xmrig | 0241cc87d02419756166b73ea50cec455dcaafcb7f9d9e1e4ae109f16d06706e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
Size

2.7MB
MD5

9af1a04b51adbf946f85418af5b68320
SHA1

bae6c1ff9dd386cdd97d9d7e6b75e98d553e4725
SHA256

0241cc87d02419756166b73ea50cec455dcaafcb7f9d9e1e4ae109f16d06706e
SHA512

bdc39531f47d9175cc1af5e6e3ceb324c9e700ab367b1d36a1ccb4e4c068c1993ec1caca64230850ca8e8cf6ab4126d1591fa2964797577503c6b26e02dc5b71
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoo5EcD/:BemTLkNdfE0pZrV56utgpPFoW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/644-0-0x00007FF6BC3E0000-0x00007FF6BC734000-memory.dmp	xmrig
behavioral2/files/0x0009000000023419-4.dat	xmrig
behavioral2/files/0x0007000000023420-11.dat	xmrig
behavioral2/memory/4048-17-0x00007FF75F480000-0x00007FF75F7D4000-memory.dmp	xmrig
behavioral2/memory/3040-29-0x00007FF6D5DF0000-0x00007FF6D6144000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-46.dat	xmrig
behavioral2/files/0x0007000000023429-61.dat	xmrig
behavioral2/files/0x0007000000023428-65.dat	xmrig
behavioral2/memory/2344-70-0x00007FF649600000-0x00007FF649954000-memory.dmp	xmrig
behavioral2/memory/4160-74-0x00007FF6A3690000-0x00007FF6A39E4000-memory.dmp	xmrig
behavioral2/memory/2576-73-0x00007FF737580000-0x00007FF7378D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-71.dat	xmrig
behavioral2/memory/1844-67-0x00007FF6396E0000-0x00007FF639A34000-memory.dmp	xmrig
behavioral2/memory/2092-64-0x00007FF657F60000-0x00007FF6582B4000-memory.dmp	xmrig
behavioral2/memory/4488-63-0x00007FF6D2570000-0x00007FF6D28C4000-memory.dmp	xmrig
behavioral2/memory/4564-55-0x00007FF76CA40000-0x00007FF76CD94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-51.dat	xmrig
behavioral2/files/0x0007000000023427-49.dat	xmrig
behavioral2/files/0x0007000000023423-42.dat	xmrig
behavioral2/memory/4024-40-0x00007FF681120000-0x00007FF681474000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-41.dat	xmrig
behavioral2/files/0x000700000002342c-86.dat	xmrig
behavioral2/files/0x000700000002342f-103.dat	xmrig
behavioral2/files/0x0007000000023435-130.dat	xmrig
behavioral2/memory/2908-153-0x00007FF79F2E0000-0x00007FF79F634000-memory.dmp	xmrig
behavioral2/memory/736-171-0x00007FF7FB880000-0x00007FF7FBBD4000-memory.dmp	xmrig
behavioral2/memory/436-180-0x00007FF72AB20000-0x00007FF72AE74000-memory.dmp	xmrig
behavioral2/memory/3036-184-0x00007FF73E660000-0x00007FF73E9B4000-memory.dmp	xmrig
behavioral2/memory/2984-186-0x00007FF6D3950000-0x00007FF6D3CA4000-memory.dmp	xmrig
behavioral2/memory/2776-185-0x00007FF71C900000-0x00007FF71CC54000-memory.dmp	xmrig
behavioral2/memory/4728-183-0x00007FF73E710000-0x00007FF73EA64000-memory.dmp	xmrig
behavioral2/memory/564-182-0x00007FF681560000-0x00007FF6818B4000-memory.dmp	xmrig
behavioral2/memory/2452-181-0x00007FF606B10000-0x00007FF606E64000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-178.dat	xmrig
behavioral2/files/0x000700000002343b-176.dat	xmrig
behavioral2/files/0x000700000002343a-174.dat	xmrig
behavioral2/files/0x0007000000023439-172.dat	xmrig
behavioral2/files/0x0007000000023437-169.dat	xmrig
behavioral2/memory/3200-168-0x00007FF6440F0000-0x00007FF644444000-memory.dmp	xmrig
behavioral2/files/0x0007000000023438-164.dat	xmrig
behavioral2/files/0x0007000000023436-159.dat	xmrig
behavioral2/files/0x0007000000023434-158.dat	xmrig
behavioral2/memory/624-156-0x00007FF7D8DA0000-0x00007FF7D90F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-147.dat	xmrig
behavioral2/files/0x0007000000023432-143.dat	xmrig
behavioral2/memory/2924-132-0x00007FF732030000-0x00007FF732384000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-127.dat	xmrig
behavioral2/files/0x0007000000023430-135.dat	xmrig
behavioral2/files/0x000700000002342d-131.dat	xmrig
behavioral2/memory/4480-116-0x00007FF640E40000-0x00007FF641194000-memory.dmp	xmrig
behavioral2/memory/1700-112-0x00007FF691AB0000-0x00007FF691E04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023431-120.dat	xmrig
behavioral2/memory/1456-100-0x00007FF78D3E0000-0x00007FF78D734000-memory.dmp	xmrig
behavioral2/memory/1548-97-0x00007FF733C90000-0x00007FF733FE4000-memory.dmp	xmrig
behavioral2/files/0x000800000002341d-89.dat	xmrig
behavioral2/memory/1656-82-0x00007FF77A840000-0x00007FF77AB94000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-78.dat	xmrig
behavioral2/files/0x000700000002343f-192.dat	xmrig
behavioral2/files/0x000700000002343d-189.dat	xmrig
behavioral2/memory/1388-32-0x00007FF781FD0000-0x00007FF782324000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-33.dat	xmrig
behavioral2/memory/4964-23-0x00007FF7CCC00000-0x00007FF7CCF54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-22.dat	xmrig
behavioral2/memory/644-1109-0x00007FF6BC3E0000-0x00007FF6BC734000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4048	QCvcTXH.exe
4964	RoYUbjz.exe
4024	vCNMUmh.exe
3040	RHlONUN.exe
4564	dKThLmr.exe
1388	OiCEPca.exe
4488	rhLHoTO.exe
2576	ZxmRhyi.exe
2092	eYWAvNj.exe
4160	FCdCRiW.exe
1844	AjpEznY.exe
2344	ELGdGad.exe
1656	bMsdlFC.exe
1548	EWUuYlu.exe
1456	XoSLEJf.exe
2452	nprvaCI.exe
1700	lszcbia.exe
564	FEkZHJd.exe
4480	hJrJkKw.exe
2924	WTWqvww.exe
4728	jvwogzx.exe
3036	KYkePVr.exe
2908	HoyIZfU.exe
624	DdPwjrx.exe
2776	zMHocsF.exe
3200	GDcqYfL.exe
736	qyVduIg.exe
2984	LoAVsri.exe
436	dXJeOWF.exe
4072	lXxLTLd.exe
2684	kzEVTzv.exe
4968	wOKuAIU.exe
1996	BSblSFK.exe
5032	QKtxMPp.exe
2136	OordnWN.exe
1488	vDRzUpq.exe
1368	tawybXk.exe
116	xJRleTL.exe
3292	Xsnxyxp.exe
5012	iahGQoR.exe
2996	orTunTF.exe
1268	uDBlHDI.exe
856	tSlzwtv.exe
2580	jQerPJT.exe
1876	PVGrRUo.exe
4808	mKHqlhO.exe
3412	kwhBGUP.exe
2044	rspHFbS.exe
4888	aWzOxBK.exe
3804	PQDXOJJ.exe
1044	QJbpTDb.exe
3408	xwrFusK.exe
372	mpmnOkw.exe
1796	JuyAzOJ.exe
3136	IYSukkA.exe
2904	IDzLNNG.exe
4156	wjdxKTu.exe
1260	RuomPAC.exe
4004	tLQjkyk.exe
2716	AFzJXfk.exe
4856	VOwyBYZ.exe
920	EYYQxPy.exe
700	iSOVNzo.exe
3484	MLsuNuM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/644-0-0x00007FF6BC3E0000-0x00007FF6BC734000-memory.dmp	upx
behavioral2/files/0x0009000000023419-4.dat	upx
behavioral2/files/0x0007000000023420-11.dat	upx
behavioral2/memory/4048-17-0x00007FF75F480000-0x00007FF75F7D4000-memory.dmp	upx
behavioral2/memory/3040-29-0x00007FF6D5DF0000-0x00007FF6D6144000-memory.dmp	upx
behavioral2/files/0x0007000000023426-46.dat	upx
behavioral2/files/0x0007000000023429-61.dat	upx
behavioral2/files/0x0007000000023428-65.dat	upx
behavioral2/memory/2344-70-0x00007FF649600000-0x00007FF649954000-memory.dmp	upx
behavioral2/memory/4160-74-0x00007FF6A3690000-0x00007FF6A39E4000-memory.dmp	upx
behavioral2/memory/2576-73-0x00007FF737580000-0x00007FF7378D4000-memory.dmp	upx
behavioral2/files/0x000700000002342a-71.dat	upx
behavioral2/memory/1844-67-0x00007FF6396E0000-0x00007FF639A34000-memory.dmp	upx
behavioral2/memory/2092-64-0x00007FF657F60000-0x00007FF6582B4000-memory.dmp	upx
behavioral2/memory/4488-63-0x00007FF6D2570000-0x00007FF6D28C4000-memory.dmp	upx
behavioral2/memory/4564-55-0x00007FF76CA40000-0x00007FF76CD94000-memory.dmp	upx
behavioral2/files/0x0007000000023425-51.dat	upx
behavioral2/files/0x0007000000023427-49.dat	upx
behavioral2/files/0x0007000000023423-42.dat	upx
behavioral2/memory/4024-40-0x00007FF681120000-0x00007FF681474000-memory.dmp	upx
behavioral2/files/0x0007000000023424-41.dat	upx
behavioral2/files/0x000700000002342c-86.dat	upx
behavioral2/files/0x000700000002342f-103.dat	upx
behavioral2/files/0x0007000000023435-130.dat	upx
behavioral2/memory/2908-153-0x00007FF79F2E0000-0x00007FF79F634000-memory.dmp	upx
behavioral2/memory/736-171-0x00007FF7FB880000-0x00007FF7FBBD4000-memory.dmp	upx
behavioral2/memory/436-180-0x00007FF72AB20000-0x00007FF72AE74000-memory.dmp	upx
behavioral2/memory/3036-184-0x00007FF73E660000-0x00007FF73E9B4000-memory.dmp	upx
behavioral2/memory/2984-186-0x00007FF6D3950000-0x00007FF6D3CA4000-memory.dmp	upx
behavioral2/memory/2776-185-0x00007FF71C900000-0x00007FF71CC54000-memory.dmp	upx
behavioral2/memory/4728-183-0x00007FF73E710000-0x00007FF73EA64000-memory.dmp	upx
behavioral2/memory/564-182-0x00007FF681560000-0x00007FF6818B4000-memory.dmp	upx
behavioral2/memory/2452-181-0x00007FF606B10000-0x00007FF606E64000-memory.dmp	upx
behavioral2/files/0x000700000002343c-178.dat	upx
behavioral2/files/0x000700000002343b-176.dat	upx
behavioral2/files/0x000700000002343a-174.dat	upx
behavioral2/files/0x0007000000023439-172.dat	upx
behavioral2/files/0x0007000000023437-169.dat	upx
behavioral2/memory/3200-168-0x00007FF6440F0000-0x00007FF644444000-memory.dmp	upx
behavioral2/files/0x0007000000023438-164.dat	upx
behavioral2/files/0x0007000000023436-159.dat	upx
behavioral2/files/0x0007000000023434-158.dat	upx
behavioral2/memory/624-156-0x00007FF7D8DA0000-0x00007FF7D90F4000-memory.dmp	upx
behavioral2/files/0x0007000000023433-147.dat	upx
behavioral2/files/0x0007000000023432-143.dat	upx
behavioral2/memory/2924-132-0x00007FF732030000-0x00007FF732384000-memory.dmp	upx
behavioral2/files/0x000700000002342e-127.dat	upx
behavioral2/files/0x0007000000023430-135.dat	upx
behavioral2/files/0x000700000002342d-131.dat	upx
behavioral2/memory/4480-116-0x00007FF640E40000-0x00007FF641194000-memory.dmp	upx
behavioral2/memory/1700-112-0x00007FF691AB0000-0x00007FF691E04000-memory.dmp	upx
behavioral2/files/0x0007000000023431-120.dat	upx
behavioral2/memory/1456-100-0x00007FF78D3E0000-0x00007FF78D734000-memory.dmp	upx
behavioral2/memory/1548-97-0x00007FF733C90000-0x00007FF733FE4000-memory.dmp	upx
behavioral2/files/0x000800000002341d-89.dat	upx
behavioral2/memory/1656-82-0x00007FF77A840000-0x00007FF77AB94000-memory.dmp	upx
behavioral2/files/0x000700000002342b-78.dat	upx
behavioral2/files/0x000700000002343f-192.dat	upx
behavioral2/files/0x000700000002343d-189.dat	upx
behavioral2/memory/1388-32-0x00007FF781FD0000-0x00007FF782324000-memory.dmp	upx
behavioral2/files/0x0007000000023422-33.dat	upx
behavioral2/memory/4964-23-0x00007FF7CCC00000-0x00007FF7CCF54000-memory.dmp	upx
behavioral2/files/0x0007000000023421-22.dat	upx
behavioral2/memory/644-1109-0x00007FF6BC3E0000-0x00007FF6BC734000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pgoSMUn.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\sFbqWRQ.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\DoLKuER.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\vWbJSwM.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\wTabMTy.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\SFzHyVx.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\dfLriIJ.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\UcRRHcV.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\qGpHsLA.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\davTHqf.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\QCGOzjN.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\DlzZtQS.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\uzflZZh.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\YRpVQqT.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\FtvyPhP.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\xSyljlG.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\XjZIVkd.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\wQqALlq.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\BnNklbl.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\grGntcm.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\YZApkXg.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\dvvmOmN.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\ZyGCKSS.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\YVkhEKB.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\FUsXFEL.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\VAZughn.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\wKxnOUq.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\FOFbpLw.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\JdbgeDV.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\tIaxSpC.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\DdPwjrx.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\LMkKKyd.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\siByWjd.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\PVGrRUo.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\XUmXott.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\vSdBhMv.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\rNVNxek.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\MuOXHuc.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\QdxbNPn.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\CmDgTyT.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\WamDGKJ.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\KxMJahS.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\nvISYdw.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\DmbkoGG.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\TVhlLuO.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\nVtsJsJ.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\CWAETcv.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\ZtISTdK.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\uEFRJKD.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\vGAgQNJ.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\VKvkLMA.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\SfByTOn.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\kThOurb.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\xxFluWL.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\JDhlBVb.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\hChTxzU.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\aQJhKdV.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\PKXgsBl.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\MGUYzYu.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\OEfdsaj.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\xinyzPn.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\efLbeZA.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\lIWffNt.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
