xmrig | ddfba6cca3a020637aed932ceee8346571d31f7277564cdf5dc30fe967eccb1b

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
Size 1.5MB
Sample240528-jcnecscc23
SHA256 ddfba6cca3a020637aed932ceee8346571d31f7277564cdf5dc30fe967eccb1b
MD5 38f3fb641fac9006e5d85adf3282bff0
SHA1 0fa64c29d912276d613c581ac1bd43478c7b55f2
SHA512 703ba7684c664b556960c7362707fab850d1b9dccf23c6af3e298bec1da83fda2efed1d987d7756e7e2111658126512eb383d62ee3c83617970cdb2efb023b37
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fE:ROdWCCi7/rahwNUMuikLCiJCF+Qliw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 52 IoCs

miner

resource	yara_rule
behavioral2/memory/1812-192-0x00007FF69BB40000-0x00007FF69BE91000-memory.dmp	xmrig
behavioral2/memory/1008-235-0x00007FF6F9B90000-0x00007FF6F9EE1000-memory.dmp	xmrig
behavioral2/memory/2332-241-0x00007FF66BE20000-0x00007FF66C171000-memory.dmp	xmrig
behavioral2/memory/4532-272-0x00007FF6C27F0000-0x00007FF6C2B41000-memory.dmp	xmrig
behavioral2/memory/768-281-0x00007FF7FB350000-0x00007FF7FB6A1000-memory.dmp	xmrig
behavioral2/memory/2412-287-0x00007FF7EA600000-0x00007FF7EA951000-memory.dmp	xmrig
behavioral2/memory/1940-286-0x00007FF72E910000-0x00007FF72EC61000-memory.dmp	xmrig
behavioral2/memory/5028-285-0x00007FF7F9260000-0x00007FF7F95B1000-memory.dmp	xmrig
behavioral2/memory/2776-284-0x00007FF7A6210000-0x00007FF7A6561000-memory.dmp	xmrig
behavioral2/memory/2184-283-0x00007FF668890000-0x00007FF668BE1000-memory.dmp	xmrig
behavioral2/memory/5096-282-0x00007FF619C60000-0x00007FF619FB1000-memory.dmp	xmrig
behavioral2/memory/1836-280-0x00007FF6CE070000-0x00007FF6CE3C1000-memory.dmp	xmrig
behavioral2/memory/3216-279-0x00007FF64FFF0000-0x00007FF650341000-memory.dmp	xmrig
behavioral2/memory/2572-278-0x00007FF73B640000-0x00007FF73B991000-memory.dmp	xmrig
behavioral2/memory/4360-277-0x00007FF631D50000-0x00007FF6320A1000-memory.dmp	xmrig
behavioral2/memory/2044-276-0x00007FF6137C0000-0x00007FF613B11000-memory.dmp	xmrig
behavioral2/memory/1664-274-0x00007FF682750000-0x00007FF682AA1000-memory.dmp	xmrig
behavioral2/memory/1376-273-0x00007FF6DEC90000-0x00007FF6DEFE1000-memory.dmp	xmrig
behavioral2/memory/5044-266-0x00007FF6E0B70000-0x00007FF6E0EC1000-memory.dmp	xmrig
behavioral2/memory/1236-231-0x00007FF6F2220000-0x00007FF6F2571000-memory.dmp	xmrig
behavioral2/memory/2136-230-0x00007FF79A410000-0x00007FF79A761000-memory.dmp	xmrig
behavioral2/memory/3552-16-0x00007FF67ED50000-0x00007FF67F0A1000-memory.dmp	xmrig
behavioral2/memory/3976-2161-0x00007FF70FE60000-0x00007FF7101B1000-memory.dmp	xmrig
behavioral2/memory/3552-2260-0x00007FF67ED50000-0x00007FF67F0A1000-memory.dmp	xmrig
behavioral2/memory/5096-2262-0x00007FF619C60000-0x00007FF619FB1000-memory.dmp	xmrig
behavioral2/memory/2416-2264-0x00007FF605140000-0x00007FF605491000-memory.dmp	xmrig
behavioral2/memory/1548-2266-0x00007FF69C400000-0x00007FF69C751000-memory.dmp	xmrig
behavioral2/memory/416-2271-0x00007FF668830000-0x00007FF668B81000-memory.dmp	xmrig
behavioral2/memory/2184-2272-0x00007FF668890000-0x00007FF668BE1000-memory.dmp	xmrig
behavioral2/memory/4904-2269-0x00007FF6D9270000-0x00007FF6D95C1000-memory.dmp	xmrig
behavioral2/memory/1812-2275-0x00007FF69BB40000-0x00007FF69BE91000-memory.dmp	xmrig
behavioral2/memory/2136-2289-0x00007FF79A410000-0x00007FF79A761000-memory.dmp	xmrig
behavioral2/memory/5044-2292-0x00007FF6E0B70000-0x00007FF6E0EC1000-memory.dmp	xmrig
behavioral2/memory/2584-2298-0x00007FF777720000-0x00007FF777A71000-memory.dmp	xmrig
behavioral2/memory/1376-2300-0x00007FF6DEC90000-0x00007FF6DEFE1000-memory.dmp	xmrig
behavioral2/memory/1940-2296-0x00007FF72E910000-0x00007FF72EC61000-memory.dmp	xmrig
behavioral2/memory/1008-2294-0x00007FF6F9B90000-0x00007FF6F9EE1000-memory.dmp	xmrig
behavioral2/memory/1236-2288-0x00007FF6F2220000-0x00007FF6F2571000-memory.dmp	xmrig
behavioral2/memory/5028-2284-0x00007FF7F9260000-0x00007FF7F95B1000-memory.dmp	xmrig
behavioral2/memory/2900-2282-0x00007FF7B6740000-0x00007FF7B6A91000-memory.dmp	xmrig
behavioral2/memory/2776-2280-0x00007FF7A6210000-0x00007FF7A6561000-memory.dmp	xmrig
behavioral2/memory/4532-2278-0x00007FF6C27F0000-0x00007FF6C2B41000-memory.dmp	xmrig
behavioral2/memory/2332-2276-0x00007FF66BE20000-0x00007FF66C171000-memory.dmp	xmrig
behavioral2/memory/2044-2315-0x00007FF6137C0000-0x00007FF613B11000-memory.dmp	xmrig
behavioral2/memory/1836-2313-0x00007FF6CE070000-0x00007FF6CE3C1000-memory.dmp	xmrig
behavioral2/memory/768-2309-0x00007FF7FB350000-0x00007FF7FB6A1000-memory.dmp	xmrig
behavioral2/memory/2572-2311-0x00007FF73B640000-0x00007FF73B991000-memory.dmp	xmrig
behavioral2/memory/4360-2349-0x00007FF631D50000-0x00007FF6320A1000-memory.dmp	xmrig
behavioral2/memory/1748-2327-0x00007FF7B8BC0000-0x00007FF7B8F11000-memory.dmp	xmrig
behavioral2/memory/2412-2307-0x00007FF7EA600000-0x00007FF7EA951000-memory.dmp	xmrig
behavioral2/memory/1664-2305-0x00007FF682750000-0x00007FF682AA1000-memory.dmp	xmrig
behavioral2/memory/3216-2325-0x00007FF64FFF0000-0x00007FF650341000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3552	NPidUBH.exe
5096	yjKeOjJ.exe
2416	nzGQIBC.exe
2184	uWpZZzR.exe
416	ueEUBcW.exe
1548	uVUDtvt.exe
2900	oBaXhhB.exe
2776	dcbDrOx.exe
4904	MuFytSA.exe
5028	qApvUmZ.exe
2584	dnuJSmo.exe
1812	JyZyLUO.exe
2136	bejZjqh.exe
1236	KCmQMEj.exe
1008	HsxPXYp.exe
1748	mHlgrRj.exe
2332	sMGKSgN.exe
5044	OrLxhrQ.exe
4532	glaeOIM.exe
1940	VEYOfXA.exe
1376	KjzcNHr.exe
2412	mBvscUr.exe
1664	AiGZrzP.exe
2044	UWUlhdo.exe
4360	KHjgUCe.exe
2572	RuFzfkz.exe
3216	TYZBLUX.exe
1836	daDmgDF.exe
768	IOQqmaf.exe
4676	gqBLySA.exe
1584	mvtkYaW.exe
2736	XtLqHVe.exe
1520	SroaTkn.exe
1344	vrHPurC.exe
3400	YTIyZCT.exe
860	trvmVMQ.exe
4516	TpMleyK.exe
5060	hbLsjyf.exe
1000	qShOJeg.exe
4520	gvSeMsF.exe
1608	YBMgGgO.exe
3376	fJUPRYd.exe
3304	iUNEpXz.exe
3608	YGWOpmF.exe
2888	netMQpF.exe
4132	pxTdOMS.exe
4480	ObgfoHO.exe
4648	EebOUCv.exe
1252	ouGbquX.exe
1360	IDyERVt.exe
3596	mdUeFdX.exe
3428	sTafzQy.exe
436	SLqeRBJ.exe
3748	RAuDLhz.exe
3248	YHOUWKJ.exe
3532	DAUNKpp.exe
2228	WEvbZaI.exe
4396	xyYtUsA.exe
4392	PUcciaZ.exe
4968	LSdtzwD.exe
2012	PvweQSu.exe
4772	zODAveb.exe
3988	hsWICrl.exe
2544	oBJlFXK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3976-0-0x00007FF70FE60000-0x00007FF7101B1000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-5.dat	upx
behavioral2/files/0x00070000000233ed-34.dat	upx
behavioral2/files/0x00070000000233f0-60.dat	upx
behavioral2/files/0x0007000000023400-108.dat	upx
behavioral2/files/0x00070000000233f5-136.dat	upx
behavioral2/memory/1812-192-0x00007FF69BB40000-0x00007FF69BE91000-memory.dmp	upx
behavioral2/memory/1008-235-0x00007FF6F9B90000-0x00007FF6F9EE1000-memory.dmp	upx
behavioral2/memory/2332-241-0x00007FF66BE20000-0x00007FF66C171000-memory.dmp	upx
behavioral2/memory/4532-272-0x00007FF6C27F0000-0x00007FF6C2B41000-memory.dmp	upx
behavioral2/memory/768-281-0x00007FF7FB350000-0x00007FF7FB6A1000-memory.dmp	upx
behavioral2/memory/2412-287-0x00007FF7EA600000-0x00007FF7EA951000-memory.dmp	upx
behavioral2/memory/1940-286-0x00007FF72E910000-0x00007FF72EC61000-memory.dmp	upx
behavioral2/memory/5028-285-0x00007FF7F9260000-0x00007FF7F95B1000-memory.dmp	upx
behavioral2/memory/2776-284-0x00007FF7A6210000-0x00007FF7A6561000-memory.dmp	upx
behavioral2/memory/2184-283-0x00007FF668890000-0x00007FF668BE1000-memory.dmp	upx
behavioral2/memory/5096-282-0x00007FF619C60000-0x00007FF619FB1000-memory.dmp	upx
behavioral2/memory/1836-280-0x00007FF6CE070000-0x00007FF6CE3C1000-memory.dmp	upx
behavioral2/memory/3216-279-0x00007FF64FFF0000-0x00007FF650341000-memory.dmp	upx
behavioral2/memory/2572-278-0x00007FF73B640000-0x00007FF73B991000-memory.dmp	upx
behavioral2/memory/4360-277-0x00007FF631D50000-0x00007FF6320A1000-memory.dmp	upx
behavioral2/memory/2044-276-0x00007FF6137C0000-0x00007FF613B11000-memory.dmp	upx
behavioral2/memory/1664-274-0x00007FF682750000-0x00007FF682AA1000-memory.dmp	upx
behavioral2/memory/1376-273-0x00007FF6DEC90000-0x00007FF6DEFE1000-memory.dmp	upx
behavioral2/memory/5044-266-0x00007FF6E0B70000-0x00007FF6E0EC1000-memory.dmp	upx
behavioral2/memory/1748-236-0x00007FF7B8BC0000-0x00007FF7B8F11000-memory.dmp	upx
behavioral2/memory/1236-231-0x00007FF6F2220000-0x00007FF6F2571000-memory.dmp	upx
behavioral2/memory/2136-230-0x00007FF79A410000-0x00007FF79A761000-memory.dmp	upx
behavioral2/files/0x0007000000023401-191.dat	upx
behavioral2/files/0x0007000000023402-189.dat	upx
behavioral2/files/0x0007000000023413-187.dat	upx
behavioral2/files/0x0007000000023412-186.dat	upx
behavioral2/files/0x000700000002340b-184.dat	upx
behavioral2/files/0x0007000000023411-181.dat	upx
behavioral2/files/0x0007000000023410-178.dat	upx
behavioral2/files/0x00070000000233fd-176.dat	upx
behavioral2/files/0x000700000002340f-174.dat	upx
behavioral2/files/0x00070000000233fa-168.dat	upx
behavioral2/files/0x000700000002340e-166.dat	upx
behavioral2/files/0x00070000000233f9-163.dat	upx
behavioral2/files/0x000700000002340d-160.dat	upx
behavioral2/files/0x00070000000233f8-155.dat	upx
behavioral2/files/0x000700000002340c-149.dat	upx
behavioral2/memory/2584-148-0x00007FF777720000-0x00007FF777A71000-memory.dmp	upx
behavioral2/files/0x000700000002340a-135.dat	upx
behavioral2/files/0x0007000000023409-134.dat	upx
behavioral2/files/0x00070000000233ff-133.dat	upx
behavioral2/files/0x0007000000023408-131.dat	upx
behavioral2/files/0x00070000000233f6-179.dat	upx
behavioral2/files/0x0007000000023407-130.dat	upx
behavioral2/files/0x0007000000023406-128.dat	upx
behavioral2/files/0x0007000000023405-127.dat	upx
behavioral2/files/0x0007000000023404-126.dat	upx
behavioral2/files/0x00070000000233f3-122.dat	upx
behavioral2/files/0x0007000000023403-116.dat	upx
behavioral2/memory/4904-105-0x00007FF6D9270000-0x00007FF6D95C1000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-99.dat	upx
behavioral2/files/0x00070000000233fc-93.dat	upx
behavioral2/files/0x00070000000233f4-85.dat	upx
behavioral2/files/0x00070000000233fb-83.dat	upx
behavioral2/files/0x00070000000233f7-73.dat	upx
behavioral2/files/0x00070000000233f1-67.dat	upx
behavioral2/memory/1548-54-0x00007FF69C400000-0x00007FF69C751000-memory.dmp	upx
behavioral2/files/0x00070000000233ef-47.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mBvscUr.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\iUNEpXz.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\oOfYrQQ.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\climZvG.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\wDeqIjy.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\WAZQaFh.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\TaCnJNl.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\aYGAgGw.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\MVnujSA.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\DIELAbC.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\djMlJaj.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\cMSNZDs.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\cNLLtzo.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\bQXpYRs.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\tvrOEEo.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\hdTUTon.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\yjKeOjJ.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\SQgjvag.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\MHfTtso.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\qApvUmZ.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\daDmgDF.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\YGWOpmF.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\SLqeRBJ.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\zJueUmr.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\ukhQnmX.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\GnOwjDp.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\qqiEWwh.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\hEIIFuh.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\rCYmuQA.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\HkaaBJG.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\KpRjZGo.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\JnjvpoF.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\BkaRDFT.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\rmxTQrE.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\MdnDfrF.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\IaMgjiZ.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\tToiYFL.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\AtrhqQy.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\TrPrMrB.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\PKbmXPR.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\IpPuaiy.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\IqXeDWq.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\UjQYQML.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\SJSThAM.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\CtZKGZy.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\TYZBLUX.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\netMQpF.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\ycvZpaV.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\SrbooiF.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\lIkJzbN.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\vENYFQI.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\MdNGwUl.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\EoMtKsd.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\Nhnktqk.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\PJVbyaW.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\jPAFgrq.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\lYakWKH.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\faJacdF.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\sdTVKzi.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\GymacLD.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\uKZjwni.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\shGxpQR.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\PUcciaZ.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
File created	C:\Windows\System\eFOQYBo.exe	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 3552	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	83
PID 3976 wrote to memory of 3552	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	83
PID 3976 wrote to memory of 5096	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	84
PID 3976 wrote to memory of 5096	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	84
PID 3976 wrote to memory of 2416	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	85
PID 3976 wrote to memory of 2416	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	85
PID 3976 wrote to memory of 2184	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	86
PID 3976 wrote to memory of 2184	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	86
PID 3976 wrote to memory of 416	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	87
PID 3976 wrote to memory of 416	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	87
PID 3976 wrote to memory of 1548	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	88
PID 3976 wrote to memory of 1548	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	88
PID 3976 wrote to memory of 2900	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	89
PID 3976 wrote to memory of 2900	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	89
PID 3976 wrote to memory of 2776	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	90
PID 3976 wrote to memory of 2776	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	90
PID 3976 wrote to memory of 4904	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	91
PID 3976 wrote to memory of 4904	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	91
PID 3976 wrote to memory of 5028	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	92
PID 3976 wrote to memory of 5028	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	92
PID 3976 wrote to memory of 2584	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	93
PID 3976 wrote to memory of 2584	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	93
PID 3976 wrote to memory of 1812	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	94
PID 3976 wrote to memory of 1812	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	94
PID 3976 wrote to memory of 2136	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	95
PID 3976 wrote to memory of 2136	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	95
PID 3976 wrote to memory of 1236	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	96
PID 3976 wrote to memory of 1236	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	96
PID 3976 wrote to memory of 1008	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	97
PID 3976 wrote to memory of 1008	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	97
PID 3976 wrote to memory of 1748	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	98
PID 3976 wrote to memory of 1748	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	98
PID 3976 wrote to memory of 2332	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	99
PID 3976 wrote to memory of 2332	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	99
PID 3976 wrote to memory of 5044	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	100
PID 3976 wrote to memory of 5044	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	100
PID 3976 wrote to memory of 4532	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	101
PID 3976 wrote to memory of 4532	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	101
PID 3976 wrote to memory of 768	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	102
PID 3976 wrote to memory of 768	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	102
PID 3976 wrote to memory of 1940	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	103
PID 3976 wrote to memory of 1940	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	103
PID 3976 wrote to memory of 1376	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	104
PID 3976 wrote to memory of 1376	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	104
PID 3976 wrote to memory of 2412	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	105
PID 3976 wrote to memory of 2412	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	105
PID 3976 wrote to memory of 1664	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	106
PID 3976 wrote to memory of 1664	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	106
PID 3976 wrote to memory of 2044	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	107
PID 3976 wrote to memory of 2044	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	107
PID 3976 wrote to memory of 4360	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	108
PID 3976 wrote to memory of 4360	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	108
PID 3976 wrote to memory of 2572	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	109
PID 3976 wrote to memory of 2572	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	109
PID 3976 wrote to memory of 3216	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	110
PID 3976 wrote to memory of 3216	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	110
PID 3976 wrote to memory of 1836	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	111
PID 3976 wrote to memory of 1836	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	111
PID 3976 wrote to memory of 4676	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	112
PID 3976 wrote to memory of 4676	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	112
PID 3976 wrote to memory of 1584	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	113
PID 3976 wrote to memory of 1584	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	113
PID 3976 wrote to memory of 2736	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	114
PID 3976 wrote to memory of 2736	3976	38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\38f3fb641fac9006e5d85adf3282bff0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\System\NPidUBH.exe
  C:\Windows\System\NPidUBH.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\yjKeOjJ.exe
  C:\Windows\System\yjKeOjJ.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\nzGQIBC.exe
  C:\Windows\System\nzGQIBC.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\uWpZZzR.exe
  C:\Windows\System\uWpZZzR.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\ueEUBcW.exe
  C:\Windows\System\ueEUBcW.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\uVUDtvt.exe
  C:\Windows\System\uVUDtvt.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\oBaXhhB.exe
  C:\Windows\System\oBaXhhB.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\dcbDrOx.exe
  C:\Windows\System\dcbDrOx.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\MuFytSA.exe
  C:\Windows\System\MuFytSA.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\qApvUmZ.exe
  C:\Windows\System\qApvUmZ.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\dnuJSmo.exe
  C:\Windows\System\dnuJSmo.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\JyZyLUO.exe
  C:\Windows\System\JyZyLUO.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\bejZjqh.exe
  C:\Windows\System\bejZjqh.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\KCmQMEj.exe
  C:\Windows\System\KCmQMEj.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\HsxPXYp.exe
  C:\Windows\System\HsxPXYp.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\mHlgrRj.exe
  C:\Windows\System\mHlgrRj.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\sMGKSgN.exe
  C:\Windows\System\sMGKSgN.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\OrLxhrQ.exe
  C:\Windows\System\OrLxhrQ.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\glaeOIM.exe
  C:\Windows\System\glaeOIM.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\IOQqmaf.exe
  C:\Windows\System\IOQqmaf.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\VEYOfXA.exe
  C:\Windows\System\VEYOfXA.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\KjzcNHr.exe
  C:\Windows\System\KjzcNHr.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\mBvscUr.exe
  C:\Windows\System\mBvscUr.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\AiGZrzP.exe
  C:\Windows\System\AiGZrzP.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\UWUlhdo.exe
  C:\Windows\System\UWUlhdo.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\KHjgUCe.exe
  C:\Windows\System\KHjgUCe.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\RuFzfkz.exe
  C:\Windows\System\RuFzfkz.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\TYZBLUX.exe
  C:\Windows\System\TYZBLUX.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\daDmgDF.exe
  C:\Windows\System\daDmgDF.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\gqBLySA.exe
  C:\Windows\System\gqBLySA.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\mvtkYaW.exe
  C:\Windows\System\mvtkYaW.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\XtLqHVe.exe
  C:\Windows\System\XtLqHVe.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\SroaTkn.exe
  C:\Windows\System\SroaTkn.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\vrHPurC.exe
  C:\Windows\System\vrHPurC.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\YTIyZCT.exe
  C:\Windows\System\YTIyZCT.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\trvmVMQ.exe
  C:\Windows\System\trvmVMQ.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\TpMleyK.exe
  C:\Windows\System\TpMleyK.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\hbLsjyf.exe
  C:\Windows\System\hbLsjyf.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\qShOJeg.exe
  C:\Windows\System\qShOJeg.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\gvSeMsF.exe
  C:\Windows\System\gvSeMsF.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\pxTdOMS.exe
  C:\Windows\System\pxTdOMS.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\ObgfoHO.exe
  C:\Windows\System\ObgfoHO.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\YBMgGgO.exe
  C:\Windows\System\YBMgGgO.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\fJUPRYd.exe
  C:\Windows\System\fJUPRYd.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\IDyERVt.exe
  C:\Windows\System\IDyERVt.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\iUNEpXz.exe
  C:\Windows\System\iUNEpXz.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\YGWOpmF.exe
  C:\Windows\System\YGWOpmF.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\netMQpF.exe
  C:\Windows\System\netMQpF.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\EebOUCv.exe
  C:\Windows\System\EebOUCv.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\ouGbquX.exe
  C:\Windows\System\ouGbquX.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\mdUeFdX.exe
  C:\Windows\System\mdUeFdX.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\sTafzQy.exe
  C:\Windows\System\sTafzQy.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\SLqeRBJ.exe
  C:\Windows\System\SLqeRBJ.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\RAuDLhz.exe
  C:\Windows\System\RAuDLhz.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\YHOUWKJ.exe
  C:\Windows\System\YHOUWKJ.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\DAUNKpp.exe
  C:\Windows\System\DAUNKpp.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\WEvbZaI.exe
  C:\Windows\System\WEvbZaI.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\xyYtUsA.exe
  C:\Windows\System\xyYtUsA.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\PUcciaZ.exe
  C:\Windows\System\PUcciaZ.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\LSdtzwD.exe
  C:\Windows\System\LSdtzwD.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\PvweQSu.exe
  C:\Windows\System\PvweQSu.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\zODAveb.exe
  C:\Windows\System\zODAveb.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\hsWICrl.exe
  C:\Windows\System\hsWICrl.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\oBJlFXK.exe
  C:\Windows\System\oBJlFXK.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\WldGuOw.exe
  C:\Windows\System\WldGuOw.exe
  2⤵
  PID:1696
- C:\Windows\System\SPNPqjD.exe
  C:\Windows\System\SPNPqjD.exe
  2⤵
  PID:3380
- C:\Windows\System\KaknmmI.exe
  C:\Windows\System\KaknmmI.exe
  2⤵
  PID:4364
- C:\Windows\System\EqhibVt.exe
  C:\Windows\System\EqhibVt.exe
  2⤵
  PID:2252
- C:\Windows\System\QSxZCWh.exe
  C:\Windows\System\QSxZCWh.exe
  2⤵
  PID:3500
- C:\Windows\System\wYKaDEK.exe
  C:\Windows\System\wYKaDEK.exe
  2⤵
  PID:4852
- C:\Windows\System\eBPWPxM.exe
  C:\Windows\System\eBPWPxM.exe
  2⤵
  PID:408
- C:\Windows\System\WvReXhM.exe
  C:\Windows\System\WvReXhM.exe
  2⤵
  PID:2452
- C:\Windows\System\GrBgyCE.exe
  C:\Windows\System\GrBgyCE.exe
  2⤵
  PID:2524
- C:\Windows\System\NjfiFaZ.exe
  C:\Windows\System\NjfiFaZ.exe
  2⤵
  PID:5032
- C:\Windows\System\kTzkIoU.exe
  C:\Windows\System\kTzkIoU.exe
  2⤵
  PID:8
- C:\Windows\System\gWExgnR.exe
  C:\Windows\System\gWExgnR.exe
  2⤵
  PID:5112
- C:\Windows\System\bFHhroF.exe
  C:\Windows\System\bFHhroF.exe
  2⤵
  PID:4536
- C:\Windows\System\tDTvoXC.exe
  C:\Windows\System\tDTvoXC.exe
  2⤵
  PID:4336
- C:\Windows\System\hxtcCpB.exe
  C:\Windows\System\hxtcCpB.exe
  2⤵
  PID:4768
- C:\Windows\System\DBgMCil.exe
  C:\Windows\System\DBgMCil.exe
  2⤵
  PID:5004
- C:\Windows\System\sCiGKaZ.exe
  C:\Windows\System\sCiGKaZ.exe
  2⤵
  PID:4420
- C:\Windows\System\NvdCScz.exe
  C:\Windows\System\NvdCScz.exe
  2⤵
  PID:3228
- C:\Windows\System\IPpbKoI.exe
  C:\Windows\System\IPpbKoI.exe
  2⤵
  PID:4256
- C:\Windows\System\cMSNZDs.exe
  C:\Windows\System\cMSNZDs.exe
  2⤵
  PID:2768
- C:\Windows\System\tToiYFL.exe
  C:\Windows\System\tToiYFL.exe
  2⤵
  PID:4820
- C:\Windows\System\laCCVov.exe
  C:\Windows\System\laCCVov.exe
  2⤵
  PID:4260
- C:\Windows\System\KuWPihO.exe
  C:\Windows\System\KuWPihO.exe
  2⤵
  PID:1244
- C:\Windows\System\fJTDpPL.exe
  C:\Windows\System\fJTDpPL.exe
  2⤵
  PID:4304
- C:\Windows\System\vQYOtak.exe
  C:\Windows\System\vQYOtak.exe
  2⤵
  PID:2996
- C:\Windows\System\Nslwbox.exe
  C:\Windows\System\Nslwbox.exe
  2⤵
  PID:1280
- C:\Windows\System\HjmIDwt.exe
  C:\Windows\System\HjmIDwt.exe
  2⤵
  PID:3944
- C:\Windows\System\vpVtLwS.exe
  C:\Windows\System\vpVtLwS.exe
  2⤵
  PID:4696
- C:\Windows\System\DhBedqa.exe
  C:\Windows\System\DhBedqa.exe
  2⤵
  PID:1436
- C:\Windows\System\kQkGpuv.exe
  C:\Windows\System\kQkGpuv.exe
  2⤵
  PID:1904
- C:\Windows\System\QAxnuMB.exe
  C:\Windows\System\QAxnuMB.exe
  2⤵
  PID:1932
- C:\Windows\System\euMtVrd.exe
  C:\Windows\System\euMtVrd.exe
  2⤵
  PID:3204
- C:\Windows\System\sOynnzI.exe
  C:\Windows\System\sOynnzI.exe
  2⤵
  PID:4224
- C:\Windows\System\mSBtqEw.exe
  C:\Windows\System\mSBtqEw.exe
  2⤵
  PID:2892
- C:\Windows\System\LFOjLKR.exe
  C:\Windows\System\LFOjLKR.exe
  2⤵
  PID:64
- C:\Windows\System\hNpkzeX.exe
  C:\Windows\System\hNpkzeX.exe
  2⤵
  PID:1832
- C:\Windows\System\uFHyuqP.exe
  C:\Windows\System\uFHyuqP.exe
  2⤵
  PID:4840
- C:\Windows\System\WcszcxI.exe
  C:\Windows\System\WcszcxI.exe
  2⤵
  PID:1652
- C:\Windows\System\MaLWVTp.exe
  C:\Windows\System\MaLWVTp.exe
  2⤵
  PID:1616
- C:\Windows\System\IdkSZrd.exe
  C:\Windows\System\IdkSZrd.exe
  2⤵
  PID:2812
- C:\Windows\System\rlSxwNp.exe
  C:\Windows\System\rlSxwNp.exe
  2⤵
  PID:5136
- C:\Windows\System\fXcSaNR.exe
  C:\Windows\System\fXcSaNR.exe
  2⤵
  PID:5164
- C:\Windows\System\EqHPRPk.exe
  C:\Windows\System\EqHPRPk.exe
  2⤵
  PID:5184
- C:\Windows\System\zFLJrYt.exe
  C:\Windows\System\zFLJrYt.exe
  2⤵
  PID:5204
- C:\Windows\System\TNZZxvV.exe
  C:\Windows\System\TNZZxvV.exe
  2⤵
  PID:5224
- C:\Windows\System\hdKFaPc.exe
  C:\Windows\System\hdKFaPc.exe
  2⤵
  PID:5248
- C:\Windows\System\kAcavex.exe
  C:\Windows\System\kAcavex.exe
  2⤵
  PID:5272
- C:\Windows\System\ugWktET.exe
  C:\Windows\System\ugWktET.exe
  2⤵
  PID:5296
- C:\Windows\System\CihKTSf.exe
  C:\Windows\System\CihKTSf.exe
  2⤵
  PID:5320
- C:\Windows\System\CiTBIwu.exe
  C:\Windows\System\CiTBIwu.exe
  2⤵
  PID:5336
- C:\Windows\System\umilCYY.exe
  C:\Windows\System\umilCYY.exe
  2⤵
  PID:5356
- C:\Windows\System\iCXrtPi.exe
  C:\Windows\System\iCXrtPi.exe
  2⤵
  PID:5384
- C:\Windows\System\XPMFpNS.exe
  C:\Windows\System\XPMFpNS.exe
  2⤵
  PID:5404
- C:\Windows\System\VVHeCZn.exe
  C:\Windows\System\VVHeCZn.exe
  2⤵
  PID:5420
- C:\Windows\System\vcRcERa.exe
  C:\Windows\System\vcRcERa.exe
  2⤵
  PID:5444
- C:\Windows\System\dGZgkNC.exe
  C:\Windows\System\dGZgkNC.exe
  2⤵
  PID:5460
- C:\Windows\System\JRYGKRi.exe
  C:\Windows\System\JRYGKRi.exe
  2⤵
  PID:5480
- C:\Windows\System\dHLdoTd.exe
  C:\Windows\System\dHLdoTd.exe
  2⤵
  PID:5504
- C:\Windows\System\dmGXcvC.exe
  C:\Windows\System\dmGXcvC.exe
  2⤵
  PID:5524
- C:\Windows\System\TryPRJX.exe
  C:\Windows\System\TryPRJX.exe
  2⤵
  PID:5548
- C:\Windows\System\YBCrJMA.exe
  C:\Windows\System\YBCrJMA.exe
  2⤵
  PID:5576
- C:\Windows\System\fHGNELw.exe
  C:\Windows\System\fHGNELw.exe
  2⤵
  PID:5596
- C:\Windows\System\mWkwHcL.exe
  C:\Windows\System\mWkwHcL.exe
  2⤵
  PID:5620
- C:\Windows\System\YafXFGA.exe
  C:\Windows\System\YafXFGA.exe
  2⤵
  PID:5640
- C:\Windows\System\abhvipJ.exe
  C:\Windows\System\abhvipJ.exe
  2⤵
  PID:5672
- C:\Windows\System\QBrzTIq.exe
  C:\Windows\System\QBrzTIq.exe
  2⤵
  PID:5692
- C:\Windows\System\wDeqIjy.exe
  C:\Windows\System\wDeqIjy.exe
  2⤵
  PID:5712
- C:\Windows\System\SWaVECU.exe
  C:\Windows\System\SWaVECU.exe
  2⤵
  PID:5740
- C:\Windows\System\NPKcQsA.exe
  C:\Windows\System\NPKcQsA.exe
  2⤵
  PID:5760
- C:\Windows\System\iqRyHqL.exe
  C:\Windows\System\iqRyHqL.exe
  2⤵
  PID:5780
- C:\Windows\System\FISIvTD.exe
  C:\Windows\System\FISIvTD.exe
  2⤵
  PID:5800
- C:\Windows\System\lMbyELQ.exe
  C:\Windows\System\lMbyELQ.exe
  2⤵
  PID:5820
- C:\Windows\System\ELZpIoU.exe
  C:\Windows\System\ELZpIoU.exe
  2⤵
  PID:5840
- C:\Windows\System\nYopFZa.exe
  C:\Windows\System\nYopFZa.exe
  2⤵
  PID:5864
- C:\Windows\System\gETPaRU.exe
  C:\Windows\System\gETPaRU.exe
  2⤵
  PID:5884
- C:\Windows\System\DFdlbwm.exe
  C:\Windows\System\DFdlbwm.exe
  2⤵
  PID:5908
- C:\Windows\System\hNVoLdZ.exe
  C:\Windows\System\hNVoLdZ.exe
  2⤵
  PID:5928
- C:\Windows\System\gfSOWrp.exe
  C:\Windows\System\gfSOWrp.exe
  2⤵
  PID:5952
- C:\Windows\System\TRBdXYB.exe
  C:\Windows\System\TRBdXYB.exe
  2⤵
  PID:5972
- C:\Windows\System\PUGLJHV.exe
  C:\Windows\System\PUGLJHV.exe
  2⤵
  PID:5992
- C:\Windows\System\VLuGgtJ.exe
  C:\Windows\System\VLuGgtJ.exe
  2⤵
  PID:6012
- C:\Windows\System\mVCFgZf.exe
  C:\Windows\System\mVCFgZf.exe
  2⤵
  PID:6036
- C:\Windows\System\CyDTbXW.exe
  C:\Windows\System\CyDTbXW.exe
  2⤵
  PID:6060
- C:\Windows\System\ghFguZY.exe
  C:\Windows\System\ghFguZY.exe
  2⤵
  PID:6080
- C:\Windows\System\XTaYyeT.exe
  C:\Windows\System\XTaYyeT.exe
  2⤵
  PID:6104
- C:\Windows\System\zVFhvrS.exe
  C:\Windows\System\zVFhvrS.exe
  2⤵
  PID:6128
- C:\Windows\System\tqFleZc.exe
  C:\Windows\System\tqFleZc.exe
  2⤵
  PID:640
- C:\Windows\System\ZqIIbWN.exe
  C:\Windows\System\ZqIIbWN.exe
  2⤵
  PID:756
- C:\Windows\System\eFOQYBo.exe
  C:\Windows\System\eFOQYBo.exe
  2⤵
  PID:4564
- C:\Windows\System\qiOfRpY.exe
  C:\Windows\System\qiOfRpY.exe
  2⤵
  PID:1544
- C:\Windows\System\DeeaSHM.exe
  C:\Windows\System\DeeaSHM.exe
  2⤵
  PID:5216
- C:\Windows\System\TlTZtSz.exe
  C:\Windows\System\TlTZtSz.exe
  2⤵
  PID:1720
- C:\Windows\System\kWuozkY.exe
  C:\Windows\System\kWuozkY.exe
  2⤵
  PID:5244
- C:\Windows\System\sdTVKzi.exe
  C:\Windows\System\sdTVKzi.exe
  2⤵
  PID:548
- C:\Windows\System\ukCAFbf.exe
  C:\Windows\System\ukCAFbf.exe
  2⤵
  PID:5144
- C:\Windows\System\zdIDoUh.exe
  C:\Windows\System\zdIDoUh.exe
  2⤵
  PID:5332
- C:\Windows\System\PqJNyhI.exe
  C:\Windows\System\PqJNyhI.exe
  2⤵
  PID:5364
- C:\Windows\System\wHHSXgT.exe
  C:\Windows\System\wHHSXgT.exe
  2⤵
  PID:5400
- C:\Windows\System\cNLLtzo.exe
  C:\Windows\System\cNLLtzo.exe
  2⤵
  PID:5452
- C:\Windows\System\xKFvKde.exe
  C:\Windows\System\xKFvKde.exe
  2⤵
  PID:5500
- C:\Windows\System\UfSRFNh.exe
  C:\Windows\System\UfSRFNh.exe
  2⤵
  PID:5544
- C:\Windows\System\qsewDSg.exe
  C:\Windows\System\qsewDSg.exe
  2⤵
  PID:5604
- C:\Windows\System\zRqHOqJ.exe
  C:\Windows\System\zRqHOqJ.exe
  2⤵
  PID:5796
- C:\Windows\System\WAZQaFh.exe
  C:\Windows\System\WAZQaFh.exe
  2⤵
  PID:5880
- C:\Windows\System\NVvZoja.exe
  C:\Windows\System\NVvZoja.exe
  2⤵
  PID:5960
- C:\Windows\System\RNSjhGA.exe
  C:\Windows\System\RNSjhGA.exe
  2⤵
  PID:5436
- C:\Windows\System\dUloluf.exe
  C:\Windows\System\dUloluf.exe
  2⤵
  PID:6008
- C:\Windows\System\SQgjvag.exe
  C:\Windows\System\SQgjvag.exe
  2⤵
  PID:5556
- C:\Windows\System\AtrhqQy.exe
  C:\Windows\System\AtrhqQy.exe
  2⤵
  PID:6160
- C:\Windows\System\QlZWEoV.exe
  C:\Windows\System\QlZWEoV.exe
  2⤵
  PID:6180
- C:\Windows\System\oOfYrQQ.exe
  C:\Windows\System\oOfYrQQ.exe
  2⤵
  PID:6196
- C:\Windows\System\mAVCyDd.exe
  C:\Windows\System\mAVCyDd.exe
  2⤵
  PID:6220
- C:\Windows\System\ldNbNsm.exe
  C:\Windows\System\ldNbNsm.exe
  2⤵
  PID:6236
- C:\Windows\System\ajkuJJD.exe
  C:\Windows\System\ajkuJJD.exe
  2⤵
  PID:6260
- C:\Windows\System\LUkujQX.exe
  C:\Windows\System\LUkujQX.exe
  2⤵
  PID:6284
- C:\Windows\System\YZFKJhd.exe
  C:\Windows\System\YZFKJhd.exe
  2⤵
  PID:6308
- C:\Windows\System\mwobUwh.exe
  C:\Windows\System\mwobUwh.exe
  2⤵
  PID:6332
- C:\Windows\System\WlpRUCm.exe
  C:\Windows\System\WlpRUCm.exe
  2⤵
  PID:6352
- C:\Windows\System\HkaaBJG.exe
  C:\Windows\System\HkaaBJG.exe
  2⤵
  PID:6376
- C:\Windows\System\SmViuIc.exe
  C:\Windows\System\SmViuIc.exe
  2⤵
  PID:6392
- C:\Windows\System\hWuracG.exe
  C:\Windows\System\hWuracG.exe
  2⤵
  PID:6416
- C:\Windows\System\TCCfxST.exe
  C:\Windows\System\TCCfxST.exe
  2⤵
  PID:6440
- C:\Windows\System\CuoNeIP.exe
  C:\Windows\System\CuoNeIP.exe
  2⤵
  PID:6460
- C:\Windows\System\jfEScAG.exe
  C:\Windows\System\jfEScAG.exe
  2⤵
  PID:6480
- C:\Windows\System\PVfLamC.exe
  C:\Windows\System\PVfLamC.exe
  2⤵
  PID:6500
- C:\Windows\System\rEKySGE.exe
  C:\Windows\System\rEKySGE.exe
  2⤵
  PID:6520
- C:\Windows\System\ycvZpaV.exe
  C:\Windows\System\ycvZpaV.exe
  2⤵
  PID:6548
- C:\Windows\System\uKVISBW.exe
  C:\Windows\System\uKVISBW.exe
  2⤵
  PID:6572
- C:\Windows\System\bQXpYRs.exe
  C:\Windows\System\bQXpYRs.exe
  2⤵
  PID:6596
- C:\Windows\System\lIkJzbN.exe
  C:\Windows\System\lIkJzbN.exe
  2⤵
  PID:6616
- C:\Windows\System\AqWWObi.exe
  C:\Windows\System\AqWWObi.exe
  2⤵
  PID:6640
- C:\Windows\System\ghAwGLm.exe
  C:\Windows\System\ghAwGLm.exe
  2⤵
  PID:6660
- C:\Windows\System\TaeLqtV.exe
  C:\Windows\System\TaeLqtV.exe
  2⤵
  PID:6680
- C:\Windows\System\hZZjkCn.exe
  C:\Windows\System\hZZjkCn.exe
  2⤵
  PID:6700
- C:\Windows\System\HflgZvw.exe
  C:\Windows\System\HflgZvw.exe
  2⤵
  PID:6724
- C:\Windows\System\WufuSNp.exe
  C:\Windows\System\WufuSNp.exe
  2⤵
  PID:6744
- C:\Windows\System\mfKYCXG.exe
  C:\Windows\System\mfKYCXG.exe
  2⤵
  PID:6772
- C:\Windows\System\rCYmuQA.exe
  C:\Windows\System\rCYmuQA.exe
  2⤵
  PID:6796
- C:\Windows\System\KrXcsqq.exe
  C:\Windows\System\KrXcsqq.exe
  2⤵
  PID:6816
- C:\Windows\System\zJueUmr.exe
  C:\Windows\System\zJueUmr.exe
  2⤵
  PID:6836
- C:\Windows\System\hjjxcaz.exe
  C:\Windows\System\hjjxcaz.exe
  2⤵
  PID:6856
- C:\Windows\System\rDxqGZL.exe
  C:\Windows\System\rDxqGZL.exe
  2⤵
  PID:6876
- C:\Windows\System\KoLrStw.exe
  C:\Windows\System\KoLrStw.exe
  2⤵
  PID:6900
- C:\Windows\System\oxYlkUG.exe
  C:\Windows\System\oxYlkUG.exe
  2⤵
  PID:6920
- C:\Windows\System\tQQoBxD.exe
  C:\Windows\System\tQQoBxD.exe
  2⤵
  PID:6940
- C:\Windows\System\KpRjZGo.exe
  C:\Windows\System\KpRjZGo.exe
  2⤵
  PID:6968
- C:\Windows\System\vHBKJqZ.exe
  C:\Windows\System\vHBKJqZ.exe
  2⤵
  PID:6984
- C:\Windows\System\oOixNef.exe
  C:\Windows\System\oOixNef.exe
  2⤵
  PID:7008
- C:\Windows\System\PpQtczA.exe
  C:\Windows\System\PpQtczA.exe
  2⤵
  PID:7024
- C:\Windows\System\FzKlwLZ.exe
  C:\Windows\System\FzKlwLZ.exe
  2⤵
  PID:7044
- C:\Windows\System\FSORPCW.exe
  C:\Windows\System\FSORPCW.exe
  2⤵
  PID:7068
- C:\Windows\System\EFLPtRD.exe
  C:\Windows\System\EFLPtRD.exe
  2⤵
  PID:7088
- C:\Windows\System\FhUbsCi.exe
  C:\Windows\System\FhUbsCi.exe
  2⤵
  PID:7108
- C:\Windows\System\ZumdwCB.exe
  C:\Windows\System\ZumdwCB.exe
  2⤵
  PID:7132
- C:\Windows\System\tOlQGCY.exe
  C:\Windows\System\tOlQGCY.exe
  2⤵
  PID:7152
- C:\Windows\System\YmOWmaj.exe
  C:\Windows\System\YmOWmaj.exe
  2⤵
  PID:5592
- C:\Windows\System\vhzZoeb.exe
  C:\Windows\System\vhzZoeb.exe
  2⤵
  PID:5196
- C:\Windows\System\oufhGjI.exe
  C:\Windows\System\oufhGjI.exe
  2⤵
  PID:5632
- C:\Windows\System\tjAQnYx.exe
  C:\Windows\System\tjAQnYx.exe
  2⤵
  PID:5948
- C:\Windows\System\iBzfrtD.exe
  C:\Windows\System\iBzfrtD.exe
  2⤵
  PID:2516
- C:\Windows\System\hohskwj.exe
  C:\Windows\System\hohskwj.exe
  2⤵
  PID:5156
- C:\Windows\System\gJTSMTs.exe
  C:\Windows\System\gJTSMTs.exe
  2⤵
  PID:5988
- C:\Windows\System\zKnhjbo.exe
  C:\Windows\System\zKnhjbo.exe
  2⤵
  PID:5516
- C:\Windows\System\tLyeoxn.exe
  C:\Windows\System\tLyeoxn.exe
  2⤵
  PID:6044
- C:\Windows\System\LjsOZEE.exe
  C:\Windows\System\LjsOZEE.exe
  2⤵
  PID:5732
- C:\Windows\System\ygVEAJL.exe
  C:\Windows\System\ygVEAJL.exe
  2⤵
  PID:5816
- C:\Windows\System\NnfFdWc.exe
  C:\Windows\System\NnfFdWc.exe
  2⤵
  PID:6292
- C:\Windows\System\SSVdnvj.exe
  C:\Windows\System\SSVdnvj.exe
  2⤵
  PID:5900
- C:\Windows\System\vwpKGDe.exe
  C:\Windows\System\vwpKGDe.exe
  2⤵
  PID:6072
- C:\Windows\System\OwUEEXp.exe
  C:\Windows\System\OwUEEXp.exe
  2⤵
  PID:6120
- C:\Windows\System\sYFklJU.exe
  C:\Windows\System\sYFklJU.exe
  2⤵
  PID:6148
- C:\Windows\System\VbbShRH.exe
  C:\Windows\System\VbbShRH.exe
  2⤵
  PID:2368
- C:\Windows\System\HChsWVU.exe
  C:\Windows\System\HChsWVU.exe
  2⤵
  PID:6588
- C:\Windows\System\DtZhFzQ.exe
  C:\Windows\System\DtZhFzQ.exe
  2⤵
  PID:4060
- C:\Windows\System\IczWhEf.exe
  C:\Windows\System\IczWhEf.exe
  2⤵
  PID:6232
- C:\Windows\System\deYzrmN.exe
  C:\Windows\System\deYzrmN.exe
  2⤵
  PID:5348
- C:\Windows\System\vENYFQI.exe
  C:\Windows\System\vENYFQI.exe
  2⤵
  PID:7180
- C:\Windows\System\wNnlbls.exe
  C:\Windows\System\wNnlbls.exe
  2⤵
  PID:7208
- C:\Windows\System\qYtGIfO.exe
  C:\Windows\System\qYtGIfO.exe
  2⤵
  PID:7240
- C:\Windows\System\yMMDwoY.exe
  C:\Windows\System\yMMDwoY.exe
  2⤵
  PID:7256
- C:\Windows\System\TrPrMrB.exe
  C:\Windows\System\TrPrMrB.exe
  2⤵
  PID:7280
- C:\Windows\System\aOQVDhI.exe
  C:\Windows\System\aOQVDhI.exe
  2⤵
  PID:7304
- C:\Windows\System\jorAcDx.exe
  C:\Windows\System\jorAcDx.exe
  2⤵
  PID:7324
- C:\Windows\System\QvUSZHL.exe
  C:\Windows\System\QvUSZHL.exe
  2⤵
  PID:7344
- C:\Windows\System\culUHez.exe
  C:\Windows\System\culUHez.exe
  2⤵
  PID:7368
- C:\Windows\System\vzLwGpi.exe
  C:\Windows\System\vzLwGpi.exe
  2⤵
  PID:7388
- C:\Windows\System\dzAucZS.exe
  C:\Windows\System\dzAucZS.exe
  2⤵
  PID:7408
- C:\Windows\System\MropaAk.exe
  C:\Windows\System\MropaAk.exe
  2⤵
  PID:7428
- C:\Windows\System\BuDhUAG.exe
  C:\Windows\System\BuDhUAG.exe
  2⤵
  PID:7452
- C:\Windows\System\LRnhqiw.exe
  C:\Windows\System\LRnhqiw.exe
  2⤵
  PID:7468
- C:\Windows\System\SVoWqui.exe
  C:\Windows\System\SVoWqui.exe
  2⤵
  PID:7492
- C:\Windows\System\DKqgvHS.exe
  C:\Windows\System\DKqgvHS.exe
  2⤵
  PID:7516
- C:\Windows\System\nkKwEDr.exe
  C:\Windows\System\nkKwEDr.exe
  2⤵
  PID:7536
- C:\Windows\System\cFsWEri.exe
  C:\Windows\System\cFsWEri.exe
  2⤵
  PID:7564
- C:\Windows\System\GymacLD.exe
  C:\Windows\System\GymacLD.exe
  2⤵
  PID:7584
- C:\Windows\System\eEzDvnf.exe
  C:\Windows\System\eEzDvnf.exe
  2⤵
  PID:7604
- C:\Windows\System\EaKPcSX.exe
  C:\Windows\System\EaKPcSX.exe
  2⤵
  PID:7624
- C:\Windows\System\HfjYEQN.exe
  C:\Windows\System\HfjYEQN.exe
  2⤵
  PID:7656
- C:\Windows\System\qqiEWwh.exe
  C:\Windows\System\qqiEWwh.exe
  2⤵
  PID:7672
- C:\Windows\System\dKPQLHD.exe
  C:\Windows\System\dKPQLHD.exe
  2⤵
  PID:7692
- C:\Windows\System\kelbJko.exe
  C:\Windows\System\kelbJko.exe
  2⤵
  PID:7716
- C:\Windows\System\IWfpTLj.exe
  C:\Windows\System\IWfpTLj.exe
  2⤵
  PID:7740
- C:\Windows\System\PYhvajl.exe
  C:\Windows\System\PYhvajl.exe
  2⤵
  PID:7756
- C:\Windows\System\ukhQnmX.exe
  C:\Windows\System\ukhQnmX.exe
  2⤵
  PID:7776
- C:\Windows\System\jPAFgrq.exe
  C:\Windows\System\jPAFgrq.exe
  2⤵
  PID:7800
- C:\Windows\System\fTFCARM.exe
  C:\Windows\System\fTFCARM.exe
  2⤵
  PID:7820
- C:\Windows\System\sUxRkLR.exe
  C:\Windows\System\sUxRkLR.exe
  2⤵
  PID:7840
- C:\Windows\System\EjwhvpZ.exe
  C:\Windows\System\EjwhvpZ.exe
  2⤵
  PID:7856
- C:\Windows\System\mszeAMg.exe
  C:\Windows\System\mszeAMg.exe
  2⤵
  PID:7884
- C:\Windows\System\bvYIjjL.exe
  C:\Windows\System\bvYIjjL.exe
  2⤵
  PID:7904
- C:\Windows\System\OGdfqNm.exe
  C:\Windows\System\OGdfqNm.exe
  2⤵
  PID:7928
- C:\Windows\System\pnPJGYZ.exe
  C:\Windows\System\pnPJGYZ.exe
  2⤵
  PID:7944
- C:\Windows\System\VpBwKYe.exe
  C:\Windows\System\VpBwKYe.exe
  2⤵
  PID:7964
- C:\Windows\System\kVMFyZX.exe
  C:\Windows\System\kVMFyZX.exe
  2⤵
  PID:7992
- C:\Windows\System\clxtDxO.exe
  C:\Windows\System\clxtDxO.exe
  2⤵
  PID:8008
- C:\Windows\System\GJWFUEX.exe
  C:\Windows\System\GJWFUEX.exe
  2⤵
  PID:8032
- C:\Windows\System\htgSPcg.exe
  C:\Windows\System\htgSPcg.exe
  2⤵
  PID:8052
- C:\Windows\System\KPJlrnq.exe
  C:\Windows\System\KPJlrnq.exe
  2⤵
  PID:8072
- C:\Windows\System\ZEPIWwJ.exe
  C:\Windows\System\ZEPIWwJ.exe
  2⤵
  PID:8088
- C:\Windows\System\MZuUFfL.exe
  C:\Windows\System\MZuUFfL.exe
  2⤵
  PID:8108
- C:\Windows\System\rJvNaLP.exe
  C:\Windows\System\rJvNaLP.exe
  2⤵
  PID:8128
- C:\Windows\System\IHFWjHo.exe
  C:\Windows\System\IHFWjHo.exe
  2⤵
  PID:8148
- C:\Windows\System\PKbmXPR.exe
  C:\Windows\System\PKbmXPR.exe
  2⤵
  PID:8168
- C:\Windows\System\fnlOehF.exe
  C:\Windows\System\fnlOehF.exe
  2⤵
  PID:8184
- C:\Windows\System\IfmHrlZ.exe
  C:\Windows\System\IfmHrlZ.exe
  2⤵
  PID:5468
- C:\Windows\System\GNHQYTR.exe
  C:\Windows\System\GNHQYTR.exe
  2⤵
  PID:7124
- C:\Windows\System\climZvG.exe
  C:\Windows\System\climZvG.exe
  2⤵
  PID:5236
- C:\Windows\System\CrUuAcQ.exe
  C:\Windows\System\CrUuAcQ.exe
  2⤵
  PID:5284
- C:\Windows\System\pAUaxLt.exe
  C:\Windows\System\pAUaxLt.exe
  2⤵
  PID:5176
- C:\Windows\System\PsZCLdS.exe
  C:\Windows\System\PsZCLdS.exe
  2⤵
  PID:6656
- C:\Windows\System\QSsDXMa.exe
  C:\Windows\System\QSsDXMa.exe
  2⤵
  PID:6112
- C:\Windows\System\AQxkFFG.exe
  C:\Windows\System\AQxkFFG.exe
  2⤵
  PID:4972
- C:\Windows\System\GvgTmhZ.exe
  C:\Windows\System\GvgTmhZ.exe
  2⤵
  PID:6316
- C:\Windows\System\ZpZqfIL.exe
  C:\Windows\System\ZpZqfIL.exe
  2⤵
  PID:6696
- C:\Windows\System\KSNTFzV.exe
  C:\Windows\System\KSNTFzV.exe
  2⤵
  PID:6852
- C:\Windows\System\dyaKCxM.exe
  C:\Windows\System\dyaKCxM.exe
  2⤵
  PID:6404
- C:\Windows\System\QgNRbNQ.exe
  C:\Windows\System\QgNRbNQ.exe
  2⤵
  PID:6432
- C:\Windows\System\aJKzYzL.exe
  C:\Windows\System\aJKzYzL.exe
  2⤵
  PID:6456
- C:\Windows\System\dtVQGto.exe
  C:\Windows\System\dtVQGto.exe
  2⤵
  PID:7600
- C:\Windows\System\uJWOkUi.exe
  C:\Windows\System\uJWOkUi.exe
  2⤵
  PID:4512
- C:\Windows\System\WuybutV.exe
  C:\Windows\System\WuybutV.exe
  2⤵
  PID:6532
- C:\Windows\System\FCGrxOL.exe
  C:\Windows\System\FCGrxOL.exe
  2⤵
  PID:8212
- C:\Windows\System\EZFMFBz.exe
  C:\Windows\System\EZFMFBz.exe
  2⤵
  PID:8236
- C:\Windows\System\UjYskVh.exe
  C:\Windows\System\UjYskVh.exe
  2⤵
  PID:8252
- C:\Windows\System\KguiUCN.exe
  C:\Windows\System\KguiUCN.exe
  2⤵
  PID:8276
- C:\Windows\System\fZYCZGl.exe
  C:\Windows\System\fZYCZGl.exe
  2⤵
  PID:8304
- C:\Windows\System\CvCOpHT.exe
  C:\Windows\System\CvCOpHT.exe
  2⤵
  PID:8320
- C:\Windows\System\lvmNHlL.exe
  C:\Windows\System\lvmNHlL.exe
  2⤵
  PID:8344
- C:\Windows\System\nahhjRW.exe
  C:\Windows\System\nahhjRW.exe
  2⤵
  PID:8360
- C:\Windows\System\ihYQznq.exe
  C:\Windows\System\ihYQznq.exe
  2⤵
  PID:8380
- C:\Windows\System\fqEGylZ.exe
  C:\Windows\System\fqEGylZ.exe
  2⤵
  PID:8404
- C:\Windows\System\ILclqCp.exe
  C:\Windows\System\ILclqCp.exe
  2⤵
  PID:8432
- C:\Windows\System\BpamKpv.exe
  C:\Windows\System\BpamKpv.exe
  2⤵
  PID:8460
- C:\Windows\System\ryBsdLW.exe
  C:\Windows\System\ryBsdLW.exe
  2⤵
  PID:8480
- C:\Windows\System\fWVAJzq.exe
  C:\Windows\System\fWVAJzq.exe
  2⤵
  PID:8512
- C:\Windows\System\pZhGIGD.exe
  C:\Windows\System\pZhGIGD.exe
  2⤵
  PID:8532
- C:\Windows\System\wEFMHSR.exe
  C:\Windows\System\wEFMHSR.exe
  2⤵
  PID:8552
- C:\Windows\System\lsAxhKQ.exe
  C:\Windows\System\lsAxhKQ.exe
  2⤵
  PID:8580
- C:\Windows\System\XcpsmGN.exe
  C:\Windows\System\XcpsmGN.exe
  2⤵
  PID:8616
- C:\Windows\System\ImgkWwT.exe
  C:\Windows\System\ImgkWwT.exe
  2⤵
  PID:8636
- C:\Windows\System\nQQLieq.exe
  C:\Windows\System\nQQLieq.exe
  2⤵
  PID:8652
- C:\Windows\System\asROHTj.exe
  C:\Windows\System\asROHTj.exe
  2⤵
  PID:8676
- C:\Windows\System\sokgYXF.exe
  C:\Windows\System\sokgYXF.exe
  2⤵
  PID:8696
- C:\Windows\System\HIihkkX.exe
  C:\Windows\System\HIihkkX.exe
  2⤵
  PID:8716
- C:\Windows\System\PhUryDN.exe
  C:\Windows\System\PhUryDN.exe
  2⤵
  PID:8744
- C:\Windows\System\MAyXgZM.exe
  C:\Windows\System\MAyXgZM.exe
  2⤵
  PID:8764
- C:\Windows\System\auilkjB.exe
  C:\Windows\System\auilkjB.exe
  2⤵
  PID:8784
- C:\Windows\System\WmhOFbe.exe
  C:\Windows\System\WmhOFbe.exe
  2⤵
  PID:8804
- C:\Windows\System\DRUUBfy.exe
  C:\Windows\System\DRUUBfy.exe
  2⤵
  PID:8824
- C:\Windows\System\KWfEwWo.exe
  C:\Windows\System\KWfEwWo.exe
  2⤵
  PID:8844
- C:\Windows\System\GnFUfPS.exe
  C:\Windows\System\GnFUfPS.exe
  2⤵
  PID:8860
- C:\Windows\System\Ofgoqtk.exe
  C:\Windows\System\Ofgoqtk.exe
  2⤵
  PID:8884
- C:\Windows\System\DtbAFMp.exe
  C:\Windows\System\DtbAFMp.exe
  2⤵
  PID:8904
- C:\Windows\System\qmunBfe.exe
  C:\Windows\System\qmunBfe.exe
  2⤵
  PID:8924
- C:\Windows\System\aGJaHDL.exe
  C:\Windows\System\aGJaHDL.exe
  2⤵
  PID:8944
- C:\Windows\System\tvqPhbq.exe
  C:\Windows\System\tvqPhbq.exe
  2⤵
  PID:8960
- C:\Windows\System\hjpfoAK.exe
  C:\Windows\System\hjpfoAK.exe
  2⤵
  PID:8980
- C:\Windows\System\WGqKzUP.exe
  C:\Windows\System\WGqKzUP.exe
  2⤵
  PID:8996
- C:\Windows\System\IsICRBi.exe
  C:\Windows\System\IsICRBi.exe
  2⤵
  PID:9020
- C:\Windows\System\ejUBeKn.exe
  C:\Windows\System\ejUBeKn.exe
  2⤵
  PID:9040
- C:\Windows\System\MdNGwUl.exe
  C:\Windows\System\MdNGwUl.exe
  2⤵
  PID:9060
- C:\Windows\System\iuLkujZ.exe
  C:\Windows\System\iuLkujZ.exe
  2⤵
  PID:9084
- C:\Windows\System\nkIHyTT.exe
  C:\Windows\System\nkIHyTT.exe
  2⤵
  PID:9104
- C:\Windows\System\FFjyCGm.exe
  C:\Windows\System\FFjyCGm.exe
  2⤵
  PID:9120
- C:\Windows\System\qfJzoUk.exe
  C:\Windows\System\qfJzoUk.exe
  2⤵
  PID:9140
- C:\Windows\System\RXIPXyM.exe
  C:\Windows\System\RXIPXyM.exe
  2⤵
  PID:9164
- C:\Windows\System\SRLIdnB.exe
  C:\Windows\System\SRLIdnB.exe
  2⤵
  PID:9180
- C:\Windows\System\TaCnJNl.exe
  C:\Windows\System\TaCnJNl.exe
  2⤵
  PID:9204
- C:\Windows\System\TFcvoLC.exe
  C:\Windows\System\TFcvoLC.exe
  2⤵
  PID:7768
- C:\Windows\System\Smyddqw.exe
  C:\Windows\System\Smyddqw.exe
  2⤵
  PID:5728
- C:\Windows\System\LKZxrWI.exe
  C:\Windows\System\LKZxrWI.exe
  2⤵
  PID:5848
- C:\Windows\System\KcTjeAs.exe
  C:\Windows\System\KcTjeAs.exe
  2⤵
  PID:7812
- C:\Windows\System\hfkFVtz.exe
  C:\Windows\System\hfkFVtz.exe
  2⤵
  PID:6756
- C:\Windows\System\UEOowrr.exe
  C:\Windows\System\UEOowrr.exe
  2⤵
  PID:7960
- C:\Windows\System\HASeWgY.exe
  C:\Windows\System\HASeWgY.exe
  2⤵
  PID:8016
- C:\Windows\System\IpPuaiy.exe
  C:\Windows\System\IpPuaiy.exe
  2⤵
  PID:6844
- C:\Windows\System\UCcxhsA.exe
  C:\Windows\System\UCcxhsA.exe
  2⤵
  PID:6892
- C:\Windows\System\SjJEmEK.exe
  C:\Windows\System\SjJEmEK.exe
  2⤵
  PID:6936
- C:\Windows\System\GpwFFhj.exe
  C:\Windows\System\GpwFFhj.exe
  2⤵
  PID:6992
- C:\Windows\System\ZECrsgg.exe
  C:\Windows\System\ZECrsgg.exe
  2⤵
  PID:7036
- C:\Windows\System\gVJBgdE.exe
  C:\Windows\System\gVJBgdE.exe
  2⤵
  PID:7084
- C:\Windows\System\qggnylg.exe
  C:\Windows\System\qggnylg.exe
  2⤵
  PID:7436
- C:\Windows\System\JljQMrk.exe
  C:\Windows\System\JljQMrk.exe
  2⤵
  PID:5856
- C:\Windows\System\hWgUhyX.exe
  C:\Windows\System\hWgUhyX.exe
  2⤵
  PID:5476
- C:\Windows\System\pwRqeEJ.exe
  C:\Windows\System\pwRqeEJ.exe
  2⤵
  PID:9232
- C:\Windows\System\jADjLVz.exe
  C:\Windows\System\jADjLVz.exe
  2⤵
  PID:9252
- C:\Windows\System\kNMpnLd.exe
  C:\Windows\System\kNMpnLd.exe
  2⤵
  PID:9268
- C:\Windows\System\XFxKSve.exe
  C:\Windows\System\XFxKSve.exe
  2⤵
  PID:9288
- C:\Windows\System\vuUfgwL.exe
  C:\Windows\System\vuUfgwL.exe
  2⤵
  PID:9312
- C:\Windows\System\fdijEYV.exe
  C:\Windows\System\fdijEYV.exe
  2⤵
  PID:9340
- C:\Windows\System\mGqZIUU.exe
  C:\Windows\System\mGqZIUU.exe
  2⤵
  PID:9360
- C:\Windows\System\ATTHxXo.exe
  C:\Windows\System\ATTHxXo.exe
  2⤵
  PID:9376
- C:\Windows\System\fWvAtGk.exe
  C:\Windows\System\fWvAtGk.exe
  2⤵
  PID:9400
- C:\Windows\System\uBAScOr.exe
  C:\Windows\System\uBAScOr.exe
  2⤵
  PID:9420
- C:\Windows\System\mTPkchO.exe
  C:\Windows\System\mTPkchO.exe
  2⤵
  PID:9440
- C:\Windows\System\lKGiIKd.exe
  C:\Windows\System\lKGiIKd.exe
  2⤵
  PID:9464
- C:\Windows\System\TeElkSQ.exe
  C:\Windows\System\TeElkSQ.exe
  2⤵
  PID:9484
- C:\Windows\System\AmNneTH.exe
  C:\Windows\System\AmNneTH.exe
  2⤵
  PID:9504
- C:\Windows\System\frgSOTK.exe
  C:\Windows\System\frgSOTK.exe
  2⤵
  PID:9524
- C:\Windows\System\pxkTCjF.exe
  C:\Windows\System\pxkTCjF.exe
  2⤵
  PID:9544
- C:\Windows\System\RUGQbQK.exe
  C:\Windows\System\RUGQbQK.exe
  2⤵
  PID:9568
- C:\Windows\System\sguIqJM.exe
  C:\Windows\System\sguIqJM.exe
  2⤵
  PID:9592
- C:\Windows\System\xHztNJs.exe
  C:\Windows\System\xHztNJs.exe
  2⤵
  PID:9612
- C:\Windows\System\nAdMPHX.exe
  C:\Windows\System\nAdMPHX.exe
  2⤵
  PID:9636
- C:\Windows\System\gMJlsCq.exe
  C:\Windows\System\gMJlsCq.exe
  2⤵
  PID:9656
- C:\Windows\System\EONYXYx.exe
  C:\Windows\System\EONYXYx.exe
  2⤵
  PID:9676
- C:\Windows\System\HSrOhrb.exe
  C:\Windows\System\HSrOhrb.exe
  2⤵
  PID:9696
- C:\Windows\System\qrUQyVH.exe
  C:\Windows\System\qrUQyVH.exe
  2⤵
  PID:9716
- C:\Windows\System\GzxDunJ.exe
  C:\Windows\System\GzxDunJ.exe
  2⤵
  PID:9744
- C:\Windows\System\inTkZTG.exe
  C:\Windows\System\inTkZTG.exe
  2⤵
  PID:9768
- C:\Windows\System\XSDOaHW.exe
  C:\Windows\System\XSDOaHW.exe
  2⤵
  PID:9788
- C:\Windows\System\aYGAgGw.exe
  C:\Windows\System\aYGAgGw.exe
  2⤵
  PID:9808
- C:\Windows\System\qoXJybL.exe
  C:\Windows\System\qoXJybL.exe
  2⤵
  PID:9832
- C:\Windows\System\KJxNqkb.exe
  C:\Windows\System\KJxNqkb.exe
  2⤵
  PID:9852
- C:\Windows\System\dZqkxJK.exe
  C:\Windows\System\dZqkxJK.exe
  2⤵
  PID:9876
- C:\Windows\System\ehixlQo.exe
  C:\Windows\System\ehixlQo.exe
  2⤵
  PID:9896
- C:\Windows\System\sYEjXRl.exe
  C:\Windows\System\sYEjXRl.exe
  2⤵
  PID:9916
- C:\Windows\System\ojEBzia.exe
  C:\Windows\System\ojEBzia.exe
  2⤵
  PID:9940
- C:\Windows\System\pIbVhZN.exe
  C:\Windows\System\pIbVhZN.exe
  2⤵
  PID:9964
- C:\Windows\System\SzKBnkq.exe
  C:\Windows\System\SzKBnkq.exe
  2⤵
  PID:9984
- C:\Windows\System\ciBbGUO.exe
  C:\Windows\System\ciBbGUO.exe
  2⤵
  PID:10004
- C:\Windows\System\lYakWKH.exe
  C:\Windows\System\lYakWKH.exe
  2⤵
  PID:10020
- C:\Windows\System\UzsnWXc.exe
  C:\Windows\System\UzsnWXc.exe
  2⤵
  PID:10036
- C:\Windows\System\ILgQlUZ.exe
  C:\Windows\System\ILgQlUZ.exe
  2⤵
  PID:10060
- C:\Windows\System\MVnujSA.exe
  C:\Windows\System\MVnujSA.exe
  2⤵
  PID:10084
- C:\Windows\System\LPlNVDJ.exe
  C:\Windows\System\LPlNVDJ.exe
  2⤵
  PID:10104
- C:\Windows\System\TNUknYO.exe
  C:\Windows\System\TNUknYO.exe
  2⤵
  PID:10120
- C:\Windows\System\aQxZduc.exe
  C:\Windows\System\aQxZduc.exe
  2⤵
  PID:10144
- C:\Windows\System\znfQqRD.exe
  C:\Windows\System\znfQqRD.exe
  2⤵
  PID:10164
- C:\Windows\System\djMlJaj.exe
  C:\Windows\System\djMlJaj.exe
  2⤵
  PID:10188
- C:\Windows\System\kQszRxU.exe
  C:\Windows\System\kQszRxU.exe
  2⤵
  PID:10212
- C:\Windows\System\YjHnple.exe
  C:\Windows\System\YjHnple.exe
  2⤵
  PID:10232
- C:\Windows\System\SHjDQnj.exe
  C:\Windows\System\SHjDQnj.exe
  2⤵
  PID:812
- C:\Windows\System\MWQNeMM.exe
  C:\Windows\System\MWQNeMM.exe
  2⤵
  PID:7896
- C:\Windows\System\ggWvStQ.exe
  C:\Windows\System\ggWvStQ.exe
  2⤵
  PID:8020
- C:\Windows\System\Tnnsadj.exe
  C:\Windows\System\Tnnsadj.exe
  2⤵
  PID:7172
- C:\Windows\System\jMLThvZ.exe
  C:\Windows\System\jMLThvZ.exe
  2⤵
  PID:7248
- C:\Windows\System\UHsTvjQ.exe
  C:\Windows\System\UHsTvjQ.exe
  2⤵
  PID:5792
- C:\Windows\System\eZaqIFo.exe
  C:\Windows\System\eZaqIFo.exe
  2⤵
  PID:6156
- C:\Windows\System\ffpTADj.exe
  C:\Windows\System\ffpTADj.exe
  2⤵
  PID:7336
- C:\Windows\System\DlCkVVe.exe
  C:\Windows\System\DlCkVVe.exe
  2⤵
  PID:8508
- C:\Windows\System\tDwsZTK.exe
  C:\Windows\System\tDwsZTK.exe
  2⤵
  PID:7440
- C:\Windows\System\oOyJGjD.exe
  C:\Windows\System\oOyJGjD.exe
  2⤵
  PID:6088
- C:\Windows\System\pegsFUI.exe
  C:\Windows\System\pegsFUI.exe
  2⤵
  PID:7508
- C:\Windows\System\FHnDFJK.exe
  C:\Windows\System\FHnDFJK.exe
  2⤵
  PID:7552
- C:\Windows\System\JnjvpoF.exe
  C:\Windows\System\JnjvpoF.exe
  2⤵
  PID:6324
- C:\Windows\System\amHAVcI.exe
  C:\Windows\System\amHAVcI.exe
  2⤵
  PID:7488
- C:\Windows\System\uUsteUy.exe
  C:\Windows\System\uUsteUy.exe
  2⤵
  PID:7664
- C:\Windows\System\gGhNkck.exe
  C:\Windows\System\gGhNkck.exe
  2⤵
  PID:7688
- C:\Windows\System\MvgPJtk.exe
  C:\Windows\System\MvgPJtk.exe
  2⤵
  PID:8196
- C:\Windows\System\yFGZYJo.exe
  C:\Windows\System\yFGZYJo.exe
  2⤵
  PID:8224
- C:\Windows\System\tiIYDfm.exe
  C:\Windows\System\tiIYDfm.exe
  2⤵
  PID:7748
- C:\Windows\System\LekTlSK.exe
  C:\Windows\System\LekTlSK.exe
  2⤵
  PID:8708
- C:\Windows\System\EoMtKsd.exe
  C:\Windows\System\EoMtKsd.exe
  2⤵
  PID:8780
- C:\Windows\System\uUftFyI.exe
  C:\Windows\System\uUftFyI.exe
  2⤵
  PID:8840
- C:\Windows\System\xKXXghP.exe
  C:\Windows\System\xKXXghP.exe
  2⤵
  PID:8892
- C:\Windows\System\vRtuxgd.exe
  C:\Windows\System\vRtuxgd.exe
  2⤵
  PID:8936
- C:\Windows\System\djPjWne.exe
  C:\Windows\System\djPjWne.exe
  2⤵
  PID:8976
- C:\Windows\System\LdZNOpo.exe
  C:\Windows\System\LdZNOpo.exe
  2⤵
  PID:9080
- C:\Windows\System\mFdXsLR.exe
  C:\Windows\System\mFdXsLR.exe
  2⤵
  PID:9116
- C:\Windows\System\zRCziCn.exe
  C:\Windows\System\zRCziCn.exe
  2⤵
  PID:6632
- C:\Windows\System\VWFIlIk.exe
  C:\Windows\System\VWFIlIk.exe
  2⤵
  PID:10248
- C:\Windows\System\kTIeeHU.exe
  C:\Windows\System\kTIeeHU.exe
  2⤵
  PID:10276
- C:\Windows\System\QziOXFx.exe
  C:\Windows\System\QziOXFx.exe
  2⤵
  PID:10292
- C:\Windows\System\CMIsOma.exe
  C:\Windows\System\CMIsOma.exe
  2⤵
  PID:10316
- C:\Windows\System\hGAEDDg.exe
  C:\Windows\System\hGAEDDg.exe
  2⤵
  PID:10340
- C:\Windows\System\lhEMPQc.exe
  C:\Windows\System\lhEMPQc.exe
  2⤵
  PID:10356
- C:\Windows\System\iasaSXJ.exe
  C:\Windows\System\iasaSXJ.exe
  2⤵
  PID:10372
- C:\Windows\System\ntaqyas.exe
  C:\Windows\System\ntaqyas.exe
  2⤵
  PID:10392
- C:\Windows\System\jLarxKd.exe
  C:\Windows\System\jLarxKd.exe
  2⤵
  PID:10412
- C:\Windows\System\SrbooiF.exe
  C:\Windows\System\SrbooiF.exe
  2⤵
  PID:10444
- C:\Windows\System\QIFaTuJ.exe
  C:\Windows\System\QIFaTuJ.exe
  2⤵
  PID:10468
- C:\Windows\System\AuPcjMt.exe
  C:\Windows\System\AuPcjMt.exe
  2⤵
  PID:10484
- C:\Windows\System\jQMTrdQ.exe
  C:\Windows\System\jQMTrdQ.exe
  2⤵
  PID:10508
- C:\Windows\System\agPdwio.exe
  C:\Windows\System\agPdwio.exe
  2⤵
  PID:10536
- C:\Windows\System\eWgUiLJ.exe
  C:\Windows\System\eWgUiLJ.exe
  2⤵
  PID:10552
- C:\Windows\System\uZJlzul.exe
  C:\Windows\System\uZJlzul.exe
  2⤵
  PID:10572
- C:\Windows\System\xUJMOZa.exe
  C:\Windows\System\xUJMOZa.exe
  2⤵
  PID:10592
- C:\Windows\System\UDcMpgl.exe
  C:\Windows\System\UDcMpgl.exe
  2⤵
  PID:10616
- C:\Windows\System\osklQwy.exe
  C:\Windows\System\osklQwy.exe
  2⤵
  PID:10644
- C:\Windows\System\JwOTRIs.exe
  C:\Windows\System\JwOTRIs.exe
  2⤵
  PID:10664
- C:\Windows\System\MBctBKA.exe
  C:\Windows\System\MBctBKA.exe
  2⤵
  PID:10688
- C:\Windows\System\WQJmmjd.exe
  C:\Windows\System\WQJmmjd.exe
  2⤵
  PID:10708
- C:\Windows\System\OfvvOPt.exe
  C:\Windows\System\OfvvOPt.exe
  2⤵
  PID:10732
- C:\Windows\System\pzzfwkY.exe
  C:\Windows\System\pzzfwkY.exe
  2⤵
  PID:10748
- C:\Windows\System\IUHSGQi.exe
  C:\Windows\System\IUHSGQi.exe
  2⤵
  PID:10772
- C:\Windows\System\gdeWcue.exe
  C:\Windows\System\gdeWcue.exe
  2⤵
  PID:10792
- C:\Windows\System\UIQKPGs.exe
  C:\Windows\System\UIQKPGs.exe
  2⤵
  PID:10808
- C:\Windows\System\MoOLctf.exe
  C:\Windows\System\MoOLctf.exe
  2⤵
  PID:10824
- C:\Windows\System\LJdltCG.exe
  C:\Windows\System\LJdltCG.exe
  2⤵
  PID:10840
- C:\Windows\System\iAggDKr.exe
  C:\Windows\System\iAggDKr.exe
  2⤵
  PID:10860
- C:\Windows\System\zrRImZp.exe
  C:\Windows\System\zrRImZp.exe
  2⤵
  PID:10880
- C:\Windows\System\CocwUtW.exe
  C:\Windows\System\CocwUtW.exe
  2⤵
  PID:10904
- C:\Windows\System\OSFnJkl.exe
  C:\Windows\System\OSFnJkl.exe
  2⤵
  PID:10924
- C:\Windows\System\PuayMZO.exe
  C:\Windows\System\PuayMZO.exe
  2⤵
  PID:10956
- C:\Windows\System\gyveEgn.exe
  C:\Windows\System\gyveEgn.exe
  2⤵
  PID:10976
- C:\Windows\System\hwUYZZj.exe
  C:\Windows\System\hwUYZZj.exe
  2⤵
  PID:11000
- C:\Windows\System\gSRbbWF.exe
  C:\Windows\System\gSRbbWF.exe
  2⤵
  PID:11028
- C:\Windows\System\sczMpDJ.exe
  C:\Windows\System\sczMpDJ.exe
  2⤵
  PID:11044
- C:\Windows\System\ffEKIkx.exe
  C:\Windows\System\ffEKIkx.exe
  2⤵
  PID:11068
- C:\Windows\System\zaRzOYp.exe
  C:\Windows\System\zaRzOYp.exe
  2⤵
  PID:11088
- C:\Windows\System\ldXGRoU.exe
  C:\Windows\System\ldXGRoU.exe
  2⤵
  PID:11116
- C:\Windows\System\tvrOEEo.exe
  C:\Windows\System\tvrOEEo.exe
  2⤵
  PID:11136
- C:\Windows\System\oCaCNDp.exe
  C:\Windows\System\oCaCNDp.exe
  2⤵
  PID:11160
- C:\Windows\System\CTUPgki.exe
  C:\Windows\System\CTUPgki.exe
  2⤵
  PID:11180
- C:\Windows\System\KJvPBvw.exe
  C:\Windows\System\KJvPBvw.exe
  2⤵
  PID:11200
- C:\Windows\System\QUgXGUg.exe
  C:\Windows\System\QUgXGUg.exe
  2⤵
  PID:11220
- C:\Windows\System\BkaRDFT.exe
  C:\Windows\System\BkaRDFT.exe
  2⤵
  PID:11248
- C:\Windows\System\dKBJKMt.exe
  C:\Windows\System\dKBJKMt.exe
  2⤵
  PID:6448
- C:\Windows\System\dVPUayp.exe
  C:\Windows\System\dVPUayp.exe
  2⤵
  PID:6828
- C:\Windows\System\LKjcMxv.exe
  C:\Windows\System\LKjcMxv.exe
  2⤵
  PID:1820
- C:\Windows\System\lszxYRv.exe
  C:\Windows\System\lszxYRv.exe
  2⤵
  PID:4484
- C:\Windows\System\HHBpAuL.exe
  C:\Windows\System\HHBpAuL.exe
  2⤵
  PID:9264
- C:\Windows\System\vAAoToG.exe
  C:\Windows\System\vAAoToG.exe
  2⤵
  PID:3448
- C:\Windows\System\SkMTyLE.exe
  C:\Windows\System\SkMTyLE.exe
  2⤵
  PID:9448
- C:\Windows\System\MgDDZgM.exe
  C:\Windows\System\MgDDZgM.exe
  2⤵
  PID:8332
- C:\Windows\System\ZUMKNXD.exe
  C:\Windows\System\ZUMKNXD.exe
  2⤵
  PID:8352
- C:\Windows\System\dGMoCqD.exe
  C:\Windows\System\dGMoCqD.exe
  2⤵
  PID:7848
- C:\Windows\System\CWBFhfP.exe
  C:\Windows\System\CWBFhfP.exe
  2⤵
  PID:9644
- C:\Windows\System\IqXeDWq.exe
  C:\Windows\System\IqXeDWq.exe
  2⤵
  PID:7940
- C:\Windows\System\rAhybwG.exe
  C:\Windows\System\rAhybwG.exe
  2⤵
  PID:8044
- C:\Windows\System\SOJeDMF.exe
  C:\Windows\System\SOJeDMF.exe
  2⤵
  PID:8144
- C:\Windows\System\PhuUpon.exe
  C:\Windows\System\PhuUpon.exe
  2⤵
  PID:8116
- C:\Windows\System\zodNWGn.exe
  C:\Windows\System\zodNWGn.exe
  2⤵
  PID:8476
- C:\Windows\System\pcmsAej.exe
  C:\Windows\System\pcmsAej.exe
  2⤵
  PID:5312
- C:\Windows\System\Nhnktqk.exe
  C:\Windows\System\Nhnktqk.exe
  2⤵
  PID:9924
- C:\Windows\System\dHdpbuS.exe
  C:\Windows\System\dHdpbuS.exe
  2⤵
  PID:10016
- C:\Windows\System\BeHYQuZ.exe
  C:\Windows\System\BeHYQuZ.exe
  2⤵
  PID:10056
- C:\Windows\System\TPzWybZ.exe
  C:\Windows\System\TPzWybZ.exe
  2⤵
  PID:10080
- C:\Windows\System\oOkAYxG.exe
  C:\Windows\System\oOkAYxG.exe
  2⤵
  PID:7056
- C:\Windows\System\AfMSCzm.exe
  C:\Windows\System\AfMSCzm.exe
  2⤵
  PID:10160
- C:\Windows\System\MjAULBj.exe
  C:\Windows\System\MjAULBj.exe
  2⤵
  PID:8244
- C:\Windows\System\MYKBUZC.exe
  C:\Windows\System\MYKBUZC.exe
  2⤵
  PID:8328
- C:\Windows\System\OLonuSU.exe
  C:\Windows\System\OLonuSU.exe
  2⤵
  PID:8100
- C:\Windows\System\yYlqgpr.exe
  C:\Windows\System\yYlqgpr.exe
  2⤵
  PID:8660
- C:\Windows\System\ziauxKQ.exe
  C:\Windows\System\ziauxKQ.exe
  2⤵
  PID:8760
- C:\Windows\System\XQqCrcn.exe
  C:\Windows\System\XQqCrcn.exe
  2⤵
  PID:7708
- C:\Windows\System\RjIhMyU.exe
  C:\Windows\System\RjIhMyU.exe
  2⤵
  PID:11280
- C:\Windows\System\DnZfrFb.exe
  C:\Windows\System\DnZfrFb.exe
  2⤵
  PID:11304
- C:\Windows\System\eUTkNOt.exe
  C:\Windows\System\eUTkNOt.exe
  2⤵
  PID:11324
- C:\Windows\System\JDDrIBp.exe
  C:\Windows\System\JDDrIBp.exe
  2⤵
  PID:11340
- C:\Windows\System\piObBrr.exe
  C:\Windows\System\piObBrr.exe
  2⤵
  PID:11360
- C:\Windows\System\DxUVfNo.exe
  C:\Windows\System\DxUVfNo.exe
  2⤵
  PID:11388
- C:\Windows\System\EZlkQzF.exe
  C:\Windows\System\EZlkQzF.exe
  2⤵
  PID:11408
- C:\Windows\System\mbOPcdS.exe
  C:\Windows\System\mbOPcdS.exe
  2⤵
  PID:11428
- C:\Windows\System\hdTUTon.exe
  C:\Windows\System\hdTUTon.exe
  2⤵
  PID:11452
- C:\Windows\System\BNOxkcJ.exe
  C:\Windows\System\BNOxkcJ.exe
  2⤵
  PID:11472
- C:\Windows\System\rmxTQrE.exe
  C:\Windows\System\rmxTQrE.exe
  2⤵
  PID:11492
- C:\Windows\System\nBgVnzD.exe
  C:\Windows\System\nBgVnzD.exe
  2⤵
  PID:11512
- C:\Windows\System\nxmtBlk.exe
  C:\Windows\System\nxmtBlk.exe
  2⤵
  PID:11536
- C:\Windows\System\UjQYQML.exe
  C:\Windows\System\UjQYQML.exe
  2⤵
  PID:11556
- C:\Windows\System\qDriOzI.exe
  C:\Windows\System\qDriOzI.exe
  2⤵
  PID:11572
- C:\Windows\System\EPqpHiG.exe
  C:\Windows\System\EPqpHiG.exe
  2⤵
  PID:11588
- C:\Windows\System\NBVUQlE.exe
  C:\Windows\System\NBVUQlE.exe
  2⤵
  PID:11604
- C:\Windows\System\SxaTTbI.exe
  C:\Windows\System\SxaTTbI.exe
  2⤵
  PID:11624
- C:\Windows\System\ctpcxQR.exe
  C:\Windows\System\ctpcxQR.exe
  2⤵
  PID:11644
- C:\Windows\System\zPQmqtj.exe
  C:\Windows\System\zPQmqtj.exe
  2⤵
  PID:11668
- C:\Windows\System\LBPnHnH.exe
  C:\Windows\System\LBPnHnH.exe
  2⤵
  PID:11688
- C:\Windows\System\WHuSoyz.exe
  C:\Windows\System\WHuSoyz.exe
  2⤵
  PID:11712
- C:\Windows\System\uKZjwni.exe
  C:\Windows\System\uKZjwni.exe
  2⤵
  PID:11732
- C:\Windows\System\shGxpQR.exe
  C:\Windows\System\shGxpQR.exe
  2⤵
  PID:11752
- C:\Windows\System\KBFUcEv.exe
  C:\Windows\System\KBFUcEv.exe
  2⤵
  PID:11772
- C:\Windows\System\FqHDLqf.exe
  C:\Windows\System\FqHDLqf.exe
  2⤵
  PID:11792
- C:\Windows\System\YyCwMlq.exe
  C:\Windows\System\YyCwMlq.exe
  2⤵
  PID:11816
- C:\Windows\System\ZpTRmtq.exe
  C:\Windows\System\ZpTRmtq.exe
  2⤵
  PID:11836
- C:\Windows\System\Wwwaczr.exe
  C:\Windows\System\Wwwaczr.exe
  2⤵
  PID:11856
- C:\Windows\System\IkJzehe.exe
  C:\Windows\System\IkJzehe.exe
  2⤵
  PID:11880
- C:\Windows\System\GnOwjDp.exe
  C:\Windows\System\GnOwjDp.exe
  2⤵
  PID:11896
- C:\Windows\System\ZIYfAIe.exe
  C:\Windows\System\ZIYfAIe.exe
  2⤵
  PID:11916
- C:\Windows\System\yIQEgiO.exe
  C:\Windows\System\yIQEgiO.exe
  2⤵
  PID:11940
- C:\Windows\System\iAoxPBq.exe
  C:\Windows\System\iAoxPBq.exe
  2⤵
  PID:11960
- C:\Windows\System\xRCrYQZ.exe
  C:\Windows\System\xRCrYQZ.exe
  2⤵
  PID:11980
- C:\Windows\System\vPCEzTF.exe
  C:\Windows\System\vPCEzTF.exe
  2⤵
  PID:12000
- C:\Windows\System\FzsJWcI.exe
  C:\Windows\System\FzsJWcI.exe
  2⤵
  PID:12020
- C:\Windows\System\klVFJhR.exe
  C:\Windows\System\klVFJhR.exe
  2⤵
  PID:12044
- C:\Windows\System\mqenthc.exe
  C:\Windows\System\mqenthc.exe
  2⤵
  PID:12064
- C:\Windows\System\iMrynSw.exe
  C:\Windows\System\iMrynSw.exe
  2⤵
  PID:12084
- C:\Windows\System\YDHJVjW.exe
  C:\Windows\System\YDHJVjW.exe
  2⤵
  PID:12108
- C:\Windows\System\owIAkkR.exe
  C:\Windows\System\owIAkkR.exe
  2⤵
  PID:12124
- C:\Windows\System\zVsqiLG.exe
  C:\Windows\System\zVsqiLG.exe
  2⤵
  PID:12152
- C:\Windows\System\MHfTtso.exe
  C:\Windows\System\MHfTtso.exe
  2⤵
  PID:12168
- C:\Windows\System\qgpPUBB.exe
  C:\Windows\System\qgpPUBB.exe
  2⤵
  PID:12192
- C:\Windows\System\ioIWexe.exe
  C:\Windows\System\ioIWexe.exe
  2⤵
  PID:12216
- C:\Windows\System\yHSgSfn.exe
  C:\Windows\System\yHSgSfn.exe
  2⤵
  PID:12232
- C:\Windows\System\fDWqUSG.exe
  C:\Windows\System\fDWqUSG.exe
  2⤵
  PID:12252
- C:\Windows\System\ZnmUlBu.exe
  C:\Windows\System\ZnmUlBu.exe
  2⤵
  PID:12272
- C:\Windows\System\FSqWzGf.exe
  C:\Windows\System\FSqWzGf.exe
  2⤵
  PID:8820
- C:\Windows\System\IqujCHJ.exe
  C:\Windows\System\IqujCHJ.exe
  2⤵
  PID:8920
- C:\Windows\System\dqWAKWZ.exe
  C:\Windows\System\dqWAKWZ.exe
  2⤵
  PID:8952
- C:\Windows\System\CAhCNPL.exe
  C:\Windows\System\CAhCNPL.exe
  2⤵
  PID:5648
- C:\Windows\System\WmbibGW.exe
  C:\Windows\System\WmbibGW.exe
  2⤵
  PID:9112
- C:\Windows\System\zwUZGKL.exe
  C:\Windows\System\zwUZGKL.exe
  2⤵
  PID:10256
- C:\Windows\System\waDzRlb.exe
  C:\Windows\System\waDzRlb.exe
  2⤵
  PID:6956
- C:\Windows\System\OnUaNjk.exe
  C:\Windows\System\OnUaNjk.exe
  2⤵
  PID:7160
- C:\Windows\System\tgPOhVA.exe
  C:\Windows\System\tgPOhVA.exe
  2⤵
  PID:9280
- C:\Windows\System\roMnGUI.exe
  C:\Windows\System\roMnGUI.exe
  2⤵
  PID:9392
- C:\Windows\System\zNFPrMS.exe
  C:\Windows\System\zNFPrMS.exe
  2⤵
  PID:10544
- C:\Windows\System\lrvTokn.exe
  C:\Windows\System\lrvTokn.exe
  2⤵
  PID:1928
- C:\Windows\System\FNHBTrH.exe
  C:\Windows\System\FNHBTrH.exe
  2⤵
  PID:8368
- C:\Windows\System\VKlyDek.exe
  C:\Windows\System\VKlyDek.exe
  2⤵
  PID:9608
- C:\Windows\System\qxGYxtA.exe
  C:\Windows\System\qxGYxtA.exe
  2⤵
  PID:10832
- C:\Windows\System\hXXCKXF.exe
  C:\Windows\System\hXXCKXF.exe
  2⤵
  PID:8448
- C:\Windows\System\GMnMpMz.exe
  C:\Windows\System\GMnMpMz.exe
  2⤵
  PID:10916
- C:\Windows\System\ShPcPmN.exe
  C:\Windows\System\ShPcPmN.exe
  2⤵
  PID:11040
- C:\Windows\System\aPXUmkN.exe
  C:\Windows\System\aPXUmkN.exe
  2⤵
  PID:12296
- C:\Windows\System\dQsONmI.exe
  C:\Windows\System\dQsONmI.exe
  2⤵
  PID:12316
- C:\Windows\System\mOkKDTF.exe
  C:\Windows\System\mOkKDTF.exe
  2⤵
  PID:12332
- C:\Windows\System\rTJJclo.exe
  C:\Windows\System\rTJJclo.exe
  2⤵
  PID:12352
- C:\Windows\System\HWCZJoL.exe
  C:\Windows\System\HWCZJoL.exe
  2⤵
  PID:12372
- C:\Windows\System\hPCKVHT.exe
  C:\Windows\System\hPCKVHT.exe
  2⤵
  PID:12392
- C:\Windows\System\qgyDeFX.exe
  C:\Windows\System\qgyDeFX.exe
  2⤵
  PID:12416
- C:\Windows\System\oZIzMNR.exe
  C:\Windows\System\oZIzMNR.exe
  2⤵
  PID:12440
- C:\Windows\System\sFpFpWi.exe
  C:\Windows\System\sFpFpWi.exe
  2⤵
  PID:12464
- C:\Windows\System\uxtlnrm.exe
  C:\Windows\System\uxtlnrm.exe
  2⤵
  PID:12488
- C:\Windows\System\thEIDGr.exe
  C:\Windows\System\thEIDGr.exe
  2⤵
  PID:12508
- C:\Windows\System\qnSddnJ.exe
  C:\Windows\System\qnSddnJ.exe
  2⤵
  PID:12528
- C:\Windows\System\cxcoQwP.exe
  C:\Windows\System\cxcoQwP.exe
  2⤵
  PID:12548
- C:\Windows\System\FDLdAMT.exe
  C:\Windows\System\FDLdAMT.exe
  2⤵
  PID:12564
- C:\Windows\System\VHQwwbr.exe
  C:\Windows\System\VHQwwbr.exe
  2⤵
  PID:12580
- C:\Windows\System\lLjBOWI.exe
  C:\Windows\System\lLjBOWI.exe
  2⤵
  PID:12596
- C:\Windows\System\bLASAxV.exe
  C:\Windows\System\bLASAxV.exe
  2⤵
  PID:12612
- C:\Windows\System\cUaWHYP.exe
  C:\Windows\System\cUaWHYP.exe
  2⤵
  PID:12628
- C:\Windows\System\NdjXbBr.exe
  C:\Windows\System\NdjXbBr.exe
  2⤵
  PID:12648
- C:\Windows\System\isjPjJu.exe
  C:\Windows\System\isjPjJu.exe
  2⤵
  PID:12672
- C:\Windows\System\LOYkPRj.exe
  C:\Windows\System\LOYkPRj.exe
  2⤵
  PID:12692
- C:\Windows\System\PJVbyaW.exe
  C:\Windows\System\PJVbyaW.exe
  2⤵
  PID:12712
- C:\Windows\System\xRxlufy.exe
  C:\Windows\System\xRxlufy.exe
  2⤵
  PID:12732
- C:\Windows\System\dJuDqjH.exe
  C:\Windows\System\dJuDqjH.exe
  2⤵
  PID:12752
- C:\Windows\System\Ojbnbuw.exe
  C:\Windows\System\Ojbnbuw.exe
  2⤵
  PID:12772
- C:\Windows\System\bOVTSkZ.exe
  C:\Windows\System\bOVTSkZ.exe
  2⤵
  PID:12796
- C:\Windows\System\PYstmzA.exe
  C:\Windows\System\PYstmzA.exe
  2⤵
  PID:12816
- C:\Windows\System\zyBcxXt.exe
  C:\Windows\System\zyBcxXt.exe
  2⤵
  PID:12844
- C:\Windows\System\IaMgjiZ.exe
  C:\Windows\System\IaMgjiZ.exe
  2⤵
  PID:12864
- C:\Windows\System\LNwocsC.exe
  C:\Windows\System\LNwocsC.exe
  2⤵
  PID:12888
- C:\Windows\System\mmQRbeh.exe
  C:\Windows\System\mmQRbeh.exe
  2⤵
  PID:12904
- C:\Windows\System\hKvSfNK.exe
  C:\Windows\System\hKvSfNK.exe
  2⤵
  PID:12920
- C:\Windows\System\nOqPkZG.exe
  C:\Windows\System\nOqPkZG.exe
  2⤵
  PID:12940
- C:\Windows\System\RJDvUJH.exe
  C:\Windows\System\RJDvUJH.exe
  2⤵
  PID:12960
- C:\Windows\System\dIsjYqy.exe
  C:\Windows\System\dIsjYqy.exe
  2⤵
  PID:12984
- C:\Windows\System\mFfXXaG.exe
  C:\Windows\System\mFfXXaG.exe
  2⤵
  PID:13004
- C:\Windows\System\FACvTPp.exe
  C:\Windows\System\FACvTPp.exe
  2⤵
  PID:13024
- C:\Windows\System\bQtIfdO.exe
  C:\Windows\System\bQtIfdO.exe
  2⤵
  PID:13044
- C:\Windows\System\YFQYGFg.exe
  C:\Windows\System\YFQYGFg.exe
  2⤵
  PID:13072
- C:\Windows\System\SJSThAM.exe
  C:\Windows\System\SJSThAM.exe
  2⤵
  PID:13092
- C:\Windows\System\mrJvmRu.exe
  C:\Windows\System\mrJvmRu.exe
  2⤵
  PID:13120
- C:\Windows\System\rqrWcuG.exe
  C:\Windows\System\rqrWcuG.exe
  2⤵
  PID:13144
- C:\Windows\System\LOUUOUb.exe
  C:\Windows\System\LOUUOUb.exe
  2⤵
  PID:13164
- C:\Windows\System\hHXslkc.exe
  C:\Windows\System\hHXslkc.exe
  2⤵
  PID:13188
- C:\Windows\System\TBszylt.exe
  C:\Windows\System\TBszylt.exe
  2⤵
  PID:13212
- C:\Windows\System\WNuUKao.exe
  C:\Windows\System\WNuUKao.exe
  2⤵
  PID:13232
- C:\Windows\System\YFVaGts.exe
  C:\Windows\System\YFVaGts.exe
  2⤵
  PID:13252
- C:\Windows\System\lkoihJG.exe
  C:\Windows\System\lkoihJG.exe
  2⤵
  PID:13268
- C:\Windows\System\wNRqkKX.exe
  C:\Windows\System\wNRqkKX.exe
  2⤵
  PID:13292
- C:\Windows\System\fqlUiQh.exe
  C:\Windows\System\fqlUiQh.exe
  2⤵
  PID:9932
- C:\Windows\System\fqCyQLa.exe
  C:\Windows\System\fqCyQLa.exe
  2⤵
  PID:9976
- C:\Windows\System\YWjcgTd.exe
  C:\Windows\System\YWjcgTd.exe
  2⤵
  PID:10012
- C:\Windows\System\tgBSGQV.exe
  C:\Windows\System\tgBSGQV.exe
  2⤵
  PID:11216
- C:\Windows\System\dCLbPQo.exe
  C:\Windows\System\dCLbPQo.exe
  2⤵
  PID:6368
- C:\Windows\System\fqCGsWM.exe
  C:\Windows\System\fqCGsWM.exe
  2⤵
  PID:9260
- C:\Windows\System\KcXWkqL.exe
  C:\Windows\System\KcXWkqL.exe
  2⤵
  PID:10184
- C:\Windows\System\ZvroSLC.exe
  C:\Windows\System\ZvroSLC.exe
  2⤵
  PID:9436
- C:\Windows\System\pHDwxTM.exe
  C:\Windows\System\pHDwxTM.exe
  2⤵
  PID:8376
- C:\Windows\System\YdjxtiO.exe
  C:\Windows\System\YdjxtiO.exe
  2⤵
  PID:8084
- C:\Windows\System\hEIIFuh.exe
  C:\Windows\System\hEIIFuh.exe
  2⤵
  PID:7252
- C:\Windows\System\dKXDBjp.exe
  C:\Windows\System\dKXDBjp.exe
  2⤵
  PID:9892
- C:\Windows\System\oBRVDfn.exe
  C:\Windows\System\oBRVDfn.exe
  2⤵
  PID:7316
- C:\Windows\System\zqIHgGd.exe
  C:\Windows\System\zqIHgGd.exe
  2⤵
  PID:10032
- C:\Windows\System\qJhRjPr.exe
  C:\Windows\System\qJhRjPr.exe
  2⤵
  PID:7016
- C:\Windows\System\NVrYPGP.exe
  C:\Windows\System\NVrYPGP.exe
  2⤵
  PID:8220
- C:\Windows\System\hxzngsk.exe
  C:\Windows\System\hxzngsk.exe
  2⤵
  PID:8668
- C:\Windows\System\hDBcdfS.exe
  C:\Windows\System\hDBcdfS.exe
  2⤵
  PID:11276
- C:\Windows\System\DrgdTjB.exe
  C:\Windows\System\DrgdTjB.exe
  2⤵
  PID:9048
- C:\Windows\System\EAouxkf.exe
  C:\Windows\System\EAouxkf.exe
  2⤵
  PID:8836
- C:\Windows\System\PqESsBI.exe
  C:\Windows\System\PqESsBI.exe
  2⤵
  PID:8880
- C:\Windows\System\KMiMUqa.exe
  C:\Windows\System\KMiMUqa.exe
  2⤵
  PID:3556
- C:\Windows\System\xvcniRe.exe
  C:\Windows\System\xvcniRe.exe
  2⤵
  PID:13320
- C:\Windows\System\HSdVglr.exe
  C:\Windows\System\HSdVglr.exe
  2⤵
  PID:13340
- C:\Windows\System\SxSFyzS.exe
  C:\Windows\System\SxSFyzS.exe
  2⤵
  PID:13360
- C:\Windows\System\BCZnQzy.exe
  C:\Windows\System\BCZnQzy.exe
  2⤵
  PID:13384
- C:\Windows\System\ZtnqMAw.exe
  C:\Windows\System\ZtnqMAw.exe
  2⤵
  PID:13408
- C:\Windows\System\AHGXMAf.exe
  C:\Windows\System\AHGXMAf.exe
  2⤵
  PID:13424
- C:\Windows\System\rmVVoDU.exe
  C:\Windows\System\rmVVoDU.exe
  2⤵
  PID:13440
- C:\Windows\System\CHpwFfX.exe
  C:\Windows\System\CHpwFfX.exe
  2⤵
  PID:13456
- C:\Windows\System\CtZKGZy.exe
  C:\Windows\System\CtZKGZy.exe
  2⤵
  PID:13472
- C:\Windows\System\ApeiPkX.exe
  C:\Windows\System\ApeiPkX.exe
  2⤵
  PID:13488
- C:\Windows\System\xaerZnn.exe
  C:\Windows\System\xaerZnn.exe
  2⤵
  PID:13512
- C:\Windows\System\ctQYfpu.exe
  C:\Windows\System\ctQYfpu.exe
  2⤵
  PID:13536
- C:\Windows\System\sjIKDXs.exe
  C:\Windows\System\sjIKDXs.exe
  2⤵
  PID:13556
- C:\Windows\System\DCwWrTc.exe
  C:\Windows\System\DCwWrTc.exe
  2⤵
  PID:13576
- C:\Windows\System\pybprDa.exe
  C:\Windows\System\pybprDa.exe
  2⤵
  PID:13604
- C:\Windows\System\rqTtFpu.exe
  C:\Windows\System\rqTtFpu.exe
  2⤵
  PID:13624
- C:\Windows\System\WfGXnTu.exe
  C:\Windows\System\WfGXnTu.exe
  2⤵
  PID:13968
- C:\Windows\System\gOrTvvY.exe
  C:\Windows\System\gOrTvvY.exe
  2⤵
  PID:13984
- C:\Windows\System\tzMYCWu.exe
  C:\Windows\System\tzMYCWu.exe
  2⤵
  PID:14004
- C:\Windows\System\jkovADF.exe
  C:\Windows\System\jkovADF.exe
  2⤵
  PID:14028
- C:\Windows\System\ivXrXSv.exe
  C:\Windows\System\ivXrXSv.exe
  2⤵
  PID:14044
- C:\Windows\System\DreNwlT.exe
  C:\Windows\System\DreNwlT.exe
  2⤵
  PID:14060
- C:\Windows\System\DIELAbC.exe
  C:\Windows\System\DIELAbC.exe
  2⤵
  PID:14088
- C:\Windows\System\NFuXYyJ.exe
  C:\Windows\System\NFuXYyJ.exe
  2⤵
  PID:14104
- C:\Windows\System\NjVukoe.exe
  C:\Windows\System\NjVukoe.exe
  2⤵
  PID:14128
- C:\Windows\System\dnpgqPY.exe
  C:\Windows\System\dnpgqPY.exe
  2⤵
  PID:14148
- C:\Windows\System\tCDNfHo.exe
  C:\Windows\System\tCDNfHo.exe
  2⤵
  PID:14164
- C:\Windows\System\qjsGBty.exe
  C:\Windows\System\qjsGBty.exe
  2⤵
  PID:14184
- C:\Windows\System\PCsyhiq.exe
  C:\Windows\System\PCsyhiq.exe
  2⤵
  PID:14204
- C:\Windows\System\poaZGul.exe
  C:\Windows\System\poaZGul.exe
  2⤵
  PID:14228
- C:\Windows\System\YuuNCbI.exe
  C:\Windows\System\YuuNCbI.exe
  2⤵
  PID:14248
- C:\Windows\System\PRniIZT.exe
  C:\Windows\System\PRniIZT.exe
  2⤵
  PID:14268
- C:\Windows\System\hZUIePc.exe
  C:\Windows\System\hZUIePc.exe
  2⤵
  PID:14292
- C:\Windows\System\CGHuHVO.exe
  C:\Windows\System\CGHuHVO.exe
  2⤵
  PID:14312
- C:\Windows\System\BUOzDpu.exe
  C:\Windows\System\BUOzDpu.exe
  2⤵
  PID:11564
- C:\Windows\System\vzeeQis.exe
  C:\Windows\System\vzeeQis.exe
  2⤵
  PID:6608
- C:\Windows\System\TfQHgwf.exe
  C:\Windows\System\TfQHgwf.exe
  2⤵
  PID:11728
- C:\Windows\System\DrjICOP.exe
  C:\Windows\System\DrjICOP.exe
  2⤵
  PID:11764
- C:\Windows\System\RFZQEyz.exe
  C:\Windows\System\RFZQEyz.exe
  2⤵
  PID:7104
- C:\Windows\System\KuwydLq.exe
  C:\Windows\System\KuwydLq.exe
  2⤵
  PID:9244
- C:\Windows\System\TFzmRFW.exe
  C:\Windows\System\TFzmRFW.exe
  2⤵
  PID:9328
- C:\Windows\System\QaLmzhS.exe
  C:\Windows\System\QaLmzhS.exe
  2⤵
  PID:12080
- C:\Windows\System\IVCLJkq.exe
  C:\Windows\System\IVCLJkq.exe
  2⤵
  PID:10568
- C:\Windows\System\wEmUEWd.exe
  C:\Windows\System\wEmUEWd.exe
  2⤵
  PID:12148
- C:\Windows\System\TDOOGzl.exe
  C:\Windows\System\TDOOGzl.exe
  2⤵
  PID:9564
- C:\Windows\System\rSPFdKt.exe
  C:\Windows\System\rSPFdKt.exe
  2⤵
  PID:10672
- C:\Windows\System\faJacdF.exe
  C:\Windows\System\faJacdF.exe
  2⤵
  PID:10704
- C:\Windows\System\MdnDfrF.exe
  C:\Windows\System\MdnDfrF.exe
  2⤵
  PID:8916
- C:\Windows\System\ZgSWrkj.exe
  C:\Windows\System\ZgSWrkj.exe
  2⤵
  PID:10612
- C:\Windows\System\YvgzQVg.exe
  C:\Windows\System\YvgzQVg.exe
  2⤵
  PID:9728

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 2d5bdbb0428f6659b8406ae0a10d0be4 fWDJPvVxJUmrijlCF02HsA.0.1.0.0.0
1⤵
PID:8616
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:8884

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:6324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AiGZrzP.exe

Path C:\Windows\System\AiGZrzP.exe
Size 1.5MB
SHA256 51ceb7969846d597570feeb9f82d41b9ff4dad8ef9118915ae944b459822d02e
MD5 4c5369de48f66322aa7f0b8e05ea0373
SHA1 9492f5633222ca0477f84ec675ac9ed326ba1c9d
SHA512 aaed116adfd252844dac7271519850275ce8049e82b6922c4510fe5d13c9ffd3d2755a378dec9b638bc370f72871a26d1380630a4797a6b66b68ead9fbc04f53
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fF:ROdWCCi7/rahwNUMuikLCiJCF+QliR
MD5 SHA1 SHA512 SSDEEP

Submit Download

HsxPXYp.exe

Path C:\Windows\System\HsxPXYp.exe
Size 1.5MB
SHA256 b587e19d99664091b1428fa36bba31ddaae185a96b01a1e81b89c54d13cb3cea
MD5 5a049fce8b52592ed141c05c1215b6d1
SHA1 4473ce1f0906341e15e8de1a61bbebae09956068
SHA512 2a0f2feece7840cf83e6259851415bef3c6a36120d2f18c0322f0db3b8c03c5610b4f89a8c35de8fe11b5f111d12330673f0ea560c25242aaf9e4b6588faa226
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fW:ROdWCCi7/rahwNUMuikLCiJCF+QliS
MD5 SHA1 SHA512 SSDEEP

Submit Download

IOQqmaf.exe

Path C:\Windows\System\IOQqmaf.exe
Size 1.5MB
SHA256 e8b73c8e6f62530ab657992dfcc146c7aaa3ca9b7683f701632f3d56a224b1ee
MD5 3b69155f21034729026159c604b26b40
SHA1 118a16036fb853e0a76f3c6d5df1ce59ac9602af
SHA512 f92ce194f7e7bcecb94232ecce43e929c76b9a3fb4d9e318452aee1fd570ec7a5deb8293a9536e271a86cb6bed261c7178fc1d4016e29d492edab5da5e4f1bef
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fa:ROdWCCi7/rahwNUMuikLCiJCF+QliW
MD5 SHA1 SHA512 SSDEEP

Submit Download

JyZyLUO.exe

Path C:\Windows\System\JyZyLUO.exe
Size 1.5MB
SHA256 84a3b1e0a5a91d245127bbbd6d5c6645d65169b6ffc98f472d0f973bb1ba92dd
MD5 fb6eac13c7918037e55187d39ac0d00a
SHA1 78de73b83833876679d0cf63ee4862cfa2f1a586
SHA512 96c9479940a0755ee274c2c1cbfbfaa78853ac810a28e3f429953a158bb0678b91efd409fb65c7ff64365f0c54ef27e552afac825a0e7c1695cf53f6420f6ae9
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fM:ROdWCCi7/rahwNUMuikLCiJCF+QliI
MD5 SHA1 SHA512 SSDEEP

Submit Download

KCmQMEj.exe

Path C:\Windows\System\KCmQMEj.exe
Size 1.5MB
SHA256 3b1ae9739ad715d31ffe93aa03aa4d5f8a7fdd947fc1ce7eb303cd9dc1845b5a
MD5 c3b152619c91b30f02f0a963dfa5ea93
SHA1 22b455a2bb3175f6b9ab49376f787e0caa015f2c
SHA512 37554a70d222e1f5e76b627573a3f1522c582b05b5e0dbc035f6d3699ebd3a880a51478b1e352e35250df2d7808f6033fa9a38129822366e7694040cd26d4ea7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f/:ROdWCCi7/rahwNUMuikLCiJCF+Qlir
MD5 SHA1 SHA512 SSDEEP

Submit Download

KHjgUCe.exe

Path C:\Windows\System\KHjgUCe.exe
Size 1.5MB
SHA256 5b51719ed507f200245e462cf367c6d008b0358c0c44f5b29265b4b4da4dd108
MD5 47acda83d8572bff15f0b05f17529760
SHA1 f11ab37ae23aae13c1fa27f60ca31e2335be9ee6
SHA512 099f40e325f5f4e953b96a0d34eb7bbe9d0e1de526f705f1978fd4909bbc444da689b0417ea31ccf2ba4b4879c99bab9f3ab6ba4962e877fe561ec8f042ea127
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f1:ROdWCCi7/rahwNUMuikLCiJCF+QliJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

KjzcNHr.exe

Path C:\Windows\System\KjzcNHr.exe
Size 1.5MB
SHA256 0df583f46981aa96614c0a70e387ef3526d55675a3af653b03a8e68d2701954d
MD5 334c4a93acd7e7b80d20557e1efaf38f
SHA1 c5bad603ae0af5702ee257cf295460298471c3d5
SHA512 a30ef5c83a0a76b21d873ac71904ebd68efa13496fa11c54fcc8ba893628cb87e95c25fb2f150c5a6eebd473e8ce16be72e098e8159ac1d2782f61251a9a58a3
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fu:ROdWCCi7/rahwNUMuikLCiJCF+Qlia
MD5 SHA1 SHA512 SSDEEP

Submit Download

MuFytSA.exe

Path C:\Windows\System\MuFytSA.exe
Size 1.5MB
SHA256 250e90f9f044b64eb62bec49698d5c529d5fca5ec3bc310879fcc44321740acd
MD5 e6dc44096fe7a560941b09282da32ef4
SHA1 1363e31adcf8022d3a7148bcf5db5a5aae064f80
SHA512 b278a11e353c4fe67b3ca1ea87ec1c2f54f689c62ee2290f9210104cca198c8e6b439e582f794237a4f09ddd09297610d7b05a183e82f699d5dbff9ffa0c3e3a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f+:ROdWCCi7/rahwNUMuikLCiJCF+Qliy
MD5 SHA1 SHA512 SSDEEP

Submit Download

NPidUBH.exe

Path C:\Windows\System\NPidUBH.exe
Size 1.5MB
SHA256 af4505bcfe3c415830936d32c52df04d3393d2b11056d21242782ce2dfe8d1da
MD5 123ebedb5a9feb023863abe2e9a03f69
SHA1 a493c13659ab6d714e04c8f34eee27fd732a0cc1
SHA512 29b7da4d3d5f7090480791e9684ef58f25fa466e5f4224421eb6ad4a3c89a40bb707905c4d5b610b98194c4929ef87bb35b6d9bbd3d0c2eaab90480cc87e481d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fa:ROdWCCi7/rahwNUMuikLCiJCF+Qli+
MD5 SHA1 SHA512 SSDEEP

Submit Download

OrLxhrQ.exe

Path C:\Windows\System\OrLxhrQ.exe
Size 1.5MB
SHA256 b743e114866f9f1e9ba5a63a517df5e111a6fc7fe727ca29873be7c8b9b88dcc
MD5 3ce020fca59b59d001625a3e960868c5
SHA1 a74e4f8bbd0844922fcc38faa09232a0f4e323d7
SHA512 2650205165453c8bc04fcbda41db7be61b1c7890f75c86c83b2957ae6a04be1822f25cfa6148ab8dd10e279dbe560c852f2968d7bec59a43bf5b6264954a9896
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fT:ROdWCCi7/rahwNUMuikLCiJCF+QliX
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuFzfkz.exe

Path C:\Windows\System\RuFzfkz.exe
Size 1.5MB
SHA256 fe8442018a1ef8d34b17bfc24b91f7ab85e4c23ae6249341942e759e8c63be73
MD5 bd630d466f85f25550b9d27b082cc959
SHA1 9e222952b9e71c0f44eb08e18a27000c1aa21ab5
SHA512 b37c36c20332404ee8ae566d3556105e731c78ef1816bdc96597e8fb2ba9f5c1c1bcd8b036946c5b3c800ed42e346375ef3b6a69e640e0dbd54a5e3c119d15ab
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fO:ROdWCCi7/rahwNUMuikLCiJCF+Qlia
MD5 SHA1 SHA512 SSDEEP

Submit Download

SroaTkn.exe

Path C:\Windows\System\SroaTkn.exe
Size 1.5MB
SHA256 d1a7d96427819353e4d65d66ce7892895e6c82d79a3dc59dfb14650577789571
MD5 02053a71917dcca539e68951ca64d308
SHA1 8f3a83c40a15e98797ffc246c8d4d11d31215463
SHA512 6fee2b263add8193c4861de83ba5fd59dc0bed258e781771075fe01e97f3036d794156a2000d5418a1f9d10d6d85977a48fd3eed3a7d06475064dd7592081ee4
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fQ:ROdWCCi7/rahwNUMuikLCiJCF+QliW9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TYZBLUX.exe

Path C:\Windows\System\TYZBLUX.exe
Size 1.5MB
SHA256 8d39ca39031a7710bf44df0fbb6fa587f6c1bdfce79a0bf1097b7e4a050071e7
MD5 f1d038673b090af74226ee8b62e96a4f
SHA1 45b53d0c930bc1c32118d779508e3b6370845b46
SHA512 047411c7c2f8f9647998f309a0c12182acac384569526623775352bd6dc3dceab3b233ae424d984774548bb9b1d1ee2bf462f61cba08cfb751dbd69dcfe94e10
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fC:ROdWCCi7/rahwNUMuikLCiJCF+Qli2
MD5 SHA1 SHA512 SSDEEP

Submit Download

TpMleyK.exe

Path C:\Windows\System\TpMleyK.exe
Size 1.5MB
SHA256 1f41b1320fa8842756dfb503cf9ca9ade8d99158e65aced68019aef6a7acc549
MD5 da306eff39aa1856f7e00af19ee1785f
SHA1 ddb2be51f1ff2e7a671878d29c1e84f078b3eeb2
SHA512 14f41b495c50a795fba4b88a1548261e1d94118bd4264e729420d9d89506c0fddc4ef506f06a6177cd697bd55f2628644519d28ecca2ec06ef734256b8d46d29
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fp:ROdWCCi7/rahwNUMuikLCiJCF+Qlil
MD5 SHA1 SHA512 SSDEEP

Submit Download

UWUlhdo.exe

Path C:\Windows\System\UWUlhdo.exe
Size 1.5MB
SHA256 cc829e38bdfc52c7794782ab6da3176bf0221c150ed28590276279ceb4500291
MD5 b741da787dcf8e35a843ee0a31889b22
SHA1 6be891146fbca90170f9e5c8f17159a77518290a
SHA512 de5cabfaa73de68789d32f30fa73bb2dbd02e2a100a828d043e7b9eca2e4dc9babd3728a3678a57b66c6dd252c3052c9226ebc38c9f75e7accbf2236442ab727
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fi:ROdWCCi7/rahwNUMuikLCiJCF+Qlie
MD5 SHA1 SHA512 SSDEEP

Submit Download

VEYOfXA.exe

Path C:\Windows\System\VEYOfXA.exe
Size 1.5MB
SHA256 48d2e7fc60140b736d0b0abb55caadc0a10b2ac80767e81729d5dec85b4f517d
MD5 85275fc0f7a97af29cd25ae8e9df2b09
SHA1 88b93c399313a4a3332d3b02fbb0367baeabac31
SHA512 103f7d5487c1e5b6474c1fbe75a347f76b1e3be2b8d2a82486a06c0b9d91c194919f225e27ecbe5b420e168831996617aaafc7cac9f695f18f63c886ce349f4a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f8:ROdWCCi7/rahwNUMuikLCiJCF+QliI
MD5 SHA1 SHA512 SSDEEP

Submit Download

XtLqHVe.exe

Path C:\Windows\System\XtLqHVe.exe
Size 1.5MB
SHA256 6fd4232f468f8420f1a91e028d274a6bc7ca4c313c6a3cde1657fac417a2d816
MD5 45843a1fa7f490caf0df206eb468f615
SHA1 55b20a68153b15c8b941bf24ff0b9c93ab515ea8
SHA512 89dd64feab9af51841461a09e49d47a55e02ddc627f891a0cb039195d88b258eff7923bfb41faffc7f7b950cdbffcb9d7e787bc7a9584e5e66801087047d2706
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fw:ROdWCCi7/rahwNUMuikLCiJCF+Qli8
MD5 SHA1 SHA512 SSDEEP

Submit Download

YTIyZCT.exe

Path C:\Windows\System\YTIyZCT.exe
Size 1.5MB
SHA256 b25b12ced1e340835eabdc3f6fe68377326384e1e31264faa904d07b2363f1e3
MD5 18c857b7a0fb5f164358e4415c9a30d1
SHA1 57c23b458eba6f4ec676c6403a717f95b0bd9eea
SHA512 868f9d40a2943f175a0a7f722aeb75097994b33d7a7d19924b6e7aab7247a3cea5525babc63002aec3310eabd3e261b00017adbe2df9c61ed7819047bd898251
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fY:ROdWCCi7/rahwNUMuikLCiJCF+QliU
MD5 SHA1 SHA512 SSDEEP

Submit Download

bejZjqh.exe

Path C:\Windows\System\bejZjqh.exe
Size 1.5MB
SHA256 68f09cc7858328988c0dcbf2577e1b7d8136684332407a6cbd908d219cf9a676
MD5 dc3494f8d871067a67c2362e2209c20b
SHA1 531103be526e4004ce2dbd6f251cab6dc563d405
SHA512 03f82eb2f813f64c4adc56543e3a3d94f461a7ae646e73e017b42f9927985080fb03d201f23e73481575e8be82569044e99097f4385bae64be35fb6cc1e39de0
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fu:ROdWCCi7/rahwNUMuikLCiJCF+Qliq
MD5 SHA1 SHA512 SSDEEP

Submit Download

daDmgDF.exe

Path C:\Windows\System\daDmgDF.exe
Size 1.5MB
SHA256 54810eebaa9cdbe44b1e1a6f85fd2864d85d3e9fcc1d4c48cdde7b44e6af5e93
MD5 6e53795739135109d757f5f2a40ff72d
SHA1 839b9ca02ac5a5941b0989d4ee3881920d253e41
SHA512 16157df7506f5145ed57b4f733d9c68e4d5f6979d7f349ba45ade8a8a9ed1ad880bf4fa49990dd525210e527eab1267efdb844511dbd44984db82c211c911300
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fm:ROdWCCi7/rahwNUMuikLCiJCF+QliS
MD5 SHA1 SHA512 SSDEEP

Submit Download

dcbDrOx.exe

Path C:\Windows\System\dcbDrOx.exe
Size 1.5MB
SHA256 70b52a852a07346472f8e78d32494ebcbf2270ad7174e82eb32d6f0c05110850
MD5 a66ad1a797ee88bddcaa247990af63a0
SHA1 d72cedee0c7b1a7c43b4604c54b1b0e5229e11b3
SHA512 3b1148fac13c4054ad895a073eca00b8f0fade3330d7d2db8f39e1fa3c4655926cfed2dfbaac69ee10619752c7427b0aac88c28bfc5d26278e1a9a4b54df26df
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f3:ROdWCCi7/rahwNUMuikLCiJCF+Qlir
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnuJSmo.exe

Path C:\Windows\System\dnuJSmo.exe
Size 1.5MB
SHA256 8b1718fdce42fe980225bd8a2f66dd27e1bb29657180c8053644887babc9c338
MD5 25f93b16084ca5313b9c50876dad40e3
SHA1 1b6868d407e047f640c16acea89374c96d97e1b9
SHA512 8490d30f814b7567136dfb96f06ab92973a6fb4959244e87e0abc30b104f2e942220098fa7f7ac971fc4f98af782670dfc6422928e362b37bba4ef5530c76a71
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f7:ROdWCCi7/rahwNUMuikLCiJCF+QliX
MD5 SHA1 SHA512 SSDEEP

Submit Download

glaeOIM.exe

Path C:\Windows\System\glaeOIM.exe
Size 1.5MB
SHA256 41d606cffb6872591469b02e17bc8b7b1e10019abe0ba3e415d26f4cb416da1b
MD5 60c58fab101f2afe2b7e72d4f475b37c
SHA1 fa7affd3959cee2451c2aae8363d891dade39c3e
SHA512 9ac93ecb6d127fa2e44cd18e2e7fa3697cdeeb77079083293f8a80770e7bfaa0d71447584ffe2ee6c6a79efe145021d80c8798f2b73343a7b3535f0afe8e21eb
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fI:ROdWCCi7/rahwNUMuikLCiJCF+QliM
MD5 SHA1 SHA512 SSDEEP

Submit Download

gqBLySA.exe

Path C:\Windows\System\gqBLySA.exe
Size 1.5MB
SHA256 212482d5a714c3409516da762a2b415b631e0efaa206880e0fb96691d6950b15
MD5 75266de3ccb064e6429fe5ebeb4268ee
SHA1 4b92cf048354d251fb1feee06e696ff5a5228766
SHA512 4afda3b978a89e407887b11b4166471aabc95c9f9051e9f9810d45b29311d0dc928cbae47d36f21882e9ae12da57ca4a4ce074ce5e7bdc74e30de49205cffbec
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f1:ROdWCCi7/rahwNUMuikLCiJCF+Qlix
MD5 SHA1 SHA512 SSDEEP

Submit Download

gvSeMsF.exe

Path C:\Windows\System\gvSeMsF.exe
Size 1.5MB
SHA256 b0a22200d601d9eaf51ec0e6046abbff63a005e0ff776a63f64e1694a2261888
MD5 14c73f79f0c6f8a1fc3cb3d4c37b7c47
SHA1 d9bc614498464dcf7cc614d59463c5f7393c4029
SHA512 5ed1093b6c99ce56baf606f8785a817d658968efc2fe29a0946b926c48e52a546fa2178f48637546ffc272d4192effe992e43b33f94e5e3205ec5aa8e5f90f1f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fs:ROdWCCi7/rahwNUMuikLCiJCF+Qliw
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbLsjyf.exe

Path C:\Windows\System\hbLsjyf.exe
Size 1.5MB
SHA256 41ec29dcfb8139492ab46a65279d28513578c2a883cc7e648d9cda2d9233d36a
MD5 72e12dbca7f8d5a7e1445f33fab69cb5
SHA1 76e5fa700b60ca66ecf1738f02122ec3f8821a0a
SHA512 f0228d92a54c1f61fd0c53576f5ee03a4fac1b0fa50fe91a60cf8865c44b398192439b2bbce9ffb056b5a87225b5ce2e9c5ba5045e98c238184e9bff3cef73d6
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fd:ROdWCCi7/rahwNUMuikLCiJCF+QliJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mBvscUr.exe

Path C:\Windows\System\mBvscUr.exe
Size 1.5MB
SHA256 fbc0ef955999c426b0b81d4642b895b056993dd6571f286e811d7714bbe198ba
MD5 932832e029b4b5992e1a07b1a1617a2a
SHA1 200735b6bedd780d196c9f550d4f184ac2976738
SHA512 d7a4b7fb43245bb6108c1f07aba932d938f4264ae290ff5b0919f44a2b4b38e9eeff80b1b7fb26f811f3cb42f2844bf4b2ea85cca14c33c0f75b174f81a56009
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fW:ROdWCCi7/rahwNUMuikLCiJCF+Qliq
MD5 SHA1 SHA512 SSDEEP

Submit Download

mHlgrRj.exe

Path C:\Windows\System\mHlgrRj.exe
Size 1.5MB
SHA256 ee7a466e6beb158febfc1093c88ea958facf81d8a863dfab8e0cba08fe2052f4
MD5 e9c82b76b82d928e8f7b5ad35079efc5
SHA1 c2d4bb3010fe2f230ad3d244d1c0e682714f8f0b
SHA512 cee70e89683c2d94ef96f1bcd7a2dc664c2543c1f63388d5af556da5222742e7bee135e85829fc433f5a5c84f6275c569d3c8486bb21d34e2d0611daa4700822
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fQ:ROdWCCi7/rahwNUMuikLCiJCF+QliE
MD5 SHA1 SHA512 SSDEEP

Submit Download

mvtkYaW.exe

Path C:\Windows\System\mvtkYaW.exe
Size 1.5MB
SHA256 da44379efa4adbb07834a8761d7e3adbd6d094cfa1dad348cbfbc938f0e863a4
MD5 ff5099e117bb7e84e1f694a54307e5af
SHA1 6e7271fe2266899270ed0cb6e0aaa885b9184109
SHA512 8b5472d5dcda6bf93d1276ad0f48850d05a4ff113e2d0adcb13526f833d98c4ac5a110e2324a99b26e2810caf3930ee91d64a705eda6fe1baf532d48b2de5e0a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fi:ROdWCCi7/rahwNUMuikLCiJCF+Qli2
MD5 SHA1 SHA512 SSDEEP

Submit Download

nzGQIBC.exe

Path C:\Windows\System\nzGQIBC.exe
Size 1.5MB
SHA256 0463fba29d253fd9373708c1bf36e9dffc11740ec86f5a31af8cc1beb9116a03
MD5 4c18b1b45d1583a4a557ba323238c8b7
SHA1 f666965450e16abce8bfdaaf59fccf8828dcf1c1
SHA512 c629a6cb70a6be0546126c2e0687b92bcd88753c60606e32121197b03fcb4c8f0da34a72b264ae308bb9170168e936571d825d09daf5afeb07eed48a22b1781e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fK:ROdWCCi7/rahwNUMuikLCiJCF+Qli+
MD5 SHA1 SHA512 SSDEEP

Submit Download

oBaXhhB.exe

Path C:\Windows\System\oBaXhhB.exe
Size 1.5MB
SHA256 b432d9ca1d67c1d1ba58066bdd5e68263fe73b2b7c17e7cc9c3bb27d6a0a71a8
MD5 e46e75f89f748caf00e1fc81ef836dbb
SHA1 cc11072d8a011b3655794484810b4b6f46e0ecca
SHA512 52c387a6fa31978cf58ef83308ef2d09f337ef2343b2c590422e0736bce4968729cb7f48a92d3b698ba0be787555dc1184aa0d821982eb550a61783eced5f539
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fG:ROdWCCi7/rahwNUMuikLCiJCF+Qliy
MD5 SHA1 SHA512 SSDEEP

Submit Download

qApvUmZ.exe

Path C:\Windows\System\qApvUmZ.exe
Size 1.5MB
SHA256 9b1cbdcc84bfe6e3b9ad6d6490ee06aec4c63be95259a2683071cdf5f31765c7
MD5 a1bda81d4ad4b26cb748a639e492d5e5
SHA1 21bbf977a7113d0ff9f45d00e2d2193bd1abccef
SHA512 50b8499ae164f0676b6d8f3fa695eb49c25ff2bfd8fc3c9c76b48005addeb7e5478d3485eb50026be2afc398323a7e058b55b2a4c46f560941c84e63e5dc1202
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fJ:ROdWCCi7/rahwNUMuikLCiJCF+Qlil
MD5 SHA1 SHA512 SSDEEP

Submit Download

qShOJeg.exe

Path C:\Windows\System\qShOJeg.exe
Size 1.5MB
SHA256 41f081e79611a2221ba75ded054a016ba46328e0b3f2dbaf476202b0db57d0a7
MD5 038fc0c75f46a56ca364558ac25cffc3
SHA1 f1d1c2fd7c3df1694821bf9ad3fd64bd32bcc4ab
SHA512 94e452a9ec857a036236161baea7bbd0c332bf5422baa2fc6fcf8a5f841f2cc11b31244f8109f71407c168a71637809400af96c4f9da37b586d7b4be581b3088
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fG:ROdWCCi7/rahwNUMuikLCiJCF+Qli1U
MD5 SHA1 SHA512 SSDEEP

Submit Download

sMGKSgN.exe

Path C:\Windows\System\sMGKSgN.exe
Size 1.5MB
SHA256 ff1f7345fcbc12be76c89dffd0e8b3326e4add120323f99ffd3887bbcc61560f
MD5 370c57c57e54243d5c431f2ed80e8798
SHA1 8536f376c18827f3c8a986fbeb0e67f084fbd052
SHA512 5a703859cacfb7054e2b542324c7137e6a40aad1bdc7d54dcc91a11eb659e92ffd8fcf3d65c2c4cbd6473d75d34990d445b4f2b35d8932c76befb85c0c749e85
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fM:ROdWCCi7/rahwNUMuikLCiJCF+Qli4
MD5 SHA1 SHA512 SSDEEP

Submit Download

trvmVMQ.exe

Path C:\Windows\System\trvmVMQ.exe
Size 1.5MB
SHA256 a4d3f5c74f4ad2edfc92a9a3cb1116e63ea626cffc96bdfbd3e27e50242226bd
MD5 1cd78334a1648a683765a1653fd4b1b9
SHA1 4492d21441a22667c953e1fe42749798daf1c977
SHA512 ae3595cad0ca30eaf32892ff5888697724ac663435ff70778ac421f6d78efabf31272f36ab1902bdccc6f958ed51115be8530fe086afd009b3fef68c05a33c7e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fQ:ROdWCCi7/rahwNUMuikLCiJCF+Qlic
MD5 SHA1 SHA512 SSDEEP

Submit Download

uVUDtvt.exe

Path C:\Windows\System\uVUDtvt.exe
Size 1.5MB
SHA256 5a451cded6202a5e442ceef062008aaceb5b7f625b8b488e8f72e36b26230c7a
MD5 bc4a8f631677eb6aa0f9406c9489c734
SHA1 9717cb8c54ff91b9a25879847301ddecf1634913
SHA512 edd5d914b0443553f37fbc3306cd9749122cf63ed0102ad6c7f82f2dad76da39ec267cb3690c555919ac38844cb0d5511c86971970ec410e4740e4ce2636e4be
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fJ:ROdWCCi7/rahwNUMuikLCiJCF+Qli1
MD5 SHA1 SHA512 SSDEEP

Submit Download

uWpZZzR.exe

Path C:\Windows\System\uWpZZzR.exe
Size 1.5MB
SHA256 aa8e892f78794b7d9066a8ff056873d85a64801b134fb9e5f6573d6aea3d08e6
MD5 1604a835e678a9432d35c1f4b3961c30
SHA1 33d7c808b4965753af82402412ec4cd387955db4
SHA512 f9e1a750253e8e4a68027f1358c17c785fc539e46ad7a2c9fc4e05575dbe75892322469eee1a3207f454de35e4027c44eb1df4ac070f8cdd9fd260f952fb3735
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fe:ROdWCCi7/rahwNUMuikLCiJCF+QliK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ueEUBcW.exe

Path C:\Windows\System\ueEUBcW.exe
Size 1.5MB
SHA256 ae1bda2de978e1f7bb6e3de6705615309d7747d041f22b2f97dbc7591980bfa2
MD5 8fef28fe60306cf8383837ec18549b3f
SHA1 6fe296e4cbe084e846269d756630fc12efdcd506
SHA512 239b8cb59ed1f30b5057f0559cf87dc2cabd756265796dfdecaf7b089fc8d0bdf26e76750c205057ecc0b9423981e7de48d405455a68895df482497cc4d91e9c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fT:ROdWCCi7/rahwNUMuikLCiJCF+QliH
MD5 SHA1 SHA512 SSDEEP

Submit Download

vrHPurC.exe

Path C:\Windows\System\vrHPurC.exe
Size 1.5MB
SHA256 3b64f19436ac2453e59906ace3bc3c9008030ccd46e71afc1b8f71294215c963
MD5 391e14f0e97e8ac4c90d9d9fb0f7adb2
SHA1 b7a2e61293e09b0a0e5c4fe576aef69c731bcfc3
SHA512 00782523cfd85571fc7f90a72e2cc65d82c16a24ace8dbeaa96044623a85d549c22cfcc76baded62c5c40135b1ae76f140ace5f2f3aea2e17b864be57357e804
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f/:ROdWCCi7/rahwNUMuikLCiJCF+QliD
MD5 SHA1 SHA512 SSDEEP

Submit Download

yjKeOjJ.exe

Path C:\Windows\System\yjKeOjJ.exe
Size 1.5MB
SHA256 70e9036e82f6ad8f54eaba1c447b6fadd14a530c41a168273d6626282ea2c4a3
MD5 e3f01452ef3963b70d7eec658ce1a289
SHA1 9ca3b6ae8a909dede2ea586f04c36f179f00d016
SHA512 e11abae6fdbb79c66f751e4df03b6c9d316b46f767d47df96da23e04f806de85e93f567e94078a00b1f8ab9936c0ae4a0f1a2ca89863a7f0c892ca08b9face85
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fY:ROdWCCi7/rahwNUMuikLCiJCF+Qli8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/416-2271-0x00007FF668830000-0x00007FF668B81000-memory.dmp

Download

memory/416-30-0x00007FF668830000-0x00007FF668B81000-memory.dmp

Download

memory/768-281-0x00007FF7FB350000-0x00007FF7FB6A1000-memory.dmp

Download

memory/768-2309-0x00007FF7FB350000-0x00007FF7FB6A1000-memory.dmp

Download

memory/1008-235-0x00007FF6F9B90000-0x00007FF6F9EE1000-memory.dmp

Download

memory/1008-2294-0x00007FF6F9B90000-0x00007FF6F9EE1000-memory.dmp

Download

memory/1236-2288-0x00007FF6F2220000-0x00007FF6F2571000-memory.dmp

Download

memory/1236-231-0x00007FF6F2220000-0x00007FF6F2571000-memory.dmp

Download

memory/1376-2300-0x00007FF6DEC90000-0x00007FF6DEFE1000-memory.dmp

Download

memory/1376-273-0x00007FF6DEC90000-0x00007FF6DEFE1000-memory.dmp

Download

memory/1548-2266-0x00007FF69C400000-0x00007FF69C751000-memory.dmp

Download

memory/1548-54-0x00007FF69C400000-0x00007FF69C751000-memory.dmp

Download

memory/1664-274-0x00007FF682750000-0x00007FF682AA1000-memory.dmp

Download

memory/1664-2305-0x00007FF682750000-0x00007FF682AA1000-memory.dmp

Download

memory/1748-236-0x00007FF7B8BC0000-0x00007FF7B8F11000-memory.dmp

Download

memory/1748-2327-0x00007FF7B8BC0000-0x00007FF7B8F11000-memory.dmp

Download

memory/1812-192-0x00007FF69BB40000-0x00007FF69BE91000-memory.dmp

Download

memory/1812-2275-0x00007FF69BB40000-0x00007FF69BE91000-memory.dmp

Download

memory/1836-280-0x00007FF6CE070000-0x00007FF6CE3C1000-memory.dmp

Download

memory/1836-2313-0x00007FF6CE070000-0x00007FF6CE3C1000-memory.dmp

Download

memory/1940-286-0x00007FF72E910000-0x00007FF72EC61000-memory.dmp

Download

memory/1940-2296-0x00007FF72E910000-0x00007FF72EC61000-memory.dmp

Download

memory/2044-276-0x00007FF6137C0000-0x00007FF613B11000-memory.dmp

Download

memory/2044-2315-0x00007FF6137C0000-0x00007FF613B11000-memory.dmp

Download

memory/2136-230-0x00007FF79A410000-0x00007FF79A761000-memory.dmp

Download

memory/2136-2289-0x00007FF79A410000-0x00007FF79A761000-memory.dmp

Download

memory/2184-2272-0x00007FF668890000-0x00007FF668BE1000-memory.dmp

Download

memory/2184-283-0x00007FF668890000-0x00007FF668BE1000-memory.dmp

Download

memory/2332-241-0x00007FF66BE20000-0x00007FF66C171000-memory.dmp

Download

memory/2332-2276-0x00007FF66BE20000-0x00007FF66C171000-memory.dmp

Download

memory/2412-287-0x00007FF7EA600000-0x00007FF7EA951000-memory.dmp

Download

memory/2412-2307-0x00007FF7EA600000-0x00007FF7EA951000-memory.dmp

Download

memory/2416-2264-0x00007FF605140000-0x00007FF605491000-memory.dmp

Download

memory/2416-22-0x00007FF605140000-0x00007FF605491000-memory.dmp

Download

memory/2572-2311-0x00007FF73B640000-0x00007FF73B991000-memory.dmp

Download

memory/2572-278-0x00007FF73B640000-0x00007FF73B991000-memory.dmp

Download

memory/2584-148-0x00007FF777720000-0x00007FF777A71000-memory.dmp

Download

memory/2584-2298-0x00007FF777720000-0x00007FF777A71000-memory.dmp

Download

memory/2776-284-0x00007FF7A6210000-0x00007FF7A6561000-memory.dmp

Download

memory/2776-2280-0x00007FF7A6210000-0x00007FF7A6561000-memory.dmp

Download

memory/2900-2282-0x00007FF7B6740000-0x00007FF7B6A91000-memory.dmp

Download

memory/2900-58-0x00007FF7B6740000-0x00007FF7B6A91000-memory.dmp

Download

memory/3216-2325-0x00007FF64FFF0000-0x00007FF650341000-memory.dmp

Download

memory/3216-279-0x00007FF64FFF0000-0x00007FF650341000-memory.dmp

Download

memory/3552-2260-0x00007FF67ED50000-0x00007FF67F0A1000-memory.dmp

Download

memory/3552-16-0x00007FF67ED50000-0x00007FF67F0A1000-memory.dmp

Download

memory/3976-1-0x000001DC8B0C0000-0x000001DC8B0D0000-memory.dmp

Download

memory/3976-2161-0x00007FF70FE60000-0x00007FF7101B1000-memory.dmp

Download

memory/3976-0-0x00007FF70FE60000-0x00007FF7101B1000-memory.dmp

Download

memory/4360-277-0x00007FF631D50000-0x00007FF6320A1000-memory.dmp

Download

memory/4360-2349-0x00007FF631D50000-0x00007FF6320A1000-memory.dmp

Download

memory/4532-2278-0x00007FF6C27F0000-0x00007FF6C2B41000-memory.dmp

Download

memory/4532-272-0x00007FF6C27F0000-0x00007FF6C2B41000-memory.dmp

Download

memory/4904-2269-0x00007FF6D9270000-0x00007FF6D95C1000-memory.dmp

Download

memory/4904-105-0x00007FF6D9270000-0x00007FF6D95C1000-memory.dmp

Download

memory/5028-2284-0x00007FF7F9260000-0x00007FF7F95B1000-memory.dmp

Download

memory/5028-285-0x00007FF7F9260000-0x00007FF7F95B1000-memory.dmp

Download

memory/5044-2292-0x00007FF6E0B70000-0x00007FF6E0EC1000-memory.dmp

Download

memory/5044-266-0x00007FF6E0B70000-0x00007FF6E0EC1000-memory.dmp

Download

memory/5096-2262-0x00007FF619C60000-0x00007FF619FB1000-memory.dmp

Download

memory/5096-282-0x00007FF619C60000-0x00007FF619FB1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads