xmrig | ea144629844a658123d4ac38c6bd4262e145316becede91061e2c623dd98900f

Analysis

max time kernel
119s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
Size 1.6MB
Sample240518-qa671scg4v
SHA256 ea144629844a658123d4ac38c6bd4262e145316becede91061e2c623dd98900f
MD5 c9600b69efa3dcb43e07bf63f116d160
SHA1 98059cdd729b1538bd5696b939757e01e8935142
SHA512 3acf1e922fa7624e31877533a9e413a2fb125c190519ae1dd135af825d5644b4fab46c6ebe2317e9299fc5506e1fd7557c6da49e66940df15850877094c67395
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdo:RWWBibai
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 61 IoCs

miner

resource	yara_rule
behavioral2/memory/3636-23-0x00007FF755460000-0x00007FF7557B1000-memory.dmp	xmrig
behavioral2/memory/2972-212-0x00007FF633850000-0x00007FF633BA1000-memory.dmp	xmrig
behavioral2/memory/2992-219-0x00007FF684480000-0x00007FF6847D1000-memory.dmp	xmrig
behavioral2/memory/2348-243-0x00007FF7FD4D0000-0x00007FF7FD821000-memory.dmp	xmrig
behavioral2/memory/3972-571-0x00007FF7C51F0000-0x00007FF7C5541000-memory.dmp	xmrig
behavioral2/memory/4276-2473-0x00007FF785520000-0x00007FF785871000-memory.dmp	xmrig
behavioral2/memory/388-520-0x00007FF7EFF30000-0x00007FF7F0281000-memory.dmp	xmrig
behavioral2/memory/1844-519-0x00007FF66BB10000-0x00007FF66BE61000-memory.dmp	xmrig
behavioral2/memory/2956-462-0x00007FF650FA0000-0x00007FF6512F1000-memory.dmp	xmrig
behavioral2/memory/4704-458-0x00007FF6FD0E0000-0x00007FF6FD431000-memory.dmp	xmrig
behavioral2/memory/2720-412-0x00007FF770D80000-0x00007FF7710D1000-memory.dmp	xmrig
behavioral2/memory/4920-392-0x00007FF6E6160000-0x00007FF6E64B1000-memory.dmp	xmrig
behavioral2/memory/4352-389-0x00007FF6E0B70000-0x00007FF6E0EC1000-memory.dmp	xmrig
behavioral2/memory/3488-341-0x00007FF6EEA30000-0x00007FF6EED81000-memory.dmp	xmrig
behavioral2/memory/3956-306-0x00007FF7EF9A0000-0x00007FF7EFCF1000-memory.dmp	xmrig
behavioral2/memory/4832-305-0x00007FF7A02A0000-0x00007FF7A05F1000-memory.dmp	xmrig
behavioral2/memory/2948-290-0x00007FF6BFAF0000-0x00007FF6BFE41000-memory.dmp	xmrig
behavioral2/memory/1676-254-0x00007FF7B9240000-0x00007FF7B9591000-memory.dmp	xmrig
behavioral2/memory/2904-218-0x00007FF616B50000-0x00007FF616EA1000-memory.dmp	xmrig
behavioral2/memory/5000-198-0x00007FF6E9310000-0x00007FF6E9661000-memory.dmp	xmrig
behavioral2/memory/3640-118-0x00007FF712D90000-0x00007FF7130E1000-memory.dmp	xmrig
behavioral2/memory/3844-115-0x00007FF7AB2F0000-0x00007FF7AB641000-memory.dmp	xmrig
behavioral2/memory/3440-70-0x00007FF7930C0000-0x00007FF793411000-memory.dmp	xmrig
behavioral2/memory/3136-47-0x00007FF75A020000-0x00007FF75A371000-memory.dmp	xmrig
behavioral2/memory/2080-46-0x00007FF72BFF0000-0x00007FF72C341000-memory.dmp	xmrig
behavioral2/memory/1104-12-0x00007FF6DA6D0000-0x00007FF6DAA21000-memory.dmp	xmrig
behavioral2/memory/1104-2570-0x00007FF6DA6D0000-0x00007FF6DAA21000-memory.dmp	xmrig
behavioral2/memory/2588-2571-0x00007FF65EE80000-0x00007FF65F1D1000-memory.dmp	xmrig
behavioral2/memory/3440-2572-0x00007FF7930C0000-0x00007FF793411000-memory.dmp	xmrig
behavioral2/memory/2108-2573-0x00007FF7C1170000-0x00007FF7C14C1000-memory.dmp	xmrig
behavioral2/memory/1620-2574-0x00007FF637970000-0x00007FF637CC1000-memory.dmp	xmrig
behavioral2/memory/1848-2575-0x00007FF79C160000-0x00007FF79C4B1000-memory.dmp	xmrig
behavioral2/memory/3136-2623-0x00007FF75A020000-0x00007FF75A371000-memory.dmp	xmrig
behavioral2/memory/2080-2621-0x00007FF72BFF0000-0x00007FF72C341000-memory.dmp	xmrig
behavioral2/memory/2588-2616-0x00007FF65EE80000-0x00007FF65F1D1000-memory.dmp	xmrig
behavioral2/memory/4704-2627-0x00007FF6FD0E0000-0x00007FF6FD431000-memory.dmp	xmrig
behavioral2/memory/3440-2626-0x00007FF7930C0000-0x00007FF793411000-memory.dmp	xmrig
behavioral2/memory/3636-2614-0x00007FF755460000-0x00007FF7557B1000-memory.dmp	xmrig
behavioral2/memory/1104-2609-0x00007FF6DA6D0000-0x00007FF6DAA21000-memory.dmp	xmrig
behavioral2/memory/1844-2636-0x00007FF66BB10000-0x00007FF66BE61000-memory.dmp	xmrig
behavioral2/memory/1848-2634-0x00007FF79C160000-0x00007FF79C4B1000-memory.dmp	xmrig
behavioral2/memory/2972-2645-0x00007FF633850000-0x00007FF633BA1000-memory.dmp	xmrig
behavioral2/memory/5000-2647-0x00007FF6E9310000-0x00007FF6E9661000-memory.dmp	xmrig
behavioral2/memory/388-2649-0x00007FF7EFF30000-0x00007FF7F0281000-memory.dmp	xmrig
behavioral2/memory/2992-2643-0x00007FF684480000-0x00007FF6847D1000-memory.dmp	xmrig
behavioral2/memory/2956-2638-0x00007FF650FA0000-0x00007FF6512F1000-memory.dmp	xmrig
behavioral2/memory/2108-2632-0x00007FF7C1170000-0x00007FF7C14C1000-memory.dmp	xmrig
behavioral2/memory/2720-2641-0x00007FF770D80000-0x00007FF7710D1000-memory.dmp	xmrig
behavioral2/memory/3844-2640-0x00007FF7AB2F0000-0x00007FF7AB641000-memory.dmp	xmrig
behavioral2/memory/3640-2630-0x00007FF712D90000-0x00007FF7130E1000-memory.dmp	xmrig
behavioral2/memory/1620-2671-0x00007FF637970000-0x00007FF637CC1000-memory.dmp	xmrig
behavioral2/memory/2348-2670-0x00007FF7FD4D0000-0x00007FF7FD821000-memory.dmp	xmrig
behavioral2/memory/4352-2673-0x00007FF6E0B70000-0x00007FF6E0EC1000-memory.dmp	xmrig
behavioral2/memory/2904-2668-0x00007FF616B50000-0x00007FF616EA1000-memory.dmp	xmrig
behavioral2/memory/2948-2663-0x00007FF6BFAF0000-0x00007FF6BFE41000-memory.dmp	xmrig
behavioral2/memory/4832-2662-0x00007FF7A02A0000-0x00007FF7A05F1000-memory.dmp	xmrig
behavioral2/memory/3956-2659-0x00007FF7EF9A0000-0x00007FF7EFCF1000-memory.dmp	xmrig
behavioral2/memory/3488-2658-0x00007FF6EEA30000-0x00007FF6EED81000-memory.dmp	xmrig
behavioral2/memory/1676-2665-0x00007FF7B9240000-0x00007FF7B9591000-memory.dmp	xmrig
behavioral2/memory/4920-2655-0x00007FF6E6160000-0x00007FF6E64B1000-memory.dmp	xmrig
behavioral2/memory/3972-2654-0x00007FF7C51F0000-0x00007FF7C5541000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1104	xsbPsnC.exe
3636	peJYIqb.exe
2588	QatMdvF.exe
2720	zBIhnrP.exe
2080	pVGrkLL.exe
3136	aPatWig.exe
4704	VtBWlCR.exe
3440	Gnmshfq.exe
2956	XOFdoko.exe
1848	MAIyMwP.exe
2108	JxZCYoZ.exe
3844	eJGDqfF.exe
1844	MfYZcmX.exe
3640	YhfxAmA.exe
1620	hNhnQJS.exe
5000	wUxaOjQ.exe
2972	rqUOShT.exe
2904	WrilNHl.exe
2992	NoTTHNO.exe
388	crxwVVs.exe
2348	DwMvuaI.exe
1676	tRRdOHn.exe
2948	nWWNPZU.exe
4832	buiHHXt.exe
3972	cSVaRIr.exe
3956	KpIqbrK.exe
3488	efQgUDg.exe
4352	nstwCqh.exe
4920	cCYbCIl.exe
3804	pOIeWpu.exe
1280	lUFDbkD.exe
1772	LSrHwKa.exe
4368	JWngNHV.exe
1616	aNcAZue.exe
2332	pqUIWui.exe
4796	VevQHmV.exe
3100	XsljutO.exe
5008	lpDJkVe.exe
3700	asoDHmv.exe
4060	EUmbKFx.exe
3768	MIgdDYA.exe
4768	PgoZZDf.exe
3328	PADLrnc.exe
2740	glLdMAb.exe
1528	FNcVlse.exe
3184	wjIsOUZ.exe
3624	pqVChfI.exe
568	DJNBIEo.exe
4712	PCtSdxo.exe
3608	nnLleGZ.exe
3704	purIPKJ.exe
3188	IIxbmvA.exe
1012	TsvDzec.exe
4956	FdBLUzY.exe
2280	bjAmBEv.exe
3220	BvWlnWB.exe
2812	SNIUeNn.exe
4924	UnJWonx.exe
1872	trnTphu.exe
2376	TxqgqSv.exe
4076	ZnesaAa.exe
3836	SFVMaCo.exe
2888	TlYHEhp.exe
3820	hKhwsRA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4276-0-0x00007FF785520000-0x00007FF785871000-memory.dmp	upx
behavioral2/files/0x000800000002340e-6.dat	upx
behavioral2/files/0x0007000000023413-8.dat	upx
behavioral2/files/0x0007000000023412-24.dat	upx
behavioral2/memory/3636-23-0x00007FF755460000-0x00007FF7557B1000-memory.dmp	upx
behavioral2/files/0x0007000000023417-40.dat	upx
behavioral2/files/0x0007000000023435-189.dat	upx
behavioral2/files/0x0007000000023433-187.dat	upx
behavioral2/memory/2972-212-0x00007FF633850000-0x00007FF633BA1000-memory.dmp	upx
behavioral2/memory/2992-219-0x00007FF684480000-0x00007FF6847D1000-memory.dmp	upx
behavioral2/memory/2348-243-0x00007FF7FD4D0000-0x00007FF7FD821000-memory.dmp	upx
behavioral2/memory/3972-571-0x00007FF7C51F0000-0x00007FF7C5541000-memory.dmp	upx
behavioral2/memory/4276-2473-0x00007FF785520000-0x00007FF785871000-memory.dmp	upx
behavioral2/memory/388-520-0x00007FF7EFF30000-0x00007FF7F0281000-memory.dmp	upx
behavioral2/memory/1844-519-0x00007FF66BB10000-0x00007FF66BE61000-memory.dmp	upx
behavioral2/memory/2956-462-0x00007FF650FA0000-0x00007FF6512F1000-memory.dmp	upx
behavioral2/memory/4704-458-0x00007FF6FD0E0000-0x00007FF6FD431000-memory.dmp	upx
behavioral2/memory/2720-412-0x00007FF770D80000-0x00007FF7710D1000-memory.dmp	upx
behavioral2/memory/4920-392-0x00007FF6E6160000-0x00007FF6E64B1000-memory.dmp	upx
behavioral2/memory/4352-389-0x00007FF6E0B70000-0x00007FF6E0EC1000-memory.dmp	upx
behavioral2/memory/3488-341-0x00007FF6EEA30000-0x00007FF6EED81000-memory.dmp	upx
behavioral2/memory/3956-306-0x00007FF7EF9A0000-0x00007FF7EFCF1000-memory.dmp	upx
behavioral2/memory/4832-305-0x00007FF7A02A0000-0x00007FF7A05F1000-memory.dmp	upx
behavioral2/memory/2948-290-0x00007FF6BFAF0000-0x00007FF6BFE41000-memory.dmp	upx
behavioral2/memory/1676-254-0x00007FF7B9240000-0x00007FF7B9591000-memory.dmp	upx
behavioral2/memory/2904-218-0x00007FF616B50000-0x00007FF616EA1000-memory.dmp	upx
behavioral2/files/0x0007000000023437-202.dat	upx
behavioral2/memory/5000-198-0x00007FF6E9310000-0x00007FF6E9661000-memory.dmp	upx
behavioral2/files/0x000700000002342c-195.dat	upx
behavioral2/files/0x0007000000023436-192.dat	upx
behavioral2/files/0x000700000002342b-181.dat	upx
behavioral2/files/0x0007000000023428-178.dat	upx
behavioral2/files/0x0007000000023426-173.dat	upx
behavioral2/files/0x0007000000023427-172.dat	upx
behavioral2/files/0x0007000000023432-167.dat	upx
behavioral2/files/0x0007000000023431-166.dat	upx
behavioral2/files/0x0007000000023430-163.dat	upx
behavioral2/memory/1620-158-0x00007FF637970000-0x00007FF637CC1000-memory.dmp	upx
behavioral2/files/0x0007000000023425-155.dat	upx
behavioral2/files/0x000700000002342f-154.dat	upx
behavioral2/files/0x000700000002342e-153.dat	upx
behavioral2/files/0x000700000002342d-152.dat	upx
behavioral2/files/0x0007000000023429-142.dat	upx
behavioral2/files/0x000700000002341c-137.dat	upx
behavioral2/files/0x0007000000023422-135.dat	upx
behavioral2/files/0x0007000000023421-129.dat	upx
behavioral2/files/0x000700000002342a-128.dat	upx
behavioral2/files/0x0007000000023424-126.dat	upx
behavioral2/files/0x0007000000023423-121.dat	upx
behavioral2/files/0x0007000000023420-120.dat	upx
behavioral2/memory/3640-118-0x00007FF712D90000-0x00007FF7130E1000-memory.dmp	upx
behavioral2/memory/3844-115-0x00007FF7AB2F0000-0x00007FF7AB641000-memory.dmp	upx
behavioral2/files/0x000700000002341f-113.dat	upx
behavioral2/files/0x000700000002341e-111.dat	upx
behavioral2/memory/2108-99-0x00007FF7C1170000-0x00007FF7C14C1000-memory.dmp	upx
behavioral2/files/0x000700000002341b-94.dat	upx
behavioral2/files/0x000700000002341a-80.dat	upx
behavioral2/memory/3440-70-0x00007FF7930C0000-0x00007FF793411000-memory.dmp	upx
behavioral2/files/0x000700000002341d-69.dat	upx
behavioral2/files/0x0007000000023419-65.dat	upx
behavioral2/memory/1848-74-0x00007FF79C160000-0x00007FF79C4B1000-memory.dmp	upx
behavioral2/files/0x0007000000023415-56.dat	upx
behavioral2/memory/3136-47-0x00007FF75A020000-0x00007FF75A371000-memory.dmp	upx
behavioral2/memory/2080-46-0x00007FF72BFF0000-0x00007FF72C341000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uOdAKUF.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\fBkTpEA.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\dypltKa.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\zihVwjc.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\zJtjLlW.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\ZUIJAQF.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\fNKhTjF.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\xTaUqvP.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\FXGEYpD.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\EsjhoXk.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\UukvAra.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\nJmGaJB.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\HAerqMN.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\ulxBRwA.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\DXwBocd.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\atkcaQh.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\ZylmHng.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\cTFcREG.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\KVpkkNF.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\eiUrJgr.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\xLgBZWU.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\XejNulm.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\fBGAfbw.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\gXlvOEh.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\oZhDIzK.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\kQxfwhy.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\GQLzjFE.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\lYMIrKZ.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\dWKGptq.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\ERIxEwz.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\pfiYzdG.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\wWKApMy.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\fhFQyyM.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\jXfpblL.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\hgDXMkC.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\OQdqbNn.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\daoxMFA.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\JMdFMkT.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\VsmFYwb.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\zkkczmK.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\ofJJtaE.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\tGjEZfs.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\yiruJIk.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\uzZEWCj.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\BSFkTXR.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\ZmgKrMd.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\qzHnGGW.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\kDmnHZV.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\UfmYqiC.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\cSbqgkq.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\NQECrDj.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\pXJZcml.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\LaIdexV.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\fCikMMd.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\FtYfhUY.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\uBBnZvP.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\woAAsuv.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\HaCZsFv.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\BgRIJCx.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\SpDbCwj.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\QvmGiyu.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\KIYBZsA.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\TDXTfRX.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
File created	C:\Windows\System\YXZvnzk.exe	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 1104	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	83
PID 4276 wrote to memory of 1104	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	83
PID 4276 wrote to memory of 2588	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	84
PID 4276 wrote to memory of 2588	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	84
PID 4276 wrote to memory of 3636	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	85
PID 4276 wrote to memory of 3636	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	85
PID 4276 wrote to memory of 2080	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	86
PID 4276 wrote to memory of 2080	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	86
PID 4276 wrote to memory of 2720	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	87
PID 4276 wrote to memory of 2720	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	87
PID 4276 wrote to memory of 3136	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	88
PID 4276 wrote to memory of 3136	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	88
PID 4276 wrote to memory of 4704	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	89
PID 4276 wrote to memory of 4704	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	89
PID 4276 wrote to memory of 3440	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	90
PID 4276 wrote to memory of 3440	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	90
PID 4276 wrote to memory of 2956	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	91
PID 4276 wrote to memory of 2956	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	91
PID 4276 wrote to memory of 1848	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	92
PID 4276 wrote to memory of 1848	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	92
PID 4276 wrote to memory of 2108	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	93
PID 4276 wrote to memory of 2108	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	93
PID 4276 wrote to memory of 1620	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	94
PID 4276 wrote to memory of 1620	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	94
PID 4276 wrote to memory of 3844	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	95
PID 4276 wrote to memory of 3844	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	95
PID 4276 wrote to memory of 1844	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	96
PID 4276 wrote to memory of 1844	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	96
PID 4276 wrote to memory of 3640	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	97
PID 4276 wrote to memory of 3640	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	97
PID 4276 wrote to memory of 5000	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	98
PID 4276 wrote to memory of 5000	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	98
PID 4276 wrote to memory of 2972	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	99
PID 4276 wrote to memory of 2972	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	99
PID 4276 wrote to memory of 2904	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	100
PID 4276 wrote to memory of 2904	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	100
PID 4276 wrote to memory of 2992	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	101
PID 4276 wrote to memory of 2992	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	101
PID 4276 wrote to memory of 388	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	102
PID 4276 wrote to memory of 388	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	102
PID 4276 wrote to memory of 2348	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	103
PID 4276 wrote to memory of 2348	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	103
PID 4276 wrote to memory of 1676	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	104
PID 4276 wrote to memory of 1676	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	104
PID 4276 wrote to memory of 2948	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	105
PID 4276 wrote to memory of 2948	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	105
PID 4276 wrote to memory of 4832	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	106
PID 4276 wrote to memory of 4832	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	106
PID 4276 wrote to memory of 3956	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	107
PID 4276 wrote to memory of 3956	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	107
PID 4276 wrote to memory of 3972	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	108
PID 4276 wrote to memory of 3972	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	108
PID 4276 wrote to memory of 3488	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	109
PID 4276 wrote to memory of 3488	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	109
PID 4276 wrote to memory of 4352	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	110
PID 4276 wrote to memory of 4352	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	110
PID 4276 wrote to memory of 4920	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	111
PID 4276 wrote to memory of 4920	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	111
PID 4276 wrote to memory of 3804	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	112
PID 4276 wrote to memory of 3804	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	112
PID 4276 wrote to memory of 1280	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	113
PID 4276 wrote to memory of 1280	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	113
PID 4276 wrote to memory of 1772	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	114
PID 4276 wrote to memory of 1772	4276	c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c9600b69efa3dcb43e07bf63f116d160_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\System\xsbPsnC.exe
  C:\Windows\System\xsbPsnC.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\QatMdvF.exe
  C:\Windows\System\QatMdvF.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\peJYIqb.exe
  C:\Windows\System\peJYIqb.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\pVGrkLL.exe
  C:\Windows\System\pVGrkLL.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\zBIhnrP.exe
  C:\Windows\System\zBIhnrP.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\aPatWig.exe
  C:\Windows\System\aPatWig.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\VtBWlCR.exe
  C:\Windows\System\VtBWlCR.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\Gnmshfq.exe
  C:\Windows\System\Gnmshfq.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\XOFdoko.exe
  C:\Windows\System\XOFdoko.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\MAIyMwP.exe
  C:\Windows\System\MAIyMwP.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\JxZCYoZ.exe
  C:\Windows\System\JxZCYoZ.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\hNhnQJS.exe
  C:\Windows\System\hNhnQJS.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\eJGDqfF.exe
  C:\Windows\System\eJGDqfF.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\MfYZcmX.exe
  C:\Windows\System\MfYZcmX.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\YhfxAmA.exe
  C:\Windows\System\YhfxAmA.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\wUxaOjQ.exe
  C:\Windows\System\wUxaOjQ.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\rqUOShT.exe
  C:\Windows\System\rqUOShT.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\WrilNHl.exe
  C:\Windows\System\WrilNHl.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\NoTTHNO.exe
  C:\Windows\System\NoTTHNO.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\crxwVVs.exe
  C:\Windows\System\crxwVVs.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\DwMvuaI.exe
  C:\Windows\System\DwMvuaI.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\tRRdOHn.exe
  C:\Windows\System\tRRdOHn.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\nWWNPZU.exe
  C:\Windows\System\nWWNPZU.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\buiHHXt.exe
  C:\Windows\System\buiHHXt.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\KpIqbrK.exe
  C:\Windows\System\KpIqbrK.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\cSVaRIr.exe
  C:\Windows\System\cSVaRIr.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\efQgUDg.exe
  C:\Windows\System\efQgUDg.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\nstwCqh.exe
  C:\Windows\System\nstwCqh.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\cCYbCIl.exe
  C:\Windows\System\cCYbCIl.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\pOIeWpu.exe
  C:\Windows\System\pOIeWpu.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\lUFDbkD.exe
  C:\Windows\System\lUFDbkD.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\LSrHwKa.exe
  C:\Windows\System\LSrHwKa.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\JWngNHV.exe
  C:\Windows\System\JWngNHV.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\aNcAZue.exe
  C:\Windows\System\aNcAZue.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\pqUIWui.exe
  C:\Windows\System\pqUIWui.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\pqVChfI.exe
  C:\Windows\System\pqVChfI.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\VevQHmV.exe
  C:\Windows\System\VevQHmV.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\XsljutO.exe
  C:\Windows\System\XsljutO.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\lpDJkVe.exe
  C:\Windows\System\lpDJkVe.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\asoDHmv.exe
  C:\Windows\System\asoDHmv.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\EUmbKFx.exe
  C:\Windows\System\EUmbKFx.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\MIgdDYA.exe
  C:\Windows\System\MIgdDYA.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\PgoZZDf.exe
  C:\Windows\System\PgoZZDf.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\PADLrnc.exe
  C:\Windows\System\PADLrnc.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\glLdMAb.exe
  C:\Windows\System\glLdMAb.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\FNcVlse.exe
  C:\Windows\System\FNcVlse.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\wjIsOUZ.exe
  C:\Windows\System\wjIsOUZ.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\DJNBIEo.exe
  C:\Windows\System\DJNBIEo.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\PCtSdxo.exe
  C:\Windows\System\PCtSdxo.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\nnLleGZ.exe
  C:\Windows\System\nnLleGZ.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\purIPKJ.exe
  C:\Windows\System\purIPKJ.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\IIxbmvA.exe
  C:\Windows\System\IIxbmvA.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\TsvDzec.exe
  C:\Windows\System\TsvDzec.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\FdBLUzY.exe
  C:\Windows\System\FdBLUzY.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\bjAmBEv.exe
  C:\Windows\System\bjAmBEv.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\BvWlnWB.exe
  C:\Windows\System\BvWlnWB.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\SNIUeNn.exe
  C:\Windows\System\SNIUeNn.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\UnJWonx.exe
  C:\Windows\System\UnJWonx.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\trnTphu.exe
  C:\Windows\System\trnTphu.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\TxqgqSv.exe
  C:\Windows\System\TxqgqSv.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ZnesaAa.exe
  C:\Windows\System\ZnesaAa.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\SFVMaCo.exe
  C:\Windows\System\SFVMaCo.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\soVlord.exe
  C:\Windows\System\soVlord.exe
  2⤵
  PID:4912
- C:\Windows\System\TlYHEhp.exe
  C:\Windows\System\TlYHEhp.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\hKhwsRA.exe
  C:\Windows\System\hKhwsRA.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\miTppVd.exe
  C:\Windows\System\miTppVd.exe
  2⤵
  PID:2056
- C:\Windows\System\nGSIAmH.exe
  C:\Windows\System\nGSIAmH.exe
  2⤵
  PID:4996
- C:\Windows\System\dypltKa.exe
  C:\Windows\System\dypltKa.exe
  2⤵
  PID:1640
- C:\Windows\System\cdkpmLz.exe
  C:\Windows\System\cdkpmLz.exe
  2⤵
  PID:3468
- C:\Windows\System\LsKMTOV.exe
  C:\Windows\System\LsKMTOV.exe
  2⤵
  PID:4576
- C:\Windows\System\kKYrErC.exe
  C:\Windows\System\kKYrErC.exe
  2⤵
  PID:3760
- C:\Windows\System\yWxlTqw.exe
  C:\Windows\System\yWxlTqw.exe
  2⤵
  PID:3152
- C:\Windows\System\LVyZvRf.exe
  C:\Windows\System\LVyZvRf.exe
  2⤵
  PID:1656
- C:\Windows\System\qDRaWUp.exe
  C:\Windows\System\qDRaWUp.exe
  2⤵
  PID:4972
- C:\Windows\System\lZBfWPK.exe
  C:\Windows\System\lZBfWPK.exe
  2⤵
  PID:644
- C:\Windows\System\zTtiHol.exe
  C:\Windows\System\zTtiHol.exe
  2⤵
  PID:3168
- C:\Windows\System\wkUfatd.exe
  C:\Windows\System\wkUfatd.exe
  2⤵
  PID:3344
- C:\Windows\System\PbnKsJL.exe
  C:\Windows\System\PbnKsJL.exe
  2⤵
  PID:5136
- C:\Windows\System\eYjQcTo.exe
  C:\Windows\System\eYjQcTo.exe
  2⤵
  PID:5152
- C:\Windows\System\ZNClAWs.exe
  C:\Windows\System\ZNClAWs.exe
  2⤵
  PID:5172
- C:\Windows\System\EzVIJSn.exe
  C:\Windows\System\EzVIJSn.exe
  2⤵
  PID:5200
- C:\Windows\System\kTNTmud.exe
  C:\Windows\System\kTNTmud.exe
  2⤵
  PID:5220
- C:\Windows\System\UqKTOQr.exe
  C:\Windows\System\UqKTOQr.exe
  2⤵
  PID:5236
- C:\Windows\System\OpYwKdy.exe
  C:\Windows\System\OpYwKdy.exe
  2⤵
  PID:5260
- C:\Windows\System\ZXzTmNL.exe
  C:\Windows\System\ZXzTmNL.exe
  2⤵
  PID:5384
- C:\Windows\System\KVEpqku.exe
  C:\Windows\System\KVEpqku.exe
  2⤵
  PID:5404
- C:\Windows\System\gjVMxqk.exe
  C:\Windows\System\gjVMxqk.exe
  2⤵
  PID:5424
- C:\Windows\System\hAGEDHm.exe
  C:\Windows\System\hAGEDHm.exe
  2⤵
  PID:5464
- C:\Windows\System\DTgkScz.exe
  C:\Windows\System\DTgkScz.exe
  2⤵
  PID:5484
- C:\Windows\System\uOdAKUF.exe
  C:\Windows\System\uOdAKUF.exe
  2⤵
  PID:5512
- C:\Windows\System\TPzDHvJ.exe
  C:\Windows\System\TPzDHvJ.exe
  2⤵
  PID:5532
- C:\Windows\System\vSlABGa.exe
  C:\Windows\System\vSlABGa.exe
  2⤵
  PID:5560
- C:\Windows\System\ZJLUUWZ.exe
  C:\Windows\System\ZJLUUWZ.exe
  2⤵
  PID:5576
- C:\Windows\System\WiDIiIt.exe
  C:\Windows\System\WiDIiIt.exe
  2⤵
  PID:5592
- C:\Windows\System\SKbqaNj.exe
  C:\Windows\System\SKbqaNj.exe
  2⤵
  PID:5612
- C:\Windows\System\BBQObdB.exe
  C:\Windows\System\BBQObdB.exe
  2⤵
  PID:5648
- C:\Windows\System\AYIkFmw.exe
  C:\Windows\System\AYIkFmw.exe
  2⤵
  PID:5688
- C:\Windows\System\lXVdhnw.exe
  C:\Windows\System\lXVdhnw.exe
  2⤵
  PID:5712
- C:\Windows\System\rEUIaZe.exe
  C:\Windows\System\rEUIaZe.exe
  2⤵
  PID:5736
- C:\Windows\System\DPaPWPX.exe
  C:\Windows\System\DPaPWPX.exe
  2⤵
  PID:5756
- C:\Windows\System\DGoOheQ.exe
  C:\Windows\System\DGoOheQ.exe
  2⤵
  PID:5788
- C:\Windows\System\ytlxvfI.exe
  C:\Windows\System\ytlxvfI.exe
  2⤵
  PID:5808
- C:\Windows\System\pczYNad.exe
  C:\Windows\System\pczYNad.exe
  2⤵
  PID:5860
- C:\Windows\System\NtnYKfx.exe
  C:\Windows\System\NtnYKfx.exe
  2⤵
  PID:5884
- C:\Windows\System\RVgYblW.exe
  C:\Windows\System\RVgYblW.exe
  2⤵
  PID:5900
- C:\Windows\System\rqEkTnm.exe
  C:\Windows\System\rqEkTnm.exe
  2⤵
  PID:5928
- C:\Windows\System\dneMdqG.exe
  C:\Windows\System\dneMdqG.exe
  2⤵
  PID:5944
- C:\Windows\System\awNroRB.exe
  C:\Windows\System\awNroRB.exe
  2⤵
  PID:5972
- C:\Windows\System\CWNptsd.exe
  C:\Windows\System\CWNptsd.exe
  2⤵
  PID:5996
- C:\Windows\System\NsUTylN.exe
  C:\Windows\System\NsUTylN.exe
  2⤵
  PID:6024
- C:\Windows\System\AqfqGXd.exe
  C:\Windows\System\AqfqGXd.exe
  2⤵
  PID:6044
- C:\Windows\System\xVISdsU.exe
  C:\Windows\System\xVISdsU.exe
  2⤵
  PID:6068
- C:\Windows\System\mAgHEwk.exe
  C:\Windows\System\mAgHEwk.exe
  2⤵
  PID:6096
- C:\Windows\System\tcJnsHy.exe
  C:\Windows\System\tcJnsHy.exe
  2⤵
  PID:6112
- C:\Windows\System\DpzvvHr.exe
  C:\Windows\System\DpzvvHr.exe
  2⤵
  PID:6132
- C:\Windows\System\EuDrDNK.exe
  C:\Windows\System\EuDrDNK.exe
  2⤵
  PID:4384
- C:\Windows\System\LaIdexV.exe
  C:\Windows\System\LaIdexV.exe
  2⤵
  PID:1580
- C:\Windows\System\sdnRoRS.exe
  C:\Windows\System\sdnRoRS.exe
  2⤵
  PID:3456
- C:\Windows\System\FGgmtdJ.exe
  C:\Windows\System\FGgmtdJ.exe
  2⤵
  PID:3800
- C:\Windows\System\THGrTnD.exe
  C:\Windows\System\THGrTnD.exe
  2⤵
  PID:3868
- C:\Windows\System\vOdjPhW.exe
  C:\Windows\System\vOdjPhW.exe
  2⤵
  PID:4452
- C:\Windows\System\kGDufcb.exe
  C:\Windows\System\kGDufcb.exe
  2⤵
  PID:940
- C:\Windows\System\DXXgzti.exe
  C:\Windows\System\DXXgzti.exe
  2⤵
  PID:4376
- C:\Windows\System\DezgTRa.exe
  C:\Windows\System\DezgTRa.exe
  2⤵
  PID:464
- C:\Windows\System\VsmFYwb.exe
  C:\Windows\System\VsmFYwb.exe
  2⤵
  PID:3872
- C:\Windows\System\jkYnvkF.exe
  C:\Windows\System\jkYnvkF.exe
  2⤵
  PID:4944
- C:\Windows\System\UfbnCpS.exe
  C:\Windows\System\UfbnCpS.exe
  2⤵
  PID:5128
- C:\Windows\System\DoPERcH.exe
  C:\Windows\System\DoPERcH.exe
  2⤵
  PID:5164
- C:\Windows\System\ONpzPib.exe
  C:\Windows\System\ONpzPib.exe
  2⤵
  PID:5232
- C:\Windows\System\gCAuqgA.exe
  C:\Windows\System\gCAuqgA.exe
  2⤵
  PID:5720
- C:\Windows\System\AUfMULc.exe
  C:\Windows\System\AUfMULc.exe
  2⤵
  PID:5804
- C:\Windows\System\BfhtxbJ.exe
  C:\Windows\System\BfhtxbJ.exe
  2⤵
  PID:5292
- C:\Windows\System\PQvpbfa.exe
  C:\Windows\System\PQvpbfa.exe
  2⤵
  PID:5552
- C:\Windows\System\wJZJEqb.exe
  C:\Windows\System\wJZJEqb.exe
  2⤵
  PID:5360
- C:\Windows\System\YXZvnzk.exe
  C:\Windows\System\YXZvnzk.exe
  2⤵
  PID:5392
- C:\Windows\System\RAwVnGD.exe
  C:\Windows\System\RAwVnGD.exe
  2⤵
  PID:5420
- C:\Windows\System\oMwfFcW.exe
  C:\Windows\System\oMwfFcW.exe
  2⤵
  PID:5472
- C:\Windows\System\fNbayri.exe
  C:\Windows\System\fNbayri.exe
  2⤵
  PID:5880
- C:\Windows\System\NQeIMeg.exe
  C:\Windows\System\NQeIMeg.exe
  2⤵
  PID:5588
- C:\Windows\System\feVmKlQ.exe
  C:\Windows\System\feVmKlQ.exe
  2⤵
  PID:6012
- C:\Windows\System\mCubgvb.exe
  C:\Windows\System\mCubgvb.exe
  2⤵
  PID:6152
- C:\Windows\System\jAfdrGA.exe
  C:\Windows\System\jAfdrGA.exe
  2⤵
  PID:6172
- C:\Windows\System\wQpRcoI.exe
  C:\Windows\System\wQpRcoI.exe
  2⤵
  PID:6200
- C:\Windows\System\YhDMPbT.exe
  C:\Windows\System\YhDMPbT.exe
  2⤵
  PID:6224
- C:\Windows\System\RNTHPaj.exe
  C:\Windows\System\RNTHPaj.exe
  2⤵
  PID:6244
- C:\Windows\System\BanxEZz.exe
  C:\Windows\System\BanxEZz.exe
  2⤵
  PID:6280
- C:\Windows\System\CamyWTf.exe
  C:\Windows\System\CamyWTf.exe
  2⤵
  PID:6320
- C:\Windows\System\UbNHPUI.exe
  C:\Windows\System\UbNHPUI.exe
  2⤵
  PID:6336
- C:\Windows\System\bhrDnlg.exe
  C:\Windows\System\bhrDnlg.exe
  2⤵
  PID:6360
- C:\Windows\System\saWqmWF.exe
  C:\Windows\System\saWqmWF.exe
  2⤵
  PID:6388
- C:\Windows\System\aAZtQzX.exe
  C:\Windows\System\aAZtQzX.exe
  2⤵
  PID:6408
- C:\Windows\System\fNKhTjF.exe
  C:\Windows\System\fNKhTjF.exe
  2⤵
  PID:6432
- C:\Windows\System\yDWrMMo.exe
  C:\Windows\System\yDWrMMo.exe
  2⤵
  PID:6452
- C:\Windows\System\TxFmnZS.exe
  C:\Windows\System\TxFmnZS.exe
  2⤵
  PID:6472
- C:\Windows\System\zihVwjc.exe
  C:\Windows\System\zihVwjc.exe
  2⤵
  PID:6496
- C:\Windows\System\ERIxEwz.exe
  C:\Windows\System\ERIxEwz.exe
  2⤵
  PID:6520
- C:\Windows\System\pnCEmgi.exe
  C:\Windows\System\pnCEmgi.exe
  2⤵
  PID:6536
- C:\Windows\System\fHfFdOk.exe
  C:\Windows\System\fHfFdOk.exe
  2⤵
  PID:6560
- C:\Windows\System\VdIvctU.exe
  C:\Windows\System\VdIvctU.exe
  2⤵
  PID:6624
- C:\Windows\System\WkRpatq.exe
  C:\Windows\System\WkRpatq.exe
  2⤵
  PID:6640
- C:\Windows\System\gPHSAor.exe
  C:\Windows\System\gPHSAor.exe
  2⤵
  PID:6668
- C:\Windows\System\SHfeXUn.exe
  C:\Windows\System\SHfeXUn.exe
  2⤵
  PID:6692
- C:\Windows\System\UMVcnUx.exe
  C:\Windows\System\UMVcnUx.exe
  2⤵
  PID:6708
- C:\Windows\System\qAiuxeT.exe
  C:\Windows\System\qAiuxeT.exe
  2⤵
  PID:6732
- C:\Windows\System\wYGwwLR.exe
  C:\Windows\System\wYGwwLR.exe
  2⤵
  PID:6768
- C:\Windows\System\pnXxHfa.exe
  C:\Windows\System\pnXxHfa.exe
  2⤵
  PID:6792
- C:\Windows\System\mrNQZlZ.exe
  C:\Windows\System\mrNQZlZ.exe
  2⤵
  PID:6812
- C:\Windows\System\UfmYqiC.exe
  C:\Windows\System\UfmYqiC.exe
  2⤵
  PID:6836
- C:\Windows\System\zysTHXA.exe
  C:\Windows\System\zysTHXA.exe
  2⤵
  PID:6860
- C:\Windows\System\KEwtNvh.exe
  C:\Windows\System\KEwtNvh.exe
  2⤵
  PID:6884
- C:\Windows\System\udtOOhQ.exe
  C:\Windows\System\udtOOhQ.exe
  2⤵
  PID:6904
- C:\Windows\System\adhgkeO.exe
  C:\Windows\System\adhgkeO.exe
  2⤵
  PID:6924
- C:\Windows\System\PJgxbsA.exe
  C:\Windows\System\PJgxbsA.exe
  2⤵
  PID:6952
- C:\Windows\System\qjqnCpo.exe
  C:\Windows\System\qjqnCpo.exe
  2⤵
  PID:6980
- C:\Windows\System\xushxlU.exe
  C:\Windows\System\xushxlU.exe
  2⤵
  PID:7000
- C:\Windows\System\CUDbPFF.exe
  C:\Windows\System\CUDbPFF.exe
  2⤵
  PID:7024
- C:\Windows\System\eWOFaJA.exe
  C:\Windows\System\eWOFaJA.exe
  2⤵
  PID:7044
- C:\Windows\System\NAcwmYt.exe
  C:\Windows\System\NAcwmYt.exe
  2⤵
  PID:7060
- C:\Windows\System\pzjuzcL.exe
  C:\Windows\System\pzjuzcL.exe
  2⤵
  PID:7132
- C:\Windows\System\xkvsDtx.exe
  C:\Windows\System\xkvsDtx.exe
  2⤵
  PID:7148
- C:\Windows\System\enyjlhx.exe
  C:\Windows\System\enyjlhx.exe
  2⤵
  PID:2968
- C:\Windows\System\kuotXdV.exe
  C:\Windows\System\kuotXdV.exe
  2⤵
  PID:5768
- C:\Windows\System\LdNUZMC.exe
  C:\Windows\System\LdNUZMC.exe
  2⤵
  PID:2668
- C:\Windows\System\oaGjQeT.exe
  C:\Windows\System\oaGjQeT.exe
  2⤵
  PID:5800
- C:\Windows\System\yMkPKwp.exe
  C:\Windows\System\yMkPKwp.exe
  2⤵
  PID:4332
- C:\Windows\System\OQdqbNn.exe
  C:\Windows\System\OQdqbNn.exe
  2⤵
  PID:5064
- C:\Windows\System\RKYcGuJ.exe
  C:\Windows\System\RKYcGuJ.exe
  2⤵
  PID:5908
- C:\Windows\System\RXbzjGt.exe
  C:\Windows\System\RXbzjGt.exe
  2⤵
  PID:5960
- C:\Windows\System\ZPRNnti.exe
  C:\Windows\System\ZPRNnti.exe
  2⤵
  PID:6036
- C:\Windows\System\pfiYzdG.exe
  C:\Windows\System\pfiYzdG.exe
  2⤵
  PID:5100
- C:\Windows\System\tWiycHO.exe
  C:\Windows\System\tWiycHO.exe
  2⤵
  PID:6212
- C:\Windows\System\WJGQXcD.exe
  C:\Windows\System\WJGQXcD.exe
  2⤵
  PID:1564
- C:\Windows\System\cYvkaZb.exe
  C:\Windows\System\cYvkaZb.exe
  2⤵
  PID:6356
- C:\Windows\System\KgiWwnd.exe
  C:\Windows\System\KgiWwnd.exe
  2⤵
  PID:6416
- C:\Windows\System\hFYoCtc.exe
  C:\Windows\System\hFYoCtc.exe
  2⤵
  PID:6488
- C:\Windows\System\CwMKQTx.exe
  C:\Windows\System\CwMKQTx.exe
  2⤵
  PID:4420
- C:\Windows\System\CKPZMVe.exe
  C:\Windows\System\CKPZMVe.exe
  2⤵
  PID:5504
- C:\Windows\System\yzukAUl.exe
  C:\Windows\System\yzukAUl.exe
  2⤵
  PID:5160
- C:\Windows\System\KVpkkNF.exe
  C:\Windows\System\KVpkkNF.exe
  2⤵
  PID:5544
- C:\Windows\System\GYLkDbd.exe
  C:\Windows\System\GYLkDbd.exe
  2⤵
  PID:6788
- C:\Windows\System\WsBXnSK.exe
  C:\Windows\System\WsBXnSK.exe
  2⤵
  PID:6352
- C:\Windows\System\EihuKUE.exe
  C:\Windows\System\EihuKUE.exe
  2⤵
  PID:6420
- C:\Windows\System\cdHoYuV.exe
  C:\Windows\System\cdHoYuV.exe
  2⤵
  PID:6972
- C:\Windows\System\klKkkpv.exe
  C:\Windows\System\klKkkpv.exe
  2⤵
  PID:7016
- C:\Windows\System\mDFKuVE.exe
  C:\Windows\System\mDFKuVE.exe
  2⤵
  PID:6576
- C:\Windows\System\BVWFNhW.exe
  C:\Windows\System\BVWFNhW.exe
  2⤵
  PID:5332
- C:\Windows\System\zoCfaqj.exe
  C:\Windows\System\zoCfaqj.exe
  2⤵
  PID:5432
- C:\Windows\System\qnAaLko.exe
  C:\Windows\System\qnAaLko.exe
  2⤵
  PID:5572
- C:\Windows\System\QowxMNH.exe
  C:\Windows\System\QowxMNH.exe
  2⤵
  PID:4824
- C:\Windows\System\BcCaLsk.exe
  C:\Windows\System\BcCaLsk.exe
  2⤵
  PID:6208
- C:\Windows\System\fBGAfbw.exe
  C:\Windows\System\fBGAfbw.exe
  2⤵
  PID:7276
- C:\Windows\System\wWIzvKb.exe
  C:\Windows\System\wWIzvKb.exe
  2⤵
  PID:7292
- C:\Windows\System\cFSHpeL.exe
  C:\Windows\System\cFSHpeL.exe
  2⤵
  PID:7308
- C:\Windows\System\WPVJQMf.exe
  C:\Windows\System\WPVJQMf.exe
  2⤵
  PID:7324
- C:\Windows\System\gOEPheL.exe
  C:\Windows\System\gOEPheL.exe
  2⤵
  PID:7340
- C:\Windows\System\stGGREb.exe
  C:\Windows\System\stGGREb.exe
  2⤵
  PID:7356
- C:\Windows\System\VzbgJCx.exe
  C:\Windows\System\VzbgJCx.exe
  2⤵
  PID:7372
- C:\Windows\System\PutgiDN.exe
  C:\Windows\System\PutgiDN.exe
  2⤵
  PID:7388
- C:\Windows\System\lYogSEh.exe
  C:\Windows\System\lYogSEh.exe
  2⤵
  PID:7404
- C:\Windows\System\ulxBRwA.exe
  C:\Windows\System\ulxBRwA.exe
  2⤵
  PID:7420
- C:\Windows\System\xTaUqvP.exe
  C:\Windows\System\xTaUqvP.exe
  2⤵
  PID:7436
- C:\Windows\System\KdRjaSv.exe
  C:\Windows\System\KdRjaSv.exe
  2⤵
  PID:7452
- C:\Windows\System\VEfVajZ.exe
  C:\Windows\System\VEfVajZ.exe
  2⤵
  PID:7472
- C:\Windows\System\KMerixR.exe
  C:\Windows\System\KMerixR.exe
  2⤵
  PID:7504
- C:\Windows\System\kjIZuMi.exe
  C:\Windows\System\kjIZuMi.exe
  2⤵
  PID:7656
- C:\Windows\System\jXtmxCd.exe
  C:\Windows\System\jXtmxCd.exe
  2⤵
  PID:7672
- C:\Windows\System\wWKApMy.exe
  C:\Windows\System\wWKApMy.exe
  2⤵
  PID:7688
- C:\Windows\System\CCDOcrm.exe
  C:\Windows\System\CCDOcrm.exe
  2⤵
  PID:7704
- C:\Windows\System\RNvBopV.exe
  C:\Windows\System\RNvBopV.exe
  2⤵
  PID:7740
- C:\Windows\System\yOPWXrc.exe
  C:\Windows\System\yOPWXrc.exe
  2⤵
  PID:7764
- C:\Windows\System\EEJOMSA.exe
  C:\Windows\System\EEJOMSA.exe
  2⤵
  PID:7784
- C:\Windows\System\pteHSVN.exe
  C:\Windows\System\pteHSVN.exe
  2⤵
  PID:7812
- C:\Windows\System\pUSDWAN.exe
  C:\Windows\System\pUSDWAN.exe
  2⤵
  PID:7840
- C:\Windows\System\UzUfggS.exe
  C:\Windows\System\UzUfggS.exe
  2⤵
  PID:7860
- C:\Windows\System\rSYgsRI.exe
  C:\Windows\System\rSYgsRI.exe
  2⤵
  PID:7892
- C:\Windows\System\HHrDImX.exe
  C:\Windows\System\HHrDImX.exe
  2⤵
  PID:7916
- C:\Windows\System\PXmcKNm.exe
  C:\Windows\System\PXmcKNm.exe
  2⤵
  PID:7936
- C:\Windows\System\YfyMKcI.exe
  C:\Windows\System\YfyMKcI.exe
  2⤵
  PID:7960
- C:\Windows\System\jebuTNI.exe
  C:\Windows\System\jebuTNI.exe
  2⤵
  PID:7984
- C:\Windows\System\SJCvBaB.exe
  C:\Windows\System\SJCvBaB.exe
  2⤵
  PID:8008
- C:\Windows\System\LhhRypA.exe
  C:\Windows\System\LhhRypA.exe
  2⤵
  PID:8032
- C:\Windows\System\cnTqGmL.exe
  C:\Windows\System\cnTqGmL.exe
  2⤵
  PID:8052
- C:\Windows\System\mPXAkKB.exe
  C:\Windows\System\mPXAkKB.exe
  2⤵
  PID:8080
- C:\Windows\System\DrtHvgn.exe
  C:\Windows\System\DrtHvgn.exe
  2⤵
  PID:8100
- C:\Windows\System\wnsQmGX.exe
  C:\Windows\System\wnsQmGX.exe
  2⤵
  PID:8128
- C:\Windows\System\eEaPFgY.exe
  C:\Windows\System\eEaPFgY.exe
  2⤵
  PID:8156
- C:\Windows\System\SuFrnPE.exe
  C:\Windows\System\SuFrnPE.exe
  2⤵
  PID:8180
- C:\Windows\System\AjaYCtd.exe
  C:\Windows\System\AjaYCtd.exe
  2⤵
  PID:3568
- C:\Windows\System\ijGFBex.exe
  C:\Windows\System\ijGFBex.exe
  2⤵
  PID:6504
- C:\Windows\System\oBjhcfN.exe
  C:\Windows\System\oBjhcfN.exe
  2⤵
  PID:6616
- C:\Windows\System\JTxYjnF.exe
  C:\Windows\System\JTxYjnF.exe
  2⤵
  PID:6656
- C:\Windows\System\TdhbmmQ.exe
  C:\Windows\System\TdhbmmQ.exe
  2⤵
  PID:6704
- C:\Windows\System\YowpMaH.exe
  C:\Windows\System\YowpMaH.exe
  2⤵
  PID:7124
- C:\Windows\System\pnGTeUD.exe
  C:\Windows\System\pnGTeUD.exe
  2⤵
  PID:6820
- C:\Windows\System\kNADRDP.exe
  C:\Windows\System\kNADRDP.exe
  2⤵
  PID:6896
- C:\Windows\System\vdBVSMJ.exe
  C:\Windows\System\vdBVSMJ.exe
  2⤵
  PID:2944
- C:\Windows\System\QYravbG.exe
  C:\Windows\System\QYravbG.exe
  2⤵
  PID:7112
- C:\Windows\System\CUIujvI.exe
  C:\Windows\System\CUIujvI.exe
  2⤵
  PID:6040
- C:\Windows\System\oZhDIzK.exe
  C:\Windows\System\oZhDIzK.exe
  2⤵
  PID:6996
- C:\Windows\System\ILRtCKE.exe
  C:\Windows\System\ILRtCKE.exe
  2⤵
  PID:7176
- C:\Windows\System\oqfIPnt.exe
  C:\Windows\System\oqfIPnt.exe
  2⤵
  PID:7164
- C:\Windows\System\qWBILcb.exe
  C:\Windows\System\qWBILcb.exe
  2⤵
  PID:3304
- C:\Windows\System\hvWupmz.exe
  C:\Windows\System\hvWupmz.exe
  2⤵
  PID:5896
- C:\Windows\System\fCikMMd.exe
  C:\Windows\System\fCikMMd.exe
  2⤵
  PID:6004
- C:\Windows\System\BMQoEet.exe
  C:\Windows\System\BMQoEet.exe
  2⤵
  PID:6236
- C:\Windows\System\ntDZXhw.exe
  C:\Windows\System\ntDZXhw.exe
  2⤵
  PID:2412
- C:\Windows\System\fxkIkTg.exe
  C:\Windows\System\fxkIkTg.exe
  2⤵
  PID:6568
- C:\Windows\System\RNRAhkD.exe
  C:\Windows\System\RNRAhkD.exe
  2⤵
  PID:4444
- C:\Windows\System\ayrlKRW.exe
  C:\Windows\System\ayrlKRW.exe
  2⤵
  PID:6344
- C:\Windows\System\bLAkSvr.exe
  C:\Windows\System\bLAkSvr.exe
  2⤵
  PID:6460
- C:\Windows\System\sxAuYMH.exe
  C:\Windows\System\sxAuYMH.exe
  2⤵
  PID:5868
- C:\Windows\System\McVQZVe.exe
  C:\Windows\System\McVQZVe.exe
  2⤵
  PID:5988
- C:\Windows\System\DbqXFuv.exe
  C:\Windows\System\DbqXFuv.exe
  2⤵
  PID:8196
- C:\Windows\System\kQxfwhy.exe
  C:\Windows\System\kQxfwhy.exe
  2⤵
  PID:8212
- C:\Windows\System\cymedTb.exe
  C:\Windows\System\cymedTb.exe
  2⤵
  PID:8232
- C:\Windows\System\IJFsOeR.exe
  C:\Windows\System\IJFsOeR.exe
  2⤵
  PID:8252
- C:\Windows\System\UkuewLQ.exe
  C:\Windows\System\UkuewLQ.exe
  2⤵
  PID:8272
- C:\Windows\System\KVDmqYK.exe
  C:\Windows\System\KVDmqYK.exe
  2⤵
  PID:8292
- C:\Windows\System\IgpTBPm.exe
  C:\Windows\System\IgpTBPm.exe
  2⤵
  PID:8308
- C:\Windows\System\nzzqvJu.exe
  C:\Windows\System\nzzqvJu.exe
  2⤵
  PID:8328
- C:\Windows\System\SDujKfj.exe
  C:\Windows\System\SDujKfj.exe
  2⤵
  PID:8348
- C:\Windows\System\KadFelq.exe
  C:\Windows\System\KadFelq.exe
  2⤵
  PID:8368
- C:\Windows\System\Xtrxdis.exe
  C:\Windows\System\Xtrxdis.exe
  2⤵
  PID:8384
- C:\Windows\System\RJniqQW.exe
  C:\Windows\System\RJniqQW.exe
  2⤵
  PID:8472
- C:\Windows\System\PKVMjaZ.exe
  C:\Windows\System\PKVMjaZ.exe
  2⤵
  PID:8560
- C:\Windows\System\aPeubtm.exe
  C:\Windows\System\aPeubtm.exe
  2⤵
  PID:8580
- C:\Windows\System\eIjhiVq.exe
  C:\Windows\System\eIjhiVq.exe
  2⤵
  PID:8596
- C:\Windows\System\ZsvZcBb.exe
  C:\Windows\System\ZsvZcBb.exe
  2⤵
  PID:8612
- C:\Windows\System\OMPPPnB.exe
  C:\Windows\System\OMPPPnB.exe
  2⤵
  PID:8632
- C:\Windows\System\rFXaZgN.exe
  C:\Windows\System\rFXaZgN.exe
  2⤵
  PID:8648
- C:\Windows\System\PXrPYtB.exe
  C:\Windows\System\PXrPYtB.exe
  2⤵
  PID:8684
- C:\Windows\System\HpnYSva.exe
  C:\Windows\System\HpnYSva.exe
  2⤵
  PID:8724
- C:\Windows\System\ppdOmLq.exe
  C:\Windows\System\ppdOmLq.exe
  2⤵
  PID:8748
- C:\Windows\System\dVdJhMm.exe
  C:\Windows\System\dVdJhMm.exe
  2⤵
  PID:8776
- C:\Windows\System\zcHdGLk.exe
  C:\Windows\System\zcHdGLk.exe
  2⤵
  PID:8816
- C:\Windows\System\iZpWIoG.exe
  C:\Windows\System\iZpWIoG.exe
  2⤵
  PID:8840
- C:\Windows\System\JnSNgkX.exe
  C:\Windows\System\JnSNgkX.exe
  2⤵
  PID:8872
- C:\Windows\System\lKsEQlq.exe
  C:\Windows\System\lKsEQlq.exe
  2⤵
  PID:8888
- C:\Windows\System\zhjqgSq.exe
  C:\Windows\System\zhjqgSq.exe
  2⤵
  PID:8908
- C:\Windows\System\CBMTagR.exe
  C:\Windows\System\CBMTagR.exe
  2⤵
  PID:8932
- C:\Windows\System\CUhzOrB.exe
  C:\Windows\System\CUhzOrB.exe
  2⤵
  PID:8952
- C:\Windows\System\zTMTxin.exe
  C:\Windows\System\zTMTxin.exe
  2⤵
  PID:8972
- C:\Windows\System\GrwMpUM.exe
  C:\Windows\System\GrwMpUM.exe
  2⤵
  PID:8996
- C:\Windows\System\NGdbpIL.exe
  C:\Windows\System\NGdbpIL.exe
  2⤵
  PID:9016
- C:\Windows\System\dFvXiYF.exe
  C:\Windows\System\dFvXiYF.exe
  2⤵
  PID:9040
- C:\Windows\System\zJtjLlW.exe
  C:\Windows\System\zJtjLlW.exe
  2⤵
  PID:9056
- C:\Windows\System\BivSvBO.exe
  C:\Windows\System\BivSvBO.exe
  2⤵
  PID:9076
- C:\Windows\System\HfNDlJW.exe
  C:\Windows\System\HfNDlJW.exe
  2⤵
  PID:9092
- C:\Windows\System\qtaJzkw.exe
  C:\Windows\System\qtaJzkw.exe
  2⤵
  PID:9108
- C:\Windows\System\sqbavlv.exe
  C:\Windows\System\sqbavlv.exe
  2⤵
  PID:9128
- C:\Windows\System\XyjYREe.exe
  C:\Windows\System\XyjYREe.exe
  2⤵
  PID:9148
- C:\Windows\System\oWTENlp.exe
  C:\Windows\System\oWTENlp.exe
  2⤵
  PID:9164
- C:\Windows\System\IVqgfaM.exe
  C:\Windows\System\IVqgfaM.exe
  2⤵
  PID:9184
- C:\Windows\System\ZYVETFF.exe
  C:\Windows\System\ZYVETFF.exe
  2⤵
  PID:9200
- C:\Windows\System\FXGEYpD.exe
  C:\Windows\System\FXGEYpD.exe
  2⤵
  PID:7684
- C:\Windows\System\XsppVRE.exe
  C:\Windows\System\XsppVRE.exe
  2⤵
  PID:8016
- C:\Windows\System\uFMFlwm.exe
  C:\Windows\System\uFMFlwm.exe
  2⤵
  PID:6872
- C:\Windows\System\BULHlus.exe
  C:\Windows\System\BULHlus.exe
  2⤵
  PID:6988
- C:\Windows\System\rtEWhNs.exe
  C:\Windows\System\rtEWhNs.exe
  2⤵
  PID:6544
- C:\Windows\System\woYIKRO.exe
  C:\Windows\System\woYIKRO.exe
  2⤵
  PID:3988
- C:\Windows\System\MRJeMHF.exe
  C:\Windows\System\MRJeMHF.exe
  2⤵
  PID:6848
- C:\Windows\System\JTyKHAd.exe
  C:\Windows\System\JTyKHAd.exe
  2⤵
  PID:8288
- C:\Windows\System\zomSUmK.exe
  C:\Windows\System\zomSUmK.exe
  2⤵
  PID:7792
- C:\Windows\System\oxzmMLk.exe
  C:\Windows\System\oxzmMLk.exe
  2⤵
  PID:7824
- C:\Windows\System\GlHfbZy.exe
  C:\Windows\System\GlHfbZy.exe
  2⤵
  PID:7868
- C:\Windows\System\bKDepfR.exe
  C:\Windows\System\bKDepfR.exe
  2⤵
  PID:8800
- C:\Windows\System\sOVPwJF.exe
  C:\Windows\System\sOVPwJF.exe
  2⤵
  PID:8188
- C:\Windows\System\LAifrej.exe
  C:\Windows\System\LAifrej.exe
  2⤵
  PID:6764
- C:\Windows\System\CxqngdV.exe
  C:\Windows\System\CxqngdV.exe
  2⤵
  PID:5752
- C:\Windows\System\uzZEWCj.exe
  C:\Windows\System\uzZEWCj.exe
  2⤵
  PID:4004
- C:\Windows\System\gXlvOEh.exe
  C:\Windows\System\gXlvOEh.exe
  2⤵
  PID:6532
- C:\Windows\System\EyrNxNK.exe
  C:\Windows\System\EyrNxNK.exe
  2⤵
  PID:9116
- C:\Windows\System\RceMrwT.exe
  C:\Windows\System\RceMrwT.exe
  2⤵
  PID:2392
- C:\Windows\System\vifbqsg.exe
  C:\Windows\System\vifbqsg.exe
  2⤵
  PID:8224
- C:\Windows\System\eiUrJgr.exe
  C:\Windows\System\eiUrJgr.exe
  2⤵
  PID:8264
- C:\Windows\System\ZzyezLf.exe
  C:\Windows\System\ZzyezLf.exe
  2⤵
  PID:9208
- C:\Windows\System\kXDAoSU.exe
  C:\Windows\System\kXDAoSU.exe
  2⤵
  PID:9236
- C:\Windows\System\OjEItyf.exe
  C:\Windows\System\OjEItyf.exe
  2⤵
  PID:9252
- C:\Windows\System\zSzUEUl.exe
  C:\Windows\System\zSzUEUl.exe
  2⤵
  PID:9272
- C:\Windows\System\yxZrQZU.exe
  C:\Windows\System\yxZrQZU.exe
  2⤵
  PID:9292
- C:\Windows\System\HaCZsFv.exe
  C:\Windows\System\HaCZsFv.exe
  2⤵
  PID:9324
- C:\Windows\System\jUfAPHC.exe
  C:\Windows\System\jUfAPHC.exe
  2⤵
  PID:9340
- C:\Windows\System\GgERcga.exe
  C:\Windows\System\GgERcga.exe
  2⤵
  PID:9368
- C:\Windows\System\KIzybnf.exe
  C:\Windows\System\KIzybnf.exe
  2⤵
  PID:9384
- C:\Windows\System\cNyHirB.exe
  C:\Windows\System\cNyHirB.exe
  2⤵
  PID:9400
- C:\Windows\System\sspqnLR.exe
  C:\Windows\System\sspqnLR.exe
  2⤵
  PID:9420
- C:\Windows\System\dYCDNEW.exe
  C:\Windows\System\dYCDNEW.exe
  2⤵
  PID:9440
- C:\Windows\System\lGUISaz.exe
  C:\Windows\System\lGUISaz.exe
  2⤵
  PID:9460
- C:\Windows\System\BgRIJCx.exe
  C:\Windows\System\BgRIJCx.exe
  2⤵
  PID:9484
- C:\Windows\System\OSpnfKJ.exe
  C:\Windows\System\OSpnfKJ.exe
  2⤵
  PID:9504
- C:\Windows\System\oFSLSIX.exe
  C:\Windows\System\oFSLSIX.exe
  2⤵
  PID:9528
- C:\Windows\System\EmsjvPq.exe
  C:\Windows\System\EmsjvPq.exe
  2⤵
  PID:9548
- C:\Windows\System\eZsdHNB.exe
  C:\Windows\System\eZsdHNB.exe
  2⤵
  PID:9568
- C:\Windows\System\itlWmLE.exe
  C:\Windows\System\itlWmLE.exe
  2⤵
  PID:9588
- C:\Windows\System\lHtxJmi.exe
  C:\Windows\System\lHtxJmi.exe
  2⤵
  PID:9604
- C:\Windows\System\ZoZrLiS.exe
  C:\Windows\System\ZoZrLiS.exe
  2⤵
  PID:9620
- C:\Windows\System\PXXTUyS.exe
  C:\Windows\System\PXXTUyS.exe
  2⤵
  PID:9636
- C:\Windows\System\QpxiLZE.exe
  C:\Windows\System\QpxiLZE.exe
  2⤵
  PID:9660
- C:\Windows\System\oCMGvOs.exe
  C:\Windows\System\oCMGvOs.exe
  2⤵
  PID:9688
- C:\Windows\System\lPpBYEd.exe
  C:\Windows\System\lPpBYEd.exe
  2⤵
  PID:9716
- C:\Windows\System\myIlqyI.exe
  C:\Windows\System\myIlqyI.exe
  2⤵
  PID:9740
- C:\Windows\System\tXYZJfc.exe
  C:\Windows\System\tXYZJfc.exe
  2⤵
  PID:9764
- C:\Windows\System\afOkcYC.exe
  C:\Windows\System\afOkcYC.exe
  2⤵
  PID:9784
- C:\Windows\System\tUOZIEK.exe
  C:\Windows\System\tUOZIEK.exe
  2⤵
  PID:9808
- C:\Windows\System\hLPNglf.exe
  C:\Windows\System\hLPNglf.exe
  2⤵
  PID:9832
- C:\Windows\System\zkkczmK.exe
  C:\Windows\System\zkkczmK.exe
  2⤵
  PID:9860
- C:\Windows\System\ylYwBJk.exe
  C:\Windows\System\ylYwBJk.exe
  2⤵
  PID:9884
- C:\Windows\System\vIMaGLf.exe
  C:\Windows\System\vIMaGLf.exe
  2⤵
  PID:9900
- C:\Windows\System\tlXedJx.exe
  C:\Windows\System\tlXedJx.exe
  2⤵
  PID:9924
- C:\Windows\System\FtYfhUY.exe
  C:\Windows\System\FtYfhUY.exe
  2⤵
  PID:9944
- C:\Windows\System\cPUMjQM.exe
  C:\Windows\System\cPUMjQM.exe
  2⤵
  PID:9968
- C:\Windows\System\PzIdTmB.exe
  C:\Windows\System\PzIdTmB.exe
  2⤵
  PID:9988
- C:\Windows\System\iKIFyWa.exe
  C:\Windows\System\iKIFyWa.exe
  2⤵
  PID:10008
- C:\Windows\System\DRKrPha.exe
  C:\Windows\System\DRKrPha.exe
  2⤵
  PID:10028
- C:\Windows\System\JkfymPk.exe
  C:\Windows\System\JkfymPk.exe
  2⤵
  PID:10048
- C:\Windows\System\aFooWtE.exe
  C:\Windows\System\aFooWtE.exe
  2⤵
  PID:10072
- C:\Windows\System\OprhhhY.exe
  C:\Windows\System\OprhhhY.exe
  2⤵
  PID:10096
- C:\Windows\System\FmUXeQz.exe
  C:\Windows\System\FmUXeQz.exe
  2⤵
  PID:10116
- C:\Windows\System\nlDTXgk.exe
  C:\Windows\System\nlDTXgk.exe
  2⤵
  PID:10136
- C:\Windows\System\gDnMaaP.exe
  C:\Windows\System\gDnMaaP.exe
  2⤵
  PID:10160
- C:\Windows\System\jUokoWU.exe
  C:\Windows\System\jUokoWU.exe
  2⤵
  PID:10184
- C:\Windows\System\aFXFrjS.exe
  C:\Windows\System\aFXFrjS.exe
  2⤵
  PID:10208
- C:\Windows\System\IyqfQip.exe
  C:\Windows\System\IyqfQip.exe
  2⤵
  PID:10236
- C:\Windows\System\wtwwvLY.exe
  C:\Windows\System\wtwwvLY.exe
  2⤵
  PID:7288
- C:\Windows\System\mfZAwaZ.exe
  C:\Windows\System\mfZAwaZ.exe
  2⤵
  PID:7336
- C:\Windows\System\IFcChGZ.exe
  C:\Windows\System\IFcChGZ.exe
  2⤵
  PID:7460
- C:\Windows\System\JBThtpU.exe
  C:\Windows\System\JBThtpU.exe
  2⤵
  PID:7416
- C:\Windows\System\VJtkgTE.exe
  C:\Windows\System\VJtkgTE.exe
  2⤵
  PID:7380
- C:\Windows\System\mfTlABI.exe
  C:\Windows\System\mfTlABI.exe
  2⤵
  PID:8572
- C:\Windows\System\AyaBWhn.exe
  C:\Windows\System\AyaBWhn.exe
  2⤵
  PID:7640
- C:\Windows\System\VCXFnkC.exe
  C:\Windows\System\VCXFnkC.exe
  2⤵
  PID:7700
- C:\Windows\System\TIlFnAf.exe
  C:\Windows\System\TIlFnAf.exe
  2⤵
  PID:7752
- C:\Windows\System\rvNLPDh.exe
  C:\Windows\System\rvNLPDh.exe
  2⤵
  PID:7904
- C:\Windows\System\nXwLaUg.exe
  C:\Windows\System\nXwLaUg.exe
  2⤵
  PID:7968
- C:\Windows\System\kwqPdeg.exe
  C:\Windows\System\kwqPdeg.exe
  2⤵
  PID:7992
- C:\Windows\System\UfWjQhe.exe
  C:\Windows\System\UfWjQhe.exe
  2⤵
  PID:8044
- C:\Windows\System\nhBuRFi.exe
  C:\Windows\System\nhBuRFi.exe
  2⤵
  PID:8144
- C:\Windows\System\zugBiXq.exe
  C:\Windows\System\zugBiXq.exe
  2⤵
  PID:5700
- C:\Windows\System\IIXeFTY.exe
  C:\Windows\System\IIXeFTY.exe
  2⤵
  PID:6724
- C:\Windows\System\xhMrXKC.exe
  C:\Windows\System\xhMrXKC.exe
  2⤵
  PID:6844
- C:\Windows\System\GoWOblI.exe
  C:\Windows\System\GoWOblI.exe
  2⤵
  PID:8916
- C:\Windows\System\bYDkQXa.exe
  C:\Windows\System\bYDkQXa.exe
  2⤵
  PID:8948
- C:\Windows\System\CRLZkSw.exe
  C:\Windows\System\CRLZkSw.exe
  2⤵
  PID:7800
- C:\Windows\System\JSLcyXb.exe
  C:\Windows\System\JSLcyXb.exe
  2⤵
  PID:9036
- C:\Windows\System\hGGnJbA.exe
  C:\Windows\System\hGGnJbA.exe
  2⤵
  PID:5372
- C:\Windows\System\djMMnkR.exe
  C:\Windows\System\djMMnkR.exe
  2⤵
  PID:4872
- C:\Windows\System\MLJAfKC.exe
  C:\Windows\System\MLJAfKC.exe
  2⤵
  PID:5924
- C:\Windows\System\UogpsOn.exe
  C:\Windows\System\UogpsOn.exe
  2⤵
  PID:9196
- C:\Windows\System\LTRdMFz.exe
  C:\Windows\System\LTRdMFz.exe
  2⤵
  PID:6960
- C:\Windows\System\uBBnZvP.exe
  C:\Windows\System\uBBnZvP.exe
  2⤵
  PID:6188
- C:\Windows\System\ZOpgKXp.exe
  C:\Windows\System\ZOpgKXp.exe
  2⤵
  PID:10260
- C:\Windows\System\fHcwhOF.exe
  C:\Windows\System\fHcwhOF.exe
  2⤵
  PID:10276
- C:\Windows\System\Cshrhjj.exe
  C:\Windows\System\Cshrhjj.exe
  2⤵
  PID:10300
- C:\Windows\System\gauqiKV.exe
  C:\Windows\System\gauqiKV.exe
  2⤵
  PID:10320
- C:\Windows\System\fyLWoLk.exe
  C:\Windows\System\fyLWoLk.exe
  2⤵
  PID:10348
- C:\Windows\System\prqMrBU.exe
  C:\Windows\System\prqMrBU.exe
  2⤵
  PID:10364
- C:\Windows\System\WyoGKxx.exe
  C:\Windows\System\WyoGKxx.exe
  2⤵
  PID:10388
- C:\Windows\System\EsjhoXk.exe
  C:\Windows\System\EsjhoXk.exe
  2⤵
  PID:10412
- C:\Windows\System\yZyQacR.exe
  C:\Windows\System\yZyQacR.exe
  2⤵
  PID:10440
- C:\Windows\System\YQFJHzm.exe
  C:\Windows\System\YQFJHzm.exe
  2⤵
  PID:10464
- C:\Windows\System\pIpXsBI.exe
  C:\Windows\System\pIpXsBI.exe
  2⤵
  PID:10492
- C:\Windows\System\wNsQMEy.exe
  C:\Windows\System\wNsQMEy.exe
  2⤵
  PID:10512
- C:\Windows\System\BcuBUzg.exe
  C:\Windows\System\BcuBUzg.exe
  2⤵
  PID:10540
- C:\Windows\System\cFwvcBi.exe
  C:\Windows\System\cFwvcBi.exe
  2⤵
  PID:10556
- C:\Windows\System\cuQKKvS.exe
  C:\Windows\System\cuQKKvS.exe
  2⤵
  PID:10576
- C:\Windows\System\MbUlsiU.exe
  C:\Windows\System\MbUlsiU.exe
  2⤵
  PID:10592
- C:\Windows\System\ofJJtaE.exe
  C:\Windows\System\ofJJtaE.exe
  2⤵
  PID:10608
- C:\Windows\System\qELsJgc.exe
  C:\Windows\System\qELsJgc.exe
  2⤵
  PID:10624
- C:\Windows\System\mlezyQz.exe
  C:\Windows\System\mlezyQz.exe
  2⤵
  PID:10640
- C:\Windows\System\cSbqgkq.exe
  C:\Windows\System\cSbqgkq.exe
  2⤵
  PID:10656
- C:\Windows\System\wzBawRt.exe
  C:\Windows\System\wzBawRt.exe
  2⤵
  PID:10676
- C:\Windows\System\xWkhAaN.exe
  C:\Windows\System\xWkhAaN.exe
  2⤵
  PID:10704
- C:\Windows\System\BecHcNq.exe
  C:\Windows\System\BecHcNq.exe
  2⤵
  PID:10720
- C:\Windows\System\CQYfFUU.exe
  C:\Windows\System\CQYfFUU.exe
  2⤵
  PID:10744
- C:\Windows\System\DXwBocd.exe
  C:\Windows\System\DXwBocd.exe
  2⤵
  PID:10768
- C:\Windows\System\MglYslA.exe
  C:\Windows\System\MglYslA.exe
  2⤵
  PID:10796
- C:\Windows\System\mtuOWEm.exe
  C:\Windows\System\mtuOWEm.exe
  2⤵
  PID:10820
- C:\Windows\System\cZHmTQe.exe
  C:\Windows\System\cZHmTQe.exe
  2⤵
  PID:10836
- C:\Windows\System\DSRvaBi.exe
  C:\Windows\System\DSRvaBi.exe
  2⤵
  PID:10860
- C:\Windows\System\oiQDnSd.exe
  C:\Windows\System\oiQDnSd.exe
  2⤵
  PID:10880
- C:\Windows\System\llTYRrk.exe
  C:\Windows\System\llTYRrk.exe
  2⤵
  PID:10900
- C:\Windows\System\Uuapjoo.exe
  C:\Windows\System\Uuapjoo.exe
  2⤵
  PID:10924
- C:\Windows\System\lSQeaLT.exe
  C:\Windows\System\lSQeaLT.exe
  2⤵
  PID:10944
- C:\Windows\System\ifjBfKD.exe
  C:\Windows\System\ifjBfKD.exe
  2⤵
  PID:10968
- C:\Windows\System\MJwnUtj.exe
  C:\Windows\System\MJwnUtj.exe
  2⤵
  PID:10988
- C:\Windows\System\NPxhrOD.exe
  C:\Windows\System\NPxhrOD.exe
  2⤵
  PID:11012
- C:\Windows\System\NQShaiL.exe
  C:\Windows\System\NQShaiL.exe
  2⤵
  PID:11032
- C:\Windows\System\rRHnRJV.exe
  C:\Windows\System\rRHnRJV.exe
  2⤵
  PID:11056
- C:\Windows\System\JFEjbEk.exe
  C:\Windows\System\JFEjbEk.exe
  2⤵
  PID:11080
- C:\Windows\System\eWGRzkW.exe
  C:\Windows\System\eWGRzkW.exe
  2⤵
  PID:11100
- C:\Windows\System\iQZjAZM.exe
  C:\Windows\System\iQZjAZM.exe
  2⤵
  PID:11128
- C:\Windows\System\OtIEAZI.exe
  C:\Windows\System\OtIEAZI.exe
  2⤵
  PID:11152
- C:\Windows\System\xfPnfox.exe
  C:\Windows\System\xfPnfox.exe
  2⤵
  PID:11172
- C:\Windows\System\POHCPhp.exe
  C:\Windows\System\POHCPhp.exe
  2⤵
  PID:11192
- C:\Windows\System\PimEhMU.exe
  C:\Windows\System\PimEhMU.exe
  2⤵
  PID:11220
- C:\Windows\System\BSFkTXR.exe
  C:\Windows\System\BSFkTXR.exe
  2⤵
  PID:11244
- C:\Windows\System\WVSFtXJ.exe
  C:\Windows\System\WVSFtXJ.exe
  2⤵
  PID:9244
- C:\Windows\System\UmOZzrz.exe
  C:\Windows\System\UmOZzrz.exe
  2⤵
  PID:9280
- C:\Windows\System\cobtpMl.exe
  C:\Windows\System\cobtpMl.exe
  2⤵
  PID:9360
- C:\Windows\System\atkcaQh.exe
  C:\Windows\System\atkcaQh.exe
  2⤵
  PID:7648
- C:\Windows\System\woAAsuv.exe
  C:\Windows\System\woAAsuv.exe
  2⤵
  PID:9416
- C:\Windows\System\FyQMYRT.exe
  C:\Windows\System\FyQMYRT.exe
  2⤵
  PID:9516
- C:\Windows\System\QHvXooo.exe
  C:\Windows\System\QHvXooo.exe
  2⤵
  PID:9560
- C:\Windows\System\vWdoHiU.exe
  C:\Windows\System\vWdoHiU.exe
  2⤵
  PID:9632
- C:\Windows\System\NdXZwap.exe
  C:\Windows\System\NdXZwap.exe
  2⤵
  PID:9672
- C:\Windows\System\oMOksFL.exe
  C:\Windows\System\oMOksFL.exe
  2⤵
  PID:9704
- C:\Windows\System\fuDGpUy.exe
  C:\Windows\System\fuDGpUy.exe
  2⤵
  PID:9776
- C:\Windows\System\ZzSSqHS.exe
  C:\Windows\System\ZzSSqHS.exe
  2⤵
  PID:9820
- C:\Windows\System\aUOxYmQ.exe
  C:\Windows\System\aUOxYmQ.exe
  2⤵
  PID:9892
- C:\Windows\System\ITAxCQI.exe
  C:\Windows\System\ITAxCQI.exe
  2⤵
  PID:6468
- C:\Windows\System\XkshBUW.exe
  C:\Windows\System\XkshBUW.exe
  2⤵
  PID:7632
- C:\Windows\System\BqFJiNF.exe
  C:\Windows\System\BqFJiNF.exe
  2⤵
  PID:10024
- C:\Windows\System\jxWlKOY.exe
  C:\Windows\System\jxWlKOY.exe
  2⤵
  PID:10108
- C:\Windows\System\aFajwDC.exe
  C:\Windows\System\aFajwDC.exe
  2⤵
  PID:9024
- C:\Windows\System\MWoNcHr.exe
  C:\Windows\System\MWoNcHr.exe
  2⤵
  PID:10180
- C:\Windows\System\FVReTmL.exe
  C:\Windows\System\FVReTmL.exe
  2⤵
  PID:7284
- C:\Windows\System\JnVVtEE.exe
  C:\Windows\System\JnVVtEE.exe
  2⤵
  PID:7352
- C:\Windows\System\oWFuppJ.exe
  C:\Windows\System\oWFuppJ.exe
  2⤵
  PID:11276
- C:\Windows\System\ToXfKcV.exe
  C:\Windows\System\ToXfKcV.exe
  2⤵
  PID:11300
- C:\Windows\System\GOXlgzr.exe
  C:\Windows\System\GOXlgzr.exe
  2⤵
  PID:11328
- C:\Windows\System\nttkVUA.exe
  C:\Windows\System\nttkVUA.exe
  2⤵
  PID:11352
- C:\Windows\System\tKZcvLy.exe
  C:\Windows\System\tKZcvLy.exe
  2⤵
  PID:11372
- C:\Windows\System\DigmhOK.exe
  C:\Windows\System\DigmhOK.exe
  2⤵
  PID:11400
- C:\Windows\System\QkMXaTK.exe
  C:\Windows\System\QkMXaTK.exe
  2⤵
  PID:11420
- C:\Windows\System\WLrPlik.exe
  C:\Windows\System\WLrPlik.exe
  2⤵
  PID:11448
- C:\Windows\System\GysIgal.exe
  C:\Windows\System\GysIgal.exe
  2⤵
  PID:11468
- C:\Windows\System\sqjKTvc.exe
  C:\Windows\System\sqjKTvc.exe
  2⤵
  PID:11496
- C:\Windows\System\CBgeJbR.exe
  C:\Windows\System\CBgeJbR.exe
  2⤵
  PID:11520
- C:\Windows\System\MLjxmeI.exe
  C:\Windows\System\MLjxmeI.exe
  2⤵
  PID:11540
- C:\Windows\System\PdVxfNS.exe
  C:\Windows\System\PdVxfNS.exe
  2⤵
  PID:11560
- C:\Windows\System\daoxMFA.exe
  C:\Windows\System\daoxMFA.exe
  2⤵
  PID:11584
- C:\Windows\System\cABugFK.exe
  C:\Windows\System\cABugFK.exe
  2⤵
  PID:11608
- C:\Windows\System\zuZgSMB.exe
  C:\Windows\System\zuZgSMB.exe
  2⤵
  PID:11632
- C:\Windows\System\LcDmYCy.exe
  C:\Windows\System\LcDmYCy.exe
  2⤵
  PID:11660
- C:\Windows\System\OexBzoN.exe
  C:\Windows\System\OexBzoN.exe
  2⤵
  PID:11680
- C:\Windows\System\ZaEsUyq.exe
  C:\Windows\System\ZaEsUyq.exe
  2⤵
  PID:11704
- C:\Windows\System\jcQlNYK.exe
  C:\Windows\System\jcQlNYK.exe
  2⤵
  PID:11728
- C:\Windows\System\iVznpcu.exe
  C:\Windows\System\iVznpcu.exe
  2⤵
  PID:11748
- C:\Windows\System\ImpWuJg.exe
  C:\Windows\System\ImpWuJg.exe
  2⤵
  PID:11764
- C:\Windows\System\juTRcSX.exe
  C:\Windows\System\juTRcSX.exe
  2⤵
  PID:11780
- C:\Windows\System\BXElTsZ.exe
  C:\Windows\System\BXElTsZ.exe
  2⤵
  PID:11796
- C:\Windows\System\WlCKSJR.exe
  C:\Windows\System\WlCKSJR.exe
  2⤵
  PID:11816
- C:\Windows\System\fhFQyyM.exe
  C:\Windows\System\fhFQyyM.exe
  2⤵
  PID:11840
- C:\Windows\System\sJxqebv.exe
  C:\Windows\System\sJxqebv.exe
  2⤵
  PID:11860
- C:\Windows\System\KqBQUfc.exe
  C:\Windows\System\KqBQUfc.exe
  2⤵
  PID:11888
- C:\Windows\System\GtAfBce.exe
  C:\Windows\System\GtAfBce.exe
  2⤵
  PID:11908
- C:\Windows\System\WKtsTvP.exe
  C:\Windows\System\WKtsTvP.exe
  2⤵
  PID:11928
- C:\Windows\System\RHRsaxL.exe
  C:\Windows\System\RHRsaxL.exe
  2⤵
  PID:11948
- C:\Windows\System\jVgWZZF.exe
  C:\Windows\System\jVgWZZF.exe
  2⤵
  PID:11972
- C:\Windows\System\ByVWrQx.exe
  C:\Windows\System\ByVWrQx.exe
  2⤵
  PID:11992
- C:\Windows\System\oOMFksc.exe
  C:\Windows\System\oOMFksc.exe
  2⤵
  PID:12012
- C:\Windows\System\iIHWFME.exe
  C:\Windows\System\iIHWFME.exe
  2⤵
  PID:12032
- C:\Windows\System\xzgoloI.exe
  C:\Windows\System\xzgoloI.exe
  2⤵
  PID:12056
- C:\Windows\System\mtEfPSm.exe
  C:\Windows\System\mtEfPSm.exe
  2⤵
  PID:12080
- C:\Windows\System\WfWJLSS.exe
  C:\Windows\System\WfWJLSS.exe
  2⤵
  PID:12096
- C:\Windows\System\ZylmHng.exe
  C:\Windows\System\ZylmHng.exe
  2⤵
  PID:12120
- C:\Windows\System\QBTlmhQ.exe
  C:\Windows\System\QBTlmhQ.exe
  2⤵
  PID:12148
- C:\Windows\System\LcflSkk.exe
  C:\Windows\System\LcflSkk.exe
  2⤵
  PID:12168
- C:\Windows\System\rLYJWwL.exe
  C:\Windows\System\rLYJWwL.exe
  2⤵
  PID:12184
- C:\Windows\System\OLBhJrt.exe
  C:\Windows\System\OLBhJrt.exe
  2⤵
  PID:12204
- C:\Windows\System\aAWtWqV.exe
  C:\Windows\System\aAWtWqV.exe
  2⤵
  PID:12244
- C:\Windows\System\sYBHJjA.exe
  C:\Windows\System\sYBHJjA.exe
  2⤵
  PID:12264
- C:\Windows\System\zaMwyzV.exe
  C:\Windows\System\zaMwyzV.exe
  2⤵
  PID:12284
- C:\Windows\System\AYcywZJ.exe
  C:\Windows\System\AYcywZJ.exe
  2⤵
  PID:7900
- C:\Windows\System\weThoom.exe
  C:\Windows\System\weThoom.exe
  2⤵
  PID:7976
- C:\Windows\System\AmZcuCV.exe
  C:\Windows\System\AmZcuCV.exe
  2⤵
  PID:8064
- C:\Windows\System\ySaleMU.exe
  C:\Windows\System\ySaleMU.exe
  2⤵
  PID:5676
- C:\Windows\System\qZTlpeb.exe
  C:\Windows\System\qZTlpeb.exe
  2⤵
  PID:6080
- C:\Windows\System\uqeqpeG.exe
  C:\Windows\System\uqeqpeG.exe
  2⤵
  PID:8900
- C:\Windows\System\cTFcREG.exe
  C:\Windows\System\cTFcREG.exe
  2⤵
  PID:7820
- C:\Windows\System\UukvAra.exe
  C:\Windows\System\UukvAra.exe
  2⤵
  PID:9068
- C:\Windows\System\eVUaimd.exe
  C:\Windows\System\eVUaimd.exe
  2⤵
  PID:8316
- C:\Windows\System\OubvIaR.exe
  C:\Windows\System\OubvIaR.exe
  2⤵
  PID:9180
- C:\Windows\System\NnfFhXc.exe
  C:\Windows\System\NnfFhXc.exe
  2⤵
  PID:10312
- C:\Windows\System\AllYNEy.exe
  C:\Windows\System\AllYNEy.exe
  2⤵
  PID:10340
- C:\Windows\System\tXeLZxd.exe
  C:\Windows\System\tXeLZxd.exe
  2⤵
  PID:10432
- C:\Windows\System\sQRuLJL.exe
  C:\Windows\System\sQRuLJL.exe
  2⤵
  PID:10528
- C:\Windows\System\OrmqIAA.exe
  C:\Windows\System\OrmqIAA.exe
  2⤵
  PID:10688
- C:\Windows\System\TpYZILX.exe
  C:\Windows\System\TpYZILX.exe
  2⤵
  PID:10728
- C:\Windows\System\xIIWoTk.exe
  C:\Windows\System\xIIWoTk.exe
  2⤵
  PID:10816
- C:\Windows\System\cAJcDmi.exe
  C:\Windows\System\cAJcDmi.exe
  2⤵
  PID:10876
- C:\Windows\System\knOcCGE.exe
  C:\Windows\System\knOcCGE.exe
  2⤵
  PID:9668
- C:\Windows\System\QeElHLz.exe
  C:\Windows\System\QeElHLz.exe
  2⤵
  PID:10984
- C:\Windows\System\ewllaPB.exe
  C:\Windows\System\ewllaPB.exe
  2⤵
  PID:9736
- C:\Windows\System\yYxrTuw.exe
  C:\Windows\System\yYxrTuw.exe
  2⤵
  PID:11148
- C:\Windows\System\eivGHsL.exe
  C:\Windows\System\eivGHsL.exe
  2⤵
  PID:12292
- C:\Windows\System\TSFTpZZ.exe
  C:\Windows\System\TSFTpZZ.exe
  2⤵
  PID:12312
- C:\Windows\System\ytMERJm.exe
  C:\Windows\System\ytMERJm.exe
  2⤵
  PID:12332
- C:\Windows\System\qZaivWq.exe
  C:\Windows\System\qZaivWq.exe
  2⤵
  PID:12360
- C:\Windows\System\IXjpvGn.exe
  C:\Windows\System\IXjpvGn.exe
  2⤵
  PID:12380
- C:\Windows\System\oViLeaE.exe
  C:\Windows\System\oViLeaE.exe
  2⤵
  PID:12412
- C:\Windows\System\PvoPMBK.exe
  C:\Windows\System\PvoPMBK.exe
  2⤵
  PID:12432
- C:\Windows\System\McIKtsi.exe
  C:\Windows\System\McIKtsi.exe
  2⤵
  PID:12456
- C:\Windows\System\kuepAZC.exe
  C:\Windows\System\kuepAZC.exe
  2⤵
  PID:12476
- C:\Windows\System\BMnyYEz.exe
  C:\Windows\System\BMnyYEz.exe
  2⤵
  PID:12496
- C:\Windows\System\fFqofag.exe
  C:\Windows\System\fFqofag.exe
  2⤵
  PID:12520
- C:\Windows\System\vNUeDwF.exe
  C:\Windows\System\vNUeDwF.exe
  2⤵
  PID:12544
- C:\Windows\System\qvmnfhN.exe
  C:\Windows\System\qvmnfhN.exe
  2⤵
  PID:12572
- C:\Windows\System\qqnmxBG.exe
  C:\Windows\System\qqnmxBG.exe
  2⤵
  PID:12588
- C:\Windows\System\BMraEKs.exe
  C:\Windows\System\BMraEKs.exe
  2⤵
  PID:12608
- C:\Windows\System\eWnZdtL.exe
  C:\Windows\System\eWnZdtL.exe
  2⤵
  PID:12632
- C:\Windows\System\RRqeqBq.exe
  C:\Windows\System\RRqeqBq.exe
  2⤵
  PID:12652
- C:\Windows\System\UDhiVSZ.exe
  C:\Windows\System\UDhiVSZ.exe
  2⤵
  PID:12676
- C:\Windows\System\zAQoPma.exe
  C:\Windows\System\zAQoPma.exe
  2⤵
  PID:12700
- C:\Windows\System\nIiFtEW.exe
  C:\Windows\System\nIiFtEW.exe
  2⤵
  PID:12724
- C:\Windows\System\hlPkfBt.exe
  C:\Windows\System\hlPkfBt.exe
  2⤵
  PID:12740
- C:\Windows\System\EsAgUme.exe
  C:\Windows\System\EsAgUme.exe
  2⤵
  PID:12756
- C:\Windows\System\kzyZxCs.exe
  C:\Windows\System\kzyZxCs.exe
  2⤵
  PID:12772
- C:\Windows\System\MvaWveE.exe
  C:\Windows\System\MvaWveE.exe
  2⤵
  PID:12788
- C:\Windows\System\jXfpblL.exe
  C:\Windows\System\jXfpblL.exe
  2⤵
  PID:12804
- C:\Windows\System\KUTrdri.exe
  C:\Windows\System\KUTrdri.exe
  2⤵
  PID:12828
- C:\Windows\System\VAeQReT.exe
  C:\Windows\System\VAeQReT.exe
  2⤵
  PID:12848
- C:\Windows\System\eUMYvdU.exe
  C:\Windows\System\eUMYvdU.exe
  2⤵
  PID:12868
- C:\Windows\System\lJXtalr.exe
  C:\Windows\System\lJXtalr.exe
  2⤵
  PID:12888
- C:\Windows\System\MAVmohi.exe
  C:\Windows\System\MAVmohi.exe
  2⤵
  PID:12916
- C:\Windows\System\fVLgung.exe
  C:\Windows\System\fVLgung.exe
  2⤵
  PID:12948
- C:\Windows\System\GCraKjg.exe
  C:\Windows\System\GCraKjg.exe
  2⤵
  PID:12972
- C:\Windows\System\KiPZzuz.exe
  C:\Windows\System\KiPZzuz.exe
  2⤵
  PID:12992
- C:\Windows\System\NQECrDj.exe
  C:\Windows\System\NQECrDj.exe
  2⤵
  PID:13012
- C:\Windows\System\xLgBZWU.exe
  C:\Windows\System\xLgBZWU.exe
  2⤵
  PID:13036
- C:\Windows\System\qzHnGGW.exe
  C:\Windows\System\qzHnGGW.exe
  2⤵
  PID:13064
- C:\Windows\System\VyFNlKS.exe
  C:\Windows\System\VyFNlKS.exe
  2⤵
  PID:13080
- C:\Windows\System\PtgAqex.exe
  C:\Windows\System\PtgAqex.exe
  2⤵
  PID:13104
- C:\Windows\System\zTVvcPg.exe
  C:\Windows\System\zTVvcPg.exe
  2⤵
  PID:13128
- C:\Windows\System\PEILePp.exe
  C:\Windows\System\PEILePp.exe
  2⤵
  PID:13148
- C:\Windows\System\vYjQAvT.exe
  C:\Windows\System\vYjQAvT.exe
  2⤵
  PID:13168
- C:\Windows\System\pbyeovm.exe
  C:\Windows\System\pbyeovm.exe
  2⤵
  PID:13192
- C:\Windows\System\TbCiAVZ.exe
  C:\Windows\System\TbCiAVZ.exe
  2⤵
  PID:13220
- C:\Windows\System\fSSSymf.exe
  C:\Windows\System\fSSSymf.exe
  2⤵
  PID:7384
- C:\Windows\System\ozRfHRb.exe
  C:\Windows\System\ozRfHRb.exe
  2⤵
  PID:11324
- C:\Windows\System\UKfFjnt.exe
  C:\Windows\System\UKfFjnt.exe
  2⤵
  PID:11476
- C:\Windows\System\nTlNcuo.exe
  C:\Windows\System\nTlNcuo.exe
  2⤵
  PID:11536
- C:\Windows\System\ftbNdVj.exe
  C:\Windows\System\ftbNdVj.exe
  2⤵
  PID:6572
- C:\Windows\System\WUdTXUr.exe
  C:\Windows\System\WUdTXUr.exe
  2⤵
  PID:11648
- C:\Windows\System\EBBTQqo.exe
  C:\Windows\System\EBBTQqo.exe
  2⤵
  PID:8928
- C:\Windows\System\lrcoojh.exe
  C:\Windows\System\lrcoojh.exe
  2⤵
  PID:11736
- C:\Windows\System\WCrwgOh.exe
  C:\Windows\System\WCrwgOh.exe
  2⤵
  PID:11832
- C:\Windows\System\moDBeYz.exe
  C:\Windows\System\moDBeYz.exe
  2⤵
  PID:11940
- C:\Windows\System\tDJkpfj.exe
  C:\Windows\System\tDJkpfj.exe
  2⤵
  PID:10292
- C:\Windows\System\hezOGhn.exe
  C:\Windows\System\hezOGhn.exe
  2⤵
  PID:9348
- C:\Windows\System\uMLhLXp.exe
  C:\Windows\System\uMLhLXp.exe
  2⤵
  PID:9380
- C:\Windows\System\JAfGydr.exe
  C:\Windows\System\JAfGydr.exe
  2⤵
  PID:9496
- C:\Windows\System\QTHhogt.exe
  C:\Windows\System\QTHhogt.exe
  2⤵
  PID:10336
- C:\Windows\System\ZPCzdcn.exe
  C:\Windows\System\ZPCzdcn.exe
  2⤵
  PID:9212
- C:\Windows\System\jsdGdxr.exe
  C:\Windows\System\jsdGdxr.exe
  2⤵
  PID:9804
- C:\Windows\System\VIxIPiI.exe
  C:\Windows\System\VIxIPiI.exe
  2⤵
  PID:11092
- C:\Windows\System\rxvqnys.exe
  C:\Windows\System\rxvqnys.exe
  2⤵
  PID:11228
- C:\Windows\System\hcrlZWN.exe
  C:\Windows\System\hcrlZWN.exe
  2⤵
  PID:9332
- C:\Windows\System\FbbpjWo.exe
  C:\Windows\System\FbbpjWo.exe
  2⤵
  PID:12404
- C:\Windows\System\dVuQcyS.exe
  C:\Windows\System\dVuQcyS.exe
  2⤵
  PID:13328
- C:\Windows\System\hMrYCtH.exe
  C:\Windows\System\hMrYCtH.exe
  2⤵
  PID:13348
- C:\Windows\System\QvmGiyu.exe
  C:\Windows\System\QvmGiyu.exe
  2⤵
  PID:13364
- C:\Windows\System\amkGWUb.exe
  C:\Windows\System\amkGWUb.exe
  2⤵
  PID:13380
- C:\Windows\System\kuspNFS.exe
  C:\Windows\System\kuspNFS.exe
  2⤵
  PID:13400
- C:\Windows\System\ZxXfPHd.exe
  C:\Windows\System\ZxXfPHd.exe
  2⤵
  PID:13416
- C:\Windows\System\vcQgfbK.exe
  C:\Windows\System\vcQgfbK.exe
  2⤵
  PID:13432
- C:\Windows\System\Caucbtc.exe
  C:\Windows\System\Caucbtc.exe
  2⤵
  PID:13448
- C:\Windows\System\txOENVU.exe
  C:\Windows\System\txOENVU.exe
  2⤵
  PID:13464
- C:\Windows\System\BgfdwYr.exe
  C:\Windows\System\BgfdwYr.exe
  2⤵
  PID:13480
- C:\Windows\System\rmVBuZC.exe
  C:\Windows\System\rmVBuZC.exe
  2⤵
  PID:13500
- C:\Windows\System\qfjDpgf.exe
  C:\Windows\System\qfjDpgf.exe
  2⤵
  PID:13520
- C:\Windows\System\rTjOFcR.exe
  C:\Windows\System\rTjOFcR.exe
  2⤵
  PID:13544
- C:\Windows\System\XejNulm.exe
  C:\Windows\System\XejNulm.exe
  2⤵
  PID:13568
- C:\Windows\System\MtjQlvs.exe
  C:\Windows\System\MtjQlvs.exe
  2⤵
  PID:13592
- C:\Windows\System\SsXztBw.exe
  C:\Windows\System\SsXztBw.exe
  2⤵
  PID:13616
- C:\Windows\System\TcKtlrY.exe
  C:\Windows\System\TcKtlrY.exe
  2⤵
  PID:13636
- C:\Windows\System\AviWpwY.exe
  C:\Windows\System\AviWpwY.exe
  2⤵
  PID:13664
- C:\Windows\System\kjrNRth.exe
  C:\Windows\System\kjrNRth.exe
  2⤵
  PID:13688
- C:\Windows\System\YHVEZko.exe
  C:\Windows\System\YHVEZko.exe
  2⤵
  PID:13708
- C:\Windows\System\NrawgAY.exe
  C:\Windows\System\NrawgAY.exe
  2⤵
  PID:13736
- C:\Windows\System\eMYlmAE.exe
  C:\Windows\System\eMYlmAE.exe
  2⤵
  PID:13756
- C:\Windows\System\fwrbuID.exe
  C:\Windows\System\fwrbuID.exe
  2⤵
  PID:13776
- C:\Windows\System\KmUypLQ.exe
  C:\Windows\System\KmUypLQ.exe
  2⤵
  PID:13800
- C:\Windows\System\ILWKjbe.exe
  C:\Windows\System\ILWKjbe.exe
  2⤵
  PID:13824
- C:\Windows\System\FRMYklf.exe
  C:\Windows\System\FRMYklf.exe
  2⤵
  PID:13848
- C:\Windows\System\KSsufyL.exe
  C:\Windows\System\KSsufyL.exe
  2⤵
  PID:13864
- C:\Windows\System\vicxOGe.exe
  C:\Windows\System\vicxOGe.exe
  2⤵
  PID:13884
- C:\Windows\System\nwUaswd.exe
  C:\Windows\System\nwUaswd.exe
  2⤵
  PID:13904
- C:\Windows\System\tEfZsRv.exe
  C:\Windows\System\tEfZsRv.exe
  2⤵
  PID:13924
- C:\Windows\System\EBauzUE.exe
  C:\Windows\System\EBauzUE.exe
  2⤵
  PID:13944
- C:\Windows\System\oSMyiYA.exe
  C:\Windows\System\oSMyiYA.exe
  2⤵
  PID:13968
- C:\Windows\System\lDJDFNH.exe
  C:\Windows\System\lDJDFNH.exe
  2⤵
  PID:13988
- C:\Windows\System\nTmbVJu.exe
  C:\Windows\System\nTmbVJu.exe
  2⤵
  PID:14008
- C:\Windows\System\nJmGaJB.exe
  C:\Windows\System\nJmGaJB.exe
  2⤵
  PID:14032
- C:\Windows\System\rTgQUkN.exe
  C:\Windows\System\rTgQUkN.exe
  2⤵
  PID:14056
- C:\Windows\System\PwtfPCp.exe
  C:\Windows\System\PwtfPCp.exe
  2⤵
  PID:14084
- C:\Windows\System\ETOAdzP.exe
  C:\Windows\System\ETOAdzP.exe
  2⤵
  PID:14104
- C:\Windows\System\vaJsgMU.exe
  C:\Windows\System\vaJsgMU.exe
  2⤵
  PID:14124
- C:\Windows\System\ZYkKyDl.exe
  C:\Windows\System\ZYkKyDl.exe
  2⤵
  PID:14148
- C:\Windows\System\NLiVMcM.exe
  C:\Windows\System\NLiVMcM.exe
  2⤵
  PID:14172
- C:\Windows\System\NDHgYnG.exe
  C:\Windows\System\NDHgYnG.exe
  2⤵
  PID:14196
- C:\Windows\System\UrqrsnB.exe
  C:\Windows\System\UrqrsnB.exe
  2⤵
  PID:14224
- C:\Windows\System\uapbYti.exe
  C:\Windows\System\uapbYti.exe
  2⤵
  PID:14248
- C:\Windows\System\pVfOuPV.exe
  C:\Windows\System\pVfOuPV.exe
  2⤵
  PID:14268
- C:\Windows\System\HGyuUMN.exe
  C:\Windows\System\HGyuUMN.exe
  2⤵
  PID:14292
- C:\Windows\System\bPbRYMo.exe
  C:\Windows\System\bPbRYMo.exe
  2⤵
  PID:14312
- C:\Windows\System\lAOuseI.exe
  C:\Windows\System\lAOuseI.exe
  2⤵
  PID:8644
- C:\Windows\System\ocpOaka.exe
  C:\Windows\System\ocpOaka.exe
  2⤵
  PID:9652
- C:\Windows\System\XieToKE.exe
  C:\Windows\System\XieToKE.exe
  2⤵
  PID:12504
- C:\Windows\System\cfijqDw.exe
  C:\Windows\System\cfijqDw.exe
  2⤵
  PID:9816
- C:\Windows\System\QBwZmHf.exe
  C:\Windows\System\QBwZmHf.exe
  2⤵
  PID:12644
- C:\Windows\System\tOdczkn.exe
  C:\Windows\System\tOdczkn.exe
  2⤵
  PID:12716
- C:\Windows\System\ElOGssX.exe
  C:\Windows\System\ElOGssX.exe
  2⤵
  PID:7320
- C:\Windows\System\nBYUnLP.exe
  C:\Windows\System\nBYUnLP.exe
  2⤵
  PID:11268
- C:\Windows\System\VgOBPsf.exe
  C:\Windows\System\VgOBPsf.exe
  2⤵
  PID:12908
- C:\Windows\System\TMEZIvl.exe
  C:\Windows\System\TMEZIvl.exe
  2⤵
  PID:12984
- C:\Windows\System\NbnpCFR.exe
  C:\Windows\System\NbnpCFR.exe
  2⤵
  PID:11416
- C:\Windows\System\PrJJoDV.exe
  C:\Windows\System\PrJJoDV.exe
  2⤵
  PID:11492
- C:\Windows\System\IPpLdUq.exe
  C:\Windows\System\IPpLdUq.exe
  2⤵
  PID:13112
- C:\Windows\System\cqLxqwg.exe
  C:\Windows\System\cqLxqwg.exe
  2⤵
  PID:13188
- C:\Windows\System\epxjabC.exe
  C:\Windows\System\epxjabC.exe
  2⤵
  PID:8168
- C:\Windows\System\LQtpRPD.exe
  C:\Windows\System\LQtpRPD.exe
  2⤵
  PID:10256
- C:\Windows\System\GQLzjFE.exe
  C:\Windows\System\GQLzjFE.exe
  2⤵
  PID:11988
- C:\Windows\System\gfoqnkX.exe
  C:\Windows\System\gfoqnkX.exe
  2⤵
  PID:14356
- C:\Windows\System\DlllUpz.exe
  C:\Windows\System\DlllUpz.exe
  2⤵
  PID:14380
- C:\Windows\System\ZUIJAQF.exe
  C:\Windows\System\ZUIJAQF.exe
  2⤵
  PID:10568
- C:\Windows\System\aMEfVXB.exe
  C:\Windows\System\aMEfVXB.exe
  2⤵
  PID:10604
- C:\Windows\System\XihXIdC.exe
  C:\Windows\System\XihXIdC.exe
  2⤵
  PID:10648
- C:\Windows\System\LBmWhSv.exe
  C:\Windows\System\LBmWhSv.exe
  2⤵
  PID:10736
- C:\Windows\System\JMdFMkT.exe
  C:\Windows\System\JMdFMkT.exe
  2⤵
  PID:2124
- C:\Windows\System\YeYXObG.exe
  C:\Windows\System\YeYXObG.exe
  2⤵
  PID:9084
- C:\Windows\System\yBuctmv.exe
  C:\Windows\System\yBuctmv.exe
  2⤵
  PID:10548
- C:\Windows\System\zIENnrx.exe
  C:\Windows\System\zIENnrx.exe
  2⤵
  PID:11160
- C:\Windows\System\HAerqMN.exe
  C:\Windows\System\HAerqMN.exe
  2⤵
  PID:10520
- C:\Windows\System\brTICAg.exe
  C:\Windows\System\brTICAg.exe
  2⤵
  PID:11088
- C:\Windows\System\oWwxkyN.exe
  C:\Windows\System\oWwxkyN.exe
  2⤵
  PID:12372
- C:\Windows\System\hFkMjEi.exe
  C:\Windows\System\hFkMjEi.exe
  2⤵
  PID:12400
- C:\Windows\System\ZkiQaax.exe
  C:\Windows\System\ZkiQaax.exe
  2⤵
  PID:13360
- C:\Windows\System\CJgIXaS.exe
  C:\Windows\System\CJgIXaS.exe
  2⤵
  PID:13408
- C:\Windows\System\OLLboZU.exe
  C:\Windows\System\OLLboZU.exe
  2⤵
  PID:13440
- C:\Windows\System\XmCbQia.exe
  C:\Windows\System\XmCbQia.exe
  2⤵
  PID:13472
- C:\Windows\System\tbFBSWf.exe
  C:\Windows\System\tbFBSWf.exe
  2⤵
  PID:13496
- C:\Windows\System\AZGWAmB.exe
  C:\Windows\System\AZGWAmB.exe
  2⤵
  PID:13528
- C:\Windows\System\XcFOCNM.exe
  C:\Windows\System\XcFOCNM.exe
  2⤵
  PID:12452
- C:\Windows\System\yJNBIgT.exe
  C:\Windows\System\yJNBIgT.exe
  2⤵
  PID:12468
- C:\Windows\System\KHoyvcq.exe
  C:\Windows\System\KHoyvcq.exe
  2⤵
  PID:13600
- C:\Windows\System\XDhPAxE.exe
  C:\Windows\System\XDhPAxE.exe
  2⤵
  PID:13628
- C:\Windows\System\EYnUlTn.exe
  C:\Windows\System\EYnUlTn.exe
  2⤵
  PID:13644
- C:\Windows\System\gbnZPkS.exe
  C:\Windows\System\gbnZPkS.exe
  2⤵
  PID:13672
- C:\Windows\System\PXlIlWq.exe
  C:\Windows\System\PXlIlWq.exe
  2⤵
  PID:13700
- C:\Windows\System\lYMIrKZ.exe
  C:\Windows\System\lYMIrKZ.exe
  2⤵
  PID:13724
- C:\Windows\System\VnkUqsU.exe
  C:\Windows\System\VnkUqsU.exe
  2⤵
  PID:12600
- C:\Windows\System\ianPSze.exe
  C:\Windows\System\ianPSze.exe
  2⤵
  PID:13792
- C:\Windows\System\ByqgvyX.exe
  C:\Windows\System\ByqgvyX.exe
  2⤵
  PID:13836
- C:\Windows\System\GSYplQf.exe
  C:\Windows\System\GSYplQf.exe
  2⤵
  PID:13856
- C:\Windows\System\hIyMSbr.exe
  C:\Windows\System\hIyMSbr.exe
  2⤵
  PID:12736
- C:\Windows\System\wsSpjcE.exe
  C:\Windows\System\wsSpjcE.exe
  2⤵
  PID:13896
- C:\Windows\System\ZVJheAR.exe
  C:\Windows\System\ZVJheAR.exe
  2⤵
  PID:13920
- C:\Windows\System\WtDTRnF.exe
  C:\Windows\System\WtDTRnF.exe
  2⤵
  PID:12796
- C:\Windows\System\oyFTYlV.exe
  C:\Windows\System\oyFTYlV.exe
  2⤵
  PID:12816
- C:\Windows\System\tGjEZfs.exe
  C:\Windows\System\tGjEZfs.exe
  2⤵
  PID:14016
- C:\Windows\System\mgXSbtb.exe
  C:\Windows\System\mgXSbtb.exe
  2⤵
  PID:14040
- C:\Windows\System\MRakyAz.exe
  C:\Windows\System\MRakyAz.exe
  2⤵
  PID:12956
- C:\Windows\System\zxKAxdw.exe
  C:\Windows\System\zxKAxdw.exe
  2⤵
  PID:12988
- C:\Windows\System\vRdLROo.exe
  C:\Windows\System\vRdLROo.exe
  2⤵
  PID:14144
- C:\Windows\System\gRXYvIg.exe
  C:\Windows\System\gRXYvIg.exe
  2⤵
  PID:14184
- C:\Windows\System\oQNQiqg.exe
  C:\Windows\System\oQNQiqg.exe
  2⤵
  PID:13024
- C:\Windows\System\NbXTmLC.exe
  C:\Windows\System\NbXTmLC.exe
  2⤵
  PID:14232
- C:\Windows\System\IYnKTiA.exe
  C:\Windows\System\IYnKTiA.exe
  2⤵
  PID:9600
- C:\Windows\System\dYiXvML.exe
  C:\Windows\System\dYiXvML.exe
  2⤵
  PID:12492
- C:\Windows\System\WbhzDkZ.exe
  C:\Windows\System\WbhzDkZ.exe
  2⤵
  PID:9872
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 9872 -s 248
    3⤵
    PID:12112
- C:\Windows\System\LoUELDg.exe
  C:\Windows\System\LoUELDg.exe
  2⤵
  PID:11716
- C:\Windows\System\qzDjoya.exe
  C:\Windows\System\qzDjoya.exe
  2⤵
  PID:11756
- C:\Windows\System\gWFiWrf.exe
  C:\Windows\System\gWFiWrf.exe
  2⤵
  PID:11836
- C:\Windows\System\EwGtwrR.exe
  C:\Windows\System\EwGtwrR.exe
  2⤵
  PID:13276
- C:\Windows\System\gtIiUof.exe
  C:\Windows\System\gtIiUof.exe
  2⤵
  PID:12884
- C:\Windows\System\tpaUGSf.exe
  C:\Windows\System\tpaUGSf.exe
  2⤵
  PID:12964
- C:\Windows\System\evCLDDa.exe
  C:\Windows\System\evCLDDa.exe
  2⤵
  PID:11488
- C:\Windows\System\tSeDQwK.exe
  C:\Windows\System\tSeDQwK.exe
  2⤵
  PID:11924
- C:\Windows\System\TErpTJe.exe
  C:\Windows\System\TErpTJe.exe
  2⤵
  PID:11696
- C:\Windows\System\kMJrhtw.exe
  C:\Windows\System\kMJrhtw.exe
  2⤵
  PID:13296
- C:\Windows\System\GYDfsTI.exe
  C:\Windows\System\GYDfsTI.exe
  2⤵
  PID:13304
- C:\Windows\System\dQyDhNz.exe
  C:\Windows\System\dQyDhNz.exe
  2⤵
  PID:14352
- C:\Windows\System\FxdCFsj.exe
  C:\Windows\System\FxdCFsj.exe
  2⤵
  PID:14408
- C:\Windows\System\knIxRFE.exe
  C:\Windows\System\knIxRFE.exe
  2⤵
  PID:14424
- C:\Windows\System\NKkijKM.exe
  C:\Windows\System\NKkijKM.exe
  2⤵
  PID:12128
- C:\Windows\System\XeGNLXQ.exe
  C:\Windows\System\XeGNLXQ.exe
  2⤵
  PID:12164
- C:\Windows\System\wErcIBY.exe
  C:\Windows\System\wErcIBY.exe
  2⤵
  PID:12212
- C:\Windows\System\umsACwa.exe
  C:\Windows\System\umsACwa.exe
  2⤵
  PID:10508
- C:\Windows\System\uqqqQUA.exe
  C:\Windows\System\uqqqQUA.exe
  2⤵
  PID:9124
- C:\Windows\System\DMDWVyJ.exe
  C:\Windows\System\DMDWVyJ.exe
  2⤵
  PID:7120
- C:\Windows\System\yTQTDgR.exe
  C:\Windows\System\yTQTDgR.exe
  2⤵
  PID:9048
- C:\Windows\System\ljUDKZQ.exe
  C:\Windows\System\ljUDKZQ.exe
  2⤵
  PID:12272
- C:\Windows\System\YnIuYdw.exe
  C:\Windows\System\YnIuYdw.exe
  2⤵
  PID:6780
- C:\Windows\System\UQpoUNk.exe
  C:\Windows\System\UQpoUNk.exe
  2⤵
  PID:14532
- C:\Windows\System\SGfviGR.exe
  C:\Windows\System\SGfviGR.exe
  2⤵
  PID:8380
- C:\Windows\System\vgLcQQn.exe
  C:\Windows\System\vgLcQQn.exe
  2⤵
  PID:11292
- C:\Windows\System\CVnwiek.exe
  C:\Windows\System\CVnwiek.exe
  2⤵
  PID:10000
- C:\Windows\System\YgInsfc.exe
  C:\Windows\System\YgInsfc.exe
  2⤵
  PID:9724
- C:\Windows\System\tjnCcHR.exe
  C:\Windows\System\tjnCcHR.exe
  2⤵
  PID:9576
- C:\Windows\System\VyCEzHR.exe
  C:\Windows\System\VyCEzHR.exe
  2⤵
  PID:9932
- C:\Windows\System\gfwcZpe.exe
  C:\Windows\System\gfwcZpe.exe
  2⤵
  PID:11288
- C:\Windows\System\WzVknxe.exe
  C:\Windows\System\WzVknxe.exe
  2⤵
  PID:9064
- C:\Windows\System\nDzosPL.exe
  C:\Windows\System\nDzosPL.exe
  2⤵
  PID:14876
- C:\Windows\System\DdhyNER.exe
  C:\Windows\System\DdhyNER.exe
  2⤵
  PID:7732
- C:\Windows\System\LvqVkQY.exe
  C:\Windows\System\LvqVkQY.exe
  2⤵
  PID:14948
- C:\Windows\System\EmmoCTq.exe
  C:\Windows\System\EmmoCTq.exe
  2⤵
  PID:4860
- C:\Windows\System\DQYioDp.exe
  C:\Windows\System\DQYioDp.exe
  2⤵
  PID:14780
- C:\Windows\System\xqjeuqT.exe
  C:\Windows\System\xqjeuqT.exe
  2⤵
  PID:14828
- C:\Windows\System\wkEepcW.exe
  C:\Windows\System\wkEepcW.exe
  2⤵
  PID:14912
- C:\Windows\System\oMMPQpz.exe
  C:\Windows\System\oMMPQpz.exe
  2⤵
  PID:15112
- C:\Windows\System\XjpTMal.exe
  C:\Windows\System\XjpTMal.exe
  2⤵
  PID:2952
- C:\Windows\System\pdLmafj.exe
  C:\Windows\System\pdLmafj.exe
  2⤵
  PID:4064
- C:\Windows\System\hgDXMkC.exe
  C:\Windows\System\hgDXMkC.exe
  2⤵
  PID:15024
- C:\Windows\System\mYDToga.exe
  C:\Windows\System\mYDToga.exe
  2⤵
  PID:1920
- C:\Windows\System\NEUSvWT.exe
  C:\Windows\System\NEUSvWT.exe
  2⤵
  PID:3056
- C:\Windows\System\TwcqBtb.exe
  C:\Windows\System\TwcqBtb.exe
  2⤵
  PID:14788
- C:\Windows\System\SflKDDP.exe
  C:\Windows\System\SflKDDP.exe
  2⤵
  PID:13492
- C:\Windows\System\niBFdGl.exe
  C:\Windows\System\niBFdGl.exe
  2⤵
  PID:13684
- C:\Windows\System\trIJlEL.exe
  C:\Windows\System\trIJlEL.exe
  2⤵
  PID:15188
- C:\Windows\System\hHESwfM.exe
  C:\Windows\System\hHESwfM.exe
  2⤵
  PID:14004
- C:\Windows\System\FJevyTR.exe
  C:\Windows\System\FJevyTR.exe
  2⤵
  PID:14212
- C:\Windows\System\DjjbHdU.exe
  C:\Windows\System\DjjbHdU.exe
  2⤵
  PID:10584
- C:\Windows\System\ASWmRcj.exe
  C:\Windows\System\ASWmRcj.exe
  2⤵
  PID:10960
- C:\Windows\System\oceXReU.exe
  C:\Windows\System\oceXReU.exe
  2⤵
  PID:9472
- C:\Windows\System\uFfAsJt.exe
  C:\Windows\System\uFfAsJt.exe
  2⤵
  PID:12352
- C:\Windows\System\UBOlgEy.exe
  C:\Windows\System\UBOlgEy.exe
  2⤵
  PID:8704
- C:\Windows\System\AsolnpF.exe
  C:\Windows\System\AsolnpF.exe
  2⤵
  PID:9712
- C:\Windows\System\FKioGsq.exe
  C:\Windows\System\FKioGsq.exe
  2⤵
  PID:13512
- C:\Windows\System\pOhXpaO.exe
  C:\Windows\System\pOhXpaO.exe
  2⤵
  PID:9012
- C:\Windows\System\reFOoOh.exe
  C:\Windows\System\reFOoOh.exe
  2⤵
  PID:8984
- C:\Windows\System\KuCknar.exe
  C:\Windows\System\KuCknar.exe
  2⤵
  PID:12092
- C:\Windows\System\knxWDjk.exe
  C:\Windows\System\knxWDjk.exe
  2⤵
  PID:12768
- C:\Windows\System\jQXKxhQ.exe
  C:\Windows\System\jQXKxhQ.exe
  2⤵
  PID:15224
- C:\Windows\System\KIYBZsA.exe
  C:\Windows\System\KIYBZsA.exe
  2⤵
  PID:15256
- C:\Windows\System\RXdqnWL.exe
  C:\Windows\System\RXdqnWL.exe
  2⤵
  PID:10620
- C:\Windows\System\uETblxG.exe
  C:\Windows\System\uETblxG.exe
  2⤵
  PID:13772
- C:\Windows\System\hmrMgxN.exe
  C:\Windows\System\hmrMgxN.exe
  2⤵
  PID:13976
- C:\Windows\System\shyJITs.exe
  C:\Windows\System\shyJITs.exe
  2⤵
  PID:11392
- C:\Windows\System\ajHNYhp.exe
  C:\Windows\System\ajHNYhp.exe
  2⤵
  PID:15020
- C:\Windows\System\cEmZLkZ.exe
  C:\Windows\System\cEmZLkZ.exe
  2⤵
  PID:2648
- C:\Windows\System\AtRBfLf.exe
  C:\Windows\System\AtRBfLf.exe
  2⤵
  PID:11824
- C:\Windows\System\bMEptVk.exe
  C:\Windows\System\bMEptVk.exe
  2⤵
  PID:8124
- C:\Windows\System\IAXKXPV.exe
  C:\Windows\System\IAXKXPV.exe
  2⤵
  PID:12712
- C:\Windows\System\XPRJpew.exe
  C:\Windows\System\XPRJpew.exe
  2⤵
  PID:13540

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:9180

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:12756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DwMvuaI.exe

Path C:\Windows\System\DwMvuaI.exe
Size 1.7MB
SHA256 456382c43af1e13dcf3a5326b62451a944d3f168d809a385a15706e2ad6d60e9
MD5 00334614c51f336f395cb134a1497742
SHA1 e3b510aa11dd6913b7ce1bfb838c825d44eb8239
SHA512 99628b23913f499bb9dab057d8207036149a6c19fb7a7ea47690af375a010196b675178954abf5cbc2b23109aa01c65240b8bcd9a2b1b2af17eedb13685ae373
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdZ:RWWBibaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gnmshfq.exe

Path C:\Windows\System\Gnmshfq.exe
Size 1.7MB
SHA256 41fe6c08e3b2fdb3eb0a83eb5bbb7214dde7a6d62a76c6542400c91a5dd2310e
MD5 5a6b1ec22462081f21d690dba15c929a
SHA1 e5f06e864483252910543fb9a8364b7dd7444598
SHA512 6da89d871e74deed68e8f2c9599ab390f5b85d50cd9cc12bb039a04e20585818bec2fc077a47f4dde028ec4237ffb685cc13a992b0ef2d57d600781da240512a
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdG:RWWBiba0
MD5 SHA1 SHA512 SSDEEP

Submit Download

JWngNHV.exe

Path C:\Windows\System\JWngNHV.exe
Size 1.7MB
SHA256 717086d96c501c553d304db1da4efba429e7f9a1919ca30ea973db6153d7c01e
MD5 25bdc5f93a95fc5f8e141badf648fd7c
SHA1 eae084f51dd5233d91fabbb958730ac21f647654
SHA512 1a33c99f3f997789088c2032ee7d9e5e1f1cdf2b4f6e007f1a831e432206ed3cb3eaeacf142f54f3333918fee4aba910ad7381717e26af4d9a446fd8cefc430e
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd0:RWWBibau
MD5 SHA1 SHA512 SSDEEP

Submit Download

JxZCYoZ.exe

Path C:\Windows\System\JxZCYoZ.exe
Size 1.7MB
SHA256 d2019630d683207c12c8f7bb5c8b76f749f9c2b6364d61927d3d251aecf2f8aa
MD5 b78ab3282245369ec1fee737d2c5bb49
SHA1 0219533e4a9b45afbcb474cf34d6ba99a17e73c3
SHA512 f84e70348413b0dc4b930366d9d9b2530c33bd7e3bd6026c9380ed0899d5e18d1a70da7f13d53a7f8405e17d6152be5665ce51c7bbe36f728441c9aa666b2d34
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdf:RWWBibax
MD5 SHA1 SHA512 SSDEEP

Submit Download

KpIqbrK.exe

Path C:\Windows\System\KpIqbrK.exe
Size 1.7MB
SHA256 25430447532e437dc41f5f0a9151a44367f5b6557ea476f2c0c2b41b27dc218b
MD5 00c9b74acea1984667a1f5627ef8e058
SHA1 591c4d520ce627c355700e941c35bb83606ba3aa
SHA512 098bc01764d761cbdb7049f853d049ae3b76a4c0512d71a23df0657a78ec8bcf6f9a28458862c7c043588f7c91b5792866877cfee311992c632e170f8b5ec19e
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdV:RWWBibav
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSrHwKa.exe

Path C:\Windows\System\LSrHwKa.exe
Size 1.7MB
SHA256 e4377ee177bd74c5bf505577a3392a47a047358c4ea31571fd26188638ab438d
MD5 030d0c352c1b5a28fb05a4d32e4e1343
SHA1 9a7da884a68925c44140d3649ccf996439609606
SHA512 9d850374ff61edff234d06ea772b4321c26b192ae549df976e4fab96bf9206b598767ef52f9b9c92ac21b6d9c2e1d366805813cfc567bdabfd3018098afaa30e
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdo:RWWBibam
MD5 SHA1 SHA512 SSDEEP

Submit Download

MAIyMwP.exe

Path C:\Windows\System\MAIyMwP.exe
Size 1.7MB
SHA256 3f3754bacb953d48d4dfc1c60539b72aba2053b272c20f815df1bd0943ae893d
MD5 8ead1d66059619ae8014ea0c6971975d
SHA1 6435d09558a1fa21917337b8834f64b318cf8d0a
SHA512 a604fac8aa5c2ef314510ba243ae8278603dab281fab5fcf4c45762dbb4e210d7a71d8529aea7729dbdc71c3825d414e2033be55d544f303c41073b9e286b7c1
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdm:RWWBibak
MD5 SHA1 SHA512 SSDEEP

Submit Download

MfYZcmX.exe

Path C:\Windows\System\MfYZcmX.exe
Size 1.7MB
SHA256 b1d89e1ccd0ed59308ed403429d2fcccf1d458aa4ac93eacf893a0ff66e7e44f
MD5 a9827b739e54902679414e35504078ab
SHA1 e4177a95e5be2400bbf1db326ad7209d695bf8ae
SHA512 80efedd60bc2348e320f28c676838a6e585106f7849dbf6f83d77050dacc0e12a1fe80ff5a1f9e642956c384c04c5cc5e946bf54243e2c75c922db8ebaff4824
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdB:RWWBiba/
MD5 SHA1 SHA512 SSDEEP

Submit Download

NoTTHNO.exe

Path C:\Windows\System\NoTTHNO.exe
Size 1.7MB
SHA256 bc73fcb1ff023a1618fac3b21344d09dac37bce602e1007aee16b098dde8ad79
MD5 1081ee2f263f0d4f68996afe8bff014d
SHA1 b653b431eaf9da57cfe6cc6de6139650cecc93b5
SHA512 38c8fa5786f2a95e1c68d38795deafcd6d23c15d21ca206f4ce16bf97fae04bc402e3315f87204d5a69687318dcf04342b86be7d16e6b2f67ae76a170345cb1a
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdw:RWWBibaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

QatMdvF.exe

Path C:\Windows\System\QatMdvF.exe
Size 1.6MB
SHA256 a2b819867051dcfcf36c1945a2c40b1fd343b5c327e81141b37247ac9f68a3d2
MD5 6fb5b9d46b21c7134bee18c694f173d2
SHA1 1919b97cc380c16cd73bf0ea08c04d7b23a45d41
SHA512 295ca6aa3ace44edfc205356c99487dab16e1160fe3d10eabe0b6f2cefd1c70b1de61d82c8dd0f7f557476cedc135354e273dc90ccc0cc5d0875bad16570d940
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdf:RWWBibaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

VevQHmV.exe

Path C:\Windows\System\VevQHmV.exe
Size 1.7MB
SHA256 8d505538b9b9af7c02fd09a1e4979d8360954f894caf4505fa08a2982717d58a
MD5 f4806e377f249cb5dee2ccd9cc633d54
SHA1 f236e4f61d5a784a754cea81efc3ab661daea965
SHA512 e04768afe58189a4816e83513b05187b95066f0c3a41e474a5d38adbf1bc96e544f85f357be2f0968c22c3437741a3ece663a8b80a464cdd2ea113df05390af4
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdb9:RWWBibaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

VtBWlCR.exe

Path C:\Windows\System\VtBWlCR.exe
Size 1.6MB
SHA256 b207d5b788e45850b1dfbc396780288c6f6f5c23d38ed0f56574ef7329d35515
MD5 f95f70cc9c32086e4143d0e67ba4b6f6
SHA1 5ad30a19c63af1a94d34d0f136852d71483b4f08
SHA512 1413f61d292f24be82827bd63a4c0f5d2336517327e9bff68d34263af182e5bc9207cfd1973ed4770cafcc591cbb2a568b00ff8bff979228541f3690752ca4bb
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdB:RWWBibaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

WrilNHl.exe

Path C:\Windows\System\WrilNHl.exe
Size 1.7MB
SHA256 b434d83f2ee13047dc2660d83473564e3e0e81132527f59b524ac7916dc87e2b
MD5 afb49b1afb04d278f7a9a56adeb79ae8
SHA1 ed668af42b4770723d6060a05d1c6dbea7f1877d
SHA512 5febb6c389a5fe38006d84be346cfe6d1ce5606cdc4ea6e86c205102623d371f64eba2207f73ae6fb5836442b0e694335e12cf1798e835dcfbda1672908da300
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd+:RWWBibao
MD5 SHA1 SHA512 SSDEEP

Submit Download

XOFdoko.exe

Path C:\Windows\System\XOFdoko.exe
Size 1.7MB
SHA256 eec5f3a8fda2b4af7a3c5dcb1cf779a8d79783dd0f0ee3713cbedad167ef2627
MD5 34aa2f41680e97580a44e2812f83b963
SHA1 612b68b0302be8a83431c324ec6b1ba2ad31df6f
SHA512 f13bae8543f3b780d4e9e6cf6b57c0fdc9895ebb3a452357f813560366a56de9b7974bf01bb977d9f48e9af4c81c5c70b78350893371b60b675c5fa3647c9293
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdB:RWWBibaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

XsljutO.exe

Path C:\Windows\System\XsljutO.exe
Size 1.7MB
SHA256 d2647c3f79baab522aad9e689a10c88cc40b70116a81a4a95bf220e0275a1daa
MD5 2591c4c9248882b0030caa0d46e3f4ad
SHA1 f6f031eddf807ca44a848010980bf00af2c74d23
SHA512 ceb5d5dc3f5d75ce63d4f679701db0b93a92d5a1a0febe31c3f22a63d00e33ea9a4e77c71bafaa08e8c02e0533f789f64931a3c789f2196d0ceae4a235d3e7dd
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd0:RWWBibaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

YhfxAmA.exe

Path C:\Windows\System\YhfxAmA.exe
Size 1.7MB
SHA256 c2cb261ea17b81fc1664513e683eef238926f82cf9521d11e459923abe2d7f97
MD5 335fe1c3c3ac81dc2b6357e7891ea393
SHA1 29e1d8e6a750b3fb01b7cb27364b28a9d4a840c5
SHA512 6287bc3a308dd7cd1631a76705bade815db009fd0a5dc806afbc9c70ad8e9a04a3fe4e33f0bbd289d0c50fd5e1447883a416df171aca4285b2abc0b97293014a
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd0:RWWBibaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

aNcAZue.exe

Path C:\Windows\System\aNcAZue.exe
Size 1.7MB
SHA256 c742696164813bb1cf3e444be844ae5a94a1e078bc1d7f7b981209db075c48cc
MD5 cfa607842b5be07d3c8b2ceec139c1d8
SHA1 038c39f4b96ce734f9cdf4f2bc9656ade98b5a75
SHA512 577f12f923e0c463c46bc2f6b3f9dc3a61e017158e06228a397bfd759abc9c3e31d73b56422e30e5bdc98fd57d0579c8649d2c257271c222c3eb68fd6e8a1d06
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdj:RWWBibat
MD5 SHA1 SHA512 SSDEEP

Submit Download

aPatWig.exe

Path C:\Windows\System\aPatWig.exe
Size 1.6MB
SHA256 92143ca828729911773106120edfb3abd639bf8004905d56a6427af326a993a3
MD5 92e605fe7a96d601e1874537cf838077
SHA1 e99c39d7242c44d48f37d9c1b02eb2dc30aa9f14
SHA512 15aeec0117b8baa68dfeeaca00c567b5bb201284593c71dd520bc2fa38800dc69f5922217f5b70f05724f095498247590471baa87eb98b86a3c634b0beed2180
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdE:RWWBibaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

buiHHXt.exe

Path C:\Windows\System\buiHHXt.exe
Size 1.7MB
SHA256 ed49f48dc522692dd714395e6801917ff15228b3864d32eed8f4c3ce867a52dd
MD5 650ae319dd8ac08276076ff43d2ba727
SHA1 6ed73c6327387282f655c573bf044e7db4300d3d
SHA512 3ef4da2d377a0251b6f541d7c817e18c6c0d8da0c0ef078ceb0ba258eb2cd3fa8c454a2ae3c90f8f2ac028a26632ae6a46318e41a5cb1346a0296dae0035ae9f
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdT:RWWBiba5
MD5 SHA1 SHA512 SSDEEP

Submit Download

cCYbCIl.exe

Path C:\Windows\System\cCYbCIl.exe
Size 1.7MB
SHA256 0d786755e72a7726da560ff344b07e9a15f2da81ee60999f0914aac25334081c
MD5 80505a60fc8ea1483c8ff2a04162551d
SHA1 a910db9f5d69ca52e686dfa662b711837c1b220c
SHA512 727a836f06ae05fc6ec17c2a3e8475ba781a4d5743129ac6564d263ebd8e974976f8179649aade4caf83658ec655510d791658fabfaec01ee1c6ba7e9521de28
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdf:RWWBibaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cSVaRIr.exe

Path C:\Windows\System\cSVaRIr.exe
Size 1.7MB
SHA256 7cbbb3bb402a0f23af77b7ba45819bc575ac1aae62d7a5129b37f97dc7fa1122
MD5 e5f6e0e213ece0645c1773b179b6ad8a
SHA1 41ba41caf8c2077f01489d4ad81fad8829e64c04
SHA512 821ff648eb91e149b0f11d22d492fcf8d33395d6834f628f5cdbc3a2519d819541abfd17e2751f0046a427e929aad949aa394b2bdb0bf523d6712c7b618036d5
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdB:RWWBiban
MD5 SHA1 SHA512 SSDEEP

Submit Download

crxwVVs.exe

Path C:\Windows\System\crxwVVs.exe
Size 1.7MB
SHA256 5bff29e53debe8183a1550ba279d716ac06a85eda9247c66826318ea071a4cd8
MD5 ee616765c1254ce9491cca2264279b88
SHA1 03db6f8bceefa53073404338668da98d1a3ab3f8
SHA512 d9c13fb2b2d1192f93118b2a89883022f48ebdd8c30ce8041fcd73a2859b762f5a23c1a25bcb3b82eed8abfb87962e0a4c5bd255c8c872d69de4b1a03c9498cd
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdB:RWWBibaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

eJGDqfF.exe

Path C:\Windows\System\eJGDqfF.exe
Size 1.7MB
SHA256 741ec05ffe458cfc4e5833d31d7d2fe91860dff1f13242539d270fb29b9077cd
MD5 939257a0aab1f89647d2f097e29bcd22
SHA1 7d939d32b78c78456e44fe51d2729246e2ba53f5
SHA512 aadcc8f005dd3794b4be1ed55a7b033b54f96aff9a215db8bb29acb418416e10ea18a4392bf77d5a1114187b1a070561f71fbe153b21e8205d853be45d3f3363
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd/:RWWBibaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

efQgUDg.exe

Path C:\Windows\System\efQgUDg.exe
Size 1.7MB
SHA256 d9404984020d2ef3b2740cd4e67a790c6d1986475d813159f426281ba632698a
MD5 0663f69be1b2308d64a3ffbb65258b70
SHA1 eaabe33554bbf4eec8a237d17b7801b9172a51d6
SHA512 717217d75d9760d6f4526bb2673d47f0190db215aa0963502063c5b154d7f0a6692784e2032f2235170c1d13a0e01c04460dd67011a9068de70bdc7d6df071af
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd5:RWWBibar
MD5 SHA1 SHA512 SSDEEP

Submit Download

hNhnQJS.exe

Path C:\Windows\System\hNhnQJS.exe
Size 1.7MB
SHA256 6ca1920687cbbd6e3571daa280ef677ceac3155a2a886afd0f1380cde3ec6eb1
MD5 04f99bfc0afa166e70da80f04a243acc
SHA1 87bf1de71aa120191472b35b6bfe35c3954abf7b
SHA512 b2f6aada04b3c8c2834de344168109b6c4f0f2cf867b06d6cb586e56191a54393c3cc04d2474303dd6ff40bbfed9312c32828a44f4faa70918ed94ae41d2f082
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdA:RWWBibaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

lUFDbkD.exe

Path C:\Windows\System\lUFDbkD.exe
Size 1.7MB
SHA256 af18b75803526be7ed465ce6adee98788f5f65e40f584fcfba2b53b1aef325a9
MD5 86e4b778edf2435f988263a9a29cabb8
SHA1 7de5169df56617f7a19c19d59bf1cc2539123f77
SHA512 4352fe91fd8981c9ec60197b4f27c964192ff3d0cce5463274359b5cf4af78d26afe13a2304515ef0fafc9f11a69f48107e7a9e36113df8b674f037d1ce7f66b
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMde:RWWBibaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

lpDJkVe.exe

Path C:\Windows\System\lpDJkVe.exe
Size 1.7MB
SHA256 587154fcff131cfce5de4b3c558b3d143a9f53765279320fa007f6f6c3196524
MD5 d909749e20b74b42b621741935915ba3
SHA1 dd6b7d1590e2d729a2a8ee0c906ffc994b788688
SHA512 6f6d6e214de40665dc0064c3f81424fc4dc67b270675ab5c90d58da16707c0905abb3d318d3e8727197e57feb5548424837a945d482762850f826e3f2b5e3792
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd+:RWWBibaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

nWWNPZU.exe

Path C:\Windows\System\nWWNPZU.exe
Size 1.7MB
SHA256 34d22a9755e617647fcb6163ba7d06bf0adfe2c9d610fd85d31ec9eafe79891e
MD5 e477c811c6e0fed16af925f8fba79629
SHA1 b163dd887fe24ca0946e85e940d72206e3b85268
SHA512 6754b125c53c97603f7ccf25c89f9b4a15e2ca7f9f25c469d622efa8ba2099b3619cee2097890d5e11de81f878924b16475f84c5b3585b0ba032eef2ed80760e
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd2:RWWBibac
MD5 SHA1 SHA512 SSDEEP

Submit Download

nstwCqh.exe

Path C:\Windows\System\nstwCqh.exe
Size 1.7MB
SHA256 1d9848587d2d87c415873a60dcdc274d836f423d6fc1442c664cff5b5453d3ea
MD5 78bea9d0e5a879e7a356f89dde4e2f37
SHA1 819277f1b8292cb3b9a80ec297a9541ee9baa4fd
SHA512 c4bd8dcac69c81edf6cc3d8f7f9f57bef74a119ebe5f8ed456c45399cbd95fcb312a8340edbce0986a430019d230506e4a926a75a4d3f05ef50997eb0b6a90f1
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd7d:RWWBibar
MD5 SHA1 SHA512 SSDEEP

Submit Download

pOIeWpu.exe

Path C:\Windows\System\pOIeWpu.exe
Size 1.7MB
SHA256 80f2c6b5f20ac418f946275ae99694dd0f6d50d47e252e635b5f04ba7216e177
MD5 20047d3a2f82b947cadc99514f292257
SHA1 0c81e85a5221c6aa4056eb825ea5e7349dae289c
SHA512 5667e9231918cef241eb8ba7e4b6f5fc738c44cf95f909595985cb83f1b8c6c32e7f236dcc607ffd32971445eb1ddc5dde6b76aa3b7809120c3ac30822b2b503
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdk:RWWBibai
MD5 SHA1 SHA512 SSDEEP

Submit Download

pVGrkLL.exe

Path C:\Windows\System\pVGrkLL.exe
Size 1.6MB
SHA256 f85b9bfa72d46a71a843a2a09098f68e6c0b9b1cead1729aaca81c7b1b99a1c5
MD5 2ab653c808bf23c91eeeeb7ecb9b9304
SHA1 ad249934d85ed2c233b0e1305da8f672720907a6
SHA512 08bf737ea6bfc4363644a6982baa609c778770be12e899e01f668258f3088ddbb1799590efcec74588fd6cc0b83556edb35c652a2a010cce0164ca7ff3e36d20
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd6:RWWBibak
MD5 SHA1 SHA512 SSDEEP

Submit Download

peJYIqb.exe

Path C:\Windows\System\peJYIqb.exe
Size 1.6MB
SHA256 d8dc983ab1c3e1ce921d06f9c556bcf2d4d0cbd98a493f6724d72bb850f3cffe
MD5 90fbf630e6b0058a1e0ceeb95c065142
SHA1 e3683352e1e7d17f841fa0d6d27fc4f1f1ba1d25
SHA512 8a45d2fcc10242646d0b172874ff0935226d67e65d8ebe1cefa31a75762c1039ba7c960f28941e161054b3b2b506c665c1e094e839584325dc8905a31f234b1d
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd4:RWWBibaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

pqUIWui.exe

Path C:\Windows\System\pqUIWui.exe
Size 1.7MB
SHA256 7e9dd808a393ad386076d20600136dfdc40194eca9318858e940710186251099
MD5 e25e42ca1c7556066b5498cd81d048aa
SHA1 af7e8d96a323cd78323d6541eaf892a297318eaf
SHA512 4474081c009b0967b58e5eb377dcfefd4c01b0a0cae724ae10382e4a6d222460bdb370ea5f367b355663dc46b97f8cae3fcc90bff9bfe8cbf3eaaed0cfc4a713
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdT:RWWBibaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

rqUOShT.exe

Path C:\Windows\System\rqUOShT.exe
Size 1.7MB
SHA256 c0049a5b6a31173a7d4826aeaa1d9b5a5d52cc128385f3ffd1322887229859d7
MD5 89eca109cca17446ed78cc292266a8fd
SHA1 96f2e4aa862a8ded9dfae6f33c8c26669e42578c
SHA512 a5f98376c6dfc2be6cc96d13b0866e97fd46708e0b84b4814bec355c5fbc80bfa2bfce392e69813164395b62bcd350f1b374d0aac11fcd0e87f1afe1a16bf7b9
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdB:RWWBibaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

tRRdOHn.exe

Path C:\Windows\System\tRRdOHn.exe
Size 1.7MB
SHA256 6bd680691c9b6af1830862b6d477792d1ff4b792941612e0ec876ab1f0fc5eee
MD5 22f4808b6cf0d85762dbb514269be980
SHA1 08b54a3bf027f29d52d1f4c941c5c8998f64e0c0
SHA512 d7f61e99f245f7ddada626d460567c7760de713221ab78ec235ebac8eebb0ab02d0b49c08ae1b6d820c3eec4f1ff5209ca487a11736cae3f6772b2b0f883c76a
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd+:RWWBibao
MD5 SHA1 SHA512 SSDEEP

Submit Download

wUxaOjQ.exe

Path C:\Windows\System\wUxaOjQ.exe
Size 1.7MB
SHA256 1bf52669c1dc5457577b5fce37368575fb86b338af751f41b9856596dfcd26fa
MD5 b3e397fb30fb84246d3c099fce9f84a1
SHA1 63a9f168a6f1c4d1e3da4ee02afd6e8227b32389
SHA512 326fbbbe6996d8450df6ed0341c385534d1038d1297dd583378e052a23bcc9e990f5232b12429161f0da29c88ed0f65b767b66fc1f826df1bb7763b3bd03e1f3
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdW:RWWBibao
MD5 SHA1 SHA512 SSDEEP

Submit Download

xsbPsnC.exe

Path C:\Windows\System\xsbPsnC.exe
Size 1.6MB
SHA256 c17f952a4af9a5f3460369fddaebbe0224ac021b5de2460fcda1d7ace750a939
MD5 2628ba285ec37b3db9f6d307c2169d04
SHA1 d7b6e2edc269cea53d1b00c3bf555ffebe3977a2
SHA512 d6a5f0700dbe33a579c1b02fd9f8a9e0ff7d2c80752b1acc9fd91830e35aea23052a44055813d6ee2afcced8641ecf872975496aafb59de68ea8d0087109f0af
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMd7:RWWBibaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

zBIhnrP.exe

Path C:\Windows\System\zBIhnrP.exe
Size 1.6MB
SHA256 8d7f17524e07a05288ab1e90663be262d9cc8c8072345985a01bd257150514cb
MD5 fae1e1e199c8cb1f2e2e9564209dc403
SHA1 55a1af46a932554b36b0e3172e081531a34b12c9
SHA512 6d215f0b907b99a0fd32dc7d60bbeba4345f89a6ce5d569ae6a3b1069faa04a9344e89e49181d0545b774b5472fca0d40f33581ca6f7215df7d409afe2f05f0b
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWnv8eMdY:RWWBibaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-520-0x00007FF7EFF30000-0x00007FF7F0281000-memory.dmp

Download

memory/388-2649-0x00007FF7EFF30000-0x00007FF7F0281000-memory.dmp

Download

memory/1104-2609-0x00007FF6DA6D0000-0x00007FF6DAA21000-memory.dmp

Download

memory/1104-12-0x00007FF6DA6D0000-0x00007FF6DAA21000-memory.dmp

Download

memory/1104-2570-0x00007FF6DA6D0000-0x00007FF6DAA21000-memory.dmp

Download

memory/1620-2574-0x00007FF637970000-0x00007FF637CC1000-memory.dmp

Download

memory/1620-2671-0x00007FF637970000-0x00007FF637CC1000-memory.dmp

Download

memory/1620-158-0x00007FF637970000-0x00007FF637CC1000-memory.dmp

Download

memory/1676-254-0x00007FF7B9240000-0x00007FF7B9591000-memory.dmp

Download

memory/1676-2665-0x00007FF7B9240000-0x00007FF7B9591000-memory.dmp

Download

memory/1844-519-0x00007FF66BB10000-0x00007FF66BE61000-memory.dmp

Download

memory/1844-2636-0x00007FF66BB10000-0x00007FF66BE61000-memory.dmp

Download

memory/1848-2575-0x00007FF79C160000-0x00007FF79C4B1000-memory.dmp

Download

memory/1848-2634-0x00007FF79C160000-0x00007FF79C4B1000-memory.dmp

Download

memory/1848-74-0x00007FF79C160000-0x00007FF79C4B1000-memory.dmp

Download

memory/2080-46-0x00007FF72BFF0000-0x00007FF72C341000-memory.dmp

Download

memory/2080-2621-0x00007FF72BFF0000-0x00007FF72C341000-memory.dmp

Download

memory/2108-2573-0x00007FF7C1170000-0x00007FF7C14C1000-memory.dmp

Download

memory/2108-99-0x00007FF7C1170000-0x00007FF7C14C1000-memory.dmp

Download

memory/2108-2632-0x00007FF7C1170000-0x00007FF7C14C1000-memory.dmp

Download

memory/2348-2670-0x00007FF7FD4D0000-0x00007FF7FD821000-memory.dmp

Download

memory/2348-243-0x00007FF7FD4D0000-0x00007FF7FD821000-memory.dmp

Download

memory/2588-2616-0x00007FF65EE80000-0x00007FF65F1D1000-memory.dmp

Download

memory/2588-2571-0x00007FF65EE80000-0x00007FF65F1D1000-memory.dmp

Download

memory/2588-37-0x00007FF65EE80000-0x00007FF65F1D1000-memory.dmp

Download

memory/2720-2641-0x00007FF770D80000-0x00007FF7710D1000-memory.dmp

Download

memory/2720-412-0x00007FF770D80000-0x00007FF7710D1000-memory.dmp

Download

memory/2904-2668-0x00007FF616B50000-0x00007FF616EA1000-memory.dmp

Download

memory/2904-218-0x00007FF616B50000-0x00007FF616EA1000-memory.dmp

Download

memory/2948-2663-0x00007FF6BFAF0000-0x00007FF6BFE41000-memory.dmp

Download

memory/2948-290-0x00007FF6BFAF0000-0x00007FF6BFE41000-memory.dmp

Download

memory/2956-2638-0x00007FF650FA0000-0x00007FF6512F1000-memory.dmp

Download

memory/2956-462-0x00007FF650FA0000-0x00007FF6512F1000-memory.dmp

Download

memory/2972-212-0x00007FF633850000-0x00007FF633BA1000-memory.dmp

Download

memory/2972-2645-0x00007FF633850000-0x00007FF633BA1000-memory.dmp

Download

memory/2992-219-0x00007FF684480000-0x00007FF6847D1000-memory.dmp

Download

memory/2992-2643-0x00007FF684480000-0x00007FF6847D1000-memory.dmp

Download

memory/3136-47-0x00007FF75A020000-0x00007FF75A371000-memory.dmp

Download

memory/3136-2623-0x00007FF75A020000-0x00007FF75A371000-memory.dmp

Download

memory/3440-2626-0x00007FF7930C0000-0x00007FF793411000-memory.dmp

Download

memory/3440-2572-0x00007FF7930C0000-0x00007FF793411000-memory.dmp

Download

memory/3440-70-0x00007FF7930C0000-0x00007FF793411000-memory.dmp

Download

memory/3488-2658-0x00007FF6EEA30000-0x00007FF6EED81000-memory.dmp

Download

memory/3488-341-0x00007FF6EEA30000-0x00007FF6EED81000-memory.dmp

Download

memory/3636-2614-0x00007FF755460000-0x00007FF7557B1000-memory.dmp

Download

memory/3636-23-0x00007FF755460000-0x00007FF7557B1000-memory.dmp

Download

memory/3640-2630-0x00007FF712D90000-0x00007FF7130E1000-memory.dmp

Download

memory/3640-118-0x00007FF712D90000-0x00007FF7130E1000-memory.dmp

Download

memory/3844-2640-0x00007FF7AB2F0000-0x00007FF7AB641000-memory.dmp

Download

memory/3844-115-0x00007FF7AB2F0000-0x00007FF7AB641000-memory.dmp

Download

memory/3956-306-0x00007FF7EF9A0000-0x00007FF7EFCF1000-memory.dmp

Download

memory/3956-2659-0x00007FF7EF9A0000-0x00007FF7EFCF1000-memory.dmp

Download

memory/3972-571-0x00007FF7C51F0000-0x00007FF7C5541000-memory.dmp

Download

memory/3972-2654-0x00007FF7C51F0000-0x00007FF7C5541000-memory.dmp

Download

memory/4276-1-0x000001F8FFB60000-0x000001F8FFB70000-memory.dmp

Download

memory/4276-0-0x00007FF785520000-0x00007FF785871000-memory.dmp

Download

memory/4276-2473-0x00007FF785520000-0x00007FF785871000-memory.dmp

Download

memory/4352-389-0x00007FF6E0B70000-0x00007FF6E0EC1000-memory.dmp

Download

memory/4352-2673-0x00007FF6E0B70000-0x00007FF6E0EC1000-memory.dmp

Download

memory/4704-458-0x00007FF6FD0E0000-0x00007FF6FD431000-memory.dmp

Download

memory/4704-2627-0x00007FF6FD0E0000-0x00007FF6FD431000-memory.dmp

Download

memory/4832-2662-0x00007FF7A02A0000-0x00007FF7A05F1000-memory.dmp

Download

memory/4832-305-0x00007FF7A02A0000-0x00007FF7A05F1000-memory.dmp

Download

memory/4920-392-0x00007FF6E6160000-0x00007FF6E64B1000-memory.dmp

Download

memory/4920-2655-0x00007FF6E6160000-0x00007FF6E64B1000-memory.dmp

Download

memory/5000-198-0x00007FF6E9310000-0x00007FF6E9661000-memory.dmp

Download

memory/5000-2647-0x00007FF6E9310000-0x00007FF6E9661000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads