xmrig | 3f79ccae8dc16ae0308719a230076b6e4aa43768d4b0d4372886058b8cbc0709

Analysis

max time kernel
117s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
Size

2.2MB
MD5

f820513b9c6f2547b87ad0301c4aba00
SHA1

7109fe00b78d12d0d38bb5304375ed10503dddcc
SHA256

3f79ccae8dc16ae0308719a230076b6e4aa43768d4b0d4372886058b8cbc0709
SHA512

3aed4e1d35589acf32f61809685372d8050a2ed5d3d785138077a64cbf490b039ab502c02aa04e504c3fc3a46e5ecd816b0bc6e50d8c47be77a9052961362816
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIlfBWFUpIO2hOsgeGo3Q0:BemTLkNdfE0pZrQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/220-0-0x00007FF6732C0000-0x00007FF673614000-memory.dmp	xmrig
behavioral2/files/0x0009000000023470-6.dat	xmrig
behavioral2/files/0x0007000000023478-10.dat	xmrig
behavioral2/files/0x0007000000023477-11.dat	xmrig
behavioral2/memory/2084-22-0x00007FF7D5E90000-0x00007FF7D61E4000-memory.dmp	xmrig
behavioral2/files/0x000700000002347a-25.dat	xmrig
behavioral2/files/0x000700000002347c-39.dat	xmrig
behavioral2/files/0x000700000002347d-45.dat	xmrig
behavioral2/files/0x000700000002347e-49.dat	xmrig
behavioral2/files/0x0007000000023481-62.dat	xmrig
behavioral2/files/0x0007000000023484-77.dat	xmrig
behavioral2/files/0x0007000000023485-90.dat	xmrig
behavioral2/files/0x000700000002348b-112.dat	xmrig
behavioral2/files/0x000700000002348d-130.dat	xmrig
behavioral2/files/0x0007000000023491-150.dat	xmrig
behavioral2/files/0x0007000000023496-167.dat	xmrig
behavioral2/memory/3152-655-0x00007FF715770000-0x00007FF715AC4000-memory.dmp	xmrig
behavioral2/memory/4528-654-0x00007FF764710000-0x00007FF764A64000-memory.dmp	xmrig
behavioral2/memory/1816-656-0x00007FF799EA0000-0x00007FF79A1F4000-memory.dmp	xmrig
behavioral2/memory/2264-658-0x00007FF602370000-0x00007FF6026C4000-memory.dmp	xmrig
behavioral2/memory/3996-659-0x00007FF739460000-0x00007FF7397B4000-memory.dmp	xmrig
behavioral2/memory/5024-661-0x00007FF7F9800000-0x00007FF7F9B54000-memory.dmp	xmrig
behavioral2/memory/4296-662-0x00007FF60EA20000-0x00007FF60ED74000-memory.dmp	xmrig
behavioral2/memory/5012-672-0x00007FF79C460000-0x00007FF79C7B4000-memory.dmp	xmrig
behavioral2/memory/1464-679-0x00007FF6A9E20000-0x00007FF6AA174000-memory.dmp	xmrig
behavioral2/memory/4168-685-0x00007FF715350000-0x00007FF7156A4000-memory.dmp	xmrig
behavioral2/memory/3404-704-0x00007FF782F70000-0x00007FF7832C4000-memory.dmp	xmrig
behavioral2/memory/1740-733-0x00007FF6B87A0000-0x00007FF6B8AF4000-memory.dmp	xmrig
behavioral2/memory/4668-735-0x00007FF7899F0000-0x00007FF789D44000-memory.dmp	xmrig
behavioral2/memory/220-2090-0x00007FF6732C0000-0x00007FF673614000-memory.dmp	xmrig
behavioral2/memory/440-2091-0x00007FF788550000-0x00007FF7888A4000-memory.dmp	xmrig
behavioral2/memory/3812-728-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	xmrig
behavioral2/memory/1328-724-0x00007FF740F70000-0x00007FF7412C4000-memory.dmp	xmrig
behavioral2/memory/2564-717-0x00007FF624B80000-0x00007FF624ED4000-memory.dmp	xmrig
behavioral2/memory/1156-714-0x00007FF75C0F0000-0x00007FF75C444000-memory.dmp	xmrig
behavioral2/memory/4676-709-0x00007FF7A0AD0000-0x00007FF7A0E24000-memory.dmp	xmrig
behavioral2/memory/1612-697-0x00007FF7AE290000-0x00007FF7AE5E4000-memory.dmp	xmrig
behavioral2/memory/4600-691-0x00007FF6F4CA0000-0x00007FF6F4FF4000-memory.dmp	xmrig
behavioral2/memory/844-675-0x00007FF7CC810000-0x00007FF7CCB64000-memory.dmp	xmrig
behavioral2/memory/4080-669-0x00007FF6FBD20000-0x00007FF6FC074000-memory.dmp	xmrig
behavioral2/memory/1016-667-0x00007FF627C30000-0x00007FF627F84000-memory.dmp	xmrig
behavioral2/memory/4320-660-0x00007FF6EA940000-0x00007FF6EAC94000-memory.dmp	xmrig
behavioral2/memory/4116-657-0x00007FF6E4750000-0x00007FF6E4AA4000-memory.dmp	xmrig
behavioral2/memory/4360-2092-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023494-165.dat	xmrig
behavioral2/files/0x0007000000023495-162.dat	xmrig
behavioral2/files/0x0007000000023493-160.dat	xmrig
behavioral2/files/0x0007000000023492-155.dat	xmrig
behavioral2/files/0x0007000000023490-145.dat	xmrig
behavioral2/files/0x000700000002348f-140.dat	xmrig
behavioral2/files/0x000700000002348e-135.dat	xmrig
behavioral2/files/0x000700000002348c-125.dat	xmrig
behavioral2/files/0x000700000002348a-115.dat	xmrig
behavioral2/files/0x0007000000023489-110.dat	xmrig
behavioral2/files/0x0007000000023488-105.dat	xmrig
behavioral2/files/0x0007000000023487-100.dat	xmrig
behavioral2/files/0x0007000000023488-97.dat	xmrig
behavioral2/files/0x0007000000023486-95.dat	xmrig
behavioral2/files/0x0007000000023483-80.dat	xmrig
behavioral2/files/0x0007000000023482-75.dat	xmrig
behavioral2/files/0x0007000000023480-65.dat	xmrig
behavioral2/files/0x000700000002347f-60.dat	xmrig
behavioral2/files/0x0007000000023479-37.dat	xmrig
behavioral2/memory/4360-34-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
440	VLQvudO.exe
2084	EQcnmyx.exe
1520	pzTGVqu.exe
1740	ikuIzWv.exe
4360	tmCJVnf.exe
4528	VTxfjYR.exe
4668	xMhxUIs.exe
3152	fSvCnoJ.exe
1816	fNwgYpy.exe
4116	eaiLVaJ.exe
2264	zlnWivl.exe
3996	TJgsWeB.exe
4320	dOXpttE.exe
5024	MuWLOvT.exe
4296	HUTVwMB.exe
1016	RldYiIg.exe
4080	JyOPltl.exe
5012	rwLSHvD.exe
844	ZyfoGPx.exe
1464	jHnHcet.exe
4168	GQrPtNa.exe
4600	UonNRKP.exe
1612	RjYJvEx.exe
3404	CxpsJiH.exe
4676	eNdgrZm.exe
1156	ZeQMdzH.exe
2564	ScoHXKP.exe
1328	dDzeOZF.exe
3812	IgcZAlt.exe
1020	zDJmwLI.exe
1096	UCoSZPG.exe
512	AvVQZDl.exe
2956	BjprUKf.exe
4164	vCAIgow.exe
1868	IGQkWoS.exe
4924	rjgPoyZ.exe
3488	lKDzbKZ.exe
4532	vRIzCIv.exe
4392	KUaTMkH.exe
1352	iStaSJp.exe
3324	jHHogXp.exe
2412	nZTGKpE.exe
2484	ughvsOl.exe
3216	ttbnWaN.exe
2828	VMSREGW.exe
5000	vJJhJCk.exe
2268	WpAsEjs.exe
2164	tuyhPCE.exe
3868	MdzyCej.exe
5032	qJqwYRE.exe
4152	lPgVuQz.exe
1256	XySSBnx.exe
3644	rrCeSkH.exe
2812	cVijLpe.exe
4544	rGYuitT.exe
3096	dpMWSok.exe
1644	wIcxrBm.exe
2868	DvTrFVw.exe
4628	yBjkIsE.exe
2424	hPfikPu.exe
3340	wNMHpHQ.exe
4488	eteAhfY.exe
812	ghqUuZd.exe
4636	CDUDGqs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/220-0-0x00007FF6732C0000-0x00007FF673614000-memory.dmp	upx
behavioral2/files/0x0009000000023470-6.dat	upx
behavioral2/files/0x0007000000023478-10.dat	upx
behavioral2/files/0x0007000000023477-11.dat	upx
behavioral2/memory/2084-22-0x00007FF7D5E90000-0x00007FF7D61E4000-memory.dmp	upx
behavioral2/files/0x000700000002347a-25.dat	upx
behavioral2/files/0x000700000002347c-39.dat	upx
behavioral2/files/0x000700000002347d-45.dat	upx
behavioral2/files/0x000700000002347e-49.dat	upx
behavioral2/files/0x0007000000023481-62.dat	upx
behavioral2/files/0x0007000000023484-77.dat	upx
behavioral2/files/0x0007000000023485-90.dat	upx
behavioral2/files/0x000700000002348b-112.dat	upx
behavioral2/files/0x000700000002348d-130.dat	upx
behavioral2/files/0x0007000000023491-150.dat	upx
behavioral2/files/0x0007000000023496-167.dat	upx
behavioral2/memory/3152-655-0x00007FF715770000-0x00007FF715AC4000-memory.dmp	upx
behavioral2/memory/4528-654-0x00007FF764710000-0x00007FF764A64000-memory.dmp	upx
behavioral2/memory/1816-656-0x00007FF799EA0000-0x00007FF79A1F4000-memory.dmp	upx
behavioral2/memory/2264-658-0x00007FF602370000-0x00007FF6026C4000-memory.dmp	upx
behavioral2/memory/3996-659-0x00007FF739460000-0x00007FF7397B4000-memory.dmp	upx
behavioral2/memory/5024-661-0x00007FF7F9800000-0x00007FF7F9B54000-memory.dmp	upx
behavioral2/memory/4296-662-0x00007FF60EA20000-0x00007FF60ED74000-memory.dmp	upx
behavioral2/memory/5012-672-0x00007FF79C460000-0x00007FF79C7B4000-memory.dmp	upx
behavioral2/memory/1464-679-0x00007FF6A9E20000-0x00007FF6AA174000-memory.dmp	upx
behavioral2/memory/4168-685-0x00007FF715350000-0x00007FF7156A4000-memory.dmp	upx
behavioral2/memory/3404-704-0x00007FF782F70000-0x00007FF7832C4000-memory.dmp	upx
behavioral2/memory/1740-733-0x00007FF6B87A0000-0x00007FF6B8AF4000-memory.dmp	upx
behavioral2/memory/4668-735-0x00007FF7899F0000-0x00007FF789D44000-memory.dmp	upx
behavioral2/memory/220-2090-0x00007FF6732C0000-0x00007FF673614000-memory.dmp	upx
behavioral2/memory/440-2091-0x00007FF788550000-0x00007FF7888A4000-memory.dmp	upx
behavioral2/memory/3812-728-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	upx
behavioral2/memory/1328-724-0x00007FF740F70000-0x00007FF7412C4000-memory.dmp	upx
behavioral2/memory/2564-717-0x00007FF624B80000-0x00007FF624ED4000-memory.dmp	upx
behavioral2/memory/1156-714-0x00007FF75C0F0000-0x00007FF75C444000-memory.dmp	upx
behavioral2/memory/4676-709-0x00007FF7A0AD0000-0x00007FF7A0E24000-memory.dmp	upx
behavioral2/memory/1612-697-0x00007FF7AE290000-0x00007FF7AE5E4000-memory.dmp	upx
behavioral2/memory/4600-691-0x00007FF6F4CA0000-0x00007FF6F4FF4000-memory.dmp	upx
behavioral2/memory/844-675-0x00007FF7CC810000-0x00007FF7CCB64000-memory.dmp	upx
behavioral2/memory/4080-669-0x00007FF6FBD20000-0x00007FF6FC074000-memory.dmp	upx
behavioral2/memory/1016-667-0x00007FF627C30000-0x00007FF627F84000-memory.dmp	upx
behavioral2/memory/4320-660-0x00007FF6EA940000-0x00007FF6EAC94000-memory.dmp	upx
behavioral2/memory/4116-657-0x00007FF6E4750000-0x00007FF6E4AA4000-memory.dmp	upx
behavioral2/memory/4360-2092-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp	upx
behavioral2/files/0x0007000000023494-165.dat	upx
behavioral2/files/0x0007000000023495-162.dat	upx
behavioral2/files/0x0007000000023493-160.dat	upx
behavioral2/files/0x0007000000023492-155.dat	upx
behavioral2/files/0x0007000000023490-145.dat	upx
behavioral2/files/0x000700000002348f-140.dat	upx
behavioral2/files/0x000700000002348e-135.dat	upx
behavioral2/files/0x000700000002348c-125.dat	upx
behavioral2/files/0x000700000002348a-115.dat	upx
behavioral2/files/0x0007000000023489-110.dat	upx
behavioral2/files/0x0007000000023488-105.dat	upx
behavioral2/files/0x0007000000023487-100.dat	upx
behavioral2/files/0x0007000000023488-97.dat	upx
behavioral2/files/0x0007000000023486-95.dat	upx
behavioral2/files/0x0007000000023483-80.dat	upx
behavioral2/files/0x0007000000023482-75.dat	upx
behavioral2/files/0x0007000000023480-65.dat	upx
behavioral2/files/0x000700000002347f-60.dat	upx
behavioral2/files/0x0007000000023479-37.dat	upx
behavioral2/memory/4360-34-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sQbsDjY.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\eoYttKm.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\ZTmBbxR.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\NgcEuMC.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\KZmUMJq.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\sigIlxQ.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\fsCSyEX.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\qicqCkt.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\SLxBdsM.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\EZwWtrN.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\DPQbEnN.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\oyvNkHa.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\fRrIhFj.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\TMlQkop.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\vJGBNwt.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\SiujTRh.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\CCTJQng.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\cGeqeGx.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\ViNRIdv.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\LJsqxrm.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\BJIqgfp.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\ESAwDBq.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\RVcGtWg.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\XBkvvie.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\CTCVXho.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\jHnHcet.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\gYNvQiJ.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\fOmhiCL.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\FzjFIpm.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\puZxmXw.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\WnVDAfJ.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\USxBHhZ.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\rRCujwY.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\GRsdbDV.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\JCLJsBj.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\NtQtMpi.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\DIXmvOL.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\XdOAsqs.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\rrCeSkH.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\ytRulBI.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\JXlcfhR.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\yXjWXzi.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\bFlTAGJ.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\jdcOaJy.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\cqAqjjS.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\PjfJZvc.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\JMTidOV.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\RAodnEu.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\wleNBEC.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\sJIpeVK.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\guAfOKr.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\ltPrptT.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\VjNjbIz.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\QRecMme.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\mHwrqWr.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\vLAFIkZ.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\brGMjRZ.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\emHVPZH.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\pSrIXtX.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\sinqtpm.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\mmyiDQO.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\lPgVuQz.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\rVGHpiK.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
File created	C:\Windows\System\zqSzxwV.exe	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 440	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	84
PID 220 wrote to memory of 440	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	84
PID 220 wrote to memory of 2084	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	85
PID 220 wrote to memory of 2084	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	85
PID 220 wrote to memory of 1520	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	86
PID 220 wrote to memory of 1520	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	86
PID 220 wrote to memory of 1740	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	87
PID 220 wrote to memory of 1740	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	87
PID 220 wrote to memory of 4360	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	88
PID 220 wrote to memory of 4360	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	88
PID 220 wrote to memory of 4528	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	89
PID 220 wrote to memory of 4528	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	89
PID 220 wrote to memory of 4668	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	90
PID 220 wrote to memory of 4668	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	90
PID 220 wrote to memory of 3152	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	91
PID 220 wrote to memory of 3152	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	91
PID 220 wrote to memory of 1816	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	92
PID 220 wrote to memory of 1816	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	92
PID 220 wrote to memory of 4116	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	93
PID 220 wrote to memory of 4116	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	93
PID 220 wrote to memory of 2264	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	94
PID 220 wrote to memory of 2264	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	94
PID 220 wrote to memory of 3996	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	95
PID 220 wrote to memory of 3996	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	95
PID 220 wrote to memory of 4320	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	96
PID 220 wrote to memory of 4320	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	96
PID 220 wrote to memory of 5024	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	97
PID 220 wrote to memory of 5024	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	97
PID 220 wrote to memory of 4296	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	98
PID 220 wrote to memory of 4296	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	98
PID 220 wrote to memory of 1016	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	99
PID 220 wrote to memory of 1016	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	99
PID 220 wrote to memory of 4080	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	100
PID 220 wrote to memory of 4080	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	100
PID 220 wrote to memory of 5012	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	101
PID 220 wrote to memory of 5012	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	101
PID 220 wrote to memory of 844	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	102
PID 220 wrote to memory of 844	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	102
PID 220 wrote to memory of 1464	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	103
PID 220 wrote to memory of 1464	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	103
PID 220 wrote to memory of 4168	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	104
PID 220 wrote to memory of 4168	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	104
PID 220 wrote to memory of 4600	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	105
PID 220 wrote to memory of 4600	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	105
PID 220 wrote to memory of 1612	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	106
PID 220 wrote to memory of 1612	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	106
PID 220 wrote to memory of 3404	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	107
PID 220 wrote to memory of 3404	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	107
PID 220 wrote to memory of 4676	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	108
PID 220 wrote to memory of 4676	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	108
PID 220 wrote to memory of 1156	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	109
PID 220 wrote to memory of 1156	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	109
PID 220 wrote to memory of 2564	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	110
PID 220 wrote to memory of 2564	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	110
PID 220 wrote to memory of 1328	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	111
PID 220 wrote to memory of 1328	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	111
PID 220 wrote to memory of 3812	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	112
PID 220 wrote to memory of 3812	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	112
PID 220 wrote to memory of 1020	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	113
PID 220 wrote to memory of 1020	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	113
PID 220 wrote to memory of 1096	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	114
PID 220 wrote to memory of 1096	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	114
PID 220 wrote to memory of 512	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	115
PID 220 wrote to memory of 512	220	f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f820513b9c6f2547b87ad0301c4aba00_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\System\VLQvudO.exe
  C:\Windows\System\VLQvudO.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\EQcnmyx.exe
  C:\Windows\System\EQcnmyx.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\pzTGVqu.exe
  C:\Windows\System\pzTGVqu.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\ikuIzWv.exe
  C:\Windows\System\ikuIzWv.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\tmCJVnf.exe
  C:\Windows\System\tmCJVnf.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\VTxfjYR.exe
  C:\Windows\System\VTxfjYR.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\xMhxUIs.exe
  C:\Windows\System\xMhxUIs.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\fSvCnoJ.exe
  C:\Windows\System\fSvCnoJ.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\fNwgYpy.exe
  C:\Windows\System\fNwgYpy.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\eaiLVaJ.exe
  C:\Windows\System\eaiLVaJ.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\zlnWivl.exe
  C:\Windows\System\zlnWivl.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\TJgsWeB.exe
  C:\Windows\System\TJgsWeB.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\dOXpttE.exe
  C:\Windows\System\dOXpttE.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\MuWLOvT.exe
  C:\Windows\System\MuWLOvT.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\HUTVwMB.exe
  C:\Windows\System\HUTVwMB.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\RldYiIg.exe
  C:\Windows\System\RldYiIg.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\JyOPltl.exe
  C:\Windows\System\JyOPltl.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\rwLSHvD.exe
  C:\Windows\System\rwLSHvD.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\ZyfoGPx.exe
  C:\Windows\System\ZyfoGPx.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\jHnHcet.exe
  C:\Windows\System\jHnHcet.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\GQrPtNa.exe
  C:\Windows\System\GQrPtNa.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\UonNRKP.exe
  C:\Windows\System\UonNRKP.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\RjYJvEx.exe
  C:\Windows\System\RjYJvEx.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\CxpsJiH.exe
  C:\Windows\System\CxpsJiH.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\eNdgrZm.exe
  C:\Windows\System\eNdgrZm.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\ZeQMdzH.exe
  C:\Windows\System\ZeQMdzH.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ScoHXKP.exe
  C:\Windows\System\ScoHXKP.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\dDzeOZF.exe
  C:\Windows\System\dDzeOZF.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\IgcZAlt.exe
  C:\Windows\System\IgcZAlt.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\zDJmwLI.exe
  C:\Windows\System\zDJmwLI.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\UCoSZPG.exe
  C:\Windows\System\UCoSZPG.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\AvVQZDl.exe
  C:\Windows\System\AvVQZDl.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\BjprUKf.exe
  C:\Windows\System\BjprUKf.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\vCAIgow.exe
  C:\Windows\System\vCAIgow.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\IGQkWoS.exe
  C:\Windows\System\IGQkWoS.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\rjgPoyZ.exe
  C:\Windows\System\rjgPoyZ.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\lKDzbKZ.exe
  C:\Windows\System\lKDzbKZ.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\vRIzCIv.exe
  C:\Windows\System\vRIzCIv.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\KUaTMkH.exe
  C:\Windows\System\KUaTMkH.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\iStaSJp.exe
  C:\Windows\System\iStaSJp.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\jHHogXp.exe
  C:\Windows\System\jHHogXp.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\nZTGKpE.exe
  C:\Windows\System\nZTGKpE.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ughvsOl.exe
  C:\Windows\System\ughvsOl.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\ttbnWaN.exe
  C:\Windows\System\ttbnWaN.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\VMSREGW.exe
  C:\Windows\System\VMSREGW.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\vJJhJCk.exe
  C:\Windows\System\vJJhJCk.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\WpAsEjs.exe
  C:\Windows\System\WpAsEjs.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\tuyhPCE.exe
  C:\Windows\System\tuyhPCE.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\MdzyCej.exe
  C:\Windows\System\MdzyCej.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\qJqwYRE.exe
  C:\Windows\System\qJqwYRE.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\lPgVuQz.exe
  C:\Windows\System\lPgVuQz.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\XySSBnx.exe
  C:\Windows\System\XySSBnx.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\rrCeSkH.exe
  C:\Windows\System\rrCeSkH.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\cVijLpe.exe
  C:\Windows\System\cVijLpe.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\rGYuitT.exe
  C:\Windows\System\rGYuitT.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\dpMWSok.exe
  C:\Windows\System\dpMWSok.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\wIcxrBm.exe
  C:\Windows\System\wIcxrBm.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\DvTrFVw.exe
  C:\Windows\System\DvTrFVw.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\yBjkIsE.exe
  C:\Windows\System\yBjkIsE.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\hPfikPu.exe
  C:\Windows\System\hPfikPu.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\wNMHpHQ.exe
  C:\Windows\System\wNMHpHQ.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\eteAhfY.exe
  C:\Windows\System\eteAhfY.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\ghqUuZd.exe
  C:\Windows\System\ghqUuZd.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\CDUDGqs.exe
  C:\Windows\System\CDUDGqs.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\XNsuzgu.exe
  C:\Windows\System\XNsuzgu.exe
  2⤵
  PID:2864
- C:\Windows\System\HARFQEL.exe
  C:\Windows\System\HARFQEL.exe
  2⤵
  PID:3252
- C:\Windows\System\IXaygNZ.exe
  C:\Windows\System\IXaygNZ.exe
  2⤵
  PID:2216
- C:\Windows\System\wQnUtLO.exe
  C:\Windows\System\wQnUtLO.exe
  2⤵
  PID:2172
- C:\Windows\System\MWJlxeB.exe
  C:\Windows\System\MWJlxeB.exe
  2⤵
  PID:4384
- C:\Windows\System\NVZhiII.exe
  C:\Windows\System\NVZhiII.exe
  2⤵
  PID:1080
- C:\Windows\System\vyFqMQA.exe
  C:\Windows\System\vyFqMQA.exe
  2⤵
  PID:4844
- C:\Windows\System\EZwWtrN.exe
  C:\Windows\System\EZwWtrN.exe
  2⤵
  PID:2348
- C:\Windows\System\BRkrvTH.exe
  C:\Windows\System\BRkrvTH.exe
  2⤵
  PID:4912
- C:\Windows\System\PRbfrEs.exe
  C:\Windows\System\PRbfrEs.exe
  2⤵
  PID:4612
- C:\Windows\System\tvEUGeW.exe
  C:\Windows\System\tvEUGeW.exe
  2⤵
  PID:2108
- C:\Windows\System\KiPzfVK.exe
  C:\Windows\System\KiPzfVK.exe
  2⤵
  PID:1496
- C:\Windows\System\GHbGhKD.exe
  C:\Windows\System\GHbGhKD.exe
  2⤵
  PID:4556
- C:\Windows\System\zkCPegN.exe
  C:\Windows\System\zkCPegN.exe
  2⤵
  PID:2364
- C:\Windows\System\TpdzAID.exe
  C:\Windows\System\TpdzAID.exe
  2⤵
  PID:5140
- C:\Windows\System\kImgzkt.exe
  C:\Windows\System\kImgzkt.exe
  2⤵
  PID:5168
- C:\Windows\System\lQhxPKx.exe
  C:\Windows\System\lQhxPKx.exe
  2⤵
  PID:5196
- C:\Windows\System\VOrRQhJ.exe
  C:\Windows\System\VOrRQhJ.exe
  2⤵
  PID:5224
- C:\Windows\System\ISrMSNy.exe
  C:\Windows\System\ISrMSNy.exe
  2⤵
  PID:5252
- C:\Windows\System\lYFcyuW.exe
  C:\Windows\System\lYFcyuW.exe
  2⤵
  PID:5280
- C:\Windows\System\CQQTufr.exe
  C:\Windows\System\CQQTufr.exe
  2⤵
  PID:5304
- C:\Windows\System\bZKWRvy.exe
  C:\Windows\System\bZKWRvy.exe
  2⤵
  PID:5332
- C:\Windows\System\KtHCPCt.exe
  C:\Windows\System\KtHCPCt.exe
  2⤵
  PID:5364
- C:\Windows\System\ytRulBI.exe
  C:\Windows\System\ytRulBI.exe
  2⤵
  PID:5392
- C:\Windows\System\mddbUBv.exe
  C:\Windows\System\mddbUBv.exe
  2⤵
  PID:5420
- C:\Windows\System\SbCOqub.exe
  C:\Windows\System\SbCOqub.exe
  2⤵
  PID:5448
- C:\Windows\System\gYNvQiJ.exe
  C:\Windows\System\gYNvQiJ.exe
  2⤵
  PID:5476
- C:\Windows\System\TbWlbmC.exe
  C:\Windows\System\TbWlbmC.exe
  2⤵
  PID:5504
- C:\Windows\System\gSgkKiM.exe
  C:\Windows\System\gSgkKiM.exe
  2⤵
  PID:5528
- C:\Windows\System\ExNHDfH.exe
  C:\Windows\System\ExNHDfH.exe
  2⤵
  PID:5556
- C:\Windows\System\BDRMfYT.exe
  C:\Windows\System\BDRMfYT.exe
  2⤵
  PID:5584
- C:\Windows\System\IbItDzN.exe
  C:\Windows\System\IbItDzN.exe
  2⤵
  PID:5612
- C:\Windows\System\VZxHGnc.exe
  C:\Windows\System\VZxHGnc.exe
  2⤵
  PID:5644
- C:\Windows\System\xPlOJQt.exe
  C:\Windows\System\xPlOJQt.exe
  2⤵
  PID:5672
- C:\Windows\System\NTvFASD.exe
  C:\Windows\System\NTvFASD.exe
  2⤵
  PID:5700
- C:\Windows\System\izlbIwh.exe
  C:\Windows\System\izlbIwh.exe
  2⤵
  PID:5728
- C:\Windows\System\ANojXBD.exe
  C:\Windows\System\ANojXBD.exe
  2⤵
  PID:5752
- C:\Windows\System\lHMSjQD.exe
  C:\Windows\System\lHMSjQD.exe
  2⤵
  PID:5784
- C:\Windows\System\LJsqxrm.exe
  C:\Windows\System\LJsqxrm.exe
  2⤵
  PID:5812
- C:\Windows\System\imzETKH.exe
  C:\Windows\System\imzETKH.exe
  2⤵
  PID:5840
- C:\Windows\System\cphxfQR.exe
  C:\Windows\System\cphxfQR.exe
  2⤵
  PID:5864
- C:\Windows\System\RqDWNPH.exe
  C:\Windows\System\RqDWNPH.exe
  2⤵
  PID:5892
- C:\Windows\System\sJIpeVK.exe
  C:\Windows\System\sJIpeVK.exe
  2⤵
  PID:5924
- C:\Windows\System\scAIADR.exe
  C:\Windows\System\scAIADR.exe
  2⤵
  PID:5952
- C:\Windows\System\pSrIXtX.exe
  C:\Windows\System\pSrIXtX.exe
  2⤵
  PID:5976
- C:\Windows\System\tSOMVmm.exe
  C:\Windows\System\tSOMVmm.exe
  2⤵
  PID:6008
- C:\Windows\System\HyGLfsm.exe
  C:\Windows\System\HyGLfsm.exe
  2⤵
  PID:6036
- C:\Windows\System\ggylWjV.exe
  C:\Windows\System\ggylWjV.exe
  2⤵
  PID:6060
- C:\Windows\System\lKORXgz.exe
  C:\Windows\System\lKORXgz.exe
  2⤵
  PID:6088
- C:\Windows\System\eMbRkGw.exe
  C:\Windows\System\eMbRkGw.exe
  2⤵
  PID:6116
- C:\Windows\System\KTGWdQe.exe
  C:\Windows\System\KTGWdQe.exe
  2⤵
  PID:4576
- C:\Windows\System\SrwDWgb.exe
  C:\Windows\System\SrwDWgb.exe
  2⤵
  PID:4644
- C:\Windows\System\HXOyMuL.exe
  C:\Windows\System\HXOyMuL.exe
  2⤵
  PID:2668
- C:\Windows\System\gSFlXfC.exe
  C:\Windows\System\gSFlXfC.exe
  2⤵
  PID:2372
- C:\Windows\System\PrSCqeC.exe
  C:\Windows\System\PrSCqeC.exe
  2⤵
  PID:1356
- C:\Windows\System\LaVOmlm.exe
  C:\Windows\System\LaVOmlm.exe
  2⤵
  PID:3144
- C:\Windows\System\sinqtpm.exe
  C:\Windows\System\sinqtpm.exe
  2⤵
  PID:2968
- C:\Windows\System\MLHFIoz.exe
  C:\Windows\System\MLHFIoz.exe
  2⤵
  PID:5160
- C:\Windows\System\UNbpSkS.exe
  C:\Windows\System\UNbpSkS.exe
  2⤵
  PID:5236
- C:\Windows\System\iCMwBDy.exe
  C:\Windows\System\iCMwBDy.exe
  2⤵
  PID:5296
- C:\Windows\System\CRsrHaJ.exe
  C:\Windows\System\CRsrHaJ.exe
  2⤵
  PID:5356
- C:\Windows\System\bpUHQCi.exe
  C:\Windows\System\bpUHQCi.exe
  2⤵
  PID:5432
- C:\Windows\System\PaLyGkr.exe
  C:\Windows\System\PaLyGkr.exe
  2⤵
  PID:5492
- C:\Windows\System\ryWAGtb.exe
  C:\Windows\System\ryWAGtb.exe
  2⤵
  PID:5572
- C:\Windows\System\UDYzkeo.exe
  C:\Windows\System\UDYzkeo.exe
  2⤵
  PID:5632
- C:\Windows\System\YeUZkbx.exe
  C:\Windows\System\YeUZkbx.exe
  2⤵
  PID:5688
- C:\Windows\System\EtrdaNI.exe
  C:\Windows\System\EtrdaNI.exe
  2⤵
  PID:5748
- C:\Windows\System\lEckQSb.exe
  C:\Windows\System\lEckQSb.exe
  2⤵
  PID:5828
- C:\Windows\System\UYtYWpO.exe
  C:\Windows\System\UYtYWpO.exe
  2⤵
  PID:5884
- C:\Windows\System\gPNMRph.exe
  C:\Windows\System\gPNMRph.exe
  2⤵
  PID:5964
- C:\Windows\System\IgwrplF.exe
  C:\Windows\System\IgwrplF.exe
  2⤵
  PID:6024
- C:\Windows\System\emfFhKh.exe
  C:\Windows\System\emfFhKh.exe
  2⤵
  PID:6084
- C:\Windows\System\NcdTpDi.exe
  C:\Windows\System\NcdTpDi.exe
  2⤵
  PID:1812
- C:\Windows\System\lyqCTiK.exe
  C:\Windows\System\lyqCTiK.exe
  2⤵
  PID:1400
- C:\Windows\System\oPeKJZb.exe
  C:\Windows\System\oPeKJZb.exe
  2⤵
  PID:4224
- C:\Windows\System\hPGThil.exe
  C:\Windows\System\hPGThil.exe
  2⤵
  PID:5152
- C:\Windows\System\cqAqjjS.exe
  C:\Windows\System\cqAqjjS.exe
  2⤵
  PID:5292
- C:\Windows\System\VqFtSHB.exe
  C:\Windows\System\VqFtSHB.exe
  2⤵
  PID:5464
- C:\Windows\System\dzbHFOS.exe
  C:\Windows\System\dzbHFOS.exe
  2⤵
  PID:5604
- C:\Windows\System\HBZXjxp.exe
  C:\Windows\System\HBZXjxp.exe
  2⤵
  PID:5744
- C:\Windows\System\HJYlWJq.exe
  C:\Windows\System\HJYlWJq.exe
  2⤵
  PID:5936
- C:\Windows\System\TxMHjEH.exe
  C:\Windows\System\TxMHjEH.exe
  2⤵
  PID:6056
- C:\Windows\System\EXNnIjv.exe
  C:\Windows\System\EXNnIjv.exe
  2⤵
  PID:4588
- C:\Windows\System\iVfyhUg.exe
  C:\Windows\System\iVfyhUg.exe
  2⤵
  PID:5268
- C:\Windows\System\XHzLKFU.exe
  C:\Windows\System\XHzLKFU.exe
  2⤵
  PID:1012
- C:\Windows\System\fmpdvCm.exe
  C:\Windows\System\fmpdvCm.exe
  2⤵
  PID:6176
- C:\Windows\System\dDXEbfK.exe
  C:\Windows\System\dDXEbfK.exe
  2⤵
  PID:6204
- C:\Windows\System\SscHssn.exe
  C:\Windows\System\SscHssn.exe
  2⤵
  PID:6232
- C:\Windows\System\CYZPqEC.exe
  C:\Windows\System\CYZPqEC.exe
  2⤵
  PID:6260
- C:\Windows\System\HPZImla.exe
  C:\Windows\System\HPZImla.exe
  2⤵
  PID:6284
- C:\Windows\System\mHwrqWr.exe
  C:\Windows\System\mHwrqWr.exe
  2⤵
  PID:6312
- C:\Windows\System\MAIxIqG.exe
  C:\Windows\System\MAIxIqG.exe
  2⤵
  PID:6344
- C:\Windows\System\IOlaTvr.exe
  C:\Windows\System\IOlaTvr.exe
  2⤵
  PID:6372
- C:\Windows\System\VjAFisP.exe
  C:\Windows\System\VjAFisP.exe
  2⤵
  PID:6396
- C:\Windows\System\NPmaWQy.exe
  C:\Windows\System\NPmaWQy.exe
  2⤵
  PID:6428
- C:\Windows\System\psKVdOc.exe
  C:\Windows\System\psKVdOc.exe
  2⤵
  PID:6452
- C:\Windows\System\TjVUuxL.exe
  C:\Windows\System\TjVUuxL.exe
  2⤵
  PID:6484
- C:\Windows\System\sigIlxQ.exe
  C:\Windows\System\sigIlxQ.exe
  2⤵
  PID:6508
- C:\Windows\System\HqFmRkE.exe
  C:\Windows\System\HqFmRkE.exe
  2⤵
  PID:6540
- C:\Windows\System\FvdARwD.exe
  C:\Windows\System\FvdARwD.exe
  2⤵
  PID:6564
- C:\Windows\System\AiYJOEk.exe
  C:\Windows\System\AiYJOEk.exe
  2⤵
  PID:6592
- C:\Windows\System\BJIqgfp.exe
  C:\Windows\System\BJIqgfp.exe
  2⤵
  PID:6624
- C:\Windows\System\sBdOGQG.exe
  C:\Windows\System\sBdOGQG.exe
  2⤵
  PID:6648
- C:\Windows\System\qMbducA.exe
  C:\Windows\System\qMbducA.exe
  2⤵
  PID:6680
- C:\Windows\System\YyrEOLq.exe
  C:\Windows\System\YyrEOLq.exe
  2⤵
  PID:6704
- C:\Windows\System\ESAwDBq.exe
  C:\Windows\System\ESAwDBq.exe
  2⤵
  PID:6732
- C:\Windows\System\fsCSyEX.exe
  C:\Windows\System\fsCSyEX.exe
  2⤵
  PID:6764
- C:\Windows\System\FTpnvHm.exe
  C:\Windows\System\FTpnvHm.exe
  2⤵
  PID:6792
- C:\Windows\System\NydRtEE.exe
  C:\Windows\System\NydRtEE.exe
  2⤵
  PID:6820
- C:\Windows\System\KenJRhZ.exe
  C:\Windows\System\KenJRhZ.exe
  2⤵
  PID:6848
- C:\Windows\System\ugIvCjD.exe
  C:\Windows\System\ugIvCjD.exe
  2⤵
  PID:6876
- C:\Windows\System\sQbsDjY.exe
  C:\Windows\System\sQbsDjY.exe
  2⤵
  PID:6900
- C:\Windows\System\JDJZdop.exe
  C:\Windows\System\JDJZdop.exe
  2⤵
  PID:6928
- C:\Windows\System\bVWpKPY.exe
  C:\Windows\System\bVWpKPY.exe
  2⤵
  PID:6956
- C:\Windows\System\EGgWebU.exe
  C:\Windows\System\EGgWebU.exe
  2⤵
  PID:6988
- C:\Windows\System\cEVSXXu.exe
  C:\Windows\System\cEVSXXu.exe
  2⤵
  PID:7016
- C:\Windows\System\owUNxww.exe
  C:\Windows\System\owUNxww.exe
  2⤵
  PID:7048
- C:\Windows\System\CKIZiTX.exe
  C:\Windows\System\CKIZiTX.exe
  2⤵
  PID:7072
- C:\Windows\System\ODnyudS.exe
  C:\Windows\System\ODnyudS.exe
  2⤵
  PID:7100
- C:\Windows\System\WOQQsmg.exe
  C:\Windows\System\WOQQsmg.exe
  2⤵
  PID:7128
- C:\Windows\System\urBZfGE.exe
  C:\Windows\System\urBZfGE.exe
  2⤵
  PID:7152
- C:\Windows\System\eChzlgT.exe
  C:\Windows\System\eChzlgT.exe
  2⤵
  PID:5740
- C:\Windows\System\ueRwiJA.exe
  C:\Windows\System\ueRwiJA.exe
  2⤵
  PID:6132
- C:\Windows\System\upcayuE.exe
  C:\Windows\System\upcayuE.exe
  2⤵
  PID:5412
- C:\Windows\System\Mfazzxe.exe
  C:\Windows\System\Mfazzxe.exe
  2⤵
  PID:6200
- C:\Windows\System\nNdAASq.exe
  C:\Windows\System\nNdAASq.exe
  2⤵
  PID:6252
- C:\Windows\System\AXfxrVb.exe
  C:\Windows\System\AXfxrVb.exe
  2⤵
  PID:6328
- C:\Windows\System\EaebEBK.exe
  C:\Windows\System\EaebEBK.exe
  2⤵
  PID:6364
- C:\Windows\System\fVootdA.exe
  C:\Windows\System\fVootdA.exe
  2⤵
  PID:6440
- C:\Windows\System\JfgRbGX.exe
  C:\Windows\System\JfgRbGX.exe
  2⤵
  PID:1472
- C:\Windows\System\EZtjatK.exe
  C:\Windows\System\EZtjatK.exe
  2⤵
  PID:6552
- C:\Windows\System\dIFKsze.exe
  C:\Windows\System\dIFKsze.exe
  2⤵
  PID:3544
- C:\Windows\System\csEijgU.exe
  C:\Windows\System\csEijgU.exe
  2⤵
  PID:6920
- C:\Windows\System\ONVdNNL.exe
  C:\Windows\System\ONVdNNL.exe
  2⤵
  PID:7032
- C:\Windows\System\LTvanFA.exe
  C:\Windows\System\LTvanFA.exe
  2⤵
  PID:7084
- C:\Windows\System\NtLXAeN.exe
  C:\Windows\System\NtLXAeN.exe
  2⤵
  PID:3924
- C:\Windows\System\AgkoNJy.exe
  C:\Windows\System\AgkoNJy.exe
  2⤵
  PID:4868
- C:\Windows\System\gdOAKxt.exe
  C:\Windows\System\gdOAKxt.exe
  2⤵
  PID:5684
- C:\Windows\System\rRCujwY.exe
  C:\Windows\System\rRCujwY.exe
  2⤵
  PID:5132
- C:\Windows\System\JEAMQlt.exe
  C:\Windows\System\JEAMQlt.exe
  2⤵
  PID:6224
- C:\Windows\System\vLAFIkZ.exe
  C:\Windows\System\vLAFIkZ.exe
  2⤵
  PID:6304
- C:\Windows\System\NUsAPMH.exe
  C:\Windows\System\NUsAPMH.exe
  2⤵
  PID:6468
- C:\Windows\System\ClUTCPP.exe
  C:\Windows\System\ClUTCPP.exe
  2⤵
  PID:6636
- C:\Windows\System\fYliJtY.exe
  C:\Windows\System\fYliJtY.exe
  2⤵
  PID:6892
- C:\Windows\System\cGeqeGx.exe
  C:\Windows\System\cGeqeGx.exe
  2⤵
  PID:4596
- C:\Windows\System\WboRoOB.exe
  C:\Windows\System\WboRoOB.exe
  2⤵
  PID:2400
- C:\Windows\System\cHcpZpf.exe
  C:\Windows\System\cHcpZpf.exe
  2⤵
  PID:3344
- C:\Windows\System\BzAKRpc.exe
  C:\Windows\System\BzAKRpc.exe
  2⤵
  PID:3008
- C:\Windows\System\YrYWAnc.exe
  C:\Windows\System\YrYWAnc.exe
  2⤵
  PID:964
- C:\Windows\System\PjfJZvc.exe
  C:\Windows\System\PjfJZvc.exe
  2⤵
  PID:7096
- C:\Windows\System\HqeMHdR.exe
  C:\Windows\System\HqeMHdR.exe
  2⤵
  PID:1476
- C:\Windows\System\zUvzBQT.exe
  C:\Windows\System\zUvzBQT.exe
  2⤵
  PID:2980
- C:\Windows\System\nsVIZAD.exe
  C:\Windows\System\nsVIZAD.exe
  2⤵
  PID:1244
- C:\Windows\System\hkyxBlZ.exe
  C:\Windows\System\hkyxBlZ.exe
  2⤵
  PID:636
- C:\Windows\System\czNCUTp.exe
  C:\Windows\System\czNCUTp.exe
  2⤵
  PID:6360
- C:\Windows\System\jOqCWfL.exe
  C:\Windows\System\jOqCWfL.exe
  2⤵
  PID:7000
- C:\Windows\System\QlPDjQN.exe
  C:\Windows\System\QlPDjQN.exe
  2⤵
  PID:7064
- C:\Windows\System\khOAWUK.exe
  C:\Windows\System\khOAWUK.exe
  2⤵
  PID:7176
- C:\Windows\System\MYSGeqT.exe
  C:\Windows\System\MYSGeqT.exe
  2⤵
  PID:7196
- C:\Windows\System\eoYttKm.exe
  C:\Windows\System\eoYttKm.exe
  2⤵
  PID:7212
- C:\Windows\System\QiEDqSr.exe
  C:\Windows\System\QiEDqSr.exe
  2⤵
  PID:7228
- C:\Windows\System\XIRlndw.exe
  C:\Windows\System\XIRlndw.exe
  2⤵
  PID:7252
- C:\Windows\System\SAwSMOs.exe
  C:\Windows\System\SAwSMOs.exe
  2⤵
  PID:7268
- C:\Windows\System\WLSbjyS.exe
  C:\Windows\System\WLSbjyS.exe
  2⤵
  PID:7284
- C:\Windows\System\AxZzojh.exe
  C:\Windows\System\AxZzojh.exe
  2⤵
  PID:7388
- C:\Windows\System\gfozTcQ.exe
  C:\Windows\System\gfozTcQ.exe
  2⤵
  PID:7420
- C:\Windows\System\yyyogPr.exe
  C:\Windows\System\yyyogPr.exe
  2⤵
  PID:7444
- C:\Windows\System\XkIQIdi.exe
  C:\Windows\System\XkIQIdi.exe
  2⤵
  PID:7476
- C:\Windows\System\GgxXOwt.exe
  C:\Windows\System\GgxXOwt.exe
  2⤵
  PID:7508
- C:\Windows\System\zssmoIw.exe
  C:\Windows\System\zssmoIw.exe
  2⤵
  PID:7548
- C:\Windows\System\DJxmBzH.exe
  C:\Windows\System\DJxmBzH.exe
  2⤵
  PID:7576
- C:\Windows\System\BSRSWdy.exe
  C:\Windows\System\BSRSWdy.exe
  2⤵
  PID:7604
- C:\Windows\System\OMVmVAI.exe
  C:\Windows\System\OMVmVAI.exe
  2⤵
  PID:7620
- C:\Windows\System\muEmOZV.exe
  C:\Windows\System\muEmOZV.exe
  2⤵
  PID:7660
- C:\Windows\System\hGNYiVp.exe
  C:\Windows\System\hGNYiVp.exe
  2⤵
  PID:7688
- C:\Windows\System\hWXWqYo.exe
  C:\Windows\System\hWXWqYo.exe
  2⤵
  PID:7716
- C:\Windows\System\DlwbHeV.exe
  C:\Windows\System\DlwbHeV.exe
  2⤵
  PID:7748
- C:\Windows\System\RwCbfHT.exe
  C:\Windows\System\RwCbfHT.exe
  2⤵
  PID:7772
- C:\Windows\System\LqlOjoD.exe
  C:\Windows\System\LqlOjoD.exe
  2⤵
  PID:7800
- C:\Windows\System\pSvSthi.exe
  C:\Windows\System\pSvSthi.exe
  2⤵
  PID:7836
- C:\Windows\System\yUHAlCk.exe
  C:\Windows\System\yUHAlCk.exe
  2⤵
  PID:7864
- C:\Windows\System\nnapnWp.exe
  C:\Windows\System\nnapnWp.exe
  2⤵
  PID:7892
- C:\Windows\System\jwckfnM.exe
  C:\Windows\System\jwckfnM.exe
  2⤵
  PID:7920
- C:\Windows\System\ZbFuokl.exe
  C:\Windows\System\ZbFuokl.exe
  2⤵
  PID:7952
- C:\Windows\System\bpqNqKH.exe
  C:\Windows\System\bpqNqKH.exe
  2⤵
  PID:7980
- C:\Windows\System\gWhnRXW.exe
  C:\Windows\System\gWhnRXW.exe
  2⤵
  PID:7996
- C:\Windows\System\NuAvQFh.exe
  C:\Windows\System\NuAvQFh.exe
  2⤵
  PID:8032
- C:\Windows\System\RVcGtWg.exe
  C:\Windows\System\RVcGtWg.exe
  2⤵
  PID:8072
- C:\Windows\System\PiNJqRy.exe
  C:\Windows\System\PiNJqRy.exe
  2⤵
  PID:8108
- C:\Windows\System\ViNRIdv.exe
  C:\Windows\System\ViNRIdv.exe
  2⤵
  PID:4476
- C:\Windows\System\MPjVRgA.exe
  C:\Windows\System\MPjVRgA.exe
  2⤵
  PID:7248
- C:\Windows\System\NVQGilV.exe
  C:\Windows\System\NVQGilV.exe
  2⤵
  PID:6588
- C:\Windows\System\lUXnjjJ.exe
  C:\Windows\System\lUXnjjJ.exe
  2⤵
  PID:7368
- C:\Windows\System\yJtndYE.exe
  C:\Windows\System\yJtndYE.exe
  2⤵
  PID:7324
- C:\Windows\System\VPNxtyA.exe
  C:\Windows\System\VPNxtyA.exe
  2⤵
  PID:7472
- C:\Windows\System\rhZqkiW.exe
  C:\Windows\System\rhZqkiW.exe
  2⤵
  PID:1960
- C:\Windows\System\xiXryPF.exe
  C:\Windows\System\xiXryPF.exe
  2⤵
  PID:7588
- C:\Windows\System\vLYTeLf.exe
  C:\Windows\System\vLYTeLf.exe
  2⤵
  PID:7684
- C:\Windows\System\xJOTVvo.exe
  C:\Windows\System\xJOTVvo.exe
  2⤵
  PID:7784
- C:\Windows\System\VCdBpZA.exe
  C:\Windows\System\VCdBpZA.exe
  2⤵
  PID:7856
- C:\Windows\System\qjMexZI.exe
  C:\Windows\System\qjMexZI.exe
  2⤵
  PID:2604
- C:\Windows\System\gOsqQDD.exe
  C:\Windows\System\gOsqQDD.exe
  2⤵
  PID:7916
- C:\Windows\System\fpYNowY.exe
  C:\Windows\System\fpYNowY.exe
  2⤵
  PID:7992
- C:\Windows\System\VdWSsuf.exe
  C:\Windows\System\VdWSsuf.exe
  2⤵
  PID:8084
- C:\Windows\System\aWkPYav.exe
  C:\Windows\System\aWkPYav.exe
  2⤵
  PID:8188
- C:\Windows\System\xPrcQPD.exe
  C:\Windows\System\xPrcQPD.exe
  2⤵
  PID:7280
- C:\Windows\System\KrRlAxO.exe
  C:\Windows\System\KrRlAxO.exe
  2⤵
  PID:4664
- C:\Windows\System\gxbriyI.exe
  C:\Windows\System\gxbriyI.exe
  2⤵
  PID:7640
- C:\Windows\System\IIBIaNS.exe
  C:\Windows\System\IIBIaNS.exe
  2⤵
  PID:7832
- C:\Windows\System\yURhRhi.exe
  C:\Windows\System\yURhRhi.exe
  2⤵
  PID:7976
- C:\Windows\System\NJhCEPz.exe
  C:\Windows\System\NJhCEPz.exe
  2⤵
  PID:7192
- C:\Windows\System\boBSNUh.exe
  C:\Windows\System\boBSNUh.exe
  2⤵
  PID:7760
- C:\Windows\System\GSiDotA.exe
  C:\Windows\System\GSiDotA.exe
  2⤵
  PID:8144
- C:\Windows\System\FkSegCX.exe
  C:\Windows\System\FkSegCX.exe
  2⤵
  PID:7452
- C:\Windows\System\wQZctqC.exe
  C:\Windows\System\wQZctqC.exe
  2⤵
  PID:8116
- C:\Windows\System\JntKFLq.exe
  C:\Windows\System\JntKFLq.exe
  2⤵
  PID:8196
- C:\Windows\System\DPQbEnN.exe
  C:\Windows\System\DPQbEnN.exe
  2⤵
  PID:8224
- C:\Windows\System\QEdtCkU.exe
  C:\Windows\System\QEdtCkU.exe
  2⤵
  PID:8252
- C:\Windows\System\oyvNkHa.exe
  C:\Windows\System\oyvNkHa.exe
  2⤵
  PID:8280
- C:\Windows\System\BbwxNPZ.exe
  C:\Windows\System\BbwxNPZ.exe
  2⤵
  PID:8316
- C:\Windows\System\lKTrReP.exe
  C:\Windows\System\lKTrReP.exe
  2⤵
  PID:8352
- C:\Windows\System\qfBcjGG.exe
  C:\Windows\System\qfBcjGG.exe
  2⤵
  PID:8380
- C:\Windows\System\BJufWKl.exe
  C:\Windows\System\BJufWKl.exe
  2⤵
  PID:8412
- C:\Windows\System\IppDPyZ.exe
  C:\Windows\System\IppDPyZ.exe
  2⤵
  PID:8440
- C:\Windows\System\fonmKdm.exe
  C:\Windows\System\fonmKdm.exe
  2⤵
  PID:8468
- C:\Windows\System\voEyAuj.exe
  C:\Windows\System\voEyAuj.exe
  2⤵
  PID:8496
- C:\Windows\System\FnMwXsU.exe
  C:\Windows\System\FnMwXsU.exe
  2⤵
  PID:8524
- C:\Windows\System\WAKzuab.exe
  C:\Windows\System\WAKzuab.exe
  2⤵
  PID:8556
- C:\Windows\System\VjLfhqu.exe
  C:\Windows\System\VjLfhqu.exe
  2⤵
  PID:8572
- C:\Windows\System\GpfRmLV.exe
  C:\Windows\System\GpfRmLV.exe
  2⤵
  PID:8588
- C:\Windows\System\zifvSYW.exe
  C:\Windows\System\zifvSYW.exe
  2⤵
  PID:8640
- C:\Windows\System\xLnrFzP.exe
  C:\Windows\System\xLnrFzP.exe
  2⤵
  PID:8656
- C:\Windows\System\bmecKUp.exe
  C:\Windows\System\bmecKUp.exe
  2⤵
  PID:8700
- C:\Windows\System\XBkvvie.exe
  C:\Windows\System\XBkvvie.exe
  2⤵
  PID:8728
- C:\Windows\System\rQlAPDv.exe
  C:\Windows\System\rQlAPDv.exe
  2⤵
  PID:8756
- C:\Windows\System\YxozeyG.exe
  C:\Windows\System\YxozeyG.exe
  2⤵
  PID:8784
- C:\Windows\System\HkyiMjQ.exe
  C:\Windows\System\HkyiMjQ.exe
  2⤵
  PID:8812
- C:\Windows\System\dKUBYDc.exe
  C:\Windows\System\dKUBYDc.exe
  2⤵
  PID:8840
- C:\Windows\System\JwWKyYU.exe
  C:\Windows\System\JwWKyYU.exe
  2⤵
  PID:8856
- C:\Windows\System\eyDfxFf.exe
  C:\Windows\System\eyDfxFf.exe
  2⤵
  PID:8896
- C:\Windows\System\cuiRFzj.exe
  C:\Windows\System\cuiRFzj.exe
  2⤵
  PID:8924
- C:\Windows\System\LqkJaIq.exe
  C:\Windows\System\LqkJaIq.exe
  2⤵
  PID:8952
- C:\Windows\System\eFbQhYY.exe
  C:\Windows\System\eFbQhYY.exe
  2⤵
  PID:8980
- C:\Windows\System\sTATUtR.exe
  C:\Windows\System\sTATUtR.exe
  2⤵
  PID:9008
- C:\Windows\System\sewhTQg.exe
  C:\Windows\System\sewhTQg.exe
  2⤵
  PID:9036
- C:\Windows\System\eREPoqq.exe
  C:\Windows\System\eREPoqq.exe
  2⤵
  PID:9052
- C:\Windows\System\LQkzVnf.exe
  C:\Windows\System\LQkzVnf.exe
  2⤵
  PID:9068
- C:\Windows\System\VnHDQtK.exe
  C:\Windows\System\VnHDQtK.exe
  2⤵
  PID:9092
- C:\Windows\System\LrHWOEA.exe
  C:\Windows\System\LrHWOEA.exe
  2⤵
  PID:9136
- C:\Windows\System\vhazMXJ.exe
  C:\Windows\System\vhazMXJ.exe
  2⤵
  PID:9168
- C:\Windows\System\wIVImZW.exe
  C:\Windows\System\wIVImZW.exe
  2⤵
  PID:9208
- C:\Windows\System\fEnnHBR.exe
  C:\Windows\System\fEnnHBR.exe
  2⤵
  PID:8236
- C:\Windows\System\joibwYe.exe
  C:\Windows\System\joibwYe.exe
  2⤵
  PID:8308
- C:\Windows\System\mONUNSq.exe
  C:\Windows\System\mONUNSq.exe
  2⤵
  PID:8328
- C:\Windows\System\jorLcFL.exe
  C:\Windows\System\jorLcFL.exe
  2⤵
  PID:8436
- C:\Windows\System\fRrIhFj.exe
  C:\Windows\System\fRrIhFj.exe
  2⤵
  PID:8508
- C:\Windows\System\KemTCLg.exe
  C:\Windows\System\KemTCLg.exe
  2⤵
  PID:8548
- C:\Windows\System\Bqwxxvl.exe
  C:\Windows\System\Bqwxxvl.exe
  2⤵
  PID:8580
- C:\Windows\System\eXKJCKe.exe
  C:\Windows\System\eXKJCKe.exe
  2⤵
  PID:8648
- C:\Windows\System\kRIGJTv.exe
  C:\Windows\System\kRIGJTv.exe
  2⤵
  PID:8724
- C:\Windows\System\WnVDAfJ.exe
  C:\Windows\System\WnVDAfJ.exe
  2⤵
  PID:8776
- C:\Windows\System\OJXVTzx.exe
  C:\Windows\System\OJXVTzx.exe
  2⤵
  PID:8832
- C:\Windows\System\eAhoAgG.exe
  C:\Windows\System\eAhoAgG.exe
  2⤵
  PID:8948
- C:\Windows\System\xtdBlZn.exe
  C:\Windows\System\xtdBlZn.exe
  2⤵
  PID:9020
- C:\Windows\System\OHPtKcX.exe
  C:\Windows\System\OHPtKcX.exe
  2⤵
  PID:9084
- C:\Windows\System\IdIaUiM.exe
  C:\Windows\System\IdIaUiM.exe
  2⤵
  PID:9200
- C:\Windows\System\onHgzTM.exe
  C:\Windows\System\onHgzTM.exe
  2⤵
  PID:8364
- C:\Windows\System\zeDhoNj.exe
  C:\Windows\System\zeDhoNj.exe
  2⤵
  PID:8772
- C:\Windows\System\BvjRyPN.exe
  C:\Windows\System\BvjRyPN.exe
  2⤵
  PID:8804
- C:\Windows\System\CxdhyBw.exe
  C:\Windows\System\CxdhyBw.exe
  2⤵
  PID:8976
- C:\Windows\System\QlKHLmS.exe
  C:\Windows\System\QlKHLmS.exe
  2⤵
  PID:9116
- C:\Windows\System\lZHsKLj.exe
  C:\Windows\System\lZHsKLj.exe
  2⤵
  PID:8212
- C:\Windows\System\aJqznDU.exe
  C:\Windows\System\aJqznDU.exe
  2⤵
  PID:8808
- C:\Windows\System\bioNksz.exe
  C:\Windows\System\bioNksz.exe
  2⤵
  PID:8920
- C:\Windows\System\uIEeeZv.exe
  C:\Windows\System\uIEeeZv.exe
  2⤵
  PID:8536
- C:\Windows\System\QSCgykx.exe
  C:\Windows\System\QSCgykx.exe
  2⤵
  PID:9236
- C:\Windows\System\AnGBkIn.exe
  C:\Windows\System\AnGBkIn.exe
  2⤵
  PID:9264
- C:\Windows\System\atncfkU.exe
  C:\Windows\System\atncfkU.exe
  2⤵
  PID:9292
- C:\Windows\System\XnfCDdE.exe
  C:\Windows\System\XnfCDdE.exe
  2⤵
  PID:9320
- C:\Windows\System\XYsgofF.exe
  C:\Windows\System\XYsgofF.exe
  2⤵
  PID:9348
- C:\Windows\System\KLvuwUJ.exe
  C:\Windows\System\KLvuwUJ.exe
  2⤵
  PID:9380
- C:\Windows\System\nCFwuAX.exe
  C:\Windows\System\nCFwuAX.exe
  2⤵
  PID:9408
- C:\Windows\System\vHCCiED.exe
  C:\Windows\System\vHCCiED.exe
  2⤵
  PID:9436
- C:\Windows\System\uEeUoZR.exe
  C:\Windows\System\uEeUoZR.exe
  2⤵
  PID:9464
- C:\Windows\System\TdtyWLJ.exe
  C:\Windows\System\TdtyWLJ.exe
  2⤵
  PID:9492
- C:\Windows\System\CCnCouX.exe
  C:\Windows\System\CCnCouX.exe
  2⤵
  PID:9520
- C:\Windows\System\ZumxfxZ.exe
  C:\Windows\System\ZumxfxZ.exe
  2⤵
  PID:9548
- C:\Windows\System\jxTEUia.exe
  C:\Windows\System\jxTEUia.exe
  2⤵
  PID:9576
- C:\Windows\System\hzGmrGN.exe
  C:\Windows\System\hzGmrGN.exe
  2⤵
  PID:9600
- C:\Windows\System\oNAdkXm.exe
  C:\Windows\System\oNAdkXm.exe
  2⤵
  PID:9628
- C:\Windows\System\gkGCXir.exe
  C:\Windows\System\gkGCXir.exe
  2⤵
  PID:9648
- C:\Windows\System\gtBzNUq.exe
  C:\Windows\System\gtBzNUq.exe
  2⤵
  PID:9676
- C:\Windows\System\HCkLUZW.exe
  C:\Windows\System\HCkLUZW.exe
  2⤵
  PID:9704
- C:\Windows\System\WjZMJwA.exe
  C:\Windows\System\WjZMJwA.exe
  2⤵
  PID:9744
- C:\Windows\System\LffOBXH.exe
  C:\Windows\System\LffOBXH.exe
  2⤵
  PID:9772
- C:\Windows\System\TzPRAIn.exe
  C:\Windows\System\TzPRAIn.exe
  2⤵
  PID:9800
- C:\Windows\System\PoniXBA.exe
  C:\Windows\System\PoniXBA.exe
  2⤵
  PID:9828
- C:\Windows\System\rTnHgpP.exe
  C:\Windows\System\rTnHgpP.exe
  2⤵
  PID:9856
- C:\Windows\System\UOfPnmX.exe
  C:\Windows\System\UOfPnmX.exe
  2⤵
  PID:9884
- C:\Windows\System\ltbIeAZ.exe
  C:\Windows\System\ltbIeAZ.exe
  2⤵
  PID:9912
- C:\Windows\System\xLJxCTI.exe
  C:\Windows\System\xLJxCTI.exe
  2⤵
  PID:9940
- C:\Windows\System\SPQVuMY.exe
  C:\Windows\System\SPQVuMY.exe
  2⤵
  PID:9968
- C:\Windows\System\BSKVvCB.exe
  C:\Windows\System\BSKVvCB.exe
  2⤵
  PID:9996
- C:\Windows\System\rVGHpiK.exe
  C:\Windows\System\rVGHpiK.exe
  2⤵
  PID:10024
- C:\Windows\System\cADBBha.exe
  C:\Windows\System\cADBBha.exe
  2⤵
  PID:10040
- C:\Windows\System\mRDfwNA.exe
  C:\Windows\System\mRDfwNA.exe
  2⤵
  PID:10072
- C:\Windows\System\mmyiDQO.exe
  C:\Windows\System\mmyiDQO.exe
  2⤵
  PID:10108
- C:\Windows\System\GRsdbDV.exe
  C:\Windows\System\GRsdbDV.exe
  2⤵
  PID:10136
- C:\Windows\System\PezmEbn.exe
  C:\Windows\System\PezmEbn.exe
  2⤵
  PID:10180
- C:\Windows\System\QeydNYX.exe
  C:\Windows\System\QeydNYX.exe
  2⤵
  PID:10196
- C:\Windows\System\RFwPzEN.exe
  C:\Windows\System\RFwPzEN.exe
  2⤵
  PID:10236
- C:\Windows\System\WxbqerS.exe
  C:\Windows\System\WxbqerS.exe
  2⤵
  PID:9340
- C:\Windows\System\JVEQSYz.exe
  C:\Windows\System\JVEQSYz.exe
  2⤵
  PID:9428
- C:\Windows\System\jylmpnb.exe
  C:\Windows\System\jylmpnb.exe
  2⤵
  PID:9484
- C:\Windows\System\dcXFyqj.exe
  C:\Windows\System\dcXFyqj.exe
  2⤵
  PID:9560
- C:\Windows\System\HDjFfCM.exe
  C:\Windows\System\HDjFfCM.exe
  2⤵
  PID:9668
- C:\Windows\System\TMlQkop.exe
  C:\Windows\System\TMlQkop.exe
  2⤵
  PID:9740
- C:\Windows\System\mHNUHRu.exe
  C:\Windows\System\mHNUHRu.exe
  2⤵
  PID:9812
- C:\Windows\System\opWRXIk.exe
  C:\Windows\System\opWRXIk.exe
  2⤵
  PID:9936
- C:\Windows\System\uIEhYtA.exe
  C:\Windows\System\uIEhYtA.exe
  2⤵
  PID:10008
- C:\Windows\System\xxEEuhd.exe
  C:\Windows\System\xxEEuhd.exe
  2⤵
  PID:10068
- C:\Windows\System\ANJyQaN.exe
  C:\Windows\System\ANJyQaN.exe
  2⤵
  PID:10228
- C:\Windows\System\ceJRaCk.exe
  C:\Windows\System\ceJRaCk.exe
  2⤵
  PID:9396
- C:\Windows\System\guAfOKr.exe
  C:\Windows\System\guAfOKr.exe
  2⤵
  PID:9584
- C:\Windows\System\kJMvsmB.exe
  C:\Windows\System\kJMvsmB.exe
  2⤵
  PID:9796
- C:\Windows\System\okeFhlo.exe
  C:\Windows\System\okeFhlo.exe
  2⤵
  PID:10060
- C:\Windows\System\pPnmbuF.exe
  C:\Windows\System\pPnmbuF.exe
  2⤵
  PID:9404
- C:\Windows\System\ZTmBbxR.exe
  C:\Windows\System\ZTmBbxR.exe
  2⤵
  PID:9736
- C:\Windows\System\lHWBPEk.exe
  C:\Windows\System\lHWBPEk.exe
  2⤵
  PID:9672
- C:\Windows\System\USxBHhZ.exe
  C:\Windows\System\USxBHhZ.exe
  2⤵
  PID:10260
- C:\Windows\System\lowBIvI.exe
  C:\Windows\System\lowBIvI.exe
  2⤵
  PID:10296
- C:\Windows\System\bEIlMqM.exe
  C:\Windows\System\bEIlMqM.exe
  2⤵
  PID:10328
- C:\Windows\System\mfDBjtO.exe
  C:\Windows\System\mfDBjtO.exe
  2⤵
  PID:10356
- C:\Windows\System\bIqndsv.exe
  C:\Windows\System\bIqndsv.exe
  2⤵
  PID:10384
- C:\Windows\System\ZHqXqJo.exe
  C:\Windows\System\ZHqXqJo.exe
  2⤵
  PID:10412
- C:\Windows\System\bSksUgR.exe
  C:\Windows\System\bSksUgR.exe
  2⤵
  PID:10440
- C:\Windows\System\nDAvdWs.exe
  C:\Windows\System\nDAvdWs.exe
  2⤵
  PID:10472
- C:\Windows\System\AiIzNvT.exe
  C:\Windows\System\AiIzNvT.exe
  2⤵
  PID:10488
- C:\Windows\System\AKRtXcy.exe
  C:\Windows\System\AKRtXcy.exe
  2⤵
  PID:10516
- C:\Windows\System\jIiyPDp.exe
  C:\Windows\System\jIiyPDp.exe
  2⤵
  PID:10532
- C:\Windows\System\viLJGmW.exe
  C:\Windows\System\viLJGmW.exe
  2⤵
  PID:10576
- C:\Windows\System\VjNjbIz.exe
  C:\Windows\System\VjNjbIz.exe
  2⤵
  PID:10620
- C:\Windows\System\dGtUNyE.exe
  C:\Windows\System\dGtUNyE.exe
  2⤵
  PID:10656
- C:\Windows\System\mfZOhWH.exe
  C:\Windows\System\mfZOhWH.exe
  2⤵
  PID:10684
- C:\Windows\System\EvGLYTC.exe
  C:\Windows\System\EvGLYTC.exe
  2⤵
  PID:10712
- C:\Windows\System\zqSzxwV.exe
  C:\Windows\System\zqSzxwV.exe
  2⤵
  PID:10740
- C:\Windows\System\USMCkov.exe
  C:\Windows\System\USMCkov.exe
  2⤵
  PID:10768
- C:\Windows\System\JCLJsBj.exe
  C:\Windows\System\JCLJsBj.exe
  2⤵
  PID:10796
- C:\Windows\System\qiswyhO.exe
  C:\Windows\System\qiswyhO.exe
  2⤵
  PID:10824
- C:\Windows\System\NgcEuMC.exe
  C:\Windows\System\NgcEuMC.exe
  2⤵
  PID:10840
- C:\Windows\System\bzFIgRa.exe
  C:\Windows\System\bzFIgRa.exe
  2⤵
  PID:10880
- C:\Windows\System\iXWRUuE.exe
  C:\Windows\System\iXWRUuE.exe
  2⤵
  PID:10908
- C:\Windows\System\CqUUNJz.exe
  C:\Windows\System\CqUUNJz.exe
  2⤵
  PID:10936
- C:\Windows\System\tdBPCkY.exe
  C:\Windows\System\tdBPCkY.exe
  2⤵
  PID:10964
- C:\Windows\System\BYGfrFv.exe
  C:\Windows\System\BYGfrFv.exe
  2⤵
  PID:10992
- C:\Windows\System\NtQtMpi.exe
  C:\Windows\System\NtQtMpi.exe
  2⤵
  PID:11024
- C:\Windows\System\ZYKmhVu.exe
  C:\Windows\System\ZYKmhVu.exe
  2⤵
  PID:11052
- C:\Windows\System\dOAFNTs.exe
  C:\Windows\System\dOAFNTs.exe
  2⤵
  PID:11084
- C:\Windows\System\KwLHNkt.exe
  C:\Windows\System\KwLHNkt.exe
  2⤵
  PID:11112
- C:\Windows\System\uNlHOSL.exe
  C:\Windows\System\uNlHOSL.exe
  2⤵
  PID:11140
- C:\Windows\System\Bebpthb.exe
  C:\Windows\System\Bebpthb.exe
  2⤵
  PID:11168
- C:\Windows\System\UTzOIQs.exe
  C:\Windows\System\UTzOIQs.exe
  2⤵
  PID:11196
- C:\Windows\System\ayXcqOm.exe
  C:\Windows\System\ayXcqOm.exe
  2⤵
  PID:11224
- C:\Windows\System\FUanbIp.exe
  C:\Windows\System\FUanbIp.exe
  2⤵
  PID:11252
- C:\Windows\System\oXGfmyL.exe
  C:\Windows\System\oXGfmyL.exe
  2⤵
  PID:10252
- C:\Windows\System\tAkVRSt.exe
  C:\Windows\System\tAkVRSt.exe
  2⤵
  PID:10324
- C:\Windows\System\jgmtsSc.exe
  C:\Windows\System\jgmtsSc.exe
  2⤵
  PID:10380
- C:\Windows\System\SVWKVDg.exe
  C:\Windows\System\SVWKVDg.exe
  2⤵
  PID:10456
- C:\Windows\System\WKUCluT.exe
  C:\Windows\System\WKUCluT.exe
  2⤵
  PID:10508
- C:\Windows\System\pyJzZiH.exe
  C:\Windows\System\pyJzZiH.exe
  2⤵
  PID:10556
- C:\Windows\System\KVDPXlL.exe
  C:\Windows\System\KVDPXlL.exe
  2⤵
  PID:10668
- C:\Windows\System\PzcwXvy.exe
  C:\Windows\System\PzcwXvy.exe
  2⤵
  PID:10728
- C:\Windows\System\SsXdfdi.exe
  C:\Windows\System\SsXdfdi.exe
  2⤵
  PID:10788
- C:\Windows\System\pXTlAVX.exe
  C:\Windows\System\pXTlAVX.exe
  2⤵
  PID:10852
- C:\Windows\System\vygJSsn.exe
  C:\Windows\System\vygJSsn.exe
  2⤵
  PID:10928
- C:\Windows\System\PVEFily.exe
  C:\Windows\System\PVEFily.exe
  2⤵
  PID:10988
- C:\Windows\System\irNDvGv.exe
  C:\Windows\System\irNDvGv.exe
  2⤵
  PID:11068
- C:\Windows\System\XNRApOZ.exe
  C:\Windows\System\XNRApOZ.exe
  2⤵
  PID:11132
- C:\Windows\System\dGspErT.exe
  C:\Windows\System\dGspErT.exe
  2⤵
  PID:11192
- C:\Windows\System\JXlcfhR.exe
  C:\Windows\System\JXlcfhR.exe
  2⤵
  PID:9608
- C:\Windows\System\IqtYDgQ.exe
  C:\Windows\System\IqtYDgQ.exe
  2⤵
  PID:10372
- C:\Windows\System\QnlJdiA.exe
  C:\Windows\System\QnlJdiA.exe
  2⤵
  PID:10524
- C:\Windows\System\XadFiSC.exe
  C:\Windows\System\XadFiSC.exe
  2⤵
  PID:10700
- C:\Windows\System\OxmxlJu.exe
  C:\Windows\System\OxmxlJu.exe
  2⤵
  PID:1524
- C:\Windows\System\LgiCWxn.exe
  C:\Windows\System\LgiCWxn.exe
  2⤵
  PID:10960
- C:\Windows\System\XeUWqhm.exe
  C:\Windows\System\XeUWqhm.exe
  2⤵
  PID:11104
- C:\Windows\System\TeGrtPZ.exe
  C:\Windows\System\TeGrtPZ.exe
  2⤵
  PID:10408
- C:\Windows\System\azDmEAg.exe
  C:\Windows\System\azDmEAg.exe
  2⤵
  PID:10652
- C:\Windows\System\jCVxrKZ.exe
  C:\Windows\System\jCVxrKZ.exe
  2⤵
  PID:10864
- C:\Windows\System\kaUOPxx.exe
  C:\Windows\System\kaUOPxx.exe
  2⤵
  PID:10648
- C:\Windows\System\LuEeTSq.exe
  C:\Windows\System\LuEeTSq.exe
  2⤵
  PID:11248
- C:\Windows\System\LapXlwD.exe
  C:\Windows\System\LapXlwD.exe
  2⤵
  PID:11300
- C:\Windows\System\KXszJbe.exe
  C:\Windows\System\KXszJbe.exe
  2⤵
  PID:11328
- C:\Windows\System\qSMcMTq.exe
  C:\Windows\System\qSMcMTq.exe
  2⤵
  PID:11356
- C:\Windows\System\HbzesLf.exe
  C:\Windows\System\HbzesLf.exe
  2⤵
  PID:11384
- C:\Windows\System\rKtumaT.exe
  C:\Windows\System\rKtumaT.exe
  2⤵
  PID:11412
- C:\Windows\System\vwQJPPj.exe
  C:\Windows\System\vwQJPPj.exe
  2⤵
  PID:11440
- C:\Windows\System\hGAzYqz.exe
  C:\Windows\System\hGAzYqz.exe
  2⤵
  PID:11468
- C:\Windows\System\cNmkuSI.exe
  C:\Windows\System\cNmkuSI.exe
  2⤵
  PID:11496
- C:\Windows\System\uOTTlBX.exe
  C:\Windows\System\uOTTlBX.exe
  2⤵
  PID:11524
- C:\Windows\System\TdldLMm.exe
  C:\Windows\System\TdldLMm.exe
  2⤵
  PID:11552
- C:\Windows\System\ZRCZFWf.exe
  C:\Windows\System\ZRCZFWf.exe
  2⤵
  PID:11580
- C:\Windows\System\XrnwOSt.exe
  C:\Windows\System\XrnwOSt.exe
  2⤵
  PID:11608
- C:\Windows\System\tVuWlMs.exe
  C:\Windows\System\tVuWlMs.exe
  2⤵
  PID:11636
- C:\Windows\System\brGMjRZ.exe
  C:\Windows\System\brGMjRZ.exe
  2⤵
  PID:11664
- C:\Windows\System\PgWbkFr.exe
  C:\Windows\System\PgWbkFr.exe
  2⤵
  PID:11692
- C:\Windows\System\KZmUMJq.exe
  C:\Windows\System\KZmUMJq.exe
  2⤵
  PID:11720
- C:\Windows\System\JMTidOV.exe
  C:\Windows\System\JMTidOV.exe
  2⤵
  PID:11748
- C:\Windows\System\MnMdqEJ.exe
  C:\Windows\System\MnMdqEJ.exe
  2⤵
  PID:11776
- C:\Windows\System\foKoGTL.exe
  C:\Windows\System\foKoGTL.exe
  2⤵
  PID:11804
- C:\Windows\System\lPPqcJj.exe
  C:\Windows\System\lPPqcJj.exe
  2⤵
  PID:11832
- C:\Windows\System\Prjewbq.exe
  C:\Windows\System\Prjewbq.exe
  2⤵
  PID:11860
- C:\Windows\System\xlBGYTD.exe
  C:\Windows\System\xlBGYTD.exe
  2⤵
  PID:11888
- C:\Windows\System\WzSoEEH.exe
  C:\Windows\System\WzSoEEH.exe
  2⤵
  PID:11916
- C:\Windows\System\scwASXp.exe
  C:\Windows\System\scwASXp.exe
  2⤵
  PID:11944
- C:\Windows\System\mrAVXul.exe
  C:\Windows\System\mrAVXul.exe
  2⤵
  PID:11972
- C:\Windows\System\xkKrsGC.exe
  C:\Windows\System\xkKrsGC.exe
  2⤵
  PID:12000
- C:\Windows\System\nDRhPFS.exe
  C:\Windows\System\nDRhPFS.exe
  2⤵
  PID:12028
- C:\Windows\System\KOAgxHl.exe
  C:\Windows\System\KOAgxHl.exe
  2⤵
  PID:12056
- C:\Windows\System\oCvMhTc.exe
  C:\Windows\System\oCvMhTc.exe
  2⤵
  PID:12084
- C:\Windows\System\AzRQmVC.exe
  C:\Windows\System\AzRQmVC.exe
  2⤵
  PID:12112
- C:\Windows\System\HMKmGwV.exe
  C:\Windows\System\HMKmGwV.exe
  2⤵
  PID:12140
- C:\Windows\System\vJGBNwt.exe
  C:\Windows\System\vJGBNwt.exe
  2⤵
  PID:12168
- C:\Windows\System\SGpzroP.exe
  C:\Windows\System\SGpzroP.exe
  2⤵
  PID:12196
- C:\Windows\System\yQkFPKV.exe
  C:\Windows\System\yQkFPKV.exe
  2⤵
  PID:12224
- C:\Windows\System\SSdoTDZ.exe
  C:\Windows\System\SSdoTDZ.exe
  2⤵
  PID:12252
- C:\Windows\System\IPIIIaR.exe
  C:\Windows\System\IPIIIaR.exe
  2⤵
  PID:12280
- C:\Windows\System\kotHpbv.exe
  C:\Windows\System\kotHpbv.exe
  2⤵
  PID:11324
- C:\Windows\System\nqZsxGm.exe
  C:\Windows\System\nqZsxGm.exe
  2⤵
  PID:11408
- C:\Windows\System\jsbThDw.exe
  C:\Windows\System\jsbThDw.exe
  2⤵
  PID:11492
- C:\Windows\System\giOzOIw.exe
  C:\Windows\System\giOzOIw.exe
  2⤵
  PID:11548
- C:\Windows\System\RAodnEu.exe
  C:\Windows\System\RAodnEu.exe
  2⤵
  PID:11604
- C:\Windows\System\fkFIRUx.exe
  C:\Windows\System\fkFIRUx.exe
  2⤵
  PID:11660
- C:\Windows\System\RiDyBLF.exe
  C:\Windows\System\RiDyBLF.exe
  2⤵
  PID:11716
- C:\Windows\System\TbmvBhg.exe
  C:\Windows\System\TbmvBhg.exe
  2⤵
  PID:11788
- C:\Windows\System\aQAAftR.exe
  C:\Windows\System\aQAAftR.exe
  2⤵
  PID:11852
- C:\Windows\System\aIZUVMY.exe
  C:\Windows\System\aIZUVMY.exe
  2⤵
  PID:11912
- C:\Windows\System\YVwWTIQ.exe
  C:\Windows\System\YVwWTIQ.exe
  2⤵
  PID:11984
- C:\Windows\System\CjYHlqg.exe
  C:\Windows\System\CjYHlqg.exe
  2⤵
  PID:12048
- C:\Windows\System\lHAYhnG.exe
  C:\Windows\System\lHAYhnG.exe
  2⤵
  PID:12124
- C:\Windows\System\RNpbEut.exe
  C:\Windows\System\RNpbEut.exe
  2⤵
  PID:12188
- C:\Windows\System\AWchfya.exe
  C:\Windows\System\AWchfya.exe
  2⤵
  PID:12244
- C:\Windows\System\PqBcKoj.exe
  C:\Windows\System\PqBcKoj.exe
  2⤵
  PID:12276
- C:\Windows\System\XXIosmD.exe
  C:\Windows\System\XXIosmD.exe
  2⤵
  PID:11540
- C:\Windows\System\pyfHRTP.exe
  C:\Windows\System\pyfHRTP.exe
  2⤵
  PID:11596
- C:\Windows\System\JYYonmM.exe
  C:\Windows\System\JYYonmM.exe
  2⤵
  PID:11768
- C:\Windows\System\KgQVvtS.exe
  C:\Windows\System\KgQVvtS.exe
  2⤵
  PID:11908
- C:\Windows\System\eVywllD.exe
  C:\Windows\System\eVywllD.exe
  2⤵
  PID:12100
- C:\Windows\System\rTcNjfb.exe
  C:\Windows\System\rTcNjfb.exe
  2⤵
  PID:12220
- C:\Windows\System\vZoRWJd.exe
  C:\Windows\System\vZoRWJd.exe
  2⤵
  PID:11436
- C:\Windows\System\qlQBWzN.exe
  C:\Windows\System\qlQBWzN.exe
  2⤵
  PID:12044
- C:\Windows\System\PExxLUy.exe
  C:\Windows\System\PExxLUy.exe
  2⤵
  PID:11848
- C:\Windows\System\icjfxtd.exe
  C:\Windows\System\icjfxtd.exe
  2⤵
  PID:12296
- C:\Windows\System\fFGwufs.exe
  C:\Windows\System\fFGwufs.exe
  2⤵
  PID:12324
- C:\Windows\System\jtGCEpJ.exe
  C:\Windows\System\jtGCEpJ.exe
  2⤵
  PID:12352
- C:\Windows\System\RYCthkt.exe
  C:\Windows\System\RYCthkt.exe
  2⤵
  PID:12380
- C:\Windows\System\OLmqEPL.exe
  C:\Windows\System\OLmqEPL.exe
  2⤵
  PID:12408
- C:\Windows\System\UwFeFeP.exe
  C:\Windows\System\UwFeFeP.exe
  2⤵
  PID:12436
- C:\Windows\System\yXjWXzi.exe
  C:\Windows\System\yXjWXzi.exe
  2⤵
  PID:12464
- C:\Windows\System\pTRxkAI.exe
  C:\Windows\System\pTRxkAI.exe
  2⤵
  PID:12492
- C:\Windows\System\kUEYJJI.exe
  C:\Windows\System\kUEYJJI.exe
  2⤵
  PID:12520
- C:\Windows\System\bFlTAGJ.exe
  C:\Windows\System\bFlTAGJ.exe
  2⤵
  PID:12556
- C:\Windows\System\WXiOOdl.exe
  C:\Windows\System\WXiOOdl.exe
  2⤵
  PID:12584
- C:\Windows\System\ZLgdMyx.exe
  C:\Windows\System\ZLgdMyx.exe
  2⤵
  PID:12612
- C:\Windows\System\xTBTCkl.exe
  C:\Windows\System\xTBTCkl.exe
  2⤵
  PID:12640
- C:\Windows\System\MmtKISD.exe
  C:\Windows\System\MmtKISD.exe
  2⤵
  PID:12672
- C:\Windows\System\PJqxMRf.exe
  C:\Windows\System\PJqxMRf.exe
  2⤵
  PID:12700
- C:\Windows\System\xfObkcM.exe
  C:\Windows\System\xfObkcM.exe
  2⤵
  PID:12728
- C:\Windows\System\wfXyaPP.exe
  C:\Windows\System\wfXyaPP.exe
  2⤵
  PID:12756
- C:\Windows\System\oiLptFl.exe
  C:\Windows\System\oiLptFl.exe
  2⤵
  PID:12784
- C:\Windows\System\ZQcZkyd.exe
  C:\Windows\System\ZQcZkyd.exe
  2⤵
  PID:12812
- C:\Windows\System\pHvyUqe.exe
  C:\Windows\System\pHvyUqe.exe
  2⤵
  PID:12840
- C:\Windows\System\zfqkHLO.exe
  C:\Windows\System\zfqkHLO.exe
  2⤵
  PID:12868
- C:\Windows\System\QgvpSvI.exe
  C:\Windows\System\QgvpSvI.exe
  2⤵
  PID:12896
- C:\Windows\System\HPPMOib.exe
  C:\Windows\System\HPPMOib.exe
  2⤵
  PID:12924
- C:\Windows\System\oxLNGTH.exe
  C:\Windows\System\oxLNGTH.exe
  2⤵
  PID:12952
- C:\Windows\System\xOwyBhU.exe
  C:\Windows\System\xOwyBhU.exe
  2⤵
  PID:12980
- C:\Windows\System\zuLZTeO.exe
  C:\Windows\System\zuLZTeO.exe
  2⤵
  PID:13008
- C:\Windows\System\wleNBEC.exe
  C:\Windows\System\wleNBEC.exe
  2⤵
  PID:13036
- C:\Windows\System\aRLjUyW.exe
  C:\Windows\System\aRLjUyW.exe
  2⤵
  PID:13064
- C:\Windows\System\fDcCfpW.exe
  C:\Windows\System\fDcCfpW.exe
  2⤵
  PID:13092
- C:\Windows\System\pgaGafY.exe
  C:\Windows\System\pgaGafY.exe
  2⤵
  PID:13120
- C:\Windows\System\vZznBOM.exe
  C:\Windows\System\vZznBOM.exe
  2⤵
  PID:13148
- C:\Windows\System\CHKFyAT.exe
  C:\Windows\System\CHKFyAT.exe
  2⤵
  PID:13176
- C:\Windows\System\gVSlsAN.exe
  C:\Windows\System\gVSlsAN.exe
  2⤵
  PID:13204
- C:\Windows\System\zTfprvR.exe
  C:\Windows\System\zTfprvR.exe
  2⤵
  PID:13228
- C:\Windows\System\fOmhiCL.exe
  C:\Windows\System\fOmhiCL.exe
  2⤵
  PID:13260
- C:\Windows\System\aRvuGSn.exe
  C:\Windows\System\aRvuGSn.exe
  2⤵
  PID:13288
- C:\Windows\System\paTOKiY.exe
  C:\Windows\System\paTOKiY.exe
  2⤵
  PID:11428
- C:\Windows\System\oLkFRex.exe
  C:\Windows\System\oLkFRex.exe
  2⤵
  PID:12340
- C:\Windows\System\jjfMAOM.exe
  C:\Windows\System\jjfMAOM.exe
  2⤵
  PID:12424
- C:\Windows\System\dQzkbUi.exe
  C:\Windows\System\dQzkbUi.exe
  2⤵
  PID:12456
- C:\Windows\System\PbNsKmk.exe
  C:\Windows\System\PbNsKmk.exe
  2⤵
  PID:12548
- C:\Windows\System\ERiXVaR.exe
  C:\Windows\System\ERiXVaR.exe
  2⤵
  PID:12608
- C:\Windows\System\DgZFdYC.exe
  C:\Windows\System\DgZFdYC.exe
  2⤵
  PID:12696
- C:\Windows\System\YsXWwJk.exe
  C:\Windows\System\YsXWwJk.exe
  2⤵
  PID:12776
- C:\Windows\System\SiujTRh.exe
  C:\Windows\System\SiujTRh.exe
  2⤵
  PID:12832
- C:\Windows\System\ewEdjxu.exe
  C:\Windows\System\ewEdjxu.exe
  2⤵
  PID:12892
- C:\Windows\System\pKbODeE.exe
  C:\Windows\System\pKbODeE.exe
  2⤵
  PID:12964
- C:\Windows\System\EjLqwRK.exe
  C:\Windows\System\EjLqwRK.exe
  2⤵
  PID:13020
- C:\Windows\System\XqcKZrT.exe
  C:\Windows\System\XqcKZrT.exe
  2⤵
  PID:13108
- C:\Windows\System\eHNUyZP.exe
  C:\Windows\System\eHNUyZP.exe
  2⤵
  PID:6804
- C:\Windows\System\BcbCNiG.exe
  C:\Windows\System\BcbCNiG.exe
  2⤵
  PID:13216
- C:\Windows\System\TjUpjhZ.exe
  C:\Windows\System\TjUpjhZ.exe
  2⤵
  PID:13256
- C:\Windows\System\kjEVSEQ.exe
  C:\Windows\System\kjEVSEQ.exe
  2⤵
  PID:13308
- C:\Windows\System\lVLlkLQ.exe
  C:\Windows\System\lVLlkLQ.exe
  2⤵
  PID:12316
- C:\Windows\System\tIdCBBz.exe
  C:\Windows\System\tIdCBBz.exe
  2⤵
  PID:12448
- C:\Windows\System\WbKCRJv.exe
  C:\Windows\System\WbKCRJv.exe
  2⤵
  PID:620
- C:\Windows\System\PBGpBza.exe
  C:\Windows\System\PBGpBza.exe
  2⤵
  PID:12656
- C:\Windows\System\EdKDTnN.exe
  C:\Windows\System\EdKDTnN.exe
  2⤵
  PID:12752
- C:\Windows\System\nBmToDL.exe
  C:\Windows\System\nBmToDL.exe
  2⤵
  PID:12884
- C:\Windows\System\XeESrBn.exe
  C:\Windows\System\XeESrBn.exe
  2⤵
  PID:13088
- C:\Windows\System\rCZmwQE.exe
  C:\Windows\System\rCZmwQE.exe
  2⤵
  PID:13252
- C:\Windows\System\giSvIUZ.exe
  C:\Windows\System\giSvIUZ.exe
  2⤵
  PID:232
- C:\Windows\System\qicqCkt.exe
  C:\Windows\System\qicqCkt.exe
  2⤵
  PID:2760
- C:\Windows\System\jdcOaJy.exe
  C:\Windows\System\jdcOaJy.exe
  2⤵
  PID:12796
- C:\Windows\System\ahXAFFc.exe
  C:\Windows\System\ahXAFFc.exe
  2⤵
  PID:13192
- C:\Windows\System\ZrHcKkA.exe
  C:\Windows\System\ZrHcKkA.exe
  2⤵
  PID:8124
- C:\Windows\System\iAGEdeG.exe
  C:\Windows\System\iAGEdeG.exe
  2⤵
  PID:13304
- C:\Windows\System\foomTIa.exe
  C:\Windows\System\foomTIa.exe
  2⤵
  PID:13144
- C:\Windows\System\hEoFTal.exe
  C:\Windows\System\hEoFTal.exe
  2⤵
  PID:13328
- C:\Windows\System\GLvvnOf.exe
  C:\Windows\System\GLvvnOf.exe
  2⤵
  PID:13356
- C:\Windows\System\VKBFBbU.exe
  C:\Windows\System\VKBFBbU.exe
  2⤵
  PID:13384
- C:\Windows\System\xJhBSvm.exe
  C:\Windows\System\xJhBSvm.exe
  2⤵
  PID:13412
- C:\Windows\System\CycSaPc.exe
  C:\Windows\System\CycSaPc.exe
  2⤵
  PID:13440
- C:\Windows\System\jctpEkJ.exe
  C:\Windows\System\jctpEkJ.exe
  2⤵
  PID:13468
- C:\Windows\System\rqxlnaE.exe
  C:\Windows\System\rqxlnaE.exe
  2⤵
  PID:13496
- C:\Windows\System\xnaSmID.exe
  C:\Windows\System\xnaSmID.exe
  2⤵
  PID:13524
- C:\Windows\System\upWzyBW.exe
  C:\Windows\System\upWzyBW.exe
  2⤵
  PID:13552
- C:\Windows\System\rUSiZlu.exe
  C:\Windows\System\rUSiZlu.exe
  2⤵
  PID:13584
- C:\Windows\System\nVQWRku.exe
  C:\Windows\System\nVQWRku.exe
  2⤵
  PID:13612
- C:\Windows\System\hadFQdR.exe
  C:\Windows\System\hadFQdR.exe
  2⤵
  PID:13640
- C:\Windows\System\dcxoISV.exe
  C:\Windows\System\dcxoISV.exe
  2⤵
  PID:13668
- C:\Windows\System\zbDPnPh.exe
  C:\Windows\System\zbDPnPh.exe
  2⤵
  PID:13696
- C:\Windows\System\nfcLMNi.exe
  C:\Windows\System\nfcLMNi.exe
  2⤵
  PID:13724
- C:\Windows\System\aEoNlOL.exe
  C:\Windows\System\aEoNlOL.exe
  2⤵
  PID:13752
- C:\Windows\System\QkMkKBk.exe
  C:\Windows\System\QkMkKBk.exe
  2⤵
  PID:13780
- C:\Windows\System\OqtkUwJ.exe
  C:\Windows\System\OqtkUwJ.exe
  2⤵
  PID:13808
- C:\Windows\System\dUGybvK.exe
  C:\Windows\System\dUGybvK.exe
  2⤵
  PID:13836
- C:\Windows\System\nbPJPBm.exe
  C:\Windows\System\nbPJPBm.exe
  2⤵
  PID:13864
- C:\Windows\System\RWAmpTQ.exe
  C:\Windows\System\RWAmpTQ.exe
  2⤵
  PID:13892
- C:\Windows\System\utffTPi.exe
  C:\Windows\System\utffTPi.exe
  2⤵
  PID:13920
- C:\Windows\System\GTkYgbE.exe
  C:\Windows\System\GTkYgbE.exe
  2⤵
  PID:13948
- C:\Windows\System\TCjZfCi.exe
  C:\Windows\System\TCjZfCi.exe
  2⤵
  PID:13976
- C:\Windows\System\vCxvyHM.exe
  C:\Windows\System\vCxvyHM.exe
  2⤵
  PID:14004
- C:\Windows\System\MCMqYkh.exe
  C:\Windows\System\MCMqYkh.exe
  2⤵
  PID:14032
- C:\Windows\System\FzjFIpm.exe
  C:\Windows\System\FzjFIpm.exe
  2⤵
  PID:14060
- C:\Windows\System\PIoeXnU.exe
  C:\Windows\System\PIoeXnU.exe
  2⤵
  PID:14088
- C:\Windows\System\wxZiygM.exe
  C:\Windows\System\wxZiygM.exe
  2⤵
  PID:14108
- C:\Windows\System\mGJdlRm.exe
  C:\Windows\System\mGJdlRm.exe
  2⤵
  PID:14132
- C:\Windows\System\pbEVUhK.exe
  C:\Windows\System\pbEVUhK.exe
  2⤵
  PID:14160
- C:\Windows\System\HhCpsIq.exe
  C:\Windows\System\HhCpsIq.exe
  2⤵
  PID:14184
- C:\Windows\System\TQzISch.exe
  C:\Windows\System\TQzISch.exe
  2⤵
  PID:14212
- C:\Windows\System\XSdqdJB.exe
  C:\Windows\System\XSdqdJB.exe
  2⤵
  PID:14244
- C:\Windows\System\DFEuWma.exe
  C:\Windows\System\DFEuWma.exe
  2⤵
  PID:14276
- C:\Windows\System\dwxauzb.exe
  C:\Windows\System\dwxauzb.exe
  2⤵
  PID:14304
- C:\Windows\System\fymkuGe.exe
  C:\Windows\System\fymkuGe.exe
  2⤵
  PID:14328
- C:\Windows\System\gmojKDw.exe
  C:\Windows\System\gmojKDw.exe
  2⤵
  PID:7120
- C:\Windows\System\RDoNljO.exe
  C:\Windows\System\RDoNljO.exe
  2⤵
  PID:13428
- C:\Windows\System\QjInTyp.exe
  C:\Windows\System\QjInTyp.exe
  2⤵
  PID:13488
- C:\Windows\System\ksGDsgv.exe
  C:\Windows\System\ksGDsgv.exe
  2⤵
  PID:13544
- C:\Windows\System\zIqGPGz.exe
  C:\Windows\System\zIqGPGz.exe
  2⤵
  PID:13600
- C:\Windows\System\TLJkePY.exe
  C:\Windows\System\TLJkePY.exe
  2⤵
  PID:13660
- C:\Windows\System\Etmsafx.exe
  C:\Windows\System\Etmsafx.exe
  2⤵
  PID:13716
- C:\Windows\System\kPCvpyU.exe
  C:\Windows\System\kPCvpyU.exe
  2⤵
  PID:13776
- C:\Windows\System\nsFvmkv.exe
  C:\Windows\System\nsFvmkv.exe
  2⤵
  PID:13852
- C:\Windows\System\OxRbmhd.exe
  C:\Windows\System\OxRbmhd.exe
  2⤵
  PID:1752
- C:\Windows\System\CCTJQng.exe
  C:\Windows\System\CCTJQng.exe
  2⤵
  PID:13940
- C:\Windows\System\AGwkZNF.exe
  C:\Windows\System\AGwkZNF.exe
  2⤵
  PID:14024
- C:\Windows\System\DeVcIHQ.exe
  C:\Windows\System\DeVcIHQ.exe
  2⤵
  PID:14096
- C:\Windows\System\QRecMme.exe
  C:\Windows\System\QRecMme.exe
  2⤵
  PID:7056
- C:\Windows\System\hukUbvk.exe
  C:\Windows\System\hukUbvk.exe
  2⤵
  PID:14224
- C:\Windows\System\exjOEsk.exe
  C:\Windows\System\exjOEsk.exe
  2⤵
  PID:14284
- C:\Windows\System\eWpcfnA.exe
  C:\Windows\System\eWpcfnA.exe
  2⤵
  PID:13320
- C:\Windows\System\zTgShnX.exe
  C:\Windows\System\zTgShnX.exe
  2⤵
  PID:13396
- C:\Windows\System\QVrEsab.exe
  C:\Windows\System\QVrEsab.exe
  2⤵
  PID:13656
- C:\Windows\System\gViPSKb.exe
  C:\Windows\System\gViPSKb.exe
  2⤵
  PID:13828
- C:\Windows\System\puZxmXw.exe
  C:\Windows\System\puZxmXw.exe
  2⤵
  PID:13888
- C:\Windows\System\GlhyINZ.exe
  C:\Windows\System\GlhyINZ.exe
  2⤵
  PID:14048
- C:\Windows\System\heSsitE.exe
  C:\Windows\System\heSsitE.exe
  2⤵
  PID:14120
- C:\Windows\System\ywMTEJa.exe
  C:\Windows\System\ywMTEJa.exe
  2⤵
  PID:14260
- C:\Windows\System\NiUAWua.exe
  C:\Windows\System\NiUAWua.exe
  2⤵
  PID:13324
- C:\Windows\System\djUbxzm.exe
  C:\Windows\System\djUbxzm.exe
  2⤵
  PID:14264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AvVQZDl.exe

Filesize
2.2MB

MD5
cfc03c85246f82c51951a678c02e3c3a

SHA1
811e02947285cb719fc7cbb6af8d357c39b89a6f

SHA256
987c87f131dc5afb9b34317060be693d545dcb8e85c2e784848b58c42000a1c1

SHA512
27a097d9d2008df77d1089bb6cf0b2acb91ae883588ac03a6df0f57fa4960540bfd486ff5ff35dacf82edafb3d13877e9a32cd594d51c18ee17e56b20cb113c8

Download Submit
C:\Windows\System\BjprUKf.exe

Filesize
2.2MB

MD5
b8b63bbbd9dec5ae4dc1bdb06f6df39f

SHA1
39b18fd154bdfa0dcedf180a6e1fc59c10fb8be1

SHA256
b39419fc865c9573fb51f792e64a768a590588cb8498fcddfdaf74b4971c5d3a

SHA512
6ec84c33078f40221d857fe53df6e12ac6e7bfcd5d6cbeb75e21e9801c475a921dcbdfc818dd65e45672ac66443a1296e1cf5c5a09c85ec4e462af949f316efe

Download Submit
C:\Windows\System\CxpsJiH.exe

Filesize
2.2MB

MD5
e83da9bd30535aff46a82c7f8d14545d

SHA1
929986d9ad0508950b57186fca6157d8fb273658

SHA256
535306ff32864cfa6ad1cc4f513914056bef6b4c7e266b7b692fa9de9c27b937

SHA512
a90a71b9bafa3c2e4487d6faf73c3db783933b39b44199bfb02ac5f9c6c0fcf3dd7fcc6b3ec10499e62bc552d812e5fbf804b46d07de29acf637844a2ffe8d60

Download Submit
C:\Windows\System\EQcnmyx.exe

Filesize
2.2MB

MD5
2bb9035c69a2ca6feddfbbcb0fd9af40

SHA1
2d6494d9da4a6e2835e11261db3fc1c1d5f22d27

SHA256
eea85cdac1c827883e17df5344e4ab2ba86da82a32fd7a0d7a48d734592c6dda

SHA512
175956688138452739971d645365ac427572d5bbf86f17ed994c22572a7608d10f53902e5243a8b1d57669266a593ae7e742d440828ac292009741feb1d410ce

Download Submit
C:\Windows\System\GQrPtNa.exe

Filesize
2.2MB

MD5
1856460a3baeb1c66c15864e03445ad9

SHA1
256a936f630648b092c4760f0c0287b969b6a77a

SHA256
6583166b064394d3b9eb1161dc8ff5220e617195bc4b9526e440fe1370b82365

SHA512
e7219467f50febe248b6c8750a1d37686fe43854711dd6a47e74b76ab54214a28482880c0258221bfd3cdcdc313da9220dbb6b109638e91e8689f0f0bdb3e0a0

Download Submit
C:\Windows\System\HUTVwMB.exe

Filesize
2.2MB

MD5
03421f5b1e315e030d1ef8ad2213761a

SHA1
0cdb6880b4722442e9742147a37aabeb1a7b9912

SHA256
9212649f516c414b6abf3b0754a1d2ff13f7dd83f57ff3f1c57834f730e4c6d0

SHA512
a94a348494e165d7240e893b058b153a524309361ebef305d2030c7d31b1506f944c85f4424af7875bfe95e5c84616403844e0302a635dc09484997261e95e49

Download Submit
C:\Windows\System\IgcZAlt.exe

Filesize
2.2MB

MD5
6a7a0a35a6cabf99a732a29157e1f807

SHA1
7f520d27e7d963f905e40861357f03d3d8508e11

SHA256
d23f9694dd9329489a3d4c2126add9c65da41ac4b62bcc7559b5e913106d1244

SHA512
e09e24f02329d20a925e7522b887ff6a708b93047ce267b72389537367f564b0a70a462f279d785ab6093652eeec0b58ceea35fbd703a178b5929a95387542eb

Download Submit
C:\Windows\System\JyOPltl.exe

Filesize
2.2MB

MD5
453ab79c751be22607669f3818ee1805

SHA1
911e612b2b5c5b68ad717e6fdc14a6da5b6f6e58

SHA256
b67a25ddd14e0427eb1f8d5c77dcb10177e0ad7dc5efe7ea7465d16db6cb489d

SHA512
ac3b7e3f614bce1a0c5f39c574692a59b1b8068479b82fa85e8777d65332dbbdace416d745095612b4a792339409f542909c40799010a233b5faab3e1c66afe4

Download Submit
C:\Windows\System\MuWLOvT.exe

Filesize
2.2MB

MD5
42a358e71eeebb82aa662903c15de2f6

SHA1
a0d6534baf03cabc153bd05154d4ce3a93be1807

SHA256
968d62bd8dcf4d7ce9bf56c34c797b81221fefa614679ea661eaa1fc0870395a

SHA512
bdd47758dd6149bea701b9331a3d43dba2a574a3801fa8be354e4c94974310089709e56241a499eb9136ffd98d8d2166f1ebb563b8d66df0fb6bff854ef2d2fc

Download Submit
C:\Windows\System\RjYJvEx.exe

Filesize
2.2MB

MD5
367abd5655d337fe3502691ab01c51b6

SHA1
30d399f4530334a77d796ac6b103e5eb6201ae8f

SHA256
88bd6d049c663fad0dc1187121639aadea293f74ba46753038c0cbef347f3691

SHA512
49ab5440430eea22c40145d022e743b054efe3aecd54ec79f25ccb4910e49d11257bad27f5c90028b2c9c0df2599d48ec9019dcaf56fd030c01e662373cb268a

Download Submit
C:\Windows\System\RldYiIg.exe

Filesize
2.2MB

MD5
d229c2b01a046e7a9f7c15355772b9b1

SHA1
9bd2ae62c6f0edee180b8811f90e420a17d05e7a

SHA256
a91dd8fae14b0daa76f37c9ae45011398e20790b94a88a5448a4e1b1b6693784

SHA512
7389aa0133505c281b3f21516990949938c7e12a0c5825ddbb3411567c31652346e90dcf2b089587e67dfcc5c05309c61557422466bcd69c4673c33c9828745b

Download Submit
C:\Windows\System\ScoHXKP.exe

Filesize
2.2MB

MD5
aed57f913a30250e0f952482e455f794

SHA1
ddaa643bdafe4064ea6bb6d1257e8f94b036497b

SHA256
b329b0cb0bc0b1ad0f06c2198263e17ae28ad24a58ee1b908a8541673076cb02

SHA512
0682fd34808bb5d1af3caddd2e8c0fbc3bf3d6c9d4cbb31fbfb9d58719eab2524c79d58bda4b59ac9c3434ec404a920476c2b201b552ade6f7dc309d78e2fe28

Download Submit
C:\Windows\System\TJgsWeB.exe

Filesize
2.2MB

MD5
bdc5af07ff3914d7372eb9579ee7cd54

SHA1
864b61f031e6a1f6fd0f32dd33583a9c9796914d

SHA256
8bacc64d74ba1c728170e5d3d188dc3e04030fc7864522a41bbd6b5ed576dfea

SHA512
144b35dc94825b6c07f3348e265d70e5851d80857ae257a5171ab6cc673a07496b9f8b2af3cf8a6326ec149c2c336580f9cc0fbe8bbcc5cc886552e88e4b5b81

Download Submit
C:\Windows\System\UCoSZPG.exe

Filesize
2.2MB

MD5
ac3ff8934341be81ca4de49c7de6eb1d

SHA1
17887a68be9921d7c0c95f09d727cd0138c1555e

SHA256
6d1382947a5bb9fe468628afa4585b08b58273013936e065208b9256e540b22e

SHA512
7079ee5ad11c8aa535ad1a0cebf859d864a7689e21c2f5be90da6d3e569c542dc695a8c1cdaf0e011974651776565476d76831c6e6bb0a2122eb406d25f44781

Download Submit
C:\Windows\System\UonNRKP.exe

Filesize
2.2MB

MD5
b67279a13dc60a08c370d7264893b34e

SHA1
b0a0dec484a4e8fe343eb4c614c420d8f0772141

SHA256
1d9e54c66a7e97b2e710a5f21b1792659d3b4427e554403a7cc975b3c3135f7d

SHA512
ec0d062e0de13ec54d68cebd710caa83296d8b9e294ea60c558e96d4c2bd3c66c63fd2093c452112b2dc7f472b7f76c9a992d7a4a1376b7d4c87d4ab20e4f09d

Download Submit
C:\Windows\System\VLQvudO.exe

Filesize
2.2MB

MD5
ed1fec40ecf56a2fc7f0b1ec7f8dded0

SHA1
0d882724eab8d10f83d07ff5490c215468cba794

SHA256
cdf9b0dfc703a67a188284c8c7b5d650912162ec6d8c8e646a30c741230301e0

SHA512
6b8899e1f1ec240adcb0082df7860f53d1ea4fb7250efee8b0269ca5fa47de340542196c1f2885c5370926ff9bdc1c6723ab1f48e484ec05b1b7fb03a5848557

Download Submit
C:\Windows\System\VTxfjYR.exe

Filesize
2.2MB

MD5
8664f44ad46c114d901a6e8f12e47bc3

SHA1
b687f6395861d9e042ad8d6bd1125472a1e888cb

SHA256
3c6b9ba9801ed19272bd9af8a8bf209aad5de882d2aac2f7e4a08840aeb8471d

SHA512
736deeccb90e43c835cbf0ae4bc95317e247eae9a368cee1ee374a418e79cc47703380c27595f0d599894853831285520a75fdb6c114a471fc06eb43d01e328b

Download Submit
C:\Windows\System\ZeQMdzH.exe

Filesize
2.2MB

MD5
0fa9da9f688134e8bd879cdbeade92d3

SHA1
d9e5fdd795e749bfa6886c8cc6245107bdedd5c7

SHA256
c453a5624f1a424cd7102fec91ab7176cdd2cd67928b77395689a45515bb4d1b

SHA512
b87295bc14f2b9485609368e86a171080784b4d39b00530af4851a73b66d41d95637b25bceedd7eb2401e9ee62c7ab4674bcd2110504e8d732b0f6934fcc3ab6

Download Submit
C:\Windows\System\ZyfoGPx.exe

Filesize
2.2MB

MD5
c8587d7eca6350daaa2bf699d3c50fcc

SHA1
9b6dbb87865d6368e2a93a1753f89b01ab42ac89

SHA256
8e3dc07a19ee8f598e2a7ea14e9f2f67af042ccba0d947710ddb58aebb29c209

SHA512
efc010ae335533c74a2efdda666d60ecf1b55fc2a8fccdbdae29919ed5882eae09806a3c0108c94c529519fb8d573123e37df1a95ee0ac5d9e1a387b756a9afa

Download Submit
C:\Windows\System\ZyfoGPx.exe

Filesize
1.9MB

MD5
f52c0f4bba01bdedc36f0e4d770d7d09

SHA1
eafd01e9ff7959f72fe1c7884a3aa60ba4f7d6ce

SHA256
e50447c63d7ca0ad010ee167b51ac549158dcd34e415f974791a337dc6888ac7

SHA512
26fb64ab7c1c591b2db5d491d3697d0e4ad5f70ae113fe74bd5e84b37c041d5ab423c46dd83065d282c986a4ab868fce2bbb6bb0e038acc62c93a2b002ded5c9

Download Submit
C:\Windows\System\dDzeOZF.exe

Filesize
2.2MB

MD5
bc9ccd0c75df1a69beaec835ce55973a

SHA1
72c26c55b76d77bf1198cbd86d2cfc737ca46ef9

SHA256
802e4df05ef8d908ca4ffbaf848d9f13f0776548fbff99ed645cbbd55f9339d4

SHA512
229ef1ab3bbf55b46424b33f74ca163bd49797af9d64c0edc35d0300a995addc5e811945557e2861576ebba8e42c540c60329aa25f1a4b7c3a6abfeeaf768b24

Download Submit
C:\Windows\System\dOXpttE.exe

Filesize
2.2MB

MD5
a076caebb617d84ec764165751cc489a

SHA1
d92ba8702892a5b3f60410151a8118a3912969cb

SHA256
c206d7ba8abd1cb3bb1bff0fdb1fe1a5758e4a86dadf54f171c0913659fc86bc

SHA512
e6d7bbcd5a7775a6df4458886901d81c7ce82a8b763bcd5acd8daf49f0c6ed966893938ff1ccbb6d72262d398d3f60490545f511f21e01829612b6661b673fc1

Download Submit
C:\Windows\System\eNdgrZm.exe

Filesize
2.2MB

MD5
23255ae886ea92bfdbc464a6a7956398

SHA1
68509d9b054648d13703c1859af6492b70008b59

SHA256
d0ceb3d4aed47866c18a7e044cddb8ee86303f76a1eabe6cc38d794a099bda67

SHA512
c8b59fd29a5287840f35a0c401479967fb85d4fedde5895b160770e8f8b430abbbc5b2c82db2cc35128ba0cf01a2242369d118026fd12da5403d3ddcb0996efd

Download Submit
C:\Windows\System\eaiLVaJ.exe

Filesize
2.2MB

MD5
5bf3569cc5e4849caeaebd5197dcc68e

SHA1
9527e5d231966a57c06102741b4247755155e3d9

SHA256
aa6f7719d14be93ff58c0eedf33c8fb1a0fcb954073dcc7aec1d61d25017c83a

SHA512
d353e17d73b9b4c69a696c3ad472d0bb9cc85dbe7c6504c3694fab880fe2350e54091428c1479fa42dd884fee62ccd0f6d835ee0512187fa0e0e4943b604e200

Download Submit
C:\Windows\System\fNwgYpy.exe

Filesize
2.2MB

MD5
5be02c5efc96f2a45274d72f2a6c172e

SHA1
a89506dd870b7f265c78bf235617719144d74b96

SHA256
8e888f939419011493fbf7af2174802a22eb5414293da8fe29cb8062183cd3c2

SHA512
33e1bec7079bac746dae4edf763590a2e238ca5fecb07fb82bf727650674197d6acf378412b009c6010ae48c5ddfff4a765b8c9e93de6a833075a683114676f7

Download Submit
C:\Windows\System\fSvCnoJ.exe

Filesize
2.2MB

MD5
ea8406e2e861ad2c965a315dd7cf9f63

SHA1
95fba7b10effa264c1a546f05cdd5f3f6f2fdb7c

SHA256
0f9bb66c410e7d7804fd7c6f37fe3d734ec2cfab7cb4ca992facdb71f14e4689

SHA512
03b6e3cf7dcbe270d781c7f69291190c98e324df48b0a184615a403fb2f9c9c18ec163ec2467f94bfac52bad65395f00bb64c195ee923116a33d4aa1842a4ad1

Download Submit
C:\Windows\System\ikuIzWv.exe

Filesize
2.2MB

MD5
97269747cb1dcfc023842de182f3f4bc

SHA1
7ed769a042533af3c5b235aea531d3ab392aea09

SHA256
1c49bb4deb1e12dafa30fdf55d29ed19a04e96c79d23266bf266dd6ed88349ac

SHA512
554defeaee7379eaf796e895c9d860d3f08a0d86a406fb0a3d651ad14c73349fa63e210647d7910dadc20f269470216c1329010c7cc0eb22c6f1647f212ee27d

Download Submit
C:\Windows\System\jHnHcet.exe

Filesize
2.2MB

MD5
d945c98ca2d45e3640deda45c10789f9

SHA1
386160f7c43bf320c85e019fdc56985dcd311494

SHA256
43d0ce0f318c39c907d38192bc325e520119e89fae0d0869c6ba4e2ef07d5b8f

SHA512
d915540fdde76b9b9ed38973710bd8edec6199e991a0b524a5d5fb766733c69912f6dac47317beffd0f8dbdc464f93d4cbba7c4fb94941f819d55818d265c586

Download Submit
C:\Windows\System\pzTGVqu.exe

Filesize
2.2MB

MD5
39b4e74208dc89056637af45616e3db5

SHA1
959ea17dcd176db21bb922877d955932c269f59e

SHA256
6d7a5899ef4e209ddeab30457c2feb70fc0d165fe72d1ad1cdde253a62639454

SHA512
fac7100f9569e4b209c6e2baecde9c1c5d35cd9fff06e2bb32f2aa1e314d163dcff1def0c1ca592452f6436e64fc0e4f30428bd4454ff06488a1182b22513d70

Download Submit
C:\Windows\System\rwLSHvD.exe

Filesize
2.2MB

MD5
d7d11be2801fec557aa56cf36164534a

SHA1
2d35e2e5fae4c4f33adf6ad8ac343d9bec795221

SHA256
59841c59d52b3d72ea7604a9746856f4dcf3a011ddd2460a337ae56d48ac42fb

SHA512
66f8c1edca3476ddbb04f977c2b4d4a057b52237540e1d3103f9a2f3ba614cf0f18b6f813c67cbac41173bbba82c0ceaaf1e22b8eca5ce06d0f08e0ba5b0686e

Download Submit
C:\Windows\System\tmCJVnf.exe

Filesize
2.2MB

MD5
f3f5d2e866028e7a2d9c50fee2bba334

SHA1
34b94ba0261ba9da137c2cd30141a9eeea4a3e85

SHA256
471ee5a8829e91c646b277c9819121782da4e82e1e342d91c78bdd0e21b56c01

SHA512
08b6dd8d25c5f77d0dab693f708b26086861823ea2228b40d8b11f7f90229bdddb6d89363a1aad8e567a80798782aee7fe10abad6c53696cd518e4e5bb2614eb

Download Submit
C:\Windows\System\xMhxUIs.exe

Filesize
2.2MB

MD5
29d81131cafc78a711b083deb15822ef

SHA1
91baf008973e4e42c35a8c5c8653280b4d4b9169

SHA256
20a795409c3c4ffa22a3d3d26f4ce0e8eaa3f062d5ac719b0e57246655d0e5dc

SHA512
e8bcbc127bfb3dfcfad7afa6ed0a49effb3db0ac6e3f17ec94e1cfed52dad5c8d12cb43433444bb32f019e098a2ddf926c8e36776476b89eb8af926989136bcd

Download Submit
C:\Windows\System\zDJmwLI.exe

Filesize
2.2MB

MD5
7ef6e006279355f622dae68273abbcd2

SHA1
4f429fbb6e38555a31dd27c80b5680970f0a5571

SHA256
0d4394a1319772a2ae2b78bb0c5f0efce0e50b46d994e34d5f8dd74fbf59a839

SHA512
7f00b1cc119b1e237d55385edb8677ce878473581030ab032dd29896e9b1a734491f9b375181686878aa9fe316cb80131717b1df6a336268df32f3097bec66b0

Download Submit
C:\Windows\System\zlnWivl.exe

Filesize
2.2MB

MD5
34fa63dec41d1f12a95610a32a9f21a6

SHA1
18ff5cd814ac9289f2477c4e0d3a664fae85ffa7

SHA256
c90bde9f44118823a86bf61824717245c18d1a80ded6b26f9b6453d723c370c1

SHA512
4b7d82d580c5ee8efc7dea1af0163df543e3da4374499ce14551afffd638eee34eaedf7ecbc1c147b1227f8e1d887e4dca98ac42d195e6714b1b212bd923f011

Download Submit
memory/220-2090-0x00007FF6732C0000-0x00007FF673614000-memory.dmp

Filesize
3.3MB

Download
memory/220-1-0x000002523D900000-0x000002523D910000-memory.dmp

Filesize
64KB

Download
memory/220-0-0x00007FF6732C0000-0x00007FF673614000-memory.dmp

Filesize
3.3MB

Download
memory/440-9-0x00007FF788550000-0x00007FF7888A4000-memory.dmp

Filesize
3.3MB

Download
memory/440-2091-0x00007FF788550000-0x00007FF7888A4000-memory.dmp

Filesize
3.3MB

Download
memory/440-2093-0x00007FF788550000-0x00007FF7888A4000-memory.dmp

Filesize
3.3MB

Download
memory/844-675-0x00007FF7CC810000-0x00007FF7CCB64000-memory.dmp

Filesize
3.3MB

Download
memory/844-2106-0x00007FF7CC810000-0x00007FF7CCB64000-memory.dmp

Filesize
3.3MB

Download
memory/1016-667-0x00007FF627C30000-0x00007FF627F84000-memory.dmp

Filesize
3.3MB

Download
memory/1016-2107-0x00007FF627C30000-0x00007FF627F84000-memory.dmp

Filesize
3.3MB

Download
memory/1156-2119-0x00007FF75C0F0000-0x00007FF75C444000-memory.dmp

Filesize
3.3MB

Download
memory/1156-714-0x00007FF75C0F0000-0x00007FF75C444000-memory.dmp

Filesize
3.3MB

Download
memory/1328-724-0x00007FF740F70000-0x00007FF7412C4000-memory.dmp

Filesize
3.3MB

Download
memory/1328-2116-0x00007FF740F70000-0x00007FF7412C4000-memory.dmp

Filesize
3.3MB

Download
memory/1464-2109-0x00007FF6A9E20000-0x00007FF6AA174000-memory.dmp

Filesize
3.3MB

Download
memory/1464-679-0x00007FF6A9E20000-0x00007FF6AA174000-memory.dmp

Filesize
3.3MB

Download
memory/1520-2095-0x00007FF7AFCD0000-0x00007FF7B0024000-memory.dmp

Filesize
3.3MB

Download
memory/1520-29-0x00007FF7AFCD0000-0x00007FF7B0024000-memory.dmp

Filesize
3.3MB

Download
memory/1612-697-0x00007FF7AE290000-0x00007FF7AE5E4000-memory.dmp

Filesize
3.3MB

Download
memory/1612-2114-0x00007FF7AE290000-0x00007FF7AE5E4000-memory.dmp

Filesize
3.3MB

Download
memory/1740-733-0x00007FF6B87A0000-0x00007FF6B8AF4000-memory.dmp

Filesize
3.3MB

Download
memory/1740-2097-0x00007FF6B87A0000-0x00007FF6B8AF4000-memory.dmp

Filesize
3.3MB

Download
memory/1816-2102-0x00007FF799EA0000-0x00007FF79A1F4000-memory.dmp

Filesize
3.3MB

Download
memory/1816-656-0x00007FF799EA0000-0x00007FF79A1F4000-memory.dmp

Filesize
3.3MB

Download
memory/2084-2094-0x00007FF7D5E90000-0x00007FF7D61E4000-memory.dmp

Filesize
3.3MB

Download
memory/2084-22-0x00007FF7D5E90000-0x00007FF7D61E4000-memory.dmp

Filesize
3.3MB

Download
memory/2264-2104-0x00007FF602370000-0x00007FF6026C4000-memory.dmp

Filesize
3.3MB

Download
memory/2264-658-0x00007FF602370000-0x00007FF6026C4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-717-0x00007FF624B80000-0x00007FF624ED4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-2118-0x00007FF624B80000-0x00007FF624ED4000-memory.dmp

Filesize
3.3MB

Download
memory/3152-655-0x00007FF715770000-0x00007FF715AC4000-memory.dmp

Filesize
3.3MB

Download
memory/3152-2099-0x00007FF715770000-0x00007FF715AC4000-memory.dmp

Filesize
3.3MB

Download
memory/3404-2121-0x00007FF782F70000-0x00007FF7832C4000-memory.dmp

Filesize
3.3MB

Download
memory/3404-704-0x00007FF782F70000-0x00007FF7832C4000-memory.dmp

Filesize
3.3MB

Download
memory/3812-728-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp

Filesize
3.3MB

Download
memory/3812-2117-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp

Filesize
3.3MB

Download
memory/3996-659-0x00007FF739460000-0x00007FF7397B4000-memory.dmp

Filesize
3.3MB

Download
memory/3996-2103-0x00007FF739460000-0x00007FF7397B4000-memory.dmp

Filesize
3.3MB

Download
memory/4080-669-0x00007FF6FBD20000-0x00007FF6FC074000-memory.dmp

Filesize
3.3MB

Download
memory/4080-2110-0x00007FF6FBD20000-0x00007FF6FC074000-memory.dmp

Filesize
3.3MB

Download
memory/4116-2101-0x00007FF6E4750000-0x00007FF6E4AA4000-memory.dmp

Filesize
3.3MB

Download
memory/4116-657-0x00007FF6E4750000-0x00007FF6E4AA4000-memory.dmp

Filesize
3.3MB

Download
memory/4168-685-0x00007FF715350000-0x00007FF7156A4000-memory.dmp

Filesize
3.3MB

Download
memory/4168-2105-0x00007FF715350000-0x00007FF7156A4000-memory.dmp

Filesize
3.3MB

Download
memory/4296-662-0x00007FF60EA20000-0x00007FF60ED74000-memory.dmp

Filesize
3.3MB

Download
memory/4296-2112-0x00007FF60EA20000-0x00007FF60ED74000-memory.dmp

Filesize
3.3MB

Download
memory/4320-2113-0x00007FF6EA940000-0x00007FF6EAC94000-memory.dmp

Filesize
3.3MB

Download
memory/4320-660-0x00007FF6EA940000-0x00007FF6EAC94000-memory.dmp

Filesize
3.3MB

Download
memory/4360-2100-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp

Filesize
3.3MB

Download
memory/4360-34-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp

Filesize
3.3MB

Download
memory/4360-2092-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp

Filesize
3.3MB

Download
memory/4528-2096-0x00007FF764710000-0x00007FF764A64000-memory.dmp

Filesize
3.3MB

Download
memory/4528-654-0x00007FF764710000-0x00007FF764A64000-memory.dmp

Filesize
3.3MB

Download
memory/4600-691-0x00007FF6F4CA0000-0x00007FF6F4FF4000-memory.dmp

Filesize
3.3MB

Download
memory/4600-2115-0x00007FF6F4CA0000-0x00007FF6F4FF4000-memory.dmp

Filesize
3.3MB

Download
memory/4668-2098-0x00007FF7899F0000-0x00007FF789D44000-memory.dmp

Filesize
3.3MB

Download
memory/4668-735-0x00007FF7899F0000-0x00007FF789D44000-memory.dmp

Filesize
3.3MB

Download
memory/4676-709-0x00007FF7A0AD0000-0x00007FF7A0E24000-memory.dmp

Filesize
3.3MB

Download
memory/4676-2120-0x00007FF7A0AD0000-0x00007FF7A0E24000-memory.dmp

Filesize
3.3MB

Download
memory/5012-2108-0x00007FF79C460000-0x00007FF79C7B4000-memory.dmp

Filesize
3.3MB

Download
memory/5012-672-0x00007FF79C460000-0x00007FF79C7B4000-memory.dmp

Filesize
3.3MB

Download
memory/5024-661-0x00007FF7F9800000-0x00007FF7F9B54000-memory.dmp

Filesize
3.3MB

Download
memory/5024-2111-0x00007FF7F9800000-0x00007FF7F9B54000-memory.dmp

Filesize
3.3MB

Download