xmrig | 5913b1d392510b36a832cae18e26bb4277d942550fc4563c425c1c8b90942e82

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
Size

2.2MB
MD5

00892dfa639a85e6d4af009a2f62c160
SHA1

8bc9de15b9ecf260e6d97c5466b4260dd71f4e3c
SHA256

5913b1d392510b36a832cae18e26bb4277d942550fc4563c425c1c8b90942e82
SHA512

0a8ef1f73a5184344b15cfbf1ec2d292791751ee76c9c5b93ac91be26ed0479b89b8e6823a3cf544687372f26caff19355232d371253deca5d7bd8f0b4a7eca3
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxJTFlt2O+2BWu:BemTLkNdfE0pZrQZ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2812-0-0x00007FF717370000-0x00007FF7176C4000-memory.dmp	xmrig
behavioral2/files/0x00050000000232a4-5.dat	xmrig
behavioral2/files/0x000a00000002340d-9.dat	xmrig
behavioral2/memory/3052-13-0x00007FF78C6B0000-0x00007FF78CA04000-memory.dmp	xmrig
behavioral2/memory/3144-17-0x00007FF73B780000-0x00007FF73BAD4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023412-21.dat	xmrig
behavioral2/memory/1124-24-0x00007FF721E50000-0x00007FF7221A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-38.dat	xmrig
behavioral2/files/0x0007000000023418-53.dat	xmrig
behavioral2/files/0x000700000002341a-63.dat	xmrig
behavioral2/files/0x000700000002341d-74.dat	xmrig
behavioral2/files/0x000700000002341e-83.dat	xmrig
behavioral2/files/0x0007000000023422-97.dat	xmrig
behavioral2/files/0x0007000000023423-108.dat	xmrig
behavioral2/files/0x0007000000023426-123.dat	xmrig
behavioral2/files/0x000700000002342a-143.dat	xmrig
behavioral2/files/0x000700000002342f-162.dat	xmrig
behavioral2/memory/620-677-0x00007FF636B80000-0x00007FF636ED4000-memory.dmp	xmrig
behavioral2/memory/2080-678-0x00007FF7C4200000-0x00007FF7C4554000-memory.dmp	xmrig
behavioral2/memory/3488-680-0x00007FF73CCE0000-0x00007FF73D034000-memory.dmp	xmrig
behavioral2/memory/528-679-0x00007FF690BA0000-0x00007FF690EF4000-memory.dmp	xmrig
behavioral2/memory/3652-681-0x00007FF6E2240000-0x00007FF6E2594000-memory.dmp	xmrig
behavioral2/memory/4524-696-0x00007FF6D9F10000-0x00007FF6DA264000-memory.dmp	xmrig
behavioral2/memory/1816-705-0x00007FF6653B0000-0x00007FF665704000-memory.dmp	xmrig
behavioral2/memory/2444-714-0x00007FF7000F0000-0x00007FF700444000-memory.dmp	xmrig
behavioral2/memory/5080-718-0x00007FF6043E0000-0x00007FF604734000-memory.dmp	xmrig
behavioral2/memory/3992-729-0x00007FF6D6790000-0x00007FF6D6AE4000-memory.dmp	xmrig
behavioral2/memory/4436-730-0x00007FF606D80000-0x00007FF6070D4000-memory.dmp	xmrig
behavioral2/memory/1884-741-0x00007FF76DD80000-0x00007FF76E0D4000-memory.dmp	xmrig
behavioral2/memory/1516-743-0x00007FF633420000-0x00007FF633774000-memory.dmp	xmrig
behavioral2/memory/3000-744-0x00007FF67B450000-0x00007FF67B7A4000-memory.dmp	xmrig
behavioral2/memory/556-747-0x00007FF7D6600000-0x00007FF7D6954000-memory.dmp	xmrig
behavioral2/memory/3456-749-0x00007FF7F90F0000-0x00007FF7F9444000-memory.dmp	xmrig
behavioral2/memory/4920-748-0x00007FF719E60000-0x00007FF71A1B4000-memory.dmp	xmrig
behavioral2/memory/2764-746-0x00007FF662740000-0x00007FF662A94000-memory.dmp	xmrig
behavioral2/memory/1732-745-0x00007FF7EFD80000-0x00007FF7F00D4000-memory.dmp	xmrig
behavioral2/memory/1108-742-0x00007FF6380D0000-0x00007FF638424000-memory.dmp	xmrig
behavioral2/memory/4788-735-0x00007FF641D60000-0x00007FF6420B4000-memory.dmp	xmrig
behavioral2/memory/4556-721-0x00007FF7B12D0000-0x00007FF7B1624000-memory.dmp	xmrig
behavioral2/memory/2516-701-0x00007FF7228C0000-0x00007FF722C14000-memory.dmp	xmrig
behavioral2/memory/1948-692-0x00007FF6C43C0000-0x00007FF6C4714000-memory.dmp	xmrig
behavioral2/memory/4944-689-0x00007FF674530000-0x00007FF674884000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-167.dat	xmrig
behavioral2/files/0x000700000002342e-163.dat	xmrig
behavioral2/files/0x000700000002342d-158.dat	xmrig
behavioral2/files/0x000700000002342c-153.dat	xmrig
behavioral2/files/0x000700000002342b-148.dat	xmrig
behavioral2/files/0x0007000000023429-138.dat	xmrig
behavioral2/files/0x0007000000023428-133.dat	xmrig
behavioral2/files/0x0007000000023427-128.dat	xmrig
behavioral2/files/0x0007000000023425-118.dat	xmrig
behavioral2/files/0x0007000000023424-112.dat	xmrig
behavioral2/files/0x0007000000023421-98.dat	xmrig
behavioral2/files/0x0007000000023420-92.dat	xmrig
behavioral2/files/0x000700000002341f-88.dat	xmrig
behavioral2/files/0x000700000002341c-72.dat	xmrig
behavioral2/files/0x000700000002341b-68.dat	xmrig
behavioral2/files/0x0007000000023419-58.dat	xmrig
behavioral2/files/0x0007000000023417-48.dat	xmrig
behavioral2/files/0x0007000000023416-42.dat	xmrig
behavioral2/files/0x0007000000023414-30.dat	xmrig
behavioral2/files/0x0008000000023413-28.dat	xmrig
behavioral2/memory/1260-18-0x00007FF6E2490000-0x00007FF6E27E4000-memory.dmp	xmrig
behavioral2/memory/2812-2128-0x00007FF717370000-0x00007FF7176C4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3052	QGOzhHQ.exe
3144	YaYcPuL.exe
1260	GzPAKjo.exe
1124	qcQNaXo.exe
620	aqLwrDv.exe
2080	KENmtmF.exe
528	IkQBSqd.exe
3488	aBhuMMq.exe
3652	ADyPhfK.exe
4944	KFyahDh.exe
1948	CauhjeE.exe
4524	dfftWiC.exe
2516	VsfLQAA.exe
1816	KXVEfxw.exe
2444	ICRXaGw.exe
5080	BKlwZgd.exe
4556	MNehEFR.exe
3992	ebogwLj.exe
4436	BnwfhYC.exe
4788	IEmILdr.exe
1884	DizJWrt.exe
1108	uDPScyM.exe
1516	xiupeCX.exe
3000	HuPPdWQ.exe
1732	cvKjiuX.exe
2764	pWJoyjy.exe
556	ecNdkfK.exe
4920	BkIjByX.exe
3456	dWNjWTe.exe
996	TviEtBB.exe
1060	BEVZrRF.exe
2244	QaIWliY.exe
2728	QLnZUPr.exe
2428	ZPTTuTX.exe
4208	EYsYcJX.exe
1152	SqYTwSN.exe
1796	rkVMfes.exe
3508	NclCMYu.exe
3944	ZiOuuWW.exe
1360	rGKWBTQ.exe
5100	mZHJjiV.exe
3260	FdBtoyh.exe
3080	lTaMlLA.exe
3648	kAezDxm.exe
4468	PbDzfPF.exe
2556	DNFiDnc.exe
684	dwhXqAA.exe
4660	eZqQAIi.exe
1780	cjBtLlX.exe
2248	OZCDGKz.exe
4312	XtdQOim.exe
4148	VNpldKA.exe
2904	vSftpOq.exe
2064	OhJQTVY.exe
4356	fFCHOuA.exe
3704	AcfvycD.exe
2008	UrDwapE.exe
2780	qviSfhU.exe
5088	AyOvbXp.exe
2612	vQLUwWY.exe
2608	yoLekYA.exe
1068	JuwHNPd.exe
5036	mIybveo.exe
2680	oXkOXCJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2812-0-0x00007FF717370000-0x00007FF7176C4000-memory.dmp	upx
behavioral2/files/0x00050000000232a4-5.dat	upx
behavioral2/files/0x000a00000002340d-9.dat	upx
behavioral2/memory/3052-13-0x00007FF78C6B0000-0x00007FF78CA04000-memory.dmp	upx
behavioral2/memory/3144-17-0x00007FF73B780000-0x00007FF73BAD4000-memory.dmp	upx
behavioral2/files/0x0008000000023412-21.dat	upx
behavioral2/memory/1124-24-0x00007FF721E50000-0x00007FF7221A4000-memory.dmp	upx
behavioral2/files/0x0007000000023415-38.dat	upx
behavioral2/files/0x0007000000023418-53.dat	upx
behavioral2/files/0x000700000002341a-63.dat	upx
behavioral2/files/0x000700000002341d-74.dat	upx
behavioral2/files/0x000700000002341e-83.dat	upx
behavioral2/files/0x0007000000023422-97.dat	upx
behavioral2/files/0x0007000000023423-108.dat	upx
behavioral2/files/0x0007000000023426-123.dat	upx
behavioral2/files/0x000700000002342a-143.dat	upx
behavioral2/files/0x000700000002342f-162.dat	upx
behavioral2/memory/620-677-0x00007FF636B80000-0x00007FF636ED4000-memory.dmp	upx
behavioral2/memory/2080-678-0x00007FF7C4200000-0x00007FF7C4554000-memory.dmp	upx
behavioral2/memory/3488-680-0x00007FF73CCE0000-0x00007FF73D034000-memory.dmp	upx
behavioral2/memory/528-679-0x00007FF690BA0000-0x00007FF690EF4000-memory.dmp	upx
behavioral2/memory/3652-681-0x00007FF6E2240000-0x00007FF6E2594000-memory.dmp	upx
behavioral2/memory/4524-696-0x00007FF6D9F10000-0x00007FF6DA264000-memory.dmp	upx
behavioral2/memory/1816-705-0x00007FF6653B0000-0x00007FF665704000-memory.dmp	upx
behavioral2/memory/2444-714-0x00007FF7000F0000-0x00007FF700444000-memory.dmp	upx
behavioral2/memory/5080-718-0x00007FF6043E0000-0x00007FF604734000-memory.dmp	upx
behavioral2/memory/3992-729-0x00007FF6D6790000-0x00007FF6D6AE4000-memory.dmp	upx
behavioral2/memory/4436-730-0x00007FF606D80000-0x00007FF6070D4000-memory.dmp	upx
behavioral2/memory/1884-741-0x00007FF76DD80000-0x00007FF76E0D4000-memory.dmp	upx
behavioral2/memory/1516-743-0x00007FF633420000-0x00007FF633774000-memory.dmp	upx
behavioral2/memory/3000-744-0x00007FF67B450000-0x00007FF67B7A4000-memory.dmp	upx
behavioral2/memory/556-747-0x00007FF7D6600000-0x00007FF7D6954000-memory.dmp	upx
behavioral2/memory/3456-749-0x00007FF7F90F0000-0x00007FF7F9444000-memory.dmp	upx
behavioral2/memory/4920-748-0x00007FF719E60000-0x00007FF71A1B4000-memory.dmp	upx
behavioral2/memory/2764-746-0x00007FF662740000-0x00007FF662A94000-memory.dmp	upx
behavioral2/memory/1732-745-0x00007FF7EFD80000-0x00007FF7F00D4000-memory.dmp	upx
behavioral2/memory/1108-742-0x00007FF6380D0000-0x00007FF638424000-memory.dmp	upx
behavioral2/memory/4788-735-0x00007FF641D60000-0x00007FF6420B4000-memory.dmp	upx
behavioral2/memory/4556-721-0x00007FF7B12D0000-0x00007FF7B1624000-memory.dmp	upx
behavioral2/memory/2516-701-0x00007FF7228C0000-0x00007FF722C14000-memory.dmp	upx
behavioral2/memory/1948-692-0x00007FF6C43C0000-0x00007FF6C4714000-memory.dmp	upx
behavioral2/memory/4944-689-0x00007FF674530000-0x00007FF674884000-memory.dmp	upx
behavioral2/files/0x0007000000023430-167.dat	upx
behavioral2/files/0x000700000002342e-163.dat	upx
behavioral2/files/0x000700000002342d-158.dat	upx
behavioral2/files/0x000700000002342c-153.dat	upx
behavioral2/files/0x000700000002342b-148.dat	upx
behavioral2/files/0x0007000000023429-138.dat	upx
behavioral2/files/0x0007000000023428-133.dat	upx
behavioral2/files/0x0007000000023427-128.dat	upx
behavioral2/files/0x0007000000023425-118.dat	upx
behavioral2/files/0x0007000000023424-112.dat	upx
behavioral2/files/0x0007000000023421-98.dat	upx
behavioral2/files/0x0007000000023420-92.dat	upx
behavioral2/files/0x000700000002341f-88.dat	upx
behavioral2/files/0x000700000002341c-72.dat	upx
behavioral2/files/0x000700000002341b-68.dat	upx
behavioral2/files/0x0007000000023419-58.dat	upx
behavioral2/files/0x0007000000023417-48.dat	upx
behavioral2/files/0x0007000000023416-42.dat	upx
behavioral2/files/0x0007000000023414-30.dat	upx
behavioral2/files/0x0008000000023413-28.dat	upx
behavioral2/memory/1260-18-0x00007FF6E2490000-0x00007FF6E27E4000-memory.dmp	upx
behavioral2/memory/2812-2128-0x00007FF717370000-0x00007FF7176C4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\opIGeGs.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\qOkWgIh.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\ZVFuunN.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\vizeHCY.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\sPfJRyz.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\CzOjRNO.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\QaIWliY.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\OFdOtQz.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\oMwhzWr.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\cKUOaia.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\tUsWFEt.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\bhUYWpO.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\YRIAoAA.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\dYmoRTb.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\CBodyOP.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\XDsROLp.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\faMYXDd.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\hsjcnIb.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\pzSXyIZ.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\jtbrzoP.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\jIqEzOe.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\aBhuMMq.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\tHQivZF.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\sMQLyVT.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\kZQovIS.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\XBOxmYG.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\KFyahDh.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\cMTyanh.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\BYJDGBu.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\vcPQJXW.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\KnKSqPG.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\IlFPFTB.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\BaKglFx.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\BkIjByX.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\yChWoTd.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\GfPvWHC.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\eCKASSG.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\OFtpubN.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\UFmosTw.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\HSUUCye.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\TuckJsF.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\IkQBSqd.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\cvKjiuX.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\cXChJQz.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\JyhjOdF.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\RDhxNIw.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\KyuoEgz.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\SnKukJw.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\ICRXaGw.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\KKXOZlc.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\UYIzKJc.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\yhdtBtC.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\VQgetTG.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\dlcCpSK.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\VHWZVOp.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\BNkMRmv.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\AUrkUxQ.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\uMNbJrZ.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\hZODkfZ.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\XVJQJgk.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\WwvrMVj.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\axyEeZJ.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\iQtQvaN.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
File created	C:\Windows\System\MNehEFR.exe	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3052	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	83
PID 2812 wrote to memory of 3052	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	83
PID 2812 wrote to memory of 3144	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	84
PID 2812 wrote to memory of 3144	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	84
PID 2812 wrote to memory of 1260	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	85
PID 2812 wrote to memory of 1260	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	85
PID 2812 wrote to memory of 1124	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	86
PID 2812 wrote to memory of 1124	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	86
PID 2812 wrote to memory of 620	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	87
PID 2812 wrote to memory of 620	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	87
PID 2812 wrote to memory of 2080	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	88
PID 2812 wrote to memory of 2080	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	88
PID 2812 wrote to memory of 528	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	89
PID 2812 wrote to memory of 528	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	89
PID 2812 wrote to memory of 3488	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	90
PID 2812 wrote to memory of 3488	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	90
PID 2812 wrote to memory of 3652	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	91
PID 2812 wrote to memory of 3652	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	91
PID 2812 wrote to memory of 4944	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	92
PID 2812 wrote to memory of 4944	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	92
PID 2812 wrote to memory of 1948	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	93
PID 2812 wrote to memory of 1948	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	93
PID 2812 wrote to memory of 4524	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	94
PID 2812 wrote to memory of 4524	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	94
PID 2812 wrote to memory of 2516	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	95
PID 2812 wrote to memory of 2516	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	95
PID 2812 wrote to memory of 1816	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	96
PID 2812 wrote to memory of 1816	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	96
PID 2812 wrote to memory of 2444	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	97
PID 2812 wrote to memory of 2444	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	97
PID 2812 wrote to memory of 5080	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	98
PID 2812 wrote to memory of 5080	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	98
PID 2812 wrote to memory of 4556	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	99
PID 2812 wrote to memory of 4556	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	99
PID 2812 wrote to memory of 3992	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	100
PID 2812 wrote to memory of 3992	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	100
PID 2812 wrote to memory of 4436	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	101
PID 2812 wrote to memory of 4436	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	101
PID 2812 wrote to memory of 4788	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	102
PID 2812 wrote to memory of 4788	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	102
PID 2812 wrote to memory of 1884	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	103
PID 2812 wrote to memory of 1884	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	103
PID 2812 wrote to memory of 1108	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	104
PID 2812 wrote to memory of 1108	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	104
PID 2812 wrote to memory of 1516	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	105
PID 2812 wrote to memory of 1516	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	105
PID 2812 wrote to memory of 3000	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	106
PID 2812 wrote to memory of 3000	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	106
PID 2812 wrote to memory of 1732	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	107
PID 2812 wrote to memory of 1732	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	107
PID 2812 wrote to memory of 2764	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	108
PID 2812 wrote to memory of 2764	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	108
PID 2812 wrote to memory of 556	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	109
PID 2812 wrote to memory of 556	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	109
PID 2812 wrote to memory of 4920	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	110
PID 2812 wrote to memory of 4920	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	110
PID 2812 wrote to memory of 3456	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	111
PID 2812 wrote to memory of 3456	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	111
PID 2812 wrote to memory of 996	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	112
PID 2812 wrote to memory of 996	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	112
PID 2812 wrote to memory of 1060	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	113
PID 2812 wrote to memory of 1060	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	113
PID 2812 wrote to memory of 2244	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	114
PID 2812 wrote to memory of 2244	2812	00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\00892dfa639a85e6d4af009a2f62c160_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\System\QGOzhHQ.exe
  C:\Windows\System\QGOzhHQ.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\YaYcPuL.exe
  C:\Windows\System\YaYcPuL.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\GzPAKjo.exe
  C:\Windows\System\GzPAKjo.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\qcQNaXo.exe
  C:\Windows\System\qcQNaXo.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\aqLwrDv.exe
  C:\Windows\System\aqLwrDv.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\KENmtmF.exe
  C:\Windows\System\KENmtmF.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\IkQBSqd.exe
  C:\Windows\System\IkQBSqd.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\aBhuMMq.exe
  C:\Windows\System\aBhuMMq.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\ADyPhfK.exe
  C:\Windows\System\ADyPhfK.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\KFyahDh.exe
  C:\Windows\System\KFyahDh.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\CauhjeE.exe
  C:\Windows\System\CauhjeE.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\dfftWiC.exe
  C:\Windows\System\dfftWiC.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\VsfLQAA.exe
  C:\Windows\System\VsfLQAA.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\KXVEfxw.exe
  C:\Windows\System\KXVEfxw.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\ICRXaGw.exe
  C:\Windows\System\ICRXaGw.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\BKlwZgd.exe
  C:\Windows\System\BKlwZgd.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\MNehEFR.exe
  C:\Windows\System\MNehEFR.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\ebogwLj.exe
  C:\Windows\System\ebogwLj.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\BnwfhYC.exe
  C:\Windows\System\BnwfhYC.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\IEmILdr.exe
  C:\Windows\System\IEmILdr.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\DizJWrt.exe
  C:\Windows\System\DizJWrt.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\uDPScyM.exe
  C:\Windows\System\uDPScyM.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\xiupeCX.exe
  C:\Windows\System\xiupeCX.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\HuPPdWQ.exe
  C:\Windows\System\HuPPdWQ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\cvKjiuX.exe
  C:\Windows\System\cvKjiuX.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\pWJoyjy.exe
  C:\Windows\System\pWJoyjy.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ecNdkfK.exe
  C:\Windows\System\ecNdkfK.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\BkIjByX.exe
  C:\Windows\System\BkIjByX.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\dWNjWTe.exe
  C:\Windows\System\dWNjWTe.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\TviEtBB.exe
  C:\Windows\System\TviEtBB.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\BEVZrRF.exe
  C:\Windows\System\BEVZrRF.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\QaIWliY.exe
  C:\Windows\System\QaIWliY.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\QLnZUPr.exe
  C:\Windows\System\QLnZUPr.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ZPTTuTX.exe
  C:\Windows\System\ZPTTuTX.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\EYsYcJX.exe
  C:\Windows\System\EYsYcJX.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\SqYTwSN.exe
  C:\Windows\System\SqYTwSN.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\rkVMfes.exe
  C:\Windows\System\rkVMfes.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\NclCMYu.exe
  C:\Windows\System\NclCMYu.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\ZiOuuWW.exe
  C:\Windows\System\ZiOuuWW.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\rGKWBTQ.exe
  C:\Windows\System\rGKWBTQ.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\mZHJjiV.exe
  C:\Windows\System\mZHJjiV.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\FdBtoyh.exe
  C:\Windows\System\FdBtoyh.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\lTaMlLA.exe
  C:\Windows\System\lTaMlLA.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\kAezDxm.exe
  C:\Windows\System\kAezDxm.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\PbDzfPF.exe
  C:\Windows\System\PbDzfPF.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\DNFiDnc.exe
  C:\Windows\System\DNFiDnc.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\dwhXqAA.exe
  C:\Windows\System\dwhXqAA.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\eZqQAIi.exe
  C:\Windows\System\eZqQAIi.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\cjBtLlX.exe
  C:\Windows\System\cjBtLlX.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\OZCDGKz.exe
  C:\Windows\System\OZCDGKz.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\XtdQOim.exe
  C:\Windows\System\XtdQOim.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\VNpldKA.exe
  C:\Windows\System\VNpldKA.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\vSftpOq.exe
  C:\Windows\System\vSftpOq.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\OhJQTVY.exe
  C:\Windows\System\OhJQTVY.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\fFCHOuA.exe
  C:\Windows\System\fFCHOuA.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\AcfvycD.exe
  C:\Windows\System\AcfvycD.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\UrDwapE.exe
  C:\Windows\System\UrDwapE.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\qviSfhU.exe
  C:\Windows\System\qviSfhU.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\AyOvbXp.exe
  C:\Windows\System\AyOvbXp.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\vQLUwWY.exe
  C:\Windows\System\vQLUwWY.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\yoLekYA.exe
  C:\Windows\System\yoLekYA.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\JuwHNPd.exe
  C:\Windows\System\JuwHNPd.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\mIybveo.exe
  C:\Windows\System\mIybveo.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\oXkOXCJ.exe
  C:\Windows\System\oXkOXCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\ZApVpQl.exe
  C:\Windows\System\ZApVpQl.exe
  2⤵
  PID:936
- C:\Windows\System\yChWoTd.exe
  C:\Windows\System\yChWoTd.exe
  2⤵
  PID:1228
- C:\Windows\System\yrEPcRr.exe
  C:\Windows\System\yrEPcRr.exe
  2⤵
  PID:4688
- C:\Windows\System\zRJAvix.exe
  C:\Windows\System\zRJAvix.exe
  2⤵
  PID:3424
- C:\Windows\System\PGgGiCO.exe
  C:\Windows\System\PGgGiCO.exe
  2⤵
  PID:4004
- C:\Windows\System\rFqAHYJ.exe
  C:\Windows\System\rFqAHYJ.exe
  2⤵
  PID:3696
- C:\Windows\System\YQkECge.exe
  C:\Windows\System\YQkECge.exe
  2⤵
  PID:4544
- C:\Windows\System\vAoMAHW.exe
  C:\Windows\System\vAoMAHW.exe
  2⤵
  PID:4680
- C:\Windows\System\LdmqjzV.exe
  C:\Windows\System\LdmqjzV.exe
  2⤵
  PID:2480
- C:\Windows\System\JMhvncq.exe
  C:\Windows\System\JMhvncq.exe
  2⤵
  PID:1388
- C:\Windows\System\BJotYil.exe
  C:\Windows\System\BJotYil.exe
  2⤵
  PID:4052
- C:\Windows\System\slEHnxA.exe
  C:\Windows\System\slEHnxA.exe
  2⤵
  PID:4256
- C:\Windows\System\RDhxNIw.exe
  C:\Windows\System\RDhxNIw.exe
  2⤵
  PID:5068
- C:\Windows\System\AOubhQY.exe
  C:\Windows\System\AOubhQY.exe
  2⤵
  PID:3268
- C:\Windows\System\XIXiAlN.exe
  C:\Windows\System\XIXiAlN.exe
  2⤵
  PID:4872
- C:\Windows\System\ITvIHXK.exe
  C:\Windows\System\ITvIHXK.exe
  2⤵
  PID:1064
- C:\Windows\System\ZVziqdm.exe
  C:\Windows\System\ZVziqdm.exe
  2⤵
  PID:5144
- C:\Windows\System\JSNWmuz.exe
  C:\Windows\System\JSNWmuz.exe
  2⤵
  PID:5172
- C:\Windows\System\ADTpVHZ.exe
  C:\Windows\System\ADTpVHZ.exe
  2⤵
  PID:5200
- C:\Windows\System\rBDTHRS.exe
  C:\Windows\System\rBDTHRS.exe
  2⤵
  PID:5228
- C:\Windows\System\BADmARh.exe
  C:\Windows\System\BADmARh.exe
  2⤵
  PID:5256
- C:\Windows\System\jKWLYXU.exe
  C:\Windows\System\jKWLYXU.exe
  2⤵
  PID:5284
- C:\Windows\System\oOQosIB.exe
  C:\Windows\System\oOQosIB.exe
  2⤵
  PID:5312
- C:\Windows\System\aUaxehv.exe
  C:\Windows\System\aUaxehv.exe
  2⤵
  PID:5340
- C:\Windows\System\jUcDqVb.exe
  C:\Windows\System\jUcDqVb.exe
  2⤵
  PID:5364
- C:\Windows\System\OFdOtQz.exe
  C:\Windows\System\OFdOtQz.exe
  2⤵
  PID:5396
- C:\Windows\System\wnIRrfG.exe
  C:\Windows\System\wnIRrfG.exe
  2⤵
  PID:5424
- C:\Windows\System\sqIlsZa.exe
  C:\Windows\System\sqIlsZa.exe
  2⤵
  PID:5452
- C:\Windows\System\CSzxvGt.exe
  C:\Windows\System\CSzxvGt.exe
  2⤵
  PID:5480
- C:\Windows\System\pKGnlVb.exe
  C:\Windows\System\pKGnlVb.exe
  2⤵
  PID:5508
- C:\Windows\System\zwhYjCm.exe
  C:\Windows\System\zwhYjCm.exe
  2⤵
  PID:5536
- C:\Windows\System\cwZRSbu.exe
  C:\Windows\System\cwZRSbu.exe
  2⤵
  PID:5564
- C:\Windows\System\GfPvWHC.exe
  C:\Windows\System\GfPvWHC.exe
  2⤵
  PID:5588
- C:\Windows\System\oPbTCsE.exe
  C:\Windows\System\oPbTCsE.exe
  2⤵
  PID:5620
- C:\Windows\System\BUPusPg.exe
  C:\Windows\System\BUPusPg.exe
  2⤵
  PID:5648
- C:\Windows\System\gNOSCNo.exe
  C:\Windows\System\gNOSCNo.exe
  2⤵
  PID:5676
- C:\Windows\System\XhmyibR.exe
  C:\Windows\System\XhmyibR.exe
  2⤵
  PID:5700
- C:\Windows\System\bLzAPGr.exe
  C:\Windows\System\bLzAPGr.exe
  2⤵
  PID:5728
- C:\Windows\System\Xmdwein.exe
  C:\Windows\System\Xmdwein.exe
  2⤵
  PID:5756
- C:\Windows\System\ixaicrv.exe
  C:\Windows\System\ixaicrv.exe
  2⤵
  PID:5788
- C:\Windows\System\cPKjgyU.exe
  C:\Windows\System\cPKjgyU.exe
  2⤵
  PID:5820
- C:\Windows\System\GBQlWpa.exe
  C:\Windows\System\GBQlWpa.exe
  2⤵
  PID:5844
- C:\Windows\System\BYJDGBu.exe
  C:\Windows\System\BYJDGBu.exe
  2⤵
  PID:5872
- C:\Windows\System\VLmAjxl.exe
  C:\Windows\System\VLmAjxl.exe
  2⤵
  PID:5900
- C:\Windows\System\cMTyanh.exe
  C:\Windows\System\cMTyanh.exe
  2⤵
  PID:5928
- C:\Windows\System\XVJQJgk.exe
  C:\Windows\System\XVJQJgk.exe
  2⤵
  PID:5956
- C:\Windows\System\sMQLyVT.exe
  C:\Windows\System\sMQLyVT.exe
  2⤵
  PID:5984
- C:\Windows\System\MXUIeCM.exe
  C:\Windows\System\MXUIeCM.exe
  2⤵
  PID:6008
- C:\Windows\System\lJbHzdD.exe
  C:\Windows\System\lJbHzdD.exe
  2⤵
  PID:6040
- C:\Windows\System\bPOimKT.exe
  C:\Windows\System\bPOimKT.exe
  2⤵
  PID:6068
- C:\Windows\System\ANirwxY.exe
  C:\Windows\System\ANirwxY.exe
  2⤵
  PID:6096
- C:\Windows\System\NUzislO.exe
  C:\Windows\System\NUzislO.exe
  2⤵
  PID:6124
- C:\Windows\System\VoIGTmP.exe
  C:\Windows\System\VoIGTmP.exe
  2⤵
  PID:1540
- C:\Windows\System\gqtCIWV.exe
  C:\Windows\System\gqtCIWV.exe
  2⤵
  PID:2304
- C:\Windows\System\ZZElpBO.exe
  C:\Windows\System\ZZElpBO.exe
  2⤵
  PID:572
- C:\Windows\System\clnfZXt.exe
  C:\Windows\System\clnfZXt.exe
  2⤵
  PID:4636
- C:\Windows\System\uwoHddc.exe
  C:\Windows\System\uwoHddc.exe
  2⤵
  PID:3492
- C:\Windows\System\GrubuVi.exe
  C:\Windows\System\GrubuVi.exe
  2⤵
  PID:3952
- C:\Windows\System\eCKASSG.exe
  C:\Windows\System\eCKASSG.exe
  2⤵
  PID:5156
- C:\Windows\System\EOSCHqs.exe
  C:\Windows\System\EOSCHqs.exe
  2⤵
  PID:5216
- C:\Windows\System\KQnRUka.exe
  C:\Windows\System\KQnRUka.exe
  2⤵
  PID:5276
- C:\Windows\System\mVahNXK.exe
  C:\Windows\System\mVahNXK.exe
  2⤵
  PID:5352
- C:\Windows\System\NezrBzz.exe
  C:\Windows\System\NezrBzz.exe
  2⤵
  PID:5408
- C:\Windows\System\vGhasOE.exe
  C:\Windows\System\vGhasOE.exe
  2⤵
  PID:5468
- C:\Windows\System\MTmbtQK.exe
  C:\Windows\System\MTmbtQK.exe
  2⤵
  PID:5548
- C:\Windows\System\emXbTUc.exe
  C:\Windows\System\emXbTUc.exe
  2⤵
  PID:5608
- C:\Windows\System\suxrbwD.exe
  C:\Windows\System\suxrbwD.exe
  2⤵
  PID:5668
- C:\Windows\System\WLQgfkS.exe
  C:\Windows\System\WLQgfkS.exe
  2⤵
  PID:5724
- C:\Windows\System\DYyHJWH.exe
  C:\Windows\System\DYyHJWH.exe
  2⤵
  PID:5804
- C:\Windows\System\WWBDlWk.exe
  C:\Windows\System\WWBDlWk.exe
  2⤵
  PID:5864
- C:\Windows\System\odWVNVL.exe
  C:\Windows\System\odWVNVL.exe
  2⤵
  PID:5944
- C:\Windows\System\XReimIo.exe
  C:\Windows\System\XReimIo.exe
  2⤵
  PID:6000
- C:\Windows\System\PzbYflH.exe
  C:\Windows\System\PzbYflH.exe
  2⤵
  PID:6060
- C:\Windows\System\ulkndyF.exe
  C:\Windows\System\ulkndyF.exe
  2⤵
  PID:6136
- C:\Windows\System\QbfweyQ.exe
  C:\Windows\System\QbfweyQ.exe
  2⤵
  PID:2980
- C:\Windows\System\XMzzDin.exe
  C:\Windows\System\XMzzDin.exe
  2⤵
  PID:3584
- C:\Windows\System\AgTGfwv.exe
  C:\Windows\System\AgTGfwv.exe
  2⤵
  PID:5132
- C:\Windows\System\reNkmHI.exe
  C:\Windows\System\reNkmHI.exe
  2⤵
  PID:5304
- C:\Windows\System\nPwvueO.exe
  C:\Windows\System\nPwvueO.exe
  2⤵
  PID:5444
- C:\Windows\System\SKpsynV.exe
  C:\Windows\System\SKpsynV.exe
  2⤵
  PID:5584
- C:\Windows\System\elJgfgM.exe
  C:\Windows\System\elJgfgM.exe
  2⤵
  PID:5720
- C:\Windows\System\vcPQJXW.exe
  C:\Windows\System\vcPQJXW.exe
  2⤵
  PID:5856
- C:\Windows\System\KnKSqPG.exe
  C:\Windows\System\KnKSqPG.exe
  2⤵
  PID:6168
- C:\Windows\System\XXphToS.exe
  C:\Windows\System\XXphToS.exe
  2⤵
  PID:6196
- C:\Windows\System\CwAijeA.exe
  C:\Windows\System\CwAijeA.exe
  2⤵
  PID:6224
- C:\Windows\System\ZdbJnTL.exe
  C:\Windows\System\ZdbJnTL.exe
  2⤵
  PID:6252
- C:\Windows\System\pqJRiJn.exe
  C:\Windows\System\pqJRiJn.exe
  2⤵
  PID:6276
- C:\Windows\System\QYobAsM.exe
  C:\Windows\System\QYobAsM.exe
  2⤵
  PID:6308
- C:\Windows\System\jtMBtSX.exe
  C:\Windows\System\jtMBtSX.exe
  2⤵
  PID:6336
- C:\Windows\System\GOVvZGx.exe
  C:\Windows\System\GOVvZGx.exe
  2⤵
  PID:6364
- C:\Windows\System\KVvyGEp.exe
  C:\Windows\System\KVvyGEp.exe
  2⤵
  PID:6388
- C:\Windows\System\ogeGPSS.exe
  C:\Windows\System\ogeGPSS.exe
  2⤵
  PID:6420
- C:\Windows\System\TaBRuyT.exe
  C:\Windows\System\TaBRuyT.exe
  2⤵
  PID:6448
- C:\Windows\System\QpHppPQ.exe
  C:\Windows\System\QpHppPQ.exe
  2⤵
  PID:6476
- C:\Windows\System\GpjALWT.exe
  C:\Windows\System\GpjALWT.exe
  2⤵
  PID:6500
- C:\Windows\System\mJCEhqH.exe
  C:\Windows\System\mJCEhqH.exe
  2⤵
  PID:6532
- C:\Windows\System\tgprkSh.exe
  C:\Windows\System\tgprkSh.exe
  2⤵
  PID:6560
- C:\Windows\System\WiaajSv.exe
  C:\Windows\System\WiaajSv.exe
  2⤵
  PID:6588
- C:\Windows\System\FZWfxqI.exe
  C:\Windows\System\FZWfxqI.exe
  2⤵
  PID:6616
- C:\Windows\System\XhOfEWL.exe
  C:\Windows\System\XhOfEWL.exe
  2⤵
  PID:6644
- C:\Windows\System\rMMbiND.exe
  C:\Windows\System\rMMbiND.exe
  2⤵
  PID:6672
- C:\Windows\System\XDsROLp.exe
  C:\Windows\System\XDsROLp.exe
  2⤵
  PID:6700
- C:\Windows\System\aXGLNVl.exe
  C:\Windows\System\aXGLNVl.exe
  2⤵
  PID:6728
- C:\Windows\System\raTitEF.exe
  C:\Windows\System\raTitEF.exe
  2⤵
  PID:6756
- C:\Windows\System\GdmAEBb.exe
  C:\Windows\System\GdmAEBb.exe
  2⤵
  PID:6784
- C:\Windows\System\zYDtdli.exe
  C:\Windows\System\zYDtdli.exe
  2⤵
  PID:6812
- C:\Windows\System\zPLvRYC.exe
  C:\Windows\System\zPLvRYC.exe
  2⤵
  PID:6840
- C:\Windows\System\nekTTMz.exe
  C:\Windows\System\nekTTMz.exe
  2⤵
  PID:6868
- C:\Windows\System\hsjcnIb.exe
  C:\Windows\System\hsjcnIb.exe
  2⤵
  PID:6896
- C:\Windows\System\puTMVMU.exe
  C:\Windows\System\puTMVMU.exe
  2⤵
  PID:6924
- C:\Windows\System\ppmUFOW.exe
  C:\Windows\System\ppmUFOW.exe
  2⤵
  PID:6952
- C:\Windows\System\isWEeYg.exe
  C:\Windows\System\isWEeYg.exe
  2⤵
  PID:6980
- C:\Windows\System\scuCuyK.exe
  C:\Windows\System\scuCuyK.exe
  2⤵
  PID:7008
- C:\Windows\System\rpZSoTs.exe
  C:\Windows\System\rpZSoTs.exe
  2⤵
  PID:7036
- C:\Windows\System\kcXCkJg.exe
  C:\Windows\System\kcXCkJg.exe
  2⤵
  PID:7064
- C:\Windows\System\dYmoRTb.exe
  C:\Windows\System\dYmoRTb.exe
  2⤵
  PID:7092
- C:\Windows\System\xCImzyn.exe
  C:\Windows\System\xCImzyn.exe
  2⤵
  PID:7120
- C:\Windows\System\mcXBBBr.exe
  C:\Windows\System\mcXBBBr.exe
  2⤵
  PID:7148
- C:\Windows\System\xNsNejY.exe
  C:\Windows\System\xNsNejY.exe
  2⤵
  PID:5968
- C:\Windows\System\wlYuCDg.exe
  C:\Windows\System\wlYuCDg.exe
  2⤵
  PID:6108
- C:\Windows\System\xCnUcYc.exe
  C:\Windows\System\xCnUcYc.exe
  2⤵
  PID:4700
- C:\Windows\System\axyEeZJ.exe
  C:\Windows\System\axyEeZJ.exe
  2⤵
  PID:5380
- C:\Windows\System\bddQWxy.exe
  C:\Windows\System\bddQWxy.exe
  2⤵
  PID:5660
- C:\Windows\System\zkflNdX.exe
  C:\Windows\System\zkflNdX.exe
  2⤵
  PID:6156
- C:\Windows\System\YvjvFYu.exe
  C:\Windows\System\YvjvFYu.exe
  2⤵
  PID:6216
- C:\Windows\System\wdzFBbQ.exe
  C:\Windows\System\wdzFBbQ.exe
  2⤵
  PID:6292
- C:\Windows\System\pVfAqGC.exe
  C:\Windows\System\pVfAqGC.exe
  2⤵
  PID:6352
- C:\Windows\System\aJtRHnp.exe
  C:\Windows\System\aJtRHnp.exe
  2⤵
  PID:6412
- C:\Windows\System\EKZoLqb.exe
  C:\Windows\System\EKZoLqb.exe
  2⤵
  PID:6468
- C:\Windows\System\aYwQDmy.exe
  C:\Windows\System\aYwQDmy.exe
  2⤵
  PID:6544
- C:\Windows\System\inueaDq.exe
  C:\Windows\System\inueaDq.exe
  2⤵
  PID:6600
- C:\Windows\System\qFptdxs.exe
  C:\Windows\System\qFptdxs.exe
  2⤵
  PID:6664
- C:\Windows\System\CBodyOP.exe
  C:\Windows\System\CBodyOP.exe
  2⤵
  PID:6720
- C:\Windows\System\mkDYxCs.exe
  C:\Windows\System\mkDYxCs.exe
  2⤵
  PID:6796
- C:\Windows\System\mWWHEFM.exe
  C:\Windows\System\mWWHEFM.exe
  2⤵
  PID:6852
- C:\Windows\System\CmhbZVw.exe
  C:\Windows\System\CmhbZVw.exe
  2⤵
  PID:6912
- C:\Windows\System\sCfjadi.exe
  C:\Windows\System\sCfjadi.exe
  2⤵
  PID:6972
- C:\Windows\System\iBDrpUO.exe
  C:\Windows\System\iBDrpUO.exe
  2⤵
  PID:4644
- C:\Windows\System\uMNbJrZ.exe
  C:\Windows\System\uMNbJrZ.exe
  2⤵
  PID:7080
- C:\Windows\System\UvZFeXy.exe
  C:\Windows\System\UvZFeXy.exe
  2⤵
  PID:7140
- C:\Windows\System\rDRGGiQ.exe
  C:\Windows\System\rDRGGiQ.exe
  2⤵
  PID:6184
- C:\Windows\System\LXOOyMo.exe
  C:\Windows\System\LXOOyMo.exe
  2⤵
  PID:6324
- C:\Windows\System\YWGaTOX.exe
  C:\Windows\System\YWGaTOX.exe
  2⤵
  PID:4976
- C:\Windows\System\PETAmUx.exe
  C:\Windows\System\PETAmUx.exe
  2⤵
  PID:6576
- C:\Windows\System\KOmAAxF.exe
  C:\Windows\System\KOmAAxF.exe
  2⤵
  PID:6692
- C:\Windows\System\dNIhVUK.exe
  C:\Windows\System\dNIhVUK.exe
  2⤵
  PID:6768
- C:\Windows\System\cUOHowp.exe
  C:\Windows\System\cUOHowp.exe
  2⤵
  PID:6940
- C:\Windows\System\ExWsNKd.exe
  C:\Windows\System\ExWsNKd.exe
  2⤵
  PID:7048
- C:\Windows\System\uuxWnll.exe
  C:\Windows\System\uuxWnll.exe
  2⤵
  PID:3760
- C:\Windows\System\QBSWZOn.exe
  C:\Windows\System\QBSWZOn.exe
  2⤵
  PID:7112
- C:\Windows\System\XGwAXNm.exe
  C:\Windows\System\XGwAXNm.exe
  2⤵
  PID:408
- C:\Windows\System\MTPRTYL.exe
  C:\Windows\System\MTPRTYL.exe
  2⤵
  PID:5064
- C:\Windows\System\RLawXLT.exe
  C:\Windows\System\RLawXLT.exe
  2⤵
  PID:2832
- C:\Windows\System\FqisqFl.exe
  C:\Windows\System\FqisqFl.exe
  2⤵
  PID:4800
- C:\Windows\System\XVjqmNK.exe
  C:\Windows\System\XVjqmNK.exe
  2⤵
  PID:2432
- C:\Windows\System\heFYxCd.exe
  C:\Windows\System\heFYxCd.exe
  2⤵
  PID:2604
- C:\Windows\System\AobWFeO.exe
  C:\Windows\System\AobWFeO.exe
  2⤵
  PID:4288
- C:\Windows\System\hZODkfZ.exe
  C:\Windows\System\hZODkfZ.exe
  2⤵
  PID:6264
- C:\Windows\System\KvDCmog.exe
  C:\Windows\System\KvDCmog.exe
  2⤵
  PID:6632
- C:\Windows\System\kFvnERV.exe
  C:\Windows\System\kFvnERV.exe
  2⤵
  PID:4828
- C:\Windows\System\NJmYgIA.exe
  C:\Windows\System\NJmYgIA.exe
  2⤵
  PID:4768
- C:\Windows\System\XLZBmok.exe
  C:\Windows\System\XLZBmok.exe
  2⤵
  PID:3672
- C:\Windows\System\cihDHCi.exe
  C:\Windows\System\cihDHCi.exe
  2⤵
  PID:4528
- C:\Windows\System\TBdVMaD.exe
  C:\Windows\System\TBdVMaD.exe
  2⤵
  PID:6884
- C:\Windows\System\eSCcoYr.exe
  C:\Windows\System\eSCcoYr.exe
  2⤵
  PID:1804
- C:\Windows\System\vLWOoaS.exe
  C:\Windows\System\vLWOoaS.exe
  2⤵
  PID:5524
- C:\Windows\System\bNqMPGm.exe
  C:\Windows\System\bNqMPGm.exe
  2⤵
  PID:4476
- C:\Windows\System\opIGeGs.exe
  C:\Windows\System\opIGeGs.exe
  2⤵
  PID:6464
- C:\Windows\System\aNhuqve.exe
  C:\Windows\System\aNhuqve.exe
  2⤵
  PID:5244
- C:\Windows\System\HRLxmCw.exe
  C:\Windows\System\HRLxmCw.exe
  2⤵
  PID:7196
- C:\Windows\System\VNWyIvg.exe
  C:\Windows\System\VNWyIvg.exe
  2⤵
  PID:7220
- C:\Windows\System\aZFTJmi.exe
  C:\Windows\System\aZFTJmi.exe
  2⤵
  PID:7244
- C:\Windows\System\VjbzgaT.exe
  C:\Windows\System\VjbzgaT.exe
  2⤵
  PID:7280
- C:\Windows\System\sTDxdOx.exe
  C:\Windows\System\sTDxdOx.exe
  2⤵
  PID:7312
- C:\Windows\System\vGiEAtl.exe
  C:\Windows\System\vGiEAtl.exe
  2⤵
  PID:7340
- C:\Windows\System\ffkILEW.exe
  C:\Windows\System\ffkILEW.exe
  2⤵
  PID:7356
- C:\Windows\System\cUULMDh.exe
  C:\Windows\System\cUULMDh.exe
  2⤵
  PID:7396
- C:\Windows\System\aBEpHMA.exe
  C:\Windows\System\aBEpHMA.exe
  2⤵
  PID:7436
- C:\Windows\System\nVtFgaa.exe
  C:\Windows\System\nVtFgaa.exe
  2⤵
  PID:7464
- C:\Windows\System\XpEUJcA.exe
  C:\Windows\System\XpEUJcA.exe
  2⤵
  PID:7496
- C:\Windows\System\VeRObTV.exe
  C:\Windows\System\VeRObTV.exe
  2⤵
  PID:7524
- C:\Windows\System\ymLrFDY.exe
  C:\Windows\System\ymLrFDY.exe
  2⤵
  PID:7544
- C:\Windows\System\FepOPkL.exe
  C:\Windows\System\FepOPkL.exe
  2⤵
  PID:7580
- C:\Windows\System\yrByLoa.exe
  C:\Windows\System\yrByLoa.exe
  2⤵
  PID:7600
- C:\Windows\System\NNNilOE.exe
  C:\Windows\System\NNNilOE.exe
  2⤵
  PID:7628
- C:\Windows\System\ROjVMFX.exe
  C:\Windows\System\ROjVMFX.exe
  2⤵
  PID:7664
- C:\Windows\System\UnlYvkM.exe
  C:\Windows\System\UnlYvkM.exe
  2⤵
  PID:7692
- C:\Windows\System\ivWSeOX.exe
  C:\Windows\System\ivWSeOX.exe
  2⤵
  PID:7708
- C:\Windows\System\WVzRHBp.exe
  C:\Windows\System\WVzRHBp.exe
  2⤵
  PID:7752
- C:\Windows\System\jdSXbVh.exe
  C:\Windows\System\jdSXbVh.exe
  2⤵
  PID:7780
- C:\Windows\System\eNQvqwt.exe
  C:\Windows\System\eNQvqwt.exe
  2⤵
  PID:7800
- C:\Windows\System\rqynzoV.exe
  C:\Windows\System\rqynzoV.exe
  2⤵
  PID:7840
- C:\Windows\System\JFbKFPU.exe
  C:\Windows\System\JFbKFPU.exe
  2⤵
  PID:7856
- C:\Windows\System\lAaJsoS.exe
  C:\Windows\System\lAaJsoS.exe
  2⤵
  PID:7896
- C:\Windows\System\PKTgDLr.exe
  C:\Windows\System\PKTgDLr.exe
  2⤵
  PID:7924
- C:\Windows\System\bTpYHEJ.exe
  C:\Windows\System\bTpYHEJ.exe
  2⤵
  PID:7940
- C:\Windows\System\FQWKovA.exe
  C:\Windows\System\FQWKovA.exe
  2⤵
  PID:7980
- C:\Windows\System\TPOfRkY.exe
  C:\Windows\System\TPOfRkY.exe
  2⤵
  PID:7996
- C:\Windows\System\VQgetTG.exe
  C:\Windows\System\VQgetTG.exe
  2⤵
  PID:8036
- C:\Windows\System\EFHtlfH.exe
  C:\Windows\System\EFHtlfH.exe
  2⤵
  PID:8064
- C:\Windows\System\blFIJEy.exe
  C:\Windows\System\blFIJEy.exe
  2⤵
  PID:8080
- C:\Windows\System\OIOrSnN.exe
  C:\Windows\System\OIOrSnN.exe
  2⤵
  PID:8116
- C:\Windows\System\XHcuKdQ.exe
  C:\Windows\System\XHcuKdQ.exe
  2⤵
  PID:8136
- C:\Windows\System\SbYkMiM.exe
  C:\Windows\System\SbYkMiM.exe
  2⤵
  PID:8152
- C:\Windows\System\MJLSSsT.exe
  C:\Windows\System\MJLSSsT.exe
  2⤵
  PID:8180
- C:\Windows\System\IlFPFTB.exe
  C:\Windows\System\IlFPFTB.exe
  2⤵
  PID:7212
- C:\Windows\System\yibWPkM.exe
  C:\Windows\System\yibWPkM.exe
  2⤵
  PID:7300
- C:\Windows\System\QgZgAOs.exe
  C:\Windows\System\QgZgAOs.exe
  2⤵
  PID:7388
- C:\Windows\System\OIdODsW.exe
  C:\Windows\System\OIdODsW.exe
  2⤵
  PID:7448
- C:\Windows\System\yQiNqNJ.exe
  C:\Windows\System\yQiNqNJ.exe
  2⤵
  PID:7540
- C:\Windows\System\phJXHBj.exe
  C:\Windows\System\phJXHBj.exe
  2⤵
  PID:7576
- C:\Windows\System\iQtQvaN.exe
  C:\Windows\System\iQtQvaN.exe
  2⤵
  PID:7676
- C:\Windows\System\hEaGYAI.exe
  C:\Windows\System\hEaGYAI.exe
  2⤵
  PID:7736
- C:\Windows\System\YKnUnHb.exe
  C:\Windows\System\YKnUnHb.exe
  2⤵
  PID:7820
- C:\Windows\System\GIwYIfk.exe
  C:\Windows\System\GIwYIfk.exe
  2⤵
  PID:7892
- C:\Windows\System\wtuizlw.exe
  C:\Windows\System\wtuizlw.exe
  2⤵
  PID:7956
- C:\Windows\System\TOnFAtz.exe
  C:\Windows\System\TOnFAtz.exe
  2⤵
  PID:8028
- C:\Windows\System\UEuAUTI.exe
  C:\Windows\System\UEuAUTI.exe
  2⤵
  PID:8096
- C:\Windows\System\qICCcTR.exe
  C:\Windows\System\qICCcTR.exe
  2⤵
  PID:8144
- C:\Windows\System\PFjXGBB.exe
  C:\Windows\System\PFjXGBB.exe
  2⤵
  PID:7208
- C:\Windows\System\zFZadvr.exe
  C:\Windows\System\zFZadvr.exe
  2⤵
  PID:7348
- C:\Windows\System\CGYICbb.exe
  C:\Windows\System\CGYICbb.exe
  2⤵
  PID:7432
- C:\Windows\System\gltpXhZ.exe
  C:\Windows\System\gltpXhZ.exe
  2⤵
  PID:7660
- C:\Windows\System\qXIVtAJ.exe
  C:\Windows\System\qXIVtAJ.exe
  2⤵
  PID:7876
- C:\Windows\System\PXMXbYs.exe
  C:\Windows\System\PXMXbYs.exe
  2⤵
  PID:7960
- C:\Windows\System\UjNghLH.exe
  C:\Windows\System\UjNghLH.exe
  2⤵
  PID:8076
- C:\Windows\System\PNRcXWl.exe
  C:\Windows\System\PNRcXWl.exe
  2⤵
  PID:7372
- C:\Windows\System\xOJZoFi.exe
  C:\Windows\System\xOJZoFi.exe
  2⤵
  PID:7492
- C:\Windows\System\MLgFmTy.exe
  C:\Windows\System\MLgFmTy.exe
  2⤵
  PID:8052
- C:\Windows\System\kgzSaAQ.exe
  C:\Windows\System\kgzSaAQ.exe
  2⤵
  PID:7552
- C:\Windows\System\YkjyDJz.exe
  C:\Windows\System\YkjyDJz.exe
  2⤵
  PID:8016
- C:\Windows\System\gcERMAR.exe
  C:\Windows\System\gcERMAR.exe
  2⤵
  PID:8232
- C:\Windows\System\DMSxwIF.exe
  C:\Windows\System\DMSxwIF.exe
  2⤵
  PID:8264
- C:\Windows\System\WZmkbfI.exe
  C:\Windows\System\WZmkbfI.exe
  2⤵
  PID:8292
- C:\Windows\System\VKAkVnp.exe
  C:\Windows\System\VKAkVnp.exe
  2⤵
  PID:8320
- C:\Windows\System\GWXtDil.exe
  C:\Windows\System\GWXtDil.exe
  2⤵
  PID:8336
- C:\Windows\System\wxXNvkZ.exe
  C:\Windows\System\wxXNvkZ.exe
  2⤵
  PID:8356
- C:\Windows\System\ABBIAft.exe
  C:\Windows\System\ABBIAft.exe
  2⤵
  PID:8396
- C:\Windows\System\llTRlPs.exe
  C:\Windows\System\llTRlPs.exe
  2⤵
  PID:8432
- C:\Windows\System\uBWfZry.exe
  C:\Windows\System\uBWfZry.exe
  2⤵
  PID:8460
- C:\Windows\System\oMkpJKV.exe
  C:\Windows\System\oMkpJKV.exe
  2⤵
  PID:8488
- C:\Windows\System\UXwnPCF.exe
  C:\Windows\System\UXwnPCF.exe
  2⤵
  PID:8512
- C:\Windows\System\BMeDaff.exe
  C:\Windows\System\BMeDaff.exe
  2⤵
  PID:8532
- C:\Windows\System\quYpUbu.exe
  C:\Windows\System\quYpUbu.exe
  2⤵
  PID:8568
- C:\Windows\System\roCulAB.exe
  C:\Windows\System\roCulAB.exe
  2⤵
  PID:8588
- C:\Windows\System\vdlisri.exe
  C:\Windows\System\vdlisri.exe
  2⤵
  PID:8612
- C:\Windows\System\zrFZGcF.exe
  C:\Windows\System\zrFZGcF.exe
  2⤵
  PID:8644
- C:\Windows\System\oYpduJK.exe
  C:\Windows\System\oYpduJK.exe
  2⤵
  PID:8672
- C:\Windows\System\SosKeCw.exe
  C:\Windows\System\SosKeCw.exe
  2⤵
  PID:8700
- C:\Windows\System\bSLxvLq.exe
  C:\Windows\System\bSLxvLq.exe
  2⤵
  PID:8740
- C:\Windows\System\DbcHtwI.exe
  C:\Windows\System\DbcHtwI.exe
  2⤵
  PID:8756
- C:\Windows\System\PuvkvCL.exe
  C:\Windows\System\PuvkvCL.exe
  2⤵
  PID:8792
- C:\Windows\System\fJjveqR.exe
  C:\Windows\System\fJjveqR.exe
  2⤵
  PID:8812
- C:\Windows\System\bmOCBJD.exe
  C:\Windows\System\bmOCBJD.exe
  2⤵
  PID:8840
- C:\Windows\System\sFXrBME.exe
  C:\Windows\System\sFXrBME.exe
  2⤵
  PID:8880
- C:\Windows\System\sxEFRCa.exe
  C:\Windows\System\sxEFRCa.exe
  2⤵
  PID:8900
- C:\Windows\System\LCuymvO.exe
  C:\Windows\System\LCuymvO.exe
  2⤵
  PID:8924
- C:\Windows\System\HIHeazx.exe
  C:\Windows\System\HIHeazx.exe
  2⤵
  PID:8964
- C:\Windows\System\bVBqhjK.exe
  C:\Windows\System\bVBqhjK.exe
  2⤵
  PID:8992
- C:\Windows\System\xfCxBWD.exe
  C:\Windows\System\xfCxBWD.exe
  2⤵
  PID:9008
- C:\Windows\System\mPIKjRw.exe
  C:\Windows\System\mPIKjRw.exe
  2⤵
  PID:9036
- C:\Windows\System\dawTXBQ.exe
  C:\Windows\System\dawTXBQ.exe
  2⤵
  PID:9064
- C:\Windows\System\BvtwSYL.exe
  C:\Windows\System\BvtwSYL.exe
  2⤵
  PID:9092
- C:\Windows\System\amaxCpI.exe
  C:\Windows\System\amaxCpI.exe
  2⤵
  PID:9120
- C:\Windows\System\CSxGayx.exe
  C:\Windows\System\CSxGayx.exe
  2⤵
  PID:9136
- C:\Windows\System\pNKKcOG.exe
  C:\Windows\System\pNKKcOG.exe
  2⤵
  PID:9172
- C:\Windows\System\fhzkTXK.exe
  C:\Windows\System\fhzkTXK.exe
  2⤵
  PID:9204
- C:\Windows\System\dgywqjz.exe
  C:\Windows\System\dgywqjz.exe
  2⤵
  PID:8228
- C:\Windows\System\ZONiPeY.exe
  C:\Windows\System\ZONiPeY.exe
  2⤵
  PID:8284
- C:\Windows\System\HPGoAyO.exe
  C:\Windows\System\HPGoAyO.exe
  2⤵
  PID:8348
- C:\Windows\System\dPWciNe.exe
  C:\Windows\System\dPWciNe.exe
  2⤵
  PID:8376
- C:\Windows\System\vsHPKYd.exe
  C:\Windows\System\vsHPKYd.exe
  2⤵
  PID:8480
- C:\Windows\System\znCFCzs.exe
  C:\Windows\System\znCFCzs.exe
  2⤵
  PID:8548
- C:\Windows\System\qOkWgIh.exe
  C:\Windows\System\qOkWgIh.exe
  2⤵
  PID:8604
- C:\Windows\System\pokPPWi.exe
  C:\Windows\System\pokPPWi.exe
  2⤵
  PID:8684
- C:\Windows\System\GDWeEEA.exe
  C:\Windows\System\GDWeEEA.exe
  2⤵
  PID:8752
- C:\Windows\System\nTjqyIp.exe
  C:\Windows\System\nTjqyIp.exe
  2⤵
  PID:8832
- C:\Windows\System\lnqwTLP.exe
  C:\Windows\System\lnqwTLP.exe
  2⤵
  PID:8888
- C:\Windows\System\LVreHDb.exe
  C:\Windows\System\LVreHDb.exe
  2⤵
  PID:8976
- C:\Windows\System\YFEeEnP.exe
  C:\Windows\System\YFEeEnP.exe
  2⤵
  PID:9000
- C:\Windows\System\PhBkknH.exe
  C:\Windows\System\PhBkknH.exe
  2⤵
  PID:9112
- C:\Windows\System\Rxywkrl.exe
  C:\Windows\System\Rxywkrl.exe
  2⤵
  PID:9160
- C:\Windows\System\BdOdGpq.exe
  C:\Windows\System\BdOdGpq.exe
  2⤵
  PID:8256
- C:\Windows\System\yVkQOaR.exe
  C:\Windows\System\yVkQOaR.exe
  2⤵
  PID:8384
- C:\Windows\System\JYftXFX.exe
  C:\Windows\System\JYftXFX.exe
  2⤵
  PID:8448
- C:\Windows\System\tHQivZF.exe
  C:\Windows\System\tHQivZF.exe
  2⤵
  PID:8724
- C:\Windows\System\uXODIJu.exe
  C:\Windows\System\uXODIJu.exe
  2⤵
  PID:8916
- C:\Windows\System\yAVfLRc.exe
  C:\Windows\System\yAVfLRc.exe
  2⤵
  PID:8940
- C:\Windows\System\RyxoOXL.exe
  C:\Windows\System\RyxoOXL.exe
  2⤵
  PID:9128
- C:\Windows\System\kuBCyGo.exe
  C:\Windows\System\kuBCyGo.exe
  2⤵
  PID:8332
- C:\Windows\System\gbQQvPn.exe
  C:\Windows\System\gbQQvPn.exe
  2⤵
  PID:8472
- C:\Windows\System\TwonOuu.exe
  C:\Windows\System\TwonOuu.exe
  2⤵
  PID:8804
- C:\Windows\System\VXGdeXm.exe
  C:\Windows\System\VXGdeXm.exe
  2⤵
  PID:8408
- C:\Windows\System\bqGTyZC.exe
  C:\Windows\System\bqGTyZC.exe
  2⤵
  PID:8204
- C:\Windows\System\qbqeYod.exe
  C:\Windows\System\qbqeYod.exe
  2⤵
  PID:9248
- C:\Windows\System\HgVXIiN.exe
  C:\Windows\System\HgVXIiN.exe
  2⤵
  PID:9272
- C:\Windows\System\ZVFuunN.exe
  C:\Windows\System\ZVFuunN.exe
  2⤵
  PID:9296
- C:\Windows\System\NMSPqUr.exe
  C:\Windows\System\NMSPqUr.exe
  2⤵
  PID:9336
- C:\Windows\System\dZbaLEH.exe
  C:\Windows\System\dZbaLEH.exe
  2⤵
  PID:9364
- C:\Windows\System\ErwhoBw.exe
  C:\Windows\System\ErwhoBw.exe
  2⤵
  PID:9392
- C:\Windows\System\mlbCPal.exe
  C:\Windows\System\mlbCPal.exe
  2⤵
  PID:9420
- C:\Windows\System\pLdMOPW.exe
  C:\Windows\System\pLdMOPW.exe
  2⤵
  PID:9440
- C:\Windows\System\lMvDSbI.exe
  C:\Windows\System\lMvDSbI.exe
  2⤵
  PID:9476
- C:\Windows\System\ZFEOQAM.exe
  C:\Windows\System\ZFEOQAM.exe
  2⤵
  PID:9504
- C:\Windows\System\upvtmLo.exe
  C:\Windows\System\upvtmLo.exe
  2⤵
  PID:9544
- C:\Windows\System\eBIZYBR.exe
  C:\Windows\System\eBIZYBR.exe
  2⤵
  PID:9560
- C:\Windows\System\DXwxRRR.exe
  C:\Windows\System\DXwxRRR.exe
  2⤵
  PID:9588
- C:\Windows\System\WznEzhg.exe
  C:\Windows\System\WznEzhg.exe
  2⤵
  PID:9616
- C:\Windows\System\hdLJAbL.exe
  C:\Windows\System\hdLJAbL.exe
  2⤵
  PID:9632
- C:\Windows\System\oNtOCKE.exe
  C:\Windows\System\oNtOCKE.exe
  2⤵
  PID:9660
- C:\Windows\System\KKXOZlc.exe
  C:\Windows\System\KKXOZlc.exe
  2⤵
  PID:9688
- C:\Windows\System\sUaviXc.exe
  C:\Windows\System\sUaviXc.exe
  2⤵
  PID:9716
- C:\Windows\System\pzSXyIZ.exe
  C:\Windows\System\pzSXyIZ.exe
  2⤵
  PID:9744
- C:\Windows\System\MkQpDds.exe
  C:\Windows\System\MkQpDds.exe
  2⤵
  PID:9780
- C:\Windows\System\uyAiwZe.exe
  C:\Windows\System\uyAiwZe.exe
  2⤵
  PID:9800
- C:\Windows\System\hOuYDFn.exe
  C:\Windows\System\hOuYDFn.exe
  2⤵
  PID:9816
- C:\Windows\System\WIYNeAc.exe
  C:\Windows\System\WIYNeAc.exe
  2⤵
  PID:9864
- C:\Windows\System\ssBbmJw.exe
  C:\Windows\System\ssBbmJw.exe
  2⤵
  PID:9892
- C:\Windows\System\XeRREbj.exe
  C:\Windows\System\XeRREbj.exe
  2⤵
  PID:9916
- C:\Windows\System\kXBXjpu.exe
  C:\Windows\System\kXBXjpu.exe
  2⤵
  PID:9940
- C:\Windows\System\eLwwClT.exe
  C:\Windows\System\eLwwClT.exe
  2⤵
  PID:9972
- C:\Windows\System\VaBWhHt.exe
  C:\Windows\System\VaBWhHt.exe
  2⤵
  PID:10004
- C:\Windows\System\KyuoEgz.exe
  C:\Windows\System\KyuoEgz.exe
  2⤵
  PID:10036
- C:\Windows\System\gDWnJPF.exe
  C:\Windows\System\gDWnJPF.exe
  2⤵
  PID:10064
- C:\Windows\System\bDSSHvt.exe
  C:\Windows\System\bDSSHvt.exe
  2⤵
  PID:10080
- C:\Windows\System\AmQtFpA.exe
  C:\Windows\System\AmQtFpA.exe
  2⤵
  PID:10108
- C:\Windows\System\OWbzhgh.exe
  C:\Windows\System\OWbzhgh.exe
  2⤵
  PID:10136
- C:\Windows\System\iChmgQe.exe
  C:\Windows\System\iChmgQe.exe
  2⤵
  PID:10160
- C:\Windows\System\vizeHCY.exe
  C:\Windows\System\vizeHCY.exe
  2⤵
  PID:10204
- C:\Windows\System\DRpRDWl.exe
  C:\Windows\System\DRpRDWl.exe
  2⤵
  PID:10232
- C:\Windows\System\jOVedaF.exe
  C:\Windows\System\jOVedaF.exe
  2⤵
  PID:9244
- C:\Windows\System\ltVjuba.exe
  C:\Windows\System\ltVjuba.exe
  2⤵
  PID:9288
- C:\Windows\System\clcRitj.exe
  C:\Windows\System\clcRitj.exe
  2⤵
  PID:9348
- C:\Windows\System\utOYJXW.exe
  C:\Windows\System\utOYJXW.exe
  2⤵
  PID:9428
- C:\Windows\System\WwvrMVj.exe
  C:\Windows\System\WwvrMVj.exe
  2⤵
  PID:964
- C:\Windows\System\OFtpubN.exe
  C:\Windows\System\OFtpubN.exe
  2⤵
  PID:9516
- C:\Windows\System\iCROAEx.exe
  C:\Windows\System\iCROAEx.exe
  2⤵
  PID:7732
- C:\Windows\System\ljhysOE.exe
  C:\Windows\System\ljhysOE.exe
  2⤵
  PID:9584
- C:\Windows\System\fxwjAlU.exe
  C:\Windows\System\fxwjAlU.exe
  2⤵
  PID:9676
- C:\Windows\System\SnKukJw.exe
  C:\Windows\System\SnKukJw.exe
  2⤵
  PID:9728
- C:\Windows\System\JeoJJMc.exe
  C:\Windows\System\JeoJJMc.exe
  2⤵
  PID:9764
- C:\Windows\System\gKfJLKb.exe
  C:\Windows\System\gKfJLKb.exe
  2⤵
  PID:9840
- C:\Windows\System\MsEVFmd.exe
  C:\Windows\System\MsEVFmd.exe
  2⤵
  PID:9912
- C:\Windows\System\yYYTrVw.exe
  C:\Windows\System\yYYTrVw.exe
  2⤵
  PID:9936
- C:\Windows\System\UFmosTw.exe
  C:\Windows\System\UFmosTw.exe
  2⤵
  PID:10024
- C:\Windows\System\upPcszA.exe
  C:\Windows\System\upPcszA.exe
  2⤵
  PID:10132
- C:\Windows\System\HWWUyYV.exe
  C:\Windows\System\HWWUyYV.exe
  2⤵
  PID:10192
- C:\Windows\System\LZmjNKB.exe
  C:\Windows\System\LZmjNKB.exe
  2⤵
  PID:9280
- C:\Windows\System\bGmherB.exe
  C:\Windows\System\bGmherB.exe
  2⤵
  PID:9412
- C:\Windows\System\BxKacRy.exe
  C:\Windows\System\BxKacRy.exe
  2⤵
  PID:9492
- C:\Windows\System\CPMesfo.exe
  C:\Windows\System\CPMesfo.exe
  2⤵
  PID:9552
- C:\Windows\System\VHWZVOp.exe
  C:\Windows\System\VHWZVOp.exe
  2⤵
  PID:9732
- C:\Windows\System\FFMiHpz.exe
  C:\Windows\System\FFMiHpz.exe
  2⤵
  PID:9876
- C:\Windows\System\yLJIEWv.exe
  C:\Windows\System\yLJIEWv.exe
  2⤵
  PID:10012
- C:\Windows\System\FrMfRgI.exe
  C:\Windows\System\FrMfRgI.exe
  2⤵
  PID:10200
- C:\Windows\System\LWNisWq.exe
  C:\Windows\System\LWNisWq.exe
  2⤵
  PID:9416
- C:\Windows\System\JBshmsR.exe
  C:\Windows\System\JBshmsR.exe
  2⤵
  PID:9756
- C:\Windows\System\nkrSRgw.exe
  C:\Windows\System\nkrSRgw.exe
  2⤵
  PID:10028
- C:\Windows\System\qqwwDxL.exe
  C:\Windows\System\qqwwDxL.exe
  2⤵
  PID:9600
- C:\Windows\System\hMullNP.exe
  C:\Windows\System\hMullNP.exe
  2⤵
  PID:8628
- C:\Windows\System\sWTpesc.exe
  C:\Windows\System\sWTpesc.exe
  2⤵
  PID:10248
- C:\Windows\System\SNZaNzz.exe
  C:\Windows\System\SNZaNzz.exe
  2⤵
  PID:10272
- C:\Windows\System\gTyMWho.exe
  C:\Windows\System\gTyMWho.exe
  2⤵
  PID:10296
- C:\Windows\System\zgnWoiH.exe
  C:\Windows\System\zgnWoiH.exe
  2⤵
  PID:10320
- C:\Windows\System\PPIrkyL.exe
  C:\Windows\System\PPIrkyL.exe
  2⤵
  PID:10344
- C:\Windows\System\DGMWjJv.exe
  C:\Windows\System\DGMWjJv.exe
  2⤵
  PID:10368
- C:\Windows\System\SjtvuKr.exe
  C:\Windows\System\SjtvuKr.exe
  2⤵
  PID:10408
- C:\Windows\System\wgeIcJM.exe
  C:\Windows\System\wgeIcJM.exe
  2⤵
  PID:10432
- C:\Windows\System\lKrDBIY.exe
  C:\Windows\System\lKrDBIY.exe
  2⤵
  PID:10472
- C:\Windows\System\atUPuMf.exe
  C:\Windows\System\atUPuMf.exe
  2⤵
  PID:10500
- C:\Windows\System\DEtapUO.exe
  C:\Windows\System\DEtapUO.exe
  2⤵
  PID:10528
- C:\Windows\System\LyDRZaK.exe
  C:\Windows\System\LyDRZaK.exe
  2⤵
  PID:10544
- C:\Windows\System\eVwEodn.exe
  C:\Windows\System\eVwEodn.exe
  2⤵
  PID:10580
- C:\Windows\System\kZQovIS.exe
  C:\Windows\System\kZQovIS.exe
  2⤵
  PID:10600
- C:\Windows\System\pkfQTef.exe
  C:\Windows\System\pkfQTef.exe
  2⤵
  PID:10640
- C:\Windows\System\smkVLxN.exe
  C:\Windows\System\smkVLxN.exe
  2⤵
  PID:10668
- C:\Windows\System\wLCWRaR.exe
  C:\Windows\System\wLCWRaR.exe
  2⤵
  PID:10684
- C:\Windows\System\AVoFUvc.exe
  C:\Windows\System\AVoFUvc.exe
  2⤵
  PID:10712
- C:\Windows\System\bkwdNja.exe
  C:\Windows\System\bkwdNja.exe
  2⤵
  PID:10752
- C:\Windows\System\sPfJRyz.exe
  C:\Windows\System\sPfJRyz.exe
  2⤵
  PID:10780
- C:\Windows\System\CJAODqd.exe
  C:\Windows\System\CJAODqd.exe
  2⤵
  PID:10808
- C:\Windows\System\rmmqKXK.exe
  C:\Windows\System\rmmqKXK.exe
  2⤵
  PID:10832
- C:\Windows\System\bEQVmhD.exe
  C:\Windows\System\bEQVmhD.exe
  2⤵
  PID:10852
- C:\Windows\System\ysCkaQA.exe
  C:\Windows\System\ysCkaQA.exe
  2⤵
  PID:10880
- C:\Windows\System\qYcrxyJ.exe
  C:\Windows\System\qYcrxyJ.exe
  2⤵
  PID:10908
- C:\Windows\System\JaDtyrf.exe
  C:\Windows\System\JaDtyrf.exe
  2⤵
  PID:10948
- C:\Windows\System\dlcCpSK.exe
  C:\Windows\System\dlcCpSK.exe
  2⤵
  PID:10976
- C:\Windows\System\gDUTYei.exe
  C:\Windows\System\gDUTYei.exe
  2⤵
  PID:11004
- C:\Windows\System\KboOMGR.exe
  C:\Windows\System\KboOMGR.exe
  2⤵
  PID:11036
- C:\Windows\System\czyBaYU.exe
  C:\Windows\System\czyBaYU.exe
  2⤵
  PID:11072
- C:\Windows\System\QWMnEer.exe
  C:\Windows\System\QWMnEer.exe
  2⤵
  PID:11100
- C:\Windows\System\mNhyDzT.exe
  C:\Windows\System\mNhyDzT.exe
  2⤵
  PID:11116
- C:\Windows\System\FgIrjxI.exe
  C:\Windows\System\FgIrjxI.exe
  2⤵
  PID:11132
- C:\Windows\System\QEtjQzD.exe
  C:\Windows\System\QEtjQzD.exe
  2⤵
  PID:11148
- C:\Windows\System\BNkMRmv.exe
  C:\Windows\System\BNkMRmv.exe
  2⤵
  PID:11200
- C:\Windows\System\CXrHOat.exe
  C:\Windows\System\CXrHOat.exe
  2⤵
  PID:11244
- C:\Windows\System\rfWAGdx.exe
  C:\Windows\System\rfWAGdx.exe
  2⤵
  PID:10280
- C:\Windows\System\TFrVyKT.exe
  C:\Windows\System\TFrVyKT.exe
  2⤵
  PID:10376
- C:\Windows\System\PNukqbc.exe
  C:\Windows\System\PNukqbc.exe
  2⤵
  PID:10424
- C:\Windows\System\HSUUCye.exe
  C:\Windows\System\HSUUCye.exe
  2⤵
  PID:10496
- C:\Windows\System\xSjUtrv.exe
  C:\Windows\System\xSjUtrv.exe
  2⤵
  PID:10588
- C:\Windows\System\HuLpJed.exe
  C:\Windows\System\HuLpJed.exe
  2⤵
  PID:10632
- C:\Windows\System\CacGfcb.exe
  C:\Windows\System\CacGfcb.exe
  2⤵
  PID:10676
- C:\Windows\System\AUrkUxQ.exe
  C:\Windows\System\AUrkUxQ.exe
  2⤵
  PID:10748
- C:\Windows\System\JjpTqlt.exe
  C:\Windows\System\JjpTqlt.exe
  2⤵
  PID:10792
- C:\Windows\System\Tsrsmrv.exe
  C:\Windows\System\Tsrsmrv.exe
  2⤵
  PID:10816
- C:\Windows\System\ajwSTIg.exe
  C:\Windows\System\ajwSTIg.exe
  2⤵
  PID:10872
- C:\Windows\System\jtbrzoP.exe
  C:\Windows\System\jtbrzoP.exe
  2⤵
  PID:10996
- C:\Windows\System\yuROGtY.exe
  C:\Windows\System\yuROGtY.exe
  2⤵
  PID:11056
- C:\Windows\System\KjQDOkV.exe
  C:\Windows\System\KjQDOkV.exe
  2⤵
  PID:11168
- C:\Windows\System\hZSGvQi.exe
  C:\Windows\System\hZSGvQi.exe
  2⤵
  PID:11192
- C:\Windows\System\MjKbUgd.exe
  C:\Windows\System\MjKbUgd.exe
  2⤵
  PID:10392
- C:\Windows\System\rHMjyKh.exe
  C:\Windows\System\rHMjyKh.exe
  2⤵
  PID:10484
- C:\Windows\System\ezSfDko.exe
  C:\Windows\System\ezSfDko.exe
  2⤵
  PID:10660
- C:\Windows\System\TzlGUoF.exe
  C:\Windows\System\TzlGUoF.exe
  2⤵
  PID:10776
- C:\Windows\System\YNkKFnc.exe
  C:\Windows\System\YNkKFnc.exe
  2⤵
  PID:10864
- C:\Windows\System\qdkCkFf.exe
  C:\Windows\System\qdkCkFf.exe
  2⤵
  PID:11112
- C:\Windows\System\YLVGPXB.exe
  C:\Windows\System\YLVGPXB.exe
  2⤵
  PID:10284
- C:\Windows\System\hWUPkmC.exe
  C:\Windows\System\hWUPkmC.exe
  2⤵
  PID:10596
- C:\Windows\System\UNwvpcO.exe
  C:\Windows\System\UNwvpcO.exe
  2⤵
  PID:11016
- C:\Windows\System\ISahwhu.exe
  C:\Windows\System\ISahwhu.exe
  2⤵
  PID:10264
- C:\Windows\System\AraOEtO.exe
  C:\Windows\System\AraOEtO.exe
  2⤵
  PID:11184
- C:\Windows\System\TuckJsF.exe
  C:\Windows\System\TuckJsF.exe
  2⤵
  PID:11272
- C:\Windows\System\WKoLDJH.exe
  C:\Windows\System\WKoLDJH.exe
  2⤵
  PID:11312
- C:\Windows\System\kYSVJFA.exe
  C:\Windows\System\kYSVJFA.exe
  2⤵
  PID:11328
- C:\Windows\System\vVxAaut.exe
  C:\Windows\System\vVxAaut.exe
  2⤵
  PID:11356
- C:\Windows\System\CUhGGbn.exe
  C:\Windows\System\CUhGGbn.exe
  2⤵
  PID:11372
- C:\Windows\System\qSwprKy.exe
  C:\Windows\System\qSwprKy.exe
  2⤵
  PID:11396
- C:\Windows\System\QVUkaWI.exe
  C:\Windows\System\QVUkaWI.exe
  2⤵
  PID:11432
- C:\Windows\System\GioGTCA.exe
  C:\Windows\System\GioGTCA.exe
  2⤵
  PID:11464
- C:\Windows\System\cXChJQz.exe
  C:\Windows\System\cXChJQz.exe
  2⤵
  PID:11500
- C:\Windows\System\pSFmhTG.exe
  C:\Windows\System\pSFmhTG.exe
  2⤵
  PID:11524
- C:\Windows\System\NgFqong.exe
  C:\Windows\System\NgFqong.exe
  2⤵
  PID:11552
- C:\Windows\System\Kfcltgr.exe
  C:\Windows\System\Kfcltgr.exe
  2⤵
  PID:11592
- C:\Windows\System\DTTfizh.exe
  C:\Windows\System\DTTfizh.exe
  2⤵
  PID:11608
- C:\Windows\System\ZFxTlZw.exe
  C:\Windows\System\ZFxTlZw.exe
  2⤵
  PID:11636
- C:\Windows\System\CzOjRNO.exe
  C:\Windows\System\CzOjRNO.exe
  2⤵
  PID:11668
- C:\Windows\System\YKdEHNE.exe
  C:\Windows\System\YKdEHNE.exe
  2⤵
  PID:11696
- C:\Windows\System\LMlUEJu.exe
  C:\Windows\System\LMlUEJu.exe
  2⤵
  PID:11720
- C:\Windows\System\XDlvlgr.exe
  C:\Windows\System\XDlvlgr.exe
  2⤵
  PID:11760
- C:\Windows\System\tgkbTSu.exe
  C:\Windows\System\tgkbTSu.exe
  2⤵
  PID:11776
- C:\Windows\System\fBNoGmK.exe
  C:\Windows\System\fBNoGmK.exe
  2⤵
  PID:11808
- C:\Windows\System\UYIzKJc.exe
  C:\Windows\System\UYIzKJc.exe
  2⤵
  PID:11832
- C:\Windows\System\EQXRfyn.exe
  C:\Windows\System\EQXRfyn.exe
  2⤵
  PID:11860
- C:\Windows\System\kxtaeCE.exe
  C:\Windows\System\kxtaeCE.exe
  2⤵
  PID:11888
- C:\Windows\System\uRNadrA.exe
  C:\Windows\System\uRNadrA.exe
  2⤵
  PID:11904
- C:\Windows\System\dKKWCtz.exe
  C:\Windows\System\dKKWCtz.exe
  2⤵
  PID:11956
- C:\Windows\System\lDAVLoI.exe
  C:\Windows\System\lDAVLoI.exe
  2⤵
  PID:11984
- C:\Windows\System\IiWHUSP.exe
  C:\Windows\System\IiWHUSP.exe
  2⤵
  PID:12004
- C:\Windows\System\sRtBrUo.exe
  C:\Windows\System\sRtBrUo.exe
  2⤵
  PID:12024
- C:\Windows\System\CAiDSUz.exe
  C:\Windows\System\CAiDSUz.exe
  2⤵
  PID:12056
- C:\Windows\System\uUgBHcE.exe
  C:\Windows\System\uUgBHcE.exe
  2⤵
  PID:12088
- C:\Windows\System\hdShyFH.exe
  C:\Windows\System\hdShyFH.exe
  2⤵
  PID:12116
- C:\Windows\System\iIyeipU.exe
  C:\Windows\System\iIyeipU.exe
  2⤵
  PID:12144
- C:\Windows\System\XbPpunh.exe
  C:\Windows\System\XbPpunh.exe
  2⤵
  PID:12184
- C:\Windows\System\EjMawwi.exe
  C:\Windows\System\EjMawwi.exe
  2⤵
  PID:12212
- C:\Windows\System\DuirOXj.exe
  C:\Windows\System\DuirOXj.exe
  2⤵
  PID:12228
- C:\Windows\System\gRRZVcW.exe
  C:\Windows\System\gRRZVcW.exe
  2⤵
  PID:12268
- C:\Windows\System\vjnxOqT.exe
  C:\Windows\System\vjnxOqT.exe
  2⤵
  PID:11268
- C:\Windows\System\gqTgUDF.exe
  C:\Windows\System\gqTgUDF.exe
  2⤵
  PID:11324
- C:\Windows\System\tMBfClA.exe
  C:\Windows\System\tMBfClA.exe
  2⤵
  PID:11388
- C:\Windows\System\VRTrGMg.exe
  C:\Windows\System\VRTrGMg.exe
  2⤵
  PID:11420
- C:\Windows\System\WMcHmYm.exe
  C:\Windows\System\WMcHmYm.exe
  2⤵
  PID:11544
- C:\Windows\System\slCloWl.exe
  C:\Windows\System\slCloWl.exe
  2⤵
  PID:11580
- C:\Windows\System\mGSIFpZ.exe
  C:\Windows\System\mGSIFpZ.exe
  2⤵
  PID:11676
- C:\Windows\System\QYVZqyQ.exe
  C:\Windows\System\QYVZqyQ.exe
  2⤵
  PID:11712
- C:\Windows\System\vUcpXHZ.exe
  C:\Windows\System\vUcpXHZ.exe
  2⤵
  PID:11804
- C:\Windows\System\SVGjekE.exe
  C:\Windows\System\SVGjekE.exe
  2⤵
  PID:11028
- C:\Windows\System\VDWuoXV.exe
  C:\Windows\System\VDWuoXV.exe
  2⤵
  PID:11924
- C:\Windows\System\AfBwsyD.exe
  C:\Windows\System\AfBwsyD.exe
  2⤵
  PID:11992
- C:\Windows\System\iLdpDNj.exe
  C:\Windows\System\iLdpDNj.exe
  2⤵
  PID:12068
- C:\Windows\System\YhaqbXJ.exe
  C:\Windows\System\YhaqbXJ.exe
  2⤵
  PID:12084
- C:\Windows\System\RbCCcfV.exe
  C:\Windows\System\RbCCcfV.exe
  2⤵
  PID:12200
- C:\Windows\System\EsZGAaI.exe
  C:\Windows\System\EsZGAaI.exe
  2⤵
  PID:12252
- C:\Windows\System\BaKglFx.exe
  C:\Windows\System\BaKglFx.exe
  2⤵
  PID:11352
- C:\Windows\System\HMxVZVB.exe
  C:\Windows\System\HMxVZVB.exe
  2⤵
  PID:11540
- C:\Windows\System\XizuzZv.exe
  C:\Windows\System\XizuzZv.exe
  2⤵
  PID:11628
- C:\Windows\System\cKUOaia.exe
  C:\Windows\System\cKUOaia.exe
  2⤵
  PID:11788
- C:\Windows\System\hTQQKgH.exe
  C:\Windows\System\hTQQKgH.exe
  2⤵
  PID:11872
- C:\Windows\System\JyhjOdF.exe
  C:\Windows\System\JyhjOdF.exe
  2⤵
  PID:12052
- C:\Windows\System\spffwIn.exe
  C:\Windows\System\spffwIn.exe
  2⤵
  PID:12260
- C:\Windows\System\FpJfnYQ.exe
  C:\Windows\System\FpJfnYQ.exe
  2⤵
  PID:11384
- C:\Windows\System\kDzNMJe.exe
  C:\Windows\System\kDzNMJe.exe
  2⤵
  PID:12044
- C:\Windows\System\yhdtBtC.exe
  C:\Windows\System\yhdtBtC.exe
  2⤵
  PID:2252
- C:\Windows\System\yBxAfnF.exe
  C:\Windows\System\yBxAfnF.exe
  2⤵
  PID:12128
- C:\Windows\System\WSvcOax.exe
  C:\Windows\System\WSvcOax.exe
  2⤵
  PID:11968
- C:\Windows\System\JjddCGe.exe
  C:\Windows\System\JjddCGe.exe
  2⤵
  PID:12316
- C:\Windows\System\anhpWKB.exe
  C:\Windows\System\anhpWKB.exe
  2⤵
  PID:12344
- C:\Windows\System\GWEPAUb.exe
  C:\Windows\System\GWEPAUb.exe
  2⤵
  PID:12372
- C:\Windows\System\GUpespu.exe
  C:\Windows\System\GUpespu.exe
  2⤵
  PID:12400
- C:\Windows\System\LPYjgiE.exe
  C:\Windows\System\LPYjgiE.exe
  2⤵
  PID:12428
- C:\Windows\System\nVbNFVh.exe
  C:\Windows\System\nVbNFVh.exe
  2⤵
  PID:12444
- C:\Windows\System\vpBkCbC.exe
  C:\Windows\System\vpBkCbC.exe
  2⤵
  PID:12488
- C:\Windows\System\nyrLOVx.exe
  C:\Windows\System\nyrLOVx.exe
  2⤵
  PID:12516
- C:\Windows\System\kcMlrQf.exe
  C:\Windows\System\kcMlrQf.exe
  2⤵
  PID:12544
- C:\Windows\System\JGToPxn.exe
  C:\Windows\System\JGToPxn.exe
  2⤵
  PID:12560
- C:\Windows\System\DPGDhoo.exe
  C:\Windows\System\DPGDhoo.exe
  2⤵
  PID:12592
- C:\Windows\System\tUsWFEt.exe
  C:\Windows\System\tUsWFEt.exe
  2⤵
  PID:12612
- C:\Windows\System\uFhkwre.exe
  C:\Windows\System\uFhkwre.exe
  2⤵
  PID:12660
- C:\Windows\System\sBOvxyS.exe
  C:\Windows\System\sBOvxyS.exe
  2⤵
  PID:12676
- C:\Windows\System\JMzZnJC.exe
  C:\Windows\System\JMzZnJC.exe
  2⤵
  PID:12716
- C:\Windows\System\NojhfQr.exe
  C:\Windows\System\NojhfQr.exe
  2⤵
  PID:12744
- C:\Windows\System\FciBMjx.exe
  C:\Windows\System\FciBMjx.exe
  2⤵
  PID:12760
- C:\Windows\System\pWqsdgk.exe
  C:\Windows\System\pWqsdgk.exe
  2⤵
  PID:12788
- C:\Windows\System\iGAaxQO.exe
  C:\Windows\System\iGAaxQO.exe
  2⤵
  PID:12816
- C:\Windows\System\iXCjdSW.exe
  C:\Windows\System\iXCjdSW.exe
  2⤵
  PID:12844
- C:\Windows\System\gDAtVbR.exe
  C:\Windows\System\gDAtVbR.exe
  2⤵
  PID:12884
- C:\Windows\System\hCQJkUk.exe
  C:\Windows\System\hCQJkUk.exe
  2⤵
  PID:12912
- C:\Windows\System\hLWrthF.exe
  C:\Windows\System\hLWrthF.exe
  2⤵
  PID:12944
- C:\Windows\System\jIqEzOe.exe
  C:\Windows\System\jIqEzOe.exe
  2⤵
  PID:12972
- C:\Windows\System\XBOxmYG.exe
  C:\Windows\System\XBOxmYG.exe
  2⤵
  PID:13000
- C:\Windows\System\KNxmMEq.exe
  C:\Windows\System\KNxmMEq.exe
  2⤵
  PID:13016
- C:\Windows\System\yNauxkJ.exe
  C:\Windows\System\yNauxkJ.exe
  2⤵
  PID:13056
- C:\Windows\System\vXPcmOe.exe
  C:\Windows\System\vXPcmOe.exe
  2⤵
  PID:13084
- C:\Windows\System\HYsLovj.exe
  C:\Windows\System\HYsLovj.exe
  2⤵
  PID:13112
- C:\Windows\System\gWWgBkX.exe
  C:\Windows\System\gWWgBkX.exe
  2⤵
  PID:13128
- C:\Windows\System\XatAGFH.exe
  C:\Windows\System\XatAGFH.exe
  2⤵
  PID:13168
- C:\Windows\System\wNwQWho.exe
  C:\Windows\System\wNwQWho.exe
  2⤵
  PID:13196
- C:\Windows\System\oMwhzWr.exe
  C:\Windows\System\oMwhzWr.exe
  2⤵
  PID:13224
- C:\Windows\System\mzLlpsL.exe
  C:\Windows\System\mzLlpsL.exe
  2⤵
  PID:13252
- C:\Windows\System\rAPPMnb.exe
  C:\Windows\System\rAPPMnb.exe
  2⤵
  PID:13280
- C:\Windows\System\zZVXbWo.exe
  C:\Windows\System\zZVXbWo.exe
  2⤵
  PID:13300
- C:\Windows\System\XfLGcfV.exe
  C:\Windows\System\XfLGcfV.exe
  2⤵
  PID:12304
- C:\Windows\System\kldQOXM.exe
  C:\Windows\System\kldQOXM.exe
  2⤵
  PID:12340
- C:\Windows\System\ePohAiq.exe
  C:\Windows\System\ePohAiq.exe
  2⤵
  PID:12412
- C:\Windows\System\kBxjVpF.exe
  C:\Windows\System\kBxjVpF.exe
  2⤵
  PID:12484
- C:\Windows\System\KvLLeYA.exe
  C:\Windows\System\KvLLeYA.exe
  2⤵
  PID:12572
- C:\Windows\System\AuFzLLL.exe
  C:\Windows\System\AuFzLLL.exe
  2⤵
  PID:12644
- C:\Windows\System\kXIigyb.exe
  C:\Windows\System\kXIigyb.exe
  2⤵
  PID:12700
- C:\Windows\System\QIAYFTJ.exe
  C:\Windows\System\QIAYFTJ.exe
  2⤵
  PID:12752
- C:\Windows\System\faMYXDd.exe
  C:\Windows\System\faMYXDd.exe
  2⤵
  PID:12836
- C:\Windows\System\CngLDBM.exe
  C:\Windows\System\CngLDBM.exe
  2⤵
  PID:12940
- C:\Windows\System\bhUYWpO.exe
  C:\Windows\System\bhUYWpO.exe
  2⤵
  PID:12988
- C:\Windows\System\qzwyhFn.exe
  C:\Windows\System\qzwyhFn.exe
  2⤵
  PID:13040
- C:\Windows\System\fzIhHMO.exe
  C:\Windows\System\fzIhHMO.exe
  2⤵
  PID:13096
- C:\Windows\System\DQpyFPk.exe
  C:\Windows\System\DQpyFPk.exe
  2⤵
  PID:13152
- C:\Windows\System\JtRfxHO.exe
  C:\Windows\System\JtRfxHO.exe
  2⤵
  PID:13184
- C:\Windows\System\STmpEgN.exe
  C:\Windows\System\STmpEgN.exe
  2⤵
  PID:13244
- C:\Windows\System\sqOKIWP.exe
  C:\Windows\System\sqOKIWP.exe
  2⤵
  PID:12368
- C:\Windows\System\zOZpWBW.exe
  C:\Windows\System\zOZpWBW.exe
  2⤵
  PID:12440
- C:\Windows\System\KEuwhen.exe
  C:\Windows\System\KEuwhen.exe
  2⤵
  PID:12600
- C:\Windows\System\XusPXrw.exe
  C:\Windows\System\XusPXrw.exe
  2⤵
  PID:12808
- C:\Windows\System\wUtQDqp.exe
  C:\Windows\System\wUtQDqp.exe
  2⤵
  PID:12924
- C:\Windows\System\epnzdUY.exe
  C:\Windows\System\epnzdUY.exe
  2⤵
  PID:13072
- C:\Windows\System\POxTLKf.exe
  C:\Windows\System\POxTLKf.exe
  2⤵
  PID:13160
- C:\Windows\System\JapgUim.exe
  C:\Windows\System\JapgUim.exe
  2⤵
  PID:12332
- C:\Windows\System\qjPUtwd.exe
  C:\Windows\System\qjPUtwd.exe
  2⤵
  PID:12668
- C:\Windows\System\dxACdJq.exe
  C:\Windows\System\dxACdJq.exe
  2⤵
  PID:12736
- C:\Windows\System\ELrbzJy.exe
  C:\Windows\System\ELrbzJy.exe
  2⤵
  PID:13272
- C:\Windows\System\FqCzzpP.exe
  C:\Windows\System\FqCzzpP.exe
  2⤵
  PID:12608
- C:\Windows\System\URtDvnZ.exe
  C:\Windows\System\URtDvnZ.exe
  2⤵
  PID:12588
- C:\Windows\System\JCOOafR.exe
  C:\Windows\System\JCOOafR.exe
  2⤵
  PID:1800
- C:\Windows\System\sVPzZNH.exe
  C:\Windows\System\sVPzZNH.exe
  2⤵
  PID:13316
- C:\Windows\System\FVlfjyB.exe
  C:\Windows\System\FVlfjyB.exe
  2⤵
  PID:13332
- C:\Windows\System\TILzmJv.exe
  C:\Windows\System\TILzmJv.exe
  2⤵
  PID:13352
- C:\Windows\System\pxMHDap.exe
  C:\Windows\System\pxMHDap.exe
  2⤵
  PID:13388
- C:\Windows\System\SDGUqcX.exe
  C:\Windows\System\SDGUqcX.exe
  2⤵
  PID:13428
- C:\Windows\System\AboqhwS.exe
  C:\Windows\System\AboqhwS.exe
  2⤵
  PID:13468
- C:\Windows\System\Qtcegfa.exe
  C:\Windows\System\Qtcegfa.exe
  2⤵
  PID:13500
- C:\Windows\System\lBeazsa.exe
  C:\Windows\System\lBeazsa.exe
  2⤵
  PID:13528
- C:\Windows\System\hyQCKgw.exe
  C:\Windows\System\hyQCKgw.exe
  2⤵
  PID:13556
- C:\Windows\System\HMIijOV.exe
  C:\Windows\System\HMIijOV.exe
  2⤵
  PID:13584
- C:\Windows\System\fKvRYsF.exe
  C:\Windows\System\fKvRYsF.exe
  2⤵
  PID:13612
- C:\Windows\System\hpVksrw.exe
  C:\Windows\System\hpVksrw.exe
  2⤵
  PID:13640
- C:\Windows\System\TgdqKRN.exe
  C:\Windows\System\TgdqKRN.exe
  2⤵
  PID:13656
- C:\Windows\System\jyQEldh.exe
  C:\Windows\System\jyQEldh.exe
  2⤵
  PID:13696
- C:\Windows\System\YRIAoAA.exe
  C:\Windows\System\YRIAoAA.exe
  2⤵
  PID:13712
- C:\Windows\System\OsEeBYK.exe
  C:\Windows\System\OsEeBYK.exe
  2⤵
  PID:13740
- C:\Windows\System\VgealSf.exe
  C:\Windows\System\VgealSf.exe
  2⤵
  PID:13768
- C:\Windows\System\bgjVtSQ.exe
  C:\Windows\System\bgjVtSQ.exe
  2⤵
  PID:13792
- C:\Windows\System\LgFTInL.exe
  C:\Windows\System\LgFTInL.exe
  2⤵
  PID:13824
- C:\Windows\System\LhgAZBQ.exe
  C:\Windows\System\LhgAZBQ.exe
  2⤵
  PID:13864
- C:\Windows\System\dRuLaKA.exe
  C:\Windows\System\dRuLaKA.exe
  2⤵
  PID:13880
- C:\Windows\System\dcuHUgt.exe
  C:\Windows\System\dcuHUgt.exe
  2⤵
  PID:13912
- C:\Windows\System\ftoRhma.exe
  C:\Windows\System\ftoRhma.exe
  2⤵
  PID:13936
- C:\Windows\System\GyPibJq.exe
  C:\Windows\System\GyPibJq.exe
  2⤵
  PID:13964
- C:\Windows\System\CBQqGhP.exe
  C:\Windows\System\CBQqGhP.exe
  2⤵
  PID:13992
- C:\Windows\System\RjmKiQP.exe
  C:\Windows\System\RjmKiQP.exe
  2⤵
  PID:14032
- C:\Windows\System\uIOkofQ.exe
  C:\Windows\System\uIOkofQ.exe
  2⤵
  PID:14060
- C:\Windows\System\QdCZJMt.exe
  C:\Windows\System\QdCZJMt.exe
  2⤵
  PID:14076
- C:\Windows\System\kZvTauB.exe
  C:\Windows\System\kZvTauB.exe
  2⤵
  PID:14100
- C:\Windows\System\gwldMfd.exe
  C:\Windows\System\gwldMfd.exe
  2⤵
  PID:14124
- C:\Windows\System\RCDzDlJ.exe
  C:\Windows\System\RCDzDlJ.exe
  2⤵
  PID:14176
- C:\Windows\System\fVTMEau.exe
  C:\Windows\System\fVTMEau.exe
  2⤵
  PID:14204
- C:\Windows\System\EgVGtOv.exe
  C:\Windows\System\EgVGtOv.exe
  2⤵
  PID:14232
- C:\Windows\System\pvponxQ.exe
  C:\Windows\System\pvponxQ.exe
  2⤵
  PID:14260
- C:\Windows\System\byWnbYN.exe
  C:\Windows\System\byWnbYN.exe
  2⤵
  PID:14288
- C:\Windows\System\AlmETCs.exe
  C:\Windows\System\AlmETCs.exe
  2⤵
  PID:14304
- C:\Windows\System\jBvjvUh.exe
  C:\Windows\System\jBvjvUh.exe
  2⤵
  PID:14332
- C:\Windows\System\cOttLtH.exe
  C:\Windows\System\cOttLtH.exe
  2⤵
  PID:13360
- C:\Windows\System\XDAhZay.exe
  C:\Windows\System\XDAhZay.exe
  2⤵
  PID:13384
- C:\Windows\System\XaEYHcv.exe
  C:\Windows\System\XaEYHcv.exe
  2⤵
  PID:13484
- C:\Windows\System\TtvSvGJ.exe
  C:\Windows\System\TtvSvGJ.exe
  2⤵
  PID:13540
- C:\Windows\System\YbeGtEJ.exe
  C:\Windows\System\YbeGtEJ.exe
  2⤵
  PID:13628
- C:\Windows\System\DiEWxML.exe
  C:\Windows\System\DiEWxML.exe
  2⤵
  PID:13680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ADyPhfK.exe

Filesize
2.2MB

MD5
b4e698990a9cf994573b480698b14eb0

SHA1
fd72fbcc06700b8445678c7ee39d6e812842366d

SHA256
47456feea12a1a84067a117764373c0cc7976a7e3f38821e4a4ba5793e52bb03

SHA512
9d67259e83c1896f1603971720c95fdad581b6a53f7730cdddfc8090b738a9e566a2c1e7578a5f96c1181cfead15fc787bc50e26ea2bbc4c262d195da84eb189

Download Submit
C:\Windows\System\BEVZrRF.exe

Filesize
2.2MB

MD5
a98b080e757776599d6e8c63ecb20cee

SHA1
2676c5aaac06f69a690e9fbb55c3e811e829a600

SHA256
7259777e302263f71faee9e82aaba9dd4d8d9eed115459c51c4c47374217d583

SHA512
5bab48a1a579e12947aca4a0d531a26d4f10c63008224384c9a5915500f8bf3c436c31d0baae09a9c95913ae58e07aa351174c9f541727839d908658712bc9d4

Download Submit
C:\Windows\System\BKlwZgd.exe

Filesize
2.2MB

MD5
b5b76449cf994be11d711ca9d24c6b1b

SHA1
c022fff14d9f4d3db127c2316220a795e92c2f68

SHA256
15988e2ec49f088f08faf50fb1748d0bea59e8785b0f5b757dc8d7c6211ae42d

SHA512
0b1524053afbf14e198bf5fd88c771e4fe14ebef0ddfa98fc4ce4235d6f27702c72f163346fc98fecd1535956d0da6856e7a9163d965e4be08c50e6881811c05

Download Submit
C:\Windows\System\BkIjByX.exe

Filesize
2.2MB

MD5
930a38d6895a9c12a3c4f89ff4772226

SHA1
35ef22993ac6ebd6d6792b9aa85c55eff7c1ce20

SHA256
24cde870e84b920330b66dad4145368ee57c174ea4be188348c4f8a093785f6a

SHA512
2f6857fa1e630f171b792be41f2f195ed72fe80bda4fb24de4b72017f4d026a6c6eab2b660daeea66685db2c54ea8b3ab5f686dc4dd1de635a7a1cd130e1f0eb

Download Submit
C:\Windows\System\BnwfhYC.exe

Filesize
2.2MB

MD5
43eacf94cf036fbc340306bd4257da51

SHA1
b258186493443c97163b24a03335c58355167c10

SHA256
8d80475bd009c98646522a183760da3520300661a0893c778798aa96d9b5bf9e

SHA512
c2d5f549be7dd91f4e4b288f4099beb7ffe9d4cd5216ca4400b2bc94c59c0ccdd396c911e9f0974f16eceddd3552aafd0d18b6d9f393fd05ba45fe986c104ada

Download Submit
C:\Windows\System\CauhjeE.exe

Filesize
2.2MB

MD5
e40b50f57d01ccf20bd9dde0e7323e91

SHA1
7b44c0c3adf8e61da20ec595f30d9a01a894f058

SHA256
1f1a0e07beb3344a6bed399e82df26a21e7197bdf198ebc376afc8c8fd78f9f0

SHA512
026df19082d6c6b97054aaa5480babb54d6f453c9532653b4f1818417e277a3553df155d0a2a8e13f1e3ceaede4260c00eee7e9c26c5b4c83b6a38560a910c43

Download Submit
C:\Windows\System\DizJWrt.exe

Filesize
2.2MB

MD5
ab2e826355e6ec9e7bddff3c771efa35

SHA1
ea74841fb32ab226918e31cb819a063cbc3eb096

SHA256
2daf7cb770742f25012c923748f682227e76156fb229c7fc6bd66a0b24091591

SHA512
49832cc0284bc1ddb7b5ea4189d3403b509cdf51112252e53e7708eb51c760510f309023a0bd29d71ca7ac23c61870a419b3ee7b836794b3158ffa4f4b97ecfd

Download Submit
C:\Windows\System\GzPAKjo.exe

Filesize
2.2MB

MD5
ab9232c0508ce35baaf40e80466b1640

SHA1
8d1a5255cb3b3e291ce490dbf457d4d6c22b1848

SHA256
6bd0209595a06c0cbce2482799689637e11eb472a74c92d37a8b28eede642d12

SHA512
211c32b013e31b864926d96986ea9f08aadbe7082845672fe59c1e954502dab32cfa319db5456734ce957cef32d2a9976190b0916b2bc62195e17ad1bcd58137

Download Submit
C:\Windows\System\HuPPdWQ.exe

Filesize
2.2MB

MD5
d89bfb7265e8a1c90397a4d88bdba955

SHA1
c403ebb198e4d063890fd1a8f494c8b7dcb42529

SHA256
cda174582867df37f3d19dd271c8aa3b38e0192526729b2f121922eed3997776

SHA512
cd621057e155d75d6c2a8f348d0abee053f49d591b8c53b8bc333e17c6a0851359b6a907d9a62aa22be64e55eda7e5125f043550c86f33a2eb7fa7f9c21b76d7

Download Submit
C:\Windows\System\ICRXaGw.exe

Filesize
2.2MB

MD5
9000d7ad10511b0f18a79bf01c861395

SHA1
5db222b7b67c1a7ba348b1c5a02a13ffe89da35e

SHA256
51deb50fda4dcec51adc83f1510c8e8578763a342edb0974cdfd162a324cbaef

SHA512
795a6567a9a30840fbea4aab2619aa2272b752fa066c1da914466865045ae38cc5ce603f5f79b6c11a77a034546bed41b9b16ae6d087a3d695ed6064ecb03c71

Download Submit
C:\Windows\System\IEmILdr.exe

Filesize
2.2MB

MD5
7eab33821caf25287b173e8cfba5e7c6

SHA1
d0fc8069f6bbb6c41eecf0aff8b99be949f4e2e5

SHA256
5280a67e96292169654848bb177e889d76a5dacfadc854b6d091f723347a0f48

SHA512
5bcbc678c85bc743ad6f5614720c0203b57de0bf423731167b5f0560f73ff4bf6748fb7197c61df1a64a2316d2686a581cb7c7fc5c98490ec5956acc42e64bb8

Download Submit
C:\Windows\System\IkQBSqd.exe

Filesize
2.2MB

MD5
b55a01f123af4a9a89dfb212037cce2d

SHA1
961995bbf3be8232590163687ca353013758a807

SHA256
eaf3892366dd46f3db56c1ce24ab187a37687efa65aaab2476bd48574a991cf8

SHA512
333c82e0649912ffa051bb070376a789451a6c1bf41c7452532e7b1654ac2bd970a2d76ca4d9ec6066970e37f734d1766a1b43eec36f3f5d325c310d75d9ebd6

Download Submit
C:\Windows\System\KENmtmF.exe

Filesize
2.2MB

MD5
9e74c413787102b7a36eecc5902f0417

SHA1
f8b38da86f43106cfb2204d71c448cc5e0671c47

SHA256
1315630aa58515dfa3d15422ce07c376bfda53f0bf3dc8f74933a35d5e932a1a

SHA512
32cd1df869bcaa3f8e5c4034493bdda859662d5c415132b9733a298f29361e64000649aba82005657d0ba3c4ca007c01d966178eff3bb4bceec2ab050554e07f

Download Submit
C:\Windows\System\KFyahDh.exe

Filesize
2.2MB

MD5
4fc51726e7b09f79dabe4b47e9429c51

SHA1
da0e87af078db6beed5b3b6deda49d6793d926be

SHA256
eb1981f4b0205c6d8402e5892b4f2b459a52178e0951b272052618a5ecbd5230

SHA512
425d6328f9e37dbaca0aa1e8687d676dba7b60752ba94cf72e79015a6a3bbf927a8c9a4d8541f397addc169fa395200b304d83d4865c583144d596715e601674

Download Submit
C:\Windows\System\KXVEfxw.exe

Filesize
2.2MB

MD5
07b296b94d30cdb014e963bcac668dcf

SHA1
bcb082f07e8f6881b63b631d0ef76210e3bb3b4e

SHA256
f315ac9227e5b85bcf5d57d67a16a9d6f8d7cb8dbc32eb60ec9561750666d37e

SHA512
8b538a5054285b366669d87707e25532914d113ac17c85b895362884925c7c3c273690a766666966f63f55979c48766c579918995fa3884d4fa18c7d31ebc930

Download Submit
C:\Windows\System\MNehEFR.exe

Filesize
2.2MB

MD5
7ce15f225df96e69c3c1a43d6af33ce9

SHA1
8259d65fd640f4e27bac3623959f814ad80624a0

SHA256
653aac476fe2016e5ae31351bf21d37211c0e48f3652a469156983eeb70e3a24

SHA512
71bda428556f8e2ab5aea7f4375c3ea707fb3b037b62a5a0ccb6696397d0890f5cce7bc9fb4150a786ab0bbfd90ec1c1806f9250c9b178077bf90d384cf7e70b

Download Submit
C:\Windows\System\QGOzhHQ.exe

Filesize
2.2MB

MD5
826cc5a2648eb288d7411e04a927f36c

SHA1
e882cecd856126c302a982a2787d1186c16c4841

SHA256
e1ddb31b9ac0c3cf3f42c632633b5292151f1b50b4867954365b121c9dd278ca

SHA512
d82213f055d4568f0fa328289d8e2726be0f68713240024be781da09fe948496ac4bd96ac06a77e7fc6611fc5d5e3a1b743cdfcde1623a83367ece1a0ee57975

Download Submit
C:\Windows\System\QLnZUPr.exe

Filesize
2.2MB

MD5
2bc0c9faa099854bbbc8c260c32a97bd

SHA1
a2b648458ac6c89e02686e4a13a81ce336a43329

SHA256
f8f04edf89327b31298912973d62def76a9d5a89d89ca50eb9caafe3dde74867

SHA512
360015eaccf462ea1a4031afd02e38d8bccf6c98470db0e73147dc3856205cf59f1a33e6accca551db7672d127d8a2e137946215f8eb0860532c5d1f8327c305

Download Submit
C:\Windows\System\QaIWliY.exe

Filesize
2.2MB

MD5
59d0a8dc975a6c0f0b103dc4938a3fad

SHA1
60a41a2add1d784c7d2b26d3eeedf798a6055b78

SHA256
3057f43ecd67077cbd866613bb876bc9712a900349a207528c41e1bb02e899c3

SHA512
e1f780eab0c343d068e30857ec0a4874ea4d14a263b0488527c9265f72ee561091f9e9e78efe1f8690c70472ef50578a203feb3b9a2d288765902b0e2cc129c6

Download Submit
C:\Windows\System\TviEtBB.exe

Filesize
2.2MB

MD5
a87d14dc6c3998b2947543cf0239997c

SHA1
83d9ab03aa119245aac65373a786544ba9b1bf5e

SHA256
ad85f1adcffbdf7c9bc56efb747ef57f4a5c672441d44cf8084db63c8bb4c02a

SHA512
38088d57f121a31a38fa91e96757a68937aa4f20d28080a4a10cd05616e25fe49da283bb8db5d4814e1bfbaaed883685b552c34761bb6db0f28de009dc1ad9d4

Download Submit
C:\Windows\System\VsfLQAA.exe

Filesize
2.2MB

MD5
be0ebc0e2f3ce5e2c995036a6ab089e2

SHA1
d84e342093929ad3e1830a38b649286b073b5303

SHA256
5e0041b16dbc52f3ccf991d72808cfecc3b95c188a81efb3d2ab359a7074a46a

SHA512
2e4a29b7011c9647f06032ad1c1f328cf888c5c2c884be9f58336854a7a9e7287a8be661700545bb2d83048b2944487b7e8b1897c678d10b942405dba308c1d1

Download Submit
C:\Windows\System\YaYcPuL.exe

Filesize
2.2MB

MD5
9b4109207f98926f0dcbea106c0bb6be

SHA1
56bfd05289f9f00976cc21474e86f5d83b38051b

SHA256
dd4482aab6b6d755e9297373265033c1caedc43ac986922321a7ae45b1b1f8f9

SHA512
5d5a0341995079e13c784cc372b4ba47866358352c48bb8f3297ab710dfecea4ccf48d682846d19f40ad80b6152704cb4e56210083a6c4126b15c6a3377382ef

Download Submit
C:\Windows\System\aBhuMMq.exe

Filesize
2.2MB

MD5
c8e9c908a980fa6ffc7f11994466c225

SHA1
d94b541a20247c8035bee79bd1d0890e6e090e6c

SHA256
3b8039c63c02a28669d360b558479322397279b17ae8423ad6ab41ffbb09de66

SHA512
06523b088f578fb95b36b3f4dc2c211e0219e97312984ac131d4ebf5b9b06e77b15b55dc886433b897721e3332bdbb5509e7e12eeb01cdc6bb3dd9d65f7c1a0b

Download Submit
C:\Windows\System\aqLwrDv.exe

Filesize
2.2MB

MD5
5e93b0e36f52dbed4960dbe4f716320a

SHA1
9d9b13ff056fb59221005348db752df1ab4e041c

SHA256
112602e87bff43cff6783770f3e3bb026d7b3294873bdc6cb4e8c279a1a3f84a

SHA512
26bd92f134c6121901243528c6c4e06fe6c2b8ee4adf56bef0fc43439ab5cdcbf5929c45e230044b79d7ce1da7fc2e706ff91da4edb031d68b20b36747ee383c

Download Submit
C:\Windows\System\cvKjiuX.exe

Filesize
2.2MB

MD5
c9897e38cb81519447d57f13669dc69c

SHA1
ec68ee338830ad1e61c11cf313dd22ef5c41d590

SHA256
366520e02e6cb7ccde333ffbed3eddaebc4dd37fd2c0286214cc075c71e283a3

SHA512
e35f25baf3af4337fe84b4c8e76f6ae3d9ace265f1b137ed11983d9302c4b8f1cbf88b34461964691849229a99d924bc22ef693437bbfbd888eb4d43eccf440f

Download Submit
C:\Windows\System\dWNjWTe.exe

Filesize
2.2MB

MD5
771410b54ad96d203e5f90fd5693f499

SHA1
e2adec6c9328159a77ec28ffab1ea084391a7562

SHA256
1e1f717db1e04507508d9068fe2b5fe0c23f59188194bf784c2961c60dbfee34

SHA512
ac24a9ed07b7e2815c46d5f8013454ae1d15b1e768d5c9b259bd98b562c2386dc373ef8f6a365a69cd42d52676ac562b04062cbeb9b6698d047c587ce2144cc8

Download Submit
C:\Windows\System\dfftWiC.exe

Filesize
2.2MB

MD5
35d25e77aed45340ee8fd62ab4251d62

SHA1
701a519f629ac696820eb0c2c8a4ad8a3a13addd

SHA256
047deee4d158bfa9bb62f8292cbbec72790a884c81a18e0a9ccf6a8f088266d7

SHA512
320e955cd6e294b7773bb74f4a31da0e3d1371f11bb54c17e25ceab590e966580d00d1027291858b94d41c18011838d06339fefc83a799d94772e55699ac7b2e

Download Submit
C:\Windows\System\ebogwLj.exe

Filesize
2.2MB

MD5
44ac03720e3520ef503d950c49fcf8c5

SHA1
e934e6ab03aca1cadbf6618c78305d4628fb4640

SHA256
311dd392709773600f4f4cb17a886ca713df0c2d622ad9e5730762389b9818e0

SHA512
183857b1a9dbaa4eb36e2a9fd48aedba17ac48a4a8dc9aedc8971f93d37b5c462335208a43771c881e68af7d8a8c0ceb32d2f58c514a18cb04001ac08033794d

Download Submit
C:\Windows\System\ecNdkfK.exe

Filesize
2.2MB

MD5
3e5499ac4d151ae2307ec9792f9749c3

SHA1
8cac9ae2e6b261fb55a48b2f3fdc931ade3a700b

SHA256
55a47f7d78034fb518b2e5676985b1cd0cc7fd06a9ae848fea8a8ad5f3c846a0

SHA512
ce29eb25ba99c8d901eb20d089eef132c190446a2d70a7d99f4395821bff7be3da0d81361f6600e853e5269e5f70f8c1c1f556b8ee4a336cb7cb124a99c8fa5a

Download Submit
C:\Windows\System\pWJoyjy.exe

Filesize
2.2MB

MD5
3a481b1cc9ed5d589c0627a6a6c2dc15

SHA1
124b1f815d4ff3b7ae413c7f1d26f088d62233fc

SHA256
cfd24312b305a3806d85b2bbcba233b10cc317d27ccf131c41c428e30c981606

SHA512
4252b72e93e70c536d5c41e221b91a773cd832fea75f276f372a10d69f4118722f6b22279b35f582d138998524c34a4f8cfaddf381aa900cbffd5ea03e31ae9b

Download Submit
C:\Windows\System\qcQNaXo.exe

Filesize
2.2MB

MD5
510dcc2f637017fc88083ac72cc0f4eb

SHA1
cd80de58d109c696c780cda4a4f8bd003776c255

SHA256
b301892e9bb8f9ac36163e15996392e7e4f4ad40d119681be34c998a5f23d850

SHA512
4c8aa4bc256385f19712e0c2d49e8c845b982f3e7d5f7b716aa41d64f1b75ddba16afcb01209f2091632c3e3b81bc830f0e24982b51ac689abd0e2ea51718e97

Download Submit
C:\Windows\System\uDPScyM.exe

Filesize
2.2MB

MD5
d268b8cbfb3707f00975496363c31d5d

SHA1
ea5cdb83b150ca60879883f6c699e3f79f6cc922

SHA256
6b3d18590c9ca36f51a40d80169eda6bd55f078c731b72a900c07f4b1a6ba21a

SHA512
6f7d0a98a7f0df480fafde92f1282351e7bb0c28cea5c380ba4417f72e2edece4be63ae4f547b1004c57625f9aef5f4bd19b74af7d27c6ca2fd81d9ec7c26db7

Download Submit
C:\Windows\System\xiupeCX.exe

Filesize
2.2MB

MD5
5b50df819642601e40f879225b01848f

SHA1
c9719e4ecfd08a73cc606f5afe71c5e746c2a5c9

SHA256
cd40ddf24e2af6351b7e2983ace1b5d2a0ed61046d6565c3c67499d4b1e6756e

SHA512
8c5036f26ab17c13035ba97f2b5d1dee9aef7db514bd35f6844d0558ee022c8e0bcc7787663d2099894abc8e85662ac93ad0a35c889e67f7754ed7a951e7c83a

Download Submit
memory/528-2138-0x00007FF690BA0000-0x00007FF690EF4000-memory.dmp

Filesize
3.3MB

Download
memory/528-679-0x00007FF690BA0000-0x00007FF690EF4000-memory.dmp

Filesize
3.3MB

Download
memory/556-747-0x00007FF7D6600000-0x00007FF7D6954000-memory.dmp

Filesize
3.3MB

Download
memory/556-2154-0x00007FF7D6600000-0x00007FF7D6954000-memory.dmp

Filesize
3.3MB

Download
memory/620-2134-0x00007FF636B80000-0x00007FF636ED4000-memory.dmp

Filesize
3.3MB

Download
memory/620-677-0x00007FF636B80000-0x00007FF636ED4000-memory.dmp

Filesize
3.3MB

Download
memory/1108-742-0x00007FF6380D0000-0x00007FF638424000-memory.dmp

Filesize
3.3MB

Download
memory/1108-2149-0x00007FF6380D0000-0x00007FF638424000-memory.dmp

Filesize
3.3MB

Download
memory/1124-2137-0x00007FF721E50000-0x00007FF7221A4000-memory.dmp

Filesize
3.3MB

Download
memory/1124-24-0x00007FF721E50000-0x00007FF7221A4000-memory.dmp

Filesize
3.3MB

Download
memory/1124-2130-0x00007FF721E50000-0x00007FF7221A4000-memory.dmp

Filesize
3.3MB

Download
memory/1260-2132-0x00007FF6E2490000-0x00007FF6E27E4000-memory.dmp

Filesize
3.3MB

Download
memory/1260-2129-0x00007FF6E2490000-0x00007FF6E27E4000-memory.dmp

Filesize
3.3MB

Download
memory/1260-18-0x00007FF6E2490000-0x00007FF6E27E4000-memory.dmp

Filesize
3.3MB

Download
memory/1516-743-0x00007FF633420000-0x00007FF633774000-memory.dmp

Filesize
3.3MB

Download
memory/1516-2148-0x00007FF633420000-0x00007FF633774000-memory.dmp

Filesize
3.3MB

Download
memory/1732-2153-0x00007FF7EFD80000-0x00007FF7F00D4000-memory.dmp

Filesize
3.3MB

Download
memory/1732-745-0x00007FF7EFD80000-0x00007FF7F00D4000-memory.dmp

Filesize
3.3MB

Download
memory/1816-705-0x00007FF6653B0000-0x00007FF665704000-memory.dmp

Filesize
3.3MB

Download
memory/1816-2158-0x00007FF6653B0000-0x00007FF665704000-memory.dmp

Filesize
3.3MB

Download
memory/1884-741-0x00007FF76DD80000-0x00007FF76E0D4000-memory.dmp

Filesize
3.3MB

Download
memory/1884-2144-0x00007FF76DD80000-0x00007FF76E0D4000-memory.dmp

Filesize
3.3MB

Download
memory/1948-692-0x00007FF6C43C0000-0x00007FF6C4714000-memory.dmp

Filesize
3.3MB

Download
memory/1948-2142-0x00007FF6C43C0000-0x00007FF6C4714000-memory.dmp

Filesize
3.3MB

Download
memory/2080-2136-0x00007FF7C4200000-0x00007FF7C4554000-memory.dmp

Filesize
3.3MB

Download
memory/2080-678-0x00007FF7C4200000-0x00007FF7C4554000-memory.dmp

Filesize
3.3MB

Download
memory/2444-714-0x00007FF7000F0000-0x00007FF700444000-memory.dmp

Filesize
3.3MB

Download
memory/2444-2157-0x00007FF7000F0000-0x00007FF700444000-memory.dmp

Filesize
3.3MB

Download
memory/2516-701-0x00007FF7228C0000-0x00007FF722C14000-memory.dmp

Filesize
3.3MB

Download
memory/2516-2145-0x00007FF7228C0000-0x00007FF722C14000-memory.dmp

Filesize
3.3MB

Download
memory/2764-2147-0x00007FF662740000-0x00007FF662A94000-memory.dmp

Filesize
3.3MB

Download
memory/2764-746-0x00007FF662740000-0x00007FF662A94000-memory.dmp

Filesize
3.3MB

Download
memory/2812-2128-0x00007FF717370000-0x00007FF7176C4000-memory.dmp

Filesize
3.3MB

Download
memory/2812-0-0x00007FF717370000-0x00007FF7176C4000-memory.dmp

Filesize
3.3MB

Download
memory/2812-1-0x000002B445B20000-0x000002B445B30000-memory.dmp

Filesize
64KB

Download
memory/3000-744-0x00007FF67B450000-0x00007FF67B7A4000-memory.dmp

Filesize
3.3MB

Download
memory/3000-2146-0x00007FF67B450000-0x00007FF67B7A4000-memory.dmp

Filesize
3.3MB

Download
memory/3052-2133-0x00007FF78C6B0000-0x00007FF78CA04000-memory.dmp

Filesize
3.3MB

Download
memory/3052-13-0x00007FF78C6B0000-0x00007FF78CA04000-memory.dmp

Filesize
3.3MB

Download
memory/3144-2131-0x00007FF73B780000-0x00007FF73BAD4000-memory.dmp

Filesize
3.3MB

Download
memory/3144-17-0x00007FF73B780000-0x00007FF73BAD4000-memory.dmp

Filesize
3.3MB

Download
memory/3456-749-0x00007FF7F90F0000-0x00007FF7F9444000-memory.dmp

Filesize
3.3MB

Download
memory/3456-2152-0x00007FF7F90F0000-0x00007FF7F9444000-memory.dmp

Filesize
3.3MB

Download
memory/3488-2135-0x00007FF73CCE0000-0x00007FF73D034000-memory.dmp

Filesize
3.3MB

Download
memory/3488-680-0x00007FF73CCE0000-0x00007FF73D034000-memory.dmp

Filesize
3.3MB

Download
memory/3652-2139-0x00007FF6E2240000-0x00007FF6E2594000-memory.dmp

Filesize
3.3MB

Download
memory/3652-681-0x00007FF6E2240000-0x00007FF6E2594000-memory.dmp

Filesize
3.3MB

Download
memory/3992-2150-0x00007FF6D6790000-0x00007FF6D6AE4000-memory.dmp

Filesize
3.3MB

Download
memory/3992-729-0x00007FF6D6790000-0x00007FF6D6AE4000-memory.dmp

Filesize
3.3MB

Download
memory/4436-2159-0x00007FF606D80000-0x00007FF6070D4000-memory.dmp

Filesize
3.3MB

Download
memory/4436-730-0x00007FF606D80000-0x00007FF6070D4000-memory.dmp

Filesize
3.3MB

Download
memory/4524-696-0x00007FF6D9F10000-0x00007FF6DA264000-memory.dmp

Filesize
3.3MB

Download
memory/4524-2141-0x00007FF6D9F10000-0x00007FF6DA264000-memory.dmp

Filesize
3.3MB

Download
memory/4556-2155-0x00007FF7B12D0000-0x00007FF7B1624000-memory.dmp

Filesize
3.3MB

Download
memory/4556-721-0x00007FF7B12D0000-0x00007FF7B1624000-memory.dmp

Filesize
3.3MB

Download
memory/4788-2151-0x00007FF641D60000-0x00007FF6420B4000-memory.dmp

Filesize
3.3MB

Download
memory/4788-735-0x00007FF641D60000-0x00007FF6420B4000-memory.dmp

Filesize
3.3MB

Download
memory/4920-748-0x00007FF719E60000-0x00007FF71A1B4000-memory.dmp

Filesize
3.3MB

Download
memory/4920-2143-0x00007FF719E60000-0x00007FF71A1B4000-memory.dmp

Filesize
3.3MB

Download
memory/4944-689-0x00007FF674530000-0x00007FF674884000-memory.dmp

Filesize
3.3MB

Download
memory/4944-2140-0x00007FF674530000-0x00007FF674884000-memory.dmp

Filesize
3.3MB

Download
memory/5080-2156-0x00007FF6043E0000-0x00007FF604734000-memory.dmp

Filesize
3.3MB

Download
memory/5080-718-0x00007FF6043E0000-0x00007FF604734000-memory.dmp

Filesize
3.3MB

Download