xmrig | aaab87b0b30e8d3042d47b1bf6d9b9e633610e6814d7d95ba318ae93d0415ee2

Analysis

max time kernel
144s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
Size

2.6MB
MD5

172d3acab657cb191b1f017bc463fff0
SHA1

cb2f29bffaf7752692198a661795116168634fc0
SHA256

aaab87b0b30e8d3042d47b1bf6d9b9e633610e6814d7d95ba318ae93d0415ee2
SHA512

be37e085c9a3d63f0ae868427bcaf18fc47ca70f288e370d9dc97e7d0e907fa4c11278c80ae181d08ca0fddb16847908f3c827d083645839d360471cfee314b1
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPIH2BdfCgT:BemTLkNdfE0pZrV56utgpPh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4044-0-0x00007FF7CECC0000-0x00007FF7CF014000-memory.dmp	xmrig
behavioral2/files/0x0008000000023424-5.dat	xmrig
behavioral2/memory/1700-7-0x00007FF65F6F0000-0x00007FF65FA44000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-10.dat	xmrig
behavioral2/files/0x000700000002342c-17.dat	xmrig
behavioral2/files/0x000700000002342d-20.dat	xmrig
behavioral2/memory/4252-24-0x00007FF6DA100000-0x00007FF6DA454000-memory.dmp	xmrig
behavioral2/memory/3668-31-0x00007FF737780000-0x00007FF737AD4000-memory.dmp	xmrig
behavioral2/memory/1276-32-0x00007FF623930000-0x00007FF623C84000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-30.dat	xmrig
behavioral2/memory/3812-16-0x00007FF729BA0000-0x00007FF729EF4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-33.dat	xmrig
behavioral2/files/0x0007000000023431-49.dat	xmrig
behavioral2/files/0x0007000000023432-50.dat	xmrig
behavioral2/files/0x0007000000023434-63.dat	xmrig
behavioral2/files/0x0008000000023428-72.dat	xmrig
behavioral2/files/0x0007000000023438-92.dat	xmrig
behavioral2/files/0x000700000002343a-102.dat	xmrig
behavioral2/files/0x000700000002343d-113.dat	xmrig
behavioral2/files/0x000700000002343f-123.dat	xmrig
behavioral2/files/0x0007000000023441-136.dat	xmrig
behavioral2/files/0x0007000000023445-156.dat	xmrig
behavioral2/memory/3572-414-0x00007FF621820000-0x00007FF621B74000-memory.dmp	xmrig
behavioral2/memory/4352-434-0x00007FF74AD70000-0x00007FF74B0C4000-memory.dmp	xmrig
behavioral2/memory/1448-436-0x00007FF604360000-0x00007FF6046B4000-memory.dmp	xmrig
behavioral2/memory/1092-438-0x00007FF705390000-0x00007FF7056E4000-memory.dmp	xmrig
behavioral2/memory/368-440-0x00007FF7B8A10000-0x00007FF7B8D64000-memory.dmp	xmrig
behavioral2/memory/3276-447-0x00007FF613DC0000-0x00007FF614114000-memory.dmp	xmrig
behavioral2/memory/3184-458-0x00007FF769820000-0x00007FF769B74000-memory.dmp	xmrig
behavioral2/memory/3080-462-0x00007FF634340000-0x00007FF634694000-memory.dmp	xmrig
behavioral2/memory/3120-477-0x00007FF718880000-0x00007FF718BD4000-memory.dmp	xmrig
behavioral2/memory/552-487-0x00007FF71AB90000-0x00007FF71AEE4000-memory.dmp	xmrig
behavioral2/memory/772-484-0x00007FF783900000-0x00007FF783C54000-memory.dmp	xmrig
behavioral2/memory/3208-498-0x00007FF7499E0000-0x00007FF749D34000-memory.dmp	xmrig
behavioral2/memory/3136-503-0x00007FF6F4400000-0x00007FF6F4754000-memory.dmp	xmrig
behavioral2/memory/4052-501-0x00007FF7841E0000-0x00007FF784534000-memory.dmp	xmrig
behavioral2/memory/4504-474-0x00007FF739FC0000-0x00007FF73A314000-memory.dmp	xmrig
behavioral2/memory/2192-470-0x00007FF609CA0000-0x00007FF609FF4000-memory.dmp	xmrig
behavioral2/memory/1384-465-0x00007FF69F210000-0x00007FF69F564000-memory.dmp	xmrig
behavioral2/memory/632-467-0x00007FF6561E0000-0x00007FF656534000-memory.dmp	xmrig
behavioral2/memory/4672-457-0x00007FF7FF4D0000-0x00007FF7FF824000-memory.dmp	xmrig
behavioral2/memory/4020-425-0x00007FF7F73F0000-0x00007FF7F7744000-memory.dmp	xmrig
behavioral2/memory/4952-419-0x00007FF66B320000-0x00007FF66B674000-memory.dmp	xmrig
behavioral2/memory/4044-1118-0x00007FF7CECC0000-0x00007FF7CF014000-memory.dmp	xmrig
behavioral2/files/0x0007000000023449-171.dat	xmrig
behavioral2/files/0x0007000000023447-167.dat	xmrig
behavioral2/files/0x0007000000023448-166.dat	xmrig
behavioral2/files/0x0007000000023446-162.dat	xmrig
behavioral2/files/0x0007000000023444-152.dat	xmrig
behavioral2/files/0x0007000000023443-146.dat	xmrig
behavioral2/files/0x0007000000023442-142.dat	xmrig
behavioral2/files/0x0007000000023440-132.dat	xmrig
behavioral2/files/0x000700000002343e-121.dat	xmrig
behavioral2/files/0x000700000002343c-111.dat	xmrig
behavioral2/files/0x000700000002343b-107.dat	xmrig
behavioral2/files/0x0007000000023439-96.dat	xmrig
behavioral2/files/0x0007000000023437-87.dat	xmrig
behavioral2/files/0x0007000000023436-81.dat	xmrig
behavioral2/files/0x0007000000023435-77.dat	xmrig
behavioral2/memory/1772-62-0x00007FF600F30000-0x00007FF601284000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-56.dat	xmrig
behavioral2/memory/4656-48-0x00007FF6A9450000-0x00007FF6A97A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-43.dat	xmrig
behavioral2/memory/3628-38-0x00007FF6F7FD0000-0x00007FF6F8324000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1700	JoExKnA.exe
3812	kLLUCeZ.exe
4252	XyLfQJh.exe
3668	GHtmOrK.exe
1276	gVaIzSL.exe
3628	RLQHEfM.exe
4656	vVdJIFv.exe
1772	lqczvEK.exe
3572	BUGSewI.exe
4052	HtrLqpn.exe
3136	suSDEGO.exe
4952	XjCWlVJ.exe
4020	cOEtaGh.exe
4352	EcOQxWV.exe
1448	kjtEqOr.exe
1092	UFoASZp.exe
368	aQwyOig.exe
3276	CZvgFbL.exe
4672	HCCDvdU.exe
3184	JCGsbXS.exe
3080	iKkDPcA.exe
1384	OTYokHH.exe
632	uvsbfeH.exe
2192	vvbSiOg.exe
4504	DsLrAOx.exe
3120	XKgLwNi.exe
772	zgwuNtS.exe
552	nWltKPE.exe
3208	KbulymH.exe
1936	qbdQyLx.exe
4528	CNyOTdY.exe
3552	FQqZTzP.exe
4400	IlVBCub.exe
900	AYaUpWx.exe
388	truQGCd.exe
2892	jocyrqu.exe
3240	TQhJexZ.exe
2528	GTJWvyb.exe
5040	DdpaRWJ.exe
1852	aptaWWW.exe
2412	IgVrLgy.exe
4144	ozGIobL.exe
4428	mYReklH.exe
2540	fCoxWxZ.exe
4556	KGrUiHd.exe
4596	iNRxEkr.exe
2392	eJBsClH.exe
4936	OZbxoqz.exe
4476	fRVUzZL.exe
2176	CmnoBjj.exe
4636	GZiIXEN.exe
1284	NjvOdye.exe
2648	BTXJTFU.exe
656	qLeNPSa.exe
2940	lWtERAm.exe
2068	NiYjqQk.exe
964	fEqeQnO.exe
2660	ToWgycw.exe
4460	TfiFtZp.exe
4616	QBTKlri.exe
3904	EYVQbki.exe
3352	mCpKWfR.exe
2640	PvbobUo.exe
5068	TOgPCxY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4044-0-0x00007FF7CECC0000-0x00007FF7CF014000-memory.dmp	upx
behavioral2/files/0x0008000000023424-5.dat	upx
behavioral2/memory/1700-7-0x00007FF65F6F0000-0x00007FF65FA44000-memory.dmp	upx
behavioral2/files/0x000700000002342b-10.dat	upx
behavioral2/files/0x000700000002342c-17.dat	upx
behavioral2/files/0x000700000002342d-20.dat	upx
behavioral2/memory/4252-24-0x00007FF6DA100000-0x00007FF6DA454000-memory.dmp	upx
behavioral2/memory/3668-31-0x00007FF737780000-0x00007FF737AD4000-memory.dmp	upx
behavioral2/memory/1276-32-0x00007FF623930000-0x00007FF623C84000-memory.dmp	upx
behavioral2/files/0x000700000002342e-30.dat	upx
behavioral2/memory/3812-16-0x00007FF729BA0000-0x00007FF729EF4000-memory.dmp	upx
behavioral2/files/0x000700000002342f-33.dat	upx
behavioral2/files/0x0007000000023431-49.dat	upx
behavioral2/files/0x0007000000023432-50.dat	upx
behavioral2/files/0x0007000000023434-63.dat	upx
behavioral2/files/0x0008000000023428-72.dat	upx
behavioral2/files/0x0007000000023438-92.dat	upx
behavioral2/files/0x000700000002343a-102.dat	upx
behavioral2/files/0x000700000002343d-113.dat	upx
behavioral2/files/0x000700000002343f-123.dat	upx
behavioral2/files/0x0007000000023441-136.dat	upx
behavioral2/files/0x0007000000023445-156.dat	upx
behavioral2/memory/3572-414-0x00007FF621820000-0x00007FF621B74000-memory.dmp	upx
behavioral2/memory/4352-434-0x00007FF74AD70000-0x00007FF74B0C4000-memory.dmp	upx
behavioral2/memory/1448-436-0x00007FF604360000-0x00007FF6046B4000-memory.dmp	upx
behavioral2/memory/1092-438-0x00007FF705390000-0x00007FF7056E4000-memory.dmp	upx
behavioral2/memory/368-440-0x00007FF7B8A10000-0x00007FF7B8D64000-memory.dmp	upx
behavioral2/memory/3276-447-0x00007FF613DC0000-0x00007FF614114000-memory.dmp	upx
behavioral2/memory/3184-458-0x00007FF769820000-0x00007FF769B74000-memory.dmp	upx
behavioral2/memory/3080-462-0x00007FF634340000-0x00007FF634694000-memory.dmp	upx
behavioral2/memory/3120-477-0x00007FF718880000-0x00007FF718BD4000-memory.dmp	upx
behavioral2/memory/552-487-0x00007FF71AB90000-0x00007FF71AEE4000-memory.dmp	upx
behavioral2/memory/772-484-0x00007FF783900000-0x00007FF783C54000-memory.dmp	upx
behavioral2/memory/3208-498-0x00007FF7499E0000-0x00007FF749D34000-memory.dmp	upx
behavioral2/memory/3136-503-0x00007FF6F4400000-0x00007FF6F4754000-memory.dmp	upx
behavioral2/memory/4052-501-0x00007FF7841E0000-0x00007FF784534000-memory.dmp	upx
behavioral2/memory/4504-474-0x00007FF739FC0000-0x00007FF73A314000-memory.dmp	upx
behavioral2/memory/2192-470-0x00007FF609CA0000-0x00007FF609FF4000-memory.dmp	upx
behavioral2/memory/1384-465-0x00007FF69F210000-0x00007FF69F564000-memory.dmp	upx
behavioral2/memory/632-467-0x00007FF6561E0000-0x00007FF656534000-memory.dmp	upx
behavioral2/memory/4672-457-0x00007FF7FF4D0000-0x00007FF7FF824000-memory.dmp	upx
behavioral2/memory/4020-425-0x00007FF7F73F0000-0x00007FF7F7744000-memory.dmp	upx
behavioral2/memory/4952-419-0x00007FF66B320000-0x00007FF66B674000-memory.dmp	upx
behavioral2/memory/4044-1118-0x00007FF7CECC0000-0x00007FF7CF014000-memory.dmp	upx
behavioral2/files/0x0007000000023449-171.dat	upx
behavioral2/files/0x0007000000023447-167.dat	upx
behavioral2/files/0x0007000000023448-166.dat	upx
behavioral2/files/0x0007000000023446-162.dat	upx
behavioral2/files/0x0007000000023444-152.dat	upx
behavioral2/files/0x0007000000023443-146.dat	upx
behavioral2/files/0x0007000000023442-142.dat	upx
behavioral2/files/0x0007000000023440-132.dat	upx
behavioral2/files/0x000700000002343e-121.dat	upx
behavioral2/files/0x000700000002343c-111.dat	upx
behavioral2/files/0x000700000002343b-107.dat	upx
behavioral2/files/0x0007000000023439-96.dat	upx
behavioral2/files/0x0007000000023437-87.dat	upx
behavioral2/files/0x0007000000023436-81.dat	upx
behavioral2/files/0x0007000000023435-77.dat	upx
behavioral2/memory/1772-62-0x00007FF600F30000-0x00007FF601284000-memory.dmp	upx
behavioral2/files/0x0007000000023433-56.dat	upx
behavioral2/memory/4656-48-0x00007FF6A9450000-0x00007FF6A97A4000-memory.dmp	upx
behavioral2/files/0x0007000000023430-43.dat	upx
behavioral2/memory/3628-38-0x00007FF6F7FD0000-0x00007FF6F8324000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bdVIsaY.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\BzUqCDT.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\CCfCSEB.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\fFzfETE.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\PrAHDfe.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\QwFNCyj.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\bdiUKgD.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\qxtqJyF.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\mGWLSmw.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\mMBqPNa.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\MTcFmOA.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\JpKxgXi.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\mBfbgsN.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\oTAzRKG.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\GUrTfle.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\VZatLbr.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\sHrBgQo.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\wGWtZat.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\twtRaBD.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\CvWIzed.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\aTjTpsE.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\HYDHZWC.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\NXmvpGf.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\IyvBpsr.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\CDUauzE.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\gCrlppw.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\JaybXqr.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\DdpaRWJ.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\RYkUbjp.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\XjCWlVJ.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\ozGIobL.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\eJBsClH.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\ZBdLheb.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\CstzEph.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\UQfCyxM.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\JWtHzYT.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\utFAzJW.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\YdCOZGK.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\zJvfdvP.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\RsKZwXg.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\ohdwXWP.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\bSHMncj.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\OscQQvX.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\AkGoLYL.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\kGqxfCB.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\sYcKmrD.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\TaxhYPT.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\TfiFtZp.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\nVhcTnI.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\EwlrKEI.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\qvxYoGi.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\OmjelQi.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\DVBwcap.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\otrwBDP.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\jsWufxS.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\QoVHaeg.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\IbSPOGg.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\RLFFImD.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\XKgLwNi.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\NiYjqQk.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\FXpdZnQ.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\aYlvTWm.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\PPEfPuu.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
File created	C:\Windows\System\EetvVeI.exe	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
14540	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 1700	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	88
PID 4044 wrote to memory of 1700	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	88
PID 4044 wrote to memory of 3812	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	89
PID 4044 wrote to memory of 3812	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	89
PID 4044 wrote to memory of 4252	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	90
PID 4044 wrote to memory of 4252	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	90
PID 4044 wrote to memory of 3668	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	91
PID 4044 wrote to memory of 3668	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	91
PID 4044 wrote to memory of 1276	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	92
PID 4044 wrote to memory of 1276	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	92
PID 4044 wrote to memory of 3628	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	93
PID 4044 wrote to memory of 3628	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	93
PID 4044 wrote to memory of 4656	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	94
PID 4044 wrote to memory of 4656	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	94
PID 4044 wrote to memory of 1772	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	95
PID 4044 wrote to memory of 1772	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	95
PID 4044 wrote to memory of 3572	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	96
PID 4044 wrote to memory of 3572	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	96
PID 4044 wrote to memory of 4052	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	97
PID 4044 wrote to memory of 4052	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	97
PID 4044 wrote to memory of 3136	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	98
PID 4044 wrote to memory of 3136	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	98
PID 4044 wrote to memory of 4952	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	99
PID 4044 wrote to memory of 4952	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	99
PID 4044 wrote to memory of 4020	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	100
PID 4044 wrote to memory of 4020	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	100
PID 4044 wrote to memory of 4352	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	101
PID 4044 wrote to memory of 4352	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	101
PID 4044 wrote to memory of 1448	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	102
PID 4044 wrote to memory of 1448	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	102
PID 4044 wrote to memory of 1092	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	103
PID 4044 wrote to memory of 1092	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	103
PID 4044 wrote to memory of 368	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	104
PID 4044 wrote to memory of 368	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	104
PID 4044 wrote to memory of 3276	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	105
PID 4044 wrote to memory of 3276	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	105
PID 4044 wrote to memory of 4672	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	106
PID 4044 wrote to memory of 4672	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	106
PID 4044 wrote to memory of 3184	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	107
PID 4044 wrote to memory of 3184	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	107
PID 4044 wrote to memory of 3080	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	108
PID 4044 wrote to memory of 3080	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	108
PID 4044 wrote to memory of 1384	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	109
PID 4044 wrote to memory of 1384	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	109
PID 4044 wrote to memory of 632	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	110
PID 4044 wrote to memory of 632	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	110
PID 4044 wrote to memory of 2192	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	111
PID 4044 wrote to memory of 2192	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	111
PID 4044 wrote to memory of 4504	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	112
PID 4044 wrote to memory of 4504	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	112
PID 4044 wrote to memory of 3120	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	113
PID 4044 wrote to memory of 3120	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	113
PID 4044 wrote to memory of 772	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	114
PID 4044 wrote to memory of 772	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	114
PID 4044 wrote to memory of 552	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	115
PID 4044 wrote to memory of 552	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	115
PID 4044 wrote to memory of 3208	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	116
PID 4044 wrote to memory of 3208	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	116
PID 4044 wrote to memory of 1936	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	117
PID 4044 wrote to memory of 1936	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	117
PID 4044 wrote to memory of 4528	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	118
PID 4044 wrote to memory of 4528	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	118
PID 4044 wrote to memory of 3552	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	119
PID 4044 wrote to memory of 3552	4044	172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe	119

C:\Users\Admin\AppData\Local\Temp\172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\172d3acab657cb191b1f017bc463fff0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\System\JoExKnA.exe
  C:\Windows\System\JoExKnA.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\kLLUCeZ.exe
  C:\Windows\System\kLLUCeZ.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\XyLfQJh.exe
  C:\Windows\System\XyLfQJh.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\GHtmOrK.exe
  C:\Windows\System\GHtmOrK.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\gVaIzSL.exe
  C:\Windows\System\gVaIzSL.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\RLQHEfM.exe
  C:\Windows\System\RLQHEfM.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\vVdJIFv.exe
  C:\Windows\System\vVdJIFv.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\lqczvEK.exe
  C:\Windows\System\lqczvEK.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\BUGSewI.exe
  C:\Windows\System\BUGSewI.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\HtrLqpn.exe
  C:\Windows\System\HtrLqpn.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\suSDEGO.exe
  C:\Windows\System\suSDEGO.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\XjCWlVJ.exe
  C:\Windows\System\XjCWlVJ.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\cOEtaGh.exe
  C:\Windows\System\cOEtaGh.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\EcOQxWV.exe
  C:\Windows\System\EcOQxWV.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\kjtEqOr.exe
  C:\Windows\System\kjtEqOr.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\UFoASZp.exe
  C:\Windows\System\UFoASZp.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\aQwyOig.exe
  C:\Windows\System\aQwyOig.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\CZvgFbL.exe
  C:\Windows\System\CZvgFbL.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\HCCDvdU.exe
  C:\Windows\System\HCCDvdU.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\JCGsbXS.exe
  C:\Windows\System\JCGsbXS.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\iKkDPcA.exe
  C:\Windows\System\iKkDPcA.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\OTYokHH.exe
  C:\Windows\System\OTYokHH.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\uvsbfeH.exe
  C:\Windows\System\uvsbfeH.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\vvbSiOg.exe
  C:\Windows\System\vvbSiOg.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\DsLrAOx.exe
  C:\Windows\System\DsLrAOx.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\XKgLwNi.exe
  C:\Windows\System\XKgLwNi.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\zgwuNtS.exe
  C:\Windows\System\zgwuNtS.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\nWltKPE.exe
  C:\Windows\System\nWltKPE.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\KbulymH.exe
  C:\Windows\System\KbulymH.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\qbdQyLx.exe
  C:\Windows\System\qbdQyLx.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\CNyOTdY.exe
  C:\Windows\System\CNyOTdY.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\FQqZTzP.exe
  C:\Windows\System\FQqZTzP.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\IlVBCub.exe
  C:\Windows\System\IlVBCub.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\AYaUpWx.exe
  C:\Windows\System\AYaUpWx.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\truQGCd.exe
  C:\Windows\System\truQGCd.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\jocyrqu.exe
  C:\Windows\System\jocyrqu.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\TQhJexZ.exe
  C:\Windows\System\TQhJexZ.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\GTJWvyb.exe
  C:\Windows\System\GTJWvyb.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\DdpaRWJ.exe
  C:\Windows\System\DdpaRWJ.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\aptaWWW.exe
  C:\Windows\System\aptaWWW.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\IgVrLgy.exe
  C:\Windows\System\IgVrLgy.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ozGIobL.exe
  C:\Windows\System\ozGIobL.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\mYReklH.exe
  C:\Windows\System\mYReklH.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\fCoxWxZ.exe
  C:\Windows\System\fCoxWxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\KGrUiHd.exe
  C:\Windows\System\KGrUiHd.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\iNRxEkr.exe
  C:\Windows\System\iNRxEkr.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\eJBsClH.exe
  C:\Windows\System\eJBsClH.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\OZbxoqz.exe
  C:\Windows\System\OZbxoqz.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\fRVUzZL.exe
  C:\Windows\System\fRVUzZL.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\CmnoBjj.exe
  C:\Windows\System\CmnoBjj.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\GZiIXEN.exe
  C:\Windows\System\GZiIXEN.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\NjvOdye.exe
  C:\Windows\System\NjvOdye.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\BTXJTFU.exe
  C:\Windows\System\BTXJTFU.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\qLeNPSa.exe
  C:\Windows\System\qLeNPSa.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\lWtERAm.exe
  C:\Windows\System\lWtERAm.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\NiYjqQk.exe
  C:\Windows\System\NiYjqQk.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\fEqeQnO.exe
  C:\Windows\System\fEqeQnO.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\ToWgycw.exe
  C:\Windows\System\ToWgycw.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\TfiFtZp.exe
  C:\Windows\System\TfiFtZp.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\QBTKlri.exe
  C:\Windows\System\QBTKlri.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\EYVQbki.exe
  C:\Windows\System\EYVQbki.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\mCpKWfR.exe
  C:\Windows\System\mCpKWfR.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\PvbobUo.exe
  C:\Windows\System\PvbobUo.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\TOgPCxY.exe
  C:\Windows\System\TOgPCxY.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\pKtVAOn.exe
  C:\Windows\System\pKtVAOn.exe
  2⤵
  PID:2636
- C:\Windows\System\luHYjAN.exe
  C:\Windows\System\luHYjAN.exe
  2⤵
  PID:952
- C:\Windows\System\QdOZXGK.exe
  C:\Windows\System\QdOZXGK.exe
  2⤵
  PID:4332
- C:\Windows\System\zAKCRVL.exe
  C:\Windows\System\zAKCRVL.exe
  2⤵
  PID:3872
- C:\Windows\System\HTFKAdd.exe
  C:\Windows\System\HTFKAdd.exe
  2⤵
  PID:1872
- C:\Windows\System\WrmYnLs.exe
  C:\Windows\System\WrmYnLs.exe
  2⤵
  PID:3672
- C:\Windows\System\MNHqCJT.exe
  C:\Windows\System\MNHqCJT.exe
  2⤵
  PID:5132
- C:\Windows\System\zapivwR.exe
  C:\Windows\System\zapivwR.exe
  2⤵
  PID:5160
- C:\Windows\System\CSkKzfX.exe
  C:\Windows\System\CSkKzfX.exe
  2⤵
  PID:5188
- C:\Windows\System\vrMNHEc.exe
  C:\Windows\System\vrMNHEc.exe
  2⤵
  PID:5216
- C:\Windows\System\UeRISEn.exe
  C:\Windows\System\UeRISEn.exe
  2⤵
  PID:5248
- C:\Windows\System\UJAGndi.exe
  C:\Windows\System\UJAGndi.exe
  2⤵
  PID:5272
- C:\Windows\System\cYvsCyJ.exe
  C:\Windows\System\cYvsCyJ.exe
  2⤵
  PID:5300
- C:\Windows\System\ackzywg.exe
  C:\Windows\System\ackzywg.exe
  2⤵
  PID:5328
- C:\Windows\System\MiSVJES.exe
  C:\Windows\System\MiSVJES.exe
  2⤵
  PID:5356
- C:\Windows\System\eEITfJa.exe
  C:\Windows\System\eEITfJa.exe
  2⤵
  PID:5384
- C:\Windows\System\RYkUbjp.exe
  C:\Windows\System\RYkUbjp.exe
  2⤵
  PID:5412
- C:\Windows\System\xBuKLzM.exe
  C:\Windows\System\xBuKLzM.exe
  2⤵
  PID:5436
- C:\Windows\System\YeZAZes.exe
  C:\Windows\System\YeZAZes.exe
  2⤵
  PID:5468
- C:\Windows\System\GCoarla.exe
  C:\Windows\System\GCoarla.exe
  2⤵
  PID:5500
- C:\Windows\System\utFAzJW.exe
  C:\Windows\System\utFAzJW.exe
  2⤵
  PID:5524
- C:\Windows\System\HhZepQB.exe
  C:\Windows\System\HhZepQB.exe
  2⤵
  PID:5552
- C:\Windows\System\PnHZwVD.exe
  C:\Windows\System\PnHZwVD.exe
  2⤵
  PID:5576
- C:\Windows\System\LtWOegc.exe
  C:\Windows\System\LtWOegc.exe
  2⤵
  PID:5604
- C:\Windows\System\FsOAcEb.exe
  C:\Windows\System\FsOAcEb.exe
  2⤵
  PID:5632
- C:\Windows\System\yvhDjDQ.exe
  C:\Windows\System\yvhDjDQ.exe
  2⤵
  PID:5660
- C:\Windows\System\mMypSbk.exe
  C:\Windows\System\mMypSbk.exe
  2⤵
  PID:5692
- C:\Windows\System\YSYrTNc.exe
  C:\Windows\System\YSYrTNc.exe
  2⤵
  PID:5720
- C:\Windows\System\BnjtGNw.exe
  C:\Windows\System\BnjtGNw.exe
  2⤵
  PID:5744
- C:\Windows\System\AgLqmEp.exe
  C:\Windows\System\AgLqmEp.exe
  2⤵
  PID:5772
- C:\Windows\System\OlkJggC.exe
  C:\Windows\System\OlkJggC.exe
  2⤵
  PID:5804
- C:\Windows\System\sHrBgQo.exe
  C:\Windows\System\sHrBgQo.exe
  2⤵
  PID:5832
- C:\Windows\System\dYLdzrM.exe
  C:\Windows\System\dYLdzrM.exe
  2⤵
  PID:5860
- C:\Windows\System\fARNVop.exe
  C:\Windows\System\fARNVop.exe
  2⤵
  PID:5888
- C:\Windows\System\JAHWoam.exe
  C:\Windows\System\JAHWoam.exe
  2⤵
  PID:5916
- C:\Windows\System\wGWtZat.exe
  C:\Windows\System\wGWtZat.exe
  2⤵
  PID:5948
- C:\Windows\System\KellgKA.exe
  C:\Windows\System\KellgKA.exe
  2⤵
  PID:5976
- C:\Windows\System\hEEDAEK.exe
  C:\Windows\System\hEEDAEK.exe
  2⤵
  PID:6004
- C:\Windows\System\DtiVbRi.exe
  C:\Windows\System\DtiVbRi.exe
  2⤵
  PID:6032
- C:\Windows\System\OiZNgVG.exe
  C:\Windows\System\OiZNgVG.exe
  2⤵
  PID:6060
- C:\Windows\System\otrwBDP.exe
  C:\Windows\System\otrwBDP.exe
  2⤵
  PID:6092
- C:\Windows\System\UFkIKrx.exe
  C:\Windows\System\UFkIKrx.exe
  2⤵
  PID:6116
- C:\Windows\System\hIRBjEN.exe
  C:\Windows\System\hIRBjEN.exe
  2⤵
  PID:1152
- C:\Windows\System\bHRKMxv.exe
  C:\Windows\System\bHRKMxv.exe
  2⤵
  PID:4516
- C:\Windows\System\ECwAtCF.exe
  C:\Windows\System\ECwAtCF.exe
  2⤵
  PID:4884
- C:\Windows\System\bTPCRDA.exe
  C:\Windows\System\bTPCRDA.exe
  2⤵
  PID:1660
- C:\Windows\System\zUIJDtF.exe
  C:\Windows\System\zUIJDtF.exe
  2⤵
  PID:4300
- C:\Windows\System\cgLryGp.exe
  C:\Windows\System\cgLryGp.exe
  2⤵
  PID:5176
- C:\Windows\System\IyvBpsr.exe
  C:\Windows\System\IyvBpsr.exe
  2⤵
  PID:5404
- C:\Windows\System\jckHqfH.exe
  C:\Windows\System\jckHqfH.exe
  2⤵
  PID:5508
- C:\Windows\System\tFrFkck.exe
  C:\Windows\System\tFrFkck.exe
  2⤵
  PID:5544
- C:\Windows\System\AwzwXOO.exe
  C:\Windows\System\AwzwXOO.exe
  2⤵
  PID:4988
- C:\Windows\System\JZEBlHH.exe
  C:\Windows\System\JZEBlHH.exe
  2⤵
  PID:5736
- C:\Windows\System\YeZSmyf.exe
  C:\Windows\System\YeZSmyf.exe
  2⤵
  PID:5792
- C:\Windows\System\tgMfyrG.exe
  C:\Windows\System\tgMfyrG.exe
  2⤵
  PID:5824
- C:\Windows\System\XpOEJek.exe
  C:\Windows\System\XpOEJek.exe
  2⤵
  PID:5876
- C:\Windows\System\hkglIIR.exe
  C:\Windows\System\hkglIIR.exe
  2⤵
  PID:5908
- C:\Windows\System\ZRnmCCX.exe
  C:\Windows\System\ZRnmCCX.exe
  2⤵
  PID:5968
- C:\Windows\System\uOpqPgR.exe
  C:\Windows\System\uOpqPgR.exe
  2⤵
  PID:6020
- C:\Windows\System\twtRaBD.exe
  C:\Windows\System\twtRaBD.exe
  2⤵
  PID:6132
- C:\Windows\System\kxgsyVn.exe
  C:\Windows\System\kxgsyVn.exe
  2⤵
  PID:5052
- C:\Windows\System\smskSpp.exe
  C:\Windows\System\smskSpp.exe
  2⤵
  PID:1372
- C:\Windows\System\McaNGJt.exe
  C:\Windows\System\McaNGJt.exe
  2⤵
  PID:4004
- C:\Windows\System\KFhdovf.exe
  C:\Windows\System\KFhdovf.exe
  2⤵
  PID:5456
- C:\Windows\System\XvIprVa.exe
  C:\Windows\System\XvIprVa.exe
  2⤵
  PID:3064
- C:\Windows\System\ycweOgU.exe
  C:\Windows\System\ycweOgU.exe
  2⤵
  PID:2168
- C:\Windows\System\WgyDYgO.exe
  C:\Windows\System\WgyDYgO.exe
  2⤵
  PID:5540
- C:\Windows\System\FXpdZnQ.exe
  C:\Windows\System\FXpdZnQ.exe
  2⤵
  PID:1332
- C:\Windows\System\aYlvTWm.exe
  C:\Windows\System\aYlvTWm.exe
  2⤵
  PID:1124
- C:\Windows\System\OmuFuaB.exe
  C:\Windows\System\OmuFuaB.exe
  2⤵
  PID:5820
- C:\Windows\System\bYUaUlV.exe
  C:\Windows\System\bYUaUlV.exe
  2⤵
  PID:4860
- C:\Windows\System\ZBPeEps.exe
  C:\Windows\System\ZBPeEps.exe
  2⤵
  PID:6056
- C:\Windows\System\KeWUoqY.exe
  C:\Windows\System\KeWUoqY.exe
  2⤵
  PID:5116
- C:\Windows\System\bdiUKgD.exe
  C:\Windows\System\bdiUKgD.exe
  2⤵
  PID:1256
- C:\Windows\System\HSCBLcm.exe
  C:\Windows\System\HSCBLcm.exe
  2⤵
  PID:5428
- C:\Windows\System\AwlpJsg.exe
  C:\Windows\System\AwlpJsg.exe
  2⤵
  PID:4912
- C:\Windows\System\wdnDfjF.exe
  C:\Windows\System\wdnDfjF.exe
  2⤵
  PID:2316
- C:\Windows\System\rgNVvTx.exe
  C:\Windows\System\rgNVvTx.exe
  2⤵
  PID:116
- C:\Windows\System\mSjeUJD.exe
  C:\Windows\System\mSjeUJD.exe
  2⤵
  PID:3220
- C:\Windows\System\EisYGeO.exe
  C:\Windows\System\EisYGeO.exe
  2⤵
  PID:3180
- C:\Windows\System\bSHMncj.exe
  C:\Windows\System\bSHMncj.exe
  2⤵
  PID:3560
- C:\Windows\System\hRqtPmE.exe
  C:\Windows\System\hRqtPmE.exe
  2⤵
  PID:3012
- C:\Windows\System\dIZpRtK.exe
  C:\Windows\System\dIZpRtK.exe
  2⤵
  PID:4872
- C:\Windows\System\GwuMjzc.exe
  C:\Windows\System\GwuMjzc.exe
  2⤵
  PID:1824
- C:\Windows\System\KfmaasG.exe
  C:\Windows\System\KfmaasG.exe
  2⤵
  PID:2076
- C:\Windows\System\KdqLOyl.exe
  C:\Windows\System\KdqLOyl.exe
  2⤵
  PID:2284
- C:\Windows\System\CDUauzE.exe
  C:\Windows\System\CDUauzE.exe
  2⤵
  PID:2344
- C:\Windows\System\TmXaDYj.exe
  C:\Windows\System\TmXaDYj.exe
  2⤵
  PID:872
- C:\Windows\System\RmsghBr.exe
  C:\Windows\System\RmsghBr.exe
  2⤵
  PID:6176
- C:\Windows\System\RrasneB.exe
  C:\Windows\System\RrasneB.exe
  2⤵
  PID:6204
- C:\Windows\System\QLqQMPy.exe
  C:\Windows\System\QLqQMPy.exe
  2⤵
  PID:6232
- C:\Windows\System\IExoczl.exe
  C:\Windows\System\IExoczl.exe
  2⤵
  PID:6268
- C:\Windows\System\zfxaANI.exe
  C:\Windows\System\zfxaANI.exe
  2⤵
  PID:6304
- C:\Windows\System\lTxFKNJ.exe
  C:\Windows\System\lTxFKNJ.exe
  2⤵
  PID:6336
- C:\Windows\System\cigSNTN.exe
  C:\Windows\System\cigSNTN.exe
  2⤵
  PID:6356
- C:\Windows\System\MTcFmOA.exe
  C:\Windows\System\MTcFmOA.exe
  2⤵
  PID:6388
- C:\Windows\System\gtxUEEy.exe
  C:\Windows\System\gtxUEEy.exe
  2⤵
  PID:6424
- C:\Windows\System\zANbXaM.exe
  C:\Windows\System\zANbXaM.exe
  2⤵
  PID:6444
- C:\Windows\System\IBipMsl.exe
  C:\Windows\System\IBipMsl.exe
  2⤵
  PID:6476
- C:\Windows\System\QxnXnGB.exe
  C:\Windows\System\QxnXnGB.exe
  2⤵
  PID:6508
- C:\Windows\System\xPOJcoL.exe
  C:\Windows\System\xPOJcoL.exe
  2⤵
  PID:6536
- C:\Windows\System\ynuuBlF.exe
  C:\Windows\System\ynuuBlF.exe
  2⤵
  PID:6576
- C:\Windows\System\gCrlppw.exe
  C:\Windows\System\gCrlppw.exe
  2⤵
  PID:6612
- C:\Windows\System\TnBpZNA.exe
  C:\Windows\System\TnBpZNA.exe
  2⤵
  PID:6648
- C:\Windows\System\fwAQiCs.exe
  C:\Windows\System\fwAQiCs.exe
  2⤵
  PID:6668
- C:\Windows\System\QvPJGfG.exe
  C:\Windows\System\QvPJGfG.exe
  2⤵
  PID:6716
- C:\Windows\System\JMSEBVe.exe
  C:\Windows\System\JMSEBVe.exe
  2⤵
  PID:6752
- C:\Windows\System\qRajScC.exe
  C:\Windows\System\qRajScC.exe
  2⤵
  PID:6772
- C:\Windows\System\KmmEKyY.exe
  C:\Windows\System\KmmEKyY.exe
  2⤵
  PID:6800
- C:\Windows\System\CzTdLBd.exe
  C:\Windows\System\CzTdLBd.exe
  2⤵
  PID:6828
- C:\Windows\System\ihXJMgM.exe
  C:\Windows\System\ihXJMgM.exe
  2⤵
  PID:6860
- C:\Windows\System\yeABqMT.exe
  C:\Windows\System\yeABqMT.exe
  2⤵
  PID:6888
- C:\Windows\System\OscQQvX.exe
  C:\Windows\System\OscQQvX.exe
  2⤵
  PID:6916
- C:\Windows\System\xmyeBgj.exe
  C:\Windows\System\xmyeBgj.exe
  2⤵
  PID:6944
- C:\Windows\System\JaybXqr.exe
  C:\Windows\System\JaybXqr.exe
  2⤵
  PID:6976
- C:\Windows\System\xbmJZym.exe
  C:\Windows\System\xbmJZym.exe
  2⤵
  PID:7008
- C:\Windows\System\NoatMzu.exe
  C:\Windows\System\NoatMzu.exe
  2⤵
  PID:7032
- C:\Windows\System\IyjCahJ.exe
  C:\Windows\System\IyjCahJ.exe
  2⤵
  PID:7060
- C:\Windows\System\rsNuklo.exe
  C:\Windows\System\rsNuklo.exe
  2⤵
  PID:7100
- C:\Windows\System\VsdVCYf.exe
  C:\Windows\System\VsdVCYf.exe
  2⤵
  PID:7132
- C:\Windows\System\YdCOZGK.exe
  C:\Windows\System\YdCOZGK.exe
  2⤵
  PID:7164
- C:\Windows\System\ZaphrGW.exe
  C:\Windows\System\ZaphrGW.exe
  2⤵
  PID:6200
- C:\Windows\System\BxdwawA.exe
  C:\Windows\System\BxdwawA.exe
  2⤵
  PID:6276
- C:\Windows\System\nROLUHJ.exe
  C:\Windows\System\nROLUHJ.exe
  2⤵
  PID:6368
- C:\Windows\System\tbBRbcv.exe
  C:\Windows\System\tbBRbcv.exe
  2⤵
  PID:6464
- C:\Windows\System\EYJlalt.exe
  C:\Windows\System\EYJlalt.exe
  2⤵
  PID:532
- C:\Windows\System\GyIetmW.exe
  C:\Windows\System\GyIetmW.exe
  2⤵
  PID:6656
- C:\Windows\System\egEcPSA.exe
  C:\Windows\System\egEcPSA.exe
  2⤵
  PID:6732
- C:\Windows\System\zJvfdvP.exe
  C:\Windows\System\zJvfdvP.exe
  2⤵
  PID:6788
- C:\Windows\System\QdPYEuH.exe
  C:\Windows\System\QdPYEuH.exe
  2⤵
  PID:6852
- C:\Windows\System\XKvyEtx.exe
  C:\Windows\System\XKvyEtx.exe
  2⤵
  PID:6940
- C:\Windows\System\FXYaNNj.exe
  C:\Windows\System\FXYaNNj.exe
  2⤵
  PID:7016
- C:\Windows\System\VmrGUFC.exe
  C:\Windows\System\VmrGUFC.exe
  2⤵
  PID:5520
- C:\Windows\System\seezaBP.exe
  C:\Windows\System\seezaBP.exe
  2⤵
  PID:6164
- C:\Windows\System\LEcsakA.exe
  C:\Windows\System\LEcsakA.exe
  2⤵
  PID:6488
- C:\Windows\System\jsWufxS.exe
  C:\Windows\System\jsWufxS.exe
  2⤵
  PID:4580
- C:\Windows\System\ULiZeIy.exe
  C:\Windows\System\ULiZeIy.exe
  2⤵
  PID:6760
- C:\Windows\System\HqOnruW.exe
  C:\Windows\System\HqOnruW.exe
  2⤵
  PID:6932
- C:\Windows\System\LSzTuiV.exe
  C:\Windows\System\LSzTuiV.exe
  2⤵
  PID:7056
- C:\Windows\System\BppfXbr.exe
  C:\Windows\System\BppfXbr.exe
  2⤵
  PID:7116
- C:\Windows\System\JDnAbLf.exe
  C:\Windows\System\JDnAbLf.exe
  2⤵
  PID:6344
- C:\Windows\System\lLlmQcn.exe
  C:\Windows\System\lLlmQcn.exe
  2⤵
  PID:5760
- C:\Windows\System\eXPRDOQ.exe
  C:\Windows\System\eXPRDOQ.exe
  2⤵
  PID:1532
- C:\Windows\System\nwekjkJ.exe
  C:\Windows\System\nwekjkJ.exe
  2⤵
  PID:2288
- C:\Windows\System\Dpuagwa.exe
  C:\Windows\System\Dpuagwa.exe
  2⤵
  PID:7076
- C:\Windows\System\AlusQSD.exe
  C:\Windows\System\AlusQSD.exe
  2⤵
  PID:5972
- C:\Windows\System\jfHfGGU.exe
  C:\Windows\System\jfHfGGU.exe
  2⤵
  PID:7176
- C:\Windows\System\AkGoLYL.exe
  C:\Windows\System\AkGoLYL.exe
  2⤵
  PID:7200
- C:\Windows\System\eJBlnoC.exe
  C:\Windows\System\eJBlnoC.exe
  2⤵
  PID:7232
- C:\Windows\System\LuxWILR.exe
  C:\Windows\System\LuxWILR.exe
  2⤵
  PID:7260
- C:\Windows\System\jKFevVG.exe
  C:\Windows\System\jKFevVG.exe
  2⤵
  PID:7284
- C:\Windows\System\PPEfPuu.exe
  C:\Windows\System\PPEfPuu.exe
  2⤵
  PID:7312
- C:\Windows\System\EetvVeI.exe
  C:\Windows\System\EetvVeI.exe
  2⤵
  PID:7340
- C:\Windows\System\sItaqvB.exe
  C:\Windows\System\sItaqvB.exe
  2⤵
  PID:7368
- C:\Windows\System\TVHoUor.exe
  C:\Windows\System\TVHoUor.exe
  2⤵
  PID:7404
- C:\Windows\System\eEiLVlz.exe
  C:\Windows\System\eEiLVlz.exe
  2⤵
  PID:7424
- C:\Windows\System\tGYXgOQ.exe
  C:\Windows\System\tGYXgOQ.exe
  2⤵
  PID:7452
- C:\Windows\System\ckKIKCO.exe
  C:\Windows\System\ckKIKCO.exe
  2⤵
  PID:7480
- C:\Windows\System\sRYuCyp.exe
  C:\Windows\System\sRYuCyp.exe
  2⤵
  PID:7512
- C:\Windows\System\PenSqaj.exe
  C:\Windows\System\PenSqaj.exe
  2⤵
  PID:7548
- C:\Windows\System\doNVAAV.exe
  C:\Windows\System\doNVAAV.exe
  2⤵
  PID:7576
- C:\Windows\System\uPmFgjC.exe
  C:\Windows\System\uPmFgjC.exe
  2⤵
  PID:7612
- C:\Windows\System\nVhcTnI.exe
  C:\Windows\System\nVhcTnI.exe
  2⤵
  PID:7640
- C:\Windows\System\FyMIpZK.exe
  C:\Windows\System\FyMIpZK.exe
  2⤵
  PID:7668
- C:\Windows\System\wccqzPg.exe
  C:\Windows\System\wccqzPg.exe
  2⤵
  PID:7696
- C:\Windows\System\xsgMfOG.exe
  C:\Windows\System\xsgMfOG.exe
  2⤵
  PID:7740
- C:\Windows\System\ktbpIAE.exe
  C:\Windows\System\ktbpIAE.exe
  2⤵
  PID:7780
- C:\Windows\System\jEfpvPd.exe
  C:\Windows\System\jEfpvPd.exe
  2⤵
  PID:7828
- C:\Windows\System\AcQjzUq.exe
  C:\Windows\System\AcQjzUq.exe
  2⤵
  PID:7872
- C:\Windows\System\IkvHZau.exe
  C:\Windows\System\IkvHZau.exe
  2⤵
  PID:7920
- C:\Windows\System\BMgdJQv.exe
  C:\Windows\System\BMgdJQv.exe
  2⤵
  PID:7948
- C:\Windows\System\qxtqJyF.exe
  C:\Windows\System\qxtqJyF.exe
  2⤵
  PID:7976
- C:\Windows\System\BhGEcMa.exe
  C:\Windows\System\BhGEcMa.exe
  2⤵
  PID:8036
- C:\Windows\System\LATDwCQ.exe
  C:\Windows\System\LATDwCQ.exe
  2⤵
  PID:8072
- C:\Windows\System\jUsfqbM.exe
  C:\Windows\System\jUsfqbM.exe
  2⤵
  PID:8088
- C:\Windows\System\RsKZwXg.exe
  C:\Windows\System\RsKZwXg.exe
  2⤵
  PID:8132
- C:\Windows\System\LUJSnZB.exe
  C:\Windows\System\LUJSnZB.exe
  2⤵
  PID:8176
- C:\Windows\System\SnupivW.exe
  C:\Windows\System\SnupivW.exe
  2⤵
  PID:7224
- C:\Windows\System\ECCeUqM.exe
  C:\Windows\System\ECCeUqM.exe
  2⤵
  PID:7308
- C:\Windows\System\QXwsPJQ.exe
  C:\Windows\System\QXwsPJQ.exe
  2⤵
  PID:7356
- C:\Windows\System\aROqKkf.exe
  C:\Windows\System\aROqKkf.exe
  2⤵
  PID:5536
- C:\Windows\System\DUMVBwM.exe
  C:\Windows\System\DUMVBwM.exe
  2⤵
  PID:7492
- C:\Windows\System\nllPRbz.exe
  C:\Windows\System\nllPRbz.exe
  2⤵
  PID:7568
- C:\Windows\System\LWduRht.exe
  C:\Windows\System\LWduRht.exe
  2⤵
  PID:7652
- C:\Windows\System\dTrqJnn.exe
  C:\Windows\System\dTrqJnn.exe
  2⤵
  PID:7732
- C:\Windows\System\oScJrQk.exe
  C:\Windows\System\oScJrQk.exe
  2⤵
  PID:7824
- C:\Windows\System\jLbGLjy.exe
  C:\Windows\System\jLbGLjy.exe
  2⤵
  PID:7940
- C:\Windows\System\gPmUFcQ.exe
  C:\Windows\System\gPmUFcQ.exe
  2⤵
  PID:8048
- C:\Windows\System\ZcWXHcS.exe
  C:\Windows\System\ZcWXHcS.exe
  2⤵
  PID:8160
- C:\Windows\System\iAGtXqP.exe
  C:\Windows\System\iAGtXqP.exe
  2⤵
  PID:3504
- C:\Windows\System\jJONADR.exe
  C:\Windows\System\jJONADR.exe
  2⤵
  PID:7332
- C:\Windows\System\hjzHsvp.exe
  C:\Windows\System\hjzHsvp.exe
  2⤵
  PID:7444
- C:\Windows\System\CstzEph.exe
  C:\Windows\System\CstzEph.exe
  2⤵
  PID:7688
- C:\Windows\System\VPWDflo.exe
  C:\Windows\System\VPWDflo.exe
  2⤵
  PID:7932
- C:\Windows\System\NQpilTj.exe
  C:\Windows\System\NQpilTj.exe
  2⤵
  PID:7216
- C:\Windows\System\sxyuxiz.exe
  C:\Windows\System\sxyuxiz.exe
  2⤵
  PID:5996
- C:\Windows\System\wWxhUyl.exe
  C:\Windows\System\wWxhUyl.exe
  2⤵
  PID:7760
- C:\Windows\System\kvApVIi.exe
  C:\Windows\System\kvApVIi.exe
  2⤵
  PID:4008
- C:\Windows\System\CezUZzY.exe
  C:\Windows\System\CezUZzY.exe
  2⤵
  PID:7268
- C:\Windows\System\SObihum.exe
  C:\Windows\System\SObihum.exe
  2⤵
  PID:8212
- C:\Windows\System\kGqxfCB.exe
  C:\Windows\System\kGqxfCB.exe
  2⤵
  PID:8236
- C:\Windows\System\rHOLbxD.exe
  C:\Windows\System\rHOLbxD.exe
  2⤵
  PID:8268
- C:\Windows\System\WhyVLSj.exe
  C:\Windows\System\WhyVLSj.exe
  2⤵
  PID:8292
- C:\Windows\System\JssbStY.exe
  C:\Windows\System\JssbStY.exe
  2⤵
  PID:8320
- C:\Windows\System\dAhhFDl.exe
  C:\Windows\System\dAhhFDl.exe
  2⤵
  PID:8348
- C:\Windows\System\FLJtqCf.exe
  C:\Windows\System\FLJtqCf.exe
  2⤵
  PID:8380
- C:\Windows\System\lqGfbnr.exe
  C:\Windows\System\lqGfbnr.exe
  2⤵
  PID:8408
- C:\Windows\System\BmEyeRs.exe
  C:\Windows\System\BmEyeRs.exe
  2⤵
  PID:8436
- C:\Windows\System\AucLxgT.exe
  C:\Windows\System\AucLxgT.exe
  2⤵
  PID:8464
- C:\Windows\System\rEEkYEK.exe
  C:\Windows\System\rEEkYEK.exe
  2⤵
  PID:8496
- C:\Windows\System\MdBemZa.exe
  C:\Windows\System\MdBemZa.exe
  2⤵
  PID:8520
- C:\Windows\System\slSmrpb.exe
  C:\Windows\System\slSmrpb.exe
  2⤵
  PID:8548
- C:\Windows\System\jHxoiaV.exe
  C:\Windows\System\jHxoiaV.exe
  2⤵
  PID:8580
- C:\Windows\System\vxUghfT.exe
  C:\Windows\System\vxUghfT.exe
  2⤵
  PID:8604
- C:\Windows\System\bWZYlXB.exe
  C:\Windows\System\bWZYlXB.exe
  2⤵
  PID:8632
- C:\Windows\System\wnzlNlw.exe
  C:\Windows\System\wnzlNlw.exe
  2⤵
  PID:8660
- C:\Windows\System\UAOcSvS.exe
  C:\Windows\System\UAOcSvS.exe
  2⤵
  PID:8688
- C:\Windows\System\rQNETuZ.exe
  C:\Windows\System\rQNETuZ.exe
  2⤵
  PID:8716
- C:\Windows\System\WjBhfjK.exe
  C:\Windows\System\WjBhfjK.exe
  2⤵
  PID:8744
- C:\Windows\System\iZOBHan.exe
  C:\Windows\System\iZOBHan.exe
  2⤵
  PID:8772
- C:\Windows\System\glwNXeS.exe
  C:\Windows\System\glwNXeS.exe
  2⤵
  PID:8800
- C:\Windows\System\JnPlzut.exe
  C:\Windows\System\JnPlzut.exe
  2⤵
  PID:8828
- C:\Windows\System\FCCwzNy.exe
  C:\Windows\System\FCCwzNy.exe
  2⤵
  PID:8856
- C:\Windows\System\XUjIpMO.exe
  C:\Windows\System\XUjIpMO.exe
  2⤵
  PID:8888
- C:\Windows\System\dkktNUG.exe
  C:\Windows\System\dkktNUG.exe
  2⤵
  PID:8920
- C:\Windows\System\VzYgOdT.exe
  C:\Windows\System\VzYgOdT.exe
  2⤵
  PID:8940
- C:\Windows\System\LpWgvsu.exe
  C:\Windows\System\LpWgvsu.exe
  2⤵
  PID:8968
- C:\Windows\System\VpjDTQN.exe
  C:\Windows\System\VpjDTQN.exe
  2⤵
  PID:8996
- C:\Windows\System\YcLLDBR.exe
  C:\Windows\System\YcLLDBR.exe
  2⤵
  PID:9024
- C:\Windows\System\azUZIzM.exe
  C:\Windows\System\azUZIzM.exe
  2⤵
  PID:9052
- C:\Windows\System\mGWLSmw.exe
  C:\Windows\System\mGWLSmw.exe
  2⤵
  PID:9080
- C:\Windows\System\TkmSQXi.exe
  C:\Windows\System\TkmSQXi.exe
  2⤵
  PID:9108
- C:\Windows\System\jCHYNRB.exe
  C:\Windows\System\jCHYNRB.exe
  2⤵
  PID:9144
- C:\Windows\System\ANQxxCZ.exe
  C:\Windows\System\ANQxxCZ.exe
  2⤵
  PID:9172
- C:\Windows\System\kfotLAC.exe
  C:\Windows\System\kfotLAC.exe
  2⤵
  PID:8156
- C:\Windows\System\drEEfMi.exe
  C:\Windows\System\drEEfMi.exe
  2⤵
  PID:8228
- C:\Windows\System\bHGVZIM.exe
  C:\Windows\System\bHGVZIM.exe
  2⤵
  PID:8284
- C:\Windows\System\DTSQFnc.exe
  C:\Windows\System\DTSQFnc.exe
  2⤵
  PID:3480
- C:\Windows\System\bcMIrFq.exe
  C:\Windows\System\bcMIrFq.exe
  2⤵
  PID:8420
- C:\Windows\System\AZlwgUU.exe
  C:\Windows\System\AZlwgUU.exe
  2⤵
  PID:8484
- C:\Windows\System\mSQKOfg.exe
  C:\Windows\System\mSQKOfg.exe
  2⤵
  PID:8544
- C:\Windows\System\MIylBww.exe
  C:\Windows\System\MIylBww.exe
  2⤵
  PID:8616
- C:\Windows\System\kCPNrTd.exe
  C:\Windows\System\kCPNrTd.exe
  2⤵
  PID:8680
- C:\Windows\System\dZtqNAO.exe
  C:\Windows\System\dZtqNAO.exe
  2⤵
  PID:8792
- C:\Windows\System\GrOPCGD.exe
  C:\Windows\System\GrOPCGD.exe
  2⤵
  PID:8848
- C:\Windows\System\rEMOhys.exe
  C:\Windows\System\rEMOhys.exe
  2⤵
  PID:8896
- C:\Windows\System\mMBqPNa.exe
  C:\Windows\System\mMBqPNa.exe
  2⤵
  PID:8960
- C:\Windows\System\iMykOzu.exe
  C:\Windows\System\iMykOzu.exe
  2⤵
  PID:9020
- C:\Windows\System\wbfRWnq.exe
  C:\Windows\System\wbfRWnq.exe
  2⤵
  PID:9096
- C:\Windows\System\rBdCRoJ.exe
  C:\Windows\System\rBdCRoJ.exe
  2⤵
  PID:9160
- C:\Windows\System\eFVZHGD.exe
  C:\Windows\System\eFVZHGD.exe
  2⤵
  PID:9128
- C:\Windows\System\QoVHaeg.exe
  C:\Windows\System\QoVHaeg.exe
  2⤵
  PID:8340
- C:\Windows\System\ScNNInU.exe
  C:\Windows\System\ScNNInU.exe
  2⤵
  PID:8504
- C:\Windows\System\uhVHvWu.exe
  C:\Windows\System\uhVHvWu.exe
  2⤵
  PID:8652
- C:\Windows\System\aXKfHzA.exe
  C:\Windows\System\aXKfHzA.exe
  2⤵
  PID:8812
- C:\Windows\System\FVMrMOp.exe
  C:\Windows\System\FVMrMOp.exe
  2⤵
  PID:8952
- C:\Windows\System\WJaGXXw.exe
  C:\Windows\System\WJaGXXw.exe
  2⤵
  PID:9120
- C:\Windows\System\XvjytWZ.exe
  C:\Windows\System\XvjytWZ.exe
  2⤵
  PID:8288
- C:\Windows\System\OClmtrJ.exe
  C:\Windows\System\OClmtrJ.exe
  2⤵
  PID:8596
- C:\Windows\System\YVvAFPg.exe
  C:\Windows\System\YVvAFPg.exe
  2⤵
  PID:9044
- C:\Windows\System\QCFdpEv.exe
  C:\Windows\System\QCFdpEv.exe
  2⤵
  PID:8540
- C:\Windows\System\WOWYVyX.exe
  C:\Windows\System\WOWYVyX.exe
  2⤵
  PID:8448
- C:\Windows\System\DBmgMel.exe
  C:\Windows\System\DBmgMel.exe
  2⤵
  PID:9232
- C:\Windows\System\YkgkIoL.exe
  C:\Windows\System\YkgkIoL.exe
  2⤵
  PID:9264
- C:\Windows\System\eDoDZbd.exe
  C:\Windows\System\eDoDZbd.exe
  2⤵
  PID:9292
- C:\Windows\System\bkgosqQ.exe
  C:\Windows\System\bkgosqQ.exe
  2⤵
  PID:9320
- C:\Windows\System\aMOlCPI.exe
  C:\Windows\System\aMOlCPI.exe
  2⤵
  PID:9348
- C:\Windows\System\udSSQDp.exe
  C:\Windows\System\udSSQDp.exe
  2⤵
  PID:9376
- C:\Windows\System\egMKJiK.exe
  C:\Windows\System\egMKJiK.exe
  2⤵
  PID:9404
- C:\Windows\System\QVzzrnX.exe
  C:\Windows\System\QVzzrnX.exe
  2⤵
  PID:9432
- C:\Windows\System\FrUrOrH.exe
  C:\Windows\System\FrUrOrH.exe
  2⤵
  PID:9460
- C:\Windows\System\gLEQXLi.exe
  C:\Windows\System\gLEQXLi.exe
  2⤵
  PID:9488
- C:\Windows\System\EwlrKEI.exe
  C:\Windows\System\EwlrKEI.exe
  2⤵
  PID:9516
- C:\Windows\System\bXzJKTb.exe
  C:\Windows\System\bXzJKTb.exe
  2⤵
  PID:9544
- C:\Windows\System\eqZmJhK.exe
  C:\Windows\System\eqZmJhK.exe
  2⤵
  PID:9584
- C:\Windows\System\CoFrLyh.exe
  C:\Windows\System\CoFrLyh.exe
  2⤵
  PID:9604
- C:\Windows\System\PIWQrBj.exe
  C:\Windows\System\PIWQrBj.exe
  2⤵
  PID:9632
- C:\Windows\System\QaNNrst.exe
  C:\Windows\System\QaNNrst.exe
  2⤵
  PID:9656
- C:\Windows\System\cExlTsS.exe
  C:\Windows\System\cExlTsS.exe
  2⤵
  PID:9680
- C:\Windows\System\IbSPOGg.exe
  C:\Windows\System\IbSPOGg.exe
  2⤵
  PID:9720
- C:\Windows\System\ejZkGTO.exe
  C:\Windows\System\ejZkGTO.exe
  2⤵
  PID:9748
- C:\Windows\System\vHtDOyU.exe
  C:\Windows\System\vHtDOyU.exe
  2⤵
  PID:9776
- C:\Windows\System\tVUSMgV.exe
  C:\Windows\System\tVUSMgV.exe
  2⤵
  PID:9804
- C:\Windows\System\BkxaEbM.exe
  C:\Windows\System\BkxaEbM.exe
  2⤵
  PID:9832
- C:\Windows\System\zLpUPzo.exe
  C:\Windows\System\zLpUPzo.exe
  2⤵
  PID:9860
- C:\Windows\System\sHOdzWs.exe
  C:\Windows\System\sHOdzWs.exe
  2⤵
  PID:9888
- C:\Windows\System\qcsFRLE.exe
  C:\Windows\System\qcsFRLE.exe
  2⤵
  PID:9924
- C:\Windows\System\HKouerP.exe
  C:\Windows\System\HKouerP.exe
  2⤵
  PID:9976
- C:\Windows\System\imrHucg.exe
  C:\Windows\System\imrHucg.exe
  2⤵
  PID:10004
- C:\Windows\System\xNbsvtv.exe
  C:\Windows\System\xNbsvtv.exe
  2⤵
  PID:10040
- C:\Windows\System\mUsJSrf.exe
  C:\Windows\System\mUsJSrf.exe
  2⤵
  PID:10068
- C:\Windows\System\DdalRTU.exe
  C:\Windows\System\DdalRTU.exe
  2⤵
  PID:10096
- C:\Windows\System\bQDNyPd.exe
  C:\Windows\System\bQDNyPd.exe
  2⤵
  PID:10136
- C:\Windows\System\VvjYWDv.exe
  C:\Windows\System\VvjYWDv.exe
  2⤵
  PID:10160
- C:\Windows\System\ecbzBZC.exe
  C:\Windows\System\ecbzBZC.exe
  2⤵
  PID:10196
- C:\Windows\System\osCfPwd.exe
  C:\Windows\System\osCfPwd.exe
  2⤵
  PID:10228
- C:\Windows\System\cFWXrrS.exe
  C:\Windows\System\cFWXrrS.exe
  2⤵
  PID:9308
- C:\Windows\System\NdGMMkU.exe
  C:\Windows\System\NdGMMkU.exe
  2⤵
  PID:9360
- C:\Windows\System\ctYDLqF.exe
  C:\Windows\System\ctYDLqF.exe
  2⤵
  PID:9424
- C:\Windows\System\qKGEuug.exe
  C:\Windows\System\qKGEuug.exe
  2⤵
  PID:9532
- C:\Windows\System\KaIPopA.exe
  C:\Windows\System\KaIPopA.exe
  2⤵
  PID:9624
- C:\Windows\System\ZAALfQo.exe
  C:\Windows\System\ZAALfQo.exe
  2⤵
  PID:9692
- C:\Windows\System\ANMYQXw.exe
  C:\Windows\System\ANMYQXw.exe
  2⤵
  PID:9792
- C:\Windows\System\nmBNKPQ.exe
  C:\Windows\System\nmBNKPQ.exe
  2⤵
  PID:9852
- C:\Windows\System\vtSepIQ.exe
  C:\Windows\System\vtSepIQ.exe
  2⤵
  PID:9920
- C:\Windows\System\BNIWKqF.exe
  C:\Windows\System\BNIWKqF.exe
  2⤵
  PID:10032
- C:\Windows\System\jNSdoOZ.exe
  C:\Windows\System\jNSdoOZ.exe
  2⤵
  PID:10112
- C:\Windows\System\oVRyILS.exe
  C:\Windows\System\oVRyILS.exe
  2⤵
  PID:9952
- C:\Windows\System\CAXBcXz.exe
  C:\Windows\System\CAXBcXz.exe
  2⤵
  PID:10184
- C:\Windows\System\OmjelQi.exe
  C:\Windows\System\OmjelQi.exe
  2⤵
  PID:9284
- C:\Windows\System\alsdQOX.exe
  C:\Windows\System\alsdQOX.exe
  2⤵
  PID:9912
- C:\Windows\System\gqkbpnq.exe
  C:\Windows\System\gqkbpnq.exe
  2⤵
  PID:9620
- C:\Windows\System\uRyOXUO.exe
  C:\Windows\System\uRyOXUO.exe
  2⤵
  PID:9764
- C:\Windows\System\exeDVtR.exe
  C:\Windows\System\exeDVtR.exe
  2⤵
  PID:10000
- C:\Windows\System\VDlctEE.exe
  C:\Windows\System\VDlctEE.exe
  2⤵
  PID:9956
- C:\Windows\System\lVspMKd.exe
  C:\Windows\System\lVspMKd.exe
  2⤵
  PID:9344
- C:\Windows\System\DVBwcap.exe
  C:\Windows\System\DVBwcap.exe
  2⤵
  PID:9740
- C:\Windows\System\wcQAMyy.exe
  C:\Windows\System\wcQAMyy.exe
  2⤵
  PID:10120
- C:\Windows\System\vWRrfbF.exe
  C:\Windows\System\vWRrfbF.exe
  2⤵
  PID:9972
- C:\Windows\System\FzdIKGM.exe
  C:\Windows\System\FzdIKGM.exe
  2⤵
  PID:9676
- C:\Windows\System\ZYPwKFk.exe
  C:\Windows\System\ZYPwKFk.exe
  2⤵
  PID:10272
- C:\Windows\System\QYBqIhR.exe
  C:\Windows\System\QYBqIhR.exe
  2⤵
  PID:10300
- C:\Windows\System\IDVbmYZ.exe
  C:\Windows\System\IDVbmYZ.exe
  2⤵
  PID:10328
- C:\Windows\System\jinRmbW.exe
  C:\Windows\System\jinRmbW.exe
  2⤵
  PID:10356
- C:\Windows\System\PahphId.exe
  C:\Windows\System\PahphId.exe
  2⤵
  PID:10384
- C:\Windows\System\aTjTpsE.exe
  C:\Windows\System\aTjTpsE.exe
  2⤵
  PID:10412
- C:\Windows\System\nundukj.exe
  C:\Windows\System\nundukj.exe
  2⤵
  PID:10440
- C:\Windows\System\bCnxKwi.exe
  C:\Windows\System\bCnxKwi.exe
  2⤵
  PID:10468
- C:\Windows\System\WRqwPMS.exe
  C:\Windows\System\WRqwPMS.exe
  2⤵
  PID:10496
- C:\Windows\System\EIHpwcM.exe
  C:\Windows\System\EIHpwcM.exe
  2⤵
  PID:10524
- C:\Windows\System\CvWIzed.exe
  C:\Windows\System\CvWIzed.exe
  2⤵
  PID:10560
- C:\Windows\System\eDXIrRz.exe
  C:\Windows\System\eDXIrRz.exe
  2⤵
  PID:10588
- C:\Windows\System\LQEgDOu.exe
  C:\Windows\System\LQEgDOu.exe
  2⤵
  PID:10624
- C:\Windows\System\JkdkpUg.exe
  C:\Windows\System\JkdkpUg.exe
  2⤵
  PID:10656
- C:\Windows\System\QSxyOCs.exe
  C:\Windows\System\QSxyOCs.exe
  2⤵
  PID:10684
- C:\Windows\System\TABbGmO.exe
  C:\Windows\System\TABbGmO.exe
  2⤵
  PID:10712
- C:\Windows\System\DFlWnzz.exe
  C:\Windows\System\DFlWnzz.exe
  2⤵
  PID:10744
- C:\Windows\System\vVrifAs.exe
  C:\Windows\System\vVrifAs.exe
  2⤵
  PID:10772
- C:\Windows\System\YvmmJeJ.exe
  C:\Windows\System\YvmmJeJ.exe
  2⤵
  PID:10800
- C:\Windows\System\TRnXXSb.exe
  C:\Windows\System\TRnXXSb.exe
  2⤵
  PID:10828
- C:\Windows\System\YFYECSo.exe
  C:\Windows\System\YFYECSo.exe
  2⤵
  PID:10856
- C:\Windows\System\wsyclwp.exe
  C:\Windows\System\wsyclwp.exe
  2⤵
  PID:10884
- C:\Windows\System\AHPxIFT.exe
  C:\Windows\System\AHPxIFT.exe
  2⤵
  PID:10920
- C:\Windows\System\hebXkVg.exe
  C:\Windows\System\hebXkVg.exe
  2⤵
  PID:10972
- C:\Windows\System\PrAHDfe.exe
  C:\Windows\System\PrAHDfe.exe
  2⤵
  PID:10996
- C:\Windows\System\WGDSjIp.exe
  C:\Windows\System\WGDSjIp.exe
  2⤵
  PID:11020
- C:\Windows\System\keooayP.exe
  C:\Windows\System\keooayP.exe
  2⤵
  PID:11060
- C:\Windows\System\VIbNWYS.exe
  C:\Windows\System\VIbNWYS.exe
  2⤵
  PID:11092
- C:\Windows\System\VFIrKZx.exe
  C:\Windows\System\VFIrKZx.exe
  2⤵
  PID:11120
- C:\Windows\System\JAczEih.exe
  C:\Windows\System\JAczEih.exe
  2⤵
  PID:11148
- C:\Windows\System\wIhNyNL.exe
  C:\Windows\System\wIhNyNL.exe
  2⤵
  PID:11176
- C:\Windows\System\fcydpYM.exe
  C:\Windows\System\fcydpYM.exe
  2⤵
  PID:11204
- C:\Windows\System\mmBVDrG.exe
  C:\Windows\System\mmBVDrG.exe
  2⤵
  PID:11232
- C:\Windows\System\hwcExme.exe
  C:\Windows\System\hwcExme.exe
  2⤵
  PID:11260
- C:\Windows\System\ajXaDrn.exe
  C:\Windows\System\ajXaDrn.exe
  2⤵
  PID:10312
- C:\Windows\System\yrLpIhR.exe
  C:\Windows\System\yrLpIhR.exe
  2⤵
  PID:10376
- C:\Windows\System\PkYQqAg.exe
  C:\Windows\System\PkYQqAg.exe
  2⤵
  PID:10436
- C:\Windows\System\KYmWIfD.exe
  C:\Windows\System\KYmWIfD.exe
  2⤵
  PID:10488
- C:\Windows\System\YgZCsHJ.exe
  C:\Windows\System\YgZCsHJ.exe
  2⤵
  PID:10572
- C:\Windows\System\JfvWvHc.exe
  C:\Windows\System\JfvWvHc.exe
  2⤵
  PID:10648
- C:\Windows\System\HqLlZsg.exe
  C:\Windows\System\HqLlZsg.exe
  2⤵
  PID:10704
- C:\Windows\System\lNBgYrl.exe
  C:\Windows\System\lNBgYrl.exe
  2⤵
  PID:9644
- C:\Windows\System\QwFNCyj.exe
  C:\Windows\System\QwFNCyj.exe
  2⤵
  PID:9476
- C:\Windows\System\kjmLYID.exe
  C:\Windows\System\kjmLYID.exe
  2⤵
  PID:10792
- C:\Windows\System\BUquSUI.exe
  C:\Windows\System\BUquSUI.exe
  2⤵
  PID:9244
- C:\Windows\System\wSBVgtW.exe
  C:\Windows\System\wSBVgtW.exe
  2⤵
  PID:10912
- C:\Windows\System\UQfCyxM.exe
  C:\Windows\System\UQfCyxM.exe
  2⤵
  PID:10992
- C:\Windows\System\SXnizcu.exe
  C:\Windows\System\SXnizcu.exe
  2⤵
  PID:11052
- C:\Windows\System\uiknQZd.exe
  C:\Windows\System\uiknQZd.exe
  2⤵
  PID:11108
- C:\Windows\System\jNmAxmV.exe
  C:\Windows\System\jNmAxmV.exe
  2⤵
  PID:10952
- C:\Windows\System\DAhtPCE.exe
  C:\Windows\System\DAhtPCE.exe
  2⤵
  PID:10936
- C:\Windows\System\yCpxCpb.exe
  C:\Windows\System\yCpxCpb.exe
  2⤵
  PID:11248
- C:\Windows\System\TEeEQxG.exe
  C:\Windows\System\TEeEQxG.exe
  2⤵
  PID:10344
- C:\Windows\System\bdVIsaY.exe
  C:\Windows\System\bdVIsaY.exe
  2⤵
  PID:10480
- C:\Windows\System\pzKimHJ.exe
  C:\Windows\System\pzKimHJ.exe
  2⤵
  PID:10708
- C:\Windows\System\fQHWigW.exe
  C:\Windows\System\fQHWigW.exe
  2⤵
  PID:10260
- C:\Windows\System\ihUGoDf.exe
  C:\Windows\System\ihUGoDf.exe
  2⤵
  PID:10868
- C:\Windows\System\eghpYYQ.exe
  C:\Windows\System\eghpYYQ.exe
  2⤵
  PID:11048
- C:\Windows\System\QYyVsjn.exe
  C:\Windows\System\QYyVsjn.exe
  2⤵
  PID:10928
- C:\Windows\System\wEBGyzA.exe
  C:\Windows\System\wEBGyzA.exe
  2⤵
  PID:10292
- C:\Windows\System\DsqQJwW.exe
  C:\Windows\System\DsqQJwW.exe
  2⤵
  PID:10512
- C:\Windows\System\sAKswhs.exe
  C:\Windows\System\sAKswhs.exe
  2⤵
  PID:10784
- C:\Windows\System\PbsWnvr.exe
  C:\Windows\System\PbsWnvr.exe
  2⤵
  PID:11200
- C:\Windows\System\RZkZaHi.exe
  C:\Windows\System\RZkZaHi.exe
  2⤵
  PID:10964
- C:\Windows\System\dsSZxeC.exe
  C:\Windows\System\dsSZxeC.exe
  2⤵
  PID:9900
- C:\Windows\System\ysUnWJM.exe
  C:\Windows\System\ysUnWJM.exe
  2⤵
  PID:11292
- C:\Windows\System\GInRezx.exe
  C:\Windows\System\GInRezx.exe
  2⤵
  PID:11320
- C:\Windows\System\YxqxuIZ.exe
  C:\Windows\System\YxqxuIZ.exe
  2⤵
  PID:11348
- C:\Windows\System\HSXKmRR.exe
  C:\Windows\System\HSXKmRR.exe
  2⤵
  PID:11364
- C:\Windows\System\RyDINej.exe
  C:\Windows\System\RyDINej.exe
  2⤵
  PID:11404
- C:\Windows\System\EZsmtBL.exe
  C:\Windows\System\EZsmtBL.exe
  2⤵
  PID:11428
- C:\Windows\System\RHisOyg.exe
  C:\Windows\System\RHisOyg.exe
  2⤵
  PID:11448
- C:\Windows\System\MhjnBlA.exe
  C:\Windows\System\MhjnBlA.exe
  2⤵
  PID:11468
- C:\Windows\System\IUazycf.exe
  C:\Windows\System\IUazycf.exe
  2⤵
  PID:11520
- C:\Windows\System\yJdBjOU.exe
  C:\Windows\System\yJdBjOU.exe
  2⤵
  PID:11548
- C:\Windows\System\cOfICWn.exe
  C:\Windows\System\cOfICWn.exe
  2⤵
  PID:11576
- C:\Windows\System\YUufXcx.exe
  C:\Windows\System\YUufXcx.exe
  2⤵
  PID:11604
- C:\Windows\System\wdRrusv.exe
  C:\Windows\System\wdRrusv.exe
  2⤵
  PID:11632
- C:\Windows\System\FGpkhKf.exe
  C:\Windows\System\FGpkhKf.exe
  2⤵
  PID:11660
- C:\Windows\System\GkHeEXG.exe
  C:\Windows\System\GkHeEXG.exe
  2⤵
  PID:11688
- C:\Windows\System\fesvEWG.exe
  C:\Windows\System\fesvEWG.exe
  2⤵
  PID:11716
- C:\Windows\System\ykBwBPH.exe
  C:\Windows\System\ykBwBPH.exe
  2⤵
  PID:11744
- C:\Windows\System\OQcOjOM.exe
  C:\Windows\System\OQcOjOM.exe
  2⤵
  PID:11768
- C:\Windows\System\RfktMmv.exe
  C:\Windows\System\RfktMmv.exe
  2⤵
  PID:11784
- C:\Windows\System\IWbxfVA.exe
  C:\Windows\System\IWbxfVA.exe
  2⤵
  PID:11828
- C:\Windows\System\uIOijny.exe
  C:\Windows\System\uIOijny.exe
  2⤵
  PID:11856
- C:\Windows\System\qYkTOiu.exe
  C:\Windows\System\qYkTOiu.exe
  2⤵
  PID:11884
- C:\Windows\System\yWVKkZP.exe
  C:\Windows\System\yWVKkZP.exe
  2⤵
  PID:11912
- C:\Windows\System\ipOgUvs.exe
  C:\Windows\System\ipOgUvs.exe
  2⤵
  PID:11940
- C:\Windows\System\yhjGDoK.exe
  C:\Windows\System\yhjGDoK.exe
  2⤵
  PID:11968
- C:\Windows\System\bItSXCo.exe
  C:\Windows\System\bItSXCo.exe
  2⤵
  PID:11996
- C:\Windows\System\zSULwMI.exe
  C:\Windows\System\zSULwMI.exe
  2⤵
  PID:12028
- C:\Windows\System\UjXHyBI.exe
  C:\Windows\System\UjXHyBI.exe
  2⤵
  PID:12056
- C:\Windows\System\JUqgxdL.exe
  C:\Windows\System\JUqgxdL.exe
  2⤵
  PID:12084
- C:\Windows\System\cKZHEKg.exe
  C:\Windows\System\cKZHEKg.exe
  2⤵
  PID:12112
- C:\Windows\System\PdmQCzI.exe
  C:\Windows\System\PdmQCzI.exe
  2⤵
  PID:12128
- C:\Windows\System\jbSwASu.exe
  C:\Windows\System\jbSwASu.exe
  2⤵
  PID:12168
- C:\Windows\System\QKJhSdl.exe
  C:\Windows\System\QKJhSdl.exe
  2⤵
  PID:12196
- C:\Windows\System\imjomUj.exe
  C:\Windows\System\imjomUj.exe
  2⤵
  PID:12224
- C:\Windows\System\sawYSrH.exe
  C:\Windows\System\sawYSrH.exe
  2⤵
  PID:12252
- C:\Windows\System\HYDHZWC.exe
  C:\Windows\System\HYDHZWC.exe
  2⤵
  PID:12280
- C:\Windows\System\eQoKqao.exe
  C:\Windows\System\eQoKqao.exe
  2⤵
  PID:11144
- C:\Windows\System\lploDsh.exe
  C:\Windows\System\lploDsh.exe
  2⤵
  PID:11340
- C:\Windows\System\VWhtiEu.exe
  C:\Windows\System\VWhtiEu.exe
  2⤵
  PID:11396
- C:\Windows\System\ERIqvwD.exe
  C:\Windows\System\ERIqvwD.exe
  2⤵
  PID:11464
- C:\Windows\System\WJOkfoC.exe
  C:\Windows\System\WJOkfoC.exe
  2⤵
  PID:11508
- C:\Windows\System\pOYoSPg.exe
  C:\Windows\System\pOYoSPg.exe
  2⤵
  PID:11588
- C:\Windows\System\dNiAfJD.exe
  C:\Windows\System\dNiAfJD.exe
  2⤵
  PID:11684
- C:\Windows\System\sNitFhe.exe
  C:\Windows\System\sNitFhe.exe
  2⤵
  PID:11708
- C:\Windows\System\OJuqydK.exe
  C:\Windows\System\OJuqydK.exe
  2⤵
  PID:11812
- C:\Windows\System\GldDsSZ.exe
  C:\Windows\System\GldDsSZ.exe
  2⤵
  PID:11840
- C:\Windows\System\NXmvpGf.exe
  C:\Windows\System\NXmvpGf.exe
  2⤵
  PID:11880
- C:\Windows\System\ohdwXWP.exe
  C:\Windows\System\ohdwXWP.exe
  2⤵
  PID:11952
- C:\Windows\System\dReKGLU.exe
  C:\Windows\System\dReKGLU.exe
  2⤵
  PID:12024
- C:\Windows\System\HDOKZZq.exe
  C:\Windows\System\HDOKZZq.exe
  2⤵
  PID:12120
- C:\Windows\System\BhLHFzp.exe
  C:\Windows\System\BhLHFzp.exe
  2⤵
  PID:12180
- C:\Windows\System\khWEbUs.exe
  C:\Windows\System\khWEbUs.exe
  2⤵
  PID:12220
- C:\Windows\System\GhLZlvr.exe
  C:\Windows\System\GhLZlvr.exe
  2⤵
  PID:11332
- C:\Windows\System\ODLtETV.exe
  C:\Windows\System\ODLtETV.exe
  2⤵
  PID:11532
- C:\Windows\System\CRECSXB.exe
  C:\Windows\System\CRECSXB.exe
  2⤵
  PID:11700
- C:\Windows\System\siJNRbd.exe
  C:\Windows\System\siJNRbd.exe
  2⤵
  PID:11956
- C:\Windows\System\RGVnAgL.exe
  C:\Windows\System\RGVnAgL.exe
  2⤵
  PID:12008
- C:\Windows\System\npEpaTa.exe
  C:\Windows\System\npEpaTa.exe
  2⤵
  PID:12192
- C:\Windows\System\mNaRITn.exe
  C:\Windows\System\mNaRITn.exe
  2⤵
  PID:11416
- C:\Windows\System\skAYtzJ.exe
  C:\Windows\System\skAYtzJ.exe
  2⤵
  PID:11824
- C:\Windows\System\XCvyFMu.exe
  C:\Windows\System\XCvyFMu.exe
  2⤵
  PID:12300
- C:\Windows\System\kplPayW.exe
  C:\Windows\System\kplPayW.exe
  2⤵
  PID:12324
- C:\Windows\System\RqwHYPs.exe
  C:\Windows\System\RqwHYPs.exe
  2⤵
  PID:12348
- C:\Windows\System\AWAQNuI.exe
  C:\Windows\System\AWAQNuI.exe
  2⤵
  PID:12376
- C:\Windows\System\gocUezu.exe
  C:\Windows\System\gocUezu.exe
  2⤵
  PID:12408
- C:\Windows\System\clyzMPU.exe
  C:\Windows\System\clyzMPU.exe
  2⤵
  PID:12484
- C:\Windows\System\LtNDXXK.exe
  C:\Windows\System\LtNDXXK.exe
  2⤵
  PID:12516
- C:\Windows\System\WFOHGwJ.exe
  C:\Windows\System\WFOHGwJ.exe
  2⤵
  PID:12564
- C:\Windows\System\xmDstDv.exe
  C:\Windows\System\xmDstDv.exe
  2⤵
  PID:12584
- C:\Windows\System\zVwtMzr.exe
  C:\Windows\System\zVwtMzr.exe
  2⤵
  PID:12612
- C:\Windows\System\MILPMFt.exe
  C:\Windows\System\MILPMFt.exe
  2⤵
  PID:12656
- C:\Windows\System\EKHWnRz.exe
  C:\Windows\System\EKHWnRz.exe
  2⤵
  PID:12680
- C:\Windows\System\Ngbmxmd.exe
  C:\Windows\System\Ngbmxmd.exe
  2⤵
  PID:12696
- C:\Windows\System\DjwKYQG.exe
  C:\Windows\System\DjwKYQG.exe
  2⤵
  PID:12716
- C:\Windows\System\kIrTULU.exe
  C:\Windows\System\kIrTULU.exe
  2⤵
  PID:12748
- C:\Windows\System\BzUqCDT.exe
  C:\Windows\System\BzUqCDT.exe
  2⤵
  PID:12800
- C:\Windows\System\tnptQEL.exe
  C:\Windows\System\tnptQEL.exe
  2⤵
  PID:12828
- C:\Windows\System\ErFENZW.exe
  C:\Windows\System\ErFENZW.exe
  2⤵
  PID:12844
- C:\Windows\System\NsumHat.exe
  C:\Windows\System\NsumHat.exe
  2⤵
  PID:12864
- C:\Windows\System\BuOHNtj.exe
  C:\Windows\System\BuOHNtj.exe
  2⤵
  PID:12912
- C:\Windows\System\SBjeBzy.exe
  C:\Windows\System\SBjeBzy.exe
  2⤵
  PID:12928
- C:\Windows\System\MFvwMrZ.exe
  C:\Windows\System\MFvwMrZ.exe
  2⤵
  PID:12956
- C:\Windows\System\OqsWQyf.exe
  C:\Windows\System\OqsWQyf.exe
  2⤵
  PID:12988
- C:\Windows\System\FCXzqGQ.exe
  C:\Windows\System\FCXzqGQ.exe
  2⤵
  PID:13012
- C:\Windows\System\OdJqpCU.exe
  C:\Windows\System\OdJqpCU.exe
  2⤵
  PID:13052
- C:\Windows\System\qvxYoGi.exe
  C:\Windows\System\qvxYoGi.exe
  2⤵
  PID:13068
- C:\Windows\System\XgAPjeG.exe
  C:\Windows\System\XgAPjeG.exe
  2⤵
  PID:13100
- C:\Windows\System\HtXUNam.exe
  C:\Windows\System\HtXUNam.exe
  2⤵
  PID:13140
- C:\Windows\System\RrDHIJm.exe
  C:\Windows\System\RrDHIJm.exe
  2⤵
  PID:13156
- C:\Windows\System\qoAiKDZ.exe
  C:\Windows\System\qoAiKDZ.exe
  2⤵
  PID:13188
- C:\Windows\System\caUolYZ.exe
  C:\Windows\System\caUolYZ.exe
  2⤵
  PID:13216
- C:\Windows\System\UAYwRTb.exe
  C:\Windows\System\UAYwRTb.exe
  2⤵
  PID:13252
- C:\Windows\System\KNCXuQm.exe
  C:\Windows\System\KNCXuQm.exe
  2⤵
  PID:13280
- C:\Windows\System\XxwIKXq.exe
  C:\Windows\System\XxwIKXq.exe
  2⤵
  PID:13296
- C:\Windows\System\jOiEhXK.exe
  C:\Windows\System\jOiEhXK.exe
  2⤵
  PID:11544
- C:\Windows\System\DuCTWMz.exe
  C:\Windows\System\DuCTWMz.exe
  2⤵
  PID:12368
- C:\Windows\System\oTAzRKG.exe
  C:\Windows\System\oTAzRKG.exe
  2⤵
  PID:12472
- C:\Windows\System\yUVGDct.exe
  C:\Windows\System\yUVGDct.exe
  2⤵
  PID:12508
- C:\Windows\System\RwsSVsS.exe
  C:\Windows\System\RwsSVsS.exe
  2⤵
  PID:12628
- C:\Windows\System\KTCnqCz.exe
  C:\Windows\System\KTCnqCz.exe
  2⤵
  PID:12664
- C:\Windows\System\rUgdEdu.exe
  C:\Windows\System\rUgdEdu.exe
  2⤵
  PID:12784
- C:\Windows\System\PMghGFq.exe
  C:\Windows\System\PMghGFq.exe
  2⤵
  PID:12856
- C:\Windows\System\aJYcQKr.exe
  C:\Windows\System\aJYcQKr.exe
  2⤵
  PID:12908
- C:\Windows\System\ohHmFAK.exe
  C:\Windows\System\ohHmFAK.exe
  2⤵
  PID:12968
- C:\Windows\System\qYXhMPp.exe
  C:\Windows\System\qYXhMPp.exe
  2⤵
  PID:13000
- C:\Windows\System\JfcHhCQ.exe
  C:\Windows\System\JfcHhCQ.exe
  2⤵
  PID:13064
- C:\Windows\System\NCJZOxN.exe
  C:\Windows\System\NCJZOxN.exe
  2⤵
  PID:13152
- C:\Windows\System\bmrgaTI.exe
  C:\Windows\System\bmrgaTI.exe
  2⤵
  PID:13224
- C:\Windows\System\WzRdgNi.exe
  C:\Windows\System\WzRdgNi.exe
  2⤵
  PID:13268
- C:\Windows\System\SgquOvv.exe
  C:\Windows\System\SgquOvv.exe
  2⤵
  PID:12316
- C:\Windows\System\MLduqBs.exe
  C:\Windows\System\MLduqBs.exe
  2⤵
  PID:12676
- C:\Windows\System\TFsruDq.exe
  C:\Windows\System\TFsruDq.exe
  2⤵
  PID:12740
- C:\Windows\System\LUvoWmG.exe
  C:\Windows\System\LUvoWmG.exe
  2⤵
  PID:12840
- C:\Windows\System\rxHosgb.exe
  C:\Windows\System\rxHosgb.exe
  2⤵
  PID:13036
- C:\Windows\System\rqpLjsd.exe
  C:\Windows\System\rqpLjsd.exe
  2⤵
  PID:13208
- C:\Windows\System\poHIfRp.exe
  C:\Windows\System\poHIfRp.exe
  2⤵
  PID:12312
- C:\Windows\System\PMbFZgE.exe
  C:\Windows\System\PMbFZgE.exe
  2⤵
  PID:12688
- C:\Windows\System\VgznHDN.exe
  C:\Windows\System\VgznHDN.exe
  2⤵
  PID:13132
- C:\Windows\System\VhuDgrK.exe
  C:\Windows\System\VhuDgrK.exe
  2⤵
  PID:12604
- C:\Windows\System\TAiuiyY.exe
  C:\Windows\System\TAiuiyY.exe
  2⤵
  PID:12872
- C:\Windows\System\JJhCLCY.exe
  C:\Windows\System\JJhCLCY.exe
  2⤵
  PID:1956
- C:\Windows\System\zFjjDts.exe
  C:\Windows\System\zFjjDts.exe
  2⤵
  PID:6300
- C:\Windows\System\SUiztak.exe
  C:\Windows\System\SUiztak.exe
  2⤵
  PID:7936
- C:\Windows\System\mjTlDjY.exe
  C:\Windows\System\mjTlDjY.exe
  2⤵
  PID:6528
- C:\Windows\System\javvCjK.exe
  C:\Windows\System\javvCjK.exe
  2⤵
  PID:4156
- C:\Windows\System\QhuQuxC.exe
  C:\Windows\System\QhuQuxC.exe
  2⤵
  PID:6728
- C:\Windows\System\hbpFkAQ.exe
  C:\Windows\System\hbpFkAQ.exe
  2⤵
  PID:12552
- C:\Windows\System\tGONMjI.exe
  C:\Windows\System\tGONMjI.exe
  2⤵
  PID:4228
- C:\Windows\System\OHZmIGz.exe
  C:\Windows\System\OHZmIGz.exe
  2⤵
  PID:13328
- C:\Windows\System\OZpakqS.exe
  C:\Windows\System\OZpakqS.exe
  2⤵
  PID:13356
- C:\Windows\System\oXKkYzn.exe
  C:\Windows\System\oXKkYzn.exe
  2⤵
  PID:13384
- C:\Windows\System\qoGWgkY.exe
  C:\Windows\System\qoGWgkY.exe
  2⤵
  PID:13404
- C:\Windows\System\kQdypMH.exe
  C:\Windows\System\kQdypMH.exe
  2⤵
  PID:13424
- C:\Windows\System\VjSHAoB.exe
  C:\Windows\System\VjSHAoB.exe
  2⤵
  PID:13444
- C:\Windows\System\ndBPQuG.exe
  C:\Windows\System\ndBPQuG.exe
  2⤵
  PID:13472
- C:\Windows\System\bRzmJdg.exe
  C:\Windows\System\bRzmJdg.exe
  2⤵
  PID:13536
- C:\Windows\System\yraFvaj.exe
  C:\Windows\System\yraFvaj.exe
  2⤵
  PID:13564
- C:\Windows\System\HwMXooo.exe
  C:\Windows\System\HwMXooo.exe
  2⤵
  PID:13596
- C:\Windows\System\KbqxXMG.exe
  C:\Windows\System\KbqxXMG.exe
  2⤵
  PID:13624
- C:\Windows\System\CCfCSEB.exe
  C:\Windows\System\CCfCSEB.exe
  2⤵
  PID:13652
- C:\Windows\System\sYcKmrD.exe
  C:\Windows\System\sYcKmrD.exe
  2⤵
  PID:13680
- C:\Windows\System\hPvjJkn.exe
  C:\Windows\System\hPvjJkn.exe
  2⤵
  PID:13708
- C:\Windows\System\YADfJLY.exe
  C:\Windows\System\YADfJLY.exe
  2⤵
  PID:13736
- C:\Windows\System\mHzxPPp.exe
  C:\Windows\System\mHzxPPp.exe
  2⤵
  PID:13764
- C:\Windows\System\qbiNwxo.exe
  C:\Windows\System\qbiNwxo.exe
  2⤵
  PID:13792
- C:\Windows\System\idjCKBS.exe
  C:\Windows\System\idjCKBS.exe
  2⤵
  PID:13820
- C:\Windows\System\dAfKxdJ.exe
  C:\Windows\System\dAfKxdJ.exe
  2⤵
  PID:13848
- C:\Windows\System\qBcxAkK.exe
  C:\Windows\System\qBcxAkK.exe
  2⤵
  PID:13876
- C:\Windows\System\AEjmLtT.exe
  C:\Windows\System\AEjmLtT.exe
  2⤵
  PID:13904
- C:\Windows\System\cPpHHSD.exe
  C:\Windows\System\cPpHHSD.exe
  2⤵
  PID:13932
- C:\Windows\System\cHEbAOP.exe
  C:\Windows\System\cHEbAOP.exe
  2⤵
  PID:13948
- C:\Windows\System\WzjGuha.exe
  C:\Windows\System\WzjGuha.exe
  2⤵
  PID:13968
- C:\Windows\System\tycMMch.exe
  C:\Windows\System\tycMMch.exe
  2⤵
  PID:14004
- C:\Windows\System\xFfZjuM.exe
  C:\Windows\System\xFfZjuM.exe
  2⤵
  PID:14032
- C:\Windows\System\nbonXrC.exe
  C:\Windows\System\nbonXrC.exe
  2⤵
  PID:14072
- C:\Windows\System\TZaZqnK.exe
  C:\Windows\System\TZaZqnK.exe
  2⤵
  PID:14100
- C:\Windows\System\ufmxDWa.exe
  C:\Windows\System\ufmxDWa.exe
  2⤵
  PID:14120
- C:\Windows\System\fFzfETE.exe
  C:\Windows\System\fFzfETE.exe
  2⤵
  PID:14156
- C:\Windows\System\bnohKhY.exe
  C:\Windows\System\bnohKhY.exe
  2⤵
  PID:14176
- C:\Windows\System\hOBoLSS.exe
  C:\Windows\System\hOBoLSS.exe
  2⤵
  PID:14212
- C:\Windows\System\xdYFusv.exe
  C:\Windows\System\xdYFusv.exe
  2⤵
  PID:14240
- C:\Windows\System\amHNiRP.exe
  C:\Windows\System\amHNiRP.exe
  2⤵
  PID:14268
- C:\Windows\System\fmDSMKe.exe
  C:\Windows\System\fmDSMKe.exe
  2⤵
  PID:14296
- C:\Windows\System\upfTZDL.exe
  C:\Windows\System\upfTZDL.exe
  2⤵
  PID:14324
- C:\Windows\System\HXQDDcG.exe
  C:\Windows\System\HXQDDcG.exe
  2⤵
  PID:13344
- C:\Windows\System\gFvIJCw.exe
  C:\Windows\System\gFvIJCw.exe
  2⤵
  PID:3604
- C:\Windows\System\PfNIPyD.exe
  C:\Windows\System\PfNIPyD.exe
  2⤵
  PID:13468
- C:\Windows\System\ZriYfEg.exe
  C:\Windows\System\ZriYfEg.exe
  2⤵
  PID:3756
- C:\Windows\System\rrOmvjQ.exe
  C:\Windows\System\rrOmvjQ.exe
  2⤵
  PID:13544
- C:\Windows\System\ZBdLheb.exe
  C:\Windows\System\ZBdLheb.exe
  2⤵
  PID:13616
- C:\Windows\System\CDIvdOT.exe
  C:\Windows\System\CDIvdOT.exe
  2⤵
  PID:13668
- C:\Windows\System\mXVhSTh.exe
  C:\Windows\System\mXVhSTh.exe
  2⤵
  PID:13720
- C:\Windows\System\RuIXyoH.exe
  C:\Windows\System\RuIXyoH.exe
  2⤵
  PID:13784
- C:\Windows\System\IIKdwLS.exe
  C:\Windows\System\IIKdwLS.exe
  2⤵
  PID:13868
- C:\Windows\System\nrqxkDo.exe
  C:\Windows\System\nrqxkDo.exe
  2⤵
  PID:13928
- C:\Windows\System\ZfbtGHv.exe
  C:\Windows\System\ZfbtGHv.exe
  2⤵
  PID:13984
- C:\Windows\System\xQtMHTM.exe
  C:\Windows\System\xQtMHTM.exe
  2⤵
  PID:14016
- C:\Windows\System\LXmGOyf.exe
  C:\Windows\System\LXmGOyf.exe
  2⤵
  PID:14128
- C:\Windows\System\HUaCaVZ.exe
  C:\Windows\System\HUaCaVZ.exe
  2⤵
  PID:14228
- C:\Windows\System\OsgMeAt.exe
  C:\Windows\System\OsgMeAt.exe
  2⤵
  PID:14252
- C:\Windows\System\KwvQNBi.exe
  C:\Windows\System\KwvQNBi.exe
  2⤵
  PID:14320
- C:\Windows\System\iTWEJfa.exe
  C:\Windows\System\iTWEJfa.exe
  2⤵
  PID:13420
- C:\Windows\System\AZkcneb.exe
  C:\Windows\System\AZkcneb.exe
  2⤵
  PID:2196
- C:\Windows\System\GtZtLJY.exe
  C:\Windows\System\GtZtLJY.exe
  2⤵
  PID:13700
- C:\Windows\System\NKjubSN.exe
  C:\Windows\System\NKjubSN.exe
  2⤵
  PID:13812
- C:\Windows\System\CePpZhN.exe
  C:\Windows\System\CePpZhN.exe
  2⤵
  PID:13944
- C:\Windows\System\fktwgyK.exe
  C:\Windows\System\fktwgyK.exe
  2⤵
  PID:13964
- C:\Windows\System\rqADTaB.exe
  C:\Windows\System\rqADTaB.exe
  2⤵
  PID:14164
- C:\Windows\System\GUrTfle.exe
  C:\Windows\System\GUrTfle.exe
  2⤵
  PID:13440
- C:\Windows\System\xiWKWLk.exe
  C:\Windows\System\xiWKWLk.exe
  2⤵
  PID:13892
- C:\Windows\System\hnXgSjT.exe
  C:\Windows\System\hnXgSjT.exe
  2⤵
  PID:14064
- C:\Windows\System\IfziPbp.exe
  C:\Windows\System\IfziPbp.exe
  2⤵
  PID:14312
- C:\Windows\System\EaPoIbP.exe
  C:\Windows\System\EaPoIbP.exe
  2⤵
  PID:7768
- C:\Windows\System\gdOtfFz.exe
  C:\Windows\System\gdOtfFz.exe
  2⤵
  PID:14352
- C:\Windows\System\MCjjIGy.exe
  C:\Windows\System\MCjjIGy.exe
  2⤵
  PID:14380
- C:\Windows\System\uyYIgDx.exe
  C:\Windows\System\uyYIgDx.exe
  2⤵
  PID:14408
- C:\Windows\System\MnyLJUm.exe
  C:\Windows\System\MnyLJUm.exe
  2⤵
  PID:14436
- C:\Windows\System\JWtHzYT.exe
  C:\Windows\System\JWtHzYT.exe
  2⤵
  PID:14464
- C:\Windows\System\uFYbLJZ.exe
  C:\Windows\System\uFYbLJZ.exe
  2⤵
  PID:14480
- C:\Windows\System\fuhSDVJ.exe
  C:\Windows\System\fuhSDVJ.exe
  2⤵
  PID:14520
- C:\Windows\System\TaxhYPT.exe
  C:\Windows\System\TaxhYPT.exe
  2⤵
  PID:14548
- C:\Windows\System\wFdWdxt.exe
  C:\Windows\System\wFdWdxt.exe
  2⤵
  PID:14576
- C:\Windows\System\rvjRbMx.exe
  C:\Windows\System\rvjRbMx.exe
  2⤵
  PID:14604
- C:\Windows\System\nhIPxPV.exe
  C:\Windows\System\nhIPxPV.exe
  2⤵
  PID:14632

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:14540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BUGSewI.exe

Filesize
2.6MB

MD5
f7a323fd11d6216d970a6066f6b38495

SHA1
5468479599d6f320b0e1eee9e7d160b00d9e463b

SHA256
b32da302158146710a7a46d3f9c63ae709e57bb2addf4632171172a6788e9d32

SHA512
f10449e72feceb51ab908d01d855910450caea69a71510acce4c40550015d512d2df6673a0a7bd0b5fcece53a8adadb2d57434c76f989732f8cdd9d66875979f

Download Submit
C:\Windows\System\CNyOTdY.exe

Filesize
2.6MB

MD5
c515b5f888ae06d102ea9acbb5472122

SHA1
2fdf20755e5b9f34bd8b29f4e7d8db86d65331f6

SHA256
148367a8eeb1065766e053b1d0d27aaa99788a49c1e28caf858f98199f6e99cc

SHA512
f6c7b32cca9b567997ec926b70bb627b727362905b3ae7167b5c42630a8978069732eb66294c2d0fee215a364e2bdd75a95fc2aeda1df0005f39c85fd227c192

Download Submit
C:\Windows\System\CZvgFbL.exe

Filesize
2.6MB

MD5
db52e95320401061bee7a60d6a27b94b

SHA1
dad41fec2fe3b31b5ef3bd56b2b87e2ec17b6735

SHA256
fd2ff47306fcbe06ef212a1fe9db29a2dcae3a35fb2e3082f96803638cf3cf88

SHA512
4fd5a79ceeee3ddc3ea038117e409a0c3b5bdb35f02cd84332a7b08303f136ead60110d8afae6b3226776ab053274f2b219a4f56b9aa01f6bf2c058c8dee3beb

Download Submit
C:\Windows\System\DsLrAOx.exe

Filesize
2.6MB

MD5
b5930adabbe34f5c028a77e8a399816a

SHA1
5072cf045328646f319e885358c02df3a1a318f3

SHA256
7670cf42bf8a79a2924e7cd65515f4a5136f9aa25bf8e24f146b416f4d82237f

SHA512
c34e9110ba6fe025dada5f0bcbaff3c8f743691488df93cf226d59d656bf808ec630525da12b1cd145d082e6e03542b961938ead6fab2c2bd4ab9521620952ca

Download Submit
C:\Windows\System\EcOQxWV.exe

Filesize
2.6MB

MD5
7b4fbcd9dfe7a834a91a01c34dab24c3

SHA1
98be3984d3c284fcf7ec6956b48bd8035d775715

SHA256
2dea1e0088e67d9c14ae51ec09be6f43c3b386a1f56a1287334c26d9490cd6f4

SHA512
e534d29afdc0ad775563756daa521d53492f9f4e53cf32781e843fe8f33a97a1791b421a67029bbc318e5493e0c3d6d12cede8bb6b086d9be9f9f13c3d6d9edb

Download Submit
C:\Windows\System\FQqZTzP.exe

Filesize
2.6MB

MD5
447d6a0cc44ada094bc7e3b9a58e8884

SHA1
398fc0eaa2805965176a7676b43112261093fde7

SHA256
48c48d15ecd1c777709420916de990ed1b003abc02f27b532d2db0a1d4f38332

SHA512
c886e9ed63564b57260e58ebe49f593953ad69759281065ed3504be0b5fe961ed27ff1c051cb74f55c4b0373ad3ca9ef9a52860f005c19da5f63d790b51926ef

Download Submit
C:\Windows\System\GHtmOrK.exe

Filesize
2.6MB

MD5
53be688e69996a262bdf493174ac8306

SHA1
ebc4547cc5ef74b6841e69f569b1d9138a517959

SHA256
33d9698b368d1e33d7f87f1750b4610cbce3fbcdd8774dff96dc18098631080e

SHA512
150cddc51b0fe914e9be2ceaa0068f7462fd2a1201c0abe61a0d05a8d47379a1e7b817ae4729f1769de10b95969b8d1d96de41404765a8c70d7a6d87b4b126da

Download Submit
C:\Windows\System\HCCDvdU.exe

Filesize
2.6MB

MD5
8e29dc81f89aa4a996776864fd91bb87

SHA1
a48bd5ef7856429855ff61e4266a7fe6ef6e7cae

SHA256
99542771b4625496a53b5908c325cdad7b5827ea835dbcfde77ae2db2dd2a3b3

SHA512
26b15341fd510da8b532c6bbcd933223c2c871679c725c9f7fe1a5f16d8fb9ce5a562cc3247e979fe93cc222bd29f1e3b42da42a7a2c5c54b2c84c0b854f5bf0

Download Submit
C:\Windows\System\HtrLqpn.exe

Filesize
2.6MB

MD5
3a59ec2432d0a8b8268abb50a9127c59

SHA1
ebda4b2c4526d34d366d96d4475b95c6c35f0fb0

SHA256
c4f8af8d9a05c2f9bb5b47be0de4b21e09598d467e42e7a30864f5ab02109b9c

SHA512
9f9b0231acf43fde73c357d05a2664e155c61fb32b4299cbc7652a8770a0e206f9cd099c52f67732bfa1a2381aa63421361674b0c97a114d6e96bd9046e70eed

Download Submit
C:\Windows\System\IlVBCub.exe

Filesize
2.6MB

MD5
f1ec7d060112cc00d85fae314551a2e4

SHA1
6bf75fa3d6fb089fd21f00cb6020390145ddfa47

SHA256
ebe6460fb13432b7fd24d075bf117db8e4334710b922c310bffcd90f715cb17f

SHA512
b954d854a1d4111fe3435ca9479891c192a5015c7e2bd924f8ab04a87b970cb2161bb047c213dd0e0f5621f0e5510e034afa6c9ca6fdf8992cdfbbc73e94be6e

Download Submit
C:\Windows\System\JCGsbXS.exe

Filesize
2.6MB

MD5
fb50f22bc857685716ed8330351fc204

SHA1
6654d2491cb2aecafb6075ba7845cceaa45e82e3

SHA256
c3394a9fcae3269bcc15349ecb6af64c41b468c4098f24eaba0c9a2c55a2021d

SHA512
62213735788ff7189b42b002f24d0d89bbbf36840bbf7937f11b28dc8695f051d633fca064f96197820b4c254e6a5b6fceacf68a76bd7456bc721c5aef0dc80f

Download Submit
C:\Windows\System\JoExKnA.exe

Filesize
2.6MB

MD5
00f08cd49446b8c4a3465db9374cb6ad

SHA1
a1a3b7fdf129a320b7f2393e1e93e877293af078

SHA256
1173f52775f3e02d5da62876c68d44053860b4360aa7f6808303d49932bfe62e

SHA512
55b038e0b6e0a003af2c98eb0ed77a2b63785f6fdff297f0648d49ebc6a2e451e532ccdfff3306db3d5c845ef97930773cfcdfb71e0d7f944e524536c76744ad

Download Submit
C:\Windows\System\KbulymH.exe

Filesize
2.6MB

MD5
edea383c29021604feb0aa6730fc0962

SHA1
87ae1e622ee2dcd36085e52c1ee8564b797497fa

SHA256
6e69ebb96e11cff0e3ab7afd951142ffd14528554b0540f0454e367063b21c1b

SHA512
26f243d05636b2f17aebd0942932d9d3a10e64c0ff46b04368e093ce13332e1189727cea1e30ce9876e925a195d5a50ffc6aad779ddbf9db9f8ca265c1c4088d

Download Submit
C:\Windows\System\OTYokHH.exe

Filesize
2.6MB

MD5
c159b0da91a40a407b3b718a2831b564

SHA1
371fbd650608162edf0a9e56a38a3402f83a12db

SHA256
58cb52d86b61096273b188b5948694a188df78f7d746042117afd69ad9962c79

SHA512
49e4e24f41488fdd2db73350f476250f36e5ffd6a98190b36522d20f44505eede919316bdd02ad40a93084088dac364bc46f892d6ecc37dd33f94cadceb2aa29

Download Submit
C:\Windows\System\RLQHEfM.exe

Filesize
2.6MB

MD5
474916b1527ab64e0b938ea9f05ab316

SHA1
6e0196d90ea8ac56849286b2fb7f8d2ff1e911b3

SHA256
be9e5ddf2cd4e2018eed6b2b4be583e80bf156b2bc0cc00e53bc8590f19f97ee

SHA512
50b7322ab98d0d2c79e34eb974405f35767b335463a2f8d485d67e484e73042ace707ee5d8289e3cc560d61c9b00d5e3353762009f3b9db4a23d13873a68dacd

Download Submit
C:\Windows\System\UFoASZp.exe

Filesize
2.6MB

MD5
d2f25a55ca91859c9e1cd278c523263f

SHA1
59b14f4350f24f145719ee3e4633a4156aa3a33a

SHA256
91cdd3454981e77a354b858313248ca572a5ca166d6f12927861aaed092d9d90

SHA512
b75b2fccf3e9c0fea87d80364e2e29bdac9741af2b4e36eaf5d9836d85a33b51cdacbc20f665fcb73107e8f515c353ffd2872307bb397e3a8ee2175ce898eb14

Download Submit
C:\Windows\System\XKgLwNi.exe

Filesize
2.6MB

MD5
5d5fb86db9b0c07ddd82a3fe3e9b87cf

SHA1
6dcd7d57f07aea40fdf73076da2db0a7084c65b4

SHA256
0d20bce43362cb9c45a4abed0dad3381496a329ce62fad022040f059e4980446

SHA512
a8e056dd7bcb3ff887685caf6bbbaf2070529dcf7c0061e828a761788f0060f47bd2b763aa94d2506ab9da72e3e2b282c31a61a6a717192f0cea8dc708fd040c

Download Submit
C:\Windows\System\XjCWlVJ.exe

Filesize
2.6MB

MD5
ea3f5a3b5c6ccb3284e180cf2059dde3

SHA1
f83c00eebb132a4ecb8d73f98b2c8aa36d026145

SHA256
7a40dd1eefb85b286aabc1e01cc329999f742df9c21dac91088e457923385b58

SHA512
0dd8df4aa463409d4f4fe6bb5f38cd9514df86abd41b0f09f7f61d74695af1ff8da5a370006161e8480ec4aa6f9883e59a43be8cde4413e307d9d6674c07cf02

Download Submit
C:\Windows\System\XyLfQJh.exe

Filesize
2.6MB

MD5
b49cf2cd69fe569c8d3239fe93f2dd52

SHA1
bf50e47135f393c56ac6b7aae8b04e18977d4780

SHA256
e794aca99c2fa528550149b050366d168865b04624ce6756abac9dc0d22a806a

SHA512
a2c11974f586a75f40a3b18221fa1fc41e3167112c24f2b25fa0be754530073f4a10a31399809bde5fc7febdead0e32f259601509bffb1a42305234bac5ca9fe

Download Submit
C:\Windows\System\aQwyOig.exe

Filesize
2.6MB

MD5
4fa703893ab098b4c04acdf3cde9f1b1

SHA1
00cb5f86e63054d86f659ba65b243a752ad48b6d

SHA256
2e6d7c21c990a8f0473e03747e621b25996fa0f12a0ac7cf68e6637c47ff4dfd

SHA512
ee4c1acf443f7722c2d2ea73846ae2c4d4208982495fcc2ed5b8af90bf9fe9474ea6412b80db5d26e4c8efbc2470af8273533d581444fd4b220d9558c03d7cc5

Download Submit
C:\Windows\System\cOEtaGh.exe

Filesize
2.6MB

MD5
aed8f1be85a8dcbdcdd964b8ca8de2fa

SHA1
558908c7d1b2c3651b3878334caa72200293bf90

SHA256
f52668f73af73d368d22b5ab95701ba6f27fcd8f26c078cde8028206130e53aa

SHA512
de518098a90b6b0b20cc6abbe0ec611008e4519108bcf7acada52d96e3a5a01e5bf3e3cd53ed62e05f57ead2bdd3401f49489cde020b0b93e0304d21a02ddc7a

Download Submit
C:\Windows\System\gVaIzSL.exe

Filesize
2.6MB

MD5
b699dc5fd201a58b0534f0c5a584a27e

SHA1
a307d5114d6e09908d9586c13f4d9b6397e2e40d

SHA256
db9fdcefa16f03996615154d30096ec3b984c54965349b8119e65f7df22c9af8

SHA512
6425d534abb9da20abd9c2320af994c9db1b6ca6a9d757d4e75c309107c35de7b44a545a549f5a3538400cc05be30cff2a93f815c8f6daa9b49c562d198d5b0a

Download Submit
C:\Windows\System\iKkDPcA.exe

Filesize
2.6MB

MD5
86c441e6a9952ab0c2fc05ef42cfb2f4

SHA1
f37f4956250c34d91c0ef832aefa13e1b2131b43

SHA256
2143829e9b9ea560f1fcad1389ae088d321df049208102b400eb843336c551af

SHA512
1bbc0864ca6a04a7d6a8bd378bcbca99da71ba58a4f04f12d26bfa6e1831d19c020fa8c4380125c7e277a3ad686fb233d9494731d0b670fbd685e9fcd975c318

Download Submit
C:\Windows\System\kLLUCeZ.exe

Filesize
2.6MB

MD5
2084423b0fefc607c3cca53da45c5fbc

SHA1
0f9b7d5b8dfffb657b932f84edffbb5a302d34a2

SHA256
b32f8f83b9bcbafc32d4813571f1139aea46a6c8cf49ed8fc36b9c9ca1c54373

SHA512
92e7b6079e2831f5b5f9b39244f37b1b3fd78e65adaa00ffe458ebc53176fdf88d3dbc66445217af2ef78b4ea739ef1d1dba13f11b4650305cd138ff11742268

Download Submit
C:\Windows\System\kjtEqOr.exe

Filesize
2.6MB

MD5
ff5fea40cb12fdc856f7f230f36f6513

SHA1
29c30f8bcfbc102fd459889b7d940d5a90b3913d

SHA256
8bcece185fa98ec02202b2e7d38740b1bea52e673fc3af8912dae076691ad548

SHA512
d6b55788c54d8671dff7aee97935c3a6916ce148c2f2a69913bc520b0879a597fd697da2dd6683965260f758507cd5d6ffb05b75097896d3849c010f2ea1056c

Download Submit
C:\Windows\System\lqczvEK.exe

Filesize
2.6MB

MD5
ae6026d0dde2939c0f0ef6c03fb2f3c7

SHA1
fcb7e594f30314647f398cd29bcc4df88d54e976

SHA256
0373a3e6ec181d2e4ee461df77fd74cf4ef1cd06201d61b3b9c09ccadc155360

SHA512
ff9e1f44d7b8fa60dc26ec07899c123ada5a8ede9da0de2d3280cda917365e0a4ac47fa7ffcde234a9ef714c0660be9dc0f4a710ef0e00c39117d9a7149b3c57

Download Submit
C:\Windows\System\nWltKPE.exe

Filesize
2.6MB

MD5
dd5e57e9115881fe6058cdf7e2a3413e

SHA1
a0d5840f7c29d4a024dd848ed40cd46de45f5d56

SHA256
424df1936c4a637e3ceb65209a530df6f1507ea7af9eeea8eca27f3d94f1234f

SHA512
f6975c922e074cd7208a87683ad2ff69cd114eaa46a0daf3e64075dea18e08b96bc37579081b59f03c0cefdead368bf65637b1d7fc813aff41bca8dca617ff38

Download Submit
C:\Windows\System\qbdQyLx.exe

Filesize
2.6MB

MD5
abc95619f6052230ad9da6078ef5ade8

SHA1
f9183c19917ce52c0132e6d6b230ea43b7c269c9

SHA256
83033c40da560416d2c3f3b1524983cce7420c9c38bb7c7b0afbe7875ea8cd37

SHA512
2201b662a47fc866b908d75e4e9b9fa3ac543801175c88222a3c423f278d5e1534503b202ca66be83aacfab75135c5757b2828d31aca7b716c3b82b63dd7d807

Download Submit
C:\Windows\System\suSDEGO.exe

Filesize
2.6MB

MD5
1b1dd819b3c7be5c24768438349bd9cd

SHA1
8b568ee92f20097ab18c2e98639bb0189e243a58

SHA256
de0cbabe17e45f9c613bca2cb12a2596aac23701d059d295818f5aad6ab5e98e

SHA512
f0eb94b7ec7c27e6ac46f7916fb9eaa9cfbce237265dc3f9c171826c11da95a0823401e71723335f894fb62d4a5aa1f118875496e9dd9a3a128130f96c7e5791

Download Submit
C:\Windows\System\uvsbfeH.exe

Filesize
2.6MB

MD5
ad768dc9682d285a6e1d42a3f53530a8

SHA1
aa45df90782281df1f155cbae75300be5877d19c

SHA256
e5147c8fb5aadc278768711021959f77beb26a0e0e49f6c568ada5a7420b0de0

SHA512
487e45a5d8f8baa10976dd0e5c5954482edbeaa1be8359f8971385d77f47c9b25eb8402200714eabe9621b75cd5ee0080095b9dc6b09cdd8bc9fd3d6a1c7e7f5

Download Submit
C:\Windows\System\vVdJIFv.exe

Filesize
2.6MB

MD5
cd5b5c44ac20bfc7a2a741427b4fd1d2

SHA1
f4b4e9a00bc2246f66d53ae4f0b9172f788b9c87

SHA256
3840ebea1c25ecf16db6be654f1386531e46181f9c9026bf10fdfb8856469d47

SHA512
d79ea3c8b89b1bd23b90869d7d772f2673aee1dc3aacb7ba4a8247b028c30d71f7a6d743d12c9c9c2946572181e0df446131e53e2ffe0cec08b3a27a3532659e

Download Submit
C:\Windows\System\vvbSiOg.exe

Filesize
2.6MB

MD5
11b98c9651f82520eec396462213539f

SHA1
7e95065f2d1542495682adedcd7151476376757f

SHA256
88b135e88c90c18186d766ba589cbac01c72ec38d68ff0cf65b254d12f20dcdb

SHA512
9d377cd7525c51057daf8086e503701e8e08e23283bb80ba5f5374a51ea4289f306e5383a1a541ff82f13c0ab3768294898156a5be75a0c74fcadff20f629e14

Download Submit
C:\Windows\System\zgwuNtS.exe

Filesize
2.6MB

MD5
7036d0d9f98dbbfe8fd80e2285c51f9b

SHA1
ee0bbae9bfffdab30b14ac5a4d6b88662651273c

SHA256
c19f66df8465849aa8fbbe771a6679fa58d257ba97b5c8c3fd95ab17dfebdcc7

SHA512
b83d7ec0f4975d65057c3f96ac15f2e66232fbb34430e21605e39dcf20015c4390cedd91449b3782f0bf6aa6b71132fc798e3a01a67faa36f3c33e0f06ab311f

Download Submit
memory/368-2155-0x00007FF7B8A10000-0x00007FF7B8D64000-memory.dmp

Filesize
3.3MB

Download
memory/368-440-0x00007FF7B8A10000-0x00007FF7B8D64000-memory.dmp

Filesize
3.3MB

Download
memory/552-487-0x00007FF71AB90000-0x00007FF71AEE4000-memory.dmp

Filesize
3.3MB

Download
memory/552-2163-0x00007FF71AB90000-0x00007FF71AEE4000-memory.dmp

Filesize
3.3MB

Download
memory/632-2156-0x00007FF6561E0000-0x00007FF656534000-memory.dmp

Filesize
3.3MB

Download
memory/632-467-0x00007FF6561E0000-0x00007FF656534000-memory.dmp

Filesize
3.3MB

Download
memory/772-484-0x00007FF783900000-0x00007FF783C54000-memory.dmp

Filesize
3.3MB

Download
memory/772-2165-0x00007FF783900000-0x00007FF783C54000-memory.dmp

Filesize
3.3MB

Download
memory/1092-2154-0x00007FF705390000-0x00007FF7056E4000-memory.dmp

Filesize
3.3MB

Download
memory/1092-438-0x00007FF705390000-0x00007FF7056E4000-memory.dmp

Filesize
3.3MB

Download
memory/1276-32-0x00007FF623930000-0x00007FF623C84000-memory.dmp

Filesize
3.3MB

Download
memory/1276-2136-0x00007FF623930000-0x00007FF623C84000-memory.dmp

Filesize
3.3MB

Download
memory/1276-2144-0x00007FF623930000-0x00007FF623C84000-memory.dmp

Filesize
3.3MB

Download
memory/1384-465-0x00007FF69F210000-0x00007FF69F564000-memory.dmp

Filesize
3.3MB

Download
memory/1384-2157-0x00007FF69F210000-0x00007FF69F564000-memory.dmp

Filesize
3.3MB

Download
memory/1448-436-0x00007FF604360000-0x00007FF6046B4000-memory.dmp

Filesize
3.3MB

Download
memory/1448-2153-0x00007FF604360000-0x00007FF6046B4000-memory.dmp

Filesize
3.3MB

Download
memory/1700-2139-0x00007FF65F6F0000-0x00007FF65FA44000-memory.dmp

Filesize
3.3MB

Download
memory/1700-7-0x00007FF65F6F0000-0x00007FF65FA44000-memory.dmp

Filesize
3.3MB

Download
memory/1700-1458-0x00007FF65F6F0000-0x00007FF65FA44000-memory.dmp

Filesize
3.3MB

Download
memory/1772-2146-0x00007FF600F30000-0x00007FF601284000-memory.dmp

Filesize
3.3MB

Download
memory/1772-62-0x00007FF600F30000-0x00007FF601284000-memory.dmp

Filesize
3.3MB

Download
memory/2192-470-0x00007FF609CA0000-0x00007FF609FF4000-memory.dmp

Filesize
3.3MB

Download
memory/2192-2162-0x00007FF609CA0000-0x00007FF609FF4000-memory.dmp

Filesize
3.3MB

Download
memory/3080-462-0x00007FF634340000-0x00007FF634694000-memory.dmp

Filesize
3.3MB

Download
memory/3080-2158-0x00007FF634340000-0x00007FF634694000-memory.dmp

Filesize
3.3MB

Download
memory/3120-477-0x00007FF718880000-0x00007FF718BD4000-memory.dmp

Filesize
3.3MB

Download
memory/3120-2166-0x00007FF718880000-0x00007FF718BD4000-memory.dmp

Filesize
3.3MB

Download
memory/3136-503-0x00007FF6F4400000-0x00007FF6F4754000-memory.dmp

Filesize
3.3MB

Download
memory/3136-2149-0x00007FF6F4400000-0x00007FF6F4754000-memory.dmp

Filesize
3.3MB

Download
memory/3184-458-0x00007FF769820000-0x00007FF769B74000-memory.dmp

Filesize
3.3MB

Download
memory/3184-2159-0x00007FF769820000-0x00007FF769B74000-memory.dmp

Filesize
3.3MB

Download
memory/3208-498-0x00007FF7499E0000-0x00007FF749D34000-memory.dmp

Filesize
3.3MB

Download
memory/3208-2164-0x00007FF7499E0000-0x00007FF749D34000-memory.dmp

Filesize
3.3MB

Download
memory/3276-2160-0x00007FF613DC0000-0x00007FF614114000-memory.dmp

Filesize
3.3MB

Download
memory/3276-447-0x00007FF613DC0000-0x00007FF614114000-memory.dmp

Filesize
3.3MB

Download
memory/3572-414-0x00007FF621820000-0x00007FF621B74000-memory.dmp

Filesize
3.3MB

Download
memory/3572-2147-0x00007FF621820000-0x00007FF621B74000-memory.dmp

Filesize
3.3MB

Download
memory/3628-2143-0x00007FF6F7FD0000-0x00007FF6F8324000-memory.dmp

Filesize
3.3MB

Download
memory/3628-2137-0x00007FF6F7FD0000-0x00007FF6F8324000-memory.dmp

Filesize
3.3MB

Download
memory/3628-38-0x00007FF6F7FD0000-0x00007FF6F8324000-memory.dmp

Filesize
3.3MB

Download
memory/3668-2141-0x00007FF737780000-0x00007FF737AD4000-memory.dmp

Filesize
3.3MB

Download
memory/3668-31-0x00007FF737780000-0x00007FF737AD4000-memory.dmp

Filesize
3.3MB

Download
memory/3812-1834-0x00007FF729BA0000-0x00007FF729EF4000-memory.dmp

Filesize
3.3MB

Download
memory/3812-2140-0x00007FF729BA0000-0x00007FF729EF4000-memory.dmp

Filesize
3.3MB

Download
memory/3812-16-0x00007FF729BA0000-0x00007FF729EF4000-memory.dmp

Filesize
3.3MB

Download
memory/4020-425-0x00007FF7F73F0000-0x00007FF7F7744000-memory.dmp

Filesize
3.3MB

Download
memory/4020-2151-0x00007FF7F73F0000-0x00007FF7F7744000-memory.dmp

Filesize
3.3MB

Download
memory/4044-1-0x000001E992A40000-0x000001E992A50000-memory.dmp

Filesize
64KB

Download
memory/4044-0-0x00007FF7CECC0000-0x00007FF7CF014000-memory.dmp

Filesize
3.3MB

Download
memory/4044-1118-0x00007FF7CECC0000-0x00007FF7CF014000-memory.dmp

Filesize
3.3MB

Download
memory/4052-501-0x00007FF7841E0000-0x00007FF784534000-memory.dmp

Filesize
3.3MB

Download
memory/4052-2148-0x00007FF7841E0000-0x00007FF784534000-memory.dmp

Filesize
3.3MB

Download
memory/4252-2142-0x00007FF6DA100000-0x00007FF6DA454000-memory.dmp

Filesize
3.3MB

Download
memory/4252-1837-0x00007FF6DA100000-0x00007FF6DA454000-memory.dmp

Filesize
3.3MB

Download
memory/4252-24-0x00007FF6DA100000-0x00007FF6DA454000-memory.dmp

Filesize
3.3MB

Download
memory/4352-434-0x00007FF74AD70000-0x00007FF74B0C4000-memory.dmp

Filesize
3.3MB

Download
memory/4352-2152-0x00007FF74AD70000-0x00007FF74B0C4000-memory.dmp

Filesize
3.3MB

Download
memory/4504-474-0x00007FF739FC0000-0x00007FF73A314000-memory.dmp

Filesize
3.3MB

Download
memory/4504-2167-0x00007FF739FC0000-0x00007FF73A314000-memory.dmp

Filesize
3.3MB

Download
memory/4656-2138-0x00007FF6A9450000-0x00007FF6A97A4000-memory.dmp

Filesize
3.3MB

Download
memory/4656-48-0x00007FF6A9450000-0x00007FF6A97A4000-memory.dmp

Filesize
3.3MB

Download
memory/4656-2145-0x00007FF6A9450000-0x00007FF6A97A4000-memory.dmp

Filesize
3.3MB

Download
memory/4672-2161-0x00007FF7FF4D0000-0x00007FF7FF824000-memory.dmp

Filesize
3.3MB

Download
memory/4672-457-0x00007FF7FF4D0000-0x00007FF7FF824000-memory.dmp

Filesize
3.3MB

Download
memory/4952-419-0x00007FF66B320000-0x00007FF66B674000-memory.dmp

Filesize
3.3MB

Download
memory/4952-2150-0x00007FF66B320000-0x00007FF66B674000-memory.dmp

Filesize
3.3MB

Download