xmrig | 5dcf32e2362e31e4660d436eded2bc152a3d12f42625f417548eb4bf42cda099

Analysis

max time kernel
117s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
Size

1.5MB
MD5

363b77418053c01577e327640d343cd0
SHA1

f6d9d01fb6e7c84df44c2c6368d706e4d5bff7f9
SHA256

5dcf32e2362e31e4660d436eded2bc152a3d12f42625f417548eb4bf42cda099
SHA512

58ca9b8491912bae846f9c59bda3078c8dfa1607bb70f7d2fd08824657442aa7782d239d52b124da025fcc9b3e6c797ee506dc1d913ff85b30a54577775eb33b
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXxeHNsw5:BemTLkNdfE0pZrS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2208-0-0x00007FF7FBFC0000-0x00007FF7FC314000-memory.dmp	xmrig
behavioral2/files/0x00090000000233f4-5.dat	xmrig
behavioral2/memory/1404-14-0x00007FF641640000-0x00007FF641994000-memory.dmp	xmrig
behavioral2/files/0x0007000000023406-20.dat	xmrig
behavioral2/files/0x0007000000023407-29.dat	xmrig
behavioral2/files/0x0007000000023409-38.dat	xmrig
behavioral2/files/0x000700000002340a-43.dat	xmrig
behavioral2/files/0x000700000002340b-58.dat	xmrig
behavioral2/files/0x000700000002340e-73.dat	xmrig
behavioral2/files/0x0007000000023411-88.dat	xmrig
behavioral2/files/0x0007000000023415-100.dat	xmrig
behavioral2/files/0x0007000000023418-115.dat	xmrig
behavioral2/files/0x000700000002341e-153.dat	xmrig
behavioral2/memory/2572-663-0x00007FF65D380000-0x00007FF65D6D4000-memory.dmp	xmrig
behavioral2/memory/3984-664-0x00007FF716B40000-0x00007FF716E94000-memory.dmp	xmrig
behavioral2/memory/3824-676-0x00007FF791F90000-0x00007FF7922E4000-memory.dmp	xmrig
behavioral2/memory/552-692-0x00007FF7B3920000-0x00007FF7B3C74000-memory.dmp	xmrig
behavioral2/memory/1548-704-0x00007FF7F7AD0000-0x00007FF7F7E24000-memory.dmp	xmrig
behavioral2/memory/3280-716-0x00007FF6008F0000-0x00007FF600C44000-memory.dmp	xmrig
behavioral2/memory/4628-721-0x00007FF757B80000-0x00007FF757ED4000-memory.dmp	xmrig
behavioral2/memory/2548-726-0x00007FF71B4A0000-0x00007FF71B7F4000-memory.dmp	xmrig
behavioral2/memory/2864-733-0x00007FF653BF0000-0x00007FF653F44000-memory.dmp	xmrig
behavioral2/memory/2684-735-0x00007FF7650E0000-0x00007FF765434000-memory.dmp	xmrig
behavioral2/memory/4612-738-0x00007FF7DCF40000-0x00007FF7DD294000-memory.dmp	xmrig
behavioral2/memory/1096-745-0x00007FF7CFD80000-0x00007FF7D00D4000-memory.dmp	xmrig
behavioral2/memory/3320-748-0x00007FF73FDA0000-0x00007FF7400F4000-memory.dmp	xmrig
behavioral2/memory/5024-750-0x00007FF74F8C0000-0x00007FF74FC14000-memory.dmp	xmrig
behavioral2/memory/4796-734-0x00007FF7A7E30000-0x00007FF7A8184000-memory.dmp	xmrig
behavioral2/memory/3700-699-0x00007FF787410000-0x00007FF787764000-memory.dmp	xmrig
behavioral2/memory/3260-680-0x00007FF64D0A0000-0x00007FF64D3F4000-memory.dmp	xmrig
behavioral2/memory/4348-677-0x00007FF660720000-0x00007FF660A74000-memory.dmp	xmrig
behavioral2/memory/4960-796-0x00007FF7BF9E0000-0x00007FF7BFD34000-memory.dmp	xmrig
behavioral2/memory/4296-800-0x00007FF6D53C0000-0x00007FF6D5714000-memory.dmp	xmrig
behavioral2/memory/3924-799-0x00007FF6C6FF0000-0x00007FF6C7344000-memory.dmp	xmrig
behavioral2/memory/3188-806-0x00007FF787060000-0x00007FF7873B4000-memory.dmp	xmrig
behavioral2/memory/4924-810-0x00007FF792A70000-0x00007FF792DC4000-memory.dmp	xmrig
behavioral2/memory/2172-816-0x00007FF689BF0000-0x00007FF689F44000-memory.dmp	xmrig
behavioral2/memory/2708-818-0x00007FF73CE40000-0x00007FF73D194000-memory.dmp	xmrig
behavioral2/memory/3600-817-0x00007FF682320000-0x00007FF682674000-memory.dmp	xmrig
behavioral2/memory/5032-668-0x00007FF6DAD40000-0x00007FF6DB094000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-165.dat	xmrig
behavioral2/files/0x0007000000023420-163.dat	xmrig
behavioral2/files/0x0007000000023421-160.dat	xmrig
behavioral2/files/0x000700000002341f-158.dat	xmrig
behavioral2/files/0x000700000002341d-148.dat	xmrig
behavioral2/files/0x000700000002341c-143.dat	xmrig
behavioral2/files/0x000700000002341b-138.dat	xmrig
behavioral2/files/0x000700000002341a-133.dat	xmrig
behavioral2/files/0x0007000000023419-128.dat	xmrig
behavioral2/files/0x0007000000023417-118.dat	xmrig
behavioral2/files/0x0007000000023416-113.dat	xmrig
behavioral2/files/0x0007000000023414-103.dat	xmrig
behavioral2/files/0x0007000000023413-98.dat	xmrig
behavioral2/files/0x0007000000023412-93.dat	xmrig
behavioral2/files/0x0007000000023410-83.dat	xmrig
behavioral2/files/0x000700000002340f-78.dat	xmrig
behavioral2/files/0x000700000002340d-68.dat	xmrig
behavioral2/files/0x000700000002340c-63.dat	xmrig
behavioral2/files/0x0007000000023408-48.dat	xmrig
behavioral2/files/0x0007000000023403-36.dat	xmrig
behavioral2/files/0x0007000000023405-27.dat	xmrig
behavioral2/files/0x0007000000023404-24.dat	xmrig
behavioral2/memory/1328-21-0x00007FF663690000-0x00007FF6639E4000-memory.dmp	xmrig
behavioral2/memory/2572-2151-0x00007FF65D380000-0x00007FF65D6D4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1404	YkGRHWr.exe
1328	OKWdqBF.exe
2572	HDLanMY.exe
3984	bsNQitB.exe
5032	cWNGzDE.exe
2708	hTMjvhp.exe
3824	KecMKYh.exe
4348	IyRlVNf.exe
3260	DOJxenm.exe
552	XFJGlKe.exe
3700	ZOIZsol.exe
1548	LinSbUE.exe
3280	vMyElrO.exe
4628	VVquHCF.exe
2548	AXBgMoC.exe
2864	TyIZwsX.exe
4796	YDRNEcF.exe
2684	EhPdRHA.exe
4612	OfyycGo.exe
1096	rVuFMSp.exe
3320	ryBFFTm.exe
5024	EPnJTwR.exe
4960	kLNsNdS.exe
3924	jtRpoUQ.exe
4296	LjfcZdN.exe
3188	NnmMUSk.exe
4924	iXzpmUb.exe
2172	gwyrzKO.exe
3600	srIdTgC.exe
2968	GFGrgXj.exe
3112	omlUQgt.exe
4864	dbOUXJy.exe
2196	kiXvIHI.exe
4724	GFIvbCa.exe
4996	ncwyCQs.exe
4912	uhKQEXl.exe
4188	zzffXEJ.exe
5068	hRARxbp.exe
3352	zjgTuCD.exe
3216	DePHGIG.exe
2668	jAEkRgo.exe
3932	XrbuiAx.exe
4944	XuRxBRU.exe
3408	RWKUWdm.exe
1160	xYwVBzF.exe
3768	kIbejRV.exe
3376	blQBkjT.exe
4652	xzFqAVH.exe
3120	LqdPYlY.exe
4432	kkahwIG.exe
1888	nqppgkO.exe
4984	CIzymOw.exe
2280	ZJpqxyA.exe
4908	aZGPJiX.exe
1184	ArnNpGm.exe
2372	iDZpicA.exe
2616	MeHXSmc.exe
2052	mPRKMSy.exe
5064	LJJjuuF.exe
3300	IZLxcBs.exe
1164	WMNUJMH.exe
208	xbmSdpR.exe
2164	xFaiIUD.exe
3592	WmcGkYK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2208-0-0x00007FF7FBFC0000-0x00007FF7FC314000-memory.dmp	upx
behavioral2/files/0x00090000000233f4-5.dat	upx
behavioral2/memory/1404-14-0x00007FF641640000-0x00007FF641994000-memory.dmp	upx
behavioral2/files/0x0007000000023406-20.dat	upx
behavioral2/files/0x0007000000023407-29.dat	upx
behavioral2/files/0x0007000000023409-38.dat	upx
behavioral2/files/0x000700000002340a-43.dat	upx
behavioral2/files/0x000700000002340b-58.dat	upx
behavioral2/files/0x000700000002340e-73.dat	upx
behavioral2/files/0x0007000000023411-88.dat	upx
behavioral2/files/0x0007000000023415-100.dat	upx
behavioral2/files/0x0007000000023418-115.dat	upx
behavioral2/files/0x000700000002341e-153.dat	upx
behavioral2/memory/2572-663-0x00007FF65D380000-0x00007FF65D6D4000-memory.dmp	upx
behavioral2/memory/3984-664-0x00007FF716B40000-0x00007FF716E94000-memory.dmp	upx
behavioral2/memory/3824-676-0x00007FF791F90000-0x00007FF7922E4000-memory.dmp	upx
behavioral2/memory/552-692-0x00007FF7B3920000-0x00007FF7B3C74000-memory.dmp	upx
behavioral2/memory/1548-704-0x00007FF7F7AD0000-0x00007FF7F7E24000-memory.dmp	upx
behavioral2/memory/3280-716-0x00007FF6008F0000-0x00007FF600C44000-memory.dmp	upx
behavioral2/memory/4628-721-0x00007FF757B80000-0x00007FF757ED4000-memory.dmp	upx
behavioral2/memory/2548-726-0x00007FF71B4A0000-0x00007FF71B7F4000-memory.dmp	upx
behavioral2/memory/2864-733-0x00007FF653BF0000-0x00007FF653F44000-memory.dmp	upx
behavioral2/memory/2684-735-0x00007FF7650E0000-0x00007FF765434000-memory.dmp	upx
behavioral2/memory/4612-738-0x00007FF7DCF40000-0x00007FF7DD294000-memory.dmp	upx
behavioral2/memory/1096-745-0x00007FF7CFD80000-0x00007FF7D00D4000-memory.dmp	upx
behavioral2/memory/3320-748-0x00007FF73FDA0000-0x00007FF7400F4000-memory.dmp	upx
behavioral2/memory/5024-750-0x00007FF74F8C0000-0x00007FF74FC14000-memory.dmp	upx
behavioral2/memory/4796-734-0x00007FF7A7E30000-0x00007FF7A8184000-memory.dmp	upx
behavioral2/memory/3700-699-0x00007FF787410000-0x00007FF787764000-memory.dmp	upx
behavioral2/memory/3260-680-0x00007FF64D0A0000-0x00007FF64D3F4000-memory.dmp	upx
behavioral2/memory/4348-677-0x00007FF660720000-0x00007FF660A74000-memory.dmp	upx
behavioral2/memory/4960-796-0x00007FF7BF9E0000-0x00007FF7BFD34000-memory.dmp	upx
behavioral2/memory/4296-800-0x00007FF6D53C0000-0x00007FF6D5714000-memory.dmp	upx
behavioral2/memory/3924-799-0x00007FF6C6FF0000-0x00007FF6C7344000-memory.dmp	upx
behavioral2/memory/3188-806-0x00007FF787060000-0x00007FF7873B4000-memory.dmp	upx
behavioral2/memory/4924-810-0x00007FF792A70000-0x00007FF792DC4000-memory.dmp	upx
behavioral2/memory/2172-816-0x00007FF689BF0000-0x00007FF689F44000-memory.dmp	upx
behavioral2/memory/2708-818-0x00007FF73CE40000-0x00007FF73D194000-memory.dmp	upx
behavioral2/memory/3600-817-0x00007FF682320000-0x00007FF682674000-memory.dmp	upx
behavioral2/memory/5032-668-0x00007FF6DAD40000-0x00007FF6DB094000-memory.dmp	upx
behavioral2/files/0x0007000000023422-165.dat	upx
behavioral2/files/0x0007000000023420-163.dat	upx
behavioral2/files/0x0007000000023421-160.dat	upx
behavioral2/files/0x000700000002341f-158.dat	upx
behavioral2/files/0x000700000002341d-148.dat	upx
behavioral2/files/0x000700000002341c-143.dat	upx
behavioral2/files/0x000700000002341b-138.dat	upx
behavioral2/files/0x000700000002341a-133.dat	upx
behavioral2/files/0x0007000000023419-128.dat	upx
behavioral2/files/0x0007000000023417-118.dat	upx
behavioral2/files/0x0007000000023416-113.dat	upx
behavioral2/files/0x0007000000023414-103.dat	upx
behavioral2/files/0x0007000000023413-98.dat	upx
behavioral2/files/0x0007000000023412-93.dat	upx
behavioral2/files/0x0007000000023410-83.dat	upx
behavioral2/files/0x000700000002340f-78.dat	upx
behavioral2/files/0x000700000002340d-68.dat	upx
behavioral2/files/0x000700000002340c-63.dat	upx
behavioral2/files/0x0007000000023408-48.dat	upx
behavioral2/files/0x0007000000023403-36.dat	upx
behavioral2/files/0x0007000000023405-27.dat	upx
behavioral2/files/0x0007000000023404-24.dat	upx
behavioral2/memory/1328-21-0x00007FF663690000-0x00007FF6639E4000-memory.dmp	upx
behavioral2/memory/2572-2151-0x00007FF65D380000-0x00007FF65D6D4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BXVMoxd.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\KlOOyxp.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\dbOUXJy.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\yJdZBjl.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\dLUkZrb.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\NMkJaGS.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZTUcNha.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\iDZpicA.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\vuuzYdy.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\CPWvFaL.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\TsYwHHN.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\VjISFOg.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\XrbuiAx.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ttoVgGX.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\xflSHCp.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\QxFguxd.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\lxAmPcb.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\RWKUWdm.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\aCUohgL.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\hHUBZAp.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ujdtvIL.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\AQgHQyi.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\DOJxenm.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\bAjBuOJ.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\vjfKIHw.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\yAGjDep.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\IYpqojt.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\IzqrOGg.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\LfvGZbr.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\MzGjjtc.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\vRQcqmU.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\qbgqxzj.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\fQKaLdS.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\vsIwaae.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\qIkUmRu.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\mTcWzYA.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\KecMKYh.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\LqdPYlY.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\jOImxsh.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\MAJtWZr.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\esiHVAr.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\SzBLrMw.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\SwshyvN.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\nnyRErm.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\nqppgkO.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ASvzOEg.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\bbaMrWy.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\kTCuQjM.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\YFSGpkh.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\GFGrgXj.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\oXXyXZJ.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\qiddeSQ.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\xaDuKex.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\aviVdoq.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\hEzgcyh.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\zZSaXSC.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ezbhuOg.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\qXTPfvr.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\BYuVEAx.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZzzrFtr.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\Ufoysiq.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\Rlflliu.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\oWWweXI.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
File created	C:\Windows\System\bncRLaO.exe	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1404	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	84
PID 2208 wrote to memory of 1404	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	84
PID 2208 wrote to memory of 1328	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	85
PID 2208 wrote to memory of 1328	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	85
PID 2208 wrote to memory of 2572	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	86
PID 2208 wrote to memory of 2572	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	86
PID 2208 wrote to memory of 3984	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	87
PID 2208 wrote to memory of 3984	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	87
PID 2208 wrote to memory of 5032	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	88
PID 2208 wrote to memory of 5032	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	88
PID 2208 wrote to memory of 2708	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	89
PID 2208 wrote to memory of 2708	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	89
PID 2208 wrote to memory of 3824	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	90
PID 2208 wrote to memory of 3824	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	90
PID 2208 wrote to memory of 4348	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	91
PID 2208 wrote to memory of 4348	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	91
PID 2208 wrote to memory of 3260	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	92
PID 2208 wrote to memory of 3260	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	92
PID 2208 wrote to memory of 552	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	93
PID 2208 wrote to memory of 552	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	93
PID 2208 wrote to memory of 3700	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	94
PID 2208 wrote to memory of 3700	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	94
PID 2208 wrote to memory of 1548	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	95
PID 2208 wrote to memory of 1548	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	95
PID 2208 wrote to memory of 3280	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	96
PID 2208 wrote to memory of 3280	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	96
PID 2208 wrote to memory of 4628	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	97
PID 2208 wrote to memory of 4628	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	97
PID 2208 wrote to memory of 2548	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	98
PID 2208 wrote to memory of 2548	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	98
PID 2208 wrote to memory of 2864	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	99
PID 2208 wrote to memory of 2864	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	99
PID 2208 wrote to memory of 4796	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	100
PID 2208 wrote to memory of 4796	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	100
PID 2208 wrote to memory of 2684	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	101
PID 2208 wrote to memory of 2684	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	101
PID 2208 wrote to memory of 4612	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	102
PID 2208 wrote to memory of 4612	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	102
PID 2208 wrote to memory of 1096	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	103
PID 2208 wrote to memory of 1096	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	103
PID 2208 wrote to memory of 3320	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	104
PID 2208 wrote to memory of 3320	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	104
PID 2208 wrote to memory of 5024	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	105
PID 2208 wrote to memory of 5024	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	105
PID 2208 wrote to memory of 4960	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	106
PID 2208 wrote to memory of 4960	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	106
PID 2208 wrote to memory of 3924	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	107
PID 2208 wrote to memory of 3924	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	107
PID 2208 wrote to memory of 4296	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	108
PID 2208 wrote to memory of 4296	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	108
PID 2208 wrote to memory of 3188	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	109
PID 2208 wrote to memory of 3188	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	109
PID 2208 wrote to memory of 4924	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	110
PID 2208 wrote to memory of 4924	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	110
PID 2208 wrote to memory of 2172	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	111
PID 2208 wrote to memory of 2172	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	111
PID 2208 wrote to memory of 3600	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	112
PID 2208 wrote to memory of 3600	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	112
PID 2208 wrote to memory of 2968	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	113
PID 2208 wrote to memory of 2968	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	113
PID 2208 wrote to memory of 3112	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	114
PID 2208 wrote to memory of 3112	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	114
PID 2208 wrote to memory of 4864	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	115
PID 2208 wrote to memory of 4864	2208	363b77418053c01577e327640d343cd0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\363b77418053c01577e327640d343cd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\363b77418053c01577e327640d343cd0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System\YkGRHWr.exe
  C:\Windows\System\YkGRHWr.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\OKWdqBF.exe
  C:\Windows\System\OKWdqBF.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\HDLanMY.exe
  C:\Windows\System\HDLanMY.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\bsNQitB.exe
  C:\Windows\System\bsNQitB.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\cWNGzDE.exe
  C:\Windows\System\cWNGzDE.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\hTMjvhp.exe
  C:\Windows\System\hTMjvhp.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\KecMKYh.exe
  C:\Windows\System\KecMKYh.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\IyRlVNf.exe
  C:\Windows\System\IyRlVNf.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\DOJxenm.exe
  C:\Windows\System\DOJxenm.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\XFJGlKe.exe
  C:\Windows\System\XFJGlKe.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\ZOIZsol.exe
  C:\Windows\System\ZOIZsol.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\LinSbUE.exe
  C:\Windows\System\LinSbUE.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\vMyElrO.exe
  C:\Windows\System\vMyElrO.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\VVquHCF.exe
  C:\Windows\System\VVquHCF.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\AXBgMoC.exe
  C:\Windows\System\AXBgMoC.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\TyIZwsX.exe
  C:\Windows\System\TyIZwsX.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\YDRNEcF.exe
  C:\Windows\System\YDRNEcF.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\EhPdRHA.exe
  C:\Windows\System\EhPdRHA.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\OfyycGo.exe
  C:\Windows\System\OfyycGo.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\rVuFMSp.exe
  C:\Windows\System\rVuFMSp.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\ryBFFTm.exe
  C:\Windows\System\ryBFFTm.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\EPnJTwR.exe
  C:\Windows\System\EPnJTwR.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\kLNsNdS.exe
  C:\Windows\System\kLNsNdS.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\jtRpoUQ.exe
  C:\Windows\System\jtRpoUQ.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\LjfcZdN.exe
  C:\Windows\System\LjfcZdN.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\NnmMUSk.exe
  C:\Windows\System\NnmMUSk.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\iXzpmUb.exe
  C:\Windows\System\iXzpmUb.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\gwyrzKO.exe
  C:\Windows\System\gwyrzKO.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\srIdTgC.exe
  C:\Windows\System\srIdTgC.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\GFGrgXj.exe
  C:\Windows\System\GFGrgXj.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\omlUQgt.exe
  C:\Windows\System\omlUQgt.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\dbOUXJy.exe
  C:\Windows\System\dbOUXJy.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\kiXvIHI.exe
  C:\Windows\System\kiXvIHI.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\GFIvbCa.exe
  C:\Windows\System\GFIvbCa.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\ncwyCQs.exe
  C:\Windows\System\ncwyCQs.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\uhKQEXl.exe
  C:\Windows\System\uhKQEXl.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\zzffXEJ.exe
  C:\Windows\System\zzffXEJ.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\hRARxbp.exe
  C:\Windows\System\hRARxbp.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\zjgTuCD.exe
  C:\Windows\System\zjgTuCD.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\DePHGIG.exe
  C:\Windows\System\DePHGIG.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\jAEkRgo.exe
  C:\Windows\System\jAEkRgo.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\XrbuiAx.exe
  C:\Windows\System\XrbuiAx.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\XuRxBRU.exe
  C:\Windows\System\XuRxBRU.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\RWKUWdm.exe
  C:\Windows\System\RWKUWdm.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\xYwVBzF.exe
  C:\Windows\System\xYwVBzF.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\kIbejRV.exe
  C:\Windows\System\kIbejRV.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\blQBkjT.exe
  C:\Windows\System\blQBkjT.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\xzFqAVH.exe
  C:\Windows\System\xzFqAVH.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\LqdPYlY.exe
  C:\Windows\System\LqdPYlY.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\kkahwIG.exe
  C:\Windows\System\kkahwIG.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\nqppgkO.exe
  C:\Windows\System\nqppgkO.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\CIzymOw.exe
  C:\Windows\System\CIzymOw.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\ZJpqxyA.exe
  C:\Windows\System\ZJpqxyA.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\aZGPJiX.exe
  C:\Windows\System\aZGPJiX.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\ArnNpGm.exe
  C:\Windows\System\ArnNpGm.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\iDZpicA.exe
  C:\Windows\System\iDZpicA.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\MeHXSmc.exe
  C:\Windows\System\MeHXSmc.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\mPRKMSy.exe
  C:\Windows\System\mPRKMSy.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\LJJjuuF.exe
  C:\Windows\System\LJJjuuF.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\IZLxcBs.exe
  C:\Windows\System\IZLxcBs.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\WMNUJMH.exe
  C:\Windows\System\WMNUJMH.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\xbmSdpR.exe
  C:\Windows\System\xbmSdpR.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\xFaiIUD.exe
  C:\Windows\System\xFaiIUD.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\WmcGkYK.exe
  C:\Windows\System\WmcGkYK.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\NWfWYCi.exe
  C:\Windows\System\NWfWYCi.exe
  2⤵
  PID:2984
- C:\Windows\System\vuuzYdy.exe
  C:\Windows\System\vuuzYdy.exe
  2⤵
  PID:3568
- C:\Windows\System\pPNpDWu.exe
  C:\Windows\System\pPNpDWu.exe
  2⤵
  PID:4468
- C:\Windows\System\bfGFOIi.exe
  C:\Windows\System\bfGFOIi.exe
  2⤵
  PID:532
- C:\Windows\System\yJdZBjl.exe
  C:\Windows\System\yJdZBjl.exe
  2⤵
  PID:2876
- C:\Windows\System\mkHwADt.exe
  C:\Windows\System\mkHwADt.exe
  2⤵
  PID:3728
- C:\Windows\System\YBVSIAh.exe
  C:\Windows\System\YBVSIAh.exe
  2⤵
  PID:4460
- C:\Windows\System\dLUkZrb.exe
  C:\Windows\System\dLUkZrb.exe
  2⤵
  PID:2420
- C:\Windows\System\qkyMdEM.exe
  C:\Windows\System\qkyMdEM.exe
  2⤵
  PID:4436
- C:\Windows\System\gpMgfqR.exe
  C:\Windows\System\gpMgfqR.exe
  2⤵
  PID:1524
- C:\Windows\System\NYrZkEo.exe
  C:\Windows\System\NYrZkEo.exe
  2⤵
  PID:1948
- C:\Windows\System\AzrTRVw.exe
  C:\Windows\System\AzrTRVw.exe
  2⤵
  PID:3532
- C:\Windows\System\ZzzrFtr.exe
  C:\Windows\System\ZzzrFtr.exe
  2⤵
  PID:536
- C:\Windows\System\aCUohgL.exe
  C:\Windows\System\aCUohgL.exe
  2⤵
  PID:5128
- C:\Windows\System\qIPiWPn.exe
  C:\Windows\System\qIPiWPn.exe
  2⤵
  PID:5156
- C:\Windows\System\BzwXtaj.exe
  C:\Windows\System\BzwXtaj.exe
  2⤵
  PID:5184
- C:\Windows\System\dMWwefq.exe
  C:\Windows\System\dMWwefq.exe
  2⤵
  PID:5212
- C:\Windows\System\TYEyLWZ.exe
  C:\Windows\System\TYEyLWZ.exe
  2⤵
  PID:5240
- C:\Windows\System\bAjBuOJ.exe
  C:\Windows\System\bAjBuOJ.exe
  2⤵
  PID:5268
- C:\Windows\System\pWFDvrT.exe
  C:\Windows\System\pWFDvrT.exe
  2⤵
  PID:5296
- C:\Windows\System\EnOpipS.exe
  C:\Windows\System\EnOpipS.exe
  2⤵
  PID:5328
- C:\Windows\System\IjFYVtD.exe
  C:\Windows\System\IjFYVtD.exe
  2⤵
  PID:5352
- C:\Windows\System\qiddeSQ.exe
  C:\Windows\System\qiddeSQ.exe
  2⤵
  PID:5380
- C:\Windows\System\KeufAaw.exe
  C:\Windows\System\KeufAaw.exe
  2⤵
  PID:5408
- C:\Windows\System\hCpGDei.exe
  C:\Windows\System\hCpGDei.exe
  2⤵
  PID:5436
- C:\Windows\System\TUANzbs.exe
  C:\Windows\System\TUANzbs.exe
  2⤵
  PID:5468
- C:\Windows\System\BWhByZE.exe
  C:\Windows\System\BWhByZE.exe
  2⤵
  PID:5492
- C:\Windows\System\qROGbTc.exe
  C:\Windows\System\qROGbTc.exe
  2⤵
  PID:5520
- C:\Windows\System\TawrMdo.exe
  C:\Windows\System\TawrMdo.exe
  2⤵
  PID:5548
- C:\Windows\System\YxfAlZE.exe
  C:\Windows\System\YxfAlZE.exe
  2⤵
  PID:5576
- C:\Windows\System\NaqgkSj.exe
  C:\Windows\System\NaqgkSj.exe
  2⤵
  PID:5604
- C:\Windows\System\rSaYXiJ.exe
  C:\Windows\System\rSaYXiJ.exe
  2⤵
  PID:5632
- C:\Windows\System\xQSThYh.exe
  C:\Windows\System\xQSThYh.exe
  2⤵
  PID:5660
- C:\Windows\System\lhNsTHi.exe
  C:\Windows\System\lhNsTHi.exe
  2⤵
  PID:5692
- C:\Windows\System\nsWoMMY.exe
  C:\Windows\System\nsWoMMY.exe
  2⤵
  PID:5716
- C:\Windows\System\XIUMkgc.exe
  C:\Windows\System\XIUMkgc.exe
  2⤵
  PID:5744
- C:\Windows\System\MkizBfr.exe
  C:\Windows\System\MkizBfr.exe
  2⤵
  PID:5768
- C:\Windows\System\GePcPSj.exe
  C:\Windows\System\GePcPSj.exe
  2⤵
  PID:5800
- C:\Windows\System\vTbWzhW.exe
  C:\Windows\System\vTbWzhW.exe
  2⤵
  PID:5828
- C:\Windows\System\awoBcgN.exe
  C:\Windows\System\awoBcgN.exe
  2⤵
  PID:5856
- C:\Windows\System\YszHrHO.exe
  C:\Windows\System\YszHrHO.exe
  2⤵
  PID:5884
- C:\Windows\System\GOOZQws.exe
  C:\Windows\System\GOOZQws.exe
  2⤵
  PID:5912
- C:\Windows\System\aXErQpY.exe
  C:\Windows\System\aXErQpY.exe
  2⤵
  PID:5936
- C:\Windows\System\ZlBZruJ.exe
  C:\Windows\System\ZlBZruJ.exe
  2⤵
  PID:5968
- C:\Windows\System\htzTUqQ.exe
  C:\Windows\System\htzTUqQ.exe
  2⤵
  PID:5992
- C:\Windows\System\sCjERqH.exe
  C:\Windows\System\sCjERqH.exe
  2⤵
  PID:6024
- C:\Windows\System\RCSdfLJ.exe
  C:\Windows\System\RCSdfLJ.exe
  2⤵
  PID:6052
- C:\Windows\System\qbgqxzj.exe
  C:\Windows\System\qbgqxzj.exe
  2⤵
  PID:6080
- C:\Windows\System\HTvlPyf.exe
  C:\Windows\System\HTvlPyf.exe
  2⤵
  PID:6108
- C:\Windows\System\tMxhIlh.exe
  C:\Windows\System\tMxhIlh.exe
  2⤵
  PID:6136
- C:\Windows\System\ePrUJJt.exe
  C:\Windows\System\ePrUJJt.exe
  2⤵
  PID:2996
- C:\Windows\System\gcfCGUr.exe
  C:\Windows\System\gcfCGUr.exe
  2⤵
  PID:3372
- C:\Windows\System\CtxDmpJ.exe
  C:\Windows\System\CtxDmpJ.exe
  2⤵
  PID:2820
- C:\Windows\System\TtoIwRj.exe
  C:\Windows\System\TtoIwRj.exe
  2⤵
  PID:4532
- C:\Windows\System\kgqrMpY.exe
  C:\Windows\System\kgqrMpY.exe
  2⤵
  PID:224
- C:\Windows\System\aIoeMAc.exe
  C:\Windows\System\aIoeMAc.exe
  2⤵
  PID:3668
- C:\Windows\System\gCDhXGd.exe
  C:\Windows\System\gCDhXGd.exe
  2⤵
  PID:4660
- C:\Windows\System\gnWxfLP.exe
  C:\Windows\System\gnWxfLP.exe
  2⤵
  PID:5196
- C:\Windows\System\dqXVKHn.exe
  C:\Windows\System\dqXVKHn.exe
  2⤵
  PID:5256
- C:\Windows\System\fQKaLdS.exe
  C:\Windows\System\fQKaLdS.exe
  2⤵
  PID:5324
- C:\Windows\System\zwJFIva.exe
  C:\Windows\System\zwJFIva.exe
  2⤵
  PID:5392
- C:\Windows\System\MxufRGe.exe
  C:\Windows\System\MxufRGe.exe
  2⤵
  PID:5452
- C:\Windows\System\WZoklfz.exe
  C:\Windows\System\WZoklfz.exe
  2⤵
  PID:5512
- C:\Windows\System\rYQXgOi.exe
  C:\Windows\System\rYQXgOi.exe
  2⤵
  PID:5568
- C:\Windows\System\zcugrAB.exe
  C:\Windows\System\zcugrAB.exe
  2⤵
  PID:5624
- C:\Windows\System\bHxLWcs.exe
  C:\Windows\System\bHxLWcs.exe
  2⤵
  PID:5700
- C:\Windows\System\dgRasgW.exe
  C:\Windows\System\dgRasgW.exe
  2⤵
  PID:5760
- C:\Windows\System\oSIXXhD.exe
  C:\Windows\System\oSIXXhD.exe
  2⤵
  PID:5820
- C:\Windows\System\ttoVgGX.exe
  C:\Windows\System\ttoVgGX.exe
  2⤵
  PID:5876
- C:\Windows\System\sinCTnF.exe
  C:\Windows\System\sinCTnF.exe
  2⤵
  PID:5956
- C:\Windows\System\fDWddCM.exe
  C:\Windows\System\fDWddCM.exe
  2⤵
  PID:6016
- C:\Windows\System\xezVZdZ.exe
  C:\Windows\System\xezVZdZ.exe
  2⤵
  PID:6092
- C:\Windows\System\YisUiaC.exe
  C:\Windows\System\YisUiaC.exe
  2⤵
  PID:2844
- C:\Windows\System\WjhJtKY.exe
  C:\Windows\System\WjhJtKY.exe
  2⤵
  PID:5028
- C:\Windows\System\TLCkvot.exe
  C:\Windows\System\TLCkvot.exe
  2⤵
  PID:1532
- C:\Windows\System\mcgYkYC.exe
  C:\Windows\System\mcgYkYC.exe
  2⤵
  PID:5148
- C:\Windows\System\lRccedZ.exe
  C:\Windows\System\lRccedZ.exe
  2⤵
  PID:5288
- C:\Windows\System\ICSGOzE.exe
  C:\Windows\System\ICSGOzE.exe
  2⤵
  PID:5428
- C:\Windows\System\oUFQbnq.exe
  C:\Windows\System\oUFQbnq.exe
  2⤵
  PID:5560
- C:\Windows\System\ASvzOEg.exe
  C:\Windows\System\ASvzOEg.exe
  2⤵
  PID:5728
- C:\Windows\System\BxMwWpv.exe
  C:\Windows\System\BxMwWpv.exe
  2⤵
  PID:6172
- C:\Windows\System\FZtlZhz.exe
  C:\Windows\System\FZtlZhz.exe
  2⤵
  PID:6200
- C:\Windows\System\PXPfMuu.exe
  C:\Windows\System\PXPfMuu.exe
  2⤵
  PID:6228
- C:\Windows\System\vmhZYBj.exe
  C:\Windows\System\vmhZYBj.exe
  2⤵
  PID:6256
- C:\Windows\System\YqarTQD.exe
  C:\Windows\System\YqarTQD.exe
  2⤵
  PID:6280
- C:\Windows\System\FzYgaxp.exe
  C:\Windows\System\FzYgaxp.exe
  2⤵
  PID:6308
- C:\Windows\System\pQLzFYy.exe
  C:\Windows\System\pQLzFYy.exe
  2⤵
  PID:6336
- C:\Windows\System\joXaUYy.exe
  C:\Windows\System\joXaUYy.exe
  2⤵
  PID:6364
- C:\Windows\System\oEzBOAa.exe
  C:\Windows\System\oEzBOAa.exe
  2⤵
  PID:6396
- C:\Windows\System\hawyhUJ.exe
  C:\Windows\System\hawyhUJ.exe
  2⤵
  PID:6424
- C:\Windows\System\qxffDSW.exe
  C:\Windows\System\qxffDSW.exe
  2⤵
  PID:6452
- C:\Windows\System\QOIHdDm.exe
  C:\Windows\System\QOIHdDm.exe
  2⤵
  PID:6480
- C:\Windows\System\RzePMmm.exe
  C:\Windows\System\RzePMmm.exe
  2⤵
  PID:6508
- C:\Windows\System\iCuSNNo.exe
  C:\Windows\System\iCuSNNo.exe
  2⤵
  PID:6536
- C:\Windows\System\KBEFymc.exe
  C:\Windows\System\KBEFymc.exe
  2⤵
  PID:6564
- C:\Windows\System\fMCnffp.exe
  C:\Windows\System\fMCnffp.exe
  2⤵
  PID:6592
- C:\Windows\System\HOFfJKF.exe
  C:\Windows\System\HOFfJKF.exe
  2⤵
  PID:6620
- C:\Windows\System\mIuwbou.exe
  C:\Windows\System\mIuwbou.exe
  2⤵
  PID:6648
- C:\Windows\System\saMpCvy.exe
  C:\Windows\System\saMpCvy.exe
  2⤵
  PID:6676
- C:\Windows\System\YLbIjJL.exe
  C:\Windows\System\YLbIjJL.exe
  2⤵
  PID:6704
- C:\Windows\System\GHlNIXx.exe
  C:\Windows\System\GHlNIXx.exe
  2⤵
  PID:6732
- C:\Windows\System\QHAATPY.exe
  C:\Windows\System\QHAATPY.exe
  2⤵
  PID:6760
- C:\Windows\System\cgexOBx.exe
  C:\Windows\System\cgexOBx.exe
  2⤵
  PID:6788
- C:\Windows\System\Cwpxect.exe
  C:\Windows\System\Cwpxect.exe
  2⤵
  PID:6816
- C:\Windows\System\gAszXMP.exe
  C:\Windows\System\gAszXMP.exe
  2⤵
  PID:6844
- C:\Windows\System\Efvnysl.exe
  C:\Windows\System\Efvnysl.exe
  2⤵
  PID:6872
- C:\Windows\System\glGboBV.exe
  C:\Windows\System\glGboBV.exe
  2⤵
  PID:6900
- C:\Windows\System\YDFzpnL.exe
  C:\Windows\System\YDFzpnL.exe
  2⤵
  PID:6928
- C:\Windows\System\OflYGIZ.exe
  C:\Windows\System\OflYGIZ.exe
  2⤵
  PID:6956
- C:\Windows\System\QQcaYQo.exe
  C:\Windows\System\QQcaYQo.exe
  2⤵
  PID:6984
- C:\Windows\System\bjVGNgy.exe
  C:\Windows\System\bjVGNgy.exe
  2⤵
  PID:7012
- C:\Windows\System\cBnYDht.exe
  C:\Windows\System\cBnYDht.exe
  2⤵
  PID:7040
- C:\Windows\System\MLmfIYd.exe
  C:\Windows\System\MLmfIYd.exe
  2⤵
  PID:7068
- C:\Windows\System\IikUAKy.exe
  C:\Windows\System\IikUAKy.exe
  2⤵
  PID:7096
- C:\Windows\System\PrJqFXF.exe
  C:\Windows\System\PrJqFXF.exe
  2⤵
  PID:7124
- C:\Windows\System\mTbrwvd.exe
  C:\Windows\System\mTbrwvd.exe
  2⤵
  PID:7152
- C:\Windows\System\omFmkHS.exe
  C:\Windows\System\omFmkHS.exe
  2⤵
  PID:5792
- C:\Windows\System\fRkmeBu.exe
  C:\Windows\System\fRkmeBu.exe
  2⤵
  PID:5932
- C:\Windows\System\RIixmiO.exe
  C:\Windows\System\RIixmiO.exe
  2⤵
  PID:6120
- C:\Windows\System\sPuNOYk.exe
  C:\Windows\System\sPuNOYk.exe
  2⤵
  PID:3784
- C:\Windows\System\BKYZioY.exe
  C:\Windows\System\BKYZioY.exe
  2⤵
  PID:5232
- C:\Windows\System\ksabyvx.exe
  C:\Windows\System\ksabyvx.exe
  2⤵
  PID:5616
- C:\Windows\System\ZQkRHAp.exe
  C:\Windows\System\ZQkRHAp.exe
  2⤵
  PID:6160
- C:\Windows\System\zmmqULP.exe
  C:\Windows\System\zmmqULP.exe
  2⤵
  PID:6220
- C:\Windows\System\qaBwSRv.exe
  C:\Windows\System\qaBwSRv.exe
  2⤵
  PID:6296
- C:\Windows\System\kTnhkJW.exe
  C:\Windows\System\kTnhkJW.exe
  2⤵
  PID:6356
- C:\Windows\System\fkCTAQi.exe
  C:\Windows\System\fkCTAQi.exe
  2⤵
  PID:6416
- C:\Windows\System\iRzzVjf.exe
  C:\Windows\System\iRzzVjf.exe
  2⤵
  PID:6472
- C:\Windows\System\dpKLAzz.exe
  C:\Windows\System\dpKLAzz.exe
  2⤵
  PID:6548
- C:\Windows\System\WKHaQnY.exe
  C:\Windows\System\WKHaQnY.exe
  2⤵
  PID:6608
- C:\Windows\System\Ufoysiq.exe
  C:\Windows\System\Ufoysiq.exe
  2⤵
  PID:6664
- C:\Windows\System\pRkiDgr.exe
  C:\Windows\System\pRkiDgr.exe
  2⤵
  PID:6716
- C:\Windows\System\eLmZGBO.exe
  C:\Windows\System\eLmZGBO.exe
  2⤵
  PID:6776
- C:\Windows\System\FikUoRY.exe
  C:\Windows\System\FikUoRY.exe
  2⤵
  PID:3584
- C:\Windows\System\eJEwXaa.exe
  C:\Windows\System\eJEwXaa.exe
  2⤵
  PID:1408
- C:\Windows\System\WmVJZDT.exe
  C:\Windows\System\WmVJZDT.exe
  2⤵
  PID:6944
- C:\Windows\System\vsIwaae.exe
  C:\Windows\System\vsIwaae.exe
  2⤵
  PID:7136
- C:\Windows\System\bbaMrWy.exe
  C:\Windows\System\bbaMrWy.exe
  2⤵
  PID:5868
- C:\Windows\System\AsbiDsX.exe
  C:\Windows\System\AsbiDsX.exe
  2⤵
  PID:6044
- C:\Windows\System\MEXyeoQ.exe
  C:\Windows\System\MEXyeoQ.exe
  2⤵
  PID:4052
- C:\Windows\System\YYPAqWI.exe
  C:\Windows\System\YYPAqWI.exe
  2⤵
  PID:5420
- C:\Windows\System\yGCFNUF.exe
  C:\Windows\System\yGCFNUF.exe
  2⤵
  PID:3760
- C:\Windows\System\mlVLONJ.exe
  C:\Windows\System\mlVLONJ.exe
  2⤵
  PID:4376
- C:\Windows\System\KTZrrSe.exe
  C:\Windows\System\KTZrrSe.exe
  2⤵
  PID:6328
- C:\Windows\System\WyPBdAz.exe
  C:\Windows\System\WyPBdAz.exe
  2⤵
  PID:6388
- C:\Windows\System\pPRqcQD.exe
  C:\Windows\System\pPRqcQD.exe
  2⤵
  PID:1384
- C:\Windows\System\pYiALZB.exe
  C:\Windows\System\pYiALZB.exe
  2⤵
  PID:1576
- C:\Windows\System\NJiAzVO.exe
  C:\Windows\System\NJiAzVO.exe
  2⤵
  PID:1620
- C:\Windows\System\aCREteZ.exe
  C:\Windows\System\aCREteZ.exe
  2⤵
  PID:3208
- C:\Windows\System\ZLJsNql.exe
  C:\Windows\System\ZLJsNql.exe
  2⤵
  PID:3108
- C:\Windows\System\cqRmpcX.exe
  C:\Windows\System\cqRmpcX.exe
  2⤵
  PID:6864
- C:\Windows\System\uMuVISh.exe
  C:\Windows\System\uMuVISh.exe
  2⤵
  PID:4948
- C:\Windows\System\DtTEYda.exe
  C:\Windows\System\DtTEYda.exe
  2⤵
  PID:2016
- C:\Windows\System\gmcYVNL.exe
  C:\Windows\System\gmcYVNL.exe
  2⤵
  PID:5736
- C:\Windows\System\tvbRDuZ.exe
  C:\Windows\System\tvbRDuZ.exe
  2⤵
  PID:5672
- C:\Windows\System\FmDQNcK.exe
  C:\Windows\System\FmDQNcK.exe
  2⤵
  PID:4788
- C:\Windows\System\Rlflliu.exe
  C:\Windows\System\Rlflliu.exe
  2⤵
  PID:4600
- C:\Windows\System\sRGkuKD.exe
  C:\Windows\System\sRGkuKD.exe
  2⤵
  PID:2180
- C:\Windows\System\LcHzrgg.exe
  C:\Windows\System\LcHzrgg.exe
  2⤵
  PID:2772
- C:\Windows\System\VPhkcsL.exe
  C:\Windows\System\VPhkcsL.exe
  2⤵
  PID:964
- C:\Windows\System\QbyMLnx.exe
  C:\Windows\System\QbyMLnx.exe
  2⤵
  PID:2340
- C:\Windows\System\xUGWcYk.exe
  C:\Windows\System\xUGWcYk.exe
  2⤵
  PID:7216
- C:\Windows\System\IOhkRrV.exe
  C:\Windows\System\IOhkRrV.exe
  2⤵
  PID:7232
- C:\Windows\System\ppnJvJk.exe
  C:\Windows\System\ppnJvJk.exe
  2⤵
  PID:7256
- C:\Windows\System\ysjRWes.exe
  C:\Windows\System\ysjRWes.exe
  2⤵
  PID:7284
- C:\Windows\System\pYKwSRU.exe
  C:\Windows\System\pYKwSRU.exe
  2⤵
  PID:7312
- C:\Windows\System\dvTQfga.exe
  C:\Windows\System\dvTQfga.exe
  2⤵
  PID:7340
- C:\Windows\System\RZMIQbe.exe
  C:\Windows\System\RZMIQbe.exe
  2⤵
  PID:7372
- C:\Windows\System\lPmIWXH.exe
  C:\Windows\System\lPmIWXH.exe
  2⤵
  PID:7388
- C:\Windows\System\jJzXULH.exe
  C:\Windows\System\jJzXULH.exe
  2⤵
  PID:7416
- C:\Windows\System\zRAmowT.exe
  C:\Windows\System\zRAmowT.exe
  2⤵
  PID:7444
- C:\Windows\System\syiVWDl.exe
  C:\Windows\System\syiVWDl.exe
  2⤵
  PID:7468
- C:\Windows\System\CPWvFaL.exe
  C:\Windows\System\CPWvFaL.exe
  2⤵
  PID:7496
- C:\Windows\System\bCKZqYc.exe
  C:\Windows\System\bCKZqYc.exe
  2⤵
  PID:7524
- C:\Windows\System\tPlQdnC.exe
  C:\Windows\System\tPlQdnC.exe
  2⤵
  PID:7568
- C:\Windows\System\BwEJoLf.exe
  C:\Windows\System\BwEJoLf.exe
  2⤵
  PID:7604
- C:\Windows\System\YgdaUsL.exe
  C:\Windows\System\YgdaUsL.exe
  2⤵
  PID:7620
- C:\Windows\System\kpdpgnw.exe
  C:\Windows\System\kpdpgnw.exe
  2⤵
  PID:7668
- C:\Windows\System\uIaedYO.exe
  C:\Windows\System\uIaedYO.exe
  2⤵
  PID:7684
- C:\Windows\System\MXowwQu.exe
  C:\Windows\System\MXowwQu.exe
  2⤵
  PID:7828
- C:\Windows\System\mCTNhFx.exe
  C:\Windows\System\mCTNhFx.exe
  2⤵
  PID:7864
- C:\Windows\System\oVBRuTU.exe
  C:\Windows\System\oVBRuTU.exe
  2⤵
  PID:7892
- C:\Windows\System\qIkUmRu.exe
  C:\Windows\System\qIkUmRu.exe
  2⤵
  PID:7932
- C:\Windows\System\sYjXArN.exe
  C:\Windows\System\sYjXArN.exe
  2⤵
  PID:7948
- C:\Windows\System\GFGkvjj.exe
  C:\Windows\System\GFGkvjj.exe
  2⤵
  PID:7964
- C:\Windows\System\bqJfJYI.exe
  C:\Windows\System\bqJfJYI.exe
  2⤵
  PID:7992
- C:\Windows\System\DQUTEUl.exe
  C:\Windows\System\DQUTEUl.exe
  2⤵
  PID:8020
- C:\Windows\System\rQLIAnL.exe
  C:\Windows\System\rQLIAnL.exe
  2⤵
  PID:8048
- C:\Windows\System\fZkqVDZ.exe
  C:\Windows\System\fZkqVDZ.exe
  2⤵
  PID:8100
- C:\Windows\System\ktOTUlQ.exe
  C:\Windows\System\ktOTUlQ.exe
  2⤵
  PID:8116
- C:\Windows\System\IzqrOGg.exe
  C:\Windows\System\IzqrOGg.exe
  2⤵
  PID:8156
- C:\Windows\System\AOelVfd.exe
  C:\Windows\System\AOelVfd.exe
  2⤵
  PID:8172
- C:\Windows\System\qafOjVs.exe
  C:\Windows\System\qafOjVs.exe
  2⤵
  PID:8188
- C:\Windows\System\KjVwmlc.exe
  C:\Windows\System\KjVwmlc.exe
  2⤵
  PID:4440
- C:\Windows\System\gwnpIPo.exe
  C:\Windows\System\gwnpIPo.exe
  2⤵
  PID:6752
- C:\Windows\System\CXBptgC.exe
  C:\Windows\System\CXBptgC.exe
  2⤵
  PID:7212
- C:\Windows\System\OnYHdgy.exe
  C:\Windows\System\OnYHdgy.exe
  2⤵
  PID:7276
- C:\Windows\System\PDuCwMW.exe
  C:\Windows\System\PDuCwMW.exe
  2⤵
  PID:7352
- C:\Windows\System\RrAIPfT.exe
  C:\Windows\System\RrAIPfT.exe
  2⤵
  PID:7400
- C:\Windows\System\CsSjtov.exe
  C:\Windows\System\CsSjtov.exe
  2⤵
  PID:7516
- C:\Windows\System\uicJIEC.exe
  C:\Windows\System\uicJIEC.exe
  2⤵
  PID:7596
- C:\Windows\System\aQWNdhw.exe
  C:\Windows\System\aQWNdhw.exe
  2⤵
  PID:7616
- C:\Windows\System\GfYmrva.exe
  C:\Windows\System\GfYmrva.exe
  2⤵
  PID:7704
- C:\Windows\System\FQuhqON.exe
  C:\Windows\System\FQuhqON.exe
  2⤵
  PID:2788
- C:\Windows\System\oMCLjCd.exe
  C:\Windows\System\oMCLjCd.exe
  2⤵
  PID:6384
- C:\Windows\System\oWWweXI.exe
  C:\Windows\System\oWWweXI.exe
  2⤵
  PID:7056
- C:\Windows\System\MpmbPda.exe
  C:\Windows\System\MpmbPda.exe
  2⤵
  PID:7884
- C:\Windows\System\WhqhVMx.exe
  C:\Windows\System\WhqhVMx.exe
  2⤵
  PID:7580
- C:\Windows\System\jOImxsh.exe
  C:\Windows\System\jOImxsh.exe
  2⤵
  PID:8008
- C:\Windows\System\mgAXamf.exe
  C:\Windows\System\mgAXamf.exe
  2⤵
  PID:8056
- C:\Windows\System\KSsbBkh.exe
  C:\Windows\System\KSsbBkh.exe
  2⤵
  PID:8112
- C:\Windows\System\PIkLYHJ.exe
  C:\Windows\System\PIkLYHJ.exe
  2⤵
  PID:8180
- C:\Windows\System\mIXouoB.exe
  C:\Windows\System\mIXouoB.exe
  2⤵
  PID:4868
- C:\Windows\System\SCqBOkd.exe
  C:\Windows\System\SCqBOkd.exe
  2⤵
  PID:7248
- C:\Windows\System\roBRwtb.exe
  C:\Windows\System\roBRwtb.exe
  2⤵
  PID:7492
- C:\Windows\System\nKlqAbF.exe
  C:\Windows\System\nKlqAbF.exe
  2⤵
  PID:7556
- C:\Windows\System\eKwgtrA.exe
  C:\Windows\System\eKwgtrA.exe
  2⤵
  PID:7736
- C:\Windows\System\xoKaMJX.exe
  C:\Windows\System\xoKaMJX.exe
  2⤵
  PID:7820
- C:\Windows\System\aabNMyl.exe
  C:\Windows\System\aabNMyl.exe
  2⤵
  PID:7956
- C:\Windows\System\PqPOYaC.exe
  C:\Windows\System\PqPOYaC.exe
  2⤵
  PID:7960
- C:\Windows\System\cpLGyOK.exe
  C:\Windows\System\cpLGyOK.exe
  2⤵
  PID:1688
- C:\Windows\System\WtfOKZK.exe
  C:\Windows\System\WtfOKZK.exe
  2⤵
  PID:7464
- C:\Windows\System\wznJlrk.exe
  C:\Windows\System\wznJlrk.exe
  2⤵
  PID:8096
- C:\Windows\System\SbbPscF.exe
  C:\Windows\System\SbbPscF.exe
  2⤵
  PID:7384
- C:\Windows\System\GAzJbtj.exe
  C:\Windows\System\GAzJbtj.exe
  2⤵
  PID:8212
- C:\Windows\System\rBkDUNn.exe
  C:\Windows\System\rBkDUNn.exe
  2⤵
  PID:8244
- C:\Windows\System\BkJeTtV.exe
  C:\Windows\System\BkJeTtV.exe
  2⤵
  PID:8260
- C:\Windows\System\izdTuqk.exe
  C:\Windows\System\izdTuqk.exe
  2⤵
  PID:8288
- C:\Windows\System\hHUBZAp.exe
  C:\Windows\System\hHUBZAp.exe
  2⤵
  PID:8316
- C:\Windows\System\nkpZmlA.exe
  C:\Windows\System\nkpZmlA.exe
  2⤵
  PID:8344
- C:\Windows\System\ujdtvIL.exe
  C:\Windows\System\ujdtvIL.exe
  2⤵
  PID:8372
- C:\Windows\System\WAPqqCh.exe
  C:\Windows\System\WAPqqCh.exe
  2⤵
  PID:8392
- C:\Windows\System\vjVBHDi.exe
  C:\Windows\System\vjVBHDi.exe
  2⤵
  PID:8428
- C:\Windows\System\xaDuKex.exe
  C:\Windows\System\xaDuKex.exe
  2⤵
  PID:8460
- C:\Windows\System\tGQrYrD.exe
  C:\Windows\System\tGQrYrD.exe
  2⤵
  PID:8488
- C:\Windows\System\YfMoBYR.exe
  C:\Windows\System\YfMoBYR.exe
  2⤵
  PID:8508
- C:\Windows\System\TALpsge.exe
  C:\Windows\System\TALpsge.exe
  2⤵
  PID:8544
- C:\Windows\System\MAJtWZr.exe
  C:\Windows\System\MAJtWZr.exe
  2⤵
  PID:8568
- C:\Windows\System\bOjCTHJ.exe
  C:\Windows\System\bOjCTHJ.exe
  2⤵
  PID:8596
- C:\Windows\System\oJRQJcn.exe
  C:\Windows\System\oJRQJcn.exe
  2⤵
  PID:8616
- C:\Windows\System\xYypSNn.exe
  C:\Windows\System\xYypSNn.exe
  2⤵
  PID:8652
- C:\Windows\System\beawdHE.exe
  C:\Windows\System\beawdHE.exe
  2⤵
  PID:8692
- C:\Windows\System\LHeoCtZ.exe
  C:\Windows\System\LHeoCtZ.exe
  2⤵
  PID:8720
- C:\Windows\System\muvNTWn.exe
  C:\Windows\System\muvNTWn.exe
  2⤵
  PID:8748
- C:\Windows\System\xflSHCp.exe
  C:\Windows\System\xflSHCp.exe
  2⤵
  PID:8764
- C:\Windows\System\hEzgcyh.exe
  C:\Windows\System\hEzgcyh.exe
  2⤵
  PID:8792
- C:\Windows\System\HjCgMpx.exe
  C:\Windows\System\HjCgMpx.exe
  2⤵
  PID:8832
- C:\Windows\System\LOgfOqY.exe
  C:\Windows\System\LOgfOqY.exe
  2⤵
  PID:8860
- C:\Windows\System\bEGBeMl.exe
  C:\Windows\System\bEGBeMl.exe
  2⤵
  PID:8888
- C:\Windows\System\vjfKIHw.exe
  C:\Windows\System\vjfKIHw.exe
  2⤵
  PID:8916
- C:\Windows\System\jKDYlUq.exe
  C:\Windows\System\jKDYlUq.exe
  2⤵
  PID:8932
- C:\Windows\System\fiKyBYD.exe
  C:\Windows\System\fiKyBYD.exe
  2⤵
  PID:8956
- C:\Windows\System\mCCjIZx.exe
  C:\Windows\System\mCCjIZx.exe
  2⤵
  PID:8988
- C:\Windows\System\gCFuHna.exe
  C:\Windows\System\gCFuHna.exe
  2⤵
  PID:9016
- C:\Windows\System\uFWLhqt.exe
  C:\Windows\System\uFWLhqt.exe
  2⤵
  PID:9036
- C:\Windows\System\LqjChHI.exe
  C:\Windows\System\LqjChHI.exe
  2⤵
  PID:9056
- C:\Windows\System\kTCuQjM.exe
  C:\Windows\System\kTCuQjM.exe
  2⤵
  PID:9088
- C:\Windows\System\oZBMpLl.exe
  C:\Windows\System\oZBMpLl.exe
  2⤵
  PID:9128
- C:\Windows\System\ziRqRDi.exe
  C:\Windows\System\ziRqRDi.exe
  2⤵
  PID:9152
- C:\Windows\System\DNPldCY.exe
  C:\Windows\System\DNPldCY.exe
  2⤵
  PID:9176
- C:\Windows\System\gEZrHHv.exe
  C:\Windows\System\gEZrHHv.exe
  2⤵
  PID:9200
- C:\Windows\System\RzJeJFv.exe
  C:\Windows\System\RzJeJFv.exe
  2⤵
  PID:8272
- C:\Windows\System\YIMJayL.exe
  C:\Windows\System\YIMJayL.exe
  2⤵
  PID:8328
- C:\Windows\System\YUykVxI.exe
  C:\Windows\System\YUykVxI.exe
  2⤵
  PID:8404
- C:\Windows\System\OyCvvnF.exe
  C:\Windows\System\OyCvvnF.exe
  2⤵
  PID:8472
- C:\Windows\System\PbVmjPL.exe
  C:\Windows\System\PbVmjPL.exe
  2⤵
  PID:8552
- C:\Windows\System\bncRLaO.exe
  C:\Windows\System\bncRLaO.exe
  2⤵
  PID:8524
- C:\Windows\System\DgHcsGd.exe
  C:\Windows\System\DgHcsGd.exe
  2⤵
  PID:8612
- C:\Windows\System\DrIckhG.exe
  C:\Windows\System\DrIckhG.exe
  2⤵
  PID:8732
- C:\Windows\System\OhQoNDX.exe
  C:\Windows\System\OhQoNDX.exe
  2⤵
  PID:8760
- C:\Windows\System\KsgkGWb.exe
  C:\Windows\System\KsgkGWb.exe
  2⤵
  PID:8848
- C:\Windows\System\UNyCSxl.exe
  C:\Windows\System\UNyCSxl.exe
  2⤵
  PID:8908
- C:\Windows\System\sdJoMKL.exe
  C:\Windows\System\sdJoMKL.exe
  2⤵
  PID:8952
- C:\Windows\System\etaeVQZ.exe
  C:\Windows\System\etaeVQZ.exe
  2⤵
  PID:9004
- C:\Windows\System\gJiZUee.exe
  C:\Windows\System\gJiZUee.exe
  2⤵
  PID:9048
- C:\Windows\System\xffLsmL.exe
  C:\Windows\System\xffLsmL.exe
  2⤵
  PID:9112
- C:\Windows\System\lsRKoZx.exe
  C:\Windows\System\lsRKoZx.exe
  2⤵
  PID:9192
- C:\Windows\System\LJhChRs.exe
  C:\Windows\System\LJhChRs.exe
  2⤵
  PID:8416
- C:\Windows\System\SJKVyxO.exe
  C:\Windows\System\SJKVyxO.exe
  2⤵
  PID:8528
- C:\Windows\System\LJrigUG.exe
  C:\Windows\System\LJrigUG.exe
  2⤵
  PID:8636
- C:\Windows\System\KLJVHHu.exe
  C:\Windows\System\KLJVHHu.exe
  2⤵
  PID:8884
- C:\Windows\System\AncuDQj.exe
  C:\Windows\System\AncuDQj.exe
  2⤵
  PID:8904
- C:\Windows\System\hWtzVaj.exe
  C:\Windows\System\hWtzVaj.exe
  2⤵
  PID:9076
- C:\Windows\System\lxQcQmR.exe
  C:\Windows\System\lxQcQmR.exe
  2⤵
  PID:8560
- C:\Windows\System\UPnezdY.exe
  C:\Windows\System\UPnezdY.exe
  2⤵
  PID:8756
- C:\Windows\System\AQFafeL.exe
  C:\Windows\System\AQFafeL.exe
  2⤵
  PID:9028
- C:\Windows\System\BGgryvq.exe
  C:\Windows\System\BGgryvq.exe
  2⤵
  PID:9164
- C:\Windows\System\olIaZkt.exe
  C:\Windows\System\olIaZkt.exe
  2⤵
  PID:8984
- C:\Windows\System\osqzGst.exe
  C:\Windows\System\osqzGst.exe
  2⤵
  PID:9252
- C:\Windows\System\esiHVAr.exe
  C:\Windows\System\esiHVAr.exe
  2⤵
  PID:9268
- C:\Windows\System\hDpbqMz.exe
  C:\Windows\System\hDpbqMz.exe
  2⤵
  PID:9292
- C:\Windows\System\fVnVbAw.exe
  C:\Windows\System\fVnVbAw.exe
  2⤵
  PID:9324
- C:\Windows\System\yPgrorn.exe
  C:\Windows\System\yPgrorn.exe
  2⤵
  PID:9364
- C:\Windows\System\NApnZjX.exe
  C:\Windows\System\NApnZjX.exe
  2⤵
  PID:9392
- C:\Windows\System\jyZyhNv.exe
  C:\Windows\System\jyZyhNv.exe
  2⤵
  PID:9420
- C:\Windows\System\xRcnBpA.exe
  C:\Windows\System\xRcnBpA.exe
  2⤵
  PID:9460
- C:\Windows\System\UlhXhWJ.exe
  C:\Windows\System\UlhXhWJ.exe
  2⤵
  PID:9476
- C:\Windows\System\BXVMoxd.exe
  C:\Windows\System\BXVMoxd.exe
  2⤵
  PID:9516
- C:\Windows\System\NlbwIaT.exe
  C:\Windows\System\NlbwIaT.exe
  2⤵
  PID:9544
- C:\Windows\System\kNvMqmZ.exe
  C:\Windows\System\kNvMqmZ.exe
  2⤵
  PID:9572
- C:\Windows\System\fzuFLue.exe
  C:\Windows\System\fzuFLue.exe
  2⤵
  PID:9600
- C:\Windows\System\YFSGpkh.exe
  C:\Windows\System\YFSGpkh.exe
  2⤵
  PID:9628
- C:\Windows\System\BKVxLpg.exe
  C:\Windows\System\BKVxLpg.exe
  2⤵
  PID:9656
- C:\Windows\System\hrFSfFw.exe
  C:\Windows\System\hrFSfFw.exe
  2⤵
  PID:9672
- C:\Windows\System\qDQSJce.exe
  C:\Windows\System\qDQSJce.exe
  2⤵
  PID:9700
- C:\Windows\System\kJqftDY.exe
  C:\Windows\System\kJqftDY.exe
  2⤵
  PID:9728
- C:\Windows\System\DElZzZw.exe
  C:\Windows\System\DElZzZw.exe
  2⤵
  PID:9756
- C:\Windows\System\oEfwjSW.exe
  C:\Windows\System\oEfwjSW.exe
  2⤵
  PID:9776
- C:\Windows\System\yVGZVcS.exe
  C:\Windows\System\yVGZVcS.exe
  2⤵
  PID:9800
- C:\Windows\System\JvjYoHt.exe
  C:\Windows\System\JvjYoHt.exe
  2⤵
  PID:9824
- C:\Windows\System\AGtEgjs.exe
  C:\Windows\System\AGtEgjs.exe
  2⤵
  PID:9880
- C:\Windows\System\faLyJwE.exe
  C:\Windows\System\faLyJwE.exe
  2⤵
  PID:9896
- C:\Windows\System\pHCWzSW.exe
  C:\Windows\System\pHCWzSW.exe
  2⤵
  PID:9916
- C:\Windows\System\ZBRHUbF.exe
  C:\Windows\System\ZBRHUbF.exe
  2⤵
  PID:9944
- C:\Windows\System\hGpMmIQ.exe
  C:\Windows\System\hGpMmIQ.exe
  2⤵
  PID:9980
- C:\Windows\System\TTdMNDt.exe
  C:\Windows\System\TTdMNDt.exe
  2⤵
  PID:9996
- C:\Windows\System\IgrKvPV.exe
  C:\Windows\System\IgrKvPV.exe
  2⤵
  PID:10024
- C:\Windows\System\grGRPeb.exe
  C:\Windows\System\grGRPeb.exe
  2⤵
  PID:10044
- C:\Windows\System\TsYwHHN.exe
  C:\Windows\System\TsYwHHN.exe
  2⤵
  PID:10088
- C:\Windows\System\MbQCSrg.exe
  C:\Windows\System\MbQCSrg.exe
  2⤵
  PID:10108
- C:\Windows\System\uYVOQcH.exe
  C:\Windows\System\uYVOQcH.exe
  2⤵
  PID:10124
- C:\Windows\System\VxsbHZc.exe
  C:\Windows\System\VxsbHZc.exe
  2⤵
  PID:10148
- C:\Windows\System\gaOKKPG.exe
  C:\Windows\System\gaOKKPG.exe
  2⤵
  PID:10176
- C:\Windows\System\BHqqXBd.exe
  C:\Windows\System\BHqqXBd.exe
  2⤵
  PID:10220
- C:\Windows\System\gbwyWdt.exe
  C:\Windows\System\gbwyWdt.exe
  2⤵
  PID:9240
- C:\Windows\System\LWGWtvH.exe
  C:\Windows\System\LWGWtvH.exe
  2⤵
  PID:9308
- C:\Windows\System\zZSaXSC.exe
  C:\Windows\System\zZSaXSC.exe
  2⤵
  PID:9336
- C:\Windows\System\ceZAJyS.exe
  C:\Windows\System\ceZAJyS.exe
  2⤵
  PID:9412
- C:\Windows\System\hrAtJsD.exe
  C:\Windows\System\hrAtJsD.exe
  2⤵
  PID:9488
- C:\Windows\System\ezbhuOg.exe
  C:\Windows\System\ezbhuOg.exe
  2⤵
  PID:9528
- C:\Windows\System\GVjbzMb.exe
  C:\Windows\System\GVjbzMb.exe
  2⤵
  PID:9624
- C:\Windows\System\dPRMUch.exe
  C:\Windows\System\dPRMUch.exe
  2⤵
  PID:9664
- C:\Windows\System\UrxwVpd.exe
  C:\Windows\System\UrxwVpd.exe
  2⤵
  PID:9740
- C:\Windows\System\wYfVatp.exe
  C:\Windows\System\wYfVatp.exe
  2⤵
  PID:9868
- C:\Windows\System\hXTdzRr.exe
  C:\Windows\System\hXTdzRr.exe
  2⤵
  PID:9892
- C:\Windows\System\oWyRUBW.exe
  C:\Windows\System\oWyRUBW.exe
  2⤵
  PID:9908
- C:\Windows\System\dhoWFOA.exe
  C:\Windows\System\dhoWFOA.exe
  2⤵
  PID:9940
- C:\Windows\System\EJsvrCc.exe
  C:\Windows\System\EJsvrCc.exe
  2⤵
  PID:9992
- C:\Windows\System\kqvezRk.exe
  C:\Windows\System\kqvezRk.exe
  2⤵
  PID:10060
- C:\Windows\System\DhnMhrg.exe
  C:\Windows\System\DhnMhrg.exe
  2⤵
  PID:10184
- C:\Windows\System\ZVRbyib.exe
  C:\Windows\System\ZVRbyib.exe
  2⤵
  PID:9284
- C:\Windows\System\AItgeeK.exe
  C:\Windows\System\AItgeeK.exe
  2⤵
  PID:9444
- C:\Windows\System\hKkJttE.exe
  C:\Windows\System\hKkJttE.exe
  2⤵
  PID:9504
- C:\Windows\System\saMMwMk.exe
  C:\Windows\System\saMMwMk.exe
  2⤵
  PID:9764
- C:\Windows\System\pQIjLAS.exe
  C:\Windows\System\pQIjLAS.exe
  2⤵
  PID:10012
- C:\Windows\System\CMtRqXR.exe
  C:\Windows\System\CMtRqXR.exe
  2⤵
  PID:10168
- C:\Windows\System\DYfQmJd.exe
  C:\Windows\System\DYfQmJd.exe
  2⤵
  PID:9232
- C:\Windows\System\rQObLkz.exe
  C:\Windows\System\rQObLkz.exe
  2⤵
  PID:9236
- C:\Windows\System\uuOtwdb.exe
  C:\Windows\System\uuOtwdb.exe
  2⤵
  PID:9792
- C:\Windows\System\mTcWzYA.exe
  C:\Windows\System\mTcWzYA.exe
  2⤵
  PID:9904
- C:\Windows\System\fAHmplE.exe
  C:\Windows\System\fAHmplE.exe
  2⤵
  PID:9356
- C:\Windows\System\hZgnVMB.exe
  C:\Windows\System\hZgnVMB.exe
  2⤵
  PID:10272
- C:\Windows\System\OxSCmOW.exe
  C:\Windows\System\OxSCmOW.exe
  2⤵
  PID:10288
- C:\Windows\System\gNbBRgU.exe
  C:\Windows\System\gNbBRgU.exe
  2⤵
  PID:10316
- C:\Windows\System\zXvmtah.exe
  C:\Windows\System\zXvmtah.exe
  2⤵
  PID:10352
- C:\Windows\System\cSbYqFm.exe
  C:\Windows\System\cSbYqFm.exe
  2⤵
  PID:10384
- C:\Windows\System\pNwHehh.exe
  C:\Windows\System\pNwHehh.exe
  2⤵
  PID:10408
- C:\Windows\System\vTClums.exe
  C:\Windows\System\vTClums.exe
  2⤵
  PID:10436
- C:\Windows\System\YJtXgsm.exe
  C:\Windows\System\YJtXgsm.exe
  2⤵
  PID:10464
- C:\Windows\System\iPlCbPF.exe
  C:\Windows\System\iPlCbPF.exe
  2⤵
  PID:10480
- C:\Windows\System\RALdKlK.exe
  C:\Windows\System\RALdKlK.exe
  2⤵
  PID:10516
- C:\Windows\System\jKDYrTe.exe
  C:\Windows\System\jKDYrTe.exe
  2⤵
  PID:10556
- C:\Windows\System\HaKCYEx.exe
  C:\Windows\System\HaKCYEx.exe
  2⤵
  PID:10592
- C:\Windows\System\ECwkZCc.exe
  C:\Windows\System\ECwkZCc.exe
  2⤵
  PID:10624
- C:\Windows\System\lwcUWHP.exe
  C:\Windows\System\lwcUWHP.exe
  2⤵
  PID:10660
- C:\Windows\System\cpzfltW.exe
  C:\Windows\System\cpzfltW.exe
  2⤵
  PID:10676
- C:\Windows\System\QxFguxd.exe
  C:\Windows\System\QxFguxd.exe
  2⤵
  PID:10716
- C:\Windows\System\AQgHQyi.exe
  C:\Windows\System\AQgHQyi.exe
  2⤵
  PID:10744
- C:\Windows\System\bysmrRx.exe
  C:\Windows\System\bysmrRx.exe
  2⤵
  PID:10760
- C:\Windows\System\HBQkeGx.exe
  C:\Windows\System\HBQkeGx.exe
  2⤵
  PID:10788
- C:\Windows\System\IafpgxZ.exe
  C:\Windows\System\IafpgxZ.exe
  2⤵
  PID:10816
- C:\Windows\System\jzUfykk.exe
  C:\Windows\System\jzUfykk.exe
  2⤵
  PID:10848
- C:\Windows\System\ChaDrAo.exe
  C:\Windows\System\ChaDrAo.exe
  2⤵
  PID:10884
- C:\Windows\System\yFnULmh.exe
  C:\Windows\System\yFnULmh.exe
  2⤵
  PID:10904
- C:\Windows\System\ZdGwLrN.exe
  C:\Windows\System\ZdGwLrN.exe
  2⤵
  PID:10928
- C:\Windows\System\uMqoDrI.exe
  C:\Windows\System\uMqoDrI.exe
  2⤵
  PID:10948
- C:\Windows\System\CJUwTTe.exe
  C:\Windows\System\CJUwTTe.exe
  2⤵
  PID:10972
- C:\Windows\System\CtprLCn.exe
  C:\Windows\System\CtprLCn.exe
  2⤵
  PID:10988
- C:\Windows\System\qXTPfvr.exe
  C:\Windows\System\qXTPfvr.exe
  2⤵
  PID:11020
- C:\Windows\System\fsmESoP.exe
  C:\Windows\System\fsmESoP.exe
  2⤵
  PID:11048
- C:\Windows\System\DBXvKMz.exe
  C:\Windows\System\DBXvKMz.exe
  2⤵
  PID:11076
- C:\Windows\System\lknOaMU.exe
  C:\Windows\System\lknOaMU.exe
  2⤵
  PID:11100
- C:\Windows\System\RGnezOc.exe
  C:\Windows\System\RGnezOc.exe
  2⤵
  PID:11144
- C:\Windows\System\IhocviV.exe
  C:\Windows\System\IhocviV.exe
  2⤵
  PID:11168
- C:\Windows\System\lMJvpaC.exe
  C:\Windows\System\lMJvpaC.exe
  2⤵
  PID:11204
- C:\Windows\System\fzHNiyE.exe
  C:\Windows\System\fzHNiyE.exe
  2⤵
  PID:11232
- C:\Windows\System\jTmwDbP.exe
  C:\Windows\System\jTmwDbP.exe
  2⤵
  PID:9684
- C:\Windows\System\yAGjDep.exe
  C:\Windows\System\yAGjDep.exe
  2⤵
  PID:9280
- C:\Windows\System\qQvYhCw.exe
  C:\Windows\System\qQvYhCw.exe
  2⤵
  PID:10264
- C:\Windows\System\BWIqzzS.exe
  C:\Windows\System\BWIqzzS.exe
  2⤵
  PID:10340
- C:\Windows\System\GxBoWUJ.exe
  C:\Windows\System\GxBoWUJ.exe
  2⤵
  PID:10396
- C:\Windows\System\qZEzaiV.exe
  C:\Windows\System\qZEzaiV.exe
  2⤵
  PID:10472
- C:\Windows\System\cnQYZqY.exe
  C:\Windows\System\cnQYZqY.exe
  2⤵
  PID:10564
- C:\Windows\System\LBUPsIV.exe
  C:\Windows\System\LBUPsIV.exe
  2⤵
  PID:10608
- C:\Windows\System\HMBLvCe.exe
  C:\Windows\System\HMBLvCe.exe
  2⤵
  PID:10668
- C:\Windows\System\Aigcmnj.exe
  C:\Windows\System\Aigcmnj.exe
  2⤵
  PID:10712
- C:\Windows\System\zAxiKQB.exe
  C:\Windows\System\zAxiKQB.exe
  2⤵
  PID:10780
- C:\Windows\System\LOrzZQi.exe
  C:\Windows\System\LOrzZQi.exe
  2⤵
  PID:10832
- C:\Windows\System\baXfStm.exe
  C:\Windows\System\baXfStm.exe
  2⤵
  PID:10912
- C:\Windows\System\iBUDlih.exe
  C:\Windows\System\iBUDlih.exe
  2⤵
  PID:10984
- C:\Windows\System\CnIuskA.exe
  C:\Windows\System\CnIuskA.exe
  2⤵
  PID:11032
- C:\Windows\System\ZqcACzU.exe
  C:\Windows\System\ZqcACzU.exe
  2⤵
  PID:11132
- C:\Windows\System\jZGxWGf.exe
  C:\Windows\System\jZGxWGf.exe
  2⤵
  PID:10236
- C:\Windows\System\mjcNhlE.exe
  C:\Windows\System\mjcNhlE.exe
  2⤵
  PID:10364
- C:\Windows\System\IYpqojt.exe
  C:\Windows\System\IYpqojt.exe
  2⤵
  PID:10424
- C:\Windows\System\tSaDNuD.exe
  C:\Windows\System\tSaDNuD.exe
  2⤵
  PID:10552
- C:\Windows\System\JyLGCkp.exe
  C:\Windows\System\JyLGCkp.exe
  2⤵
  PID:10696
- C:\Windows\System\IYkxZUg.exe
  C:\Windows\System\IYkxZUg.exe
  2⤵
  PID:10772
- C:\Windows\System\EMxZqLa.exe
  C:\Windows\System\EMxZqLa.exe
  2⤵
  PID:10956
- C:\Windows\System\STVSuOA.exe
  C:\Windows\System\STVSuOA.exe
  2⤵
  PID:11124
- C:\Windows\System\WQgcbQl.exe
  C:\Windows\System\WQgcbQl.exe
  2⤵
  PID:10336
- C:\Windows\System\SzBLrMw.exe
  C:\Windows\System\SzBLrMw.exe
  2⤵
  PID:10644
- C:\Windows\System\LfvGZbr.exe
  C:\Windows\System\LfvGZbr.exe
  2⤵
  PID:2484
- C:\Windows\System\AVgWlIb.exe
  C:\Windows\System\AVgWlIb.exe
  2⤵
  PID:10648
- C:\Windows\System\FxWWORR.exe
  C:\Windows\System\FxWWORR.exe
  2⤵
  PID:10756
- C:\Windows\System\jbvKODT.exe
  C:\Windows\System\jbvKODT.exe
  2⤵
  PID:10116
- C:\Windows\System\dYLpFIm.exe
  C:\Windows\System\dYLpFIm.exe
  2⤵
  PID:11296
- C:\Windows\System\vAweOzG.exe
  C:\Windows\System\vAweOzG.exe
  2⤵
  PID:11320
- C:\Windows\System\rKFkokA.exe
  C:\Windows\System\rKFkokA.exe
  2⤵
  PID:11344
- C:\Windows\System\mnjrkPk.exe
  C:\Windows\System\mnjrkPk.exe
  2⤵
  PID:11368
- C:\Windows\System\aweeFGZ.exe
  C:\Windows\System\aweeFGZ.exe
  2⤵
  PID:11404
- C:\Windows\System\BiIAZjR.exe
  C:\Windows\System\BiIAZjR.exe
  2⤵
  PID:11424
- C:\Windows\System\aDiVqNA.exe
  C:\Windows\System\aDiVqNA.exe
  2⤵
  PID:11452
- C:\Windows\System\BjNrOde.exe
  C:\Windows\System\BjNrOde.exe
  2⤵
  PID:11468
- C:\Windows\System\juVsNnn.exe
  C:\Windows\System\juVsNnn.exe
  2⤵
  PID:11496
- C:\Windows\System\AbcvJJA.exe
  C:\Windows\System\AbcvJJA.exe
  2⤵
  PID:11560
- C:\Windows\System\HocYgKY.exe
  C:\Windows\System\HocYgKY.exe
  2⤵
  PID:11588
- C:\Windows\System\caJNqwu.exe
  C:\Windows\System\caJNqwu.exe
  2⤵
  PID:11616
- C:\Windows\System\lyeetLN.exe
  C:\Windows\System\lyeetLN.exe
  2⤵
  PID:11636
- C:\Windows\System\YeWZHXb.exe
  C:\Windows\System\YeWZHXb.exe
  2⤵
  PID:11660
- C:\Windows\System\jvSUqyC.exe
  C:\Windows\System\jvSUqyC.exe
  2⤵
  PID:11688
- C:\Windows\System\NlSuiCV.exe
  C:\Windows\System\NlSuiCV.exe
  2⤵
  PID:11704
- C:\Windows\System\FFYYPDv.exe
  C:\Windows\System\FFYYPDv.exe
  2⤵
  PID:11744
- C:\Windows\System\MzGjjtc.exe
  C:\Windows\System\MzGjjtc.exe
  2⤵
  PID:11764
- C:\Windows\System\otYYhpz.exe
  C:\Windows\System\otYYhpz.exe
  2⤵
  PID:11804
- C:\Windows\System\hsSGKzu.exe
  C:\Windows\System\hsSGKzu.exe
  2⤵
  PID:11828
- C:\Windows\System\DLVAhhL.exe
  C:\Windows\System\DLVAhhL.exe
  2⤵
  PID:11860
- C:\Windows\System\wTNNrKg.exe
  C:\Windows\System\wTNNrKg.exe
  2⤵
  PID:11884
- C:\Windows\System\vvkqPUK.exe
  C:\Windows\System\vvkqPUK.exe
  2⤵
  PID:11912
- C:\Windows\System\HPoAKom.exe
  C:\Windows\System\HPoAKom.exe
  2⤵
  PID:11944
- C:\Windows\System\UrvOAgm.exe
  C:\Windows\System\UrvOAgm.exe
  2⤵
  PID:11968
- C:\Windows\System\ZiZqLpD.exe
  C:\Windows\System\ZiZqLpD.exe
  2⤵
  PID:11996
- C:\Windows\System\EJPEwar.exe
  C:\Windows\System\EJPEwar.exe
  2⤵
  PID:12020
- C:\Windows\System\vRQcqmU.exe
  C:\Windows\System\vRQcqmU.exe
  2⤵
  PID:12040
- C:\Windows\System\VWTgJYh.exe
  C:\Windows\System\VWTgJYh.exe
  2⤵
  PID:12088
- C:\Windows\System\xEaLnaD.exe
  C:\Windows\System\xEaLnaD.exe
  2⤵
  PID:12108
- C:\Windows\System\qLfEZzj.exe
  C:\Windows\System\qLfEZzj.exe
  2⤵
  PID:12148
- C:\Windows\System\udmVjqX.exe
  C:\Windows\System\udmVjqX.exe
  2⤵
  PID:12176
- C:\Windows\System\jTzhBCn.exe
  C:\Windows\System\jTzhBCn.exe
  2⤵
  PID:12192
- C:\Windows\System\kOBJhno.exe
  C:\Windows\System\kOBJhno.exe
  2⤵
  PID:12212
- C:\Windows\System\UapmMfd.exe
  C:\Windows\System\UapmMfd.exe
  2⤵
  PID:12240
- C:\Windows\System\olLZlxg.exe
  C:\Windows\System\olLZlxg.exe
  2⤵
  PID:12276
- C:\Windows\System\uiFhsEl.exe
  C:\Windows\System\uiFhsEl.exe
  2⤵
  PID:11280
- C:\Windows\System\rheDDRt.exe
  C:\Windows\System\rheDDRt.exe
  2⤵
  PID:11360
- C:\Windows\System\qOlLOcC.exe
  C:\Windows\System\qOlLOcC.exe
  2⤵
  PID:11392
- C:\Windows\System\aphIWSN.exe
  C:\Windows\System\aphIWSN.exe
  2⤵
  PID:11436
- C:\Windows\System\YTJTvmI.exe
  C:\Windows\System\YTJTvmI.exe
  2⤵
  PID:11484
- C:\Windows\System\StRLvJg.exe
  C:\Windows\System\StRLvJg.exe
  2⤵
  PID:11580
- C:\Windows\System\eBeaTch.exe
  C:\Windows\System\eBeaTch.exe
  2⤵
  PID:11644
- C:\Windows\System\SwshyvN.exe
  C:\Windows\System\SwshyvN.exe
  2⤵
  PID:11676
- C:\Windows\System\YvAHQaB.exe
  C:\Windows\System\YvAHQaB.exe
  2⤵
  PID:11736
- C:\Windows\System\ZocpTuG.exe
  C:\Windows\System\ZocpTuG.exe
  2⤵
  PID:11904
- C:\Windows\System\aMhBMDh.exe
  C:\Windows\System\aMhBMDh.exe
  2⤵
  PID:11960
- C:\Windows\System\mBGHXyV.exe
  C:\Windows\System\mBGHXyV.exe
  2⤵
  PID:11956
- C:\Windows\System\XiFRtXU.exe
  C:\Windows\System\XiFRtXU.exe
  2⤵
  PID:12032
- C:\Windows\System\XsUiFIZ.exe
  C:\Windows\System\XsUiFIZ.exe
  2⤵
  PID:12096
- C:\Windows\System\vexPJkf.exe
  C:\Windows\System\vexPJkf.exe
  2⤵
  PID:12188
- C:\Windows\System\ZpbPLGj.exe
  C:\Windows\System\ZpbPLGj.exe
  2⤵
  PID:12228
- C:\Windows\System\EpglKDx.exe
  C:\Windows\System\EpglKDx.exe
  2⤵
  PID:11276
- C:\Windows\System\KAcLLHb.exe
  C:\Windows\System\KAcLLHb.exe
  2⤵
  PID:11420
- C:\Windows\System\wTDAyMl.exe
  C:\Windows\System\wTDAyMl.exe
  2⤵
  PID:11504
- C:\Windows\System\ekwBJoE.exe
  C:\Windows\System\ekwBJoE.exe
  2⤵
  PID:11652
- C:\Windows\System\kQKrbLd.exe
  C:\Windows\System\kQKrbLd.exe
  2⤵
  PID:11824
- C:\Windows\System\DDMSGlI.exe
  C:\Windows\System\DDMSGlI.exe
  2⤵
  PID:11984
- C:\Windows\System\gWcGtXx.exe
  C:\Windows\System\gWcGtXx.exe
  2⤵
  PID:12072
- C:\Windows\System\kCWDeVh.exe
  C:\Windows\System\kCWDeVh.exe
  2⤵
  PID:12264
- C:\Windows\System\BuQeTew.exe
  C:\Windows\System\BuQeTew.exe
  2⤵
  PID:11528
- C:\Windows\System\DrKrlSO.exe
  C:\Windows\System\DrKrlSO.exe
  2⤵
  PID:11612
- C:\Windows\System\CfHrdHt.exe
  C:\Windows\System\CfHrdHt.exe
  2⤵
  PID:11872
- C:\Windows\System\sKqEDCW.exe
  C:\Windows\System\sKqEDCW.exe
  2⤵
  PID:12296
- C:\Windows\System\XwtVxld.exe
  C:\Windows\System\XwtVxld.exe
  2⤵
  PID:12320
- C:\Windows\System\hsHKfiW.exe
  C:\Windows\System\hsHKfiW.exe
  2⤵
  PID:12352
- C:\Windows\System\NCdZbVF.exe
  C:\Windows\System\NCdZbVF.exe
  2⤵
  PID:12376
- C:\Windows\System\osxPjiJ.exe
  C:\Windows\System\osxPjiJ.exe
  2⤵
  PID:12416
- C:\Windows\System\pBIIhrn.exe
  C:\Windows\System\pBIIhrn.exe
  2⤵
  PID:12444
- C:\Windows\System\jdfQSdh.exe
  C:\Windows\System\jdfQSdh.exe
  2⤵
  PID:12464
- C:\Windows\System\vdVkyEZ.exe
  C:\Windows\System\vdVkyEZ.exe
  2⤵
  PID:12488
- C:\Windows\System\SUcYcDN.exe
  C:\Windows\System\SUcYcDN.exe
  2⤵
  PID:12516
- C:\Windows\System\EjdMTpD.exe
  C:\Windows\System\EjdMTpD.exe
  2⤵
  PID:12540
- C:\Windows\System\SWYNQqU.exe
  C:\Windows\System\SWYNQqU.exe
  2⤵
  PID:12580
- C:\Windows\System\JokgsUA.exe
  C:\Windows\System\JokgsUA.exe
  2⤵
  PID:12624
- C:\Windows\System\pDgyqYX.exe
  C:\Windows\System\pDgyqYX.exe
  2⤵
  PID:12640
- C:\Windows\System\PenyhoN.exe
  C:\Windows\System\PenyhoN.exe
  2⤵
  PID:12672
- C:\Windows\System\ZumzAnP.exe
  C:\Windows\System\ZumzAnP.exe
  2⤵
  PID:12696
- C:\Windows\System\ptcBMNK.exe
  C:\Windows\System\ptcBMNK.exe
  2⤵
  PID:12712
- C:\Windows\System\hFDEwCV.exe
  C:\Windows\System\hFDEwCV.exe
  2⤵
  PID:12740
- C:\Windows\System\qnNeKXU.exe
  C:\Windows\System\qnNeKXU.exe
  2⤵
  PID:12772
- C:\Windows\System\sSrJwXz.exe
  C:\Windows\System\sSrJwXz.exe
  2⤵
  PID:12792
- C:\Windows\System\OPhFmIR.exe
  C:\Windows\System\OPhFmIR.exe
  2⤵
  PID:12820
- C:\Windows\System\AGBHRoH.exe
  C:\Windows\System\AGBHRoH.exe
  2⤵
  PID:12852
- C:\Windows\System\HSggvZD.exe
  C:\Windows\System\HSggvZD.exe
  2⤵
  PID:12872
- C:\Windows\System\JhXrtEN.exe
  C:\Windows\System\JhXrtEN.exe
  2⤵
  PID:12896
- C:\Windows\System\oFPEyLy.exe
  C:\Windows\System\oFPEyLy.exe
  2⤵
  PID:12956
- C:\Windows\System\CUEbQCC.exe
  C:\Windows\System\CUEbQCC.exe
  2⤵
  PID:12976
- C:\Windows\System\xFfVsUw.exe
  C:\Windows\System\xFfVsUw.exe
  2⤵
  PID:12996
- C:\Windows\System\SFoPSvr.exe
  C:\Windows\System\SFoPSvr.exe
  2⤵
  PID:13040
- C:\Windows\System\VGzopAc.exe
  C:\Windows\System\VGzopAc.exe
  2⤵
  PID:13072
- C:\Windows\System\QFTIAqf.exe
  C:\Windows\System\QFTIAqf.exe
  2⤵
  PID:13088
- C:\Windows\System\pWFXNUR.exe
  C:\Windows\System\pWFXNUR.exe
  2⤵
  PID:13112
- C:\Windows\System\qQWMeXR.exe
  C:\Windows\System\qQWMeXR.exe
  2⤵
  PID:13136
- C:\Windows\System\YohXhFA.exe
  C:\Windows\System\YohXhFA.exe
  2⤵
  PID:13184
- C:\Windows\System\uPcloIn.exe
  C:\Windows\System\uPcloIn.exe
  2⤵
  PID:13200
- C:\Windows\System\xOWLzPI.exe
  C:\Windows\System\xOWLzPI.exe
  2⤵
  PID:13216
- C:\Windows\System\zfaokzS.exe
  C:\Windows\System\zfaokzS.exe
  2⤵
  PID:13248
- C:\Windows\System\jTTVFuk.exe
  C:\Windows\System\jTTVFuk.exe
  2⤵
  PID:13268
- C:\Windows\System\ZhxfZlD.exe
  C:\Windows\System\ZhxfZlD.exe
  2⤵
  PID:3432
- C:\Windows\System\EOOAHtG.exe
  C:\Windows\System\EOOAHtG.exe
  2⤵
  PID:11356
- C:\Windows\System\aviVdoq.exe
  C:\Windows\System\aviVdoq.exe
  2⤵
  PID:12460
- C:\Windows\System\lVeGWNf.exe
  C:\Windows\System\lVeGWNf.exe
  2⤵
  PID:12508
- C:\Windows\System\JkCbHZT.exe
  C:\Windows\System\JkCbHZT.exe
  2⤵
  PID:12552
- C:\Windows\System\YPInQsT.exe
  C:\Windows\System\YPInQsT.exe
  2⤵
  PID:12608
- C:\Windows\System\fyUeZqI.exe
  C:\Windows\System\fyUeZqI.exe
  2⤵
  PID:12656
- C:\Windows\System\YYHHvRi.exe
  C:\Windows\System\YYHHvRi.exe
  2⤵
  PID:12704
- C:\Windows\System\tutPUmx.exe
  C:\Windows\System\tutPUmx.exe
  2⤵
  PID:12756
- C:\Windows\System\vwSXpsP.exe
  C:\Windows\System\vwSXpsP.exe
  2⤵
  PID:12860
- C:\Windows\System\kKCrSkF.exe
  C:\Windows\System\kKCrSkF.exe
  2⤵
  PID:12968
- C:\Windows\System\JWPQsbe.exe
  C:\Windows\System\JWPQsbe.exe
  2⤵
  PID:13024
- C:\Windows\System\xwnvxtV.exe
  C:\Windows\System\xwnvxtV.exe
  2⤵
  PID:13080
- C:\Windows\System\dUjuRvq.exe
  C:\Windows\System\dUjuRvq.exe
  2⤵
  PID:13132
- C:\Windows\System\HRiQsQb.exe
  C:\Windows\System\HRiQsQb.exe
  2⤵
  PID:3204
- C:\Windows\System\GAbHYxd.exe
  C:\Windows\System\GAbHYxd.exe
  2⤵
  PID:13256
- C:\Windows\System\vOXxjnp.exe
  C:\Windows\System\vOXxjnp.exe
  2⤵
  PID:3268
- C:\Windows\System\nnyRErm.exe
  C:\Windows\System\nnyRErm.exe
  2⤵
  PID:2316
- C:\Windows\System\MRnCrGH.exe
  C:\Windows\System\MRnCrGH.exe
  2⤵
  PID:12504
- C:\Windows\System\gKByvaR.exe
  C:\Windows\System\gKByvaR.exe
  2⤵
  PID:12532
- C:\Windows\System\WeSXqXu.exe
  C:\Windows\System\WeSXqXu.exe
  2⤵
  PID:12780
- C:\Windows\System\IDIuldf.exe
  C:\Windows\System\IDIuldf.exe
  2⤵
  PID:12788
- C:\Windows\System\zQjchzt.exe
  C:\Windows\System\zQjchzt.exe
  2⤵
  PID:13104
- C:\Windows\System\oBLLylj.exe
  C:\Windows\System\oBLLylj.exe
  2⤵
  PID:13176
- C:\Windows\System\HIXcHbc.exe
  C:\Windows\System\HIXcHbc.exe
  2⤵
  PID:3256
- C:\Windows\System\KSQIMwz.exe
  C:\Windows\System\KSQIMwz.exe
  2⤵
  PID:11928
- C:\Windows\System\lBMJrBI.exe
  C:\Windows\System\lBMJrBI.exe
  2⤵
  PID:12684
- C:\Windows\System\IbBISSI.exe
  C:\Windows\System\IbBISSI.exe
  2⤵
  PID:13192
- C:\Windows\System\fqXtoka.exe
  C:\Windows\System\fqXtoka.exe
  2⤵
  PID:13296
- C:\Windows\System\lHpGUnr.exe
  C:\Windows\System\lHpGUnr.exe
  2⤵
  PID:12372
- C:\Windows\System\VVdUIEW.exe
  C:\Windows\System\VVdUIEW.exe
  2⤵
  PID:12452
- C:\Windows\System\izpcyCf.exe
  C:\Windows\System\izpcyCf.exe
  2⤵
  PID:13332
- C:\Windows\System\tQIwUbF.exe
  C:\Windows\System\tQIwUbF.exe
  2⤵
  PID:13364
- C:\Windows\System\CcpEkMx.exe
  C:\Windows\System\CcpEkMx.exe
  2⤵
  PID:13380
- C:\Windows\System\yngMpRY.exe
  C:\Windows\System\yngMpRY.exe
  2⤵
  PID:13420
- C:\Windows\System\lXhwwQV.exe
  C:\Windows\System\lXhwwQV.exe
  2⤵
  PID:13440
- C:\Windows\System\qTuizUp.exe
  C:\Windows\System\qTuizUp.exe
  2⤵
  PID:13464
- C:\Windows\System\SdGxSGp.exe
  C:\Windows\System\SdGxSGp.exe
  2⤵
  PID:13484
- C:\Windows\System\eKjRzXY.exe
  C:\Windows\System\eKjRzXY.exe
  2⤵
  PID:13520
- C:\Windows\System\picfRNR.exe
  C:\Windows\System\picfRNR.exe
  2⤵
  PID:13560
- C:\Windows\System\VjsIfxX.exe
  C:\Windows\System\VjsIfxX.exe
  2⤵
  PID:13600
- C:\Windows\System\YsWxwcx.exe
  C:\Windows\System\YsWxwcx.exe
  2⤵
  PID:13624
- C:\Windows\System\KlOOyxp.exe
  C:\Windows\System\KlOOyxp.exe
  2⤵
  PID:13648
- C:\Windows\System\gnvuNBp.exe
  C:\Windows\System\gnvuNBp.exe
  2⤵
  PID:13672
- C:\Windows\System\CaEAyxq.exe
  C:\Windows\System\CaEAyxq.exe
  2⤵
  PID:13692
- C:\Windows\System\EpIhScI.exe
  C:\Windows\System\EpIhScI.exe
  2⤵
  PID:13736
- C:\Windows\System\VjISFOg.exe
  C:\Windows\System\VjISFOg.exe
  2⤵
  PID:13756
- C:\Windows\System\xmoRTXt.exe
  C:\Windows\System\xmoRTXt.exe
  2⤵
  PID:13788
- C:\Windows\System\jrRDSjf.exe
  C:\Windows\System\jrRDSjf.exe
  2⤵
  PID:13812
- C:\Windows\System\BfJmVhx.exe
  C:\Windows\System\BfJmVhx.exe
  2⤵
  PID:13828
- C:\Windows\System\eyzxOcu.exe
  C:\Windows\System\eyzxOcu.exe
  2⤵
  PID:13856
- C:\Windows\System\ammKOHZ.exe
  C:\Windows\System\ammKOHZ.exe
  2⤵
  PID:13896
- C:\Windows\System\jzkNbrC.exe
  C:\Windows\System\jzkNbrC.exe
  2⤵
  PID:13920
- C:\Windows\System\junsuxq.exe
  C:\Windows\System\junsuxq.exe
  2⤵
  PID:13960
- C:\Windows\System\hJlrGJZ.exe
  C:\Windows\System\hJlrGJZ.exe
  2⤵
  PID:13980
- C:\Windows\System\IMtinqD.exe
  C:\Windows\System\IMtinqD.exe
  2⤵
  PID:14008
- C:\Windows\System\ctThMMO.exe
  C:\Windows\System\ctThMMO.exe
  2⤵
  PID:14048
- C:\Windows\System\OzTpwMu.exe
  C:\Windows\System\OzTpwMu.exe
  2⤵
  PID:14076
- C:\Windows\System\ebLKfVP.exe
  C:\Windows\System\ebLKfVP.exe
  2⤵
  PID:14104
- C:\Windows\System\ONvezxF.exe
  C:\Windows\System\ONvezxF.exe
  2⤵
  PID:14132
- C:\Windows\System\wHWXxaT.exe
  C:\Windows\System\wHWXxaT.exe
  2⤵
  PID:14148
- C:\Windows\System\wViuOqL.exe
  C:\Windows\System\wViuOqL.exe
  2⤵
  PID:14176
- C:\Windows\System\MqyJfgJ.exe
  C:\Windows\System\MqyJfgJ.exe
  2⤵
  PID:14196
- C:\Windows\System\FSoMmNB.exe
  C:\Windows\System\FSoMmNB.exe
  2⤵
  PID:14232
- C:\Windows\System\rtdyUnU.exe
  C:\Windows\System\rtdyUnU.exe
  2⤵
  PID:14260
- C:\Windows\System\oXXyXZJ.exe
  C:\Windows\System\oXXyXZJ.exe
  2⤵
  PID:14280
- C:\Windows\System\kpXkhJr.exe
  C:\Windows\System\kpXkhJr.exe
  2⤵
  PID:14304
- C:\Windows\System\lxAmPcb.exe
  C:\Windows\System\lxAmPcb.exe
  2⤵
  PID:14328
- C:\Windows\System\BYuVEAx.exe
  C:\Windows\System\BYuVEAx.exe
  2⤵
  PID:13376
- C:\Windows\System\jmHEyzh.exe
  C:\Windows\System\jmHEyzh.exe
  2⤵
  PID:13472
- C:\Windows\System\vNbvkHZ.exe
  C:\Windows\System\vNbvkHZ.exe
  2⤵
  PID:13508
- C:\Windows\System\TIOfcmv.exe
  C:\Windows\System\TIOfcmv.exe
  2⤵
  PID:13556
- C:\Windows\System\TkMdpyJ.exe
  C:\Windows\System\TkMdpyJ.exe
  2⤵
  PID:13664
- C:\Windows\System\pKklneD.exe
  C:\Windows\System\pKklneD.exe
  2⤵
  PID:13660
- C:\Windows\System\yXqPwxf.exe
  C:\Windows\System\yXqPwxf.exe
  2⤵
  PID:13768
- C:\Windows\System\MAzUpwe.exe
  C:\Windows\System\MAzUpwe.exe
  2⤵
  PID:13912
- C:\Windows\System\RgisrgH.exe
  C:\Windows\System\RgisrgH.exe
  2⤵
  PID:13976
- C:\Windows\System\aOqLWuQ.exe
  C:\Windows\System\aOqLWuQ.exe
  2⤵
  PID:13992
- C:\Windows\System\SWKHUbK.exe
  C:\Windows\System\SWKHUbK.exe
  2⤵
  PID:14184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AXBgMoC.exe

Filesize
1.5MB

MD5
091e3423794c99096fa4b13ceb2d0a9b

SHA1
fc1211dfbb84dfaf7a53fbcdd18e6b406b08aa6a

SHA256
d0c0f709a9fec0f200794ba98bfaa1363daf603168c743add7c80d198946d11f

SHA512
869fb06f8cc5e0391c84ce01845b6113551975b5581c809e58fa3c86c891192c6d40c7fa25a06d877cbccf6d32d858579af3372c4e47486b1e812322f9294321

Download Submit
C:\Windows\System\DOJxenm.exe

Filesize
1.5MB

MD5
f9ad08601b490b7b4662cb8e3653afbc

SHA1
618dadf82e9c31c91d6f27fa7127b3ac1b64a3d7

SHA256
45a2b9b44173e41608124a58219f4d6a599d2ac5a9e6d17c8f7ca90c7331166f

SHA512
f87b560156d95ebcabd048b21de552808bf3122fd724f1a23dfc1435b24dc11c43626cc9c428d029088b4b850dcdc12cf80f5a6649815c6ca56f4f26b20bf3a6

Download Submit
C:\Windows\System\EPnJTwR.exe

Filesize
1.5MB

MD5
c42d8cec22ffe9b3d41a8e464e4107e1

SHA1
b474d0cfe4aa18289738b7de514367a530df289f

SHA256
bf7c4079b3abce9a0b50f03cb4a5a08d20f87f9efcabbfaa7b3cef41689a3e25

SHA512
016c9ff2e215a5508c269a4efa910b6c029aaffb2ea3248495196d77ae633e1674525a5cd9577cd85d53032a4d7669d03fa1b4d30cbd5737c589cd1346ad063f

Download Submit
C:\Windows\System\EhPdRHA.exe

Filesize
1.5MB

MD5
0dfd8bb3ee0a247f3088749465832afa

SHA1
57a621b96c5f68ffda08a142c6b2de3ff64ddbc7

SHA256
764966187aba377a5af2ef9182c7c08abf974420d1a7f11488e2a3ae02bc71a4

SHA512
369320240379c30436c24d9f0cd9f877f415b8578ca826fecb98e25b5b5086bffd3941d12bd70f26bacf425b369bda30e97fc5552eb97e609cc3078e2e517991

Download Submit
C:\Windows\System\GFGrgXj.exe

Filesize
1.5MB

MD5
ad172a0484813d5400c77b495c6979bb

SHA1
690a04e1a56324e6dad23aacfcca939dd585cf2e

SHA256
55fa69debed04a774197e5cee6e50f2de68552ec53f4f28dfdd5f24cf6456d74

SHA512
fee53b61de14ceb52a0831c638b7ad375f8079a52ef4f4b32a824b6d88a0a7004b3b9151d1f517ca7e73881fad69fa1565c4c3e67af3cf99e0c8881bb9496f37

Download Submit
C:\Windows\System\HDLanMY.exe

Filesize
1.5MB

MD5
2f43465c892a97ff2d4f630ebfbdb912

SHA1
1c0f340e84a3315b299633f11841a89e4f00c1df

SHA256
b7e6a44cf35209e00fa18ca474f848ad35ed819aa7b6ec121cc9714ab17f57a8

SHA512
880cadf44ef795861bb066ac149b08df2326dfdec2263e2dc412571fd810c88019041175378546c14abde092135eb731932f8e5b5f821b16c699838f573e991a

Download Submit
C:\Windows\System\IyRlVNf.exe

Filesize
1.5MB

MD5
c7c96b54b17a3eaa2e8ebaa835300b01

SHA1
7c49c24062e12da35ecc145c99c8f0543a2df0b9

SHA256
69208e3e55c13170e262b15cd6344677e318bffc6115c26ed8363b6033c3f1fa

SHA512
489888cea598c50afba563e728087ae736c476b196a78c54bcc94d9c67edc0d0f64d6cb6cd24d3ed05f62ed0cf20c1cb8f65e3040ae89af2faf5946234bf2873

Download Submit
C:\Windows\System\KecMKYh.exe

Filesize
1.5MB

MD5
55dce326b6e47b650404a6ea49e10c27

SHA1
90e065397109affddcb0d4b6e8e180af7c99f68a

SHA256
8c7e182ae6c809a2f1c654e13ed56c770ec799527e466801fc55d356f11ece8c

SHA512
15773d0b313ce616fed3c10e699744c03c85b7f6935144f3a6bdf0713fce7d9c008d3154d76fe53f9dcd80c164e68ef80bd9a7a68acb34973b57e59b12330310

Download Submit
C:\Windows\System\LinSbUE.exe

Filesize
1.5MB

MD5
a7c84c874778bfb5f115bb89d90c8df1

SHA1
9a7c81de9429e13d55b7dd2b80b7655eb7ebf01b

SHA256
7912e1bc1ec400f2841cd15a31948430624fa35d3fac0aeb0718ba0ed0b29f6a

SHA512
9daf5b5eea737a763193efb40cdde0e044e9990adbc64569365a986767a972bdce2fb988e4c719e7568911e35b8f61db254e480ed8bcc180cf4b09451274a888

Download Submit
C:\Windows\System\LjfcZdN.exe

Filesize
1.5MB

MD5
4f054266b7a4d7832f83456abdd80b8c

SHA1
15c11d49e67386a02423dd125cfbd94c3647d8f2

SHA256
00b195ba650ce1f695e819a40076a971914175e1ac21fe843f1b1c26c1d60709

SHA512
24ad74aa2bb1f1123f6e3eeb2d3d165c48659004395e4ad89c52e9b5cf2174a5d914c565700c30aeec0820a4a70808ec869bfe2690348d87e36d6a8c49936e1b

Download Submit
C:\Windows\System\NnmMUSk.exe

Filesize
1.5MB

MD5
15af4380fd5b9a0f2ac87f39d322c94f

SHA1
9e4277c63f2727d6449d3d8bc75e00f256fee70c

SHA256
0443fd7bb1684345fa8c4d3c95e62a8fdce756d0958786ef08613ca3857a63bf

SHA512
40971b07b78639e70f120ca3beef2af155ca6eb8fad32678865f8f5f21d51f719070254164e02c53ddd68607e314f288968fe915317360f0f200a1974ee9427e

Download Submit
C:\Windows\System\OKWdqBF.exe

Filesize
1.5MB

MD5
fd23f1a1015688a90d083bcbfb861f83

SHA1
ea7dbeb4c9505a95a18ca269171dda1a012dd65c

SHA256
d9f5407b98afd6016f26fdd2acdf471997fe57b771065920ce31f8dee4afee2c

SHA512
e3f24472619803acc96f13c3aa29cb51cd06c9350669c60b3694ebc7bae85a50892380a5371dc802fa7369d91f48b37b87e874c68fc12a49f6a6c2898dce2858

Download Submit
C:\Windows\System\OfyycGo.exe

Filesize
1.5MB

MD5
8e9ca51e6d02fa137b36fa897a70dd18

SHA1
cc33a653e7f8ac3e08ce92fc602105906371a7f1

SHA256
e1c8c3a6793f3f9dbebd28ed69fc9fab5162890201052ef9923eae3b6953114c

SHA512
3835425769fcb4cad362274c10735a141276585ff402e8e75b9ffa6372357f8e39e7a1485369c7c307990f1bc57e8a91ce8ee0e9565f7b1f4c266bcb6e3cbf7d

Download Submit
C:\Windows\System\TyIZwsX.exe

Filesize
1.5MB

MD5
42dc04342a029bfa6561817b263db029

SHA1
c36405e0c65e86cd029c7a293ed7358c8bf480f7

SHA256
88bfa40d18aeaa9701032fc631d86dd2c6025b581002f310faf5b53086d010c6

SHA512
33d83096a5e370dc6912ea5a5eab7c08efec086bd78856a9b757be03080f86a283ae343b8cdc0b5e45941c56b86c247ad9b81f4b54500550076abfc713f982da

Download Submit
C:\Windows\System\VVquHCF.exe

Filesize
1.5MB

MD5
bf7a70c362671bd9c896213bcead101c

SHA1
12d7ff47bf764c143184c56b633c5284bfb43333

SHA256
a057d529e0919ae66532e02e50b049e3f660e0afee994933f2cb8f3dd5ec5456

SHA512
8d1c16f7bb7058894bedc32d332191dc44c26866c331f60dbd8e93a634daa468017ed481e3a128c9c8516f1b7026677f75ccc11f9342eddd4106be0261d60fa9

Download Submit
C:\Windows\System\XFJGlKe.exe

Filesize
1.5MB

MD5
10093944cb185c775f99715c1339582f

SHA1
f9227ef67e0616e1c71e726562e01fae1a790e6a

SHA256
70e0303cda3741f8aaac0f2583d326182dd5a503b19c608b2bd1dbf9d6900c57

SHA512
6d0f33b84839d2d526f26dfb572a125822e75403f3c1fcaa6e7a4e2a7725d03605fe0cd5416024560e80f9bb95d2b9f038b8ab4eac01ea57e96b25fd043652ce

Download Submit
C:\Windows\System\YDRNEcF.exe

Filesize
1.5MB

MD5
51b49e0caafcdcdced879f4c4ae6e44c

SHA1
ddc2581822af6335feb22c84e8b79414a25fd5b5

SHA256
27000cd3157835fc51c295848cc8a5784ea4409742bcdb82239712882ad89c49

SHA512
ceb4aeba65f0fb3d15f43ced189b9233d2ace692c8b14a86163c50af2a0d263270fea3af14e5acea11b1beeaed191ddb1f3ab49c092498f0111c3261b531b00f

Download Submit
C:\Windows\System\YkGRHWr.exe

Filesize
1.5MB

MD5
498a86d3f0e25881b9589d2dab8809b7

SHA1
52eedface4cff2c522c301b8eaafacbfd17710f8

SHA256
f9b4498d615e73ecd13d2f4eb2daf07ea20ed7b9c3d5eec0f0e6d06c000cb5dd

SHA512
b0eb8def7b68869d48d589b54f30d8485fcc9df89d1bd9f7cb54e05517ba82f0250797fcae877c1db664016066bc896f55a583efd563d198fbb9bc2752edcd25

Download Submit
C:\Windows\System\ZOIZsol.exe

Filesize
1.5MB

MD5
67a2c1579cc86a9078f9c01b917465e7

SHA1
3bc94864d59d6e9c27577bc604570c03cc52f59a

SHA256
033cf54c9526ef8d6cda1b79df23186569be357f0e622b3ffc54ae71d1b5db5b

SHA512
128304836187e781df1a1c72ebb255b3aa7826d04e7f637ce9b1dfc6f5ebe1ff60af8e69c94fc15417d3325004a68c376abc3e4933218abe650e3b9290416884

Download Submit
C:\Windows\System\bsNQitB.exe

Filesize
1.5MB

MD5
2485f459d2e793f4fdcfccf334000b32

SHA1
5a27d5ea7d4a49b62a955ed3ba3e2571de1c7384

SHA256
011a6c387686c1fe6d11796f822fd83ab9b901f16f1317aaf676cab17d877c8d

SHA512
bb336f34b03273aa6faadda5b7a3946708ab3147dbeb2029a6a11b9b60e20db4fee67477a02c8b3d27bcdf18e3d65dbd6a5b5e7cd5c2eaaabf408e3a9c7da8a1

Download Submit
C:\Windows\System\cWNGzDE.exe

Filesize
1.5MB

MD5
a0ab3bbc065b79894b260ecd64615485

SHA1
fb40a53f5bafaafa8bce76b5648f1716f3cd45b8

SHA256
b3f871b453736f54e09337daa3d2e62b474f8228a92cfa83957a1d16c58da5a5

SHA512
5ea4166f4cf3207ab706bd90e817e0465e952405a1fdba7de78fcce769c5d482d745ef5528be5ba9265bfaf3a90c2dd0fc7be49cc6e99fe7cd151534e6b10085

Download Submit
C:\Windows\System\dbOUXJy.exe

Filesize
1.5MB

MD5
7b80aa29415000723da75df3337f5d22

SHA1
9bcb969750d9a88923fc8a7bf434d27248aeff68

SHA256
b13938738b3336690492ccf233a63cf4c07641189b8291b79620804b0919398f

SHA512
5168999f7625b1eb2f3903adeb9a47d0a8f821fb8e47e67475e8d96f5442cc50400b4fd3142d74e393eab7b75191f6d2f6f5fe16436cd4cc585b3b0526b4bd96

Download Submit
C:\Windows\System\gwyrzKO.exe

Filesize
1.5MB

MD5
2e256f1f3114793b85d765439d129f69

SHA1
2457c98a264ca831f544588cda5467df50b29dbf

SHA256
e67e1b02a8d7da64aba01e6c6135c98c07ccf98e75a7dc97cec01c4e3624886f

SHA512
52e0442af96c113d5c42dc9cba5426754fd4dbabee258792bd94690af7db78bf30c8c0b57b615223ab5411f9ffa60a8ad0f25de44a8a7d13f317f78b6a4ca901

Download Submit
C:\Windows\System\hTMjvhp.exe

Filesize
1.5MB

MD5
14c6b4453af2772a5010f2c148e94961

SHA1
3e85261333c135c9ba7ce7a985e687a25ded27b9

SHA256
fbc5bd594a29255d5b287b1ee4d745021e84878ba2d4398022cbb759102ee91f

SHA512
419e39a0320c1bc47895fe97d4fc057f3639f89611ad16f218ebe59b3e5db471e8171702f8a218594edc89c4cf739ebe4e16eff84474e00d11c19db014103137

Download Submit
C:\Windows\System\iXzpmUb.exe

Filesize
1.5MB

MD5
b3300c0ee6b2ee9447dee06ea528565f

SHA1
44c354d896c45f64aff5b260d8884c4f81b1c53f

SHA256
5faf0be96d3f1031a972d96e340be442428d924edeff1f4f4626cbb16896a6d6

SHA512
574ea28c5e6d7af16b201d5d79e6f6b32ad1dc72274b0519087da54264cc786142bc250c0af5d78149504b979abc55ebdb10a0495172af8f954bf6ffc10965f2

Download Submit
C:\Windows\System\jtRpoUQ.exe

Filesize
1.5MB

MD5
6bcabfdd0c539d083fd2b1413107c223

SHA1
31fa398203b214371cfdeb11d61a99e141186bf2

SHA256
010996a85b2ded924bf204aad0966fb1916b255f21d736e1d7bc4b73840175f6

SHA512
fd127ae568554e0ade8e85a772e25005eebd4ed87a750ed6a2cfdd411ef6599bea6dddbd758b4b330e996a6e24c943aed938d861e2de6925da392b88af3539d3

Download Submit
C:\Windows\System\kLNsNdS.exe

Filesize
1.5MB

MD5
7c489378fd9f4ae4787133948e9e1710

SHA1
9c4a89a5a612d5fc9cd8c2d0e5f792d18f8c7909

SHA256
bd04e95b840c10b9d94606530ffc28e71e22ff0df5605d3c052ac107630b5d67

SHA512
466eab600b3dc517b7a252ae938cae83b43dd7991893658bf1c27b72300fb6e0114067845506d2d2de48fefc8912cd18ecd7ad27efb3445731b5e1db1cdc7a53

Download Submit
C:\Windows\System\kiXvIHI.exe

Filesize
1.5MB

MD5
fe6db3ff9ab6d89d8e2005096d8ee1ab

SHA1
93b58b5959852d341eac8cfe792b679b36e2dfe3

SHA256
62548a1a5d91e55d5ae78bd76c1c5d706c6a55d028e92a0ad8a2afd24658bcac

SHA512
1f5667d0636be39f0164c0c707d3c67a72e9f8d693acaf63604ce2af7c750e265affca41373796887740d281a224e9d3796d441f21b92869ef224b11e1573e79

Download Submit
C:\Windows\System\omlUQgt.exe

Filesize
1.5MB

MD5
3a3c014f07d7fcdae1ef08654f50cd4b

SHA1
5bee06630e67c437deb5c121b119137837be38ac

SHA256
e706bea110739187af52d39fb34d3d6b68916e370b659a6307207d0de445668a

SHA512
7f623dfc6003a0b55cdb0219441399f957193007bae506dbd91da1102e18c246e679f8dbd97d17e7b6afdb23b2414ff1ead10be5744bfad34e7127d75d05ee32

Download Submit
C:\Windows\System\rVuFMSp.exe

Filesize
1.5MB

MD5
bdb3f27ff8323364aae73e893e951863

SHA1
583715fd4770c250f88ccdb7343687a242b4b97f

SHA256
37187ee2d50194702b52f24b7bb6804d3322610a3c334b1d04701c9460291a0f

SHA512
c967870ec3d0bd44c09f60cb13fdb32f9ffc1a75f5f37bc3de781f2dcdd6b91ecbc727e6e0fbe4fb7777e9c0242dd3e4d7d11e96544d371725717b78665c9dd0

Download Submit
C:\Windows\System\ryBFFTm.exe

Filesize
1.5MB

MD5
97cf76ef8b91c8c6ed0366bcb1a87fbd

SHA1
6e0256146aa3f965f1c357849d2d4c68737492c6

SHA256
da9baa3563a7554c3b7fe6d93adc2f5b448557d8ad3e1503aa46912762ee2a3e

SHA512
aa1d54dcc3835dab9fedfa99e7b1c7717d14b4cf10243783c5163726e90cf930f3dd23e0542706ba7372d5ef95a3927c3f7cab6a7970a147bcc6f926136b4082

Download Submit
C:\Windows\System\srIdTgC.exe

Filesize
1.5MB

MD5
f4fcc4a2f0cbee3a2d4af9489556b55b

SHA1
a6f9ed950499523de509c968f034599ff35902d4

SHA256
8a84b267fabca131eb01b355df8f64f7c9c49d65104a20022b10744fd37b4177

SHA512
4604247e2478bcdb885a747d291dc01473f8aedbc186e140398624c0c15ddc7978941b3c59410e0181b9c4fde1ef6fe73c580506583d60208e0d0c9a0fde9985

Download Submit
C:\Windows\System\vMyElrO.exe

Filesize
1.5MB

MD5
bd303ad2793db5c66a23d2b3632ed44f

SHA1
0d618b6a13082d087ded5f6d4c1aaa5fbf7eb6c8

SHA256
cec34e70d4f244cbca621a936da430aa3f224e66c345bac8638554dc4a922169

SHA512
5f1e2722b1dd3398d60b64471567bcabab43f8796dad5f6df154ba49d16e1d28193c44c9274c6373565f4a6bdb2f6be9c6e94a3de4f30ce9b899c5df85271659

Download Submit
memory/552-2164-0x00007FF7B3920000-0x00007FF7B3C74000-memory.dmp

Filesize
3.3MB

Download
memory/552-692-0x00007FF7B3920000-0x00007FF7B3C74000-memory.dmp

Filesize
3.3MB

Download
memory/1096-745-0x00007FF7CFD80000-0x00007FF7D00D4000-memory.dmp

Filesize
3.3MB

Download
memory/1096-2165-0x00007FF7CFD80000-0x00007FF7D00D4000-memory.dmp

Filesize
3.3MB

Download
memory/1328-2157-0x00007FF663690000-0x00007FF6639E4000-memory.dmp

Filesize
3.3MB

Download
memory/1328-21-0x00007FF663690000-0x00007FF6639E4000-memory.dmp

Filesize
3.3MB

Download
memory/1328-2152-0x00007FF663690000-0x00007FF6639E4000-memory.dmp

Filesize
3.3MB

Download
memory/1404-2153-0x00007FF641640000-0x00007FF641994000-memory.dmp

Filesize
3.3MB

Download
memory/1404-14-0x00007FF641640000-0x00007FF641994000-memory.dmp

Filesize
3.3MB

Download
memory/1548-704-0x00007FF7F7AD0000-0x00007FF7F7E24000-memory.dmp

Filesize
3.3MB

Download
memory/1548-2163-0x00007FF7F7AD0000-0x00007FF7F7E24000-memory.dmp

Filesize
3.3MB

Download
memory/2172-816-0x00007FF689BF0000-0x00007FF689F44000-memory.dmp

Filesize
3.3MB

Download
memory/2172-2180-0x00007FF689BF0000-0x00007FF689F44000-memory.dmp

Filesize
3.3MB

Download
memory/2208-0-0x00007FF7FBFC0000-0x00007FF7FC314000-memory.dmp

Filesize
3.3MB

Download
memory/2208-1-0x00000265C6DC0000-0x00000265C6DD0000-memory.dmp

Filesize
64KB

Download
memory/2548-726-0x00007FF71B4A0000-0x00007FF71B7F4000-memory.dmp

Filesize
3.3MB

Download
memory/2548-2161-0x00007FF71B4A0000-0x00007FF71B7F4000-memory.dmp

Filesize
3.3MB

Download
memory/2572-663-0x00007FF65D380000-0x00007FF65D6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2572-2156-0x00007FF65D380000-0x00007FF65D6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2572-2151-0x00007FF65D380000-0x00007FF65D6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2684-735-0x00007FF7650E0000-0x00007FF765434000-memory.dmp

Filesize
3.3MB

Download
memory/2684-2167-0x00007FF7650E0000-0x00007FF765434000-memory.dmp

Filesize
3.3MB

Download
memory/2708-818-0x00007FF73CE40000-0x00007FF73D194000-memory.dmp

Filesize
3.3MB

Download
memory/2708-2170-0x00007FF73CE40000-0x00007FF73D194000-memory.dmp

Filesize
3.3MB

Download
memory/2864-733-0x00007FF653BF0000-0x00007FF653F44000-memory.dmp

Filesize
3.3MB

Download
memory/2864-2160-0x00007FF653BF0000-0x00007FF653F44000-memory.dmp

Filesize
3.3MB

Download
memory/3188-806-0x00007FF787060000-0x00007FF7873B4000-memory.dmp

Filesize
3.3MB

Download
memory/3188-2178-0x00007FF787060000-0x00007FF7873B4000-memory.dmp

Filesize
3.3MB

Download
memory/3260-2168-0x00007FF64D0A0000-0x00007FF64D3F4000-memory.dmp

Filesize
3.3MB

Download
memory/3260-680-0x00007FF64D0A0000-0x00007FF64D3F4000-memory.dmp

Filesize
3.3MB

Download
memory/3280-2162-0x00007FF6008F0000-0x00007FF600C44000-memory.dmp

Filesize
3.3MB

Download
memory/3280-716-0x00007FF6008F0000-0x00007FF600C44000-memory.dmp

Filesize
3.3MB

Download
memory/3320-2173-0x00007FF73FDA0000-0x00007FF7400F4000-memory.dmp

Filesize
3.3MB

Download
memory/3320-748-0x00007FF73FDA0000-0x00007FF7400F4000-memory.dmp

Filesize
3.3MB

Download
memory/3600-817-0x00007FF682320000-0x00007FF682674000-memory.dmp

Filesize
3.3MB

Download
memory/3600-2181-0x00007FF682320000-0x00007FF682674000-memory.dmp

Filesize
3.3MB

Download
memory/3700-2159-0x00007FF787410000-0x00007FF787764000-memory.dmp

Filesize
3.3MB

Download
memory/3700-699-0x00007FF787410000-0x00007FF787764000-memory.dmp

Filesize
3.3MB

Download
memory/3824-676-0x00007FF791F90000-0x00007FF7922E4000-memory.dmp

Filesize
3.3MB

Download
memory/3824-2166-0x00007FF791F90000-0x00007FF7922E4000-memory.dmp

Filesize
3.3MB

Download
memory/3924-2175-0x00007FF6C6FF0000-0x00007FF6C7344000-memory.dmp

Filesize
3.3MB

Download
memory/3924-799-0x00007FF6C6FF0000-0x00007FF6C7344000-memory.dmp

Filesize
3.3MB

Download
memory/3984-2154-0x00007FF716B40000-0x00007FF716E94000-memory.dmp

Filesize
3.3MB

Download
memory/3984-664-0x00007FF716B40000-0x00007FF716E94000-memory.dmp

Filesize
3.3MB

Download
memory/4296-2177-0x00007FF6D53C0000-0x00007FF6D5714000-memory.dmp

Filesize
3.3MB

Download
memory/4296-800-0x00007FF6D53C0000-0x00007FF6D5714000-memory.dmp

Filesize
3.3MB

Download
memory/4348-2169-0x00007FF660720000-0x00007FF660A74000-memory.dmp

Filesize
3.3MB

Download
memory/4348-677-0x00007FF660720000-0x00007FF660A74000-memory.dmp

Filesize
3.3MB

Download
memory/4612-738-0x00007FF7DCF40000-0x00007FF7DD294000-memory.dmp

Filesize
3.3MB

Download
memory/4612-2171-0x00007FF7DCF40000-0x00007FF7DD294000-memory.dmp

Filesize
3.3MB

Download
memory/4628-721-0x00007FF757B80000-0x00007FF757ED4000-memory.dmp

Filesize
3.3MB

Download
memory/4628-2158-0x00007FF757B80000-0x00007FF757ED4000-memory.dmp

Filesize
3.3MB

Download
memory/4796-2172-0x00007FF7A7E30000-0x00007FF7A8184000-memory.dmp

Filesize
3.3MB

Download
memory/4796-734-0x00007FF7A7E30000-0x00007FF7A8184000-memory.dmp

Filesize
3.3MB

Download
memory/4924-2179-0x00007FF792A70000-0x00007FF792DC4000-memory.dmp

Filesize
3.3MB

Download
memory/4924-810-0x00007FF792A70000-0x00007FF792DC4000-memory.dmp

Filesize
3.3MB

Download
memory/4960-796-0x00007FF7BF9E0000-0x00007FF7BFD34000-memory.dmp

Filesize
3.3MB

Download
memory/4960-2176-0x00007FF7BF9E0000-0x00007FF7BFD34000-memory.dmp

Filesize
3.3MB

Download
memory/5024-750-0x00007FF74F8C0000-0x00007FF74FC14000-memory.dmp

Filesize
3.3MB

Download
memory/5024-2174-0x00007FF74F8C0000-0x00007FF74FC14000-memory.dmp

Filesize
3.3MB

Download
memory/5032-2155-0x00007FF6DAD40000-0x00007FF6DB094000-memory.dmp

Filesize
3.3MB

Download
memory/5032-668-0x00007FF6DAD40000-0x00007FF6DB094000-memory.dmp

Filesize
3.3MB

Download