xmrig | 0358d6466ce2181eb58cb6f85b0f1a06ea153c9249f1d818ff47de919b5be6c6

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
Size

2.2MB
MD5

6d2afe0cfc031c3a9b675594d4d6ea50
SHA1

1663d74849d792aadd4fa8b77a50b178401218b9
SHA256

0358d6466ce2181eb58cb6f85b0f1a06ea153c9249f1d818ff47de919b5be6c6
SHA512

0a3205477806955b15c63974c1e99e0769f48b7d2c07492a8612188a7843aaefe5833ba340c6edc03aea5e875861e8977e30f151c8285f5457b1685834bebbeb
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXGv4rzq6c2HAUJYT:BemTLkNdfE0pZr8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3792-0-0x00007FF746C60000-0x00007FF746FB4000-memory.dmp	xmrig
behavioral2/files/0x000900000002342c-5.dat	xmrig
behavioral2/memory/1392-20-0x00007FF7EB6D0000-0x00007FF7EBA24000-memory.dmp	xmrig
behavioral2/memory/3532-33-0x00007FF79A330000-0x00007FF79A684000-memory.dmp	xmrig
behavioral2/memory/3092-29-0x00007FF60AE20000-0x00007FF60B174000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-52.dat	xmrig
behavioral2/files/0x0007000000023442-91.dat	xmrig
behavioral2/files/0x0007000000023449-136.dat	xmrig
behavioral2/files/0x000700000002344b-145.dat	xmrig
behavioral2/memory/3932-160-0x00007FF614570000-0x00007FF6148C4000-memory.dmp	xmrig
behavioral2/memory/4692-188-0x00007FF6297A0000-0x00007FF629AF4000-memory.dmp	xmrig
behavioral2/memory/3520-198-0x00007FF68DA60000-0x00007FF68DDB4000-memory.dmp	xmrig
behavioral2/memory/1672-203-0x00007FF7B35D0000-0x00007FF7B3924000-memory.dmp	xmrig
behavioral2/memory/3784-207-0x00007FF7087A0000-0x00007FF708AF4000-memory.dmp	xmrig
behavioral2/memory/5080-209-0x00007FF7B9390000-0x00007FF7B96E4000-memory.dmp	xmrig
behavioral2/memory/1460-208-0x00007FF781530000-0x00007FF781884000-memory.dmp	xmrig
behavioral2/memory/588-206-0x00007FF78DA10000-0x00007FF78DD64000-memory.dmp	xmrig
behavioral2/memory/5112-204-0x00007FF70D550000-0x00007FF70D8A4000-memory.dmp	xmrig
behavioral2/memory/3712-201-0x00007FF756550000-0x00007FF7568A4000-memory.dmp	xmrig
behavioral2/memory/4196-199-0x00007FF6D2D20000-0x00007FF6D3074000-memory.dmp	xmrig
behavioral2/memory/2652-192-0x00007FF64EC90000-0x00007FF64EFE4000-memory.dmp	xmrig
behavioral2/memory/1788-191-0x00007FF6CF5A0000-0x00007FF6CF8F4000-memory.dmp	xmrig
behavioral2/memory/4960-179-0x00007FF60ED70000-0x00007FF60F0C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023452-178.dat	xmrig
behavioral2/memory/1392-2105-0x00007FF7EB6D0000-0x00007FF7EBA24000-memory.dmp	xmrig
behavioral2/memory/3568-2108-0x00007FF69A980000-0x00007FF69ACD4000-memory.dmp	xmrig
behavioral2/memory/956-2110-0x00007FF7D0300000-0x00007FF7D0654000-memory.dmp	xmrig
behavioral2/memory/2560-2112-0x00007FF726820000-0x00007FF726B74000-memory.dmp	xmrig
behavioral2/memory/3284-2114-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	xmrig
behavioral2/memory/4200-2113-0x00007FF67E4E0000-0x00007FF67E834000-memory.dmp	xmrig
behavioral2/memory/1448-2111-0x00007FF647D70000-0x00007FF6480C4000-memory.dmp	xmrig
behavioral2/memory/3588-2107-0x00007FF725E10000-0x00007FF726164000-memory.dmp	xmrig
behavioral2/memory/3092-2106-0x00007FF60AE20000-0x00007FF60B174000-memory.dmp	xmrig
behavioral2/memory/4960-2116-0x00007FF60ED70000-0x00007FF60F0C4000-memory.dmp	xmrig
behavioral2/memory/3532-2115-0x00007FF79A330000-0x00007FF79A684000-memory.dmp	xmrig
behavioral2/files/0x0007000000023450-172.dat	xmrig
behavioral2/files/0x000700000002344a-170.dat	xmrig
behavioral2/files/0x000700000002344f-163.dat	xmrig
behavioral2/files/0x000700000002344f-159.dat	xmrig
behavioral2/memory/3284-147-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	xmrig
behavioral2/files/0x000700000002344a-129.dat	xmrig
behavioral2/memory/4200-128-0x00007FF67E4E0000-0x00007FF67E834000-memory.dmp	xmrig
behavioral2/files/0x000700000002344c-137.dat	xmrig
behavioral2/files/0x0007000000023443-123.dat	xmrig
behavioral2/memory/4572-117-0x00007FF75DB00000-0x00007FF75DE54000-memory.dmp	xmrig
behavioral2/memory/2560-102-0x00007FF726820000-0x00007FF726B74000-memory.dmp	xmrig
behavioral2/files/0x000700000002343e-88.dat	xmrig
behavioral2/files/0x000700000002343c-82.dat	xmrig
behavioral2/memory/1448-81-0x00007FF647D70000-0x00007FF6480C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-71.dat	xmrig
behavioral2/memory/4412-64-0x00007FF657DD0000-0x00007FF658124000-memory.dmp	xmrig
behavioral2/memory/3568-55-0x00007FF69A980000-0x00007FF69ACD4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343d-61.dat	xmrig
behavioral2/memory/3588-44-0x00007FF725E10000-0x00007FF726164000-memory.dmp	xmrig
behavioral2/files/0x0007000000023438-47.dat	xmrig
behavioral2/files/0x0007000000023435-36.dat	xmrig
behavioral2/files/0x0007000000023434-19.dat	xmrig
behavioral2/memory/1036-12-0x00007FF725370000-0x00007FF7256C4000-memory.dmp	xmrig
behavioral2/files/0x000800000002342f-11.dat	xmrig
behavioral2/memory/1036-2117-0x00007FF725370000-0x00007FF7256C4000-memory.dmp	xmrig
behavioral2/memory/1392-2118-0x00007FF7EB6D0000-0x00007FF7EBA24000-memory.dmp	xmrig
behavioral2/memory/3092-2119-0x00007FF60AE20000-0x00007FF60B174000-memory.dmp	xmrig
behavioral2/memory/3520-2121-0x00007FF68DA60000-0x00007FF68DDB4000-memory.dmp	xmrig
behavioral2/memory/3588-2123-0x00007FF725E10000-0x00007FF726164000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1036	ybrUKzY.exe
1392	oMqrHJY.exe
3092	GDURuQx.exe
3520	AcRpdwZ.exe
3532	FEakgZd.exe
3588	zDlDJKL.exe
4196	EqsxcZx.exe
3568	YCZDVSl.exe
3712	lglIVhm.exe
4412	qhhivEI.exe
1672	KbNwaQR.exe
956	LVRlOLG.exe
1448	LpEaAqC.exe
5112	DjHCxDt.exe
2560	Hwtcpza.exe
1260	uZIifby.exe
4572	tHTgJoh.exe
588	AiLoiKf.exe
3784	KXUFlOs.exe
4200	XjxOoSV.exe
3284	dzUVHTf.exe
3932	xSuiPIY.exe
1460	iywSzeq.exe
4960	EKpBFrV.exe
5080	zsfjTdt.exe
3516	gXVKGgI.exe
4692	jnkYwji.exe
1788	vXMAXPx.exe
2652	KGCwZAb.exe
4972	BQZjiLW.exe
728	GdBmSjM.exe
3200	QtoITpT.exe
1680	MEPYeKF.exe
3416	VArxmJd.exe
3984	xLZsUBG.exe
2312	EniyMTu.exe
1696	IdUkfGE.exe
4180	xtDeKar.exe
4400	UJyCAwo.exe
876	CYhIezr.exe
1612	loHqOYn.exe
4700	QWCVqzq.exe
4620	XNRscSG.exe
3764	ZxIcTWW.exe
4996	YwkugMs.exe
3780	KNAtzJk.exe
4116	oEpSUIw.exe
3128	XBVExmb.exe
4140	zpzyQXM.exe
4144	MCWkkci.exe
2200	NbUwjel.exe
1956	HZPWrMt.exe
1740	AhxsyQx.exe
2580	KNparzu.exe
2496	XVfHKjg.exe
4600	tEXwdbm.exe
1316	KUHlAmS.exe
1264	ypAsSeB.exe
4864	awYirje.exe
2000	zJGuayl.exe
4352	ylwukoA.exe
4016	cSjSnmE.exe
4084	OWlhoXf.exe
508	DWdtXoP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3792-0-0x00007FF746C60000-0x00007FF746FB4000-memory.dmp	upx
behavioral2/files/0x000900000002342c-5.dat	upx
behavioral2/memory/1392-20-0x00007FF7EB6D0000-0x00007FF7EBA24000-memory.dmp	upx
behavioral2/memory/3532-33-0x00007FF79A330000-0x00007FF79A684000-memory.dmp	upx
behavioral2/memory/3092-29-0x00007FF60AE20000-0x00007FF60B174000-memory.dmp	upx
behavioral2/files/0x000700000002343b-52.dat	upx
behavioral2/memory/956-78-0x00007FF7D0300000-0x00007FF7D0654000-memory.dmp	upx
behavioral2/files/0x0007000000023442-91.dat	upx
behavioral2/files/0x0007000000023449-136.dat	upx
behavioral2/files/0x000700000002344b-145.dat	upx
behavioral2/memory/3932-160-0x00007FF614570000-0x00007FF6148C4000-memory.dmp	upx
behavioral2/memory/4692-188-0x00007FF6297A0000-0x00007FF629AF4000-memory.dmp	upx
behavioral2/memory/3520-198-0x00007FF68DA60000-0x00007FF68DDB4000-memory.dmp	upx
behavioral2/memory/1672-203-0x00007FF7B35D0000-0x00007FF7B3924000-memory.dmp	upx
behavioral2/memory/3784-207-0x00007FF7087A0000-0x00007FF708AF4000-memory.dmp	upx
behavioral2/memory/5080-209-0x00007FF7B9390000-0x00007FF7B96E4000-memory.dmp	upx
behavioral2/memory/1460-208-0x00007FF781530000-0x00007FF781884000-memory.dmp	upx
behavioral2/memory/588-206-0x00007FF78DA10000-0x00007FF78DD64000-memory.dmp	upx
behavioral2/memory/1260-205-0x00007FF67B580000-0x00007FF67B8D4000-memory.dmp	upx
behavioral2/memory/5112-204-0x00007FF70D550000-0x00007FF70D8A4000-memory.dmp	upx
behavioral2/memory/3712-201-0x00007FF756550000-0x00007FF7568A4000-memory.dmp	upx
behavioral2/memory/4196-199-0x00007FF6D2D20000-0x00007FF6D3074000-memory.dmp	upx
behavioral2/memory/2652-192-0x00007FF64EC90000-0x00007FF64EFE4000-memory.dmp	upx
behavioral2/memory/1788-191-0x00007FF6CF5A0000-0x00007FF6CF8F4000-memory.dmp	upx
behavioral2/memory/3516-185-0x00007FF625960000-0x00007FF625CB4000-memory.dmp	upx
behavioral2/memory/4960-179-0x00007FF60ED70000-0x00007FF60F0C4000-memory.dmp	upx
behavioral2/files/0x0007000000023452-178.dat	upx
behavioral2/files/0x0007000000023451-177.dat	upx
behavioral2/memory/1392-2105-0x00007FF7EB6D0000-0x00007FF7EBA24000-memory.dmp	upx
behavioral2/memory/3568-2108-0x00007FF69A980000-0x00007FF69ACD4000-memory.dmp	upx
behavioral2/memory/956-2110-0x00007FF7D0300000-0x00007FF7D0654000-memory.dmp	upx
behavioral2/memory/2560-2112-0x00007FF726820000-0x00007FF726B74000-memory.dmp	upx
behavioral2/memory/3284-2114-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	upx
behavioral2/memory/4200-2113-0x00007FF67E4E0000-0x00007FF67E834000-memory.dmp	upx
behavioral2/memory/1448-2111-0x00007FF647D70000-0x00007FF6480C4000-memory.dmp	upx
behavioral2/memory/4412-2109-0x00007FF657DD0000-0x00007FF658124000-memory.dmp	upx
behavioral2/memory/3588-2107-0x00007FF725E10000-0x00007FF726164000-memory.dmp	upx
behavioral2/memory/3092-2106-0x00007FF60AE20000-0x00007FF60B174000-memory.dmp	upx
behavioral2/memory/4960-2116-0x00007FF60ED70000-0x00007FF60F0C4000-memory.dmp	upx
behavioral2/memory/3532-2115-0x00007FF79A330000-0x00007FF79A684000-memory.dmp	upx
behavioral2/files/0x0007000000023450-172.dat	upx
behavioral2/files/0x000700000002344a-170.dat	upx
behavioral2/files/0x000700000002344f-163.dat	upx
behavioral2/files/0x000700000002344f-159.dat	upx
behavioral2/memory/3284-147-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	upx
behavioral2/files/0x000700000002344a-129.dat	upx
behavioral2/memory/4200-128-0x00007FF67E4E0000-0x00007FF67E834000-memory.dmp	upx
behavioral2/files/0x000700000002344c-137.dat	upx
behavioral2/files/0x0007000000023443-123.dat	upx
behavioral2/memory/4572-117-0x00007FF75DB00000-0x00007FF75DE54000-memory.dmp	upx
behavioral2/files/0x0007000000023447-115.dat	upx
behavioral2/memory/2560-102-0x00007FF726820000-0x00007FF726B74000-memory.dmp	upx
behavioral2/files/0x000700000002343e-88.dat	upx
behavioral2/files/0x000700000002343c-82.dat	upx
behavioral2/memory/1448-81-0x00007FF647D70000-0x00007FF6480C4000-memory.dmp	upx
behavioral2/files/0x000700000002343b-71.dat	upx
behavioral2/memory/4412-64-0x00007FF657DD0000-0x00007FF658124000-memory.dmp	upx
behavioral2/memory/3568-55-0x00007FF69A980000-0x00007FF69ACD4000-memory.dmp	upx
behavioral2/files/0x000700000002343d-61.dat	upx
behavioral2/memory/3588-44-0x00007FF725E10000-0x00007FF726164000-memory.dmp	upx
behavioral2/files/0x0007000000023438-47.dat	upx
behavioral2/files/0x0007000000023435-36.dat	upx
behavioral2/files/0x0007000000023434-19.dat	upx
behavioral2/memory/1036-12-0x00007FF725370000-0x00007FF7256C4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sgqGtOj.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\nipXjbZ.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\JrOzYDQ.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\IqTSzpE.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\eFTQtgG.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\qoIXkYH.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\eAqrVZt.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\WOiWBXf.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\ObMCtTo.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\xsJXqJF.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\rvZoQaV.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\zlXBqcn.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\kpreswH.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\vFBwPhC.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\FEakgZd.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\rHHaTlB.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\nyIlwyL.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\uIlJJTL.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\AQqFKuO.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\UQTWoVO.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\DZEbdAR.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\XBVExmb.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\dwJhtNK.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\CAgJgjM.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\hdmhqbM.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\QKRVeaX.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\xtDeKar.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\qsLqFiV.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\SSclCBC.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\nvUcwpK.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\jMwvPfN.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\EtkvDwb.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\QlVzkfF.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\iiCGGTr.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\VblTmOl.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\yrqyDbV.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\MCWkkci.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\KNparzu.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\NGTXehN.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\LYeVlKt.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\XYJllEq.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\bwzRXnF.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\nLEiRhs.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\bNuNTVZ.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\vBOcYEi.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\KGCwZAb.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\CYhIezr.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\FHiKCIu.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\ahIqQLc.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\MUlkRrs.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\jRXQPcs.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\zpzyQXM.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\gGVMGeV.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\sGvtXTe.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\TAokQaG.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\WhTiHoM.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\cvqcJxA.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\tTdwgMm.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\KbNwaQR.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\RstSYMH.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\QPLrDOG.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\tZUlFFj.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\kMqsvib.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
File created	C:\Windows\System\OIOXVLe.exe	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1036	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	82
PID 3792 wrote to memory of 1036	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	82
PID 3792 wrote to memory of 1392	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	83
PID 3792 wrote to memory of 1392	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	83
PID 3792 wrote to memory of 3092	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	84
PID 3792 wrote to memory of 3092	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	84
PID 3792 wrote to memory of 3532	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	85
PID 3792 wrote to memory of 3532	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	85
PID 3792 wrote to memory of 3520	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	86
PID 3792 wrote to memory of 3520	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	86
PID 3792 wrote to memory of 3588	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	87
PID 3792 wrote to memory of 3588	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	87
PID 3792 wrote to memory of 4196	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	88
PID 3792 wrote to memory of 4196	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	88
PID 3792 wrote to memory of 3568	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	89
PID 3792 wrote to memory of 3568	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	89
PID 3792 wrote to memory of 3712	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	90
PID 3792 wrote to memory of 3712	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	90
PID 3792 wrote to memory of 4412	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	91
PID 3792 wrote to memory of 4412	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	91
PID 3792 wrote to memory of 1672	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	92
PID 3792 wrote to memory of 1672	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	92
PID 3792 wrote to memory of 956	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	93
PID 3792 wrote to memory of 956	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	93
PID 3792 wrote to memory of 1448	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	94
PID 3792 wrote to memory of 1448	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	94
PID 3792 wrote to memory of 5112	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	95
PID 3792 wrote to memory of 5112	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	95
PID 3792 wrote to memory of 2560	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	96
PID 3792 wrote to memory of 2560	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	96
PID 3792 wrote to memory of 1260	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	97
PID 3792 wrote to memory of 1260	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	97
PID 3792 wrote to memory of 4572	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	98
PID 3792 wrote to memory of 4572	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	98
PID 3792 wrote to memory of 588	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	99
PID 3792 wrote to memory of 588	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	99
PID 3792 wrote to memory of 3784	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	100
PID 3792 wrote to memory of 3784	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	100
PID 3792 wrote to memory of 4200	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	101
PID 3792 wrote to memory of 4200	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	101
PID 3792 wrote to memory of 3284	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	102
PID 3792 wrote to memory of 3284	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	102
PID 3792 wrote to memory of 3932	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	103
PID 3792 wrote to memory of 3932	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	103
PID 3792 wrote to memory of 1460	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	104
PID 3792 wrote to memory of 1460	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	104
PID 3792 wrote to memory of 3516	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	105
PID 3792 wrote to memory of 3516	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	105
PID 3792 wrote to memory of 4960	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	106
PID 3792 wrote to memory of 4960	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	106
PID 3792 wrote to memory of 5080	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	107
PID 3792 wrote to memory of 5080	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	107
PID 3792 wrote to memory of 4692	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	109
PID 3792 wrote to memory of 4692	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	109
PID 3792 wrote to memory of 1788	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	110
PID 3792 wrote to memory of 1788	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	110
PID 3792 wrote to memory of 2652	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	111
PID 3792 wrote to memory of 2652	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	111
PID 3792 wrote to memory of 4972	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	112
PID 3792 wrote to memory of 4972	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	112
PID 3792 wrote to memory of 728	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	113
PID 3792 wrote to memory of 728	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	113
PID 3792 wrote to memory of 3200	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	114
PID 3792 wrote to memory of 3200	3792	6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\2626768563\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\2626768563\zmstage.exe
1⤵
PID:4700

C:\Users\Admin\AppData\Local\Temp\6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6d2afe0cfc031c3a9b675594d4d6ea50_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\System\ybrUKzY.exe
  C:\Windows\System\ybrUKzY.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\oMqrHJY.exe
  C:\Windows\System\oMqrHJY.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\GDURuQx.exe
  C:\Windows\System\GDURuQx.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\FEakgZd.exe
  C:\Windows\System\FEakgZd.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\AcRpdwZ.exe
  C:\Windows\System\AcRpdwZ.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\zDlDJKL.exe
  C:\Windows\System\zDlDJKL.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\EqsxcZx.exe
  C:\Windows\System\EqsxcZx.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\YCZDVSl.exe
  C:\Windows\System\YCZDVSl.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\lglIVhm.exe
  C:\Windows\System\lglIVhm.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\qhhivEI.exe
  C:\Windows\System\qhhivEI.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\KbNwaQR.exe
  C:\Windows\System\KbNwaQR.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\LVRlOLG.exe
  C:\Windows\System\LVRlOLG.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\LpEaAqC.exe
  C:\Windows\System\LpEaAqC.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\DjHCxDt.exe
  C:\Windows\System\DjHCxDt.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\Hwtcpza.exe
  C:\Windows\System\Hwtcpza.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\uZIifby.exe
  C:\Windows\System\uZIifby.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\tHTgJoh.exe
  C:\Windows\System\tHTgJoh.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\AiLoiKf.exe
  C:\Windows\System\AiLoiKf.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\KXUFlOs.exe
  C:\Windows\System\KXUFlOs.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\XjxOoSV.exe
  C:\Windows\System\XjxOoSV.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\dzUVHTf.exe
  C:\Windows\System\dzUVHTf.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\xSuiPIY.exe
  C:\Windows\System\xSuiPIY.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\iywSzeq.exe
  C:\Windows\System\iywSzeq.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\gXVKGgI.exe
  C:\Windows\System\gXVKGgI.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\EKpBFrV.exe
  C:\Windows\System\EKpBFrV.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\zsfjTdt.exe
  C:\Windows\System\zsfjTdt.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\jnkYwji.exe
  C:\Windows\System\jnkYwji.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\vXMAXPx.exe
  C:\Windows\System\vXMAXPx.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\KGCwZAb.exe
  C:\Windows\System\KGCwZAb.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\BQZjiLW.exe
  C:\Windows\System\BQZjiLW.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\GdBmSjM.exe
  C:\Windows\System\GdBmSjM.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\QtoITpT.exe
  C:\Windows\System\QtoITpT.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\MEPYeKF.exe
  C:\Windows\System\MEPYeKF.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\VArxmJd.exe
  C:\Windows\System\VArxmJd.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\xLZsUBG.exe
  C:\Windows\System\xLZsUBG.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\EniyMTu.exe
  C:\Windows\System\EniyMTu.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\IdUkfGE.exe
  C:\Windows\System\IdUkfGE.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\xtDeKar.exe
  C:\Windows\System\xtDeKar.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\UJyCAwo.exe
  C:\Windows\System\UJyCAwo.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\CYhIezr.exe
  C:\Windows\System\CYhIezr.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\loHqOYn.exe
  C:\Windows\System\loHqOYn.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\QWCVqzq.exe
  C:\Windows\System\QWCVqzq.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\XNRscSG.exe
  C:\Windows\System\XNRscSG.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\ZxIcTWW.exe
  C:\Windows\System\ZxIcTWW.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\YwkugMs.exe
  C:\Windows\System\YwkugMs.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\KNAtzJk.exe
  C:\Windows\System\KNAtzJk.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\oEpSUIw.exe
  C:\Windows\System\oEpSUIw.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\XBVExmb.exe
  C:\Windows\System\XBVExmb.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\zpzyQXM.exe
  C:\Windows\System\zpzyQXM.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\MCWkkci.exe
  C:\Windows\System\MCWkkci.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\NbUwjel.exe
  C:\Windows\System\NbUwjel.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\HZPWrMt.exe
  C:\Windows\System\HZPWrMt.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\AhxsyQx.exe
  C:\Windows\System\AhxsyQx.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\KNparzu.exe
  C:\Windows\System\KNparzu.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\XVfHKjg.exe
  C:\Windows\System\XVfHKjg.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\tEXwdbm.exe
  C:\Windows\System\tEXwdbm.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\KUHlAmS.exe
  C:\Windows\System\KUHlAmS.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\ypAsSeB.exe
  C:\Windows\System\ypAsSeB.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\awYirje.exe
  C:\Windows\System\awYirje.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\zJGuayl.exe
  C:\Windows\System\zJGuayl.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ylwukoA.exe
  C:\Windows\System\ylwukoA.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\cSjSnmE.exe
  C:\Windows\System\cSjSnmE.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\OWlhoXf.exe
  C:\Windows\System\OWlhoXf.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\DWdtXoP.exe
  C:\Windows\System\DWdtXoP.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\HVkEVBi.exe
  C:\Windows\System\HVkEVBi.exe
  2⤵
  PID:3804
- C:\Windows\System\IttILBw.exe
  C:\Windows\System\IttILBw.exe
  2⤵
  PID:376
- C:\Windows\System\HmIlYaa.exe
  C:\Windows\System\HmIlYaa.exe
  2⤵
  PID:1344
- C:\Windows\System\DxdfSsh.exe
  C:\Windows\System\DxdfSsh.exe
  2⤵
  PID:1360
- C:\Windows\System\fcgUhGV.exe
  C:\Windows\System\fcgUhGV.exe
  2⤵
  PID:836
- C:\Windows\System\zaPqiFk.exe
  C:\Windows\System\zaPqiFk.exe
  2⤵
  PID:3600
- C:\Windows\System\IPeulmn.exe
  C:\Windows\System\IPeulmn.exe
  2⤵
  PID:1432
- C:\Windows\System\tvhLymj.exe
  C:\Windows\System\tvhLymj.exe
  2⤵
  PID:3032
- C:\Windows\System\WQtSjcF.exe
  C:\Windows\System\WQtSjcF.exe
  2⤵
  PID:1936
- C:\Windows\System\BgkNfbe.exe
  C:\Windows\System\BgkNfbe.exe
  2⤵
  PID:3848
- C:\Windows\System\iZBIrXb.exe
  C:\Windows\System\iZBIrXb.exe
  2⤵
  PID:4644
- C:\Windows\System\ZfMLvAq.exe
  C:\Windows\System\ZfMLvAq.exe
  2⤵
  PID:3944
- C:\Windows\System\AjOXWnC.exe
  C:\Windows\System\AjOXWnC.exe
  2⤵
  PID:3388
- C:\Windows\System\Gfglcvd.exe
  C:\Windows\System\Gfglcvd.exe
  2⤵
  PID:1176
- C:\Windows\System\qKRNgfw.exe
  C:\Windows\System\qKRNgfw.exe
  2⤵
  PID:880
- C:\Windows\System\RijMtmU.exe
  C:\Windows\System\RijMtmU.exe
  2⤵
  PID:3316
- C:\Windows\System\fFDygvZ.exe
  C:\Windows\System\fFDygvZ.exe
  2⤵
  PID:5164
- C:\Windows\System\IcEXtsv.exe
  C:\Windows\System\IcEXtsv.exe
  2⤵
  PID:5212
- C:\Windows\System\kpreswH.exe
  C:\Windows\System\kpreswH.exe
  2⤵
  PID:5240
- C:\Windows\System\pDeAkEl.exe
  C:\Windows\System\pDeAkEl.exe
  2⤵
  PID:5268
- C:\Windows\System\nvUcwpK.exe
  C:\Windows\System\nvUcwpK.exe
  2⤵
  PID:5284
- C:\Windows\System\WNsFEIr.exe
  C:\Windows\System\WNsFEIr.exe
  2⤵
  PID:5316
- C:\Windows\System\FoaKFQE.exe
  C:\Windows\System\FoaKFQE.exe
  2⤵
  PID:5352
- C:\Windows\System\RgLIqGb.exe
  C:\Windows\System\RgLIqGb.exe
  2⤵
  PID:5380
- C:\Windows\System\PDGlRoH.exe
  C:\Windows\System\PDGlRoH.exe
  2⤵
  PID:5408
- C:\Windows\System\HAOhpHw.exe
  C:\Windows\System\HAOhpHw.exe
  2⤵
  PID:5436
- C:\Windows\System\geKfYdl.exe
  C:\Windows\System\geKfYdl.exe
  2⤵
  PID:5472
- C:\Windows\System\AWLdhGw.exe
  C:\Windows\System\AWLdhGw.exe
  2⤵
  PID:5504
- C:\Windows\System\vhejlCL.exe
  C:\Windows\System\vhejlCL.exe
  2⤵
  PID:5540
- C:\Windows\System\eaSASQG.exe
  C:\Windows\System\eaSASQG.exe
  2⤵
  PID:5556
- C:\Windows\System\KrwBIvP.exe
  C:\Windows\System\KrwBIvP.exe
  2⤵
  PID:5584
- C:\Windows\System\NGTXehN.exe
  C:\Windows\System\NGTXehN.exe
  2⤵
  PID:5612
- C:\Windows\System\JowxKUh.exe
  C:\Windows\System\JowxKUh.exe
  2⤵
  PID:5640
- C:\Windows\System\nJgsphM.exe
  C:\Windows\System\nJgsphM.exe
  2⤵
  PID:5676
- C:\Windows\System\QxDPqkd.exe
  C:\Windows\System\QxDPqkd.exe
  2⤵
  PID:5696
- C:\Windows\System\rHHaTlB.exe
  C:\Windows\System\rHHaTlB.exe
  2⤵
  PID:5724
- C:\Windows\System\rvLzfdo.exe
  C:\Windows\System\rvLzfdo.exe
  2⤵
  PID:5752
- C:\Windows\System\dLahUpq.exe
  C:\Windows\System\dLahUpq.exe
  2⤵
  PID:5788
- C:\Windows\System\XeDioWq.exe
  C:\Windows\System\XeDioWq.exe
  2⤵
  PID:5812
- C:\Windows\System\JIoeSwN.exe
  C:\Windows\System\JIoeSwN.exe
  2⤵
  PID:5836
- C:\Windows\System\MQqLoxS.exe
  C:\Windows\System\MQqLoxS.exe
  2⤵
  PID:5880
- C:\Windows\System\nyJfmYB.exe
  C:\Windows\System\nyJfmYB.exe
  2⤵
  PID:5912
- C:\Windows\System\DolsSEB.exe
  C:\Windows\System\DolsSEB.exe
  2⤵
  PID:5944
- C:\Windows\System\SHdhkBq.exe
  C:\Windows\System\SHdhkBq.exe
  2⤵
  PID:5976
- C:\Windows\System\nyIlwyL.exe
  C:\Windows\System\nyIlwyL.exe
  2⤵
  PID:6020
- C:\Windows\System\TOoaOKx.exe
  C:\Windows\System\TOoaOKx.exe
  2⤵
  PID:6044
- C:\Windows\System\nYZLADP.exe
  C:\Windows\System\nYZLADP.exe
  2⤵
  PID:6076
- C:\Windows\System\qUjmMru.exe
  C:\Windows\System\qUjmMru.exe
  2⤵
  PID:6108
- C:\Windows\System\JVoEIBC.exe
  C:\Windows\System\JVoEIBC.exe
  2⤵
  PID:6140
- C:\Windows\System\dwJhtNK.exe
  C:\Windows\System\dwJhtNK.exe
  2⤵
  PID:3056
- C:\Windows\System\RstSYMH.exe
  C:\Windows\System\RstSYMH.exe
  2⤵
  PID:5208
- C:\Windows\System\pGBNptD.exe
  C:\Windows\System\pGBNptD.exe
  2⤵
  PID:5276
- C:\Windows\System\OuAfBUh.exe
  C:\Windows\System\OuAfBUh.exe
  2⤵
  PID:5348
- C:\Windows\System\DrEvpjD.exe
  C:\Windows\System\DrEvpjD.exe
  2⤵
  PID:5404
- C:\Windows\System\MYRaDSR.exe
  C:\Windows\System\MYRaDSR.exe
  2⤵
  PID:5492
- C:\Windows\System\ApUlodE.exe
  C:\Windows\System\ApUlodE.exe
  2⤵
  PID:5548
- C:\Windows\System\bpLJPAc.exe
  C:\Windows\System\bpLJPAc.exe
  2⤵
  PID:5624
- C:\Windows\System\ObDmpGi.exe
  C:\Windows\System\ObDmpGi.exe
  2⤵
  PID:5684
- C:\Windows\System\CdvBIze.exe
  C:\Windows\System\CdvBIze.exe
  2⤵
  PID:5736
- C:\Windows\System\CcoJoGx.exe
  C:\Windows\System\CcoJoGx.exe
  2⤵
  PID:5804
- C:\Windows\System\xHuDivU.exe
  C:\Windows\System\xHuDivU.exe
  2⤵
  PID:5876
- C:\Windows\System\gAPKXxI.exe
  C:\Windows\System\gAPKXxI.exe
  2⤵
  PID:5952
- C:\Windows\System\vyZEgXg.exe
  C:\Windows\System\vyZEgXg.exe
  2⤵
  PID:6012
- C:\Windows\System\sVBQzlN.exe
  C:\Windows\System\sVBQzlN.exe
  2⤵
  PID:6092
- C:\Windows\System\UPrqfew.exe
  C:\Windows\System\UPrqfew.exe
  2⤵
  PID:5128
- C:\Windows\System\QxwNxGK.exe
  C:\Windows\System\QxwNxGK.exe
  2⤵
  PID:5236
- C:\Windows\System\voXtICQ.exe
  C:\Windows\System\voXtICQ.exe
  2⤵
  PID:5428
- C:\Windows\System\XHjkMVl.exe
  C:\Windows\System\XHjkMVl.exe
  2⤵
  PID:4448
- C:\Windows\System\FHiKCIu.exe
  C:\Windows\System\FHiKCIu.exe
  2⤵
  PID:5652
- C:\Windows\System\waAWOTJ.exe
  C:\Windows\System\waAWOTJ.exe
  2⤵
  PID:5772
- C:\Windows\System\Gsixcdq.exe
  C:\Windows\System\Gsixcdq.exe
  2⤵
  PID:5896
- C:\Windows\System\mbxURHw.exe
  C:\Windows\System\mbxURHw.exe
  2⤵
  PID:6064
- C:\Windows\System\sJHVJKI.exe
  C:\Windows\System\sJHVJKI.exe
  2⤵
  PID:5256
- C:\Windows\System\ItsDzvy.exe
  C:\Windows\System\ItsDzvy.exe
  2⤵
  PID:5596
- C:\Windows\System\edgUJUb.exe
  C:\Windows\System\edgUJUb.exe
  2⤵
  PID:5864
- C:\Windows\System\hZEGMUn.exe
  C:\Windows\System\hZEGMUn.exe
  2⤵
  PID:2304
- C:\Windows\System\xEjEhhQ.exe
  C:\Windows\System\xEjEhhQ.exe
  2⤵
  PID:8
- C:\Windows\System\KpXhHNy.exe
  C:\Windows\System\KpXhHNy.exe
  2⤵
  PID:6156
- C:\Windows\System\eAqrVZt.exe
  C:\Windows\System\eAqrVZt.exe
  2⤵
  PID:6176
- C:\Windows\System\GTStkeo.exe
  C:\Windows\System\GTStkeo.exe
  2⤵
  PID:6208
- C:\Windows\System\OnJlCJJ.exe
  C:\Windows\System\OnJlCJJ.exe
  2⤵
  PID:6232
- C:\Windows\System\vdNKtpu.exe
  C:\Windows\System\vdNKtpu.exe
  2⤵
  PID:6256
- C:\Windows\System\OhDiMzQ.exe
  C:\Windows\System\OhDiMzQ.exe
  2⤵
  PID:6280
- C:\Windows\System\gnNMTzh.exe
  C:\Windows\System\gnNMTzh.exe
  2⤵
  PID:6308
- C:\Windows\System\ICHYHrA.exe
  C:\Windows\System\ICHYHrA.exe
  2⤵
  PID:6344
- C:\Windows\System\UdwfnXy.exe
  C:\Windows\System\UdwfnXy.exe
  2⤵
  PID:6400
- C:\Windows\System\JzPLtpF.exe
  C:\Windows\System\JzPLtpF.exe
  2⤵
  PID:6424
- C:\Windows\System\xVWSHsM.exe
  C:\Windows\System\xVWSHsM.exe
  2⤵
  PID:6464
- C:\Windows\System\vFxHDDV.exe
  C:\Windows\System\vFxHDDV.exe
  2⤵
  PID:6492
- C:\Windows\System\nDBepFu.exe
  C:\Windows\System\nDBepFu.exe
  2⤵
  PID:6540
- C:\Windows\System\IYFBOXr.exe
  C:\Windows\System\IYFBOXr.exe
  2⤵
  PID:6576
- C:\Windows\System\GWJrnzL.exe
  C:\Windows\System\GWJrnzL.exe
  2⤵
  PID:6600
- C:\Windows\System\MbqBiNS.exe
  C:\Windows\System\MbqBiNS.exe
  2⤵
  PID:6632
- C:\Windows\System\dtmTpcC.exe
  C:\Windows\System\dtmTpcC.exe
  2⤵
  PID:6680
- C:\Windows\System\cptYqie.exe
  C:\Windows\System\cptYqie.exe
  2⤵
  PID:6700
- C:\Windows\System\JSbxLtk.exe
  C:\Windows\System\JSbxLtk.exe
  2⤵
  PID:6732
- C:\Windows\System\zwEAWcR.exe
  C:\Windows\System\zwEAWcR.exe
  2⤵
  PID:6772
- C:\Windows\System\TFVONix.exe
  C:\Windows\System\TFVONix.exe
  2⤵
  PID:6808
- C:\Windows\System\uystEse.exe
  C:\Windows\System\uystEse.exe
  2⤵
  PID:6836
- C:\Windows\System\EjuHyZL.exe
  C:\Windows\System\EjuHyZL.exe
  2⤵
  PID:6864
- C:\Windows\System\hDiNtaz.exe
  C:\Windows\System\hDiNtaz.exe
  2⤵
  PID:6900
- C:\Windows\System\GVMmuKB.exe
  C:\Windows\System\GVMmuKB.exe
  2⤵
  PID:6964
- C:\Windows\System\YcqbfHd.exe
  C:\Windows\System\YcqbfHd.exe
  2⤵
  PID:6984
- C:\Windows\System\IzOMshN.exe
  C:\Windows\System\IzOMshN.exe
  2⤵
  PID:7024
- C:\Windows\System\NJcNtEp.exe
  C:\Windows\System\NJcNtEp.exe
  2⤵
  PID:7044
- C:\Windows\System\hElJPqi.exe
  C:\Windows\System\hElJPqi.exe
  2⤵
  PID:7068
- C:\Windows\System\aCoDley.exe
  C:\Windows\System\aCoDley.exe
  2⤵
  PID:7100
- C:\Windows\System\YqFXxOT.exe
  C:\Windows\System\YqFXxOT.exe
  2⤵
  PID:7140
- C:\Windows\System\ZyIQGox.exe
  C:\Windows\System\ZyIQGox.exe
  2⤵
  PID:7164
- C:\Windows\System\WQStQBm.exe
  C:\Windows\System\WQStQBm.exe
  2⤵
  PID:6188
- C:\Windows\System\gNHavFO.exe
  C:\Windows\System\gNHavFO.exe
  2⤵
  PID:6264
- C:\Windows\System\TqCDrZj.exe
  C:\Windows\System\TqCDrZj.exe
  2⤵
  PID:6352
- C:\Windows\System\BCrJQCI.exe
  C:\Windows\System\BCrJQCI.exe
  2⤵
  PID:6444
- C:\Windows\System\xMcdMTf.exe
  C:\Windows\System\xMcdMTf.exe
  2⤵
  PID:6524
- C:\Windows\System\ZMvELrv.exe
  C:\Windows\System\ZMvELrv.exe
  2⤵
  PID:6584
- C:\Windows\System\BRJKCse.exe
  C:\Windows\System\BRJKCse.exe
  2⤵
  PID:6664
- C:\Windows\System\zroysEH.exe
  C:\Windows\System\zroysEH.exe
  2⤵
  PID:6752
- C:\Windows\System\KRFZyxA.exe
  C:\Windows\System\KRFZyxA.exe
  2⤵
  PID:6832
- C:\Windows\System\HPkKDtz.exe
  C:\Windows\System\HPkKDtz.exe
  2⤵
  PID:6928
- C:\Windows\System\CAgJgjM.exe
  C:\Windows\System\CAgJgjM.exe
  2⤵
  PID:7040
- C:\Windows\System\mDFippe.exe
  C:\Windows\System\mDFippe.exe
  2⤵
  PID:7128
- C:\Windows\System\dXWnFCU.exe
  C:\Windows\System\dXWnFCU.exe
  2⤵
  PID:6204
- C:\Windows\System\uIqLOwo.exe
  C:\Windows\System\uIqLOwo.exe
  2⤵
  PID:6392
- C:\Windows\System\nLEiRhs.exe
  C:\Windows\System\nLEiRhs.exe
  2⤵
  PID:2740
- C:\Windows\System\voUrGWe.exe
  C:\Windows\System\voUrGWe.exe
  2⤵
  PID:6648
- C:\Windows\System\hzKstmA.exe
  C:\Windows\System\hzKstmA.exe
  2⤵
  PID:6876
- C:\Windows\System\tHHNmZW.exe
  C:\Windows\System\tHHNmZW.exe
  2⤵
  PID:7108
- C:\Windows\System\gWBagTi.exe
  C:\Windows\System\gWBagTi.exe
  2⤵
  PID:6248
- C:\Windows\System\LJYaYRf.exe
  C:\Windows\System\LJYaYRf.exe
  2⤵
  PID:6820
- C:\Windows\System\OUvpMDm.exe
  C:\Windows\System\OUvpMDm.exe
  2⤵
  PID:7064
- C:\Windows\System\LYeVlKt.exe
  C:\Windows\System\LYeVlKt.exe
  2⤵
  PID:4820
- C:\Windows\System\gWTSYNp.exe
  C:\Windows\System\gWTSYNp.exe
  2⤵
  PID:7172
- C:\Windows\System\rFBQdne.exe
  C:\Windows\System\rFBQdne.exe
  2⤵
  PID:7212
- C:\Windows\System\BWHrwUi.exe
  C:\Windows\System\BWHrwUi.exe
  2⤵
  PID:7232
- C:\Windows\System\leMNrLw.exe
  C:\Windows\System\leMNrLw.exe
  2⤵
  PID:7260
- C:\Windows\System\qtuHdBf.exe
  C:\Windows\System\qtuHdBf.exe
  2⤵
  PID:7288
- C:\Windows\System\HqkrieD.exe
  C:\Windows\System\HqkrieD.exe
  2⤵
  PID:7316
- C:\Windows\System\epEJZrU.exe
  C:\Windows\System\epEJZrU.exe
  2⤵
  PID:7344
- C:\Windows\System\EkEXAIZ.exe
  C:\Windows\System\EkEXAIZ.exe
  2⤵
  PID:7376
- C:\Windows\System\qgfsXur.exe
  C:\Windows\System\qgfsXur.exe
  2⤵
  PID:7404
- C:\Windows\System\kMewcYZ.exe
  C:\Windows\System\kMewcYZ.exe
  2⤵
  PID:7432
- C:\Windows\System\rjQrIav.exe
  C:\Windows\System\rjQrIav.exe
  2⤵
  PID:7460
- C:\Windows\System\YnNDaDy.exe
  C:\Windows\System\YnNDaDy.exe
  2⤵
  PID:7496
- C:\Windows\System\nSJepWm.exe
  C:\Windows\System\nSJepWm.exe
  2⤵
  PID:7516
- C:\Windows\System\GtOnWtC.exe
  C:\Windows\System\GtOnWtC.exe
  2⤵
  PID:7544
- C:\Windows\System\pkuYWQe.exe
  C:\Windows\System\pkuYWQe.exe
  2⤵
  PID:7572
- C:\Windows\System\sgqGtOj.exe
  C:\Windows\System\sgqGtOj.exe
  2⤵
  PID:7600
- C:\Windows\System\McmGNOp.exe
  C:\Windows\System\McmGNOp.exe
  2⤵
  PID:7628
- C:\Windows\System\ZYHPzKL.exe
  C:\Windows\System\ZYHPzKL.exe
  2⤵
  PID:7656
- C:\Windows\System\LuXqiAJ.exe
  C:\Windows\System\LuXqiAJ.exe
  2⤵
  PID:7692
- C:\Windows\System\iCJahZD.exe
  C:\Windows\System\iCJahZD.exe
  2⤵
  PID:7712
- C:\Windows\System\doggJqz.exe
  C:\Windows\System\doggJqz.exe
  2⤵
  PID:7736
- C:\Windows\System\MMGTgOX.exe
  C:\Windows\System\MMGTgOX.exe
  2⤵
  PID:7768
- C:\Windows\System\NxnTCrd.exe
  C:\Windows\System\NxnTCrd.exe
  2⤵
  PID:7796
- C:\Windows\System\sAgHwKv.exe
  C:\Windows\System\sAgHwKv.exe
  2⤵
  PID:7832
- C:\Windows\System\FiYGjrP.exe
  C:\Windows\System\FiYGjrP.exe
  2⤵
  PID:7852
- C:\Windows\System\XbqHMBL.exe
  C:\Windows\System\XbqHMBL.exe
  2⤵
  PID:7880
- C:\Windows\System\oALYHiu.exe
  C:\Windows\System\oALYHiu.exe
  2⤵
  PID:7908
- C:\Windows\System\iEMiigW.exe
  C:\Windows\System\iEMiigW.exe
  2⤵
  PID:7936
- C:\Windows\System\xYXvtla.exe
  C:\Windows\System\xYXvtla.exe
  2⤵
  PID:7964
- C:\Windows\System\OBSxQmy.exe
  C:\Windows\System\OBSxQmy.exe
  2⤵
  PID:7992
- C:\Windows\System\DfaMjQQ.exe
  C:\Windows\System\DfaMjQQ.exe
  2⤵
  PID:8020
- C:\Windows\System\Xyejvoq.exe
  C:\Windows\System\Xyejvoq.exe
  2⤵
  PID:8048
- C:\Windows\System\BQGqZIp.exe
  C:\Windows\System\BQGqZIp.exe
  2⤵
  PID:8076
- C:\Windows\System\WKhrYLQ.exe
  C:\Windows\System\WKhrYLQ.exe
  2⤵
  PID:8104
- C:\Windows\System\hLctqGk.exe
  C:\Windows\System\hLctqGk.exe
  2⤵
  PID:8132
- C:\Windows\System\xzPTVyc.exe
  C:\Windows\System\xzPTVyc.exe
  2⤵
  PID:8160
- C:\Windows\System\BVZSKfm.exe
  C:\Windows\System\BVZSKfm.exe
  2⤵
  PID:8188
- C:\Windows\System\PLntCKY.exe
  C:\Windows\System\PLntCKY.exe
  2⤵
  PID:7224
- C:\Windows\System\HCpXFdl.exe
  C:\Windows\System\HCpXFdl.exe
  2⤵
  PID:7284
- C:\Windows\System\sSsewuR.exe
  C:\Windows\System\sSsewuR.exe
  2⤵
  PID:7356
- C:\Windows\System\vBnfQKb.exe
  C:\Windows\System\vBnfQKb.exe
  2⤵
  PID:7424
- C:\Windows\System\ahIqQLc.exe
  C:\Windows\System\ahIqQLc.exe
  2⤵
  PID:7480
- C:\Windows\System\WOiWBXf.exe
  C:\Windows\System\WOiWBXf.exe
  2⤵
  PID:7540
- C:\Windows\System\qasvhON.exe
  C:\Windows\System\qasvhON.exe
  2⤵
  PID:7596
- C:\Windows\System\zeNYosC.exe
  C:\Windows\System\zeNYosC.exe
  2⤵
  PID:7668
- C:\Windows\System\FnFnqlD.exe
  C:\Windows\System\FnFnqlD.exe
  2⤵
  PID:7724
- C:\Windows\System\RDnxrez.exe
  C:\Windows\System\RDnxrez.exe
  2⤵
  PID:7792
- C:\Windows\System\zKtKrKp.exe
  C:\Windows\System\zKtKrKp.exe
  2⤵
  PID:7864
- C:\Windows\System\WsDwGto.exe
  C:\Windows\System\WsDwGto.exe
  2⤵
  PID:7928
- C:\Windows\System\aZwJgCk.exe
  C:\Windows\System\aZwJgCk.exe
  2⤵
  PID:7988
- C:\Windows\System\yXRJnGi.exe
  C:\Windows\System\yXRJnGi.exe
  2⤵
  PID:8060
- C:\Windows\System\HGGHGKV.exe
  C:\Windows\System\HGGHGKV.exe
  2⤵
  PID:8124
- C:\Windows\System\jvhARuO.exe
  C:\Windows\System\jvhARuO.exe
  2⤵
  PID:4624
- C:\Windows\System\CCpIiNo.exe
  C:\Windows\System\CCpIiNo.exe
  2⤵
  PID:7280
- C:\Windows\System\nipXjbZ.exe
  C:\Windows\System\nipXjbZ.exe
  2⤵
  PID:7392
- C:\Windows\System\tmsVJtZ.exe
  C:\Windows\System\tmsVJtZ.exe
  2⤵
  PID:7528
- C:\Windows\System\ZAnUFCI.exe
  C:\Windows\System\ZAnUFCI.exe
  2⤵
  PID:7708
- C:\Windows\System\QPLrDOG.exe
  C:\Windows\System\QPLrDOG.exe
  2⤵
  PID:7848
- C:\Windows\System\jLnHrOI.exe
  C:\Windows\System\jLnHrOI.exe
  2⤵
  PID:7984
- C:\Windows\System\QVnXYKv.exe
  C:\Windows\System\QVnXYKv.exe
  2⤵
  PID:8144
- C:\Windows\System\gGVMGeV.exe
  C:\Windows\System\gGVMGeV.exe
  2⤵
  PID:7452
- C:\Windows\System\DsXAInt.exe
  C:\Windows\System\DsXAInt.exe
  2⤵
  PID:7644
- C:\Windows\System\bNuNTVZ.exe
  C:\Windows\System\bNuNTVZ.exe
  2⤵
  PID:8044
- C:\Windows\System\pfKRvOT.exe
  C:\Windows\System\pfKRvOT.exe
  2⤵
  PID:2964
- C:\Windows\System\KJpaoLG.exe
  C:\Windows\System\KJpaoLG.exe
  2⤵
  PID:7536
- C:\Windows\System\IeUGAyU.exe
  C:\Windows\System\IeUGAyU.exe
  2⤵
  PID:8208
- C:\Windows\System\gHbquIQ.exe
  C:\Windows\System\gHbquIQ.exe
  2⤵
  PID:8236
- C:\Windows\System\ddcMprL.exe
  C:\Windows\System\ddcMprL.exe
  2⤵
  PID:8268
- C:\Windows\System\pKnLijU.exe
  C:\Windows\System\pKnLijU.exe
  2⤵
  PID:8292
- C:\Windows\System\nQOWdJX.exe
  C:\Windows\System\nQOWdJX.exe
  2⤵
  PID:8324
- C:\Windows\System\LvMHcQc.exe
  C:\Windows\System\LvMHcQc.exe
  2⤵
  PID:8348
- C:\Windows\System\SKkNlKB.exe
  C:\Windows\System\SKkNlKB.exe
  2⤵
  PID:8376
- C:\Windows\System\AswXybw.exe
  C:\Windows\System\AswXybw.exe
  2⤵
  PID:8404
- C:\Windows\System\feMYeXH.exe
  C:\Windows\System\feMYeXH.exe
  2⤵
  PID:8424
- C:\Windows\System\JynDByJ.exe
  C:\Windows\System\JynDByJ.exe
  2⤵
  PID:8464
- C:\Windows\System\CLXFhGE.exe
  C:\Windows\System\CLXFhGE.exe
  2⤵
  PID:8496
- C:\Windows\System\XfIrWvP.exe
  C:\Windows\System\XfIrWvP.exe
  2⤵
  PID:8524
- C:\Windows\System\fBIWqHq.exe
  C:\Windows\System\fBIWqHq.exe
  2⤵
  PID:8572
- C:\Windows\System\WyzhkSl.exe
  C:\Windows\System\WyzhkSl.exe
  2⤵
  PID:8588
- C:\Windows\System\wKuRPps.exe
  C:\Windows\System\wKuRPps.exe
  2⤵
  PID:8616
- C:\Windows\System\Otddzja.exe
  C:\Windows\System\Otddzja.exe
  2⤵
  PID:8644
- C:\Windows\System\sgzZwqF.exe
  C:\Windows\System\sgzZwqF.exe
  2⤵
  PID:8672
- C:\Windows\System\fXbCwgJ.exe
  C:\Windows\System\fXbCwgJ.exe
  2⤵
  PID:8708
- C:\Windows\System\QKiGYLR.exe
  C:\Windows\System\QKiGYLR.exe
  2⤵
  PID:8748
- C:\Windows\System\oZXpVOh.exe
  C:\Windows\System\oZXpVOh.exe
  2⤵
  PID:8788
- C:\Windows\System\fbpYtax.exe
  C:\Windows\System\fbpYtax.exe
  2⤵
  PID:8820
- C:\Windows\System\DdSEIOn.exe
  C:\Windows\System\DdSEIOn.exe
  2⤵
  PID:8848
- C:\Windows\System\OovpQVg.exe
  C:\Windows\System\OovpQVg.exe
  2⤵
  PID:8880
- C:\Windows\System\VWNQLSL.exe
  C:\Windows\System\VWNQLSL.exe
  2⤵
  PID:8912
- C:\Windows\System\GNyxQie.exe
  C:\Windows\System\GNyxQie.exe
  2⤵
  PID:8932
- C:\Windows\System\NAHOhES.exe
  C:\Windows\System\NAHOhES.exe
  2⤵
  PID:8960
- C:\Windows\System\mkxxdcZ.exe
  C:\Windows\System\mkxxdcZ.exe
  2⤵
  PID:8988
- C:\Windows\System\sGvtXTe.exe
  C:\Windows\System\sGvtXTe.exe
  2⤵
  PID:9016
- C:\Windows\System\DzGfikK.exe
  C:\Windows\System\DzGfikK.exe
  2⤵
  PID:9044
- C:\Windows\System\qsLqFiV.exe
  C:\Windows\System\qsLqFiV.exe
  2⤵
  PID:9072
- C:\Windows\System\PAMIkpg.exe
  C:\Windows\System\PAMIkpg.exe
  2⤵
  PID:9104
- C:\Windows\System\QddPaio.exe
  C:\Windows\System\QddPaio.exe
  2⤵
  PID:9132
- C:\Windows\System\zIQIVtL.exe
  C:\Windows\System\zIQIVtL.exe
  2⤵
  PID:9156
- C:\Windows\System\MCasqJQ.exe
  C:\Windows\System\MCasqJQ.exe
  2⤵
  PID:9184
- C:\Windows\System\DuKUngi.exe
  C:\Windows\System\DuKUngi.exe
  2⤵
  PID:8200
- C:\Windows\System\xdjXyaa.exe
  C:\Windows\System\xdjXyaa.exe
  2⤵
  PID:8256
- C:\Windows\System\NVlbJub.exe
  C:\Windows\System\NVlbJub.exe
  2⤵
  PID:8312
- C:\Windows\System\nBVYpgz.exe
  C:\Windows\System\nBVYpgz.exe
  2⤵
  PID:8388
- C:\Windows\System\tZUlFFj.exe
  C:\Windows\System\tZUlFFj.exe
  2⤵
  PID:8448
- C:\Windows\System\gdORCwA.exe
  C:\Windows\System\gdORCwA.exe
  2⤵
  PID:8520
- C:\Windows\System\DKojgDO.exe
  C:\Windows\System\DKojgDO.exe
  2⤵
  PID:8604
- C:\Windows\System\mRcRhQQ.exe
  C:\Windows\System\mRcRhQQ.exe
  2⤵
  PID:8664
- C:\Windows\System\EMfiCtl.exe
  C:\Windows\System\EMfiCtl.exe
  2⤵
  PID:8732
- C:\Windows\System\fdMgqIQ.exe
  C:\Windows\System\fdMgqIQ.exe
  2⤵
  PID:8816
- C:\Windows\System\jMwvPfN.exe
  C:\Windows\System\jMwvPfN.exe
  2⤵
  PID:8888
- C:\Windows\System\AAvpgVt.exe
  C:\Windows\System\AAvpgVt.exe
  2⤵
  PID:8956
- C:\Windows\System\NHCrXvN.exe
  C:\Windows\System\NHCrXvN.exe
  2⤵
  PID:9008
- C:\Windows\System\QfgNNqP.exe
  C:\Windows\System\QfgNNqP.exe
  2⤵
  PID:9068
- C:\Windows\System\dvkvqoS.exe
  C:\Windows\System\dvkvqoS.exe
  2⤵
  PID:9140
- C:\Windows\System\CHeualP.exe
  C:\Windows\System\CHeualP.exe
  2⤵
  PID:9204
- C:\Windows\System\LTpfJFi.exe
  C:\Windows\System\LTpfJFi.exe
  2⤵
  PID:8280
- C:\Windows\System\rYSTGGr.exe
  C:\Windows\System\rYSTGGr.exe
  2⤵
  PID:8488
- C:\Windows\System\jKDMeLa.exe
  C:\Windows\System\jKDMeLa.exe
  2⤵
  PID:8640
- C:\Windows\System\ZvsIydo.exe
  C:\Windows\System\ZvsIydo.exe
  2⤵
  PID:8812
- C:\Windows\System\TGMWdDY.exe
  C:\Windows\System\TGMWdDY.exe
  2⤵
  PID:8928
- C:\Windows\System\zFDAsCY.exe
  C:\Windows\System\zFDAsCY.exe
  2⤵
  PID:9096
- C:\Windows\System\sZdyAXc.exe
  C:\Windows\System\sZdyAXc.exe
  2⤵
  PID:8284
- C:\Windows\System\GTdwMYt.exe
  C:\Windows\System\GTdwMYt.exe
  2⤵
  PID:8564
- C:\Windows\System\UjxXBit.exe
  C:\Windows\System\UjxXBit.exe
  2⤵
  PID:8900
- C:\Windows\System\iglFBWG.exe
  C:\Windows\System\iglFBWG.exe
  2⤵
  PID:1548
- C:\Windows\System\LcsrbQw.exe
  C:\Windows\System\LcsrbQw.exe
  2⤵
  PID:8232
- C:\Windows\System\YSeAwnZ.exe
  C:\Windows\System\YSeAwnZ.exe
  2⤵
  PID:9228
- C:\Windows\System\bIaUeYE.exe
  C:\Windows\System\bIaUeYE.exe
  2⤵
  PID:9256
- C:\Windows\System\NpZQLIy.exe
  C:\Windows\System\NpZQLIy.exe
  2⤵
  PID:9284
- C:\Windows\System\LNrfdXZ.exe
  C:\Windows\System\LNrfdXZ.exe
  2⤵
  PID:9312
- C:\Windows\System\AlGPAeJ.exe
  C:\Windows\System\AlGPAeJ.exe
  2⤵
  PID:9348
- C:\Windows\System\mVqLGrO.exe
  C:\Windows\System\mVqLGrO.exe
  2⤵
  PID:9368
- C:\Windows\System\zFbycSP.exe
  C:\Windows\System\zFbycSP.exe
  2⤵
  PID:9396
- C:\Windows\System\tLPecvi.exe
  C:\Windows\System\tLPecvi.exe
  2⤵
  PID:9424
- C:\Windows\System\TAokQaG.exe
  C:\Windows\System\TAokQaG.exe
  2⤵
  PID:9452
- C:\Windows\System\HiUUSUf.exe
  C:\Windows\System\HiUUSUf.exe
  2⤵
  PID:9480
- C:\Windows\System\LQXvAnx.exe
  C:\Windows\System\LQXvAnx.exe
  2⤵
  PID:9508
- C:\Windows\System\JrOzYDQ.exe
  C:\Windows\System\JrOzYDQ.exe
  2⤵
  PID:9536
- C:\Windows\System\BFFANka.exe
  C:\Windows\System\BFFANka.exe
  2⤵
  PID:9564
- C:\Windows\System\Fnvcgod.exe
  C:\Windows\System\Fnvcgod.exe
  2⤵
  PID:9592
- C:\Windows\System\SjzjJtt.exe
  C:\Windows\System\SjzjJtt.exe
  2⤵
  PID:9620
- C:\Windows\System\xVNStpL.exe
  C:\Windows\System\xVNStpL.exe
  2⤵
  PID:9652
- C:\Windows\System\yLZvDuy.exe
  C:\Windows\System\yLZvDuy.exe
  2⤵
  PID:9676
- C:\Windows\System\viSoHGo.exe
  C:\Windows\System\viSoHGo.exe
  2⤵
  PID:9704
- C:\Windows\System\kHDSrWK.exe
  C:\Windows\System\kHDSrWK.exe
  2⤵
  PID:9732
- C:\Windows\System\HTrPKGc.exe
  C:\Windows\System\HTrPKGc.exe
  2⤵
  PID:9760
- C:\Windows\System\MUlkRrs.exe
  C:\Windows\System\MUlkRrs.exe
  2⤵
  PID:9796
- C:\Windows\System\kXVJOIy.exe
  C:\Windows\System\kXVJOIy.exe
  2⤵
  PID:9816
- C:\Windows\System\ZSiKlGI.exe
  C:\Windows\System\ZSiKlGI.exe
  2⤵
  PID:9848
- C:\Windows\System\ybSzhGr.exe
  C:\Windows\System\ybSzhGr.exe
  2⤵
  PID:9876
- C:\Windows\System\kMqsvib.exe
  C:\Windows\System\kMqsvib.exe
  2⤵
  PID:9900
- C:\Windows\System\YBOuhqA.exe
  C:\Windows\System\YBOuhqA.exe
  2⤵
  PID:9928
- C:\Windows\System\fEJXGrz.exe
  C:\Windows\System\fEJXGrz.exe
  2⤵
  PID:9956
- C:\Windows\System\EPDbYHn.exe
  C:\Windows\System\EPDbYHn.exe
  2⤵
  PID:9988
- C:\Windows\System\uIlJJTL.exe
  C:\Windows\System\uIlJJTL.exe
  2⤵
  PID:10012
- C:\Windows\System\KwQdUHJ.exe
  C:\Windows\System\KwQdUHJ.exe
  2⤵
  PID:10040
- C:\Windows\System\WhTiHoM.exe
  C:\Windows\System\WhTiHoM.exe
  2⤵
  PID:10068
- C:\Windows\System\EtkvDwb.exe
  C:\Windows\System\EtkvDwb.exe
  2⤵
  PID:10096
- C:\Windows\System\ITBrBYg.exe
  C:\Windows\System\ITBrBYg.exe
  2⤵
  PID:10128
- C:\Windows\System\qRxVBvU.exe
  C:\Windows\System\qRxVBvU.exe
  2⤵
  PID:10156
- C:\Windows\System\AQqFKuO.exe
  C:\Windows\System\AQqFKuO.exe
  2⤵
  PID:10188
- C:\Windows\System\qRHRuTQ.exe
  C:\Windows\System\qRHRuTQ.exe
  2⤵
  PID:10212
- C:\Windows\System\NKKOYmj.exe
  C:\Windows\System\NKKOYmj.exe
  2⤵
  PID:1616
- C:\Windows\System\HJbWIkx.exe
  C:\Windows\System\HJbWIkx.exe
  2⤵
  PID:9276
- C:\Windows\System\dcmMfVY.exe
  C:\Windows\System\dcmMfVY.exe
  2⤵
  PID:9336
- C:\Windows\System\lsNSHFD.exe
  C:\Windows\System\lsNSHFD.exe
  2⤵
  PID:9408
- C:\Windows\System\XYJllEq.exe
  C:\Windows\System\XYJllEq.exe
  2⤵
  PID:9440
- C:\Windows\System\GWgjzOG.exe
  C:\Windows\System\GWgjzOG.exe
  2⤵
  PID:9476
- C:\Windows\System\axdsUFh.exe
  C:\Windows\System\axdsUFh.exe
  2⤵
  PID:9520
- C:\Windows\System\aOZMBnp.exe
  C:\Windows\System\aOZMBnp.exe
  2⤵
  PID:9556
- C:\Windows\System\wNFlQUu.exe
  C:\Windows\System\wNFlQUu.exe
  2⤵
  PID:9588
- C:\Windows\System\cLvGOGh.exe
  C:\Windows\System\cLvGOGh.exe
  2⤵
  PID:9640
- C:\Windows\System\eiXcyAP.exe
  C:\Windows\System\eiXcyAP.exe
  2⤵
  PID:9688
- C:\Windows\System\KuyEccE.exe
  C:\Windows\System\KuyEccE.exe
  2⤵
  PID:9724
- C:\Windows\System\yAyUCxd.exe
  C:\Windows\System\yAyUCxd.exe
  2⤵
  PID:9808
- C:\Windows\System\SGYoZvk.exe
  C:\Windows\System\SGYoZvk.exe
  2⤵
  PID:9896
- C:\Windows\System\rAqOzxt.exe
  C:\Windows\System\rAqOzxt.exe
  2⤵
  PID:3192
- C:\Windows\System\EfgZUSv.exe
  C:\Windows\System\EfgZUSv.exe
  2⤵
  PID:10052
- C:\Windows\System\gDpNNfh.exe
  C:\Windows\System\gDpNNfh.exe
  2⤵
  PID:10124
- C:\Windows\System\tgDIefM.exe
  C:\Windows\System\tgDIefM.exe
  2⤵
  PID:10176
- C:\Windows\System\Cnvmiqp.exe
  C:\Windows\System\Cnvmiqp.exe
  2⤵
  PID:9304
- C:\Windows\System\tOniVXF.exe
  C:\Windows\System\tOniVXF.exe
  2⤵
  PID:3324
- C:\Windows\System\NbvMFHd.exe
  C:\Windows\System\NbvMFHd.exe
  2⤵
  PID:9632
- C:\Windows\System\QRbYSGp.exe
  C:\Windows\System\QRbYSGp.exe
  2⤵
  PID:9828
- C:\Windows\System\LDWCTFI.exe
  C:\Windows\System\LDWCTFI.exe
  2⤵
  PID:9948
- C:\Windows\System\IqTSzpE.exe
  C:\Windows\System\IqTSzpE.exe
  2⤵
  PID:10108
- C:\Windows\System\yEyeYJl.exe
  C:\Windows\System\yEyeYJl.exe
  2⤵
  PID:10208
- C:\Windows\System\tFewpki.exe
  C:\Windows\System\tFewpki.exe
  2⤵
  PID:9500
- C:\Windows\System\jZpKyaN.exe
  C:\Windows\System\jZpKyaN.exe
  2⤵
  PID:9716
- C:\Windows\System\JYLfxDb.exe
  C:\Windows\System\JYLfxDb.exe
  2⤵
  PID:10088
- C:\Windows\System\fchbPCf.exe
  C:\Windows\System\fchbPCf.exe
  2⤵
  PID:9584
- C:\Windows\System\gZCHOur.exe
  C:\Windows\System\gZCHOur.exe
  2⤵
  PID:10008
- C:\Windows\System\ONXXRUr.exe
  C:\Windows\System\ONXXRUr.exe
  2⤵
  PID:10256
- C:\Windows\System\qnuovzP.exe
  C:\Windows\System\qnuovzP.exe
  2⤵
  PID:10284
- C:\Windows\System\hHbtUin.exe
  C:\Windows\System\hHbtUin.exe
  2⤵
  PID:10312
- C:\Windows\System\ERChjIx.exe
  C:\Windows\System\ERChjIx.exe
  2⤵
  PID:10340
- C:\Windows\System\goElwpk.exe
  C:\Windows\System\goElwpk.exe
  2⤵
  PID:10360
- C:\Windows\System\XaKgWrZ.exe
  C:\Windows\System\XaKgWrZ.exe
  2⤵
  PID:10380
- C:\Windows\System\eYYVJMf.exe
  C:\Windows\System\eYYVJMf.exe
  2⤵
  PID:10400
- C:\Windows\System\aFEWNrg.exe
  C:\Windows\System\aFEWNrg.exe
  2⤵
  PID:10428
- C:\Windows\System\HxINpRO.exe
  C:\Windows\System\HxINpRO.exe
  2⤵
  PID:10452
- C:\Windows\System\mStOPQX.exe
  C:\Windows\System\mStOPQX.exe
  2⤵
  PID:10484
- C:\Windows\System\xhYrAAf.exe
  C:\Windows\System\xhYrAAf.exe
  2⤵
  PID:10520
- C:\Windows\System\uUJdylD.exe
  C:\Windows\System\uUJdylD.exe
  2⤵
  PID:10552
- C:\Windows\System\lSCLBjK.exe
  C:\Windows\System\lSCLBjK.exe
  2⤵
  PID:10580
- C:\Windows\System\gRcAQBI.exe
  C:\Windows\System\gRcAQBI.exe
  2⤵
  PID:10608
- C:\Windows\System\qqyIYWZ.exe
  C:\Windows\System\qqyIYWZ.exe
  2⤵
  PID:10648
- C:\Windows\System\Oturjnp.exe
  C:\Windows\System\Oturjnp.exe
  2⤵
  PID:10676
- C:\Windows\System\AmnZrpf.exe
  C:\Windows\System\AmnZrpf.exe
  2⤵
  PID:10704
- C:\Windows\System\IwIhprK.exe
  C:\Windows\System\IwIhprK.exe
  2⤵
  PID:10732
- C:\Windows\System\ezqYNUc.exe
  C:\Windows\System\ezqYNUc.exe
  2⤵
  PID:10760
- C:\Windows\System\IsSVvjA.exe
  C:\Windows\System\IsSVvjA.exe
  2⤵
  PID:10788
- C:\Windows\System\uAdXPSq.exe
  C:\Windows\System\uAdXPSq.exe
  2⤵
  PID:10816
- C:\Windows\System\rLFonAi.exe
  C:\Windows\System\rLFonAi.exe
  2⤵
  PID:10844
- C:\Windows\System\QlVzkfF.exe
  C:\Windows\System\QlVzkfF.exe
  2⤵
  PID:10872
- C:\Windows\System\oShPqbC.exe
  C:\Windows\System\oShPqbC.exe
  2⤵
  PID:10900
- C:\Windows\System\hKazzPb.exe
  C:\Windows\System\hKazzPb.exe
  2⤵
  PID:10928
- C:\Windows\System\UjrDWtf.exe
  C:\Windows\System\UjrDWtf.exe
  2⤵
  PID:10956
- C:\Windows\System\hdBfRaf.exe
  C:\Windows\System\hdBfRaf.exe
  2⤵
  PID:10984
- C:\Windows\System\AZuwtlx.exe
  C:\Windows\System\AZuwtlx.exe
  2⤵
  PID:11012
- C:\Windows\System\zgfnsLM.exe
  C:\Windows\System\zgfnsLM.exe
  2⤵
  PID:11040
- C:\Windows\System\DbRYPmP.exe
  C:\Windows\System\DbRYPmP.exe
  2⤵
  PID:11068
- C:\Windows\System\ltGwykq.exe
  C:\Windows\System\ltGwykq.exe
  2⤵
  PID:11096
- C:\Windows\System\UQTWoVO.exe
  C:\Windows\System\UQTWoVO.exe
  2⤵
  PID:11124
- C:\Windows\System\USexedt.exe
  C:\Windows\System\USexedt.exe
  2⤵
  PID:11152
- C:\Windows\System\cQWuRSo.exe
  C:\Windows\System\cQWuRSo.exe
  2⤵
  PID:11180
- C:\Windows\System\mLYpCGL.exe
  C:\Windows\System\mLYpCGL.exe
  2⤵
  PID:11204
- C:\Windows\System\wWvXDfw.exe
  C:\Windows\System\wWvXDfw.exe
  2⤵
  PID:11236
- C:\Windows\System\jVhQAox.exe
  C:\Windows\System\jVhQAox.exe
  2⤵
  PID:9436
- C:\Windows\System\OIOXVLe.exe
  C:\Windows\System\OIOXVLe.exe
  2⤵
  PID:10296
- C:\Windows\System\iFRqHlY.exe
  C:\Windows\System\iFRqHlY.exe
  2⤵
  PID:10352
- C:\Windows\System\FqhRnTs.exe
  C:\Windows\System\FqhRnTs.exe
  2⤵
  PID:10412
- C:\Windows\System\QKtRUoi.exe
  C:\Windows\System\QKtRUoi.exe
  2⤵
  PID:10476
- C:\Windows\System\xddtPkv.exe
  C:\Windows\System\xddtPkv.exe
  2⤵
  PID:10564
- C:\Windows\System\IBTOvmz.exe
  C:\Windows\System\IBTOvmz.exe
  2⤵
  PID:10596
- C:\Windows\System\VOCLyaV.exe
  C:\Windows\System\VOCLyaV.exe
  2⤵
  PID:10696
- C:\Windows\System\baasiMJ.exe
  C:\Windows\System\baasiMJ.exe
  2⤵
  PID:10752
- C:\Windows\System\NRmHIrP.exe
  C:\Windows\System\NRmHIrP.exe
  2⤵
  PID:10840
- C:\Windows\System\GbGXZVT.exe
  C:\Windows\System\GbGXZVT.exe
  2⤵
  PID:10920
- C:\Windows\System\WVKkkRY.exe
  C:\Windows\System\WVKkkRY.exe
  2⤵
  PID:10996
- C:\Windows\System\zlPmEuA.exe
  C:\Windows\System\zlPmEuA.exe
  2⤵
  PID:11064
- C:\Windows\System\lahTcFG.exe
  C:\Windows\System\lahTcFG.exe
  2⤵
  PID:11144
- C:\Windows\System\HbXmWru.exe
  C:\Windows\System\HbXmWru.exe
  2⤵
  PID:11228
- C:\Windows\System\sVfnDQO.exe
  C:\Windows\System\sVfnDQO.exe
  2⤵
  PID:3308
- C:\Windows\System\pVwtWra.exe
  C:\Windows\System\pVwtWra.exe
  2⤵
  PID:552
- C:\Windows\System\UahNAvf.exe
  C:\Windows\System\UahNAvf.exe
  2⤵
  PID:10604
- C:\Windows\System\ZOfrSyQ.exe
  C:\Windows\System\ZOfrSyQ.exe
  2⤵
  PID:10836
- C:\Windows\System\cvqcJxA.exe
  C:\Windows\System\cvqcJxA.exe
  2⤵
  PID:10968
- C:\Windows\System\glWloac.exe
  C:\Windows\System\glWloac.exe
  2⤵
  PID:4580
- C:\Windows\System\mFOwEDj.exe
  C:\Windows\System\mFOwEDj.exe
  2⤵
  PID:10472
- C:\Windows\System\DtSaUJN.exe
  C:\Windows\System\DtSaUJN.exe
  2⤵
  PID:10688
- C:\Windows\System\bhAbIVs.exe
  C:\Windows\System\bhAbIVs.exe
  2⤵
  PID:10976
- C:\Windows\System\UZtTHbO.exe
  C:\Windows\System\UZtTHbO.exe
  2⤵
  PID:10252
- C:\Windows\System\haRiPVp.exe
  C:\Windows\System\haRiPVp.exe
  2⤵
  PID:11288
- C:\Windows\System\yCVCeuc.exe
  C:\Windows\System\yCVCeuc.exe
  2⤵
  PID:11328
- C:\Windows\System\sbatXcg.exe
  C:\Windows\System\sbatXcg.exe
  2⤵
  PID:11356
- C:\Windows\System\zuvsuis.exe
  C:\Windows\System\zuvsuis.exe
  2⤵
  PID:11384
- C:\Windows\System\EjiMClH.exe
  C:\Windows\System\EjiMClH.exe
  2⤵
  PID:11404
- C:\Windows\System\vCXCLlB.exe
  C:\Windows\System\vCXCLlB.exe
  2⤵
  PID:11420
- C:\Windows\System\XRxkmpQ.exe
  C:\Windows\System\XRxkmpQ.exe
  2⤵
  PID:11436
- C:\Windows\System\IUVvMSH.exe
  C:\Windows\System\IUVvMSH.exe
  2⤵
  PID:11456
- C:\Windows\System\aCbcsaB.exe
  C:\Windows\System\aCbcsaB.exe
  2⤵
  PID:11480
- C:\Windows\System\xKllfLd.exe
  C:\Windows\System\xKllfLd.exe
  2⤵
  PID:11504
- C:\Windows\System\CyZnFOW.exe
  C:\Windows\System\CyZnFOW.exe
  2⤵
  PID:11528
- C:\Windows\System\hSHFxaj.exe
  C:\Windows\System\hSHFxaj.exe
  2⤵
  PID:11564
- C:\Windows\System\Kgftbdb.exe
  C:\Windows\System\Kgftbdb.exe
  2⤵
  PID:11612
- C:\Windows\System\LWObecl.exe
  C:\Windows\System\LWObecl.exe
  2⤵
  PID:11664
- C:\Windows\System\DZtAbVl.exe
  C:\Windows\System\DZtAbVl.exe
  2⤵
  PID:11696
- C:\Windows\System\SfBHSGF.exe
  C:\Windows\System\SfBHSGF.exe
  2⤵
  PID:11724
- C:\Windows\System\NzhYZDJ.exe
  C:\Windows\System\NzhYZDJ.exe
  2⤵
  PID:11756
- C:\Windows\System\kgAVRDu.exe
  C:\Windows\System\kgAVRDu.exe
  2⤵
  PID:11784
- C:\Windows\System\QGKhREh.exe
  C:\Windows\System\QGKhREh.exe
  2⤵
  PID:11808
- C:\Windows\System\tpwBGmQ.exe
  C:\Windows\System\tpwBGmQ.exe
  2⤵
  PID:11844
- C:\Windows\System\REwSpBq.exe
  C:\Windows\System\REwSpBq.exe
  2⤵
  PID:11872
- C:\Windows\System\OCxCEcE.exe
  C:\Windows\System\OCxCEcE.exe
  2⤵
  PID:11908
- C:\Windows\System\uOFWDpz.exe
  C:\Windows\System\uOFWDpz.exe
  2⤵
  PID:11936
- C:\Windows\System\CmgfekW.exe
  C:\Windows\System\CmgfekW.exe
  2⤵
  PID:11984
- C:\Windows\System\dwzWpEB.exe
  C:\Windows\System\dwzWpEB.exe
  2⤵
  PID:12012
- C:\Windows\System\DZEbdAR.exe
  C:\Windows\System\DZEbdAR.exe
  2⤵
  PID:12028
- C:\Windows\System\INxXtEa.exe
  C:\Windows\System\INxXtEa.exe
  2⤵
  PID:12056
- C:\Windows\System\xsepshT.exe
  C:\Windows\System\xsepshT.exe
  2⤵
  PID:12084
- C:\Windows\System\wtMoZHc.exe
  C:\Windows\System\wtMoZHc.exe
  2⤵
  PID:12112
- C:\Windows\System\dvDJUvE.exe
  C:\Windows\System\dvDJUvE.exe
  2⤵
  PID:12140
- C:\Windows\System\LjlwypZ.exe
  C:\Windows\System\LjlwypZ.exe
  2⤵
  PID:12168
- C:\Windows\System\nZvDWym.exe
  C:\Windows\System\nZvDWym.exe
  2⤵
  PID:12196
- C:\Windows\System\PjzIqos.exe
  C:\Windows\System\PjzIqos.exe
  2⤵
  PID:12224
- C:\Windows\System\puwxXgG.exe
  C:\Windows\System\puwxXgG.exe
  2⤵
  PID:12252
- C:\Windows\System\umlyYrW.exe
  C:\Windows\System\umlyYrW.exe
  2⤵
  PID:12280
- C:\Windows\System\GaHPwjk.exe
  C:\Windows\System\GaHPwjk.exe
  2⤵
  PID:11272
- C:\Windows\System\WxCaoql.exe
  C:\Windows\System\WxCaoql.exe
  2⤵
  PID:11368
- C:\Windows\System\pEsqbML.exe
  C:\Windows\System\pEsqbML.exe
  2⤵
  PID:11412
- C:\Windows\System\iLggyxk.exe
  C:\Windows\System\iLggyxk.exe
  2⤵
  PID:11468
- C:\Windows\System\FtEBbhb.exe
  C:\Windows\System\FtEBbhb.exe
  2⤵
  PID:11552
- C:\Windows\System\AAiWyDS.exe
  C:\Windows\System\AAiWyDS.exe
  2⤵
  PID:11644
- C:\Windows\System\ElOuZOn.exe
  C:\Windows\System\ElOuZOn.exe
  2⤵
  PID:696
- C:\Windows\System\QRNmXEn.exe
  C:\Windows\System\QRNmXEn.exe
  2⤵
  PID:11744
- C:\Windows\System\UInYsCv.exe
  C:\Windows\System\UInYsCv.exe
  2⤵
  PID:3540
- C:\Windows\System\veKyyyj.exe
  C:\Windows\System\veKyyyj.exe
  2⤵
  PID:11856
- C:\Windows\System\kyMKJGd.exe
  C:\Windows\System\kyMKJGd.exe
  2⤵
  PID:11920
- C:\Windows\System\kezTIxp.exe
  C:\Windows\System\kezTIxp.exe
  2⤵
  PID:4720
- C:\Windows\System\sxuHfdZ.exe
  C:\Windows\System\sxuHfdZ.exe
  2⤵
  PID:2244
- C:\Windows\System\itUHfNJ.exe
  C:\Windows\System\itUHfNJ.exe
  2⤵
  PID:11960
- C:\Windows\System\zIpNBLD.exe
  C:\Windows\System\zIpNBLD.exe
  2⤵
  PID:4056
- C:\Windows\System\StINVrn.exe
  C:\Windows\System\StINVrn.exe
  2⤵
  PID:12068
- C:\Windows\System\ouCrpeX.exe
  C:\Windows\System\ouCrpeX.exe
  2⤵
  PID:12152
- C:\Windows\System\FDxQFBn.exe
  C:\Windows\System\FDxQFBn.exe
  2⤵
  PID:12208
- C:\Windows\System\bxbobPU.exe
  C:\Windows\System\bxbobPU.exe
  2⤵
  PID:12268
- C:\Windows\System\cvhHuvt.exe
  C:\Windows\System\cvhHuvt.exe
  2⤵
  PID:3164
- C:\Windows\System\WOlHfVV.exe
  C:\Windows\System\WOlHfVV.exe
  2⤵
  PID:11540
- C:\Windows\System\JIyelpC.exe
  C:\Windows\System\JIyelpC.exe
  2⤵
  PID:11604
- C:\Windows\System\nPqCotx.exe
  C:\Windows\System\nPqCotx.exe
  2⤵
  PID:11780
- C:\Windows\System\oTJBcYx.exe
  C:\Windows\System\oTJBcYx.exe
  2⤵
  PID:1536
- C:\Windows\System\zctidSs.exe
  C:\Windows\System\zctidSs.exe
  2⤵
  PID:11212
- C:\Windows\System\oPBfNlb.exe
  C:\Windows\System\oPBfNlb.exe
  2⤵
  PID:12048
- C:\Windows\System\KvnEGrC.exe
  C:\Windows\System\KvnEGrC.exe
  2⤵
  PID:12212
- C:\Windows\System\vFBwPhC.exe
  C:\Windows\System\vFBwPhC.exe
  2⤵
  PID:11348
- C:\Windows\System\MniHCsZ.exe
  C:\Windows\System\MniHCsZ.exe
  2⤵
  PID:11632
- C:\Windows\System\lncaoCE.exe
  C:\Windows\System\lncaoCE.exe
  2⤵
  PID:1112
- C:\Windows\System\slYUymD.exe
  C:\Windows\System\slYUymD.exe
  2⤵
  PID:12024
- C:\Windows\System\DRKzGHL.exe
  C:\Windows\System\DRKzGHL.exe
  2⤵
  PID:11520
- C:\Windows\System\mYVqGLh.exe
  C:\Windows\System\mYVqGLh.exe
  2⤵
  PID:11276
- C:\Windows\System\peBESbC.exe
  C:\Windows\System\peBESbC.exe
  2⤵
  PID:11904
- C:\Windows\System\LxwLOnK.exe
  C:\Windows\System\LxwLOnK.exe
  2⤵
  PID:12316
- C:\Windows\System\PjVhMMP.exe
  C:\Windows\System\PjVhMMP.exe
  2⤵
  PID:12344
- C:\Windows\System\joLJSaI.exe
  C:\Windows\System\joLJSaI.exe
  2⤵
  PID:12372
- C:\Windows\System\nmWtQoV.exe
  C:\Windows\System\nmWtQoV.exe
  2⤵
  PID:12400
- C:\Windows\System\uAtBuHG.exe
  C:\Windows\System\uAtBuHG.exe
  2⤵
  PID:12432
- C:\Windows\System\EGdlFSL.exe
  C:\Windows\System\EGdlFSL.exe
  2⤵
  PID:12460
- C:\Windows\System\vMNCdhU.exe
  C:\Windows\System\vMNCdhU.exe
  2⤵
  PID:12488
- C:\Windows\System\mgaHFHf.exe
  C:\Windows\System\mgaHFHf.exe
  2⤵
  PID:12516
- C:\Windows\System\irGhXOW.exe
  C:\Windows\System\irGhXOW.exe
  2⤵
  PID:12544
- C:\Windows\System\ivzAXjf.exe
  C:\Windows\System\ivzAXjf.exe
  2⤵
  PID:12572
- C:\Windows\System\LPJWrKe.exe
  C:\Windows\System\LPJWrKe.exe
  2⤵
  PID:12616
- C:\Windows\System\yUMxxoW.exe
  C:\Windows\System\yUMxxoW.exe
  2⤵
  PID:12632
- C:\Windows\System\ytWVUsN.exe
  C:\Windows\System\ytWVUsN.exe
  2⤵
  PID:12660
- C:\Windows\System\EGCzIje.exe
  C:\Windows\System\EGCzIje.exe
  2⤵
  PID:12688
- C:\Windows\System\WRcnkVl.exe
  C:\Windows\System\WRcnkVl.exe
  2⤵
  PID:12716
- C:\Windows\System\ZrQfvzI.exe
  C:\Windows\System\ZrQfvzI.exe
  2⤵
  PID:12744
- C:\Windows\System\TRZZjfk.exe
  C:\Windows\System\TRZZjfk.exe
  2⤵
  PID:12772
- C:\Windows\System\QYStSmF.exe
  C:\Windows\System\QYStSmF.exe
  2⤵
  PID:12800
- C:\Windows\System\ZOrLmmD.exe
  C:\Windows\System\ZOrLmmD.exe
  2⤵
  PID:12828
- C:\Windows\System\QWGGPEX.exe
  C:\Windows\System\QWGGPEX.exe
  2⤵
  PID:12856
- C:\Windows\System\tcwuIaT.exe
  C:\Windows\System\tcwuIaT.exe
  2⤵
  PID:12888
- C:\Windows\System\fPkMKSg.exe
  C:\Windows\System\fPkMKSg.exe
  2⤵
  PID:12916
- C:\Windows\System\SfEFZzP.exe
  C:\Windows\System\SfEFZzP.exe
  2⤵
  PID:12944
- C:\Windows\System\XXtoAOI.exe
  C:\Windows\System\XXtoAOI.exe
  2⤵
  PID:12972
- C:\Windows\System\qWcuKSc.exe
  C:\Windows\System\qWcuKSc.exe
  2⤵
  PID:13000
- C:\Windows\System\blzRmkR.exe
  C:\Windows\System\blzRmkR.exe
  2⤵
  PID:13028
- C:\Windows\System\WxYTaKn.exe
  C:\Windows\System\WxYTaKn.exe
  2⤵
  PID:13056
- C:\Windows\System\XvgAovN.exe
  C:\Windows\System\XvgAovN.exe
  2⤵
  PID:13084
- C:\Windows\System\pxWJasz.exe
  C:\Windows\System\pxWJasz.exe
  2⤵
  PID:13112
- C:\Windows\System\ObMCtTo.exe
  C:\Windows\System\ObMCtTo.exe
  2⤵
  PID:13140
- C:\Windows\System\iiCGGTr.exe
  C:\Windows\System\iiCGGTr.exe
  2⤵
  PID:13168
- C:\Windows\System\fiFKhGZ.exe
  C:\Windows\System\fiFKhGZ.exe
  2⤵
  PID:13196
- C:\Windows\System\VtetfWz.exe
  C:\Windows\System\VtetfWz.exe
  2⤵
  PID:13224
- C:\Windows\System\tMcEgqb.exe
  C:\Windows\System\tMcEgqb.exe
  2⤵
  PID:13252
- C:\Windows\System\KYwcoCb.exe
  C:\Windows\System\KYwcoCb.exe
  2⤵
  PID:13280
- C:\Windows\System\bxBWqqe.exe
  C:\Windows\System\bxBWqqe.exe
  2⤵
  PID:13308
- C:\Windows\System\pTaeZMB.exe
  C:\Windows\System\pTaeZMB.exe
  2⤵
  PID:12340
- C:\Windows\System\tOZPIzp.exe
  C:\Windows\System\tOZPIzp.exe
  2⤵
  PID:3828
- C:\Windows\System\hWbYTnY.exe
  C:\Windows\System\hWbYTnY.exe
  2⤵
  PID:12476
- C:\Windows\System\jibKisJ.exe
  C:\Windows\System\jibKisJ.exe
  2⤵
  PID:12528
- C:\Windows\System\pwDqBim.exe
  C:\Windows\System\pwDqBim.exe
  2⤵
  PID:12584
- C:\Windows\System\TynAGPx.exe
  C:\Windows\System\TynAGPx.exe
  2⤵
  PID:12652
- C:\Windows\System\kSlqGfD.exe
  C:\Windows\System\kSlqGfD.exe
  2⤵
  PID:12712
- C:\Windows\System\VdAmBtd.exe
  C:\Windows\System\VdAmBtd.exe
  2⤵
  PID:4948
- C:\Windows\System\iEFDqwd.exe
  C:\Windows\System\iEFDqwd.exe
  2⤵
  PID:12840
- C:\Windows\System\ARDoyZc.exe
  C:\Windows\System\ARDoyZc.exe
  2⤵
  PID:12904
- C:\Windows\System\LsTdsdC.exe
  C:\Windows\System\LsTdsdC.exe
  2⤵
  PID:12968
- C:\Windows\System\hzSdvCG.exe
  C:\Windows\System\hzSdvCG.exe
  2⤵
  PID:13012
- C:\Windows\System\AnNsvdy.exe
  C:\Windows\System\AnNsvdy.exe
  2⤵
  PID:13080
- C:\Windows\System\iSiZVmn.exe
  C:\Windows\System\iSiZVmn.exe
  2⤵
  PID:13152
- C:\Windows\System\HeOEVzq.exe
  C:\Windows\System\HeOEVzq.exe
  2⤵
  PID:13216
- C:\Windows\System\qSIlyFJ.exe
  C:\Windows\System\qSIlyFJ.exe
  2⤵
  PID:5056
- C:\Windows\System\hnqBTNs.exe
  C:\Windows\System\hnqBTNs.exe
  2⤵
  PID:12328
- C:\Windows\System\mOZotJg.exe
  C:\Windows\System\mOZotJg.exe
  2⤵
  PID:12448
- C:\Windows\System\uzutIsE.exe
  C:\Windows\System\uzutIsE.exe
  2⤵
  PID:12596
- C:\Windows\System\QADhHRW.exe
  C:\Windows\System\QADhHRW.exe
  2⤵
  PID:12764
- C:\Windows\System\FmSbIwj.exe
  C:\Windows\System\FmSbIwj.exe
  2⤵
  PID:12900
- C:\Windows\System\spQzoHw.exe
  C:\Windows\System\spQzoHw.exe
  2⤵
  PID:13048
- C:\Windows\System\vACHeGv.exe
  C:\Windows\System\vACHeGv.exe
  2⤵
  PID:13192
- C:\Windows\System\GtSnnNT.exe
  C:\Windows\System\GtSnnNT.exe
  2⤵
  PID:13296
- C:\Windows\System\JgEiMLX.exe
  C:\Windows\System\JgEiMLX.exe
  2⤵
  PID:11980
- C:\Windows\System\hdmhqbM.exe
  C:\Windows\System\hdmhqbM.exe
  2⤵
  PID:3452
- C:\Windows\System\qCuCpee.exe
  C:\Windows\System\qCuCpee.exe
  2⤵
  PID:13264
- C:\Windows\System\icxkcFG.exe
  C:\Windows\System\icxkcFG.exe
  2⤵
  PID:12868
- C:\Windows\System\LZveEwE.exe
  C:\Windows\System\LZveEwE.exe
  2⤵
  PID:12568
- C:\Windows\System\FAgLOef.exe
  C:\Windows\System\FAgLOef.exe
  2⤵
  PID:13324
- C:\Windows\System\uKIDNEs.exe
  C:\Windows\System\uKIDNEs.exe
  2⤵
  PID:13352
- C:\Windows\System\BTzEHEt.exe
  C:\Windows\System\BTzEHEt.exe
  2⤵
  PID:13380
- C:\Windows\System\HXyJfjZ.exe
  C:\Windows\System\HXyJfjZ.exe
  2⤵
  PID:13408
- C:\Windows\System\ddSZniO.exe
  C:\Windows\System\ddSZniO.exe
  2⤵
  PID:13428
- C:\Windows\System\jHMxLnt.exe
  C:\Windows\System\jHMxLnt.exe
  2⤵
  PID:13464
- C:\Windows\System\UgVNAZg.exe
  C:\Windows\System\UgVNAZg.exe
  2⤵
  PID:13496
- C:\Windows\System\OlQBHqo.exe
  C:\Windows\System\OlQBHqo.exe
  2⤵
  PID:13520
- C:\Windows\System\GWnWKkx.exe
  C:\Windows\System\GWnWKkx.exe
  2⤵
  PID:13552
- C:\Windows\System\qKcdXWB.exe
  C:\Windows\System\qKcdXWB.exe
  2⤵
  PID:13580
- C:\Windows\System\dbFgpoX.exe
  C:\Windows\System\dbFgpoX.exe
  2⤵
  PID:13608
- C:\Windows\System\zwLlUej.exe
  C:\Windows\System\zwLlUej.exe
  2⤵
  PID:13636
- C:\Windows\System\UtmJPWq.exe
  C:\Windows\System\UtmJPWq.exe
  2⤵
  PID:13664
- C:\Windows\System\VVmqNPy.exe
  C:\Windows\System\VVmqNPy.exe
  2⤵
  PID:13708
- C:\Windows\System\cUtcBuc.exe
  C:\Windows\System\cUtcBuc.exe
  2⤵
  PID:13724
- C:\Windows\System\MdkRYos.exe
  C:\Windows\System\MdkRYos.exe
  2⤵
  PID:13752
- C:\Windows\System\EsJCMCb.exe
  C:\Windows\System\EsJCMCb.exe
  2⤵
  PID:13780
- C:\Windows\System\ARSrvEz.exe
  C:\Windows\System\ARSrvEz.exe
  2⤵
  PID:13808
- C:\Windows\System\YYAbfxy.exe
  C:\Windows\System\YYAbfxy.exe
  2⤵
  PID:13840
- C:\Windows\System\jRXQPcs.exe
  C:\Windows\System\jRXQPcs.exe
  2⤵
  PID:13868
- C:\Windows\System\xzofjtZ.exe
  C:\Windows\System\xzofjtZ.exe
  2⤵
  PID:13896
- C:\Windows\System\wHgakqr.exe
  C:\Windows\System\wHgakqr.exe
  2⤵
  PID:13924
- C:\Windows\System\autcRad.exe
  C:\Windows\System\autcRad.exe
  2⤵
  PID:13956
- C:\Windows\System\MRSwrsZ.exe
  C:\Windows\System\MRSwrsZ.exe
  2⤵
  PID:13980
- C:\Windows\System\oYjMlRx.exe
  C:\Windows\System\oYjMlRx.exe
  2⤵
  PID:14008
- C:\Windows\System\VblTmOl.exe
  C:\Windows\System\VblTmOl.exe
  2⤵
  PID:14036
- C:\Windows\System\VrCjiej.exe
  C:\Windows\System\VrCjiej.exe
  2⤵
  PID:14064
- C:\Windows\System\nzoJXub.exe
  C:\Windows\System\nzoJXub.exe
  2⤵
  PID:14092
- C:\Windows\System\iWmxzLE.exe
  C:\Windows\System\iWmxzLE.exe
  2⤵
  PID:14112
- C:\Windows\System\GuQrjOW.exe
  C:\Windows\System\GuQrjOW.exe
  2⤵
  PID:14132
- C:\Windows\System\PBRmLnf.exe
  C:\Windows\System\PBRmLnf.exe
  2⤵
  PID:14152
- C:\Windows\System\OgbBfNn.exe
  C:\Windows\System\OgbBfNn.exe
  2⤵
  PID:14176
- C:\Windows\System\VbeleJG.exe
  C:\Windows\System\VbeleJG.exe
  2⤵
  PID:14208
- C:\Windows\System\eFTQtgG.exe
  C:\Windows\System\eFTQtgG.exe
  2⤵
  PID:14232
- C:\Windows\System\YWBkpnu.exe
  C:\Windows\System\YWBkpnu.exe
  2⤵
  PID:14272
- C:\Windows\System\FcLWSLt.exe
  C:\Windows\System\FcLWSLt.exe
  2⤵
  PID:14300
- C:\Windows\System\CSqwvdh.exe
  C:\Windows\System\CSqwvdh.exe
  2⤵
  PID:14332
- C:\Windows\System\ENWqBCu.exe
  C:\Windows\System\ENWqBCu.exe
  2⤵
  PID:13364
- C:\Windows\System\bFUCnLK.exe
  C:\Windows\System\bFUCnLK.exe
  2⤵
  PID:13416
- C:\Windows\System\LKgBdPM.exe
  C:\Windows\System\LKgBdPM.exe
  2⤵
  PID:13508
- C:\Windows\System\UXEKjfF.exe
  C:\Windows\System\UXEKjfF.exe
  2⤵
  PID:13572
- C:\Windows\System\QKRVeaX.exe
  C:\Windows\System\QKRVeaX.exe
  2⤵
  PID:6060
- C:\Windows\System\oimBmwE.exe
  C:\Windows\System\oimBmwE.exe
  2⤵
  PID:6244
- C:\Windows\System\EmNttjm.exe
  C:\Windows\System\EmNttjm.exe
  2⤵
  PID:5988
- C:\Windows\System\tTdwgMm.exe
  C:\Windows\System\tTdwgMm.exe
  2⤵
  PID:13656
- C:\Windows\System\yrqyDbV.exe
  C:\Windows\System\yrqyDbV.exe
  2⤵
  PID:13748
- C:\Windows\System\XSmpSvr.exe
  C:\Windows\System\XSmpSvr.exe
  2⤵
  PID:13820
- C:\Windows\System\HBFxyZs.exe
  C:\Windows\System\HBFxyZs.exe
  2⤵
  PID:13860
- C:\Windows\System\AlYMjOy.exe
  C:\Windows\System\AlYMjOy.exe
  2⤵
  PID:13920
- C:\Windows\System\HEYulWt.exe
  C:\Windows\System\HEYulWt.exe
  2⤵
  PID:14004
- C:\Windows\System\FEhpNkk.exe
  C:\Windows\System\FEhpNkk.exe
  2⤵
  PID:3064
- C:\Windows\System\yydTcqe.exe
  C:\Windows\System\yydTcqe.exe
  2⤵
  PID:14120
- C:\Windows\System\oskcPay.exe
  C:\Windows\System\oskcPay.exe
  2⤵
  PID:14164
- C:\Windows\System\KHVVXlQ.exe
  C:\Windows\System\KHVVXlQ.exe
  2⤵
  PID:14228
- C:\Windows\System\kDCGPNz.exe
  C:\Windows\System\kDCGPNz.exe
  2⤵
  PID:14292
- C:\Windows\System\SRsgUcA.exe
  C:\Windows\System\SRsgUcA.exe
  2⤵
  PID:13392
- C:\Windows\System\ZfkTNIu.exe
  C:\Windows\System\ZfkTNIu.exe
  2⤵
  PID:13516
- C:\Windows\System\lIPqnJa.exe
  C:\Windows\System\lIPqnJa.exe
  2⤵
  PID:6240
- C:\Windows\System\lgqCKbr.exe
  C:\Windows\System\lgqCKbr.exe
  2⤵
  PID:13676
- C:\Windows\System\dBYkPgG.exe
  C:\Windows\System\dBYkPgG.exe
  2⤵
  PID:13804
- C:\Windows\System\iwLCWDw.exe
  C:\Windows\System\iwLCWDw.exe
  2⤵
  PID:13972
- C:\Windows\System\SBsocQH.exe
  C:\Windows\System\SBsocQH.exe
  2⤵
  PID:14088
- C:\Windows\System\xsJXqJF.exe
  C:\Windows\System\xsJXqJF.exe
  2⤵
  PID:14244
- C:\Windows\System\NmFXAnj.exe
  C:\Windows\System\NmFXAnj.exe
  2⤵
  PID:13376
- C:\Windows\System\wHlTTCu.exe
  C:\Windows\System\wHlTTCu.exe
  2⤵
  PID:3216
- C:\Windows\System\rvZoQaV.exe
  C:\Windows\System\rvZoQaV.exe
  2⤵
  PID:13852
- C:\Windows\System\kRKRCLN.exe
  C:\Windows\System\kRKRCLN.exe
  2⤵
  PID:14168
- C:\Windows\System\vBOcYEi.exe
  C:\Windows\System\vBOcYEi.exe
  2⤵
  PID:5992
- C:\Windows\System\ZymGvkD.exe
  C:\Windows\System\ZymGvkD.exe
  2⤵
  PID:13776
- C:\Windows\System\ISquVIC.exe
  C:\Windows\System\ISquVIC.exe
  2⤵
  PID:14060
- C:\Windows\System\eZQbQsz.exe
  C:\Windows\System\eZQbQsz.exe
  2⤵
  PID:14364
- C:\Windows\System\TrUKnly.exe
  C:\Windows\System\TrUKnly.exe
  2⤵
  PID:14392
- C:\Windows\System\vCFpczn.exe
  C:\Windows\System\vCFpczn.exe
  2⤵
  PID:14420
- C:\Windows\System\hnUPzfy.exe
  C:\Windows\System\hnUPzfy.exe
  2⤵
  PID:14448
- C:\Windows\System\lmgtMLU.exe
  C:\Windows\System\lmgtMLU.exe
  2⤵
  PID:14476
- C:\Windows\System\qCtwxBG.exe
  C:\Windows\System\qCtwxBG.exe
  2⤵
  PID:14504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AiLoiKf.exe

Filesize
1.1MB

MD5
6c966a15339f4d3233441817aa741947

SHA1
1aee3f2d0f21eb3d39c189fc6ed3d050e712f157

SHA256
841fd233b79cac7128951c1e99e30ef0536cc5c06baf9dfd99c342439c758950

SHA512
3e26afa8bc30ee384665dbee99d38cc1fe08556a8e980dc53cd54d35b15bc354365236f529608db3c1e740235a13f0fb43ee43cbe3fb75dfba05f862791800b5

Download Submit
C:\Windows\System\BQZjiLW.exe

Filesize
1.2MB

MD5
7aa529fea9e15422fb03ea7d99c4d7d7

SHA1
f3b91a8502b30d81f070dfeb342284dea6ec7d58

SHA256
8522fdddda75d1469db5a11fb1f584d87a8dd92cc5fbe49596dedaf54602df07

SHA512
adeaddc1ee413ad0a0b9c4760916a5abd73ee1a42106181d4546e6c675ceafe354e491a5a964d55aa88860bfe41cf7b9c53b5015f38482a882dfc3bb3c428431

Download Submit
C:\Windows\System\BQZjiLW.exe

Filesize
2.2MB

MD5
7b12aa9b88ea84d10e05ba8ca0172e91

SHA1
26387431fca105bff9d38cccddb5b621756312c9

SHA256
aaf30629ca7f979f40697bc281be875cf41504c038377b8b9b3402ccbee365f9

SHA512
f29784914c61e77db94b0a14f61972101342a99e901e17fc2f2f108a94f5b6b4dce308540fdcbcc930e0d51ed63abe4ad5b758f3122a2dfa5ee41073e48ae110

Download Submit
C:\Windows\System\EKpBFrV.exe

Filesize
2.2MB

MD5
b98fb6e4d1b2ae57d539623826bbbdc7

SHA1
0154f84f89253246c5d92cf99d845ab6e51a265d

SHA256
9a65456d8ed9b0c58576195f30f4b80380789db3667f94744a369d89ce223f19

SHA512
3699186d9d604e89af30578f6643e2d9aee580d49d87755040b3c5ca570a7eb9a12d321f9a8dbf1b4b6010f9df8393d7a7664ef742de789f7869db3b01a25d4d

Download Submit
C:\Windows\System\EKpBFrV.exe

Filesize
2.1MB

MD5
befb22fa8c8e3bc766683c88917b55a4

SHA1
35624406e65045ec10ff5c5cf16c31b33092e677

SHA256
8ee62a36f39cf589b4b7c08149c33e87f7ff87985f9fead669f75bfa5b60dd5c

SHA512
37fa156b5209fc09bca3ca05d1fc8b73d5415539886490e92b5277fbf3ae53a82961313f1bfa63cdb9ebcb3e72647021944442b798ed7d3a9968d4778d7f338e

Download Submit
C:\Windows\System\EqsxcZx.exe

Filesize
2.2MB

MD5
05bd3e2cdf7a9be127e2e567c456bd26

SHA1
4adcf9f4ac517706bd629796ee5fbdf978471569

SHA256
663ff23df3e8af313f196539e1817eb09aa4ec67421cae7c84a98f542dd4fbca

SHA512
bef7d08845eb0ddd2b8847685cc92cc6a83a959a8b796cdb8df1a261475c517415cbc487586017357d9a3557e802620bae73a39885a52bdf08cb7c753e11607d

Download Submit
C:\Windows\System\FEakgZd.exe

Filesize
2.2MB

MD5
deb800ca0f1d2172fc546b4109f3d7b8

SHA1
f31e783e901a1ad276c82709b1a957a652a6d961

SHA256
47f51e9978c16a781f466fbbbbf09add2dd58a723d42d25abd8480b44eec2731

SHA512
5d28ba5e8cb42b07e27498f9c40e9cac8084709795b0577db58c7d36b86eb47611b1b20e27fbd986c7edd1f3548a637bfed67e75f5a2d3df1fe3e5ec1d48ba03

Download Submit
C:\Windows\System\GDURuQx.exe

Filesize
2.2MB

MD5
98ce4443e193738845ce72fa0a392067

SHA1
174401593452102472d27529b15666c43c2344e4

SHA256
c89b17e33d964822ed753519291c5126a72c73df2fbe8edbccb8a4ad5123c72c

SHA512
40793bae7b959f41d0d4e6a643950f22464b8ba82e1d182355e66a1ad304e64f1deb932950e03af1824042575ac61a5e776b595caae3d2580b63da7581b6363f

Download Submit
C:\Windows\System\GdBmSjM.exe

Filesize
2.2MB

MD5
0fd47406d8a57a3463ada6e3a0418b7f

SHA1
7c20d58e93e92e067774be961f0d0f3dfa412d50

SHA256
50b3fa634cb1ea694130393c8cd0f3431c5c03a03eaf44a922aa50d7c347c760

SHA512
eb5ac369fee2cb22a989b8a7d392c0ebde68976b1403b4126ed1de3a93c99422d010c6887db477ff9f28ccb5a27becbd97ba5bd57dfe66c86a93cb13bbb2f7b5

Download Submit
C:\Windows\System\KbNwaQR.exe

Filesize
1.6MB

MD5
c5659ca65df20dd52f2c9a12ef5a9e1d

SHA1
bcc72abed4523303733039918814344fb4ea3b3f

SHA256
95a5dd4ffdbe5cb310d7fdec4c75626406c7fa731fc0db5782202c97538a6b97

SHA512
5c9380187c53b85fbaf0628abf975fc0b0067f2b6282fd5228c5c67f48bfc019acd46b4dd1e873cedac9755b8859cb26e5afa581fb2c2e5878442b8ff871ab3d

Download Submit
C:\Windows\System\LVRlOLG.exe

Filesize
2.2MB

MD5
3e6397e2149a4a1d7f4d080c5e028388

SHA1
bb915856b383f4542683b80bdb35c26b87b339dd

SHA256
a42b77de50841efab5e7dfb9567a432910471d578e3678f89ae08bf5389961be

SHA512
831789d5964b1546ca7383f36ca5d816c9390aa0ac3a459640f03e41c04646879e6a8b1f8ac2563ea9b07154fd84b2ff8555670e922bced06b74d1846c5bd08d

Download Submit
C:\Windows\System\LpEaAqC.exe

Filesize
2.0MB

MD5
646729145994b6775f40087a4822fc35

SHA1
98a70f07fb0defd420bac7df10861cf9538277ce

SHA256
f4b85289db22de6b2ab52f6d38d24fe874499027137723f85bb75489c922781d

SHA512
d4192fa854e2c845be8ab98d0dc56fc0cf27b24327c9f442c2c5205214d8c9b62e5239c90003a3e961c46f3aa18c6b349ec0537b28946d0d6817061d79518827

Download Submit
C:\Windows\System\MEPYeKF.exe

Filesize
2.2MB

MD5
6c10f9d9d770ae4d8468f2e742fe1e78

SHA1
44e8a30e07de0d9c0a02c5f07e255ae85530967e

SHA256
c3ecdd453ea0abeff1ed42a7998723cbe92ad42f56873ad8c988c01d11868b73

SHA512
86a305da5ddbcb25f55c53c5dff91174f50883326a47575bf0d7b67c45656fdfb06676fbaf227d97523a15394c95cf4421802ca33d983d8eab29097faea8f79d

Download Submit
C:\Windows\System\QtoITpT.exe

Filesize
448KB

MD5
0642442db4acbbfb6037e06789624264

SHA1
923aee440a6887c7a7a8a78085aa492b2cdcee65

SHA256
5d6249e3d37c32c515e6f20e0771180c7b51c791102dfffe39e4510d623eda85

SHA512
7fc8231c299b64743a966130c519362217b11d421c0ccc65ca7c97570221449b6e5bd90caefa97b416470db36fac07c3f48ea41836b395ab190e6121598e88a1

Download Submit
C:\Windows\System\gXVKGgI.exe

Filesize
2.2MB

MD5
ba313d41430ab1a422dee396a9fd4165

SHA1
65690673811db93ff50417fb20bf5a3b354d3193

SHA256
453fdad580febec09cc4acde2c55bdce0fa7fc2dc5a07696a5d767245d3baba4

SHA512
8c7fea47fb673602c35e2042573eda3a45a5c30a1643d66c2b3ad62dde5de77653e3ca1a0cbb601e8c5aefa43fc420555e80dce8fa3b111d86c62221b8407257

Download Submit
C:\Windows\System\jnkYwji.exe

Filesize
2.2MB

MD5
626821404ec087685ffb4f8ffdb64fdd

SHA1
ed0430075927f4ad901279cdd5093d35e085493e

SHA256
a5aa5675a37764667a3d2a77086bf86bb644463329f1d3da77fb5931dabb053f

SHA512
5d6a6c6ad340b05d45d4ff531b4e893f484c0e5eaaaeda9877423c87b519dd82be8d8873aa8860ba7366e4e7bb8744a9f12cd68a62c84eeeb4345ae194bd300d

Download Submit
C:\Windows\System\oMqrHJY.exe

Filesize
2.2MB

MD5
dbb76f692c033bbeccc990cf50166085

SHA1
ea80e117764dfa175248c5276116dd73269e018d

SHA256
4211883bbbd7e2150bcc540bd0268f39a8880cd753db099bc7b466d199d50304

SHA512
4ae3fc1a44932210be344acd35046596e3262ae63a70db8ad13ad2556964b966f6b7de5955951b4a98621a38acdf9d3197fe4fa69f6a5dcd9acc2176d8138257

Download Submit
C:\Windows\System\qhhivEI.exe

Filesize
2.2MB

MD5
88e12179e273f88a310e7e0c5c99a877

SHA1
120dd7f391efbfa5bc66613d2c7ab79318fc798b

SHA256
5505ffc34acfba63a12d126a42836a056656ffba236c58a7736785425b5f249a

SHA512
9b126e50f6a753f2e0a39477beda27ad6c04d30a863845712656c6a80e7e1735a0e9590330c04f20aa33a7945ef96649bd40d8a28a45f305eecc79e68dfa6a80

Download Submit
C:\Windows\System\qhhivEI.exe

Filesize
1.1MB

MD5
1241ba867453897ac081cd65f8362e09

SHA1
c06f20c8fe988e04887b1928c0d398e1278d1f63

SHA256
4da6a57bd18d845b9eb05ddd095ba49a9a1364f0f89dcc72e16f38ee06b3ecf2

SHA512
7035d20636296fc99797ebe12bb98dd381bedda6aae785250256cdbea17ca2a91777be59420c826d8c0a97d52e35f2dbc43b95df90b931416103881e71aafc54

Download Submit
C:\Windows\System\tHTgJoh.exe

Filesize
1.9MB

MD5
aef19ec13f611c2d877d2889611bff56

SHA1
5386af4ee9a97d7a675caea4aafb0dc57035cd54

SHA256
7de8d50a7829ae513b341c5c15fa69e1ba873b71df7ad54311bc60f7c1d30513

SHA512
8140395bb2e721e4dad9fb26e3604d2c6cdb18c8234f36900cf3b7e5a0e558d23f85c4e377e773bc9ca6930f1ca280d2959a57ce4266c363f37334278f528120

Download Submit
C:\Windows\System\xSuiPIY.exe

Filesize
512KB

MD5
6b5887af4274a78686a788865765637c

SHA1
5afc15e6fcbc11377bbabbda47ff43f6ebedd369

SHA256
ecdfed9bc02368fefbebe0d02090e93826b7e5cc1043e339dd245299c8b23006

SHA512
4f563e539f8ec68bbc27d4cc59c42ea4897bb131085e08433f745cc558ab7a030701a601ddb711cda19dfa6cd9086b458fb74762092be15aaa4190c05134d077

Download Submit
C:\Windows\System\ybrUKzY.exe

Filesize
2.2MB

MD5
406d1e445362a328cfe8e9f1f79e19cb

SHA1
8a5f39729d97c855da0261f2747f19528dfaa6af

SHA256
5ade389eb8289ec140756af53703a44d0c93898aab962118203ee5b8c8ac8f30

SHA512
c6d0de932576c7e879f392599dae532f520f59fe777cc42b036024c068ab8065077aed31406603e9b39d1a3b1ba20a7ccdb5274eaf544fc0f0e073984fe2d963

Download Submit
C:\Windows\System\zsfjTdt.exe

Filesize
1.8MB

MD5
00f39f6b6dc9cf82c8cf2d63f15baba8

SHA1
21e47401f23fc7da935d6b2f500250e3bc747916

SHA256
599044497baa716a6ed5862cd5756a10a05b214ff86d7d407119f540a6657efc

SHA512
21a2a5460668e80e4d1e557418c270c7dfea977159268be4f6275ca5b1738f64ecf6b2b58ca22beb3d9ca9655433d8c92c991cdeda02fca349f6711acd60eca0

Download Submit
memory/588-2138-0x00007FF78DA10000-0x00007FF78DD64000-memory.dmp

Filesize
3.3MB

Download
memory/588-206-0x00007FF78DA10000-0x00007FF78DD64000-memory.dmp

Filesize
3.3MB

Download
memory/956-2128-0x00007FF7D0300000-0x00007FF7D0654000-memory.dmp

Filesize
3.3MB

Download
memory/956-78-0x00007FF7D0300000-0x00007FF7D0654000-memory.dmp

Filesize
3.3MB

Download
memory/956-2110-0x00007FF7D0300000-0x00007FF7D0654000-memory.dmp

Filesize
3.3MB

Download
memory/1036-12-0x00007FF725370000-0x00007FF7256C4000-memory.dmp

Filesize
3.3MB

Download
memory/1036-2117-0x00007FF725370000-0x00007FF7256C4000-memory.dmp

Filesize
3.3MB

Download
memory/1260-2133-0x00007FF67B580000-0x00007FF67B8D4000-memory.dmp

Filesize
3.3MB

Download
memory/1260-205-0x00007FF67B580000-0x00007FF67B8D4000-memory.dmp

Filesize
3.3MB

Download
memory/1392-2118-0x00007FF7EB6D0000-0x00007FF7EBA24000-memory.dmp

Filesize
3.3MB

Download
memory/1392-2105-0x00007FF7EB6D0000-0x00007FF7EBA24000-memory.dmp

Filesize
3.3MB

Download
memory/1392-20-0x00007FF7EB6D0000-0x00007FF7EBA24000-memory.dmp

Filesize
3.3MB

Download
memory/1448-2111-0x00007FF647D70000-0x00007FF6480C4000-memory.dmp

Filesize
3.3MB

Download
memory/1448-81-0x00007FF647D70000-0x00007FF6480C4000-memory.dmp

Filesize
3.3MB

Download
memory/1448-2127-0x00007FF647D70000-0x00007FF6480C4000-memory.dmp

Filesize
3.3MB

Download
memory/1460-2136-0x00007FF781530000-0x00007FF781884000-memory.dmp

Filesize
3.3MB

Download
memory/1460-208-0x00007FF781530000-0x00007FF781884000-memory.dmp

Filesize
3.3MB

Download
memory/1672-2129-0x00007FF7B35D0000-0x00007FF7B3924000-memory.dmp

Filesize
3.3MB

Download
memory/1672-203-0x00007FF7B35D0000-0x00007FF7B3924000-memory.dmp

Filesize
3.3MB

Download
memory/1788-191-0x00007FF6CF5A0000-0x00007FF6CF8F4000-memory.dmp

Filesize
3.3MB

Download
memory/1788-2142-0x00007FF6CF5A0000-0x00007FF6CF8F4000-memory.dmp

Filesize
3.3MB

Download
memory/2560-102-0x00007FF726820000-0x00007FF726B74000-memory.dmp

Filesize
3.3MB

Download
memory/2560-2132-0x00007FF726820000-0x00007FF726B74000-memory.dmp

Filesize
3.3MB

Download
memory/2560-2112-0x00007FF726820000-0x00007FF726B74000-memory.dmp

Filesize
3.3MB

Download
memory/2652-192-0x00007FF64EC90000-0x00007FF64EFE4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-2137-0x00007FF64EC90000-0x00007FF64EFE4000-memory.dmp

Filesize
3.3MB

Download
memory/3092-2106-0x00007FF60AE20000-0x00007FF60B174000-memory.dmp

Filesize
3.3MB

Download
memory/3092-2119-0x00007FF60AE20000-0x00007FF60B174000-memory.dmp

Filesize
3.3MB

Download
memory/3092-29-0x00007FF60AE20000-0x00007FF60B174000-memory.dmp

Filesize
3.3MB

Download
memory/3284-2114-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp

Filesize
3.3MB

Download
memory/3284-147-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp

Filesize
3.3MB

Download
memory/3284-2140-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp

Filesize
3.3MB

Download
memory/3516-2145-0x00007FF625960000-0x00007FF625CB4000-memory.dmp

Filesize
3.3MB

Download
memory/3516-185-0x00007FF625960000-0x00007FF625CB4000-memory.dmp

Filesize
3.3MB

Download
memory/3520-198-0x00007FF68DA60000-0x00007FF68DDB4000-memory.dmp

Filesize
3.3MB

Download
memory/3520-2121-0x00007FF68DA60000-0x00007FF68DDB4000-memory.dmp

Filesize
3.3MB

Download
memory/3532-33-0x00007FF79A330000-0x00007FF79A684000-memory.dmp

Filesize
3.3MB

Download
memory/3532-2115-0x00007FF79A330000-0x00007FF79A684000-memory.dmp

Filesize
3.3MB

Download
memory/3532-2120-0x00007FF79A330000-0x00007FF79A684000-memory.dmp

Filesize
3.3MB

Download
memory/3568-55-0x00007FF69A980000-0x00007FF69ACD4000-memory.dmp

Filesize
3.3MB

Download
memory/3568-2108-0x00007FF69A980000-0x00007FF69ACD4000-memory.dmp

Filesize
3.3MB

Download
memory/3568-2126-0x00007FF69A980000-0x00007FF69ACD4000-memory.dmp

Filesize
3.3MB

Download
memory/3588-2123-0x00007FF725E10000-0x00007FF726164000-memory.dmp

Filesize
3.3MB

Download
memory/3588-2107-0x00007FF725E10000-0x00007FF726164000-memory.dmp

Filesize
3.3MB

Download
memory/3588-44-0x00007FF725E10000-0x00007FF726164000-memory.dmp

Filesize
3.3MB

Download
memory/3712-201-0x00007FF756550000-0x00007FF7568A4000-memory.dmp

Filesize
3.3MB

Download
memory/3712-2124-0x00007FF756550000-0x00007FF7568A4000-memory.dmp

Filesize
3.3MB

Download
memory/3784-207-0x00007FF7087A0000-0x00007FF708AF4000-memory.dmp

Filesize
3.3MB

Download
memory/3784-2134-0x00007FF7087A0000-0x00007FF708AF4000-memory.dmp

Filesize
3.3MB

Download
memory/3792-0-0x00007FF746C60000-0x00007FF746FB4000-memory.dmp

Filesize
3.3MB

Download
memory/3792-1-0x000001671C750000-0x000001671C760000-memory.dmp

Filesize
64KB

Download
memory/3932-160-0x00007FF614570000-0x00007FF6148C4000-memory.dmp

Filesize
3.3MB

Download
memory/3932-2139-0x00007FF614570000-0x00007FF6148C4000-memory.dmp

Filesize
3.3MB

Download
memory/4196-199-0x00007FF6D2D20000-0x00007FF6D3074000-memory.dmp

Filesize
3.3MB

Download
memory/4196-2122-0x00007FF6D2D20000-0x00007FF6D3074000-memory.dmp

Filesize
3.3MB

Download
memory/4200-2113-0x00007FF67E4E0000-0x00007FF67E834000-memory.dmp

Filesize
3.3MB

Download
memory/4200-128-0x00007FF67E4E0000-0x00007FF67E834000-memory.dmp

Filesize
3.3MB

Download
memory/4200-2135-0x00007FF67E4E0000-0x00007FF67E834000-memory.dmp

Filesize
3.3MB

Download
memory/4412-2125-0x00007FF657DD0000-0x00007FF658124000-memory.dmp

Filesize
3.3MB

Download
memory/4412-64-0x00007FF657DD0000-0x00007FF658124000-memory.dmp

Filesize
3.3MB

Download
memory/4412-2109-0x00007FF657DD0000-0x00007FF658124000-memory.dmp

Filesize
3.3MB

Download
memory/4572-2130-0x00007FF75DB00000-0x00007FF75DE54000-memory.dmp

Filesize
3.3MB

Download
memory/4572-117-0x00007FF75DB00000-0x00007FF75DE54000-memory.dmp

Filesize
3.3MB

Download
memory/4692-188-0x00007FF6297A0000-0x00007FF629AF4000-memory.dmp

Filesize
3.3MB

Download
memory/4692-2144-0x00007FF6297A0000-0x00007FF629AF4000-memory.dmp

Filesize
3.3MB

Download
memory/4960-2143-0x00007FF60ED70000-0x00007FF60F0C4000-memory.dmp

Filesize
3.3MB

Download
memory/4960-179-0x00007FF60ED70000-0x00007FF60F0C4000-memory.dmp

Filesize
3.3MB

Download
memory/4960-2116-0x00007FF60ED70000-0x00007FF60F0C4000-memory.dmp

Filesize
3.3MB

Download
memory/5080-209-0x00007FF7B9390000-0x00007FF7B96E4000-memory.dmp

Filesize
3.3MB

Download
memory/5080-2141-0x00007FF7B9390000-0x00007FF7B96E4000-memory.dmp

Filesize
3.3MB

Download
memory/5112-2131-0x00007FF70D550000-0x00007FF70D8A4000-memory.dmp

Filesize
3.3MB

Download
memory/5112-204-0x00007FF70D550000-0x00007FF70D8A4000-memory.dmp

Filesize
3.3MB

Download