xmrig | 61a389bb4bf1a9a303a3a87b3834a66f9890e71efe0985a2c75dee87fbe3682f

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
Size

2.1MB
MD5

846a04c1a685134ccedbd0aa99258700
SHA1

e0b82c3abd939b2d3af66637312550a8f9fc4482
SHA256

61a389bb4bf1a9a303a3a87b3834a66f9890e71efe0985a2c75dee87fbe3682f
SHA512

d9b3f9a4eca7fd1ca1ae7e7d513b6259035b303d823245a66d1883fd1cd028f521d4ae52132b58871874582523dd1c95a78fcd73cfabca358ce53caea7ba1d98
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXGvAnCumIj:BemTLkNdfE0pZr1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1612-0-0x00007FF7DA120000-0x00007FF7DA474000-memory.dmp	xmrig
behavioral2/files/0x0007000000023278-5.dat	xmrig
behavioral2/files/0x00080000000233b9-11.dat	xmrig
behavioral2/files/0x00070000000233bb-20.dat	xmrig
behavioral2/memory/3876-23-0x00007FF720DA0000-0x00007FF7210F4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233bc-28.dat	xmrig
behavioral2/files/0x00070000000233bd-34.dat	xmrig
behavioral2/memory/2064-48-0x00007FF6679C0000-0x00007FF667D14000-memory.dmp	xmrig
behavioral2/memory/232-52-0x00007FF654380000-0x00007FF6546D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233c0-57.dat	xmrig
behavioral2/files/0x00070000000233c3-68.dat	xmrig
behavioral2/files/0x00070000000233c5-78.dat	xmrig
behavioral2/files/0x00070000000233c6-87.dat	xmrig
behavioral2/files/0x00070000000233ca-103.dat	xmrig
behavioral2/files/0x00070000000233cc-116.dat	xmrig
behavioral2/files/0x00070000000233d3-152.dat	xmrig
behavioral2/memory/2652-777-0x00007FF7697C0000-0x00007FF769B14000-memory.dmp	xmrig
behavioral2/memory/3140-778-0x00007FF669AA0000-0x00007FF669DF4000-memory.dmp	xmrig
behavioral2/memory/868-779-0x00007FF7D41A0000-0x00007FF7D44F4000-memory.dmp	xmrig
behavioral2/memory/3136-780-0x00007FF67D9C0000-0x00007FF67DD14000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d8-171.dat	xmrig
behavioral2/files/0x00070000000233d6-167.dat	xmrig
behavioral2/files/0x00070000000233d7-166.dat	xmrig
behavioral2/files/0x00070000000233d5-162.dat	xmrig
behavioral2/files/0x00070000000233d4-156.dat	xmrig
behavioral2/files/0x00070000000233d2-146.dat	xmrig
behavioral2/files/0x00070000000233d1-142.dat	xmrig
behavioral2/files/0x00070000000233d0-137.dat	xmrig
behavioral2/files/0x00070000000233cf-132.dat	xmrig
behavioral2/files/0x00070000000233ce-126.dat	xmrig
behavioral2/files/0x00070000000233cd-122.dat	xmrig
behavioral2/files/0x00070000000233cb-112.dat	xmrig
behavioral2/files/0x00070000000233c9-101.dat	xmrig
behavioral2/files/0x00070000000233c8-97.dat	xmrig
behavioral2/files/0x00070000000233c7-92.dat	xmrig
behavioral2/files/0x00070000000233c4-76.dat	xmrig
behavioral2/files/0x00070000000233c2-66.dat	xmrig
behavioral2/files/0x00070000000233c1-62.dat	xmrig
behavioral2/memory/3424-49-0x00007FF7291D0000-0x00007FF729524000-memory.dmp	xmrig
behavioral2/files/0x00070000000233bf-45.dat	xmrig
behavioral2/files/0x00070000000233be-44.dat	xmrig
behavioral2/memory/2896-42-0x00007FF635C50000-0x00007FF635FA4000-memory.dmp	xmrig
behavioral2/memory/4200-32-0x00007FF7F5D90000-0x00007FF7F60E4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ba-21.dat	xmrig
behavioral2/memory/3616-16-0x00007FF7AF400000-0x00007FF7AF754000-memory.dmp	xmrig
behavioral2/memory/3496-10-0x00007FF698470000-0x00007FF6987C4000-memory.dmp	xmrig
behavioral2/memory/4064-781-0x00007FF7B5B40000-0x00007FF7B5E94000-memory.dmp	xmrig
behavioral2/memory/2164-782-0x00007FF7E2BC0000-0x00007FF7E2F14000-memory.dmp	xmrig
behavioral2/memory/2480-783-0x00007FF714E30000-0x00007FF715184000-memory.dmp	xmrig
behavioral2/memory/5056-784-0x00007FF77BA80000-0x00007FF77BDD4000-memory.dmp	xmrig
behavioral2/memory/2564-785-0x00007FF78C170000-0x00007FF78C4C4000-memory.dmp	xmrig
behavioral2/memory/2796-797-0x00007FF6A9940000-0x00007FF6A9C94000-memory.dmp	xmrig
behavioral2/memory/3040-806-0x00007FF760550000-0x00007FF7608A4000-memory.dmp	xmrig
behavioral2/memory/2968-801-0x00007FF756300000-0x00007FF756654000-memory.dmp	xmrig
behavioral2/memory/3116-818-0x00007FF74C330000-0x00007FF74C684000-memory.dmp	xmrig
behavioral2/memory/2240-823-0x00007FF70F0A0000-0x00007FF70F3F4000-memory.dmp	xmrig
behavioral2/memory/3864-828-0x00007FF7328F0000-0x00007FF732C44000-memory.dmp	xmrig
behavioral2/memory/2924-836-0x00007FF6937B0000-0x00007FF693B04000-memory.dmp	xmrig
behavioral2/memory/3036-844-0x00007FF6CB4E0000-0x00007FF6CB834000-memory.dmp	xmrig
behavioral2/memory/4092-849-0x00007FF6811C0000-0x00007FF681514000-memory.dmp	xmrig
behavioral2/memory/916-845-0x00007FF6D4590000-0x00007FF6D48E4000-memory.dmp	xmrig
behavioral2/memory/1080-833-0x00007FF7B5F10000-0x00007FF7B6264000-memory.dmp	xmrig
behavioral2/memory/4524-829-0x00007FF6A3AD0000-0x00007FF6A3E24000-memory.dmp	xmrig
behavioral2/memory/1612-2117-0x00007FF7DA120000-0x00007FF7DA474000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3496	SxZOgHs.exe
3616	FLmjIKc.exe
3876	TZQTFtG.exe
4200	UZXAuEu.exe
2064	bTOyivW.exe
2896	YXOJItZ.exe
3424	AkcETzB.exe
232	nzeQmIi.exe
2652	yCjwvpc.exe
3140	sHwKufO.exe
868	GgHPMJQ.exe
3136	CHsFnQr.exe
4064	MpAhiDj.exe
2164	PtYJJAj.exe
2480	QpOYuRL.exe
5056	PZgxHJU.exe
2564	Dmecozt.exe
2796	cZqDCcz.exe
2968	Jeutilv.exe
3040	JewGPYr.exe
3116	OYhoNSO.exe
2240	sfkQQMZ.exe
3864	KySjMXL.exe
4524	SEDhYZZ.exe
1080	xcONzLS.exe
2924	XEoDyPn.exe
3036	WAODnYQ.exe
916	eaksmOc.exe
4092	mzcrnLj.exe
880	jnblKeD.exe
2668	ZWAOGJM.exe
696	wtOdjNh.exe
2008	UczbpfC.exe
1472	jgJKtAO.exe
2088	LfYqPQu.exe
2576	JengOQY.exe
1020	lZuFWzk.exe
2228	DHNqTzk.exe
5104	nxhaLVG.exe
4924	mKSmFvA.exe
1152	ItpjWwp.exe
4796	kEKrxJn.exe
4540	kcdcMKm.exe
3672	sdnGmgi.exe
2980	TMdOvFO.exe
532	OTzmVjw.exe
5032	tlNmpEh.exe
4424	KOzDGTd.exe
444	VQDCBgI.exe
224	ivSDaqb.exe
4328	CPomUAC.exe
1640	UnYgoGr.exe
3988	LFiKnrm.exe
1488	knaGvUJ.exe
1280	htCtLRR.exe
4936	NgcKeTF.exe
404	eCGGgMe.exe
4988	cSyemhB.exe
1616	SBLeYQH.exe
4820	IQVkfUP.exe
3300	IPyyadI.exe
3128	LaeBOtK.exe
1036	KkjFdhI.exe
3416	CkFCMQQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1612-0-0x00007FF7DA120000-0x00007FF7DA474000-memory.dmp	upx
behavioral2/files/0x0007000000023278-5.dat	upx
behavioral2/files/0x00080000000233b9-11.dat	upx
behavioral2/files/0x00070000000233bb-20.dat	upx
behavioral2/memory/3876-23-0x00007FF720DA0000-0x00007FF7210F4000-memory.dmp	upx
behavioral2/files/0x00070000000233bc-28.dat	upx
behavioral2/files/0x00070000000233bd-34.dat	upx
behavioral2/memory/2064-48-0x00007FF6679C0000-0x00007FF667D14000-memory.dmp	upx
behavioral2/memory/232-52-0x00007FF654380000-0x00007FF6546D4000-memory.dmp	upx
behavioral2/files/0x00070000000233c0-57.dat	upx
behavioral2/files/0x00070000000233c3-68.dat	upx
behavioral2/files/0x00070000000233c5-78.dat	upx
behavioral2/files/0x00070000000233c6-87.dat	upx
behavioral2/files/0x00070000000233ca-103.dat	upx
behavioral2/files/0x00070000000233cc-116.dat	upx
behavioral2/files/0x00070000000233d3-152.dat	upx
behavioral2/memory/2652-777-0x00007FF7697C0000-0x00007FF769B14000-memory.dmp	upx
behavioral2/memory/3140-778-0x00007FF669AA0000-0x00007FF669DF4000-memory.dmp	upx
behavioral2/memory/868-779-0x00007FF7D41A0000-0x00007FF7D44F4000-memory.dmp	upx
behavioral2/memory/3136-780-0x00007FF67D9C0000-0x00007FF67DD14000-memory.dmp	upx
behavioral2/files/0x00070000000233d8-171.dat	upx
behavioral2/files/0x00070000000233d6-167.dat	upx
behavioral2/files/0x00070000000233d7-166.dat	upx
behavioral2/files/0x00070000000233d5-162.dat	upx
behavioral2/files/0x00070000000233d4-156.dat	upx
behavioral2/files/0x00070000000233d2-146.dat	upx
behavioral2/files/0x00070000000233d1-142.dat	upx
behavioral2/files/0x00070000000233d0-137.dat	upx
behavioral2/files/0x00070000000233cf-132.dat	upx
behavioral2/files/0x00070000000233ce-126.dat	upx
behavioral2/files/0x00070000000233cd-122.dat	upx
behavioral2/files/0x00070000000233cb-112.dat	upx
behavioral2/files/0x00070000000233c9-101.dat	upx
behavioral2/files/0x00070000000233c8-97.dat	upx
behavioral2/files/0x00070000000233c7-92.dat	upx
behavioral2/files/0x00070000000233c4-76.dat	upx
behavioral2/files/0x00070000000233c2-66.dat	upx
behavioral2/files/0x00070000000233c1-62.dat	upx
behavioral2/memory/3424-49-0x00007FF7291D0000-0x00007FF729524000-memory.dmp	upx
behavioral2/files/0x00070000000233bf-45.dat	upx
behavioral2/files/0x00070000000233be-44.dat	upx
behavioral2/memory/2896-42-0x00007FF635C50000-0x00007FF635FA4000-memory.dmp	upx
behavioral2/memory/4200-32-0x00007FF7F5D90000-0x00007FF7F60E4000-memory.dmp	upx
behavioral2/files/0x00070000000233ba-21.dat	upx
behavioral2/memory/3616-16-0x00007FF7AF400000-0x00007FF7AF754000-memory.dmp	upx
behavioral2/memory/3496-10-0x00007FF698470000-0x00007FF6987C4000-memory.dmp	upx
behavioral2/memory/4064-781-0x00007FF7B5B40000-0x00007FF7B5E94000-memory.dmp	upx
behavioral2/memory/2164-782-0x00007FF7E2BC0000-0x00007FF7E2F14000-memory.dmp	upx
behavioral2/memory/2480-783-0x00007FF714E30000-0x00007FF715184000-memory.dmp	upx
behavioral2/memory/5056-784-0x00007FF77BA80000-0x00007FF77BDD4000-memory.dmp	upx
behavioral2/memory/2564-785-0x00007FF78C170000-0x00007FF78C4C4000-memory.dmp	upx
behavioral2/memory/2796-797-0x00007FF6A9940000-0x00007FF6A9C94000-memory.dmp	upx
behavioral2/memory/3040-806-0x00007FF760550000-0x00007FF7608A4000-memory.dmp	upx
behavioral2/memory/2968-801-0x00007FF756300000-0x00007FF756654000-memory.dmp	upx
behavioral2/memory/3116-818-0x00007FF74C330000-0x00007FF74C684000-memory.dmp	upx
behavioral2/memory/2240-823-0x00007FF70F0A0000-0x00007FF70F3F4000-memory.dmp	upx
behavioral2/memory/3864-828-0x00007FF7328F0000-0x00007FF732C44000-memory.dmp	upx
behavioral2/memory/2924-836-0x00007FF6937B0000-0x00007FF693B04000-memory.dmp	upx
behavioral2/memory/3036-844-0x00007FF6CB4E0000-0x00007FF6CB834000-memory.dmp	upx
behavioral2/memory/4092-849-0x00007FF6811C0000-0x00007FF681514000-memory.dmp	upx
behavioral2/memory/916-845-0x00007FF6D4590000-0x00007FF6D48E4000-memory.dmp	upx
behavioral2/memory/1080-833-0x00007FF7B5F10000-0x00007FF7B6264000-memory.dmp	upx
behavioral2/memory/4524-829-0x00007FF6A3AD0000-0x00007FF6A3E24000-memory.dmp	upx
behavioral2/memory/1612-2117-0x00007FF7DA120000-0x00007FF7DA474000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nxhaLVG.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\CGcfnWN.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\pjbGpEE.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\jgJKtAO.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\HnTTpEX.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\ZlypRkV.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\ZVOZwZp.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\TpMShKb.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\VynZbaG.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\yMNGPcn.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\SEDhYZZ.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\OTzmVjw.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\NaJWGWK.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\DcfUvEg.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\pVzFlgU.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\TexRmgV.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\EtnMkfV.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\XQWraAC.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\sYgKzGq.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\papRsdg.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\MwsNcGp.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\HynfyNG.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\cIjPedM.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\DiczrHi.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\mNIBWyh.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\CphuHan.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\NgcKeTF.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\kqmsdHh.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\ZpeJlmn.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\yCjwvpc.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\sdnGmgi.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\jYonWiR.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\lLGjYqC.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\pJAbsNI.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\vSKRBEM.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\SQaErTr.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\xJTLWDC.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\ZGKQitA.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\eMApVQC.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\cxtbhOF.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\pfoJewN.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\YdiBTuH.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\vXSupTb.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\tmGlkpv.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\uPzSYpY.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\hkuwbPO.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\DuNYKaK.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\MlFsAlN.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\uRZLTjn.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\hGvQcru.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\RHavTmx.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\OvdhlJi.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\OmwNXwk.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\dkCizkM.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\FPMKpFE.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\ggSCgBk.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\NvIAoiX.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\NNuIgDb.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\kBkqfmL.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\nGOEEWX.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\ZHdzuBp.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\NgfQvmg.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\pJrsokW.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
File created	C:\Windows\System\wFVmHfc.exe	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3496	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	82
PID 1612 wrote to memory of 3496	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	82
PID 1612 wrote to memory of 3616	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	83
PID 1612 wrote to memory of 3616	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	83
PID 1612 wrote to memory of 3876	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	84
PID 1612 wrote to memory of 3876	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	84
PID 1612 wrote to memory of 4200	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	85
PID 1612 wrote to memory of 4200	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	85
PID 1612 wrote to memory of 2064	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	86
PID 1612 wrote to memory of 2064	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	86
PID 1612 wrote to memory of 2896	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	87
PID 1612 wrote to memory of 2896	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	87
PID 1612 wrote to memory of 3424	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	88
PID 1612 wrote to memory of 3424	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	88
PID 1612 wrote to memory of 232	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	89
PID 1612 wrote to memory of 232	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	89
PID 1612 wrote to memory of 2652	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	90
PID 1612 wrote to memory of 2652	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	90
PID 1612 wrote to memory of 3140	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	91
PID 1612 wrote to memory of 3140	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	91
PID 1612 wrote to memory of 868	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	92
PID 1612 wrote to memory of 868	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	92
PID 1612 wrote to memory of 3136	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	93
PID 1612 wrote to memory of 3136	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	93
PID 1612 wrote to memory of 4064	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	94
PID 1612 wrote to memory of 4064	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	94
PID 1612 wrote to memory of 2164	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	95
PID 1612 wrote to memory of 2164	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	95
PID 1612 wrote to memory of 2480	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	96
PID 1612 wrote to memory of 2480	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	96
PID 1612 wrote to memory of 5056	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	97
PID 1612 wrote to memory of 5056	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	97
PID 1612 wrote to memory of 2564	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	98
PID 1612 wrote to memory of 2564	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	98
PID 1612 wrote to memory of 2796	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	99
PID 1612 wrote to memory of 2796	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	99
PID 1612 wrote to memory of 2968	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	100
PID 1612 wrote to memory of 2968	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	100
PID 1612 wrote to memory of 3040	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	101
PID 1612 wrote to memory of 3040	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	101
PID 1612 wrote to memory of 3116	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	102
PID 1612 wrote to memory of 3116	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	102
PID 1612 wrote to memory of 2240	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	103
PID 1612 wrote to memory of 2240	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	103
PID 1612 wrote to memory of 3864	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	104
PID 1612 wrote to memory of 3864	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	104
PID 1612 wrote to memory of 4524	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	105
PID 1612 wrote to memory of 4524	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	105
PID 1612 wrote to memory of 1080	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	106
PID 1612 wrote to memory of 1080	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	106
PID 1612 wrote to memory of 2924	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	107
PID 1612 wrote to memory of 2924	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	107
PID 1612 wrote to memory of 3036	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	108
PID 1612 wrote to memory of 3036	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	108
PID 1612 wrote to memory of 916	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	109
PID 1612 wrote to memory of 916	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	109
PID 1612 wrote to memory of 4092	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	110
PID 1612 wrote to memory of 4092	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	110
PID 1612 wrote to memory of 880	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	111
PID 1612 wrote to memory of 880	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	111
PID 1612 wrote to memory of 2668	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	112
PID 1612 wrote to memory of 2668	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	112
PID 1612 wrote to memory of 696	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	113
PID 1612 wrote to memory of 696	1612	846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\846a04c1a685134ccedbd0aa99258700_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\System\SxZOgHs.exe
  C:\Windows\System\SxZOgHs.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\FLmjIKc.exe
  C:\Windows\System\FLmjIKc.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\TZQTFtG.exe
  C:\Windows\System\TZQTFtG.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\UZXAuEu.exe
  C:\Windows\System\UZXAuEu.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\bTOyivW.exe
  C:\Windows\System\bTOyivW.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\YXOJItZ.exe
  C:\Windows\System\YXOJItZ.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\AkcETzB.exe
  C:\Windows\System\AkcETzB.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\nzeQmIi.exe
  C:\Windows\System\nzeQmIi.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\yCjwvpc.exe
  C:\Windows\System\yCjwvpc.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\sHwKufO.exe
  C:\Windows\System\sHwKufO.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\GgHPMJQ.exe
  C:\Windows\System\GgHPMJQ.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\CHsFnQr.exe
  C:\Windows\System\CHsFnQr.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\MpAhiDj.exe
  C:\Windows\System\MpAhiDj.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\PtYJJAj.exe
  C:\Windows\System\PtYJJAj.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\QpOYuRL.exe
  C:\Windows\System\QpOYuRL.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\PZgxHJU.exe
  C:\Windows\System\PZgxHJU.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\Dmecozt.exe
  C:\Windows\System\Dmecozt.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\cZqDCcz.exe
  C:\Windows\System\cZqDCcz.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\Jeutilv.exe
  C:\Windows\System\Jeutilv.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\JewGPYr.exe
  C:\Windows\System\JewGPYr.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\OYhoNSO.exe
  C:\Windows\System\OYhoNSO.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\sfkQQMZ.exe
  C:\Windows\System\sfkQQMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\KySjMXL.exe
  C:\Windows\System\KySjMXL.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\SEDhYZZ.exe
  C:\Windows\System\SEDhYZZ.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\xcONzLS.exe
  C:\Windows\System\xcONzLS.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\XEoDyPn.exe
  C:\Windows\System\XEoDyPn.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\WAODnYQ.exe
  C:\Windows\System\WAODnYQ.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\eaksmOc.exe
  C:\Windows\System\eaksmOc.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\mzcrnLj.exe
  C:\Windows\System\mzcrnLj.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\jnblKeD.exe
  C:\Windows\System\jnblKeD.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\ZWAOGJM.exe
  C:\Windows\System\ZWAOGJM.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\wtOdjNh.exe
  C:\Windows\System\wtOdjNh.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\UczbpfC.exe
  C:\Windows\System\UczbpfC.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\jgJKtAO.exe
  C:\Windows\System\jgJKtAO.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\LfYqPQu.exe
  C:\Windows\System\LfYqPQu.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\JengOQY.exe
  C:\Windows\System\JengOQY.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\lZuFWzk.exe
  C:\Windows\System\lZuFWzk.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\DHNqTzk.exe
  C:\Windows\System\DHNqTzk.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\nxhaLVG.exe
  C:\Windows\System\nxhaLVG.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\mKSmFvA.exe
  C:\Windows\System\mKSmFvA.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\ItpjWwp.exe
  C:\Windows\System\ItpjWwp.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\kEKrxJn.exe
  C:\Windows\System\kEKrxJn.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\kcdcMKm.exe
  C:\Windows\System\kcdcMKm.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\sdnGmgi.exe
  C:\Windows\System\sdnGmgi.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\TMdOvFO.exe
  C:\Windows\System\TMdOvFO.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\OTzmVjw.exe
  C:\Windows\System\OTzmVjw.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\tlNmpEh.exe
  C:\Windows\System\tlNmpEh.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\KOzDGTd.exe
  C:\Windows\System\KOzDGTd.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\VQDCBgI.exe
  C:\Windows\System\VQDCBgI.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\ivSDaqb.exe
  C:\Windows\System\ivSDaqb.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\CPomUAC.exe
  C:\Windows\System\CPomUAC.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\UnYgoGr.exe
  C:\Windows\System\UnYgoGr.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\LFiKnrm.exe
  C:\Windows\System\LFiKnrm.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\knaGvUJ.exe
  C:\Windows\System\knaGvUJ.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\htCtLRR.exe
  C:\Windows\System\htCtLRR.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\NgcKeTF.exe
  C:\Windows\System\NgcKeTF.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\eCGGgMe.exe
  C:\Windows\System\eCGGgMe.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\cSyemhB.exe
  C:\Windows\System\cSyemhB.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\SBLeYQH.exe
  C:\Windows\System\SBLeYQH.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\IQVkfUP.exe
  C:\Windows\System\IQVkfUP.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\IPyyadI.exe
  C:\Windows\System\IPyyadI.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\LaeBOtK.exe
  C:\Windows\System\LaeBOtK.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\KkjFdhI.exe
  C:\Windows\System\KkjFdhI.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\CkFCMQQ.exe
  C:\Windows\System\CkFCMQQ.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\bJUQyPO.exe
  C:\Windows\System\bJUQyPO.exe
  2⤵
  PID:4056
- C:\Windows\System\lhLhGlR.exe
  C:\Windows\System\lhLhGlR.exe
  2⤵
  PID:1924
- C:\Windows\System\KduNUyL.exe
  C:\Windows\System\KduNUyL.exe
  2⤵
  PID:3344
- C:\Windows\System\kpDQvTA.exe
  C:\Windows\System\kpDQvTA.exe
  2⤵
  PID:948
- C:\Windows\System\GllLkyy.exe
  C:\Windows\System\GllLkyy.exe
  2⤵
  PID:1524
- C:\Windows\System\hWTfGKy.exe
  C:\Windows\System\hWTfGKy.exe
  2⤵
  PID:1252
- C:\Windows\System\jYonWiR.exe
  C:\Windows\System\jYonWiR.exe
  2⤵
  PID:3692
- C:\Windows\System\kqmsdHh.exe
  C:\Windows\System\kqmsdHh.exe
  2⤵
  PID:4776
- C:\Windows\System\kPsPCIe.exe
  C:\Windows\System\kPsPCIe.exe
  2⤵
  PID:4192
- C:\Windows\System\FQJaoUz.exe
  C:\Windows\System\FQJaoUz.exe
  2⤵
  PID:4324
- C:\Windows\System\lxNYWZp.exe
  C:\Windows\System\lxNYWZp.exe
  2⤵
  PID:60
- C:\Windows\System\PhBjczT.exe
  C:\Windows\System\PhBjczT.exe
  2⤵
  PID:3984
- C:\Windows\System\KGZAujD.exe
  C:\Windows\System\KGZAujD.exe
  2⤵
  PID:2664
- C:\Windows\System\cQCXyjJ.exe
  C:\Windows\System\cQCXyjJ.exe
  2⤵
  PID:3100
- C:\Windows\System\dkCizkM.exe
  C:\Windows\System\dkCizkM.exe
  2⤵
  PID:5128
- C:\Windows\System\erFKAxQ.exe
  C:\Windows\System\erFKAxQ.exe
  2⤵
  PID:5156
- C:\Windows\System\vuqTQqX.exe
  C:\Windows\System\vuqTQqX.exe
  2⤵
  PID:5184
- C:\Windows\System\pHmSUhG.exe
  C:\Windows\System\pHmSUhG.exe
  2⤵
  PID:5212
- C:\Windows\System\QZfSXAY.exe
  C:\Windows\System\QZfSXAY.exe
  2⤵
  PID:5240
- C:\Windows\System\SMWArNS.exe
  C:\Windows\System\SMWArNS.exe
  2⤵
  PID:5268
- C:\Windows\System\FBWCFRk.exe
  C:\Windows\System\FBWCFRk.exe
  2⤵
  PID:5292
- C:\Windows\System\AfmXLZp.exe
  C:\Windows\System\AfmXLZp.exe
  2⤵
  PID:5320
- C:\Windows\System\kTQsMXr.exe
  C:\Windows\System\kTQsMXr.exe
  2⤵
  PID:5340
- C:\Windows\System\EQnXQBe.exe
  C:\Windows\System\EQnXQBe.exe
  2⤵
  PID:5368
- C:\Windows\System\fSxaEeJ.exe
  C:\Windows\System\fSxaEeJ.exe
  2⤵
  PID:5396
- C:\Windows\System\tmGlkpv.exe
  C:\Windows\System\tmGlkpv.exe
  2⤵
  PID:5424
- C:\Windows\System\nisyGxI.exe
  C:\Windows\System\nisyGxI.exe
  2⤵
  PID:5452
- C:\Windows\System\nFrpBjl.exe
  C:\Windows\System\nFrpBjl.exe
  2⤵
  PID:5480
- C:\Windows\System\dEkUaox.exe
  C:\Windows\System\dEkUaox.exe
  2⤵
  PID:5508
- C:\Windows\System\EzzpJOa.exe
  C:\Windows\System\EzzpJOa.exe
  2⤵
  PID:5536
- C:\Windows\System\JFppIxp.exe
  C:\Windows\System\JFppIxp.exe
  2⤵
  PID:5564
- C:\Windows\System\TWyKTJv.exe
  C:\Windows\System\TWyKTJv.exe
  2⤵
  PID:5592
- C:\Windows\System\oVCtYNR.exe
  C:\Windows\System\oVCtYNR.exe
  2⤵
  PID:5620
- C:\Windows\System\PYwlZqJ.exe
  C:\Windows\System\PYwlZqJ.exe
  2⤵
  PID:5648
- C:\Windows\System\iSUcgUB.exe
  C:\Windows\System\iSUcgUB.exe
  2⤵
  PID:5676
- C:\Windows\System\lLGjYqC.exe
  C:\Windows\System\lLGjYqC.exe
  2⤵
  PID:5704
- C:\Windows\System\ablZfzd.exe
  C:\Windows\System\ablZfzd.exe
  2⤵
  PID:5732
- C:\Windows\System\wQiEZnO.exe
  C:\Windows\System\wQiEZnO.exe
  2⤵
  PID:5760
- C:\Windows\System\blSrIUV.exe
  C:\Windows\System\blSrIUV.exe
  2⤵
  PID:5788
- C:\Windows\System\cIjPedM.exe
  C:\Windows\System\cIjPedM.exe
  2⤵
  PID:5816
- C:\Windows\System\rVQkEPu.exe
  C:\Windows\System\rVQkEPu.exe
  2⤵
  PID:5844
- C:\Windows\System\rtGRTDV.exe
  C:\Windows\System\rtGRTDV.exe
  2⤵
  PID:5872
- C:\Windows\System\FZKPibY.exe
  C:\Windows\System\FZKPibY.exe
  2⤵
  PID:5900
- C:\Windows\System\bWeLBUS.exe
  C:\Windows\System\bWeLBUS.exe
  2⤵
  PID:5928
- C:\Windows\System\uPzSYpY.exe
  C:\Windows\System\uPzSYpY.exe
  2⤵
  PID:5956
- C:\Windows\System\dtnGRfO.exe
  C:\Windows\System\dtnGRfO.exe
  2⤵
  PID:5984
- C:\Windows\System\GpZpbKo.exe
  C:\Windows\System\GpZpbKo.exe
  2⤵
  PID:6012
- C:\Windows\System\DsYOCjN.exe
  C:\Windows\System\DsYOCjN.exe
  2⤵
  PID:6040
- C:\Windows\System\ohLhRmz.exe
  C:\Windows\System\ohLhRmz.exe
  2⤵
  PID:6068
- C:\Windows\System\rsUbqls.exe
  C:\Windows\System\rsUbqls.exe
  2⤵
  PID:6096
- C:\Windows\System\hkuwbPO.exe
  C:\Windows\System\hkuwbPO.exe
  2⤵
  PID:6124
- C:\Windows\System\gGGOwqX.exe
  C:\Windows\System\gGGOwqX.exe
  2⤵
  PID:872
- C:\Windows\System\NiOSrjE.exe
  C:\Windows\System\NiOSrjE.exe
  2⤵
  PID:1644
- C:\Windows\System\nPsBqvq.exe
  C:\Windows\System\nPsBqvq.exe
  2⤵
  PID:4580
- C:\Windows\System\ZtuMXdo.exe
  C:\Windows\System\ZtuMXdo.exe
  2⤵
  PID:4784
- C:\Windows\System\MiVIjSj.exe
  C:\Windows\System\MiVIjSj.exe
  2⤵
  PID:4160
- C:\Windows\System\lXbxoDo.exe
  C:\Windows\System\lXbxoDo.exe
  2⤵
  PID:4996
- C:\Windows\System\xYfDkAK.exe
  C:\Windows\System\xYfDkAK.exe
  2⤵
  PID:4748
- C:\Windows\System\WPRAnPg.exe
  C:\Windows\System\WPRAnPg.exe
  2⤵
  PID:5148
- C:\Windows\System\aiqakJz.exe
  C:\Windows\System\aiqakJz.exe
  2⤵
  PID:5224
- C:\Windows\System\EbrnPtI.exe
  C:\Windows\System\EbrnPtI.exe
  2⤵
  PID:5284
- C:\Windows\System\pJAbsNI.exe
  C:\Windows\System\pJAbsNI.exe
  2⤵
  PID:5352
- C:\Windows\System\VUoxcTp.exe
  C:\Windows\System\VUoxcTp.exe
  2⤵
  PID:5412
- C:\Windows\System\nusazMa.exe
  C:\Windows\System\nusazMa.exe
  2⤵
  PID:5496
- C:\Windows\System\XYDyRjH.exe
  C:\Windows\System\XYDyRjH.exe
  2⤵
  PID:1836
- C:\Windows\System\KDbZTTu.exe
  C:\Windows\System\KDbZTTu.exe
  2⤵
  PID:5632
- C:\Windows\System\nKcQjOZ.exe
  C:\Windows\System\nKcQjOZ.exe
  2⤵
  PID:5664
- C:\Windows\System\gQOXVTP.exe
  C:\Windows\System\gQOXVTP.exe
  2⤵
  PID:5720
- C:\Windows\System\mfmuwTz.exe
  C:\Windows\System\mfmuwTz.exe
  2⤵
  PID:5800
- C:\Windows\System\ZoslwPs.exe
  C:\Windows\System\ZoslwPs.exe
  2⤵
  PID:5860
- C:\Windows\System\MzUOSBL.exe
  C:\Windows\System\MzUOSBL.exe
  2⤵
  PID:5920
- C:\Windows\System\yblpclT.exe
  C:\Windows\System\yblpclT.exe
  2⤵
  PID:508
- C:\Windows\System\BfBmWiG.exe
  C:\Windows\System\BfBmWiG.exe
  2⤵
  PID:6052
- C:\Windows\System\GqDbBTh.exe
  C:\Windows\System\GqDbBTh.exe
  2⤵
  PID:6108
- C:\Windows\System\dHtWMjb.exe
  C:\Windows\System\dHtWMjb.exe
  2⤵
  PID:1016
- C:\Windows\System\AhyZCkO.exe
  C:\Windows\System\AhyZCkO.exe
  2⤵
  PID:4188
- C:\Windows\System\NvIAoiX.exe
  C:\Windows\System\NvIAoiX.exe
  2⤵
  PID:2436
- C:\Windows\System\EuRtguO.exe
  C:\Windows\System\EuRtguO.exe
  2⤵
  PID:5196
- C:\Windows\System\CabRxlQ.exe
  C:\Windows\System\CabRxlQ.exe
  2⤵
  PID:5332
- C:\Windows\System\hOBMkzN.exe
  C:\Windows\System\hOBMkzN.exe
  2⤵
  PID:5524
- C:\Windows\System\ZpeJlmn.exe
  C:\Windows\System\ZpeJlmn.exe
  2⤵
  PID:5640
- C:\Windows\System\vuRvtTJ.exe
  C:\Windows\System\vuRvtTJ.exe
  2⤵
  PID:5776
- C:\Windows\System\wcFBrrm.exe
  C:\Windows\System\wcFBrrm.exe
  2⤵
  PID:6168
- C:\Windows\System\egVKovD.exe
  C:\Windows\System\egVKovD.exe
  2⤵
  PID:6196
- C:\Windows\System\hfGxhVV.exe
  C:\Windows\System\hfGxhVV.exe
  2⤵
  PID:6224
- C:\Windows\System\WIthjbD.exe
  C:\Windows\System\WIthjbD.exe
  2⤵
  PID:6252
- C:\Windows\System\tWFNCIt.exe
  C:\Windows\System\tWFNCIt.exe
  2⤵
  PID:6280
- C:\Windows\System\jYZWWzi.exe
  C:\Windows\System\jYZWWzi.exe
  2⤵
  PID:6308
- C:\Windows\System\YuArXOl.exe
  C:\Windows\System\YuArXOl.exe
  2⤵
  PID:6336
- C:\Windows\System\BpBkKGc.exe
  C:\Windows\System\BpBkKGc.exe
  2⤵
  PID:6364
- C:\Windows\System\iNJXcdx.exe
  C:\Windows\System\iNJXcdx.exe
  2⤵
  PID:6392
- C:\Windows\System\vSKRBEM.exe
  C:\Windows\System\vSKRBEM.exe
  2⤵
  PID:6420
- C:\Windows\System\tSDaNMb.exe
  C:\Windows\System\tSDaNMb.exe
  2⤵
  PID:6448
- C:\Windows\System\rxMxVfk.exe
  C:\Windows\System\rxMxVfk.exe
  2⤵
  PID:6476
- C:\Windows\System\kerQLpc.exe
  C:\Windows\System\kerQLpc.exe
  2⤵
  PID:6504
- C:\Windows\System\XooRZjd.exe
  C:\Windows\System\XooRZjd.exe
  2⤵
  PID:6532
- C:\Windows\System\XiJmwnP.exe
  C:\Windows\System\XiJmwnP.exe
  2⤵
  PID:6560
- C:\Windows\System\ttANwMs.exe
  C:\Windows\System\ttANwMs.exe
  2⤵
  PID:6588
- C:\Windows\System\byGMcfJ.exe
  C:\Windows\System\byGMcfJ.exe
  2⤵
  PID:6616
- C:\Windows\System\YrumSkD.exe
  C:\Windows\System\YrumSkD.exe
  2⤵
  PID:6644
- C:\Windows\System\tGRHTOl.exe
  C:\Windows\System\tGRHTOl.exe
  2⤵
  PID:6672
- C:\Windows\System\PXTGgnN.exe
  C:\Windows\System\PXTGgnN.exe
  2⤵
  PID:6700
- C:\Windows\System\qzoEuwW.exe
  C:\Windows\System\qzoEuwW.exe
  2⤵
  PID:6728
- C:\Windows\System\inPyGKZ.exe
  C:\Windows\System\inPyGKZ.exe
  2⤵
  PID:6756
- C:\Windows\System\awHxKGW.exe
  C:\Windows\System\awHxKGW.exe
  2⤵
  PID:6784
- C:\Windows\System\qTodTIP.exe
  C:\Windows\System\qTodTIP.exe
  2⤵
  PID:6812
- C:\Windows\System\ULJwTKm.exe
  C:\Windows\System\ULJwTKm.exe
  2⤵
  PID:6840
- C:\Windows\System\VuZSeFT.exe
  C:\Windows\System\VuZSeFT.exe
  2⤵
  PID:6868
- C:\Windows\System\ljLfkHi.exe
  C:\Windows\System\ljLfkHi.exe
  2⤵
  PID:6896
- C:\Windows\System\KSYmxqq.exe
  C:\Windows\System\KSYmxqq.exe
  2⤵
  PID:6924
- C:\Windows\System\lHiDJxI.exe
  C:\Windows\System\lHiDJxI.exe
  2⤵
  PID:6952
- C:\Windows\System\FfCghre.exe
  C:\Windows\System\FfCghre.exe
  2⤵
  PID:6980
- C:\Windows\System\eJDQLMM.exe
  C:\Windows\System\eJDQLMM.exe
  2⤵
  PID:7008
- C:\Windows\System\uxUJcnd.exe
  C:\Windows\System\uxUJcnd.exe
  2⤵
  PID:7036
- C:\Windows\System\xFRgMgZ.exe
  C:\Windows\System\xFRgMgZ.exe
  2⤵
  PID:7064
- C:\Windows\System\MjtMmeh.exe
  C:\Windows\System\MjtMmeh.exe
  2⤵
  PID:7092
- C:\Windows\System\nEBEypp.exe
  C:\Windows\System\nEBEypp.exe
  2⤵
  PID:7120
- C:\Windows\System\lijHunR.exe
  C:\Windows\System\lijHunR.exe
  2⤵
  PID:7148
- C:\Windows\System\PoKeDCy.exe
  C:\Windows\System\PoKeDCy.exe
  2⤵
  PID:5888
- C:\Windows\System\TNkEvcC.exe
  C:\Windows\System\TNkEvcC.exe
  2⤵
  PID:6024
- C:\Windows\System\LDEspEs.exe
  C:\Windows\System\LDEspEs.exe
  2⤵
  PID:2508
- C:\Windows\System\YfdFFba.exe
  C:\Windows\System\YfdFFba.exe
  2⤵
  PID:2596
- C:\Windows\System\zGtXZsN.exe
  C:\Windows\System\zGtXZsN.exe
  2⤵
  PID:5388
- C:\Windows\System\UPTEffV.exe
  C:\Windows\System\UPTEffV.exe
  2⤵
  PID:5696
- C:\Windows\System\cPXuXMQ.exe
  C:\Windows\System\cPXuXMQ.exe
  2⤵
  PID:6180
- C:\Windows\System\iCPVCOR.exe
  C:\Windows\System\iCPVCOR.exe
  2⤵
  PID:6240
- C:\Windows\System\wWdgoGR.exe
  C:\Windows\System\wWdgoGR.exe
  2⤵
  PID:6300
- C:\Windows\System\eEFIJsf.exe
  C:\Windows\System\eEFIJsf.exe
  2⤵
  PID:6356
- C:\Windows\System\eWKLKfi.exe
  C:\Windows\System\eWKLKfi.exe
  2⤵
  PID:6432
- C:\Windows\System\kzwqrMz.exe
  C:\Windows\System\kzwqrMz.exe
  2⤵
  PID:6488
- C:\Windows\System\kgrtIEK.exe
  C:\Windows\System\kgrtIEK.exe
  2⤵
  PID:6548
- C:\Windows\System\KNSmYkJ.exe
  C:\Windows\System\KNSmYkJ.exe
  2⤵
  PID:6604
- C:\Windows\System\fOZysDA.exe
  C:\Windows\System\fOZysDA.exe
  2⤵
  PID:6664
- C:\Windows\System\bNeWAVR.exe
  C:\Windows\System\bNeWAVR.exe
  2⤵
  PID:2776
- C:\Windows\System\QsIkedj.exe
  C:\Windows\System\QsIkedj.exe
  2⤵
  PID:6796
- C:\Windows\System\IoeQyla.exe
  C:\Windows\System\IoeQyla.exe
  2⤵
  PID:6852
- C:\Windows\System\htXNret.exe
  C:\Windows\System\htXNret.exe
  2⤵
  PID:6912
- C:\Windows\System\IoYZtpn.exe
  C:\Windows\System\IoYZtpn.exe
  2⤵
  PID:6972
- C:\Windows\System\nhXyMkx.exe
  C:\Windows\System\nhXyMkx.exe
  2⤵
  PID:7048
- C:\Windows\System\jJHzVwm.exe
  C:\Windows\System\jJHzVwm.exe
  2⤵
  PID:7108
- C:\Windows\System\dKRPmLv.exe
  C:\Windows\System\dKRPmLv.exe
  2⤵
  PID:7164
- C:\Windows\System\DiczrHi.exe
  C:\Windows\System\DiczrHi.exe
  2⤵
  PID:6084
- C:\Windows\System\RibqEKZ.exe
  C:\Windows\System\RibqEKZ.exe
  2⤵
  PID:5260
- C:\Windows\System\SVTobEC.exe
  C:\Windows\System\SVTobEC.exe
  2⤵
  PID:6208
- C:\Windows\System\LrKcvTu.exe
  C:\Windows\System\LrKcvTu.exe
  2⤵
  PID:6328
- C:\Windows\System\HtCGtNQ.exe
  C:\Windows\System\HtCGtNQ.exe
  2⤵
  PID:6468
- C:\Windows\System\dYiJegz.exe
  C:\Windows\System\dYiJegz.exe
  2⤵
  PID:6636
- C:\Windows\System\iznEOef.exe
  C:\Windows\System\iznEOef.exe
  2⤵
  PID:6748
- C:\Windows\System\HJElTVL.exe
  C:\Windows\System\HJElTVL.exe
  2⤵
  PID:6828
- C:\Windows\System\spbDwhL.exe
  C:\Windows\System\spbDwhL.exe
  2⤵
  PID:6964
- C:\Windows\System\ZZnpxtO.exe
  C:\Windows\System\ZZnpxtO.exe
  2⤵
  PID:7136
- C:\Windows\System\XVVqDMT.exe
  C:\Windows\System\XVVqDMT.exe
  2⤵
  PID:5076
- C:\Windows\System\sNjPaTc.exe
  C:\Windows\System\sNjPaTc.exe
  2⤵
  PID:7196
- C:\Windows\System\iwTxuuB.exe
  C:\Windows\System\iwTxuuB.exe
  2⤵
  PID:7224
- C:\Windows\System\eMApVQC.exe
  C:\Windows\System\eMApVQC.exe
  2⤵
  PID:7252
- C:\Windows\System\DuNYKaK.exe
  C:\Windows\System\DuNYKaK.exe
  2⤵
  PID:7280
- C:\Windows\System\mNIBWyh.exe
  C:\Windows\System\mNIBWyh.exe
  2⤵
  PID:7308
- C:\Windows\System\eSlUvsL.exe
  C:\Windows\System\eSlUvsL.exe
  2⤵
  PID:7336
- C:\Windows\System\aJsXASB.exe
  C:\Windows\System\aJsXASB.exe
  2⤵
  PID:7364
- C:\Windows\System\UWoqnra.exe
  C:\Windows\System\UWoqnra.exe
  2⤵
  PID:7392
- C:\Windows\System\qxwQhWb.exe
  C:\Windows\System\qxwQhWb.exe
  2⤵
  PID:7420
- C:\Windows\System\HnTTpEX.exe
  C:\Windows\System\HnTTpEX.exe
  2⤵
  PID:7448
- C:\Windows\System\GKOerRs.exe
  C:\Windows\System\GKOerRs.exe
  2⤵
  PID:7476
- C:\Windows\System\mWlVdDm.exe
  C:\Windows\System\mWlVdDm.exe
  2⤵
  PID:7504
- C:\Windows\System\pNXSefG.exe
  C:\Windows\System\pNXSefG.exe
  2⤵
  PID:7532
- C:\Windows\System\WxlbQXr.exe
  C:\Windows\System\WxlbQXr.exe
  2⤵
  PID:7560
- C:\Windows\System\ToikGdV.exe
  C:\Windows\System\ToikGdV.exe
  2⤵
  PID:7588
- C:\Windows\System\NaJWGWK.exe
  C:\Windows\System\NaJWGWK.exe
  2⤵
  PID:7616
- C:\Windows\System\jaLpCWb.exe
  C:\Windows\System\jaLpCWb.exe
  2⤵
  PID:7644
- C:\Windows\System\DZwvezF.exe
  C:\Windows\System\DZwvezF.exe
  2⤵
  PID:7672
- C:\Windows\System\QVSrXtc.exe
  C:\Windows\System\QVSrXtc.exe
  2⤵
  PID:7700
- C:\Windows\System\CphuHan.exe
  C:\Windows\System\CphuHan.exe
  2⤵
  PID:7728
- C:\Windows\System\WYSDnIh.exe
  C:\Windows\System\WYSDnIh.exe
  2⤵
  PID:7804
- C:\Windows\System\bWQBTPB.exe
  C:\Windows\System\bWQBTPB.exe
  2⤵
  PID:7832
- C:\Windows\System\EVioFcf.exe
  C:\Windows\System\EVioFcf.exe
  2⤵
  PID:7856
- C:\Windows\System\gvXToNf.exe
  C:\Windows\System\gvXToNf.exe
  2⤵
  PID:7892
- C:\Windows\System\rMDSVLk.exe
  C:\Windows\System\rMDSVLk.exe
  2⤵
  PID:7928
- C:\Windows\System\iDiEiAW.exe
  C:\Windows\System\iDiEiAW.exe
  2⤵
  PID:7964
- C:\Windows\System\jMbpdFV.exe
  C:\Windows\System\jMbpdFV.exe
  2⤵
  PID:7988
- C:\Windows\System\nQgShnl.exe
  C:\Windows\System\nQgShnl.exe
  2⤵
  PID:8012
- C:\Windows\System\nGOEEWX.exe
  C:\Windows\System\nGOEEWX.exe
  2⤵
  PID:8028
- C:\Windows\System\boRhUYS.exe
  C:\Windows\System\boRhUYS.exe
  2⤵
  PID:8044
- C:\Windows\System\ZlypRkV.exe
  C:\Windows\System\ZlypRkV.exe
  2⤵
  PID:8108
- C:\Windows\System\ExZtOUw.exe
  C:\Windows\System\ExZtOUw.exe
  2⤵
  PID:8156
- C:\Windows\System\NdumnMy.exe
  C:\Windows\System\NdumnMy.exe
  2⤵
  PID:5144
- C:\Windows\System\LjiEtDT.exe
  C:\Windows\System\LjiEtDT.exe
  2⤵
  PID:6272
- C:\Windows\System\CmSlxAl.exe
  C:\Windows\System\CmSlxAl.exe
  2⤵
  PID:6692
- C:\Windows\System\YyNxLeG.exe
  C:\Windows\System\YyNxLeG.exe
  2⤵
  PID:4416
- C:\Windows\System\aYNPOBc.exe
  C:\Windows\System\aYNPOBc.exe
  2⤵
  PID:5968
- C:\Windows\System\PTRGWkU.exe
  C:\Windows\System\PTRGWkU.exe
  2⤵
  PID:7216
- C:\Windows\System\enXmVKH.exe
  C:\Windows\System\enXmVKH.exe
  2⤵
  PID:7300
- C:\Windows\System\ZHdzuBp.exe
  C:\Windows\System\ZHdzuBp.exe
  2⤵
  PID:7356
- C:\Windows\System\ULpAAcr.exe
  C:\Windows\System\ULpAAcr.exe
  2⤵
  PID:7384
- C:\Windows\System\LzklyMk.exe
  C:\Windows\System\LzklyMk.exe
  2⤵
  PID:7460
- C:\Windows\System\HvcsJtI.exe
  C:\Windows\System\HvcsJtI.exe
  2⤵
  PID:3904
- C:\Windows\System\MlFsAlN.exe
  C:\Windows\System\MlFsAlN.exe
  2⤵
  PID:920
- C:\Windows\System\ZSzYiCV.exe
  C:\Windows\System\ZSzYiCV.exe
  2⤵
  PID:7552
- C:\Windows\System\GcfTRsM.exe
  C:\Windows\System\GcfTRsM.exe
  2⤵
  PID:7580
- C:\Windows\System\cBUHwqF.exe
  C:\Windows\System\cBUHwqF.exe
  2⤵
  PID:1200
- C:\Windows\System\IZdhjkI.exe
  C:\Windows\System\IZdhjkI.exe
  2⤵
  PID:884
- C:\Windows\System\MSkvNal.exe
  C:\Windows\System\MSkvNal.exe
  2⤵
  PID:4232
- C:\Windows\System\IDMxUCh.exe
  C:\Windows\System\IDMxUCh.exe
  2⤵
  PID:7712
- C:\Windows\System\dwvQIAD.exe
  C:\Windows\System\dwvQIAD.exe
  2⤵
  PID:3220
- C:\Windows\System\lbxIpeN.exe
  C:\Windows\System\lbxIpeN.exe
  2⤵
  PID:7772
- C:\Windows\System\uRZLTjn.exe
  C:\Windows\System\uRZLTjn.exe
  2⤵
  PID:2212
- C:\Windows\System\NNuIgDb.exe
  C:\Windows\System\NNuIgDb.exe
  2⤵
  PID:2632
- C:\Windows\System\EtnMkfV.exe
  C:\Windows\System\EtnMkfV.exe
  2⤵
  PID:7864
- C:\Windows\System\gVHOlTb.exe
  C:\Windows\System\gVHOlTb.exe
  2⤵
  PID:7884
- C:\Windows\System\YbeRyEO.exe
  C:\Windows\System\YbeRyEO.exe
  2⤵
  PID:7936
- C:\Windows\System\DxJmAxk.exe
  C:\Windows\System\DxJmAxk.exe
  2⤵
  PID:8020
- C:\Windows\System\jopMFjJ.exe
  C:\Windows\System\jopMFjJ.exe
  2⤵
  PID:5752
- C:\Windows\System\hdSFGRg.exe
  C:\Windows\System\hdSFGRg.exe
  2⤵
  PID:6268
- C:\Windows\System\dgkMovV.exe
  C:\Windows\System\dgkMovV.exe
  2⤵
  PID:6712
- C:\Windows\System\tIetSUG.exe
  C:\Windows\System\tIetSUG.exe
  2⤵
  PID:7212
- C:\Windows\System\MJyVCzY.exe
  C:\Windows\System\MJyVCzY.exe
  2⤵
  PID:8068
- C:\Windows\System\BrcxcsX.exe
  C:\Windows\System\BrcxcsX.exe
  2⤵
  PID:5080
- C:\Windows\System\mfnjWoN.exe
  C:\Windows\System\mfnjWoN.exe
  2⤵
  PID:7328
- C:\Windows\System\XQWraAC.exe
  C:\Windows\System\XQWraAC.exe
  2⤵
  PID:7468
- C:\Windows\System\bExFaRf.exe
  C:\Windows\System\bExFaRf.exe
  2⤵
  PID:4652
- C:\Windows\System\tJtfMZd.exe
  C:\Windows\System\tJtfMZd.exe
  2⤵
  PID:7608
- C:\Windows\System\RQTXPyT.exe
  C:\Windows\System\RQTXPyT.exe
  2⤵
  PID:7692
- C:\Windows\System\cxtbhOF.exe
  C:\Windows\System\cxtbhOF.exe
  2⤵
  PID:1852
- C:\Windows\System\bIhFZQA.exe
  C:\Windows\System\bIhFZQA.exe
  2⤵
  PID:3500
- C:\Windows\System\qBrIgOk.exe
  C:\Windows\System\qBrIgOk.exe
  2⤵
  PID:8000
- C:\Windows\System\TrTsvCd.exe
  C:\Windows\System\TrTsvCd.exe
  2⤵
  PID:8036
- C:\Windows\System\DFvrOTG.exe
  C:\Windows\System\DFvrOTG.exe
  2⤵
  PID:7244
- C:\Windows\System\FPMKpFE.exe
  C:\Windows\System\FPMKpFE.exe
  2⤵
  PID:6944
- C:\Windows\System\EvVXSOn.exe
  C:\Windows\System\EvVXSOn.exe
  2⤵
  PID:7488
- C:\Windows\System\JRMPsTv.exe
  C:\Windows\System\JRMPsTv.exe
  2⤵
  PID:3780
- C:\Windows\System\TqavCdb.exe
  C:\Windows\System\TqavCdb.exe
  2⤵
  PID:2216
- C:\Windows\System\YjBcqqC.exe
  C:\Windows\System\YjBcqqC.exe
  2⤵
  PID:7980
- C:\Windows\System\WCJrUwS.exe
  C:\Windows\System\WCJrUwS.exe
  2⤵
  PID:8172
- C:\Windows\System\MiCByKP.exe
  C:\Windows\System\MiCByKP.exe
  2⤵
  PID:7548
- C:\Windows\System\eIGRNhP.exe
  C:\Windows\System\eIGRNhP.exe
  2⤵
  PID:1824
- C:\Windows\System\BIekSxa.exe
  C:\Windows\System\BIekSxa.exe
  2⤵
  PID:1652
- C:\Windows\System\SuYZycF.exe
  C:\Windows\System\SuYZycF.exe
  2⤵
  PID:8212
- C:\Windows\System\HBnHdnr.exe
  C:\Windows\System\HBnHdnr.exe
  2⤵
  PID:8248
- C:\Windows\System\OExIyAB.exe
  C:\Windows\System\OExIyAB.exe
  2⤵
  PID:8264
- C:\Windows\System\TlqBukT.exe
  C:\Windows\System\TlqBukT.exe
  2⤵
  PID:8292
- C:\Windows\System\dbibJaw.exe
  C:\Windows\System\dbibJaw.exe
  2⤵
  PID:8320
- C:\Windows\System\QugPlvB.exe
  C:\Windows\System\QugPlvB.exe
  2⤵
  PID:8360
- C:\Windows\System\jBipeMI.exe
  C:\Windows\System\jBipeMI.exe
  2⤵
  PID:8388
- C:\Windows\System\hGPEBUB.exe
  C:\Windows\System\hGPEBUB.exe
  2⤵
  PID:8416
- C:\Windows\System\Suyrhdg.exe
  C:\Windows\System\Suyrhdg.exe
  2⤵
  PID:8444
- C:\Windows\System\lGVZRlV.exe
  C:\Windows\System\lGVZRlV.exe
  2⤵
  PID:8476
- C:\Windows\System\rYYbHyW.exe
  C:\Windows\System\rYYbHyW.exe
  2⤵
  PID:8504
- C:\Windows\System\eZOzkCT.exe
  C:\Windows\System\eZOzkCT.exe
  2⤵
  PID:8524
- C:\Windows\System\qplZdfz.exe
  C:\Windows\System\qplZdfz.exe
  2⤵
  PID:8564
- C:\Windows\System\pynECmm.exe
  C:\Windows\System\pynECmm.exe
  2⤵
  PID:8592
- C:\Windows\System\LXUeZPg.exe
  C:\Windows\System\LXUeZPg.exe
  2⤵
  PID:8608
- C:\Windows\System\VayQVDK.exe
  C:\Windows\System\VayQVDK.exe
  2⤵
  PID:8648
- C:\Windows\System\ggSCgBk.exe
  C:\Windows\System\ggSCgBk.exe
  2⤵
  PID:8676
- C:\Windows\System\ZVOZwZp.exe
  C:\Windows\System\ZVOZwZp.exe
  2⤵
  PID:8692
- C:\Windows\System\aOsjvaw.exe
  C:\Windows\System\aOsjvaw.exe
  2⤵
  PID:8720
- C:\Windows\System\TfoEXic.exe
  C:\Windows\System\TfoEXic.exe
  2⤵
  PID:8748
- C:\Windows\System\WmesHyn.exe
  C:\Windows\System\WmesHyn.exe
  2⤵
  PID:8764
- C:\Windows\System\RCNFLeW.exe
  C:\Windows\System\RCNFLeW.exe
  2⤵
  PID:8792
- C:\Windows\System\HvtRRWt.exe
  C:\Windows\System\HvtRRWt.exe
  2⤵
  PID:8820
- C:\Windows\System\LqLckxe.exe
  C:\Windows\System\LqLckxe.exe
  2⤵
  PID:8848
- C:\Windows\System\ZUhuprf.exe
  C:\Windows\System\ZUhuprf.exe
  2⤵
  PID:8876
- C:\Windows\System\hGvQcru.exe
  C:\Windows\System\hGvQcru.exe
  2⤵
  PID:8904
- C:\Windows\System\jydILUZ.exe
  C:\Windows\System\jydILUZ.exe
  2⤵
  PID:8932
- C:\Windows\System\WnwgnEl.exe
  C:\Windows\System\WnwgnEl.exe
  2⤵
  PID:8960
- C:\Windows\System\OzeczxL.exe
  C:\Windows\System\OzeczxL.exe
  2⤵
  PID:8996
- C:\Windows\System\DmeRJGU.exe
  C:\Windows\System\DmeRJGU.exe
  2⤵
  PID:9040
- C:\Windows\System\xixbuJX.exe
  C:\Windows\System\xixbuJX.exe
  2⤵
  PID:9116
- C:\Windows\System\RHavTmx.exe
  C:\Windows\System\RHavTmx.exe
  2⤵
  PID:9140
- C:\Windows\System\vIjcKoK.exe
  C:\Windows\System\vIjcKoK.exe
  2⤵
  PID:9164
- C:\Windows\System\NgfQvmg.exe
  C:\Windows\System\NgfQvmg.exe
  2⤵
  PID:9200
- C:\Windows\System\OvdhlJi.exe
  C:\Windows\System\OvdhlJi.exe
  2⤵
  PID:8204
- C:\Windows\System\hGQhmKD.exe
  C:\Windows\System\hGQhmKD.exe
  2⤵
  PID:8280
- C:\Windows\System\bZBKuFU.exe
  C:\Windows\System\bZBKuFU.exe
  2⤵
  PID:8372
- C:\Windows\System\oJfLiet.exe
  C:\Windows\System\oJfLiet.exe
  2⤵
  PID:8400
- C:\Windows\System\BajjWIv.exe
  C:\Windows\System\BajjWIv.exe
  2⤵
  PID:8488
- C:\Windows\System\ueaXCJb.exe
  C:\Windows\System\ueaXCJb.exe
  2⤵
  PID:8576
- C:\Windows\System\yJxyWNg.exe
  C:\Windows\System\yJxyWNg.exe
  2⤵
  PID:8668
- C:\Windows\System\BTSwNoP.exe
  C:\Windows\System\BTSwNoP.exe
  2⤵
  PID:8708
- C:\Windows\System\hFcDNwO.exe
  C:\Windows\System\hFcDNwO.exe
  2⤵
  PID:8780
- C:\Windows\System\zlwRjht.exe
  C:\Windows\System\zlwRjht.exe
  2⤵
  PID:8836
- C:\Windows\System\TBkhMGU.exe
  C:\Windows\System\TBkhMGU.exe
  2⤵
  PID:8896
- C:\Windows\System\JDOjcSx.exe
  C:\Windows\System\JDOjcSx.exe
  2⤵
  PID:8948
- C:\Windows\System\GgccNNX.exe
  C:\Windows\System\GgccNNX.exe
  2⤵
  PID:9028
- C:\Windows\System\twkTpZw.exe
  C:\Windows\System\twkTpZw.exe
  2⤵
  PID:9112
- C:\Windows\System\umJKQYf.exe
  C:\Windows\System\umJKQYf.exe
  2⤵
  PID:8256
- C:\Windows\System\sYgKzGq.exe
  C:\Windows\System\sYgKzGq.exe
  2⤵
  PID:8352
- C:\Windows\System\xsOWNIB.exe
  C:\Windows\System\xsOWNIB.exe
  2⤵
  PID:8404
- C:\Windows\System\QZvfYXi.exe
  C:\Windows\System\QZvfYXi.exe
  2⤵
  PID:8464
- C:\Windows\System\pJrsokW.exe
  C:\Windows\System\pJrsokW.exe
  2⤵
  PID:8868
- C:\Windows\System\UfuRLGW.exe
  C:\Windows\System\UfuRLGW.exe
  2⤵
  PID:9012
- C:\Windows\System\QESAeoh.exe
  C:\Windows\System\QESAeoh.exe
  2⤵
  PID:9180
- C:\Windows\System\lANXysA.exe
  C:\Windows\System\lANXysA.exe
  2⤵
  PID:8460
- C:\Windows\System\QfJVIKm.exe
  C:\Windows\System\QfJVIKm.exe
  2⤵
  PID:8856
- C:\Windows\System\nqTtuNc.exe
  C:\Windows\System\nqTtuNc.exe
  2⤵
  PID:8336
- C:\Windows\System\AxsoMSp.exe
  C:\Windows\System\AxsoMSp.exe
  2⤵
  PID:9228
- C:\Windows\System\RNLYYfB.exe
  C:\Windows\System\RNLYYfB.exe
  2⤵
  PID:9248
- C:\Windows\System\HKfTuNH.exe
  C:\Windows\System\HKfTuNH.exe
  2⤵
  PID:9284
- C:\Windows\System\ExONETB.exe
  C:\Windows\System\ExONETB.exe
  2⤵
  PID:9304
- C:\Windows\System\JIDyfRR.exe
  C:\Windows\System\JIDyfRR.exe
  2⤵
  PID:9336
- C:\Windows\System\MsfyFxk.exe
  C:\Windows\System\MsfyFxk.exe
  2⤵
  PID:9360
- C:\Windows\System\disDxuN.exe
  C:\Windows\System\disDxuN.exe
  2⤵
  PID:9388
- C:\Windows\System\WTZSrdl.exe
  C:\Windows\System\WTZSrdl.exe
  2⤵
  PID:9404
- C:\Windows\System\lxSOeCv.exe
  C:\Windows\System\lxSOeCv.exe
  2⤵
  PID:9428
- C:\Windows\System\skjmghu.exe
  C:\Windows\System\skjmghu.exe
  2⤵
  PID:9448
- C:\Windows\System\ugTKWqJ.exe
  C:\Windows\System\ugTKWqJ.exe
  2⤵
  PID:9476
- C:\Windows\System\zSAcJPl.exe
  C:\Windows\System\zSAcJPl.exe
  2⤵
  PID:9532
- C:\Windows\System\lcoUCSV.exe
  C:\Windows\System\lcoUCSV.exe
  2⤵
  PID:9552
- C:\Windows\System\papRsdg.exe
  C:\Windows\System\papRsdg.exe
  2⤵
  PID:9600
- C:\Windows\System\bUBQSLY.exe
  C:\Windows\System\bUBQSLY.exe
  2⤵
  PID:9628
- C:\Windows\System\zljoRvM.exe
  C:\Windows\System\zljoRvM.exe
  2⤵
  PID:9656
- C:\Windows\System\TTDoOEf.exe
  C:\Windows\System\TTDoOEf.exe
  2⤵
  PID:9684
- C:\Windows\System\uoLsftz.exe
  C:\Windows\System\uoLsftz.exe
  2⤵
  PID:9712
- C:\Windows\System\hFOVGNq.exe
  C:\Windows\System\hFOVGNq.exe
  2⤵
  PID:9740
- C:\Windows\System\dmZVeYI.exe
  C:\Windows\System\dmZVeYI.exe
  2⤵
  PID:9756
- C:\Windows\System\dAZZfpW.exe
  C:\Windows\System\dAZZfpW.exe
  2⤵
  PID:9776
- C:\Windows\System\CjQshcQ.exe
  C:\Windows\System\CjQshcQ.exe
  2⤵
  PID:9804
- C:\Windows\System\LhcyVYl.exe
  C:\Windows\System\LhcyVYl.exe
  2⤵
  PID:9840
- C:\Windows\System\pfoJewN.exe
  C:\Windows\System\pfoJewN.exe
  2⤵
  PID:9856
- C:\Windows\System\dLLTqBH.exe
  C:\Windows\System\dLLTqBH.exe
  2⤵
  PID:9884
- C:\Windows\System\fluGibi.exe
  C:\Windows\System\fluGibi.exe
  2⤵
  PID:9924
- C:\Windows\System\oqODitu.exe
  C:\Windows\System\oqODitu.exe
  2⤵
  PID:9944
- C:\Windows\System\VzMRrMH.exe
  C:\Windows\System\VzMRrMH.exe
  2⤵
  PID:9976
- C:\Windows\System\xNJXzOv.exe
  C:\Windows\System\xNJXzOv.exe
  2⤵
  PID:9996
- C:\Windows\System\wFVmHfc.exe
  C:\Windows\System\wFVmHfc.exe
  2⤵
  PID:10012
- C:\Windows\System\tVxIXJb.exe
  C:\Windows\System\tVxIXJb.exe
  2⤵
  PID:10040
- C:\Windows\System\JroNdbT.exe
  C:\Windows\System\JroNdbT.exe
  2⤵
  PID:10056
- C:\Windows\System\HDPEeAc.exe
  C:\Windows\System\HDPEeAc.exe
  2⤵
  PID:10092
- C:\Windows\System\kBkqfmL.exe
  C:\Windows\System\kBkqfmL.exe
  2⤵
  PID:10148
- C:\Windows\System\IyVkOiy.exe
  C:\Windows\System\IyVkOiy.exe
  2⤵
  PID:10188
- C:\Windows\System\gALadQB.exe
  C:\Windows\System\gALadQB.exe
  2⤵
  PID:10204
- C:\Windows\System\CGcfnWN.exe
  C:\Windows\System\CGcfnWN.exe
  2⤵
  PID:10232
- C:\Windows\System\GnmkJbj.exe
  C:\Windows\System\GnmkJbj.exe
  2⤵
  PID:9268
- C:\Windows\System\gzMpAHV.exe
  C:\Windows\System\gzMpAHV.exe
  2⤵
  PID:9296
- C:\Windows\System\EFqPyvw.exe
  C:\Windows\System\EFqPyvw.exe
  2⤵
  PID:9372
- C:\Windows\System\bfEJwjw.exe
  C:\Windows\System\bfEJwjw.exe
  2⤵
  PID:9420
- C:\Windows\System\mGYGUVa.exe
  C:\Windows\System\mGYGUVa.exe
  2⤵
  PID:9444
- C:\Windows\System\rflfiSZ.exe
  C:\Windows\System\rflfiSZ.exe
  2⤵
  PID:9512
- C:\Windows\System\Lzzkflq.exe
  C:\Windows\System\Lzzkflq.exe
  2⤵
  PID:9620
- C:\Windows\System\ccufbtC.exe
  C:\Windows\System\ccufbtC.exe
  2⤵
  PID:9704
- C:\Windows\System\mLxFved.exe
  C:\Windows\System\mLxFved.exe
  2⤵
  PID:9812
- C:\Windows\System\fsETMmF.exe
  C:\Windows\System\fsETMmF.exe
  2⤵
  PID:9848
- C:\Windows\System\aLOFFTS.exe
  C:\Windows\System\aLOFFTS.exe
  2⤵
  PID:9912
- C:\Windows\System\ctvYaQZ.exe
  C:\Windows\System\ctvYaQZ.exe
  2⤵
  PID:9952
- C:\Windows\System\IPyANhs.exe
  C:\Windows\System\IPyANhs.exe
  2⤵
  PID:10036
- C:\Windows\System\GIDqrLp.exe
  C:\Windows\System\GIDqrLp.exe
  2⤵
  PID:10076
- C:\Windows\System\qymijwu.exe
  C:\Windows\System\qymijwu.exe
  2⤵
  PID:10184
- C:\Windows\System\OmwNXwk.exe
  C:\Windows\System\OmwNXwk.exe
  2⤵
  PID:9244
- C:\Windows\System\wppicPp.exe
  C:\Windows\System\wppicPp.exe
  2⤵
  PID:9348
- C:\Windows\System\jGkcEMq.exe
  C:\Windows\System\jGkcEMq.exe
  2⤵
  PID:9472
- C:\Windows\System\BAAKNYk.exe
  C:\Windows\System\BAAKNYk.exe
  2⤵
  PID:9672
- C:\Windows\System\yozAqXn.exe
  C:\Windows\System\yozAqXn.exe
  2⤵
  PID:9800
- C:\Windows\System\MwsNcGp.exe
  C:\Windows\System\MwsNcGp.exe
  2⤵
  PID:9972
- C:\Windows\System\aNCJDJh.exe
  C:\Windows\System\aNCJDJh.exe
  2⤵
  PID:10160
- C:\Windows\System\EeyZbKg.exe
  C:\Windows\System\EeyZbKg.exe
  2⤵
  PID:10224
- C:\Windows\System\OsbaZAN.exe
  C:\Windows\System\OsbaZAN.exe
  2⤵
  PID:9596
- C:\Windows\System\HyXiXFc.exe
  C:\Windows\System\HyXiXFc.exe
  2⤵
  PID:9908
- C:\Windows\System\AKRTnrT.exe
  C:\Windows\System\AKRTnrT.exe
  2⤵
  PID:9300
- C:\Windows\System\PPUJGeC.exe
  C:\Windows\System\PPUJGeC.exe
  2⤵
  PID:9752
- C:\Windows\System\QLSckFx.exe
  C:\Windows\System\QLSckFx.exe
  2⤵
  PID:10256
- C:\Windows\System\EyBPiqX.exe
  C:\Windows\System\EyBPiqX.exe
  2⤵
  PID:10296
- C:\Windows\System\SjrwWAc.exe
  C:\Windows\System\SjrwWAc.exe
  2⤵
  PID:10312
- C:\Windows\System\vrWAPsQ.exe
  C:\Windows\System\vrWAPsQ.exe
  2⤵
  PID:10352
- C:\Windows\System\FUVofIP.exe
  C:\Windows\System\FUVofIP.exe
  2⤵
  PID:10368
- C:\Windows\System\rUvZura.exe
  C:\Windows\System\rUvZura.exe
  2⤵
  PID:10408
- C:\Windows\System\fRUNeGj.exe
  C:\Windows\System\fRUNeGj.exe
  2⤵
  PID:10424
- C:\Windows\System\yRSCXWg.exe
  C:\Windows\System\yRSCXWg.exe
  2⤵
  PID:10464
- C:\Windows\System\DcfUvEg.exe
  C:\Windows\System\DcfUvEg.exe
  2⤵
  PID:10492
- C:\Windows\System\YJQjreL.exe
  C:\Windows\System\YJQjreL.exe
  2⤵
  PID:10520
- C:\Windows\System\ddOWygz.exe
  C:\Windows\System\ddOWygz.exe
  2⤵
  PID:10536
- C:\Windows\System\KAYdzkH.exe
  C:\Windows\System\KAYdzkH.exe
  2⤵
  PID:10564
- C:\Windows\System\wANUNiT.exe
  C:\Windows\System\wANUNiT.exe
  2⤵
  PID:10592
- C:\Windows\System\OGJHutI.exe
  C:\Windows\System\OGJHutI.exe
  2⤵
  PID:10620
- C:\Windows\System\zsgogWn.exe
  C:\Windows\System\zsgogWn.exe
  2⤵
  PID:10636
- C:\Windows\System\CmGUwMq.exe
  C:\Windows\System\CmGUwMq.exe
  2⤵
  PID:10688
- C:\Windows\System\FBaFPqT.exe
  C:\Windows\System\FBaFPqT.exe
  2⤵
  PID:10704
- C:\Windows\System\lZfNsNF.exe
  C:\Windows\System\lZfNsNF.exe
  2⤵
  PID:10744
- C:\Windows\System\tnqUmFl.exe
  C:\Windows\System\tnqUmFl.exe
  2⤵
  PID:10772
- C:\Windows\System\kYniXjl.exe
  C:\Windows\System\kYniXjl.exe
  2⤵
  PID:10788
- C:\Windows\System\TpMShKb.exe
  C:\Windows\System\TpMShKb.exe
  2⤵
  PID:10808
- C:\Windows\System\vIQWfHx.exe
  C:\Windows\System\vIQWfHx.exe
  2⤵
  PID:10848
- C:\Windows\System\hAmXdEP.exe
  C:\Windows\System\hAmXdEP.exe
  2⤵
  PID:10872
- C:\Windows\System\rKYiutW.exe
  C:\Windows\System\rKYiutW.exe
  2⤵
  PID:10900
- C:\Windows\System\nbLvpwV.exe
  C:\Windows\System\nbLvpwV.exe
  2⤵
  PID:10928
- C:\Windows\System\aSvzGkn.exe
  C:\Windows\System\aSvzGkn.exe
  2⤵
  PID:10968
- C:\Windows\System\XrcbZjA.exe
  C:\Windows\System\XrcbZjA.exe
  2⤵
  PID:10984
- C:\Windows\System\xEsEALn.exe
  C:\Windows\System\xEsEALn.exe
  2⤵
  PID:11012
- C:\Windows\System\fqnKbWc.exe
  C:\Windows\System\fqnKbWc.exe
  2⤵
  PID:11040
- C:\Windows\System\SeNOxsS.exe
  C:\Windows\System\SeNOxsS.exe
  2⤵
  PID:11080
- C:\Windows\System\lFhpnwp.exe
  C:\Windows\System\lFhpnwp.exe
  2⤵
  PID:11108
- C:\Windows\System\LdQklNM.exe
  C:\Windows\System\LdQklNM.exe
  2⤵
  PID:11140
- C:\Windows\System\eytYKRV.exe
  C:\Windows\System\eytYKRV.exe
  2⤵
  PID:11168
- C:\Windows\System\JhRPRog.exe
  C:\Windows\System\JhRPRog.exe
  2⤵
  PID:11196
- C:\Windows\System\ziiGsIx.exe
  C:\Windows\System\ziiGsIx.exe
  2⤵
  PID:11212
- C:\Windows\System\IRdrHJQ.exe
  C:\Windows\System\IRdrHJQ.exe
  2⤵
  PID:11240
- C:\Windows\System\NHGYLnA.exe
  C:\Windows\System\NHGYLnA.exe
  2⤵
  PID:9612
- C:\Windows\System\cPpquSh.exe
  C:\Windows\System\cPpquSh.exe
  2⤵
  PID:10280
- C:\Windows\System\YdiBTuH.exe
  C:\Windows\System\YdiBTuH.exe
  2⤵
  PID:10348
- C:\Windows\System\FVAgQjt.exe
  C:\Windows\System\FVAgQjt.exe
  2⤵
  PID:10456
- C:\Windows\System\rWjtXBk.exe
  C:\Windows\System\rWjtXBk.exe
  2⤵
  PID:10512
- C:\Windows\System\CUFOUIc.exe
  C:\Windows\System\CUFOUIc.exe
  2⤵
  PID:10584
- C:\Windows\System\gsnuJyu.exe
  C:\Windows\System\gsnuJyu.exe
  2⤵
  PID:10632
- C:\Windows\System\trYJOEl.exe
  C:\Windows\System\trYJOEl.exe
  2⤵
  PID:10680
- C:\Windows\System\LGUEMRS.exe
  C:\Windows\System\LGUEMRS.exe
  2⤵
  PID:10756
- C:\Windows\System\zyuzieH.exe
  C:\Windows\System\zyuzieH.exe
  2⤵
  PID:10796
- C:\Windows\System\rRDfiDx.exe
  C:\Windows\System\rRDfiDx.exe
  2⤵
  PID:10884
- C:\Windows\System\oUFtLRc.exe
  C:\Windows\System\oUFtLRc.exe
  2⤵
  PID:10920
- C:\Windows\System\agyEHVl.exe
  C:\Windows\System\agyEHVl.exe
  2⤵
  PID:10980
- C:\Windows\System\FEpLFod.exe
  C:\Windows\System\FEpLFod.exe
  2⤵
  PID:11104
- C:\Windows\System\bwsdVCy.exe
  C:\Windows\System\bwsdVCy.exe
  2⤵
  PID:11152
- C:\Windows\System\SkKVrjR.exe
  C:\Windows\System\SkKVrjR.exe
  2⤵
  PID:11188
- C:\Windows\System\MzqBEim.exe
  C:\Windows\System\MzqBEim.exe
  2⤵
  PID:10248
- C:\Windows\System\ArMTqoP.exe
  C:\Windows\System\ArMTqoP.exe
  2⤵
  PID:10416
- C:\Windows\System\WBYCyBI.exe
  C:\Windows\System\WBYCyBI.exe
  2⤵
  PID:10556
- C:\Windows\System\fpVAPIj.exe
  C:\Windows\System\fpVAPIj.exe
  2⤵
  PID:10716
- C:\Windows\System\lkZSsHP.exe
  C:\Windows\System\lkZSsHP.exe
  2⤵
  PID:10856
- C:\Windows\System\ejyiFZL.exe
  C:\Windows\System\ejyiFZL.exe
  2⤵
  PID:11092
- C:\Windows\System\zKbMBIf.exe
  C:\Windows\System\zKbMBIf.exe
  2⤵
  PID:11228
- C:\Windows\System\TsxItAs.exe
  C:\Windows\System\TsxItAs.exe
  2⤵
  PID:10488
- C:\Windows\System\tUWXYXJ.exe
  C:\Windows\System\tUWXYXJ.exe
  2⤵
  PID:10888
- C:\Windows\System\JosSSZY.exe
  C:\Windows\System\JosSSZY.exe
  2⤵
  PID:11204
- C:\Windows\System\jDFwXhG.exe
  C:\Windows\System\jDFwXhG.exe
  2⤵
  PID:11028
- C:\Windows\System\HtivySr.exe
  C:\Windows\System\HtivySr.exe
  2⤵
  PID:9072
- C:\Windows\System\fUAbpET.exe
  C:\Windows\System\fUAbpET.exe
  2⤵
  PID:9088
- C:\Windows\System\mBYeitW.exe
  C:\Windows\System\mBYeitW.exe
  2⤵
  PID:11304
- C:\Windows\System\mxdeaKF.exe
  C:\Windows\System\mxdeaKF.exe
  2⤵
  PID:11320
- C:\Windows\System\ZniTjDK.exe
  C:\Windows\System\ZniTjDK.exe
  2⤵
  PID:11336
- C:\Windows\System\rBqUPue.exe
  C:\Windows\System\rBqUPue.exe
  2⤵
  PID:11360
- C:\Windows\System\QltnTwY.exe
  C:\Windows\System\QltnTwY.exe
  2⤵
  PID:11392
- C:\Windows\System\NWHfgRo.exe
  C:\Windows\System\NWHfgRo.exe
  2⤵
  PID:11420
- C:\Windows\System\HldXzlq.exe
  C:\Windows\System\HldXzlq.exe
  2⤵
  PID:11444
- C:\Windows\System\YSpKlfz.exe
  C:\Windows\System\YSpKlfz.exe
  2⤵
  PID:11464
- C:\Windows\System\YZQvTYq.exe
  C:\Windows\System\YZQvTYq.exe
  2⤵
  PID:11516
- C:\Windows\System\VHovRog.exe
  C:\Windows\System\VHovRog.exe
  2⤵
  PID:11532
- C:\Windows\System\oCBuuVf.exe
  C:\Windows\System\oCBuuVf.exe
  2⤵
  PID:11572
- C:\Windows\System\tovOjpg.exe
  C:\Windows\System\tovOjpg.exe
  2⤵
  PID:11588
- C:\Windows\System\fTbnPwl.exe
  C:\Windows\System\fTbnPwl.exe
  2⤵
  PID:11628
- C:\Windows\System\rPjgfSQ.exe
  C:\Windows\System\rPjgfSQ.exe
  2⤵
  PID:11644
- C:\Windows\System\HnbuezM.exe
  C:\Windows\System\HnbuezM.exe
  2⤵
  PID:11676
- C:\Windows\System\jldZyBt.exe
  C:\Windows\System\jldZyBt.exe
  2⤵
  PID:11700
- C:\Windows\System\rtAmjph.exe
  C:\Windows\System\rtAmjph.exe
  2⤵
  PID:11736
- C:\Windows\System\GoEsiss.exe
  C:\Windows\System\GoEsiss.exe
  2⤵
  PID:11756
- C:\Windows\System\NdBHdWD.exe
  C:\Windows\System\NdBHdWD.exe
  2⤵
  PID:11784
- C:\Windows\System\rIpYtZA.exe
  C:\Windows\System\rIpYtZA.exe
  2⤵
  PID:11820
- C:\Windows\System\KuLKsWS.exe
  C:\Windows\System\KuLKsWS.exe
  2⤵
  PID:11852
- C:\Windows\System\WWQahBc.exe
  C:\Windows\System\WWQahBc.exe
  2⤵
  PID:11876
- C:\Windows\System\ldTdJdL.exe
  C:\Windows\System\ldTdJdL.exe
  2⤵
  PID:11896
- C:\Windows\System\cSiXpUw.exe
  C:\Windows\System\cSiXpUw.exe
  2⤵
  PID:11924
- C:\Windows\System\IyFAUCV.exe
  C:\Windows\System\IyFAUCV.exe
  2⤵
  PID:11952
- C:\Windows\System\jQnJmbC.exe
  C:\Windows\System\jQnJmbC.exe
  2⤵
  PID:11968
- C:\Windows\System\vHvAmro.exe
  C:\Windows\System\vHvAmro.exe
  2⤵
  PID:12004
- C:\Windows\System\jZDMrQG.exe
  C:\Windows\System\jZDMrQG.exe
  2⤵
  PID:12036
- C:\Windows\System\pjKnObA.exe
  C:\Windows\System\pjKnObA.exe
  2⤵
  PID:12056
- C:\Windows\System\PTNezAW.exe
  C:\Windows\System\PTNezAW.exe
  2⤵
  PID:12092
- C:\Windows\System\mHCYgme.exe
  C:\Windows\System\mHCYgme.exe
  2⤵
  PID:12120
- C:\Windows\System\twDnwCI.exe
  C:\Windows\System\twDnwCI.exe
  2⤵
  PID:12164
- C:\Windows\System\ZTSATQq.exe
  C:\Windows\System\ZTSATQq.exe
  2⤵
  PID:12180
- C:\Windows\System\saFFhOI.exe
  C:\Windows\System\saFFhOI.exe
  2⤵
  PID:12220
- C:\Windows\System\gpPEBUF.exe
  C:\Windows\System\gpPEBUF.exe
  2⤵
  PID:12236
- C:\Windows\System\dMZanua.exe
  C:\Windows\System\dMZanua.exe
  2⤵
  PID:12264
- C:\Windows\System\nxqKWUs.exe
  C:\Windows\System\nxqKWUs.exe
  2⤵
  PID:12280
- C:\Windows\System\bdkhcOK.exe
  C:\Windows\System\bdkhcOK.exe
  2⤵
  PID:11300
- C:\Windows\System\eDAvNud.exe
  C:\Windows\System\eDAvNud.exe
  2⤵
  PID:11332
- C:\Windows\System\BLjgsIl.exe
  C:\Windows\System\BLjgsIl.exe
  2⤵
  PID:11372
- C:\Windows\System\BaGudgJ.exe
  C:\Windows\System\BaGudgJ.exe
  2⤵
  PID:11480
- C:\Windows\System\LjkeMoI.exe
  C:\Windows\System\LjkeMoI.exe
  2⤵
  PID:11528
- C:\Windows\System\ipJFNQO.exe
  C:\Windows\System\ipJFNQO.exe
  2⤵
  PID:11580
- C:\Windows\System\UoHWcEa.exe
  C:\Windows\System\UoHWcEa.exe
  2⤵
  PID:11640
- C:\Windows\System\GlNEdQl.exe
  C:\Windows\System\GlNEdQl.exe
  2⤵
  PID:11728
- C:\Windows\System\yVWjmFb.exe
  C:\Windows\System\yVWjmFb.exe
  2⤵
  PID:11816
- C:\Windows\System\TNBdxin.exe
  C:\Windows\System\TNBdxin.exe
  2⤵
  PID:11892
- C:\Windows\System\kyxQGzs.exe
  C:\Windows\System\kyxQGzs.exe
  2⤵
  PID:11912
- C:\Windows\System\ArnWZJA.exe
  C:\Windows\System\ArnWZJA.exe
  2⤵
  PID:12032
- C:\Windows\System\RonyyNv.exe
  C:\Windows\System\RonyyNv.exe
  2⤵
  PID:12076
- C:\Windows\System\SQaErTr.exe
  C:\Windows\System\SQaErTr.exe
  2⤵
  PID:12160
- C:\Windows\System\KymmUfX.exe
  C:\Windows\System\KymmUfX.exe
  2⤵
  PID:10400
- C:\Windows\System\RmhOfIw.exe
  C:\Windows\System\RmhOfIw.exe
  2⤵
  PID:12252
- C:\Windows\System\dukYpCI.exe
  C:\Windows\System\dukYpCI.exe
  2⤵
  PID:12276
- C:\Windows\System\WnZQkMZ.exe
  C:\Windows\System\WnZQkMZ.exe
  2⤵
  PID:11384
- C:\Windows\System\zmGDnIa.exe
  C:\Windows\System\zmGDnIa.exe
  2⤵
  PID:11460
- C:\Windows\System\sAUbbGS.exe
  C:\Windows\System\sAUbbGS.exe
  2⤵
  PID:11660
- C:\Windows\System\OgKNShi.exe
  C:\Windows\System\OgKNShi.exe
  2⤵
  PID:11872
- C:\Windows\System\JgBDEGL.exe
  C:\Windows\System\JgBDEGL.exe
  2⤵
  PID:12112
- C:\Windows\System\pVzFlgU.exe
  C:\Windows\System\pVzFlgU.exe
  2⤵
  PID:12248
- C:\Windows\System\NELMdEI.exe
  C:\Windows\System\NELMdEI.exe
  2⤵
  PID:11440
- C:\Windows\System\lLZFArL.exe
  C:\Windows\System\lLZFArL.exe
  2⤵
  PID:11992
- C:\Windows\System\gnoCcEZ.exe
  C:\Windows\System\gnoCcEZ.exe
  2⤵
  PID:12052
- C:\Windows\System\xrunDUQ.exe
  C:\Windows\System\xrunDUQ.exe
  2⤵
  PID:11696
- C:\Windows\System\EfCsHIc.exe
  C:\Windows\System\EfCsHIc.exe
  2⤵
  PID:9588
- C:\Windows\System\vXSupTb.exe
  C:\Windows\System\vXSupTb.exe
  2⤵
  PID:12324
- C:\Windows\System\KiSplhO.exe
  C:\Windows\System\KiSplhO.exe
  2⤵
  PID:12340
- C:\Windows\System\BbIamOA.exe
  C:\Windows\System\BbIamOA.exe
  2⤵
  PID:12380
- C:\Windows\System\RvAxavn.exe
  C:\Windows\System\RvAxavn.exe
  2⤵
  PID:12408
- C:\Windows\System\VynZbaG.exe
  C:\Windows\System\VynZbaG.exe
  2⤵
  PID:12428
- C:\Windows\System\iMWmmDR.exe
  C:\Windows\System\iMWmmDR.exe
  2⤵
  PID:12456
- C:\Windows\System\xfmcgWk.exe
  C:\Windows\System\xfmcgWk.exe
  2⤵
  PID:12504
- C:\Windows\System\DPNnMSD.exe
  C:\Windows\System\DPNnMSD.exe
  2⤵
  PID:12536
- C:\Windows\System\maLKjcV.exe
  C:\Windows\System\maLKjcV.exe
  2⤵
  PID:12568
- C:\Windows\System\cmmCKjR.exe
  C:\Windows\System\cmmCKjR.exe
  2⤵
  PID:12596
- C:\Windows\System\WVMdBLG.exe
  C:\Windows\System\WVMdBLG.exe
  2⤵
  PID:12624
- C:\Windows\System\KAEYspp.exe
  C:\Windows\System\KAEYspp.exe
  2⤵
  PID:12664
- C:\Windows\System\mkDQsef.exe
  C:\Windows\System\mkDQsef.exe
  2⤵
  PID:12692
- C:\Windows\System\MIzastf.exe
  C:\Windows\System\MIzastf.exe
  2⤵
  PID:12720
- C:\Windows\System\ArcRptA.exe
  C:\Windows\System\ArcRptA.exe
  2⤵
  PID:12748
- C:\Windows\System\gUIjeVb.exe
  C:\Windows\System\gUIjeVb.exe
  2⤵
  PID:12776
- C:\Windows\System\UzMFJtc.exe
  C:\Windows\System\UzMFJtc.exe
  2⤵
  PID:12796
- C:\Windows\System\OUrzdCU.exe
  C:\Windows\System\OUrzdCU.exe
  2⤵
  PID:12820
- C:\Windows\System\AiUcZPq.exe
  C:\Windows\System\AiUcZPq.exe
  2⤵
  PID:12840
- C:\Windows\System\ahjTRvU.exe
  C:\Windows\System\ahjTRvU.exe
  2⤵
  PID:12868
- C:\Windows\System\bimiqDf.exe
  C:\Windows\System\bimiqDf.exe
  2⤵
  PID:12904
- C:\Windows\System\dZHiUgv.exe
  C:\Windows\System\dZHiUgv.exe
  2⤵
  PID:12936
- C:\Windows\System\kbNKXxt.exe
  C:\Windows\System\kbNKXxt.exe
  2⤵
  PID:12960
- C:\Windows\System\OYvJqBi.exe
  C:\Windows\System\OYvJqBi.exe
  2⤵
  PID:13000
- C:\Windows\System\oSVlPOl.exe
  C:\Windows\System\oSVlPOl.exe
  2⤵
  PID:13016
- C:\Windows\System\BoDLmbU.exe
  C:\Windows\System\BoDLmbU.exe
  2⤵
  PID:13044
- C:\Windows\System\owmDGMk.exe
  C:\Windows\System\owmDGMk.exe
  2⤵
  PID:13068
- C:\Windows\System\NsCmSZG.exe
  C:\Windows\System\NsCmSZG.exe
  2⤵
  PID:13104
- C:\Windows\System\EQOXZQI.exe
  C:\Windows\System\EQOXZQI.exe
  2⤵
  PID:13132
- C:\Windows\System\SWCfyCz.exe
  C:\Windows\System\SWCfyCz.exe
  2⤵
  PID:13168
- C:\Windows\System\rwliOgO.exe
  C:\Windows\System\rwliOgO.exe
  2⤵
  PID:13196
- C:\Windows\System\UpGwTPz.exe
  C:\Windows\System\UpGwTPz.exe
  2⤵
  PID:13224
- C:\Windows\System\BSvOqyI.exe
  C:\Windows\System\BSvOqyI.exe
  2⤵
  PID:13256
- C:\Windows\System\vHJMhrw.exe
  C:\Windows\System\vHJMhrw.exe
  2⤵
  PID:13276
- C:\Windows\System\riLfuXh.exe
  C:\Windows\System\riLfuXh.exe
  2⤵
  PID:11768
- C:\Windows\System\zTlclRe.exe
  C:\Windows\System\zTlclRe.exe
  2⤵
  PID:12368
- C:\Windows\System\xASctzL.exe
  C:\Windows\System\xASctzL.exe
  2⤵
  PID:12440
- C:\Windows\System\xJTLWDC.exe
  C:\Windows\System\xJTLWDC.exe
  2⤵
  PID:12492
- C:\Windows\System\fnmoWwR.exe
  C:\Windows\System\fnmoWwR.exe
  2⤵
  PID:12580
- C:\Windows\System\gpHNjdn.exe
  C:\Windows\System\gpHNjdn.exe
  2⤵
  PID:12644
- C:\Windows\System\aymAZUR.exe
  C:\Windows\System\aymAZUR.exe
  2⤵
  PID:12704
- C:\Windows\System\TexRmgV.exe
  C:\Windows\System\TexRmgV.exe
  2⤵
  PID:12736
- C:\Windows\System\efpPGZq.exe
  C:\Windows\System\efpPGZq.exe
  2⤵
  PID:12808
- C:\Windows\System\pNfKbRv.exe
  C:\Windows\System\pNfKbRv.exe
  2⤵
  PID:12892
- C:\Windows\System\ZYJPHwj.exe
  C:\Windows\System\ZYJPHwj.exe
  2⤵
  PID:12988
- C:\Windows\System\vzsoCdF.exe
  C:\Windows\System\vzsoCdF.exe
  2⤵
  PID:13032
- C:\Windows\System\omosqtZ.exe
  C:\Windows\System\omosqtZ.exe
  2⤵
  PID:13112
- C:\Windows\System\HlKMLuV.exe
  C:\Windows\System\HlKMLuV.exe
  2⤵
  PID:3052
- C:\Windows\System\gJIJqFx.exe
  C:\Windows\System\gJIJqFx.exe
  2⤵
  PID:11692
- C:\Windows\System\IbmuGLf.exe
  C:\Windows\System\IbmuGLf.exe
  2⤵
  PID:13244
- C:\Windows\System\VtsNsul.exe
  C:\Windows\System\VtsNsul.exe
  2⤵
  PID:13292
- C:\Windows\System\kRxufyW.exe
  C:\Windows\System\kRxufyW.exe
  2⤵
  PID:12404
- C:\Windows\System\HaMNpQO.exe
  C:\Windows\System\HaMNpQO.exe
  2⤵
  PID:12528
- C:\Windows\System\qRyOBuY.exe
  C:\Windows\System\qRyOBuY.exe
  2⤵
  PID:12620
- C:\Windows\System\dqXorBO.exe
  C:\Windows\System\dqXorBO.exe
  2⤵
  PID:12760
- C:\Windows\System\ZnSHyrw.exe
  C:\Windows\System\ZnSHyrw.exe
  2⤵
  PID:12980
- C:\Windows\System\qCrDOuo.exe
  C:\Windows\System\qCrDOuo.exe
  2⤵
  PID:13080
- C:\Windows\System\OfNiAQk.exe
  C:\Windows\System\OfNiAQk.exe
  2⤵
  PID:12352
- C:\Windows\System\nWyVSoE.exe
  C:\Windows\System\nWyVSoE.exe
  2⤵
  PID:12744
- C:\Windows\System\isgcGih.exe
  C:\Windows\System\isgcGih.exe
  2⤵
  PID:13028
- C:\Windows\System\KFWpORr.exe
  C:\Windows\System\KFWpORr.exe
  2⤵
  PID:13188
- C:\Windows\System\HynfyNG.exe
  C:\Windows\System\HynfyNG.exe
  2⤵
  PID:13140
- C:\Windows\System\ORwJqke.exe
  C:\Windows\System\ORwJqke.exe
  2⤵
  PID:13336
- C:\Windows\System\IotbhJs.exe
  C:\Windows\System\IotbhJs.exe
  2⤵
  PID:13380
- C:\Windows\System\VeccfXY.exe
  C:\Windows\System\VeccfXY.exe
  2⤵
  PID:13396
- C:\Windows\System\qnSrHFx.exe
  C:\Windows\System\qnSrHFx.exe
  2⤵
  PID:13412
- C:\Windows\System\NRVdNxX.exe
  C:\Windows\System\NRVdNxX.exe
  2⤵
  PID:13440
- C:\Windows\System\ANSOlxp.exe
  C:\Windows\System\ANSOlxp.exe
  2⤵
  PID:13488
- C:\Windows\System\NEQSfLb.exe
  C:\Windows\System\NEQSfLb.exe
  2⤵
  PID:13520
- C:\Windows\System\NhtnEPA.exe
  C:\Windows\System\NhtnEPA.exe
  2⤵
  PID:13548
- C:\Windows\System\EeHxBuL.exe
  C:\Windows\System\EeHxBuL.exe
  2⤵
  PID:13576
- C:\Windows\System\UgaiLtL.exe
  C:\Windows\System\UgaiLtL.exe
  2⤵
  PID:13592
- C:\Windows\System\MZtvMij.exe
  C:\Windows\System\MZtvMij.exe
  2⤵
  PID:13612
- C:\Windows\System\ckHSEeR.exe
  C:\Windows\System\ckHSEeR.exe
  2⤵
  PID:13660
- C:\Windows\System\pjbGpEE.exe
  C:\Windows\System\pjbGpEE.exe
  2⤵
  PID:13680
- C:\Windows\System\DqarzFF.exe
  C:\Windows\System\DqarzFF.exe
  2⤵
  PID:13704
- C:\Windows\System\fUSHRvI.exe
  C:\Windows\System\fUSHRvI.exe
  2⤵
  PID:13732
- C:\Windows\System\PbxDtqZ.exe
  C:\Windows\System\PbxDtqZ.exe
  2⤵
  PID:13748
- C:\Windows\System\QdjJJOW.exe
  C:\Windows\System\QdjJJOW.exe
  2⤵
  PID:13776
- C:\Windows\System\ZNdXmPP.exe
  C:\Windows\System\ZNdXmPP.exe
  2⤵
  PID:13800
- C:\Windows\System\YmCUKxf.exe
  C:\Windows\System\YmCUKxf.exe
  2⤵
  PID:13844
- C:\Windows\System\jrZzuiL.exe
  C:\Windows\System\jrZzuiL.exe
  2⤵
  PID:13872
- C:\Windows\System\aiGdkYE.exe
  C:\Windows\System\aiGdkYE.exe
  2⤵
  PID:13892
- C:\Windows\System\fAmiIyt.exe
  C:\Windows\System\fAmiIyt.exe
  2⤵
  PID:13932
- C:\Windows\System\yhktdxM.exe
  C:\Windows\System\yhktdxM.exe
  2⤵
  PID:13956
- C:\Windows\System\ZGKQitA.exe
  C:\Windows\System\ZGKQitA.exe
  2⤵
  PID:13972
- C:\Windows\System\PThJOWp.exe
  C:\Windows\System\PThJOWp.exe
  2⤵
  PID:14008
- C:\Windows\System\itRZCYB.exe
  C:\Windows\System\itRZCYB.exe
  2⤵
  PID:14036
- C:\Windows\System\yMNGPcn.exe
  C:\Windows\System\yMNGPcn.exe
  2⤵
  PID:14080
- C:\Windows\System\GgjyiMy.exe
  C:\Windows\System\GgjyiMy.exe
  2⤵
  PID:14108
- C:\Windows\System\CkGzsbq.exe
  C:\Windows\System\CkGzsbq.exe
  2⤵
  PID:14136
- C:\Windows\System\zGAiNOo.exe
  C:\Windows\System\zGAiNOo.exe
  2⤵
  PID:14180
- C:\Windows\System\NYSDUNl.exe
  C:\Windows\System\NYSDUNl.exe
  2⤵
  PID:14196
- C:\Windows\System\vJdaMYV.exe
  C:\Windows\System\vJdaMYV.exe
  2⤵
  PID:14224
- C:\Windows\System\nnLJePt.exe
  C:\Windows\System\nnLJePt.exe
  2⤵
  PID:14252
- C:\Windows\System\yZHkTUy.exe
  C:\Windows\System\yZHkTUy.exe
  2⤵
  PID:14280
- C:\Windows\System\IQalpxH.exe
  C:\Windows\System\IQalpxH.exe
  2⤵
  PID:14300
- C:\Windows\System\FLYsivZ.exe
  C:\Windows\System\FLYsivZ.exe
  2⤵
  PID:14328
- C:\Windows\System\phDorEb.exe
  C:\Windows\System\phDorEb.exe
  2⤵
  PID:12944
- C:\Windows\System\QNeXnIR.exe
  C:\Windows\System\QNeXnIR.exe
  2⤵
  PID:13392
- C:\Windows\System\iSwDwQn.exe
  C:\Windows\System\iSwDwQn.exe
  2⤵
  PID:13496
- C:\Windows\System\RQfEpjH.exe
  C:\Windows\System\RQfEpjH.exe
  2⤵
  PID:13532
- C:\Windows\System\YeOCRVn.exe
  C:\Windows\System\YeOCRVn.exe
  2⤵
  PID:13588
- C:\Windows\System\dEAICiD.exe
  C:\Windows\System\dEAICiD.exe
  2⤵
  PID:13688
- C:\Windows\System\TBHXWgj.exe
  C:\Windows\System\TBHXWgj.exe
  2⤵
  PID:13740
- C:\Windows\System\muiEsVK.exe
  C:\Windows\System\muiEsVK.exe
  2⤵
  PID:13792
- C:\Windows\System\urpRwhe.exe
  C:\Windows\System\urpRwhe.exe
  2⤵
  PID:4216
- C:\Windows\System\GReqkQy.exe
  C:\Windows\System\GReqkQy.exe
  2⤵
  PID:13928
- C:\Windows\System\atdKVPZ.exe
  C:\Windows\System\atdKVPZ.exe
  2⤵
  PID:13964
- C:\Windows\System\oeBoDrA.exe
  C:\Windows\System\oeBoDrA.exe
  2⤵
  PID:14072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AkcETzB.exe

Filesize
2.1MB

MD5
c4c790b85347250b85116c563863d90f

SHA1
abc09424f53c746c108cf3e17c8b22088f131a42

SHA256
5367067680f49136ce1a6c9d0ff984e2df03aebacd0a8031fae1752fe5a477c9

SHA512
568a494cf45be57e596145ca3a095d6d154558e6ac7f88e0c8411de3afa93b6440d622ccffcecbc5dc2d3efa6da50e38837f7a86e9c3c832c1694539cd90cc25

Download Submit
C:\Windows\System\CHsFnQr.exe

Filesize
2.1MB

MD5
4ef3fa90bc71710a6e3d04822b26a9fe

SHA1
99f17e1116ec4df85a4b65ea4b69b5c2e66a995b

SHA256
32d6a17ca743795ea92ae432fe6ab1d17cf2f0272983845ace946feb864b2e26

SHA512
11be21ad4e05f8bff90863bccbd199478e583ff21dc59967eac922f9449df413e4dd7789aab9d65f24d6c2f252f610f23361999ee7409d5b28fcf46fb57c09a3

Download Submit
C:\Windows\System\Dmecozt.exe

Filesize
2.1MB

MD5
236a298ae3afb3eabf23d1e8103ed65c

SHA1
23a56adb6e0f36ebf0b0f33f04c612d00f46d137

SHA256
2bb8cb90c981fb3483ff673295a6086d4464cad870add614f45478cb8f23d8f7

SHA512
9d2b9ce6028903bd7456e2cf74a61af3c5d8d6deb74fd830d0faf7b8c22305310a758f5e9c645fdc602fecc0bda1772d3b45f90a83ecb79ccc7faae8f48e1843

Download Submit
C:\Windows\System\FLmjIKc.exe

Filesize
2.1MB

MD5
1f70c008445f263ec31a7a30af32203e

SHA1
11d0e43112b8baecf4acf86860d8a37d690fc320

SHA256
7b599439c776206fb79cd72b4b361583c788656eeee7b284b99616257e6264dc

SHA512
b547a455da38f8f7cdf746e48b156729bf0bf28075c7c2ce617cae41602115e8dbb1414cb061042a86e47635aefcc92744d19e6edf34259a44033a5d24ce2c8a

Download Submit
C:\Windows\System\GgHPMJQ.exe

Filesize
2.1MB

MD5
493f207e7b291f7bd2a8949f89952fc1

SHA1
6068d92712aed05b149cf1d1ef07a80443755ef0

SHA256
1c05339e76563591b0c64da6e27675ed3245756b7af37c6f911bee21446dcd3b

SHA512
7a01a3f9622ab79d591b42b0227a31fe0c7acfd50991e1ed317edbb1b61d80b4ab82e1fb2b29d7d770ac57b11669531f96a4aac77b63fa541f36d5f440b69f29

Download Submit
C:\Windows\System\Jeutilv.exe

Filesize
2.1MB

MD5
a9808da1ae4156fe1bcdadac8201c02b

SHA1
97ef7aabd73ba2dd5ba37fbf12037e7c883ceb5d

SHA256
50ed3d401a4b755321a6debb922d6cb45161cbe1129c4ed491d42f04726304b6

SHA512
803d2b3e3a44c5e4e8a3e5792269542c88a508611eb56cb5734ef73da8b944d4de28bf7e3928e6b3f526bc26b5ea82762815b00a250a52f21bc7d0a11c02fe88

Download Submit
C:\Windows\System\JewGPYr.exe

Filesize
2.1MB

MD5
579035ae9e28f822ed2e1a9055f30c0e

SHA1
2c4d00de7192272fa2271df146f0387d2d537f76

SHA256
ad9e70d3cef5e138bc5f5502a31e112740187096b98b5cc4418716ae6f2a608e

SHA512
de0aa6283b35181a46ee26447f79e690cca505a9512f4072cd93d5561d3bd1ef211a9c127f1eaa79d118f682171da0645adff3f29748b1c1db1be3add59756f4

Download Submit
C:\Windows\System\KySjMXL.exe

Filesize
2.1MB

MD5
87bd7f8a0e99e74677c559b01cc00f0b

SHA1
eef75d5318f4148d22396de18d771683ac4fd9af

SHA256
22ac494342cd7a8495b305b729238f3d3dead67d267f22c8bfe8aa2bae6ce93b

SHA512
9f3f3ebcfe38dc13044285d6dc30389960665fe1f24f4fff16a5c8ac94581c3305cc0d461426d94cd4382ee7eabbb025dec02760c52d01337efa25b388f4e30a

Download Submit
C:\Windows\System\MpAhiDj.exe

Filesize
2.1MB

MD5
01017b200d2c9a589b1ea2e9393ad203

SHA1
1f80767e80cf1087fc7116d90642914cc1263cf5

SHA256
c51e15d33f330643668fdf9170782991a9b2628e5175ad833e26835949849b7e

SHA512
7b1993e45ca868f8de9723e97cc62b753594b3ce3efc2f15e69b0345dba598b6208ca4959da04a92f0d5b1d758416b3132c02271b5ae521e2105d64337440fc2

Download Submit
C:\Windows\System\OYhoNSO.exe

Filesize
2.1MB

MD5
2f23830ef8dac28f6530555317b3f6e2

SHA1
f91c0750abe83efab1d4cd349c1f31bd156e88a3

SHA256
8adada5fab28b8ff15af00a5174cad1d2d3d71e0a7bf2fa2bf68e1ad98103ffd

SHA512
d276922d57d2265746a3c570bad6caa2f9dd28493c3a87de9dc4073c891c0689e8734f1b58c8b99c20bcdf40373b220a8e8844402c029be147827cb9178dd211

Download Submit
C:\Windows\System\PZgxHJU.exe

Filesize
2.1MB

MD5
e4ba4320324f50348ee846286408d573

SHA1
8040cad22f99ac1f8f4f09b1ce4658168f213927

SHA256
4c04d596ff33e0f28021a38886dc1f9f5921314f14897e6d482abb732c4f7c22

SHA512
90fe80994037f48fea192b2c2c703dae7c32151b2dd162c6fcd7cebbddf6406492d9abe88b814ef9c65ea8901ac12aef5a1b0ca5609f6ef13d20eaae8613da1a

Download Submit
C:\Windows\System\PtYJJAj.exe

Filesize
2.1MB

MD5
5f7cc7416fc74bebceebc2bab2bf830e

SHA1
05af74e61a1b5b8126a4e99c26de29b6ede34b93

SHA256
edd12562aac7f7e503ff1a78f9ae551003e5a213eb7f11ec9db38ec0c33a1c36

SHA512
c1e446ee5d2d912845c71ce45714bd493a815f567ee19683c3db1466d5808b6f6380de6d034d354bdccdf021b27207b2daea5723041009b99dcf7cfb5f08b0a6

Download Submit
C:\Windows\System\QpOYuRL.exe

Filesize
2.1MB

MD5
8acf3ad821e74a85db1304ceaf0cb92f

SHA1
5d294be5f1823d14b7faa124c48915e43e144afd

SHA256
e049e972884c5aee8690179674fdf5879bceafcf0968bcad606b3d07ba8baeee

SHA512
86694e0843c7a26414032c34d3e289b9977ef95ead73a21daf3612fe1c8344452daf5768f496acde9e2f3e717c23cd062a98c9a882db2fae5f2b5c4a701001d7

Download Submit
C:\Windows\System\SEDhYZZ.exe

Filesize
2.1MB

MD5
b7887bf0c706fc9aaae7272632523247

SHA1
5abc3f9bd193789b43e309f771e20b61cd570a2a

SHA256
185dfc889af941420606231379b60c5620b28d3495de2d41770fb7af24be44e6

SHA512
e7490b41115ac4fc80ca12a95e1aeb68b40ddd28cf8bc69763dc0c5c9d7d7b9ac4ea744843f1e7242b9d3fed5fe7d595333f4fa981b624033a10db899f8d0d84

Download Submit
C:\Windows\System\SxZOgHs.exe

Filesize
2.1MB

MD5
2f51ef92fa489e4a53b0b1132c56d4e5

SHA1
a75faa73cfc6cdb86bfcfea6e603197d32fe24f9

SHA256
1c6e31f21374584759bbf7fadd8a8ed96dbdcdccc839c9c20e0baa0d20647ff8

SHA512
09647308f407383f25ae2778b5fec67ea2f9b48cb3a87766483e68360806e57f4bd7f3bec554ce956121a5bbe927c618853f397bfb56b13f780c0fc34bb3e5a4

Download Submit
C:\Windows\System\TZQTFtG.exe

Filesize
2.1MB

MD5
778e0065107a11035498fa85eeea644c

SHA1
84ce3ab4be3bb955a147596e8b770363cb6d2c2e

SHA256
9cecd3b55b966bde84fb433634c0d17a24e7613b35333e5ef1ada3e10d0c7684

SHA512
7314f08cc59fbdb7526204b029c020e75ac81b13b42d2d53a3610b1924337c00b860638d83a422927c235246b06e5ce2b8812cde9c67b7611566ba40b7e40e3a

Download Submit
C:\Windows\System\UZXAuEu.exe

Filesize
2.1MB

MD5
7d79378a61e8dc237eb3e7013b9bded2

SHA1
2aacb72347335a93ad71542efbe7279806b0813d

SHA256
c3954f0df33b879b7f55604e083ecd0052299614928a0a49b2cc7fae195200e0

SHA512
82c816e4c7e82c4f232ae7f9e9e752649808b90719557fa8fa81ec5a1b5920a1156a0da7d8d0c49fae254383693b108674962b1b568870437cad8f6e9d130745

Download Submit
C:\Windows\System\UczbpfC.exe

Filesize
2.1MB

MD5
110bce3bb582e197903892c7592b741a

SHA1
97688b1c1ebebfa46045f90d536fd613076ea703

SHA256
cc53d44c16c2a997cb75cce3465250c33ac903b0a75b28f4f236fa7c9b7da6b3

SHA512
9d68b8cf7772d49fe4734b7b5881b82f16f913ce2da69d62060232ebc1454181c58cf498d310286e6b468d4a8a1b073321b63a4cc4ba9609d052d652312579b3

Download Submit
C:\Windows\System\WAODnYQ.exe

Filesize
2.1MB

MD5
b1ab35eff356186d4f32c9119c578995

SHA1
9c082ab4228eafd4f89b8f102333531766ce78a6

SHA256
ee829df381a43f876a45cf4cc53ab8f56cb7e6539e9a477f1d07e7a679ea3934

SHA512
d2ea0723ad123e44c97bf1ec765a9148f8b8971c93f5a2af3ee888ec5dff50ee33d339016151deb12acb3c74530e29577e98e5b364a7ec8fc95f263261b39343

Download Submit
C:\Windows\System\XEoDyPn.exe

Filesize
2.1MB

MD5
72e7b064ea9d1fcde4dfd95051fd9bfd

SHA1
56ac7d9bad7b01e7e5c288b4fe9d0ee9babd19a2

SHA256
0ddf4278d44e17e84f17e75a7faad72bd5b4692f436bf0e7b56079c4a1d97687

SHA512
348cfba7cd56c15a56e371141e6b5e2386540adfa9df59bb437a66c568be27664b405b524cb55bb529f5b229073d7bfb051b535d13b6d5a7fabf8e028fc38762

Download Submit
C:\Windows\System\YXOJItZ.exe

Filesize
2.1MB

MD5
020e6932480f342fde08c4080e15809a

SHA1
02c892ad9204adfdf9110f02e77f71bb26117507

SHA256
9a4090af3056d53451308daf526a80f2261c1a059d4e186b78e21408c7af84c6

SHA512
695a250c00a6332e678450f9d17b3c6d246be45fb1f3082dc133bdc2c0ac73affe6ac1140db3ca14bfa9a9a86f57fd01e79cffdaeba0b2d44b85652adc41ac46

Download Submit
C:\Windows\System\ZWAOGJM.exe

Filesize
2.1MB

MD5
ef498f986bad1210d4f6a130ea29b105

SHA1
41deb2be65d0a67a4584283fe1a261e1c2cae271

SHA256
1cd69fd85d62ae78cf20e40bb71964aea8ac3f61e919c192d466ecf683f685d1

SHA512
daa91ec86094c8d90d441ce16d17a9e26c9f42cee46194018bbad1917ca0af51eb70f8dda29facf5902aa290f2cf39093db1c81f9ff781edc77a9f04145c9498

Download Submit
C:\Windows\System\bTOyivW.exe

Filesize
2.1MB

MD5
93cc0185c68437c766540dcd410613cf

SHA1
6c90f72ce479e63e3b7cc424dce9e2d6c4d0d0a0

SHA256
edb434125fee66a4f11796b3d48121d788c973383356b959cc19d5b5298ffb74

SHA512
6e827f25f0c92993128acc7e01e57acb685d7399bcb458ca9a1f15f52372bc4b7bbd5a33187278e7a56afe41ff1b5de1b5071190f1f8815376a4ddd60b5695d9

Download Submit
C:\Windows\System\cZqDCcz.exe

Filesize
2.1MB

MD5
0693644fb99400bd527258de24d616b6

SHA1
80e5f4ffcf4263f6e0a1602f552f132b15ae8e8f

SHA256
83a01cba13f3894d8c572350fd90e716e3c01a5f58c5344854f1086ce3cb67d1

SHA512
8eb26778be96cf151376530449a8867dc82cf98f89a22f66a48e709870249c460d3ddde7d1f3f24dcd31b2c7c4de58d0cd152e14a37d0b86d0c66cf7e2c01f67

Download Submit
C:\Windows\System\eaksmOc.exe

Filesize
2.1MB

MD5
6e8f06397a1947f25965b4216a111ab4

SHA1
2bdc2eaaeadcd65ef90d985f8e61a31bbbdcb36e

SHA256
738416e137f7001ad12edd19458cbd3d3f9d15a7a5962d919a74faa4aa6b4405

SHA512
59dec81bfc84f6b1ab33322e0e23734b269ec6efcae878a0d49162f6f5f62a42d930c3419b5493fb761686c7486fb7959d7e0b488bab235bd2d4450f4c69b881

Download Submit
C:\Windows\System\jnblKeD.exe

Filesize
2.1MB

MD5
455f3386207f1f694bdf2501d7cc634a

SHA1
908be74b942415c288f0f1c57f09b094f9df79ba

SHA256
0c907ff2c04c72a3013120de94089ad29477c624786c4f2276949b1a7459dc4d

SHA512
069c7c37efece28cf742e0fa17bb2f2098797cabe311529cdbcb59d789d7656ea000a7ff7950f4963e37a4f59b8da8e4bfea95d498599f6d142cec840dde1b27

Download Submit
C:\Windows\System\mzcrnLj.exe

Filesize
2.1MB

MD5
b345bba8ceeff399d9ee2d61ebd2e821

SHA1
24da68fc8b0fda204902660568488530a02fb8e3

SHA256
ba9d7bceeb1633f6b9175fcc82995f63fffae353a87acbff53740ebf4840af6a

SHA512
0c915970a74aa660e809998a0c9658a63e3eca1e12cba09c969218c816cb174e20b42c9e27a1b7edfd878e0aa36cb1a67b5badaa15032d4246fe62683da50574

Download Submit
C:\Windows\System\nzeQmIi.exe

Filesize
2.1MB

MD5
ac9ddfc9f320ad0b6edc0b2db2f07e1a

SHA1
fc7501135ff7dbc30aedb5a5b5451f23b8a10d4e

SHA256
6b2660d547918314ba7962318ba66c2217c2a7e0ac7d20f9e566807718d126ec

SHA512
4fd29f75247619dd7bfd3ca699afaca30dec8bc346ec7d2634f267632cd536973a874994cdc40150b0a0866cae01aa9bf994bf7a35ff2cb0ccdedddaa4192e42

Download Submit
C:\Windows\System\sHwKufO.exe

Filesize
2.1MB

MD5
aec5a534cd0872b357ceb9ce1a953067

SHA1
6b0ba61e211179e195f95f98ddc043fd1f7a8950

SHA256
1675075dd160663e9157e19f18a3d9964ba0980996d0a044e7b7703a40a04440

SHA512
777689357d9c796a97fb68405dbcc5e0a5397249d393087a5e68f68b232022444f55645c6c7e00e0a52b8c4376e4882af1d7e56484f52f1e4fae4f5ba0141b1e

Download Submit
C:\Windows\System\sfkQQMZ.exe

Filesize
2.1MB

MD5
284cffe2ceafc3aeafd602eb34fbd987

SHA1
499aeeddddca0cfb16ccceb9e0989ed8a02451db

SHA256
7ab40420a18ad71d210ac2f21299bbf8336f12174d43f1330c30540b4de1a0b9

SHA512
3b6279bcf59b8ead47036a057a428f4bdf464b05b7328335e14f22538b160f7374544debc0d950b64e42ae7135f8317504efacc1fbb362cbbb2398268a300756

Download Submit
C:\Windows\System\wtOdjNh.exe

Filesize
2.1MB

MD5
b1069e0a0117fb1e073fa594b08bb4bf

SHA1
54001426655450ea5a3abbb38ee160ffd0018a82

SHA256
2d11cba99f172b46c9c7feeec73fc2ce380d0aa4560ff9cdadcf5478084aa399

SHA512
90c4a003a9221fc516f9f06d5e51b8be0435e2411e3f7f0f6c0ce116eed8914914cc7854e1786b9b7fe9075b238f9aea14db4459222c012fd9373b864a9f21aa

Download Submit
C:\Windows\System\xcONzLS.exe

Filesize
2.1MB

MD5
16f1ca19148ac50cba74e9b226993dd7

SHA1
ff45e80a4d69f2d2c529892a678d9c6f1172787e

SHA256
9c1f7796dd43ebbe10c0e4f18a6c8f8437104fc11094462d05160788173b6bef

SHA512
4eaefecc099cf82b7fa468cc2703b256c5eaef7afdebaf2b15d6515ff5b548462a36bf5d90a74eeb47d8ea32e01fb945c66eadcb28c32ee7e948467a438707aa

Download Submit
C:\Windows\System\yCjwvpc.exe

Filesize
2.1MB

MD5
a514bbce5bbea337c275293294cd0914

SHA1
44c2cbfe4aa4d00c164594d443c7520c11107e48

SHA256
8bb323e6c49adb4fa7f5cc8af1da6d09194d90d0ae341ee5983e3c0b9378c1a5

SHA512
f68cf14d3d1f3f231fb9b165bca84f900cf7e642b47173eab8c98c36a10c59ba45de7452bb3082bf5cd3794c2b5adbeb1afb750eb8dff9df77c0c294325b93c8

Download Submit
memory/232-52-0x00007FF654380000-0x00007FF6546D4000-memory.dmp

Filesize
3.3MB

Download
memory/232-2132-0x00007FF654380000-0x00007FF6546D4000-memory.dmp

Filesize
3.3MB

Download
memory/868-779-0x00007FF7D41A0000-0x00007FF7D44F4000-memory.dmp

Filesize
3.3MB

Download
memory/868-2136-0x00007FF7D41A0000-0x00007FF7D44F4000-memory.dmp

Filesize
3.3MB

Download
memory/916-845-0x00007FF6D4590000-0x00007FF6D48E4000-memory.dmp

Filesize
3.3MB

Download
memory/916-2153-0x00007FF6D4590000-0x00007FF6D48E4000-memory.dmp

Filesize
3.3MB

Download
memory/1080-2150-0x00007FF7B5F10000-0x00007FF7B6264000-memory.dmp

Filesize
3.3MB

Download
memory/1080-833-0x00007FF7B5F10000-0x00007FF7B6264000-memory.dmp

Filesize
3.3MB

Download
memory/1612-0-0x00007FF7DA120000-0x00007FF7DA474000-memory.dmp

Filesize
3.3MB

Download
memory/1612-1-0x0000028E32960000-0x0000028E32970000-memory.dmp

Filesize
64KB

Download
memory/1612-2117-0x00007FF7DA120000-0x00007FF7DA474000-memory.dmp

Filesize
3.3MB

Download
memory/2064-48-0x00007FF6679C0000-0x00007FF667D14000-memory.dmp

Filesize
3.3MB

Download
memory/2064-2130-0x00007FF6679C0000-0x00007FF667D14000-memory.dmp

Filesize
3.3MB

Download
memory/2164-782-0x00007FF7E2BC0000-0x00007FF7E2F14000-memory.dmp

Filesize
3.3MB

Download
memory/2164-2140-0x00007FF7E2BC0000-0x00007FF7E2F14000-memory.dmp

Filesize
3.3MB

Download
memory/2240-2147-0x00007FF70F0A0000-0x00007FF70F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/2240-823-0x00007FF70F0A0000-0x00007FF70F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/2480-783-0x00007FF714E30000-0x00007FF715184000-memory.dmp

Filesize
3.3MB

Download
memory/2480-2139-0x00007FF714E30000-0x00007FF715184000-memory.dmp

Filesize
3.3MB

Download
memory/2564-2138-0x00007FF78C170000-0x00007FF78C4C4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-785-0x00007FF78C170000-0x00007FF78C4C4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-777-0x00007FF7697C0000-0x00007FF769B14000-memory.dmp

Filesize
3.3MB

Download
memory/2652-2137-0x00007FF7697C0000-0x00007FF769B14000-memory.dmp

Filesize
3.3MB

Download
memory/2796-797-0x00007FF6A9940000-0x00007FF6A9C94000-memory.dmp

Filesize
3.3MB

Download
memory/2796-2142-0x00007FF6A9940000-0x00007FF6A9C94000-memory.dmp

Filesize
3.3MB

Download
memory/2896-2133-0x00007FF635C50000-0x00007FF635FA4000-memory.dmp

Filesize
3.3MB

Download
memory/2896-2125-0x00007FF635C50000-0x00007FF635FA4000-memory.dmp

Filesize
3.3MB

Download
memory/2896-42-0x00007FF635C50000-0x00007FF635FA4000-memory.dmp

Filesize
3.3MB

Download
memory/2924-836-0x00007FF6937B0000-0x00007FF693B04000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2152-0x00007FF6937B0000-0x00007FF693B04000-memory.dmp

Filesize
3.3MB

Download
memory/2968-2144-0x00007FF756300000-0x00007FF756654000-memory.dmp

Filesize
3.3MB

Download
memory/2968-801-0x00007FF756300000-0x00007FF756654000-memory.dmp

Filesize
3.3MB

Download
memory/3036-844-0x00007FF6CB4E0000-0x00007FF6CB834000-memory.dmp

Filesize
3.3MB

Download
memory/3036-2151-0x00007FF6CB4E0000-0x00007FF6CB834000-memory.dmp

Filesize
3.3MB

Download
memory/3040-2145-0x00007FF760550000-0x00007FF7608A4000-memory.dmp

Filesize
3.3MB

Download
memory/3040-806-0x00007FF760550000-0x00007FF7608A4000-memory.dmp

Filesize
3.3MB

Download
memory/3116-2146-0x00007FF74C330000-0x00007FF74C684000-memory.dmp

Filesize
3.3MB

Download
memory/3116-818-0x00007FF74C330000-0x00007FF74C684000-memory.dmp

Filesize
3.3MB

Download
memory/3136-780-0x00007FF67D9C0000-0x00007FF67DD14000-memory.dmp

Filesize
3.3MB

Download
memory/3136-2135-0x00007FF67D9C0000-0x00007FF67DD14000-memory.dmp

Filesize
3.3MB

Download
memory/3140-778-0x00007FF669AA0000-0x00007FF669DF4000-memory.dmp

Filesize
3.3MB

Download
memory/3140-2134-0x00007FF669AA0000-0x00007FF669DF4000-memory.dmp

Filesize
3.3MB

Download
memory/3424-2131-0x00007FF7291D0000-0x00007FF729524000-memory.dmp

Filesize
3.3MB

Download
memory/3424-49-0x00007FF7291D0000-0x00007FF729524000-memory.dmp

Filesize
3.3MB

Download
memory/3496-10-0x00007FF698470000-0x00007FF6987C4000-memory.dmp

Filesize
3.3MB

Download
memory/3496-2126-0x00007FF698470000-0x00007FF6987C4000-memory.dmp

Filesize
3.3MB

Download
memory/3616-16-0x00007FF7AF400000-0x00007FF7AF754000-memory.dmp

Filesize
3.3MB

Download
memory/3616-2127-0x00007FF7AF400000-0x00007FF7AF754000-memory.dmp

Filesize
3.3MB

Download
memory/3864-2148-0x00007FF7328F0000-0x00007FF732C44000-memory.dmp

Filesize
3.3MB

Download
memory/3864-828-0x00007FF7328F0000-0x00007FF732C44000-memory.dmp

Filesize
3.3MB

Download
memory/3876-2128-0x00007FF720DA0000-0x00007FF7210F4000-memory.dmp

Filesize
3.3MB

Download
memory/3876-2123-0x00007FF720DA0000-0x00007FF7210F4000-memory.dmp

Filesize
3.3MB

Download
memory/3876-23-0x00007FF720DA0000-0x00007FF7210F4000-memory.dmp

Filesize
3.3MB

Download
memory/4064-2141-0x00007FF7B5B40000-0x00007FF7B5E94000-memory.dmp

Filesize
3.3MB

Download
memory/4064-781-0x00007FF7B5B40000-0x00007FF7B5E94000-memory.dmp

Filesize
3.3MB

Download
memory/4092-849-0x00007FF6811C0000-0x00007FF681514000-memory.dmp

Filesize
3.3MB

Download
memory/4092-2154-0x00007FF6811C0000-0x00007FF681514000-memory.dmp

Filesize
3.3MB

Download
memory/4200-2124-0x00007FF7F5D90000-0x00007FF7F60E4000-memory.dmp

Filesize
3.3MB

Download
memory/4200-32-0x00007FF7F5D90000-0x00007FF7F60E4000-memory.dmp

Filesize
3.3MB

Download
memory/4200-2129-0x00007FF7F5D90000-0x00007FF7F60E4000-memory.dmp

Filesize
3.3MB

Download
memory/4524-829-0x00007FF6A3AD0000-0x00007FF6A3E24000-memory.dmp

Filesize
3.3MB

Download
memory/4524-2149-0x00007FF6A3AD0000-0x00007FF6A3E24000-memory.dmp

Filesize
3.3MB

Download
memory/5056-784-0x00007FF77BA80000-0x00007FF77BDD4000-memory.dmp

Filesize
3.3MB

Download
memory/5056-2143-0x00007FF77BA80000-0x00007FF77BDD4000-memory.dmp

Filesize
3.3MB

Download