xmrig | 89a22acd26beee70923dee35ac9712b63dd773b363d75c85f498190e882940d7

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
Size

2.3MB
MD5

364fd18f5fae902eb39aec052a6693c0
SHA1

ecf122dc76b70fda7f73bedc327d2ddd37dabf71
SHA256

89a22acd26beee70923dee35ac9712b63dd773b363d75c85f498190e882940d7
SHA512

a81fdd6e992b9a4ec6a2a4a00a405970284e661edbd76ae9582ee093d8772edc4ef9ba56a46ee6a30a83f58d95b164dc2f8ca91e19b4c26103127459cc66a353
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQFD2P6QV8NqMyLdlL2HZ0z:BemTLkNdfE0pZrQi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3012-0-0x00007FF65F530000-0x00007FF65F884000-memory.dmp	xmrig
behavioral2/files/0x000600000002329e-5.dat	xmrig
behavioral2/files/0x000800000002342a-10.dat	xmrig
behavioral2/files/0x000a000000023422-15.dat	xmrig
behavioral2/memory/536-23-0x00007FF7D8A30000-0x00007FF7D8D84000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-29.dat	xmrig
behavioral2/files/0x000700000002342e-38.dat	xmrig
behavioral2/files/0x000700000002342f-47.dat	xmrig
behavioral2/files/0x0007000000023432-62.dat	xmrig
behavioral2/files/0x0007000000023434-71.dat	xmrig
behavioral2/memory/2520-726-0x00007FF687250000-0x00007FF6875A4000-memory.dmp	xmrig
behavioral2/memory/2668-727-0x00007FF66C510000-0x00007FF66C864000-memory.dmp	xmrig
behavioral2/files/0x0007000000023448-166.dat	xmrig
behavioral2/files/0x0007000000023446-162.dat	xmrig
behavioral2/files/0x0007000000023447-161.dat	xmrig
behavioral2/files/0x0007000000023445-157.dat	xmrig
behavioral2/files/0x0007000000023444-152.dat	xmrig
behavioral2/files/0x0007000000023443-147.dat	xmrig
behavioral2/files/0x0007000000023442-142.dat	xmrig
behavioral2/files/0x0007000000023441-137.dat	xmrig
behavioral2/files/0x0007000000023440-132.dat	xmrig
behavioral2/files/0x000700000002343f-127.dat	xmrig
behavioral2/files/0x000700000002343e-122.dat	xmrig
behavioral2/memory/1428-728-0x00007FF72F890000-0x00007FF72FBE4000-memory.dmp	xmrig
behavioral2/memory/1860-729-0x00007FF71E620000-0x00007FF71E974000-memory.dmp	xmrig
behavioral2/memory/996-730-0x00007FF712390000-0x00007FF7126E4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343d-117.dat	xmrig
behavioral2/files/0x000700000002343c-112.dat	xmrig
behavioral2/files/0x000700000002343b-107.dat	xmrig
behavioral2/files/0x000700000002343a-102.dat	xmrig
behavioral2/files/0x0007000000023439-97.dat	xmrig
behavioral2/files/0x0007000000023438-92.dat	xmrig
behavioral2/files/0x0007000000023437-87.dat	xmrig
behavioral2/files/0x0007000000023436-82.dat	xmrig
behavioral2/files/0x0007000000023435-77.dat	xmrig
behavioral2/files/0x0007000000023433-67.dat	xmrig
behavioral2/files/0x0007000000023431-54.dat	xmrig
behavioral2/files/0x0007000000023430-51.dat	xmrig
behavioral2/files/0x000700000002342d-34.dat	xmrig
behavioral2/memory/1116-731-0x00007FF6B8DD0000-0x00007FF6B9124000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-27.dat	xmrig
behavioral2/memory/4044-19-0x00007FF7645A0000-0x00007FF7648F4000-memory.dmp	xmrig
behavioral2/memory/4056-9-0x00007FF6D2850000-0x00007FF6D2BA4000-memory.dmp	xmrig
behavioral2/memory/4292-732-0x00007FF65F820000-0x00007FF65FB74000-memory.dmp	xmrig
behavioral2/memory/2716-738-0x00007FF7FCD00000-0x00007FF7FD054000-memory.dmp	xmrig
behavioral2/memory/4488-744-0x00007FF663A50000-0x00007FF663DA4000-memory.dmp	xmrig
behavioral2/memory/3972-742-0x00007FF6211B0000-0x00007FF621504000-memory.dmp	xmrig
behavioral2/memory/4484-770-0x00007FF7C08E0000-0x00007FF7C0C34000-memory.dmp	xmrig
behavioral2/memory/3984-773-0x00007FF798930000-0x00007FF798C84000-memory.dmp	xmrig
behavioral2/memory/3816-761-0x00007FF6534C0000-0x00007FF653814000-memory.dmp	xmrig
behavioral2/memory/4068-754-0x00007FF7A8170000-0x00007FF7A84C4000-memory.dmp	xmrig
behavioral2/memory/1932-751-0x00007FF72A170000-0x00007FF72A4C4000-memory.dmp	xmrig
behavioral2/memory/2304-781-0x00007FF677930000-0x00007FF677C84000-memory.dmp	xmrig
behavioral2/memory/1788-817-0x00007FF636EB0000-0x00007FF637204000-memory.dmp	xmrig
behavioral2/memory/4604-808-0x00007FF709A60000-0x00007FF709DB4000-memory.dmp	xmrig
behavioral2/memory/3380-801-0x00007FF623D00000-0x00007FF624054000-memory.dmp	xmrig
behavioral2/memory/960-794-0x00007FF7F0010000-0x00007FF7F0364000-memory.dmp	xmrig
behavioral2/memory/4372-792-0x00007FF71B180000-0x00007FF71B4D4000-memory.dmp	xmrig
behavioral2/memory/4648-826-0x00007FF6AFCD0000-0x00007FF6B0024000-memory.dmp	xmrig
behavioral2/memory/4428-833-0x00007FF703D90000-0x00007FF7040E4000-memory.dmp	xmrig
behavioral2/memory/2576-847-0x00007FF78AF20000-0x00007FF78B274000-memory.dmp	xmrig
behavioral2/memory/2464-844-0x00007FF7137B0000-0x00007FF713B04000-memory.dmp	xmrig
behavioral2/memory/1520-839-0x00007FF6FA8D0000-0x00007FF6FAC24000-memory.dmp	xmrig
behavioral2/memory/4044-2124-0x00007FF7645A0000-0x00007FF7648F4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4056	ECNxfTZ.exe
4044	ssbeSsY.exe
536	rzGZhpR.exe
2520	toKmLpN.exe
2576	hIeKuoG.exe
2668	HwweFxL.exe
1428	qRlDuQN.exe
1860	GPIbUzL.exe
996	RiYmhxT.exe
1116	EpXuHqI.exe
4292	riQegth.exe
2716	GaoUMYs.exe
3972	bWvXJoX.exe
4488	TXAJBWC.exe
1932	LhHdbqS.exe
4068	cOrjMeY.exe
3816	YmvZWzx.exe
4484	utOuJCJ.exe
3984	RzIzQFg.exe
2304	sLXpPmV.exe
4372	aagjrIa.exe
960	NrRKcCC.exe
3380	GlIiTAs.exe
4604	yuTilEI.exe
1788	grssGTw.exe
4648	cASfZek.exe
4428	SqyPiVN.exe
1520	RxyNxqJ.exe
2464	ymSIyPM.exe
3672	uFcjFAW.exe
2488	cwNIApt.exe
3256	DBiRJbR.exe
1740	SHitvyk.exe
4272	uQEeJjR.exe
4380	EKrnaCc.exe
4276	CCtAMtT.exe
8	kLyBual.exe
2396	rmyRsJO.exe
772	xAYqrua.exe
4628	CfOlorU.exe
3504	ZNMVKNC.exe
4448	OffWEpG.exe
4900	HOtaRJO.exe
4920	RumyQaS.exe
5016	MPJvkyN.exe
4112	YQhMUJo.exe
2184	ubjtiEf.exe
808	eZWzFOa.exe
744	ssjBHXK.exe
3524	QuBFJOU.exe
1180	GMvkvIl.exe
3292	BzxgBAe.exe
116	VvqNfMN.exe
4076	DWadHiH.exe
4512	gOeYbxL.exe
1904	DTHWOUx.exe
836	oCtoWhq.exe
3244	MMyKNiN.exe
3424	wUrxufZ.exe
1736	htZUIBb.exe
2976	ocyCRmY.exe
3728	yRdMpWi.exe
1072	mnMRjjd.exe
4408	zODFaqM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3012-0-0x00007FF65F530000-0x00007FF65F884000-memory.dmp	upx
behavioral2/files/0x000600000002329e-5.dat	upx
behavioral2/files/0x000800000002342a-10.dat	upx
behavioral2/files/0x000a000000023422-15.dat	upx
behavioral2/memory/536-23-0x00007FF7D8A30000-0x00007FF7D8D84000-memory.dmp	upx
behavioral2/files/0x000700000002342c-29.dat	upx
behavioral2/files/0x000700000002342e-38.dat	upx
behavioral2/files/0x000700000002342f-47.dat	upx
behavioral2/files/0x0007000000023432-62.dat	upx
behavioral2/files/0x0007000000023434-71.dat	upx
behavioral2/memory/2520-726-0x00007FF687250000-0x00007FF6875A4000-memory.dmp	upx
behavioral2/memory/2668-727-0x00007FF66C510000-0x00007FF66C864000-memory.dmp	upx
behavioral2/files/0x0007000000023448-166.dat	upx
behavioral2/files/0x0007000000023446-162.dat	upx
behavioral2/files/0x0007000000023447-161.dat	upx
behavioral2/files/0x0007000000023445-157.dat	upx
behavioral2/files/0x0007000000023444-152.dat	upx
behavioral2/files/0x0007000000023443-147.dat	upx
behavioral2/files/0x0007000000023442-142.dat	upx
behavioral2/files/0x0007000000023441-137.dat	upx
behavioral2/files/0x0007000000023440-132.dat	upx
behavioral2/files/0x000700000002343f-127.dat	upx
behavioral2/files/0x000700000002343e-122.dat	upx
behavioral2/memory/1428-728-0x00007FF72F890000-0x00007FF72FBE4000-memory.dmp	upx
behavioral2/memory/1860-729-0x00007FF71E620000-0x00007FF71E974000-memory.dmp	upx
behavioral2/memory/996-730-0x00007FF712390000-0x00007FF7126E4000-memory.dmp	upx
behavioral2/files/0x000700000002343d-117.dat	upx
behavioral2/files/0x000700000002343c-112.dat	upx
behavioral2/files/0x000700000002343b-107.dat	upx
behavioral2/files/0x000700000002343a-102.dat	upx
behavioral2/files/0x0007000000023439-97.dat	upx
behavioral2/files/0x0007000000023438-92.dat	upx
behavioral2/files/0x0007000000023437-87.dat	upx
behavioral2/files/0x0007000000023436-82.dat	upx
behavioral2/files/0x0007000000023435-77.dat	upx
behavioral2/files/0x0007000000023433-67.dat	upx
behavioral2/files/0x0007000000023431-54.dat	upx
behavioral2/files/0x0007000000023430-51.dat	upx
behavioral2/files/0x000700000002342d-34.dat	upx
behavioral2/memory/1116-731-0x00007FF6B8DD0000-0x00007FF6B9124000-memory.dmp	upx
behavioral2/files/0x000700000002342b-27.dat	upx
behavioral2/memory/4044-19-0x00007FF7645A0000-0x00007FF7648F4000-memory.dmp	upx
behavioral2/memory/4056-9-0x00007FF6D2850000-0x00007FF6D2BA4000-memory.dmp	upx
behavioral2/memory/4292-732-0x00007FF65F820000-0x00007FF65FB74000-memory.dmp	upx
behavioral2/memory/2716-738-0x00007FF7FCD00000-0x00007FF7FD054000-memory.dmp	upx
behavioral2/memory/4488-744-0x00007FF663A50000-0x00007FF663DA4000-memory.dmp	upx
behavioral2/memory/3972-742-0x00007FF6211B0000-0x00007FF621504000-memory.dmp	upx
behavioral2/memory/4484-770-0x00007FF7C08E0000-0x00007FF7C0C34000-memory.dmp	upx
behavioral2/memory/3984-773-0x00007FF798930000-0x00007FF798C84000-memory.dmp	upx
behavioral2/memory/3816-761-0x00007FF6534C0000-0x00007FF653814000-memory.dmp	upx
behavioral2/memory/4068-754-0x00007FF7A8170000-0x00007FF7A84C4000-memory.dmp	upx
behavioral2/memory/1932-751-0x00007FF72A170000-0x00007FF72A4C4000-memory.dmp	upx
behavioral2/memory/2304-781-0x00007FF677930000-0x00007FF677C84000-memory.dmp	upx
behavioral2/memory/1788-817-0x00007FF636EB0000-0x00007FF637204000-memory.dmp	upx
behavioral2/memory/4604-808-0x00007FF709A60000-0x00007FF709DB4000-memory.dmp	upx
behavioral2/memory/3380-801-0x00007FF623D00000-0x00007FF624054000-memory.dmp	upx
behavioral2/memory/960-794-0x00007FF7F0010000-0x00007FF7F0364000-memory.dmp	upx
behavioral2/memory/4372-792-0x00007FF71B180000-0x00007FF71B4D4000-memory.dmp	upx
behavioral2/memory/4648-826-0x00007FF6AFCD0000-0x00007FF6B0024000-memory.dmp	upx
behavioral2/memory/4428-833-0x00007FF703D90000-0x00007FF7040E4000-memory.dmp	upx
behavioral2/memory/2576-847-0x00007FF78AF20000-0x00007FF78B274000-memory.dmp	upx
behavioral2/memory/2464-844-0x00007FF7137B0000-0x00007FF713B04000-memory.dmp	upx
behavioral2/memory/1520-839-0x00007FF6FA8D0000-0x00007FF6FAC24000-memory.dmp	upx
behavioral2/memory/4044-2124-0x00007FF7645A0000-0x00007FF7648F4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hpYXtnr.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\rjaqUdC.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\snSKgiO.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\kwgcNSB.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\WwmNUQU.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\SCrKAnW.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\pQjeimG.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\KHRZQnQ.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\IXwOHXP.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\mUxsfqo.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\CzuHqUT.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\vcUYPhi.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\NtQPDYF.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\YQhMUJo.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\ubjtiEf.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\NPfObqB.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\gZlKkZi.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\iulSDqh.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\FTtTFVL.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\ptFIKjP.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\wdJdKJT.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\NsnhZwH.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\SOQsNfy.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\YHaSWqR.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\RJJrKaZ.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\DTiKhzy.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\ihhKspt.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\LMuReLc.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\hjmoTTM.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\JiYCElt.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\YgZnCYb.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\QhCGCAs.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\xAYqrua.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\fbePEmx.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\CKwQRef.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\bUpMCoT.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\WPSsyTB.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\xWbyQuH.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\WWfGRBA.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\BncEXyv.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\ruwdyuZ.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\BXCSooR.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\LOirHul.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\DWadHiH.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\WDnWptw.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\VfLsFhC.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\TXAJBWC.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\ELRItnx.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\vKAmRNK.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\AIdDpZy.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\TPGAAwh.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\CDiIlxR.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\xjLmyAR.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\bwBnsAJ.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\ELAJHNw.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\lyCeemt.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\eAYtoHd.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\tWCSjPM.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\TvHBJfj.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\ewWQIxo.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\IZEkHeO.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\xfTUhjb.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\IlPgoNf.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
File created	C:\Windows\System\wwQezST.exe	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4056	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	84
PID 3012 wrote to memory of 4056	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	84
PID 3012 wrote to memory of 4044	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	85
PID 3012 wrote to memory of 4044	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	85
PID 3012 wrote to memory of 536	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	86
PID 3012 wrote to memory of 536	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	86
PID 3012 wrote to memory of 2520	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	87
PID 3012 wrote to memory of 2520	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	87
PID 3012 wrote to memory of 2576	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	88
PID 3012 wrote to memory of 2576	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	88
PID 3012 wrote to memory of 2668	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	89
PID 3012 wrote to memory of 2668	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	89
PID 3012 wrote to memory of 1428	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	90
PID 3012 wrote to memory of 1428	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	90
PID 3012 wrote to memory of 1860	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	91
PID 3012 wrote to memory of 1860	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	91
PID 3012 wrote to memory of 996	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	92
PID 3012 wrote to memory of 996	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	92
PID 3012 wrote to memory of 1116	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	93
PID 3012 wrote to memory of 1116	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	93
PID 3012 wrote to memory of 4292	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	94
PID 3012 wrote to memory of 4292	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	94
PID 3012 wrote to memory of 2716	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	95
PID 3012 wrote to memory of 2716	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	95
PID 3012 wrote to memory of 3972	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	96
PID 3012 wrote to memory of 3972	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	96
PID 3012 wrote to memory of 4488	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	97
PID 3012 wrote to memory of 4488	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	97
PID 3012 wrote to memory of 1932	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	98
PID 3012 wrote to memory of 1932	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	98
PID 3012 wrote to memory of 4068	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	99
PID 3012 wrote to memory of 4068	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	99
PID 3012 wrote to memory of 3816	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	100
PID 3012 wrote to memory of 3816	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	100
PID 3012 wrote to memory of 4484	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	101
PID 3012 wrote to memory of 4484	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	101
PID 3012 wrote to memory of 3984	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	102
PID 3012 wrote to memory of 3984	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	102
PID 3012 wrote to memory of 2304	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	103
PID 3012 wrote to memory of 2304	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	103
PID 3012 wrote to memory of 4372	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	104
PID 3012 wrote to memory of 4372	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	104
PID 3012 wrote to memory of 960	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	105
PID 3012 wrote to memory of 960	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	105
PID 3012 wrote to memory of 3380	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	106
PID 3012 wrote to memory of 3380	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	106
PID 3012 wrote to memory of 4604	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	107
PID 3012 wrote to memory of 4604	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	107
PID 3012 wrote to memory of 1788	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	108
PID 3012 wrote to memory of 1788	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	108
PID 3012 wrote to memory of 4648	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	109
PID 3012 wrote to memory of 4648	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	109
PID 3012 wrote to memory of 4428	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	110
PID 3012 wrote to memory of 4428	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	110
PID 3012 wrote to memory of 1520	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	111
PID 3012 wrote to memory of 1520	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	111
PID 3012 wrote to memory of 2464	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	112
PID 3012 wrote to memory of 2464	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	112
PID 3012 wrote to memory of 3672	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	113
PID 3012 wrote to memory of 3672	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	113
PID 3012 wrote to memory of 2488	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	114
PID 3012 wrote to memory of 2488	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	114
PID 3012 wrote to memory of 3256	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	115
PID 3012 wrote to memory of 3256	3012	364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\364fd18f5fae902eb39aec052a6693c0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\System\ECNxfTZ.exe
  C:\Windows\System\ECNxfTZ.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\ssbeSsY.exe
  C:\Windows\System\ssbeSsY.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\rzGZhpR.exe
  C:\Windows\System\rzGZhpR.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\toKmLpN.exe
  C:\Windows\System\toKmLpN.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\hIeKuoG.exe
  C:\Windows\System\hIeKuoG.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\HwweFxL.exe
  C:\Windows\System\HwweFxL.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\qRlDuQN.exe
  C:\Windows\System\qRlDuQN.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\GPIbUzL.exe
  C:\Windows\System\GPIbUzL.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\RiYmhxT.exe
  C:\Windows\System\RiYmhxT.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\EpXuHqI.exe
  C:\Windows\System\EpXuHqI.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\riQegth.exe
  C:\Windows\System\riQegth.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\GaoUMYs.exe
  C:\Windows\System\GaoUMYs.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\bWvXJoX.exe
  C:\Windows\System\bWvXJoX.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\TXAJBWC.exe
  C:\Windows\System\TXAJBWC.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\LhHdbqS.exe
  C:\Windows\System\LhHdbqS.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\cOrjMeY.exe
  C:\Windows\System\cOrjMeY.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\YmvZWzx.exe
  C:\Windows\System\YmvZWzx.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\utOuJCJ.exe
  C:\Windows\System\utOuJCJ.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\RzIzQFg.exe
  C:\Windows\System\RzIzQFg.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\sLXpPmV.exe
  C:\Windows\System\sLXpPmV.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\aagjrIa.exe
  C:\Windows\System\aagjrIa.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\NrRKcCC.exe
  C:\Windows\System\NrRKcCC.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\GlIiTAs.exe
  C:\Windows\System\GlIiTAs.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\yuTilEI.exe
  C:\Windows\System\yuTilEI.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\grssGTw.exe
  C:\Windows\System\grssGTw.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\cASfZek.exe
  C:\Windows\System\cASfZek.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\SqyPiVN.exe
  C:\Windows\System\SqyPiVN.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\RxyNxqJ.exe
  C:\Windows\System\RxyNxqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\ymSIyPM.exe
  C:\Windows\System\ymSIyPM.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\uFcjFAW.exe
  C:\Windows\System\uFcjFAW.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\cwNIApt.exe
  C:\Windows\System\cwNIApt.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\DBiRJbR.exe
  C:\Windows\System\DBiRJbR.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\SHitvyk.exe
  C:\Windows\System\SHitvyk.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\uQEeJjR.exe
  C:\Windows\System\uQEeJjR.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\EKrnaCc.exe
  C:\Windows\System\EKrnaCc.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\CCtAMtT.exe
  C:\Windows\System\CCtAMtT.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\kLyBual.exe
  C:\Windows\System\kLyBual.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\rmyRsJO.exe
  C:\Windows\System\rmyRsJO.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\xAYqrua.exe
  C:\Windows\System\xAYqrua.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\CfOlorU.exe
  C:\Windows\System\CfOlorU.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\ZNMVKNC.exe
  C:\Windows\System\ZNMVKNC.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\OffWEpG.exe
  C:\Windows\System\OffWEpG.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\HOtaRJO.exe
  C:\Windows\System\HOtaRJO.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\RumyQaS.exe
  C:\Windows\System\RumyQaS.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\MPJvkyN.exe
  C:\Windows\System\MPJvkyN.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\YQhMUJo.exe
  C:\Windows\System\YQhMUJo.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\ubjtiEf.exe
  C:\Windows\System\ubjtiEf.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\eZWzFOa.exe
  C:\Windows\System\eZWzFOa.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\ssjBHXK.exe
  C:\Windows\System\ssjBHXK.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\QuBFJOU.exe
  C:\Windows\System\QuBFJOU.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\GMvkvIl.exe
  C:\Windows\System\GMvkvIl.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\BzxgBAe.exe
  C:\Windows\System\BzxgBAe.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\VvqNfMN.exe
  C:\Windows\System\VvqNfMN.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\DWadHiH.exe
  C:\Windows\System\DWadHiH.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\gOeYbxL.exe
  C:\Windows\System\gOeYbxL.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\DTHWOUx.exe
  C:\Windows\System\DTHWOUx.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\oCtoWhq.exe
  C:\Windows\System\oCtoWhq.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\MMyKNiN.exe
  C:\Windows\System\MMyKNiN.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\wUrxufZ.exe
  C:\Windows\System\wUrxufZ.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\htZUIBb.exe
  C:\Windows\System\htZUIBb.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\ocyCRmY.exe
  C:\Windows\System\ocyCRmY.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\yRdMpWi.exe
  C:\Windows\System\yRdMpWi.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\mnMRjjd.exe
  C:\Windows\System\mnMRjjd.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\zODFaqM.exe
  C:\Windows\System\zODFaqM.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\VOZjxkx.exe
  C:\Windows\System\VOZjxkx.exe
  2⤵
  PID:2972
- C:\Windows\System\gLRAPZy.exe
  C:\Windows\System\gLRAPZy.exe
  2⤵
  PID:812
- C:\Windows\System\AERjuaW.exe
  C:\Windows\System\AERjuaW.exe
  2⤵
  PID:3864
- C:\Windows\System\SmNDpAm.exe
  C:\Windows\System\SmNDpAm.exe
  2⤵
  PID:4460
- C:\Windows\System\fbePEmx.exe
  C:\Windows\System\fbePEmx.exe
  2⤵
  PID:2564
- C:\Windows\System\kvDFcPO.exe
  C:\Windows\System\kvDFcPO.exe
  2⤵
  PID:3772
- C:\Windows\System\lPovrhC.exe
  C:\Windows\System\lPovrhC.exe
  2⤵
  PID:1204
- C:\Windows\System\iQTyoEB.exe
  C:\Windows\System\iQTyoEB.exe
  2⤵
  PID:392
- C:\Windows\System\vKAmRNK.exe
  C:\Windows\System\vKAmRNK.exe
  2⤵
  PID:1996
- C:\Windows\System\OEUIRXg.exe
  C:\Windows\System\OEUIRXg.exe
  2⤵
  PID:232
- C:\Windows\System\iYhTzgQ.exe
  C:\Windows\System\iYhTzgQ.exe
  2⤵
  PID:2368
- C:\Windows\System\QquIACb.exe
  C:\Windows\System\QquIACb.exe
  2⤵
  PID:5124
- C:\Windows\System\SOQsNfy.exe
  C:\Windows\System\SOQsNfy.exe
  2⤵
  PID:5152
- C:\Windows\System\wxWFJTv.exe
  C:\Windows\System\wxWFJTv.exe
  2⤵
  PID:5180
- C:\Windows\System\xYYJvyg.exe
  C:\Windows\System\xYYJvyg.exe
  2⤵
  PID:5208
- C:\Windows\System\YHaSWqR.exe
  C:\Windows\System\YHaSWqR.exe
  2⤵
  PID:5236
- C:\Windows\System\whDJevX.exe
  C:\Windows\System\whDJevX.exe
  2⤵
  PID:5264
- C:\Windows\System\Xjynrmr.exe
  C:\Windows\System\Xjynrmr.exe
  2⤵
  PID:5296
- C:\Windows\System\tWCSjPM.exe
  C:\Windows\System\tWCSjPM.exe
  2⤵
  PID:5320
- C:\Windows\System\OSASVvS.exe
  C:\Windows\System\OSASVvS.exe
  2⤵
  PID:5348
- C:\Windows\System\VHZNvwE.exe
  C:\Windows\System\VHZNvwE.exe
  2⤵
  PID:5376
- C:\Windows\System\hpYXtnr.exe
  C:\Windows\System\hpYXtnr.exe
  2⤵
  PID:5404
- C:\Windows\System\VSAhapA.exe
  C:\Windows\System\VSAhapA.exe
  2⤵
  PID:5432
- C:\Windows\System\UfYklkO.exe
  C:\Windows\System\UfYklkO.exe
  2⤵
  PID:5460
- C:\Windows\System\CTAfBUp.exe
  C:\Windows\System\CTAfBUp.exe
  2⤵
  PID:5488
- C:\Windows\System\AgSpjgh.exe
  C:\Windows\System\AgSpjgh.exe
  2⤵
  PID:5516
- C:\Windows\System\LpePrlu.exe
  C:\Windows\System\LpePrlu.exe
  2⤵
  PID:5544
- C:\Windows\System\PYEQUTD.exe
  C:\Windows\System\PYEQUTD.exe
  2⤵
  PID:5572
- C:\Windows\System\zNlMKqg.exe
  C:\Windows\System\zNlMKqg.exe
  2⤵
  PID:5600
- C:\Windows\System\rjaqUdC.exe
  C:\Windows\System\rjaqUdC.exe
  2⤵
  PID:5628
- C:\Windows\System\VXRqKYh.exe
  C:\Windows\System\VXRqKYh.exe
  2⤵
  PID:5656
- C:\Windows\System\fhjOpDy.exe
  C:\Windows\System\fhjOpDy.exe
  2⤵
  PID:5684
- C:\Windows\System\OvDmKve.exe
  C:\Windows\System\OvDmKve.exe
  2⤵
  PID:5708
- C:\Windows\System\vkkXRZJ.exe
  C:\Windows\System\vkkXRZJ.exe
  2⤵
  PID:5736
- C:\Windows\System\BMnBpxA.exe
  C:\Windows\System\BMnBpxA.exe
  2⤵
  PID:5768
- C:\Windows\System\MUwanNe.exe
  C:\Windows\System\MUwanNe.exe
  2⤵
  PID:5796
- C:\Windows\System\GMuLQoA.exe
  C:\Windows\System\GMuLQoA.exe
  2⤵
  PID:5824
- C:\Windows\System\chGuEDX.exe
  C:\Windows\System\chGuEDX.exe
  2⤵
  PID:5852
- C:\Windows\System\SPybuCX.exe
  C:\Windows\System\SPybuCX.exe
  2⤵
  PID:5880
- C:\Windows\System\nyzQeVg.exe
  C:\Windows\System\nyzQeVg.exe
  2⤵
  PID:5908
- C:\Windows\System\pXiKSho.exe
  C:\Windows\System\pXiKSho.exe
  2⤵
  PID:5932
- C:\Windows\System\ANMdReO.exe
  C:\Windows\System\ANMdReO.exe
  2⤵
  PID:5964
- C:\Windows\System\IwpEYkp.exe
  C:\Windows\System\IwpEYkp.exe
  2⤵
  PID:5992
- C:\Windows\System\VPbSbvx.exe
  C:\Windows\System\VPbSbvx.exe
  2⤵
  PID:6020
- C:\Windows\System\NDAbSbv.exe
  C:\Windows\System\NDAbSbv.exe
  2⤵
  PID:6044
- C:\Windows\System\zMZQjFc.exe
  C:\Windows\System\zMZQjFc.exe
  2⤵
  PID:6076
- C:\Windows\System\AWZkswP.exe
  C:\Windows\System\AWZkswP.exe
  2⤵
  PID:6104
- C:\Windows\System\ptpcbLI.exe
  C:\Windows\System\ptpcbLI.exe
  2⤵
  PID:6132
- C:\Windows\System\ATHIHzy.exe
  C:\Windows\System\ATHIHzy.exe
  2⤵
  PID:2248
- C:\Windows\System\qVfoRQY.exe
  C:\Windows\System\qVfoRQY.exe
  2⤵
  PID:3064
- C:\Windows\System\jXnvjgP.exe
  C:\Windows\System\jXnvjgP.exe
  2⤵
  PID:4436
- C:\Windows\System\PNajgiF.exe
  C:\Windows\System\PNajgiF.exe
  2⤵
  PID:5080
- C:\Windows\System\HvHtwZQ.exe
  C:\Windows\System\HvHtwZQ.exe
  2⤵
  PID:452
- C:\Windows\System\TPGAAwh.exe
  C:\Windows\System\TPGAAwh.exe
  2⤵
  PID:5140
- C:\Windows\System\pNccJFb.exe
  C:\Windows\System\pNccJFb.exe
  2⤵
  PID:5200
- C:\Windows\System\yJuIwjy.exe
  C:\Windows\System\yJuIwjy.exe
  2⤵
  PID:5276
- C:\Windows\System\ZAYXQRD.exe
  C:\Windows\System\ZAYXQRD.exe
  2⤵
  PID:5336
- C:\Windows\System\AmaZsQj.exe
  C:\Windows\System\AmaZsQj.exe
  2⤵
  PID:5396
- C:\Windows\System\QamfrPW.exe
  C:\Windows\System\QamfrPW.exe
  2⤵
  PID:5472
- C:\Windows\System\NeerKZN.exe
  C:\Windows\System\NeerKZN.exe
  2⤵
  PID:5532
- C:\Windows\System\GvLeDDS.exe
  C:\Windows\System\GvLeDDS.exe
  2⤵
  PID:5592
- C:\Windows\System\RJJrKaZ.exe
  C:\Windows\System\RJJrKaZ.exe
  2⤵
  PID:5668
- C:\Windows\System\DVYNGrO.exe
  C:\Windows\System\DVYNGrO.exe
  2⤵
  PID:5728
- C:\Windows\System\btOLPlN.exe
  C:\Windows\System\btOLPlN.exe
  2⤵
  PID:5788
- C:\Windows\System\WWfGRBA.exe
  C:\Windows\System\WWfGRBA.exe
  2⤵
  PID:5864
- C:\Windows\System\mgXQRxI.exe
  C:\Windows\System\mgXQRxI.exe
  2⤵
  PID:5924
- C:\Windows\System\XOSZOrN.exe
  C:\Windows\System\XOSZOrN.exe
  2⤵
  PID:5984
- C:\Windows\System\nfRIuBa.exe
  C:\Windows\System\nfRIuBa.exe
  2⤵
  PID:6060
- C:\Windows\System\EzqrNDy.exe
  C:\Windows\System\EzqrNDy.exe
  2⤵
  PID:6116
- C:\Windows\System\RNQJlyU.exe
  C:\Windows\System\RNQJlyU.exe
  2⤵
  PID:3608
- C:\Windows\System\QYdLRYf.exe
  C:\Windows\System\QYdLRYf.exe
  2⤵
  PID:804
- C:\Windows\System\ALSRpsF.exe
  C:\Windows\System\ALSRpsF.exe
  2⤵
  PID:2736
- C:\Windows\System\iGErkgw.exe
  C:\Windows\System\iGErkgw.exe
  2⤵
  PID:5312
- C:\Windows\System\qSZJKgQ.exe
  C:\Windows\System\qSZJKgQ.exe
  2⤵
  PID:5448
- C:\Windows\System\zdhJjnw.exe
  C:\Windows\System\zdhJjnw.exe
  2⤵
  PID:5620
- C:\Windows\System\HcFVaZi.exe
  C:\Windows\System\HcFVaZi.exe
  2⤵
  PID:5760
- C:\Windows\System\szdApKD.exe
  C:\Windows\System\szdApKD.exe
  2⤵
  PID:5900
- C:\Windows\System\ByRRnqv.exe
  C:\Windows\System\ByRRnqv.exe
  2⤵
  PID:6172
- C:\Windows\System\bAeVPjs.exe
  C:\Windows\System\bAeVPjs.exe
  2⤵
  PID:6200
- C:\Windows\System\bmNgfDj.exe
  C:\Windows\System\bmNgfDj.exe
  2⤵
  PID:6228
- C:\Windows\System\wsnyvss.exe
  C:\Windows\System\wsnyvss.exe
  2⤵
  PID:6256
- C:\Windows\System\DTiKhzy.exe
  C:\Windows\System\DTiKhzy.exe
  2⤵
  PID:6284
- C:\Windows\System\UpjwBaA.exe
  C:\Windows\System\UpjwBaA.exe
  2⤵
  PID:6312
- C:\Windows\System\AIdDpZy.exe
  C:\Windows\System\AIdDpZy.exe
  2⤵
  PID:6340
- C:\Windows\System\nmWrElE.exe
  C:\Windows\System\nmWrElE.exe
  2⤵
  PID:6368
- C:\Windows\System\xGERrJn.exe
  C:\Windows\System\xGERrJn.exe
  2⤵
  PID:6396
- C:\Windows\System\AkcBnJb.exe
  C:\Windows\System\AkcBnJb.exe
  2⤵
  PID:6424
- C:\Windows\System\EpQZuEt.exe
  C:\Windows\System\EpQZuEt.exe
  2⤵
  PID:6456
- C:\Windows\System\YXJHvLW.exe
  C:\Windows\System\YXJHvLW.exe
  2⤵
  PID:6480
- C:\Windows\System\DyRduOX.exe
  C:\Windows\System\DyRduOX.exe
  2⤵
  PID:6508
- C:\Windows\System\nCwxARz.exe
  C:\Windows\System\nCwxARz.exe
  2⤵
  PID:6536
- C:\Windows\System\qPnElPY.exe
  C:\Windows\System\qPnElPY.exe
  2⤵
  PID:6564
- C:\Windows\System\TqgzSkd.exe
  C:\Windows\System\TqgzSkd.exe
  2⤵
  PID:6592
- C:\Windows\System\tcSZRAR.exe
  C:\Windows\System\tcSZRAR.exe
  2⤵
  PID:6616
- C:\Windows\System\XJeNblI.exe
  C:\Windows\System\XJeNblI.exe
  2⤵
  PID:6648
- C:\Windows\System\OyuFqeA.exe
  C:\Windows\System\OyuFqeA.exe
  2⤵
  PID:6676
- C:\Windows\System\HzhPwGO.exe
  C:\Windows\System\HzhPwGO.exe
  2⤵
  PID:6704
- C:\Windows\System\pyfjobD.exe
  C:\Windows\System\pyfjobD.exe
  2⤵
  PID:6732
- C:\Windows\System\tXaaPfd.exe
  C:\Windows\System\tXaaPfd.exe
  2⤵
  PID:6760
- C:\Windows\System\ZcteAbE.exe
  C:\Windows\System\ZcteAbE.exe
  2⤵
  PID:6788
- C:\Windows\System\aLFMJNJ.exe
  C:\Windows\System\aLFMJNJ.exe
  2⤵
  PID:6816
- C:\Windows\System\ZHMoqbn.exe
  C:\Windows\System\ZHMoqbn.exe
  2⤵
  PID:6844
- C:\Windows\System\HitkIvK.exe
  C:\Windows\System\HitkIvK.exe
  2⤵
  PID:6872
- C:\Windows\System\rZXJFfW.exe
  C:\Windows\System\rZXJFfW.exe
  2⤵
  PID:6900
- C:\Windows\System\NUducGJ.exe
  C:\Windows\System\NUducGJ.exe
  2⤵
  PID:6928
- C:\Windows\System\vRobXXX.exe
  C:\Windows\System\vRobXXX.exe
  2⤵
  PID:6956
- C:\Windows\System\AzgIILu.exe
  C:\Windows\System\AzgIILu.exe
  2⤵
  PID:6984
- C:\Windows\System\FTtTFVL.exe
  C:\Windows\System\FTtTFVL.exe
  2⤵
  PID:7012
- C:\Windows\System\wBWXMvW.exe
  C:\Windows\System\wBWXMvW.exe
  2⤵
  PID:7040
- C:\Windows\System\yTHdxqY.exe
  C:\Windows\System\yTHdxqY.exe
  2⤵
  PID:7068
- C:\Windows\System\LdLmsfd.exe
  C:\Windows\System\LdLmsfd.exe
  2⤵
  PID:7096
- C:\Windows\System\aTXbYDD.exe
  C:\Windows\System\aTXbYDD.exe
  2⤵
  PID:7124
- C:\Windows\System\sNArOlQ.exe
  C:\Windows\System\sNArOlQ.exe
  2⤵
  PID:7152
- C:\Windows\System\WiAPpSm.exe
  C:\Windows\System\WiAPpSm.exe
  2⤵
  PID:6012
- C:\Windows\System\TAiowxP.exe
  C:\Windows\System\TAiowxP.exe
  2⤵
  PID:4600
- C:\Windows\System\KLcqENO.exe
  C:\Windows\System\KLcqENO.exe
  2⤵
  PID:2376
- C:\Windows\System\kArfYtI.exe
  C:\Windows\System\kArfYtI.exe
  2⤵
  PID:5508
- C:\Windows\System\XwmscTH.exe
  C:\Windows\System\XwmscTH.exe
  2⤵
  PID:5836
- C:\Windows\System\SMUYiXl.exe
  C:\Windows\System\SMUYiXl.exe
  2⤵
  PID:6188
- C:\Windows\System\qEbAvYc.exe
  C:\Windows\System\qEbAvYc.exe
  2⤵
  PID:6248
- C:\Windows\System\dGXLtao.exe
  C:\Windows\System\dGXLtao.exe
  2⤵
  PID:6324
- C:\Windows\System\KXkieuR.exe
  C:\Windows\System\KXkieuR.exe
  2⤵
  PID:6384
- C:\Windows\System\PJkngzE.exe
  C:\Windows\System\PJkngzE.exe
  2⤵
  PID:6452
- C:\Windows\System\hTAntgh.exe
  C:\Windows\System\hTAntgh.exe
  2⤵
  PID:6492
- C:\Windows\System\GhPgFbl.exe
  C:\Windows\System\GhPgFbl.exe
  2⤵
  PID:6552
- C:\Windows\System\FYXPCsI.exe
  C:\Windows\System\FYXPCsI.exe
  2⤵
  PID:6612
- C:\Windows\System\gQeWMlO.exe
  C:\Windows\System\gQeWMlO.exe
  2⤵
  PID:6688
- C:\Windows\System\xJtcAVQ.exe
  C:\Windows\System\xJtcAVQ.exe
  2⤵
  PID:6744
- C:\Windows\System\jlNRHte.exe
  C:\Windows\System\jlNRHte.exe
  2⤵
  PID:6804
- C:\Windows\System\hSsEjZM.exe
  C:\Windows\System\hSsEjZM.exe
  2⤵
  PID:6864
- C:\Windows\System\YKvlXrF.exe
  C:\Windows\System\YKvlXrF.exe
  2⤵
  PID:6920
- C:\Windows\System\ZsfZAkC.exe
  C:\Windows\System\ZsfZAkC.exe
  2⤵
  PID:6996
- C:\Windows\System\HNNZDBn.exe
  C:\Windows\System\HNNZDBn.exe
  2⤵
  PID:7052
- C:\Windows\System\aDeNsCC.exe
  C:\Windows\System\aDeNsCC.exe
  2⤵
  PID:7112
- C:\Windows\System\rBDQmMS.exe
  C:\Windows\System\rBDQmMS.exe
  2⤵
  PID:5956
- C:\Windows\System\kUDWlQt.exe
  C:\Windows\System\kUDWlQt.exe
  2⤵
  PID:2460
- C:\Windows\System\AmuQxTh.exe
  C:\Windows\System\AmuQxTh.exe
  2⤵
  PID:5700
- C:\Windows\System\pUMIABa.exe
  C:\Windows\System\pUMIABa.exe
  2⤵
  PID:6240
- C:\Windows\System\JKYzfJp.exe
  C:\Windows\System\JKYzfJp.exe
  2⤵
  PID:1772
- C:\Windows\System\xPdqvuX.exe
  C:\Windows\System\xPdqvuX.exe
  2⤵
  PID:4976
- C:\Windows\System\AexHVox.exe
  C:\Windows\System\AexHVox.exe
  2⤵
  PID:6604
- C:\Windows\System\XHtaAOe.exe
  C:\Windows\System\XHtaAOe.exe
  2⤵
  PID:6716
- C:\Windows\System\ifFmMGk.exe
  C:\Windows\System\ifFmMGk.exe
  2⤵
  PID:6836
- C:\Windows\System\TvHBJfj.exe
  C:\Windows\System\TvHBJfj.exe
  2⤵
  PID:6968
- C:\Windows\System\EetEjLw.exe
  C:\Windows\System\EetEjLw.exe
  2⤵
  PID:7084
- C:\Windows\System\IZEkHeO.exe
  C:\Windows\System\IZEkHeO.exe
  2⤵
  PID:684
- C:\Windows\System\guYskYv.exe
  C:\Windows\System\guYskYv.exe
  2⤵
  PID:5696
- C:\Windows\System\jJUpCRZ.exe
  C:\Windows\System\jJUpCRZ.exe
  2⤵
  PID:6416
- C:\Windows\System\KipSdNU.exe
  C:\Windows\System\KipSdNU.exe
  2⤵
  PID:6580
- C:\Windows\System\dXxLTZa.exe
  C:\Windows\System\dXxLTZa.exe
  2⤵
  PID:2268
- C:\Windows\System\jcbpaNd.exe
  C:\Windows\System\jcbpaNd.exe
  2⤵
  PID:6948
- C:\Windows\System\hFHNfkm.exe
  C:\Windows\System\hFHNfkm.exe
  2⤵
  PID:7144
- C:\Windows\System\bCrwijx.exe
  C:\Windows\System\bCrwijx.exe
  2⤵
  PID:6216
- C:\Windows\System\QFnclHa.exe
  C:\Windows\System\QFnclHa.exe
  2⤵
  PID:7192
- C:\Windows\System\gMOCpct.exe
  C:\Windows\System\gMOCpct.exe
  2⤵
  PID:7220
- C:\Windows\System\MZskgUA.exe
  C:\Windows\System\MZskgUA.exe
  2⤵
  PID:7248
- C:\Windows\System\IYyhKbv.exe
  C:\Windows\System\IYyhKbv.exe
  2⤵
  PID:7344
- C:\Windows\System\GJKZUNC.exe
  C:\Windows\System\GJKZUNC.exe
  2⤵
  PID:7372
- C:\Windows\System\ELRItnx.exe
  C:\Windows\System\ELRItnx.exe
  2⤵
  PID:7424
- C:\Windows\System\PlgkrRC.exe
  C:\Windows\System\PlgkrRC.exe
  2⤵
  PID:7456
- C:\Windows\System\gaEhjmq.exe
  C:\Windows\System\gaEhjmq.exe
  2⤵
  PID:7492
- C:\Windows\System\ihhKspt.exe
  C:\Windows\System\ihhKspt.exe
  2⤵
  PID:7520
- C:\Windows\System\DjZFWJI.exe
  C:\Windows\System\DjZFWJI.exe
  2⤵
  PID:7548
- C:\Windows\System\LFLiMTU.exe
  C:\Windows\System\LFLiMTU.exe
  2⤵
  PID:7568
- C:\Windows\System\QQIfvOH.exe
  C:\Windows\System\QQIfvOH.exe
  2⤵
  PID:7588
- C:\Windows\System\etyzaku.exe
  C:\Windows\System\etyzaku.exe
  2⤵
  PID:7620
- C:\Windows\System\MJNVcyN.exe
  C:\Windows\System\MJNVcyN.exe
  2⤵
  PID:7648
- C:\Windows\System\sryiDlp.exe
  C:\Windows\System\sryiDlp.exe
  2⤵
  PID:7664
- C:\Windows\System\eySMQVm.exe
  C:\Windows\System\eySMQVm.exe
  2⤵
  PID:7740
- C:\Windows\System\sbTcRPd.exe
  C:\Windows\System\sbTcRPd.exe
  2⤵
  PID:7784
- C:\Windows\System\OffbgZT.exe
  C:\Windows\System\OffbgZT.exe
  2⤵
  PID:7800
- C:\Windows\System\uAjwgkE.exe
  C:\Windows\System\uAjwgkE.exe
  2⤵
  PID:7816
- C:\Windows\System\hNwRiDe.exe
  C:\Windows\System\hNwRiDe.exe
  2⤵
  PID:7832
- C:\Windows\System\KGGCQda.exe
  C:\Windows\System\KGGCQda.exe
  2⤵
  PID:7848
- C:\Windows\System\pQjeimG.exe
  C:\Windows\System\pQjeimG.exe
  2⤵
  PID:7896
- C:\Windows\System\xykJODz.exe
  C:\Windows\System\xykJODz.exe
  2⤵
  PID:7924
- C:\Windows\System\ILeDPJG.exe
  C:\Windows\System\ILeDPJG.exe
  2⤵
  PID:7944
- C:\Windows\System\gMUgRco.exe
  C:\Windows\System\gMUgRco.exe
  2⤵
  PID:7972
- C:\Windows\System\kKtEJZc.exe
  C:\Windows\System\kKtEJZc.exe
  2⤵
  PID:7992
- C:\Windows\System\wInCPiP.exe
  C:\Windows\System\wInCPiP.exe
  2⤵
  PID:8008
- C:\Windows\System\CDiIlxR.exe
  C:\Windows\System\CDiIlxR.exe
  2⤵
  PID:8040
- C:\Windows\System\HhIJhwk.exe
  C:\Windows\System\HhIJhwk.exe
  2⤵
  PID:8100
- C:\Windows\System\XrAtoHr.exe
  C:\Windows\System\XrAtoHr.exe
  2⤵
  PID:8116
- C:\Windows\System\BhAPNez.exe
  C:\Windows\System\BhAPNez.exe
  2⤵
  PID:8184
- C:\Windows\System\BncEXyv.exe
  C:\Windows\System\BncEXyv.exe
  2⤵
  PID:1828
- C:\Windows\System\OAiTNrZ.exe
  C:\Windows\System\OAiTNrZ.exe
  2⤵
  PID:3752
- C:\Windows\System\fOmBlyP.exe
  C:\Windows\System\fOmBlyP.exe
  2⤵
  PID:1580
- C:\Windows\System\CHbUjkh.exe
  C:\Windows\System\CHbUjkh.exe
  2⤵
  PID:3916
- C:\Windows\System\hkXJLjq.exe
  C:\Windows\System\hkXJLjq.exe
  2⤵
  PID:2240
- C:\Windows\System\MXCUwbB.exe
  C:\Windows\System\MXCUwbB.exe
  2⤵
  PID:1676
- C:\Windows\System\aBlvgoR.exe
  C:\Windows\System\aBlvgoR.exe
  2⤵
  PID:4012
- C:\Windows\System\AXbwBHX.exe
  C:\Windows\System\AXbwBHX.exe
  2⤵
  PID:4768
- C:\Windows\System\YMIVcmn.exe
  C:\Windows\System\YMIVcmn.exe
  2⤵
  PID:3084
- C:\Windows\System\XCEyVUd.exe
  C:\Windows\System\XCEyVUd.exe
  2⤵
  PID:1508
- C:\Windows\System\zLbDsrC.exe
  C:\Windows\System\zLbDsrC.exe
  2⤵
  PID:7320
- C:\Windows\System\DgtcQUY.exe
  C:\Windows\System\DgtcQUY.exe
  2⤵
  PID:7408
- C:\Windows\System\wEiiJNd.exe
  C:\Windows\System\wEiiJNd.exe
  2⤵
  PID:7484
- C:\Windows\System\wMtOxhO.exe
  C:\Windows\System\wMtOxhO.exe
  2⤵
  PID:7556
- C:\Windows\System\uyVmBWo.exe
  C:\Windows\System\uyVmBWo.exe
  2⤵
  PID:7628
- C:\Windows\System\GaYRanm.exe
  C:\Windows\System\GaYRanm.exe
  2⤵
  PID:7700
- C:\Windows\System\KBJGglx.exe
  C:\Windows\System\KBJGglx.exe
  2⤵
  PID:7400
- C:\Windows\System\FNnCiFx.exe
  C:\Windows\System\FNnCiFx.exe
  2⤵
  PID:3420
- C:\Windows\System\yCyjjTA.exe
  C:\Windows\System\yCyjjTA.exe
  2⤵
  PID:7808
- C:\Windows\System\vdGblMI.exe
  C:\Windows\System\vdGblMI.exe
  2⤵
  PID:7840
- C:\Windows\System\iaktFOv.exe
  C:\Windows\System\iaktFOv.exe
  2⤵
  PID:7912
- C:\Windows\System\wEygGIo.exe
  C:\Windows\System\wEygGIo.exe
  2⤵
  PID:7988
- C:\Windows\System\MChkPvT.exe
  C:\Windows\System\MChkPvT.exe
  2⤵
  PID:8028
- C:\Windows\System\FhjQTew.exe
  C:\Windows\System\FhjQTew.exe
  2⤵
  PID:8128
- C:\Windows\System\IQcaZDn.exe
  C:\Windows\System\IQcaZDn.exe
  2⤵
  PID:8172
- C:\Windows\System\DAqAxaY.exe
  C:\Windows\System\DAqAxaY.exe
  2⤵
  PID:1708
- C:\Windows\System\HVQAfKK.exe
  C:\Windows\System\HVQAfKK.exe
  2⤵
  PID:5368
- C:\Windows\System\GLrjmPP.exe
  C:\Windows\System\GLrjmPP.exe
  2⤵
  PID:5092
- C:\Windows\System\MEglOsC.exe
  C:\Windows\System\MEglOsC.exe
  2⤵
  PID:2224
- C:\Windows\System\ivXeejw.exe
  C:\Windows\System\ivXeejw.exe
  2⤵
  PID:5028
- C:\Windows\System\OxaSjMH.exe
  C:\Windows\System\OxaSjMH.exe
  2⤵
  PID:7860
- C:\Windows\System\dHSDnfc.exe
  C:\Windows\System\dHSDnfc.exe
  2⤵
  PID:4328
- C:\Windows\System\dNOtkRc.exe
  C:\Windows\System\dNOtkRc.exe
  2⤵
  PID:7536
- C:\Windows\System\PKZKnNK.exe
  C:\Windows\System\PKZKnNK.exe
  2⤵
  PID:7656
- C:\Windows\System\UkDuqvN.exe
  C:\Windows\System\UkDuqvN.exe
  2⤵
  PID:7576
- C:\Windows\System\KHRZQnQ.exe
  C:\Windows\System\KHRZQnQ.exe
  2⤵
  PID:7952
- C:\Windows\System\QYWhioy.exe
  C:\Windows\System\QYWhioy.exe
  2⤵
  PID:8160
- C:\Windows\System\oKIKFLn.exe
  C:\Windows\System\oKIKFLn.exe
  2⤵
  PID:3648
- C:\Windows\System\KdkIOra.exe
  C:\Windows\System\KdkIOra.exe
  2⤵
  PID:1880
- C:\Windows\System\OWSUsjr.exe
  C:\Windows\System\OWSUsjr.exe
  2⤵
  PID:696
- C:\Windows\System\iJEPJsJ.exe
  C:\Windows\System\iJEPJsJ.exe
  2⤵
  PID:7448
- C:\Windows\System\dlvPsuo.exe
  C:\Windows\System\dlvPsuo.exe
  2⤵
  PID:7720
- C:\Windows\System\zKKXBHf.exe
  C:\Windows\System\zKKXBHf.exe
  2⤵
  PID:7964
- C:\Windows\System\tpyLpUZ.exe
  C:\Windows\System\tpyLpUZ.exe
  2⤵
  PID:5112
- C:\Windows\System\YGJWVmW.exe
  C:\Windows\System\YGJWVmW.exe
  2⤵
  PID:7504
- C:\Windows\System\PetqIfs.exe
  C:\Windows\System\PetqIfs.exe
  2⤵
  PID:7932
- C:\Windows\System\xfTUhjb.exe
  C:\Windows\System\xfTUhjb.exe
  2⤵
  PID:4588
- C:\Windows\System\ruwdyuZ.exe
  C:\Windows\System\ruwdyuZ.exe
  2⤵
  PID:8232
- C:\Windows\System\izTuydB.exe
  C:\Windows\System\izTuydB.exe
  2⤵
  PID:8260
- C:\Windows\System\QmlLTzN.exe
  C:\Windows\System\QmlLTzN.exe
  2⤵
  PID:8288
- C:\Windows\System\uKBUNDa.exe
  C:\Windows\System\uKBUNDa.exe
  2⤵
  PID:8316
- C:\Windows\System\WDnWptw.exe
  C:\Windows\System\WDnWptw.exe
  2⤵
  PID:8344
- C:\Windows\System\sGBewjE.exe
  C:\Windows\System\sGBewjE.exe
  2⤵
  PID:8372
- C:\Windows\System\GtWMSCk.exe
  C:\Windows\System\GtWMSCk.exe
  2⤵
  PID:8400
- C:\Windows\System\IXwOHXP.exe
  C:\Windows\System\IXwOHXP.exe
  2⤵
  PID:8428
- C:\Windows\System\bsYxwet.exe
  C:\Windows\System\bsYxwet.exe
  2⤵
  PID:8472
- C:\Windows\System\Zhdkuyb.exe
  C:\Windows\System\Zhdkuyb.exe
  2⤵
  PID:8488
- C:\Windows\System\JsXIpVo.exe
  C:\Windows\System\JsXIpVo.exe
  2⤵
  PID:8512
- C:\Windows\System\EVifOUh.exe
  C:\Windows\System\EVifOUh.exe
  2⤵
  PID:8544
- C:\Windows\System\bpDjQMX.exe
  C:\Windows\System\bpDjQMX.exe
  2⤵
  PID:8564
- C:\Windows\System\LEAMaMz.exe
  C:\Windows\System\LEAMaMz.exe
  2⤵
  PID:8600
- C:\Windows\System\Admixac.exe
  C:\Windows\System\Admixac.exe
  2⤵
  PID:8628
- C:\Windows\System\pxGOEsI.exe
  C:\Windows\System\pxGOEsI.exe
  2⤵
  PID:8660
- C:\Windows\System\yrgdMnD.exe
  C:\Windows\System\yrgdMnD.exe
  2⤵
  PID:8688
- C:\Windows\System\Gsploah.exe
  C:\Windows\System\Gsploah.exe
  2⤵
  PID:8708
- C:\Windows\System\UgrloMB.exe
  C:\Windows\System\UgrloMB.exe
  2⤵
  PID:8744
- C:\Windows\System\KtCmTlv.exe
  C:\Windows\System\KtCmTlv.exe
  2⤵
  PID:8772
- C:\Windows\System\yTDNzds.exe
  C:\Windows\System\yTDNzds.exe
  2⤵
  PID:8796
- C:\Windows\System\ptFIKjP.exe
  C:\Windows\System\ptFIKjP.exe
  2⤵
  PID:8828
- C:\Windows\System\QhyNYQy.exe
  C:\Windows\System\QhyNYQy.exe
  2⤵
  PID:8848
- C:\Windows\System\QDZuyYA.exe
  C:\Windows\System\QDZuyYA.exe
  2⤵
  PID:8872
- C:\Windows\System\SqMGWlA.exe
  C:\Windows\System\SqMGWlA.exe
  2⤵
  PID:8888
- C:\Windows\System\BzlKesg.exe
  C:\Windows\System\BzlKesg.exe
  2⤵
  PID:8920
- C:\Windows\System\bbnaLgD.exe
  C:\Windows\System\bbnaLgD.exe
  2⤵
  PID:8948
- C:\Windows\System\MGyMNuQ.exe
  C:\Windows\System\MGyMNuQ.exe
  2⤵
  PID:9000
- C:\Windows\System\tQcTDeO.exe
  C:\Windows\System\tQcTDeO.exe
  2⤵
  PID:9016
- C:\Windows\System\DxvyDaN.exe
  C:\Windows\System\DxvyDaN.exe
  2⤵
  PID:9032
- C:\Windows\System\hNljshS.exe
  C:\Windows\System\hNljshS.exe
  2⤵
  PID:9068
- C:\Windows\System\aqFpOiy.exe
  C:\Windows\System\aqFpOiy.exe
  2⤵
  PID:9112
- C:\Windows\System\jWTjfiB.exe
  C:\Windows\System\jWTjfiB.exe
  2⤵
  PID:9128
- C:\Windows\System\tMFIhgI.exe
  C:\Windows\System\tMFIhgI.exe
  2⤵
  PID:9168
- C:\Windows\System\gOYfkxp.exe
  C:\Windows\System\gOYfkxp.exe
  2⤵
  PID:9192
- C:\Windows\System\anDuwFv.exe
  C:\Windows\System\anDuwFv.exe
  2⤵
  PID:9212
- C:\Windows\System\GPZapUk.exe
  C:\Windows\System\GPZapUk.exe
  2⤵
  PID:8252
- C:\Windows\System\aEiJCbL.exe
  C:\Windows\System\aEiJCbL.exe
  2⤵
  PID:8356
- C:\Windows\System\KokOHbi.exe
  C:\Windows\System\KokOHbi.exe
  2⤵
  PID:8392
- C:\Windows\System\fMfPBBy.exe
  C:\Windows\System\fMfPBBy.exe
  2⤵
  PID:7416
- C:\Windows\System\ydbpNxO.exe
  C:\Windows\System\ydbpNxO.exe
  2⤵
  PID:8496
- C:\Windows\System\RSfdWtV.exe
  C:\Windows\System\RSfdWtV.exe
  2⤵
  PID:8532
- C:\Windows\System\tdDPjlq.exe
  C:\Windows\System\tdDPjlq.exe
  2⤵
  PID:8624
- C:\Windows\System\fyLlife.exe
  C:\Windows\System\fyLlife.exe
  2⤵
  PID:8716
- C:\Windows\System\psASIOp.exe
  C:\Windows\System\psASIOp.exe
  2⤵
  PID:8764
- C:\Windows\System\THyiXwx.exe
  C:\Windows\System\THyiXwx.exe
  2⤵
  PID:8836
- C:\Windows\System\ibypHei.exe
  C:\Windows\System\ibypHei.exe
  2⤵
  PID:8912
- C:\Windows\System\aVGczgj.exe
  C:\Windows\System\aVGczgj.exe
  2⤵
  PID:8936
- C:\Windows\System\zGTcQmm.exe
  C:\Windows\System\zGTcQmm.exe
  2⤵
  PID:9008
- C:\Windows\System\UkyKXZC.exe
  C:\Windows\System\UkyKXZC.exe
  2⤵
  PID:9088
- C:\Windows\System\kItiOlr.exe
  C:\Windows\System\kItiOlr.exe
  2⤵
  PID:9148
- C:\Windows\System\ZFPhfma.exe
  C:\Windows\System\ZFPhfma.exe
  2⤵
  PID:8224
- C:\Windows\System\pFwDkrO.exe
  C:\Windows\System\pFwDkrO.exe
  2⤵
  PID:8284
- C:\Windows\System\VaqjCGy.exe
  C:\Windows\System\VaqjCGy.exe
  2⤵
  PID:8412
- C:\Windows\System\teWokjX.exe
  C:\Windows\System\teWokjX.exe
  2⤵
  PID:8592
- C:\Windows\System\AyxglIy.exe
  C:\Windows\System\AyxglIy.exe
  2⤵
  PID:8756
- C:\Windows\System\zELcJZY.exe
  C:\Windows\System\zELcJZY.exe
  2⤵
  PID:8864
- C:\Windows\System\DnlykbL.exe
  C:\Windows\System\DnlykbL.exe
  2⤵
  PID:8992
- C:\Windows\System\CYzPlDJ.exe
  C:\Windows\System\CYzPlDJ.exe
  2⤵
  PID:9184
- C:\Windows\System\lajPEAo.exe
  C:\Windows\System\lajPEAo.exe
  2⤵
  PID:8504
- C:\Windows\System\rZagZvk.exe
  C:\Windows\System\rZagZvk.exe
  2⤵
  PID:8820
- C:\Windows\System\yeeynni.exe
  C:\Windows\System\yeeynni.exe
  2⤵
  PID:8248
- C:\Windows\System\RLGyQwF.exe
  C:\Windows\System\RLGyQwF.exe
  2⤵
  PID:8636
- C:\Windows\System\PlJSZaE.exe
  C:\Windows\System\PlJSZaE.exe
  2⤵
  PID:9236
- C:\Windows\System\VniGVvS.exe
  C:\Windows\System\VniGVvS.exe
  2⤵
  PID:9252
- C:\Windows\System\LMuReLc.exe
  C:\Windows\System\LMuReLc.exe
  2⤵
  PID:9280
- C:\Windows\System\JbCZVPB.exe
  C:\Windows\System\JbCZVPB.exe
  2⤵
  PID:9312
- C:\Windows\System\EmmEBVm.exe
  C:\Windows\System\EmmEBVm.exe
  2⤵
  PID:9340
- C:\Windows\System\bDktVwj.exe
  C:\Windows\System\bDktVwj.exe
  2⤵
  PID:9368
- C:\Windows\System\hhQpCPS.exe
  C:\Windows\System\hhQpCPS.exe
  2⤵
  PID:9396
- C:\Windows\System\xjLmyAR.exe
  C:\Windows\System\xjLmyAR.exe
  2⤵
  PID:9432
- C:\Windows\System\jtSaJqj.exe
  C:\Windows\System\jtSaJqj.exe
  2⤵
  PID:9464
- C:\Windows\System\GewAepH.exe
  C:\Windows\System\GewAepH.exe
  2⤵
  PID:9492
- C:\Windows\System\xOyBrxS.exe
  C:\Windows\System\xOyBrxS.exe
  2⤵
  PID:9520
- C:\Windows\System\XqxGtOp.exe
  C:\Windows\System\XqxGtOp.exe
  2⤵
  PID:9540
- C:\Windows\System\hjmoTTM.exe
  C:\Windows\System\hjmoTTM.exe
  2⤵
  PID:9576
- C:\Windows\System\CClRjRC.exe
  C:\Windows\System\CClRjRC.exe
  2⤵
  PID:9604
- C:\Windows\System\JiRHzTj.exe
  C:\Windows\System\JiRHzTj.exe
  2⤵
  PID:9632
- C:\Windows\System\gtSUzvv.exe
  C:\Windows\System\gtSUzvv.exe
  2⤵
  PID:9664
- C:\Windows\System\ebdALfg.exe
  C:\Windows\System\ebdALfg.exe
  2⤵
  PID:9692
- C:\Windows\System\lrXJXUx.exe
  C:\Windows\System\lrXJXUx.exe
  2⤵
  PID:9716
- C:\Windows\System\itgnClz.exe
  C:\Windows\System\itgnClz.exe
  2⤵
  PID:9748
- C:\Windows\System\oFTDTxz.exe
  C:\Windows\System\oFTDTxz.exe
  2⤵
  PID:9776
- C:\Windows\System\ehOuwDl.exe
  C:\Windows\System\ehOuwDl.exe
  2⤵
  PID:9804
- C:\Windows\System\bmULNYm.exe
  C:\Windows\System\bmULNYm.exe
  2⤵
  PID:9820
- C:\Windows\System\snSKgiO.exe
  C:\Windows\System\snSKgiO.exe
  2⤵
  PID:9860
- C:\Windows\System\UHkjbrh.exe
  C:\Windows\System\UHkjbrh.exe
  2⤵
  PID:9888
- C:\Windows\System\tkHMibx.exe
  C:\Windows\System\tkHMibx.exe
  2⤵
  PID:9916
- C:\Windows\System\fPdfHLW.exe
  C:\Windows\System\fPdfHLW.exe
  2⤵
  PID:9944
- C:\Windows\System\jhPjrNf.exe
  C:\Windows\System\jhPjrNf.exe
  2⤵
  PID:9972
- C:\Windows\System\lWZxxGu.exe
  C:\Windows\System\lWZxxGu.exe
  2⤵
  PID:10000
- C:\Windows\System\nzVwStn.exe
  C:\Windows\System\nzVwStn.exe
  2⤵
  PID:10028
- C:\Windows\System\HshCLOW.exe
  C:\Windows\System\HshCLOW.exe
  2⤵
  PID:10056
- C:\Windows\System\kwgcNSB.exe
  C:\Windows\System\kwgcNSB.exe
  2⤵
  PID:10084
- C:\Windows\System\HemFZax.exe
  C:\Windows\System\HemFZax.exe
  2⤵
  PID:10100
- C:\Windows\System\ReLUNnH.exe
  C:\Windows\System\ReLUNnH.exe
  2⤵
  PID:10140
- C:\Windows\System\ewWQIxo.exe
  C:\Windows\System\ewWQIxo.exe
  2⤵
  PID:10156
- C:\Windows\System\oqqAkRu.exe
  C:\Windows\System\oqqAkRu.exe
  2⤵
  PID:10184
- C:\Windows\System\IiFeOle.exe
  C:\Windows\System\IiFeOle.exe
  2⤵
  PID:10224
- C:\Windows\System\LiMjQaM.exe
  C:\Windows\System\LiMjQaM.exe
  2⤵
  PID:9224
- C:\Windows\System\dQYZUNH.exe
  C:\Windows\System\dQYZUNH.exe
  2⤵
  PID:9296
- C:\Windows\System\MknHSVc.exe
  C:\Windows\System\MknHSVc.exe
  2⤵
  PID:9300
- C:\Windows\System\ocYdeoy.exe
  C:\Windows\System\ocYdeoy.exe
  2⤵
  PID:9428
- C:\Windows\System\WGhuAof.exe
  C:\Windows\System\WGhuAof.exe
  2⤵
  PID:9484
- C:\Windows\System\BXCSooR.exe
  C:\Windows\System\BXCSooR.exe
  2⤵
  PID:9536
- C:\Windows\System\ZvwsYRT.exe
  C:\Windows\System\ZvwsYRT.exe
  2⤵
  PID:9616
- C:\Windows\System\MPfBdcZ.exe
  C:\Windows\System\MPfBdcZ.exe
  2⤵
  PID:9688
- C:\Windows\System\SMdmVMA.exe
  C:\Windows\System\SMdmVMA.exe
  2⤵
  PID:9744
- C:\Windows\System\UYGmdXl.exe
  C:\Windows\System\UYGmdXl.exe
  2⤵
  PID:9792
- C:\Windows\System\Zhbqkap.exe
  C:\Windows\System\Zhbqkap.exe
  2⤵
  PID:9872
- C:\Windows\System\bfTuevG.exe
  C:\Windows\System\bfTuevG.exe
  2⤵
  PID:9936
- C:\Windows\System\pxHGMFW.exe
  C:\Windows\System\pxHGMFW.exe
  2⤵
  PID:10012
- C:\Windows\System\MnwEJge.exe
  C:\Windows\System\MnwEJge.exe
  2⤵
  PID:10076
- C:\Windows\System\CKwQRef.exe
  C:\Windows\System\CKwQRef.exe
  2⤵
  PID:10116
- C:\Windows\System\bkdFpGO.exe
  C:\Windows\System\bkdFpGO.exe
  2⤵
  PID:10204
- C:\Windows\System\NQKelEE.exe
  C:\Windows\System\NQKelEE.exe
  2⤵
  PID:9220
- C:\Windows\System\YCQhJZw.exe
  C:\Windows\System\YCQhJZw.exe
  2⤵
  PID:9356
- C:\Windows\System\NthtHrT.exe
  C:\Windows\System\NthtHrT.exe
  2⤵
  PID:9588
- C:\Windows\System\LieWhEH.exe
  C:\Windows\System\LieWhEH.exe
  2⤵
  PID:9732
- C:\Windows\System\pfzBqrd.exe
  C:\Windows\System\pfzBqrd.exe
  2⤵
  PID:9852
- C:\Windows\System\mQiWSDa.exe
  C:\Windows\System\mQiWSDa.exe
  2⤵
  PID:9988
- C:\Windows\System\ZVbxqgo.exe
  C:\Windows\System\ZVbxqgo.exe
  2⤵
  PID:10136
- C:\Windows\System\NsnhZwH.exe
  C:\Windows\System\NsnhZwH.exe
  2⤵
  PID:9320
- C:\Windows\System\GbLyLFN.exe
  C:\Windows\System\GbLyLFN.exe
  2⤵
  PID:9724
- C:\Windows\System\FAbWjnG.exe
  C:\Windows\System\FAbWjnG.exe
  2⤵
  PID:9940
- C:\Windows\System\GwJGeqD.exe
  C:\Windows\System\GwJGeqD.exe
  2⤵
  PID:9548
- C:\Windows\System\vvYCfal.exe
  C:\Windows\System\vvYCfal.exe
  2⤵
  PID:10096
- C:\Windows\System\APluQOh.exe
  C:\Windows\System\APluQOh.exe
  2⤵
  PID:10264
- C:\Windows\System\dFKqUzk.exe
  C:\Windows\System\dFKqUzk.exe
  2⤵
  PID:10280
- C:\Windows\System\jAFQQKm.exe
  C:\Windows\System\jAFQQKm.exe
  2⤵
  PID:10296
- C:\Windows\System\NRayPmP.exe
  C:\Windows\System\NRayPmP.exe
  2⤵
  PID:10312
- C:\Windows\System\lPhbpuD.exe
  C:\Windows\System\lPhbpuD.exe
  2⤵
  PID:10344
- C:\Windows\System\UiOEjsO.exe
  C:\Windows\System\UiOEjsO.exe
  2⤵
  PID:10392
- C:\Windows\System\IqDztKq.exe
  C:\Windows\System\IqDztKq.exe
  2⤵
  PID:10420
- C:\Windows\System\xFNuYsJ.exe
  C:\Windows\System\xFNuYsJ.exe
  2⤵
  PID:10460
- C:\Windows\System\ZLpoqDK.exe
  C:\Windows\System\ZLpoqDK.exe
  2⤵
  PID:10488
- C:\Windows\System\Afyexkf.exe
  C:\Windows\System\Afyexkf.exe
  2⤵
  PID:10516
- C:\Windows\System\NPfObqB.exe
  C:\Windows\System\NPfObqB.exe
  2⤵
  PID:10532
- C:\Windows\System\ARLvCCn.exe
  C:\Windows\System\ARLvCCn.exe
  2⤵
  PID:10556
- C:\Windows\System\VmSEUys.exe
  C:\Windows\System\VmSEUys.exe
  2⤵
  PID:10596
- C:\Windows\System\RCfTRKo.exe
  C:\Windows\System\RCfTRKo.exe
  2⤵
  PID:10624
- C:\Windows\System\SeKIlib.exe
  C:\Windows\System\SeKIlib.exe
  2⤵
  PID:10656
- C:\Windows\System\ldHfzsN.exe
  C:\Windows\System\ldHfzsN.exe
  2⤵
  PID:10672
- C:\Windows\System\QBZfQfH.exe
  C:\Windows\System\QBZfQfH.exe
  2⤵
  PID:10724
- C:\Windows\System\jdCIqYD.exe
  C:\Windows\System\jdCIqYD.exe
  2⤵
  PID:10740
- C:\Windows\System\XBwqrBX.exe
  C:\Windows\System\XBwqrBX.exe
  2⤵
  PID:10756
- C:\Windows\System\SQSTutu.exe
  C:\Windows\System\SQSTutu.exe
  2⤵
  PID:10784
- C:\Windows\System\ZTNoOhr.exe
  C:\Windows\System\ZTNoOhr.exe
  2⤵
  PID:10812
- C:\Windows\System\MZzdOtf.exe
  C:\Windows\System\MZzdOtf.exe
  2⤵
  PID:10852
- C:\Windows\System\hvTHbdG.exe
  C:\Windows\System\hvTHbdG.exe
  2⤵
  PID:10876
- C:\Windows\System\gByBzbk.exe
  C:\Windows\System\gByBzbk.exe
  2⤵
  PID:10896
- C:\Windows\System\XFlsYLK.exe
  C:\Windows\System\XFlsYLK.exe
  2⤵
  PID:10936
- C:\Windows\System\JiYCElt.exe
  C:\Windows\System\JiYCElt.exe
  2⤵
  PID:10952
- C:\Windows\System\QzqRSDq.exe
  C:\Windows\System\QzqRSDq.exe
  2⤵
  PID:10984
- C:\Windows\System\KzabUtf.exe
  C:\Windows\System\KzabUtf.exe
  2⤵
  PID:11008
- C:\Windows\System\UqSajkD.exe
  C:\Windows\System\UqSajkD.exe
  2⤵
  PID:11028
- C:\Windows\System\pLLfmry.exe
  C:\Windows\System\pLLfmry.exe
  2⤵
  PID:11064
- C:\Windows\System\IlPgoNf.exe
  C:\Windows\System\IlPgoNf.exe
  2⤵
  PID:11104
- C:\Windows\System\MzkkhRL.exe
  C:\Windows\System\MzkkhRL.exe
  2⤵
  PID:11120
- C:\Windows\System\BpxkquG.exe
  C:\Windows\System\BpxkquG.exe
  2⤵
  PID:11148
- C:\Windows\System\mXQYRzt.exe
  C:\Windows\System\mXQYRzt.exe
  2⤵
  PID:11176
- C:\Windows\System\CwYPyPQ.exe
  C:\Windows\System\CwYPyPQ.exe
  2⤵
  PID:11216
- C:\Windows\System\LHlYcoM.exe
  C:\Windows\System\LHlYcoM.exe
  2⤵
  PID:11240
- C:\Windows\System\COXDJTx.exe
  C:\Windows\System\COXDJTx.exe
  2⤵
  PID:11260
- C:\Windows\System\IJhARIN.exe
  C:\Windows\System\IJhARIN.exe
  2⤵
  PID:10292
- C:\Windows\System\ddslvRG.exe
  C:\Windows\System\ddslvRG.exe
  2⤵
  PID:10352
- C:\Windows\System\GMNMjra.exe
  C:\Windows\System\GMNMjra.exe
  2⤵
  PID:10452
- C:\Windows\System\FYhROuH.exe
  C:\Windows\System\FYhROuH.exe
  2⤵
  PID:10528
- C:\Windows\System\BakBqXZ.exe
  C:\Windows\System\BakBqXZ.exe
  2⤵
  PID:10568
- C:\Windows\System\KwTYkab.exe
  C:\Windows\System\KwTYkab.exe
  2⤵
  PID:10652
- C:\Windows\System\esORzqu.exe
  C:\Windows\System\esORzqu.exe
  2⤵
  PID:10708
- C:\Windows\System\rUWNcdu.exe
  C:\Windows\System\rUWNcdu.exe
  2⤵
  PID:10776
- C:\Windows\System\vIpvDiB.exe
  C:\Windows\System\vIpvDiB.exe
  2⤵
  PID:10844
- C:\Windows\System\VfLsFhC.exe
  C:\Windows\System\VfLsFhC.exe
  2⤵
  PID:10916
- C:\Windows\System\HyMLqau.exe
  C:\Windows\System\HyMLqau.exe
  2⤵
  PID:10976
- C:\Windows\System\ZoOpwVZ.exe
  C:\Windows\System\ZoOpwVZ.exe
  2⤵
  PID:11052
- C:\Windows\System\OeIuyXT.exe
  C:\Windows\System\OeIuyXT.exe
  2⤵
  PID:11092
- C:\Windows\System\BQGTZln.exe
  C:\Windows\System\BQGTZln.exe
  2⤵
  PID:11136
- C:\Windows\System\MlTiIel.exe
  C:\Windows\System\MlTiIel.exe
  2⤵
  PID:11212
- C:\Windows\System\DlVVyyz.exe
  C:\Windows\System\DlVVyyz.exe
  2⤵
  PID:10260
- C:\Windows\System\zXBngwl.exe
  C:\Windows\System\zXBngwl.exe
  2⤵
  PID:10444
- C:\Windows\System\HCjxwAG.exe
  C:\Windows\System\HCjxwAG.exe
  2⤵
  PID:10588
- C:\Windows\System\hNfQhDV.exe
  C:\Windows\System\hNfQhDV.exe
  2⤵
  PID:10780
- C:\Windows\System\vgSfCgM.exe
  C:\Windows\System\vgSfCgM.exe
  2⤵
  PID:10884
- C:\Windows\System\ztVXUtF.exe
  C:\Windows\System\ztVXUtF.exe
  2⤵
  PID:11048
- C:\Windows\System\GrfCSjN.exe
  C:\Windows\System\GrfCSjN.exe
  2⤵
  PID:11168
- C:\Windows\System\bFeStci.exe
  C:\Windows\System\bFeStci.exe
  2⤵
  PID:10376
- C:\Windows\System\QqmobqU.exe
  C:\Windows\System\QqmobqU.exe
  2⤵
  PID:10964
- C:\Windows\System\nINQaBT.exe
  C:\Windows\System\nINQaBT.exe
  2⤵
  PID:11024
- C:\Windows\System\FrUooqN.exe
  C:\Windows\System\FrUooqN.exe
  2⤵
  PID:11196
- C:\Windows\System\gIbzHux.exe
  C:\Windows\System\gIbzHux.exe
  2⤵
  PID:10720
- C:\Windows\System\CgWesIs.exe
  C:\Windows\System\CgWesIs.exe
  2⤵
  PID:11288
- C:\Windows\System\PxmhLjD.exe
  C:\Windows\System\PxmhLjD.exe
  2⤵
  PID:11320
- C:\Windows\System\oAyYxwn.exe
  C:\Windows\System\oAyYxwn.exe
  2⤵
  PID:11352
- C:\Windows\System\blOFxpa.exe
  C:\Windows\System\blOFxpa.exe
  2⤵
  PID:11384
- C:\Windows\System\nWdAaje.exe
  C:\Windows\System\nWdAaje.exe
  2⤵
  PID:11412
- C:\Windows\System\RNxADmP.exe
  C:\Windows\System\RNxADmP.exe
  2⤵
  PID:11436
- C:\Windows\System\ScVkMIu.exe
  C:\Windows\System\ScVkMIu.exe
  2⤵
  PID:11468
- C:\Windows\System\VegFcZY.exe
  C:\Windows\System\VegFcZY.exe
  2⤵
  PID:11484
- C:\Windows\System\oMVWJpM.exe
  C:\Windows\System\oMVWJpM.exe
  2⤵
  PID:11524
- C:\Windows\System\wwQezST.exe
  C:\Windows\System\wwQezST.exe
  2⤵
  PID:11540
- C:\Windows\System\WwmNUQU.exe
  C:\Windows\System\WwmNUQU.exe
  2⤵
  PID:11580
- C:\Windows\System\jWnXCei.exe
  C:\Windows\System\jWnXCei.exe
  2⤵
  PID:11596
- C:\Windows\System\feNyydd.exe
  C:\Windows\System\feNyydd.exe
  2⤵
  PID:11636
- C:\Windows\System\IqjCoOp.exe
  C:\Windows\System\IqjCoOp.exe
  2⤵
  PID:11652
- C:\Windows\System\VMdjSYZ.exe
  C:\Windows\System\VMdjSYZ.exe
  2⤵
  PID:11680
- C:\Windows\System\GIVCNAe.exe
  C:\Windows\System\GIVCNAe.exe
  2⤵
  PID:11708
- C:\Windows\System\qmaCumV.exe
  C:\Windows\System\qmaCumV.exe
  2⤵
  PID:11740
- C:\Windows\System\eEXhxsX.exe
  C:\Windows\System\eEXhxsX.exe
  2⤵
  PID:11760
- C:\Windows\System\Alxxuuv.exe
  C:\Windows\System\Alxxuuv.exe
  2⤵
  PID:11792
- C:\Windows\System\GYcqZdi.exe
  C:\Windows\System\GYcqZdi.exe
  2⤵
  PID:11828
- C:\Windows\System\CfaFTry.exe
  C:\Windows\System\CfaFTry.exe
  2⤵
  PID:11848
- C:\Windows\System\VEOwYvg.exe
  C:\Windows\System\VEOwYvg.exe
  2⤵
  PID:11876
- C:\Windows\System\cBvKhfX.exe
  C:\Windows\System\cBvKhfX.exe
  2⤵
  PID:11904
- C:\Windows\System\sKCoiBm.exe
  C:\Windows\System\sKCoiBm.exe
  2⤵
  PID:11940
- C:\Windows\System\hVUAUMC.exe
  C:\Windows\System\hVUAUMC.exe
  2⤵
  PID:11960
- C:\Windows\System\dqmUCSh.exe
  C:\Windows\System\dqmUCSh.exe
  2⤵
  PID:11988
- C:\Windows\System\yZiobSU.exe
  C:\Windows\System\yZiobSU.exe
  2⤵
  PID:12020
- C:\Windows\System\cpvPyLM.exe
  C:\Windows\System\cpvPyLM.exe
  2⤵
  PID:12056
- C:\Windows\System\gymMNCJ.exe
  C:\Windows\System\gymMNCJ.exe
  2⤵
  PID:12084
- C:\Windows\System\LOirHul.exe
  C:\Windows\System\LOirHul.exe
  2⤵
  PID:12100
- C:\Windows\System\VzVIygu.exe
  C:\Windows\System\VzVIygu.exe
  2⤵
  PID:12140
- C:\Windows\System\KfbvqWY.exe
  C:\Windows\System\KfbvqWY.exe
  2⤵
  PID:12168
- C:\Windows\System\tkIgRKx.exe
  C:\Windows\System\tkIgRKx.exe
  2⤵
  PID:12196
- C:\Windows\System\FUameZT.exe
  C:\Windows\System\FUameZT.exe
  2⤵
  PID:12224
- C:\Windows\System\hqwcFTk.exe
  C:\Windows\System\hqwcFTk.exe
  2⤵
  PID:12252
- C:\Windows\System\UeEkWin.exe
  C:\Windows\System\UeEkWin.exe
  2⤵
  PID:12268
- C:\Windows\System\EEiyFUs.exe
  C:\Windows\System\EEiyFUs.exe
  2⤵
  PID:11328
- C:\Windows\System\XqLgEFi.exe
  C:\Windows\System\XqLgEFi.exe
  2⤵
  PID:11368
- C:\Windows\System\rcjtTGS.exe
  C:\Windows\System\rcjtTGS.exe
  2⤵
  PID:11432
- C:\Windows\System\UHSNmXp.exe
  C:\Windows\System\UHSNmXp.exe
  2⤵
  PID:11532
- C:\Windows\System\wdJdKJT.exe
  C:\Windows\System\wdJdKJT.exe
  2⤵
  PID:11616
- C:\Windows\System\EPeHAxK.exe
  C:\Windows\System\EPeHAxK.exe
  2⤵
  PID:11672
- C:\Windows\System\KUGhrtL.exe
  C:\Windows\System\KUGhrtL.exe
  2⤵
  PID:11748
- C:\Windows\System\SlQMqsw.exe
  C:\Windows\System\SlQMqsw.exe
  2⤵
  PID:11804
- C:\Windows\System\yxyjMFy.exe
  C:\Windows\System\yxyjMFy.exe
  2⤵
  PID:11860
- C:\Windows\System\mUxsfqo.exe
  C:\Windows\System\mUxsfqo.exe
  2⤵
  PID:11920
- C:\Windows\System\TgmtzXU.exe
  C:\Windows\System\TgmtzXU.exe
  2⤵
  PID:12004
- C:\Windows\System\cRDYuWJ.exe
  C:\Windows\System\cRDYuWJ.exe
  2⤵
  PID:12040
- C:\Windows\System\NPSZauj.exe
  C:\Windows\System\NPSZauj.exe
  2⤵
  PID:12124
- C:\Windows\System\yKPWPQB.exe
  C:\Windows\System\yKPWPQB.exe
  2⤵
  PID:12192
- C:\Windows\System\MamTzpL.exe
  C:\Windows\System\MamTzpL.exe
  2⤵
  PID:12240
- C:\Windows\System\gZlKkZi.exe
  C:\Windows\System\gZlKkZi.exe
  2⤵
  PID:11344
- C:\Windows\System\rICYsXX.exe
  C:\Windows\System\rICYsXX.exe
  2⤵
  PID:11536
- C:\Windows\System\SoPzZqp.exe
  C:\Windows\System\SoPzZqp.exe
  2⤵
  PID:11648
- C:\Windows\System\bwBnsAJ.exe
  C:\Windows\System\bwBnsAJ.exe
  2⤵
  PID:11788
- C:\Windows\System\bUpMCoT.exe
  C:\Windows\System\bUpMCoT.exe
  2⤵
  PID:11980
- C:\Windows\System\esSKLfp.exe
  C:\Windows\System\esSKLfp.exe
  2⤵
  PID:12160
- C:\Windows\System\LtnKxGK.exe
  C:\Windows\System\LtnKxGK.exe
  2⤵
  PID:11316
- C:\Windows\System\YEjzcgQ.exe
  C:\Windows\System\YEjzcgQ.exe
  2⤵
  PID:11820
- C:\Windows\System\WYweuMe.exe
  C:\Windows\System\WYweuMe.exe
  2⤵
  PID:12076
- C:\Windows\System\xrsRuGs.exe
  C:\Windows\System\xrsRuGs.exe
  2⤵
  PID:11272
- C:\Windows\System\pCxoctc.exe
  C:\Windows\System\pCxoctc.exe
  2⤵
  PID:11704
- C:\Windows\System\lQecqBR.exe
  C:\Windows\System\lQecqBR.exe
  2⤵
  PID:12308
- C:\Windows\System\SMiNiYQ.exe
  C:\Windows\System\SMiNiYQ.exe
  2⤵
  PID:12344
- C:\Windows\System\oBMbqzC.exe
  C:\Windows\System\oBMbqzC.exe
  2⤵
  PID:12376
- C:\Windows\System\PfIGCro.exe
  C:\Windows\System\PfIGCro.exe
  2⤵
  PID:12392
- C:\Windows\System\ZHMZPif.exe
  C:\Windows\System\ZHMZPif.exe
  2⤵
  PID:12420
- C:\Windows\System\jrUSrAZ.exe
  C:\Windows\System\jrUSrAZ.exe
  2⤵
  PID:12444
- C:\Windows\System\kLHAvHJ.exe
  C:\Windows\System\kLHAvHJ.exe
  2⤵
  PID:12468
- C:\Windows\System\WPCNhmc.exe
  C:\Windows\System\WPCNhmc.exe
  2⤵
  PID:12504
- C:\Windows\System\Jgebqqs.exe
  C:\Windows\System\Jgebqqs.exe
  2⤵
  PID:12544
- C:\Windows\System\BTsGOcv.exe
  C:\Windows\System\BTsGOcv.exe
  2⤵
  PID:12560
- C:\Windows\System\QNiwBxZ.exe
  C:\Windows\System\QNiwBxZ.exe
  2⤵
  PID:12600
- C:\Windows\System\SYVtGkF.exe
  C:\Windows\System\SYVtGkF.exe
  2⤵
  PID:12628
- C:\Windows\System\bMKwsXp.exe
  C:\Windows\System\bMKwsXp.exe
  2⤵
  PID:12644
- C:\Windows\System\oRjxjyD.exe
  C:\Windows\System\oRjxjyD.exe
  2⤵
  PID:12684
- C:\Windows\System\rtHfnrA.exe
  C:\Windows\System\rtHfnrA.exe
  2⤵
  PID:12700
- C:\Windows\System\MOURJzh.exe
  C:\Windows\System\MOURJzh.exe
  2⤵
  PID:12740
- C:\Windows\System\uPUiomT.exe
  C:\Windows\System\uPUiomT.exe
  2⤵
  PID:12756
- C:\Windows\System\HiNFphj.exe
  C:\Windows\System\HiNFphj.exe
  2⤵
  PID:12788
- C:\Windows\System\HPkWvJO.exe
  C:\Windows\System\HPkWvJO.exe
  2⤵
  PID:12828
- C:\Windows\System\LhDlJAL.exe
  C:\Windows\System\LhDlJAL.exe
  2⤵
  PID:12856
- C:\Windows\System\FMItXdu.exe
  C:\Windows\System\FMItXdu.exe
  2⤵
  PID:12884
- C:\Windows\System\peyDYof.exe
  C:\Windows\System\peyDYof.exe
  2⤵
  PID:12912
- C:\Windows\System\toblBET.exe
  C:\Windows\System\toblBET.exe
  2⤵
  PID:12940
- C:\Windows\System\eKnUYbv.exe
  C:\Windows\System\eKnUYbv.exe
  2⤵
  PID:12976
- C:\Windows\System\pMqskRh.exe
  C:\Windows\System\pMqskRh.exe
  2⤵
  PID:12992
- C:\Windows\System\AXWgSQz.exe
  C:\Windows\System\AXWgSQz.exe
  2⤵
  PID:13020
- C:\Windows\System\YZBdrXV.exe
  C:\Windows\System\YZBdrXV.exe
  2⤵
  PID:13060
- C:\Windows\System\oQcVXHW.exe
  C:\Windows\System\oQcVXHW.exe
  2⤵
  PID:13088
- C:\Windows\System\EinLyfx.exe
  C:\Windows\System\EinLyfx.exe
  2⤵
  PID:13116
- C:\Windows\System\lxGCFEz.exe
  C:\Windows\System\lxGCFEz.exe
  2⤵
  PID:13144
- C:\Windows\System\CzuHqUT.exe
  C:\Windows\System\CzuHqUT.exe
  2⤵
  PID:13176
- C:\Windows\System\tgSNSmL.exe
  C:\Windows\System\tgSNSmL.exe
  2⤵
  PID:13204
- C:\Windows\System\RKTOlbW.exe
  C:\Windows\System\RKTOlbW.exe
  2⤵
  PID:13228
- C:\Windows\System\gWgfWFY.exe
  C:\Windows\System\gWgfWFY.exe
  2⤵
  PID:13248
- C:\Windows\System\VjttfVD.exe
  C:\Windows\System\VjttfVD.exe
  2⤵
  PID:13280
- C:\Windows\System\mOKHgeq.exe
  C:\Windows\System\mOKHgeq.exe
  2⤵
  PID:13308
- C:\Windows\System\ELAJHNw.exe
  C:\Windows\System\ELAJHNw.exe
  2⤵
  PID:12336
- C:\Windows\System\nnufkRs.exe
  C:\Windows\System\nnufkRs.exe
  2⤵
  PID:12432
- C:\Windows\System\HrfLisU.exe
  C:\Windows\System\HrfLisU.exe
  2⤵
  PID:12524
- C:\Windows\System\CaephIG.exe
  C:\Windows\System\CaephIG.exe
  2⤵
  PID:12556
- C:\Windows\System\IxSHQqy.exe
  C:\Windows\System\IxSHQqy.exe
  2⤵
  PID:12620
- C:\Windows\System\qiVlfVS.exe
  C:\Windows\System\qiVlfVS.exe
  2⤵
  PID:12680
- C:\Windows\System\funWchC.exe
  C:\Windows\System\funWchC.exe
  2⤵
  PID:12780
- C:\Windows\System\hxiTrfl.exe
  C:\Windows\System\hxiTrfl.exe
  2⤵
  PID:12848
- C:\Windows\System\DsmKneu.exe
  C:\Windows\System\DsmKneu.exe
  2⤵
  PID:12904
- C:\Windows\System\ANZmZtf.exe
  C:\Windows\System\ANZmZtf.exe
  2⤵
  PID:12972
- C:\Windows\System\HomLLBX.exe
  C:\Windows\System\HomLLBX.exe
  2⤵
  PID:12092
- C:\Windows\System\tASVCcW.exe
  C:\Windows\System\tASVCcW.exe
  2⤵
  PID:13104
- C:\Windows\System\vSUZoVr.exe
  C:\Windows\System\vSUZoVr.exe
  2⤵
  PID:13140
- C:\Windows\System\FMDeXcH.exe
  C:\Windows\System\FMDeXcH.exe
  2⤵
  PID:13220
- C:\Windows\System\lBKNKoA.exe
  C:\Windows\System\lBKNKoA.exe
  2⤵
  PID:13296
- C:\Windows\System\JERmZul.exe
  C:\Windows\System\JERmZul.exe
  2⤵
  PID:12408
- C:\Windows\System\jvHLjzR.exe
  C:\Windows\System\jvHLjzR.exe
  2⤵
  PID:12552
- C:\Windows\System\tWSVzdL.exe
  C:\Windows\System\tWSVzdL.exe
  2⤵
  PID:12596
- C:\Windows\System\VcbEGwU.exe
  C:\Windows\System\VcbEGwU.exe
  2⤵
  PID:12728
- C:\Windows\System\ZcanBEI.exe
  C:\Windows\System\ZcanBEI.exe
  2⤵
  PID:12824
- C:\Windows\System\lgxlxcS.exe
  C:\Windows\System\lgxlxcS.exe
  2⤵
  PID:13044
- C:\Windows\System\qvwIaiD.exe
  C:\Windows\System\qvwIaiD.exe
  2⤵
  PID:13188
- C:\Windows\System\MYHBXLF.exe
  C:\Windows\System\MYHBXLF.exe
  2⤵
  PID:12332
- C:\Windows\System\UxxAfuw.exe
  C:\Windows\System\UxxAfuw.exe
  2⤵
  PID:12540
- C:\Windows\System\mRBIUWL.exe
  C:\Windows\System\mRBIUWL.exe
  2⤵
  PID:12900
- C:\Windows\System\UJFAjwr.exe
  C:\Windows\System\UJFAjwr.exe
  2⤵
  PID:13172
- C:\Windows\System\fydQaGd.exe
  C:\Windows\System\fydQaGd.exe
  2⤵
  PID:13032
- C:\Windows\System\rVxTYGE.exe
  C:\Windows\System\rVxTYGE.exe
  2⤵
  PID:4860
- C:\Windows\System\IyrIRDN.exe
  C:\Windows\System\IyrIRDN.exe
  2⤵
  PID:13320
- C:\Windows\System\QPgnmfh.exe
  C:\Windows\System\QPgnmfh.exe
  2⤵
  PID:13348
- C:\Windows\System\uGbADoI.exe
  C:\Windows\System\uGbADoI.exe
  2⤵
  PID:13388
- C:\Windows\System\lyCeemt.exe
  C:\Windows\System\lyCeemt.exe
  2⤵
  PID:13416
- C:\Windows\System\SCrKAnW.exe
  C:\Windows\System\SCrKAnW.exe
  2⤵
  PID:13444
- C:\Windows\System\tmSnaaq.exe
  C:\Windows\System\tmSnaaq.exe
  2⤵
  PID:13460
- C:\Windows\System\Htobczm.exe
  C:\Windows\System\Htobczm.exe
  2⤵
  PID:13476
- C:\Windows\System\jhrSVzg.exe
  C:\Windows\System\jhrSVzg.exe
  2⤵
  PID:13528
- C:\Windows\System\zVWhJkT.exe
  C:\Windows\System\zVWhJkT.exe
  2⤵
  PID:13544
- C:\Windows\System\uwibGxA.exe
  C:\Windows\System\uwibGxA.exe
  2⤵
  PID:13560
- C:\Windows\System\rmhLAGF.exe
  C:\Windows\System\rmhLAGF.exe
  2⤵
  PID:13588
- C:\Windows\System\SZxPIFY.exe
  C:\Windows\System\SZxPIFY.exe
  2⤵
  PID:13628
- C:\Windows\System\UULrtxZ.exe
  C:\Windows\System\UULrtxZ.exe
  2⤵
  PID:13656
- C:\Windows\System\LlWCftk.exe
  C:\Windows\System\LlWCftk.exe
  2⤵
  PID:13680
- C:\Windows\System\xMTzRcz.exe
  C:\Windows\System\xMTzRcz.exe
  2⤵
  PID:13712
- C:\Windows\System\HthVFqB.exe
  C:\Windows\System\HthVFqB.exe
  2⤵
  PID:13748
- C:\Windows\System\BgyDBXH.exe
  C:\Windows\System\BgyDBXH.exe
  2⤵
  PID:13780
- C:\Windows\System\MhtyjDe.exe
  C:\Windows\System\MhtyjDe.exe
  2⤵
  PID:13796
- C:\Windows\System\FrQeiLD.exe
  C:\Windows\System\FrQeiLD.exe
  2⤵
  PID:13824
- C:\Windows\System\bUbkEHF.exe
  C:\Windows\System\bUbkEHF.exe
  2⤵
  PID:13864
- C:\Windows\System\yPfNOyo.exe
  C:\Windows\System\yPfNOyo.exe
  2⤵
  PID:13892
- C:\Windows\System\peGzovW.exe
  C:\Windows\System\peGzovW.exe
  2⤵
  PID:13920
- C:\Windows\System\fznfzZB.exe
  C:\Windows\System\fznfzZB.exe
  2⤵
  PID:13936
- C:\Windows\System\vcUYPhi.exe
  C:\Windows\System\vcUYPhi.exe
  2⤵
  PID:13976
- C:\Windows\System\olsNHfs.exe
  C:\Windows\System\olsNHfs.exe
  2⤵
  PID:14004
- C:\Windows\System\kkscJuz.exe
  C:\Windows\System\kkscJuz.exe
  2⤵
  PID:14036
- C:\Windows\System\WJTqjMb.exe
  C:\Windows\System\WJTqjMb.exe
  2⤵
  PID:14052
- C:\Windows\System\EsZopjc.exe
  C:\Windows\System\EsZopjc.exe
  2⤵
  PID:14092
- C:\Windows\System\iulSDqh.exe
  C:\Windows\System\iulSDqh.exe
  2⤵
  PID:14108
- C:\Windows\System\Dflszma.exe
  C:\Windows\System\Dflszma.exe
  2⤵
  PID:14136
- C:\Windows\System\lyRZAGT.exe
  C:\Windows\System\lyRZAGT.exe
  2⤵
  PID:14176
- C:\Windows\System\kvDvngJ.exe
  C:\Windows\System\kvDvngJ.exe
  2⤵
  PID:14204
- C:\Windows\System\mkzaDGr.exe
  C:\Windows\System\mkzaDGr.exe
  2⤵
  PID:14220
- C:\Windows\System\iqGEwpf.exe
  C:\Windows\System\iqGEwpf.exe
  2⤵
  PID:14260
- C:\Windows\System\VxaLeQd.exe
  C:\Windows\System\VxaLeQd.exe
  2⤵
  PID:14284
- C:\Windows\System\yylCNny.exe
  C:\Windows\System\yylCNny.exe
  2⤵
  PID:14316
- C:\Windows\System\QIWGPMq.exe
  C:\Windows\System\QIWGPMq.exe
  2⤵
  PID:14332
- C:\Windows\System\sRTRvfl.exe
  C:\Windows\System\sRTRvfl.exe
  2⤵
  PID:13400
- C:\Windows\System\NtQPDYF.exe
  C:\Windows\System\NtQPDYF.exe
  2⤵
  PID:13440
- C:\Windows\System\hiyjQgx.exe
  C:\Windows\System\hiyjQgx.exe
  2⤵
  PID:13512
- C:\Windows\System\nvoQNFc.exe
  C:\Windows\System\nvoQNFc.exe
  2⤵
  PID:13572
- C:\Windows\System\YgZnCYb.exe
  C:\Windows\System\YgZnCYb.exe
  2⤵
  PID:13612
- C:\Windows\System\jumMQUU.exe
  C:\Windows\System\jumMQUU.exe
  2⤵
  PID:13704
- C:\Windows\System\QhCGCAs.exe
  C:\Windows\System\QhCGCAs.exe
  2⤵
  PID:13736
- C:\Windows\System\wMgYucj.exe
  C:\Windows\System\wMgYucj.exe
  2⤵
  PID:13812
- C:\Windows\System\IqqaPCf.exe
  C:\Windows\System\IqqaPCf.exe
  2⤵
  PID:13904
- C:\Windows\System\mxoqPdp.exe
  C:\Windows\System\mxoqPdp.exe
  2⤵
  PID:13956
- C:\Windows\System\VvREHUf.exe
  C:\Windows\System\VvREHUf.exe
  2⤵
  PID:14020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DBiRJbR.exe

Filesize
2.3MB

MD5
1661693c6133091b0ab5fc9bb04ecfe2

SHA1
1e953c7596b42d516de365dd362b54102f5a6a50

SHA256
f1addcd7fb52a975c25226da5ed2eb3d23afb72d16348d8c635fa7643cc584d5

SHA512
e416b56696da6a5bccfdf8e04c27043a9adc039f066e6c424d0edc61547a951c484049c890aac52d8b962b1113bd77bdf171a53ec3a1568ceb0a6b923572e5f4

Download Submit
C:\Windows\System\ECNxfTZ.exe

Filesize
2.3MB

MD5
e23e831de211cb736cde281a8236c297

SHA1
46a81245db262d54590d5634c6bd21e4cea044c0

SHA256
2e974eb1dc16bef6d745c938651a97bf1acdffc4386ff0199fa7a391382298db

SHA512
ee6a9ae2d21f71d974adf2f59d1ac06d9de603f5ddc2ec7a70ff12b4c142ec2c99083e7bbaf1e5335a1cbe91050cee208c7497b332873d4b71abaac9f18e32a2

Download Submit
C:\Windows\System\EpXuHqI.exe

Filesize
2.3MB

MD5
e7f47707d30b8721abd70133ff526aa6

SHA1
4e8989844e764b4a99382bed307448a1d43e9347

SHA256
490ae7f8380e7f585dc04e673862b9f000c2c1610ffbef0c7a5bcd7a9871a300

SHA512
b47e7afd1e42f6056f97b22a5c1e9d6285f991208852e2e4d1b637bc807b558b01047216bfd888c84e7c8438dfa57350a59438827ddfb3f0bc063b17b0044d47

Download Submit
C:\Windows\System\GPIbUzL.exe

Filesize
2.3MB

MD5
a50069e69497a88cc73b58f1f13c066f

SHA1
9e3a75d9d82485aee96b491f8b47d922d5d98fd7

SHA256
e205b1bf85dabf0dfe8a84b643fdda7a6c6c5cebe0b1cb8080c72ad261025dd0

SHA512
73ad2abe8a721da9b21d659d4c0ae9327520a909eee2346d5ad3eea583414b38d3cb67b8e4f8074fb6ff71f64b5a6203fb2e5dffe692472c439dbc59fc7e111f

Download Submit
C:\Windows\System\GaoUMYs.exe

Filesize
2.3MB

MD5
728e047b0afb942dcf0ae20720ff866e

SHA1
45c6aedec78a007710b118e024fc91e477ce0235

SHA256
c8edbfcb591e87aaeb711b2df465c8d451063b63b6b96d321317a72b3742f7c8

SHA512
6220d5a28d0d66a7811ca12d93e0fe0620624bec04828ceb9f3fc7ccd07a526814daae00edfbe55051a087bb24958d80f33571ce8dd5a91459ddb02fd7ed5c1f

Download Submit
C:\Windows\System\GlIiTAs.exe

Filesize
2.3MB

MD5
2080266a204dcaee24e3de77ba6f2e37

SHA1
0d6126305c26ec5a4a14c3f41a20163d780e0409

SHA256
be9d428413dc8902207e3f27a6aa371df6ca7f70ccc987d7930fa26d70aea405

SHA512
a077ea6e42f3ce02f7b66a39ecff6a99d7caf8b7150e1f2cd2fdd34c8c0a6be2f402314d65fe4cde0949bda7b4940920c97b210750c1acc9bfb6daddeb5a7e8a

Download Submit
C:\Windows\System\HwweFxL.exe

Filesize
2.3MB

MD5
44c3206ac07b3750f493a794eb6ac1fd

SHA1
3361deb957deb2b7872d1781f7b798181acf39a0

SHA256
374b598d0aab78f798e185153340b2e11d11e5b7723faddfccbe9235dca8958a

SHA512
47033eecdf6cc346fb61011dcd6312ecbf82bc07802c388502f90e243ab5169c6f87baa194abd18f15bc303d44a76d59ee67786a9973f82e36c9ee1c072dd26b

Download Submit
C:\Windows\System\LhHdbqS.exe

Filesize
2.3MB

MD5
3527a8cf58a0516fb8b67cc5acd2fd7a

SHA1
fa949e2a71563f5e1c5b0359bbb99b8fcec8349d

SHA256
82f20d7a81f9ca839bc553be47134a7bd7fc8850d7da515629413fbb6a3d6a2a

SHA512
2f8712033a5da9b9da51187fd3691860cdbcaffeab77cdc348a69dbe1c20953f29acd4cfbf43c50a557ec6fb78e1856c0e1728340880f0a3064c940c56a5e315

Download Submit
C:\Windows\System\NrRKcCC.exe

Filesize
2.3MB

MD5
fd3b4d883a90677b6dba75246d6ccd53

SHA1
7a844cb436344260ebdc0812cae54c9a19e4a6ec

SHA256
47faefae5b5b3211e7e9f6c77398e781916bac91f3d535afafd611a9110c0853

SHA512
efe96da5449ca52c3f7f47339f59d27f361d382a78c6bc74415e51f647d59b0df31c61698146ca5e7a2b2f02fd17bb67fe615c79d80fec04a11cf77a18e750bb

Download Submit
C:\Windows\System\RiYmhxT.exe

Filesize
2.3MB

MD5
7962537aea6eda3bad78c001848d1158

SHA1
b525948ff5ef8c048fdf1b95b89d018fa59278b1

SHA256
c3f9014e62dfc206b6d7111f186384ba3a6d4b897e225084a82ab0663ddcab08

SHA512
099252f2a63ba65d76962ff3c3c8a73c49047fc8c9de88a0339e86d3214cad63bf6ccb4108e71b2ed029d234bf739ee4b4329f7c4cf72f6178c06dedb42073b3

Download Submit
C:\Windows\System\RxyNxqJ.exe

Filesize
2.3MB

MD5
b5e153d61d3435ac09d73a234ae3ea12

SHA1
1a55a0925dce88521132e6591c30072b851517f1

SHA256
6142956d8a2b685c9dc52bae7196d76eed53e863dc4bd5d7fbc7d1424bdfbd9b

SHA512
523ad65110fbb2b5260f051bcc2f3825cde7795dcaca7cf926a980d7a6306cd314b649509950b3c6988ba44d3a205cece745e463e4d76408cd1e1385cebb710d

Download Submit
C:\Windows\System\RzIzQFg.exe

Filesize
2.3MB

MD5
e71a6e900084ea3d57f6f172fc8388bf

SHA1
cbca41509e4342dae3fa54fc5b9019e3f95b1179

SHA256
fe566bdcc30325a9b7e496fb4bfd4c2448449b76992cc1f4f39d13e206f672fd

SHA512
f44b3072a671a560b2f4244cfcc72d5952aecd429693b2d73ee445db297e77813d362234c1d73bcee62a932cfb7b42daaf3a2771383b6ffd2dd8c5ed9c51659b

Download Submit
C:\Windows\System\SHitvyk.exe

Filesize
2.3MB

MD5
66e32469c69ae9b0a056bc559b864d36

SHA1
b32d5ce98d7658d5dd2da719ee351ebc6ad1589e

SHA256
f8b98b7db94048a00f62f1e7c875948b0bd712c9f0341802a2e41801b77c04c8

SHA512
320b4b107a9cfdef4002dc7eb41eee08d31169912f366551aaba3b5a9d51cf37a31acee2b03fbf9511274c6bf73d75976822c00045de210a43f8065631daee84

Download Submit
C:\Windows\System\SqyPiVN.exe

Filesize
2.3MB

MD5
73b34ba8249cb0a022625194b039366c

SHA1
271b5dd59e3ff61185f8bc796114a4f7a70a9a83

SHA256
7c9110a88f861a723e7a73985a8f9cdc8dcfcd49d134c11602baed32d43a1fc9

SHA512
5deb6f41a07dfe1cc9da5e78dea88c5b2768bc7e92515135dfeb7ae7e190d5d74d4c4475af94d6763375ebfebb61e5a04eda697c0acc8d3274bacb6b2242560a

Download Submit
C:\Windows\System\TXAJBWC.exe

Filesize
2.3MB

MD5
c5668e390946ac3b3ce68360a78c175c

SHA1
1af1eb3a0b60626d16ac46bbcf6303a5fd261b9c

SHA256
a779a1d61b34f0d18c7e54eef2cd033d323f02e9b7bea328cb25aa944955900f

SHA512
0f9b3c13dc19d48ce6eeaff602d1f88b15c3302ae47311b071f0f9294c7495da50d35c3ff0e81c0981273f22e0513cce2ae95206cb6361b9c2343f414e3ccf13

Download Submit
C:\Windows\System\YmvZWzx.exe

Filesize
2.3MB

MD5
4ebdf095635ec9ee9fa1019fb6c8260e

SHA1
14aaf91d0f8a61ddb65e0788359be090b214f851

SHA256
a78bbc07f4dd9728fe5f713bc03561d0e39d1ad07c44c0d613f7a307d7461063

SHA512
9d9159d9cbf24a85f662d5878b3376b660f880e4b4a6de30c0bb2248b35e431709740c24de86b9b3fcd937b38a73a85e3a90fae04c576e5f72a1a47a189baebc

Download Submit
C:\Windows\System\aagjrIa.exe

Filesize
2.3MB

MD5
5422de85441494f3125065baee323017

SHA1
8a560b87417bad4e5f72ba945dc0eba85e353c1b

SHA256
479154bd1d7fd8573a3a38009f87365ab55788c65f2ec5aef45e276743513ae8

SHA512
9b05887e3dc083c3517089704def40cb7151b8bbe959d2e82e97ff83b3ea562855b8bb881218be85aaba97cfc458c3cc1b8c88883bed55891a660425ef36f5da

Download Submit
C:\Windows\System\bWvXJoX.exe

Filesize
2.3MB

MD5
66f3598944ae2d9cd73cab1575944529

SHA1
d3dccc9a4e28496dcdf6fa9de92b3662f1d04203

SHA256
17aacf8f8eeb6998f7a6217bda377073d9bae0970788566f9b2f01198bcd31f2

SHA512
3c53431806ac64c09b85e20d16af300e05d78f472736d371a76903e62a91699becb2becddb8aaf863e3cf3c37b2c9af706ed64accfb06ecc843c78e9657e9626

Download Submit
C:\Windows\System\cASfZek.exe

Filesize
2.3MB

MD5
bbbb2166cd17d186074e11593da452d2

SHA1
8ff34c7bf878eed661eba3617742c90df85e508b

SHA256
cde8601883e4bf08521bcbe20de9ca7af4b37f7fb7ac361668dee97edbdca491

SHA512
33ed21b10805d31596e6fdfc1d92a4419e5f7ae5f09ea7cf4c4415582cf16b8bbc51dc7e1bc69a577a6ccb863294eddf25edcdb00a115d340150108bfa8c6b1c

Download Submit
C:\Windows\System\cOrjMeY.exe

Filesize
2.3MB

MD5
7f470f3ff63131c5170d7abf0ac5ac66

SHA1
a1c099c1b1cd6c3e48f04469a44be75a85c36f03

SHA256
9d7d4404a3a3f7974e255fb8cc173c143ab824f019873f50ac520fb0aa0e79bb

SHA512
54dadd992442baeab6a12f5b56b893863b99829566e371b49b3fa387e0fd647dcdcbc84bc197d44a4407895b20e54ffb7a0f28d26a09147ac583bce457f4a7ca

Download Submit
C:\Windows\System\cwNIApt.exe

Filesize
2.3MB

MD5
81f302a6b335d99dd8866b51a4e3b67c

SHA1
84c59bff38f1dd1324a3816e4b5bbe1a2cbb65e6

SHA256
be33a3356cc16fab5014f3567783a0fae4fde351009c2c1a2ea2882e1e69ddcb

SHA512
57fceaed010e5dff16493c40f85ffaca1d610a48c7664af673b8d44ec7906d960eaa57a2fb305cf2a4be6363b6525e1ab63a105cc45417015977ede141d9888c

Download Submit
C:\Windows\System\grssGTw.exe

Filesize
2.3MB

MD5
e14e8872153672f9079ec56e9054a3f8

SHA1
b8dbeee8c4814bb07efde57496caf4f19906fc95

SHA256
e40e99df55f3164ce62501c07ab01bbe996fda162840273e2e5dad63ad5f79c8

SHA512
e8861f79a7e0c1c35d139471f4a67cb51df629e68681ee91329f4d07bba6ea4464590ae605d5e556df0748e278917037c93a5b90afcc4293a2ce08e690b07aa3

Download Submit
C:\Windows\System\hIeKuoG.exe

Filesize
2.3MB

MD5
5bcc063989c790799976ff90a12aa369

SHA1
0237c7c216dea9dada84cd4ea5cf9fb1520bc245

SHA256
26a112987b1fe2165e67e2f8d1923055d6ff557196faf20f815d50d0ad6bc315

SHA512
216913caec68f3eb65d43cc30efeb931a1a93073d6a92886d4188e7511bc7a1e865566e485e571b188bf03db548c8390ef906bbfd11758a484419fa7b2a281cc

Download Submit
C:\Windows\System\qRlDuQN.exe

Filesize
2.3MB

MD5
551d721aa3f37bbe08d101273fb7a83c

SHA1
ad10de8156b3302c8e5e3c0ab8f6396deb3600a7

SHA256
69a6c244985b4a619e074bc7dc5112c6dd9a675133e00e4bce6d82fb8ff465dc

SHA512
b4703f14a0930a5efeb28c6aa07398ebddb9a182df2a29332d16f5ed08d2a01bbc51a9807d0e8de1a5bd03af41f9efb546c4d585830315fe98de9c8be00f44a3

Download Submit
C:\Windows\System\riQegth.exe

Filesize
2.3MB

MD5
eee05766e434e5be29bde758c708ba79

SHA1
6dda44ece24062d53338680b62779ada8b7c4171

SHA256
7281333c75085dbff25fa6d798cf8561400d7188ea94c2200b970ab1aec69192

SHA512
019e9d8742dc40b085500b12e889f6102f8cfbdca7d120957a75a0e781c02e158c1d444e9c750d5ffcf725c99360cbe0cfe3a1563a7291c57e5ea19ac900f026

Download Submit
C:\Windows\System\rzGZhpR.exe

Filesize
2.3MB

MD5
edc0e3e523d0207166c6e3cb853fda32

SHA1
5ed134ff8ae6245d2125d5209a5650d24e4ec308

SHA256
443a193b48a68b2b0ce4c4a450baf9f8ba8ae798dee1a67943bffd79efcbe879

SHA512
75c718f2903bb1e8e3cc81dfe47ba4e76409921e9128320b8de91854caf17717af56243a88bd69c21cc0fea88d378b786dbb3298abdbccfd0f6d108ca688f6bc

Download Submit
C:\Windows\System\sLXpPmV.exe

Filesize
2.3MB

MD5
7355a2104fc381a59dfeb564222e0cab

SHA1
094306c03946b66f710bdde0c06bced09e6300e6

SHA256
1e0de778f7eb5f5946cbb47d54f7821718bbd2db61540a69133fc1e3aace8a93

SHA512
ef75fc319458d1033e86c723c654e8ebd52595d91a37f1b1b8ab36d82ee8d409c433437735c5f247d641a5688e0ad28e8481b6fc2888ff4c1b1094f7c1bb2d29

Download Submit
C:\Windows\System\ssbeSsY.exe

Filesize
2.3MB

MD5
e9bea9386ad05d8b51c86188d6039504

SHA1
b8f969a5d789ae61c1311a3310d7719836833375

SHA256
843f825221941b8cd8a28f7ebb4fadd6f1b7f72465c0e14866ce4461af23ddb1

SHA512
5302d30ac43ec38b3c7dcbb323f770ceb1947d46500528912d2bb09ce40eee71c72457e79a07741e3c3892d6e7350ed9486d3d31cd18df365f9c36789a24eb2d

Download Submit
C:\Windows\System\toKmLpN.exe

Filesize
2.3MB

MD5
fffd1304635183e4b8f807c935aeb144

SHA1
50b51ad56f161500d0f1eb180d9bda08119b05a5

SHA256
d5945337d22c0ca787fc6961848819fec790070094fcc890665fa7658d494b65

SHA512
68f25d19734d1f246637bff58b98cf716602023a9b4acdb5710d5e9ee08dff579bfceb8ff8956585200fdda1b65e7a80668343cbf821c161cbecfc1528cbf768

Download Submit
C:\Windows\System\uFcjFAW.exe

Filesize
2.3MB

MD5
395315e388688b132751b4ff1fff8958

SHA1
301ec85c03a582a5bbd859b60934becb5f92a8ce

SHA256
917a9fbff628a27f3e3864714d599acfe268d3262e25d715025899ccdbeda8be

SHA512
0ff59e39f091aa33998b6c89ea1f9808c164d753315b85f046972f8e4268e62e554be28015639e38db872e3113115ca3054513190d4506e63cf09df238fcbb0b

Download Submit
C:\Windows\System\utOuJCJ.exe

Filesize
2.3MB

MD5
308e4036896040970fac98e9c213825b

SHA1
c16e049fde3ceb6709459748500d460d9289e240

SHA256
a4fec0f20ee0428dc6ffba0321bebb20d4fb9c748a76f2b93474d7953e49b5da

SHA512
11e65597b5bce7fd249e83458204810fea56a1cb8e2318e48d87c8a1637f1c402901a02a652316e3fcf501e4edd5872d3ac54d06cddb594212754cfb60090d1e

Download Submit
C:\Windows\System\ymSIyPM.exe

Filesize
2.3MB

MD5
a10053ebe5f0969425e499bf77363a87

SHA1
9f6e8a4dac75c3c4303d74faeacebb326847ebd8

SHA256
68f51680f2187989956fbd9f12834881db514e470f792912b4bf5c2936be5f10

SHA512
eb957a58c6f4d9330cb47b58b1c4dff56fec1fe5a589d2d73d651bf3a05eff693b4ee5780fef9e8663465cfe13ad579e52903ab6f5814446e011d91c13dd45a6

Download Submit
C:\Windows\System\yuTilEI.exe

Filesize
2.3MB

MD5
122c7a9bea039209fc597691c1001445

SHA1
e74cec72f079887b572eda1252b61d4aa79e736d

SHA256
a46dea289c4b94a799e7ddde7ff9016ca52f8ddc352d41256660112f5c4f4d0d

SHA512
fd43e592e0c780497fa844c90c20363e90d9f3f93670d63bc01be1142e192d60babbd60ba8a707361627c632a14f162562126dab1704180b6b1a5e8b7e31dd4c

Download Submit
memory/536-23-0x00007FF7D8A30000-0x00007FF7D8D84000-memory.dmp

Filesize
3.3MB

Download
memory/536-2125-0x00007FF7D8A30000-0x00007FF7D8D84000-memory.dmp

Filesize
3.3MB

Download
memory/536-2129-0x00007FF7D8A30000-0x00007FF7D8D84000-memory.dmp

Filesize
3.3MB

Download
memory/960-794-0x00007FF7F0010000-0x00007FF7F0364000-memory.dmp

Filesize
3.3MB

Download
memory/960-2147-0x00007FF7F0010000-0x00007FF7F0364000-memory.dmp

Filesize
3.3MB

Download
memory/996-2135-0x00007FF712390000-0x00007FF7126E4000-memory.dmp

Filesize
3.3MB

Download
memory/996-730-0x00007FF712390000-0x00007FF7126E4000-memory.dmp

Filesize
3.3MB

Download
memory/1116-2134-0x00007FF6B8DD0000-0x00007FF6B9124000-memory.dmp

Filesize
3.3MB

Download
memory/1116-731-0x00007FF6B8DD0000-0x00007FF6B9124000-memory.dmp

Filesize
3.3MB

Download
memory/1428-728-0x00007FF72F890000-0x00007FF72FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/1428-2141-0x00007FF72F890000-0x00007FF72FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/1520-2154-0x00007FF6FA8D0000-0x00007FF6FAC24000-memory.dmp

Filesize
3.3MB

Download
memory/1520-839-0x00007FF6FA8D0000-0x00007FF6FAC24000-memory.dmp

Filesize
3.3MB

Download
memory/1788-2153-0x00007FF636EB0000-0x00007FF637204000-memory.dmp

Filesize
3.3MB

Download
memory/1788-817-0x00007FF636EB0000-0x00007FF637204000-memory.dmp

Filesize
3.3MB

Download
memory/1860-729-0x00007FF71E620000-0x00007FF71E974000-memory.dmp

Filesize
3.3MB

Download
memory/1860-2140-0x00007FF71E620000-0x00007FF71E974000-memory.dmp

Filesize
3.3MB

Download
memory/1932-751-0x00007FF72A170000-0x00007FF72A4C4000-memory.dmp

Filesize
3.3MB

Download
memory/1932-2133-0x00007FF72A170000-0x00007FF72A4C4000-memory.dmp

Filesize
3.3MB

Download
memory/2304-2145-0x00007FF677930000-0x00007FF677C84000-memory.dmp

Filesize
3.3MB

Download
memory/2304-781-0x00007FF677930000-0x00007FF677C84000-memory.dmp

Filesize
3.3MB

Download
memory/2464-844-0x00007FF7137B0000-0x00007FF713B04000-memory.dmp

Filesize
3.3MB

Download
memory/2464-2152-0x00007FF7137B0000-0x00007FF713B04000-memory.dmp

Filesize
3.3MB

Download
memory/2520-2126-0x00007FF687250000-0x00007FF6875A4000-memory.dmp

Filesize
3.3MB

Download
memory/2520-726-0x00007FF687250000-0x00007FF6875A4000-memory.dmp

Filesize
3.3MB

Download
memory/2520-2131-0x00007FF687250000-0x00007FF6875A4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-847-0x00007FF78AF20000-0x00007FF78B274000-memory.dmp

Filesize
3.3MB

Download
memory/2576-2130-0x00007FF78AF20000-0x00007FF78B274000-memory.dmp

Filesize
3.3MB

Download
memory/2668-727-0x00007FF66C510000-0x00007FF66C864000-memory.dmp

Filesize
3.3MB

Download
memory/2668-2132-0x00007FF66C510000-0x00007FF66C864000-memory.dmp

Filesize
3.3MB

Download
memory/2716-2138-0x00007FF7FCD00000-0x00007FF7FD054000-memory.dmp

Filesize
3.3MB

Download
memory/2716-738-0x00007FF7FCD00000-0x00007FF7FD054000-memory.dmp

Filesize
3.3MB

Download
memory/3012-0-0x00007FF65F530000-0x00007FF65F884000-memory.dmp

Filesize
3.3MB

Download
memory/3012-1-0x000002AC20A20000-0x000002AC20A30000-memory.dmp

Filesize
64KB

Download
memory/3380-2149-0x00007FF623D00000-0x00007FF624054000-memory.dmp

Filesize
3.3MB

Download
memory/3380-801-0x00007FF623D00000-0x00007FF624054000-memory.dmp

Filesize
3.3MB

Download
memory/3816-761-0x00007FF6534C0000-0x00007FF653814000-memory.dmp

Filesize
3.3MB

Download
memory/3816-2143-0x00007FF6534C0000-0x00007FF653814000-memory.dmp

Filesize
3.3MB

Download
memory/3972-742-0x00007FF6211B0000-0x00007FF621504000-memory.dmp

Filesize
3.3MB

Download
memory/3972-2137-0x00007FF6211B0000-0x00007FF621504000-memory.dmp

Filesize
3.3MB

Download
memory/3984-773-0x00007FF798930000-0x00007FF798C84000-memory.dmp

Filesize
3.3MB

Download
memory/3984-2144-0x00007FF798930000-0x00007FF798C84000-memory.dmp

Filesize
3.3MB

Download
memory/4044-19-0x00007FF7645A0000-0x00007FF7648F4000-memory.dmp

Filesize
3.3MB

Download
memory/4044-2124-0x00007FF7645A0000-0x00007FF7648F4000-memory.dmp

Filesize
3.3MB

Download
memory/4044-2128-0x00007FF7645A0000-0x00007FF7648F4000-memory.dmp

Filesize
3.3MB

Download
memory/4056-2127-0x00007FF6D2850000-0x00007FF6D2BA4000-memory.dmp

Filesize
3.3MB

Download
memory/4056-9-0x00007FF6D2850000-0x00007FF6D2BA4000-memory.dmp

Filesize
3.3MB

Download
memory/4068-754-0x00007FF7A8170000-0x00007FF7A84C4000-memory.dmp

Filesize
3.3MB

Download
memory/4068-2142-0x00007FF7A8170000-0x00007FF7A84C4000-memory.dmp

Filesize
3.3MB

Download
memory/4292-2139-0x00007FF65F820000-0x00007FF65FB74000-memory.dmp

Filesize
3.3MB

Download
memory/4292-732-0x00007FF65F820000-0x00007FF65FB74000-memory.dmp

Filesize
3.3MB

Download
memory/4372-792-0x00007FF71B180000-0x00007FF71B4D4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-2146-0x00007FF71B180000-0x00007FF71B4D4000-memory.dmp

Filesize
3.3MB

Download
memory/4428-833-0x00007FF703D90000-0x00007FF7040E4000-memory.dmp

Filesize
3.3MB

Download
memory/4428-2150-0x00007FF703D90000-0x00007FF7040E4000-memory.dmp

Filesize
3.3MB

Download
memory/4484-770-0x00007FF7C08E0000-0x00007FF7C0C34000-memory.dmp

Filesize
3.3MB

Download
memory/4484-2148-0x00007FF7C08E0000-0x00007FF7C0C34000-memory.dmp

Filesize
3.3MB

Download
memory/4488-2136-0x00007FF663A50000-0x00007FF663DA4000-memory.dmp

Filesize
3.3MB

Download
memory/4488-744-0x00007FF663A50000-0x00007FF663DA4000-memory.dmp

Filesize
3.3MB

Download
memory/4604-808-0x00007FF709A60000-0x00007FF709DB4000-memory.dmp

Filesize
3.3MB

Download
memory/4604-2151-0x00007FF709A60000-0x00007FF709DB4000-memory.dmp

Filesize
3.3MB

Download
memory/4648-826-0x00007FF6AFCD0000-0x00007FF6B0024000-memory.dmp

Filesize
3.3MB

Download
memory/4648-2155-0x00007FF6AFCD0000-0x00007FF6B0024000-memory.dmp

Filesize
3.3MB

Download