xmrig | 286b63220585d33ab16bfd8383bd90333150368288ed3319feae2596e22c0151

Analysis

max time kernel
136s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
Size

3.1MB
MD5

ad640e915ae44a7d13b7c8bea3d27620
SHA1

de0145fc970546c9647eed491d91da3dcfdb47cc
SHA256

286b63220585d33ab16bfd8383bd90333150368288ed3319feae2596e22c0151
SHA512

03f7fc192899a04ddb54ea9b6fdad751d601fe54f97d9f60daecccacc01a485a2d53723ed301c5f23c48c3336b9dbce0a0f20d37f8f986145baa1cb41fd10ac8
SSDEEP

98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4G:NFWPClFW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/788-0-0x00007FF68C1A0000-0x00007FF68C595000-memory.dmp	xmrig
behavioral2/files/0x000600000002327c-5.dat	xmrig
behavioral2/files/0x0007000000023417-10.dat	xmrig
behavioral2/memory/4112-13-0x00007FF6F2320000-0x00007FF6F2715000-memory.dmp	xmrig
behavioral2/files/0x0008000000023413-11.dat	xmrig
behavioral2/memory/3496-20-0x00007FF621360000-0x00007FF621755000-memory.dmp	xmrig
behavioral2/memory/4468-15-0x00007FF68D080000-0x00007FF68D475000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-22.dat	xmrig
behavioral2/files/0x0007000000023419-29.dat	xmrig
behavioral2/memory/1912-26-0x00007FF7C86A0000-0x00007FF7C8A95000-memory.dmp	xmrig
behavioral2/memory/4816-32-0x00007FF795940000-0x00007FF795D35000-memory.dmp	xmrig
behavioral2/files/0x0008000000023414-41.dat	xmrig
behavioral2/memory/2908-40-0x00007FF6BC0B0000-0x00007FF6BC4A5000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-36.dat	xmrig
behavioral2/memory/3732-45-0x00007FF6B0430000-0x00007FF6B0825000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-48.dat	xmrig
behavioral2/files/0x000700000002341c-53.dat	xmrig
behavioral2/files/0x000700000002341e-58.dat	xmrig
behavioral2/files/0x0007000000023420-63.dat	xmrig
behavioral2/files/0x0007000000023421-67.dat	xmrig
behavioral2/files/0x0007000000023422-73.dat	xmrig
behavioral2/files/0x0007000000023423-77.dat	xmrig
behavioral2/files/0x0007000000023424-86.dat	xmrig
behavioral2/files/0x0007000000023425-96.dat	xmrig
behavioral2/memory/980-101-0x00007FF73A970000-0x00007FF73AD65000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-124.dat	xmrig
behavioral2/files/0x000700000002342e-142.dat	xmrig
behavioral2/files/0x0007000000023430-154.dat	xmrig
behavioral2/files/0x0007000000023435-179.dat	xmrig
behavioral2/memory/2012-397-0x00007FF7CA980000-0x00007FF7CAD75000-memory.dmp	xmrig
behavioral2/memory/1324-398-0x00007FF741DF0000-0x00007FF7421E5000-memory.dmp	xmrig
behavioral2/memory/4356-399-0x00007FF719270000-0x00007FF719665000-memory.dmp	xmrig
behavioral2/memory/892-403-0x00007FF78C990000-0x00007FF78CD85000-memory.dmp	xmrig
behavioral2/memory/4800-411-0x00007FF616780000-0x00007FF616B75000-memory.dmp	xmrig
behavioral2/memory/5116-415-0x00007FF77C400000-0x00007FF77C7F5000-memory.dmp	xmrig
behavioral2/memory/4900-406-0x00007FF7EEDA0000-0x00007FF7EF195000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-174.dat	xmrig
behavioral2/files/0x0007000000023433-169.dat	xmrig
behavioral2/files/0x0007000000023432-164.dat	xmrig
behavioral2/files/0x0007000000023431-159.dat	xmrig
behavioral2/files/0x000700000002342f-149.dat	xmrig
behavioral2/files/0x000700000002342d-139.dat	xmrig
behavioral2/files/0x000700000002342c-134.dat	xmrig
behavioral2/files/0x000700000002342b-129.dat	xmrig
behavioral2/files/0x0007000000023429-119.dat	xmrig
behavioral2/files/0x0007000000023428-114.dat	xmrig
behavioral2/files/0x0007000000023427-109.dat	xmrig
behavioral2/memory/3724-106-0x00007FF77A020000-0x00007FF77A415000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-103.dat	xmrig
behavioral2/memory/2916-102-0x00007FF77FA70000-0x00007FF77FE65000-memory.dmp	xmrig
behavioral2/memory/788-97-0x00007FF68C1A0000-0x00007FF68C595000-memory.dmp	xmrig
behavioral2/memory/2588-94-0x00007FF7FE470000-0x00007FF7FE865000-memory.dmp	xmrig
behavioral2/memory/2352-93-0x00007FF626F10000-0x00007FF627305000-memory.dmp	xmrig
behavioral2/memory/3096-89-0x00007FF7AE5F0000-0x00007FF7AE9E5000-memory.dmp	xmrig
behavioral2/memory/4984-82-0x00007FF78E3B0000-0x00007FF78E7A5000-memory.dmp	xmrig
behavioral2/memory/1516-78-0x00007FF6E2190000-0x00007FF6E2585000-memory.dmp	xmrig
behavioral2/memory/4880-74-0x00007FF78EEA0000-0x00007FF78F295000-memory.dmp	xmrig
behavioral2/memory/3296-71-0x00007FF766C90000-0x00007FF767085000-memory.dmp	xmrig
behavioral2/memory/3496-942-0x00007FF621360000-0x00007FF621755000-memory.dmp	xmrig
behavioral2/memory/1912-1260-0x00007FF7C86A0000-0x00007FF7C8A95000-memory.dmp	xmrig
behavioral2/memory/788-1942-0x00007FF68C1A0000-0x00007FF68C595000-memory.dmp	xmrig
behavioral2/memory/980-1943-0x00007FF73A970000-0x00007FF73AD65000-memory.dmp	xmrig
behavioral2/memory/3724-1944-0x00007FF77A020000-0x00007FF77A415000-memory.dmp	xmrig
behavioral2/memory/4112-1945-0x00007FF6F2320000-0x00007FF6F2715000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4112	oHkhLQi.exe
4468	yIUUryn.exe
3496	zoWsTxd.exe
1912	zmqOAAa.exe
4816	SaKlogN.exe
2908	MhLAlho.exe
3732	pQLdZQK.exe
3296	ElHhnhZ.exe
3096	WCAvEWf.exe
4880	TdQRMxy.exe
1516	dZxVOcD.exe
4984	bkXYJbs.exe
2352	OgLOwsh.exe
2588	IiOSQRs.exe
980	WAZRAFJ.exe
2916	UKPszbt.exe
3724	ZLOzNzU.exe
2012	OUQwico.exe
1324	cjJWxon.exe
4356	soPzDNH.exe
892	uXtJWMw.exe
4900	SsHKHeV.exe
4800	OwcYoRi.exe
5116	gfGxcDr.exe
1816	BXPblfc.exe
4140	CgHSnun.exe
564	yLaroTh.exe
3736	vPNJkFz.exe
3668	PSBFaRI.exe
3164	QvAygOa.exe
4856	INcfwoK.exe
3272	BadhMJb.exe
4132	pVEctry.exe
2848	RZEXXag.exe
2508	NPThqFW.exe
3720	gXEeOBj.exe
3256	PlqBsOB.exe
212	UMWxZWW.exe
4820	TRSKWFe.exe
1792	kKAXNIE.exe
3284	SxZjCGR.exe
648	toiMeXG.exe
4332	tSZAZmn.exe
428	ZUePZmA.exe
1328	DxRobEl.exe
2612	mRdmnRk.exe
4464	JPvdWpG.exe
4436	UGMhPtY.exe
4036	uLgggLA.exe
1916	maZfIpm.exe
5040	bkrMzKe.exe
4784	CbArvAi.exe
4544	bwOurgb.exe
2648	CXQyAIM.exe
4352	UNZiaFb.exe
968	CNIoBrn.exe
1896	jWAKGil.exe
400	scCaOKS.exe
1664	FVJEQrI.exe
2596	vFxjIhP.exe
4204	ZXUMPGw.exe
3928	yRirIuX.exe
3752	vYbygZH.exe
232	SQDdixm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/788-0-0x00007FF68C1A0000-0x00007FF68C595000-memory.dmp	upx
behavioral2/files/0x000600000002327c-5.dat	upx
behavioral2/files/0x0007000000023417-10.dat	upx
behavioral2/memory/4112-13-0x00007FF6F2320000-0x00007FF6F2715000-memory.dmp	upx
behavioral2/files/0x0008000000023413-11.dat	upx
behavioral2/memory/3496-20-0x00007FF621360000-0x00007FF621755000-memory.dmp	upx
behavioral2/memory/4468-15-0x00007FF68D080000-0x00007FF68D475000-memory.dmp	upx
behavioral2/files/0x0007000000023418-22.dat	upx
behavioral2/files/0x0007000000023419-29.dat	upx
behavioral2/memory/1912-26-0x00007FF7C86A0000-0x00007FF7C8A95000-memory.dmp	upx
behavioral2/memory/4816-32-0x00007FF795940000-0x00007FF795D35000-memory.dmp	upx
behavioral2/files/0x0008000000023414-41.dat	upx
behavioral2/memory/2908-40-0x00007FF6BC0B0000-0x00007FF6BC4A5000-memory.dmp	upx
behavioral2/files/0x000700000002341a-36.dat	upx
behavioral2/memory/3732-45-0x00007FF6B0430000-0x00007FF6B0825000-memory.dmp	upx
behavioral2/files/0x000700000002341b-48.dat	upx
behavioral2/files/0x000700000002341c-53.dat	upx
behavioral2/files/0x000700000002341e-58.dat	upx
behavioral2/files/0x0007000000023420-63.dat	upx
behavioral2/files/0x0007000000023421-67.dat	upx
behavioral2/files/0x0007000000023422-73.dat	upx
behavioral2/files/0x0007000000023423-77.dat	upx
behavioral2/files/0x0007000000023424-86.dat	upx
behavioral2/files/0x0007000000023425-96.dat	upx
behavioral2/memory/980-101-0x00007FF73A970000-0x00007FF73AD65000-memory.dmp	upx
behavioral2/files/0x000700000002342a-124.dat	upx
behavioral2/files/0x000700000002342e-142.dat	upx
behavioral2/files/0x0007000000023430-154.dat	upx
behavioral2/files/0x0007000000023435-179.dat	upx
behavioral2/memory/2012-397-0x00007FF7CA980000-0x00007FF7CAD75000-memory.dmp	upx
behavioral2/memory/1324-398-0x00007FF741DF0000-0x00007FF7421E5000-memory.dmp	upx
behavioral2/memory/4356-399-0x00007FF719270000-0x00007FF719665000-memory.dmp	upx
behavioral2/memory/892-403-0x00007FF78C990000-0x00007FF78CD85000-memory.dmp	upx
behavioral2/memory/4800-411-0x00007FF616780000-0x00007FF616B75000-memory.dmp	upx
behavioral2/memory/5116-415-0x00007FF77C400000-0x00007FF77C7F5000-memory.dmp	upx
behavioral2/memory/4900-406-0x00007FF7EEDA0000-0x00007FF7EF195000-memory.dmp	upx
behavioral2/files/0x0007000000023434-174.dat	upx
behavioral2/files/0x0007000000023433-169.dat	upx
behavioral2/files/0x0007000000023432-164.dat	upx
behavioral2/files/0x0007000000023431-159.dat	upx
behavioral2/files/0x000700000002342f-149.dat	upx
behavioral2/files/0x000700000002342d-139.dat	upx
behavioral2/files/0x000700000002342c-134.dat	upx
behavioral2/files/0x000700000002342b-129.dat	upx
behavioral2/files/0x0007000000023429-119.dat	upx
behavioral2/files/0x0007000000023428-114.dat	upx
behavioral2/files/0x0007000000023427-109.dat	upx
behavioral2/memory/3724-106-0x00007FF77A020000-0x00007FF77A415000-memory.dmp	upx
behavioral2/files/0x0007000000023426-103.dat	upx
behavioral2/memory/2916-102-0x00007FF77FA70000-0x00007FF77FE65000-memory.dmp	upx
behavioral2/memory/788-97-0x00007FF68C1A0000-0x00007FF68C595000-memory.dmp	upx
behavioral2/memory/2588-94-0x00007FF7FE470000-0x00007FF7FE865000-memory.dmp	upx
behavioral2/memory/2352-93-0x00007FF626F10000-0x00007FF627305000-memory.dmp	upx
behavioral2/memory/3096-89-0x00007FF7AE5F0000-0x00007FF7AE9E5000-memory.dmp	upx
behavioral2/memory/4984-82-0x00007FF78E3B0000-0x00007FF78E7A5000-memory.dmp	upx
behavioral2/memory/1516-78-0x00007FF6E2190000-0x00007FF6E2585000-memory.dmp	upx
behavioral2/memory/4880-74-0x00007FF78EEA0000-0x00007FF78F295000-memory.dmp	upx
behavioral2/memory/3296-71-0x00007FF766C90000-0x00007FF767085000-memory.dmp	upx
behavioral2/memory/3496-942-0x00007FF621360000-0x00007FF621755000-memory.dmp	upx
behavioral2/memory/1912-1260-0x00007FF7C86A0000-0x00007FF7C8A95000-memory.dmp	upx
behavioral2/memory/788-1942-0x00007FF68C1A0000-0x00007FF68C595000-memory.dmp	upx
behavioral2/memory/980-1943-0x00007FF73A970000-0x00007FF73AD65000-memory.dmp	upx
behavioral2/memory/3724-1944-0x00007FF77A020000-0x00007FF77A415000-memory.dmp	upx
behavioral2/memory/4112-1945-0x00007FF6F2320000-0x00007FF6F2715000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\CDRWlre.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\hymFUrI.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\XJpCbRD.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\KbxxbaN.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\KmkbuWs.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\NUAgaAB.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\YmlvkAp.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\GwnHxem.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\wHLWUkt.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\HlThlLj.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\bVFHjSk.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\cJJCuHO.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\OUQwico.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\ItaBcnc.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\VpLvblh.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\TNvJtEw.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\fzdSZLJ.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\DTzjDcI.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\WCAvEWf.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\sKmjTIe.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\WVJHyZi.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\pBSpLlh.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\jVVuEeC.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\QmBmmwH.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\VbFCFaB.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\nKCwGgw.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\vKtganO.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\dIJJjgS.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\toiMeXG.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\XwEDNWP.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\PFiQGsT.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\iojRFQK.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\LYGwoWJ.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\whbqSjo.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\lEIkHZN.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\oDyhOrU.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\yXwuWDs.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\JYscEzr.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\ubdgwvk.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\RZEXXag.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\muHftkP.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\AgYJKip.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\nASxaJs.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\cAzyhEq.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\pTdRbIj.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\scCaOKS.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\yTQPPbZ.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\OytiNUj.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\zDJYHyk.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\XzZJnvn.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\zgfIPMO.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\INcfwoK.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\eAGVyOl.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\WcfWyov.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\LGLdoKd.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\WXfHUwx.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\BokWfib.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\QcZgpAV.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\EerjjnR.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\DvpFmlk.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\bHcrTlA.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\tTIEgFq.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\MnGkvXl.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
File created	C:\Windows\System32\USHYYmH.exe	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 4112	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	84
PID 788 wrote to memory of 4112	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	84
PID 788 wrote to memory of 4468	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	85
PID 788 wrote to memory of 4468	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	85
PID 788 wrote to memory of 3496	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	86
PID 788 wrote to memory of 3496	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	86
PID 788 wrote to memory of 1912	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	87
PID 788 wrote to memory of 1912	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	87
PID 788 wrote to memory of 4816	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	88
PID 788 wrote to memory of 4816	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	88
PID 788 wrote to memory of 2908	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	89
PID 788 wrote to memory of 2908	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	89
PID 788 wrote to memory of 3732	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	90
PID 788 wrote to memory of 3732	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	90
PID 788 wrote to memory of 3296	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	91
PID 788 wrote to memory of 3296	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	91
PID 788 wrote to memory of 3096	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	93
PID 788 wrote to memory of 3096	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	93
PID 788 wrote to memory of 4880	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	94
PID 788 wrote to memory of 4880	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	94
PID 788 wrote to memory of 1516	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	95
PID 788 wrote to memory of 1516	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	95
PID 788 wrote to memory of 4984	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	96
PID 788 wrote to memory of 4984	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	96
PID 788 wrote to memory of 2352	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	97
PID 788 wrote to memory of 2352	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	97
PID 788 wrote to memory of 2588	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	98
PID 788 wrote to memory of 2588	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	98
PID 788 wrote to memory of 980	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	99
PID 788 wrote to memory of 980	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	99
PID 788 wrote to memory of 2916	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	100
PID 788 wrote to memory of 2916	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	100
PID 788 wrote to memory of 3724	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	101
PID 788 wrote to memory of 3724	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	101
PID 788 wrote to memory of 2012	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	102
PID 788 wrote to memory of 2012	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	102
PID 788 wrote to memory of 1324	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	103
PID 788 wrote to memory of 1324	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	103
PID 788 wrote to memory of 4356	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	104
PID 788 wrote to memory of 4356	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	104
PID 788 wrote to memory of 892	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	105
PID 788 wrote to memory of 892	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	105
PID 788 wrote to memory of 4900	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	106
PID 788 wrote to memory of 4900	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	106
PID 788 wrote to memory of 4800	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	107
PID 788 wrote to memory of 4800	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	107
PID 788 wrote to memory of 5116	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	108
PID 788 wrote to memory of 5116	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	108
PID 788 wrote to memory of 1816	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	109
PID 788 wrote to memory of 1816	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	109
PID 788 wrote to memory of 4140	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	110
PID 788 wrote to memory of 4140	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	110
PID 788 wrote to memory of 564	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	111
PID 788 wrote to memory of 564	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	111
PID 788 wrote to memory of 3736	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	112
PID 788 wrote to memory of 3736	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	112
PID 788 wrote to memory of 3668	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	113
PID 788 wrote to memory of 3668	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	113
PID 788 wrote to memory of 3164	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	114
PID 788 wrote to memory of 3164	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	114
PID 788 wrote to memory of 4856	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	115
PID 788 wrote to memory of 4856	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	115
PID 788 wrote to memory of 3272	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	116
PID 788 wrote to memory of 3272	788	ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ad640e915ae44a7d13b7c8bea3d27620_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\System32\oHkhLQi.exe
  C:\Windows\System32\oHkhLQi.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System32\yIUUryn.exe
  C:\Windows\System32\yIUUryn.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System32\zoWsTxd.exe
  C:\Windows\System32\zoWsTxd.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System32\zmqOAAa.exe
  C:\Windows\System32\zmqOAAa.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System32\SaKlogN.exe
  C:\Windows\System32\SaKlogN.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System32\MhLAlho.exe
  C:\Windows\System32\MhLAlho.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System32\pQLdZQK.exe
  C:\Windows\System32\pQLdZQK.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System32\ElHhnhZ.exe
  C:\Windows\System32\ElHhnhZ.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System32\WCAvEWf.exe
  C:\Windows\System32\WCAvEWf.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System32\TdQRMxy.exe
  C:\Windows\System32\TdQRMxy.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System32\dZxVOcD.exe
  C:\Windows\System32\dZxVOcD.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System32\bkXYJbs.exe
  C:\Windows\System32\bkXYJbs.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System32\OgLOwsh.exe
  C:\Windows\System32\OgLOwsh.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System32\IiOSQRs.exe
  C:\Windows\System32\IiOSQRs.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System32\WAZRAFJ.exe
  C:\Windows\System32\WAZRAFJ.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System32\UKPszbt.exe
  C:\Windows\System32\UKPszbt.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System32\ZLOzNzU.exe
  C:\Windows\System32\ZLOzNzU.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System32\OUQwico.exe
  C:\Windows\System32\OUQwico.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System32\cjJWxon.exe
  C:\Windows\System32\cjJWxon.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System32\soPzDNH.exe
  C:\Windows\System32\soPzDNH.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System32\uXtJWMw.exe
  C:\Windows\System32\uXtJWMw.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System32\SsHKHeV.exe
  C:\Windows\System32\SsHKHeV.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System32\OwcYoRi.exe
  C:\Windows\System32\OwcYoRi.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System32\gfGxcDr.exe
  C:\Windows\System32\gfGxcDr.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System32\BXPblfc.exe
  C:\Windows\System32\BXPblfc.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System32\CgHSnun.exe
  C:\Windows\System32\CgHSnun.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System32\yLaroTh.exe
  C:\Windows\System32\yLaroTh.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System32\vPNJkFz.exe
  C:\Windows\System32\vPNJkFz.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System32\PSBFaRI.exe
  C:\Windows\System32\PSBFaRI.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System32\QvAygOa.exe
  C:\Windows\System32\QvAygOa.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System32\INcfwoK.exe
  C:\Windows\System32\INcfwoK.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System32\BadhMJb.exe
  C:\Windows\System32\BadhMJb.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System32\pVEctry.exe
  C:\Windows\System32\pVEctry.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System32\RZEXXag.exe
  C:\Windows\System32\RZEXXag.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System32\NPThqFW.exe
  C:\Windows\System32\NPThqFW.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System32\gXEeOBj.exe
  C:\Windows\System32\gXEeOBj.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System32\PlqBsOB.exe
  C:\Windows\System32\PlqBsOB.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System32\UMWxZWW.exe
  C:\Windows\System32\UMWxZWW.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System32\TRSKWFe.exe
  C:\Windows\System32\TRSKWFe.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System32\kKAXNIE.exe
  C:\Windows\System32\kKAXNIE.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System32\SxZjCGR.exe
  C:\Windows\System32\SxZjCGR.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System32\toiMeXG.exe
  C:\Windows\System32\toiMeXG.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System32\tSZAZmn.exe
  C:\Windows\System32\tSZAZmn.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System32\ZUePZmA.exe
  C:\Windows\System32\ZUePZmA.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System32\DxRobEl.exe
  C:\Windows\System32\DxRobEl.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System32\mRdmnRk.exe
  C:\Windows\System32\mRdmnRk.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System32\JPvdWpG.exe
  C:\Windows\System32\JPvdWpG.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System32\UGMhPtY.exe
  C:\Windows\System32\UGMhPtY.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System32\uLgggLA.exe
  C:\Windows\System32\uLgggLA.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System32\maZfIpm.exe
  C:\Windows\System32\maZfIpm.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System32\bkrMzKe.exe
  C:\Windows\System32\bkrMzKe.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System32\CbArvAi.exe
  C:\Windows\System32\CbArvAi.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System32\bwOurgb.exe
  C:\Windows\System32\bwOurgb.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System32\CXQyAIM.exe
  C:\Windows\System32\CXQyAIM.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System32\UNZiaFb.exe
  C:\Windows\System32\UNZiaFb.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System32\CNIoBrn.exe
  C:\Windows\System32\CNIoBrn.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System32\jWAKGil.exe
  C:\Windows\System32\jWAKGil.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System32\scCaOKS.exe
  C:\Windows\System32\scCaOKS.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System32\FVJEQrI.exe
  C:\Windows\System32\FVJEQrI.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System32\vFxjIhP.exe
  C:\Windows\System32\vFxjIhP.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System32\ZXUMPGw.exe
  C:\Windows\System32\ZXUMPGw.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System32\yRirIuX.exe
  C:\Windows\System32\yRirIuX.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System32\vYbygZH.exe
  C:\Windows\System32\vYbygZH.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System32\SQDdixm.exe
  C:\Windows\System32\SQDdixm.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System32\rGxIOls.exe
  C:\Windows\System32\rGxIOls.exe
  2⤵
  PID:3536
- C:\Windows\System32\OcXkZZj.exe
  C:\Windows\System32\OcXkZZj.exe
  2⤵
  PID:4540
- C:\Windows\System32\JZyghlN.exe
  C:\Windows\System32\JZyghlN.exe
  2⤵
  PID:2936
- C:\Windows\System32\NKOvLFg.exe
  C:\Windows\System32\NKOvLFg.exe
  2⤵
  PID:1892
- C:\Windows\System32\SRYhNiV.exe
  C:\Windows\System32\SRYhNiV.exe
  2⤵
  PID:4576
- C:\Windows\System32\YkywYnT.exe
  C:\Windows\System32\YkywYnT.exe
  2⤵
  PID:2496
- C:\Windows\System32\JDMgVwk.exe
  C:\Windows\System32\JDMgVwk.exe
  2⤵
  PID:4136
- C:\Windows\System32\eQiuAwU.exe
  C:\Windows\System32\eQiuAwU.exe
  2⤵
  PID:3328
- C:\Windows\System32\XSIyDvT.exe
  C:\Windows\System32\XSIyDvT.exe
  2⤵
  PID:3904
- C:\Windows\System32\LmxiLts.exe
  C:\Windows\System32\LmxiLts.exe
  2⤵
  PID:2332
- C:\Windows\System32\CpmQVbY.exe
  C:\Windows\System32\CpmQVbY.exe
  2⤵
  PID:672
- C:\Windows\System32\rypfTOr.exe
  C:\Windows\System32\rypfTOr.exe
  2⤵
  PID:3984
- C:\Windows\System32\ItaBcnc.exe
  C:\Windows\System32\ItaBcnc.exe
  2⤵
  PID:2232
- C:\Windows\System32\xYjlpqI.exe
  C:\Windows\System32\xYjlpqI.exe
  2⤵
  PID:5132
- C:\Windows\System32\OnPKyDs.exe
  C:\Windows\System32\OnPKyDs.exe
  2⤵
  PID:5160
- C:\Windows\System32\YBmaWWm.exe
  C:\Windows\System32\YBmaWWm.exe
  2⤵
  PID:5188
- C:\Windows\System32\JfEtYYq.exe
  C:\Windows\System32\JfEtYYq.exe
  2⤵
  PID:5216
- C:\Windows\System32\LMDiSYw.exe
  C:\Windows\System32\LMDiSYw.exe
  2⤵
  PID:5244
- C:\Windows\System32\PLTGgao.exe
  C:\Windows\System32\PLTGgao.exe
  2⤵
  PID:5272
- C:\Windows\System32\ahHeUXD.exe
  C:\Windows\System32\ahHeUXD.exe
  2⤵
  PID:5300
- C:\Windows\System32\VpLvblh.exe
  C:\Windows\System32\VpLvblh.exe
  2⤵
  PID:5328
- C:\Windows\System32\YbsRVrE.exe
  C:\Windows\System32\YbsRVrE.exe
  2⤵
  PID:5356
- C:\Windows\System32\wAQfMlB.exe
  C:\Windows\System32\wAQfMlB.exe
  2⤵
  PID:5392
- C:\Windows\System32\iCqRTON.exe
  C:\Windows\System32\iCqRTON.exe
  2⤵
  PID:5412
- C:\Windows\System32\VbFCFaB.exe
  C:\Windows\System32\VbFCFaB.exe
  2⤵
  PID:5440
- C:\Windows\System32\nZKDucp.exe
  C:\Windows\System32\nZKDucp.exe
  2⤵
  PID:5468
- C:\Windows\System32\IroXCXq.exe
  C:\Windows\System32\IroXCXq.exe
  2⤵
  PID:5504
- C:\Windows\System32\RBqsrtn.exe
  C:\Windows\System32\RBqsrtn.exe
  2⤵
  PID:5524
- C:\Windows\System32\ZiszghJ.exe
  C:\Windows\System32\ZiszghJ.exe
  2⤵
  PID:5552
- C:\Windows\System32\UNLdSMf.exe
  C:\Windows\System32\UNLdSMf.exe
  2⤵
  PID:5580
- C:\Windows\System32\KmkbuWs.exe
  C:\Windows\System32\KmkbuWs.exe
  2⤵
  PID:5608
- C:\Windows\System32\cAzyhEq.exe
  C:\Windows\System32\cAzyhEq.exe
  2⤵
  PID:5636
- C:\Windows\System32\hCzmyWe.exe
  C:\Windows\System32\hCzmyWe.exe
  2⤵
  PID:5664
- C:\Windows\System32\PvCGQEF.exe
  C:\Windows\System32\PvCGQEF.exe
  2⤵
  PID:5700
- C:\Windows\System32\UiBBjAy.exe
  C:\Windows\System32\UiBBjAy.exe
  2⤵
  PID:5720
- C:\Windows\System32\zztnTAb.exe
  C:\Windows\System32\zztnTAb.exe
  2⤵
  PID:5748
- C:\Windows\System32\zUZbCFx.exe
  C:\Windows\System32\zUZbCFx.exe
  2⤵
  PID:5776
- C:\Windows\System32\sjTFKeL.exe
  C:\Windows\System32\sjTFKeL.exe
  2⤵
  PID:5804
- C:\Windows\System32\qjyXqUR.exe
  C:\Windows\System32\qjyXqUR.exe
  2⤵
  PID:5832
- C:\Windows\System32\pzpVZdf.exe
  C:\Windows\System32\pzpVZdf.exe
  2⤵
  PID:5868
- C:\Windows\System32\RocIJcN.exe
  C:\Windows\System32\RocIJcN.exe
  2⤵
  PID:5888
- C:\Windows\System32\NUAgaAB.exe
  C:\Windows\System32\NUAgaAB.exe
  2⤵
  PID:5940
- C:\Windows\System32\iWuptmu.exe
  C:\Windows\System32\iWuptmu.exe
  2⤵
  PID:5988
- C:\Windows\System32\MdjTfEw.exe
  C:\Windows\System32\MdjTfEw.exe
  2⤵
  PID:6008
- C:\Windows\System32\rECLSew.exe
  C:\Windows\System32\rECLSew.exe
  2⤵
  PID:6024
- C:\Windows\System32\GiaTcaI.exe
  C:\Windows\System32\GiaTcaI.exe
  2⤵
  PID:6048
- C:\Windows\System32\meKWOFj.exe
  C:\Windows\System32\meKWOFj.exe
  2⤵
  PID:6100
- C:\Windows\System32\wBLiMpL.exe
  C:\Windows\System32\wBLiMpL.exe
  2⤵
  PID:3184
- C:\Windows\System32\erwWdGl.exe
  C:\Windows\System32\erwWdGl.exe
  2⤵
  PID:2448
- C:\Windows\System32\sTzKoIi.exe
  C:\Windows\System32\sTzKoIi.exe
  2⤵
  PID:1084
- C:\Windows\System32\BawhdUy.exe
  C:\Windows\System32\BawhdUy.exe
  2⤵
  PID:5148
- C:\Windows\System32\wpFcOAJ.exe
  C:\Windows\System32\wpFcOAJ.exe
  2⤵
  PID:5228
- C:\Windows\System32\uqcPSCF.exe
  C:\Windows\System32\uqcPSCF.exe
  2⤵
  PID:5296
- C:\Windows\System32\IKKAMrK.exe
  C:\Windows\System32\IKKAMrK.exe
  2⤵
  PID:5344
- C:\Windows\System32\pkxSTdw.exe
  C:\Windows\System32\pkxSTdw.exe
  2⤵
  PID:5428
- C:\Windows\System32\aWisbNI.exe
  C:\Windows\System32\aWisbNI.exe
  2⤵
  PID:5500
- C:\Windows\System32\WqeaCQr.exe
  C:\Windows\System32\WqeaCQr.exe
  2⤵
  PID:5604
- C:\Windows\System32\JVtiKdR.exe
  C:\Windows\System32\JVtiKdR.exe
  2⤵
  PID:5688
- C:\Windows\System32\rKMxzQm.exe
  C:\Windows\System32\rKMxzQm.exe
  2⤵
  PID:5760
- C:\Windows\System32\xihLXdY.exe
  C:\Windows\System32\xihLXdY.exe
  2⤵
  PID:5864
- C:\Windows\System32\BiGygdW.exe
  C:\Windows\System32\BiGygdW.exe
  2⤵
  PID:4948
- C:\Windows\System32\hTFDawh.exe
  C:\Windows\System32\hTFDawh.exe
  2⤵
  PID:3424
- C:\Windows\System32\xnAxnVJ.exe
  C:\Windows\System32\xnAxnVJ.exe
  2⤵
  PID:6000
- C:\Windows\System32\ECFokFz.exe
  C:\Windows\System32\ECFokFz.exe
  2⤵
  PID:6004
- C:\Windows\System32\XYJSVeL.exe
  C:\Windows\System32\XYJSVeL.exe
  2⤵
  PID:6056
- C:\Windows\System32\XwEDNWP.exe
  C:\Windows\System32\XwEDNWP.exe
  2⤵
  PID:6140
- C:\Windows\System32\bercGLN.exe
  C:\Windows\System32\bercGLN.exe
  2⤵
  PID:600
- C:\Windows\System32\ZrZoCte.exe
  C:\Windows\System32\ZrZoCte.exe
  2⤵
  PID:1076
- C:\Windows\System32\pQvabJX.exe
  C:\Windows\System32\pQvabJX.exe
  2⤵
  PID:3380
- C:\Windows\System32\VpEHfQn.exe
  C:\Windows\System32\VpEHfQn.exe
  2⤵
  PID:5204
- C:\Windows\System32\KxsShnA.exe
  C:\Windows\System32\KxsShnA.exe
  2⤵
  PID:5340
- C:\Windows\System32\sKmjTIe.exe
  C:\Windows\System32\sKmjTIe.exe
  2⤵
  PID:2272
- C:\Windows\System32\GADwiMz.exe
  C:\Windows\System32\GADwiMz.exe
  2⤵
  PID:5712
- C:\Windows\System32\HecAsAt.exe
  C:\Windows\System32\HecAsAt.exe
  2⤵
  PID:2504
- C:\Windows\System32\PEZAZDs.exe
  C:\Windows\System32\PEZAZDs.exe
  2⤵
  PID:5960
- C:\Windows\System32\xtOxxdz.exe
  C:\Windows\System32\xtOxxdz.exe
  2⤵
  PID:5576
- C:\Windows\System32\WVJwGwK.exe
  C:\Windows\System32\WVJwGwK.exe
  2⤵
  PID:3416
- C:\Windows\System32\UYPHbih.exe
  C:\Windows\System32\UYPHbih.exe
  2⤵
  PID:4808
- C:\Windows\System32\luwVXJT.exe
  C:\Windows\System32\luwVXJT.exe
  2⤵
  PID:5156
- C:\Windows\System32\fgBCkXv.exe
  C:\Windows\System32\fgBCkXv.exe
  2⤵
  PID:1260
- C:\Windows\System32\DTCSvZp.exe
  C:\Windows\System32\DTCSvZp.exe
  2⤵
  PID:5716
- C:\Windows\System32\bAkRdOX.exe
  C:\Windows\System32\bAkRdOX.exe
  2⤵
  PID:5516
- C:\Windows\System32\rWifByI.exe
  C:\Windows\System32\rWifByI.exe
  2⤵
  PID:4508
- C:\Windows\System32\pYGSRGY.exe
  C:\Windows\System32\pYGSRGY.exe
  2⤵
  PID:1508
- C:\Windows\System32\fzRCfAp.exe
  C:\Windows\System32\fzRCfAp.exe
  2⤵
  PID:5592
- C:\Windows\System32\bqEDAol.exe
  C:\Windows\System32\bqEDAol.exe
  2⤵
  PID:2384
- C:\Windows\System32\kmHEVZS.exe
  C:\Windows\System32\kmHEVZS.exe
  2⤵
  PID:5936
- C:\Windows\System32\FIOyBbJ.exe
  C:\Windows\System32\FIOyBbJ.exe
  2⤵
  PID:6164
- C:\Windows\System32\muHftkP.exe
  C:\Windows\System32\muHftkP.exe
  2⤵
  PID:6184
- C:\Windows\System32\lPWKKsa.exe
  C:\Windows\System32\lPWKKsa.exe
  2⤵
  PID:6220
- C:\Windows\System32\yoYDbJC.exe
  C:\Windows\System32\yoYDbJC.exe
  2⤵
  PID:6252
- C:\Windows\System32\eVqdPlN.exe
  C:\Windows\System32\eVqdPlN.exe
  2⤵
  PID:6280
- C:\Windows\System32\nWkmcWG.exe
  C:\Windows\System32\nWkmcWG.exe
  2⤵
  PID:6308
- C:\Windows\System32\uuaaxua.exe
  C:\Windows\System32\uuaaxua.exe
  2⤵
  PID:6348
- C:\Windows\System32\htCNHLA.exe
  C:\Windows\System32\htCNHLA.exe
  2⤵
  PID:6392
- C:\Windows\System32\LaxXUQd.exe
  C:\Windows\System32\LaxXUQd.exe
  2⤵
  PID:6424
- C:\Windows\System32\qswHAlX.exe
  C:\Windows\System32\qswHAlX.exe
  2⤵
  PID:6472
- C:\Windows\System32\CgVTTEQ.exe
  C:\Windows\System32\CgVTTEQ.exe
  2⤵
  PID:6504
- C:\Windows\System32\gVclKJx.exe
  C:\Windows\System32\gVclKJx.exe
  2⤵
  PID:6544
- C:\Windows\System32\ktuGMyF.exe
  C:\Windows\System32\ktuGMyF.exe
  2⤵
  PID:6568
- C:\Windows\System32\SnZyxdN.exe
  C:\Windows\System32\SnZyxdN.exe
  2⤵
  PID:6592
- C:\Windows\System32\XUTjjZW.exe
  C:\Windows\System32\XUTjjZW.exe
  2⤵
  PID:6608
- C:\Windows\System32\fkiRGDl.exe
  C:\Windows\System32\fkiRGDl.exe
  2⤵
  PID:6624
- C:\Windows\System32\VXsCYll.exe
  C:\Windows\System32\VXsCYll.exe
  2⤵
  PID:6672
- C:\Windows\System32\LgbrAta.exe
  C:\Windows\System32\LgbrAta.exe
  2⤵
  PID:6704
- C:\Windows\System32\OAnckzY.exe
  C:\Windows\System32\OAnckzY.exe
  2⤵
  PID:6740
- C:\Windows\System32\vZJkTjL.exe
  C:\Windows\System32\vZJkTjL.exe
  2⤵
  PID:6772
- C:\Windows\System32\drQXCXk.exe
  C:\Windows\System32\drQXCXk.exe
  2⤵
  PID:6800
- C:\Windows\System32\bOMjjZh.exe
  C:\Windows\System32\bOMjjZh.exe
  2⤵
  PID:6820
- C:\Windows\System32\ottKKXG.exe
  C:\Windows\System32\ottKKXG.exe
  2⤵
  PID:6852
- C:\Windows\System32\xHRRphV.exe
  C:\Windows\System32\xHRRphV.exe
  2⤵
  PID:6880
- C:\Windows\System32\XnTAuSe.exe
  C:\Windows\System32\XnTAuSe.exe
  2⤵
  PID:6896
- C:\Windows\System32\NwwxvAG.exe
  C:\Windows\System32\NwwxvAG.exe
  2⤵
  PID:6948
- C:\Windows\System32\TNvJtEw.exe
  C:\Windows\System32\TNvJtEw.exe
  2⤵
  PID:6992
- C:\Windows\System32\CDRWlre.exe
  C:\Windows\System32\CDRWlre.exe
  2⤵
  PID:7044
- C:\Windows\System32\NEpoNMg.exe
  C:\Windows\System32\NEpoNMg.exe
  2⤵
  PID:7072
- C:\Windows\System32\JwfMryD.exe
  C:\Windows\System32\JwfMryD.exe
  2⤵
  PID:7100
- C:\Windows\System32\IncVluJ.exe
  C:\Windows\System32\IncVluJ.exe
  2⤵
  PID:7120
- C:\Windows\System32\wUvZQlV.exe
  C:\Windows\System32\wUvZQlV.exe
  2⤵
  PID:7152
- C:\Windows\System32\XuFRsQh.exe
  C:\Windows\System32\XuFRsQh.exe
  2⤵
  PID:6172
- C:\Windows\System32\ivnZyyl.exe
  C:\Windows\System32\ivnZyyl.exe
  2⤵
  PID:6120
- C:\Windows\System32\WeNeDhc.exe
  C:\Windows\System32\WeNeDhc.exe
  2⤵
  PID:6236
- C:\Windows\System32\JaEIliM.exe
  C:\Windows\System32\JaEIliM.exe
  2⤵
  PID:5924
- C:\Windows\System32\AUVuKYu.exe
  C:\Windows\System32\AUVuKYu.exe
  2⤵
  PID:6344
- C:\Windows\System32\xEUlsJy.exe
  C:\Windows\System32\xEUlsJy.exe
  2⤵
  PID:6416
- C:\Windows\System32\yCjCpCw.exe
  C:\Windows\System32\yCjCpCw.exe
  2⤵
  PID:6552
- C:\Windows\System32\KPhDDNv.exe
  C:\Windows\System32\KPhDDNv.exe
  2⤵
  PID:6588
- C:\Windows\System32\nrcEEOf.exe
  C:\Windows\System32\nrcEEOf.exe
  2⤵
  PID:6644
- C:\Windows\System32\OzBChmf.exe
  C:\Windows\System32\OzBChmf.exe
  2⤵
  PID:6716
- C:\Windows\System32\wvhwHZj.exe
  C:\Windows\System32\wvhwHZj.exe
  2⤵
  PID:6752
- C:\Windows\System32\RLphkif.exe
  C:\Windows\System32\RLphkif.exe
  2⤵
  PID:6844
- C:\Windows\System32\TiUmFZG.exe
  C:\Windows\System32\TiUmFZG.exe
  2⤵
  PID:6932
- C:\Windows\System32\dLcgUuM.exe
  C:\Windows\System32\dLcgUuM.exe
  2⤵
  PID:7028
- C:\Windows\System32\treheoR.exe
  C:\Windows\System32\treheoR.exe
  2⤵
  PID:7084
- C:\Windows\System32\qIsWhxY.exe
  C:\Windows\System32\qIsWhxY.exe
  2⤵
  PID:7132
- C:\Windows\System32\XsfygeD.exe
  C:\Windows\System32\XsfygeD.exe
  2⤵
  PID:5568
- C:\Windows\System32\DgJdCRh.exe
  C:\Windows\System32\DgJdCRh.exe
  2⤵
  PID:6208
- C:\Windows\System32\oKznzvJ.exe
  C:\Windows\System32\oKznzvJ.exe
  2⤵
  PID:6448
- C:\Windows\System32\cvggMBP.exe
  C:\Windows\System32\cvggMBP.exe
  2⤵
  PID:6652
- C:\Windows\System32\hymFUrI.exe
  C:\Windows\System32\hymFUrI.exe
  2⤵
  PID:6816
- C:\Windows\System32\EdKcCOH.exe
  C:\Windows\System32\EdKcCOH.exe
  2⤵
  PID:5928
- C:\Windows\System32\mdRsdHb.exe
  C:\Windows\System32\mdRsdHb.exe
  2⤵
  PID:7160
- C:\Windows\System32\pcgQxSg.exe
  C:\Windows\System32\pcgQxSg.exe
  2⤵
  PID:6320
- C:\Windows\System32\juyunqT.exe
  C:\Windows\System32\juyunqT.exe
  2⤵
  PID:6748
- C:\Windows\System32\LqglzNd.exe
  C:\Windows\System32\LqglzNd.exe
  2⤵
  PID:7108
- C:\Windows\System32\gTmpSxZ.exe
  C:\Windows\System32\gTmpSxZ.exe
  2⤵
  PID:5632
- C:\Windows\System32\DlOtwAo.exe
  C:\Windows\System32\DlOtwAo.exe
  2⤵
  PID:7176
- C:\Windows\System32\rBUaGLa.exe
  C:\Windows\System32\rBUaGLa.exe
  2⤵
  PID:7196
- C:\Windows\System32\WtVVRwE.exe
  C:\Windows\System32\WtVVRwE.exe
  2⤵
  PID:7232
- C:\Windows\System32\IQLHvJj.exe
  C:\Windows\System32\IQLHvJj.exe
  2⤵
  PID:7260
- C:\Windows\System32\GWBkKkE.exe
  C:\Windows\System32\GWBkKkE.exe
  2⤵
  PID:7292
- C:\Windows\System32\XmnzVJJ.exe
  C:\Windows\System32\XmnzVJJ.exe
  2⤵
  PID:7328
- C:\Windows\System32\KCMcuGG.exe
  C:\Windows\System32\KCMcuGG.exe
  2⤵
  PID:7372
- C:\Windows\System32\uXTJpZm.exe
  C:\Windows\System32\uXTJpZm.exe
  2⤵
  PID:7412
- C:\Windows\System32\QcZgpAV.exe
  C:\Windows\System32\QcZgpAV.exe
  2⤵
  PID:7464
- C:\Windows\System32\UvRRukT.exe
  C:\Windows\System32\UvRRukT.exe
  2⤵
  PID:7524
- C:\Windows\System32\duZFHZK.exe
  C:\Windows\System32\duZFHZK.exe
  2⤵
  PID:7576
- C:\Windows\System32\yTQPPbZ.exe
  C:\Windows\System32\yTQPPbZ.exe
  2⤵
  PID:7624
- C:\Windows\System32\nSwCJdN.exe
  C:\Windows\System32\nSwCJdN.exe
  2⤵
  PID:7660
- C:\Windows\System32\FbdNNCL.exe
  C:\Windows\System32\FbdNNCL.exe
  2⤵
  PID:7684
- C:\Windows\System32\qUZzNXG.exe
  C:\Windows\System32\qUZzNXG.exe
  2⤵
  PID:7716
- C:\Windows\System32\FlhbhWD.exe
  C:\Windows\System32\FlhbhWD.exe
  2⤵
  PID:7752
- C:\Windows\System32\osZmgTz.exe
  C:\Windows\System32\osZmgTz.exe
  2⤵
  PID:7792
- C:\Windows\System32\PFiQGsT.exe
  C:\Windows\System32\PFiQGsT.exe
  2⤵
  PID:7832
- C:\Windows\System32\KZVWLbY.exe
  C:\Windows\System32\KZVWLbY.exe
  2⤵
  PID:7852
- C:\Windows\System32\QDikYHO.exe
  C:\Windows\System32\QDikYHO.exe
  2⤵
  PID:7888
- C:\Windows\System32\WVJHyZi.exe
  C:\Windows\System32\WVJHyZi.exe
  2⤵
  PID:7908
- C:\Windows\System32\qnnBsJt.exe
  C:\Windows\System32\qnnBsJt.exe
  2⤵
  PID:7944
- C:\Windows\System32\nfsNTWk.exe
  C:\Windows\System32\nfsNTWk.exe
  2⤵
  PID:7972
- C:\Windows\System32\iojRFQK.exe
  C:\Windows\System32\iojRFQK.exe
  2⤵
  PID:8000
- C:\Windows\System32\AohuXdQ.exe
  C:\Windows\System32\AohuXdQ.exe
  2⤵
  PID:8032
- C:\Windows\System32\tTIEgFq.exe
  C:\Windows\System32\tTIEgFq.exe
  2⤵
  PID:8052
- C:\Windows\System32\rzEMyqm.exe
  C:\Windows\System32\rzEMyqm.exe
  2⤵
  PID:8084
- C:\Windows\System32\NJosQnR.exe
  C:\Windows\System32\NJosQnR.exe
  2⤵
  PID:8108
- C:\Windows\System32\fpOuxsY.exe
  C:\Windows\System32\fpOuxsY.exe
  2⤵
  PID:8144
- C:\Windows\System32\XRgCnGn.exe
  C:\Windows\System32\XRgCnGn.exe
  2⤵
  PID:8168
- C:\Windows\System32\LYGwoWJ.exe
  C:\Windows\System32\LYGwoWJ.exe
  2⤵
  PID:7184
- C:\Windows\System32\uOTNNyt.exe
  C:\Windows\System32\uOTNNyt.exe
  2⤵
  PID:6060
- C:\Windows\System32\YTUZLDx.exe
  C:\Windows\System32\YTUZLDx.exe
  2⤵
  PID:7300
- C:\Windows\System32\YmlvkAp.exe
  C:\Windows\System32\YmlvkAp.exe
  2⤵
  PID:7404
- C:\Windows\System32\whbqSjo.exe
  C:\Windows\System32\whbqSjo.exe
  2⤵
  PID:7556
- C:\Windows\System32\TVhNaUl.exe
  C:\Windows\System32\TVhNaUl.exe
  2⤵
  PID:5996
- C:\Windows\System32\OytiNUj.exe
  C:\Windows\System32\OytiNUj.exe
  2⤵
  PID:7708
- C:\Windows\System32\zCNTzaY.exe
  C:\Windows\System32\zCNTzaY.exe
  2⤵
  PID:7780
- C:\Windows\System32\luUDzEd.exe
  C:\Windows\System32\luUDzEd.exe
  2⤵
  PID:7864
- C:\Windows\System32\MnGkvXl.exe
  C:\Windows\System32\MnGkvXl.exe
  2⤵
  PID:7900
- C:\Windows\System32\LFZrQiA.exe
  C:\Windows\System32\LFZrQiA.exe
  2⤵
  PID:7960
- C:\Windows\System32\KMPraXV.exe
  C:\Windows\System32\KMPraXV.exe
  2⤵
  PID:8040
- C:\Windows\System32\ehspmry.exe
  C:\Windows\System32\ehspmry.exe
  2⤵
  PID:8100
- C:\Windows\System32\djQYofQ.exe
  C:\Windows\System32\djQYofQ.exe
  2⤵
  PID:8184
- C:\Windows\System32\lAgPzwy.exe
  C:\Windows\System32\lAgPzwy.exe
  2⤵
  PID:7324
- C:\Windows\System32\KYEcWRP.exe
  C:\Windows\System32\KYEcWRP.exe
  2⤵
  PID:7584
- C:\Windows\System32\qgvlkuc.exe
  C:\Windows\System32\qgvlkuc.exe
  2⤵
  PID:7728
- C:\Windows\System32\RaEBoyF.exe
  C:\Windows\System32\RaEBoyF.exe
  2⤵
  PID:7988
- C:\Windows\System32\HAcSFfh.exe
  C:\Windows\System32\HAcSFfh.exe
  2⤵
  PID:8096
- C:\Windows\System32\sjtUFRT.exe
  C:\Windows\System32\sjtUFRT.exe
  2⤵
  PID:7356
- C:\Windows\System32\RyppeRV.exe
  C:\Windows\System32\RyppeRV.exe
  2⤵
  PID:7816
- C:\Windows\System32\LGuJdBr.exe
  C:\Windows\System32\LGuJdBr.exe
  2⤵
  PID:7488
- C:\Windows\System32\YYWhVcW.exe
  C:\Windows\System32\YYWhVcW.exe
  2⤵
  PID:7192
- C:\Windows\System32\NmFYbKX.exe
  C:\Windows\System32\NmFYbKX.exe
  2⤵
  PID:8212
- C:\Windows\System32\atSsdSs.exe
  C:\Windows\System32\atSsdSs.exe
  2⤵
  PID:8236
- C:\Windows\System32\cWgWptJ.exe
  C:\Windows\System32\cWgWptJ.exe
  2⤵
  PID:8272
- C:\Windows\System32\iKQSBsp.exe
  C:\Windows\System32\iKQSBsp.exe
  2⤵
  PID:8292
- C:\Windows\System32\olusucm.exe
  C:\Windows\System32\olusucm.exe
  2⤵
  PID:8328
- C:\Windows\System32\iNERAuj.exe
  C:\Windows\System32\iNERAuj.exe
  2⤵
  PID:8356
- C:\Windows\System32\NcETvvz.exe
  C:\Windows\System32\NcETvvz.exe
  2⤵
  PID:8388
- C:\Windows\System32\jXvMPDl.exe
  C:\Windows\System32\jXvMPDl.exe
  2⤵
  PID:8408
- C:\Windows\System32\bQvuxCS.exe
  C:\Windows\System32\bQvuxCS.exe
  2⤵
  PID:8448
- C:\Windows\System32\ZKUWeEC.exe
  C:\Windows\System32\ZKUWeEC.exe
  2⤵
  PID:8472
- C:\Windows\System32\ZaplYGu.exe
  C:\Windows\System32\ZaplYGu.exe
  2⤵
  PID:8492
- C:\Windows\System32\DbrgFsC.exe
  C:\Windows\System32\DbrgFsC.exe
  2⤵
  PID:8528
- C:\Windows\System32\nXZoDlp.exe
  C:\Windows\System32\nXZoDlp.exe
  2⤵
  PID:8560
- C:\Windows\System32\ZWOBpyf.exe
  C:\Windows\System32\ZWOBpyf.exe
  2⤵
  PID:8588
- C:\Windows\System32\sbpqOhp.exe
  C:\Windows\System32\sbpqOhp.exe
  2⤵
  PID:8612
- C:\Windows\System32\XrDnvQn.exe
  C:\Windows\System32\XrDnvQn.exe
  2⤵
  PID:8648
- C:\Windows\System32\eAGVyOl.exe
  C:\Windows\System32\eAGVyOl.exe
  2⤵
  PID:8668
- C:\Windows\System32\jfwSmDe.exe
  C:\Windows\System32\jfwSmDe.exe
  2⤵
  PID:8696
- C:\Windows\System32\YEZAuQd.exe
  C:\Windows\System32\YEZAuQd.exe
  2⤵
  PID:8728
- C:\Windows\System32\ebyRiRf.exe
  C:\Windows\System32\ebyRiRf.exe
  2⤵
  PID:8752
- C:\Windows\System32\JCnwyWP.exe
  C:\Windows\System32\JCnwyWP.exe
  2⤵
  PID:8780
- C:\Windows\System32\LGLdoKd.exe
  C:\Windows\System32\LGLdoKd.exe
  2⤵
  PID:8800
- C:\Windows\System32\cDspKgq.exe
  C:\Windows\System32\cDspKgq.exe
  2⤵
  PID:8820
- C:\Windows\System32\XJpCbRD.exe
  C:\Windows\System32\XJpCbRD.exe
  2⤵
  PID:8872
- C:\Windows\System32\cMyMsOz.exe
  C:\Windows\System32\cMyMsOz.exe
  2⤵
  PID:8896
- C:\Windows\System32\TdJxPwp.exe
  C:\Windows\System32\TdJxPwp.exe
  2⤵
  PID:8924
- C:\Windows\System32\YaPtAFR.exe
  C:\Windows\System32\YaPtAFR.exe
  2⤵
  PID:8944
- C:\Windows\System32\ICOMXbM.exe
  C:\Windows\System32\ICOMXbM.exe
  2⤵
  PID:8992
- C:\Windows\System32\pvJhzhK.exe
  C:\Windows\System32\pvJhzhK.exe
  2⤵
  PID:9016
- C:\Windows\System32\HMUSeqP.exe
  C:\Windows\System32\HMUSeqP.exe
  2⤵
  PID:9044
- C:\Windows\System32\rwwUJtz.exe
  C:\Windows\System32\rwwUJtz.exe
  2⤵
  PID:9104
- C:\Windows\System32\TpvrufU.exe
  C:\Windows\System32\TpvrufU.exe
  2⤵
  PID:9136
- C:\Windows\System32\CqogiEJ.exe
  C:\Windows\System32\CqogiEJ.exe
  2⤵
  PID:9164
- C:\Windows\System32\yPVFTKo.exe
  C:\Windows\System32\yPVFTKo.exe
  2⤵
  PID:9192
- C:\Windows\System32\TUhPDyT.exe
  C:\Windows\System32\TUhPDyT.exe
  2⤵
  PID:8220
- C:\Windows\System32\pGqatSU.exe
  C:\Windows\System32\pGqatSU.exe
  2⤵
  PID:8284
- C:\Windows\System32\OkDUzCt.exe
  C:\Windows\System32\OkDUzCt.exe
  2⤵
  PID:8364
- C:\Windows\System32\YBwRjty.exe
  C:\Windows\System32\YBwRjty.exe
  2⤵
  PID:8428
- C:\Windows\System32\XTdUeXt.exe
  C:\Windows\System32\XTdUeXt.exe
  2⤵
  PID:8484
- C:\Windows\System32\iNHGZbI.exe
  C:\Windows\System32\iNHGZbI.exe
  2⤵
  PID:8548
- C:\Windows\System32\jXrNinc.exe
  C:\Windows\System32\jXrNinc.exe
  2⤵
  PID:8624
- C:\Windows\System32\idwtGox.exe
  C:\Windows\System32\idwtGox.exe
  2⤵
  PID:8680
- C:\Windows\System32\ZKxGPqm.exe
  C:\Windows\System32\ZKxGPqm.exe
  2⤵
  PID:8748
- C:\Windows\System32\mLYHPlD.exe
  C:\Windows\System32\mLYHPlD.exe
  2⤵
  PID:8812
- C:\Windows\System32\FdooLfi.exe
  C:\Windows\System32\FdooLfi.exe
  2⤵
  PID:8892
- C:\Windows\System32\zDJYHyk.exe
  C:\Windows\System32\zDJYHyk.exe
  2⤵
  PID:8940
- C:\Windows\System32\vhULvqH.exe
  C:\Windows\System32\vhULvqH.exe
  2⤵
  PID:9028
- C:\Windows\System32\hmuqCvD.exe
  C:\Windows\System32\hmuqCvD.exe
  2⤵
  PID:9128
- C:\Windows\System32\MFSJglX.exe
  C:\Windows\System32\MFSJglX.exe
  2⤵
  PID:9156
- C:\Windows\System32\VWrnDpC.exe
  C:\Windows\System32\VWrnDpC.exe
  2⤵
  PID:8280
- C:\Windows\System32\ebhKJXm.exe
  C:\Windows\System32\ebhKJXm.exe
  2⤵
  PID:8460
- C:\Windows\System32\aFYiyIA.exe
  C:\Windows\System32\aFYiyIA.exe
  2⤵
  PID:8580
- C:\Windows\System32\SalrChN.exe
  C:\Windows\System32\SalrChN.exe
  2⤵
  PID:8776
- C:\Windows\System32\uvsBlGI.exe
  C:\Windows\System32\uvsBlGI.exe
  2⤵
  PID:8916
- C:\Windows\System32\WdNwvzq.exe
  C:\Windows\System32\WdNwvzq.exe
  2⤵
  PID:9064
- C:\Windows\System32\qczyPqP.exe
  C:\Windows\System32\qczyPqP.exe
  2⤵
  PID:8200
- C:\Windows\System32\pBSpLlh.exe
  C:\Windows\System32\pBSpLlh.exe
  2⤵
  PID:8520
- C:\Windows\System32\lyZHYxO.exe
  C:\Windows\System32\lyZHYxO.exe
  2⤵
  PID:8964
- C:\Windows\System32\CBsvuMW.exe
  C:\Windows\System32\CBsvuMW.exe
  2⤵
  PID:8372
- C:\Windows\System32\JQgkjqR.exe
  C:\Windows\System32\JQgkjqR.exe
  2⤵
  PID:9152
- C:\Windows\System32\WxdcIIt.exe
  C:\Windows\System32\WxdcIIt.exe
  2⤵
  PID:9232
- C:\Windows\System32\ivkIfpZ.exe
  C:\Windows\System32\ivkIfpZ.exe
  2⤵
  PID:9260
- C:\Windows\System32\zQqQgZX.exe
  C:\Windows\System32\zQqQgZX.exe
  2⤵
  PID:9296
- C:\Windows\System32\crIaZZB.exe
  C:\Windows\System32\crIaZZB.exe
  2⤵
  PID:9316
- C:\Windows\System32\MMBgkzf.exe
  C:\Windows\System32\MMBgkzf.exe
  2⤵
  PID:9376
- C:\Windows\System32\nQuRcSg.exe
  C:\Windows\System32\nQuRcSg.exe
  2⤵
  PID:9408
- C:\Windows\System32\lBqqsgf.exe
  C:\Windows\System32\lBqqsgf.exe
  2⤵
  PID:9424
- C:\Windows\System32\nQyHZxD.exe
  C:\Windows\System32\nQyHZxD.exe
  2⤵
  PID:9456
- C:\Windows\System32\oVNWpGG.exe
  C:\Windows\System32\oVNWpGG.exe
  2⤵
  PID:9496
- C:\Windows\System32\BUXuUYL.exe
  C:\Windows\System32\BUXuUYL.exe
  2⤵
  PID:9532
- C:\Windows\System32\jRRxNDP.exe
  C:\Windows\System32\jRRxNDP.exe
  2⤵
  PID:9552
- C:\Windows\System32\cMislEQ.exe
  C:\Windows\System32\cMislEQ.exe
  2⤵
  PID:9580
- C:\Windows\System32\beufNYU.exe
  C:\Windows\System32\beufNYU.exe
  2⤵
  PID:9608
- C:\Windows\System32\ZcrOqcJ.exe
  C:\Windows\System32\ZcrOqcJ.exe
  2⤵
  PID:9640
- C:\Windows\System32\WoKahgm.exe
  C:\Windows\System32\WoKahgm.exe
  2⤵
  PID:9664
- C:\Windows\System32\bFqTEZP.exe
  C:\Windows\System32\bFqTEZP.exe
  2⤵
  PID:9692
- C:\Windows\System32\RzNFVSZ.exe
  C:\Windows\System32\RzNFVSZ.exe
  2⤵
  PID:9708
- C:\Windows\System32\NPMiwus.exe
  C:\Windows\System32\NPMiwus.exe
  2⤵
  PID:9740
- C:\Windows\System32\pkibCxN.exe
  C:\Windows\System32\pkibCxN.exe
  2⤵
  PID:9776
- C:\Windows\System32\VxHcVKX.exe
  C:\Windows\System32\VxHcVKX.exe
  2⤵
  PID:9804
- C:\Windows\System32\dhdHinH.exe
  C:\Windows\System32\dhdHinH.exe
  2⤵
  PID:9832
- C:\Windows\System32\TufgikH.exe
  C:\Windows\System32\TufgikH.exe
  2⤵
  PID:9860
- C:\Windows\System32\KIoItkv.exe
  C:\Windows\System32\KIoItkv.exe
  2⤵
  PID:9888
- C:\Windows\System32\hqxHQPY.exe
  C:\Windows\System32\hqxHQPY.exe
  2⤵
  PID:9916
- C:\Windows\System32\MeJxBpX.exe
  C:\Windows\System32\MeJxBpX.exe
  2⤵
  PID:9944
- C:\Windows\System32\eFjJyMH.exe
  C:\Windows\System32\eFjJyMH.exe
  2⤵
  PID:9972
- C:\Windows\System32\MEMLZRs.exe
  C:\Windows\System32\MEMLZRs.exe
  2⤵
  PID:10012
- C:\Windows\System32\dttANay.exe
  C:\Windows\System32\dttANay.exe
  2⤵
  PID:10028
- C:\Windows\System32\XoEninn.exe
  C:\Windows\System32\XoEninn.exe
  2⤵
  PID:10052
- C:\Windows\System32\jVVuEeC.exe
  C:\Windows\System32\jVVuEeC.exe
  2⤵
  PID:10084
- C:\Windows\System32\fuNHWuq.exe
  C:\Windows\System32\fuNHWuq.exe
  2⤵
  PID:10100
- C:\Windows\System32\dAxalEU.exe
  C:\Windows\System32\dAxalEU.exe
  2⤵
  PID:10140
- C:\Windows\System32\USHYYmH.exe
  C:\Windows\System32\USHYYmH.exe
  2⤵
  PID:10168
- C:\Windows\System32\XVbXcvo.exe
  C:\Windows\System32\XVbXcvo.exe
  2⤵
  PID:10196
- C:\Windows\System32\MaBmarV.exe
  C:\Windows\System32\MaBmarV.exe
  2⤵
  PID:10216
- C:\Windows\System32\mediyBY.exe
  C:\Windows\System32\mediyBY.exe
  2⤵
  PID:8796
- C:\Windows\System32\nKCwGgw.exe
  C:\Windows\System32\nKCwGgw.exe
  2⤵
  PID:9308
- C:\Windows\System32\OsBMSyQ.exe
  C:\Windows\System32\OsBMSyQ.exe
  2⤵
  PID:9400
- C:\Windows\System32\YrjVgmT.exe
  C:\Windows\System32\YrjVgmT.exe
  2⤵
  PID:9468
- C:\Windows\System32\DogGZHX.exe
  C:\Windows\System32\DogGZHX.exe
  2⤵
  PID:9540
- C:\Windows\System32\lfdDyTB.exe
  C:\Windows\System32\lfdDyTB.exe
  2⤵
  PID:9592
- C:\Windows\System32\EuiqXeB.exe
  C:\Windows\System32\EuiqXeB.exe
  2⤵
  PID:9660
- C:\Windows\System32\ALOYcyW.exe
  C:\Windows\System32\ALOYcyW.exe
  2⤵
  PID:9752
- C:\Windows\System32\cTjxFxF.exe
  C:\Windows\System32\cTjxFxF.exe
  2⤵
  PID:9796
- C:\Windows\System32\fsmpfdA.exe
  C:\Windows\System32\fsmpfdA.exe
  2⤵
  PID:9856
- C:\Windows\System32\nnlooBK.exe
  C:\Windows\System32\nnlooBK.exe
  2⤵
  PID:9928
- C:\Windows\System32\cfUzjje.exe
  C:\Windows\System32\cfUzjje.exe
  2⤵
  PID:9980
- C:\Windows\System32\hXZzRJE.exe
  C:\Windows\System32\hXZzRJE.exe
  2⤵
  PID:10068
- C:\Windows\System32\PZWcbGV.exe
  C:\Windows\System32\PZWcbGV.exe
  2⤵
  PID:10092
- C:\Windows\System32\mzPXHen.exe
  C:\Windows\System32\mzPXHen.exe
  2⤵
  PID:10188
- C:\Windows\System32\unnDpwl.exe
  C:\Windows\System32\unnDpwl.exe
  2⤵
  PID:10232
- C:\Windows\System32\PICcDiY.exe
  C:\Windows\System32\PICcDiY.exe
  2⤵
  PID:9416
- C:\Windows\System32\lEIkHZN.exe
  C:\Windows\System32\lEIkHZN.exe
  2⤵
  PID:9572
- C:\Windows\System32\wIiFIak.exe
  C:\Windows\System32\wIiFIak.exe
  2⤵
  PID:9684
- C:\Windows\System32\kPhApYG.exe
  C:\Windows\System32\kPhApYG.exe
  2⤵
  PID:9844
- C:\Windows\System32\AwTrqfL.exe
  C:\Windows\System32\AwTrqfL.exe
  2⤵
  PID:10036
- C:\Windows\System32\UuWytga.exe
  C:\Windows\System32\UuWytga.exe
  2⤵
  PID:10164
- C:\Windows\System32\vsmiPzq.exe
  C:\Windows\System32\vsmiPzq.exe
  2⤵
  PID:9384
- C:\Windows\System32\pBsreIA.exe
  C:\Windows\System32\pBsreIA.exe
  2⤵
  PID:9824
- C:\Windows\System32\RhsfTVM.exe
  C:\Windows\System32\RhsfTVM.exe
  2⤵
  PID:10184
- C:\Windows\System32\MBdTtLS.exe
  C:\Windows\System32\MBdTtLS.exe
  2⤵
  PID:9996
- C:\Windows\System32\SCtbUpJ.exe
  C:\Windows\System32\SCtbUpJ.exe
  2⤵
  PID:9244
- C:\Windows\System32\XzZJnvn.exe
  C:\Windows\System32\XzZJnvn.exe
  2⤵
  PID:10268
- C:\Windows\System32\Xwhawyp.exe
  C:\Windows\System32\Xwhawyp.exe
  2⤵
  PID:10288
- C:\Windows\System32\npNakHY.exe
  C:\Windows\System32\npNakHY.exe
  2⤵
  PID:10312
- C:\Windows\System32\mNcHuvg.exe
  C:\Windows\System32\mNcHuvg.exe
  2⤵
  PID:10344
- C:\Windows\System32\pTdRbIj.exe
  C:\Windows\System32\pTdRbIj.exe
  2⤵
  PID:10388
- C:\Windows\System32\fzdSZLJ.exe
  C:\Windows\System32\fzdSZLJ.exe
  2⤵
  PID:10412
- C:\Windows\System32\HllogOq.exe
  C:\Windows\System32\HllogOq.exe
  2⤵
  PID:10440
- C:\Windows\System32\ucaiwWZ.exe
  C:\Windows\System32\ucaiwWZ.exe
  2⤵
  PID:10460
- C:\Windows\System32\aspPyEp.exe
  C:\Windows\System32\aspPyEp.exe
  2⤵
  PID:10504
- C:\Windows\System32\QmBmmwH.exe
  C:\Windows\System32\QmBmmwH.exe
  2⤵
  PID:10524
- C:\Windows\System32\SnKiIfS.exe
  C:\Windows\System32\SnKiIfS.exe
  2⤵
  PID:10552
- C:\Windows\System32\bjzZnzl.exe
  C:\Windows\System32\bjzZnzl.exe
  2⤵
  PID:10568
- C:\Windows\System32\KbxxbaN.exe
  C:\Windows\System32\KbxxbaN.exe
  2⤵
  PID:10608
- C:\Windows\System32\HiPubUQ.exe
  C:\Windows\System32\HiPubUQ.exe
  2⤵
  PID:10636
- C:\Windows\System32\LvGhbLe.exe
  C:\Windows\System32\LvGhbLe.exe
  2⤵
  PID:10664
- C:\Windows\System32\oDyhOrU.exe
  C:\Windows\System32\oDyhOrU.exe
  2⤵
  PID:10692
- C:\Windows\System32\vSPbdoh.exe
  C:\Windows\System32\vSPbdoh.exe
  2⤵
  PID:10720
- C:\Windows\System32\PnebdbE.exe
  C:\Windows\System32\PnebdbE.exe
  2⤵
  PID:10740
- C:\Windows\System32\VkNkyHn.exe
  C:\Windows\System32\VkNkyHn.exe
  2⤵
  PID:10768
- C:\Windows\System32\AbLoonZ.exe
  C:\Windows\System32\AbLoonZ.exe
  2⤵
  PID:10812
- C:\Windows\System32\FCPLhUq.exe
  C:\Windows\System32\FCPLhUq.exe
  2⤵
  PID:10832
- C:\Windows\System32\uGjDeBR.exe
  C:\Windows\System32\uGjDeBR.exe
  2⤵
  PID:10848
- C:\Windows\System32\Eqirofw.exe
  C:\Windows\System32\Eqirofw.exe
  2⤵
  PID:10888
- C:\Windows\System32\tXxszhe.exe
  C:\Windows\System32\tXxszhe.exe
  2⤵
  PID:10912
- C:\Windows\System32\AgYJKip.exe
  C:\Windows\System32\AgYJKip.exe
  2⤵
  PID:10944
- C:\Windows\System32\XxRhZro.exe
  C:\Windows\System32\XxRhZro.exe
  2⤵
  PID:10972
- C:\Windows\System32\pJJpNyJ.exe
  C:\Windows\System32\pJJpNyJ.exe
  2⤵
  PID:11000
- C:\Windows\System32\grrLzfh.exe
  C:\Windows\System32\grrLzfh.exe
  2⤵
  PID:11028
- C:\Windows\System32\KfQXchX.exe
  C:\Windows\System32\KfQXchX.exe
  2⤵
  PID:11056
- C:\Windows\System32\yHMFrGK.exe
  C:\Windows\System32\yHMFrGK.exe
  2⤵
  PID:11084
- C:\Windows\System32\GwnHxem.exe
  C:\Windows\System32\GwnHxem.exe
  2⤵
  PID:11116
- C:\Windows\System32\ZlLOmeE.exe
  C:\Windows\System32\ZlLOmeE.exe
  2⤵
  PID:11140
- C:\Windows\System32\ymBNVoy.exe
  C:\Windows\System32\ymBNVoy.exe
  2⤵
  PID:11168
- C:\Windows\System32\BiBFlrM.exe
  C:\Windows\System32\BiBFlrM.exe
  2⤵
  PID:11196
- C:\Windows\System32\yXwuWDs.exe
  C:\Windows\System32\yXwuWDs.exe
  2⤵
  PID:11228
- C:\Windows\System32\XzfFkWo.exe
  C:\Windows\System32\XzfFkWo.exe
  2⤵
  PID:11252
- C:\Windows\System32\bCdiIsB.exe
  C:\Windows\System32\bCdiIsB.exe
  2⤵
  PID:10276
- C:\Windows\System32\bVFHjSk.exe
  C:\Windows\System32\bVFHjSk.exe
  2⤵
  PID:10340
- C:\Windows\System32\AUhQpSn.exe
  C:\Windows\System32\AUhQpSn.exe
  2⤵
  PID:10420
- C:\Windows\System32\UbseyaG.exe
  C:\Windows\System32\UbseyaG.exe
  2⤵
  PID:10448
- C:\Windows\System32\pJncWPO.exe
  C:\Windows\System32\pJncWPO.exe
  2⤵
  PID:9060
- C:\Windows\System32\EerjjnR.exe
  C:\Windows\System32\EerjjnR.exe
  2⤵
  PID:8848
- C:\Windows\System32\LMnhkkO.exe
  C:\Windows\System32\LMnhkkO.exe
  2⤵
  PID:10560
- C:\Windows\System32\FOQxUIT.exe
  C:\Windows\System32\FOQxUIT.exe
  2⤵
  PID:10688
- C:\Windows\System32\nASxaJs.exe
  C:\Windows\System32\nASxaJs.exe
  2⤵
  PID:10728
- C:\Windows\System32\QSefBfc.exe
  C:\Windows\System32\QSefBfc.exe
  2⤵
  PID:10820
- C:\Windows\System32\jBeJOSW.exe
  C:\Windows\System32\jBeJOSW.exe
  2⤵
  PID:10880
- C:\Windows\System32\fzdGRKc.exe
  C:\Windows\System32\fzdGRKc.exe
  2⤵
  PID:10940
- C:\Windows\System32\vSrUOmN.exe
  C:\Windows\System32\vSrUOmN.exe
  2⤵
  PID:10992
- C:\Windows\System32\TbXTZfE.exe
  C:\Windows\System32\TbXTZfE.exe
  2⤵
  PID:11048
- C:\Windows\System32\RHPjvIJ.exe
  C:\Windows\System32\RHPjvIJ.exe
  2⤵
  PID:11152
- C:\Windows\System32\WXfHUwx.exe
  C:\Windows\System32\WXfHUwx.exe
  2⤵
  PID:11212
- C:\Windows\System32\nuNTalV.exe
  C:\Windows\System32\nuNTalV.exe
  2⤵
  PID:10256
- C:\Windows\System32\zvJhVYi.exe
  C:\Windows\System32\zvJhVYi.exe
  2⤵
  PID:10408
- C:\Windows\System32\iPgLEjq.exe
  C:\Windows\System32\iPgLEjq.exe
  2⤵
  PID:8336
- C:\Windows\System32\pMwPoOL.exe
  C:\Windows\System32\pMwPoOL.exe
  2⤵
  PID:10656
- C:\Windows\System32\abBLzjZ.exe
  C:\Windows\System32\abBLzjZ.exe
  2⤵
  PID:10800
- C:\Windows\System32\DTzjDcI.exe
  C:\Windows\System32\DTzjDcI.exe
  2⤵
  PID:10988
- C:\Windows\System32\sXSfVVk.exe
  C:\Windows\System32\sXSfVVk.exe
  2⤵
  PID:11040
- C:\Windows\System32\noVPXpL.exe
  C:\Windows\System32\noVPXpL.exe
  2⤵
  PID:10628
- C:\Windows\System32\WuzgtQI.exe
  C:\Windows\System32\WuzgtQI.exe
  2⤵
  PID:9688
- C:\Windows\System32\TfdcXmT.exe
  C:\Windows\System32\TfdcXmT.exe
  2⤵
  PID:10580
- C:\Windows\System32\nZApeLv.exe
  C:\Windows\System32\nZApeLv.exe
  2⤵
  PID:10372
- C:\Windows\System32\tLNGsbK.exe
  C:\Windows\System32\tLNGsbK.exe
  2⤵
  PID:10776
- C:\Windows\System32\UlDgCpi.exe
  C:\Windows\System32\UlDgCpi.exe
  2⤵
  PID:11276
- C:\Windows\System32\ynYiHko.exe
  C:\Windows\System32\ynYiHko.exe
  2⤵
  PID:11296
- C:\Windows\System32\JLMozhU.exe
  C:\Windows\System32\JLMozhU.exe
  2⤵
  PID:11332
- C:\Windows\System32\GqdnDXK.exe
  C:\Windows\System32\GqdnDXK.exe
  2⤵
  PID:11364
- C:\Windows\System32\KfipPnR.exe
  C:\Windows\System32\KfipPnR.exe
  2⤵
  PID:11404
- C:\Windows\System32\nUFdWkG.exe
  C:\Windows\System32\nUFdWkG.exe
  2⤵
  PID:11420
- C:\Windows\System32\CtrUmHf.exe
  C:\Windows\System32\CtrUmHf.exe
  2⤵
  PID:11448
- C:\Windows\System32\weIVkdz.exe
  C:\Windows\System32\weIVkdz.exe
  2⤵
  PID:11476
- C:\Windows\System32\vKtganO.exe
  C:\Windows\System32\vKtganO.exe
  2⤵
  PID:11504
- C:\Windows\System32\OkphBkT.exe
  C:\Windows\System32\OkphBkT.exe
  2⤵
  PID:11528
- C:\Windows\System32\rTPdbPc.exe
  C:\Windows\System32\rTPdbPc.exe
  2⤵
  PID:11560
- C:\Windows\System32\mpBzHoz.exe
  C:\Windows\System32\mpBzHoz.exe
  2⤵
  PID:11576
- C:\Windows\System32\IYlAJhw.exe
  C:\Windows\System32\IYlAJhw.exe
  2⤵
  PID:11616
- C:\Windows\System32\LuIbtYx.exe
  C:\Windows\System32\LuIbtYx.exe
  2⤵
  PID:11644
- C:\Windows\System32\zgfIPMO.exe
  C:\Windows\System32\zgfIPMO.exe
  2⤵
  PID:11676
- C:\Windows\System32\wUMvuVh.exe
  C:\Windows\System32\wUMvuVh.exe
  2⤵
  PID:11704
- C:\Windows\System32\sQRKSyQ.exe
  C:\Windows\System32\sQRKSyQ.exe
  2⤵
  PID:11728
- C:\Windows\System32\sUCPdrQ.exe
  C:\Windows\System32\sUCPdrQ.exe
  2⤵
  PID:11748
- C:\Windows\System32\PfrOsPN.exe
  C:\Windows\System32\PfrOsPN.exe
  2⤵
  PID:11788
- C:\Windows\System32\vLbuPOl.exe
  C:\Windows\System32\vLbuPOl.exe
  2⤵
  PID:11816
- C:\Windows\System32\vqzKMfd.exe
  C:\Windows\System32\vqzKMfd.exe
  2⤵
  PID:11844
- C:\Windows\System32\FQiaETb.exe
  C:\Windows\System32\FQiaETb.exe
  2⤵
  PID:11872
- C:\Windows\System32\DzQWhUt.exe
  C:\Windows\System32\DzQWhUt.exe
  2⤵
  PID:11900
- C:\Windows\System32\BBuiopJ.exe
  C:\Windows\System32\BBuiopJ.exe
  2⤵
  PID:11928
- C:\Windows\System32\ezRSlqd.exe
  C:\Windows\System32\ezRSlqd.exe
  2⤵
  PID:11956
- C:\Windows\System32\icWpIxc.exe
  C:\Windows\System32\icWpIxc.exe
  2⤵
  PID:11984
- C:\Windows\System32\AZtAlgI.exe
  C:\Windows\System32\AZtAlgI.exe
  2⤵
  PID:12012
- C:\Windows\System32\bqtoCpp.exe
  C:\Windows\System32\bqtoCpp.exe
  2⤵
  PID:12056
- C:\Windows\System32\afCKAlf.exe
  C:\Windows\System32\afCKAlf.exe
  2⤵
  PID:12072
- C:\Windows\System32\MKDwpaf.exe
  C:\Windows\System32\MKDwpaf.exe
  2⤵
  PID:12100
- C:\Windows\System32\mwgcvyg.exe
  C:\Windows\System32\mwgcvyg.exe
  2⤵
  PID:12128
- C:\Windows\System32\JYscEzr.exe
  C:\Windows\System32\JYscEzr.exe
  2⤵
  PID:12156
- C:\Windows\System32\xyVIjEN.exe
  C:\Windows\System32\xyVIjEN.exe
  2⤵
  PID:12184
- C:\Windows\System32\hjyADou.exe
  C:\Windows\System32\hjyADou.exe
  2⤵
  PID:12212
- C:\Windows\System32\ddwDYnn.exe
  C:\Windows\System32\ddwDYnn.exe
  2⤵
  PID:12240
- C:\Windows\System32\ggZfKeo.exe
  C:\Windows\System32\ggZfKeo.exe
  2⤵
  PID:12268
- C:\Windows\System32\VXAmlpF.exe
  C:\Windows\System32\VXAmlpF.exe
  2⤵
  PID:2716
- C:\Windows\System32\qtBLjbm.exe
  C:\Windows\System32\qtBLjbm.exe
  2⤵
  PID:11340
- C:\Windows\System32\NXVhCVo.exe
  C:\Windows\System32\NXVhCVo.exe
  2⤵
  PID:9080
- C:\Windows\System32\hMWeVZR.exe
  C:\Windows\System32\hMWeVZR.exe
  2⤵
  PID:11460
- C:\Windows\System32\KozsPWU.exe
  C:\Windows\System32\KozsPWU.exe
  2⤵
  PID:11516
- C:\Windows\System32\GIswgcG.exe
  C:\Windows\System32\GIswgcG.exe
  2⤵
  PID:11572
- C:\Windows\System32\jHPdoRE.exe
  C:\Windows\System32\jHPdoRE.exe
  2⤵
  PID:11636
- C:\Windows\System32\uDgQsAU.exe
  C:\Windows\System32\uDgQsAU.exe
  2⤵
  PID:3952
- C:\Windows\System32\nbNmowH.exe
  C:\Windows\System32\nbNmowH.exe
  2⤵
  PID:11744
- C:\Windows\System32\yvcjuRz.exe
  C:\Windows\System32\yvcjuRz.exe
  2⤵
  PID:11812
- C:\Windows\System32\LaAuTjo.exe
  C:\Windows\System32\LaAuTjo.exe
  2⤵
  PID:11884
- C:\Windows\System32\AdtbjSX.exe
  C:\Windows\System32\AdtbjSX.exe
  2⤵
  PID:11948
- C:\Windows\System32\nmAPife.exe
  C:\Windows\System32\nmAPife.exe
  2⤵
  PID:12008
- C:\Windows\System32\KyDjoKz.exe
  C:\Windows\System32\KyDjoKz.exe
  2⤵
  PID:4788
- C:\Windows\System32\QbjEuvq.exe
  C:\Windows\System32\QbjEuvq.exe
  2⤵
  PID:3080
- C:\Windows\System32\xDcrckL.exe
  C:\Windows\System32\xDcrckL.exe
  2⤵
  PID:7216
- C:\Windows\System32\pLntcqG.exe
  C:\Windows\System32\pLntcqG.exe
  2⤵
  PID:12048
- C:\Windows\System32\lQQNmuJ.exe
  C:\Windows\System32\lQQNmuJ.exe
  2⤵
  PID:12096
- C:\Windows\System32\PRAPjPa.exe
  C:\Windows\System32\PRAPjPa.exe
  2⤵
  PID:12168
- C:\Windows\System32\khIelGr.exe
  C:\Windows\System32\khIelGr.exe
  2⤵
  PID:12236
- C:\Windows\System32\kOHXAXH.exe
  C:\Windows\System32\kOHXAXH.exe
  2⤵
  PID:11268
- C:\Windows\System32\NdZNjPx.exe
  C:\Windows\System32\NdZNjPx.exe
  2⤵
  PID:11416
- C:\Windows\System32\KaFndLg.exe
  C:\Windows\System32\KaFndLg.exe
  2⤵
  PID:440
- C:\Windows\System32\IIByZyP.exe
  C:\Windows\System32\IIByZyP.exe
  2⤵
  PID:4772
- C:\Windows\System32\CSFUMTQ.exe
  C:\Windows\System32\CSFUMTQ.exe
  2⤵
  PID:11700
- C:\Windows\System32\ivZyzQH.exe
  C:\Windows\System32\ivZyzQH.exe
  2⤵
  PID:11840
- C:\Windows\System32\mdpkZML.exe
  C:\Windows\System32\mdpkZML.exe
  2⤵
  PID:11996
- C:\Windows\System32\SqgDQqb.exe
  C:\Windows\System32\SqgDQqb.exe
  2⤵
  PID:1244
- C:\Windows\System32\RWLHezB.exe
  C:\Windows\System32\RWLHezB.exe
  2⤵
  PID:12064
- C:\Windows\System32\gWnxMDy.exe
  C:\Windows\System32\gWnxMDy.exe
  2⤵
  PID:12208
- C:\Windows\System32\uOqcrfK.exe
  C:\Windows\System32\uOqcrfK.exe
  2⤵
  PID:11400
- C:\Windows\System32\nTLEGwL.exe
  C:\Windows\System32\nTLEGwL.exe
  2⤵
  PID:1440
- C:\Windows\System32\AJzkOGA.exe
  C:\Windows\System32\AJzkOGA.exe
  2⤵
  PID:11940
- C:\Windows\System32\tbUGGRE.exe
  C:\Windows\System32\tbUGGRE.exe
  2⤵
  PID:12036
- C:\Windows\System32\FBlaJpI.exe
  C:\Windows\System32\FBlaJpI.exe
  2⤵
  PID:11672
- C:\Windows\System32\gGOanQT.exe
  C:\Windows\System32\gGOanQT.exe
  2⤵
  PID:4012
- C:\Windows\System32\EheezSy.exe
  C:\Windows\System32\EheezSy.exe
  2⤵
  PID:3392
- C:\Windows\System32\AZptfWe.exe
  C:\Windows\System32\AZptfWe.exe
  2⤵
  PID:12304
- C:\Windows\System32\WcfWyov.exe
  C:\Windows\System32\WcfWyov.exe
  2⤵
  PID:12340
- C:\Windows\System32\dLfCqXA.exe
  C:\Windows\System32\dLfCqXA.exe
  2⤵
  PID:12380
- C:\Windows\System32\clLinvc.exe
  C:\Windows\System32\clLinvc.exe
  2⤵
  PID:12396
- C:\Windows\System32\acfqzHv.exe
  C:\Windows\System32\acfqzHv.exe
  2⤵
  PID:12424
- C:\Windows\System32\EAxbVnF.exe
  C:\Windows\System32\EAxbVnF.exe
  2⤵
  PID:12452
- C:\Windows\System32\DaQLqIL.exe
  C:\Windows\System32\DaQLqIL.exe
  2⤵
  PID:12480
- C:\Windows\System32\yZJchhN.exe
  C:\Windows\System32\yZJchhN.exe
  2⤵
  PID:12508
- C:\Windows\System32\otUwitX.exe
  C:\Windows\System32\otUwitX.exe
  2⤵
  PID:12536
- C:\Windows\System32\jUVGmfJ.exe
  C:\Windows\System32\jUVGmfJ.exe
  2⤵
  PID:12564
- C:\Windows\System32\PLEMDGI.exe
  C:\Windows\System32\PLEMDGI.exe
  2⤵
  PID:12592
- C:\Windows\System32\DwxLwWk.exe
  C:\Windows\System32\DwxLwWk.exe
  2⤵
  PID:12620
- C:\Windows\System32\qjDjdsb.exe
  C:\Windows\System32\qjDjdsb.exe
  2⤵
  PID:12648
- C:\Windows\System32\mnvvTiE.exe
  C:\Windows\System32\mnvvTiE.exe
  2⤵
  PID:12676
- C:\Windows\System32\XxqjRBW.exe
  C:\Windows\System32\XxqjRBW.exe
  2⤵
  PID:12704
- C:\Windows\System32\QSUMjzB.exe
  C:\Windows\System32\QSUMjzB.exe
  2⤵
  PID:12732
- C:\Windows\System32\BqUkxce.exe
  C:\Windows\System32\BqUkxce.exe
  2⤵
  PID:12760
- C:\Windows\System32\qeklVls.exe
  C:\Windows\System32\qeklVls.exe
  2⤵
  PID:12788
- C:\Windows\System32\aofXMcJ.exe
  C:\Windows\System32\aofXMcJ.exe
  2⤵
  PID:12816
- C:\Windows\System32\NxvLzEw.exe
  C:\Windows\System32\NxvLzEw.exe
  2⤵
  PID:12844
- C:\Windows\System32\lXAKcdq.exe
  C:\Windows\System32\lXAKcdq.exe
  2⤵
  PID:12872
- C:\Windows\System32\dIJJjgS.exe
  C:\Windows\System32\dIJJjgS.exe
  2⤵
  PID:12900
- C:\Windows\System32\jwNxmXL.exe
  C:\Windows\System32\jwNxmXL.exe
  2⤵
  PID:12928
- C:\Windows\System32\pxTITST.exe
  C:\Windows\System32\pxTITST.exe
  2⤵
  PID:12956
- C:\Windows\System32\ekExzqU.exe
  C:\Windows\System32\ekExzqU.exe
  2⤵
  PID:12984
- C:\Windows\System32\XxcyyTD.exe
  C:\Windows\System32\XxcyyTD.exe
  2⤵
  PID:13012
- C:\Windows\System32\gkvOKwP.exe
  C:\Windows\System32\gkvOKwP.exe
  2⤵
  PID:13040
- C:\Windows\System32\oifsLKv.exe
  C:\Windows\System32\oifsLKv.exe
  2⤵
  PID:13068
- C:\Windows\System32\wHLWUkt.exe
  C:\Windows\System32\wHLWUkt.exe
  2⤵
  PID:13096
- C:\Windows\System32\GhPeFOg.exe
  C:\Windows\System32\GhPeFOg.exe
  2⤵
  PID:13124
- C:\Windows\System32\UzPxJIV.exe
  C:\Windows\System32\UzPxJIV.exe
  2⤵
  PID:13152
- C:\Windows\System32\zBZsqTO.exe
  C:\Windows\System32\zBZsqTO.exe
  2⤵
  PID:13180
- C:\Windows\System32\cJJCuHO.exe
  C:\Windows\System32\cJJCuHO.exe
  2⤵
  PID:13208
- C:\Windows\System32\hSrQPJz.exe
  C:\Windows\System32\hSrQPJz.exe
  2⤵
  PID:13236
- C:\Windows\System32\TyJDZxN.exe
  C:\Windows\System32\TyJDZxN.exe
  2⤵
  PID:13264
- C:\Windows\System32\anDBmKU.exe
  C:\Windows\System32\anDBmKU.exe
  2⤵
  PID:13292
- C:\Windows\System32\CxBliWY.exe
  C:\Windows\System32\CxBliWY.exe
  2⤵
  PID:12316
- C:\Windows\System32\MiLTeXJ.exe
  C:\Windows\System32\MiLTeXJ.exe
  2⤵
  PID:12332
- C:\Windows\System32\wQLbOOc.exe
  C:\Windows\System32\wQLbOOc.exe
  2⤵
  PID:12408
- C:\Windows\System32\aJrCYxU.exe
  C:\Windows\System32\aJrCYxU.exe
  2⤵
  PID:12608
- C:\Windows\System32\EFTtEyS.exe
  C:\Windows\System32\EFTtEyS.exe
  2⤵
  PID:12672
- C:\Windows\System32\BkuAacI.exe
  C:\Windows\System32\BkuAacI.exe
  2⤵
  PID:12724
- C:\Windows\System32\tfZMJBL.exe
  C:\Windows\System32\tfZMJBL.exe
  2⤵
  PID:12772
- C:\Windows\System32\HlThlLj.exe
  C:\Windows\System32\HlThlLj.exe
  2⤵
  PID:12892
- C:\Windows\System32\lKdzEHl.exe
  C:\Windows\System32\lKdzEHl.exe
  2⤵
  PID:12968
- C:\Windows\System32\UzWkAxh.exe
  C:\Windows\System32\UzWkAxh.exe
  2⤵
  PID:13024
- C:\Windows\System32\CAINSew.exe
  C:\Windows\System32\CAINSew.exe
  2⤵
  PID:13080
- C:\Windows\System32\WdyfGxQ.exe
  C:\Windows\System32\WdyfGxQ.exe
  2⤵
  PID:13144
- C:\Windows\System32\sPMfSLu.exe
  C:\Windows\System32\sPMfSLu.exe
  2⤵
  PID:13200
- C:\Windows\System32\zuYVVsA.exe
  C:\Windows\System32\zuYVVsA.exe
  2⤵
  PID:13284
- C:\Windows\System32\hMbsNXK.exe
  C:\Windows\System32\hMbsNXK.exe
  2⤵
  PID:4496
- C:\Windows\System32\XvqHUrS.exe
  C:\Windows\System32\XvqHUrS.exe
  2⤵
  PID:12532
- C:\Windows\System32\wdcosdk.exe
  C:\Windows\System32\wdcosdk.exe
  2⤵
  PID:12716
- C:\Windows\System32\OIDwlHm.exe
  C:\Windows\System32\OIDwlHm.exe
  2⤵
  PID:12920
- C:\Windows\System32\xHyjADG.exe
  C:\Windows\System32\xHyjADG.exe
  2⤵
  PID:13060
- C:\Windows\System32\nzfDBgL.exe
  C:\Windows\System32\nzfDBgL.exe
  2⤵
  PID:13204
- C:\Windows\System32\LdQyXUE.exe
  C:\Windows\System32\LdQyXUE.exe
  2⤵
  PID:12300
- C:\Windows\System32\FnXubRE.exe
  C:\Windows\System32\FnXubRE.exe
  2⤵
  PID:12752
- C:\Windows\System32\cAeBTnn.exe
  C:\Windows\System32\cAeBTnn.exe
  2⤵
  PID:13176
- C:\Windows\System32\dhzFWpw.exe
  C:\Windows\System32\dhzFWpw.exe
  2⤵
  PID:12728
- C:\Windows\System32\SASWLRE.exe
  C:\Windows\System32\SASWLRE.exe
  2⤵
  PID:13120
- C:\Windows\System32\EhlPHpk.exe
  C:\Windows\System32\EhlPHpk.exe
  2⤵
  PID:13344
- C:\Windows\System32\hnaajnz.exe
  C:\Windows\System32\hnaajnz.exe
  2⤵
  PID:13360
- C:\Windows\System32\ZeQhnoR.exe
  C:\Windows\System32\ZeQhnoR.exe
  2⤵
  PID:13388
- C:\Windows\System32\CKkZyCs.exe
  C:\Windows\System32\CKkZyCs.exe
  2⤵
  PID:13416
- C:\Windows\System32\HHKCJED.exe
  C:\Windows\System32\HHKCJED.exe
  2⤵
  PID:13444
- C:\Windows\System32\UVvubDT.exe
  C:\Windows\System32\UVvubDT.exe
  2⤵
  PID:13472
- C:\Windows\System32\eYBKaNN.exe
  C:\Windows\System32\eYBKaNN.exe
  2⤵
  PID:13504
- C:\Windows\System32\UnuQima.exe
  C:\Windows\System32\UnuQima.exe
  2⤵
  PID:13532
- C:\Windows\System32\HrhTFIh.exe
  C:\Windows\System32\HrhTFIh.exe
  2⤵
  PID:13664
- C:\Windows\System32\DvpFmlk.exe
  C:\Windows\System32\DvpFmlk.exe
  2⤵
  PID:13680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\BXPblfc.exe

Filesize
3.1MB

MD5
b8c34c18a2f0c0c760f24f5bc9c603d3

SHA1
b3d4396e4d58c51f96676be36582c6e0b0886f6c

SHA256
000ae36f5c4ea9bab774be791c8da5b5d29efec4f54f57f87d642f6a7fa150c6

SHA512
f2a0669f720f1ec9ea9a188df0174ec00777145ef6524306ab2db7631e34173dbe5d6acb68b584176d8eacfb2527b453033ce4a429a83f7a8ada9dfad2cf2b0b

Download Submit
C:\Windows\System32\BadhMJb.exe

Filesize
3.1MB

MD5
ab2ac8ebfefec97316b24c182cc4c3a4

SHA1
50018828a6bfe5567b9470d65e6f27dc688af358

SHA256
14727da46e599d1a4ae6904b70befa815bee00a188b0fe98d19cef9495d21350

SHA512
a509b9c4ea2bb040e86d97f89e92bed34064bb8a1837f711d883f022d6c84defd62ed132f31a3b9c9f33848220e20bc5c62061ff44b21fae4b35a344dc48c876

Download Submit
C:\Windows\System32\CgHSnun.exe

Filesize
3.1MB

MD5
5d0157ffa27bb1015b89658e465f4663

SHA1
3732ab3cf3952d75c5907c23b21ab0b7747342d8

SHA256
2b33a0d528418d5dbbbd91aab7b0594cea525ba442bcf6d71b8f71e00b96c99a

SHA512
c5e20cb2529f28a89361f12906ec0a0fd2bb2101c71db96c94366bf2989a98d7581e330f169baba3334178a64d6c6d7878a491ccd3d22edf28544dfb8dab15f4

Download Submit
C:\Windows\System32\ElHhnhZ.exe

Filesize
3.1MB

MD5
cf9b51b12e6dd07c31ceb8950bfeaed9

SHA1
ee20bb190271e28a7aac07f9bd60c31c2242e74a

SHA256
9a320be2fe83e167c80ddb68ef492f90bb8ff31ef7c4da54e71f764b0242630c

SHA512
9e8aa5be19af691c30063f85f3e57b7c16f8552ae59d0742467d28a1b63c2376b6deecb47406e21131d2efc1099eb9e0676062158c42d4192f80b0f9064bea22

Download Submit
C:\Windows\System32\INcfwoK.exe

Filesize
3.1MB

MD5
69fde45cf9661a3a32fe04aedcd161c0

SHA1
80d871750a74fc4897c92d887b69284a01e0dc3e

SHA256
611bb177a1d7ca99089891663f8005ee8476de2ff830e5b08a2cc3cf92b54911

SHA512
ad175f0bd313b3e0e4a82ad17584e67b765352a470c88c491d6e768c39c0f0ef8c32b2ab5474640550ba9205ecf9726f05f3d854e59f61bcf142cf9418541215

Download Submit
C:\Windows\System32\IiOSQRs.exe

Filesize
3.1MB

MD5
c312748f8b2594fc0536b14fbf220ff2

SHA1
9974406547814644340065d01e4829a61def75d4

SHA256
a5641739d61b98f3bd6cb09b10a47e920c9256fa97aaa0075fcb16763ce07258

SHA512
44c56ca941c5e570cd36d53f6b7d76565ddc9378736bf4ad0386c005f7ccdb5d7cddcdc17761aa3a72f1b1a3098424fa0e727ad09779265193b3b4496687db35

Download Submit
C:\Windows\System32\MhLAlho.exe

Filesize
3.1MB

MD5
0ac7b9b8f60087e0ecbb773f69be139d

SHA1
1f450357b7230a7bb6110e51989e275ff72190a5

SHA256
379c60f449326064cdde99234ac8b598addf721dfedb276a9dc4cbbb30c222d4

SHA512
005d32b7e935d4348ce4a4d4c288bce9019d6beddd5fcacf5dac81984ee18e4e50b311543181a91e2868256763792deb91d02a2ff021f961a2991121b43d23cd

Download Submit
C:\Windows\System32\OUQwico.exe

Filesize
3.1MB

MD5
d6290f2fcb3bd922d8a95789ad9a02c9

SHA1
342a0f30542cb3e93ace25f97ce7b0d1c0b9d55b

SHA256
d6d6e222b4bea5125b1e4d6f938029fb9f1d6dbe98fb2b244f25f71a2d452fc9

SHA512
464ba702f790847e06f8e8326f64c15947ce57d820fe0e3dd5909151aaad18af645e99ace1f3bda07f8d13a311e73b5be41131a1a1c971d29f771d6968b65df4

Download Submit
C:\Windows\System32\OgLOwsh.exe

Filesize
3.1MB

MD5
977fcc861a8f91a97ff9cd72c393c86b

SHA1
bd4f98b881d7cb1a8297875d6c917161a4a80fc9

SHA256
48599f5ec81c26f7330b1c7fc7bd36a4b45c17706cd4d3b50fbe75231bbe4a4e

SHA512
754c527a5ed11847c6108a8816330b999cd6abf1179b382fd704812e457a04df6478c80deeba2efd40b3c517a702a56dbb71f67fee3028d9099810d875628544

Download Submit
C:\Windows\System32\OwcYoRi.exe

Filesize
3.1MB

MD5
2b2713d9e8531b2311c56efc95627866

SHA1
8aa44be84570c85670976d9c97c0054465f9ced8

SHA256
8556a55d42f9b3719857f3bbb4bacd535e1665c00866da7f58b940319dd96843

SHA512
05e800ed5ace04c4950e60688b701b8650f9d9e099bd7d742cf056b8db178a76ab0f6349156334acd29387f82cd95fef80fafd19b456ca55d62dbd78da976e27

Download Submit
C:\Windows\System32\PSBFaRI.exe

Filesize
3.1MB

MD5
8d9ec4c754173bd00751f1d4087f18e2

SHA1
5fa9b40f1e91b7c95c3718dcb02dcdc0eed5ba68

SHA256
a0f03bfa35187ecdf82831a33325ba63fe0c8c5f42d9db882118517735861b61

SHA512
6f5accea62c312da9dd2c33c6149681376c52ff1bebf52cd7ded7fc49f90bae2e3724cf5f86db79ac54c9f9147c07e5fe88e0c70f6913099babdf869e2081a55

Download Submit
C:\Windows\System32\QvAygOa.exe

Filesize
3.1MB

MD5
0b85532a900e61b086bf5e2edbd55e4c

SHA1
b1ab63d5cc4cede7798aa39bc4d8d12494003974

SHA256
69aed29ee2a1a9661f6534d4e6caddd1ff2f5ab0c1a5ddc189f90cf70ae5cac2

SHA512
9c285691f2e72a82a7dcb748df707bcd22f9df5cdbb452954b11b1b34779cb824a925bd6a5cc0fc058577bb8eafcd75002eaebfe6bbb53b7a63491eb0d93def2

Download Submit
C:\Windows\System32\SaKlogN.exe

Filesize
3.1MB

MD5
43b2f60c8f90b3a6425c41dd02fca728

SHA1
d475b4e508bedc58669e5dec15098e5a91c5916a

SHA256
1365b29befe84fab5c2bb5b548018a169486ab4d1150fc61bb1f761bb2c1882e

SHA512
e6b5b6c2caaf8d9f353b24e8833e69c3bda9cebef640e333c917b9aa37a207c64427293b3aa67e0de26af89eec16b637e0651d26b8981dd20b4956cbb3156b0c

Download Submit
C:\Windows\System32\SsHKHeV.exe

Filesize
3.1MB

MD5
44dc49d931504e2b72d8c4d8677ac089

SHA1
d44a837578103950a8eb3f1bd8e2aa5b03332b32

SHA256
91751c1a20c7f5167e91a80ef8b24a4856fbf88aa3b7609d94739a6aa5364039

SHA512
121471f59b143a5f4c7d1b2184722ad6ada31ef9c90050d559cf7f9e31eeb71a23dd115a6c61c8a2906ba8a9d2f414e67c3346f33268e18c5f2aa3e5812fc286

Download Submit
C:\Windows\System32\TdQRMxy.exe

Filesize
3.1MB

MD5
41968c8a79436810c6b8f02bfa88736b

SHA1
d0cc8a342619fcc7a7aa18ee8c5036e90867b462

SHA256
4d93fcff44ab29c658c68bdd34e9cf386bae73d76fbdddbf65dedf9d92b2f585

SHA512
77d65682217167dec5711ff1aaadab8bdd6390819d66714210f0cdcb033d8fbe2b630cb7b071bd70f31c238b6b16a58ed6770ba503aa2d7494559712cba1f7d5

Download Submit
C:\Windows\System32\UKPszbt.exe

Filesize
3.1MB

MD5
085b01120a6198e0cfb88fb00c2bcdd5

SHA1
f6dc89a423aaa4f4d221cd845a8edfdc4dd9ab81

SHA256
5c3854570335a44261ec61a118ebea5b58b9f7984e63a7abc995ff2293619f7a

SHA512
467fd8a8c2063cc2c3049dda527d321b9168952b8a510d1d20aefbce900f51781409dd2b5ef798cad3fef25c773c833112b993e36b55667a7f28f31d1d675839

Download Submit
C:\Windows\System32\WAZRAFJ.exe

Filesize
3.1MB

MD5
b56994760d6372751e4ea7700eedef4f

SHA1
05a6166eaf4a2fc0b44d0c0b84e79a4c7fc2b738

SHA256
2f18259b2f0219a4cb1508944fe57203663914d5d0a822ba91acaac3d9aa7e1f

SHA512
259dd432680f83f0fedcd90cdc641afc9d0cdb0c7f2ec52dfd673ab8d646170d6c53a53cf9f7f73dc7aded26c5952d7cbe0213332a04885a41328ad5ca1d0a27

Download Submit
C:\Windows\System32\WCAvEWf.exe

Filesize
3.1MB

MD5
732ab084f7904a0579e9fa3ce30e2959

SHA1
0f26d4c0db5a95f30d440f4d2b37b97fdfd52c60

SHA256
df7783cf4771f8232b3d5d4bd48bb04e23196336a2ec7ac9e2d9c78d8245ecc6

SHA512
b3022034a639b4aacecf3c19ac5ff700840929c560bc864b3cf5d796c3e33b250e0873e25e8556a07360ce61e8fe079a397b9a6dba32966b5035536a3e08484e

Download Submit
C:\Windows\System32\ZLOzNzU.exe

Filesize
3.1MB

MD5
091aeaf9ac583d7819c6444c617ccc3a

SHA1
971b88b076a109437efcfaf83773920e6d5d5e01

SHA256
551b69349a4d25dc01c14dddf1e3b3dbe9c5e1e9eadff2cfb0de00cedbf4af4b

SHA512
ab896523a367c257a8242b35230ac97815fa5b0dad8b9b86aba3a4c0c76cdf124103c6908f3d89c0e7837a06fcdddd92ce5391f653ac43ae6da61c7339d2b9f1

Download Submit
C:\Windows\System32\bkXYJbs.exe

Filesize
3.1MB

MD5
8c5469d4d9f8c4624a0b698ec0464ece

SHA1
83c39eda5edcaef175e015a52a69fa50b2044568

SHA256
efee5ab56cda5a5d1c247fc5cf8fefa303584ad5d2db5c17ca10b4eb061b5a88

SHA512
32fccb10d2635ba534798cc2a858593420dbd2cceb75b98effda33674656762691b0b963c8240d74ac69b637d74774314c02957919b334f56887593393ad37a9

Download Submit
C:\Windows\System32\cjJWxon.exe

Filesize
3.1MB

MD5
0ef19314d854ff1306f848d365b5a698

SHA1
5327c3bf2c51460bf47bf339edec5e96989eb21a

SHA256
be5f112b1af8e8b2c0f01a9c7ce812e8499b552d41546b2c8270bf6f5a15ee76

SHA512
8c9d90b36a23365b11a806da12dc22f2caf6015e4c5f3a4ceab88f06a15d20ed319e1483b9a06201ce388864ddfa39961998de2307f24c0b0fdc6639b620b687

Download Submit
C:\Windows\System32\dZxVOcD.exe

Filesize
3.1MB

MD5
b016581e65984a670f6ec4acfe904ab3

SHA1
85571f9b50cd7aa1df188fcbe598b5d14f0dcc6f

SHA256
2f9f9c9cf248d8a55a33efa3e21e69da00737789a8349702b286d21505153769

SHA512
4bbfc8a21b7185095b6791ff911a0b15254923edab779d6e76c8d4056eda2cabfbf63e2d98c587f218eac475de05fb26bedc850601f71d45682333feb64ef243

Download Submit
C:\Windows\System32\gfGxcDr.exe

Filesize
3.1MB

MD5
9da611228ce5c16926f17dde45e9dcf0

SHA1
eadcb0814f91ede16910b9553a3c9c718ec2002a

SHA256
2956bf26d4573f4baf040b7893ed0212830c3b916ffdfe996b3f5506e834c794

SHA512
bb5ba570a65e74a389e8e6c7e1306f085771d069501d7ff1ce24968f31e935a7d57fa8c89cf0057fc41a5c4b514721177f18f68c4f4e316e5962f712ffc7d35c

Download Submit
C:\Windows\System32\oHkhLQi.exe

Filesize
3.1MB

MD5
c56b4869384f934acc75e08b7f66c820

SHA1
b433905377f6a24cca0d0b94d6a1848990b053e4

SHA256
bc04247cdc748622db4acda6ccd279f988685982eeb39794f96c3fd4856599c9

SHA512
0d0e443271d5d64f17da95553b4f50da1f9ffa0ac5de32d15e2a09e0c2a8afe22fbf415c66b3436497e280dc1ed7d1d76aed5ad19f0156b090aa4a9167c77112

Download Submit
C:\Windows\System32\pQLdZQK.exe

Filesize
3.1MB

MD5
f2fc4a975a2ba07ef3091e6c6cc611c7

SHA1
827166f310a3668d393aff478ad224f49c12260f

SHA256
46a0c009ada8aefb9ea36da89f343a4536d4b23712b2572a17a406367a6254dc

SHA512
d1d8e431ab3d198adb70a85e2ac8958c6b15094b65b32d43693fb21cf83590fe2e18fdcc896af700660fb400122ccb9e7712659eba5377ec1e6b2a8130b143c4

Download Submit
C:\Windows\System32\soPzDNH.exe

Filesize
3.1MB

MD5
73db4210e1266f907ec575d43daba3f2

SHA1
03d0c6ebc7b126a7206d7ac3deaed04790a87fb7

SHA256
716ddab4ad7bb74d0afb7e7258b9721ba5287c3ece1db19a7fbcdbf079d8b33c

SHA512
3a05190624219c09f50fc4ff5c87a02d738fc037b58fbf65dc9e049395944072b78e33d82b7e982eeea57119ffe2189e9fcf9c3fc6fc28fc5daabe6a22b604ff

Download Submit
C:\Windows\System32\uXtJWMw.exe

Filesize
3.1MB

MD5
011bc315a7e11bcb80df41f5d35d2d63

SHA1
801ae5912c9aef091d15bdf27b11437ac8b2b681

SHA256
80c78fe43ea6be6c4d313330c3c526119a2d5a4b82cf97b203a13330c8a10fd4

SHA512
c002de37d350408bc8e8e4e4530d0d85ad0a740fd55d7ebe863d4a3649898852120da21065dc43abe3159b5f5ac98375e63863e2a4233961f0600998f04eaa9e

Download Submit
C:\Windows\System32\vPNJkFz.exe

Filesize
3.1MB

MD5
243e6265d99ba3ea028cbdd763f4ba46

SHA1
88273143c3e6bad35e52f77b0aef9fac4110e420

SHA256
ff79b8975b83e1289151848f877a92ef30b106c2c4cfbc30ba68445a5264aeff

SHA512
d54e1a9b58ee3bac52fe6a92da1463594ab130349d2ba62dff919cb2a2e637eab35777a86385f91edbe87e6378e3da2d5576df605c5710f92cdf4d39cb4d28a3

Download Submit
C:\Windows\System32\yIUUryn.exe

Filesize
3.1MB

MD5
a22881060f86bea609e34b3b08e64562

SHA1
7fefc8c9eae85470c7a9ab3f6c132db373d76ae3

SHA256
6d80c220f8cc3c334919630edf5bf66787ec845cd15f78a0819f9ca818b36e19

SHA512
6ecc16fa0f65ce443521564fcad16bc898d4a6f0c38f135b4d6c23a5707b417aadc87ff8847f1562cef05df647d04abb30ef4b70f558f07f936c775250fe389c

Download Submit
C:\Windows\System32\yLaroTh.exe

Filesize
3.1MB

MD5
381dba6a7b6d3bfadaf4e6e63273188a

SHA1
926a3b46efaa58cd35c3b2ae86624e1bb7f2be8a

SHA256
dff639a1974c029e9d11d4c041434909c6bdf592285292d2b84301b96012d924

SHA512
ce918dcf66a2dd9f7ce1fa248a7d343ed3148eba703d4ebe934b3133766a6788a899b6abedb05b0424d052db9cb7f573f115b1aa95c76f792ffbea0baea90940

Download Submit
C:\Windows\System32\zmqOAAa.exe

Filesize
3.1MB

MD5
95252a547ae3ff80a868004ec9a1e72b

SHA1
11d048a53337d00fc29a31dbf334b28cd1745c9b

SHA256
cfc5c8ab9374b41c634eb43ae32b7d6b3bb12070de99ef8dc75488fbb5017d69

SHA512
ae6b62db9701d64166af7a6fdbeefed7762a7f2cfc9658ab960e2fa6e7a323d9b699b08e2f6aab9b359c4e9d57bc70d4f8fd730c0fa377fef5d05ce450b3931c

Download Submit
C:\Windows\System32\zoWsTxd.exe

Filesize
3.1MB

MD5
62aa6dd3e90792097c2669676ea0657c

SHA1
92cab7601ec1d718afd6bcea9ca8f268af740fa6

SHA256
2c0072d6ed2981b025ff38b00e869292f73759052c40f965cbdb7bd7f51f4de0

SHA512
9d8108abddc4fb016dbfffa73ad9d4d9b6d582882f9178706268e8159601cd26bb8f587eb24ac0b0e110d55b0fe82159db5d9600a8b8faa55de55796d7eb03a9

Download Submit
memory/788-1-0x00000127A1400000-0x00000127A1410000-memory.dmp

Filesize
64KB

Download
memory/788-0-0x00007FF68C1A0000-0x00007FF68C595000-memory.dmp

Filesize
4.0MB

Download
memory/788-97-0x00007FF68C1A0000-0x00007FF68C595000-memory.dmp

Filesize
4.0MB

Download
memory/788-1942-0x00007FF68C1A0000-0x00007FF68C595000-memory.dmp

Filesize
4.0MB

Download
memory/892-403-0x00007FF78C990000-0x00007FF78CD85000-memory.dmp

Filesize
4.0MB

Download
memory/892-1968-0x00007FF78C990000-0x00007FF78CD85000-memory.dmp

Filesize
4.0MB

Download
memory/980-101-0x00007FF73A970000-0x00007FF73AD65000-memory.dmp

Filesize
4.0MB

Download
memory/980-1943-0x00007FF73A970000-0x00007FF73AD65000-memory.dmp

Filesize
4.0MB

Download
memory/980-1962-0x00007FF73A970000-0x00007FF73AD65000-memory.dmp

Filesize
4.0MB

Download
memory/1324-398-0x00007FF741DF0000-0x00007FF7421E5000-memory.dmp

Filesize
4.0MB

Download
memory/1324-1961-0x00007FF741DF0000-0x00007FF7421E5000-memory.dmp

Filesize
4.0MB

Download
memory/1516-1955-0x00007FF6E2190000-0x00007FF6E2585000-memory.dmp

Filesize
4.0MB

Download
memory/1516-78-0x00007FF6E2190000-0x00007FF6E2585000-memory.dmp

Filesize
4.0MB

Download
memory/1912-1948-0x00007FF7C86A0000-0x00007FF7C8A95000-memory.dmp

Filesize
4.0MB

Download
memory/1912-26-0x00007FF7C86A0000-0x00007FF7C8A95000-memory.dmp

Filesize
4.0MB

Download
memory/1912-1260-0x00007FF7C86A0000-0x00007FF7C8A95000-memory.dmp

Filesize
4.0MB

Download
memory/2012-1958-0x00007FF7CA980000-0x00007FF7CAD75000-memory.dmp

Filesize
4.0MB

Download
memory/2012-397-0x00007FF7CA980000-0x00007FF7CAD75000-memory.dmp

Filesize
4.0MB

Download
memory/2352-93-0x00007FF626F10000-0x00007FF627305000-memory.dmp

Filesize
4.0MB

Download
memory/2352-1956-0x00007FF626F10000-0x00007FF627305000-memory.dmp

Filesize
4.0MB

Download
memory/2588-1957-0x00007FF7FE470000-0x00007FF7FE865000-memory.dmp

Filesize
4.0MB

Download
memory/2588-94-0x00007FF7FE470000-0x00007FF7FE865000-memory.dmp

Filesize
4.0MB

Download
memory/2908-40-0x00007FF6BC0B0000-0x00007FF6BC4A5000-memory.dmp

Filesize
4.0MB

Download
memory/2908-1950-0x00007FF6BC0B0000-0x00007FF6BC4A5000-memory.dmp

Filesize
4.0MB

Download
memory/2916-102-0x00007FF77FA70000-0x00007FF77FE65000-memory.dmp

Filesize
4.0MB

Download
memory/2916-1963-0x00007FF77FA70000-0x00007FF77FE65000-memory.dmp

Filesize
4.0MB

Download
memory/3096-89-0x00007FF7AE5F0000-0x00007FF7AE9E5000-memory.dmp

Filesize
4.0MB

Download
memory/3096-1953-0x00007FF7AE5F0000-0x00007FF7AE9E5000-memory.dmp

Filesize
4.0MB

Download
memory/3296-71-0x00007FF766C90000-0x00007FF767085000-memory.dmp

Filesize
4.0MB

Download
memory/3296-1952-0x00007FF766C90000-0x00007FF767085000-memory.dmp

Filesize
4.0MB

Download
memory/3496-942-0x00007FF621360000-0x00007FF621755000-memory.dmp

Filesize
4.0MB

Download
memory/3496-20-0x00007FF621360000-0x00007FF621755000-memory.dmp

Filesize
4.0MB

Download
memory/3496-1947-0x00007FF621360000-0x00007FF621755000-memory.dmp

Filesize
4.0MB

Download
memory/3724-106-0x00007FF77A020000-0x00007FF77A415000-memory.dmp

Filesize
4.0MB

Download
memory/3724-1944-0x00007FF77A020000-0x00007FF77A415000-memory.dmp

Filesize
4.0MB

Download
memory/3724-1960-0x00007FF77A020000-0x00007FF77A415000-memory.dmp

Filesize
4.0MB

Download
memory/3732-1951-0x00007FF6B0430000-0x00007FF6B0825000-memory.dmp

Filesize
4.0MB

Download
memory/3732-45-0x00007FF6B0430000-0x00007FF6B0825000-memory.dmp

Filesize
4.0MB

Download
memory/4112-1945-0x00007FF6F2320000-0x00007FF6F2715000-memory.dmp

Filesize
4.0MB

Download
memory/4112-13-0x00007FF6F2320000-0x00007FF6F2715000-memory.dmp

Filesize
4.0MB

Download
memory/4356-1964-0x00007FF719270000-0x00007FF719665000-memory.dmp

Filesize
4.0MB

Download
memory/4356-399-0x00007FF719270000-0x00007FF719665000-memory.dmp

Filesize
4.0MB

Download
memory/4468-15-0x00007FF68D080000-0x00007FF68D475000-memory.dmp

Filesize
4.0MB

Download
memory/4468-1946-0x00007FF68D080000-0x00007FF68D475000-memory.dmp

Filesize
4.0MB

Download
memory/4800-1965-0x00007FF616780000-0x00007FF616B75000-memory.dmp

Filesize
4.0MB

Download
memory/4800-411-0x00007FF616780000-0x00007FF616B75000-memory.dmp

Filesize
4.0MB

Download
memory/4816-1949-0x00007FF795940000-0x00007FF795D35000-memory.dmp

Filesize
4.0MB

Download
memory/4816-32-0x00007FF795940000-0x00007FF795D35000-memory.dmp

Filesize
4.0MB

Download
memory/4880-74-0x00007FF78EEA0000-0x00007FF78F295000-memory.dmp

Filesize
4.0MB

Download
memory/4880-1954-0x00007FF78EEA0000-0x00007FF78F295000-memory.dmp

Filesize
4.0MB

Download
memory/4900-406-0x00007FF7EEDA0000-0x00007FF7EF195000-memory.dmp

Filesize
4.0MB

Download
memory/4900-1967-0x00007FF7EEDA0000-0x00007FF7EF195000-memory.dmp

Filesize
4.0MB

Download
memory/4984-1959-0x00007FF78E3B0000-0x00007FF78E7A5000-memory.dmp

Filesize
4.0MB

Download
memory/4984-82-0x00007FF78E3B0000-0x00007FF78E7A5000-memory.dmp

Filesize
4.0MB

Download
memory/5116-1966-0x00007FF77C400000-0x00007FF77C7F5000-memory.dmp

Filesize
4.0MB

Download
memory/5116-415-0x00007FF77C400000-0x00007FF77C7F5000-memory.dmp

Filesize
4.0MB

Download