xmrig | 746b7cf38888204e9260663a4503a6f632db7bfe00a3d7a93389ae704a64c542

Analysis

max time kernel
147s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
Size

2.0MB
MD5

ee947b9ed1695da8264b39967071a620
SHA1

42aa3cfacd496496c2b4364cef6b2daa89c7e2fa
SHA256

746b7cf38888204e9260663a4503a6f632db7bfe00a3d7a93389ae704a64c542
SHA512

47301c03122da5b0674f46ecea9853474519cff0ba51b5c29cb42560ae8bcaf43a7674e77047abe4fc50054f512386fe1913a6900de1eb575f0f15b0a856b934
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhCx:BemTLkNdfE0pZrQz

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3228-0-0x00007FF735B60000-0x00007FF735EB4000-memory.dmp	xmrig
behavioral2/files/0x0003000000022aa2-4.dat	xmrig
behavioral2/files/0x0007000000023427-18.dat	xmrig
behavioral2/files/0x0008000000023423-19.dat	xmrig
behavioral2/files/0x0007000000023429-25.dat	xmrig
behavioral2/files/0x0007000000023428-33.dat	xmrig
behavioral2/files/0x0007000000023436-94.dat	xmrig
behavioral2/memory/1544-109-0x00007FF7ECFA0000-0x00007FF7ED2F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-135.dat	xmrig
behavioral2/memory/3632-151-0x00007FF70AC00000-0x00007FF70AF54000-memory.dmp	xmrig
behavioral2/memory/4140-154-0x00007FF7750D0000-0x00007FF775424000-memory.dmp	xmrig
behavioral2/memory/3052-158-0x00007FF75BDA0000-0x00007FF75C0F4000-memory.dmp	xmrig
behavioral2/memory/4828-164-0x00007FF7A0E10000-0x00007FF7A1164000-memory.dmp	xmrig
behavioral2/memory/4328-163-0x00007FF6F8C20000-0x00007FF6F8F74000-memory.dmp	xmrig
behavioral2/memory/3336-162-0x00007FF798DB0000-0x00007FF799104000-memory.dmp	xmrig
behavioral2/memory/2468-161-0x00007FF638750000-0x00007FF638AA4000-memory.dmp	xmrig
behavioral2/memory/404-160-0x00007FF68A160000-0x00007FF68A4B4000-memory.dmp	xmrig
behavioral2/memory/5084-159-0x00007FF6E7A50000-0x00007FF6E7DA4000-memory.dmp	xmrig
behavioral2/memory/888-157-0x00007FF7EEAF0000-0x00007FF7EEE44000-memory.dmp	xmrig
behavioral2/memory/3608-156-0x00007FF65F620000-0x00007FF65F974000-memory.dmp	xmrig
behavioral2/memory/4036-155-0x00007FF72FDB0000-0x00007FF730104000-memory.dmp	xmrig
behavioral2/memory/4860-153-0x00007FF763110000-0x00007FF763464000-memory.dmp	xmrig
behavioral2/memory/5068-152-0x00007FF7D7560000-0x00007FF7D78B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343e-147.dat	xmrig
behavioral2/memory/4816-146-0x00007FF6C58F0000-0x00007FF6C5C44000-memory.dmp	xmrig
behavioral2/memory/4528-145-0x00007FF65C470000-0x00007FF65C7C4000-memory.dmp	xmrig
behavioral2/memory/4644-144-0x00007FF69DB70000-0x00007FF69DEC4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343d-142.dat	xmrig
behavioral2/files/0x000700000002343a-140.dat	xmrig
behavioral2/files/0x0007000000023432-138.dat	xmrig
behavioral2/files/0x000700000002343c-136.dat	xmrig
behavioral2/files/0x000700000002343b-133.dat	xmrig
behavioral2/memory/3876-131-0x00007FF7E5250000-0x00007FF7E55A4000-memory.dmp	xmrig
behavioral2/memory/3436-130-0x00007FF6533D0000-0x00007FF653724000-memory.dmp	xmrig
behavioral2/files/0x0007000000023435-126.dat	xmrig
behavioral2/files/0x0007000000023438-124.dat	xmrig
behavioral2/memory/5040-118-0x00007FF7F2BE0000-0x00007FF7F2F34000-memory.dmp	xmrig
behavioral2/files/0x000700000002343d-117.dat	xmrig
behavioral2/files/0x0007000000023437-113.dat	xmrig
behavioral2/files/0x0007000000023439-104.dat	xmrig
behavioral2/files/0x0007000000023434-98.dat	xmrig
behavioral2/files/0x0007000000023431-95.dat	xmrig
behavioral2/memory/2480-189-0x00007FF71E920000-0x00007FF71EC74000-memory.dmp	xmrig
behavioral2/memory/4868-2068-0x00007FF7E1D10000-0x00007FF7E2064000-memory.dmp	xmrig
behavioral2/memory/4068-2071-0x00007FF74F430000-0x00007FF74F784000-memory.dmp	xmrig
behavioral2/memory/4000-2070-0x00007FF6D1CB0000-0x00007FF6D2004000-memory.dmp	xmrig
behavioral2/memory/4404-2069-0x00007FF71AC00000-0x00007FF71AF54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-195.dat	xmrig
behavioral2/files/0x0007000000023443-194.dat	xmrig
behavioral2/files/0x0007000000023444-193.dat	xmrig
behavioral2/files/0x0008000000023424-184.dat	xmrig
behavioral2/files/0x0007000000023441-177.dat	xmrig
behavioral2/memory/1304-175-0x00007FF62D7D0000-0x00007FF62DB24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023440-168.dat	xmrig
behavioral2/files/0x0007000000023440-167.dat	xmrig
behavioral2/memory/3612-86-0x00007FF648520000-0x00007FF648874000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-85.dat	xmrig
behavioral2/memory/4068-80-0x00007FF74F430000-0x00007FF74F784000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-78.dat	xmrig
behavioral2/files/0x0007000000023433-72.dat	xmrig
behavioral2/files/0x000700000002342b-68.dat	xmrig
behavioral2/files/0x000700000002342e-67.dat	xmrig
behavioral2/files/0x000700000002342d-66.dat	xmrig
behavioral2/files/0x000700000002342a-65.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4868	UjrKgeX.exe
4404	epMVKVU.exe
4304	dKwXmZZ.exe
888	kWfZBhr.exe
4000	TfCOODn.exe
3052	vRnPQMn.exe
4068	lUAilVs.exe
3612	JLxaMJQ.exe
5084	yDzUBMR.exe
1544	qtZagWg.exe
5040	BjRPlii.exe
3436	eLoHQSc.exe
404	DUtrsGL.exe
3876	tlDVEJx.exe
4644	kHGXdUq.exe
2468	XJkylwM.exe
4528	vtSMGNu.exe
4816	BXTZoGF.exe
3632	NWGpyny.exe
5068	uskcboB.exe
3336	MvSORbY.exe
4328	HDPuxNb.exe
4860	fFaCYCp.exe
4140	mSrsFXU.exe
4036	rtsNakN.exe
4828	VydmODa.exe
3608	MHbRaeW.exe
1304	eWiycDc.exe
2480	hYyPADg.exe
764	xpjtowp.exe
3716	xErXMqv.exe
2244	uhTAMQW.exe
3172	XlsnhmL.exe
3968	JHMEaHm.exe
2956	OOYhXJC.exe
840	LpcvUVX.exe
2948	OsSRflF.exe
1252	fdIIDWj.exe
4668	NJTvgpq.exe
2092	VBbwdlf.exe
2068	veLXSar.exe
4364	vCobzNz.exe
4012	GBxkZaK.exe
2028	hpPgYKG.exe
2064	zljmxWW.exe
2340	ZaBWOEj.exe
4104	ScEhmjs.exe
3048	sIAXQIf.exe
408	VyMKgHc.exe
3524	wnFzSqS.exe
1164	aqHyEjw.exe
1636	xDbxLtK.exe
5056	TQcWnRo.exe
4268	qjNjBvP.exe
4904	swNUoNJ.exe
4832	ANqjasS.exe
516	aiPlCwR.exe
3544	ylZnaTq.exe
4092	OOgeoJJ.exe
4172	IOuBDlx.exe
936	fMVXmHu.exe
2252	qBDxvqS.exe
4696	rVLTBTj.exe
4276	xDxjZkm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3228-0-0x00007FF735B60000-0x00007FF735EB4000-memory.dmp	upx
behavioral2/files/0x0003000000022aa2-4.dat	upx
behavioral2/files/0x0007000000023427-18.dat	upx
behavioral2/files/0x0008000000023423-19.dat	upx
behavioral2/files/0x0007000000023429-25.dat	upx
behavioral2/files/0x0007000000023428-33.dat	upx
behavioral2/files/0x0007000000023436-94.dat	upx
behavioral2/memory/1544-109-0x00007FF7ECFA0000-0x00007FF7ED2F4000-memory.dmp	upx
behavioral2/files/0x000700000002343f-135.dat	upx
behavioral2/memory/3632-151-0x00007FF70AC00000-0x00007FF70AF54000-memory.dmp	upx
behavioral2/memory/4140-154-0x00007FF7750D0000-0x00007FF775424000-memory.dmp	upx
behavioral2/memory/3052-158-0x00007FF75BDA0000-0x00007FF75C0F4000-memory.dmp	upx
behavioral2/memory/4828-164-0x00007FF7A0E10000-0x00007FF7A1164000-memory.dmp	upx
behavioral2/memory/4328-163-0x00007FF6F8C20000-0x00007FF6F8F74000-memory.dmp	upx
behavioral2/memory/3336-162-0x00007FF798DB0000-0x00007FF799104000-memory.dmp	upx
behavioral2/memory/2468-161-0x00007FF638750000-0x00007FF638AA4000-memory.dmp	upx
behavioral2/memory/404-160-0x00007FF68A160000-0x00007FF68A4B4000-memory.dmp	upx
behavioral2/memory/5084-159-0x00007FF6E7A50000-0x00007FF6E7DA4000-memory.dmp	upx
behavioral2/memory/888-157-0x00007FF7EEAF0000-0x00007FF7EEE44000-memory.dmp	upx
behavioral2/memory/3608-156-0x00007FF65F620000-0x00007FF65F974000-memory.dmp	upx
behavioral2/memory/4036-155-0x00007FF72FDB0000-0x00007FF730104000-memory.dmp	upx
behavioral2/memory/4860-153-0x00007FF763110000-0x00007FF763464000-memory.dmp	upx
behavioral2/memory/5068-152-0x00007FF7D7560000-0x00007FF7D78B4000-memory.dmp	upx
behavioral2/files/0x000700000002343e-147.dat	upx
behavioral2/memory/4816-146-0x00007FF6C58F0000-0x00007FF6C5C44000-memory.dmp	upx
behavioral2/memory/4528-145-0x00007FF65C470000-0x00007FF65C7C4000-memory.dmp	upx
behavioral2/memory/4644-144-0x00007FF69DB70000-0x00007FF69DEC4000-memory.dmp	upx
behavioral2/files/0x000700000002343d-142.dat	upx
behavioral2/files/0x000700000002343a-140.dat	upx
behavioral2/files/0x0007000000023432-138.dat	upx
behavioral2/files/0x000700000002343c-136.dat	upx
behavioral2/files/0x000700000002343b-133.dat	upx
behavioral2/memory/3876-131-0x00007FF7E5250000-0x00007FF7E55A4000-memory.dmp	upx
behavioral2/memory/3436-130-0x00007FF6533D0000-0x00007FF653724000-memory.dmp	upx
behavioral2/files/0x0007000000023435-126.dat	upx
behavioral2/files/0x0007000000023438-124.dat	upx
behavioral2/memory/5040-118-0x00007FF7F2BE0000-0x00007FF7F2F34000-memory.dmp	upx
behavioral2/files/0x000700000002343d-117.dat	upx
behavioral2/files/0x0007000000023437-113.dat	upx
behavioral2/files/0x0007000000023439-104.dat	upx
behavioral2/files/0x0007000000023434-98.dat	upx
behavioral2/files/0x0007000000023431-95.dat	upx
behavioral2/memory/2480-189-0x00007FF71E920000-0x00007FF71EC74000-memory.dmp	upx
behavioral2/memory/4868-2068-0x00007FF7E1D10000-0x00007FF7E2064000-memory.dmp	upx
behavioral2/memory/4068-2071-0x00007FF74F430000-0x00007FF74F784000-memory.dmp	upx
behavioral2/memory/4000-2070-0x00007FF6D1CB0000-0x00007FF6D2004000-memory.dmp	upx
behavioral2/memory/4404-2069-0x00007FF71AC00000-0x00007FF71AF54000-memory.dmp	upx
behavioral2/files/0x0007000000023442-195.dat	upx
behavioral2/files/0x0007000000023443-194.dat	upx
behavioral2/files/0x0007000000023444-193.dat	upx
behavioral2/files/0x0008000000023424-184.dat	upx
behavioral2/files/0x0007000000023441-177.dat	upx
behavioral2/memory/1304-175-0x00007FF62D7D0000-0x00007FF62DB24000-memory.dmp	upx
behavioral2/files/0x0007000000023440-168.dat	upx
behavioral2/files/0x0007000000023440-167.dat	upx
behavioral2/memory/3612-86-0x00007FF648520000-0x00007FF648874000-memory.dmp	upx
behavioral2/files/0x0007000000023430-85.dat	upx
behavioral2/memory/4068-80-0x00007FF74F430000-0x00007FF74F784000-memory.dmp	upx
behavioral2/files/0x000700000002342c-78.dat	upx
behavioral2/files/0x0007000000023433-72.dat	upx
behavioral2/files/0x000700000002342b-68.dat	upx
behavioral2/files/0x000700000002342e-67.dat	upx
behavioral2/files/0x000700000002342d-66.dat	upx
behavioral2/files/0x000700000002342a-65.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nLaIuRm.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\CgEwCQV.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\XkunLHh.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\TLWgDdn.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\VydmODa.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\EFzEBHK.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\ocxuNvg.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\NApFwGO.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\MHbRaeW.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\fdIIDWj.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\sPkSapP.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\ONPCRhk.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\yawmGMs.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\wzINPUu.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\bCIjPxg.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\azpAXVe.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\bjsFWQO.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\cZXrxZH.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\RlKgvCB.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\ARYmHdk.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\yfFSZLq.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\TzAonzw.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\auOpDPP.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\OhaIlPY.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\EbYymDq.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\bbPAxmq.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\VIBcYyJ.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\SPCWcsJ.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\UgIuewX.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\pjWHbSQ.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\zFOrQTm.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\CHmaDYf.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\KnclrKJ.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\kypjRQJ.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\MkBLnFk.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\FvgXKoN.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\pzheMMT.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\lYPNXFr.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\OOYhXJC.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\sNploGT.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\HwVusXC.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\yXwkqpP.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\AZCQNqo.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\NWGpyny.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\rxDdxkV.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\EkefCCJ.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\tYDIwbz.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\otgkgKX.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\hLCNFwy.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\fMVXmHu.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\ZSwImwB.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\RHaTrqc.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\BxMpkEG.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\JeIGXtS.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\IRjpZhl.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\wGagrSp.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\kmocNJV.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\JowWsgr.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\IESaVtE.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\qYhHJnQ.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\pEJGzsf.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\vRnPQMn.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\rVLTBTj.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
File created	C:\Windows\System\yNIJifb.exe	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4868	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	84
PID 3228 wrote to memory of 4868	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	84
PID 3228 wrote to memory of 4404	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	85
PID 3228 wrote to memory of 4404	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	85
PID 3228 wrote to memory of 4304	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	86
PID 3228 wrote to memory of 4304	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	86
PID 3228 wrote to memory of 888	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	87
PID 3228 wrote to memory of 888	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	87
PID 3228 wrote to memory of 4000	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	88
PID 3228 wrote to memory of 4000	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	88
PID 3228 wrote to memory of 3052	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	89
PID 3228 wrote to memory of 3052	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	89
PID 3228 wrote to memory of 4068	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	90
PID 3228 wrote to memory of 4068	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	90
PID 3228 wrote to memory of 3612	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	91
PID 3228 wrote to memory of 3612	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	91
PID 3228 wrote to memory of 5084	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	92
PID 3228 wrote to memory of 5084	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	92
PID 3228 wrote to memory of 1544	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	93
PID 3228 wrote to memory of 1544	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	93
PID 3228 wrote to memory of 404	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	94
PID 3228 wrote to memory of 404	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	94
PID 3228 wrote to memory of 5040	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	95
PID 3228 wrote to memory of 5040	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	95
PID 3228 wrote to memory of 3436	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	96
PID 3228 wrote to memory of 3436	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	96
PID 3228 wrote to memory of 2468	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	97
PID 3228 wrote to memory of 2468	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	97
PID 3228 wrote to memory of 3876	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	98
PID 3228 wrote to memory of 3876	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	98
PID 3228 wrote to memory of 4644	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	99
PID 3228 wrote to memory of 4644	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	99
PID 3228 wrote to memory of 5068	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	100
PID 3228 wrote to memory of 5068	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	100
PID 3228 wrote to memory of 4528	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	101
PID 3228 wrote to memory of 4528	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	101
PID 3228 wrote to memory of 4816	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	102
PID 3228 wrote to memory of 4816	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	102
PID 3228 wrote to memory of 3632	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	103
PID 3228 wrote to memory of 3632	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	103
PID 3228 wrote to memory of 3336	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	104
PID 3228 wrote to memory of 3336	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	104
PID 3228 wrote to memory of 4140	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	105
PID 3228 wrote to memory of 4140	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	105
PID 3228 wrote to memory of 4328	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	106
PID 3228 wrote to memory of 4328	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	106
PID 3228 wrote to memory of 4860	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	107
PID 3228 wrote to memory of 4860	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	107
PID 3228 wrote to memory of 4036	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	108
PID 3228 wrote to memory of 4036	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	108
PID 3228 wrote to memory of 4828	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	109
PID 3228 wrote to memory of 4828	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	109
PID 3228 wrote to memory of 3608	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	110
PID 3228 wrote to memory of 3608	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	110
PID 3228 wrote to memory of 1304	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	111
PID 3228 wrote to memory of 1304	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	111
PID 3228 wrote to memory of 764	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	112
PID 3228 wrote to memory of 764	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	112
PID 3228 wrote to memory of 2480	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	113
PID 3228 wrote to memory of 2480	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	113
PID 3228 wrote to memory of 3716	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	114
PID 3228 wrote to memory of 3716	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	114
PID 3228 wrote to memory of 3172	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	115
PID 3228 wrote to memory of 3172	3228	ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ee947b9ed1695da8264b39967071a620_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\System\UjrKgeX.exe
  C:\Windows\System\UjrKgeX.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\epMVKVU.exe
  C:\Windows\System\epMVKVU.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\dKwXmZZ.exe
  C:\Windows\System\dKwXmZZ.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\kWfZBhr.exe
  C:\Windows\System\kWfZBhr.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\TfCOODn.exe
  C:\Windows\System\TfCOODn.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\vRnPQMn.exe
  C:\Windows\System\vRnPQMn.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\lUAilVs.exe
  C:\Windows\System\lUAilVs.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\JLxaMJQ.exe
  C:\Windows\System\JLxaMJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\yDzUBMR.exe
  C:\Windows\System\yDzUBMR.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\qtZagWg.exe
  C:\Windows\System\qtZagWg.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\DUtrsGL.exe
  C:\Windows\System\DUtrsGL.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\BjRPlii.exe
  C:\Windows\System\BjRPlii.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\eLoHQSc.exe
  C:\Windows\System\eLoHQSc.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\XJkylwM.exe
  C:\Windows\System\XJkylwM.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\tlDVEJx.exe
  C:\Windows\System\tlDVEJx.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\kHGXdUq.exe
  C:\Windows\System\kHGXdUq.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\uskcboB.exe
  C:\Windows\System\uskcboB.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\vtSMGNu.exe
  C:\Windows\System\vtSMGNu.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\BXTZoGF.exe
  C:\Windows\System\BXTZoGF.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\NWGpyny.exe
  C:\Windows\System\NWGpyny.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\MvSORbY.exe
  C:\Windows\System\MvSORbY.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\mSrsFXU.exe
  C:\Windows\System\mSrsFXU.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\HDPuxNb.exe
  C:\Windows\System\HDPuxNb.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\fFaCYCp.exe
  C:\Windows\System\fFaCYCp.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\rtsNakN.exe
  C:\Windows\System\rtsNakN.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\VydmODa.exe
  C:\Windows\System\VydmODa.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\MHbRaeW.exe
  C:\Windows\System\MHbRaeW.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\eWiycDc.exe
  C:\Windows\System\eWiycDc.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\xpjtowp.exe
  C:\Windows\System\xpjtowp.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\hYyPADg.exe
  C:\Windows\System\hYyPADg.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\xErXMqv.exe
  C:\Windows\System\xErXMqv.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\XlsnhmL.exe
  C:\Windows\System\XlsnhmL.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\uhTAMQW.exe
  C:\Windows\System\uhTAMQW.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\OOYhXJC.exe
  C:\Windows\System\OOYhXJC.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\JHMEaHm.exe
  C:\Windows\System\JHMEaHm.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\LpcvUVX.exe
  C:\Windows\System\LpcvUVX.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\OsSRflF.exe
  C:\Windows\System\OsSRflF.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\fdIIDWj.exe
  C:\Windows\System\fdIIDWj.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\NJTvgpq.exe
  C:\Windows\System\NJTvgpq.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\VBbwdlf.exe
  C:\Windows\System\VBbwdlf.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\veLXSar.exe
  C:\Windows\System\veLXSar.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\vCobzNz.exe
  C:\Windows\System\vCobzNz.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\GBxkZaK.exe
  C:\Windows\System\GBxkZaK.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\hpPgYKG.exe
  C:\Windows\System\hpPgYKG.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\zljmxWW.exe
  C:\Windows\System\zljmxWW.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\ZaBWOEj.exe
  C:\Windows\System\ZaBWOEj.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\ScEhmjs.exe
  C:\Windows\System\ScEhmjs.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\VyMKgHc.exe
  C:\Windows\System\VyMKgHc.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\sIAXQIf.exe
  C:\Windows\System\sIAXQIf.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\wnFzSqS.exe
  C:\Windows\System\wnFzSqS.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\aqHyEjw.exe
  C:\Windows\System\aqHyEjw.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\xDbxLtK.exe
  C:\Windows\System\xDbxLtK.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\TQcWnRo.exe
  C:\Windows\System\TQcWnRo.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\qjNjBvP.exe
  C:\Windows\System\qjNjBvP.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\swNUoNJ.exe
  C:\Windows\System\swNUoNJ.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\ANqjasS.exe
  C:\Windows\System\ANqjasS.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\aiPlCwR.exe
  C:\Windows\System\aiPlCwR.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\ylZnaTq.exe
  C:\Windows\System\ylZnaTq.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\OOgeoJJ.exe
  C:\Windows\System\OOgeoJJ.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\IOuBDlx.exe
  C:\Windows\System\IOuBDlx.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\fMVXmHu.exe
  C:\Windows\System\fMVXmHu.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\rVLTBTj.exe
  C:\Windows\System\rVLTBTj.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\qBDxvqS.exe
  C:\Windows\System\qBDxvqS.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\xDxjZkm.exe
  C:\Windows\System\xDxjZkm.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\dUMuvac.exe
  C:\Windows\System\dUMuvac.exe
  2⤵
  PID:3692
- C:\Windows\System\dnLMuiN.exe
  C:\Windows\System\dnLMuiN.exe
  2⤵
  PID:2544
- C:\Windows\System\DMLdkGA.exe
  C:\Windows\System\DMLdkGA.exe
  2⤵
  PID:4180
- C:\Windows\System\azpAXVe.exe
  C:\Windows\System\azpAXVe.exe
  2⤵
  PID:4380
- C:\Windows\System\mhYrUfU.exe
  C:\Windows\System\mhYrUfU.exe
  2⤵
  PID:4940
- C:\Windows\System\fZuhOFe.exe
  C:\Windows\System\fZuhOFe.exe
  2⤵
  PID:1604
- C:\Windows\System\lhIsYNy.exe
  C:\Windows\System\lhIsYNy.exe
  2⤵
  PID:1180
- C:\Windows\System\OKsjdoR.exe
  C:\Windows\System\OKsjdoR.exe
  2⤵
  PID:3976
- C:\Windows\System\JeIGXtS.exe
  C:\Windows\System\JeIGXtS.exe
  2⤵
  PID:4912
- C:\Windows\System\EoTFFlw.exe
  C:\Windows\System\EoTFFlw.exe
  2⤵
  PID:996
- C:\Windows\System\LFHUChw.exe
  C:\Windows\System\LFHUChw.exe
  2⤵
  PID:5088
- C:\Windows\System\IiznaRF.exe
  C:\Windows\System\IiznaRF.exe
  2⤵
  PID:2040
- C:\Windows\System\bjsFWQO.exe
  C:\Windows\System\bjsFWQO.exe
  2⤵
  PID:3404
- C:\Windows\System\ppLiuBi.exe
  C:\Windows\System\ppLiuBi.exe
  2⤵
  PID:2052
- C:\Windows\System\aKKgsEB.exe
  C:\Windows\System\aKKgsEB.exe
  2⤵
  PID:4128
- C:\Windows\System\NrFZAFA.exe
  C:\Windows\System\NrFZAFA.exe
  2⤵
  PID:4396
- C:\Windows\System\ouLTpCG.exe
  C:\Windows\System\ouLTpCG.exe
  2⤵
  PID:4936
- C:\Windows\System\pQhDQXV.exe
  C:\Windows\System\pQhDQXV.exe
  2⤵
  PID:2408
- C:\Windows\System\QYvBSqL.exe
  C:\Windows\System\QYvBSqL.exe
  2⤵
  PID:3264
- C:\Windows\System\KyLaxmr.exe
  C:\Windows\System\KyLaxmr.exe
  2⤵
  PID:876
- C:\Windows\System\JWniUYi.exe
  C:\Windows\System\JWniUYi.exe
  2⤵
  PID:3644
- C:\Windows\System\sPkSapP.exe
  C:\Windows\System\sPkSapP.exe
  2⤵
  PID:2368
- C:\Windows\System\OLdqoHS.exe
  C:\Windows\System\OLdqoHS.exe
  2⤵
  PID:5136
- C:\Windows\System\kSEcywp.exe
  C:\Windows\System\kSEcywp.exe
  2⤵
  PID:5152
- C:\Windows\System\AdEgUEL.exe
  C:\Windows\System\AdEgUEL.exe
  2⤵
  PID:5180
- C:\Windows\System\gYcziYZ.exe
  C:\Windows\System\gYcziYZ.exe
  2⤵
  PID:5212
- C:\Windows\System\VjNLPhK.exe
  C:\Windows\System\VjNLPhK.exe
  2⤵
  PID:5248
- C:\Windows\System\gbfDtgT.exe
  C:\Windows\System\gbfDtgT.exe
  2⤵
  PID:5284
- C:\Windows\System\lCzYngq.exe
  C:\Windows\System\lCzYngq.exe
  2⤵
  PID:5320
- C:\Windows\System\NuzwZeD.exe
  C:\Windows\System\NuzwZeD.exe
  2⤵
  PID:5348
- C:\Windows\System\TirasLD.exe
  C:\Windows\System\TirasLD.exe
  2⤵
  PID:5388
- C:\Windows\System\EFzEBHK.exe
  C:\Windows\System\EFzEBHK.exe
  2⤵
  PID:5424
- C:\Windows\System\zOlqfpd.exe
  C:\Windows\System\zOlqfpd.exe
  2⤵
  PID:5452
- C:\Windows\System\uUQqlkB.exe
  C:\Windows\System\uUQqlkB.exe
  2⤵
  PID:5472
- C:\Windows\System\QmgNmuD.exe
  C:\Windows\System\QmgNmuD.exe
  2⤵
  PID:5504
- C:\Windows\System\JNjcHGw.exe
  C:\Windows\System\JNjcHGw.exe
  2⤵
  PID:5552
- C:\Windows\System\cZXrxZH.exe
  C:\Windows\System\cZXrxZH.exe
  2⤵
  PID:5584
- C:\Windows\System\jJRYKvE.exe
  C:\Windows\System\jJRYKvE.exe
  2⤵
  PID:5636
- C:\Windows\System\ocxuNvg.exe
  C:\Windows\System\ocxuNvg.exe
  2⤵
  PID:5656
- C:\Windows\System\ztbkQqL.exe
  C:\Windows\System\ztbkQqL.exe
  2⤵
  PID:5684
- C:\Windows\System\EabmXWU.exe
  C:\Windows\System\EabmXWU.exe
  2⤵
  PID:5712
- C:\Windows\System\NwxoUjT.exe
  C:\Windows\System\NwxoUjT.exe
  2⤵
  PID:5748
- C:\Windows\System\yxjSnZT.exe
  C:\Windows\System\yxjSnZT.exe
  2⤵
  PID:5776
- C:\Windows\System\uGHIYIp.exe
  C:\Windows\System\uGHIYIp.exe
  2⤵
  PID:5792
- C:\Windows\System\tWkUgWn.exe
  C:\Windows\System\tWkUgWn.exe
  2⤵
  PID:5824
- C:\Windows\System\lUCGhzI.exe
  C:\Windows\System\lUCGhzI.exe
  2⤵
  PID:5852
- C:\Windows\System\HdHfrXu.exe
  C:\Windows\System\HdHfrXu.exe
  2⤵
  PID:5888
- C:\Windows\System\eRflncq.exe
  C:\Windows\System\eRflncq.exe
  2⤵
  PID:5916
- C:\Windows\System\GaPhTuy.exe
  C:\Windows\System\GaPhTuy.exe
  2⤵
  PID:5944
- C:\Windows\System\LrBxCzH.exe
  C:\Windows\System\LrBxCzH.exe
  2⤵
  PID:5980
- C:\Windows\System\yoBGwZZ.exe
  C:\Windows\System\yoBGwZZ.exe
  2⤵
  PID:6000
- C:\Windows\System\FilMYNV.exe
  C:\Windows\System\FilMYNV.exe
  2⤵
  PID:6036
- C:\Windows\System\zhtjDBb.exe
  C:\Windows\System\zhtjDBb.exe
  2⤵
  PID:6064
- C:\Windows\System\QgyrMND.exe
  C:\Windows\System\QgyrMND.exe
  2⤵
  PID:6080
- C:\Windows\System\AWmfOGX.exe
  C:\Windows\System\AWmfOGX.exe
  2⤵
  PID:6112
- C:\Windows\System\mSesvgs.exe
  C:\Windows\System\mSesvgs.exe
  2⤵
  PID:5144
- C:\Windows\System\NApFwGO.exe
  C:\Windows\System\NApFwGO.exe
  2⤵
  PID:5268
- C:\Windows\System\PKgaGxJ.exe
  C:\Windows\System\PKgaGxJ.exe
  2⤵
  PID:5344
- C:\Windows\System\yMyyZnR.exe
  C:\Windows\System\yMyyZnR.exe
  2⤵
  PID:5412
- C:\Windows\System\khlSjVZ.exe
  C:\Windows\System\khlSjVZ.exe
  2⤵
  PID:5484
- C:\Windows\System\wfKOXtd.exe
  C:\Windows\System\wfKOXtd.exe
  2⤵
  PID:4688
- C:\Windows\System\pNfkRUt.exe
  C:\Windows\System\pNfkRUt.exe
  2⤵
  PID:1156
- C:\Windows\System\wiXqHQb.exe
  C:\Windows\System\wiXqHQb.exe
  2⤵
  PID:4076
- C:\Windows\System\YSXhRyG.exe
  C:\Windows\System\YSXhRyG.exe
  2⤵
  PID:5680
- C:\Windows\System\ZBWuLvF.exe
  C:\Windows\System\ZBWuLvF.exe
  2⤵
  PID:5736
- C:\Windows\System\legtmjf.exe
  C:\Windows\System\legtmjf.exe
  2⤵
  PID:5784
- C:\Windows\System\nMcKGeD.exe
  C:\Windows\System\nMcKGeD.exe
  2⤵
  PID:5884
- C:\Windows\System\knZUXvl.exe
  C:\Windows\System\knZUXvl.exe
  2⤵
  PID:4272
- C:\Windows\System\fZVGrmK.exe
  C:\Windows\System\fZVGrmK.exe
  2⤵
  PID:5528
- C:\Windows\System\ckbvpus.exe
  C:\Windows\System\ckbvpus.exe
  2⤵
  PID:5560
- C:\Windows\System\RWOakCL.exe
  C:\Windows\System\RWOakCL.exe
  2⤵
  PID:6048
- C:\Windows\System\tKOzKHD.exe
  C:\Windows\System\tKOzKHD.exe
  2⤵
  PID:6104
- C:\Windows\System\IsPBjwi.exe
  C:\Windows\System\IsPBjwi.exe
  2⤵
  PID:5296
- C:\Windows\System\QhoDmPE.exe
  C:\Windows\System\QhoDmPE.exe
  2⤵
  PID:5512
- C:\Windows\System\yAQLgda.exe
  C:\Windows\System\yAQLgda.exe
  2⤵
  PID:3160
- C:\Windows\System\gNOXVOj.exe
  C:\Windows\System\gNOXVOj.exe
  2⤵
  PID:5676
- C:\Windows\System\FFjGPFB.exe
  C:\Windows\System\FFjGPFB.exe
  2⤵
  PID:2872
- C:\Windows\System\zxbOIXL.exe
  C:\Windows\System\zxbOIXL.exe
  2⤵
  PID:5968
- C:\Windows\System\SmCDqwg.exe
  C:\Windows\System\SmCDqwg.exe
  2⤵
  PID:5208
- C:\Windows\System\RMRxYpq.exe
  C:\Windows\System\RMRxYpq.exe
  2⤵
  PID:5464
- C:\Windows\System\VwqPRkO.exe
  C:\Windows\System\VwqPRkO.exe
  2⤵
  PID:5612
- C:\Windows\System\NkiJLml.exe
  C:\Windows\System\NkiJLml.exe
  2⤵
  PID:5308
- C:\Windows\System\hnrhkbv.exe
  C:\Windows\System\hnrhkbv.exe
  2⤵
  PID:5312
- C:\Windows\System\HZxYPvk.exe
  C:\Windows\System\HZxYPvk.exe
  2⤵
  PID:5696
- C:\Windows\System\dCylTxi.exe
  C:\Windows\System\dCylTxi.exe
  2⤵
  PID:5368
- C:\Windows\System\SfnpygN.exe
  C:\Windows\System\SfnpygN.exe
  2⤵
  PID:6148
- C:\Windows\System\oaZFpmc.exe
  C:\Windows\System\oaZFpmc.exe
  2⤵
  PID:6172
- C:\Windows\System\ivOgRhd.exe
  C:\Windows\System\ivOgRhd.exe
  2⤵
  PID:6204
- C:\Windows\System\hhRQhhA.exe
  C:\Windows\System\hhRQhhA.exe
  2⤵
  PID:6232
- C:\Windows\System\IfODTtd.exe
  C:\Windows\System\IfODTtd.exe
  2⤵
  PID:6260
- C:\Windows\System\wEHoNYj.exe
  C:\Windows\System\wEHoNYj.exe
  2⤵
  PID:6288
- C:\Windows\System\xIEUBrK.exe
  C:\Windows\System\xIEUBrK.exe
  2⤵
  PID:6324
- C:\Windows\System\QieRbcT.exe
  C:\Windows\System\QieRbcT.exe
  2⤵
  PID:6348
- C:\Windows\System\ZnyqEqg.exe
  C:\Windows\System\ZnyqEqg.exe
  2⤵
  PID:6376
- C:\Windows\System\pfspBRW.exe
  C:\Windows\System\pfspBRW.exe
  2⤵
  PID:6404
- C:\Windows\System\irNsBIq.exe
  C:\Windows\System\irNsBIq.exe
  2⤵
  PID:6432
- C:\Windows\System\nfkMdHj.exe
  C:\Windows\System\nfkMdHj.exe
  2⤵
  PID:6460
- C:\Windows\System\PEvjwOu.exe
  C:\Windows\System\PEvjwOu.exe
  2⤵
  PID:6488
- C:\Windows\System\oiEaiAE.exe
  C:\Windows\System\oiEaiAE.exe
  2⤵
  PID:6516
- C:\Windows\System\rNXKMYh.exe
  C:\Windows\System\rNXKMYh.exe
  2⤵
  PID:6544
- C:\Windows\System\LUQoQUF.exe
  C:\Windows\System\LUQoQUF.exe
  2⤵
  PID:6572
- C:\Windows\System\YMqhnWf.exe
  C:\Windows\System\YMqhnWf.exe
  2⤵
  PID:6608
- C:\Windows\System\qvdttTU.exe
  C:\Windows\System\qvdttTU.exe
  2⤵
  PID:6628
- C:\Windows\System\jGmDDHv.exe
  C:\Windows\System\jGmDDHv.exe
  2⤵
  PID:6656
- C:\Windows\System\NCYJuDU.exe
  C:\Windows\System\NCYJuDU.exe
  2⤵
  PID:6684
- C:\Windows\System\UPOLtVI.exe
  C:\Windows\System\UPOLtVI.exe
  2⤵
  PID:6712
- C:\Windows\System\YODDaNR.exe
  C:\Windows\System\YODDaNR.exe
  2⤵
  PID:6744
- C:\Windows\System\ATVAyHC.exe
  C:\Windows\System\ATVAyHC.exe
  2⤵
  PID:6772
- C:\Windows\System\dVhYodd.exe
  C:\Windows\System\dVhYodd.exe
  2⤵
  PID:6800
- C:\Windows\System\BKdzfgV.exe
  C:\Windows\System\BKdzfgV.exe
  2⤵
  PID:6824
- C:\Windows\System\sZHAaou.exe
  C:\Windows\System\sZHAaou.exe
  2⤵
  PID:6868
- C:\Windows\System\xFCGqwZ.exe
  C:\Windows\System\xFCGqwZ.exe
  2⤵
  PID:6888
- C:\Windows\System\vwHDYVY.exe
  C:\Windows\System\vwHDYVY.exe
  2⤵
  PID:6908
- C:\Windows\System\sggSaju.exe
  C:\Windows\System\sggSaju.exe
  2⤵
  PID:6944
- C:\Windows\System\EQaJEHs.exe
  C:\Windows\System\EQaJEHs.exe
  2⤵
  PID:6976
- C:\Windows\System\yNIJifb.exe
  C:\Windows\System\yNIJifb.exe
  2⤵
  PID:7000
- C:\Windows\System\GEwsKuX.exe
  C:\Windows\System\GEwsKuX.exe
  2⤵
  PID:7016
- C:\Windows\System\ekJUMRD.exe
  C:\Windows\System\ekJUMRD.exe
  2⤵
  PID:7032
- C:\Windows\System\ZSwImwB.exe
  C:\Windows\System\ZSwImwB.exe
  2⤵
  PID:7052
- C:\Windows\System\tNdYMmn.exe
  C:\Windows\System\tNdYMmn.exe
  2⤵
  PID:7072
- C:\Windows\System\IlcRDyj.exe
  C:\Windows\System\IlcRDyj.exe
  2⤵
  PID:7092
- C:\Windows\System\LEpTLSu.exe
  C:\Windows\System\LEpTLSu.exe
  2⤵
  PID:7120
- C:\Windows\System\pIwwGij.exe
  C:\Windows\System\pIwwGij.exe
  2⤵
  PID:3712
- C:\Windows\System\ksNzCjv.exe
  C:\Windows\System\ksNzCjv.exe
  2⤵
  PID:6192
- C:\Windows\System\QTvHRmN.exe
  C:\Windows\System\QTvHRmN.exe
  2⤵
  PID:6280
- C:\Windows\System\ngQKLcC.exe
  C:\Windows\System\ngQKLcC.exe
  2⤵
  PID:6360
- C:\Windows\System\qvNEyOr.exe
  C:\Windows\System\qvNEyOr.exe
  2⤵
  PID:6456
- C:\Windows\System\yfFSZLq.exe
  C:\Windows\System\yfFSZLq.exe
  2⤵
  PID:6512
- C:\Windows\System\GFlCtOg.exe
  C:\Windows\System\GFlCtOg.exe
  2⤵
  PID:6556
- C:\Windows\System\wPppDje.exe
  C:\Windows\System\wPppDje.exe
  2⤵
  PID:6620
- C:\Windows\System\sNploGT.exe
  C:\Windows\System\sNploGT.exe
  2⤵
  PID:6668
- C:\Windows\System\ybBstyb.exe
  C:\Windows\System\ybBstyb.exe
  2⤵
  PID:6724
- C:\Windows\System\qKdYZyh.exe
  C:\Windows\System\qKdYZyh.exe
  2⤵
  PID:6852
- C:\Windows\System\hAemfGC.exe
  C:\Windows\System\hAemfGC.exe
  2⤵
  PID:6880
- C:\Windows\System\OPMCvMI.exe
  C:\Windows\System\OPMCvMI.exe
  2⤵
  PID:6956
- C:\Windows\System\iQPdbqb.exe
  C:\Windows\System\iQPdbqb.exe
  2⤵
  PID:7012
- C:\Windows\System\rxDdxkV.exe
  C:\Windows\System\rxDdxkV.exe
  2⤵
  PID:7060
- C:\Windows\System\fDEInxD.exe
  C:\Windows\System\fDEInxD.exe
  2⤵
  PID:7104
- C:\Windows\System\DAQlDQl.exe
  C:\Windows\System\DAQlDQl.exe
  2⤵
  PID:7148
- C:\Windows\System\HAHwWQU.exe
  C:\Windows\System\HAHwWQU.exe
  2⤵
  PID:2148
- C:\Windows\System\ahhGxzq.exe
  C:\Windows\System\ahhGxzq.exe
  2⤵
  PID:6476
- C:\Windows\System\NMlzFDb.exe
  C:\Windows\System\NMlzFDb.exe
  2⤵
  PID:6584
- C:\Windows\System\DaKDqiS.exe
  C:\Windows\System\DaKDqiS.exe
  2⤵
  PID:6792
- C:\Windows\System\MjTwLFO.exe
  C:\Windows\System\MjTwLFO.exe
  2⤵
  PID:6932
- C:\Windows\System\jRHgDhm.exe
  C:\Windows\System\jRHgDhm.exe
  2⤵
  PID:7064
- C:\Windows\System\sXCNZwP.exe
  C:\Windows\System\sXCNZwP.exe
  2⤵
  PID:4216
- C:\Windows\System\MLKLWPo.exe
  C:\Windows\System\MLKLWPo.exe
  2⤵
  PID:812
- C:\Windows\System\YbdPuug.exe
  C:\Windows\System\YbdPuug.exe
  2⤵
  PID:6884
- C:\Windows\System\esxDnhq.exe
  C:\Windows\System\esxDnhq.exe
  2⤵
  PID:7112
- C:\Windows\System\TPWQfhG.exe
  C:\Windows\System\TPWQfhG.exe
  2⤵
  PID:6540
- C:\Windows\System\HwVusXC.exe
  C:\Windows\System\HwVusXC.exe
  2⤵
  PID:7180
- C:\Windows\System\HHTXgZH.exe
  C:\Windows\System\HHTXgZH.exe
  2⤵
  PID:7220
- C:\Windows\System\itfZPIY.exe
  C:\Windows\System\itfZPIY.exe
  2⤵
  PID:7248
- C:\Windows\System\XUnNryr.exe
  C:\Windows\System\XUnNryr.exe
  2⤵
  PID:7296
- C:\Windows\System\tOkYiCx.exe
  C:\Windows\System\tOkYiCx.exe
  2⤵
  PID:7340
- C:\Windows\System\jgfOigk.exe
  C:\Windows\System\jgfOigk.exe
  2⤵
  PID:7368
- C:\Windows\System\giYyyjq.exe
  C:\Windows\System\giYyyjq.exe
  2⤵
  PID:7396
- C:\Windows\System\xtWwVlR.exe
  C:\Windows\System\xtWwVlR.exe
  2⤵
  PID:7420
- C:\Windows\System\mACmhAI.exe
  C:\Windows\System\mACmhAI.exe
  2⤵
  PID:7464
- C:\Windows\System\TeaXBpr.exe
  C:\Windows\System\TeaXBpr.exe
  2⤵
  PID:7488
- C:\Windows\System\QPzPcCE.exe
  C:\Windows\System\QPzPcCE.exe
  2⤵
  PID:7516
- C:\Windows\System\TmVCews.exe
  C:\Windows\System\TmVCews.exe
  2⤵
  PID:7544
- C:\Windows\System\roygOSQ.exe
  C:\Windows\System\roygOSQ.exe
  2⤵
  PID:7572
- C:\Windows\System\JIUNnQg.exe
  C:\Windows\System\JIUNnQg.exe
  2⤵
  PID:7608
- C:\Windows\System\uMsHyzZ.exe
  C:\Windows\System\uMsHyzZ.exe
  2⤵
  PID:7628
- C:\Windows\System\hDBrGSO.exe
  C:\Windows\System\hDBrGSO.exe
  2⤵
  PID:7656
- C:\Windows\System\ZuScyJd.exe
  C:\Windows\System\ZuScyJd.exe
  2⤵
  PID:7684
- C:\Windows\System\NhVNmkR.exe
  C:\Windows\System\NhVNmkR.exe
  2⤵
  PID:7712
- C:\Windows\System\epqJbTr.exe
  C:\Windows\System\epqJbTr.exe
  2⤵
  PID:7740
- C:\Windows\System\hEWxrPz.exe
  C:\Windows\System\hEWxrPz.exe
  2⤵
  PID:7768
- C:\Windows\System\ftzmYYc.exe
  C:\Windows\System\ftzmYYc.exe
  2⤵
  PID:7796
- C:\Windows\System\OPgNXwv.exe
  C:\Windows\System\OPgNXwv.exe
  2⤵
  PID:7824
- C:\Windows\System\HttDcFs.exe
  C:\Windows\System\HttDcFs.exe
  2⤵
  PID:7852
- C:\Windows\System\BDBwWzA.exe
  C:\Windows\System\BDBwWzA.exe
  2⤵
  PID:7880
- C:\Windows\System\tZAfHru.exe
  C:\Windows\System\tZAfHru.exe
  2⤵
  PID:7908
- C:\Windows\System\yfAaJIJ.exe
  C:\Windows\System\yfAaJIJ.exe
  2⤵
  PID:7936
- C:\Windows\System\VNsSfGN.exe
  C:\Windows\System\VNsSfGN.exe
  2⤵
  PID:7964
- C:\Windows\System\koSiDDS.exe
  C:\Windows\System\koSiDDS.exe
  2⤵
  PID:7992
- C:\Windows\System\lJCzcJD.exe
  C:\Windows\System\lJCzcJD.exe
  2⤵
  PID:8020
- C:\Windows\System\LQwiXKN.exe
  C:\Windows\System\LQwiXKN.exe
  2⤵
  PID:8044
- C:\Windows\System\ylabWhM.exe
  C:\Windows\System\ylabWhM.exe
  2⤵
  PID:8076
- C:\Windows\System\bwhWnPu.exe
  C:\Windows\System\bwhWnPu.exe
  2⤵
  PID:8104
- C:\Windows\System\mTkERMy.exe
  C:\Windows\System\mTkERMy.exe
  2⤵
  PID:8136
- C:\Windows\System\HJEeddQ.exe
  C:\Windows\System\HJEeddQ.exe
  2⤵
  PID:8164
- C:\Windows\System\jHRaBkm.exe
  C:\Windows\System\jHRaBkm.exe
  2⤵
  PID:8188
- C:\Windows\System\RHaTrqc.exe
  C:\Windows\System\RHaTrqc.exe
  2⤵
  PID:7236
- C:\Windows\System\BxMpkEG.exe
  C:\Windows\System\BxMpkEG.exe
  2⤵
  PID:7356
- C:\Windows\System\nmmuqmg.exe
  C:\Windows\System\nmmuqmg.exe
  2⤵
  PID:7440
- C:\Windows\System\dQOqzni.exe
  C:\Windows\System\dQOqzni.exe
  2⤵
  PID:7508
- C:\Windows\System\lczQvRS.exe
  C:\Windows\System\lczQvRS.exe
  2⤵
  PID:7568
- C:\Windows\System\XkDjCbL.exe
  C:\Windows\System\XkDjCbL.exe
  2⤵
  PID:7624
- C:\Windows\System\eNVulEU.exe
  C:\Windows\System\eNVulEU.exe
  2⤵
  PID:7696
- C:\Windows\System\HNqcWrT.exe
  C:\Windows\System\HNqcWrT.exe
  2⤵
  PID:7760
- C:\Windows\System\pakfPjT.exe
  C:\Windows\System\pakfPjT.exe
  2⤵
  PID:7808
- C:\Windows\System\EkefCCJ.exe
  C:\Windows\System\EkefCCJ.exe
  2⤵
  PID:7876
- C:\Windows\System\EezFpzs.exe
  C:\Windows\System\EezFpzs.exe
  2⤵
  PID:7948
- C:\Windows\System\XxAdgQh.exe
  C:\Windows\System\XxAdgQh.exe
  2⤵
  PID:8012
- C:\Windows\System\xidqoTu.exe
  C:\Windows\System\xidqoTu.exe
  2⤵
  PID:8064
- C:\Windows\System\HvXNMBP.exe
  C:\Windows\System\HvXNMBP.exe
  2⤵
  PID:8132
- C:\Windows\System\JowWsgr.exe
  C:\Windows\System\JowWsgr.exe
  2⤵
  PID:7200
- C:\Windows\System\uzPJlOo.exe
  C:\Windows\System\uzPJlOo.exe
  2⤵
  PID:7480
- C:\Windows\System\nzfXcmq.exe
  C:\Windows\System\nzfXcmq.exe
  2⤵
  PID:7592
- C:\Windows\System\uVXqFzl.exe
  C:\Windows\System\uVXqFzl.exe
  2⤵
  PID:7736
- C:\Windows\System\vCsxRsE.exe
  C:\Windows\System\vCsxRsE.exe
  2⤵
  PID:7864
- C:\Windows\System\OCforws.exe
  C:\Windows\System\OCforws.exe
  2⤵
  PID:1560
- C:\Windows\System\nnXlXcC.exe
  C:\Windows\System\nnXlXcC.exe
  2⤵
  PID:8176
- C:\Windows\System\otgkgKX.exe
  C:\Windows\System\otgkgKX.exe
  2⤵
  PID:7560
- C:\Windows\System\kwUBmwP.exe
  C:\Windows\System\kwUBmwP.exe
  2⤵
  PID:8100
- C:\Windows\System\teYGrfI.exe
  C:\Windows\System\teYGrfI.exe
  2⤵
  PID:8052
- C:\Windows\System\kDOccFh.exe
  C:\Windows\System\kDOccFh.exe
  2⤵
  PID:8224
- C:\Windows\System\eeYAFyp.exe
  C:\Windows\System\eeYAFyp.exe
  2⤵
  PID:8260
- C:\Windows\System\hKyawCS.exe
  C:\Windows\System\hKyawCS.exe
  2⤵
  PID:8292
- C:\Windows\System\KDrbKcc.exe
  C:\Windows\System\KDrbKcc.exe
  2⤵
  PID:8328
- C:\Windows\System\ZnHszvW.exe
  C:\Windows\System\ZnHszvW.exe
  2⤵
  PID:8368
- C:\Windows\System\qmfblyK.exe
  C:\Windows\System\qmfblyK.exe
  2⤵
  PID:8396
- C:\Windows\System\mQrcLhy.exe
  C:\Windows\System\mQrcLhy.exe
  2⤵
  PID:8432
- C:\Windows\System\DMWuUwz.exe
  C:\Windows\System\DMWuUwz.exe
  2⤵
  PID:8452
- C:\Windows\System\smDCXCl.exe
  C:\Windows\System\smDCXCl.exe
  2⤵
  PID:8492
- C:\Windows\System\hyQuAcR.exe
  C:\Windows\System\hyQuAcR.exe
  2⤵
  PID:8512
- C:\Windows\System\pgutWGF.exe
  C:\Windows\System\pgutWGF.exe
  2⤵
  PID:8552
- C:\Windows\System\XFNIOui.exe
  C:\Windows\System\XFNIOui.exe
  2⤵
  PID:8596
- C:\Windows\System\JFvvkpJ.exe
  C:\Windows\System\JFvvkpJ.exe
  2⤵
  PID:8632
- C:\Windows\System\RMtHLdN.exe
  C:\Windows\System\RMtHLdN.exe
  2⤵
  PID:8668
- C:\Windows\System\CzqwFKx.exe
  C:\Windows\System\CzqwFKx.exe
  2⤵
  PID:8700
- C:\Windows\System\FvgXKoN.exe
  C:\Windows\System\FvgXKoN.exe
  2⤵
  PID:8744
- C:\Windows\System\lJSzVyT.exe
  C:\Windows\System\lJSzVyT.exe
  2⤵
  PID:8780
- C:\Windows\System\IYoSvbU.exe
  C:\Windows\System\IYoSvbU.exe
  2⤵
  PID:8816
- C:\Windows\System\XwudJWr.exe
  C:\Windows\System\XwudJWr.exe
  2⤵
  PID:8844
- C:\Windows\System\mCiRhmq.exe
  C:\Windows\System\mCiRhmq.exe
  2⤵
  PID:8872
- C:\Windows\System\eqhFTMw.exe
  C:\Windows\System\eqhFTMw.exe
  2⤵
  PID:8904
- C:\Windows\System\MEENCYw.exe
  C:\Windows\System\MEENCYw.exe
  2⤵
  PID:8932
- C:\Windows\System\CJHVpYo.exe
  C:\Windows\System\CJHVpYo.exe
  2⤵
  PID:8960
- C:\Windows\System\PcKdqQd.exe
  C:\Windows\System\PcKdqQd.exe
  2⤵
  PID:8988
- C:\Windows\System\pzheMMT.exe
  C:\Windows\System\pzheMMT.exe
  2⤵
  PID:9012
- C:\Windows\System\RlKgvCB.exe
  C:\Windows\System\RlKgvCB.exe
  2⤵
  PID:9052
- C:\Windows\System\MLIXFTD.exe
  C:\Windows\System\MLIXFTD.exe
  2⤵
  PID:9068
- C:\Windows\System\TzAonzw.exe
  C:\Windows\System\TzAonzw.exe
  2⤵
  PID:9096
- C:\Windows\System\mcLKcXD.exe
  C:\Windows\System\mcLKcXD.exe
  2⤵
  PID:9128
- C:\Windows\System\GwrqiQJ.exe
  C:\Windows\System\GwrqiQJ.exe
  2⤵
  PID:9148
- C:\Windows\System\FDtBFTP.exe
  C:\Windows\System\FDtBFTP.exe
  2⤵
  PID:9176
- C:\Windows\System\benGIZx.exe
  C:\Windows\System\benGIZx.exe
  2⤵
  PID:9204
- C:\Windows\System\tYDIwbz.exe
  C:\Windows\System\tYDIwbz.exe
  2⤵
  PID:8240
- C:\Windows\System\zgybwCv.exe
  C:\Windows\System\zgybwCv.exe
  2⤵
  PID:8276
- C:\Windows\System\oSqLSHd.exe
  C:\Windows\System\oSqLSHd.exe
  2⤵
  PID:8392
- C:\Windows\System\JLAEZdC.exe
  C:\Windows\System\JLAEZdC.exe
  2⤵
  PID:8448
- C:\Windows\System\JreUAen.exe
  C:\Windows\System\JreUAen.exe
  2⤵
  PID:8528
- C:\Windows\System\Wnomdmy.exe
  C:\Windows\System\Wnomdmy.exe
  2⤵
  PID:8624
- C:\Windows\System\vbJSOjh.exe
  C:\Windows\System\vbJSOjh.exe
  2⤵
  PID:8656
- C:\Windows\System\KEvgNDJ.exe
  C:\Windows\System\KEvgNDJ.exe
  2⤵
  PID:8772
- C:\Windows\System\VZmFDKX.exe
  C:\Windows\System\VZmFDKX.exe
  2⤵
  PID:8828
- C:\Windows\System\IoYJOti.exe
  C:\Windows\System\IoYJOti.exe
  2⤵
  PID:8884
- C:\Windows\System\XHAldrl.exe
  C:\Windows\System\XHAldrl.exe
  2⤵
  PID:8956
- C:\Windows\System\VUFEBMl.exe
  C:\Windows\System\VUFEBMl.exe
  2⤵
  PID:3356
- C:\Windows\System\MaaHWsO.exe
  C:\Windows\System\MaaHWsO.exe
  2⤵
  PID:9136
- C:\Windows\System\eMjGRNJ.exe
  C:\Windows\System\eMjGRNJ.exe
  2⤵
  PID:9172
- C:\Windows\System\IpBAuEa.exe
  C:\Windows\System\IpBAuEa.exe
  2⤵
  PID:8272
- C:\Windows\System\IRjpZhl.exe
  C:\Windows\System\IRjpZhl.exe
  2⤵
  PID:8548
- C:\Windows\System\wufQcms.exe
  C:\Windows\System\wufQcms.exe
  2⤵
  PID:8688
- C:\Windows\System\qIhEZlg.exe
  C:\Windows\System\qIhEZlg.exe
  2⤵
  PID:8944
- C:\Windows\System\ORlXDlU.exe
  C:\Windows\System\ORlXDlU.exe
  2⤵
  PID:9028
- C:\Windows\System\ueHYGDL.exe
  C:\Windows\System\ueHYGDL.exe
  2⤵
  PID:9192
- C:\Windows\System\KlRXuhh.exe
  C:\Windows\System\KlRXuhh.exe
  2⤵
  PID:8920
- C:\Windows\System\EbYymDq.exe
  C:\Windows\System\EbYymDq.exe
  2⤵
  PID:9156
- C:\Windows\System\zVThFel.exe
  C:\Windows\System\zVThFel.exe
  2⤵
  PID:8592
- C:\Windows\System\FntxvWV.exe
  C:\Windows\System\FntxvWV.exe
  2⤵
  PID:9236
- C:\Windows\System\alKVGru.exe
  C:\Windows\System\alKVGru.exe
  2⤵
  PID:9264
- C:\Windows\System\PdWVQCC.exe
  C:\Windows\System\PdWVQCC.exe
  2⤵
  PID:9284
- C:\Windows\System\TTuHypX.exe
  C:\Windows\System\TTuHypX.exe
  2⤵
  PID:9300
- C:\Windows\System\LEfhpYG.exe
  C:\Windows\System\LEfhpYG.exe
  2⤵
  PID:9332
- C:\Windows\System\ZpnfMfA.exe
  C:\Windows\System\ZpnfMfA.exe
  2⤵
  PID:9372
- C:\Windows\System\JVrZtQX.exe
  C:\Windows\System\JVrZtQX.exe
  2⤵
  PID:9420
- C:\Windows\System\muBNJAt.exe
  C:\Windows\System\muBNJAt.exe
  2⤵
  PID:9452
- C:\Windows\System\bbPAxmq.exe
  C:\Windows\System\bbPAxmq.exe
  2⤵
  PID:9492
- C:\Windows\System\HgkWijl.exe
  C:\Windows\System\HgkWijl.exe
  2⤵
  PID:9528
- C:\Windows\System\xlJPLhM.exe
  C:\Windows\System\xlJPLhM.exe
  2⤵
  PID:9556
- C:\Windows\System\mnoiYgs.exe
  C:\Windows\System\mnoiYgs.exe
  2⤵
  PID:9588
- C:\Windows\System\AUNqmHu.exe
  C:\Windows\System\AUNqmHu.exe
  2⤵
  PID:9620
- C:\Windows\System\PiEpJzp.exe
  C:\Windows\System\PiEpJzp.exe
  2⤵
  PID:9648
- C:\Windows\System\IYmhUql.exe
  C:\Windows\System\IYmhUql.exe
  2⤵
  PID:9680
- C:\Windows\System\nLaIuRm.exe
  C:\Windows\System\nLaIuRm.exe
  2⤵
  PID:9704
- C:\Windows\System\wGagrSp.exe
  C:\Windows\System\wGagrSp.exe
  2⤵
  PID:9736
- C:\Windows\System\jSqWoiF.exe
  C:\Windows\System\jSqWoiF.exe
  2⤵
  PID:9764
- C:\Windows\System\KYXTJhp.exe
  C:\Windows\System\KYXTJhp.exe
  2⤵
  PID:9792
- C:\Windows\System\TkHMcCZ.exe
  C:\Windows\System\TkHMcCZ.exe
  2⤵
  PID:9824
- C:\Windows\System\UxiKSND.exe
  C:\Windows\System\UxiKSND.exe
  2⤵
  PID:9852
- C:\Windows\System\VGdmJGw.exe
  C:\Windows\System\VGdmJGw.exe
  2⤵
  PID:9876
- C:\Windows\System\jMdUSMh.exe
  C:\Windows\System\jMdUSMh.exe
  2⤵
  PID:9896
- C:\Windows\System\baJPiao.exe
  C:\Windows\System\baJPiao.exe
  2⤵
  PID:9928
- C:\Windows\System\KKOXaDY.exe
  C:\Windows\System\KKOXaDY.exe
  2⤵
  PID:9944
- C:\Windows\System\lrjwkfP.exe
  C:\Windows\System\lrjwkfP.exe
  2⤵
  PID:9968
- C:\Windows\System\ndpiPUd.exe
  C:\Windows\System\ndpiPUd.exe
  2⤵
  PID:9988
- C:\Windows\System\ZiRdsVB.exe
  C:\Windows\System\ZiRdsVB.exe
  2⤵
  PID:10004
- C:\Windows\System\sykGQwc.exe
  C:\Windows\System\sykGQwc.exe
  2⤵
  PID:10020
- C:\Windows\System\DQaHrzt.exe
  C:\Windows\System\DQaHrzt.exe
  2⤵
  PID:10040
- C:\Windows\System\DqLREFy.exe
  C:\Windows\System\DqLREFy.exe
  2⤵
  PID:10064
- C:\Windows\System\QcQbsgl.exe
  C:\Windows\System\QcQbsgl.exe
  2⤵
  PID:10084
- C:\Windows\System\czaKgym.exe
  C:\Windows\System\czaKgym.exe
  2⤵
  PID:10116
- C:\Windows\System\CgDlypk.exe
  C:\Windows\System\CgDlypk.exe
  2⤵
  PID:10144
- C:\Windows\System\OUIRBdj.exe
  C:\Windows\System\OUIRBdj.exe
  2⤵
  PID:10188
- C:\Windows\System\uiddFzK.exe
  C:\Windows\System\uiddFzK.exe
  2⤵
  PID:10220
- C:\Windows\System\lmWxfOS.exe
  C:\Windows\System\lmWxfOS.exe
  2⤵
  PID:9088
- C:\Windows\System\qIZcklh.exe
  C:\Windows\System\qIZcklh.exe
  2⤵
  PID:9324
- C:\Windows\System\XTGuwCj.exe
  C:\Windows\System\XTGuwCj.exe
  2⤵
  PID:9408
- C:\Windows\System\bUpSwKF.exe
  C:\Windows\System\bUpSwKF.exe
  2⤵
  PID:9488
- C:\Windows\System\xiOCHiU.exe
  C:\Windows\System\xiOCHiU.exe
  2⤵
  PID:9576
- C:\Windows\System\BvPBQKi.exe
  C:\Windows\System\BvPBQKi.exe
  2⤵
  PID:9644
- C:\Windows\System\kpgJJHN.exe
  C:\Windows\System\kpgJJHN.exe
  2⤵
  PID:9732
- C:\Windows\System\KnclrKJ.exe
  C:\Windows\System\KnclrKJ.exe
  2⤵
  PID:9784
- C:\Windows\System\aPdwJQF.exe
  C:\Windows\System\aPdwJQF.exe
  2⤵
  PID:9844
- C:\Windows\System\EqsbmTw.exe
  C:\Windows\System\EqsbmTw.exe
  2⤵
  PID:9912
- C:\Windows\System\rrNITZt.exe
  C:\Windows\System\rrNITZt.exe
  2⤵
  PID:9964
- C:\Windows\System\dXSSIJj.exe
  C:\Windows\System\dXSSIJj.exe
  2⤵
  PID:10052
- C:\Windows\System\BgtGzcL.exe
  C:\Windows\System\BgtGzcL.exe
  2⤵
  PID:3944
- C:\Windows\System\rTsWwOz.exe
  C:\Windows\System\rTsWwOz.exe
  2⤵
  PID:10104
- C:\Windows\System\MVHDfyz.exe
  C:\Windows\System\MVHDfyz.exe
  2⤵
  PID:10236
- C:\Windows\System\DlHgiGd.exe
  C:\Windows\System\DlHgiGd.exe
  2⤵
  PID:9256
- C:\Windows\System\LxrpnMF.exe
  C:\Windows\System\LxrpnMF.exe
  2⤵
  PID:9440
- C:\Windows\System\CNPreAc.exe
  C:\Windows\System\CNPreAc.exe
  2⤵
  PID:9632
- C:\Windows\System\UgIuewX.exe
  C:\Windows\System\UgIuewX.exe
  2⤵
  PID:9776
- C:\Windows\System\MrQVWoe.exe
  C:\Windows\System\MrQVWoe.exe
  2⤵
  PID:9976
- C:\Windows\System\tAuwyJu.exe
  C:\Windows\System\tAuwyJu.exe
  2⤵
  PID:10056
- C:\Windows\System\doFTJdq.exe
  C:\Windows\System\doFTJdq.exe
  2⤵
  PID:10128
- C:\Windows\System\aKjXDAr.exe
  C:\Windows\System\aKjXDAr.exe
  2⤵
  PID:9548
- C:\Windows\System\AsJBABI.exe
  C:\Windows\System\AsJBABI.exe
  2⤵
  PID:9888
- C:\Windows\System\UccShJN.exe
  C:\Windows\System\UccShJN.exe
  2⤵
  PID:10196
- C:\Windows\System\ozLAyWs.exe
  C:\Windows\System\ozLAyWs.exe
  2⤵
  PID:10076
- C:\Windows\System\pjWHbSQ.exe
  C:\Windows\System\pjWHbSQ.exe
  2⤵
  PID:9848
- C:\Windows\System\OEJjWYA.exe
  C:\Windows\System\OEJjWYA.exe
  2⤵
  PID:10264
- C:\Windows\System\skIHUPK.exe
  C:\Windows\System\skIHUPK.exe
  2⤵
  PID:10292
- C:\Windows\System\XIoivYL.exe
  C:\Windows\System\XIoivYL.exe
  2⤵
  PID:10324
- C:\Windows\System\OOXPLUY.exe
  C:\Windows\System\OOXPLUY.exe
  2⤵
  PID:10356
- C:\Windows\System\DVmeyIu.exe
  C:\Windows\System\DVmeyIu.exe
  2⤵
  PID:10384
- C:\Windows\System\uZLIjUW.exe
  C:\Windows\System\uZLIjUW.exe
  2⤵
  PID:10412
- C:\Windows\System\UQwOzwx.exe
  C:\Windows\System\UQwOzwx.exe
  2⤵
  PID:10440
- C:\Windows\System\vncbTvL.exe
  C:\Windows\System\vncbTvL.exe
  2⤵
  PID:10468
- C:\Windows\System\rOgkliY.exe
  C:\Windows\System\rOgkliY.exe
  2⤵
  PID:10496
- C:\Windows\System\hTniGnf.exe
  C:\Windows\System\hTniGnf.exe
  2⤵
  PID:10524
- C:\Windows\System\vkWGRUG.exe
  C:\Windows\System\vkWGRUG.exe
  2⤵
  PID:10552
- C:\Windows\System\zTdJyIl.exe
  C:\Windows\System\zTdJyIl.exe
  2⤵
  PID:10580
- C:\Windows\System\nNvuSDu.exe
  C:\Windows\System\nNvuSDu.exe
  2⤵
  PID:10608
- C:\Windows\System\oHBcCCO.exe
  C:\Windows\System\oHBcCCO.exe
  2⤵
  PID:10636
- C:\Windows\System\ONPCRhk.exe
  C:\Windows\System\ONPCRhk.exe
  2⤵
  PID:10664
- C:\Windows\System\HaGvWMg.exe
  C:\Windows\System\HaGvWMg.exe
  2⤵
  PID:10692
- C:\Windows\System\ivAPCRv.exe
  C:\Windows\System\ivAPCRv.exe
  2⤵
  PID:10720
- C:\Windows\System\qhcLIaX.exe
  C:\Windows\System\qhcLIaX.exe
  2⤵
  PID:10748
- C:\Windows\System\VIBcYyJ.exe
  C:\Windows\System\VIBcYyJ.exe
  2⤵
  PID:10780
- C:\Windows\System\eHGLPSW.exe
  C:\Windows\System\eHGLPSW.exe
  2⤵
  PID:10808
- C:\Windows\System\FPhYoPE.exe
  C:\Windows\System\FPhYoPE.exe
  2⤵
  PID:10836
- C:\Windows\System\njxaKTF.exe
  C:\Windows\System\njxaKTF.exe
  2⤵
  PID:10864
- C:\Windows\System\GKsuBhy.exe
  C:\Windows\System\GKsuBhy.exe
  2⤵
  PID:10892
- C:\Windows\System\hoTSMJM.exe
  C:\Windows\System\hoTSMJM.exe
  2⤵
  PID:10924
- C:\Windows\System\aKcWmpl.exe
  C:\Windows\System\aKcWmpl.exe
  2⤵
  PID:10952
- C:\Windows\System\XRiUEnn.exe
  C:\Windows\System\XRiUEnn.exe
  2⤵
  PID:10980
- C:\Windows\System\QRavvYA.exe
  C:\Windows\System\QRavvYA.exe
  2⤵
  PID:11012
- C:\Windows\System\wsVEkNP.exe
  C:\Windows\System\wsVEkNP.exe
  2⤵
  PID:11040
- C:\Windows\System\DNZlqyy.exe
  C:\Windows\System\DNZlqyy.exe
  2⤵
  PID:11068
- C:\Windows\System\hfqhbZL.exe
  C:\Windows\System\hfqhbZL.exe
  2⤵
  PID:11084
- C:\Windows\System\MmMDslC.exe
  C:\Windows\System\MmMDslC.exe
  2⤵
  PID:11124
- C:\Windows\System\KTYzgnP.exe
  C:\Windows\System\KTYzgnP.exe
  2⤵
  PID:11152
- C:\Windows\System\lvUlTLG.exe
  C:\Windows\System\lvUlTLG.exe
  2⤵
  PID:11180
- C:\Windows\System\OJEADem.exe
  C:\Windows\System\OJEADem.exe
  2⤵
  PID:11208
- C:\Windows\System\GCkznNO.exe
  C:\Windows\System\GCkznNO.exe
  2⤵
  PID:11236
- C:\Windows\System\gjdosXF.exe
  C:\Windows\System\gjdosXF.exe
  2⤵
  PID:10248
- C:\Windows\System\IWDwklk.exe
  C:\Windows\System\IWDwklk.exe
  2⤵
  PID:10316
- C:\Windows\System\qnPnokU.exe
  C:\Windows\System\qnPnokU.exe
  2⤵
  PID:10376
- C:\Windows\System\CgEwCQV.exe
  C:\Windows\System\CgEwCQV.exe
  2⤵
  PID:10452
- C:\Windows\System\sKvyXmI.exe
  C:\Windows\System\sKvyXmI.exe
  2⤵
  PID:10516
- C:\Windows\System\SWcWQdl.exe
  C:\Windows\System\SWcWQdl.exe
  2⤵
  PID:10576
- C:\Windows\System\XKOjRku.exe
  C:\Windows\System\XKOjRku.exe
  2⤵
  PID:10632
- C:\Windows\System\DXSUpsF.exe
  C:\Windows\System\DXSUpsF.exe
  2⤵
  PID:10704
- C:\Windows\System\mnizRof.exe
  C:\Windows\System\mnizRof.exe
  2⤵
  PID:10760
- C:\Windows\System\vloYyin.exe
  C:\Windows\System\vloYyin.exe
  2⤵
  PID:10824
- C:\Windows\System\dUdLNnO.exe
  C:\Windows\System\dUdLNnO.exe
  2⤵
  PID:10888
- C:\Windows\System\GNIazhc.exe
  C:\Windows\System\GNIazhc.exe
  2⤵
  PID:10964
- C:\Windows\System\kCcKwBr.exe
  C:\Windows\System\kCcKwBr.exe
  2⤵
  PID:11076
- C:\Windows\System\ZMKwNOX.exe
  C:\Windows\System\ZMKwNOX.exe
  2⤵
  PID:11136
- C:\Windows\System\VMdZLjE.exe
  C:\Windows\System\VMdZLjE.exe
  2⤵
  PID:11232
- C:\Windows\System\IESaVtE.exe
  C:\Windows\System\IESaVtE.exe
  2⤵
  PID:10348
- C:\Windows\System\rzkENDt.exe
  C:\Windows\System\rzkENDt.exe
  2⤵
  PID:10508
- C:\Windows\System\suUwJGo.exe
  C:\Windows\System\suUwJGo.exe
  2⤵
  PID:10656
- C:\Windows\System\jTwtZcF.exe
  C:\Windows\System\jTwtZcF.exe
  2⤵
  PID:10804
- C:\Windows\System\QykPRmm.exe
  C:\Windows\System\QykPRmm.exe
  2⤵
  PID:10948
- C:\Windows\System\CYuaJJQ.exe
  C:\Windows\System\CYuaJJQ.exe
  2⤵
  PID:11176
- C:\Windows\System\auOpDPP.exe
  C:\Windows\System\auOpDPP.exe
  2⤵
  PID:10404
- C:\Windows\System\eDGHJiy.exe
  C:\Windows\System\eDGHJiy.exe
  2⤵
  PID:10744
- C:\Windows\System\VrupCoy.exe
  C:\Windows\System\VrupCoy.exe
  2⤵
  PID:11116
- C:\Windows\System\pypZyyo.exe
  C:\Windows\System\pypZyyo.exe
  2⤵
  PID:10916
- C:\Windows\System\aOmoGna.exe
  C:\Windows\System\aOmoGna.exe
  2⤵
  PID:10436
- C:\Windows\System\zwpTwSh.exe
  C:\Windows\System\zwpTwSh.exe
  2⤵
  PID:11288
- C:\Windows\System\VYhpdUS.exe
  C:\Windows\System\VYhpdUS.exe
  2⤵
  PID:11316
- C:\Windows\System\KOxNPfV.exe
  C:\Windows\System\KOxNPfV.exe
  2⤵
  PID:11344
- C:\Windows\System\QNXcYJL.exe
  C:\Windows\System\QNXcYJL.exe
  2⤵
  PID:11372
- C:\Windows\System\gAkVSOi.exe
  C:\Windows\System\gAkVSOi.exe
  2⤵
  PID:11400
- C:\Windows\System\RBwhdYy.exe
  C:\Windows\System\RBwhdYy.exe
  2⤵
  PID:11428
- C:\Windows\System\XAsEqtP.exe
  C:\Windows\System\XAsEqtP.exe
  2⤵
  PID:11456
- C:\Windows\System\oVLpshD.exe
  C:\Windows\System\oVLpshD.exe
  2⤵
  PID:11484
- C:\Windows\System\cmKaRQf.exe
  C:\Windows\System\cmKaRQf.exe
  2⤵
  PID:11512
- C:\Windows\System\CVudgWd.exe
  C:\Windows\System\CVudgWd.exe
  2⤵
  PID:11540
- C:\Windows\System\MCtSwPJ.exe
  C:\Windows\System\MCtSwPJ.exe
  2⤵
  PID:11568
- C:\Windows\System\hwrFJNw.exe
  C:\Windows\System\hwrFJNw.exe
  2⤵
  PID:11596
- C:\Windows\System\fvkyYmf.exe
  C:\Windows\System\fvkyYmf.exe
  2⤵
  PID:11624
- C:\Windows\System\OsfdYQc.exe
  C:\Windows\System\OsfdYQc.exe
  2⤵
  PID:11652
- C:\Windows\System\vyEqoyK.exe
  C:\Windows\System\vyEqoyK.exe
  2⤵
  PID:11680
- C:\Windows\System\pejbKEm.exe
  C:\Windows\System\pejbKEm.exe
  2⤵
  PID:11708
- C:\Windows\System\yXwkqpP.exe
  C:\Windows\System\yXwkqpP.exe
  2⤵
  PID:11736
- C:\Windows\System\gDnszMJ.exe
  C:\Windows\System\gDnszMJ.exe
  2⤵
  PID:11764
- C:\Windows\System\DfTiCQa.exe
  C:\Windows\System\DfTiCQa.exe
  2⤵
  PID:11792
- C:\Windows\System\XFewxQl.exe
  C:\Windows\System\XFewxQl.exe
  2⤵
  PID:11820
- C:\Windows\System\PnuKzbz.exe
  C:\Windows\System\PnuKzbz.exe
  2⤵
  PID:11848
- C:\Windows\System\gTKNBJf.exe
  C:\Windows\System\gTKNBJf.exe
  2⤵
  PID:11876
- C:\Windows\System\UQTdJLt.exe
  C:\Windows\System\UQTdJLt.exe
  2⤵
  PID:11908
- C:\Windows\System\fOcMuKb.exe
  C:\Windows\System\fOcMuKb.exe
  2⤵
  PID:11936
- C:\Windows\System\QKkFPgp.exe
  C:\Windows\System\QKkFPgp.exe
  2⤵
  PID:11964
- C:\Windows\System\GqsfCGT.exe
  C:\Windows\System\GqsfCGT.exe
  2⤵
  PID:11980
- C:\Windows\System\HnxxNnO.exe
  C:\Windows\System\HnxxNnO.exe
  2⤵
  PID:12008
- C:\Windows\System\LoFTHRC.exe
  C:\Windows\System\LoFTHRC.exe
  2⤵
  PID:12048
- C:\Windows\System\gcWhQOw.exe
  C:\Windows\System\gcWhQOw.exe
  2⤵
  PID:12076
- C:\Windows\System\YZdAOQy.exe
  C:\Windows\System\YZdAOQy.exe
  2⤵
  PID:12092
- C:\Windows\System\gAUKpZX.exe
  C:\Windows\System\gAUKpZX.exe
  2⤵
  PID:12116
- C:\Windows\System\uXnHpIq.exe
  C:\Windows\System\uXnHpIq.exe
  2⤵
  PID:12148
- C:\Windows\System\zKuHGrj.exe
  C:\Windows\System\zKuHGrj.exe
  2⤵
  PID:12184
- C:\Windows\System\KXPTcfR.exe
  C:\Windows\System\KXPTcfR.exe
  2⤵
  PID:12220
- C:\Windows\System\FoBNWPA.exe
  C:\Windows\System\FoBNWPA.exe
  2⤵
  PID:12248
- C:\Windows\System\vBPljKI.exe
  C:\Windows\System\vBPljKI.exe
  2⤵
  PID:12276
- C:\Windows\System\HnKedsV.exe
  C:\Windows\System\HnKedsV.exe
  2⤵
  PID:11300
- C:\Windows\System\kmocNJV.exe
  C:\Windows\System\kmocNJV.exe
  2⤵
  PID:11364
- C:\Windows\System\UdhWbwR.exe
  C:\Windows\System\UdhWbwR.exe
  2⤵
  PID:11424
- C:\Windows\System\KweQdkF.exe
  C:\Windows\System\KweQdkF.exe
  2⤵
  PID:11508
- C:\Windows\System\oObtwBI.exe
  C:\Windows\System\oObtwBI.exe
  2⤵
  PID:11560
- C:\Windows\System\XIRfGid.exe
  C:\Windows\System\XIRfGid.exe
  2⤵
  PID:11636
- C:\Windows\System\qYhHJnQ.exe
  C:\Windows\System\qYhHJnQ.exe
  2⤵
  PID:11700
- C:\Windows\System\YTGdYjO.exe
  C:\Windows\System\YTGdYjO.exe
  2⤵
  PID:11756
- C:\Windows\System\muwBUTY.exe
  C:\Windows\System\muwBUTY.exe
  2⤵
  PID:11816
- C:\Windows\System\TxVWabG.exe
  C:\Windows\System\TxVWabG.exe
  2⤵
  PID:11888
- C:\Windows\System\TTTyOAX.exe
  C:\Windows\System\TTTyOAX.exe
  2⤵
  PID:11900
- C:\Windows\System\ZSoEDwt.exe
  C:\Windows\System\ZSoEDwt.exe
  2⤵
  PID:12036
- C:\Windows\System\qsAxRRf.exe
  C:\Windows\System\qsAxRRf.exe
  2⤵
  PID:12084
- C:\Windows\System\YUEOrNf.exe
  C:\Windows\System\YUEOrNf.exe
  2⤵
  PID:12144
- C:\Windows\System\uVIinIg.exe
  C:\Windows\System\uVIinIg.exe
  2⤵
  PID:12216
- C:\Windows\System\XblNLzk.exe
  C:\Windows\System\XblNLzk.exe
  2⤵
  PID:10620
- C:\Windows\System\IEWgJTk.exe
  C:\Windows\System\IEWgJTk.exe
  2⤵
  PID:11412
- C:\Windows\System\aWbAygD.exe
  C:\Windows\System\aWbAygD.exe
  2⤵
  PID:11552
- C:\Windows\System\grJDvgo.exe
  C:\Windows\System\grJDvgo.exe
  2⤵
  PID:11720
- C:\Windows\System\wLhVrEV.exe
  C:\Windows\System\wLhVrEV.exe
  2⤵
  PID:11868
- C:\Windows\System\tHcTbAP.exe
  C:\Windows\System\tHcTbAP.exe
  2⤵
  PID:12032
- C:\Windows\System\nUDkFxK.exe
  C:\Windows\System\nUDkFxK.exe
  2⤵
  PID:12180
- C:\Windows\System\VbBHiYM.exe
  C:\Windows\System\VbBHiYM.exe
  2⤵
  PID:11356
- C:\Windows\System\SbzfgyN.exe
  C:\Windows\System\SbzfgyN.exe
  2⤵
  PID:11692
- C:\Windows\System\bhnHCZm.exe
  C:\Windows\System\bhnHCZm.exe
  2⤵
  PID:12104
- C:\Windows\System\GwjePKz.exe
  C:\Windows\System\GwjePKz.exe
  2⤵
  PID:11676
- C:\Windows\System\VjdaNZL.exe
  C:\Windows\System\VjdaNZL.exe
  2⤵
  PID:11496
- C:\Windows\System\xYIwLas.exe
  C:\Windows\System\xYIwLas.exe
  2⤵
  PID:12304
- C:\Windows\System\ZqBWPTq.exe
  C:\Windows\System\ZqBWPTq.exe
  2⤵
  PID:12332
- C:\Windows\System\GudvxjX.exe
  C:\Windows\System\GudvxjX.exe
  2⤵
  PID:12360
- C:\Windows\System\XlhzsSh.exe
  C:\Windows\System\XlhzsSh.exe
  2⤵
  PID:12388
- C:\Windows\System\IrUPJGw.exe
  C:\Windows\System\IrUPJGw.exe
  2⤵
  PID:12416
- C:\Windows\System\XkunLHh.exe
  C:\Windows\System\XkunLHh.exe
  2⤵
  PID:12444
- C:\Windows\System\yDkjHgq.exe
  C:\Windows\System\yDkjHgq.exe
  2⤵
  PID:12472
- C:\Windows\System\XRgTVXw.exe
  C:\Windows\System\XRgTVXw.exe
  2⤵
  PID:12500
- C:\Windows\System\UeppvrM.exe
  C:\Windows\System\UeppvrM.exe
  2⤵
  PID:12528
- C:\Windows\System\kKELIQO.exe
  C:\Windows\System\kKELIQO.exe
  2⤵
  PID:12556
- C:\Windows\System\ZXlGHqJ.exe
  C:\Windows\System\ZXlGHqJ.exe
  2⤵
  PID:12584
- C:\Windows\System\lYPNXFr.exe
  C:\Windows\System\lYPNXFr.exe
  2⤵
  PID:12612
- C:\Windows\System\arlpVLe.exe
  C:\Windows\System\arlpVLe.exe
  2⤵
  PID:12640
- C:\Windows\System\WGOSVrm.exe
  C:\Windows\System\WGOSVrm.exe
  2⤵
  PID:12668
- C:\Windows\System\fbDqHwL.exe
  C:\Windows\System\fbDqHwL.exe
  2⤵
  PID:12696
- C:\Windows\System\VfnxfgE.exe
  C:\Windows\System\VfnxfgE.exe
  2⤵
  PID:12724
- C:\Windows\System\iTUhdDB.exe
  C:\Windows\System\iTUhdDB.exe
  2⤵
  PID:12752
- C:\Windows\System\uNTzWnJ.exe
  C:\Windows\System\uNTzWnJ.exe
  2⤵
  PID:12768
- C:\Windows\System\mCwabVq.exe
  C:\Windows\System\mCwabVq.exe
  2⤵
  PID:12792
- C:\Windows\System\eQOGTNH.exe
  C:\Windows\System\eQOGTNH.exe
  2⤵
  PID:12816
- C:\Windows\System\OhaIlPY.exe
  C:\Windows\System\OhaIlPY.exe
  2⤵
  PID:12852
- C:\Windows\System\xIiBkOL.exe
  C:\Windows\System\xIiBkOL.exe
  2⤵
  PID:12892
- C:\Windows\System\mozNCYS.exe
  C:\Windows\System\mozNCYS.exe
  2⤵
  PID:12920
- C:\Windows\System\sDAObnF.exe
  C:\Windows\System\sDAObnF.exe
  2⤵
  PID:12948
- C:\Windows\System\mAAeKXs.exe
  C:\Windows\System\mAAeKXs.exe
  2⤵
  PID:12976
- C:\Windows\System\vvJCXut.exe
  C:\Windows\System\vvJCXut.exe
  2⤵
  PID:13004
- C:\Windows\System\jNaQKQQ.exe
  C:\Windows\System\jNaQKQQ.exe
  2⤵
  PID:13032
- C:\Windows\System\yqZkXKY.exe
  C:\Windows\System\yqZkXKY.exe
  2⤵
  PID:13060
- C:\Windows\System\SoyWooB.exe
  C:\Windows\System\SoyWooB.exe
  2⤵
  PID:13088
- C:\Windows\System\eDcEyKJ.exe
  C:\Windows\System\eDcEyKJ.exe
  2⤵
  PID:13116
- C:\Windows\System\LzvItYJ.exe
  C:\Windows\System\LzvItYJ.exe
  2⤵
  PID:13144
- C:\Windows\System\lzCBNdM.exe
  C:\Windows\System\lzCBNdM.exe
  2⤵
  PID:13172
- C:\Windows\System\UclQroR.exe
  C:\Windows\System\UclQroR.exe
  2⤵
  PID:13200
- C:\Windows\System\kypjRQJ.exe
  C:\Windows\System\kypjRQJ.exe
  2⤵
  PID:13232
- C:\Windows\System\rYLjaYQ.exe
  C:\Windows\System\rYLjaYQ.exe
  2⤵
  PID:13260
- C:\Windows\System\EBUIjxQ.exe
  C:\Windows\System\EBUIjxQ.exe
  2⤵
  PID:13292
- C:\Windows\System\MkBLnFk.exe
  C:\Windows\System\MkBLnFk.exe
  2⤵
  PID:12316
- C:\Windows\System\xlKRNfI.exe
  C:\Windows\System\xlKRNfI.exe
  2⤵
  PID:12380
- C:\Windows\System\EvorrdB.exe
  C:\Windows\System\EvorrdB.exe
  2⤵
  PID:12456
- C:\Windows\System\XAsmihe.exe
  C:\Windows\System\XAsmihe.exe
  2⤵
  PID:12516
- C:\Windows\System\ZvLgnhh.exe
  C:\Windows\System\ZvLgnhh.exe
  2⤵
  PID:12576
- C:\Windows\System\pKPdojh.exe
  C:\Windows\System\pKPdojh.exe
  2⤵
  PID:12652
- C:\Windows\System\AHTcAgd.exe
  C:\Windows\System\AHTcAgd.exe
  2⤵
  PID:12716
- C:\Windows\System\veoUFiz.exe
  C:\Windows\System\veoUFiz.exe
  2⤵
  PID:12776
- C:\Windows\System\ARYmHdk.exe
  C:\Windows\System\ARYmHdk.exe
  2⤵
  PID:12836
- C:\Windows\System\oJDjOlp.exe
  C:\Windows\System\oJDjOlp.exe
  2⤵
  PID:12912
- C:\Windows\System\hQiropL.exe
  C:\Windows\System\hQiropL.exe
  2⤵
  PID:12968
- C:\Windows\System\OdXtrcw.exe
  C:\Windows\System\OdXtrcw.exe
  2⤵
  PID:13024
- C:\Windows\System\CeKYKom.exe
  C:\Windows\System\CeKYKom.exe
  2⤵
  PID:13112
- C:\Windows\System\VAqJdjq.exe
  C:\Windows\System\VAqJdjq.exe
  2⤵
  PID:13164
- C:\Windows\System\zFOrQTm.exe
  C:\Windows\System\zFOrQTm.exe
  2⤵
  PID:13228
- C:\Windows\System\nnVKDMB.exe
  C:\Windows\System\nnVKDMB.exe
  2⤵
  PID:13304
- C:\Windows\System\kcrIgHx.exe
  C:\Windows\System\kcrIgHx.exe
  2⤵
  PID:12428
- C:\Windows\System\UEgxlFA.exe
  C:\Windows\System\UEgxlFA.exe
  2⤵
  PID:12580
- C:\Windows\System\DSgpanW.exe
  C:\Windows\System\DSgpanW.exe
  2⤵
  PID:12744
- C:\Windows\System\foqttQw.exe
  C:\Windows\System\foqttQw.exe
  2⤵
  PID:12876
- C:\Windows\System\MnQOCXP.exe
  C:\Windows\System\MnQOCXP.exe
  2⤵
  PID:13028
- C:\Windows\System\JVPzmXq.exe
  C:\Windows\System\JVPzmXq.exe
  2⤵
  PID:13192
- C:\Windows\System\yNjSoHG.exe
  C:\Windows\System\yNjSoHG.exe
  2⤵
  PID:12372
- C:\Windows\System\jWlJKNP.exe
  C:\Windows\System\jWlJKNP.exe
  2⤵
  PID:12708
- C:\Windows\System\QtnAElY.exe
  C:\Windows\System\QtnAElY.exe
  2⤵
  PID:13084
- C:\Windows\System\BQJvVyw.exe
  C:\Windows\System\BQJvVyw.exe
  2⤵
  PID:12636
- C:\Windows\System\SPCWcsJ.exe
  C:\Windows\System\SPCWcsJ.exe
  2⤵
  PID:12996
- C:\Windows\System\oStxjGq.exe
  C:\Windows\System\oStxjGq.exe
  2⤵
  PID:13328
- C:\Windows\System\MZDICfs.exe
  C:\Windows\System\MZDICfs.exe
  2⤵
  PID:13356
- C:\Windows\System\ptXISsQ.exe
  C:\Windows\System\ptXISsQ.exe
  2⤵
  PID:13384
- C:\Windows\System\gWaSYsD.exe
  C:\Windows\System\gWaSYsD.exe
  2⤵
  PID:13412
- C:\Windows\System\cfmarOU.exe
  C:\Windows\System\cfmarOU.exe
  2⤵
  PID:13440
- C:\Windows\System\dDYlvqS.exe
  C:\Windows\System\dDYlvqS.exe
  2⤵
  PID:13468
- C:\Windows\System\rPgzmJL.exe
  C:\Windows\System\rPgzmJL.exe
  2⤵
  PID:13496
- C:\Windows\System\CAPwtYi.exe
  C:\Windows\System\CAPwtYi.exe
  2⤵
  PID:13524
- C:\Windows\System\wSjgwgd.exe
  C:\Windows\System\wSjgwgd.exe
  2⤵
  PID:13552
- C:\Windows\System\cOAdNLg.exe
  C:\Windows\System\cOAdNLg.exe
  2⤵
  PID:13580
- C:\Windows\System\NXJKyvp.exe
  C:\Windows\System\NXJKyvp.exe
  2⤵
  PID:13596
- C:\Windows\System\wcxWcAU.exe
  C:\Windows\System\wcxWcAU.exe
  2⤵
  PID:13612
- C:\Windows\System\fFnpXhM.exe
  C:\Windows\System\fFnpXhM.exe
  2⤵
  PID:13640
- C:\Windows\System\xwusMYw.exe
  C:\Windows\System\xwusMYw.exe
  2⤵
  PID:13672
- C:\Windows\System\kNCOwBo.exe
  C:\Windows\System\kNCOwBo.exe
  2⤵
  PID:13712
- C:\Windows\System\CHmaDYf.exe
  C:\Windows\System\CHmaDYf.exe
  2⤵
  PID:13744
- C:\Windows\System\RBYXSmQ.exe
  C:\Windows\System\RBYXSmQ.exe
  2⤵
  PID:13780
- C:\Windows\System\AfazJPE.exe
  C:\Windows\System\AfazJPE.exe
  2⤵
  PID:13808
- C:\Windows\System\sphIOhN.exe
  C:\Windows\System\sphIOhN.exe
  2⤵
  PID:13872
- C:\Windows\System\hLCNFwy.exe
  C:\Windows\System\hLCNFwy.exe
  2⤵
  PID:13920
- C:\Windows\System\pEJGzsf.exe
  C:\Windows\System\pEJGzsf.exe
  2⤵
  PID:13952
- C:\Windows\System\riKPpVM.exe
  C:\Windows\System\riKPpVM.exe
  2⤵
  PID:13980
- C:\Windows\System\DqCKnjC.exe
  C:\Windows\System\DqCKnjC.exe
  2⤵
  PID:14008
- C:\Windows\System\NXSTfWa.exe
  C:\Windows\System\NXSTfWa.exe
  2⤵
  PID:14036
- C:\Windows\System\CTHZGLa.exe
  C:\Windows\System\CTHZGLa.exe
  2⤵
  PID:14064
- C:\Windows\System\gGdnpVl.exe
  C:\Windows\System\gGdnpVl.exe
  2⤵
  PID:14092
- C:\Windows\System\sRKWsPv.exe
  C:\Windows\System\sRKWsPv.exe
  2⤵
  PID:14120
- C:\Windows\System\ckYGMsf.exe
  C:\Windows\System\ckYGMsf.exe
  2⤵
  PID:14148
- C:\Windows\System\YVOcrEN.exe
  C:\Windows\System\YVOcrEN.exe
  2⤵
  PID:14176
- C:\Windows\System\AZCQNqo.exe
  C:\Windows\System\AZCQNqo.exe
  2⤵
  PID:14204
- C:\Windows\System\vsiyHrt.exe
  C:\Windows\System\vsiyHrt.exe
  2⤵
  PID:14232
- C:\Windows\System\zXAzcUK.exe
  C:\Windows\System\zXAzcUK.exe
  2⤵
  PID:14264
- C:\Windows\System\xqvQWVN.exe
  C:\Windows\System\xqvQWVN.exe
  2⤵
  PID:14292
- C:\Windows\System\HmRrTaj.exe
  C:\Windows\System\HmRrTaj.exe
  2⤵
  PID:14320
- C:\Windows\System\bwAOUVb.exe
  C:\Windows\System\bwAOUVb.exe
  2⤵
  PID:13340
- C:\Windows\System\ZBVNFmx.exe
  C:\Windows\System\ZBVNFmx.exe
  2⤵
  PID:13404
- C:\Windows\System\LFbXlUK.exe
  C:\Windows\System\LFbXlUK.exe
  2⤵
  PID:13464
- C:\Windows\System\bVjpmDk.exe
  C:\Windows\System\bVjpmDk.exe
  2⤵
  PID:2356
- C:\Windows\System\TGLpCgJ.exe
  C:\Windows\System\TGLpCgJ.exe
  2⤵
  PID:4576
- C:\Windows\System\COqBJpu.exe
  C:\Windows\System\COqBJpu.exe
  2⤵
  PID:13520
- C:\Windows\System\ThDJKSZ.exe
  C:\Windows\System\ThDJKSZ.exe
  2⤵
  PID:13588
- C:\Windows\System\zNkNkIN.exe
  C:\Windows\System\zNkNkIN.exe
  2⤵
  PID:13652
- C:\Windows\System\QcSbdXv.exe
  C:\Windows\System\QcSbdXv.exe
  2⤵
  PID:13760
- C:\Windows\System\RSytsZz.exe
  C:\Windows\System\RSytsZz.exe
  2⤵
  PID:13776
- C:\Windows\System\lHUbvjS.exe
  C:\Windows\System\lHUbvjS.exe
  2⤵
  PID:13948
- C:\Windows\System\aVomkuj.exe
  C:\Windows\System\aVomkuj.exe
  2⤵
  PID:14004
- C:\Windows\System\XMLWSLc.exe
  C:\Windows\System\XMLWSLc.exe
  2⤵
  PID:14088
- C:\Windows\System\tNLPhKG.exe
  C:\Windows\System\tNLPhKG.exe
  2⤵
  PID:14160
- C:\Windows\System\vAaWYfe.exe
  C:\Windows\System\vAaWYfe.exe
  2⤵
  PID:14200
- C:\Windows\System\kSBAUhe.exe
  C:\Windows\System\kSBAUhe.exe
  2⤵
  PID:14284
- C:\Windows\System\jPjkeIi.exe
  C:\Windows\System\jPjkeIi.exe
  2⤵
  PID:13320
- C:\Windows\System\VjohHLz.exe
  C:\Windows\System\VjohHLz.exe
  2⤵
  PID:13460
- C:\Windows\System\ExnWKtk.exe
  C:\Windows\System\ExnWKtk.exe
  2⤵
  PID:13572
- C:\Windows\System\yawmGMs.exe
  C:\Windows\System\yawmGMs.exe
  2⤵
  PID:13772
- C:\Windows\System\wzINPUu.exe
  C:\Windows\System\wzINPUu.exe
  2⤵
  PID:13944
- C:\Windows\System\lbbMIlP.exe
  C:\Windows\System\lbbMIlP.exe
  2⤵
  PID:14060
- C:\Windows\System\cAZaoHm.exe
  C:\Windows\System\cAZaoHm.exe
  2⤵
  PID:14244
- C:\Windows\System\pzkMDor.exe
  C:\Windows\System\pzkMDor.exe
  2⤵
  PID:13492
- C:\Windows\System\kEeHECv.exe
  C:\Windows\System\kEeHECv.exe
  2⤵
  PID:13660
- C:\Windows\System\dyQENCx.exe
  C:\Windows\System\dyQENCx.exe
  2⤵
  PID:13992
- C:\Windows\System\KYnPDjd.exe
  C:\Windows\System\KYnPDjd.exe
  2⤵
  PID:4884
- C:\Windows\System\RxKTufF.exe
  C:\Windows\System\RxKTufF.exe
  2⤵
  PID:13396
- C:\Windows\System\qxYoDoR.exe
  C:\Windows\System\qxYoDoR.exe
  2⤵
  PID:14352
- C:\Windows\System\TvIQVVs.exe
  C:\Windows\System\TvIQVVs.exe
  2⤵
  PID:14388
- C:\Windows\System\cnwrGYG.exe
  C:\Windows\System\cnwrGYG.exe
  2⤵
  PID:14412
- C:\Windows\System\LibRLeY.exe
  C:\Windows\System\LibRLeY.exe
  2⤵
  PID:14452
- C:\Windows\System\ayGUGJf.exe
  C:\Windows\System\ayGUGJf.exe
  2⤵
  PID:14484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BXTZoGF.exe

Filesize
2.0MB

MD5
8ff481a1c2e6c1983e7c91b492734524

SHA1
b9c2fd7819acd5d89fc70cbb374ccde2e5ca8ead

SHA256
744d179df5596323321d649c9d41cc96398ab91fe39c0d274df15d9fba47fc24

SHA512
12a7269bfbb94a1d7c90d504ce6b76934561cde86ab3e212fae9bcb522ab0383b09ee2bddd92b652b21dfcec0104949ea05481e88e44699f4d38187014418101

Download Submit
C:\Windows\System\BjRPlii.exe

Filesize
2.0MB

MD5
d04d28ff4e6e0245251ca80fe5a5190b

SHA1
6e5d88c8ddeffb83e668e748d45c347c691ea417

SHA256
caa266a68f2fff04793f4d7218b580ccb445fbe0f07284c4501b02fc3a893000

SHA512
afc996278d6d4d17e9217138de35246516c712b72eb84235150c345d0857ee71bf7d67e80788ff20ee5261bd5535df5c7dd2e5d797b46cd9b8a8fb7e49480809

Download Submit
C:\Windows\System\DUtrsGL.exe

Filesize
2.0MB

MD5
6d60ab2656d2d33729e4f50f6c60dba1

SHA1
d19751b3c75c7f4697b98e7f5bbc4f63f4894d45

SHA256
9a8e7498d7c4fa71e929f0c5248c228a8f64b31e44dcf521b4ac03dcdb531acd

SHA512
2fd1e8ab4d73486193b84457ec74fd623943c336c98ed546a3000b3087e5f5afc00343ff6c1104564aa0cddcdce79ab937d5d41c10b44a9d62a53a0c2813cd93

Download Submit
C:\Windows\System\HDPuxNb.exe

Filesize
2.0MB

MD5
d3e0efd3a1ec8715059e771ddaa08bc9

SHA1
49f64c17eaec785bc6fbf7d0ac0be5c070f5eef8

SHA256
19f67c1257e00e400985e34c67fb0f43d4dd037f494311ec8868febff98d00f7

SHA512
41c9cf33a080e76f3af4832780d94fc1374c0b7102241dde2bd61586ac3a09f91488f05e6b5d6c1f249f4a1318600efec2d515772b136d71f0a04afc0272d01a

Download Submit
C:\Windows\System\JLxaMJQ.exe

Filesize
2.0MB

MD5
682ea847903273b006ff6dc77e8a95ef

SHA1
2e3e360865598aff59f71adeda98d77c2b47bd16

SHA256
ae250a623888ae8492a33ee9eed4073f4043681708f5c573d2745a5f09573741

SHA512
94fa3b570ce4330edee6cecbe42ecc9f7cd8dfc92c4dca69cd97d9e896cdba9b3e5a1d094ed0d7faa2c7b15b8824d299854bdd10599fd7a2a52324f92eaae2a0

Download Submit
C:\Windows\System\MHbRaeW.exe

Filesize
2.0MB

MD5
db4eb23ac3f5067bf251b7b5e23f02a2

SHA1
5dff9220c7afee11c5ac0fe9721d23cd4f0b45be

SHA256
037ead6ab1f8dc30cb0b9a6573bee2a0c9c935f6372cee251a15f2c74880de9a

SHA512
431debbd726a669b9014650d1c95e3bf0deb86e6c9ef82ebebe22f8101c7b15e908d5fb7aefa7a404e8ed006513a9db8e5c97a0a905d888801209f11720d39d4

Download Submit
C:\Windows\System\MvSORbY.exe

Filesize
2.0MB

MD5
8297ef4c94f927622d2e6af3db1b3899

SHA1
8d3041b5e14e9add3055a3579b3082586d7337a3

SHA256
ba323070b00b9aec365133cc8c4ca70446e19416b8ef34f429828fc296a603b2

SHA512
b4a506f3362e31b00e485d2852e869629d9d49cd8f4246c73723f3fe5aa0e02117cacc201dec4f222a0c8d7980680e6b7514d079d8174145d12504b042c0d52c

Download Submit
C:\Windows\System\NWGpyny.exe

Filesize
2.0MB

MD5
1d00f9fefd78ec9619ad2a8eaf7d1ad2

SHA1
4a80ef1136b14faa6d55a05c2540caf29e1f789c

SHA256
3098ed308c7008ae7028f85b3c9d5e59287b8b0db1ea30a669cbbd271edd5003

SHA512
4b69c678b81f0fba3b27d26b56adb4c4d772e5f8f7169bffaf15eda6bd9b10135e1b871fff05eda7a3cc2d6467ed3e0d51909a70d8cb50af3e57192106a13f16

Download Submit
C:\Windows\System\TfCOODn.exe

Filesize
2.0MB

MD5
754fe096f1fadebda24845220982cf35

SHA1
b52bff980053f112ffabe8d29fad09e690c8f312

SHA256
79c509f5533184b59bd6478960c3df71b98c4d4f22655efef419fcddc7877bde

SHA512
70738ff73edb58d771565f24e16dd9e8f55f7a2b407b7bae34b287b2972da02cd7dffe44aa6fb0fd73aafdf60128ebdd06de121fce7236360a816d329a83655c

Download Submit
C:\Windows\System\UjrKgeX.exe

Filesize
2.0MB

MD5
47e57d11141e3a9045ace78d908543be

SHA1
b55bc5bff53137f51289254310ccb2ceaa024b72

SHA256
965e073fb95fea5b47c066973d3869f254c0fc59ead1610ba99fbcfa0b6a2901

SHA512
dc10d2b0a0408e99134b33bc184b5ca8f1e2b2a20a51af30e9de8b811baa74064b42f02cd21581d7f733e5979923550cae377f5ca66e1bba92387700549a4333

Download Submit
C:\Windows\System\VydmODa.exe

Filesize
2.0MB

MD5
d5c55dd1ae4a599159043e41d26019b6

SHA1
7f9c29f84d870e671a87371ab72c31c3897120a8

SHA256
d8dd6c510412cd626c677427445b86ef9eea95d3a41abbfa6e98485d557d858a

SHA512
c7a44de89a4821394bd22a35fd6a5fd1742826c290d13c9e9bc9c72efcb80c999eb7f8cdb765663d8f6d0c64de5da9484998d59182b4d83f0bb88235ecc7df52

Download Submit
C:\Windows\System\XJkylwM.exe

Filesize
2.0MB

MD5
9397a9d7d7b716364f73905f9828db9a

SHA1
ddcca1476d5924c9347001d0c120090d64c84b6f

SHA256
a6ef49763706413b24fd4f83a5d262b15c13b38d3de5568b2d02a467224c3a4f

SHA512
823a0447b75e21c99e03f8ea1ee35cd7686e776ea0e9412b31d41d03079f450cd44e6517795ab3ed1b65418ddccdeca86301411422cce83d8d10c19ef25bbc18

Download Submit
C:\Windows\System\XlsnhmL.exe

Filesize
2.0MB

MD5
ae4c15b2d33468225177838174440745

SHA1
8516704110d2426b06f16afe56e3d3a21b1de95d

SHA256
82c293ef008dcab5813564cc939ce65ce03b44674163f706ad6759d5cef046e8

SHA512
beec162d56a09cf444b7e031a7b92165e4b9a468ed0c9f61e42939e352870a7aec604eec6768c8b5c2e9302d43b2ab2f5fedbf8f703b3d75b97fd2eba0e98f33

Download Submit
C:\Windows\System\dKwXmZZ.exe

Filesize
2.0MB

MD5
26c12fbe07e288717e38428b307f1c32

SHA1
1a45b0d387258bb25ca03df7ee686090d4081156

SHA256
7162ec1a4a12d3f5f20ef895958523a055ba3c47bc98bccb3aebe857b9d88ea0

SHA512
d683baa445fec4cdea52dfce9206a4500082042f79a0996423659a2657574bda6814ac9e398281711f379195d4b0f12758015b1954e71a3d538536f6d44be1ca

Download Submit
C:\Windows\System\eLoHQSc.exe

Filesize
2.0MB

MD5
bee08dd3dfe5268de18df52e187a98ef

SHA1
37b94991b7257d20f41e9473e9444de0940639ca

SHA256
b2eb27ce3d4a7f76b6239e829cde55fe30f3dac32e3c51dad3fba2f2b4b85a77

SHA512
421989c6c67208a5d7816dd32454d6cc686f0c7eec2cb0fa858e9c7c25e9f2d35e910b85bad20e38fd6238ae7e879968a476fe2ce895f8e77cedf47d02b38484

Download Submit
C:\Windows\System\eWiycDc.exe

Filesize
1.1MB

MD5
fd82da185e5a49219183fc220b4a880e

SHA1
72267e320b4bd526e3e1ba9fd80a7fb4c5a4cfe6

SHA256
90d016700c3e836ddfa243662082a4e23adedef5e8fc1c5fa57b46f6e257b688

SHA512
5d3235aaa989eb1b4ca5a9593081fa027e0048eaa1c559694cb08aab5e1f8c46fbcea15d9c224026ec11917b04fdd3b3c42021c5a793d8d717a0510410258037

Download Submit
C:\Windows\System\eWiycDc.exe

Filesize
2.0MB

MD5
b4e15d6c4e061b8f1051b9be7ff4de4b

SHA1
4147370619429cbbcdfb32d0516fbf06f8985f26

SHA256
6f3a28db701f1bca7b28a4510c9958257bc5d493260987989bc8b3d2d382c709

SHA512
d9571f3bad75ff9cd00521c90506e1bce3f2b6bc32a5af7cd6ee8a759645dc16f29a2b90b4f7eba67ea9402418f691f4ec060d822f1d5238ba17495f85f11919

Download Submit
C:\Windows\System\epMVKVU.exe

Filesize
2.0MB

MD5
6947719a24bb94242a5b46305d85c49e

SHA1
4d15b0d613944b5b9eeeaf54675aa0209477ca8d

SHA256
acb6e791f5447b6a486d0120165f86d880a12e8d918d4ad6aa1a0848d7c5805b

SHA512
6c296d2602077a2a4f1d6f3185a405c8382e01cf37afd0ea7359e549544a5c164edba412028dd52d26918aacd36d525f1a256585b37a9e3c6494532ec3d3db10

Download Submit
C:\Windows\System\fFaCYCp.exe

Filesize
2.0MB

MD5
6bc34f405ddfa4d9f41427959285495b

SHA1
30c30763a94fe7e4cfc0dc1c713d412e3fae8197

SHA256
1f3ba22ad7de169b6e151e3f155e0a3f1cee84db8fafe16c1cbaeeea53c5c47b

SHA512
779ee67688e37572eead99866240aa768c386adc8c24fc10e1620cb626fa86e6cbd7b9da843a57186b7c37a099a81e911f674ddb87fba6d9652ba8fae786db7f

Download Submit
C:\Windows\System\hYyPADg.exe

Filesize
2.0MB

MD5
724f56a3991d0cac6614af68e36e460c

SHA1
f0fe2d4e76b42a88559955194ea96c0ba278c6aa

SHA256
a27ced094f4879b5b850c796e7d2044ed2af46d98eb56cfe60ef3cbc11e80e12

SHA512
db104c99b8ca5e33ca17efd3530471579ef85992597cc67e0b63c49be286ca8563378bd8c912fe73ed199d51bd1a4ee48ba0717a6268e70434d79d072ffc7c96

Download Submit
C:\Windows\System\kHGXdUq.exe

Filesize
2.0MB

MD5
883407e6c10e5618375eac4ec18716b6

SHA1
649d4760d8b1eb79f42ba307875ab1626871fb14

SHA256
8ccd1385f99af888803b0a637c68046cafdbffcf478593115f386a9b0ec05b9d

SHA512
e53173f0a01d524e370d0d9b28fd2edb021d238cb9e7d573856a5650490838e4c916acc70723ad6d9ed39198de9a022167dc36417da9d686b5d1ff11de13ed63

Download Submit
C:\Windows\System\kWfZBhr.exe

Filesize
2.0MB

MD5
ca46dc2928c7baaae76fcb6884d77ca5

SHA1
128f93acd207e80e816024be222a0f2e5d9e6434

SHA256
cfdea754f8bf4b232e0dda8935b1125d1f66b00aa250e5f1948052bdab322650

SHA512
d166b0c138340cab1a1800a35adfe057696da4fe60c5c77625b7e05cd4bb01cf5636a6b60eb23fe5617ecdee0bbc5d3d3253eff1a81dd89a8d73ee26e2c0b53d

Download Submit
C:\Windows\System\lUAilVs.exe

Filesize
2.0MB

MD5
eb7cd9bb98bbe071c9a6099178362bde

SHA1
9e58e134e53d2ef0565b14c672dab572c4682361

SHA256
1bc71a0b9faf44872cd70f3bb0fe90ac42754282a86e5501c22b11facbcb2416

SHA512
cecbd257ea635ac9949d163af9c41c8894662a84208dbc95879d9021e51d578466466f14957532fd1b23c71359db5417e44ff001dcc1ce69d4d66e57b6cfc039

Download Submit
C:\Windows\System\mSrsFXU.exe

Filesize
2.0MB

MD5
b2223dbe96fec5db44ffae6ea1a41d7d

SHA1
260cdbce316f0772459791b177e0aee73c923445

SHA256
a957537f98fdbf56419e7caafcf0de090fa5e5d0fbd0ea2d71c098170200ecb3

SHA512
698b8187c7220d22ac17ca2c8efdf9ec69860ff7fac747c5b88b513e743db4f886d0ad2ac5ea355d42703ab971060f2559405b3a789f78f86b7ae7eab5ac4758

Download Submit
C:\Windows\System\qtZagWg.exe

Filesize
2.0MB

MD5
70a4397a60811b8b77db6a7775fa39b2

SHA1
b2b8d0b48c2efdbee1feec1a89d82ab78a0af59a

SHA256
3c364bfdab42e254dacf4c707d10764bc98967feb617298de744e02ef5e9416b

SHA512
a77ead2006ec1e4a61b257903f305abc1d4d8cf773c31dd6066f05d1225c35802629bd3a6e01926b44cefc897cc922ec2e8a0b251298d3ab039db25fc20265bc

Download Submit
C:\Windows\System\rtsNakN.exe

Filesize
2.0MB

MD5
1a76d89c3f5cce0db7cc16b3184e0395

SHA1
9604c3aeceda48a2348eb0beab075dd56b478cc9

SHA256
11781e0b7cb96ab5bcb30ed2a1c1346c378820266ca9d61a1a77719c44efd4cd

SHA512
3ef3edbfe65adcc7b6a3dfee112efea0961553fa5525becb8e0bf998c4943a68f2d291c7843d76f3041f6711679eea0a72e72c541bb3d18cccf0484604d2cb6d

Download Submit
C:\Windows\System\rtsNakN.exe

Filesize
1.2MB

MD5
1e2c91c252fda2ba969dbe32b0b5ab77

SHA1
ab171f79b0e051763189f6cdb9168dd2af0b084f

SHA256
ea520e081a8e8135310d7168f90c0cf55bf3a607ff8dd73063a44570c10abf00

SHA512
376952619d13e73211b4ad7b27c979d9cc4f6e2961ac10d8f57882bec33161ecb5760b47d8607621ec4be8ef4d760bd317fb45b1946f2e0ffc31af3173e3d0a8

Download Submit
C:\Windows\System\tlDVEJx.exe

Filesize
2.0MB

MD5
814a9071e22992ff6abf6a24ca8f7c69

SHA1
1db1c92a52aef717cec3cb4f33c6adde2c961809

SHA256
49c52ebce2a4fc35e004aa9619cd9bc63e254e4157ea636e657fec4afc92df68

SHA512
1376f967aa1d97058f247f9bdb1f276472edf14905e6f887390d62bdd39c37a6457e07f1b215b1a5e7f964a94f1051b42ded71130072d090dc529ec36a9cc280

Download Submit
C:\Windows\System\uhTAMQW.exe

Filesize
2.0MB

MD5
7bd3c9ef6d40e8353d37a98b46aa168f

SHA1
83af08291c7709f99c3164cb6e63029b56736550

SHA256
0d44a1e6c056ac1da2eb3e5dcc7095dbc63ad96b9fa0711fa2c714f4ce62e2ad

SHA512
a979783da2465675262ee5dfc53498112ce7d7da597ca072c093e27256eb7e3e242e520ae750d39f9bfb658aa87b80a9040540b416bb826c66926823f7f2f97a

Download Submit
C:\Windows\System\uskcboB.exe

Filesize
2.0MB

MD5
16843e3a0f30c5f29a8c72b87e853214

SHA1
3b61872db2fa0057654770389d4bb21dfc858766

SHA256
d1ad01094d5d53d7ef33497438c12634accf188b7dd403ea32ce5ec7be0ba54c

SHA512
46267fcce3a0671ebadefb70e95635e09e955b38fb3317c6fa5423a119ffcab396a84d62b5df6120706fd023b1441b760f338d32ee2c2a14b0c610f734e6c1aa

Download Submit
C:\Windows\System\vRnPQMn.exe

Filesize
2.0MB

MD5
ea38eaabc0f3bcfaec930baa333cb22f

SHA1
48f3eaedee2c5201ea41c7aaf4a6fe712de5a6d6

SHA256
bfc23b9e5dfe4aa688855e2ca4fc0db76262a7a22da0731b56af4c100c37c113

SHA512
6532ef993636c861eb76094939c4ee78cc92bbabc992afc7a4eaa62f4625cca7346b1e18229c1cf5ffdaca0d160a3101150e1d632b3f6baf62cab84eeb6f26b8

Download Submit
C:\Windows\System\vtSMGNu.exe

Filesize
2.0MB

MD5
6c449fb4a123c326b08462140b2dba96

SHA1
98b7d883da4155ff97a60a6fb975656ee2dce302

SHA256
45123dc47fe43bb523b0273f1ae5b0b5ea98d1f9b28900dbf2dfd2f04989179c

SHA512
daec7904a380776fe5aa588afd419a55cf0f95b827cc9549b3afb38f7edd7d1ebcb2d9418fe0ef66de582a585947a292c9658d723ac5da82f864da5084e09e17

Download Submit
C:\Windows\System\xErXMqv.exe

Filesize
2.0MB

MD5
a21286508d8702a59f02fdc4fa26110a

SHA1
37c9329f036b0bc9c73ea8af39e3c99e498d604c

SHA256
13210a9209137da10f555574cffed13be01ed8d49faa2385e0793e0bbe7ab978

SHA512
7b02cd6c77b0fa1954d67d1b5718a33b24b97ebbca239c96c593d066fc3b9c5d898cdb3e8608a34b31311763f2a4436905ad311090813473d53315f18c9e75d3

Download Submit
C:\Windows\System\xpjtowp.exe

Filesize
2.0MB

MD5
70d3a2ec1d1a35e699aa13e3bb039386

SHA1
f24ea47d56dc4fa5606e8a40d240bc5155fc9538

SHA256
aeec05768040a01eeb45d2e51bd9d588212b51797b34cf5ac5c7ff8cd9b34e27

SHA512
7c22de4c561471598a9ab174c1c89a657f225c7306eb6f54ac40cc47b48dc5d8a1adb0a89799f61796272db92c323c4c82ccceacd49773841b5cc0de1c28de41

Download Submit
C:\Windows\System\yDzUBMR.exe

Filesize
2.0MB

MD5
d6ac244db9822c520db2fcaf88268bce

SHA1
f738c33259406dfafd91ad13c83f946cea5ea8e8

SHA256
05b72e328c9ceef410b15fe637bd7981bf9c71f376fbc70e08c48f5023be9214

SHA512
a03a277bf6025815e7bc0968489afb070e3569e4b373f23a6864560d07feb81fbf498a92a803abc23fe54882656f4cea676f5036037737deae65c234de59c506

Download Submit
memory/404-160-0x00007FF68A160000-0x00007FF68A4B4000-memory.dmp

Filesize
3.3MB

Download
memory/404-2076-0x00007FF68A160000-0x00007FF68A4B4000-memory.dmp

Filesize
3.3MB

Download
memory/888-2075-0x00007FF7EEAF0000-0x00007FF7EEE44000-memory.dmp

Filesize
3.3MB

Download
memory/888-157-0x00007FF7EEAF0000-0x00007FF7EEE44000-memory.dmp

Filesize
3.3MB

Download
memory/1304-2099-0x00007FF62D7D0000-0x00007FF62DB24000-memory.dmp

Filesize
3.3MB

Download
memory/1304-175-0x00007FF62D7D0000-0x00007FF62DB24000-memory.dmp

Filesize
3.3MB

Download
memory/1544-109-0x00007FF7ECFA0000-0x00007FF7ED2F4000-memory.dmp

Filesize
3.3MB

Download
memory/1544-2077-0x00007FF7ECFA0000-0x00007FF7ED2F4000-memory.dmp

Filesize
3.3MB

Download
memory/2468-161-0x00007FF638750000-0x00007FF638AA4000-memory.dmp

Filesize
3.3MB

Download
memory/2468-2095-0x00007FF638750000-0x00007FF638AA4000-memory.dmp

Filesize
3.3MB

Download
memory/2480-2100-0x00007FF71E920000-0x00007FF71EC74000-memory.dmp

Filesize
3.3MB

Download
memory/2480-189-0x00007FF71E920000-0x00007FF71EC74000-memory.dmp

Filesize
3.3MB

Download
memory/3052-158-0x00007FF75BDA0000-0x00007FF75C0F4000-memory.dmp

Filesize
3.3MB

Download
memory/3052-2083-0x00007FF75BDA0000-0x00007FF75C0F4000-memory.dmp

Filesize
3.3MB

Download
memory/3228-0-0x00007FF735B60000-0x00007FF735EB4000-memory.dmp

Filesize
3.3MB

Download
memory/3228-1-0x000001F3128A0000-0x000001F3128B0000-memory.dmp

Filesize
64KB

Download
memory/3336-2085-0x00007FF798DB0000-0x00007FF799104000-memory.dmp

Filesize
3.3MB

Download
memory/3336-162-0x00007FF798DB0000-0x00007FF799104000-memory.dmp

Filesize
3.3MB

Download
memory/3436-2084-0x00007FF6533D0000-0x00007FF653724000-memory.dmp

Filesize
3.3MB

Download
memory/3436-130-0x00007FF6533D0000-0x00007FF653724000-memory.dmp

Filesize
3.3MB

Download
memory/3608-156-0x00007FF65F620000-0x00007FF65F974000-memory.dmp

Filesize
3.3MB

Download
memory/3608-2098-0x00007FF65F620000-0x00007FF65F974000-memory.dmp

Filesize
3.3MB

Download
memory/3612-86-0x00007FF648520000-0x00007FF648874000-memory.dmp

Filesize
3.3MB

Download
memory/3612-2081-0x00007FF648520000-0x00007FF648874000-memory.dmp

Filesize
3.3MB

Download
memory/3632-151-0x00007FF70AC00000-0x00007FF70AF54000-memory.dmp

Filesize
3.3MB

Download
memory/3632-2091-0x00007FF70AC00000-0x00007FF70AF54000-memory.dmp

Filesize
3.3MB

Download
memory/3876-131-0x00007FF7E5250000-0x00007FF7E55A4000-memory.dmp

Filesize
3.3MB

Download
memory/3876-2079-0x00007FF7E5250000-0x00007FF7E55A4000-memory.dmp

Filesize
3.3MB

Download
memory/4000-57-0x00007FF6D1CB0000-0x00007FF6D2004000-memory.dmp

Filesize
3.3MB

Download
memory/4000-2080-0x00007FF6D1CB0000-0x00007FF6D2004000-memory.dmp

Filesize
3.3MB

Download
memory/4000-2070-0x00007FF6D1CB0000-0x00007FF6D2004000-memory.dmp

Filesize
3.3MB

Download
memory/4036-155-0x00007FF72FDB0000-0x00007FF730104000-memory.dmp

Filesize
3.3MB

Download
memory/4036-2093-0x00007FF72FDB0000-0x00007FF730104000-memory.dmp

Filesize
3.3MB

Download
memory/4068-80-0x00007FF74F430000-0x00007FF74F784000-memory.dmp

Filesize
3.3MB

Download
memory/4068-2078-0x00007FF74F430000-0x00007FF74F784000-memory.dmp

Filesize
3.3MB

Download
memory/4068-2071-0x00007FF74F430000-0x00007FF74F784000-memory.dmp

Filesize
3.3MB

Download
memory/4140-154-0x00007FF7750D0000-0x00007FF775424000-memory.dmp

Filesize
3.3MB

Download
memory/4140-2094-0x00007FF7750D0000-0x00007FF775424000-memory.dmp

Filesize
3.3MB

Download
memory/4304-2073-0x00007FF6E6620000-0x00007FF6E6974000-memory.dmp

Filesize
3.3MB

Download
memory/4304-41-0x00007FF6E6620000-0x00007FF6E6974000-memory.dmp

Filesize
3.3MB

Download
memory/4328-163-0x00007FF6F8C20000-0x00007FF6F8F74000-memory.dmp

Filesize
3.3MB

Download
memory/4328-2097-0x00007FF6F8C20000-0x00007FF6F8F74000-memory.dmp

Filesize
3.3MB

Download
memory/4404-2069-0x00007FF71AC00000-0x00007FF71AF54000-memory.dmp

Filesize
3.3MB

Download
memory/4404-2074-0x00007FF71AC00000-0x00007FF71AF54000-memory.dmp

Filesize
3.3MB

Download
memory/4404-26-0x00007FF71AC00000-0x00007FF71AF54000-memory.dmp

Filesize
3.3MB

Download
memory/4528-145-0x00007FF65C470000-0x00007FF65C7C4000-memory.dmp

Filesize
3.3MB

Download
memory/4528-2088-0x00007FF65C470000-0x00007FF65C7C4000-memory.dmp

Filesize
3.3MB

Download
memory/4644-2087-0x00007FF69DB70000-0x00007FF69DEC4000-memory.dmp

Filesize
3.3MB

Download
memory/4644-144-0x00007FF69DB70000-0x00007FF69DEC4000-memory.dmp

Filesize
3.3MB

Download
memory/4816-146-0x00007FF6C58F0000-0x00007FF6C5C44000-memory.dmp

Filesize
3.3MB

Download
memory/4816-2086-0x00007FF6C58F0000-0x00007FF6C5C44000-memory.dmp

Filesize
3.3MB

Download
memory/4828-164-0x00007FF7A0E10000-0x00007FF7A1164000-memory.dmp

Filesize
3.3MB

Download
memory/4828-2092-0x00007FF7A0E10000-0x00007FF7A1164000-memory.dmp

Filesize
3.3MB

Download
memory/4860-153-0x00007FF763110000-0x00007FF763464000-memory.dmp

Filesize
3.3MB

Download
memory/4860-2096-0x00007FF763110000-0x00007FF763464000-memory.dmp

Filesize
3.3MB

Download
memory/4868-2072-0x00007FF7E1D10000-0x00007FF7E2064000-memory.dmp

Filesize
3.3MB

Download
memory/4868-11-0x00007FF7E1D10000-0x00007FF7E2064000-memory.dmp

Filesize
3.3MB

Download
memory/4868-2068-0x00007FF7E1D10000-0x00007FF7E2064000-memory.dmp

Filesize
3.3MB

Download
memory/5040-2082-0x00007FF7F2BE0000-0x00007FF7F2F34000-memory.dmp

Filesize
3.3MB

Download
memory/5040-118-0x00007FF7F2BE0000-0x00007FF7F2F34000-memory.dmp

Filesize
3.3MB

Download
memory/5068-152-0x00007FF7D7560000-0x00007FF7D78B4000-memory.dmp

Filesize
3.3MB

Download
memory/5068-2090-0x00007FF7D7560000-0x00007FF7D78B4000-memory.dmp

Filesize
3.3MB

Download
memory/5084-159-0x00007FF6E7A50000-0x00007FF6E7DA4000-memory.dmp

Filesize
3.3MB

Download
memory/5084-2089-0x00007FF6E7A50000-0x00007FF6E7DA4000-memory.dmp

Filesize
3.3MB

Download