xmrig | e847061a0767d6446ae2416c24d5e4c28fd03ca9353f5d391d4b1de311f50da4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
Size 1.4MB
Sample240518-jg6fqsaa42
SHA256 e847061a0767d6446ae2416c24d5e4c28fd03ca9353f5d391d4b1de311f50da4
MD5 ad1d06114d96dde98d2fd38781214110
SHA1 6c7fcf062c028696074d215ef0b0167e401e21b9
SHA512 cc151ce8fb79a7349439a631b937e6d8f8d7db476315b85060f017fa89e0c94b8783e55ea52aae39fca3aac18f5a0bad03e547d477e59741c578880cfeb25100
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZm:ROdWCCi7/rahW/dLUoJlruRXPm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral2/memory/2912-56-0x00007FF793CC0000-0x00007FF794011000-memory.dmp	xmrig
behavioral2/memory/2500-296-0x00007FF6D7FC0000-0x00007FF6D8311000-memory.dmp	xmrig
behavioral2/memory/1284-267-0x00007FF71C710000-0x00007FF71CA61000-memory.dmp	xmrig
behavioral2/memory/3656-318-0x00007FF75EBB0000-0x00007FF75EF01000-memory.dmp	xmrig
behavioral2/memory/1584-315-0x00007FF697940000-0x00007FF697C91000-memory.dmp	xmrig
behavioral2/memory/3376-333-0x00007FF7C9210000-0x00007FF7C9561000-memory.dmp	xmrig
behavioral2/memory/4584-348-0x00007FF64FE40000-0x00007FF650191000-memory.dmp	xmrig
behavioral2/memory/656-352-0x00007FF6674A0000-0x00007FF6677F1000-memory.dmp	xmrig
behavioral2/memory/4304-358-0x00007FF6EC3F0000-0x00007FF6EC741000-memory.dmp	xmrig
behavioral2/memory/2276-357-0x00007FF7FB6C0000-0x00007FF7FBA11000-memory.dmp	xmrig
behavioral2/memory/3976-356-0x00007FF7D0750000-0x00007FF7D0AA1000-memory.dmp	xmrig
behavioral2/memory/4440-353-0x00007FF7AB590000-0x00007FF7AB8E1000-memory.dmp	xmrig
behavioral2/memory/4808-350-0x00007FF6B7370000-0x00007FF6B76C1000-memory.dmp	xmrig
behavioral2/memory/4784-2133-0x00007FF7CC540000-0x00007FF7CC891000-memory.dmp	xmrig
behavioral2/memory/4332-349-0x00007FF7B5130000-0x00007FF7B5481000-memory.dmp	xmrig
behavioral2/memory/2236-340-0x00007FF789A00000-0x00007FF789D51000-memory.dmp	xmrig
behavioral2/memory/1220-266-0x00007FF7988D0000-0x00007FF798C21000-memory.dmp	xmrig
behavioral2/memory/2940-51-0x00007FF69FA30000-0x00007FF69FD81000-memory.dmp	xmrig
behavioral2/memory/1756-32-0x00007FF6653E0000-0x00007FF665731000-memory.dmp	xmrig
behavioral2/memory/2136-30-0x00007FF702E70000-0x00007FF7031C1000-memory.dmp	xmrig
behavioral2/memory/3932-17-0x00007FF799790000-0x00007FF799AE1000-memory.dmp	xmrig
behavioral2/memory/3924-2201-0x00007FF60C700000-0x00007FF60CA51000-memory.dmp	xmrig
behavioral2/memory/3068-2231-0x00007FF665650000-0x00007FF6659A1000-memory.dmp	xmrig
behavioral2/memory/2136-2235-0x00007FF702E70000-0x00007FF7031C1000-memory.dmp	xmrig
behavioral2/memory/5028-2236-0x00007FF66C9E0000-0x00007FF66CD31000-memory.dmp	xmrig
behavioral2/memory/3664-2237-0x00007FF6DCE30000-0x00007FF6DD181000-memory.dmp	xmrig
behavioral2/memory/5032-2238-0x00007FF6513D0000-0x00007FF651721000-memory.dmp	xmrig
behavioral2/memory/3352-2239-0x00007FF659430000-0x00007FF659781000-memory.dmp	xmrig
behavioral2/memory/4468-2240-0x00007FF74B600000-0x00007FF74B951000-memory.dmp	xmrig
behavioral2/memory/2372-2242-0x00007FF6596D0000-0x00007FF659A21000-memory.dmp	xmrig
behavioral2/memory/2916-2241-0x00007FF674650000-0x00007FF6749A1000-memory.dmp	xmrig
behavioral2/memory/3924-2244-0x00007FF60C700000-0x00007FF60CA51000-memory.dmp	xmrig
behavioral2/memory/3932-2246-0x00007FF799790000-0x00007FF799AE1000-memory.dmp	xmrig
behavioral2/memory/3068-2271-0x00007FF665650000-0x00007FF6659A1000-memory.dmp	xmrig
behavioral2/memory/2940-2287-0x00007FF69FA30000-0x00007FF69FD81000-memory.dmp	xmrig
behavioral2/memory/1756-2285-0x00007FF6653E0000-0x00007FF665731000-memory.dmp	xmrig
behavioral2/memory/2136-2289-0x00007FF702E70000-0x00007FF7031C1000-memory.dmp	xmrig
behavioral2/memory/2912-2305-0x00007FF793CC0000-0x00007FF794011000-memory.dmp	xmrig
behavioral2/memory/4440-2311-0x00007FF7AB590000-0x00007FF7AB8E1000-memory.dmp	xmrig
behavioral2/memory/3664-2313-0x00007FF6DCE30000-0x00007FF6DD181000-memory.dmp	xmrig
behavioral2/memory/3976-2309-0x00007FF7D0750000-0x00007FF7D0AA1000-memory.dmp	xmrig
behavioral2/memory/5028-2308-0x00007FF66C9E0000-0x00007FF66CD31000-memory.dmp	xmrig
behavioral2/memory/1220-2322-0x00007FF7988D0000-0x00007FF798C21000-memory.dmp	xmrig
behavioral2/memory/5032-2329-0x00007FF6513D0000-0x00007FF651721000-memory.dmp	xmrig
behavioral2/memory/2500-2334-0x00007FF6D7FC0000-0x00007FF6D8311000-memory.dmp	xmrig
behavioral2/memory/4304-2331-0x00007FF6EC3F0000-0x00007FF6EC741000-memory.dmp	xmrig
behavioral2/memory/2372-2326-0x00007FF6596D0000-0x00007FF659A21000-memory.dmp	xmrig
behavioral2/memory/2276-2324-0x00007FF7FB6C0000-0x00007FF7FBA11000-memory.dmp	xmrig
behavioral2/memory/3352-2320-0x00007FF659430000-0x00007FF659781000-memory.dmp	xmrig
behavioral2/memory/2916-2318-0x00007FF674650000-0x00007FF6749A1000-memory.dmp	xmrig
behavioral2/memory/4468-2316-0x00007FF74B600000-0x00007FF74B951000-memory.dmp	xmrig
behavioral2/memory/656-2328-0x00007FF6674A0000-0x00007FF6677F1000-memory.dmp	xmrig
behavioral2/memory/1584-2341-0x00007FF697940000-0x00007FF697C91000-memory.dmp	xmrig
behavioral2/memory/3656-2353-0x00007FF75EBB0000-0x00007FF75EF01000-memory.dmp	xmrig
behavioral2/memory/2236-2350-0x00007FF789A00000-0x00007FF789D51000-memory.dmp	xmrig
behavioral2/memory/4584-2346-0x00007FF64FE40000-0x00007FF650191000-memory.dmp	xmrig
behavioral2/memory/3376-2352-0x00007FF7C9210000-0x00007FF7C9561000-memory.dmp	xmrig
behavioral2/memory/4332-2348-0x00007FF7B5130000-0x00007FF7B5481000-memory.dmp	xmrig
behavioral2/memory/4808-2344-0x00007FF6B7370000-0x00007FF6B76C1000-memory.dmp	xmrig
behavioral2/memory/1284-2336-0x00007FF71C710000-0x00007FF71CA61000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3924	LAfKlIA.exe
3932	ZXRjWlz.exe
3068	oPVIlhs.exe
1756	jVseFOl.exe
2136	fTbnBck.exe
2940	IVCqmbs.exe
2912	yEzICEl.exe
5028	ybeRMcZ.exe
3664	DsFjDqG.exe
656	lhnzDOM.exe
5032	BHGSJno.exe
4440	OrmPKqn.exe
3976	MEJPvHp.exe
2276	ecKUPWc.exe
4468	rIQgbTJ.exe
2916	SzCatAW.exe
2372	NHxPQjU.exe
3352	yCObzXu.exe
1220	dfduxYI.exe
4304	gKZusPB.exe
1284	EQRjbfd.exe
2500	DXFGphB.exe
1584	UPspNTr.exe
3656	NBCawiT.exe
3376	WvtEXrP.exe
2236	zLlhoWc.exe
4584	uQPAOJI.exe
4332	BEKBgco.exe
4808	EqzwJNv.exe
3408	sznntYb.exe
3172	zYIcqSK.exe
4852	IqPXThv.exe
1184	HExFZgD.exe
3548	kUlsTRy.exe
1508	HgPInCC.exe
2284	sJKtDwr.exe
3744	jADqHNR.exe
2132	kKeZAgI.exe
2304	ukjQcsB.exe
1044	AWFIXWO.exe
916	WvsbMam.exe
4152	NmbwZxh.exe
5000	dxJDMYJ.exe
4752	ShXGVhb.exe
392	FUpHzDN.exe
1676	bHhwonO.exe
3588	dpDrMOP.exe
220	QoFbsfT.exe
3668	NQNKobT.exe
3856	ZZXMEeu.exe
4280	ygGCzqA.exe
4268	GFrrDSJ.exe
3400	HRDSfbh.exe
1272	PpECdkd.exe
896	igQxQXJ.exe
2380	ptuvdCD.exe
3380	fXkOjYD.exe
3048	TtTiKUw.exe
1496	GqlGoBA.exe
4224	Ccjnyvi.exe
4544	tSKaZoV.exe
2332	nfKQABG.exe
640	ZjGROOT.exe
4580	HMbViJK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4784-0-0x00007FF7CC540000-0x00007FF7CC891000-memory.dmp	upx
behavioral2/files/0x000800000002341d-4.dat	upx
behavioral2/files/0x0007000000023421-10.dat	upx
behavioral2/files/0x0007000000023422-16.dat	upx
behavioral2/memory/3068-25-0x00007FF665650000-0x00007FF6659A1000-memory.dmp	upx
behavioral2/files/0x0007000000023426-41.dat	upx
behavioral2/files/0x0007000000023428-50.dat	upx
behavioral2/memory/2912-56-0x00007FF793CC0000-0x00007FF794011000-memory.dmp	upx
behavioral2/files/0x000700000002342b-67.dat	upx
behavioral2/memory/5032-88-0x00007FF6513D0000-0x00007FF651721000-memory.dmp	upx
behavioral2/memory/2916-95-0x00007FF674650000-0x00007FF6749A1000-memory.dmp	upx
behavioral2/files/0x0007000000023430-101.dat	upx
behavioral2/files/0x0007000000023431-107.dat	upx
behavioral2/files/0x0007000000023434-119.dat	upx
behavioral2/files/0x0007000000023436-128.dat	upx
behavioral2/files/0x0007000000023437-134.dat	upx
behavioral2/files/0x0007000000023439-153.dat	upx
behavioral2/files/0x000700000002343d-163.dat	upx
behavioral2/files/0x000700000002343f-174.dat	upx
behavioral2/memory/2500-296-0x00007FF6D7FC0000-0x00007FF6D8311000-memory.dmp	upx
behavioral2/memory/1284-267-0x00007FF71C710000-0x00007FF71CA61000-memory.dmp	upx
behavioral2/memory/3656-318-0x00007FF75EBB0000-0x00007FF75EF01000-memory.dmp	upx
behavioral2/memory/1584-315-0x00007FF697940000-0x00007FF697C91000-memory.dmp	upx
behavioral2/memory/3376-333-0x00007FF7C9210000-0x00007FF7C9561000-memory.dmp	upx
behavioral2/memory/4584-348-0x00007FF64FE40000-0x00007FF650191000-memory.dmp	upx
behavioral2/memory/656-352-0x00007FF6674A0000-0x00007FF6677F1000-memory.dmp	upx
behavioral2/memory/4304-358-0x00007FF6EC3F0000-0x00007FF6EC741000-memory.dmp	upx
behavioral2/memory/2276-357-0x00007FF7FB6C0000-0x00007FF7FBA11000-memory.dmp	upx
behavioral2/memory/3976-356-0x00007FF7D0750000-0x00007FF7D0AA1000-memory.dmp	upx
behavioral2/memory/4440-353-0x00007FF7AB590000-0x00007FF7AB8E1000-memory.dmp	upx
behavioral2/memory/4808-350-0x00007FF6B7370000-0x00007FF6B76C1000-memory.dmp	upx
behavioral2/memory/4784-2133-0x00007FF7CC540000-0x00007FF7CC891000-memory.dmp	upx
behavioral2/memory/4332-349-0x00007FF7B5130000-0x00007FF7B5481000-memory.dmp	upx
behavioral2/memory/2236-340-0x00007FF789A00000-0x00007FF789D51000-memory.dmp	upx
behavioral2/memory/1220-266-0x00007FF7988D0000-0x00007FF798C21000-memory.dmp	upx
behavioral2/memory/3352-265-0x00007FF659430000-0x00007FF659781000-memory.dmp	upx
behavioral2/files/0x000700000002343e-169.dat	upx
behavioral2/files/0x000700000002343c-159.dat	upx
behavioral2/files/0x000700000002343b-157.dat	upx
behavioral2/files/0x000700000002343a-155.dat	upx
behavioral2/files/0x0007000000023438-151.dat	upx
behavioral2/files/0x0007000000023435-124.dat	upx
behavioral2/files/0x0007000000023433-114.dat	upx
behavioral2/files/0x0007000000023432-105.dat	upx
behavioral2/memory/2372-103-0x00007FF6596D0000-0x00007FF659A21000-memory.dmp	upx
behavioral2/files/0x000700000002342f-99.dat	upx
behavioral2/files/0x000700000002342e-98.dat	upx
behavioral2/files/0x000700000002342d-97.dat	upx
behavioral2/files/0x000700000002342a-93.dat	upx
behavioral2/files/0x0007000000023429-92.dat	upx
behavioral2/memory/4468-89-0x00007FF74B600000-0x00007FF74B951000-memory.dmp	upx
behavioral2/memory/3664-80-0x00007FF6DCE30000-0x00007FF6DD181000-memory.dmp	upx
behavioral2/files/0x000700000002342c-75.dat	upx
behavioral2/memory/5028-60-0x00007FF66C9E0000-0x00007FF66CD31000-memory.dmp	upx
behavioral2/files/0x0007000000023427-59.dat	upx
behavioral2/memory/2940-51-0x00007FF69FA30000-0x00007FF69FD81000-memory.dmp	upx
behavioral2/files/0x0007000000023425-36.dat	upx
behavioral2/memory/1756-32-0x00007FF6653E0000-0x00007FF665731000-memory.dmp	upx
behavioral2/memory/2136-30-0x00007FF702E70000-0x00007FF7031C1000-memory.dmp	upx
behavioral2/files/0x0007000000023424-29.dat	upx
behavioral2/files/0x0007000000023423-27.dat	upx
behavioral2/memory/3932-17-0x00007FF799790000-0x00007FF799AE1000-memory.dmp	upx
behavioral2/memory/3924-15-0x00007FF60C700000-0x00007FF60CA51000-memory.dmp	upx
behavioral2/memory/3924-2201-0x00007FF60C700000-0x00007FF60CA51000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FLpuNoN.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\KpyOafM.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\BqLQIrp.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\jmRANjg.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\tfzzYvM.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\YoYVEVb.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\FRyFBtR.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\ByGIbjA.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\aOUvLuh.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\yVhYPsW.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\dkGQijI.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\ldXaXQF.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\uoPKRzN.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\cFbzFCd.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\VMHHmTx.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\VRlCBhv.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\OzLQTGE.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\orKGdNk.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\KoMnmjh.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\UPspNTr.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\PqBBfEB.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\mphoawK.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\EDrYbJw.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\adubCWG.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\EOEWUyG.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\rIQgbTJ.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\wbsPCVh.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\qlbQzyV.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\NfNLppU.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\uxQsbRv.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\aLEuJVV.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\WEuJZaZ.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\ZTvXCMV.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\TDMBckx.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\AtbUApS.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\hcccvDV.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\RAszTgz.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\SCxtqgW.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\mMynEWc.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\BThDBoy.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\vPAFflY.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\sSBItdo.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\fqTZAVc.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\rGzqSOO.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\eOoOLhf.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\anbFrju.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\upVaJdd.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\fJgWOmh.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\arsGdmg.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\EQRjbfd.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\GFrrDSJ.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\PpECdkd.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\igQxQXJ.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\UFqZbdl.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\rjavWkk.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\WvtEXrP.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\lKtywSI.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\QKkQKpr.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\IYNDNuW.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\hoZaxqI.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\AxUSFGD.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\HhAPWMe.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\aioGwmm.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
File created	C:\Windows\System\wvOOOmh.exe	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 3924	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	84
PID 4784 wrote to memory of 3924	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	84
PID 4784 wrote to memory of 3932	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	85
PID 4784 wrote to memory of 3932	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	85
PID 4784 wrote to memory of 3068	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	86
PID 4784 wrote to memory of 3068	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	86
PID 4784 wrote to memory of 1756	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	87
PID 4784 wrote to memory of 1756	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	87
PID 4784 wrote to memory of 2136	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	88
PID 4784 wrote to memory of 2136	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	88
PID 4784 wrote to memory of 2940	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	89
PID 4784 wrote to memory of 2940	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	89
PID 4784 wrote to memory of 2912	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	90
PID 4784 wrote to memory of 2912	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	90
PID 4784 wrote to memory of 5028	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	91
PID 4784 wrote to memory of 5028	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	91
PID 4784 wrote to memory of 3664	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	92
PID 4784 wrote to memory of 3664	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	92
PID 4784 wrote to memory of 656	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	93
PID 4784 wrote to memory of 656	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	93
PID 4784 wrote to memory of 5032	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	94
PID 4784 wrote to memory of 5032	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	94
PID 4784 wrote to memory of 4440	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	95
PID 4784 wrote to memory of 4440	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	95
PID 4784 wrote to memory of 3976	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	96
PID 4784 wrote to memory of 3976	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	96
PID 4784 wrote to memory of 2276	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	97
PID 4784 wrote to memory of 2276	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	97
PID 4784 wrote to memory of 4468	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	98
PID 4784 wrote to memory of 4468	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	98
PID 4784 wrote to memory of 2916	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	99
PID 4784 wrote to memory of 2916	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	99
PID 4784 wrote to memory of 2372	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	100
PID 4784 wrote to memory of 2372	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	100
PID 4784 wrote to memory of 3352	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	101
PID 4784 wrote to memory of 3352	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	101
PID 4784 wrote to memory of 1220	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	102
PID 4784 wrote to memory of 1220	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	102
PID 4784 wrote to memory of 4304	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	103
PID 4784 wrote to memory of 4304	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	103
PID 4784 wrote to memory of 1284	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	104
PID 4784 wrote to memory of 1284	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	104
PID 4784 wrote to memory of 2500	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	105
PID 4784 wrote to memory of 2500	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	105
PID 4784 wrote to memory of 1584	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	106
PID 4784 wrote to memory of 1584	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	106
PID 4784 wrote to memory of 3656	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	107
PID 4784 wrote to memory of 3656	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	107
PID 4784 wrote to memory of 3376	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	108
PID 4784 wrote to memory of 3376	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	108
PID 4784 wrote to memory of 2236	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	109
PID 4784 wrote to memory of 2236	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	109
PID 4784 wrote to memory of 4584	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	110
PID 4784 wrote to memory of 4584	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	110
PID 4784 wrote to memory of 4332	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	111
PID 4784 wrote to memory of 4332	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	111
PID 4784 wrote to memory of 4808	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	112
PID 4784 wrote to memory of 4808	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	112
PID 4784 wrote to memory of 3408	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	113
PID 4784 wrote to memory of 3408	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	113
PID 4784 wrote to memory of 3172	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	114
PID 4784 wrote to memory of 3172	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	114
PID 4784 wrote to memory of 4852	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	115
PID 4784 wrote to memory of 4852	4784	ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ad1d06114d96dde98d2fd38781214110_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\System\LAfKlIA.exe
  C:\Windows\System\LAfKlIA.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\ZXRjWlz.exe
  C:\Windows\System\ZXRjWlz.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\oPVIlhs.exe
  C:\Windows\System\oPVIlhs.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\jVseFOl.exe
  C:\Windows\System\jVseFOl.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\fTbnBck.exe
  C:\Windows\System\fTbnBck.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\IVCqmbs.exe
  C:\Windows\System\IVCqmbs.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\yEzICEl.exe
  C:\Windows\System\yEzICEl.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\ybeRMcZ.exe
  C:\Windows\System\ybeRMcZ.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\DsFjDqG.exe
  C:\Windows\System\DsFjDqG.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\lhnzDOM.exe
  C:\Windows\System\lhnzDOM.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\BHGSJno.exe
  C:\Windows\System\BHGSJno.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\OrmPKqn.exe
  C:\Windows\System\OrmPKqn.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\MEJPvHp.exe
  C:\Windows\System\MEJPvHp.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\ecKUPWc.exe
  C:\Windows\System\ecKUPWc.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\rIQgbTJ.exe
  C:\Windows\System\rIQgbTJ.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\SzCatAW.exe
  C:\Windows\System\SzCatAW.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\NHxPQjU.exe
  C:\Windows\System\NHxPQjU.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\yCObzXu.exe
  C:\Windows\System\yCObzXu.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\dfduxYI.exe
  C:\Windows\System\dfduxYI.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\gKZusPB.exe
  C:\Windows\System\gKZusPB.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\EQRjbfd.exe
  C:\Windows\System\EQRjbfd.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\DXFGphB.exe
  C:\Windows\System\DXFGphB.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\UPspNTr.exe
  C:\Windows\System\UPspNTr.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\NBCawiT.exe
  C:\Windows\System\NBCawiT.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\WvtEXrP.exe
  C:\Windows\System\WvtEXrP.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\zLlhoWc.exe
  C:\Windows\System\zLlhoWc.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\uQPAOJI.exe
  C:\Windows\System\uQPAOJI.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\BEKBgco.exe
  C:\Windows\System\BEKBgco.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\EqzwJNv.exe
  C:\Windows\System\EqzwJNv.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\sznntYb.exe
  C:\Windows\System\sznntYb.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\zYIcqSK.exe
  C:\Windows\System\zYIcqSK.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\IqPXThv.exe
  C:\Windows\System\IqPXThv.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\HExFZgD.exe
  C:\Windows\System\HExFZgD.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\kUlsTRy.exe
  C:\Windows\System\kUlsTRy.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\HgPInCC.exe
  C:\Windows\System\HgPInCC.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\sJKtDwr.exe
  C:\Windows\System\sJKtDwr.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\jADqHNR.exe
  C:\Windows\System\jADqHNR.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\kKeZAgI.exe
  C:\Windows\System\kKeZAgI.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\ukjQcsB.exe
  C:\Windows\System\ukjQcsB.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\AWFIXWO.exe
  C:\Windows\System\AWFIXWO.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\WvsbMam.exe
  C:\Windows\System\WvsbMam.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\NmbwZxh.exe
  C:\Windows\System\NmbwZxh.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\dxJDMYJ.exe
  C:\Windows\System\dxJDMYJ.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\ShXGVhb.exe
  C:\Windows\System\ShXGVhb.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\FUpHzDN.exe
  C:\Windows\System\FUpHzDN.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\bHhwonO.exe
  C:\Windows\System\bHhwonO.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\dpDrMOP.exe
  C:\Windows\System\dpDrMOP.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\Ccjnyvi.exe
  C:\Windows\System\Ccjnyvi.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\QoFbsfT.exe
  C:\Windows\System\QoFbsfT.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\NQNKobT.exe
  C:\Windows\System\NQNKobT.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\ZZXMEeu.exe
  C:\Windows\System\ZZXMEeu.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\ygGCzqA.exe
  C:\Windows\System\ygGCzqA.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\GFrrDSJ.exe
  C:\Windows\System\GFrrDSJ.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\HRDSfbh.exe
  C:\Windows\System\HRDSfbh.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\PpECdkd.exe
