xmrig | c41b3b11487facfe9c049276f30c130beed79994757a03f9167f662233db29ac

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
Size

1.8MB
MD5

343a2391adc85dff159355c2efae0160
SHA1

7776e1af3dcfb424d27a5d2e841b71479de99f61
SHA256

c41b3b11487facfe9c049276f30c130beed79994757a03f9167f662233db29ac
SHA512

9ed7b0017b86fdc7364dcbfcd62d77d4d9cc4893051bc5006cf8d23c19114bc9b8fc527574edab1a9b2f7b88300bb4593b6eb6e6cb741f563f229fc16ffffbba
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQW/zFdDlhcX38:BemTLkNdfE0pZrQg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4460-0-0x00007FF6D8FC0000-0x00007FF6D9314000-memory.dmp	xmrig
behavioral2/files/0x0006000000022f42-5.dat	xmrig
behavioral2/files/0x0007000000023424-9.dat	xmrig
behavioral2/files/0x0008000000023423-10.dat	xmrig
behavioral2/memory/3280-11-0x00007FF7ACDE0000-0x00007FF7AD134000-memory.dmp	xmrig
behavioral2/memory/3388-12-0x00007FF76A350000-0x00007FF76A6A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-24.dat	xmrig
behavioral2/files/0x0007000000023426-30.dat	xmrig
behavioral2/memory/1208-43-0x00007FF63F9C0000-0x00007FF63FD14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023429-49.dat	xmrig
behavioral2/files/0x000700000002342c-57.dat	xmrig
behavioral2/files/0x000700000002342a-62.dat	xmrig
behavioral2/files/0x000700000002342d-67.dat	xmrig
behavioral2/files/0x0007000000023430-81.dat	xmrig
behavioral2/files/0x0007000000023432-96.dat	xmrig
behavioral2/files/0x000700000002342f-112.dat	xmrig
behavioral2/memory/2476-137-0x00007FF77E190000-0x00007FF77E4E4000-memory.dmp	xmrig
behavioral2/memory/3240-144-0x00007FF7BD7E0000-0x00007FF7BDB34000-memory.dmp	xmrig
behavioral2/memory/1568-158-0x00007FF6523C0000-0x00007FF652714000-memory.dmp	xmrig
behavioral2/memory/2580-163-0x00007FF637030000-0x00007FF637384000-memory.dmp	xmrig
behavioral2/memory/5060-167-0x00007FF614E30000-0x00007FF615184000-memory.dmp	xmrig
behavioral2/memory/3904-170-0x00007FF69CB20000-0x00007FF69CE74000-memory.dmp	xmrig
behavioral2/memory/432-169-0x00007FF65F7C0000-0x00007FF65FB14000-memory.dmp	xmrig
behavioral2/memory/1704-168-0x00007FF716870000-0x00007FF716BC4000-memory.dmp	xmrig
behavioral2/memory/336-166-0x00007FF673960000-0x00007FF673CB4000-memory.dmp	xmrig
behavioral2/memory/3308-165-0x00007FF6FAE20000-0x00007FF6FB174000-memory.dmp	xmrig
behavioral2/memory/4964-164-0x00007FF778BF0000-0x00007FF778F44000-memory.dmp	xmrig
behavioral2/memory/4340-162-0x00007FF7AFCD0000-0x00007FF7B0024000-memory.dmp	xmrig
behavioral2/memory/2008-161-0x00007FF783A70000-0x00007FF783DC4000-memory.dmp	xmrig
behavioral2/memory/2820-160-0x00007FF7D8620000-0x00007FF7D8974000-memory.dmp	xmrig
behavioral2/memory/2280-159-0x00007FF7411E0000-0x00007FF741534000-memory.dmp	xmrig
behavioral2/memory/4884-157-0x00007FF6ADC50000-0x00007FF6ADFA4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-155.dat	xmrig
behavioral2/files/0x000700000002343b-153.dat	xmrig
behavioral2/files/0x000700000002343a-151.dat	xmrig
behavioral2/files/0x0007000000023439-149.dat	xmrig
behavioral2/files/0x0007000000023438-147.dat	xmrig
behavioral2/files/0x0007000000023437-145.dat	xmrig
behavioral2/files/0x0007000000023436-142.dat	xmrig
behavioral2/files/0x0007000000023435-140.dat	xmrig
behavioral2/memory/3476-139-0x00007FF6B7F90000-0x00007FF6B82E4000-memory.dmp	xmrig
behavioral2/memory/464-138-0x00007FF6C2AD0000-0x00007FF6C2E24000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-134.dat	xmrig
behavioral2/files/0x0007000000023434-131.dat	xmrig
behavioral2/files/0x0007000000023433-129.dat	xmrig
behavioral2/files/0x0007000000023431-125.dat	xmrig
behavioral2/memory/4748-108-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp	xmrig
behavioral2/memory/384-88-0x00007FF7F8FB0000-0x00007FF7F9304000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-76.dat	xmrig
behavioral2/files/0x0007000000023428-60.dat	xmrig
behavioral2/memory/2168-59-0x00007FF7B58A0000-0x00007FF7B5BF4000-memory.dmp	xmrig
behavioral2/memory/3980-55-0x00007FF7E1A70000-0x00007FF7E1DC4000-memory.dmp	xmrig
behavioral2/memory/4316-54-0x00007FF615820000-0x00007FF615B74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-51.dat	xmrig
behavioral2/memory/372-36-0x00007FF79D930000-0x00007FF79DC84000-memory.dmp	xmrig
behavioral2/files/0x000900000002341d-34.dat	xmrig
behavioral2/memory/1636-29-0x00007FF6D0780000-0x00007FF6D0AD4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343d-174.dat	xmrig
behavioral2/files/0x000700000002343e-180.dat	xmrig
behavioral2/files/0x0007000000023441-187.dat	xmrig
behavioral2/files/0x000700000002343f-191.dat	xmrig
behavioral2/memory/4644-188-0x00007FF662B30000-0x00007FF662E84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023440-186.dat	xmrig
behavioral2/memory/4460-2108-0x00007FF6D8FC0000-0x00007FF6D9314000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3280	NShFvUc.exe
3388	TYEMZDn.exe
1636	MHgUhTr.exe
372	fWoOrcI.exe
4316	XWyEcpq.exe
1208	ztKRRJo.exe
3980	uQoleOE.exe
336	JfcLBEy.exe
2168	eJDimBg.exe
384	tmRTmjp.exe
5060	tJrXcWZ.exe
4748	weJCnAq.exe
1704	RYSkvun.exe
2476	JucRoau.exe
464	GmzNVRH.exe
3476	LnCDGaG.exe
432	BVfbQgb.exe
3240	ulshwdo.exe
4884	xmZYjYp.exe
1568	cROdGAM.exe
2280	pHItRYZ.exe
2820	NAtrbaM.exe
3904	AbZKdXK.exe
2008	STiLrIO.exe
4340	YoUDhpm.exe
2580	iGtigXt.exe
4964	YmPBFJb.exe
3308	GWbfURB.exe
4644	NlrKedi.exe
2896	iQAoKYX.exe
3792	CRqxAVG.exe
2128	hgBpFXW.exe
1980	fdfPuNq.exe
4696	iPbPMEH.exe
3660	EibjLgj.exe
4780	ujpETpH.exe
4688	PdXuTSg.exe
960	wfAxaYd.exe
2768	vaiTvPA.exe
2680	SUoexoN.exe
4212	naYiamc.exe
1816	EXwqrDQ.exe
4444	HKgxBLC.exe
3080	pVwOYGG.exe
3044	xoaRBic.exe
3528	FJwqBNQ.exe
456	gOmgVAL.exe
2908	CCvhIRG.exe
2900	MFyrsbc.exe
2544	Jelrsns.exe
4704	wxKwqjp.exe
4500	kLstMcq.exe
2944	pOXTQDK.exe
3128	sqfJZve.exe
3160	zLcIUdA.exe
1888	IekkDgc.exe
4140	BFRSkoT.exe
4484	InyUiSu.exe
3684	BxHHeOJ.exe
2384	MONpoWl.exe
2344	CTZtYNP.exe
516	wauaAYv.exe
2208	JRyFYWz.exe
4796	AmcriQd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4460-0-0x00007FF6D8FC0000-0x00007FF6D9314000-memory.dmp	upx
behavioral2/files/0x0006000000022f42-5.dat	upx
behavioral2/files/0x0007000000023424-9.dat	upx
behavioral2/files/0x0008000000023423-10.dat	upx
behavioral2/memory/3280-11-0x00007FF7ACDE0000-0x00007FF7AD134000-memory.dmp	upx
behavioral2/memory/3388-12-0x00007FF76A350000-0x00007FF76A6A4000-memory.dmp	upx
behavioral2/files/0x0007000000023425-24.dat	upx
behavioral2/files/0x0007000000023426-30.dat	upx
behavioral2/memory/1208-43-0x00007FF63F9C0000-0x00007FF63FD14000-memory.dmp	upx
behavioral2/files/0x0007000000023429-49.dat	upx
behavioral2/files/0x000700000002342c-57.dat	upx
behavioral2/files/0x000700000002342a-62.dat	upx
behavioral2/files/0x000700000002342d-67.dat	upx
behavioral2/files/0x0007000000023430-81.dat	upx
behavioral2/files/0x0007000000023432-96.dat	upx
behavioral2/files/0x000700000002342f-112.dat	upx
behavioral2/memory/2476-137-0x00007FF77E190000-0x00007FF77E4E4000-memory.dmp	upx
behavioral2/memory/3240-144-0x00007FF7BD7E0000-0x00007FF7BDB34000-memory.dmp	upx
behavioral2/memory/1568-158-0x00007FF6523C0000-0x00007FF652714000-memory.dmp	upx
behavioral2/memory/2580-163-0x00007FF637030000-0x00007FF637384000-memory.dmp	upx
behavioral2/memory/5060-167-0x00007FF614E30000-0x00007FF615184000-memory.dmp	upx
behavioral2/memory/3904-170-0x00007FF69CB20000-0x00007FF69CE74000-memory.dmp	upx
behavioral2/memory/432-169-0x00007FF65F7C0000-0x00007FF65FB14000-memory.dmp	upx
behavioral2/memory/1704-168-0x00007FF716870000-0x00007FF716BC4000-memory.dmp	upx
behavioral2/memory/336-166-0x00007FF673960000-0x00007FF673CB4000-memory.dmp	upx
behavioral2/memory/3308-165-0x00007FF6FAE20000-0x00007FF6FB174000-memory.dmp	upx
behavioral2/memory/4964-164-0x00007FF778BF0000-0x00007FF778F44000-memory.dmp	upx
behavioral2/memory/4340-162-0x00007FF7AFCD0000-0x00007FF7B0024000-memory.dmp	upx
behavioral2/memory/2008-161-0x00007FF783A70000-0x00007FF783DC4000-memory.dmp	upx
behavioral2/memory/2820-160-0x00007FF7D8620000-0x00007FF7D8974000-memory.dmp	upx
behavioral2/memory/2280-159-0x00007FF7411E0000-0x00007FF741534000-memory.dmp	upx
behavioral2/memory/4884-157-0x00007FF6ADC50000-0x00007FF6ADFA4000-memory.dmp	upx
behavioral2/files/0x000700000002343c-155.dat	upx
behavioral2/files/0x000700000002343b-153.dat	upx
behavioral2/files/0x000700000002343a-151.dat	upx
behavioral2/files/0x0007000000023439-149.dat	upx
behavioral2/files/0x0007000000023438-147.dat	upx
behavioral2/files/0x0007000000023437-145.dat	upx
behavioral2/files/0x0007000000023436-142.dat	upx
behavioral2/files/0x0007000000023435-140.dat	upx
behavioral2/memory/3476-139-0x00007FF6B7F90000-0x00007FF6B82E4000-memory.dmp	upx
behavioral2/memory/464-138-0x00007FF6C2AD0000-0x00007FF6C2E24000-memory.dmp	upx
behavioral2/files/0x000700000002342e-134.dat	upx
behavioral2/files/0x0007000000023434-131.dat	upx
behavioral2/files/0x0007000000023433-129.dat	upx
behavioral2/files/0x0007000000023431-125.dat	upx
behavioral2/memory/4748-108-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp	upx
behavioral2/memory/384-88-0x00007FF7F8FB0000-0x00007FF7F9304000-memory.dmp	upx
behavioral2/files/0x000700000002342b-76.dat	upx
behavioral2/files/0x0007000000023428-60.dat	upx
behavioral2/memory/2168-59-0x00007FF7B58A0000-0x00007FF7B5BF4000-memory.dmp	upx
behavioral2/memory/3980-55-0x00007FF7E1A70000-0x00007FF7E1DC4000-memory.dmp	upx
behavioral2/memory/4316-54-0x00007FF615820000-0x00007FF615B74000-memory.dmp	upx
behavioral2/files/0x0007000000023427-51.dat	upx
behavioral2/memory/372-36-0x00007FF79D930000-0x00007FF79DC84000-memory.dmp	upx
behavioral2/files/0x000900000002341d-34.dat	upx
behavioral2/memory/1636-29-0x00007FF6D0780000-0x00007FF6D0AD4000-memory.dmp	upx
behavioral2/files/0x000700000002343d-174.dat	upx
behavioral2/files/0x000700000002343e-180.dat	upx
behavioral2/files/0x0007000000023441-187.dat	upx
behavioral2/files/0x000700000002343f-191.dat	upx
behavioral2/memory/4644-188-0x00007FF662B30000-0x00007FF662E84000-memory.dmp	upx
behavioral2/files/0x0007000000023440-186.dat	upx
behavioral2/memory/4460-2108-0x00007FF6D8FC0000-0x00007FF6D9314000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xePvqfp.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\XuIwEjQ.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\kKmykqo.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\hLWGWMx.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\MoCNxBb.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\AVqwTEC.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\ErTtnvA.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\BCZXtHa.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\MrNhaiG.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\wBnCJlb.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\KpFTwHl.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\ztKRRJo.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\LnCDGaG.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\vwznftk.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\oWwSULa.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\XjmDkNK.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\xbWazsC.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\sqvXWfN.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\uHGHUUv.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\WQRKDBu.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\wcuGAYO.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\gCOVKHJ.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\Ierghki.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\WHWrlRa.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\jUBtmRQ.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\OcvHsBj.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\gYMaaAD.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\kfCqOva.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\ypNnOGx.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\sJjsKXU.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\qYEJnKo.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\nNPGaZT.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\dxYeypS.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\SyxvDuy.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\AWBeigf.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\SiwBRoS.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\OVeXBAH.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\GRyOKrG.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\ZHBpcWJ.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\Peatvsw.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\wauaAYv.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\JRyFYWz.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\zhlbZne.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\vqfLRkS.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\ymCqwqi.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\bNbLrgP.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\mHQuCAw.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\xFOPfJz.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\vMFmAEl.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\THhkysY.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\JfcLBEy.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\GmzNVRH.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\pHItRYZ.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\pbKKUCT.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\QBOkHju.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\oYhKkeK.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\ZOrgUuI.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\ZFLrjpK.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\NerdQze.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\XuEvIgi.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\rYTHKWC.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\ftktQjk.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\zAuTXuH.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
File created	C:\Windows\System\GktphqI.exe	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3280	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	82
PID 4460 wrote to memory of 3280	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	82
PID 4460 wrote to memory of 3388	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	83
PID 4460 wrote to memory of 3388	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	83
PID 4460 wrote to memory of 1636	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	84
PID 4460 wrote to memory of 1636	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	84
PID 4460 wrote to memory of 372	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	85
PID 4460 wrote to memory of 372	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	85
PID 4460 wrote to memory of 4316	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	86
PID 4460 wrote to memory of 4316	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	86
PID 4460 wrote to memory of 1208	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	87
PID 4460 wrote to memory of 1208	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	87
PID 4460 wrote to memory of 3980	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	88
PID 4460 wrote to memory of 3980	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	88
PID 4460 wrote to memory of 336	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	89
PID 4460 wrote to memory of 336	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	89
PID 4460 wrote to memory of 2168	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	90
PID 4460 wrote to memory of 2168	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	90
PID 4460 wrote to memory of 5060	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	91
PID 4460 wrote to memory of 5060	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	91
PID 4460 wrote to memory of 384	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	92
PID 4460 wrote to memory of 384	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	92
PID 4460 wrote to memory of 4748	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	93
PID 4460 wrote to memory of 4748	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	93
PID 4460 wrote to memory of 1704	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	94
PID 4460 wrote to memory of 1704	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	94
PID 4460 wrote to memory of 2476	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	96
PID 4460 wrote to memory of 2476	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	96
PID 4460 wrote to memory of 464	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	97
PID 4460 wrote to memory of 464	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	97
PID 4460 wrote to memory of 3476	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	98
PID 4460 wrote to memory of 3476	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	98
PID 4460 wrote to memory of 432	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	99
PID 4460 wrote to memory of 432	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	99
PID 4460 wrote to memory of 3240	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	100
PID 4460 wrote to memory of 3240	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	100
PID 4460 wrote to memory of 4884	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	101
PID 4460 wrote to memory of 4884	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	101
PID 4460 wrote to memory of 1568	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	102
PID 4460 wrote to memory of 1568	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	102
PID 4460 wrote to memory of 2280	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	103
PID 4460 wrote to memory of 2280	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	103
PID 4460 wrote to memory of 2820	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	104
PID 4460 wrote to memory of 2820	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	104
PID 4460 wrote to memory of 3904	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	105
PID 4460 wrote to memory of 3904	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	105
PID 4460 wrote to memory of 2008	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	106
PID 4460 wrote to memory of 2008	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	106
PID 4460 wrote to memory of 4340	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	107
PID 4460 wrote to memory of 4340	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	107
PID 4460 wrote to memory of 2580	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	108
PID 4460 wrote to memory of 2580	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	108
PID 4460 wrote to memory of 4964	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	109
PID 4460 wrote to memory of 4964	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	109
PID 4460 wrote to memory of 3308	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	110
PID 4460 wrote to memory of 3308	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	110
PID 4460 wrote to memory of 4644	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	111
PID 4460 wrote to memory of 4644	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	111
PID 4460 wrote to memory of 2896	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	114
PID 4460 wrote to memory of 2896	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	114
PID 4460 wrote to memory of 3792	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	115
PID 4460 wrote to memory of 3792	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	115
PID 4460 wrote to memory of 2128	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	116
PID 4460 wrote to memory of 2128	4460	343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\343a2391adc85dff159355c2efae0160_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\System\NShFvUc.exe
  C:\Windows\System\NShFvUc.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\TYEMZDn.exe
  C:\Windows\System\TYEMZDn.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\MHgUhTr.exe
  C:\Windows\System\MHgUhTr.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\fWoOrcI.exe
  C:\Windows\System\fWoOrcI.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\XWyEcpq.exe
  C:\Windows\System\XWyEcpq.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\ztKRRJo.exe
  C:\Windows\System\ztKRRJo.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\uQoleOE.exe
  C:\Windows\System\uQoleOE.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\JfcLBEy.exe
  C:\Windows\System\JfcLBEy.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\eJDimBg.exe
  C:\Windows\System\eJDimBg.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\tJrXcWZ.exe
  C:\Windows\System\tJrXcWZ.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\tmRTmjp.exe
  C:\Windows\System\tmRTmjp.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\weJCnAq.exe
  C:\Windows\System\weJCnAq.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\RYSkvun.exe
  C:\Windows\System\RYSkvun.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\JucRoau.exe
  C:\Windows\System\JucRoau.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\GmzNVRH.exe
  C:\Windows\System\GmzNVRH.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\LnCDGaG.exe
  C:\Windows\System\LnCDGaG.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\BVfbQgb.exe
  C:\Windows\System\BVfbQgb.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\ulshwdo.exe
  C:\Windows\System\ulshwdo.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\xmZYjYp.exe
  C:\Windows\System\xmZYjYp.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\cROdGAM.exe
  C:\Windows\System\cROdGAM.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\pHItRYZ.exe
  C:\Windows\System\pHItRYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\NAtrbaM.exe
  C:\Windows\System\NAtrbaM.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\AbZKdXK.exe
  C:\Windows\System\AbZKdXK.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\STiLrIO.exe
  C:\Windows\System\STiLrIO.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\YoUDhpm.exe
  C:\Windows\System\YoUDhpm.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\iGtigXt.exe
  C:\Windows\System\iGtigXt.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\YmPBFJb.exe
  C:\Windows\System\YmPBFJb.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\GWbfURB.exe
  C:\Windows\System\GWbfURB.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\NlrKedi.exe
  C:\Windows\System\NlrKedi.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\iQAoKYX.exe
  C:\Windows\System\iQAoKYX.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\CRqxAVG.exe
  C:\Windows\System\CRqxAVG.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\hgBpFXW.exe
  C:\Windows\System\hgBpFXW.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\fdfPuNq.exe
  C:\Windows\System\fdfPuNq.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\iPbPMEH.exe
  C:\Windows\System\iPbPMEH.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\EibjLgj.exe
  C:\Windows\System\EibjLgj.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\ujpETpH.exe
  C:\Windows\System\ujpETpH.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\PdXuTSg.exe
  C:\Windows\System\PdXuTSg.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\wfAxaYd.exe
  C:\Windows\System\wfAxaYd.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\vaiTvPA.exe
  C:\Windows\System\vaiTvPA.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\SUoexoN.exe
  C:\Windows\System\SUoexoN.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\naYiamc.exe
  C:\Windows\System\naYiamc.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\EXwqrDQ.exe
  C:\Windows\System\EXwqrDQ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\HKgxBLC.exe
  C:\Windows\System\HKgxBLC.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\pVwOYGG.exe
  C:\Windows\System\pVwOYGG.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\xoaRBic.exe
  C:\Windows\System\xoaRBic.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\FJwqBNQ.exe
  C:\Windows\System\FJwqBNQ.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\gOmgVAL.exe
  C:\Windows\System\gOmgVAL.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\CCvhIRG.exe
  C:\Windows\System\CCvhIRG.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\MFyrsbc.exe
  C:\Windows\System\MFyrsbc.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\Jelrsns.exe
  C:\Windows\System\Jelrsns.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\wxKwqjp.exe
  C:\Windows\System\wxKwqjp.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\kLstMcq.exe
  C:\Windows\System\kLstMcq.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\pOXTQDK.exe
  C:\Windows\System\pOXTQDK.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\sqfJZve.exe
  C:\Windows\System\sqfJZve.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\zLcIUdA.exe
  C:\Windows\System\zLcIUdA.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\IekkDgc.exe
  C:\Windows\System\IekkDgc.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\BFRSkoT.exe
  C:\Windows\System\BFRSkoT.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\InyUiSu.exe
  C:\Windows\System\InyUiSu.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\BxHHeOJ.exe
  C:\Windows\System\BxHHeOJ.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\MONpoWl.exe
  C:\Windows\System\MONpoWl.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\CTZtYNP.exe
  C:\Windows\System\CTZtYNP.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\wauaAYv.exe
  C:\Windows\System\wauaAYv.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\JRyFYWz.exe
  C:\Windows\System\JRyFYWz.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\AmcriQd.exe
  C:\Windows\System\AmcriQd.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\ZacSskd.exe
  C:\Windows\System\ZacSskd.exe
  2⤵
  PID:4236
- C:\Windows\System\vvrdgDj.exe
  C:\Windows\System\vvrdgDj.exe
  2⤵
  PID:1152
- C:\Windows\System\XbOafQG.exe
  C:\Windows\System\XbOafQG.exe
  2⤵
  PID:4676
- C:\Windows\System\YKXPRze.exe
  C:\Windows\System\YKXPRze.exe
  2⤵
  PID:3472
- C:\Windows\System\MosNKsY.exe
  C:\Windows\System\MosNKsY.exe
  2⤵
  PID:3164
- C:\Windows\System\CxrHuTG.exe
  C:\Windows\System\CxrHuTG.exe
  2⤵
  PID:1644
- C:\Windows\System\jUBtmRQ.exe
  C:\Windows\System\jUBtmRQ.exe
  2⤵
  PID:2216
- C:\Windows\System\oMfRAPk.exe
  C:\Windows\System\oMfRAPk.exe
  2⤵
  PID:3664
- C:\Windows\System\ZzNBEIu.exe
  C:\Windows\System\ZzNBEIu.exe
  2⤵
  PID:4936
- C:\Windows\System\uHGHUUv.exe
  C:\Windows\System\uHGHUUv.exe
  2⤵
  PID:2372
- C:\Windows\System\GTedIoN.exe
  C:\Windows\System\GTedIoN.exe
  2⤵
  PID:1972
- C:\Windows\System\CJPOSVJ.exe
  C:\Windows\System\CJPOSVJ.exe
  2⤵
  PID:2332
- C:\Windows\System\COHwgQp.exe
  C:\Windows\System\COHwgQp.exe
  2⤵
  PID:3652
- C:\Windows\System\JnTRKrj.exe
  C:\Windows\System\JnTRKrj.exe
  2⤵
  PID:2108
- C:\Windows\System\DZJSkSB.exe
  C:\Windows\System\DZJSkSB.exe
  2⤵
  PID:3616
- C:\Windows\System\pbKKUCT.exe
  C:\Windows\System\pbKKUCT.exe
  2⤵
  PID:4760
- C:\Windows\System\uvJXIWe.exe
  C:\Windows\System\uvJXIWe.exe
  2⤵
  PID:5108
- C:\Windows\System\EypCFAk.exe
  C:\Windows\System\EypCFAk.exe
  2⤵
  PID:1596
- C:\Windows\System\KSeYMxN.exe
  C:\Windows\System\KSeYMxN.exe
  2⤵
  PID:3900
- C:\Windows\System\PhWCCPa.exe
  C:\Windows\System\PhWCCPa.exe
  2⤵
  PID:1724
- C:\Windows\System\BfHUQFq.exe
  C:\Windows\System\BfHUQFq.exe
  2⤵
  PID:880
- C:\Windows\System\JGpkLmb.exe
  C:\Windows\System\JGpkLmb.exe
  2⤵
  PID:4284
- C:\Windows\System\WxuySCA.exe
  C:\Windows\System\WxuySCA.exe
  2⤵
  PID:2780
- C:\Windows\System\sdrDkyw.exe
  C:\Windows\System\sdrDkyw.exe
  2⤵
  PID:2148
- C:\Windows\System\MVqiwkT.exe
  C:\Windows\System\MVqiwkT.exe
  2⤵
  PID:912
- C:\Windows\System\vwznftk.exe
  C:\Windows\System\vwznftk.exe
  2⤵
  PID:4720
- C:\Windows\System\tanUalY.exe
  C:\Windows\System\tanUalY.exe
  2⤵
  PID:540
- C:\Windows\System\mcFnfNS.exe
  C:\Windows\System\mcFnfNS.exe
  2⤵
  PID:4016
- C:\Windows\System\uJZZdqM.exe
  C:\Windows\System\uJZZdqM.exe
  2⤵
  PID:5004
- C:\Windows\System\AcccwgD.exe
  C:\Windows\System\AcccwgD.exe
  2⤵
  PID:4176
- C:\Windows\System\kuTwfgt.exe
  C:\Windows\System\kuTwfgt.exe
  2⤵
  PID:3200
- C:\Windows\System\pJHvjJm.exe
  C:\Windows\System\pJHvjJm.exe
  2⤵
  PID:1564
- C:\Windows\System\bPqocfV.exe
  C:\Windows\System\bPqocfV.exe
  2⤵
  PID:60
- C:\Windows\System\aYLxxXR.exe
  C:\Windows\System\aYLxxXR.exe
  2⤵
  PID:1752
- C:\Windows\System\FUZCLEr.exe
  C:\Windows\System\FUZCLEr.exe
  2⤵
  PID:5128
- C:\Windows\System\SREcCGy.exe
  C:\Windows\System\SREcCGy.exe
  2⤵
  PID:5152
- C:\Windows\System\XXUNtPW.exe
  C:\Windows\System\XXUNtPW.exe
  2⤵
  PID:5184
- C:\Windows\System\fhNzkcs.exe
  C:\Windows\System\fhNzkcs.exe
  2⤵
  PID:5220
- C:\Windows\System\uCQpdDL.exe
  C:\Windows\System\uCQpdDL.exe
  2⤵
  PID:5252
- C:\Windows\System\KSwoiyl.exe
  C:\Windows\System\KSwoiyl.exe
  2⤵
  PID:5284
- C:\Windows\System\UHZXOll.exe
  C:\Windows\System\UHZXOll.exe
  2⤵
  PID:5312
- C:\Windows\System\sCqwPze.exe
  C:\Windows\System\sCqwPze.exe
  2⤵
  PID:5348
- C:\Windows\System\WQRKDBu.exe
  C:\Windows\System\WQRKDBu.exe
  2⤵
  PID:5376
- C:\Windows\System\RkHwKnE.exe
  C:\Windows\System\RkHwKnE.exe
  2⤵
  PID:5404
- C:\Windows\System\ftktQjk.exe
  C:\Windows\System\ftktQjk.exe
  2⤵
  PID:5432
- C:\Windows\System\iSKbpKE.exe
  C:\Windows\System\iSKbpKE.exe
  2⤵
  PID:5452
- C:\Windows\System\ILgsQnG.exe
  C:\Windows\System\ILgsQnG.exe
  2⤵
  PID:5488
- C:\Windows\System\vqjnlDw.exe
  C:\Windows\System\vqjnlDw.exe
  2⤵
  PID:5504
- C:\Windows\System\dsIHUPc.exe
  C:\Windows\System\dsIHUPc.exe
  2⤵
  PID:5536
- C:\Windows\System\INmVCoK.exe
  C:\Windows\System\INmVCoK.exe
  2⤵
  PID:5576
- C:\Windows\System\dzsItLr.exe
  C:\Windows\System\dzsItLr.exe
  2⤵
  PID:5604
- C:\Windows\System\bEIWgCB.exe
  C:\Windows\System\bEIWgCB.exe
  2⤵
  PID:5632
- C:\Windows\System\MGEZuyX.exe
  C:\Windows\System\MGEZuyX.exe
  2⤵
  PID:5660
- C:\Windows\System\nNPGaZT.exe
  C:\Windows\System\nNPGaZT.exe
  2⤵
  PID:5692
- C:\Windows\System\nZfaSEh.exe
  C:\Windows\System\nZfaSEh.exe
  2⤵
  PID:5720
- C:\Windows\System\vGJNCVc.exe
  C:\Windows\System\vGJNCVc.exe
  2⤵
  PID:5744
- C:\Windows\System\zhlbZne.exe
  C:\Windows\System\zhlbZne.exe
  2⤵
  PID:5772
- C:\Windows\System\YJTHMhg.exe
  C:\Windows\System\YJTHMhg.exe
  2⤵
  PID:5800
- C:\Windows\System\QBOkHju.exe
  C:\Windows\System\QBOkHju.exe
  2⤵
  PID:5816
- C:\Windows\System\xDhLdxB.exe
  C:\Windows\System\xDhLdxB.exe
  2⤵
  PID:5848
- C:\Windows\System\bSMVVVj.exe
  C:\Windows\System\bSMVVVj.exe
  2⤵
  PID:5880
- C:\Windows\System\vqfLRkS.exe
  C:\Windows\System\vqfLRkS.exe
  2⤵
  PID:5912
- C:\Windows\System\yvfFPzQ.exe
  C:\Windows\System\yvfFPzQ.exe
  2⤵
  PID:5932
- C:\Windows\System\HrlskDN.exe
  C:\Windows\System\HrlskDN.exe
  2⤵
  PID:5964
- C:\Windows\System\FlTPGIZ.exe
  C:\Windows\System\FlTPGIZ.exe
  2⤵
  PID:6000
- C:\Windows\System\TnwcuJK.exe
  C:\Windows\System\TnwcuJK.exe
  2⤵
  PID:6016
- C:\Windows\System\MDpScbc.exe
  C:\Windows\System\MDpScbc.exe
  2⤵
  PID:6052
- C:\Windows\System\rVCXgPz.exe
  C:\Windows\System\rVCXgPz.exe
  2⤵
  PID:6076
- C:\Windows\System\zfMLnKa.exe
  C:\Windows\System\zfMLnKa.exe
  2⤵
  PID:6104
- C:\Windows\System\YdplgyC.exe
  C:\Windows\System\YdplgyC.exe
  2⤵
  PID:6140
- C:\Windows\System\Tntlexp.exe
  C:\Windows\System\Tntlexp.exe
  2⤵
  PID:5144
- C:\Windows\System\YZUgfBq.exe
  C:\Windows\System\YZUgfBq.exe
  2⤵
  PID:5192
- C:\Windows\System\PokgcdC.exe
  C:\Windows\System\PokgcdC.exe
  2⤵
  PID:5264
- C:\Windows\System\sjvJvIh.exe
  C:\Windows\System\sjvJvIh.exe
  2⤵
  PID:5332
- C:\Windows\System\PtCBhvM.exe
  C:\Windows\System\PtCBhvM.exe
  2⤵
  PID:5396
- C:\Windows\System\LPBKGOC.exe
  C:\Windows\System\LPBKGOC.exe
  2⤵
  PID:5472
- C:\Windows\System\RtKhlFP.exe
  C:\Windows\System\RtKhlFP.exe
  2⤵
  PID:5548
- C:\Windows\System\EHbgYMT.exe
  C:\Windows\System\EHbgYMT.exe
  2⤵
  PID:5616
- C:\Windows\System\zvIuBjB.exe
  C:\Windows\System\zvIuBjB.exe
  2⤵
  PID:5684
- C:\Windows\System\IvtPkmY.exe
  C:\Windows\System\IvtPkmY.exe
  2⤵
  PID:5756
- C:\Windows\System\fsvvJgk.exe
  C:\Windows\System\fsvvJgk.exe
  2⤵
  PID:5784
- C:\Windows\System\cELJyBw.exe
  C:\Windows\System\cELJyBw.exe
  2⤵
  PID:5856
- C:\Windows\System\snBlNhO.exe
  C:\Windows\System\snBlNhO.exe
  2⤵
  PID:5956
- C:\Windows\System\ZfODmfH.exe
  C:\Windows\System\ZfODmfH.exe
  2⤵
  PID:6028
- C:\Windows\System\WvnlmNT.exe
  C:\Windows\System\WvnlmNT.exe
  2⤵
  PID:6088
- C:\Windows\System\fLtgtzx.exe
  C:\Windows\System\fLtgtzx.exe
  2⤵
  PID:2672
- C:\Windows\System\ESzuftY.exe
  C:\Windows\System\ESzuftY.exe
  2⤵
  PID:5240
- C:\Windows\System\oYhKkeK.exe
  C:\Windows\System\oYhKkeK.exe
  2⤵
  PID:5428
- C:\Windows\System\wwxZvnl.exe
  C:\Windows\System\wwxZvnl.exe
  2⤵
  PID:5680
- C:\Windows\System\uSDdJNn.exe
  C:\Windows\System\uSDdJNn.exe
  2⤵
  PID:5844
- C:\Windows\System\vHBwGYI.exe
  C:\Windows\System\vHBwGYI.exe
  2⤵
  PID:5940
- C:\Windows\System\hkXfzZK.exe
  C:\Windows\System\hkXfzZK.exe
  2⤵
  PID:1128
- C:\Windows\System\gLqyjNT.exe
  C:\Windows\System\gLqyjNT.exe
  2⤵
  PID:5596
- C:\Windows\System\dTPujYN.exe
  C:\Windows\System\dTPujYN.exe
  2⤵
  PID:5908
- C:\Windows\System\RmsvKoz.exe
  C:\Windows\System\RmsvKoz.exe
  2⤵
  PID:5728
- C:\Windows\System\ymCqwqi.exe
  C:\Windows\System\ymCqwqi.exe
  2⤵
  PID:6048
- C:\Windows\System\HYmgGKZ.exe
  C:\Windows\System\HYmgGKZ.exe
  2⤵
  PID:6176
- C:\Windows\System\juZpNZX.exe
  C:\Windows\System\juZpNZX.exe
  2⤵
  PID:6192
- C:\Windows\System\SHmbtjk.exe
  C:\Windows\System\SHmbtjk.exe
  2⤵
  PID:6228
- C:\Windows\System\BxnUmIg.exe
  C:\Windows\System\BxnUmIg.exe
  2⤵
  PID:6244
- C:\Windows\System\kqvqKSI.exe
  C:\Windows\System\kqvqKSI.exe
  2⤵
  PID:6276
- C:\Windows\System\UpmNvFF.exe
  C:\Windows\System\UpmNvFF.exe
  2⤵
  PID:6312
- C:\Windows\System\HQPHtHX.exe
  C:\Windows\System\HQPHtHX.exe
  2⤵
  PID:6340
- C:\Windows\System\DWaIKbF.exe
  C:\Windows\System\DWaIKbF.exe
  2⤵
  PID:6372
- C:\Windows\System\nPtgQaQ.exe
  C:\Windows\System\nPtgQaQ.exe
  2⤵
  PID:6400
- C:\Windows\System\QOKRVZg.exe
  C:\Windows\System\QOKRVZg.exe
  2⤵
  PID:6428
- C:\Windows\System\yeThYJR.exe
  C:\Windows\System\yeThYJR.exe
  2⤵
  PID:6444
- C:\Windows\System\IlLtAIc.exe
  C:\Windows\System\IlLtAIc.exe
  2⤵
  PID:6476
- C:\Windows\System\SjhLajx.exe
  C:\Windows\System\SjhLajx.exe
  2⤵
  PID:6500
- C:\Windows\System\bNbLrgP.exe
  C:\Windows\System\bNbLrgP.exe
  2⤵
  PID:6532
- C:\Windows\System\AyPsVjD.exe
  C:\Windows\System\AyPsVjD.exe
  2⤵
  PID:6568
- C:\Windows\System\MLVjNgJ.exe
  C:\Windows\System\MLVjNgJ.exe
  2⤵
  PID:6592
- C:\Windows\System\WiDmWsu.exe
  C:\Windows\System\WiDmWsu.exe
  2⤵
  PID:6624
- C:\Windows\System\ZFuMMlU.exe
  C:\Windows\System\ZFuMMlU.exe
  2⤵
  PID:6640
- C:\Windows\System\oWwSULa.exe
  C:\Windows\System\oWwSULa.exe
  2⤵
  PID:6656
- C:\Windows\System\FYErNkj.exe
  C:\Windows\System\FYErNkj.exe
  2⤵
  PID:6676
- C:\Windows\System\XuIwEjQ.exe
  C:\Windows\System\XuIwEjQ.exe
  2⤵
  PID:6696
- C:\Windows\System\asnesIJ.exe
  C:\Windows\System\asnesIJ.exe
  2⤵
  PID:6716
- C:\Windows\System\CmOASvQ.exe
  C:\Windows\System\CmOASvQ.exe
  2⤵
  PID:6752
- C:\Windows\System\LgBxLZY.exe
  C:\Windows\System\LgBxLZY.exe
  2⤵
  PID:6788
- C:\Windows\System\cTaQvTc.exe
  C:\Windows\System\cTaQvTc.exe
  2⤵
  PID:6828
- C:\Windows\System\RgSAZuD.exe
  C:\Windows\System\RgSAZuD.exe
  2⤵
  PID:6864
- C:\Windows\System\hnjrGXf.exe
  C:\Windows\System\hnjrGXf.exe
  2⤵
  PID:6900
- C:\Windows\System\mvtJFug.exe
  C:\Windows\System\mvtJFug.exe
  2⤵
  PID:6932
- C:\Windows\System\lWqvVAj.exe
  C:\Windows\System\lWqvVAj.exe
  2⤵
  PID:6964
- C:\Windows\System\xYlrSJr.exe
  C:\Windows\System\xYlrSJr.exe
  2⤵
  PID:6988
- C:\Windows\System\fYYLbZe.exe
  C:\Windows\System\fYYLbZe.exe
  2⤵
  PID:7016
- C:\Windows\System\zBTGdCK.exe
  C:\Windows\System\zBTGdCK.exe
  2⤵
  PID:7044
- C:\Windows\System\MfeHtdO.exe
  C:\Windows\System\MfeHtdO.exe
  2⤵
  PID:7072
- C:\Windows\System\VnvtErD.exe
  C:\Windows\System\VnvtErD.exe
  2⤵
  PID:7100
- C:\Windows\System\OcvHsBj.exe
  C:\Windows\System\OcvHsBj.exe
  2⤵
  PID:7128
- C:\Windows\System\iamrFvq.exe
  C:\Windows\System\iamrFvq.exe
  2⤵
  PID:7156
- C:\Windows\System\OGWnwPM.exe
  C:\Windows\System\OGWnwPM.exe
  2⤵
  PID:6168
- C:\Windows\System\RXKmQBs.exe
  C:\Windows\System\RXKmQBs.exe
  2⤵
  PID:6220
- C:\Windows\System\GomZQpJ.exe
  C:\Windows\System\GomZQpJ.exe
  2⤵
  PID:6296
- C:\Windows\System\dGnkVZN.exe
  C:\Windows\System\dGnkVZN.exe
  2⤵
  PID:6384
- C:\Windows\System\YjefQJY.exe
  C:\Windows\System\YjefQJY.exe
  2⤵
  PID:6440
- C:\Windows\System\vXnoFUa.exe
  C:\Windows\System\vXnoFUa.exe
  2⤵
  PID:6512
- C:\Windows\System\mHQuCAw.exe
  C:\Windows\System\mHQuCAw.exe
  2⤵
  PID:6584
- C:\Windows\System\DbrqQfx.exe
  C:\Windows\System\DbrqQfx.exe
  2⤵
  PID:6684
- C:\Windows\System\pljgRoV.exe
  C:\Windows\System\pljgRoV.exe
  2⤵
  PID:6692
- C:\Windows\System\bSeOgGQ.exe
  C:\Windows\System\bSeOgGQ.exe
  2⤵
  PID:6764
- C:\Windows\System\OgeBGun.exe
  C:\Windows\System\OgeBGun.exe
  2⤵
  PID:6840
- C:\Windows\System\wcuGAYO.exe
  C:\Windows\System\wcuGAYO.exe
  2⤵
  PID:6908
- C:\Windows\System\inuGYPr.exe
  C:\Windows\System\inuGYPr.exe
  2⤵
  PID:6952
- C:\Windows\System\pSDNtFc.exe
  C:\Windows\System\pSDNtFc.exe
  2⤵
  PID:7012
- C:\Windows\System\YQyQhki.exe
  C:\Windows\System\YQyQhki.exe
  2⤵
  PID:7112
- C:\Windows\System\LkPfITp.exe
  C:\Windows\System\LkPfITp.exe
  2⤵
  PID:6164
- C:\Windows\System\YbSHUjU.exe
  C:\Windows\System\YbSHUjU.exe
  2⤵
  PID:6308
- C:\Windows\System\FvBkMcM.exe
  C:\Windows\System\FvBkMcM.exe
  2⤵
  PID:6496
- C:\Windows\System\dWsJxYy.exe
  C:\Windows\System\dWsJxYy.exe
  2⤵
  PID:6100
- C:\Windows\System\wYJGEFx.exe
  C:\Windows\System\wYJGEFx.exe
  2⤵
  PID:6736
- C:\Windows\System\vGAUAXK.exe
  C:\Windows\System\vGAUAXK.exe
  2⤵
  PID:6920
- C:\Windows\System\FpxIewO.exe
  C:\Windows\System\FpxIewO.exe
  2⤵
  PID:7096
- C:\Windows\System\ykuaVRJ.exe
  C:\Windows\System\ykuaVRJ.exe
  2⤵
  PID:6284
- C:\Windows\System\XrRixZL.exe
  C:\Windows\System\XrRixZL.exe
  2⤵
  PID:6728
- C:\Windows\System\PlkQNvJ.exe
  C:\Windows\System\PlkQNvJ.exe
  2⤵
  PID:6856
- C:\Windows\System\NEfFnNZ.exe
  C:\Windows\System\NEfFnNZ.exe
  2⤵
  PID:5876
- C:\Windows\System\RYKeHYS.exe
  C:\Windows\System\RYKeHYS.exe
  2⤵
  PID:1280
- C:\Windows\System\JssHJWj.exe
  C:\Windows\System\JssHJWj.exe
  2⤵
  PID:7176
- C:\Windows\System\pvpdqRY.exe
  C:\Windows\System\pvpdqRY.exe
  2⤵
  PID:7212
- C:\Windows\System\pRtvgSd.exe
  C:\Windows\System\pRtvgSd.exe
  2⤵
  PID:7244
- C:\Windows\System\AiEVPYt.exe
  C:\Windows\System\AiEVPYt.exe
  2⤵
  PID:7280
- C:\Windows\System\DEeXTTM.exe
  C:\Windows\System\DEeXTTM.exe
  2⤵
  PID:7312
- C:\Windows\System\WSZJesW.exe
  C:\Windows\System\WSZJesW.exe
  2⤵
  PID:7340
- C:\Windows\System\ZZMOLmY.exe
  C:\Windows\System\ZZMOLmY.exe
  2⤵
  PID:7368
- C:\Windows\System\QEystby.exe
  C:\Windows\System\QEystby.exe
  2⤵
  PID:7396
- C:\Windows\System\gCOVKHJ.exe
  C:\Windows\System\gCOVKHJ.exe
  2⤵
  PID:7424
- C:\Windows\System\KOWtMfa.exe
  C:\Windows\System\KOWtMfa.exe
  2⤵
  PID:7452
- C:\Windows\System\CWdrHRx.exe
  C:\Windows\System\CWdrHRx.exe
  2⤵
  PID:7468
- C:\Windows\System\fAYBTMl.exe
  C:\Windows\System\fAYBTMl.exe
  2⤵
  PID:7496
- C:\Windows\System\uNPzEWi.exe
  C:\Windows\System\uNPzEWi.exe
  2⤵
  PID:7524
- C:\Windows\System\ChnbEON.exe
  C:\Windows\System\ChnbEON.exe
  2⤵
  PID:7556
- C:\Windows\System\HvlUBKv.exe
  C:\Windows\System\HvlUBKv.exe
  2⤵
  PID:7592
- C:\Windows\System\noZfnPa.exe
  C:\Windows\System\noZfnPa.exe
  2⤵
  PID:7620
- C:\Windows\System\rwhgdPb.exe
  C:\Windows\System\rwhgdPb.exe
  2⤵
  PID:7648
- C:\Windows\System\xHtiJuG.exe
  C:\Windows\System\xHtiJuG.exe
  2⤵
  PID:7676
- C:\Windows\System\yGDFJMe.exe
  C:\Windows\System\yGDFJMe.exe
  2⤵
  PID:7704
- C:\Windows\System\khmGhAk.exe
  C:\Windows\System\khmGhAk.exe
  2⤵
  PID:7720
- C:\Windows\System\mLdcniy.exe
  C:\Windows\System\mLdcniy.exe
  2⤵
  PID:7748
- C:\Windows\System\cTRStHp.exe
  C:\Windows\System\cTRStHp.exe
  2⤵
  PID:7768
- C:\Windows\System\jZsiIDy.exe
  C:\Windows\System\jZsiIDy.exe
  2⤵
  PID:7788
- C:\Windows\System\xBZpnvh.exe
  C:\Windows\System\xBZpnvh.exe
  2⤵
  PID:7820
- C:\Windows\System\IqKxlTs.exe
  C:\Windows\System\IqKxlTs.exe
  2⤵
  PID:7860
- C:\Windows\System\pceEPzM.exe
  C:\Windows\System\pceEPzM.exe
  2⤵
  PID:7888
- C:\Windows\System\rbrayeu.exe
  C:\Windows\System\rbrayeu.exe
  2⤵
  PID:7916
- C:\Windows\System\CESkZuI.exe
  C:\Windows\System\CESkZuI.exe
  2⤵
  PID:7944
- C:\Windows\System\iJxuhPQ.exe
  C:\Windows\System\iJxuhPQ.exe
  2⤵
  PID:7980
- C:\Windows\System\kKmykqo.exe
  C:\Windows\System\kKmykqo.exe
  2⤵
  PID:8000
- C:\Windows\System\fQKjpWO.exe
  C:\Windows\System\fQKjpWO.exe
  2⤵
  PID:8016
- C:\Windows\System\awpaxMf.exe
  C:\Windows\System\awpaxMf.exe
  2⤵
  PID:8048
- C:\Windows\System\YfIGFjm.exe
  C:\Windows\System\YfIGFjm.exe
  2⤵
  PID:8088
- C:\Windows\System\avGcVju.exe
  C:\Windows\System\avGcVju.exe
  2⤵
  PID:8112
- C:\Windows\System\kkgzgSD.exe
  C:\Windows\System\kkgzgSD.exe
  2⤵
  PID:8140
- C:\Windows\System\hdneHyR.exe
  C:\Windows\System\hdneHyR.exe
  2⤵
  PID:8172
- C:\Windows\System\AWBeigf.exe
  C:\Windows\System\AWBeigf.exe
  2⤵
  PID:7200
- C:\Windows\System\PqfpYOS.exe
  C:\Windows\System\PqfpYOS.exe
  2⤵
  PID:7256
- C:\Windows\System\JHgvQVA.exe
  C:\Windows\System\JHgvQVA.exe
  2⤵
  PID:7324
- C:\Windows\System\dwcUMam.exe
  C:\Windows\System\dwcUMam.exe
  2⤵
  PID:7380
- C:\Windows\System\gYMaaAD.exe
  C:\Windows\System\gYMaaAD.exe
  2⤵
  PID:7448
- C:\Windows\System\YRxRaTw.exe
  C:\Windows\System\YRxRaTw.exe
  2⤵
  PID:7492
- C:\Windows\System\gcQFGpM.exe
  C:\Windows\System\gcQFGpM.exe
  2⤵
  PID:7580
- C:\Windows\System\OWYFNQw.exe
  C:\Windows\System\OWYFNQw.exe
  2⤵
  PID:7636
- C:\Windows\System\vqNxyBS.exe
  C:\Windows\System\vqNxyBS.exe
  2⤵
  PID:7696
- C:\Windows\System\ZOrgUuI.exe
  C:\Windows\System\ZOrgUuI.exe
  2⤵
  PID:7796
- C:\Windows\System\UnucNNI.exe
  C:\Windows\System\UnucNNI.exe
  2⤵
  PID:7840
- C:\Windows\System\RPkNpAb.exe
  C:\Windows\System\RPkNpAb.exe
  2⤵
  PID:7876
- C:\Windows\System\JmZKPUI.exe
  C:\Windows\System\JmZKPUI.exe
  2⤵
  PID:7932
- C:\Windows\System\ZxwFfPU.exe
  C:\Windows\System\ZxwFfPU.exe
  2⤵
  PID:8012
- C:\Windows\System\PxmqHjI.exe
  C:\Windows\System\PxmqHjI.exe
  2⤵
  PID:8064
- C:\Windows\System\EFRUEFP.exe
  C:\Windows\System\EFRUEFP.exe
  2⤵
  PID:8124
- C:\Windows\System\rALwnge.exe
  C:\Windows\System\rALwnge.exe
  2⤵
  PID:7064
- C:\Windows\System\rcXfEta.exe
  C:\Windows\System\rcXfEta.exe
  2⤵
  PID:3732
- C:\Windows\System\CNeAEaK.exe
  C:\Windows\System\CNeAEaK.exe
  2⤵
  PID:7416
- C:\Windows\System\NphMdAe.exe
  C:\Windows\System\NphMdAe.exe
  2⤵
  PID:7564
- C:\Windows\System\qkEzSrD.exe
  C:\Windows\System\qkEzSrD.exe
  2⤵
  PID:7688
- C:\Windows\System\hLWGWMx.exe
  C:\Windows\System\hLWGWMx.exe
  2⤵
  PID:7908
- C:\Windows\System\aZhNWtx.exe
  C:\Windows\System\aZhNWtx.exe
  2⤵
  PID:8056
- C:\Windows\System\OGMlLxq.exe
  C:\Windows\System\OGMlLxq.exe
  2⤵
  PID:8160
- C:\Windows\System\NhHtcnf.exe
  C:\Windows\System\NhHtcnf.exe
  2⤵
  PID:7384
- C:\Windows\System\THhkysY.exe
  C:\Windows\System\THhkysY.exe
  2⤵
  PID:7716
- C:\Windows\System\wMrLgzH.exe
  C:\Windows\System\wMrLgzH.exe
  2⤵
  PID:1356
- C:\Windows\System\ERDoBlo.exe
  C:\Windows\System\ERDoBlo.exe
  2⤵
  PID:8104
- C:\Windows\System\ZmXqRgU.exe
  C:\Windows\System\ZmXqRgU.exe
  2⤵
  PID:7300
- C:\Windows\System\vgloDlp.exe
  C:\Windows\System\vgloDlp.exe
  2⤵
  PID:5084
- C:\Windows\System\hkTOKZn.exe
  C:\Windows\System\hkTOKZn.exe
  2⤵
  PID:8220
- C:\Windows\System\MelpoUN.exe
  C:\Windows\System\MelpoUN.exe
  2⤵
  PID:8260
- C:\Windows\System\QtWiRqe.exe
  C:\Windows\System\QtWiRqe.exe
  2⤵
  PID:8288
- C:\Windows\System\pOMCJZZ.exe
  C:\Windows\System\pOMCJZZ.exe
  2⤵
  PID:8316
- C:\Windows\System\pTtfIAp.exe
  C:\Windows\System\pTtfIAp.exe
  2⤵
  PID:8344
- C:\Windows\System\sDqxPhi.exe
  C:\Windows\System\sDqxPhi.exe
  2⤵
  PID:8380
- C:\Windows\System\rKckYBC.exe
  C:\Windows\System\rKckYBC.exe
  2⤵
  PID:8412
- C:\Windows\System\IHjlsdR.exe
  C:\Windows\System\IHjlsdR.exe
  2⤵
  PID:8440
- C:\Windows\System\dzOuoQv.exe
  C:\Windows\System\dzOuoQv.exe
  2⤵
  PID:8468
- C:\Windows\System\mgnfixp.exe
  C:\Windows\System\mgnfixp.exe
  2⤵
  PID:8496
- C:\Windows\System\jDQYVUa.exe
  C:\Windows\System\jDQYVUa.exe
  2⤵
  PID:8512
- C:\Windows\System\HQjwMPi.exe
  C:\Windows\System\HQjwMPi.exe
  2⤵
  PID:8532
- C:\Windows\System\mwfsNtS.exe
  C:\Windows\System\mwfsNtS.exe
  2⤵
  PID:8564
- C:\Windows\System\lhDeeRP.exe
  C:\Windows\System\lhDeeRP.exe
  2⤵
  PID:8596
- C:\Windows\System\jlvHrFU.exe
  C:\Windows\System\jlvHrFU.exe
  2⤵
  PID:8624
- C:\Windows\System\XqMgNEl.exe
  C:\Windows\System\XqMgNEl.exe
  2⤵
  PID:8648
- C:\Windows\System\BXzwIew.exe
  C:\Windows\System\BXzwIew.exe
  2⤵
  PID:8676
- C:\Windows\System\IVbzSNb.exe
  C:\Windows\System\IVbzSNb.exe
  2⤵
  PID:8700
- C:\Windows\System\GgZcnmM.exe
  C:\Windows\System\GgZcnmM.exe
  2⤵
  PID:8740
- C:\Windows\System\RcZgpRW.exe
  C:\Windows\System\RcZgpRW.exe
  2⤵
  PID:8760
- C:\Windows\System\EsgWgcd.exe
  C:\Windows\System\EsgWgcd.exe
  2⤵
  PID:8784
- C:\Windows\System\SaEuFHs.exe
  C:\Windows\System\SaEuFHs.exe
  2⤵
  PID:8820
- C:\Windows\System\esyENsx.exe
  C:\Windows\System\esyENsx.exe
  2⤵
  PID:8848
- C:\Windows\System\IUzYfQV.exe
  C:\Windows\System\IUzYfQV.exe
  2⤵
  PID:8888
- C:\Windows\System\uDCqRdZ.exe
  C:\Windows\System\uDCqRdZ.exe
  2⤵
  PID:8916
- C:\Windows\System\ZvXarnJ.exe
  C:\Windows\System\ZvXarnJ.exe
  2⤵
  PID:8932
- C:\Windows\System\QOFzuQn.exe
  C:\Windows\System\QOFzuQn.exe
  2⤵
  PID:8960
- C:\Windows\System\RzrGOZc.exe
  C:\Windows\System\RzrGOZc.exe
  2⤵
  PID:9000
- C:\Windows\System\cXIfRUA.exe
  C:\Windows\System\cXIfRUA.exe
  2⤵
  PID:9028
- C:\Windows\System\ZyboPPi.exe
  C:\Windows\System\ZyboPPi.exe
  2⤵
  PID:9044
- C:\Windows\System\iWWDoWP.exe
  C:\Windows\System\iWWDoWP.exe
  2⤵
  PID:9072
- C:\Windows\System\DCNXDRA.exe
  C:\Windows\System\DCNXDRA.exe
  2⤵
  PID:9100
- C:\Windows\System\IJvXotj.exe
  C:\Windows\System\IJvXotj.exe
  2⤵
  PID:9132
- C:\Windows\System\hgpPeRk.exe
  C:\Windows\System\hgpPeRk.exe
  2⤵
  PID:9168
- C:\Windows\System\xdpdNpq.exe
  C:\Windows\System\xdpdNpq.exe
  2⤵
  PID:9184
- C:\Windows\System\RbJAfdd.exe
  C:\Windows\System\RbJAfdd.exe
  2⤵
  PID:9200
- C:\Windows\System\trpYaJf.exe
  C:\Windows\System\trpYaJf.exe
  2⤵
  PID:7640
- C:\Windows\System\WWlbUYu.exe
  C:\Windows\System\WWlbUYu.exe
  2⤵
  PID:8272
- C:\Windows\System\fvTOtOm.exe
  C:\Windows\System\fvTOtOm.exe
  2⤵
  PID:8340
- C:\Windows\System\oiAvRJr.exe
  C:\Windows\System\oiAvRJr.exe
  2⤵
  PID:8424
- C:\Windows\System\tJMvnCO.exe
  C:\Windows\System\tJMvnCO.exe
  2⤵
  PID:8484
- C:\Windows\System\jZuqgvA.exe
  C:\Windows\System\jZuqgvA.exe
  2⤵
  PID:4624
- C:\Windows\System\BEXTSQh.exe
  C:\Windows\System\BEXTSQh.exe
  2⤵
  PID:8560
- C:\Windows\System\fnYLWDT.exe
  C:\Windows\System\fnYLWDT.exe
  2⤵
  PID:8668
- C:\Windows\System\xbWazsC.exe
  C:\Windows\System\xbWazsC.exe
  2⤵
  PID:8772
- C:\Windows\System\qVPssAt.exe
  C:\Windows\System\qVPssAt.exe
  2⤵
  PID:8796
- C:\Windows\System\MsSMZwJ.exe
  C:\Windows\System\MsSMZwJ.exe
  2⤵
  PID:8876
- C:\Windows\System\HmrIUXM.exe
  C:\Windows\System\HmrIUXM.exe
  2⤵
  PID:8912
- C:\Windows\System\vtDqxgh.exe
  C:\Windows\System\vtDqxgh.exe
  2⤵
  PID:8956
- C:\Windows\System\tEveGlY.exe
  C:\Windows\System\tEveGlY.exe
  2⤵
  PID:9012
- C:\Windows\System\runHjWt.exe
  C:\Windows\System\runHjWt.exe
  2⤵
  PID:9084
- C:\Windows\System\rCmlggX.exe
  C:\Windows\System\rCmlggX.exe
  2⤵
  PID:9120
- C:\Windows\System\PWLIhJK.exe
  C:\Windows\System\PWLIhJK.exe
  2⤵
  PID:9180
- C:\Windows\System\MyKrZtY.exe
  C:\Windows\System\MyKrZtY.exe
  2⤵
  PID:8356
- C:\Windows\System\pJhHgHG.exe
  C:\Windows\System\pJhHgHG.exe
  2⤵
  PID:8460
- C:\Windows\System\SuZsxta.exe
  C:\Windows\System\SuZsxta.exe
  2⤵
  PID:8608
- C:\Windows\System\LiXglFQ.exe
  C:\Windows\System\LiXglFQ.exe
  2⤵
  PID:8812
- C:\Windows\System\zJhOofT.exe
  C:\Windows\System\zJhOofT.exe
  2⤵
  PID:9036
- C:\Windows\System\pxqjsQM.exe
  C:\Windows\System\pxqjsQM.exe
  2⤵
  PID:9156
- C:\Windows\System\ESElVrS.exe
  C:\Windows\System\ESElVrS.exe
  2⤵
  PID:8304
- C:\Windows\System\OyDRbBA.exe
  C:\Windows\System\OyDRbBA.exe
  2⤵
  PID:8400
- C:\Windows\System\mRRCEGw.exe
  C:\Windows\System\mRRCEGw.exe
  2⤵
  PID:8780
- C:\Windows\System\dWpKkFp.exe
  C:\Windows\System\dWpKkFp.exe
  2⤵
  PID:9092
- C:\Windows\System\jVowBmc.exe
  C:\Windows\System\jVowBmc.exe
  2⤵
  PID:9140
- C:\Windows\System\mQXrDCm.exe
  C:\Windows\System\mQXrDCm.exe
  2⤵
  PID:9236
- C:\Windows\System\wTcrALe.exe
  C:\Windows\System\wTcrALe.exe
  2⤵
  PID:9264
- C:\Windows\System\pxlREmj.exe
  C:\Windows\System\pxlREmj.exe
  2⤵
  PID:9304
- C:\Windows\System\KbSwwRf.exe
  C:\Windows\System\KbSwwRf.exe
  2⤵
  PID:9332
- C:\Windows\System\MTTfmvR.exe
  C:\Windows\System\MTTfmvR.exe
  2⤵
  PID:9360
- C:\Windows\System\HRpdOzd.exe
  C:\Windows\System\HRpdOzd.exe
  2⤵
  PID:9392
- C:\Windows\System\MrNhaiG.exe
  C:\Windows\System\MrNhaiG.exe
  2⤵
  PID:9420
- C:\Windows\System\EjEhRTq.exe
  C:\Windows\System\EjEhRTq.exe
  2⤵
  PID:9448
- C:\Windows\System\RxsnYey.exe
  C:\Windows\System\RxsnYey.exe
  2⤵
  PID:9472
- C:\Windows\System\NLsqNdZ.exe
  C:\Windows\System\NLsqNdZ.exe
  2⤵
  PID:9496
- C:\Windows\System\rAwEHMg.exe
  C:\Windows\System\rAwEHMg.exe
  2⤵
  PID:9520
- C:\Windows\System\ZDuDIXq.exe
  C:\Windows\System\ZDuDIXq.exe
  2⤵
  PID:9536
- C:\Windows\System\ArdnpZD.exe
  C:\Windows\System\ArdnpZD.exe
  2⤵
  PID:9564
- C:\Windows\System\OYOxfqi.exe
  C:\Windows\System\OYOxfqi.exe
  2⤵
  PID:9600
- C:\Windows\System\EoXwdFy.exe
  C:\Windows\System\EoXwdFy.exe
  2⤵
  PID:9632
- C:\Windows\System\NECXHeJ.exe
  C:\Windows\System\NECXHeJ.exe
  2⤵
  PID:9664
- C:\Windows\System\VVZIwaK.exe
  C:\Windows\System\VVZIwaK.exe
  2⤵
  PID:9696
- C:\Windows\System\yyJymAa.exe
  C:\Windows\System\yyJymAa.exe
  2⤵
  PID:9728
- C:\Windows\System\GHiDLpU.exe
  C:\Windows\System\GHiDLpU.exe
  2⤵
  PID:9756
- C:\Windows\System\wyzBIqE.exe
  C:\Windows\System\wyzBIqE.exe
  2⤵
  PID:9784
- C:\Windows\System\nXNhiFi.exe
  C:\Windows\System\nXNhiFi.exe
  2⤵
  PID:9808
- C:\Windows\System\PHXWksK.exe
  C:\Windows\System\PHXWksK.exe
  2⤵
  PID:9828
- C:\Windows\System\WQIQwcp.exe
  C:\Windows\System\WQIQwcp.exe
  2⤵
  PID:9852
- C:\Windows\System\vnIYBaZ.exe
  C:\Windows\System\vnIYBaZ.exe
  2⤵
  PID:9884
- C:\Windows\System\KUcAEzI.exe
  C:\Windows\System\KUcAEzI.exe
  2⤵
  PID:9924
- C:\Windows\System\pKnOsjG.exe
  C:\Windows\System\pKnOsjG.exe
  2⤵
  PID:9952
- C:\Windows\System\aSJfIzY.exe
  C:\Windows\System\aSJfIzY.exe
  2⤵
  PID:9980
- C:\Windows\System\bJbxDIB.exe
  C:\Windows\System\bJbxDIB.exe
  2⤵
  PID:10008
- C:\Windows\System\gdanGPL.exe
  C:\Windows\System\gdanGPL.exe
  2⤵
  PID:10036
- C:\Windows\System\fDoNHHy.exe
  C:\Windows\System\fDoNHHy.exe
  2⤵
  PID:10064
- C:\Windows\System\KWraHkw.exe
  C:\Windows\System\KWraHkw.exe
  2⤵
  PID:10080
- C:\Windows\System\wshHxwE.exe
  C:\Windows\System\wshHxwE.exe
  2⤵
  PID:10108
- C:\Windows\System\djclnej.exe
  C:\Windows\System\djclnej.exe
  2⤵
  PID:10136
- C:\Windows\System\WOhpTjb.exe
  C:\Windows\System\WOhpTjb.exe
  2⤵
  PID:10164
- C:\Windows\System\NeEjprc.exe
  C:\Windows\System\NeEjprc.exe
  2⤵
  PID:10204
- C:\Windows\System\MoCNxBb.exe
  C:\Windows\System\MoCNxBb.exe
  2⤵
  PID:10220
- C:\Windows\System\jtvotmr.exe
  C:\Windows\System\jtvotmr.exe
  2⤵
  PID:10236
- C:\Windows\System\GPiptOM.exe
  C:\Windows\System\GPiptOM.exe
  2⤵
  PID:9248
- C:\Windows\System\gKkkhaI.exe
  C:\Windows\System\gKkkhaI.exe
  2⤵
  PID:9324
- C:\Windows\System\aJXxlrf.exe
  C:\Windows\System\aJXxlrf.exe
  2⤵
  PID:9388
- C:\Windows\System\snOLuVN.exe
  C:\Windows\System\snOLuVN.exe
  2⤵
  PID:9460
- C:\Windows\System\VOGgpsk.exe
  C:\Windows\System\VOGgpsk.exe
  2⤵
  PID:9548
- C:\Windows\System\XIqWKrG.exe
  C:\Windows\System\XIqWKrG.exe
  2⤵
  PID:5088
- C:\Windows\System\SEsSLWt.exe
  C:\Windows\System\SEsSLWt.exe
  2⤵
  PID:9644
- C:\Windows\System\AVqwTEC.exe
  C:\Windows\System\AVqwTEC.exe
  2⤵
  PID:9712
- C:\Windows\System\LKJaJoe.exe
  C:\Windows\System\LKJaJoe.exe
  2⤵
  PID:9776
- C:\Windows\System\HqeTHOv.exe
  C:\Windows\System\HqeTHOv.exe
  2⤵
  PID:9804
- C:\Windows\System\klOuOEF.exe
  C:\Windows\System\klOuOEF.exe
  2⤵
  PID:9896
- C:\Windows\System\HNKfZMh.exe
  C:\Windows\System\HNKfZMh.exe
  2⤵
  PID:9968
- C:\Windows\System\cHKCUTp.exe
  C:\Windows\System\cHKCUTp.exe
  2⤵
  PID:10032
- C:\Windows\System\GDkfcAF.exe
  C:\Windows\System\GDkfcAF.exe
  2⤵
  PID:10096
- C:\Windows\System\ktfQjLt.exe
  C:\Windows\System\ktfQjLt.exe
  2⤵
  PID:10120
- C:\Windows\System\WSHTvIo.exe
  C:\Windows\System\WSHTvIo.exe
  2⤵
  PID:10192
- C:\Windows\System\zGPtHCh.exe
  C:\Windows\System\zGPtHCh.exe
  2⤵
  PID:8216
- C:\Windows\System\JHYYVGs.exe
  C:\Windows\System\JHYYVGs.exe
  2⤵
  PID:9372
- C:\Windows\System\SIYdqDl.exe
  C:\Windows\System\SIYdqDl.exe
  2⤵
  PID:9512
- C:\Windows\System\GTYproH.exe
  C:\Windows\System\GTYproH.exe
  2⤵
  PID:9740
- C:\Windows\System\yovhVpF.exe
  C:\Windows\System\yovhVpF.exe
  2⤵
  PID:9880
- C:\Windows\System\cgchpXQ.exe
  C:\Windows\System\cgchpXQ.exe
  2⤵
  PID:9964
- C:\Windows\System\meRJsVR.exe
  C:\Windows\System\meRJsVR.exe
  2⤵
  PID:10128
- C:\Windows\System\gsnSaEK.exe
  C:\Windows\System\gsnSaEK.exe
  2⤵
  PID:10156
- C:\Windows\System\XjmDkNK.exe
  C:\Windows\System\XjmDkNK.exe
  2⤵
  PID:9416
- C:\Windows\System\bChAuMR.exe
  C:\Windows\System\bChAuMR.exe
  2⤵
  PID:9436
- C:\Windows\System\vAkzUTl.exe
  C:\Windows\System\vAkzUTl.exe
  2⤵
  PID:9620
- C:\Windows\System\fguNzvY.exe
  C:\Windows\System\fguNzvY.exe
  2⤵
  PID:10024
- C:\Windows\System\uIJmLsT.exe
  C:\Windows\System\uIJmLsT.exe
  2⤵
  PID:10216
- C:\Windows\System\IEtPkGx.exe
  C:\Windows\System\IEtPkGx.exe
  2⤵
  PID:10272
- C:\Windows\System\gphjZHe.exe
  C:\Windows\System\gphjZHe.exe
  2⤵
  PID:10308
- C:\Windows\System\SLRTOia.exe
  C:\Windows\System\SLRTOia.exe
  2⤵
  PID:10332
- C:\Windows\System\dxYeypS.exe
  C:\Windows\System\dxYeypS.exe
  2⤵
  PID:10372
- C:\Windows\System\NdTriuv.exe
  C:\Windows\System\NdTriuv.exe
  2⤵
  PID:10388
- C:\Windows\System\slBocae.exe
  C:\Windows\System\slBocae.exe
  2⤵
  PID:10412
- C:\Windows\System\SXRuHvA.exe
  C:\Windows\System\SXRuHvA.exe
  2⤵
  PID:10440
- C:\Windows\System\CUjnWka.exe
  C:\Windows\System\CUjnWka.exe
  2⤵
  PID:10468
- C:\Windows\System\SYosHDw.exe
  C:\Windows\System\SYosHDw.exe
  2⤵
  PID:10500
- C:\Windows\System\VTysuKn.exe
  C:\Windows\System\VTysuKn.exe
  2⤵
  PID:10520
- C:\Windows\System\ZFLrjpK.exe
  C:\Windows\System\ZFLrjpK.exe
  2⤵
  PID:10552
- C:\Windows\System\aGtTwhE.exe
  C:\Windows\System\aGtTwhE.exe
  2⤵
  PID:10580
- C:\Windows\System\efaeawM.exe
  C:\Windows\System\efaeawM.exe
  2⤵
  PID:10624
- C:\Windows\System\BxRpVCk.exe
  C:\Windows\System\BxRpVCk.exe
  2⤵
  PID:10644
- C:\Windows\System\ycJWSVZ.exe
  C:\Windows\System\ycJWSVZ.exe
  2⤵
  PID:10676
- C:\Windows\System\lDWepmZ.exe
  C:\Windows\System\lDWepmZ.exe
  2⤵
  PID:10696
- C:\Windows\System\ctjXhOW.exe
  C:\Windows\System\ctjXhOW.exe
  2⤵
  PID:10724
- C:\Windows\System\AdTDvKN.exe
  C:\Windows\System\AdTDvKN.exe
  2⤵
  PID:10756
- C:\Windows\System\OYeEMSJ.exe
  C:\Windows\System\OYeEMSJ.exe
  2⤵
  PID:10784
- C:\Windows\System\vWTGByx.exe
  C:\Windows\System\vWTGByx.exe
  2⤵
  PID:10816
- C:\Windows\System\SDsSmiS.exe
  C:\Windows\System\SDsSmiS.exe
  2⤵
  PID:10840
- C:\Windows\System\RopXEIM.exe
  C:\Windows\System\RopXEIM.exe
  2⤵
  PID:10868
- C:\Windows\System\HaXDSbU.exe
  C:\Windows\System\HaXDSbU.exe
  2⤵
  PID:10904
- C:\Windows\System\aRRowhv.exe
  C:\Windows\System\aRRowhv.exe
  2⤵
  PID:10932
- C:\Windows\System\jkOzAuv.exe
  C:\Windows\System\jkOzAuv.exe
  2⤵
  PID:10960
- C:\Windows\System\prudEla.exe
  C:\Windows\System\prudEla.exe
  2⤵
  PID:10992
- C:\Windows\System\fWMygWJ.exe
  C:\Windows\System\fWMygWJ.exe
  2⤵
  PID:11016
- C:\Windows\System\Uvyjjjx.exe
  C:\Windows\System\Uvyjjjx.exe
  2⤵
  PID:11056
- C:\Windows\System\GuGPYlB.exe
  C:\Windows\System\GuGPYlB.exe
  2⤵
  PID:11072
- C:\Windows\System\LQNRpvy.exe
  C:\Windows\System\LQNRpvy.exe
  2⤵
  PID:11100
- C:\Windows\System\oigslNQ.exe
  C:\Windows\System\oigslNQ.exe
  2⤵
  PID:11140
- C:\Windows\System\NerdQze.exe
  C:\Windows\System\NerdQze.exe
  2⤵
  PID:11168
- C:\Windows\System\USwWumD.exe
  C:\Windows\System\USwWumD.exe
  2⤵
  PID:11188
- C:\Windows\System\QKIbulq.exe
  C:\Windows\System\QKIbulq.exe
  2⤵
  PID:11220
- C:\Windows\System\NNhEtAe.exe
  C:\Windows\System\NNhEtAe.exe
  2⤵
  PID:11260
- C:\Windows\System\SnwzMJU.exe
  C:\Windows\System\SnwzMJU.exe
  2⤵
  PID:9940
- C:\Windows\System\iigvXBT.exe
  C:\Windows\System\iigvXBT.exe
  2⤵
  PID:10268
- C:\Windows\System\kfCqOva.exe
  C:\Windows\System\kfCqOva.exe
  2⤵
  PID:10328
- C:\Windows\System\btShFTT.exe
  C:\Windows\System\btShFTT.exe
  2⤵
  PID:10436
- C:\Windows\System\YKgEupN.exe
  C:\Windows\System\YKgEupN.exe
  2⤵
  PID:10484
- C:\Windows\System\YvYDYHu.exe
  C:\Windows\System\YvYDYHu.exe
  2⤵
  PID:10560
- C:\Windows\System\efJwPUM.exe
  C:\Windows\System\efJwPUM.exe
  2⤵
  PID:10672
- C:\Windows\System\Peatvsw.exe
  C:\Windows\System\Peatvsw.exe
  2⤵
  PID:10712
- C:\Windows\System\zxocvEw.exe
  C:\Windows\System\zxocvEw.exe
  2⤵
  PID:10792
- C:\Windows\System\oGbwreN.exe
  C:\Windows\System\oGbwreN.exe
  2⤵
  PID:10892
- C:\Windows\System\EXlMlOt.exe
  C:\Windows\System\EXlMlOt.exe
  2⤵
  PID:10920
- C:\Windows\System\hyfpdKi.exe
  C:\Windows\System\hyfpdKi.exe
  2⤵
  PID:10972
- C:\Windows\System\XuEvIgi.exe
  C:\Windows\System\XuEvIgi.exe
  2⤵
  PID:11024
- C:\Windows\System\IzlSSfk.exe
  C:\Windows\System\IzlSSfk.exe
  2⤵
  PID:11068
- C:\Windows\System\fseNkvS.exe
  C:\Windows\System\fseNkvS.exe
  2⤵
  PID:11152
- C:\Windows\System\EAcyeXU.exe
  C:\Windows\System\EAcyeXU.exe
  2⤵
  PID:11204
- C:\Windows\System\IYdXCgj.exe
  C:\Windows\System\IYdXCgj.exe
  2⤵
  PID:10292
- C:\Windows\System\CBlCRET.exe
  C:\Windows\System\CBlCRET.exe
  2⤵
  PID:10384
- C:\Windows\System\WQzKXBa.exe
  C:\Windows\System\WQzKXBa.exe
  2⤵
  PID:10612
- C:\Windows\System\GceLUWe.exe
  C:\Windows\System\GceLUWe.exe
  2⤵
  PID:10732
- C:\Windows\System\VMUJMwu.exe
  C:\Windows\System\VMUJMwu.exe
  2⤵
  PID:10864
- C:\Windows\System\zWjzrye.exe
  C:\Windows\System\zWjzrye.exe
  2⤵
  PID:10948
- C:\Windows\System\lXsNeFE.exe
  C:\Windows\System\lXsNeFE.exe
  2⤵
  PID:4524
- C:\Windows\System\kjfvfEX.exe
  C:\Windows\System\kjfvfEX.exe
  2⤵
  PID:11184
- C:\Windows\System\AUQwdrC.exe
  C:\Windows\System\AUQwdrC.exe
  2⤵
  PID:10380
- C:\Windows\System\eSfLvjn.exe
  C:\Windows\System\eSfLvjn.exe
  2⤵
  PID:10664
- C:\Windows\System\qhQaYxU.exe
  C:\Windows\System\qhQaYxU.exe
  2⤵
  PID:11036
- C:\Windows\System\exWRrCH.exe
  C:\Windows\System\exWRrCH.exe
  2⤵
  PID:10548
- C:\Windows\System\pVRvlwo.exe
  C:\Windows\System\pVRvlwo.exe
  2⤵
  PID:11284
- C:\Windows\System\zZJhazG.exe
  C:\Windows\System\zZJhazG.exe
  2⤵
  PID:11304
- C:\Windows\System\afPFyPs.exe
  C:\Windows\System\afPFyPs.exe
  2⤵
  PID:11332
- C:\Windows\System\rYTHKWC.exe
  C:\Windows\System\rYTHKWC.exe
  2⤵
  PID:11372
- C:\Windows\System\qkYZPYx.exe
  C:\Windows\System\qkYZPYx.exe
  2⤵
  PID:11404
- C:\Windows\System\HTbrOgI.exe
  C:\Windows\System\HTbrOgI.exe
  2⤵
  PID:11440
- C:\Windows\System\oOaTzeQ.exe
  C:\Windows\System\oOaTzeQ.exe
  2⤵
  PID:11456
- C:\Windows\System\AKkTdOO.exe
  C:\Windows\System\AKkTdOO.exe
  2⤵
  PID:11472
- C:\Windows\System\oxYeKOa.exe
  C:\Windows\System\oxYeKOa.exe
  2⤵
  PID:11492
- C:\Windows\System\MmdQDAr.exe
  C:\Windows\System\MmdQDAr.exe
  2⤵
  PID:11528
- C:\Windows\System\OLpaYzs.exe
  C:\Windows\System\OLpaYzs.exe
  2⤵
  PID:11564
- C:\Windows\System\axtuGCP.exe
  C:\Windows\System\axtuGCP.exe
  2⤵
  PID:11592
- C:\Windows\System\NDABvUb.exe
  C:\Windows\System\NDABvUb.exe
  2⤵
  PID:11620
- C:\Windows\System\iPOeyma.exe
  C:\Windows\System\iPOeyma.exe
  2⤵
  PID:11652
- C:\Windows\System\xsQuNRY.exe
  C:\Windows\System\xsQuNRY.exe
  2⤵
  PID:11680
- C:\Windows\System\ErTtnvA.exe
  C:\Windows\System\ErTtnvA.exe
  2⤵
  PID:11708
- C:\Windows\System\GJNdrLg.exe
  C:\Windows\System\GJNdrLg.exe
  2⤵
  PID:11736
- C:\Windows\System\qKzxAry.exe
  C:\Windows\System\qKzxAry.exe
  2⤵
  PID:11764
- C:\Windows\System\tRCvswT.exe
  C:\Windows\System\tRCvswT.exe
  2⤵
  PID:11792
- C:\Windows\System\gbrLUMG.exe
  C:\Windows\System\gbrLUMG.exe
  2⤵
  PID:11824
- C:\Windows\System\SHiqqkr.exe
  C:\Windows\System\SHiqqkr.exe
  2⤵
  PID:11852
- C:\Windows\System\sYeZwfj.exe
  C:\Windows\System\sYeZwfj.exe
  2⤵
  PID:11868
- C:\Windows\System\uwDCous.exe
  C:\Windows\System\uwDCous.exe
  2⤵
  PID:11900
- C:\Windows\System\aLFobBn.exe
  C:\Windows\System\aLFobBn.exe
  2⤵
  PID:11936
- C:\Windows\System\cKdHbyN.exe
  C:\Windows\System\cKdHbyN.exe
  2⤵
  PID:11964
- C:\Windows\System\QxDCNpI.exe
  C:\Windows\System\QxDCNpI.exe
  2⤵
  PID:11992
- C:\Windows\System\xFOPfJz.exe
  C:\Windows\System\xFOPfJz.exe
  2⤵
  PID:12020
- C:\Windows\System\FVnpvSs.exe
  C:\Windows\System\FVnpvSs.exe
  2⤵
  PID:12048
- C:\Windows\System\kpIMVpX.exe
  C:\Windows\System\kpIMVpX.exe
  2⤵
  PID:12076
- C:\Windows\System\YrvtBZS.exe
  C:\Windows\System\YrvtBZS.exe
  2⤵
  PID:12112
- C:\Windows\System\ZndEefi.exe
  C:\Windows\System\ZndEefi.exe
  2⤵
  PID:12144
- C:\Windows\System\jFBBiAF.exe
  C:\Windows\System\jFBBiAF.exe
  2⤵
  PID:12168
- C:\Windows\System\UyfrciV.exe
  C:\Windows\System\UyfrciV.exe
  2⤵
  PID:12188
- C:\Windows\System\ygofAxR.exe
  C:\Windows\System\ygofAxR.exe
  2⤵
  PID:12216
- C:\Windows\System\ypNnOGx.exe
  C:\Windows\System\ypNnOGx.exe
  2⤵
  PID:12244
- C:\Windows\System\aMDXWSj.exe
  C:\Windows\System\aMDXWSj.exe
  2⤵
  PID:12260
- C:\Windows\System\FRZtgIm.exe
  C:\Windows\System\FRZtgIm.exe
  2⤵
  PID:12280
- C:\Windows\System\ZrKMMzG.exe
  C:\Windows\System\ZrKMMzG.exe
  2⤵
  PID:11064
- C:\Windows\System\YvZnwLb.exe
  C:\Windows\System\YvZnwLb.exe
  2⤵
  PID:11300
- C:\Windows\System\kYAsvvt.exe
  C:\Windows\System\kYAsvvt.exe
  2⤵
  PID:11348
- C:\Windows\System\pocpKPF.exe
  C:\Windows\System\pocpKPF.exe
  2⤵
  PID:11424
- C:\Windows\System\ghLNfUw.exe
  C:\Windows\System\ghLNfUw.exe
  2⤵
  PID:11520
- C:\Windows\System\DptbyAz.exe
  C:\Windows\System\DptbyAz.exe
  2⤵
  PID:11584
- C:\Windows\System\dabhgZI.exe
  C:\Windows\System\dabhgZI.exe
  2⤵
  PID:11636
- C:\Windows\System\KnraaWZ.exe
  C:\Windows\System\KnraaWZ.exe
  2⤵
  PID:11696
- C:\Windows\System\mGPryVH.exe
  C:\Windows\System\mGPryVH.exe
  2⤵
  PID:11788
- C:\Windows\System\MIUBtwz.exe
  C:\Windows\System\MIUBtwz.exe
  2⤵
  PID:11840
- C:\Windows\System\TTKZIbz.exe
  C:\Windows\System\TTKZIbz.exe
  2⤵
  PID:11880
- C:\Windows\System\wGkCsIH.exe
  C:\Windows\System\wGkCsIH.exe
  2⤵
  PID:11976
- C:\Windows\System\lpGJGSy.exe
  C:\Windows\System\lpGJGSy.exe
  2⤵
  PID:12032
- C:\Windows\System\moDUFfM.exe
  C:\Windows\System\moDUFfM.exe
  2⤵
  PID:12104
- C:\Windows\System\StVcOsu.exe
  C:\Windows\System\StVcOsu.exe
  2⤵
  PID:12180
- C:\Windows\System\sJjsKXU.exe
  C:\Windows\System\sJjsKXU.exe
  2⤵
  PID:12268
- C:\Windows\System\UscWosW.exe
  C:\Windows\System\UscWosW.exe
  2⤵
  PID:11328
- C:\Windows\System\AzLLhMl.exe
  C:\Windows\System\AzLLhMl.exe
  2⤵
  PID:11412
- C:\Windows\System\jzjGduK.exe
  C:\Windows\System\jzjGduK.exe
  2⤵
  PID:11536
- C:\Windows\System\qRTDTnX.exe
  C:\Windows\System\qRTDTnX.exe
  2⤵
  PID:11720
- C:\Windows\System\lWVBCum.exe
  C:\Windows\System\lWVBCum.exe
  2⤵
  PID:11752
- C:\Windows\System\moikjlD.exe
  C:\Windows\System\moikjlD.exe
  2⤵
  PID:11924
- C:\Windows\System\Ierghki.exe
  C:\Windows\System\Ierghki.exe
  2⤵
  PID:11952
- C:\Windows\System\YDmJPrY.exe
  C:\Windows\System\YDmJPrY.exe
  2⤵
  PID:12156
- C:\Windows\System\izXQbbQ.exe
  C:\Windows\System\izXQbbQ.exe
  2⤵
  PID:11272
- C:\Windows\System\ABsEiLV.exe
  C:\Windows\System\ABsEiLV.exe
  2⤵
  PID:11664
- C:\Windows\System\iXFfOHi.exe
  C:\Windows\System\iXFfOHi.exe
  2⤵
  PID:12088
- C:\Windows\System\JAiVTme.exe
  C:\Windows\System\JAiVTme.exe
  2⤵
  PID:12296
- C:\Windows\System\htlrMxo.exe
  C:\Windows\System\htlrMxo.exe
  2⤵
  PID:12316
- C:\Windows\System\CejgeSn.exe
  C:\Windows\System\CejgeSn.exe
  2⤵
  PID:12348
- C:\Windows\System\AVByoHY.exe
  C:\Windows\System\AVByoHY.exe
  2⤵
  PID:12384
- C:\Windows\System\SiwBRoS.exe
  C:\Windows\System\SiwBRoS.exe
  2⤵
  PID:12416
- C:\Windows\System\TaeBVhl.exe
  C:\Windows\System\TaeBVhl.exe
  2⤵
  PID:12440
- C:\Windows\System\aSnZcyg.exe
  C:\Windows\System\aSnZcyg.exe
  2⤵
  PID:12472
- C:\Windows\System\DJlBerR.exe
  C:\Windows\System\DJlBerR.exe
  2⤵
  PID:12492
- C:\Windows\System\LzESaer.exe
  C:\Windows\System\LzESaer.exe
  2⤵
  PID:12512
- C:\Windows\System\SXeLZNw.exe
  C:\Windows\System\SXeLZNw.exe
  2⤵
  PID:12552
- C:\Windows\System\btiCpDR.exe
  C:\Windows\System\btiCpDR.exe
  2⤵
  PID:12572
- C:\Windows\System\pknYCrH.exe
  C:\Windows\System\pknYCrH.exe
  2⤵
  PID:12600
- C:\Windows\System\sqvXWfN.exe
  C:\Windows\System\sqvXWfN.exe
  2⤵
  PID:12632
- C:\Windows\System\SPtIlvZ.exe
  C:\Windows\System\SPtIlvZ.exe
  2⤵
  PID:12676
- C:\Windows\System\kebUNub.exe
  C:\Windows\System\kebUNub.exe
  2⤵
  PID:12704
- C:\Windows\System\jjXOHne.exe
  C:\Windows\System\jjXOHne.exe
  2⤵
  PID:12720
- C:\Windows\System\LvqEgmk.exe
  C:\Windows\System\LvqEgmk.exe
  2⤵
  PID:12744
- C:\Windows\System\WaEkYhs.exe
  C:\Windows\System\WaEkYhs.exe
  2⤵
  PID:12772
- C:\Windows\System\TFKsxNp.exe
  C:\Windows\System\TFKsxNp.exe
  2⤵
  PID:12800
- C:\Windows\System\pdQhBLJ.exe
  C:\Windows\System\pdQhBLJ.exe
  2⤵
  PID:12832
- C:\Windows\System\kkKtZbD.exe
  C:\Windows\System\kkKtZbD.exe
  2⤵
  PID:12860
- C:\Windows\System\ftyiJic.exe
  C:\Windows\System\ftyiJic.exe
  2⤵
  PID:12884
- C:\Windows\System\KGYlZOi.exe
  C:\Windows\System\KGYlZOi.exe
  2⤵
  PID:12912
- C:\Windows\System\WOMyTvr.exe
  C:\Windows\System\WOMyTvr.exe
  2⤵
  PID:12980
- C:\Windows\System\vqyjpiq.exe
  C:\Windows\System\vqyjpiq.exe
  2⤵
  PID:13004
- C:\Windows\System\rhHqeFb.exe
  C:\Windows\System\rhHqeFb.exe
  2⤵
  PID:13020
- C:\Windows\System\adoKagY.exe
  C:\Windows\System\adoKagY.exe
  2⤵
  PID:13060
- C:\Windows\System\SyxvDuy.exe
  C:\Windows\System\SyxvDuy.exe
  2⤵
  PID:13088
- C:\Windows\System\rGSIQKW.exe
  C:\Windows\System\rGSIQKW.exe
  2⤵
  PID:13116
- C:\Windows\System\GYadFzj.exe
  C:\Windows\System\GYadFzj.exe
  2⤵
  PID:13132
- C:\Windows\System\vMFmAEl.exe
  C:\Windows\System\vMFmAEl.exe
  2⤵
  PID:13164
- C:\Windows\System\TZpHaNm.exe
  C:\Windows\System\TZpHaNm.exe
  2⤵
  PID:13188
- C:\Windows\System\JHOmnEd.exe
  C:\Windows\System\JHOmnEd.exe
  2⤵
  PID:13208
- C:\Windows\System\QuQZfFQ.exe
  C:\Windows\System\QuQZfFQ.exe
  2⤵
  PID:13224
- C:\Windows\System\QEItZLA.exe
  C:\Windows\System\QEItZLA.exe
  2⤵
  PID:13256
- C:\Windows\System\yiZiYFt.exe
  C:\Windows\System\yiZiYFt.exe
  2⤵
  PID:13284
- C:\Windows\System\rybmAQK.exe
  C:\Windows\System\rybmAQK.exe
  2⤵
  PID:11468
- C:\Windows\System\hoZecXV.exe
  C:\Windows\System\hoZecXV.exe
  2⤵
  PID:11920
- C:\Windows\System\UuNTzLm.exe
  C:\Windows\System\UuNTzLm.exe
  2⤵
  PID:12336
- C:\Windows\System\qYEJnKo.exe
  C:\Windows\System\qYEJnKo.exe
  2⤵
  PID:12448
- C:\Windows\System\yWrQlBO.exe
  C:\Windows\System\yWrQlBO.exe
  2⤵
  PID:12488
- C:\Windows\System\nNCeTlz.exe
  C:\Windows\System\nNCeTlz.exe
  2⤵
  PID:12504
- C:\Windows\System\apjEZHa.exe
  C:\Windows\System\apjEZHa.exe
  2⤵
  PID:12664
- C:\Windows\System\WAvKzfr.exe
  C:\Windows\System\WAvKzfr.exe
  2⤵
  PID:12700
- C:\Windows\System\EXSEScY.exe
  C:\Windows\System\EXSEScY.exe
  2⤵
  PID:12768
- C:\Windows\System\BCZXtHa.exe
  C:\Windows\System\BCZXtHa.exe
  2⤵
  PID:12796
- C:\Windows\System\mrfSKfr.exe
  C:\Windows\System\mrfSKfr.exe
  2⤵
  PID:12816
- C:\Windows\System\DZTzqvr.exe
  C:\Windows\System\DZTzqvr.exe
  2⤵
  PID:2424
- C:\Windows\System\iPanLLN.exe
  C:\Windows\System\iPanLLN.exe
  2⤵
  PID:7008
- C:\Windows\System\xePvqfp.exe
  C:\Windows\System\xePvqfp.exe
  2⤵
  PID:12988
- C:\Windows\System\rwrgKhi.exe
  C:\Windows\System\rwrgKhi.exe
  2⤵
  PID:13000
- C:\Windows\System\fwzWotb.exe
  C:\Windows\System\fwzWotb.exe
  2⤵
  PID:13124
- C:\Windows\System\sAslTGf.exe
  C:\Windows\System\sAslTGf.exe
  2⤵
  PID:13108
- C:\Windows\System\PzNQKTp.exe
  C:\Windows\System\PzNQKTp.exe
  2⤵
  PID:13252
- C:\Windows\System\OVeXBAH.exe
  C:\Windows\System\OVeXBAH.exe
  2⤵
  PID:13304
- C:\Windows\System\ZWVcsUt.exe
  C:\Windows\System\ZWVcsUt.exe
  2⤵
  PID:12408
- C:\Windows\System\zKEblkp.exe
  C:\Windows\System\zKEblkp.exe
  2⤵
  PID:12732
- C:\Windows\System\mlomeiN.exe
  C:\Windows\System\mlomeiN.exe
  2⤵
  PID:12712
- C:\Windows\System\rxtgHCi.exe
  C:\Windows\System\rxtgHCi.exe
  2⤵
  PID:12792
- C:\Windows\System\rToELNP.exe
  C:\Windows\System\rToELNP.exe
  2⤵
  PID:12852
- C:\Windows\System\CdwtDrs.exe
  C:\Windows\System\CdwtDrs.exe
  2⤵
  PID:1500
- C:\Windows\System\spJLqLl.exe
  C:\Windows\System\spJLqLl.exe
  2⤵
  PID:13032
- C:\Windows\System\GAQmwWF.exe
  C:\Windows\System\GAQmwWF.exe
  2⤵
  PID:13100
- C:\Windows\System\DNNSvww.exe
  C:\Windows\System\DNNSvww.exe
  2⤵
  PID:12596
- C:\Windows\System\avSpbvb.exe
  C:\Windows\System\avSpbvb.exe
  2⤵
  PID:12312
- C:\Windows\System\iLhsMnB.exe
  C:\Windows\System\iLhsMnB.exe
  2⤵
  PID:12876
- C:\Windows\System\jChowwW.exe
  C:\Windows\System\jChowwW.exe
  2⤵
  PID:13320
- C:\Windows\System\PgThLgU.exe
  C:\Windows\System\PgThLgU.exe
  2⤵
  PID:13352
- C:\Windows\System\qGUshEm.exe
  C:\Windows\System\qGUshEm.exe
  2⤵
  PID:13376
- C:\Windows\System\zebcDxC.exe
  C:\Windows\System\zebcDxC.exe
  2⤵
  PID:13396
- C:\Windows\System\vspQmDu.exe
  C:\Windows\System\vspQmDu.exe
  2⤵
  PID:13420
- C:\Windows\System\kxhFegP.exe
  C:\Windows\System\kxhFegP.exe
  2⤵
  PID:13448
- C:\Windows\System\bBRoocD.exe
  C:\Windows\System\bBRoocD.exe
  2⤵
  PID:13480
- C:\Windows\System\TTDevCO.exe
  C:\Windows\System\TTDevCO.exe
  2⤵
  PID:13512
- C:\Windows\System\GudYdZu.exe
  C:\Windows\System\GudYdZu.exe
  2⤵
  PID:13536
- C:\Windows\System\QOyGHVk.exe
  C:\Windows\System\QOyGHVk.exe
  2⤵
  PID:13560
- C:\Windows\System\lASQfvJ.exe
  C:\Windows\System\lASQfvJ.exe
  2⤵
  PID:13596
- C:\Windows\System\zAuTXuH.exe
  C:\Windows\System\zAuTXuH.exe
  2⤵
  PID:13628
- C:\Windows\System\yKmFHTg.exe
  C:\Windows\System\yKmFHTg.exe
  2⤵
  PID:13656
- C:\Windows\System\wvpBXel.exe
  C:\Windows\System\wvpBXel.exe
  2⤵
  PID:13680
- C:\Windows\System\hmJCwvf.exe
  C:\Windows\System\hmJCwvf.exe
  2⤵
  PID:13708
- C:\Windows\System\iMGedHc.exe
  C:\Windows\System\iMGedHc.exe
  2⤵
  PID:13740
- C:\Windows\System\apprAUf.exe
  C:\Windows\System\apprAUf.exe
  2⤵
  PID:13780
- C:\Windows\System\uuJbDCP.exe
  C:\Windows\System\uuJbDCP.exe
  2⤵
  PID:13800
- C:\Windows\System\BjWsULE.exe
  C:\Windows\System\BjWsULE.exe
  2⤵
  PID:13828
- C:\Windows\System\nbUpMkN.exe
  C:\Windows\System\nbUpMkN.exe
  2⤵
  PID:13860
- C:\Windows\System\NnBjnqv.exe
  C:\Windows\System\NnBjnqv.exe
  2⤵
  PID:13892
- C:\Windows\System\GRyOKrG.exe
  C:\Windows\System\GRyOKrG.exe
  2⤵
  PID:13916
- C:\Windows\System\XoCOzsw.exe
  C:\Windows\System\XoCOzsw.exe
  2⤵
  PID:13948
- C:\Windows\System\FrwxNSw.exe
  C:\Windows\System\FrwxNSw.exe
  2⤵
  PID:13976
- C:\Windows\System\ZVJLExZ.exe
  C:\Windows\System\ZVJLExZ.exe
  2⤵
  PID:14004
- C:\Windows\System\DLzdFQe.exe
  C:\Windows\System\DLzdFQe.exe
  2⤵
  PID:14032
- C:\Windows\System\OmUcghj.exe
  C:\Windows\System\OmUcghj.exe
  2⤵
  PID:14056
- C:\Windows\System\GGUWQPF.exe
  C:\Windows\System\GGUWQPF.exe
  2⤵
  PID:14080
- C:\Windows\System\kkREfdx.exe
  C:\Windows\System\kkREfdx.exe
  2⤵
  PID:14100
- C:\Windows\System\lSvDloi.exe
  C:\Windows\System\lSvDloi.exe
  2⤵
  PID:14120
- C:\Windows\System\qEqTdgQ.exe
  C:\Windows\System\qEqTdgQ.exe
  2⤵
  PID:14144
- C:\Windows\System\sRIiHGi.exe
  C:\Windows\System\sRIiHGi.exe
  2⤵
  PID:14184
- C:\Windows\System\YsNEEWD.exe
  C:\Windows\System\YsNEEWD.exe
  2⤵
  PID:14212
- C:\Windows\System\JHfhzYi.exe
  C:\Windows\System\JHfhzYi.exe
  2⤵
  PID:14248
- C:\Windows\System\QKxTShF.exe
  C:\Windows\System\QKxTShF.exe
  2⤵
  PID:14280
- C:\Windows\System\miXCcCc.exe
  C:\Windows\System\miXCcCc.exe
  2⤵
  PID:14296
- C:\Windows\System\XAsTEcz.exe
  C:\Windows\System\XAsTEcz.exe
  2⤵
  PID:14332
- C:\Windows\System\tInrrML.exe
  C:\Windows\System\tInrrML.exe
  2⤵
  PID:860
- C:\Windows\System\JYzhbMr.exe
  C:\Windows\System\JYzhbMr.exe
  2⤵
  PID:12976
- C:\Windows\System\lkVnwvF.exe
  C:\Windows\System\lkVnwvF.exe
  2⤵
  PID:13336
- C:\Windows\System\ZtjyGhC.exe
  C:\Windows\System\ZtjyGhC.exe
  2⤵
  PID:13416
- C:\Windows\System\GVHaftz.exe
  C:\Windows\System\GVHaftz.exe
  2⤵
  PID:13584
- C:\Windows\System\ZHBpcWJ.exe
  C:\Windows\System\ZHBpcWJ.exe
  2⤵
  PID:13568
- C:\Windows\System\xLIJvvw.exe
  C:\Windows\System\xLIJvvw.exe
  2⤵
  PID:13668
- C:\Windows\System\MpWHcOB.exe
  C:\Windows\System\MpWHcOB.exe
  2⤵
  PID:13692
- C:\Windows\System\YUaTHlY.exe
  C:\Windows\System\YUaTHlY.exe
  2⤵
  PID:13796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AbZKdXK.exe

Filesize
1.8MB

MD5
e61e9c96e0eeb12c93cad9ba4b432401

SHA1
1dd0d31e17577f8b41d2ed58f97e96f91a72b20b

SHA256
e9d499b443764a0bb195bc6de62e6eba092ff7f6f1f1b50444d2e7dbec9da911

SHA512
e4c73219ab081cbc56de3335e1b1b0a5fc1ed4463ee60b5d0ebc5e76765b7da4ead86810b3febb858004f7d8236a49b8337e0c6400eb8879e07e6577237401d9

Download Submit
C:\Windows\System\BVfbQgb.exe

Filesize
1.8MB

MD5
7f5043596a89538efc939f04e3723687

SHA1
2292454c8ffcfac1c3d18d26b22b97485e4e6b3c

SHA256
1a3902dde67e294c9336e6b54d80092e13c6fd80e94d02bfd356b9a316a60a9c

SHA512
da740d4e08d5983674dbac1a3cd2c070c9988136fe9bc9024ed9b55fdcd78ab13d5ddce2ef25ad9cd40ab570f64de3d5d95a3cd6b7ead04f22540013da220e28

Download Submit
C:\Windows\System\CRqxAVG.exe

Filesize
1.8MB

MD5
6873ec751bc5afc39d6ffdedf9f16189

SHA1
51963a275d280dc0dc8dadbf3557ec9120e8b17b

SHA256
d640361ac66198ce58b51afea11a765c84f0d0b7c9f86bfd2ea58e69a8200f64

SHA512
8c68111b760d43dff9b6d0a769b844f7a4be5a4b09fe20c8abed2dfed69efb88e67c13e00ae124dfccd6b1b17e47c0ce340965a594dfaee290789a3f331d2a21

Download Submit
C:\Windows\System\GWbfURB.exe

Filesize
1.8MB

MD5
70228ce68d86d8fdbe3606903ab0b756

SHA1
bf5856b5e6cbc01c732a976a521cebf5828b399f

SHA256
369b1d3a41c27807aa434d8c981dfa3da456ec81f7bb1a2eb9c5d2fffa8f635a

SHA512
f4d0a1f02a00fdb4a0e67f399fa68de342159cc17f9fa1a82e61d4d829334dde191960d0ad2502aa5f565ec7ef81c3077b17594e05b67cc36f3377d41e39009a

Download Submit
C:\Windows\System\GmzNVRH.exe

Filesize
1.8MB

MD5
095adbc031c2c0c6fa6fa5f2848170c6

SHA1
3a60c7b55760625b223d040aff7b1f78d72c9156

SHA256
7b717ad0aa358ff88e0294bd285279166730fc32c5747a8280a129cc4a2ce765

SHA512
b6d079bc08346b47a3b14590c432d187a9d0d6ff6605a7db944a2e1c496116b5e4810fa806a07c46ff79618b348f375233cf950eada38b41f4775846c5f0bffb

Download Submit
C:\Windows\System\JfcLBEy.exe

Filesize
1.8MB

MD5
dbabd88e07792a24ba68e743e60a2d3f

SHA1
b7b774015dbb1d738ad20c45bf6add71ad8bc1bd

SHA256
08c92efa120fcd223c48f7f771c42b1e6d1366276490b6c9082612e8ee33ec6f

SHA512
028e699b9e93377bbab12c779392c608806b1013bca6a639a39c3d1953e027107c243dc1211a67ef9313136e3d810e34c555c94299f90cfa1768f6678f3cb725

Download Submit
C:\Windows\System\JucRoau.exe

Filesize
1.8MB

MD5
5c38e773840c6f45d5cc3a02aea037b8

SHA1
0333c83a20caeb1b78d9cdf7b6a1114a4bceacf6

SHA256
84aace4ea2033bedf0f9b08878c0842978b0eca2bf864cf0700e89a0927415ae

SHA512
13c103e5f942e3e3c43d6c3fd74801c7235ef81687c312f32aaf12cd7590af6c51a9e264370bbca7ab05addedb138e704aceda8f53c4b74ab200d88c3eeb9ab8

Download Submit
C:\Windows\System\LnCDGaG.exe

Filesize
1.8MB

MD5
9ed1d12641ef50301c522f360cb8fbda

SHA1
f5fedb3c2e8a6e1eb990ba1dcfcfd5df9d6408f7

SHA256
133b8d6f8ecc65eff35663d934270b8233838a3ef9c4fdef7adfe1678517d861

SHA512
1111f8bb1934f3c998a8a167c6ba8fbfe4bf22a90823097827628f94b1105e94b382610a5dc61c98278578e3f54d09fc9583a540aa4464d7d6164c59a48923f8

Download Submit
C:\Windows\System\MHgUhTr.exe

Filesize
1.8MB

MD5
4a951569245d053a90220de7fbbbd45c

SHA1
b8a2f666c652fd278bb9b06fb8f474bcf057113b

SHA256
25d76d8e0dbedfd3bf562aaa374716b268380e4f98e87e97754e0eb5a2223730

SHA512
3267f9ae72a80115a23a6b8d99b78c07f742a3169785b95caa5bc8f24fbeb4fb40ed62a56997a99a52b7c7b59f38f62048fecd9a4883aa8132377e7898d70a51

Download Submit
C:\Windows\System\NAtrbaM.exe

Filesize
1.8MB

MD5
00916c965d9e170419ffe5bc6aed2930

SHA1
721529af545269fc99aad2aab8576a29425f3aa9

SHA256
bdfec55f2203b33a96850cdf5223a03b4389be28c819d460dcf208ffd52762d8

SHA512
32b292783e4773b2325ceabb66936d3eb52d21fead2025f51cd0e833b36b8c013caae6cbabe67cde3c781e66b39cb3bae1f5c532ec8a5583f36e535c3fb32359

Download Submit
C:\Windows\System\NShFvUc.exe

Filesize
1.8MB

MD5
d2db1e4a2d8174bf5d048ef33563bc7d

SHA1
096ba23c947a3b94a1fc8fe66f6ded87d977b70d

SHA256
018788a946e7f22707c903bb915b82a7de442a5ecec5918c1de5f5f05c3263d8

SHA512
b13940921a505dbf6dd52a726fec65503ff6c8594d0ae465b75f59f218f4e7be96906216cb2d0c55949100366c5c9e826f865aa0d47c2292bb944d934836e234

Download Submit
C:\Windows\System\NlrKedi.exe

Filesize
1.8MB

MD5
f4ef4e839fc19c59fdfe31b9f5f29153

SHA1
e9dbc8ae090c74d5904552fec1c5832d8cf2b924

SHA256
e25697ef00ef8b363475741884f9848a3984ca868d9ccf7913ae9a8285a72317

SHA512
4714c4f2b860c2cd841caca1fed8d07f4d1eb793900096fdb4322f47649d79f62bddaff2ebcc610ac35223661bee6798b1982c40a6713b841b79c11dd44bdf8e

Download Submit
C:\Windows\System\RYSkvun.exe

Filesize
1.8MB

MD5
199d30f68884aa585fc1b7381d1ee77f

SHA1
8cde432185ca393824cd324bc661faeae7431e49

SHA256
a8d557a99c8fd33223321c313c4c62a6db1ccd9ebc2a8944edbfdf8f4a5eeb40

SHA512
b91fd081c5d50e9a3dd8e64dd34f6dd029e7ca07d2c846bc4f928e7219dda32b7d5993bcbcc55cb6335f1651d27e04289a428c1f0e90502bb73b46509b0220d1

Download Submit
C:\Windows\System\STiLrIO.exe

Filesize
1.8MB

MD5
2dd7438576a8c43f6231d9c431687109

SHA1
3c3fc1b447e9056ccbd359f91951afd2d00e7499

SHA256
553e79db294fe353b731a2a70290c4fb649ea67828de45ff61f5e28faf771398

SHA512
10be655105107c9f06b5eb4c5ae31a476b94828122a6c07a7a50f8e744d840d9bd01d7ee33239384642522a7842589024a3a9f7823ece9154f3667986bd7cb74

Download Submit
C:\Windows\System\TYEMZDn.exe

Filesize
1.8MB

MD5
a8bf14b6776b2f1757c1e6025b2040d1

SHA1
b47f41bec386ba8d6d5ab618b8bc2cc7f0b5f934

SHA256
b34f73db327fc2e052cde0c994ce3665415f101e693195195eaafe7ef0d4f9c1

SHA512
f45ecb6fa3edd0710d3429a5d2af6faac82746542e4f4495f50bf8910a6685177bb1a2251f4bfc99fd74aced6756e69467b3aedee973827c230b3d2d2feeb636

Download Submit
C:\Windows\System\XWyEcpq.exe

Filesize
1.8MB

MD5
58373f89762c040545b041adeef6168c

SHA1
c5ca12484235df1f172ae014d69bc24a486c4475

SHA256
e404727fe61ad69c60db142dcac28ab8242527e6601692867e79652971b81e7e

SHA512
8d74d769655fdf786a05436cc0ff498be707d6c1ee7799d77beb65eb7f72608484d47d951eb1fa19da62a5bb634699e8b52f0c95eae0922aae6d866659f28dd8

Download Submit
C:\Windows\System\YmPBFJb.exe

Filesize
1.8MB

MD5
c02f03c871a7689657f9818730628c23

SHA1
df1d4dd6b5e0e751e6cf069c374c33ba1f78a9b9

SHA256
6442a62660be45353084fc583d9104c16e0e0b28ea1f7c688fcb6adda36d3fc0

SHA512
26835c86282a684ec190a26279e1c86581c3bb49b0d4fec5a0887024eb8d857831f6528e3d7c4eeb5564bba4d8e12822942c81c69e638a3bed8871fe5898e39a

Download Submit
C:\Windows\System\YoUDhpm.exe

Filesize
1.8MB

MD5
85fa33232b9458e45d3b2bd0e402c9c1

SHA1
a8de1d751d0628c9ac65806840054224e3397466

SHA256
36cf96db1812cc6adfe407fb74db84329f3269aa7243c73c9c7ba410dc6f88f1

SHA512
5859edbef4b6c792ddfa56b1e0c546fe84143cdd68db2da10a41ee6120bdffc7e02323f43f71008bf05b8bdcbcbe7120e8e465382c98b1ad15f654c83e06fba9

Download Submit
C:\Windows\System\cROdGAM.exe

Filesize
1.8MB

MD5
d0f3f8e6fb23e628d66c5ef8f38f9320

SHA1
9a7e1cdf7e93fad26a354aabe586a3b49497b03e

SHA256
57898dc5e0af98fafd981dd636696f6d68cb5042307ae62fe23edaf4f7e89f9c

SHA512
4a23c0058b6785d14e806b9aeb26943cb3cb2a1efb9e0adc6f81a9010470d697b5bcea53c455c2b1b8ee095696f73113d9608f1e34d7651d1c88f3eeb4d7a978

Download Submit
C:\Windows\System\eJDimBg.exe

Filesize
1.8MB

MD5
13dd7fcb1d2ad87105b40f309a2e2584

SHA1
ec81c762120fa8612c6f8763ca6558ee0b0a6ff0

SHA256
c7202889a35258121397932c2f18289140e44ac0a3f0184372fe439c5ed38676

SHA512
5469cb4f4608891345236ff7fbbfbc13fe3cc6e6671717a426e985fdffbc8ead72c786e5d825e1182576653dd33e95a05cae23aa47504d22c66f7bef68cdcde7

Download Submit
C:\Windows\System\fWoOrcI.exe

Filesize
1.8MB

MD5
1dc30f416f1583592a5d92c3222123b2

SHA1
5c8e3a291d95142a7af28abf67553cd36c471dfd

SHA256
a5032e2db1928d3aff72dd6f11fb6861e5263133e920c5f6a181c0e6f1c7483f

SHA512
c81fc240184aeae6c85e20842f07c19d117eca8ad9c5739fdb044a9ac8781268d94d23f9a86c521a7795c53a6e32eaa27f4e84ef72d6b6eff07fc0a1029f099a

Download Submit
C:\Windows\System\fdfPuNq.exe

Filesize
1.8MB

MD5
2d913a784203f5455f2b819b7ebfbe18

SHA1
1ad1b1864b191236c4bc2cf3a72c11b8d7ceb605

SHA256
226b7cf667bf722d6b0540062a929d8e81d527d3ae9034a3c22e264973fc7501

SHA512
4e7b1128a950dde55632a222558ecb5e8bfbb29c9050ba195e564895ffabb92da1f7e8f0fb72a72025e24bcd1d7a83cbd571eab131c73e8294eae6047d63295d

Download Submit
C:\Windows\System\hgBpFXW.exe

Filesize
1.8MB

MD5
0247fa2a0a64af823b3889f0fc795134

SHA1
3ca50253325073310ed5e4a0b61a9aea054224e4

SHA256
2f1dbb679bfaaec7b953c521d3bc58f97c918eed6df11fe9fd887c008a846c24

SHA512
f6cc0dabbf357f295da25518f5c39a142ea72cccfce720f9e3c671db1a0fbfd11d786529da804605bfc0f83401de6598e1cfbe06b9cfdb227956bdbd6e603fa5

Download Submit
C:\Windows\System\iGtigXt.exe

Filesize
1.8MB

MD5
b195600b252a172e885fecdbfa668a27

SHA1
b548daeef627f236ded73870226f192069dd3a55

SHA256
227c9ebc22139f571f5788b597c12d71c71b069146ea8b4256eaa90ae5753529

SHA512
5adaf442c58171e378b17843455a07959b732c51e3c21a8abaeefb03d721c6b4378086d29b2429aabfd8bb18237a198adb3c858755dbc423f0026a538a4a6d19

Download Submit
C:\Windows\System\iQAoKYX.exe

Filesize
1.8MB

MD5
a5b789c75e97a7c4ecae43ffa831a558

SHA1
e7c8bec55867aa1470e64250f469c6a9401cdb63

SHA256
4d15090aab121320d5ce7027d661dcf213a83cd6599118a87412e32c4fdd1285

SHA512
1fee8a35cc7e8f1ed2c44c01b4a0561514e415203c2a7aedf2fbd3e355772d1fc2c2548056a572f0b44568b086e88e2091cbe0aaea455ba0cdeec41abed30435

Download Submit
C:\Windows\System\pHItRYZ.exe

Filesize
1.8MB

MD5
5375abe6baa44070b5c22e816c50cbc4

SHA1
9bb02db0fd1cddf8d7386e3bcba61246a7a7ac06

SHA256
e57f3e75690d9ff176a49fa20669aaaa6999daaaee8b9d4aa02f6afabc82b215

SHA512
8f0c8ff703990c9a3e06643c8719aec0eb3dbb1b047f9674b9744158fe23ca586813c30fe169028de2f3d60b705b4c0e0f9da8676abd2d19187d6c6601d3ef8b

Download Submit
C:\Windows\System\tJrXcWZ.exe

Filesize
1.8MB

MD5
621faf35dd3eee23364ad49e9ff2d351

SHA1
aff4173fac7651c53750a20ab4b10d5d700bc159

SHA256
f13cee7eecb25460b721816c6b47bfb8b62f4b424d78bf61ff397599cefcb3f3

SHA512
6cc5a0228df9808adedcf0b8d0064dc428ae05bba6cd3cb54e5a62ae8a91fd86dc5128210ef2623fe12e4080d86e3b9ee47635ce172d9e2ac255dab92271408a

Download Submit
C:\Windows\System\tmRTmjp.exe

Filesize
1.8MB

MD5
9498cffefefe6a1323ab9fa82d4451a8

SHA1
233ad6b53a04f73f51d7ab5ed8c05e68bba79837

SHA256
b7468b351dcfb048e6d1fdd3760339436c9fe71cbc7e669cc59303827b58d74c

SHA512
c91d72f4d47256f8ab20c35fb77f6c9da893c279dd0c7c57cc44230bbd618ba16216f7d4cc83f98ea34667c43d529e3f1b07be6330ea6edc484ffed45b66f13a

Download Submit
C:\Windows\System\uQoleOE.exe

Filesize
1.8MB

MD5
472deff5240be81c37ab738751485007

SHA1
8e5a34d60259bee4e56b5701df62749eae3b9d1e

SHA256
8a3ed8172524a18c980ea02d28eac0452d23cb252febf481a3aeb91e722efc67

SHA512
01240c793d75319fd0dc9efce4dc7ff800ade366d4e88551e22953fb9ecb55c756c2dd4ffe55af5b10872441d02bd0dae367a3f3f7d529cc893dc7fc53e15ab4

Download Submit
C:\Windows\System\ulshwdo.exe

Filesize
1.8MB

MD5
a4ad316d2c153aabd6e0ed57149c4d13

SHA1
e248a5267be3d3f943c6c8e0f43cfea7cba07e9f

SHA256
20330582818628e459c5feaad9ea0e6f04937e32860dfb3b909bb63d2d0c7c3c

SHA512
84627aa6a16d70fabb18639aa44a700af16bfe7a86b6509d59d086579f43e8a0f89b3bcfc7a6daec22036d3f7f804c01a89abff29bf4114ad3f658cfbbbb24f5

Download Submit
C:\Windows\System\weJCnAq.exe

Filesize
1.8MB

MD5
dc8c683934330e3c51dd912c1c6e4e31

SHA1
e9f5bb253c6f09e340c6be99c946cd82c09d3001

SHA256
156fab3b30ba27093e567158d2717f5600c5e6044b35a322b40266f9b3ac8f73

SHA512
0b2b9183e99d89682b4e3a681599f0e12f8a0f9216fadc6276dbbd471d463ad8e09610ecfb3e53b4b94f19794cbcfd3510470f90943f88a7e185ecf0c90298e9

Download Submit
C:\Windows\System\xmZYjYp.exe

Filesize
1.8MB

MD5
ad1b512bebbf63b6e7ae9c69364f7cd8

SHA1
61d42c0ad8819f79567e4b51824f11f7a78d3651

SHA256
dfa1475012920061b57ea9e61410c33aca3c912fb735c55f6b051d1a777bb75b

SHA512
aa30a1b4f107f58ee2dbcf066dc8f63cdaea48c1cc88a7724ca2bd45e36a64ea2fcec5bbe703361fc608f1e64870419914dd987e74677bbf8df28d5dafec4487

Download Submit
C:\Windows\System\ztKRRJo.exe

Filesize
1.8MB

MD5
6cc35cb627363474715ce555cd1035d4

SHA1
821da9c82521d197be8a77e259f95cf478649ea9

SHA256
68471537ffa772a96a1af8c37ea762c66490d70198de8446b364dcaa629fbc21

SHA512
c7ee79348cf2921886a822d872e96fb4dade7930a2fb927f3205a10ccd1a29ce245ca142966c14de50b18eb52ebb727ba37a87ac8cf2ad2b935c8c42075ad06a

Download Submit
memory/336-166-0x00007FF673960000-0x00007FF673CB4000-memory.dmp

Filesize
3.3MB

Download
memory/336-2124-0x00007FF673960000-0x00007FF673CB4000-memory.dmp

Filesize
3.3MB

Download
memory/372-36-0x00007FF79D930000-0x00007FF79DC84000-memory.dmp

Filesize
3.3MB

Download
memory/372-2117-0x00007FF79D930000-0x00007FF79DC84000-memory.dmp

Filesize
3.3MB

Download
memory/384-88-0x00007FF7F8FB0000-0x00007FF7F9304000-memory.dmp

Filesize
3.3MB

Download
memory/384-2120-0x00007FF7F8FB0000-0x00007FF7F9304000-memory.dmp

Filesize
3.3MB

Download
memory/432-169-0x00007FF65F7C0000-0x00007FF65FB14000-memory.dmp

Filesize
3.3MB

Download
memory/432-2134-0x00007FF65F7C0000-0x00007FF65FB14000-memory.dmp

Filesize
3.3MB

Download
memory/464-138-0x00007FF6C2AD0000-0x00007FF6C2E24000-memory.dmp

Filesize
3.3MB

Download
memory/464-2141-0x00007FF6C2AD0000-0x00007FF6C2E24000-memory.dmp

Filesize
3.3MB

Download
memory/1208-2118-0x00007FF63F9C0000-0x00007FF63FD14000-memory.dmp

Filesize
3.3MB

Download
memory/1208-43-0x00007FF63F9C0000-0x00007FF63FD14000-memory.dmp

Filesize
3.3MB

Download
memory/1568-2139-0x00007FF6523C0000-0x00007FF652714000-memory.dmp

Filesize
3.3MB

Download
memory/1568-158-0x00007FF6523C0000-0x00007FF652714000-memory.dmp

Filesize
3.3MB

Download
memory/1636-29-0x00007FF6D0780000-0x00007FF6D0AD4000-memory.dmp

Filesize
3.3MB

Download
memory/1636-2116-0x00007FF6D0780000-0x00007FF6D0AD4000-memory.dmp

Filesize
3.3MB

Download
memory/1704-2136-0x00007FF716870000-0x00007FF716BC4000-memory.dmp

Filesize
3.3MB

Download
memory/1704-168-0x00007FF716870000-0x00007FF716BC4000-memory.dmp

Filesize
3.3MB

Download
memory/2008-161-0x00007FF783A70000-0x00007FF783DC4000-memory.dmp

Filesize
3.3MB

Download
memory/2008-2129-0x00007FF783A70000-0x00007FF783DC4000-memory.dmp

Filesize
3.3MB

Download
memory/2168-2121-0x00007FF7B58A0000-0x00007FF7B5BF4000-memory.dmp

Filesize
3.3MB

Download
memory/2168-59-0x00007FF7B58A0000-0x00007FF7B5BF4000-memory.dmp

Filesize
3.3MB

Download
memory/2168-2111-0x00007FF7B58A0000-0x00007FF7B5BF4000-memory.dmp

Filesize
3.3MB

Download
memory/2280-2131-0x00007FF7411E0000-0x00007FF741534000-memory.dmp

Filesize
3.3MB

Download
memory/2280-159-0x00007FF7411E0000-0x00007FF741534000-memory.dmp

Filesize
3.3MB

Download
memory/2476-2112-0x00007FF77E190000-0x00007FF77E4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2476-137-0x00007FF77E190000-0x00007FF77E4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2476-2135-0x00007FF77E190000-0x00007FF77E4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2580-2127-0x00007FF637030000-0x00007FF637384000-memory.dmp

Filesize
3.3MB

Download
memory/2580-163-0x00007FF637030000-0x00007FF637384000-memory.dmp

Filesize
3.3MB

Download
memory/2820-160-0x00007FF7D8620000-0x00007FF7D8974000-memory.dmp

Filesize
3.3MB

Download
memory/2820-2130-0x00007FF7D8620000-0x00007FF7D8974000-memory.dmp

Filesize
3.3MB

Download
memory/3240-144-0x00007FF7BD7E0000-0x00007FF7BDB34000-memory.dmp

Filesize
3.3MB

Download
memory/3240-2133-0x00007FF7BD7E0000-0x00007FF7BDB34000-memory.dmp

Filesize
3.3MB

Download
memory/3280-11-0x00007FF7ACDE0000-0x00007FF7AD134000-memory.dmp

Filesize
3.3MB

Download
memory/3280-2114-0x00007FF7ACDE0000-0x00007FF7AD134000-memory.dmp

Filesize
3.3MB

Download
memory/3308-2125-0x00007FF6FAE20000-0x00007FF6FB174000-memory.dmp

Filesize
3.3MB

Download
memory/3308-165-0x00007FF6FAE20000-0x00007FF6FB174000-memory.dmp

Filesize
3.3MB

Download
memory/3388-2115-0x00007FF76A350000-0x00007FF76A6A4000-memory.dmp

Filesize
3.3MB

Download
memory/3388-12-0x00007FF76A350000-0x00007FF76A6A4000-memory.dmp

Filesize
3.3MB

Download
memory/3388-2109-0x00007FF76A350000-0x00007FF76A6A4000-memory.dmp

Filesize
3.3MB

Download
memory/3476-139-0x00007FF6B7F90000-0x00007FF6B82E4000-memory.dmp

Filesize
3.3MB

Download
memory/3476-2140-0x00007FF6B7F90000-0x00007FF6B82E4000-memory.dmp

Filesize
3.3MB

Download
memory/3904-170-0x00007FF69CB20000-0x00007FF69CE74000-memory.dmp

Filesize
3.3MB

Download
memory/3904-2132-0x00007FF69CB20000-0x00007FF69CE74000-memory.dmp

Filesize
3.3MB

Download
memory/3980-2113-0x00007FF7E1A70000-0x00007FF7E1DC4000-memory.dmp

Filesize
3.3MB

Download
memory/3980-2123-0x00007FF7E1A70000-0x00007FF7E1DC4000-memory.dmp

Filesize
3.3MB

Download
memory/3980-55-0x00007FF7E1A70000-0x00007FF7E1DC4000-memory.dmp

Filesize
3.3MB

Download
memory/4316-2110-0x00007FF615820000-0x00007FF615B74000-memory.dmp

Filesize
3.3MB

Download
memory/4316-2119-0x00007FF615820000-0x00007FF615B74000-memory.dmp

Filesize
3.3MB

Download
memory/4316-54-0x00007FF615820000-0x00007FF615B74000-memory.dmp

Filesize
3.3MB

Download
memory/4340-2128-0x00007FF7AFCD0000-0x00007FF7B0024000-memory.dmp

Filesize
3.3MB

Download
memory/4340-162-0x00007FF7AFCD0000-0x00007FF7B0024000-memory.dmp

Filesize
3.3MB

Download
memory/4460-1-0x0000012985160000-0x0000012985170000-memory.dmp

Filesize
64KB

Download
memory/4460-2108-0x00007FF6D8FC0000-0x00007FF6D9314000-memory.dmp

Filesize
3.3MB

Download
memory/4460-0-0x00007FF6D8FC0000-0x00007FF6D9314000-memory.dmp

Filesize
3.3MB

Download
memory/4644-2142-0x00007FF662B30000-0x00007FF662E84000-memory.dmp

Filesize
3.3MB

Download
memory/4644-188-0x00007FF662B30000-0x00007FF662E84000-memory.dmp

Filesize
3.3MB

Download
memory/4748-108-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp

Filesize
3.3MB

Download
memory/4748-2137-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp

Filesize
3.3MB

Download
memory/4884-157-0x00007FF6ADC50000-0x00007FF6ADFA4000-memory.dmp

Filesize
3.3MB

Download
memory/4884-2138-0x00007FF6ADC50000-0x00007FF6ADFA4000-memory.dmp

Filesize
3.3MB

Download
memory/4964-2126-0x00007FF778BF0000-0x00007FF778F44000-memory.dmp

Filesize
3.3MB

Download
memory/4964-164-0x00007FF778BF0000-0x00007FF778F44000-memory.dmp

Filesize
3.3MB

Download
memory/5060-167-0x00007FF614E30000-0x00007FF615184000-memory.dmp

Filesize
3.3MB

Download
memory/5060-2122-0x00007FF614E30000-0x00007FF615184000-memory.dmp

Filesize
3.3MB

Download