File created	C:\Windows\System\uvhSMxc.exe	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4048	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	84
PID 644 wrote to memory of 4048	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	84
PID 644 wrote to memory of 4964	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	85
PID 644 wrote to memory of 4964	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	85
PID 644 wrote to memory of 4024	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	86
PID 644 wrote to memory of 4024	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	86
PID 644 wrote to memory of 3040	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	87
PID 644 wrote to memory of 3040	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	87
PID 644 wrote to memory of 4564	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	88
PID 644 wrote to memory of 4564	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	88
PID 644 wrote to memory of 1388	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	89
PID 644 wrote to memory of 1388	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	89
PID 644 wrote to memory of 4488	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	90
PID 644 wrote to memory of 4488	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	90
PID 644 wrote to memory of 2576	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	91
PID 644 wrote to memory of 2576	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	91
PID 644 wrote to memory of 2092	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	92
PID 644 wrote to memory of 2092	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	92
PID 644 wrote to memory of 4160	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	93
PID 644 wrote to memory of 4160	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	93
PID 644 wrote to memory of 1844	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	94
PID 644 wrote to memory of 1844	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	94
PID 644 wrote to memory of 2344	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	95
PID 644 wrote to memory of 2344	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	95
PID 644 wrote to memory of 1656	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	96
PID 644 wrote to memory of 1656	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	96
PID 644 wrote to memory of 1548	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	97
PID 644 wrote to memory of 1548	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	97
PID 644 wrote to memory of 1456	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	98
PID 644 wrote to memory of 1456	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	98
PID 644 wrote to memory of 2452	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	99
PID 644 wrote to memory of 2452	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	99
PID 644 wrote to memory of 1700	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	100
PID 644 wrote to memory of 1700	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	100
PID 644 wrote to memory of 564	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	101
PID 644 wrote to memory of 564	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	101
PID 644 wrote to memory of 4480	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	102
PID 644 wrote to memory of 4480	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	102
PID 644 wrote to memory of 2924	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	103
PID 644 wrote to memory of 2924	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	103
PID 644 wrote to memory of 4728	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	104
PID 644 wrote to memory of 4728	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	104
PID 644 wrote to memory of 3036	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	105
PID 644 wrote to memory of 3036	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	105
PID 644 wrote to memory of 2908	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	106
PID 644 wrote to memory of 2908	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	106
PID 644 wrote to memory of 624	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	107
PID 644 wrote to memory of 624	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	107
PID 644 wrote to memory of 2776	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	108
PID 644 wrote to memory of 2776	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	108
PID 644 wrote to memory of 3200	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	109
PID 644 wrote to memory of 3200	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	109
PID 644 wrote to memory of 736	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	110
PID 644 wrote to memory of 736	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	110
PID 644 wrote to memory of 2984	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	111
PID 644 wrote to memory of 2984	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	111
PID 644 wrote to memory of 436	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	112
PID 644 wrote to memory of 436	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	112
PID 644 wrote to memory of 4072	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	113
PID 644 wrote to memory of 4072	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	113
PID 644 wrote to memory of 2684	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	114
PID 644 wrote to memory of 2684	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	114
PID 644 wrote to memory of 4968	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	115
PID 644 wrote to memory of 4968	644	9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9af1a04b51adbf946f85418af5b68320_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\System\QCvcTXH.exe
  C:\Windows\System\QCvcTXH.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\RoYUbjz.exe
  C:\Windows\System\RoYUbjz.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\vCNMUmh.exe
  C:\Windows\System\vCNMUmh.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\RHlONUN.exe
  C:\Windows\System\RHlONUN.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\dKThLmr.exe
  C:\Windows\System\dKThLmr.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\OiCEPca.exe
  C:\Windows\System\OiCEPca.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\rhLHoTO.exe
  C:\Windows\System\rhLHoTO.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\ZxmRhyi.exe
  C:\Windows\System\ZxmRhyi.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\eYWAvNj.exe
  C:\Windows\System\eYWAvNj.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\FCdCRiW.exe
  C:\Windows\System\FCdCRiW.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\AjpEznY.exe
  C:\Windows\System\AjpEznY.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ELGdGad.exe
  C:\Windows\System\ELGdGad.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\bMsdlFC.exe
  C:\Windows\System\bMsdlFC.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\EWUuYlu.exe
  C:\Windows\System\EWUuYlu.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\XoSLEJf.exe
  C:\Windows\System\XoSLEJf.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\nprvaCI.exe
  C:\Windows\System\nprvaCI.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\lszcbia.exe
  C:\Windows\System\lszcbia.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\FEkZHJd.exe
  C:\Windows\System\FEkZHJd.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\hJrJkKw.exe
  C:\Windows\System\hJrJkKw.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\WTWqvww.exe
  C:\Windows\System\WTWqvww.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\jvwogzx.exe
  C:\Windows\System\jvwogzx.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\KYkePVr.exe
  C:\Windows\System\KYkePVr.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\HoyIZfU.exe
  C:\Windows\System\HoyIZfU.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\DdPwjrx.exe
  C:\Windows\System\DdPwjrx.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\zMHocsF.exe
  C:\Windows\System\zMHocsF.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\GDcqYfL.exe
  C:\Windows\System\GDcqYfL.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\qyVduIg.exe
  C:\Windows\System\qyVduIg.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\LoAVsri.exe
  C:\Windows\System\LoAVsri.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\dXJeOWF.exe
  C:\Windows\System\dXJeOWF.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\lXxLTLd.exe
  C:\Windows\System\lXxLTLd.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\kzEVTzv.exe
  C:\Windows\System\kzEVTzv.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\wOKuAIU.exe
  C:\Windows\System\wOKuAIU.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\BSblSFK.exe
  C:\Windows\System\BSblSFK.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\QKtxMPp.exe
  C:\Windows\System\QKtxMPp.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\OordnWN.exe
  C:\Windows\System\OordnWN.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\vDRzUpq.exe
  C:\Windows\System\vDRzUpq.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\tawybXk.exe
  C:\Windows\System\tawybXk.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\xJRleTL.exe
  C:\Windows\System\xJRleTL.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\Xsnxyxp.exe
  C:\Windows\System\Xsnxyxp.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\iahGQoR.exe
  C:\Windows\System\iahGQoR.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\orTunTF.exe
  C:\Windows\System\orTunTF.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\uDBlHDI.exe
  C:\Windows\System\uDBlHDI.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\tSlzwtv.exe
  C:\Windows\System\tSlzwtv.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\jQerPJT.exe
  C:\Windows\System\jQerPJT.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\PVGrRUo.exe
  C:\Windows\System\PVGrRUo.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\mKHqlhO.exe
  C:\Windows\System\mKHqlhO.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\kwhBGUP.exe
  C:\Windows\System\kwhBGUP.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\rspHFbS.exe
  C:\Windows\System\rspHFbS.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\aWzOxBK.exe
  C:\Windows\System\aWzOxBK.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\PQDXOJJ.exe
  C:\Windows\System\PQDXOJJ.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\QJbpTDb.exe
  C:\Windows\System\QJbpTDb.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\xwrFusK.exe
  C:\Windows\System\xwrFusK.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\mpmnOkw.exe
  C:\Windows\System\mpmnOkw.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\JuyAzOJ.exe
  C:\Windows\System\JuyAzOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\IYSukkA.exe
  C:\Windows\System\IYSukkA.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\IDzLNNG.exe
  C:\Windows\System\IDzLNNG.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\wjdxKTu.exe
  C:\Windows\System\wjdxKTu.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\RuomPAC.exe
  C:\Windows\System\RuomPAC.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\tLQjkyk.exe
  C:\Windows\System\tLQjkyk.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\AFzJXfk.exe
  C:\Windows\System\AFzJXfk.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\VOwyBYZ.exe
  C:\Windows\System\VOwyBYZ.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\EYYQxPy.exe
  C:\Windows\System\EYYQxPy.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\iSOVNzo.exe
  C:\Windows\System\iSOVNzo.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\MLsuNuM.exe
  C:\Windows\System\MLsuNuM.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\UQHxtbH.exe
  C:\Windows\System\UQHxtbH.exe
  2⤵
  PID:968
- C:\Windows\System\zHVuHbc.exe
  C:\Windows\System\zHVuHbc.exe
  2⤵
  PID:1192
- C:\Windows\System\kRwGViS.exe
  C:\Windows\System\kRwGViS.exe
  2⤵
  PID:1056
- C:\Windows\System\WamDGKJ.exe
  C:\Windows\System\WamDGKJ.exe
  2⤵
  PID:1744
- C:\Windows\System\YVkhEKB.exe
  C:\Windows\System\YVkhEKB.exe
  2⤵
  PID:2372
- C:\Windows\System\JTzdKeH.exe
  C:\Windows\System\JTzdKeH.exe
  2⤵
  PID:4132
- C:\Windows\System\XUmXott.exe
  C:\Windows\System\XUmXott.exe
  2⤵
  PID:4404
- C:\Windows\System\FMFCoMK.exe
  C:\Windows\System\FMFCoMK.exe
  2⤵
  PID:3596
- C:\Windows\System\IWJapcj.exe
  C:\Windows\System\IWJapcj.exe
  2⤵
  PID:2016
- C:\Windows\System\MpuRpws.exe
  C:\Windows\System\MpuRpws.exe
  2⤵
  PID:4752
- C:\Windows\System\xXelbKG.exe
  C:\Windows\System\xXelbKG.exe
  2⤵
  PID:3572
- C:\Windows\System\modEzJs.exe
  C:\Windows\System\modEzJs.exe
  2⤵
  PID:232
- C:\Windows\System\oKbSAaj.exe
  C:\Windows\System\oKbSAaj.exe
  2⤵
  PID:1072
- C:\Windows\System\PKXgsBl.exe
  C:\Windows\System\PKXgsBl.exe
  2⤵
  PID:2916
- C:\Windows\System\qhWaKwA.exe
  C:\Windows\System\qhWaKwA.exe
  2⤵
  PID:4276
- C:\Windows\System\xSyljlG.exe
  C:\Windows\System\xSyljlG.exe
  2⤵
  PID:1412
- C:\Windows\System\gFUNyuC.exe
  C:\Windows\System\gFUNyuC.exe
  2⤵
  PID:3900
- C:\Windows\System\YoprXWs.exe
  C:\Windows\System\YoprXWs.exe
  2⤵
  PID:3640
- C:\Windows\System\tTXnKNl.exe
  C:\Windows\System\tTXnKNl.exe
  2⤵
  PID:4040
- C:\Windows\System\EwWCklp.exe
  C:\Windows\System\EwWCklp.exe
  2⤵
  PID:4140
- C:\Windows\System\WsbUkCA.exe
  C:\Windows\System\WsbUkCA.exe
  2⤵
  PID:5128
- C:\Windows\System\IFyYAIn.exe
  C:\Windows\System\IFyYAIn.exe
  2⤵
  PID:5152
- C:\Windows\System\fcIysaU.exe
  C:\Windows\System\fcIysaU.exe
  2⤵
  PID:5188
- C:\Windows\System\FIRKqSg.exe
  C:\Windows\System\FIRKqSg.exe
  2⤵
  PID:5216
- C:\Windows\System\RPfApcx.exe
  C:\Windows\System\RPfApcx.exe
  2⤵
  PID:5236
- C:\Windows\System\fmyTYHM.exe
  C:\Windows\System\fmyTYHM.exe
  2⤵
  PID:5256
- C:\Windows\System\JXHRzdd.exe
  C:\Windows\System\JXHRzdd.exe
  2⤵
  PID:5280
- C:\Windows\System\QCGOzjN.exe
  C:\Windows\System\QCGOzjN.exe
  2⤵
  PID:5296
- C:\Windows\System\QVfVhnV.exe
  C:\Windows\System\QVfVhnV.exe
  2⤵
  PID:5324
- C:\Windows\System\EkmHBUt.exe
  C:\Windows\System\EkmHBUt.exe
  2⤵
  PID:5364
- C:\Windows\System\pgVNbqg.exe
  C:\Windows\System\pgVNbqg.exe
  2⤵
  PID:5404
- C:\Windows\System\ACYVIGs.exe
  C:\Windows\System\ACYVIGs.exe
  2⤵
  PID:5432
- C:\Windows\System\VIHltQP.exe
  C:\Windows\System\VIHltQP.exe
  2⤵
  PID:5476
- C:\Windows\System\fsMbJLw.exe
  C:\Windows\System\fsMbJLw.exe
  2⤵
  PID:5500
- C:\Windows\System\juLAmFs.exe
  C:\Windows\System\juLAmFs.exe
  2⤵
  PID:5540
- C:\Windows\System\TsfzRmj.exe
  C:\Windows\System\TsfzRmj.exe
  2⤵
  PID:5572
- C:\Windows\System\WRIoIPz.exe
  C:\Windows\System\WRIoIPz.exe
  2⤵
  PID:5596
- C:\Windows\System\LTmCzgp.exe
  C:\Windows\System\LTmCzgp.exe
  2⤵
  PID:5628
- C:\Windows\System\EaMfhfD.exe
  C:\Windows\System\EaMfhfD.exe
  2⤵
  PID:5660
- C:\Windows\System\nLNYpij.exe
  C:\Windows\System\nLNYpij.exe
  2⤵
  PID:5696
- C:\Windows\System\bEgmNmM.exe
  C:\Windows\System\bEgmNmM.exe
  2⤵
  PID:5732
- C:\Windows\System\raFOKmy.exe
  C:\Windows\System\raFOKmy.exe
  2⤵
  PID:5772
- C:\Windows\System\gOFrzVU.exe
  C:\Windows\System\gOFrzVU.exe
  2⤵
  PID:5812
- C:\Windows\System\RBzEygB.exe
  C:\Windows\System\RBzEygB.exe
  2⤵
  PID:5840
- C:\Windows\System\KRSyycI.exe
  C:\Windows\System\KRSyycI.exe
  2⤵
  PID:5860
- C:\Windows\System\SCcSzNk.exe
  C:\Windows\System\SCcSzNk.exe
  2⤵
  PID:5888
- C:\Windows\System\bvtNxhZ.exe
  C:\Windows\System\bvtNxhZ.exe
  2⤵
  PID:5928
- C:\Windows\System\ddzAdTV.exe
  C:\Windows\System\ddzAdTV.exe
  2⤵
  PID:5956
- C:\Windows\System\FUsXFEL.exe
  C:\Windows\System\FUsXFEL.exe
  2⤵
  PID:5984
- C:\Windows\System\XtlCgRe.exe
  C:\Windows\System\XtlCgRe.exe
  2⤵
  PID:6016
- C:\Windows\System\pVwELwq.exe
  C:\Windows\System\pVwELwq.exe
  2⤵
  PID:6040
- C:\Windows\System\uyYtPHZ.exe
  C:\Windows\System\uyYtPHZ.exe
  2⤵
  PID:6076
- C:\Windows\System\bfIyeBH.exe
  C:\Windows\System\bfIyeBH.exe
  2⤵
  PID:6104
- C:\Windows\System\eEBqsPC.exe
  C:\Windows\System\eEBqsPC.exe
  2⤵
  PID:6124
- C:\Windows\System\NfiaVrr.exe
  C:\Windows\System\NfiaVrr.exe
  2⤵
  PID:5144
- C:\Windows\System\WomSezG.exe
  C:\Windows\System\WomSezG.exe
  2⤵
  PID:5224
- C:\Windows\System\PlsCePG.exe
  C:\Windows\System\PlsCePG.exe
  2⤵
  PID:5252
- C:\Windows\System\shpyvdf.exe
  C:\Windows\System\shpyvdf.exe
  2⤵
  PID:5316
- C:\Windows\System\zYlptMg.exe
  C:\Windows\System\zYlptMg.exe
  2⤵
  PID:5392
- C:\Windows\System\eveccsi.exe
  C:\Windows\System\eveccsi.exe
  2⤵
  PID:5472
- C:\Windows\System\omLuRdH.exe
  C:\Windows\System\omLuRdH.exe
  2⤵
  PID:5548
- C:\Windows\System\ZJnVdEd.exe
  C:\Windows\System\ZJnVdEd.exe
  2⤵
  PID:5588
- C:\Windows\System\DlzZtQS.exe
  C:\Windows\System\DlzZtQS.exe
  2⤵
  PID:5656
- C:\Windows\System\qfSzBWQ.exe
  C:\Windows\System\qfSzBWQ.exe
  2⤵
  PID:5764
- C:\Windows\System\crEhwgS.exe
  C:\Windows\System\crEhwgS.exe
  2⤵
  PID:5828
- C:\Windows\System\ufhMurN.exe
  C:\Windows\System\ufhMurN.exe
  2⤵
  PID:5900
- C:\Windows\System\CNNLNof.exe
  C:\Windows\System\CNNLNof.exe
  2⤵
  PID:5944
- C:\Windows\System\OIILBpD.exe
  C:\Windows\System\OIILBpD.exe
  2⤵
  PID:6024
- C:\Windows\System\UIvvhMY.exe
  C:\Windows\System\UIvvhMY.exe
  2⤵
  PID:6092
- C:\Windows\System\bqtuzFF.exe
  C:\Windows\System\bqtuzFF.exe
  2⤵
  PID:6000
- C:\Windows\System\mmqzqnD.exe
  C:\Windows\System\mmqzqnD.exe
  2⤵
  PID:5288
- C:\Windows\System\nzKNLZb.exe
  C:\Windows\System\nzKNLZb.exe
  2⤵
  PID:5424
- C:\Windows\System\UqUjNcZ.exe
  C:\Windows\System\UqUjNcZ.exe
  2⤵
  PID:5584
- C:\Windows\System\PDJlEVG.exe
  C:\Windows\System\PDJlEVG.exe
  2⤵
  PID:5784
- C:\Windows\System\rDuRGfD.exe
  C:\Windows\System\rDuRGfD.exe
  2⤵
  PID:5936
- C:\Windows\System\mAFDltY.exe
  C:\Windows\System\mAFDltY.exe
  2⤵
  PID:6084
- C:\Windows\System\LMkKKyd.exe
  C:\Windows\System\LMkKKyd.exe
  2⤵
  PID:5356
- C:\Windows\System\pFWJICD.exe
  C:\Windows\System\pFWJICD.exe
  2⤵
  PID:5704
- C:\Windows\System\wpCFGjP.exe
  C:\Windows\System\wpCFGjP.exe
  2⤵
  PID:5264
- C:\Windows\System\lkItXeZ.exe
  C:\Windows\System\lkItXeZ.exe
  2⤵
  PID:5644
- C:\Windows\System\eUenHTE.exe
  C:\Windows\System\eUenHTE.exe
  2⤵
  PID:6164
- C:\Windows\System\dApjKCv.exe
  C:\Windows\System\dApjKCv.exe
  2⤵
  PID:6200
- C:\Windows\System\zdRHIef.exe
  C:\Windows\System\zdRHIef.exe
  2⤵
  PID:6228
- C:\Windows\System\gMTtNCJ.exe
  C:\Windows\System\gMTtNCJ.exe
  2⤵
  PID:6256
- C:\Windows\System\GzNirYU.exe
  C:\Windows\System\GzNirYU.exe
  2⤵
  PID:6300
- C:\Windows\System\lPpmqbN.exe
  C:\Windows\System\lPpmqbN.exe
  2⤵
  PID:6328
- C:\Windows\System\ySFwoxW.exe
  C:\Windows\System\ySFwoxW.exe
  2⤵
  PID:6356
- C:\Windows\System\grGntcm.exe
  C:\Windows\System\grGntcm.exe
  2⤵
  PID:6388
- C:\Windows\System\NUwPeJA.exe
  C:\Windows\System\NUwPeJA.exe
  2⤵
  PID:6444
- C:\Windows\System\VGdBItF.exe
  C:\Windows\System\VGdBItF.exe
  2⤵
  PID:6484
- C:\Windows\System\ppfPPft.exe
  C:\Windows\System\ppfPPft.exe
  2⤵
  PID:6524
- C:\Windows\System\AfXvrYv.exe
  C:\Windows\System\AfXvrYv.exe
  2⤵
  PID:6572
- C:\Windows\System\sgoanAI.exe
  C:\Windows\System\sgoanAI.exe
  2⤵
  PID:6588
- C:\Windows\System\mzvqTab.exe
  C:\Windows\System\mzvqTab.exe
  2⤵
  PID:6624
- C:\Windows\System\uIehUZG.exe
  C:\Windows\System\uIehUZG.exe
  2⤵
  PID:6668
- C:\Windows\System\wHFxfgA.exe
  C:\Windows\System\wHFxfgA.exe
  2⤵
  PID:6704
- C:\Windows\System\sBMyIDP.exe
  C:\Windows\System\sBMyIDP.exe
  2⤵
  PID:6732
- C:\Windows\System\iuIWeKz.exe
  C:\Windows\System\iuIWeKz.exe
  2⤵
  PID:6760
- C:\Windows\System\mYdprXb.exe
  C:\Windows\System\mYdprXb.exe
  2⤵
  PID:6812
- C:\Windows\System\CLdoEAN.exe
  C:\Windows\System\CLdoEAN.exe
  2⤵
  PID:6864
- C:\Windows\System\BRiYHHx.exe
  C:\Windows\System\BRiYHHx.exe
  2⤵
  PID:6892
- C:\Windows\System\dsQWAFZ.exe
  C:\Windows\System\dsQWAFZ.exe
  2⤵
  PID:6920
- C:\Windows\System\VTWNhZg.exe
  C:\Windows\System\VTWNhZg.exe
  2⤵
  PID:6948
- C:\Windows\System\WlfsKWW.exe
  C:\Windows\System\WlfsKWW.exe
  2⤵
  PID:6976
- C:\Windows\System\pIFlzWd.exe
  C:\Windows\System\pIFlzWd.exe
  2⤵
  PID:7004
- C:\Windows\System\dJjNFcM.exe
  C:\Windows\System\dJjNFcM.exe
  2⤵
  PID:7036
- C:\Windows\System\hiUNCve.exe
  C:\Windows\System\hiUNCve.exe
  2⤵
  PID:7064
- C:\Windows\System\UcRRHcV.exe
  C:\Windows\System\UcRRHcV.exe
  2⤵
  PID:7092
- C:\Windows\System\xitOObv.exe
  C:\Windows\System\xitOObv.exe
  2⤵
  PID:7124
- C:\Windows\System\qQlNyiB.exe
  C:\Windows\System\qQlNyiB.exe
  2⤵
  PID:7160
- C:\Windows\System\godvBWR.exe
  C:\Windows\System\godvBWR.exe
  2⤵
  PID:5492
- C:\Windows\System\nrQDBSQ.exe
  C:\Windows\System\nrQDBSQ.exe
  2⤵
  PID:6268
- C:\Windows\System\vRqwyPK.exe
  C:\Windows\System\vRqwyPK.exe
  2⤵
  PID:6344
- C:\Windows\System\oUlbApT.exe
  C:\Windows\System\oUlbApT.exe
  2⤵
  PID:6432
- C:\Windows\System\nBjImJm.exe
  C:\Windows\System\nBjImJm.exe
  2⤵
  PID:6520
- C:\Windows\System\WPAgFnR.exe
  C:\Windows\System\WPAgFnR.exe
  2⤵
  PID:6616
- C:\Windows\System\qCdjwob.exe
  C:\Windows\System\qCdjwob.exe
  2⤵
  PID:6720
- C:\Windows\System\bUfYnol.exe
  C:\Windows\System\bUfYnol.exe
  2⤵
  PID:6792
- C:\Windows\System\FsmmTXd.exe
  C:\Windows\System\FsmmTXd.exe
  2⤵
  PID:6888
- C:\Windows\System\CWAETcv.exe
  C:\Windows\System\CWAETcv.exe
  2⤵
  PID:6968
- C:\Windows\System\dBbkmYY.exe
  C:\Windows\System\dBbkmYY.exe
  2⤵
  PID:7024
- C:\Windows\System\VKvkLMA.exe
  C:\Windows\System\VKvkLMA.exe
  2⤵
  PID:7116
- C:\Windows\System\pWpGIQl.exe
  C:\Windows\System\pWpGIQl.exe
  2⤵
  PID:6212
- C:\Windows\System\kPmTbBf.exe
  C:\Windows\System\kPmTbBf.exe
  2⤵
  PID:6380
- C:\Windows\System\hHFIxsd.exe
  C:\Windows\System\hHFIxsd.exe
  2⤵
  PID:6584
- C:\Windows\System\kzWKCeW.exe
  C:\Windows\System\kzWKCeW.exe
  2⤵
  PID:6844
- C:\Windows\System\nuUQzON.exe
  C:\Windows\System\nuUQzON.exe
  2⤵
  PID:6988
- C:\Windows\System\lpdSfoQ.exe
  C:\Windows\System\lpdSfoQ.exe
  2⤵
  PID:7084
- C:\Windows\System\HmJONVu.exe
  C:\Windows\System\HmJONVu.exe
  2⤵
  PID:6324
- C:\Windows\System\XszJxdz.exe
  C:\Windows\System\XszJxdz.exe
  2⤵
  PID:6940
- C:\Windows\System\OGwsMpp.exe
  C:\Windows\System\OGwsMpp.exe
  2⤵
  PID:6312
- C:\Windows\System\JNGsMlD.exe
  C:\Windows\System\JNGsMlD.exe
  2⤵
  PID:7052
- C:\Windows\System\pgoSMUn.exe
  C:\Windows\System\pgoSMUn.exe
  2⤵
  PID:7184
- C:\Windows\System\EsOnNMG.exe
  C:\Windows\System\EsOnNMG.exe
  2⤵
  PID:7216
- C:\Windows\System\wSNmMum.exe
  C:\Windows\System\wSNmMum.exe
  2⤵
  PID:7248
- C:\Windows\System\XTJZRhk.exe
  C:\Windows\System\XTJZRhk.exe
  2⤵
  PID:7276
- C:\Windows\System\oKbZywt.exe
  C:\Windows\System\oKbZywt.exe
  2⤵
  PID:7304
- C:\Windows\System\oHKDisI.exe
  C:\Windows\System\oHKDisI.exe
  2⤵
  PID:7332
- C:\Windows\System\GEENAiN.exe
  C:\Windows\System\GEENAiN.exe
  2⤵
  PID:7356
- C:\Windows\System\ObMCMJn.exe
  C:\Windows\System\ObMCMJn.exe
  2⤵
  PID:7392
- C:\Windows\System\DXXDEYL.exe
  C:\Windows\System\DXXDEYL.exe
  2⤵
  PID:7412
- C:\Windows\System\qWFBRPG.exe
  C:\Windows\System\qWFBRPG.exe
  2⤵
  PID:7448
- C:\Windows\System\RgeHvTo.exe
  C:\Windows\System\RgeHvTo.exe
  2⤵
  PID:7472
- C:\Windows\System\qjgXiSY.exe
  C:\Windows\System\qjgXiSY.exe
  2⤵
  PID:7504
- C:\Windows\System\MDgQAEE.exe
  C:\Windows\System\MDgQAEE.exe
  2⤵
  PID:7524
- C:\Windows\System\ilWhcxi.exe
  C:\Windows\System\ilWhcxi.exe
  2⤵
  PID:7552
- C:\Windows\System\OTqspdg.exe
  C:\Windows\System\OTqspdg.exe
  2⤵
  PID:7584
- C:\Windows\System\MGUYzYu.exe
  C:\Windows\System\MGUYzYu.exe
  2⤵
  PID:7616
- C:\Windows\System\vSdBhMv.exe
  C:\Windows\System\vSdBhMv.exe
  2⤵
  PID:7636
- C:\Windows\System\RZkPuCu.exe
  C:\Windows\System\RZkPuCu.exe
  2⤵
  PID:7664
- C:\Windows\System\UDDJZJr.exe
  C:\Windows\System\UDDJZJr.exe
  2⤵
  PID:7692
- C:\Windows\System\AkklXIt.exe
  C:\Windows\System\AkklXIt.exe
  2⤵
  PID:7724
- C:\Windows\System\lsmTqet.exe
  C:\Windows\System\lsmTqet.exe
  2⤵
  PID:7756
- C:\Windows\System\wHHJniy.exe
  C:\Windows\System\wHHJniy.exe
  2⤵
  PID:7784
- C:\Windows\System\LLCiGsK.exe
  C:\Windows\System\LLCiGsK.exe
  2⤵
  PID:7812
- C:\Windows\System\DGdEZhm.exe
  C:\Windows\System\DGdEZhm.exe
  2⤵
  PID:7852
- C:\Windows\System\RPzwAXs.exe
  C:\Windows\System\RPzwAXs.exe
  2⤵
  PID:7880
- C:\Windows\System\jNIsTxD.exe
  C:\Windows\System\jNIsTxD.exe
  2⤵
  PID:7908
- C:\Windows\System\qrvMeJv.exe
  C:\Windows\System\qrvMeJv.exe
  2⤵
  PID:7948
- C:\Windows\System\ZBrzxHk.exe
  C:\Windows\System\ZBrzxHk.exe
  2⤵
  PID:7988
- C:\Windows\System\rNVNxek.exe
  C:\Windows\System\rNVNxek.exe
  2⤵
  PID:8016
- C:\Windows\System\rlTfqPv.exe
  C:\Windows\System\rlTfqPv.exe
  2⤵
  PID:8044
- C:\Windows\System\abdsovf.exe
  C:\Windows\System\abdsovf.exe
  2⤵
  PID:8068
- C:\Windows\System\tNzPQGf.exe
  C:\Windows\System\tNzPQGf.exe
  2⤵
  PID:8084
- C:\Windows\System\sFbqWRQ.exe
  C:\Windows\System\sFbqWRQ.exe
  2⤵
  PID:8108
- C:\Windows\System\qfVnXbb.exe
  C:\Windows\System\qfVnXbb.exe
  2⤵
  PID:8136
- C:\Windows\System\Uvsyehf.exe
  C:\Windows\System\Uvsyehf.exe
  2⤵
  PID:8168
- C:\Windows\System\uzflZZh.exe
  C:\Windows\System\uzflZZh.exe
  2⤵
  PID:7208
- C:\Windows\System\KnqYOKQ.exe
  C:\Windows\System\KnqYOKQ.exe
  2⤵
  PID:7292
- C:\Windows\System\wVgquoT.exe
  C:\Windows\System\wVgquoT.exe
  2⤵
  PID:7368
- C:\Windows\System\nsZFUws.exe
  C:\Windows\System\nsZFUws.exe
  2⤵
  PID:7432
- C:\Windows\System\NOTqEYn.exe
  C:\Windows\System\NOTqEYn.exe
  2⤵
  PID:7512
- C:\Windows\System\BjxsRVD.exe
  C:\Windows\System\BjxsRVD.exe
  2⤵
  PID:7572
- C:\Windows\System\RBynSIv.exe
  C:\Windows\System\RBynSIv.exe
  2⤵
  PID:7628
- C:\Windows\System\ZVdCnwb.exe
  C:\Windows\System\ZVdCnwb.exe
  2⤵
  PID:7704
- C:\Windows\System\jqzbkrv.exe
  C:\Windows\System\jqzbkrv.exe
  2⤵
  PID:7768
- C:\Windows\System\Ypkxlij.exe
  C:\Windows\System\Ypkxlij.exe
  2⤵
  PID:7836
- C:\Windows\System\TnXCYLl.exe
  C:\Windows\System\TnXCYLl.exe
  2⤵
  PID:7944
- C:\Windows\System\OaFqJMB.exe
  C:\Windows\System\OaFqJMB.exe
  2⤵
  PID:8012
- C:\Windows\System\qGpHsLA.exe
  C:\Windows\System\qGpHsLA.exe
  2⤵
  PID:8120
- C:\Windows\System\KxMJahS.exe
  C:\Windows\System\KxMJahS.exe
  2⤵
  PID:8160
- C:\Windows\System\yrSBHin.exe
  C:\Windows\System\yrSBHin.exe
  2⤵
  PID:7352
- C:\Windows\System\RJpRjcw.exe
  C:\Windows\System\RJpRjcw.exe
  2⤵
  PID:7536
- C:\Windows\System\PxDuqYQ.exe
  C:\Windows\System\PxDuqYQ.exe
  2⤵
  PID:7940
- C:\Windows\System\OEfdsaj.exe
  C:\Windows\System\OEfdsaj.exe
  2⤵
  PID:7684
- C:\Windows\System\ajQLJut.exe
  C:\Windows\System\ajQLJut.exe
  2⤵
  PID:7876
- C:\Windows\System\WcGYjel.exe
  C:\Windows\System\WcGYjel.exe
  2⤵
  PID:8064
- C:\Windows\System\FxhyjqN.exe
  C:\Windows\System\FxhyjqN.exe
  2⤵
  PID:7424
- C:\Windows\System\rUFLkOn.exe
  C:\Windows\System\rUFLkOn.exe
  2⤵
  PID:7688
- C:\Windows\System\fNtCcZB.exe
  C:\Windows\System\fNtCcZB.exe
  2⤵
  PID:7180
- C:\Windows\System\DudoSET.exe
  C:\Windows\System\DudoSET.exe
  2⤵
  PID:8056
- C:\Windows\System\dzzfspA.exe
  C:\Windows\System\dzzfspA.exe
  2⤵
  PID:8200
- C:\Windows\System\sriFCXd.exe
  C:\Windows\System\sriFCXd.exe
  2⤵
  PID:8280
- C:\Windows\System\sFGjSeA.exe
  C:\Windows\System\sFGjSeA.exe
  2⤵
  PID:8300
- C:\Windows\System\ivhwnpm.exe
  C:\Windows\System\ivhwnpm.exe
  2⤵
  PID:8336
- C:\Windows\System\rwsrYeB.exe
  C:\Windows\System\rwsrYeB.exe
  2⤵
  PID:8364
- C:\Windows\System\DoLKuER.exe
  C:\Windows\System\DoLKuER.exe
  2⤵
  PID:8388
- C:\Windows\System\pVUjwMZ.exe
  C:\Windows\System\pVUjwMZ.exe
  2⤵
  PID:8416
- C:\Windows\System\RNZloek.exe
  C:\Windows\System\RNZloek.exe
  2⤵
  PID:8440
- C:\Windows\System\nkKfuHF.exe
  C:\Windows\System\nkKfuHF.exe
  2⤵
  PID:8472
- C:\Windows\System\vzjtIkj.exe
  C:\Windows\System\vzjtIkj.exe
  2⤵
  PID:8496
- C:\Windows\System\SfByTOn.exe
  C:\Windows\System\SfByTOn.exe
  2⤵
  PID:8532
- C:\Windows\System\LtQsWEK.exe
  C:\Windows\System\LtQsWEK.exe
  2⤵
  PID:8556
- C:\Windows\System\osANomN.exe
  C:\Windows\System\osANomN.exe
  2⤵
  PID:8580
- C:\Windows\System\IzRxIlR.exe
  C:\Windows\System\IzRxIlR.exe
  2⤵
  PID:8608
- C:\Windows\System\nvISYdw.exe
  C:\Windows\System\nvISYdw.exe
  2⤵
  PID:8636
- C:\Windows\System\tmSqNLr.exe
  C:\Windows\System\tmSqNLr.exe
  2⤵
  PID:8664
- C:\Windows\System\MCOaZxs.exe
  C:\Windows\System\MCOaZxs.exe
  2⤵
  PID:8708
- C:\Windows\System\QraMfKH.exe
  C:\Windows\System\QraMfKH.exe
  2⤵
  PID:8760
- C:\Windows\System\ZqdFRKa.exe
  C:\Windows\System\ZqdFRKa.exe
  2⤵
  PID:8800
- C:\Windows\System\lXILRwp.exe
  C:\Windows\System\lXILRwp.exe
  2⤵
  PID:8840
- C:\Windows\System\nDFTHje.exe
  C:\Windows\System\nDFTHje.exe
  2⤵
  PID:8876
- C:\Windows\System\CluOqnz.exe
  C:\Windows\System\CluOqnz.exe
  2⤵
  PID:8904
- C:\Windows\System\UxmcaDc.exe
  C:\Windows\System\UxmcaDc.exe
  2⤵
  PID:8932
- C:\Windows\System\RyZmGaZ.exe
  C:\Windows\System\RyZmGaZ.exe
  2⤵
  PID:8960
- C:\Windows\System\qlRQwLA.exe
  C:\Windows\System\qlRQwLA.exe
  2⤵
  PID:8988
- C:\Windows\System\vWbJSwM.exe
  C:\Windows\System\vWbJSwM.exe
  2⤵
  PID:9016
- C:\Windows\System\UAnXJZo.exe
  C:\Windows\System\UAnXJZo.exe
  2⤵
  PID:9032
- C:\Windows\System\ZNmnIEf.exe
  C:\Windows\System\ZNmnIEf.exe
  2⤵
  PID:9072
- C:\Windows\System\GIDUrPs.exe
  C:\Windows\System\GIDUrPs.exe
  2⤵
  PID:9108
- C:\Windows\System\zvjocAY.exe
  C:\Windows\System\zvjocAY.exe
  2⤵
  PID:9132
- C:\Windows\System\vCtHMId.exe
  C:\Windows\System\vCtHMId.exe
  2⤵
  PID:9164
- C:\Windows\System\OwgfSSy.exe
  C:\Windows\System\OwgfSSy.exe
  2⤵
  PID:9188
- C:\Windows\System\vbsXuew.exe
  C:\Windows\System\vbsXuew.exe
  2⤵
  PID:7928
- C:\Windows\System\ooaFYnA.exe
  C:\Windows\System\ooaFYnA.exe
  2⤵
  PID:8296
- C:\Windows\System\htIWxfm.exe
  C:\Windows\System\htIWxfm.exe
  2⤵
  PID:8376
- C:\Windows\System\DmbkoGG.exe
  C:\Windows\System\DmbkoGG.exe
  2⤵
  PID:8432
- C:\Windows\System\eZdzJtW.exe
  C:\Windows\System\eZdzJtW.exe
  2⤵
  PID:8492
- C:\Windows\System\ZVRSkhf.exe
  C:\Windows\System\ZVRSkhf.exe
  2⤵
  PID:8564
- C:\Windows\System\OtrbSRD.exe
  C:\Windows\System\OtrbSRD.exe
  2⤵
  PID:7976
- C:\Windows\System\vFOjcFo.exe
  C:\Windows\System\vFOjcFo.exe
  2⤵
  PID:8288
- C:\Windows\System\WmJQwvk.exe
  C:\Windows\System\WmJQwvk.exe
  2⤵
  PID:8604
- C:\Windows\System\DgMrPPZ.exe
  C:\Windows\System\DgMrPPZ.exe
  2⤵
  PID:8704
- C:\Windows\System\htSQboN.exe
  C:\Windows\System\htSQboN.exe
  2⤵
  PID:8788
- C:\Windows\System\SNIOVsl.exe
  C:\Windows\System\SNIOVsl.exe
  2⤵
  PID:8888
- C:\Windows\System\FPEyjlf.exe
  C:\Windows\System\FPEyjlf.exe
  2⤵
  PID:8720
- C:\Windows\System\zNDDHtr.exe
  C:\Windows\System\zNDDHtr.exe
  2⤵
  PID:8696
- C:\Windows\System\vwzVnqQ.exe
  C:\Windows\System\vwzVnqQ.exe
  2⤵
  PID:8980
- C:\Windows\System\ZzVEpDY.exe
  C:\Windows\System\ZzVEpDY.exe
  2⤵
  PID:9056
- C:\Windows\System\HahpFfu.exe
  C:\Windows\System\HahpFfu.exe
  2⤵
  PID:9100
- C:\Windows\System\AXaNArX.exe
  C:\Windows\System\AXaNArX.exe
  2⤵
  PID:9200
- C:\Windows\System\avQKbfC.exe
  C:\Windows\System\avQKbfC.exe
  2⤵
  PID:8344
- C:\Windows\System\rQwCyVx.exe
  C:\Windows\System\rQwCyVx.exe
  2⤵
  PID:8464
- C:\Windows\System\gIStgcQ.exe
  C:\Windows\System\gIStgcQ.exe
  2⤵
  PID:8060
- C:\Windows\System\TVhlLuO.exe
  C:\Windows\System\TVhlLuO.exe
  2⤵
  PID:8592
- C:\Windows\System\VAZughn.exe
  C:\Windows\System\VAZughn.exe
  2⤵
  PID:8660
- C:\Windows\System\bktTLlx.exe
  C:\Windows\System\bktTLlx.exe
  2⤵
  PID:8928
- C:\Windows\System\dQhPYSl.exe
  C:\Windows\System\dQhPYSl.exe
  2⤵
  PID:9028
- C:\Windows\System\CyyJTEp.exe
  C:\Windows\System\CyyJTEp.exe
  2⤵
  PID:8292
- C:\Windows\System\hEXHLTy.exe
  C:\Windows\System\hEXHLTy.exe
  2⤵
  PID:8460
- C:\Windows\System\fzqPtju.exe
  C:\Windows\System\fzqPtju.exe
  2⤵
  PID:8868
- C:\Windows\System\VmRYsVK.exe
  C:\Windows\System\VmRYsVK.exe
  2⤵
  PID:8972
- C:\Windows\System\pjPEKjt.exe
  C:\Windows\System\pjPEKjt.exe
  2⤵
  PID:8860
- C:\Windows\System\ZtISTdK.exe
  C:\Windows\System\ZtISTdK.exe
  2⤵
  PID:9180
- C:\Windows\System\aATSavT.exe
  C:\Windows\System\aATSavT.exe
  2⤵
  PID:9224
- C:\Windows\System\RhupJdQ.exe
  C:\Windows\System\RhupJdQ.exe
  2⤵
  PID:9252
- C:\Windows\System\xrjUtla.exe
  C:\Windows\System\xrjUtla.exe
  2⤵
  PID:9292
- C:\Windows\System\HfUqDti.exe
  C:\Windows\System\HfUqDti.exe
  2⤵
  PID:9320
- C:\Windows\System\YZApkXg.exe
  C:\Windows\System\YZApkXg.exe
  2⤵
  PID:9348
- C:\Windows\System\MqKLejp.exe
  C:\Windows\System\MqKLejp.exe
  2⤵
  PID:9368
- C:\Windows\System\iNQJAds.exe
  C:\Windows\System\iNQJAds.exe
  2⤵
  PID:9400
- C:\Windows\System\YcmbNxb.exe
  C:\Windows\System\YcmbNxb.exe
  2⤵
  PID:9428
- C:\Windows\System\qaFLlag.exe
  C:\Windows\System\qaFLlag.exe
  2⤵
  PID:9460
- C:\Windows\System\wKxnOUq.exe
  C:\Windows\System\wKxnOUq.exe
  2⤵
  PID:9484
- C:\Windows\System\VsGmvST.exe
  C:\Windows\System\VsGmvST.exe
  2⤵
  PID:9516
- C:\Windows\System\xkDHXyd.exe
  C:\Windows\System\xkDHXyd.exe
  2⤵
  PID:9540
- C:\Windows\System\IjmgKNg.exe
  C:\Windows\System\IjmgKNg.exe
  2⤵
  PID:9560
- C:\Windows\System\OUwrOvw.exe
  C:\Windows\System\OUwrOvw.exe
  2⤵
  PID:9600
- C:\Windows\System\OTUagQP.exe
  C:\Windows\System\OTUagQP.exe
  2⤵
  PID:9628
- C:\Windows\System\eRHeDMH.exe
  C:\Windows\System\eRHeDMH.exe
  2⤵
  PID:9656
- C:\Windows\System\lSaTskd.exe
  C:\Windows\System\lSaTskd.exe
  2⤵
  PID:9672
- C:\Windows\System\ANvmyyL.exe
  C:\Windows\System\ANvmyyL.exe
  2⤵
  PID:9700
- C:\Windows\System\kjAonRL.exe
  C:\Windows\System\kjAonRL.exe
  2⤵
  PID:9740
- C:\Windows\System\NwDSaWq.exe
  C:\Windows\System\NwDSaWq.exe
  2⤵
  PID:9764
- C:\Windows\System\evZfolP.exe
  C:\Windows\System\evZfolP.exe
  2⤵
  PID:9796
- C:\Windows\System\tzaZMyf.exe
  C:\Windows\System\tzaZMyf.exe
  2⤵
  PID:9816
- C:\Windows\System\ZpepjFz.exe
  C:\Windows\System\ZpepjFz.exe
  2⤵
  PID:9832
- C:\Windows\System\ewFVogB.exe
  C:\Windows\System\ewFVogB.exe
  2⤵
  PID:9860
- C:\Windows\System\lQbWCrZ.exe
  C:\Windows\System\lQbWCrZ.exe
  2⤵
  PID:9884
- C:\Windows\System\xmfhQMb.exe
  C:\Windows\System\xmfhQMb.exe
  2⤵
  PID:9924
- C:\Windows\System\pjocXqE.exe
  C:\Windows\System\pjocXqE.exe
  2⤵
  PID:9956
- C:\Windows\System\FKNnWnN.exe
  C:\Windows\System\FKNnWnN.exe
  2⤵
  PID:9976
- C:\Windows\System\pBtZZLP.exe
  C:\Windows\System\pBtZZLP.exe
  2⤵
  PID:10008
- C:\Windows\System\wBQUrqM.exe
  C:\Windows\System\wBQUrqM.exe
  2⤵
  PID:10040
- C:\Windows\System\qYuuggk.exe
  C:\Windows\System\qYuuggk.exe
  2⤵
  PID:10076
- C:\Windows\System\viaNaUZ.exe
  C:\Windows\System\viaNaUZ.exe
  2⤵
  PID:10100
- C:\Windows\System\kThOurb.exe
  C:\Windows\System\kThOurb.exe
  2⤵
  PID:10136
- C:\Windows\System\bmXceTM.exe
  C:\Windows\System\bmXceTM.exe
  2⤵
  PID:10152
- C:\Windows\System\ApzEDzW.exe
  C:\Windows\System\ApzEDzW.exe
  2⤵
  PID:10172
- C:\Windows\System\ANzjYei.exe
  C:\Windows\System\ANzjYei.exe
  2⤵
  PID:10208
- C:\Windows\System\FOfiXMa.exe
  C:\Windows\System\FOfiXMa.exe
  2⤵
  PID:10224
- C:\Windows\System\HhfeLsP.exe
  C:\Windows\System\HhfeLsP.exe
  2⤵
  PID:9276
- C:\Windows\System\yjtDdcu.exe
  C:\Windows\System\yjtDdcu.exe
  2⤵
  PID:9340
- C:\Windows\System\lSdOXEx.exe
  C:\Windows\System\lSdOXEx.exe
  2⤵
  PID:9408
- C:\Windows\System\VWQXwdv.exe
  C:\Windows\System\VWQXwdv.exe
  2⤵
  PID:9504
- C:\Windows\System\sSdtKzb.exe
  C:\Windows\System\sSdtKzb.exe
  2⤵
  PID:9536
- C:\Windows\System\ybJJIVR.exe
  C:\Windows\System\ybJJIVR.exe
  2⤵
  PID:9620
- C:\Windows\System\GeTgjZn.exe
  C:\Windows\System\GeTgjZn.exe
  2⤵
  PID:9684
- C:\Windows\System\uEFRJKD.exe
  C:\Windows\System\uEFRJKD.exe
  2⤵
  PID:9748
- C:\Windows\System\EeyGvXm.exe
  C:\Windows\System\EeyGvXm.exe
  2⤵
  PID:9812
- C:\Windows\System\xwEZQvo.exe
  C:\Windows\System\xwEZQvo.exe
  2⤵
  PID:9904
- C:\Windows\System\UmkzhRa.exe
  C:\Windows\System\UmkzhRa.exe
  2⤵
  PID:9944
- C:\Windows\System\kFdlJim.exe
  C:\Windows\System\kFdlJim.exe
  2⤵
  PID:10036
- C:\Windows\System\diAlCay.exe
  C:\Windows\System\diAlCay.exe
  2⤵
  PID:10060
- C:\Windows\System\DgwBccI.exe
  C:\Windows\System\DgwBccI.exe
  2⤵
  PID:10128
- C:\Windows\System\CXeAprI.exe
  C:\Windows\System\CXeAprI.exe
  2⤵
  PID:10216
- C:\Windows\System\MuOXHuc.exe
  C:\Windows\System\MuOXHuc.exe
  2⤵
  PID:9264
- C:\Windows\System\aNbTyKT.exe
  C:\Windows\System\aNbTyKT.exe
  2⤵
  PID:9412
- C:\Windows\System\hSormFO.exe
  C:\Windows\System\hSormFO.exe
  2⤵
  PID:9612
- C:\Windows\System\XhMiOYs.exe
  C:\Windows\System\XhMiOYs.exe
  2⤵
  PID:9720
- C:\Windows\System\htxyVKB.exe
  C:\Windows\System\htxyVKB.exe
  2⤵
  PID:9868
- C:\Windows\System\QglVGTq.exe
  C:\Windows\System\QglVGTq.exe
  2⤵
  PID:9892
- C:\Windows\System\xKZJHnV.exe
  C:\Windows\System\xKZJHnV.exe
  2⤵
  PID:10184
- C:\Windows\System\FGwJLKc.exe
  C:\Windows\System\FGwJLKc.exe
  2⤵
  PID:9556
- C:\Windows\System\JukINjn.exe
  C:\Windows\System\JukINjn.exe
  2⤵
  PID:9788
- C:\Windows\System\FOdVmTd.exe
  C:\Windows\System\FOdVmTd.exe
  2⤵
  PID:10088
- C:\Windows\System\xinyzPn.exe
  C:\Windows\System\xinyzPn.exe
  2⤵
  PID:10000
- C:\Windows\System\FkXuQZK.exe
  C:\Windows\System\FkXuQZK.exe
  2⤵
  PID:9508
- C:\Windows\System\QxgRriJ.exe
  C:\Windows\System\QxgRriJ.exe
  2⤵
  PID:10264
- C:\Windows\System\swYRxTt.exe
  C:\Windows\System\swYRxTt.exe
  2⤵
  PID:10280
- C:\Windows\System\hRQbplJ.exe
  C:\Windows\System\hRQbplJ.exe
  2⤵
  PID:10304
- C:\Windows\System\qVcnLHr.exe
  C:\Windows\System\qVcnLHr.exe
  2⤵
  PID:10348
- C:\Windows\System\XjZIVkd.exe
  C:\Windows\System\XjZIVkd.exe
  2⤵
  PID:10368
- C:\Windows\System\oGEaMwn.exe
  C:\Windows\System\oGEaMwn.exe
  2⤵
  PID:10396
- C:\Windows\System\azUNluH.exe
  C:\Windows\System\azUNluH.exe
  2⤵
  PID:10424
- C:\Windows\System\juMSKXW.exe
  C:\Windows\System\juMSKXW.exe
  2⤵
  PID:10456
- C:\Windows\System\VONiijm.exe
  C:\Windows\System\VONiijm.exe
  2⤵
  PID:10480
- C:\Windows\System\vYeVyXv.exe
  C:\Windows\System\vYeVyXv.exe
  2⤵
  PID:10508
- C:\Windows\System\ejpyPoa.exe
  C:\Windows\System\ejpyPoa.exe
  2⤵
  PID:10528
- C:\Windows\System\JBGCjFX.exe
  C:\Windows\System\JBGCjFX.exe
  2⤵
  PID:10552
- C:\Windows\System\zeqdCVi.exe
  C:\Windows\System\zeqdCVi.exe
  2⤵
  PID:10576
- C:\Windows\System\vGAgQNJ.exe
  C:\Windows\System\vGAgQNJ.exe
  2⤵
  PID:10612
- C:\Windows\System\xkegjep.exe
  C:\Windows\System\xkegjep.exe
  2⤵
  PID:10636
- C:\Windows\System\hPadAft.exe
  C:\Windows\System\hPadAft.exe
  2⤵
  PID:10680
- C:\Windows\System\foWVsKx.exe
  C:\Windows\System\foWVsKx.exe
  2⤵
  PID:10704
- C:\Windows\System\wSFtOGC.exe
  C:\Windows\System\wSFtOGC.exe
  2⤵
  PID:10732
- C:\Windows\System\rFGkAke.exe
  C:\Windows\System\rFGkAke.exe
  2⤵
  PID:10760
- C:\Windows\System\GjCYZdl.exe
  C:\Windows\System\GjCYZdl.exe
  2⤵
  PID:10792
- C:\Windows\System\QDABjQl.exe
  C:\Windows\System\QDABjQl.exe
  2⤵
  PID:10820
- C:\Windows\System\GpDHSyX.exe
  C:\Windows\System\GpDHSyX.exe
  2⤵
  PID:10836
- C:\Windows\System\KGgyOVH.exe
  C:\Windows\System\KGgyOVH.exe
  2⤵
  PID:10852
- C:\Windows\System\fmhpCls.exe
  C:\Windows\System\fmhpCls.exe
  2⤵
  PID:10892
- C:\Windows\System\odlGqZc.exe
  C:\Windows\System\odlGqZc.exe
  2⤵
  PID:10920
- C:\Windows\System\EBgcjBq.exe
  C:\Windows\System\EBgcjBq.exe
  2⤵
  PID:10948
- C:\Windows\System\GzWuKKk.exe
  C:\Windows\System\GzWuKKk.exe
  2⤵
  PID:10988
- C:\Windows\System\vgRkCQH.exe
  C:\Windows\System\vgRkCQH.exe
  2⤵
  PID:11020
- C:\Windows\System\icClesA.exe
  C:\Windows\System\icClesA.exe
  2⤵
  PID:11044
- C:\Windows\System\wQqALlq.exe
  C:\Windows\System\wQqALlq.exe
  2⤵
  PID:11080
- C:\Windows\System\nRnxKXt.exe
  C:\Windows\System\nRnxKXt.exe
  2⤵
  PID:11144
- C:\Windows\System\dgDuJYk.exe
  C:\Windows\System\dgDuJYk.exe
  2⤵
  PID:11172
- C:\Windows\System\lKPoUpu.exe
  C:\Windows\System\lKPoUpu.exe
  2⤵
  PID:11188
- C:\Windows\System\UVwiVrR.exe
  C:\Windows\System\UVwiVrR.exe
  2⤵
  PID:11248
- C:\Windows\System\kdUfrhG.exe
  C:\Windows\System\kdUfrhG.exe
  2⤵
  PID:10272
- C:\Windows\System\NxYlJHS.exe
  C:\Windows\System\NxYlJHS.exe
  2⤵
  PID:10316
- C:\Windows\System\IjCNpMO.exe
  C:\Windows\System\IjCNpMO.exe
  2⤵
  PID:10416
- C:\Windows\System\zGZNOIG.exe
  C:\Windows\System\zGZNOIG.exe
  2⤵
  PID:10476
- C:\Windows\System\lNwqWel.exe
  C:\Windows\System\lNwqWel.exe
  2⤵
  PID:10524
- C:\Windows\System\DFXVVwV.exe
  C:\Windows\System\DFXVVwV.exe
  2⤵
  PID:10800
- C:\Windows\System\GFinUyA.exe
  C:\Windows\System\GFinUyA.exe
  2⤵
  PID:10776
- C:\Windows\System\PqEDDWK.exe
  C:\Windows\System\PqEDDWK.exe
  2⤵
  PID:10880
- C:\Windows\System\FerHDjj.exe
  C:\Windows\System\FerHDjj.exe
  2⤵
  PID:10936
- C:\Windows\System\lwthmGm.exe
  C:\Windows\System\lwthmGm.exe
  2⤵
  PID:11000
- C:\Windows\System\THtJkDR.exe
  C:\Windows\System\THtJkDR.exe
  2⤵
  PID:11072
- C:\Windows\System\DIkhQli.exe
  C:\Windows\System\DIkhQli.exe
  2⤵
  PID:11156
- C:\Windows\System\BPGLsJU.exe
  C:\Windows\System\BPGLsJU.exe
  2⤵
  PID:11232
- C:\Windows\System\UvVcUhL.exe
  C:\Windows\System\UvVcUhL.exe
  2⤵
  PID:10412
- C:\Windows\System\GRCySKD.exe
  C:\Windows\System\GRCySKD.exe
  2⤵
  PID:10520
- C:\Windows\System\QutOuTh.exe
  C:\Windows\System\QutOuTh.exe
  2⤵
  PID:10656
- C:\Windows\System\evHZKBs.exe
  C:\Windows\System\evHZKBs.exe
  2⤵
  PID:10844
- C:\Windows\System\EsnvOFO.exe
  C:\Windows\System\EsnvOFO.exe
  2⤵
  PID:10904
- C:\Windows\System\DFiWvxk.exe
  C:\Windows\System\DFiWvxk.exe
  2⤵
  PID:10960
- C:\Windows\System\StVVoos.exe
  C:\Windows\System\StVVoos.exe
  2⤵
  PID:10192
- C:\Windows\System\UPxutGy.exe
  C:\Windows\System\UPxutGy.exe
  2⤵
  PID:10292
- C:\Windows\System\YPDepcY.exe
  C:\Windows\System\YPDepcY.exe
  2⤵
  PID:11288
- C:\Windows\System\SdGUMpv.exe
  C:\Windows\System\SdGUMpv.exe
  2⤵
  PID:11332
- C:\Windows\System\REzIHKI.exe
  C:\Windows\System\REzIHKI.exe
  2⤵
  PID:11376
- C:\Windows\System\YRpVQqT.exe
  C:\Windows\System\YRpVQqT.exe
  2⤵
  PID:11400
- C:\Windows\System\ORANTwN.exe
  C:\Windows\System\ORANTwN.exe
  2⤵
  PID:11428
- C:\Windows\System\UfXLxKQ.exe
  C:\Windows\System\UfXLxKQ.exe
  2⤵
  PID:11464
- C:\Windows\System\ftJPCju.exe
  C:\Windows\System\ftJPCju.exe
  2⤵
  PID:11484
- C:\Windows\System\uNVqjBF.exe
  C:\Windows\System\uNVqjBF.exe
  2⤵
  PID:11524
- C:\Windows\System\eZXlllP.exe
  C:\Windows\System\eZXlllP.exe
  2⤵
  PID:11552
- C:\Windows\System\YBpThaF.exe
  C:\Windows\System\YBpThaF.exe
  2⤵
  PID:11572
- C:\Windows\System\PwAvMEF.exe
  C:\Windows\System\PwAvMEF.exe
  2⤵
  PID:11592
- C:\Windows\System\AjNauAW.exe
  C:\Windows\System\AjNauAW.exe
  2⤵
  PID:11612
- C:\Windows\System\HZbGCnx.exe
  C:\Windows\System\HZbGCnx.exe
  2⤵
  PID:11640
- C:\Windows\System\eCQocor.exe
  C:\Windows\System\eCQocor.exe
  2⤵
  PID:11676
- C:\Windows\System\INCIIvw.exe
  C:\Windows\System\INCIIvw.exe
  2⤵
  PID:11712
- C:\Windows\System\wZRmgVq.exe
  C:\Windows\System\wZRmgVq.exe
  2⤵
  PID:11748
- C:\Windows\System\siutgNP.exe
  C:\Windows\System\siutgNP.exe
  2⤵
  PID:11776
- C:\Windows\System\ERRrdQj.exe
  C:\Windows\System\ERRrdQj.exe
  2⤵
  PID:11804
- C:\Windows\System\eqagspA.exe
  C:\Windows\System\eqagspA.exe
  2⤵
  PID:11820
- C:\Windows\System\XAduMCb.exe
  C:\Windows\System\XAduMCb.exe
  2⤵
  PID:11848
- C:\Windows\System\eDcuBbW.exe
  C:\Windows\System\eDcuBbW.exe
  2⤵
  PID:11876
- C:\Windows\System\iihptfw.exe
  C:\Windows\System\iihptfw.exe
  2⤵
  PID:11932
- C:\Windows\System\bbImkwt.exe
  C:\Windows\System\bbImkwt.exe
  2⤵
  PID:11948
- C:\Windows\System\FOFbpLw.exe
  C:\Windows\System\FOFbpLw.exe
  2⤵
  PID:11964
- C:\Windows\System\bXORWvd.exe
  C:\Windows\System\bXORWvd.exe
  2⤵
  PID:11992
- C:\Windows\System\ZGnCKcq.exe
  C:\Windows\System\ZGnCKcq.exe
  2⤵
  PID:12024
- C:\Windows\System\JDZhahG.exe
  C:\Windows\System\JDZhahG.exe
  2⤵
  PID:12048
- C:\Windows\System\kyJQCUu.exe
  C:\Windows\System\kyJQCUu.exe
  2⤵
  PID:12080
- C:\Windows\System\MaQoQud.exe
  C:\Windows\System\MaQoQud.exe
  2⤵
  PID:12116
- C:\Windows\System\vMVdMTy.exe
  C:\Windows\System\vMVdMTy.exe
  2⤵
  PID:12148
- C:\Windows\System\DBAAVPJ.exe
  C:\Windows\System\DBAAVPJ.exe
  2⤵
  PID:12164
- C:\Windows\System\rIBwFMb.exe
  C:\Windows\System\rIBwFMb.exe
  2⤵
  PID:12188
- C:\Windows\System\EyUZufN.exe
  C:\Windows\System\EyUZufN.exe
  2⤵
  PID:12220
- C:\Windows\System\KhjSbMR.exe
  C:\Windows\System\KhjSbMR.exe
  2⤵
  PID:12252
- C:\Windows\System\lrrlBrW.exe
  C:\Windows\System\lrrlBrW.exe
  2⤵
  PID:11128
- C:\Windows\System\aRvfZVR.exe
  C:\Windows\System\aRvfZVR.exe
  2⤵
  PID:10808
- C:\Windows\System\noXuqLw.exe
  C:\Windows\System\noXuqLw.exe
  2⤵
  PID:11280
- C:\Windows\System\IxZLxwJ.exe
  C:\Windows\System\IxZLxwJ.exe
  2⤵
  PID:11388
- C:\Windows\System\YxYzpRO.exe
  C:\Windows\System\YxYzpRO.exe
  2⤵
  PID:11420
- C:\Windows\System\gOrmEcJ.exe
  C:\Windows\System\gOrmEcJ.exe
  2⤵
  PID:11480
- C:\Windows\System\PwFvlRU.exe
  C:\Windows\System\PwFvlRU.exe
  2⤵
  PID:11568
- C:\Windows\System\OHESqnT.exe
  C:\Windows\System\OHESqnT.exe
  2⤵
  PID:11604
- C:\Windows\System\ZlzzkZV.exe
  C:\Windows\System\ZlzzkZV.exe
  2⤵
  PID:11668
- C:\Windows\System\rDCllvI.exe
  C:\Windows\System\rDCllvI.exe
  2⤵
  PID:11744
- C:\Windows\System\CDIkKfW.exe
  C:\Windows\System\CDIkKfW.exe
  2⤵
  PID:11812
- C:\Windows\System\BhujKPV.exe
  C:\Windows\System\BhujKPV.exe
  2⤵
  PID:11892
- C:\Windows\System\efLbeZA.exe
  C:\Windows\System\efLbeZA.exe
  2⤵
  PID:11944
- C:\Windows\System\JfxSdbs.exe
  C:\Windows\System\JfxSdbs.exe
  2⤵
  PID:12008
- C:\Windows\System\siGIkww.exe
  C:\Windows\System\siGIkww.exe
  2⤵
  PID:12060
- C:\Windows\System\qnUbOkz.exe
  C:\Windows\System\qnUbOkz.exe
  2⤵
  PID:12156
- C:\Windows\System\DHgLTPJ.exe
  C:\Windows\System\DHgLTPJ.exe
  2⤵
  PID:12180
- C:\Windows\System\nPkljWO.exe
  C:\Windows\System\nPkljWO.exe
  2⤵
  PID:12240
- C:\Windows\System\heOEYgg.exe
  C:\Windows\System\heOEYgg.exe
  2⤵
  PID:11340
- C:\Windows\System\Beuvjiz.exe
  C:\Windows\System\Beuvjiz.exe
  2⤵
  PID:11476
- C:\Windows\System\tgeJegB.exe
  C:\Windows\System\tgeJegB.exe
  2⤵
  PID:11664
- C:\Windows\System\KTvwExY.exe
  C:\Windows\System\KTvwExY.exe
  2⤵
  PID:11864
- C:\Windows\System\kyzJFNa.exe
  C:\Windows\System\kyzJFNa.exe
  2⤵
  PID:11912
- C:\Windows\System\wTabMTy.exe
  C:\Windows\System\wTabMTy.exe
  2⤵
  PID:12140
- C:\Windows\System\YMlFyrR.exe
  C:\Windows\System\YMlFyrR.exe
  2⤵
  PID:12264
- C:\Windows\System\nVtsJsJ.exe
  C:\Windows\System\nVtsJsJ.exe
  2⤵
  PID:2260
- C:\Windows\System\SVeYrNo.exe
  C:\Windows\System\SVeYrNo.exe
  2⤵
  PID:11708
- C:\Windows\System\eNwmCGc.exe
  C:\Windows\System\eNwmCGc.exe
  2⤵
  PID:11956
- C:\Windows\System\KnyWIbb.exe
  C:\Windows\System\KnyWIbb.exe
  2⤵
  PID:11416
- C:\Windows\System\wFsTISC.exe
  C:\Windows\System\wFsTISC.exe
  2⤵
  PID:12072
- C:\Windows\System\sdaytQa.exe
  C:\Windows\System\sdaytQa.exe
  2⤵
  PID:1560
- C:\Windows\System\SMqdsjf.exe
  C:\Windows\System\SMqdsjf.exe
  2⤵
  PID:12332
- C:\Windows\System\eWzpqoZ.exe
  C:\Windows\System\eWzpqoZ.exe
  2⤵
  PID:12368
- C:\Windows\System\hjVNenA.exe
  C:\Windows\System\hjVNenA.exe
  2⤵
  PID:12404
- C:\Windows\System\wMBfKpz.exe
  C:\Windows\System\wMBfKpz.exe
  2⤵
  PID:12440
- C:\Windows\System\BnNklbl.exe
  C:\Windows\System\BnNklbl.exe
  2⤵
  PID:12464
- C:\Windows\System\UChcebR.exe
  C:\Windows\System\UChcebR.exe
  2⤵
  PID:12484
- C:\Windows\System\UFJQaBo.exe
  C:\Windows\System\UFJQaBo.exe
  2⤵
  PID:12516
- C:\Windows\System\NxSosja.exe
  C:\Windows\System\NxSosja.exe
  2⤵
  PID:12548
- C:\Windows\System\JXbVMDk.exe
  C:\Windows\System\JXbVMDk.exe
  2⤵
  PID:12564
- C:\Windows\System\XVKqWEK.exe
  C:\Windows\System\XVKqWEK.exe
  2⤵
  PID:12580
- C:\Windows\System\HKfIEJd.exe
  C:\Windows\System\HKfIEJd.exe
  2⤵
  PID:12608
- C:\Windows\System\dsrnYWb.exe
  C:\Windows\System\dsrnYWb.exe
  2⤵
  PID:12648
- C:\Windows\System\XGuaDWR.exe
  C:\Windows\System\XGuaDWR.exe
  2⤵
  PID:12688
- C:\Windows\System\mvAqdGD.exe
  C:\Windows\System\mvAqdGD.exe
  2⤵
  PID:12740
- C:\Windows\System\qsJVfnd.exe
  C:\Windows\System\qsJVfnd.exe
  2⤵
  PID:12760
- C:\Windows\System\ZBVsAzH.exe
  C:\Windows\System\ZBVsAzH.exe
  2⤵
  PID:12784
- C:\Windows\System\KbGZiWV.exe
  C:\Windows\System\KbGZiWV.exe
  2⤵
  PID:12808
- C:\Windows\System\PicYWGu.exe
  C:\Windows\System\PicYWGu.exe
  2⤵
  PID:12836
- C:\Windows\System\OVJRjCZ.exe
  C:\Windows\System\OVJRjCZ.exe
  2⤵
  PID:12872
- C:\Windows\System\cVwAvDN.exe
  C:\Windows\System\cVwAvDN.exe
  2⤵
  PID:12900
- C:\Windows\System\zilxywS.exe
  C:\Windows\System\zilxywS.exe
  2⤵
  PID:12932
- C:\Windows\System\jDMeALm.exe
  C:\Windows\System\jDMeALm.exe
  2⤵
  PID:12956
- C:\Windows\System\rwPwuqm.exe
  C:\Windows\System\rwPwuqm.exe
  2⤵
  PID:12980
- C:\Windows\System\QdxbNPn.exe
  C:\Windows\System\QdxbNPn.exe
  2⤵
  PID:13008
- C:\Windows\System\WKoigrO.exe
  C:\Windows\System\WKoigrO.exe
  2⤵
  PID:13044
- C:\Windows\System\AQcaJye.exe
  C:\Windows\System\AQcaJye.exe
  2⤵
  PID:13068
- C:\Windows\System\SFzHyVx.exe
  C:\Windows\System\SFzHyVx.exe
  2⤵
  PID:13084
- C:\Windows\System\rmoCCuF.exe
  C:\Windows\System\rmoCCuF.exe
  2⤵
  PID:13108
- C:\Windows\System\vGkCpDQ.exe
  C:\Windows\System\vGkCpDQ.exe
  2⤵
  PID:13140
- C:\Windows\System\KtyCZQx.exe
  C:\Windows\System\KtyCZQx.exe
  2⤵
  PID:13168
- C:\Windows\System\KunrmpD.exe
  C:\Windows\System\KunrmpD.exe
  2⤵
  PID:13212
- C:\Windows\System\fojxXqs.exe
  C:\Windows\System\fojxXqs.exe
  2⤵
  PID:13248
- C:\Windows\System\ATepdfg.exe
  C:\Windows\System\ATepdfg.exe
  2⤵
  PID:13276
- C:\Windows\System\LvlvGVV.exe
  C:\Windows\System\LvlvGVV.exe
  2⤵
  PID:13292
- C:\Windows\System\dCtFyug.exe
  C:\Windows\System\dCtFyug.exe
  2⤵
  PID:11536
- C:\Windows\System\UDMjABy.exe
  C:\Windows\System\UDMjABy.exe
  2⤵
  PID:12308
- C:\Windows\System\nymSAmz.exe
  C:\Windows\System\nymSAmz.exe
  2⤵
  PID:12388
- C:\Windows\System\jSXCsFw.exe
  C:\Windows\System\jSXCsFw.exe
  2⤵
  PID:12448
- C:\Windows\System\nJElxAi.exe
  C:\Windows\System\nJElxAi.exe
  2⤵
  PID:12500
- C:\Windows\System\fsKQmHT.exe
  C:\Windows\System\fsKQmHT.exe
  2⤵
  PID:12560
- C:\Windows\System\BuqwyCT.exe
  C:\Windows\System\BuqwyCT.exe
  2⤵
  PID:12628
- C:\Windows\System\omwpRGC.exe
  C:\Windows\System\omwpRGC.exe
  2⤵
  PID:12732
- C:\Windows\System\MgHnfud.exe
  C:\Windows\System\MgHnfud.exe
  2⤵
  PID:11732
- C:\Windows\System\ZJVuxWq.exe
  C:\Windows\System\ZJVuxWq.exe
  2⤵
  PID:12800
- C:\Windows\System\ybtxPEV.exe
  C:\Windows\System\ybtxPEV.exe
  2⤵
  PID:12880
- C:\Windows\System\MquBkac.exe
  C:\Windows\System\MquBkac.exe
  2⤵
  PID:12964
- C:\Windows\System\CmDgTyT.exe
  C:\Windows\System\CmDgTyT.exe
  2⤵
  PID:12064
- C:\Windows\System\wrAfoVY.exe
  C:\Windows\System\wrAfoVY.exe
  2⤵
  PID:13060
- C:\Windows\System\aQHCtKw.exe
  C:\Windows\System\aQHCtKw.exe
  2⤵
  PID:13124
- C:\Windows\System\JdbgeDV.exe
  C:\Windows\System\JdbgeDV.exe
  2⤵
  PID:13220
- C:\Windows\System\giqWsNs.exe
  C:\Windows\System\giqWsNs.exe
  2⤵
  PID:2268
- C:\Windows\System\xxFluWL.exe
  C:\Windows\System\xxFluWL.exe
  2⤵
  PID:13288
- C:\Windows\System\xPazIod.exe
  C:\Windows\System\xPazIod.exe
  2⤵
  PID:12300
- C:\Windows\System\JwlHWkt.exe
  C:\Windows\System\JwlHWkt.exe
  2⤵
  PID:12540
- C:\Windows\System\McGSawV.exe
  C:\Windows\System\McGSawV.exe
  2⤵
  PID:12604
- C:\Windows\System\iEQKuyj.exe
  C:\Windows\System\iEQKuyj.exe
  2⤵
  PID:12768
- C:\Windows\System\cdfwvgL.exe
  C:\Windows\System\cdfwvgL.exe
  2⤵
  PID:12856
- C:\Windows\System\dejxoSN.exe
  C:\Windows\System\dejxoSN.exe
  2⤵
  PID:13156
- C:\Windows\System\ESQztzB.exe
  C:\Windows\System\ESQztzB.exe
  2⤵
  PID:13200
- C:\Windows\System\egPHCcq.exe
  C:\Windows\System\egPHCcq.exe
  2⤵
  PID:12392
- C:\Windows\System\HJEYkek.exe
  C:\Windows\System\HJEYkek.exe
  2⤵
  PID:12664
- C:\Windows\System\ZjsPkqw.exe
  C:\Windows\System\ZjsPkqw.exe
  2⤵
  PID:12852
- C:\Windows\System\JDhlBVb.exe
  C:\Windows\System\JDhlBVb.exe
  2⤵
  PID:13116
- C:\Windows\System\fVydrBO.exe
  C:\Windows\System\fVydrBO.exe
  2⤵
  PID:12508
- C:\Windows\System\pFmqtDh.exe
  C:\Windows\System\pFmqtDh.exe
  2⤵
  PID:13316
- C:\Windows\System\JXNsVNS.exe
  C:\Windows\System\JXNsVNS.exe
  2⤵
  PID:13340
- C:\Windows\System\ajgghPq.exe
  C:\Windows\System\ajgghPq.exe
  2⤵
  PID:13380
- C:\Windows\System\LMAagAJ.exe
  C:\Windows\System\LMAagAJ.exe
  2⤵
  PID:13408
- C:\Windows\System\LFCeDfu.exe
  C:\Windows\System\LFCeDfu.exe
  2⤵
  PID:13424
- C:\Windows\System\ZKhVgYi.exe
  C:\Windows\System\ZKhVgYi.exe
  2⤵
  PID:13444
- C:\Windows\System\wujQYlG.exe
  C:\Windows\System\wujQYlG.exe
  2⤵
  PID:13480
- C:\Windows\System\zkabkZM.exe
  C:\Windows\System\zkabkZM.exe
  2⤵
  PID:13508
- C:\Windows\System\IURaVsI.exe
  C:\Windows\System\IURaVsI.exe
  2⤵
  PID:13540
- C:\Windows\System\davTHqf.exe
  C:\Windows\System\davTHqf.exe
  2⤵
  PID:13576
- C:\Windows\System\gQsWPWH.exe
  C:\Windows\System\gQsWPWH.exe
  2⤵
  PID:13616
- C:\Windows\System\YJRNxMl.exe
  C:\Windows\System\YJRNxMl.exe
  2⤵
  PID:13632
- C:\Windows\System\FOChVfn.exe
  C:\Windows\System\FOChVfn.exe
  2⤵
  PID:13660
- C:\Windows\System\oLLkrtz.exe
  C:\Windows\System\oLLkrtz.exe
  2⤵
  PID:13688
- C:\Windows\System\uzbSVvV.exe
  C:\Windows\System\uzbSVvV.exe
  2⤵
  PID:13720
- C:\Windows\System\hvriNLo.exe
  C:\Windows\System\hvriNLo.exe
  2⤵
  PID:13744
- C:\Windows\System\ePuqnpJ.exe
  C:\Windows\System\ePuqnpJ.exe
  2⤵
  PID:13764
- C:\Windows\System\FtvyPhP.exe
  C:\Windows\System\FtvyPhP.exe
  2⤵
  PID:13796
- C:\Windows\System\FIZMKdW.exe
  C:\Windows\System\FIZMKdW.exe
  2⤵
  PID:13820
- C:\Windows\System\kUKQEWk.exe
  C:\Windows\System\kUKQEWk.exe
  2⤵
  PID:13856
- C:\Windows\System\daYALXB.exe
  C:\Windows\System\daYALXB.exe
  2⤵
  PID:13896
- C:\Windows\System\RGALmnq.exe
  C:\Windows\System\RGALmnq.exe
  2⤵
  PID:13920
- C:\Windows\System\dfLriIJ.exe
  C:\Windows\System\dfLriIJ.exe
  2⤵
  PID:13952
- C:\Windows\System\crJuNkb.exe
  C:\Windows\System\crJuNkb.exe
  2⤵
  PID:13976
- C:\Windows\System\ewkzkCY.exe
  C:\Windows\System\ewkzkCY.exe
  2⤵
  PID:14008
- C:\Windows\System\MjVlLGd.exe
  C:\Windows\System\MjVlLGd.exe
  2⤵
  PID:14024
- C:\Windows\System\eXepWuG.exe
  C:\Windows\System\eXepWuG.exe
  2⤵
  PID:14052
- C:\Windows\System\LayGHAV.exe
  C:\Windows\System\LayGHAV.exe
  2⤵
  PID:14068
- C:\Windows\System\htRVADe.exe
  C:\Windows\System\htRVADe.exe
  2⤵
  PID:14096
- C:\Windows\System\gHziCBk.exe
  C:\Windows\System\gHziCBk.exe
  2⤵
  PID:14128
- C:\Windows\System\isjYTNk.exe
  C:\Windows\System\isjYTNk.exe
  2⤵
  PID:14176
- C:\Windows\System\OqaEJGZ.exe
  C:\Windows\System\OqaEJGZ.exe
  2⤵
  PID:14192
- C:\Windows\System\grEkhLd.exe
  C:\Windows\System\grEkhLd.exe
  2⤵
  PID:14232
- C:\Windows\System\unsmjZl.exe
  C:\Windows\System\unsmjZl.exe
  2⤵
  PID:14256
- C:\Windows\System\ouXiUDl.exe
  C:\Windows\System\ouXiUDl.exe
  2⤵
  PID:14276
- C:\Windows\System\hsmZSik.exe
  C:\Windows\System\hsmZSik.exe
  2⤵
  PID:14304
- C:\Windows\System\HUZDSfQ.exe
  C:\Windows\System\HUZDSfQ.exe
  2⤵
  PID:14324
- C:\Windows\System\lBpMsig.exe
  C:\Windows\System\lBpMsig.exe
  2⤵
  PID:13324
- C:\Windows\System\zkLxdra.exe
  C:\Windows\System\zkLxdra.exe
  2⤵
  PID:13364
- C:\Windows\System\bScYZJP.exe
  C:\Windows\System\bScYZJP.exe
  2⤵
  PID:13464
- C:\Windows\System\kxEdfWQ.exe
  C:\Windows\System\kxEdfWQ.exe
  2⤵
  PID:13524
- C:\Windows\System\wUPcKJH.exe
  C:\Windows\System\wUPcKJH.exe
  2⤵
  PID:13572
- C:\Windows\System\xstlXdD.exe
  C:\Windows\System\xstlXdD.exe
  2⤵
  PID:13612
- C:\Windows\System\AEVMgve.exe
  C:\Windows\System\AEVMgve.exe
  2⤵
  PID:13656
- C:\Windows\System\dlxGCZK.exe
  C:\Windows\System\dlxGCZK.exe
  2⤵
  PID:13700
- C:\Windows\System\GHgTqcp.exe
  C:\Windows\System\GHgTqcp.exe
  2⤵
  PID:13776
- C:\Windows\System\ReostXK.exe
  C:\Windows\System\ReostXK.exe
  2⤵
  PID:13812
- C:\Windows\System\YqqpmHz.exe
  C:\Windows\System\YqqpmHz.exe
  2⤵
  PID:13876
- C:\Windows\System\sndhMlc.exe
  C:\Windows\System\sndhMlc.exe
  2⤵
  PID:3932
- C:\Windows\System\vTUTweR.exe
  C:\Windows\System\vTUTweR.exe
  2⤵
  PID:6276
- C:\Windows\System\sAUvGmA.exe
  C:\Windows\System\sAUvGmA.exe
  2⤵
  PID:5676
- C:\Windows\System\zMqEiSe.exe
  C:\Windows\System\zMqEiSe.exe
  2⤵
  PID:14044
- C:\Windows\System\pgwohZA.exe
  C:\Windows\System\pgwohZA.exe
  2⤵
  PID:14080
- C:\Windows\System\lNjqmwU.exe
  C:\Windows\System\lNjqmwU.exe
  2⤵
  PID:14148
- C:\Windows\System\HdXlYBx.exe
  C:\Windows\System\HdXlYBx.exe
  2⤵
  PID:14208
- C:\Windows\System\khuapjf.exe
  C:\Windows\System\khuapjf.exe
  2⤵
  PID:14248
- C:\Windows\System\oFYsvKi.exe
  C:\Windows\System\oFYsvKi.exe
  2⤵
  PID:2920
- C:\Windows\System\wkLbJPg.exe
  C:\Windows\System\wkLbJPg.exe
  2⤵
  PID:13332
- C:\Windows\System\nVKmaeX.exe
  C:\Windows\System\nVKmaeX.exe
  2⤵
  PID:13416
- C:\Windows\System\zWWHNKc.exe
  C:\Windows\System\zWWHNKc.exe
  2⤵
  PID:13628
- C:\Windows\System\FlCwFBw.exe
  C:\Windows\System\FlCwFBw.exe
  2⤵
  PID:1396
- C:\Windows\System\bTlwSaU.exe
  C:\Windows\System\bTlwSaU.exe
  2⤵
  PID:4800
- C:\Windows\System\QaltlWL.exe
  C:\Windows\System\QaltlWL.exe
  2⤵
  PID:5744
- C:\Windows\System\tDlsNjR.exe
  C:\Windows\System\tDlsNjR.exe
  2⤵
  PID:14088
- C:\Windows\System\XhHXbrF.exe
  C:\Windows\System\XhHXbrF.exe
  2⤵
  PID:14184
- C:\Windows\System\YqBZLQk.exe
  C:\Windows\System\YqBZLQk.exe
  2⤵
  PID:4924
- C:\Windows\System\qOsiRty.exe
  C:\Windows\System\qOsiRty.exe
  2⤵
  PID:13536
- C:\Windows\System\rdObpiX.exe
  C:\Windows\System\rdObpiX.exe
  2⤵
  PID:13600
- C:\Windows\System\SXcxUNg.exe
  C:\Windows\System\SXcxUNg.exe
  2⤵
  PID:13940
- C:\Windows\System\tIaxSpC.exe
  C:\Windows\System\tIaxSpC.exe
  2⤵
  PID:14160
- C:\Windows\System\MjcFizd.exe
  C:\Windows\System\MjcFizd.exe
  2⤵
  PID:13432
- C:\Windows\System\wxmltTE.exe
  C:\Windows\System\wxmltTE.exe
  2⤵
  PID:14312
- C:\Windows\System\SwGnKiz.exe
  C:\Windows\System\SwGnKiz.exe
  2⤵
  PID:13732
- C:\Windows\System\nYxZfHX.exe
  C:\Windows\System\nYxZfHX.exe
  2⤵
  PID:14364
- C:\Windows\System\dlavznO.exe
  C:\Windows\System\dlavznO.exe
  2⤵
  PID:14404
- C:\Windows\System\UCKAmdk.exe
  C:\Windows\System\UCKAmdk.exe
  2⤵
  PID:14432
- C:\Windows\System\dvvmOmN.exe
  C:\Windows\System\dvvmOmN.exe
  2⤵
  PID:14460
- C:\Windows\System\ZyGCKSS.exe
  C:\Windows\System\ZyGCKSS.exe
  2⤵
  PID:14476
- C:\Windows\System\vgTxeOA.exe
  C:\Windows\System\vgTxeOA.exe
  2⤵
  PID:14492
- C:\Windows\System\sPiEnDs.exe
  C:\Windows\System\sPiEnDs.exe
  2⤵
  PID:14512
- C:\Windows\System\OBLDBUo.exe
  C:\Windows\System\OBLDBUo.exe
  2⤵
  PID:14552
- C:\Windows\System\siByWjd.exe
  C:\Windows\System\siByWjd.exe
  2⤵
  PID:14604
- C:\Windows\System\edgLXqd.exe
  C:\Windows\System\edgLXqd.exe
  2⤵
  PID:14620
- C:\Windows\System\kImxkHz.exe
  C:\Windows\System\kImxkHz.exe
  2⤵
  PID:14660
- C:\Windows\System\wrRgchf.exe
  C:\Windows\System\wrRgchf.exe
  2⤵
  PID:14676
- C:\Windows\System\nvtbtvc.exe
  C:\Windows\System\nvtbtvc.exe
  2⤵
  PID:14704
- C:\Windows\System\ggZPIkP.exe
  C:\Windows\System\ggZPIkP.exe
  2⤵
  PID:14828
- C:\Windows\System\aKiEIIe.exe
  C:\Windows\System\aKiEIIe.exe
  2⤵
  PID:14844
- C:\Windows\System\exVSNKU.exe
  C:\Windows\System\exVSNKU.exe
  2⤵
  PID:14864
- C:\Windows\System\digaKMo.exe
  C:\Windows\System\digaKMo.exe
  2⤵
  PID:14888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AjpEznY.exe

Filesize
2.7MB

MD5
02e904237927d2450b5ac32f27a64d0f

SHA1
da0948368a97c71b19edb66f92ed510decad808a

SHA256
55da5991529efd6e5d234a23873a275a724e3e92f4d8d58c50716f9cb4e85e50

SHA512
94cd5f89c0292c745bbb9847a0e27e96f016b08418143cc5d704b735d06b853491125ef82823e6f05aeeeeadb4aa329fd884bdfbbd6fdf0f9d51d8b061fdef40

Download Submit
C:\Windows\System\BSblSFK.exe

Filesize
2.7MB

MD5
603a768d13e651d3b7f190cb43feed49

SHA1
25b80065e30eee15a5fe56eeeddeb453a539a848

SHA256
b6b25a63c2950a01dac34dac5d6040257016e167862c2f794d515d3e7bf6c544

SHA512
f842f60da20dccb351f5e199cee13d4350efdf88a5b97aa2b85791b2f33cc9769afddb7a7b87a2d1c64d44b950346d850af596b0d6ecf15b28be07063d4cbdba

Download Submit
C:\Windows\System\DdPwjrx.exe

Filesize
2.7MB

MD5
070fa78f693a0256da27d69313ca5b10

SHA1
cb9f0d18b5b1d90667bb3723c8be0378bf851874

SHA256
72843d544d689f202f1a9669fb9839ec8f7683904defaab3ae5745652b87bf9e

SHA512
a32ff9301598bc2ecb2d14c196c0c57b7ce0988cab4c6460b802bf8209a23f9f098cf0a0372772727c40d03c239b73f6d6631fc23e9b96edfb383515c5579564

Download Submit
C:\Windows\System\ELGdGad.exe

Filesize
2.7MB

MD5
5e88e14c4242d3c9e22c0efad1503978

SHA1
8ba42ddecf702289bfed66adac96d72ac090c715

SHA256
0651cc0521d086e1b7dbc21d6572152cd1cab41e7785a6ebdd37f56a8d769fbf

SHA512
b74d6c44fd79c87f10277357cbcd7bc7ad2152f04b1d73939c71e9ad8ed1f67ac2e8c607b69b62e2186aa99113d86a26400edac06df8aabde888b4f077736561

Download Submit
C:\Windows\System\EWUuYlu.exe

Filesize
2.7MB

MD5
cae9cf63d9f2ea9c91b277c2f05897d5

SHA1
4896e04568df6318172ad125f92096f77bbcb834

SHA256
9d253631e21275dc1d1e693eed5836426235b1cd616b7b34d08bc88c1cba245c

SHA512
3694e66499966e4ed6bf089cd9897938aea88224325d3c925e86047da4a81f0e5a2fd35b5766a78a2504af6d66aee05b1172f473506fbbc3ceabd29b862e8042

Download Submit
C:\Windows\System\FCdCRiW.exe

Filesize
2.7MB

MD5
827f77a76215557eefceb37339a1cdb3

SHA1
58999f925d71d7ee705b4184e945fb00cd55da39

SHA256
7493ad8a3c79ea992c48c118fd473620e462d071d8a9cbfdcc65705422b79fb0

SHA512
09636cd857d9dcffe72a00426f15885f35e157f32a60d1a28733fde14c4d60f16f39f430fcebddd5043b689eb4126d00e1df8d457158a281ba1c493ee19ce110

Download Submit
C:\Windows\System\FEkZHJd.exe

Filesize
2.7MB

MD5
4149980678e5f2b5ab0b93c3776fc9c7

SHA1
3849cab7d21b75c913dc9e0de32952c86321d61e

SHA256
0b24757c966c19e2396736231875e8b880e92a76f586e8b1033cedfa40b83572

SHA512
8d432844efb6989db8e3345ca9353d1621cc437b1c6c8c4e4fe530c311c1ca041ed4462a78569f5f1d1d20110dd56c1a0e491f054f0c7bd464acd5d3cbd45e81

Download Submit
C:\Windows\System\GDcqYfL.exe

Filesize
2.7MB

MD5
3438d4f2d1cf0bf6995852ed4a8f66af

SHA1
496ab33a55708196cdc05fb980bb0659f032e04e

SHA256
57668573773b3f1b72c5dcda41bb900bcceaf3ee12c1cb36133ec9ac0985bcee

SHA512
0a9b429ca20fd996037f5f723bd7e1848041b4133a80ea4537463dc1d6d472a6fd214f3f098eae7a91ffea3d0d81d40d3eb6028b5ebe767409fc98f9a4412ba7

Download Submit
C:\Windows\System\HoyIZfU.exe

Filesize
2.7MB

MD5
8196a5a4b9a01559a4f1d040149a33dc

SHA1
be75dafd44740f3d614247acdf406b3c23b8030f

SHA256
a202bfcdc1c51d9a7679a64395cc980ef4a0720ba99a0ba47c5d8ba300b5cc65

SHA512
c715cbaa456e658585581bc4bfa2a1b8a90757881a28e968b54ec1a159a737cf635c0fe4929c44fd8d977213866b436f9e3318176b8dd3d4803ed61736a0a0e4

Download Submit
C:\Windows\System\KYkePVr.exe

Filesize
2.7MB

MD5
8d41e24ef7e8e69ac95bc7b05674ba4d

SHA1
78529f87494c2852a2eb7aa6646515787569a8bd

SHA256
efd2b03bdba61f67a78f1350a075b4dd4ad46494f6dfbe7322f8b6546f28aa75

SHA512
db5922c0e4e0e04a29d5cdea79313d6b68e030ae08dcd67524be9b6054fba8c159eace7348f062f829e60c87c3a917d4a33a03006cd982b0cb9958af2a5a5215

Download Submit
C:\Windows\System\LoAVsri.exe

Filesize
2.7MB

MD5
0bf4b0ed80583204edf3c78db8dbb9a5

SHA1
f6ead65a2731aba253cacce131e9596a2e8e7fd3

SHA256
6501d837e4c226d60acf3e931fb98d3259fc339abb9f90f219cea2cb45b9da8c

SHA512
13b4b1d4e6f035b9a050a224c16a8060067e22fb70399c66e588622e30d5bf8121b71f11d196cdb51f196363b8a8e8b340863a2695c4d225df17892a706c5bd4

Download Submit
C:\Windows\System\OiCEPca.exe

Filesize
2.7MB

MD5
3b568a93832146820abb043ed7502abc

SHA1
6b43a95abcce3082fe6b77b9ccc0cb245416be04

SHA256
5c4d176d355afd041fde229029d025ba76427d942e72e63a3c468a8ae6008c8f

SHA512
d123e4bb6efa02940d27915504d769375db3ca8de947c7197ff0108b1f6fe89bdd9b3c97ea5b6bca8da9492b9a7a14dd659139df0619e8bed520d8830db3fffd

Download Submit
C:\Windows\System\QCvcTXH.exe

Filesize
2.7MB

MD5
291e74399f2980c773bf8078930d2696

SHA1
4028df14366dec6c152986e570bf60ffb9aa1a77

SHA256
20f86d2ea6e5945e2dde60c4d9f312251f087856a5ad653c59cba699736be28e

SHA512
2dfe00de063f595fc871d232725abc60888e2eb4700b58401d151e071cfab44e7801571a185583bb96c35a9d2375a42a79516222f723bb19082d3bd0006ea0f8

Download Submit
C:\Windows\System\RHlONUN.exe

Filesize
2.7MB

MD5
2a17d3a9bbf0fd5603187cc668355931

SHA1
46f99a9fc0ea97d785d97bbea26a6df1d12dc9f2

SHA256
39addf7a1824a24dccb9312350a8f39fe23649d64b17fac1ece573161ffedd9a

SHA512
3affc74fb83ccdb7c78075bcc59c1c9daeca168dc4fd8464d8ae24aaab4ab68a1543c60a95a2e0d5152b8e04eb70efb1fb2e780a3eddc2bb20667a91407b1ebf

Download Submit
C:\Windows\System\RoYUbjz.exe

Filesize
2.7MB

MD5
9ca528684419da6f6d1847ae506e3d70

SHA1
aec8270dae3791890db5c3ef7d2c78e0f09a9cc5

SHA256
d130a127f0e6d0b6e90f6895cd409c34cc1838908f067d9d0a381fbc98f82f99

SHA512
00a5f685d70eebd410fc5797e8c900817d2ffdc14581498580d3f94505a29058be0c66a452efc1d4e8c88b5f8537dd83910ce0d68ddd7b2beabac329b9b99bfb

Download Submit
C:\Windows\System\WTWqvww.exe

Filesize
2.7MB

MD5
9133c310a6f7ecae3094dc515d17622b

SHA1
b9b9b9e2662157567fe30204b0c54e5f29d3d49e

SHA256
ea2905319bf6c4e851a0758d370f0a03245e14f73df729d141d51ad53cd0d1a0

SHA512
e90d8a37d129b4042ac51ca19d1956db3fd939a02198d056ffad665b6bc2f406e82b59b1d21e1e5eafd6c07fa924228c16e8f6f36cc52323fea044b6f2532f78

Download Submit
C:\Windows\System\XoSLEJf.exe

Filesize
2.7MB

MD5
b1bf9900cea3d660c050fb550b17f387

SHA1
d345cc871266e072c1dccccc2db96e41d185addb

SHA256
3be34cc951f666c5a3cfa13938f8229cc96c01652833504e8c216acd779d89cb

SHA512
f518ed87058beb361ac09de29b2561187ec7fffad0468448af2294a3072b40a7f1e96e37ee3cc9c50fe704668f9300c12040fe503b44abfc20d9982821e0782a

Download Submit
C:\Windows\System\ZxmRhyi.exe

Filesize
2.7MB

MD5
3df5e9dd60e1b5849405018b5ecb92ee

SHA1
3447378e4423432e0223f6d83c13bd91404858d2

SHA256
cb9cfaa88257735ddb8894726654004ece68a2ebfbc832c4d7b132d4cbb57e5b

SHA512
31487a5c11bd094f19fa7b651d2dc31a99eab9eb0631eee70846161492c451437f7a6410dcb45975804c645308af3ce6eab42e42804a83883768d4cee201fcd1

Download Submit
C:\Windows\System\bMsdlFC.exe

Filesize
2.7MB

MD5
7c9c0cbca24b69113bd66924dd5d472b

SHA1
ad99d95957c342dcbb14e77d52040f106a25249d

SHA256
a108c5fc122ab585a267cb7ea29c7ba49ca3546b417fdf3bd57a68b47aaf282d

SHA512
472e6130f528e0c4fad40389a8153897a4b8a28e6c750ba9345c8864a8c308f128dce30f6839f207a489e34049d39af91e9966ce95f670455a560a2ebd68df02

Download Submit
C:\Windows\System\dKThLmr.exe

Filesize
2.7MB

MD5
b4b0e4060464a8a3ae1464cba6161838

SHA1
79648db60c58512b066bf42ff0d9742370c209ec

SHA256
86ed66d697b1b5ff211aa522563f47e7c92ca39882e267cac826a015200ed2b9

SHA512
892baae5683ad926ccc67bbbb255a91589fc8f3e7df65d74fc3b3b6fc29c689cc4dfa73a6eab7e5801a5481370ad69eb0d25a70c6f0848f0c3710f42d1d9c25d

Download Submit
C:\Windows\System\dXJeOWF.exe

Filesize
2.7MB

MD5
05de50dd821cf5fa4446820d0e903057

SHA1
54e88c248aa347392ad7a37cb735bafef5cf83fc

SHA256
6ba80198bab054c0b918bca5e852467939b7a48fe7d4968c6ad6a9e4df20abd4

SHA512
06beef83c9d93d60a8516936add890cda0336416cf8785435d8a5012bce78d5b8952575370e567d8e3f6ecb7e8f4fa3b59999d8535b874c4a2e375bbe48ac46b

Download Submit
C:\Windows\System\eYWAvNj.exe

Filesize
2.7MB

MD5
b6ab0d88fe80f8c9e7a867d0aef14535

SHA1
eb8b647cf650c14d3d05643257f1602e303e74d3

SHA256
04d0b204775fd8aa0cac61e1c7e50760eec2e7d9afdada44eeb7b8945acce7d4

SHA512
b3066698fd5de06523255f97941832dddcc1bfa8cf45bcbec5118c431e6c73b4db40e9e732ee636b947786ed758134ec00240382e2e5e4050726a1bf134a67c9

Download Submit
C:\Windows\System\hJrJkKw.exe

Filesize
2.7MB

MD5
b7bcf1a164e8e00101c91268f6dd85c3

SHA1
d2764ef1d3f1875b782ece8475a6745e0167c268

SHA256
eba567e0f21646a7040d3e480f9c8c6ce2282e5b43870acc43a306b35bd9f2fb

SHA512
da9f9b701c31ca0c96f206bc91b803a35a1bf66709c1947a7bbe45a8f0a4b2e97051c0cc549de127eb47120e26bdc2fe2074f23a500d7b72582d066ae479762d

Download Submit
C:\Windows\System\jvwogzx.exe

Filesize
2.7MB

MD5
d60a3aa1c499bc338704c68607a0d6c8

SHA1
c7f1e223dd3a3e1c7a2c7e6c58fb5b593d42bc71

SHA256
84abe1143c163cd80eb9d0812644478b0a52e4280450d569da07f0061ff5adcd

SHA512
6fec8d3f5866261d29a2e2e15fc64450ff087a6961d316b8308078f8cd68224785802359a97fcd2887ef5c194460a389d7bc89c0f9f292beb9455236c35f1182

Download Submit
C:\Windows\System\kzEVTzv.exe

Filesize
2.7MB

MD5
5f0b99f36ccf638c61854b5c2035f776

SHA1
d50f3fef0ed00ac227427b5b451f94b3ff8585f9

SHA256
a371e52b560d4e22f2b03e5058f505ba81304a2fc73d2a04fbabd59ed04118cb

SHA512
942b5bfbe23f7ab43b09e9a3d12fd592688ef3cbb452d49b26b4182c8c86655bd55880e26cb5f4fde00b32ebb5ff3326ca8353695c2555f0c8780a846093cb39

Download Submit
C:\Windows\System\lXxLTLd.exe

Filesize
2.7MB

MD5
b4ed315803d4fa625f4c064568866d9c

SHA1
0a8870377459a32ece77f8f9bcde6c0a2752ae76

SHA256
88022fe43898ddd0573affc8df24f5a0c5f9c153aa4134277f78615249ffdc83

SHA512
1b1962ad7c5a27cd42a50ef4c6a088e318284c6ec8e07b9d61eb1dd9d8641159f700ec2af3cf74dd99b660352dbd0d5047c26a9513672d0a8db1d32a39005665

Download Submit
C:\Windows\System\lszcbia.exe

Filesize
2.7MB

MD5
911fa9332ff0e5a0044529fd67a0f967

SHA1
1971b6479a05d194607ccea138cdb37f22217819

SHA256
6353d8262655772f861c710240ca2527026dd96848d0ab7651a3434d23b92433

SHA512
290866031ff18c59b1fdb3d9a33ee5ed3f309d19412e2b20ad05bcd6d3504a29fd9ac613d01864009440853430f25fef9bd69c5058fd7e1852fcea423e0d2a7e

Download Submit
C:\Windows\System\nprvaCI.exe

Filesize
2.7MB

MD5
dc20bb0fa327b633ad8d9e277d3b6033

SHA1
652611bfcb530b4cec2ea51c05d3e3929a897d19

SHA256
d64a86928d03887d23f7a10e6113ec70f1d3ffec93cb22dc62c344c36345faba

SHA512
9f7b57fe37b0f55134018e9c0a91b912748fd6c1fa312406dea9d59bebf0a561f7d648d30c4ef56858e95d766baf92e221fc5e65c40265404ef6d8315ccfc7b1

Download Submit
C:\Windows\System\qyVduIg.exe

Filesize
2.7MB

MD5
671c4998b0c87bca63479ae88b31690f

SHA1
6132c53ffbaadf3d25affea7146dbf3e253157d8

SHA256
9d2f319934249b28202a011383d13b8e07e45692799b41a6a81cae70504df65b

SHA512
499f37e1ca830b0f3a049e84309c1b0f23a2068fd4427f59186a009c01ac4d992dc6677c5427e45cf022e18bf9647309966ca906e04053ee86cefaeecd5afd71

Download Submit
C:\Windows\System\rhLHoTO.exe

Filesize
2.7MB

MD5
9d2bb8f9f9742f5ae7f28ebe1d4570b9

SHA1
7cb70659bcca11c644d52a933de8379343a3aa8e

SHA256
67105a9001bdffc0c43daffed76fa1db915718643ee2eedf9c7e68dfc1503747

SHA512
f665b72223c40b2aad5ab7c8efa1dfa9d4d22601fd29581fe5181ce14f5f6a0cab9f7c3cb9b30a4f2d2c81aab737a2652414c3aaa589f05ef69c54e91bdbde21

Download Submit
C:\Windows\System\vCNMUmh.exe

Filesize
2.7MB

MD5
643f0311f933a9ab552f0d30e1d750f4

SHA1
26cbe761fad8d95b0c320cca3804b57ba70bf991

SHA256
66f6b5a0807dc9614d8550a5fc203e16e019ad2758674a8c510a5b1f209fdd56

SHA512
a538eed37d80d537e6322d3175e2d876999affcbf787b5e629a1970de3313984f748130467a33a435669e2a6611c5a235da5af9a03dbff106def07e133479081

Download Submit
C:\Windows\System\wOKuAIU.exe

Filesize
2.7MB

MD5
62319b2f14c6e6b07230001771caddf7

SHA1
6c6e8f7dfcea199453e8b11bc910b2d36c72bc8f

SHA256
1db3697cc95bced7a3de23b1910cd463d0426661c2d339e973dc84c82d6373c4

SHA512
0833c3c40c386ae4481e5a860d5bab12007071b92ae7c6a214e9340366c8f877705b3e1347585315958581d36642ff04a2bb7a7d8dec1146d7a8204d57375841

Download Submit
C:\Windows\System\zMHocsF.exe

Filesize
2.7MB

MD5
1f3ccfdf5d31cf1e21f9f0bdb63ec158

SHA1
8faa5ead7bc41a7fc605ec6a429d50581c1d9297

SHA256
e09a08801b1e6ad72d41bdc117850f36f44539b89772162aa2d82d049e3d5974

SHA512
d0befa41fbc01f2b416c3c3e9965f2602e8f3a1bda3fec75d8255be63e60f50a9e46fe7c7847f45da5e7b68cb1bedd58b6beadb85857f2e3b0725e77e139be69

Download Submit
memory/436-180-0x00007FF72AB20000-0x00007FF72AE74000-memory.dmp

Filesize
3.3MB

Download
memory/436-2138-0x00007FF72AB20000-0x00007FF72AE74000-memory.dmp

Filesize
3.3MB

Download
memory/436-2110-0x00007FF72AB20000-0x00007FF72AE74000-memory.dmp

Filesize
3.3MB

Download
memory/564-182-0x00007FF681560000-0x00007FF6818B4000-memory.dmp

Filesize
3.3MB

Download
memory/564-2127-0x00007FF681560000-0x00007FF6818B4000-memory.dmp

Filesize
3.3MB

Download
memory/624-156-0x00007FF7D8DA0000-0x00007FF7D90F4000-memory.dmp

Filesize
3.3MB

Download
memory/624-2129-0x00007FF7D8DA0000-0x00007FF7D90F4000-memory.dmp

Filesize
3.3MB

Download
memory/644-0-0x00007FF6BC3E0000-0x00007FF6BC734000-memory.dmp

Filesize
3.3MB

Download
memory/644-1-0x0000012572110000-0x0000012572120000-memory.dmp

Filesize
64KB

Download
memory/644-1109-0x00007FF6BC3E0000-0x00007FF6BC734000-memory.dmp

Filesize
3.3MB

Download
memory/736-171-0x00007FF7FB880000-0x00007FF7FBBD4000-memory.dmp

Filesize
3.3MB

Download
memory/736-2136-0x00007FF7FB880000-0x00007FF7FBBD4000-memory.dmp

Filesize
3.3MB

Download
memory/1388-2118-0x00007FF781FD0000-0x00007FF782324000-memory.dmp

Filesize
3.3MB

Download
memory/1388-32-0x00007FF781FD0000-0x00007FF782324000-memory.dmp

Filesize
3.3MB

Download
memory/1388-1587-0x00007FF781FD0000-0x00007FF782324000-memory.dmp

Filesize
3.3MB

Download
memory/1456-100-0x00007FF78D3E0000-0x00007FF78D734000-memory.dmp

Filesize
3.3MB

Download
memory/1456-2108-0x00007FF78D3E0000-0x00007FF78D734000-memory.dmp

Filesize
3.3MB

Download
memory/1456-2125-0x00007FF78D3E0000-0x00007FF78D734000-memory.dmp

Filesize
3.3MB

Download
memory/1548-97-0x00007FF733C90000-0x00007FF733FE4000-memory.dmp

Filesize
3.3MB

Download
memory/1548-2104-0x00007FF733C90000-0x00007FF733FE4000-memory.dmp

Filesize
3.3MB

Download
memory/1548-2124-0x00007FF733C90000-0x00007FF733FE4000-memory.dmp

Filesize
3.3MB

Download
memory/1656-82-0x00007FF77A840000-0x00007FF77AB94000-memory.dmp

Filesize
3.3MB

Download
memory/1656-2123-0x00007FF77A840000-0x00007FF77AB94000-memory.dmp

Filesize
3.3MB

Download
memory/1700-2105-0x00007FF691AB0000-0x00007FF691E04000-memory.dmp

Filesize
3.3MB

Download
memory/1700-112-0x00007FF691AB0000-0x00007FF691E04000-memory.dmp

Filesize
3.3MB

Download
memory/1700-2133-0x00007FF691AB0000-0x00007FF691E04000-memory.dmp

Filesize
3.3MB

Download
memory/1844-2121-0x00007FF6396E0000-0x00007FF639A34000-memory.dmp

Filesize
3.3MB

Download
memory/1844-67-0x00007FF6396E0000-0x00007FF639A34000-memory.dmp

Filesize
3.3MB

Download
memory/1844-2102-0x00007FF6396E0000-0x00007FF639A34000-memory.dmp

Filesize
3.3MB

Download
memory/2092-64-0x00007FF657F60000-0x00007FF6582B4000-memory.dmp

Filesize
3.3MB

Download
memory/2092-2116-0x00007FF657F60000-0x00007FF6582B4000-memory.dmp

Filesize
3.3MB

Download
memory/2344-2122-0x00007FF649600000-0x00007FF649954000-memory.dmp

Filesize
3.3MB

Download
memory/2344-70-0x00007FF649600000-0x00007FF649954000-memory.dmp

Filesize
3.3MB

Download
memory/2344-2103-0x00007FF649600000-0x00007FF649954000-memory.dmp

Filesize
3.3MB

Download
memory/2452-2132-0x00007FF606B10000-0x00007FF606E64000-memory.dmp

Filesize
3.3MB

Download
memory/2452-181-0x00007FF606B10000-0x00007FF606E64000-memory.dmp

Filesize
3.3MB

Download
memory/2576-73-0x00007FF737580000-0x00007FF7378D4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-2119-0x00007FF737580000-0x00007FF7378D4000-memory.dmp

Filesize
3.3MB

Download
memory/2776-185-0x00007FF71C900000-0x00007FF71CC54000-memory.dmp

Filesize
3.3MB

Download
memory/2776-2135-0x00007FF71C900000-0x00007FF71CC54000-memory.dmp

Filesize
3.3MB

Download
memory/2908-153-0x00007FF79F2E0000-0x00007FF79F634000-memory.dmp

Filesize
3.3MB

Download
memory/2908-2107-0x00007FF79F2E0000-0x00007FF79F634000-memory.dmp

Filesize
3.3MB

Download
memory/2908-2134-0x00007FF79F2E0000-0x00007FF79F634000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2126-0x00007FF732030000-0x00007FF732384000-memory.dmp

Filesize
3.3MB

Download
memory/2924-132-0x00007FF732030000-0x00007FF732384000-memory.dmp

Filesize
3.3MB

Download
memory/2984-2139-0x00007FF6D3950000-0x00007FF6D3CA4000-memory.dmp

Filesize
3.3MB

Download
memory/2984-186-0x00007FF6D3950000-0x00007FF6D3CA4000-memory.dmp

Filesize
3.3MB

Download
memory/3036-184-0x00007FF73E660000-0x00007FF73E9B4000-memory.dmp

Filesize
3.3MB

Download
memory/3036-2131-0x00007FF73E660000-0x00007FF73E9B4000-memory.dmp

Filesize
3.3MB

Download
memory/3040-2114-0x00007FF6D5DF0000-0x00007FF6D6144000-memory.dmp

Filesize
3.3MB

Download
memory/3040-1586-0x00007FF6D5DF0000-0x00007FF6D6144000-memory.dmp

Filesize
3.3MB

Download
memory/3040-29-0x00007FF6D5DF0000-0x00007FF6D6144000-memory.dmp

Filesize
3.3MB

Download
memory/3200-2109-0x00007FF6440F0000-0x00007FF644444000-memory.dmp

Filesize
3.3MB

Download
memory/3200-2137-0x00007FF6440F0000-0x00007FF644444000-memory.dmp

Filesize
3.3MB

Download
memory/3200-168-0x00007FF6440F0000-0x00007FF644444000-memory.dmp

Filesize
3.3MB

Download
memory/4024-2113-0x00007FF681120000-0x00007FF681474000-memory.dmp

Filesize
3.3MB

Download
memory/4024-40-0x00007FF681120000-0x00007FF681474000-memory.dmp

Filesize
3.3MB

Download
memory/4048-2111-0x00007FF75F480000-0x00007FF75F7D4000-memory.dmp

Filesize
3.3MB

Download
memory/4048-17-0x00007FF75F480000-0x00007FF75F7D4000-memory.dmp

Filesize
3.3MB

Download
memory/4160-74-0x00007FF6A3690000-0x00007FF6A39E4000-memory.dmp

Filesize
3.3MB

Download
memory/4160-2120-0x00007FF6A3690000-0x00007FF6A39E4000-memory.dmp

Filesize
3.3MB

Download
memory/4480-2106-0x00007FF640E40000-0x00007FF641194000-memory.dmp

Filesize
3.3MB

Download
memory/4480-116-0x00007FF640E40000-0x00007FF641194000-memory.dmp

Filesize
3.3MB

Download
memory/4480-2128-0x00007FF640E40000-0x00007FF641194000-memory.dmp

Filesize
3.3MB

Download
memory/4488-63-0x00007FF6D2570000-0x00007FF6D28C4000-memory.dmp

Filesize
3.3MB

Download
memory/4488-2117-0x00007FF6D2570000-0x00007FF6D28C4000-memory.dmp

Filesize
3.3MB

Download
memory/4564-2074-0x00007FF76CA40000-0x00007FF76CD94000-memory.dmp

Filesize
3.3MB

Download
memory/4564-2115-0x00007FF76CA40000-0x00007FF76CD94000-memory.dmp

Filesize
3.3MB

Download
memory/4564-55-0x00007FF76CA40000-0x00007FF76CD94000-memory.dmp

Filesize
3.3MB

Download
memory/4728-2130-0x00007FF73E710000-0x00007FF73EA64000-memory.dmp

Filesize
3.3MB

Download
memory/4728-183-0x00007FF73E710000-0x00007FF73EA64000-memory.dmp

Filesize
3.3MB

Download
memory/4964-2112-0x00007FF7CCC00000-0x00007FF7CCF54000-memory.dmp

Filesize
3.3MB

Download
memory/4964-23-0x00007FF7CCC00000-0x00007FF7CCF54000-memory.dmp

Filesize
3.3MB

Download