  C:\Windows\System\PpECdkd.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\igQxQXJ.exe
  C:\Windows\System\igQxQXJ.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\ptuvdCD.exe
  C:\Windows\System\ptuvdCD.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\fXkOjYD.exe
  C:\Windows\System\fXkOjYD.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\TtTiKUw.exe
  C:\Windows\System\TtTiKUw.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\GqlGoBA.exe
  C:\Windows\System\GqlGoBA.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\tSKaZoV.exe
  C:\Windows\System\tSKaZoV.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\nfKQABG.exe
  C:\Windows\System\nfKQABG.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\oJQjrpP.exe
  C:\Windows\System\oJQjrpP.exe
  2⤵
  PID:4488
- C:\Windows\System\ZjGROOT.exe
  C:\Windows\System\ZjGROOT.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\HMbViJK.exe
  C:\Windows\System\HMbViJK.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\QeRlRtC.exe
  C:\Windows\System\QeRlRtC.exe
  2⤵
  PID:2692
- C:\Windows\System\PbEGqjV.exe
  C:\Windows\System\PbEGqjV.exe
  2⤵
  PID:3224
- C:\Windows\System\CHIRKMl.exe
  C:\Windows\System\CHIRKMl.exe
  2⤵
  PID:4636
- C:\Windows\System\adwMSxd.exe
  C:\Windows\System\adwMSxd.exe
  2⤵
  PID:432
- C:\Windows\System\Nydqybg.exe
  C:\Windows\System\Nydqybg.exe
  2⤵
  PID:5100
- C:\Windows\System\WmmVOtz.exe
  C:\Windows\System\WmmVOtz.exe
  2⤵
  PID:4032
- C:\Windows\System\klVMypI.exe
  C:\Windows\System\klVMypI.exe
  2⤵
  PID:3596
- C:\Windows\System\fpUpDwy.exe
  C:\Windows\System\fpUpDwy.exe
  2⤵
  PID:2088
- C:\Windows\System\AxUSFGD.exe
  C:\Windows\System\AxUSFGD.exe
  2⤵
  PID:1948
- C:\Windows\System\VPQHrka.exe
  C:\Windows\System\VPQHrka.exe
  2⤵
  PID:376
- C:\Windows\System\mOTMEoS.exe
  C:\Windows\System\mOTMEoS.exe
  2⤵
  PID:4524
- C:\Windows\System\ExMrdGS.exe
  C:\Windows\System\ExMrdGS.exe
  2⤵
  PID:3056
- C:\Windows\System\NmAmKJp.exe
  C:\Windows\System\NmAmKJp.exe
  2⤵
  PID:4600
- C:\Windows\System\NinSUcS.exe
  C:\Windows\System\NinSUcS.exe
  2⤵
  PID:1264
- C:\Windows\System\zTGqeyw.exe
  C:\Windows\System\zTGqeyw.exe
  2⤵
  PID:4292
- C:\Windows\System\HueNnmA.exe
  C:\Windows\System\HueNnmA.exe
  2⤵
  PID:1628
- C:\Windows\System\HYeywMj.exe
  C:\Windows\System\HYeywMj.exe
  2⤵
  PID:2876
- C:\Windows\System\wbsPCVh.exe
  C:\Windows\System\wbsPCVh.exe
  2⤵
  PID:2632
- C:\Windows\System\eykJFVF.exe
  C:\Windows\System\eykJFVF.exe
  2⤵
  PID:4472
- C:\Windows\System\ZbacZza.exe
  C:\Windows\System\ZbacZza.exe
  2⤵
  PID:5136
- C:\Windows\System\VYWBHbO.exe
  C:\Windows\System\VYWBHbO.exe
  2⤵
  PID:5152
- C:\Windows\System\LeEhAMo.exe
  C:\Windows\System\LeEhAMo.exe
  2⤵
  PID:5180
- C:\Windows\System\ZlaVZQM.exe
  C:\Windows\System\ZlaVZQM.exe
  2⤵
  PID:5700
- C:\Windows\System\UFqZbdl.exe
  C:\Windows\System\UFqZbdl.exe
  2⤵
  PID:5740
- C:\Windows\System\sbfVCgW.exe
  C:\Windows\System\sbfVCgW.exe
  2⤵
  PID:5768
- C:\Windows\System\ZLPTogJ.exe
  C:\Windows\System\ZLPTogJ.exe
  2⤵
  PID:5796
- C:\Windows\System\wMFJlFh.exe
  C:\Windows\System\wMFJlFh.exe
  2⤵
  PID:5824
- C:\Windows\System\qmXhVJa.exe
  C:\Windows\System\qmXhVJa.exe
  2⤵
  PID:5852
- C:\Windows\System\qlbQzyV.exe
  C:\Windows\System\qlbQzyV.exe
  2⤵
  PID:5880
- C:\Windows\System\aWcUZsN.exe
  C:\Windows\System\aWcUZsN.exe
  2⤵
  PID:5908
- C:\Windows\System\WgXKWzG.exe
  C:\Windows\System\WgXKWzG.exe
  2⤵
  PID:5936
- C:\Windows\System\UhpenAG.exe
  C:\Windows\System\UhpenAG.exe
  2⤵
  PID:5964
- C:\Windows\System\EuUhdsD.exe
  C:\Windows\System\EuUhdsD.exe
  2⤵
  PID:5992
- C:\Windows\System\HiikzHJ.exe
  C:\Windows\System\HiikzHJ.exe
  2⤵
  PID:6020
- C:\Windows\System\EgSqVlQ.exe
  C:\Windows\System\EgSqVlQ.exe
  2⤵
  PID:6048
- C:\Windows\System\GOjFJLl.exe
  C:\Windows\System\GOjFJLl.exe
  2⤵
  PID:6076
- C:\Windows\System\iEBwWeo.exe
  C:\Windows\System\iEBwWeo.exe
  2⤵
  PID:6104
- C:\Windows\System\KiXVrqV.exe
  C:\Windows\System\KiXVrqV.exe
  2⤵
  PID:6132
- C:\Windows\System\rjwhYCS.exe
  C:\Windows\System\rjwhYCS.exe
  2⤵
  PID:4436
- C:\Windows\System\JMhhxIo.exe
  C:\Windows\System\JMhhxIo.exe
  2⤵
  PID:4416
- C:\Windows\System\YDmYoTH.exe
  C:\Windows\System\YDmYoTH.exe
  2⤵
  PID:4072
- C:\Windows\System\thyGbLT.exe
  C:\Windows\System\thyGbLT.exe
  2⤵
  PID:1984
- C:\Windows\System\ZwxvmEo.exe
  C:\Windows\System\ZwxvmEo.exe
  2⤵
  PID:2300
- C:\Windows\System\jDkiUVX.exe
  C:\Windows\System\jDkiUVX.exe
  2⤵
  PID:4200
- C:\Windows\System\VcwqGWR.exe
  C:\Windows\System\VcwqGWR.exe
  2⤵
  PID:2924
- C:\Windows\System\kttjjth.exe
  C:\Windows\System\kttjjth.exe
  2⤵
  PID:3812
- C:\Windows\System\XFdwlfc.exe
  C:\Windows\System\XFdwlfc.exe
  2⤵
  PID:4604
- C:\Windows\System\rxJylBj.exe
  C:\Windows\System\rxJylBj.exe
  2⤵
  PID:1480
- C:\Windows\System\rcZsceB.exe
  C:\Windows\System\rcZsceB.exe
  2⤵
  PID:1200
- C:\Windows\System\mMynEWc.exe
  C:\Windows\System\mMynEWc.exe
  2⤵
  PID:5148
- C:\Windows\System\VdQvNfo.exe
  C:\Windows\System\VdQvNfo.exe
  2⤵
  PID:4460
- C:\Windows\System\iIGZmoG.exe
  C:\Windows\System\iIGZmoG.exe
  2⤵
  PID:884
- C:\Windows\System\iDqyarS.exe
  C:\Windows\System\iDqyarS.exe
  2⤵
  PID:5204
- C:\Windows\System\JoJmIxM.exe
  C:\Windows\System\JoJmIxM.exe
  2⤵
  PID:5268
- C:\Windows\System\IzVbLYH.exe
  C:\Windows\System\IzVbLYH.exe
  2⤵
  PID:2704
- C:\Windows\System\SOIoEsP.exe
  C:\Windows\System\SOIoEsP.exe
  2⤵
  PID:6028
- C:\Windows\System\RbZiqng.exe
  C:\Windows\System\RbZiqng.exe
  2⤵
  PID:5976
- C:\Windows\System\upVaJdd.exe
  C:\Windows\System\upVaJdd.exe
  2⤵
  PID:5948
- C:\Windows\System\rRxWoXE.exe
  C:\Windows\System\rRxWoXE.exe
  2⤵
  PID:5900
- C:\Windows\System\lYuiIXh.exe
  C:\Windows\System\lYuiIXh.exe
  2⤵
  PID:5844
- C:\Windows\System\wZrZeEr.exe
  C:\Windows\System\wZrZeEr.exe
  2⤵
  PID:5804
- C:\Windows\System\JBzxsyu.exe
  C:\Windows\System\JBzxsyu.exe
  2⤵
  PID:5760
- C:\Windows\System\fJgWOmh.exe
  C:\Windows\System\fJgWOmh.exe
  2⤵
  PID:3896
- C:\Windows\System\ZaSYCMF.exe
  C:\Windows\System\ZaSYCMF.exe
  2⤵
  PID:5628
- C:\Windows\System\GfgpZvY.exe
  C:\Windows\System\GfgpZvY.exe
  2⤵
  PID:5596
- C:\Windows\System\FLpuNoN.exe
  C:\Windows\System\FLpuNoN.exe
  2⤵
  PID:5528
- C:\Windows\System\PUbICfC.exe
  C:\Windows\System\PUbICfC.exe
  2⤵
  PID:5452
- C:\Windows\System\OgxwZUB.exe
  C:\Windows\System\OgxwZUB.exe
  2⤵
  PID:5400
- C:\Windows\System\UOAviTJ.exe
  C:\Windows\System\UOAviTJ.exe
  2⤵
  PID:5344
- C:\Windows\System\pYrKZDW.exe
  C:\Windows\System\pYrKZDW.exe
  2⤵
  PID:5296
- C:\Windows\System\dUFoyZG.exe
  C:\Windows\System\dUFoyZG.exe
  2⤵
  PID:6140
- C:\Windows\System\URjXYTq.exe
  C:\Windows\System\URjXYTq.exe
  2⤵
  PID:2428
- C:\Windows\System\uLJiJIU.exe
  C:\Windows\System\uLJiJIU.exe
  2⤵
  PID:1348
- C:\Windows\System\FADLHdr.exe
  C:\Windows\System\FADLHdr.exe
  2⤵
  PID:3156
- C:\Windows\System\IkeaREl.exe
  C:\Windows\System\IkeaREl.exe
  2⤵
  PID:1572
- C:\Windows\System\TDMBckx.exe
  C:\Windows\System\TDMBckx.exe
  2⤵
  PID:4212
- C:\Windows\System\GeEEpRe.exe
  C:\Windows\System\GeEEpRe.exe
  2⤵
  PID:3328
- C:\Windows\System\pUVMpBd.exe
  C:\Windows\System\pUVMpBd.exe
  2⤵
  PID:4816
- C:\Windows\System\MZOMGoJ.exe
  C:\Windows\System\MZOMGoJ.exe
  2⤵
  PID:3628
- C:\Windows\System\KpyOafM.exe
  C:\Windows\System\KpyOafM.exe
  2⤵
  PID:4640
- C:\Windows\System\bnfrLfO.exe
  C:\Windows\System\bnfrLfO.exe
  2⤵
  PID:232
- C:\Windows\System\voHhJMh.exe
  C:\Windows\System\voHhJMh.exe
  2⤵
  PID:2636
- C:\Windows\System\PIhgBQJ.exe
  C:\Windows\System\PIhgBQJ.exe
  2⤵
  PID:2172
- C:\Windows\System\lAwbKSj.exe
  C:\Windows\System\lAwbKSj.exe
  2⤵
  PID:4376
- C:\Windows\System\NfNLppU.exe
  C:\Windows\System\NfNLppU.exe
  2⤵
  PID:5124
- C:\Windows\System\kxfmylh.exe
  C:\Windows\System\kxfmylh.exe
  2⤵
  PID:6032
- C:\Windows\System\cXruLZz.exe
  C:\Windows\System\cXruLZz.exe
  2⤵
  PID:5892
- C:\Windows\System\cqyqWPw.exe
  C:\Windows\System\cqyqWPw.exe
  2⤵
  PID:4620
- C:\Windows\System\xHqjikW.exe
  C:\Windows\System\xHqjikW.exe
  2⤵
  PID:3860
- C:\Windows\System\kcNQMyV.exe
  C:\Windows\System\kcNQMyV.exe
  2⤵
  PID:5320
- C:\Windows\System\AHGJhsT.exe
  C:\Windows\System\AHGJhsT.exe
  2⤵
  PID:5972
- C:\Windows\System\vyYcHof.exe
  C:\Windows\System\vyYcHof.exe
  2⤵
  PID:968
- C:\Windows\System\lKtywSI.exe
  C:\Windows\System\lKtywSI.exe
  2⤵
  PID:5436
- C:\Windows\System\rrLYsAg.exe
  C:\Windows\System\rrLYsAg.exe
  2⤵
  PID:5012
- C:\Windows\System\sTQUjkn.exe
  C:\Windows\System\sTQUjkn.exe
  2⤵
  PID:3392
- C:\Windows\System\vpTzild.exe
  C:\Windows\System\vpTzild.exe
  2⤵
  PID:5428
- C:\Windows\System\dpUdkqS.exe
  C:\Windows\System\dpUdkqS.exe
  2⤵
  PID:6164
- C:\Windows\System\cSrkMIu.exe
  C:\Windows\System\cSrkMIu.exe
  2⤵
  PID:6184
- C:\Windows\System\aOUvLuh.exe
  C:\Windows\System\aOUvLuh.exe
  2⤵
  PID:6200
- C:\Windows\System\BifuBss.exe
  C:\Windows\System\BifuBss.exe
  2⤵
  PID:6224
- C:\Windows\System\qSmTXlZ.exe
  C:\Windows\System\qSmTXlZ.exe
  2⤵
  PID:6240
- C:\Windows\System\XUZLvpv.exe
  C:\Windows\System\XUZLvpv.exe
  2⤵
  PID:6268
- C:\Windows\System\XZchzld.exe
  C:\Windows\System\XZchzld.exe
  2⤵
  PID:6292
- C:\Windows\System\BThDBoy.exe
  C:\Windows\System\BThDBoy.exe
  2⤵
  PID:6308
- C:\Windows\System\ZxJBZXI.exe
  C:\Windows\System\ZxJBZXI.exe
  2⤵
  PID:6328
- C:\Windows\System\RfzuYNb.exe
  C:\Windows\System\RfzuYNb.exe
  2⤵
  PID:6348
- C:\Windows\System\iWiInYa.exe
  C:\Windows\System\iWiInYa.exe
  2⤵
  PID:6372
- C:\Windows\System\IQbEWPI.exe
  C:\Windows\System\IQbEWPI.exe
  2⤵
  PID:6388
- C:\Windows\System\twpARPc.exe
  C:\Windows\System\twpARPc.exe
  2⤵
  PID:6408
- C:\Windows\System\gIHDahH.exe
  C:\Windows\System\gIHDahH.exe
  2⤵
  PID:6436
- C:\Windows\System\TjkHVaw.exe
  C:\Windows\System\TjkHVaw.exe
  2⤵
  PID:6456
- C:\Windows\System\TRcpBJz.exe
  C:\Windows\System\TRcpBJz.exe
  2⤵
  PID:6476
- C:\Windows\System\dpDsGpK.exe
  C:\Windows\System\dpDsGpK.exe
  2⤵
  PID:6496
- C:\Windows\System\GDiJCJl.exe
  C:\Windows\System\GDiJCJl.exe
  2⤵
  PID:6516
- C:\Windows\System\elQEPIs.exe
  C:\Windows\System\elQEPIs.exe
  2⤵
  PID:6536
- C:\Windows\System\epCGLJZ.exe
  C:\Windows\System\epCGLJZ.exe
  2⤵
  PID:6560
- C:\Windows\System\zcRzqks.exe
  C:\Windows\System\zcRzqks.exe
  2⤵
  PID:6580
- C:\Windows\System\EuabaUL.exe
  C:\Windows\System\EuabaUL.exe
  2⤵
  PID:6596
- C:\Windows\System\tIaAINw.exe
  C:\Windows\System\tIaAINw.exe
  2⤵
  PID:6616
- C:\Windows\System\pPGpPDM.exe
  C:\Windows\System\pPGpPDM.exe
  2⤵
  PID:6636
- C:\Windows\System\xMnBmxs.exe
  C:\Windows\System\xMnBmxs.exe
  2⤵
  PID:6652
- C:\Windows\System\sSBItdo.exe
  C:\Windows\System\sSBItdo.exe
  2⤵
  PID:6676
- C:\Windows\System\yQfuQfY.exe
  C:\Windows\System\yQfuQfY.exe
  2⤵
  PID:6696
- C:\Windows\System\soLAdCg.exe
  C:\Windows\System\soLAdCg.exe
  2⤵
  PID:6720
- C:\Windows\System\mpKvLcx.exe
  C:\Windows\System\mpKvLcx.exe
  2⤵
  PID:6736
- C:\Windows\System\LYunBAm.exe
  C:\Windows\System\LYunBAm.exe
  2⤵
  PID:6764
- C:\Windows\System\AtbUApS.exe
  C:\Windows\System\AtbUApS.exe
  2⤵
  PID:6788
- C:\Windows\System\hcccvDV.exe
  C:\Windows\System\hcccvDV.exe
  2⤵
  PID:6808
- C:\Windows\System\MExwzBh.exe
  C:\Windows\System\MExwzBh.exe
  2⤵
  PID:6832
- C:\Windows\System\bFBUVEb.exe
  C:\Windows\System\bFBUVEb.exe
  2⤵
  PID:6856
- C:\Windows\System\RAUbOrE.exe
  C:\Windows\System\RAUbOrE.exe
  2⤵
  PID:6876
- C:\Windows\System\gwzKyXn.exe
  C:\Windows\System\gwzKyXn.exe
  2⤵
  PID:6900
- C:\Windows\System\AsFzxkq.exe
  C:\Windows\System\AsFzxkq.exe
  2⤵
  PID:6916
- C:\Windows\System\AFzXYfy.exe
  C:\Windows\System\AFzXYfy.exe
  2⤵
  PID:6944
- C:\Windows\System\GllvDkj.exe
  C:\Windows\System\GllvDkj.exe
  2⤵
  PID:6968
- C:\Windows\System\bxbJYYL.exe
  C:\Windows\System\bxbJYYL.exe
  2⤵
  PID:6988
- C:\Windows\System\nhKtLmx.exe
  C:\Windows\System\nhKtLmx.exe
  2⤵
  PID:7004
- C:\Windows\System\gfrQJMf.exe
  C:\Windows\System\gfrQJMf.exe
  2⤵
  PID:7024
- C:\Windows\System\HhAPWMe.exe
  C:\Windows\System\HhAPWMe.exe
  2⤵
  PID:7040
- C:\Windows\System\arsGdmg.exe
  C:\Windows\System\arsGdmg.exe
  2⤵
  PID:7068
- C:\Windows\System\JqjDjDX.exe
  C:\Windows\System\JqjDjDX.exe
  2⤵
  PID:7084
- C:\Windows\System\SIqqSPA.exe
  C:\Windows\System\SIqqSPA.exe
  2⤵
  PID:7112
- C:\Windows\System\cMLITIY.exe
  C:\Windows\System\cMLITIY.exe
  2⤵
  PID:7132
- C:\Windows\System\LiILkVZ.exe
  C:\Windows\System\LiILkVZ.exe
  2⤵
  PID:7164
- C:\Windows\System\LbguTpV.exe
  C:\Windows\System\LbguTpV.exe
  2⤵
  PID:1344
- C:\Windows\System\ZKjuiPv.exe
  C:\Windows\System\ZKjuiPv.exe
  2⤵
  PID:4172
- C:\Windows\System\xuBfxMN.exe
  C:\Windows\System\xuBfxMN.exe
  2⤵
  PID:5860
- C:\Windows\System\ZBWhgNN.exe
  C:\Windows\System\ZBWhgNN.exe
  2⤵
  PID:6000
- C:\Windows\System\PqOSitH.exe
  C:\Windows\System\PqOSitH.exe
  2⤵
  PID:2844
- C:\Windows\System\aeJeksr.exe
  C:\Windows\System\aeJeksr.exe
  2⤵
  PID:6152
- C:\Windows\System\PqBBfEB.exe
  C:\Windows\System\PqBBfEB.exe
  2⤵
  PID:6212
- C:\Windows\System\leoIJHT.exe
  C:\Windows\System\leoIJHT.exe
  2⤵
  PID:6340
- C:\Windows\System\JRuXnkV.exe
  C:\Windows\System\JRuXnkV.exe
  2⤵
  PID:2752
- C:\Windows\System\OmiMZAI.exe
  C:\Windows\System\OmiMZAI.exe
  2⤵
  PID:4744
- C:\Windows\System\qJtSlUm.exe
  C:\Windows\System\qJtSlUm.exe
  2⤵
  PID:1100
- C:\Windows\System\UExJKer.exe
  C:\Windows\System\UExJKer.exe
  2⤵
  PID:6572
- C:\Windows\System\OzGXliw.exe
  C:\Windows\System\OzGXliw.exe
  2⤵
  PID:5248
- C:\Windows\System\qXQozVA.exe
  C:\Windows\System\qXQozVA.exe
  2⤵
  PID:5732
- C:\Windows\System\NnVzxlk.exe
  C:\Windows\System\NnVzxlk.exe
  2⤵
  PID:7184
- C:\Windows\System\oZkhwjd.exe
  C:\Windows\System\oZkhwjd.exe
  2⤵
  PID:7204
- C:\Windows\System\shVCUDY.exe
  C:\Windows\System\shVCUDY.exe
  2⤵
  PID:7228
- C:\Windows\System\EqYtXPO.exe
  C:\Windows\System\EqYtXPO.exe
  2⤵
  PID:7244
- C:\Windows\System\lEBMVlS.exe
  C:\Windows\System\lEBMVlS.exe
  2⤵
  PID:7272
- C:\Windows\System\UrrViZG.exe
  C:\Windows\System\UrrViZG.exe
  2⤵
  PID:7296
- C:\Windows\System\bmzZUpP.exe
  C:\Windows\System\bmzZUpP.exe
  2⤵
  PID:7324
- C:\Windows\System\ZYDQVFl.exe
  C:\Windows\System\ZYDQVFl.exe
  2⤵
  PID:7340
- C:\Windows\System\RAszTgz.exe
  C:\Windows\System\RAszTgz.exe
  2⤵
  PID:7364
- C:\Windows\System\rinBlNq.exe
  C:\Windows\System\rinBlNq.exe
  2⤵
  PID:7388
- C:\Windows\System\fQJpQGn.exe
  C:\Windows\System\fQJpQGn.exe
  2⤵
  PID:7412
- C:\Windows\System\cGRxeya.exe
  C:\Windows\System\cGRxeya.exe
  2⤵
  PID:7432
- C:\Windows\System\UyxqYFR.exe
  C:\Windows\System\UyxqYFR.exe
  2⤵
  PID:7452
- C:\Windows\System\xCcrqAs.exe
  C:\Windows\System\xCcrqAs.exe
  2⤵
  PID:7472
- C:\Windows\System\KPurvdw.exe
  C:\Windows\System\KPurvdw.exe
  2⤵
  PID:7492
- C:\Windows\System\KWbvImv.exe
  C:\Windows\System\KWbvImv.exe
  2⤵
  PID:7512
- C:\Windows\System\TjEhvgz.exe
  C:\Windows\System\TjEhvgz.exe
  2⤵
  PID:7528
- C:\Windows\System\lkSRllU.exe
  C:\Windows\System\lkSRllU.exe
  2⤵
  PID:7544
- C:\Windows\System\zIUyVbS.exe
  C:\Windows\System\zIUyVbS.exe
  2⤵
  PID:7564
- C:\Windows\System\ywWwpPk.exe
  C:\Windows\System\ywWwpPk.exe
  2⤵
  PID:7584
- C:\Windows\System\VowNBDd.exe
  C:\Windows\System\VowNBDd.exe
  2⤵
  PID:7604
- C:\Windows\System\FPXcahL.exe
  C:\Windows\System\FPXcahL.exe
  2⤵
  PID:7624
- C:\Windows\System\dEmMNSP.exe
  C:\Windows\System\dEmMNSP.exe
  2⤵
  PID:7652
- C:\Windows\System\NzgPUbz.exe
  C:\Windows\System\NzgPUbz.exe
  2⤵
  PID:7676
- C:\Windows\System\yNYarQT.exe
  C:\Windows\System\yNYarQT.exe
  2⤵
  PID:7704
- C:\Windows\System\tCZGmjt.exe
  C:\Windows\System\tCZGmjt.exe
  2⤵
  PID:7724
- C:\Windows\System\abFPEaO.exe
  C:\Windows\System\abFPEaO.exe
  2⤵
  PID:7744
- C:\Windows\System\WAZcXQV.exe
  C:\Windows\System\WAZcXQV.exe
  2⤵
  PID:7764
- C:\Windows\System\bpQLkjI.exe
  C:\Windows\System\bpQLkjI.exe
  2⤵
  PID:7788
- C:\Windows\System\fYpAnbd.exe
  C:\Windows\System\fYpAnbd.exe
  2⤵
  PID:7808
- C:\Windows\System\uxQsbRv.exe
  C:\Windows\System\uxQsbRv.exe
  2⤵
  PID:7828
- C:\Windows\System\iSeVmrD.exe
  C:\Windows\System\iSeVmrD.exe
  2⤵
  PID:7848
- C:\Windows\System\ZtqNHXt.exe
  C:\Windows\System\ZtqNHXt.exe
  2⤵
  PID:7868
- C:\Windows\System\aAQTHYN.exe
  C:\Windows\System\aAQTHYN.exe
  2⤵
  PID:7888
- C:\Windows\System\CLWAzeo.exe
  C:\Windows\System\CLWAzeo.exe
  2⤵
  PID:7920
- C:\Windows\System\hobtPjx.exe
  C:\Windows\System\hobtPjx.exe
  2⤵
  PID:7936
- C:\Windows\System\BrlyVsa.exe
  C:\Windows\System\BrlyVsa.exe
  2⤵
  PID:7956
- C:\Windows\System\jxyWgFY.exe
  C:\Windows\System\jxyWgFY.exe
  2⤵
  PID:7976
- C:\Windows\System\CCkkQfw.exe
  C:\Windows\System\CCkkQfw.exe
  2⤵
  PID:7996
- C:\Windows\System\yVhYPsW.exe
  C:\Windows\System\yVhYPsW.exe
  2⤵
  PID:8016
- C:\Windows\System\fKWsSeS.exe
  C:\Windows\System\fKWsSeS.exe
  2⤵
  PID:8040
- C:\Windows\System\YnLXjRJ.exe
  C:\Windows\System\YnLXjRJ.exe
  2⤵
  PID:8076
- C:\Windows\System\MdNJbTf.exe
  C:\Windows\System\MdNJbTf.exe
  2⤵
  PID:8092
- C:\Windows\System\rKDgEDJ.exe
  C:\Windows\System\rKDgEDJ.exe
  2⤵
  PID:8112
- C:\Windows\System\AhBpfin.exe
  C:\Windows\System\AhBpfin.exe
  2⤵
  PID:8128
- C:\Windows\System\hjIQEOV.exe
  C:\Windows\System\hjIQEOV.exe
  2⤵
  PID:8148
- C:\Windows\System\VUxJQhl.exe
  C:\Windows\System\VUxJQhl.exe
  2⤵
  PID:8172
- C:\Windows\System\dkGQijI.exe
  C:\Windows\System\dkGQijI.exe
  2⤵
  PID:6912
- C:\Windows\System\UQVOBMr.exe
  C:\Windows\System\UQVOBMr.exe
  2⤵
  PID:6964
- C:\Windows\System\SCxtqgW.exe
  C:\Windows\System\SCxtqgW.exe
  2⤵
  PID:6472
- C:\Windows\System\CYrLtvN.exe
  C:\Windows\System\CYrLtvN.exe
  2⤵
  PID:7080
- C:\Windows\System\fqTZAVc.exe
  C:\Windows\System\fqTZAVc.exe
  2⤵
  PID:4664
- C:\Windows\System\sXsOkea.exe
  C:\Windows\System\sXsOkea.exe
  2⤵
  PID:6668
- C:\Windows\System\MkRVLWD.exe
  C:\Windows\System\MkRVLWD.exe
  2⤵
  PID:6256
- C:\Windows\System\SPHJbqm.exe
  C:\Windows\System\SPHJbqm.exe
  2⤵
  PID:6692
- C:\Windows\System\mzpiJMF.exe
  C:\Windows\System\mzpiJMF.exe
  2⤵
  PID:5372
- C:\Windows\System\tJnKNza.exe
  C:\Windows\System\tJnKNza.exe
  2⤵
  PID:6752
- C:\Windows\System\ZNlJTQX.exe
  C:\Windows\System\ZNlJTQX.exe
  2⤵
  PID:6552
- C:\Windows\System\WAHROGC.exe
  C:\Windows\System\WAHROGC.exe
  2⤵
  PID:6784
- C:\Windows\System\IEFxzcU.exe
  C:\Windows\System\IEFxzcU.exe
  2⤵
  PID:7180
- C:\Windows\System\NGAuFsZ.exe
  C:\Windows\System\NGAuFsZ.exe
  2⤵
  PID:7236
- C:\Windows\System\sjLoLbS.exe
  C:\Windows\System\sjLoLbS.exe
  2⤵
  PID:7312
- C:\Windows\System\lOZxWgg.exe
  C:\Windows\System\lOZxWgg.exe
  2⤵
  PID:7396
- C:\Windows\System\WLgMxHt.exe
  C:\Windows\System\WLgMxHt.exe
  2⤵
  PID:7032
- C:\Windows\System\KETtVcq.exe
  C:\Windows\System\KETtVcq.exe
  2⤵
  PID:7504
- C:\Windows\System\WzwuGKG.exe
  C:\Windows\System\WzwuGKG.exe
  2⤵
  PID:8200
- C:\Windows\System\ALOeLsd.exe
  C:\Windows\System\ALOeLsd.exe
  2⤵
  PID:8220
- C:\Windows\System\AYywQyM.exe
  C:\Windows\System\AYywQyM.exe
  2⤵
  PID:8244
- C:\Windows\System\WhcheYh.exe
  C:\Windows\System\WhcheYh.exe
  2⤵
  PID:8264
- C:\Windows\System\SkwCFEe.exe
  C:\Windows\System\SkwCFEe.exe
  2⤵
  PID:8284
- C:\Windows\System\hatkduh.exe
  C:\Windows\System\hatkduh.exe
  2⤵
  PID:8300
- C:\Windows\System\CUylUCH.exe
  C:\Windows\System\CUylUCH.exe
  2⤵
  PID:8320
- C:\Windows\System\MkmzRCn.exe
  C:\Windows\System\MkmzRCn.exe
  2⤵
  PID:8336
- C:\Windows\System\qUjLQcq.exe
  C:\Windows\System\qUjLQcq.exe
  2⤵
  PID:8356
- C:\Windows\System\oAVSkdJ.exe
  C:\Windows\System\oAVSkdJ.exe
  2⤵
  PID:8380
- C:\Windows\System\DmkOKPc.exe
  C:\Windows\System\DmkOKPc.exe
  2⤵
  PID:8400
- C:\Windows\System\YqDEpPI.exe
  C:\Windows\System\YqDEpPI.exe
  2⤵
  PID:8420
- C:\Windows\System\JGJFfEK.exe
  C:\Windows\System\JGJFfEK.exe
  2⤵
  PID:8444
- C:\Windows\System\NZdaEMM.exe
  C:\Windows\System\NZdaEMM.exe
  2⤵
  PID:8460
- C:\Windows\System\yDqfOwX.exe
  C:\Windows\System\yDqfOwX.exe
  2⤵
  PID:8480
- C:\Windows\System\PLcwetM.exe
  C:\Windows\System\PLcwetM.exe
  2⤵
  PID:8504
- C:\Windows\System\NiugdzK.exe
  C:\Windows\System\NiugdzK.exe
  2⤵
  PID:8524
- C:\Windows\System\UUTmGEY.exe
  C:\Windows\System\UUTmGEY.exe
  2⤵
  PID:8544
- C:\Windows\System\SGbWGtD.exe
  C:\Windows\System\SGbWGtD.exe
  2⤵
  PID:8564
- C:\Windows\System\BPKveTS.exe
  C:\Windows\System\BPKveTS.exe
  2⤵
  PID:8584
- C:\Windows\System\hSkpbso.exe
  C:\Windows\System\hSkpbso.exe
  2⤵
  PID:8608
- C:\Windows\System\BkFhYZW.exe
  C:\Windows\System\BkFhYZW.exe
  2⤵
  PID:8624
- C:\Windows\System\ETablEY.exe
  C:\Windows\System\ETablEY.exe
  2⤵
  PID:8644
- C:\Windows\System\eLaKvHl.exe
  C:\Windows\System\eLaKvHl.exe
  2⤵
  PID:8660
- C:\Windows\System\fxMAIlb.exe
  C:\Windows\System\fxMAIlb.exe
  2⤵
  PID:8680
- C:\Windows\System\aioGwmm.exe
  C:\Windows\System\aioGwmm.exe
  2⤵
  PID:8700
- C:\Windows\System\wvOOOmh.exe
  C:\Windows\System\wvOOOmh.exe
  2⤵
  PID:8724
- C:\Windows\System\JuAYYMS.exe
  C:\Windows\System\JuAYYMS.exe
  2⤵
  PID:8748
- C:\Windows\System\ldXaXQF.exe
  C:\Windows\System\ldXaXQF.exe
  2⤵
  PID:8764
- C:\Windows\System\ngoKsvx.exe
  C:\Windows\System\ngoKsvx.exe
  2⤵
  PID:8796
- C:\Windows\System\rjavWkk.exe
  C:\Windows\System\rjavWkk.exe
  2⤵
  PID:8812
- C:\Windows\System\qrnsQoH.exe
  C:\Windows\System\qrnsQoH.exe
  2⤵
  PID:8832
- C:\Windows\System\FgvzSey.exe
  C:\Windows\System\FgvzSey.exe
  2⤵
  PID:8848
- C:\Windows\System\rTPjcZW.exe
  C:\Windows\System\rTPjcZW.exe
  2⤵
  PID:8864
- C:\Windows\System\PcpHOhp.exe
  C:\Windows\System\PcpHOhp.exe
  2⤵
  PID:8888
- C:\Windows\System\vVjqkOY.exe
  C:\Windows\System\vVjqkOY.exe
  2⤵
  PID:8908
- C:\Windows\System\FwJAoWn.exe
  C:\Windows\System\FwJAoWn.exe
  2⤵
  PID:8928
- C:\Windows\System\pIeBDGq.exe
  C:\Windows\System\pIeBDGq.exe
  2⤵
  PID:8948
- C:\Windows\System\RAKOliX.exe
  C:\Windows\System\RAKOliX.exe
  2⤵
  PID:8972
- C:\Windows\System\HtvjXDv.exe
  C:\Windows\System\HtvjXDv.exe
  2⤵
  PID:8992
- C:\Windows\System\aFNiPcP.exe
  C:\Windows\System\aFNiPcP.exe
  2⤵
  PID:9024
- C:\Windows\System\BqLQIrp.exe
  C:\Windows\System\BqLQIrp.exe
  2⤵
  PID:9040
- C:\Windows\System\imEipNO.exe
  C:\Windows\System\imEipNO.exe
  2⤵
  PID:9064
- C:\Windows\System\PVYuDcc.exe
  C:\Windows\System\PVYuDcc.exe
  2⤵
  PID:9084
- C:\Windows\System\vBBtAKw.exe
  C:\Windows\System\vBBtAKw.exe
  2⤵
  PID:9100
- C:\Windows\System\rqZAKZY.exe
  C:\Windows\System\rqZAKZY.exe
  2⤵
  PID:9124
- C:\Windows\System\CPcSuMw.exe
  C:\Windows\System\CPcSuMw.exe
  2⤵
  PID:9148
- C:\Windows\System\HRPryPX.exe
  C:\Windows\System\HRPryPX.exe
  2⤵
  PID:9168
- C:\Windows\System\GaBfnoM.exe
  C:\Windows\System\GaBfnoM.exe
  2⤵
  PID:9188
- C:\Windows\System\NGZixwF.exe
  C:\Windows\System\NGZixwF.exe
  2⤵
  PID:9208
- C:\Windows\System\gSJykag.exe
  C:\Windows\System\gSJykag.exe
  2⤵
  PID:7580
- C:\Windows\System\tfVmvUs.exe
  C:\Windows\System\tfVmvUs.exe
  2⤵
  PID:6612
- C:\Windows\System\fzpiFrL.exe
  C:\Windows\System\fzpiFrL.exe
  2⤵
  PID:7128
- C:\Windows\System\jYBEHwh.exe
  C:\Windows\System\jYBEHwh.exe
  2⤵
  PID:7668
- C:\Windows\System\gPvPOZs.exe
  C:\Windows\System\gPvPOZs.exe
  2⤵
  PID:7696
- C:\Windows\System\wCFKEFV.exe
  C:\Windows\System\wCFKEFV.exe
  2⤵
  PID:7772
- C:\Windows\System\djRKZWb.exe
  C:\Windows\System\djRKZWb.exe
  2⤵
  PID:7816
- C:\Windows\System\xAEpnou.exe
  C:\Windows\System\xAEpnou.exe
  2⤵
  PID:4244
- C:\Windows\System\iQgYfIQ.exe
  C:\Windows\System\iQgYfIQ.exe
  2⤵
  PID:7900
- C:\Windows\System\rKAXkWQ.exe
  C:\Windows\System\rKAXkWQ.exe
  2⤵
  PID:7968
- C:\Windows\System\EHxFqzT.exe
  C:\Windows\System\EHxFqzT.exe
  2⤵
  PID:7992
- C:\Windows\System\VMHHmTx.exe
  C:\Windows\System\VMHHmTx.exe
  2⤵
  PID:6624
- C:\Windows\System\oZXIbum.exe
  C:\Windows\System\oZXIbum.exe
  2⤵
  PID:6824
- C:\Windows\System\yuJtbjE.exe
  C:\Windows\System\yuJtbjE.exe
  2⤵
  PID:6872
- C:\Windows\System\dEiMXvH.exe
  C:\Windows\System\dEiMXvH.exe
  2⤵
  PID:8164
- C:\Windows\System\XZcknno.exe
  C:\Windows\System\XZcknno.exe
  2⤵
  PID:5004
- C:\Windows\System\nSsVGQV.exe
  C:\Windows\System\nSsVGQV.exe
  2⤵
  PID:7076
- C:\Windows\System\BUGvXxo.exe
  C:\Windows\System\BUGvXxo.exe
  2⤵
  PID:6960
- C:\Windows\System\AzytyHl.exe
  C:\Windows\System\AzytyHl.exe
  2⤵
  PID:7380
- C:\Windows\System\eQrPOcU.exe
  C:\Windows\System\eQrPOcU.exe
  2⤵
  PID:7240
- C:\Windows\System\oKJralX.exe
  C:\Windows\System\oKJralX.exe
  2⤵
  PID:8272
- C:\Windows\System\ONThRbe.exe
  C:\Windows\System\ONThRbe.exe
  2⤵
  PID:8352
- C:\Windows\System\nVjebba.exe
  C:\Windows\System\nVjebba.exe
  2⤵
  PID:8368
- C:\Windows\System\pefSKea.exe
  C:\Windows\System\pefSKea.exe
  2⤵
  PID:7844
- C:\Windows\System\RTPBsaI.exe
  C:\Windows\System\RTPBsaI.exe
  2⤵
  PID:9236
- C:\Windows\System\JZrthKs.exe
  C:\Windows\System\JZrthKs.exe
  2⤵
  PID:9256
- C:\Windows\System\aOetyjf.exe
  C:\Windows\System\aOetyjf.exe
  2⤵
  PID:9272
- C:\Windows\System\mWWMVIl.exe
  C:\Windows\System\mWWMVIl.exe
  2⤵
  PID:9292
- C:\Windows\System\XIbjIXT.exe
  C:\Windows\System\XIbjIXT.exe
  2⤵
  PID:9312
- C:\Windows\System\WVcOfyg.exe
  C:\Windows\System\WVcOfyg.exe
  2⤵
  PID:9328
- C:\Windows\System\ijhkkxd.exe
  C:\Windows\System\ijhkkxd.exe
  2⤵
  PID:9348
- C:\Windows\System\RQWsIpB.exe
  C:\Windows\System\RQWsIpB.exe
  2⤵
  PID:9376
- C:\Windows\System\VRlCBhv.exe
  C:\Windows\System\VRlCBhv.exe
  2⤵
  PID:9392
- C:\Windows\System\zwrcrIQ.exe
  C:\Windows\System\zwrcrIQ.exe
  2⤵
  PID:9420
- C:\Windows\System\rXeUJnA.exe
  C:\Windows\System\rXeUJnA.exe
  2⤵
  PID:9448
- C:\Windows\System\rGzqSOO.exe
  C:\Windows\System\rGzqSOO.exe
  2⤵
  PID:9464
- C:\Windows\System\gjWEGtK.exe
  C:\Windows\System\gjWEGtK.exe
  2⤵
  PID:9492
- C:\Windows\System\ivdxloO.exe
  C:\Windows\System\ivdxloO.exe
  2⤵
  PID:9508
- C:\Windows\System\rrlNWrq.exe
  C:\Windows\System\rrlNWrq.exe
  2⤵
  PID:9528
- C:\Windows\System\xjLTVBi.exe
  C:\Windows\System\xjLTVBi.exe
  2⤵
  PID:9548
- C:\Windows\System\RzbDDzQ.exe
  C:\Windows\System\RzbDDzQ.exe
  2⤵
  PID:9564
- C:\Windows\System\JSSJjLg.exe
  C:\Windows\System\JSSJjLg.exe
  2⤵
  PID:9584
- C:\Windows\System\HseqhMU.exe
  C:\Windows\System\HseqhMU.exe
  2⤵
  PID:9600
- C:\Windows\System\eGIQYjl.exe
  C:\Windows\System\eGIQYjl.exe
  2⤵
  PID:9632
- C:\Windows\System\aLEuJVV.exe
  C:\Windows\System\aLEuJVV.exe
  2⤵
  PID:9648
- C:\Windows\System\amDBypg.exe
  C:\Windows\System\amDBypg.exe
  2⤵
  PID:9672
- C:\Windows\System\GfJzVJo.exe
  C:\Windows\System\GfJzVJo.exe
  2⤵
  PID:9692
- C:\Windows\System\cYVgbEi.exe
  C:\Windows\System\cYVgbEi.exe
  2⤵
  PID:9716
- C:\Windows\System\MqwvLiX.exe
  C:\Windows\System\MqwvLiX.exe
  2⤵
  PID:9736
- C:\Windows\System\vPAFflY.exe
  C:\Windows\System\vPAFflY.exe
  2⤵
  PID:9756
- C:\Windows\System\urStJeh.exe
  C:\Windows\System\urStJeh.exe
  2⤵
  PID:9784
- C:\Windows\System\uoPKRzN.exe
  C:\Windows\System\uoPKRzN.exe
  2⤵
  PID:9804
- C:\Windows\System\iOGfDtl.exe
  C:\Windows\System\iOGfDtl.exe
  2⤵
  PID:9824
- C:\Windows\System\DhOIBQs.exe
  C:\Windows\System\DhOIBQs.exe
  2⤵
  PID:9844
- C:\Windows\System\mphoawK.exe
  C:\Windows\System\mphoawK.exe
  2⤵
  PID:9868
- C:\Windows\System\GInNzmV.exe
  C:\Windows\System\GInNzmV.exe
  2⤵
  PID:9892
- C:\Windows\System\wAJijuG.exe
  C:\Windows\System\wAJijuG.exe
  2⤵
  PID:9936
- C:\Windows\System\nHKoHAm.exe
  C:\Windows\System\nHKoHAm.exe
  2⤵
  PID:9960
- C:\Windows\System\xkfcGFD.exe
  C:\Windows\System\xkfcGFD.exe
  2⤵
  PID:9988
- C:\Windows\System\HbYzXZs.exe
  C:\Windows\System\HbYzXZs.exe
  2⤵
  PID:10008
- C:\Windows\System\MlFwZSp.exe
  C:\Windows\System\MlFwZSp.exe
  2⤵
  PID:10024
- C:\Windows\System\SrWJXdz.exe
  C:\Windows\System\SrWJXdz.exe
  2⤵
  PID:10044
- C:\Windows\System\QVDAgCT.exe
  C:\Windows\System\QVDAgCT.exe
  2⤵
  PID:10068
- C:\Windows\System\UGhwejz.exe
  C:\Windows\System\UGhwejz.exe
  2⤵
  PID:10088
- C:\Windows\System\RQzlhuW.exe
  C:\Windows\System\RQzlhuW.exe
  2⤵
  PID:10112
- C:\Windows\System\MqRaBYT.exe
  C:\Windows\System\MqRaBYT.exe
  2⤵
  PID:10132
- C:\Windows\System\ikZGXvy.exe
  C:\Windows\System\ikZGXvy.exe
  2⤵
  PID:10156
- C:\Windows\System\pQffIDO.exe
  C:\Windows\System\pQffIDO.exe
  2⤵
  PID:10176
- C:\Windows\System\TWxrTIE.exe
  C:\Windows\System\TWxrTIE.exe
  2⤵
  PID:10196
- C:\Windows\System\ZYVvozr.exe
  C:\Windows\System\ZYVvozr.exe
  2⤵
  PID:10220
- C:\Windows\System\IwrobNg.exe
  C:\Windows\System\IwrobNg.exe
  2⤵
  PID:8516
- C:\Windows\System\huVMxph.exe
  C:\Windows\System\huVMxph.exe
  2⤵
  PID:7944
- C:\Windows\System\jRXehXW.exe
  C:\Windows\System\jRXehXW.exe
  2⤵
  PID:8636
- C:\Windows\System\JtQofVx.exe
  C:\Windows\System\JtQofVx.exe
  2⤵
  PID:6776
- C:\Windows\System\QwEVSPb.exe
  C:\Windows\System\QwEVSPb.exe
  2⤵
  PID:6592
- C:\Windows\System\nCHxeLz.exe
  C:\Windows\System\nCHxeLz.exe
  2⤵
  PID:7596
- C:\Windows\System\cHFMQao.exe
  C:\Windows\System\cHFMQao.exe
  2⤵
  PID:7620
- C:\Windows\System\SSVrSZQ.exe
  C:\Windows\System\SSVrSZQ.exe
  2⤵
  PID:7540
- C:\Windows\System\nxjekwl.exe
  C:\Windows\System\nxjekwl.exe
  2⤵
  PID:8312
- C:\Windows\System\lJfoMqV.exe
  C:\Windows\System\lJfoMqV.exe
  2⤵
  PID:8008
- C:\Windows\System\eaTxeJl.exe
  C:\Windows\System\eaTxeJl.exe
  2⤵
  PID:7684
- C:\Windows\System\hrrdEXM.exe
  C:\Windows\System\hrrdEXM.exe
  2⤵
  PID:8440
- C:\Windows\System\NHEPssS.exe
  C:\Windows\System\NHEPssS.exe
  2⤵
  PID:7732
- C:\Windows\System\cCjWSYr.exe
  C:\Windows\System\cCjWSYr.exe
  2⤵
  PID:7856
- C:\Windows\System\TYSUHYW.exe
  C:\Windows\System\TYSUHYW.exe
  2⤵
  PID:9264
- C:\Windows\System\wzmZiTU.exe
  C:\Windows\System\wzmZiTU.exe
  2⤵
  PID:9284
- C:\Windows\System\itRZWjn.exe
  C:\Windows\System\itRZWjn.exe
  2⤵
  PID:8560
- C:\Windows\System\ZoNIOzh.exe
  C:\Windows\System\ZoNIOzh.exe
  2⤵
  PID:8620
- C:\Windows\System\fBDqTtn.exe
  C:\Windows\System\fBDqTtn.exe
  2⤵
  PID:10248
- C:\Windows\System\FLnHtGE.exe
  C:\Windows\System\FLnHtGE.exe
  2⤵
  PID:10264
- C:\Windows\System\RvIrDCT.exe
  C:\Windows\System\RvIrDCT.exe
  2⤵
  PID:10288
- C:\Windows\System\YfWLyxH.exe
  C:\Windows\System\YfWLyxH.exe
  2⤵
  PID:10308
- C:\Windows\System\KrPoisU.exe
  C:\Windows\System\KrPoisU.exe
  2⤵
  PID:10340
- C:\Windows\System\lEmBWJf.exe
  C:\Windows\System\lEmBWJf.exe
  2⤵
  PID:10364
- C:\Windows\System\EDrYbJw.exe
  C:\Windows\System\EDrYbJw.exe
  2⤵
  PID:10380
- C:\Windows\System\GaOhwks.exe
  C:\Windows\System\GaOhwks.exe
  2⤵
  PID:10408
- C:\Windows\System\UpfQxxj.exe
  C:\Windows\System\UpfQxxj.exe
  2⤵
  PID:10436
- C:\Windows\System\DxiijLb.exe
  C:\Windows\System\DxiijLb.exe
  2⤵
  PID:10456
- C:\Windows\System\SgVlIAq.exe
  C:\Windows\System\SgVlIAq.exe
  2⤵
  PID:10480
- C:\Windows\System\OgYXUzX.exe
  C:\Windows\System\OgYXUzX.exe
  2⤵
  PID:10504
- C:\Windows\System\ypIICUM.exe
  C:\Windows\System\ypIICUM.exe
  2⤵
  PID:10520
- C:\Windows\System\GvZdBFt.exe
  C:\Windows\System\GvZdBFt.exe
  2⤵
  PID:10540
- C:\Windows\System\AoYrEnq.exe
  C:\Windows\System\AoYrEnq.exe
  2⤵
  PID:10560
- C:\Windows\System\oZvboYk.exe
  C:\Windows\System\oZvboYk.exe
  2⤵
  PID:10584
- C:\Windows\System\qBVVmHG.exe
  C:\Windows\System\qBVVmHG.exe
  2⤵
  PID:10604
- C:\Windows\System\rpvGRqm.exe
  C:\Windows\System\rpvGRqm.exe
  2⤵
  PID:10620
- C:\Windows\System\MQFhgLp.exe
  C:\Windows\System\MQFhgLp.exe
  2⤵
  PID:10644
- C:\Windows\System\XwCicHF.exe
  C:\Windows\System\XwCicHF.exe
  2⤵
  PID:10664
- C:\Windows\System\ymNMYIM.exe
  C:\Windows\System\ymNMYIM.exe
  2⤵
  PID:10684
- C:\Windows\System\WCFYSEj.exe
  C:\Windows\System\WCFYSEj.exe
  2⤵
  PID:10708
- C:\Windows\System\QJFCUFe.exe
  C:\Windows\System\QJFCUFe.exe
  2⤵
  PID:10732
- C:\Windows\System\IbIbrDV.exe
  C:\Windows\System\IbIbrDV.exe
  2⤵
  PID:10760
- C:\Windows\System\QgXqCXg.exe
  C:\Windows\System\QgXqCXg.exe
  2⤵
  PID:10792
- C:\Windows\System\IjUtxSc.exe
  C:\Windows\System\IjUtxSc.exe
  2⤵
  PID:10816
- C:\Windows\System\UwSDoZa.exe
  C:\Windows\System\UwSDoZa.exe
  2⤵
  PID:10836
- C:\Windows\System\ZXPAzRN.exe
  C:\Windows\System\ZXPAzRN.exe
  2⤵
  PID:10860
- C:\Windows\System\YoYVEVb.exe
  C:\Windows\System\YoYVEVb.exe
  2⤵
  PID:10884
- C:\Windows\System\zaoDhnr.exe
  C:\Windows\System\zaoDhnr.exe
  2⤵
  PID:10904
- C:\Windows\System\oltDURG.exe
  C:\Windows\System\oltDURG.exe
  2⤵
  PID:10924
- C:\Windows\System\mbPYngL.exe
  C:\Windows\System\mbPYngL.exe
  2⤵
  PID:10948
- C:\Windows\System\OzLQTGE.exe
  C:\Windows\System\OzLQTGE.exe
  2⤵
  PID:10968
- C:\Windows\System\dxauKxV.exe
  C:\Windows\System\dxauKxV.exe
  2⤵
  PID:10988
- C:\Windows\System\qgiNNbr.exe
  C:\Windows\System\qgiNNbr.exe
  2⤵
  PID:11004
- C:\Windows\System\AvZyLbY.exe
  C:\Windows\System\AvZyLbY.exe
  2⤵
  PID:11028
- C:\Windows\System\YucHRdK.exe
  C:\Windows\System\YucHRdK.exe
  2⤵
  PID:11048
- C:\Windows\System\lGmOHCd.exe
  C:\Windows\System\lGmOHCd.exe
  2⤵
  PID:11064
- C:\Windows\System\LzUSNEe.exe
  C:\Windows\System\LzUSNEe.exe
  2⤵
  PID:11080
- C:\Windows\System\KWxXtGI.exe
  C:\Windows\System\KWxXtGI.exe
  2⤵
  PID:11100
- C:\Windows\System\xiVmJdm.exe
  C:\Windows\System\xiVmJdm.exe
  2⤵
  PID:11120
- C:\Windows\System\MNkpwtW.exe
  C:\Windows\System\MNkpwtW.exe
  2⤵
  PID:11140
- C:\Windows\System\oqCAkeL.exe
  C:\Windows\System\oqCAkeL.exe
  2⤵
  PID:11160
- C:\Windows\System\pHfuzHm.exe
  C:\Windows\System\pHfuzHm.exe
  2⤵
  PID:11188
- C:\Windows\System\ooZEAfY.exe
  C:\Windows\System\ooZEAfY.exe
  2⤵
  PID:11208
- C:\Windows\System\jYZHLDM.exe
  C:\Windows\System\jYZHLDM.exe
  2⤵
  PID:11228
- C:\Windows\System\wlMCVVm.exe
  C:\Windows\System\wlMCVVm.exe
  2⤵
  PID:11248
- C:\Windows\System\occANlS.exe
  C:\Windows\System\occANlS.exe
  2⤵
  PID:8676
- C:\Windows\System\MPktRdn.exe
  C:\Windows\System\MPktRdn.exe
  2⤵
  PID:9560
- C:\Windows\System\WEuJZaZ.exe
  C:\Windows\System\WEuJZaZ.exe
  2⤵
  PID:6896
- C:\Windows\System\EOEWUyG.exe
  C:\Windows\System\EOEWUyG.exe
  2⤵
  PID:9680
- C:\Windows\System\rfSjBMF.exe
  C:\Windows\System\rfSjBMF.exe
  2⤵
  PID:4740
- C:\Windows\System\xQdtxPD.exe
  C:\Windows\System\xQdtxPD.exe
  2⤵
  PID:6688
- C:\Windows\System\GSoQzGn.exe
  C:\Windows\System\GSoQzGn.exe
  2⤵
  PID:6196
- C:\Windows\System\OAbMdnv.exe
  C:\Windows\System\OAbMdnv.exe
  2⤵
  PID:9884
- C:\Windows\System\IuGiALK.exe
  C:\Windows\System\IuGiALK.exe
  2⤵
  PID:9972
- C:\Windows\System\onnrrpY.exe
  C:\Windows\System\onnrrpY.exe
  2⤵
  PID:9052
- C:\Windows\System\fOeCMWU.exe
  C:\Windows\System\fOeCMWU.exe
  2⤵
  PID:7356
- C:\Windows\System\itPmQtm.exe
  C:\Windows\System\itPmQtm.exe
  2⤵
  PID:9160
- C:\Windows\System\vHSapET.exe
  C:\Windows\System\vHSapET.exe
  2⤵
  PID:10168
- C:\Windows\System\wBFutBL.exe
  C:\Windows\System\wBFutBL.exe
  2⤵
  PID:10208
- C:\Windows\System\NPhTNig.exe
  C:\Windows\System\NPhTNig.exe
  2⤵
  PID:8260
- C:\Windows\System\vgpjgpB.exe
  C:\Windows\System\vgpjgpB.exe
  2⤵
  PID:8280
- C:\Windows\System\RwDIzTb.exe
  C:\Windows\System\RwDIzTb.exe
  2⤵
  PID:7784
- C:\Windows\System\llLlAeV.exe
  C:\Windows\System\llLlAeV.exe
  2⤵
  PID:8160
- C:\Windows\System\NEERsgB.exe
  C:\Windows\System\NEERsgB.exe
  2⤵
  PID:11284
- C:\Windows\System\NibHpHp.exe
  C:\Windows\System\NibHpHp.exe
  2⤵
  PID:11304
- C:\Windows\System\AiByibm.exe
  C:\Windows\System\AiByibm.exe
  2⤵
  PID:11332
- C:\Windows\System\PGSkLpi.exe
  C:\Windows\System\PGSkLpi.exe
  2⤵
  PID:11360
- C:\Windows\System\vzfzyMk.exe
  C:\Windows\System\vzfzyMk.exe
  2⤵
  PID:11388
- C:\Windows\System\dzrgiaT.exe
  C:\Windows\System\dzrgiaT.exe
  2⤵
  PID:11404
- C:\Windows\System\adubCWG.exe
  C:\Windows\System\adubCWG.exe
  2⤵
  PID:11432
- C:\Windows\System\iyxdXAt.exe
  C:\Windows\System\iyxdXAt.exe
  2⤵
  PID:11448
- C:\Windows\System\clsIfOj.exe
  C:\Windows\System\clsIfOj.exe
  2⤵
  PID:11464
- C:\Windows\System\QKkQKpr.exe
  C:\Windows\System\QKkQKpr.exe
  2⤵
  PID:11480
- C:\Windows\System\bkvomWY.exe
  C:\Windows\System\bkvomWY.exe
  2⤵
  PID:11496
- C:\Windows\System\mPdxzcy.exe
  C:\Windows\System\mPdxzcy.exe
  2⤵
  PID:11520
- C:\Windows\System\hhpomRn.exe
  C:\Windows\System\hhpomRn.exe
  2⤵
  PID:11540
- C:\Windows\System\nYrcBAu.exe
  C:\Windows\System\nYrcBAu.exe
  2⤵
  PID:11568
- C:\Windows\System\rkgAtBo.exe
  C:\Windows\System\rkgAtBo.exe
  2⤵
  PID:11608
- C:\Windows\System\vIwSGHu.exe
  C:\Windows\System\vIwSGHu.exe
  2⤵
  PID:11632
- C:\Windows\System\yzyTXjW.exe
  C:\Windows\System\yzyTXjW.exe
  2⤵
  PID:11656
- C:\Windows\System\uNthRqN.exe
  C:\Windows\System\uNthRqN.exe
  2⤵
  PID:11676
- C:\Windows\System\eoaMDZN.exe
  C:\Windows\System\eoaMDZN.exe
  2⤵
  PID:11700
- C:\Windows\System\UhIbvUX.exe
  C:\Windows\System\UhIbvUX.exe
  2⤵
  PID:11720
- C:\Windows\System\eXLVsiV.exe
  C:\Windows\System\eXLVsiV.exe
  2⤵
  PID:11752
- C:\Windows\System\smQbKyF.exe
  C:\Windows\System\smQbKyF.exe
  2⤵
  PID:11768
- C:\Windows\System\YSwUBYf.exe
  C:\Windows\System\YSwUBYf.exe
  2⤵
  PID:11788
- C:\Windows\System\BQHfOms.exe
  C:\Windows\System\BQHfOms.exe
  2⤵
  PID:11812
- C:\Windows\System\KjfJHYo.exe
  C:\Windows\System\KjfJHYo.exe
  2⤵
  PID:11836
- C:\Windows\System\BubUFce.exe
  C:\Windows\System\BubUFce.exe
  2⤵
  PID:11856
- C:\Windows\System\dWpNBYe.exe
  C:\Windows\System\dWpNBYe.exe
  2⤵
  PID:11876
- C:\Windows\System\IYNDNuW.exe
  C:\Windows\System\IYNDNuW.exe
  2⤵
  PID:11896
- C:\Windows\System\GEYIXWw.exe
  C:\Windows\System\GEYIXWw.exe
  2⤵
  PID:11916
- C:\Windows\System\vsLSyze.exe
  C:\Windows\System\vsLSyze.exe
  2⤵
  PID:11936
- C:\Windows\System\uXQlJmB.exe
  C:\Windows\System\uXQlJmB.exe
  2⤵
  PID:11960
- C:\Windows\System\MvSwdhx.exe
  C:\Windows\System\MvSwdhx.exe
  2⤵
  PID:11980
- C:\Windows\System\luZEZPo.exe
  C:\Windows\System\luZEZPo.exe
  2⤵
  PID:12004
- C:\Windows\System\oFhgzEL.exe
  C:\Windows\System\oFhgzEL.exe
  2⤵
  PID:12028
- C:\Windows\System\qKyZTmR.exe
  C:\Windows\System\qKyZTmR.exe
  2⤵
  PID:12052
- C:\Windows\System\tSutbBQ.exe
  C:\Windows\System\tSutbBQ.exe
  2⤵
  PID:12072
- C:\Windows\System\cXiJMbN.exe
  C:\Windows\System\cXiJMbN.exe
  2⤵
  PID:12092
- C:\Windows\System\dQnoJXG.exe
  C:\Windows\System\dQnoJXG.exe
  2⤵
  PID:12116
- C:\Windows\System\EYVBqcD.exe
  C:\Windows\System\EYVBqcD.exe
  2⤵
  PID:12144
- C:\Windows\System\yKEhBgu.exe
  C:\Windows\System\yKEhBgu.exe
  2⤵
  PID:12160
- C:\Windows\System\KKJtiLC.exe
  C:\Windows\System\KKJtiLC.exe
  2⤵
  PID:12184
- C:\Windows\System\qZvsOkI.exe
  C:\Windows\System\qZvsOkI.exe
  2⤵
  PID:12208
- C:\Windows\System\DWSGrEs.exe
  C:\Windows\System\DWSGrEs.exe
  2⤵
  PID:12224
- C:\Windows\System\emnRcAd.exe
  C:\Windows\System\emnRcAd.exe
  2⤵
  PID:12248
- C:\Windows\System\IMdRTef.exe
  C:\Windows\System\IMdRTef.exe
  2⤵
  PID:12272
- C:\Windows\System\hFATmLg.exe
  C:\Windows\System\hFATmLg.exe
  2⤵
  PID:6936
- C:\Windows\System\fAzzGgW.exe
  C:\Windows\System\fAzzGgW.exe
  2⤵
  PID:6400
- C:\Windows\System\wCFvqua.exe
  C:\Windows\System\wCFvqua.exe
  2⤵
  PID:9116
- C:\Windows\System\ANTOvbX.exe
  C:\Windows\System\ANTOvbX.exe
  2⤵
  PID:4624
- C:\Windows\System\TCgiozb.exe
  C:\Windows\System\TCgiozb.exe
  2⤵
  PID:7560
- C:\Windows\System\crctIKo.exe
  C:\Windows\System\crctIKo.exe
  2⤵
  PID:9372
- C:\Windows\System\MIzRCmu.exe
  C:\Windows\System\MIzRCmu.exe
  2⤵
  PID:9304
- C:\Windows\System\hoZaxqI.exe
  C:\Windows\System\hoZaxqI.exe
  2⤵
  PID:8716
- C:\Windows\System\GHliVLu.exe
  C:\Windows\System\GHliVLu.exe
  2⤵
  PID:8696
- C:\Windows\System\xEuqxwN.exe
  C:\Windows\System\xEuqxwN.exe
  2⤵
  PID:10328
- C:\Windows\System\GBnyygN.exe
  C:\Windows\System\GBnyygN.exe
  2⤵
  PID:10464
- C:\Windows\System\ybwooCZ.exe
  C:\Windows\System\ybwooCZ.exe
  2⤵
  PID:9596
- C:\Windows\System\THLQmxJ.exe
  C:\Windows\System\THLQmxJ.exe
  2⤵
  PID:12292
- C:\Windows\System\gTbNZmI.exe
  C:\Windows\System\gTbNZmI.exe
  2⤵
  PID:12312
- C:\Windows\System\HlzcCbQ.exe
  C:\Windows\System\HlzcCbQ.exe
  2⤵
  PID:12336
- C:\Windows\System\SQxzhsz.exe
  C:\Windows\System\SQxzhsz.exe
  2⤵
  PID:12356
- C:\Windows\System\FTIeqIo.exe
  C:\Windows\System\FTIeqIo.exe
  2⤵
  PID:12376
- C:\Windows\System\sVGiSeo.exe
  C:\Windows\System\sVGiSeo.exe
  2⤵
  PID:12396
- C:\Windows\System\uZUyfzJ.exe
  C:\Windows\System\uZUyfzJ.exe
  2⤵
  PID:12416
- C:\Windows\System\sRFbTqf.exe
  C:\Windows\System\sRFbTqf.exe
  2⤵
  PID:12436
- C:\Windows\System\XerJxoy.exe
  C:\Windows\System\XerJxoy.exe
  2⤵
  PID:12460
- C:\Windows\System\mBreeHp.exe
  C:\Windows\System\mBreeHp.exe
  2⤵
  PID:12484
- C:\Windows\System\pnrtTgd.exe
  C:\Windows\System\pnrtTgd.exe
  2⤵
  PID:12504
- C:\Windows\System\msGLYWA.exe
  C:\Windows\System\msGLYWA.exe
  2⤵
  PID:12528
- C:\Windows\System\fVSwUYX.exe
  C:\Windows\System\fVSwUYX.exe
  2⤵
  PID:12556
- C:\Windows\System\qarQdQT.exe
  C:\Windows\System\qarQdQT.exe
  2⤵
  PID:12576
- C:\Windows\System\QVFLzuC.exe
  C:\Windows\System\QVFLzuC.exe
  2⤵
  PID:12600
- C:\Windows\System\HIIKPGD.exe
  C:\Windows\System\HIIKPGD.exe
  2⤵
  PID:12624
- C:\Windows\System\FOMVVou.exe
  C:\Windows\System\FOMVVou.exe
  2⤵
  PID:12648
- C:\Windows\System\dwxWzqy.exe
  C:\Windows\System\dwxWzqy.exe
  2⤵
  PID:12668
- C:\Windows\System\zAVmKdC.exe
  C:\Windows\System\zAVmKdC.exe
  2⤵
  PID:12688
- C:\Windows\System\EcOxNIk.exe
  C:\Windows\System\EcOxNIk.exe
  2⤵
  PID:12712
- C:\Windows\System\PjLuWqC.exe
  C:\Windows\System\PjLuWqC.exe
  2⤵
  PID:12736
- C:\Windows\System\mIRMfWQ.exe
  C:\Windows\System\mIRMfWQ.exe
  2⤵
  PID:12760
- C:\Windows\System\ffvZsNt.exe
  C:\Windows\System\ffvZsNt.exe
  2⤵
  PID:12780
- C:\Windows\System\rUIUFlK.exe
  C:\Windows\System\rUIUFlK.exe
  2⤵
  PID:12804
- C:\Windows\System\LbNcjvn.exe
  C:\Windows\System\LbNcjvn.exe
  2⤵
  PID:12832
- C:\Windows\System\mvBemsG.exe
  C:\Windows\System\mvBemsG.exe
  2⤵
  PID:12852
- C:\Windows\System\Eemxqtm.exe
  C:\Windows\System\Eemxqtm.exe
  2⤵
  PID:12868
- C:\Windows\System\lFKlHkW.exe
  C:\Windows\System\lFKlHkW.exe
  2⤵
  PID:12892
- C:\Windows\System\lLlvcQQ.exe
  C:\Windows\System\lLlvcQQ.exe
  2⤵
  PID:12908
- C:\Windows\System\Iegslgz.exe
  C:\Windows\System\Iegslgz.exe
  2⤵
  PID:12924
- C:\Windows\System\tUDKkta.exe
  C:\Windows\System\tUDKkta.exe
  2⤵
  PID:12940
- C:\Windows\System\GiElZKB.exe
  C:\Windows\System\GiElZKB.exe
  2⤵
  PID:12956
- C:\Windows\System\RYlnrZk.exe
  C:\Windows\System\RYlnrZk.exe
  2⤵
  PID:12976
- C:\Windows\System\XrFiyID.exe
  C:\Windows\System\XrFiyID.exe
  2⤵
  PID:12996
- C:\Windows\System\ikcNWcN.exe
  C:\Windows\System\ikcNWcN.exe
  2⤵
  PID:13016
- C:\Windows\System\tvMouYg.exe
  C:\Windows\System\tvMouYg.exe
  2⤵
  PID:13040
- C:\Windows\System\cmDVwWW.exe
  C:\Windows\System\cmDVwWW.exe
  2⤵
  PID:13060
- C:\Windows\System\hZFMdSU.exe
  C:\Windows\System\hZFMdSU.exe
  2⤵
  PID:13080
- C:\Windows\System\VkOHVcw.exe
  C:\Windows\System\VkOHVcw.exe
  2⤵
  PID:13108
- C:\Windows\System\yKDzQqt.exe
  C:\Windows\System\yKDzQqt.exe
  2⤵
  PID:13124
- C:\Windows\System\oPVddIJ.exe
  C:\Windows\System\oPVddIJ.exe
  2⤵
  PID:13148
- C:\Windows\System\HcYIveC.exe
  C:\Windows\System\HcYIveC.exe
  2⤵
  PID:13168
- C:\Windows\System\ghmAGKn.exe
  C:\Windows\System\ghmAGKn.exe
  2⤵
  PID:13192
- C:\Windows\System\eonqrqB.exe
  C:\Windows\System\eonqrqB.exe
  2⤵
  PID:13216
- C:\Windows\System\DgyTRcT.exe
  C:\Windows\System\DgyTRcT.exe
  2⤵
  PID:13240
- C:\Windows\System\izflsyp.exe
  C:\Windows\System\izflsyp.exe
  2⤵
  PID:13264
- C:\Windows\System\WjImEhY.exe
  C:\Windows\System\WjImEhY.exe
  2⤵
  PID:13284
- C:\Windows\System\SjRZbyS.exe
  C:\Windows\System\SjRZbyS.exe
  2⤵
  PID:9624
- C:\Windows\System\DdZnKSW.exe
  C:\Windows\System\DdZnKSW.exe
  2⤵
  PID:9684
- C:\Windows\System\KTfRGPe.exe
  C:\Windows\System\KTfRGPe.exe
  2⤵
  PID:10652
- C:\Windows\System\eOoOLhf.exe
  C:\Windows\System\eOoOLhf.exe
  2⤵
  PID:10724
- C:\Windows\System\FRyFBtR.exe
  C:\Windows\System\FRyFBtR.exe
  2⤵
  PID:9752
- C:\Windows\System\ZPWpSNL.exe
  C:\Windows\System\ZPWpSNL.exe
  2⤵
  PID:9792
- C:\Windows\System\NEqYhbx.exe
  C:\Windows\System\NEqYhbx.exe
  2⤵
  PID:9864
- C:\Windows\System\gjeLRSV.exe
  C:\Windows\System\gjeLRSV.exe
  2⤵
  PID:10900
- C:\Windows\System\nmSvZRt.exe
  C:\Windows\System\nmSvZRt.exe
  2⤵
  PID:9984
- C:\Windows\System\hWxApgr.exe
  C:\Windows\System\hWxApgr.exe
  2⤵
  PID:11040
- C:\Windows\System\bOVnnpc.exe
  C:\Windows\System\bOVnnpc.exe
  2⤵
  PID:10052
- C:\Windows\System\RDwieJu.exe
  C:\Windows\System\RDwieJu.exe
  2⤵
  PID:10100
- C:\Windows\System\orKGdNk.exe
  C:\Windows\System\orKGdNk.exe
  2⤵
  PID:9504
- C:\Windows\System\sRVABQq.exe
  C:\Windows\System\sRVABQq.exe
  2⤵
  PID:10204
- C:\Windows\System\XPWsToy.exe
  C:\Windows\System\XPWsToy.exe
  2⤵
  PID:10232
- C:\Windows\System\ogYoHiM.exe
  C:\Windows\System\ogYoHiM.exe
  2⤵
  PID:9952
- C:\Windows\System\TDACvQa.exe
  C:\Windows\System\TDACvQa.exe
  2⤵
  PID:8760
- C:\Windows\System\LKnoNUi.exe
  C:\Windows\System\LKnoNUi.exe
  2⤵
  PID:6524
- C:\Windows\System\nqrlwYd.exe
  C:\Windows\System\nqrlwYd.exe
  2⤵
  PID:8088
- C:\Windows\System\oYQemOi.exe
  C:\Windows\System\oYQemOi.exe
  2⤵
  PID:6924
- C:\Windows\System\DxFeLdc.exe
  C:\Windows\System\DxFeLdc.exe
  2⤵
  PID:9036
- C:\Windows\System\cYiJMDb.exe
  C:\Windows\System\cYiJMDb.exe
  2⤵
  PID:13328
- C:\Windows\System\cHqrWcr.exe
  C:\Windows\System\cHqrWcr.exe
  2⤵
  PID:13352
- C:\Windows\System\zTievfr.exe
  C:\Windows\System\zTievfr.exe
  2⤵
  PID:13380
- C:\Windows\System\ccseWyd.exe
  C:\Windows\System\ccseWyd.exe
  2⤵
  PID:13396
- C:\Windows\System\Oyfhvnh.exe
  C:\Windows\System\Oyfhvnh.exe
  2⤵
  PID:13412
- C:\Windows\System\BzzhSYM.exe
  C:\Windows\System\BzzhSYM.exe
  2⤵
  PID:13436
- C:\Windows\System\xkzCPwE.exe
  C:\Windows\System\xkzCPwE.exe
  2⤵
  PID:13456
- C:\Windows\System\zPthfjr.exe
  C:\Windows\System\zPthfjr.exe
  2⤵
  PID:13480
- C:\Windows\System\iTrYGXs.exe
  C:\Windows\System\iTrYGXs.exe
  2⤵
  PID:13500
- C:\Windows\System\hroTqdW.exe
  C:\Windows\System\hroTqdW.exe
  2⤵
  PID:13524
- C:\Windows\System\ugZbgnN.exe
  C:\Windows\System\ugZbgnN.exe
  2⤵
  PID:13548
- C:\Windows\System\fSbsGMj.exe
  C:\Windows\System\fSbsGMj.exe
  2⤵
  PID:13568
- C:\Windows\System\zjQEdHM.exe
  C:\Windows\System\zjQEdHM.exe
  2⤵
  PID:13592
- C:\Windows\System\WfqLIrA.exe
  C:\Windows\System\WfqLIrA.exe
  2⤵
  PID:13616
- C:\Windows\System\KoMnmjh.exe
  C:\Windows\System\KoMnmjh.exe
  2⤵
  PID:13632
- C:\Windows\System\WsLgdCb.exe
  C:\Windows\System\WsLgdCb.exe
  2⤵
  PID:13652
- C:\Windows\System\lpXMqlP.exe
  C:\Windows\System\lpXMqlP.exe
  2⤵
  PID:13680
- C:\Windows\System\ANTWTmJ.exe
  C:\Windows\System\ANTWTmJ.exe
  2⤵
  PID:13704
- C:\Windows\System\zIveQve.exe
  C:\Windows\System\zIveQve.exe
  2⤵
  PID:13728
- C:\Windows\System\lYVVfUK.exe
  C:\Windows\System\lYVVfUK.exe
  2⤵
  PID:13752
- C:\Windows\System\rGTtTft.exe
  C:\Windows\System\rGTtTft.exe
  2⤵
  PID:13768
- C:\Windows\System\jKjYczc.exe
  C:\Windows\System\jKjYczc.exe
  2⤵
  PID:13788
- C:\Windows\System\lnrIYjH.exe
  C:\Windows\System\lnrIYjH.exe
  2⤵
  PID:13816
- C:\Windows\System\fVRGklN.exe
  C:\Windows\System\fVRGklN.exe
  2⤵
  PID:13836
- C:\Windows\System\kalLGQk.exe
  C:\Windows\System\kalLGQk.exe
  2⤵
  PID:13856
- C:\Windows\System\rsQhGcK.exe
  C:\Windows\System\rsQhGcK.exe
  2⤵
  PID:13880
- C:\Windows\System\AGAXjLj.exe
  C:\Windows\System\AGAXjLj.exe
  2⤵
  PID:13904
- C:\Windows\System\MbEFWez.exe
  C:\Windows\System\MbEFWez.exe
  2⤵
  PID:13920
- C:\Windows\System\VUIXPuc.exe
  C:\Windows\System\VUIXPuc.exe
  2⤵
  PID:13944
- C:\Windows\System\rAJsiaA.exe
  C:\Windows\System\rAJsiaA.exe
  2⤵
  PID:13968
- C:\Windows\System\ZTvXCMV.exe
  C:\Windows\System\ZTvXCMV.exe
  2⤵
  PID:13988
- C:\Windows\System\DfkRDVf.exe
  C:\Windows\System\DfkRDVf.exe
  2⤵
  PID:14008
- C:\Windows\System\WviEtnA.exe
  C:\Windows\System\WviEtnA.exe
  2⤵
  PID:14028
- C:\Windows\System\kvrWeaz.exe
  C:\Windows\System\kvrWeaz.exe
  2⤵
  PID:14048
- C:\Windows\System\tKijOxq.exe
  C:\Windows\System\tKijOxq.exe
  2⤵
  PID:14064
- C:\Windows\System\hRnpjyp.exe
  C:\Windows\System\hRnpjyp.exe
  2⤵
  PID:14080
- C:\Windows\System\lTJFify.exe
  C:\Windows\System\lTJFify.exe
  2⤵
  PID:14096
- C:\Windows\System\ByGIbjA.exe
  C:\Windows\System\ByGIbjA.exe
  2⤵
  PID:14116
- C:\Windows\System\dMavYkC.exe
  C:\Windows\System\dMavYkC.exe
  2⤵
  PID:14132
- C:\Windows\System\fLNpDVr.exe
  C:\Windows\System\fLNpDVr.exe
  2⤵
  PID:14148
- C:\Windows\System\UbSxlmg.exe
  C:\Windows\System\UbSxlmg.exe
  2⤵
  PID:14164
- C:\Windows\System\zGsvrGp.exe
  C:\Windows\System\zGsvrGp.exe
  2⤵
  PID:14184
- C:\Windows\System\RxMWMaY.exe
  C:\Windows\System\RxMWMaY.exe
  2⤵
  PID:14224
- C:\Windows\System\HiXtcmz.exe
  C:\Windows\System\HiXtcmz.exe
  2⤵
  PID:14260
- C:\Windows\System\kCsnTCs.exe
  C:\Windows\System\kCsnTCs.exe
  2⤵
  PID:14284
- C:\Windows\System\XUTRsOl.exe
  C:\Windows\System\XUTRsOl.exe
  2⤵
  PID:14308
- C:\Windows\System\UmojyIF.exe
  C:\Windows\System\UmojyIF.exe
  2⤵
  PID:14332
- C:\Windows\System\xkcnEHt.exe
  C:\Windows\System\xkcnEHt.exe
  2⤵
  PID:11372
- C:\Windows\System\VNnDbVD.exe
  C:\Windows\System\VNnDbVD.exe
  2⤵
  PID:11492
- C:\Windows\System\jeODyUq.exe
  C:\Windows\System\jeODyUq.exe
  2⤵
  PID:11556
- C:\Windows\System\oYwpdFZ.exe
  C:\Windows\System\oYwpdFZ.exe
  2⤵
  PID:11692
- C:\Windows\System\EywdaZs.exe
  C:\Windows\System\EywdaZs.exe
  2⤵
  PID:11728
- C:\Windows\System\cIjXUct.exe
  C:\Windows\System\cIjXUct.exe
  2⤵
  PID:8316
- C:\Windows\System\rgcpVKc.exe
  C:\Windows\System\rgcpVKc.exe
  2⤵
  PID:7636
- C:\Windows\System\PpkvCmv.exe
  C:\Windows\System\PpkvCmv.exe
  2⤵
  PID:9336
- C:\Windows\System\anbFrju.exe
  C:\Windows\System\anbFrju.exe
  2⤵
  PID:9244
- C:\Windows\System\weFvUCy.exe
  C:\Windows\System\weFvUCy.exe
  2⤵
  PID:9324
- C:\Windows\System\UfbtnfC.exe
  C:\Windows\System\UfbtnfC.exe
  2⤵
  PID:10260
- C:\Windows\System\JVhwNzn.exe
  C:\Windows\System\JVhwNzn.exe
  2⤵
  PID:10296
- C:\Windows\System\qfzpeCY.exe
  C:\Windows\System\qfzpeCY.exe
  2⤵
  PID:10348
- C:\Windows\System\HTYOCGW.exe
  C:\Windows\System\HTYOCGW.exe
  2⤵
  PID:10388
- C:\Windows\System\LByUykP.exe
  C:\Windows\System\LByUykP.exe
  2⤵
  PID:10396
- C:\Windows\System\CDQICKY.exe
  C:\Windows\System\CDQICKY.exe
  2⤵
  PID:9544
- C:\Windows\System\LUmaPiF.exe
  C:\Windows\System\LUmaPiF.exe
  2⤵
  PID:7672
- C:\Windows\System\ihjshkS.exe
  C:\Windows\System\ihjshkS.exe
  2⤵
  PID:10492
- C:\Windows\System\WeKNElJ.exe
  C:\Windows\System\WeKNElJ.exe
  2⤵
  PID:10256
- C:\Windows\System\oiQTZaR.exe
  C:\Windows\System\oiQTZaR.exe
  2⤵
  PID:9592
- C:\Windows\System\VbSUcDQ.exe
  C:\Windows\System\VbSUcDQ.exe
  2⤵
  PID:10516
- C:\Windows\System\koowiur.exe
  C:\Windows\System\koowiur.exe
  2⤵
  PID:10580
- C:\Windows\System\GsxklZN.exe
  C:\Windows\System\GsxklZN.exe
  2⤵
  PID:10640
- C:\Windows\System\bIqTLpP.exe
  C:\Windows\System\bIqTLpP.exe
  2⤵
  PID:12512
- C:\Windows\System\laVlFXQ.exe
  C:\Windows\System\laVlFXQ.exe
  2⤵
  PID:10716
- C:\Windows\System\wsXBvcm.exe
  C:\Windows\System\wsXBvcm.exe
  2⤵
  PID:10776
- C:\Windows\System\shHUsNs.exe
  C:\Windows\System\shHUsNs.exe
  2⤵
  PID:10808
- C:\Windows\System\jFdOjPv.exe
  C:\Windows\System\jFdOjPv.exe
  2⤵
  PID:10828
- C:\Windows\System\eLRqNDp.exe
  C:\Windows\System\eLRqNDp.exe
  2⤵
  PID:10852
- C:\Windows\System\oApWXFh.exe
  C:\Windows\System\oApWXFh.exe
  2⤵
  PID:12720
- C:\Windows\System\vZhdERw.exe
  C:\Windows\System\vZhdERw.exe
  2⤵
  PID:14344
- C:\Windows\System\rTZYlLG.exe
  C:\Windows\System\rTZYlLG.exe
  2⤵
  PID:14360
- C:\Windows\System\glJtcrh.exe
  C:\Windows\System\glJtcrh.exe
  2⤵
  PID:14376
- C:\Windows\System\hfdDPhV.exe
  C:\Windows\System\hfdDPhV.exe
  2⤵
  PID:14392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BEKBgco.exe

Path C:\Windows\System\BEKBgco.exe
Size 1.4MB
SHA256 2c53b74d444ede4bb1901175257bf04acc984eef00e1cb3d8f3d7b4511d06aa8
MD5 d3aba19aa71c9d1341a6572bbdd80898
SHA1 39b1bf6ec30c60da8f92f27523dedc46a70b4ac0
SHA512 66f3a6124044f55788fd5f854c16959cb201d96a9fe12edb605fe3b4230099d14df7b493af62836f3e4d6f75cb2d3e3515842d217e86e8f835eab6d4ffaf684a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZdy:ROdWCCi7/rahW/dLUoJlruRXP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

BHGSJno.exe

Path C:\Windows\System\BHGSJno.exe
Size 1.4MB
SHA256 f4b2bbcf274f9fe87a779b454d7276dbb826e13ecae37dbbae168753732dfc5f
MD5 676ef679c3814db10c92faee75ccf010
SHA1 6fced61e90e97b22aabf6e0dba28ee9a5f5ed351
SHA512 b63ddd1c2ffe34b7b9aee6c15d01da5ad8858a839af095a7ea51b60c5f98539df1842a656354148362e7e71033d1c34e61159463e132696841b8f0bafaa25d94
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZg:ROdWCCi7/rahW/dLUoJlruRXPg
MD5 SHA1 SHA512 SSDEEP

Submit Download

DXFGphB.exe

Path C:\Windows\System\DXFGphB.exe
Size 1.4MB
SHA256 9c8bd7f6d634e71426547aed2d47dc46547448c33759cfe3a36d90ffc032ccdc
MD5 78d013454d089aff02a280d101b8f886
SHA1 a50bcfccb8eb5e3a37cbcdedf098314e07d67c7e
SHA512 d270817201fd28923063d92e1bc135deefb20360fde7a200415ccbbfff8f2b4848661b441180fb8e70c048a1193455d0f2e9cc62d35b747098aeabe6ec94109b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZb:ROdWCCi7/rahW/dLUoJlruRXPb
MD5 SHA1 SHA512 SSDEEP

Submit Download

DsFjDqG.exe

Path C:\Windows\System\DsFjDqG.exe
Size 1.4MB
SHA256 87a28175d7cfa0048cb1654a0ccc2c43ecbf40433a6752af08d2a6825056abb2
MD5 64a4959c1e4b513281870ed5f13f885e
SHA1 1feb04d62532cfdcc248f00a390f16a50488763a
SHA512 6b32a78202382b50d0a4ad51007ad98e68a238649537673dcf58e3e9aca72172f33b2ee380fde4da8076eb4d44b5edf9125c534b839f2f9cc050b23b989e984b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZ9:ROdWCCi7/rahW/dLUoJlruRXP9
MD5 SHA1 SHA512 SSDEEP

Submit Download

EQRjbfd.exe

Path C:\Windows\System\EQRjbfd.exe
Size 1.4MB
SHA256 b858c279250dce83e9b36af8b674ba2a69ebd70ed8205a558736a33b1047f483
MD5 38b1caa016bf713161f199a07cb0d152
SHA1 13f84efbcdf9703ba38834272caea56894e53390
SHA512 33e68d1b04ea673d8f978527841f11298e16d762ad6f8618b958169cc0d61256bf40a215fb92f1b4a881423f1f8bee827df5d6eb457e08c70d0f7d9823c7c09d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZz:ROdWCCi7/rahW/dLUoJlruRXPz
MD5 SHA1 SHA512 SSDEEP

Submit Download

EqzwJNv.exe

Path C:\Windows\System\EqzwJNv.exe
Size 1.4MB
SHA256 0060d139c38600b223c9d935577cee31cc8476708e40a756ad3b8021d87cfb45
MD5 c8f25adf33f5f50d4050e64c99ab5ac7
SHA1 481a0fad3f4d43f33e85b7a6e8fd3dc7f88d93c4
SHA512 080c6a64a5478ac02a1d0564fc1fa6b6f7cc81bf90fd7c50b198e4ec3983ff7053c97b4c69e36c6197356b0197884484de47490fa0751116d0da6b232de11089
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZ3:ROdWCCi7/rahW/dLUoJlruRXP3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IVCqmbs.exe

Path C:\Windows\System\IVCqmbs.exe
Size 1.4MB
SHA256 b1cde56703bc00a152543ceeadfe199d1eaac64177bc5759088caf8492feb01a
MD5 5feda77be6ffe1c2d1ff74f38f18cfcc
SHA1 1fd04b8261933e04eb1b730174e3ae0b02b33f3d
SHA512 838b26541862e9d76b54163a483843b016fadc0c9f1aee8e50d4bd4f3654a13b61a000d6f1ea7b815176cbac54bc147f0d80a46d7282be53a9d91eee03feffdd
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZ+n:ROdWCCi7/rahW/dLUoJlruRXP+n
MD5 SHA1 SHA512 SSDEEP

Submit Download

IqPXThv.exe

Path C:\Windows\System\IqPXThv.exe
Size 1.4MB
SHA256 11c85d7a76d08a3ec93c47825a9e33bb2a2e694596198540657f9bb4b1aa96f2
MD5 c453c2c30adac2f312fe12308d4c60f1
SHA1 0bee693a49e255d2e3871ecd3ee3e372dd6fea48
SHA512 c5924b1486417189861d2139b689dbb269d487b96459d7fd744024b1cdc0a8c41bc38c50956f31b530939254915e34d9e3bff5941bf2f2af60298cf3932c2f92
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZU:ROdWCCi7/rahW/dLUoJlruRXPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

LAfKlIA.exe

Path C:\Windows\System\LAfKlIA.exe
Size 1.4MB
SHA256 bc815e283a444c18e28667636401604c7af7ea16b27c2cd0589af63333091014
MD5 ea2e83448fed3e553bae4559c99e16cc
SHA1 ea46a77bae314ac2c1554ae6990fc36fb90c3164
SHA512 583621fdb2ca410d944750943855e66d4dc240a0e99fb990a536a94fad9fd84df107df50555811ff8f43f79a69226c151ab04e60baa2fbee9cdf37148e74faf8
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZT:ROdWCCi7/rahW/dLUoJlruRXPT
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEJPvHp.exe

Path C:\Windows\System\MEJPvHp.exe
Size 1.4MB
SHA256 065ea41b7893c223a9222ef7fdb8dc54412d89e1e0c25f9ac8fdea9da81ed283
MD5 1ed271d86b91dd12d583989c24c56b19
SHA1 f537108e329e797213be37e31b0fc82ab37edb1e
SHA512 62677197ef24275894ea0ab62732e1956916e981e6c3025d1a777dd55290010c483dabe331caa7cc7573950437af4fbc3b08d8a133d7442748fc0d3a2cb33df8
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZK:ROdWCCi7/rahW/dLUoJlruRXPK
MD5 SHA1 SHA512 SSDEEP

Submit Download

NBCawiT.exe

Path C:\Windows\System\NBCawiT.exe
Size 1.4MB
SHA256 665d929b097f106cbb167547040cb185d1502769f72c87753db0557d3c00afff
MD5 2f90ac0d4a6a76ef17bf843c039bb23e
SHA1 abd769697debc99f3ff02cb777b7b27274994c7e
SHA512 949176d3be9489e025b36aaa5a8134c19dc5c5e85c29e5581146f72f6d0a87c40ddf6caaf4c1ac2d082b2e9d5b50193638e30d579387a42844efbca34fdb6cc9
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZw:ROdWCCi7/rahW/dLUoJlruRXPw
MD5 SHA1 SHA512 SSDEEP

Submit Download

NHxPQjU.exe

Path C:\Windows\System\NHxPQjU.exe
Size 1.4MB
SHA256 d531ba40417fc1d871ba0787b4cc6acf29ea9ffed0083bc3ba21193d6b5114e1
MD5 5110405339ea6edaa09d89f88e76a76b
SHA1 0df8c46c565b51bf53cff595a92f6d775f02e29f
SHA512 2b4348f265f6ef6bd64ec8df3d4940398eabf00a8d4fadec0371fb8230c1361f58166c36be81246132adb44afb249dfd1409f72738a2f84f8259089048a8ce13
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZB:ROdWCCi7/rahW/dLUoJlruRXPB
MD5 SHA1 SHA512 SSDEEP

Submit Download

OrmPKqn.exe

Path C:\Windows\System\OrmPKqn.exe
Size 1.4MB
SHA256 8ec9d6587342f36b05d0832d62b6f6afb80649b1512cd1e3b18cea11da692705
MD5 985568bbd10bbd4998b1387330ce6fec
SHA1 c10e9508e6498c01b430ae40d2dd752e996e6649
SHA512 a9960beff46e6ad2bb72c24c3feb60e088740310c976ebb6adbd6cb85494bbdc0c8e4e2eda755e2ca18a0f286672c87299ce3b29142c02d5059296e9aac71696
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZh:ROdWCCi7/rahW/dLUoJlruRXPh
MD5 SHA1 SHA512 SSDEEP

Submit Download

SzCatAW.exe

Path C:\Windows\System\SzCatAW.exe
Size 1.4MB
SHA256 f450cdd025e31374e63c12a49985375c114ec33783eb72e0d8555015498916a2
MD5 b8e050a74adbf9779a32a147c9a888a2
SHA1 e06e11b239433b7fffc9987a917151b7685080be
SHA512 b03b9469655e24c8437103917a7f048007cf9469cab07b361ef7006fb5889101fd976b18f83a1713b3cfb572cde1b5155f25b701bbb3118d5506fc5ae8ebc6d5
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZm:ROdWCCi7/rahW/dLUoJlruRXPm
MD5 SHA1 SHA512 SSDEEP

Submit Download

UPspNTr.exe

Path C:\Windows\System\UPspNTr.exe
Size 1.4MB
SHA256 29826cb7eada7a643c14c1ffaf0c46ddbeb1f27e4df4561f4d2701cfb8025c80
MD5 8e5edef63b7c3ef3837cf939b1695b1b
SHA1 92ece9f3e2d7e994eeeb9d6f17d04e83c01562be
SHA512 b90604825c3cab94c46c44aecca596918692d510051696ee9f96eaadca9c79dbd2dafe05f5a5a5fad4813a0a71f2d0941afa29ca6d3b28fbfbef5153b88c0fac
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZg:ROdWCCi7/rahW/dLUoJlruRXPg
MD5 SHA1 SHA512 SSDEEP

Submit Download

WvtEXrP.exe

Path C:\Windows\System\WvtEXrP.exe
Size 1.4MB
SHA256 38a9c62e2b0279577b6028f93b7e1e5be98d62d3aafc4a16dbdb80bff2de5217
MD5 a1833156c04f40c2e236576a9be0a76c
SHA1 6a882defa5d4baf41e7e5ccc2f873b5d5ac09505
SHA512 77aec775bd1ffdd1da905ccd7976b07eb7251505d7b116dff56fc5b4ca0eae0b05b9292c87ec658f3cdae3bab503b2bb689a57053c271bd475963ec19ece7b1c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZa:ROdWCCi7/rahW/dLUoJlruRXPa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZXRjWlz.exe

Path C:\Windows\System\ZXRjWlz.exe
Size 1.4MB
SHA256 4252fd40a01d29f03077c0a5c30a78894485a9dedd925488e131baa5aa042a0a
MD5 9138a33ac80a56366f22cfcdf303664a
SHA1 254ad196a5ce41b9e56454a395e283f07c97f721
SHA512 a23083d5729dd3a645d815465593f58a554f9609e640204dd6828b6b3e8e122a1a0819d79d5f346ca029ecbc3f1ba69c90ed5ed24ea88dcfc018fa1fc7bbc1b7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZg:ROdWCCi7/rahW/dLUoJlruRXPg
MD5 SHA1 SHA512 SSDEEP

Submit Download

dfduxYI.exe

Path C:\Windows\System\dfduxYI.exe
Size 1.4MB
SHA256 7e183b7c9a90553b4489f163bb29c218395aa19ae3485c803742eb671c3c19e2
MD5 e16ffdd83a8fe1e1588b16e29adb0dd9
SHA1 8d491e862b8aad77052060b23649f743692e1b88
SHA512 016bdfa22a1a5e22ac0f9f3ef34de4396cc5ab448b3f94f522e915f1f81ea379c2a47bc4f6c93e0badce26db37958f12e3cfc242c93b28189a0ee0f53c4a150c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZU:ROdWCCi7/rahW/dLUoJlruRXPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ecKUPWc.exe

Path C:\Windows\System\ecKUPWc.exe
Size 1.4MB
SHA256 4c12b722589e6f2c50e8bb49fc65342d5076baa9bc0d61f944d7d6948325981b
MD5 5283cd4037f939f2516613f097b2b4b9
SHA1 f163ef88a16ee68f811aee518791ab8ccfeeeeb2
SHA512 8b4f380eb8a54d459f9ff0ccb63023cf6e6ffb8001f834c5c33de322ba3ff5eeaa25b52e375cbd51d3c28847a6821d6f21e8ab564a4657ddee90dfac21bde8ec
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZV:ROdWCCi7/rahW/dLUoJlruRXPV
MD5 SHA1 SHA512 SSDEEP

Submit Download

fTbnBck.exe

Path C:\Windows\System\fTbnBck.exe
Size 1.4MB
SHA256 7a356420721bd9966e17823f0655c8a81f883d80ef1c48accd94aef95cbd6cdf
MD5 dcf10dea5467975605f61f05e38b72f6
SHA1 0ae6cc04a46f6b71c53e2f88a5f75d63f1552226
SHA512 2d910155b470039873d410491f7b24ae1b4a117121951053baeb575dc2c760531190958b52a77121cd0e1303dafd0aa827e544ea7e363fdf554b400a5eb8ed22
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZ5:ROdWCCi7/rahW/dLUoJlruRXP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

gKZusPB.exe

Path C:\Windows\System\gKZusPB.exe
Size 1.4MB
SHA256 5a9715fea81c64d22289da61f57f047b9eaff88f07c6835fc4c1569a56332e3b
MD5 fb25a2aa52d995ca8b7aae6ba4462c0e
SHA1 e4292fe0d2e8131839fabb1974001cdd240d8078
SHA512 8c2a72c23de3c731c983de5d5904653344bf565d799d2fd6d41d50dd6a6bd3f4ff1ca0da44195eb49d79f4af4674ee630960e6c20a11aab8618682a2706793b7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZx:ROdWCCi7/rahW/dLUoJlruRXPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

jVseFOl.exe

Path C:\Windows\System\jVseFOl.exe
Size 1.4MB
SHA256 b6c22360a2d0190a06d779c29a58e266480adcf5f5f27985f41d60187c282dba
MD5 d7dcabc511c253cf29675170edc57aac
SHA1 f9ecfc7cb261c3b737748b580387cd45785dc6ef
SHA512 eae341bcf5ccd59cd7e6df8eb2f08884c5fb6aa7aac89475d5ebcb7ee14957710d1d7a53fb7cef4f30e219633de4e7443649296ea326aa15ab9a225e19d337ac
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZD:ROdWCCi7/rahW/dLUoJlruRXPD
MD5 SHA1 SHA512 SSDEEP

Submit Download

lhnzDOM.exe

Path C:\Windows\System\lhnzDOM.exe
Size 1.4MB
SHA256 291785f128fd69592df442fc21454278a60d28fbe9c20c0c23eb6b1bff41ee9c
MD5 cb8fa208cb2caa66af28cedf2018a0ee
SHA1 1e974850f0a1b4e3003e97e27bc2caa8c175c349
SHA512 b11f311d0102a6c126da727af31ffaac4d234a9f13bd75e58de5dba0f83a09b24826d99cdf5b78ce9518026e2ef42cd8ef00e253c6e6859750839100dcb6d714
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZU:ROdWCCi7/rahW/dLUoJlruRXPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

oPVIlhs.exe

Path C:\Windows\System\oPVIlhs.exe
Size 1.4MB
SHA256 b87c743cd13d0bb351932629c333ea4fb9c24a3215a0ad34ac21393040b64df2
MD5 7754fc3b033e76a24c7971865f4facc6
SHA1 44c126c5e2c6f7f734d5b8266c5a5305914384bf
SHA512 5bd103ebfdce3587f9b94d5c06ccd4b1d423d55b62a6303ef4e5caf7dc102339870d68c449e6433366cad1c046abee2d4bbf2936bd04441c940888976f3f2e39
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZf:ROdWCCi7/rahW/dLUoJlruRXPf
MD5 SHA1 SHA512 SSDEEP

Submit Download

rIQgbTJ.exe

Path C:\Windows\System\rIQgbTJ.exe
Size 1.4MB
SHA256 e1396db7c22f35443fd31987bfb65aff46ad66821a17129a44aee41bf951315b
MD5 6c786b06a3f68521788286d4426b2214
SHA1 e39e9bdf90f0ee31efd64755aca7defd15d07fbe
SHA512 2ef8daa16bc59f8934b3b28ea692ed6d77fef590275061488e4b20d8e93c3f853bda1b4a5373be4bd4e8b7a825f508e2d958c4750947a2fc9b2160a896ae6ad2
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZd:ROdWCCi7/rahW/dLUoJlruRXPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

sznntYb.exe

Path C:\Windows\System\sznntYb.exe
Size 1.4MB
SHA256 3c934f3072741846d355a71cafe8f252047c8cfc29fbf0dbc5e4179aa6478197
MD5 1c29f87d7d3788d0a9dc038f7e25e43d
SHA1 056a02ac45d7afdcf1549da03b099598201109a3
SHA512 3a3dd39f48987530ff4fe691b525f0232e247d5d4bb6b61e764d2cd7098fe6b21b465f0573babe0c4a494da74adf760ee0b6d4699eebc94c152e48b61ad90fad
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZQ:ROdWCCi7/rahW/dLUoJlruRXPQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uQPAOJI.exe

Path C:\Windows\System\uQPAOJI.exe
Size 1.4MB
SHA256 c477eafcce91507b010fc28a8474932916ffdc7ba1ac7ca5963d2fa3a3fbb316
MD5 9120a05e0d1f644517815bb363863e40
SHA1 51ed465a0e301c74704a031006b62e95e0492228
SHA512 dbf20312db5fb1f2d3cc19bae8fbf9f1d57245270b801c756eb32694ae9c5b564b2c2b0976045620302f0af705d443785219c0bcc4ff0838108b242fc2db16e4
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZw:ROdWCCi7/rahW/dLUoJlruRXPw
MD5 SHA1 SHA512 SSDEEP

Submit Download

yCObzXu.exe

Path C:\Windows\System\yCObzXu.exe
Size 1.4MB
SHA256 b0f15ae16b051c04cf9b835507557b44ee61d5ddf9b1f9c006793b16accca69f
MD5 a32797ee038a30d39a28ed32577ba305
SHA1 979e932b5ba7abdb7cc23fd354e7d019230c2164
SHA512 7048f9d04dd32debd41254d5f359e85472056ec9f6a96feef2f80f4b22c7e98a8f126f69e4c875dbcaf6be7fef7f98c730c3803c8cfd4f9461bd79139d7818c2
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZy:ROdWCCi7/rahW/dLUoJlruRXPy
MD5 SHA1 SHA512 SSDEEP

Submit Download

yEzICEl.exe

Path C:\Windows\System\yEzICEl.exe
Size 1.4MB
SHA256 55c51a2cab45f4c3b5b81d72438c0ccdcb225999cdc2e580bf92a451b3512b5c
MD5 8b76521fca001d2aabea293ced98e99d
SHA1 06960aa5a0898716bb0b19fe5dd2616e80359d44
SHA512 8959c9b5121cd52a8f3fb80dcb2cd8e1422614c0b5f584c37c0a0ef8afc2ba3d56033c1ccd6cd09b6a412933debe0be7ab9fe79161e0f49642c543dc2fe6dd5e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZs:ROdWCCi7/rahW/dLUoJlruRXPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

ybeRMcZ.exe

Path C:\Windows\System\ybeRMcZ.exe
Size 1.4MB
SHA256 56118a2fd4dc26cfd040f32be7bd538c85248a24e6bfa399e24ce6ab4c0b87b9
MD5 97bce56119fff1f688764be5e37112ba
SHA1 530b027d1c1bd42af26aa43198efe03874dac690
SHA512 39fd25b2142b8dad0c3d05763faa44ef2fbb1a23790a7c416b92ba1479441682fce6d08d77d07c1c58942f0986fbe12c7bad534261e80a5c2234ae2deb57e07e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZ4:ROdWCCi7/rahW/dLUoJlruRXP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

zLlhoWc.exe

Path C:\Windows\System\zLlhoWc.exe
Size 1.4MB
SHA256 1fa97ac703e0c58c6da7e3bf288ec01e6731b46afaa2e4ebd878d4ecc8aa621e
MD5 cd4b4b440e5cd0cdfaa59bee25c4b486
SHA1 01add4504dc8e0745293a9fbe694c88d2066492b
SHA512 146715bdecc00e8c335d608a0ac5bd460579d8cc47c05e23b6a777acab04d160d8c2c2bb7d822e6952a5875e2bf14c20ad3a1d107fb4ca5528cd8753b6a31935
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZn:ROdWCCi7/rahW/dLUoJlruRXPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

zYIcqSK.exe

Path C:\Windows\System\zYIcqSK.exe
Size 1.4MB
SHA256 d85de6a627c74d6f4372ffaef7c80390b0195c668765731c324d5562ef6a5078
MD5 86734a9724d6c7b6b8965d402ad92444
SHA1 b1b88319a6ecbbd6b0fd50b29476a2282d181aca
SHA512 290442dbb9e4e5b308aeac2a4c2b07d4f94e4df66525d90bcdd3180395fc6b916a7ac7cef43e0904b52bb0dbd910b944fd4c461478625bcc556efa5a38156fce
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QonLbSP+Y70dCNulTHYs4A6RLQsvcp4lZd:ROdWCCi7/rahW/dLUoJlruRXPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/656-2328-0x00007FF6674A0000-0x00007FF6677F1000-memory.dmp

Download

memory/656-352-0x00007FF6674A0000-0x00007FF6677F1000-memory.dmp

Download

memory/1220-2322-0x00007FF7988D0000-0x00007FF798C21000-memory.dmp

Download

memory/1220-266-0x00007FF7988D0000-0x00007FF798C21000-memory.dmp

Download

memory/1284-2336-0x00007FF71C710000-0x00007FF71CA61000-memory.dmp

Download

memory/1284-267-0x00007FF71C710000-0x00007FF71CA61000-memory.dmp

Download

memory/1584-315-0x00007FF697940000-0x00007FF697C91000-memory.dmp

Download

memory/1584-2341-0x00007FF697940000-0x00007FF697C91000-memory.dmp

Download

memory/1756-32-0x00007FF6653E0000-0x00007FF665731000-memory.dmp

Download

memory/1756-2285-0x00007FF6653E0000-0x00007FF665731000-memory.dmp

Download

memory/2136-2289-0x00007FF702E70000-0x00007FF7031C1000-memory.dmp

Download

memory/2136-30-0x00007FF702E70000-0x00007FF7031C1000-memory.dmp

Download

memory/2136-2235-0x00007FF702E70000-0x00007FF7031C1000-memory.dmp

Download

memory/2236-340-0x00007FF789A00000-0x00007FF789D51000-memory.dmp

Download

memory/2236-2350-0x00007FF789A00000-0x00007FF789D51000-memory.dmp

Download

memory/2276-2324-0x00007FF7FB6C0000-0x00007FF7FBA11000-memory.dmp

Download

memory/2276-357-0x00007FF7FB6C0000-0x00007FF7FBA11000-memory.dmp

Download

memory/2372-2242-0x00007FF6596D0000-0x00007FF659A21000-memory.dmp

Download

memory/2372-103-0x00007FF6596D0000-0x00007FF659A21000-memory.dmp

Download

memory/2372-2326-0x00007FF6596D0000-0x00007FF659A21000-memory.dmp

Download

memory/2500-2334-0x00007FF6D7FC0000-0x00007FF6D8311000-memory.dmp

Download

memory/2500-296-0x00007FF6D7FC0000-0x00007FF6D8311000-memory.dmp

Download

memory/2912-2305-0x00007FF793CC0000-0x00007FF794011000-memory.dmp

Download

memory/2912-56-0x00007FF793CC0000-0x00007FF794011000-memory.dmp

Download

memory/2916-95-0x00007FF674650000-0x00007FF6749A1000-memory.dmp

Download

memory/2916-2241-0x00007FF674650000-0x00007FF6749A1000-memory.dmp

Download

memory/2916-2318-0x00007FF674650000-0x00007FF6749A1000-memory.dmp

Download

memory/2940-51-0x00007FF69FA30000-0x00007FF69FD81000-memory.dmp

Download

memory/2940-2287-0x00007FF69FA30000-0x00007FF69FD81000-memory.dmp

Download

memory/3068-2271-0x00007FF665650000-0x00007FF6659A1000-memory.dmp

Download

memory/3068-2231-0x00007FF665650000-0x00007FF6659A1000-memory.dmp

Download

memory/3068-25-0x00007FF665650000-0x00007FF6659A1000-memory.dmp

Download

memory/3352-2320-0x00007FF659430000-0x00007FF659781000-memory.dmp

Download

memory/3352-265-0x00007FF659430000-0x00007FF659781000-memory.dmp

Download

memory/3352-2239-0x00007FF659430000-0x00007FF659781000-memory.dmp

Download

memory/3376-333-0x00007FF7C9210000-0x00007FF7C9561000-memory.dmp

Download

memory/3376-2352-0x00007FF7C9210000-0x00007FF7C9561000-memory.dmp

Download

memory/3656-2353-0x00007FF75EBB0000-0x00007FF75EF01000-memory.dmp

Download

memory/3656-318-0x00007FF75EBB0000-0x00007FF75EF01000-memory.dmp

Download

memory/3664-2237-0x00007FF6DCE30000-0x00007FF6DD181000-memory.dmp

Download

memory/3664-2313-0x00007FF6DCE30000-0x00007FF6DD181000-memory.dmp

Download

memory/3664-80-0x00007FF6DCE30000-0x00007FF6DD181000-memory.dmp

Download

memory/3924-15-0x00007FF60C700000-0x00007FF60CA51000-memory.dmp

Download

memory/3924-2244-0x00007FF60C700000-0x00007FF60CA51000-memory.dmp

Download

memory/3924-2201-0x00007FF60C700000-0x00007FF60CA51000-memory.dmp

Download

memory/3932-17-0x00007FF799790000-0x00007FF799AE1000-memory.dmp

Download

memory/3932-2246-0x00007FF799790000-0x00007FF799AE1000-memory.dmp

Download

memory/3976-356-0x00007FF7D0750000-0x00007FF7D0AA1000-memory.dmp

Download

memory/3976-2309-0x00007FF7D0750000-0x00007FF7D0AA1000-memory.dmp

Download

memory/4304-2331-0x00007FF6EC3F0000-0x00007FF6EC741000-memory.dmp

Download

memory/4304-358-0x00007FF6EC3F0000-0x00007FF6EC741000-memory.dmp

Download

memory/4332-2348-0x00007FF7B5130000-0x00007FF7B5481000-memory.dmp

Download

memory/4332-349-0x00007FF7B5130000-0x00007FF7B5481000-memory.dmp

Download

memory/4440-2311-0x00007FF7AB590000-0x00007FF7AB8E1000-memory.dmp

Download

memory/4440-353-0x00007FF7AB590000-0x00007FF7AB8E1000-memory.dmp

Download

memory/4468-2316-0x00007FF74B600000-0x00007FF74B951000-memory.dmp

Download

memory/4468-2240-0x00007FF74B600000-0x00007FF74B951000-memory.dmp

Download

memory/4468-89-0x00007FF74B600000-0x00007FF74B951000-memory.dmp

Download

memory/4584-348-0x00007FF64FE40000-0x00007FF650191000-memory.dmp

Download

memory/4584-2346-0x00007FF64FE40000-0x00007FF650191000-memory.dmp

Download

memory/4784-2133-0x00007FF7CC540000-0x00007FF7CC891000-memory.dmp

Download

memory/4784-0-0x00007FF7CC540000-0x00007FF7CC891000-memory.dmp

Download

memory/4784-1-0x0000019BD8510000-0x0000019BD8520000-memory.dmp

Download

memory/4808-350-0x00007FF6B7370000-0x00007FF6B76C1000-memory.dmp

Download

memory/4808-2344-0x00007FF6B7370000-0x00007FF6B76C1000-memory.dmp

Download

memory/5028-2308-0x00007FF66C9E0000-0x00007FF66CD31000-memory.dmp

Download

memory/5028-60-0x00007FF66C9E0000-0x00007FF66CD31000-memory.dmp

Download

memory/5028-2236-0x00007FF66C9E0000-0x00007FF66CD31000-memory.dmp

Download

memory/5032-2329-0x00007FF6513D0000-0x00007FF651721000-memory.dmp

Download

memory/5032-88-0x00007FF6513D0000-0x00007FF651721000-memory.dmp

Download

memory/5032-2238-0x00007FF6513D0000-0x00007FF651721000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads