xmrig | 9d128f6503f4bde230fc08f55f81604971760432ae4ba11bb33638121939f339

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
Size 1.1MB
Sample240607-l47y7aff78
SHA256 9d128f6503f4bde230fc08f55f81604971760432ae4ba11bb33638121939f339
MD5 4ca3f6913c1022a428e8dd57333c9ff0
SHA1 40cab6d9c27e9e5398d87deb3d616b959c9f1bb6
SHA512 3b48403d26c4b31381441c573d17313dbad4c46ec20d068c0a908185d1aec1ff55d3813dd80b5a736390bd3cfa91c253d5fb8c615341ef06bb67b056d9b335f2
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenm:ROdWCCi7/rahW/zFdDlhUKCl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 56 IoCs

miner

resource	yara_rule
behavioral2/memory/2028-35-0x00007FF64E930000-0x00007FF64EC81000-memory.dmp	xmrig
behavioral2/memory/2752-33-0x00007FF7BFF90000-0x00007FF7C02E1000-memory.dmp	xmrig
behavioral2/memory/1620-62-0x00007FF68D9F0000-0x00007FF68DD41000-memory.dmp	xmrig
behavioral2/memory/3184-63-0x00007FF7403D0000-0x00007FF740721000-memory.dmp	xmrig
behavioral2/memory/1568-68-0x00007FF7F49C0000-0x00007FF7F4D11000-memory.dmp	xmrig
behavioral2/memory/4988-70-0x00007FF6DE190000-0x00007FF6DE4E1000-memory.dmp	xmrig
behavioral2/memory/1132-75-0x00007FF607960000-0x00007FF607CB1000-memory.dmp	xmrig
behavioral2/memory/5048-77-0x00007FF775B20000-0x00007FF775E71000-memory.dmp	xmrig
behavioral2/memory/4100-81-0x00007FF7D80E0000-0x00007FF7D8431000-memory.dmp	xmrig
behavioral2/memory/3032-93-0x00007FF6BB5C0000-0x00007FF6BB911000-memory.dmp	xmrig
behavioral2/memory/2752-95-0x00007FF7BFF90000-0x00007FF7C02E1000-memory.dmp	xmrig
behavioral2/memory/3036-115-0x00007FF739BD0000-0x00007FF739F21000-memory.dmp	xmrig
behavioral2/memory/4428-126-0x00007FF71D8E0000-0x00007FF71DC31000-memory.dmp	xmrig
behavioral2/memory/3328-123-0x00007FF713C20000-0x00007FF713F71000-memory.dmp	xmrig
behavioral2/memory/1700-117-0x00007FF71F480000-0x00007FF71F7D1000-memory.dmp	xmrig
behavioral2/memory/4780-116-0x00007FF6822A0000-0x00007FF6825F1000-memory.dmp	xmrig
behavioral2/memory/3464-113-0x00007FF767170000-0x00007FF7674C1000-memory.dmp	xmrig
behavioral2/memory/452-110-0x00007FF6B5D00000-0x00007FF6B6051000-memory.dmp	xmrig
behavioral2/memory/872-101-0x00007FF7C1130000-0x00007FF7C1481000-memory.dmp	xmrig
behavioral2/memory/4700-167-0x00007FF607280000-0x00007FF6075D1000-memory.dmp	xmrig
behavioral2/memory/5100-205-0x00007FF714DB0000-0x00007FF715101000-memory.dmp	xmrig
behavioral2/memory/3792-213-0x00007FF611620000-0x00007FF611971000-memory.dmp	xmrig
behavioral2/memory/4732-211-0x00007FF642360000-0x00007FF6426B1000-memory.dmp	xmrig
behavioral2/memory/4708-207-0x00007FF6B5E90000-0x00007FF6B61E1000-memory.dmp	xmrig
behavioral2/memory/976-197-0x00007FF74A340000-0x00007FF74A691000-memory.dmp	xmrig
behavioral2/memory/644-171-0x00007FF60F490000-0x00007FF60F7E1000-memory.dmp	xmrig
behavioral2/memory/4716-152-0x00007FF656640000-0x00007FF656991000-memory.dmp	xmrig
behavioral2/memory/804-135-0x00007FF7550C0000-0x00007FF755411000-memory.dmp	xmrig
behavioral2/memory/1568-2185-0x00007FF7F49C0000-0x00007FF7F4D11000-memory.dmp	xmrig
behavioral2/memory/1132-2195-0x00007FF607960000-0x00007FF607CB1000-memory.dmp	xmrig
behavioral2/memory/2028-2202-0x00007FF64E930000-0x00007FF64EC81000-memory.dmp	xmrig
behavioral2/memory/2752-2208-0x00007FF7BFF90000-0x00007FF7C02E1000-memory.dmp	xmrig
behavioral2/memory/4100-2207-0x00007FF7D80E0000-0x00007FF7D8431000-memory.dmp	xmrig
behavioral2/memory/3036-2212-0x00007FF739BD0000-0x00007FF739F21000-memory.dmp	xmrig
behavioral2/memory/3464-2211-0x00007FF767170000-0x00007FF7674C1000-memory.dmp	xmrig
behavioral2/memory/804-2299-0x00007FF7550C0000-0x00007FF755411000-memory.dmp	xmrig
behavioral2/memory/3184-2302-0x00007FF7403D0000-0x00007FF740721000-memory.dmp	xmrig
behavioral2/memory/5100-2301-0x00007FF714DB0000-0x00007FF715101000-memory.dmp	xmrig
behavioral2/memory/4988-2304-0x00007FF6DE190000-0x00007FF6DE4E1000-memory.dmp	xmrig
behavioral2/memory/5048-2318-0x00007FF775B20000-0x00007FF775E71000-memory.dmp	xmrig
behavioral2/memory/452-2336-0x00007FF6B5D00000-0x00007FF6B6051000-memory.dmp	xmrig
behavioral2/memory/872-2341-0x00007FF7C1130000-0x00007FF7C1481000-memory.dmp	xmrig
behavioral2/memory/1700-2343-0x00007FF71F480000-0x00007FF71F7D1000-memory.dmp	xmrig
behavioral2/memory/4780-2345-0x00007FF6822A0000-0x00007FF6825F1000-memory.dmp	xmrig
behavioral2/memory/4428-2349-0x00007FF71D8E0000-0x00007FF71DC31000-memory.dmp	xmrig
behavioral2/memory/5044-2352-0x00007FF64F2B0000-0x00007FF64F601000-memory.dmp	xmrig
behavioral2/memory/3328-2347-0x00007FF713C20000-0x00007FF713F71000-memory.dmp	xmrig
behavioral2/memory/4700-2356-0x00007FF607280000-0x00007FF6075D1000-memory.dmp	xmrig
behavioral2/memory/4716-2354-0x00007FF656640000-0x00007FF656991000-memory.dmp	xmrig
behavioral2/memory/644-2360-0x00007FF60F490000-0x00007FF60F7E1000-memory.dmp	xmrig
behavioral2/memory/3640-2358-0x00007FF68A910000-0x00007FF68AC61000-memory.dmp	xmrig
behavioral2/memory/4708-2364-0x00007FF6B5E90000-0x00007FF6B61E1000-memory.dmp	xmrig
behavioral2/memory/3792-2363-0x00007FF611620000-0x00007FF611971000-memory.dmp	xmrig
behavioral2/memory/976-2368-0x00007FF74A340000-0x00007FF74A691000-memory.dmp	xmrig
behavioral2/memory/4732-2366-0x00007FF642360000-0x00007FF6426B1000-memory.dmp	xmrig
behavioral2/memory/4856-2371-0x00007FF7A9AF0000-0x00007FF7A9E41000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1568	WGEwesz.exe
1132	IreCqnf.exe
4100	jRBRdCL.exe
2752	CjJuDZY.exe
2028	YrksMFf.exe
3464	WHHyYSC.exe
3036	qKFhtPF.exe
804	AjozbIR.exe
5100	APFEXML.exe
3184	DdsadIh.exe
4988	iSmexJe.exe
5048	WhwcMLb.exe
3032	AYgrJAX.exe
872	ZtQUBOx.exe
452	eSXeYkF.exe
4780	mYmXzkO.exe
1700	YsFyRxg.exe
3328	vQjPkvk.exe
4428	CmjOXIR.exe
5044	ASHHTjm.exe
4716	lCbZwwW.exe
3640	BDxRxoE.exe
4700	CCzajjp.exe
644	jVBIKom.exe
4708	YgeZSkY.exe
4732	BYhfwnf.exe
3792	NedNLzM.exe
4856	fcUDbFV.exe
976	sCPdltk.exe
4488	NflATLy.exe
760	avUmutb.exe
408	HOnKxkF.exe
1720	PHfmFCz.exe
3664	WqJFnZi.exe
4912	EUDCFHQ.exe
856	dBTYKpj.exe
1936	azRzTNV.exe
3028	oTMnJIk.exe
1852	YPvFsLA.exe
416	RORsNfk.exe
1528	CQqslUU.exe
4792	UahfhBG.exe
3592	ficQdvr.exe
4804	kKdjATQ.exe
4252	CplmgEv.exe
1948	RTNCmcC.exe
4572	ktGQRpW.exe
3616	jAATCBW.exe
2452	UDGIXrs.exe
3256	wpCOHsN.exe
4968	gdqZnsv.exe
4580	sdTVbkZ.exe
1572	boBwChf.exe
4548	UaTMlmp.exe
1236	NcxHySs.exe
2032	CDCjGsl.exe
1468	wXcSZVn.exe
4728	QijFhvb.exe
1088	PmRVXEd.exe
1268	skGSYig.exe
1280	NhNNHgE.exe
968	pOExVPp.exe
4852	owOIjqE.exe
2436	DXsJRdR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1620-0-0x00007FF68D9F0000-0x00007FF68DD41000-memory.dmp	upx
behavioral2/files/0x000800000002322b-6.dat	upx
behavioral2/memory/1568-8-0x00007FF7F49C0000-0x00007FF7F4D11000-memory.dmp	upx
behavioral2/files/0x000800000002322e-10.dat	upx
behavioral2/memory/1132-14-0x00007FF607960000-0x00007FF607CB1000-memory.dmp	upx
behavioral2/files/0x0008000000023232-11.dat	upx
behavioral2/files/0x0008000000023233-23.dat	upx
behavioral2/memory/4100-22-0x00007FF7D80E0000-0x00007FF7D8431000-memory.dmp	upx
behavioral2/files/0x000800000002322f-27.dat	upx
behavioral2/memory/3464-37-0x00007FF767170000-0x00007FF7674C1000-memory.dmp	upx
behavioral2/files/0x0007000000023235-40.dat	upx
behavioral2/files/0x0007000000023234-36.dat	upx
behavioral2/memory/3036-47-0x00007FF739BD0000-0x00007FF739F21000-memory.dmp	upx
behavioral2/memory/804-48-0x00007FF7550C0000-0x00007FF755411000-memory.dmp	upx
behavioral2/files/0x0007000000023236-46.dat	upx
behavioral2/memory/2028-35-0x00007FF64E930000-0x00007FF64EC81000-memory.dmp	upx
behavioral2/memory/2752-33-0x00007FF7BFF90000-0x00007FF7C02E1000-memory.dmp	upx
behavioral2/files/0x0007000000023237-52.dat	upx
behavioral2/memory/5100-56-0x00007FF714DB0000-0x00007FF715101000-memory.dmp	upx
behavioral2/files/0x0007000000023238-60.dat	upx
behavioral2/memory/1620-62-0x00007FF68D9F0000-0x00007FF68DD41000-memory.dmp	upx
behavioral2/memory/3184-63-0x00007FF7403D0000-0x00007FF740721000-memory.dmp	upx
behavioral2/files/0x0007000000023239-65.dat	upx
behavioral2/memory/1568-68-0x00007FF7F49C0000-0x00007FF7F4D11000-memory.dmp	upx
behavioral2/memory/4988-70-0x00007FF6DE190000-0x00007FF6DE4E1000-memory.dmp	upx
behavioral2/files/0x000700000002323a-72.dat	upx
behavioral2/memory/1132-75-0x00007FF607960000-0x00007FF607CB1000-memory.dmp	upx
behavioral2/memory/5048-77-0x00007FF775B20000-0x00007FF775E71000-memory.dmp	upx
behavioral2/files/0x000700000002323b-79.dat	upx
behavioral2/memory/4100-81-0x00007FF7D80E0000-0x00007FF7D8431000-memory.dmp	upx
behavioral2/files/0x000700000002323c-86.dat	upx
behavioral2/memory/3032-93-0x00007FF6BB5C0000-0x00007FF6BB911000-memory.dmp	upx
behavioral2/files/0x000700000002323d-92.dat	upx
behavioral2/memory/2752-95-0x00007FF7BFF90000-0x00007FF7C02E1000-memory.dmp	upx
behavioral2/files/0x000700000002323e-109.dat	upx
behavioral2/memory/3036-115-0x00007FF739BD0000-0x00007FF739F21000-memory.dmp	upx
behavioral2/files/0x0007000000023242-118.dat	upx
behavioral2/files/0x0007000000023241-120.dat	upx
behavioral2/memory/4428-126-0x00007FF71D8E0000-0x00007FF71DC31000-memory.dmp	upx
behavioral2/files/0x0007000000023243-127.dat	upx
behavioral2/memory/5044-125-0x00007FF64F2B0000-0x00007FF64F601000-memory.dmp	upx
behavioral2/memory/3328-123-0x00007FF713C20000-0x00007FF713F71000-memory.dmp	upx
behavioral2/memory/1700-117-0x00007FF71F480000-0x00007FF71F7D1000-memory.dmp	upx
behavioral2/memory/4780-116-0x00007FF6822A0000-0x00007FF6825F1000-memory.dmp	upx
behavioral2/memory/3464-113-0x00007FF767170000-0x00007FF7674C1000-memory.dmp	upx
behavioral2/memory/452-110-0x00007FF6B5D00000-0x00007FF6B6051000-memory.dmp	upx
behavioral2/files/0x0007000000023240-103.dat	upx
behavioral2/memory/872-101-0x00007FF7C1130000-0x00007FF7C1481000-memory.dmp	upx
behavioral2/files/0x0007000000023244-132.dat	upx
behavioral2/files/0x0007000000023247-147.dat	upx
behavioral2/files/0x0007000000023248-148.dat	upx
behavioral2/files/0x0007000000023246-154.dat	upx
behavioral2/files/0x0007000000023249-168.dat	upx
behavioral2/files/0x000700000002324c-169.dat	upx
behavioral2/memory/4700-167-0x00007FF607280000-0x00007FF6075D1000-memory.dmp	upx
behavioral2/files/0x000700000002324a-179.dat	upx
behavioral2/files/0x000700000002324e-189.dat	upx
behavioral2/files/0x0007000000023250-193.dat	upx
behavioral2/files/0x000700000002324f-199.dat	upx
behavioral2/memory/5100-205-0x00007FF714DB0000-0x00007FF715101000-memory.dmp	upx
behavioral2/memory/3792-213-0x00007FF611620000-0x00007FF611971000-memory.dmp	upx
behavioral2/memory/4732-211-0x00007FF642360000-0x00007FF6426B1000-memory.dmp	upx
behavioral2/memory/4708-207-0x00007FF6B5E90000-0x00007FF6B61E1000-memory.dmp	upx
behavioral2/files/0x0007000000023251-198.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UsMGMjR.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\wpYQJYr.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\MEwRiDC.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\yvEBIYV.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\ZucSmdh.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\nAmZGFY.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\sdTVbkZ.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\gjJRjNy.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\nQrvFYS.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\sMNlTxu.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\lGnKZTC.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\lOsAwGf.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\GXCpdlz.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\wdTNLWP.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\aUVKKFA.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\RuLmPnb.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\eGhfcbu.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\dXMDdmt.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\zbnSwYl.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\wKyKMCz.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\wqhlRgE.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\oPELFtg.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\WAQdfET.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\dDgEFaz.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\rQEvKNo.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\ehhoQcu.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\DihGCoW.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\BaEQDWx.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\mDelidq.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\hqMhLaP.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\YgeZSkY.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\PBNTOwj.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\gQlzNQV.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\wrppGcp.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\yZjbrvm.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\aUEtnrC.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\uJhgdYs.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\XYmUsZK.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\fKMYwyX.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\QAUYVUS.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\uVEkAAD.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\CnPSZOu.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\TDrMVjV.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\fGXRvcB.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\AtEBlGt.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\kLvEIYf.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\cJIyiyR.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\MXQKWbx.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\SdmDgjN.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\nXvvcbL.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\iLWGEPk.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\LOHxAWR.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\ppbyFBQ.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\uAVHRqX.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\EDMJKod.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\iKTIall.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\uJpIJfS.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\LiHkxgg.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\jtIVGaU.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\kvwVHmQ.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\GSyiZZN.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\cJsWSWi.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\DXsJRdR.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
File created	C:\Windows\System\xsEsuMy.exe	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1568	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	93
PID 1620 wrote to memory of 1568	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	93
PID 1620 wrote to memory of 1132	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	94
PID 1620 wrote to memory of 1132	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	94
PID 1620 wrote to memory of 4100	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	95
PID 1620 wrote to memory of 4100	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	95
PID 1620 wrote to memory of 2752	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	96
PID 1620 wrote to memory of 2752	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	96
PID 1620 wrote to memory of 2028	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	97
PID 1620 wrote to memory of 2028	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	97
PID 1620 wrote to memory of 3464	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	98
PID 1620 wrote to memory of 3464	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	98
PID 1620 wrote to memory of 3036	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	99
PID 1620 wrote to memory of 3036	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	99
PID 1620 wrote to memory of 804	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	100
PID 1620 wrote to memory of 804	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	100
PID 1620 wrote to memory of 5100	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	101
PID 1620 wrote to memory of 5100	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	101
PID 1620 wrote to memory of 3184	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	102
PID 1620 wrote to memory of 3184	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	102
PID 1620 wrote to memory of 4988	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	103
PID 1620 wrote to memory of 4988	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	103
PID 1620 wrote to memory of 5048	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	104
PID 1620 wrote to memory of 5048	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	104
PID 1620 wrote to memory of 3032	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	105
PID 1620 wrote to memory of 3032	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	105
PID 1620 wrote to memory of 872	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	106
PID 1620 wrote to memory of 872	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	106
PID 1620 wrote to memory of 452	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	107
PID 1620 wrote to memory of 452	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	107
PID 1620 wrote to memory of 4780	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	108
PID 1620 wrote to memory of 4780	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	108
PID 1620 wrote to memory of 1700	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	109
PID 1620 wrote to memory of 1700	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	109
PID 1620 wrote to memory of 4428	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	110
PID 1620 wrote to memory of 4428	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	110
PID 1620 wrote to memory of 3328	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	111
PID 1620 wrote to memory of 3328	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	111
PID 1620 wrote to memory of 5044	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	112
PID 1620 wrote to memory of 5044	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	112
PID 1620 wrote to memory of 4716	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	113
PID 1620 wrote to memory of 4716	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	113
PID 1620 wrote to memory of 3640	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	114
PID 1620 wrote to memory of 3640	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	114
PID 1620 wrote to memory of 4700	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	115
PID 1620 wrote to memory of 4700	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	115
PID 1620 wrote to memory of 644	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	116
PID 1620 wrote to memory of 644	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	116
PID 1620 wrote to memory of 4708	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	117
PID 1620 wrote to memory of 4708	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	117
PID 1620 wrote to memory of 4732	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	118
PID 1620 wrote to memory of 4732	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	118
PID 1620 wrote to memory of 3792	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	119
PID 1620 wrote to memory of 3792	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	119
PID 1620 wrote to memory of 4856	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	120
PID 1620 wrote to memory of 4856	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	120
PID 1620 wrote to memory of 976	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	121
PID 1620 wrote to memory of 976	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	121
PID 1620 wrote to memory of 4488	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	122
PID 1620 wrote to memory of 4488	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	122
PID 1620 wrote to memory of 760	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	123
PID 1620 wrote to memory of 760	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	123
PID 1620 wrote to memory of 408	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	124
PID 1620 wrote to memory of 408	1620	4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4ca3f6913c1022a428e8dd57333c9ff0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\System\WGEwesz.exe
  C:\Windows\System\WGEwesz.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\IreCqnf.exe
  C:\Windows\System\IreCqnf.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\jRBRdCL.exe
  C:\Windows\System\jRBRdCL.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\CjJuDZY.exe
  C:\Windows\System\CjJuDZY.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\YrksMFf.exe
  C:\Windows\System\YrksMFf.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\WHHyYSC.exe
  C:\Windows\System\WHHyYSC.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\qKFhtPF.exe
  C:\Windows\System\qKFhtPF.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\AjozbIR.exe
  C:\Windows\System\AjozbIR.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\APFEXML.exe
  C:\Windows\System\APFEXML.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\DdsadIh.exe
  C:\Windows\System\DdsadIh.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\iSmexJe.exe
  C:\Windows\System\iSmexJe.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\WhwcMLb.exe
  C:\Windows\System\WhwcMLb.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\AYgrJAX.exe
  C:\Windows\System\AYgrJAX.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\ZtQUBOx.exe
  C:\Windows\System\ZtQUBOx.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\eSXeYkF.exe
  C:\Windows\System\eSXeYkF.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\mYmXzkO.exe
  C:\Windows\System\mYmXzkO.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\YsFyRxg.exe
  C:\Windows\System\YsFyRxg.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\CmjOXIR.exe
  C:\Windows\System\CmjOXIR.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\vQjPkvk.exe
  C:\Windows\System\vQjPkvk.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\ASHHTjm.exe
  C:\Windows\System\ASHHTjm.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\lCbZwwW.exe
  C:\Windows\System\lCbZwwW.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\BDxRxoE.exe
  C:\Windows\System\BDxRxoE.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\CCzajjp.exe
  C:\Windows\System\CCzajjp.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\jVBIKom.exe
  C:\Windows\System\jVBIKom.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\YgeZSkY.exe
  C:\Windows\System\YgeZSkY.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\BYhfwnf.exe
  C:\Windows\System\BYhfwnf.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\NedNLzM.exe
  C:\Windows\System\NedNLzM.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\fcUDbFV.exe
  C:\Windows\System\fcUDbFV.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\sCPdltk.exe
  C:\Windows\System\sCPdltk.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\NflATLy.exe
  C:\Windows\System\NflATLy.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\avUmutb.exe
  C:\Windows\System\avUmutb.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\HOnKxkF.exe
  C:\Windows\System\HOnKxkF.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\PHfmFCz.exe
  C:\Windows\System\PHfmFCz.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\WqJFnZi.exe
  C:\Windows\System\WqJFnZi.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\EUDCFHQ.exe
  C:\Windows\System\EUDCFHQ.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\azRzTNV.exe
  C:\Windows\System\azRzTNV.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\YPvFsLA.exe
  C:\Windows\System\YPvFsLA.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\dBTYKpj.exe
  C:\Windows\System\dBTYKpj.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\oTMnJIk.exe
  C:\Windows\System\oTMnJIk.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\RORsNfk.exe
  C:\Windows\System\RORsNfk.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\CQqslUU.exe
  C:\Windows\System\CQqslUU.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\UahfhBG.exe
  C:\Windows\System\UahfhBG.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\ficQdvr.exe
  C:\Windows\System\ficQdvr.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\kKdjATQ.exe
  C:\Windows\System\kKdjATQ.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\CplmgEv.exe
  C:\Windows\System\CplmgEv.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\RTNCmcC.exe
  C:\Windows\System\RTNCmcC.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\ktGQRpW.exe
  C:\Windows\System\ktGQRpW.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\jAATCBW.exe
  C:\Windows\System\jAATCBW.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\UDGIXrs.exe
  C:\Windows\System\UDGIXrs.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\wpCOHsN.exe
  C:\Windows\System\wpCOHsN.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\gdqZnsv.exe
  C:\Windows\System\gdqZnsv.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\sdTVbkZ.exe
  C:\Windows\System\sdTVbkZ.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\boBwChf.exe
  C:\Windows\System\boBwChf.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\UaTMlmp.exe
  C:\Windows\System\UaTMlmp.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\NcxHySs.exe
  C:\Windows\System\NcxHySs.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\CDCjGsl.exe
  C:\Windows\System\CDCjGsl.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\wXcSZVn.exe
  C:\Windows\System\wXcSZVn.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\QijFhvb.exe
  C:\Windows\System\QijFhvb.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\PmRVXEd.exe
  C:\Windows\System\PmRVXEd.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\skGSYig.exe
  C:\Windows\System\skGSYig.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\pOExVPp.exe
  C:\Windows\System\pOExVPp.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\NhNNHgE.exe
  C:\Windows\System\NhNNHgE.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\owOIjqE.exe
  C:\Windows\System\owOIjqE.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\DXsJRdR.exe
  C:\Windows\System\DXsJRdR.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\wdTNLWP.exe
  C:\Windows\System\wdTNLWP.exe
  2⤵
  PID:716
- C:\Windows\System\XyleiAp.exe
  C:\Windows\System\XyleiAp.exe
  2⤵
  PID:3960
- C:\Windows\System\jxmpqis.exe
  C:\Windows\System\jxmpqis.exe
  2⤵
  PID:2432
- C:\Windows\System\KwUGCKk.exe
  C:\Windows\System\KwUGCKk.exe
  2⤵
  PID:2664
- C:\Windows\System\xzNcdOj.exe
  C:\Windows\System\xzNcdOj.exe
  2⤵
  PID:4784
- C:\Windows\System\EDMJKod.exe
  C:\Windows\System\EDMJKod.exe
  2⤵
  PID:5128
- C:\Windows\System\OZAuHhi.exe
  C:\Windows\System\OZAuHhi.exe
  2⤵
  PID:5164
- C:\Windows\System\uwVzitH.exe
  C:\Windows\System\uwVzitH.exe
  2⤵
  PID:5196
- C:\Windows\System\pSeKLvO.exe
  C:\Windows\System\pSeKLvO.exe
  2⤵
  PID:5220
- C:\Windows\System\hBWDcIb.exe
  C:\Windows\System\hBWDcIb.exe
  2⤵
  PID:5244
- C:\Windows\System\JRRokmO.exe
  C:\Windows\System\JRRokmO.exe
  2⤵
  PID:5264
- C:\Windows\System\JnLyWHt.exe
  C:\Windows\System\JnLyWHt.exe
  2⤵
  PID:5316
- C:\Windows\System\PKmojFx.exe
  C:\Windows\System\PKmojFx.exe
  2⤵
  PID:5348
- C:\Windows\System\eXVzBgx.exe
  C:\Windows\System\eXVzBgx.exe
  2⤵
  PID:5364
- C:\Windows\System\gjJRjNy.exe
  C:\Windows\System\gjJRjNy.exe
  2⤵
  PID:5404
- C:\Windows\System\MiILeAu.exe
  C:\Windows\System\MiILeAu.exe
  2⤵
  PID:5432
- C:\Windows\System\SJDyFcG.exe
  C:\Windows\System\SJDyFcG.exe
  2⤵
  PID:5448
- C:\Windows\System\lvLBhwa.exe
  C:\Windows\System\lvLBhwa.exe
  2⤵
  PID:5488
- C:\Windows\System\QAUYVUS.exe
  C:\Windows\System\QAUYVUS.exe
  2⤵
  PID:5504
- C:\Windows\System\PHnwPBe.exe
  C:\Windows\System\PHnwPBe.exe
  2⤵
  PID:5540
- C:\Windows\System\AXBHypx.exe
  C:\Windows\System\AXBHypx.exe
  2⤵
  PID:5568
- C:\Windows\System\skRDiAg.exe
  C:\Windows\System\skRDiAg.exe
  2⤵
  PID:5588
- C:\Windows\System\UQfzZXE.exe
  C:\Windows\System\UQfzZXE.exe
  2⤵
  PID:5628
- C:\Windows\System\ETsUOXk.exe
  C:\Windows\System\ETsUOXk.exe
  2⤵
  PID:5660
- C:\Windows\System\vSbzifW.exe
  C:\Windows\System\vSbzifW.exe
  2⤵
  PID:5688
- C:\Windows\System\BQFsSEt.exe
  C:\Windows\System\BQFsSEt.exe
  2⤵
  PID:5704
- C:\Windows\System\YkCrxoZ.exe
  C:\Windows\System\YkCrxoZ.exe
  2⤵
  PID:5740
- C:\Windows\System\RFQpFdZ.exe
  C:\Windows\System\RFQpFdZ.exe
  2⤵
  PID:5760
- C:\Windows\System\WWzpsVG.exe
  C:\Windows\System\WWzpsVG.exe
  2⤵
  PID:5796
- C:\Windows\System\gMmjrpt.exe
  C:\Windows\System\gMmjrpt.exe
  2⤵
  PID:5816
- C:\Windows\System\ZhmAhwu.exe
  C:\Windows\System\ZhmAhwu.exe
  2⤵
  PID:5840
- C:\Windows\System\kZZlhmT.exe
  C:\Windows\System\kZZlhmT.exe
  2⤵
  PID:5888
- C:\Windows\System\gbKDSaM.exe
  C:\Windows\System\gbKDSaM.exe
  2⤵
  PID:5904
- C:\Windows\System\qzRClNi.exe
  C:\Windows\System\qzRClNi.exe
  2⤵
  PID:5940
- C:\Windows\System\ouFbHfT.exe
  C:\Windows\System\ouFbHfT.exe
  2⤵
  PID:5968
- C:\Windows\System\qiAnfhK.exe
  C:\Windows\System\qiAnfhK.exe
  2⤵
  PID:5984
- C:\Windows\System\XsfMhlg.exe
  C:\Windows\System\XsfMhlg.exe
  2⤵
  PID:6028
- C:\Windows\System\SmrcgJD.exe
  C:\Windows\System\SmrcgJD.exe
  2⤵
  PID:6044
- C:\Windows\System\KyyFWmo.exe
  C:\Windows\System\KyyFWmo.exe
  2⤵
  PID:6080
- C:\Windows\System\TlQtRaY.exe
  C:\Windows\System\TlQtRaY.exe
  2⤵
  PID:6100
- C:\Windows\System\ZSEbggC.exe
  C:\Windows\System\ZSEbggC.exe
  2⤵
  PID:6132
- C:\Windows\System\yrtacHz.exe
  C:\Windows\System\yrtacHz.exe
  2⤵
  PID:5124
- C:\Windows\System\QFKZgmn.exe
  C:\Windows\System\QFKZgmn.exe
  2⤵
  PID:3720
- C:\Windows\System\JcbPAEN.exe
  C:\Windows\System\JcbPAEN.exe
  2⤵
  PID:5236
- C:\Windows\System\mhYgjMP.exe
  C:\Windows\System\mhYgjMP.exe
  2⤵
  PID:5260
- C:\Windows\System\UsMGMjR.exe
  C:\Windows\System\UsMGMjR.exe
  2⤵
  PID:5332
- C:\Windows\System\VDpjxgY.exe
  C:\Windows\System\VDpjxgY.exe
  2⤵
  PID:5360
- C:\Windows\System\ImtaNOC.exe
  C:\Windows\System\ImtaNOC.exe
  2⤵
  PID:5396
- C:\Windows\System\iiYcvBD.exe
  C:\Windows\System\iiYcvBD.exe
  2⤵
  PID:5444
- C:\Windows\System\DoQWXnM.exe
  C:\Windows\System\DoQWXnM.exe
  2⤵
  PID:5640
- C:\Windows\System\xrMvtkb.exe
  C:\Windows\System\xrMvtkb.exe
  2⤵
  PID:3352
- C:\Windows\System\zbnSwYl.exe
  C:\Windows\System\zbnSwYl.exe
  2⤵
  PID:5776
- C:\Windows\System\odOebcu.exe
  C:\Windows\System\odOebcu.exe
  2⤵
  PID:5808
- C:\Windows\System\KZrqCsK.exe
  C:\Windows\System\KZrqCsK.exe
  2⤵
  PID:5900
- C:\Windows\System\EyXhDvu.exe
  C:\Windows\System\EyXhDvu.exe
  2⤵
  PID:5976
- C:\Windows\System\owDLEzd.exe
  C:\Windows\System\owDLEzd.exe
  2⤵
  PID:6016
- C:\Windows\System\JAedAIY.exe
  C:\Windows\System\JAedAIY.exe
  2⤵
  PID:6064
- C:\Windows\System\iKTIall.exe
  C:\Windows\System\iKTIall.exe
  2⤵
  PID:6112
- C:\Windows\System\QtVuIiO.exe
  C:\Windows\System\QtVuIiO.exe
  2⤵
  PID:5180
- C:\Windows\System\HAcWBSU.exe
  C:\Windows\System\HAcWBSU.exe
  2⤵
  PID:5280
- C:\Windows\System\cJIyiyR.exe
  C:\Windows\System\cJIyiyR.exe
  2⤵
  PID:5256
- C:\Windows\System\VCNKlOl.exe
  C:\Windows\System\VCNKlOl.exe
  2⤵
  PID:5624
- C:\Windows\System\KcEeaAA.exe
  C:\Windows\System\KcEeaAA.exe
  2⤵
  PID:3904
- C:\Windows\System\anaqsoP.exe
  C:\Windows\System\anaqsoP.exe
  2⤵
  PID:5720
- C:\Windows\System\wSeCQsS.exe
  C:\Windows\System\wSeCQsS.exe
  2⤵
  PID:5920
- C:\Windows\System\kdebFLG.exe
  C:\Windows\System\kdebFLG.exe
  2⤵
  PID:4648
- C:\Windows\System\XRNfChl.exe
  C:\Windows\System\XRNfChl.exe
  2⤵
  PID:4928
- C:\Windows\System\dQDyisF.exe
  C:\Windows\System\dQDyisF.exe
  2⤵
  PID:5400
- C:\Windows\System\jgodxBH.exe
  C:\Windows\System\jgodxBH.exe
  2⤵
  PID:5856
- C:\Windows\System\JFRQAWt.exe
  C:\Windows\System\JFRQAWt.exe
  2⤵
  PID:2456
- C:\Windows\System\MXQKWbx.exe
  C:\Windows\System\MXQKWbx.exe
  2⤵
  PID:5580
- C:\Windows\System\QZNkUYC.exe
  C:\Windows\System\QZNkUYC.exe
  2⤵
  PID:5272
- C:\Windows\System\BTuPUrz.exe
  C:\Windows\System\BTuPUrz.exe
  2⤵
  PID:6140
- C:\Windows\System\WOStSAQ.exe
  C:\Windows\System\WOStSAQ.exe
  2⤵
  PID:6164
- C:\Windows\System\wJenybi.exe
  C:\Windows\System\wJenybi.exe
  2⤵
  PID:6184
- C:\Windows\System\cszcIoF.exe
  C:\Windows\System\cszcIoF.exe
  2⤵
  PID:6232
- C:\Windows\System\DRaOwgH.exe
  C:\Windows\System\DRaOwgH.exe
  2⤵
  PID:6256
- C:\Windows\System\bAaxWLP.exe
  C:\Windows\System\bAaxWLP.exe
  2⤵
  PID:6276
- C:\Windows\System\BaEQDWx.exe
  C:\Windows\System\BaEQDWx.exe
  2⤵
  PID:6308
- C:\Windows\System\ItUVZLF.exe
  C:\Windows\System\ItUVZLF.exe
  2⤵
  PID:6332
- C:\Windows\System\TFpemBK.exe
  C:\Windows\System\TFpemBK.exe
  2⤵
  PID:6352
- C:\Windows\System\lwKyGyI.exe
  C:\Windows\System\lwKyGyI.exe
  2⤵
  PID:6372
- C:\Windows\System\SdmDgjN.exe
  C:\Windows\System\SdmDgjN.exe
  2⤵
  PID:6392
- C:\Windows\System\piTZInb.exe
  C:\Windows\System\piTZInb.exe
  2⤵
  PID:6412
- C:\Windows\System\wNcrrSk.exe
  C:\Windows\System\wNcrrSk.exe
  2⤵
  PID:6428
- C:\Windows\System\WAQdfET.exe
  C:\Windows\System\WAQdfET.exe
  2⤵
  PID:6452
- C:\Windows\System\hNuHcIC.exe
  C:\Windows\System\hNuHcIC.exe
  2⤵
  PID:6476
- C:\Windows\System\mDelidq.exe
  C:\Windows\System\mDelidq.exe
  2⤵
  PID:6492
- C:\Windows\System\dOrcbKJ.exe
  C:\Windows\System\dOrcbKJ.exe
  2⤵
  PID:6512
- C:\Windows\System\hwseHjL.exe
  C:\Windows\System\hwseHjL.exe
  2⤵
  PID:6528
- C:\Windows\System\wXiPWoP.exe
  C:\Windows\System\wXiPWoP.exe
  2⤵
  PID:6544
- C:\Windows\System\FtwCcZo.exe
  C:\Windows\System\FtwCcZo.exe
  2⤵
  PID:6564
- C:\Windows\System\xbwfnzZ.exe
  C:\Windows\System\xbwfnzZ.exe
  2⤵
  PID:6588
- C:\Windows\System\uzMBsrx.exe
  C:\Windows\System\uzMBsrx.exe
  2⤵
  PID:6604
- C:\Windows\System\TefhQwD.exe
  C:\Windows\System\TefhQwD.exe
  2⤵
  PID:6620
- C:\Windows\System\OZGFIWJ.exe
  C:\Windows\System\OZGFIWJ.exe
  2⤵
  PID:6644
- C:\Windows\System\AOZwoCA.exe
  C:\Windows\System\AOZwoCA.exe
  2⤵
  PID:6660
- C:\Windows\System\QVgYiIV.exe
  C:\Windows\System\QVgYiIV.exe
  2⤵
  PID:6680
- C:\Windows\System\tVBthoC.exe
  C:\Windows\System\tVBthoC.exe
  2⤵
  PID:6700
- C:\Windows\System\EbYrnJJ.exe
  C:\Windows\System\EbYrnJJ.exe
  2⤵
  PID:6720
- C:\Windows\System\cwxMEdg.exe
  C:\Windows\System\cwxMEdg.exe
  2⤵
  PID:6744
- C:\Windows\System\nVkrjFc.exe
  C:\Windows\System\nVkrjFc.exe
  2⤵
  PID:6768
- C:\Windows\System\CTTAroq.exe
  C:\Windows\System\CTTAroq.exe
  2⤵
  PID:6784
- C:\Windows\System\GgZkZlI.exe
  C:\Windows\System\GgZkZlI.exe
  2⤵
  PID:6804
- C:\Windows\System\DWfGLIO.exe
  C:\Windows\System\DWfGLIO.exe
  2⤵
  PID:6824
- C:\Windows\System\ZMkLOcJ.exe
  C:\Windows\System\ZMkLOcJ.exe
  2⤵
  PID:6844
- C:\Windows\System\WJWvJsL.exe
  C:\Windows\System\WJWvJsL.exe
  2⤵
  PID:6868
- C:\Windows\System\aUVKKFA.exe
  C:\Windows\System\aUVKKFA.exe
  2⤵
  PID:6884
- C:\Windows\System\mytvamj.exe
  C:\Windows\System\mytvamj.exe
  2⤵
  PID:6904
- C:\Windows\System\ytrazWC.exe
  C:\Windows\System\ytrazWC.exe
  2⤵
  PID:6924
- C:\Windows\System\ysHdakF.exe
  C:\Windows\System\ysHdakF.exe
  2⤵
  PID:6940
- C:\Windows\System\DdMneuN.exe
  C:\Windows\System\DdMneuN.exe
  2⤵
  PID:6960
- C:\Windows\System\iCOQgLA.exe
  C:\Windows\System\iCOQgLA.exe
  2⤵
  PID:6984
- C:\Windows\System\kcfrNIU.exe
  C:\Windows\System\kcfrNIU.exe
  2⤵
  PID:7004
- C:\Windows\System\rqLnGGI.exe
  C:\Windows\System\rqLnGGI.exe
  2⤵
  PID:7024
- C:\Windows\System\UgobJJA.exe
  C:\Windows\System\UgobJJA.exe
  2⤵
  PID:7044
- C:\Windows\System\znoEcqN.exe
  C:\Windows\System\znoEcqN.exe
  2⤵
  PID:7060
- C:\Windows\System\vSWocPZ.exe
  C:\Windows\System\vSWocPZ.exe
  2⤵
  PID:7088
- C:\Windows\System\SBAoAQf.exe
  C:\Windows\System\SBAoAQf.exe
  2⤵
  PID:7104
- C:\Windows\System\GeNhasK.exe
  C:\Windows\System\GeNhasK.exe
  2⤵
  PID:7124
- C:\Windows\System\RnpsYfS.exe
  C:\Windows\System\RnpsYfS.exe
  2⤵
  PID:7144
- C:\Windows\System\pmktrhk.exe
  C:\Windows\System\pmktrhk.exe
  2⤵
  PID:7164
- C:\Windows\System\jsAstwr.exe
  C:\Windows\System\jsAstwr.exe
  2⤵
  PID:6172
- C:\Windows\System\dkqFqWl.exe
  C:\Windows\System\dkqFqWl.exe
  2⤵
  PID:6204
- C:\Windows\System\PQLMrDt.exe
  C:\Windows\System\PQLMrDt.exe
  2⤵
  PID:6268
- C:\Windows\System\FoUSJwd.exe
  C:\Windows\System\FoUSJwd.exe
  2⤵
  PID:6304
- C:\Windows\System\jiFbGKe.exe
  C:\Windows\System\jiFbGKe.exe
  2⤵
  PID:6488
- C:\Windows\System\PjxJrla.exe
  C:\Windows\System\PjxJrla.exe
  2⤵
  PID:6472
- C:\Windows\System\vLaDjyW.exe
  C:\Windows\System\vLaDjyW.exe
  2⤵
  PID:6508
- C:\Windows\System\ixuyEBQ.exe
  C:\Windows\System\ixuyEBQ.exe
  2⤵
  PID:6672
- C:\Windows\System\lKyORCC.exe
  C:\Windows\System\lKyORCC.exe
  2⤵
  PID:6792
- C:\Windows\System\nTKGHrB.exe
  C:\Windows\System\nTKGHrB.exe
  2⤵
  PID:6776
- C:\Windows\System\aVpAYGb.exe
  C:\Windows\System\aVpAYGb.exe
  2⤵
  PID:6832
- C:\Windows\System\luqDDdI.exe
  C:\Windows\System\luqDDdI.exe
  2⤵
  PID:6708
- C:\Windows\System\bPfqiha.exe
  C:\Windows\System\bPfqiha.exe
  2⤵
  PID:6584
- C:\Windows\System\UjngFmc.exe
  C:\Windows\System\UjngFmc.exe
  2⤵
  PID:6616
- C:\Windows\System\hvfoaDa.exe
  C:\Windows\System\hvfoaDa.exe
  2⤵
  PID:6936
- C:\Windows\System\zogcnqJ.exe
  C:\Windows\System\zogcnqJ.exe
  2⤵
  PID:6876
- C:\Windows\System\xCpgAZW.exe
  C:\Windows\System\xCpgAZW.exe
  2⤵
  PID:7032
- C:\Windows\System\yAsJEuf.exe
  C:\Windows\System\yAsJEuf.exe
  2⤵
  PID:7116
- C:\Windows\System\ApAeIem.exe
  C:\Windows\System\ApAeIem.exe
  2⤵
  PID:7160
- C:\Windows\System\GHvjYvP.exe
  C:\Windows\System\GHvjYvP.exe
  2⤵
  PID:6288
- C:\Windows\System\RIfqBhn.exe
  C:\Windows\System\RIfqBhn.exe
  2⤵
  PID:6976
- C:\Windows\System\dAmoiwV.exe
  C:\Windows\System\dAmoiwV.exe
  2⤵
  PID:7020
- C:\Windows\System\LbsOPxA.exe
  C:\Windows\System\LbsOPxA.exe
  2⤵
  PID:7188
- C:\Windows\System\eTrEPyJ.exe
  C:\Windows\System\eTrEPyJ.exe
  2⤵
  PID:7208
- C:\Windows\System\dqnnjVY.exe
  C:\Windows\System\dqnnjVY.exe
  2⤵
  PID:7224
- C:\Windows\System\WBcVPxP.exe
  C:\Windows\System\WBcVPxP.exe
  2⤵
  PID:7248
- C:\Windows\System\SnaBixj.exe
  C:\Windows\System\SnaBixj.exe
  2⤵
  PID:7264
- C:\Windows\System\Lewvqhf.exe
  C:\Windows\System\Lewvqhf.exe
  2⤵
  PID:7288
- C:\Windows\System\RUVvoCx.exe
  C:\Windows\System\RUVvoCx.exe
  2⤵
  PID:7312
- C:\Windows\System\xTtMJBE.exe
  C:\Windows\System\xTtMJBE.exe
  2⤵
  PID:7332
- C:\Windows\System\jkMxptP.exe
  C:\Windows\System\jkMxptP.exe
  2⤵
  PID:7348
- C:\Windows\System\mxcGrEC.exe
  C:\Windows\System\mxcGrEC.exe
  2⤵
  PID:7368
- C:\Windows\System\BbzNGiQ.exe
  C:\Windows\System\BbzNGiQ.exe
  2⤵
  PID:7384
- C:\Windows\System\tUsrwiI.exe
  C:\Windows\System\tUsrwiI.exe
  2⤵
  PID:7408
- C:\Windows\System\KVIqlgf.exe
  C:\Windows\System\KVIqlgf.exe
  2⤵
  PID:7432
- C:\Windows\System\Txlnjuw.exe
  C:\Windows\System\Txlnjuw.exe
  2⤵
  PID:7448
- C:\Windows\System\AudDtZe.exe
  C:\Windows\System\AudDtZe.exe
  2⤵
  PID:7472
- C:\Windows\System\pJobWVo.exe
  C:\Windows\System\pJobWVo.exe
  2⤵
  PID:7488
- C:\Windows\System\OgccXHx.exe
  C:\Windows\System\OgccXHx.exe
  2⤵
  PID:7512
- C:\Windows\System\WvsAatt.exe
  C:\Windows\System\WvsAatt.exe
  2⤵
  PID:7532
- C:\Windows\System\jgjBSdh.exe
  C:\Windows\System\jgjBSdh.exe
  2⤵
  PID:7552
- C:\Windows\System\CnPSZOu.exe
  C:\Windows\System\CnPSZOu.exe
  2⤵
  PID:7572
- C:\Windows\System\JmpKjkQ.exe
  C:\Windows\System\JmpKjkQ.exe
  2⤵
  PID:7588
- C:\Windows\System\XPFJjTk.exe
  C:\Windows\System\XPFJjTk.exe
  2⤵
  PID:7608
- C:\Windows\System\OToWWrq.exe
  C:\Windows\System\OToWWrq.exe
  2⤵
  PID:7632
- C:\Windows\System\TZEkUCJ.exe
  C:\Windows\System\TZEkUCJ.exe
  2⤵
  PID:7648
- C:\Windows\System\AWVdQwc.exe
  C:\Windows\System\AWVdQwc.exe
  2⤵
  PID:7676
- C:\Windows\System\EmJhSTq.exe
  C:\Windows\System\EmJhSTq.exe
  2⤵
  PID:7704
- C:\Windows\System\hygrGwT.exe
  C:\Windows\System\hygrGwT.exe
  2⤵
  PID:7720
- C:\Windows\System\hzLtcXd.exe
  C:\Windows\System\hzLtcXd.exe
  2⤵
  PID:7740
- C:\Windows\System\QMYgoUP.exe
  C:\Windows\System\QMYgoUP.exe
  2⤵
  PID:7760
- C:\Windows\System\LLDigGO.exe
  C:\Windows\System\LLDigGO.exe
  2⤵
  PID:7780
- C:\Windows\System\OHerkNb.exe
  C:\Windows\System\OHerkNb.exe
  2⤵
  PID:7808
- C:\Windows\System\mBNJzBZ.exe
  C:\Windows\System\mBNJzBZ.exe
  2⤵
  PID:7828
- C:\Windows\System\KGFEzKr.exe
  C:\Windows\System\KGFEzKr.exe
  2⤵
  PID:7844
- C:\Windows\System\pQSCbUs.exe
  C:\Windows\System\pQSCbUs.exe
  2⤵
  PID:7864
- C:\Windows\System\faFUbrO.exe
  C:\Windows\System\faFUbrO.exe
  2⤵
  PID:7884
- C:\Windows\System\FIkPotc.exe
  C:\Windows\System\FIkPotc.exe
  2⤵
  PID:7904
- C:\Windows\System\fFhxnjx.exe
  C:\Windows\System\fFhxnjx.exe
  2⤵
  PID:7920
- C:\Windows\System\wKyKMCz.exe
  C:\Windows\System\wKyKMCz.exe
  2⤵
  PID:7940
- C:\Windows\System\EcCSzGB.exe
  C:\Windows\System\EcCSzGB.exe
  2⤵
  PID:7960
- C:\Windows\System\qYqVqcW.exe
  C:\Windows\System\qYqVqcW.exe
  2⤵
  PID:7976
- C:\Windows\System\YBkaBLP.exe
  C:\Windows\System\YBkaBLP.exe
  2⤵
  PID:7996
- C:\Windows\System\xsEsuMy.exe
  C:\Windows\System\xsEsuMy.exe
  2⤵
  PID:8020
- C:\Windows\System\mYwVIDF.exe
  C:\Windows\System\mYwVIDF.exe
  2⤵
  PID:8036
- C:\Windows\System\WtZUtMJ.exe
  C:\Windows\System\WtZUtMJ.exe
  2⤵
  PID:8060
- C:\Windows\System\MwQtCby.exe
  C:\Windows\System\MwQtCby.exe
  2⤵
  PID:8076
- C:\Windows\System\wCDJOoD.exe
  C:\Windows\System\wCDJOoD.exe
  2⤵
  PID:8096
- C:\Windows\System\QDTcnNS.exe
  C:\Windows\System\QDTcnNS.exe
  2⤵
  PID:8112
- C:\Windows\System\pLTCdmc.exe
  C:\Windows\System\pLTCdmc.exe
  2⤵
  PID:8132
- C:\Windows\System\qWRruNh.exe
  C:\Windows\System\qWRruNh.exe
  2⤵
  PID:8148
- C:\Windows\System\JqnfCCp.exe
  C:\Windows\System\JqnfCCp.exe
  2⤵
  PID:8172
- C:\Windows\System\EotfryL.exe
  C:\Windows\System\EotfryL.exe
  2⤵
  PID:7120
- C:\Windows\System\BYuZFiA.exe
  C:\Windows\System\BYuZFiA.exe
  2⤵
  PID:6524
- C:\Windows\System\iHAFqun.exe
  C:\Windows\System\iHAFqun.exe
  2⤵
  PID:6556
- C:\Windows\System\YeXVIZZ.exe
  C:\Windows\System\YeXVIZZ.exe
  2⤵
  PID:6668
- C:\Windows\System\QufivQx.exe
  C:\Windows\System\QufivQx.exe
  2⤵
  PID:6316
- C:\Windows\System\VhUZaaS.exe
  C:\Windows\System\VhUZaaS.exe
  2⤵
  PID:7180
- C:\Windows\System\LiHkxgg.exe
  C:\Windows\System\LiHkxgg.exe
  2⤵
  PID:6368
- C:\Windows\System\tHMBXXz.exe
  C:\Windows\System\tHMBXXz.exe
  2⤵
  PID:7324
- C:\Windows\System\nXvvcbL.exe
  C:\Windows\System\nXvvcbL.exe
  2⤵
  PID:7380
- C:\Windows\System\XvsKdlj.exe
  C:\Windows\System\XvsKdlj.exe
  2⤵
  PID:7480
- C:\Windows\System\WlJoUjg.exe
  C:\Windows\System\WlJoUjg.exe
  2⤵
  PID:7524
- C:\Windows\System\UFJkzfF.exe
  C:\Windows\System\UFJkzfF.exe
  2⤵
  PID:7584
- C:\Windows\System\sRekbIO.exe
  C:\Windows\System\sRekbIO.exe
  2⤵
  PID:8204
- C:\Windows\System\fgSVfIx.exe
  C:\Windows\System\fgSVfIx.exe
  2⤵
  PID:8220
- C:\Windows\System\mrudmzE.exe
  C:\Windows\System\mrudmzE.exe
  2⤵
  PID:8240
- C:\Windows\System\FlqZmZz.exe
  C:\Windows\System\FlqZmZz.exe
  2⤵
  PID:8256
- C:\Windows\System\VgmaNhs.exe
  C:\Windows\System\VgmaNhs.exe
  2⤵
  PID:8284
- C:\Windows\System\qKIVqlQ.exe
  C:\Windows\System\qKIVqlQ.exe
  2⤵
  PID:8300
- C:\Windows\System\IaqglTS.exe
  C:\Windows\System\IaqglTS.exe
  2⤵
  PID:8316
- C:\Windows\System\PsJYWDR.exe
  C:\Windows\System\PsJYWDR.exe
  2⤵
  PID:8336
- C:\Windows\System\PBNTOwj.exe
  C:\Windows\System\PBNTOwj.exe
  2⤵
  PID:8356
- C:\Windows\System\FfzoQkj.exe
  C:\Windows\System\FfzoQkj.exe
  2⤵
  PID:8388
- C:\Windows\System\XyRRdRb.exe
  C:\Windows\System\XyRRdRb.exe
  2⤵
  PID:8404
- C:\Windows\System\VOjTKtA.exe
  C:\Windows\System\VOjTKtA.exe
  2⤵
  PID:8424
- C:\Windows\System\TDrMVjV.exe
  C:\Windows\System\TDrMVjV.exe
  2⤵
  PID:8444
- C:\Windows\System\wpYQJYr.exe
  C:\Windows\System\wpYQJYr.exe
  2⤵
  PID:8464
- C:\Windows\System\rravazR.exe
  C:\Windows\System\rravazR.exe
  2⤵
  PID:8488
- C:\Windows\System\ziyMWWV.exe
  C:\Windows\System\ziyMWWV.exe
  2⤵
  PID:8504
- C:\Windows\System\kgLozOH.exe
  C:\Windows\System\kgLozOH.exe
  2⤵
  PID:8532
- C:\Windows\System\FiJuPHT.exe
  C:\Windows\System\FiJuPHT.exe
  2⤵
  PID:8552
- C:\Windows\System\doEccFl.exe
  C:\Windows\System\doEccFl.exe
  2⤵
  PID:8572
- C:\Windows\System\aaLtWhl.exe
  C:\Windows\System\aaLtWhl.exe
  2⤵
  PID:8588
- C:\Windows\System\foDzVoo.exe
  C:\Windows\System\foDzVoo.exe
  2⤵
  PID:8604
- C:\Windows\System\LevRbfF.exe
  C:\Windows\System\LevRbfF.exe
  2⤵
  PID:8624
- C:\Windows\System\EwTioxk.exe
  C:\Windows\System\EwTioxk.exe
  2⤵
  PID:8640
- C:\Windows\System\GUefkYO.exe
  C:\Windows\System\GUefkYO.exe
  2⤵
  PID:8664
- C:\Windows\System\cJOLZGI.exe
  C:\Windows\System\cJOLZGI.exe
  2⤵
  PID:8684
- C:\Windows\System\gZxuKGJ.exe
  C:\Windows\System\gZxuKGJ.exe
  2⤵
  PID:8704
- C:\Windows\System\oYEfJeF.exe
  C:\Windows\System\oYEfJeF.exe
  2⤵
  PID:8724
- C:\Windows\System\RVdhOZU.exe
  C:\Windows\System\RVdhOZU.exe
  2⤵
  PID:8748
- C:\Windows\System\unFdGGc.exe
  C:\Windows\System\unFdGGc.exe
  2⤵
  PID:8764
- C:\Windows\System\ERNgwWc.exe
  C:\Windows\System\ERNgwWc.exe
  2⤵
  PID:8788
- C:\Windows\System\OfWTFYc.exe
  C:\Windows\System\OfWTFYc.exe
  2⤵
  PID:8804
- C:\Windows\System\ftGBtrf.exe
  C:\Windows\System\ftGBtrf.exe
  2⤵
  PID:8820
- C:\Windows\System\BpdhTyU.exe
  C:\Windows\System\BpdhTyU.exe
  2⤵
  PID:8840
- C:\Windows\System\yVVAoSh.exe
  C:\Windows\System\yVVAoSh.exe
  2⤵
  PID:8856
- C:\Windows\System\dgbXeCA.exe
  C:\Windows\System\dgbXeCA.exe
  2⤵
  PID:8876
- C:\Windows\System\EpKrALM.exe
  C:\Windows\System\EpKrALM.exe
  2⤵
  PID:8896
- C:\Windows\System\YmRrebn.exe
  C:\Windows\System\YmRrebn.exe
  2⤵
  PID:9188
- C:\Windows\System\hChHArD.exe
  C:\Windows\System\hChHArD.exe
  2⤵
  PID:7376
- C:\Windows\System\kNobpOs.exe
  C:\Windows\System\kNobpOs.exe
  2⤵
  PID:7440
- C:\Windows\System\UsnXcuu.exe
  C:\Windows\System\UsnXcuu.exe
  2⤵
  PID:7136
- C:\Windows\System\EQHLPFa.exe
  C:\Windows\System\EQHLPFa.exe
  2⤵
  PID:6740
- C:\Windows\System\ffBeGGX.exe
  C:\Windows\System\ffBeGGX.exe
  2⤵
  PID:7604
- C:\Windows\System\ymGlGwS.exe
  C:\Windows\System\ymGlGwS.exe
  2⤵
  PID:8196
- C:\Windows\System\uCuQFmV.exe
  C:\Windows\System\uCuQFmV.exe
  2⤵
  PID:7696
- C:\Windows\System\jZLbbau.exe
  C:\Windows\System\jZLbbau.exe
  2⤵
  PID:6224
- C:\Windows\System\imvrtSD.exe
  C:\Windows\System\imvrtSD.exe
  2⤵
  PID:8384
- C:\Windows\System\eJDTtKO.exe
  C:\Windows\System\eJDTtKO.exe
  2⤵
  PID:7204
- C:\Windows\System\qKeIvUO.exe
  C:\Windows\System\qKeIvUO.exe
  2⤵
  PID:7836
- C:\Windows\System\YONJVcM.exe
  C:\Windows\System\YONJVcM.exe
  2⤵
  PID:8584
- C:\Windows\System\HwXQdxP.exe
  C:\Windows\System\HwXQdxP.exe
  2⤵
  PID:8660
- C:\Windows\System\vgVnPRy.exe
  C:\Windows\System\vgVnPRy.exe
  2⤵
  PID:8720
- C:\Windows\System\pPbRylD.exe
  C:\Windows\System\pPbRylD.exe
  2⤵
  PID:7968
- C:\Windows\System\Aeypkcc.exe
  C:\Windows\System\Aeypkcc.exe
  2⤵
  PID:8168
- C:\Windows\System\hwpcQKk.exe
  C:\Windows\System\hwpcQKk.exe
  2⤵
  PID:6244
- C:\Windows\System\HpikDJD.exe
  C:\Windows\System\HpikDJD.exe
  2⤵
  PID:7340
- C:\Windows\System\rQEvKNo.exe
  C:\Windows\System\rQEvKNo.exe
  2⤵
  PID:7580
- C:\Windows\System\gYKhlom.exe
  C:\Windows\System\gYKhlom.exe
  2⤵
  PID:8312
- C:\Windows\System\zRWMRZt.exe
  C:\Windows\System\zRWMRZt.exe
  2⤵
  PID:8400
- C:\Windows\System\dDgEFaz.exe
  C:\Windows\System\dDgEFaz.exe
  2⤵
  PID:8472
- C:\Windows\System\Rqywzeg.exe
  C:\Windows\System\Rqywzeg.exe
  2⤵
  PID:7916
- C:\Windows\System\yMyboXP.exe
  C:\Windows\System\yMyboXP.exe
  2⤵
  PID:7952
- C:\Windows\System\rUIeEwN.exe
  C:\Windows\System\rUIeEwN.exe
  2⤵
  PID:8292
- C:\Windows\System\BFfcqqL.exe
  C:\Windows\System\BFfcqqL.exe
  2⤵
  PID:8828
- C:\Windows\System\GiCNHcq.exe
  C:\Windows\System\GiCNHcq.exe
  2⤵
  PID:8144
- C:\Windows\System\TAkGnTk.exe
  C:\Windows\System\TAkGnTk.exe
  2⤵
  PID:7444
- C:\Windows\System\CEkjGGk.exe
  C:\Windows\System\CEkjGGk.exe
  2⤵
  PID:8252
- C:\Windows\System\BXJkzhf.exe
  C:\Windows\System\BXJkzhf.exe
  2⤵
  PID:8440
- C:\Windows\System\kNIGxvN.exe
  C:\Windows\System\kNIGxvN.exe
  2⤵
  PID:8568
- C:\Windows\System\LrnpOAb.exe
  C:\Windows\System\LrnpOAb.exe
  2⤵
  PID:8832
- C:\Windows\System\lJptDds.exe
  C:\Windows\System\lJptDds.exe
  2⤵
  PID:8904
- C:\Windows\System\wWLBrXd.exe
  C:\Windows\System\wWLBrXd.exe
  2⤵
  PID:9232
- C:\Windows\System\eDhRvhS.exe
  C:\Windows\System\eDhRvhS.exe
  2⤵
  PID:9272
- C:\Windows\System\mVtOkvG.exe
  C:\Windows\System\mVtOkvG.exe
  2⤵
  PID:9292
- C:\Windows\System\LQXatqV.exe
  C:\Windows\System\LQXatqV.exe
  2⤵
  PID:9320
- C:\Windows\System\zyZNRuN.exe
  C:\Windows\System\zyZNRuN.exe
  2⤵
  PID:9340
- C:\Windows\System\FxsakMP.exe
  C:\Windows\System\FxsakMP.exe
  2⤵
  PID:9356
- C:\Windows\System\GQVdTDn.exe
  C:\Windows\System\GQVdTDn.exe
  2⤵
  PID:9372
- C:\Windows\System\CAFMMmc.exe
  C:\Windows\System\CAFMMmc.exe
  2⤵
  PID:9388
- C:\Windows\System\iGiiilE.exe
  C:\Windows\System\iGiiilE.exe
  2⤵
  PID:9404
- C:\Windows\System\jtIVGaU.exe
  C:\Windows\System\jtIVGaU.exe
  2⤵
  PID:9424
- C:\Windows\System\LhBQSou.exe
  C:\Windows\System\LhBQSou.exe
  2⤵
  PID:9452
- C:\Windows\System\rvszjPC.exe
  C:\Windows\System\rvszjPC.exe
  2⤵
  PID:9476
- C:\Windows\System\iXkohrj.exe
  C:\Windows\System\iXkohrj.exe
  2⤵
  PID:9492
- C:\Windows\System\qBQEwzZ.exe
  C:\Windows\System\qBQEwzZ.exe
  2⤵
  PID:9520
- C:\Windows\System\jFSiUqr.exe
  C:\Windows\System\jFSiUqr.exe
  2⤵
  PID:9544
- C:\Windows\System\fvmsjRb.exe
  C:\Windows\System\fvmsjRb.exe
  2⤵
  PID:9564
- C:\Windows\System\cPEfldp.exe
  C:\Windows\System\cPEfldp.exe
  2⤵
  PID:9580
- C:\Windows\System\MEwRiDC.exe
  C:\Windows\System\MEwRiDC.exe
  2⤵
  PID:9600
- C:\Windows\System\eeoFyCw.exe
  C:\Windows\System\eeoFyCw.exe
  2⤵
  PID:9620
- C:\Windows\System\vnBWXEm.exe
  C:\Windows\System\vnBWXEm.exe
  2⤵
  PID:9636
- C:\Windows\System\rkjFIYD.exe
  C:\Windows\System\rkjFIYD.exe
  2⤵
  PID:9656
- C:\Windows\System\zFiyRdR.exe
  C:\Windows\System\zFiyRdR.exe
  2⤵
  PID:9676
- C:\Windows\System\vRrAhAg.exe
  C:\Windows\System\vRrAhAg.exe
  2⤵
  PID:9692
- C:\Windows\System\aWUaBxi.exe
  C:\Windows\System\aWUaBxi.exe
  2⤵
  PID:9712
- C:\Windows\System\mWVDkiY.exe
  C:\Windows\System\mWVDkiY.exe
  2⤵
  PID:9732
- C:\Windows\System\ehhoQcu.exe
  C:\Windows\System\ehhoQcu.exe
  2⤵
  PID:10060
- C:\Windows\System\nVEjHYb.exe
  C:\Windows\System\nVEjHYb.exe
  2⤵
  PID:10080
- C:\Windows\System\Auiyrqw.exe
  C:\Windows\System\Auiyrqw.exe
  2⤵
  PID:10096
- C:\Windows\System\TQyFTHU.exe
  C:\Windows\System\TQyFTHU.exe
  2⤵
  PID:10124
- C:\Windows\System\YvgOcwP.exe
  C:\Windows\System\YvgOcwP.exe
  2⤵
  PID:10144
- C:\Windows\System\SDzQFls.exe
  C:\Windows\System\SDzQFls.exe
  2⤵
  PID:10160
- C:\Windows\System\bzlCBtY.exe
  C:\Windows\System\bzlCBtY.exe
  2⤵
  PID:10196
- C:\Windows\System\XdFCDPv.exe
  C:\Windows\System\XdFCDPv.exe
  2⤵
  PID:10212
- C:\Windows\System\mxPXOrs.exe
  C:\Windows\System\mxPXOrs.exe
  2⤵
  PID:10232
- C:\Windows\System\AAZwsYl.exe
  C:\Windows\System\AAZwsYl.exe
  2⤵
  PID:8940
- C:\Windows\System\BLZNNPL.exe
  C:\Windows\System\BLZNNPL.exe
  2⤵
  PID:8432
- C:\Windows\System\fhBayNT.exe
  C:\Windows\System\fhBayNT.exe
  2⤵
  PID:7624
- C:\Windows\System\FkFmbaX.exe
  C:\Windows\System\FkFmbaX.exe
  2⤵
  PID:6716
- C:\Windows\System\gKIyRXk.exe
  C:\Windows\System\gKIyRXk.exe
  2⤵
  PID:8084
- C:\Windows\System\WBRJicn.exe
  C:\Windows\System\WBRJicn.exe
  2⤵
  PID:8612
- C:\Windows\System\RuLmPnb.exe
  C:\Windows\System\RuLmPnb.exe
  2⤵
  PID:6504
- C:\Windows\System\yEOPaoB.exe
  C:\Windows\System\yEOPaoB.exe
  2⤵
  PID:9260
- C:\Windows\System\Ogzhpok.exe
  C:\Windows\System\Ogzhpok.exe
  2⤵
  PID:9488
- C:\Windows\System\fWUEtWm.exe
  C:\Windows\System\fWUEtWm.exe
  2⤵
  PID:9172
- C:\Windows\System\ckwORGR.exe
  C:\Windows\System\ckwORGR.exe
  2⤵
  PID:9244
- C:\Windows\System\yxxdGTJ.exe
  C:\Windows\System\yxxdGTJ.exe
  2⤵
  PID:7220
- C:\Windows\System\JVuBltB.exe
  C:\Windows\System\JVuBltB.exe
  2⤵
  PID:8092
- C:\Windows\System\NvBONCi.exe
  C:\Windows\System\NvBONCi.exe
  2⤵
  PID:9304
- C:\Windows\System\eExofmM.exe
  C:\Windows\System\eExofmM.exe
  2⤵
  PID:6736
- C:\Windows\System\IwdFVmB.exe
  C:\Windows\System\IwdFVmB.exe
  2⤵
  PID:7936
- C:\Windows\System\PkuNMIV.exe
  C:\Windows\System\PkuNMIV.exe
  2⤵
  PID:7948
- C:\Windows\System\PYCUgeQ.exe
  C:\Windows\System\PYCUgeQ.exe
  2⤵
  PID:7392
- C:\Windows\System\qnJgCIN.exe
  C:\Windows\System\qnJgCIN.exe
  2⤵
  PID:7752
- C:\Windows\System\FWnIFMm.exe
  C:\Windows\System\FWnIFMm.exe
  2⤵
  PID:7856
- C:\Windows\System\CjUluxo.exe
  C:\Windows\System\CjUluxo.exe
  2⤵
  PID:7992
- C:\Windows\System\XvlHTba.exe
  C:\Windows\System\XvlHTba.exe
  2⤵
  PID:8128
- C:\Windows\System\yvEBIYV.exe
  C:\Windows\System\yvEBIYV.exe
  2⤵
  PID:7564
- C:\Windows\System\DlsWUaB.exe
  C:\Windows\System\DlsWUaB.exe
  2⤵
  PID:9664
- C:\Windows\System\oGYfgYk.exe
  C:\Windows\System\oGYfgYk.exe
  2⤵
  PID:9748
- C:\Windows\System\uJhgdYs.exe
  C:\Windows\System\uJhgdYs.exe
  2⤵
  PID:9268
- C:\Windows\System\WhjqoPf.exe
  C:\Windows\System\WhjqoPf.exe
  2⤵
  PID:9352
- C:\Windows\System\oJHpWgH.exe
  C:\Windows\System\oJHpWgH.exe
  2⤵
  PID:9884
- C:\Windows\System\ZymHbqi.exe
  C:\Windows\System\ZymHbqi.exe
  2⤵
  PID:10260
- C:\Windows\System\XYmUsZK.exe
  C:\Windows\System\XYmUsZK.exe
  2⤵
  PID:10280
- C:\Windows\System\FOjDFWB.exe
  C:\Windows\System\FOjDFWB.exe
  2⤵
  PID:10304
- C:\Windows\System\wqhlRgE.exe
  C:\Windows\System\wqhlRgE.exe
  2⤵
  PID:10320
- C:\Windows\System\bUxFUzo.exe
  C:\Windows\System\bUxFUzo.exe
  2⤵
  PID:10340
- C:\Windows\System\ROBuBOI.exe
  C:\Windows\System\ROBuBOI.exe
  2⤵
  PID:10356
- C:\Windows\System\JwKxDIh.exe
  C:\Windows\System\JwKxDIh.exe
  2⤵
  PID:10380
- C:\Windows\System\qcPztNS.exe
  C:\Windows\System\qcPztNS.exe
  2⤵
  PID:10404
- C:\Windows\System\yqNXJBE.exe
  C:\Windows\System\yqNXJBE.exe
  2⤵
  PID:10420
- C:\Windows\System\TjxETZH.exe
  C:\Windows\System\TjxETZH.exe
  2⤵
  PID:10444
- C:\Windows\System\BRQHyGb.exe
  C:\Windows\System\BRQHyGb.exe
  2⤵
  PID:10460
- C:\Windows\System\FzNqUfV.exe
  C:\Windows\System\FzNqUfV.exe
  2⤵
  PID:10484
- C:\Windows\System\ZsToGKH.exe
  C:\Windows\System\ZsToGKH.exe
  2⤵
  PID:10500
- C:\Windows\System\JRRaHid.exe
  C:\Windows\System\JRRaHid.exe
  2⤵
  PID:10524
- C:\Windows\System\qxLXoWz.exe
  C:\Windows\System\qxLXoWz.exe
  2⤵
  PID:10544
- C:\Windows\System\wCDlxIZ.exe
  C:\Windows\System\wCDlxIZ.exe
  2⤵
  PID:10564
- C:\Windows\System\NaWnuaL.exe
  C:\Windows\System\NaWnuaL.exe
  2⤵
  PID:10584
- C:\Windows\System\WfuSUEW.exe
  C:\Windows\System\WfuSUEW.exe
  2⤵
  PID:10616
- C:\Windows\System\hGOKVYV.exe
  C:\Windows\System\hGOKVYV.exe
  2⤵
  PID:10636
- C:\Windows\System\VCFKOaU.exe
  C:\Windows\System\VCFKOaU.exe
  2⤵
  PID:10664
- C:\Windows\System\jhWlwTW.exe
  C:\Windows\System\jhWlwTW.exe
  2⤵
  PID:10688
- C:\Windows\System\vdavzZv.exe
  C:\Windows\System\vdavzZv.exe
  2⤵
  PID:10704
- C:\Windows\System\iLWGEPk.exe
  C:\Windows\System\iLWGEPk.exe
  2⤵
  PID:10720
- C:\Windows\System\alhtvJD.exe
  C:\Windows\System\alhtvJD.exe
  2⤵
  PID:10740
- C:\Windows\System\WQoQzEt.exe
  C:\Windows\System\WQoQzEt.exe
  2⤵
  PID:10760
- C:\Windows\System\mtmgaVB.exe
  C:\Windows\System\mtmgaVB.exe
  2⤵
  PID:10784
- C:\Windows\System\LhrhMot.exe
  C:\Windows\System\LhrhMot.exe
  2⤵
  PID:11088
- C:\Windows\System\cPZDYKk.exe
  C:\Windows\System\cPZDYKk.exe
  2⤵
  PID:11248
- C:\Windows\System\odroxeY.exe
  C:\Windows\System\odroxeY.exe
  2⤵
  PID:9420
- C:\Windows\System\rjtBJkI.exe
  C:\Windows\System\rjtBJkI.exe
  2⤵
  PID:9516
- C:\Windows\System\gQlzNQV.exe
  C:\Windows\System\gQlzNQV.exe
  2⤵
  PID:9504
- C:\Windows\System\NKNqTjY.exe
  C:\Windows\System\NKNqTjY.exe
  2⤵
  PID:9396
- C:\Windows\System\VIXiLyG.exe
  C:\Windows\System\VIXiLyG.exe
  2⤵
  PID:9328
- C:\Windows\System\ZTmWcAP.exe
  C:\Windows\System\ZTmWcAP.exe
  2⤵
  PID:9572
- C:\Windows\System\uVEkAAD.exe
  C:\Windows\System\uVEkAAD.exe
  2⤵
  PID:9672
- C:\Windows\System\oRjXRIz.exe
  C:\Windows\System\oRjXRIz.exe
  2⤵
  PID:9740
- C:\Windows\System\fGXRvcB.exe
  C:\Windows\System\fGXRvcB.exe
  2⤵
  PID:9608
- C:\Windows\System\kvwVHmQ.exe
  C:\Windows\System\kvwVHmQ.exe
  2⤵
  PID:10152
- C:\Windows\System\PHEkinO.exe
  C:\Windows\System\PHEkinO.exe
  2⤵
  PID:9792
- C:\Windows\System\wDnZYRm.exe
  C:\Windows\System\wDnZYRm.exe
  2⤵
  PID:6916
- C:\Windows\System\TEjfqyV.exe
  C:\Windows\System\TEjfqyV.exe
  2⤵
  PID:9980
- C:\Windows\System\JGsXgDV.exe
  C:\Windows\System\JGsXgDV.exe
  2⤵
  PID:10248
- C:\Windows\System\mQfXczE.exe
  C:\Windows\System\mQfXczE.exe
  2⤵
  PID:10596
- C:\Windows\System\PiCmDdl.exe
  C:\Windows\System\PiCmDdl.exe
  2⤵
  PID:8180
- C:\Windows\System\oRVJZtP.exe
  C:\Windows\System\oRVJZtP.exe
  2⤵
  PID:9868
- C:\Windows\System\AtEBlGt.exe
  C:\Windows\System\AtEBlGt.exe
  2⤵
  PID:10004
- C:\Windows\System\AvoWAPW.exe
  C:\Windows\System\AvoWAPW.exe
  2⤵
  PID:9336
- C:\Windows\System\IfNvxHb.exe
  C:\Windows\System\IfNvxHb.exe
  2⤵
  PID:10352
- C:\Windows\System\LZbrYxf.exe
  C:\Windows\System\LZbrYxf.exe
  2⤵
  PID:10480
- C:\Windows\System\QYpoajP.exe
  C:\Windows\System\QYpoajP.exe
  2⤵
  PID:10176
- C:\Windows\System\iwXxLCs.exe
  C:\Windows\System\iwXxLCs.exe
  2⤵
  PID:4528
- C:\Windows\System\RojaZzo.exe
  C:\Windows\System\RojaZzo.exe
  2⤵
  PID:7504
- C:\Windows\System\qTiDpVv.exe
  C:\Windows\System\qTiDpVv.exe
  2⤵
  PID:6864
- C:\Windows\System\fFVqhzK.exe
  C:\Windows\System\fFVqhzK.exe
  2⤵
  PID:10808
- C:\Windows\System\WhCLtTo.exe
  C:\Windows\System\WhCLtTo.exe
  2⤵
  PID:7308
- C:\Windows\System\vqxmzgk.exe
  C:\Windows\System\vqxmzgk.exe
  2⤵
  PID:7468
- C:\Windows\System\LOHxAWR.exe
  C:\Windows\System\LOHxAWR.exe
  2⤵
  PID:11056
- C:\Windows\System\hOReDkQ.exe
  C:\Windows\System\hOReDkQ.exe
  2⤵
  PID:9412
- C:\Windows\System\PlKTQJA.exe
  C:\Windows\System\PlKTQJA.exe
  2⤵
  PID:10312
- C:\Windows\System\fXNXrcl.exe
  C:\Windows\System\fXNXrcl.exe
  2⤵
  PID:10648
- C:\Windows\System\RyHAmQK.exe
  C:\Windows\System\RyHAmQK.exe
  2⤵
  PID:9464
- C:\Windows\System\XfzKPPN.exe
  C:\Windows\System\XfzKPPN.exe
  2⤵
  PID:10252
- C:\Windows\System\TluwCHO.exe
  C:\Windows\System\TluwCHO.exe
  2⤵
  PID:10364
- C:\Windows\System\OldKzjN.exe
  C:\Windows\System\OldKzjN.exe
  2⤵
  PID:10440
- C:\Windows\System\teTCqaa.exe
  C:\Windows\System\teTCqaa.exe
  2⤵
  PID:10520
- C:\Windows\System\ZFaHTie.exe
  C:\Windows\System\ZFaHTie.exe
  2⤵
  PID:10632
- C:\Windows\System\TeqnBUl.exe
  C:\Windows\System\TeqnBUl.exe
  2⤵
  PID:10716
- C:\Windows\System\KnKNwIN.exe
  C:\Windows\System\KnKNwIN.exe
  2⤵
  PID:11028
- C:\Windows\System\XKlghnY.exe
  C:\Windows\System\XKlghnY.exe
  2⤵
  PID:8648
- C:\Windows\System\ZxFzRxn.exe
  C:\Windows\System\ZxFzRxn.exe
  2⤵
  PID:9500
- C:\Windows\System\rNjUquL.exe
  C:\Windows\System\rNjUquL.exe
  2⤵
  PID:9348
- C:\Windows\System\oLMhiBV.exe
  C:\Windows\System\oLMhiBV.exe
  2⤵
  PID:9648
- C:\Windows\System\kETvZiS.exe
  C:\Windows\System\kETvZiS.exe
  2⤵
  PID:9764
- C:\Windows\System\LICsUIw.exe
  C:\Windows\System\LICsUIw.exe
  2⤵
  PID:9812
- C:\Windows\System\elAtwdm.exe
  C:\Windows\System\elAtwdm.exe
  2⤵
  PID:11280
- C:\Windows\System\zIvKPgM.exe
  C:\Windows\System\zIvKPgM.exe
  2⤵
  PID:11300
- C:\Windows\System\DzJUDtH.exe
  C:\Windows\System\DzJUDtH.exe
  2⤵
  PID:11324
- C:\Windows\System\pAQOGzs.exe
  C:\Windows\System\pAQOGzs.exe
  2⤵
  PID:11340
- C:\Windows\System\xlzKTlJ.exe
  C:\Windows\System\xlzKTlJ.exe
  2⤵
  PID:11360
- C:\Windows\System\XKAnqUZ.exe
  C:\Windows\System\XKAnqUZ.exe
  2⤵
  PID:11380
- C:\Windows\System\sMNlTxu.exe
  C:\Windows\System\sMNlTxu.exe
  2⤵
  PID:11408
- C:\Windows\System\xaKkyfU.exe
  C:\Windows\System\xaKkyfU.exe
  2⤵
  PID:11440
- C:\Windows\System\ryvSsZG.exe
  C:\Windows\System\ryvSsZG.exe
  2⤵
  PID:11456
- C:\Windows\System\lKiPKGs.exe
  C:\Windows\System\lKiPKGs.exe
  2⤵
  PID:11476
- C:\Windows\System\XboqnYL.exe
  C:\Windows\System\XboqnYL.exe
  2⤵
  PID:11500
- C:\Windows\System\YXSNCcD.exe
  C:\Windows\System\YXSNCcD.exe
  2⤵
  PID:11524
- C:\Windows\System\bxxfNCi.exe
  C:\Windows\System\bxxfNCi.exe
  2⤵
  PID:11544
- C:\Windows\System\PhHqozF.exe
  C:\Windows\System\PhHqozF.exe
  2⤵
  PID:11568
- C:\Windows\System\pbiHdCi.exe
  C:\Windows\System\pbiHdCi.exe
  2⤵
  PID:11592
- C:\Windows\System\aWdFpCT.exe
  C:\Windows\System\aWdFpCT.exe
  2⤵
  PID:11624
- C:\Windows\System\RNSomca.exe
  C:\Windows\System\RNSomca.exe
  2⤵
  PID:11648
- C:\Windows\System\mNBtZhY.exe
  C:\Windows\System\mNBtZhY.exe
  2⤵
  PID:11668
- C:\Windows\System\caWgbSb.exe
  C:\Windows\System\caWgbSb.exe
  2⤵
  PID:11692
- C:\Windows\System\rdLqXBF.exe
  C:\Windows\System\rdLqXBF.exe
  2⤵
  PID:11712
- C:\Windows\System\oVAtklZ.exe
  C:\Windows\System\oVAtklZ.exe
  2⤵
  PID:11736
- C:\Windows\System\zNjbGaM.exe
  C:\Windows\System\zNjbGaM.exe
  2⤵
  PID:11764
- C:\Windows\System\BWVqgir.exe
  C:\Windows\System\BWVqgir.exe
  2⤵
  PID:11780
- C:\Windows\System\WRbAbkQ.exe
  C:\Windows\System\WRbAbkQ.exe
  2⤵
  PID:11800
- C:\Windows\System\eGhfcbu.exe
  C:\Windows\System\eGhfcbu.exe
  2⤵
  PID:11816
- C:\Windows\System\dXMDdmt.exe
  C:\Windows\System\dXMDdmt.exe
  2⤵
  PID:11832
- C:\Windows\System\wrppGcp.exe
  C:\Windows\System\wrppGcp.exe
  2⤵
  PID:11852
- C:\Windows\System\ssawYxN.exe
  C:\Windows\System\ssawYxN.exe
  2⤵
  PID:11872
- C:\Windows\System\qLLNDtf.exe
  C:\Windows\System\qLLNDtf.exe
  2⤵
  PID:11896
- C:\Windows\System\ZLoXYeR.exe
  C:\Windows\System\ZLoXYeR.exe
  2⤵
  PID:11916
- C:\Windows\System\relmyAP.exe
  C:\Windows\System\relmyAP.exe
  2⤵
  PID:11940
- C:\Windows\System\uPbIXnx.exe
  C:\Windows\System\uPbIXnx.exe
  2⤵
  PID:11964
- C:\Windows\System\PuIyYKJ.exe
  C:\Windows\System\PuIyYKJ.exe
  2⤵
  PID:11980
- C:\Windows\System\mmxYczf.exe
  C:\Windows\System\mmxYczf.exe
  2⤵
  PID:12004
- C:\Windows\System\ddctHKD.exe
  C:\Windows\System\ddctHKD.exe
  2⤵
  PID:12024
- C:\Windows\System\ywnQDBM.exe
  C:\Windows\System\ywnQDBM.exe
  2⤵
  PID:12044
- C:\Windows\System\XEAUhVl.exe
  C:\Windows\System\XEAUhVl.exe
  2⤵
  PID:12068
- C:\Windows\System\oSzeXLG.exe
  C:\Windows\System\oSzeXLG.exe
  2⤵
  PID:12088
- C:\Windows\System\vlXuHTI.exe
  C:\Windows\System\vlXuHTI.exe
  2⤵
  PID:12120
- C:\Windows\System\yklaNJh.exe
  C:\Windows\System\yklaNJh.exe
  2⤵
  PID:12136
- C:\Windows\System\OomJFFt.exe
  C:\Windows\System\OomJFFt.exe
  2⤵
  PID:12156
- C:\Windows\System\ZucSmdh.exe
  C:\Windows\System\ZucSmdh.exe
  2⤵
  PID:12176
- C:\Windows\System\wIWlyja.exe
  C:\Windows\System\wIWlyja.exe
  2⤵
  PID:12196
- C:\Windows\System\pVRZySZ.exe
  C:\Windows\System\pVRZySZ.exe
  2⤵
  PID:12212
- C:\Windows\System\lGnKZTC.exe
  C:\Windows\System\lGnKZTC.exe
  2⤵
  PID:12228
- C:\Windows\System\OHOOIPS.exe
  C:\Windows\System\OHOOIPS.exe
  2⤵
  PID:12244
- C:\Windows\System\VFVeNWZ.exe
  C:\Windows\System\VFVeNWZ.exe
  2⤵
  PID:12268
- C:\Windows\System\GSyiZZN.exe
  C:\Windows\System\GSyiZZN.exe
  2⤵
  PID:12284
- C:\Windows\System\SLHjsAn.exe
  C:\Windows\System\SLHjsAn.exe
  2⤵
  PID:10872
- C:\Windows\System\OwLDSHQ.exe
  C:\Windows\System\OwLDSHQ.exe
  2⤵
  PID:11044
- C:\Windows\System\lJylhqq.exe
  C:\Windows\System\lJylhqq.exe
  2⤵
  PID:7928
- C:\Windows\System\dJoRQCN.exe
  C:\Windows\System\dJoRQCN.exe
  2⤵
  PID:10412
- C:\Windows\System\nYZGGfD.exe
  C:\Windows\System\nYZGGfD.exe
  2⤵
  PID:10712
- C:\Windows\System\pboxDJL.exe
  C:\Windows\System\pboxDJL.exe
  2⤵
  PID:10768
- C:\Windows\System\hCSaNdq.exe
  C:\Windows\System\hCSaNdq.exe
  2⤵
  PID:8632
- C:\Windows\System\GQHRHAk.exe
  C:\Windows\System\GQHRHAk.exe
  2⤵
  PID:10332
- C:\Windows\System\mYuVUIA.exe
  C:\Windows\System\mYuVUIA.exe
  2⤵
  PID:12292
- C:\Windows\System\jOCtNAM.exe
  C:\Windows\System\jOCtNAM.exe
  2⤵
  PID:12308
- C:\Windows\System\DihGCoW.exe
  C:\Windows\System\DihGCoW.exe
  2⤵
  PID:12336
- C:\Windows\System\WAPugaW.exe
  C:\Windows\System\WAPugaW.exe
  2⤵
  PID:12356
- C:\Windows\System\kNxXiZj.exe
  C:\Windows\System\kNxXiZj.exe
  2⤵
  PID:12376
- C:\Windows\System\fzjxRYU.exe
  C:\Windows\System\fzjxRYU.exe
  2⤵
  PID:12400
- C:\Windows\System\eCvJVdo.exe
  C:\Windows\System\eCvJVdo.exe
  2⤵
  PID:12420
- C:\Windows\System\mHOfWcf.exe
  C:\Windows\System\mHOfWcf.exe
  2⤵
  PID:12440
- C:\Windows\System\MOGkmzF.exe
  C:\Windows\System\MOGkmzF.exe
  2⤵
  PID:12456
- C:\Windows\System\ovdaKWJ.exe
  C:\Windows\System\ovdaKWJ.exe
  2⤵
  PID:12472
- C:\Windows\System\oPELFtg.exe
  C:\Windows\System\oPELFtg.exe
  2⤵
  PID:12488
- C:\Windows\System\BEdQIjb.exe
  C:\Windows\System\BEdQIjb.exe
  2⤵
  PID:12504
- C:\Windows\System\QcTtIVy.exe
  C:\Windows\System\QcTtIVy.exe
  2⤵
  PID:12520
- C:\Windows\System\bwrrKfN.exe
  C:\Windows\System\bwrrKfN.exe
  2⤵
  PID:12544
- C:\Windows\System\kviNMbK.exe
  C:\Windows\System\kviNMbK.exe
  2⤵
  PID:12564
- C:\Windows\System\aDuFlPU.exe
  C:\Windows\System\aDuFlPU.exe
  2⤵
  PID:12588
- C:\Windows\System\nmCAyZm.exe
  C:\Windows\System\nmCAyZm.exe
  2⤵
  PID:12608
- C:\Windows\System\lOsAwGf.exe
  C:\Windows\System\lOsAwGf.exe
  2⤵
  PID:12628
- C:\Windows\System\zYeOfia.exe
  C:\Windows\System\zYeOfia.exe
  2⤵
  PID:12648
- C:\Windows\System\ijYChOA.exe
  C:\Windows\System\ijYChOA.exe
  2⤵
  PID:12672
- C:\Windows\System\YlYcTCn.exe
  C:\Windows\System\YlYcTCn.exe
  2⤵
  PID:12688
- C:\Windows\System\crDQNTH.exe
  C:\Windows\System\crDQNTH.exe
  2⤵
  PID:12712
- C:\Windows\System\SfLPVHP.exe
  C:\Windows\System\SfLPVHP.exe
  2⤵
  PID:12728
- C:\Windows\System\ZiQTNra.exe
  C:\Windows\System\ZiQTNra.exe
  2⤵
  PID:12744
- C:\Windows\System\hqMhLaP.exe
  C:\Windows\System\hqMhLaP.exe
  2⤵
  PID:12760
- C:\Windows\System\OwtnrQS.exe
  C:\Windows\System\OwtnrQS.exe
  2⤵
  PID:12776
- C:\Windows\System\zjKZvVQ.exe
  C:\Windows\System\zjKZvVQ.exe
  2⤵
  PID:12792
- C:\Windows\System\sjLoPlZ.exe
  C:\Windows\System\sjLoPlZ.exe
  2⤵
  PID:12808
- C:\Windows\System\bSzPIzv.exe
  C:\Windows\System\bSzPIzv.exe
  2⤵
  PID:12824
- C:\Windows\System\vQgXnjw.exe
  C:\Windows\System\vQgXnjw.exe
  2⤵
  PID:12840
- C:\Windows\System\GFuPEkB.exe
  C:\Windows\System\GFuPEkB.exe
  2⤵
  PID:12860
- C:\Windows\System\vSczjAf.exe
  C:\Windows\System\vSczjAf.exe
  2⤵
  PID:12880
- C:\Windows\System\gkobrku.exe
  C:\Windows\System\gkobrku.exe
  2⤵
  PID:12900
- C:\Windows\System\ispDidV.exe
  C:\Windows\System\ispDidV.exe
  2⤵
  PID:12916
- C:\Windows\System\tjzdShq.exe
  C:\Windows\System\tjzdShq.exe
  2⤵
  PID:12944
- C:\Windows\System\iFtbsRu.exe
  C:\Windows\System\iFtbsRu.exe
  2⤵
  PID:12960
- C:\Windows\System\pmjVKor.exe
  C:\Windows\System\pmjVKor.exe
  2⤵
  PID:12980
- C:\Windows\System\uLupfnw.exe
  C:\Windows\System\uLupfnw.exe
  2⤵
  PID:12996
- C:\Windows\System\llwnxRl.exe
  C:\Windows\System\llwnxRl.exe
  2⤵
  PID:13020
- C:\Windows\System\vaFVLgb.exe
  C:\Windows\System\vaFVLgb.exe
  2⤵
  PID:13036
- C:\Windows\System\yZjbrvm.exe
  C:\Windows\System\yZjbrvm.exe
  2⤵
  PID:13056
- C:\Windows\System\oolRehn.exe
  C:\Windows\System\oolRehn.exe
  2⤵
  PID:11728
- C:\Windows\System\uTOoGca.exe
  C:\Windows\System\uTOoGca.exe
  2⤵
  PID:11988
- C:\Windows\System\acXFkic.exe
  C:\Windows\System\acXFkic.exe
  2⤵
  PID:12100
- C:\Windows\System\lUQzCnD.exe
  C:\Windows\System\lUQzCnD.exe
  2⤵
  PID:12132
- C:\Windows\System\kCHnBUg.exe
  C:\Windows\System\kCHnBUg.exe
  2⤵
  PID:8596
- C:\Windows\System\nmBHpIe.exe
  C:\Windows\System\nmBHpIe.exe
  2⤵
  PID:12256
- C:\Windows\System\byRfoLO.exe
  C:\Windows\System\byRfoLO.exe
  2⤵
  PID:12280
- C:\Windows\System\UJESfqe.exe
  C:\Windows\System\UJESfqe.exe
  2⤵
  PID:11008
- C:\Windows\System\UmmDQMx.exe
  C:\Windows\System\UmmDQMx.exe
  2⤵
  PID:10372
- C:\Windows\System\kUyLlVE.exe
  C:\Windows\System\kUyLlVE.exe
  2⤵
  PID:8044
- C:\Windows\System\HLkCCnE.exe
  C:\Windows\System\HLkCCnE.exe
  2⤵
  PID:10600
- C:\Windows\System\juUdpzO.exe
  C:\Windows\System\juUdpzO.exe
  2⤵
  PID:12428
- C:\Windows\System\iclncpc.exe
  C:\Windows\System\iclncpc.exe
  2⤵
  PID:12464
- C:\Windows\System\NdppBBP.exe
  C:\Windows\System\NdppBBP.exe
  2⤵
  PID:9460
- C:\Windows\System\XmrlDqE.exe
  C:\Windows\System\XmrlDqE.exe
  2⤵
  PID:12708
- C:\Windows\System\uratLeW.exe
  C:\Windows\System\uratLeW.exe
  2⤵
  PID:10684
- C:\Windows\System\MHRKrLd.exe
  C:\Windows\System\MHRKrLd.exe
  2⤵
  PID:12768
- C:\Windows\System\MfKVJcE.exe
  C:\Windows\System\MfKVJcE.exe
  2⤵
  PID:11332
- C:\Windows\System\VUjisXl.exe
  C:\Windows\System\VUjisXl.exe
  2⤵
  PID:13064
- C:\Windows\System\iGErPPy.exe
  C:\Windows\System\iGErPPy.exe
  2⤵
  PID:11704
- C:\Windows\System\thCVSBW.exe
  C:\Windows\System\thCVSBW.exe
  2⤵
  PID:13140
- C:\Windows\System\TXQxWrV.exe
  C:\Windows\System\TXQxWrV.exe
  2⤵
  PID:11808
- C:\Windows\System\RitwsOg.exe
  C:\Windows\System\RitwsOg.exe
  2⤵
  PID:11868
- C:\Windows\System\Wikwnfg.exe
  C:\Windows\System\Wikwnfg.exe
  2⤵
  PID:11908
- C:\Windows\System\GxrAmBZ.exe
  C:\Windows\System\GxrAmBZ.exe
  2⤵
  PID:12016
- C:\Windows\System\BFloBhH.exe
  C:\Windows\System\BFloBhH.exe
  2⤵
  PID:13236
- C:\Windows\System\kcjXNuB.exe
  C:\Windows\System\kcjXNuB.exe
  2⤵
  PID:13332
- C:\Windows\System\EvCJLoG.exe
  C:\Windows\System\EvCJLoG.exe
  2⤵
  PID:13352
- C:\Windows\System\XkgXwaH.exe
  C:\Windows\System\XkgXwaH.exe
  2⤵
  PID:13372
- C:\Windows\System\KGyELkS.exe
  C:\Windows\System\KGyELkS.exe
  2⤵
  PID:13772
- C:\Windows\System\ppbyFBQ.exe
  C:\Windows\System\ppbyFBQ.exe
  2⤵
  PID:13792
- C:\Windows\System\Pbnymrc.exe
  C:\Windows\System\Pbnymrc.exe
  2⤵
  PID:13808
- C:\Windows\System\DFDSrxx.exe
  C:\Windows\System\DFDSrxx.exe
  2⤵
  PID:13828
- C:\Windows\System\fbWChJg.exe
  C:\Windows\System\fbWChJg.exe
  2⤵
  PID:13848
- C:\Windows\System\nEgLcGK.exe
  C:\Windows\System\nEgLcGK.exe
  2⤵
  PID:13864
- C:\Windows\System\qxbHOGc.exe
  C:\Windows\System\qxbHOGc.exe
  2⤵
  PID:13880
- C:\Windows\System\sWkpAkK.exe
  C:\Windows\System\sWkpAkK.exe
  2⤵
  PID:13896
- C:\Windows\System\FORjTPu.exe
  C:\Windows\System\FORjTPu.exe
  2⤵
  PID:13912
- C:\Windows\System\LvaSikZ.exe
  C:\Windows\System\LvaSikZ.exe
  2⤵
  PID:13928
- C:\Windows\System\bMfcYwb.exe
  C:\Windows\System\bMfcYwb.exe
  2⤵
  PID:13948
- C:\Windows\System\DkicDbf.exe
  C:\Windows\System\DkicDbf.exe
  2⤵
  PID:13968
- C:\Windows\System\RQAihJW.exe
  C:\Windows\System\RQAihJW.exe
  2⤵
  PID:14000
- C:\Windows\System\JbnwKjq.exe
  C:\Windows\System\JbnwKjq.exe
  2⤵
  PID:14020
- C:\Windows\System\gVQJPKq.exe
  C:\Windows\System\gVQJPKq.exe
  2⤵
  PID:14048
- C:\Windows\System\PIYEsOZ.exe
  C:\Windows\System\PIYEsOZ.exe
  2⤵
  PID:14068
- C:\Windows\System\UcyVdfw.exe
  C:\Windows\System\UcyVdfw.exe
  2⤵
  PID:14092
- C:\Windows\System\wxnXHVc.exe
  C:\Windows\System\wxnXHVc.exe
  2⤵
  PID:14112
- C:\Windows\System\dUkUgvk.exe
  C:\Windows\System\dUkUgvk.exe
  2⤵
  PID:14136
- C:\Windows\System\KvRsOwu.exe
  C:\Windows\System\KvRsOwu.exe
  2⤵
  PID:14152
- C:\Windows\System\SCZtnin.exe
  C:\Windows\System\SCZtnin.exe
  2⤵
  PID:14172
- C:\Windows\System\qPdILLh.exe
  C:\Windows\System\qPdILLh.exe
  2⤵
  PID:14192
- C:\Windows\System\utOYxCn.exe
  C:\Windows\System\utOYxCn.exe
  2⤵
  PID:14216
- C:\Windows\System\HsXQknt.exe
  C:\Windows\System\HsXQknt.exe
  2⤵
  PID:14236
- C:\Windows\System\AUguvZn.exe
  C:\Windows\System\AUguvZn.exe
  2⤵
  PID:14256
- C:\Windows\System\iRZddAo.exe
  C:\Windows\System\iRZddAo.exe
  2⤵
  PID:14284
- C:\Windows\System\TSOVxEa.exe
  C:\Windows\System\TSOVxEa.exe
  2⤵
  PID:14304
- C:\Windows\System\BkVuoQf.exe
  C:\Windows\System\BkVuoQf.exe
  2⤵
  PID:14324
- C:\Windows\System\OheBMXZ.exe
  C:\Windows\System\OheBMXZ.exe
  2⤵
  PID:10416
- C:\Windows\System\InClzRP.exe
  C:\Windows\System\InClzRP.exe
  2⤵
  PID:12172
- C:\Windows\System\igCydcQ.exe
  C:\Windows\System\igCydcQ.exe
  2⤵
  PID:12316
- C:\Windows\System\BtiOZlM.exe
  C:\Windows\System\BtiOZlM.exe
  2⤵
  PID:12584
- C:\Windows\System\bhJNcdb.exe
  C:\Windows\System\bhJNcdb.exe
  2⤵
  PID:10968
- C:\Windows\System\vvcKRpf.exe
  C:\Windows\System\vvcKRpf.exe
  2⤵
  PID:12788
- C:\Windows\System\FZBRRDH.exe
  C:\Windows\System\FZBRRDH.exe
  2⤵
  PID:9876
- C:\Windows\System\KZtnyoa.exe
  C:\Windows\System\KZtnyoa.exe
  2⤵
  PID:12992
- C:\Windows\System\pPwTqPX.exe
  C:\Windows\System\pPwTqPX.exe
  2⤵
  PID:11372
- C:\Windows\System\uAVHRqX.exe
  C:\Windows\System\uAVHRqX.exe
  2⤵
  PID:11484
- C:\Windows\System\qzQRwqW.exe
  C:\Windows\System\qzQRwqW.exe
  2⤵
  PID:11552
- C:\Windows\System\GXCpdlz.exe
  C:\Windows\System\GXCpdlz.exe
  2⤵
  PID:11564
- C:\Windows\System\BQddCPU.exe
  C:\Windows\System\BQddCPU.exe
  2⤵
  PID:9988
- C:\Windows\System\rQZIxSh.exe
  C:\Windows\System\rQZIxSh.exe
  2⤵
  PID:11708
- C:\Windows\System\fKMYwyX.exe
  C:\Windows\System\fKMYwyX.exe
  2⤵
  PID:12696
- C:\Windows\System\yyQTYTK.exe
  C:\Windows\System\yyQTYTK.exe
  2⤵
  PID:11664
- C:\Windows\System\AfHBlQk.exe
  C:\Windows\System\AfHBlQk.exe
  2⤵
  PID:12060
- C:\Windows\System\DhJVxbw.exe
  C:\Windows\System\DhJVxbw.exe
  2⤵
  PID:12148
- C:\Windows\System\RFaLPoY.exe
  C:\Windows\System\RFaLPoY.exe
  2⤵
  PID:12208
- C:\Windows\System\LnuaPuu.exe
  C:\Windows\System\LnuaPuu.exe
  2⤵
  PID:12300
- C:\Windows\System\xeTRUmg.exe
  C:\Windows\System\xeTRUmg.exe
  2⤵
  PID:12364
- C:\Windows\System\HMcDrMR.exe
  C:\Windows\System\HMcDrMR.exe
  2⤵
  PID:12388
- C:\Windows\System\eGHhxeR.exe
  C:\Windows\System\eGHhxeR.exe
  2⤵
  PID:12512
- C:\Windows\System\xdPRVng.exe
  C:\Windows\System\xdPRVng.exe
  2⤵
  PID:12560
- C:\Windows\System\CjhAKbV.exe
  C:\Windows\System\CjhAKbV.exe
  2⤵
  PID:12644
- C:\Windows\System\aUEtnrC.exe
  C:\Windows\System\aUEtnrC.exe
  2⤵
  PID:12704
- C:\Windows\System\kLvEIYf.exe
  C:\Windows\System\kLvEIYf.exe
  2⤵
  PID:12756
- C:\Windows\System\ejSnoIc.exe
  C:\Windows\System\ejSnoIc.exe
  2⤵
  PID:12816
- C:\Windows\System\GJbJjfJ.exe
  C:\Windows\System\GJbJjfJ.exe
  2⤵
  PID:12888
- C:\Windows\System\IPaBCBD.exe
  C:\Windows\System\IPaBCBD.exe
  2⤵
  PID:12956
- C:\Windows\System\fBFlMJg.exe
  C:\Windows\System\fBFlMJg.exe
  2⤵
  PID:13012
- C:\Windows\System\hZMfVGA.exe
  C:\Windows\System\hZMfVGA.exe
  2⤵
  PID:13052
- C:\Windows\System\baRtGfl.exe
  C:\Windows\System\baRtGfl.exe
  2⤵
  PID:8328
- C:\Windows\System\nAmZGFY.exe
  C:\Windows\System\nAmZGFY.exe
  2⤵
  PID:10244
- C:\Windows\System\nQrvFYS.exe
  C:\Windows\System\nQrvFYS.exe
  2⤵
  PID:2116
- C:\Windows\System\cJsWSWi.exe
  C:\Windows\System\cJsWSWi.exe
  2⤵
  PID:11452
- C:\Windows\System\fCOFpgw.exe
  C:\Windows\System\fCOFpgw.exe
  2⤵
  PID:13148
- C:\Windows\System\SecxFGY.exe
  C:\Windows\System\SecxFGY.exe
  2⤵
  PID:13324
- C:\Windows\System\rdFMyqP.exe
  C:\Windows\System\rdFMyqP.exe
  2⤵
  PID:13240
- C:\Windows\System\ihZhRkH.exe
  C:\Windows\System\ihZhRkH.exe
  2⤵
  PID:14012
- C:\Windows\System\axZhJeq.exe
  C:\Windows\System\axZhJeq.exe
  2⤵
  PID:14060
- C:\Windows\System\CEWFVvS.exe
  C:\Windows\System\CEWFVvS.exe
  2⤵
  PID:14248
- C:\Windows\System\CSjZNfZ.exe
  C:\Windows\System\CSjZNfZ.exe
  2⤵
  PID:14296
- C:\Windows\System\axwEmPy.exe
  C:\Windows\System\axwEmPy.exe
  2⤵
  PID:9532
- C:\Windows\System\vyeCWKm.exe
  C:\Windows\System\vyeCWKm.exe
  2⤵
  PID:11276
- C:\Windows\System\yNyPvxl.exe
  C:\Windows\System\yNyPvxl.exe
  2⤵
  PID:12868
- C:\Windows\System\phCpwNs.exe
  C:\Windows\System\phCpwNs.exe
  2⤵
  PID:11512
- C:\Windows\System\xAwcjNG.exe
  C:\Windows\System\xAwcjNG.exe
  2⤵
  PID:12188
- C:\Windows\System\aiuBXAt.exe
  C:\Windows\System\aiuBXAt.exe
  2⤵
  PID:10864
- C:\Windows\System\xjlDfbD.exe
  C:\Windows\System\xjlDfbD.exe
  2⤵
  PID:12416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:14436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

APFEXML.exe

Path C:\Windows\System\APFEXML.exe
Size 1.1MB
SHA256 bc02c7859cae56d0e77bf50168dc31eb7bd04bde0eddb22f2f9b63cd503e8594
MD5 2df7fa83b4608d17b5b32ecd9baa0415
SHA1 3fce042b2f986ed2891ee3619cdb1371f3c5704f
SHA512 249f002db0a7a1bd73a5caddedbcfff20c24f0d746acb61d32cb3b50dbac6a9a08c08c8e3863b6e03577c573d56b76cbaca7c1cf9982b770920e0561f0b2aa26
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenr:ROdWCCi7/rahW/zFdDlhUKCM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ASHHTjm.exe

Path C:\Windows\System\ASHHTjm.exe
Size 1.1MB
SHA256 a092e92c274a71ff96a7c74162962efd420656be08d3866c8f58edd67f3567f0
MD5 d60579710ead50a99724c9a7ba198892
SHA1 04cf79f7f04fa2e9c960e1dcc01b5f4cbcfc4518
SHA512 9d37ab48559181f0e9f2ec4e274c51efd8aff37bbc92582862b9b1ea3f6fe70b411e1827270349caf1345b76cecd89b4a98b4faef64eb030113508217f7f4045
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenZ:ROdWCCi7/rahW/zFdDlhUKCg
MD5 SHA1 SHA512 SSDEEP

Submit Download

AYgrJAX.exe

Path C:\Windows\System\AYgrJAX.exe
Size 1.1MB
SHA256 5dc975135bbd92837236d86374bce50ecf7ff050e871b030391bb3542c0d8953
MD5 64730a9f44d73e1dfb1b349141adb2b6
SHA1 328b320f15f8baa93f631825243adf09b5824219
SHA512 c461135bb891f5ddfc6934f570fed7ec41ef6b86ae16d5c0543309bcc621f6beac2b39c7565a9343a8d18021c67cd9da18cf6fb2a0d86895dd8627e07aaf87ff
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenM:ROdWCCi7/rahW/zFdDlhUKCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

AjozbIR.exe

Path C:\Windows\System\AjozbIR.exe
Size 1.1MB
SHA256 3767b2e46e5720572a0086190187488ec8eac4096d0e7f231ccd4e1bce78bb99
MD5 42fce283f40d75776927a61b6939ca04
SHA1 b633ac7a0135a58dc92d1eb797a59339cac456d9
SHA512 273fe0c55041eef9d45662dd896b8ebcd0f2308e3340f3a06b818545266cdffe23185c884c8ab0d333fe5ef98f5db72eea5701c9acdfdadbf6ec298a82bbddb6
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenU:ROdWCCi7/rahW/zFdDlhUKCJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BDxRxoE.exe

Path C:\Windows\System\BDxRxoE.exe
Size 1.1MB
SHA256 f2d3632a0491c9a45bd9f483a4c065f17a26eb69ac376e75da23229bdd685661
MD5 0e70a230ed56cee059691568a27694cf
SHA1 a05721bc322ed7e12305f9cef3bfbc3ea18ed871
SHA512 7f2aad411c32c4534db6b37a64865b371cec3b343829d9738b8cd470cb8985f1687ad76cfd85c70ec03b5117202af165b12711b1b12807004137546a15c3c412
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKen7:ROdWCCi7/rahW/zFdDlhUKCW
MD5 SHA1 SHA512 SSDEEP

Submit Download

BYhfwnf.exe

Path C:\Windows\System\BYhfwnf.exe
Size 1.1MB
SHA256 5c6fdfdb08419b0977b4bac1b81c4b93417783845afaf3d00d272b6e36b444f6
MD5 916fa8d43b634ec5db69ebb38a4c56a2
SHA1 d50bd977464170a65d05a819bd1ec848b26c7b36
SHA512 8bc3b9e67825ded7a75a29fe33bb585a62b14babd48548847c8771ed82629dbb5d2f57b0ffa4312b2b97e890164b44a05cf7025ff6207e40a0a7c407f2147d51
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKeniF:ROdWCCi7/rahW/zFdDlhUKC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCzajjp.exe

Path C:\Windows\System\CCzajjp.exe
Size 1.1MB
SHA256 6a821b39bb1694a13ce7068eba3c3475154258b8b2f194a4009d4b734bf9f5d8
MD5 03a91cd50750ec1dce294e7966d701b1
SHA1 3747a721341663e9a88fa4f67feb106cffe9be79
SHA512 5452e562c1ec167cd0e3c8380220179e23d7ddde20d49488e8d85535a3b4f68eb6fb4852af0d1dc594be6aaf361ab66ab3508bdf9261df370d3d837a5c77ba90
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKen/:ROdWCCi7/rahW/zFdDlhUKCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

CjJuDZY.exe

Path C:\Windows\System\CjJuDZY.exe
Size 1.1MB
SHA256 12395d7c8e120a892d787939e17bb7ed0725de55a8e170945bad45a2f29d387e
MD5 f03ce99419937dd03ad44ff44804cc29
SHA1 ce6267e62698f50d633cd32ca0955b339e64e0fa
SHA512 c8c009ffdba064a2fa62e02857c0c1610268126484066da075aea36ea5743d254253c835d25e037895f3d50789355d469ced78f8ca17a4d20740882341dd2139
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenE:ROdWCCi7/rahW/zFdDlhUKC5
MD5 SHA1 SHA512 SSDEEP

Submit Download

CmjOXIR.exe

Path C:\Windows\System\CmjOXIR.exe
Size 1.1MB
SHA256 125ec0f63690424a8b770f9db7699ca12b503adc29c3bb71b205f697f4d18993
MD5 c7f717df98d17356eba535e13aaaf400
SHA1 39340eee3914c728a3df1ead1727a9b2767b9448
SHA512 5795399ddc15e8a576a1019cbdb24dd23ef8cc11a391b17338f36bcea856ac4752317d77309b212c5d24a8f1107018f1f260b06b08caf34c4a2f258543feba6e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKent:ROdWCCi7/rahW/zFdDlhUKC4
MD5 SHA1 SHA512 SSDEEP

Submit Download

DdsadIh.exe

Path C:\Windows\System\DdsadIh.exe
Size 1.1MB
SHA256 6555dd0fefacea57343d03a9f0ac3e728e0ac59d91a796b429ecc5126c57dc69
MD5 452c7da9a6420d100290cb25413e504f
SHA1 902aca2b3858836e542d4c447546fe521cfa5bd3
SHA512 c10016860d756b81361c4b4e1918eea2d09a224839805e57a5ad320b0a2b8a9becc72ef53e063bed2ed8966fce7a766918702348e47486d15698d68cb62b6f5b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKene:ROdWCCi7/rahW/zFdDlhUKCX
MD5 SHA1 SHA512 SSDEEP

Submit Download

HOnKxkF.exe

Path C:\Windows\System\HOnKxkF.exe
Size 1.1MB
SHA256 3455e59174e995143a721cdf07a98cdbb7639f954154eae7c1f8e035a0396be2
MD5 488cccb753bb52f65510544701af6185
SHA1 0d83c073b115ff60e3c27fab28665759af120685
SHA512 778b797fcc52ffe74d9087a01e2d5822735897dbc5355ff8af970e4f64ff78725fd76985fcaa154c2545d5d0bd0b0d18ff55a743ef71b73c1fb7151dc87cf31c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenY:ROdWCCi7/rahW/zFdDlhUKCR
MD5 SHA1 SHA512 SSDEEP

Submit Download

IreCqnf.exe

Path C:\Windows\System\IreCqnf.exe
Size 1.1MB
SHA256 ec7f0e5b652d4e400d7a7720748d720b81c1dbdbc1bd0e84ba85ee32274e5e57
MD5 7c392443de6fc7e723cea19bafa6fa02
SHA1 36dde995a45cc9b7b25d1a3ed7a42160dea8d6ce
SHA512 0531880d0c977a85bba01f18533fc7b8326284727f852cff21f1a485abf9812cacc14ee3798bc902678bf92df317808e5becbe92665a0e7c296b5bdb175bbe84
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKen1:ROdWCCi7/rahW/zFdDlhUKCQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

NedNLzM.exe

Path C:\Windows\System\NedNLzM.exe
Size 1.1MB
SHA256 4dff5643de9c01081ca518356d7e7943ad32a9d6969c7a5f25d2500297fc7820
MD5 19dca767f00e638c85e3435311f1b7d3
SHA1 8e92023a569e073cc8b7fc9090013638035017f3
SHA512 5396e5a53d6c314833f8b82b163541daf96a5b6e6a84ce65bfe39b1b497c322f574fc03c5fb860971ff040b32526990e2e76e8f32965e525bc085e37b16b6d08
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenh:ROdWCCi7/rahW/zFdDlhUKCe
MD5 SHA1 SHA512 SSDEEP

Submit Download

NflATLy.exe

Path C:\Windows\System\NflATLy.exe
Size 1.1MB
SHA256 4ee80931da833d1c83119d3861c760bc657086624f79632ddde89de592b5d61f
MD5 d43af61323473789fbaa041b69038372
SHA1 9e826f418babe32b040fb752a16785dacdbb0011
SHA512 0d58583e14f9c02a47fb5d42ffaf3bdbf9d3f8b648b64a648dbdabd24da73286191cf44b3ef6baf6ec551dee6c308899560c1bffff6a1150385e87545c4d9f86
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenU:ROdWCCi7/rahW/zFdDlhUKCZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PHfmFCz.exe

Path C:\Windows\System\PHfmFCz.exe
Size 1.1MB
SHA256 cdd68335049a04d82f32f36cdd16f086ea5512c089fcc56014e1e63450acec15
MD5 339ea32a91e974440f6495a1fe80c269
SHA1 156560cbe821b235f9d25ef046f16fc7d4ccfe23
SHA512 246e7f6a94943214c43e849d0b504d2d26a8834e72f4f4f6e96904f603f4b85bdc33d1a5646dc6c5e279d1a6cd3683c51bba6d037b66d9fe6ff9fe729ff80f32
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKencx:ROdWCCi7/rahW/zFdDlhUKC/
MD5 SHA1 SHA512 SSDEEP

Submit Download

WGEwesz.exe

Path C:\Windows\System\WGEwesz.exe
Size 1.1MB
SHA256 e38e1ce22e3f83df78b19c850b2354f49f3801ed28c746813ed1e03f46404706
MD5 082b4edf1c489c7daedc7c8d41dda4b4
SHA1 0cc16a274f9b5c7a84a52fd3b4dafc957715f140
SHA512 1aa1c06b55635a4a328c0d783a755931f18da2f10cb753216247505db4c868447eaa64eeaac8d6d679a1bb0c10a9f48a6605aa2bc07c853e4ecf9a3f43299ef9
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenr:ROdWCCi7/rahW/zFdDlhUKCc
MD5 SHA1 SHA512 SSDEEP

Submit Download

WHHyYSC.exe

Path C:\Windows\System\WHHyYSC.exe
Size 1.1MB
SHA256 3423a93d3cae614f4202426d6c6f3f5c1b38d026172b762ee61da095dd15c881
MD5 9cf9788f43fa207aea906d71a7465972
SHA1 64b0034ff083f4ea0e1445bed404399f59847f42
SHA512 e129b0dfaaab8242f5e59f40b081c7391297f6a32e7b889377bf09c990047766aa2cfc41c004ad621145ef92e4414c9619997b8f8a6dd4f37f0d5c836ef7dc12
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenC:ROdWCCi7/rahW/zFdDlhUKCD
MD5 SHA1 SHA512 SSDEEP

Submit Download

WhwcMLb.exe

Path C:\Windows\System\WhwcMLb.exe
Size 1.1MB
SHA256 05ffd689e264a022720a545ee12384fa7279cdcb71a2309426bcf9513b9e8d1a
MD5 c015c5e364015d91ea1c27a028e86150
SHA1 800dcc54665de9c0f525c5eb8c681e8d747025fe
SHA512 c541577c541f79fa6b2516f39f3469c8d9212a4ddd88edef469f4c2a11cf872b11b1d44dd91cf8d1abf758caaa668d9fbfbbe5f13954a0c394ebe572604f0a89
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKen9:ROdWCCi7/rahW/zFdDlhUKC0
MD5 SHA1 SHA512 SSDEEP

Submit Download

YgeZSkY.exe

Path C:\Windows\System\YgeZSkY.exe
Size 1.1MB
SHA256 8f7410d2bc8a8725b4dd732b7f9429077a8634af17a9b7ee177a32eebbae618e
MD5 9c84d4f8cf6d37e0a40ad0912713c28e
SHA1 42db45d48c3e5cc4150832a4e02db01a8eba110a
SHA512 dedced82edd7f1826bced2c4215f6d1f3d093ce8ea635f6d75dc6f6a56b9acb1f392360ad4f7baec5bfe9a22453038f3e7d5daebbd3e8208ab4593ad70d3bc70
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenM:ROdWCCi7/rahW/zFdDlhUKCD
MD5 SHA1 SHA512 SSDEEP

Submit Download

YrksMFf.exe

Path C:\Windows\System\YrksMFf.exe
Size 1.1MB
SHA256 dad2d14e6e5b4c4c41d40da45e72f15dde2524c226dcd5f88bfc59a8d3e59197
MD5 7c7a4a9466c0b32e59b8784251560712
SHA1 d56af0ac42430001686b338a68f3145c8a022562
SHA512 626724b6f291b07e1b083bb1394727d7cf6a62bccbd86181a07042873cca20dde67fdc0c0bc47494fdf3b276dc4faf520430d9077de3b53901fbb009ba2942f6
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKen5:ROdWCCi7/rahW/zFdDlhUKCq
MD5 SHA1 SHA512 SSDEEP

Submit Download

YsFyRxg.exe

Path C:\Windows\System\YsFyRxg.exe
Size 1.1MB
SHA256 9e6dd33cd9c5755b9389cbf6226d40c3436e9f580b2ec5b1a78a68030e510454
MD5 c4e87b0aa9383b10e571fddd40dafc3a
SHA1 21d048912e05cad8b10cf945fa81033adcd84cc2
SHA512 cc45f644fdb1edb8f6c9b62a160d6c9b688c09bf7b5c4ae5a7b29e6a1be6cbf615a94847a82ad07716c5ba83be9c7702bbf480d71444063f73ddaa53ed22f6d7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenS:ROdWCCi7/rahW/zFdDlhUKC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZtQUBOx.exe

Path C:\Windows\System\ZtQUBOx.exe
Size 1.1MB
SHA256 86993ebddc91013e3805ce6cfa0d706414dc7164bffce9160ade9e469592306f
MD5 0898e6d8624e606a424cbabf9cb2b335
SHA1 fdab6252015fcc0ea68d4558eefe3a7912ba37d4
SHA512 0bbe01f3fb3a2004ad559fffd7a31ceec8d3d072d7ade0e4962aff311aedcca3aca36cf1e979701c6989d26991bb73c19f48b43ed9ad2c9980b7ddfa997a01f5
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenP:ROdWCCi7/rahW/zFdDlhUKC+
MD5 SHA1 SHA512 SSDEEP

Submit Download

avUmutb.exe

Path C:\Windows\System\avUmutb.exe
Size 1.1MB
SHA256 48f31aa2483f962c8269627dc39a05977439313533f184c3ff4d644c44bca0ec
MD5 311fc3387ddc2dfc81d9f8114825da4a
SHA1 ea29bb621e6960174d0d7e16ead4eeb8101fd25d
SHA512 d027659770fa319929c8166973dab333201aa65a46fa42d86d71e0a7fe7d1d58575554f8bd7f90624b33fe1afedb39e0755bad02d1eddd1ce9a67842c8183346
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKent:ROdWCCi7/rahW/zFdDlhUKCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

eSXeYkF.exe

Path C:\Windows\System\eSXeYkF.exe
Size 1.1MB
SHA256 2602a329c00bb56bf9f2d23a8c0a80b06f1fe6f2a3694f0d393db05e07985fd0
MD5 a692258cbd395adea6c752a3b3d8c9f9
SHA1 8ab2a3d8cc38a2c05a91ec1071539943b1c6f922
SHA512 f31b685ec14d09451adfe8dcf9f33d2e3ecf422a63f449fef9f1d63614a75785ce9297d05764d40dd9664f32a726d987b944f173ebadac1f2b43d9c932392f59
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenH:ROdWCCi7/rahW/zFdDlhUKCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

fcUDbFV.exe

Path C:\Windows\System\fcUDbFV.exe
Size 1.1MB
SHA256 58a71fea06b8ae1b9a7721ebb65215a424a0b7452c9904f437fd4049711e2376
MD5 156210b5a54cefa19b652147fdd09483
SHA1 078f1200ea4ef614a7890be9d016a5b3b1c28ad4
SHA512 cf5381ec1def5ba52c5d9c9d6845e07da55206c7a434f496f9cdb68741dcea773e84b173b22968b678dbae4ffbde026eb80984d3f60aa31e548a54b9fdba5b03
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenZp:ROdWCCi7/rahW/zFdDlhUKCW
MD5 SHA1 SHA512 SSDEEP

Submit Download

iSmexJe.exe

Path C:\Windows\System\iSmexJe.exe
Size 1.1MB
SHA256 cdde7a889511e7ff5403edd1373ca2df100095777866edb3f1f1b5992d1d8cf4
MD5 dcacb0870caf42bbd20253bf570cf914
SHA1 e96400f79b9304188fe656620e802039f4931e7c
SHA512 cf8e1c83d9c897dc20a801833038edb1f974ae11cfd930dc4fd6f27595c28960def9c5500e8393e1211cac257d82a2adb1ff3fa04020324b50c31caa4caa287e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenji:ROdWCCi7/rahW/zFdDlhUKCQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jRBRdCL.exe

Path C:\Windows\System\jRBRdCL.exe
Size 1.1MB
SHA256 44ef77524926e63c09f936c39dd00a9a61189233323d56691438cb71e9501cc7
MD5 655ef5dd530bf2df917619c37b9b446e
SHA1 e81d8a30609ee275bce33847a0839ad3690a549c
SHA512 83b2c775ac4ea9308c6729cdb65e5a7c225584207c3bb789475fce65361d4850329b42b4de2fa3a33f409f528fe69ea2be515c416ed2248693169f84c661369c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenm:ROdWCCi7/rahW/zFdDlhUKCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jVBIKom.exe

Path C:\Windows\System\jVBIKom.exe
Size 1.1MB
SHA256 fbbc38a2b0ec294fd1f1795db834a77018a7fba4e66abb82ee69187b2fbd7863
MD5 a5b05b6a4ba63c8c08aa8c0a8b822567
SHA1 d0c565d0862b1dc8f639faab213e4789eec50de7
SHA512 73143b1dfd8861ba4868736dc73fdd39d376ea4469e2fc3ef467834d02f8ca5ed64ad2526b2ef1fcaa66e6f127041a9860aa9926037992024b9c94939d1f6fcf
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenC:ROdWCCi7/rahW/zFdDlhUKCL
MD5 SHA1 SHA512 SSDEEP

Submit Download

lCbZwwW.exe

Path C:\Windows\System\lCbZwwW.exe
Size 1.1MB
SHA256 4f01e48f6058b2d8eb7f799f23421e14c47d02131f39f35d8feb9fee10244fd6
MD5 df7caf1bd63b9d1633f3d1ce07eab9d5
SHA1 3d57d1a9fede44dc9a24337b2b191b6b83e6a690
SHA512 211bc12fc66e26d8595935215567136fac32fb39afe07ec27bc5dcd7d5e863c6b10cfe831a4fd8f62c080afa1cf106d9e8fcd774f0a4e48fcdd11dad8299b213
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenh:ROdWCCi7/rahW/zFdDlhUKCC
MD5 SHA1 SHA512 SSDEEP

Submit Download

mYmXzkO.exe

Path C:\Windows\System\mYmXzkO.exe
Size 1.1MB
SHA256 50f3399fd18b9e98e09a0562f8b225aa004887301b116f86ad2d38548b96d5df
MD5 d22c061fc10f90f82171aeff1398b1e3
SHA1 dcf5c879b71018eb74b9d4c6f2f9ef3dd91c841d
SHA512 619afec6a2e059674ded7a71361ef935fb8d670cafa9f641c5c72dc5072c7544abb964313825fe0a4fe799c365b9ae296661443e3a84e5e6aa6b008cb57c3e0d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenA:ROdWCCi7/rahW/zFdDlhUKCp
MD5 SHA1 SHA512 SSDEEP

Submit Download

qKFhtPF.exe

Path C:\Windows\System\qKFhtPF.exe
Size 1.1MB
SHA256 b88ae821c84111f4a2129e255f3a2ea8d70b0b83959a0379e86dc85c2e42af8c
MD5 96cdfce4f033ec214aa95e68cdb7098b
SHA1 d99b19495c95cc9008cb2ea068c46af4ddfb5933
SHA512 6a74ca149703b17aab8afc40c55686654a48b26a26b67b369fcccc115ef594ae396272638409b1babe84a4525788dc074bf595dc957d142a414045482ac8b60b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKen0:ROdWCCi7/rahW/zFdDlhUKC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

sCPdltk.exe

Path C:\Windows\System\sCPdltk.exe
Size 1.1MB
SHA256 1b32822dfcf15eb5569b546ec169290cc98cb80ccb6282b72989a3e6e6d7b02d
MD5 9ec1853a83aafcafff08f3d133916b82
SHA1 1258b138d0fd45b55eecd92dbcdb21596ab90a09
SHA512 f51cbd81826008a4d6a622d5ee66503bb42a108061ce4d3b149391579cc0107bcc5b6af4d365f5c015301d395ad7d90d4e3afd41c7bd4ea1880a57f672e744e8
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKen2:ROdWCCi7/rahW/zFdDlhUKCF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vQjPkvk.exe

Path C:\Windows\System\vQjPkvk.exe
Size 1.1MB
SHA256 db3d0b62f0110693b67f698db5f87d4f6997f11cb359015bbc8b68d5affdb094
MD5 2a46598cb6349093f513aadff4cd29fa
SHA1 5e99989becddacd607adb11dcce355675b45ff4e
SHA512 99199e172e867eb8b885f493c31b2e37ade4c3d2d76bdeddeea2814ef722c58ebee9e27f5ee4e4f3c8677112f0f697dc1b232b260c1c2d87cb74b66afa7d036e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQ6thdqPicRWdKenf:ROdWCCi7/rahW/zFdDlhUKCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-110-0x00007FF6B5D00000-0x00007FF6B6051000-memory.dmp

Download

memory/452-2336-0x00007FF6B5D00000-0x00007FF6B6051000-memory.dmp

Download

memory/644-171-0x00007FF60F490000-0x00007FF60F7E1000-memory.dmp

Download

memory/644-2360-0x00007FF60F490000-0x00007FF60F7E1000-memory.dmp

Download

memory/804-135-0x00007FF7550C0000-0x00007FF755411000-memory.dmp

Download

memory/804-48-0x00007FF7550C0000-0x00007FF755411000-memory.dmp

Download

memory/804-2299-0x00007FF7550C0000-0x00007FF755411000-memory.dmp

Download

memory/872-2341-0x00007FF7C1130000-0x00007FF7C1481000-memory.dmp

Download

memory/872-101-0x00007FF7C1130000-0x00007FF7C1481000-memory.dmp

Download

memory/976-2368-0x00007FF74A340000-0x00007FF74A691000-memory.dmp

Download

memory/976-197-0x00007FF74A340000-0x00007FF74A691000-memory.dmp

Download

memory/1132-2195-0x00007FF607960000-0x00007FF607CB1000-memory.dmp

Download

memory/1132-14-0x00007FF607960000-0x00007FF607CB1000-memory.dmp

Download

memory/1132-75-0x00007FF607960000-0x00007FF607CB1000-memory.dmp

Download

memory/1568-68-0x00007FF7F49C0000-0x00007FF7F4D11000-memory.dmp

Download

memory/1568-8-0x00007FF7F49C0000-0x00007FF7F4D11000-memory.dmp

Download

memory/1568-2185-0x00007FF7F49C0000-0x00007FF7F4D11000-memory.dmp

Download

memory/1620-1-0x00000212A34F0000-0x00000212A3500000-memory.dmp

Download

memory/1620-62-0x00007FF68D9F0000-0x00007FF68DD41000-memory.dmp

Download

memory/1620-0-0x00007FF68D9F0000-0x00007FF68DD41000-memory.dmp

Download

memory/1700-117-0x00007FF71F480000-0x00007FF71F7D1000-memory.dmp

Download

memory/1700-2343-0x00007FF71F480000-0x00007FF71F7D1000-memory.dmp

Download

memory/2028-2202-0x00007FF64E930000-0x00007FF64EC81000-memory.dmp

Download

memory/2028-35-0x00007FF64E930000-0x00007FF64EC81000-memory.dmp

Download

memory/2752-95-0x00007FF7BFF90000-0x00007FF7C02E1000-memory.dmp

Download

memory/2752-33-0x00007FF7BFF90000-0x00007FF7C02E1000-memory.dmp

Download

memory/2752-2208-0x00007FF7BFF90000-0x00007FF7C02E1000-memory.dmp

Download

memory/3032-93-0x00007FF6BB5C0000-0x00007FF6BB911000-memory.dmp

Download

memory/3036-115-0x00007FF739BD0000-0x00007FF739F21000-memory.dmp

Download

memory/3036-47-0x00007FF739BD0000-0x00007FF739F21000-memory.dmp

Download

memory/3036-2212-0x00007FF739BD0000-0x00007FF739F21000-memory.dmp

Download

memory/3184-2302-0x00007FF7403D0000-0x00007FF740721000-memory.dmp

Download

memory/3184-63-0x00007FF7403D0000-0x00007FF740721000-memory.dmp

Download

memory/3328-2347-0x00007FF713C20000-0x00007FF713F71000-memory.dmp

Download

memory/3328-123-0x00007FF713C20000-0x00007FF713F71000-memory.dmp

Download

memory/3464-113-0x00007FF767170000-0x00007FF7674C1000-memory.dmp

Download

memory/3464-2211-0x00007FF767170000-0x00007FF7674C1000-memory.dmp

Download

memory/3464-37-0x00007FF767170000-0x00007FF7674C1000-memory.dmp

Download

memory/3640-155-0x00007FF68A910000-0x00007FF68AC61000-memory.dmp

Download

memory/3640-2358-0x00007FF68A910000-0x00007FF68AC61000-memory.dmp

Download

memory/3792-213-0x00007FF611620000-0x00007FF611971000-memory.dmp

Download

memory/3792-2363-0x00007FF611620000-0x00007FF611971000-memory.dmp

Download

memory/4100-22-0x00007FF7D80E0000-0x00007FF7D8431000-memory.dmp

Download

memory/4100-2207-0x00007FF7D80E0000-0x00007FF7D8431000-memory.dmp

Download

memory/4100-81-0x00007FF7D80E0000-0x00007FF7D8431000-memory.dmp

Download

memory/4428-126-0x00007FF71D8E0000-0x00007FF71DC31000-memory.dmp

Download

memory/4428-2349-0x00007FF71D8E0000-0x00007FF71DC31000-memory.dmp

Download

memory/4700-167-0x00007FF607280000-0x00007FF6075D1000-memory.dmp

Download

memory/4700-2356-0x00007FF607280000-0x00007FF6075D1000-memory.dmp

Download

memory/4708-2364-0x00007FF6B5E90000-0x00007FF6B61E1000-memory.dmp

Download

memory/4708-207-0x00007FF6B5E90000-0x00007FF6B61E1000-memory.dmp

Download

memory/4716-152-0x00007FF656640000-0x00007FF656991000-memory.dmp

Download

memory/4716-2354-0x00007FF656640000-0x00007FF656991000-memory.dmp

Download

memory/4732-2366-0x00007FF642360000-0x00007FF6426B1000-memory.dmp

Download

memory/4732-211-0x00007FF642360000-0x00007FF6426B1000-memory.dmp

Download

memory/4780-2345-0x00007FF6822A0000-0x00007FF6825F1000-memory.dmp

Download

memory/4780-116-0x00007FF6822A0000-0x00007FF6825F1000-memory.dmp

Download

memory/4856-192-0x00007FF7A9AF0000-0x00007FF7A9E41000-memory.dmp

Download

memory/4856-2371-0x00007FF7A9AF0000-0x00007FF7A9E41000-memory.dmp

Download

memory/4988-2304-0x00007FF6DE190000-0x00007FF6DE4E1000-memory.dmp

Download

memory/4988-70-0x00007FF6DE190000-0x00007FF6DE4E1000-memory.dmp

Download

memory/5044-2352-0x00007FF64F2B0000-0x00007FF64F601000-memory.dmp

Download

memory/5044-125-0x00007FF64F2B0000-0x00007FF64F601000-memory.dmp

Download

memory/5048-77-0x00007FF775B20000-0x00007FF775E71000-memory.dmp

Download

memory/5048-2318-0x00007FF775B20000-0x00007FF775E71000-memory.dmp

Download

memory/5100-205-0x00007FF714DB0000-0x00007FF715101000-memory.dmp

Download

memory/5100-2301-0x00007FF714DB0000-0x00007FF715101000-memory.dmp

Download

memory/5100-56-0x00007FF714DB0000-0x00007FF715101000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads