xmrig | d2401ed916695cc8c71ff64ac0c143bd1d3f8fa15b085119dea9b3dc9e587318

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
Size 1.7MB
Sample240522-1y5dfaaf97
SHA256 d2401ed916695cc8c71ff64ac0c143bd1d3f8fa15b085119dea9b3dc9e587318
MD5 476fc642a1660ea1f73e7bebc9cfd7d0
SHA1 5a8d5c0ef176a0c9ec8fdfba5c96f2b412120c29
SHA512 d725b7a08cfa08d55447fa2640c31a7216becb590c064a928207b6425d33932818ad8522f08432058665cdbca90f4388caa5ddd2a474889626001114467844b1
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqM:RWWBibaQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/796-553-0x00007FF62BFF0000-0x00007FF62C341000-memory.dmp	xmrig
behavioral2/memory/3924-555-0x00007FF68EDE0000-0x00007FF68F131000-memory.dmp	xmrig
behavioral2/memory/1236-554-0x00007FF783740000-0x00007FF783A91000-memory.dmp	xmrig
behavioral2/memory/4484-556-0x00007FF7FFA00000-0x00007FF7FFD51000-memory.dmp	xmrig
behavioral2/memory/2972-557-0x00007FF66B0E0000-0x00007FF66B431000-memory.dmp	xmrig
behavioral2/memory/5088-586-0x00007FF7D65F0000-0x00007FF7D6941000-memory.dmp	xmrig
behavioral2/memory/1112-599-0x00007FF6458D0000-0x00007FF645C21000-memory.dmp	xmrig
behavioral2/memory/4248-607-0x00007FF627400000-0x00007FF627751000-memory.dmp	xmrig
behavioral2/memory/1380-627-0x00007FF7903C0000-0x00007FF790711000-memory.dmp	xmrig
behavioral2/memory/1368-630-0x00007FF604140000-0x00007FF604491000-memory.dmp	xmrig
behavioral2/memory/772-635-0x00007FF6D5F90000-0x00007FF6D62E1000-memory.dmp	xmrig
behavioral2/memory/5028-624-0x00007FF75AC30000-0x00007FF75AF81000-memory.dmp	xmrig
behavioral2/memory/2280-623-0x00007FF6465D0000-0x00007FF646921000-memory.dmp	xmrig
behavioral2/memory/2548-620-0x00007FF7353D0000-0x00007FF735721000-memory.dmp	xmrig
behavioral2/memory/4864-616-0x00007FF633820000-0x00007FF633B71000-memory.dmp	xmrig
behavioral2/memory/1056-615-0x00007FF7EAF80000-0x00007FF7EB2D1000-memory.dmp	xmrig
behavioral2/memory/4624-608-0x00007FF62D270000-0x00007FF62D5C1000-memory.dmp	xmrig
behavioral2/memory/3716-606-0x00007FF607F50000-0x00007FF6082A1000-memory.dmp	xmrig
behavioral2/memory/4516-605-0x00007FF69DEA0000-0x00007FF69E1F1000-memory.dmp	xmrig
behavioral2/memory/4700-581-0x00007FF7C2670000-0x00007FF7C29C1000-memory.dmp	xmrig
behavioral2/memory/4356-576-0x00007FF6A36F0000-0x00007FF6A3A41000-memory.dmp	xmrig
behavioral2/memory/1524-573-0x00007FF74ECD0000-0x00007FF74F021000-memory.dmp	xmrig
behavioral2/memory/4200-569-0x00007FF700C90000-0x00007FF700FE1000-memory.dmp	xmrig
behavioral2/memory/4580-656-0x00007FF7A24B0000-0x00007FF7A2801000-memory.dmp	xmrig
behavioral2/memory/4416-661-0x00007FF66BE90000-0x00007FF66C1E1000-memory.dmp	xmrig
behavioral2/memory/4828-675-0x00007FF71E030000-0x00007FF71E381000-memory.dmp	xmrig
behavioral2/memory/1600-670-0x00007FF6475F0000-0x00007FF647941000-memory.dmp	xmrig
behavioral2/memory/212-2178-0x00007FF7D7D20000-0x00007FF7D8071000-memory.dmp	xmrig
behavioral2/memory/3216-2214-0x00007FF7AD9E0000-0x00007FF7ADD31000-memory.dmp	xmrig
behavioral2/memory/1140-2215-0x00007FF70D2A0000-0x00007FF70D5F1000-memory.dmp	xmrig
behavioral2/memory/3216-2223-0x00007FF7AD9E0000-0x00007FF7ADD31000-memory.dmp	xmrig
behavioral2/memory/796-2225-0x00007FF62BFF0000-0x00007FF62C341000-memory.dmp	xmrig
behavioral2/memory/1140-2227-0x00007FF70D2A0000-0x00007FF70D5F1000-memory.dmp	xmrig
behavioral2/memory/1236-2230-0x00007FF783740000-0x00007FF783A91000-memory.dmp	xmrig
behavioral2/memory/4828-2231-0x00007FF71E030000-0x00007FF71E381000-memory.dmp	xmrig
behavioral2/memory/3924-2233-0x00007FF68EDE0000-0x00007FF68F131000-memory.dmp	xmrig
behavioral2/memory/4484-2235-0x00007FF7FFA00000-0x00007FF7FFD51000-memory.dmp	xmrig
behavioral2/memory/2972-2237-0x00007FF66B0E0000-0x00007FF66B431000-memory.dmp	xmrig
behavioral2/memory/4200-2241-0x00007FF700C90000-0x00007FF700FE1000-memory.dmp	xmrig
behavioral2/memory/1524-2240-0x00007FF74ECD0000-0x00007FF74F021000-memory.dmp	xmrig
behavioral2/memory/4356-2243-0x00007FF6A36F0000-0x00007FF6A3A41000-memory.dmp	xmrig
behavioral2/memory/4700-2247-0x00007FF7C2670000-0x00007FF7C29C1000-memory.dmp	xmrig
behavioral2/memory/4516-2257-0x00007FF69DEA0000-0x00007FF69E1F1000-memory.dmp	xmrig
behavioral2/memory/1056-2259-0x00007FF7EAF80000-0x00007FF7EB2D1000-memory.dmp	xmrig
behavioral2/memory/2280-2263-0x00007FF6465D0000-0x00007FF646921000-memory.dmp	xmrig
behavioral2/memory/5028-2267-0x00007FF75AC30000-0x00007FF75AF81000-memory.dmp	xmrig
behavioral2/memory/1380-2269-0x00007FF7903C0000-0x00007FF790711000-memory.dmp	xmrig
behavioral2/memory/2548-2265-0x00007FF7353D0000-0x00007FF735721000-memory.dmp	xmrig
behavioral2/memory/4864-2261-0x00007FF633820000-0x00007FF633B71000-memory.dmp	xmrig
behavioral2/memory/1112-2256-0x00007FF6458D0000-0x00007FF645C21000-memory.dmp	xmrig
behavioral2/memory/3716-2253-0x00007FF607F50000-0x00007FF6082A1000-memory.dmp	xmrig
behavioral2/memory/4248-2252-0x00007FF627400000-0x00007FF627751000-memory.dmp	xmrig
behavioral2/memory/4624-2249-0x00007FF62D270000-0x00007FF62D5C1000-memory.dmp	xmrig
behavioral2/memory/5088-2246-0x00007FF7D65F0000-0x00007FF7D6941000-memory.dmp	xmrig
behavioral2/memory/1600-2291-0x00007FF6475F0000-0x00007FF647941000-memory.dmp	xmrig
behavioral2/memory/772-2277-0x00007FF6D5F90000-0x00007FF6D62E1000-memory.dmp	xmrig
behavioral2/memory/1368-2276-0x00007FF604140000-0x00007FF604491000-memory.dmp	xmrig
behavioral2/memory/4416-2273-0x00007FF66BE90000-0x00007FF66C1E1000-memory.dmp	xmrig
behavioral2/memory/4580-2272-0x00007FF7A24B0000-0x00007FF7A2801000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3216	JkQKlCj.exe
1140	aVFqEjc.exe
796	iRrTvSS.exe
1236	JsACqEg.exe
4828	innJABZ.exe
3924	EvcdjpE.exe
4484	xAYQWpv.exe
2972	UxksseR.exe
4200	xcByRlu.exe
1524	nRIYkkh.exe
4356	kOSPdem.exe
4700	PDDnHxr.exe
5088	IJrcShB.exe
1112	ZZFMqYb.exe
4516	MrezGfS.exe
3716	BLkGryd.exe
4248	DfezMaQ.exe
4624	tmLjQgx.exe
1056	nMTQnAk.exe
4864	kuXzKYB.exe
2548	nRSFHws.exe
2280	puWkAVV.exe
5028	ePGJbnn.exe
1380	qDIOlxk.exe
1368	ftRLTwM.exe
772	JcGdjyc.exe
4580	CYxBroO.exe
4416	afRxsEL.exe
1600	dbQqmEY.exe
2416	vxeISSK.exe
2124	PrSQIrr.exe
3092	AdsinbJ.exe
224	KAFucjK.exe
3228	MAtDvEK.exe
3424	HDfqUEc.exe
1864	XRGwuYF.exe
960	jyWgyTp.exe
2328	DLQaNZd.exe
1256	qNfptxz.exe
4684	JeXJcqt.exe
2412	RRVakIO.exe
4860	NyUDCOU.exe
3268	IEesnfB.exe
4564	RZAlpRF.exe
2688	HoLUNpq.exe
1012	hVEXyWa.exe
2544	qUCVcjd.exe
3584	dveadWL.exe
4900	CkavvRy.exe
3748	DwqbVxn.exe
3328	FBXGEnD.exe
4508	oKZCzfR.exe
4340	myqiFao.exe
1936	yjsIjUJ.exe
2696	jGTGBvF.exe
1516	zDSKfUg.exe
3616	ijApPIn.exe
1952	cTyFgyG.exe
4616	SEBARIA.exe
2292	HytaryY.exe
1144	lxghcQb.exe
2044	vMnwqPX.exe
4924	siYDFKR.exe
2672	uWqEBko.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/212-0-0x00007FF7D7D20000-0x00007FF7D8071000-memory.dmp	upx
behavioral2/files/0x000a00000002346a-5.dat	upx
behavioral2/files/0x0007000000023473-7.dat	upx
behavioral2/files/0x0007000000023472-15.dat	upx
behavioral2/files/0x0007000000023474-19.dat	upx
behavioral2/files/0x0007000000023479-45.dat	upx
behavioral2/files/0x000700000002347a-58.dat	upx
behavioral2/files/0x000700000002347c-68.dat	upx
behavioral2/files/0x0007000000023483-94.dat	upx
behavioral2/files/0x0007000000023487-115.dat	upx
behavioral2/files/0x0007000000023488-128.dat	upx
behavioral2/files/0x000700000002348d-145.dat	upx
behavioral2/files/0x0007000000023491-165.dat	upx
behavioral2/memory/796-553-0x00007FF62BFF0000-0x00007FF62C341000-memory.dmp	upx
behavioral2/memory/3924-555-0x00007FF68EDE0000-0x00007FF68F131000-memory.dmp	upx
behavioral2/memory/1236-554-0x00007FF783740000-0x00007FF783A91000-memory.dmp	upx
behavioral2/memory/4484-556-0x00007FF7FFA00000-0x00007FF7FFD51000-memory.dmp	upx
behavioral2/memory/2972-557-0x00007FF66B0E0000-0x00007FF66B431000-memory.dmp	upx
behavioral2/memory/5088-586-0x00007FF7D65F0000-0x00007FF7D6941000-memory.dmp	upx
behavioral2/memory/1112-599-0x00007FF6458D0000-0x00007FF645C21000-memory.dmp	upx
behavioral2/memory/4248-607-0x00007FF627400000-0x00007FF627751000-memory.dmp	upx
behavioral2/memory/1380-627-0x00007FF7903C0000-0x00007FF790711000-memory.dmp	upx
behavioral2/memory/1368-630-0x00007FF604140000-0x00007FF604491000-memory.dmp	upx
behavioral2/memory/772-635-0x00007FF6D5F90000-0x00007FF6D62E1000-memory.dmp	upx
behavioral2/memory/5028-624-0x00007FF75AC30000-0x00007FF75AF81000-memory.dmp	upx
behavioral2/memory/2280-623-0x00007FF6465D0000-0x00007FF646921000-memory.dmp	upx
behavioral2/memory/2548-620-0x00007FF7353D0000-0x00007FF735721000-memory.dmp	upx
behavioral2/memory/4864-616-0x00007FF633820000-0x00007FF633B71000-memory.dmp	upx
behavioral2/memory/1056-615-0x00007FF7EAF80000-0x00007FF7EB2D1000-memory.dmp	upx
behavioral2/memory/4624-608-0x00007FF62D270000-0x00007FF62D5C1000-memory.dmp	upx
behavioral2/memory/3716-606-0x00007FF607F50000-0x00007FF6082A1000-memory.dmp	upx
behavioral2/memory/4516-605-0x00007FF69DEA0000-0x00007FF69E1F1000-memory.dmp	upx
behavioral2/memory/4700-581-0x00007FF7C2670000-0x00007FF7C29C1000-memory.dmp	upx
behavioral2/memory/4356-576-0x00007FF6A36F0000-0x00007FF6A3A41000-memory.dmp	upx
behavioral2/memory/1524-573-0x00007FF74ECD0000-0x00007FF74F021000-memory.dmp	upx
behavioral2/memory/4200-569-0x00007FF700C90000-0x00007FF700FE1000-memory.dmp	upx
behavioral2/memory/4580-656-0x00007FF7A24B0000-0x00007FF7A2801000-memory.dmp	upx
behavioral2/memory/4416-661-0x00007FF66BE90000-0x00007FF66C1E1000-memory.dmp	upx
behavioral2/memory/4828-675-0x00007FF71E030000-0x00007FF71E381000-memory.dmp	upx
behavioral2/memory/1600-670-0x00007FF6475F0000-0x00007FF647941000-memory.dmp	upx
behavioral2/files/0x000700000002348f-163.dat	upx
behavioral2/files/0x0007000000023490-160.dat	upx
behavioral2/files/0x000700000002348e-158.dat	upx
behavioral2/files/0x000700000002348c-148.dat	upx
behavioral2/files/0x000700000002348b-143.dat	upx
behavioral2/files/0x000700000002348a-138.dat	upx
behavioral2/files/0x0007000000023489-133.dat	upx
behavioral2/files/0x0007000000023486-118.dat	upx
behavioral2/files/0x0007000000023485-113.dat	upx
behavioral2/files/0x0007000000023484-108.dat	upx
behavioral2/files/0x0007000000023482-98.dat	upx
behavioral2/files/0x0007000000023481-93.dat	upx
behavioral2/files/0x0007000000023480-88.dat	upx
behavioral2/files/0x000700000002347f-83.dat	upx
behavioral2/files/0x000700000002347e-78.dat	upx
behavioral2/files/0x000700000002347d-73.dat	upx
behavioral2/files/0x000700000002347b-63.dat	upx
behavioral2/files/0x0007000000023478-48.dat	upx
behavioral2/files/0x0007000000023477-43.dat	upx
behavioral2/files/0x0007000000023476-38.dat	upx
behavioral2/files/0x0007000000023475-33.dat	upx
behavioral2/memory/1140-12-0x00007FF70D2A0000-0x00007FF70D5F1000-memory.dmp	upx
behavioral2/memory/3216-9-0x00007FF7AD9E0000-0x00007FF7ADD31000-memory.dmp	upx
behavioral2/memory/212-2178-0x00007FF7D7D20000-0x00007FF7D8071000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KByKteB.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\WWRyxeo.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\UJjFSSO.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\YeKBOSV.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\jHUPTvZ.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\IOhLibT.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\qowXXKx.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\lxghcQb.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\wsczMYn.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\FVTLRJq.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\etOEjjQ.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\DBtcvex.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\eYrDtck.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\ORccGBV.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZZFMqYb.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\jyWgyTp.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\oTpLTcc.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\OWhVkwo.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\RjmMQfS.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\HSKzCia.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\uBDUEdY.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\xOTdUzT.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\qrdynuq.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\jWeDdpg.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\gbZNexf.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\HbHeDKB.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\MnlGGJK.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\iPqnjUU.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\hoiBVWw.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\pNbCTTq.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\CfruPoV.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZFaITWf.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\WqYCqJJ.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\OYSDgSc.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\joklqLN.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\VyynriU.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\RtFOfjS.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\gcocKgr.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\KOCHARt.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\cATvXXv.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\vMnwqPX.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\Stcnngf.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\PYcoTkz.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\VDuUwBJ.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\uJMtquK.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\XSWWFZq.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\ddSPoOe.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\OFeGegY.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\nESMqKo.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\IUdTCUX.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\reipTyS.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\rVxIvYx.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\TFiRteO.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\NiygTzG.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\XDfohsF.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\fxPWqrg.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\bXUWLoj.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\XutJeGj.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\nMNQLWS.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\utOQzpc.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\CntKeVw.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\kOSPdem.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\EMMwedS.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
File created	C:\Windows\System\fAQutPe.exe	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 3216	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	84
PID 212 wrote to memory of 3216	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	84
PID 212 wrote to memory of 1140	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	85
PID 212 wrote to memory of 1140	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	85
PID 212 wrote to memory of 796	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	86
PID 212 wrote to memory of 796	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	86
PID 212 wrote to memory of 1236	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	87
PID 212 wrote to memory of 1236	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	87
PID 212 wrote to memory of 4828	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	88
PID 212 wrote to memory of 4828	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	88
PID 212 wrote to memory of 3924	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	89
PID 212 wrote to memory of 3924	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	89
PID 212 wrote to memory of 4484	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	90
PID 212 wrote to memory of 4484	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	90
PID 212 wrote to memory of 2972	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	91
PID 212 wrote to memory of 2972	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	91
PID 212 wrote to memory of 4200	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	92
PID 212 wrote to memory of 4200	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	92
PID 212 wrote to memory of 1524	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	93
PID 212 wrote to memory of 1524	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	93
PID 212 wrote to memory of 4356	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	94
PID 212 wrote to memory of 4356	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	94
PID 212 wrote to memory of 4700	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	95
PID 212 wrote to memory of 4700	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	95
PID 212 wrote to memory of 5088	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	96
PID 212 wrote to memory of 5088	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	96
PID 212 wrote to memory of 1112	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	97
PID 212 wrote to memory of 1112	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	97
PID 212 wrote to memory of 4516	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	98
PID 212 wrote to memory of 4516	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	98
PID 212 wrote to memory of 3716	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	99
PID 212 wrote to memory of 3716	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	99
PID 212 wrote to memory of 4248	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	100
PID 212 wrote to memory of 4248	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	100
PID 212 wrote to memory of 4624	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	101
PID 212 wrote to memory of 4624	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	101
PID 212 wrote to memory of 1056	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	102
PID 212 wrote to memory of 1056	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	102
PID 212 wrote to memory of 4864	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	103
PID 212 wrote to memory of 4864	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	103
PID 212 wrote to memory of 2548	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	104
PID 212 wrote to memory of 2548	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	104
PID 212 wrote to memory of 2280	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	105
PID 212 wrote to memory of 2280	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	105
PID 212 wrote to memory of 5028	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	106
PID 212 wrote to memory of 5028	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	106
PID 212 wrote to memory of 1380	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	107
PID 212 wrote to memory of 1380	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	107
PID 212 wrote to memory of 1368	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	108
PID 212 wrote to memory of 1368	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	108
PID 212 wrote to memory of 772	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	109
PID 212 wrote to memory of 772	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	109
PID 212 wrote to memory of 4580	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	110
PID 212 wrote to memory of 4580	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	110
PID 212 wrote to memory of 4416	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	111
PID 212 wrote to memory of 4416	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	111
PID 212 wrote to memory of 1600	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	112
PID 212 wrote to memory of 1600	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	112
PID 212 wrote to memory of 2416	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	113
PID 212 wrote to memory of 2416	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	113
PID 212 wrote to memory of 2124	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	114
PID 212 wrote to memory of 2124	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	114
PID 212 wrote to memory of 3092	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	115
PID 212 wrote to memory of 3092	212	476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\476fc642a1660ea1f73e7bebc9cfd7d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\System\JkQKlCj.exe
  C:\Windows\System\JkQKlCj.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\aVFqEjc.exe
  C:\Windows\System\aVFqEjc.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\iRrTvSS.exe
  C:\Windows\System\iRrTvSS.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\JsACqEg.exe
  C:\Windows\System\JsACqEg.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\innJABZ.exe
  C:\Windows\System\innJABZ.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\EvcdjpE.exe
  C:\Windows\System\EvcdjpE.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\xAYQWpv.exe
  C:\Windows\System\xAYQWpv.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\UxksseR.exe
  C:\Windows\System\UxksseR.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\xcByRlu.exe
  C:\Windows\System\xcByRlu.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\nRIYkkh.exe
  C:\Windows\System\nRIYkkh.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\kOSPdem.exe
  C:\Windows\System\kOSPdem.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\PDDnHxr.exe
  C:\Windows\System\PDDnHxr.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\IJrcShB.exe
  C:\Windows\System\IJrcShB.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\ZZFMqYb.exe
  C:\Windows\System\ZZFMqYb.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\MrezGfS.exe
  C:\Windows\System\MrezGfS.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\BLkGryd.exe
  C:\Windows\System\BLkGryd.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\DfezMaQ.exe
  C:\Windows\System\DfezMaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\tmLjQgx.exe
  C:\Windows\System\tmLjQgx.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\nMTQnAk.exe
  C:\Windows\System\nMTQnAk.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\kuXzKYB.exe
  C:\Windows\System\kuXzKYB.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\nRSFHws.exe
  C:\Windows\System\nRSFHws.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\puWkAVV.exe
  C:\Windows\System\puWkAVV.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ePGJbnn.exe
  C:\Windows\System\ePGJbnn.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\qDIOlxk.exe
  C:\Windows\System\qDIOlxk.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\ftRLTwM.exe
  C:\Windows\System\ftRLTwM.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\JcGdjyc.exe
  C:\Windows\System\JcGdjyc.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\CYxBroO.exe
  C:\Windows\System\CYxBroO.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\afRxsEL.exe
  C:\Windows\System\afRxsEL.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\dbQqmEY.exe
  C:\Windows\System\dbQqmEY.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\vxeISSK.exe
  C:\Windows\System\vxeISSK.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\PrSQIrr.exe
  C:\Windows\System\PrSQIrr.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\AdsinbJ.exe
  C:\Windows\System\AdsinbJ.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\KAFucjK.exe
  C:\Windows\System\KAFucjK.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\MAtDvEK.exe
  C:\Windows\System\MAtDvEK.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\HDfqUEc.exe
  C:\Windows\System\HDfqUEc.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\XRGwuYF.exe
  C:\Windows\System\XRGwuYF.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\jyWgyTp.exe
  C:\Windows\System\jyWgyTp.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\DLQaNZd.exe
  C:\Windows\System\DLQaNZd.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\qNfptxz.exe
  C:\Windows\System\qNfptxz.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\JeXJcqt.exe
  C:\Windows\System\JeXJcqt.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\RRVakIO.exe
  C:\Windows\System\RRVakIO.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\NyUDCOU.exe
  C:\Windows\System\NyUDCOU.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\IEesnfB.exe
  C:\Windows\System\IEesnfB.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\RZAlpRF.exe
  C:\Windows\System\RZAlpRF.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\HoLUNpq.exe
  C:\Windows\System\HoLUNpq.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\hVEXyWa.exe
  C:\Windows\System\hVEXyWa.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\qUCVcjd.exe
  C:\Windows\System\qUCVcjd.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\dveadWL.exe
  C:\Windows\System\dveadWL.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\CkavvRy.exe
  C:\Windows\System\CkavvRy.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\DwqbVxn.exe
  C:\Windows\System\DwqbVxn.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\FBXGEnD.exe
  C:\Windows\System\FBXGEnD.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\oKZCzfR.exe
  C:\Windows\System\oKZCzfR.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\myqiFao.exe
  C:\Windows\System\myqiFao.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\yjsIjUJ.exe
  C:\Windows\System\yjsIjUJ.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\jGTGBvF.exe
  C:\Windows\System\jGTGBvF.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\zDSKfUg.exe
  C:\Windows\System\zDSKfUg.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\ijApPIn.exe
  C:\Windows\System\ijApPIn.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\cTyFgyG.exe
  C:\Windows\System\cTyFgyG.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\SEBARIA.exe
  C:\Windows\System\SEBARIA.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\HytaryY.exe
  C:\Windows\System\HytaryY.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\lxghcQb.exe
  C:\Windows\System\lxghcQb.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\vMnwqPX.exe
  C:\Windows\System\vMnwqPX.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\siYDFKR.exe
  C:\Windows\System\siYDFKR.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\uWqEBko.exe
  C:\Windows\System\uWqEBko.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\kkljRuA.exe
  C:\Windows\System\kkljRuA.exe
  2⤵
  PID:3852
- C:\Windows\System\nKoALqX.exe
  C:\Windows\System\nKoALqX.exe
  2⤵
  PID:2024
- C:\Windows\System\ynqwfbq.exe
  C:\Windows\System\ynqwfbq.exe
  2⤵
  PID:3104
- C:\Windows\System\hQyWbqw.exe
  C:\Windows\System\hQyWbqw.exe
  2⤵
  PID:3588
- C:\Windows\System\AkfGYiv.exe
  C:\Windows\System\AkfGYiv.exe
  2⤵
  PID:4532
- C:\Windows\System\TatmGsZ.exe
  C:\Windows\System\TatmGsZ.exe
  2⤵
  PID:3660
- C:\Windows\System\TeAKlOB.exe
  C:\Windows\System\TeAKlOB.exe
  2⤵
  PID:3920
- C:\Windows\System\cAwCfxj.exe
  C:\Windows\System\cAwCfxj.exe
  2⤵
  PID:2736
- C:\Windows\System\TlkIzYy.exe
  C:\Windows\System\TlkIzYy.exe
  2⤵
  PID:4432
- C:\Windows\System\yoNTkPk.exe
  C:\Windows\System\yoNTkPk.exe
  2⤵
  PID:2388
- C:\Windows\System\EMMwedS.exe
  C:\Windows\System\EMMwedS.exe
  2⤵
  PID:1020
- C:\Windows\System\oTpLTcc.exe
  C:\Windows\System\oTpLTcc.exe
  2⤵
  PID:540
- C:\Windows\System\NiygTzG.exe
  C:\Windows\System\NiygTzG.exe
  2⤵
  PID:4868
- C:\Windows\System\XDfohsF.exe
  C:\Windows\System\XDfohsF.exe
  2⤵
  PID:4308
- C:\Windows\System\YkDzFIZ.exe
  C:\Windows\System\YkDzFIZ.exe
  2⤵
  PID:1152
- C:\Windows\System\LufmGBl.exe
  C:\Windows\System\LufmGBl.exe
  2⤵
  PID:5116
- C:\Windows\System\UJjFSSO.exe
  C:\Windows\System\UJjFSSO.exe
  2⤵
  PID:3204
- C:\Windows\System\YeKBOSV.exe
  C:\Windows\System\YeKBOSV.exe
  2⤵
  PID:5124
- C:\Windows\System\XfMDIyb.exe
  C:\Windows\System\XfMDIyb.exe
  2⤵
  PID:5152
- C:\Windows\System\wVzXHcz.exe
  C:\Windows\System\wVzXHcz.exe
  2⤵
  PID:5184
- C:\Windows\System\XYJdteR.exe
  C:\Windows\System\XYJdteR.exe
  2⤵
  PID:5208
- C:\Windows\System\anXjecC.exe
  C:\Windows\System\anXjecC.exe
  2⤵
  PID:5236
- C:\Windows\System\PHLdxOS.exe
  C:\Windows\System\PHLdxOS.exe
  2⤵
  PID:5268
- C:\Windows\System\BaohXSS.exe
  C:\Windows\System\BaohXSS.exe
  2⤵
  PID:5296
- C:\Windows\System\dwNLNDp.exe
  C:\Windows\System\dwNLNDp.exe
  2⤵
  PID:5324
- C:\Windows\System\TgkMyUg.exe
  C:\Windows\System\TgkMyUg.exe
  2⤵
  PID:5352
- C:\Windows\System\tYdjZvb.exe
  C:\Windows\System\tYdjZvb.exe
  2⤵
  PID:5380
- C:\Windows\System\mtUUkUt.exe
  C:\Windows\System\mtUUkUt.exe
  2⤵
  PID:5408
- C:\Windows\System\IsPeagF.exe
  C:\Windows\System\IsPeagF.exe
  2⤵
  PID:5436
- C:\Windows\System\AWljiep.exe
  C:\Windows\System\AWljiep.exe
  2⤵
  PID:5472
- C:\Windows\System\VhpGtYp.exe
  C:\Windows\System\VhpGtYp.exe
  2⤵
  PID:5492
- C:\Windows\System\oOhJggl.exe
  C:\Windows\System\oOhJggl.exe
  2⤵
  PID:5520
- C:\Windows\System\blLxjZh.exe
  C:\Windows\System\blLxjZh.exe
  2⤵
  PID:5548
- C:\Windows\System\IXakamM.exe
  C:\Windows\System\IXakamM.exe
  2⤵
  PID:5576
- C:\Windows\System\KqjSoEb.exe
  C:\Windows\System\KqjSoEb.exe
  2⤵
  PID:5600
- C:\Windows\System\ZWlpmjn.exe
  C:\Windows\System\ZWlpmjn.exe
  2⤵
  PID:5632
- C:\Windows\System\rPiSYhb.exe
  C:\Windows\System\rPiSYhb.exe
  2⤵
  PID:5656
- C:\Windows\System\wrlIYaQ.exe
  C:\Windows\System\wrlIYaQ.exe
  2⤵
  PID:5684
- C:\Windows\System\MvmeteV.exe
  C:\Windows\System\MvmeteV.exe
  2⤵
  PID:5712
- C:\Windows\System\sQeSjEe.exe
  C:\Windows\System\sQeSjEe.exe
  2⤵
  PID:5740
- C:\Windows\System\YtvzUjC.exe
  C:\Windows\System\YtvzUjC.exe
  2⤵
  PID:5772
- C:\Windows\System\qxGiUic.exe
  C:\Windows\System\qxGiUic.exe
  2⤵
  PID:5796
- C:\Windows\System\MeBlnkK.exe
  C:\Windows\System\MeBlnkK.exe
  2⤵
  PID:5824
- C:\Windows\System\TQBNygl.exe
  C:\Windows\System\TQBNygl.exe
  2⤵
  PID:5856
- C:\Windows\System\orwuOex.exe
  C:\Windows\System\orwuOex.exe
  2⤵
  PID:5884
- C:\Windows\System\DflbHSA.exe
  C:\Windows\System\DflbHSA.exe
  2⤵
  PID:5908
- C:\Windows\System\oyTfJqu.exe
  C:\Windows\System\oyTfJqu.exe
  2⤵
  PID:5936
- C:\Windows\System\YpQWyXP.exe
  C:\Windows\System\YpQWyXP.exe
  2⤵
  PID:5968
- C:\Windows\System\NzEPxMC.exe
  C:\Windows\System\NzEPxMC.exe
  2⤵
  PID:5996
- C:\Windows\System\uKLoTmq.exe
  C:\Windows\System\uKLoTmq.exe
  2⤵
  PID:6024
- C:\Windows\System\ZypcJcs.exe
  C:\Windows\System\ZypcJcs.exe
  2⤵
  PID:6052
- C:\Windows\System\XWaYohZ.exe
  C:\Windows\System\XWaYohZ.exe
  2⤵
  PID:6080
- C:\Windows\System\vmIzBRC.exe
  C:\Windows\System\vmIzBRC.exe
  2⤵
  PID:6104
- C:\Windows\System\utZQERH.exe
  C:\Windows\System\utZQERH.exe
  2⤵
  PID:6132
- C:\Windows\System\JWamAdg.exe
  C:\Windows\System\JWamAdg.exe
  2⤵
  PID:2096
- C:\Windows\System\VQtDGdA.exe
  C:\Windows\System\VQtDGdA.exe
  2⤵
  PID:408
- C:\Windows\System\INvxzrk.exe
  C:\Windows\System\INvxzrk.exe
  2⤵
  PID:4316
- C:\Windows\System\gbZNexf.exe
  C:\Windows\System\gbZNexf.exe
  2⤵
  PID:1512
- C:\Windows\System\fchKNQH.exe
  C:\Windows\System\fchKNQH.exe
  2⤵
  PID:4172
- C:\Windows\System\AruFAzd.exe
  C:\Windows\System\AruFAzd.exe
  2⤵
  PID:1848
- C:\Windows\System\wsczMYn.exe
  C:\Windows\System\wsczMYn.exe
  2⤵
  PID:5176
- C:\Windows\System\UgFHbQF.exe
  C:\Windows\System\UgFHbQF.exe
  2⤵
  PID:5228
- C:\Windows\System\sNBSCJp.exe
  C:\Windows\System\sNBSCJp.exe
  2⤵
  PID:5288
- C:\Windows\System\ewXHIRA.exe
  C:\Windows\System\ewXHIRA.exe
  2⤵
  PID:5368
- C:\Windows\System\jHUPTvZ.exe
  C:\Windows\System\jHUPTvZ.exe
  2⤵
  PID:5424
- C:\Windows\System\bfjTCkU.exe
  C:\Windows\System\bfjTCkU.exe
  2⤵
  PID:5488
- C:\Windows\System\wIUOYSP.exe
  C:\Windows\System\wIUOYSP.exe
  2⤵
  PID:348
- C:\Windows\System\OFeGegY.exe
  C:\Windows\System\OFeGegY.exe
  2⤵
  PID:5596
- C:\Windows\System\NducRwt.exe
  C:\Windows\System\NducRwt.exe
  2⤵
  PID:5672
- C:\Windows\System\TDMeHfp.exe
  C:\Windows\System\TDMeHfp.exe
  2⤵
  PID:5728
- C:\Windows\System\tbZSqMj.exe
  C:\Windows\System\tbZSqMj.exe
  2⤵
  PID:5788
- C:\Windows\System\jUUGbuK.exe
  C:\Windows\System\jUUGbuK.exe
  2⤵
  PID:5868
- C:\Windows\System\jYOYHOO.exe
  C:\Windows\System\jYOYHOO.exe
  2⤵
  PID:5924
- C:\Windows\System\syLSfro.exe
  C:\Windows\System\syLSfro.exe
  2⤵
  PID:5984
- C:\Windows\System\OzPptjY.exe
  C:\Windows\System\OzPptjY.exe
  2⤵
  PID:6044
- C:\Windows\System\WNFXKns.exe
  C:\Windows\System\WNFXKns.exe
  2⤵
  PID:6096
- C:\Windows\System\hXlMATs.exe
  C:\Windows\System\hXlMATs.exe
  2⤵
  PID:3260
- C:\Windows\System\xsLUcTr.exe
  C:\Windows\System\xsLUcTr.exe
  2⤵
  PID:2396
- C:\Windows\System\wHsWSdk.exe
  C:\Windows\System\wHsWSdk.exe
  2⤵
  PID:4792
- C:\Windows\System\TsxGJmC.exe
  C:\Windows\System\TsxGJmC.exe
  2⤵
  PID:5172
- C:\Windows\System\BFRPUfD.exe
  C:\Windows\System\BFRPUfD.exe
  2⤵
  PID:5280
- C:\Windows\System\GrhtdqX.exe
  C:\Windows\System\GrhtdqX.exe
  2⤵
  PID:5400
- C:\Windows\System\aXYPGln.exe
  C:\Windows\System\aXYPGln.exe
  2⤵
  PID:5532
- C:\Windows\System\cmwvrUc.exe
  C:\Windows\System\cmwvrUc.exe
  2⤵
  PID:2180
- C:\Windows\System\SIcqsyj.exe
  C:\Windows\System\SIcqsyj.exe
  2⤵
  PID:5764
- C:\Windows\System\IRtpCXG.exe
  C:\Windows\System\IRtpCXG.exe
  2⤵
  PID:1908
- C:\Windows\System\Baowmct.exe
  C:\Windows\System\Baowmct.exe
  2⤵
  PID:6036
- C:\Windows\System\XlIIuFa.exe
  C:\Windows\System\XlIIuFa.exe
  2⤵
  PID:4232
- C:\Windows\System\bqyCpCh.exe
  C:\Windows\System\bqyCpCh.exe
  2⤵
  PID:4592
- C:\Windows\System\ZYPdiEJ.exe
  C:\Windows\System\ZYPdiEJ.exe
  2⤵
  PID:4800
- C:\Windows\System\DkYdMYz.exe
  C:\Windows\System\DkYdMYz.exe
  2⤵
  PID:5396
- C:\Windows\System\DyYbqlK.exe
  C:\Windows\System\DyYbqlK.exe
  2⤵
  PID:436
- C:\Windows\System\XRmqDPL.exe
  C:\Windows\System\XRmqDPL.exe
  2⤵
  PID:5840
- C:\Windows\System\RlRWgjY.exe
  C:\Windows\System\RlRWgjY.exe
  2⤵
  PID:1568
- C:\Windows\System\YKOnhFU.exe
  C:\Windows\System\YKOnhFU.exe
  2⤵
  PID:2844
- C:\Windows\System\KAfttfZ.exe
  C:\Windows\System\KAfttfZ.exe
  2⤵
  PID:4976
- C:\Windows\System\xhjqpIA.exe
  C:\Windows\System\xhjqpIA.exe
  2⤵
  PID:6168
- C:\Windows\System\rqvGlvM.exe
  C:\Windows\System\rqvGlvM.exe
  2⤵
  PID:6196
- C:\Windows\System\oxrWZKr.exe
  C:\Windows\System\oxrWZKr.exe
  2⤵
  PID:6224
- C:\Windows\System\UtCiwns.exe
  C:\Windows\System\UtCiwns.exe
  2⤵
  PID:6360
- C:\Windows\System\toVozYi.exe
  C:\Windows\System\toVozYi.exe
  2⤵
  PID:6384
- C:\Windows\System\WFZOAvx.exe
  C:\Windows\System\WFZOAvx.exe
  2⤵
  PID:6404
- C:\Windows\System\jauyzcL.exe
  C:\Windows\System\jauyzcL.exe
  2⤵
  PID:6424
- C:\Windows\System\Stcnngf.exe
  C:\Windows\System\Stcnngf.exe
  2⤵
  PID:6460
- C:\Windows\System\HrPPOxF.exe
  C:\Windows\System\HrPPOxF.exe
  2⤵
  PID:6480
- C:\Windows\System\pAziGTF.exe
  C:\Windows\System\pAziGTF.exe
  2⤵
  PID:6508
- C:\Windows\System\gxPDwGF.exe
  C:\Windows\System\gxPDwGF.exe
  2⤵
  PID:6532
- C:\Windows\System\ltwMGzN.exe
  C:\Windows\System\ltwMGzN.exe
  2⤵
  PID:6552
- C:\Windows\System\niRJYJi.exe
  C:\Windows\System\niRJYJi.exe
  2⤵
  PID:6596
- C:\Windows\System\WKEmLFZ.exe
  C:\Windows\System\WKEmLFZ.exe
  2⤵
  PID:6620
- C:\Windows\System\HSKzCia.exe
  C:\Windows\System\HSKzCia.exe
  2⤵
  PID:6660
- C:\Windows\System\tfmDABd.exe
  C:\Windows\System\tfmDABd.exe
  2⤵
  PID:6676
- C:\Windows\System\hELuSaQ.exe
  C:\Windows\System\hELuSaQ.exe
  2⤵
  PID:6716
- C:\Windows\System\TNTbOhK.exe
  C:\Windows\System\TNTbOhK.exe
  2⤵
  PID:6788
- C:\Windows\System\nYjTPWr.exe
  C:\Windows\System\nYjTPWr.exe
  2⤵
  PID:6812
- C:\Windows\System\KlocnDx.exe
  C:\Windows\System\KlocnDx.exe
  2⤵
  PID:6852
- C:\Windows\System\DXzReuB.exe
  C:\Windows\System\DXzReuB.exe
  2⤵
  PID:6880
- C:\Windows\System\NkMYfOF.exe
  C:\Windows\System\NkMYfOF.exe
  2⤵
  PID:6896
- C:\Windows\System\XoOhmYf.exe
  C:\Windows\System\XoOhmYf.exe
  2⤵
  PID:6952
- C:\Windows\System\aZOVxzm.exe
  C:\Windows\System\aZOVxzm.exe
  2⤵
  PID:6984
- C:\Windows\System\qqDHYfY.exe
  C:\Windows\System\qqDHYfY.exe
  2⤵
  PID:7096
- C:\Windows\System\evTGUmi.exe
  C:\Windows\System\evTGUmi.exe
  2⤵
  PID:7112
- C:\Windows\System\CXghaOL.exe
  C:\Windows\System\CXghaOL.exe
  2⤵
  PID:7128
- C:\Windows\System\dORXQLO.exe
  C:\Windows\System\dORXQLO.exe
  2⤵
  PID:7148
- C:\Windows\System\BIJydlp.exe
  C:\Windows\System\BIJydlp.exe
  2⤵
  PID:412
- C:\Windows\System\iOYxyRs.exe
  C:\Windows\System\iOYxyRs.exe
  2⤵
  PID:5072
- C:\Windows\System\hbbJtUq.exe
  C:\Windows\System\hbbJtUq.exe
  2⤵
  PID:6068
- C:\Windows\System\OlYQAVK.exe
  C:\Windows\System\OlYQAVK.exe
  2⤵
  PID:4184
- C:\Windows\System\fAQutPe.exe
  C:\Windows\System\fAQutPe.exe
  2⤵
  PID:6164
- C:\Windows\System\JAJkOrL.exe
  C:\Windows\System\JAJkOrL.exe
  2⤵
  PID:4464
- C:\Windows\System\dyyZhTP.exe
  C:\Windows\System\dyyZhTP.exe
  2⤵
  PID:6396
- C:\Windows\System\LBkEgCv.exe
  C:\Windows\System\LBkEgCv.exe
  2⤵
  PID:6456
- C:\Windows\System\RKRXqFC.exe
  C:\Windows\System\RKRXqFC.exe
  2⤵
  PID:6548
- C:\Windows\System\rKAGHit.exe
  C:\Windows\System\rKAGHit.exe
  2⤵
  PID:6704
- C:\Windows\System\RdoORyg.exe
  C:\Windows\System\RdoORyg.exe
  2⤵
  PID:6804
- C:\Windows\System\tzQinJC.exe
  C:\Windows\System\tzQinJC.exe
  2⤵
  PID:6820
- C:\Windows\System\qxxYTkB.exe
  C:\Windows\System\qxxYTkB.exe
  2⤵
  PID:6280
- C:\Windows\System\AZkOIey.exe
  C:\Windows\System\AZkOIey.exe
  2⤵
  PID:6948
- C:\Windows\System\aqBzMuo.exe
  C:\Windows\System\aqBzMuo.exe
  2⤵
  PID:7024
- C:\Windows\System\ENvBfyc.exe
  C:\Windows\System\ENvBfyc.exe
  2⤵
  PID:7080
- C:\Windows\System\fknRCZc.exe
  C:\Windows\System\fknRCZc.exe
  2⤵
  PID:7144
- C:\Windows\System\smVPxQA.exe
  C:\Windows\System\smVPxQA.exe
  2⤵
  PID:6156
- C:\Windows\System\hEccxrS.exe
  C:\Windows\System\hEccxrS.exe
  2⤵
  PID:3276
- C:\Windows\System\WrzYVyd.exe
  C:\Windows\System\WrzYVyd.exe
  2⤵
  PID:3340
- C:\Windows\System\bzhMoXf.exe
  C:\Windows\System\bzhMoXf.exe
  2⤵
  PID:528
- C:\Windows\System\PxLqIsS.exe
  C:\Windows\System\PxLqIsS.exe
  2⤵
  PID:6436
- C:\Windows\System\cWgAQjc.exe
  C:\Windows\System\cWgAQjc.exe
  2⤵
  PID:6604
- C:\Windows\System\WunFWQm.exe
  C:\Windows\System\WunFWQm.exe
  2⤵
  PID:6796
- C:\Windows\System\jZSwfgP.exe
  C:\Windows\System\jZSwfgP.exe
  2⤵
  PID:6932
- C:\Windows\System\SegOxCp.exe
  C:\Windows\System\SegOxCp.exe
  2⤵
  PID:1032
- C:\Windows\System\rLMPdbs.exe
  C:\Windows\System\rLMPdbs.exe
  2⤵
  PID:7064
- C:\Windows\System\PwsxxrP.exe
  C:\Windows\System\PwsxxrP.exe
  2⤵
  PID:3604
- C:\Windows\System\alCxEqu.exe
  C:\Windows\System\alCxEqu.exe
  2⤵
  PID:6220
- C:\Windows\System\hsRGTSg.exe
  C:\Windows\System\hsRGTSg.exe
  2⤵
  PID:7012
- C:\Windows\System\DbPVHbg.exe
  C:\Windows\System\DbPVHbg.exe
  2⤵
  PID:7172
- C:\Windows\System\hMeQDJO.exe
  C:\Windows\System\hMeQDJO.exe
  2⤵
  PID:7188
- C:\Windows\System\UXMEcvY.exe
  C:\Windows\System\UXMEcvY.exe
  2⤵
  PID:7216
- C:\Windows\System\PGrPxkm.exe
  C:\Windows\System\PGrPxkm.exe
  2⤵
  PID:7256
- C:\Windows\System\LsdTPmm.exe
  C:\Windows\System\LsdTPmm.exe
  2⤵
  PID:7276
- C:\Windows\System\SJzaXoI.exe
  C:\Windows\System\SJzaXoI.exe
  2⤵
  PID:7300
- C:\Windows\System\TzQPWCD.exe
  C:\Windows\System\TzQPWCD.exe
  2⤵
  PID:7324
- C:\Windows\System\AtfJGFm.exe
  C:\Windows\System\AtfJGFm.exe
  2⤵
  PID:7368
- C:\Windows\System\oNLMTup.exe
  C:\Windows\System\oNLMTup.exe
  2⤵
  PID:7396
- C:\Windows\System\XqgPZTu.exe
  C:\Windows\System\XqgPZTu.exe
  2⤵
  PID:7432
- C:\Windows\System\GRwkrOA.exe
  C:\Windows\System\GRwkrOA.exe
  2⤵
  PID:7452
- C:\Windows\System\JBiKIwn.exe
  C:\Windows\System\JBiKIwn.exe
  2⤵
  PID:7484
- C:\Windows\System\zgYVcpE.exe
  C:\Windows\System\zgYVcpE.exe
  2⤵
  PID:7556
- C:\Windows\System\budeHyT.exe
  C:\Windows\System\budeHyT.exe
  2⤵
  PID:7592
- C:\Windows\System\oUxGCbF.exe
  C:\Windows\System\oUxGCbF.exe
  2⤵
  PID:7608
- C:\Windows\System\GjEXAfX.exe
  C:\Windows\System\GjEXAfX.exe
  2⤵
  PID:7632
- C:\Windows\System\ighqZPV.exe
  C:\Windows\System\ighqZPV.exe
  2⤵
  PID:7656
- C:\Windows\System\gIkGtnI.exe
  C:\Windows\System\gIkGtnI.exe
  2⤵
  PID:7680
- C:\Windows\System\leddHKJ.exe
  C:\Windows\System\leddHKJ.exe
  2⤵
  PID:7700
- C:\Windows\System\lUhZCar.exe
  C:\Windows\System\lUhZCar.exe
  2⤵
  PID:7772
- C:\Windows\System\Hkyfpxq.exe
  C:\Windows\System\Hkyfpxq.exe
  2⤵
  PID:7788
- C:\Windows\System\WqYCqJJ.exe
  C:\Windows\System\WqYCqJJ.exe
  2⤵
  PID:7812
- C:\Windows\System\VkQYhVb.exe
  C:\Windows\System\VkQYhVb.exe
  2⤵
  PID:7832
- C:\Windows\System\fxPWqrg.exe
  C:\Windows\System\fxPWqrg.exe
  2⤵
  PID:7860
- C:\Windows\System\IOhLibT.exe
  C:\Windows\System\IOhLibT.exe
  2⤵
  PID:7884
- C:\Windows\System\hNYslRI.exe
  C:\Windows\System\hNYslRI.exe
  2⤵
  PID:7908
- C:\Windows\System\qDkMoVx.exe
  C:\Windows\System\qDkMoVx.exe
  2⤵
  PID:7928
- C:\Windows\System\qGpCdfD.exe
  C:\Windows\System\qGpCdfD.exe
  2⤵
  PID:7976
- C:\Windows\System\qowXXKx.exe
  C:\Windows\System\qowXXKx.exe
  2⤵
  PID:8012
- C:\Windows\System\pqYUsUu.exe
  C:\Windows\System\pqYUsUu.exe
  2⤵
  PID:8036
- C:\Windows\System\KByKteB.exe
  C:\Windows\System\KByKteB.exe
  2⤵
  PID:8076
- C:\Windows\System\nfhlnVW.exe
  C:\Windows\System\nfhlnVW.exe
  2⤵
  PID:8100
- C:\Windows\System\HbHeDKB.exe
  C:\Windows\System\HbHeDKB.exe
  2⤵
  PID:8116
- C:\Windows\System\bkicmTT.exe
  C:\Windows\System\bkicmTT.exe
  2⤵
  PID:8156
- C:\Windows\System\iXxvvRQ.exe
  C:\Windows\System\iXxvvRQ.exe
  2⤵
  PID:6868
- C:\Windows\System\dykOEWW.exe
  C:\Windows\System\dykOEWW.exe
  2⤵
  PID:7160
- C:\Windows\System\zuqmvga.exe
  C:\Windows\System\zuqmvga.exe
  2⤵
  PID:7180
- C:\Windows\System\kbliMbV.exe
  C:\Windows\System\kbliMbV.exe
  2⤵
  PID:7208
- C:\Windows\System\cKuIUwG.exe
  C:\Windows\System\cKuIUwG.exe
  2⤵
  PID:7292
- C:\Windows\System\GVzNHpc.exe
  C:\Windows\System\GVzNHpc.exe
  2⤵
  PID:7376
- C:\Windows\System\BPzazmg.exe
  C:\Windows\System\BPzazmg.exe
  2⤵
  PID:6468
- C:\Windows\System\VXreIMj.exe
  C:\Windows\System\VXreIMj.exe
  2⤵
  PID:7472
- C:\Windows\System\MXcDQEg.exe
  C:\Windows\System\MXcDQEg.exe
  2⤵
  PID:7548
- C:\Windows\System\nESMqKo.exe
  C:\Windows\System\nESMqKo.exe
  2⤵
  PID:7624
- C:\Windows\System\JedlkPq.exe
  C:\Windows\System\JedlkPq.exe
  2⤵
  PID:6608
- C:\Windows\System\VeLcMGV.exe
  C:\Windows\System\VeLcMGV.exe
  2⤵
  PID:7740
- C:\Windows\System\XQljRbM.exe
  C:\Windows\System\XQljRbM.exe
  2⤵
  PID:7720
- C:\Windows\System\TQUAsmp.exe
  C:\Windows\System\TQUAsmp.exe
  2⤵
  PID:1812
- C:\Windows\System\lRmXTAN.exe
  C:\Windows\System\lRmXTAN.exe
  2⤵
  PID:7820
- C:\Windows\System\bryXbCP.exe
  C:\Windows\System\bryXbCP.exe
  2⤵
  PID:7828
- C:\Windows\System\MexMhZZ.exe
  C:\Windows\System\MexMhZZ.exe
  2⤵
  PID:7892
- C:\Windows\System\YrABxoV.exe
  C:\Windows\System\YrABxoV.exe
  2⤵
  PID:7984
- C:\Windows\System\LjhNMYs.exe
  C:\Windows\System\LjhNMYs.exe
  2⤵
  PID:6928
- C:\Windows\System\cBNrWsm.exe
  C:\Windows\System\cBNrWsm.exe
  2⤵
  PID:6904
- C:\Windows\System\OniwGQb.exe
  C:\Windows\System\OniwGQb.exe
  2⤵
  PID:8092
- C:\Windows\System\HOlsEED.exe
  C:\Windows\System\HOlsEED.exe
  2⤵
  PID:8144
- C:\Windows\System\MebvHbk.exe
  C:\Windows\System\MebvHbk.exe
  2⤵
  PID:6892
- C:\Windows\System\QgQiLwH.exe
  C:\Windows\System\QgQiLwH.exe
  2⤵
  PID:7296
- C:\Windows\System\fRrYMNk.exe
  C:\Windows\System\fRrYMNk.exe
  2⤵
  PID:7428
- C:\Windows\System\BpRyKCx.exe
  C:\Windows\System\BpRyKCx.exe
  2⤵
  PID:6380
- C:\Windows\System\bDpMvCO.exe
  C:\Windows\System\bDpMvCO.exe
  2⤵
  PID:7784
- C:\Windows\System\VczjVyJ.exe
  C:\Windows\System\VczjVyJ.exe
  2⤵
  PID:8052
- C:\Windows\System\VPbiiJF.exe
  C:\Windows\System\VPbiiJF.exe
  2⤵
  PID:7904
- C:\Windows\System\HoChUqd.exe
  C:\Windows\System\HoChUqd.exe
  2⤵
  PID:7200
- C:\Windows\System\iPmWzwj.exe
  C:\Windows\System\iPmWzwj.exe
  2⤵
  PID:7360
- C:\Windows\System\LtyhfBH.exe
  C:\Windows\System\LtyhfBH.exe
  2⤵
  PID:7404
- C:\Windows\System\voOjSSx.exe
  C:\Windows\System\voOjSSx.exe
  2⤵
  PID:7696
- C:\Windows\System\uBDUEdY.exe
  C:\Windows\System\uBDUEdY.exe
  2⤵
  PID:7156
- C:\Windows\System\bxyyooU.exe
  C:\Windows\System\bxyyooU.exe
  2⤵
  PID:8028
- C:\Windows\System\KHgwyfo.exe
  C:\Windows\System\KHgwyfo.exe
  2⤵
  PID:7600
- C:\Windows\System\CLDHVhV.exe
  C:\Windows\System\CLDHVhV.exe
  2⤵
  PID:8204
- C:\Windows\System\tAuRnSl.exe
  C:\Windows\System\tAuRnSl.exe
  2⤵
  PID:8236
- C:\Windows\System\XpeHdAR.exe
  C:\Windows\System\XpeHdAR.exe
  2⤵
  PID:8260
- C:\Windows\System\vJsyBIa.exe
  C:\Windows\System\vJsyBIa.exe
  2⤵
  PID:8292
- C:\Windows\System\enmZTqu.exe
  C:\Windows\System\enmZTqu.exe
  2⤵
  PID:8324
- C:\Windows\System\UfsySic.exe
  C:\Windows\System\UfsySic.exe
  2⤵
  PID:8352
- C:\Windows\System\bAfIInd.exe
  C:\Windows\System\bAfIInd.exe
  2⤵
  PID:8380
- C:\Windows\System\OYSDgSc.exe
  C:\Windows\System\OYSDgSc.exe
  2⤵
  PID:8400
- C:\Windows\System\kuFlWGH.exe
  C:\Windows\System\kuFlWGH.exe
  2⤵
  PID:8440
- C:\Windows\System\OWhVkwo.exe
  C:\Windows\System\OWhVkwo.exe
  2⤵
  PID:8464
- C:\Windows\System\OLuODmM.exe
  C:\Windows\System\OLuODmM.exe
  2⤵
  PID:8484
- C:\Windows\System\vNOkqer.exe
  C:\Windows\System\vNOkqer.exe
  2⤵
  PID:8504
- C:\Windows\System\hVheGeB.exe
  C:\Windows\System\hVheGeB.exe
  2⤵
  PID:8532
- C:\Windows\System\tULWDSM.exe
  C:\Windows\System\tULWDSM.exe
  2⤵
  PID:8552
- C:\Windows\System\nBICKBC.exe
  C:\Windows\System\nBICKBC.exe
  2⤵
  PID:8592
- C:\Windows\System\plFBpwv.exe
  C:\Windows\System\plFBpwv.exe
  2⤵
  PID:8628
- C:\Windows\System\WNiqjMB.exe
  C:\Windows\System\WNiqjMB.exe
  2⤵
  PID:8652
- C:\Windows\System\qsTyyuU.exe
  C:\Windows\System\qsTyyuU.exe
  2⤵
  PID:8696
- C:\Windows\System\YXeUxOp.exe
  C:\Windows\System\YXeUxOp.exe
  2⤵
  PID:8720
- C:\Windows\System\NExnZjj.exe
  C:\Windows\System\NExnZjj.exe
  2⤵
  PID:8744
- C:\Windows\System\HHqkGXj.exe
  C:\Windows\System\HHqkGXj.exe
  2⤵
  PID:8764
- C:\Windows\System\HyHImxI.exe
  C:\Windows\System\HyHImxI.exe
  2⤵
  PID:8808
- C:\Windows\System\lqkYGRH.exe
  C:\Windows\System\lqkYGRH.exe
  2⤵
  PID:8824
- C:\Windows\System\DstVBGg.exe
  C:\Windows\System\DstVBGg.exe
  2⤵
  PID:8844
- C:\Windows\System\ppVzkKo.exe
  C:\Windows\System\ppVzkKo.exe
  2⤵
  PID:8872
- C:\Windows\System\HnuUuzj.exe
  C:\Windows\System\HnuUuzj.exe
  2⤵
  PID:8912
- C:\Windows\System\bTFnZRx.exe
  C:\Windows\System\bTFnZRx.exe
  2⤵
  PID:8932
- C:\Windows\System\mIBwvUj.exe
  C:\Windows\System\mIBwvUj.exe
  2⤵
  PID:8952
- C:\Windows\System\hLhwhvt.exe
  C:\Windows\System\hLhwhvt.exe
  2⤵
  PID:9000
- C:\Windows\System\csTqlvI.exe
  C:\Windows\System\csTqlvI.exe
  2⤵
  PID:9028
- C:\Windows\System\xAPXbrV.exe
  C:\Windows\System\xAPXbrV.exe
  2⤵
  PID:9052
- C:\Windows\System\sdtoNse.exe
  C:\Windows\System\sdtoNse.exe
  2⤵
  PID:9080
- C:\Windows\System\BXCyDJC.exe
  C:\Windows\System\BXCyDJC.exe
  2⤵
  PID:9100
- C:\Windows\System\dOtYItK.exe
  C:\Windows\System\dOtYItK.exe
  2⤵
  PID:9128
- C:\Windows\System\PJAHhDe.exe
  C:\Windows\System\PJAHhDe.exe
  2⤵
  PID:9160
- C:\Windows\System\LswPYWt.exe
  C:\Windows\System\LswPYWt.exe
  2⤵
  PID:9188
- C:\Windows\System\RQzwHhs.exe
  C:\Windows\System\RQzwHhs.exe
  2⤵
  PID:7364
- C:\Windows\System\NLptDtL.exe
  C:\Windows\System\NLptDtL.exe
  2⤵
  PID:8268
- C:\Windows\System\FVTLRJq.exe
  C:\Windows\System\FVTLRJq.exe
  2⤵
  PID:8284
- C:\Windows\System\PyivVJZ.exe
  C:\Windows\System\PyivVJZ.exe
  2⤵
  PID:8396
- C:\Windows\System\IWPJJxf.exe
  C:\Windows\System\IWPJJxf.exe
  2⤵
  PID:8416
- C:\Windows\System\MnlGGJK.exe
  C:\Windows\System\MnlGGJK.exe
  2⤵
  PID:8456
- C:\Windows\System\PIsQHoY.exe
  C:\Windows\System\PIsQHoY.exe
  2⤵
  PID:8520
- C:\Windows\System\bbzkmta.exe
  C:\Windows\System\bbzkmta.exe
  2⤵
  PID:8584
- C:\Windows\System\YffUIoY.exe
  C:\Windows\System\YffUIoY.exe
  2⤵
  PID:8620
- C:\Windows\System\IiRWjwa.exe
  C:\Windows\System\IiRWjwa.exe
  2⤵
  PID:8692
- C:\Windows\System\BJrWNWV.exe
  C:\Windows\System\BJrWNWV.exe
  2⤵
  PID:8772
- C:\Windows\System\UsuLTvQ.exe
  C:\Windows\System\UsuLTvQ.exe
  2⤵
  PID:8796
- C:\Windows\System\dOWnjFz.exe
  C:\Windows\System\dOWnjFz.exe
  2⤵
  PID:8820
- C:\Windows\System\xDajsHW.exe
  C:\Windows\System\xDajsHW.exe
  2⤵
  PID:8864
- C:\Windows\System\XCOfrNt.exe
  C:\Windows\System\XCOfrNt.exe
  2⤵
  PID:8944
- C:\Windows\System\iPqnjUU.exe
  C:\Windows\System\iPqnjUU.exe
  2⤵
  PID:8976
- C:\Windows\System\yZBAknD.exe
  C:\Windows\System\yZBAknD.exe
  2⤵
  PID:9020
- C:\Windows\System\ZyoBKxc.exe
  C:\Windows\System\ZyoBKxc.exe
  2⤵
  PID:9152
- C:\Windows\System\yQTdXpj.exe
  C:\Windows\System\yQTdXpj.exe
  2⤵
  PID:9204
- C:\Windows\System\jnCOqAO.exe
  C:\Windows\System\jnCOqAO.exe
  2⤵
  PID:8276
- C:\Windows\System\mXtzCpZ.exe
  C:\Windows\System\mXtzCpZ.exe
  2⤵
  PID:8368
- C:\Windows\System\soDZSEM.exe
  C:\Windows\System\soDZSEM.exe
  2⤵
  PID:8624
- C:\Windows\System\PYcoTkz.exe
  C:\Windows\System\PYcoTkz.exe
  2⤵
  PID:8904
- C:\Windows\System\eEbZJee.exe
  C:\Windows\System\eEbZJee.exe
  2⤵
  PID:8220
- C:\Windows\System\iiwTMXp.exe
  C:\Windows\System\iiwTMXp.exe
  2⤵
  PID:8736
- C:\Windows\System\aDMUGXm.exe
  C:\Windows\System\aDMUGXm.exe
  2⤵
  PID:8788
- C:\Windows\System\QYEhvGJ.exe
  C:\Windows\System\QYEhvGJ.exe
  2⤵
  PID:8644
- C:\Windows\System\ERcvWMu.exe
  C:\Windows\System\ERcvWMu.exe
  2⤵
  PID:8320
- C:\Windows\System\RdTqvYm.exe
  C:\Windows\System\RdTqvYm.exe
  2⤵
  PID:8792
- C:\Windows\System\LfCCApW.exe
  C:\Windows\System\LfCCApW.exe
  2⤵
  PID:9236
- C:\Windows\System\dxpnfYX.exe
  C:\Windows\System\dxpnfYX.exe
  2⤵
  PID:9280
- C:\Windows\System\IjKQAwH.exe
  C:\Windows\System\IjKQAwH.exe
  2⤵
  PID:9308
- C:\Windows\System\IodWAAn.exe
  C:\Windows\System\IodWAAn.exe
  2⤵
  PID:9348
- C:\Windows\System\joklqLN.exe
  C:\Windows\System\joklqLN.exe
  2⤵
  PID:9368
- C:\Windows\System\QhUNaJS.exe
  C:\Windows\System\QhUNaJS.exe
  2⤵
  PID:9388
- C:\Windows\System\EJvAaQH.exe
  C:\Windows\System\EJvAaQH.exe
  2⤵
  PID:9408
- C:\Windows\System\OveOIha.exe
  C:\Windows\System\OveOIha.exe
  2⤵
  PID:9432
- C:\Windows\System\tdVAIQF.exe
  C:\Windows\System\tdVAIQF.exe
  2⤵
  PID:9456
- C:\Windows\System\dyrYNvD.exe
  C:\Windows\System\dyrYNvD.exe
  2⤵
  PID:9472
- C:\Windows\System\nlOoaiS.exe
  C:\Windows\System\nlOoaiS.exe
  2⤵
  PID:9504
- C:\Windows\System\wBAkhDT.exe
  C:\Windows\System\wBAkhDT.exe
  2⤵
  PID:9528
- C:\Windows\System\VyynriU.exe
  C:\Windows\System\VyynriU.exe
  2⤵
  PID:9584
- C:\Windows\System\DTTEbMd.exe
  C:\Windows\System\DTTEbMd.exe
  2⤵
  PID:9604
- C:\Windows\System\agCSkha.exe
  C:\Windows\System\agCSkha.exe
  2⤵
  PID:9628
- C:\Windows\System\IRyTnDe.exe
  C:\Windows\System\IRyTnDe.exe
  2⤵
  PID:9648
- C:\Windows\System\TPWQfnl.exe
  C:\Windows\System\TPWQfnl.exe
  2⤵
  PID:9684
- C:\Windows\System\WdfeFbJ.exe
  C:\Windows\System\WdfeFbJ.exe
  2⤵
  PID:9724
- C:\Windows\System\ydQywmd.exe
  C:\Windows\System\ydQywmd.exe
  2⤵
  PID:9756
- C:\Windows\System\XcbxVKb.exe
  C:\Windows\System\XcbxVKb.exe
  2⤵
  PID:9772
- C:\Windows\System\hoiBVWw.exe
  C:\Windows\System\hoiBVWw.exe
  2⤵
  PID:9800
- C:\Windows\System\Bziwsww.exe
  C:\Windows\System\Bziwsww.exe
  2⤵
  PID:9848
- C:\Windows\System\oRpWxXn.exe
  C:\Windows\System\oRpWxXn.exe
  2⤵
  PID:9868
- C:\Windows\System\GkTPxeQ.exe
  C:\Windows\System\GkTPxeQ.exe
  2⤵
  PID:9888
- C:\Windows\System\uLrMSOG.exe
  C:\Windows\System\uLrMSOG.exe
  2⤵
  PID:9928
- C:\Windows\System\iYbigde.exe
  C:\Windows\System\iYbigde.exe
  2⤵
  PID:9948
- C:\Windows\System\JlxnXYm.exe
  C:\Windows\System\JlxnXYm.exe
  2⤵
  PID:9976
- C:\Windows\System\CeYDwDn.exe
  C:\Windows\System\CeYDwDn.exe
  2⤵
  PID:10016
- C:\Windows\System\HZrFYoh.exe
  C:\Windows\System\HZrFYoh.exe
  2⤵
  PID:10032
- C:\Windows\System\kwKXunM.exe
  C:\Windows\System\kwKXunM.exe
  2⤵
  PID:10056
- C:\Windows\System\fDNYjic.exe
  C:\Windows\System\fDNYjic.exe
  2⤵
  PID:10076
- C:\Windows\System\favaUWq.exe
  C:\Windows\System\favaUWq.exe
  2⤵
  PID:10120
- C:\Windows\System\XUiUWbi.exe
  C:\Windows\System\XUiUWbi.exe
  2⤵
  PID:10156
- C:\Windows\System\ELtxsPm.exe
  C:\Windows\System\ELtxsPm.exe
  2⤵
  PID:10184
- C:\Windows\System\CWHfppk.exe
  C:\Windows\System\CWHfppk.exe
  2⤵
  PID:10220
- C:\Windows\System\MStHqkl.exe
  C:\Windows\System\MStHqkl.exe
  2⤵
  PID:10236
- C:\Windows\System\rVumfZO.exe
  C:\Windows\System\rVumfZO.exe
  2⤵
  PID:9248
- C:\Windows\System\fivAATz.exe
  C:\Windows\System\fivAATz.exe
  2⤵
  PID:9292
- C:\Windows\System\RtFOfjS.exe
  C:\Windows\System\RtFOfjS.exe
  2⤵
  PID:9560
- C:\Windows\System\RNfSdQZ.exe
  C:\Windows\System\RNfSdQZ.exe
  2⤵
  PID:9624
- C:\Windows\System\UWZyICN.exe
  C:\Windows\System\UWZyICN.exe
  2⤵
  PID:9636
- C:\Windows\System\ArhyEeN.exe
  C:\Windows\System\ArhyEeN.exe
  2⤵
  PID:9748
- C:\Windows\System\QRKUvRo.exe
  C:\Windows\System\QRKUvRo.exe
  2⤵
  PID:9768
- C:\Windows\System\OpooMIB.exe
  C:\Windows\System\OpooMIB.exe
  2⤵
  PID:9788
- C:\Windows\System\NvDGwke.exe
  C:\Windows\System\NvDGwke.exe
  2⤵
  PID:9920
- C:\Windows\System\coUusIO.exe
  C:\Windows\System\coUusIO.exe
  2⤵
  PID:9944
- C:\Windows\System\fjLchtc.exe
  C:\Windows\System\fjLchtc.exe
  2⤵
  PID:10044
- C:\Windows\System\VWWVrSS.exe
  C:\Windows\System\VWWVrSS.exe
  2⤵
  PID:4956
- C:\Windows\System\dJLnJvC.exe
  C:\Windows\System\dJLnJvC.exe
  2⤵
  PID:10112
- C:\Windows\System\IeAjXZj.exe
  C:\Windows\System\IeAjXZj.exe
  2⤵
  PID:9232
- C:\Windows\System\mdmzJYA.exe
  C:\Windows\System\mdmzJYA.exe
  2⤵
  PID:8940
- C:\Windows\System\rWJymkk.exe
  C:\Windows\System\rWJymkk.exe
  2⤵
  PID:3760
- C:\Windows\System\hBVvddG.exe
  C:\Windows\System\hBVvddG.exe
  2⤵
  PID:9340
- C:\Windows\System\brDRbUZ.exe
  C:\Windows\System\brDRbUZ.exe
  2⤵
  PID:9444
- C:\Windows\System\Hjgyrow.exe
  C:\Windows\System\Hjgyrow.exe
  2⤵
  PID:9524
- C:\Windows\System\OZxbdJU.exe
  C:\Windows\System\OZxbdJU.exe
  2⤵
  PID:9836
- C:\Windows\System\gYIGUlE.exe
  C:\Windows\System\gYIGUlE.exe
  2⤵
  PID:9916
- C:\Windows\System\PwifoNR.exe
  C:\Windows\System\PwifoNR.exe
  2⤵
  PID:4524
- C:\Windows\System\WdGLmne.exe
  C:\Windows\System\WdGLmne.exe
  2⤵
  PID:10104
- C:\Windows\System\nMNQLWS.exe
  C:\Windows\System\nMNQLWS.exe
  2⤵
  PID:9320
- C:\Windows\System\hivPTAL.exe
  C:\Windows\System\hivPTAL.exe
  2⤵
  PID:9500
- C:\Windows\System\FZDWCgi.exe
  C:\Windows\System\FZDWCgi.exe
  2⤵
  PID:9732
- C:\Windows\System\kvPICkt.exe
  C:\Windows\System\kvPICkt.exe
  2⤵
  PID:10180
- C:\Windows\System\etOEjjQ.exe
  C:\Windows\System\etOEjjQ.exe
  2⤵
  PID:9496
- C:\Windows\System\drRBGCl.exe
  C:\Windows\System\drRBGCl.exe
  2⤵
  PID:2016
- C:\Windows\System\lVXMTTl.exe
  C:\Windows\System\lVXMTTl.exe
  2⤵
  PID:10260
- C:\Windows\System\uKZaxIL.exe
  C:\Windows\System\uKZaxIL.exe
  2⤵
  PID:10276
- C:\Windows\System\ZuiptQl.exe
  C:\Windows\System\ZuiptQl.exe
  2⤵
  PID:10292
- C:\Windows\System\AGaLuJG.exe
  C:\Windows\System\AGaLuJG.exe
  2⤵
  PID:10328
- C:\Windows\System\pNbCTTq.exe
  C:\Windows\System\pNbCTTq.exe
  2⤵
  PID:10356
- C:\Windows\System\pbbKRFX.exe
  C:\Windows\System\pbbKRFX.exe
  2⤵
  PID:10404
- C:\Windows\System\oRUvswE.exe
  C:\Windows\System\oRUvswE.exe
  2⤵
  PID:10456
- C:\Windows\System\LAgNsGZ.exe
  C:\Windows\System\LAgNsGZ.exe
  2⤵
  PID:10476
- C:\Windows\System\XOsWUGV.exe
  C:\Windows\System\XOsWUGV.exe
  2⤵
  PID:10504
- C:\Windows\System\IWjkJSI.exe
  C:\Windows\System\IWjkJSI.exe
  2⤵
  PID:10524
- C:\Windows\System\Jxnsuzj.exe
  C:\Windows\System\Jxnsuzj.exe
  2⤵
  PID:10552
- C:\Windows\System\OqXLpDU.exe
  C:\Windows\System\OqXLpDU.exe
  2⤵
  PID:10600
- C:\Windows\System\pTpGKsI.exe
  C:\Windows\System\pTpGKsI.exe
  2⤵
  PID:10616
- C:\Windows\System\mjjUlAb.exe
  C:\Windows\System\mjjUlAb.exe
  2⤵
  PID:10636
- C:\Windows\System\muXmjCE.exe
  C:\Windows\System\muXmjCE.exe
  2⤵
  PID:10684
- C:\Windows\System\DbNzwjw.exe
  C:\Windows\System\DbNzwjw.exe
  2⤵
  PID:10724
- C:\Windows\System\zXXeRKT.exe
  C:\Windows\System\zXXeRKT.exe
  2⤵
  PID:10744
- C:\Windows\System\IUdTCUX.exe
  C:\Windows\System\IUdTCUX.exe
  2⤵
  PID:10768
- C:\Windows\System\qowjFox.exe
  C:\Windows\System\qowjFox.exe
  2⤵
  PID:10788
- C:\Windows\System\wYnYTYF.exe
  C:\Windows\System\wYnYTYF.exe
  2⤵
  PID:10812
- C:\Windows\System\SddLQvR.exe
  C:\Windows\System\SddLQvR.exe
  2⤵
  PID:10828
- C:\Windows\System\fbilnmw.exe
  C:\Windows\System\fbilnmw.exe
  2⤵
  PID:10872
- C:\Windows\System\XSWWFZq.exe
  C:\Windows\System\XSWWFZq.exe
  2⤵
  PID:10892
- C:\Windows\System\bXUWLoj.exe
  C:\Windows\System\bXUWLoj.exe
  2⤵
  PID:10916
- C:\Windows\System\zkQRjot.exe
  C:\Windows\System\zkQRjot.exe
  2⤵
  PID:10936
- C:\Windows\System\RJCNdVC.exe
  C:\Windows\System\RJCNdVC.exe
  2⤵
  PID:10964
- C:\Windows\System\jmHGnNP.exe
  C:\Windows\System\jmHGnNP.exe
  2⤵
  PID:10984
- C:\Windows\System\soRYKWD.exe
  C:\Windows\System\soRYKWD.exe
  2⤵
  PID:11016
- C:\Windows\System\PCDCDzb.exe
  C:\Windows\System\PCDCDzb.exe
  2⤵
  PID:11036
- C:\Windows\System\tVYtRiB.exe
  C:\Windows\System\tVYtRiB.exe
  2⤵
  PID:11096
- C:\Windows\System\lguiwnd.exe
  C:\Windows\System\lguiwnd.exe
  2⤵
  PID:11120
- C:\Windows\System\kxrRtjX.exe
  C:\Windows\System\kxrRtjX.exe
  2⤵
  PID:11140
- C:\Windows\System\DRxtgZE.exe
  C:\Windows\System\DRxtgZE.exe
  2⤵
  PID:11188
- C:\Windows\System\CSHeSvS.exe
  C:\Windows\System\CSHeSvS.exe
  2⤵
  PID:11216
- C:\Windows\System\XEmumlM.exe
  C:\Windows\System\XEmumlM.exe
  2⤵
  PID:11256
- C:\Windows\System\FotRCQI.exe
  C:\Windows\System\FotRCQI.exe
  2⤵
  PID:10208
- C:\Windows\System\cZMMKln.exe
  C:\Windows\System\cZMMKln.exe
  2⤵
  PID:9640
- C:\Windows\System\FZzrmel.exe
  C:\Windows\System\FZzrmel.exe
  2⤵
  PID:10312
- C:\Windows\System\cTxGbzv.exe
  C:\Windows\System\cTxGbzv.exe
  2⤵
  PID:10288
- C:\Windows\System\reYLLpl.exe
  C:\Windows\System\reYLLpl.exe
  2⤵
  PID:10388
- C:\Windows\System\XutJeGj.exe
  C:\Windows\System\XutJeGj.exe
  2⤵
  PID:10432
- C:\Windows\System\daaTfAH.exe
  C:\Windows\System\daaTfAH.exe
  2⤵
  PID:10516
- C:\Windows\System\DjVCRDb.exe
  C:\Windows\System\DjVCRDb.exe
  2⤵
  PID:10548
- C:\Windows\System\aKDtctG.exe
  C:\Windows\System\aKDtctG.exe
  2⤵
  PID:10608
- C:\Windows\System\sZSUiCL.exe
  C:\Windows\System\sZSUiCL.exe
  2⤵
  PID:10676
- C:\Windows\System\oWzbHNy.exe
  C:\Windows\System\oWzbHNy.exe
  2⤵
  PID:10732
- C:\Windows\System\uFRGeTF.exe
  C:\Windows\System\uFRGeTF.exe
  2⤵
  PID:10852
- C:\Windows\System\JKwUfGo.exe
  C:\Windows\System\JKwUfGo.exe
  2⤵
  PID:10884
- C:\Windows\System\xOTdUzT.exe
  C:\Windows\System\xOTdUzT.exe
  2⤵
  PID:11012
- C:\Windows\System\RxEKydE.exe
  C:\Windows\System\RxEKydE.exe
  2⤵
  PID:11064
- C:\Windows\System\reipTyS.exe
  C:\Windows\System\reipTyS.exe
  2⤵
  PID:11088
- C:\Windows\System\KmbkSBU.exe
  C:\Windows\System\KmbkSBU.exe
  2⤵
  PID:11116
- C:\Windows\System\wVZMQPK.exe
  C:\Windows\System\wVZMQPK.exe
  2⤵
  PID:11184
- C:\Windows\System\pLGbpur.exe
  C:\Windows\System\pLGbpur.exe
  2⤵
  PID:11236
- C:\Windows\System\QJjmqwP.exe
  C:\Windows\System\QJjmqwP.exe
  2⤵
  PID:10268
- C:\Windows\System\WQZcbLt.exe
  C:\Windows\System\WQZcbLt.exe
  2⤵
  PID:10364
- C:\Windows\System\GorsiFV.exe
  C:\Windows\System\GorsiFV.exe
  2⤵
  PID:10572
- C:\Windows\System\GUWliTd.exe
  C:\Windows\System\GUWliTd.exe
  2⤵
  PID:10780
- C:\Windows\System\OiGGzIR.exe
  C:\Windows\System\OiGGzIR.exe
  2⤵
  PID:10880
- C:\Windows\System\OUQVmCs.exe
  C:\Windows\System\OUQVmCs.exe
  2⤵
  PID:10980
- C:\Windows\System\LoNezqT.exe
  C:\Windows\System\LoNezqT.exe
  2⤵
  PID:11132
- C:\Windows\System\blfpWFK.exe
  C:\Windows\System\blfpWFK.exe
  2⤵
  PID:3504
- C:\Windows\System\uLpFSal.exe
  C:\Windows\System\uLpFSal.exe
  2⤵
  PID:10248
- C:\Windows\System\VqbItZZ.exe
  C:\Windows\System\VqbItZZ.exe
  2⤵
  PID:10992
- C:\Windows\System\kRGOLEC.exe
  C:\Windows\System\kRGOLEC.exe
  2⤵
  PID:10340
- C:\Windows\System\MzyiMFn.exe
  C:\Windows\System\MzyiMFn.exe
  2⤵
  PID:10844
- C:\Windows\System\FjsmHSF.exe
  C:\Windows\System\FjsmHSF.exe
  2⤵
  PID:1732
- C:\Windows\System\RjmMQfS.exe
  C:\Windows\System\RjmMQfS.exe
  2⤵
  PID:11280
- C:\Windows\System\AfDJGuK.exe
  C:\Windows\System\AfDJGuK.exe
  2⤵
  PID:11300
- C:\Windows\System\YxHSIfd.exe
  C:\Windows\System\YxHSIfd.exe
  2⤵
  PID:11336
- C:\Windows\System\yuQjXml.exe
  C:\Windows\System\yuQjXml.exe
  2⤵
  PID:11404
- C:\Windows\System\fzYapCi.exe
  C:\Windows\System\fzYapCi.exe
  2⤵
  PID:11432
- C:\Windows\System\bxkqMHg.exe
  C:\Windows\System\bxkqMHg.exe
  2⤵
  PID:11452
- C:\Windows\System\ZpufGhq.exe
  C:\Windows\System\ZpufGhq.exe
  2⤵
  PID:11488
- C:\Windows\System\utOQzpc.exe
  C:\Windows\System\utOQzpc.exe
  2⤵
  PID:11508
- C:\Windows\System\soidCrY.exe
  C:\Windows\System\soidCrY.exe
  2⤵
  PID:11528
- C:\Windows\System\bCTaXIv.exe
  C:\Windows\System\bCTaXIv.exe
  2⤵
  PID:11572
- C:\Windows\System\xCHGRVZ.exe
  C:\Windows\System\xCHGRVZ.exe
  2⤵
  PID:11596
- C:\Windows\System\dSnxYpA.exe
  C:\Windows\System\dSnxYpA.exe
  2⤵
  PID:11612
- C:\Windows\System\qCcviQx.exe
  C:\Windows\System\qCcviQx.exe
  2⤵
  PID:11640
- C:\Windows\System\eWvqmLe.exe
  C:\Windows\System\eWvqmLe.exe
  2⤵
  PID:11680
- C:\Windows\System\iZbLmzt.exe
  C:\Windows\System\iZbLmzt.exe
  2⤵
  PID:11704
- C:\Windows\System\TVsjtTs.exe
  C:\Windows\System\TVsjtTs.exe
  2⤵
  PID:11728
- C:\Windows\System\LSibQqJ.exe
  C:\Windows\System\LSibQqJ.exe
  2⤵
  PID:11744
- C:\Windows\System\neBCPrG.exe
  C:\Windows\System\neBCPrG.exe
  2⤵
  PID:11764
- C:\Windows\System\ZJSFdnK.exe
  C:\Windows\System\ZJSFdnK.exe
  2⤵
  PID:11780
- C:\Windows\System\dpWtoph.exe
  C:\Windows\System\dpWtoph.exe
  2⤵
  PID:11800
- C:\Windows\System\KUghUTm.exe
  C:\Windows\System\KUghUTm.exe
  2⤵
  PID:11848
- C:\Windows\System\bwKCLgF.exe
  C:\Windows\System\bwKCLgF.exe
  2⤵
  PID:11876
- C:\Windows\System\NfaHyGs.exe
  C:\Windows\System\NfaHyGs.exe
  2⤵
  PID:11904
- C:\Windows\System\ZiJHTpU.exe
  C:\Windows\System\ZiJHTpU.exe
  2⤵
  PID:11940
- C:\Windows\System\tAwKDQT.exe
  C:\Windows\System\tAwKDQT.exe
  2⤵
  PID:11964
- C:\Windows\System\XShsvra.exe
  C:\Windows\System\XShsvra.exe
  2⤵
  PID:11988
- C:\Windows\System\yLnwote.exe
  C:\Windows\System\yLnwote.exe
  2⤵
  PID:12008
- C:\Windows\System\kTvRqUL.exe
  C:\Windows\System\kTvRqUL.exe
  2⤵
  PID:12036
- C:\Windows\System\TTvzUVe.exe
  C:\Windows\System\TTvzUVe.exe
  2⤵
  PID:12100
- C:\Windows\System\xEFmIQj.exe
  C:\Windows\System\xEFmIQj.exe
  2⤵
  PID:12120
- C:\Windows\System\KdsIBqP.exe
  C:\Windows\System\KdsIBqP.exe
  2⤵
  PID:12144
- C:\Windows\System\QlPHSIA.exe
  C:\Windows\System\QlPHSIA.exe
  2⤵
  PID:12192
- C:\Windows\System\hCNAnEq.exe
  C:\Windows\System\hCNAnEq.exe
  2⤵
  PID:12232
- C:\Windows\System\PmfLbQX.exe
  C:\Windows\System\PmfLbQX.exe
  2⤵
  PID:12256
- C:\Windows\System\nVVxdEe.exe
  C:\Windows\System\nVVxdEe.exe
  2⤵
  PID:12280
- C:\Windows\System\nnsNHys.exe
  C:\Windows\System\nnsNHys.exe
  2⤵
  PID:9812
- C:\Windows\System\tdLpSar.exe
  C:\Windows\System\tdLpSar.exe
  2⤵
  PID:11352
- C:\Windows\System\catNsUf.exe
  C:\Windows\System\catNsUf.exe
  2⤵
  PID:11376
- C:\Windows\System\OBfqGYE.exe
  C:\Windows\System\OBfqGYE.exe
  2⤵
  PID:11444
- C:\Windows\System\mpBeykz.exe
  C:\Windows\System\mpBeykz.exe
  2⤵
  PID:11548
- C:\Windows\System\MrBYOVq.exe
  C:\Windows\System\MrBYOVq.exe
  2⤵
  PID:11604
- C:\Windows\System\MJxWbQH.exe
  C:\Windows\System\MJxWbQH.exe
  2⤵
  PID:11656
- C:\Windows\System\hBPmvPV.exe
  C:\Windows\System\hBPmvPV.exe
  2⤵
  PID:11700
- C:\Windows\System\vmlPvcc.exe
  C:\Windows\System\vmlPvcc.exe
  2⤵
  PID:11752
- C:\Windows\System\fQoPhWD.exe
  C:\Windows\System\fQoPhWD.exe
  2⤵
  PID:11840
- C:\Windows\System\PaBQNHd.exe
  C:\Windows\System\PaBQNHd.exe
  2⤵
  PID:11828
- C:\Windows\System\CPLkCeT.exe
  C:\Windows\System\CPLkCeT.exe
  2⤵
  PID:11972
- C:\Windows\System\qXSlqjO.exe
  C:\Windows\System\qXSlqjO.exe
  2⤵
  PID:12044
- C:\Windows\System\vpWZmku.exe
  C:\Windows\System\vpWZmku.exe
  2⤵
  PID:12088
- C:\Windows\System\RgdOBum.exe
  C:\Windows\System\RgdOBum.exe
  2⤵
  PID:12136
- C:\Windows\System\iywJruA.exe
  C:\Windows\System\iywJruA.exe
  2⤵
  PID:12240
- C:\Windows\System\GUrwXAh.exe
  C:\Windows\System\GUrwXAh.exe
  2⤵
  PID:10972
- C:\Windows\System\rVxIvYx.exe
  C:\Windows\System\rVxIvYx.exe
  2⤵
  PID:11312
- C:\Windows\System\ftsFQmq.exe
  C:\Windows\System\ftsFQmq.exe
  2⤵
  PID:10588
- C:\Windows\System\rNUKoME.exe
  C:\Windows\System\rNUKoME.exe
  2⤵
  PID:11584
- C:\Windows\System\swqqYbt.exe
  C:\Windows\System\swqqYbt.exe
  2⤵
  PID:11628
- C:\Windows\System\LQSKMzk.exe
  C:\Windows\System\LQSKMzk.exe
  2⤵
  PID:11900
- C:\Windows\System\BRYWuwT.exe
  C:\Windows\System\BRYWuwT.exe
  2⤵
  PID:12000
- C:\Windows\System\VDuUwBJ.exe
  C:\Windows\System\VDuUwBJ.exe
  2⤵
  PID:12204
- C:\Windows\System\EPfBYGp.exe
  C:\Windows\System\EPfBYGp.exe
  2⤵
  PID:11364
- C:\Windows\System\naipQKf.exe
  C:\Windows\System\naipQKf.exe
  2⤵
  PID:11636
- C:\Windows\System\xZLRbWs.exe
  C:\Windows\System\xZLRbWs.exe
  2⤵
  PID:11956
- C:\Windows\System\qrdynuq.exe
  C:\Windows\System\qrdynuq.exe
  2⤵
  PID:12116
- C:\Windows\System\bRJrmfi.exe
  C:\Windows\System\bRJrmfi.exe
  2⤵
  PID:12304
- C:\Windows\System\mijREpt.exe
  C:\Windows\System\mijREpt.exe
  2⤵
  PID:12324
- C:\Windows\System\SIVYMYt.exe
  C:\Windows\System\SIVYMYt.exe
  2⤵
  PID:12380
- C:\Windows\System\CfruPoV.exe
  C:\Windows\System\CfruPoV.exe
  2⤵
  PID:12412
- C:\Windows\System\xBqKhSz.exe
  C:\Windows\System\xBqKhSz.exe
  2⤵
  PID:12444
- C:\Windows\System\BDHNzFR.exe
  C:\Windows\System\BDHNzFR.exe
  2⤵
  PID:12468
- C:\Windows\System\WJgWpaA.exe
  C:\Windows\System\WJgWpaA.exe
  2⤵
  PID:12492
- C:\Windows\System\bPaBahc.exe
  C:\Windows\System\bPaBahc.exe
  2⤵
  PID:12512
- C:\Windows\System\UJMmAxT.exe
  C:\Windows\System\UJMmAxT.exe
  2⤵
  PID:12548
- C:\Windows\System\eYrDtck.exe
  C:\Windows\System\eYrDtck.exe
  2⤵
  PID:12564
- C:\Windows\System\xnQVPsV.exe
  C:\Windows\System\xnQVPsV.exe
  2⤵
  PID:12584
- C:\Windows\System\TdfqbEl.exe
  C:\Windows\System\TdfqbEl.exe
  2⤵
  PID:12612
- C:\Windows\System\ckjfVJB.exe
  C:\Windows\System\ckjfVJB.exe
  2⤵
  PID:12652
- C:\Windows\System\LWCEAkv.exe
  C:\Windows\System\LWCEAkv.exe
  2⤵
  PID:12680
- C:\Windows\System\kMXAMyK.exe
  C:\Windows\System\kMXAMyK.exe
  2⤵
  PID:12708
- C:\Windows\System\ZUHnxNC.exe
  C:\Windows\System\ZUHnxNC.exe
  2⤵
  PID:12752
- C:\Windows\System\TaYniZp.exe
  C:\Windows\System\TaYniZp.exe
  2⤵
  PID:12776
- C:\Windows\System\aynpjwU.exe
  C:\Windows\System\aynpjwU.exe
  2⤵
  PID:12812
- C:\Windows\System\txscRKz.exe
  C:\Windows\System\txscRKz.exe
  2⤵
  PID:12844
- C:\Windows\System\tDBRUWi.exe
  C:\Windows\System\tDBRUWi.exe
  2⤵
  PID:12868
- C:\Windows\System\riZDCef.exe
  C:\Windows\System\riZDCef.exe
  2⤵
  PID:12892
- C:\Windows\System\BMAxGRm.exe
  C:\Windows\System\BMAxGRm.exe
  2⤵
  PID:12972
- C:\Windows\System\OdmoQfL.exe
  C:\Windows\System\OdmoQfL.exe
  2⤵
  PID:13060
- C:\Windows\System\KIHoZLX.exe
  C:\Windows\System\KIHoZLX.exe
  2⤵
  PID:13080
- C:\Windows\System\nSMRUIY.exe
  C:\Windows\System\nSMRUIY.exe
  2⤵
  PID:13116
- C:\Windows\System\CntKeVw.exe
  C:\Windows\System\CntKeVw.exe
  2⤵
  PID:13132
- C:\Windows\System\McJxSrk.exe
  C:\Windows\System\McJxSrk.exe
  2⤵
  PID:13148
- C:\Windows\System\ddSPoOe.exe
  C:\Windows\System\ddSPoOe.exe
  2⤵
  PID:13164
- C:\Windows\System\gsNurGm.exe
  C:\Windows\System\gsNurGm.exe
  2⤵
  PID:13204
- C:\Windows\System\FhDWDVX.exe
  C:\Windows\System\FhDWDVX.exe
  2⤵
  PID:13224
- C:\Windows\System\qGxctyk.exe
  C:\Windows\System\qGxctyk.exe
  2⤵
  PID:13248
- C:\Windows\System\fCYlmFc.exe
  C:\Windows\System\fCYlmFc.exe
  2⤵
  PID:13300
- C:\Windows\System\njsxTar.exe
  C:\Windows\System\njsxTar.exe
  2⤵
  PID:10716
- C:\Windows\System\lGzKDAA.exe
  C:\Windows\System\lGzKDAA.exe
  2⤵
  PID:12316
- C:\Windows\System\uJMtquK.exe
  C:\Windows\System\uJMtquK.exe
  2⤵
  PID:12428
- C:\Windows\System\MheJNzM.exe
  C:\Windows\System\MheJNzM.exe
  2⤵
  PID:12460
- C:\Windows\System\ORccGBV.exe
  C:\Windows\System\ORccGBV.exe
  2⤵
  PID:12520
- C:\Windows\System\ZFaITWf.exe
  C:\Windows\System\ZFaITWf.exe
  2⤵
  PID:12600
- C:\Windows\System\hpFuPtg.exe
  C:\Windows\System\hpFuPtg.exe
  2⤵
  PID:12608
- C:\Windows\System\phDLvAe.exe
  C:\Windows\System\phDLvAe.exe
  2⤵
  PID:12644
- C:\Windows\System\YTZiwXl.exe
  C:\Windows\System\YTZiwXl.exe
  2⤵
  PID:12724
- C:\Windows\System\DDIdjex.exe
  C:\Windows\System\DDIdjex.exe
  2⤵
  PID:12760
- C:\Windows\System\hnyTvWs.exe
  C:\Windows\System\hnyTvWs.exe
  2⤵
  PID:12792
- C:\Windows\System\vVrXmTK.exe
  C:\Windows\System\vVrXmTK.exe
  2⤵
  PID:12968
- C:\Windows\System\JlyzeKC.exe
  C:\Windows\System\JlyzeKC.exe
  2⤵
  PID:12916
- C:\Windows\System\LmACUBI.exe
  C:\Windows\System\LmACUBI.exe
  2⤵
  PID:12936
- C:\Windows\System\hHWUzRJ.exe
  C:\Windows\System\hHWUzRJ.exe
  2⤵
  PID:13020
- C:\Windows\System\PzgZcWO.exe
  C:\Windows\System\PzgZcWO.exe
  2⤵
  PID:13040
- C:\Windows\System\HQqulWs.exe
  C:\Windows\System\HQqulWs.exe
  2⤵
  PID:13144
- C:\Windows\System\RmHFokj.exe
  C:\Windows\System\RmHFokj.exe
  2⤵
  PID:13124
- C:\Windows\System\MaefsOL.exe
  C:\Windows\System\MaefsOL.exe
  2⤵
  PID:13268
- C:\Windows\System\qvBFLov.exe
  C:\Windows\System\qvBFLov.exe
  2⤵
  PID:13220
- C:\Windows\System\BsMVptz.exe
  C:\Windows\System\BsMVptz.exe
  2⤵
  PID:12356
- C:\Windows\System\bFVcTDC.exe
  C:\Windows\System\bFVcTDC.exe
  2⤵
  PID:12528
- C:\Windows\System\DBtcvex.exe
  C:\Windows\System\DBtcvex.exe
  2⤵
  PID:12604
- C:\Windows\System\IYAvFti.exe
  C:\Windows\System\IYAvFti.exe
  2⤵
  PID:12744
- C:\Windows\System\puiihEH.exe
  C:\Windows\System\puiihEH.exe
  2⤵
  PID:704
- C:\Windows\System\xWFChVB.exe
  C:\Windows\System\xWFChVB.exe
  2⤵
  PID:12800
- C:\Windows\System\sUkxAyD.exe
  C:\Windows\System\sUkxAyD.exe
  2⤵
  PID:12996
- C:\Windows\System\JRgEePt.exe
  C:\Windows\System\JRgEePt.exe
  2⤵
  PID:13108
- C:\Windows\System\SuiIkFx.exe
  C:\Windows\System\SuiIkFx.exe
  2⤵
  PID:12312
- C:\Windows\System\IqYvFJa.exe
  C:\Windows\System\IqYvFJa.exe
  2⤵
  PID:12704
- C:\Windows\System\hilCcfc.exe
  C:\Windows\System\hilCcfc.exe
  2⤵
  PID:1216
- C:\Windows\System\VxFFnnZ.exe
  C:\Windows\System\VxFFnnZ.exe
  2⤵
  PID:12952
- C:\Windows\System\UHuNVRh.exe
  C:\Windows\System\UHuNVRh.exe
  2⤵
  PID:13008
- C:\Windows\System\EbRQrXR.exe
  C:\Windows\System\EbRQrXR.exe
  2⤵
  PID:12264
- C:\Windows\System\WWRyxeo.exe
  C:\Windows\System\WWRyxeo.exe
  2⤵
  PID:12560
- C:\Windows\System\CpGUXSi.exe
  C:\Windows\System\CpGUXSi.exe
  2⤵
  PID:13048
- C:\Windows\System\VOmUWJo.exe
  C:\Windows\System\VOmUWJo.exe
  2⤵
  PID:13352
- C:\Windows\System\jTZgNBF.exe
  C:\Windows\System\jTZgNBF.exe
  2⤵
  PID:13384
- C:\Windows\System\gcocKgr.exe
  C:\Windows\System\gcocKgr.exe
  2⤵
  PID:13412
- C:\Windows\System\yXtGNtx.exe
  C:\Windows\System\yXtGNtx.exe
  2⤵
  PID:13432
- C:\Windows\System\iNaFeXb.exe
  C:\Windows\System\iNaFeXb.exe
  2⤵
  PID:13488
- C:\Windows\System\mLhdMdz.exe
  C:\Windows\System\mLhdMdz.exe
  2⤵
  PID:13508
- C:\Windows\System\cyeAqAf.exe
  C:\Windows\System\cyeAqAf.exe
  2⤵
  PID:13532
- C:\Windows\System\foqIdVb.exe
  C:\Windows\System\foqIdVb.exe
  2⤵
  PID:13556
- C:\Windows\System\lkqVQwV.exe
  C:\Windows\System\lkqVQwV.exe
  2⤵
  PID:13572
- C:\Windows\System\LGIKMGf.exe
  C:\Windows\System\LGIKMGf.exe
  2⤵
  PID:13596
- C:\Windows\System\piyKOQA.exe
  C:\Windows\System\piyKOQA.exe
  2⤵
  PID:13616
- C:\Windows\System\MdlVCMX.exe
  C:\Windows\System\MdlVCMX.exe
  2⤵
  PID:13640
- C:\Windows\System\CPMNwRP.exe
  C:\Windows\System\CPMNwRP.exe
  2⤵
  PID:13660
- C:\Windows\System\vFxDJCY.exe
  C:\Windows\System\vFxDJCY.exe
  2⤵
  PID:13676
- C:\Windows\System\oFYQBaL.exe
  C:\Windows\System\oFYQBaL.exe
  2⤵
  PID:13696
- C:\Windows\System\gxcAzkI.exe
  C:\Windows\System\gxcAzkI.exe
  2⤵
  PID:13720
- C:\Windows\System\quRHOCF.exe
  C:\Windows\System\quRHOCF.exe
  2⤵
  PID:13740
- C:\Windows\System\qVniBtE.exe
  C:\Windows\System\qVniBtE.exe
  2⤵
  PID:13760
- C:\Windows\System\TCLTJQD.exe
  C:\Windows\System\TCLTJQD.exe
  2⤵
  PID:13788
- C:\Windows\System\sudLPQl.exe
  C:\Windows\System\sudLPQl.exe
  2⤵
  PID:13804
- C:\Windows\System\TjlchQB.exe
  C:\Windows\System\TjlchQB.exe
  2⤵
  PID:13824
- C:\Windows\System\oEDuwHT.exe
  C:\Windows\System\oEDuwHT.exe
  2⤵
  PID:13840
- C:\Windows\System\KtWmEDC.exe
  C:\Windows\System\KtWmEDC.exe
  2⤵
  PID:13860
- C:\Windows\System\nDMnQMT.exe
  C:\Windows\System\nDMnQMT.exe
  2⤵
  PID:13876
- C:\Windows\System\kMhHfHw.exe
  C:\Windows\System\kMhHfHw.exe
  2⤵
  PID:13896
- C:\Windows\System\JDjHMjt.exe
  C:\Windows\System\JDjHMjt.exe
  2⤵
  PID:13916
- C:\Windows\System\SQYnqmv.exe
  C:\Windows\System\SQYnqmv.exe
  2⤵
  PID:13932
- C:\Windows\System\BdxmCPh.exe
  C:\Windows\System\BdxmCPh.exe
  2⤵
  PID:13960
- C:\Windows\System\xBtoRtS.exe
  C:\Windows\System\xBtoRtS.exe
  2⤵
  PID:13980
- C:\Windows\System\dIGzBEh.exe
  C:\Windows\System\dIGzBEh.exe
  2⤵
  PID:13996
- C:\Windows\System\KOCHARt.exe
  C:\Windows\System\KOCHARt.exe
  2⤵
  PID:14016
- C:\Windows\System\YZLlCtQ.exe
  C:\Windows\System\YZLlCtQ.exe
  2⤵
  PID:14044
- C:\Windows\System\mxjtoQS.exe
  C:\Windows\System\mxjtoQS.exe
  2⤵
  PID:14060
- C:\Windows\System\jgdtzLw.exe
  C:\Windows\System\jgdtzLw.exe
  2⤵
  PID:14084
- C:\Windows\System\IlMByPQ.exe
  C:\Windows\System\IlMByPQ.exe
  2⤵
  PID:14100
- C:\Windows\System\rUgYnBX.exe
  C:\Windows\System\rUgYnBX.exe
  2⤵
  PID:14124
- C:\Windows\System\xpxjbUY.exe
  C:\Windows\System\xpxjbUY.exe
  2⤵
  PID:14140
- C:\Windows\System\qoJCLHM.exe
  C:\Windows\System\qoJCLHM.exe
  2⤵
  PID:14164
- C:\Windows\System\vjZfJEn.exe
  C:\Windows\System\vjZfJEn.exe
  2⤵
  PID:14184
- C:\Windows\System\NQOVfWw.exe
  C:\Windows\System\NQOVfWw.exe
  2⤵
  PID:14216
- C:\Windows\System\bSKNdDU.exe
  C:\Windows\System\bSKNdDU.exe
  2⤵
  PID:14240
- C:\Windows\System\msQzDib.exe
  C:\Windows\System\msQzDib.exe
  2⤵
  PID:14264
- C:\Windows\System\JfziSeS.exe
  C:\Windows\System\JfziSeS.exe
  2⤵
  PID:14284
- C:\Windows\System\tCWFxnZ.exe
  C:\Windows\System\tCWFxnZ.exe
  2⤵
  PID:14304
- C:\Windows\System\HJVEZHD.exe
  C:\Windows\System\HJVEZHD.exe
  2⤵
  PID:14328
- C:\Windows\System\wKqTZJJ.exe
  C:\Windows\System\wKqTZJJ.exe
  2⤵
  PID:12576
- C:\Windows\System\OqJHRtq.exe
  C:\Windows\System\OqJHRtq.exe
  2⤵
  PID:13332
- C:\Windows\System\lfuRqNY.exe
  C:\Windows\System\lfuRqNY.exe
  2⤵
  PID:13376
- C:\Windows\System\wzPSnNx.exe
  C:\Windows\System\wzPSnNx.exe
  2⤵
  PID:13428
- C:\Windows\System\dOQmggs.exe
  C:\Windows\System\dOQmggs.exe
  2⤵
  PID:13500
- C:\Windows\System\CepTWQy.exe
  C:\Windows\System\CepTWQy.exe
  2⤵
  PID:13528
- C:\Windows\System\mtGCEnY.exe
  C:\Windows\System\mtGCEnY.exe
  2⤵
  PID:13564
- C:\Windows\System\QEWUagL.exe
  C:\Windows\System\QEWUagL.exe
  2⤵
  PID:13588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:13760

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:13500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AdsinbJ.exe

Path C:\Windows\System\AdsinbJ.exe
Size 1.7MB
SHA256 e6b78c33f011853a142ba59172a78f0af6a3f88c540fd271e78077f2bb5bcc85
MD5 773fef3ba0196d0c24845638b634fd32
SHA1 5648bcfa24d6293914a2e0a6b2e00bbb3d1e394d
SHA512 3b65fd729688e33789c5f81ce1f2184979c487f83f39e1827f0839f7b760bf4afeae163470ac2c75d333294e5af7177f9e5d926f943b3fb06e4f4ed6a4240288
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqc:RWWBibaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

BLkGryd.exe

Path C:\Windows\System\BLkGryd.exe
Size 1.7MB
SHA256 a7da45fec1aa9d89aa7754d5bbb878065b37ceb9f57eaa11e7cae57f73a0829c
MD5 1c1c34c483911be3753eefeee963b79e
SHA1 4f9988ed127225ca5a4397cb9359bd18c0529a08
SHA512 1bbeba763a8f6108a2f63d2af92c65c5b004ff018d5da06cf406452d6b66c83aad7205d1522ace7d1c58d6f0931b8a50e4a64cc203f500947c9780237f74e5eb
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqy:RWWBibae
MD5 SHA1 SHA512 SSDEEP

Submit Download

CYxBroO.exe

Path C:\Windows\System\CYxBroO.exe
Size 1.7MB
SHA256 a0c122595f510688aa324914f0cad6177a0f34ecd17e501542f817e0f489e14d
MD5 bf6b629ac1ae211069483cbde1a829cc
SHA1 7a9bf380fed392b5229ca0cc1a25b01a014036bb
SHA512 07b43a5cf6c59aa211963898a9a37c23093e9a954ca79b9cb6d74d8e0e40e0abed6d0e906fc020ff9092beec2fec3c89caf26fc479d42cd45ffa1bbe175ed668
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqs:RWWBibag
MD5 SHA1 SHA512 SSDEEP

Submit Download

DfezMaQ.exe

Path C:\Windows\System\DfezMaQ.exe
Size 1.7MB
SHA256 c3d40fb1148ac3b4124c1ec6035e22d11b1293d9790076dc2d73765dd75a1504
MD5 0e524c494b947ae127c5698adcacc610
SHA1 62d119b5e46ae5d8e171f1726716c35cb6bf6f01
SHA512 8f040770190feb855fa49ded2a6c3f9c37cc7b7f4a36858c2d0f4ec73fc86c9b7e194de91d9e33a2d0fefc495483cc055de9ea1d0c11fba2e9f76c0ce1b79f5e
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqE:RWWBibaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

EvcdjpE.exe

Path C:\Windows\System\EvcdjpE.exe
Size 1.7MB
SHA256 558c057db33f5c94458afe1e91a522b666403b8257c4be2d39421ba3d0b0a868
MD5 951bad3920d1272c07c7f8e5f664a26f
SHA1 429c4e9ec11ee4837305cfcca2c1e5f417c25759
SHA512 977dee0cd2976bf4224a53a0fdae5a7f66e7fbf24493404bfd342cdb7a465aeabc1a2eb03347bea9c3b5859ce8c738e14adf030f378f378977307467eb26241e
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqN:RWWBibap
MD5 SHA1 SHA512 SSDEEP

Submit Download

IJrcShB.exe

Path C:\Windows\System\IJrcShB.exe
Size 1.7MB
SHA256 d485f9361c4837e956f6b7518f430d8b95fae37f5390234eab6364dcdb912ba9
MD5 b368e9c4913d9357e5547854b956e048
SHA1 e3ac0641c1547155130d69767382743174f99544
SHA512 45b8350ca89391d6558f41c0802e69f49e6a61958651467f01a6f241eaa0e1b88b64ef1e5779fd949a860873bb16f84223b59d7f5d8e2dae09531ded745f1160
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqt:RWWBibaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

JcGdjyc.exe

Path C:\Windows\System\JcGdjyc.exe
Size 1.7MB
SHA256 0a24e8768374374e5a41291130be9933aaff9fe6cfbebc843614472f24d94589
MD5 56f5d6853635987b7ecfcd0689f50803
SHA1 5ee73cdc6f01bd2ae0bb13b563e0ae988703e9fc
SHA512 8b62706689480dc1d45ff92587eb9459e7e0944ef35bdd1f77bb20f430a013957a50e0dd9c1c5eab66a76b4210678fef45588adc193225f4b7afbb0a17a9f78e
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqy:RWWBibau
MD5 SHA1 SHA512 SSDEEP

Submit Download

JkQKlCj.exe

Path C:\Windows\System\JkQKlCj.exe
Size 1.7MB
SHA256 1c4fbbd215deea77d3bbb0fd5a369baff0f192929a46738d14a22b0bc919576a
MD5 d174ce2d913e1caf2f95c564904a6740
SHA1 ad008ce4f5f4a844480c8118a1ee96f0ac7097ab
SHA512 dace10f2ba10785cd289888308ad7d2fbe09314f306480baf879bf0e17c7d74033d462d0f61c49f9f086a741556da80fd82fdafab38227bc8de891bde0272523
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqn:RWWBibar
MD5 SHA1 SHA512 SSDEEP

Submit Download

JsACqEg.exe

Path C:\Windows\System\JsACqEg.exe
Size 1.7MB
SHA256 1fcad992ed25ba603c6ff9259a612062fea769bb0424636118503495aebd1a10
MD5 e0ddb690d11a3df46a475c2b445d21ef
SHA1 ee590a1fa6da0606da4a96b35e08d7bcc0f9ff34
SHA512 8873cfd549dc6c9ac537fc3691992fc465be19f7577a21d268d2cae8c28cbd2bb9a03ddaf2486837f6181c612e6f40e4793bf436b2e555cc0a6d043eed1b4c27
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqD:RWWBibav
MD5 SHA1 SHA512 SSDEEP

Submit Download

KAFucjK.exe

Path C:\Windows\System\KAFucjK.exe
Size 1.7MB
SHA256 a28b68226f5a702bf11b72c91ac5c20a6c93bcd0e2cc3b5dc82b6aa6bc1551bf
MD5 54edb16d7e97edabf459c19e8a525a3d
SHA1 76f2a09a84d16b4cf4f5f407d7809fcb73636547
SHA512 d64bb8720997779d27ac4b4e1b30de43f890515b286b72c50bc774aa8be6095be22df27665c2a621d88dabfbcda15d3dbd1838af14439a026c304472896bf428
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqd:RWWBibaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

MrezGfS.exe

Path C:\Windows\System\MrezGfS.exe
Size 1.7MB
SHA256 5be9118e3d23c60686a9452ac1f007bb7455dbe2fa8398897eb7e2571bd5fa15
MD5 33c09e96654d881beae222ad557eff32
SHA1 5373d0d2ffbc7a446d7124b136a7ce43dce27773
SHA512 22817250267f1c166714c894abc58a0089255cddf59f075796ae6dc3d6ef5209466f18ccb713e98be95787a743d144f3110e6d3dc4233ec230bdff507c924711
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqW:RWWBibay
MD5 SHA1 SHA512 SSDEEP

Submit Download

PDDnHxr.exe

Path C:\Windows\System\PDDnHxr.exe
Size 1.7MB
SHA256 cdf6765e7c0b8780bef2c35573e3e26fc09099efb929ce24c9f6d94e26426a3d
MD5 4e36013096f245ce9f11e13c1967bb02
SHA1 bb797f41cbf08ba97b459bcebd7ac3fca47a0829
SHA512 670118da8b503e3fa22c8e21e5548b8b9422a04a57d7dc15b970b4a7384fd4b7c62dab9da71e6ec00da5b4f86ce3c55da2cebd791007a1dfd8ffcb20c9adc222
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqM:RWWBibag
MD5 SHA1 SHA512 SSDEEP

Submit Download

PrSQIrr.exe

Path C:\Windows\System\PrSQIrr.exe
Size 1.7MB
SHA256 dfe842220f48666f19e64d992aeffb2cbb10d49dc100166e1efafbcfedb92791
MD5 93c2094b2c2b58ce752a9dbfc377f01f
SHA1 4b115c11fc695600c3ebca36dfee1cc37e031aa8
SHA512 734039b7d306220227becbbf66b6e540394774c0f7773d79d05085931ec8a2caf5a5d82eab9c1eb8cf64403d9fba7496c4a43078f677b78bd853d2524dcbfca3
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqQ:RWWBibac
MD5 SHA1 SHA512 SSDEEP

Submit Download

UxksseR.exe

Path C:\Windows\System\UxksseR.exe
Size 1.7MB
SHA256 51f122a2b035a95e9521a516b3cf14e77c88dc3b332e8c2c4e934dbfe4ed5052
MD5 1df4e1c49171354614615c51adb09c1c
SHA1 f1cca2dcb4ca132789b3a20ac8a40aeec614e466
SHA512 9eeabd8d67eed09f00992fcb4170e92b3316d02920fac130f3fa761cbe3a3d617ad6091fe2d878041c3ca837fe9f54e8a0ebb83ae0dd63f173a509103b062b52
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqb:RWWBiba/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZZFMqYb.exe

Path C:\Windows\System\ZZFMqYb.exe
Size 1.7MB
SHA256 7abf01ea50b0620cdb8eb6909fcab01fd0452b09c7dfcc5b72557a0daf4f3079
MD5 ec0c3b3d5daa226d586431997df75b8b
SHA1 94bd2fd2b20678ddeb94f3204e2b28755a8ac9a1
SHA512 4636ba888b113b982bf0e23b766104b2b6bc6012cf07e149246e3b120db2629fc974b8494033c31a4e682c8305710595dea0c84aa218e980926c95d30e803ddc
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqO:RWWBibaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

aVFqEjc.exe

Path C:\Windows\System\aVFqEjc.exe
Size 1.7MB
SHA256 2aa9094e26628c3ce365c2db70c58147d91be6937ac9f1002fd3deb0fd9bcbc5
MD5 4fe4eb27f21208d0f2907e6bd7f7ff5e
SHA1 0c4773feb4f2f2331529cf9d19c6859b12e1737e
SHA512 7f2206f275ab6ec694d1e813cdfb628dec0cbfa20e0564c318de5ab049813dbcf530d221ed5d905c555d91948daa36ebeed6f1087555ea3dd5e19aeecd0ddd54
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqV:RWWBibax
MD5 SHA1 SHA512 SSDEEP

Submit Download

afRxsEL.exe

Path C:\Windows\System\afRxsEL.exe
Size 1.7MB
SHA256 340cf7a36273fded2c5a0c811f4109dac7662bf63d78232bea9c3cb89eebd058
MD5 13668f707ca8769914ee4d735f806d6a
SHA1 32bd9d7de25fd708e71467778455ae0a0e33e6ed
SHA512 5be78d60e2c240c55993ce6ac0d9b9fc1d55cd64f181a6b71c85b574cfe8b76d1482dd733ee71bd1b1d5273c6f066ef97877491804bc6656bbb1fcee50a8c4ce
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUq/C:RWWBibae
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbQqmEY.exe

Path C:\Windows\System\dbQqmEY.exe
Size 1.7MB
SHA256 6f8bee17432d7317b5fa1cba4a2b452905b0b467a25c768a9abfc1f66d4a8a64
MD5 5e8f3d6068e1a2bd7592cb0769704bbe
SHA1 f61b72546403695cfe436fe797c3b911116d04d0
SHA512 9aae67839c1299122ca7c62b8d9a84f500d62e38938b6986f5e195b66fe244c7cf183e7bc69d1ef8004431e6c5eabf91a4f36d806da79046e1b00a0185f4a780
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqH:RWWBibaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ePGJbnn.exe

Path C:\Windows\System\ePGJbnn.exe
Size 1.7MB
SHA256 0cbd986c04f315597a62ee8cb0b48dcf2a45f122308699a56ff34432e999b00b
MD5 8001ab45ea315905cdb1473aa4849d64
SHA1 fa2c71e4ba81b1d7e12688bf1506880fa96f1c30
SHA512 692af2ff20cfa487a81551579758674a3cdd3ac1c5e4113b54c7ebe0d64c3d286127089c1db4fdc0a4aa3da6fa978bc67986792c3c0c0523acde1e9f72f8c309
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqn:RWWBibaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftRLTwM.exe

Path C:\Windows\System\ftRLTwM.exe
Size 1.7MB
SHA256 d978e2214f1e5a21c5a522369ed4f6035e1e35e56307e844b5bb0704f51de5eb
MD5 d54b71c01df10898b1c1a06241d1438b
SHA1 c8aecd6a608fde34692880a80295d82227172212
SHA512 e2a356885b1bdfa990d310375b0f0860d3a9314c159a7f8b2e262da4de04713c763275af4d8a3aee7a1b87b32446dbdf587eaaa3e85a01933857bf98a39b67c7
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqw:RWWBibac
MD5 SHA1 SHA512 SSDEEP

Submit Download

iRrTvSS.exe

Path C:\Windows\System\iRrTvSS.exe
Size 1.7MB
SHA256 231dfd9ea92b15b82014a2b568d4d704a0b032f0b331a47b3e3e39d9f8572ab0
MD5 238e6eac1020e914a8b93159483914e8
SHA1 5ccb2de82a39f00cba97a97fca23fcaade2e395a
SHA512 893913b1e5a42637c5370c5d28cb0764f2b4988be8c9e82f6978fa7d1cbd26fce0266245b1e454baa01efd984fada2c09ccc78d96ca30520dd224908abf2b36e
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqA:RWWBibak
MD5 SHA1 SHA512 SSDEEP

Submit Download

innJABZ.exe

Path C:\Windows\System\innJABZ.exe
Size 1.7MB
SHA256 2f3d3805728dffb0307c6a48c4ad43e3f85cf8146b00fb7f4a2482a8e045307b
MD5 4e8597f13c6d48c95257390605838329
SHA1 653e6fc287677cf3f50ec4bd299bce0bbfc8b696
SHA512 ed34299d10defd5492698f9c81a4f59e91eaf2574af5abe1b7e6dba81a6e4a4a7069f339084c711dabceb21fb6c573fafb7b1ae5cdead69c2e46366db3ff5664
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUql:RWWBibah
MD5 SHA1 SHA512 SSDEEP

Submit Download

kOSPdem.exe

Path C:\Windows\System\kOSPdem.exe
Size 1.7MB
SHA256 25616a94c51c0290ff5b4888a9142f9719a2dd595848ee80b2e161510f64c393
MD5 947d49a88447aef282d995da887ef5e7
SHA1 8e297eef443a9e14c930062f5776397a71f29f5c
SHA512 40d49319f9496ba6ec14831db3b41d62c2bf6da01ceebc4f4ae415cb091c43cd433af2d64fce05edc350a26ba57c361ace898056686432c6403a37243200d9c7
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqd:RWWBibaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

kuXzKYB.exe

Path C:\Windows\System\kuXzKYB.exe
Size 1.7MB
SHA256 a06da2176bad97a7c1b3e664d21a4816d14f252e32b30ccdaa278b675c77ba32
MD5 e3c8406c6ab152856615ace9df8d9ffc
SHA1 7e293284eecf1c5c3af319678404605db61513e8
SHA512 9fc3b21fe888c9b4abbce1f142a32ca94dc95e98cbfbe5f431ca38ba5620d4e34b9dd645e398ba47211c7309512cff203cbebfcad2b7aed783097f2958a60eeb
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqx:RWWBibaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

nMTQnAk.exe

Path C:\Windows\System\nMTQnAk.exe
Size 1.7MB
SHA256 b5116944c8c8f7df2cc7dbc8a50186925d0a522114fb5e8b142960109463a308
MD5 d2898c58ba827e666cc1039b27d2f18d
SHA1 866a19137312021cf4a241f8cd74ea0a9f36f57a
SHA512 566b5ad667c278de9113da313f45ff4c4edc59555d606082c1937e8511bcd75854779debff8b0d534a47a922f74397e741fb880c39fb8c842cd348a3fce7db19
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqI:RWWBibak
MD5 SHA1 SHA512 SSDEEP

Submit Download

nRIYkkh.exe

Path C:\Windows\System\nRIYkkh.exe
Size 1.7MB
SHA256 4b75044b8434bfc520e3c8396e3821e1c72c758907a747fa703789252fca8dff
MD5 ba91c01e787edb00f4fda5c580ebaa8a
SHA1 38545ac1d3a3603b276b225d5aead1e8626e6406
SHA512 abc4a46e0f8112b6db09ab5cea407a66b60f1d8930b1f966fb911c9624ef6ef3d71501afdeba8bb1302c7f291c83a442fc6e4d863573b4c64a0fc58ca7e5c982
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqE/:RWWBiba2
MD5 SHA1 SHA512 SSDEEP

Submit Download

nRSFHws.exe

Path C:\Windows\System\nRSFHws.exe
Size 1.7MB
SHA256 3644fc150271511e4ffc0123f4ceea0a05507e887b8eae2e04127683c04b0848
MD5 a2a7f0922e5b342f0da023289daf3c38
SHA1 9a8e7ea793e90867fb62e447a2e18b405494dd80
SHA512 6e6a7693b58e2e068ea27f88e60ca7718eecbe4f630ac8701c70492205e94be67de216bf06bf8bcce1151d5ffed1d371f4535958664de558fff795a6416ebccf
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqt:RWWBibax
MD5 SHA1 SHA512 SSDEEP

Submit Download

puWkAVV.exe

Path C:\Windows\System\puWkAVV.exe
Size 1.7MB
SHA256 73d863ba40566704ea4fb0e0f88b9193d1c9359f51fa3d9c5a10786aea05f295
MD5 19ad1a739d76a616612160505153a1d7
SHA1 5fbfd984001aa019d934d48835917bfb41bff54b
SHA512 380569449ed1557b2fe5c916efe532d87ad9f0755ec866368a69f39d7d99924e60126221c22f5595c94f78b3a77df604de44382d7120550fb8024846bd6db463
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqP:RWWBibaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

qDIOlxk.exe

Path C:\Windows\System\qDIOlxk.exe
Size 1.7MB
SHA256 17e5337df8c143d2d9a8c04b043060e4f6456014a6c2e160cb6a11a026443b49
MD5 b52c401e0dd169247259d688ee13da41
SHA1 bb63088b3d159792305e23b926c19d5412fe09a6
SHA512 c81e9197123c865e7243b6b6e096f2530bd00e29fb92f537fe53cb73bca00ea36aa299d50b52c7452eed50e7909db07b134e3033bc19498b83599482d105a61d
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUq4:RWWBiba0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmLjQgx.exe

Path C:\Windows\System\tmLjQgx.exe
Size 1.7MB
SHA256 1bfdc77767dce2eceb0d66c3b09c41d2a98d0fb60cc39c01cb605c40f4736b66
MD5 b312e5ad1344ca047331403f706c0662
SHA1 63e01ce7897cbef4adeffaf6a6805cab31d30fa0
SHA512 284fa1e881c00956345ed07bb542e97d37eac34715194ec62b0cbc1d08cd25f366cce88b215604f44d0a2fe02d0a2431844c47bcccdb8bb3c3dc4db72ca9569a
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqV:RWWBibah
MD5 SHA1 SHA512 SSDEEP

Submit Download

vxeISSK.exe

Path C:\Windows\System\vxeISSK.exe
Size 1.7MB
SHA256 28cd5423fcd3e0eb18299d1d196609120db0576ddf67fb09315dfe947ab4e4a8
MD5 5b80f46408398be4bd548b61f53973d7
SHA1 949add073210f0fd29d7335251d9bd3a4f93124a
SHA512 7e0f48d69d71d8011eeaf9246ccc9d9c5b816748f50a25bcff68d99d332bbed9069a1f56688dc26b245e1a8f1bb5360d900e0c5bb4d8d0c3f9d8f8cd3c566654
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUq3:RWWBibaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

xAYQWpv.exe

Path C:\Windows\System\xAYQWpv.exe
Size 1.7MB
SHA256 37f8cb9ea4e92aadcf423dae1e84ec03673cf521dfdac4515314457cb74bf142
MD5 52620141c047eab1773e0f21bba77123
SHA1 ebaf104d02fa433de0189a9b66748ae0fe31fedc
SHA512 8621be4bc42e6c9ea692b415bbe8ec8782af68a32aa5e974008e12097090c5be0ff23291e028a46f9c923afecd5556850ef879c27230ab65ec1b463ce60f1ce5
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUqs:RWWBiba4
MD5 SHA1 SHA512 SSDEEP

Submit Download

xcByRlu.exe

Path C:\Windows\System\xcByRlu.exe
Size 1.7MB
SHA256 3843a62501c161b9e45d7d243342ffd6714f1a0ed5b09fb25dfeb567cda68f3c
MD5 1b731c807afd81af44d8d0d1f92eba50
SHA1 cf7e96faa9579cb8bd12621dcae4adc850473c36
SHA512 bad93299e441e82c3c77362e8361dfad530888c549ec1b19294e237373342d1d15ad5bc35a01784acd91bf1349edc818a66646c4cfa17789b1091cb367c4c8a5
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXcCCJnUq0:RWWBiba4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-1-0x00000150D3370000-0x00000150D3380000-memory.dmp

Download

memory/212-2178-0x00007FF7D7D20000-0x00007FF7D8071000-memory.dmp

Download

memory/212-0-0x00007FF7D7D20000-0x00007FF7D8071000-memory.dmp

Download

memory/772-635-0x00007FF6D5F90000-0x00007FF6D62E1000-memory.dmp

Download

memory/772-2277-0x00007FF6D5F90000-0x00007FF6D62E1000-memory.dmp

Download

memory/796-553-0x00007FF62BFF0000-0x00007FF62C341000-memory.dmp

Download

memory/796-2225-0x00007FF62BFF0000-0x00007FF62C341000-memory.dmp

Download

memory/1056-615-0x00007FF7EAF80000-0x00007FF7EB2D1000-memory.dmp

Download

memory/1056-2259-0x00007FF7EAF80000-0x00007FF7EB2D1000-memory.dmp

Download

memory/1112-2256-0x00007FF6458D0000-0x00007FF645C21000-memory.dmp

Download

memory/1112-599-0x00007FF6458D0000-0x00007FF645C21000-memory.dmp

Download

memory/1140-2215-0x00007FF70D2A0000-0x00007FF70D5F1000-memory.dmp

Download

memory/1140-12-0x00007FF70D2A0000-0x00007FF70D5F1000-memory.dmp

Download

memory/1140-2227-0x00007FF70D2A0000-0x00007FF70D5F1000-memory.dmp

Download

memory/1236-554-0x00007FF783740000-0x00007FF783A91000-memory.dmp

Download

memory/1236-2230-0x00007FF783740000-0x00007FF783A91000-memory.dmp

Download

memory/1368-630-0x00007FF604140000-0x00007FF604491000-memory.dmp

Download

memory/1368-2276-0x00007FF604140000-0x00007FF604491000-memory.dmp

Download

memory/1380-2269-0x00007FF7903C0000-0x00007FF790711000-memory.dmp

Download

memory/1380-627-0x00007FF7903C0000-0x00007FF790711000-memory.dmp

Download

memory/1524-2240-0x00007FF74ECD0000-0x00007FF74F021000-memory.dmp

Download

memory/1524-573-0x00007FF74ECD0000-0x00007FF74F021000-memory.dmp

Download

memory/1600-2291-0x00007FF6475F0000-0x00007FF647941000-memory.dmp

Download

memory/1600-670-0x00007FF6475F0000-0x00007FF647941000-memory.dmp

Download

memory/2280-623-0x00007FF6465D0000-0x00007FF646921000-memory.dmp

Download

memory/2280-2263-0x00007FF6465D0000-0x00007FF646921000-memory.dmp

Download

memory/2548-620-0x00007FF7353D0000-0x00007FF735721000-memory.dmp

Download

memory/2548-2265-0x00007FF7353D0000-0x00007FF735721000-memory.dmp

Download

memory/2972-2237-0x00007FF66B0E0000-0x00007FF66B431000-memory.dmp

Download

memory/2972-557-0x00007FF66B0E0000-0x00007FF66B431000-memory.dmp

Download

memory/3216-9-0x00007FF7AD9E0000-0x00007FF7ADD31000-memory.dmp

Download

memory/3216-2214-0x00007FF7AD9E0000-0x00007FF7ADD31000-memory.dmp

Download

memory/3216-2223-0x00007FF7AD9E0000-0x00007FF7ADD31000-memory.dmp

Download

memory/3716-606-0x00007FF607F50000-0x00007FF6082A1000-memory.dmp

Download

memory/3716-2253-0x00007FF607F50000-0x00007FF6082A1000-memory.dmp

Download

memory/3924-2233-0x00007FF68EDE0000-0x00007FF68F131000-memory.dmp

Download

memory/3924-555-0x00007FF68EDE0000-0x00007FF68F131000-memory.dmp

Download

memory/4200-569-0x00007FF700C90000-0x00007FF700FE1000-memory.dmp

Download

memory/4200-2241-0x00007FF700C90000-0x00007FF700FE1000-memory.dmp

Download

memory/4248-607-0x00007FF627400000-0x00007FF627751000-memory.dmp

Download

memory/4248-2252-0x00007FF627400000-0x00007FF627751000-memory.dmp

Download

memory/4356-576-0x00007FF6A36F0000-0x00007FF6A3A41000-memory.dmp

Download

memory/4356-2243-0x00007FF6A36F0000-0x00007FF6A3A41000-memory.dmp

Download

memory/4416-661-0x00007FF66BE90000-0x00007FF66C1E1000-memory.dmp

Download

memory/4416-2273-0x00007FF66BE90000-0x00007FF66C1E1000-memory.dmp

Download

memory/4484-2235-0x00007FF7FFA00000-0x00007FF7FFD51000-memory.dmp

Download

memory/4484-556-0x00007FF7FFA00000-0x00007FF7FFD51000-memory.dmp

Download

memory/4516-2257-0x00007FF69DEA0000-0x00007FF69E1F1000-memory.dmp

Download

memory/4516-605-0x00007FF69DEA0000-0x00007FF69E1F1000-memory.dmp

Download

memory/4580-656-0x00007FF7A24B0000-0x00007FF7A2801000-memory.dmp

Download

memory/4580-2272-0x00007FF7A24B0000-0x00007FF7A2801000-memory.dmp

Download

memory/4624-608-0x00007FF62D270000-0x00007FF62D5C1000-memory.dmp

Download

memory/4624-2249-0x00007FF62D270000-0x00007FF62D5C1000-memory.dmp

Download

memory/4700-2247-0x00007FF7C2670000-0x00007FF7C29C1000-memory.dmp

Download

memory/4700-581-0x00007FF7C2670000-0x00007FF7C29C1000-memory.dmp

Download

memory/4828-2231-0x00007FF71E030000-0x00007FF71E381000-memory.dmp

Download

memory/4828-675-0x00007FF71E030000-0x00007FF71E381000-memory.dmp

Download

memory/4864-616-0x00007FF633820000-0x00007FF633B71000-memory.dmp

Download

memory/4864-2261-0x00007FF633820000-0x00007FF633B71000-memory.dmp

Download

memory/5028-2267-0x00007FF75AC30000-0x00007FF75AF81000-memory.dmp

Download

memory/5028-624-0x00007FF75AC30000-0x00007FF75AF81000-memory.dmp

Download

memory/5088-2246-0x00007FF7D65F0000-0x00007FF7D6941000-memory.dmp

Download

memory/5088-586-0x00007FF7D65F0000-0x00007FF7D6941000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads