xmrig | daa94ff4c237ac916b17c42ee9c977aac3cdb36cda847f2eb61988ac7b7658b8

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
Size

2.0MB
MD5

9163b53ad25b927af67e7735d398b880
SHA1

052db371122a62760847743e0a308dfb48f57ddb
SHA256

daa94ff4c237ac916b17c42ee9c977aac3cdb36cda847f2eb61988ac7b7658b8
SHA512

542c92408edc33a93163d331635b5e81672cec4464d52522b33de284fa91a1c1cc3e482793d4e181d6f1e8f47eea310abadfb97b6ed357225fb1773423d41d70
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIZbGb+7MxexcWTBpm:BemTLkNdfE0pZrN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2796-0-0x00007FF698EF0000-0x00007FF699244000-memory.dmp	xmrig
behavioral2/files/0x000d000000023383-5.dat	xmrig
behavioral2/files/0x0007000000023402-7.dat	xmrig
behavioral2/files/0x00090000000233f3-8.dat	xmrig
behavioral2/files/0x0007000000023403-26.dat	xmrig
behavioral2/files/0x0007000000023404-31.dat	xmrig
behavioral2/files/0x0007000000023405-37.dat	xmrig
behavioral2/files/0x0007000000023407-43.dat	xmrig
behavioral2/files/0x0007000000023409-53.dat	xmrig
behavioral2/files/0x000700000002340a-61.dat	xmrig
behavioral2/files/0x0007000000023412-96.dat	xmrig
behavioral2/files/0x0007000000023413-109.dat	xmrig
behavioral2/files/0x000700000002341c-146.dat	xmrig
behavioral2/memory/2284-680-0x00007FF69D530000-0x00007FF69D884000-memory.dmp	xmrig
behavioral2/memory/2396-681-0x00007FF673210000-0x00007FF673564000-memory.dmp	xmrig
behavioral2/memory/4780-682-0x00007FF684FE0000-0x00007FF685334000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-166.dat	xmrig
behavioral2/files/0x000700000002341e-164.dat	xmrig
behavioral2/files/0x000700000002341f-161.dat	xmrig
behavioral2/files/0x000700000002341d-159.dat	xmrig
behavioral2/files/0x000700000002341b-149.dat	xmrig
behavioral2/files/0x000700000002341a-144.dat	xmrig
behavioral2/files/0x0007000000023419-139.dat	xmrig
behavioral2/files/0x0007000000023418-134.dat	xmrig
behavioral2/files/0x0007000000023417-129.dat	xmrig
behavioral2/files/0x0007000000023416-124.dat	xmrig
behavioral2/files/0x0007000000023415-119.dat	xmrig
behavioral2/files/0x0007000000023414-114.dat	xmrig
behavioral2/files/0x0007000000023411-99.dat	xmrig
behavioral2/files/0x0007000000023410-94.dat	xmrig
behavioral2/files/0x000700000002340f-89.dat	xmrig
behavioral2/files/0x000700000002340e-84.dat	xmrig
behavioral2/files/0x000700000002340d-79.dat	xmrig
behavioral2/files/0x000700000002340c-74.dat	xmrig
behavioral2/files/0x000700000002340b-69.dat	xmrig
behavioral2/files/0x0007000000023408-51.dat	xmrig
behavioral2/files/0x0007000000023406-41.dat	xmrig
behavioral2/memory/4348-28-0x00007FF6BDC60000-0x00007FF6BDFB4000-memory.dmp	xmrig
behavioral2/memory/5108-19-0x00007FF6C2660000-0x00007FF6C29B4000-memory.dmp	xmrig
behavioral2/memory/3260-9-0x00007FF676980000-0x00007FF676CD4000-memory.dmp	xmrig
behavioral2/memory/1920-683-0x00007FF7B4890000-0x00007FF7B4BE4000-memory.dmp	xmrig
behavioral2/memory/3488-761-0x00007FF77E8F0000-0x00007FF77EC44000-memory.dmp	xmrig
behavioral2/memory/3000-764-0x00007FF768F20000-0x00007FF769274000-memory.dmp	xmrig
behavioral2/memory/1368-796-0x00007FF7E9270000-0x00007FF7E95C4000-memory.dmp	xmrig
behavioral2/memory/632-789-0x00007FF6B5DC0000-0x00007FF6B6114000-memory.dmp	xmrig
behavioral2/memory/5028-801-0x00007FF6C1C70000-0x00007FF6C1FC4000-memory.dmp	xmrig
behavioral2/memory/1584-786-0x00007FF65F2B0000-0x00007FF65F604000-memory.dmp	xmrig
behavioral2/memory/3224-782-0x00007FF780920000-0x00007FF780C74000-memory.dmp	xmrig
behavioral2/memory/4084-776-0x00007FF6131F0000-0x00007FF613544000-memory.dmp	xmrig
behavioral2/memory/3968-747-0x00007FF6022B0000-0x00007FF602604000-memory.dmp	xmrig
behavioral2/memory/3568-741-0x00007FF73E510000-0x00007FF73E864000-memory.dmp	xmrig
behavioral2/memory/872-730-0x00007FF7FF870000-0x00007FF7FFBC4000-memory.dmp	xmrig
behavioral2/memory/4836-720-0x00007FF781240000-0x00007FF781594000-memory.dmp	xmrig
behavioral2/memory/3408-714-0x00007FF733C80000-0x00007FF733FD4000-memory.dmp	xmrig
behavioral2/memory/4372-706-0x00007FF70D5D0000-0x00007FF70D924000-memory.dmp	xmrig
behavioral2/memory/1900-693-0x00007FF6CA800000-0x00007FF6CAB54000-memory.dmp	xmrig
behavioral2/memory/4884-684-0x00007FF7DCA00000-0x00007FF7DCD54000-memory.dmp	xmrig
behavioral2/memory/2884-823-0x00007FF6EB0F0000-0x00007FF6EB444000-memory.dmp	xmrig
behavioral2/memory/4464-820-0x00007FF690940000-0x00007FF690C94000-memory.dmp	xmrig
behavioral2/memory/1832-815-0x00007FF7DAC00000-0x00007FF7DAF54000-memory.dmp	xmrig
behavioral2/memory/2188-810-0x00007FF7BCCA0000-0x00007FF7BCFF4000-memory.dmp	xmrig
behavioral2/memory/3548-833-0x00007FF6A4420000-0x00007FF6A4774000-memory.dmp	xmrig
behavioral2/memory/528-830-0x00007FF6D95F0000-0x00007FF6D9944000-memory.dmp	xmrig
behavioral2/memory/5108-2114-0x00007FF6C2660000-0x00007FF6C29B4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3260	EAvoRbv.exe
5108	LxGfgJq.exe
4348	JvLvfQN.exe
3548	brJOsvs.exe
2284	kXGspSi.exe
2396	NDAPhFw.exe
4780	aFzOSUy.exe
1920	jeDqMRi.exe
4884	rUDMUTB.exe
1900	psdAmkz.exe
4372	GnVVdrt.exe
3408	hFrsaix.exe
4836	RIKLrcF.exe
872	MjdlWKi.exe
3568	lbwGnLB.exe
3968	SOTzAIY.exe
3488	oEKtTZn.exe
3000	FROAEXO.exe
4084	KleFuIJ.exe
3224	YZzpWvf.exe
1584	nfsrcZP.exe
632	EThMHjW.exe
1368	IcSSTNR.exe
5028	GbWraht.exe
2188	qVeCcjI.exe
1832	NyplNtU.exe
4464	imCrJgR.exe
2884	sZZbGoy.exe
528	pObwSoe.exe
1816	JWnPxJq.exe
3556	HZLDFob.exe
2052	DECBrWf.exe
4020	IVYRedc.exe
2900	vvvUrQn.exe
4560	UniFoCV.exe
1712	xGshHQb.exe
4004	iTzSuqi.exe
1484	FeEyoYk.exe
868	GgbgbJD.exe
4520	FnVVUmW.exe
2480	rDQObZe.exe
2276	UvqdVnS.exe
1948	VSgvEZH.exe
1416	tsCFSuI.exe
3252	MhvpjxM.exe
1768	dPSvdtU.exe
3756	PWGpVFA.exe
1060	letcjdD.exe
5024	jDcTMBp.exe
376	WmNtKxI.exe
4312	mQnIDDQ.exe
4316	CZEWSEh.exe
4352	ntwhOvP.exe
2068	yXOYiUj.exe
1652	NxexsRd.exe
3096	QiRKudg.exe
3528	RvYfwtH.exe
544	ZuMdDaV.exe
4892	SCCMWEx.exe
396	yDdvuRX.exe
2264	BVBZMwF.exe
2944	zsYcwWf.exe
4844	LRyUntf.exe
5092	QeLtGme.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2796-0-0x00007FF698EF0000-0x00007FF699244000-memory.dmp	upx
behavioral2/files/0x000d000000023383-5.dat	upx
behavioral2/files/0x0007000000023402-7.dat	upx
behavioral2/files/0x00090000000233f3-8.dat	upx
behavioral2/files/0x0007000000023403-26.dat	upx
behavioral2/files/0x0007000000023404-31.dat	upx
behavioral2/files/0x0007000000023405-37.dat	upx
behavioral2/files/0x0007000000023407-43.dat	upx
behavioral2/files/0x0007000000023409-53.dat	upx
behavioral2/files/0x000700000002340a-61.dat	upx
behavioral2/files/0x0007000000023412-96.dat	upx
behavioral2/files/0x0007000000023413-109.dat	upx
behavioral2/files/0x000700000002341c-146.dat	upx
behavioral2/memory/2284-680-0x00007FF69D530000-0x00007FF69D884000-memory.dmp	upx
behavioral2/memory/2396-681-0x00007FF673210000-0x00007FF673564000-memory.dmp	upx
behavioral2/memory/4780-682-0x00007FF684FE0000-0x00007FF685334000-memory.dmp	upx
behavioral2/files/0x0007000000023420-166.dat	upx
behavioral2/files/0x000700000002341e-164.dat	upx
behavioral2/files/0x000700000002341f-161.dat	upx
behavioral2/files/0x000700000002341d-159.dat	upx
behavioral2/files/0x000700000002341b-149.dat	upx
behavioral2/files/0x000700000002341a-144.dat	upx
behavioral2/files/0x0007000000023419-139.dat	upx
behavioral2/files/0x0007000000023418-134.dat	upx
behavioral2/files/0x0007000000023417-129.dat	upx
behavioral2/files/0x0007000000023416-124.dat	upx
behavioral2/files/0x0007000000023415-119.dat	upx
behavioral2/files/0x0007000000023414-114.dat	upx
behavioral2/files/0x0007000000023411-99.dat	upx
behavioral2/files/0x0007000000023410-94.dat	upx
behavioral2/files/0x000700000002340f-89.dat	upx
behavioral2/files/0x000700000002340e-84.dat	upx
behavioral2/files/0x000700000002340d-79.dat	upx
behavioral2/files/0x000700000002340c-74.dat	upx
behavioral2/files/0x000700000002340b-69.dat	upx
behavioral2/files/0x0007000000023408-51.dat	upx
behavioral2/files/0x0007000000023406-41.dat	upx
behavioral2/memory/4348-28-0x00007FF6BDC60000-0x00007FF6BDFB4000-memory.dmp	upx
behavioral2/memory/5108-19-0x00007FF6C2660000-0x00007FF6C29B4000-memory.dmp	upx
behavioral2/memory/3260-9-0x00007FF676980000-0x00007FF676CD4000-memory.dmp	upx
behavioral2/memory/1920-683-0x00007FF7B4890000-0x00007FF7B4BE4000-memory.dmp	upx
behavioral2/memory/3488-761-0x00007FF77E8F0000-0x00007FF77EC44000-memory.dmp	upx
behavioral2/memory/3000-764-0x00007FF768F20000-0x00007FF769274000-memory.dmp	upx
behavioral2/memory/1368-796-0x00007FF7E9270000-0x00007FF7E95C4000-memory.dmp	upx
behavioral2/memory/632-789-0x00007FF6B5DC0000-0x00007FF6B6114000-memory.dmp	upx
behavioral2/memory/5028-801-0x00007FF6C1C70000-0x00007FF6C1FC4000-memory.dmp	upx
behavioral2/memory/1584-786-0x00007FF65F2B0000-0x00007FF65F604000-memory.dmp	upx
behavioral2/memory/3224-782-0x00007FF780920000-0x00007FF780C74000-memory.dmp	upx
behavioral2/memory/4084-776-0x00007FF6131F0000-0x00007FF613544000-memory.dmp	upx
behavioral2/memory/3968-747-0x00007FF6022B0000-0x00007FF602604000-memory.dmp	upx
behavioral2/memory/3568-741-0x00007FF73E510000-0x00007FF73E864000-memory.dmp	upx
behavioral2/memory/872-730-0x00007FF7FF870000-0x00007FF7FFBC4000-memory.dmp	upx
behavioral2/memory/4836-720-0x00007FF781240000-0x00007FF781594000-memory.dmp	upx
behavioral2/memory/3408-714-0x00007FF733C80000-0x00007FF733FD4000-memory.dmp	upx
behavioral2/memory/4372-706-0x00007FF70D5D0000-0x00007FF70D924000-memory.dmp	upx
behavioral2/memory/1900-693-0x00007FF6CA800000-0x00007FF6CAB54000-memory.dmp	upx
behavioral2/memory/4884-684-0x00007FF7DCA00000-0x00007FF7DCD54000-memory.dmp	upx
behavioral2/memory/2884-823-0x00007FF6EB0F0000-0x00007FF6EB444000-memory.dmp	upx
behavioral2/memory/4464-820-0x00007FF690940000-0x00007FF690C94000-memory.dmp	upx
behavioral2/memory/1832-815-0x00007FF7DAC00000-0x00007FF7DAF54000-memory.dmp	upx
behavioral2/memory/2188-810-0x00007FF7BCCA0000-0x00007FF7BCFF4000-memory.dmp	upx
behavioral2/memory/3548-833-0x00007FF6A4420000-0x00007FF6A4774000-memory.dmp	upx
behavioral2/memory/528-830-0x00007FF6D95F0000-0x00007FF6D9944000-memory.dmp	upx
behavioral2/memory/5108-2114-0x00007FF6C2660000-0x00007FF6C29B4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DvNXjrv.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\jwPsrOZ.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\GyARhWr.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\hFmYCuX.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\xBmOvMU.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\HioIQkA.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\gMnoSMa.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\KQfwPbE.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\AQZRubE.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\FDARdFy.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\rCGXIGn.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\IkGeXin.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\ZiBybOk.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\jmkgyxG.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\kvMKnwa.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\zpTEJob.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\hiiLrvS.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\OdcChdw.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\prnSDBT.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\lNvcFNR.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\IEZnvvX.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\GFZZrDf.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\kszvkgS.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\XhHYoRE.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\wOInIpB.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\iAkhcPI.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\wEBGwtA.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\CGkgqOK.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\PnKCIUQ.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\pWLFfjN.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\RNPDTGU.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\wXRwvff.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\xHEiZEy.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\eJqqSvH.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\ydccvFl.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\RIKLrcF.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\HZLDFob.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\bbLbiTy.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\EkHRwWv.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\VAIodiW.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\qrzcTmt.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\OExAAUl.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\yoHencI.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\LoCRhPh.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\tlncKmx.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\UxBooPz.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\UstLDDl.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\OzYHlaY.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\vmHyVGf.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\MBHjQbW.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\upgbFQI.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\qCcnAzg.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\LXJDkSp.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\AiPOxFm.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\NSnIhHJ.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\YscpXFi.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\QeLtGme.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\hGvHOIz.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\DullEYf.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\QNIHJxM.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\qVeCcjI.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\uoajndE.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\QpXEimi.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
File created	C:\Windows\System\EVUsugh.exe	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3260	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	85
PID 2796 wrote to memory of 3260	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	85
PID 2796 wrote to memory of 5108	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	86
PID 2796 wrote to memory of 5108	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	86
PID 2796 wrote to memory of 4348	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	87
PID 2796 wrote to memory of 4348	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	87
PID 2796 wrote to memory of 3548	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	88
PID 2796 wrote to memory of 3548	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	88
PID 2796 wrote to memory of 2284	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	89
PID 2796 wrote to memory of 2284	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	89
PID 2796 wrote to memory of 2396	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	90
PID 2796 wrote to memory of 2396	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	90
PID 2796 wrote to memory of 4780	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	91
PID 2796 wrote to memory of 4780	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	91
PID 2796 wrote to memory of 1920	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	92
PID 2796 wrote to memory of 1920	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	92
PID 2796 wrote to memory of 4884	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	93
PID 2796 wrote to memory of 4884	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	93
PID 2796 wrote to memory of 1900	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	94
PID 2796 wrote to memory of 1900	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	94
PID 2796 wrote to memory of 4372	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	95
PID 2796 wrote to memory of 4372	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	95
PID 2796 wrote to memory of 3408	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	96
PID 2796 wrote to memory of 3408	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	96
PID 2796 wrote to memory of 4836	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	97
PID 2796 wrote to memory of 4836	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	97
PID 2796 wrote to memory of 872	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	98
PID 2796 wrote to memory of 872	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	98
PID 2796 wrote to memory of 3568	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	99
PID 2796 wrote to memory of 3568	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	99
PID 2796 wrote to memory of 3968	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	100
PID 2796 wrote to memory of 3968	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	100
PID 2796 wrote to memory of 3488	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	101
PID 2796 wrote to memory of 3488	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	101
PID 2796 wrote to memory of 3000	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	102
PID 2796 wrote to memory of 3000	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	102
PID 2796 wrote to memory of 4084	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	103
PID 2796 wrote to memory of 4084	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	103
PID 2796 wrote to memory of 3224	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	104
PID 2796 wrote to memory of 3224	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	104
PID 2796 wrote to memory of 1584	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	105
PID 2796 wrote to memory of 1584	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	105
PID 2796 wrote to memory of 632	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	106
PID 2796 wrote to memory of 632	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	106
PID 2796 wrote to memory of 1368	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	107
PID 2796 wrote to memory of 1368	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	107
PID 2796 wrote to memory of 5028	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	108
PID 2796 wrote to memory of 5028	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	108
PID 2796 wrote to memory of 2188	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	109
PID 2796 wrote to memory of 2188	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	109
PID 2796 wrote to memory of 1832	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	110
PID 2796 wrote to memory of 1832	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	110
PID 2796 wrote to memory of 4464	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	111
PID 2796 wrote to memory of 4464	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	111
PID 2796 wrote to memory of 2884	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	112
PID 2796 wrote to memory of 2884	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	112
PID 2796 wrote to memory of 528	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	113
PID 2796 wrote to memory of 528	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	113
PID 2796 wrote to memory of 1816	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	114
PID 2796 wrote to memory of 1816	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	114
PID 2796 wrote to memory of 3556	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	115
PID 2796 wrote to memory of 3556	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	115
PID 2796 wrote to memory of 2052	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	116
PID 2796 wrote to memory of 2052	2796	9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9163b53ad25b927af67e7735d398b880_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\System\EAvoRbv.exe
  C:\Windows\System\EAvoRbv.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\LxGfgJq.exe
  C:\Windows\System\LxGfgJq.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\JvLvfQN.exe
  C:\Windows\System\JvLvfQN.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\brJOsvs.exe
  C:\Windows\System\brJOsvs.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\kXGspSi.exe
  C:\Windows\System\kXGspSi.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\NDAPhFw.exe
  C:\Windows\System\NDAPhFw.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\aFzOSUy.exe
  C:\Windows\System\aFzOSUy.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\jeDqMRi.exe
  C:\Windows\System\jeDqMRi.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\rUDMUTB.exe
  C:\Windows\System\rUDMUTB.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\psdAmkz.exe
  C:\Windows\System\psdAmkz.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\GnVVdrt.exe
  C:\Windows\System\GnVVdrt.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\hFrsaix.exe
  C:\Windows\System\hFrsaix.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\RIKLrcF.exe
  C:\Windows\System\RIKLrcF.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\MjdlWKi.exe
  C:\Windows\System\MjdlWKi.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\lbwGnLB.exe
  C:\Windows\System\lbwGnLB.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\SOTzAIY.exe
  C:\Windows\System\SOTzAIY.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\oEKtTZn.exe
  C:\Windows\System\oEKtTZn.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\FROAEXO.exe
  C:\Windows\System\FROAEXO.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\KleFuIJ.exe
  C:\Windows\System\KleFuIJ.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\YZzpWvf.exe
  C:\Windows\System\YZzpWvf.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\nfsrcZP.exe
  C:\Windows\System\nfsrcZP.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\EThMHjW.exe
  C:\Windows\System\EThMHjW.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\IcSSTNR.exe
  C:\Windows\System\IcSSTNR.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\GbWraht.exe
  C:\Windows\System\GbWraht.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\qVeCcjI.exe
  C:\Windows\System\qVeCcjI.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\NyplNtU.exe
  C:\Windows\System\NyplNtU.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\imCrJgR.exe
  C:\Windows\System\imCrJgR.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\sZZbGoy.exe
  C:\Windows\System\sZZbGoy.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\pObwSoe.exe
  C:\Windows\System\pObwSoe.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\JWnPxJq.exe
  C:\Windows\System\JWnPxJq.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\HZLDFob.exe
  C:\Windows\System\HZLDFob.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\DECBrWf.exe
  C:\Windows\System\DECBrWf.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\IVYRedc.exe
  C:\Windows\System\IVYRedc.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\vvvUrQn.exe
  C:\Windows\System\vvvUrQn.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\UniFoCV.exe
  C:\Windows\System\UniFoCV.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\xGshHQb.exe
  C:\Windows\System\xGshHQb.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\iTzSuqi.exe
  C:\Windows\System\iTzSuqi.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\FeEyoYk.exe
  C:\Windows\System\FeEyoYk.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\GgbgbJD.exe
  C:\Windows\System\GgbgbJD.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\FnVVUmW.exe
  C:\Windows\System\FnVVUmW.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\rDQObZe.exe
  C:\Windows\System\rDQObZe.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\UvqdVnS.exe
  C:\Windows\System\UvqdVnS.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\VSgvEZH.exe
  C:\Windows\System\VSgvEZH.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\tsCFSuI.exe
  C:\Windows\System\tsCFSuI.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\MhvpjxM.exe
  C:\Windows\System\MhvpjxM.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\dPSvdtU.exe
  C:\Windows\System\dPSvdtU.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\PWGpVFA.exe
  C:\Windows\System\PWGpVFA.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\letcjdD.exe
  C:\Windows\System\letcjdD.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\jDcTMBp.exe
  C:\Windows\System\jDcTMBp.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\WmNtKxI.exe
  C:\Windows\System\WmNtKxI.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\mQnIDDQ.exe
  C:\Windows\System\mQnIDDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\CZEWSEh.exe
  C:\Windows\System\CZEWSEh.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\ntwhOvP.exe
  C:\Windows\System\ntwhOvP.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\yXOYiUj.exe
  C:\Windows\System\yXOYiUj.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\NxexsRd.exe
  C:\Windows\System\NxexsRd.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\QiRKudg.exe
  C:\Windows\System\QiRKudg.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\RvYfwtH.exe
  C:\Windows\System\RvYfwtH.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\ZuMdDaV.exe
  C:\Windows\System\ZuMdDaV.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\SCCMWEx.exe
  C:\Windows\System\SCCMWEx.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\yDdvuRX.exe
  C:\Windows\System\yDdvuRX.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\BVBZMwF.exe
  C:\Windows\System\BVBZMwF.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\zsYcwWf.exe
  C:\Windows\System\zsYcwWf.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\LRyUntf.exe
  C:\Windows\System\LRyUntf.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\QeLtGme.exe
  C:\Windows\System\QeLtGme.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\eyohMog.exe
  C:\Windows\System\eyohMog.exe
  2⤵
  PID:4236
- C:\Windows\System\OzYHlaY.exe
  C:\Windows\System\OzYHlaY.exe
  2⤵
  PID:5032
- C:\Windows\System\YRscHNp.exe
  C:\Windows\System\YRscHNp.exe
  2⤵
  PID:3060
- C:\Windows\System\VDagYLu.exe
  C:\Windows\System\VDagYLu.exe
  2⤵
  PID:4980
- C:\Windows\System\Ncmpxgh.exe
  C:\Windows\System\Ncmpxgh.exe
  2⤵
  PID:1796
- C:\Windows\System\nkXgFhj.exe
  C:\Windows\System\nkXgFhj.exe
  2⤵
  PID:2636
- C:\Windows\System\jOOXVSi.exe
  C:\Windows\System\jOOXVSi.exe
  2⤵
  PID:1492
- C:\Windows\System\bTkrxgp.exe
  C:\Windows\System\bTkrxgp.exe
  2⤵
  PID:1388
- C:\Windows\System\GOhXRxv.exe
  C:\Windows\System\GOhXRxv.exe
  2⤵
  PID:4736
- C:\Windows\System\awslcTm.exe
  C:\Windows\System\awslcTm.exe
  2⤵
  PID:4868
- C:\Windows\System\ZiBybOk.exe
  C:\Windows\System\ZiBybOk.exe
  2⤵
  PID:3316
- C:\Windows\System\Rxygyji.exe
  C:\Windows\System\Rxygyji.exe
  2⤵
  PID:1644
- C:\Windows\System\pIPMcuK.exe
  C:\Windows\System\pIPMcuK.exe
  2⤵
  PID:2592
- C:\Windows\System\xTDCzuJ.exe
  C:\Windows\System\xTDCzuJ.exe
  2⤵
  PID:2584
- C:\Windows\System\ALxHLgU.exe
  C:\Windows\System\ALxHLgU.exe
  2⤵
  PID:1432
- C:\Windows\System\XtcTRAo.exe
  C:\Windows\System\XtcTRAo.exe
  2⤵
  PID:5000
- C:\Windows\System\tGnvZMx.exe
  C:\Windows\System\tGnvZMx.exe
  2⤵
  PID:5148
- C:\Windows\System\DqFXwtl.exe
  C:\Windows\System\DqFXwtl.exe
  2⤵
  PID:5176
- C:\Windows\System\PnKCIUQ.exe
  C:\Windows\System\PnKCIUQ.exe
  2⤵
  PID:5204
- C:\Windows\System\jvmRHAo.exe
  C:\Windows\System\jvmRHAo.exe
  2⤵
  PID:5232
- C:\Windows\System\HlcJjGH.exe
  C:\Windows\System\HlcJjGH.exe
  2⤵
  PID:5260
- C:\Windows\System\tQPZetF.exe
  C:\Windows\System\tQPZetF.exe
  2⤵
  PID:5288
- C:\Windows\System\cKaIrLO.exe
  C:\Windows\System\cKaIrLO.exe
  2⤵
  PID:5316
- C:\Windows\System\smTPzhq.exe
  C:\Windows\System\smTPzhq.exe
  2⤵
  PID:5344
- C:\Windows\System\oTcrFkM.exe
  C:\Windows\System\oTcrFkM.exe
  2⤵
  PID:5372
- C:\Windows\System\OFVyHHI.exe
  C:\Windows\System\OFVyHHI.exe
  2⤵
  PID:5400
- C:\Windows\System\RofdYVN.exe
  C:\Windows\System\RofdYVN.exe
  2⤵
  PID:5428
- C:\Windows\System\oFoHiYQ.exe
  C:\Windows\System\oFoHiYQ.exe
  2⤵
  PID:5456
- C:\Windows\System\IEZnvvX.exe
  C:\Windows\System\IEZnvvX.exe
  2⤵
  PID:5484
- C:\Windows\System\ufuGXsm.exe
  C:\Windows\System\ufuGXsm.exe
  2⤵
  PID:5512
- C:\Windows\System\VEkYMLn.exe
  C:\Windows\System\VEkYMLn.exe
  2⤵
  PID:5540
- C:\Windows\System\qQLLDVg.exe
  C:\Windows\System\qQLLDVg.exe
  2⤵
  PID:5564
- C:\Windows\System\ytfBVYA.exe
  C:\Windows\System\ytfBVYA.exe
  2⤵
  PID:5596
- C:\Windows\System\nQhAVdl.exe
  C:\Windows\System\nQhAVdl.exe
  2⤵
  PID:5624
- C:\Windows\System\LoCRhPh.exe
  C:\Windows\System\LoCRhPh.exe
  2⤵
  PID:5652
- C:\Windows\System\bcetzXw.exe
  C:\Windows\System\bcetzXw.exe
  2⤵
  PID:5680
- C:\Windows\System\JZoVBBD.exe
  C:\Windows\System\JZoVBBD.exe
  2⤵
  PID:5712
- C:\Windows\System\fucBtzG.exe
  C:\Windows\System\fucBtzG.exe
  2⤵
  PID:5744
- C:\Windows\System\wauNVQA.exe
  C:\Windows\System\wauNVQA.exe
  2⤵
  PID:5772
- C:\Windows\System\tuheDVO.exe
  C:\Windows\System\tuheDVO.exe
  2⤵
  PID:5792
- C:\Windows\System\PNFdvDh.exe
  C:\Windows\System\PNFdvDh.exe
  2⤵
  PID:5820
- C:\Windows\System\snqcedP.exe
  C:\Windows\System\snqcedP.exe
  2⤵
  PID:5836
- C:\Windows\System\TqAyRGj.exe
  C:\Windows\System\TqAyRGj.exe
  2⤵
  PID:5864
- C:\Windows\System\KQcRkUe.exe
  C:\Windows\System\KQcRkUe.exe
  2⤵
  PID:5900
- C:\Windows\System\sVnVVjZ.exe
  C:\Windows\System\sVnVVjZ.exe
  2⤵
  PID:5932
- C:\Windows\System\LrfNwmv.exe
  C:\Windows\System\LrfNwmv.exe
  2⤵
  PID:5960
- C:\Windows\System\NIFxtmi.exe
  C:\Windows\System\NIFxtmi.exe
  2⤵
  PID:5988
- C:\Windows\System\pWLFfjN.exe
  C:\Windows\System\pWLFfjN.exe
  2⤵
  PID:6016
- C:\Windows\System\bbLbiTy.exe
  C:\Windows\System\bbLbiTy.exe
  2⤵
  PID:6044
- C:\Windows\System\wWagjvj.exe
  C:\Windows\System\wWagjvj.exe
  2⤵
  PID:6072
- C:\Windows\System\rCqRNTW.exe
  C:\Windows\System\rCqRNTW.exe
  2⤵
  PID:6100
- C:\Windows\System\cOgBMDB.exe
  C:\Windows\System\cOgBMDB.exe
  2⤵
  PID:6128
- C:\Windows\System\pAEVzig.exe
  C:\Windows\System\pAEVzig.exe
  2⤵
  PID:1760
- C:\Windows\System\nCafqdt.exe
  C:\Windows\System\nCafqdt.exe
  2⤵
  PID:3824
- C:\Windows\System\jjREOME.exe
  C:\Windows\System\jjREOME.exe
  2⤵
  PID:2364
- C:\Windows\System\bUdOUNw.exe
  C:\Windows\System\bUdOUNw.exe
  2⤵
  PID:212
- C:\Windows\System\QaSoInv.exe
  C:\Windows\System\QaSoInv.exe
  2⤵
  PID:3464
- C:\Windows\System\tSlwUiz.exe
  C:\Windows\System\tSlwUiz.exe
  2⤵
  PID:1096
- C:\Windows\System\gpsLErr.exe
  C:\Windows\System\gpsLErr.exe
  2⤵
  PID:860
- C:\Windows\System\PwYIpFu.exe
  C:\Windows\System\PwYIpFu.exe
  2⤵
  PID:5192
- C:\Windows\System\ALyAWbv.exe
  C:\Windows\System\ALyAWbv.exe
  2⤵
  PID:5272
- C:\Windows\System\RNPDTGU.exe
  C:\Windows\System\RNPDTGU.exe
  2⤵
  PID:5336
- C:\Windows\System\RWJHqsq.exe
  C:\Windows\System\RWJHqsq.exe
  2⤵
  PID:5392
- C:\Windows\System\qbppSbY.exe
  C:\Windows\System\qbppSbY.exe
  2⤵
  PID:5444
- C:\Windows\System\DXFgkKL.exe
  C:\Windows\System\DXFgkKL.exe
  2⤵
  PID:5504
- C:\Windows\System\WrsDMUJ.exe
  C:\Windows\System\WrsDMUJ.exe
  2⤵
  PID:5584
- C:\Windows\System\tlncKmx.exe
  C:\Windows\System\tlncKmx.exe
  2⤵
  PID:5640
- C:\Windows\System\uYCjNMK.exe
  C:\Windows\System\uYCjNMK.exe
  2⤵
  PID:5696
- C:\Windows\System\zHYNrdc.exe
  C:\Windows\System\zHYNrdc.exe
  2⤵
  PID:5764
- C:\Windows\System\ECVhiuA.exe
  C:\Windows\System\ECVhiuA.exe
  2⤵
  PID:5828
- C:\Windows\System\KUExNPU.exe
  C:\Windows\System\KUExNPU.exe
  2⤵
  PID:5888
- C:\Windows\System\zRvYNEc.exe
  C:\Windows\System\zRvYNEc.exe
  2⤵
  PID:5952
- C:\Windows\System\rbWgvgv.exe
  C:\Windows\System\rbWgvgv.exe
  2⤵
  PID:6028
- C:\Windows\System\YpdWMrV.exe
  C:\Windows\System\YpdWMrV.exe
  2⤵
  PID:6088
- C:\Windows\System\JSqzQsO.exe
  C:\Windows\System\JSqzQsO.exe
  2⤵
  PID:1552
- C:\Windows\System\EwpMWFI.exe
  C:\Windows\System\EwpMWFI.exe
  2⤵
  PID:3984
- C:\Windows\System\dDWMMwb.exe
  C:\Windows\System\dDWMMwb.exe
  2⤵
  PID:1476
- C:\Windows\System\pvUtVYq.exe
  C:\Windows\System\pvUtVYq.exe
  2⤵
  PID:5140
- C:\Windows\System\eqyxPDN.exe
  C:\Windows\System\eqyxPDN.exe
  2⤵
  PID:5308
- C:\Windows\System\RBvitHs.exe
  C:\Windows\System\RBvitHs.exe
  2⤵
  PID:5440
- C:\Windows\System\IALpTFQ.exe
  C:\Windows\System\IALpTFQ.exe
  2⤵
  PID:5608
- C:\Windows\System\GFZZrDf.exe
  C:\Windows\System\GFZZrDf.exe
  2⤵
  PID:5736
- C:\Windows\System\kszvkgS.exe
  C:\Windows\System\kszvkgS.exe
  2⤵
  PID:5876
- C:\Windows\System\pCUqoOe.exe
  C:\Windows\System\pCUqoOe.exe
  2⤵
  PID:6164
- C:\Windows\System\TqoLYnB.exe
  C:\Windows\System\TqoLYnB.exe
  2⤵
  PID:6192
- C:\Windows\System\AmJDiJS.exe
  C:\Windows\System\AmJDiJS.exe
  2⤵
  PID:6220
- C:\Windows\System\kMhYfzZ.exe
  C:\Windows\System\kMhYfzZ.exe
  2⤵
  PID:6248
- C:\Windows\System\IvmezGu.exe
  C:\Windows\System\IvmezGu.exe
  2⤵
  PID:6276
- C:\Windows\System\FKvgHbl.exe
  C:\Windows\System\FKvgHbl.exe
  2⤵
  PID:6304
- C:\Windows\System\lyEuvER.exe
  C:\Windows\System\lyEuvER.exe
  2⤵
  PID:6332
- C:\Windows\System\ZQdhdGl.exe
  C:\Windows\System\ZQdhdGl.exe
  2⤵
  PID:6360
- C:\Windows\System\qeYtGWw.exe
  C:\Windows\System\qeYtGWw.exe
  2⤵
  PID:6388
- C:\Windows\System\QdMlqGF.exe
  C:\Windows\System\QdMlqGF.exe
  2⤵
  PID:6416
- C:\Windows\System\SAVmxtc.exe
  C:\Windows\System\SAVmxtc.exe
  2⤵
  PID:6444
- C:\Windows\System\CbkavpU.exe
  C:\Windows\System\CbkavpU.exe
  2⤵
  PID:6472
- C:\Windows\System\zyZcyMb.exe
  C:\Windows\System\zyZcyMb.exe
  2⤵
  PID:6500
- C:\Windows\System\Ohdioma.exe
  C:\Windows\System\Ohdioma.exe
  2⤵
  PID:6528
- C:\Windows\System\HULPiqq.exe
  C:\Windows\System\HULPiqq.exe
  2⤵
  PID:6556
- C:\Windows\System\gfkBxcI.exe
  C:\Windows\System\gfkBxcI.exe
  2⤵
  PID:6584
- C:\Windows\System\HrQLEkT.exe
  C:\Windows\System\HrQLEkT.exe
  2⤵
  PID:6612
- C:\Windows\System\xBmOvMU.exe
  C:\Windows\System\xBmOvMU.exe
  2⤵
  PID:6640
- C:\Windows\System\LFQpivB.exe
  C:\Windows\System\LFQpivB.exe
  2⤵
  PID:6668
- C:\Windows\System\hLAUTCj.exe
  C:\Windows\System\hLAUTCj.exe
  2⤵
  PID:6696
- C:\Windows\System\hHWGcYF.exe
  C:\Windows\System\hHWGcYF.exe
  2⤵
  PID:6724
- C:\Windows\System\Zqfevsh.exe
  C:\Windows\System\Zqfevsh.exe
  2⤵
  PID:6752
- C:\Windows\System\wqYqFSj.exe
  C:\Windows\System\wqYqFSj.exe
  2⤵
  PID:6780
- C:\Windows\System\FHzxpiL.exe
  C:\Windows\System\FHzxpiL.exe
  2⤵
  PID:6808
- C:\Windows\System\ivLKajl.exe
  C:\Windows\System\ivLKajl.exe
  2⤵
  PID:6832
- C:\Windows\System\VOlQyZJ.exe
  C:\Windows\System\VOlQyZJ.exe
  2⤵
  PID:6864
- C:\Windows\System\NLBEJYs.exe
  C:\Windows\System\NLBEJYs.exe
  2⤵
  PID:6892
- C:\Windows\System\OFUiKoO.exe
  C:\Windows\System\OFUiKoO.exe
  2⤵
  PID:6920
- C:\Windows\System\ZUjCfMP.exe
  C:\Windows\System\ZUjCfMP.exe
  2⤵
  PID:6948
- C:\Windows\System\WDxhRTM.exe
  C:\Windows\System\WDxhRTM.exe
  2⤵
  PID:6976
- C:\Windows\System\bcdmMtl.exe
  C:\Windows\System\bcdmMtl.exe
  2⤵
  PID:7004
- C:\Windows\System\lJShXTU.exe
  C:\Windows\System\lJShXTU.exe
  2⤵
  PID:7032
- C:\Windows\System\dyIdGVy.exe
  C:\Windows\System\dyIdGVy.exe
  2⤵
  PID:7060
- C:\Windows\System\DaeoANc.exe
  C:\Windows\System\DaeoANc.exe
  2⤵
  PID:7088
- C:\Windows\System\VuVQmYB.exe
  C:\Windows\System\VuVQmYB.exe
  2⤵
  PID:7116
- C:\Windows\System\HioIQkA.exe
  C:\Windows\System\HioIQkA.exe
  2⤵
  PID:7144
- C:\Windows\System\zseIRyk.exe
  C:\Windows\System\zseIRyk.exe
  2⤵
  PID:5980
- C:\Windows\System\OBtCATO.exe
  C:\Windows\System\OBtCATO.exe
  2⤵
  PID:6120
- C:\Windows\System\JMBeAOe.exe
  C:\Windows\System\JMBeAOe.exe
  2⤵
  PID:4404
- C:\Windows\System\qOXZtyx.exe
  C:\Windows\System\qOXZtyx.exe
  2⤵
  PID:5256
- C:\Windows\System\rcHWLUi.exe
  C:\Windows\System\rcHWLUi.exe
  2⤵
  PID:5668
- C:\Windows\System\cvISreF.exe
  C:\Windows\System\cvISreF.exe
  2⤵
  PID:6152
- C:\Windows\System\mqxjAwX.exe
  C:\Windows\System\mqxjAwX.exe
  2⤵
  PID:6212
- C:\Windows\System\gMnoSMa.exe
  C:\Windows\System\gMnoSMa.exe
  2⤵
  PID:6288
- C:\Windows\System\RDEDwkW.exe
  C:\Windows\System\RDEDwkW.exe
  2⤵
  PID:6348
- C:\Windows\System\CKtLzHM.exe
  C:\Windows\System\CKtLzHM.exe
  2⤵
  PID:6408
- C:\Windows\System\WKaNSNa.exe
  C:\Windows\System\WKaNSNa.exe
  2⤵
  PID:6484
- C:\Windows\System\FfoHHTg.exe
  C:\Windows\System\FfoHHTg.exe
  2⤵
  PID:6544
- C:\Windows\System\aEOviYE.exe
  C:\Windows\System\aEOviYE.exe
  2⤵
  PID:6604
- C:\Windows\System\tkDYgGH.exe
  C:\Windows\System\tkDYgGH.exe
  2⤵
  PID:6660
- C:\Windows\System\QLmkvuG.exe
  C:\Windows\System\QLmkvuG.exe
  2⤵
  PID:6716
- C:\Windows\System\VRtxeNQ.exe
  C:\Windows\System\VRtxeNQ.exe
  2⤵
  PID:6772
- C:\Windows\System\YlSHEvX.exe
  C:\Windows\System\YlSHEvX.exe
  2⤵
  PID:6824
- C:\Windows\System\eJXFpis.exe
  C:\Windows\System\eJXFpis.exe
  2⤵
  PID:6880
- C:\Windows\System\fBspuLL.exe
  C:\Windows\System\fBspuLL.exe
  2⤵
  PID:6940
- C:\Windows\System\itprnLb.exe
  C:\Windows\System\itprnLb.exe
  2⤵
  PID:7016
- C:\Windows\System\pATunlk.exe
  C:\Windows\System\pATunlk.exe
  2⤵
  PID:2136
- C:\Windows\System\vnDOqOT.exe
  C:\Windows\System\vnDOqOT.exe
  2⤵
  PID:7108
- C:\Windows\System\bfiMPXI.exe
  C:\Windows\System\bfiMPXI.exe
  2⤵
  PID:6204
- C:\Windows\System\KVSkEAA.exe
  C:\Windows\System\KVSkEAA.exe
  2⤵
  PID:6320
- C:\Windows\System\EkHRwWv.exe
  C:\Windows\System\EkHRwWv.exe
  2⤵
  PID:6400
- C:\Windows\System\KOERLhd.exe
  C:\Windows\System\KOERLhd.exe
  2⤵
  PID:6572
- C:\Windows\System\RSjyFyl.exe
  C:\Windows\System\RSjyFyl.exe
  2⤵
  PID:2320
- C:\Windows\System\WSmzrkg.exe
  C:\Windows\System\WSmzrkg.exe
  2⤵
  PID:1572
- C:\Windows\System\VkOQPLC.exe
  C:\Windows\System\VkOQPLC.exe
  2⤵
  PID:6768
- C:\Windows\System\XhHYoRE.exe
  C:\Windows\System\XhHYoRE.exe
  2⤵
  PID:4552
- C:\Windows\System\SPfKGbF.exe
  C:\Windows\System\SPfKGbF.exe
  2⤵
  PID:6852
- C:\Windows\System\yDfgIhG.exe
  C:\Windows\System\yDfgIhG.exe
  2⤵
  PID:6912
- C:\Windows\System\EmKBtyC.exe
  C:\Windows\System\EmKBtyC.exe
  2⤵
  PID:7052
- C:\Windows\System\EFoneIQ.exe
  C:\Windows\System\EFoneIQ.exe
  2⤵
  PID:3600
- C:\Windows\System\jSkCeal.exe
  C:\Windows\System\jSkCeal.exe
  2⤵
  PID:5532
- C:\Windows\System\ieuRpjp.exe
  C:\Windows\System\ieuRpjp.exe
  2⤵
  PID:4588
- C:\Windows\System\XnKoQSl.exe
  C:\Windows\System\XnKoQSl.exe
  2⤵
  PID:1904
- C:\Windows\System\VxxXEVS.exe
  C:\Windows\System\VxxXEVS.exe
  2⤵
  PID:4924
- C:\Windows\System\kFXXAEw.exe
  C:\Windows\System\kFXXAEw.exe
  2⤵
  PID:412
- C:\Windows\System\lnFqjZr.exe
  C:\Windows\System\lnFqjZr.exe
  2⤵
  PID:1800
- C:\Windows\System\wXRwvff.exe
  C:\Windows\System\wXRwvff.exe
  2⤵
  PID:6516
- C:\Windows\System\ldcIZJN.exe
  C:\Windows\System\ldcIZJN.exe
  2⤵
  PID:7048
- C:\Windows\System\rqIFNEL.exe
  C:\Windows\System\rqIFNEL.exe
  2⤵
  PID:6968
- C:\Windows\System\JorcHKj.exe
  C:\Windows\System\JorcHKj.exe
  2⤵
  PID:2468
- C:\Windows\System\eJqqSvH.exe
  C:\Windows\System\eJqqSvH.exe
  2⤵
  PID:5036
- C:\Windows\System\Ozqfzzw.exe
  C:\Windows\System\Ozqfzzw.exe
  2⤵
  PID:7176
- C:\Windows\System\yILLPSO.exe
  C:\Windows\System\yILLPSO.exe
  2⤵
  PID:7196
- C:\Windows\System\httUWtD.exe
  C:\Windows\System\httUWtD.exe
  2⤵
  PID:7224
- C:\Windows\System\TrBZUQP.exe
  C:\Windows\System\TrBZUQP.exe
  2⤵
  PID:7260
- C:\Windows\System\KQfwPbE.exe
  C:\Windows\System\KQfwPbE.exe
  2⤵
  PID:7296
- C:\Windows\System\JiwLbQX.exe
  C:\Windows\System\JiwLbQX.exe
  2⤵
  PID:7380
- C:\Windows\System\InOGXnn.exe
  C:\Windows\System\InOGXnn.exe
  2⤵
  PID:7400
- C:\Windows\System\RzEoutW.exe
  C:\Windows\System\RzEoutW.exe
  2⤵
  PID:7420
- C:\Windows\System\jWIKJjZ.exe
  C:\Windows\System\jWIKJjZ.exe
  2⤵
  PID:7452
- C:\Windows\System\QveBplH.exe
  C:\Windows\System\QveBplH.exe
  2⤵
  PID:7476
- C:\Windows\System\eGmDjkH.exe
  C:\Windows\System\eGmDjkH.exe
  2⤵
  PID:7508
- C:\Windows\System\aEEKRlI.exe
  C:\Windows\System\aEEKRlI.exe
  2⤵
  PID:7540
- C:\Windows\System\PLjzkpI.exe
  C:\Windows\System\PLjzkpI.exe
  2⤵
  PID:7644
- C:\Windows\System\XUSDDAP.exe
  C:\Windows\System\XUSDDAP.exe
  2⤵
  PID:7676
- C:\Windows\System\jjMxzbi.exe
  C:\Windows\System\jjMxzbi.exe
  2⤵
  PID:7692
- C:\Windows\System\xLgyEoY.exe
  C:\Windows\System\xLgyEoY.exe
  2⤵
  PID:7712
- C:\Windows\System\uyxjjVk.exe
  C:\Windows\System\uyxjjVk.exe
  2⤵
  PID:7752
- C:\Windows\System\HNZRfmq.exe
  C:\Windows\System\HNZRfmq.exe
  2⤵
  PID:7776
- C:\Windows\System\fwSZXnx.exe
  C:\Windows\System\fwSZXnx.exe
  2⤵
  PID:7796
- C:\Windows\System\PupaReH.exe
  C:\Windows\System\PupaReH.exe
  2⤵
  PID:7828
- C:\Windows\System\jcyaQKR.exe
  C:\Windows\System\jcyaQKR.exe
  2⤵
  PID:7868
- C:\Windows\System\uoajndE.exe
  C:\Windows\System\uoajndE.exe
  2⤵
  PID:7900
- C:\Windows\System\lpECwdm.exe
  C:\Windows\System\lpECwdm.exe
  2⤵
  PID:7924
- C:\Windows\System\ZpqVDSo.exe
  C:\Windows\System\ZpqVDSo.exe
  2⤵
  PID:7964
- C:\Windows\System\RKAXCGZ.exe
  C:\Windows\System\RKAXCGZ.exe
  2⤵
  PID:8000
- C:\Windows\System\WrLphBH.exe
  C:\Windows\System\WrLphBH.exe
  2⤵
  PID:8024
- C:\Windows\System\zNdaHTr.exe
  C:\Windows\System\zNdaHTr.exe
  2⤵
  PID:8048
- C:\Windows\System\UUAtMuL.exe
  C:\Windows\System\UUAtMuL.exe
  2⤵
  PID:8156
- C:\Windows\System\cQtMEZG.exe
  C:\Windows\System\cQtMEZG.exe
  2⤵
  PID:1136
- C:\Windows\System\DvNXjrv.exe
  C:\Windows\System\DvNXjrv.exe
  2⤵
  PID:7044
- C:\Windows\System\zrCeDQq.exe
  C:\Windows\System\zrCeDQq.exe
  2⤵
  PID:7276
- C:\Windows\System\UxBooPz.exe
  C:\Windows\System\UxBooPz.exe
  2⤵
  PID:7392
- C:\Windows\System\QTEWYEF.exe
  C:\Windows\System\QTEWYEF.exe
  2⤵
  PID:7472
- C:\Windows\System\uYHktUy.exe
  C:\Windows\System\uYHktUy.exe
  2⤵
  PID:7560
- C:\Windows\System\ivPljJV.exe
  C:\Windows\System\ivPljJV.exe
  2⤵
  PID:7636
- C:\Windows\System\uwcGdrR.exe
  C:\Windows\System\uwcGdrR.exe
  2⤵
  PID:7572
- C:\Windows\System\QzEIkas.exe
  C:\Windows\System\QzEIkas.exe
  2⤵
  PID:7440
- C:\Windows\System\qzogvPB.exe
  C:\Windows\System\qzogvPB.exe
  2⤵
  PID:7688
- C:\Windows\System\bhSWdGl.exe
  C:\Windows\System\bhSWdGl.exe
  2⤵
  PID:7728
- C:\Windows\System\tsYUpUm.exe
  C:\Windows\System\tsYUpUm.exe
  2⤵
  PID:7792
- C:\Windows\System\piFMLUL.exe
  C:\Windows\System\piFMLUL.exe
  2⤵
  PID:820
- C:\Windows\System\UPeVTxH.exe
  C:\Windows\System\UPeVTxH.exe
  2⤵
  PID:7916
- C:\Windows\System\mRuQWEA.exe
  C:\Windows\System\mRuQWEA.exe
  2⤵
  PID:8036
- C:\Windows\System\ISVCBGa.exe
  C:\Windows\System\ISVCBGa.exe
  2⤵
  PID:8140
- C:\Windows\System\roIqmGM.exe
  C:\Windows\System\roIqmGM.exe
  2⤵
  PID:8168
- C:\Windows\System\xKHHBES.exe
  C:\Windows\System\xKHHBES.exe
  2⤵
  PID:7700
- C:\Windows\System\pjOSUAW.exe
  C:\Windows\System\pjOSUAW.exe
  2⤵
  PID:8092
- C:\Windows\System\grDgSZc.exe
  C:\Windows\System\grDgSZc.exe
  2⤵
  PID:7936
- C:\Windows\System\QpXEimi.exe
  C:\Windows\System\QpXEimi.exe
  2⤵
  PID:7416
- C:\Windows\System\HMcGHcN.exe
  C:\Windows\System\HMcGHcN.exe
  2⤵
  PID:7444
- C:\Windows\System\ymqCWZF.exe
  C:\Windows\System\ymqCWZF.exe
  2⤵
  PID:6512
- C:\Windows\System\xzMSuHZ.exe
  C:\Windows\System\xzMSuHZ.exe
  2⤵
  PID:7708
- C:\Windows\System\SEKrBsh.exe
  C:\Windows\System\SEKrBsh.exe
  2⤵
  PID:7820
- C:\Windows\System\nbqQcoZ.exe
  C:\Windows\System\nbqQcoZ.exe
  2⤵
  PID:7980
- C:\Windows\System\cyELPYI.exe
  C:\Windows\System\cyELPYI.exe
  2⤵
  PID:736
- C:\Windows\System\ekpnNkI.exe
  C:\Windows\System\ekpnNkI.exe
  2⤵
  PID:8104
- C:\Windows\System\yWkYEYr.exe
  C:\Windows\System\yWkYEYr.exe
  2⤵
  PID:7268
- C:\Windows\System\UutlnOF.exe
  C:\Windows\System\UutlnOF.exe
  2⤵
  PID:1208
- C:\Windows\System\uCNukzX.exe
  C:\Windows\System\uCNukzX.exe
  2⤵
  PID:7952
- C:\Windows\System\hiiLrvS.exe
  C:\Windows\System\hiiLrvS.exe
  2⤵
  PID:8100
- C:\Windows\System\aVRfmHm.exe
  C:\Windows\System\aVRfmHm.exe
  2⤵
  PID:7660
- C:\Windows\System\RlqGHqj.exe
  C:\Windows\System\RlqGHqj.exe
  2⤵
  PID:8200
- C:\Windows\System\jXsiwLi.exe
  C:\Windows\System\jXsiwLi.exe
  2⤵
  PID:8228
- C:\Windows\System\EMrNkAF.exe
  C:\Windows\System\EMrNkAF.exe
  2⤵
  PID:8244
- C:\Windows\System\HbUDSXg.exe
  C:\Windows\System\HbUDSXg.exe
  2⤵
  PID:8276
- C:\Windows\System\PEOBtTB.exe
  C:\Windows\System\PEOBtTB.exe
  2⤵
  PID:8304
- C:\Windows\System\jPexSbJ.exe
  C:\Windows\System\jPexSbJ.exe
  2⤵
  PID:8328
- C:\Windows\System\pFhrjQC.exe
  C:\Windows\System\pFhrjQC.exe
  2⤵
  PID:8356
- C:\Windows\System\qCcnAzg.exe
  C:\Windows\System\qCcnAzg.exe
  2⤵
  PID:8384
- C:\Windows\System\nFBwYar.exe
  C:\Windows\System\nFBwYar.exe
  2⤵
  PID:8412
- C:\Windows\System\MAIusQK.exe
  C:\Windows\System\MAIusQK.exe
  2⤵
  PID:8440
- C:\Windows\System\enizCUE.exe
  C:\Windows\System\enizCUE.exe
  2⤵
  PID:8480
- C:\Windows\System\ZsFEPth.exe
  C:\Windows\System\ZsFEPth.exe
  2⤵
  PID:8508
- C:\Windows\System\TzrSjsU.exe
  C:\Windows\System\TzrSjsU.exe
  2⤵
  PID:8528
- C:\Windows\System\wAcGtTm.exe
  C:\Windows\System\wAcGtTm.exe
  2⤵
  PID:8552
- C:\Windows\System\MGnpBnh.exe
  C:\Windows\System\MGnpBnh.exe
  2⤵
  PID:8584
- C:\Windows\System\LXJDkSp.exe
  C:\Windows\System\LXJDkSp.exe
  2⤵
  PID:8608
- C:\Windows\System\nnVTUnc.exe
  C:\Windows\System\nnVTUnc.exe
  2⤵
  PID:8644
- C:\Windows\System\uTbryoP.exe
  C:\Windows\System\uTbryoP.exe
  2⤵
  PID:8664
- C:\Windows\System\jwPsrOZ.exe
  C:\Windows\System\jwPsrOZ.exe
  2⤵
  PID:8692
- C:\Windows\System\OQagZwk.exe
  C:\Windows\System\OQagZwk.exe
  2⤵
  PID:8720
- C:\Windows\System\fRkkwZV.exe
  C:\Windows\System\fRkkwZV.exe
  2⤵
  PID:8760
- C:\Windows\System\AHlrLQV.exe
  C:\Windows\System\AHlrLQV.exe
  2⤵
  PID:8788
- C:\Windows\System\RGejnnr.exe
  C:\Windows\System\RGejnnr.exe
  2⤵
  PID:8816
- C:\Windows\System\OzUqGuz.exe
  C:\Windows\System\OzUqGuz.exe
  2⤵
  PID:8832
- C:\Windows\System\wOInIpB.exe
  C:\Windows\System\wOInIpB.exe
  2⤵
  PID:8872
- C:\Windows\System\hGvHOIz.exe
  C:\Windows\System\hGvHOIz.exe
  2⤵
  PID:8888
- C:\Windows\System\KiMOntQ.exe
  C:\Windows\System\KiMOntQ.exe
  2⤵
  PID:8928
- C:\Windows\System\nKhgEFm.exe
  C:\Windows\System\nKhgEFm.exe
  2⤵
  PID:8956
- C:\Windows\System\UstLDDl.exe
  C:\Windows\System\UstLDDl.exe
  2⤵
  PID:8972
- C:\Windows\System\gPrdkIX.exe
  C:\Windows\System\gPrdkIX.exe
  2⤵
  PID:8988
- C:\Windows\System\EYKWgTQ.exe
  C:\Windows\System\EYKWgTQ.exe
  2⤵
  PID:9020
- C:\Windows\System\lCVdhGa.exe
  C:\Windows\System\lCVdhGa.exe
  2⤵
  PID:9048
- C:\Windows\System\wWKAKIf.exe
  C:\Windows\System\wWKAKIf.exe
  2⤵
  PID:9072
- C:\Windows\System\FtpzBGZ.exe
  C:\Windows\System\FtpzBGZ.exe
  2⤵
  PID:9124
- C:\Windows\System\lOkeajH.exe
  C:\Windows\System\lOkeajH.exe
  2⤵
  PID:9152
- C:\Windows\System\oQKUyJX.exe
  C:\Windows\System\oQKUyJX.exe
  2⤵
  PID:9180
- C:\Windows\System\emQtsAP.exe
  C:\Windows\System\emQtsAP.exe
  2⤵
  PID:9212
- C:\Windows\System\hhgLFwk.exe
  C:\Windows\System\hhgLFwk.exe
  2⤵
  PID:4856
- C:\Windows\System\cBvcVDL.exe
  C:\Windows\System\cBvcVDL.exe
  2⤵
  PID:8260
- C:\Windows\System\lhczwMg.exe
  C:\Windows\System\lhczwMg.exe
  2⤵
  PID:3348
- C:\Windows\System\myKSDzu.exe
  C:\Windows\System\myKSDzu.exe
  2⤵
  PID:8404
- C:\Windows\System\VAIodiW.exe
  C:\Windows\System\VAIodiW.exe
  2⤵
  PID:8428
- C:\Windows\System\IEFozlN.exe
  C:\Windows\System\IEFozlN.exe
  2⤵
  PID:8500
- C:\Windows\System\LbZlyWX.exe
  C:\Windows\System\LbZlyWX.exe
  2⤵
  PID:8544
- C:\Windows\System\snrbCNl.exe
  C:\Windows\System\snrbCNl.exe
  2⤵
  PID:8652
- C:\Windows\System\LEqdMZR.exe
  C:\Windows\System\LEqdMZR.exe
  2⤵
  PID:8708
- C:\Windows\System\MVZGptZ.exe
  C:\Windows\System\MVZGptZ.exe
  2⤵
  PID:8756
- C:\Windows\System\bXjsnhg.exe
  C:\Windows\System\bXjsnhg.exe
  2⤵
  PID:8848
- C:\Windows\System\CjoWgzY.exe
  C:\Windows\System\CjoWgzY.exe
  2⤵
  PID:8868
- C:\Windows\System\wihoctf.exe
  C:\Windows\System\wihoctf.exe
  2⤵
  PID:8912
- C:\Windows\System\GyARhWr.exe
  C:\Windows\System\GyARhWr.exe
  2⤵
  PID:9000
- C:\Windows\System\eEBXPgE.exe
  C:\Windows\System\eEBXPgE.exe
  2⤵
  PID:9016
- C:\Windows\System\uSQTJen.exe
  C:\Windows\System\uSQTJen.exe
  2⤵
  PID:9096
- C:\Windows\System\pNfBsjl.exe
  C:\Windows\System\pNfBsjl.exe
  2⤵
  PID:9204
- C:\Windows\System\OKYnaUE.exe
  C:\Windows\System\OKYnaUE.exe
  2⤵
  PID:2252
- C:\Windows\System\yDbkANX.exe
  C:\Windows\System\yDbkANX.exe
  2⤵
  PID:8400
- C:\Windows\System\XCJeZOs.exe
  C:\Windows\System\XCJeZOs.exe
  2⤵
  PID:8524
- C:\Windows\System\SBLRURP.exe
  C:\Windows\System\SBLRURP.exe
  2⤵
  PID:8640
- C:\Windows\System\oNjhcAF.exe
  C:\Windows\System\oNjhcAF.exe
  2⤵
  PID:8784
- C:\Windows\System\DpcDXYr.exe
  C:\Windows\System\DpcDXYr.exe
  2⤵
  PID:8968
- C:\Windows\System\IMSYXlI.exe
  C:\Windows\System\IMSYXlI.exe
  2⤵
  PID:9108
- C:\Windows\System\HikQmDp.exe
  C:\Windows\System\HikQmDp.exe
  2⤵
  PID:8312
- C:\Windows\System\zjVtuip.exe
  C:\Windows\System\zjVtuip.exe
  2⤵
  PID:8864
- C:\Windows\System\CuvnDzF.exe
  C:\Windows\System\CuvnDzF.exe
  2⤵
  PID:9036
- C:\Windows\System\KniXUnv.exe
  C:\Windows\System\KniXUnv.exe
  2⤵
  PID:8376
- C:\Windows\System\lEiKYoQ.exe
  C:\Windows\System\lEiKYoQ.exe
  2⤵
  PID:8212
- C:\Windows\System\ILUWjbR.exe
  C:\Windows\System\ILUWjbR.exe
  2⤵
  PID:9232
- C:\Windows\System\pyfiEyM.exe
  C:\Windows\System\pyfiEyM.exe
  2⤵
  PID:9248
- C:\Windows\System\nTlZUix.exe
  C:\Windows\System\nTlZUix.exe
  2⤵
  PID:9276
- C:\Windows\System\IRjDqWl.exe
  C:\Windows\System\IRjDqWl.exe
  2⤵
  PID:9316
- C:\Windows\System\vFHZckX.exe
  C:\Windows\System\vFHZckX.exe
  2⤵
  PID:9332
- C:\Windows\System\kEsUeih.exe
  C:\Windows\System\kEsUeih.exe
  2⤵
  PID:9360
- C:\Windows\System\tSnbPse.exe
  C:\Windows\System\tSnbPse.exe
  2⤵
  PID:9400
- C:\Windows\System\kgTuUCN.exe
  C:\Windows\System\kgTuUCN.exe
  2⤵
  PID:9428
- C:\Windows\System\mbffSKI.exe
  C:\Windows\System\mbffSKI.exe
  2⤵
  PID:9456
- C:\Windows\System\UksJwLc.exe
  C:\Windows\System\UksJwLc.exe
  2⤵
  PID:9484
- C:\Windows\System\MUfYtFa.exe
  C:\Windows\System\MUfYtFa.exe
  2⤵
  PID:9508
- C:\Windows\System\FKdKoIC.exe
  C:\Windows\System\FKdKoIC.exe
  2⤵
  PID:9528
- C:\Windows\System\yqfTJgq.exe
  C:\Windows\System\yqfTJgq.exe
  2⤵
  PID:9544
- C:\Windows\System\ePGPVgI.exe
  C:\Windows\System\ePGPVgI.exe
  2⤵
  PID:9580
- C:\Windows\System\UrZGJCJ.exe
  C:\Windows\System\UrZGJCJ.exe
  2⤵
  PID:9612
- C:\Windows\System\KUExzgQ.exe
  C:\Windows\System\KUExzgQ.exe
  2⤵
  PID:9652
- C:\Windows\System\sNSPbuP.exe
  C:\Windows\System\sNSPbuP.exe
  2⤵
  PID:9668
- C:\Windows\System\GkUdlUw.exe
  C:\Windows\System\GkUdlUw.exe
  2⤵
  PID:9696
- C:\Windows\System\hQCwuHS.exe
  C:\Windows\System\hQCwuHS.exe
  2⤵
  PID:9712
- C:\Windows\System\BGqfUIS.exe
  C:\Windows\System\BGqfUIS.exe
  2⤵
  PID:9740
- C:\Windows\System\OExAAUl.exe
  C:\Windows\System\OExAAUl.exe
  2⤵
  PID:9780
- C:\Windows\System\gGBoAYG.exe
  C:\Windows\System\gGBoAYG.exe
  2⤵
  PID:9796
- C:\Windows\System\fnMeYqS.exe
  C:\Windows\System\fnMeYqS.exe
  2⤵
  PID:9832
- C:\Windows\System\BuQKCDI.exe
  C:\Windows\System\BuQKCDI.exe
  2⤵
  PID:9852
- C:\Windows\System\prWbwqt.exe
  C:\Windows\System\prWbwqt.exe
  2⤵
  PID:9880
- C:\Windows\System\VwUfgEe.exe
  C:\Windows\System\VwUfgEe.exe
  2⤵
  PID:9908
- C:\Windows\System\dFizFAN.exe
  C:\Windows\System\dFizFAN.exe
  2⤵
  PID:9940
- C:\Windows\System\bYEGicQ.exe
  C:\Windows\System\bYEGicQ.exe
  2⤵
  PID:9976
- C:\Windows\System\cSClCho.exe
  C:\Windows\System\cSClCho.exe
  2⤵
  PID:10012
- C:\Windows\System\RcYADxo.exe
  C:\Windows\System\RcYADxo.exe
  2⤵
  PID:10044
- C:\Windows\System\LbtTwef.exe
  C:\Windows\System\LbtTwef.exe
  2⤵
  PID:10064
- C:\Windows\System\oBLMqrX.exe
  C:\Windows\System\oBLMqrX.exe
  2⤵
  PID:10092
- C:\Windows\System\MXnKlBK.exe
  C:\Windows\System\MXnKlBK.exe
  2⤵
  PID:10120
- C:\Windows\System\UUOADvI.exe
  C:\Windows\System\UUOADvI.exe
  2⤵
  PID:10136
- C:\Windows\System\lAhfLOu.exe
  C:\Windows\System\lAhfLOu.exe
  2⤵
  PID:10152
- C:\Windows\System\fvApsBk.exe
  C:\Windows\System\fvApsBk.exe
  2⤵
  PID:10168
- C:\Windows\System\HEUZUjd.exe
  C:\Windows\System\HEUZUjd.exe
  2⤵
  PID:10196
- C:\Windows\System\ZoAAEkn.exe
  C:\Windows\System\ZoAAEkn.exe
  2⤵
  PID:10228
- C:\Windows\System\rIlrOrz.exe
  C:\Windows\System\rIlrOrz.exe
  2⤵
  PID:9240
- C:\Windows\System\QRIVAZm.exe
  C:\Windows\System\QRIVAZm.exe
  2⤵
  PID:9288
- C:\Windows\System\xNqVOUq.exe
  C:\Windows\System\xNqVOUq.exe
  2⤵
  PID:9356
- C:\Windows\System\yOeOglO.exe
  C:\Windows\System\yOeOglO.exe
  2⤵
  PID:9444
- C:\Windows\System\yoHencI.exe
  C:\Windows\System\yoHencI.exe
  2⤵
  PID:9492
- C:\Windows\System\DoBIDRd.exe
  C:\Windows\System\DoBIDRd.exe
  2⤵
  PID:9560
- C:\Windows\System\kaGqcpr.exe
  C:\Windows\System\kaGqcpr.exe
  2⤵
  PID:9688
- C:\Windows\System\BNOXgLm.exe
  C:\Windows\System\BNOXgLm.exe
  2⤵
  PID:9760
- C:\Windows\System\LDnJCiB.exe
  C:\Windows\System\LDnJCiB.exe
  2⤵
  PID:4240
- C:\Windows\System\kXYOzlg.exe
  C:\Windows\System\kXYOzlg.exe
  2⤵
  PID:9840
- C:\Windows\System\OdcChdw.exe
  C:\Windows\System\OdcChdw.exe
  2⤵
  PID:9924
- C:\Windows\System\xhQWqVh.exe
  C:\Windows\System\xhQWqVh.exe
  2⤵
  PID:9956
- C:\Windows\System\UoheDDK.exe
  C:\Windows\System\UoheDDK.exe
  2⤵
  PID:10028
- C:\Windows\System\fQFduPz.exe
  C:\Windows\System\fQFduPz.exe
  2⤵
  PID:10072
- C:\Windows\System\AAFiMZz.exe
  C:\Windows\System\AAFiMZz.exe
  2⤵
  PID:10184
- C:\Windows\System\RmUqNQP.exe
  C:\Windows\System\RmUqNQP.exe
  2⤵
  PID:9224
- C:\Windows\System\fIKrQAj.exe
  C:\Windows\System\fIKrQAj.exe
  2⤵
  PID:9388
- C:\Windows\System\gJcugWm.exe
  C:\Windows\System\gJcugWm.exe
  2⤵
  PID:9420
- C:\Windows\System\dStzzfn.exe
  C:\Windows\System\dStzzfn.exe
  2⤵
  PID:9640
- C:\Windows\System\KrCyRff.exe
  C:\Windows\System\KrCyRff.exe
  2⤵
  PID:3592
- C:\Windows\System\GVPEcHQ.exe
  C:\Windows\System\GVPEcHQ.exe
  2⤵
  PID:9892
- C:\Windows\System\BisLwKZ.exe
  C:\Windows\System\BisLwKZ.exe
  2⤵
  PID:10040
- C:\Windows\System\uNGXnqD.exe
  C:\Windows\System\uNGXnqD.exe
  2⤵
  PID:10128
- C:\Windows\System\JWsNZBN.exe
  C:\Windows\System\JWsNZBN.exe
  2⤵
  PID:9732
- C:\Windows\System\prnSDBT.exe
  C:\Windows\System\prnSDBT.exe
  2⤵
  PID:9964
- C:\Windows\System\YYifWSp.exe
  C:\Windows\System\YYifWSp.exe
  2⤵
  PID:9304
- C:\Windows\System\jmkgyxG.exe
  C:\Windows\System\jmkgyxG.exe
  2⤵
  PID:9636
- C:\Windows\System\QyYEIOX.exe
  C:\Windows\System\QyYEIOX.exe
  2⤵
  PID:10244
- C:\Windows\System\qzDdfwf.exe
  C:\Windows\System\qzDdfwf.exe
  2⤵
  PID:10276
- C:\Windows\System\kvMKnwa.exe
  C:\Windows\System\kvMKnwa.exe
  2⤵
  PID:10308
- C:\Windows\System\yirxccR.exe
  C:\Windows\System\yirxccR.exe
  2⤵
  PID:10324
- C:\Windows\System\IXchBzh.exe
  C:\Windows\System\IXchBzh.exe
  2⤵
  PID:10340
- C:\Windows\System\UFUiYKp.exe
  C:\Windows\System\UFUiYKp.exe
  2⤵
  PID:10376
- C:\Windows\System\hKzdmPj.exe
  C:\Windows\System\hKzdmPj.exe
  2⤵
  PID:10420
- C:\Windows\System\wwAFHeq.exe
  C:\Windows\System\wwAFHeq.exe
  2⤵
  PID:10436
- C:\Windows\System\rSIYvmD.exe
  C:\Windows\System\rSIYvmD.exe
  2⤵
  PID:10464
- C:\Windows\System\UMPYEFi.exe
  C:\Windows\System\UMPYEFi.exe
  2⤵
  PID:10500
- C:\Windows\System\dTmzvaU.exe
  C:\Windows\System\dTmzvaU.exe
  2⤵
  PID:10520
- C:\Windows\System\dZdAniu.exe
  C:\Windows\System\dZdAniu.exe
  2⤵
  PID:10548
- C:\Windows\System\bwDdKBF.exe
  C:\Windows\System\bwDdKBF.exe
  2⤵
  PID:10576
- C:\Windows\System\GKrAXEa.exe
  C:\Windows\System\GKrAXEa.exe
  2⤵
  PID:10616
- C:\Windows\System\Wwqyzhh.exe
  C:\Windows\System\Wwqyzhh.exe
  2⤵
  PID:10644
- C:\Windows\System\MOcPYEm.exe
  C:\Windows\System\MOcPYEm.exe
  2⤵
  PID:10672
- C:\Windows\System\DullEYf.exe
  C:\Windows\System\DullEYf.exe
  2⤵
  PID:10688
- C:\Windows\System\iAkhcPI.exe
  C:\Windows\System\iAkhcPI.exe
  2⤵
  PID:10728
- C:\Windows\System\QNIHJxM.exe
  C:\Windows\System\QNIHJxM.exe
  2⤵
  PID:10756
- C:\Windows\System\FFtjTFA.exe
  C:\Windows\System\FFtjTFA.exe
  2⤵
  PID:10784
- C:\Windows\System\oBJmuZL.exe
  C:\Windows\System\oBJmuZL.exe
  2⤵
  PID:10812
- C:\Windows\System\hFmYCuX.exe
  C:\Windows\System\hFmYCuX.exe
  2⤵
  PID:10840
- C:\Windows\System\CfydFXk.exe
  C:\Windows\System\CfydFXk.exe
  2⤵
  PID:10868
- C:\Windows\System\PZwChyB.exe
  C:\Windows\System\PZwChyB.exe
  2⤵
  PID:10884
- C:\Windows\System\fxtyHoW.exe
  C:\Windows\System\fxtyHoW.exe
  2⤵
  PID:10924
- C:\Windows\System\wLvUEPq.exe
  C:\Windows\System\wLvUEPq.exe
  2⤵
  PID:10952
- C:\Windows\System\RaeHEBe.exe
  C:\Windows\System\RaeHEBe.exe
  2⤵
  PID:10980
- C:\Windows\System\paUsmrQ.exe
  C:\Windows\System\paUsmrQ.exe
  2⤵
  PID:11008
- C:\Windows\System\OnrIiiz.exe
  C:\Windows\System\OnrIiiz.exe
  2⤵
  PID:11024
- C:\Windows\System\ZOJudUH.exe
  C:\Windows\System\ZOJudUH.exe
  2⤵
  PID:11052
- C:\Windows\System\XcKLKZI.exe
  C:\Windows\System\XcKLKZI.exe
  2⤵
  PID:11092
- C:\Windows\System\LcJmdKe.exe
  C:\Windows\System\LcJmdKe.exe
  2⤵
  PID:11112
- C:\Windows\System\NdowOlB.exe
  C:\Windows\System\NdowOlB.exe
  2⤵
  PID:11140
- C:\Windows\System\nFZmWWL.exe
  C:\Windows\System\nFZmWWL.exe
  2⤵
  PID:11156
- C:\Windows\System\ERpBzEW.exe
  C:\Windows\System\ERpBzEW.exe
  2⤵
  PID:11204
- C:\Windows\System\mBbpxfW.exe
  C:\Windows\System\mBbpxfW.exe
  2⤵
  PID:11236
- C:\Windows\System\vmHyVGf.exe
  C:\Windows\System\vmHyVGf.exe
  2⤵
  PID:10148
- C:\Windows\System\chSrPTg.exe
  C:\Windows\System\chSrPTg.exe
  2⤵
  PID:10252
- C:\Windows\System\rsJNOgr.exe
  C:\Windows\System\rsJNOgr.exe
  2⤵
  PID:10316
- C:\Windows\System\chLPutk.exe
  C:\Windows\System\chLPutk.exe
  2⤵
  PID:10352
- C:\Windows\System\abVRhLk.exe
  C:\Windows\System\abVRhLk.exe
  2⤵
  PID:10408
- C:\Windows\System\vIzKwcE.exe
  C:\Windows\System\vIzKwcE.exe
  2⤵
  PID:10476
- C:\Windows\System\uAAobDO.exe
  C:\Windows\System\uAAobDO.exe
  2⤵
  PID:10536
- C:\Windows\System\KilVxxR.exe
  C:\Windows\System\KilVxxR.exe
  2⤵
  PID:10636
- C:\Windows\System\VkxoBup.exe
  C:\Windows\System\VkxoBup.exe
  2⤵
  PID:10720
- C:\Windows\System\dAsfGlZ.exe
  C:\Windows\System\dAsfGlZ.exe
  2⤵
  PID:10780
- C:\Windows\System\oiqKUac.exe
  C:\Windows\System\oiqKUac.exe
  2⤵
  PID:10864
- C:\Windows\System\tAVVima.exe
  C:\Windows\System\tAVVima.exe
  2⤵
  PID:10896
- C:\Windows\System\oElDRny.exe
  C:\Windows\System\oElDRny.exe
  2⤵
  PID:10976
- C:\Windows\System\JehlOWL.exe
  C:\Windows\System\JehlOWL.exe
  2⤵
  PID:11020
- C:\Windows\System\YrSmexK.exe
  C:\Windows\System\YrSmexK.exe
  2⤵
  PID:11100
- C:\Windows\System\fPcpZeZ.exe
  C:\Windows\System\fPcpZeZ.exe
  2⤵
  PID:11152
- C:\Windows\System\PCgtCWU.exe
  C:\Windows\System\PCgtCWU.exe
  2⤵
  PID:11228
- C:\Windows\System\JjQbmeS.exe
  C:\Windows\System\JjQbmeS.exe
  2⤵
  PID:10304
- C:\Windows\System\QobiGUo.exe
  C:\Windows\System\QobiGUo.exe
  2⤵
  PID:10364
- C:\Windows\System\MTOeCTf.exe
  C:\Windows\System\MTOeCTf.exe
  2⤵
  PID:10628
- C:\Windows\System\JXJsVnb.exe
  C:\Windows\System\JXJsVnb.exe
  2⤵
  PID:10776
- C:\Windows\System\iDMGhXK.exe
  C:\Windows\System\iDMGhXK.exe
  2⤵
  PID:11080
- C:\Windows\System\jKmvuuv.exe
  C:\Windows\System\jKmvuuv.exe
  2⤵
  PID:11124
- C:\Windows\System\yDgLTex.exe
  C:\Windows\System\yDgLTex.exe
  2⤵
  PID:11196
- C:\Windows\System\CXkrARH.exe
  C:\Windows\System\CXkrARH.exe
  2⤵
  PID:10508
- C:\Windows\System\UKOdFHX.exe
  C:\Windows\System\UKOdFHX.exe
  2⤵
  PID:11044
- C:\Windows\System\MhQmbQT.exe
  C:\Windows\System\MhQmbQT.exe
  2⤵
  PID:10448
- C:\Windows\System\EVUsugh.exe
  C:\Windows\System\EVUsugh.exe
  2⤵
  PID:10944
- C:\Windows\System\LdmRHeG.exe
  C:\Windows\System\LdmRHeG.exe
  2⤵
  PID:11288
- C:\Windows\System\bvdPMna.exe
  C:\Windows\System\bvdPMna.exe
  2⤵
  PID:11304
- C:\Windows\System\KJQOcUE.exe
  C:\Windows\System\KJQOcUE.exe
  2⤵
  PID:11344
- C:\Windows\System\ujIdnom.exe
  C:\Windows\System\ujIdnom.exe
  2⤵
  PID:11364
- C:\Windows\System\MBHjQbW.exe
  C:\Windows\System\MBHjQbW.exe
  2⤵
  PID:11388
- C:\Windows\System\LKKHpNg.exe
  C:\Windows\System\LKKHpNg.exe
  2⤵
  PID:11420
- C:\Windows\System\OCJWzdt.exe
  C:\Windows\System\OCJWzdt.exe
  2⤵
  PID:11448
- C:\Windows\System\xEQTlIV.exe
  C:\Windows\System\xEQTlIV.exe
  2⤵
  PID:11476
- C:\Windows\System\PiqDhdC.exe
  C:\Windows\System\PiqDhdC.exe
  2⤵
  PID:11500
- C:\Windows\System\aFXJDiX.exe
  C:\Windows\System\aFXJDiX.exe
  2⤵
  PID:11528
- C:\Windows\System\vhbJrfY.exe
  C:\Windows\System\vhbJrfY.exe
  2⤵
  PID:11556
- C:\Windows\System\dNJoHkm.exe
  C:\Windows\System\dNJoHkm.exe
  2⤵
  PID:11592
- C:\Windows\System\TNYIwAT.exe
  C:\Windows\System\TNYIwAT.exe
  2⤵
  PID:11616
- C:\Windows\System\sauxtYW.exe
  C:\Windows\System\sauxtYW.exe
  2⤵
  PID:11644
- C:\Windows\System\XuPyepN.exe
  C:\Windows\System\XuPyepN.exe
  2⤵
  PID:11680
- C:\Windows\System\KbipdsM.exe
  C:\Windows\System\KbipdsM.exe
  2⤵
  PID:11700
- C:\Windows\System\EuicBMC.exe
  C:\Windows\System\EuicBMC.exe
  2⤵
  PID:11728
- C:\Windows\System\aUKXoUc.exe
  C:\Windows\System\aUKXoUc.exe
  2⤵
  PID:11756
- C:\Windows\System\CIdRmME.exe
  C:\Windows\System\CIdRmME.exe
  2⤵
  PID:11796
- C:\Windows\System\osWltCW.exe
  C:\Windows\System\osWltCW.exe
  2⤵
  PID:11812
- C:\Windows\System\LkmKSoF.exe
  C:\Windows\System\LkmKSoF.exe
  2⤵
  PID:11852
- C:\Windows\System\FWFyHKo.exe
  C:\Windows\System\FWFyHKo.exe
  2⤵
  PID:11868
- C:\Windows\System\sHpePCo.exe
  C:\Windows\System\sHpePCo.exe
  2⤵
  PID:11908
- C:\Windows\System\kShCPjN.exe
  C:\Windows\System\kShCPjN.exe
  2⤵
  PID:11924
- C:\Windows\System\mwXXFci.exe
  C:\Windows\System\mwXXFci.exe
  2⤵
  PID:11964
- C:\Windows\System\GBDibgI.exe
  C:\Windows\System\GBDibgI.exe
  2⤵
  PID:11992
- C:\Windows\System\uQSVPYG.exe
  C:\Windows\System\uQSVPYG.exe
  2⤵
  PID:12020
- C:\Windows\System\nsDTRwg.exe
  C:\Windows\System\nsDTRwg.exe
  2⤵
  PID:12036
- C:\Windows\System\zSValuP.exe
  C:\Windows\System\zSValuP.exe
  2⤵
  PID:12064
- C:\Windows\System\hDbpMKu.exe
  C:\Windows\System\hDbpMKu.exe
  2⤵
  PID:12084
- C:\Windows\System\HgemgDJ.exe
  C:\Windows\System\HgemgDJ.exe
  2⤵
  PID:12108
- C:\Windows\System\zpTEJob.exe
  C:\Windows\System\zpTEJob.exe
  2⤵
  PID:12124
- C:\Windows\System\XdnztDO.exe
  C:\Windows\System\XdnztDO.exe
  2⤵
  PID:12152
- C:\Windows\System\cjMnfxt.exe
  C:\Windows\System\cjMnfxt.exe
  2⤵
  PID:12192
- C:\Windows\System\sDhCbVx.exe
  C:\Windows\System\sDhCbVx.exe
  2⤵
  PID:12248
- C:\Windows\System\iYzMhDD.exe
  C:\Windows\System\iYzMhDD.exe
  2⤵
  PID:12280
- C:\Windows\System\PAvhGCx.exe
  C:\Windows\System\PAvhGCx.exe
  2⤵
  PID:11296
- C:\Windows\System\JPNGvng.exe
  C:\Windows\System\JPNGvng.exe
  2⤵
  PID:11328
- C:\Windows\System\jdcZeUn.exe
  C:\Windows\System\jdcZeUn.exe
  2⤵
  PID:11372
- C:\Windows\System\vpnqKMU.exe
  C:\Windows\System\vpnqKMU.exe
  2⤵
  PID:11440
- C:\Windows\System\rCGXIGn.exe
  C:\Windows\System\rCGXIGn.exe
  2⤵
  PID:11496
- C:\Windows\System\XtaXaCi.exe
  C:\Windows\System\XtaXaCi.exe
  2⤵
  PID:11548
- C:\Windows\System\EQbczLc.exe
  C:\Windows\System\EQbczLc.exe
  2⤵
  PID:11628
- C:\Windows\System\czibFdn.exe
  C:\Windows\System\czibFdn.exe
  2⤵
  PID:11708
- C:\Windows\System\FPnxHEm.exe
  C:\Windows\System\FPnxHEm.exe
  2⤵
  PID:11788
- C:\Windows\System\UcuYVod.exe
  C:\Windows\System\UcuYVod.exe
  2⤵
  PID:11108
- C:\Windows\System\uTligXA.exe
  C:\Windows\System\uTligXA.exe
  2⤵
  PID:11892
- C:\Windows\System\unwdoRK.exe
  C:\Windows\System\unwdoRK.exe
  2⤵
  PID:11984
- C:\Windows\System\cWQMOhO.exe
  C:\Windows\System\cWQMOhO.exe
  2⤵
  PID:12008
- C:\Windows\System\kbkCBTG.exe
  C:\Windows\System\kbkCBTG.exe
  2⤵
  PID:12100
- C:\Windows\System\LOXQaqT.exe
  C:\Windows\System\LOXQaqT.exe
  2⤵
  PID:12180
- C:\Windows\System\uBYfsPr.exe
  C:\Windows\System\uBYfsPr.exe
  2⤵
  PID:12224
- C:\Windows\System\AJptjSw.exe
  C:\Windows\System\AJptjSw.exe
  2⤵
  PID:11332
- C:\Windows\System\rNoOaRM.exe
  C:\Windows\System\rNoOaRM.exe
  2⤵
  PID:11400
- C:\Windows\System\YscpXFi.exe
  C:\Windows\System\YscpXFi.exe
  2⤵
  PID:11520
- C:\Windows\System\OxTuTig.exe
  C:\Windows\System\OxTuTig.exe
  2⤵
  PID:11780
- C:\Windows\System\wEOGQOW.exe
  C:\Windows\System\wEOGQOW.exe
  2⤵
  PID:11944
- C:\Windows\System\ydccvFl.exe
  C:\Windows\System\ydccvFl.exe
  2⤵
  PID:12104
- C:\Windows\System\DyZIaUh.exe
  C:\Windows\System\DyZIaUh.exe
  2⤵
  PID:12232
- C:\Windows\System\miUPtKa.exe
  C:\Windows\System\miUPtKa.exe
  2⤵
  PID:11572
- C:\Windows\System\OMBzjwn.exe
  C:\Windows\System\OMBzjwn.exe
  2⤵
  PID:11864
- C:\Windows\System\AiPOxFm.exe
  C:\Windows\System\AiPOxFm.exe
  2⤵
  PID:12188
- C:\Windows\System\QZsgPek.exe
  C:\Windows\System\QZsgPek.exe
  2⤵
  PID:11624
- C:\Windows\System\AcggCup.exe
  C:\Windows\System\AcggCup.exe
  2⤵
  PID:12176
- C:\Windows\System\TGKRoOU.exe
  C:\Windows\System\TGKRoOU.exe
  2⤵
  PID:12316
- C:\Windows\System\TzfyIgL.exe
  C:\Windows\System\TzfyIgL.exe
  2⤵
  PID:12332
- C:\Windows\System\qrzcTmt.exe
  C:\Windows\System\qrzcTmt.exe
  2⤵
  PID:12360
- C:\Windows\System\jxDcgQL.exe
  C:\Windows\System\jxDcgQL.exe
  2⤵
  PID:12400
- C:\Windows\System\ycGLDUc.exe
  C:\Windows\System\ycGLDUc.exe
  2⤵
  PID:12428
- C:\Windows\System\nyxwsXG.exe
  C:\Windows\System\nyxwsXG.exe
  2⤵
  PID:12456
- C:\Windows\System\cMtPTOf.exe
  C:\Windows\System\cMtPTOf.exe
  2⤵
  PID:12484
- C:\Windows\System\lZcfjom.exe
  C:\Windows\System\lZcfjom.exe
  2⤵
  PID:12512
- C:\Windows\System\AQZRubE.exe
  C:\Windows\System\AQZRubE.exe
  2⤵
  PID:12532
- C:\Windows\System\nlOnTBK.exe
  C:\Windows\System\nlOnTBK.exe
  2⤵
  PID:12556
- C:\Windows\System\IfkVnqW.exe
  C:\Windows\System\IfkVnqW.exe
  2⤵
  PID:12600
- C:\Windows\System\VYWgqmR.exe
  C:\Windows\System\VYWgqmR.exe
  2⤵
  PID:12632
- C:\Windows\System\mdQwLgf.exe
  C:\Windows\System\mdQwLgf.exe
  2⤵
  PID:12648
- C:\Windows\System\vNnWRPG.exe
  C:\Windows\System\vNnWRPG.exe
  2⤵
  PID:12668
- C:\Windows\System\wbwdTeZ.exe
  C:\Windows\System\wbwdTeZ.exe
  2⤵
  PID:12704
- C:\Windows\System\WEcfDSC.exe
  C:\Windows\System\WEcfDSC.exe
  2⤵
  PID:12724
- C:\Windows\System\OsiWJMU.exe
  C:\Windows\System\OsiWJMU.exe
  2⤵
  PID:12760
- C:\Windows\System\FsMOXtt.exe
  C:\Windows\System\FsMOXtt.exe
  2⤵
  PID:12788
- C:\Windows\System\mktXRim.exe
  C:\Windows\System\mktXRim.exe
  2⤵
  PID:12816
- C:\Windows\System\rsODmsD.exe
  C:\Windows\System\rsODmsD.exe
  2⤵
  PID:12844
- C:\Windows\System\xMVTmNl.exe
  C:\Windows\System\xMVTmNl.exe
  2⤵
  PID:12872
- C:\Windows\System\NxSGrHU.exe
  C:\Windows\System\NxSGrHU.exe
  2⤵
  PID:12888
- C:\Windows\System\WRrDzys.exe
  C:\Windows\System\WRrDzys.exe
  2⤵
  PID:12908
- C:\Windows\System\ngeLCnE.exe
  C:\Windows\System\ngeLCnE.exe
  2⤵
  PID:12948
- C:\Windows\System\eVjgtnV.exe
  C:\Windows\System\eVjgtnV.exe
  2⤵
  PID:12968
- C:\Windows\System\aeftvnx.exe
  C:\Windows\System\aeftvnx.exe
  2⤵
  PID:13012
- C:\Windows\System\qCilTKg.exe
  C:\Windows\System\qCilTKg.exe
  2⤵
  PID:13028
- C:\Windows\System\CkkAHrz.exe
  C:\Windows\System\CkkAHrz.exe
  2⤵
  PID:13052
- C:\Windows\System\OVnYQre.exe
  C:\Windows\System\OVnYQre.exe
  2⤵
  PID:13080
- C:\Windows\System\xuSyKFZ.exe
  C:\Windows\System\xuSyKFZ.exe
  2⤵
  PID:13116
- C:\Windows\System\PPIItQq.exe
  C:\Windows\System\PPIItQq.exe
  2⤵
  PID:13148
- C:\Windows\System\XiMDShP.exe
  C:\Windows\System\XiMDShP.exe
  2⤵
  PID:13176
- C:\Windows\System\FDARdFy.exe
  C:\Windows\System\FDARdFy.exe
  2⤵
  PID:13200
- C:\Windows\System\jJAMkpJ.exe
  C:\Windows\System\jJAMkpJ.exe
  2⤵
  PID:13228
- C:\Windows\System\eRkITUH.exe
  C:\Windows\System\eRkITUH.exe
  2⤵
  PID:13260
- C:\Windows\System\vBwbjjI.exe
  C:\Windows\System\vBwbjjI.exe
  2⤵
  PID:13292
- C:\Windows\System\njtFwMg.exe
  C:\Windows\System\njtFwMg.exe
  2⤵
  PID:12296
- C:\Windows\System\ojyVVgZ.exe
  C:\Windows\System\ojyVVgZ.exe
  2⤵
  PID:12356
- C:\Windows\System\rYxvBbK.exe
  C:\Windows\System\rYxvBbK.exe
  2⤵
  PID:12412
- C:\Windows\System\UmjKSxG.exe
  C:\Windows\System\UmjKSxG.exe
  2⤵
  PID:12508
- C:\Windows\System\AQQZWxB.exe
  C:\Windows\System\AQQZWxB.exe
  2⤵
  PID:12548
- C:\Windows\System\dqJWYDK.exe
  C:\Windows\System\dqJWYDK.exe
  2⤵
  PID:12596
- C:\Windows\System\wEBGwtA.exe
  C:\Windows\System\wEBGwtA.exe
  2⤵
  PID:12700
- C:\Windows\System\GjMQHVY.exe
  C:\Windows\System\GjMQHVY.exe
  2⤵
  PID:12812
- C:\Windows\System\uhpcOsN.exe
  C:\Windows\System\uhpcOsN.exe
  2⤵
  PID:12856
- C:\Windows\System\fWSwmDt.exe
  C:\Windows\System\fWSwmDt.exe
  2⤵
  PID:12896
- C:\Windows\System\jyJgmMo.exe
  C:\Windows\System\jyJgmMo.exe
  2⤵
  PID:13000
- C:\Windows\System\megyauY.exe
  C:\Windows\System\megyauY.exe
  2⤵
  PID:13076
- C:\Windows\System\MpETpbz.exe
  C:\Windows\System\MpETpbz.exe
  2⤵
  PID:1100
- C:\Windows\System\CGkgqOK.exe
  C:\Windows\System\CGkgqOK.exe
  2⤵
  PID:13072
- C:\Windows\System\gJPHSFS.exe
  C:\Windows\System\gJPHSFS.exe
  2⤵
  PID:13184
- C:\Windows\System\yZSZCow.exe
  C:\Windows\System\yZSZCow.exe
  2⤵
  PID:13224
- C:\Windows\System\upgbFQI.exe
  C:\Windows\System\upgbFQI.exe
  2⤵
  PID:13252
- C:\Windows\System\RBeotnW.exe
  C:\Windows\System\RBeotnW.exe
  2⤵
  PID:12392
- C:\Windows\System\IbmrPzb.exe
  C:\Windows\System\IbmrPzb.exe
  2⤵
  PID:12576
- C:\Windows\System\fPQEkLv.exe
  C:\Windows\System\fPQEkLv.exe
  2⤵
  PID:12688
- C:\Windows\System\EEFWaOR.exe
  C:\Windows\System\EEFWaOR.exe
  2⤵
  PID:12880
- C:\Windows\System\EiQApxj.exe
  C:\Windows\System\EiQApxj.exe
  2⤵
  PID:13064
- C:\Windows\System\OuHCCti.exe
  C:\Windows\System\OuHCCti.exe
  2⤵
  PID:13160
- C:\Windows\System\fjuGPOz.exe
  C:\Windows\System\fjuGPOz.exe
  2⤵
  PID:13188
- C:\Windows\System\oAFkPkQ.exe
  C:\Windows\System\oAFkPkQ.exe
  2⤵
  PID:2996
- C:\Windows\System\gMZjVEI.exe
  C:\Windows\System\gMZjVEI.exe
  2⤵
  PID:12836
- C:\Windows\System\djdpNzs.exe
  C:\Windows\System\djdpNzs.exe
  2⤵
  PID:12528
- C:\Windows\System\bwopUqL.exe
  C:\Windows\System\bwopUqL.exe
  2⤵
  PID:13332
- C:\Windows\System\cZcNkWm.exe
  C:\Windows\System\cZcNkWm.exe
  2⤵
  PID:13360
- C:\Windows\System\xHEiZEy.exe
  C:\Windows\System\xHEiZEy.exe
  2⤵
  PID:13388
- C:\Windows\System\qFnSlyT.exe
  C:\Windows\System\qFnSlyT.exe
  2⤵
  PID:13404
- C:\Windows\System\klnujof.exe
  C:\Windows\System\klnujof.exe
  2⤵
  PID:13420
- C:\Windows\System\OehwUjY.exe
  C:\Windows\System\OehwUjY.exe
  2⤵
  PID:13476
- C:\Windows\System\MPaYGWQ.exe
  C:\Windows\System\MPaYGWQ.exe
  2⤵
  PID:13500
- C:\Windows\System\TJDfxMo.exe
  C:\Windows\System\TJDfxMo.exe
  2⤵
  PID:13540
- C:\Windows\System\DpnMHvp.exe
  C:\Windows\System\DpnMHvp.exe
  2⤵
  PID:13568
- C:\Windows\System\BVuSpSi.exe
  C:\Windows\System\BVuSpSi.exe
  2⤵
  PID:13584
- C:\Windows\System\aeBpgrv.exe
  C:\Windows\System\aeBpgrv.exe
  2⤵
  PID:13616
- C:\Windows\System\DxUVMvZ.exe
  C:\Windows\System\DxUVMvZ.exe
  2⤵
  PID:13640
- C:\Windows\System\GhRWEoY.exe
  C:\Windows\System\GhRWEoY.exe
  2⤵
  PID:13680
- C:\Windows\System\biIdSDR.exe
  C:\Windows\System\biIdSDR.exe
  2⤵
  PID:13696
- C:\Windows\System\vCWVImS.exe
  C:\Windows\System\vCWVImS.exe
  2⤵
  PID:13728
- C:\Windows\System\GJIXjDJ.exe
  C:\Windows\System\GJIXjDJ.exe
  2⤵
  PID:13752
- C:\Windows\System\WKVDJyT.exe
  C:\Windows\System\WKVDJyT.exe
  2⤵
  PID:13792
- C:\Windows\System\dxrLEMO.exe
  C:\Windows\System\dxrLEMO.exe
  2⤵
  PID:13824
- C:\Windows\System\GYJiQfE.exe
  C:\Windows\System\GYJiQfE.exe
  2⤵
  PID:13852
- C:\Windows\System\dbxXoKK.exe
  C:\Windows\System\dbxXoKK.exe
  2⤵
  PID:13880
- C:\Windows\System\njDUVZR.exe
  C:\Windows\System\njDUVZR.exe
  2⤵
  PID:13896
- C:\Windows\System\tYBdKwy.exe
  C:\Windows\System\tYBdKwy.exe
  2⤵
  PID:13936
- C:\Windows\System\GipOlfg.exe
  C:\Windows\System\GipOlfg.exe
  2⤵
  PID:13968
- C:\Windows\System\ZgRHulP.exe
  C:\Windows\System\ZgRHulP.exe
  2⤵
  PID:13996
- C:\Windows\System\lBWhtVX.exe
  C:\Windows\System\lBWhtVX.exe
  2⤵
  PID:14024
- C:\Windows\System\PoFgcjz.exe
  C:\Windows\System\PoFgcjz.exe
  2⤵
  PID:14056
- C:\Windows\System\ukTVIgv.exe
  C:\Windows\System\ukTVIgv.exe
  2⤵
  PID:14072
- C:\Windows\System\IkGeXin.exe
  C:\Windows\System\IkGeXin.exe
  2⤵
  PID:14124
- C:\Windows\System\ZiKYERu.exe
  C:\Windows\System\ZiKYERu.exe
  2⤵
  PID:14152
- C:\Windows\System\IHNTlzu.exe
  C:\Windows\System\IHNTlzu.exe
  2⤵
  PID:14172
- C:\Windows\System\FwveOXv.exe
  C:\Windows\System\FwveOXv.exe
  2⤵
  PID:14200
- C:\Windows\System\ZcYJEvf.exe
  C:\Windows\System\ZcYJEvf.exe
  2⤵
  PID:14232
- C:\Windows\System\tcqDQcs.exe
  C:\Windows\System\tcqDQcs.exe
  2⤵
  PID:14260
- C:\Windows\System\YPSaNry.exe
  C:\Windows\System\YPSaNry.exe
  2⤵
  PID:14288
- C:\Windows\System\dQjHhEO.exe
  C:\Windows\System\dQjHhEO.exe
  2⤵
  PID:14332
- C:\Windows\System\WwjzEFC.exe
  C:\Windows\System\WwjzEFC.exe
  2⤵
  PID:13324
- C:\Windows\System\MJsEcwc.exe
  C:\Windows\System\MJsEcwc.exe
  2⤵
  PID:13356
- C:\Windows\System\hmoiPVJ.exe
  C:\Windows\System\hmoiPVJ.exe
  2⤵
  PID:13412
- C:\Windows\System\fqomOsU.exe
  C:\Windows\System\fqomOsU.exe
  2⤵
  PID:13484
- C:\Windows\System\QKbRjzx.exe
  C:\Windows\System\QKbRjzx.exe
  2⤵
  PID:13624
- C:\Windows\System\jTKkcpp.exe
  C:\Windows\System\jTKkcpp.exe
  2⤵
  PID:13656
- C:\Windows\System\ZXEpSUe.exe
  C:\Windows\System\ZXEpSUe.exe
  2⤵
  PID:13708
- C:\Windows\System\mrAxDqk.exe
  C:\Windows\System\mrAxDqk.exe
  2⤵
  PID:13744
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13744 -s 248
    3⤵
    PID:13284
- C:\Windows\System\bgrdVhe.exe
  C:\Windows\System\bgrdVhe.exe
  2⤵
  PID:13840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DECBrWf.exe

Filesize
2.0MB

MD5
711144f73808daf9aa867aeb6e36ddc6

SHA1
b3dfcb32fe5854368bdedfa155c82db6d0476abc

SHA256
ad36099a42b12c9b557a24923bf36b010356c42699ddf29614f8d194c4f730ec

SHA512
99e60aadee6f42b80253ea89c809ec899aa20686d2c261524b87c6855ac448498b47b2d0c88bcf3414f1a66e208e8e8e666df52aab7c2e3b9da9d3086de85b47

Download Submit
C:\Windows\System\EAvoRbv.exe

Filesize
2.0MB

MD5
10938cd2da2f5c9aea53ce3f09d1b85a

SHA1
057ce83d2f4f88d25504905b5c8970ad5e3f4141

SHA256
d4caeb5c4629102c89a949efbe18fd00c7070d9275efbcf22346565558fccf31

SHA512
edea587a71f5e5176eed36c1e22074b6d72cc7266111adf6eff95a79cf8d7d0895da81c41059cdb228692badd7f391266eb033d43e518426c0fe5410fd187681

Download Submit
C:\Windows\System\EThMHjW.exe

Filesize
2.0MB

MD5
a5e9c200aeccc2369f2dfa87386623ce

SHA1
9a8d84f606731bd7ffeae529cbae849dff8d37b4

SHA256
384154e0077adbd4396d5f9de4b0d73d27ca3d7351879a7791fc4258333fbc8c

SHA512
7ff36b3be0ab4aaa136012cbc6c0347a1ea17b1994e0f744f8a01873e02da9d76125f3a5508efe229397b910d2e58e4f0fa31709417786e1f58e9f772bee1ff3

Download Submit
C:\Windows\System\FROAEXO.exe

Filesize
2.0MB

MD5
4178449fbece1faf87c0ada2d64ae50b

SHA1
f4f332c966a08d986a6e716b15d124b1c25c1136

SHA256
c443e48688a3025a238e0b3a7a56462888b38ca2f02a66db5e3644f843a4b950

SHA512
d81c0e8ac66ba6697508c99c5f70f06f5d3aa32f7dc723d212280c60785892f2d104cd19dae34f62faa1967759e1cd1e8d7e7ba20cc8b7ca49a03beaede8107c

Download Submit
C:\Windows\System\GbWraht.exe

Filesize
2.0MB

MD5
74cc5a165484826188403c7625ac0373

SHA1
22bf37b10e22468ba4d0b7dc829a89a4bad5bda5

SHA256
ebae550b58b24cfe0573d4adff1e94e220af2d718caca52c2d5bd1ba82a03d0e

SHA512
2957dca7123c1107a665882140874a3007828d57a086d679fb1f2a08fa501c83372a7d9798e4b43b9247dc76fceb55b73aa7ffe592c528673044e71d5cc667c8

Download Submit
C:\Windows\System\GnVVdrt.exe

Filesize
2.0MB

MD5
d8d21c6c5218071bd22661bb8fd2d9cb

SHA1
271dfd4cbb29850a54af8f5dbe71add5a5e25d61

SHA256
61bc2cdff6b4b1239cf270ebee15f64872b6e6b9184650232fd5dee5c49e702a

SHA512
bcbdc3ed6405d1ff5acbc98414ee3f2ad9173ce57c2195764a12f8cdf2c0ca7e95f92ada04c5772f980f2b867f5b10185a6c734357d9526662d093a54ccaac04

Download Submit
C:\Windows\System\HZLDFob.exe

Filesize
2.0MB

MD5
2c0ef2b204278382bf600902fab369bb

SHA1
2a0e60db61ac8f2f7865cef5176b509053f8fd18

SHA256
437f156b20f92b4d3258239d5605b4d5bc7dc367e0ef26006abf054742da805d

SHA512
fff1ea05c09053f8f8c8be64df780d3e929fa89982d4b7050c1414f67b15ab5f6202f435c04327246dfa0a159feb97667ca8de8da05c6891172ea13dd4a68cb2

Download Submit
C:\Windows\System\IVYRedc.exe

Filesize
2.0MB

MD5
8ce936340269d3128fd850d12e563929

SHA1
d1c3678f0ac71980bb94f02713691a3ed36e79dc

SHA256
a46b5f9332767a4f504988abd328e09019aa6621913b023d50448d328ac5a5f7

SHA512
f6915f7693fec0c92c3b441af3241b2ee4c4766b6a4d1364c3245e1bd3fa66dcfa525252b2866f7dbbc96346629c1ee352ff98f9d34fe092137bda810fa12c32

Download Submit
C:\Windows\System\IcSSTNR.exe

Filesize
2.0MB

MD5
068856f8e8d597a2ac212c5f8fc5839f

SHA1
1c6be1cfa33f4c87c2bf43ed60ace436a49f3e96

SHA256
144be432336f16c2fa3562c714ee6b4da2a299934c8741c759cb434c105094ab

SHA512
09d5d20a29d16c7ab9ed206b526faebea47817df43f52ca8dc55274bef615b109894bbeb63aaad663e7e2aaa55da7e423b62a88ad50f6044a2da0502a4a55dde

Download Submit
C:\Windows\System\JWnPxJq.exe

Filesize
2.0MB

MD5
18347cdd90a7a64a27f76ab6b8b7e3c7

SHA1
34d4cbec0397f3ecad5fb5b43271e7aededabf93

SHA256
af741e0bf992cdeb617f12d734e381e3d025ebeb1bcf49bd5f6556af04581578

SHA512
73c583557674a2484ebb5c38f3d080f15c69514de822fa6f14e0fba674cf823c6fae126179cae43a799903ae20933232044dbb87125d7211cb1f7e225e0f6249

Download Submit
C:\Windows\System\JvLvfQN.exe

Filesize
2.0MB

MD5
550db7f4d29adee8a3729b4ef3f9886d

SHA1
5ea194b4667ff04d29a67c4324f8a4c8a3bcbd58

SHA256
84fd28cacea477c12f66c2067b99a65d173082f046d87d97f1f42992146f89b8

SHA512
63af5279171f28c8daa430207351837d781c4cee9d8dad69bbb7f177e7c3c752e4d56be8d7631481b1170f7fedab38fda01b9ec6f9a1f6de3d079f799fd2f096

Download Submit
C:\Windows\System\KleFuIJ.exe

Filesize
2.0MB

MD5
dd780e1c97bd92ae2054565137f2342c

SHA1
b4ee3b5d89237b4c6ebccceba53ffef552e70a5b

SHA256
86f2bac56b8cfd1a5b19ac97cf7028fc96ff1b013c94e308de8324debf2eb52d

SHA512
833704aeaf4155bf3c70929125c0ec3ed7fb58ee00cec14338d99e7bfa5a46d7c6faa1dce66980a706fe33af941e95d3b6b83e05775e8e7dad2ceacebaa2b1b2

Download Submit
C:\Windows\System\LxGfgJq.exe

Filesize
2.0MB

MD5
c1936bec2ff1ea7f5f313700c0316acc

SHA1
e5f43f8e008e8e87b563d282bed9a1261828e541

SHA256
248c14b78cee4eb2698bf5970d8e561a1a9759b35c1edbbe9ee4f126427a6c9c

SHA512
8e93988dc6353b93507f6da91644bec7a57d92b3e7b2d32572d0a3015a72c162e437efc3c7a9ae62e2d7b261232eb2b1e2cf7355d1a7a173564bc62c8785a62f

Download Submit
C:\Windows\System\MjdlWKi.exe

Filesize
2.0MB

MD5
e9a520230737f3e1933304a06469c763

SHA1
3ea25a14fdf2c9bd130abfcbd080e42cc2b4f64d

SHA256
3a89dea0002c4ecc692bf1f65b18e7d0f08f8d94a9cf0253b05e5627e5b13862

SHA512
d3d18123e4b1c408e271d4db48ae70330188902b81f2e1c55e4ba177416322a8ca86280e0e9290e7b0becc79b49bc6b8cedb9a5bce1eac3327f1e7ca4265dae1

Download Submit
C:\Windows\System\NDAPhFw.exe

Filesize
2.0MB

MD5
281dafa2cd30ea3fe6af761563ffe8fa

SHA1
b5fff4b5d2293df1aee653a6e36d57d7107e34f8

SHA256
3076855dd57284e20696d2047112815ac3711ee9f9a1bca7fd07577f5ae3b53e

SHA512
e94736629ef0b2c1a7d38160871859ef7fd008a3e3120cc095c0b6dc3c4a28de3fd9e9853f3d5f083f8eafa14c26c6309b1359ee7be2806ebe957be1dd141ecc

Download Submit
C:\Windows\System\NyplNtU.exe

Filesize
2.0MB

MD5
2869e77538ff553914f20e7d34724344

SHA1
36cecc19e11e2c193b3d40769fcc73aa67507762

SHA256
3118fbed9776d7121fae22dffe49869debe301e1e1dcc450b8251c3cfe3bfb22

SHA512
b67b7c93bc239b36798d9458d8c602b815a41fab618629d2f6a3f8fe92b279ca33b44369d2cf0998ff949cf7deb49d078182fcfa249efeca61c193fa58228031

Download Submit
C:\Windows\System\RIKLrcF.exe

Filesize
2.0MB

MD5
83aa7444400398055ee2b824bc7d59fb

SHA1
17e7ff79369736bf6148a20d9b2e39c0b6886ab0

SHA256
a555224a98d647ffdd4565126e263df7a54b82e93af44c70d1746bf69da12539

SHA512
bbef0d8a0139028f53a7f086df53a2cd53064cab8b95c033d62cf119e98f4e718b85dcc12e9b6c9b3ef274f406b6c708b77412f1d71073232eb19886a96e5670

Download Submit
C:\Windows\System\SOTzAIY.exe

Filesize
2.0MB

MD5
2dc183311537d94a8a51c7556055fd8d

SHA1
2218ef37643f1e77bd41cf4b8bdabae12d908afe

SHA256
7aaf77ad3381870df16e61419d32ed2997c6690ed2991a0f1ed90bfbb3dd8abc

SHA512
e7cb02e2327da6a115361a1fc57c2d43f638f1a6a8732bdeb506866a0f00db051c226ed511be5b60de368d2d4b0357af5eb2bbcfcb00b754c9e83f352b9e3392

Download Submit
C:\Windows\System\YZzpWvf.exe

Filesize
2.0MB

MD5
5711f59f33e430520b70668e4589138d

SHA1
8291405c53cb7add8e723241e7400e260b878a5f

SHA256
a6c11ae79132c4a3b048c51f602b76bb658080ce537c5ff04df6e481bc0a4cb9

SHA512
72489a140ebe0d8265af447b32bc572b6ed4136922341f7a851da5accfe64c9729408bffc6c11633d8d7d7fc05aed2c261bb11902e8d9d13bd7719ed4474e044

Download Submit
C:\Windows\System\aFzOSUy.exe

Filesize
2.0MB

MD5
e7c56c78138f6f82c34500bce18055c2

SHA1
92231916a2e3c15040b241226ec6ce70672cca54

SHA256
54e0412c05eed79e8cba73e930dd37ee1448878f5dcc73c79ea27332f9bdea49

SHA512
5b3f3f198c70f12ce145aecf36eec0181edba237008360dbc8b1fee660c6d8ba0ce289f2d7de82e4ea04c14148fa727b1b0b94a7d96fb0cf184dba428bb89ac8

Download Submit
C:\Windows\System\brJOsvs.exe

Filesize
2.0MB

MD5
1488b3ebeb9e73a26f9f5753bfa92453

SHA1
76019c47406d931410d5c2ef144d4fb6d0ccb5c8

SHA256
069d8ba598cf43d7ff9fb5d4f4bb97586f535b4d0c35f51f70cfb3e7c982b457

SHA512
c33cde6249f054619f0833403fbdce5056d4e35c598a8ec71087ef961bf58021ab0add16b86c231d7678f0996e0a63c473db75a87ebafe690f09e9918b15d328

Download Submit
C:\Windows\System\hFrsaix.exe

Filesize
2.0MB

MD5
40949cf6bdab42a9427f76ed526d107f

SHA1
e4834d00dda7e5ab91d73b405eb80be956f64f4b

SHA256
67c3196055057d74f637498d6a12c55e6b792433502dc400192316d577488695

SHA512
f3688be600d06cf75fe9af341a9be695a91685213f152d4d1d3212d1cafa552403edd7e17dea0ab2915c35b3996a94c5d9ddf0db93fa0846c6ebe758c8ceadb7

Download Submit
C:\Windows\System\imCrJgR.exe

Filesize
2.0MB

MD5
423fe9e66cdd797d7cbe9a9c4d345d5c

SHA1
f23fcd32ea232c0639967bc900658e9c6d3aca65

SHA256
1d2c26d7a9a8df405d9e1d9b39e010f7131e21503ff131ea4b91dbce2b0b85be

SHA512
be1f62c7f314c1be2ea7191499c83108a0e5c425b352ad75de372457e7703c6898f86ce766d078d685bd52eedb1b1df94d6cabe27d98f6486da6c8e5b4ab4015

Download Submit
C:\Windows\System\jeDqMRi.exe

Filesize
2.0MB

MD5
4b65cd76a74b58958e0ba403e506fb27

SHA1
91211507b13a0c42eab282b03ca0d52f2a5c5566

SHA256
54930bbc82345c7b25eab53f289522b62b1be839151ba10c3f91d32d67553a77

SHA512
b7ff227959dc3fd5f7e39da05d83f0085a640cd9d0c63e3ab31b41e6e53b2763461adf7eb25f663365c387cb9c15dd75eb538546610c704689639f2d9b21227b

Download Submit
C:\Windows\System\kXGspSi.exe

Filesize
2.0MB

MD5
6eba95303d35cbc4b529ea44199eb11f

SHA1
6e6145d90fbce756d0a02b09f7c7cfa558beab98

SHA256
b56de74c9d90f67c89209da4cfc3c16b69ce2853b3c132ed062ce8e8824d80fc

SHA512
5f8f92887f52347e637ee4c2372a1cdbef0296c12dad34b92d89a4c16d45e1530f88a14e7e3082893ad6c0a2d01ca393edb84af152c520f78758d9ef2424e31d

Download Submit
C:\Windows\System\lbwGnLB.exe

Filesize
2.0MB

MD5
6f3b9e8fe2f4eff006e0f67084a378f0

SHA1
6871f10834c418dc2e33f51b88c44126630c2e75

SHA256
d4f708520238cb020ad563c8c0ee162422b74d360030093a3a24c1ed4569b537

SHA512
f7ff00174a00cc0bc23fd26db49b3258128aee51ae0e530223482baa45e1c2c352fe0bf7942a76cea6a382caec87d7185c84c87184cd803ef536fdb2ffb24925

Download Submit
C:\Windows\System\nfsrcZP.exe

Filesize
2.0MB

MD5
6c77b9cc40345c8bb0eaa0ec93769239

SHA1
ca15536901d6b38c3d5b913317cb6181aeee5b22

SHA256
f74ddbcb71a0e67c1dbcc42ad367afd633731c1045e98cc86926cb26c89137c5

SHA512
c1c4b643b4c21bd4e7e732c9c9eaf794f9a1230f22c346e604584e58df5fb835dc75e3eb465658149c6f158468980258d46bdd6354af3a0935eedf3944b67cbf

Download Submit
C:\Windows\System\oEKtTZn.exe

Filesize
2.0MB

MD5
1ece7d7ec8a2c3bb577690c52f1fab53

SHA1
e2a7bdfe29b03ee429c36595b15baf592d84efa4

SHA256
69f8cb5609aebd6e45b230fd6818a1916a1a4826014869289c3787a145a58c71

SHA512
81845753e8bd5f841e007c5687cda8fb2eb09b880dbd487bc5fdd088ec72537efe4452edeec566bfdd87f490f54702a4d584d8180eb4f1f7959e08afd8507700

Download Submit
C:\Windows\System\pObwSoe.exe

Filesize
2.0MB

MD5
7e70462fe74b97b1374d5c5ddf9f16b8

SHA1
5e1dd68ac70c0d09ac1c2f5adf42fe4c1de100e5

SHA256
9cb2f645e5217c134e874101c760f693ccf04db100a4d9da69f9f7b6d6e64b01

SHA512
5d2f760320719b72be15d7dd1b4e2d70f889a420c30b151e39ccf30a14f19a9eda29ff9cbc923d8c86639e85e8b346616557d39abcd01bf58c1f1302d8452bc0

Download Submit
C:\Windows\System\psdAmkz.exe

Filesize
2.0MB

MD5
1422f88eece65ac18ecffc4ba6898eb0

SHA1
1e9e7fe332d7ff963183e572cf9cd886eb7c4a25

SHA256
40c54b4e1cf74c1ac9fcba520af610a6766044117db7f27ba3e17df805dc7b91

SHA512
28792d252b02994711449bae08e7fbad9324444ccd30fe869d313f03b20d472548edcb6fc617360847978e755ad15be85af2fbf6d7580805bbed678d9ded2e07

Download Submit
C:\Windows\System\qVeCcjI.exe

Filesize
2.0MB

MD5
7c35ecf0bc44771f0cc4a4ef4679caca

SHA1
dbee0ed53c2987f784c5bd54f3b5f1a32ca7a680

SHA256
93b2b393e6bfa0797ed348a2a0ff2eb76a5aeb2c87d46bc1a05c6b4daabc0b06

SHA512
079a29816c6432c8736d4a8ff4f9ca84ff0f98f87bbb807961ca26a4a14e1af6ac99737e16fed42f0d26a2489897bc2b4eff7906bbc74ea2c95612a45dd8e877

Download Submit
C:\Windows\System\rUDMUTB.exe

Filesize
2.0MB

MD5
217212270cd06c5c8fb5ea94b3bd1ea2

SHA1
6bca175f3a97d67ed625ef5a092b6cfc60e2a728

SHA256
b8dbcae002053562826451bac6af9bbe6e510f5549ce4d7b1c39622bcdf96f71

SHA512
3838b83083b2e81f5687a28249f6b5f538a43c4b0acfa467b5de7b86b999ce965a14b1f0bfab4bf160915a2c2f719aacb54b6d56b1350a3408a48f9038dd5439

Download Submit
C:\Windows\System\sZZbGoy.exe

Filesize
2.0MB

MD5
4067fba83687a78127e0f7b3416a9c8a

SHA1
7c7f59143ab82b9e61034fb8f9fb760b289bf050

SHA256
d3923d6a25ba133cbf75496d859911a9035eef6b8336ea1cfda93cd451b2770a

SHA512
6c71185be1bde48db40590b612f901b66030352b243de8cd32eacd4061144fb562d61436aa92d00519fc5e4caf424e1c2b3d819f191609afd5863c41bf583d47

Download Submit
memory/528-2143-0x00007FF6D95F0000-0x00007FF6D9944000-memory.dmp

Filesize
3.3MB

Download
memory/528-830-0x00007FF6D95F0000-0x00007FF6D9944000-memory.dmp

Filesize
3.3MB

Download
memory/632-2136-0x00007FF6B5DC0000-0x00007FF6B6114000-memory.dmp

Filesize
3.3MB

Download
memory/632-789-0x00007FF6B5DC0000-0x00007FF6B6114000-memory.dmp

Filesize
3.3MB

Download
memory/872-2129-0x00007FF7FF870000-0x00007FF7FFBC4000-memory.dmp

Filesize
3.3MB

Download
memory/872-730-0x00007FF7FF870000-0x00007FF7FFBC4000-memory.dmp

Filesize
3.3MB

Download
memory/1368-796-0x00007FF7E9270000-0x00007FF7E95C4000-memory.dmp

Filesize
3.3MB

Download
memory/1368-2135-0x00007FF7E9270000-0x00007FF7E95C4000-memory.dmp

Filesize
3.3MB

Download
memory/1584-786-0x00007FF65F2B0000-0x00007FF65F604000-memory.dmp

Filesize
3.3MB

Download
memory/1584-2131-0x00007FF65F2B0000-0x00007FF65F604000-memory.dmp

Filesize
3.3MB

Download
memory/1832-815-0x00007FF7DAC00000-0x00007FF7DAF54000-memory.dmp

Filesize
3.3MB

Download
memory/1832-2132-0x00007FF7DAC00000-0x00007FF7DAF54000-memory.dmp

Filesize
3.3MB

Download
memory/1900-693-0x00007FF6CA800000-0x00007FF6CAB54000-memory.dmp

Filesize
3.3MB

Download
memory/1900-2122-0x00007FF6CA800000-0x00007FF6CAB54000-memory.dmp

Filesize
3.3MB

Download
memory/1920-683-0x00007FF7B4890000-0x00007FF7B4BE4000-memory.dmp

Filesize
3.3MB

Download
memory/1920-2125-0x00007FF7B4890000-0x00007FF7B4BE4000-memory.dmp

Filesize
3.3MB

Download
memory/2188-810-0x00007FF7BCCA0000-0x00007FF7BCFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2188-2144-0x00007FF7BCCA0000-0x00007FF7BCFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2284-680-0x00007FF69D530000-0x00007FF69D884000-memory.dmp

Filesize
3.3MB

Download
memory/2284-2124-0x00007FF69D530000-0x00007FF69D884000-memory.dmp

Filesize
3.3MB

Download
memory/2396-2126-0x00007FF673210000-0x00007FF673564000-memory.dmp

Filesize
3.3MB

Download
memory/2396-681-0x00007FF673210000-0x00007FF673564000-memory.dmp

Filesize
3.3MB

Download
memory/2796-0-0x00007FF698EF0000-0x00007FF699244000-memory.dmp

Filesize
3.3MB

Download
memory/2796-1-0x000001F929B80000-0x000001F929B90000-memory.dmp

Filesize
64KB

Download
memory/2884-823-0x00007FF6EB0F0000-0x00007FF6EB444000-memory.dmp

Filesize
3.3MB

Download
memory/2884-2133-0x00007FF6EB0F0000-0x00007FF6EB444000-memory.dmp

Filesize
3.3MB

Download
memory/3000-2139-0x00007FF768F20000-0x00007FF769274000-memory.dmp

Filesize
3.3MB

Download
memory/3000-764-0x00007FF768F20000-0x00007FF769274000-memory.dmp

Filesize
3.3MB

Download
memory/3224-2137-0x00007FF780920000-0x00007FF780C74000-memory.dmp

Filesize
3.3MB

Download
memory/3224-782-0x00007FF780920000-0x00007FF780C74000-memory.dmp

Filesize
3.3MB

Download
memory/3260-9-0x00007FF676980000-0x00007FF676CD4000-memory.dmp

Filesize
3.3MB

Download
memory/3260-2116-0x00007FF676980000-0x00007FF676CD4000-memory.dmp

Filesize
3.3MB

Download
memory/3408-714-0x00007FF733C80000-0x00007FF733FD4000-memory.dmp

Filesize
3.3MB

Download
memory/3408-2128-0x00007FF733C80000-0x00007FF733FD4000-memory.dmp

Filesize
3.3MB

Download
memory/3488-761-0x00007FF77E8F0000-0x00007FF77EC44000-memory.dmp

Filesize
3.3MB

Download
memory/3488-2140-0x00007FF77E8F0000-0x00007FF77EC44000-memory.dmp

Filesize
3.3MB

Download
memory/3548-833-0x00007FF6A4420000-0x00007FF6A4774000-memory.dmp

Filesize
3.3MB

Download
memory/3548-2119-0x00007FF6A4420000-0x00007FF6A4774000-memory.dmp

Filesize
3.3MB

Download
memory/3568-2142-0x00007FF73E510000-0x00007FF73E864000-memory.dmp

Filesize
3.3MB

Download
memory/3568-741-0x00007FF73E510000-0x00007FF73E864000-memory.dmp

Filesize
3.3MB

Download
memory/3968-2141-0x00007FF6022B0000-0x00007FF602604000-memory.dmp

Filesize
3.3MB

Download
memory/3968-747-0x00007FF6022B0000-0x00007FF602604000-memory.dmp

Filesize
3.3MB

Download
memory/4084-776-0x00007FF6131F0000-0x00007FF613544000-memory.dmp

Filesize
3.3MB

Download
memory/4084-2138-0x00007FF6131F0000-0x00007FF613544000-memory.dmp

Filesize
3.3MB

Download
memory/4348-2115-0x00007FF6BDC60000-0x00007FF6BDFB4000-memory.dmp

Filesize
3.3MB

Download
memory/4348-28-0x00007FF6BDC60000-0x00007FF6BDFB4000-memory.dmp

Filesize
3.3MB

Download
memory/4348-2118-0x00007FF6BDC60000-0x00007FF6BDFB4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-706-0x00007FF70D5D0000-0x00007FF70D924000-memory.dmp

Filesize
3.3MB

Download
memory/4372-2123-0x00007FF70D5D0000-0x00007FF70D924000-memory.dmp

Filesize
3.3MB

Download
memory/4464-820-0x00007FF690940000-0x00007FF690C94000-memory.dmp

Filesize
3.3MB

Download
memory/4464-2130-0x00007FF690940000-0x00007FF690C94000-memory.dmp

Filesize
3.3MB

Download
memory/4780-682-0x00007FF684FE0000-0x00007FF685334000-memory.dmp

Filesize
3.3MB

Download
memory/4780-2121-0x00007FF684FE0000-0x00007FF685334000-memory.dmp

Filesize
3.3MB

Download
memory/4836-2127-0x00007FF781240000-0x00007FF781594000-memory.dmp

Filesize
3.3MB

Download
memory/4836-720-0x00007FF781240000-0x00007FF781594000-memory.dmp

Filesize
3.3MB

Download
memory/4884-684-0x00007FF7DCA00000-0x00007FF7DCD54000-memory.dmp

Filesize
3.3MB

Download
memory/4884-2120-0x00007FF7DCA00000-0x00007FF7DCD54000-memory.dmp

Filesize
3.3MB

Download
memory/5028-2134-0x00007FF6C1C70000-0x00007FF6C1FC4000-memory.dmp

Filesize
3.3MB

Download
memory/5028-801-0x00007FF6C1C70000-0x00007FF6C1FC4000-memory.dmp

Filesize
3.3MB

Download
memory/5108-19-0x00007FF6C2660000-0x00007FF6C29B4000-memory.dmp

Filesize
3.3MB

Download
memory/5108-2117-0x00007FF6C2660000-0x00007FF6C29B4000-memory.dmp

Filesize
3.3MB

Download
memory/5108-2114-0x00007FF6C2660000-0x00007FF6C29B4000-memory.dmp

Filesize
3.3MB

Download