xmrig | 6f7de684d7053bd3446cc7a6018172e8e7b64b8d9813fe4db304ba4c3763fed1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
Size

2.6MB
MD5

c31c7059fa8772dadc2c2093208bcab0
SHA1

7743406571b0561c6ce355148ad23203abdd3131
SHA256

6f7de684d7053bd3446cc7a6018172e8e7b64b8d9813fe4db304ba4c3763fed1
SHA512

ff68cabb695619c93f83bbbcd8ea4a3202db6f1947964b9dbaf6c52d54500e41db9c51f9d9f1d15e61b4de81ff11dbf28e88c0c359c651d5217f1a7c5d89fe0f
SSDEEP

49152:N0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzJZaDg3Pp1LX:N0GnJMOWPClFdx6e0EALKWVTffZiPAcD

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4780-0-0x00007FF7855D0000-0x00007FF7859C5000-memory.dmp	xmrig
behavioral2/files/0x0008000000023431-5.dat	xmrig
behavioral2/memory/2948-9-0x00007FF620410000-0x00007FF620805000-memory.dmp	xmrig
behavioral2/files/0x0008000000023434-11.dat	xmrig
behavioral2/files/0x0007000000023438-7.dat	xmrig
behavioral2/files/0x0007000000023439-22.dat	xmrig
behavioral2/memory/540-25-0x00007FF6816D0000-0x00007FF681AC5000-memory.dmp	xmrig
behavioral2/files/0x000700000002343a-29.dat	xmrig
behavioral2/memory/3308-32-0x00007FF7D44E0000-0x00007FF7D48D5000-memory.dmp	xmrig
behavioral2/memory/548-28-0x00007FF687050000-0x00007FF687445000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-45.dat	xmrig
behavioral2/files/0x000700000002343e-51.dat	xmrig
behavioral2/files/0x000700000002343f-55.dat	xmrig
behavioral2/memory/1452-56-0x00007FF73D860000-0x00007FF73DC55000-memory.dmp	xmrig
behavioral2/memory/1392-57-0x00007FF7CD290000-0x00007FF7CD685000-memory.dmp	xmrig
behavioral2/memory/4948-60-0x00007FF734E70000-0x00007FF735265000-memory.dmp	xmrig
behavioral2/memory/2756-54-0x00007FF6505B0000-0x00007FF6509A5000-memory.dmp	xmrig
behavioral2/memory/2212-52-0x00007FF7B0030000-0x00007FF7B0425000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-47.dat	xmrig
behavioral2/files/0x0007000000023443-76.dat	xmrig
behavioral2/files/0x0007000000023444-81.dat	xmrig
behavioral2/files/0x0007000000023447-96.dat	xmrig
behavioral2/files/0x0007000000023448-101.dat	xmrig
behavioral2/files/0x000700000002344a-109.dat	xmrig
behavioral2/files/0x000700000002344f-136.dat	xmrig
behavioral2/files/0x0007000000023454-161.dat	xmrig
behavioral2/memory/1292-467-0x00007FF71F8C0000-0x00007FF71FCB5000-memory.dmp	xmrig
behavioral2/memory/1196-468-0x00007FF674040000-0x00007FF674435000-memory.dmp	xmrig
behavioral2/memory/216-466-0x00007FF795D40000-0x00007FF796135000-memory.dmp	xmrig
behavioral2/memory/1520-469-0x00007FF676A60000-0x00007FF676E55000-memory.dmp	xmrig
behavioral2/memory/1500-470-0x00007FF615A00000-0x00007FF615DF5000-memory.dmp	xmrig
behavioral2/memory/5104-471-0x00007FF661890000-0x00007FF661C85000-memory.dmp	xmrig
behavioral2/memory/4436-472-0x00007FF6A0550000-0x00007FF6A0945000-memory.dmp	xmrig
behavioral2/memory/2632-480-0x00007FF62F7A0000-0x00007FF62FB95000-memory.dmp	xmrig
behavioral2/memory/4880-486-0x00007FF6FF460000-0x00007FF6FF855000-memory.dmp	xmrig
behavioral2/memory/1448-489-0x00007FF6433F0000-0x00007FF6437E5000-memory.dmp	xmrig
behavioral2/memory/1672-491-0x00007FF69D420000-0x00007FF69D815000-memory.dmp	xmrig
behavioral2/memory/336-484-0x00007FF6AB8F0000-0x00007FF6ABCE5000-memory.dmp	xmrig
behavioral2/memory/4596-477-0x00007FF7764E0000-0x00007FF7768D5000-memory.dmp	xmrig
behavioral2/memory/4552-473-0x00007FF624200000-0x00007FF6245F5000-memory.dmp	xmrig
behavioral2/memory/4780-1143-0x00007FF7855D0000-0x00007FF7859C5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023456-171.dat	xmrig
behavioral2/files/0x0007000000023455-166.dat	xmrig
behavioral2/files/0x0007000000023453-156.dat	xmrig
behavioral2/files/0x0007000000023452-151.dat	xmrig
behavioral2/files/0x0007000000023451-146.dat	xmrig
behavioral2/files/0x0007000000023450-141.dat	xmrig
behavioral2/files/0x000700000002344e-131.dat	xmrig
behavioral2/files/0x000700000002344d-126.dat	xmrig
behavioral2/files/0x000700000002344c-121.dat	xmrig
behavioral2/files/0x000700000002344b-116.dat	xmrig
behavioral2/files/0x0007000000023449-106.dat	xmrig
behavioral2/files/0x0007000000023446-91.dat	xmrig
behavioral2/files/0x0007000000023445-86.dat	xmrig
behavioral2/files/0x0008000000023435-71.dat	xmrig
behavioral2/files/0x0007000000023440-66.dat	xmrig
behavioral2/files/0x000700000002343d-49.dat	xmrig
behavioral2/memory/1032-19-0x00007FF7FC7E0000-0x00007FF7FCBD5000-memory.dmp	xmrig
behavioral2/memory/2948-1483-0x00007FF620410000-0x00007FF620805000-memory.dmp	xmrig
behavioral2/memory/3308-1870-0x00007FF7D44E0000-0x00007FF7D48D5000-memory.dmp	xmrig
behavioral2/memory/1392-1871-0x00007FF7CD290000-0x00007FF7CD685000-memory.dmp	xmrig
behavioral2/memory/4948-1872-0x00007FF734E70000-0x00007FF735265000-memory.dmp	xmrig
behavioral2/memory/4780-1873-0x00007FF7855D0000-0x00007FF7859C5000-memory.dmp	xmrig
behavioral2/memory/1032-1874-0x00007FF7FC7E0000-0x00007FF7FCBD5000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2948	nggSqqy.exe
1032	VBdwgts.exe
540	DiHMLeW.exe
548	teiYvNm.exe
3308	JDRvHtC.exe
2212	SQEOVPL.exe
2756	MSeErav.exe
1452	kSAiFik.exe
1392	qwdAXZe.exe
4948	OgdaHvY.exe
216	noDQGLf.exe
1292	ITAgCkV.exe
1196	gZwpCZi.exe
1520	WitWuCo.exe
1500	GfJBukR.exe
5104	AaBgqhu.exe
4436	LNMoIaD.exe
4552	PGtDCKm.exe
4596	xKoxhqy.exe
2632	jCkPUuX.exe
336	mdkDEad.exe
4880	ChmCcjr.exe
1448	fIPJccu.exe
1672	UgNuSqD.exe
2920	cxOexcs.exe
5080	vYrVviR.exe
3676	lMvsgFt.exe
3448	GMLoHlR.exe
4972	pSiOAfp.exe
4184	xHAuhho.exe
4028	rWZinah.exe
624	gAdPgTj.exe
4696	bFZEcpj.exe
4508	eCZAdQc.exe
4372	wgXcmGV.exe
3264	IKqWCJF.exe
4536	VIlqYRb.exe
3464	UFsocZM.exe
1912	HzNSfvn.exe
2940	CsrIexn.exe
64	dDGHbrH.exe
968	YASlATy.exe
4332	Dhmjpag.exe
3628	anTOswQ.exe
4172	xXBapFU.exe
2932	CyUTaBh.exe
2984	lfSuGuI.exe
4784	udwysMr.exe
4496	oAHZLRz.exe
2360	bnxumgt.exe
1012	otMVAWO.exe
2308	reoIsXa.exe
1136	tgamEfG.exe
3468	gMfDjOL.exe
1696	IpMYZZy.exe
4004	munPqzu.exe
3588	BacAUCD.exe
1440	LoRfCSK.exe
4920	TqzmpIJ.exe
3956	nySVTqp.exe
2968	qIqHbKq.exe
3576	RchjCWt.exe
1596	DIoBrpX.exe
3172	JduxJRg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4780-0-0x00007FF7855D0000-0x00007FF7859C5000-memory.dmp	upx
behavioral2/files/0x0008000000023431-5.dat	upx
behavioral2/memory/2948-9-0x00007FF620410000-0x00007FF620805000-memory.dmp	upx
behavioral2/files/0x0008000000023434-11.dat	upx
behavioral2/files/0x0007000000023438-7.dat	upx
behavioral2/files/0x0007000000023439-22.dat	upx
behavioral2/memory/540-25-0x00007FF6816D0000-0x00007FF681AC5000-memory.dmp	upx
behavioral2/files/0x000700000002343a-29.dat	upx
behavioral2/memory/3308-32-0x00007FF7D44E0000-0x00007FF7D48D5000-memory.dmp	upx
behavioral2/memory/548-28-0x00007FF687050000-0x00007FF687445000-memory.dmp	upx
behavioral2/files/0x000700000002343b-45.dat	upx
behavioral2/files/0x000700000002343e-51.dat	upx
behavioral2/files/0x000700000002343f-55.dat	upx
behavioral2/memory/1452-56-0x00007FF73D860000-0x00007FF73DC55000-memory.dmp	upx
behavioral2/memory/1392-57-0x00007FF7CD290000-0x00007FF7CD685000-memory.dmp	upx
behavioral2/memory/4948-60-0x00007FF734E70000-0x00007FF735265000-memory.dmp	upx
behavioral2/memory/2756-54-0x00007FF6505B0000-0x00007FF6509A5000-memory.dmp	upx
behavioral2/memory/2212-52-0x00007FF7B0030000-0x00007FF7B0425000-memory.dmp	upx
behavioral2/files/0x000700000002343c-47.dat	upx
behavioral2/files/0x0007000000023443-76.dat	upx
behavioral2/files/0x0007000000023444-81.dat	upx
behavioral2/files/0x0007000000023447-96.dat	upx
behavioral2/files/0x0007000000023448-101.dat	upx
behavioral2/files/0x000700000002344a-109.dat	upx
behavioral2/files/0x000700000002344f-136.dat	upx
behavioral2/files/0x0007000000023454-161.dat	upx
behavioral2/memory/1292-467-0x00007FF71F8C0000-0x00007FF71FCB5000-memory.dmp	upx
behavioral2/memory/1196-468-0x00007FF674040000-0x00007FF674435000-memory.dmp	upx
behavioral2/memory/216-466-0x00007FF795D40000-0x00007FF796135000-memory.dmp	upx
behavioral2/memory/1520-469-0x00007FF676A60000-0x00007FF676E55000-memory.dmp	upx
behavioral2/memory/1500-470-0x00007FF615A00000-0x00007FF615DF5000-memory.dmp	upx
behavioral2/memory/5104-471-0x00007FF661890000-0x00007FF661C85000-memory.dmp	upx
behavioral2/memory/4436-472-0x00007FF6A0550000-0x00007FF6A0945000-memory.dmp	upx
behavioral2/memory/2632-480-0x00007FF62F7A0000-0x00007FF62FB95000-memory.dmp	upx
behavioral2/memory/4880-486-0x00007FF6FF460000-0x00007FF6FF855000-memory.dmp	upx
behavioral2/memory/1448-489-0x00007FF6433F0000-0x00007FF6437E5000-memory.dmp	upx
behavioral2/memory/1672-491-0x00007FF69D420000-0x00007FF69D815000-memory.dmp	upx
behavioral2/memory/336-484-0x00007FF6AB8F0000-0x00007FF6ABCE5000-memory.dmp	upx
behavioral2/memory/4596-477-0x00007FF7764E0000-0x00007FF7768D5000-memory.dmp	upx
behavioral2/memory/4552-473-0x00007FF624200000-0x00007FF6245F5000-memory.dmp	upx
behavioral2/memory/4780-1143-0x00007FF7855D0000-0x00007FF7859C5000-memory.dmp	upx
behavioral2/files/0x0007000000023456-171.dat	upx
behavioral2/files/0x0007000000023455-166.dat	upx
behavioral2/files/0x0007000000023453-156.dat	upx
behavioral2/files/0x0007000000023452-151.dat	upx
behavioral2/files/0x0007000000023451-146.dat	upx
behavioral2/files/0x0007000000023450-141.dat	upx
behavioral2/files/0x000700000002344e-131.dat	upx
behavioral2/files/0x000700000002344d-126.dat	upx
behavioral2/files/0x000700000002344c-121.dat	upx
behavioral2/files/0x000700000002344b-116.dat	upx
behavioral2/files/0x0007000000023449-106.dat	upx
behavioral2/files/0x0007000000023446-91.dat	upx
behavioral2/files/0x0007000000023445-86.dat	upx
behavioral2/files/0x0008000000023435-71.dat	upx
behavioral2/files/0x0007000000023440-66.dat	upx
behavioral2/files/0x000700000002343d-49.dat	upx
behavioral2/memory/1032-19-0x00007FF7FC7E0000-0x00007FF7FCBD5000-memory.dmp	upx
behavioral2/memory/2948-1483-0x00007FF620410000-0x00007FF620805000-memory.dmp	upx
behavioral2/memory/3308-1870-0x00007FF7D44E0000-0x00007FF7D48D5000-memory.dmp	upx
behavioral2/memory/1392-1871-0x00007FF7CD290000-0x00007FF7CD685000-memory.dmp	upx
behavioral2/memory/4948-1872-0x00007FF734E70000-0x00007FF735265000-memory.dmp	upx
behavioral2/memory/4780-1873-0x00007FF7855D0000-0x00007FF7859C5000-memory.dmp	upx
behavioral2/memory/1032-1874-0x00007FF7FC7E0000-0x00007FF7FCBD5000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\LrSFEXb.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\YxJbLQx.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\iafllQr.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\xfPbNGF.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\yxmKBay.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\EGynhCv.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\WLzzBDp.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\jtkNBWz.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\wSSngah.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\RuEPZAl.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\MSeErav.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\PFFlpbV.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\lTdgawF.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\UxrtnnE.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\AsZRtDd.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\yglvvKN.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\kUbXDcJ.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\oITTthQ.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\ANQUgPh.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\ssEaGeu.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\vYKhuwE.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\yvmceaf.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\pPcnDDC.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\hPHRtQy.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\HAdhOhj.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\CQiCvVL.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\llmxxNI.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\ZSfeYMh.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\roQEibb.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\DsTPVIm.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\reoIsXa.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\jVDiyGf.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\uLpYyVi.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\eLeHEER.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\enpiyXE.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\GfJBukR.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\XeICCed.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\AjViwug.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\FiXQRDj.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\fAPbHwI.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\JZsjpiJ.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\FNvzwqY.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\jSwwaEs.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\zSbnSnx.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\XFoMoJB.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\HnhYShO.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\UCyHckb.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\HZfPPaP.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\FEFzWMS.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\ZrrnSox.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\lrGScLn.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\UfZPBrz.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\ITAgCkV.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\naTtUTJ.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\FDcpWgb.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\MRjukmN.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\ODfckeh.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\kgFDaIk.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\JJIeTNv.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\umrumTz.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\FxtVVpn.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\FAvAdYw.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\HUDSMlE.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
File created	C:\Windows\System32\BacAUCD.exe	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2948	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	84
PID 4780 wrote to memory of 2948	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	84
PID 4780 wrote to memory of 1032	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	85
PID 4780 wrote to memory of 1032	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	85
PID 4780 wrote to memory of 540	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	86
PID 4780 wrote to memory of 540	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	86
PID 4780 wrote to memory of 548	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	87
PID 4780 wrote to memory of 548	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	87
PID 4780 wrote to memory of 3308	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	88
PID 4780 wrote to memory of 3308	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	88
PID 4780 wrote to memory of 2212	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	89
PID 4780 wrote to memory of 2212	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	89
PID 4780 wrote to memory of 2756	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	90
PID 4780 wrote to memory of 2756	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	90
PID 4780 wrote to memory of 1452	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	91
PID 4780 wrote to memory of 1452	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	91
PID 4780 wrote to memory of 1392	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	92
PID 4780 wrote to memory of 1392	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	92
PID 4780 wrote to memory of 4948	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	93
PID 4780 wrote to memory of 4948	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	93
PID 4780 wrote to memory of 216	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	94
PID 4780 wrote to memory of 216	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	94
PID 4780 wrote to memory of 1292	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	95
PID 4780 wrote to memory of 1292	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	95
PID 4780 wrote to memory of 1196	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	96
PID 4780 wrote to memory of 1196	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	96
PID 4780 wrote to memory of 1520	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	97
PID 4780 wrote to memory of 1520	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	97
PID 4780 wrote to memory of 1500	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	98
PID 4780 wrote to memory of 1500	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	98
PID 4780 wrote to memory of 5104	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	99
PID 4780 wrote to memory of 5104	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	99
PID 4780 wrote to memory of 4436	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	100
PID 4780 wrote to memory of 4436	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	100
PID 4780 wrote to memory of 4552	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	101
PID 4780 wrote to memory of 4552	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	101
PID 4780 wrote to memory of 4596	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	102
PID 4780 wrote to memory of 4596	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	102
PID 4780 wrote to memory of 2632	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	103
PID 4780 wrote to memory of 2632	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	103
PID 4780 wrote to memory of 336	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	104
PID 4780 wrote to memory of 336	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	104
PID 4780 wrote to memory of 4880	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	105
PID 4780 wrote to memory of 4880	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	105
PID 4780 wrote to memory of 1448	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	106
PID 4780 wrote to memory of 1448	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	106
PID 4780 wrote to memory of 1672	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	107
PID 4780 wrote to memory of 1672	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	107
PID 4780 wrote to memory of 2920	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	108
PID 4780 wrote to memory of 2920	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	108
PID 4780 wrote to memory of 5080	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	109
PID 4780 wrote to memory of 5080	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	109
PID 4780 wrote to memory of 3676	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	110
PID 4780 wrote to memory of 3676	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	110
PID 4780 wrote to memory of 3448	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	111
PID 4780 wrote to memory of 3448	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	111
PID 4780 wrote to memory of 4972	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	112
PID 4780 wrote to memory of 4972	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	112
PID 4780 wrote to memory of 4184	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	113
PID 4780 wrote to memory of 4184	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	113
PID 4780 wrote to memory of 4028	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	114
PID 4780 wrote to memory of 4028	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	114
PID 4780 wrote to memory of 624	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	115
PID 4780 wrote to memory of 624	4780	c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c31c7059fa8772dadc2c2093208bcab0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\System32\nggSqqy.exe
  C:\Windows\System32\nggSqqy.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System32\VBdwgts.exe
  C:\Windows\System32\VBdwgts.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System32\DiHMLeW.exe
  C:\Windows\System32\DiHMLeW.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System32\teiYvNm.exe
  C:\Windows\System32\teiYvNm.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System32\JDRvHtC.exe
  C:\Windows\System32\JDRvHtC.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System32\SQEOVPL.exe
  C:\Windows\System32\SQEOVPL.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System32\MSeErav.exe
  C:\Windows\System32\MSeErav.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System32\kSAiFik.exe
  C:\Windows\System32\kSAiFik.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System32\qwdAXZe.exe
  C:\Windows\System32\qwdAXZe.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System32\OgdaHvY.exe
  C:\Windows\System32\OgdaHvY.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System32\noDQGLf.exe
  C:\Windows\System32\noDQGLf.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System32\ITAgCkV.exe
  C:\Windows\System32\ITAgCkV.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System32\gZwpCZi.exe
  C:\Windows\System32\gZwpCZi.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System32\WitWuCo.exe
  C:\Windows\System32\WitWuCo.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System32\GfJBukR.exe
  C:\Windows\System32\GfJBukR.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System32\AaBgqhu.exe
  C:\Windows\System32\AaBgqhu.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System32\LNMoIaD.exe
  C:\Windows\System32\LNMoIaD.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System32\PGtDCKm.exe
  C:\Windows\System32\PGtDCKm.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System32\xKoxhqy.exe
  C:\Windows\System32\xKoxhqy.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System32\jCkPUuX.exe
  C:\Windows\System32\jCkPUuX.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System32\mdkDEad.exe
  C:\Windows\System32\mdkDEad.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System32\ChmCcjr.exe
  C:\Windows\System32\ChmCcjr.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System32\fIPJccu.exe
  C:\Windows\System32\fIPJccu.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System32\UgNuSqD.exe
  C:\Windows\System32\UgNuSqD.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System32\cxOexcs.exe
  C:\Windows\System32\cxOexcs.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System32\vYrVviR.exe
  C:\Windows\System32\vYrVviR.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System32\lMvsgFt.exe
  C:\Windows\System32\lMvsgFt.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System32\GMLoHlR.exe
  C:\Windows\System32\GMLoHlR.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System32\pSiOAfp.exe
  C:\Windows\System32\pSiOAfp.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System32\xHAuhho.exe
  C:\Windows\System32\xHAuhho.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System32\rWZinah.exe
  C:\Windows\System32\rWZinah.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System32\gAdPgTj.exe
  C:\Windows\System32\gAdPgTj.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System32\bFZEcpj.exe
  C:\Windows\System32\bFZEcpj.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System32\eCZAdQc.exe
  C:\Windows\System32\eCZAdQc.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System32\wgXcmGV.exe
  C:\Windows\System32\wgXcmGV.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System32\IKqWCJF.exe
  C:\Windows\System32\IKqWCJF.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System32\VIlqYRb.exe
  C:\Windows\System32\VIlqYRb.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System32\UFsocZM.exe
  C:\Windows\System32\UFsocZM.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System32\HzNSfvn.exe
  C:\Windows\System32\HzNSfvn.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System32\CsrIexn.exe
  C:\Windows\System32\CsrIexn.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System32\dDGHbrH.exe
  C:\Windows\System32\dDGHbrH.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System32\YASlATy.exe
  C:\Windows\System32\YASlATy.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System32\Dhmjpag.exe
  C:\Windows\System32\Dhmjpag.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System32\anTOswQ.exe
  C:\Windows\System32\anTOswQ.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System32\xXBapFU.exe
  C:\Windows\System32\xXBapFU.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System32\CyUTaBh.exe
  C:\Windows\System32\CyUTaBh.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System32\lfSuGuI.exe
  C:\Windows\System32\lfSuGuI.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System32\udwysMr.exe
  C:\Windows\System32\udwysMr.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System32\oAHZLRz.exe
  C:\Windows\System32\oAHZLRz.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System32\bnxumgt.exe
  C:\Windows\System32\bnxumgt.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System32\otMVAWO.exe
  C:\Windows\System32\otMVAWO.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System32\reoIsXa.exe
  C:\Windows\System32\reoIsXa.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System32\tgamEfG.exe
  C:\Windows\System32\tgamEfG.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System32\gMfDjOL.exe
  C:\Windows\System32\gMfDjOL.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System32\IpMYZZy.exe
  C:\Windows\System32\IpMYZZy.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System32\munPqzu.exe
  C:\Windows\System32\munPqzu.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System32\BacAUCD.exe
  C:\Windows\System32\BacAUCD.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System32\LoRfCSK.exe
  C:\Windows\System32\LoRfCSK.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System32\TqzmpIJ.exe
  C:\Windows\System32\TqzmpIJ.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System32\nySVTqp.exe
  C:\Windows\System32\nySVTqp.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System32\qIqHbKq.exe
  C:\Windows\System32\qIqHbKq.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System32\RchjCWt.exe
  C:\Windows\System32\RchjCWt.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System32\DIoBrpX.exe
  C:\Windows\System32\DIoBrpX.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System32\JduxJRg.exe
  C:\Windows\System32\JduxJRg.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System32\GETUUZP.exe
  C:\Windows\System32\GETUUZP.exe
  2⤵
  PID:1992
- C:\Windows\System32\DFAHypk.exe
  C:\Windows\System32\DFAHypk.exe
  2⤵
  PID:3212
- C:\Windows\System32\fPCihYe.exe
  C:\Windows\System32\fPCihYe.exe
  2⤵
  PID:2560
- C:\Windows\System32\BoTquGE.exe
  C:\Windows\System32\BoTquGE.exe
  2⤵
  PID:2656
- C:\Windows\System32\ceuCTLR.exe
  C:\Windows\System32\ceuCTLR.exe
  2⤵
  PID:2572
- C:\Windows\System32\swgBsRV.exe
  C:\Windows\System32\swgBsRV.exe
  2⤵
  PID:5128
- C:\Windows\System32\brkeDth.exe
  C:\Windows\System32\brkeDth.exe
  2⤵
  PID:5144
- C:\Windows\System32\XWbXYTl.exe
  C:\Windows\System32\XWbXYTl.exe
  2⤵
  PID:5184
- C:\Windows\System32\LRIRKXF.exe
  C:\Windows\System32\LRIRKXF.exe
  2⤵
  PID:5200
- C:\Windows\System32\EiiYVbr.exe
  C:\Windows\System32\EiiYVbr.exe
  2⤵
  PID:5232
- C:\Windows\System32\OsbvDHF.exe
  C:\Windows\System32\OsbvDHF.exe
  2⤵
  PID:5264
- C:\Windows\System32\JXtuFgI.exe
  C:\Windows\System32\JXtuFgI.exe
  2⤵
  PID:5300
- C:\Windows\System32\GKhDQkf.exe
  C:\Windows\System32\GKhDQkf.exe
  2⤵
  PID:5324
- C:\Windows\System32\pxkPQVT.exe
  C:\Windows\System32\pxkPQVT.exe
  2⤵
  PID:5352
- C:\Windows\System32\EyJHIng.exe
  C:\Windows\System32\EyJHIng.exe
  2⤵
  PID:5380
- C:\Windows\System32\ycSgHqn.exe
  C:\Windows\System32\ycSgHqn.exe
  2⤵
  PID:5396
- C:\Windows\System32\mrZJMAP.exe
  C:\Windows\System32\mrZJMAP.exe
  2⤵
  PID:5436
- C:\Windows\System32\uRdmkFo.exe
  C:\Windows\System32\uRdmkFo.exe
  2⤵
  PID:5452
- C:\Windows\System32\VoRygmX.exe
  C:\Windows\System32\VoRygmX.exe
  2⤵
  PID:5480
- C:\Windows\System32\UhRpTQa.exe
  C:\Windows\System32\UhRpTQa.exe
  2⤵
  PID:5520
- C:\Windows\System32\JZctQCO.exe
  C:\Windows\System32\JZctQCO.exe
  2⤵
  PID:5536
- C:\Windows\System32\HbzRwAw.exe
  C:\Windows\System32\HbzRwAw.exe
  2⤵
  PID:5564
- C:\Windows\System32\HYDjrLG.exe
  C:\Windows\System32\HYDjrLG.exe
  2⤵
  PID:5592
- C:\Windows\System32\wHQUdSq.exe
  C:\Windows\System32\wHQUdSq.exe
  2⤵
  PID:5632
- C:\Windows\System32\dYEbGhA.exe
  C:\Windows\System32\dYEbGhA.exe
  2⤵
  PID:5648
- C:\Windows\System32\oxpTGeH.exe
  C:\Windows\System32\oxpTGeH.exe
  2⤵
  PID:5688
- C:\Windows\System32\fEEsqOk.exe
  C:\Windows\System32\fEEsqOk.exe
  2⤵
  PID:5704
- C:\Windows\System32\zXDypBx.exe
  C:\Windows\System32\zXDypBx.exe
  2⤵
  PID:5732
- C:\Windows\System32\hGUELJb.exe
  C:\Windows\System32\hGUELJb.exe
  2⤵
  PID:5760
- C:\Windows\System32\TFNSOME.exe
  C:\Windows\System32\TFNSOME.exe
  2⤵
  PID:5788
- C:\Windows\System32\xbrDzEQ.exe
  C:\Windows\System32\xbrDzEQ.exe
  2⤵
  PID:5816
- C:\Windows\System32\CMWdIiO.exe
  C:\Windows\System32\CMWdIiO.exe
  2⤵
  PID:5844
- C:\Windows\System32\HMtPkYS.exe
  C:\Windows\System32\HMtPkYS.exe
  2⤵
  PID:5872
- C:\Windows\System32\xhDNawL.exe
  C:\Windows\System32\xhDNawL.exe
  2⤵
  PID:5912
- C:\Windows\System32\tkcgGRY.exe
  C:\Windows\System32\tkcgGRY.exe
  2⤵
  PID:5928
- C:\Windows\System32\EaRQrRN.exe
  C:\Windows\System32\EaRQrRN.exe
  2⤵
  PID:5956
- C:\Windows\System32\jwagFiD.exe
  C:\Windows\System32\jwagFiD.exe
  2⤵
  PID:5996
- C:\Windows\System32\vbYEUPQ.exe
  C:\Windows\System32\vbYEUPQ.exe
  2⤵
  PID:6012
- C:\Windows\System32\RsCzKby.exe
  C:\Windows\System32\RsCzKby.exe
  2⤵
  PID:6040
- C:\Windows\System32\vcsUjGy.exe
  C:\Windows\System32\vcsUjGy.exe
  2⤵
  PID:6080
- C:\Windows\System32\ssEaGeu.exe
  C:\Windows\System32\ssEaGeu.exe
  2⤵
  PID:6108
- C:\Windows\System32\ODzPSWy.exe
  C:\Windows\System32\ODzPSWy.exe
  2⤵
  PID:6136
- C:\Windows\System32\qjihLxE.exe
  C:\Windows\System32\qjihLxE.exe
  2⤵
  PID:2488
- C:\Windows\System32\dbDHyFu.exe
  C:\Windows\System32\dbDHyFu.exe
  2⤵
  PID:3220
- C:\Windows\System32\AHYaGcX.exe
  C:\Windows\System32\AHYaGcX.exe
  2⤵
  PID:3364
- C:\Windows\System32\PZmawdY.exe
  C:\Windows\System32\PZmawdY.exe
  2⤵
  PID:2032
- C:\Windows\System32\oUvVRsF.exe
  C:\Windows\System32\oUvVRsF.exe
  2⤵
  PID:2960
- C:\Windows\System32\PFFlpbV.exe
  C:\Windows\System32\PFFlpbV.exe
  2⤵
  PID:5140
- C:\Windows\System32\rFRfYvl.exe
  C:\Windows\System32\rFRfYvl.exe
  2⤵
  PID:5240
- C:\Windows\System32\ktuDzvP.exe
  C:\Windows\System32\ktuDzvP.exe
  2⤵
  PID:5288
- C:\Windows\System32\wKnbCGe.exe
  C:\Windows\System32\wKnbCGe.exe
  2⤵
  PID:5360
- C:\Windows\System32\VftEFUb.exe
  C:\Windows\System32\VftEFUb.exe
  2⤵
  PID:5408
- C:\Windows\System32\cWKIoNM.exe
  C:\Windows\System32\cWKIoNM.exe
  2⤵
  PID:5468
- C:\Windows\System32\yhZyJOr.exe
  C:\Windows\System32\yhZyJOr.exe
  2⤵
  PID:5552
- C:\Windows\System32\GCnVrpe.exe
  C:\Windows\System32\GCnVrpe.exe
  2⤵
  PID:5604
- C:\Windows\System32\oZQLjvP.exe
  C:\Windows\System32\oZQLjvP.exe
  2⤵
  PID:5680
- C:\Windows\System32\xKocZtT.exe
  C:\Windows\System32\xKocZtT.exe
  2⤵
  PID:5712
- C:\Windows\System32\gjoydwR.exe
  C:\Windows\System32\gjoydwR.exe
  2⤵
  PID:5828
- C:\Windows\System32\ZPlNQLV.exe
  C:\Windows\System32\ZPlNQLV.exe
  2⤵
  PID:5020
- C:\Windows\System32\LtZSFnV.exe
  C:\Windows\System32\LtZSFnV.exe
  2⤵
  PID:5940
- C:\Windows\System32\PDeukMw.exe
  C:\Windows\System32\PDeukMw.exe
  2⤵
  PID:5972
- C:\Windows\System32\uulLPml.exe
  C:\Windows\System32\uulLPml.exe
  2⤵
  PID:6056
- C:\Windows\System32\BvKbsyo.exe
  C:\Windows\System32\BvKbsyo.exe
  2⤵
  PID:6116
- C:\Windows\System32\juXgdLw.exe
  C:\Windows\System32\juXgdLw.exe
  2⤵
  PID:4476
- C:\Windows\System32\PBoctko.exe
  C:\Windows\System32\PBoctko.exe
  2⤵
  PID:2008
- C:\Windows\System32\ArkiFdO.exe
  C:\Windows\System32\ArkiFdO.exe
  2⤵
  PID:5136
- C:\Windows\System32\RqxtTgA.exe
  C:\Windows\System32\RqxtTgA.exe
  2⤵
  PID:5260
- C:\Windows\System32\iCvVQhV.exe
  C:\Windows\System32\iCvVQhV.exe
  2⤵
  PID:5660
- C:\Windows\System32\GbwYdFq.exe
  C:\Windows\System32\GbwYdFq.exe
  2⤵
  PID:5768
- C:\Windows\System32\PQxVteW.exe
  C:\Windows\System32\PQxVteW.exe
  2⤵
  PID:3704
- C:\Windows\System32\fhAZSfM.exe
  C:\Windows\System32\fhAZSfM.exe
  2⤵
  PID:6036
- C:\Windows\System32\hxqhDlr.exe
  C:\Windows\System32\hxqhDlr.exe
  2⤵
  PID:4356
- C:\Windows\System32\UCyHckb.exe
  C:\Windows\System32\UCyHckb.exe
  2⤵
  PID:2336
- C:\Windows\System32\irkWwYI.exe
  C:\Windows\System32\irkWwYI.exe
  2⤵
  PID:2440
- C:\Windows\System32\hPHRtQy.exe
  C:\Windows\System32\hPHRtQy.exe
  2⤵
  PID:4288
- C:\Windows\System32\XvRBjbD.exe
  C:\Windows\System32\XvRBjbD.exe
  2⤵
  PID:4788
- C:\Windows\System32\naTtUTJ.exe
  C:\Windows\System32\naTtUTJ.exe
  2⤵
  PID:4232
- C:\Windows\System32\AsZRtDd.exe
  C:\Windows\System32\AsZRtDd.exe
  2⤵
  PID:4600
- C:\Windows\System32\shPrKFn.exe
  C:\Windows\System32\shPrKFn.exe
  2⤵
  PID:5968
- C:\Windows\System32\OgNLoQi.exe
  C:\Windows\System32\OgNLoQi.exe
  2⤵
  PID:6004
- C:\Windows\System32\hHLtztc.exe
  C:\Windows\System32\hHLtztc.exe
  2⤵
  PID:2092
- C:\Windows\System32\xysFHVJ.exe
  C:\Windows\System32\xysFHVJ.exe
  2⤵
  PID:3740
- C:\Windows\System32\vHeaxLt.exe
  C:\Windows\System32\vHeaxLt.exe
  2⤵
  PID:3540
- C:\Windows\System32\GooKZka.exe
  C:\Windows\System32\GooKZka.exe
  2⤵
  PID:3696
- C:\Windows\System32\gsdSFjI.exe
  C:\Windows\System32\gsdSFjI.exe
  2⤵
  PID:3204
- C:\Windows\System32\JeelcLS.exe
  C:\Windows\System32\JeelcLS.exe
  2⤵
  PID:5092
- C:\Windows\System32\UdJPgBa.exe
  C:\Windows\System32\UdJPgBa.exe
  2⤵
  PID:4800
- C:\Windows\System32\IsXNFzP.exe
  C:\Windows\System32\IsXNFzP.exe
  2⤵
  PID:6156
- C:\Windows\System32\jgAqLSs.exe
  C:\Windows\System32\jgAqLSs.exe
  2⤵
  PID:6176
- C:\Windows\System32\sGwWvPE.exe
  C:\Windows\System32\sGwWvPE.exe
  2⤵
  PID:6216
- C:\Windows\System32\piBvNjo.exe
  C:\Windows\System32\piBvNjo.exe
  2⤵
  PID:6244
- C:\Windows\System32\VyBVGzE.exe
  C:\Windows\System32\VyBVGzE.exe
  2⤵
  PID:6272
- C:\Windows\System32\TQFFbHQ.exe
  C:\Windows\System32\TQFFbHQ.exe
  2⤵
  PID:6304
- C:\Windows\System32\HAdhOhj.exe
  C:\Windows\System32\HAdhOhj.exe
  2⤵
  PID:6340
- C:\Windows\System32\YhLGvBn.exe
  C:\Windows\System32\YhLGvBn.exe
  2⤵
  PID:6388
- C:\Windows\System32\biHcEJC.exe
  C:\Windows\System32\biHcEJC.exe
  2⤵
  PID:6408
- C:\Windows\System32\UwDrrih.exe
  C:\Windows\System32\UwDrrih.exe
  2⤵
  PID:6440
- C:\Windows\System32\YvsaDJY.exe
  C:\Windows\System32\YvsaDJY.exe
  2⤵
  PID:6476
- C:\Windows\System32\RShobZa.exe
  C:\Windows\System32\RShobZa.exe
  2⤵
  PID:6508
- C:\Windows\System32\JfNMKAo.exe
  C:\Windows\System32\JfNMKAo.exe
  2⤵
  PID:6536
- C:\Windows\System32\cSzuTKB.exe
  C:\Windows\System32\cSzuTKB.exe
  2⤵
  PID:6572
- C:\Windows\System32\SSXBDGM.exe
  C:\Windows\System32\SSXBDGM.exe
  2⤵
  PID:6604
- C:\Windows\System32\fmRlBnd.exe
  C:\Windows\System32\fmRlBnd.exe
  2⤵
  PID:6632
- C:\Windows\System32\HOtLxAs.exe
  C:\Windows\System32\HOtLxAs.exe
  2⤵
  PID:6668
- C:\Windows\System32\YxJbLQx.exe
  C:\Windows\System32\YxJbLQx.exe
  2⤵
  PID:6708
- C:\Windows\System32\DZoISdU.exe
  C:\Windows\System32\DZoISdU.exe
  2⤵
  PID:6732
- C:\Windows\System32\ITmHRdC.exe
  C:\Windows\System32\ITmHRdC.exe
  2⤵
  PID:6760
- C:\Windows\System32\OrGtUad.exe
  C:\Windows\System32\OrGtUad.exe
  2⤵
  PID:6780
- C:\Windows\System32\nWsSpEV.exe
  C:\Windows\System32\nWsSpEV.exe
  2⤵
  PID:6816
- C:\Windows\System32\xFuzdYm.exe
  C:\Windows\System32\xFuzdYm.exe
  2⤵
  PID:6876
- C:\Windows\System32\YNSVZpW.exe
  C:\Windows\System32\YNSVZpW.exe
  2⤵
  PID:6900
- C:\Windows\System32\zqQFjfp.exe
  C:\Windows\System32\zqQFjfp.exe
  2⤵
  PID:6924
- C:\Windows\System32\svkfpgc.exe
  C:\Windows\System32\svkfpgc.exe
  2⤵
  PID:6956
- C:\Windows\System32\sCUUdbz.exe
  C:\Windows\System32\sCUUdbz.exe
  2⤵
  PID:6980
- C:\Windows\System32\gdylFTo.exe
  C:\Windows\System32\gdylFTo.exe
  2⤵
  PID:7020
- C:\Windows\System32\wsiVwXt.exe
  C:\Windows\System32\wsiVwXt.exe
  2⤵
  PID:7048
- C:\Windows\System32\iafllQr.exe
  C:\Windows\System32\iafllQr.exe
  2⤵
  PID:7084
- C:\Windows\System32\hqyvKoy.exe
  C:\Windows\System32\hqyvKoy.exe
  2⤵
  PID:7108
- C:\Windows\System32\dvBsAca.exe
  C:\Windows\System32\dvBsAca.exe
  2⤵
  PID:7144
- C:\Windows\System32\GJxWmIb.exe
  C:\Windows\System32\GJxWmIb.exe
  2⤵
  PID:6148
- C:\Windows\System32\yHTZpXj.exe
  C:\Windows\System32\yHTZpXj.exe
  2⤵
  PID:6208
- C:\Windows\System32\ctSwiLD.exe
  C:\Windows\System32\ctSwiLD.exe
  2⤵
  PID:6296
- C:\Windows\System32\WLSYrPm.exe
  C:\Windows\System32\WLSYrPm.exe
  2⤵
  PID:6292
- C:\Windows\System32\blqYRvc.exe
  C:\Windows\System32\blqYRvc.exe
  2⤵
  PID:6448
- C:\Windows\System32\LsmCzXc.exe
  C:\Windows\System32\LsmCzXc.exe
  2⤵
  PID:6504
- C:\Windows\System32\oFYoWlI.exe
  C:\Windows\System32\oFYoWlI.exe
  2⤵
  PID:6584
- C:\Windows\System32\xfPbNGF.exe
  C:\Windows\System32\xfPbNGF.exe
  2⤵
  PID:6624
- C:\Windows\System32\DKQGyVh.exe
  C:\Windows\System32\DKQGyVh.exe
  2⤵
  PID:6656
- C:\Windows\System32\IbnNeJx.exe
  C:\Windows\System32\IbnNeJx.exe
  2⤵
  PID:6688
- C:\Windows\System32\YdEYVKe.exe
  C:\Windows\System32\YdEYVKe.exe
  2⤵
  PID:6716
- C:\Windows\System32\uEoeLcV.exe
  C:\Windows\System32\uEoeLcV.exe
  2⤵
  PID:6804
- C:\Windows\System32\UWcqFzr.exe
  C:\Windows\System32\UWcqFzr.exe
  2⤵
  PID:6908
- C:\Windows\System32\bWVaXVB.exe
  C:\Windows\System32\bWVaXVB.exe
  2⤵
  PID:6972
- C:\Windows\System32\DaJvWlU.exe
  C:\Windows\System32\DaJvWlU.exe
  2⤵
  PID:7064
- C:\Windows\System32\JPqCkrT.exe
  C:\Windows\System32\JPqCkrT.exe
  2⤵
  PID:7156
- C:\Windows\System32\HaZFxfU.exe
  C:\Windows\System32\HaZFxfU.exe
  2⤵
  PID:6200
- C:\Windows\System32\vjNzhvK.exe
  C:\Windows\System32\vjNzhvK.exe
  2⤵
  PID:6404
- C:\Windows\System32\nahDQlH.exe
  C:\Windows\System32\nahDQlH.exe
  2⤵
  PID:6552
- C:\Windows\System32\vknrIOB.exe
  C:\Windows\System32\vknrIOB.exe
  2⤵
  PID:452
- C:\Windows\System32\WQOixNm.exe
  C:\Windows\System32\WQOixNm.exe
  2⤵
  PID:6808
- C:\Windows\System32\PssKFvu.exe
  C:\Windows\System32\PssKFvu.exe
  2⤵
  PID:6948
- C:\Windows\System32\lcFZyvM.exe
  C:\Windows\System32\lcFZyvM.exe
  2⤵
  PID:7164
- C:\Windows\System32\NlsQGSF.exe
  C:\Windows\System32\NlsQGSF.exe
  2⤵
  PID:6488
- C:\Windows\System32\dvvKGuz.exe
  C:\Windows\System32\dvvKGuz.exe
  2⤵
  PID:7040
- C:\Windows\System32\azUpWJR.exe
  C:\Windows\System32\azUpWJR.exe
  2⤵
  PID:6888
- C:\Windows\System32\HyQPYdU.exe
  C:\Windows\System32\HyQPYdU.exe
  2⤵
  PID:7196
- C:\Windows\System32\gunJXIa.exe
  C:\Windows\System32\gunJXIa.exe
  2⤵
  PID:7220
- C:\Windows\System32\ljNoCmV.exe
  C:\Windows\System32\ljNoCmV.exe
  2⤵
  PID:7248
- C:\Windows\System32\VKNDqcd.exe
  C:\Windows\System32\VKNDqcd.exe
  2⤵
  PID:7276
- C:\Windows\System32\ElMWSxA.exe
  C:\Windows\System32\ElMWSxA.exe
  2⤵
  PID:7312
- C:\Windows\System32\lKmEpJK.exe
  C:\Windows\System32\lKmEpJK.exe
  2⤵
  PID:7336
- C:\Windows\System32\jEeVeQi.exe
  C:\Windows\System32\jEeVeQi.exe
  2⤵
  PID:7364
- C:\Windows\System32\eBeevAf.exe
  C:\Windows\System32\eBeevAf.exe
  2⤵
  PID:7392
- C:\Windows\System32\AdCQQBm.exe
  C:\Windows\System32\AdCQQBm.exe
  2⤵
  PID:7420
- C:\Windows\System32\FzyBJpn.exe
  C:\Windows\System32\FzyBJpn.exe
  2⤵
  PID:7444
- C:\Windows\System32\RitiyBw.exe
  C:\Windows\System32\RitiyBw.exe
  2⤵
  PID:7472
- C:\Windows\System32\FNvzwqY.exe
  C:\Windows\System32\FNvzwqY.exe
  2⤵
  PID:7500
- C:\Windows\System32\rjTJudP.exe
  C:\Windows\System32\rjTJudP.exe
  2⤵
  PID:7532
- C:\Windows\System32\ULlHBkq.exe
  C:\Windows\System32\ULlHBkq.exe
  2⤵
  PID:7556
- C:\Windows\System32\XeICCed.exe
  C:\Windows\System32\XeICCed.exe
  2⤵
  PID:7584
- C:\Windows\System32\CcvuRaI.exe
  C:\Windows\System32\CcvuRaI.exe
  2⤵
  PID:7616
- C:\Windows\System32\tYyueSf.exe
  C:\Windows\System32\tYyueSf.exe
  2⤵
  PID:7644
- C:\Windows\System32\oMKThNJ.exe
  C:\Windows\System32\oMKThNJ.exe
  2⤵
  PID:7672
- C:\Windows\System32\URQeZdE.exe
  C:\Windows\System32\URQeZdE.exe
  2⤵
  PID:7700
- C:\Windows\System32\lTdgawF.exe
  C:\Windows\System32\lTdgawF.exe
  2⤵
  PID:7728
- C:\Windows\System32\fakAeBs.exe
  C:\Windows\System32\fakAeBs.exe
  2⤵
  PID:7760
- C:\Windows\System32\vYKhuwE.exe
  C:\Windows\System32\vYKhuwE.exe
  2⤵
  PID:7788
- C:\Windows\System32\uPalVaX.exe
  C:\Windows\System32\uPalVaX.exe
  2⤵
  PID:7824
- C:\Windows\System32\KDPKARj.exe
  C:\Windows\System32\KDPKARj.exe
  2⤵
  PID:7852
- C:\Windows\System32\MaCtOBJ.exe
  C:\Windows\System32\MaCtOBJ.exe
  2⤵
  PID:7880
- C:\Windows\System32\FaqpgxW.exe
  C:\Windows\System32\FaqpgxW.exe
  2⤵
  PID:7908
- C:\Windows\System32\fQCApMQ.exe
  C:\Windows\System32\fQCApMQ.exe
  2⤵
  PID:7936
- C:\Windows\System32\cbohsoI.exe
  C:\Windows\System32\cbohsoI.exe
  2⤵
  PID:7964
- C:\Windows\System32\sWJGdmB.exe
  C:\Windows\System32\sWJGdmB.exe
  2⤵
  PID:7980
- C:\Windows\System32\NskDDxe.exe
  C:\Windows\System32\NskDDxe.exe
  2⤵
  PID:8020
- C:\Windows\System32\yvSDiYL.exe
  C:\Windows\System32\yvSDiYL.exe
  2⤵
  PID:8048
- C:\Windows\System32\ZFOsVXX.exe
  C:\Windows\System32\ZFOsVXX.exe
  2⤵
  PID:8080
- C:\Windows\System32\MVtgQnU.exe
  C:\Windows\System32\MVtgQnU.exe
  2⤵
  PID:8108
- C:\Windows\System32\rXBaaxM.exe
  C:\Windows\System32\rXBaaxM.exe
  2⤵
  PID:8136
- C:\Windows\System32\TtkAXFj.exe
  C:\Windows\System32\TtkAXFj.exe
  2⤵
  PID:8168
- C:\Windows\System32\zEHagkp.exe
  C:\Windows\System32\zEHagkp.exe
  2⤵
  PID:7180
- C:\Windows\System32\BEcKida.exe
  C:\Windows\System32\BEcKida.exe
  2⤵
  PID:7244
- C:\Windows\System32\dYkEsZe.exe
  C:\Windows\System32\dYkEsZe.exe
  2⤵
  PID:7320
- C:\Windows\System32\yNWQySa.exe
  C:\Windows\System32\yNWQySa.exe
  2⤵
  PID:7380
- C:\Windows\System32\rIZYAXm.exe
  C:\Windows\System32\rIZYAXm.exe
  2⤵
  PID:7440
- C:\Windows\System32\fZpGwLL.exe
  C:\Windows\System32\fZpGwLL.exe
  2⤵
  PID:7512
- C:\Windows\System32\yWXLIDS.exe
  C:\Windows\System32\yWXLIDS.exe
  2⤵
  PID:7580
- C:\Windows\System32\VduEpxo.exe
  C:\Windows\System32\VduEpxo.exe
  2⤵
  PID:7668
- C:\Windows\System32\GhZhnqC.exe
  C:\Windows\System32\GhZhnqC.exe
  2⤵
  PID:7740
- C:\Windows\System32\ABFbJCM.exe
  C:\Windows\System32\ABFbJCM.exe
  2⤵
  PID:7804
- C:\Windows\System32\iESNRMl.exe
  C:\Windows\System32\iESNRMl.exe
  2⤵
  PID:5924
- C:\Windows\System32\ngebQPp.exe
  C:\Windows\System32\ngebQPp.exe
  2⤵
  PID:8008
- C:\Windows\System32\TWcMFJe.exe
  C:\Windows\System32\TWcMFJe.exe
  2⤵
  PID:8072
- C:\Windows\System32\LhPfikx.exe
  C:\Windows\System32\LhPfikx.exe
  2⤵
  PID:8132
- C:\Windows\System32\fRvzXpz.exe
  C:\Windows\System32\fRvzXpz.exe
  2⤵
  PID:7348
- C:\Windows\System32\jSwwaEs.exe
  C:\Windows\System32\jSwwaEs.exe
  2⤵
  PID:7552
- C:\Windows\System32\bZPwfoS.exe
  C:\Windows\System32\bZPwfoS.exe
  2⤵
  PID:2256
- C:\Windows\System32\AXnreLC.exe
  C:\Windows\System32\AXnreLC.exe
  2⤵
  PID:7232
- C:\Windows\System32\vqaYdaf.exe
  C:\Windows\System32\vqaYdaf.exe
  2⤵
  PID:2912
- C:\Windows\System32\jrsiPGS.exe
  C:\Windows\System32\jrsiPGS.exe
  2⤵
  PID:7720
- C:\Windows\System32\fKPYRdJ.exe
  C:\Windows\System32\fKPYRdJ.exe
  2⤵
  PID:8224
- C:\Windows\System32\aErAVfh.exe
  C:\Windows\System32\aErAVfh.exe
  2⤵
  PID:8252
- C:\Windows\System32\TsUNMVO.exe
  C:\Windows\System32\TsUNMVO.exe
  2⤵
  PID:8284
- C:\Windows\System32\Cxeotpd.exe
  C:\Windows\System32\Cxeotpd.exe
  2⤵
  PID:8312
- C:\Windows\System32\yFWjnYI.exe
  C:\Windows\System32\yFWjnYI.exe
  2⤵
  PID:8344
- C:\Windows\System32\yxmKBay.exe
  C:\Windows\System32\yxmKBay.exe
  2⤵
  PID:8384
- C:\Windows\System32\TSarmJM.exe
  C:\Windows\System32\TSarmJM.exe
  2⤵
  PID:8416
- C:\Windows\System32\UFFhOtO.exe
  C:\Windows\System32\UFFhOtO.exe
  2⤵
  PID:8444
- C:\Windows\System32\UbaEHAr.exe
  C:\Windows\System32\UbaEHAr.exe
  2⤵
  PID:8472
- C:\Windows\System32\cMYlVKR.exe
  C:\Windows\System32\cMYlVKR.exe
  2⤵
  PID:8504
- C:\Windows\System32\xjckCaO.exe
  C:\Windows\System32\xjckCaO.exe
  2⤵
  PID:8528
- C:\Windows\System32\abFYCHV.exe
  C:\Windows\System32\abFYCHV.exe
  2⤵
  PID:8556
- C:\Windows\System32\CVuIpCQ.exe
  C:\Windows\System32\CVuIpCQ.exe
  2⤵
  PID:8588
- C:\Windows\System32\dZjtcFi.exe
  C:\Windows\System32\dZjtcFi.exe
  2⤵
  PID:8624
- C:\Windows\System32\QMQrJAm.exe
  C:\Windows\System32\QMQrJAm.exe
  2⤵
  PID:8652
- C:\Windows\System32\CrhmFaD.exe
  C:\Windows\System32\CrhmFaD.exe
  2⤵
  PID:8696
- C:\Windows\System32\yvmceaf.exe
  C:\Windows\System32\yvmceaf.exe
  2⤵
  PID:8724
- C:\Windows\System32\WuJKabL.exe
  C:\Windows\System32\WuJKabL.exe
  2⤵
  PID:8760
- C:\Windows\System32\hLoYLor.exe
  C:\Windows\System32\hLoYLor.exe
  2⤵
  PID:8784
- C:\Windows\System32\JaXZdow.exe
  C:\Windows\System32\JaXZdow.exe
  2⤵
  PID:8812
- C:\Windows\System32\yglvvKN.exe
  C:\Windows\System32\yglvvKN.exe
  2⤵
  PID:8836
- C:\Windows\System32\lfrzovf.exe
  C:\Windows\System32\lfrzovf.exe
  2⤵
  PID:8868
- C:\Windows\System32\taJFKeE.exe
  C:\Windows\System32\taJFKeE.exe
  2⤵
  PID:8900
- C:\Windows\System32\vKBTFqx.exe
  C:\Windows\System32\vKBTFqx.exe
  2⤵
  PID:8932
- C:\Windows\System32\KpJxGRb.exe
  C:\Windows\System32\KpJxGRb.exe
  2⤵
  PID:8956
- C:\Windows\System32\iTUSOIw.exe
  C:\Windows\System32\iTUSOIw.exe
  2⤵
  PID:8988
- C:\Windows\System32\LfjuEuL.exe
  C:\Windows\System32\LfjuEuL.exe
  2⤵
  PID:9012
- C:\Windows\System32\sPxpbJY.exe
  C:\Windows\System32\sPxpbJY.exe
  2⤵
  PID:9040
- C:\Windows\System32\wPnaSyc.exe
  C:\Windows\System32\wPnaSyc.exe
  2⤵
  PID:9072
- C:\Windows\System32\YGbNDmU.exe
  C:\Windows\System32\YGbNDmU.exe
  2⤵
  PID:9100
- C:\Windows\System32\ZTpGfdP.exe
  C:\Windows\System32\ZTpGfdP.exe
  2⤵
  PID:9124
- C:\Windows\System32\MCnrSGV.exe
  C:\Windows\System32\MCnrSGV.exe
  2⤵
  PID:9156
- C:\Windows\System32\gasuIEC.exe
  C:\Windows\System32\gasuIEC.exe
  2⤵
  PID:9180
- C:\Windows\System32\rZcWsVT.exe
  C:\Windows\System32\rZcWsVT.exe
  2⤵
  PID:9208
- C:\Windows\System32\WbvqNOY.exe
  C:\Windows\System32\WbvqNOY.exe
  2⤵
  PID:8240
- C:\Windows\System32\yKRJJaL.exe
  C:\Windows\System32\yKRJJaL.exe
  2⤵
  PID:8292
- C:\Windows\System32\xwUjRhW.exe
  C:\Windows\System32\xwUjRhW.exe
  2⤵
  PID:8376
- C:\Windows\System32\AjViwug.exe
  C:\Windows\System32\AjViwug.exe
  2⤵
  PID:8436
- C:\Windows\System32\wjPLUQP.exe
  C:\Windows\System32\wjPLUQP.exe
  2⤵
  PID:8496
- C:\Windows\System32\IWEGqlM.exe
  C:\Windows\System32\IWEGqlM.exe
  2⤵
  PID:8568
- C:\Windows\System32\kQOgUsL.exe
  C:\Windows\System32\kQOgUsL.exe
  2⤵
  PID:8644
- C:\Windows\System32\ebPPIxY.exe
  C:\Windows\System32\ebPPIxY.exe
  2⤵
  PID:8736
- C:\Windows\System32\pPcnDDC.exe
  C:\Windows\System32\pPcnDDC.exe
  2⤵
  PID:8800
- C:\Windows\System32\EsspsWl.exe
  C:\Windows\System32\EsspsWl.exe
  2⤵
  PID:8860
- C:\Windows\System32\ThAODMx.exe
  C:\Windows\System32\ThAODMx.exe
  2⤵
  PID:8940
- C:\Windows\System32\iSkqFRr.exe
  C:\Windows\System32\iSkqFRr.exe
  2⤵
  PID:9004
- C:\Windows\System32\STKtcBK.exe
  C:\Windows\System32\STKtcBK.exe
  2⤵
  PID:9060
- C:\Windows\System32\CzrmPIy.exe
  C:\Windows\System32\CzrmPIy.exe
  2⤵
  PID:9144
- C:\Windows\System32\SWYpDuO.exe
  C:\Windows\System32\SWYpDuO.exe
  2⤵
  PID:9204
- C:\Windows\System32\RgTXjox.exe
  C:\Windows\System32\RgTXjox.exe
  2⤵
  PID:8308
- C:\Windows\System32\FDcpWgb.exe
  C:\Windows\System32\FDcpWgb.exe
  2⤵
  PID:8484
- C:\Windows\System32\MRjukmN.exe
  C:\Windows\System32\MRjukmN.exe
  2⤵
  PID:8636
- C:\Windows\System32\ZjpDQKj.exe
  C:\Windows\System32\ZjpDQKj.exe
  2⤵
  PID:8828
- C:\Windows\System32\kJUgLuc.exe
  C:\Windows\System32\kJUgLuc.exe
  2⤵
  PID:8980
- C:\Windows\System32\nNDoYxD.exe
  C:\Windows\System32\nNDoYxD.exe
  2⤵
  PID:9172
- C:\Windows\System32\WAzFQbD.exe
  C:\Windows\System32\WAzFQbD.exe
  2⤵
  PID:8432
- C:\Windows\System32\jNPBYLD.exe
  C:\Windows\System32\jNPBYLD.exe
  2⤵
  PID:8776
- C:\Windows\System32\ODfckeh.exe
  C:\Windows\System32\ODfckeh.exe
  2⤵
  PID:9140
- C:\Windows\System32\rUCsZWM.exe
  C:\Windows\System32\rUCsZWM.exe
  2⤵
  PID:8976
- C:\Windows\System32\HWSMVzW.exe
  C:\Windows\System32\HWSMVzW.exe
  2⤵
  PID:8772
- C:\Windows\System32\WqVFHJZ.exe
  C:\Windows\System32\WqVFHJZ.exe
  2⤵
  PID:9244
- C:\Windows\System32\PurRBXc.exe
  C:\Windows\System32\PurRBXc.exe
  2⤵
  PID:9272
- C:\Windows\System32\PNQBdQa.exe
  C:\Windows\System32\PNQBdQa.exe
  2⤵
  PID:9300
- C:\Windows\System32\jVDiyGf.exe
  C:\Windows\System32\jVDiyGf.exe
  2⤵
  PID:9328
- C:\Windows\System32\BwnnQWQ.exe
  C:\Windows\System32\BwnnQWQ.exe
  2⤵
  PID:9356
- C:\Windows\System32\pRIwvqE.exe
  C:\Windows\System32\pRIwvqE.exe
  2⤵
  PID:9384
- C:\Windows\System32\DLYKpgC.exe
  C:\Windows\System32\DLYKpgC.exe
  2⤵
  PID:9416
- C:\Windows\System32\vzQoBwQ.exe
  C:\Windows\System32\vzQoBwQ.exe
  2⤵
  PID:9452
- C:\Windows\System32\FYcDuRt.exe
  C:\Windows\System32\FYcDuRt.exe
  2⤵
  PID:9488
- C:\Windows\System32\JuuxMQN.exe
  C:\Windows\System32\JuuxMQN.exe
  2⤵
  PID:9516
- C:\Windows\System32\qfTzVDH.exe
  C:\Windows\System32\qfTzVDH.exe
  2⤵
  PID:9552
- C:\Windows\System32\mVfDPoY.exe
  C:\Windows\System32\mVfDPoY.exe
  2⤵
  PID:9572
- C:\Windows\System32\bMDYztM.exe
  C:\Windows\System32\bMDYztM.exe
  2⤵
  PID:9600
- C:\Windows\System32\oVQLkQM.exe
  C:\Windows\System32\oVQLkQM.exe
  2⤵
  PID:9628
- C:\Windows\System32\onRjKQz.exe
  C:\Windows\System32\onRjKQz.exe
  2⤵
  PID:9656
- C:\Windows\System32\HgSJhvJ.exe
  C:\Windows\System32\HgSJhvJ.exe
  2⤵
  PID:9684
- C:\Windows\System32\ekqwxpE.exe
  C:\Windows\System32\ekqwxpE.exe
  2⤵
  PID:9712
- C:\Windows\System32\PiMGBls.exe
  C:\Windows\System32\PiMGBls.exe
  2⤵
  PID:9740
- C:\Windows\System32\oXZrENT.exe
  C:\Windows\System32\oXZrENT.exe
  2⤵
  PID:9768
- C:\Windows\System32\LtEuEpC.exe
  C:\Windows\System32\LtEuEpC.exe
  2⤵
  PID:9800
- C:\Windows\System32\UZRXQWD.exe
  C:\Windows\System32\UZRXQWD.exe
  2⤵
  PID:9828
- C:\Windows\System32\gvobKmm.exe
  C:\Windows\System32\gvobKmm.exe
  2⤵
  PID:9856
- C:\Windows\System32\PZFSBvW.exe
  C:\Windows\System32\PZFSBvW.exe
  2⤵
  PID:9884
- C:\Windows\System32\ezECQXp.exe
  C:\Windows\System32\ezECQXp.exe
  2⤵
  PID:9912
- C:\Windows\System32\uaXQOaA.exe
  C:\Windows\System32\uaXQOaA.exe
  2⤵
  PID:9940
- C:\Windows\System32\IXJCNlv.exe
  C:\Windows\System32\IXJCNlv.exe
  2⤵
  PID:9976
- C:\Windows\System32\UxrtnnE.exe
  C:\Windows\System32\UxrtnnE.exe
  2⤵
  PID:10008
- C:\Windows\System32\FAvAdYw.exe
  C:\Windows\System32\FAvAdYw.exe
  2⤵
  PID:10036
- C:\Windows\System32\GquHfnu.exe
  C:\Windows\System32\GquHfnu.exe
  2⤵
  PID:10056
- C:\Windows\System32\iFGdvXM.exe
  C:\Windows\System32\iFGdvXM.exe
  2⤵
  PID:10108
- C:\Windows\System32\sGslRwn.exe
  C:\Windows\System32\sGslRwn.exe
  2⤵
  PID:10124
- C:\Windows\System32\JWcKQzA.exe
  C:\Windows\System32\JWcKQzA.exe
  2⤵
  PID:10152
- C:\Windows\System32\XhozjBk.exe
  C:\Windows\System32\XhozjBk.exe
  2⤵
  PID:10180
- C:\Windows\System32\fjQjgOw.exe
  C:\Windows\System32\fjQjgOw.exe
  2⤵
  PID:10208
- C:\Windows\System32\jzyFvsr.exe
  C:\Windows\System32\jzyFvsr.exe
  2⤵
  PID:10236
- C:\Windows\System32\RkENQax.exe
  C:\Windows\System32\RkENQax.exe
  2⤵
  PID:9288
- C:\Windows\System32\ElPUjaF.exe
  C:\Windows\System32\ElPUjaF.exe
  2⤵
  PID:9348
- C:\Windows\System32\SDRezyU.exe
  C:\Windows\System32\SDRezyU.exe
  2⤵
  PID:9412
- C:\Windows\System32\BDnbPbk.exe
  C:\Windows\System32\BDnbPbk.exe
  2⤵
  PID:9504
- C:\Windows\System32\CQKcUSG.exe
  C:\Windows\System32\CQKcUSG.exe
  2⤵
  PID:9536
- C:\Windows\System32\leQuqbG.exe
  C:\Windows\System32\leQuqbG.exe
  2⤵
  PID:9596
- C:\Windows\System32\RQADWhr.exe
  C:\Windows\System32\RQADWhr.exe
  2⤵
  PID:9672
- C:\Windows\System32\kKpsZxg.exe
  C:\Windows\System32\kKpsZxg.exe
  2⤵
  PID:9732
- C:\Windows\System32\NPbkHqm.exe
  C:\Windows\System32\NPbkHqm.exe
  2⤵
  PID:9764
- C:\Windows\System32\rATsyZK.exe
  C:\Windows\System32\rATsyZK.exe
  2⤵
  PID:9868
- C:\Windows\System32\EElvtTe.exe
  C:\Windows\System32\EElvtTe.exe
  2⤵
  PID:9932
- C:\Windows\System32\yOfcuSL.exe
  C:\Windows\System32\yOfcuSL.exe
  2⤵
  PID:10004
- C:\Windows\System32\XTWLppq.exe
  C:\Windows\System32\XTWLppq.exe
  2⤵
  PID:10088
- C:\Windows\System32\XRZmgRH.exe
  C:\Windows\System32\XRZmgRH.exe
  2⤵
  PID:10148
- C:\Windows\System32\kpXvTUL.exe
  C:\Windows\System32\kpXvTUL.exe
  2⤵
  PID:10204
- C:\Windows\System32\Rahtaoz.exe
  C:\Windows\System32\Rahtaoz.exe
  2⤵
  PID:9312
- C:\Windows\System32\xMYcxTs.exe
  C:\Windows\System32\xMYcxTs.exe
  2⤵
  PID:9480
- C:\Windows\System32\icZzZbv.exe
  C:\Windows\System32\icZzZbv.exe
  2⤵
  PID:9592
- C:\Windows\System32\HWmcHlB.exe
  C:\Windows\System32\HWmcHlB.exe
  2⤵
  PID:9752
- C:\Windows\System32\EGynhCv.exe
  C:\Windows\System32\EGynhCv.exe
  2⤵
  PID:9924
- C:\Windows\System32\cDOhGet.exe
  C:\Windows\System32\cDOhGet.exe
  2⤵
  PID:10120
- C:\Windows\System32\rlOlNTR.exe
  C:\Windows\System32\rlOlNTR.exe
  2⤵
  PID:9448
- C:\Windows\System32\iORmsQk.exe
  C:\Windows\System32\iORmsQk.exe
  2⤵
  PID:9652
- C:\Windows\System32\uajdvxQ.exe
  C:\Windows\System32\uajdvxQ.exe
  2⤵
  PID:10048
- C:\Windows\System32\YgRqkSH.exe
  C:\Windows\System32\YgRqkSH.exe
  2⤵
  PID:10044
- C:\Windows\System32\kgFDaIk.exe
  C:\Windows\System32\kgFDaIk.exe
  2⤵
  PID:10200
- C:\Windows\System32\HUDSMlE.exe
  C:\Windows\System32\HUDSMlE.exe
  2⤵
  PID:10248
- C:\Windows\System32\iJatUAH.exe
  C:\Windows\System32\iJatUAH.exe
  2⤵
  PID:10272
- C:\Windows\System32\FnWOgFE.exe
  C:\Windows\System32\FnWOgFE.exe
  2⤵
  PID:10296
- C:\Windows\System32\AhCWZmT.exe
  C:\Windows\System32\AhCWZmT.exe
  2⤵
  PID:10324
- C:\Windows\System32\ipZUnWP.exe
  C:\Windows\System32\ipZUnWP.exe
  2⤵
  PID:10360
- C:\Windows\System32\wZUOosp.exe
  C:\Windows\System32\wZUOosp.exe
  2⤵
  PID:10416
- C:\Windows\System32\lnGqCqq.exe
  C:\Windows\System32\lnGqCqq.exe
  2⤵
  PID:10456
- C:\Windows\System32\jglMPNb.exe
  C:\Windows\System32\jglMPNb.exe
  2⤵
  PID:10484
- C:\Windows\System32\kQuIPJy.exe
  C:\Windows\System32\kQuIPJy.exe
  2⤵
  PID:10508
- C:\Windows\System32\CMhinQb.exe
  C:\Windows\System32\CMhinQb.exe
  2⤵
  PID:10536
- C:\Windows\System32\JJIeTNv.exe
  C:\Windows\System32\JJIeTNv.exe
  2⤵
  PID:10572
- C:\Windows\System32\mWanafY.exe
  C:\Windows\System32\mWanafY.exe
  2⤵
  PID:10592
- C:\Windows\System32\tILJaAw.exe
  C:\Windows\System32\tILJaAw.exe
  2⤵
  PID:10628
- C:\Windows\System32\GRmubbr.exe
  C:\Windows\System32\GRmubbr.exe
  2⤵
  PID:10656
- C:\Windows\System32\zIaRpkv.exe
  C:\Windows\System32\zIaRpkv.exe
  2⤵
  PID:10684
- C:\Windows\System32\zCOpPol.exe
  C:\Windows\System32\zCOpPol.exe
  2⤵
  PID:10700
- C:\Windows\System32\TFIckKZ.exe
  C:\Windows\System32\TFIckKZ.exe
  2⤵
  PID:10740
- C:\Windows\System32\XZmafva.exe
  C:\Windows\System32\XZmafva.exe
  2⤵
  PID:10776
- C:\Windows\System32\adtwTyl.exe
  C:\Windows\System32\adtwTyl.exe
  2⤵
  PID:10796
- C:\Windows\System32\RlHsOov.exe
  C:\Windows\System32\RlHsOov.exe
  2⤵
  PID:10812
- C:\Windows\System32\VXgxdqO.exe
  C:\Windows\System32\VXgxdqO.exe
  2⤵
  PID:10852
- C:\Windows\System32\dSYdGxD.exe
  C:\Windows\System32\dSYdGxD.exe
  2⤵
  PID:10880
- C:\Windows\System32\gprZZwg.exe
  C:\Windows\System32\gprZZwg.exe
  2⤵
  PID:10908
- C:\Windows\System32\CfpgRFs.exe
  C:\Windows\System32\CfpgRFs.exe
  2⤵
  PID:10936
- C:\Windows\System32\NtWQndP.exe
  C:\Windows\System32\NtWQndP.exe
  2⤵
  PID:10964
- C:\Windows\System32\FiXQRDj.exe
  C:\Windows\System32\FiXQRDj.exe
  2⤵
  PID:10992
- C:\Windows\System32\BBWINYF.exe
  C:\Windows\System32\BBWINYF.exe
  2⤵
  PID:11020
- C:\Windows\System32\CLdASTm.exe
  C:\Windows\System32\CLdASTm.exe
  2⤵
  PID:11048
- C:\Windows\System32\IkBDiMb.exe
  C:\Windows\System32\IkBDiMb.exe
  2⤵
  PID:11064
- C:\Windows\System32\HZfPPaP.exe
  C:\Windows\System32\HZfPPaP.exe
  2⤵
  PID:11100
- C:\Windows\System32\bgIBaGt.exe
  C:\Windows\System32\bgIBaGt.exe
  2⤵
  PID:11132
- C:\Windows\System32\fwIuirl.exe
  C:\Windows\System32\fwIuirl.exe
  2⤵
  PID:11156
- C:\Windows\System32\xFgJhel.exe
  C:\Windows\System32\xFgJhel.exe
  2⤵
  PID:11180
- C:\Windows\System32\JvOsuGU.exe
  C:\Windows\System32\JvOsuGU.exe
  2⤵
  PID:11220
- C:\Windows\System32\bGFAcgU.exe
  C:\Windows\System32\bGFAcgU.exe
  2⤵
  PID:11248
- C:\Windows\System32\lSWrRsq.exe
  C:\Windows\System32\lSWrRsq.exe
  2⤵
  PID:9908
- C:\Windows\System32\fAPbHwI.exe
  C:\Windows\System32\fAPbHwI.exe
  2⤵
  PID:10284
- C:\Windows\System32\SoiRKyK.exe
  C:\Windows\System32\SoiRKyK.exe
  2⤵
  PID:10384
- C:\Windows\System32\FZRrfmb.exe
  C:\Windows\System32\FZRrfmb.exe
  2⤵
  PID:10468
- C:\Windows\System32\JZsjpiJ.exe
  C:\Windows\System32\JZsjpiJ.exe
  2⤵
  PID:10564
- C:\Windows\System32\PYbaPQC.exe
  C:\Windows\System32\PYbaPQC.exe
  2⤵
  PID:10620
- C:\Windows\System32\YWQAaBG.exe
  C:\Windows\System32\YWQAaBG.exe
  2⤵
  PID:10676
- C:\Windows\System32\uLpYyVi.exe
  C:\Windows\System32\uLpYyVi.exe
  2⤵
  PID:10752
- C:\Windows\System32\cgcgJJY.exe
  C:\Windows\System32\cgcgJJY.exe
  2⤵
  PID:10804
- C:\Windows\System32\YXMbHCu.exe
  C:\Windows\System32\YXMbHCu.exe
  2⤵
  PID:10872
- C:\Windows\System32\MjJrMlK.exe
  C:\Windows\System32\MjJrMlK.exe
  2⤵
  PID:10932
- C:\Windows\System32\CkBuORz.exe
  C:\Windows\System32\CkBuORz.exe
  2⤵
  PID:11004
- C:\Windows\System32\kUbXDcJ.exe
  C:\Windows\System32\kUbXDcJ.exe
  2⤵
  PID:11044
- C:\Windows\System32\VfsyXBm.exe
  C:\Windows\System32\VfsyXBm.exe
  2⤵
  PID:11128
- C:\Windows\System32\KkXkVNt.exe
  C:\Windows\System32\KkXkVNt.exe
  2⤵
  PID:11172
- C:\Windows\System32\WLzzBDp.exe
  C:\Windows\System32\WLzzBDp.exe
  2⤵
  PID:11256
- C:\Windows\System32\uMemluv.exe
  C:\Windows\System32\uMemluv.exe
  2⤵
  PID:10356
- C:\Windows\System32\XJAbpFr.exe
  C:\Windows\System32\XJAbpFr.exe
  2⤵
  PID:10584
- C:\Windows\System32\hJLSkxv.exe
  C:\Windows\System32\hJLSkxv.exe
  2⤵
  PID:10728
- C:\Windows\System32\bDyisnp.exe
  C:\Windows\System32\bDyisnp.exe
  2⤵
  PID:10768
- C:\Windows\System32\UfZPBrz.exe
  C:\Windows\System32\UfZPBrz.exe
  2⤵
  PID:10960
- C:\Windows\System32\PSpRwnL.exe
  C:\Windows\System32\PSpRwnL.exe
  2⤵
  PID:11056
- C:\Windows\System32\pZIcVUl.exe
  C:\Windows\System32\pZIcVUl.exe
  2⤵
  PID:10280
- C:\Windows\System32\lVkifUp.exe
  C:\Windows\System32\lVkifUp.exe
  2⤵
  PID:10808
- C:\Windows\System32\XpqnxgO.exe
  C:\Windows\System32\XpqnxgO.exe
  2⤵
  PID:11108
- C:\Windows\System32\wLIuspU.exe
  C:\Windows\System32\wLIuspU.exe
  2⤵
  PID:10648
- C:\Windows\System32\OhQjYsZ.exe
  C:\Windows\System32\OhQjYsZ.exe
  2⤵
  PID:10408
- C:\Windows\System32\VeKiCLd.exe
  C:\Windows\System32\VeKiCLd.exe
  2⤵
  PID:11288
- C:\Windows\System32\uJEbTIe.exe
  C:\Windows\System32\uJEbTIe.exe
  2⤵
  PID:11320
- C:\Windows\System32\oITTthQ.exe
  C:\Windows\System32\oITTthQ.exe
  2⤵
  PID:11348
- C:\Windows\System32\MyVZYWg.exe
  C:\Windows\System32\MyVZYWg.exe
  2⤵
  PID:11376
- C:\Windows\System32\jtkNBWz.exe
  C:\Windows\System32\jtkNBWz.exe
  2⤵
  PID:11404
- C:\Windows\System32\GnUvoHC.exe
  C:\Windows\System32\GnUvoHC.exe
  2⤵
  PID:11440
- C:\Windows\System32\vdhBoct.exe
  C:\Windows\System32\vdhBoct.exe
  2⤵
  PID:11460
- C:\Windows\System32\COfavrJ.exe
  C:\Windows\System32\COfavrJ.exe
  2⤵
  PID:11488
- C:\Windows\System32\LrSFEXb.exe
  C:\Windows\System32\LrSFEXb.exe
  2⤵
  PID:11516
- C:\Windows\System32\aMlqwua.exe
  C:\Windows\System32\aMlqwua.exe
  2⤵
  PID:11532
- C:\Windows\System32\RyUEjNR.exe
  C:\Windows\System32\RyUEjNR.exe
  2⤵
  PID:11548
- C:\Windows\System32\FEFzWMS.exe
  C:\Windows\System32\FEFzWMS.exe
  2⤵
  PID:11580
- C:\Windows\System32\JgeBRRa.exe
  C:\Windows\System32\JgeBRRa.exe
  2⤵
  PID:11600
- C:\Windows\System32\vzRHzJx.exe
  C:\Windows\System32\vzRHzJx.exe
  2⤵
  PID:11648
- C:\Windows\System32\aPHMTnv.exe
  C:\Windows\System32\aPHMTnv.exe
  2⤵
  PID:11684
- C:\Windows\System32\zPXxwuS.exe
  C:\Windows\System32\zPXxwuS.exe
  2⤵
  PID:11712
- C:\Windows\System32\PKxmrpd.exe
  C:\Windows\System32\PKxmrpd.exe
  2⤵
  PID:11728
- C:\Windows\System32\tJPZeLL.exe
  C:\Windows\System32\tJPZeLL.exe
  2⤵
  PID:11756
- C:\Windows\System32\dYgttsM.exe
  C:\Windows\System32\dYgttsM.exe
  2⤵
  PID:11792
- C:\Windows\System32\ZywYRDI.exe
  C:\Windows\System32\ZywYRDI.exe
  2⤵
  PID:12012
- C:\Windows\System32\OPnNFLV.exe
  C:\Windows\System32\OPnNFLV.exe
  2⤵
  PID:12040
- C:\Windows\System32\EdoHkkA.exe
  C:\Windows\System32\EdoHkkA.exe
  2⤵
  PID:12084
- C:\Windows\System32\dJuVkHN.exe
  C:\Windows\System32\dJuVkHN.exe
  2⤵
  PID:12108
- C:\Windows\System32\LeBZcss.exe
  C:\Windows\System32\LeBZcss.exe
  2⤵
  PID:12144
- C:\Windows\System32\LXvtXMP.exe
  C:\Windows\System32\LXvtXMP.exe
  2⤵
  PID:12160
- C:\Windows\System32\afkneeA.exe
  C:\Windows\System32\afkneeA.exe
  2⤵
  PID:12184
- C:\Windows\System32\tHVkQZn.exe
  C:\Windows\System32\tHVkQZn.exe
  2⤵
  PID:12220
- C:\Windows\System32\WWdRdUm.exe
  C:\Windows\System32\WWdRdUm.exe
  2⤵
  PID:12252
- C:\Windows\System32\ZrrnSox.exe
  C:\Windows\System32\ZrrnSox.exe
  2⤵
  PID:11032
- C:\Windows\System32\knzPcpV.exe
  C:\Windows\System32\knzPcpV.exe
  2⤵
  PID:11332
- C:\Windows\System32\umrumTz.exe
  C:\Windows\System32\umrumTz.exe
  2⤵
  PID:11396
- C:\Windows\System32\UOSCmnq.exe
  C:\Windows\System32\UOSCmnq.exe
  2⤵
  PID:11476
- C:\Windows\System32\bMaioFQ.exe
  C:\Windows\System32\bMaioFQ.exe
  2⤵
  PID:11592
- C:\Windows\System32\qLlmEGB.exe
  C:\Windows\System32\qLlmEGB.exe
  2⤵
  PID:11660
- C:\Windows\System32\HAajAOx.exe
  C:\Windows\System32\HAajAOx.exe
  2⤵
  PID:11748
- C:\Windows\System32\IqPKllM.exe
  C:\Windows\System32\IqPKllM.exe
  2⤵
  PID:11788
- C:\Windows\System32\CusIvQA.exe
  C:\Windows\System32\CusIvQA.exe
  2⤵
  PID:11860
- C:\Windows\System32\ytwQhor.exe
  C:\Windows\System32\ytwQhor.exe
  2⤵
  PID:11920
- C:\Windows\System32\lmwVSdx.exe
  C:\Windows\System32\lmwVSdx.exe
  2⤵
  PID:11972
- C:\Windows\System32\zhPnIia.exe
  C:\Windows\System32\zhPnIia.exe
  2⤵
  PID:11912
- C:\Windows\System32\EAbsXPf.exe
  C:\Windows\System32\EAbsXPf.exe
  2⤵
  PID:11940
- C:\Windows\System32\DRrgKNQ.exe
  C:\Windows\System32\DRrgKNQ.exe
  2⤵
  PID:11872
- C:\Windows\System32\oHNhgur.exe
  C:\Windows\System32\oHNhgur.exe
  2⤵
  PID:11956
- C:\Windows\System32\FnpUtQL.exe
  C:\Windows\System32\FnpUtQL.exe
  2⤵
  PID:12056
- C:\Windows\System32\wSSngah.exe
  C:\Windows\System32\wSSngah.exe
  2⤵
  PID:12120
- C:\Windows\System32\moMdtME.exe
  C:\Windows\System32\moMdtME.exe
  2⤵
  PID:12196
- C:\Windows\System32\vBPQgil.exe
  C:\Windows\System32\vBPQgil.exe
  2⤵
  PID:12280
- C:\Windows\System32\OLHknDj.exe
  C:\Windows\System32\OLHknDj.exe
  2⤵
  PID:11448
- C:\Windows\System32\tzQTBIt.exe
  C:\Windows\System32\tzQTBIt.exe
  2⤵
  PID:11564
- C:\Windows\System32\KtGPPlN.exe
  C:\Windows\System32\KtGPPlN.exe
  2⤵
  PID:11696
- C:\Windows\System32\BQaRPwx.exe
  C:\Windows\System32\BQaRPwx.exe
  2⤵
  PID:11808
- C:\Windows\System32\usCASda.exe
  C:\Windows\System32\usCASda.exe
  2⤵
  PID:11820
- C:\Windows\System32\eXqIQLP.exe
  C:\Windows\System32\eXqIQLP.exe
  2⤵
  PID:11948
- C:\Windows\System32\rNPVoEF.exe
  C:\Windows\System32\rNPVoEF.exe
  2⤵
  PID:11980
- C:\Windows\System32\bZPQqww.exe
  C:\Windows\System32\bZPQqww.exe
  2⤵
  PID:12152
- C:\Windows\System32\dBzYZtU.exe
  C:\Windows\System32\dBzYZtU.exe
  2⤵
  PID:11308
- C:\Windows\System32\MFnbFzM.exe
  C:\Windows\System32\MFnbFzM.exe
  2⤵
  PID:12000
- C:\Windows\System32\irXtxKz.exe
  C:\Windows\System32\irXtxKz.exe
  2⤵
  PID:11908
- C:\Windows\System32\zdwibVv.exe
  C:\Windows\System32\zdwibVv.exe
  2⤵
  PID:11960
- C:\Windows\System32\NhRNSPR.exe
  C:\Windows\System32\NhRNSPR.exe
  2⤵
  PID:11364
- C:\Windows\System32\sHcYfpq.exe
  C:\Windows\System32\sHcYfpq.exe
  2⤵
  PID:12024
- C:\Windows\System32\XkehxqU.exe
  C:\Windows\System32\XkehxqU.exe
  2⤵
  PID:11904
- C:\Windows\System32\wtqnHxs.exe
  C:\Windows\System32\wtqnHxs.exe
  2⤵
  PID:12308
- C:\Windows\System32\YsAnRJe.exe
  C:\Windows\System32\YsAnRJe.exe
  2⤵
  PID:12340
- C:\Windows\System32\RuEPZAl.exe
  C:\Windows\System32\RuEPZAl.exe
  2⤵
  PID:12368
- C:\Windows\System32\dquonyH.exe
  C:\Windows\System32\dquonyH.exe
  2⤵
  PID:12396
- C:\Windows\System32\PWcHulL.exe
  C:\Windows\System32\PWcHulL.exe
  2⤵
  PID:12432
- C:\Windows\System32\FxtVVpn.exe
  C:\Windows\System32\FxtVVpn.exe
  2⤵
  PID:12460
- C:\Windows\System32\vggiGFh.exe
  C:\Windows\System32\vggiGFh.exe
  2⤵
  PID:12488
- C:\Windows\System32\KszzwSo.exe
  C:\Windows\System32\KszzwSo.exe
  2⤵
  PID:12504
- C:\Windows\System32\VlQnBYo.exe
  C:\Windows\System32\VlQnBYo.exe
  2⤵
  PID:12544
- C:\Windows\System32\BHrHZdM.exe
  C:\Windows\System32\BHrHZdM.exe
  2⤵
  PID:12560
- C:\Windows\System32\QBNIrkW.exe
  C:\Windows\System32\QBNIrkW.exe
  2⤵
  PID:12576
- C:\Windows\System32\LNbaRvm.exe
  C:\Windows\System32\LNbaRvm.exe
  2⤵
  PID:12596
- C:\Windows\System32\dnqrhmf.exe
  C:\Windows\System32\dnqrhmf.exe
  2⤵
  PID:12632
- C:\Windows\System32\uDWjjJc.exe
  C:\Windows\System32\uDWjjJc.exe
  2⤵
  PID:12692
- C:\Windows\System32\RAOqWka.exe
  C:\Windows\System32\RAOqWka.exe
  2⤵
  PID:12736
- C:\Windows\System32\iiHaCos.exe
  C:\Windows\System32\iiHaCos.exe
  2⤵
  PID:12768
- C:\Windows\System32\UuNMDgr.exe
  C:\Windows\System32\UuNMDgr.exe
  2⤵
  PID:12784
- C:\Windows\System32\eLeHEER.exe
  C:\Windows\System32\eLeHEER.exe
  2⤵
  PID:12848
- C:\Windows\System32\WmjwgmI.exe
  C:\Windows\System32\WmjwgmI.exe
  2⤵
  PID:12868
- C:\Windows\System32\fIaWsoU.exe
  C:\Windows\System32\fIaWsoU.exe
  2⤵
  PID:12896
- C:\Windows\System32\HFFhjIp.exe
  C:\Windows\System32\HFFhjIp.exe
  2⤵
  PID:12932
- C:\Windows\System32\qOOhBLj.exe
  C:\Windows\System32\qOOhBLj.exe
  2⤵
  PID:12952
- C:\Windows\System32\zSbnSnx.exe
  C:\Windows\System32\zSbnSnx.exe
  2⤵
  PID:12980
- C:\Windows\System32\xciCwIE.exe
  C:\Windows\System32\xciCwIE.exe
  2⤵
  PID:13020
- C:\Windows\System32\iMaPGOn.exe
  C:\Windows\System32\iMaPGOn.exe
  2⤵
  PID:13040
- C:\Windows\System32\zTAeshg.exe
  C:\Windows\System32\zTAeshg.exe
  2⤵
  PID:13068
- C:\Windows\System32\GFCTWxZ.exe
  C:\Windows\System32\GFCTWxZ.exe
  2⤵
  PID:13100
- C:\Windows\System32\jvBvxeU.exe
  C:\Windows\System32\jvBvxeU.exe
  2⤵
  PID:13120
- C:\Windows\System32\ojVVvys.exe
  C:\Windows\System32\ojVVvys.exe
  2⤵
  PID:13168
- C:\Windows\System32\CQiCvVL.exe
  C:\Windows\System32\CQiCvVL.exe
  2⤵
  PID:13196
- C:\Windows\System32\OqSIpey.exe
  C:\Windows\System32\OqSIpey.exe
  2⤵
  PID:13252
- C:\Windows\System32\mBKrzHn.exe
  C:\Windows\System32\mBKrzHn.exe
  2⤵
  PID:13276
- C:\Windows\System32\wUkKkUn.exe
  C:\Windows\System32\wUkKkUn.exe
  2⤵
  PID:12092
- C:\Windows\System32\qnujgUy.exe
  C:\Windows\System32\qnujgUy.exe
  2⤵
  PID:3064
- C:\Windows\System32\PSQmXwa.exe
  C:\Windows\System32\PSQmXwa.exe
  2⤵
  PID:12376
- C:\Windows\System32\KukpiYN.exe
  C:\Windows\System32\KukpiYN.exe
  2⤵
  PID:12444
- C:\Windows\System32\MqRWonv.exe
  C:\Windows\System32\MqRWonv.exe
  2⤵
  PID:12496
- C:\Windows\System32\DRFnEgT.exe
  C:\Windows\System32\DRFnEgT.exe
  2⤵
  PID:12532
- C:\Windows\System32\enpiyXE.exe
  C:\Windows\System32\enpiyXE.exe
  2⤵
  PID:12552
- C:\Windows\System32\SwDwOgi.exe
  C:\Windows\System32\SwDwOgi.exe
  2⤵
  PID:12616
- C:\Windows\System32\XFoMoJB.exe
  C:\Windows\System32\XFoMoJB.exe
  2⤵
  PID:12660
- C:\Windows\System32\AunzpxJ.exe
  C:\Windows\System32\AunzpxJ.exe
  2⤵
  PID:12716
- C:\Windows\System32\LWYxkJx.exe
  C:\Windows\System32\LWYxkJx.exe
  2⤵
  PID:11768
- C:\Windows\System32\ujArOXj.exe
  C:\Windows\System32\ujArOXj.exe
  2⤵
  PID:12912
- C:\Windows\System32\UBLtuRC.exe
  C:\Windows\System32\UBLtuRC.exe
  2⤵
  PID:13016
- C:\Windows\System32\eDKIrTm.exe
  C:\Windows\System32\eDKIrTm.exe
  2⤵
  PID:13028
- C:\Windows\System32\MimaUSN.exe
  C:\Windows\System32\MimaUSN.exe
  2⤵
  PID:13136
- C:\Windows\System32\jLNCOLu.exe
  C:\Windows\System32\jLNCOLu.exe
  2⤵
  PID:13288
- C:\Windows\System32\MtMfTFY.exe
  C:\Windows\System32\MtMfTFY.exe
  2⤵
  PID:13304
- C:\Windows\System32\VFPyVsR.exe
  C:\Windows\System32\VFPyVsR.exe
  2⤵
  PID:12392
- C:\Windows\System32\EwnsmvK.exe
  C:\Windows\System32\EwnsmvK.exe
  2⤵
  PID:12500
- C:\Windows\System32\FOCBfuB.exe
  C:\Windows\System32\FOCBfuB.exe
  2⤵
  PID:12620
- C:\Windows\System32\kZsbsop.exe
  C:\Windows\System32\kZsbsop.exe
  2⤵
  PID:12644
- C:\Windows\System32\gPesEOA.exe
  C:\Windows\System32\gPesEOA.exe
  2⤵
  PID:12908
- C:\Windows\System32\YEyTGuh.exe
  C:\Windows\System32\YEyTGuh.exe
  2⤵
  PID:13092
- C:\Windows\System32\ANQUgPh.exe
  C:\Windows\System32\ANQUgPh.exe
  2⤵
  PID:12276
- C:\Windows\System32\JCQGZjM.exe
  C:\Windows\System32\JCQGZjM.exe
  2⤵
  PID:12672
- C:\Windows\System32\vCdUVQR.exe
  C:\Windows\System32\vCdUVQR.exe
  2⤵
  PID:12968
- C:\Windows\System32\QStbGQg.exe
  C:\Windows\System32\QStbGQg.exe
  2⤵
  PID:13240
- C:\Windows\System32\RLyUkPA.exe
  C:\Windows\System32\RLyUkPA.exe
  2⤵
  PID:11416
- C:\Windows\System32\VSzWGEp.exe
  C:\Windows\System32\VSzWGEp.exe
  2⤵
  PID:12452
- C:\Windows\System32\tRXCAif.exe
  C:\Windows\System32\tRXCAif.exe
  2⤵
  PID:13340
- C:\Windows\System32\HnhYShO.exe
  C:\Windows\System32\HnhYShO.exe
  2⤵
  PID:13368
- C:\Windows\System32\yxLGqBJ.exe
  C:\Windows\System32\yxLGqBJ.exe
  2⤵
  PID:13384
- C:\Windows\System32\ZkVeGoV.exe
  C:\Windows\System32\ZkVeGoV.exe
  2⤵
  PID:13416
- C:\Windows\System32\OXpxMEc.exe
  C:\Windows\System32\OXpxMEc.exe
  2⤵
  PID:13452
- C:\Windows\System32\ZqOeNuj.exe
  C:\Windows\System32\ZqOeNuj.exe
  2⤵
  PID:13484
- C:\Windows\System32\tDigSbB.exe
  C:\Windows\System32\tDigSbB.exe
  2⤵
  PID:13500
- C:\Windows\System32\WXAnlKw.exe
  C:\Windows\System32\WXAnlKw.exe
  2⤵
  PID:13528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AaBgqhu.exe

Filesize
2.6MB

MD5
ec53bb1dd58ad1a0ef4833f6f40640bc

SHA1
73e756668a77022254d56e6adb02c14bfeb9c4ca

SHA256
de88fa7095bc80b504d0380ee9ee0f3f9dcf4733fcb5b7b3feae692bb3cc3a66

SHA512
cbea181b29133761a1d583c9721122e6e7182eb5c80ec8cea4903223ac7b22bc7a3735de19ba7b427920eb42da70dd9c72009af3c86916f758aab665cd13f646

Download Submit
C:\Windows\System32\ChmCcjr.exe

Filesize
2.6MB

MD5
809b1b8f6b828afabd4458570edaef02

SHA1
d4c7882a9c77de559603020ee71d8f7016534667

SHA256
ce9be04ab77797c66254ffd8dbbe242d1863b00f8123911d81dc2ca8721ce8e1

SHA512
40186f24c6438638105dc71b4011fd52952c8ab97576e2d695313406c203b15de85108cf2d345fac88a8d23f6ef54805d2d0bbc1e0e425f249c3d18b570ae1ee

Download Submit
C:\Windows\System32\DiHMLeW.exe

Filesize
2.6MB

MD5
9f94d6a9836ddaa1e074257a2bb74173

SHA1
a9356b7b090a98d0cf43ed4ed8dc653a52a2e859

SHA256
5b54fbe00c3e7f010f2a246e7f2e2180ec7b5e21a2f75d8c202a08fe13a4ad8d

SHA512
875aaee866d4e9ee5f048a4f599b8849c8c10616eb09b34e3f762d19e7d448e28a8e23d068d14dad34d5b93f099250e32f49f89b566667f070524a7dc72fdf8b

Download Submit
C:\Windows\System32\GMLoHlR.exe

Filesize
2.6MB

MD5
666a174a6bc324d660c081b1f8ea5e7f

SHA1
4203db7df615b7ffdb3837c2a710a724a6d82b39

SHA256
f4b05d62154e21e086a868da3a2a49ea7983525e1fdaae612b5f5129aa42e978

SHA512
a9aa57c861f68a367090af9efe7d122be9d55684212e60701024d00553b449029c439955b88baf2f880e71c0552ef5676f267c1d1a01292901b181d69e7ecb4e

Download Submit
C:\Windows\System32\GfJBukR.exe

Filesize
2.6MB

MD5
989d2216a895e93bd683ab561456ef1a

SHA1
8b285b9551b159128e5dcd39eab4851ed486f76a

SHA256
f8cf07b4d2c753568cfe8482c0cd6b7e9a5ac15fd56659bf939afe164b53d327

SHA512
4269bcbccd0e18d8a5242814b6c1b9b79583620ffacd37ffdfb292155e8dfa39e7d47ff9ef3a95d0384214501e14fc4b5e8b846c5cd0dc6afc63fc5043ae022d

Download Submit
C:\Windows\System32\ITAgCkV.exe

Filesize
2.6MB

MD5
adbb84b13764abdaa53ebb6d531cd5cb

SHA1
40549bbb997dbe9fcccdd6be0df06f1803f2a91a

SHA256
f50a2d5ebad5ca8916918d3f338c053a80d8c3ea4e0fff6ac5d8db88b1df4fab

SHA512
9ea028dd95a9718e2601ad6f745891978e7e79fb073cd9ced1346d9c3fc3d7eb18ce762bbacb96e3b4436b143dd4a330065540fd42189739ee85e4a4a616d9ad

Download Submit
C:\Windows\System32\JDRvHtC.exe

Filesize
2.6MB

MD5
4ba290e5e55f9e679fc9a36bbc1227d3

SHA1
3772e5bdf566205d1bd5fabc0c2460de4bc6697e

SHA256
786836c09bbaa848174c85845f940b6a3ccedb4609f10dbf4f5c77eaad71e75a

SHA512
5c7faf5c3c877630bda6cfa6d1bd90b71f3ca903ef6146bca4b52f9d60dd115be04e08e8fb4dfacb741627c784b8d87a6fcc112dfead5cd244d6c4368c86efbd

Download Submit
C:\Windows\System32\LNMoIaD.exe

Filesize
2.6MB

MD5
1f4601a4174f290ebff9e8614b2725d3

SHA1
f1a45e72de2c51539739c4a581e4e1007433e136

SHA256
2d72c03405dfcdd37432af5b1e69e2d1cf4b0de9d8e3f71f8a0389d68fd0046e

SHA512
5fc4500e3ac75eb46251a12d6db94f40051dfabf9f59a83fb0a1bda77ea5b0087043506553ffed0f4f2210eb7718828f7f0543a178439e5e14a96e7aa651da77

Download Submit
C:\Windows\System32\MSeErav.exe

Filesize
2.6MB

MD5
36b6a7cbfc6dd116ccd339b9501e048e

SHA1
45a419755e46c3003558d86b21bf737346be4c73

SHA256
b1d7289fc0bdcbd13e0f856ab6d22040562ec3ef8672fbf21ae525794d949c49

SHA512
ca48b0de94b93d4e273a96e9703e9754f4a00a2825b14d3ddb3abda11ae34b3de647fc3b43bd449a016a6802097097c40c3fb6b918c6b728a25c8739d039ab37

Download Submit
C:\Windows\System32\OgdaHvY.exe

Filesize
2.6MB

MD5
c1b3dcf61b19bc7b99a7ff691b3a28af

SHA1
bf94095d38a7913dd6f61ad40ecfe3afd6c8417f

SHA256
d882a9ae3c61f461a6543173d344653d1c2f8bfd0dff14cec1ed67a98ecc2439

SHA512
2ce225cd576510bd3ef5d2e8b02ab226d6065ae24fdfde4016aa6d2df91a64eb137b41154ba7f80249e8c2e5417aba13351a58d140a1f748d83c440db8f11cf8

Download Submit
C:\Windows\System32\PGtDCKm.exe

Filesize
2.6MB

MD5
37cd4ccea29356cc56a6d1beea9f1953

SHA1
20ddcbd57311272eb9ae2b60e62a826f74719be2

SHA256
cea513152cb052188d3755395e6a4dac3071924b34685a78d61d7759e58b0648

SHA512
7a00b567ace767f81f2cc89b8759321f867b20f028e80f8e82a4391866b73ee51048be822692a3baead801f6fdd849cfdd5ef5999baed87b036c3baefbf86b1d

Download Submit
C:\Windows\System32\SQEOVPL.exe

Filesize
2.6MB

MD5
1421473ce1eb30e65b57f04b31c942a1

SHA1
0be40afc5bdfd7e27fb5bd283d1480a0fafb2336

SHA256
35711e268050ac3fd4dd7fce3d37adc9cb1668ef7b9342fd2472b5176a9461dd

SHA512
5b41cf75c3328fac6715629f62abf2626f7061ecf12c63f3e72deaa85c9185c06b8fd0cc4257ddd333dc14e1f2348cfa5947ee8c5d51f7d82247250cc2665f2f

Download Submit
C:\Windows\System32\UgNuSqD.exe

Filesize
2.6MB

MD5
310f7715a388d567b5b7915e3a2f516c

SHA1
77df3f8d651b4e9fad3ba8447245a36ae6ebf89c

SHA256
3d20049d651043661b0ea14d6a86c2cfcc90c8e4e07b758bae0ad6e49cf64100

SHA512
7a7c710e25552379984088baec2f6365c86f7f82175f8775150818ae4b70708cf28e23d165353ccfdd58e80e1ef14eefdddbd87059a0484fe40324649e686353

Download Submit
C:\Windows\System32\VBdwgts.exe

Filesize
2.6MB

MD5
54d6b6b463211d41d47772c7cd34a008

SHA1
2360100e4d5457be13f02174fd64128810459187

SHA256
e5c08273446610c5d7650f821dbeda716ab66b411c52754b0c2c53813f05207b

SHA512
916dc782b0e871c8970cca9b3db5cecad0898caad29ea6fd72e4921d20eb710575a3b91b404a0f340aa89d7164c2d33c572f59788a5e2353d0d091a7a4be8a64

Download Submit
C:\Windows\System32\WitWuCo.exe

Filesize
2.6MB

MD5
18e9d3434952ab52cd3b20b83eb8b9e2

SHA1
12bf16327cc297cb35927ecde94cd62d271e5fe7

SHA256
a622783ec0d42a2d627c42131de9b9f585dc4b1bc2ff2ebcdd3990aac4ecd1cf

SHA512
86d983df0d7838447dd25cde8d69b1fde8368197cbb71c73a5c33220d9551d457af948b2b68719762eaffbf81d3691cb4b0675033db9a8b1e1a7a972efefb27d

Download Submit
C:\Windows\System32\cxOexcs.exe

Filesize
2.6MB

MD5
eb79cb8a038c1cfdfcba84c322d9a830

SHA1
d238b0ebbd9a945ea0ca875900ed60d3aa790481

SHA256
67a13a00da75eb152b6534e455a596c0e4c962ccfddf89ba62f0a2eced53f0d7

SHA512
d5b50f226bac23c3064b41dee71533059b63a9d389d4664f1ee01534e0c6d0ebda6cfa3c1de0797168f3f978e9e33297edaa58f62c0f8d719b4c8e17e2b0351c

Download Submit
C:\Windows\System32\fIPJccu.exe

Filesize
2.6MB

MD5
002e3d65c189a99e166c90847fa6b308

SHA1
9e305e1be78b84542cd120bfb4bc2213b8b3d8eb

SHA256
47c6d8950679ef1d92f06cdd7b5bde4aefcce7e3c685ea5ae486bd71677cca5f

SHA512
543630f6ffaa07b595cc6d4c589b3b7a6991b4f022c80ebc205e22ebf663429ab6a5e7b173d9219c9bb5fc6a9aa17d0ba42a9fb0dfb038715954a5d5f0e32761

Download Submit
C:\Windows\System32\gAdPgTj.exe

Filesize
2.6MB

MD5
4ef223a9c9829bf86ce9e0b28f99843b

SHA1
6025ae99094f7dc7222ff4ef9106cc6785147b22

SHA256
d6f0b13f9b139bb3aa30d8518a00c3def5c3fb10008a7c2b95de9892982232c8

SHA512
7d79efdec69ce83e6bc3d242ffe2847fb327c513ee99daf167b39e36683b63e874ef8fc3e01b21d22f89bfc7db02d6bc47a85e9b2b1d6f192a5f4612ddea283c

Download Submit
C:\Windows\System32\gZwpCZi.exe

Filesize
2.6MB

MD5
68644d6c00ce86ca5cddb926fd956573

SHA1
77783b14cd35bbd3e70f24fd17ed508487a83463

SHA256
f6d62090c5d3ce0490502f39059d9538dd3878126f3a94eb4ba913a4ddc0e967

SHA512
105ca88417cf6acab19678f18cbf791496d903242f386d00e6235cc44c0b3465433703a84ff0d6dc327875559503bd818ca353bfc0f16b5fd20c52b8b36db31d

Download Submit
C:\Windows\System32\jCkPUuX.exe

Filesize
2.6MB

MD5
ce87fd2eae461e8f7c215fc390e5c5d3

SHA1
2269c449e1eb076d66a392d425f114ee0806faeb

SHA256
21cf97964db2a4e8f0b2fff029229884ef8ec6da5bab619de25b9a79e777f9df

SHA512
bfb73036e3d70e8a3de405cbc8c56d623452d9e19da542c7a2299cbd71f6f8309e83b9b3867c2899a7c8afe39f9bc53c4ed38f0f244fb12598776ab1f073646e

Download Submit
C:\Windows\System32\kSAiFik.exe

Filesize
2.6MB

MD5
a2e0e471e93f1ad6739faf916b16258a

SHA1
dca30d810baaa916c0fa5e566377a754c2b4fc6d

SHA256
058011d56b2d96ea46c5613a5d0da2c5c6a7e651b0d1a771e8808db53fa1e3d2

SHA512
07872765c7238fab175a01222954c4c183878aeeb4fc0b8df9c9022cece992bda44970c54e371f8e358af6b656401b7e8495cab6b1aa548fd50940ce9b7bd4e7

Download Submit
C:\Windows\System32\lMvsgFt.exe

Filesize
2.6MB

MD5
e1a50d70accd5f468e556b7786b3f65e

SHA1
47d3b21dce0b6725d18db0ba234bcfd18ac8b10a

SHA256
e7c06883f9aef37b8f6a24a71ac78b6d3eee8a3d2f3a78c0122d2a829e661fce

SHA512
8b9409dbdffe9c2120a21efab3b2be877e53df25c77642c4ab65f9333bf548f8bedf7a504caa878ee39053fd1f71d723ac57a8ba56bbc02de552c985552d2a9a

Download Submit
C:\Windows\System32\mdkDEad.exe

Filesize
2.6MB

MD5
1b68f51af0b3026d29c3ec40df5c16c2

SHA1
7b26ba768040a6c4ea25322cc93ce14ee37d4b6e

SHA256
15fd9946a5f6c3c6fac45331621c7858732d4ed4f74a3f6ad36f93490e0574b9

SHA512
5a3a3c2f77c6b21609a0240b126ba5830cef5c69c3a69fa74a8626efe540ca0bf74e13db6ab541aded24720cf634b6ea79a8ea45c1ee7a1a3e098f80e726dbc0

Download Submit
C:\Windows\System32\nggSqqy.exe

Filesize
2.6MB

MD5
dc05129a30cffa9a9acc93bbfe8cecb6

SHA1
a1233616a8483a2d443919ed90eebf6ef72bf337

SHA256
e7696b7d7d3c8cc8a30b7573e9929fe662e20689895ffe30f4e9fa538eb2ee02

SHA512
3e20f2322899ef52e5e123e54b077f8c9d7e1d796d48af03122b65ee60f6f7decbab62044d64c88e160e3cfedbda5b6d8949c661171f298396788334dbd230c6

Download Submit
C:\Windows\System32\noDQGLf.exe

Filesize
2.6MB

MD5
e56b434d5be3ad56dab948a6fdcb7d38

SHA1
4a54a50b3c090bfcc9b9e3b341efa01e7d800bee

SHA256
33fe7cf431e2d9908c4747b4b535140094b95e2b20d1df9c23889e380d7f883a

SHA512
aa0b62e7ddf3aa58451c1f35c8fdf71e4770facefcf9fe952955c2ff3dd5e93d7704c2a9099a2c0ddf8b4dc337aa21ce96611137a556577cb1b0042275918a95

Download Submit
C:\Windows\System32\pSiOAfp.exe

Filesize
2.6MB

MD5
45aa4047746c6c582ab216ba9588a210

SHA1
356022821c6ca4fce0e5f496797ed228f19448c5

SHA256
ccdee00f3e4c5ec4e170d3bb6418222cbe392d8b78a1f4579cde718e2b3c4c1d

SHA512
e36d812527da511cb345e71bb9d8258ca15de68ce8f413a39b037566de87529472db6900bea34f59b7a47767e590f4b470e6e08277abed82be44ef0eafc2831e

Download Submit
C:\Windows\System32\qwdAXZe.exe

Filesize
2.6MB

MD5
f4239e54746be852de75eeb338a126cf

SHA1
1b2617184f306127865e293206086aed21d56413

SHA256
522f6ec2473ac8cebdc940e552f80b2f59370d7e8845578db7d62413e76ebed9

SHA512
385e35ee49fe087383264f18705d23214fa8fc2bd1a47f44d96ef872b6dfa5cde9078efc6e467c3f11305b3139464f3435b9c632b15df2400f56473dab8a10e7

Download Submit
C:\Windows\System32\rWZinah.exe

Filesize
2.6MB

MD5
3d95d7e04e6f2648fdc339554d936963

SHA1
67da1583269beeaed28305e51558b3e1d97ce6c5

SHA256
64261c0c73316dee62ec06f8bc3147bb0e7799294013ee99d49fd008950a1b42

SHA512
fe3b0f736672d6f18f94c7c032ab438fad000faa4f2f6f1c2f9bd8ab30499d91d1a5803412d6f4a69f16ec989717afe4176a509670e0d541921303d8a5e43c05

Download Submit
C:\Windows\System32\teiYvNm.exe

Filesize
2.6MB

MD5
2a122a6460387126d8fa1a4a9d265683

SHA1
67a8e563b1eadbe87b24c7cb318b84539787383b

SHA256
cacef11de238d949b4473e12a3aee8c88d78d22d179fbe583731b483a036f697

SHA512
2cc750c464538136c78d4f07d206fdd138372626b265d1b6a32568b0c70a758aab902dfee453910acb2000d7cc7c3b9539a44d98bb7dde22add93557521d91cb

Download Submit
C:\Windows\System32\vYrVviR.exe

Filesize
2.6MB

MD5
53959c63609e86bc5a23d1856e00cff0

SHA1
28bd43b44b8e5aaaeb3d73cfb5d26db85d6fb01c

SHA256
e54340da7f7561de800d86364d2956f03101ab06894488ccc4cbf08b8f37f3b8

SHA512
5688027587da1a3ab5ce6eb0e47470fcff08d8c9535a86601914d5239f06fde3ae94e17b3dd0c3ef7000617e0fa62130b2bc45de7c68ba880630100044511d38

Download Submit
C:\Windows\System32\xHAuhho.exe

Filesize
2.6MB

MD5
67f7fc3da54a0fe6d66a1c8c73865bb5

SHA1
f74a5bebbcf875eaca8e45787594884149f65f57

SHA256
6b65615c1fd21fbf58de65a949aca361b92c4bc33589cc7f4c6d25825b1c9d19

SHA512
069156af6edb1cea207ec24774eb7be94783829109cecac3b987b5b052e2a088fb4cf32a40be5b7f03dbbd449bb6f02576744b6beea9763116eb3f5c1b53d076

Download Submit
C:\Windows\System32\xKoxhqy.exe

Filesize
2.6MB

MD5
bfebe6f75e1dd3940300f3350833c42d

SHA1
63d3be7c3c9b7c2d31143855f0c8207a8e205335

SHA256
4cbfc17432aaa70227a5b765223fe3508cead073679008bb11b7edbe6d6081eb

SHA512
3a935264026d043e00ed9cd3ca9d2c2b92ec53b9608077a4eabd5fe04095ad9a70c92eae47f40a7ad913b8698fdae6b7d272318ae5263cd1b229eaae2577a739

Download Submit
memory/216-466-0x00007FF795D40000-0x00007FF796135000-memory.dmp

Filesize
4.0MB

Download
memory/216-1884-0x00007FF795D40000-0x00007FF796135000-memory.dmp

Filesize
4.0MB

Download
memory/336-484-0x00007FF6AB8F0000-0x00007FF6ABCE5000-memory.dmp

Filesize
4.0MB

Download
memory/336-1893-0x00007FF6AB8F0000-0x00007FF6ABCE5000-memory.dmp

Filesize
4.0MB

Download
memory/540-1876-0x00007FF6816D0000-0x00007FF681AC5000-memory.dmp

Filesize
4.0MB

Download
memory/540-25-0x00007FF6816D0000-0x00007FF681AC5000-memory.dmp

Filesize
4.0MB

Download
memory/548-1877-0x00007FF687050000-0x00007FF687445000-memory.dmp

Filesize
4.0MB

Download
memory/548-28-0x00007FF687050000-0x00007FF687445000-memory.dmp

Filesize
4.0MB

Download
memory/1032-19-0x00007FF7FC7E0000-0x00007FF7FCBD5000-memory.dmp

Filesize
4.0MB

Download
memory/1032-1874-0x00007FF7FC7E0000-0x00007FF7FCBD5000-memory.dmp

Filesize
4.0MB

Download
memory/1196-1888-0x00007FF674040000-0x00007FF674435000-memory.dmp

Filesize
4.0MB

Download
memory/1196-468-0x00007FF674040000-0x00007FF674435000-memory.dmp

Filesize
4.0MB

Download
memory/1292-1885-0x00007FF71F8C0000-0x00007FF71FCB5000-memory.dmp

Filesize
4.0MB

Download
memory/1292-467-0x00007FF71F8C0000-0x00007FF71FCB5000-memory.dmp

Filesize
4.0MB

Download
memory/1392-1871-0x00007FF7CD290000-0x00007FF7CD685000-memory.dmp

Filesize
4.0MB

Download
memory/1392-1882-0x00007FF7CD290000-0x00007FF7CD685000-memory.dmp

Filesize
4.0MB

Download
memory/1392-57-0x00007FF7CD290000-0x00007FF7CD685000-memory.dmp

Filesize
4.0MB

Download
memory/1448-1891-0x00007FF6433F0000-0x00007FF6437E5000-memory.dmp

Filesize
4.0MB

Download
memory/1448-489-0x00007FF6433F0000-0x00007FF6437E5000-memory.dmp

Filesize
4.0MB

Download
memory/1452-1881-0x00007FF73D860000-0x00007FF73DC55000-memory.dmp

Filesize
4.0MB

Download
memory/1452-56-0x00007FF73D860000-0x00007FF73DC55000-memory.dmp

Filesize
4.0MB

Download
memory/1500-1887-0x00007FF615A00000-0x00007FF615DF5000-memory.dmp

Filesize
4.0MB

Download
memory/1500-470-0x00007FF615A00000-0x00007FF615DF5000-memory.dmp

Filesize
4.0MB

Download
memory/1520-1886-0x00007FF676A60000-0x00007FF676E55000-memory.dmp

Filesize
4.0MB

Download
memory/1520-469-0x00007FF676A60000-0x00007FF676E55000-memory.dmp

Filesize
4.0MB

Download
memory/1672-491-0x00007FF69D420000-0x00007FF69D815000-memory.dmp

Filesize
4.0MB

Download
memory/1672-1895-0x00007FF69D420000-0x00007FF69D815000-memory.dmp

Filesize
4.0MB

Download
memory/2212-52-0x00007FF7B0030000-0x00007FF7B0425000-memory.dmp

Filesize
4.0MB

Download
memory/2212-1880-0x00007FF7B0030000-0x00007FF7B0425000-memory.dmp

Filesize
4.0MB

Download
memory/2632-480-0x00007FF62F7A0000-0x00007FF62FB95000-memory.dmp

Filesize
4.0MB

Download
memory/2632-1894-0x00007FF62F7A0000-0x00007FF62FB95000-memory.dmp

Filesize
4.0MB

Download
memory/2756-54-0x00007FF6505B0000-0x00007FF6509A5000-memory.dmp

Filesize
4.0MB

Download
memory/2756-1879-0x00007FF6505B0000-0x00007FF6509A5000-memory.dmp

Filesize
4.0MB

Download
memory/2948-9-0x00007FF620410000-0x00007FF620805000-memory.dmp

Filesize
4.0MB

Download
memory/2948-1483-0x00007FF620410000-0x00007FF620805000-memory.dmp

Filesize
4.0MB

Download
memory/2948-1875-0x00007FF620410000-0x00007FF620805000-memory.dmp

Filesize
4.0MB

Download
memory/3308-1878-0x00007FF7D44E0000-0x00007FF7D48D5000-memory.dmp

Filesize
4.0MB

Download
memory/3308-1870-0x00007FF7D44E0000-0x00007FF7D48D5000-memory.dmp

Filesize
4.0MB

Download
memory/3308-32-0x00007FF7D44E0000-0x00007FF7D48D5000-memory.dmp

Filesize
4.0MB

Download
memory/4436-1890-0x00007FF6A0550000-0x00007FF6A0945000-memory.dmp

Filesize
4.0MB

Download
memory/4436-472-0x00007FF6A0550000-0x00007FF6A0945000-memory.dmp

Filesize
4.0MB

Download
memory/4552-1897-0x00007FF624200000-0x00007FF6245F5000-memory.dmp

Filesize
4.0MB

Download
memory/4552-473-0x00007FF624200000-0x00007FF6245F5000-memory.dmp

Filesize
4.0MB

Download
memory/4596-477-0x00007FF7764E0000-0x00007FF7768D5000-memory.dmp

Filesize
4.0MB

Download
memory/4596-1896-0x00007FF7764E0000-0x00007FF7768D5000-memory.dmp

Filesize
4.0MB

Download
memory/4780-0-0x00007FF7855D0000-0x00007FF7859C5000-memory.dmp

Filesize
4.0MB

Download
memory/4780-1143-0x00007FF7855D0000-0x00007FF7859C5000-memory.dmp

Filesize
4.0MB

Download
memory/4780-1-0x000001D7BB590000-0x000001D7BB5A0000-memory.dmp

Filesize
64KB

Download
memory/4780-1873-0x00007FF7855D0000-0x00007FF7859C5000-memory.dmp

Filesize
4.0MB

Download
memory/4880-486-0x00007FF6FF460000-0x00007FF6FF855000-memory.dmp

Filesize
4.0MB

Download
memory/4880-1892-0x00007FF6FF460000-0x00007FF6FF855000-memory.dmp

Filesize
4.0MB

Download
memory/4948-60-0x00007FF734E70000-0x00007FF735265000-memory.dmp

Filesize
4.0MB

Download
memory/4948-1883-0x00007FF734E70000-0x00007FF735265000-memory.dmp

Filesize
4.0MB

Download
memory/4948-1872-0x00007FF734E70000-0x00007FF735265000-memory.dmp

Filesize
4.0MB

Download
memory/5104-1889-0x00007FF661890000-0x00007FF661C85000-memory.dmp

Filesize
4.0MB

Download
memory/5104-471-0x00007FF661890000-0x00007FF661C85000-memory.dmp

Filesize
4.0MB

Download