xmrig | ee3c18c59bfd97defd58221f35e8e3de15fcc4621aac0a3ba191fd6e8bba8b93

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
Size

1.1MB
MD5

7a13b4b0fde7bf5c34fbaaaff88fb880
SHA1

c625f5c943672d537fcfaa7adb8f7f4f5d99419a
SHA256

ee3c18c59bfd97defd58221f35e8e3de15fcc4621aac0a3ba191fd6e8bba8b93
SHA512

68fef7d8ce89d6637a29a06c253c59db90417b905e3a691a7112f6a394c84c5460c551685de876001e8fa87f1d43c78acd5eee599aa5ad5996b0f99803344539
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKensziRPVnrU2OOpQ:GezaTF8FcNkNdfE0pZ9oztFwIRmVIzv

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/files/0x0006000000023298-4.dat	xmrig
behavioral2/files/0x000700000002343e-8.dat	xmrig
behavioral2/files/0x000700000002343f-19.dat	xmrig
behavioral2/files/0x000800000002343d-15.dat	xmrig
behavioral2/files/0x0007000000023440-23.dat	xmrig
behavioral2/files/0x0007000000023443-35.dat	xmrig
behavioral2/files/0x0007000000023444-43.dat	xmrig
behavioral2/files/0x0007000000023446-54.dat	xmrig
behavioral2/files/0x0007000000023449-91.dat	xmrig
behavioral2/files/0x0007000000023453-105.dat	xmrig
behavioral2/files/0x000700000002344f-119.dat	xmrig
behavioral2/files/0x0007000000023459-150.dat	xmrig
behavioral2/files/0x0007000000023454-165.dat	xmrig
behavioral2/files/0x0007000000023460-164.dat	xmrig
behavioral2/files/0x000700000002345f-163.dat	xmrig
behavioral2/files/0x0007000000023458-162.dat	xmrig
behavioral2/files/0x000700000002345e-161.dat	xmrig
behavioral2/files/0x000700000002345d-160.dat	xmrig
behavioral2/files/0x000700000002345c-159.dat	xmrig
behavioral2/files/0x0007000000023451-158.dat	xmrig
behavioral2/files/0x0007000000023455-157.dat	xmrig
behavioral2/files/0x000700000002345b-156.dat	xmrig
behavioral2/files/0x000700000002345a-153.dat	xmrig
behavioral2/files/0x0007000000023452-146.dat	xmrig
behavioral2/files/0x0007000000023456-140.dat	xmrig
behavioral2/files/0x0007000000023457-132.dat	xmrig
behavioral2/files/0x0007000000023450-126.dat	xmrig
behavioral2/files/0x000700000002344c-125.dat	xmrig
behavioral2/files/0x000700000002344e-118.dat	xmrig
behavioral2/files/0x000700000002344d-111.dat	xmrig
behavioral2/files/0x000700000002344b-103.dat	xmrig
behavioral2/files/0x0007000000023448-88.dat	xmrig
behavioral2/files/0x000700000002344a-81.dat	xmrig
behavioral2/files/0x0007000000023447-75.dat	xmrig
behavioral2/files/0x0007000000023445-60.dat	xmrig
behavioral2/files/0x0007000000023441-42.dat	xmrig
behavioral2/files/0x0007000000023442-39.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1824	JQgiSMy.exe
3588	lyoPPTX.exe
2148	mKnSmVp.exe
1388	oibGXpj.exe
676	pVlOQAx.exe
3696	VlJGoko.exe
3260	TuIjbIV.exe
1964	BsxeVtE.exe
4316	AxdGMXl.exe
2696	SHtrUDd.exe
2212	SIlclKa.exe
2604	kUEJIDR.exe
1316	MMrBtFm.exe
1496	eYLLlYN.exe
2940	TfLKIlq.exe
1372	QLVssAF.exe
1064	WTeDwXD.exe
636	QHqYtDR.exe
2072	xveDWtw.exe
396	tnRoOOi.exe
1156	jibYOcs.exe
2916	jKKaTJZ.exe
5048	BReJYbQ.exe
5068	nbEfsBi.exe
3284	TljacmI.exe
4852	MwnLmwd.exe
5040	xytvQnr.exe
2312	wcRDYsI.exe
3036	OSNhmEI.exe
3788	aXSbGCh.exe
3032	BAethhq.exe
4920	rTuGYgH.exe
4140	chODUJT.exe
2548	RQFuiaU.exe
3048	uvVMMXp.exe
3572	RaVPVzZ.exe
4564	nfvQRcP.exe
868	LgyCmIp.exe
3892	NfuTaHF.exe
1732	xIokIfk.exe
2452	mepPWkW.exe
3864	KVXnSgJ.exe
3920	BhWaFut.exe
848	PYIpahV.exe
4228	ajEuorH.exe
4276	aKhqdWP.exe
3852	vWXMAWA.exe
4088	tUPmbVi.exe
460	LZLyJaU.exe
4520	FZnXqIq.exe
1736	ENdYCYz.exe
2364	fmQGtlS.exe
1956	QDWaGuF.exe
1764	uwwlHni.exe
3676	sXWnxzO.exe
2628	OGskCwB.exe
3980	bmZjAyU.exe
3828	FFXpeAm.exe
1712	zLgXNiY.exe
464	OJgsLin.exe
988	CDMRYII.exe
3496	NojpFdN.exe
3304	KQHWtAX.exe
1148	dopdKXC.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LJFPaaI.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\yQdEnCZ.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\UAHWnFE.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\NJaAzel.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\zWRHZFK.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\YbMqsbr.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\LnkYOgo.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\nuYHqBu.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\yXUszaD.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\HtDJiFD.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\GDQqvoD.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\uIoCeUu.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\zaTqanC.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\WTeDwXD.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\AtFEbnc.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\bvlbGfg.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\hiEvlAJ.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\ANyLKnn.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\sdKPLTs.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\SBeamjy.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\eZRLOLC.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\InLjOLF.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\pWyqLTA.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\iyEIYxY.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\IbAdlaM.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\IoWTXxS.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\LeNgXYT.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\ZPsaTox.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\abOdTEn.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\ZrFhwfy.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\zuJDlQg.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\TJNRdzE.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\xEJezlH.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\jwrLRFe.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\iqDEgtq.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\sviIIch.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\DbackVQ.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\hCFZaWm.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\DnAwHNY.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\rPtYzbA.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\DmQoYeC.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\CWashVs.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\mUZOtiM.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\ZGpHDgo.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\fDvqmfi.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\SDEBwTX.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\HhsYcvc.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\yMSanjw.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\hHitGVU.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\WhBBYnb.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\RPGNPJx.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\mbYQpsp.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\LtrSQFm.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\UVUchvS.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\XjvGAox.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\BUAXfWy.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\bcnYVwm.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\kNgaCSC.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\OzdVdIk.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\aXSbGCh.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\KESTikZ.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\AeWFmNP.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\FdvGzWq.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
File created	C:\Windows\System\NojpFdN.exe	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1824	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	82
PID 4416 wrote to memory of 1824	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	82
PID 4416 wrote to memory of 3588	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	83
PID 4416 wrote to memory of 3588	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	83
PID 4416 wrote to memory of 2148	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	84
PID 4416 wrote to memory of 2148	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	84
PID 4416 wrote to memory of 1388	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	85
PID 4416 wrote to memory of 1388	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	85
PID 4416 wrote to memory of 676	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	86
PID 4416 wrote to memory of 676	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	86
PID 4416 wrote to memory of 3696	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	87
PID 4416 wrote to memory of 3696	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	87
PID 4416 wrote to memory of 3260	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	88
PID 4416 wrote to memory of 3260	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	88
PID 4416 wrote to memory of 1964	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	89
PID 4416 wrote to memory of 1964	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	89
PID 4416 wrote to memory of 4316	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	90
PID 4416 wrote to memory of 4316	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	90
PID 4416 wrote to memory of 2696	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	91
PID 4416 wrote to memory of 2696	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	91
PID 4416 wrote to memory of 2212	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	92
PID 4416 wrote to memory of 2212	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	92
PID 4416 wrote to memory of 2604	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	93
PID 4416 wrote to memory of 2604	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	93
PID 4416 wrote to memory of 1316	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	94
PID 4416 wrote to memory of 1316	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	94
PID 4416 wrote to memory of 1496	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	95
PID 4416 wrote to memory of 1496	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	95
PID 4416 wrote to memory of 2940	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	96
PID 4416 wrote to memory of 2940	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	96
PID 4416 wrote to memory of 1372	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	97
PID 4416 wrote to memory of 1372	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	97
PID 4416 wrote to memory of 396	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	98
PID 4416 wrote to memory of 396	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	98
PID 4416 wrote to memory of 1064	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	99
PID 4416 wrote to memory of 1064	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	99
PID 4416 wrote to memory of 636	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	100
PID 4416 wrote to memory of 636	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	100
PID 4416 wrote to memory of 2072	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	101
PID 4416 wrote to memory of 2072	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	101
PID 4416 wrote to memory of 1156	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	102
PID 4416 wrote to memory of 1156	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	102
PID 4416 wrote to memory of 2916	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	103
PID 4416 wrote to memory of 2916	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	103
PID 4416 wrote to memory of 5048	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	104
PID 4416 wrote to memory of 5048	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	104
PID 4416 wrote to memory of 5068	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	105
PID 4416 wrote to memory of 5068	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	105
PID 4416 wrote to memory of 3284	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	106
PID 4416 wrote to memory of 3284	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	106
PID 4416 wrote to memory of 4852	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	107
PID 4416 wrote to memory of 4852	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	107
PID 4416 wrote to memory of 5040	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	108
PID 4416 wrote to memory of 5040	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	108
PID 4416 wrote to memory of 2312	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	109
PID 4416 wrote to memory of 2312	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	109
PID 4416 wrote to memory of 3036	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	110
PID 4416 wrote to memory of 3036	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	110
PID 4416 wrote to memory of 3788	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	111
PID 4416 wrote to memory of 3788	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	111
PID 4416 wrote to memory of 3032	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	112
PID 4416 wrote to memory of 3032	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	112
PID 4416 wrote to memory of 4920	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	113
PID 4416 wrote to memory of 4920	4416	7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7a13b4b0fde7bf5c34fbaaaff88fb880_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\System\JQgiSMy.exe
  C:\Windows\System\JQgiSMy.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\lyoPPTX.exe
  C:\Windows\System\lyoPPTX.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\mKnSmVp.exe
  C:\Windows\System\mKnSmVp.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\oibGXpj.exe
  C:\Windows\System\oibGXpj.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\pVlOQAx.exe
  C:\Windows\System\pVlOQAx.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\VlJGoko.exe
  C:\Windows\System\VlJGoko.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\TuIjbIV.exe
  C:\Windows\System\TuIjbIV.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\BsxeVtE.exe
  C:\Windows\System\BsxeVtE.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\AxdGMXl.exe
  C:\Windows\System\AxdGMXl.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\SHtrUDd.exe
  C:\Windows\System\SHtrUDd.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\SIlclKa.exe
  C:\Windows\System\SIlclKa.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\kUEJIDR.exe
  C:\Windows\System\kUEJIDR.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\MMrBtFm.exe
  C:\Windows\System\MMrBtFm.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\eYLLlYN.exe
  C:\Windows\System\eYLLlYN.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\TfLKIlq.exe
  C:\Windows\System\TfLKIlq.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\QLVssAF.exe
  C:\Windows\System\QLVssAF.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\tnRoOOi.exe
  C:\Windows\System\tnRoOOi.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\WTeDwXD.exe
  C:\Windows\System\WTeDwXD.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\QHqYtDR.exe
  C:\Windows\System\QHqYtDR.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\xveDWtw.exe
  C:\Windows\System\xveDWtw.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\jibYOcs.exe
  C:\Windows\System\jibYOcs.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\jKKaTJZ.exe
  C:\Windows\System\jKKaTJZ.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\BReJYbQ.exe
  C:\Windows\System\BReJYbQ.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\nbEfsBi.exe
  C:\Windows\System\nbEfsBi.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\TljacmI.exe
  C:\Windows\System\TljacmI.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\MwnLmwd.exe
  C:\Windows\System\MwnLmwd.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\xytvQnr.exe
  C:\Windows\System\xytvQnr.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\wcRDYsI.exe
  C:\Windows\System\wcRDYsI.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\OSNhmEI.exe
  C:\Windows\System\OSNhmEI.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\aXSbGCh.exe
  C:\Windows\System\aXSbGCh.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\BAethhq.exe
  C:\Windows\System\BAethhq.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\rTuGYgH.exe
  C:\Windows\System\rTuGYgH.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\chODUJT.exe
  C:\Windows\System\chODUJT.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\RQFuiaU.exe
  C:\Windows\System\RQFuiaU.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\uvVMMXp.exe
  C:\Windows\System\uvVMMXp.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\RaVPVzZ.exe
  C:\Windows\System\RaVPVzZ.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\nfvQRcP.exe
  C:\Windows\System\nfvQRcP.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\LgyCmIp.exe
  C:\Windows\System\LgyCmIp.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\NfuTaHF.exe
  C:\Windows\System\NfuTaHF.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\xIokIfk.exe
  C:\Windows\System\xIokIfk.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\mepPWkW.exe
  C:\Windows\System\mepPWkW.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\KVXnSgJ.exe
  C:\Windows\System\KVXnSgJ.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\aKhqdWP.exe
  C:\Windows\System\aKhqdWP.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\BhWaFut.exe
  C:\Windows\System\BhWaFut.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\PYIpahV.exe
  C:\Windows\System\PYIpahV.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\ajEuorH.exe
  C:\Windows\System\ajEuorH.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\vWXMAWA.exe
  C:\Windows\System\vWXMAWA.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\tUPmbVi.exe
  C:\Windows\System\tUPmbVi.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\FZnXqIq.exe
  C:\Windows\System\FZnXqIq.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\LZLyJaU.exe
  C:\Windows\System\LZLyJaU.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\fmQGtlS.exe
  C:\Windows\System\fmQGtlS.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\ENdYCYz.exe
  C:\Windows\System\ENdYCYz.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\QDWaGuF.exe
  C:\Windows\System\QDWaGuF.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\OGskCwB.exe
  C:\Windows\System\OGskCwB.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\uwwlHni.exe
  C:\Windows\System\uwwlHni.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\sXWnxzO.exe
  C:\Windows\System\sXWnxzO.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\bmZjAyU.exe
  C:\Windows\System\bmZjAyU.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\FFXpeAm.exe
  C:\Windows\System\FFXpeAm.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\zLgXNiY.exe
  C:\Windows\System\zLgXNiY.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\OJgsLin.exe
  C:\Windows\System\OJgsLin.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\CDMRYII.exe
  C:\Windows\System\CDMRYII.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\NojpFdN.exe
  C:\Windows\System\NojpFdN.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\dopdKXC.exe
  C:\Windows\System\dopdKXC.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\KQHWtAX.exe
  C:\Windows\System\KQHWtAX.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\SBeamjy.exe
  C:\Windows\System\SBeamjy.exe
  2⤵
  PID:1644
- C:\Windows\System\cfpmuyj.exe
  C:\Windows\System\cfpmuyj.exe
  2⤵
  PID:4764
- C:\Windows\System\CGBqpNb.exe
  C:\Windows\System\CGBqpNb.exe
  2⤵
  PID:3760
- C:\Windows\System\pJoDGzP.exe
  C:\Windows\System\pJoDGzP.exe
  2⤵
  PID:220
- C:\Windows\System\kNgaCSC.exe
  C:\Windows\System\kNgaCSC.exe
  2⤵
  PID:3276
- C:\Windows\System\gGyTUkZ.exe
  C:\Windows\System\gGyTUkZ.exe
  2⤵
  PID:4020
- C:\Windows\System\tWqAHmX.exe
  C:\Windows\System\tWqAHmX.exe
  2⤵
  PID:3668
- C:\Windows\System\HTPztXo.exe
  C:\Windows\System\HTPztXo.exe
  2⤵
  PID:4304
- C:\Windows\System\dUJfloy.exe
  C:\Windows\System\dUJfloy.exe
  2⤵
  PID:3332
- C:\Windows\System\HhsYcvc.exe
  C:\Windows\System\HhsYcvc.exe
  2⤵
  PID:1020
- C:\Windows\System\kUGmfqV.exe
  C:\Windows\System\kUGmfqV.exe
  2⤵
  PID:3396
- C:\Windows\System\nYtnRWD.exe
  C:\Windows\System\nYtnRWD.exe
  2⤵
  PID:4704
- C:\Windows\System\VHvydlD.exe
  C:\Windows\System\VHvydlD.exe
  2⤵
  PID:4684
- C:\Windows\System\VfpYJoi.exe
  C:\Windows\System\VfpYJoi.exe
  2⤵
  PID:4456
- C:\Windows\System\AjeCaDa.exe
  C:\Windows\System\AjeCaDa.exe
  2⤵
  PID:4656
- C:\Windows\System\WMooKkP.exe
  C:\Windows\System\WMooKkP.exe
  2⤵
  PID:3580
- C:\Windows\System\NsSGbdi.exe
  C:\Windows\System\NsSGbdi.exe
  2⤵
  PID:3640
- C:\Windows\System\OPsmMfL.exe
  C:\Windows\System\OPsmMfL.exe
  2⤵
  PID:4948
- C:\Windows\System\zEPPjiN.exe
  C:\Windows\System\zEPPjiN.exe
  2⤵
  PID:4944
- C:\Windows\System\ZggkfTm.exe
  C:\Windows\System\ZggkfTm.exe
  2⤵
  PID:1592
- C:\Windows\System\mzRQAOh.exe
  C:\Windows\System\mzRQAOh.exe
  2⤵
  PID:3388
- C:\Windows\System\mrCZbPS.exe
  C:\Windows\System\mrCZbPS.exe
  2⤵
  PID:216
- C:\Windows\System\sShSFej.exe
  C:\Windows\System\sShSFej.exe
  2⤵
  PID:2568
- C:\Windows\System\VETcVMi.exe
  C:\Windows\System\VETcVMi.exe
  2⤵
  PID:4400
- C:\Windows\System\FdvGzWq.exe
  C:\Windows\System\FdvGzWq.exe
  2⤵
  PID:4464
- C:\Windows\System\FqedgmN.exe
  C:\Windows\System\FqedgmN.exe
  2⤵
  PID:3432
- C:\Windows\System\ZajLndi.exe
  C:\Windows\System\ZajLndi.exe
  2⤵
  PID:1328
- C:\Windows\System\NyyQbuL.exe
  C:\Windows\System\NyyQbuL.exe
  2⤵
  PID:2680
- C:\Windows\System\vMkvnyJ.exe
  C:\Windows\System\vMkvnyJ.exe
  2⤵
  PID:5012
- C:\Windows\System\yXUszaD.exe
  C:\Windows\System\yXUszaD.exe
  2⤵
  PID:4768
- C:\Windows\System\BUAXfWy.exe
  C:\Windows\System\BUAXfWy.exe
  2⤵
  PID:508
- C:\Windows\System\gljKxQE.exe
  C:\Windows\System\gljKxQE.exe
  2⤵
  PID:4184
- C:\Windows\System\OMMCsEQ.exe
  C:\Windows\System\OMMCsEQ.exe
  2⤵
  PID:3756
- C:\Windows\System\zpoRJWS.exe
  C:\Windows\System\zpoRJWS.exe
  2⤵
  PID:884
- C:\Windows\System\hrVASjt.exe
  C:\Windows\System\hrVASjt.exe
  2⤵
  PID:1052
- C:\Windows\System\AvCfzwH.exe
  C:\Windows\System\AvCfzwH.exe
  2⤵
  PID:3812
- C:\Windows\System\PwqThAQ.exe
  C:\Windows\System\PwqThAQ.exe
  2⤵
  PID:3660
- C:\Windows\System\kgkqVvg.exe
  C:\Windows\System\kgkqVvg.exe
  2⤵
  PID:856
- C:\Windows\System\mLTJmfS.exe
  C:\Windows\System\mLTJmfS.exe
  2⤵
  PID:2104
- C:\Windows\System\iqDEgtq.exe
  C:\Windows\System\iqDEgtq.exe
  2⤵
  PID:208
- C:\Windows\System\HFLhAmi.exe
  C:\Windows\System\HFLhAmi.exe
  2⤵
  PID:2632
- C:\Windows\System\gAcyQSo.exe
  C:\Windows\System\gAcyQSo.exe
  2⤵
  PID:1120
- C:\Windows\System\lMNFkce.exe
  C:\Windows\System\lMNFkce.exe
  2⤵
  PID:3256
- C:\Windows\System\UqFcMGv.exe
  C:\Windows\System\UqFcMGv.exe
  2⤵
  PID:4524
- C:\Windows\System\mUZOtiM.exe
  C:\Windows\System\mUZOtiM.exe
  2⤵
  PID:3000
- C:\Windows\System\kqlAtwQ.exe
  C:\Windows\System\kqlAtwQ.exe
  2⤵
  PID:4436
- C:\Windows\System\JNeHRDl.exe
  C:\Windows\System\JNeHRDl.exe
  2⤵
  PID:4832
- C:\Windows\System\EWsMqjx.exe
  C:\Windows\System\EWsMqjx.exe
  2⤵
  PID:5136
- C:\Windows\System\acogylb.exe
  C:\Windows\System\acogylb.exe
  2⤵
  PID:5160
- C:\Windows\System\WhBBYnb.exe
  C:\Windows\System\WhBBYnb.exe
  2⤵
  PID:5188
- C:\Windows\System\wGStuBd.exe
  C:\Windows\System\wGStuBd.exe
  2⤵
  PID:5204
- C:\Windows\System\SVXESCG.exe
  C:\Windows\System\SVXESCG.exe
  2⤵
  PID:5232
- C:\Windows\System\fifwyni.exe
  C:\Windows\System\fifwyni.exe
  2⤵
  PID:5272
- C:\Windows\System\fGAqmKM.exe
  C:\Windows\System\fGAqmKM.exe
  2⤵
  PID:5296
- C:\Windows\System\xVZaErE.exe
  C:\Windows\System\xVZaErE.exe
  2⤵
  PID:5324
- C:\Windows\System\JIylWKw.exe
  C:\Windows\System\JIylWKw.exe
  2⤵
  PID:5352
- C:\Windows\System\NmTQccJ.exe
  C:\Windows\System\NmTQccJ.exe
  2⤵
  PID:5380
- C:\Windows\System\EUipiUn.exe
  C:\Windows\System\EUipiUn.exe
  2⤵
  PID:5400
- C:\Windows\System\cAVAees.exe
  C:\Windows\System\cAVAees.exe
  2⤵
  PID:5432
- C:\Windows\System\rTzurVK.exe
  C:\Windows\System\rTzurVK.exe
  2⤵
  PID:5464
- C:\Windows\System\qhBjcLk.exe
  C:\Windows\System\qhBjcLk.exe
  2⤵
  PID:5492
- C:\Windows\System\hEbOLDW.exe
  C:\Windows\System\hEbOLDW.exe
  2⤵
  PID:5520
- C:\Windows\System\jTQvkvM.exe
  C:\Windows\System\jTQvkvM.exe
  2⤵
  PID:5548
- C:\Windows\System\dowIkrQ.exe
  C:\Windows\System\dowIkrQ.exe
  2⤵
  PID:5576
- C:\Windows\System\puRbsex.exe
  C:\Windows\System\puRbsex.exe
  2⤵
  PID:5604
- C:\Windows\System\VEqwsOQ.exe
  C:\Windows\System\VEqwsOQ.exe
  2⤵
  PID:5660
- C:\Windows\System\oNjKYGu.exe
  C:\Windows\System\oNjKYGu.exe
  2⤵
  PID:5676
- C:\Windows\System\eRWmvgK.exe
  C:\Windows\System\eRWmvgK.exe
  2⤵
  PID:5700
- C:\Windows\System\MQZCMlN.exe
  C:\Windows\System\MQZCMlN.exe
  2⤵
  PID:5720
- C:\Windows\System\DBMadjy.exe
  C:\Windows\System\DBMadjy.exe
  2⤵
  PID:5752
- C:\Windows\System\yfBjHof.exe
  C:\Windows\System\yfBjHof.exe
  2⤵
  PID:5784
- C:\Windows\System\mcAjRut.exe
  C:\Windows\System\mcAjRut.exe
  2⤵
  PID:5824
- C:\Windows\System\ZrFhwfy.exe
  C:\Windows\System\ZrFhwfy.exe
  2⤵
  PID:5852
- C:\Windows\System\pvtcEvs.exe
  C:\Windows\System\pvtcEvs.exe
  2⤵
  PID:5884
- C:\Windows\System\ZgNAMjc.exe
  C:\Windows\System\ZgNAMjc.exe
  2⤵
  PID:5912
- C:\Windows\System\fteytvk.exe
  C:\Windows\System\fteytvk.exe
  2⤵
  PID:5928
- C:\Windows\System\fCRzZPg.exe
  C:\Windows\System\fCRzZPg.exe
  2⤵
  PID:5960
- C:\Windows\System\UWoCuDa.exe
  C:\Windows\System\UWoCuDa.exe
  2⤵
  PID:5988
- C:\Windows\System\LctkyoN.exe
  C:\Windows\System\LctkyoN.exe
  2⤵
  PID:6012
- C:\Windows\System\SoZACAu.exe
  C:\Windows\System\SoZACAu.exe
  2⤵
  PID:6032
- C:\Windows\System\ZyXqCKh.exe
  C:\Windows\System\ZyXqCKh.exe
  2⤵
  PID:6052
- C:\Windows\System\fuoiDBI.exe
  C:\Windows\System\fuoiDBI.exe
  2⤵
  PID:6072
- C:\Windows\System\vIaewyW.exe
  C:\Windows\System\vIaewyW.exe
  2⤵
  PID:6092
- C:\Windows\System\kXvXTVv.exe
  C:\Windows\System\kXvXTVv.exe
  2⤵
  PID:6116
- C:\Windows\System\pgFsOBK.exe
  C:\Windows\System\pgFsOBK.exe
  2⤵
  PID:4408
- C:\Windows\System\pqrjJRe.exe
  C:\Windows\System\pqrjJRe.exe
  2⤵
  PID:928
- C:\Windows\System\GNAhHUc.exe
  C:\Windows\System\GNAhHUc.exe
  2⤵
  PID:4988
- C:\Windows\System\JhjROkC.exe
  C:\Windows\System\JhjROkC.exe
  2⤵
  PID:5316
- C:\Windows\System\OlcETim.exe
  C:\Windows\System\OlcETim.exe
  2⤵
  PID:5284
- C:\Windows\System\dwbMetS.exe
  C:\Windows\System\dwbMetS.exe
  2⤵
  PID:5416
- C:\Windows\System\nKXzaBr.exe
  C:\Windows\System\nKXzaBr.exe
  2⤵
  PID:5396
- C:\Windows\System\NtLXPLA.exe
  C:\Windows\System\NtLXPLA.exe
  2⤵
  PID:5504
- C:\Windows\System\FRyVgRb.exe
  C:\Windows\System\FRyVgRb.exe
  2⤵
  PID:5584
- C:\Windows\System\KcDKWJD.exe
  C:\Windows\System\KcDKWJD.exe
  2⤵
  PID:5640
- C:\Windows\System\NJaAzel.exe
  C:\Windows\System\NJaAzel.exe
  2⤵
  PID:5672
- C:\Windows\System\wvCuKJC.exe
  C:\Windows\System\wvCuKJC.exe
  2⤵
  PID:5820
- C:\Windows\System\jcHaQWJ.exe
  C:\Windows\System\jcHaQWJ.exe
  2⤵
  PID:5892
- C:\Windows\System\TxyzPvC.exe
  C:\Windows\System\TxyzPvC.exe
  2⤵
  PID:5944
- C:\Windows\System\aZcIFJX.exe
  C:\Windows\System\aZcIFJX.exe
  2⤵
  PID:6004
- C:\Windows\System\LKQBXZD.exe
  C:\Windows\System\LKQBXZD.exe
  2⤵
  PID:6112
- C:\Windows\System\MpqBlhD.exe
  C:\Windows\System\MpqBlhD.exe
  2⤵
  PID:2728
- C:\Windows\System\RVSzdyW.exe
  C:\Windows\System\RVSzdyW.exe
  2⤵
  PID:5240
- C:\Windows\System\ThkpvqC.exe
  C:\Windows\System\ThkpvqC.exe
  2⤵
  PID:5196
- C:\Windows\System\sviIIch.exe
  C:\Windows\System\sviIIch.exe
  2⤵
  PID:5512
- C:\Windows\System\TtyYAHB.exe
  C:\Windows\System\TtyYAHB.exe
  2⤵
  PID:5744
- C:\Windows\System\yUIshFM.exe
  C:\Windows\System\yUIshFM.exe
  2⤵
  PID:5728
- C:\Windows\System\CtQFjwl.exe
  C:\Windows\System\CtQFjwl.exe
  2⤵
  PID:5776
- C:\Windows\System\PEAxYhH.exe
  C:\Windows\System\PEAxYhH.exe
  2⤵
  PID:5156
- C:\Windows\System\zuJDlQg.exe
  C:\Windows\System\zuJDlQg.exe
  2⤵
  PID:6136
- C:\Windows\System\LzCXrlL.exe
  C:\Windows\System\LzCXrlL.exe
  2⤵
  PID:5564
- C:\Windows\System\TQldkQG.exe
  C:\Windows\System\TQldkQG.exe
  2⤵
  PID:6068
- C:\Windows\System\lYhKUjM.exe
  C:\Windows\System\lYhKUjM.exe
  2⤵
  PID:5924
- C:\Windows\System\gESTXyz.exe
  C:\Windows\System\gESTXyz.exe
  2⤵
  PID:6152
- C:\Windows\System\aTTNklj.exe
  C:\Windows\System\aTTNklj.exe
  2⤵
  PID:6184
- C:\Windows\System\TlGRzaF.exe
  C:\Windows\System\TlGRzaF.exe
  2⤵
  PID:6208
- C:\Windows\System\LiayQrQ.exe
  C:\Windows\System\LiayQrQ.exe
  2⤵
  PID:6236
- C:\Windows\System\cZCmSQP.exe
  C:\Windows\System\cZCmSQP.exe
  2⤵
  PID:6272
- C:\Windows\System\UcNmGQZ.exe
  C:\Windows\System\UcNmGQZ.exe
  2⤵
  PID:6300
- C:\Windows\System\yMSanjw.exe
  C:\Windows\System\yMSanjw.exe
  2⤵
  PID:6328
- C:\Windows\System\QAgmjTr.exe
  C:\Windows\System\QAgmjTr.exe
  2⤵
  PID:6356
- C:\Windows\System\iHiUtNZ.exe
  C:\Windows\System\iHiUtNZ.exe
  2⤵
  PID:6384
- C:\Windows\System\UbTKNxM.exe
  C:\Windows\System\UbTKNxM.exe
  2⤵
  PID:6408
- C:\Windows\System\KdRivIV.exe
  C:\Windows\System\KdRivIV.exe
  2⤵
  PID:6436
- C:\Windows\System\PyfKkkb.exe
  C:\Windows\System\PyfKkkb.exe
  2⤵
  PID:6464
- C:\Windows\System\fGhhxOL.exe
  C:\Windows\System\fGhhxOL.exe
  2⤵
  PID:6484
- C:\Windows\System\ExReHPG.exe
  C:\Windows\System\ExReHPG.exe
  2⤵
  PID:6512
- C:\Windows\System\tvrzbfM.exe
  C:\Windows\System\tvrzbfM.exe
  2⤵
  PID:6540
- C:\Windows\System\JQHvWzb.exe
  C:\Windows\System\JQHvWzb.exe
  2⤵
  PID:6564
- C:\Windows\System\VIPDMQP.exe
  C:\Windows\System\VIPDMQP.exe
  2⤵
  PID:6592
- C:\Windows\System\MjFamHe.exe
  C:\Windows\System\MjFamHe.exe
  2⤵
  PID:6616
- C:\Windows\System\YPfiyoS.exe
  C:\Windows\System\YPfiyoS.exe
  2⤵
  PID:6640
- C:\Windows\System\neEmWcL.exe
  C:\Windows\System\neEmWcL.exe
  2⤵
  PID:6672
- C:\Windows\System\KiZzxdr.exe
  C:\Windows\System\KiZzxdr.exe
  2⤵
  PID:6700
- C:\Windows\System\eBeKVGs.exe
  C:\Windows\System\eBeKVGs.exe
  2⤵
  PID:6728
- C:\Windows\System\XdhEupP.exe
  C:\Windows\System\XdhEupP.exe
  2⤵
  PID:6752
- C:\Windows\System\jBsMJmq.exe
  C:\Windows\System\jBsMJmq.exe
  2⤵
  PID:6784
- C:\Windows\System\pHLideU.exe
  C:\Windows\System\pHLideU.exe
  2⤵
  PID:6812
- C:\Windows\System\gPIVbVM.exe
  C:\Windows\System\gPIVbVM.exe
  2⤵
  PID:6836
- C:\Windows\System\HTQqFxo.exe
  C:\Windows\System\HTQqFxo.exe
  2⤵
  PID:6868
- C:\Windows\System\WgoEisI.exe
  C:\Windows\System\WgoEisI.exe
  2⤵
  PID:6896
- C:\Windows\System\OQbUEuS.exe
  C:\Windows\System\OQbUEuS.exe
  2⤵
  PID:6928
- C:\Windows\System\ODMTFuE.exe
  C:\Windows\System\ODMTFuE.exe
  2⤵
  PID:6956
- C:\Windows\System\XKJMTEf.exe
  C:\Windows\System\XKJMTEf.exe
  2⤵
  PID:6984
- C:\Windows\System\gXsxjCm.exe
  C:\Windows\System\gXsxjCm.exe
  2⤵
  PID:7036
- C:\Windows\System\ccxEaGm.exe
  C:\Windows\System\ccxEaGm.exe
  2⤵
  PID:7052
- C:\Windows\System\qAilSHa.exe
  C:\Windows\System\qAilSHa.exe
  2⤵
  PID:7080
- C:\Windows\System\tbwlRAQ.exe
  C:\Windows\System\tbwlRAQ.exe
  2⤵
  PID:7108
- C:\Windows\System\uySxsqm.exe
  C:\Windows\System\uySxsqm.exe
  2⤵
  PID:7136
- C:\Windows\System\PELJXFo.exe
  C:\Windows\System\PELJXFo.exe
  2⤵
  PID:5364
- C:\Windows\System\sCQGNud.exe
  C:\Windows\System\sCQGNud.exe
  2⤵
  PID:5940
- C:\Windows\System\TUsWbEY.exe
  C:\Windows\System\TUsWbEY.exe
  2⤵
  PID:6288
- C:\Windows\System\KYenTaQ.exe
  C:\Windows\System\KYenTaQ.exe
  2⤵
  PID:6344
- C:\Windows\System\LrKcNQN.exe
  C:\Windows\System\LrKcNQN.exe
  2⤵
  PID:6248
- C:\Windows\System\KwIPXtg.exe
  C:\Windows\System\KwIPXtg.exe
  2⤵
  PID:6376
- C:\Windows\System\qESXhZs.exe
  C:\Windows\System\qESXhZs.exe
  2⤵
  PID:6508
- C:\Windows\System\RQtAmox.exe
  C:\Windows\System\RQtAmox.exe
  2⤵
  PID:6556
- C:\Windows\System\ZOLPYRN.exe
  C:\Windows\System\ZOLPYRN.exe
  2⤵
  PID:6636
- C:\Windows\System\JKDGqDP.exe
  C:\Windows\System\JKDGqDP.exe
  2⤵
  PID:6692
- C:\Windows\System\cQRjRxW.exe
  C:\Windows\System\cQRjRxW.exe
  2⤵
  PID:6684
- C:\Windows\System\QsdmObJ.exe
  C:\Windows\System\QsdmObJ.exe
  2⤵
  PID:6744
- C:\Windows\System\ppeBDrM.exe
  C:\Windows\System\ppeBDrM.exe
  2⤵
  PID:6776
- C:\Windows\System\EouClFZ.exe
  C:\Windows\System\EouClFZ.exe
  2⤵
  PID:6884
- C:\Windows\System\kzxwHIY.exe
  C:\Windows\System\kzxwHIY.exe
  2⤵
  PID:6908
- C:\Windows\System\KpqdMca.exe
  C:\Windows\System\KpqdMca.exe
  2⤵
  PID:7128
- C:\Windows\System\rpyHkcO.exe
  C:\Windows\System\rpyHkcO.exe
  2⤵
  PID:7048
- C:\Windows\System\qfMzDXS.exe
  C:\Windows\System\qfMzDXS.exe
  2⤵
  PID:5536
- C:\Windows\System\kUuULZx.exe
  C:\Windows\System\kUuULZx.exe
  2⤵
  PID:6316
- C:\Windows\System\oLTRQdY.exe
  C:\Windows\System\oLTRQdY.exe
  2⤵
  PID:6688
- C:\Windows\System\XKyqmcS.exe
  C:\Windows\System\XKyqmcS.exe
  2⤵
  PID:6548
- C:\Windows\System\fqTnqmd.exe
  C:\Windows\System\fqTnqmd.exe
  2⤵
  PID:6584
- C:\Windows\System\FNZVJlZ.exe
  C:\Windows\System\FNZVJlZ.exe
  2⤵
  PID:6452
- C:\Windows\System\iTNvyvq.exe
  C:\Windows\System\iTNvyvq.exe
  2⤵
  PID:7184
- C:\Windows\System\BTDhYEc.exe
  C:\Windows\System\BTDhYEc.exe
  2⤵
  PID:7204
- C:\Windows\System\BQgtfdl.exe
  C:\Windows\System\BQgtfdl.exe
  2⤵
  PID:7220
- C:\Windows\System\cFSwMwJ.exe
  C:\Windows\System\cFSwMwJ.exe
  2⤵
  PID:7244
- C:\Windows\System\vZIofPs.exe
  C:\Windows\System\vZIofPs.exe
  2⤵
  PID:7264
- C:\Windows\System\hCFZaWm.exe
  C:\Windows\System\hCFZaWm.exe
  2⤵
  PID:7288
- C:\Windows\System\EVnESgv.exe
  C:\Windows\System\EVnESgv.exe
  2⤵
  PID:7316
- C:\Windows\System\UUlUgEd.exe
  C:\Windows\System\UUlUgEd.exe
  2⤵
  PID:7340
- C:\Windows\System\vYGrogx.exe
  C:\Windows\System\vYGrogx.exe
  2⤵
  PID:7368
- C:\Windows\System\yWAxVvB.exe
  C:\Windows\System\yWAxVvB.exe
  2⤵
  PID:7404
- C:\Windows\System\EWvxVUh.exe
  C:\Windows\System\EWvxVUh.exe
  2⤵
  PID:7432
- C:\Windows\System\YtIMwlQ.exe
  C:\Windows\System\YtIMwlQ.exe
  2⤵
  PID:7456
- C:\Windows\System\YPsEnFX.exe
  C:\Windows\System\YPsEnFX.exe
  2⤵
  PID:7484
- C:\Windows\System\vJCJgBD.exe
  C:\Windows\System\vJCJgBD.exe
  2⤵
  PID:7512
- C:\Windows\System\OpOvYwS.exe
  C:\Windows\System\OpOvYwS.exe
  2⤵
  PID:7544
- C:\Windows\System\KKjYUvm.exe
  C:\Windows\System\KKjYUvm.exe
  2⤵
  PID:7576
- C:\Windows\System\DjXYMGO.exe
  C:\Windows\System\DjXYMGO.exe
  2⤵
  PID:7604
- C:\Windows\System\ymjbFTk.exe
  C:\Windows\System\ymjbFTk.exe
  2⤵
  PID:7636
- C:\Windows\System\LgvjEzZ.exe
  C:\Windows\System\LgvjEzZ.exe
  2⤵
  PID:7664
- C:\Windows\System\qQihPlf.exe
  C:\Windows\System\qQihPlf.exe
  2⤵
  PID:7696
- C:\Windows\System\iuBdcUW.exe
  C:\Windows\System\iuBdcUW.exe
  2⤵
  PID:7716
- C:\Windows\System\ooXAhcb.exe
  C:\Windows\System\ooXAhcb.exe
  2⤵
  PID:7744
- C:\Windows\System\QeGlkSs.exe
  C:\Windows\System\QeGlkSs.exe
  2⤵
  PID:7772
- C:\Windows\System\VRKzPwu.exe
  C:\Windows\System\VRKzPwu.exe
  2⤵
  PID:7800
- C:\Windows\System\PUjKqnk.exe
  C:\Windows\System\PUjKqnk.exe
  2⤵
  PID:7828
- C:\Windows\System\yoQLmeb.exe
  C:\Windows\System\yoQLmeb.exe
  2⤵
  PID:7860
- C:\Windows\System\sutdpTq.exe
  C:\Windows\System\sutdpTq.exe
  2⤵
  PID:7888
- C:\Windows\System\XgpsCqg.exe
  C:\Windows\System\XgpsCqg.exe
  2⤵
  PID:7924
- C:\Windows\System\GtqAFng.exe
  C:\Windows\System\GtqAFng.exe
  2⤵
  PID:7952
- C:\Windows\System\JVBpjQc.exe
  C:\Windows\System\JVBpjQc.exe
  2⤵
  PID:7980
- C:\Windows\System\WviqmMx.exe
  C:\Windows\System\WviqmMx.exe
  2⤵
  PID:8004
- C:\Windows\System\edwotQR.exe
  C:\Windows\System\edwotQR.exe
  2⤵
  PID:8036
- C:\Windows\System\Icffgki.exe
  C:\Windows\System\Icffgki.exe
  2⤵
  PID:8056
- C:\Windows\System\LQupHSd.exe
  C:\Windows\System\LQupHSd.exe
  2⤵
  PID:8080
- C:\Windows\System\AJcyWXG.exe
  C:\Windows\System\AJcyWXG.exe
  2⤵
  PID:8096
- C:\Windows\System\edSbqzA.exe
  C:\Windows\System\edSbqzA.exe
  2⤵
  PID:8128
- C:\Windows\System\TqHNXKe.exe
  C:\Windows\System\TqHNXKe.exe
  2⤵
  PID:8156
- C:\Windows\System\nEQNzau.exe
  C:\Windows\System\nEQNzau.exe
  2⤵
  PID:8188
- C:\Windows\System\DCsJVjY.exe
  C:\Windows\System\DCsJVjY.exe
  2⤵
  PID:6880
- C:\Windows\System\UVUchvS.exe
  C:\Windows\System\UVUchvS.exe
  2⤵
  PID:7144
- C:\Windows\System\hHitGVU.exe
  C:\Windows\System\hHitGVU.exe
  2⤵
  PID:6172
- C:\Windows\System\SjFBwer.exe
  C:\Windows\System\SjFBwer.exe
  2⤵
  PID:7324
- C:\Windows\System\KEazqSm.exe
  C:\Windows\System\KEazqSm.exe
  2⤵
  PID:7216
- C:\Windows\System\tRUtVIv.exe
  C:\Windows\System\tRUtVIv.exe
  2⤵
  PID:7300
- C:\Windows\System\hbIlDYC.exe
  C:\Windows\System\hbIlDYC.exe
  2⤵
  PID:7440
- C:\Windows\System\ECoOdie.exe
  C:\Windows\System\ECoOdie.exe
  2⤵
  PID:7384
- C:\Windows\System\AfWqMyO.exe
  C:\Windows\System\AfWqMyO.exe
  2⤵
  PID:7556
- C:\Windows\System\Tqjzbvp.exe
  C:\Windows\System\Tqjzbvp.exe
  2⤵
  PID:7692
- C:\Windows\System\kNIfWPA.exe
  C:\Windows\System\kNIfWPA.exe
  2⤵
  PID:7652
- C:\Windows\System\rmrNgLI.exe
  C:\Windows\System\rmrNgLI.exe
  2⤵
  PID:7724
- C:\Windows\System\glkdUAM.exe
  C:\Windows\System\glkdUAM.exe
  2⤵
  PID:7796
- C:\Windows\System\XHZIlLO.exe
  C:\Windows\System\XHZIlLO.exe
  2⤵
  PID:7856
- C:\Windows\System\XNOXuDg.exe
  C:\Windows\System\XNOXuDg.exe
  2⤵
  PID:7988
- C:\Windows\System\VnyCbXV.exe
  C:\Windows\System\VnyCbXV.exe
  2⤵
  PID:7964
- C:\Windows\System\bGhgbcO.exe
  C:\Windows\System\bGhgbcO.exe
  2⤵
  PID:8176
- C:\Windows\System\wMhZgMz.exe
  C:\Windows\System\wMhZgMz.exe
  2⤵
  PID:8048
- C:\Windows\System\MCxrLvA.exe
  C:\Windows\System\MCxrLvA.exe
  2⤵
  PID:8108
- C:\Windows\System\PPgmbbW.exe
  C:\Windows\System\PPgmbbW.exe
  2⤵
  PID:7096
- C:\Windows\System\GzPFDUZ.exe
  C:\Windows\System\GzPFDUZ.exe
  2⤵
  PID:6220
- C:\Windows\System\UAlIofm.exe
  C:\Windows\System\UAlIofm.exe
  2⤵
  PID:7380
- C:\Windows\System\pWyqLTA.exe
  C:\Windows\System\pWyqLTA.exe
  2⤵
  PID:7452
- C:\Windows\System\ecGWJTO.exe
  C:\Windows\System\ecGWJTO.exe
  2⤵
  PID:7520
- C:\Windows\System\Rzdebfu.exe
  C:\Windows\System\Rzdebfu.exe
  2⤵
  PID:7976
- C:\Windows\System\OxhFQzu.exe
  C:\Windows\System\OxhFQzu.exe
  2⤵
  PID:8088
- C:\Windows\System\pnKghFQ.exe
  C:\Windows\System\pnKghFQ.exe
  2⤵
  PID:7480
- C:\Windows\System\VIcWKIZ.exe
  C:\Windows\System\VIcWKIZ.exe
  2⤵
  PID:8116
- C:\Windows\System\rmHpxIu.exe
  C:\Windows\System\rmHpxIu.exe
  2⤵
  PID:8212
- C:\Windows\System\pbHyOzz.exe
  C:\Windows\System\pbHyOzz.exe
  2⤵
  PID:8236
- C:\Windows\System\rdhnJtg.exe
  C:\Windows\System\rdhnJtg.exe
  2⤵
  PID:8264
- C:\Windows\System\CcooCJf.exe
  C:\Windows\System\CcooCJf.exe
  2⤵
  PID:8292
- C:\Windows\System\IixkNor.exe
  C:\Windows\System\IixkNor.exe
  2⤵
  PID:8316
- C:\Windows\System\muTjlLV.exe
  C:\Windows\System\muTjlLV.exe
  2⤵
  PID:8336
- C:\Windows\System\XvyCZPc.exe
  C:\Windows\System\XvyCZPc.exe
  2⤵
  PID:8360
- C:\Windows\System\uLdTEbE.exe
  C:\Windows\System\uLdTEbE.exe
  2⤵
  PID:8396
- C:\Windows\System\cKJdFwX.exe
  C:\Windows\System\cKJdFwX.exe
  2⤵
  PID:8416
- C:\Windows\System\lufMuXB.exe
  C:\Windows\System\lufMuXB.exe
  2⤵
  PID:8444
- C:\Windows\System\KdLKMYD.exe
  C:\Windows\System\KdLKMYD.exe
  2⤵
  PID:8468
- C:\Windows\System\jUyMQwb.exe
  C:\Windows\System\jUyMQwb.exe
  2⤵
  PID:8512
- C:\Windows\System\tmwQGTw.exe
  C:\Windows\System\tmwQGTw.exe
  2⤵
  PID:8556
- C:\Windows\System\IpQOMIA.exe
  C:\Windows\System\IpQOMIA.exe
  2⤵
  PID:8580
- C:\Windows\System\mgsFgPh.exe
  C:\Windows\System\mgsFgPh.exe
  2⤵
  PID:8612
- C:\Windows\System\KRHtIpN.exe
  C:\Windows\System\KRHtIpN.exe
  2⤵
  PID:8640
- C:\Windows\System\GwJPPee.exe
  C:\Windows\System\GwJPPee.exe
  2⤵
  PID:8668
- C:\Windows\System\LyqxBDw.exe
  C:\Windows\System\LyqxBDw.exe
  2⤵
  PID:8696
- C:\Windows\System\ywJQiuR.exe
  C:\Windows\System\ywJQiuR.exe
  2⤵
  PID:8728
- C:\Windows\System\ahHUUci.exe
  C:\Windows\System\ahHUUci.exe
  2⤵
  PID:8760
- C:\Windows\System\WsvMNBb.exe
  C:\Windows\System\WsvMNBb.exe
  2⤵
  PID:8784
- C:\Windows\System\rZLLFML.exe
  C:\Windows\System\rZLLFML.exe
  2⤵
  PID:8808
- C:\Windows\System\IoWTXxS.exe
  C:\Windows\System\IoWTXxS.exe
  2⤵
  PID:8832
- C:\Windows\System\DEJEfET.exe
  C:\Windows\System\DEJEfET.exe
  2⤵
  PID:8860
- C:\Windows\System\ekcCsja.exe
  C:\Windows\System\ekcCsja.exe
  2⤵
  PID:8892
- C:\Windows\System\fBCxwxd.exe
  C:\Windows\System\fBCxwxd.exe
  2⤵
  PID:8916
- C:\Windows\System\qTnNMhq.exe
  C:\Windows\System\qTnNMhq.exe
  2⤵
  PID:8944
- C:\Windows\System\UAHWnFE.exe
  C:\Windows\System\UAHWnFE.exe
  2⤵
  PID:8968
- C:\Windows\System\JCXbpIn.exe
  C:\Windows\System\JCXbpIn.exe
  2⤵
  PID:9000
- C:\Windows\System\rCcGdVW.exe
  C:\Windows\System\rCcGdVW.exe
  2⤵
  PID:9024
- C:\Windows\System\bgiZZfn.exe
  C:\Windows\System\bgiZZfn.exe
  2⤵
  PID:9052
- C:\Windows\System\SIRjefh.exe
  C:\Windows\System\SIRjefh.exe
  2⤵
  PID:9068
- C:\Windows\System\RYRrYwd.exe
  C:\Windows\System\RYRrYwd.exe
  2⤵
  PID:9084
- C:\Windows\System\tePUrij.exe
  C:\Windows\System\tePUrij.exe
  2⤵
  PID:9120
- C:\Windows\System\THMKLKv.exe
  C:\Windows\System\THMKLKv.exe
  2⤵
  PID:9148
- C:\Windows\System\BBfbXps.exe
  C:\Windows\System\BBfbXps.exe
  2⤵
  PID:9172
- C:\Windows\System\eWQdzcT.exe
  C:\Windows\System\eWQdzcT.exe
  2⤵
  PID:9200
- C:\Windows\System\pWvMWvt.exe
  C:\Windows\System\pWvMWvt.exe
  2⤵
  PID:7564
- C:\Windows\System\PkjaOEp.exe
  C:\Windows\System\PkjaOEp.exe
  2⤵
  PID:7912
- C:\Windows\System\zZtKtZK.exe
  C:\Windows\System\zZtKtZK.exe
  2⤵
  PID:7844
- C:\Windows\System\zWRHZFK.exe
  C:\Windows\System\zWRHZFK.exe
  2⤵
  PID:7784
- C:\Windows\System\NDhOMjU.exe
  C:\Windows\System\NDhOMjU.exe
  2⤵
  PID:7356
- C:\Windows\System\WYtHLcw.exe
  C:\Windows\System\WYtHLcw.exe
  2⤵
  PID:8200
- C:\Windows\System\oiiXeXi.exe
  C:\Windows\System\oiiXeXi.exe
  2⤵
  PID:8276
- C:\Windows\System\ZGYZYYx.exe
  C:\Windows\System\ZGYZYYx.exe
  2⤵
  PID:8440
- C:\Windows\System\BTgXFOM.exe
  C:\Windows\System\BTgXFOM.exe
  2⤵
  PID:8376
- C:\Windows\System\cPohvWB.exe
  C:\Windows\System\cPohvWB.exe
  2⤵
  PID:8652
- C:\Windows\System\KANQbxE.exe
  C:\Windows\System\KANQbxE.exe
  2⤵
  PID:8772
- C:\Windows\System\KJQpUgd.exe
  C:\Windows\System\KJQpUgd.exe
  2⤵
  PID:8600
- C:\Windows\System\KESTikZ.exe
  C:\Windows\System\KESTikZ.exe
  2⤵
  PID:8932
- C:\Windows\System\bkCDmvQ.exe
  C:\Windows\System\bkCDmvQ.exe
  2⤵
  PID:8852
- C:\Windows\System\aSrFdvh.exe
  C:\Windows\System\aSrFdvh.exe
  2⤵
  PID:8856
- C:\Windows\System\AvfrEQX.exe
  C:\Windows\System\AvfrEQX.exe
  2⤵
  PID:9160
- C:\Windows\System\qEghFdq.exe
  C:\Windows\System\qEghFdq.exe
  2⤵
  PID:8956
- C:\Windows\System\awxcPZM.exe
  C:\Windows\System\awxcPZM.exe
  2⤵
  PID:9020
- C:\Windows\System\ypcAGMK.exe
  C:\Windows\System\ypcAGMK.exe
  2⤵
  PID:9104
- C:\Windows\System\ZMjpwsy.exe
  C:\Windows\System\ZMjpwsy.exe
  2⤵
  PID:9212
- C:\Windows\System\UhInGgu.exe
  C:\Windows\System\UhInGgu.exe
  2⤵
  PID:8428
- C:\Windows\System\gJhzCeJ.exe
  C:\Windows\System\gJhzCeJ.exe
  2⤵
  PID:8528
- C:\Windows\System\NvzsNGV.exe
  C:\Windows\System\NvzsNGV.exe
  2⤵
  PID:8588
- C:\Windows\System\BsZVDaw.exe
  C:\Windows\System\BsZVDaw.exe
  2⤵
  PID:8660
- C:\Windows\System\IbAdlaM.exe
  C:\Windows\System\IbAdlaM.exe
  2⤵
  PID:8928
- C:\Windows\System\bsDPORI.exe
  C:\Windows\System\bsDPORI.exe
  2⤵
  PID:9080
- C:\Windows\System\XPEXBCT.exe
  C:\Windows\System\XPEXBCT.exe
  2⤵
  PID:9236
- C:\Windows\System\IKqPQiN.exe
  C:\Windows\System\IKqPQiN.exe
  2⤵
  PID:9260
- C:\Windows\System\BqwJNlD.exe
  C:\Windows\System\BqwJNlD.exe
  2⤵
  PID:9280
- C:\Windows\System\MMmOCQh.exe
  C:\Windows\System\MMmOCQh.exe
  2⤵
  PID:9320
- C:\Windows\System\iEPuUwv.exe
  C:\Windows\System\iEPuUwv.exe
  2⤵
  PID:9344
- C:\Windows\System\tWTIXuN.exe
  C:\Windows\System\tWTIXuN.exe
  2⤵
  PID:9364
- C:\Windows\System\OibvdMG.exe
  C:\Windows\System\OibvdMG.exe
  2⤵
  PID:9392
- C:\Windows\System\zfvPEaG.exe
  C:\Windows\System\zfvPEaG.exe
  2⤵
  PID:9416
- C:\Windows\System\oXUefQw.exe
  C:\Windows\System\oXUefQw.exe
  2⤵
  PID:9440
- C:\Windows\System\wzcISTZ.exe
  C:\Windows\System\wzcISTZ.exe
  2⤵
  PID:9472
- C:\Windows\System\KcHyGLu.exe
  C:\Windows\System\KcHyGLu.exe
  2⤵
  PID:9500
- C:\Windows\System\ZGpHDgo.exe
  C:\Windows\System\ZGpHDgo.exe
  2⤵
  PID:9524
- C:\Windows\System\vlnuuen.exe
  C:\Windows\System\vlnuuen.exe
  2⤵
  PID:9560
- C:\Windows\System\OzdVdIk.exe
  C:\Windows\System\OzdVdIk.exe
  2⤵
  PID:9584
- C:\Windows\System\rPbFfBT.exe
  C:\Windows\System\rPbFfBT.exe
  2⤵
  PID:9612
- C:\Windows\System\ZbeXLjt.exe
  C:\Windows\System\ZbeXLjt.exe
  2⤵
  PID:9644
- C:\Windows\System\QrfkEDf.exe
  C:\Windows\System\QrfkEDf.exe
  2⤵
  PID:9672
- C:\Windows\System\MAlQAsN.exe
  C:\Windows\System\MAlQAsN.exe
  2⤵
  PID:9704
- C:\Windows\System\HBXrBQF.exe
  C:\Windows\System\HBXrBQF.exe
  2⤵
  PID:9728
- C:\Windows\System\fVYeAFV.exe
  C:\Windows\System\fVYeAFV.exe
  2⤵
  PID:9756
- C:\Windows\System\YbMqsbr.exe
  C:\Windows\System\YbMqsbr.exe
  2⤵
  PID:9788
- C:\Windows\System\OMVDWCi.exe
  C:\Windows\System\OMVDWCi.exe
  2⤵
  PID:9808
- C:\Windows\System\oZnwaSI.exe
  C:\Windows\System\oZnwaSI.exe
  2⤵
  PID:9844
- C:\Windows\System\TIuaziI.exe
  C:\Windows\System\TIuaziI.exe
  2⤵
  PID:9872
- C:\Windows\System\qwVgczs.exe
  C:\Windows\System\qwVgczs.exe
  2⤵
  PID:9888
- C:\Windows\System\PzAKADF.exe
  C:\Windows\System\PzAKADF.exe
  2⤵
  PID:9904
- C:\Windows\System\LrcxLzc.exe
  C:\Windows\System\LrcxLzc.exe
  2⤵
  PID:9932
- C:\Windows\System\cZXSCdt.exe
  C:\Windows\System\cZXSCdt.exe
  2⤵
  PID:9968
- C:\Windows\System\vzCVwdC.exe
  C:\Windows\System\vzCVwdC.exe
  2⤵
  PID:9996
- C:\Windows\System\hUPETpF.exe
  C:\Windows\System\hUPETpF.exe
  2⤵
  PID:10020
- C:\Windows\System\qaqklqI.exe
  C:\Windows\System\qaqklqI.exe
  2⤵
  PID:10052
- C:\Windows\System\AeWFmNP.exe
  C:\Windows\System\AeWFmNP.exe
  2⤵
  PID:10076
- C:\Windows\System\TUKsoBp.exe
  C:\Windows\System\TUKsoBp.exe
  2⤵
  PID:10096
- C:\Windows\System\DEGyIXk.exe
  C:\Windows\System\DEGyIXk.exe
  2⤵
  PID:10120
- C:\Windows\System\vflmZjE.exe
  C:\Windows\System\vflmZjE.exe
  2⤵
  PID:10148
- C:\Windows\System\OsXHOPU.exe
  C:\Windows\System\OsXHOPU.exe
  2⤵
  PID:10176
- C:\Windows\System\zTDwbOJ.exe
  C:\Windows\System\zTDwbOJ.exe
  2⤵
  PID:10200
- C:\Windows\System\RKCBNSH.exe
  C:\Windows\System\RKCBNSH.exe
  2⤵
  PID:10220
- C:\Windows\System\YmRDFQR.exe
  C:\Windows\System\YmRDFQR.exe
  2⤵
  PID:8880
- C:\Windows\System\IPUGITs.exe
  C:\Windows\System\IPUGITs.exe
  2⤵
  PID:9076
- C:\Windows\System\FrbHlsO.exe
  C:\Windows\System\FrbHlsO.exe
  2⤵
  PID:8232
- C:\Windows\System\NVIhJYM.exe
  C:\Windows\System\NVIhJYM.exe
  2⤵
  PID:8688
- C:\Windows\System\ambVZuo.exe
  C:\Windows\System\ambVZuo.exe
  2⤵
  PID:7880
- C:\Windows\System\QFUQjFD.exe
  C:\Windows\System\QFUQjFD.exe
  2⤵
  PID:9224
- C:\Windows\System\MjuhJfJ.exe
  C:\Windows\System\MjuhJfJ.exe
  2⤵
  PID:9268
- C:\Windows\System\HAoIAEM.exe
  C:\Windows\System\HAoIAEM.exe
  2⤵
  PID:9636
- C:\Windows\System\aGqrfdv.exe
  C:\Windows\System\aGqrfdv.exe
  2⤵
  PID:9520
- C:\Windows\System\iaMUfgx.exe
  C:\Windows\System\iaMUfgx.exe
  2⤵
  PID:9412
- C:\Windows\System\HSxyWQU.exe
  C:\Windows\System\HSxyWQU.exe
  2⤵
  PID:9452
- C:\Windows\System\gqqUtAY.exe
  C:\Windows\System\gqqUtAY.exe
  2⤵
  PID:9656
- C:\Windows\System\QWXgERn.exe
  C:\Windows\System\QWXgERn.exe
  2⤵
  PID:9580
- C:\Windows\System\FmsIFJJ.exe
  C:\Windows\System\FmsIFJJ.exe
  2⤵
  PID:9956
- C:\Windows\System\iTAScBo.exe
  C:\Windows\System\iTAScBo.exe
  2⤵
  PID:9980
- C:\Windows\System\nQbeJVF.exe
  C:\Windows\System\nQbeJVF.exe
  2⤵
  PID:9880
- C:\Windows\System\tvdKeji.exe
  C:\Windows\System\tvdKeji.exe
  2⤵
  PID:9800
- C:\Windows\System\LnhOGmj.exe
  C:\Windows\System\LnhOGmj.exe
  2⤵
  PID:9836
- C:\Windows\System\hjozsiz.exe
  C:\Windows\System\hjozsiz.exe
  2⤵
  PID:10068
- C:\Windows\System\ZtIYjXO.exe
  C:\Windows\System\ZtIYjXO.exe
  2⤵
  PID:10032
- C:\Windows\System\LnkYOgo.exe
  C:\Windows\System\LnkYOgo.exe
  2⤵
  PID:8348
- C:\Windows\System\VyBoVSW.exe
  C:\Windows\System\VyBoVSW.exe
  2⤵
  PID:10196
- C:\Windows\System\gYdUvEG.exe
  C:\Windows\System\gYdUvEG.exe
  2⤵
  PID:9232
- C:\Windows\System\SrwordT.exe
  C:\Windows\System\SrwordT.exe
  2⤵
  PID:9332
- C:\Windows\System\rRGaTya.exe
  C:\Windows\System\rRGaTya.exe
  2⤵
  PID:9044
- C:\Windows\System\wPRotRj.exe
  C:\Windows\System\wPRotRj.exe
  2⤵
  PID:9372
- C:\Windows\System\CiiJfgx.exe
  C:\Windows\System\CiiJfgx.exe
  2⤵
  PID:9468
- C:\Windows\System\tuZIRjW.exe
  C:\Windows\System\tuZIRjW.exe
  2⤵
  PID:10256
- C:\Windows\System\taHvCyK.exe
  C:\Windows\System\taHvCyK.exe
  2⤵
  PID:10276
- C:\Windows\System\LeNgXYT.exe
  C:\Windows\System\LeNgXYT.exe
  2⤵
  PID:10304
- C:\Windows\System\mYMBMVF.exe
  C:\Windows\System\mYMBMVF.exe
  2⤵
  PID:10336
- C:\Windows\System\EWmkcIf.exe
  C:\Windows\System\EWmkcIf.exe
  2⤵
  PID:10364
- C:\Windows\System\weWWwtk.exe
  C:\Windows\System\weWWwtk.exe
  2⤵
  PID:10388
- C:\Windows\System\WsVKVry.exe
  C:\Windows\System\WsVKVry.exe
  2⤵
  PID:10420
- C:\Windows\System\biSxhqk.exe
  C:\Windows\System\biSxhqk.exe
  2⤵
  PID:10448
- C:\Windows\System\LxoZVNY.exe
  C:\Windows\System\LxoZVNY.exe
  2⤵
  PID:10480
- C:\Windows\System\mUHPYPd.exe
  C:\Windows\System\mUHPYPd.exe
  2⤵
  PID:10504
- C:\Windows\System\SKKGfyi.exe
  C:\Windows\System\SKKGfyi.exe
  2⤵
  PID:10532
- C:\Windows\System\vLZRyEN.exe
  C:\Windows\System\vLZRyEN.exe
  2⤵
  PID:10572
- C:\Windows\System\ZydCfiH.exe
  C:\Windows\System\ZydCfiH.exe
  2⤵
  PID:10608
- C:\Windows\System\UlJDHny.exe
  C:\Windows\System\UlJDHny.exe
  2⤵
  PID:10636
- C:\Windows\System\kmsfHvp.exe
  C:\Windows\System\kmsfHvp.exe
  2⤵
  PID:10664
- C:\Windows\System\UxhSCjq.exe
  C:\Windows\System\UxhSCjq.exe
  2⤵
  PID:10700
- C:\Windows\System\CSNEGtI.exe
  C:\Windows\System\CSNEGtI.exe
  2⤵
  PID:10728
- C:\Windows\System\zZEzPID.exe
  C:\Windows\System\zZEzPID.exe
  2⤵
  PID:10756
- C:\Windows\System\xNFVFdu.exe
  C:\Windows\System\xNFVFdu.exe
  2⤵
  PID:10788
- C:\Windows\System\eumOPlz.exe
  C:\Windows\System\eumOPlz.exe
  2⤵
  PID:10820
- C:\Windows\System\nobaHIL.exe
  C:\Windows\System\nobaHIL.exe
  2⤵
  PID:10848
- C:\Windows\System\ObWYiVW.exe
  C:\Windows\System\ObWYiVW.exe
  2⤵
  PID:10868
- C:\Windows\System\bOLQkng.exe
  C:\Windows\System\bOLQkng.exe
  2⤵
  PID:10900
- C:\Windows\System\bmAtQgh.exe
  C:\Windows\System\bmAtQgh.exe
  2⤵
  PID:10932
- C:\Windows\System\NfdLtqz.exe
  C:\Windows\System\NfdLtqz.exe
  2⤵
  PID:10968
- C:\Windows\System\OlKXQtu.exe
  C:\Windows\System\OlKXQtu.exe
  2⤵
  PID:10996
- C:\Windows\System\zDJDhJF.exe
  C:\Windows\System\zDJDhJF.exe
  2⤵
  PID:11020
- C:\Windows\System\NYyqPlb.exe
  C:\Windows\System\NYyqPlb.exe
  2⤵
  PID:11044
- C:\Windows\System\TJNRdzE.exe
  C:\Windows\System\TJNRdzE.exe
  2⤵
  PID:11076
- C:\Windows\System\LtrSQFm.exe
  C:\Windows\System\LtrSQFm.exe
  2⤵
  PID:11108
- C:\Windows\System\mFODuql.exe
  C:\Windows\System\mFODuql.exe
  2⤵
  PID:11132
- C:\Windows\System\xGxitUJ.exe
  C:\Windows\System\xGxitUJ.exe
  2⤵
  PID:11168
- C:\Windows\System\PhwgaiZ.exe
  C:\Windows\System\PhwgaiZ.exe
  2⤵
  PID:11200
- C:\Windows\System\hiEvlAJ.exe
  C:\Windows\System\hiEvlAJ.exe
  2⤵
  PID:11232
- C:\Windows\System\dnaHxyW.exe
  C:\Windows\System\dnaHxyW.exe
  2⤵
  PID:11252
- C:\Windows\System\pPUSazl.exe
  C:\Windows\System\pPUSazl.exe
  2⤵
  PID:9896
- C:\Windows\System\HtDJiFD.exe
  C:\Windows\System\HtDJiFD.exe
  2⤵
  PID:9460
- C:\Windows\System\kmZHNOl.exe
  C:\Windows\System\kmZHNOl.exe
  2⤵
  PID:10172
- C:\Windows\System\NLmAPgV.exe
  C:\Windows\System\NLmAPgV.exe
  2⤵
  PID:10140
- C:\Windows\System\ZPRHxVi.exe
  C:\Windows\System\ZPRHxVi.exe
  2⤵
  PID:10008
- C:\Windows\System\qagwLVp.exe
  C:\Windows\System\qagwLVp.exe
  2⤵
  PID:10136
- C:\Windows\System\qWtSzHW.exe
  C:\Windows\System\qWtSzHW.exe
  2⤵
  PID:8456
- C:\Windows\System\ANyLKnn.exe
  C:\Windows\System\ANyLKnn.exe
  2⤵
  PID:10404
- C:\Windows\System\XNGeOmy.exe
  C:\Windows\System\XNGeOmy.exe
  2⤵
  PID:10652
- C:\Windows\System\ORfPoAw.exe
  C:\Windows\System\ORfPoAw.exe
  2⤵
  PID:10300
- C:\Windows\System\DmQoYeC.exe
  C:\Windows\System\DmQoYeC.exe
  2⤵
  PID:10352
- C:\Windows\System\RLIGnJU.exe
  C:\Windows\System\RLIGnJU.exe
  2⤵
  PID:10436
- C:\Windows\System\iLRplJl.exe
  C:\Windows\System\iLRplJl.exe
  2⤵
  PID:10492
- C:\Windows\System\OJUdgKG.exe
  C:\Windows\System\OJUdgKG.exe
  2⤵
  PID:10520
- C:\Windows\System\CRsQxAz.exe
  C:\Windows\System\CRsQxAz.exe
  2⤵
  PID:10808
- C:\Windows\System\AcRhokK.exe
  C:\Windows\System\AcRhokK.exe
  2⤵
  PID:10720
- C:\Windows\System\dEqlNzR.exe
  C:\Windows\System\dEqlNzR.exe
  2⤵
  PID:10740
- C:\Windows\System\vHKdRrz.exe
  C:\Windows\System\vHKdRrz.exe
  2⤵
  PID:11188
- C:\Windows\System\eZRLOLC.exe
  C:\Windows\System\eZRLOLC.exe
  2⤵
  PID:10916
- C:\Windows\System\JTSPRGo.exe
  C:\Windows\System\JTSPRGo.exe
  2⤵
  PID:11160
- C:\Windows\System\PDFemxx.exe
  C:\Windows\System\PDFemxx.exe
  2⤵
  PID:11004
- C:\Windows\System\XwVsjCV.exe
  C:\Windows\System\XwVsjCV.exe
  2⤵
  PID:11040
- C:\Windows\System\qGtbgjB.exe
  C:\Windows\System\qGtbgjB.exe
  2⤵
  PID:9780
- C:\Windows\System\vzVVjXg.exe
  C:\Windows\System\vzVVjXg.exe
  2⤵
  PID:11244
- C:\Windows\System\uJrmrMq.exe
  C:\Windows\System\uJrmrMq.exe
  2⤵
  PID:10456
- C:\Windows\System\BihszKe.exe
  C:\Windows\System\BihszKe.exe
  2⤵
  PID:11272
- C:\Windows\System\guSCYvs.exe
  C:\Windows\System\guSCYvs.exe
  2⤵
  PID:11296
- C:\Windows\System\aqAHxDg.exe
  C:\Windows\System\aqAHxDg.exe
  2⤵
  PID:11320
- C:\Windows\System\HYbWowU.exe
  C:\Windows\System\HYbWowU.exe
  2⤵
  PID:11352
- C:\Windows\System\CsiCXsj.exe
  C:\Windows\System\CsiCXsj.exe
  2⤵
  PID:11380
- C:\Windows\System\NnlXZuw.exe
  C:\Windows\System\NnlXZuw.exe
  2⤵
  PID:11400
- C:\Windows\System\YrmrcFZ.exe
  C:\Windows\System\YrmrcFZ.exe
  2⤵
  PID:11424
- C:\Windows\System\JKlrRtG.exe
  C:\Windows\System\JKlrRtG.exe
  2⤵
  PID:11452
- C:\Windows\System\okBsaMR.exe
  C:\Windows\System\okBsaMR.exe
  2⤵
  PID:11472
- C:\Windows\System\LdUecMH.exe
  C:\Windows\System\LdUecMH.exe
  2⤵
  PID:11504
- C:\Windows\System\dPbfbot.exe
  C:\Windows\System\dPbfbot.exe
  2⤵
  PID:11536
- C:\Windows\System\MILznJZ.exe
  C:\Windows\System\MILznJZ.exe
  2⤵
  PID:11556
- C:\Windows\System\GAAcqqj.exe
  C:\Windows\System\GAAcqqj.exe
  2⤵
  PID:11580
- C:\Windows\System\qMnVTiT.exe
  C:\Windows\System\qMnVTiT.exe
  2⤵
  PID:11612
- C:\Windows\System\dqNAeIc.exe
  C:\Windows\System\dqNAeIc.exe
  2⤵
  PID:11644
- C:\Windows\System\SxLXDtR.exe
  C:\Windows\System\SxLXDtR.exe
  2⤵
  PID:11668
- C:\Windows\System\GMHHUxs.exe
  C:\Windows\System\GMHHUxs.exe
  2⤵
  PID:11688
- C:\Windows\System\nNqyqzi.exe
  C:\Windows\System\nNqyqzi.exe
  2⤵
  PID:11716
- C:\Windows\System\OHvyhNf.exe
  C:\Windows\System\OHvyhNf.exe
  2⤵
  PID:11744
- C:\Windows\System\RWdVhtJ.exe
  C:\Windows\System\RWdVhtJ.exe
  2⤵
  PID:11768
- C:\Windows\System\zlBWWtF.exe
  C:\Windows\System\zlBWWtF.exe
  2⤵
  PID:11788
- C:\Windows\System\zzmqqLM.exe
  C:\Windows\System\zzmqqLM.exe
  2⤵
  PID:11816
- C:\Windows\System\JImwamU.exe
  C:\Windows\System\JImwamU.exe
  2⤵
  PID:11844
- C:\Windows\System\QaMFynC.exe
  C:\Windows\System\QaMFynC.exe
  2⤵
  PID:11868
- C:\Windows\System\GALJTrD.exe
  C:\Windows\System\GALJTrD.exe
  2⤵
  PID:11900
- C:\Windows\System\JFrZepV.exe
  C:\Windows\System\JFrZepV.exe
  2⤵
  PID:11928
- C:\Windows\System\VwkryOP.exe
  C:\Windows\System\VwkryOP.exe
  2⤵
  PID:11956
- C:\Windows\System\xEJezlH.exe
  C:\Windows\System\xEJezlH.exe
  2⤵
  PID:11984
- C:\Windows\System\hsWeETH.exe
  C:\Windows\System\hsWeETH.exe
  2⤵
  PID:12008
- C:\Windows\System\pdJfDGm.exe
  C:\Windows\System\pdJfDGm.exe
  2⤵
  PID:12036
- C:\Windows\System\dzqQDLt.exe
  C:\Windows\System\dzqQDLt.exe
  2⤵
  PID:12060
- C:\Windows\System\UCyJYbi.exe
  C:\Windows\System\UCyJYbi.exe
  2⤵
  PID:12084
- C:\Windows\System\HlhHmqk.exe
  C:\Windows\System\HlhHmqk.exe
  2⤵
  PID:12116
- C:\Windows\System\RPGNPJx.exe
  C:\Windows\System\RPGNPJx.exe
  2⤵
  PID:12136
- C:\Windows\System\TdnXLyq.exe
  C:\Windows\System\TdnXLyq.exe
  2⤵
  PID:12168
- C:\Windows\System\UDoDnFi.exe
  C:\Windows\System\UDoDnFi.exe
  2⤵
  PID:12196
- C:\Windows\System\cLHLNok.exe
  C:\Windows\System\cLHLNok.exe
  2⤵
  PID:12220
- C:\Windows\System\aunWPsw.exe
  C:\Windows\System\aunWPsw.exe
  2⤵
  PID:12236
- C:\Windows\System\rGOQYFR.exe
  C:\Windows\System\rGOQYFR.exe
  2⤵
  PID:12268
- C:\Windows\System\bvlbGfg.exe
  C:\Windows\System\bvlbGfg.exe
  2⤵
  PID:10416
- C:\Windows\System\qDvhvlQ.exe
  C:\Windows\System\qDvhvlQ.exe
  2⤵
  PID:10840
- C:\Windows\System\WIobsJC.exe
  C:\Windows\System\WIobsJC.exe
  2⤵
  PID:10212
- C:\Windows\System\awYMocC.exe
  C:\Windows\System\awYMocC.exe
  2⤵
  PID:10556
- C:\Windows\System\jvckxfT.exe
  C:\Windows\System\jvckxfT.exe
  2⤵
  PID:10324
- C:\Windows\System\KXEuTud.exe
  C:\Windows\System\KXEuTud.exe
  2⤵
  PID:9384
- C:\Windows\System\GDQqvoD.exe
  C:\Windows\System\GDQqvoD.exe
  2⤵
  PID:10724
- C:\Windows\System\RMCpVCA.exe
  C:\Windows\System\RMCpVCA.exe
  2⤵
  PID:10780
- C:\Windows\System\iwOlgYa.exe
  C:\Windows\System\iwOlgYa.exe
  2⤵
  PID:11288
- C:\Windows\System\HFAbnuZ.exe
  C:\Windows\System\HFAbnuZ.exe
  2⤵
  PID:11192
- C:\Windows\System\HQoQpxW.exe
  C:\Windows\System\HQoQpxW.exe
  2⤵
  PID:3016
- C:\Windows\System\zsKZmVu.exe
  C:\Windows\System\zsKZmVu.exe
  2⤵
  PID:11372
- C:\Windows\System\KUHHDPS.exe
  C:\Windows\System\KUHHDPS.exe
  2⤵
  PID:11408
- C:\Windows\System\bcnYVwm.exe
  C:\Windows\System\bcnYVwm.exe
  2⤵
  PID:11552
- C:\Windows\System\PtzpPHB.exe
  C:\Windows\System\PtzpPHB.exe
  2⤵
  PID:11392
- C:\Windows\System\dYweqkY.exe
  C:\Windows\System\dYweqkY.exe
  2⤵
  PID:11440
- C:\Windows\System\ZPsaTox.exe
  C:\Windows\System\ZPsaTox.exe
  2⤵
  PID:11524
- C:\Windows\System\UaTYdbK.exe
  C:\Windows\System\UaTYdbK.exe
  2⤵
  PID:12108
- C:\Windows\System\IGQDKXT.exe
  C:\Windows\System\IGQDKXT.exe
  2⤵
  PID:11600
- C:\Windows\System\JhctTxY.exe
  C:\Windows\System\JhctTxY.exe
  2⤵
  PID:11892
- C:\Windows\System\auaRvhL.exe
  C:\Windows\System\auaRvhL.exe
  2⤵
  PID:12212
- C:\Windows\System\asCGRPr.exe
  C:\Windows\System\asCGRPr.exe
  2⤵
  PID:11992
- C:\Windows\System\xzGAjRV.exe
  C:\Windows\System\xzGAjRV.exe
  2⤵
  PID:11736
- C:\Windows\System\vXnSENz.exe
  C:\Windows\System\vXnSENz.exe
  2⤵
  PID:12100
- C:\Windows\System\soVmdgZ.exe
  C:\Windows\System\soVmdgZ.exe
  2⤵
  PID:11480
- C:\Windows\System\NcFneYG.exe
  C:\Windows\System\NcFneYG.exe
  2⤵
  PID:11940
- C:\Windows\System\XOgrhys.exe
  C:\Windows\System\XOgrhys.exe
  2⤵
  PID:10884
- C:\Windows\System\DnAwHNY.exe
  C:\Windows\System\DnAwHNY.exe
  2⤵
  PID:12300
- C:\Windows\System\xNPwJlE.exe
  C:\Windows\System\xNPwJlE.exe
  2⤵
  PID:12332
- C:\Windows\System\KDHDzTW.exe
  C:\Windows\System\KDHDzTW.exe
  2⤵
  PID:12364
- C:\Windows\System\hlZJmyc.exe
  C:\Windows\System\hlZJmyc.exe
  2⤵
  PID:12392
- C:\Windows\System\iYiuBfU.exe
  C:\Windows\System\iYiuBfU.exe
  2⤵
  PID:12420
- C:\Windows\System\lxuLQFi.exe
  C:\Windows\System\lxuLQFi.exe
  2⤵
  PID:12440
- C:\Windows\System\SligXxg.exe
  C:\Windows\System\SligXxg.exe
  2⤵
  PID:12464
- C:\Windows\System\gLIiOAW.exe
  C:\Windows\System\gLIiOAW.exe
  2⤵
  PID:12492
- C:\Windows\System\EKJqDgn.exe
  C:\Windows\System\EKJqDgn.exe
  2⤵
  PID:12516
- C:\Windows\System\WROqcaK.exe
  C:\Windows\System\WROqcaK.exe
  2⤵
  PID:12544
- C:\Windows\System\IwBBNCU.exe
  C:\Windows\System\IwBBNCU.exe
  2⤵
  PID:12568
- C:\Windows\System\ymFOcYz.exe
  C:\Windows\System\ymFOcYz.exe
  2⤵
  PID:12588
- C:\Windows\System\JkLioIz.exe
  C:\Windows\System\JkLioIz.exe
  2⤵
  PID:12628
- C:\Windows\System\RVGfeUR.exe
  C:\Windows\System\RVGfeUR.exe
  2⤵
  PID:12652
- C:\Windows\System\zuLJZBR.exe
  C:\Windows\System\zuLJZBR.exe
  2⤵
  PID:12676
- C:\Windows\System\XtFIMrO.exe
  C:\Windows\System\XtFIMrO.exe
  2⤵
  PID:12700
- C:\Windows\System\MFnzAnc.exe
  C:\Windows\System\MFnzAnc.exe
  2⤵
  PID:12728
- C:\Windows\System\khFMzXc.exe
  C:\Windows\System\khFMzXc.exe
  2⤵
  PID:12756
- C:\Windows\System\VRaOrsc.exe
  C:\Windows\System\VRaOrsc.exe
  2⤵
  PID:12776
- C:\Windows\System\uWpSXhw.exe
  C:\Windows\System\uWpSXhw.exe
  2⤵
  PID:12808
- C:\Windows\System\nuYHqBu.exe
  C:\Windows\System\nuYHqBu.exe
  2⤵
  PID:12832
- C:\Windows\System\hbapYrT.exe
  C:\Windows\System\hbapYrT.exe
  2⤵
  PID:12860
- C:\Windows\System\yauInvt.exe
  C:\Windows\System\yauInvt.exe
  2⤵
  PID:12884
- C:\Windows\System\GufOOWg.exe
  C:\Windows\System\GufOOWg.exe
  2⤵
  PID:12908
- C:\Windows\System\UIGZvpo.exe
  C:\Windows\System\UIGZvpo.exe
  2⤵
  PID:12932
- C:\Windows\System\RlNXHIh.exe
  C:\Windows\System\RlNXHIh.exe
  2⤵
  PID:12960
- C:\Windows\System\mbYQpsp.exe
  C:\Windows\System\mbYQpsp.exe
  2⤵
  PID:12988
- C:\Windows\System\fGMFbdd.exe
  C:\Windows\System\fGMFbdd.exe
  2⤵
  PID:13016
- C:\Windows\System\jqNKICy.exe
  C:\Windows\System\jqNKICy.exe
  2⤵
  PID:13048
- C:\Windows\System\BhDWWRQ.exe
  C:\Windows\System\BhDWWRQ.exe
  2⤵
  PID:13068
- C:\Windows\System\AtFEbnc.exe
  C:\Windows\System\AtFEbnc.exe
  2⤵
  PID:13096
- C:\Windows\System\ARgQhiU.exe
  C:\Windows\System\ARgQhiU.exe
  2⤵
  PID:13124
- C:\Windows\System\wTtdyVh.exe
  C:\Windows\System\wTtdyVh.exe
  2⤵
  PID:13156
- C:\Windows\System\SEBhIWY.exe
  C:\Windows\System\SEBhIWY.exe
  2⤵
  PID:13176
- C:\Windows\System\EumpOJD.exe
  C:\Windows\System\EumpOJD.exe
  2⤵
  PID:13208
- C:\Windows\System\InLjOLF.exe
  C:\Windows\System\InLjOLF.exe
  2⤵
  PID:13240
- C:\Windows\System\KoGVuCE.exe
  C:\Windows\System\KoGVuCE.exe
  2⤵
  PID:13268
- C:\Windows\System\ExbCcPQ.exe
  C:\Windows\System\ExbCcPQ.exe
  2⤵
  PID:13292
- C:\Windows\System\zEVZYGS.exe
  C:\Windows\System\zEVZYGS.exe
  2⤵
  PID:12096
- C:\Windows\System\iKlDHZH.exe
  C:\Windows\System\iKlDHZH.exe
  2⤵
  PID:10768
- C:\Windows\System\rmHbnER.exe
  C:\Windows\System\rmHbnER.exe
  2⤵
  PID:11680
- C:\Windows\System\SNbqwOx.exe
  C:\Windows\System\SNbqwOx.exe
  2⤵
  PID:12256
- C:\Windows\System\HaluYpP.exe
  C:\Windows\System\HaluYpP.exe
  2⤵
  PID:11116
- C:\Windows\System\RJUQxDn.exe
  C:\Windows\System\RJUQxDn.exe
  2⤵
  PID:12264
- C:\Windows\System\ZWhTrGt.exe
  C:\Windows\System\ZWhTrGt.exe
  2⤵
  PID:11292
- C:\Windows\System\plzWnNd.exe
  C:\Windows\System\plzWnNd.exe
  2⤵
  PID:10984
- C:\Windows\System\uIoCeUu.exe
  C:\Windows\System\uIoCeUu.exe
  2⤵
  PID:11416
- C:\Windows\System\ANmdtIr.exe
  C:\Windows\System\ANmdtIr.exe
  2⤵
  PID:12320
- C:\Windows\System\gvLnWYG.exe
  C:\Windows\System\gvLnWYG.exe
  2⤵
  PID:12376
- C:\Windows\System\TrjWptc.exe
  C:\Windows\System\TrjWptc.exe
  2⤵
  PID:12408
- C:\Windows\System\YFrFHBJ.exe
  C:\Windows\System\YFrFHBJ.exe
  2⤵
  PID:12452
- C:\Windows\System\AyeVmdK.exe
  C:\Windows\System\AyeVmdK.exe
  2⤵
  PID:12512
- C:\Windows\System\LkSngdu.exe
  C:\Windows\System\LkSngdu.exe
  2⤵
  PID:12556
- C:\Windows\System\sHLaoMw.exe
  C:\Windows\System\sHLaoMw.exe
  2⤵
  PID:12048
- C:\Windows\System\DAboNvC.exe
  C:\Windows\System\DAboNvC.exe
  2⤵
  PID:12324
- C:\Windows\System\oLBQqxB.exe
  C:\Windows\System\oLBQqxB.exe
  2⤵
  PID:12944
- C:\Windows\System\yDOGibP.exe
  C:\Windows\System\yDOGibP.exe
  2⤵
  PID:12980
- C:\Windows\System\zJxQBuu.exe
  C:\Windows\System\zJxQBuu.exe
  2⤵
  PID:13004
- C:\Windows\System\clZrBMv.exe
  C:\Windows\System\clZrBMv.exe
  2⤵
  PID:12460
- C:\Windows\System\bAcDtnD.exe
  C:\Windows\System\bAcDtnD.exe
  2⤵
  PID:12796
- C:\Windows\System\xaEsiVq.exe
  C:\Windows\System\xaEsiVq.exe
  2⤵
  PID:12604
- C:\Windows\System\inNpcLe.exe
  C:\Windows\System\inNpcLe.exe
  2⤵
  PID:12668
- C:\Windows\System\oxwPZTK.exe
  C:\Windows\System\oxwPZTK.exe
  2⤵
  PID:12748
- C:\Windows\System\IhRgFVI.exe
  C:\Windows\System\IhRgFVI.exe
  2⤵
  PID:8596
- C:\Windows\System\zVcvfWn.exe
  C:\Windows\System\zVcvfWn.exe
  2⤵
  PID:13076
- C:\Windows\System\ZhViezo.exe
  C:\Windows\System\ZhViezo.exe
  2⤵
  PID:13116
- C:\Windows\System\WzMNpGv.exe
  C:\Windows\System\WzMNpGv.exe
  2⤵
  PID:13172
- C:\Windows\System\QZFlQUX.exe
  C:\Windows\System\QZFlQUX.exe
  2⤵
  PID:13332
- C:\Windows\System\yzBhhmk.exe
  C:\Windows\System\yzBhhmk.exe
  2⤵
  PID:13360
- C:\Windows\System\zVMhtsE.exe
  C:\Windows\System\zVMhtsE.exe
  2⤵
  PID:13384
- C:\Windows\System\iKWQPig.exe
  C:\Windows\System\iKWQPig.exe
  2⤵
  PID:13416
- C:\Windows\System\iUDWVtW.exe
  C:\Windows\System\iUDWVtW.exe
  2⤵
  PID:13916
- C:\Windows\System\KfxDBTH.exe
  C:\Windows\System\KfxDBTH.exe
  2⤵
  PID:13944
- C:\Windows\System\OJEihnA.exe
  C:\Windows\System\OJEihnA.exe
  2⤵
  PID:13980
- C:\Windows\System\CWashVs.exe
  C:\Windows\System\CWashVs.exe
  2⤵
  PID:14004
- C:\Windows\System\BJPsqJW.exe
  C:\Windows\System\BJPsqJW.exe
  2⤵
  PID:14048
- C:\Windows\System\fCbcvoC.exe
  C:\Windows\System\fCbcvoC.exe
  2⤵
  PID:14080
- C:\Windows\System\PamJHHO.exe
  C:\Windows\System\PamJHHO.exe
  2⤵
  PID:14112
- C:\Windows\System\fDvqmfi.exe
  C:\Windows\System\fDvqmfi.exe
  2⤵
  PID:14140
- C:\Windows\System\FsnvjtM.exe
  C:\Windows\System\FsnvjtM.exe
  2⤵
  PID:14156
- C:\Windows\System\VcbKVUf.exe
  C:\Windows\System\VcbKVUf.exe
  2⤵
  PID:14176
- C:\Windows\System\YwyvVSB.exe
  C:\Windows\System\YwyvVSB.exe
  2⤵
  PID:14196
- C:\Windows\System\VvgEiHv.exe
  C:\Windows\System\VvgEiHv.exe
  2⤵
  PID:14216
- C:\Windows\System\xRwRdqn.exe
  C:\Windows\System\xRwRdqn.exe
  2⤵
  PID:14240
- C:\Windows\System\ezmmScw.exe
  C:\Windows\System\ezmmScw.exe
  2⤵
  PID:14260
- C:\Windows\System\pOikrfH.exe
  C:\Windows\System\pOikrfH.exe
  2⤵
  PID:14288
- C:\Windows\System\cfDHyYT.exe
  C:\Windows\System\cfDHyYT.exe
  2⤵
  PID:14316
- C:\Windows\System\pOtnOgY.exe
  C:\Windows\System\pOtnOgY.exe
  2⤵
  PID:12880
- C:\Windows\System\mZlJpLM.exe
  C:\Windows\System\mZlJpLM.exe
  2⤵
  PID:12916
- C:\Windows\System\DdjEFkY.exe
  C:\Windows\System\DdjEFkY.exe
  2⤵
  PID:12736
- C:\Windows\System\VavgQgj.exe
  C:\Windows\System\VavgQgj.exe
  2⤵
  PID:12024
- C:\Windows\System\VsEtNUn.exe
  C:\Windows\System\VsEtNUn.exe
  2⤵
  PID:13152
- C:\Windows\System\cJzzxis.exe
  C:\Windows\System\cJzzxis.exe
  2⤵
  PID:12028
- C:\Windows\System\nuVyuhE.exe
  C:\Windows\System\nuVyuhE.exe
  2⤵
  PID:13280
- C:\Windows\System\XjvGAox.exe
  C:\Windows\System\XjvGAox.exe
  2⤵
  PID:11360
- C:\Windows\System\OKVeAEt.exe
  C:\Windows\System\OKVeAEt.exe
  2⤵
  PID:11832
- C:\Windows\System\AlnaKcf.exe
  C:\Windows\System\AlnaKcf.exe
  2⤵
  PID:11660
- C:\Windows\System\tcYDsZv.exe
  C:\Windows\System\tcYDsZv.exe
  2⤵
  PID:13344
- C:\Windows\System\DbackVQ.exe
  C:\Windows\System\DbackVQ.exe
  2⤵
  PID:12068
- C:\Windows\System\lRbqzFW.exe
  C:\Windows\System\lRbqzFW.exe
  2⤵
  PID:12352
- C:\Windows\System\zZkTEUw.exe
  C:\Windows\System\zZkTEUw.exe
  2⤵
  PID:13000
- C:\Windows\System\YLefHdo.exe
  C:\Windows\System\YLefHdo.exe
  2⤵
  PID:10548
- C:\Windows\System\CIjdkBI.exe
  C:\Windows\System\CIjdkBI.exe
  2⤵
  PID:13612
- C:\Windows\System\HblnFjl.exe
  C:\Windows\System\HblnFjl.exe
  2⤵
  PID:13380
- C:\Windows\System\vZPnnWe.exe
  C:\Windows\System\vZPnnWe.exe
  2⤵
  PID:13468
- C:\Windows\System\jDQnDeH.exe
  C:\Windows\System\jDQnDeH.exe
  2⤵
  PID:13516
- C:\Windows\System\HavNHkk.exe
  C:\Windows\System\HavNHkk.exe
  2⤵
  PID:13556
- C:\Windows\System\EZcfEqB.exe
  C:\Windows\System\EZcfEqB.exe
  2⤵
  PID:13792
- C:\Windows\System\BHzOuDy.exe
  C:\Windows\System\BHzOuDy.exe
  2⤵
  PID:13444
- C:\Windows\System\ryZtNOC.exe
  C:\Windows\System\ryZtNOC.exe
  2⤵
  PID:13912
- C:\Windows\System\emzOpwg.exe
  C:\Windows\System\emzOpwg.exe
  2⤵
  PID:13964
- C:\Windows\System\PhfaRQk.exe
  C:\Windows\System\PhfaRQk.exe
  2⤵
  PID:13932
- C:\Windows\System\SaifoKw.exe
  C:\Windows\System\SaifoKw.exe
  2⤵
  PID:13880
- C:\Windows\System\HZilKdL.exe
  C:\Windows\System\HZilKdL.exe
  2⤵
  PID:13992
- C:\Windows\System\BvzczFS.exe
  C:\Windows\System\BvzczFS.exe
  2⤵
  PID:14148
- C:\Windows\System\FItzneu.exe
  C:\Windows\System\FItzneu.exe
  2⤵
  PID:14120
- C:\Windows\System\MzjwuLh.exe
  C:\Windows\System\MzjwuLh.exe
  2⤵
  PID:14324
- C:\Windows\System\qgXLlnZ.exe
  C:\Windows\System\qgXLlnZ.exe
  2⤵
  PID:13236
- C:\Windows\System\sRWvUtW.exe
  C:\Windows\System\sRWvUtW.exe
  2⤵
  PID:14184
- C:\Windows\System\SilFNgT.exe
  C:\Windows\System\SilFNgT.exe
  2⤵
  PID:13264
- C:\Windows\System\GLpJLBw.exe
  C:\Windows\System\GLpJLBw.exe
  2⤵
  PID:10288
- C:\Windows\System\ViHfxol.exe
  C:\Windows\System\ViHfxol.exe
  2⤵
  PID:12904
- C:\Windows\System\qXPCifF.exe
  C:\Windows\System\qXPCifF.exe
  2⤵
  PID:14308
- C:\Windows\System\RvWMLLE.exe
  C:\Windows\System\RvWMLLE.exe
  2⤵
  PID:13448
- C:\Windows\System\MEfBTFG.exe
  C:\Windows\System\MEfBTFG.exe
  2⤵
  PID:12664
- C:\Windows\System\rAtlFuW.exe
  C:\Windows\System\rAtlFuW.exe
  2⤵
  PID:13404
- C:\Windows\System\HtFafnv.exe
  C:\Windows\System\HtFafnv.exe
  2⤵
  PID:14032
- C:\Windows\System\arFwBig.exe
  C:\Windows\System\arFwBig.exe
  2⤵
  PID:14212
- C:\Windows\System\nwsZsGI.exe
  C:\Windows\System\nwsZsGI.exe
  2⤵
  PID:12692
- C:\Windows\System\nQyIvLh.exe
  C:\Windows\System\nQyIvLh.exe
  2⤵
  PID:14172
- C:\Windows\System\pkLKIwz.exe
  C:\Windows\System\pkLKIwz.exe
  2⤵
  PID:14376
- C:\Windows\System\mpSTnGp.exe
  C:\Windows\System\mpSTnGp.exe
  2⤵
  PID:14404
- C:\Windows\System\IeapIfE.exe
  C:\Windows\System\IeapIfE.exe
  2⤵
  PID:14428
- C:\Windows\System\ifrdvml.exe
  C:\Windows\System\ifrdvml.exe
  2⤵
  PID:14448
- C:\Windows\System\vaglftR.exe
  C:\Windows\System\vaglftR.exe
  2⤵
  PID:14480
- C:\Windows\System\SREGTXq.exe
  C:\Windows\System\SREGTXq.exe
  2⤵
  PID:14504
- C:\Windows\System\sZpzgRu.exe
  C:\Windows\System\sZpzgRu.exe
  2⤵
  PID:14540
- C:\Windows\System\EgkVymP.exe
  C:\Windows\System\EgkVymP.exe
  2⤵
  PID:14568
- C:\Windows\System\IAwJCLK.exe
  C:\Windows\System\IAwJCLK.exe
  2⤵
  PID:14584
- C:\Windows\System\spFdutw.exe
  C:\Windows\System\spFdutw.exe
  2⤵
  PID:14616
- C:\Windows\System\jHSjgSu.exe
  C:\Windows\System\jHSjgSu.exe
  2⤵
  PID:14636
- C:\Windows\System\FcqFVNX.exe
  C:\Windows\System\FcqFVNX.exe
  2⤵
  PID:14664
- C:\Windows\System\YfhYKdF.exe
  C:\Windows\System\YfhYKdF.exe
  2⤵
  PID:14696
- C:\Windows\System\VWACtkR.exe
  C:\Windows\System\VWACtkR.exe
  2⤵
  PID:14716
- C:\Windows\System\etsfTPF.exe
  C:\Windows\System\etsfTPF.exe
  2⤵
  PID:14736
- C:\Windows\System\zaTqanC.exe
  C:\Windows\System\zaTqanC.exe
  2⤵
  PID:14764
- C:\Windows\System\mVisbAY.exe
  C:\Windows\System\mVisbAY.exe
  2⤵
  PID:14792
- C:\Windows\System\gGMWBzs.exe
  C:\Windows\System\gGMWBzs.exe
  2⤵
  PID:14812
- C:\Windows\System\noGVKVY.exe
  C:\Windows\System\noGVKVY.exe
  2⤵
  PID:14836
- C:\Windows\System\eBasrhC.exe
  C:\Windows\System\eBasrhC.exe
  2⤵
  PID:14856
- C:\Windows\System\skPjhqB.exe
  C:\Windows\System\skPjhqB.exe
  2⤵
  PID:14880
- C:\Windows\System\ilzIVEl.exe
  C:\Windows\System\ilzIVEl.exe
  2⤵
  PID:14908
- C:\Windows\System\IPszIom.exe
  C:\Windows\System\IPszIom.exe
  2⤵
  PID:14928
- C:\Windows\System\OMUCcsc.exe
  C:\Windows\System\OMUCcsc.exe
  2⤵
  PID:14948
- C:\Windows\System\hTGFgcj.exe
  C:\Windows\System\hTGFgcj.exe
  2⤵
  PID:14980
- C:\Windows\System\DsJwYDf.exe
  C:\Windows\System\DsJwYDf.exe
  2⤵
  PID:15004
- C:\Windows\System\KOARmbu.exe
  C:\Windows\System\KOARmbu.exe
  2⤵
  PID:15028
- C:\Windows\System\gLXUIJn.exe
  C:\Windows\System\gLXUIJn.exe
  2⤵
  PID:15056
- C:\Windows\System\cFTYgPe.exe
  C:\Windows\System\cFTYgPe.exe
  2⤵
  PID:15080
- C:\Windows\System\YJMZBrq.exe
  C:\Windows\System\YJMZBrq.exe
  2⤵
  PID:15104
- C:\Windows\System\MkSMElk.exe
  C:\Windows\System\MkSMElk.exe
  2⤵
  PID:15136
- C:\Windows\System\BOOJVVq.exe
  C:\Windows\System\BOOJVVq.exe
  2⤵
  PID:15160
- C:\Windows\System\TNHWcxr.exe
  C:\Windows\System\TNHWcxr.exe
  2⤵
  PID:15180
- C:\Windows\System\hsksJyg.exe
  C:\Windows\System\hsksJyg.exe
  2⤵
  PID:15196
- C:\Windows\System\xqVoJHg.exe
  C:\Windows\System\xqVoJHg.exe
  2⤵
  PID:15220
- C:\Windows\System\MHxSkyS.exe
  C:\Windows\System\MHxSkyS.exe
  2⤵
  PID:15244
- C:\Windows\System\ebaWoof.exe
  C:\Windows\System\ebaWoof.exe
  2⤵
  PID:15272
- C:\Windows\System\mvsvTpY.exe
  C:\Windows\System\mvsvTpY.exe
  2⤵
  PID:15296
- C:\Windows\System\OSLitkD.exe
  C:\Windows\System\OSLitkD.exe
  2⤵
  PID:15316
- C:\Windows\System\OYcMRvy.exe
  C:\Windows\System\OYcMRvy.exe
  2⤵
  PID:15344
- C:\Windows\System\OHSNDeM.exe
  C:\Windows\System\OHSNDeM.exe
  2⤵
  PID:13144
- C:\Windows\System\rVBltEa.exe
  C:\Windows\System\rVBltEa.exe
  2⤵
  PID:12856
- C:\Windows\System\oQrYbuJ.exe
  C:\Windows\System\oQrYbuJ.exe
  2⤵
  PID:13864
- C:\Windows\System\RNgWUha.exe
  C:\Windows\System\RNgWUha.exe
  2⤵
  PID:10072
- C:\Windows\System\pAMJrFj.exe
  C:\Windows\System\pAMJrFj.exe
  2⤵
  PID:12772
- C:\Windows\System\PZnrJKa.exe
  C:\Windows\System\PZnrJKa.exe
  2⤵
  PID:12228
- C:\Windows\System\nbRhfYG.exe
  C:\Windows\System\nbRhfYG.exe
  2⤵
  PID:11784
- C:\Windows\System\AnswTWa.exe
  C:\Windows\System\AnswTWa.exe
  2⤵
  PID:14532
- C:\Windows\System\dtrNlwq.exe
  C:\Windows\System\dtrNlwq.exe
  2⤵
  PID:14600
- C:\Windows\System\RgJfGal.exe
  C:\Windows\System\RgJfGal.exe
  2⤵
  PID:14648
- C:\Windows\System\pJamwCF.exe
  C:\Windows\System\pJamwCF.exe
  2⤵
  PID:14424
- C:\Windows\System\YKLftBt.exe
  C:\Windows\System\YKLftBt.exe
  2⤵
  PID:14552
- C:\Windows\System\zlDHDgb.exe
  C:\Windows\System\zlDHDgb.exe
  2⤵
  PID:14900
- C:\Windows\System\BpXvkgK.exe
  C:\Windows\System\BpXvkgK.exe
  2⤵
  PID:14680
- C:\Windows\System\FnxqNFc.exe
  C:\Windows\System\FnxqNFc.exe
  2⤵
  PID:14444
- C:\Windows\System\pvPzygl.exe
  C:\Windows\System\pvPzygl.exe
  2⤵
  PID:14788
- C:\Windows\System\vvfDZKa.exe
  C:\Windows\System\vvfDZKa.exe
  2⤵
  PID:14916
- C:\Windows\System\rPtYzbA.exe
  C:\Windows\System\rPtYzbA.exe
  2⤵
  PID:15236
- C:\Windows\System\NBhbzrX.exe
  C:\Windows\System\NBhbzrX.exe
  2⤵
  PID:15024
- C:\Windows\System\AmxYfHc.exe
  C:\Windows\System\AmxYfHc.exe
  2⤵
  PID:12476
- C:\Windows\System\FUFqRUR.exe
  C:\Windows\System\FUFqRUR.exe
  2⤵
  PID:13808
- C:\Windows\System\RosJZQZ.exe
  C:\Windows\System\RosJZQZ.exe
  2⤵
  PID:15380
- C:\Windows\System\TYGErdk.exe
  C:\Windows\System\TYGErdk.exe
  2⤵
  PID:15408
- C:\Windows\System\bWByjnK.exe
  C:\Windows\System\bWByjnK.exe
  2⤵
  PID:15440
- C:\Windows\System\EOidpFu.exe
  C:\Windows\System\EOidpFu.exe
  2⤵
  PID:15468
- C:\Windows\System\xbfUYrZ.exe
  C:\Windows\System\xbfUYrZ.exe
  2⤵
  PID:15504
- C:\Windows\System\zIfsAgN.exe
  C:\Windows\System\zIfsAgN.exe
  2⤵
  PID:15528
- C:\Windows\System\sdKPLTs.exe
  C:\Windows\System\sdKPLTs.exe
  2⤵
  PID:15588
- C:\Windows\System\iEVJPmm.exe
  C:\Windows\System\iEVJPmm.exe
  2⤵
  PID:15608
- C:\Windows\System\Egtelmz.exe
  C:\Windows\System\Egtelmz.exe
  2⤵
  PID:15624
- C:\Windows\System\usBQgTI.exe
  C:\Windows\System\usBQgTI.exe
  2⤵
  PID:15660
- C:\Windows\System\YjXsKOq.exe
  C:\Windows\System\YjXsKOq.exe
  2⤵
  PID:15684
- C:\Windows\System\lIrsmlD.exe
  C:\Windows\System\lIrsmlD.exe
  2⤵
  PID:15704
- C:\Windows\System\iyEIYxY.exe
  C:\Windows\System\iyEIYxY.exe
  2⤵
  PID:15728
- C:\Windows\System\UjECGdL.exe
  C:\Windows\System\UjECGdL.exe
  2⤵
  PID:15752
- C:\Windows\System\zIHvpua.exe
  C:\Windows\System\zIHvpua.exe
  2⤵
  PID:15772
- C:\Windows\System\fmROuNT.exe
  C:\Windows\System\fmROuNT.exe
  2⤵
  PID:15808
- C:\Windows\System\ijDBCos.exe
  C:\Windows\System\ijDBCos.exe
  2⤵
  PID:15828
- C:\Windows\System\LGpWTKq.exe
  C:\Windows\System\LGpWTKq.exe
  2⤵
  PID:15852
- C:\Windows\System\abOdTEn.exe
  C:\Windows\System\abOdTEn.exe
  2⤵
  PID:15876
- C:\Windows\System\iAertlP.exe
  C:\Windows\System\iAertlP.exe
  2⤵
  PID:15908
- C:\Windows\System\iMFVDqs.exe
  C:\Windows\System\iMFVDqs.exe
  2⤵
  PID:15928
- C:\Windows\System\yXxtlXY.exe
  C:\Windows\System\yXxtlXY.exe
  2⤵
  PID:15960
- C:\Windows\System\iiuXCPH.exe
  C:\Windows\System\iiuXCPH.exe
  2⤵
  PID:15976
- C:\Windows\System\NriCAOA.exe
  C:\Windows\System\NriCAOA.exe
  2⤵
  PID:15992
- C:\Windows\System\ELCRvcm.exe
  C:\Windows\System\ELCRvcm.exe
  2⤵
  PID:16016
- C:\Windows\System\NHbbxMk.exe
  C:\Windows\System\NHbbxMk.exe
  2⤵
  PID:16052
- C:\Windows\System\OaQPeHx.exe
  C:\Windows\System\OaQPeHx.exe
  2⤵
  PID:16072
- C:\Windows\System\IhKpueR.exe
  C:\Windows\System\IhKpueR.exe
  2⤵
  PID:16100
- C:\Windows\System\owCMpYi.exe
  C:\Windows\System\owCMpYi.exe
  2⤵
  PID:16124
- C:\Windows\System\tXTrPZI.exe
  C:\Windows\System\tXTrPZI.exe
  2⤵
  PID:16148
- C:\Windows\System\cyGfjgl.exe
  C:\Windows\System\cyGfjgl.exe
  2⤵
  PID:16180
- C:\Windows\System\Oqipgvo.exe
  C:\Windows\System\Oqipgvo.exe
  2⤵
  PID:16200
- C:\Windows\System\hAmsLbj.exe
  C:\Windows\System\hAmsLbj.exe
  2⤵
  PID:16224
- C:\Windows\System\sNWNASv.exe
  C:\Windows\System\sNWNASv.exe
  2⤵
  PID:16252
- C:\Windows\System\jwrLRFe.exe
  C:\Windows\System\jwrLRFe.exe
  2⤵
  PID:16276
- C:\Windows\System\iTcGaLF.exe
  C:\Windows\System\iTcGaLF.exe
  2⤵
  PID:16296
- C:\Windows\System\xsyzJXG.exe
  C:\Windows\System\xsyzJXG.exe
  2⤵
  PID:16328
- C:\Windows\System\RRUFTnB.exe
  C:\Windows\System\RRUFTnB.exe
  2⤵
  PID:16344
- C:\Windows\System\IUYrbDn.exe
  C:\Windows\System\IUYrbDn.exe
  2⤵
  PID:16372
- C:\Windows\System\bCsroRa.exe
  C:\Windows\System\bCsroRa.exe
  2⤵
  PID:15156
- C:\Windows\System\nqSHxFn.exe
  C:\Windows\System\nqSHxFn.exe
  2⤵
  PID:15212
- C:\Windows\System\mzMiVhF.exe
  C:\Windows\System\mzMiVhF.exe
  2⤵
  PID:14420
- C:\Windows\System\uIaGbVy.exe
  C:\Windows\System\uIaGbVy.exe
  2⤵
  PID:15328
- C:\Windows\System\FBFHVXO.exe
  C:\Windows\System\FBFHVXO.exe
  2⤵
  PID:14256
- C:\Windows\System\RfzJjVe.exe
  C:\Windows\System\RfzJjVe.exe
  2⤵
  PID:14832
- C:\Windows\System\UDKjVhA.exe
  C:\Windows\System\UDKjVhA.exe
  2⤵
  PID:14440
- C:\Windows\System\TxDpYkw.exe
  C:\Windows\System\TxDpYkw.exe
  2⤵
  PID:14492
- C:\Windows\System\coQpFDu.exe
  C:\Windows\System\coQpFDu.exe
  2⤵
  PID:15496
- C:\Windows\System\pgOQQYt.exe
  C:\Windows\System\pgOQQYt.exe
  2⤵
  PID:14652
- C:\Windows\System\HNVVYEF.exe
  C:\Windows\System\HNVVYEF.exe
  2⤵
  PID:15284
- C:\Windows\System\qctIkpG.exe
  C:\Windows\System\qctIkpG.exe
  2⤵
  PID:14780
- C:\Windows\System\dmpNYWR.exe
  C:\Windows\System\dmpNYWR.exe
  2⤵
  PID:11220
- C:\Windows\System\JQetzde.exe
  C:\Windows\System\JQetzde.exe
  2⤵
  PID:15372
- C:\Windows\System\hKUnJTR.exe
  C:\Windows\System\hKUnJTR.exe
  2⤵
  PID:15420
- C:\Windows\System\edktOXD.exe
  C:\Windows\System\edktOXD.exe
  2⤵
  PID:15548
- C:\Windows\System\Donixgp.exe
  C:\Windows\System\Donixgp.exe
  2⤵
  PID:14760
- C:\Windows\System\WPggypl.exe
  C:\Windows\System\WPggypl.exe
  2⤵
  PID:14500
- C:\Windows\System\IpdltpW.exe
  C:\Windows\System\IpdltpW.exe
  2⤵
  PID:15604
- C:\Windows\System\mbuSusG.exe
  C:\Windows\System\mbuSusG.exe
  2⤵
  PID:15720
- C:\Windows\System\gvTeOcG.exe
  C:\Windows\System\gvTeOcG.exe
  2⤵
  PID:16248
- C:\Windows\System\YodRFmm.exe
  C:\Windows\System\YodRFmm.exe
  2⤵
  PID:15864
- C:\Windows\System\PxBggaE.exe
  C:\Windows\System\PxBggaE.exe
  2⤵
  PID:16324
- C:\Windows\System\hRSdjcB.exe
  C:\Windows\System\hRSdjcB.exe
  2⤵
  PID:14868
- C:\Windows\System\EWwufnc.exe
  C:\Windows\System\EWwufnc.exe
  2⤵
  PID:15972
- C:\Windows\System\zxJSYyz.exe
  C:\Windows\System\zxJSYyz.exe
  2⤵
  PID:15168
- C:\Windows\System\LlQyjsj.exe
  C:\Windows\System\LlQyjsj.exe
  2⤵
  PID:15620
- C:\Windows\System\UcnZuMc.exe
  C:\Windows\System\UcnZuMc.exe
  2⤵
  PID:16132
- C:\Windows\System\TVJqTVA.exe
  C:\Windows\System\TVJqTVA.exe
  2⤵
  PID:16396
- C:\Windows\System\uSRyzqc.exe
  C:\Windows\System\uSRyzqc.exe
  2⤵
  PID:16416
- C:\Windows\System\AdtMjna.exe
  C:\Windows\System\AdtMjna.exe
  2⤵
  PID:16440
- C:\Windows\System\OJDPYvf.exe
  C:\Windows\System\OJDPYvf.exe
  2⤵
  PID:16472
- C:\Windows\System\iqNqvfb.exe
  C:\Windows\System\iqNqvfb.exe
  2⤵
  PID:16504
- C:\Windows\System\jPDTOeh.exe
  C:\Windows\System\jPDTOeh.exe
  2⤵
  PID:16528
- C:\Windows\System\rcXEvHc.exe
  C:\Windows\System\rcXEvHc.exe
  2⤵
  PID:16544
- C:\Windows\System\YEJouqu.exe
  C:\Windows\System\YEJouqu.exe
  2⤵
  PID:16572
- C:\Windows\System\iQiqXWW.exe
  C:\Windows\System\iQiqXWW.exe
  2⤵
  PID:16592
- C:\Windows\System\AcIxfvz.exe
  C:\Windows\System\AcIxfvz.exe
  2⤵
  PID:16620
- C:\Windows\System\TGIQHdw.exe
  C:\Windows\System\TGIQHdw.exe
  2⤵
  PID:16648
- C:\Windows\System\MYoECvY.exe
  C:\Windows\System\MYoECvY.exe
  2⤵
  PID:16676
- C:\Windows\System\coYcWZn.exe
  C:\Windows\System\coYcWZn.exe
  2⤵
  PID:16708
- C:\Windows\System\wDBQDZP.exe
  C:\Windows\System\wDBQDZP.exe
  2⤵
  PID:16736
- C:\Windows\System\rwYTdgR.exe
  C:\Windows\System\rwYTdgR.exe
  2⤵
  PID:16768
- C:\Windows\System\QwYEjvN.exe
  C:\Windows\System\QwYEjvN.exe
  2⤵
  PID:16788
- C:\Windows\System\lpBXtRd.exe
  C:\Windows\System\lpBXtRd.exe
  2⤵
  PID:16816
- C:\Windows\System\czWmChO.exe
  C:\Windows\System\czWmChO.exe
  2⤵
  PID:16832
- C:\Windows\System\uSeIgeg.exe
  C:\Windows\System\uSeIgeg.exe
  2⤵
  PID:16860
- C:\Windows\System\dzPMpAD.exe
  C:\Windows\System\dzPMpAD.exe
  2⤵
  PID:16888
- C:\Windows\System\QKbuKmo.exe
  C:\Windows\System\QKbuKmo.exe
  2⤵
  PID:16920
- C:\Windows\System\LJFPaaI.exe
  C:\Windows\System\LJFPaaI.exe
  2⤵
  PID:16944
- C:\Windows\System\SDEBwTX.exe
  C:\Windows\System\SDEBwTX.exe
  2⤵
  PID:16972
- C:\Windows\System\dcedImS.exe
  C:\Windows\System\dcedImS.exe
  2⤵
  PID:17004
- C:\Windows\System\XgSLhLy.exe
  C:\Windows\System\XgSLhLy.exe
  2⤵
  PID:17032
- C:\Windows\System\FqAfgAo.exe
  C:\Windows\System\FqAfgAo.exe
  2⤵
  PID:17052
- C:\Windows\System\GvdgjJA.exe
  C:\Windows\System\GvdgjJA.exe
  2⤵
  PID:17084
- C:\Windows\System\FVqFsaZ.exe
  C:\Windows\System\FVqFsaZ.exe
  2⤵
  PID:17112
- C:\Windows\System\eSoHjoL.exe
  C:\Windows\System\eSoHjoL.exe
  2⤵
  PID:17128
- C:\Windows\System\ruiswlZ.exe
  C:\Windows\System\ruiswlZ.exe
  2⤵
  PID:17152
- C:\Windows\System\LPqkBaJ.exe
  C:\Windows\System\LPqkBaJ.exe
  2⤵
  PID:17176
- C:\Windows\System\rhSegIq.exe
  C:\Windows\System\rhSegIq.exe
  2⤵
  PID:17196
- C:\Windows\System\ErGQdJK.exe
  C:\Windows\System\ErGQdJK.exe
  2⤵
  PID:17224
- C:\Windows\System\ZhktHCK.exe
  C:\Windows\System\ZhktHCK.exe
  2⤵
  PID:17248
- C:\Windows\System\jQqrjEj.exe
  C:\Windows\System\jQqrjEj.exe
  2⤵
  PID:17264
- C:\Windows\System\UKtDrDr.exe
  C:\Windows\System\UKtDrDr.exe
  2⤵
  PID:17280
- C:\Windows\System\TjpDjbm.exe
  C:\Windows\System\TjpDjbm.exe
  2⤵
  PID:17296
- C:\Windows\System\twGsGWH.exe
  C:\Windows\System\twGsGWH.exe
  2⤵
  PID:17324

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:15284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AxdGMXl.exe

Filesize
1.1MB

MD5
cade5a2c2a2b8e97e4d1bd308ec4210f

SHA1
e77931b9f3e00b1e14317a5613a7a8f23d244e4f

SHA256
4a7ec2ce18cc05d8fc7923e388a553bff5755a7a2420b14111e7bc1a3311da4b

SHA512
559521aecb5dd8c63a1d95d82eedf67aa2d20db90ef7c167a6b783b1f0f66e86f3e400be01e1e5dd06a019f5ec6dbf4e24485ce85719f627857db7421a9ce751

Download Submit
C:\Windows\System\BAethhq.exe

Filesize
1.1MB

MD5
3629fe94e7f25c1706ab37d9ccba4b5a

SHA1
fd83b030a72616d20ccab89aa99322990c028a1d

SHA256
b1c406494e734b5003d7ca26006a8be12f29a991b55190b7b4704222b059ed09

SHA512
1345cc6a424339ea1d81edc74b563779ff24ebab4fa5fcca60692c154cd0ca6987eda476a04864b439d19f7cbd96a8c1a9599d19c78f28eea7135c168bd149f6

Download Submit
C:\Windows\System\BReJYbQ.exe

Filesize
1.1MB

MD5
0d1d0d659e993c5a636931f70d5f5c84

SHA1
cd1357063472c4a681cf544eeb8d2831f7f4fe11

SHA256
6ab57a23344921f32951eb338d88876bc9d9f2152a8f04f3fcb0abd16a886eb8

SHA512
050131bca37624542772314003086779cf584825ae2543cdd8ebed5a1b28aa4e32c9bdde0302213052c923bf445f04f47a24329afe754715eb392edcac56b6b1

Download Submit
C:\Windows\System\BsxeVtE.exe

Filesize
1.1MB

MD5
803dafac41cb225e970423a586c2497c

SHA1
f9d00c3b434283777172ae62b45a1618e3da8f80

SHA256
7d5c6317b64aa6a8fe6b2360b75e0a70216a4cab1c10d83613b8976f302dcad8

SHA512
c63bec6d8f097208a674bea01ff71097f8b576624349b51df57b16abd9e5bd63a6eb8e6b1884ffdec44ff89c052a28f2dcc722398497c92557ec73530acd87c5

Download Submit
C:\Windows\System\JQgiSMy.exe

Filesize
1.1MB

MD5
5fee8a2f740c037e4f52e326d72c9df1

SHA1
82ed7d15531d5df7109845eb1bca77ee6c8fd084

SHA256
cafa8762685481a0faad1ad835250834b088803e707552d5b4472d36f3077afe

SHA512
6a8506fd531a1a68e77ee915375d66f784afe5f8150dc3297903b57818dd179e14b21988c912c300ed30b0a72ae836c1b849572b3dfed1be3d3243bfe5235e45

Download Submit
C:\Windows\System\MMrBtFm.exe

Filesize
1.1MB

MD5
4e5094fb529fd835334e7a48669ec7a0

SHA1
d11d0ac51c3257250e79928e15f71acc29480679

SHA256
500ba14941bd529c54ba6a0bc1740f7cd8b2ee8851fbf5c0f1508158b8f5b0bd

SHA512
de25f888e6a5665f746639d3e53293dc07d1448b1a7f6af51ccf4cdabfff8c91ebaa6037046acb230a6be9a9d91587839066962216530d3bdefbb9455cc6f9cd

Download Submit
C:\Windows\System\MwnLmwd.exe

Filesize
1.1MB

MD5
80c37bc17f6f8c29b6c0568d1b6372f8

SHA1
30376c27a24535e280f85378994d7cff0ee10407

SHA256
1febd3dbe9b4f5c47e959ef0d5f2ba3dc3c002080a9de817e67b761759c8ddca

SHA512
46a0bbd18c44f61d5c7949f0e89f7ddccf806d36d0a854f543c1fbcb50756d84da08e69c21ab78c4575635abbef97e95613353c167fba50942585ad502709a8c

Download Submit
C:\Windows\System\OSNhmEI.exe

Filesize
1.1MB

MD5
6851b2ade0231e80d42d6d7272796fc3

SHA1
42ebe93aad5aae100296ab33c6f141ec899cdd16

SHA256
b5efdd27aa9210bcb9146731a19633b6f721d0a9f8068d36657482c0f372d923

SHA512
a62a8a4dcb3dc9fac57ae1d795b703d10c85bea6e088ca24a8b4c34acb4c07ca198d8d98f16cdb762396e96e185f90ef9c882c8f5db37ca2b09474f7068aab73

Download Submit
C:\Windows\System\QHqYtDR.exe

Filesize
1.1MB

MD5
5a5c9357810dda7b5ff79f0ad1a405b3

SHA1
c68d185a341f9730de3bbd052b75d233f4dd3a18

SHA256
b676ae3caf810e12c7234c9d3fe1f4cc270870754804a7d5671f740062f9a24b

SHA512
5f9dc066431f955e7cdcd4f4e6cb6d795bf7fc94294ccccc6841645f588a2afd359b4d05471b939ecc64e3ec3e0d79b9023039dbcc4b080705fa30394f4bee4c

Download Submit
C:\Windows\System\QLVssAF.exe

Filesize
1.1MB

MD5
0cfbe0ef4bd7853e28c253af404b136a

SHA1
fb679861c1e7755f0dd63e81e296401445f4f611

SHA256
efc3edbf55671fa2c3ef040a2f4a2e0768c605ca006c2edd823f280c0997d6d7

SHA512
79098b44c3d023b9482a07d18edebf434d92d35979754281e124e91294048b72c3313be4926e8a8fd091ff42afcff6603dd88a883cd101605276dc3b13aae7c3

Download Submit
C:\Windows\System\RQFuiaU.exe

Filesize
1.1MB

MD5
0b4db743c11a13f663cb6c0cd166bbf8

SHA1
f83ea098e697240d7853444bc6ff0d88ea647bf1

SHA256
6a27f349cdf17d885a9241bcc8ecada05930a4ce8f603f85fe7016bb99fa721b

SHA512
02840f74415ef09c951afb40978e06f73bfa3921dd51e25f8bb2b11f7e72bf0c63b526761de2d5d73704745c9a1edadc335669e836a102c707d144ce2610956c

Download Submit
C:\Windows\System\RaVPVzZ.exe

Filesize
1.1MB

MD5
cf73885c88f10f747aeebca47f1a9679

SHA1
f0dae45d5acee063ee6f5a7b1c2e70520e36976c

SHA256
f153c9a3a1667b092abf93d0da083e4b648694a9e047f2deb93ef264dd591daa

SHA512
f087861349a2cac334961addac42c04ea01faa3d9b0d212e71e869f38e0fbec13302948c764b5f697b86b11a3d94a36f3cc8826cd05a56d6cb62cd265379ed33

Download Submit
C:\Windows\System\SHtrUDd.exe

Filesize
1.1MB

MD5
198782fa7aa4944118a1f6235b6856d2

SHA1
02aac6a84704a8920db65a316a2dbdb642e1959f

SHA256
f5fc11487e9bb0730d97588f81f1c347bc634952ca08ab71b80eeef5924da215

SHA512
22b7cdf35a963caa9149982a3a949d78550d810c2488859a6126fa48a8de13744f4da7ff88b7e6f304ca9395e37588c4d9cf86fe70ff88c47eb9b2d26747df63

Download Submit
C:\Windows\System\SIlclKa.exe

Filesize
1.1MB

MD5
e0b74613e8f600673aa1030786f74a65

SHA1
f15a8858d492311e31e8eb76ceba92d56a0ab95f

SHA256
02d6f65ad0e4d88ce023fe82843b409e7a9cfbfebf5f91a79f0e9ac2025b055a

SHA512
88ae470b9f044e78fffca186841622d99009c92061570487ae9c3f944696bbaf964ac44f6e67aa36ad775a182ed9fc9e3e3b4eb2450961f0f214aafa90c1f3f3

Download Submit
C:\Windows\System\TfLKIlq.exe

Filesize
1.1MB

MD5
72967f4fc7875c8771155926badf254a

SHA1
1f57ea74a68e73030476823d36f5c7059366f886

SHA256
8ded4e42fa4f2244292b18f9c8161d11a93aa7f76d0c6ffe4cc13ef56fe32fd0

SHA512
c8211aefd62e36c5734064384c2735178a391d568ca2217ce6cc7663e5b37d3936327f798adbbeb38a5051fa0b57f41a55debafca8ce0d449e8d9b20718ff83d

Download Submit
C:\Windows\System\TljacmI.exe

Filesize
1.1MB

MD5
cd4504ec1a214e527eaef65b5d35cbb3

SHA1
72813fc73a458057d86bf04ef3234829e3f49ec8

SHA256
82ea692f189dd59ef6340c58cfb0153b12a5074ff967aa773ee42ca36f745107

SHA512
ae040007db8d630d35dc7c747a8e6a8fbf8dc15aaaa29640ae099a70cdef881101e5a2ad218dc93cdb4f72f4d2d02dffefcf14f742b9e785815f655c755dfe3f

Download Submit
C:\Windows\System\TuIjbIV.exe

Filesize
1.1MB

MD5
d248958db1cfde316662a69a6b51e165

SHA1
ce6b0965f5e65717ffb36e5c691130d99220bda7

SHA256
ee9213fdd218aeb29e476bb5dc7f975c0fa59666cee86bdcc0c277a44fc3df50

SHA512
6e473d23c64192d77c7a5b77e0346cc4d0fa12b9d01e373ba5888278016409c89219fd23827559e0d178d97f06227e2cb9479da0316b8c117ad7bf443092c687

Download Submit
C:\Windows\System\VlJGoko.exe

Filesize
1.1MB

MD5
8fd70db4c8dc9f6918838b48ecc39eee

SHA1
3b454c83ce29cbece9a40ccd1a48a42a0f1d3b50

SHA256
ec938becdfbac0a350eb7f57ba2f7a382fab92a3aa0ffbd8da3acc46d575e4be

SHA512
bd822a5e90b9df7ce2722f73404a50edd00b73935f89e4f1a16ffde43c35c2d5cf5e0bf7744e6ce8a91763ac99a627995909aabb13554d9bae26a287fd8f8b6c

Download Submit
C:\Windows\System\WTeDwXD.exe

Filesize
1.1MB

MD5
8616b06e6df0d62a8728abdc0eaac215

SHA1
589021b75c0d1accd07ce4ff171f5dc8c8ae6fd0

SHA256
9b847fb56854222db1eb5b779e480ead23f8716651ffec7f26de8c1d699e29ce

SHA512
8656bb1c77d3a1d9223e0d2a2354ad0ed0d70c90c0a1e7a256e588b126c1a97390fbf1a76167d81e0f8c97027cd203c823b740525664d479e1fd62294dd67d8a

Download Submit
C:\Windows\System\aXSbGCh.exe

Filesize
1.1MB

MD5
b92d76d6c51878a17dd286074577d9f1

SHA1
20b2db1eab40f0add47483e56183e420a989b369

SHA256
4efd016d0e32c6a00e2ec8e3f3ea8f0c27cf0eb49d6759b75fffdc337b7696ba

SHA512
929b10bbdc27470afd4ebc30acc1bd39ec46a7edf6773cb5f40c900f7b0e2d30e8299e57b8d2f5cc09638e0a832788044eacfd2f73dd5ec4bf90cbe692db6b5e

Download Submit
C:\Windows\System\chODUJT.exe

Filesize
1.1MB

MD5
e0c3c57203626423ce96772e4810bddd

SHA1
82c58287ee7394f9d8d68478ddfb586d7fc1f7a0

SHA256
a771823ffad862e566fd2e6f09323a5b6b57ad885e254a3de0140a8173f0385c

SHA512
e11ff4ad5f64edd398fcd2729e411c77641446a615a96335dfb074fef4461e128d59d68f433eb18849d795cbdae4d59ad7a47c776f466e5f858d1ab02f13cb28

Download Submit
C:\Windows\System\eYLLlYN.exe

Filesize
1.1MB

MD5
afedba21860e6ef826be6012858922e7

SHA1
2db74645f4211138281007b2d0659b42afb77a4f

SHA256
fc0fc103ea3650df01d91207e2e613d16da40d1c19fd2333e61c1695fc753101

SHA512
5a01cbe42c19c3f4ef4769680f781f7be2ee9d72417f987eb32400377e196c90642ca7f80c02a12d4faff8cf2fd8dea856b1ae2971432bc4968e9ce80fb4506a

Download Submit
C:\Windows\System\jKKaTJZ.exe

Filesize
1.1MB

MD5
c4696f55f0b46a39c53abc5b7173a843

SHA1
d2852f1a3153b29a7e19308a4ad4c586f0216569

SHA256
1800fe995007c5e962146dc7ed97261d6a37c00ed2b68c54660518f2b074842a

SHA512
4ee168d032dc8c37cb6e3bfc865bb2bcb3a2cfa415838ffe90365a34668341f4fb464da03d6249b991348ce30c2fe7ae870bc414bd56191c7dd07f0d10bf6c15

Download Submit
C:\Windows\System\jibYOcs.exe

Filesize
1.1MB

MD5
958880a70d27ba53e05e8108fedf91df

SHA1
187a56c5496da3c5ffafe632eed2beeb2f2f4f5f

SHA256
e386c857d5c5ebd9d17dbf241a9e473c5551372591123db7439c956893b8c4c4

SHA512
931e6edccbbc6ed8d2fe9f6fd0e74ccc310e3294ce980d09b4e528a52b61b479b2ef697d3dad4cf197861cfeeee44330cba21aef4a1571fff6ba3e68e5297915

Download Submit
C:\Windows\System\kUEJIDR.exe

Filesize
1.1MB

MD5
2cd82631939c53fc54b47f5b70caa674

SHA1
61f68eb980d814d82e0731282a803489d523d0a6

SHA256
26b5737d7ded8dfdf224f2416afc1c2edb7cba465fd114ec7bbce525e2f5e5f8

SHA512
0d9c895e9627bdcce310abf6bf3c9202f8f00eb39d9fde2e78333144e8c6bc84b4b465e0e34a4b8c62116d2d31763abe890da13c862ad8170c6f87dcd1637ab6

Download Submit
C:\Windows\System\lyoPPTX.exe

Filesize
1.1MB

MD5
0a72636b26c64a0298caf243ab35f948

SHA1
f461ead5c64d7561a66c4b34352ebe6417179189

SHA256
b59e19e5b18b16f6d7274f990e337f3ac1ae8cd19abfdd7cf9aa1676d14f5c06

SHA512
192d5428e25fbbcd5783d41bdfb161bbc030dc5864fbab1d97e4fd9dcd4bb439a2d840c5bdf153491d405692ef12bc34f8c665bfe439a1a354442934ce4f984f

Download Submit
C:\Windows\System\mKnSmVp.exe

Filesize
1.1MB

MD5
b7d564fe065a7f762faf285af38b2c86

SHA1
733c0430d3167666853ecace419c74510dd7a346

SHA256
4cb280b23e0c1d7ced7a0eddcb831d3ac621698e5ae22045d20d0ee4774eac0d

SHA512
8b97d3ce22c89572a9ac2fe2f152124a0e352247dc0e3a78eb88e1abec01fa3ff88a0e9e5f89e0b4e0730729dc1a891b381523495705f32058b6ca59de001255

Download Submit
C:\Windows\System\nbEfsBi.exe

Filesize
1.1MB

MD5
93708f30f910f690e39970f370fd74b9

SHA1
7e39b43222ee3af65767d53fa4ceb0d6f10c03aa

SHA256
7749bbc1839905b64308230f23c4e2d2a49b77497bcdf5f01d8ef2bad9dc1964

SHA512
1cd711417d2c8bfcfd4e9abda0f22153c2e84e8135bebd00d45981bda9fcccd90ddd040e7d2da0d2f29344678c844f9b68537397926ef36419490b60c8fdab4f

Download Submit
C:\Windows\System\nfvQRcP.exe

Filesize
1.1MB

MD5
ec9042321a7f2678a57d9cc049e0364c

SHA1
14a4227076d2f5844d559e3a3fe452e1b4b3dbca

SHA256
a131aef39c35678521f127d4a122f5dff6a45a7d14090bfc6e83caaaeaf0b158

SHA512
1b15dff0946db96cb05db59f612feb7a087a57a23ed7e412a101f5671d69bd6bef91551ed9f1b9b6992b65aacff1c1b609631e7ed95cafbda9cc1b86d0634a9e

Download Submit
C:\Windows\System\oibGXpj.exe

Filesize
1.1MB

MD5
812dfefa5e86e8b47dcbfc7d7d707c8b

SHA1
b41ce4f191dd191026035ac7540047403189ca5d

SHA256
155e134e62ae88a88b8b51eec2e3c04e45358f816262648552759317c932d0fd

SHA512
0153835ffc0f17a3500b8adf9f08dcdddbc0b317eb5a1b34d209cfda97ad584072d18ffb2c6cbf0b80292a9056ad6ea7e9a6217b6d7962be897344a33c93142b

Download Submit
C:\Windows\System\pVlOQAx.exe

Filesize
1.1MB

MD5
ecbd26abf1e0776d77f4b3fde56c3fd0

SHA1
c1fb4e7b4eff4e1420706c8ef4875490eb75f31a

SHA256
d99ef10dde321184f3d0ece87293ca3d2dce0387a4986e28730cd1529fb9c8a7

SHA512
346b798195820aab59b5625cd09df404d633600aa8728b342e8ddeee58b911106114d9edaae13903723072404de386079a090fa26a576f3b435299b7e8113a76

Download Submit
C:\Windows\System\rTuGYgH.exe

Filesize
1.1MB

MD5
45962e2b077167b29a1a6d8b56f8a4bc

SHA1
a0ae36adbf3d34a9088c80f70bd5bf667f32be59

SHA256
6bb8d285bfc8469ad0b4e9ff60471e324cf74a29c104bc27ebd284a1dd5d6596

SHA512
9943adeb0a9ef03de73019dc258e69142e7f2225aeea69e2da3898d2da60fb743d84f08cbb60ea43c8aa71813ba78accb287b2bfb66c97b9c2cde664c562453c

Download Submit
C:\Windows\System\tnRoOOi.exe

Filesize
1.1MB

MD5
79ae9891e2f8a44d7af06b27fa0f3d71

SHA1
a40e54ccd360df496d7c3c8e2254e33a34a404df

SHA256
287d7561b7cf4065e8586658a384067b8a85c282728bd6de6240596809fc0699

SHA512
6d7ef9dc26fbe4ce973ccac2bb51655e482eb8b043cb1c43cdbdd043e4abe9c17242979239fc67724ce73de337cc66ec40849ce8e9e8bbd381704029448e9025

Download Submit
C:\Windows\System\uvVMMXp.exe

Filesize
1.1MB

MD5
14942665701c03437d481ec1b95e7be6

SHA1
8426046be0ab5200388ddd06c0628f3fb628c0d9

SHA256
9f6bb3ddd91a0b08754f8ef9dfce6bbd40a67bc5a61fd0feab7fd00c3f8f8487

SHA512
f4d460d2d3c1f1057ec6c19d92a364bd42ab16ebedd5870b61a4ebd942621fd4d92dec3ff1346edd8109e0db798c60c4d1755ecd31990ffda436ff68d8ef618a

Download Submit
C:\Windows\System\wcRDYsI.exe

Filesize
1.1MB

MD5
cb48895eaa97893c7ee759538d8cd3b2

SHA1
1f49a2b2d34c44c8bba403f2ed65cf67f5f2ebb0

SHA256
053b351376a439543c63e184d55dddd5afcf7a9db40bb543811a896ae365a889

SHA512
a84bedc8233d1983eb287387e965fa2453998aafb47be09cac0f4363e542139c4b10ebeebd432b422777581865d847dbbdfee68a4bf40aa0980150a7c766671a

Download Submit
C:\Windows\System\xveDWtw.exe

Filesize
1.1MB

MD5
01e2088b0417b946879e1b2f1b8871e9

SHA1
77afeb920255f31d1cd2fe56627018efd756094c

SHA256
83e0d1fe90e6e83c40c936e87e94cbf76560183f631fb0ef40d979424ff6a948

SHA512
2021f874be0a924bffa947f85f2d41aa3554a0ff5bfa46d3e117e1d8aa112a9101488da4ab61437f423df5dd54074b65a057facfd6c818ab324931c19fb9270e

Download Submit
C:\Windows\System\xytvQnr.exe

Filesize
1.1MB

MD5
5473d346c92ba85d820551e88a856e90

SHA1
a2dcd45c445d492041ff5af6891a98faadad3728

SHA256
0d5d2fd3385f56394ed1b94fb6b187877198f35c87b58ae825745ddf8dccc1e8

SHA512
0690a544f6354245061a0a4645653cec50fb6c4d80dc4671452fe831278a6e4b9d2de196b83c75aabe9977b1152aac9f76739111bdb9bcda48a2f4b35f6cbe56

Download Submit
memory/4416-0-0x0000019F2E630000-0x0000019F2E640000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads