xmrig | 02efd3a0e5927496257f7bc90cfdaccd20fb47fe2d55a402daf896f9cc3d5942

Analysis

max time kernel
121s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
Size 1.7MB
Sample240519-rb5k9aba72
SHA256 02efd3a0e5927496257f7bc90cfdaccd20fb47fe2d55a402daf896f9cc3d5942
MD5 d13a9bee13b088c7675e7c1814ce0e40
SHA1 b9712afe93b7675da69e2e7056b9a47cea100999
SHA512 e73cf7d5c326000383c4c70ed1cefad36852ad03ef4cff86b176f23f08c612274697d4664ea26c3abeedb9fb5f466e8424e2372a000df5ed46d5858154d10343
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iJ:ROdWCCi7/rahoyBcIKH0iAxWsUIT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/1572-190-0x00007FF71C330000-0x00007FF71C681000-memory.dmp	xmrig
behavioral2/memory/1956-220-0x00007FF65FDC0000-0x00007FF660111000-memory.dmp	xmrig
behavioral2/memory/3796-249-0x00007FF7C6430000-0x00007FF7C6781000-memory.dmp	xmrig
behavioral2/memory/2300-298-0x00007FF6CAED0000-0x00007FF6CB221000-memory.dmp	xmrig
behavioral2/memory/4376-508-0x00007FF78CE50000-0x00007FF78D1A1000-memory.dmp	xmrig
behavioral2/memory/3368-505-0x00007FF65C970000-0x00007FF65CCC1000-memory.dmp	xmrig
behavioral2/memory/3144-564-0x00007FF69A8D0000-0x00007FF69AC21000-memory.dmp	xmrig
behavioral2/memory/848-2317-0x00007FF7709A0000-0x00007FF770CF1000-memory.dmp	xmrig
behavioral2/memory/2976-464-0x00007FF6E51E0000-0x00007FF6E5531000-memory.dmp	xmrig
behavioral2/memory/1052-467-0x00007FF6FBF30000-0x00007FF6FC281000-memory.dmp	xmrig
behavioral2/memory/3348-428-0x00007FF786B50000-0x00007FF786EA1000-memory.dmp	xmrig
behavioral2/memory/5028-374-0x00007FF69AF20000-0x00007FF69B271000-memory.dmp	xmrig
behavioral2/memory/3844-384-0x00007FF654050000-0x00007FF6543A1000-memory.dmp	xmrig
behavioral2/memory/5084-381-0x00007FF7CC430000-0x00007FF7CC781000-memory.dmp	xmrig
behavioral2/memory/852-350-0x00007FF6E9260000-0x00007FF6E95B1000-memory.dmp	xmrig
behavioral2/memory/3288-329-0x00007FF71CE90000-0x00007FF71D1E1000-memory.dmp	xmrig
behavioral2/memory/2376-325-0x00007FF697F30000-0x00007FF698281000-memory.dmp	xmrig
behavioral2/memory/4848-299-0x00007FF685B10000-0x00007FF685E61000-memory.dmp	xmrig
behavioral2/memory/2960-270-0x00007FF6E23E0000-0x00007FF6E2731000-memory.dmp	xmrig
behavioral2/memory/1008-2415-0x00007FF710320000-0x00007FF710671000-memory.dmp	xmrig
behavioral2/memory/1084-2416-0x00007FF651F80000-0x00007FF6522D1000-memory.dmp	xmrig
behavioral2/memory/4720-250-0x00007FF6C2080000-0x00007FF6C23D1000-memory.dmp	xmrig
behavioral2/memory/840-221-0x00007FF7C3190000-0x00007FF7C34E1000-memory.dmp	xmrig
behavioral2/memory/440-163-0x00007FF687DF0000-0x00007FF688141000-memory.dmp	xmrig
behavioral2/memory/32-160-0x00007FF6C2530000-0x00007FF6C2881000-memory.dmp	xmrig
behavioral2/memory/1412-2417-0x00007FF665CB0000-0x00007FF666001000-memory.dmp	xmrig
behavioral2/memory/1728-128-0x00007FF6AF330000-0x00007FF6AF681000-memory.dmp	xmrig
behavioral2/memory/4880-123-0x00007FF60B6B0000-0x00007FF60BA01000-memory.dmp	xmrig
behavioral2/memory/1284-81-0x00007FF779AE0000-0x00007FF779E31000-memory.dmp	xmrig
behavioral2/memory/1960-23-0x00007FF7407C0000-0x00007FF740B11000-memory.dmp	xmrig
behavioral2/memory/1960-2419-0x00007FF7407C0000-0x00007FF740B11000-memory.dmp	xmrig
behavioral2/memory/3348-2421-0x00007FF786B50000-0x00007FF786EA1000-memory.dmp	xmrig
behavioral2/memory/1412-2423-0x00007FF665CB0000-0x00007FF666001000-memory.dmp	xmrig
behavioral2/memory/1008-2425-0x00007FF710320000-0x00007FF710671000-memory.dmp	xmrig
behavioral2/memory/4880-2429-0x00007FF60B6B0000-0x00007FF60BA01000-memory.dmp	xmrig
behavioral2/memory/1284-2427-0x00007FF779AE0000-0x00007FF779E31000-memory.dmp	xmrig
behavioral2/memory/840-2431-0x00007FF7C3190000-0x00007FF7C34E1000-memory.dmp	xmrig
behavioral2/memory/4376-2473-0x00007FF78CE50000-0x00007FF78D1A1000-memory.dmp	xmrig
behavioral2/memory/1572-2475-0x00007FF71C330000-0x00007FF71C681000-memory.dmp	xmrig
behavioral2/memory/1956-2504-0x00007FF65FDC0000-0x00007FF660111000-memory.dmp	xmrig
behavioral2/memory/3144-2510-0x00007FF69A8D0000-0x00007FF69AC21000-memory.dmp	xmrig
behavioral2/memory/4848-2512-0x00007FF685B10000-0x00007FF685E61000-memory.dmp	xmrig
behavioral2/memory/2960-2508-0x00007FF6E23E0000-0x00007FF6E2731000-memory.dmp	xmrig
behavioral2/memory/2300-2506-0x00007FF6CAED0000-0x00007FF6CB221000-memory.dmp	xmrig
behavioral2/memory/5028-2502-0x00007FF69AF20000-0x00007FF69B271000-memory.dmp	xmrig
behavioral2/memory/4720-2498-0x00007FF6C2080000-0x00007FF6C23D1000-memory.dmp	xmrig
behavioral2/memory/440-2499-0x00007FF687DF0000-0x00007FF688141000-memory.dmp	xmrig
behavioral2/memory/3796-2489-0x00007FF7C6430000-0x00007FF7C6781000-memory.dmp	xmrig
behavioral2/memory/32-2453-0x00007FF6C2530000-0x00007FF6C2881000-memory.dmp	xmrig
behavioral2/memory/1728-2441-0x00007FF6AF330000-0x00007FF6AF681000-memory.dmp	xmrig
behavioral2/memory/2376-2532-0x00007FF697F30000-0x00007FF698281000-memory.dmp	xmrig
behavioral2/memory/5084-2528-0x00007FF7CC430000-0x00007FF7CC781000-memory.dmp	xmrig
behavioral2/memory/3844-2538-0x00007FF654050000-0x00007FF6543A1000-memory.dmp	xmrig
behavioral2/memory/852-2522-0x00007FF6E9260000-0x00007FF6E95B1000-memory.dmp	xmrig
behavioral2/memory/3288-2520-0x00007FF71CE90000-0x00007FF71D1E1000-memory.dmp	xmrig
behavioral2/memory/1052-2439-0x00007FF6FBF30000-0x00007FF6FC281000-memory.dmp	xmrig
behavioral2/memory/1084-2437-0x00007FF651F80000-0x00007FF6522D1000-memory.dmp	xmrig
behavioral2/memory/2976-2436-0x00007FF6E51E0000-0x00007FF6E5531000-memory.dmp	xmrig
behavioral2/memory/3368-2433-0x00007FF65C970000-0x00007FF65CCC1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1960	VDyHksW.exe
3348	GurFbQl.exe
1412	dlaCzAy.exe
1008	nGzHSHe.exe
1084	iJhqpuW.exe
2976	pSuXBLu.exe
1284	uVTSReN.exe
4880	KWwCACF.exe
1052	YmcaFBm.exe
1728	iIlxuuI.exe
32	VaLOcXu.exe
440	vByUeJE.exe
1572	peIMHlo.exe
1956	PETFhde.exe
840	mYrzDeH.exe
3368	vnamZSk.exe
4376	XIjiGIn.exe
3796	UvyNfvR.exe
4720	TRFUDId.exe
2960	vqvwgjY.exe
2300	ybuHIXi.exe
4848	OKXeHxA.exe
3144	gsvkfvk.exe
2376	qNUmrEA.exe
3288	yuNVcwL.exe
852	iTJXlOO.exe
5028	QosCWhh.exe
5084	TXAqqim.exe
3844	boqyzdA.exe
4180	wlPrlaB.exe
2720	VShLmwg.exe
3128	UBHknAA.exe
3860	ZhSfQTR.exe
3204	vAGINsf.exe
3496	AxkDopx.exe
3976	LISSNNZ.exe
5096	jjAvCzu.exe
452	yKWtMtT.exe
2176	xVupIdr.exe
1740	apCDSOK.exe
1676	AyelQqE.exe
1680	awQtqYY.exe
5072	hWqszsI.exe
4348	ZFeVTDA.exe
3776	FDfZvQs.exe
1260	ufuVuVR.exe
4708	lrOpmTr.exe
4324	ZWyiScZ.exe
4536	yupXhZQ.exe
5008	uUwcWHV.exe
3716	oEoTmwI.exe
2320	wMZSbMa.exe
4952	rDCYtyC.exe
1532	yEoESDW.exe
4436	nYrerFh.exe
2232	vKWfdEe.exe
4788	NYIuFOD.exe
4144	sQbIRvB.exe
4516	lqUqazU.exe
2460	vKPFGuU.exe
3516	lNxJTiq.exe
3396	wPLRldd.exe
2980	sXBsDvt.exe
1644	bZGlCze.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/848-0-0x00007FF7709A0000-0x00007FF770CF1000-memory.dmp	upx
behavioral2/files/0x00090000000233d5-4.dat	upx
behavioral2/files/0x000700000002340e-8.dat	upx
behavioral2/files/0x0007000000023414-52.dat	upx
behavioral2/files/0x0007000000023423-164.dat	upx
behavioral2/memory/1572-190-0x00007FF71C330000-0x00007FF71C681000-memory.dmp	upx
behavioral2/memory/1956-220-0x00007FF65FDC0000-0x00007FF660111000-memory.dmp	upx
behavioral2/memory/3796-249-0x00007FF7C6430000-0x00007FF7C6781000-memory.dmp	upx
behavioral2/memory/2300-298-0x00007FF6CAED0000-0x00007FF6CB221000-memory.dmp	upx
behavioral2/memory/4376-508-0x00007FF78CE50000-0x00007FF78D1A1000-memory.dmp	upx
behavioral2/memory/3368-505-0x00007FF65C970000-0x00007FF65CCC1000-memory.dmp	upx
behavioral2/memory/3144-564-0x00007FF69A8D0000-0x00007FF69AC21000-memory.dmp	upx
behavioral2/memory/848-2317-0x00007FF7709A0000-0x00007FF770CF1000-memory.dmp	upx
behavioral2/memory/2976-464-0x00007FF6E51E0000-0x00007FF6E5531000-memory.dmp	upx
behavioral2/memory/1052-467-0x00007FF6FBF30000-0x00007FF6FC281000-memory.dmp	upx
behavioral2/memory/3348-428-0x00007FF786B50000-0x00007FF786EA1000-memory.dmp	upx
behavioral2/memory/5028-374-0x00007FF69AF20000-0x00007FF69B271000-memory.dmp	upx
behavioral2/memory/3844-384-0x00007FF654050000-0x00007FF6543A1000-memory.dmp	upx
behavioral2/memory/5084-381-0x00007FF7CC430000-0x00007FF7CC781000-memory.dmp	upx
behavioral2/memory/852-350-0x00007FF6E9260000-0x00007FF6E95B1000-memory.dmp	upx
behavioral2/memory/3288-329-0x00007FF71CE90000-0x00007FF71D1E1000-memory.dmp	upx
behavioral2/memory/2376-325-0x00007FF697F30000-0x00007FF698281000-memory.dmp	upx
behavioral2/memory/4848-299-0x00007FF685B10000-0x00007FF685E61000-memory.dmp	upx
behavioral2/memory/2960-270-0x00007FF6E23E0000-0x00007FF6E2731000-memory.dmp	upx
behavioral2/memory/1008-2415-0x00007FF710320000-0x00007FF710671000-memory.dmp	upx
behavioral2/memory/1084-2416-0x00007FF651F80000-0x00007FF6522D1000-memory.dmp	upx
behavioral2/memory/4720-250-0x00007FF6C2080000-0x00007FF6C23D1000-memory.dmp	upx
behavioral2/memory/840-221-0x00007FF7C3190000-0x00007FF7C34E1000-memory.dmp	upx
behavioral2/files/0x000700000002341c-186.dat	upx
behavioral2/files/0x0007000000023433-185.dat	upx
behavioral2/files/0x0007000000023431-180.dat	upx
behavioral2/files/0x0007000000023430-172.dat	upx
behavioral2/files/0x000700000002342f-170.dat	upx
behavioral2/files/0x0007000000023427-169.dat	upx
behavioral2/files/0x000700000002342e-168.dat	upx
behavioral2/memory/440-163-0x00007FF687DF0000-0x00007FF688141000-memory.dmp	upx
behavioral2/memory/32-160-0x00007FF6C2530000-0x00007FF6C2881000-memory.dmp	upx
behavioral2/files/0x000700000002342c-157.dat	upx
behavioral2/files/0x000700000002342b-156.dat	upx
behavioral2/files/0x0007000000023422-153.dat	upx
behavioral2/files/0x000700000002342a-152.dat	upx
behavioral2/files/0x0007000000023429-151.dat	upx
behavioral2/files/0x0007000000023421-182.dat	upx
behavioral2/files/0x0007000000023432-181.dat	upx
behavioral2/files/0x0007000000023420-175.dat	upx
behavioral2/files/0x0007000000023419-146.dat	upx
behavioral2/files/0x000700000002341f-137.dat	upx
behavioral2/files/0x000700000002341e-135.dat	upx
behavioral2/memory/1412-2417-0x00007FF665CB0000-0x00007FF666001000-memory.dmp	upx
behavioral2/files/0x000700000002342d-165.dat	upx
behavioral2/files/0x0007000000023418-115.dat	upx
behavioral2/files/0x0007000000023428-147.dat	upx
behavioral2/files/0x0007000000023416-103.dat	upx
behavioral2/files/0x0007000000023426-134.dat	upx
behavioral2/files/0x0007000000023425-131.dat	upx
behavioral2/files/0x0007000000023424-130.dat	upx
behavioral2/memory/1728-128-0x00007FF6AF330000-0x00007FF6AF681000-memory.dmp	upx
behavioral2/memory/4880-123-0x00007FF60B6B0000-0x00007FF60BA01000-memory.dmp	upx
behavioral2/files/0x000700000002341b-84.dat	upx
behavioral2/memory/1284-81-0x00007FF779AE0000-0x00007FF779E31000-memory.dmp	upx
behavioral2/memory/1084-77-0x00007FF651F80000-0x00007FF6522D1000-memory.dmp	upx
behavioral2/files/0x000700000002341a-75.dat	upx
behavioral2/files/0x0007000000023417-110.dat	upx
behavioral2/files/0x000700000002341d-106.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xXuTSoY.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\DuhqCUy.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\pOvyZsS.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\IzBjPgY.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\KhjOjKT.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\UsNxVrb.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\pGBrFdp.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\yRdYvEO.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\XIjiGIn.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\FhfAHei.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\wUNqjRd.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\ycjtqIr.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\RlHwZSu.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\EFhTIeV.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\aznDRNV.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\skEqdcO.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\NrANEum.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\jbSSsok.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\aEzmoAt.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\uyVgGby.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\meGDVnz.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\dCHMmdy.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\WgaCqRd.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\yyXLmCK.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\ywtnHrA.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\wYxanUm.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\BDJQQEs.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\bPUvHLh.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\dktpNXA.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\fKdMYFD.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\BhFjmRP.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\qtJAVay.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\OPnGEOP.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\qhOIQJz.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\rDCYtyC.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\wUUlLLI.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\kfbjbqs.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\qNUmrEA.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\XKbJzeG.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\ufuVuVR.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\GmyWrnS.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\UeDsMFr.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\YpxpkEi.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\ZCoJDgx.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\AvMhwjn.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\ioaJggQ.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\nBcuxXN.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\XmUwAHy.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\yvLPDcg.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\JFOeHns.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\VhtsocM.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\fIGlJaU.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\GDOReYA.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\eITyrza.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\VXkvlmI.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\BTaIVjA.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\fpIhVFV.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\NruiExH.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\hySjtdW.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\BwPEfYV.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\WrOmkal.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\VNXhaEU.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\nLSTUlU.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
File created	C:\Windows\System\XGKsntA.exe	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1960	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	83
PID 848 wrote to memory of 1960	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	83
PID 848 wrote to memory of 3348	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	84
PID 848 wrote to memory of 3348	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	84
PID 848 wrote to memory of 1412	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	85
PID 848 wrote to memory of 1412	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	85
PID 848 wrote to memory of 1008	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	86
PID 848 wrote to memory of 1008	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	86
PID 848 wrote to memory of 1284	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	87
PID 848 wrote to memory of 1284	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	87
PID 848 wrote to memory of 1084	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	88
PID 848 wrote to memory of 1084	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	88
PID 848 wrote to memory of 2976	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	89
PID 848 wrote to memory of 2976	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	89
PID 848 wrote to memory of 4880	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	90
PID 848 wrote to memory of 4880	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	90
PID 848 wrote to memory of 1052	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	91
PID 848 wrote to memory of 1052	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	91
PID 848 wrote to memory of 1728	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	92
PID 848 wrote to memory of 1728	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	92
PID 848 wrote to memory of 32	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	93
PID 848 wrote to memory of 32	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	93
PID 848 wrote to memory of 440	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	94
PID 848 wrote to memory of 440	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	94
PID 848 wrote to memory of 1572	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	95
PID 848 wrote to memory of 1572	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	95
PID 848 wrote to memory of 1956	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	96
PID 848 wrote to memory of 1956	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	96
PID 848 wrote to memory of 840	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	97
PID 848 wrote to memory of 840	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	97
PID 848 wrote to memory of 3368	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	98
PID 848 wrote to memory of 3368	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	98
PID 848 wrote to memory of 3144	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	99
PID 848 wrote to memory of 3144	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	99
PID 848 wrote to memory of 4376	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	100
PID 848 wrote to memory of 4376	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	100
PID 848 wrote to memory of 3796	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	101
PID 848 wrote to memory of 3796	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	101
PID 848 wrote to memory of 4720	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	102
PID 848 wrote to memory of 4720	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	102
PID 848 wrote to memory of 2960	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	103
PID 848 wrote to memory of 2960	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	103
PID 848 wrote to memory of 2300	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	104
PID 848 wrote to memory of 2300	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	104
PID 848 wrote to memory of 4848	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	105
PID 848 wrote to memory of 4848	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	105
PID 848 wrote to memory of 3860	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	106
PID 848 wrote to memory of 3860	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	106
PID 848 wrote to memory of 2376	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	107
PID 848 wrote to memory of 2376	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	107
PID 848 wrote to memory of 3288	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	108
PID 848 wrote to memory of 3288	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	108
PID 848 wrote to memory of 852	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	109
PID 848 wrote to memory of 852	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	109
PID 848 wrote to memory of 5028	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	110
PID 848 wrote to memory of 5028	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	110
PID 848 wrote to memory of 5084	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	111
PID 848 wrote to memory of 5084	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	111
PID 848 wrote to memory of 3844	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	112
PID 848 wrote to memory of 3844	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	112
PID 848 wrote to memory of 4180	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	113
PID 848 wrote to memory of 4180	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	113
PID 848 wrote to memory of 2720	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	114
PID 848 wrote to memory of 2720	848	d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d13a9bee13b088c7675e7c1814ce0e40_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\System\VDyHksW.exe
  C:\Windows\System\VDyHksW.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\GurFbQl.exe
  C:\Windows\System\GurFbQl.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\dlaCzAy.exe
  C:\Windows\System\dlaCzAy.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\nGzHSHe.exe
  C:\Windows\System\nGzHSHe.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\uVTSReN.exe
  C:\Windows\System\uVTSReN.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\iJhqpuW.exe
  C:\Windows\System\iJhqpuW.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\pSuXBLu.exe
  C:\Windows\System\pSuXBLu.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\KWwCACF.exe
  C:\Windows\System\KWwCACF.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\YmcaFBm.exe
  C:\Windows\System\YmcaFBm.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\iIlxuuI.exe
  C:\Windows\System\iIlxuuI.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\VaLOcXu.exe
  C:\Windows\System\VaLOcXu.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\vByUeJE.exe
  C:\Windows\System\vByUeJE.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\peIMHlo.exe
  C:\Windows\System\peIMHlo.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\PETFhde.exe
  C:\Windows\System\PETFhde.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\mYrzDeH.exe
  C:\Windows\System\mYrzDeH.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\vnamZSk.exe
  C:\Windows\System\vnamZSk.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\gsvkfvk.exe
  C:\Windows\System\gsvkfvk.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\XIjiGIn.exe
  C:\Windows\System\XIjiGIn.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\UvyNfvR.exe
  C:\Windows\System\UvyNfvR.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\TRFUDId.exe
  C:\Windows\System\TRFUDId.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\vqvwgjY.exe
  C:\Windows\System\vqvwgjY.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\ybuHIXi.exe
  C:\Windows\System\ybuHIXi.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\OKXeHxA.exe
  C:\Windows\System\OKXeHxA.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\ZhSfQTR.exe
  C:\Windows\System\ZhSfQTR.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\qNUmrEA.exe
  C:\Windows\System\qNUmrEA.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\yuNVcwL.exe
  C:\Windows\System\yuNVcwL.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\iTJXlOO.exe
  C:\Windows\System\iTJXlOO.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\QosCWhh.exe
  C:\Windows\System\QosCWhh.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\TXAqqim.exe
  C:\Windows\System\TXAqqim.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\boqyzdA.exe
  C:\Windows\System\boqyzdA.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\wlPrlaB.exe
  C:\Windows\System\wlPrlaB.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\VShLmwg.exe
  C:\Windows\System\VShLmwg.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\UBHknAA.exe
  C:\Windows\System\UBHknAA.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\vAGINsf.exe
  C:\Windows\System\vAGINsf.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\AxkDopx.exe
  C:\Windows\System\AxkDopx.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\LISSNNZ.exe
  C:\Windows\System\LISSNNZ.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\jjAvCzu.exe
  C:\Windows\System\jjAvCzu.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\yKWtMtT.exe
  C:\Windows\System\yKWtMtT.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\xVupIdr.exe
  C:\Windows\System\xVupIdr.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\apCDSOK.exe
  C:\Windows\System\apCDSOK.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\AyelQqE.exe
  C:\Windows\System\AyelQqE.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\awQtqYY.exe
  C:\Windows\System\awQtqYY.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\hWqszsI.exe
  C:\Windows\System\hWqszsI.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\ZFeVTDA.exe
  C:\Windows\System\ZFeVTDA.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\FDfZvQs.exe
  C:\Windows\System\FDfZvQs.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\ufuVuVR.exe
  C:\Windows\System\ufuVuVR.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\lrOpmTr.exe
  C:\Windows\System\lrOpmTr.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\ZWyiScZ.exe
  C:\Windows\System\ZWyiScZ.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\sQbIRvB.exe
  C:\Windows\System\sQbIRvB.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\yupXhZQ.exe
  C:\Windows\System\yupXhZQ.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\uUwcWHV.exe
  C:\Windows\System\uUwcWHV.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\oEoTmwI.exe
  C:\Windows\System\oEoTmwI.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\wMZSbMa.exe
  C:\Windows\System\wMZSbMa.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\rDCYtyC.exe
  C:\Windows\System\rDCYtyC.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\yEoESDW.exe
  C:\Windows\System\yEoESDW.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\nYrerFh.exe
  C:\Windows\System\nYrerFh.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\vKWfdEe.exe
  C:\Windows\System\vKWfdEe.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\NYIuFOD.exe
  C:\Windows\System\NYIuFOD.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\lqUqazU.exe
  C:\Windows\System\lqUqazU.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\vKPFGuU.exe
  C:\Windows\System\vKPFGuU.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\lNxJTiq.exe
  C:\Windows\System\lNxJTiq.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\wPLRldd.exe
  C:\Windows\System\wPLRldd.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\sXBsDvt.exe
  C:\Windows\System\sXBsDvt.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\bZGlCze.exe
  C:\Windows\System\bZGlCze.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\VBjYdOh.exe
  C:\Windows\System\VBjYdOh.exe
  2⤵
  PID:924
- C:\Windows\System\JnvoHkc.exe
  C:\Windows\System\JnvoHkc.exe
  2⤵
  PID:384
- C:\Windows\System\UfFUcKF.exe
  C:\Windows\System\UfFUcKF.exe
  2⤵
  PID:4624
- C:\Windows\System\sKUtDGc.exe
  C:\Windows\System\sKUtDGc.exe
  2⤵
  PID:3908
- C:\Windows\System\NrANEum.exe
  C:\Windows\System\NrANEum.exe
  2⤵
  PID:392
- C:\Windows\System\peunJpf.exe
  C:\Windows\System\peunJpf.exe
  2⤵
  PID:3888
- C:\Windows\System\Xtsajsq.exe
  C:\Windows\System\Xtsajsq.exe
  2⤵
  PID:3020
- C:\Windows\System\dfOzkdJ.exe
  C:\Windows\System\dfOzkdJ.exe
  2⤵
  PID:3236
- C:\Windows\System\uKjsnan.exe
  C:\Windows\System\uKjsnan.exe
  2⤵
  PID:984
- C:\Windows\System\lVcUVGO.exe
  C:\Windows\System\lVcUVGO.exe
  2⤵
  PID:2016
- C:\Windows\System\yObiIdG.exe
  C:\Windows\System\yObiIdG.exe
  2⤵
  PID:5012
- C:\Windows\System\sHnFhSi.exe
  C:\Windows\System\sHnFhSi.exe
  2⤵
  PID:4636
- C:\Windows\System\SuMgdPZ.exe
  C:\Windows\System\SuMgdPZ.exe
  2⤵
  PID:4644
- C:\Windows\System\zGZwtmh.exe
  C:\Windows\System\zGZwtmh.exe
  2⤵
  PID:3900
- C:\Windows\System\EfdQGMB.exe
  C:\Windows\System\EfdQGMB.exe
  2⤵
  PID:4116
- C:\Windows\System\iZehPfv.exe
  C:\Windows\System\iZehPfv.exe
  2⤵
  PID:3648
- C:\Windows\System\HtzqrTP.exe
  C:\Windows\System\HtzqrTP.exe
  2⤵
  PID:2024
- C:\Windows\System\SosYxki.exe
  C:\Windows\System\SosYxki.exe
  2⤵
  PID:4888
- C:\Windows\System\IdYHGYX.exe
  C:\Windows\System\IdYHGYX.exe
  2⤵
  PID:456
- C:\Windows\System\NrwXOrt.exe
  C:\Windows\System\NrwXOrt.exe
  2⤵
  PID:5128
- C:\Windows\System\kJzYqeZ.exe
  C:\Windows\System\kJzYqeZ.exe
  2⤵
  PID:5156
- C:\Windows\System\AVPHLgX.exe
  C:\Windows\System\AVPHLgX.exe
  2⤵
  PID:5184
- C:\Windows\System\MWizJJB.exe
  C:\Windows\System\MWizJJB.exe
  2⤵
  PID:5204
- C:\Windows\System\gtIfMXS.exe
  C:\Windows\System\gtIfMXS.exe
  2⤵
  PID:5236
- C:\Windows\System\YpxpkEi.exe
  C:\Windows\System\YpxpkEi.exe
  2⤵
  PID:5252
- C:\Windows\System\JXybECe.exe
  C:\Windows\System\JXybECe.exe
  2⤵
  PID:5272
- C:\Windows\System\gTLobyn.exe
  C:\Windows\System\gTLobyn.exe
  2⤵
  PID:5324
- C:\Windows\System\MndwZCI.exe
  C:\Windows\System\MndwZCI.exe
  2⤵
  PID:5340
- C:\Windows\System\PVgJIBE.exe
  C:\Windows\System\PVgJIBE.exe
  2⤵
  PID:5368
- C:\Windows\System\bHeurOE.exe
  C:\Windows\System\bHeurOE.exe
  2⤵
  PID:5400
- C:\Windows\System\FkOIPGb.exe
  C:\Windows\System\FkOIPGb.exe
  2⤵
  PID:5416
- C:\Windows\System\SVpXbBm.exe
  C:\Windows\System\SVpXbBm.exe
  2⤵
  PID:5432
- C:\Windows\System\LxWEtFJ.exe
  C:\Windows\System\LxWEtFJ.exe
  2⤵
  PID:5448
- C:\Windows\System\mdRfPwF.exe
  C:\Windows\System\mdRfPwF.exe
  2⤵
  PID:5468
- C:\Windows\System\zzGAeEE.exe
  C:\Windows\System\zzGAeEE.exe
  2⤵
  PID:5496
- C:\Windows\System\bLlefPi.exe
  C:\Windows\System\bLlefPi.exe
  2⤵
  PID:5520
- C:\Windows\System\ZeWLcQp.exe
  C:\Windows\System\ZeWLcQp.exe
  2⤵
  PID:5540
- C:\Windows\System\JplQgLi.exe
  C:\Windows\System\JplQgLi.exe
  2⤵
  PID:5556
- C:\Windows\System\wUUlLLI.exe
  C:\Windows\System\wUUlLLI.exe
  2⤵
  PID:5580
- C:\Windows\System\FhfAHei.exe
  C:\Windows\System\FhfAHei.exe
  2⤵
  PID:5672
- C:\Windows\System\jCFPAAC.exe
  C:\Windows\System\jCFPAAC.exe
  2⤵
  PID:5688
- C:\Windows\System\cFEZoWw.exe
  C:\Windows\System\cFEZoWw.exe
  2⤵
  PID:5716
- C:\Windows\System\okjGfpG.exe
  C:\Windows\System\okjGfpG.exe
  2⤵
  PID:5736
- C:\Windows\System\nOPnwFT.exe
  C:\Windows\System\nOPnwFT.exe
  2⤵
  PID:5760
- C:\Windows\System\VOaNyqR.exe
  C:\Windows\System\VOaNyqR.exe
  2⤵
  PID:5776
- C:\Windows\System\XJpovzN.exe
  C:\Windows\System\XJpovzN.exe
  2⤵
  PID:5824
- C:\Windows\System\GDOReYA.exe
  C:\Windows\System\GDOReYA.exe
  2⤵
  PID:5848
- C:\Windows\System\iVjCTvd.exe
  C:\Windows\System\iVjCTvd.exe
  2⤵
  PID:5868
- C:\Windows\System\JgJVduq.exe
  C:\Windows\System\JgJVduq.exe
  2⤵
  PID:5888
- C:\Windows\System\JykViin.exe
  C:\Windows\System\JykViin.exe
  2⤵
  PID:5920
- C:\Windows\System\jOtOaIb.exe
  C:\Windows\System\jOtOaIb.exe
  2⤵
  PID:5944
- C:\Windows\System\lgMhBeH.exe
  C:\Windows\System\lgMhBeH.exe
  2⤵
  PID:5968
- C:\Windows\System\sxKUgtV.exe
  C:\Windows\System\sxKUgtV.exe
  2⤵
  PID:6024
- C:\Windows\System\NXtMFOB.exe
  C:\Windows\System\NXtMFOB.exe
  2⤵
  PID:6056
- C:\Windows\System\sgvtylB.exe
  C:\Windows\System\sgvtylB.exe
  2⤵
  PID:6072
- C:\Windows\System\GnBScxi.exe
  C:\Windows\System\GnBScxi.exe
  2⤵
  PID:6088
- C:\Windows\System\tbSKhJx.exe
  C:\Windows\System\tbSKhJx.exe
  2⤵
  PID:6108
- C:\Windows\System\vGORUel.exe
  C:\Windows\System\vGORUel.exe
  2⤵
  PID:6128
- C:\Windows\System\dzqYzNT.exe
  C:\Windows\System\dzqYzNT.exe
  2⤵
  PID:2464
- C:\Windows\System\NsIMcUc.exe
  C:\Windows\System\NsIMcUc.exe
  2⤵
  PID:3052
- C:\Windows\System\VWBkCRg.exe
  C:\Windows\System\VWBkCRg.exe
  2⤵
  PID:4940
- C:\Windows\System\GmyWrnS.exe
  C:\Windows\System\GmyWrnS.exe
  2⤵
  PID:1692
- C:\Windows\System\UAJkyXF.exe
  C:\Windows\System\UAJkyXF.exe
  2⤵
  PID:1228
- C:\Windows\System\yyXLmCK.exe
  C:\Windows\System\yyXLmCK.exe
  2⤵
  PID:4844
- C:\Windows\System\TfonXxc.exe
  C:\Windows\System\TfonXxc.exe
  2⤵
  PID:2328
- C:\Windows\System\lzZThsS.exe
  C:\Windows\System\lzZThsS.exe
  2⤵
  PID:5260
- C:\Windows\System\sgKpjpo.exe
  C:\Windows\System\sgKpjpo.exe
  2⤵
  PID:2424
- C:\Windows\System\AiwPKSL.exe
  C:\Windows\System\AiwPKSL.exe
  2⤵
  PID:556
- C:\Windows\System\xDeSmhW.exe
  C:\Windows\System\xDeSmhW.exe
  2⤵
  PID:1600
- C:\Windows\System\foDIWyN.exe
  C:\Windows\System\foDIWyN.exe
  2⤵
  PID:3540
- C:\Windows\System\jsCOVng.exe
  C:\Windows\System\jsCOVng.exe
  2⤵
  PID:636
- C:\Windows\System\JWlcTYp.exe
  C:\Windows\System\JWlcTYp.exe
  2⤵
  PID:5212
- C:\Windows\System\uRLbgoe.exe
  C:\Windows\System\uRLbgoe.exe
  2⤵
  PID:5696
- C:\Windows\System\eUVZGWX.exe
  C:\Windows\System\eUVZGWX.exe
  2⤵
  PID:5744
- C:\Windows\System\kZlSgft.exe
  C:\Windows\System\kZlSgft.exe
  2⤵
  PID:5332
- C:\Windows\System\rIsHpJi.exe
  C:\Windows\System\rIsHpJi.exe
  2⤵
  PID:5396
- C:\Windows\System\TXqYuFl.exe
  C:\Windows\System\TXqYuFl.exe
  2⤵
  PID:5460
- C:\Windows\System\GwoVxFt.exe
  C:\Windows\System\GwoVxFt.exe
  2⤵
  PID:5512
- C:\Windows\System\AJvGyUQ.exe
  C:\Windows\System\AJvGyUQ.exe
  2⤵
  PID:6140
- C:\Windows\System\qsguzZh.exe
  C:\Windows\System\qsguzZh.exe
  2⤵
  PID:4388
- C:\Windows\System\zUIFsRr.exe
  C:\Windows\System\zUIFsRr.exe
  2⤵
  PID:5680
- C:\Windows\System\hLaNfxR.exe
  C:\Windows\System\hLaNfxR.exe
  2⤵
  PID:5768
- C:\Windows\System\ZKrRnmN.exe
  C:\Windows\System\ZKrRnmN.exe
  2⤵
  PID:6148
- C:\Windows\System\VqGYRkn.exe
  C:\Windows\System\VqGYRkn.exe
  2⤵
  PID:6168
- C:\Windows\System\evpridW.exe
  C:\Windows\System\evpridW.exe
  2⤵
  PID:6192
- C:\Windows\System\ZCoJDgx.exe
  C:\Windows\System\ZCoJDgx.exe
  2⤵
  PID:6212
- C:\Windows\System\kGAUXzx.exe
  C:\Windows\System\kGAUXzx.exe
  2⤵
  PID:6240
- C:\Windows\System\vvwHTkS.exe
  C:\Windows\System\vvwHTkS.exe
  2⤵
  PID:6260
- C:\Windows\System\YOVtGmW.exe
  C:\Windows\System\YOVtGmW.exe
  2⤵
  PID:6280
- C:\Windows\System\GpQcZwu.exe
  C:\Windows\System\GpQcZwu.exe
  2⤵
  PID:6296
- C:\Windows\System\eaKnfWJ.exe
  C:\Windows\System\eaKnfWJ.exe
  2⤵
  PID:6320
- C:\Windows\System\POTvGVd.exe
  C:\Windows\System\POTvGVd.exe
  2⤵
  PID:6340
- C:\Windows\System\PaCXIcV.exe
  C:\Windows\System\PaCXIcV.exe
  2⤵
  PID:6368
- C:\Windows\System\BPBMDpS.exe
  C:\Windows\System\BPBMDpS.exe
  2⤵
  PID:6392
- C:\Windows\System\IywCnQr.exe
  C:\Windows\System\IywCnQr.exe
  2⤵
  PID:6412
- C:\Windows\System\kfbjbqs.exe
  C:\Windows\System\kfbjbqs.exe
  2⤵
  PID:6428
- C:\Windows\System\FFYebXj.exe
  C:\Windows\System\FFYebXj.exe
  2⤵
  PID:6484
- C:\Windows\System\eABszDz.exe
  C:\Windows\System\eABszDz.exe
  2⤵
  PID:6508
- C:\Windows\System\kymhaSf.exe
  C:\Windows\System\kymhaSf.exe
  2⤵
  PID:6532
- C:\Windows\System\GRbzKHA.exe
  C:\Windows\System\GRbzKHA.exe
  2⤵
  PID:6556
- C:\Windows\System\XPdSthL.exe
  C:\Windows\System\XPdSthL.exe
  2⤵
  PID:6580
- C:\Windows\System\eFssxfL.exe
  C:\Windows\System\eFssxfL.exe
  2⤵
  PID:6596
- C:\Windows\System\mnlVrPH.exe
  C:\Windows\System\mnlVrPH.exe
  2⤵
  PID:6620
- C:\Windows\System\anRwHBF.exe
  C:\Windows\System\anRwHBF.exe
  2⤵
  PID:6652
- C:\Windows\System\klQzEze.exe
  C:\Windows\System\klQzEze.exe
  2⤵
  PID:6668
- C:\Windows\System\uRCgsQb.exe
  C:\Windows\System\uRCgsQb.exe
  2⤵
  PID:6692
- C:\Windows\System\ccVPGZz.exe
  C:\Windows\System\ccVPGZz.exe
  2⤵
  PID:6720
- C:\Windows\System\kgrZvOz.exe
  C:\Windows\System\kgrZvOz.exe
  2⤵
  PID:6736
- C:\Windows\System\SfWYpUJ.exe
  C:\Windows\System\SfWYpUJ.exe
  2⤵
  PID:6776
- C:\Windows\System\wIvhyLl.exe
  C:\Windows\System\wIvhyLl.exe
  2⤵
  PID:6792
- C:\Windows\System\GkCZTLu.exe
  C:\Windows\System\GkCZTLu.exe
  2⤵
  PID:6808
- C:\Windows\System\ZmOpDjF.exe
  C:\Windows\System\ZmOpDjF.exe
  2⤵
  PID:6828
- C:\Windows\System\VQTqOgx.exe
  C:\Windows\System\VQTqOgx.exe
  2⤵
  PID:6852
- C:\Windows\System\QzFJtXi.exe
  C:\Windows\System\QzFJtXi.exe
  2⤵
  PID:6872
- C:\Windows\System\MCLIQOg.exe
  C:\Windows\System\MCLIQOg.exe
  2⤵
  PID:6900
- C:\Windows\System\tYdwleP.exe
  C:\Windows\System\tYdwleP.exe
  2⤵
  PID:6916
- C:\Windows\System\AvMhwjn.exe
  C:\Windows\System\AvMhwjn.exe
  2⤵
  PID:6936
- C:\Windows\System\NnDEJNz.exe
  C:\Windows\System\NnDEJNz.exe
  2⤵
  PID:6960
- C:\Windows\System\eshfqUJ.exe
  C:\Windows\System\eshfqUJ.exe
  2⤵
  PID:6988
- C:\Windows\System\SAnOkuK.exe
  C:\Windows\System\SAnOkuK.exe
  2⤵
  PID:7004
- C:\Windows\System\PEqflYq.exe
  C:\Windows\System\PEqflYq.exe
  2⤵
  PID:7024
- C:\Windows\System\qtJAVay.exe
  C:\Windows\System\qtJAVay.exe
  2⤵
  PID:7044
- C:\Windows\System\dfKteAf.exe
  C:\Windows\System\dfKteAf.exe
  2⤵
  PID:7060
- C:\Windows\System\xTGLaIe.exe
  C:\Windows\System\xTGLaIe.exe
  2⤵
  PID:7152
- C:\Windows\System\hFySUQp.exe
  C:\Windows\System\hFySUQp.exe
  2⤵
  PID:5840
- C:\Windows\System\aKhQZrY.exe
  C:\Windows\System\aKhQZrY.exe
  2⤵
  PID:5424
- C:\Windows\System\eIBteoU.exe
  C:\Windows\System\eIBteoU.exe
  2⤵
  PID:5152
- C:\Windows\System\TIxYtNG.exe
  C:\Windows\System\TIxYtNG.exe
  2⤵
  PID:6020
- C:\Windows\System\olMXlna.exe
  C:\Windows\System\olMXlna.exe
  2⤵
  PID:6064
- C:\Windows\System\yxcYPTQ.exe
  C:\Windows\System\yxcYPTQ.exe
  2⤵
  PID:6096
- C:\Windows\System\FOVOBUW.exe
  C:\Windows\System\FOVOBUW.exe
  2⤵
  PID:6120
- C:\Windows\System\ODQDUZY.exe
  C:\Windows\System\ODQDUZY.exe
  2⤵
  PID:5728
- C:\Windows\System\yZmjGcH.exe
  C:\Windows\System\yZmjGcH.exe
  2⤵
  PID:5000
- C:\Windows\System\IhjPjtR.exe
  C:\Windows\System\IhjPjtR.exe
  2⤵
  PID:4616
- C:\Windows\System\yvLPDcg.exe
  C:\Windows\System\yvLPDcg.exe
  2⤵
  PID:6204
- C:\Windows\System\CUWUwco.exe
  C:\Windows\System\CUWUwco.exe
  2⤵
  PID:6228
- C:\Windows\System\BdRffFa.exe
  C:\Windows\System\BdRffFa.exe
  2⤵
  PID:3168
- C:\Windows\System\mBvauic.exe
  C:\Windows\System\mBvauic.exe
  2⤵
  PID:2028
- C:\Windows\System\uGQtOaA.exe
  C:\Windows\System\uGQtOaA.exe
  2⤵
  PID:1636
- C:\Windows\System\BKsGODj.exe
  C:\Windows\System\BKsGODj.exe
  2⤵
  PID:6184
- C:\Windows\System\QXeuSTh.exe
  C:\Windows\System\QXeuSTh.exe
  2⤵
  PID:6304
- C:\Windows\System\sfqaaXD.exe
  C:\Windows\System\sfqaaXD.exe
  2⤵
  PID:6352
- C:\Windows\System\wUNqjRd.exe
  C:\Windows\System\wUNqjRd.exe
  2⤵
  PID:6408
- C:\Windows\System\uWoTvmG.exe
  C:\Windows\System\uWoTvmG.exe
  2⤵
  PID:6500
- C:\Windows\System\jGgRVSp.exe
  C:\Windows\System\jGgRVSp.exe
  2⤵
  PID:6544
- C:\Windows\System\QXOdAiY.exe
  C:\Windows\System\QXOdAiY.exe
  2⤵
  PID:6588
- C:\Windows\System\DuhqCUy.exe
  C:\Windows\System\DuhqCUy.exe
  2⤵
  PID:6636
- C:\Windows\System\skEqdcO.exe
  C:\Windows\System\skEqdcO.exe
  2⤵
  PID:6688
- C:\Windows\System\FikitJK.exe
  C:\Windows\System\FikitJK.exe
  2⤵
  PID:6748
- C:\Windows\System\oEIonGG.exe
  C:\Windows\System\oEIonGG.exe
  2⤵
  PID:6980
- C:\Windows\System\TuKPVci.exe
  C:\Windows\System\TuKPVci.exe
  2⤵
  PID:6800
- C:\Windows\System\XTquUMe.exe
  C:\Windows\System\XTquUMe.exe
  2⤵
  PID:6868
- C:\Windows\System\ufBPhmY.exe
  C:\Windows\System\ufBPhmY.exe
  2⤵
  PID:6924
- C:\Windows\System\LyAdWKU.exe
  C:\Windows\System\LyAdWKU.exe
  2⤵
  PID:7016
- C:\Windows\System\QqOqSvq.exe
  C:\Windows\System\QqOqSvq.exe
  2⤵
  PID:7040
- C:\Windows\System\pYsbyOz.exe
  C:\Windows\System\pYsbyOz.exe
  2⤵
  PID:7164
- C:\Windows\System\wcOIzHe.exe
  C:\Windows\System\wcOIzHe.exe
  2⤵
  PID:7180
- C:\Windows\System\XesnMVt.exe
  C:\Windows\System\XesnMVt.exe
  2⤵
  PID:7208
- C:\Windows\System\ydFafZw.exe
  C:\Windows\System\ydFafZw.exe
  2⤵
  PID:7228
- C:\Windows\System\rKWBlTi.exe
  C:\Windows\System\rKWBlTi.exe
  2⤵
  PID:7248
- C:\Windows\System\VlKEVgk.exe
  C:\Windows\System\VlKEVgk.exe
  2⤵
  PID:7264
- C:\Windows\System\rBnxZXB.exe
  C:\Windows\System\rBnxZXB.exe
  2⤵
  PID:7284
- C:\Windows\System\NoTYGZN.exe
  C:\Windows\System\NoTYGZN.exe
  2⤵
  PID:7304
- C:\Windows\System\AUNBtxD.exe
  C:\Windows\System\AUNBtxD.exe
  2⤵
  PID:7320
- C:\Windows\System\uLKkBmB.exe
  C:\Windows\System\uLKkBmB.exe
  2⤵
  PID:7336
- C:\Windows\System\WZClLJm.exe
  C:\Windows\System\WZClLJm.exe
  2⤵
  PID:7356
- C:\Windows\System\bambstw.exe
  C:\Windows\System\bambstw.exe
  2⤵
  PID:7372
- C:\Windows\System\LcxcKlM.exe
  C:\Windows\System\LcxcKlM.exe
  2⤵
  PID:7388
- C:\Windows\System\gFbLFRL.exe
  C:\Windows\System\gFbLFRL.exe
  2⤵
  PID:7408
- C:\Windows\System\BgdWvWi.exe
  C:\Windows\System\BgdWvWi.exe
  2⤵
  PID:7428
- C:\Windows\System\tKJbfCI.exe
  C:\Windows\System\tKJbfCI.exe
  2⤵
  PID:7448
- C:\Windows\System\neDsOUp.exe
  C:\Windows\System\neDsOUp.exe
  2⤵
  PID:7464
- C:\Windows\System\UxgOJGt.exe
  C:\Windows\System\UxgOJGt.exe
  2⤵
  PID:7484
- C:\Windows\System\PGpwxhU.exe
  C:\Windows\System\PGpwxhU.exe
  2⤵
  PID:7504
- C:\Windows\System\dpprAQd.exe
  C:\Windows\System\dpprAQd.exe
  2⤵
  PID:7524
- C:\Windows\System\nNKQeSV.exe
  C:\Windows\System\nNKQeSV.exe
  2⤵
  PID:7552
- C:\Windows\System\oQxVsre.exe
  C:\Windows\System\oQxVsre.exe
  2⤵
  PID:7568
- C:\Windows\System\MfcBIAY.exe
  C:\Windows\System\MfcBIAY.exe
  2⤵
  PID:7588
- C:\Windows\System\OMDQBkV.exe
  C:\Windows\System\OMDQBkV.exe
  2⤵
  PID:7604
- C:\Windows\System\fpIhVFV.exe
  C:\Windows\System\fpIhVFV.exe
  2⤵
  PID:7620
- C:\Windows\System\WkApSUt.exe
  C:\Windows\System\WkApSUt.exe
  2⤵
  PID:7836
- C:\Windows\System\zKpJeOm.exe
  C:\Windows\System\zKpJeOm.exe
  2⤵
  PID:7852
- C:\Windows\System\SUnyzCT.exe
  C:\Windows\System\SUnyzCT.exe
  2⤵
  PID:7868
- C:\Windows\System\CfoYuTq.exe
  C:\Windows\System\CfoYuTq.exe
  2⤵
  PID:7884
- C:\Windows\System\KBuBOdV.exe
  C:\Windows\System\KBuBOdV.exe
  2⤵
  PID:7900
- C:\Windows\System\ZrBmZqi.exe
  C:\Windows\System\ZrBmZqi.exe
  2⤵
  PID:7920
- C:\Windows\System\eEzBkWd.exe
  C:\Windows\System\eEzBkWd.exe
  2⤵
  PID:7936
- C:\Windows\System\AWesOSN.exe
  C:\Windows\System\AWesOSN.exe
  2⤵
  PID:7956
- C:\Windows\System\GuYqkEK.exe
  C:\Windows\System\GuYqkEK.exe
  2⤵
  PID:7976
- C:\Windows\System\QlkYMlI.exe
  C:\Windows\System\QlkYMlI.exe
  2⤵
  PID:7992
- C:\Windows\System\vtNzGHY.exe
  C:\Windows\System\vtNzGHY.exe
  2⤵
  PID:8016
- C:\Windows\System\cdtsaAV.exe
  C:\Windows\System\cdtsaAV.exe
  2⤵
  PID:8032
- C:\Windows\System\DkEpwXB.exe
  C:\Windows\System\DkEpwXB.exe
  2⤵
  PID:8052
- C:\Windows\System\fSthyTh.exe
  C:\Windows\System\fSthyTh.exe
  2⤵
  PID:8072
- C:\Windows\System\GvdBBLg.exe
  C:\Windows\System\GvdBBLg.exe
  2⤵
  PID:8096
- C:\Windows\System\nkwvsSa.exe
  C:\Windows\System\nkwvsSa.exe
  2⤵
  PID:8112
- C:\Windows\System\EtczxIT.exe
  C:\Windows\System\EtczxIT.exe
  2⤵
  PID:8136
- C:\Windows\System\PTPjhLW.exe
  C:\Windows\System\PTPjhLW.exe
  2⤵
  PID:5860
- C:\Windows\System\kXPWODx.exe
  C:\Windows\System\kXPWODx.exe
  2⤵
  PID:6036
- C:\Windows\System\LLBAsby.exe
  C:\Windows\System\LLBAsby.exe
  2⤵
  PID:7396
- C:\Windows\System\zpEYmYc.exe
  C:\Windows\System\zpEYmYc.exe
  2⤵
  PID:7444
- C:\Windows\System\wALJcXh.exe
  C:\Windows\System\wALJcXh.exe
  2⤵
  PID:7560
- C:\Windows\System\NihHmQH.exe
  C:\Windows\System\NihHmQH.exe
  2⤵
  PID:7384
- C:\Windows\System\RMgCHie.exe
  C:\Windows\System\RMgCHie.exe
  2⤵
  PID:7472
- C:\Windows\System\DdXDEhV.exe
  C:\Windows\System\DdXDEhV.exe
  2⤵
  PID:5536
- C:\Windows\System\MWTVnOa.exe
  C:\Windows\System\MWTVnOa.exe
  2⤵
  PID:6104
- C:\Windows\System\hvjKlSX.exe
  C:\Windows\System\hvjKlSX.exe
  2⤵
  PID:8
- C:\Windows\System\bTRjBHU.exe
  C:\Windows\System\bTRjBHU.exe
  2⤵
  PID:8216
- C:\Windows\System\hwITvEI.exe
  C:\Windows\System\hwITvEI.exe
  2⤵
  PID:8240
- C:\Windows\System\FanhUny.exe
  C:\Windows\System\FanhUny.exe
  2⤵
  PID:8264
- C:\Windows\System\OPnGEOP.exe
  C:\Windows\System\OPnGEOP.exe
  2⤵
  PID:8288
- C:\Windows\System\mPlNmRC.exe
  C:\Windows\System\mPlNmRC.exe
  2⤵
  PID:8312
- C:\Windows\System\JANjvMK.exe
  C:\Windows\System\JANjvMK.exe
  2⤵
  PID:8340
- C:\Windows\System\qaYMtKc.exe
  C:\Windows\System\qaYMtKc.exe
  2⤵
  PID:8356
- C:\Windows\System\kvoOZix.exe
  C:\Windows\System\kvoOZix.exe
  2⤵
  PID:8376
- C:\Windows\System\jldkrVd.exe
  C:\Windows\System\jldkrVd.exe
  2⤵
  PID:8404
- C:\Windows\System\zgMlwBo.exe
  C:\Windows\System\zgMlwBo.exe
  2⤵
  PID:8432
- C:\Windows\System\wVhIBFD.exe
  C:\Windows\System\wVhIBFD.exe
  2⤵
  PID:8448
- C:\Windows\System\oRcjPDW.exe
  C:\Windows\System\oRcjPDW.exe
  2⤵
  PID:8464
- C:\Windows\System\lvZtklQ.exe
  C:\Windows\System\lvZtklQ.exe
  2⤵
  PID:8480
- C:\Windows\System\BUEQlWf.exe
  C:\Windows\System\BUEQlWf.exe
  2⤵
  PID:8500
- C:\Windows\System\TqezKkC.exe
  C:\Windows\System\TqezKkC.exe
  2⤵
  PID:8528
- C:\Windows\System\eAjHQLT.exe
  C:\Windows\System\eAjHQLT.exe
  2⤵
  PID:8544
- C:\Windows\System\CkmXtQr.exe
  C:\Windows\System\CkmXtQr.exe
  2⤵
  PID:8568
- C:\Windows\System\zVEUUfW.exe
  C:\Windows\System\zVEUUfW.exe
  2⤵
  PID:8592
- C:\Windows\System\JYjGiEm.exe
  C:\Windows\System\JYjGiEm.exe
  2⤵
  PID:8612
- C:\Windows\System\acHXgQf.exe
  C:\Windows\System\acHXgQf.exe
  2⤵
  PID:8636
- C:\Windows\System\gyeZxhw.exe
  C:\Windows\System\gyeZxhw.exe
  2⤵
  PID:8660
- C:\Windows\System\SEkevEj.exe
  C:\Windows\System\SEkevEj.exe
  2⤵
  PID:8684
- C:\Windows\System\RlHwZSu.exe
  C:\Windows\System\RlHwZSu.exe
  2⤵
  PID:8712
- C:\Windows\System\CBPqqlq.exe
  C:\Windows\System\CBPqqlq.exe
  2⤵
  PID:8728
- C:\Windows\System\IazDToa.exe
  C:\Windows\System\IazDToa.exe
  2⤵
  PID:8752
- C:\Windows\System\XJBlnhO.exe
  C:\Windows\System\XJBlnhO.exe
  2⤵
  PID:8776
- C:\Windows\System\lsqPpMo.exe
  C:\Windows\System\lsqPpMo.exe
  2⤵
  PID:8828
- C:\Windows\System\TifjHix.exe
  C:\Windows\System\TifjHix.exe
  2⤵
  PID:8852
- C:\Windows\System\tkzFppV.exe
  C:\Windows\System\tkzFppV.exe
  2⤵
  PID:8876
- C:\Windows\System\LywfxNt.exe
  C:\Windows\System\LywfxNt.exe
  2⤵
  PID:8900
- C:\Windows\System\AdOrtek.exe
  C:\Windows\System\AdOrtek.exe
  2⤵
  PID:8924
- C:\Windows\System\uSFquHS.exe
  C:\Windows\System\uSFquHS.exe
  2⤵
  PID:8944
- C:\Windows\System\vGwlPpc.exe
  C:\Windows\System\vGwlPpc.exe
  2⤵
  PID:8964
- C:\Windows\System\VNXhaEU.exe
  C:\Windows\System\VNXhaEU.exe
  2⤵
  PID:8984
- C:\Windows\System\hoQsYRW.exe
  C:\Windows\System\hoQsYRW.exe
  2⤵
  PID:9008
- C:\Windows\System\JttsEJS.exe
  C:\Windows\System\JttsEJS.exe
  2⤵
  PID:9028
- C:\Windows\System\YOYaKhF.exe
  C:\Windows\System\YOYaKhF.exe
  2⤵
  PID:9048
- C:\Windows\System\nbaYbST.exe
  C:\Windows\System\nbaYbST.exe
  2⤵
  PID:9068
- C:\Windows\System\UeDsMFr.exe
  C:\Windows\System\UeDsMFr.exe
  2⤵
  PID:9092
- C:\Windows\System\ZFIzRNb.exe
  C:\Windows\System\ZFIzRNb.exe
  2⤵
  PID:9144
- C:\Windows\System\bEmGzTJ.exe
  C:\Windows\System\bEmGzTJ.exe
  2⤵
  PID:6180
- C:\Windows\System\RelUUdt.exe
  C:\Windows\System\RelUUdt.exe
  2⤵
  PID:6364
- C:\Windows\System\JjnnDmP.exe
  C:\Windows\System\JjnnDmP.exe
  2⤵
  PID:6516
- C:\Windows\System\QMuYldg.exe
  C:\Windows\System\QMuYldg.exe
  2⤵
  PID:6612
- C:\Windows\System\lpfyRKC.exe
  C:\Windows\System\lpfyRKC.exe
  2⤵
  PID:6708
- C:\Windows\System\oeEmzLG.exe
  C:\Windows\System\oeEmzLG.exe
  2⤵
  PID:7036
- C:\Windows\System\OxuQAdK.exe
  C:\Windows\System\OxuQAdK.exe
  2⤵
  PID:6848
- C:\Windows\System\nrkiHtp.exe
  C:\Windows\System\nrkiHtp.exe
  2⤵
  PID:6956
- C:\Windows\System\lXyzmYk.exe
  C:\Windows\System\lXyzmYk.exe
  2⤵
  PID:7080
- C:\Windows\System\ZWLDTtK.exe
  C:\Windows\System\ZWLDTtK.exe
  2⤵
  PID:7188
- C:\Windows\System\kIsoZwC.exe
  C:\Windows\System\kIsoZwC.exe
  2⤵
  PID:7224
- C:\Windows\System\gyrTdJC.exe
  C:\Windows\System\gyrTdJC.exe
  2⤵
  PID:7256
- C:\Windows\System\zgDJAGy.exe
  C:\Windows\System\zgDJAGy.exe
  2⤵
  PID:7296
- C:\Windows\System\eITyrza.exe
  C:\Windows\System\eITyrza.exe
  2⤵
  PID:7344
- C:\Windows\System\xhPQQKJ.exe
  C:\Windows\System\xhPQQKJ.exe
  2⤵
  PID:7404
- C:\Windows\System\IqwZecE.exe
  C:\Windows\System\IqwZecE.exe
  2⤵
  PID:7564
- C:\Windows\System\JFOeHns.exe
  C:\Windows\System\JFOeHns.exe
  2⤵
  PID:7616
- C:\Windows\System\DOWCipw.exe
  C:\Windows\System\DOWCipw.exe
  2⤵
  PID:7584
- C:\Windows\System\SChcxTN.exe
  C:\Windows\System\SChcxTN.exe
  2⤵
  PID:7848
- C:\Windows\System\ZPnYGPx.exe
  C:\Windows\System\ZPnYGPx.exe
  2⤵
  PID:7880
- C:\Windows\System\lKjDNMe.exe
  C:\Windows\System\lKjDNMe.exe
  2⤵
  PID:7928
- C:\Windows\System\VhtsocM.exe
  C:\Windows\System\VhtsocM.exe
  2⤵
  PID:7964
- C:\Windows\System\XcodBsz.exe
  C:\Windows\System\XcodBsz.exe
  2⤵
  PID:8008
- C:\Windows\System\eqsvzIb.exe
  C:\Windows\System\eqsvzIb.exe
  2⤵
  PID:8044
- C:\Windows\System\lJMiGRF.exe
  C:\Windows\System\lJMiGRF.exe
  2⤵
  PID:8092
- C:\Windows\System\GWXZKYR.exe
  C:\Windows\System\GWXZKYR.exe
  2⤵
  PID:8132
- C:\Windows\System\xXyXaok.exe
  C:\Windows\System\xXyXaok.exe
  2⤵
  PID:4920
- C:\Windows\System\RuMZNAP.exe
  C:\Windows\System\RuMZNAP.exe
  2⤵
  PID:8188
- C:\Windows\System\qWjBDlF.exe
  C:\Windows\System\qWjBDlF.exe
  2⤵
  PID:4656
- C:\Windows\System\xIXwLsx.exe
  C:\Windows\System\xIXwLsx.exe
  2⤵
  PID:7436
- C:\Windows\System\ycjtqIr.exe
  C:\Windows\System\ycjtqIr.exe
  2⤵
  PID:6136
- C:\Windows\System\UrlvxXO.exe
  C:\Windows\System\UrlvxXO.exe
  2⤵
  PID:8224
- C:\Windows\System\gVGxRug.exe
  C:\Windows\System\gVGxRug.exe
  2⤵
  PID:8260
- C:\Windows\System\nFLYAxN.exe
  C:\Windows\System\nFLYAxN.exe
  2⤵
  PID:8308
- C:\Windows\System\nBILnjB.exe
  C:\Windows\System\nBILnjB.exe
  2⤵
  PID:8368
- C:\Windows\System\cuskrwC.exe
  C:\Windows\System\cuskrwC.exe
  2⤵
  PID:8396
- C:\Windows\System\kWpzCOV.exe
  C:\Windows\System\kWpzCOV.exe
  2⤵
  PID:8456
- C:\Windows\System\DvTQauv.exe
  C:\Windows\System\DvTQauv.exe
  2⤵
  PID:8492
- C:\Windows\System\lOwQItY.exe
  C:\Windows\System\lOwQItY.exe
  2⤵
  PID:8540
- C:\Windows\System\WoIsFAT.exe
  C:\Windows\System\WoIsFAT.exe
  2⤵
  PID:8600
- C:\Windows\System\aMdopOU.exe
  C:\Windows\System\aMdopOU.exe
  2⤵
  PID:8644
- C:\Windows\System\tmxFooR.exe
  C:\Windows\System\tmxFooR.exe
  2⤵
  PID:8692
- C:\Windows\System\jhsFiUX.exe
  C:\Windows\System\jhsFiUX.exe
  2⤵
  PID:8736
- C:\Windows\System\IJHlEfM.exe
  C:\Windows\System\IJHlEfM.exe
  2⤵
  PID:8788
- C:\Windows\System\nxnZJDv.exe
  C:\Windows\System\nxnZJDv.exe
  2⤵
  PID:8844
- C:\Windows\System\KkYKQyE.exe
  C:\Windows\System\KkYKQyE.exe
  2⤵
  PID:8892
- C:\Windows\System\SNFHQsE.exe
  C:\Windows\System\SNFHQsE.exe
  2⤵
  PID:8932
- C:\Windows\System\zNniUrq.exe
  C:\Windows\System\zNniUrq.exe
  2⤵
  PID:8976
- C:\Windows\System\bDeRHIE.exe
  C:\Windows\System\bDeRHIE.exe
  2⤵
  PID:9044
- C:\Windows\System\huLnJPm.exe
  C:\Windows\System\huLnJPm.exe
  2⤵
  PID:9088
- C:\Windows\System\yyAsRrq.exe
  C:\Windows\System\yyAsRrq.exe
  2⤵
  PID:4896
- C:\Windows\System\pwKiSnN.exe
  C:\Windows\System\pwKiSnN.exe
  2⤵
  PID:6704
- C:\Windows\System\FOaPOsi.exe
  C:\Windows\System\FOaPOsi.exe
  2⤵
  PID:7400
- C:\Windows\System\CdKXTbM.exe
  C:\Windows\System\CdKXTbM.exe
  2⤵
  PID:8392
- C:\Windows\System\hsXLJsG.exe
  C:\Windows\System\hsXLJsG.exe
  2⤵
  PID:8724
- C:\Windows\System\aEzmoAt.exe
  C:\Windows\System\aEzmoAt.exe
  2⤵
  PID:6312
- C:\Windows\System\rmcGrlm.exe
  C:\Windows\System\rmcGrlm.exe
  2⤵
  PID:6660
- C:\Windows\System\ZBQTVcQ.exe
  C:\Windows\System\ZBQTVcQ.exe
  2⤵
  PID:6540
- C:\Windows\System\awyakSs.exe
  C:\Windows\System\awyakSs.exe
  2⤵
  PID:8476
- C:\Windows\System\ADcjbgi.exe
  C:\Windows\System\ADcjbgi.exe
  2⤵
  PID:8156
- C:\Windows\System\QLjhIEm.exe
  C:\Windows\System\QLjhIEm.exe
  2⤵
  PID:8024
- C:\Windows\System\ywtnHrA.exe
  C:\Windows\System\ywtnHrA.exe
  2⤵
  PID:7440
- C:\Windows\System\guUkGCh.exe
  C:\Windows\System\guUkGCh.exe
  2⤵
  PID:8060
- C:\Windows\System\eBJwffE.exe
  C:\Windows\System\eBJwffE.exe
  2⤵
  PID:1436
- C:\Windows\System\YcpKjog.exe
  C:\Windows\System\YcpKjog.exe
  2⤵
  PID:7292
- C:\Windows\System\avAoOeL.exe
  C:\Windows\System\avAoOeL.exe
  2⤵
  PID:9236
- C:\Windows\System\VlDrIjD.exe
  C:\Windows\System\VlDrIjD.exe
  2⤵
  PID:9260
- C:\Windows\System\WWDHscG.exe
  C:\Windows\System\WWDHscG.exe
  2⤵
  PID:9284
- C:\Windows\System\BATdusp.exe
  C:\Windows\System\BATdusp.exe
  2⤵
  PID:9308
- C:\Windows\System\CnGFJKK.exe
  C:\Windows\System\CnGFJKK.exe
  2⤵
  PID:9332
- C:\Windows\System\GdUatLZ.exe
  C:\Windows\System\GdUatLZ.exe
  2⤵
  PID:9352
- C:\Windows\System\OsCydpk.exe
  C:\Windows\System\OsCydpk.exe
  2⤵
  PID:9376
- C:\Windows\System\UsNxVrb.exe
  C:\Windows\System\UsNxVrb.exe
  2⤵
  PID:9396
- C:\Windows\System\WhWmbRQ.exe
  C:\Windows\System\WhWmbRQ.exe
  2⤵
  PID:9420
- C:\Windows\System\bAUTuAf.exe
  C:\Windows\System\bAUTuAf.exe
  2⤵
  PID:9444
- C:\Windows\System\fLnhCJv.exe
  C:\Windows\System\fLnhCJv.exe
  2⤵
  PID:9464
- C:\Windows\System\FteYpHz.exe
  C:\Windows\System\FteYpHz.exe
  2⤵
  PID:9480
- C:\Windows\System\YwwUTXl.exe
  C:\Windows\System\YwwUTXl.exe
  2⤵
  PID:9504
- C:\Windows\System\pDuKDQC.exe
  C:\Windows\System\pDuKDQC.exe
  2⤵
  PID:9528
- C:\Windows\System\faUOXft.exe
  C:\Windows\System\faUOXft.exe
  2⤵
  PID:9552
- C:\Windows\System\wJcnsrS.exe
  C:\Windows\System\wJcnsrS.exe
  2⤵
  PID:9568
- C:\Windows\System\tWIFLwN.exe
  C:\Windows\System\tWIFLwN.exe
  2⤵
  PID:9592
- C:\Windows\System\VFkGhcB.exe
  C:\Windows\System\VFkGhcB.exe
  2⤵
  PID:9612
- C:\Windows\System\xyAsAWv.exe
  C:\Windows\System\xyAsAWv.exe
  2⤵
  PID:9628
- C:\Windows\System\ioaJggQ.exe
  C:\Windows\System\ioaJggQ.exe
  2⤵
  PID:9648
- C:\Windows\System\BLVMMOv.exe
  C:\Windows\System\BLVMMOv.exe
  2⤵
  PID:9672
- C:\Windows\System\VvRCcvi.exe
  C:\Windows\System\VvRCcvi.exe
  2⤵
  PID:9692
- C:\Windows\System\NyceaMJ.exe
  C:\Windows\System\NyceaMJ.exe
  2⤵
  PID:9716
- C:\Windows\System\IdcoFut.exe
  C:\Windows\System\IdcoFut.exe
  2⤵
  PID:9736
- C:\Windows\System\hJCdFbw.exe
  C:\Windows\System\hJCdFbw.exe
  2⤵
  PID:9760
- C:\Windows\System\XKbJzeG.exe
  C:\Windows\System\XKbJzeG.exe
  2⤵
  PID:9780
- C:\Windows\System\YkKohSb.exe
  C:\Windows\System\YkKohSb.exe
  2⤵
  PID:9812
- C:\Windows\System\JBfupLx.exe
  C:\Windows\System\JBfupLx.exe
  2⤵
  PID:9828
- C:\Windows\System\ySwISkw.exe
  C:\Windows\System\ySwISkw.exe
  2⤵
  PID:9844
- C:\Windows\System\lOSoBIY.exe
  C:\Windows\System\lOSoBIY.exe
  2⤵
  PID:9860
- C:\Windows\System\fIGlJaU.exe
  C:\Windows\System\fIGlJaU.exe
  2⤵
  PID:9880
- C:\Windows\System\aYkhurv.exe
  C:\Windows\System\aYkhurv.exe
  2⤵
  PID:9900
- C:\Windows\System\KXSNZQT.exe
  C:\Windows\System\KXSNZQT.exe
  2⤵
  PID:9924
- C:\Windows\System\xEJwXqD.exe
  C:\Windows\System\xEJwXqD.exe
  2⤵
  PID:9944
- C:\Windows\System\EpGUBxG.exe
  C:\Windows\System\EpGUBxG.exe
  2⤵
  PID:9976
- C:\Windows\System\pGBrFdp.exe
  C:\Windows\System\pGBrFdp.exe
  2⤵
  PID:9996
- C:\Windows\System\aPTGhxH.exe
  C:\Windows\System\aPTGhxH.exe
  2⤵
  PID:10020
- C:\Windows\System\zSqmrEw.exe
  C:\Windows\System\zSqmrEw.exe
  2⤵
  PID:10040
- C:\Windows\System\bPUvHLh.exe
  C:\Windows\System\bPUvHLh.exe
  2⤵
  PID:10068
- C:\Windows\System\WpsnzkF.exe
  C:\Windows\System\WpsnzkF.exe
  2⤵
  PID:10088
- C:\Windows\System\pqCTJrm.exe
  C:\Windows\System\pqCTJrm.exe
  2⤵
  PID:10112
- C:\Windows\System\NRQDkQj.exe
  C:\Windows\System\NRQDkQj.exe
  2⤵
  PID:10136
- C:\Windows\System\vhuynGd.exe
  C:\Windows\System\vhuynGd.exe
  2⤵
  PID:10164
- C:\Windows\System\hgMiaAj.exe
  C:\Windows\System\hgMiaAj.exe
  2⤵
  PID:10180
- C:\Windows\System\fpqWwsR.exe
  C:\Windows\System\fpqWwsR.exe
  2⤵
  PID:10196
- C:\Windows\System\qhOIQJz.exe
  C:\Windows\System\qhOIQJz.exe
  2⤵
  PID:10212
- C:\Windows\System\IIbwiYD.exe
  C:\Windows\System\IIbwiYD.exe
  2⤵
  PID:10232
- C:\Windows\System\pOvyZsS.exe
  C:\Windows\System\pOvyZsS.exe
  2⤵
  PID:6016
- C:\Windows\System\xCUvQPI.exe
  C:\Windows\System\xCUvQPI.exe
  2⤵
  PID:7908
- C:\Windows\System\TDsTwOw.exe
  C:\Windows\System\TDsTwOw.exe
  2⤵
  PID:8108
- C:\Windows\System\fZnvrox.exe
  C:\Windows\System\fZnvrox.exe
  2⤵
  PID:8460
- C:\Windows\System\IUxKvlp.exe
  C:\Windows\System\IUxKvlp.exe
  2⤵
  PID:8620
- C:\Windows\System\KKteXKa.exe
  C:\Windows\System\KKteXKa.exe
  2⤵
  PID:8860
- C:\Windows\System\fvsNelp.exe
  C:\Windows\System\fvsNelp.exe
  2⤵
  PID:8916
- C:\Windows\System\sBebnnO.exe
  C:\Windows\System\sBebnnO.exe
  2⤵
  PID:7612
- C:\Windows\System\kfNRiRd.exe
  C:\Windows\System\kfNRiRd.exe
  2⤵
  PID:7196
- C:\Windows\System\oiddlWh.exe
  C:\Windows\System\oiddlWh.exe
  2⤵
  PID:8248
- C:\Windows\System\EyRjajZ.exe
  C:\Windows\System\EyRjajZ.exe
  2⤵
  PID:9244
- C:\Windows\System\AgVRPiS.exe
  C:\Windows\System\AgVRPiS.exe
  2⤵
  PID:9276
- C:\Windows\System\WkFhyRl.exe
  C:\Windows\System\WkFhyRl.exe
  2⤵
  PID:9344
- C:\Windows\System\RzmMlRB.exe
  C:\Windows\System\RzmMlRB.exe
  2⤵
  PID:10260
- C:\Windows\System\ejhhAZl.exe
  C:\Windows\System\ejhhAZl.exe
  2⤵
  PID:10280
- C:\Windows\System\aiGnSXb.exe
  C:\Windows\System\aiGnSXb.exe
  2⤵
  PID:10300
- C:\Windows\System\iZfuNVe.exe
  C:\Windows\System\iZfuNVe.exe
  2⤵
  PID:10324
- C:\Windows\System\KEyppWa.exe
  C:\Windows\System\KEyppWa.exe
  2⤵
  PID:10344
- C:\Windows\System\XFlrnoW.exe
  C:\Windows\System\XFlrnoW.exe
  2⤵
  PID:10368
- C:\Windows\System\RCtYKzM.exe
  C:\Windows\System\RCtYKzM.exe
  2⤵
  PID:10592
- C:\Windows\System\AbbhLNV.exe
  C:\Windows\System\AbbhLNV.exe
  2⤵
  PID:10620
- C:\Windows\System\xDuvBiK.exe
  C:\Windows\System\xDuvBiK.exe
  2⤵
  PID:10636
- C:\Windows\System\MxSNGvi.exe
  C:\Windows\System\MxSNGvi.exe
  2⤵
  PID:10660
- C:\Windows\System\TdlPnPh.exe
  C:\Windows\System\TdlPnPh.exe
  2⤵
  PID:10688
- C:\Windows\System\qnODKjV.exe
  C:\Windows\System\qnODKjV.exe
  2⤵
  PID:10708
- C:\Windows\System\VLNXQbE.exe
  C:\Windows\System\VLNXQbE.exe
  2⤵
  PID:10732
- C:\Windows\System\yreVaYH.exe
  C:\Windows\System\yreVaYH.exe
  2⤵
  PID:10760
- C:\Windows\System\WCgCbIM.exe
  C:\Windows\System\WCgCbIM.exe
  2⤵
  PID:10780
- C:\Windows\System\OatoWmz.exe
  C:\Windows\System\OatoWmz.exe
  2⤵
  PID:10804
- C:\Windows\System\kHiZqXQ.exe
  C:\Windows\System\kHiZqXQ.exe
  2⤵
  PID:10824
- C:\Windows\System\QOJNvTQ.exe
  C:\Windows\System\QOJNvTQ.exe
  2⤵
  PID:10844
- C:\Windows\System\BRHkMdH.exe
  C:\Windows\System\BRHkMdH.exe
  2⤵
  PID:10868
- C:\Windows\System\rvLYYDU.exe
  C:\Windows\System\rvLYYDU.exe
  2⤵
  PID:10884
- C:\Windows\System\LSteoRk.exe
  C:\Windows\System\LSteoRk.exe
  2⤵
  PID:10904
- C:\Windows\System\IzBjPgY.exe
  C:\Windows\System\IzBjPgY.exe
  2⤵
  PID:10920
- C:\Windows\System\SkFTIBd.exe
  C:\Windows\System\SkFTIBd.exe
  2⤵
  PID:10936
- C:\Windows\System\nmFNbOY.exe
  C:\Windows\System\nmFNbOY.exe
  2⤵
  PID:10952
- C:\Windows\System\tjXfKhO.exe
  C:\Windows\System\tjXfKhO.exe
  2⤵
  PID:10968
- C:\Windows\System\pOaEPJi.exe
  C:\Windows\System\pOaEPJi.exe
  2⤵
  PID:10992
- C:\Windows\System\vRsytyo.exe
  C:\Windows\System\vRsytyo.exe
  2⤵
  PID:11016
- C:\Windows\System\XEqNTIZ.exe
  C:\Windows\System\XEqNTIZ.exe
  2⤵
  PID:11048
- C:\Windows\System\DoceFkw.exe
  C:\Windows\System\DoceFkw.exe
  2⤵
  PID:11072
- C:\Windows\System\xPNlePn.exe
  C:\Windows\System\xPNlePn.exe
  2⤵
  PID:11100
- C:\Windows\System\pvJFPMn.exe
  C:\Windows\System\pvJFPMn.exe
  2⤵
  PID:11116
- C:\Windows\System\KoQYwHK.exe
  C:\Windows\System\KoQYwHK.exe
  2⤵
  PID:11136
- C:\Windows\System\HjGLLcX.exe
  C:\Windows\System\HjGLLcX.exe
  2⤵
  PID:11156
- C:\Windows\System\XcJHoOf.exe
  C:\Windows\System\XcJHoOf.exe
  2⤵
  PID:11176
- C:\Windows\System\sQakmbX.exe
  C:\Windows\System\sQakmbX.exe
  2⤵
  PID:11196
- C:\Windows\System\oAIdCwC.exe
  C:\Windows\System\oAIdCwC.exe
  2⤵
  PID:11224
- C:\Windows\System\vEcvGZI.exe
  C:\Windows\System\vEcvGZI.exe
  2⤵
  PID:11244
- C:\Windows\System\dNfFOZs.exe
  C:\Windows\System\dNfFOZs.exe
  2⤵
  PID:1632
- C:\Windows\System\tytzGua.exe
  C:\Windows\System\tytzGua.exe
  2⤵
  PID:7916
- C:\Windows\System\VxJQcrG.exe
  C:\Windows\System\VxJQcrG.exe
  2⤵
  PID:7972
- C:\Windows\System\VOysCxi.exe
  C:\Windows\System\VOysCxi.exe
  2⤵
  PID:7596
- C:\Windows\System\CyoBqaS.exe
  C:\Windows\System\CyoBqaS.exe
  2⤵
  PID:8936
- C:\Windows\System\AygzZoF.exe
  C:\Windows\System\AygzZoF.exe
  2⤵
  PID:10036
- C:\Windows\System\QViyrBl.exe
  C:\Windows\System\QViyrBl.exe
  2⤵
  PID:9064
- C:\Windows\System\jvqqist.exe
  C:\Windows\System\jvqqist.exe
  2⤵
  PID:9000
- C:\Windows\System\ROgdpNX.exe
  C:\Windows\System\ROgdpNX.exe
  2⤵
  PID:8656
- C:\Windows\System\PYKPdxC.exe
  C:\Windows\System\PYKPdxC.exe
  2⤵
  PID:7368
- C:\Windows\System\pTIBgGR.exe
  C:\Windows\System\pTIBgGR.exe
  2⤵
  PID:4684
- C:\Windows\System\dllRGmO.exe
  C:\Windows\System\dllRGmO.exe
  2⤵
  PID:7876
- C:\Windows\System\Yhmmskd.exe
  C:\Windows\System\Yhmmskd.exe
  2⤵
  PID:9340
- C:\Windows\System\nYGWKKG.exe
  C:\Windows\System\nYGWKKG.exe
  2⤵
  PID:9268
- C:\Windows\System\FLJSjQb.exe
  C:\Windows\System\FLJSjQb.exe
  2⤵
  PID:10252
- C:\Windows\System\XGKsntA.exe
  C:\Windows\System\XGKsntA.exe
  2⤵
  PID:10340
- C:\Windows\System\gFeOGcB.exe
  C:\Windows\System\gFeOGcB.exe
  2⤵
  PID:10400
- C:\Windows\System\HEiYTlE.exe
  C:\Windows\System\HEiYTlE.exe
  2⤵
  PID:11280
- C:\Windows\System\CKreMod.exe
  C:\Windows\System\CKreMod.exe
  2⤵
  PID:11304
- C:\Windows\System\aSBdrcN.exe
  C:\Windows\System\aSBdrcN.exe
  2⤵
  PID:11332
- C:\Windows\System\BuUbjwv.exe
  C:\Windows\System\BuUbjwv.exe
  2⤵
  PID:11356
- C:\Windows\System\JagNPxA.exe
  C:\Windows\System\JagNPxA.exe
  2⤵
  PID:11380
- C:\Windows\System\tPoQHJH.exe
  C:\Windows\System\tPoQHJH.exe
  2⤵
  PID:11408
- C:\Windows\System\JClEBtV.exe
  C:\Windows\System\JClEBtV.exe
  2⤵
  PID:11432
- C:\Windows\System\KmqzPBS.exe
  C:\Windows\System\KmqzPBS.exe
  2⤵
  PID:11464
- C:\Windows\System\FeDiXwi.exe
  C:\Windows\System\FeDiXwi.exe
  2⤵
  PID:11492
- C:\Windows\System\PtfNhcB.exe
  C:\Windows\System\PtfNhcB.exe
  2⤵
  PID:11516
- C:\Windows\System\VYBlejO.exe
  C:\Windows\System\VYBlejO.exe
  2⤵
  PID:11552
- C:\Windows\System\kjKTgiO.exe
  C:\Windows\System\kjKTgiO.exe
  2⤵
  PID:11576
- C:\Windows\System\JzWiCNA.exe
  C:\Windows\System\JzWiCNA.exe
  2⤵
  PID:11612
- C:\Windows\System\VdtdJyB.exe
  C:\Windows\System\VdtdJyB.exe
  2⤵
  PID:11632
- C:\Windows\System\sqwDpEL.exe
  C:\Windows\System\sqwDpEL.exe
  2⤵
  PID:11656
- C:\Windows\System\AnMFCAZ.exe
  C:\Windows\System\AnMFCAZ.exe
  2⤵
  PID:11676
- C:\Windows\System\MMZBqyl.exe
  C:\Windows\System\MMZBqyl.exe
  2⤵
  PID:11692
- C:\Windows\System\afauwLb.exe
  C:\Windows\System\afauwLb.exe
  2⤵
  PID:11712
- C:\Windows\System\dpPscWp.exe
  C:\Windows\System\dpPscWp.exe
  2⤵
  PID:11736
- C:\Windows\System\VlLVIpY.exe
  C:\Windows\System\VlLVIpY.exe
  2⤵
  PID:11760
- C:\Windows\System\KPLqSro.exe
  C:\Windows\System\KPLqSro.exe
  2⤵
  PID:11784
- C:\Windows\System\GQgTCTr.exe
  C:\Windows\System\GQgTCTr.exe
  2⤵
  PID:11808
- C:\Windows\System\neLRifV.exe
  C:\Windows\System\neLRifV.exe
  2⤵
  PID:11832
- C:\Windows\System\NruiExH.exe
  C:\Windows\System\NruiExH.exe
  2⤵
  PID:11852
- C:\Windows\System\azTJafY.exe
  C:\Windows\System\azTJafY.exe
  2⤵
  PID:11872
- C:\Windows\System\VDbNosr.exe
  C:\Windows\System\VDbNosr.exe
  2⤵
  PID:11896
- C:\Windows\System\rwulLTL.exe
  C:\Windows\System\rwulLTL.exe
  2⤵
  PID:11916
- C:\Windows\System\ugLVfhQ.exe
  C:\Windows\System\ugLVfhQ.exe
  2⤵
  PID:11936
- C:\Windows\System\JlarFgn.exe
  C:\Windows\System\JlarFgn.exe
  2⤵
  PID:11972
- C:\Windows\System\THQjyXh.exe
  C:\Windows\System\THQjyXh.exe
  2⤵
  PID:11988
- C:\Windows\System\PLGnhsQ.exe
  C:\Windows\System\PLGnhsQ.exe
  2⤵
  PID:12004
- C:\Windows\System\kWjbAJD.exe
  C:\Windows\System\kWjbAJD.exe
  2⤵
  PID:12020
- C:\Windows\System\wYxanUm.exe
  C:\Windows\System\wYxanUm.exe
  2⤵
  PID:12036
- C:\Windows\System\GZzFDud.exe
  C:\Windows\System\GZzFDud.exe
  2⤵
  PID:12056
- C:\Windows\System\qezFKMI.exe
  C:\Windows\System\qezFKMI.exe
  2⤵
  PID:12072
- C:\Windows\System\chGbLtI.exe
  C:\Windows\System\chGbLtI.exe
  2⤵
  PID:12088
- C:\Windows\System\nBcuxXN.exe
  C:\Windows\System\nBcuxXN.exe
  2⤵
  PID:12104
- C:\Windows\System\uEuVfWR.exe
  C:\Windows\System\uEuVfWR.exe
  2⤵
  PID:12124
- C:\Windows\System\bOGEOau.exe
  C:\Windows\System\bOGEOau.exe
  2⤵
  PID:12144
- C:\Windows\System\AehdgNw.exe
  C:\Windows\System\AehdgNw.exe
  2⤵
  PID:12164
- C:\Windows\System\KhjOjKT.exe
  C:\Windows\System\KhjOjKT.exe
  2⤵
  PID:12192
- C:\Windows\System\DzkUntC.exe
  C:\Windows\System\DzkUntC.exe
  2⤵
  PID:12212
- C:\Windows\System\FBVdAoN.exe
  C:\Windows\System\FBVdAoN.exe
  2⤵
  PID:12240
- C:\Windows\System\IDbcIyb.exe
  C:\Windows\System\IDbcIyb.exe
  2⤵
  PID:12260
- C:\Windows\System\ItGJAuh.exe
  C:\Windows\System\ItGJAuh.exe
  2⤵
  PID:12276
- C:\Windows\System\nLSTUlU.exe
  C:\Windows\System\nLSTUlU.exe
  2⤵
  PID:9640
- C:\Windows\System\iOiqQXp.exe
  C:\Windows\System\iOiqQXp.exe
  2⤵
  PID:9732
- C:\Windows\System\ldftDPB.exe
  C:\Windows\System\ldftDPB.exe
  2⤵
  PID:10492
- C:\Windows\System\LZmamzh.exe
  C:\Windows\System\LZmamzh.exe
  2⤵
  PID:9876
- C:\Windows\System\UkUBETo.exe
  C:\Windows\System\UkUBETo.exe
  2⤵
  PID:3828
- C:\Windows\System\JDysatu.exe
  C:\Windows\System\JDysatu.exe
  2⤵
  PID:9968
- C:\Windows\System\pelqGtB.exe
  C:\Windows\System\pelqGtB.exe
  2⤵
  PID:10012
- C:\Windows\System\XmUwAHy.exe
  C:\Windows\System\XmUwAHy.exe
  2⤵
  PID:10716
- C:\Windows\System\dwVByXg.exe
  C:\Windows\System\dwVByXg.exe
  2⤵
  PID:10124
- C:\Windows\System\pAOWgcZ.exe
  C:\Windows\System\pAOWgcZ.exe
  2⤵
  PID:10172
- C:\Windows\System\QSyJJlr.exe
  C:\Windows\System\QSyJJlr.exe
  2⤵
  PID:10820
- C:\Windows\System\rYcGFxu.exe
  C:\Windows\System\rYcGFxu.exe
  2⤵
  PID:10916
- C:\Windows\System\wSodKDZ.exe
  C:\Windows\System\wSodKDZ.exe
  2⤵
  PID:11804
- C:\Windows\System\HLOXjge.exe
  C:\Windows\System\HLOXjge.exe
  2⤵
  PID:12312
- C:\Windows\System\ZuXFdQH.exe
  C:\Windows\System\ZuXFdQH.exe
  2⤵
  PID:12332
- C:\Windows\System\UEhquTz.exe
  C:\Windows\System\UEhquTz.exe
  2⤵
  PID:12356
- C:\Windows\System\lqJVOUI.exe
  C:\Windows\System\lqJVOUI.exe
  2⤵
  PID:12372
- C:\Windows\System\djiPvCd.exe
  C:\Windows\System\djiPvCd.exe
  2⤵
  PID:12392
- C:\Windows\System\uyVgGby.exe
  C:\Windows\System\uyVgGby.exe
  2⤵
  PID:12416
- C:\Windows\System\jMuMFiD.exe
  C:\Windows\System\jMuMFiD.exe
  2⤵
  PID:12436
- C:\Windows\System\CpdTWtz.exe
  C:\Windows\System\CpdTWtz.exe
  2⤵
  PID:12456
- C:\Windows\System\TzYqVjf.exe
  C:\Windows\System\TzYqVjf.exe
  2⤵
  PID:12476
- C:\Windows\System\JhQreRV.exe
  C:\Windows\System\JhQreRV.exe
  2⤵
  PID:12500
- C:\Windows\System\ZECxXBn.exe
  C:\Windows\System\ZECxXBn.exe
  2⤵
  PID:12516
- C:\Windows\System\PINmTJo.exe
  C:\Windows\System\PINmTJo.exe
  2⤵
  PID:12544
- C:\Windows\System\FvVZWzZ.exe
  C:\Windows\System\FvVZWzZ.exe
  2⤵
  PID:12580
- C:\Windows\System\qFFnenT.exe
  C:\Windows\System\qFFnenT.exe
  2⤵
  PID:12604
- C:\Windows\System\CLUypCV.exe
  C:\Windows\System\CLUypCV.exe
  2⤵
  PID:12628
- C:\Windows\System\GiVzwJz.exe
  C:\Windows\System\GiVzwJz.exe
  2⤵
  PID:12652
- C:\Windows\System\NgxYBBm.exe
  C:\Windows\System\NgxYBBm.exe
  2⤵
  PID:12676
- C:\Windows\System\zDWecWN.exe
  C:\Windows\System\zDWecWN.exe
  2⤵
  PID:12708
- C:\Windows\System\GMODCBq.exe
  C:\Windows\System\GMODCBq.exe
  2⤵
  PID:12728
- C:\Windows\System\cyCTlHO.exe
  C:\Windows\System\cyCTlHO.exe
  2⤵
  PID:12752
- C:\Windows\System\truLtAa.exe
  C:\Windows\System\truLtAa.exe
  2⤵
  PID:12772
- C:\Windows\System\LvEObRM.exe
  C:\Windows\System\LvEObRM.exe
  2⤵
  PID:12800
- C:\Windows\System\kRjlatm.exe
  C:\Windows\System\kRjlatm.exe
  2⤵
  PID:12824
- C:\Windows\System\CaVtHUy.exe
  C:\Windows\System\CaVtHUy.exe
  2⤵
  PID:12872
- C:\Windows\System\hNmNhqU.exe
  C:\Windows\System\hNmNhqU.exe
  2⤵
  PID:12888
- C:\Windows\System\ltkqyCU.exe
  C:\Windows\System\ltkqyCU.exe
  2⤵
  PID:12908
- C:\Windows\System\VUgSdVE.exe
  C:\Windows\System\VUgSdVE.exe
  2⤵
  PID:12936
- C:\Windows\System\KDEfNzx.exe
  C:\Windows\System\KDEfNzx.exe
  2⤵
  PID:12956
- C:\Windows\System\wRpcUqF.exe
  C:\Windows\System\wRpcUqF.exe
  2⤵
  PID:12972
- C:\Windows\System\CWbCxKG.exe
  C:\Windows\System\CWbCxKG.exe
  2⤵
  PID:12988
- C:\Windows\System\SKAMzPY.exe
  C:\Windows\System\SKAMzPY.exe
  2⤵
  PID:13004
- C:\Windows\System\fZUEbYW.exe
  C:\Windows\System\fZUEbYW.exe
  2⤵
  PID:13020
- C:\Windows\System\onkRDzR.exe
  C:\Windows\System\onkRDzR.exe
  2⤵
  PID:13036
- C:\Windows\System\GSpDJtC.exe
  C:\Windows\System\GSpDJtC.exe
  2⤵
  PID:13060
- C:\Windows\System\EFhTIeV.exe
  C:\Windows\System\EFhTIeV.exe
  2⤵
  PID:13076
- C:\Windows\System\rdXSvIG.exe
  C:\Windows\System\rdXSvIG.exe
  2⤵
  PID:13096
- C:\Windows\System\FnXWYiK.exe
  C:\Windows\System\FnXWYiK.exe
  2⤵
  PID:13140
- C:\Windows\System\wkrLQqm.exe
  C:\Windows\System\wkrLQqm.exe
  2⤵
  PID:13160
- C:\Windows\System\meGDVnz.exe
  C:\Windows\System\meGDVnz.exe
  2⤵
  PID:13176
- C:\Windows\System\bfxHPoU.exe
  C:\Windows\System\bfxHPoU.exe
  2⤵
  PID:13196
- C:\Windows\System\fqYSRbC.exe
  C:\Windows\System\fqYSRbC.exe
  2⤵
  PID:13216
- C:\Windows\System\BNSMzDz.exe
  C:\Windows\System\BNSMzDz.exe
  2⤵
  PID:13232
- C:\Windows\System\WQcwSqj.exe
  C:\Windows\System\WQcwSqj.exe
  2⤵
  PID:13264
- C:\Windows\System\LjLZGAp.exe
  C:\Windows\System\LjLZGAp.exe
  2⤵
  PID:13308
- C:\Windows\System\rtIvbPW.exe
  C:\Windows\System\rtIvbPW.exe
  2⤵
  PID:11400
- C:\Windows\System\rDukkis.exe
  C:\Windows\System\rDukkis.exe
  2⤵
  PID:9316
- C:\Windows\System\PdmmvNi.exe
  C:\Windows\System\PdmmvNi.exe
  2⤵
  PID:9500
- C:\Windows\System\dCHMmdy.exe
  C:\Windows\System\dCHMmdy.exe
  2⤵
  PID:7312
- C:\Windows\System\UJKeaAn.exe
  C:\Windows\System\UJKeaAn.exe
  2⤵
  PID:10816
- C:\Windows\System\vdpyIdF.exe
  C:\Windows\System\vdpyIdF.exe
  2⤵
  PID:6468
- C:\Windows\System\WmCmjLU.exe
  C:\Windows\System\WmCmjLU.exe
  2⤵
  PID:9548
- C:\Windows\System\bnBlFmR.exe
  C:\Windows\System\bnBlFmR.exe
  2⤵
  PID:9368
- C:\Windows\System\APLafgp.exe
  C:\Windows\System\APLafgp.exe
  2⤵
  PID:11504
- C:\Windows\System\GOoYUCq.exe
  C:\Windows\System\GOoYUCq.exe
  2⤵
  PID:9992
- C:\Windows\System\FvEnFwg.exe
  C:\Windows\System\FvEnFwg.exe
  2⤵
  PID:12268
- C:\Windows\System\doXYJcF.exe
  C:\Windows\System\doXYJcF.exe
  2⤵
  PID:12064
- C:\Windows\System\hurMttg.exe
  C:\Windows\System\hurMttg.exe
  2⤵
  PID:12180
- C:\Windows\System\GudIvzW.exe
  C:\Windows\System\GudIvzW.exe
  2⤵
  PID:12344
- C:\Windows\System\EugbQkR.exe
  C:\Windows\System\EugbQkR.exe
  2⤵
  PID:12444
- C:\Windows\System\QAKyUNU.exe
  C:\Windows\System\QAKyUNU.exe
  2⤵
  PID:10896
- C:\Windows\System\wtiUuZv.exe
  C:\Windows\System\wtiUuZv.exe
  2⤵
  PID:13320
- C:\Windows\System\JwaNLmi.exe
  C:\Windows\System\JwaNLmi.exe
  2⤵
  PID:13344
- C:\Windows\System\XiXJIoy.exe
  C:\Windows\System\XiXJIoy.exe
  2⤵
  PID:13372
- C:\Windows\System\hqkOduq.exe
  C:\Windows\System\hqkOduq.exe
  2⤵
  PID:13396
- C:\Windows\System\yXUkWSu.exe
  C:\Windows\System\yXUkWSu.exe
  2⤵
  PID:13416
- C:\Windows\System\ZCypSUk.exe
  C:\Windows\System\ZCypSUk.exe
  2⤵
  PID:13436
- C:\Windows\System\AYAqGRB.exe
  C:\Windows\System\AYAqGRB.exe
  2⤵
  PID:13452
- C:\Windows\System\aznDRNV.exe
  C:\Windows\System\aznDRNV.exe
  2⤵
  PID:13468
- C:\Windows\System\NADeocw.exe
  C:\Windows\System\NADeocw.exe
  2⤵
  PID:13492
- C:\Windows\System\BVOcJiT.exe
  C:\Windows\System\BVOcJiT.exe
  2⤵
  PID:13516
- C:\Windows\System\TTsHaci.exe
  C:\Windows\System\TTsHaci.exe
  2⤵
  PID:13536
- C:\Windows\System\psflpoX.exe
  C:\Windows\System\psflpoX.exe
  2⤵
  PID:13556
- C:\Windows\System\VXkvlmI.exe
  C:\Windows\System\VXkvlmI.exe
  2⤵
  PID:13572
- C:\Windows\System\swbUcQS.exe
  C:\Windows\System\swbUcQS.exe
  2⤵
  PID:13592
- C:\Windows\System\rGXFEyt.exe
  C:\Windows\System\rGXFEyt.exe
  2⤵
  PID:13780
- C:\Windows\System\NIPLalO.exe
  C:\Windows\System\NIPLalO.exe
  2⤵
  PID:13800
- C:\Windows\System\cApPIPc.exe
  C:\Windows\System\cApPIPc.exe
  2⤵
  PID:13816
- C:\Windows\System\VhFRgQD.exe
  C:\Windows\System\VhFRgQD.exe
  2⤵
  PID:13832
- C:\Windows\System\waxllxU.exe
  C:\Windows\System\waxllxU.exe
  2⤵
  PID:13852
- C:\Windows\System\IvrPRxT.exe
  C:\Windows\System\IvrPRxT.exe
  2⤵
  PID:13872
- C:\Windows\System\atTHHLu.exe
  C:\Windows\System\atTHHLu.exe
  2⤵
  PID:13892
- C:\Windows\System\ecleIou.exe
  C:\Windows\System\ecleIou.exe
  2⤵
  PID:13908
- C:\Windows\System\iIixbHG.exe
  C:\Windows\System\iIixbHG.exe
  2⤵
  PID:13924
- C:\Windows\System\ASgcnJE.exe
  C:\Windows\System\ASgcnJE.exe
  2⤵
  PID:13940
- C:\Windows\System\hlnbiCW.exe
  C:\Windows\System\hlnbiCW.exe
  2⤵
  PID:13960
- C:\Windows\System\yFSruae.exe
  C:\Windows\System\yFSruae.exe
  2⤵
  PID:13976
- C:\Windows\System\ZneIPUC.exe
  C:\Windows\System\ZneIPUC.exe
  2⤵
  PID:13992
- C:\Windows\System\UKIUSfA.exe
  C:\Windows\System\UKIUSfA.exe
  2⤵
  PID:14008
- C:\Windows\System\uXmsWqG.exe
  C:\Windows\System\uXmsWqG.exe
  2⤵
  PID:14024
- C:\Windows\System\fpwoRke.exe
  C:\Windows\System\fpwoRke.exe
  2⤵
  PID:14040
- C:\Windows\System\hySjtdW.exe
  C:\Windows\System\hySjtdW.exe
  2⤵
  PID:14056
- C:\Windows\System\LlOqSXi.exe
  C:\Windows\System\LlOqSXi.exe
  2⤵
  PID:14072
- C:\Windows\System\jcyDayp.exe
  C:\Windows\System\jcyDayp.exe
  2⤵
  PID:14088
- C:\Windows\System\vvJGMWe.exe
  C:\Windows\System\vvJGMWe.exe
  2⤵
  PID:14104
- C:\Windows\System\vAOmcOk.exe
  C:\Windows\System\vAOmcOk.exe
  2⤵
  PID:14124
- C:\Windows\System\MOKDGZW.exe
  C:\Windows\System\MOKDGZW.exe
  2⤵
  PID:14144
- C:\Windows\System\lwHXuDb.exe
  C:\Windows\System\lwHXuDb.exe
  2⤵
  PID:14164
- C:\Windows\System\xpjBKDZ.exe
  C:\Windows\System\xpjBKDZ.exe
  2⤵
  PID:14188
- C:\Windows\System\RZUYSeg.exe
  C:\Windows\System\RZUYSeg.exe
  2⤵
  PID:14208
- C:\Windows\System\QJEQnAi.exe
  C:\Windows\System\QJEQnAi.exe
  2⤵
  PID:14232
- C:\Windows\System\bAHuzFK.exe
  C:\Windows\System\bAHuzFK.exe
  2⤵
  PID:14252
- C:\Windows\System\igVhGzw.exe
  C:\Windows\System\igVhGzw.exe
  2⤵
  PID:14280
- C:\Windows\System\ByYQNTz.exe
  C:\Windows\System\ByYQNTz.exe
  2⤵
  PID:14308
- C:\Windows\System\oKHuoYo.exe
  C:\Windows\System\oKHuoYo.exe
  2⤵
  PID:14328
- C:\Windows\System\dpTaTOT.exe
  C:\Windows\System\dpTaTOT.exe
  2⤵
  PID:12704
- C:\Windows\System\dktpNXA.exe
  C:\Windows\System\dktpNXA.exe
  2⤵
  PID:2816
- C:\Windows\System\oLxeQud.exe
  C:\Windows\System\oLxeQud.exe
  2⤵
  PID:12380
- C:\Windows\System\sYfBLqD.exe
  C:\Windows\System\sYfBLqD.exe
  2⤵
  PID:13904
- C:\Windows\System\QJnEILW.exe
  C:\Windows\System\QJnEILW.exe
  2⤵
  PID:13632
- C:\Windows\System\ABNLzCy.exe
  C:\Windows\System\ABNLzCy.exe
  2⤵
  PID:8508
- C:\Windows\System\ZzPNvlM.exe
  C:\Windows\System\ZzPNvlM.exe
  2⤵
  PID:10440
- C:\Windows\System\MGUhjun.exe
  C:\Windows\System\MGUhjun.exe
  2⤵
  PID:12968
- C:\Windows\System\wyCCbVW.exe
  C:\Windows\System\wyCCbVW.exe
  2⤵
  PID:9232
- C:\Windows\System\VOVYyJG.exe
  C:\Windows\System\VOVYyJG.exe
  2⤵
  PID:12508
- C:\Windows\System\HeRnrex.exe
  C:\Windows\System\HeRnrex.exe
  2⤵
  PID:12620
- C:\Windows\System\QBVxvjj.exe
  C:\Windows\System\QBVxvjj.exe
  2⤵
  PID:11956
- C:\Windows\System\lpdvwaQ.exe
  C:\Windows\System\lpdvwaQ.exe
  2⤵
  PID:10856
- C:\Windows\System\LnsARkE.exe
  C:\Windows\System\LnsARkE.exe
  2⤵
  PID:12792
- C:\Windows\System\uMEKnNH.exe
  C:\Windows\System\uMEKnNH.exe
  2⤵
  PID:14240
- C:\Windows\System\TBuGAoF.exe
  C:\Windows\System\TBuGAoF.exe
  2⤵
  PID:14172
- C:\Windows\System\twZJSSh.exe
  C:\Windows\System\twZJSSh.exe
  2⤵
  PID:14120
- C:\Windows\System\kUGDcJB.exe
  C:\Windows\System\kUGDcJB.exe
  2⤵
  PID:14048
- C:\Windows\System\VfGuHOs.exe
  C:\Windows\System\VfGuHOs.exe
  2⤵
  PID:14016
- C:\Windows\System\NKEEBNj.exe
  C:\Windows\System\NKEEBNj.exe
  2⤵
  PID:13972
- C:\Windows\System\wAoYkIB.exe
  C:\Windows\System\wAoYkIB.exe
  2⤵
  PID:13916
- C:\Windows\System\riijTvV.exe
  C:\Windows\System\riijTvV.exe
  2⤵
  PID:13880
- C:\Windows\System\AiAGBNw.exe
  C:\Windows\System\AiAGBNw.exe
  2⤵
  PID:13828
- C:\Windows\System\lPTGSyZ.exe
  C:\Windows\System\lPTGSyZ.exe
  2⤵
  PID:13796
- C:\Windows\System\XyadBIi.exe
  C:\Windows\System\XyadBIi.exe
  2⤵
  PID:13728
- C:\Windows\System\TkLqiGn.exe
  C:\Windows\System\TkLqiGn.exe
  2⤵
  PID:12788
- C:\Windows\System\ogTXxhx.exe
  C:\Windows\System\ogTXxhx.exe
  2⤵
  PID:4900
- C:\Windows\System\tQVRuUe.exe
  C:\Windows\System\tQVRuUe.exe
  2⤵
  PID:13568
- C:\Windows\System\vSyyocS.exe
  C:\Windows\System\vSyyocS.exe
  2⤵
  PID:13508
- C:\Windows\System\ZfRJdFT.exe
  C:\Windows\System\ZfRJdFT.exe
  2⤵
  PID:12484
- C:\Windows\System\CvzVblm.exe
  C:\Windows\System\CvzVblm.exe
  2⤵
  PID:11364
- C:\Windows\System\LjXFbdk.exe
  C:\Windows\System\LjXFbdk.exe
  2⤵
  PID:8524
- C:\Windows\System\OPoUvyY.exe
  C:\Windows\System\OPoUvyY.exe
  2⤵
  PID:12028
- C:\Windows\System\wxUnNOI.exe
  C:\Windows\System\wxUnNOI.exe
  2⤵
  PID:12080
- C:\Windows\System\kypFxtb.exe
  C:\Windows\System\kypFxtb.exe
  2⤵
  PID:13084
- C:\Windows\System\wfSaQZa.exe
  C:\Windows\System\wfSaQZa.exe
  2⤵
  PID:12596
- C:\Windows\System\RrNuowY.exe
  C:\Windows\System\RrNuowY.exe
  2⤵
  PID:13604
- C:\Windows\System\meOLUTM.exe
  C:\Windows\System\meOLUTM.exe
  2⤵
  PID:12400
- C:\Windows\System\yUljjEW.exe
  C:\Windows\System\yUljjEW.exe
  2⤵
  PID:9772
- C:\Windows\System\eVOXewM.exe
  C:\Windows\System\eVOXewM.exe
  2⤵
  PID:11888
- C:\Windows\System\VjqmfXV.exe
  C:\Windows\System\VjqmfXV.exe
  2⤵
  PID:5112
- C:\Windows\System\tworEzj.exe
  C:\Windows\System\tworEzj.exe
  2⤵
  PID:12492
- C:\Windows\System\MoytTDT.exe
  C:\Windows\System\MoytTDT.exe
  2⤵
  PID:12564
- C:\Windows\System\NiSIsaB.exe
  C:\Windows\System\NiSIsaB.exe
  2⤵
  PID:10776
- C:\Windows\System\DywsORl.exe
  C:\Windows\System\DywsORl.exe
  2⤵
  PID:11348
- C:\Windows\System\yRdYvEO.exe
  C:\Windows\System\yRdYvEO.exe
  2⤵
  PID:14320
- C:\Windows\System\ktHVjaV.exe
  C:\Windows\System\ktHVjaV.exe
  2⤵
  PID:11996
- C:\Windows\System\WgaCqRd.exe
  C:\Windows\System\WgaCqRd.exe
  2⤵
  PID:10788
- C:\Windows\System\XAkQKcR.exe
  C:\Windows\System\XAkQKcR.exe
  2⤵
  PID:10416
- C:\Windows\System\stDunnH.exe
  C:\Windows\System\stDunnH.exe
  2⤵
  PID:13108
- C:\Windows\System\hVxDHeb.exe
  C:\Windows\System\hVxDHeb.exe
  2⤵
  PID:13188
- C:\Windows\System\MCLeLxc.exe
  C:\Windows\System\MCLeLxc.exe
  2⤵
  PID:14140
- C:\Windows\System\MakIBih.exe
  C:\Windows\System\MakIBih.exe
  2⤵
  PID:11904
- C:\Windows\System\OBjyqaC.exe
  C:\Windows\System\OBjyqaC.exe
  2⤵
  PID:14152
- C:\Windows\System\idpnJAD.exe
  C:\Windows\System\idpnJAD.exe
  2⤵
  PID:6912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AxkDopx.exe

Path C:\Windows\System\AxkDopx.exe
Size 1.7MB
SHA256 5aa14c15e6f5cea05fc8c61f4a7f53acd1daafddf184b94526bc563bbccae616
MD5 1aad21198bc90ff736be05eb9f5326cd
SHA1 ae085a4716708b96b6d2e05b5c52f77f297eeecc
SHA512 c1e5e2442b9257b1c76116bdaf6aa2b959355ec14285bc857cbfcbf50a64eb1c9b0cbdecd73c0e63be5792de64ead04deaa6531942bb2b30046bc83eaa57fb44
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iC:ROdWCCi7/rahoyBcIKH0iAxWsUIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

GurFbQl.exe

Path C:\Windows\System\GurFbQl.exe
Size 1.7MB
SHA256 559f088c28ca2e187afa881cd97ec812ee539524c206ce1541a2db2459ac5c9b
MD5 c928470cae7518a569e1811af52c0536
SHA1 4320b40f32f2e82a3e1f742815214429830d944c
SHA512 900f7e19cc297a693a9de98c648fd69c471163419df4a5e62c7cd34da2f2763d6211ca1e7749d0649ea90a4ace7a0d24cbc336d761d2ccde70d0e665a75c1ebc
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iD:ROdWCCi7/rahoyBcIKH0iAxWsUIt
MD5 SHA1 SHA512 SSDEEP

Submit Download

KWwCACF.exe

Path C:\Windows\System\KWwCACF.exe
Size 1.7MB
SHA256 19a09cd74a449b8825306a0fdd19ed9620842dbf29743a997981ded3fa5a32a3
MD5 9f50671b871e416e0c5a4c3bda06cb67
SHA1 95812ec9c49ca9ffcfe03cac23f83458c44f48bd
SHA512 1a31383848cdd25069e9af1480a374d045bb7d91dee38910884376afef6629d4ccbe33adf3864a6458778c7b905a50023a456a6ca8ab9ed7920490d3eb59e16e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iI:ROdWCCi7/rahoyBcIKH0iAxWsUIC
MD5 SHA1 SHA512 SSDEEP

Submit Download

LISSNNZ.exe

Path C:\Windows\System\LISSNNZ.exe
Size 1.7MB
SHA256 e38fa451aa25ede458adf1ed5d3f59a0588a810d670ad68e9a22f650b758b2ee
MD5 7d115181f639ffbcf13cd7a864490b29
SHA1 cea6f8750cb978790a6f854df5201bff90c5ae18
SHA512 eb314512f69091164bdf73c55c113092b56923a97640bf16c9ebd660c9c3695b6635d207729f76020b91841bf108405a73a87eafb0a8cb3174ba6f79e6c40595
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i6:ROdWCCi7/rahoyBcIKH0iAxWsUIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OKXeHxA.exe

Path C:\Windows\System\OKXeHxA.exe
Size 1.7MB
SHA256 99496a16286e10d0a495899c536acd6cfeceeefa3c3c2894be8987fd65aa751f
MD5 64ce33bbdda82128df41fa1d801d2e0c
SHA1 624d1386bcba84cb10ec42c16843d97c849b0936
SHA512 ea7c7ae54ad4a140a40fd191f0e8d8b5be04b38a928c7871394c113fae28b454f689beff024affebeb45eb8004d4d0aba646ab7bdacc9cf9f4e86a69a71d6156
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2ia:ROdWCCi7/rahoyBcIKH0iAxWsUIQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PETFhde.exe

Path C:\Windows\System\PETFhde.exe
Size 1.7MB
SHA256 037692c92ee82414687d7de53c55526b81f3edfc773ca5b4b27d65fdf58bd16c
MD5 d49d6399d169d075fd63d516463f0b60
SHA1 965026dd13c78408a4aeeb6a06f27de2d684c78b
SHA512 7c00a6623c4e49c02434b6dd5aba6546277ca8e6e4a9605a2c06c8cd5a947b047ca930c94c5588319acd4fcddb1a2b8909184267575fc7ebfa538d8065ab6d06
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iT:ROdWCCi7/rahoyBcIKH0iAxWsUIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

QosCWhh.exe

Path C:\Windows\System\QosCWhh.exe
Size 1.7MB
SHA256 1b0eeb67cbf4a22803ae74ca66a55f232238f068b7164b63fe50886f267ee9be
MD5 48c1d6129e08bde53ce42d6d61c0e7fe
SHA1 2d9a7efbef24b9314aeeadb9357bd12ff9d979c9
SHA512 af6ec32d1c838559af0841d0d35462e3fc990de39b903a8b99a316b569ec13552845a7375d115db2c76c2b7810d64fec93f3cdb87c9b7293dbb67d6d195940ac
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iY:ROdWCCi7/rahoyBcIKH0iAxWsUIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

TRFUDId.exe

Path C:\Windows\System\TRFUDId.exe
Size 1.7MB
SHA256 7cf2536252698c8b80db06b5d8acb08d804fa52623b07fb36fbb31ec13a5b349
MD5 1309851fb46bdde6e44b0aa2cfad01f2
SHA1 71a3518586fa4783ae72b6c6edb1a5ce27dd4025
SHA512 56d19b9da2857a187d5ca00e769adffd910d443ae613f943801fe77039e9904aa67295d9a6acbf7d702cebe77e2d5dd9cbe033c440165186aea59f3e5fc0a4a7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2ij:ROdWCCi7/rahoyBcIKH0iAxWsUIXB
MD5 SHA1 SHA512 SSDEEP

Submit Download

TXAqqim.exe

Path C:\Windows\System\TXAqqim.exe
Size 1.7MB
SHA256 2184749a3e93c2e3dfda4bc949900397b43e0c6856c4b2af8deea99efa1361ff
MD5 3a3e4ce46f837fe6d29ea5160cf78665
SHA1 e5754f5ba1442b8190092fa9cadbe686d1e90e80
SHA512 31ac3d0bea3408d27a22c7ba2a7138ef57d0de8c62b8a870e4bd4a856ecb69705dd092adc66cb9fa41c036f896ff139aaab62e0357f3967fd16b8172ddd81813
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i6:ROdWCCi7/rahoyBcIKH0iAxWsUIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

UBHknAA.exe

Path C:\Windows\System\UBHknAA.exe
Size 1.7MB
SHA256 521b0fecbf66adba455abd245d338f22de460a8ae938eb53fef37ce1c3359d1e
MD5 7840a824fdf7b085000923095777d744
SHA1 70b946bf3b535e526b42e6ce38fa27efc24b4439
SHA512 0535e729d0fc6f3760fa4cccb53f14fa40856dd4dce7e0e47380d30b8ff9861e13f6b543d0591a3629ffed54ab9f80dce8c52649f9c780510259a17ac8f6dfa2
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iS:ROdWCCi7/rahoyBcIKH0iAxWsUI8
MD5 SHA1 SHA512 SSDEEP

Submit Download

UvyNfvR.exe

Path C:\Windows\System\UvyNfvR.exe
Size 1.7MB
SHA256 e2217b83df732dc6825e954c9741884fecfc6b8d42a2c779a4e4eff49e56adbb
MD5 092ddbd4594939c9713db65272994d4f
SHA1 dcea09a57c55da075484b9d90bd731623eba1494
SHA512 db86a3dbe87248d0ef47f107295976c00805431d056748e9922772561065237a6598c5509e97b24addac947a2ceb8770848ea887029de93f4dd0464fdf778559
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iw:ROdWCCi7/rahoyBcIKH0iAxWsUIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

VDyHksW.exe

Path C:\Windows\System\VDyHksW.exe
Size 1.7MB
SHA256 db655812ba14e2f069b1368167e639efe45d25250b3c72aa7cee4647ffc870e2
MD5 c6dede1cc40261461f4ebec1c6da2d03
SHA1 9b7d65ac20ffbd48b15b5ffa9f6c348cd2dd1fc5
SHA512 18e01a50d4741025330fb6be59b9b3ed5dd608ddf846919c14f8989d4539bdf8e79b8feb2b60f7fbbb72a1db4f61ceb8a574732a53d18000ad04cd08c2fdf975
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2ii:ROdWCCi7/rahoyBcIKH0iAxWsUIU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VShLmwg.exe

Path C:\Windows\System\VShLmwg.exe
Size 1.7MB
SHA256 116d66b2034013ea59601ccf7c175f73d412f63dc77b387e0a27910309b4df26
MD5 cc5bd20cee6a523c54dd14d77e25d4b0
SHA1 b4d516bcc51f7e67ba6d112553e48b5e3ef4e3bc
SHA512 31c122ce879abaf0a9a79e1364313d11674a56f42b0f1ed3905272bec5a8884f43afd4c9da6f7ba01b692d71b101cae572b948259442e7c0656ab88677568929
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2id:ROdWCCi7/rahoyBcIKH0iAxWsUIz
MD5 SHA1 SHA512 SSDEEP

Submit Download

VaLOcXu.exe

Path C:\Windows\System\VaLOcXu.exe
Size 1.7MB
SHA256 130dc397c9a76d66508efdea94fdf4987f3063c287062e36a5acc2d0ea92535d
MD5 b35dbb4a2a13307ca1d49993fdfda95a
SHA1 4b336a9637585fe002939c10a2270b7e57c35d06
SHA512 e382e25fb95c79900524e0666d4a6fd5ca23afa414f98bb1d6d5c28f02123b65d057af3ddc74df02e87762ae6c9af7ef0b74624a4473a2250367347b819e8ca6
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iD:ROdWCCi7/rahoyBcIKH0iAxWsUIZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

XIjiGIn.exe

Path C:\Windows\System\XIjiGIn.exe
Size 1.7MB
SHA256 3add3940fc328ef0175599ce7e1f412de5dbc2d88687a24d9aff7a6c37128259
MD5 efdd94a937dda586685b301291703056
SHA1 77b34722f98fd55ca5b1734f8ae2b490f10da666
SHA512 0c13fab9868ea82afaa4eee0bb102759089acc53ef0d887779b581d915709df25b4dababa2743ceeb89ad0fd77727ecb89a042a7cc71c8ef44f188e7d6a44ed4
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iX:ROdWCCi7/rahoyBcIKH0iAxWsUIh
MD5 SHA1 SHA512 SSDEEP

Submit Download

YmcaFBm.exe

Path C:\Windows\System\YmcaFBm.exe
Size 1.7MB
SHA256 dfbe46d715995d6e476cca141ecca674956a9774fe01deff39fbb0dfd5216204
MD5 376ee0944fd94fccf9bc3ee83dcd364e
SHA1 c53e30b36d3eaf53f7516f7e786c805a1afff038
SHA512 e8eed0ea867cdcfe6c9bda331b7cd317a7e90ae6115cce9f90cbba064fa2ff94994fe12489e7e3c4535cbe89a6573fda72b2fdc4d10512ca978120bea74f25ef
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i4:ROdWCCi7/rahoyBcIKH0iAxWsUIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZhSfQTR.exe

Path C:\Windows\System\ZhSfQTR.exe
Size 1.7MB
SHA256 a5a32a23599abbff0d3cddd8f699c0ab0004d99de2796502749f4c1afc5fa78f
MD5 68f1bcbac3244a5efd774972c8eeec04
SHA1 126e32fa232aea4334aaa8fbbfa6aa75f058a016
SHA512 dba220071e53094c00868389c778a32b4ac292b34f88cf0227d88860ee7006860378c8b21c1341bf8a02b771b476cbf37abf2af6ab3ae2cbcb2f1ed59c27df01
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iu:ROdWCCi7/rahoyBcIKH0iAxWsUI8
MD5 SHA1 SHA512 SSDEEP

Submit Download

apCDSOK.exe

Path C:\Windows\System\apCDSOK.exe
Size 1.7MB
SHA256 01a20ea7215f092e56797323511ab19402e21bddacc137ca59b12fe0ec85a06c
MD5 52dbb27edcfea21e16ba9af193ffe141
SHA1 f83b57f3c961a9c61d33c3c3a4994375f0cbbb9d
SHA512 5e5b00804ef89592f62728492310efd4e4b3b716815b58cb66002306c188782cf14e05b09608f51207aa277f7cb0945e175698998f55a1e3aaaf50aef182a388
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i7:ROdWCCi7/rahoyBcIKH0iAxWsUIK8
MD5 SHA1 SHA512 SSDEEP

Submit Download

boqyzdA.exe

Path C:\Windows\System\boqyzdA.exe
Size 1.7MB
SHA256 5f92735bcd66a937186a8f5e3cd3556afcb067e2902986f3a7834439651f2789
MD5 f02fd19e9b2c1928c4f4ce139ddf2ff6
SHA1 5926436489bcdebe991646c69053c6fa78bb7ab7
SHA512 b363cfad6b4cd9d18afc0f0deaf418641baf0009b23a3117f4d6e1e4749d01029bf74b457559f5d1b08676c682a1ba0005cc2a7a8c89207f5e1168c9670e7810
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i4:ROdWCCi7/rahoyBcIKH0iAxWsUIG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dlaCzAy.exe

Path C:\Windows\System\dlaCzAy.exe
Size 1.7MB
SHA256 10ee8136ee97fbe9289a5e0fcc8fa85104540490e25e20069b409fd7b80dc774
MD5 b269e5bacde9b8722b1fbc6d5e85108f
SHA1 9228e5fe42f849871968e9a0b1881abdda517e63
SHA512 7488bed9bbe712d0f2fca267c98af1a644a13e777aa7fd7919080c3145df148115db9218086e2c47ab47faf636c91d9eb62f4028ccaf09250fadc857bc9af69d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iU:ROdWCCi7/rahoyBcIKH0iAxWsUIe
MD5 SHA1 SHA512 SSDEEP

Submit Download

gsvkfvk.exe

Path C:\Windows\System\gsvkfvk.exe
Size 1.7MB
SHA256 cd879b3c977a4cf436556cb4b7c5b730d2db470f4e05366c26f43b4ffcbb9fa0
MD5 6b702fd24cf4f3469bdc34a398130a11
SHA1 b5bff9dbd76caaea001582c2fcefd8bddefb7746
SHA512 d612f7e140887a4aaada51352fdcb3914723435bce19a7f2dbb898760d9687ecf35cd7cd3662d79382012139ba2d38244207af28deaad0fe2233aaa9a8d4d42f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i3:ROdWCCi7/rahoyBcIKH0iAxWsUIh
MD5 SHA1 SHA512 SSDEEP

Submit Download

iIlxuuI.exe

Path C:\Windows\System\iIlxuuI.exe
Size 1.7MB
SHA256 74cc253705331c5a977c013cf994889936accf637039a642df937c37249ad1f1
MD5 784180f5e70eb54330e74fe376472e6e
SHA1 6e683ec4a87415e065431ad27947d5e6ec625bbd
SHA512 a1f5437d5b6c21e89d3c22d663db5073ea893dd11a51adecdc85ae119096be8e9932bd93179322079b17412507172ec098008dfae4dc937f5e386612cd3940c9
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2ib:ROdWCCi7/rahoyBcIKH0iAxWsUIF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iJhqpuW.exe

Path C:\Windows\System\iJhqpuW.exe
Size 1.7MB
SHA256 bbd07f18b5e23d84430826f53870a04a68f6b02533678effce90f5ca7ea2a4b5
MD5 13e7a5ea05860b2bea43ad43077b9d14
SHA1 ed909e072691e3c8824608e742411671785412af
SHA512 2b450947a7e086bee051e3463723cfe55434175e1fbbe3c3fc96307d5b0f4343de86083275b3bc81af24606c8186a508dcae620f7b2438279cd53da154e8e3d9
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2ip:ROdWCCi7/rahoyBcIKH0iAxWsUI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

iTJXlOO.exe

Path C:\Windows\System\iTJXlOO.exe
Size 1.7MB
SHA256 2435ca257380fc2a0a194b6c4953f0832162d97614778d5416a06664dc08b02e
MD5 695e89bd194c527cccf354f636d97b39
SHA1 c69c6e0a8025817b67c1d36f62c5513c897639e1
SHA512 2a0751916448e07c004c31d04b51d89dfdd31cf93708df224ba0ac4a71021833e383b606f5eaaecaa6a7862e49ea5e485bf094ef8511e4f80e345699ee04ab0c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i0:ROdWCCi7/rahoyBcIKH0iAxWsUIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjAvCzu.exe

Path C:\Windows\System\jjAvCzu.exe
Size 1.7MB
SHA256 0f154a742091c4402e27dad10142d40c9a15cc8d51743d7db41a375d6b8547a6
MD5 768c15eb5f6c3ca0942cbd1c1952826d
SHA1 57bb10b0168c5ed449b89e796e8268eeab02a8f4
SHA512 dfb2c4d34c5b906fb28fb27a89d074a23370d8c0197da8afbdc6b900fb2b04550974844c42ab141ec78f51a81a3c1271179ee5bd3a57496fcc525e84a7d0c02e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i1:ROdWCCi7/rahoyBcIKH0iAxWsUIP
MD5 SHA1 SHA512 SSDEEP

Submit Download

mYrzDeH.exe

Path C:\Windows\System\mYrzDeH.exe
Size 1.7MB
SHA256 1b79d1477787ba2a65fb713303ee5fdbbaaa7e5bbc6d7779046aacb24ce8f2c2
MD5 96173a0962859d5762f985d7fa8439e1
SHA1 8448c8109649094e2e8cf496df231f724e0d1278
SHA512 ff376248247cac4a4648b014f7b5a42193fac294735e2d472ce8a5dc8e526c417ee977b4fe33d0372a1408ea6849fbcd8cedf6b4760b19ca0b44e0c46e08a6b1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2io:ROdWCCi7/rahoyBcIKH0iAxWsUIu
MD5 SHA1 SHA512 SSDEEP

Submit Download

nGzHSHe.exe

Path C:\Windows\System\nGzHSHe.exe
Size 1.7MB
SHA256 a4f11dd4c016ad1d19fdff17821c0719b8c4693ecc4642161fd4e0efe95f0cd0
MD5 eae0d1cd517e75118e37bfab2ac948cc
SHA1 1049467a90c858b4dda74a40c0f286c44b81e2d3
SHA512 db3c65c3df889a7932780083c6d0f20e7e042eedf5dfcc6ee9a37d3f707225aca8d26fa8ca5c8814ab6ef5f31c25447beb1259a28c0421bcc23b5e237f7f9441
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2im:ROdWCCi7/rahoyBcIKH0iAxWsUI4
MD5 SHA1 SHA512 SSDEEP

Submit Download

pSuXBLu.exe

Path C:\Windows\System\pSuXBLu.exe
Size 1.7MB
SHA256 7912b1409698088ec2c0b17a5e50cbdc12589fce6461eede32d6e3f8811b2e5d
MD5 6f5de33031179a5e4847286e51e792b3
SHA1 08850996c9ec00aaaf7b850e7e9a7bf91b959c3b
SHA512 61d191b5daa4b7b0bd5ee813cc6f0f8c1c2c6ee285ce6514dbae6cb1723262f43e4acf25a47b63323d7d3e8336f109e39220cb93c2cd099f10319009b0fa6bb3
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iB:ROdWCCi7/rahoyBcIKH0iAxWsUID
MD5 SHA1 SHA512 SSDEEP

Submit Download

peIMHlo.exe

Path C:\Windows\System\peIMHlo.exe
Size 1.7MB
SHA256 6af293b50a043866743ef4fcaed21135c4858c5a286b5368e8c15ad6ff7aa1d3
MD5 25dc8cec00fe70cffbe61bf924db8413
SHA1 8f3365491be7f2ddaefb00377514c8f74f4fe6c3
SHA512 486bf10da896b28eb50d80ae372826b741465f7611bfb871f5b279165c07b3cc0750036ab99802e66e607de046ea5e29148c8082e7ceab027b0abdf7f1061ced
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i5:ROdWCCi7/rahoyBcIKH0iAxWsUIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

qNUmrEA.exe

Path C:\Windows\System\qNUmrEA.exe
Size 1.7MB
SHA256 fd2c53a929164e80eaa6ba05281335ee8bd3e2ef9c7b2bbfb580bad331dc782b
MD5 8c1e706462e81b51aa68fc08fb48e090
SHA1 84c0f83f765a734da7488cc0b80ff78614d593b4
SHA512 522d223f908ab5e2f9a5215e35b4c7c216c968acd5df10a697e9176e77f97f87cde1c54f910b1b9773b2107df4439f666d772360cfa9d2ca1b1166025cf86082
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i4:ROdWCCi7/rahoyBcIKH0iAxWsUIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

uVTSReN.exe

Path C:\Windows\System\uVTSReN.exe
Size 1.7MB
SHA256 36caab6a78e9f2b1ff7a37a1bab4e5bfcb493c2cc684fb78788912d58929e003
MD5 fe4ab7794631618f744acc58f5c17f1f
SHA1 089aa6092e3d30aa7ca0e44604b2b86e9e83e8e0
SHA512 b679d90d4c5dc190f68fa4aebc5f5025f6ea9ba5609129ce3458b17e4ba48839d95743f49f0738d1052abdfbf4ba2a9d36294862866d5f2f00f51b279575bed4
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iG:ROdWCCi7/rahoyBcIKH0iAxWsUIc
MD5 SHA1 SHA512 SSDEEP

Submit Download

vAGINsf.exe

Path C:\Windows\System\vAGINsf.exe
Size 1.7MB
SHA256 da39aa1d40b11793e799fe63c2a72b38c6beb6e59de77513bd024917b1291861
MD5 01c9f721c38a60350594a73c86ea35b9
SHA1 6b8a0aaca65e1f35a7e5ceffc9134d8594aab8b5
SHA512 4ab99d73083513287173505f76e794000c7216419eae3a2d91bd82e5fca10349ddb763ec1ee6218862fda6fa89b3b7dbf970a454d3c2de9437a2586e6cc52362
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2ih:ROdWCCi7/rahoyBcIKH0iAxWsUIL
MD5 SHA1 SHA512 SSDEEP

Submit Download

vByUeJE.exe

Path C:\Windows\System\vByUeJE.exe
Size 1.7MB
SHA256 71c76877bc3f748c0fd5529a77b74dbbbe7acb092dc25d88c1a5eec321255a57
MD5 344a91c3b56a66db2f97c3a230b373c3
SHA1 93012d0128fb928447cd681d06a0c426cff8e572
SHA512 c3b8e2209daed48c00a49046c2cf78cfd783f5f54356e8f6af0b215e9e56df868f5886d831da541fb70e78fb7f5bd4097ae1da1b0271bf7356d8854f2da50b7a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2i0:ROdWCCi7/rahoyBcIKH0iAxWsUIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vnamZSk.exe

Path C:\Windows\System\vnamZSk.exe
Size 1.7MB
SHA256 7c1799a711397149787d7db59555be7ddc484c28ad468332eb324483376558e1
MD5 8643c4d335ceada10e2e0ef91bd01a4a
SHA1 916ef1c1dc067b38d54e7cd669f329b9cd66e8f6
SHA512 7764a5c4692baba990ee98443bb50dd5e1ffa69880403edebb971f73d47e4f18546804dd4312985d0b265a7f7530bac0c0e02abc1d7d835d9c5cf6022781c53e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iL:ROdWCCi7/rahoyBcIKH0iAxWsUIJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vqvwgjY.exe

Path C:\Windows\System\vqvwgjY.exe
Size 1.7MB
SHA256 9df24d043648fe42925e33b204941ec9df6178995b3b7f45a758515e7141d230
MD5 e2e48e49a780922df70ce41c71add4f6
SHA1 5cdc4dcab4b753a387e01d5f92956307639dafd0
SHA512 bd263ec6e629f389118886395b850c1fc823f8b1b56d7b268161f898586686cd1e7d5840bdc469eb573c202d171e9038c1934ce36a075646e84a9de89cbe9849
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iw:ROdWCCi7/rahoyBcIKH0iAxWsUIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wlPrlaB.exe

Path C:\Windows\System\wlPrlaB.exe
Size 1.7MB
SHA256 dc701b2ab2a3bb0beae7148a4608741e39add57f515f6c89880e90a1b9b10579
MD5 73eb1c8ce01f855dcf9d6c61c9ac99ed
SHA1 8339d01bed3b54ffb6ffa8610f466bfc200166e8
SHA512 537192067126badfffadd636281e84cfe48433a7df21a729c725bc3f1f93ff9d05f368b6791ad23c133cc163b50126efb9096a6e477cd738f1ea2d412e749321
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iq:ROdWCCi7/rahoyBcIKH0iAxWsUIg
MD5 SHA1 SHA512 SSDEEP

Submit Download

xVupIdr.exe

Path C:\Windows\System\xVupIdr.exe
Size 1.7MB
SHA256 dcc5690ac2c3efd8accf100d779e4c97723f7e60de8702f2a67e4f61f6168ba3
MD5 f6d5dfc6a2e4b9d29dd240085a8412d5
SHA1 79e38e56f5da8a58c8b195a01180ad7d6fe03d3e
SHA512 f099208af2b4af34c08468c0d8de29f34786c655f5a610df9f01895c21c0bd1268864fecd8cbde33abb5165508aed14af518503890bafbbe94a58763912b3afe
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iX:ROdWCCi7/rahoyBcIKH0iAxWsUIF
MD5 SHA1 SHA512 SSDEEP

Submit Download

yKWtMtT.exe

Path C:\Windows\System\yKWtMtT.exe
Size 1.7MB
SHA256 104c00c0de1d06c544cb23d95d248870db7bc3aab25abb06af0d39e411963a83
MD5 55d12657463fa3f8f23841da48866023
SHA1 4db39aa07c8be9d377b7703230f450e1ea9fc709
SHA512 04ea1b6528e64686a6dae0752569e22e8ecb24350e10eb99edd9a3cbca4dbb2d18aaf6ce20706870895f6fea3fa04328d1ffe639abb35d28307557686bba2f63
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2ic:ROdWCCi7/rahoyBcIKH0iAxWsUIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ybuHIXi.exe

Path C:\Windows\System\ybuHIXi.exe
Size 1.7MB
SHA256 f819cdd435ae675ff1c205a62886a6f3eaee8dbd4df468fe2795a6101d022c92
MD5 d92f364fac22cd8bb412768b86994b05
SHA1 bba1ed4d1f1e8803a353c5eecc888ae26176a3be
SHA512 5a2ed5958115139a5479e62e57e88508840fab0fda89a9236eaf7ccf2a0256e6dbf44560dd1d891b80a8038f093488a395e9cfe9510f017acb463848d549010b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2ic:ROdWCCi7/rahoyBcIKH0iAxWsUIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

yuNVcwL.exe

Path C:\Windows\System\yuNVcwL.exe
Size 1.7MB
SHA256 6cdfa52108bbb73823b7c19f0d06cf241835ef8f3ca591b5cb2e3b806f57b6b5
MD5 324e140bb93483d776480d5b752c72c0
SHA1 d58803166233d92287121b8e56db067173dff146
SHA512 a3815d3789d358a47e3ae26b13c798dd00045a469673e07d4275902a639cf57ad96c5ba375d7beb70949214132a8611b65c31242fc6b8495fb695f96f8a55315
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pYJh5MHHRDQxgSvyH0iGTxWstt80Ew2iw:ROdWCCi7/rahoyBcIKH0iAxWsUIG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/32-160-0x00007FF6C2530000-0x00007FF6C2881000-memory.dmp

Download

memory/32-2453-0x00007FF6C2530000-0x00007FF6C2881000-memory.dmp

Download

memory/440-163-0x00007FF687DF0000-0x00007FF688141000-memory.dmp

Download

memory/440-2499-0x00007FF687DF0000-0x00007FF688141000-memory.dmp

Download

memory/840-221-0x00007FF7C3190000-0x00007FF7C34E1000-memory.dmp

Download

memory/840-2431-0x00007FF7C3190000-0x00007FF7C34E1000-memory.dmp

Download

memory/848-2317-0x00007FF7709A0000-0x00007FF770CF1000-memory.dmp

Download

memory/848-0-0x00007FF7709A0000-0x00007FF770CF1000-memory.dmp

Download

memory/848-1-0x00000288F2D10000-0x00000288F2D20000-memory.dmp

Download

memory/852-350-0x00007FF6E9260000-0x00007FF6E95B1000-memory.dmp

Download

memory/852-2522-0x00007FF6E9260000-0x00007FF6E95B1000-memory.dmp

Download

memory/1008-2425-0x00007FF710320000-0x00007FF710671000-memory.dmp

Download

memory/1008-47-0x00007FF710320000-0x00007FF710671000-memory.dmp

Download

memory/1008-2415-0x00007FF710320000-0x00007FF710671000-memory.dmp

Download

memory/1052-2439-0x00007FF6FBF30000-0x00007FF6FC281000-memory.dmp

Download

memory/1052-467-0x00007FF6FBF30000-0x00007FF6FC281000-memory.dmp

Download

memory/1084-77-0x00007FF651F80000-0x00007FF6522D1000-memory.dmp

Download

memory/1084-2437-0x00007FF651F80000-0x00007FF6522D1000-memory.dmp

Download

memory/1084-2416-0x00007FF651F80000-0x00007FF6522D1000-memory.dmp

Download

memory/1284-81-0x00007FF779AE0000-0x00007FF779E31000-memory.dmp

Download

memory/1284-2427-0x00007FF779AE0000-0x00007FF779E31000-memory.dmp

Download

memory/1412-2423-0x00007FF665CB0000-0x00007FF666001000-memory.dmp

Download

memory/1412-2417-0x00007FF665CB0000-0x00007FF666001000-memory.dmp

Download

memory/1412-27-0x00007FF665CB0000-0x00007FF666001000-memory.dmp

Download

memory/1572-2475-0x00007FF71C330000-0x00007FF71C681000-memory.dmp

Download

memory/1572-190-0x00007FF71C330000-0x00007FF71C681000-memory.dmp

Download

memory/1728-128-0x00007FF6AF330000-0x00007FF6AF681000-memory.dmp

Download

memory/1728-2441-0x00007FF6AF330000-0x00007FF6AF681000-memory.dmp

Download

memory/1956-2504-0x00007FF65FDC0000-0x00007FF660111000-memory.dmp

Download

memory/1956-220-0x00007FF65FDC0000-0x00007FF660111000-memory.dmp

Download

memory/1960-2419-0x00007FF7407C0000-0x00007FF740B11000-memory.dmp

Download

memory/1960-23-0x00007FF7407C0000-0x00007FF740B11000-memory.dmp

Download

memory/2300-298-0x00007FF6CAED0000-0x00007FF6CB221000-memory.dmp

Download

memory/2300-2506-0x00007FF6CAED0000-0x00007FF6CB221000-memory.dmp

Download

memory/2376-325-0x00007FF697F30000-0x00007FF698281000-memory.dmp

Download

memory/2376-2532-0x00007FF697F30000-0x00007FF698281000-memory.dmp

Download

memory/2960-270-0x00007FF6E23E0000-0x00007FF6E2731000-memory.dmp

Download

memory/2960-2508-0x00007FF6E23E0000-0x00007FF6E2731000-memory.dmp

Download

memory/2976-464-0x00007FF6E51E0000-0x00007FF6E5531000-memory.dmp

Download

memory/2976-2436-0x00007FF6E51E0000-0x00007FF6E5531000-memory.dmp

Download

memory/3144-2510-0x00007FF69A8D0000-0x00007FF69AC21000-memory.dmp

Download

memory/3144-564-0x00007FF69A8D0000-0x00007FF69AC21000-memory.dmp

Download

memory/3288-329-0x00007FF71CE90000-0x00007FF71D1E1000-memory.dmp

Download

memory/3288-2520-0x00007FF71CE90000-0x00007FF71D1E1000-memory.dmp

Download

memory/3348-2421-0x00007FF786B50000-0x00007FF786EA1000-memory.dmp

Download

memory/3348-428-0x00007FF786B50000-0x00007FF786EA1000-memory.dmp

Download

memory/3368-505-0x00007FF65C970000-0x00007FF65CCC1000-memory.dmp

Download

memory/3368-2433-0x00007FF65C970000-0x00007FF65CCC1000-memory.dmp

Download

memory/3796-2489-0x00007FF7C6430000-0x00007FF7C6781000-memory.dmp

Download

memory/3796-249-0x00007FF7C6430000-0x00007FF7C6781000-memory.dmp

Download

memory/3844-2538-0x00007FF654050000-0x00007FF6543A1000-memory.dmp

Download

memory/3844-384-0x00007FF654050000-0x00007FF6543A1000-memory.dmp

Download

memory/4376-508-0x00007FF78CE50000-0x00007FF78D1A1000-memory.dmp

Download

memory/4376-2473-0x00007FF78CE50000-0x00007FF78D1A1000-memory.dmp

Download

memory/4720-2498-0x00007FF6C2080000-0x00007FF6C23D1000-memory.dmp

Download

memory/4720-250-0x00007FF6C2080000-0x00007FF6C23D1000-memory.dmp

Download

memory/4848-2512-0x00007FF685B10000-0x00007FF685E61000-memory.dmp

Download

memory/4848-299-0x00007FF685B10000-0x00007FF685E61000-memory.dmp

Download

memory/4880-2429-0x00007FF60B6B0000-0x00007FF60BA01000-memory.dmp

Download

memory/4880-123-0x00007FF60B6B0000-0x00007FF60BA01000-memory.dmp

Download

memory/5028-2502-0x00007FF69AF20000-0x00007FF69B271000-memory.dmp

Download

memory/5028-374-0x00007FF69AF20000-0x00007FF69B271000-memory.dmp

Download

memory/5084-2528-0x00007FF7CC430000-0x00007FF7CC781000-memory.dmp

Download

memory/5084-381-0x00007FF7CC430000-0x00007FF7CC781000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads