xmrig | e23dc2f62428c19db0cedb45797fe135f59f4789a5f15da9221817ffd239777c

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
Size 1.7MB
Sample240525-1blmtaba5y
SHA256 e23dc2f62428c19db0cedb45797fe135f59f4789a5f15da9221817ffd239777c
MD5 20f9d6eb1a3847817cfb8b092fadea50
SHA1 c7be8f9d9baf7dac5bf3a76dc68983c4f94ff717
SHA512 b990906c86d9ad47fefa75df696f51228209cc9ac689b674aaf834b99334a33a7d11ddd41d3165b91758c577cd31573ab723558bd559a0dbcc3a7729df8bd044
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYc:RWWBibae
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 53 IoCs

miner

resource	yara_rule
behavioral2/memory/4168-35-0x00007FF78F3C0000-0x00007FF78F711000-memory.dmp	xmrig
behavioral2/memory/2552-342-0x00007FF6DED40000-0x00007FF6DF091000-memory.dmp	xmrig
behavioral2/memory/952-404-0x00007FF6CADA0000-0x00007FF6CB0F1000-memory.dmp	xmrig
behavioral2/memory/3468-415-0x00007FF7F1F10000-0x00007FF7F2261000-memory.dmp	xmrig
behavioral2/memory/1596-452-0x00007FF68A8B0000-0x00007FF68AC01000-memory.dmp	xmrig
behavioral2/memory/2020-461-0x00007FF7120F0000-0x00007FF712441000-memory.dmp	xmrig
behavioral2/memory/2184-460-0x00007FF731780000-0x00007FF731AD1000-memory.dmp	xmrig
behavioral2/memory/4460-414-0x00007FF705010000-0x00007FF705361000-memory.dmp	xmrig
behavioral2/memory/1800-413-0x00007FF6C3690000-0x00007FF6C39E1000-memory.dmp	xmrig
behavioral2/memory/4284-412-0x00007FF6F0E90000-0x00007FF6F11E1000-memory.dmp	xmrig
behavioral2/memory/4092-411-0x00007FF647B00000-0x00007FF647E51000-memory.dmp	xmrig
behavioral2/memory/4880-403-0x00007FF67EEE0000-0x00007FF67F231000-memory.dmp	xmrig
behavioral2/memory/3732-361-0x00007FF782130000-0x00007FF782481000-memory.dmp	xmrig
behavioral2/memory/3020-313-0x00007FF658C30000-0x00007FF658F81000-memory.dmp	xmrig
behavioral2/memory/1496-307-0x00007FF69B050000-0x00007FF69B3A1000-memory.dmp	xmrig
behavioral2/memory/3600-265-0x00007FF618050000-0x00007FF6183A1000-memory.dmp	xmrig
behavioral2/memory/1212-241-0x00007FF709340000-0x00007FF709691000-memory.dmp	xmrig
behavioral2/memory/5092-240-0x00007FF7A1100000-0x00007FF7A1451000-memory.dmp	xmrig
behavioral2/memory/5060-224-0x00007FF669300000-0x00007FF669651000-memory.dmp	xmrig
behavioral2/memory/644-172-0x00007FF71EE00000-0x00007FF71F151000-memory.dmp	xmrig
behavioral2/memory/3088-141-0x00007FF6768E0000-0x00007FF676C31000-memory.dmp	xmrig
behavioral2/memory/2396-16-0x00007FF769370000-0x00007FF7696C1000-memory.dmp	xmrig
behavioral2/memory/2672-10-0x00007FF72EB60000-0x00007FF72EEB1000-memory.dmp	xmrig
behavioral2/memory/1848-2166-0x00007FF620950000-0x00007FF620CA1000-memory.dmp	xmrig
behavioral2/memory/2672-2265-0x00007FF72EB60000-0x00007FF72EEB1000-memory.dmp	xmrig
behavioral2/memory/2396-2269-0x00007FF769370000-0x00007FF7696C1000-memory.dmp	xmrig
behavioral2/memory/4284-2268-0x00007FF6F0E90000-0x00007FF6F11E1000-memory.dmp	xmrig
behavioral2/memory/4560-2273-0x00007FF7F1000000-0x00007FF7F1351000-memory.dmp	xmrig
behavioral2/memory/2388-2272-0x00007FF6E8BE0000-0x00007FF6E8F31000-memory.dmp	xmrig
behavioral2/memory/1800-2275-0x00007FF6C3690000-0x00007FF6C39E1000-memory.dmp	xmrig
behavioral2/memory/4168-2277-0x00007FF78F3C0000-0x00007FF78F711000-memory.dmp	xmrig
behavioral2/memory/4840-2281-0x00007FF736130000-0x00007FF736481000-memory.dmp	xmrig
behavioral2/memory/3000-2280-0x00007FF7A7250000-0x00007FF7A75A1000-memory.dmp	xmrig
behavioral2/memory/1496-2308-0x00007FF69B050000-0x00007FF69B3A1000-memory.dmp	xmrig
behavioral2/memory/952-2315-0x00007FF6CADA0000-0x00007FF6CB0F1000-memory.dmp	xmrig
behavioral2/memory/2020-2319-0x00007FF7120F0000-0x00007FF712441000-memory.dmp	xmrig
behavioral2/memory/4880-2313-0x00007FF67EEE0000-0x00007FF67F231000-memory.dmp	xmrig
behavioral2/memory/4092-2312-0x00007FF647B00000-0x00007FF647E51000-memory.dmp	xmrig
behavioral2/memory/3732-2306-0x00007FF782130000-0x00007FF782481000-memory.dmp	xmrig
behavioral2/memory/3600-2303-0x00007FF618050000-0x00007FF6183A1000-memory.dmp	xmrig
behavioral2/memory/2184-2310-0x00007FF731780000-0x00007FF731AD1000-memory.dmp	xmrig
behavioral2/memory/1212-2301-0x00007FF709340000-0x00007FF709691000-memory.dmp	xmrig
behavioral2/memory/5092-2299-0x00007FF7A1100000-0x00007FF7A1451000-memory.dmp	xmrig
behavioral2/memory/3468-2296-0x00007FF7F1F10000-0x00007FF7F2261000-memory.dmp	xmrig
behavioral2/memory/4676-2294-0x00007FF6A2C40000-0x00007FF6A2F91000-memory.dmp	xmrig
behavioral2/memory/2148-2292-0x00007FF63EB30000-0x00007FF63EE81000-memory.dmp	xmrig
behavioral2/memory/3088-2290-0x00007FF6768E0000-0x00007FF676C31000-memory.dmp	xmrig
behavioral2/memory/1596-2288-0x00007FF68A8B0000-0x00007FF68AC01000-memory.dmp	xmrig
behavioral2/memory/644-2286-0x00007FF71EE00000-0x00007FF71F151000-memory.dmp	xmrig
behavioral2/memory/5060-2284-0x00007FF669300000-0x00007FF669651000-memory.dmp	xmrig
behavioral2/memory/4460-2298-0x00007FF705010000-0x00007FF705361000-memory.dmp	xmrig
behavioral2/memory/2552-2348-0x00007FF6DED40000-0x00007FF6DF091000-memory.dmp	xmrig
behavioral2/memory/3020-2349-0x00007FF658C30000-0x00007FF658F81000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2672	kRGYJDE.exe
2396	oPBcICD.exe
4284	OWnKxoV.exe
4168	gUYgbYw.exe
2388	ZRYTOqy.exe
1800	YBZpfwS.exe
4560	PomJxIX.exe
4460	dQexUrn.exe
3000	ZLLqkcN.exe
4840	puGRCxb.exe
4676	WggFNym.exe
3468	fuiJrLT.exe
2148	Pbdhfxi.exe
3088	pHPhFCe.exe
1596	VyYpRvb.exe
644	SjPOCbb.exe
5060	VPJIgRE.exe
5092	xNMGZCk.exe
1212	DaaEoQx.exe
3600	pWoukJP.exe
1496	vUhXTjS.exe
2184	hznPaTd.exe
3020	hViqyfJ.exe
2552	FUVbwxi.exe
3732	lGQZUAD.exe
4880	PpknVVW.exe
952	PAoHjLN.exe
4092	HhlBdtC.exe
2020	fsPvRpW.exe
2700	WjwooCb.exe
3796	nxRmank.exe
4784	dZmaUUW.exe
3256	qKRXbMu.exe
2440	mifaTEt.exe
3248	NUmaCye.exe
440	mNpABnE.exe
1332	AmVzaIr.exe
1028	pOkZftD.exe
4876	TVAGHYO.exe
452	DWfjWuT.exe
3472	jgGtZii.exe
3296	VCybuSn.exe
3592	CrYnPEq.exe
4356	WCuEtsR.exe
412	KijvXfr.exe
3516	GgwxeTh.exe
3776	WJQAPPa.exe
1232	oKlrnUf.exe
4540	XqfVMxr.exe
2708	vyBCrqV.exe
4936	ieXjXhA.exe
4512	YnZiHlA.exe
532	tweRZFI.exe
1420	kUkURRU.exe
912	tZgEPEp.exe
3756	OXQWcJZ.exe
2152	BwCJqaI.exe
3104	XRTUMyR.exe
1052	MerUHxc.exe
5044	NPIpECz.exe
4404	JLjuStU.exe
3424	PIZVsrv.exe
4416	vNhNjyu.exe
4184	jQfkECa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1848-0-0x00007FF620950000-0x00007FF620CA1000-memory.dmp	upx
behavioral2/files/0x000900000002328e-6.dat	upx
behavioral2/files/0x000700000002341a-9.dat	upx
behavioral2/files/0x0007000000023419-12.dat	upx
behavioral2/files/0x000700000002341b-26.dat	upx
behavioral2/memory/4168-35-0x00007FF78F3C0000-0x00007FF78F711000-memory.dmp	upx
behavioral2/files/0x0007000000023422-52.dat	upx
behavioral2/memory/4676-99-0x00007FF6A2C40000-0x00007FF6A2F91000-memory.dmp	upx
behavioral2/files/0x0007000000023430-127.dat	upx
behavioral2/files/0x000700000002342b-158.dat	upx
behavioral2/memory/2552-342-0x00007FF6DED40000-0x00007FF6DF091000-memory.dmp	upx
behavioral2/memory/952-404-0x00007FF6CADA0000-0x00007FF6CB0F1000-memory.dmp	upx
behavioral2/memory/3468-415-0x00007FF7F1F10000-0x00007FF7F2261000-memory.dmp	upx
behavioral2/memory/1596-452-0x00007FF68A8B0000-0x00007FF68AC01000-memory.dmp	upx
behavioral2/memory/2020-461-0x00007FF7120F0000-0x00007FF712441000-memory.dmp	upx
behavioral2/memory/2184-460-0x00007FF731780000-0x00007FF731AD1000-memory.dmp	upx
behavioral2/memory/4460-414-0x00007FF705010000-0x00007FF705361000-memory.dmp	upx
behavioral2/memory/1800-413-0x00007FF6C3690000-0x00007FF6C39E1000-memory.dmp	upx
behavioral2/memory/4284-412-0x00007FF6F0E90000-0x00007FF6F11E1000-memory.dmp	upx
behavioral2/memory/4092-411-0x00007FF647B00000-0x00007FF647E51000-memory.dmp	upx
behavioral2/memory/4880-403-0x00007FF67EEE0000-0x00007FF67F231000-memory.dmp	upx
behavioral2/memory/3732-361-0x00007FF782130000-0x00007FF782481000-memory.dmp	upx
behavioral2/memory/3020-313-0x00007FF658C30000-0x00007FF658F81000-memory.dmp	upx
behavioral2/memory/1496-307-0x00007FF69B050000-0x00007FF69B3A1000-memory.dmp	upx
behavioral2/memory/3600-265-0x00007FF618050000-0x00007FF6183A1000-memory.dmp	upx
behavioral2/memory/1212-241-0x00007FF709340000-0x00007FF709691000-memory.dmp	upx
behavioral2/memory/5092-240-0x00007FF7A1100000-0x00007FF7A1451000-memory.dmp	upx
behavioral2/memory/5060-224-0x00007FF669300000-0x00007FF669651000-memory.dmp	upx
behavioral2/files/0x000700000002343d-187.dat	upx
behavioral2/files/0x000700000002343c-184.dat	upx
behavioral2/files/0x0007000000023435-183.dat	upx
behavioral2/files/0x0009000000023416-180.dat	upx
behavioral2/files/0x000700000002343b-179.dat	upx
behavioral2/memory/644-172-0x00007FF71EE00000-0x00007FF71F151000-memory.dmp	upx
behavioral2/files/0x000700000002343a-169.dat	upx
behavioral2/files/0x0007000000023439-166.dat	upx
behavioral2/files/0x000700000002342d-163.dat	upx
behavioral2/files/0x0007000000023426-157.dat	upx
behavioral2/files/0x0007000000023437-154.dat	upx
behavioral2/files/0x000700000002342a-153.dat	upx
behavioral2/files/0x0007000000023424-147.dat	upx
behavioral2/files/0x0007000000023436-144.dat	upx
behavioral2/files/0x000700000002342f-178.dat	upx
behavioral2/files/0x000700000002342e-175.dat	upx
behavioral2/files/0x0007000000023434-143.dat	upx
behavioral2/memory/3088-141-0x00007FF6768E0000-0x00007FF676C31000-memory.dmp	upx
behavioral2/memory/2148-137-0x00007FF63EB30000-0x00007FF63EE81000-memory.dmp	upx
behavioral2/files/0x0007000000023429-132.dat	upx
behavioral2/files/0x0007000000023428-130.dat	upx
behavioral2/files/0x0007000000023432-129.dat	upx
behavioral2/files/0x0007000000023431-128.dat	upx
behavioral2/files/0x0007000000023438-160.dat	upx
behavioral2/files/0x000700000002342c-159.dat	upx
behavioral2/files/0x0007000000023427-123.dat	upx
behavioral2/files/0x0007000000023425-119.dat	upx
behavioral2/files/0x0007000000023433-136.dat	upx
behavioral2/files/0x0007000000023421-87.dat	upx
behavioral2/files/0x0007000000023423-110.dat	upx
behavioral2/files/0x0007000000023420-85.dat	upx
behavioral2/files/0x000700000002341f-82.dat	upx
behavioral2/memory/4840-78-0x00007FF736130000-0x00007FF736481000-memory.dmp	upx
behavioral2/memory/3000-60-0x00007FF7A7250000-0x00007FF7A75A1000-memory.dmp	upx
behavioral2/files/0x000700000002341d-58.dat	upx
behavioral2/memory/4560-57-0x00007FF7F1000000-0x00007FF7F1351000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OqCuPRT.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\xCxwMBy.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\AyTDfdL.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\uFvddgm.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\cFtwcDO.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\sijXEuL.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\OGUrrEE.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\yZbqqlF.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\wSorwgf.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\pKCrcdq.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\LLyfnzP.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\txTqQGt.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\fuiJrLT.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\QXaodgx.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\mCGFHMT.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\mohDncO.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\lXMfuVk.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\FsvrjTd.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\SIeKCZb.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\dZiUhBL.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\BQnDtYQ.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\bQSaQHi.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\hoQmrJk.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\AmMeHLF.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\YBZpfwS.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\aMTpTXO.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\JrxhWKD.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\guAYmGB.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\OCLcOkB.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\tZgEPEp.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\zSEfdct.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\XkZsbXI.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\AwdQTvQ.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\sRAkXZn.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\sxvKCZQ.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\bhudZmz.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\JCtSqmx.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\sRAszCj.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\ukbIkkR.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\faYTOUZ.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\DzupksE.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\puGRCxb.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\HOrBdJo.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\FaBpwBR.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\iKJhFEO.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\CsdjzVB.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\YxVWlvu.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\WtNlFnZ.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\LZFTINt.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\ubGCFwu.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\kRGYJDE.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\DUelUoP.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\ntrDAmy.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\aayafoG.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\dRiyfmy.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\uYMpmrs.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\XqfVMxr.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\sDIJRgF.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\AwKsmuH.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\YKdmqvo.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\xQJPagC.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\PJxMuLS.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\WitUiQN.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
File created	C:\Windows\System\CrYnPEq.exe	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2672	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	83
PID 1848 wrote to memory of 2672	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	83
PID 1848 wrote to memory of 2396	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	84
PID 1848 wrote to memory of 2396	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	84
PID 1848 wrote to memory of 4284	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	85
PID 1848 wrote to memory of 4284	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	85
PID 1848 wrote to memory of 4168	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	86
PID 1848 wrote to memory of 4168	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	86
PID 1848 wrote to memory of 2388	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	87
PID 1848 wrote to memory of 2388	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	87
PID 1848 wrote to memory of 1800	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	88
PID 1848 wrote to memory of 1800	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	88
PID 1848 wrote to memory of 4560	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	89
PID 1848 wrote to memory of 4560	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	89
PID 1848 wrote to memory of 4460	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	90
PID 1848 wrote to memory of 4460	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	90
PID 1848 wrote to memory of 3000	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	91
PID 1848 wrote to memory of 3000	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	91
PID 1848 wrote to memory of 4840	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	92
PID 1848 wrote to memory of 4840	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	92
PID 1848 wrote to memory of 4676	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	93
PID 1848 wrote to memory of 4676	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	93
PID 1848 wrote to memory of 3468	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	94
PID 1848 wrote to memory of 3468	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	94
PID 1848 wrote to memory of 5060	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	95
PID 1848 wrote to memory of 5060	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	95
PID 1848 wrote to memory of 2148	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	96
PID 1848 wrote to memory of 2148	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	96
PID 1848 wrote to memory of 1212	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	97
PID 1848 wrote to memory of 1212	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	97
PID 1848 wrote to memory of 3088	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	98
PID 1848 wrote to memory of 3088	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	98
PID 1848 wrote to memory of 1596	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	99
PID 1848 wrote to memory of 1596	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	99
PID 1848 wrote to memory of 644	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	100
PID 1848 wrote to memory of 644	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	100
PID 1848 wrote to memory of 5092	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	101
PID 1848 wrote to memory of 5092	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	101
PID 1848 wrote to memory of 3600	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	102
PID 1848 wrote to memory of 3600	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	102
PID 1848 wrote to memory of 1496	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	103
PID 1848 wrote to memory of 1496	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	103
PID 1848 wrote to memory of 2184	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	104
PID 1848 wrote to memory of 2184	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	104
PID 1848 wrote to memory of 3020	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	105
PID 1848 wrote to memory of 3020	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	105
PID 1848 wrote to memory of 2552	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	106
PID 1848 wrote to memory of 2552	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	106
PID 1848 wrote to memory of 3732	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	107
PID 1848 wrote to memory of 3732	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	107
PID 1848 wrote to memory of 4880	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	108
PID 1848 wrote to memory of 4880	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	108
PID 1848 wrote to memory of 952	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	109
PID 1848 wrote to memory of 952	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	109
PID 1848 wrote to memory of 4092	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	110
PID 1848 wrote to memory of 4092	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	110
PID 1848 wrote to memory of 2020	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	111
PID 1848 wrote to memory of 2020	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	111
PID 1848 wrote to memory of 1332	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	112
PID 1848 wrote to memory of 1332	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	112
PID 1848 wrote to memory of 2700	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	113
PID 1848 wrote to memory of 2700	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	113
PID 1848 wrote to memory of 3796	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	114
PID 1848 wrote to memory of 3796	1848	20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\20f9d6eb1a3847817cfb8b092fadea50_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\System\kRGYJDE.exe
  C:\Windows\System\kRGYJDE.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\oPBcICD.exe
  C:\Windows\System\oPBcICD.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\OWnKxoV.exe
  C:\Windows\System\OWnKxoV.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\gUYgbYw.exe
  C:\Windows\System\gUYgbYw.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\ZRYTOqy.exe
  C:\Windows\System\ZRYTOqy.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\YBZpfwS.exe
  C:\Windows\System\YBZpfwS.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\PomJxIX.exe
  C:\Windows\System\PomJxIX.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\dQexUrn.exe
  C:\Windows\System\dQexUrn.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\ZLLqkcN.exe
  C:\Windows\System\ZLLqkcN.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\puGRCxb.exe
  C:\Windows\System\puGRCxb.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\WggFNym.exe
  C:\Windows\System\WggFNym.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\fuiJrLT.exe
  C:\Windows\System\fuiJrLT.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\VPJIgRE.exe
  C:\Windows\System\VPJIgRE.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\Pbdhfxi.exe
  C:\Windows\System\Pbdhfxi.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\DaaEoQx.exe
  C:\Windows\System\DaaEoQx.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\pHPhFCe.exe
  C:\Windows\System\pHPhFCe.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\VyYpRvb.exe
  C:\Windows\System\VyYpRvb.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\SjPOCbb.exe
  C:\Windows\System\SjPOCbb.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\xNMGZCk.exe
  C:\Windows\System\xNMGZCk.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\pWoukJP.exe
  C:\Windows\System\pWoukJP.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\vUhXTjS.exe
  C:\Windows\System\vUhXTjS.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\hznPaTd.exe
  C:\Windows\System\hznPaTd.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\hViqyfJ.exe
  C:\Windows\System\hViqyfJ.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\FUVbwxi.exe
  C:\Windows\System\FUVbwxi.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\lGQZUAD.exe
  C:\Windows\System\lGQZUAD.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\PpknVVW.exe
  C:\Windows\System\PpknVVW.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\PAoHjLN.exe
  C:\Windows\System\PAoHjLN.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\HhlBdtC.exe
  C:\Windows\System\HhlBdtC.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\fsPvRpW.exe
  C:\Windows\System\fsPvRpW.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\AmVzaIr.exe
  C:\Windows\System\AmVzaIr.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\WjwooCb.exe
  C:\Windows\System\WjwooCb.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\nxRmank.exe
  C:\Windows\System\nxRmank.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\dZmaUUW.exe
  C:\Windows\System\dZmaUUW.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\qKRXbMu.exe
  C:\Windows\System\qKRXbMu.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\mifaTEt.exe
  C:\Windows\System\mifaTEt.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\NUmaCye.exe
  C:\Windows\System\NUmaCye.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\mNpABnE.exe
  C:\Windows\System\mNpABnE.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\pOkZftD.exe
  C:\Windows\System\pOkZftD.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\TVAGHYO.exe
  C:\Windows\System\TVAGHYO.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\DWfjWuT.exe
  C:\Windows\System\DWfjWuT.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\jgGtZii.exe
  C:\Windows\System\jgGtZii.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\VCybuSn.exe
  C:\Windows\System\VCybuSn.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\CrYnPEq.exe
  C:\Windows\System\CrYnPEq.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\WCuEtsR.exe
  C:\Windows\System\WCuEtsR.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\KijvXfr.exe
  C:\Windows\System\KijvXfr.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\GgwxeTh.exe
  C:\Windows\System\GgwxeTh.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\WJQAPPa.exe
  C:\Windows\System\WJQAPPa.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\oKlrnUf.exe
  C:\Windows\System\oKlrnUf.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\XqfVMxr.exe
  C:\Windows\System\XqfVMxr.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\vyBCrqV.exe
  C:\Windows\System\vyBCrqV.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ieXjXhA.exe
  C:\Windows\System\ieXjXhA.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\YnZiHlA.exe
  C:\Windows\System\YnZiHlA.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\tweRZFI.exe
  C:\Windows\System\tweRZFI.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\kUkURRU.exe
  C:\Windows\System\kUkURRU.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\tZgEPEp.exe
  C:\Windows\System\tZgEPEp.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\OXQWcJZ.exe
  C:\Windows\System\OXQWcJZ.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\BwCJqaI.exe
  C:\Windows\System\BwCJqaI.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\XRTUMyR.exe
  C:\Windows\System\XRTUMyR.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\MerUHxc.exe
  C:\Windows\System\MerUHxc.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\NPIpECz.exe
  C:\Windows\System\NPIpECz.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\JLjuStU.exe
  C:\Windows\System\JLjuStU.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\PIZVsrv.exe
  C:\Windows\System\PIZVsrv.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\vNhNjyu.exe
  C:\Windows\System\vNhNjyu.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\jQfkECa.exe
  C:\Windows\System\jQfkECa.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\ddYxUzx.exe
  C:\Windows\System\ddYxUzx.exe
  2⤵
  PID:2856
- C:\Windows\System\snmeMKU.exe
  C:\Windows\System\snmeMKU.exe
  2⤵
  PID:2564
- C:\Windows\System\jgwXjAT.exe
  C:\Windows\System\jgwXjAT.exe
  2⤵
  PID:1748
- C:\Windows\System\JoJYBFB.exe
  C:\Windows\System\JoJYBFB.exe
  2⤵
  PID:5028
- C:\Windows\System\SufbwbI.exe
  C:\Windows\System\SufbwbI.exe
  2⤵
  PID:1296
- C:\Windows\System\qUlcfEK.exe
  C:\Windows\System\qUlcfEK.exe
  2⤵
  PID:4764
- C:\Windows\System\eMaqOxl.exe
  C:\Windows\System\eMaqOxl.exe
  2⤵
  PID:3284
- C:\Windows\System\LwHxAaT.exe
  C:\Windows\System\LwHxAaT.exe
  2⤵
  PID:4856
- C:\Windows\System\mBzVwYL.exe
  C:\Windows\System\mBzVwYL.exe
  2⤵
  PID:1348
- C:\Windows\System\KNtdJtP.exe
  C:\Windows\System\KNtdJtP.exe
  2⤵
  PID:3964
- C:\Windows\System\SYBbNSM.exe
  C:\Windows\System\SYBbNSM.exe
  2⤵
  PID:3712
- C:\Windows\System\FUGKkTE.exe
  C:\Windows\System\FUGKkTE.exe
  2⤵
  PID:3544
- C:\Windows\System\kqGkjCB.exe
  C:\Windows\System\kqGkjCB.exe
  2⤵
  PID:3976
- C:\Windows\System\zfCVnsH.exe
  C:\Windows\System\zfCVnsH.exe
  2⤵
  PID:1248
- C:\Windows\System\cmyFNzz.exe
  C:\Windows\System\cmyFNzz.exe
  2⤵
  PID:3752
- C:\Windows\System\wYyVYAM.exe
  C:\Windows\System\wYyVYAM.exe
  2⤵
  PID:1304
- C:\Windows\System\bnVLSTm.exe
  C:\Windows\System\bnVLSTm.exe
  2⤵
  PID:2572
- C:\Windows\System\TWPjMgs.exe
  C:\Windows\System\TWPjMgs.exe
  2⤵
  PID:3272
- C:\Windows\System\SQuNkOw.exe
  C:\Windows\System\SQuNkOw.exe
  2⤵
  PID:3736
- C:\Windows\System\JJFUuUJ.exe
  C:\Windows\System\JJFUuUJ.exe
  2⤵
  PID:4008
- C:\Windows\System\xLeNqRe.exe
  C:\Windows\System\xLeNqRe.exe
  2⤵
  PID:4140
- C:\Windows\System\sDJLPeU.exe
  C:\Windows\System\sDJLPeU.exe
  2⤵
  PID:2972
- C:\Windows\System\CmlECwr.exe
  C:\Windows\System\CmlECwr.exe
  2⤵
  PID:2256
- C:\Windows\System\kLpriaq.exe
  C:\Windows\System\kLpriaq.exe
  2⤵
  PID:5136
- C:\Windows\System\gRgDfoq.exe
  C:\Windows\System\gRgDfoq.exe
  2⤵
  PID:5172
- C:\Windows\System\PJPGAAG.exe
  C:\Windows\System\PJPGAAG.exe
  2⤵
  PID:5188
- C:\Windows\System\CwhheRP.exe
  C:\Windows\System\CwhheRP.exe
  2⤵
  PID:5208
- C:\Windows\System\bhudZmz.exe
  C:\Windows\System\bhudZmz.exe
  2⤵
  PID:5252
- C:\Windows\System\EKAGmIi.exe
  C:\Windows\System\EKAGmIi.exe
  2⤵
  PID:5272
- C:\Windows\System\yctZlHQ.exe
  C:\Windows\System\yctZlHQ.exe
  2⤵
  PID:5380
- C:\Windows\System\EvPBOXU.exe
  C:\Windows\System\EvPBOXU.exe
  2⤵
  PID:5396
- C:\Windows\System\CsdjzVB.exe
  C:\Windows\System\CsdjzVB.exe
  2⤵
  PID:5412
- C:\Windows\System\isTfAta.exe
  C:\Windows\System\isTfAta.exe
  2⤵
  PID:5428
- C:\Windows\System\PbJGJdg.exe
  C:\Windows\System\PbJGJdg.exe
  2⤵
  PID:5452
- C:\Windows\System\Ucgjpxk.exe
  C:\Windows\System\Ucgjpxk.exe
  2⤵
  PID:5468
- C:\Windows\System\uEamlDL.exe
  C:\Windows\System\uEamlDL.exe
  2⤵
  PID:5488
- C:\Windows\System\SsmXwsR.exe
  C:\Windows\System\SsmXwsR.exe
  2⤵
  PID:5508
- C:\Windows\System\rlzAItT.exe
  C:\Windows\System\rlzAItT.exe
  2⤵
  PID:5540
- C:\Windows\System\cFtwcDO.exe
  C:\Windows\System\cFtwcDO.exe
  2⤵
  PID:5560
- C:\Windows\System\BWMsRqk.exe
  C:\Windows\System\BWMsRqk.exe
  2⤵
  PID:5580
- C:\Windows\System\qfLatcj.exe
  C:\Windows\System\qfLatcj.exe
  2⤵
  PID:5736
- C:\Windows\System\KcrJyKG.exe
  C:\Windows\System\KcrJyKG.exe
  2⤵
  PID:5752
- C:\Windows\System\RqfAbHT.exe
  C:\Windows\System\RqfAbHT.exe
  2⤵
  PID:5772
- C:\Windows\System\CATzGqI.exe
  C:\Windows\System\CATzGqI.exe
  2⤵
  PID:5792
- C:\Windows\System\mtYTgVp.exe
  C:\Windows\System\mtYTgVp.exe
  2⤵
  PID:5808
- C:\Windows\System\kuujOYU.exe
  C:\Windows\System\kuujOYU.exe
  2⤵
  PID:5832
- C:\Windows\System\XMbQNiQ.exe
  C:\Windows\System\XMbQNiQ.exe
  2⤵
  PID:5852
- C:\Windows\System\JVJhTYQ.exe
  C:\Windows\System\JVJhTYQ.exe
  2⤵
  PID:5872
- C:\Windows\System\iCKbmxC.exe
  C:\Windows\System\iCKbmxC.exe
  2⤵
  PID:5892
- C:\Windows\System\eOconJj.exe
  C:\Windows\System\eOconJj.exe
  2⤵
  PID:5912
- C:\Windows\System\AdoTstA.exe
  C:\Windows\System\AdoTstA.exe
  2⤵
  PID:5928
- C:\Windows\System\xwpEmPC.exe
  C:\Windows\System\xwpEmPC.exe
  2⤵
  PID:5948
- C:\Windows\System\mZxKNSX.exe
  C:\Windows\System\mZxKNSX.exe
  2⤵
  PID:5976
- C:\Windows\System\aDmMQsH.exe
  C:\Windows\System\aDmMQsH.exe
  2⤵
  PID:5996
- C:\Windows\System\IrYUufR.exe
  C:\Windows\System\IrYUufR.exe
  2⤵
  PID:1192
- C:\Windows\System\iaUOxLh.exe
  C:\Windows\System\iaUOxLh.exe
  2⤵
  PID:544
- C:\Windows\System\eVSvIYk.exe
  C:\Windows\System\eVSvIYk.exe
  2⤵
  PID:1416
- C:\Windows\System\eugyYZM.exe
  C:\Windows\System\eugyYZM.exe
  2⤵
  PID:3432
- C:\Windows\System\eFlxHbO.exe
  C:\Windows\System\eFlxHbO.exe
  2⤵
  PID:2216
- C:\Windows\System\bPVKgQe.exe
  C:\Windows\System\bPVKgQe.exe
  2⤵
  PID:668
- C:\Windows\System\zpEGdsB.exe
  C:\Windows\System\zpEGdsB.exe
  2⤵
  PID:4496
- C:\Windows\System\PruNqvK.exe
  C:\Windows\System\PruNqvK.exe
  2⤵
  PID:3164
- C:\Windows\System\JFuOOPY.exe
  C:\Windows\System\JFuOOPY.exe
  2⤵
  PID:3236
- C:\Windows\System\RxxIFjJ.exe
  C:\Windows\System\RxxIFjJ.exe
  2⤵
  PID:3720
- C:\Windows\System\sDIJRgF.exe
  C:\Windows\System\sDIJRgF.exe
  2⤵
  PID:5848
- C:\Windows\System\DUelUoP.exe
  C:\Windows\System\DUelUoP.exe
  2⤵
  PID:5880
- C:\Windows\System\eapSLOL.exe
  C:\Windows\System\eapSLOL.exe
  2⤵
  PID:5904
- C:\Windows\System\TKgzmLa.exe
  C:\Windows\System\TKgzmLa.exe
  2⤵
  PID:5936
- C:\Windows\System\uwWcjLP.exe
  C:\Windows\System\uwWcjLP.exe
  2⤵
  PID:5964
- C:\Windows\System\EZKvtlt.exe
  C:\Windows\System\EZKvtlt.exe
  2⤵
  PID:6004
- C:\Windows\System\SdghhKb.exe
  C:\Windows\System\SdghhKb.exe
  2⤵
  PID:6084
- C:\Windows\System\uQknpQJ.exe
  C:\Windows\System\uQknpQJ.exe
  2⤵
  PID:6112
- C:\Windows\System\bVdsbQh.exe
  C:\Windows\System\bVdsbQh.exe
  2⤵
  PID:2120
- C:\Windows\System\mpfNWIU.exe
  C:\Windows\System\mpfNWIU.exe
  2⤵
  PID:5108
- C:\Windows\System\ERKGWkI.exe
  C:\Windows\System\ERKGWkI.exe
  2⤵
  PID:1588
- C:\Windows\System\ncBvsPB.exe
  C:\Windows\System\ncBvsPB.exe
  2⤵
  PID:1860
- C:\Windows\System\yOHRSQb.exe
  C:\Windows\System\yOHRSQb.exe
  2⤵
  PID:1716
- C:\Windows\System\jtRlark.exe
  C:\Windows\System\jtRlark.exe
  2⤵
  PID:4672
- C:\Windows\System\UvgdQlF.exe
  C:\Windows\System\UvgdQlF.exe
  2⤵
  PID:5296
- C:\Windows\System\EVoVcLk.exe
  C:\Windows\System\EVoVcLk.exe
  2⤵
  PID:1996
- C:\Windows\System\eubQVPh.exe
  C:\Windows\System\eubQVPh.exe
  2⤵
  PID:4736
- C:\Windows\System\bVmxmci.exe
  C:\Windows\System\bVmxmci.exe
  2⤵
  PID:2372
- C:\Windows\System\ljHcjXd.exe
  C:\Windows\System\ljHcjXd.exe
  2⤵
  PID:5300
- C:\Windows\System\apViWWH.exe
  C:\Windows\System\apViWWH.exe
  2⤵
  PID:5392
- C:\Windows\System\deyBKRA.exe
  C:\Windows\System\deyBKRA.exe
  2⤵
  PID:6168
- C:\Windows\System\DdRmHKe.exe
  C:\Windows\System\DdRmHKe.exe
  2⤵
  PID:6188
- C:\Windows\System\kZiFQOt.exe
  C:\Windows\System\kZiFQOt.exe
  2⤵
  PID:6212
- C:\Windows\System\dDMIVdX.exe
  C:\Windows\System\dDMIVdX.exe
  2⤵
  PID:6240
- C:\Windows\System\brRrFEM.exe
  C:\Windows\System\brRrFEM.exe
  2⤵
  PID:6256
- C:\Windows\System\pxlHPBY.exe
  C:\Windows\System\pxlHPBY.exe
  2⤵
  PID:6280
- C:\Windows\System\PNBZyWg.exe
  C:\Windows\System\PNBZyWg.exe
  2⤵
  PID:6320
- C:\Windows\System\sijXEuL.exe
  C:\Windows\System\sijXEuL.exe
  2⤵
  PID:6336
- C:\Windows\System\cAAeoQY.exe
  C:\Windows\System\cAAeoQY.exe
  2⤵
  PID:6356
- C:\Windows\System\gcjfaFh.exe
  C:\Windows\System\gcjfaFh.exe
  2⤵
  PID:6376
- C:\Windows\System\WFDmzZZ.exe
  C:\Windows\System\WFDmzZZ.exe
  2⤵
  PID:6396
- C:\Windows\System\nDWyEdf.exe
  C:\Windows\System\nDWyEdf.exe
  2⤵
  PID:6548
- C:\Windows\System\tKWbfGy.exe
  C:\Windows\System\tKWbfGy.exe
  2⤵
  PID:6572
- C:\Windows\System\fTFugQI.exe
  C:\Windows\System\fTFugQI.exe
  2⤵
  PID:6592
- C:\Windows\System\tqQWyYo.exe
  C:\Windows\System\tqQWyYo.exe
  2⤵
  PID:6612
- C:\Windows\System\sRAkXZn.exe
  C:\Windows\System\sRAkXZn.exe
  2⤵
  PID:6636
- C:\Windows\System\BcODTyb.exe
  C:\Windows\System\BcODTyb.exe
  2⤵
  PID:6656
- C:\Windows\System\ZBDeLym.exe
  C:\Windows\System\ZBDeLym.exe
  2⤵
  PID:6676
- C:\Windows\System\aMTpTXO.exe
  C:\Windows\System\aMTpTXO.exe
  2⤵
  PID:6704
- C:\Windows\System\WTseMsH.exe
  C:\Windows\System\WTseMsH.exe
  2⤵
  PID:6728
- C:\Windows\System\egGOrGP.exe
  C:\Windows\System\egGOrGP.exe
  2⤵
  PID:6752
- C:\Windows\System\lVncnAe.exe
  C:\Windows\System\lVncnAe.exe
  2⤵
  PID:6772
- C:\Windows\System\nRFpcEe.exe
  C:\Windows\System\nRFpcEe.exe
  2⤵
  PID:6796
- C:\Windows\System\PtGtBJG.exe
  C:\Windows\System\PtGtBJG.exe
  2⤵
  PID:6816
- C:\Windows\System\mMltGxk.exe
  C:\Windows\System\mMltGxk.exe
  2⤵
  PID:6836
- C:\Windows\System\TReckdG.exe
  C:\Windows\System\TReckdG.exe
  2⤵
  PID:6860
- C:\Windows\System\wUrbSdm.exe
  C:\Windows\System\wUrbSdm.exe
  2⤵
  PID:6880
- C:\Windows\System\RsmUwPD.exe
  C:\Windows\System\RsmUwPD.exe
  2⤵
  PID:6900
- C:\Windows\System\lXMfuVk.exe
  C:\Windows\System\lXMfuVk.exe
  2⤵
  PID:6932
- C:\Windows\System\ntrDAmy.exe
  C:\Windows\System\ntrDAmy.exe
  2⤵
  PID:6948
- C:\Windows\System\hcmfyUO.exe
  C:\Windows\System\hcmfyUO.exe
  2⤵
  PID:6972
- C:\Windows\System\qEPhACo.exe
  C:\Windows\System\qEPhACo.exe
  2⤵
  PID:6988
- C:\Windows\System\ijPoaNU.exe
  C:\Windows\System\ijPoaNU.exe
  2⤵
  PID:6156
- C:\Windows\System\yQVrNUh.exe
  C:\Windows\System\yQVrNUh.exe
  2⤵
  PID:6316
- C:\Windows\System\FjaDMbh.exe
  C:\Windows\System\FjaDMbh.exe
  2⤵
  PID:6364
- C:\Windows\System\hxrYifr.exe
  C:\Windows\System\hxrYifr.exe
  2⤵
  PID:6412
- C:\Windows\System\QMpJxeA.exe
  C:\Windows\System\QMpJxeA.exe
  2⤵
  PID:3572
- C:\Windows\System\kAYxnZB.exe
  C:\Windows\System\kAYxnZB.exe
  2⤵
  PID:6476
- C:\Windows\System\eIYPbnF.exe
  C:\Windows\System\eIYPbnF.exe
  2⤵
  PID:1916
- C:\Windows\System\eRExxDY.exe
  C:\Windows\System\eRExxDY.exe
  2⤵
  PID:6532
- C:\Windows\System\PHQvtag.exe
  C:\Windows\System\PHQvtag.exe
  2⤵
  PID:6568
- C:\Windows\System\ITFTLAV.exe
  C:\Windows\System\ITFTLAV.exe
  2⤵
  PID:6608
- C:\Windows\System\buJmAdx.exe
  C:\Windows\System\buJmAdx.exe
  2⤵
  PID:6644
- C:\Windows\System\SOPFLia.exe
  C:\Windows\System\SOPFLia.exe
  2⤵
  PID:6688
- C:\Windows\System\KTOtJZs.exe
  C:\Windows\System\KTOtJZs.exe
  2⤵
  PID:6724
- C:\Windows\System\Pgqppdj.exe
  C:\Windows\System\Pgqppdj.exe
  2⤵
  PID:6768
- C:\Windows\System\RAdtnnQ.exe
  C:\Windows\System\RAdtnnQ.exe
  2⤵
  PID:6808
- C:\Windows\System\mndBddv.exe
  C:\Windows\System\mndBddv.exe
  2⤵
  PID:6856
- C:\Windows\System\cNMCrBc.exe
  C:\Windows\System\cNMCrBc.exe
  2⤵
  PID:6892
- C:\Windows\System\bEOQOqZ.exe
  C:\Windows\System\bEOQOqZ.exe
  2⤵
  PID:6956
- C:\Windows\System\WJngoMN.exe
  C:\Windows\System\WJngoMN.exe
  2⤵
  PID:6996
- C:\Windows\System\tJgyObp.exe
  C:\Windows\System\tJgyObp.exe
  2⤵
  PID:7128
- C:\Windows\System\VLVpJUb.exe
  C:\Windows\System\VLVpJUb.exe
  2⤵
  PID:5800
- C:\Windows\System\pNZHTtn.exe
  C:\Windows\System\pNZHTtn.exe
  2⤵
  PID:5592
- C:\Windows\System\aayafoG.exe
  C:\Windows\System\aayafoG.exe
  2⤵
  PID:2436
- C:\Windows\System\GNxDCvp.exe
  C:\Windows\System\GNxDCvp.exe
  2⤵
  PID:1772
- C:\Windows\System\qxInydv.exe
  C:\Windows\System\qxInydv.exe
  2⤵
  PID:4344
- C:\Windows\System\cBpMjSE.exe
  C:\Windows\System\cBpMjSE.exe
  2⤵
  PID:2460
- C:\Windows\System\OLXzisL.exe
  C:\Windows\System\OLXzisL.exe
  2⤵
  PID:4732
- C:\Windows\System\IeGfdAJ.exe
  C:\Windows\System\IeGfdAJ.exe
  2⤵
  PID:2752
- C:\Windows\System\iGrAmjs.exe
  C:\Windows\System\iGrAmjs.exe
  2⤵
  PID:1484
- C:\Windows\System\uFcsWue.exe
  C:\Windows\System\uFcsWue.exe
  2⤵
  PID:1832
- C:\Windows\System\fSsJzTA.exe
  C:\Windows\System\fSsJzTA.exe
  2⤵
  PID:3880
- C:\Windows\System\ocqDlNZ.exe
  C:\Windows\System\ocqDlNZ.exe
  2⤵
  PID:4976
- C:\Windows\System\gCOKLDo.exe
  C:\Windows\System\gCOKLDo.exe
  2⤵
  PID:2776
- C:\Windows\System\zhbpCao.exe
  C:\Windows\System\zhbpCao.exe
  2⤵
  PID:2544
- C:\Windows\System\iCFGFHH.exe
  C:\Windows\System\iCFGFHH.exe
  2⤵
  PID:1780
- C:\Windows\System\dqcykCC.exe
  C:\Windows\System\dqcykCC.exe
  2⤵
  PID:5668
- C:\Windows\System\MDwPJtW.exe
  C:\Windows\System\MDwPJtW.exe
  2⤵
  PID:1688
- C:\Windows\System\iYHtTcL.exe
  C:\Windows\System\iYHtTcL.exe
  2⤵
  PID:6220
- C:\Windows\System\bexpKly.exe
  C:\Windows\System\bexpKly.exe
  2⤵
  PID:6384
- C:\Windows\System\RxPxBmD.exe
  C:\Windows\System\RxPxBmD.exe
  2⤵
  PID:6232
- C:\Windows\System\SHPkKeU.exe
  C:\Windows\System\SHPkKeU.exe
  2⤵
  PID:6332
- C:\Windows\System\DObfLxd.exe
  C:\Windows\System\DObfLxd.exe
  2⤵
  PID:6444
- C:\Windows\System\NKcdqTG.exe
  C:\Windows\System\NKcdqTG.exe
  2⤵
  PID:6628
- C:\Windows\System\PiOKGvT.exe
  C:\Windows\System\PiOKGvT.exe
  2⤵
  PID:6804
- C:\Windows\System\AlzScfB.exe
  C:\Windows\System\AlzScfB.exe
  2⤵
  PID:6652
- C:\Windows\System\tIxCAWx.exe
  C:\Windows\System\tIxCAWx.exe
  2⤵
  PID:7160
- C:\Windows\System\dgUiZin.exe
  C:\Windows\System\dgUiZin.exe
  2⤵
  PID:5504
- C:\Windows\System\rojSMXc.exe
  C:\Windows\System\rojSMXc.exe
  2⤵
  PID:6888
- C:\Windows\System\LLyfnzP.exe
  C:\Windows\System\LLyfnzP.exe
  2⤵
  PID:4244
- C:\Windows\System\ULKvdvN.exe
  C:\Windows\System\ULKvdvN.exe
  2⤵
  PID:840
- C:\Windows\System\txTqQGt.exe
  C:\Windows\System\txTqQGt.exe
  2⤵
  PID:4756
- C:\Windows\System\eDAREwH.exe
  C:\Windows\System\eDAREwH.exe
  2⤵
  PID:3076
- C:\Windows\System\OrSRcdu.exe
  C:\Windows\System\OrSRcdu.exe
  2⤵
  PID:208
- C:\Windows\System\DnPIEMc.exe
  C:\Windows\System\DnPIEMc.exe
  2⤵
  PID:6500
- C:\Windows\System\YsDoycb.exe
  C:\Windows\System\YsDoycb.exe
  2⤵
  PID:2688
- C:\Windows\System\FsvrjTd.exe
  C:\Windows\System\FsvrjTd.exe
  2⤵
  PID:7176
- C:\Windows\System\jLRooDp.exe
  C:\Windows\System\jLRooDp.exe
  2⤵
  PID:7200
- C:\Windows\System\WevAxiN.exe
  C:\Windows\System\WevAxiN.exe
  2⤵
  PID:7220
- C:\Windows\System\ubteVMU.exe
  C:\Windows\System\ubteVMU.exe
  2⤵
  PID:7240
- C:\Windows\System\QLNYlzL.exe
  C:\Windows\System\QLNYlzL.exe
  2⤵
  PID:7264
- C:\Windows\System\ujfbdFn.exe
  C:\Windows\System\ujfbdFn.exe
  2⤵
  PID:7280
- C:\Windows\System\fBePOxH.exe
  C:\Windows\System\fBePOxH.exe
  2⤵
  PID:7300
- C:\Windows\System\QfXIINu.exe
  C:\Windows\System\QfXIINu.exe
  2⤵
  PID:7328
- C:\Windows\System\UGrycAx.exe
  C:\Windows\System\UGrycAx.exe
  2⤵
  PID:7344
- C:\Windows\System\YMIbbvO.exe
  C:\Windows\System\YMIbbvO.exe
  2⤵
  PID:7364
- C:\Windows\System\ijxJZsb.exe
  C:\Windows\System\ijxJZsb.exe
  2⤵
  PID:7388
- C:\Windows\System\JuuZcnA.exe
  C:\Windows\System\JuuZcnA.exe
  2⤵
  PID:7412
- C:\Windows\System\GBWqMZH.exe
  C:\Windows\System\GBWqMZH.exe
  2⤵
  PID:7432
- C:\Windows\System\vZMWgIA.exe
  C:\Windows\System\vZMWgIA.exe
  2⤵
  PID:7452
- C:\Windows\System\QKXqAff.exe
  C:\Windows\System\QKXqAff.exe
  2⤵
  PID:7476
- C:\Windows\System\ljNfoMq.exe
  C:\Windows\System\ljNfoMq.exe
  2⤵
  PID:7496
- C:\Windows\System\WOEhORq.exe
  C:\Windows\System\WOEhORq.exe
  2⤵
  PID:7516
- C:\Windows\System\HOrBdJo.exe
  C:\Windows\System\HOrBdJo.exe
  2⤵
  PID:7540
- C:\Windows\System\yipNeab.exe
  C:\Windows\System\yipNeab.exe
  2⤵
  PID:7564
- C:\Windows\System\WtNlFnZ.exe
  C:\Windows\System\WtNlFnZ.exe
  2⤵
  PID:7584
- C:\Windows\System\JzlgRbB.exe
  C:\Windows\System\JzlgRbB.exe
  2⤵
  PID:7612
- C:\Windows\System\SydITSb.exe
  C:\Windows\System\SydITSb.exe
  2⤵
  PID:7636
- C:\Windows\System\rptSvDC.exe
  C:\Windows\System\rptSvDC.exe
  2⤵
  PID:7652
- C:\Windows\System\BaNCctA.exe
  C:\Windows\System\BaNCctA.exe
  2⤵
  PID:7676
- C:\Windows\System\NNHyLyH.exe
  C:\Windows\System\NNHyLyH.exe
  2⤵
  PID:7700
- C:\Windows\System\pfFOrRj.exe
  C:\Windows\System\pfFOrRj.exe
  2⤵
  PID:7716
- C:\Windows\System\yCTBByM.exe
  C:\Windows\System\yCTBByM.exe
  2⤵
  PID:7732
- C:\Windows\System\LzoalOm.exe
  C:\Windows\System\LzoalOm.exe
  2⤵
  PID:7752
- C:\Windows\System\KtAVoIC.exe
  C:\Windows\System\KtAVoIC.exe
  2⤵
  PID:7772
- C:\Windows\System\EMieJkg.exe
  C:\Windows\System\EMieJkg.exe
  2⤵
  PID:7792
- C:\Windows\System\yVPFMUw.exe
  C:\Windows\System\yVPFMUw.exe
  2⤵
  PID:7812
- C:\Windows\System\eHxIRXx.exe
  C:\Windows\System\eHxIRXx.exe
  2⤵
  PID:7836
- C:\Windows\System\apemrMd.exe
  C:\Windows\System\apemrMd.exe
  2⤵
  PID:7864
- C:\Windows\System\NQFvvAZ.exe
  C:\Windows\System\NQFvvAZ.exe
  2⤵
  PID:7888
- C:\Windows\System\isbVvFM.exe
  C:\Windows\System\isbVvFM.exe
  2⤵
  PID:7908
- C:\Windows\System\sBYdzLx.exe
  C:\Windows\System\sBYdzLx.exe
  2⤵
  PID:7932
- C:\Windows\System\CnQhyEs.exe
  C:\Windows\System\CnQhyEs.exe
  2⤵
  PID:7952
- C:\Windows\System\PJxMuLS.exe
  C:\Windows\System\PJxMuLS.exe
  2⤵
  PID:7980
- C:\Windows\System\rxvVxes.exe
  C:\Windows\System\rxvVxes.exe
  2⤵
  PID:8004
- C:\Windows\System\LZFTINt.exe
  C:\Windows\System\LZFTINt.exe
  2⤵
  PID:8024
- C:\Windows\System\mdsHOMu.exe
  C:\Windows\System\mdsHOMu.exe
  2⤵
  PID:8052
- C:\Windows\System\iWejYwB.exe
  C:\Windows\System\iWejYwB.exe
  2⤵
  PID:8072
- C:\Windows\System\gTLGXam.exe
  C:\Windows\System\gTLGXam.exe
  2⤵
  PID:8096
- C:\Windows\System\ZKthZRI.exe
  C:\Windows\System\ZKthZRI.exe
  2⤵
  PID:8112
- C:\Windows\System\keeBhZv.exe
  C:\Windows\System\keeBhZv.exe
  2⤵
  PID:8136
- C:\Windows\System\hdFBXxr.exe
  C:\Windows\System\hdFBXxr.exe
  2⤵
  PID:8156
- C:\Windows\System\GQposOQ.exe
  C:\Windows\System\GQposOQ.exe
  2⤵
  PID:8180
- C:\Windows\System\urZzAuF.exe
  C:\Windows\System\urZzAuF.exe
  2⤵
  PID:6760
- C:\Windows\System\DrEVQfn.exe
  C:\Windows\System\DrEVQfn.exe
  2⤵
  PID:4772
- C:\Windows\System\XVzXkHp.exe
  C:\Windows\System\XVzXkHp.exe
  2⤵
  PID:6348
- C:\Windows\System\zSEfdct.exe
  C:\Windows\System\zSEfdct.exe
  2⤵
  PID:6584
- C:\Windows\System\UMokZVe.exe
  C:\Windows\System\UMokZVe.exe
  2⤵
  PID:7208
- C:\Windows\System\yFlvYHI.exe
  C:\Windows\System\yFlvYHI.exe
  2⤵
  PID:6048
- C:\Windows\System\wWRdcEQ.exe
  C:\Windows\System\wWRdcEQ.exe
  2⤵
  PID:5016
- C:\Windows\System\WkgogVk.exe
  C:\Windows\System\WkgogVk.exe
  2⤵
  PID:7380
- C:\Windows\System\jWQkElX.exe
  C:\Windows\System\jWQkElX.exe
  2⤵
  PID:6312
- C:\Windows\System\OGUrrEE.exe
  C:\Windows\System\OGUrrEE.exe
  2⤵
  PID:6844
- C:\Windows\System\fTyhjWU.exe
  C:\Windows\System\fTyhjWU.exe
  2⤵
  PID:7572
- C:\Windows\System\wsdPWws.exe
  C:\Windows\System\wsdPWws.exe
  2⤵
  PID:7688
- C:\Windows\System\IgdtVas.exe
  C:\Windows\System\IgdtVas.exe
  2⤵
  PID:7292
- C:\Windows\System\swwaAfJ.exe
  C:\Windows\System\swwaAfJ.exe
  2⤵
  PID:7852
- C:\Windows\System\zJUcHDF.exe
  C:\Windows\System\zJUcHDF.exe
  2⤵
  PID:7968
- C:\Windows\System\HhCpqaj.exe
  C:\Windows\System\HhCpqaj.exe
  2⤵
  PID:7488
- C:\Windows\System\zrggUFQ.exe
  C:\Windows\System\zrggUFQ.exe
  2⤵
  PID:8200
- C:\Windows\System\zpKfnqW.exe
  C:\Windows\System\zpKfnqW.exe
  2⤵
  PID:8224
- C:\Windows\System\wreUzLv.exe
  C:\Windows\System\wreUzLv.exe
  2⤵
  PID:8248
- C:\Windows\System\mCOcYPf.exe
  C:\Windows\System\mCOcYPf.exe
  2⤵
  PID:8264
- C:\Windows\System\NUBTDzJ.exe
  C:\Windows\System\NUBTDzJ.exe
  2⤵
  PID:8284
- C:\Windows\System\JCtSqmx.exe
  C:\Windows\System\JCtSqmx.exe
  2⤵
  PID:8308
- C:\Windows\System\yZbqqlF.exe
  C:\Windows\System\yZbqqlF.exe
  2⤵
  PID:8332
- C:\Windows\System\ylwMMCp.exe
  C:\Windows\System\ylwMMCp.exe
  2⤵
  PID:8356
- C:\Windows\System\lXYCHsk.exe
  C:\Windows\System\lXYCHsk.exe
  2⤵
  PID:8376
- C:\Windows\System\eeYRjDC.exe
  C:\Windows\System\eeYRjDC.exe
  2⤵
  PID:8396
- C:\Windows\System\NaCrsqG.exe
  C:\Windows\System\NaCrsqG.exe
  2⤵
  PID:8420
- C:\Windows\System\PMnWwsN.exe
  C:\Windows\System\PMnWwsN.exe
  2⤵
  PID:8440
- C:\Windows\System\PynaXDT.exe
  C:\Windows\System\PynaXDT.exe
  2⤵
  PID:8460
- C:\Windows\System\WhVSqtc.exe
  C:\Windows\System\WhVSqtc.exe
  2⤵
  PID:8484
- C:\Windows\System\asSzOfb.exe
  C:\Windows\System\asSzOfb.exe
  2⤵
  PID:8508
- C:\Windows\System\kATrtgj.exe
  C:\Windows\System\kATrtgj.exe
  2⤵
  PID:8532
- C:\Windows\System\HuXnhpw.exe
  C:\Windows\System\HuXnhpw.exe
  2⤵
  PID:8556
- C:\Windows\System\icmfVkT.exe
  C:\Windows\System\icmfVkT.exe
  2⤵
  PID:8576
- C:\Windows\System\JkWsKjO.exe
  C:\Windows\System\JkWsKjO.exe
  2⤵
  PID:8600
- C:\Windows\System\AccXMPx.exe
  C:\Windows\System\AccXMPx.exe
  2⤵
  PID:8624
- C:\Windows\System\GDDXlFV.exe
  C:\Windows\System\GDDXlFV.exe
  2⤵
  PID:8656
- C:\Windows\System\PgWrYqF.exe
  C:\Windows\System\PgWrYqF.exe
  2⤵
  PID:8672
- C:\Windows\System\WCKVsna.exe
  C:\Windows\System\WCKVsna.exe
  2⤵
  PID:8696
- C:\Windows\System\tykklAF.exe
  C:\Windows\System\tykklAF.exe
  2⤵
  PID:8720
- C:\Windows\System\tdFYhmI.exe
  C:\Windows\System\tdFYhmI.exe
  2⤵
  PID:8740
- C:\Windows\System\UqDTMwT.exe
  C:\Windows\System\UqDTMwT.exe
  2⤵
  PID:8756
- C:\Windows\System\BYPSoHf.exe
  C:\Windows\System\BYPSoHf.exe
  2⤵
  PID:8784
- C:\Windows\System\iWpFsrC.exe
  C:\Windows\System\iWpFsrC.exe
  2⤵
  PID:8808
- C:\Windows\System\cHCzAUb.exe
  C:\Windows\System\cHCzAUb.exe
  2⤵
  PID:8832
- C:\Windows\System\tqkuXcY.exe
  C:\Windows\System\tqkuXcY.exe
  2⤵
  PID:8860
- C:\Windows\System\bqturdl.exe
  C:\Windows\System\bqturdl.exe
  2⤵
  PID:8876
- C:\Windows\System\axAhatK.exe
  C:\Windows\System\axAhatK.exe
  2⤵
  PID:8900
- C:\Windows\System\sQdWkTi.exe
  C:\Windows\System\sQdWkTi.exe
  2⤵
  PID:8920
- C:\Windows\System\bYlbvJs.exe
  C:\Windows\System\bYlbvJs.exe
  2⤵
  PID:8944
- C:\Windows\System\LcRXMdY.exe
  C:\Windows\System\LcRXMdY.exe
  2⤵
  PID:8968
- C:\Windows\System\sxvKCZQ.exe
  C:\Windows\System\sxvKCZQ.exe
  2⤵
  PID:8988
- C:\Windows\System\PxaXaCK.exe
  C:\Windows\System\PxaXaCK.exe
  2⤵
  PID:9012
- C:\Windows\System\bVhJMdl.exe
  C:\Windows\System\bVhJMdl.exe
  2⤵
  PID:9036
- C:\Windows\System\IboWlDL.exe
  C:\Windows\System\IboWlDL.exe
  2⤵
  PID:9060
- C:\Windows\System\zRdHCkn.exe
  C:\Windows\System\zRdHCkn.exe
  2⤵
  PID:9080
- C:\Windows\System\SIeKCZb.exe
  C:\Windows\System\SIeKCZb.exe
  2⤵
  PID:9108
- C:\Windows\System\JwYGjbX.exe
  C:\Windows\System\JwYGjbX.exe
  2⤵
  PID:9140
- C:\Windows\System\WNNSWqD.exe
  C:\Windows\System\WNNSWqD.exe
  2⤵
  PID:9164
- C:\Windows\System\RTMfLOY.exe
  C:\Windows\System\RTMfLOY.exe
  2⤵
  PID:9184
- C:\Windows\System\xfzAHrh.exe
  C:\Windows\System\xfzAHrh.exe
  2⤵
  PID:9212
- C:\Windows\System\tNhRZiF.exe
  C:\Windows\System\tNhRZiF.exe
  2⤵
  PID:7604
- C:\Windows\System\iRTTRyI.exe
  C:\Windows\System\iRTTRyI.exe
  2⤵
  PID:6716
- C:\Windows\System\dZiUhBL.exe
  C:\Windows\System\dZiUhBL.exe
  2⤵
  PID:7728
- C:\Windows\System\jkAGdpa.exe
  C:\Windows\System\jkAGdpa.exe
  2⤵
  PID:7744
- C:\Windows\System\mCGFHMT.exe
  C:\Windows\System\mCGFHMT.exe
  2⤵
  PID:7764
- C:\Windows\System\qMiespj.exe
  C:\Windows\System\qMiespj.exe
  2⤵
  PID:5216
- C:\Windows\System\AMDFfjB.exe
  C:\Windows\System\AMDFfjB.exe
  2⤵
  PID:7360
- C:\Windows\System\YxVWlvu.exe
  C:\Windows\System\YxVWlvu.exe
  2⤵
  PID:7644
- C:\Windows\System\gBEVDRT.exe
  C:\Windows\System\gBEVDRT.exe
  2⤵
  PID:7448
- C:\Windows\System\EqRKWlP.exe
  C:\Windows\System\EqRKWlP.exe
  2⤵
  PID:7524
- C:\Windows\System\pBTHQPl.exe
  C:\Windows\System\pBTHQPl.exe
  2⤵
  PID:8176
- C:\Windows\System\HJoCzXY.exe
  C:\Windows\System\HJoCzXY.exe
  2⤵
  PID:8316
- C:\Windows\System\aJbmJiz.exe
  C:\Windows\System\aJbmJiz.exe
  2⤵
  PID:6264
- C:\Windows\System\WntNgHo.exe
  C:\Windows\System\WntNgHo.exe
  2⤵
  PID:2936
- C:\Windows\System\kzfSGNO.exe
  C:\Windows\System\kzfSGNO.exe
  2⤵
  PID:8428
- C:\Windows\System\sRAszCj.exe
  C:\Windows\System\sRAszCj.exe
  2⤵
  PID:8476
- C:\Windows\System\BQnDtYQ.exe
  C:\Windows\System\BQnDtYQ.exe
  2⤵
  PID:6524
- C:\Windows\System\NoUlNSE.exe
  C:\Windows\System\NoUlNSE.exe
  2⤵
  PID:8572
- C:\Windows\System\uYFgZmE.exe
  C:\Windows\System\uYFgZmE.exe
  2⤵
  PID:6460
- C:\Windows\System\JKmmrlg.exe
  C:\Windows\System\JKmmrlg.exe
  2⤵
  PID:7900
- C:\Windows\System\iQqzGok.exe
  C:\Windows\System\iQqzGok.exe
  2⤵
  PID:7252
- C:\Windows\System\nSFhKNM.exe
  C:\Windows\System\nSFhKNM.exe
  2⤵
  PID:8764
- C:\Windows\System\PoWKCNc.exe
  C:\Windows\System\PoWKCNc.exe
  2⤵
  PID:8016
- C:\Windows\System\AXuobam.exe
  C:\Windows\System\AXuobam.exe
  2⤵
  PID:8868
- C:\Windows\System\xmUoBSs.exe
  C:\Windows\System\xmUoBSs.exe
  2⤵
  PID:8104
- C:\Windows\System\sBtYmJe.exe
  C:\Windows\System\sBtYmJe.exe
  2⤵
  PID:9220
- C:\Windows\System\zNVKXVp.exe
  C:\Windows\System\zNVKXVp.exe
  2⤵
  PID:9248
- C:\Windows\System\KuoyPlf.exe
  C:\Windows\System\KuoyPlf.exe
  2⤵
  PID:9268
- C:\Windows\System\aErMpGn.exe
  C:\Windows\System\aErMpGn.exe
  2⤵
  PID:9288
- C:\Windows\System\ZULIfwA.exe
  C:\Windows\System\ZULIfwA.exe
  2⤵
  PID:9312
- C:\Windows\System\gzDKlMG.exe
  C:\Windows\System\gzDKlMG.exe
  2⤵
  PID:9336
- C:\Windows\System\pVyPZzB.exe
  C:\Windows\System\pVyPZzB.exe
  2⤵
  PID:9352
- C:\Windows\System\NUPntnv.exe
  C:\Windows\System\NUPntnv.exe
  2⤵
  PID:9380
- C:\Windows\System\VNFGztO.exe
  C:\Windows\System\VNFGztO.exe
  2⤵
  PID:9400
- C:\Windows\System\JmmOufs.exe
  C:\Windows\System\JmmOufs.exe
  2⤵
  PID:9428
- C:\Windows\System\IZMczPE.exe
  C:\Windows\System\IZMczPE.exe
  2⤵
  PID:9452
- C:\Windows\System\LdVoyfF.exe
  C:\Windows\System\LdVoyfF.exe
  2⤵
  PID:9468
- C:\Windows\System\tHRlsKJ.exe
  C:\Windows\System\tHRlsKJ.exe
  2⤵
  PID:9496
- C:\Windows\System\LXrXlcC.exe
  C:\Windows\System\LXrXlcC.exe
  2⤵
  PID:9516
- C:\Windows\System\mWjRLMt.exe
  C:\Windows\System\mWjRLMt.exe
  2⤵
  PID:9536
- C:\Windows\System\weXUHDv.exe
  C:\Windows\System\weXUHDv.exe
  2⤵
  PID:9564
- C:\Windows\System\KpdacJV.exe
  C:\Windows\System\KpdacJV.exe
  2⤵
  PID:9588
- C:\Windows\System\CTXAMKn.exe
  C:\Windows\System\CTXAMKn.exe
  2⤵
  PID:9612
- C:\Windows\System\zPomrcH.exe
  C:\Windows\System\zPomrcH.exe
  2⤵
  PID:9628
- C:\Windows\System\wFMWDyy.exe
  C:\Windows\System\wFMWDyy.exe
  2⤵
  PID:9648
- C:\Windows\System\reQUlrl.exe
  C:\Windows\System\reQUlrl.exe
  2⤵
  PID:9672
- C:\Windows\System\yHVUgFc.exe
  C:\Windows\System\yHVUgFc.exe
  2⤵
  PID:9696
- C:\Windows\System\LJHfWeA.exe
  C:\Windows\System\LJHfWeA.exe
  2⤵
  PID:9720
- C:\Windows\System\XbzwaaV.exe
  C:\Windows\System\XbzwaaV.exe
  2⤵
  PID:9740
- C:\Windows\System\bXRdFJa.exe
  C:\Windows\System\bXRdFJa.exe
  2⤵
  PID:9772
- C:\Windows\System\sVNepIy.exe
  C:\Windows\System\sVNepIy.exe
  2⤵
  PID:9792
- C:\Windows\System\BNUODuo.exe
  C:\Windows\System\BNUODuo.exe
  2⤵
  PID:9816
- C:\Windows\System\wgOVNNY.exe
  C:\Windows\System\wgOVNNY.exe
  2⤵
  PID:9840
- C:\Windows\System\nfktWRp.exe
  C:\Windows\System\nfktWRp.exe
  2⤵
  PID:9860
- C:\Windows\System\vjciMoD.exe
  C:\Windows\System\vjciMoD.exe
  2⤵
  PID:9888
- C:\Windows\System\HzeTnaO.exe
  C:\Windows\System\HzeTnaO.exe
  2⤵
  PID:9908
- C:\Windows\System\OqCuPRT.exe
  C:\Windows\System\OqCuPRT.exe
  2⤵
  PID:9928
- C:\Windows\System\WitUiQN.exe
  C:\Windows\System\WitUiQN.exe
  2⤵
  PID:9952
- C:\Windows\System\eRCxvEM.exe
  C:\Windows\System\eRCxvEM.exe
  2⤵
  PID:9972
- C:\Windows\System\UQmikMP.exe
  C:\Windows\System\UQmikMP.exe
  2⤵
  PID:9996
- C:\Windows\System\oaycZaP.exe
  C:\Windows\System\oaycZaP.exe
  2⤵
  PID:10020
- C:\Windows\System\VpAypzI.exe
  C:\Windows\System\VpAypzI.exe
  2⤵
  PID:10040
- C:\Windows\System\qhCmhOd.exe
  C:\Windows\System\qhCmhOd.exe
  2⤵
  PID:10064
- C:\Windows\System\lzXKQJp.exe
  C:\Windows\System\lzXKQJp.exe
  2⤵
  PID:10080
- C:\Windows\System\dhbirhc.exe
  C:\Windows\System\dhbirhc.exe
  2⤵
  PID:10104
- C:\Windows\System\QnLIBeo.exe
  C:\Windows\System\QnLIBeo.exe
  2⤵
  PID:10128
- C:\Windows\System\KNqFDHr.exe
  C:\Windows\System\KNqFDHr.exe
  2⤵
  PID:10148
- C:\Windows\System\CtPKImF.exe
  C:\Windows\System\CtPKImF.exe
  2⤵
  PID:10172
- C:\Windows\System\ZoeMTwm.exe
  C:\Windows\System\ZoeMTwm.exe
  2⤵
  PID:10196
- C:\Windows\System\sWAzUek.exe
  C:\Windows\System\sWAzUek.exe
  2⤵
  PID:10220
- C:\Windows\System\hIkjDKQ.exe
  C:\Windows\System\hIkjDKQ.exe
  2⤵
  PID:8956
- C:\Windows\System\szHrFyC.exe
  C:\Windows\System\szHrFyC.exe
  2⤵
  PID:8232
- C:\Windows\System\PcPEDtg.exe
  C:\Windows\System\PcPEDtg.exe
  2⤵
  PID:9076
- C:\Windows\System\VcKWjPJ.exe
  C:\Windows\System\VcKWjPJ.exe
  2⤵
  PID:9152
- C:\Windows\System\QuxDNLT.exe
  C:\Windows\System\QuxDNLT.exe
  2⤵
  PID:8392
- C:\Windows\System\vnnxAbU.exe
  C:\Windows\System\vnnxAbU.exe
  2⤵
  PID:8504
- C:\Windows\System\nLTxikn.exe
  C:\Windows\System\nLTxikn.exe
  2⤵
  PID:2360
- C:\Windows\System\HbYZqaM.exe
  C:\Windows\System\HbYZqaM.exe
  2⤵
  PID:7308
- C:\Windows\System\hECtASQ.exe
  C:\Windows\System\hECtASQ.exe
  2⤵
  PID:8640
- C:\Windows\System\IEddxeh.exe
  C:\Windows\System\IEddxeh.exe
  2⤵
  PID:6632
- C:\Windows\System\dRiyfmy.exe
  C:\Windows\System\dRiyfmy.exe
  2⤵
  PID:8772
- C:\Windows\System\XetWOQj.exe
  C:\Windows\System\XetWOQj.exe
  2⤵
  PID:8804
- C:\Windows\System\wSorwgf.exe
  C:\Windows\System\wSorwgf.exe
  2⤵
  PID:8820
- C:\Windows\System\VhKknvN.exe
  C:\Windows\System\VhKknvN.exe
  2⤵
  PID:8712
- C:\Windows\System\FGrVvTx.exe
  C:\Windows\System\FGrVvTx.exe
  2⤵
  PID:8048
- C:\Windows\System\MipruBt.exe
  C:\Windows\System\MipruBt.exe
  2⤵
  PID:8088
- C:\Windows\System\gEgMjiZ.exe
  C:\Windows\System\gEgMjiZ.exe
  2⤵
  PID:8940
- C:\Windows\System\nkFQGJT.exe
  C:\Windows\System\nkFQGJT.exe
  2⤵
  PID:9284
- C:\Windows\System\QpqwXVd.exe
  C:\Windows\System\QpqwXVd.exe
  2⤵
  PID:9324
- C:\Windows\System\GEJmluX.exe
  C:\Windows\System\GEJmluX.exe
  2⤵
  PID:9372
- C:\Windows\System\TFDlOCX.exe
  C:\Windows\System\TFDlOCX.exe
  2⤵
  PID:9096
- C:\Windows\System\dNYjAJH.exe
  C:\Windows\System\dNYjAJH.exe
  2⤵
  PID:8300
- C:\Windows\System\plwiNlH.exe
  C:\Windows\System\plwiNlH.exe
  2⤵
  PID:9476
- C:\Windows\System\HuonCAz.exe
  C:\Windows\System\HuonCAz.exe
  2⤵
  PID:9548
- C:\Windows\System\CxZlwMP.exe
  C:\Windows\System\CxZlwMP.exe
  2⤵
  PID:10248
- C:\Windows\System\jZSepvQ.exe
  C:\Windows\System\jZSepvQ.exe
  2⤵
  PID:10272
- C:\Windows\System\qMxJhHs.exe
  C:\Windows\System\qMxJhHs.exe
  2⤵
  PID:10296
- C:\Windows\System\WwmAWMI.exe
  C:\Windows\System\WwmAWMI.exe
  2⤵
  PID:10320
- C:\Windows\System\CssBgvj.exe
  C:\Windows\System\CssBgvj.exe
  2⤵
  PID:10340
- C:\Windows\System\fYgjOfi.exe
  C:\Windows\System\fYgjOfi.exe
  2⤵
  PID:10364
- C:\Windows\System\BwSUmVa.exe
  C:\Windows\System\BwSUmVa.exe
  2⤵
  PID:10388
- C:\Windows\System\lGLiqUD.exe
  C:\Windows\System\lGLiqUD.exe
  2⤵
  PID:10404
- C:\Windows\System\esxGsqT.exe
  C:\Windows\System\esxGsqT.exe
  2⤵
  PID:10428
- C:\Windows\System\DEUZXOk.exe
  C:\Windows\System\DEUZXOk.exe
  2⤵
  PID:10444
- C:\Windows\System\PEYyXCu.exe
  C:\Windows\System\PEYyXCu.exe
  2⤵
  PID:10464
- C:\Windows\System\fWlyPij.exe
  C:\Windows\System\fWlyPij.exe
  2⤵
  PID:10488
- C:\Windows\System\OAtpIHe.exe
  C:\Windows\System\OAtpIHe.exe
  2⤵
  PID:10512
- C:\Windows\System\DKDeBBr.exe
  C:\Windows\System\DKDeBBr.exe
  2⤵
  PID:10536
- C:\Windows\System\pVjNtcJ.exe
  C:\Windows\System\pVjNtcJ.exe
  2⤵
  PID:10564
- C:\Windows\System\kAYTjxt.exe
  C:\Windows\System\kAYTjxt.exe
  2⤵
  PID:10584
- C:\Windows\System\sDLCwqi.exe
  C:\Windows\System\sDLCwqi.exe
  2⤵
  PID:10604
- C:\Windows\System\ttEqbUk.exe
  C:\Windows\System\ttEqbUk.exe
  2⤵
  PID:10628
- C:\Windows\System\AwKsmuH.exe
  C:\Windows\System\AwKsmuH.exe
  2⤵
  PID:10652
- C:\Windows\System\sajzQKS.exe
  C:\Windows\System\sajzQKS.exe
  2⤵
  PID:10672
- C:\Windows\System\pxmIkJb.exe
  C:\Windows\System\pxmIkJb.exe
  2⤵
  PID:10696
- C:\Windows\System\ZSSzjXI.exe
  C:\Windows\System\ZSSzjXI.exe
  2⤵
  PID:10720
- C:\Windows\System\WyhZaGi.exe
  C:\Windows\System\WyhZaGi.exe
  2⤵
  PID:10744
- C:\Windows\System\eTcjAmQ.exe
  C:\Windows\System\eTcjAmQ.exe
  2⤵
  PID:10764
- C:\Windows\System\bQSaQHi.exe
  C:\Windows\System\bQSaQHi.exe
  2⤵
  PID:10784
- C:\Windows\System\brwWkdr.exe
  C:\Windows\System\brwWkdr.exe
  2⤵
  PID:10812
- C:\Windows\System\kQmwKDD.exe
  C:\Windows\System\kQmwKDD.exe
  2⤵
  PID:10832
- C:\Windows\System\snQdSwe.exe
  C:\Windows\System\snQdSwe.exe
  2⤵
  PID:10848
- C:\Windows\System\DFPBFmO.exe
  C:\Windows\System\DFPBFmO.exe
  2⤵
  PID:10868
- C:\Windows\System\oXOQToM.exe
  C:\Windows\System\oXOQToM.exe
  2⤵
  PID:10892
- C:\Windows\System\wBlRTBf.exe
  C:\Windows\System\wBlRTBf.exe
  2⤵
  PID:10916
- C:\Windows\System\qdyDYKi.exe
  C:\Windows\System\qdyDYKi.exe
  2⤵
  PID:10936
- C:\Windows\System\RmSBGiB.exe
  C:\Windows\System\RmSBGiB.exe
  2⤵
  PID:10956
- C:\Windows\System\GpoPLfJ.exe
  C:\Windows\System\GpoPLfJ.exe
  2⤵
  PID:10976
- C:\Windows\System\XRVdtCO.exe
  C:\Windows\System\XRVdtCO.exe
  2⤵
  PID:11000
- C:\Windows\System\XkZsbXI.exe
  C:\Windows\System\XkZsbXI.exe
  2⤵
  PID:11032
- C:\Windows\System\NNzLmbB.exe
  C:\Windows\System\NNzLmbB.exe
  2⤵
  PID:11052
- C:\Windows\System\tSlDrhe.exe
  C:\Windows\System\tSlDrhe.exe
  2⤵
  PID:11072
- C:\Windows\System\hoQmrJk.exe
  C:\Windows\System\hoQmrJk.exe
  2⤵
  PID:11096
- C:\Windows\System\gNeVIJO.exe
  C:\Windows\System\gNeVIJO.exe
  2⤵
  PID:11124
- C:\Windows\System\KLagRKD.exe
  C:\Windows\System\KLagRKD.exe
  2⤵
  PID:11144
- C:\Windows\System\SArrDYJ.exe
  C:\Windows\System\SArrDYJ.exe
  2⤵
  PID:11164
- C:\Windows\System\yIlxAzK.exe
  C:\Windows\System\yIlxAzK.exe
  2⤵
  PID:11196
- C:\Windows\System\GMNuLgv.exe
  C:\Windows\System\GMNuLgv.exe
  2⤵
  PID:11212
- C:\Windows\System\IvXUzoj.exe
  C:\Windows\System\IvXUzoj.exe
  2⤵
  PID:11228
- C:\Windows\System\tKZmkoR.exe
  C:\Windows\System\tKZmkoR.exe
  2⤵
  PID:11244
- C:\Windows\System\MTFwxPB.exe
  C:\Windows\System\MTFwxPB.exe
  2⤵
  PID:9620
- C:\Windows\System\ozqyRwj.exe
  C:\Windows\System\ozqyRwj.exe
  2⤵
  PID:9668
- C:\Windows\System\ubGCFwu.exe
  C:\Windows\System\ubGCFwu.exe
  2⤵
  PID:7232
- C:\Windows\System\NdAaJKv.exe
  C:\Windows\System\NdAaJKv.exe
  2⤵
  PID:9808
- C:\Windows\System\zKlChvg.exe
  C:\Windows\System\zKlChvg.exe
  2⤵
  PID:8680
- C:\Windows\System\CGgKNrh.exe
  C:\Windows\System\CGgKNrh.exe
  2⤵
  PID:3268
- C:\Windows\System\kYGcLkj.exe
  C:\Windows\System\kYGcLkj.exe
  2⤵
  PID:9904
- C:\Windows\System\MkbTHak.exe
  C:\Windows\System\MkbTHak.exe
  2⤵
  PID:7780
- C:\Windows\System\xpmbEmJ.exe
  C:\Windows\System\xpmbEmJ.exe
  2⤵
  PID:9988
- C:\Windows\System\AmMeHLF.exe
  C:\Windows\System\AmMeHLF.exe
  2⤵
  PID:10032
- C:\Windows\System\WqHYGUa.exe
  C:\Windows\System\WqHYGUa.exe
  2⤵
  PID:10076
- C:\Windows\System\EwOfERj.exe
  C:\Windows\System\EwOfERj.exe
  2⤵
  PID:10180
- C:\Windows\System\BJZkjmI.exe
  C:\Windows\System\BJZkjmI.exe
  2⤵
  PID:1712
- C:\Windows\System\NQSyeWY.exe
  C:\Windows\System\NQSyeWY.exe
  2⤵
  PID:3448
- C:\Windows\System\xRoeqxO.exe
  C:\Windows\System\xRoeqxO.exe
  2⤵
  PID:9392
- C:\Windows\System\aZTZJaG.exe
  C:\Windows\System\aZTZJaG.exe
  2⤵
  PID:5408
- C:\Windows\System\SnGnoZr.exe
  C:\Windows\System\SnGnoZr.exe
  2⤵
  PID:9508
- C:\Windows\System\QQEftGY.exe
  C:\Windows\System\QQEftGY.exe
  2⤵
  PID:9204
- C:\Windows\System\lsMDHgn.exe
  C:\Windows\System\lsMDHgn.exe
  2⤵
  PID:9608
- C:\Windows\System\eYYBYXh.exe
  C:\Windows\System\eYYBYXh.exe
  2⤵
  PID:9128
- C:\Windows\System\eoqcmmG.exe
  C:\Windows\System\eoqcmmG.exe
  2⤵
  PID:9704
- C:\Windows\System\vZsigbS.exe
  C:\Windows\System\vZsigbS.exe
  2⤵
  PID:9752
- C:\Windows\System\JPGWfmQ.exe
  C:\Windows\System\JPGWfmQ.exe
  2⤵
  PID:10472
- C:\Windows\System\ZIdjadF.exe
  C:\Windows\System\ZIdjadF.exe
  2⤵
  PID:11292
- C:\Windows\System\vdtMFQy.exe
  C:\Windows\System\vdtMFQy.exe
  2⤵
  PID:11312
- C:\Windows\System\LsxsFAB.exe
  C:\Windows\System\LsxsFAB.exe
  2⤵
  PID:11336
- C:\Windows\System\uYMpmrs.exe
  C:\Windows\System\uYMpmrs.exe
  2⤵
  PID:11356
- C:\Windows\System\FYzVLYn.exe
  C:\Windows\System\FYzVLYn.exe
  2⤵
  PID:11376
- C:\Windows\System\VZUJkQc.exe
  C:\Windows\System\VZUJkQc.exe
  2⤵
  PID:11400
- C:\Windows\System\Bpauwcs.exe
  C:\Windows\System\Bpauwcs.exe
  2⤵
  PID:11424
- C:\Windows\System\IdjaYmX.exe
  C:\Windows\System\IdjaYmX.exe
  2⤵
  PID:11444
- C:\Windows\System\rkiDlQp.exe
  C:\Windows\System\rkiDlQp.exe
  2⤵
  PID:11468
- C:\Windows\System\rQMCBvA.exe
  C:\Windows\System\rQMCBvA.exe
  2⤵
  PID:11492
- C:\Windows\System\HyovSeu.exe
  C:\Windows\System\HyovSeu.exe
  2⤵
  PID:11516
- C:\Windows\System\hlLjKPr.exe
  C:\Windows\System\hlLjKPr.exe
  2⤵
  PID:11536
- C:\Windows\System\JkIFPmb.exe
  C:\Windows\System\JkIFPmb.exe
  2⤵
  PID:11556
- C:\Windows\System\sNUIPUC.exe
  C:\Windows\System\sNUIPUC.exe
  2⤵
  PID:11584
- C:\Windows\System\tzHlvbe.exe
  C:\Windows\System\tzHlvbe.exe
  2⤵
  PID:11604
- C:\Windows\System\pKCrcdq.exe
  C:\Windows\System\pKCrcdq.exe
  2⤵
  PID:11624
- C:\Windows\System\nooNXOK.exe
  C:\Windows\System\nooNXOK.exe
  2⤵
  PID:11648
- C:\Windows\System\MnRMVXJ.exe
  C:\Windows\System\MnRMVXJ.exe
  2⤵
  PID:11668
- C:\Windows\System\UzWDTlI.exe
  C:\Windows\System\UzWDTlI.exe
  2⤵
  PID:11688
- C:\Windows\System\HHHUGbV.exe
  C:\Windows\System\HHHUGbV.exe
  2⤵
  PID:11716
- C:\Windows\System\TyTRzhz.exe
  C:\Windows\System\TyTRzhz.exe
  2⤵
  PID:11732
- C:\Windows\System\EKOAyzt.exe
  C:\Windows\System\EKOAyzt.exe
  2⤵
  PID:11752
- C:\Windows\System\LuAFtlO.exe
  C:\Windows\System\LuAFtlO.exe
  2⤵
  PID:11768
- C:\Windows\System\CZUCjrj.exe
  C:\Windows\System\CZUCjrj.exe
  2⤵
  PID:11800
- C:\Windows\System\XfJSOWL.exe
  C:\Windows\System\XfJSOWL.exe
  2⤵
  PID:11816
- C:\Windows\System\FTyWDQO.exe
  C:\Windows\System\FTyWDQO.exe
  2⤵
  PID:11840
- C:\Windows\System\fhgdwDx.exe
  C:\Windows\System\fhgdwDx.exe
  2⤵
  PID:11872
- C:\Windows\System\UwsvyrB.exe
  C:\Windows\System\UwsvyrB.exe
  2⤵
  PID:11892
- C:\Windows\System\URzTqyd.exe
  C:\Windows\System\URzTqyd.exe
  2⤵
  PID:11920
- C:\Windows\System\pxmhvqN.exe
  C:\Windows\System\pxmhvqN.exe
  2⤵
  PID:11940
- C:\Windows\System\SCsHsgQ.exe
  C:\Windows\System\SCsHsgQ.exe
  2⤵
  PID:11960
- C:\Windows\System\cmvvxxl.exe
  C:\Windows\System\cmvvxxl.exe
  2⤵
  PID:11988
- C:\Windows\System\yEniiPs.exe
  C:\Windows\System\yEniiPs.exe
  2⤵
  PID:12008
- C:\Windows\System\yWMTRqL.exe
  C:\Windows\System\yWMTRqL.exe
  2⤵
  PID:12024
- C:\Windows\System\IEsEtGp.exe
  C:\Windows\System\IEsEtGp.exe
  2⤵
  PID:12044
- C:\Windows\System\xjOcDON.exe
  C:\Windows\System\xjOcDON.exe
  2⤵
  PID:12084
- C:\Windows\System\sPlzrPs.exe
  C:\Windows\System\sPlzrPs.exe
  2⤵
  PID:12100
- C:\Windows\System\PkvKFgC.exe
  C:\Windows\System\PkvKFgC.exe
  2⤵
  PID:12116
- C:\Windows\System\ZGhtpCo.exe
  C:\Windows\System\ZGhtpCo.exe
  2⤵
  PID:9852
- C:\Windows\System\UZJraEt.exe
  C:\Windows\System\UZJraEt.exe
  2⤵
  PID:10612
- C:\Windows\System\hJQLmUr.exe
  C:\Windows\System\hJQLmUr.exe
  2⤵
  PID:10668
- C:\Windows\System\aVEZSFo.exe
  C:\Windows\System\aVEZSFo.exe
  2⤵
  PID:4864
- C:\Windows\System\aXgxQXT.exe
  C:\Windows\System\aXgxQXT.exe
  2⤵
  PID:10776
- C:\Windows\System\lkJvQJz.exe
  C:\Windows\System\lkJvQJz.exe
  2⤵
  PID:10008
- C:\Windows\System\DlkWkjp.exe
  C:\Windows\System\DlkWkjp.exe
  2⤵
  PID:10888
- C:\Windows\System\UjjDsmh.exe
  C:\Windows\System\UjjDsmh.exe
  2⤵
  PID:8664
- C:\Windows\System\JIpdTKH.exe
  C:\Windows\System\JIpdTKH.exe
  2⤵
  PID:10136
- C:\Windows\System\jnsCgHt.exe
  C:\Windows\System\jnsCgHt.exe
  2⤵
  PID:10160
- C:\Windows\System\ukbIkkR.exe
  C:\Windows\System\ukbIkkR.exe
  2⤵
  PID:11092
- C:\Windows\System\GXbYSpp.exe
  C:\Windows\System\GXbYSpp.exe
  2⤵
  PID:9320
- C:\Windows\System\bOvesUq.exe
  C:\Windows\System\bOvesUq.exe
  2⤵
  PID:11208
- C:\Windows\System\xCxwMBy.exe
  C:\Windows\System\xCxwMBy.exe
  2⤵
  PID:9368
- C:\Windows\System\lBAFUEa.exe
  C:\Windows\System\lBAFUEa.exe
  2⤵
  PID:8620
- C:\Windows\System\dFHiPlQ.exe
  C:\Windows\System\dFHiPlQ.exe
  2⤵
  PID:9992
- C:\Windows\System\YKdmqvo.exe
  C:\Windows\System\YKdmqvo.exe
  2⤵
  PID:9276
- C:\Windows\System\yRkDXvf.exe
  C:\Windows\System\yRkDXvf.exe
  2⤵
  PID:9344
- C:\Windows\System\nRXEKhl.exe
  C:\Windows\System\nRXEKhl.exe
  2⤵
  PID:9304
- C:\Windows\System\PgmTpYS.exe
  C:\Windows\System\PgmTpYS.exe
  2⤵
  PID:9464
- C:\Windows\System\nycfJuW.exe
  C:\Windows\System\nycfJuW.exe
  2⤵
  PID:10328
- C:\Windows\System\ASwVENj.exe
  C:\Windows\System\ASwVENj.exe
  2⤵
  PID:9784
- C:\Windows\System\aFIOhXn.exe
  C:\Windows\System\aFIOhXn.exe
  2⤵
  PID:11368
- C:\Windows\System\MIbsXuy.exe
  C:\Windows\System\MIbsXuy.exe
  2⤵
  PID:11440
- C:\Windows\System\NRgnAac.exe
  C:\Windows\System\NRgnAac.exe
  2⤵
  PID:10704
- C:\Windows\System\iVcsnDG.exe
  C:\Windows\System\iVcsnDG.exe
  2⤵
  PID:10732
- C:\Windows\System\ZHkISKS.exe
  C:\Windows\System\ZHkISKS.exe
  2⤵
  PID:11660
- C:\Windows\System\mohDncO.exe
  C:\Windows\System\mohDncO.exe
  2⤵
  PID:10996
- C:\Windows\System\HfzUhiG.exe
  C:\Windows\System\HfzUhiG.exe
  2⤵
  PID:11784
- C:\Windows\System\rtoKTNk.exe
  C:\Windows\System\rtoKTNk.exe
  2⤵
  PID:12304
- C:\Windows\System\XOosRfe.exe
  C:\Windows\System\XOosRfe.exe
  2⤵
  PID:12328
- C:\Windows\System\xfkdVQK.exe
  C:\Windows\System\xfkdVQK.exe
  2⤵
  PID:12356
- C:\Windows\System\Iaygnue.exe
  C:\Windows\System\Iaygnue.exe
  2⤵
  PID:12376
- C:\Windows\System\IqhZlLh.exe
  C:\Windows\System\IqhZlLh.exe
  2⤵
  PID:12396
- C:\Windows\System\xTIqYto.exe
  C:\Windows\System\xTIqYto.exe
  2⤵
  PID:12416
- C:\Windows\System\tNyXYBO.exe
  C:\Windows\System\tNyXYBO.exe
  2⤵
  PID:12436
- C:\Windows\System\FdQspEd.exe
  C:\Windows\System\FdQspEd.exe
  2⤵
  PID:12460
- C:\Windows\System\slwvzlU.exe
  C:\Windows\System\slwvzlU.exe
  2⤵
  PID:12488
- C:\Windows\System\hIVCVEf.exe
  C:\Windows\System\hIVCVEf.exe
  2⤵
  PID:12508
- C:\Windows\System\aGilccE.exe
  C:\Windows\System\aGilccE.exe
  2⤵
  PID:12528
- C:\Windows\System\PGgFIIa.exe
  C:\Windows\System\PGgFIIa.exe
  2⤵
  PID:12548
- C:\Windows\System\PvOfRzr.exe
  C:\Windows\System\PvOfRzr.exe
  2⤵
  PID:12568
- C:\Windows\System\oheARfV.exe
  C:\Windows\System\oheARfV.exe
  2⤵
  PID:12588
- C:\Windows\System\jhiHLMn.exe
  C:\Windows\System\jhiHLMn.exe
  2⤵
  PID:12612
- C:\Windows\System\grBMrna.exe
  C:\Windows\System\grBMrna.exe
  2⤵
  PID:12632
- C:\Windows\System\PJZpvrz.exe
  C:\Windows\System\PJZpvrz.exe
  2⤵
  PID:12648
- C:\Windows\System\lyIewIC.exe
  C:\Windows\System\lyIewIC.exe
  2⤵
  PID:12664
- C:\Windows\System\oIiwOxY.exe
  C:\Windows\System\oIiwOxY.exe
  2⤵
  PID:12680
- C:\Windows\System\vUaYeiP.exe
  C:\Windows\System\vUaYeiP.exe
  2⤵
  PID:12696
- C:\Windows\System\RNxpuWM.exe
  C:\Windows\System\RNxpuWM.exe
  2⤵
  PID:12712
- C:\Windows\System\tvAFSfQ.exe
  C:\Windows\System\tvAFSfQ.exe
  2⤵
  PID:12728
- C:\Windows\System\WqBtGEq.exe
  C:\Windows\System\WqBtGEq.exe
  2⤵
  PID:12760
- C:\Windows\System\RyudBiT.exe
  C:\Windows\System\RyudBiT.exe
  2⤵
  PID:12780
- C:\Windows\System\ftcQMDF.exe
  C:\Windows\System\ftcQMDF.exe
  2⤵
  PID:12800
- C:\Windows\System\qHHqWMQ.exe
  C:\Windows\System\qHHqWMQ.exe
  2⤵
  PID:12828
- C:\Windows\System\AZPFrMh.exe
  C:\Windows\System\AZPFrMh.exe
  2⤵
  PID:12848
- C:\Windows\System\qjptodg.exe
  C:\Windows\System\qjptodg.exe
  2⤵
  PID:12868
- C:\Windows\System\xKPLtFe.exe
  C:\Windows\System\xKPLtFe.exe
  2⤵
  PID:12892
- C:\Windows\System\BiZNXbX.exe
  C:\Windows\System\BiZNXbX.exe
  2⤵
  PID:12924
- C:\Windows\System\japDOYd.exe
  C:\Windows\System\japDOYd.exe
  2⤵
  PID:12952
- C:\Windows\System\NrGgHFj.exe
  C:\Windows\System\NrGgHFj.exe
  2⤵
  PID:12972
- C:\Windows\System\AyTDfdL.exe
  C:\Windows\System\AyTDfdL.exe
  2⤵
  PID:13000
- C:\Windows\System\qUQVnFm.exe
  C:\Windows\System\qUQVnFm.exe
  2⤵
  PID:13024
- C:\Windows\System\jYBVajc.exe
  C:\Windows\System\jYBVajc.exe
  2⤵
  PID:13044
- C:\Windows\System\faYTOUZ.exe
  C:\Windows\System\faYTOUZ.exe
  2⤵
  PID:13068
- C:\Windows\System\KOCyBLo.exe
  C:\Windows\System\KOCyBLo.exe
  2⤵
  PID:13088
- C:\Windows\System\lIyicOf.exe
  C:\Windows\System\lIyicOf.exe
  2⤵
  PID:13112
- C:\Windows\System\sJxRDXO.exe
  C:\Windows\System\sJxRDXO.exe
  2⤵
  PID:13136
- C:\Windows\System\InuUPRw.exe
  C:\Windows\System\InuUPRw.exe
  2⤵
  PID:13160
- C:\Windows\System\fnMPanT.exe
  C:\Windows\System\fnMPanT.exe
  2⤵
  PID:13184
- C:\Windows\System\VyWNxHG.exe
  C:\Windows\System\VyWNxHG.exe
  2⤵
  PID:13204
- C:\Windows\System\DBxtHsP.exe
  C:\Windows\System\DBxtHsP.exe
  2⤵
  PID:13224
- C:\Windows\System\pEvfXFs.exe
  C:\Windows\System\pEvfXFs.exe
  2⤵
  PID:13252
- C:\Windows\System\Rxukhkh.exe
  C:\Windows\System\Rxukhkh.exe
  2⤵
  PID:13272
- C:\Windows\System\WESqlxn.exe
  C:\Windows\System\WESqlxn.exe
  2⤵
  PID:13296
- C:\Windows\System\raOUQFN.exe
  C:\Windows\System\raOUQFN.exe
  2⤵
  PID:11040
- C:\Windows\System\tyJoKCs.exe
  C:\Windows\System\tyJoKCs.exe
  2⤵
  PID:11884
- C:\Windows\System\AMYLZLa.exe
  C:\Windows\System\AMYLZLa.exe
  2⤵
  PID:11928
- C:\Windows\System\vdYuzkS.exe
  C:\Windows\System\vdYuzkS.exe
  2⤵
  PID:11172
- C:\Windows\System\YZsVgem.exe
  C:\Windows\System\YZsVgem.exe
  2⤵
  PID:11220
- C:\Windows\System\QXaodgx.exe
  C:\Windows\System\QXaodgx.exe
  2⤵
  PID:12040
- C:\Windows\System\GxZuEjK.exe
  C:\Windows\System\GxZuEjK.exe
  2⤵
  PID:12092
- C:\Windows\System\hZJctzX.exe
  C:\Windows\System\hZJctzX.exe
  2⤵
  PID:7472
- C:\Windows\System\cqLapQN.exe
  C:\Windows\System\cqLapQN.exe
  2⤵
  PID:9832
- C:\Windows\System\ZcXpewK.exe
  C:\Windows\System\ZcXpewK.exe
  2⤵
  PID:8388
- C:\Windows\System\wGDdQhv.exe
  C:\Windows\System\wGDdQhv.exe
  2⤵
  PID:10116
- C:\Windows\System\vshnxQw.exe
  C:\Windows\System\vshnxQw.exe
  2⤵
  PID:10264
- C:\Windows\System\RtIBIRv.exe
  C:\Windows\System\RtIBIRv.exe
  2⤵
  PID:9556
- C:\Windows\System\XfWOcth.exe
  C:\Windows\System\XfWOcth.exe
  2⤵
  PID:10376
- C:\Windows\System\zwKbfaO.exe
  C:\Windows\System\zwKbfaO.exe
  2⤵
  PID:10460
- C:\Windows\System\IrkOqVk.exe
  C:\Windows\System\IrkOqVk.exe
  2⤵
  PID:11436
- C:\Windows\System\xRfobDO.exe
  C:\Windows\System\xRfobDO.exe
  2⤵
  PID:10800
- C:\Windows\System\qeEFBiU.exe
  C:\Windows\System\qeEFBiU.exe
  2⤵
  PID:13332
- C:\Windows\System\AlSXSfs.exe
  C:\Windows\System\AlSXSfs.exe
  2⤵
  PID:13380
- C:\Windows\System\qCKmdqA.exe
  C:\Windows\System\qCKmdqA.exe
  2⤵
  PID:13404
- C:\Windows\System\JZvOrNP.exe
  C:\Windows\System\JZvOrNP.exe
  2⤵
  PID:13436
- C:\Windows\System\HdjNdTf.exe
  C:\Windows\System\HdjNdTf.exe
  2⤵
  PID:13456
- C:\Windows\System\ocOFOyd.exe
  C:\Windows\System\ocOFOyd.exe
  2⤵
  PID:13484
- C:\Windows\System\pehRhQZ.exe
  C:\Windows\System\pehRhQZ.exe
  2⤵
  PID:13504
- C:\Windows\System\wJKbCsE.exe
  C:\Windows\System\wJKbCsE.exe
  2⤵
  PID:13528
- C:\Windows\System\CrAqBdZ.exe
  C:\Windows\System\CrAqBdZ.exe
  2⤵
  PID:13548
- C:\Windows\System\zMDOWGp.exe
  C:\Windows\System\zMDOWGp.exe
  2⤵
  PID:13576
- C:\Windows\System\dLfTdHy.exe
  C:\Windows\System\dLfTdHy.exe
  2⤵
  PID:13604
- C:\Windows\System\TfsoVmC.exe
  C:\Windows\System\TfsoVmC.exe
  2⤵
  PID:13624
- C:\Windows\System\pffVEBR.exe
  C:\Windows\System\pffVEBR.exe
  2⤵
  PID:13640
- C:\Windows\System\YXtlSGS.exe
  C:\Windows\System\YXtlSGS.exe
  2⤵
  PID:13656
- C:\Windows\System\wnfsuOu.exe
  C:\Windows\System\wnfsuOu.exe
  2⤵
  PID:13676
- C:\Windows\System\KWyAYCs.exe
  C:\Windows\System\KWyAYCs.exe
  2⤵
  PID:13692
- C:\Windows\System\eXzSLPV.exe
  C:\Windows\System\eXzSLPV.exe
  2⤵
  PID:13708
- C:\Windows\System\JQdSjDd.exe
  C:\Windows\System\JQdSjDd.exe
  2⤵
  PID:13724
- C:\Windows\System\XFjbpQt.exe
  C:\Windows\System\XFjbpQt.exe
  2⤵
  PID:13740
- C:\Windows\System\FaBpwBR.exe
  C:\Windows\System\FaBpwBR.exe
  2⤵
  PID:13756
- C:\Windows\System\nsRSKKu.exe
  C:\Windows\System\nsRSKKu.exe
  2⤵
  PID:13776
- C:\Windows\System\uKJkSeQ.exe
  C:\Windows\System\uKJkSeQ.exe
  2⤵
  PID:13796
- C:\Windows\System\ZzfGaiK.exe
  C:\Windows\System\ZzfGaiK.exe
  2⤵
  PID:13820
- C:\Windows\System\AwdQTvQ.exe
  C:\Windows\System\AwdQTvQ.exe
  2⤵
  PID:13844
- C:\Windows\System\ferRqzS.exe
  C:\Windows\System\ferRqzS.exe
  2⤵
  PID:13864
- C:\Windows\System\kghopAV.exe
  C:\Windows\System\kghopAV.exe
  2⤵
  PID:13884
- C:\Windows\System\JrxhWKD.exe
  C:\Windows\System\JrxhWKD.exe
  2⤵
  PID:13912
- C:\Windows\System\HeXfrfU.exe
  C:\Windows\System\HeXfrfU.exe
  2⤵
  PID:13948
- C:\Windows\System\vBPeLKb.exe
  C:\Windows\System\vBPeLKb.exe
  2⤵
  PID:13968
- C:\Windows\System\MTWxZbx.exe
  C:\Windows\System\MTWxZbx.exe
  2⤵
  PID:13992
- C:\Windows\System\gXutokt.exe
  C:\Windows\System\gXutokt.exe
  2⤵
  PID:14020
- C:\Windows\System\JUrHFRW.exe
  C:\Windows\System\JUrHFRW.exe
  2⤵
  PID:14048
- C:\Windows\System\uuPOOal.exe
  C:\Windows\System\uuPOOal.exe
  2⤵
  PID:14068
- C:\Windows\System\XXeexZh.exe
  C:\Windows\System\XXeexZh.exe
  2⤵
  PID:14084
- C:\Windows\System\BLlXtcM.exe
  C:\Windows\System\BLlXtcM.exe
  2⤵
  PID:14104
- C:\Windows\System\uAahMvb.exe
  C:\Windows\System\uAahMvb.exe
  2⤵
  PID:14124
- C:\Windows\System\rgYcZZq.exe
  C:\Windows\System\rgYcZZq.exe
  2⤵
  PID:14144
- C:\Windows\System\qQDHFHA.exe
  C:\Windows\System\qQDHFHA.exe
  2⤵
  PID:14168
- C:\Windows\System\inHiXDt.exe
  C:\Windows\System\inHiXDt.exe
  2⤵
  PID:14200
- C:\Windows\System\fQkROuM.exe
  C:\Windows\System\fQkROuM.exe
  2⤵
  PID:14220
- C:\Windows\System\cwnVUhQ.exe
  C:\Windows\System\cwnVUhQ.exe
  2⤵
  PID:14244
- C:\Windows\System\bkaiOQE.exe
  C:\Windows\System\bkaiOQE.exe
  2⤵
  PID:14268
- C:\Windows\System\MuFjhkv.exe
  C:\Windows\System\MuFjhkv.exe
  2⤵
  PID:14296
- C:\Windows\System\laigXTr.exe
  C:\Windows\System\laigXTr.exe
  2⤵
  PID:14320
- C:\Windows\System\OCLcOkB.exe
  C:\Windows\System\OCLcOkB.exe
  2⤵
  PID:10648
- C:\Windows\System\pwDgCGK.exe
  C:\Windows\System\pwDgCGK.exe
  2⤵
  PID:8996
- C:\Windows\System\FfeYYHu.exe
  C:\Windows\System\FfeYYHu.exe
  2⤵
  PID:11552
- C:\Windows\System\hEufgUl.exe
  C:\Windows\System\hEufgUl.exe
  2⤵
  PID:10912
- C:\Windows\System\FSXLtfx.exe
  C:\Windows\System\FSXLtfx.exe
  2⤵
  PID:11700
- C:\Windows\System\LUIxUZK.exe
  C:\Windows\System\LUIxUZK.exe
  2⤵
  PID:11656
- C:\Windows\System\pvxadoB.exe
  C:\Windows\System\pvxadoB.exe
  2⤵
  PID:11456
- C:\Windows\System\xNRhRmC.exe
  C:\Windows\System\xNRhRmC.exe
  2⤵
  PID:12316
- C:\Windows\System\oSMSSZk.exe
  C:\Windows\System\oSMSSZk.exe
  2⤵
  PID:11908
- C:\Windows\System\YCpGioS.exe
  C:\Windows\System\YCpGioS.exe
  2⤵
  PID:11996
- C:\Windows\System\vhMBwna.exe
  C:\Windows\System\vhMBwna.exe
  2⤵
  PID:12560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:9852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AmVzaIr.exe

Path C:\Windows\System\AmVzaIr.exe
Size 1.7MB
SHA256 75209d53a6783ab92d999ccbee87c5bc445e4b190ac06dd53a5d2fc5c4ce4e61
MD5 2638e89b23833ba61d865642f78c9c36
SHA1 825041612db1aaa6a86eadf331e470c76a4e09c9
SHA512 20238e4a1ce7398802d22bef70df92c57aae5d6bac4d3f67152c7783035bd2b6d37c04897b58ac41bc930a49a48b785ab6ea6964b48e6502276f819e269582a2
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYK:RWWBibao
MD5 SHA1 SHA512 SSDEEP

Submit Download

DaaEoQx.exe

Path C:\Windows\System\DaaEoQx.exe
Size 1.7MB
SHA256 00fa09c5750f74421895e4c1a82c001e86dcafe617883461079d6ddbbd80ca7c
MD5 d2e8ea6c3c3b627e17ff19ce6ad52162
SHA1 569f5227213abf5fcf473c3cc8e29d11c25cc687
SHA512 e96569d3d1aa1124a0b5b69c401d9afded01350da22accc90f1c14aeae1ac4e62f5fd437cc4898462c95223ed183257504ff7d52882c85ef789aa9adb3f33529
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYP:RWWBibax
MD5 SHA1 SHA512 SSDEEP

Submit Download

FUVbwxi.exe

Path C:\Windows\System\FUVbwxi.exe
Size 1.7MB
SHA256 1cd8ecedd6de249636df951422b9bb8530c0487089e364e16e71f9f4b185542e
MD5 b16eb21e8035c8da5faad17b1b54f51c
SHA1 470a34e119c44588b84c8349a729fa4f4b748235
SHA512 4aa15ea89f979c7fc9c592134f1e62df57d0c04e8034a04c52cc8e307ebd10ac425df50cb758de7e3b7622724af3aad3e9a513c116a085d221a9f03fde3ccda0
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYn:RWWBibah
MD5 SHA1 SHA512 SSDEEP

Submit Download

HhlBdtC.exe

Path C:\Windows\System\HhlBdtC.exe
Size 1.7MB
SHA256 7bae214bc83a042bd4b06b658ae603f961eb9a1f07ab7d50186fc385a4a767b4
MD5 19f4ac27a00573fa628cc3f68c33bd44
SHA1 b907700973512fae2afe076da845a6e009b63397
SHA512 f1e349b999627f819f5745f087acd910cf6cb08302b2edeb5cbd14d90e9cdbf8ff3d2e8cd214cd584e11e53c9b6c282f5448364fd0a921e545560f0ceb993364
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYG:RWWBibak
MD5 SHA1 SHA512 SSDEEP

Submit Download

NUmaCye.exe

Path C:\Windows\System\NUmaCye.exe
Size 1.7MB
SHA256 ce636f587cced66d6e2e1f0fc67c21b7c694c106dff4d5c94284f5c53ce63d6a
MD5 e2d91e694a8979a207bb02bf4e39cc7e
SHA1 b737293c41d34d12191225460aabb3659958db91
SHA512 f2b25c7a2e9afb5af251571b131a1ab82fa12cafaef0cff6d917276ca7d0a7a044f0448daced235e694c5d43857a74401bda951469a03bbdc13766ca5ba7566f
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYw:RWWBiba2
MD5 SHA1 SHA512 SSDEEP

Submit Download

OWnKxoV.exe

Path C:\Windows\System\OWnKxoV.exe
Size 1.7MB
SHA256 d5f05384753ecc7401cef7d3d4d2fe547468c44097ced22199a616ce8ee341c2
MD5 1347196758a10adbefe4615caca19801
SHA1 b9f12756797b8bbd2d120afecf27d37d809467da
SHA512 75e606d9e07585bb793488b2ca25c4d22c6ff7a72cc6b4a26ce137f906f49dd1ab415dd5c13153d080ddeb2ee7c16fb26c5966464c01cf7985adb785810831dd
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYl:RWWBibaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

PAoHjLN.exe

Path C:\Windows\System\PAoHjLN.exe
Size 1.7MB
SHA256 bcafa895cad5072cbe8555e1445e4835bcc75997732b713a839673c7a804637c
MD5 25c0c80878a9feaea12fe4560ba63581
SHA1 623d6d62b8fce2b4c3c96880dd83ef47580fffe0
SHA512 d61469c145d51d8a5fff119a424dc2f449c2580b734824aff37735c2b21b847cd735499ae4ddbc932f445c0bbdef6b87140a287989cb44df2156645f3fef742e
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYb:RWWBibaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pbdhfxi.exe

Path C:\Windows\System\Pbdhfxi.exe
Size 1.7MB
SHA256 63bb3fa8c2d28f1cd16db483bafb904e5d54f6a05a66b4d2d3fdb3e69b0ea3a1
MD5 0009dfbeb58fe3eebba43da0e122a915
SHA1 c600ae8ab0364d915ceb51e7d78b94736f7c9728
SHA512 d9ae179bea69899911feb6fa146230bb75323970c2a64c07d74b220f9aca1c7247594e4ac44f037396526e08d01758076d5dc4a0a90ac79c7736de95a4f4573c
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYJ:RWWBiba3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PomJxIX.exe

Path C:\Windows\System\PomJxIX.exe
Size 1.7MB
SHA256 c0fcc4e1d9da53caa35471d2cc25c739b2aaf14db9cb983082ac0f6d242e3191
MD5 7cc5ae95624e0092cfa065a93daeb223
SHA1 a7ee194495757c9b6155d0d9b87529b7b5a946d8
SHA512 99044e25866c31c92d0ece07bc2ba9a6cc6a7c6650bbbd7657d085ae4186b0e0d1319d81ee1e740c469a094417213b540532e327784f350a8089c26849296c06
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYy:RWWBibaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

PpknVVW.exe

Path C:\Windows\System\PpknVVW.exe
Size 1.7MB
SHA256 396c878d2c6f839fc8acfba721912a5c1b208c7ca2f6bc6fce4f8eb92f0c5965
MD5 cffd7ce93e43a4fa2540d05a6f5d1768
SHA1 bcabe9dbf9d17cb9a1cc1f4f4d3ae92450f558d4
SHA512 d15995061257a4af571170f89c9aba131b9d8fa8e0db421aaea195769da778f06fe4dc614387845ec5da52013c54a5789b410cbd0492cf789b985bd849c6c7bf
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYY:RWWBibaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjPOCbb.exe

Path C:\Windows\System\SjPOCbb.exe
Size 1.7MB
SHA256 b67565449a2cce67d065fa6718975cf89c599247c59b6d9f220f25aa18b306b6
MD5 f5c973faf331262bebb947338801ba11
SHA1 1c788f779af7539d19a0129b11b5d8105c665766
SHA512 5bca80e9a6ae55595721df633e99b89265874b91c94f411dc3c9624ffee4788d5f9956363dc64c4329fa91aa06ada3d7271232e029a10d9c8440233b2a0810bd
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYe:RWWBibaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

TVAGHYO.exe

Path C:\Windows\System\TVAGHYO.exe
Size 1.7MB
SHA256 9578815208bd4b08a5cf20264fa98aa74694ed98f8d4642beb4d126c6d368021
MD5 236d62fb11e02c8b9dd60a6af929c1cc
SHA1 6baf81050b4f09c9a736e517eca3ef1c9bd7b3db
SHA512 adcb2aa5ce9892b537e02f6d3360f3724dbfebfd460640f5e951377049b89164decb801b05ec7a560069b40202157080dc4d68771279c568b6e3f012ddc1af9a
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYX:RWWBibaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

VPJIgRE.exe

Path C:\Windows\System\VPJIgRE.exe
Size 1.7MB
SHA256 0a9be4be3c7c80068bcc4226a103a7234658405087d1665c9256b2c326e7ac0d
MD5 f07fa680fa3c30b393b2e386eeabc76e
SHA1 2f2f172d1249251b8fee090e6ff785ca69c11825
SHA512 1983d81a936ea877046d7fa8e288e99e7f4a0fd8fc95f9d0cabd4669bfc40f0c4ebd0fd27aa2d8165a8d320fb6e9d3b04b876a6945662833557445aea4d32fb7
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYW:RWWBibaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

VyYpRvb.exe

Path C:\Windows\System\VyYpRvb.exe
Size 1.7MB
SHA256 d6de9e2d13543f034a86c7e312de833a666f73befeb3eb09864316f05cd6a030
MD5 ca2277cee3088224ae19307da77fd047
SHA1 aa070efbb4343ad9ba4203a63ae50ef44ebd41b6
SHA512 35fa4e4e7f96a6c433db9f65446eb71fab27c38660ea7943a047d6afa1dd05034f8a1bbec725f1472f6a798c731159cfb581ec00c30e53beb9ff5eeabd0c9427
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYyf:RWWBibao
MD5 SHA1 SHA512 SSDEEP

Submit Download

WggFNym.exe

Path C:\Windows\System\WggFNym.exe
Size 1.7MB
SHA256 0cb47cca3e01347932babaa795bf9ca19adfca3fa608bd2c7faa69b658a5cfb5
MD5 b5834b2524ab0cf1083cb19570a5d578
SHA1 605bb10352916337825cb9813a04cd16e10ea149
SHA512 9b5d7bb1ec7d631a22a1671abc3d90ff392ff521644eb27219eb152dc7ca1e81144d8f7fa85ee09a88e0458761eaec745aa97435031943fa85547291f1238b08
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYu:RWWBibag
MD5 SHA1 SHA512 SSDEEP

Submit Download

WjwooCb.exe

Path C:\Windows\System\WjwooCb.exe
Size 1.7MB
SHA256 e85ca17fb53f120a85a8f4269035faebb27d41f5473f9d83d2d02dedfd855b29
MD5 9e4358b48fcd02fa2b32244037cc42d3
SHA1 0d2ca6bd1b00c9b2baf087a3105840e3337a875f
SHA512 730857dc23faec701e0922c0fc561231f14527a37dd5dde0f1c1ad68b438588506ccb74c85bad5948e2dca71cf93ddd1713b0d6f6810f800e5ee35ea13403e65
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYY7:RWWBibaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

YBZpfwS.exe

Path C:\Windows\System\YBZpfwS.exe
Size 1.7MB
SHA256 20fdd517a99f63368a27ffc7420a4bdf285374ec9f47f2a523e31ea9022bbcd0
MD5 4995cb53269a8d236e7153e7b04c2d7a
SHA1 33de0aa52b517f68bdcec5b25cfc669ca8d9cfd0
SHA512 86e2c03f55f788549960111b0036dda1061e45482712799b519d5696092cb86699a461dfd6bf185b3363cb616959b358906419c114603fec5799abb3f70f019d
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYE:RWWBibam
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZLLqkcN.exe

Path C:\Windows\System\ZLLqkcN.exe
Size 1.7MB
SHA256 e1ed8dc618944697e952a9a1a4e1d2105de931f88e6c29e78e8d27ad8223e578
MD5 22d85d44f105879fd6833bc11fad2820
SHA1 8092ba5f5e54f542fb6a7a82ead4b280d7d1de97
SHA512 610e32b27bcd40351809ccb08a2941b9c5ae85074fc8b0aa5112a8f647d4ff41359064dbd2aedb371cb52cbffabdc7a017309439dfb2ec2b04335c0bebcba3c5
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYD:RWWBiba1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZRYTOqy.exe

Path C:\Windows\System\ZRYTOqy.exe
Size 1.7MB
SHA256 fb7de7f45ee47dde2aef3c4bec179967b94d9713c89a8b2a00c00022477c9ca2
MD5 1eaa3c4278d9528c7dbae3dfdedcb39e
SHA1 df7a19738dfba62033205c18adb54f901252ad84
SHA512 6a3ce07c63fe007dc6cd4b863f8d32eb7ca9e1d6c01fead0398ad4d1d3debf972f18283e7d04b1f6b3aea226363d0f801c26d4b432e0be64d5c6114beea1d1c7
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYv:RWWBibax
MD5 SHA1 SHA512 SSDEEP

Submit Download

dQexUrn.exe

Path C:\Windows\System\dQexUrn.exe
Size 1.7MB
SHA256 83329646d9744c593fc6a710678aea748561c9feb820edb0084682cbc29d1c4f
MD5 2f447a1c926445c35fbae724c1083bad
SHA1 280dc5ff17763bca0190cd9afc379ad7483e933b
SHA512 abd986707ce59e89290b04cbf6831b5f5c424221f3993ebb414c2b3da09ada8144aee72676d2c3c7c0173f2008e5812a0d5022724507d1def408744aa488ceb9
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrY+:RWWBiba4
MD5 SHA1 SHA512 SSDEEP

Submit Download

dZmaUUW.exe

Path C:\Windows\System\dZmaUUW.exe
Size 1.7MB
SHA256 f36589431ee1e5143d92a68164cdef64b4681cd2da5c49387b73ba095e97d95c
MD5 7d685858db630d2766d3e4910c83456b
SHA1 d3fa59ec49fd112292eb5159c8dc21aa17bd3656
SHA512 b0309d917f1ca8cb7584d5a88a6506ab1f998d5e7fdcf83c6f5c42a09072d5634992b5666f09e40652adea25057057f194982a9ccc7dc7780a10908ba4bedc89
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrY5:RWWBibaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

fsPvRpW.exe

Path C:\Windows\System\fsPvRpW.exe
Size 1.7MB
SHA256 0713e75d436dfc4fbc8f15f008bef8ff8528e4b00476b7e779c96ec7fa0b69a7
MD5 fcaf296b359e0aa3ddf52b22c653005f
SHA1 c39f376a427a218bca66ef05a45ac92c5f1a2513
SHA512 d6f02bbe7f636fdc2fc2867b7dedead5827f6ce56f7a7b25f7ed432a0f747bc5e8ddce68f0a60a0fcf7c96bc32b306d48ba9f0b74042218b67e9a11b378fa6eb
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYBf:RWWBibaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fuiJrLT.exe

Path C:\Windows\System\fuiJrLT.exe
Size 1.7MB
SHA256 4788f19779d6ed515057018bf142333bd663bd575553828fc1e6f2d65992d1b6
MD5 25011fff6a8c10c44fcf2a81638ce5b7
SHA1 899b313ec27842169bfe0902213ae36f2e00aefa
SHA512 240810c01a3e22238439f694dd2f516479f1286438ba5a79d3c6c788d267215db2adc22c102616365fb8919f32378b75fdccaafa7826d6daf133556f42270956
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYh:RWWBiban
MD5 SHA1 SHA512 SSDEEP

Submit Download

gUYgbYw.exe

Path C:\Windows\System\gUYgbYw.exe
Size 1.7MB
SHA256 0e2c21da080009966dc38ed7eaa5a05d14bc1f0a8a7a090dfa9136b37257eb8c
MD5 a5acff2b72e66af3491ae8319cec0e3b
SHA1 82d94f2061a8a2d5518465c598e25f0998451fde
SHA512 4326ed4be2d9bb1bc19ace8cbac024b5d7897b30a2054e7cc1de038827fefe23879b30c530f6b7e3b7a92ea9007b2ee6c059ed4ce303157c49ff8a3f6f990e45
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrY4:RWWBibaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

hViqyfJ.exe

Path C:\Windows\System\hViqyfJ.exe
Size 1.7MB
SHA256 953897fa20c1c471cb27a03289fbcb35b1b9f926e471631ccfa4e9ff86a6f901
MD5 8c97dffde09ee120ae2e0bdfd31566f5
SHA1 fed385de171a7f07f36bdb436e0ff713dd573aa9
SHA512 5e882c3149cec160b4d4156112d4b374ee7ae411519c6f6fb5dfa8f6980d99352f7868733bef29a58492c63868329e673a9b1b732957bc0fcae4aee5f1249467
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYA:RWWBibau
MD5 SHA1 SHA512 SSDEEP

Submit Download

hznPaTd.exe

Path C:\Windows\System\hznPaTd.exe
Size 1.7MB
SHA256 71e92d689f1255aa9109db063e9243bb8868f2f51b441b10208ee362d5113488
MD5 4b9caccb47392dd71d34b513c6fa8fa5
SHA1 1e0e4aa9662402fba42dc7a5f97b881ccd7b6d7e
SHA512 3f7eb13621c85c2287f441864bc6f0862e135c8af171cd9cdd1471f61f06df694afa622b1801c4a7915836e7dedebf5ad62cf064d8a6d8ae747bab47cb9e4586
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYW:RWWBibaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

kRGYJDE.exe

Path C:\Windows\System\kRGYJDE.exe
Size 1.7MB
SHA256 410091902694e76f4c6c269f0f4ed63caa83e2bcbfa079150963e2fd72cb3962
MD5 94a9ed24c89e983679e9e8766bed5619
SHA1 57de21f114b51ea5b104c6d4f0daf990f38aafcd
SHA512 b34d83888427506aa55a6ca456214ff153bdb7608c7f1dfcfb057726bae3f90b5e6dde795a6489230341decacfd0f5d277f12a1235a74b6e1b7a5308ba51dc1e
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrY6:RWWBibaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

lGQZUAD.exe

Path C:\Windows\System\lGQZUAD.exe
Size 1.7MB
SHA256 bf8cc2c0d4b30d795e65635ad0ab4be358182fe99a5baf46f40af751ff4cc83d
MD5 285ec5b268e3c5f0527cd06ee3479172
SHA1 38d1f071b0144b07952cacedae0defc10aaf845d
SHA512 c32a29c0fef247e3bb1e176a4c0d446d5d1903400ffb1da2c6b2917b5c942e2e50ad8cc5e1853aa45f028ca373216f2b3c156046a940dd8a437e44c793173da6
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYj:RWWBibat
MD5 SHA1 SHA512 SSDEEP

Submit Download

mNpABnE.exe

Path C:\Windows\System\mNpABnE.exe
Size 1.7MB
SHA256 8aecce5a97ecaf73a34b192ff3dbc6060f7736bc25c856fe29599da980411975
MD5 89df2126209a5d0e84bd69a875f6d34d
SHA1 d2b477092b9fc71abbcaf80222d24136735ab373
SHA512 4e243861ed37979bca0c01154106b7defb06fef0683f11e3d9e8174e2f1f951199eb49f0e0bf92550d7a32636ad053b1e57370462fdbf58dcd02565b69eddecf
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYS:RWWBibaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

mifaTEt.exe

Path C:\Windows\System\mifaTEt.exe
Size 1.7MB
SHA256 df74e614fc0a330b09503e94fd7a3b5ea15a6d463e72940cd758f48f5e51458c
MD5 f9e42e7d19230ed69d7af7d63d2b4790
SHA1 f0d6721982ccafef1c4075583b0d989229e59410
SHA512 fdb3876d89221230e95901181382fd0d2f06ebf8b200462ae2444193e7905cd4acb66037827b62c50fbd19a104373801245e8ec08047f7949750f2e16764ee6b
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYOQ:RWWBibaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

nxRmank.exe

Path C:\Windows\System\nxRmank.exe
Size 1.7MB
SHA256 f5ccdd25b4dbf90e00b319d2a5b0900eff023c45419b79eea1b603a93b512424
MD5 2c63b50620f046a788c3e3865ad73cd4
SHA1 484b19cd3e5af90dd7c0fd1ae92151ffd9d207a4
SHA512 627a5c7d24a2aa6d4263e918f6044f77c4d02bfef535cbe34aee1da4ce42f814251e2eeb1bfee8fb3456269e3519fc19d3c72033f6ba623288bb27c96393253a
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYz:RWWBibaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

oPBcICD.exe

Path C:\Windows\System\oPBcICD.exe
Size 1.7MB
SHA256 4d963b558188dff27cfbc67f089480af15029a709d41f9ea3b9c1d7cdbd66370
MD5 8f93dc64e28b314df20139bc6c0cd9bd
SHA1 42be448dc3c9408abf260e54109a943b93cce837
SHA512 926f6a8f345620cf053a4fd8e3acf5144a76aaeb419d1c1df78815a4409f16905814ec9d92a7e90b04e804eb661f754dcaef5ac64717a6f61ebb70f82c62b01f
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYl:RWWBiban
MD5 SHA1 SHA512 SSDEEP

Submit Download

pHPhFCe.exe

Path C:\Windows\System\pHPhFCe.exe
Size 1.7MB
SHA256 4c5fb798ca5f5f9a8cd9fae4d81baa48c207e2dd1d9707cea09c7ac3cf436bce
MD5 b1deee883af7e9eafaee51550ef8f6b2
SHA1 be0a46791e347a2c47dde03d28e3ecc67a1fee06
SHA512 7304f6157169e19fcdb65ee07350470b99bae1161dc5ff7f3bd60a7bf24cb4f1e6be64bcededc47fd8281238361eab312da67be257c9176eb34a58b5233ba5eb
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYn:RWWBibaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

pOkZftD.exe

Path C:\Windows\System\pOkZftD.exe
Size 1.7MB
SHA256 3f01e07c11ee38f213449fea494e3d6c48245a8ebc7cf8e6cec2923b3bfa83be
MD5 26664a8aa4fdfacb2c517d7d561633cd
SHA1 b5c2ee3cc1b5557f40cc1c5a51cda5808ebafc6f
SHA512 a306e186ba822505494e7c98874591a69ee84a7e2ec856370c6ff792e716f8dc34d9c4534c688f0ab43fff30e48af6c124ceff2cb3f48ab750133af2388c4cb8
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYy:RWWBibaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

pWoukJP.exe

Path C:\Windows\System\pWoukJP.exe
Size 1.7MB
SHA256 c376004c0e938336b29c1acca94659513f73a51d38ee20c09c48f12bed4575dd
MD5 6ea4d493cb349f03735304ac2de7b4cb
SHA1 cf6bc77a3f438e739ac78e7b0a7360ccc03021f6
SHA512 53fe16dc3de97434551830b237d3becf0f5e478cce56f54440c670b91052c08d12746e38356694e99a7cd8fe0ab7051ada24c53edcd1dfbd0dbb8949b3b16246
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYy:RWWBibaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

puGRCxb.exe

Path C:\Windows\System\puGRCxb.exe
Size 1.7MB
SHA256 a6d711959bc03250719ad603a203b06ae3843db6719e13376722b6ff7fd8ab17
MD5 b7c88123350b091f4a764b5e8739dbd7
SHA1 46654b9fdc11b45398aece132facea6752b83db7
SHA512 51e67d1fc031d178d85e88542bd8f5e74140ca947180c40037830d8aeca1aa3a1a3f10e110cef9bc693beb03df8a7c16b47bbe1c67db6ed907560897daa189b3
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrY9:RWWBibaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

qKRXbMu.exe

Path C:\Windows\System\qKRXbMu.exe
Size 1.7MB
SHA256 70872fb35cadcb1bad640f6830324ddb0f6d94159cf6eb48898b28aaf0a0b2aa
MD5 f37869311fef7e5c0dfc98f3f2bf2e5f
SHA1 a7f5dbf6dc5ceb4b631d6d984a589427b1396441
SHA512 e8b3dca44f7810981d62bd315ff01cc1a0252c9c8719bcb3cefbf26fcff6d5a032bad66df090f4bed8b2f8e493e00f1606917917bfeaf70f569b83d23784803d
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYv:RWWBibaZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vUhXTjS.exe

Path C:\Windows\System\vUhXTjS.exe
Size 1.7MB
SHA256 4c55f15371ebaa7a3bfa8017c6f46a48080aeef0de784cf32cfbb3b15b36a106
MD5 4fd603570dc210a08011f42c0574cfb5
SHA1 9aae15f5727ad5fefecee163968c45ebdc0f870f
SHA512 d35eead8a1dfab3a821f782955639306816651a74e23c6fdb665fc7adddf9eca0e88fd5fb0034494a44a7806096e71e4f811563bd60030f2801d0f8a2116d7e9
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYp:RWWBibaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

xNMGZCk.exe

Path C:\Windows\System\xNMGZCk.exe
Size 1.7MB
SHA256 42da2c4d88dd6dcb4df1bc3ff1431d83b7bccd0b7ef51a5d3fc586ead3384856
MD5 978e1cc8866649d1129000b9a4bd1dae
SHA1 df4cc6887484a722d57c818f3d6837f69d3ec24d
SHA512 08c15e3b265cbd73fe94763f351b013a4d55546716843bc61ba6c3e9083b43d43adabd146feace24b52d3200c50935e6dabe8596f58c5e56ab93ca82b5d39d1b
SSDEEP 49152:ROdWCCi7/rahHxhOWenbffOldXeLA1cFrYM:RWWBibaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/644-2286-0x00007FF71EE00000-0x00007FF71F151000-memory.dmp

Download

memory/644-172-0x00007FF71EE00000-0x00007FF71F151000-memory.dmp

Download

memory/952-404-0x00007FF6CADA0000-0x00007FF6CB0F1000-memory.dmp

Download

memory/952-2315-0x00007FF6CADA0000-0x00007FF6CB0F1000-memory.dmp

Download

memory/1212-2301-0x00007FF709340000-0x00007FF709691000-memory.dmp

Download

memory/1212-241-0x00007FF709340000-0x00007FF709691000-memory.dmp

Download

memory/1496-307-0x00007FF69B050000-0x00007FF69B3A1000-memory.dmp

Download

memory/1496-2308-0x00007FF69B050000-0x00007FF69B3A1000-memory.dmp

Download

memory/1596-452-0x00007FF68A8B0000-0x00007FF68AC01000-memory.dmp

Download

memory/1596-2288-0x00007FF68A8B0000-0x00007FF68AC01000-memory.dmp

Download

memory/1800-413-0x00007FF6C3690000-0x00007FF6C39E1000-memory.dmp

Download

memory/1800-2275-0x00007FF6C3690000-0x00007FF6C39E1000-memory.dmp

Download

memory/1848-0-0x00007FF620950000-0x00007FF620CA1000-memory.dmp

Download

memory/1848-1-0x0000023BFB590000-0x0000023BFB5A0000-memory.dmp

Download

memory/1848-2166-0x00007FF620950000-0x00007FF620CA1000-memory.dmp

Download

memory/2020-461-0x00007FF7120F0000-0x00007FF712441000-memory.dmp

Download

memory/2020-2319-0x00007FF7120F0000-0x00007FF712441000-memory.dmp

Download

memory/2148-137-0x00007FF63EB30000-0x00007FF63EE81000-memory.dmp

Download

memory/2148-2292-0x00007FF63EB30000-0x00007FF63EE81000-memory.dmp

Download

memory/2184-2310-0x00007FF731780000-0x00007FF731AD1000-memory.dmp

Download

memory/2184-460-0x00007FF731780000-0x00007FF731AD1000-memory.dmp

Download

memory/2388-2272-0x00007FF6E8BE0000-0x00007FF6E8F31000-memory.dmp

Download

memory/2388-42-0x00007FF6E8BE0000-0x00007FF6E8F31000-memory.dmp

Download

memory/2396-2269-0x00007FF769370000-0x00007FF7696C1000-memory.dmp

Download

memory/2396-16-0x00007FF769370000-0x00007FF7696C1000-memory.dmp

Download

memory/2552-2348-0x00007FF6DED40000-0x00007FF6DF091000-memory.dmp

Download

memory/2552-342-0x00007FF6DED40000-0x00007FF6DF091000-memory.dmp

Download

memory/2672-2265-0x00007FF72EB60000-0x00007FF72EEB1000-memory.dmp

Download

memory/2672-10-0x00007FF72EB60000-0x00007FF72EEB1000-memory.dmp

Download

memory/3000-60-0x00007FF7A7250000-0x00007FF7A75A1000-memory.dmp

Download

memory/3000-2280-0x00007FF7A7250000-0x00007FF7A75A1000-memory.dmp

Download

memory/3020-2349-0x00007FF658C30000-0x00007FF658F81000-memory.dmp

Download

memory/3020-313-0x00007FF658C30000-0x00007FF658F81000-memory.dmp

Download

memory/3088-2290-0x00007FF6768E0000-0x00007FF676C31000-memory.dmp

Download

memory/3088-141-0x00007FF6768E0000-0x00007FF676C31000-memory.dmp

Download

memory/3468-415-0x00007FF7F1F10000-0x00007FF7F2261000-memory.dmp

Download

memory/3468-2296-0x00007FF7F1F10000-0x00007FF7F2261000-memory.dmp

Download

memory/3600-2303-0x00007FF618050000-0x00007FF6183A1000-memory.dmp

Download

memory/3600-265-0x00007FF618050000-0x00007FF6183A1000-memory.dmp

Download

memory/3732-2306-0x00007FF782130000-0x00007FF782481000-memory.dmp

Download

memory/3732-361-0x00007FF782130000-0x00007FF782481000-memory.dmp

Download

memory/4092-411-0x00007FF647B00000-0x00007FF647E51000-memory.dmp

Download

memory/4092-2312-0x00007FF647B00000-0x00007FF647E51000-memory.dmp

Download

memory/4168-2277-0x00007FF78F3C0000-0x00007FF78F711000-memory.dmp

Download

memory/4168-35-0x00007FF78F3C0000-0x00007FF78F711000-memory.dmp

Download

memory/4284-412-0x00007FF6F0E90000-0x00007FF6F11E1000-memory.dmp

Download

memory/4284-2268-0x00007FF6F0E90000-0x00007FF6F11E1000-memory.dmp

Download

memory/4460-2298-0x00007FF705010000-0x00007FF705361000-memory.dmp

Download

memory/4460-414-0x00007FF705010000-0x00007FF705361000-memory.dmp

Download

memory/4560-57-0x00007FF7F1000000-0x00007FF7F1351000-memory.dmp

Download

memory/4560-2273-0x00007FF7F1000000-0x00007FF7F1351000-memory.dmp

Download

memory/4676-2294-0x00007FF6A2C40000-0x00007FF6A2F91000-memory.dmp

Download

memory/4676-99-0x00007FF6A2C40000-0x00007FF6A2F91000-memory.dmp

Download

memory/4840-2281-0x00007FF736130000-0x00007FF736481000-memory.dmp

Download

memory/4840-78-0x00007FF736130000-0x00007FF736481000-memory.dmp

Download

memory/4880-2313-0x00007FF67EEE0000-0x00007FF67F231000-memory.dmp

Download

memory/4880-403-0x00007FF67EEE0000-0x00007FF67F231000-memory.dmp

Download

memory/5060-2284-0x00007FF669300000-0x00007FF669651000-memory.dmp

Download

memory/5060-224-0x00007FF669300000-0x00007FF669651000-memory.dmp

Download

memory/5092-2299-0x00007FF7A1100000-0x00007FF7A1451000-memory.dmp

Download

memory/5092-240-0x00007FF7A1100000-0x00007FF7A1451000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads