xmrig | 8ddc2acae4add4e45832cb9084f4f60dc23c344f50ba665a305ed8ba192a6df3

Analysis

max time kernel
136s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
Size

2.1MB
MD5

1efeba6ec650b242800f26ebdce73ab0
SHA1

d5f49ccaa98540899dc8c46480489735e01f7be8
SHA256

8ddc2acae4add4e45832cb9084f4f60dc23c344f50ba665a305ed8ba192a6df3
SHA512

e6bbc2561e3ac37c93d5ca924c4bdd34572db2206699cdd658dc1ef7ed955758ee5e8476b7a4e3addfb5fcf266bc812e65675f23c9bff36539c3c779a23b57fe
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+AjE6p6hzuS:BemTLkNdfE0pZrf

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3944-0-0x00007FF650440000-0x00007FF650794000-memory.dmp	xmrig
behavioral2/files/0x0008000000023433-5.dat	xmrig
behavioral2/files/0x0007000000023437-11.dat	xmrig
behavioral2/files/0x0007000000023438-20.dat	xmrig
behavioral2/files/0x0007000000023439-24.dat	xmrig
behavioral2/files/0x000700000002343d-36.dat	xmrig
behavioral2/memory/3952-42-0x00007FF63B270000-0x00007FF63B5C4000-memory.dmp	xmrig
behavioral2/memory/1888-46-0x00007FF7EA240000-0x00007FF7EA594000-memory.dmp	xmrig
behavioral2/memory/748-53-0x00007FF7FAEC0000-0x00007FF7FB214000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-66.dat	xmrig
behavioral2/memory/3484-54-0x00007FF797880000-0x00007FF797BD4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343e-51.dat	xmrig
behavioral2/files/0x000700000002343a-49.dat	xmrig
behavioral2/memory/2308-45-0x00007FF743B60000-0x00007FF743EB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-43.dat	xmrig
behavioral2/memory/4892-34-0x00007FF75F410000-0x00007FF75F764000-memory.dmp	xmrig
behavioral2/memory/1084-73-0x00007FF7F9E70000-0x00007FF7FA1C4000-memory.dmp	xmrig
behavioral2/memory/4968-77-0x00007FF6378B0000-0x00007FF637C04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023446-91.dat	xmrig
behavioral2/files/0x0007000000023448-107.dat	xmrig
behavioral2/memory/1272-111-0x00007FF791800000-0x00007FF791B54000-memory.dmp	xmrig
behavioral2/memory/4492-113-0x00007FF679350000-0x00007FF6796A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023447-119.dat	xmrig
behavioral2/memory/456-128-0x00007FF62B3C0000-0x00007FF62B714000-memory.dmp	xmrig
behavioral2/memory/3268-127-0x00007FF76F140000-0x00007FF76F494000-memory.dmp	xmrig
behavioral2/memory/2676-126-0x00007FF68EB20000-0x00007FF68EE74000-memory.dmp	xmrig
behavioral2/memory/1520-125-0x00007FF7DE6E0000-0x00007FF7DEA34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023449-118.dat	xmrig
behavioral2/memory/1776-116-0x00007FF783ED0000-0x00007FF784224000-memory.dmp	xmrig
behavioral2/files/0x0008000000023434-115.dat	xmrig
behavioral2/memory/2636-112-0x00007FF788BD0000-0x00007FF788F24000-memory.dmp	xmrig
behavioral2/memory/1788-105-0x00007FF797EE0000-0x00007FF798234000-memory.dmp	xmrig
behavioral2/memory/5096-101-0x00007FF75E980000-0x00007FF75ECD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023445-99.dat	xmrig
behavioral2/files/0x0007000000023443-96.dat	xmrig
behavioral2/files/0x0007000000023442-94.dat	xmrig
behavioral2/files/0x0007000000023441-92.dat	xmrig
behavioral2/files/0x0007000000023440-90.dat	xmrig
behavioral2/files/0x0007000000023444-85.dat	xmrig
behavioral2/memory/2388-81-0x00007FF69AE80000-0x00007FF69B1D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002344b-147.dat	xmrig
behavioral2/files/0x000700000002344f-155.dat	xmrig
behavioral2/files/0x0007000000023452-174.dat	xmrig
behavioral2/memory/3664-175-0x00007FF6E19D0000-0x00007FF6E1D24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023450-172.dat	xmrig
behavioral2/files/0x0007000000023451-171.dat	xmrig
behavioral2/files/0x0007000000023455-195.dat	xmrig
behavioral2/memory/2696-199-0x00007FF65C920000-0x00007FF65CC74000-memory.dmp	xmrig
behavioral2/memory/2212-198-0x00007FF77BCC0000-0x00007FF77C014000-memory.dmp	xmrig
behavioral2/memory/4080-196-0x00007FF622790000-0x00007FF622AE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023454-194.dat	xmrig
behavioral2/files/0x0007000000023453-190.dat	xmrig
behavioral2/files/0x000700000002344e-166.dat	xmrig
behavioral2/memory/3648-161-0x00007FF774110000-0x00007FF774464000-memory.dmp	xmrig
behavioral2/files/0x000700000002344c-157.dat	xmrig
behavioral2/files/0x000700000002344d-153.dat	xmrig
behavioral2/memory/3116-151-0x00007FF755A00000-0x00007FF755D54000-memory.dmp	xmrig
behavioral2/memory/5108-145-0x00007FF638210000-0x00007FF638564000-memory.dmp	xmrig
behavioral2/memory/3000-142-0x00007FF6771C0000-0x00007FF677514000-memory.dmp	xmrig
behavioral2/files/0x000700000002344a-136.dat	xmrig
behavioral2/memory/4904-63-0x00007FF7DD6E0000-0x00007FF7DDA34000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-32.dat	xmrig
behavioral2/memory/1748-16-0x00007FF737340000-0x00007FF737694000-memory.dmp	xmrig
behavioral2/memory/2388-2081-0x00007FF69AE80000-0x00007FF69B1D4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1748	ftcNBLX.exe
3484	uQVjCHi.exe
4892	NLyZIrT.exe
3952	RjBGcBo.exe
4904	CxGWrlV.exe
2308	XTqrscc.exe
1888	IjrmdmQ.exe
748	wzZIext.exe
1084	TfxMQvb.exe
1776	KLUqIdz.exe
4968	EMcVdrm.exe
2388	biJITOa.exe
5096	RTrKvgp.exe
1788	ZGUogrh.exe
1520	zEpAVkj.exe
2676	LiVthSQ.exe
3268	WoHFKrS.exe
1272	YLYcuLl.exe
456	OSbnnVK.exe
2636	vFoyySr.exe
4492	zYqpoJU.exe
3000	rWcpuST.exe
3648	VjcPmnb.exe
5108	LoXzDkZ.exe
3664	JKTWGqf.exe
3116	JAXgOcV.exe
2212	mDPInjb.exe
4080	rCIjyQx.exe
2696	BWlTrfa.exe
3272	PCYfpDj.exe
3032	Zdamial.exe
800	uyAUpzt.exe
348	mMMxXlI.exe
3712	OLBatkG.exe
3240	IprxiLO.exe
2120	mBzPdhP.exe
2660	TCfDDPY.exe
4796	ROUjrUb.exe
4928	ohLVFHm.exe
4000	kKaIZIB.exe
3296	rHVNpEf.exe
4456	BBGsyaG.exe
540	OneWyGu.exe
2484	GdNecTD.exe
4264	KIPHnPZ.exe
3884	VAliTLt.exe
3764	PhdtHIu.exe
1204	QDVuMQH.exe
1000	HPNwGWe.exe
2340	WLygbUS.exe
2980	EtXIQXs.exe
5064	zUgTeXt.exe
3556	HTfClYo.exe
652	uiHzfjA.exe
3996	VrZtKqN.exe
2892	GsPGUnO.exe
3436	SFouAEh.exe
4612	pArpLxf.exe
2760	ppPfIyz.exe
4696	rBFjLrj.exe
916	gtETNiz.exe
4720	qGAyqbb.exe
1040	AZIcCRX.exe
4732	xGCpJCk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3944-0-0x00007FF650440000-0x00007FF650794000-memory.dmp	upx
behavioral2/files/0x0008000000023433-5.dat	upx
behavioral2/files/0x0007000000023437-11.dat	upx
behavioral2/files/0x0007000000023438-20.dat	upx
behavioral2/files/0x0007000000023439-24.dat	upx
behavioral2/files/0x000700000002343d-36.dat	upx
behavioral2/memory/3952-42-0x00007FF63B270000-0x00007FF63B5C4000-memory.dmp	upx
behavioral2/memory/1888-46-0x00007FF7EA240000-0x00007FF7EA594000-memory.dmp	upx
behavioral2/memory/748-53-0x00007FF7FAEC0000-0x00007FF7FB214000-memory.dmp	upx
behavioral2/files/0x000700000002343f-66.dat	upx
behavioral2/memory/3484-54-0x00007FF797880000-0x00007FF797BD4000-memory.dmp	upx
behavioral2/files/0x000700000002343e-51.dat	upx
behavioral2/files/0x000700000002343a-49.dat	upx
behavioral2/memory/2308-45-0x00007FF743B60000-0x00007FF743EB4000-memory.dmp	upx
behavioral2/files/0x000700000002343b-43.dat	upx
behavioral2/memory/4892-34-0x00007FF75F410000-0x00007FF75F764000-memory.dmp	upx
behavioral2/memory/1084-73-0x00007FF7F9E70000-0x00007FF7FA1C4000-memory.dmp	upx
behavioral2/memory/4968-77-0x00007FF6378B0000-0x00007FF637C04000-memory.dmp	upx
behavioral2/files/0x0007000000023446-91.dat	upx
behavioral2/files/0x0007000000023448-107.dat	upx
behavioral2/memory/1272-111-0x00007FF791800000-0x00007FF791B54000-memory.dmp	upx
behavioral2/memory/4492-113-0x00007FF679350000-0x00007FF6796A4000-memory.dmp	upx
behavioral2/files/0x0007000000023447-119.dat	upx
behavioral2/memory/456-128-0x00007FF62B3C0000-0x00007FF62B714000-memory.dmp	upx
behavioral2/memory/3268-127-0x00007FF76F140000-0x00007FF76F494000-memory.dmp	upx
behavioral2/memory/2676-126-0x00007FF68EB20000-0x00007FF68EE74000-memory.dmp	upx
behavioral2/memory/1520-125-0x00007FF7DE6E0000-0x00007FF7DEA34000-memory.dmp	upx
behavioral2/files/0x0007000000023449-118.dat	upx
behavioral2/memory/1776-116-0x00007FF783ED0000-0x00007FF784224000-memory.dmp	upx
behavioral2/files/0x0008000000023434-115.dat	upx
behavioral2/memory/2636-112-0x00007FF788BD0000-0x00007FF788F24000-memory.dmp	upx
behavioral2/memory/1788-105-0x00007FF797EE0000-0x00007FF798234000-memory.dmp	upx
behavioral2/memory/5096-101-0x00007FF75E980000-0x00007FF75ECD4000-memory.dmp	upx
behavioral2/files/0x0007000000023445-99.dat	upx
behavioral2/files/0x0007000000023443-96.dat	upx
behavioral2/files/0x0007000000023442-94.dat	upx
behavioral2/files/0x0007000000023441-92.dat	upx
behavioral2/files/0x0007000000023440-90.dat	upx
behavioral2/files/0x0007000000023444-85.dat	upx
behavioral2/memory/2388-81-0x00007FF69AE80000-0x00007FF69B1D4000-memory.dmp	upx
behavioral2/files/0x000700000002344b-147.dat	upx
behavioral2/files/0x000700000002344f-155.dat	upx
behavioral2/files/0x0007000000023452-174.dat	upx
behavioral2/memory/3664-175-0x00007FF6E19D0000-0x00007FF6E1D24000-memory.dmp	upx
behavioral2/files/0x0007000000023450-172.dat	upx
behavioral2/files/0x0007000000023451-171.dat	upx
behavioral2/files/0x0007000000023455-195.dat	upx
behavioral2/memory/2696-199-0x00007FF65C920000-0x00007FF65CC74000-memory.dmp	upx
behavioral2/memory/2212-198-0x00007FF77BCC0000-0x00007FF77C014000-memory.dmp	upx
behavioral2/memory/4080-196-0x00007FF622790000-0x00007FF622AE4000-memory.dmp	upx
behavioral2/files/0x0007000000023454-194.dat	upx
behavioral2/files/0x0007000000023453-190.dat	upx
behavioral2/files/0x000700000002344e-166.dat	upx
behavioral2/memory/3648-161-0x00007FF774110000-0x00007FF774464000-memory.dmp	upx
behavioral2/files/0x000700000002344c-157.dat	upx
behavioral2/files/0x000700000002344d-153.dat	upx
behavioral2/memory/3116-151-0x00007FF755A00000-0x00007FF755D54000-memory.dmp	upx
behavioral2/memory/5108-145-0x00007FF638210000-0x00007FF638564000-memory.dmp	upx
behavioral2/memory/3000-142-0x00007FF6771C0000-0x00007FF677514000-memory.dmp	upx
behavioral2/files/0x000700000002344a-136.dat	upx
behavioral2/memory/4904-63-0x00007FF7DD6E0000-0x00007FF7DDA34000-memory.dmp	upx
behavioral2/files/0x000700000002343c-32.dat	upx
behavioral2/memory/1748-16-0x00007FF737340000-0x00007FF737694000-memory.dmp	upx
behavioral2/memory/2388-2081-0x00007FF69AE80000-0x00007FF69B1D4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SXsgVyW.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\LKeyZwi.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\lOMwoJM.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\UyFuWkv.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\zTozjGW.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\MvyKqcg.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\XFFlHXo.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\AYAysJX.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\COqFSHQ.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\kBOKXdP.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\MVGMSIl.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\pcrZmmg.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\HBJbtPe.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\yynSqYF.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\ZFBNPNI.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\lJnFqAs.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\oTYPBbL.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\irMCsSY.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\OkMbMyO.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\UumerrL.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\yTBVwpj.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\tpGMyYn.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\mREgBVG.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\uaPcABZ.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\nJYKjmp.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\ZGzQvmI.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\uQVjCHi.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\dbsrXMG.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\ZsUXgMw.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\QPKzTJA.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\SILCMtE.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\jAztbzE.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\EPxJluI.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\GdNecTD.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\NfJEGoN.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\PCxkjfa.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\fldYlbg.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\gNaLPEe.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\aXISqwg.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\OVqgYri.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\rJhFZhc.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\zYqpoJU.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\mBzPdhP.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\cLlhMYr.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\qnIXUsP.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\ZCoipwc.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\oHYYxCn.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\qNJcgQY.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\BJPqsXn.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\pqtJUjj.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\AhqFhev.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\RJkDeWy.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\ONntyaI.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\CaQlZON.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\iMXLFli.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\QOfEQhz.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\DYhqsMp.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\uCxSOjB.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\oWuhbhZ.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\fYywaXf.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\GoaJLAb.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\DoCfhcx.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\GRxoOCR.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
File created	C:\Windows\System\oZKLFuA.exe	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 1748	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	83
PID 3944 wrote to memory of 1748	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	83
PID 3944 wrote to memory of 3484	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	84
PID 3944 wrote to memory of 3484	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	84
PID 3944 wrote to memory of 4892	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	85
PID 3944 wrote to memory of 4892	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	85
PID 3944 wrote to memory of 3952	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	86
PID 3944 wrote to memory of 3952	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	86
PID 3944 wrote to memory of 1888	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	87
PID 3944 wrote to memory of 1888	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	87
PID 3944 wrote to memory of 4904	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	88
PID 3944 wrote to memory of 4904	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	88
PID 3944 wrote to memory of 2308	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	89
PID 3944 wrote to memory of 2308	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	89
PID 3944 wrote to memory of 748	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	90
PID 3944 wrote to memory of 748	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	90
PID 3944 wrote to memory of 1084	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	91
PID 3944 wrote to memory of 1084	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	91
PID 3944 wrote to memory of 1776	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	92
PID 3944 wrote to memory of 1776	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	92
PID 3944 wrote to memory of 4968	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	93
PID 3944 wrote to memory of 4968	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	93
PID 3944 wrote to memory of 2388	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	94
PID 3944 wrote to memory of 2388	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	94
PID 3944 wrote to memory of 5096	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	95
PID 3944 wrote to memory of 5096	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	95
PID 3944 wrote to memory of 1788	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	96
PID 3944 wrote to memory of 1788	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	96
PID 3944 wrote to memory of 1520	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	97
PID 3944 wrote to memory of 1520	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	97
PID 3944 wrote to memory of 2676	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	98
PID 3944 wrote to memory of 2676	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	98
PID 3944 wrote to memory of 3268	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	99
PID 3944 wrote to memory of 3268	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	99
PID 3944 wrote to memory of 1272	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	100
PID 3944 wrote to memory of 1272	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	100
PID 3944 wrote to memory of 4492	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	101
PID 3944 wrote to memory of 4492	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	101
PID 3944 wrote to memory of 456	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	102
PID 3944 wrote to memory of 456	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	102
PID 3944 wrote to memory of 2636	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	103
PID 3944 wrote to memory of 2636	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	103
PID 3944 wrote to memory of 3000	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	104
PID 3944 wrote to memory of 3000	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	104
PID 3944 wrote to memory of 3648	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	105
PID 3944 wrote to memory of 3648	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	105
PID 3944 wrote to memory of 5108	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	106
PID 3944 wrote to memory of 5108	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	106
PID 3944 wrote to memory of 3664	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	107
PID 3944 wrote to memory of 3664	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	107
PID 3944 wrote to memory of 3116	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	108
PID 3944 wrote to memory of 3116	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	108
PID 3944 wrote to memory of 2212	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	109
PID 3944 wrote to memory of 2212	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	109
PID 3944 wrote to memory of 4080	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	110
PID 3944 wrote to memory of 4080	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	110
PID 3944 wrote to memory of 2696	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	111
PID 3944 wrote to memory of 2696	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	111
PID 3944 wrote to memory of 3272	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	112
PID 3944 wrote to memory of 3272	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	112
PID 3944 wrote to memory of 3032	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	113
PID 3944 wrote to memory of 3032	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	113
PID 3944 wrote to memory of 800	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	114
PID 3944 wrote to memory of 800	3944	1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1efeba6ec650b242800f26ebdce73ab0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\System\ftcNBLX.exe
  C:\Windows\System\ftcNBLX.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\uQVjCHi.exe
  C:\Windows\System\uQVjCHi.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\NLyZIrT.exe
  C:\Windows\System\NLyZIrT.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\RjBGcBo.exe
  C:\Windows\System\RjBGcBo.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\IjrmdmQ.exe
  C:\Windows\System\IjrmdmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\CxGWrlV.exe
  C:\Windows\System\CxGWrlV.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\XTqrscc.exe
  C:\Windows\System\XTqrscc.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\wzZIext.exe
  C:\Windows\System\wzZIext.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\TfxMQvb.exe
  C:\Windows\System\TfxMQvb.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\KLUqIdz.exe
  C:\Windows\System\KLUqIdz.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\EMcVdrm.exe
  C:\Windows\System\EMcVdrm.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\biJITOa.exe
  C:\Windows\System\biJITOa.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\RTrKvgp.exe
  C:\Windows\System\RTrKvgp.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\ZGUogrh.exe
  C:\Windows\System\ZGUogrh.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\zEpAVkj.exe
  C:\Windows\System\zEpAVkj.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\LiVthSQ.exe
  C:\Windows\System\LiVthSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\WoHFKrS.exe
  C:\Windows\System\WoHFKrS.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\YLYcuLl.exe
  C:\Windows\System\YLYcuLl.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\zYqpoJU.exe
  C:\Windows\System\zYqpoJU.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\OSbnnVK.exe
  C:\Windows\System\OSbnnVK.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\vFoyySr.exe
  C:\Windows\System\vFoyySr.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\rWcpuST.exe
  C:\Windows\System\rWcpuST.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\VjcPmnb.exe
  C:\Windows\System\VjcPmnb.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\LoXzDkZ.exe
  C:\Windows\System\LoXzDkZ.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\JKTWGqf.exe
  C:\Windows\System\JKTWGqf.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\JAXgOcV.exe
  C:\Windows\System\JAXgOcV.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\mDPInjb.exe
  C:\Windows\System\mDPInjb.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\rCIjyQx.exe
  C:\Windows\System\rCIjyQx.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\BWlTrfa.exe
  C:\Windows\System\BWlTrfa.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\PCYfpDj.exe
  C:\Windows\System\PCYfpDj.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\Zdamial.exe
  C:\Windows\System\Zdamial.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\uyAUpzt.exe
  C:\Windows\System\uyAUpzt.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\mMMxXlI.exe
  C:\Windows\System\mMMxXlI.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\OLBatkG.exe
  C:\Windows\System\OLBatkG.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\IprxiLO.exe
  C:\Windows\System\IprxiLO.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\mBzPdhP.exe
  C:\Windows\System\mBzPdhP.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\TCfDDPY.exe
  C:\Windows\System\TCfDDPY.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ROUjrUb.exe
  C:\Windows\System\ROUjrUb.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\ohLVFHm.exe
  C:\Windows\System\ohLVFHm.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\kKaIZIB.exe
  C:\Windows\System\kKaIZIB.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\rHVNpEf.exe
  C:\Windows\System\rHVNpEf.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\BBGsyaG.exe
  C:\Windows\System\BBGsyaG.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\OneWyGu.exe
  C:\Windows\System\OneWyGu.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\GdNecTD.exe
  C:\Windows\System\GdNecTD.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\KIPHnPZ.exe
  C:\Windows\System\KIPHnPZ.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\VAliTLt.exe
  C:\Windows\System\VAliTLt.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\PhdtHIu.exe
  C:\Windows\System\PhdtHIu.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\QDVuMQH.exe
  C:\Windows\System\QDVuMQH.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\HPNwGWe.exe
  C:\Windows\System\HPNwGWe.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\WLygbUS.exe
  C:\Windows\System\WLygbUS.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\EtXIQXs.exe
  C:\Windows\System\EtXIQXs.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\zUgTeXt.exe
  C:\Windows\System\zUgTeXt.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\HTfClYo.exe
  C:\Windows\System\HTfClYo.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\uiHzfjA.exe
  C:\Windows\System\uiHzfjA.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\VrZtKqN.exe
  C:\Windows\System\VrZtKqN.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\GsPGUnO.exe
  C:\Windows\System\GsPGUnO.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\SFouAEh.exe
  C:\Windows\System\SFouAEh.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\pArpLxf.exe
  C:\Windows\System\pArpLxf.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\ppPfIyz.exe
  C:\Windows\System\ppPfIyz.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\rBFjLrj.exe
  C:\Windows\System\rBFjLrj.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\gtETNiz.exe
  C:\Windows\System\gtETNiz.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\qGAyqbb.exe
  C:\Windows\System\qGAyqbb.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\AZIcCRX.exe
  C:\Windows\System\AZIcCRX.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\xGCpJCk.exe
  C:\Windows\System\xGCpJCk.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\nbmnuGZ.exe
  C:\Windows\System\nbmnuGZ.exe
  2⤵
  PID:3624
- C:\Windows\System\nCgFUat.exe
  C:\Windows\System\nCgFUat.exe
  2⤵
  PID:2684
- C:\Windows\System\TcsvzIy.exe
  C:\Windows\System\TcsvzIy.exe
  2⤵
  PID:1648
- C:\Windows\System\uWOhuJZ.exe
  C:\Windows\System\uWOhuJZ.exe
  2⤵
  PID:4484
- C:\Windows\System\alKEsvF.exe
  C:\Windows\System\alKEsvF.exe
  2⤵
  PID:4212
- C:\Windows\System\TPqAMwt.exe
  C:\Windows\System\TPqAMwt.exe
  2⤵
  PID:2712
- C:\Windows\System\zqxmWSD.exe
  C:\Windows\System\zqxmWSD.exe
  2⤵
  PID:3056
- C:\Windows\System\IjVYSCN.exe
  C:\Windows\System\IjVYSCN.exe
  2⤵
  PID:2936
- C:\Windows\System\LbjwkSI.exe
  C:\Windows\System\LbjwkSI.exe
  2⤵
  PID:2780
- C:\Windows\System\KsdGMlJ.exe
  C:\Windows\System\KsdGMlJ.exe
  2⤵
  PID:4420
- C:\Windows\System\kFrCpgs.exe
  C:\Windows\System\kFrCpgs.exe
  2⤵
  PID:4880
- C:\Windows\System\PvqXQGB.exe
  C:\Windows\System\PvqXQGB.exe
  2⤵
  PID:3912
- C:\Windows\System\QxmCzDA.exe
  C:\Windows\System\QxmCzDA.exe
  2⤵
  PID:3396
- C:\Windows\System\dbsrXMG.exe
  C:\Windows\System\dbsrXMG.exe
  2⤵
  PID:4988
- C:\Windows\System\tmwwEve.exe
  C:\Windows\System\tmwwEve.exe
  2⤵
  PID:4068
- C:\Windows\System\LxAeNUZ.exe
  C:\Windows\System\LxAeNUZ.exe
  2⤵
  PID:2496
- C:\Windows\System\iYGiFUc.exe
  C:\Windows\System\iYGiFUc.exe
  2⤵
  PID:1716
- C:\Windows\System\HuzAlIr.exe
  C:\Windows\System\HuzAlIr.exe
  2⤵
  PID:4908
- C:\Windows\System\dQCLKvA.exe
  C:\Windows\System\dQCLKvA.exe
  2⤵
  PID:1044
- C:\Windows\System\gjMWhDy.exe
  C:\Windows\System\gjMWhDy.exe
  2⤵
  PID:2800
- C:\Windows\System\KvDVJff.exe
  C:\Windows\System\KvDVJff.exe
  2⤵
  PID:2996
- C:\Windows\System\JkyJVKL.exe
  C:\Windows\System\JkyJVKL.exe
  2⤵
  PID:3848
- C:\Windows\System\qYLZLHr.exe
  C:\Windows\System\qYLZLHr.exe
  2⤵
  PID:5140
- C:\Windows\System\aZbxIHs.exe
  C:\Windows\System\aZbxIHs.exe
  2⤵
  PID:5176
- C:\Windows\System\CzkZpOh.exe
  C:\Windows\System\CzkZpOh.exe
  2⤵
  PID:5196
- C:\Windows\System\pDtboXP.exe
  C:\Windows\System\pDtboXP.exe
  2⤵
  PID:5240
- C:\Windows\System\xPsFmXt.exe
  C:\Windows\System\xPsFmXt.exe
  2⤵
  PID:5256
- C:\Windows\System\wgokqLa.exe
  C:\Windows\System\wgokqLa.exe
  2⤵
  PID:5284
- C:\Windows\System\KBouMXQ.exe
  C:\Windows\System\KBouMXQ.exe
  2⤵
  PID:5312
- C:\Windows\System\stjhgKx.exe
  C:\Windows\System\stjhgKx.exe
  2⤵
  PID:5344
- C:\Windows\System\SgafbTl.exe
  C:\Windows\System\SgafbTl.exe
  2⤵
  PID:5372
- C:\Windows\System\MhqSAaU.exe
  C:\Windows\System\MhqSAaU.exe
  2⤵
  PID:5404
- C:\Windows\System\ziYGTcJ.exe
  C:\Windows\System\ziYGTcJ.exe
  2⤵
  PID:5428
- C:\Windows\System\ydzabIB.exe
  C:\Windows\System\ydzabIB.exe
  2⤵
  PID:5464
- C:\Windows\System\oSACwKh.exe
  C:\Windows\System\oSACwKh.exe
  2⤵
  PID:5496
- C:\Windows\System\FOicRFU.exe
  C:\Windows\System\FOicRFU.exe
  2⤵
  PID:5524
- C:\Windows\System\VaTGoLE.exe
  C:\Windows\System\VaTGoLE.exe
  2⤵
  PID:5580
- C:\Windows\System\MHFvnLC.exe
  C:\Windows\System\MHFvnLC.exe
  2⤵
  PID:5604
- C:\Windows\System\rxHcrwu.exe
  C:\Windows\System\rxHcrwu.exe
  2⤵
  PID:5624
- C:\Windows\System\vmEzULl.exe
  C:\Windows\System\vmEzULl.exe
  2⤵
  PID:5652
- C:\Windows\System\HvHxFhh.exe
  C:\Windows\System\HvHxFhh.exe
  2⤵
  PID:5684
- C:\Windows\System\pcktDWT.exe
  C:\Windows\System\pcktDWT.exe
  2⤵
  PID:5728
- C:\Windows\System\DzWwwCO.exe
  C:\Windows\System\DzWwwCO.exe
  2⤵
  PID:5764
- C:\Windows\System\GrOsFJP.exe
  C:\Windows\System\GrOsFJP.exe
  2⤵
  PID:5788
- C:\Windows\System\kataurp.exe
  C:\Windows\System\kataurp.exe
  2⤵
  PID:5816
- C:\Windows\System\FvQNqqj.exe
  C:\Windows\System\FvQNqqj.exe
  2⤵
  PID:5844
- C:\Windows\System\nyZeIQk.exe
  C:\Windows\System\nyZeIQk.exe
  2⤵
  PID:5872
- C:\Windows\System\lFkkaGK.exe
  C:\Windows\System\lFkkaGK.exe
  2⤵
  PID:5900
- C:\Windows\System\FGHCMDU.exe
  C:\Windows\System\FGHCMDU.exe
  2⤵
  PID:5932
- C:\Windows\System\cmxzBSU.exe
  C:\Windows\System\cmxzBSU.exe
  2⤵
  PID:5964
- C:\Windows\System\ltyVqtA.exe
  C:\Windows\System\ltyVqtA.exe
  2⤵
  PID:5988
- C:\Windows\System\XMLMfuh.exe
  C:\Windows\System\XMLMfuh.exe
  2⤵
  PID:6012
- C:\Windows\System\zojaSYd.exe
  C:\Windows\System\zojaSYd.exe
  2⤵
  PID:6048
- C:\Windows\System\MvPdZHA.exe
  C:\Windows\System\MvPdZHA.exe
  2⤵
  PID:6068
- C:\Windows\System\WNPfXwG.exe
  C:\Windows\System\WNPfXwG.exe
  2⤵
  PID:6096
- C:\Windows\System\XumHwMh.exe
  C:\Windows\System\XumHwMh.exe
  2⤵
  PID:6128
- C:\Windows\System\vjZxHso.exe
  C:\Windows\System\vjZxHso.exe
  2⤵
  PID:5128
- C:\Windows\System\tlmFHcQ.exe
  C:\Windows\System\tlmFHcQ.exe
  2⤵
  PID:5192
- C:\Windows\System\NLJZMFL.exe
  C:\Windows\System\NLJZMFL.exe
  2⤵
  PID:5252
- C:\Windows\System\AQZonkt.exe
  C:\Windows\System\AQZonkt.exe
  2⤵
  PID:5336
- C:\Windows\System\MorghEV.exe
  C:\Windows\System\MorghEV.exe
  2⤵
  PID:4196
- C:\Windows\System\TmuIhVq.exe
  C:\Windows\System\TmuIhVq.exe
  2⤵
  PID:5448
- C:\Windows\System\zTKzRFW.exe
  C:\Windows\System\zTKzRFW.exe
  2⤵
  PID:5516
- C:\Windows\System\IPhgKgU.exe
  C:\Windows\System\IPhgKgU.exe
  2⤵
  PID:5616
- C:\Windows\System\uwzxoyZ.exe
  C:\Windows\System\uwzxoyZ.exe
  2⤵
  PID:5676
- C:\Windows\System\ukZNBbg.exe
  C:\Windows\System\ukZNBbg.exe
  2⤵
  PID:3820
- C:\Windows\System\utzaFhW.exe
  C:\Windows\System\utzaFhW.exe
  2⤵
  PID:5800
- C:\Windows\System\mmTcuNB.exe
  C:\Windows\System\mmTcuNB.exe
  2⤵
  PID:5868
- C:\Windows\System\FzTYObD.exe
  C:\Windows\System\FzTYObD.exe
  2⤵
  PID:5924
- C:\Windows\System\UumerrL.exe
  C:\Windows\System\UumerrL.exe
  2⤵
  PID:6008
- C:\Windows\System\SflSgEY.exe
  C:\Windows\System\SflSgEY.exe
  2⤵
  PID:6080
- C:\Windows\System\mLKJJuR.exe
  C:\Windows\System\mLKJJuR.exe
  2⤵
  PID:5160
- C:\Windows\System\ShVApBG.exe
  C:\Windows\System\ShVApBG.exe
  2⤵
  PID:5248
- C:\Windows\System\fxTbYsz.exe
  C:\Windows\System\fxTbYsz.exe
  2⤵
  PID:5392
- C:\Windows\System\GYIlBAi.exe
  C:\Windows\System\GYIlBAi.exe
  2⤵
  PID:5612
- C:\Windows\System\uanJCnT.exe
  C:\Windows\System\uanJCnT.exe
  2⤵
  PID:5748
- C:\Windows\System\QDcQmBs.exe
  C:\Windows\System\QDcQmBs.exe
  2⤵
  PID:5912
- C:\Windows\System\QzDpvyJ.exe
  C:\Windows\System\QzDpvyJ.exe
  2⤵
  PID:5980
- C:\Windows\System\lzWHrbX.exe
  C:\Windows\System\lzWHrbX.exe
  2⤵
  PID:5232
- C:\Windows\System\lpFdLZh.exe
  C:\Windows\System\lpFdLZh.exe
  2⤵
  PID:5476
- C:\Windows\System\xRuSVZO.exe
  C:\Windows\System\xRuSVZO.exe
  2⤵
  PID:5896
- C:\Windows\System\ANMeLrJ.exe
  C:\Windows\System\ANMeLrJ.exe
  2⤵
  PID:6136
- C:\Windows\System\UBcnrPh.exe
  C:\Windows\System\UBcnrPh.exe
  2⤵
  PID:5828
- C:\Windows\System\GnpdBmZ.exe
  C:\Windows\System\GnpdBmZ.exe
  2⤵
  PID:6148
- C:\Windows\System\SqnCfnj.exe
  C:\Windows\System\SqnCfnj.exe
  2⤵
  PID:6172
- C:\Windows\System\xocphju.exe
  C:\Windows\System\xocphju.exe
  2⤵
  PID:6204
- C:\Windows\System\RPKnNne.exe
  C:\Windows\System\RPKnNne.exe
  2⤵
  PID:6232
- C:\Windows\System\yTBVwpj.exe
  C:\Windows\System\yTBVwpj.exe
  2⤵
  PID:6260
- C:\Windows\System\NfJEGoN.exe
  C:\Windows\System\NfJEGoN.exe
  2⤵
  PID:6276
- C:\Windows\System\FfZwdBd.exe
  C:\Windows\System\FfZwdBd.exe
  2⤵
  PID:6292
- C:\Windows\System\eUmnTJf.exe
  C:\Windows\System\eUmnTJf.exe
  2⤵
  PID:6312
- C:\Windows\System\YRIhvqc.exe
  C:\Windows\System\YRIhvqc.exe
  2⤵
  PID:6348
- C:\Windows\System\BJPqsXn.exe
  C:\Windows\System\BJPqsXn.exe
  2⤵
  PID:6388
- C:\Windows\System\AGeuPyx.exe
  C:\Windows\System\AGeuPyx.exe
  2⤵
  PID:6416
- C:\Windows\System\TVvkJMO.exe
  C:\Windows\System\TVvkJMO.exe
  2⤵
  PID:6448
- C:\Windows\System\UtCnPLq.exe
  C:\Windows\System\UtCnPLq.exe
  2⤵
  PID:6488
- C:\Windows\System\cyTCTJV.exe
  C:\Windows\System\cyTCTJV.exe
  2⤵
  PID:6516
- C:\Windows\System\TsaIoPw.exe
  C:\Windows\System\TsaIoPw.exe
  2⤵
  PID:6548
- C:\Windows\System\KkDMOQQ.exe
  C:\Windows\System\KkDMOQQ.exe
  2⤵
  PID:6572
- C:\Windows\System\jqlhfBm.exe
  C:\Windows\System\jqlhfBm.exe
  2⤵
  PID:6600
- C:\Windows\System\sjVKzSn.exe
  C:\Windows\System\sjVKzSn.exe
  2⤵
  PID:6628
- C:\Windows\System\iWXqwjf.exe
  C:\Windows\System\iWXqwjf.exe
  2⤵
  PID:6656
- C:\Windows\System\uIfbqsg.exe
  C:\Windows\System\uIfbqsg.exe
  2⤵
  PID:6684
- C:\Windows\System\cLRrPIN.exe
  C:\Windows\System\cLRrPIN.exe
  2⤵
  PID:6700
- C:\Windows\System\ZbNZHic.exe
  C:\Windows\System\ZbNZHic.exe
  2⤵
  PID:6728
- C:\Windows\System\HsorYEb.exe
  C:\Windows\System\HsorYEb.exe
  2⤵
  PID:6744
- C:\Windows\System\pAIPdtj.exe
  C:\Windows\System\pAIPdtj.exe
  2⤵
  PID:6760
- C:\Windows\System\hIPeTEh.exe
  C:\Windows\System\hIPeTEh.exe
  2⤵
  PID:6792
- C:\Windows\System\qxqzReU.exe
  C:\Windows\System\qxqzReU.exe
  2⤵
  PID:6832
- C:\Windows\System\MswTrCL.exe
  C:\Windows\System\MswTrCL.exe
  2⤵
  PID:6860
- C:\Windows\System\FSSuWcI.exe
  C:\Windows\System\FSSuWcI.exe
  2⤵
  PID:6896
- C:\Windows\System\ACGcWOc.exe
  C:\Windows\System\ACGcWOc.exe
  2⤵
  PID:6920
- C:\Windows\System\hrokzhM.exe
  C:\Windows\System\hrokzhM.exe
  2⤵
  PID:6956
- C:\Windows\System\PCxkjfa.exe
  C:\Windows\System\PCxkjfa.exe
  2⤵
  PID:6980
- C:\Windows\System\nebQCzh.exe
  C:\Windows\System\nebQCzh.exe
  2⤵
  PID:7000
- C:\Windows\System\LnyNhhe.exe
  C:\Windows\System\LnyNhhe.exe
  2⤵
  PID:7020
- C:\Windows\System\npAwNMD.exe
  C:\Windows\System\npAwNMD.exe
  2⤵
  PID:7056
- C:\Windows\System\urrzAgp.exe
  C:\Windows\System\urrzAgp.exe
  2⤵
  PID:7092
- C:\Windows\System\FyuRpXK.exe
  C:\Windows\System\FyuRpXK.exe
  2⤵
  PID:7120
- C:\Windows\System\lkbBcGs.exe
  C:\Windows\System\lkbBcGs.exe
  2⤵
  PID:7160
- C:\Windows\System\ugKjAnx.exe
  C:\Windows\System\ugKjAnx.exe
  2⤵
  PID:6192
- C:\Windows\System\qXfTmVo.exe
  C:\Windows\System\qXfTmVo.exe
  2⤵
  PID:6252
- C:\Windows\System\ymRcDSn.exe
  C:\Windows\System\ymRcDSn.exe
  2⤵
  PID:6340
- C:\Windows\System\orZYVZR.exe
  C:\Windows\System\orZYVZR.exe
  2⤵
  PID:6412
- C:\Windows\System\ZsUXgMw.exe
  C:\Windows\System\ZsUXgMw.exe
  2⤵
  PID:6476
- C:\Windows\System\CxlxRPj.exe
  C:\Windows\System\CxlxRPj.exe
  2⤵
  PID:6536
- C:\Windows\System\tAZemTy.exe
  C:\Windows\System\tAZemTy.exe
  2⤵
  PID:6596
- C:\Windows\System\Ipytypx.exe
  C:\Windows\System\Ipytypx.exe
  2⤵
  PID:6668
- C:\Windows\System\FAlbcnY.exe
  C:\Windows\System\FAlbcnY.exe
  2⤵
  PID:6720
- C:\Windows\System\NfsSaob.exe
  C:\Windows\System\NfsSaob.exe
  2⤵
  PID:6812
- C:\Windows\System\GwpcHER.exe
  C:\Windows\System\GwpcHER.exe
  2⤵
  PID:6868
- C:\Windows\System\SikqCZr.exe
  C:\Windows\System\SikqCZr.exe
  2⤵
  PID:6916
- C:\Windows\System\oWuhbhZ.exe
  C:\Windows\System\oWuhbhZ.exe
  2⤵
  PID:6976
- C:\Windows\System\MFejKzT.exe
  C:\Windows\System\MFejKzT.exe
  2⤵
  PID:7040
- C:\Windows\System\cLlhMYr.exe
  C:\Windows\System\cLlhMYr.exe
  2⤵
  PID:7116
- C:\Windows\System\hBNwPMJ.exe
  C:\Windows\System\hBNwPMJ.exe
  2⤵
  PID:6180
- C:\Windows\System\gSorzxv.exe
  C:\Windows\System\gSorzxv.exe
  2⤵
  PID:6336
- C:\Windows\System\ewYmKqK.exe
  C:\Windows\System\ewYmKqK.exe
  2⤵
  PID:6528
- C:\Windows\System\kPXSwSk.exe
  C:\Windows\System\kPXSwSk.exe
  2⤵
  PID:6756
- C:\Windows\System\pMAKsMy.exe
  C:\Windows\System\pMAKsMy.exe
  2⤵
  PID:6912
- C:\Windows\System\KiXbANj.exe
  C:\Windows\System\KiXbANj.exe
  2⤵
  PID:7156
- C:\Windows\System\vGbbgoq.exe
  C:\Windows\System\vGbbgoq.exe
  2⤵
  PID:6440
- C:\Windows\System\pqtJUjj.exe
  C:\Windows\System\pqtJUjj.exe
  2⤵
  PID:7016
- C:\Windows\System\hZEitJO.exe
  C:\Windows\System\hZEitJO.exe
  2⤵
  PID:6376
- C:\Windows\System\LhZFrbB.exe
  C:\Windows\System\LhZFrbB.exe
  2⤵
  PID:7184
- C:\Windows\System\mNvpQFb.exe
  C:\Windows\System\mNvpQFb.exe
  2⤵
  PID:7212
- C:\Windows\System\cKcMnxZ.exe
  C:\Windows\System\cKcMnxZ.exe
  2⤵
  PID:7240
- C:\Windows\System\gxKrtWp.exe
  C:\Windows\System\gxKrtWp.exe
  2⤵
  PID:7268
- C:\Windows\System\jdeMEWD.exe
  C:\Windows\System\jdeMEWD.exe
  2⤵
  PID:7296
- C:\Windows\System\MgaojYS.exe
  C:\Windows\System\MgaojYS.exe
  2⤵
  PID:7328
- C:\Windows\System\cddtcNa.exe
  C:\Windows\System\cddtcNa.exe
  2⤵
  PID:7356
- C:\Windows\System\vRVXXRu.exe
  C:\Windows\System\vRVXXRu.exe
  2⤵
  PID:7384
- C:\Windows\System\EZHuTaj.exe
  C:\Windows\System\EZHuTaj.exe
  2⤵
  PID:7404
- C:\Windows\System\vvcGeVo.exe
  C:\Windows\System\vvcGeVo.exe
  2⤵
  PID:7440
- C:\Windows\System\ANHjEBu.exe
  C:\Windows\System\ANHjEBu.exe
  2⤵
  PID:7468
- C:\Windows\System\fRsxZVC.exe
  C:\Windows\System\fRsxZVC.exe
  2⤵
  PID:7496
- C:\Windows\System\QtLkaNx.exe
  C:\Windows\System\QtLkaNx.exe
  2⤵
  PID:7524
- C:\Windows\System\zqMzLCc.exe
  C:\Windows\System\zqMzLCc.exe
  2⤵
  PID:7540
- C:\Windows\System\ylwAMdC.exe
  C:\Windows\System\ylwAMdC.exe
  2⤵
  PID:7560
- C:\Windows\System\chNAxfZ.exe
  C:\Windows\System\chNAxfZ.exe
  2⤵
  PID:7588
- C:\Windows\System\URrhJuL.exe
  C:\Windows\System\URrhJuL.exe
  2⤵
  PID:7612
- C:\Windows\System\pbQMsts.exe
  C:\Windows\System\pbQMsts.exe
  2⤵
  PID:7644
- C:\Windows\System\YTHsHgs.exe
  C:\Windows\System\YTHsHgs.exe
  2⤵
  PID:7672
- C:\Windows\System\IBIRmiM.exe
  C:\Windows\System\IBIRmiM.exe
  2⤵
  PID:7712
- C:\Windows\System\tpGMyYn.exe
  C:\Windows\System\tpGMyYn.exe
  2⤵
  PID:7748
- C:\Windows\System\sYOVdrq.exe
  C:\Windows\System\sYOVdrq.exe
  2⤵
  PID:7772
- C:\Windows\System\ghvyLGJ.exe
  C:\Windows\System\ghvyLGJ.exe
  2⤵
  PID:7796
- C:\Windows\System\FRbdlrV.exe
  C:\Windows\System\FRbdlrV.exe
  2⤵
  PID:7824
- C:\Windows\System\mREgBVG.exe
  C:\Windows\System\mREgBVG.exe
  2⤵
  PID:7856
- C:\Windows\System\uUtfBRH.exe
  C:\Windows\System\uUtfBRH.exe
  2⤵
  PID:7884
- C:\Windows\System\cBxxKqn.exe
  C:\Windows\System\cBxxKqn.exe
  2⤵
  PID:7916
- C:\Windows\System\PftXWUO.exe
  C:\Windows\System\PftXWUO.exe
  2⤵
  PID:7944
- C:\Windows\System\iwllHMM.exe
  C:\Windows\System\iwllHMM.exe
  2⤵
  PID:7980
- C:\Windows\System\ZkIxEzV.exe
  C:\Windows\System\ZkIxEzV.exe
  2⤵
  PID:8000
- C:\Windows\System\iMXLFli.exe
  C:\Windows\System\iMXLFli.exe
  2⤵
  PID:8024
- C:\Windows\System\wJKdmtf.exe
  C:\Windows\System\wJKdmtf.exe
  2⤵
  PID:8040
- C:\Windows\System\FmeVLjn.exe
  C:\Windows\System\FmeVLjn.exe
  2⤵
  PID:8072
- C:\Windows\System\YePOwCB.exe
  C:\Windows\System\YePOwCB.exe
  2⤵
  PID:8100
- C:\Windows\System\JgzcqnB.exe
  C:\Windows\System\JgzcqnB.exe
  2⤵
  PID:8136
- C:\Windows\System\lERtctW.exe
  C:\Windows\System\lERtctW.exe
  2⤵
  PID:8152
- C:\Windows\System\VqojcCR.exe
  C:\Windows\System\VqojcCR.exe
  2⤵
  PID:8184
- C:\Windows\System\rqDUshl.exe
  C:\Windows\System\rqDUshl.exe
  2⤵
  PID:7208
- C:\Windows\System\jJJDRPA.exe
  C:\Windows\System\jJJDRPA.exe
  2⤵
  PID:7292
- C:\Windows\System\xnipWoj.exe
  C:\Windows\System\xnipWoj.exe
  2⤵
  PID:7352
- C:\Windows\System\UAQSaIk.exe
  C:\Windows\System\UAQSaIk.exe
  2⤵
  PID:7436
- C:\Windows\System\oODSkVl.exe
  C:\Windows\System\oODSkVl.exe
  2⤵
  PID:7492
- C:\Windows\System\AhqFhev.exe
  C:\Windows\System\AhqFhev.exe
  2⤵
  PID:7568
- C:\Windows\System\rkBFXvP.exe
  C:\Windows\System\rkBFXvP.exe
  2⤵
  PID:7636
- C:\Windows\System\voLAboH.exe
  C:\Windows\System\voLAboH.exe
  2⤵
  PID:7696
- C:\Windows\System\lqMKSlf.exe
  C:\Windows\System\lqMKSlf.exe
  2⤵
  PID:7704
- C:\Windows\System\SDIIzwV.exe
  C:\Windows\System\SDIIzwV.exe
  2⤵
  PID:7848
- C:\Windows\System\xcmsalW.exe
  C:\Windows\System\xcmsalW.exe
  2⤵
  PID:7912
- C:\Windows\System\OqCQIoZ.exe
  C:\Windows\System\OqCQIoZ.exe
  2⤵
  PID:7956
- C:\Windows\System\GfFAdCa.exe
  C:\Windows\System\GfFAdCa.exe
  2⤵
  PID:8036
- C:\Windows\System\nulqLCZ.exe
  C:\Windows\System\nulqLCZ.exe
  2⤵
  PID:8116
- C:\Windows\System\IwVInWX.exe
  C:\Windows\System\IwVInWX.exe
  2⤵
  PID:8172
- C:\Windows\System\tKYzwCj.exe
  C:\Windows\System\tKYzwCj.exe
  2⤵
  PID:7196
- C:\Windows\System\SqGIerh.exe
  C:\Windows\System\SqGIerh.exe
  2⤵
  PID:7320
- C:\Windows\System\lmFzZDh.exe
  C:\Windows\System\lmFzZDh.exe
  2⤵
  PID:7520
- C:\Windows\System\gPLFVdl.exe
  C:\Windows\System\gPLFVdl.exe
  2⤵
  PID:7668
- C:\Windows\System\dteSaWW.exe
  C:\Windows\System\dteSaWW.exe
  2⤵
  PID:7768
- C:\Windows\System\pqrCUyg.exe
  C:\Windows\System\pqrCUyg.exe
  2⤵
  PID:8008
- C:\Windows\System\wvVgWvG.exe
  C:\Windows\System\wvVgWvG.exe
  2⤵
  PID:8148
- C:\Windows\System\WBiooWQ.exe
  C:\Windows\System\WBiooWQ.exe
  2⤵
  PID:7464
- C:\Windows\System\UmZNRUz.exe
  C:\Windows\System\UmZNRUz.exe
  2⤵
  PID:7812
- C:\Windows\System\QHbtTvV.exe
  C:\Windows\System\QHbtTvV.exe
  2⤵
  PID:7280
- C:\Windows\System\oQIHSYI.exe
  C:\Windows\System\oQIHSYI.exe
  2⤵
  PID:8212
- C:\Windows\System\BeJAHDT.exe
  C:\Windows\System\BeJAHDT.exe
  2⤵
  PID:8248
- C:\Windows\System\UgxEmhq.exe
  C:\Windows\System\UgxEmhq.exe
  2⤵
  PID:8288
- C:\Windows\System\dKhOJZy.exe
  C:\Windows\System\dKhOJZy.exe
  2⤵
  PID:8316
- C:\Windows\System\KoXEOre.exe
  C:\Windows\System\KoXEOre.exe
  2⤵
  PID:8348
- C:\Windows\System\IiDhLyY.exe
  C:\Windows\System\IiDhLyY.exe
  2⤵
  PID:8380
- C:\Windows\System\ltzAFYL.exe
  C:\Windows\System\ltzAFYL.exe
  2⤵
  PID:8416
- C:\Windows\System\XBYXZRh.exe
  C:\Windows\System\XBYXZRh.exe
  2⤵
  PID:8444
- C:\Windows\System\WtgHMaF.exe
  C:\Windows\System\WtgHMaF.exe
  2⤵
  PID:8480
- C:\Windows\System\dAvOxsp.exe
  C:\Windows\System\dAvOxsp.exe
  2⤵
  PID:8524
- C:\Windows\System\WuQQmdY.exe
  C:\Windows\System\WuQQmdY.exe
  2⤵
  PID:8560
- C:\Windows\System\CQsulYT.exe
  C:\Windows\System\CQsulYT.exe
  2⤵
  PID:8596
- C:\Windows\System\HXaRftI.exe
  C:\Windows\System\HXaRftI.exe
  2⤵
  PID:8620
- C:\Windows\System\uLlSgxZ.exe
  C:\Windows\System\uLlSgxZ.exe
  2⤵
  PID:8652
- C:\Windows\System\BphDINM.exe
  C:\Windows\System\BphDINM.exe
  2⤵
  PID:8676
- C:\Windows\System\pFHkVXF.exe
  C:\Windows\System\pFHkVXF.exe
  2⤵
  PID:8716
- C:\Windows\System\hMYxggY.exe
  C:\Windows\System\hMYxggY.exe
  2⤵
  PID:8752
- C:\Windows\System\KiGMSqU.exe
  C:\Windows\System\KiGMSqU.exe
  2⤵
  PID:8780
- C:\Windows\System\bvPooHv.exe
  C:\Windows\System\bvPooHv.exe
  2⤵
  PID:8812
- C:\Windows\System\UHEeLRn.exe
  C:\Windows\System\UHEeLRn.exe
  2⤵
  PID:8844
- C:\Windows\System\omyWTXU.exe
  C:\Windows\System\omyWTXU.exe
  2⤵
  PID:8876
- C:\Windows\System\gvHpWzn.exe
  C:\Windows\System\gvHpWzn.exe
  2⤵
  PID:8900
- C:\Windows\System\qnIXUsP.exe
  C:\Windows\System\qnIXUsP.exe
  2⤵
  PID:8936
- C:\Windows\System\IEMookb.exe
  C:\Windows\System\IEMookb.exe
  2⤵
  PID:8968
- C:\Windows\System\oiDoAgf.exe
  C:\Windows\System\oiDoAgf.exe
  2⤵
  PID:8996
- C:\Windows\System\DjUwyCN.exe
  C:\Windows\System\DjUwyCN.exe
  2⤵
  PID:9028
- C:\Windows\System\PuiXNMu.exe
  C:\Windows\System\PuiXNMu.exe
  2⤵
  PID:9056
- C:\Windows\System\WKlEcdg.exe
  C:\Windows\System\WKlEcdg.exe
  2⤵
  PID:9080
- C:\Windows\System\gHLkRGr.exe
  C:\Windows\System\gHLkRGr.exe
  2⤵
  PID:9104
- C:\Windows\System\MVGMSIl.exe
  C:\Windows\System\MVGMSIl.exe
  2⤵
  PID:9136
- C:\Windows\System\TYlRjAw.exe
  C:\Windows\System\TYlRjAw.exe
  2⤵
  PID:9164
- C:\Windows\System\aCcfnQV.exe
  C:\Windows\System\aCcfnQV.exe
  2⤵
  PID:9200
- C:\Windows\System\KCQfyyb.exe
  C:\Windows\System\KCQfyyb.exe
  2⤵
  PID:8196
- C:\Windows\System\oQtMsKW.exe
  C:\Windows\System\oQtMsKW.exe
  2⤵
  PID:8284
- C:\Windows\System\AYAysJX.exe
  C:\Windows\System\AYAysJX.exe
  2⤵
  PID:8412
- C:\Windows\System\trYWozD.exe
  C:\Windows\System\trYWozD.exe
  2⤵
  PID:8408
- C:\Windows\System\qCsmUde.exe
  C:\Windows\System\qCsmUde.exe
  2⤵
  PID:8496
- C:\Windows\System\XhcVZej.exe
  C:\Windows\System\XhcVZej.exe
  2⤵
  PID:8544
- C:\Windows\System\fYywaXf.exe
  C:\Windows\System\fYywaXf.exe
  2⤵
  PID:8604
- C:\Windows\System\zHEpuLz.exe
  C:\Windows\System\zHEpuLz.exe
  2⤵
  PID:8660
- C:\Windows\System\RnQsOzP.exe
  C:\Windows\System\RnQsOzP.exe
  2⤵
  PID:8708
- C:\Windows\System\WazDgQe.exe
  C:\Windows\System\WazDgQe.exe
  2⤵
  PID:8768
- C:\Windows\System\hCNzJhK.exe
  C:\Windows\System\hCNzJhK.exe
  2⤵
  PID:8896
- C:\Windows\System\HVsPljd.exe
  C:\Windows\System\HVsPljd.exe
  2⤵
  PID:9004
- C:\Windows\System\IFavaho.exe
  C:\Windows\System\IFavaho.exe
  2⤵
  PID:9068
- C:\Windows\System\BzSlnxv.exe
  C:\Windows\System\BzSlnxv.exe
  2⤵
  PID:9120
- C:\Windows\System\iFZacZB.exe
  C:\Windows\System\iFZacZB.exe
  2⤵
  PID:9212
- C:\Windows\System\DLXmwYd.exe
  C:\Windows\System\DLXmwYd.exe
  2⤵
  PID:8368
- C:\Windows\System\OlmOKXm.exe
  C:\Windows\System\OlmOKXm.exe
  2⤵
  PID:8472
- C:\Windows\System\rjgwcDD.exe
  C:\Windows\System\rjgwcDD.exe
  2⤵
  PID:8636
- C:\Windows\System\TLUhSqE.exe
  C:\Windows\System\TLUhSqE.exe
  2⤵
  PID:8964
- C:\Windows\System\MjAYUgW.exe
  C:\Windows\System\MjAYUgW.exe
  2⤵
  PID:9184
- C:\Windows\System\eCnXeSw.exe
  C:\Windows\System\eCnXeSw.exe
  2⤵
  PID:8740
- C:\Windows\System\SZeSmoK.exe
  C:\Windows\System\SZeSmoK.exe
  2⤵
  PID:8956
- C:\Windows\System\DqXnsdh.exe
  C:\Windows\System\DqXnsdh.exe
  2⤵
  PID:8824
- C:\Windows\System\ECSNcEJ.exe
  C:\Windows\System\ECSNcEJ.exe
  2⤵
  PID:9240
- C:\Windows\System\hgVxvYM.exe
  C:\Windows\System\hgVxvYM.exe
  2⤵
  PID:9272
- C:\Windows\System\BRzjVdt.exe
  C:\Windows\System\BRzjVdt.exe
  2⤵
  PID:9300
- C:\Windows\System\VLRBXLz.exe
  C:\Windows\System\VLRBXLz.exe
  2⤵
  PID:9332
- C:\Windows\System\CektBlH.exe
  C:\Windows\System\CektBlH.exe
  2⤵
  PID:9356
- C:\Windows\System\xXkAjKF.exe
  C:\Windows\System\xXkAjKF.exe
  2⤵
  PID:9384
- C:\Windows\System\zMDghRk.exe
  C:\Windows\System\zMDghRk.exe
  2⤵
  PID:9412
- C:\Windows\System\XGdHlFj.exe
  C:\Windows\System\XGdHlFj.exe
  2⤵
  PID:9448
- C:\Windows\System\RDXKSyu.exe
  C:\Windows\System\RDXKSyu.exe
  2⤵
  PID:9476
- C:\Windows\System\qRmVBuD.exe
  C:\Windows\System\qRmVBuD.exe
  2⤵
  PID:9508
- C:\Windows\System\iHYbPAo.exe
  C:\Windows\System\iHYbPAo.exe
  2⤵
  PID:9532
- C:\Windows\System\MytzKIt.exe
  C:\Windows\System\MytzKIt.exe
  2⤵
  PID:9556
- C:\Windows\System\xjQdIcI.exe
  C:\Windows\System\xjQdIcI.exe
  2⤵
  PID:9576
- C:\Windows\System\QTbMUTK.exe
  C:\Windows\System\QTbMUTK.exe
  2⤵
  PID:9608
- C:\Windows\System\PRcnurx.exe
  C:\Windows\System\PRcnurx.exe
  2⤵
  PID:9644
- C:\Windows\System\gFiKYMH.exe
  C:\Windows\System\gFiKYMH.exe
  2⤵
  PID:9664
- C:\Windows\System\VqeSNzq.exe
  C:\Windows\System\VqeSNzq.exe
  2⤵
  PID:9700
- C:\Windows\System\roTQOJW.exe
  C:\Windows\System\roTQOJW.exe
  2⤵
  PID:9728
- C:\Windows\System\EwHCLFl.exe
  C:\Windows\System\EwHCLFl.exe
  2⤵
  PID:9756
- C:\Windows\System\LKeyZwi.exe
  C:\Windows\System\LKeyZwi.exe
  2⤵
  PID:9784
- C:\Windows\System\uaPcABZ.exe
  C:\Windows\System\uaPcABZ.exe
  2⤵
  PID:9812
- C:\Windows\System\XlnwGTa.exe
  C:\Windows\System\XlnwGTa.exe
  2⤵
  PID:9840
- C:\Windows\System\HExdUSS.exe
  C:\Windows\System\HExdUSS.exe
  2⤵
  PID:9872
- C:\Windows\System\qnGFiwv.exe
  C:\Windows\System\qnGFiwv.exe
  2⤵
  PID:9896
- C:\Windows\System\mjPgHNv.exe
  C:\Windows\System\mjPgHNv.exe
  2⤵
  PID:9928
- C:\Windows\System\fldYlbg.exe
  C:\Windows\System\fldYlbg.exe
  2⤵
  PID:9960
- C:\Windows\System\EUYhiwj.exe
  C:\Windows\System\EUYhiwj.exe
  2⤵
  PID:9980
- C:\Windows\System\ZnXHstt.exe
  C:\Windows\System\ZnXHstt.exe
  2⤵
  PID:10016
- C:\Windows\System\lrmxdPf.exe
  C:\Windows\System\lrmxdPf.exe
  2⤵
  PID:10048
- C:\Windows\System\pmgNKlL.exe
  C:\Windows\System\pmgNKlL.exe
  2⤵
  PID:10084
- C:\Windows\System\XPakntI.exe
  C:\Windows\System\XPakntI.exe
  2⤵
  PID:10112
- C:\Windows\System\NtwkKDQ.exe
  C:\Windows\System\NtwkKDQ.exe
  2⤵
  PID:10136
- C:\Windows\System\XXyncBf.exe
  C:\Windows\System\XXyncBf.exe
  2⤵
  PID:10164
- C:\Windows\System\sUHyHbT.exe
  C:\Windows\System\sUHyHbT.exe
  2⤵
  PID:10196
- C:\Windows\System\jGXtWLm.exe
  C:\Windows\System\jGXtWLm.exe
  2⤵
  PID:10220
- C:\Windows\System\bJBZarY.exe
  C:\Windows\System\bJBZarY.exe
  2⤵
  PID:9224
- C:\Windows\System\UDQzizN.exe
  C:\Windows\System\UDQzizN.exe
  2⤵
  PID:9288
- C:\Windows\System\lOMwoJM.exe
  C:\Windows\System\lOMwoJM.exe
  2⤵
  PID:9364
- C:\Windows\System\gyQdEhN.exe
  C:\Windows\System\gyQdEhN.exe
  2⤵
  PID:9432
- C:\Windows\System\dgYTnLU.exe
  C:\Windows\System\dgYTnLU.exe
  2⤵
  PID:9472
- C:\Windows\System\DnQoHFo.exe
  C:\Windows\System\DnQoHFo.exe
  2⤵
  PID:9520
- C:\Windows\System\OKAzfsd.exe
  C:\Windows\System\OKAzfsd.exe
  2⤵
  PID:9640
- C:\Windows\System\CgRZSrp.exe
  C:\Windows\System\CgRZSrp.exe
  2⤵
  PID:9628
- C:\Windows\System\KpOrGxq.exe
  C:\Windows\System\KpOrGxq.exe
  2⤵
  PID:9716
- C:\Windows\System\gNaLPEe.exe
  C:\Windows\System\gNaLPEe.exe
  2⤵
  PID:9740
- C:\Windows\System\TRQWCGj.exe
  C:\Windows\System\TRQWCGj.exe
  2⤵
  PID:9804
- C:\Windows\System\cHEEyjD.exe
  C:\Windows\System\cHEEyjD.exe
  2⤵
  PID:9904
- C:\Windows\System\HnWzDap.exe
  C:\Windows\System\HnWzDap.exe
  2⤵
  PID:9976
- C:\Windows\System\HuoJcWS.exe
  C:\Windows\System\HuoJcWS.exe
  2⤵
  PID:10068
- C:\Windows\System\ifrdgQN.exe
  C:\Windows\System\ifrdgQN.exe
  2⤵
  PID:10156
- C:\Windows\System\zKDDBbe.exe
  C:\Windows\System\zKDDBbe.exe
  2⤵
  PID:10180
- C:\Windows\System\yPHxiyh.exe
  C:\Windows\System\yPHxiyh.exe
  2⤵
  PID:9236
- C:\Windows\System\QZMxNoy.exe
  C:\Windows\System\QZMxNoy.exe
  2⤵
  PID:9380
- C:\Windows\System\UqVbPCM.exe
  C:\Windows\System\UqVbPCM.exe
  2⤵
  PID:9548
- C:\Windows\System\uyLwQwF.exe
  C:\Windows\System\uyLwQwF.exe
  2⤵
  PID:9652
- C:\Windows\System\qHYuRyg.exe
  C:\Windows\System\qHYuRyg.exe
  2⤵
  PID:9828
- C:\Windows\System\kJmqfMp.exe
  C:\Windows\System\kJmqfMp.exe
  2⤵
  PID:9908
- C:\Windows\System\yltglWB.exe
  C:\Windows\System\yltglWB.exe
  2⤵
  PID:10100
- C:\Windows\System\aXISqwg.exe
  C:\Windows\System\aXISqwg.exe
  2⤵
  PID:10216
- C:\Windows\System\yDOyopJ.exe
  C:\Windows\System\yDOyopJ.exe
  2⤵
  PID:9572
- C:\Windows\System\fkluaIp.exe
  C:\Windows\System\fkluaIp.exe
  2⤵
  PID:10056
- C:\Windows\System\tWjFZNE.exe
  C:\Windows\System\tWjFZNE.exe
  2⤵
  PID:10212
- C:\Windows\System\SkwrCyG.exe
  C:\Windows\System\SkwrCyG.exe
  2⤵
  PID:10256
- C:\Windows\System\qDcNfgL.exe
  C:\Windows\System\qDcNfgL.exe
  2⤵
  PID:10288
- C:\Windows\System\pcrZmmg.exe
  C:\Windows\System\pcrZmmg.exe
  2⤵
  PID:10312
- C:\Windows\System\FodnKpl.exe
  C:\Windows\System\FodnKpl.exe
  2⤵
  PID:10328
- C:\Windows\System\HBJbtPe.exe
  C:\Windows\System\HBJbtPe.exe
  2⤵
  PID:10348
- C:\Windows\System\cTULsFK.exe
  C:\Windows\System\cTULsFK.exe
  2⤵
  PID:10376
- C:\Windows\System\wWQIxOu.exe
  C:\Windows\System\wWQIxOu.exe
  2⤵
  PID:10404
- C:\Windows\System\GoaJLAb.exe
  C:\Windows\System\GoaJLAb.exe
  2⤵
  PID:10436
- C:\Windows\System\XuRxfMN.exe
  C:\Windows\System\XuRxfMN.exe
  2⤵
  PID:10472
- C:\Windows\System\kXDsxiD.exe
  C:\Windows\System\kXDsxiD.exe
  2⤵
  PID:10496
- C:\Windows\System\sNDDyKV.exe
  C:\Windows\System\sNDDyKV.exe
  2⤵
  PID:10528
- C:\Windows\System\DoCfhcx.exe
  C:\Windows\System\DoCfhcx.exe
  2⤵
  PID:10552
- C:\Windows\System\ZZCByTp.exe
  C:\Windows\System\ZZCByTp.exe
  2⤵
  PID:10584
- C:\Windows\System\UyFuWkv.exe
  C:\Windows\System\UyFuWkv.exe
  2⤵
  PID:10620
- C:\Windows\System\CtCxDar.exe
  C:\Windows\System\CtCxDar.exe
  2⤵
  PID:10648
- C:\Windows\System\AeyjCBz.exe
  C:\Windows\System\AeyjCBz.exe
  2⤵
  PID:10676
- C:\Windows\System\GHyYWFn.exe
  C:\Windows\System\GHyYWFn.exe
  2⤵
  PID:10720
- C:\Windows\System\ZKfVTTb.exe
  C:\Windows\System\ZKfVTTb.exe
  2⤵
  PID:10744
- C:\Windows\System\GRxoOCR.exe
  C:\Windows\System\GRxoOCR.exe
  2⤵
  PID:10772
- C:\Windows\System\kOKcMsl.exe
  C:\Windows\System\kOKcMsl.exe
  2⤵
  PID:10816
- C:\Windows\System\UQmpfxM.exe
  C:\Windows\System\UQmpfxM.exe
  2⤵
  PID:10836
- C:\Windows\System\LEUzaYj.exe
  C:\Windows\System\LEUzaYj.exe
  2⤵
  PID:10856
- C:\Windows\System\DYHjpqM.exe
  C:\Windows\System\DYHjpqM.exe
  2⤵
  PID:10892
- C:\Windows\System\gAHhAvB.exe
  C:\Windows\System\gAHhAvB.exe
  2⤵
  PID:10916
- C:\Windows\System\oIONOPB.exe
  C:\Windows\System\oIONOPB.exe
  2⤵
  PID:10944
- C:\Windows\System\RJkDeWy.exe
  C:\Windows\System\RJkDeWy.exe
  2⤵
  PID:10972
- C:\Windows\System\HbWEDXY.exe
  C:\Windows\System\HbWEDXY.exe
  2⤵
  PID:11000
- C:\Windows\System\TlekDau.exe
  C:\Windows\System\TlekDau.exe
  2⤵
  PID:11020
- C:\Windows\System\UGloFku.exe
  C:\Windows\System\UGloFku.exe
  2⤵
  PID:11072
- C:\Windows\System\yynSqYF.exe
  C:\Windows\System\yynSqYF.exe
  2⤵
  PID:11104
- C:\Windows\System\SQntOxO.exe
  C:\Windows\System\SQntOxO.exe
  2⤵
  PID:11128
- C:\Windows\System\fWjWodH.exe
  C:\Windows\System\fWjWodH.exe
  2⤵
  PID:11156
- C:\Windows\System\txWjxov.exe
  C:\Windows\System\txWjxov.exe
  2⤵
  PID:11176
- C:\Windows\System\EdjzCQk.exe
  C:\Windows\System\EdjzCQk.exe
  2⤵
  PID:11204
- C:\Windows\System\CppVlbg.exe
  C:\Windows\System\CppVlbg.exe
  2⤵
  PID:11228
- C:\Windows\System\TafIaOK.exe
  C:\Windows\System\TafIaOK.exe
  2⤵
  PID:11248
- C:\Windows\System\DZUgxLW.exe
  C:\Windows\System\DZUgxLW.exe
  2⤵
  PID:10192
- C:\Windows\System\ibEXEbM.exe
  C:\Windows\System\ibEXEbM.exe
  2⤵
  PID:10308
- C:\Windows\System\uKEossa.exe
  C:\Windows\System\uKEossa.exe
  2⤵
  PID:10360
- C:\Windows\System\oZKLFuA.exe
  C:\Windows\System\oZKLFuA.exe
  2⤵
  PID:10428
- C:\Windows\System\YVexbLs.exe
  C:\Windows\System\YVexbLs.exe
  2⤵
  PID:10504
- C:\Windows\System\UBpKeto.exe
  C:\Windows\System\UBpKeto.exe
  2⤵
  PID:10616
- C:\Windows\System\KzExAEE.exe
  C:\Windows\System\KzExAEE.exe
  2⤵
  PID:10640
- C:\Windows\System\VwuWWjS.exe
  C:\Windows\System\VwuWWjS.exe
  2⤵
  PID:10668
- C:\Windows\System\lkbbbpp.exe
  C:\Windows\System\lkbbbpp.exe
  2⤵
  PID:10788
- C:\Windows\System\LFUTOtS.exe
  C:\Windows\System\LFUTOtS.exe
  2⤵
  PID:10808
- C:\Windows\System\YzzSFfY.exe
  C:\Windows\System\YzzSFfY.exe
  2⤵
  PID:10872
- C:\Windows\System\dpGvjqA.exe
  C:\Windows\System\dpGvjqA.exe
  2⤵
  PID:10912
- C:\Windows\System\IhjjlNZ.exe
  C:\Windows\System\IhjjlNZ.exe
  2⤵
  PID:11048
- C:\Windows\System\UTAXDUk.exe
  C:\Windows\System\UTAXDUk.exe
  2⤵
  PID:11116
- C:\Windows\System\ZFBNPNI.exe
  C:\Windows\System\ZFBNPNI.exe
  2⤵
  PID:11140
- C:\Windows\System\xOjNTqd.exe
  C:\Windows\System\xOjNTqd.exe
  2⤵
  PID:11200
- C:\Windows\System\qfUAZYF.exe
  C:\Windows\System\qfUAZYF.exe
  2⤵
  PID:10420
- C:\Windows\System\VfFuPlL.exe
  C:\Windows\System\VfFuPlL.exe
  2⤵
  PID:10392
- C:\Windows\System\WemVpbz.exe
  C:\Windows\System\WemVpbz.exe
  2⤵
  PID:10520
- C:\Windows\System\yoFtOSl.exe
  C:\Windows\System\yoFtOSl.exe
  2⤵
  PID:10828
- C:\Windows\System\yzbLiYu.exe
  C:\Windows\System\yzbLiYu.exe
  2⤵
  PID:10852
- C:\Windows\System\cBiAhZL.exe
  C:\Windows\System\cBiAhZL.exe
  2⤵
  PID:11120
- C:\Windows\System\UHRyMJD.exe
  C:\Windows\System\UHRyMJD.exe
  2⤵
  PID:11224
- C:\Windows\System\IUAVeSu.exe
  C:\Windows\System\IUAVeSu.exe
  2⤵
  PID:10356
- C:\Windows\System\Owdymft.exe
  C:\Windows\System\Owdymft.exe
  2⤵
  PID:11084
- C:\Windows\System\VpwaAUI.exe
  C:\Windows\System\VpwaAUI.exe
  2⤵
  PID:11292
- C:\Windows\System\nJYKjmp.exe
  C:\Windows\System\nJYKjmp.exe
  2⤵
  PID:11332
- C:\Windows\System\SruEmOE.exe
  C:\Windows\System\SruEmOE.exe
  2⤵
  PID:11360
- C:\Windows\System\KOZsnhU.exe
  C:\Windows\System\KOZsnhU.exe
  2⤵
  PID:11388
- C:\Windows\System\DNkZMwO.exe
  C:\Windows\System\DNkZMwO.exe
  2⤵
  PID:11420
- C:\Windows\System\lJnFqAs.exe
  C:\Windows\System\lJnFqAs.exe
  2⤵
  PID:11444
- C:\Windows\System\fClFrGl.exe
  C:\Windows\System\fClFrGl.exe
  2⤵
  PID:11472
- C:\Windows\System\rUFMUEO.exe
  C:\Windows\System\rUFMUEO.exe
  2⤵
  PID:11500
- C:\Windows\System\DzCRjfD.exe
  C:\Windows\System\DzCRjfD.exe
  2⤵
  PID:11528
- C:\Windows\System\GzRKEvZ.exe
  C:\Windows\System\GzRKEvZ.exe
  2⤵
  PID:11568
- C:\Windows\System\xlWQOdS.exe
  C:\Windows\System\xlWQOdS.exe
  2⤵
  PID:11584
- C:\Windows\System\qzjxSMB.exe
  C:\Windows\System\qzjxSMB.exe
  2⤵
  PID:11612
- C:\Windows\System\SQLyzQn.exe
  C:\Windows\System\SQLyzQn.exe
  2⤵
  PID:11640
- C:\Windows\System\HOjAcfb.exe
  C:\Windows\System\HOjAcfb.exe
  2⤵
  PID:11664
- C:\Windows\System\XCNomXs.exe
  C:\Windows\System\XCNomXs.exe
  2⤵
  PID:11696
- C:\Windows\System\gIhAJxr.exe
  C:\Windows\System\gIhAJxr.exe
  2⤵
  PID:11724
- C:\Windows\System\OpFoVYj.exe
  C:\Windows\System\OpFoVYj.exe
  2⤵
  PID:11752
- C:\Windows\System\ooazZme.exe
  C:\Windows\System\ooazZme.exe
  2⤵
  PID:11780
- C:\Windows\System\lmTTyOk.exe
  C:\Windows\System\lmTTyOk.exe
  2⤵
  PID:11796
- C:\Windows\System\jAztbzE.exe
  C:\Windows\System\jAztbzE.exe
  2⤵
  PID:11824
- C:\Windows\System\GIaeQAU.exe
  C:\Windows\System\GIaeQAU.exe
  2⤵
  PID:11840
- C:\Windows\System\RCfGYmu.exe
  C:\Windows\System\RCfGYmu.exe
  2⤵
  PID:11872
- C:\Windows\System\nfNJkky.exe
  C:\Windows\System\nfNJkky.exe
  2⤵
  PID:11904
- C:\Windows\System\ShyNHgE.exe
  C:\Windows\System\ShyNHgE.exe
  2⤵
  PID:11924
- C:\Windows\System\CleYYxN.exe
  C:\Windows\System\CleYYxN.exe
  2⤵
  PID:11944
- C:\Windows\System\tDSQuYb.exe
  C:\Windows\System\tDSQuYb.exe
  2⤵
  PID:11968
- C:\Windows\System\eUYbJDk.exe
  C:\Windows\System\eUYbJDk.exe
  2⤵
  PID:12000
- C:\Windows\System\QOfEQhz.exe
  C:\Windows\System\QOfEQhz.exe
  2⤵
  PID:12048
- C:\Windows\System\pXREZzN.exe
  C:\Windows\System\pXREZzN.exe
  2⤵
  PID:12092
- C:\Windows\System\CJZcMGr.exe
  C:\Windows\System\CJZcMGr.exe
  2⤵
  PID:12120
- C:\Windows\System\zTozjGW.exe
  C:\Windows\System\zTozjGW.exe
  2⤵
  PID:12148
- C:\Windows\System\tdwobOK.exe
  C:\Windows\System\tdwobOK.exe
  2⤵
  PID:12172
- C:\Windows\System\TLPkIQj.exe
  C:\Windows\System\TLPkIQj.exe
  2⤵
  PID:12220
- C:\Windows\System\ZGRsrdK.exe
  C:\Windows\System\ZGRsrdK.exe
  2⤵
  PID:12240
- C:\Windows\System\SfcEVYL.exe
  C:\Windows\System\SfcEVYL.exe
  2⤵
  PID:12264
- C:\Windows\System\yrOaFfl.exe
  C:\Windows\System\yrOaFfl.exe
  2⤵
  PID:10548
- C:\Windows\System\JtoDOEM.exe
  C:\Windows\System\JtoDOEM.exe
  2⤵
  PID:10928
- C:\Windows\System\cVTzwyo.exe
  C:\Windows\System\cVTzwyo.exe
  2⤵
  PID:11308
- C:\Windows\System\dSYZrmz.exe
  C:\Windows\System\dSYZrmz.exe
  2⤵
  PID:11372
- C:\Windows\System\RWnsYFH.exe
  C:\Windows\System\RWnsYFH.exe
  2⤵
  PID:11468
- C:\Windows\System\grjpUwK.exe
  C:\Windows\System\grjpUwK.exe
  2⤵
  PID:11516
- C:\Windows\System\JxyGhDH.exe
  C:\Windows\System\JxyGhDH.exe
  2⤵
  PID:11560
- C:\Windows\System\LVzfmKV.exe
  C:\Windows\System\LVzfmKV.exe
  2⤵
  PID:11652
- C:\Windows\System\eDrhGJZ.exe
  C:\Windows\System\eDrhGJZ.exe
  2⤵
  PID:11736
- C:\Windows\System\QrBjQBk.exe
  C:\Windows\System\QrBjQBk.exe
  2⤵
  PID:11808
- C:\Windows\System\YWlVWbr.exe
  C:\Windows\System\YWlVWbr.exe
  2⤵
  PID:11832
- C:\Windows\System\ONntyaI.exe
  C:\Windows\System\ONntyaI.exe
  2⤵
  PID:11916
- C:\Windows\System\xBEnfnA.exe
  C:\Windows\System\xBEnfnA.exe
  2⤵
  PID:11960
- C:\Windows\System\XDWrDtF.exe
  C:\Windows\System\XDWrDtF.exe
  2⤵
  PID:11980
- C:\Windows\System\ECenCcP.exe
  C:\Windows\System\ECenCcP.exe
  2⤵
  PID:12064
- C:\Windows\System\gBteftt.exe
  C:\Windows\System\gBteftt.exe
  2⤵
  PID:12164
- C:\Windows\System\PFTaUbp.exe
  C:\Windows\System\PFTaUbp.exe
  2⤵
  PID:12256
- C:\Windows\System\ynUcONC.exe
  C:\Windows\System\ynUcONC.exe
  2⤵
  PID:11152
- C:\Windows\System\vSRdcZp.exe
  C:\Windows\System\vSRdcZp.exe
  2⤵
  PID:11380
- C:\Windows\System\ocyCHgA.exe
  C:\Windows\System\ocyCHgA.exe
  2⤵
  PID:11604
- C:\Windows\System\GIcngsJ.exe
  C:\Windows\System\GIcngsJ.exe
  2⤵
  PID:11760
- C:\Windows\System\YVLCWci.exe
  C:\Windows\System\YVLCWci.exe
  2⤵
  PID:11868
- C:\Windows\System\QPKzTJA.exe
  C:\Windows\System\QPKzTJA.exe
  2⤵
  PID:11892
- C:\Windows\System\hiLIBxK.exe
  C:\Windows\System\hiLIBxK.exe
  2⤵
  PID:12128
- C:\Windows\System\ZCoipwc.exe
  C:\Windows\System\ZCoipwc.exe
  2⤵
  PID:11348
- C:\Windows\System\msdjXTT.exe
  C:\Windows\System\msdjXTT.exe
  2⤵
  PID:11580
- C:\Windows\System\LzFVxib.exe
  C:\Windows\System\LzFVxib.exe
  2⤵
  PID:11860
- C:\Windows\System\yKUuwmh.exe
  C:\Windows\System\yKUuwmh.exe
  2⤵
  PID:11932
- C:\Windows\System\cNODepf.exe
  C:\Windows\System\cNODepf.exe
  2⤵
  PID:12208
- C:\Windows\System\XSmKNYZ.exe
  C:\Windows\System\XSmKNYZ.exe
  2⤵
  PID:12292
- C:\Windows\System\YribTXR.exe
  C:\Windows\System\YribTXR.exe
  2⤵
  PID:12312
- C:\Windows\System\EYmGLqM.exe
  C:\Windows\System\EYmGLqM.exe
  2⤵
  PID:12348
- C:\Windows\System\tbrpxlx.exe
  C:\Windows\System\tbrpxlx.exe
  2⤵
  PID:12380
- C:\Windows\System\MvyKqcg.exe
  C:\Windows\System\MvyKqcg.exe
  2⤵
  PID:12408
- C:\Windows\System\lNARDDn.exe
  C:\Windows\System\lNARDDn.exe
  2⤵
  PID:12436
- C:\Windows\System\tMWeUxn.exe
  C:\Windows\System\tMWeUxn.exe
  2⤵
  PID:12464
- C:\Windows\System\bFToSon.exe
  C:\Windows\System\bFToSon.exe
  2⤵
  PID:12492
- C:\Windows\System\AxlTTWK.exe
  C:\Windows\System\AxlTTWK.exe
  2⤵
  PID:12524
- C:\Windows\System\nkoZeZA.exe
  C:\Windows\System\nkoZeZA.exe
  2⤵
  PID:12556
- C:\Windows\System\uATZJYx.exe
  C:\Windows\System\uATZJYx.exe
  2⤵
  PID:12596
- C:\Windows\System\wykdPVQ.exe
  C:\Windows\System\wykdPVQ.exe
  2⤵
  PID:12632
- C:\Windows\System\kGidhOL.exe
  C:\Windows\System\kGidhOL.exe
  2⤵
  PID:12660
- C:\Windows\System\JKswDUH.exe
  C:\Windows\System\JKswDUH.exe
  2⤵
  PID:12688
- C:\Windows\System\LuklAvG.exe
  C:\Windows\System\LuklAvG.exe
  2⤵
  PID:12720
- C:\Windows\System\BbDQSuc.exe
  C:\Windows\System\BbDQSuc.exe
  2⤵
  PID:12744
- C:\Windows\System\caVaAlt.exe
  C:\Windows\System\caVaAlt.exe
  2⤵
  PID:12772
- C:\Windows\System\EjcShJs.exe
  C:\Windows\System\EjcShJs.exe
  2⤵
  PID:12796
- C:\Windows\System\XOGoCGB.exe
  C:\Windows\System\XOGoCGB.exe
  2⤵
  PID:12840
- C:\Windows\System\EPxJluI.exe
  C:\Windows\System\EPxJluI.exe
  2⤵
  PID:12856
- C:\Windows\System\ZTvFZcM.exe
  C:\Windows\System\ZTvFZcM.exe
  2⤵
  PID:12884
- C:\Windows\System\tLeDDKB.exe
  C:\Windows\System\tLeDDKB.exe
  2⤵
  PID:12912
- C:\Windows\System\VuBJQgu.exe
  C:\Windows\System\VuBJQgu.exe
  2⤵
  PID:12952
- C:\Windows\System\cnZKCtc.exe
  C:\Windows\System\cnZKCtc.exe
  2⤵
  PID:12992
- C:\Windows\System\AcQZLGa.exe
  C:\Windows\System\AcQZLGa.exe
  2⤵
  PID:13008
- C:\Windows\System\cqzneeS.exe
  C:\Windows\System\cqzneeS.exe
  2⤵
  PID:13036
- C:\Windows\System\xAffxJT.exe
  C:\Windows\System\xAffxJT.exe
  2⤵
  PID:13052
- C:\Windows\System\ynQOAkO.exe
  C:\Windows\System\ynQOAkO.exe
  2⤵
  PID:13068
- C:\Windows\System\irMCsSY.exe
  C:\Windows\System\irMCsSY.exe
  2⤵
  PID:13100
- C:\Windows\System\tLQzupx.exe
  C:\Windows\System\tLQzupx.exe
  2⤵
  PID:13120
- C:\Windows\System\XFFlHXo.exe
  C:\Windows\System\XFFlHXo.exe
  2⤵
  PID:13148
- C:\Windows\System\DYhqsMp.exe
  C:\Windows\System\DYhqsMp.exe
  2⤵
  PID:13176
- C:\Windows\System\KbTlXsX.exe
  C:\Windows\System\KbTlXsX.exe
  2⤵
  PID:13196
- C:\Windows\System\YoKMTzK.exe
  C:\Windows\System\YoKMTzK.exe
  2⤵
  PID:13228
- C:\Windows\System\uREsJVj.exe
  C:\Windows\System\uREsJVj.exe
  2⤵
  PID:13260
- C:\Windows\System\THBUNft.exe
  C:\Windows\System\THBUNft.exe
  2⤵
  PID:13280
- C:\Windows\System\zFzdcvd.exe
  C:\Windows\System\zFzdcvd.exe
  2⤵
  PID:11996
- C:\Windows\System\BMicvdl.exe
  C:\Windows\System\BMicvdl.exe
  2⤵
  PID:11684
- C:\Windows\System\fEEqpKR.exe
  C:\Windows\System\fEEqpKR.exe
  2⤵
  PID:12308
- C:\Windows\System\YKgmxSH.exe
  C:\Windows\System\YKgmxSH.exe
  2⤵
  PID:12424
- C:\Windows\System\ZCOyUFf.exe
  C:\Windows\System\ZCOyUFf.exe
  2⤵
  PID:12476
- C:\Windows\System\SILCMtE.exe
  C:\Windows\System\SILCMtE.exe
  2⤵
  PID:12552
- C:\Windows\System\EiegCly.exe
  C:\Windows\System\EiegCly.exe
  2⤵
  PID:12628
- C:\Windows\System\kbFwTkM.exe
  C:\Windows\System\kbFwTkM.exe
  2⤵
  PID:12700
- C:\Windows\System\COqFSHQ.exe
  C:\Windows\System\COqFSHQ.exe
  2⤵
  PID:12760
- C:\Windows\System\uDVZyOj.exe
  C:\Windows\System\uDVZyOj.exe
  2⤵
  PID:12828
- C:\Windows\System\bNcfTKR.exe
  C:\Windows\System\bNcfTKR.exe
  2⤵
  PID:12944
- C:\Windows\System\PfnQeTD.exe
  C:\Windows\System\PfnQeTD.exe
  2⤵
  PID:4912
- C:\Windows\System\OkMbMyO.exe
  C:\Windows\System\OkMbMyO.exe
  2⤵
  PID:13084
- C:\Windows\System\KWXpjEC.exe
  C:\Windows\System\KWXpjEC.exe
  2⤵
  PID:13144
- C:\Windows\System\JKHWaKu.exe
  C:\Windows\System\JKHWaKu.exe
  2⤵
  PID:13216
- C:\Windows\System\irLwNSX.exe
  C:\Windows\System\irLwNSX.exe
  2⤵
  PID:13220
- C:\Windows\System\yMrcNAh.exe
  C:\Windows\System\yMrcNAh.exe
  2⤵
  PID:12236
- C:\Windows\System\bpaoSxP.exe
  C:\Windows\System\bpaoSxP.exe
  2⤵
  PID:12532
- C:\Windows\System\aoeFAys.exe
  C:\Windows\System\aoeFAys.exe
  2⤵
  PID:12604
- C:\Windows\System\UGdfHDg.exe
  C:\Windows\System\UGdfHDg.exe
  2⤵
  PID:12832
- C:\Windows\System\WSRnxHA.exe
  C:\Windows\System\WSRnxHA.exe
  2⤵
  PID:4400
- C:\Windows\System\MNEeNel.exe
  C:\Windows\System\MNEeNel.exe
  2⤵
  PID:13004
- C:\Windows\System\tIQtPCz.exe
  C:\Windows\System\tIQtPCz.exe
  2⤵
  PID:13060
- C:\Windows\System\sgtRpdF.exe
  C:\Windows\System\sgtRpdF.exe
  2⤵
  PID:5112
- C:\Windows\System\ybTcuHu.exe
  C:\Windows\System\ybTcuHu.exe
  2⤵
  PID:12740
- C:\Windows\System\lyAMcAd.exe
  C:\Windows\System\lyAMcAd.exe
  2⤵
  PID:12620
- C:\Windows\System\eHTOUfL.exe
  C:\Windows\System\eHTOUfL.exe
  2⤵
  PID:3324
- C:\Windows\System\OHQGxuU.exe
  C:\Windows\System\OHQGxuU.exe
  2⤵
  PID:13320
- C:\Windows\System\whZZvQd.exe
  C:\Windows\System\whZZvQd.exe
  2⤵
  PID:13344
- C:\Windows\System\uCxSOjB.exe
  C:\Windows\System\uCxSOjB.exe
  2⤵
  PID:13380
- C:\Windows\System\aiFgjhA.exe
  C:\Windows\System\aiFgjhA.exe
  2⤵
  PID:13404
- C:\Windows\System\LeVxUlo.exe
  C:\Windows\System\LeVxUlo.exe
  2⤵
  PID:13428
- C:\Windows\System\POeZuGr.exe
  C:\Windows\System\POeZuGr.exe
  2⤵
  PID:13448
- C:\Windows\System\DXdotjU.exe
  C:\Windows\System\DXdotjU.exe
  2⤵
  PID:13472
- C:\Windows\System\CAvWzrL.exe
  C:\Windows\System\CAvWzrL.exe
  2⤵
  PID:13488
- C:\Windows\System\ZGzQvmI.exe
  C:\Windows\System\ZGzQvmI.exe
  2⤵
  PID:13508
- C:\Windows\System\JhUYsuA.exe
  C:\Windows\System\JhUYsuA.exe
  2⤵
  PID:13540
- C:\Windows\System\EayGXrr.exe
  C:\Windows\System\EayGXrr.exe
  2⤵
  PID:13568
- C:\Windows\System\zGYHeiQ.exe
  C:\Windows\System\zGYHeiQ.exe
  2⤵
  PID:13608
- C:\Windows\System\RwbwwWI.exe
  C:\Windows\System\RwbwwWI.exe
  2⤵
  PID:13632
- C:\Windows\System\cFeKOeQ.exe
  C:\Windows\System\cFeKOeQ.exe
  2⤵
  PID:13668
- C:\Windows\System\qkgMXWc.exe
  C:\Windows\System\qkgMXWc.exe
  2⤵
  PID:13684
- C:\Windows\System\tdLtoXO.exe
  C:\Windows\System\tdLtoXO.exe
  2⤵
  PID:13708
- C:\Windows\System\jnvHDli.exe
  C:\Windows\System\jnvHDli.exe
  2⤵
  PID:13724
- C:\Windows\System\BSKXsOF.exe
  C:\Windows\System\BSKXsOF.exe
  2⤵
  PID:13752
- C:\Windows\System\oHYYxCn.exe
  C:\Windows\System\oHYYxCn.exe
  2⤵
  PID:13792
- C:\Windows\System\WTfggki.exe
  C:\Windows\System\WTfggki.exe
  2⤵
  PID:13816
- C:\Windows\System\oNLNUxx.exe
  C:\Windows\System\oNLNUxx.exe
  2⤵
  PID:13844
- C:\Windows\System\VmLZpnp.exe
  C:\Windows\System\VmLZpnp.exe
  2⤵
  PID:13876
- C:\Windows\System\vGVAnrK.exe
  C:\Windows\System\vGVAnrK.exe
  2⤵
  PID:13912
- C:\Windows\System\TvdkOtb.exe
  C:\Windows\System\TvdkOtb.exe
  2⤵
  PID:13960
- C:\Windows\System\kBOKXdP.exe
  C:\Windows\System\kBOKXdP.exe
  2⤵
  PID:14000
- C:\Windows\System\mqGBYUt.exe
  C:\Windows\System\mqGBYUt.exe
  2⤵
  PID:14036
- C:\Windows\System\BOejOKW.exe
  C:\Windows\System\BOejOKW.exe
  2⤵
  PID:14076
- C:\Windows\System\WxBhlRa.exe
  C:\Windows\System\WxBhlRa.exe
  2⤵
  PID:14108
- C:\Windows\System\AmBJoLw.exe
  C:\Windows\System\AmBJoLw.exe
  2⤵
  PID:14136
- C:\Windows\System\QeJhtjY.exe
  C:\Windows\System\QeJhtjY.exe
  2⤵
  PID:14164
- C:\Windows\System\HzImJNw.exe
  C:\Windows\System\HzImJNw.exe
  2⤵
  PID:14180
- C:\Windows\System\hAWsFAB.exe
  C:\Windows\System\hAWsFAB.exe
  2⤵
  PID:14196
- C:\Windows\System\mQpqpQd.exe
  C:\Windows\System\mQpqpQd.exe
  2⤵
  PID:14212
- C:\Windows\System\VuwTgMK.exe
  C:\Windows\System\VuwTgMK.exe
  2⤵
  PID:14232
- C:\Windows\System\VjIRFcO.exe
  C:\Windows\System\VjIRFcO.exe
  2⤵
  PID:14256
- C:\Windows\System\QDFuler.exe
  C:\Windows\System\QDFuler.exe
  2⤵
  PID:14276
- C:\Windows\System\HdhmvQe.exe
  C:\Windows\System\HdhmvQe.exe
  2⤵
  PID:14304
- C:\Windows\System\uqUluAF.exe
  C:\Windows\System\uqUluAF.exe
  2⤵
  PID:12304
- C:\Windows\System\lGFBExV.exe
  C:\Windows\System\lGFBExV.exe
  2⤵
  PID:4852
- C:\Windows\System\fyNGUMG.exe
  C:\Windows\System\fyNGUMG.exe
  2⤵
  PID:13424
- C:\Windows\System\EUTeCpw.exe
  C:\Windows\System\EUTeCpw.exe
  2⤵
  PID:13468
- C:\Windows\System\BsVDiPN.exe
  C:\Windows\System\BsVDiPN.exe
  2⤵
  PID:13480
- C:\Windows\System\UNawjuR.exe
  C:\Windows\System\UNawjuR.exe
  2⤵
  PID:13588
- C:\Windows\System\GjffJSz.exe
  C:\Windows\System\GjffJSz.exe
  2⤵
  PID:13624
- C:\Windows\System\hussBji.exe
  C:\Windows\System\hussBji.exe
  2⤵
  PID:13748
- C:\Windows\System\kFKNadh.exe
  C:\Windows\System\kFKNadh.exe
  2⤵
  PID:13780
- C:\Windows\System\mOytebW.exe
  C:\Windows\System\mOytebW.exe
  2⤵
  PID:13904
- C:\Windows\System\ffCWpqE.exe
  C:\Windows\System\ffCWpqE.exe
  2⤵
  PID:14064
- C:\Windows\System\JRHjMtP.exe
  C:\Windows\System\JRHjMtP.exe
  2⤵
  PID:14120
- C:\Windows\System\wPXOfAl.exe
  C:\Windows\System\wPXOfAl.exe
  2⤵
  PID:14148
- C:\Windows\System\OqCFWDt.exe
  C:\Windows\System\OqCFWDt.exe
  2⤵
  PID:14292
- C:\Windows\System\DXYkIKz.exe
  C:\Windows\System\DXYkIKz.exe
  2⤵
  PID:13396
- C:\Windows\System\TYeCbCA.exe
  C:\Windows\System\TYeCbCA.exe
  2⤵
  PID:13164
- C:\Windows\System\iRzVmyo.exe
  C:\Windows\System\iRzVmyo.exe
  2⤵
  PID:13644
- C:\Windows\System\rgrHkyr.exe
  C:\Windows\System\rgrHkyr.exe
  2⤵
  PID:13652
- C:\Windows\System\APVFDKG.exe
  C:\Windows\System\APVFDKG.exe
  2⤵
  PID:13520
- C:\Windows\System\KltlQsY.exe
  C:\Windows\System\KltlQsY.exe
  2⤵
  PID:13972
- C:\Windows\System\fpvjSXA.exe
  C:\Windows\System\fpvjSXA.exe
  2⤵
  PID:14240
- C:\Windows\System\hnIDViX.exe
  C:\Windows\System\hnIDViX.exe
  2⤵
  PID:14160
- C:\Windows\System\mkeMcuc.exe
  C:\Windows\System\mkeMcuc.exe
  2⤵
  PID:14268
- C:\Windows\System\xJyTaLs.exe
  C:\Windows\System\xJyTaLs.exe
  2⤵
  PID:13952
- C:\Windows\System\GEfKXOZ.exe
  C:\Windows\System\GEfKXOZ.exe
  2⤵
  PID:400
- C:\Windows\System\fbsbnyF.exe
  C:\Windows\System\fbsbnyF.exe
  2⤵
  PID:14252
- C:\Windows\System\CazisJi.exe
  C:\Windows\System\CazisJi.exe
  2⤵
  PID:14348
- C:\Windows\System\WZwCvJe.exe
  C:\Windows\System\WZwCvJe.exe
  2⤵
  PID:14376
- C:\Windows\System\YLbpCNa.exe
  C:\Windows\System\YLbpCNa.exe
  2⤵
  PID:14404
- C:\Windows\System\eJTiQuV.exe
  C:\Windows\System\eJTiQuV.exe
  2⤵
  PID:14436
- C:\Windows\System\SJNderh.exe
  C:\Windows\System\SJNderh.exe
  2⤵
  PID:14460
- C:\Windows\System\xcntsSQ.exe
  C:\Windows\System\xcntsSQ.exe
  2⤵
  PID:14488
- C:\Windows\System\CaQlZON.exe
  C:\Windows\System\CaQlZON.exe
  2⤵
  PID:14512
- C:\Windows\System\NEajYrS.exe
  C:\Windows\System\NEajYrS.exe
  2⤵
  PID:14544
- C:\Windows\System\WGXeqrV.exe
  C:\Windows\System\WGXeqrV.exe
  2⤵
  PID:14584
- C:\Windows\System\zkNXHXx.exe
  C:\Windows\System\zkNXHXx.exe
  2⤵
  PID:14616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BWlTrfa.exe

Filesize
2.1MB

MD5
72f683692ffb40be8ce24a84fefd2d89

SHA1
5b32a0ba083c7bd9de0a263603a11334aec39f11

SHA256
375eadd33254168daf8a40245496f691b7f4b42a61cfde952314dca126982005

SHA512
6ba86aa607dcaabff3281c774ff67431b9178064f90a8eb452923a8f5072e77accc27726ee2bdf4c88fbf27cbd8d31b6b3bd1a266de18c672aeebb2ce88de314

Download Submit
C:\Windows\System\CxGWrlV.exe

Filesize
2.1MB

MD5
15ac18b1a799038409e3e181770512c8

SHA1
dd655fbe9251dff708839d2ff5fc68547a640e95

SHA256
bc1cafc2f258dedd5c135e6c616744fe345f2103989656ac89bf8dd78621f60d

SHA512
8f27188f61fe6cd5ca44185843a891ce6f448e39848b94cba4e95afa88ce27b62346b42b1afaa4d646fd1c0575b76d76194a4e5c072bd90bfd626c4de9abc6ca

Download Submit
C:\Windows\System\EMcVdrm.exe

Filesize
2.1MB

MD5
96e5f1968d6108e2a94f502a8f47eeb0

SHA1
4c8abf280c7db58d3ea5b8b3999c1e70979cc631

SHA256
3b4363a15ae3f07e233e1cbaed2a0f3425073f976d503791bf8bbcc0353e1f6f

SHA512
e9821e5e3916159301cfd017e612b9b0a7ada9f226eb52a9d2b77f038b7bacbc7101f6055c3a68b9b27e74a323e9bb0a2b77e0ac59b33325c0ee3293d67c4f01

Download Submit
C:\Windows\System\IjrmdmQ.exe

Filesize
2.1MB

MD5
9bc3a56170096426d23b4347b0ad0099

SHA1
a2bd50df9d06f097a0e93697795067b313df3051

SHA256
a964ea07c31c05fef7a8ea26d7b5a1d5a3aea74e220006ce83a3d6181916a5c6

SHA512
cbac1bca1d5d0f2613aa97ce5f31578ef9924497470941a2760d1ce88cb4d93783c0aaaa8d511a2d25e5e8d3f6658b8fe526c268962c54ed00b9ec4faed79ec6

Download Submit
C:\Windows\System\JAXgOcV.exe

Filesize
2.1MB

MD5
ced850d85ce50ff37a4f3ca4f029f76a

SHA1
5dd8caad971c1ba953124b6d88fb1dc75e9dca3c

SHA256
9a4c0ecc8cf9b07cb50563c768ebbf20ebd3aaa7c719af1c693ab1f06bddb9db

SHA512
9187d28e9479e1fb3ae94a29d37ad29cf0373382848e6a6738657dde1193ce81658d5817bc9815d4a4852f26a50f239df99f556a3eddf6b875a4481939ebedc6

Download Submit
C:\Windows\System\JKTWGqf.exe

Filesize
2.1MB

MD5
3cc2e03628ba7f5d3705b069e41b0d00

SHA1
c33cf695ad7634e77d2dc7ecf5f30b0468ba1632

SHA256
5151d4918e5a24c004aaa0752af752cd7f02bb3237c5f239dfcc8373e37ace8b

SHA512
ef2fc7a0de947e3801dfaa6e8a432cc492d211e0acb1e72be1541a4a990805e8faf9a8ccaf278e413c3752da0a417a20da4aa5fe542ed3ff800cbe2066569be3

Download Submit
C:\Windows\System\KLUqIdz.exe

Filesize
2.1MB

MD5
62250192019f658d48de0cb635cd2c40

SHA1
879ce2f669bd7b6c0156c8fdce56343776a0f18a

SHA256
438161e19d105c6e2493de6ca5759cfcca484b4179bdcd8b2223fe6b6f03b7a7

SHA512
06657c5bad78b8b8880b45b6308a13408c1c244c5fb2dd4b5eb733efab1a493a8c675c44e647ac4ba90a66749163100225b812a94d0e5b92473d7384d2e50008

Download Submit
C:\Windows\System\LiVthSQ.exe

Filesize
2.1MB

MD5
61c28cbbff7a00f87a6b39dc3b1bc51d

SHA1
dcd5169b0da4c1a544264931452be8930e7df95e

SHA256
040872d7838499084ce2750fe727a7ed1fc51cf86266dc7317590685b59b01b8

SHA512
dae78652d66c6946bf9373d54ec229a066c6e766ca59da8b32b05f44c93f0f921e7ecd8a35c0e0a647b1ab6ae43dfd0477b062e2969498a7b460318cc81691a2

Download Submit
C:\Windows\System\LoXzDkZ.exe

Filesize
2.1MB

MD5
60470d8f21f10601797bbd5937558936

SHA1
c231f746ead87f87669adaaf5fcc2cba96390e9f

SHA256
590382b888c5b127d6c28989bd711052c18db77a2169534167f36dd04dc61558

SHA512
97c357a0dcd0618b48c5802b4b2bdf67b2c96c7d082355b8d7ad63f1080c248354187c9eb7cf6476dcdb33001409c745e25552918aa93448024e6a05811d4030

Download Submit
C:\Windows\System\NLyZIrT.exe

Filesize
2.1MB

MD5
4218e41469a59abdbb1e3a355f577bf6

SHA1
084df2ab961ee1514fee1564002ab2e4206d4686

SHA256
5d522efecc20287cddecfd18faa4145f64821d7ad86fdbc2c9208a18b5d8829c

SHA512
46d009ba51116e5887fe9e10829d1bc1648ffc8eeb2e5654d69fd3adc242256d33a867563007112d59d3fa80ab8939793fde2fc2e79ec3b8b8b91a7d18281313

Download Submit
C:\Windows\System\OSbnnVK.exe

Filesize
2.1MB

MD5
58601c25604b717ad20bb036dab4d7fc

SHA1
b2e2d2095838a6aa74bf9a2bbcc0c7d8d008511e

SHA256
fd2a864e0b523222ea1fb33d41fcdbc4dfc9150a497174f158761bf617a796db

SHA512
4cdd98cf38577b87a609a9cc336d3a2db3d3bb3d0484007f3d38eb2ba3ba76659bbf4f2313fde7b99107d5d2eeb4a8be33699205ec39a0378d27e7e53ec911cc

Download Submit
C:\Windows\System\PCYfpDj.exe

Filesize
2.1MB

MD5
bceffb9bec782e1759ceee4e1c91717e

SHA1
924f44046bc5009289c39bba2ac30811cc4634bc

SHA256
1c8c6d23c1a885a4745bf9dbde187537922aa33014acc3a3714e8d55acf0dd58

SHA512
8db3d4b593f6fadf172be8b3c4e3a0f8f5178a5b096d99d28f8e029e735232fc8dee8554101f9716d6573cb0bd901e22b2adccb6625bf7ea980e45cbe18c3a9f

Download Submit
C:\Windows\System\RTrKvgp.exe

Filesize
2.1MB

MD5
06ba1ecaa81066fa9034c263fbc70ef2

SHA1
5caffc6e7ec6c5d62ea8b45a47e5b04e6a6e7cb6

SHA256
95bf185602da57469baeaae28e29bf334d738520ff9d2b03b609d538d61aff48

SHA512
7e6cf906de96bea65463bc66f75cd59637ce421d78da558632bd052b5515357d12157d0c153806ae168c96ca0ddbee6cac0f89ad73c87b05b87c7eb902c64142

Download Submit
C:\Windows\System\RjBGcBo.exe

Filesize
2.1MB

MD5
62bd49256824fc1180d5fd25da7d1b5f

SHA1
ea1542c69baf13b680be057fc40abf72627bdef0

SHA256
76f013bb8a6bfca7449069197ca345e989c0712897b6c6e4a9598978611e0292

SHA512
6fd1f5b851a009098c240f8d87cfec7f6c9b6b68d581d7549e472ab96554c0d7ec4d2563b02cec5793323f6a883f19227d62eb5ba3fcda4f79a945ee71341a77

Download Submit
C:\Windows\System\TfxMQvb.exe

Filesize
2.1MB

MD5
2bd196b23d5fab00d75bea0b3e34967d

SHA1
07505f2511129dd3358608b7dcf5b45ae7686110

SHA256
c667d689594bd44087d85b188f0342f18dec8e23463cc88f4aa38731ab43b14a

SHA512
b3a0f6ad6618b4762a76aca4dc24f86fb2347656d9f3443215573c663cbc8406406fd5c07ff13f0d71fad44e034d4f8b4ec16a14e19317292ab8b2fd10515150

Download Submit
C:\Windows\System\VjcPmnb.exe

Filesize
2.1MB

MD5
56a5d90421018f2b893e110016953ad6

SHA1
d2c911e6367c9c87a6d353db8d14a726ce9c821c

SHA256
4794cde53408a2aeac3417e0d5c154e46938782c16d9d285e810ba9d129270ba

SHA512
434df7514eb5880621c666363a184f6b7fbd542af6c7b2ca2de7ac1631ba018f16188aaf74852be633531f3cb8ac708828d57e08db01bb8ca08e88a915d80e21

Download Submit
C:\Windows\System\WoHFKrS.exe

Filesize
2.1MB

MD5
66c95e8799bae8229c990525055e9d17

SHA1
0148b33fdecefb523772a0af935cb9ff953ab9da

SHA256
e48ead2002896223cb5aa144b0950760c10e79707b8c6b67c179c8c7e85c0a5e

SHA512
9dc4879c4d488568c377fee84851fa9207cd626ed6b86a278183b3596a9d6b6ad2b5ffc91a42b059990e3460bbf17566425c34e77ec1a38161ad8bdc7132e6dd

Download Submit
C:\Windows\System\XTqrscc.exe

Filesize
2.1MB

MD5
07ea5c496b4d229896bf94c31ddb684e

SHA1
aed45651d45bc45e156bcc4953bcc9dcf8b2e9a2

SHA256
8f6145b14be1adf3b603b4c7daa871f6e16e9cadd915ab8ae796bab971856d7d

SHA512
11a49e68e10de15d875130b9e2686c6edb99e68042b401eb1bd9d8a6c1fce9009ff4416297aa1d95d6956c8cad6fe1afce7dddbd18619fb5a88bb373a4cf35d1

Download Submit
C:\Windows\System\YLYcuLl.exe

Filesize
2.1MB

MD5
e7d818c43c6a341ff7a817bbd2f7d8e5

SHA1
0ad43dd238feb15b4b612d14f764fed675fabb68

SHA256
13828ac30d0b8717455d8dae71d742ad68e7984ad13bf73d25e6f695627c9252

SHA512
797071b6fb9e9a1868b7e488b2999a5d07fecf5e5da7464108ae986e3b48f620db4711558bc539dee031cd17ebfa2e539a927b0a38f9c9d3e0d2b06d480152ca

Download Submit
C:\Windows\System\ZGUogrh.exe

Filesize
2.1MB

MD5
cfe517a4a298a2e875f0396445da9bc0

SHA1
c8bbc65539b0ee8fb8802946dd71f5147dc774f5

SHA256
2e4ae1fc40ef37528caec04b06901d84ab5411815eeae6a4d13a74e96e8d041a

SHA512
e5be7526098a38720cde066a5bf3c59ebac0603b53ee4c1e7eeabf6721b0c648b81a4dbe16af050240ccb8a8fcc5f0fa7729c47acc3ee974fdbae5f582be0f04

Download Submit
C:\Windows\System\Zdamial.exe

Filesize
2.1MB

MD5
6dbff5af2fb207197dbdef1058d5303b

SHA1
5d19eff4686980974b30eb6ecbcc8d0d6cbb9e84

SHA256
ff066914ef324342b3a882a8eed90947338bff9243ec77f406ea3d873cb87ca6

SHA512
8c4ffe352bde93e2ec235e8eacab973eff21cb255d536820951df6e023448b88b92c79ee644aeb502aeedaec13705f7675a07cba0365ddb74e94232d9b7e79fc

Download Submit
C:\Windows\System\biJITOa.exe

Filesize
2.1MB

MD5
f61dbc4870a3c413e37786584f84d635

SHA1
b355c6d145ff78f3fe4928833ce63e740531a43a

SHA256
8db2ee8b6df7fbae1691dcae525f63ea9c83db5f6fe24db54ced00e418080047

SHA512
0b47cd75d84dd37c4703f45cdc309f4b249a5ea20957d79aaec7dd84c9f2e99c5a1549ee2a0d7caab9f3d4f0a81185ce68735c6549720655f973ecf70e226fa6

Download Submit
C:\Windows\System\ftcNBLX.exe

Filesize
2.1MB

MD5
850afc9709535f07d6eb162658dde905

SHA1
43b80369c7a15adc6935eab1a78d3e45eaa8dd42

SHA256
6c8a5e7129ad41012e8f7cebcb65e0d9fee231d179b02daf36b6703336393441

SHA512
bab74bc72a457ebdba50e9d21bfd1cad0c11301940fb7553305fddb8a215c2b32296237af895daa7a8d463dbbcd2446d93f7fae583f1be66ad9c35c2b1cbf74f

Download Submit
C:\Windows\System\mDPInjb.exe

Filesize
2.1MB

MD5
1e01732952a75379057a27d8e9c82c83

SHA1
f4afeb0853fd6784f27e683c2f2515980f97bc0f

SHA256
637534659760edce021509c9c1cc10237810bcd40459462877dda7b2802162b2

SHA512
98ad80df915ada3aa0719a222d603a5c9553e21e0107f596da519bf0a2b425b18e0cce73b85b34e4f8875ca528ed8e7c2f697864bd771fb2aa0675fe2300d5c9

Download Submit
C:\Windows\System\mMMxXlI.exe

Filesize
2.1MB

MD5
4ec54365dda964795c3a697833044525

SHA1
7bf7d2d97fcc99db1e2842fc8f3b44cb4814b5ea

SHA256
4466c830f2c0a19b8cc648f8d209e9db45cac07ee1c7fb913ed1910f7a5c28f8

SHA512
d2106f9463486cc463ef5b11fdeb929a592ec2e005ab68a7a4e51ec8763c11aa7c8ffaf2abffe6bc6724697b42939ab62c1020cae3d276a1f521fbce32804120

Download Submit
C:\Windows\System\rCIjyQx.exe

Filesize
2.1MB

MD5
4f2b2df8164ddb585cebd11b65adf665

SHA1
40b524b06829a2cb7e46105a20f59f29438fbbe9

SHA256
d3184f00821f821f95a1b3efca1cc3c4b5d91ade559a1e0575d40ff2b76ba862

SHA512
b5e48a176c72353a7fc13331be5cf0545fe1ceb31b13dd8762b2d79cf4a0fc96c821205c06c3b2d2cb1e2f13f58914f7de243ff27d736d29abae5934567bcfa4

Download Submit
C:\Windows\System\rWcpuST.exe

Filesize
2.1MB

MD5
816bea83b32ffe65845276b8884e132c

SHA1
2ca839eaf3e61e8948b5f335f8d12be40f8eff5d

SHA256
7e8d5564cb84998329fb1546d152083f6891c484709141e493bf3410b84a064f

SHA512
dd16bed4c3936b54cf27d55389e775ae292e82bee947c30f6effa4ba027c4b793f8a7c34bf9b06d521a89268f57c228321100749868940a35cf1ae963d54543a

Download Submit
C:\Windows\System\uQVjCHi.exe

Filesize
2.1MB

MD5
d94fa59f6d32b94dbec17b297b64bc64

SHA1
1cfe43dbf357e238ba8893cc39149f7672950250

SHA256
a2a24001ec32f0a1cd6418fb98dccd162b8e8db2942c1d9f55f1f8f7e7916523

SHA512
80f9ac6c4ba7eacbdb4de937ea64f7bae1f8ce670fd608ffec385ad85b3de980d57f24f50c43cf7bce8dd4ac41dffd4eb526a9f5854c798ca2217c60359398a5

Download Submit
C:\Windows\System\uyAUpzt.exe

Filesize
2.1MB

MD5
adf0c1e24d5c74112b92f966cc63b27a

SHA1
7cc6338ebab5356f2b641d80b2a2519adee2690e

SHA256
c0b545c290e6797faf3ddbcd33076b574b5ad7a86c28cbd121f5302c2c4b42d1

SHA512
353e464cb3145477ba482bfaddaf029a531928fa74d7828b13a7b32128f4a5b700b97438eb519ceba1b084cf28961b5433daeb9c2e7522d472ef34437148818f

Download Submit
C:\Windows\System\vFoyySr.exe

Filesize
2.1MB

MD5
72f057d138fa2103d11e233e7ce48321

SHA1
d1df9665bebbb099adb6a4068a59857984a56b05

SHA256
2b8389f780cc6a3c7e18f2631aef66a61c23d5b4616efe63b848d7867d2eb1f1

SHA512
2310805e9de4ba8b53ae171cd1392b1737bf00f8c3012d45bf516de62ade14e5a67545060a55a3185838fe141419cf8fcbf930f09c4bd09e6071576419b29a5e

Download Submit
C:\Windows\System\wzZIext.exe

Filesize
2.1MB

MD5
58a184b34dc4cc73cd791626a47649a3

SHA1
48ee1fb0110ee02b4bdda81d7945acbb2ef3db2b

SHA256
a73d32f5bc20a21436b2d908f0b1f916d1610c952d54b86211fb9aae23bacbd0

SHA512
715fa5816064eff062d9e5a4058658184d9b299b7836ddea547d42be5acfe8c523a90b340d9bc9ad75ce3ae4fec20c418c1c43754722d359f64e1f43525213e8

Download Submit
C:\Windows\System\zEpAVkj.exe

Filesize
2.1MB

MD5
48a967c4596138b3ddc7c188dd28637d

SHA1
c6f11e7b822038ef2976d396b52b02732daad96c

SHA256
0f07936dfa0ea3e54ea22c1c28b07bc4098af819a07769518548e646aea1f32e

SHA512
1845ee6b0badebb0bc40a483daf8c59a256e2afc9fa2559879eb48fff5241eb44e1bf2dac25b2c0d0cd9abf3cb7586a1202e12db14dabacebdca76deebfe9353

Download Submit
C:\Windows\System\zYqpoJU.exe

Filesize
2.1MB

MD5
4f92eed636472aaa77a07ee2a9a0644c

SHA1
d578f2141dbadac01c606260069f90524cc33432

SHA256
e394a60c897e80199c49e2cf9c8eb400bd9a5302db7757a20db69e5f9c61c0c4

SHA512
330b032d50cdf64c03a50796579103b13af098f47ed210e46008186daa469e956b9161dc940a1bfbd7e66ed06a23dc5b1321adc1b9af991e5e737b267561d7f4

Download Submit
memory/456-128-0x00007FF62B3C0000-0x00007FF62B714000-memory.dmp

Filesize
3.3MB

Download
memory/456-2113-0x00007FF62B3C0000-0x00007FF62B714000-memory.dmp

Filesize
3.3MB

Download
memory/748-2100-0x00007FF7FAEC0000-0x00007FF7FB214000-memory.dmp

Filesize
3.3MB

Download
memory/748-53-0x00007FF7FAEC0000-0x00007FF7FB214000-memory.dmp

Filesize
3.3MB

Download
memory/748-2083-0x00007FF7FAEC0000-0x00007FF7FB214000-memory.dmp

Filesize
3.3MB

Download
memory/1084-73-0x00007FF7F9E70000-0x00007FF7FA1C4000-memory.dmp

Filesize
3.3MB

Download
memory/1084-2101-0x00007FF7F9E70000-0x00007FF7FA1C4000-memory.dmp

Filesize
3.3MB

Download
memory/1272-2087-0x00007FF791800000-0x00007FF791B54000-memory.dmp

Filesize
3.3MB

Download
memory/1272-2109-0x00007FF791800000-0x00007FF791B54000-memory.dmp

Filesize
3.3MB

Download
memory/1272-111-0x00007FF791800000-0x00007FF791B54000-memory.dmp

Filesize
3.3MB

Download
memory/1520-125-0x00007FF7DE6E0000-0x00007FF7DEA34000-memory.dmp

Filesize
3.3MB

Download
memory/1520-2103-0x00007FF7DE6E0000-0x00007FF7DEA34000-memory.dmp

Filesize
3.3MB

Download
memory/1748-2093-0x00007FF737340000-0x00007FF737694000-memory.dmp

Filesize
3.3MB

Download
memory/1748-16-0x00007FF737340000-0x00007FF737694000-memory.dmp

Filesize
3.3MB

Download
memory/1776-116-0x00007FF783ED0000-0x00007FF784224000-memory.dmp

Filesize
3.3MB

Download
memory/1776-2102-0x00007FF783ED0000-0x00007FF784224000-memory.dmp

Filesize
3.3MB

Download
memory/1788-2086-0x00007FF797EE0000-0x00007FF798234000-memory.dmp

Filesize
3.3MB

Download
memory/1788-2108-0x00007FF797EE0000-0x00007FF798234000-memory.dmp

Filesize
3.3MB

Download
memory/1788-105-0x00007FF797EE0000-0x00007FF798234000-memory.dmp

Filesize
3.3MB

Download
memory/1888-2099-0x00007FF7EA240000-0x00007FF7EA594000-memory.dmp

Filesize
3.3MB

Download
memory/1888-2082-0x00007FF7EA240000-0x00007FF7EA594000-memory.dmp

Filesize
3.3MB

Download
memory/1888-46-0x00007FF7EA240000-0x00007FF7EA594000-memory.dmp

Filesize
3.3MB

Download
memory/2212-198-0x00007FF77BCC0000-0x00007FF77C014000-memory.dmp

Filesize
3.3MB

Download
memory/2212-2120-0x00007FF77BCC0000-0x00007FF77C014000-memory.dmp

Filesize
3.3MB

Download
memory/2308-45-0x00007FF743B60000-0x00007FF743EB4000-memory.dmp

Filesize
3.3MB

Download
memory/2308-2096-0x00007FF743B60000-0x00007FF743EB4000-memory.dmp

Filesize
3.3MB

Download
memory/2388-81-0x00007FF69AE80000-0x00007FF69B1D4000-memory.dmp

Filesize
3.3MB

Download
memory/2388-2104-0x00007FF69AE80000-0x00007FF69B1D4000-memory.dmp

Filesize
3.3MB

Download
memory/2388-2081-0x00007FF69AE80000-0x00007FF69B1D4000-memory.dmp

Filesize
3.3MB

Download
memory/2636-112-0x00007FF788BD0000-0x00007FF788F24000-memory.dmp

Filesize
3.3MB

Download
memory/2636-2088-0x00007FF788BD0000-0x00007FF788F24000-memory.dmp

Filesize
3.3MB

Download
memory/2636-2111-0x00007FF788BD0000-0x00007FF788F24000-memory.dmp

Filesize
3.3MB

Download
memory/2676-126-0x00007FF68EB20000-0x00007FF68EE74000-memory.dmp

Filesize
3.3MB

Download
memory/2676-2107-0x00007FF68EB20000-0x00007FF68EE74000-memory.dmp

Filesize
3.3MB

Download
memory/2696-2121-0x00007FF65C920000-0x00007FF65CC74000-memory.dmp

Filesize
3.3MB

Download
memory/2696-199-0x00007FF65C920000-0x00007FF65CC74000-memory.dmp

Filesize
3.3MB

Download
memory/3000-142-0x00007FF6771C0000-0x00007FF677514000-memory.dmp

Filesize
3.3MB

Download
memory/3000-2114-0x00007FF6771C0000-0x00007FF677514000-memory.dmp

Filesize
3.3MB

Download
memory/3000-2090-0x00007FF6771C0000-0x00007FF677514000-memory.dmp

Filesize
3.3MB

Download
memory/3116-151-0x00007FF755A00000-0x00007FF755D54000-memory.dmp

Filesize
3.3MB

Download
memory/3116-2116-0x00007FF755A00000-0x00007FF755D54000-memory.dmp

Filesize
3.3MB

Download
memory/3116-2092-0x00007FF755A00000-0x00007FF755D54000-memory.dmp

Filesize
3.3MB

Download
memory/3268-2110-0x00007FF76F140000-0x00007FF76F494000-memory.dmp

Filesize
3.3MB

Download
memory/3268-127-0x00007FF76F140000-0x00007FF76F494000-memory.dmp

Filesize
3.3MB

Download
memory/3484-54-0x00007FF797880000-0x00007FF797BD4000-memory.dmp

Filesize
3.3MB

Download
memory/3484-2094-0x00007FF797880000-0x00007FF797BD4000-memory.dmp

Filesize
3.3MB

Download
memory/3648-161-0x00007FF774110000-0x00007FF774464000-memory.dmp

Filesize
3.3MB

Download
memory/3648-2115-0x00007FF774110000-0x00007FF774464000-memory.dmp

Filesize
3.3MB

Download
memory/3664-2118-0x00007FF6E19D0000-0x00007FF6E1D24000-memory.dmp

Filesize
3.3MB

Download
memory/3664-175-0x00007FF6E19D0000-0x00007FF6E1D24000-memory.dmp

Filesize
3.3MB

Download
memory/3944-0-0x00007FF650440000-0x00007FF650794000-memory.dmp

Filesize
3.3MB

Download
memory/3944-1-0x000001F86C930000-0x000001F86C940000-memory.dmp

Filesize
64KB

Download
memory/3952-2095-0x00007FF63B270000-0x00007FF63B5C4000-memory.dmp

Filesize
3.3MB

Download
memory/3952-42-0x00007FF63B270000-0x00007FF63B5C4000-memory.dmp

Filesize
3.3MB

Download
memory/4080-196-0x00007FF622790000-0x00007FF622AE4000-memory.dmp

Filesize
3.3MB

Download
memory/4080-2119-0x00007FF622790000-0x00007FF622AE4000-memory.dmp

Filesize
3.3MB

Download
memory/4492-113-0x00007FF679350000-0x00007FF6796A4000-memory.dmp

Filesize
3.3MB

Download
memory/4492-2112-0x00007FF679350000-0x00007FF6796A4000-memory.dmp

Filesize
3.3MB

Download
memory/4492-2089-0x00007FF679350000-0x00007FF6796A4000-memory.dmp

Filesize
3.3MB

Download
memory/4892-34-0x00007FF75F410000-0x00007FF75F764000-memory.dmp

Filesize
3.3MB

Download
memory/4892-2097-0x00007FF75F410000-0x00007FF75F764000-memory.dmp

Filesize
3.3MB

Download
memory/4904-63-0x00007FF7DD6E0000-0x00007FF7DDA34000-memory.dmp

Filesize
3.3MB

Download
memory/4904-2098-0x00007FF7DD6E0000-0x00007FF7DDA34000-memory.dmp

Filesize
3.3MB

Download
memory/4968-2106-0x00007FF6378B0000-0x00007FF637C04000-memory.dmp

Filesize
3.3MB

Download
memory/4968-77-0x00007FF6378B0000-0x00007FF637C04000-memory.dmp

Filesize
3.3MB

Download
memory/4968-2084-0x00007FF6378B0000-0x00007FF637C04000-memory.dmp

Filesize
3.3MB

Download
memory/5096-2105-0x00007FF75E980000-0x00007FF75ECD4000-memory.dmp

Filesize
3.3MB

Download
memory/5096-101-0x00007FF75E980000-0x00007FF75ECD4000-memory.dmp

Filesize
3.3MB

Download
memory/5096-2085-0x00007FF75E980000-0x00007FF75ECD4000-memory.dmp

Filesize
3.3MB

Download
memory/5108-2117-0x00007FF638210000-0x00007FF638564000-memory.dmp

Filesize
3.3MB

Download
memory/5108-2091-0x00007FF638210000-0x00007FF638564000-memory.dmp

Filesize
3.3MB

Download
memory/5108-145-0x00007FF638210000-0x00007FF638564000-memory.dmp

Filesize
3.3MB

Download