xmrig | d728c0858e1d44b676d7505e1989bf60b2388a21163e9906ecf88bb90a3cdf42

Analysis

max time kernel
143s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
Size

2.6MB
MD5

d114dc220b77d7a9fe21d5b7d8590250
SHA1

983ca964494293b325afa2e3a70e4a2e0f2872c0
SHA256

d728c0858e1d44b676d7505e1989bf60b2388a21163e9906ecf88bb90a3cdf42
SHA512

d4be0562b7b43bfbecb7177559e11d79f266d48b3edd708ddcb571075972f903815208917e4e2654f69c8958afb218932465196965cc48920b1b9a851349e7a1
SSDEEP

49152:N0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8Dze7jcq4xG5QVf:N0GnJMOWPClFdx6e0EALKWVTffZiPAc9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/724-0-0x00007FF7C0CB0000-0x00007FF7C10A5000-memory.dmp	xmrig
behavioral2/files/0x000800000002343a-5.dat	xmrig
behavioral2/files/0x0008000000023440-10.dat	xmrig
behavioral2/files/0x0008000000023440-11.dat	xmrig
behavioral2/files/0x0007000000023441-9.dat	xmrig
behavioral2/memory/2904-31-0x00007FF656800000-0x00007FF656BF5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023445-36.dat	xmrig
behavioral2/files/0x0007000000023446-39.dat	xmrig
behavioral2/memory/4684-51-0x00007FF63C8D0000-0x00007FF63CCC5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023448-57.dat	xmrig
behavioral2/files/0x0007000000023449-62.dat	xmrig
behavioral2/files/0x000700000002344c-72.dat	xmrig
behavioral2/files/0x000700000002344d-82.dat	xmrig
behavioral2/files/0x000700000002344e-98.dat	xmrig
behavioral2/files/0x000700000002344f-103.dat	xmrig
behavioral2/memory/1812-108-0x00007FF6AFFF0000-0x00007FF6B03E5000-memory.dmp	xmrig
behavioral2/memory/3748-110-0x00007FF7EB740000-0x00007FF7EBB35000-memory.dmp	xmrig
behavioral2/memory/1512-109-0x00007FF62FA40000-0x00007FF62FE35000-memory.dmp	xmrig
behavioral2/memory/636-107-0x00007FF759A70000-0x00007FF759E65000-memory.dmp	xmrig
behavioral2/files/0x0007000000023453-119.dat	xmrig
behavioral2/files/0x0007000000023452-117.dat	xmrig
behavioral2/files/0x0007000000023451-115.dat	xmrig
behavioral2/files/0x0007000000023450-113.dat	xmrig
behavioral2/memory/4840-100-0x00007FF6A1440000-0x00007FF6A1835000-memory.dmp	xmrig
behavioral2/files/0x0007000000023451-97.dat	xmrig
behavioral2/memory/4680-95-0x00007FF7C7A30000-0x00007FF7C7E25000-memory.dmp	xmrig
behavioral2/memory/1244-78-0x00007FF7745F0000-0x00007FF7749E5000-memory.dmp	xmrig
behavioral2/files/0x000700000002344f-87.dat	xmrig
behavioral2/files/0x000700000002344e-86.dat	xmrig
behavioral2/memory/724-124-0x00007FF7C0CB0000-0x00007FF7C10A5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023455-134.dat	xmrig
behavioral2/files/0x0007000000023456-145.dat	xmrig
behavioral2/memory/3208-356-0x00007FF6BB270000-0x00007FF6BB665000-memory.dmp	xmrig
behavioral2/memory/2320-364-0x00007FF70B0E0000-0x00007FF70B4D5000-memory.dmp	xmrig
behavioral2/memory/4388-369-0x00007FF75F930000-0x00007FF75FD25000-memory.dmp	xmrig
behavioral2/memory/3172-1409-0x00007FF6AB000000-0x00007FF6AB3F5000-memory.dmp	xmrig
behavioral2/memory/4680-1915-0x00007FF7C7A30000-0x00007FF7C7E25000-memory.dmp	xmrig
behavioral2/memory/3784-1914-0x00007FF7EE920000-0x00007FF7EED15000-memory.dmp	xmrig
behavioral2/memory/4840-1916-0x00007FF6A1440000-0x00007FF6A1835000-memory.dmp	xmrig
behavioral2/files/0x000700000002345e-183.dat	xmrig
behavioral2/files/0x000700000002345d-178.dat	xmrig
behavioral2/files/0x000700000002345c-173.dat	xmrig
behavioral2/files/0x000700000002345b-168.dat	xmrig
behavioral2/files/0x000700000002345a-163.dat	xmrig
behavioral2/files/0x0007000000023459-158.dat	xmrig
behavioral2/files/0x0007000000023458-156.dat	xmrig
behavioral2/files/0x0007000000023457-154.dat	xmrig
behavioral2/memory/4620-148-0x00007FF6A4500000-0x00007FF6A48F5000-memory.dmp	xmrig
behavioral2/files/0x000800000002343e-147.dat	xmrig
behavioral2/memory/1404-142-0x00007FF699260000-0x00007FF699655000-memory.dmp	xmrig
behavioral2/files/0x0007000000023457-140.dat	xmrig
behavioral2/memory/4764-136-0x00007FF7553F0000-0x00007FF7557E5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023454-127.dat	xmrig
behavioral2/memory/4184-73-0x00007FF7AFC00000-0x00007FF7AFFF5000-memory.dmp	xmrig
behavioral2/files/0x000700000002344b-76.dat	xmrig
behavioral2/memory/792-66-0x00007FF728000000-0x00007FF7283F5000-memory.dmp	xmrig
behavioral2/files/0x000700000002344a-69.dat	xmrig
behavioral2/memory/3944-55-0x00007FF618670000-0x00007FF618A65000-memory.dmp	xmrig
behavioral2/files/0x0007000000023449-54.dat	xmrig
behavioral2/files/0x0007000000023447-47.dat	xmrig
behavioral2/memory/3172-44-0x00007FF6AB000000-0x00007FF6AB3F5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023446-45.dat	xmrig
behavioral2/files/0x0007000000023447-42.dat	xmrig
behavioral2/memory/4856-38-0x00007FF7CEDF0000-0x00007FF7CF1E5000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1004	zjKVTEj.exe
4320	ZTKmrUw.exe
3260	aSxnGzT.exe
2904	VQJuMbY.exe
4856	vBBdOlv.exe
4684	YmizCMT.exe
3172	YHiIMUC.exe
3944	WgJKaJC.exe
792	nCtqOJE.exe
4184	ZInLDhn.exe
1244	bbTFnNW.exe
636	bPIvPcR.exe
3784	ouRwMuj.exe
1812	uTOhGxx.exe
1512	xfoiIFX.exe
4680	YwhLVxp.exe
3748	vsioYic.exe
4840	XjFJaVC.exe
4764	nRiTnfh.exe
1404	dmpRqUK.exe
3208	qZQXgBM.exe
2320	KfxSlwX.exe
4388	pVlTWHm.exe
4620	dxMCGnW.exe
60	TnmwHoS.exe
3640	FpwCOKK.exe
916	JuMXJtM.exe
448	CSNAVNc.exe
3248	vgBascV.exe
400	zquVaXo.exe
1768	BRZIAkG.exe
4444	kBpZuyi.exe
3020	iycSell.exe
1720	ZsAOHEn.exe
5036	hTiqElh.exe
4196	eHEXQRd.exe
4848	FKlfPvE.exe
424	xcrQczE.exe
4492	CfWTcBz.exe
1840	veuPNeG.exe
3076	tLSQsPB.exe
3512	VNnBGbK.exe
2000	feUYMpI.exe
1964	oeJgknB.exe
860	tYLmTOj.exe
3052	EGoGVLY.exe
4460	eRgKBCZ.exe
4780	cFIdctm.exe
1928	gXYbybh.exe
4952	FRRBSCD.exe
1520	yIyGZbH.exe
5140	BicRyjX.exe
5168	WzJCoRD.exe
5196	IVJJhjH.exe
5228	JUmKqTK.exe
5252	tXsfpYk.exe
5284	ygSRoyx.exe
5316	KqcjaQF.exe
5352	aGeyQjH.exe
5376	DJkUzBJ.exe
5412	DvRMPJP.exe
5444	PzoipMr.exe
5460	IDJmDSG.exe
5488	FfixZEp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/724-0-0x00007FF7C0CB0000-0x00007FF7C10A5000-memory.dmp	upx
behavioral2/files/0x000800000002343a-5.dat	upx
behavioral2/files/0x0008000000023440-10.dat	upx
behavioral2/files/0x0008000000023440-11.dat	upx
behavioral2/files/0x0007000000023441-9.dat	upx
behavioral2/memory/2904-31-0x00007FF656800000-0x00007FF656BF5000-memory.dmp	upx
behavioral2/files/0x0007000000023445-36.dat	upx
behavioral2/files/0x0007000000023446-39.dat	upx
behavioral2/memory/4684-51-0x00007FF63C8D0000-0x00007FF63CCC5000-memory.dmp	upx
behavioral2/files/0x0007000000023448-57.dat	upx
behavioral2/files/0x0007000000023449-62.dat	upx
behavioral2/files/0x000700000002344c-72.dat	upx
behavioral2/files/0x000700000002344d-82.dat	upx
behavioral2/memory/3784-91-0x00007FF7EE920000-0x00007FF7EED15000-memory.dmp	upx
behavioral2/files/0x000700000002344e-98.dat	upx
behavioral2/files/0x000700000002344f-103.dat	upx
behavioral2/memory/1812-108-0x00007FF6AFFF0000-0x00007FF6B03E5000-memory.dmp	upx
behavioral2/memory/3748-110-0x00007FF7EB740000-0x00007FF7EBB35000-memory.dmp	upx
behavioral2/memory/1512-109-0x00007FF62FA40000-0x00007FF62FE35000-memory.dmp	upx
behavioral2/memory/636-107-0x00007FF759A70000-0x00007FF759E65000-memory.dmp	upx
behavioral2/files/0x0007000000023453-119.dat	upx
behavioral2/files/0x0007000000023452-117.dat	upx
behavioral2/files/0x0007000000023451-115.dat	upx
behavioral2/files/0x0007000000023450-113.dat	upx
behavioral2/memory/4840-100-0x00007FF6A1440000-0x00007FF6A1835000-memory.dmp	upx
behavioral2/files/0x0007000000023451-97.dat	upx
behavioral2/memory/4680-95-0x00007FF7C7A30000-0x00007FF7C7E25000-memory.dmp	upx
behavioral2/memory/1244-78-0x00007FF7745F0000-0x00007FF7749E5000-memory.dmp	upx
behavioral2/files/0x000700000002344f-87.dat	upx
behavioral2/files/0x000700000002344e-86.dat	upx
behavioral2/memory/724-124-0x00007FF7C0CB0000-0x00007FF7C10A5000-memory.dmp	upx
behavioral2/files/0x0007000000023455-134.dat	upx
behavioral2/files/0x0007000000023456-145.dat	upx
behavioral2/memory/3208-356-0x00007FF6BB270000-0x00007FF6BB665000-memory.dmp	upx
behavioral2/memory/2320-364-0x00007FF70B0E0000-0x00007FF70B4D5000-memory.dmp	upx
behavioral2/memory/4388-369-0x00007FF75F930000-0x00007FF75FD25000-memory.dmp	upx
behavioral2/memory/3172-1409-0x00007FF6AB000000-0x00007FF6AB3F5000-memory.dmp	upx
behavioral2/memory/4680-1915-0x00007FF7C7A30000-0x00007FF7C7E25000-memory.dmp	upx
behavioral2/memory/3784-1914-0x00007FF7EE920000-0x00007FF7EED15000-memory.dmp	upx
behavioral2/memory/4840-1916-0x00007FF6A1440000-0x00007FF6A1835000-memory.dmp	upx
behavioral2/files/0x000700000002345e-183.dat	upx
behavioral2/files/0x000700000002345d-178.dat	upx
behavioral2/files/0x000700000002345c-173.dat	upx
behavioral2/files/0x000700000002345b-168.dat	upx
behavioral2/files/0x000700000002345a-163.dat	upx
behavioral2/files/0x0007000000023459-158.dat	upx
behavioral2/files/0x0007000000023458-156.dat	upx
behavioral2/files/0x0007000000023457-154.dat	upx
behavioral2/memory/4620-148-0x00007FF6A4500000-0x00007FF6A48F5000-memory.dmp	upx
behavioral2/files/0x000800000002343e-147.dat	upx
behavioral2/memory/1404-142-0x00007FF699260000-0x00007FF699655000-memory.dmp	upx
behavioral2/files/0x0007000000023457-140.dat	upx
behavioral2/memory/4764-136-0x00007FF7553F0000-0x00007FF7557E5000-memory.dmp	upx
behavioral2/files/0x0007000000023454-127.dat	upx
behavioral2/memory/4184-73-0x00007FF7AFC00000-0x00007FF7AFFF5000-memory.dmp	upx
behavioral2/files/0x000700000002344b-76.dat	upx
behavioral2/memory/792-66-0x00007FF728000000-0x00007FF7283F5000-memory.dmp	upx
behavioral2/files/0x000700000002344a-69.dat	upx
behavioral2/memory/3944-55-0x00007FF618670000-0x00007FF618A65000-memory.dmp	upx
behavioral2/files/0x0007000000023449-54.dat	upx
behavioral2/files/0x0007000000023447-47.dat	upx
behavioral2/memory/3172-44-0x00007FF6AB000000-0x00007FF6AB3F5000-memory.dmp	upx
behavioral2/files/0x0007000000023446-45.dat	upx
behavioral2/files/0x0007000000023447-42.dat	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\juQsCIY.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\AKmepDx.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\tgADheu.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\HDUjkPl.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\tOfUvvf.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\qTrdzCv.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\ybsNKMo.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\YZSjibd.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\QOnSWMO.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\muKNhLX.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\YxSUdZU.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\yuVuhAj.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\bpLzBSi.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\TwGKFwu.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\bbTFnNW.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\rKbVvMN.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\faaXBXt.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\oVrSNww.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\nNaXEWv.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\sGqChbF.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\ehitCnQ.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\YHiIMUC.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\BicRyjX.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\UXdnKwv.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\pEZSgUq.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\IEAnfyT.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\PbVLSAe.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\FRRBSCD.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\VrnQKUv.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\thRIdin.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\YAPbPDi.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\sZnqVgU.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\WcdLZLM.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\vBBdOlv.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\qfutiml.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\FNIAEZt.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\wrEnhiu.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\iEfWusq.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\MnzGCuB.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\taVzGFS.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\mXustxg.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\vErlnYv.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\BPKMfdD.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\UDziRDm.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\ISRJlHj.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\ZKERlRJ.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\LEmrPbm.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\JGgVCEq.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\orlVniu.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\SaDkTUS.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\kkMrkxC.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\MlMwNVh.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\VgFKOEW.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\IoDgZfr.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\XZrbjEr.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\eFTgFBq.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\JyDeIcW.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\JyGckQc.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\wZTtpLL.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\yjQipJj.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\gvarqVf.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\kwRWpMN.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\HQsWMoq.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
File created	C:\Windows\System32\scJrHXt.exe	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 1004	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	86
PID 724 wrote to memory of 1004	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	86
PID 724 wrote to memory of 4320	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	87
PID 724 wrote to memory of 4320	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	87
PID 724 wrote to memory of 3260	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	88
PID 724 wrote to memory of 3260	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	88
PID 724 wrote to memory of 2904	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	89
PID 724 wrote to memory of 2904	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	89
PID 724 wrote to memory of 4856	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	90
PID 724 wrote to memory of 4856	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	90
PID 724 wrote to memory of 4684	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	91
PID 724 wrote to memory of 4684	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	91
PID 724 wrote to memory of 3172	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	92
PID 724 wrote to memory of 3172	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	92
PID 724 wrote to memory of 3944	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	93
PID 724 wrote to memory of 3944	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	93
PID 724 wrote to memory of 4184	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	95
PID 724 wrote to memory of 4184	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	95
PID 724 wrote to memory of 792	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	96
PID 724 wrote to memory of 792	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	96
PID 724 wrote to memory of 1244	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	98
PID 724 wrote to memory of 1244	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	98
PID 724 wrote to memory of 636	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	99
PID 724 wrote to memory of 636	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	99
PID 724 wrote to memory of 3784	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	100
PID 724 wrote to memory of 3784	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	100
PID 724 wrote to memory of 1812	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	101
PID 724 wrote to memory of 1812	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	101
PID 724 wrote to memory of 1512	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	102
PID 724 wrote to memory of 1512	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	102
PID 724 wrote to memory of 4680	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	103
PID 724 wrote to memory of 4680	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	103
PID 724 wrote to memory of 3748	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	104
PID 724 wrote to memory of 3748	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	104
PID 724 wrote to memory of 4840	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	105
PID 724 wrote to memory of 4840	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	105
PID 724 wrote to memory of 4764	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	106
PID 724 wrote to memory of 4764	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	106
PID 724 wrote to memory of 1404	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	107
PID 724 wrote to memory of 1404	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	107
PID 724 wrote to memory of 3208	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	108
PID 724 wrote to memory of 3208	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	108
PID 724 wrote to memory of 2320	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	109
PID 724 wrote to memory of 2320	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	109
PID 724 wrote to memory of 4388	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	110
PID 724 wrote to memory of 4388	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	110
PID 724 wrote to memory of 3640	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	111
PID 724 wrote to memory of 3640	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	111
PID 724 wrote to memory of 4620	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	112
PID 724 wrote to memory of 4620	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	112
PID 724 wrote to memory of 60	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	113
PID 724 wrote to memory of 60	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	113
PID 724 wrote to memory of 916	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	114
PID 724 wrote to memory of 916	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	114
PID 724 wrote to memory of 448	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	115
PID 724 wrote to memory of 448	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	115
PID 724 wrote to memory of 3248	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	116
PID 724 wrote to memory of 3248	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	116
PID 724 wrote to memory of 400	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	117
PID 724 wrote to memory of 400	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	117
PID 724 wrote to memory of 1768	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	118
PID 724 wrote to memory of 1768	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	118
PID 724 wrote to memory of 4444	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	119
PID 724 wrote to memory of 4444	724	d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe	119

C:\Users\Admin\AppData\Local\Temp\d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d114dc220b77d7a9fe21d5b7d8590250_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\System32\zjKVTEj.exe
  C:\Windows\System32\zjKVTEj.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System32\ZTKmrUw.exe
  C:\Windows\System32\ZTKmrUw.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System32\aSxnGzT.exe
  C:\Windows\System32\aSxnGzT.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System32\VQJuMbY.exe
  C:\Windows\System32\VQJuMbY.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System32\vBBdOlv.exe
  C:\Windows\System32\vBBdOlv.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System32\YmizCMT.exe
  C:\Windows\System32\YmizCMT.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System32\YHiIMUC.exe
  C:\Windows\System32\YHiIMUC.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System32\WgJKaJC.exe
  C:\Windows\System32\WgJKaJC.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System32\ZInLDhn.exe
  C:\Windows\System32\ZInLDhn.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System32\nCtqOJE.exe
  C:\Windows\System32\nCtqOJE.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System32\bbTFnNW.exe
  C:\Windows\System32\bbTFnNW.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System32\bPIvPcR.exe
  C:\Windows\System32\bPIvPcR.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System32\ouRwMuj.exe
  C:\Windows\System32\ouRwMuj.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System32\uTOhGxx.exe
  C:\Windows\System32\uTOhGxx.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System32\xfoiIFX.exe
  C:\Windows\System32\xfoiIFX.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System32\YwhLVxp.exe
  C:\Windows\System32\YwhLVxp.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System32\vsioYic.exe
  C:\Windows\System32\vsioYic.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System32\XjFJaVC.exe
  C:\Windows\System32\XjFJaVC.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System32\nRiTnfh.exe
  C:\Windows\System32\nRiTnfh.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System32\dmpRqUK.exe
  C:\Windows\System32\dmpRqUK.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System32\qZQXgBM.exe
  C:\Windows\System32\qZQXgBM.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System32\KfxSlwX.exe
  C:\Windows\System32\KfxSlwX.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System32\pVlTWHm.exe
  C:\Windows\System32\pVlTWHm.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System32\FpwCOKK.exe
  C:\Windows\System32\FpwCOKK.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System32\dxMCGnW.exe
  C:\Windows\System32\dxMCGnW.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System32\TnmwHoS.exe
  C:\Windows\System32\TnmwHoS.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System32\JuMXJtM.exe
  C:\Windows\System32\JuMXJtM.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System32\CSNAVNc.exe
  C:\Windows\System32\CSNAVNc.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System32\vgBascV.exe
  C:\Windows\System32\vgBascV.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System32\zquVaXo.exe
  C:\Windows\System32\zquVaXo.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System32\BRZIAkG.exe
  C:\Windows\System32\BRZIAkG.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System32\kBpZuyi.exe
  C:\Windows\System32\kBpZuyi.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System32\iycSell.exe
  C:\Windows\System32\iycSell.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System32\ZsAOHEn.exe
  C:\Windows\System32\ZsAOHEn.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System32\hTiqElh.exe
  C:\Windows\System32\hTiqElh.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System32\eHEXQRd.exe
  C:\Windows\System32\eHEXQRd.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System32\FKlfPvE.exe
  C:\Windows\System32\FKlfPvE.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System32\xcrQczE.exe
  C:\Windows\System32\xcrQczE.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System32\CfWTcBz.exe
  C:\Windows\System32\CfWTcBz.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System32\veuPNeG.exe
  C:\Windows\System32\veuPNeG.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System32\tLSQsPB.exe
  C:\Windows\System32\tLSQsPB.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System32\VNnBGbK.exe
  C:\Windows\System32\VNnBGbK.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System32\feUYMpI.exe
  C:\Windows\System32\feUYMpI.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System32\oeJgknB.exe
  C:\Windows\System32\oeJgknB.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System32\tYLmTOj.exe
  C:\Windows\System32\tYLmTOj.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System32\EGoGVLY.exe
  C:\Windows\System32\EGoGVLY.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System32\eRgKBCZ.exe
  C:\Windows\System32\eRgKBCZ.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System32\cFIdctm.exe
  C:\Windows\System32\cFIdctm.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System32\gXYbybh.exe
  C:\Windows\System32\gXYbybh.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System32\FRRBSCD.exe
  C:\Windows\System32\FRRBSCD.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System32\yIyGZbH.exe
  C:\Windows\System32\yIyGZbH.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System32\BicRyjX.exe
  C:\Windows\System32\BicRyjX.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System32\WzJCoRD.exe
  C:\Windows\System32\WzJCoRD.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System32\IVJJhjH.exe
  C:\Windows\System32\IVJJhjH.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System32\JUmKqTK.exe
  C:\Windows\System32\JUmKqTK.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System32\tXsfpYk.exe
  C:\Windows\System32\tXsfpYk.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System32\ygSRoyx.exe
  C:\Windows\System32\ygSRoyx.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System32\KqcjaQF.exe
  C:\Windows\System32\KqcjaQF.exe
  2⤵
  - Executes dropped EXE
  PID:5316
- C:\Windows\System32\aGeyQjH.exe
  C:\Windows\System32\aGeyQjH.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System32\DJkUzBJ.exe
  C:\Windows\System32\DJkUzBJ.exe
  2⤵
  - Executes dropped EXE
  PID:5376
- C:\Windows\System32\DvRMPJP.exe
  C:\Windows\System32\DvRMPJP.exe
  2⤵
  - Executes dropped EXE
  PID:5412
- C:\Windows\System32\PzoipMr.exe
  C:\Windows\System32\PzoipMr.exe
  2⤵
  - Executes dropped EXE
  PID:5444
- C:\Windows\System32\IDJmDSG.exe
  C:\Windows\System32\IDJmDSG.exe
  2⤵
  - Executes dropped EXE
  PID:5460
- C:\Windows\System32\FfixZEp.exe
  C:\Windows\System32\FfixZEp.exe
  2⤵
  - Executes dropped EXE
  PID:5488
- C:\Windows\System32\pPuofDS.exe
  C:\Windows\System32\pPuofDS.exe
  2⤵
  PID:5504
- C:\Windows\System32\HPNzIoD.exe
  C:\Windows\System32\HPNzIoD.exe
  2⤵
  PID:5532
- C:\Windows\System32\qfutiml.exe
  C:\Windows\System32\qfutiml.exe
  2⤵
  PID:5560
- C:\Windows\System32\XrTcWRE.exe
  C:\Windows\System32\XrTcWRE.exe
  2⤵
  PID:5588
- C:\Windows\System32\jnFVnfW.exe
  C:\Windows\System32\jnFVnfW.exe
  2⤵
  PID:5616
- C:\Windows\System32\ufgxkUn.exe
  C:\Windows\System32\ufgxkUn.exe
  2⤵
  PID:5644
- C:\Windows\System32\TEmVZot.exe
  C:\Windows\System32\TEmVZot.exe
  2⤵
  PID:5672
- C:\Windows\System32\dYQTzXm.exe
  C:\Windows\System32\dYQTzXm.exe
  2⤵
  PID:5700
- C:\Windows\System32\nUXWMAy.exe
  C:\Windows\System32\nUXWMAy.exe
  2⤵
  PID:5728
- C:\Windows\System32\mWoNFpO.exe
  C:\Windows\System32\mWoNFpO.exe
  2⤵
  PID:5756
- C:\Windows\System32\AKmepDx.exe
  C:\Windows\System32\AKmepDx.exe
  2⤵
  PID:5784
- C:\Windows\System32\MUtmekX.exe
  C:\Windows\System32\MUtmekX.exe
  2⤵
  PID:5812
- C:\Windows\System32\YkrOXsP.exe
  C:\Windows\System32\YkrOXsP.exe
  2⤵
  PID:5840
- C:\Windows\System32\rnexYsn.exe
  C:\Windows\System32\rnexYsn.exe
  2⤵
  PID:5868
- C:\Windows\System32\muKNhLX.exe
  C:\Windows\System32\muKNhLX.exe
  2⤵
  PID:5892
- C:\Windows\System32\iURRyIe.exe
  C:\Windows\System32\iURRyIe.exe
  2⤵
  PID:5924
- C:\Windows\System32\SaDkTUS.exe
  C:\Windows\System32\SaDkTUS.exe
  2⤵
  PID:5952
- C:\Windows\System32\IyrhQIf.exe
  C:\Windows\System32\IyrhQIf.exe
  2⤵
  PID:5980
- C:\Windows\System32\VrnQKUv.exe
  C:\Windows\System32\VrnQKUv.exe
  2⤵
  PID:6008
- C:\Windows\System32\ipFDRDM.exe
  C:\Windows\System32\ipFDRDM.exe
  2⤵
  PID:6036
- C:\Windows\System32\MIKvOxY.exe
  C:\Windows\System32\MIKvOxY.exe
  2⤵
  PID:6064
- C:\Windows\System32\cqjyyur.exe
  C:\Windows\System32\cqjyyur.exe
  2⤵
  PID:6100
- C:\Windows\System32\OmIzsvd.exe
  C:\Windows\System32\OmIzsvd.exe
  2⤵
  PID:6120
- C:\Windows\System32\XsrJtQk.exe
  C:\Windows\System32\XsrJtQk.exe
  2⤵
  PID:6152
- C:\Windows\System32\VMCgvjZ.exe
  C:\Windows\System32\VMCgvjZ.exe
  2⤵
  PID:6180
- C:\Windows\System32\mzcaQVP.exe
  C:\Windows\System32\mzcaQVP.exe
  2⤵
  PID:6196
- C:\Windows\System32\eRkbhrT.exe
  C:\Windows\System32\eRkbhrT.exe
  2⤵
  PID:6212
- C:\Windows\System32\dacakhT.exe
  C:\Windows\System32\dacakhT.exe
  2⤵
  PID:6244
- C:\Windows\System32\KJWetCD.exe
  C:\Windows\System32\KJWetCD.exe
  2⤵
  PID:6272
- C:\Windows\System32\thRIdin.exe
  C:\Windows\System32\thRIdin.exe
  2⤵
  PID:6308
- C:\Windows\System32\uOJIsqZ.exe
  C:\Windows\System32\uOJIsqZ.exe
  2⤵
  PID:6356
- C:\Windows\System32\EHEFYzT.exe
  C:\Windows\System32\EHEFYzT.exe
  2⤵
  PID:6436
- C:\Windows\System32\TxHGuUp.exe
  C:\Windows\System32\TxHGuUp.exe
  2⤵
  PID:6480
- C:\Windows\System32\jgIlRZI.exe
  C:\Windows\System32\jgIlRZI.exe
  2⤵
  PID:6508
- C:\Windows\System32\thfCxSF.exe
  C:\Windows\System32\thfCxSF.exe
  2⤵
  PID:6524
- C:\Windows\System32\rRxKnfp.exe
  C:\Windows\System32\rRxKnfp.exe
  2⤵
  PID:6544
- C:\Windows\System32\XZrbjEr.exe
  C:\Windows\System32\XZrbjEr.exe
  2⤵
  PID:6576
- C:\Windows\System32\mcsPCOx.exe
  C:\Windows\System32\mcsPCOx.exe
  2⤵
  PID:6664
- C:\Windows\System32\ylZDkoU.exe
  C:\Windows\System32\ylZDkoU.exe
  2⤵
  PID:6684
- C:\Windows\System32\KGeaEdQ.exe
  C:\Windows\System32\KGeaEdQ.exe
  2⤵
  PID:6712
- C:\Windows\System32\lYMNbsq.exe
  C:\Windows\System32\lYMNbsq.exe
  2⤵
  PID:6748
- C:\Windows\System32\yLEgcnA.exe
  C:\Windows\System32\yLEgcnA.exe
  2⤵
  PID:6780
- C:\Windows\System32\SbGxtGT.exe
  C:\Windows\System32\SbGxtGT.exe
  2⤵
  PID:6828
- C:\Windows\System32\XrASNtH.exe
  C:\Windows\System32\XrASNtH.exe
  2⤵
  PID:6844
- C:\Windows\System32\NORaPxd.exe
  C:\Windows\System32\NORaPxd.exe
  2⤵
  PID:6860
- C:\Windows\System32\ySmGaEO.exe
  C:\Windows\System32\ySmGaEO.exe
  2⤵
  PID:6888
- C:\Windows\System32\rbmSCpt.exe
  C:\Windows\System32\rbmSCpt.exe
  2⤵
  PID:6928
- C:\Windows\System32\YLObJiG.exe
  C:\Windows\System32\YLObJiG.exe
  2⤵
  PID:6972
- C:\Windows\System32\WVANhhg.exe
  C:\Windows\System32\WVANhhg.exe
  2⤵
  PID:7004
- C:\Windows\System32\KgETJie.exe
  C:\Windows\System32\KgETJie.exe
  2⤵
  PID:7032
- C:\Windows\System32\TSZqBNW.exe
  C:\Windows\System32\TSZqBNW.exe
  2⤵
  PID:7060
- C:\Windows\System32\oMTjdHR.exe
  C:\Windows\System32\oMTjdHR.exe
  2⤵
  PID:7100
- C:\Windows\System32\CxeHKcb.exe
  C:\Windows\System32\CxeHKcb.exe
  2⤵
  PID:7128
- C:\Windows\System32\anyBiVE.exe
  C:\Windows\System32\anyBiVE.exe
  2⤵
  PID:7164
- C:\Windows\System32\bKWhuur.exe
  C:\Windows\System32\bKWhuur.exe
  2⤵
  PID:6056
- C:\Windows\System32\bKTAlmc.exe
  C:\Windows\System32\bKTAlmc.exe
  2⤵
  PID:5964
- C:\Windows\System32\KlNaEIe.exe
  C:\Windows\System32\KlNaEIe.exe
  2⤵
  PID:5916
- C:\Windows\System32\flqdKUF.exe
  C:\Windows\System32\flqdKUF.exe
  2⤵
  PID:5820
- C:\Windows\System32\xXUWEsJ.exe
  C:\Windows\System32\xXUWEsJ.exe
  2⤵
  PID:5764
- C:\Windows\System32\ISRJlHj.exe
  C:\Windows\System32\ISRJlHj.exe
  2⤵
  PID:5748
- C:\Windows\System32\ygKvowj.exe
  C:\Windows\System32\ygKvowj.exe
  2⤵
  PID:5652
- C:\Windows\System32\ebwdhdh.exe
  C:\Windows\System32\ebwdhdh.exe
  2⤵
  PID:5600
- C:\Windows\System32\AXQfEAG.exe
  C:\Windows\System32\AXQfEAG.exe
  2⤵
  PID:3892
- C:\Windows\System32\HDGVqsB.exe
  C:\Windows\System32\HDGVqsB.exe
  2⤵
  PID:5428
- C:\Windows\System32\VVhebSm.exe
  C:\Windows\System32\VVhebSm.exe
  2⤵
  PID:2256
- C:\Windows\System32\dHhIGFi.exe
  C:\Windows\System32\dHhIGFi.exe
  2⤵
  PID:5304
- C:\Windows\System32\DgzLoUl.exe
  C:\Windows\System32\DgzLoUl.exe
  2⤵
  PID:5216
- C:\Windows\System32\jsPUtXl.exe
  C:\Windows\System32\jsPUtXl.exe
  2⤵
  PID:5152
- C:\Windows\System32\kwahved.exe
  C:\Windows\System32\kwahved.exe
  2⤵
  PID:2068
- C:\Windows\System32\KiAemPF.exe
  C:\Windows\System32\KiAemPF.exe
  2⤵
  PID:3388
- C:\Windows\System32\kzuVIQo.exe
  C:\Windows\System32\kzuVIQo.exe
  2⤵
  PID:1376
- C:\Windows\System32\AIgQiPF.exe
  C:\Windows\System32\AIgQiPF.exe
  2⤵
  PID:2432
- C:\Windows\System32\faaXBXt.exe
  C:\Windows\System32\faaXBXt.exe
  2⤵
  PID:1524
- C:\Windows\System32\yaPVKnD.exe
  C:\Windows\System32\yaPVKnD.exe
  2⤵
  PID:4636
- C:\Windows\System32\FlXkJWc.exe
  C:\Windows\System32\FlXkJWc.exe
  2⤵
  PID:3560
- C:\Windows\System32\UXdnKwv.exe
  C:\Windows\System32\UXdnKwv.exe
  2⤵
  PID:972
- C:\Windows\System32\sKdkoRD.exe
  C:\Windows\System32\sKdkoRD.exe
  2⤵
  PID:2788
- C:\Windows\System32\tsWsqOL.exe
  C:\Windows\System32\tsWsqOL.exe
  2⤵
  PID:2300
- C:\Windows\System32\xbkaLSI.exe
  C:\Windows\System32\xbkaLSI.exe
  2⤵
  PID:1972
- C:\Windows\System32\UsKIdIJ.exe
  C:\Windows\System32\UsKIdIJ.exe
  2⤵
  PID:552
- C:\Windows\System32\DbjgCmK.exe
  C:\Windows\System32\DbjgCmK.exe
  2⤵
  PID:1532
- C:\Windows\System32\YxSUdZU.exe
  C:\Windows\System32\YxSUdZU.exe
  2⤵
  PID:6128
- C:\Windows\System32\uZaHjjz.exe
  C:\Windows\System32\uZaHjjz.exe
  2⤵
  PID:4416
- C:\Windows\System32\QrwzNuC.exe
  C:\Windows\System32\QrwzNuC.exe
  2⤵
  PID:6232
- C:\Windows\System32\vkxhGmb.exe
  C:\Windows\System32\vkxhGmb.exe
  2⤵
  PID:6328
- C:\Windows\System32\kzYALsg.exe
  C:\Windows\System32\kzYALsg.exe
  2⤵
  PID:2684
- C:\Windows\System32\wctVSLV.exe
  C:\Windows\System32\wctVSLV.exe
  2⤵
  PID:4784
- C:\Windows\System32\mrGdKrN.exe
  C:\Windows\System32\mrGdKrN.exe
  2⤵
  PID:6492
- C:\Windows\System32\PGDTNJg.exe
  C:\Windows\System32\PGDTNJg.exe
  2⤵
  PID:6532
- C:\Windows\System32\WvcNgon.exe
  C:\Windows\System32\WvcNgon.exe
  2⤵
  PID:6676
- C:\Windows\System32\HDUjkPl.exe
  C:\Windows\System32\HDUjkPl.exe
  2⤵
  PID:6740
- C:\Windows\System32\rYCyQIv.exe
  C:\Windows\System32\rYCyQIv.exe
  2⤵
  PID:6840
- C:\Windows\System32\SKkfnOB.exe
  C:\Windows\System32\SKkfnOB.exe
  2⤵
  PID:6876
- C:\Windows\System32\SeiBDxs.exe
  C:\Windows\System32\SeiBDxs.exe
  2⤵
  PID:7020
- C:\Windows\System32\iiPXBrt.exe
  C:\Windows\System32\iiPXBrt.exe
  2⤵
  PID:3148
- C:\Windows\System32\wMrhPCz.exe
  C:\Windows\System32\wMrhPCz.exe
  2⤵
  PID:6624
- C:\Windows\System32\fqGpGmC.exe
  C:\Windows\System32\fqGpGmC.exe
  2⤵
  PID:5944
- C:\Windows\System32\RkMJtUB.exe
  C:\Windows\System32\RkMJtUB.exe
  2⤵
  PID:6700
- C:\Windows\System32\uSdWHoT.exe
  C:\Windows\System32\uSdWHoT.exe
  2⤵
  PID:5848
- C:\Windows\System32\zVlgdNf.exe
  C:\Windows\System32\zVlgdNf.exe
  2⤵
  PID:5664
- C:\Windows\System32\JQeTuKO.exe
  C:\Windows\System32\JQeTuKO.exe
  2⤵
  PID:5480
- C:\Windows\System32\hFMNwWf.exe
  C:\Windows\System32\hFMNwWf.exe
  2⤵
  PID:5372
- C:\Windows\System32\dJuaoae.exe
  C:\Windows\System32\dJuaoae.exe
  2⤵
  PID:5244
- C:\Windows\System32\ymyaoWJ.exe
  C:\Windows\System32\ymyaoWJ.exe
  2⤵
  PID:4544
- C:\Windows\System32\KyxeylM.exe
  C:\Windows\System32\KyxeylM.exe
  2⤵
  PID:3720
- C:\Windows\System32\wJNsxfB.exe
  C:\Windows\System32\wJNsxfB.exe
  2⤵
  PID:2244
- C:\Windows\System32\ZMlLQAR.exe
  C:\Windows\System32\ZMlLQAR.exe
  2⤵
  PID:4120
- C:\Windows\System32\zTWTrft.exe
  C:\Windows\System32\zTWTrft.exe
  2⤵
  PID:3500
- C:\Windows\System32\tgADheu.exe
  C:\Windows\System32\tgADheu.exe
  2⤵
  PID:2312
- C:\Windows\System32\WsbkiAI.exe
  C:\Windows\System32\WsbkiAI.exe
  2⤵
  PID:3320
- C:\Windows\System32\xrMwTTz.exe
  C:\Windows\System32\xrMwTTz.exe
  2⤵
  PID:6236
- C:\Windows\System32\IkOqThO.exe
  C:\Windows\System32\IkOqThO.exe
  2⤵
  PID:6364
- C:\Windows\System32\horhMOw.exe
  C:\Windows\System32\horhMOw.exe
  2⤵
  PID:6500
- C:\Windows\System32\baUdjsA.exe
  C:\Windows\System32\baUdjsA.exe
  2⤵
  PID:6732
- C:\Windows\System32\ZwMvMBA.exe
  C:\Windows\System32\ZwMvMBA.exe
  2⤵
  PID:6908
- C:\Windows\System32\SlaRtug.exe
  C:\Windows\System32\SlaRtug.exe
  2⤵
  PID:6108
- C:\Windows\System32\iqnFREG.exe
  C:\Windows\System32\iqnFREG.exe
  2⤵
  PID:6464
- C:\Windows\System32\tHfBrLh.exe
  C:\Windows\System32\tHfBrLh.exe
  2⤵
  PID:384
- C:\Windows\System32\zdZXGMa.exe
  C:\Windows\System32\zdZXGMa.exe
  2⤵
  PID:3440
- C:\Windows\System32\SdLynnP.exe
  C:\Windows\System32\SdLynnP.exe
  2⤵
  PID:3532
- C:\Windows\System32\hfkRXUs.exe
  C:\Windows\System32\hfkRXUs.exe
  2⤵
  PID:1652
- C:\Windows\System32\NWsIRhB.exe
  C:\Windows\System32\NWsIRhB.exe
  2⤵
  PID:4216
- C:\Windows\System32\wrEnhiu.exe
  C:\Windows\System32\wrEnhiu.exe
  2⤵
  PID:6300
- C:\Windows\System32\CkYEGJi.exe
  C:\Windows\System32\CkYEGJi.exe
  2⤵
  PID:6820
- C:\Windows\System32\pEZSgUq.exe
  C:\Windows\System32\pEZSgUq.exe
  2⤵
  PID:5992
- C:\Windows\System32\YVDGONQ.exe
  C:\Windows\System32\YVDGONQ.exe
  2⤵
  PID:5452
- C:\Windows\System32\bWenQFj.exe
  C:\Windows\System32\bWenQFj.exe
  2⤵
  PID:4488
- C:\Windows\System32\ZKERlRJ.exe
  C:\Windows\System32\ZKERlRJ.exe
  2⤵
  PID:6192
- C:\Windows\System32\UsHerQc.exe
  C:\Windows\System32\UsHerQc.exe
  2⤵
  PID:5736
- C:\Windows\System32\LmmTTNc.exe
  C:\Windows\System32\LmmTTNc.exe
  2⤵
  PID:6208
- C:\Windows\System32\XBeWwKV.exe
  C:\Windows\System32\XBeWwKV.exe
  2⤵
  PID:2480
- C:\Windows\System32\aLzDXRL.exe
  C:\Windows\System32\aLzDXRL.exe
  2⤵
  PID:7188
- C:\Windows\System32\ctIeRje.exe
  C:\Windows\System32\ctIeRje.exe
  2⤵
  PID:7212
- C:\Windows\System32\fKwlYCQ.exe
  C:\Windows\System32\fKwlYCQ.exe
  2⤵
  PID:7240
- C:\Windows\System32\MkxvOIp.exe
  C:\Windows\System32\MkxvOIp.exe
  2⤵
  PID:7268
- C:\Windows\System32\rLxmMxQ.exe
  C:\Windows\System32\rLxmMxQ.exe
  2⤵
  PID:7304
- C:\Windows\System32\dtYWLey.exe
  C:\Windows\System32\dtYWLey.exe
  2⤵
  PID:7324
- C:\Windows\System32\BujphfI.exe
  C:\Windows\System32\BujphfI.exe
  2⤵
  PID:7360
- C:\Windows\System32\XHcaXTi.exe
  C:\Windows\System32\XHcaXTi.exe
  2⤵
  PID:7392
- C:\Windows\System32\mHwPZLB.exe
  C:\Windows\System32\mHwPZLB.exe
  2⤵
  PID:7420
- C:\Windows\System32\IUBTCXy.exe
  C:\Windows\System32\IUBTCXy.exe
  2⤵
  PID:7448
- C:\Windows\System32\KvkuNlh.exe
  C:\Windows\System32\KvkuNlh.exe
  2⤵
  PID:7476
- C:\Windows\System32\iiJGcsu.exe
  C:\Windows\System32\iiJGcsu.exe
  2⤵
  PID:7512
- C:\Windows\System32\iPULmxU.exe
  C:\Windows\System32\iPULmxU.exe
  2⤵
  PID:7536
- C:\Windows\System32\qBxRxva.exe
  C:\Windows\System32\qBxRxva.exe
  2⤵
  PID:7564
- C:\Windows\System32\OXONjoj.exe
  C:\Windows\System32\OXONjoj.exe
  2⤵
  PID:7584
- C:\Windows\System32\sSSufTX.exe
  C:\Windows\System32\sSSufTX.exe
  2⤵
  PID:7612
- C:\Windows\System32\xKOtZNC.exe
  C:\Windows\System32\xKOtZNC.exe
  2⤵
  PID:7648
- C:\Windows\System32\NKhzJGS.exe
  C:\Windows\System32\NKhzJGS.exe
  2⤵
  PID:7692
- C:\Windows\System32\HeAJsye.exe
  C:\Windows\System32\HeAJsye.exe
  2⤵
  PID:7708
- C:\Windows\System32\dgKOdDG.exe
  C:\Windows\System32\dgKOdDG.exe
  2⤵
  PID:7724
- C:\Windows\System32\MpStkwh.exe
  C:\Windows\System32\MpStkwh.exe
  2⤵
  PID:7752
- C:\Windows\System32\iEfWusq.exe
  C:\Windows\System32\iEfWusq.exe
  2⤵
  PID:7800
- C:\Windows\System32\pPZkWES.exe
  C:\Windows\System32\pPZkWES.exe
  2⤵
  PID:7832
- C:\Windows\System32\gaStAgh.exe
  C:\Windows\System32\gaStAgh.exe
  2⤵
  PID:7848
- C:\Windows\System32\CfnhXEQ.exe
  C:\Windows\System32\CfnhXEQ.exe
  2⤵
  PID:7888
- C:\Windows\System32\NbjUfzS.exe
  C:\Windows\System32\NbjUfzS.exe
  2⤵
  PID:7904
- C:\Windows\System32\kQOuqDR.exe
  C:\Windows\System32\kQOuqDR.exe
  2⤵
  PID:7920
- C:\Windows\System32\wXxEFEW.exe
  C:\Windows\System32\wXxEFEW.exe
  2⤵
  PID:7980
- C:\Windows\System32\EZLNRab.exe
  C:\Windows\System32\EZLNRab.exe
  2⤵
  PID:8000
- C:\Windows\System32\UcwjWFI.exe
  C:\Windows\System32\UcwjWFI.exe
  2⤵
  PID:8028
- C:\Windows\System32\LbWeqIA.exe
  C:\Windows\System32\LbWeqIA.exe
  2⤵
  PID:8060
- C:\Windows\System32\zWEPQrI.exe
  C:\Windows\System32\zWEPQrI.exe
  2⤵
  PID:8088
- C:\Windows\System32\ELYMAji.exe
  C:\Windows\System32\ELYMAji.exe
  2⤵
  PID:8120
- C:\Windows\System32\cvSMrlD.exe
  C:\Windows\System32\cvSMrlD.exe
  2⤵
  PID:8144
- C:\Windows\System32\eYPRGQf.exe
  C:\Windows\System32\eYPRGQf.exe
  2⤵
  PID:8160
- C:\Windows\System32\JziLAIh.exe
  C:\Windows\System32\JziLAIh.exe
  2⤵
  PID:8180
- C:\Windows\System32\ppoSigR.exe
  C:\Windows\System32\ppoSigR.exe
  2⤵
  PID:7256
- C:\Windows\System32\ZDBBuRr.exe
  C:\Windows\System32\ZDBBuRr.exe
  2⤵
  PID:7312
- C:\Windows\System32\tmVgXit.exe
  C:\Windows\System32\tmVgXit.exe
  2⤵
  PID:7376
- C:\Windows\System32\ZQFVBXr.exe
  C:\Windows\System32\ZQFVBXr.exe
  2⤵
  PID:7440
- C:\Windows\System32\SPyOYgR.exe
  C:\Windows\System32\SPyOYgR.exe
  2⤵
  PID:7468
- C:\Windows\System32\yNUxJxX.exe
  C:\Windows\System32\yNUxJxX.exe
  2⤵
  PID:7520
- C:\Windows\System32\MkTprUk.exe
  C:\Windows\System32\MkTprUk.exe
  2⤵
  PID:7600
- C:\Windows\System32\RgopJtl.exe
  C:\Windows\System32\RgopJtl.exe
  2⤵
  PID:7656
- C:\Windows\System32\kZOeLxg.exe
  C:\Windows\System32\kZOeLxg.exe
  2⤵
  PID:1640
- C:\Windows\System32\zdaYbXV.exe
  C:\Windows\System32\zdaYbXV.exe
  2⤵
  PID:852
- C:\Windows\System32\QAJwOEh.exe
  C:\Windows\System32\QAJwOEh.exe
  2⤵
  PID:2960
- C:\Windows\System32\HtQQYGp.exe
  C:\Windows\System32\HtQQYGp.exe
  2⤵
  PID:2900
- C:\Windows\System32\yHkpMws.exe
  C:\Windows\System32\yHkpMws.exe
  2⤵
  PID:7956
- C:\Windows\System32\TeGvKiI.exe
  C:\Windows\System32\TeGvKiI.exe
  2⤵
  PID:7992
- C:\Windows\System32\mgTHtdw.exe
  C:\Windows\System32\mgTHtdw.exe
  2⤵
  PID:8052
- C:\Windows\System32\ZWbXiJd.exe
  C:\Windows\System32\ZWbXiJd.exe
  2⤵
  PID:8076
- C:\Windows\System32\YPARnBB.exe
  C:\Windows\System32\YPARnBB.exe
  2⤵
  PID:8152
- C:\Windows\System32\CyhKCFY.exe
  C:\Windows\System32\CyhKCFY.exe
  2⤵
  PID:7224
- C:\Windows\System32\iQzEKoT.exe
  C:\Windows\System32\iQzEKoT.exe
  2⤵
  PID:7432
- C:\Windows\System32\cvgpRyO.exe
  C:\Windows\System32\cvgpRyO.exe
  2⤵
  PID:7496
- C:\Windows\System32\elOuHCK.exe
  C:\Windows\System32\elOuHCK.exe
  2⤵
  PID:4648
- C:\Windows\System32\BhduRCE.exe
  C:\Windows\System32\BhduRCE.exe
  2⤵
  PID:7736
- C:\Windows\System32\rQtlGdk.exe
  C:\Windows\System32\rQtlGdk.exe
  2⤵
  PID:848
- C:\Windows\System32\IRAeReF.exe
  C:\Windows\System32\IRAeReF.exe
  2⤵
  PID:7952
- C:\Windows\System32\oVrSNww.exe
  C:\Windows\System32\oVrSNww.exe
  2⤵
  PID:8020
- C:\Windows\System32\cJwBzmW.exe
  C:\Windows\System32\cJwBzmW.exe
  2⤵
  PID:8096
- C:\Windows\System32\xSgayxF.exe
  C:\Windows\System32\xSgayxF.exe
  2⤵
  PID:8188
- C:\Windows\System32\kBhqCDQ.exe
  C:\Windows\System32\kBhqCDQ.exe
  2⤵
  PID:7320
- C:\Windows\System32\ufFlaGX.exe
  C:\Windows\System32\ufFlaGX.exe
  2⤵
  PID:7720
- C:\Windows\System32\dRLLZRH.exe
  C:\Windows\System32\dRLLZRH.exe
  2⤵
  PID:2472
- C:\Windows\System32\vTayWdM.exe
  C:\Windows\System32\vTayWdM.exe
  2⤵
  PID:3520
- C:\Windows\System32\pKDbwIn.exe
  C:\Windows\System32\pKDbwIn.exe
  2⤵
  PID:2328
- C:\Windows\System32\rKbVvMN.exe
  C:\Windows\System32\rKbVvMN.exe
  2⤵
  PID:7660
- C:\Windows\System32\OGShAUs.exe
  C:\Windows\System32\OGShAUs.exe
  2⤵
  PID:8196
- C:\Windows\System32\cVBFaQn.exe
  C:\Windows\System32\cVBFaQn.exe
  2⤵
  PID:8224
- C:\Windows\System32\gBThPhz.exe
  C:\Windows\System32\gBThPhz.exe
  2⤵
  PID:8252
- C:\Windows\System32\xVnygGX.exe
  C:\Windows\System32\xVnygGX.exe
  2⤵
  PID:8280
- C:\Windows\System32\hRubPSM.exe
  C:\Windows\System32\hRubPSM.exe
  2⤵
  PID:8296
- C:\Windows\System32\Rcaqbmv.exe
  C:\Windows\System32\Rcaqbmv.exe
  2⤵
  PID:8328
- C:\Windows\System32\qetMWid.exe
  C:\Windows\System32\qetMWid.exe
  2⤵
  PID:8364
- C:\Windows\System32\ZuzPuVt.exe
  C:\Windows\System32\ZuzPuVt.exe
  2⤵
  PID:8392
- C:\Windows\System32\zAcKIkQ.exe
  C:\Windows\System32\zAcKIkQ.exe
  2⤵
  PID:8420
- C:\Windows\System32\PNQaHAi.exe
  C:\Windows\System32\PNQaHAi.exe
  2⤵
  PID:8456
- C:\Windows\System32\uoraQJu.exe
  C:\Windows\System32\uoraQJu.exe
  2⤵
  PID:8476
- C:\Windows\System32\ArsKkLW.exe
  C:\Windows\System32\ArsKkLW.exe
  2⤵
  PID:8504
- C:\Windows\System32\EhyldDU.exe
  C:\Windows\System32\EhyldDU.exe
  2⤵
  PID:8532
- C:\Windows\System32\HWHwZkp.exe
  C:\Windows\System32\HWHwZkp.exe
  2⤵
  PID:8568
- C:\Windows\System32\syBpXHA.exe
  C:\Windows\System32\syBpXHA.exe
  2⤵
  PID:8588
- C:\Windows\System32\WzkaJbd.exe
  C:\Windows\System32\WzkaJbd.exe
  2⤵
  PID:8604
- C:\Windows\System32\gZqPTCA.exe
  C:\Windows\System32\gZqPTCA.exe
  2⤵
  PID:8632
- C:\Windows\System32\wObcpax.exe
  C:\Windows\System32\wObcpax.exe
  2⤵
  PID:8672
- C:\Windows\System32\WfdrHfZ.exe
  C:\Windows\System32\WfdrHfZ.exe
  2⤵
  PID:8708
- C:\Windows\System32\zADWvHX.exe
  C:\Windows\System32\zADWvHX.exe
  2⤵
  PID:8732
- C:\Windows\System32\MnzGCuB.exe
  C:\Windows\System32\MnzGCuB.exe
  2⤵
  PID:8776
- C:\Windows\System32\REuhYIQ.exe
  C:\Windows\System32\REuhYIQ.exe
  2⤵
  PID:8804
- C:\Windows\System32\cFKMiZh.exe
  C:\Windows\System32\cFKMiZh.exe
  2⤵
  PID:8836
- C:\Windows\System32\cKAqRDl.exe
  C:\Windows\System32\cKAqRDl.exe
  2⤵
  PID:8900
- C:\Windows\System32\IEAnfyT.exe
  C:\Windows\System32\IEAnfyT.exe
  2⤵
  PID:8928
- C:\Windows\System32\taVzGFS.exe
  C:\Windows\System32\taVzGFS.exe
  2⤵
  PID:8968
- C:\Windows\System32\vmRxbpd.exe
  C:\Windows\System32\vmRxbpd.exe
  2⤵
  PID:9004
- C:\Windows\System32\TyqnaYq.exe
  C:\Windows\System32\TyqnaYq.exe
  2⤵
  PID:9028
- C:\Windows\System32\vNEmizb.exe
  C:\Windows\System32\vNEmizb.exe
  2⤵
  PID:9052
- C:\Windows\System32\BcxwEff.exe
  C:\Windows\System32\BcxwEff.exe
  2⤵
  PID:9068
- C:\Windows\System32\Yqezlpi.exe
  C:\Windows\System32\Yqezlpi.exe
  2⤵
  PID:9108
- C:\Windows\System32\pQXjLFs.exe
  C:\Windows\System32\pQXjLFs.exe
  2⤵
  PID:9132
- C:\Windows\System32\bEHaZNI.exe
  C:\Windows\System32\bEHaZNI.exe
  2⤵
  PID:9200
- C:\Windows\System32\ujFFTqw.exe
  C:\Windows\System32\ujFFTqw.exe
  2⤵
  PID:968
- C:\Windows\System32\MHGEMJY.exe
  C:\Windows\System32\MHGEMJY.exe
  2⤵
  PID:8292
- C:\Windows\System32\rSmsmBW.exe
  C:\Windows\System32\rSmsmBW.exe
  2⤵
  PID:8404
- C:\Windows\System32\mGeLrlm.exe
  C:\Windows\System32\mGeLrlm.exe
  2⤵
  PID:8468
- C:\Windows\System32\siSVPot.exe
  C:\Windows\System32\siSVPot.exe
  2⤵
  PID:8544
- C:\Windows\System32\szItHCB.exe
  C:\Windows\System32\szItHCB.exe
  2⤵
  PID:8620
- C:\Windows\System32\syISGfN.exe
  C:\Windows\System32\syISGfN.exe
  2⤵
  PID:8644
- C:\Windows\System32\bfbeucb.exe
  C:\Windows\System32\bfbeucb.exe
  2⤵
  PID:8700
- C:\Windows\System32\NiDDftu.exe
  C:\Windows\System32\NiDDftu.exe
  2⤵
  PID:4560
- C:\Windows\System32\tiuqHwN.exe
  C:\Windows\System32\tiuqHwN.exe
  2⤵
  PID:8772
- C:\Windows\System32\IilDkyx.exe
  C:\Windows\System32\IilDkyx.exe
  2⤵
  PID:8824
- C:\Windows\System32\sqqqqOZ.exe
  C:\Windows\System32\sqqqqOZ.exe
  2⤵
  PID:8956
- C:\Windows\System32\iHiYOeP.exe
  C:\Windows\System32\iHiYOeP.exe
  2⤵
  PID:9016
- C:\Windows\System32\hopNDbO.exe
  C:\Windows\System32\hopNDbO.exe
  2⤵
  PID:9064
- C:\Windows\System32\TpmkxUu.exe
  C:\Windows\System32\TpmkxUu.exe
  2⤵
  PID:9152
- C:\Windows\System32\pMWrqQp.exe
  C:\Windows\System32\pMWrqQp.exe
  2⤵
  PID:4852
- C:\Windows\System32\MlMwNVh.exe
  C:\Windows\System32\MlMwNVh.exe
  2⤵
  PID:8496
- C:\Windows\System32\PbVLSAe.exe
  C:\Windows\System32\PbVLSAe.exe
  2⤵
  PID:8584
- C:\Windows\System32\tfAPZLD.exe
  C:\Windows\System32\tfAPZLD.exe
  2⤵
  PID:2304
- C:\Windows\System32\MBVeFSF.exe
  C:\Windows\System32\MBVeFSF.exe
  2⤵
  PID:8744
- C:\Windows\System32\thKknsp.exe
  C:\Windows\System32\thKknsp.exe
  2⤵
  PID:876
- C:\Windows\System32\PXQzNeA.exe
  C:\Windows\System32\PXQzNeA.exe
  2⤵
  PID:9020
- C:\Windows\System32\uEfTEoe.exe
  C:\Windows\System32\uEfTEoe.exe
  2⤵
  PID:9096
- C:\Windows\System32\HQsWMoq.exe
  C:\Windows\System32\HQsWMoq.exe
  2⤵
  PID:8464
- C:\Windows\System32\rgnhPEd.exe
  C:\Windows\System32\rgnhPEd.exe
  2⤵
  PID:8696
- C:\Windows\System32\ZFWaSNC.exe
  C:\Windows\System32\ZFWaSNC.exe
  2⤵
  PID:8908
- C:\Windows\System32\wZTtpLL.exe
  C:\Windows\System32\wZTtpLL.exe
  2⤵
  PID:8576
- C:\Windows\System32\COfhzKD.exe
  C:\Windows\System32\COfhzKD.exe
  2⤵
  PID:1036
- C:\Windows\System32\xugLJHl.exe
  C:\Windows\System32\xugLJHl.exe
  2⤵
  PID:2340
- C:\Windows\System32\FCIfiPe.exe
  C:\Windows\System32\FCIfiPe.exe
  2⤵
  PID:8788
- C:\Windows\System32\eFTgFBq.exe
  C:\Windows\System32\eFTgFBq.exe
  2⤵
  PID:9244
- C:\Windows\System32\glaGuqb.exe
  C:\Windows\System32\glaGuqb.exe
  2⤵
  PID:9288
- C:\Windows\System32\gkQvaXu.exe
  C:\Windows\System32\gkQvaXu.exe
  2⤵
  PID:9312
- C:\Windows\System32\mXustxg.exe
  C:\Windows\System32\mXustxg.exe
  2⤵
  PID:9348
- C:\Windows\System32\kkMrkxC.exe
  C:\Windows\System32\kkMrkxC.exe
  2⤵
  PID:9392
- C:\Windows\System32\JOYoTrt.exe
  C:\Windows\System32\JOYoTrt.exe
  2⤵
  PID:9412
- C:\Windows\System32\iqblSUO.exe
  C:\Windows\System32\iqblSUO.exe
  2⤵
  PID:9428
- C:\Windows\System32\vYQVXje.exe
  C:\Windows\System32\vYQVXje.exe
  2⤵
  PID:9484
- C:\Windows\System32\TcAsDNO.exe
  C:\Windows\System32\TcAsDNO.exe
  2⤵
  PID:9512
- C:\Windows\System32\edBpcwP.exe
  C:\Windows\System32\edBpcwP.exe
  2⤵
  PID:9544
- C:\Windows\System32\AvqnCGM.exe
  C:\Windows\System32\AvqnCGM.exe
  2⤵
  PID:9572
- C:\Windows\System32\oYRWUcg.exe
  C:\Windows\System32\oYRWUcg.exe
  2⤵
  PID:9604
- C:\Windows\System32\tdIKUpY.exe
  C:\Windows\System32\tdIKUpY.exe
  2⤵
  PID:9636
- C:\Windows\System32\TLdlQlU.exe
  C:\Windows\System32\TLdlQlU.exe
  2⤵
  PID:9664
- C:\Windows\System32\ijCazJy.exe
  C:\Windows\System32\ijCazJy.exe
  2⤵
  PID:9692
- C:\Windows\System32\JBoHeOr.exe
  C:\Windows\System32\JBoHeOr.exe
  2⤵
  PID:9720
- C:\Windows\System32\RpLvgjf.exe
  C:\Windows\System32\RpLvgjf.exe
  2⤵
  PID:9748
- C:\Windows\System32\BXsqJUr.exe
  C:\Windows\System32\BXsqJUr.exe
  2⤵
  PID:9776
- C:\Windows\System32\cZSIYxe.exe
  C:\Windows\System32\cZSIYxe.exe
  2⤵
  PID:9804
- C:\Windows\System32\MRFJbYc.exe
  C:\Windows\System32\MRFJbYc.exe
  2⤵
  PID:9832
- C:\Windows\System32\fTiCmhz.exe
  C:\Windows\System32\fTiCmhz.exe
  2⤵
  PID:9860
- C:\Windows\System32\oiYdGak.exe
  C:\Windows\System32\oiYdGak.exe
  2⤵
  PID:9888
- C:\Windows\System32\PGoiPms.exe
  C:\Windows\System32\PGoiPms.exe
  2⤵
  PID:9920
- C:\Windows\System32\mZuiLJV.exe
  C:\Windows\System32\mZuiLJV.exe
  2⤵
  PID:9948
- C:\Windows\System32\tOfUvvf.exe
  C:\Windows\System32\tOfUvvf.exe
  2⤵
  PID:9980
- C:\Windows\System32\RBAOHAT.exe
  C:\Windows\System32\RBAOHAT.exe
  2⤵
  PID:10008
- C:\Windows\System32\YEUJgRc.exe
  C:\Windows\System32\YEUJgRc.exe
  2⤵
  PID:10044
- C:\Windows\System32\wCWcAQI.exe
  C:\Windows\System32\wCWcAQI.exe
  2⤵
  PID:10064
- C:\Windows\System32\hyMYZxn.exe
  C:\Windows\System32\hyMYZxn.exe
  2⤵
  PID:10092
- C:\Windows\System32\qTrdzCv.exe
  C:\Windows\System32\qTrdzCv.exe
  2⤵
  PID:10120
- C:\Windows\System32\SOuCjBx.exe
  C:\Windows\System32\SOuCjBx.exe
  2⤵
  PID:10148
- C:\Windows\System32\cSMKVCf.exe
  C:\Windows\System32\cSMKVCf.exe
  2⤵
  PID:10176
- C:\Windows\System32\MWTRlKT.exe
  C:\Windows\System32\MWTRlKT.exe
  2⤵
  PID:10204
- C:\Windows\System32\isCXBNN.exe
  C:\Windows\System32\isCXBNN.exe
  2⤵
  PID:10232
- C:\Windows\System32\MYCDagW.exe
  C:\Windows\System32\MYCDagW.exe
  2⤵
  PID:9240
- C:\Windows\System32\InYgtsn.exe
  C:\Windows\System32\InYgtsn.exe
  2⤵
  PID:9300
- C:\Windows\System32\SWRBvOw.exe
  C:\Windows\System32\SWRBvOw.exe
  2⤵
  PID:9376
- C:\Windows\System32\rfMSTnN.exe
  C:\Windows\System32\rfMSTnN.exe
  2⤵
  PID:9480
- C:\Windows\System32\GpYXgLr.exe
  C:\Windows\System32\GpYXgLr.exe
  2⤵
  PID:9524
- C:\Windows\System32\IIzjIsO.exe
  C:\Windows\System32\IIzjIsO.exe
  2⤵
  PID:9556
- C:\Windows\System32\NODLGbC.exe
  C:\Windows\System32\NODLGbC.exe
  2⤵
  PID:9648
- C:\Windows\System32\yjQipJj.exe
  C:\Windows\System32\yjQipJj.exe
  2⤵
  PID:9716
- C:\Windows\System32\TQCHDbh.exe
  C:\Windows\System32\TQCHDbh.exe
  2⤵
  PID:9768
- C:\Windows\System32\zjEJTRF.exe
  C:\Windows\System32\zjEJTRF.exe
  2⤵
  PID:9828
- C:\Windows\System32\sPBYIEP.exe
  C:\Windows\System32\sPBYIEP.exe
  2⤵
  PID:9904
- C:\Windows\System32\JyDeIcW.exe
  C:\Windows\System32\JyDeIcW.exe
  2⤵
  PID:3528
- C:\Windows\System32\sfcjUHY.exe
  C:\Windows\System32\sfcjUHY.exe
  2⤵
  PID:10000
- C:\Windows\System32\fohnjIg.exe
  C:\Windows\System32\fohnjIg.exe
  2⤵
  PID:10084
- C:\Windows\System32\tKtUVZy.exe
  C:\Windows\System32\tKtUVZy.exe
  2⤵
  PID:10144
- C:\Windows\System32\azuKlwv.exe
  C:\Windows\System32\azuKlwv.exe
  2⤵
  PID:10196
- C:\Windows\System32\xFZtWvi.exe
  C:\Windows\System32\xFZtWvi.exe
  2⤵
  PID:9268
- C:\Windows\System32\vicOyXM.exe
  C:\Windows\System32\vicOyXM.exe
  2⤵
  PID:9404
- C:\Windows\System32\NOByDTB.exe
  C:\Windows\System32\NOByDTB.exe
  2⤵
  PID:2784
- C:\Windows\System32\YAPbPDi.exe
  C:\Windows\System32\YAPbPDi.exe
  2⤵
  PID:9704
- C:\Windows\System32\MPSpwUv.exe
  C:\Windows\System32\MPSpwUv.exe
  2⤵
  PID:9824
- C:\Windows\System32\IiQvGmY.exe
  C:\Windows\System32\IiQvGmY.exe
  2⤵
  PID:9968
- C:\Windows\System32\YScxquD.exe
  C:\Windows\System32\YScxquD.exe
  2⤵
  PID:10132
- C:\Windows\System32\HUsqkFv.exe
  C:\Windows\System32\HUsqkFv.exe
  2⤵
  PID:408
- C:\Windows\System32\ybsNKMo.exe
  C:\Windows\System32\ybsNKMo.exe
  2⤵
  PID:9536
- C:\Windows\System32\OBUrUBv.exe
  C:\Windows\System32\OBUrUBv.exe
  2⤵
  PID:9896
- C:\Windows\System32\xRQgscx.exe
  C:\Windows\System32\xRQgscx.exe
  2⤵
  PID:9228
- C:\Windows\System32\XBIYzXy.exe
  C:\Windows\System32\XBIYzXy.exe
  2⤵
  PID:10028
- C:\Windows\System32\OvtmjkL.exe
  C:\Windows\System32\OvtmjkL.exe
  2⤵
  PID:9816
- C:\Windows\System32\eLAlRyC.exe
  C:\Windows\System32\eLAlRyC.exe
  2⤵
  PID:10268
- C:\Windows\System32\mLLoAwm.exe
  C:\Windows\System32\mLLoAwm.exe
  2⤵
  PID:10296
- C:\Windows\System32\FBaVnff.exe
  C:\Windows\System32\FBaVnff.exe
  2⤵
  PID:10324
- C:\Windows\System32\nPwNYAk.exe
  C:\Windows\System32\nPwNYAk.exe
  2⤵
  PID:10352
- C:\Windows\System32\IoDgZfr.exe
  C:\Windows\System32\IoDgZfr.exe
  2⤵
  PID:10380
- C:\Windows\System32\IdJzkPj.exe
  C:\Windows\System32\IdJzkPj.exe
  2⤵
  PID:10416
- C:\Windows\System32\OeHdoiq.exe
  C:\Windows\System32\OeHdoiq.exe
  2⤵
  PID:10444
- C:\Windows\System32\aaXvxFz.exe
  C:\Windows\System32\aaXvxFz.exe
  2⤵
  PID:10472
- C:\Windows\System32\jPbQJsP.exe
  C:\Windows\System32\jPbQJsP.exe
  2⤵
  PID:10512
- C:\Windows\System32\JSBVTIy.exe
  C:\Windows\System32\JSBVTIy.exe
  2⤵
  PID:10540
- C:\Windows\System32\HIdLHRP.exe
  C:\Windows\System32\HIdLHRP.exe
  2⤵
  PID:10568
- C:\Windows\System32\psOCnFJ.exe
  C:\Windows\System32\psOCnFJ.exe
  2⤵
  PID:10596
- C:\Windows\System32\CZAXGRl.exe
  C:\Windows\System32\CZAXGRl.exe
  2⤵
  PID:10624
- C:\Windows\System32\kNwVEzD.exe
  C:\Windows\System32\kNwVEzD.exe
  2⤵
  PID:10652
- C:\Windows\System32\OBEZpBM.exe
  C:\Windows\System32\OBEZpBM.exe
  2⤵
  PID:10680
- C:\Windows\System32\nvPLkNv.exe
  C:\Windows\System32\nvPLkNv.exe
  2⤵
  PID:10708
- C:\Windows\System32\JyGckQc.exe
  C:\Windows\System32\JyGckQc.exe
  2⤵
  PID:10736
- C:\Windows\System32\wSuFKxB.exe
  C:\Windows\System32\wSuFKxB.exe
  2⤵
  PID:10764
- C:\Windows\System32\DTWRjlH.exe
  C:\Windows\System32\DTWRjlH.exe
  2⤵
  PID:10792
- C:\Windows\System32\DvexcGD.exe
  C:\Windows\System32\DvexcGD.exe
  2⤵
  PID:10824
- C:\Windows\System32\BiWNqSe.exe
  C:\Windows\System32\BiWNqSe.exe
  2⤵
  PID:10852
- C:\Windows\System32\RkwYGkn.exe
  C:\Windows\System32\RkwYGkn.exe
  2⤵
  PID:10880
- C:\Windows\System32\ISWQJAC.exe
  C:\Windows\System32\ISWQJAC.exe
  2⤵
  PID:10916
- C:\Windows\System32\wxOeCmY.exe
  C:\Windows\System32\wxOeCmY.exe
  2⤵
  PID:10984
- C:\Windows\System32\WvJcDRp.exe
  C:\Windows\System32\WvJcDRp.exe
  2⤵
  PID:11000
- C:\Windows\System32\lifXjPo.exe
  C:\Windows\System32\lifXjPo.exe
  2⤵
  PID:11032
- C:\Windows\System32\ZULrrhE.exe
  C:\Windows\System32\ZULrrhE.exe
  2⤵
  PID:11056
- C:\Windows\System32\yTlvRyd.exe
  C:\Windows\System32\yTlvRyd.exe
  2⤵
  PID:11092
- C:\Windows\System32\NdoToAb.exe
  C:\Windows\System32\NdoToAb.exe
  2⤵
  PID:11132
- C:\Windows\System32\FNIAEZt.exe
  C:\Windows\System32\FNIAEZt.exe
  2⤵
  PID:11168
- C:\Windows\System32\RBDEzGK.exe
  C:\Windows\System32\RBDEzGK.exe
  2⤵
  PID:11204
- C:\Windows\System32\xebeyCv.exe
  C:\Windows\System32\xebeyCv.exe
  2⤵
  PID:11232
- C:\Windows\System32\rYCHaTq.exe
  C:\Windows\System32\rYCHaTq.exe
  2⤵
  PID:10256
- C:\Windows\System32\wosbKSo.exe
  C:\Windows\System32\wosbKSo.exe
  2⤵
  PID:10316
- C:\Windows\System32\sZnqVgU.exe
  C:\Windows\System32\sZnqVgU.exe
  2⤵
  PID:10376
- C:\Windows\System32\ekgZLjr.exe
  C:\Windows\System32\ekgZLjr.exe
  2⤵
  PID:10452
- C:\Windows\System32\oKEkwkG.exe
  C:\Windows\System32\oKEkwkG.exe
  2⤵
  PID:10532
- C:\Windows\System32\gAzglCP.exe
  C:\Windows\System32\gAzglCP.exe
  2⤵
  PID:10592
- C:\Windows\System32\HbIJNLL.exe
  C:\Windows\System32\HbIJNLL.exe
  2⤵
  PID:10672
- C:\Windows\System32\GNmQdpa.exe
  C:\Windows\System32\GNmQdpa.exe
  2⤵
  PID:10732
- C:\Windows\System32\juQsCIY.exe
  C:\Windows\System32\juQsCIY.exe
  2⤵
  PID:10804
- C:\Windows\System32\ZeTZRYt.exe
  C:\Windows\System32\ZeTZRYt.exe
  2⤵
  PID:9368
- C:\Windows\System32\mowBhhr.exe
  C:\Windows\System32\mowBhhr.exe
  2⤵
  PID:10816
- C:\Windows\System32\wlKQRYL.exe
  C:\Windows\System32\wlKQRYL.exe
  2⤵
  PID:10876
- C:\Windows\System32\FDksaLj.exe
  C:\Windows\System32\FDksaLj.exe
  2⤵
  PID:1592
- C:\Windows\System32\eOMgoNj.exe
  C:\Windows\System32\eOMgoNj.exe
  2⤵
  PID:10980
- C:\Windows\System32\eqlKfTR.exe
  C:\Windows\System32\eqlKfTR.exe
  2⤵
  PID:10996
- C:\Windows\System32\fxBVZce.exe
  C:\Windows\System32\fxBVZce.exe
  2⤵
  PID:11068
- C:\Windows\System32\XmELAkv.exe
  C:\Windows\System32\XmELAkv.exe
  2⤵
  PID:11128
- C:\Windows\System32\ITqEToF.exe
  C:\Windows\System32\ITqEToF.exe
  2⤵
  PID:11184
- C:\Windows\System32\OTtfdDu.exe
  C:\Windows\System32\OTtfdDu.exe
  2⤵
  PID:11228
- C:\Windows\System32\zWkSpOq.exe
  C:\Windows\System32\zWkSpOq.exe
  2⤵
  PID:10292
- C:\Windows\System32\jtrhIwO.exe
  C:\Windows\System32\jtrhIwO.exe
  2⤵
  PID:10560
- C:\Windows\System32\kDtwUnd.exe
  C:\Windows\System32\kDtwUnd.exe
  2⤵
  PID:9380
- C:\Windows\System32\QzCsemK.exe
  C:\Windows\System32\QzCsemK.exe
  2⤵
  PID:10864
- C:\Windows\System32\ebFAxKz.exe
  C:\Windows\System32\ebFAxKz.exe
  2⤵
  PID:10952
- C:\Windows\System32\vuCpPuB.exe
  C:\Windows\System32\vuCpPuB.exe
  2⤵
  PID:11112
- C:\Windows\System32\HkOQtCs.exe
  C:\Windows\System32\HkOQtCs.exe
  2⤵
  PID:11200
- C:\Windows\System32\KGPZJiw.exe
  C:\Windows\System32\KGPZJiw.exe
  2⤵
  PID:10648
- C:\Windows\System32\UdFOrye.exe
  C:\Windows\System32\UdFOrye.exe
  2⤵
  PID:10960
- C:\Windows\System32\bMroAaY.exe
  C:\Windows\System32\bMroAaY.exe
  2⤵
  PID:11156
- C:\Windows\System32\MaQxXMI.exe
  C:\Windows\System32\MaQxXMI.exe
  2⤵
  PID:10844
- C:\Windows\System32\YZSjibd.exe
  C:\Windows\System32\YZSjibd.exe
  2⤵
  PID:11048
- C:\Windows\System32\YqJvGeS.exe
  C:\Windows\System32\YqJvGeS.exe
  2⤵
  PID:11284
- C:\Windows\System32\eyPlkAj.exe
  C:\Windows\System32\eyPlkAj.exe
  2⤵
  PID:11312
- C:\Windows\System32\ehpxukV.exe
  C:\Windows\System32\ehpxukV.exe
  2⤵
  PID:11340
- C:\Windows\System32\Yjkkhoo.exe
  C:\Windows\System32\Yjkkhoo.exe
  2⤵
  PID:11368
- C:\Windows\System32\zZNjruF.exe
  C:\Windows\System32\zZNjruF.exe
  2⤵
  PID:11408
- C:\Windows\System32\lhZFDPh.exe
  C:\Windows\System32\lhZFDPh.exe
  2⤵
  PID:11432
- C:\Windows\System32\qEQVcNk.exe
  C:\Windows\System32\qEQVcNk.exe
  2⤵
  PID:11452
- C:\Windows\System32\zWDGDil.exe
  C:\Windows\System32\zWDGDil.exe
  2⤵
  PID:11480
- C:\Windows\System32\bvmXMlB.exe
  C:\Windows\System32\bvmXMlB.exe
  2⤵
  PID:11508
- C:\Windows\System32\dwoLjhC.exe
  C:\Windows\System32\dwoLjhC.exe
  2⤵
  PID:11536
- C:\Windows\System32\QcovlQO.exe
  C:\Windows\System32\QcovlQO.exe
  2⤵
  PID:11564
- C:\Windows\System32\SEYrbQI.exe
  C:\Windows\System32\SEYrbQI.exe
  2⤵
  PID:11592
- C:\Windows\System32\DZjRFOJ.exe
  C:\Windows\System32\DZjRFOJ.exe
  2⤵
  PID:11620
- C:\Windows\System32\UVsIFkd.exe
  C:\Windows\System32\UVsIFkd.exe
  2⤵
  PID:11648
- C:\Windows\System32\OaLiwkH.exe
  C:\Windows\System32\OaLiwkH.exe
  2⤵
  PID:11676
- C:\Windows\System32\FSlpADr.exe
  C:\Windows\System32\FSlpADr.exe
  2⤵
  PID:11704
- C:\Windows\System32\WwkGOyG.exe
  C:\Windows\System32\WwkGOyG.exe
  2⤵
  PID:11732
- C:\Windows\System32\qgnjrjh.exe
  C:\Windows\System32\qgnjrjh.exe
  2⤵
  PID:11760
- C:\Windows\System32\DHrQBRO.exe
  C:\Windows\System32\DHrQBRO.exe
  2⤵
  PID:11788
- C:\Windows\System32\HsiFBWN.exe
  C:\Windows\System32\HsiFBWN.exe
  2⤵
  PID:11816
- C:\Windows\System32\btrraoK.exe
  C:\Windows\System32\btrraoK.exe
  2⤵
  PID:11844
- C:\Windows\System32\PDUYfZk.exe
  C:\Windows\System32\PDUYfZk.exe
  2⤵
  PID:11868
- C:\Windows\System32\wequOSB.exe
  C:\Windows\System32\wequOSB.exe
  2⤵
  PID:11900
- C:\Windows\System32\cRWEqAc.exe
  C:\Windows\System32\cRWEqAc.exe
  2⤵
  PID:11928
- C:\Windows\System32\fKXhlTa.exe
  C:\Windows\System32\fKXhlTa.exe
  2⤵
  PID:11956
- C:\Windows\System32\YDLIUVb.exe
  C:\Windows\System32\YDLIUVb.exe
  2⤵
  PID:11984
- C:\Windows\System32\aCcyyCg.exe
  C:\Windows\System32\aCcyyCg.exe
  2⤵
  PID:12012
- C:\Windows\System32\nNaXEWv.exe
  C:\Windows\System32\nNaXEWv.exe
  2⤵
  PID:12052
- C:\Windows\System32\RYMaTwg.exe
  C:\Windows\System32\RYMaTwg.exe
  2⤵
  PID:12072
- C:\Windows\System32\DEsGhmB.exe
  C:\Windows\System32\DEsGhmB.exe
  2⤵
  PID:12100
- C:\Windows\System32\DtEPUtk.exe
  C:\Windows\System32\DtEPUtk.exe
  2⤵
  PID:12132
- C:\Windows\System32\MyjvgpY.exe
  C:\Windows\System32\MyjvgpY.exe
  2⤵
  PID:12160
- C:\Windows\System32\OvqVczf.exe
  C:\Windows\System32\OvqVczf.exe
  2⤵
  PID:12188
- C:\Windows\System32\McbnPbW.exe
  C:\Windows\System32\McbnPbW.exe
  2⤵
  PID:12216
- C:\Windows\System32\sGqChbF.exe
  C:\Windows\System32\sGqChbF.exe
  2⤵
  PID:12244
- C:\Windows\System32\QkrnADY.exe
  C:\Windows\System32\QkrnADY.exe
  2⤵
  PID:12272
- C:\Windows\System32\wMQkmcA.exe
  C:\Windows\System32\wMQkmcA.exe
  2⤵
  PID:11296
- C:\Windows\System32\MZoeOWs.exe
  C:\Windows\System32\MZoeOWs.exe
  2⤵
  PID:5396
- C:\Windows\System32\jvIKPmz.exe
  C:\Windows\System32\jvIKPmz.exe
  2⤵
  PID:4632
- C:\Windows\System32\IDBxGsw.exe
  C:\Windows\System32\IDBxGsw.exe
  2⤵
  PID:1480
- C:\Windows\System32\QAXwmgq.exe
  C:\Windows\System32\QAXwmgq.exe
  2⤵
  PID:3716
- C:\Windows\System32\MGtoQRg.exe
  C:\Windows\System32\MGtoQRg.exe
  2⤵
  PID:11392
- C:\Windows\System32\CZEjSzg.exe
  C:\Windows\System32\CZEjSzg.exe
  2⤵
  PID:11420
- C:\Windows\System32\UwnHdIV.exe
  C:\Windows\System32\UwnHdIV.exe
  2⤵
  PID:11476
- C:\Windows\System32\mtYdEiR.exe
  C:\Windows\System32\mtYdEiR.exe
  2⤵
  PID:11548
- C:\Windows\System32\HDRQPeR.exe
  C:\Windows\System32\HDRQPeR.exe
  2⤵
  PID:11612
- C:\Windows\System32\rKTvAiz.exe
  C:\Windows\System32\rKTvAiz.exe
  2⤵
  PID:11672
- C:\Windows\System32\zNcTJHM.exe
  C:\Windows\System32\zNcTJHM.exe
  2⤵
  PID:11728
- C:\Windows\System32\pRFRrYN.exe
  C:\Windows\System32\pRFRrYN.exe
  2⤵
  PID:11800
- C:\Windows\System32\xRzJlQf.exe
  C:\Windows\System32\xRzJlQf.exe
  2⤵
  PID:11856
- C:\Windows\System32\vErlnYv.exe
  C:\Windows\System32\vErlnYv.exe
  2⤵
  PID:11924
- C:\Windows\System32\bpLzBSi.exe
  C:\Windows\System32\bpLzBSi.exe
  2⤵
  PID:11996
- C:\Windows\System32\xicUKom.exe
  C:\Windows\System32\xicUKom.exe
  2⤵
  PID:12064
- C:\Windows\System32\TIIewGL.exe
  C:\Windows\System32\TIIewGL.exe
  2⤵
  PID:12128
- C:\Windows\System32\VaYhyzN.exe
  C:\Windows\System32\VaYhyzN.exe
  2⤵
  PID:12200
- C:\Windows\System32\giWrUvI.exe
  C:\Windows\System32\giWrUvI.exe
  2⤵
  PID:12264
- C:\Windows\System32\iNkGiVD.exe
  C:\Windows\System32\iNkGiVD.exe
  2⤵
  PID:11336
- C:\Windows\System32\VEcuMZM.exe
  C:\Windows\System32\VEcuMZM.exe
  2⤵
  PID:2356
- C:\Windows\System32\SVyveHj.exe
  C:\Windows\System32\SVyveHj.exe
  2⤵
  PID:7076
- C:\Windows\System32\HOUCxnz.exe
  C:\Windows\System32\HOUCxnz.exe
  2⤵
  PID:11528
- C:\Windows\System32\XCAzrNv.exe
  C:\Windows\System32\XCAzrNv.exe
  2⤵
  PID:11668
- C:\Windows\System32\gKrKjpX.exe
  C:\Windows\System32\gKrKjpX.exe
  2⤵
  PID:11828
- C:\Windows\System32\xxfuykD.exe
  C:\Windows\System32\xxfuykD.exe
  2⤵
  PID:11976
- C:\Windows\System32\NgCbGUG.exe
  C:\Windows\System32\NgCbGUG.exe
  2⤵
  PID:12124
- C:\Windows\System32\sWgMlDL.exe
  C:\Windows\System32\sWgMlDL.exe
  2⤵
  PID:11276
- C:\Windows\System32\orlVniu.exe
  C:\Windows\System32\orlVniu.exe
  2⤵
  PID:11388
- C:\Windows\System32\WPUeSWX.exe
  C:\Windows\System32\WPUeSWX.exe
  2⤵
  PID:11660
- C:\Windows\System32\BPKMfdD.exe
  C:\Windows\System32\BPKMfdD.exe
  2⤵
  PID:12060
- C:\Windows\System32\XTHyNqd.exe
  C:\Windows\System32\XTHyNqd.exe
  2⤵
  PID:11256
- C:\Windows\System32\nNQuIzz.exe
  C:\Windows\System32\nNQuIzz.exe
  2⤵
  PID:3912
- C:\Windows\System32\usPPvvb.exe
  C:\Windows\System32\usPPvvb.exe
  2⤵
  PID:3648
- C:\Windows\System32\oqJNhMT.exe
  C:\Windows\System32\oqJNhMT.exe
  2⤵
  PID:1864
- C:\Windows\System32\GiIaDNj.exe
  C:\Windows\System32\GiIaDNj.exe
  2⤵
  PID:1916
- C:\Windows\System32\lLtnlhy.exe
  C:\Windows\System32\lLtnlhy.exe
  2⤵
  PID:12308
- C:\Windows\System32\HFjyBWU.exe
  C:\Windows\System32\HFjyBWU.exe
  2⤵
  PID:12336
- C:\Windows\System32\QOnSWMO.exe
  C:\Windows\System32\QOnSWMO.exe
  2⤵
  PID:12364
- C:\Windows\System32\pydgGZg.exe
  C:\Windows\System32\pydgGZg.exe
  2⤵
  PID:12392
- C:\Windows\System32\GpGmHtA.exe
  C:\Windows\System32\GpGmHtA.exe
  2⤵
  PID:12420
- C:\Windows\System32\ticWRMg.exe
  C:\Windows\System32\ticWRMg.exe
  2⤵
  PID:12448
- C:\Windows\System32\UDziRDm.exe
  C:\Windows\System32\UDziRDm.exe
  2⤵
  PID:12476
- C:\Windows\System32\DOwMsGB.exe
  C:\Windows\System32\DOwMsGB.exe
  2⤵
  PID:12504
- C:\Windows\System32\ZtYpadA.exe
  C:\Windows\System32\ZtYpadA.exe
  2⤵
  PID:12532
- C:\Windows\System32\WflPyyW.exe
  C:\Windows\System32\WflPyyW.exe
  2⤵
  PID:12560
- C:\Windows\System32\CLydXHs.exe
  C:\Windows\System32\CLydXHs.exe
  2⤵
  PID:12588
- C:\Windows\System32\HvZJGZl.exe
  C:\Windows\System32\HvZJGZl.exe
  2⤵
  PID:12616
- C:\Windows\System32\pLUBmvs.exe
  C:\Windows\System32\pLUBmvs.exe
  2⤵
  PID:12644
- C:\Windows\System32\ehitCnQ.exe
  C:\Windows\System32\ehitCnQ.exe
  2⤵
  PID:12672
- C:\Windows\System32\EffMZGU.exe
  C:\Windows\System32\EffMZGU.exe
  2⤵
  PID:12700
- C:\Windows\System32\cwTHcPx.exe
  C:\Windows\System32\cwTHcPx.exe
  2⤵
  PID:12728
- C:\Windows\System32\VgFKOEW.exe
  C:\Windows\System32\VgFKOEW.exe
  2⤵
  PID:12756
- C:\Windows\System32\vVNBuan.exe
  C:\Windows\System32\vVNBuan.exe
  2⤵
  PID:12784
- C:\Windows\System32\LcPhROm.exe
  C:\Windows\System32\LcPhROm.exe
  2⤵
  PID:12812
- C:\Windows\System32\PKzWjoT.exe
  C:\Windows\System32\PKzWjoT.exe
  2⤵
  PID:12840
- C:\Windows\System32\QrprVyO.exe
  C:\Windows\System32\QrprVyO.exe
  2⤵
  PID:12872
- C:\Windows\System32\nWOtDdR.exe
  C:\Windows\System32\nWOtDdR.exe
  2⤵
  PID:12900
- C:\Windows\System32\nnmEEYU.exe
  C:\Windows\System32\nnmEEYU.exe
  2⤵
  PID:12928
- C:\Windows\System32\uuVHXIM.exe
  C:\Windows\System32\uuVHXIM.exe
  2⤵
  PID:12956
- C:\Windows\System32\DqjSorb.exe
  C:\Windows\System32\DqjSorb.exe
  2⤵
  PID:12984
- C:\Windows\System32\YAOBCRU.exe
  C:\Windows\System32\YAOBCRU.exe
  2⤵
  PID:13012
- C:\Windows\System32\iUSvAqN.exe
  C:\Windows\System32\iUSvAqN.exe
  2⤵
  PID:13040
- C:\Windows\System32\uAFrKDH.exe
  C:\Windows\System32\uAFrKDH.exe
  2⤵
  PID:13068
- C:\Windows\System32\kTeXZiy.exe
  C:\Windows\System32\kTeXZiy.exe
  2⤵
  PID:13096
- C:\Windows\System32\ENZTlhY.exe
  C:\Windows\System32\ENZTlhY.exe
  2⤵
  PID:13124
- C:\Windows\System32\RbHyMPg.exe
  C:\Windows\System32\RbHyMPg.exe
  2⤵
  PID:13152
- C:\Windows\System32\lzqSreQ.exe
  C:\Windows\System32\lzqSreQ.exe
  2⤵
  PID:13180
- C:\Windows\System32\HfaeKFQ.exe
  C:\Windows\System32\HfaeKFQ.exe
  2⤵
  PID:13208
- C:\Windows\System32\TwGKFwu.exe
  C:\Windows\System32\TwGKFwu.exe
  2⤵
  PID:13236
- C:\Windows\System32\VklDgbE.exe
  C:\Windows\System32\VklDgbE.exe
  2⤵
  PID:13272
- C:\Windows\System32\rOinqJm.exe
  C:\Windows\System32\rOinqJm.exe
  2⤵
  PID:13292
- C:\Windows\System32\RqzkqwK.exe
  C:\Windows\System32\RqzkqwK.exe
  2⤵
  PID:12304
- C:\Windows\System32\FosUtDB.exe
  C:\Windows\System32\FosUtDB.exe
  2⤵
  PID:12376
- C:\Windows\System32\IsdkxNZ.exe
  C:\Windows\System32\IsdkxNZ.exe
  2⤵
  PID:12432
- C:\Windows\System32\ZidhRXG.exe
  C:\Windows\System32\ZidhRXG.exe
  2⤵
  PID:12496
- C:\Windows\System32\GeNqCgg.exe
  C:\Windows\System32\GeNqCgg.exe
  2⤵
  PID:12556
- C:\Windows\System32\iESnayN.exe
  C:\Windows\System32\iESnayN.exe
  2⤵
  PID:12628
- C:\Windows\System32\TBgWdMH.exe
  C:\Windows\System32\TBgWdMH.exe
  2⤵
  PID:12692
- C:\Windows\System32\DtVziTc.exe
  C:\Windows\System32\DtVziTc.exe
  2⤵
  PID:12752
- C:\Windows\System32\veOGuLb.exe
  C:\Windows\System32\veOGuLb.exe
  2⤵
  PID:12824
- C:\Windows\System32\kjCIQmP.exe
  C:\Windows\System32\kjCIQmP.exe
  2⤵
  PID:12920
- C:\Windows\System32\URXZMlm.exe
  C:\Windows\System32\URXZMlm.exe
  2⤵
  PID:13024
- C:\Windows\System32\scJrHXt.exe
  C:\Windows\System32\scJrHXt.exe
  2⤵
  PID:13164
- C:\Windows\System32\csRuFET.exe
  C:\Windows\System32\csRuFET.exe
  2⤵
  PID:13220
- C:\Windows\System32\NCCvGee.exe
  C:\Windows\System32\NCCvGee.exe
  2⤵
  PID:12404
- C:\Windows\System32\WPxmivA.exe
  C:\Windows\System32\WPxmivA.exe
  2⤵
  PID:12612
- C:\Windows\System32\yjMlEqw.exe
  C:\Windows\System32\yjMlEqw.exe
  2⤵
  PID:12804
- C:\Windows\System32\ixQxzuK.exe
  C:\Windows\System32\ixQxzuK.exe
  2⤵
  PID:13060
- C:\Windows\System32\UxNImIw.exe
  C:\Windows\System32\UxNImIw.exe
  2⤵
  PID:13232
- C:\Windows\System32\qKigFCD.exe
  C:\Windows\System32\qKigFCD.exe
  2⤵
  PID:12332
- C:\Windows\System32\rIuewII.exe
  C:\Windows\System32\rIuewII.exe
  2⤵
  PID:13144
- C:\Windows\System32\oBXqKIx.exe
  C:\Windows\System32\oBXqKIx.exe
  2⤵
  PID:13336
- C:\Windows\System32\eckUYhE.exe
  C:\Windows\System32\eckUYhE.exe
  2⤵
  PID:13364
- C:\Windows\System32\MULkJtW.exe
  C:\Windows\System32\MULkJtW.exe
  2⤵
  PID:13392
- C:\Windows\System32\vUeSxjM.exe
  C:\Windows\System32\vUeSxjM.exe
  2⤵
  PID:13420
- C:\Windows\System32\mxYszyo.exe
  C:\Windows\System32\mxYszyo.exe
  2⤵
  PID:13448
- C:\Windows\System32\NelmIUb.exe
  C:\Windows\System32\NelmIUb.exe
  2⤵
  PID:13476
- C:\Windows\System32\xpfUAkJ.exe
  C:\Windows\System32\xpfUAkJ.exe
  2⤵
  PID:13504
- C:\Windows\System32\gvarqVf.exe
  C:\Windows\System32\gvarqVf.exe
  2⤵
  PID:13532

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\BRZIAkG.exe

Filesize
2.6MB

MD5
02e4a337430c2ff47d6d8387e606d11c

SHA1
61712d277e1001a99fa2ef124e401497d121e727

SHA256
a462d71e87276c499f78db11488b7cede6a771ab819c5b40e0393f1dd6a75a83

SHA512
524417be45e057c819cb5c05266e8a01711cc6bad7a192a0c5f7809881d7eb06d99f1732bb9aa2a4b69379bbbf08b9689e253d3b8534a0993e6ee89dd38c9a33

Download Submit
C:\Windows\System32\CSNAVNc.exe

Filesize
2.6MB

MD5
d72fe7019b44fdd4fd4d5e3bb059ef3a

SHA1
a8edbceee15337034fca17eb5e6b9d0f38acae6e

SHA256
47164ce2ec98417f7536ba4c8052d3f51aa99bc58bee42e93f993c0006752390

SHA512
9fa7a730521722953b94e59bb0850d419b29bb4ed7a64c422c7fcfefbe369606d28daa97f0bcbec4cb1f1656a8ea7c0ecff1a5c51ded4676d66b2ed02d29dd6b

Download Submit
C:\Windows\System32\FpwCOKK.exe

Filesize
2.6MB

MD5
366e936a52093cf4a0dc687efc453bc1

SHA1
a664c68d19648627f9b1b2fe4f6cb81d5734d7cc

SHA256
3bf75832b909d09446a2f6c199235ec1d7306ec464641a9783187ae24530f7f1

SHA512
dc410cb073636f03ee632c0dff3b76ed6b2683ddcf4eed62ed32201cfd5a5b61d9f2c45b00107c9e80a7a03adc4965d49ba57c8dd7d05be771d3f2c9e7558af9

Download Submit
C:\Windows\System32\JuMXJtM.exe

Filesize
2.6MB

MD5
607360173ac30e8f52a4ead7f746a190

SHA1
4c23ffcc7a4c3414361bf1941eb06c941fc8a36b

SHA256
36a18bbe2e7291b8682d26a68b30de6161771631302f7d42d9a04b6c4313ca20

SHA512
f6e4f7e210dedd5613d1f0baab281c8ca7b5e3b023708ac53179c323208720d4b5b6402ec120fbd8656b34a5e7c4a1f057c848a8b51ea28710f6befe22393162

Download Submit
C:\Windows\System32\KfxSlwX.exe

Filesize
2.6MB

MD5
235dbf6ec88cc5c75e12cebd48caccaa

SHA1
cdccd08658af8d82efdeaf1951da111dccc88b43

SHA256
0f67a7b6287134d48610a0878ad0a95d747d8b76a03d0738daecc4f89f6300eb

SHA512
f7efd1577471f79827166fb2cc66b52765ee09e1e69ffcfd35de8fd3c7e8243246c4ec3481565cd1b7560d90e0a355ced703515be729b5efb6b0864087347ca8

Download Submit
C:\Windows\System32\TnmwHoS.exe

Filesize
2.6MB

MD5
7cd63508f3a4f977e6d028dd91854526

SHA1
dce0d9625f2bb8c9900cdb1556bc713d4b57528d

SHA256
b4f5e146bdfe35fe1e7451299c371e3a739cfc8da80bc09355941ce861c3e378

SHA512
d10c7aa9e2940c1a510a9e6809893b6e567207da479a95e9e10648b875bb41898511b8e22a8c8abb5c67487a295de4c2a0ed425bff4013d0686cfb2bbdaad809

Download Submit
C:\Windows\System32\VQJuMbY.exe

Filesize
1.2MB

MD5
6d7be4562532213165259cc757a776a5

SHA1
a58b978e99b9f31af3b049eec172fc2f8e64092f

SHA256
8c3e390fd8199728f18caf77ea4117ad6e5949caa03bc99a1c636f90981182c4

SHA512
d6f74f3fa821d6cfbfed8c6816ec2249a29acdb9e494c03a2d2558d5f6286e72f8188b44a33af811e779047032cd0eaaf29583b5acb58b50e92be06b1efaecfb

Download Submit
C:\Windows\System32\VQJuMbY.exe

Filesize
2.6MB

MD5
e33675ed4415027b622009f8b05fbf83

SHA1
b6dec7c904e431bdfc75b4a820969d6c2297d298

SHA256
fff0abcc4d89a51be42fc4a7bb0f0aef912889f358ce13ff5d5019d84714fe39

SHA512
f1317128d7a33d285178458b75f8272ee31067fdc5396a93e800fb750da02741c7cfb8a9729b22fa1b9feafd620788f2a34bb82b18dc212d8940e5d8bc7c7e23

Download Submit
C:\Windows\System32\WgJKaJC.exe

Filesize
2.6MB

MD5
45d1067694f61c1b48646e564cecb079

SHA1
ab9a729677553b30ab021d9cc5724c0900108635

SHA256
68953c3d2a91a4cae5fafd9834effd2fd74e9bca0d9aebb456dee83f0080af8d

SHA512
f5b6e33f51821281d5266e7b06a904da319c7ddc9edb27653a78a51e1958ac9b667356e25202850f6e684bf5cf0a202a5ead51e78d64eec2d4313ecf1b4f076d

Download Submit
C:\Windows\System32\WgJKaJC.exe

Filesize
1.7MB

MD5
10df93ab7b27888e56720a804a5a0515

SHA1
5711d705e71b1657c5d4e09189e3e99c883aeda1

SHA256
289c40fcdafd581396a2c6ac57deaeaf04bf05d33d18ff62f3353dd2834ea04b

SHA512
0a01fc417f202fee4901afd173d7404621ab5a955c3d2bb558822bd0fccaba00ac5b910779f684f92b9c5f6124a9f10a36cba23d7c0ed5f13fa59cc6bfd84013

Download Submit
C:\Windows\System32\XjFJaVC.exe

Filesize
1.8MB

MD5
2ce7b62342de4b5fc1837503c8cbb2b8

SHA1
7b9e81ee404b7ec2bd3027950189a5da37288bef

SHA256
d263373f9842fb0003ed7e1cca1996b8cc58d05ec776c986f19ddca73f3d4ea3

SHA512
07c5a88a396dc21d91e19b17dd6a59c80d679b6434cd255cd826c09fe5bd2b5e8a0e2cee9f87d8e865d74a816257cfc42a68c4714c7ce4f4e7836c35a320663b

Download Submit
C:\Windows\System32\XjFJaVC.exe

Filesize
2.6MB

MD5
645141d46b767c8b71ab2616c1a22af4

SHA1
168df4bddd4edfe8e53f8a88baed54af4cdc8b63

SHA256
9e4b826737bceb6e83b699461c2bb8690979f252a7de29658ce0c152f099b0d1

SHA512
32aace00767d47902019ae0464acefbacce2c3e7bb9be1ad18151113664b2931c80f37df41052033dc9ca7d32ece503db5318f674c54a3f89b5b4c44f71c8d5f

Download Submit
C:\Windows\System32\YHiIMUC.exe

Filesize
1.9MB

MD5
0e28467102143b4120d7c3c1300ef960

SHA1
5d60639e0737f34ee68ebbe8680eb0b077a4147b

SHA256
fc5705137728d339a929e3b998494ab596cc68e2d45264f43f27dd7bda289e6f

SHA512
1a88351718efb8fbc3b9fd3df789e519e807a8ca09c1a2e42ef79565d3aee1cd0b01d8ec152b407e50ad8eb94db94d5bd9beb0bb92aca4f733234799416087f1

Download Submit
C:\Windows\System32\YHiIMUC.exe

Filesize
2.6MB

MD5
8c85118b0b0513507553400c2c837468

SHA1
6acef3bd5efac027b1518b19272fd5b46596d902

SHA256
3e9b374f00e08eb4aab943667d3e4ae3fbc294165bc81a960a061b9578890a88

SHA512
23482eccf134938edf5953cc6efcd8a4a7ee71da838171b3405d2915b163ea473cdf324b7f731a42642031f68f9f5b0fecd2dd60d4cb46e0e26e13c4390e3cc3

Download Submit
C:\Windows\System32\YmizCMT.exe

Filesize
2.6MB

MD5
d5a77c531474307de5f2cb3ad8a21fae

SHA1
82025907172f344b65672a5d96c62b1246f8728d

SHA256
cec619e0e0a5c63ca71cf8396d023d960b2569dc40f632809d78f6389c51ddcf

SHA512
4cbade6085d356884094b398755d6722765aff4a8b776a14dfd8467d5d0621d5df9578a5963457bf5bf6f79dd039f1ae4e3a6434a8c4aed79cd628025b4ff7eb

Download Submit
C:\Windows\System32\YwhLVxp.exe

Filesize
1.4MB

MD5
3536e887471784f6142776a7f1971295

SHA1
9bc25b9c7b50bc1014406e6ab19cb9c07066229e

SHA256
5caa6493438a2ff42092b5e47e4aadb52d9b44ea0e19944602e240514ebfa203

SHA512
bf458f7d31bcee9c4e8b144a3be0c3d1fc80d40706c290982fb4218119ca93268afff10693327f44a7f3003184dc8838e1d8087ab9c3cdee0a93a99a45996f4e

Download Submit
C:\Windows\System32\YwhLVxp.exe

Filesize
2.6MB

MD5
7e3bf5ea5dd50f199f8e7448817d128b

SHA1
6492457c6ec66bd788a670dbd1a36009c49d61c3

SHA256
39b498ea9fe329312027a8f5bd9f5cd8e064e0c7bd0e53c2d412df8a961d38ee

SHA512
9e0bb48cb9e885ac153c1614189f8f5c946a7a94434f0887321893ba64c0c3b647affb373f9e6ab1f0f0d1a6bcd7c724ebcef4b55b16c72d4ffe005e425a2997

Download Submit
C:\Windows\System32\ZInLDhn.exe

Filesize
2.6MB

MD5
176f6a546dcfb8231ac18714144f1cd5

SHA1
9e6f5d9e2dc7e69d920d8fbec9904b5fc53aa639

SHA256
584ccbe76a34cea9447a833b4f5ec937e15a78f0d66b769ea6a6a8737c1adf29

SHA512
461244ecfc3107be36fc670ba2b18fa5fa1ef7e5990619819f836f70cde7720d3072f73c03e69459cecb3ea83e015fa9fe741339af7013d13ebf25a7db1cb806

Download Submit
C:\Windows\System32\ZTKmrUw.exe

Filesize
1.6MB

MD5
1d4fe7036ca9e221ea05f1e4842a2840

SHA1
8cdbaa6d8b43ec21fee5a5584ff8b10be02a03c1

SHA256
db7bd53d469f8c3955a2791213e0b340d3945803ab26a800e47454a82c26cc9b

SHA512
739bb2cbbbbc765a28d8a48119a99fb3a705c4ab9d146598291bd86bacdb12dd7e56c2d7f54c156555344900ce411037a50a76cd832cbe4efb855595b29f1479

Download Submit
C:\Windows\System32\ZTKmrUw.exe

Filesize
2.6MB

MD5
79c2c6428daabea8e55ca3961af63895

SHA1
8fcea1468dec57cd2743d74d284e6c2321bebc5f

SHA256
1f81f4b9374cfcac3f1d1da66342fb858cfd63276afed9ae44bfcb5110b0cb52

SHA512
0c1471e538e14f3f481f0842af27f599b2acf1ee30f8ef125d1111289256c9047dc703e5da0d9f16b629d4f3f6d61da909e0129cf943fc6692e10d2720a8ab93

Download Submit
C:\Windows\System32\aSxnGzT.exe

Filesize
2.6MB

MD5
4111064d60c0d962b90251543ec01f06

SHA1
2e23e61de7e11e34fbf446f8c20fdc44d25de26e

SHA256
89bbd288c79fbb648a659585323426ec2a9009202e23d02cdb51c8b3611bac71

SHA512
f7364c8f527f7bbde650a6fe43382bf127085a15619c57994ed598ba71fc665dbc1a6901e2e72098d14a46ab8854f40be8542e5376d2ffd1f3deb5556aede08f

Download Submit
C:\Windows\System32\bPIvPcR.exe

Filesize
2.6MB

MD5
dd01de1351638ccf8a5a0da07b86846c

SHA1
0ea097710a5516e46415867d7776f5af2c20c421

SHA256
df7ce9b0267b892a39c7152af4b2ef43e2d82d7f1e62a443a296cb8585327b3b

SHA512
e35c63f38870b9c84a7447df6439b65774f85893854e534d049d593db7b22d959114e15ec0a487bf2384b5b95ed6e3d2dee0522320a1e123aea0ee63cbc14cc2

Download Submit
C:\Windows\System32\bbTFnNW.exe

Filesize
2.6MB

MD5
e3cd3b999f036d76141b03a8709edc20

SHA1
5252bc9a912cb7e21e627bd6a7b880d6cf63bd92

SHA256
954cd45d4625af8ee4d5e7a75b3896ba392676511ab0370286cf2e5c318f6e9b

SHA512
dc70e0b269ad5f328a9002b99d84597f3e07738697c6bbf40f183dff81256a7860f1130f4d46cd64e1005e086696ed5dec6eddb2a0befcf279fda39baeb61f32

Download Submit
C:\Windows\System32\dmpRqUK.exe

Filesize
2.6MB

MD5
29d45a7c51d91f42119ac0a38572bf35

SHA1
7074fe235dc5e9458ddf2757936703762448a35b

SHA256
a1de35d37371d5ca59b3beefaef892e734645a365c5267f7b9fa196ca55406f9

SHA512
b8b7abb6974f2ae4f38a17b4058f5897fca374b0dd1574d8ce7ac571ac5986a1fd260d5fec251aa86ecf249db553098fb9c193e07e4fd6c3f6791db4d0484789

Download Submit
C:\Windows\System32\dxMCGnW.exe

Filesize
2.6MB

MD5
6c53596706e9ff6d017b0ba69be00c39

SHA1
891bebc6ae00af695bda1d36291c867e13394291

SHA256
6cdd9f3c378627172d158a520201d187ac3dbac22d8ffcf4d7e87de159191f43

SHA512
9e8f992c1686c6e5c1097af4cb5e51b5e8454907706d2e8e3bef27cef9e99758a4a30ee1463b2098b513d42900dd5baa883b5369cbbaf41eb55f6927eaa5cac5

Download Submit
C:\Windows\System32\dxMCGnW.exe

Filesize
1.2MB

MD5
53cc7546702cf9e884d110233589829c

SHA1
02413a07d7158b2f09314a4766e77921ac0b87c2

SHA256
d9fc959be39920c184b0656baf853894b6ae68eb8125891c66777c3c1cc55153

SHA512
3fc7a8b64d47085283c2e6619f0f194dbf5024fa12c953c8d9f5cb2dc7523b840d1bcde8e1f56eacfdcbe7c70ad79baa7068075f155ec3c433d148357d6a19d9

Download Submit
C:\Windows\System32\kBpZuyi.exe

Filesize
2.6MB

MD5
717f33af0345e01c1bcfbe86f295d6bc

SHA1
6ed66f2570382b302826e1ebb1acdab2845d0476

SHA256
39c2abdc37129c973695e35b8456b6e6f4892fad1cc27a04a79c815bb284e7b2

SHA512
c92a995aa52aad1ec043d3e36218c0aeefb51776931d1fdc9235cd5ab5f3903f90864a22e68901a6affc62ea981bd3ac0e058faa16974150dc2e5680254e110c

Download Submit
C:\Windows\System32\nCtqOJE.exe

Filesize
1.3MB

MD5
a85768b700b96e98f530f835c984f19e

SHA1
19bae42ad7467bcb1c7be17f5d661b9ea6ad3304

SHA256
a78a10c4eb298c6165a695a2d6251fd0de83404c99076fbbdd2513cce6d18370

SHA512
c3e35ad764b12c4e206668a7a90b768e1be3b3a14fdeae18225b77bad6ca610e7dc9e189f9f4d9fa6e0a2371c00291947c0c25bc6e0954a50b694459586e7469

Download Submit
C:\Windows\System32\nCtqOJE.exe

Filesize
2.6MB

MD5
01c91809ee4d3b40bd7aa99cf22b9203

SHA1
44bfe8d0d8db1c387a2a255d2954dd304cda98e9

SHA256
15a0e6132685bdb219143f48218ea871459919210062055fe6cad4731ad44732

SHA512
62790fc2f1d12c1bf116835a982e2db05263cd571cea0699a2db3773f1b24bdddebaeca02e8f8ffe015a64dbd62ed98d7a41e8471a7a1207c4740d29ccdaf4aa

Download Submit
C:\Windows\System32\nRiTnfh.exe

Filesize
2.6MB

MD5
6d2a7cac7af171e4ec29d86b75df8842

SHA1
72e5285888c9f371d18ad0b21706cb70d85ed90d

SHA256
b1a7bda5283943329d11091a45c8b1e80e29402059827f3565eb73a2bd794e3e

SHA512
8bce4022b0db806ceca465e3e029dab208ff2af198ba35d767c8af9a633ea56c725013449b5d644088b000bd8c9ea428abeaf6aec5f44f5b1fed37b9e653bafb

Download Submit
C:\Windows\System32\ouRwMuj.exe

Filesize
2.6MB

MD5
7f02fa6218d3530c55d82863d7e77fe1

SHA1
778cc7756ff094d18b5f1941088b22e7c1ffed49

SHA256
ba76cdb5d8ecf8a29a8f4de903d9544a14e86c634ba4a6f018846ea5cdf5bd16

SHA512
619c8852444015de5b53c5df6dd7b00071245e05baaa2e07a1fe6d0f6e0035e528809423d2529f40ccafb7cdccfef245ed5f6ee99dd17322bc9faea7a55e09c3

Download Submit
C:\Windows\System32\pVlTWHm.exe

Filesize
2.6MB

MD5
0ccb622a3c003a775bda96e8bf068f02

SHA1
ee38c4bd49b9b99d1ab846c3ef206ccf503fd8a1

SHA256
6ff4ddbb53feaea216af8d588dc82bcc7b15015c136086ee6931b89e453a1f32

SHA512
a463513c1d24b3d24ce04d2c54ce3818183760ebbe010a4e5e7d1e87a188a56075c7389689ae7fbf8ca50c84c68983577340f9aea6dde9d8cbcc1aa7e7cf4608

Download Submit
C:\Windows\System32\qZQXgBM.exe

Filesize
2.6MB

MD5
995845623f82c42c61d19cef80228f89

SHA1
76f5934b328e3b686da1994637f73d707b155718

SHA256
5a19c98ad13cf16670d68f9a53d0d1d687ebbe7963b4f66443dc3ff474d5025b

SHA512
44484120f9b720bec38fc3b22916a32198a4307e36aa127ecb61f0b777b6219422dd2247f1621bbd35bb9873583ff434b2ac0c673c69a5dfb7d087a7c06d6bb4

Download Submit
C:\Windows\System32\uTOhGxx.exe

Filesize
2.6MB

MD5
1085dc3a8c35054e9c40cba3af358d1d

SHA1
45ef5f669f38913148870056df5726fbf3d8dbd9

SHA256
2f9d962a65703c1c4065fd373613f1f7e14cd32e12a7aabe7c85d2150188822c

SHA512
72e3ee6677106f694fb6375e1ffa19569fbd9fa70b773253ae1f2475e22d8e4f410c7f231578fed95887bd553f60adffccc26d00b6f8ed6b490e50ce5d383954

Download Submit
C:\Windows\System32\vBBdOlv.exe

Filesize
2.6MB

MD5
5642077996d3f2226cb9c5272ed2c103

SHA1
c805013a0cb75e31c81e2471122d6b7dc261ee40

SHA256
5f9f30f0fc45808f895d795fdf34d69afcf0af351101a1d926b9701911abad55

SHA512
4fc109bcd8963b4b4c2d26072f10b4a9ddddd568cf212a1e6e52cd078a86495f2e67b255618ba5222e2d10f320dd4aa54e7cdb8896e7bf8e3775354538ab126d

Download Submit
C:\Windows\System32\vgBascV.exe

Filesize
2.6MB

MD5
a944a9bf4493920e33e953cd5c7b5cd2

SHA1
87aae0db6978d93c9800d570180adc6176c1a724

SHA256
8fb1ce416d5e51fa486155c9d2129ef9cac041c95a9d1a68058f9960fb4f1b8d

SHA512
7338926304841430589c1907c693459ac9de075490f275badc68841c67f7f5060f1a03c4b3e5ee152d6d7d339f8e884ae3a0eb57525044c167980a2f9ba7fce1

Download Submit
C:\Windows\System32\vsioYic.exe

Filesize
2.6MB

MD5
2a8145255eb1729f3d78be2efe2066b0

SHA1
1a510cf3184a4a21a98d0f6125ce082297d6ce52

SHA256
07e911373916fc1ecd87ab1657049db3f974ac5603761450ccbc4ce45717ea1f

SHA512
67cc2f2a86ab94bc4dd4d8f5cf6f40c68dac283e775e017d43dfc47aab39c4a0921d7af02457ff6eca40be73675db5362384017fb03359a46549850caa757c57

Download Submit
C:\Windows\System32\xfoiIFX.exe

Filesize
1.4MB

MD5
eb2872284253f6067b044ca4552914b5

SHA1
91640cb5376d897b36a0e87feed4d8bc0427b9eb

SHA256
b185b2e104beb215e868d75fc038bc726500c7fd29904b8920235bae3f08777d

SHA512
9ce669668e5592be7a6956bb0dbfe1ce621520fb8884ffd298f78237bf70d285b8b4cb3e431b05be1bd6fc3a595b6edfd4c8286f678656e748c86d3a2ed6971d

Download Submit
C:\Windows\System32\xfoiIFX.exe

Filesize
2.6MB

MD5
cb1e6859cb27049970b7a484e3c6dfb8

SHA1
3a4f775d8622e18ee846d17c7a69df1bb974e5b0

SHA256
071be603ddac94fb68e622655547113c73962f368e91e056a90438e381c8d181

SHA512
3fc35d68b2737e650781c35c8dbb86a4a32321567172b0d22cd67ef083686a1e547a8ab8f7e7b1bd263738235e0290fa30fc17f174d628055a079000ab77fa14

Download Submit
C:\Windows\System32\zjKVTEj.exe

Filesize
2.6MB

MD5
a563029411957c1a7a016bc80961c381

SHA1
ebceab597493eaa0331a2f4aa1f91f16ac571ca5

SHA256
bc3b755d7a71d5e5d37673c1e07c9cbafe7c3a1575f31af0667c5a114bea248b

SHA512
fec0fb0f5309a22763e2c5d6f41002a57e1099202cf620bd8f389a664207faab413a56d3334581b18855919a77bf0b08e7aeefdffd896052319dd35245d0fc32

Download Submit
C:\Windows\System32\zquVaXo.exe

Filesize
2.6MB

MD5
239e740744efe36e5e456f866660bdf7

SHA1
96b8d4d12ffb44ebf309fb3af1ef2405074d3095

SHA256
17ef22815a8bc1cba325506f55d61037cda656be8ba910fc04879aeb3a2c12c7

SHA512
bc7af73d3d8db06f6895b18e8e3aa2d7d7e6ac72343ed4a7ac7df62f42465a3d3f3b8d989a3ad0808e465ab439eeaf99bff95b488657418e7b63e9c97214a307

Download Submit
memory/636-107-0x00007FF759A70000-0x00007FF759E65000-memory.dmp

Filesize
4.0MB

Download
memory/636-1931-0x00007FF759A70000-0x00007FF759E65000-memory.dmp

Filesize
4.0MB

Download
memory/724-1-0x000001B9346C0000-0x000001B9346D0000-memory.dmp

Filesize
64KB

Download
memory/724-1919-0x00007FF7C0CB0000-0x00007FF7C10A5000-memory.dmp

Filesize
4.0MB

Download
memory/724-0-0x00007FF7C0CB0000-0x00007FF7C10A5000-memory.dmp

Filesize
4.0MB

Download
memory/724-124-0x00007FF7C0CB0000-0x00007FF7C10A5000-memory.dmp

Filesize
4.0MB

Download
memory/792-1928-0x00007FF728000000-0x00007FF7283F5000-memory.dmp

Filesize
4.0MB

Download
memory/792-66-0x00007FF728000000-0x00007FF7283F5000-memory.dmp

Filesize
4.0MB

Download
memory/1004-13-0x00007FF65AA50000-0x00007FF65AE45000-memory.dmp

Filesize
4.0MB

Download
memory/1004-1920-0x00007FF65AA50000-0x00007FF65AE45000-memory.dmp

Filesize
4.0MB

Download
memory/1244-78-0x00007FF7745F0000-0x00007FF7749E5000-memory.dmp

Filesize
4.0MB

Download
memory/1244-1930-0x00007FF7745F0000-0x00007FF7749E5000-memory.dmp

Filesize
4.0MB

Download
memory/1404-142-0x00007FF699260000-0x00007FF699655000-memory.dmp

Filesize
4.0MB

Download
memory/1404-1935-0x00007FF699260000-0x00007FF699655000-memory.dmp

Filesize
4.0MB

Download
memory/1512-1934-0x00007FF62FA40000-0x00007FF62FE35000-memory.dmp

Filesize
4.0MB

Download
memory/1512-109-0x00007FF62FA40000-0x00007FF62FE35000-memory.dmp

Filesize
4.0MB

Download
memory/1812-1932-0x00007FF6AFFF0000-0x00007FF6B03E5000-memory.dmp

Filesize
4.0MB

Download
memory/1812-108-0x00007FF6AFFF0000-0x00007FF6B03E5000-memory.dmp

Filesize
4.0MB

Download
memory/2320-364-0x00007FF70B0E0000-0x00007FF70B4D5000-memory.dmp

Filesize
4.0MB

Download
memory/2320-1941-0x00007FF70B0E0000-0x00007FF70B4D5000-memory.dmp

Filesize
4.0MB

Download
memory/2904-31-0x00007FF656800000-0x00007FF656BF5000-memory.dmp

Filesize
4.0MB

Download
memory/2904-1923-0x00007FF656800000-0x00007FF656BF5000-memory.dmp

Filesize
4.0MB

Download
memory/3172-1927-0x00007FF6AB000000-0x00007FF6AB3F5000-memory.dmp

Filesize
4.0MB

Download
memory/3172-44-0x00007FF6AB000000-0x00007FF6AB3F5000-memory.dmp

Filesize
4.0MB

Download
memory/3172-1409-0x00007FF6AB000000-0x00007FF6AB3F5000-memory.dmp

Filesize
4.0MB

Download
memory/3208-356-0x00007FF6BB270000-0x00007FF6BB665000-memory.dmp

Filesize
4.0MB

Download
memory/3208-1940-0x00007FF6BB270000-0x00007FF6BB665000-memory.dmp

Filesize
4.0MB

Download
memory/3260-25-0x00007FF705670000-0x00007FF705A65000-memory.dmp

Filesize
4.0MB

Download
memory/3260-1922-0x00007FF705670000-0x00007FF705A65000-memory.dmp

Filesize
4.0MB

Download
memory/3748-1938-0x00007FF7EB740000-0x00007FF7EBB35000-memory.dmp

Filesize
4.0MB

Download
memory/3748-1917-0x00007FF7EB740000-0x00007FF7EBB35000-memory.dmp

Filesize
4.0MB

Download
memory/3748-110-0x00007FF7EB740000-0x00007FF7EBB35000-memory.dmp

Filesize
4.0MB

Download
memory/3784-1933-0x00007FF7EE920000-0x00007FF7EED15000-memory.dmp

Filesize
4.0MB

Download
memory/3784-91-0x00007FF7EE920000-0x00007FF7EED15000-memory.dmp

Filesize
4.0MB

Download
memory/3784-1914-0x00007FF7EE920000-0x00007FF7EED15000-memory.dmp

Filesize
4.0MB

Download
memory/3944-1926-0x00007FF618670000-0x00007FF618A65000-memory.dmp

Filesize
4.0MB

Download
memory/3944-55-0x00007FF618670000-0x00007FF618A65000-memory.dmp

Filesize
4.0MB

Download
memory/4184-73-0x00007FF7AFC00000-0x00007FF7AFFF5000-memory.dmp

Filesize
4.0MB

Download
memory/4184-1929-0x00007FF7AFC00000-0x00007FF7AFFF5000-memory.dmp

Filesize
4.0MB

Download
memory/4320-1921-0x00007FF75A840000-0x00007FF75AC35000-memory.dmp

Filesize
4.0MB

Download
memory/4320-14-0x00007FF75A840000-0x00007FF75AC35000-memory.dmp

Filesize
4.0MB

Download
memory/4388-1943-0x00007FF75F930000-0x00007FF75FD25000-memory.dmp

Filesize
4.0MB

Download
memory/4388-369-0x00007FF75F930000-0x00007FF75FD25000-memory.dmp

Filesize
4.0MB

Download
memory/4620-1918-0x00007FF6A4500000-0x00007FF6A48F5000-memory.dmp

Filesize
4.0MB

Download
memory/4620-148-0x00007FF6A4500000-0x00007FF6A48F5000-memory.dmp

Filesize
4.0MB

Download
memory/4620-1942-0x00007FF6A4500000-0x00007FF6A48F5000-memory.dmp

Filesize
4.0MB

Download
memory/4680-1915-0x00007FF7C7A30000-0x00007FF7C7E25000-memory.dmp

Filesize
4.0MB

Download
memory/4680-95-0x00007FF7C7A30000-0x00007FF7C7E25000-memory.dmp

Filesize
4.0MB

Download
memory/4680-1939-0x00007FF7C7A30000-0x00007FF7C7E25000-memory.dmp

Filesize
4.0MB

Download
memory/4684-1925-0x00007FF63C8D0000-0x00007FF63CCC5000-memory.dmp

Filesize
4.0MB

Download
memory/4684-51-0x00007FF63C8D0000-0x00007FF63CCC5000-memory.dmp

Filesize
4.0MB

Download
memory/4764-1936-0x00007FF7553F0000-0x00007FF7557E5000-memory.dmp

Filesize
4.0MB

Download
memory/4764-136-0x00007FF7553F0000-0x00007FF7557E5000-memory.dmp

Filesize
4.0MB

Download
memory/4840-1916-0x00007FF6A1440000-0x00007FF6A1835000-memory.dmp

Filesize
4.0MB

Download
memory/4840-1937-0x00007FF6A1440000-0x00007FF6A1835000-memory.dmp

Filesize
4.0MB

Download
memory/4840-100-0x00007FF6A1440000-0x00007FF6A1835000-memory.dmp

Filesize
4.0MB

Download
memory/4856-1924-0x00007FF7CEDF0000-0x00007FF7CF1E5000-memory.dmp

Filesize
4.0MB

Download
memory/4856-38-0x00007FF7CEDF0000-0x00007FF7CF1E5000-memory.dmp

Filesize
4.0MB

Download