xmrig | 2c1b0abebe2402d916b690806cd39cfb2ad8feabd6c0f8210ed145aa8a65d763

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
Size

2.4MB
MD5

35c9a3c706575ae76a9ed18afbd027d0
SHA1

037c0982e757522a7855ae5ce25dcd63913091b6
SHA256

2c1b0abebe2402d916b690806cd39cfb2ad8feabd6c0f8210ed145aa8a65d763
SHA512

dc532e6be9707e75fa9c50deb42370c4f72430dea54ac776ab135ce9ce07e23e2e8f4711bd0bf149595c48c2e3952bfa074d48efd4b4d3db594ddb8d151b6e3b
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQw5UPeNliw8s/E/GYst:BemTLkNdfE0pZrQ6

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/432-0-0x00007FF7A6E60000-0x00007FF7A71B4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023424-5.dat	xmrig
behavioral2/files/0x0007000000023432-8.dat	xmrig
behavioral2/files/0x0007000000023431-10.dat	xmrig
behavioral2/memory/3284-12-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp	xmrig
behavioral2/memory/4240-7-0x00007FF603450000-0x00007FF6037A4000-memory.dmp	xmrig
behavioral2/memory/4128-20-0x00007FF627B60000-0x00007FF627EB4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023426-23.dat	xmrig
behavioral2/files/0x0007000000023433-27.dat	xmrig
behavioral2/files/0x0007000000023434-32.dat	xmrig
behavioral2/files/0x0007000000023435-36.dat	xmrig
behavioral2/files/0x0007000000023436-44.dat	xmrig
behavioral2/files/0x0007000000023438-53.dat	xmrig
behavioral2/files/0x000700000002343a-68.dat	xmrig
behavioral2/files/0x000700000002343f-94.dat	xmrig
behavioral2/files/0x0007000000023444-119.dat	xmrig
behavioral2/files/0x0007000000023446-129.dat	xmrig
behavioral2/files/0x000700000002344a-145.dat	xmrig
behavioral2/files/0x000700000002344e-165.dat	xmrig
behavioral2/memory/3704-696-0x00007FF7C40B0000-0x00007FF7C4404000-memory.dmp	xmrig
behavioral2/files/0x000700000002344f-168.dat	xmrig
behavioral2/files/0x000700000002344d-163.dat	xmrig
behavioral2/files/0x000700000002344c-159.dat	xmrig
behavioral2/files/0x000700000002344b-154.dat	xmrig
behavioral2/files/0x0007000000023449-143.dat	xmrig
behavioral2/files/0x0007000000023448-139.dat	xmrig
behavioral2/files/0x0007000000023447-134.dat	xmrig
behavioral2/files/0x0007000000023445-123.dat	xmrig
behavioral2/files/0x0007000000023443-114.dat	xmrig
behavioral2/files/0x0007000000023442-109.dat	xmrig
behavioral2/files/0x0007000000023441-104.dat	xmrig
behavioral2/files/0x0007000000023440-98.dat	xmrig
behavioral2/files/0x000700000002343e-89.dat	xmrig
behavioral2/files/0x000700000002343d-84.dat	xmrig
behavioral2/files/0x000700000002343c-79.dat	xmrig
behavioral2/files/0x000700000002343b-74.dat	xmrig
behavioral2/files/0x0007000000023439-61.dat	xmrig
behavioral2/files/0x0007000000023437-59.dat	xmrig
behavioral2/memory/732-50-0x00007FF6E6A60000-0x00007FF6E6DB4000-memory.dmp	xmrig
behavioral2/memory/3784-31-0x00007FF60C7C0000-0x00007FF60CB14000-memory.dmp	xmrig
behavioral2/memory/5072-702-0x00007FF72C8C0000-0x00007FF72CC14000-memory.dmp	xmrig
behavioral2/memory/2000-711-0x00007FF68B9A0000-0x00007FF68BCF4000-memory.dmp	xmrig
behavioral2/memory/4032-719-0x00007FF761570000-0x00007FF7618C4000-memory.dmp	xmrig
behavioral2/memory/4188-733-0x00007FF638CD0000-0x00007FF639024000-memory.dmp	xmrig
behavioral2/memory/3352-759-0x00007FF7775F0000-0x00007FF777944000-memory.dmp	xmrig
behavioral2/memory/1572-766-0x00007FF604C00000-0x00007FF604F54000-memory.dmp	xmrig
behavioral2/memory/2852-776-0x00007FF72A7F0000-0x00007FF72AB44000-memory.dmp	xmrig
behavioral2/memory/540-777-0x00007FF6A10F0000-0x00007FF6A1444000-memory.dmp	xmrig
behavioral2/memory/1544-771-0x00007FF72C6B0000-0x00007FF72CA04000-memory.dmp	xmrig
behavioral2/memory/1700-752-0x00007FF7EEB50000-0x00007FF7EEEA4000-memory.dmp	xmrig
behavioral2/memory/1008-746-0x00007FF644000000-0x00007FF644354000-memory.dmp	xmrig
behavioral2/memory/1000-741-0x00007FF717560000-0x00007FF7178B4000-memory.dmp	xmrig
behavioral2/memory/3824-736-0x00007FF789850000-0x00007FF789BA4000-memory.dmp	xmrig
behavioral2/memory/4636-726-0x00007FF6E6170000-0x00007FF6E64C4000-memory.dmp	xmrig
behavioral2/memory/3388-722-0x00007FF758260000-0x00007FF7585B4000-memory.dmp	xmrig
behavioral2/memory/2968-707-0x00007FF6A8A20000-0x00007FF6A8D74000-memory.dmp	xmrig
behavioral2/memory/1792-788-0x00007FF677FE0000-0x00007FF678334000-memory.dmp	xmrig
behavioral2/memory/4964-795-0x00007FF6C6900000-0x00007FF6C6C54000-memory.dmp	xmrig
behavioral2/memory/4428-800-0x00007FF7C7730000-0x00007FF7C7A84000-memory.dmp	xmrig
behavioral2/memory/3988-803-0x00007FF6459D0000-0x00007FF645D24000-memory.dmp	xmrig
behavioral2/memory/1480-802-0x00007FF6F3990000-0x00007FF6F3CE4000-memory.dmp	xmrig
behavioral2/memory/1396-792-0x00007FF68E960000-0x00007FF68ECB4000-memory.dmp	xmrig
behavioral2/memory/392-784-0x00007FF7E1E70000-0x00007FF7E21C4000-memory.dmp	xmrig
behavioral2/memory/3284-2077-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4240	qWJxdBU.exe
3284	ewchMDy.exe
4128	SOvIDie.exe
3784	tfBnGWg.exe
732	rwaFXkO.exe
3704	aCjqGTv.exe
1480	boQKjlg.exe
5072	eTMvexx.exe
3988	rKyMqvd.exe
2968	GJFmkCe.exe
2000	hoDvGyt.exe
4032	eBNquSu.exe
3388	imspQVb.exe
4636	tMtAACc.exe
4188	BiqmWqa.exe
3824	sMGckUX.exe
1000	nhuZRSa.exe
1008	pxAwYhy.exe
1700	boHywqt.exe
3352	HiDlRbl.exe
1572	lHqVBYU.exe
1544	BwoduaE.exe
2852	dQYlDUj.exe
540	iFWENBs.exe
392	lMVbOdb.exe
1792	vpnKFFW.exe
1396	ewQBDpo.exe
4964	SKrUWGB.exe
4428	lOnQYCF.exe
452	zLoOEIK.exe
680	RAsRFuB.exe
4464	EYxBHfD.exe
4532	mrcjWMr.exe
4948	UCJymqN.exe
4844	wSTqeCP.exe
2328	RkxQAkX.exe
2820	RlTdndg.exe
1032	ekqNuNu.exe
5096	hkLoQCx.exe
4876	NAbvooC.exe
4452	JZzShoa.exe
2892	rjQHXWh.exe
1812	XsXyAvu.exe
3948	VXlkwhg.exe
1392	mkIjfQQ.exe
3376	SXeGogT.exe
4916	SvWnlMS.exe
3464	nyBGiai.exe
4316	rzosZKV.exe
3304	djZSgWW.exe
860	QZMSyls.exe
436	zmCPbyp.exe
2932	JiHsLFG.exe
3964	pAaRpEu.exe
868	HdOOzkc.exe
1732	XiIUNur.exe
2740	ZzMUUUJ.exe
4456	BOcOfHC.exe
1992	hhCuyRA.exe
3276	ebYTdBJ.exe
3384	YtCPZbC.exe
3760	EzgLmAO.exe
2528	yzqHLcp.exe
1916	yMYdTgm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/432-0-0x00007FF7A6E60000-0x00007FF7A71B4000-memory.dmp	upx
behavioral2/files/0x0009000000023424-5.dat	upx
behavioral2/files/0x0007000000023432-8.dat	upx
behavioral2/files/0x0007000000023431-10.dat	upx
behavioral2/memory/3284-12-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp	upx
behavioral2/memory/4240-7-0x00007FF603450000-0x00007FF6037A4000-memory.dmp	upx
behavioral2/memory/4128-20-0x00007FF627B60000-0x00007FF627EB4000-memory.dmp	upx
behavioral2/files/0x0009000000023426-23.dat	upx
behavioral2/files/0x0007000000023433-27.dat	upx
behavioral2/files/0x0007000000023434-32.dat	upx
behavioral2/files/0x0007000000023435-36.dat	upx
behavioral2/files/0x0007000000023436-44.dat	upx
behavioral2/files/0x0007000000023438-53.dat	upx
behavioral2/files/0x000700000002343a-68.dat	upx
behavioral2/files/0x000700000002343f-94.dat	upx
behavioral2/files/0x0007000000023444-119.dat	upx
behavioral2/files/0x0007000000023446-129.dat	upx
behavioral2/files/0x000700000002344a-145.dat	upx
behavioral2/files/0x000700000002344e-165.dat	upx
behavioral2/memory/3704-696-0x00007FF7C40B0000-0x00007FF7C4404000-memory.dmp	upx
behavioral2/files/0x000700000002344f-168.dat	upx
behavioral2/files/0x000700000002344d-163.dat	upx
behavioral2/files/0x000700000002344c-159.dat	upx
behavioral2/files/0x000700000002344b-154.dat	upx
behavioral2/files/0x0007000000023449-143.dat	upx
behavioral2/files/0x0007000000023448-139.dat	upx
behavioral2/files/0x0007000000023447-134.dat	upx
behavioral2/files/0x0007000000023445-123.dat	upx
behavioral2/files/0x0007000000023443-114.dat	upx
behavioral2/files/0x0007000000023442-109.dat	upx
behavioral2/files/0x0007000000023441-104.dat	upx
behavioral2/files/0x0007000000023440-98.dat	upx
behavioral2/files/0x000700000002343e-89.dat	upx
behavioral2/files/0x000700000002343d-84.dat	upx
behavioral2/files/0x000700000002343c-79.dat	upx
behavioral2/files/0x000700000002343b-74.dat	upx
behavioral2/files/0x0007000000023439-61.dat	upx
behavioral2/files/0x0007000000023437-59.dat	upx
behavioral2/memory/732-50-0x00007FF6E6A60000-0x00007FF6E6DB4000-memory.dmp	upx
behavioral2/memory/3784-31-0x00007FF60C7C0000-0x00007FF60CB14000-memory.dmp	upx
behavioral2/memory/5072-702-0x00007FF72C8C0000-0x00007FF72CC14000-memory.dmp	upx
behavioral2/memory/2000-711-0x00007FF68B9A0000-0x00007FF68BCF4000-memory.dmp	upx
behavioral2/memory/4032-719-0x00007FF761570000-0x00007FF7618C4000-memory.dmp	upx
behavioral2/memory/4188-733-0x00007FF638CD0000-0x00007FF639024000-memory.dmp	upx
behavioral2/memory/3352-759-0x00007FF7775F0000-0x00007FF777944000-memory.dmp	upx
behavioral2/memory/1572-766-0x00007FF604C00000-0x00007FF604F54000-memory.dmp	upx
behavioral2/memory/2852-776-0x00007FF72A7F0000-0x00007FF72AB44000-memory.dmp	upx
behavioral2/memory/540-777-0x00007FF6A10F0000-0x00007FF6A1444000-memory.dmp	upx
behavioral2/memory/1544-771-0x00007FF72C6B0000-0x00007FF72CA04000-memory.dmp	upx
behavioral2/memory/1700-752-0x00007FF7EEB50000-0x00007FF7EEEA4000-memory.dmp	upx
behavioral2/memory/1008-746-0x00007FF644000000-0x00007FF644354000-memory.dmp	upx
behavioral2/memory/1000-741-0x00007FF717560000-0x00007FF7178B4000-memory.dmp	upx
behavioral2/memory/3824-736-0x00007FF789850000-0x00007FF789BA4000-memory.dmp	upx
behavioral2/memory/4636-726-0x00007FF6E6170000-0x00007FF6E64C4000-memory.dmp	upx
behavioral2/memory/3388-722-0x00007FF758260000-0x00007FF7585B4000-memory.dmp	upx
behavioral2/memory/2968-707-0x00007FF6A8A20000-0x00007FF6A8D74000-memory.dmp	upx
behavioral2/memory/1792-788-0x00007FF677FE0000-0x00007FF678334000-memory.dmp	upx
behavioral2/memory/4964-795-0x00007FF6C6900000-0x00007FF6C6C54000-memory.dmp	upx
behavioral2/memory/4428-800-0x00007FF7C7730000-0x00007FF7C7A84000-memory.dmp	upx
behavioral2/memory/3988-803-0x00007FF6459D0000-0x00007FF645D24000-memory.dmp	upx
behavioral2/memory/1480-802-0x00007FF6F3990000-0x00007FF6F3CE4000-memory.dmp	upx
behavioral2/memory/1396-792-0x00007FF68E960000-0x00007FF68ECB4000-memory.dmp	upx
behavioral2/memory/392-784-0x00007FF7E1E70000-0x00007FF7E21C4000-memory.dmp	upx
behavioral2/memory/3284-2077-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dwxazLC.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\LTogvSY.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\AONaGKY.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\UkNqaJG.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\BwoduaE.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\KVWmHxx.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\tmnNuyv.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\oYJUYQP.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\aCjqGTv.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\MrkKsnH.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\KJDuMdx.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\KSELfoK.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\UeIEqye.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\hkLPGyR.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\rrTICYd.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\ImMAVTR.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\wWUhkEG.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\bVdWiaB.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\qVRPKkf.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\CEveeTX.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\wBNKNyh.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\SvWnlMS.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\ROKwzTO.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\ixrdoDm.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\svrOcbC.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\nIgoedh.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\zsjyCrB.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\EdCErZv.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\FzFeRSB.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\iYTZwmR.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\nxRfcSZ.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\ITpRETo.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\fQtRxgN.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\uaoHTeI.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\xCsTdyq.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\JEFLRJj.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\ossEHGl.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\juqwpcS.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\cBduTry.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\XhUQmhd.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\UCJymqN.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\vmHvFFI.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\ALvYoIj.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\OyVqUnz.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\tyxaJwT.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\KXCXuXH.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\atxWkvx.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\GMaxwaZ.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\JkyNcFL.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\OvUbkGV.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\tUQyQNW.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\ysfitAB.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\OWkPFuL.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\YnBQluM.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\IdnZFcy.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\qdjbNvA.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\jWAzuSc.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\rKXqcrP.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\ryaoeuu.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\HiOnigK.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\tMtAACc.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\zLoOEIK.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\BwYcwuS.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
File created	C:\Windows\System\bMKNKQL.exe	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 4240	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	83
PID 432 wrote to memory of 4240	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	83
PID 432 wrote to memory of 3284	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	84
PID 432 wrote to memory of 3284	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	84
PID 432 wrote to memory of 4128	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	85
PID 432 wrote to memory of 4128	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	85
PID 432 wrote to memory of 3784	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	86
PID 432 wrote to memory of 3784	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	86
PID 432 wrote to memory of 732	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	87
PID 432 wrote to memory of 732	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	87
PID 432 wrote to memory of 3704	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	88
PID 432 wrote to memory of 3704	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	88
PID 432 wrote to memory of 1480	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	89
PID 432 wrote to memory of 1480	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	89
PID 432 wrote to memory of 5072	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	90
PID 432 wrote to memory of 5072	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	90
PID 432 wrote to memory of 2968	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	91
PID 432 wrote to memory of 2968	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	91
PID 432 wrote to memory of 3988	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	92
PID 432 wrote to memory of 3988	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	92
PID 432 wrote to memory of 2000	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	93
PID 432 wrote to memory of 2000	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	93
PID 432 wrote to memory of 4032	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	94
PID 432 wrote to memory of 4032	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	94
PID 432 wrote to memory of 3388	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	95
PID 432 wrote to memory of 3388	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	95
PID 432 wrote to memory of 4636	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	96
PID 432 wrote to memory of 4636	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	96
PID 432 wrote to memory of 4188	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	97
PID 432 wrote to memory of 4188	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	97
PID 432 wrote to memory of 3824	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	98
PID 432 wrote to memory of 3824	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	98
PID 432 wrote to memory of 1000	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	99
PID 432 wrote to memory of 1000	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	99
PID 432 wrote to memory of 1008	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	100
PID 432 wrote to memory of 1008	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	100
PID 432 wrote to memory of 1700	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	101
PID 432 wrote to memory of 1700	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	101
PID 432 wrote to memory of 3352	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	102
PID 432 wrote to memory of 3352	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	102
PID 432 wrote to memory of 1572	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	103
PID 432 wrote to memory of 1572	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	103
PID 432 wrote to memory of 1544	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	104
PID 432 wrote to memory of 1544	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	104
PID 432 wrote to memory of 2852	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	105
PID 432 wrote to memory of 2852	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	105
PID 432 wrote to memory of 540	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	106
PID 432 wrote to memory of 540	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	106
PID 432 wrote to memory of 392	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	107
PID 432 wrote to memory of 392	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	107
PID 432 wrote to memory of 1792	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	108
PID 432 wrote to memory of 1792	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	108
PID 432 wrote to memory of 1396	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	109
PID 432 wrote to memory of 1396	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	109
PID 432 wrote to memory of 4964	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	110
PID 432 wrote to memory of 4964	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	110
PID 432 wrote to memory of 4428	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	111
PID 432 wrote to memory of 4428	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	111
PID 432 wrote to memory of 452	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	112
PID 432 wrote to memory of 452	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	112
PID 432 wrote to memory of 680	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	113
PID 432 wrote to memory of 680	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	113
PID 432 wrote to memory of 4464	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	114
PID 432 wrote to memory of 4464	432	35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\35c9a3c706575ae76a9ed18afbd027d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\System\qWJxdBU.exe
  C:\Windows\System\qWJxdBU.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\ewchMDy.exe
  C:\Windows\System\ewchMDy.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\SOvIDie.exe
  C:\Windows\System\SOvIDie.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\tfBnGWg.exe
  C:\Windows\System\tfBnGWg.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\rwaFXkO.exe
  C:\Windows\System\rwaFXkO.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\aCjqGTv.exe
  C:\Windows\System\aCjqGTv.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\boQKjlg.exe
  C:\Windows\System\boQKjlg.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\eTMvexx.exe
  C:\Windows\System\eTMvexx.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\GJFmkCe.exe
  C:\Windows\System\GJFmkCe.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\rKyMqvd.exe
  C:\Windows\System\rKyMqvd.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\hoDvGyt.exe
  C:\Windows\System\hoDvGyt.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\eBNquSu.exe
  C:\Windows\System\eBNquSu.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\imspQVb.exe
  C:\Windows\System\imspQVb.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\tMtAACc.exe
  C:\Windows\System\tMtAACc.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\BiqmWqa.exe
  C:\Windows\System\BiqmWqa.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\sMGckUX.exe
  C:\Windows\System\sMGckUX.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\nhuZRSa.exe
  C:\Windows\System\nhuZRSa.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\pxAwYhy.exe
  C:\Windows\System\pxAwYhy.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\boHywqt.exe
  C:\Windows\System\boHywqt.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\HiDlRbl.exe
  C:\Windows\System\HiDlRbl.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\lHqVBYU.exe
  C:\Windows\System\lHqVBYU.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\BwoduaE.exe
  C:\Windows\System\BwoduaE.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\dQYlDUj.exe
  C:\Windows\System\dQYlDUj.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\iFWENBs.exe
  C:\Windows\System\iFWENBs.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\lMVbOdb.exe
  C:\Windows\System\lMVbOdb.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\vpnKFFW.exe
  C:\Windows\System\vpnKFFW.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ewQBDpo.exe
  C:\Windows\System\ewQBDpo.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\SKrUWGB.exe
  C:\Windows\System\SKrUWGB.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\lOnQYCF.exe
  C:\Windows\System\lOnQYCF.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\zLoOEIK.exe
  C:\Windows\System\zLoOEIK.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\RAsRFuB.exe
  C:\Windows\System\RAsRFuB.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\EYxBHfD.exe
  C:\Windows\System\EYxBHfD.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\mrcjWMr.exe
  C:\Windows\System\mrcjWMr.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\UCJymqN.exe
  C:\Windows\System\UCJymqN.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\wSTqeCP.exe
  C:\Windows\System\wSTqeCP.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\RkxQAkX.exe
  C:\Windows\System\RkxQAkX.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\RlTdndg.exe
  C:\Windows\System\RlTdndg.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ekqNuNu.exe
  C:\Windows\System\ekqNuNu.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\hkLoQCx.exe
  C:\Windows\System\hkLoQCx.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\NAbvooC.exe
  C:\Windows\System\NAbvooC.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\JZzShoa.exe
  C:\Windows\System\JZzShoa.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\rjQHXWh.exe
  C:\Windows\System\rjQHXWh.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\XsXyAvu.exe
  C:\Windows\System\XsXyAvu.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\VXlkwhg.exe
  C:\Windows\System\VXlkwhg.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\mkIjfQQ.exe
  C:\Windows\System\mkIjfQQ.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\SXeGogT.exe
  C:\Windows\System\SXeGogT.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\SvWnlMS.exe
  C:\Windows\System\SvWnlMS.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\nyBGiai.exe
  C:\Windows\System\nyBGiai.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\rzosZKV.exe
  C:\Windows\System\rzosZKV.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\djZSgWW.exe
  C:\Windows\System\djZSgWW.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\QZMSyls.exe
  C:\Windows\System\QZMSyls.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\zmCPbyp.exe
  C:\Windows\System\zmCPbyp.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\JiHsLFG.exe
  C:\Windows\System\JiHsLFG.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\pAaRpEu.exe
  C:\Windows\System\pAaRpEu.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\HdOOzkc.exe
  C:\Windows\System\HdOOzkc.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\XiIUNur.exe
  C:\Windows\System\XiIUNur.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\ZzMUUUJ.exe
  C:\Windows\System\ZzMUUUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\BOcOfHC.exe
  C:\Windows\System\BOcOfHC.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\hhCuyRA.exe
  C:\Windows\System\hhCuyRA.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\ebYTdBJ.exe
  C:\Windows\System\ebYTdBJ.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\YtCPZbC.exe
  C:\Windows\System\YtCPZbC.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\EzgLmAO.exe
  C:\Windows\System\EzgLmAO.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\yzqHLcp.exe
  C:\Windows\System\yzqHLcp.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\yMYdTgm.exe
  C:\Windows\System\yMYdTgm.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\XtuTilW.exe
  C:\Windows\System\XtuTilW.exe
  2⤵
  PID:4528
- C:\Windows\System\ICLeujD.exe
  C:\Windows\System\ICLeujD.exe
  2⤵
  PID:3372
- C:\Windows\System\EbMXGLv.exe
  C:\Windows\System\EbMXGLv.exe
  2⤵
  PID:652
- C:\Windows\System\JduaJYW.exe
  C:\Windows\System\JduaJYW.exe
  2⤵
  PID:2176
- C:\Windows\System\kDdGwvU.exe
  C:\Windows\System\kDdGwvU.exe
  2⤵
  PID:5100
- C:\Windows\System\xAPmhHx.exe
  C:\Windows\System\xAPmhHx.exe
  2⤵
  PID:2980
- C:\Windows\System\dsHmjvZ.exe
  C:\Windows\System\dsHmjvZ.exe
  2⤵
  PID:4488
- C:\Windows\System\gscGRGE.exe
  C:\Windows\System\gscGRGE.exe
  2⤵
  PID:748
- C:\Windows\System\IvghIQc.exe
  C:\Windows\System\IvghIQc.exe
  2⤵
  PID:2720
- C:\Windows\System\LGzFCvS.exe
  C:\Windows\System\LGzFCvS.exe
  2⤵
  PID:3260
- C:\Windows\System\WsGwDld.exe
  C:\Windows\System\WsGwDld.exe
  2⤵
  PID:932
- C:\Windows\System\qAzakHS.exe
  C:\Windows\System\qAzakHS.exe
  2⤵
  PID:1532
- C:\Windows\System\FkYrLdP.exe
  C:\Windows\System\FkYrLdP.exe
  2⤵
  PID:688
- C:\Windows\System\kZuDuog.exe
  C:\Windows\System\kZuDuog.exe
  2⤵
  PID:3108
- C:\Windows\System\hkhYIRs.exe
  C:\Windows\System\hkhYIRs.exe
  2⤵
  PID:1724
- C:\Windows\System\CmSnvhw.exe
  C:\Windows\System\CmSnvhw.exe
  2⤵
  PID:948
- C:\Windows\System\JlSPVNS.exe
  C:\Windows\System\JlSPVNS.exe
  2⤵
  PID:4320
- C:\Windows\System\hoMkcfX.exe
  C:\Windows\System\hoMkcfX.exe
  2⤵
  PID:4084
- C:\Windows\System\yhYLrQc.exe
  C:\Windows\System\yhYLrQc.exe
  2⤵
  PID:3804
- C:\Windows\System\NsJVdRe.exe
  C:\Windows\System\NsJVdRe.exe
  2⤵
  PID:5148
- C:\Windows\System\NvmxjNB.exe
  C:\Windows\System\NvmxjNB.exe
  2⤵
  PID:5176
- C:\Windows\System\qwMcdwU.exe
  C:\Windows\System\qwMcdwU.exe
  2⤵
  PID:5204
- C:\Windows\System\BjAtreC.exe
  C:\Windows\System\BjAtreC.exe
  2⤵
  PID:5232
- C:\Windows\System\vsfahBU.exe
  C:\Windows\System\vsfahBU.exe
  2⤵
  PID:5260
- C:\Windows\System\ExUCSXP.exe
  C:\Windows\System\ExUCSXP.exe
  2⤵
  PID:5288
- C:\Windows\System\ADjrRNc.exe
  C:\Windows\System\ADjrRNc.exe
  2⤵
  PID:5316
- C:\Windows\System\jUiSrrB.exe
  C:\Windows\System\jUiSrrB.exe
  2⤵
  PID:5344
- C:\Windows\System\bAlYIej.exe
  C:\Windows\System\bAlYIej.exe
  2⤵
  PID:5372
- C:\Windows\System\XGtGsJF.exe
  C:\Windows\System\XGtGsJF.exe
  2⤵
  PID:5400
- C:\Windows\System\oSxOiIB.exe
  C:\Windows\System\oSxOiIB.exe
  2⤵
  PID:5428
- C:\Windows\System\GYxfmHM.exe
  C:\Windows\System\GYxfmHM.exe
  2⤵
  PID:5456
- C:\Windows\System\xoNqzFP.exe
  C:\Windows\System\xoNqzFP.exe
  2⤵
  PID:5480
- C:\Windows\System\vjCOUPW.exe
  C:\Windows\System\vjCOUPW.exe
  2⤵
  PID:5508
- C:\Windows\System\CmlLWtU.exe
  C:\Windows\System\CmlLWtU.exe
  2⤵
  PID:5540
- C:\Windows\System\OdauHKC.exe
  C:\Windows\System\OdauHKC.exe
  2⤵
  PID:5568
- C:\Windows\System\MMZeXkK.exe
  C:\Windows\System\MMZeXkK.exe
  2⤵
  PID:5596
- C:\Windows\System\JluhIuS.exe
  C:\Windows\System\JluhIuS.exe
  2⤵
  PID:5624
- C:\Windows\System\NMaRWfx.exe
  C:\Windows\System\NMaRWfx.exe
  2⤵
  PID:5652
- C:\Windows\System\YMFKXlZ.exe
  C:\Windows\System\YMFKXlZ.exe
  2⤵
  PID:5680
- C:\Windows\System\nnvycYY.exe
  C:\Windows\System\nnvycYY.exe
  2⤵
  PID:5708
- C:\Windows\System\UWAevvq.exe
  C:\Windows\System\UWAevvq.exe
  2⤵
  PID:5736
- C:\Windows\System\LeonHGq.exe
  C:\Windows\System\LeonHGq.exe
  2⤵
  PID:5764
- C:\Windows\System\KFRqtLL.exe
  C:\Windows\System\KFRqtLL.exe
  2⤵
  PID:5792
- C:\Windows\System\iVxaQuX.exe
  C:\Windows\System\iVxaQuX.exe
  2⤵
  PID:5820
- C:\Windows\System\dwxazLC.exe
  C:\Windows\System\dwxazLC.exe
  2⤵
  PID:5848
- C:\Windows\System\aIRPAea.exe
  C:\Windows\System\aIRPAea.exe
  2⤵
  PID:5876
- C:\Windows\System\OfYhrZQ.exe
  C:\Windows\System\OfYhrZQ.exe
  2⤵
  PID:5904
- C:\Windows\System\oRYEZgj.exe
  C:\Windows\System\oRYEZgj.exe
  2⤵
  PID:5932
- C:\Windows\System\NBEyOTe.exe
  C:\Windows\System\NBEyOTe.exe
  2⤵
  PID:5960
- C:\Windows\System\yNzuirx.exe
  C:\Windows\System\yNzuirx.exe
  2⤵
  PID:5988
- C:\Windows\System\kpuICHZ.exe
  C:\Windows\System\kpuICHZ.exe
  2⤵
  PID:6016
- C:\Windows\System\hBQbzHX.exe
  C:\Windows\System\hBQbzHX.exe
  2⤵
  PID:6044
- C:\Windows\System\fDqqwnr.exe
  C:\Windows\System\fDqqwnr.exe
  2⤵
  PID:6072
- C:\Windows\System\FCVYAFX.exe
  C:\Windows\System\FCVYAFX.exe
  2⤵
  PID:6100
- C:\Windows\System\cbgIyua.exe
  C:\Windows\System\cbgIyua.exe
  2⤵
  PID:6128
- C:\Windows\System\FkyvLFF.exe
  C:\Windows\System\FkyvLFF.exe
  2⤵
  PID:3892
- C:\Windows\System\CLphjCU.exe
  C:\Windows\System\CLphjCU.exe
  2⤵
  PID:5044
- C:\Windows\System\QJLqqzU.exe
  C:\Windows\System\QJLqqzU.exe
  2⤵
  PID:4384
- C:\Windows\System\RZreitK.exe
  C:\Windows\System\RZreitK.exe
  2⤵
  PID:4304
- C:\Windows\System\pUgRJyK.exe
  C:\Windows\System\pUgRJyK.exe
  2⤵
  PID:872
- C:\Windows\System\fTVZyZd.exe
  C:\Windows\System\fTVZyZd.exe
  2⤵
  PID:5160
- C:\Windows\System\eOnBqNL.exe
  C:\Windows\System\eOnBqNL.exe
  2⤵
  PID:5216
- C:\Windows\System\SsPEIfR.exe
  C:\Windows\System\SsPEIfR.exe
  2⤵
  PID:5280
- C:\Windows\System\NILtOQa.exe
  C:\Windows\System\NILtOQa.exe
  2⤵
  PID:5356
- C:\Windows\System\rKXqcrP.exe
  C:\Windows\System\rKXqcrP.exe
  2⤵
  PID:5416
- C:\Windows\System\iQskrlY.exe
  C:\Windows\System\iQskrlY.exe
  2⤵
  PID:5476
- C:\Windows\System\fFgssDo.exe
  C:\Windows\System\fFgssDo.exe
  2⤵
  PID:5552
- C:\Windows\System\wSzFIGa.exe
  C:\Windows\System\wSzFIGa.exe
  2⤵
  PID:5612
- C:\Windows\System\SWGNANy.exe
  C:\Windows\System\SWGNANy.exe
  2⤵
  PID:5672
- C:\Windows\System\gJEKhMV.exe
  C:\Windows\System\gJEKhMV.exe
  2⤵
  PID:5748
- C:\Windows\System\CTDuUWg.exe
  C:\Windows\System\CTDuUWg.exe
  2⤵
  PID:5804
- C:\Windows\System\uypfKWQ.exe
  C:\Windows\System\uypfKWQ.exe
  2⤵
  PID:5868
- C:\Windows\System\kATjVTj.exe
  C:\Windows\System\kATjVTj.exe
  2⤵
  PID:5944
- C:\Windows\System\ZCvwKBr.exe
  C:\Windows\System\ZCvwKBr.exe
  2⤵
  PID:6004
- C:\Windows\System\Plbivam.exe
  C:\Windows\System\Plbivam.exe
  2⤵
  PID:6060
- C:\Windows\System\smAfeNc.exe
  C:\Windows\System\smAfeNc.exe
  2⤵
  PID:6120
- C:\Windows\System\hCXjADs.exe
  C:\Windows\System\hCXjADs.exe
  2⤵
  PID:3168
- C:\Windows\System\CQKWgSa.exe
  C:\Windows\System\CQKWgSa.exe
  2⤵
  PID:4700
- C:\Windows\System\poQaykP.exe
  C:\Windows\System\poQaykP.exe
  2⤵
  PID:5192
- C:\Windows\System\eSQYRxR.exe
  C:\Windows\System\eSQYRxR.exe
  2⤵
  PID:5332
- C:\Windows\System\rrTICYd.exe
  C:\Windows\System\rrTICYd.exe
  2⤵
  PID:5504
- C:\Windows\System\rxrBXLU.exe
  C:\Windows\System\rxrBXLU.exe
  2⤵
  PID:5644
- C:\Windows\System\aPqtNZn.exe
  C:\Windows\System\aPqtNZn.exe
  2⤵
  PID:5784
- C:\Windows\System\XdbRugq.exe
  C:\Windows\System\XdbRugq.exe
  2⤵
  PID:5972
- C:\Windows\System\tUQyQNW.exe
  C:\Windows\System\tUQyQNW.exe
  2⤵
  PID:6164
- C:\Windows\System\uabnEIV.exe
  C:\Windows\System\uabnEIV.exe
  2⤵
  PID:6192
- C:\Windows\System\kpHNpYI.exe
  C:\Windows\System\kpHNpYI.exe
  2⤵
  PID:6220
- C:\Windows\System\ZNqWxHA.exe
  C:\Windows\System\ZNqWxHA.exe
  2⤵
  PID:6248
- C:\Windows\System\HQiUMRw.exe
  C:\Windows\System\HQiUMRw.exe
  2⤵
  PID:6276
- C:\Windows\System\yfyejuu.exe
  C:\Windows\System\yfyejuu.exe
  2⤵
  PID:6304
- C:\Windows\System\BYGtSAC.exe
  C:\Windows\System\BYGtSAC.exe
  2⤵
  PID:6332
- C:\Windows\System\zlydmTT.exe
  C:\Windows\System\zlydmTT.exe
  2⤵
  PID:6360
- C:\Windows\System\KSkNDGe.exe
  C:\Windows\System\KSkNDGe.exe
  2⤵
  PID:6388
- C:\Windows\System\vEasIpl.exe
  C:\Windows\System\vEasIpl.exe
  2⤵
  PID:6416
- C:\Windows\System\CibQQsK.exe
  C:\Windows\System\CibQQsK.exe
  2⤵
  PID:6444
- C:\Windows\System\HxEtSOP.exe
  C:\Windows\System\HxEtSOP.exe
  2⤵
  PID:6472
- C:\Windows\System\LNrYSjI.exe
  C:\Windows\System\LNrYSjI.exe
  2⤵
  PID:6504
- C:\Windows\System\hnsOZKA.exe
  C:\Windows\System\hnsOZKA.exe
  2⤵
  PID:6536
- C:\Windows\System\ixKEXRJ.exe
  C:\Windows\System\ixKEXRJ.exe
  2⤵
  PID:6564
- C:\Windows\System\HGStQBa.exe
  C:\Windows\System\HGStQBa.exe
  2⤵
  PID:6584
- C:\Windows\System\KVWmHxx.exe
  C:\Windows\System\KVWmHxx.exe
  2⤵
  PID:6612
- C:\Windows\System\zSXErPy.exe
  C:\Windows\System\zSXErPy.exe
  2⤵
  PID:6640
- C:\Windows\System\PqqzCEP.exe
  C:\Windows\System\PqqzCEP.exe
  2⤵
  PID:6668
- C:\Windows\System\WwmcUgO.exe
  C:\Windows\System\WwmcUgO.exe
  2⤵
  PID:6696
- C:\Windows\System\SiIPzeh.exe
  C:\Windows\System\SiIPzeh.exe
  2⤵
  PID:6724
- C:\Windows\System\XjvUXOf.exe
  C:\Windows\System\XjvUXOf.exe
  2⤵
  PID:6752
- C:\Windows\System\aaxQFyP.exe
  C:\Windows\System\aaxQFyP.exe
  2⤵
  PID:6780
- C:\Windows\System\WGFgJdM.exe
  C:\Windows\System\WGFgJdM.exe
  2⤵
  PID:6808
- C:\Windows\System\mJRTqxF.exe
  C:\Windows\System\mJRTqxF.exe
  2⤵
  PID:6836
- C:\Windows\System\eDTUZID.exe
  C:\Windows\System\eDTUZID.exe
  2⤵
  PID:6864
- C:\Windows\System\hkLPGyR.exe
  C:\Windows\System\hkLPGyR.exe
  2⤵
  PID:6892
- C:\Windows\System\eQxjacE.exe
  C:\Windows\System\eQxjacE.exe
  2⤵
  PID:6920
- C:\Windows\System\KtBrjlq.exe
  C:\Windows\System\KtBrjlq.exe
  2⤵
  PID:6948
- C:\Windows\System\MQyZGbA.exe
  C:\Windows\System\MQyZGbA.exe
  2⤵
  PID:6976
- C:\Windows\System\lRqzmOC.exe
  C:\Windows\System\lRqzmOC.exe
  2⤵
  PID:7004
- C:\Windows\System\vbuKVoH.exe
  C:\Windows\System\vbuKVoH.exe
  2⤵
  PID:7032
- C:\Windows\System\ysfitAB.exe
  C:\Windows\System\ysfitAB.exe
  2⤵
  PID:7060
- C:\Windows\System\MWFqMmy.exe
  C:\Windows\System\MWFqMmy.exe
  2⤵
  PID:7088
- C:\Windows\System\RcOxKRr.exe
  C:\Windows\System\RcOxKRr.exe
  2⤵
  PID:7116
- C:\Windows\System\neWQsvr.exe
  C:\Windows\System\neWQsvr.exe
  2⤵
  PID:7144
- C:\Windows\System\ahNVTxU.exe
  C:\Windows\System\ahNVTxU.exe
  2⤵
  PID:6036
- C:\Windows\System\BwYcwuS.exe
  C:\Windows\System\BwYcwuS.exe
  2⤵
  PID:4312
- C:\Windows\System\FheUQXD.exe
  C:\Windows\System\FheUQXD.exe
  2⤵
  PID:5136
- C:\Windows\System\rEgPbvN.exe
  C:\Windows\System\rEgPbvN.exe
  2⤵
  PID:5580
- C:\Windows\System\TReNzCr.exe
  C:\Windows\System\TReNzCr.exe
  2⤵
  PID:5860
- C:\Windows\System\fniZUKP.exe
  C:\Windows\System\fniZUKP.exe
  2⤵
  PID:6180
- C:\Windows\System\acNFiiL.exe
  C:\Windows\System\acNFiiL.exe
  2⤵
  PID:6240
- C:\Windows\System\hVsCxSa.exe
  C:\Windows\System\hVsCxSa.exe
  2⤵
  PID:6316
- C:\Windows\System\rZdfncS.exe
  C:\Windows\System\rZdfncS.exe
  2⤵
  PID:6376
- C:\Windows\System\yzwrLBG.exe
  C:\Windows\System\yzwrLBG.exe
  2⤵
  PID:6436
- C:\Windows\System\rnJyWtJ.exe
  C:\Windows\System\rnJyWtJ.exe
  2⤵
  PID:2412
- C:\Windows\System\OWkPFuL.exe
  C:\Windows\System\OWkPFuL.exe
  2⤵
  PID:6552
- C:\Windows\System\CjxhbmJ.exe
  C:\Windows\System\CjxhbmJ.exe
  2⤵
  PID:6604
- C:\Windows\System\mVoFryc.exe
  C:\Windows\System\mVoFryc.exe
  2⤵
  PID:6680
- C:\Windows\System\yZfpqCp.exe
  C:\Windows\System\yZfpqCp.exe
  2⤵
  PID:6740
- C:\Windows\System\CMdtTdE.exe
  C:\Windows\System\CMdtTdE.exe
  2⤵
  PID:364
- C:\Windows\System\ITpRETo.exe
  C:\Windows\System\ITpRETo.exe
  2⤵
  PID:6852
- C:\Windows\System\sqRExaw.exe
  C:\Windows\System\sqRExaw.exe
  2⤵
  PID:6908
- C:\Windows\System\KHrzHyW.exe
  C:\Windows\System\KHrzHyW.exe
  2⤵
  PID:3116
- C:\Windows\System\qSWLucf.exe
  C:\Windows\System\qSWLucf.exe
  2⤵
  PID:7016
- C:\Windows\System\ugnZIRI.exe
  C:\Windows\System\ugnZIRI.exe
  2⤵
  PID:7076
- C:\Windows\System\zGLtcUe.exe
  C:\Windows\System\zGLtcUe.exe
  2⤵
  PID:7132
- C:\Windows\System\LPDwKbZ.exe
  C:\Windows\System\LPDwKbZ.exe
  2⤵
  PID:6092
- C:\Windows\System\emTSebv.exe
  C:\Windows\System\emTSebv.exe
  2⤵
  PID:5392
- C:\Windows\System\ftDtcUR.exe
  C:\Windows\System\ftDtcUR.exe
  2⤵
  PID:6152
- C:\Windows\System\imoBZzh.exe
  C:\Windows\System\imoBZzh.exe
  2⤵
  PID:6288
- C:\Windows\System\XazlWAq.exe
  C:\Windows\System\XazlWAq.exe
  2⤵
  PID:6652
- C:\Windows\System\MMdIsLH.exe
  C:\Windows\System\MMdIsLH.exe
  2⤵
  PID:6820
- C:\Windows\System\bGkJInr.exe
  C:\Windows\System\bGkJInr.exe
  2⤵
  PID:6876
- C:\Windows\System\EUvRFkV.exe
  C:\Windows\System\EUvRFkV.exe
  2⤵
  PID:6936
- C:\Windows\System\CFLIvbL.exe
  C:\Windows\System\CFLIvbL.exe
  2⤵
  PID:1512
- C:\Windows\System\opjYMEM.exe
  C:\Windows\System\opjYMEM.exe
  2⤵
  PID:4872
- C:\Windows\System\QOJeqUM.exe
  C:\Windows\System\QOJeqUM.exe
  2⤵
  PID:5776
- C:\Windows\System\luaTFjM.exe
  C:\Windows\System\luaTFjM.exe
  2⤵
  PID:4008
- C:\Windows\System\xxLqcwY.exe
  C:\Windows\System\xxLqcwY.exe
  2⤵
  PID:2188
- C:\Windows\System\nUQJaZN.exe
  C:\Windows\System\nUQJaZN.exe
  2⤵
  PID:3960
- C:\Windows\System\HXCyROO.exe
  C:\Windows\System\HXCyROO.exe
  2⤵
  PID:1660
- C:\Windows\System\yNvjojI.exe
  C:\Windows\System\yNvjojI.exe
  2⤵
  PID:4788
- C:\Windows\System\SzBMzux.exe
  C:\Windows\System\SzBMzux.exe
  2⤵
  PID:6148
- C:\Windows\System\iGsNTGb.exe
  C:\Windows\System\iGsNTGb.exe
  2⤵
  PID:3400
- C:\Windows\System\HWhVtfo.exe
  C:\Windows\System\HWhVtfo.exe
  2⤵
  PID:4068
- C:\Windows\System\JAYjnGL.exe
  C:\Windows\System\JAYjnGL.exe
  2⤵
  PID:1908
- C:\Windows\System\OOMLJDo.exe
  C:\Windows\System\OOMLJDo.exe
  2⤵
  PID:6232
- C:\Windows\System\ZfEbVrZ.exe
  C:\Windows\System\ZfEbVrZ.exe
  2⤵
  PID:7180
- C:\Windows\System\LRYKGPn.exe
  C:\Windows\System\LRYKGPn.exe
  2⤵
  PID:7220
- C:\Windows\System\NLAQRjm.exe
  C:\Windows\System\NLAQRjm.exe
  2⤵
  PID:7248
- C:\Windows\System\NPYNDoz.exe
  C:\Windows\System\NPYNDoz.exe
  2⤵
  PID:7344
- C:\Windows\System\qkfbuZE.exe
  C:\Windows\System\qkfbuZE.exe
  2⤵
  PID:7376
- C:\Windows\System\nxRfcSZ.exe
  C:\Windows\System\nxRfcSZ.exe
  2⤵
  PID:7412
- C:\Windows\System\pkcvhgw.exe
  C:\Windows\System\pkcvhgw.exe
  2⤵
  PID:7432
- C:\Windows\System\QYwfovc.exe
  C:\Windows\System\QYwfovc.exe
  2⤵
  PID:7452
- C:\Windows\System\hCFWYsD.exe
  C:\Windows\System\hCFWYsD.exe
  2⤵
  PID:7468
- C:\Windows\System\cyKRsan.exe
  C:\Windows\System\cyKRsan.exe
  2⤵
  PID:7496
- C:\Windows\System\pkyEvfK.exe
  C:\Windows\System\pkyEvfK.exe
  2⤵
  PID:7532
- C:\Windows\System\XVGFSkM.exe
  C:\Windows\System\XVGFSkM.exe
  2⤵
  PID:7592
- C:\Windows\System\pdbEnUt.exe
  C:\Windows\System\pdbEnUt.exe
  2⤵
  PID:7616
- C:\Windows\System\KXCXuXH.exe
  C:\Windows\System\KXCXuXH.exe
  2⤵
  PID:7640
- C:\Windows\System\YPYJSus.exe
  C:\Windows\System\YPYJSus.exe
  2⤵
  PID:7664
- C:\Windows\System\OuczMxL.exe
  C:\Windows\System\OuczMxL.exe
  2⤵
  PID:7696
- C:\Windows\System\bLIZzet.exe
  C:\Windows\System\bLIZzet.exe
  2⤵
  PID:7724
- C:\Windows\System\juqwpcS.exe
  C:\Windows\System\juqwpcS.exe
  2⤵
  PID:7752
- C:\Windows\System\GAVsdwT.exe
  C:\Windows\System\GAVsdwT.exe
  2⤵
  PID:7780
- C:\Windows\System\EobGvwK.exe
  C:\Windows\System\EobGvwK.exe
  2⤵
  PID:7808
- C:\Windows\System\atxWkvx.exe
  C:\Windows\System\atxWkvx.exe
  2⤵
  PID:7836
- C:\Windows\System\JSqFAoP.exe
  C:\Windows\System\JSqFAoP.exe
  2⤵
  PID:7864
- C:\Windows\System\XsXXKAU.exe
  C:\Windows\System\XsXXKAU.exe
  2⤵
  PID:7892
- C:\Windows\System\rzLXycF.exe
  C:\Windows\System\rzLXycF.exe
  2⤵
  PID:7920
- C:\Windows\System\UikBhFz.exe
  C:\Windows\System\UikBhFz.exe
  2⤵
  PID:7948
- C:\Windows\System\YMdvmRy.exe
  C:\Windows\System\YMdvmRy.exe
  2⤵
  PID:7976
- C:\Windows\System\kbZCWEc.exe
  C:\Windows\System\kbZCWEc.exe
  2⤵
  PID:8004
- C:\Windows\System\tmnNuyv.exe
  C:\Windows\System\tmnNuyv.exe
  2⤵
  PID:8032
- C:\Windows\System\XuzauHP.exe
  C:\Windows\System\XuzauHP.exe
  2⤵
  PID:8060
- C:\Windows\System\yzbdrrX.exe
  C:\Windows\System\yzbdrrX.exe
  2⤵
  PID:8088
- C:\Windows\System\zqhFXJL.exe
  C:\Windows\System\zqhFXJL.exe
  2⤵
  PID:8116
- C:\Windows\System\QqAKKav.exe
  C:\Windows\System\QqAKKav.exe
  2⤵
  PID:8144
- C:\Windows\System\nMlFjBv.exe
  C:\Windows\System\nMlFjBv.exe
  2⤵
  PID:8180
- C:\Windows\System\mgbfVdP.exe
  C:\Windows\System\mgbfVdP.exe
  2⤵
  PID:7328
- C:\Windows\System\HfxUVcQ.exe
  C:\Windows\System\HfxUVcQ.exe
  2⤵
  PID:7404
- C:\Windows\System\iNLZFqk.exe
  C:\Windows\System\iNLZFqk.exe
  2⤵
  PID:7440
- C:\Windows\System\iYTZwmR.exe
  C:\Windows\System\iYTZwmR.exe
  2⤵
  PID:7996
- C:\Windows\System\jZIXfDI.exe
  C:\Windows\System\jZIXfDI.exe
  2⤵
  PID:7936
- C:\Windows\System\EzpuTNd.exe
  C:\Windows\System\EzpuTNd.exe
  2⤵
  PID:7904
- C:\Windows\System\WBcpNQn.exe
  C:\Windows\System\WBcpNQn.exe
  2⤵
  PID:7852
- C:\Windows\System\vakmHXp.exe
  C:\Windows\System\vakmHXp.exe
  2⤵
  PID:6208
- C:\Windows\System\MIOcoht.exe
  C:\Windows\System\MIOcoht.exe
  2⤵
  PID:7740
- C:\Windows\System\XbFrVvo.exe
  C:\Windows\System\XbFrVvo.exe
  2⤵
  PID:7660
- C:\Windows\System\BlOxvMF.exe
  C:\Windows\System\BlOxvMF.exe
  2⤵
  PID:7604
- C:\Windows\System\Iqheafs.exe
  C:\Windows\System\Iqheafs.exe
  2⤵
  PID:6968
- C:\Windows\System\HFkZoBQ.exe
  C:\Windows\System\HFkZoBQ.exe
  2⤵
  PID:8128
- C:\Windows\System\Gvzpahr.exe
  C:\Windows\System\Gvzpahr.exe
  2⤵
  PID:7108
- C:\Windows\System\iRqOGti.exe
  C:\Windows\System\iRqOGti.exe
  2⤵
  PID:6824
- C:\Windows\System\YaHbjHG.exe
  C:\Windows\System\YaHbjHG.exe
  2⤵
  PID:7332
- C:\Windows\System\CcmdLYZ.exe
  C:\Windows\System\CcmdLYZ.exe
  2⤵
  PID:3524
- C:\Windows\System\GrjfqAA.exe
  C:\Windows\System\GrjfqAA.exe
  2⤵
  PID:2660
- C:\Windows\System\zATPTjB.exe
  C:\Windows\System\zATPTjB.exe
  2⤵
  PID:7908
- C:\Windows\System\EvbTuwB.exe
  C:\Windows\System\EvbTuwB.exe
  2⤵
  PID:7856
- C:\Windows\System\haQsGku.exe
  C:\Windows\System\haQsGku.exe
  2⤵
  PID:7632
- C:\Windows\System\OTcJGuD.exe
  C:\Windows\System\OTcJGuD.exe
  2⤵
  PID:3564
- C:\Windows\System\NmswKuK.exe
  C:\Windows\System\NmswKuK.exe
  2⤵
  PID:6488
- C:\Windows\System\ROKwzTO.exe
  C:\Windows\System\ROKwzTO.exe
  2⤵
  PID:5028
- C:\Windows\System\BFqYSgH.exe
  C:\Windows\System\BFqYSgH.exe
  2⤵
  PID:7800
- C:\Windows\System\YhQBVRY.exe
  C:\Windows\System\YhQBVRY.exe
  2⤵
  PID:7544
- C:\Windows\System\wWHsLka.exe
  C:\Windows\System\wWHsLka.exe
  2⤵
  PID:7568
- C:\Windows\System\xXiAJsI.exe
  C:\Windows\System\xXiAJsI.exe
  2⤵
  PID:7504
- C:\Windows\System\NiSLiYi.exe
  C:\Windows\System\NiSLiYi.exe
  2⤵
  PID:7576
- C:\Windows\System\aVqVYVb.exe
  C:\Windows\System\aVqVYVb.exe
  2⤵
  PID:8220
- C:\Windows\System\gbVUoPA.exe
  C:\Windows\System\gbVUoPA.exe
  2⤵
  PID:8248
- C:\Windows\System\RqxZfJa.exe
  C:\Windows\System\RqxZfJa.exe
  2⤵
  PID:8280
- C:\Windows\System\frZekIW.exe
  C:\Windows\System\frZekIW.exe
  2⤵
  PID:8316
- C:\Windows\System\GLZforL.exe
  C:\Windows\System\GLZforL.exe
  2⤵
  PID:8344
- C:\Windows\System\aHSttxh.exe
  C:\Windows\System\aHSttxh.exe
  2⤵
  PID:8372
- C:\Windows\System\bmqbgqa.exe
  C:\Windows\System\bmqbgqa.exe
  2⤵
  PID:8408
- C:\Windows\System\IKOCyLc.exe
  C:\Windows\System\IKOCyLc.exe
  2⤵
  PID:8428
- C:\Windows\System\rFzEXNS.exe
  C:\Windows\System\rFzEXNS.exe
  2⤵
  PID:8456
- C:\Windows\System\WzQwKzI.exe
  C:\Windows\System\WzQwKzI.exe
  2⤵
  PID:8480
- C:\Windows\System\jxhHvHg.exe
  C:\Windows\System\jxhHvHg.exe
  2⤵
  PID:8512
- C:\Windows\System\DbaFhxK.exe
  C:\Windows\System\DbaFhxK.exe
  2⤵
  PID:8548
- C:\Windows\System\KgGYqCP.exe
  C:\Windows\System\KgGYqCP.exe
  2⤵
  PID:8576
- C:\Windows\System\QQlyYeB.exe
  C:\Windows\System\QQlyYeB.exe
  2⤵
  PID:8620
- C:\Windows\System\yOoffCb.exe
  C:\Windows\System\yOoffCb.exe
  2⤵
  PID:8656
- C:\Windows\System\xJyDuCP.exe
  C:\Windows\System\xJyDuCP.exe
  2⤵
  PID:8680
- C:\Windows\System\MrkKsnH.exe
  C:\Windows\System\MrkKsnH.exe
  2⤵
  PID:8712
- C:\Windows\System\BLYNCCl.exe
  C:\Windows\System\BLYNCCl.exe
  2⤵
  PID:8740
- C:\Windows\System\GiGEzIW.exe
  C:\Windows\System\GiGEzIW.exe
  2⤵
  PID:8768
- C:\Windows\System\scHDLmQ.exe
  C:\Windows\System\scHDLmQ.exe
  2⤵
  PID:8796
- C:\Windows\System\cBduTry.exe
  C:\Windows\System\cBduTry.exe
  2⤵
  PID:8820
- C:\Windows\System\LiNvawG.exe
  C:\Windows\System\LiNvawG.exe
  2⤵
  PID:8852
- C:\Windows\System\Dhtyoqj.exe
  C:\Windows\System\Dhtyoqj.exe
  2⤵
  PID:8868
- C:\Windows\System\DKbgqcx.exe
  C:\Windows\System\DKbgqcx.exe
  2⤵
  PID:8892
- C:\Windows\System\elZsCgX.exe
  C:\Windows\System\elZsCgX.exe
  2⤵
  PID:8924
- C:\Windows\System\KIalrXT.exe
  C:\Windows\System\KIalrXT.exe
  2⤵
  PID:8948
- C:\Windows\System\ArUyRwe.exe
  C:\Windows\System\ArUyRwe.exe
  2⤵
  PID:8992
- C:\Windows\System\mICudHV.exe
  C:\Windows\System\mICudHV.exe
  2⤵
  PID:9020
- C:\Windows\System\ACoCqeQ.exe
  C:\Windows\System\ACoCqeQ.exe
  2⤵
  PID:9048
- C:\Windows\System\fvedebe.exe
  C:\Windows\System\fvedebe.exe
  2⤵
  PID:9076
- C:\Windows\System\BMVLXnf.exe
  C:\Windows\System\BMVLXnf.exe
  2⤵
  PID:9104
- C:\Windows\System\wwcqQiy.exe
  C:\Windows\System\wwcqQiy.exe
  2⤵
  PID:9132
- C:\Windows\System\ImMAVTR.exe
  C:\Windows\System\ImMAVTR.exe
  2⤵
  PID:9160
- C:\Windows\System\OmCIqik.exe
  C:\Windows\System\OmCIqik.exe
  2⤵
  PID:9188
- C:\Windows\System\LBzmeah.exe
  C:\Windows\System\LBzmeah.exe
  2⤵
  PID:9204
- C:\Windows\System\cROvjbS.exe
  C:\Windows\System\cROvjbS.exe
  2⤵
  PID:8268
- C:\Windows\System\AIqjcHX.exe
  C:\Windows\System\AIqjcHX.exe
  2⤵
  PID:8324
- C:\Windows\System\kkuXmDe.exe
  C:\Windows\System\kkuXmDe.exe
  2⤵
  PID:8336
- C:\Windows\System\wvPWbdJ.exe
  C:\Windows\System\wvPWbdJ.exe
  2⤵
  PID:8384
- C:\Windows\System\ZtnMQkF.exe
  C:\Windows\System\ZtnMQkF.exe
  2⤵
  PID:3756
- C:\Windows\System\ixrdoDm.exe
  C:\Windows\System\ixrdoDm.exe
  2⤵
  PID:8424
- C:\Windows\System\IsAgTSc.exe
  C:\Windows\System\IsAgTSc.exe
  2⤵
  PID:8464
- C:\Windows\System\LDeyIPd.exe
  C:\Windows\System\LDeyIPd.exe
  2⤵
  PID:8500
- C:\Windows\System\YEiIqHy.exe
  C:\Windows\System\YEiIqHy.exe
  2⤵
  PID:8688
- C:\Windows\System\yvGZXTU.exe
  C:\Windows\System\yvGZXTU.exe
  2⤵
  PID:8732
- C:\Windows\System\tyxaJwT.exe
  C:\Windows\System\tyxaJwT.exe
  2⤵
  PID:8784
- C:\Windows\System\HfhnVTW.exe
  C:\Windows\System\HfhnVTW.exe
  2⤵
  PID:8884
- C:\Windows\System\dHFlkSc.exe
  C:\Windows\System\dHFlkSc.exe
  2⤵
  PID:8932
- C:\Windows\System\XhUQmhd.exe
  C:\Windows\System\XhUQmhd.exe
  2⤵
  PID:9016
- C:\Windows\System\BNkhhaJ.exe
  C:\Windows\System\BNkhhaJ.exe
  2⤵
  PID:9100
- C:\Windows\System\retBfIE.exe
  C:\Windows\System\retBfIE.exe
  2⤵
  PID:9156
- C:\Windows\System\BzeQlQW.exe
  C:\Windows\System\BzeQlQW.exe
  2⤵
  PID:8212
- C:\Windows\System\HWztxRQ.exe
  C:\Windows\System\HWztxRQ.exe
  2⤵
  PID:6632
- C:\Windows\System\ohzaoDd.exe
  C:\Windows\System\ohzaoDd.exe
  2⤵
  PID:8416
- C:\Windows\System\hBYEriN.exe
  C:\Windows\System\hBYEriN.exe
  2⤵
  PID:8496
- C:\Windows\System\NmjZfQK.exe
  C:\Windows\System\NmjZfQK.exe
  2⤵
  PID:8724
- C:\Windows\System\zsFFGAd.exe
  C:\Windows\System\zsFFGAd.exe
  2⤵
  PID:8860
- C:\Windows\System\uZGYyTQ.exe
  C:\Windows\System\uZGYyTQ.exe
  2⤵
  PID:9008
- C:\Windows\System\zmsrBaM.exe
  C:\Windows\System\zmsrBaM.exe
  2⤵
  PID:9144
- C:\Windows\System\LTogvSY.exe
  C:\Windows\System\LTogvSY.exe
  2⤵
  PID:8356
- C:\Windows\System\tnhTQoX.exe
  C:\Windows\System\tnhTQoX.exe
  2⤵
  PID:8568
- C:\Windows\System\xwOQore.exe
  C:\Windows\System\xwOQore.exe
  2⤵
  PID:9064
- C:\Windows\System\vmHvFFI.exe
  C:\Windows\System\vmHvFFI.exe
  2⤵
  PID:8472
- C:\Windows\System\ukkMwVO.exe
  C:\Windows\System\ukkMwVO.exe
  2⤵
  PID:8452
- C:\Windows\System\lwXtESa.exe
  C:\Windows\System\lwXtESa.exe
  2⤵
  PID:9232
- C:\Windows\System\rBEeZaj.exe
  C:\Windows\System\rBEeZaj.exe
  2⤵
  PID:9260
- C:\Windows\System\BwKeXIJ.exe
  C:\Windows\System\BwKeXIJ.exe
  2⤵
  PID:9288
- C:\Windows\System\rlwtxbQ.exe
  C:\Windows\System\rlwtxbQ.exe
  2⤵
  PID:9316
- C:\Windows\System\pRWlQBj.exe
  C:\Windows\System\pRWlQBj.exe
  2⤵
  PID:9360
- C:\Windows\System\OtISQCi.exe
  C:\Windows\System\OtISQCi.exe
  2⤵
  PID:9388
- C:\Windows\System\qsjylFt.exe
  C:\Windows\System\qsjylFt.exe
  2⤵
  PID:9416
- C:\Windows\System\TqrdRII.exe
  C:\Windows\System\TqrdRII.exe
  2⤵
  PID:9436
- C:\Windows\System\PTQeDoT.exe
  C:\Windows\System\PTQeDoT.exe
  2⤵
  PID:9460
- C:\Windows\System\WeLWUFJ.exe
  C:\Windows\System\WeLWUFJ.exe
  2⤵
  PID:9492
- C:\Windows\System\JuBEPPT.exe
  C:\Windows\System\JuBEPPT.exe
  2⤵
  PID:9528
- C:\Windows\System\zJjapDd.exe
  C:\Windows\System\zJjapDd.exe
  2⤵
  PID:9556
- C:\Windows\System\jnZEzef.exe
  C:\Windows\System\jnZEzef.exe
  2⤵
  PID:9576
- C:\Windows\System\AONaGKY.exe
  C:\Windows\System\AONaGKY.exe
  2⤵
  PID:9600
- C:\Windows\System\TTYruCt.exe
  C:\Windows\System\TTYruCt.exe
  2⤵
  PID:9628
- C:\Windows\System\jJzfbqs.exe
  C:\Windows\System\jJzfbqs.exe
  2⤵
  PID:9648
- C:\Windows\System\WDmuOLn.exe
  C:\Windows\System\WDmuOLn.exe
  2⤵
  PID:9676
- C:\Windows\System\aNmFjty.exe
  C:\Windows\System\aNmFjty.exe
  2⤵
  PID:9696
- C:\Windows\System\RYlegHo.exe
  C:\Windows\System\RYlegHo.exe
  2⤵
  PID:9716
- C:\Windows\System\efeUZbd.exe
  C:\Windows\System\efeUZbd.exe
  2⤵
  PID:9756
- C:\Windows\System\ItBgTCg.exe
  C:\Windows\System\ItBgTCg.exe
  2⤵
  PID:9788
- C:\Windows\System\xDTnxwN.exe
  C:\Windows\System\xDTnxwN.exe
  2⤵
  PID:9824
- C:\Windows\System\ttYcGUq.exe
  C:\Windows\System\ttYcGUq.exe
  2⤵
  PID:9868
- C:\Windows\System\JJEPJcU.exe
  C:\Windows\System\JJEPJcU.exe
  2⤵
  PID:9896
- C:\Windows\System\iigziTJ.exe
  C:\Windows\System\iigziTJ.exe
  2⤵
  PID:9912
- C:\Windows\System\ifHrLKU.exe
  C:\Windows\System\ifHrLKU.exe
  2⤵
  PID:9952
- C:\Windows\System\vrorBbc.exe
  C:\Windows\System\vrorBbc.exe
  2⤵
  PID:9980
- C:\Windows\System\NtBXbMg.exe
  C:\Windows\System\NtBXbMg.exe
  2⤵
  PID:10008
- C:\Windows\System\iDnlriW.exe
  C:\Windows\System\iDnlriW.exe
  2⤵
  PID:10036
- C:\Windows\System\wWUhkEG.exe
  C:\Windows\System\wWUhkEG.exe
  2⤵
  PID:10056
- C:\Windows\System\NPdJqZc.exe
  C:\Windows\System\NPdJqZc.exe
  2⤵
  PID:10092
- C:\Windows\System\pYGLeuX.exe
  C:\Windows\System\pYGLeuX.exe
  2⤵
  PID:10116
- C:\Windows\System\LjmIPPn.exe
  C:\Windows\System\LjmIPPn.exe
  2⤵
  PID:10136
- C:\Windows\System\iSGvcsO.exe
  C:\Windows\System\iSGvcsO.exe
  2⤵
  PID:10160
- C:\Windows\System\DQQXSzV.exe
  C:\Windows\System\DQQXSzV.exe
  2⤵
  PID:10208
- C:\Windows\System\zYkgfYA.exe
  C:\Windows\System\zYkgfYA.exe
  2⤵
  PID:10236
- C:\Windows\System\nrjddrQ.exe
  C:\Windows\System\nrjddrQ.exe
  2⤵
  PID:9272
- C:\Windows\System\KmTdfJB.exe
  C:\Windows\System\KmTdfJB.exe
  2⤵
  PID:9336
- C:\Windows\System\fQtRxgN.exe
  C:\Windows\System\fQtRxgN.exe
  2⤵
  PID:9384
- C:\Windows\System\GwzRRaZ.exe
  C:\Windows\System\GwzRRaZ.exe
  2⤵
  PID:9484
- C:\Windows\System\oMXGBkA.exe
  C:\Windows\System\oMXGBkA.exe
  2⤵
  PID:9552
- C:\Windows\System\GMaxwaZ.exe
  C:\Windows\System\GMaxwaZ.exe
  2⤵
  PID:9596
- C:\Windows\System\aYVsrXc.exe
  C:\Windows\System\aYVsrXc.exe
  2⤵
  PID:9688
- C:\Windows\System\gchuEMP.exe
  C:\Windows\System\gchuEMP.exe
  2⤵
  PID:9736
- C:\Windows\System\ldLqCHy.exe
  C:\Windows\System\ldLqCHy.exe
  2⤵
  PID:9804
- C:\Windows\System\pJELsuL.exe
  C:\Windows\System\pJELsuL.exe
  2⤵
  PID:9880
- C:\Windows\System\WFHaIZM.exe
  C:\Windows\System\WFHaIZM.exe
  2⤵
  PID:9932
- C:\Windows\System\bMKNKQL.exe
  C:\Windows\System\bMKNKQL.exe
  2⤵
  PID:10004
- C:\Windows\System\FMLUpJu.exe
  C:\Windows\System\FMLUpJu.exe
  2⤵
  PID:10064
- C:\Windows\System\KJDuMdx.exe
  C:\Windows\System\KJDuMdx.exe
  2⤵
  PID:10112
- C:\Windows\System\tBQDVJE.exe
  C:\Windows\System\tBQDVJE.exe
  2⤵
  PID:10192
- C:\Windows\System\uaoHTeI.exe
  C:\Windows\System\uaoHTeI.exe
  2⤵
  PID:9308
- C:\Windows\System\nHDyJzm.exe
  C:\Windows\System\nHDyJzm.exe
  2⤵
  PID:9452
- C:\Windows\System\LGzYRQL.exe
  C:\Windows\System\LGzYRQL.exe
  2⤵
  PID:9588
- C:\Windows\System\PHAOPPl.exe
  C:\Windows\System\PHAOPPl.exe
  2⤵
  PID:9784
- C:\Windows\System\ILbiVwV.exe
  C:\Windows\System\ILbiVwV.exe
  2⤵
  PID:9928
- C:\Windows\System\GVsqlsY.exe
  C:\Windows\System\GVsqlsY.exe
  2⤵
  PID:10000
- C:\Windows\System\hPamWLR.exe
  C:\Windows\System\hPamWLR.exe
  2⤵
  PID:10232
- C:\Windows\System\UqXOZOF.exe
  C:\Windows\System\UqXOZOF.exe
  2⤵
  PID:9376
- C:\Windows\System\bVdWiaB.exe
  C:\Windows\System\bVdWiaB.exe
  2⤵
  PID:9708
- C:\Windows\System\SErczck.exe
  C:\Windows\System\SErczck.exe
  2⤵
  PID:10148
- C:\Windows\System\GJsLCnD.exe
  C:\Windows\System\GJsLCnD.exe
  2⤵
  PID:9684
- C:\Windows\System\xVeZMBd.exe
  C:\Windows\System\xVeZMBd.exe
  2⤵
  PID:10268
- C:\Windows\System\bhGQCPI.exe
  C:\Windows\System\bhGQCPI.exe
  2⤵
  PID:10284
- C:\Windows\System\EHaCXGe.exe
  C:\Windows\System\EHaCXGe.exe
  2⤵
  PID:10324
- C:\Windows\System\zEMWBYn.exe
  C:\Windows\System\zEMWBYn.exe
  2⤵
  PID:10348
- C:\Windows\System\IVQbQHC.exe
  C:\Windows\System\IVQbQHC.exe
  2⤵
  PID:10380
- C:\Windows\System\ELwFtND.exe
  C:\Windows\System\ELwFtND.exe
  2⤵
  PID:10408
- C:\Windows\System\saTHliJ.exe
  C:\Windows\System\saTHliJ.exe
  2⤵
  PID:10436
- C:\Windows\System\haGmUwl.exe
  C:\Windows\System\haGmUwl.exe
  2⤵
  PID:10464
- C:\Windows\System\FPSJNiP.exe
  C:\Windows\System\FPSJNiP.exe
  2⤵
  PID:10492
- C:\Windows\System\igRYlyL.exe
  C:\Windows\System\igRYlyL.exe
  2⤵
  PID:10516
- C:\Windows\System\cqPuzqJ.exe
  C:\Windows\System\cqPuzqJ.exe
  2⤵
  PID:10548
- C:\Windows\System\TiQKEne.exe
  C:\Windows\System\TiQKEne.exe
  2⤵
  PID:10576
- C:\Windows\System\JehFVYs.exe
  C:\Windows\System\JehFVYs.exe
  2⤵
  PID:10604
- C:\Windows\System\EgjdUrk.exe
  C:\Windows\System\EgjdUrk.exe
  2⤵
  PID:10628
- C:\Windows\System\TosjsDE.exe
  C:\Windows\System\TosjsDE.exe
  2⤵
  PID:10656
- C:\Windows\System\YeArCFt.exe
  C:\Windows\System\YeArCFt.exe
  2⤵
  PID:10688
- C:\Windows\System\NZhlcOm.exe
  C:\Windows\System\NZhlcOm.exe
  2⤵
  PID:10704
- C:\Windows\System\hXYDZaU.exe
  C:\Windows\System\hXYDZaU.exe
  2⤵
  PID:10744
- C:\Windows\System\VIOmDaz.exe
  C:\Windows\System\VIOmDaz.exe
  2⤵
  PID:10764
- C:\Windows\System\DQaPjEQ.exe
  C:\Windows\System\DQaPjEQ.exe
  2⤵
  PID:10792
- C:\Windows\System\nUDoqfV.exe
  C:\Windows\System\nUDoqfV.exe
  2⤵
  PID:10832
- C:\Windows\System\CLsqyfz.exe
  C:\Windows\System\CLsqyfz.exe
  2⤵
  PID:10860
- C:\Windows\System\UgFRrGL.exe
  C:\Windows\System\UgFRrGL.exe
  2⤵
  PID:10904
- C:\Windows\System\OWaPNRv.exe
  C:\Windows\System\OWaPNRv.exe
  2⤵
  PID:10952
- C:\Windows\System\QWhfYEM.exe
  C:\Windows\System\QWhfYEM.exe
  2⤵
  PID:10984
- C:\Windows\System\ZmeiKlR.exe
  C:\Windows\System\ZmeiKlR.exe
  2⤵
  PID:11012
- C:\Windows\System\zIyPwpA.exe
  C:\Windows\System\zIyPwpA.exe
  2⤵
  PID:11064
- C:\Windows\System\ryaoeuu.exe
  C:\Windows\System\ryaoeuu.exe
  2⤵
  PID:11084
- C:\Windows\System\iOEAjvo.exe
  C:\Windows\System\iOEAjvo.exe
  2⤵
  PID:11112
- C:\Windows\System\SifZwPL.exe
  C:\Windows\System\SifZwPL.exe
  2⤵
  PID:11140
- C:\Windows\System\gnPIcqx.exe
  C:\Windows\System\gnPIcqx.exe
  2⤵
  PID:11168
- C:\Windows\System\wYegniR.exe
  C:\Windows\System\wYegniR.exe
  2⤵
  PID:11184
- C:\Windows\System\KGCSJCB.exe
  C:\Windows\System\KGCSJCB.exe
  2⤵
  PID:11240
- C:\Windows\System\xCsTdyq.exe
  C:\Windows\System\xCsTdyq.exe
  2⤵
  PID:9432
- C:\Windows\System\LEGHouh.exe
  C:\Windows\System\LEGHouh.exe
  2⤵
  PID:10280
- C:\Windows\System\OjEwGhH.exe
  C:\Windows\System\OjEwGhH.exe
  2⤵
  PID:10308
- C:\Windows\System\haKEblQ.exe
  C:\Windows\System\haKEblQ.exe
  2⤵
  PID:10404
- C:\Windows\System\zrgPDDP.exe
  C:\Windows\System\zrgPDDP.exe
  2⤵
  PID:10456
- C:\Windows\System\JlcLDHD.exe
  C:\Windows\System\JlcLDHD.exe
  2⤵
  PID:10524
- C:\Windows\System\bCTTOzD.exe
  C:\Windows\System\bCTTOzD.exe
  2⤵
  PID:10184
- C:\Windows\System\UVtqvVe.exe
  C:\Windows\System\UVtqvVe.exe
  2⤵
  PID:10676
- C:\Windows\System\yyamkYf.exe
  C:\Windows\System\yyamkYf.exe
  2⤵
  PID:10740
- C:\Windows\System\TvphIfq.exe
  C:\Windows\System\TvphIfq.exe
  2⤵
  PID:10808
- C:\Windows\System\FYFIoUS.exe
  C:\Windows\System\FYFIoUS.exe
  2⤵
  PID:10856
- C:\Windows\System\cbvrktk.exe
  C:\Windows\System\cbvrktk.exe
  2⤵
  PID:10968
- C:\Windows\System\uOmqVUA.exe
  C:\Windows\System\uOmqVUA.exe
  2⤵
  PID:11052
- C:\Windows\System\qVRPKkf.exe
  C:\Windows\System\qVRPKkf.exe
  2⤵
  PID:11132
- C:\Windows\System\EegrowZ.exe
  C:\Windows\System\EegrowZ.exe
  2⤵
  PID:11160
- C:\Windows\System\fvELeBZ.exe
  C:\Windows\System\fvELeBZ.exe
  2⤵
  PID:9584
- C:\Windows\System\IgrcorE.exe
  C:\Windows\System\IgrcorE.exe
  2⤵
  PID:10376
- C:\Windows\System\NcYhcTM.exe
  C:\Windows\System\NcYhcTM.exe
  2⤵
  PID:10504
- C:\Windows\System\sOMoqOh.exe
  C:\Windows\System\sOMoqOh.exe
  2⤵
  PID:10640
- C:\Windows\System\qjXtPPV.exe
  C:\Windows\System\qjXtPPV.exe
  2⤵
  PID:10844
- C:\Windows\System\NKJJDHm.exe
  C:\Windows\System\NKJJDHm.exe
  2⤵
  PID:10936
- C:\Windows\System\DLjvGBD.exe
  C:\Windows\System\DLjvGBD.exe
  2⤵
  PID:11108
- C:\Windows\System\CUbeYVw.exe
  C:\Windows\System\CUbeYVw.exe
  2⤵
  PID:10432
- C:\Windows\System\HiyqWvK.exe
  C:\Windows\System\HiyqWvK.exe
  2⤵
  PID:10776
- C:\Windows\System\KgGmcOx.exe
  C:\Windows\System\KgGmcOx.exe
  2⤵
  PID:11252
- C:\Windows\System\iIcGnne.exe
  C:\Windows\System\iIcGnne.exe
  2⤵
  PID:10760
- C:\Windows\System\RzMpBdg.exe
  C:\Windows\System\RzMpBdg.exe
  2⤵
  PID:11020
- C:\Windows\System\YnBQluM.exe
  C:\Windows\System\YnBQluM.exe
  2⤵
  PID:11312
- C:\Windows\System\IdnZFcy.exe
  C:\Windows\System\IdnZFcy.exe
  2⤵
  PID:11328
- C:\Windows\System\xzkdfQv.exe
  C:\Windows\System\xzkdfQv.exe
  2⤵
  PID:11360
- C:\Windows\System\CEveeTX.exe
  C:\Windows\System\CEveeTX.exe
  2⤵
  PID:11388
- C:\Windows\System\YgXgqrC.exe
  C:\Windows\System\YgXgqrC.exe
  2⤵
  PID:11432
- C:\Windows\System\OAQQGCJ.exe
  C:\Windows\System\OAQQGCJ.exe
  2⤵
  PID:11460
- C:\Windows\System\hiOlxBO.exe
  C:\Windows\System\hiOlxBO.exe
  2⤵
  PID:11504
- C:\Windows\System\ALvYoIj.exe
  C:\Windows\System\ALvYoIj.exe
  2⤵
  PID:11532
- C:\Windows\System\uQJDtHW.exe
  C:\Windows\System\uQJDtHW.exe
  2⤵
  PID:11576
- C:\Windows\System\WGjPdee.exe
  C:\Windows\System\WGjPdee.exe
  2⤵
  PID:11620
- C:\Windows\System\mdoJfJd.exe
  C:\Windows\System\mdoJfJd.exe
  2⤵
  PID:11660
- C:\Windows\System\PVsKufN.exe
  C:\Windows\System\PVsKufN.exe
  2⤵
  PID:11680
- C:\Windows\System\KyjbMbO.exe
  C:\Windows\System\KyjbMbO.exe
  2⤵
  PID:11720
- C:\Windows\System\MxOWStg.exe
  C:\Windows\System\MxOWStg.exe
  2⤵
  PID:11752
- C:\Windows\System\KVwTmza.exe
  C:\Windows\System\KVwTmza.exe
  2⤵
  PID:11792
- C:\Windows\System\FXvoMSP.exe
  C:\Windows\System\FXvoMSP.exe
  2⤵
  PID:11820
- C:\Windows\System\JkyNcFL.exe
  C:\Windows\System\JkyNcFL.exe
  2⤵
  PID:11856
- C:\Windows\System\DUhuvrX.exe
  C:\Windows\System\DUhuvrX.exe
  2⤵
  PID:11876
- C:\Windows\System\mIsajMX.exe
  C:\Windows\System\mIsajMX.exe
  2⤵
  PID:11916
- C:\Windows\System\ahsLSmE.exe
  C:\Windows\System\ahsLSmE.exe
  2⤵
  PID:11932
- C:\Windows\System\hIUoVzA.exe
  C:\Windows\System\hIUoVzA.exe
  2⤵
  PID:11992
- C:\Windows\System\BodiYTa.exe
  C:\Windows\System\BodiYTa.exe
  2⤵
  PID:12040
- C:\Windows\System\hGBhvrX.exe
  C:\Windows\System\hGBhvrX.exe
  2⤵
  PID:12060
- C:\Windows\System\BrliTEG.exe
  C:\Windows\System\BrliTEG.exe
  2⤵
  PID:12084
- C:\Windows\System\ULiCJDs.exe
  C:\Windows\System\ULiCJDs.exe
  2⤵
  PID:12112
- C:\Windows\System\znPmyhF.exe
  C:\Windows\System\znPmyhF.exe
  2⤵
  PID:12152
- C:\Windows\System\jZBlFrV.exe
  C:\Windows\System\jZBlFrV.exe
  2⤵
  PID:12180
- C:\Windows\System\KIQHLze.exe
  C:\Windows\System\KIQHLze.exe
  2⤵
  PID:12208
- C:\Windows\System\AUXUdvP.exe
  C:\Windows\System\AUXUdvP.exe
  2⤵
  PID:12236
- C:\Windows\System\lZTgfHV.exe
  C:\Windows\System\lZTgfHV.exe
  2⤵
  PID:12268
- C:\Windows\System\tTKlyRD.exe
  C:\Windows\System\tTKlyRD.exe
  2⤵
  PID:12284
- C:\Windows\System\yKEmtmJ.exe
  C:\Windows\System\yKEmtmJ.exe
  2⤵
  PID:11320
- C:\Windows\System\PPNoeze.exe
  C:\Windows\System\PPNoeze.exe
  2⤵
  PID:11376
- C:\Windows\System\XDeBddS.exe
  C:\Windows\System\XDeBddS.exe
  2⤵
  PID:11480
- C:\Windows\System\heaPvac.exe
  C:\Windows\System\heaPvac.exe
  2⤵
  PID:11564
- C:\Windows\System\HNhbXta.exe
  C:\Windows\System\HNhbXta.exe
  2⤵
  PID:11644
- C:\Windows\System\cKKXXZi.exe
  C:\Windows\System\cKKXXZi.exe
  2⤵
  PID:11704
- C:\Windows\System\QHmfijY.exe
  C:\Windows\System\QHmfijY.exe
  2⤵
  PID:11804
- C:\Windows\System\pWISnMv.exe
  C:\Windows\System\pWISnMv.exe
  2⤵
  PID:11896
- C:\Windows\System\UAMzzNR.exe
  C:\Windows\System\UAMzzNR.exe
  2⤵
  PID:11988
- C:\Windows\System\bLHZaHs.exe
  C:\Windows\System\bLHZaHs.exe
  2⤵
  PID:12096
- C:\Windows\System\EySgKxm.exe
  C:\Windows\System\EySgKxm.exe
  2⤵
  PID:12144
- C:\Windows\System\jWiVOIk.exe
  C:\Windows\System\jWiVOIk.exe
  2⤵
  PID:12224
- C:\Windows\System\bMvNWWv.exe
  C:\Windows\System\bMvNWWv.exe
  2⤵
  PID:11292
- C:\Windows\System\tjMEjUX.exe
  C:\Windows\System\tjMEjUX.exe
  2⤵
  PID:11404
- C:\Windows\System\OyVqUnz.exe
  C:\Windows\System\OyVqUnz.exe
  2⤵
  PID:11708
- C:\Windows\System\EKhxiNv.exe
  C:\Windows\System\EKhxiNv.exe
  2⤵
  PID:11840
- C:\Windows\System\ytwlHZn.exe
  C:\Windows\System\ytwlHZn.exe
  2⤵
  PID:11976
- C:\Windows\System\xNhFxiq.exe
  C:\Windows\System\xNhFxiq.exe
  2⤵
  PID:12108
- C:\Windows\System\RrZgVvZ.exe
  C:\Windows\System\RrZgVvZ.exe
  2⤵
  PID:11352
- C:\Windows\System\vZOYDGV.exe
  C:\Windows\System\vZOYDGV.exe
  2⤵
  PID:11528
- C:\Windows\System\anPyVze.exe
  C:\Windows\System\anPyVze.exe
  2⤵
  PID:12056
- C:\Windows\System\OqaNKYb.exe
  C:\Windows\System\OqaNKYb.exe
  2⤵
  PID:11764
- C:\Windows\System\QPgDIOH.exe
  C:\Windows\System\QPgDIOH.exe
  2⤵
  PID:12324
- C:\Windows\System\xsIpSTm.exe
  C:\Windows\System\xsIpSTm.exe
  2⤵
  PID:12352
- C:\Windows\System\TIQMiKc.exe
  C:\Windows\System\TIQMiKc.exe
  2⤵
  PID:12384
- C:\Windows\System\DrhunSB.exe
  C:\Windows\System\DrhunSB.exe
  2⤵
  PID:12408
- C:\Windows\System\YvHwTKo.exe
  C:\Windows\System\YvHwTKo.exe
  2⤵
  PID:12432
- C:\Windows\System\NhrbMQN.exe
  C:\Windows\System\NhrbMQN.exe
  2⤵
  PID:12472
- C:\Windows\System\rOsTtjq.exe
  C:\Windows\System\rOsTtjq.exe
  2⤵
  PID:12488
- C:\Windows\System\jKKAgxP.exe
  C:\Windows\System\jKKAgxP.exe
  2⤵
  PID:12536
- C:\Windows\System\nrlLsgo.exe
  C:\Windows\System\nrlLsgo.exe
  2⤵
  PID:12564
- C:\Windows\System\OOjawcF.exe
  C:\Windows\System\OOjawcF.exe
  2⤵
  PID:12588
- C:\Windows\System\CTdivWO.exe
  C:\Windows\System\CTdivWO.exe
  2⤵
  PID:12620
- C:\Windows\System\fUnGzTx.exe
  C:\Windows\System\fUnGzTx.exe
  2⤵
  PID:12648
- C:\Windows\System\XlcmfZf.exe
  C:\Windows\System\XlcmfZf.exe
  2⤵
  PID:12676
- C:\Windows\System\EZieZRg.exe
  C:\Windows\System\EZieZRg.exe
  2⤵
  PID:12700
- C:\Windows\System\ZCpNKAV.exe
  C:\Windows\System\ZCpNKAV.exe
  2⤵
  PID:12720
- C:\Windows\System\oYJUYQP.exe
  C:\Windows\System\oYJUYQP.exe
  2⤵
  PID:12760
- C:\Windows\System\BqfIDVb.exe
  C:\Windows\System\BqfIDVb.exe
  2⤵
  PID:12788
- C:\Windows\System\fiVmTCe.exe
  C:\Windows\System\fiVmTCe.exe
  2⤵
  PID:12804
- C:\Windows\System\mfcHLDz.exe
  C:\Windows\System\mfcHLDz.exe
  2⤵
  PID:12844
- C:\Windows\System\jCjkEQb.exe
  C:\Windows\System\jCjkEQb.exe
  2⤵
  PID:12872
- C:\Windows\System\COIOrpB.exe
  C:\Windows\System\COIOrpB.exe
  2⤵
  PID:12900
- C:\Windows\System\XPZyLkT.exe
  C:\Windows\System\XPZyLkT.exe
  2⤵
  PID:12928
- C:\Windows\System\FXDJUmY.exe
  C:\Windows\System\FXDJUmY.exe
  2⤵
  PID:12956
- C:\Windows\System\UejyuCh.exe
  C:\Windows\System\UejyuCh.exe
  2⤵
  PID:12984
- C:\Windows\System\JNQctwD.exe
  C:\Windows\System\JNQctwD.exe
  2⤵
  PID:13012
- C:\Windows\System\FJoLseA.exe
  C:\Windows\System\FJoLseA.exe
  2⤵
  PID:13040
- C:\Windows\System\gIILSNw.exe
  C:\Windows\System\gIILSNw.exe
  2⤵
  PID:13068
- C:\Windows\System\wlCJzPl.exe
  C:\Windows\System\wlCJzPl.exe
  2⤵
  PID:13096
- C:\Windows\System\SgJkMYa.exe
  C:\Windows\System\SgJkMYa.exe
  2⤵
  PID:13124
- C:\Windows\System\dfzRjiF.exe
  C:\Windows\System\dfzRjiF.exe
  2⤵
  PID:13140
- C:\Windows\System\svrOcbC.exe
  C:\Windows\System\svrOcbC.exe
  2⤵
  PID:13160
- C:\Windows\System\eXStFkS.exe
  C:\Windows\System\eXStFkS.exe
  2⤵
  PID:13208
- C:\Windows\System\pwbhkwG.exe
  C:\Windows\System\pwbhkwG.exe
  2⤵
  PID:13224
- C:\Windows\System\WodhnPL.exe
  C:\Windows\System\WodhnPL.exe
  2⤵
  PID:13252
- C:\Windows\System\VPNylog.exe
  C:\Windows\System\VPNylog.exe
  2⤵
  PID:13292
- C:\Windows\System\kZRnhUl.exe
  C:\Windows\System\kZRnhUl.exe
  2⤵
  PID:13308
- C:\Windows\System\EApcVWn.exe
  C:\Windows\System\EApcVWn.exe
  2⤵
  PID:11844
- C:\Windows\System\ZweZEMA.exe
  C:\Windows\System\ZweZEMA.exe
  2⤵
  PID:12396
- C:\Windows\System\RVSeuGv.exe
  C:\Windows\System\RVSeuGv.exe
  2⤵
  PID:12452
- C:\Windows\System\BmsOFpm.exe
  C:\Windows\System\BmsOFpm.exe
  2⤵
  PID:12556
- C:\Windows\System\UkNqaJG.exe
  C:\Windows\System\UkNqaJG.exe
  2⤵
  PID:12604
- C:\Windows\System\VyYVfcx.exe
  C:\Windows\System\VyYVfcx.exe
  2⤵
  PID:12672
- C:\Windows\System\FiQSqEj.exe
  C:\Windows\System\FiQSqEj.exe
  2⤵
  PID:12756
- C:\Windows\System\oyRIule.exe
  C:\Windows\System\oyRIule.exe
  2⤵
  PID:12828
- C:\Windows\System\WuEDEpJ.exe
  C:\Windows\System\WuEDEpJ.exe
  2⤵
  PID:12884
- C:\Windows\System\NTKugzI.exe
  C:\Windows\System\NTKugzI.exe
  2⤵
  PID:12948
- C:\Windows\System\mgkRwwt.exe
  C:\Windows\System\mgkRwwt.exe
  2⤵
  PID:13024
- C:\Windows\System\LjQLYXL.exe
  C:\Windows\System\LjQLYXL.exe
  2⤵
  PID:13088
- C:\Windows\System\GylnXNQ.exe
  C:\Windows\System\GylnXNQ.exe
  2⤵
  PID:13156
- C:\Windows\System\nIgoedh.exe
  C:\Windows\System\nIgoedh.exe
  2⤵
  PID:13204
- C:\Windows\System\vmSvnnX.exe
  C:\Windows\System\vmSvnnX.exe
  2⤵
  PID:13304
- C:\Windows\System\gmZNBej.exe
  C:\Windows\System\gmZNBej.exe
  2⤵
  PID:12304
- C:\Windows\System\eSuCUOl.exe
  C:\Windows\System\eSuCUOl.exe
  2⤵
  PID:12548
- C:\Windows\System\olXqmNP.exe
  C:\Windows\System\olXqmNP.exe
  2⤵
  PID:12796
- C:\Windows\System\ausevCZ.exe
  C:\Windows\System\ausevCZ.exe
  2⤵
  PID:12856
- C:\Windows\System\PpAsjvc.exe
  C:\Windows\System\PpAsjvc.exe
  2⤵
  PID:12968
- C:\Windows\System\wBNKNyh.exe
  C:\Windows\System\wBNKNyh.exe
  2⤵
  PID:13192
- C:\Windows\System\OvUbkGV.exe
  C:\Windows\System\OvUbkGV.exe
  2⤵
  PID:12320
- C:\Windows\System\wXgbhxw.exe
  C:\Windows\System\wXgbhxw.exe
  2⤵
  PID:12736
- C:\Windows\System\SxUbHtX.exe
  C:\Windows\System\SxUbHtX.exe
  2⤵
  PID:12924
- C:\Windows\System\xeGvoAm.exe
  C:\Windows\System\xeGvoAm.exe
  2⤵
  PID:12580
- C:\Windows\System\DrgRWke.exe
  C:\Windows\System\DrgRWke.exe
  2⤵
  PID:13148
- C:\Windows\System\zejqTuM.exe
  C:\Windows\System\zejqTuM.exe
  2⤵
  PID:1876
- C:\Windows\System\panxCaN.exe
  C:\Windows\System\panxCaN.exe
  2⤵
  PID:12428
- C:\Windows\System\HMpKdSI.exe
  C:\Windows\System\HMpKdSI.exe
  2⤵
  PID:13316
- C:\Windows\System\PktyyCU.exe
  C:\Windows\System\PktyyCU.exe
  2⤵
  PID:13336
- C:\Windows\System\LyhVaFQ.exe
  C:\Windows\System\LyhVaFQ.exe
  2⤵
  PID:13360
- C:\Windows\System\iGEbkRf.exe
  C:\Windows\System\iGEbkRf.exe
  2⤵
  PID:13404
- C:\Windows\System\UYEMeEe.exe
  C:\Windows\System\UYEMeEe.exe
  2⤵
  PID:13440
- C:\Windows\System\KSELfoK.exe
  C:\Windows\System\KSELfoK.exe
  2⤵
  PID:13480
- C:\Windows\System\UeIEqye.exe
  C:\Windows\System\UeIEqye.exe
  2⤵
  PID:13508
- C:\Windows\System\lnkPuOQ.exe
  C:\Windows\System\lnkPuOQ.exe
  2⤵
  PID:13536
- C:\Windows\System\bMBKJuk.exe
  C:\Windows\System\bMBKJuk.exe
  2⤵
  PID:13568
- C:\Windows\System\MmoRlxo.exe
  C:\Windows\System\MmoRlxo.exe
  2⤵
  PID:13596
- C:\Windows\System\cvIEYRE.exe
  C:\Windows\System\cvIEYRE.exe
  2⤵
  PID:13624
- C:\Windows\System\dfGMpsw.exe
  C:\Windows\System\dfGMpsw.exe
  2⤵
  PID:13664
- C:\Windows\System\eZSUIdw.exe
  C:\Windows\System\eZSUIdw.exe
  2⤵
  PID:13700
- C:\Windows\System\FxPGUOH.exe
  C:\Windows\System\FxPGUOH.exe
  2⤵
  PID:13744
- C:\Windows\System\bTILUdB.exe
  C:\Windows\System\bTILUdB.exe
  2⤵
  PID:13764
- C:\Windows\System\qdjbNvA.exe
  C:\Windows\System\qdjbNvA.exe
  2⤵
  PID:13804
- C:\Windows\System\nLBIypE.exe
  C:\Windows\System\nLBIypE.exe
  2⤵
  PID:13836
- C:\Windows\System\OnOsTtq.exe
  C:\Windows\System\OnOsTtq.exe
  2⤵
  PID:13864
- C:\Windows\System\lvwAZIb.exe
  C:\Windows\System\lvwAZIb.exe
  2⤵
  PID:13892
- C:\Windows\System\cWdfIVT.exe
  C:\Windows\System\cWdfIVT.exe
  2⤵
  PID:13920
- C:\Windows\System\bLMbRnQ.exe
  C:\Windows\System\bLMbRnQ.exe
  2⤵
  PID:13936
- C:\Windows\System\MEnzbIj.exe
  C:\Windows\System\MEnzbIj.exe
  2⤵
  PID:13976
- C:\Windows\System\SsxsQad.exe
  C:\Windows\System\SsxsQad.exe
  2⤵
  PID:14004
- C:\Windows\System\XjAfXrU.exe
  C:\Windows\System\XjAfXrU.exe
  2⤵
  PID:14020
- C:\Windows\System\lfJyIPY.exe
  C:\Windows\System\lfJyIPY.exe
  2⤵
  PID:14060
- C:\Windows\System\hOOnqwC.exe
  C:\Windows\System\hOOnqwC.exe
  2⤵
  PID:14076
- C:\Windows\System\cBzoseK.exe
  C:\Windows\System\cBzoseK.exe
  2⤵
  PID:14104
- C:\Windows\System\uNDtMOY.exe
  C:\Windows\System\uNDtMOY.exe
  2⤵
  PID:14132
- C:\Windows\System\LhPENFW.exe
  C:\Windows\System\LhPENFW.exe
  2⤵
  PID:14172
- C:\Windows\System\KETnsNJ.exe
  C:\Windows\System\KETnsNJ.exe
  2⤵
  PID:14200
- C:\Windows\System\pPfRrUJ.exe
  C:\Windows\System\pPfRrUJ.exe
  2⤵
  PID:14220
- C:\Windows\System\vzxABnR.exe
  C:\Windows\System\vzxABnR.exe
  2⤵
  PID:14248
- C:\Windows\System\jWAzuSc.exe
  C:\Windows\System\jWAzuSc.exe
  2⤵
  PID:14288
- C:\Windows\System\AzUntZj.exe
  C:\Windows\System\AzUntZj.exe
  2⤵
  PID:14312
- C:\Windows\System\Vskpyea.exe
  C:\Windows\System\Vskpyea.exe
  2⤵
  PID:14332
- C:\Windows\System\bRcDrtE.exe
  C:\Windows\System\bRcDrtE.exe
  2⤵
  PID:13352
- C:\Windows\System\rOMbIFB.exe
  C:\Windows\System\rOMbIFB.exe
  2⤵
  PID:13468
- C:\Windows\System\mTuRIqO.exe
  C:\Windows\System\mTuRIqO.exe
  2⤵
  PID:13504
- C:\Windows\System\oUphZlT.exe
  C:\Windows\System\oUphZlT.exe
  2⤵
  PID:13580
- C:\Windows\System\LhYOcZl.exe
  C:\Windows\System\LhYOcZl.exe
  2⤵
  PID:13652
- C:\Windows\System\Btewakq.exe
  C:\Windows\System\Btewakq.exe
  2⤵
  PID:13724
- C:\Windows\System\RGEyLOY.exe
  C:\Windows\System\RGEyLOY.exe
  2⤵
  PID:13792
- C:\Windows\System\lPFrvFR.exe
  C:\Windows\System\lPFrvFR.exe
  2⤵
  PID:13848
- C:\Windows\System\HciTEWo.exe
  C:\Windows\System\HciTEWo.exe
  2⤵
  PID:13908
- C:\Windows\System\uUXuOkl.exe
  C:\Windows\System\uUXuOkl.exe
  2⤵
  PID:13964
- C:\Windows\System\Yfqchlu.exe
  C:\Windows\System\Yfqchlu.exe
  2⤵
  PID:14040
- C:\Windows\System\HiOnigK.exe
  C:\Windows\System\HiOnigK.exe
  2⤵
  PID:14088
- C:\Windows\System\XgEAtgI.exe
  C:\Windows\System\XgEAtgI.exe
  2⤵
  PID:14184
- C:\Windows\System\IoPuKLN.exe
  C:\Windows\System\IoPuKLN.exe
  2⤵
  PID:14244
- C:\Windows\System\SPubFQT.exe
  C:\Windows\System\SPubFQT.exe
  2⤵
  PID:14320
- C:\Windows\System\qdSozMV.exe
  C:\Windows\System\qdSozMV.exe
  2⤵
  PID:13348
- C:\Windows\System\rAfAiyX.exe
  C:\Windows\System\rAfAiyX.exe
  2⤵
  PID:13464
- C:\Windows\System\tHgCpdw.exe
  C:\Windows\System\tHgCpdw.exe
  2⤵
  PID:13608
- C:\Windows\System\XnFuzvg.exe
  C:\Windows\System\XnFuzvg.exe
  2⤵
  PID:13816
- C:\Windows\System\oGofRuh.exe
  C:\Windows\System\oGofRuh.exe
  2⤵
  PID:13948
- C:\Windows\System\zsjyCrB.exe
  C:\Windows\System\zsjyCrB.exe
  2⤵
  PID:14144
- C:\Windows\System\KDxBrDp.exe
  C:\Windows\System\KDxBrDp.exe
  2⤵
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BiqmWqa.exe

Filesize
2.4MB

MD5
ad5fa50102337fdf8984713c504fa16a

SHA1
6554b67c491c2cd5befd925f0fed2b2c4cbe4237

SHA256
b2c5324fea9f444c69d75807ef115c4bf1c6633c5999d56e4edd97c402242947

SHA512
8dc5fc8c115d21c217b8905725bfc2bebec4dbb7bf02e50b59fe328c3b7e6b93c1ab3f220db4136aeba24485a3992bfbda0387dc1da79c30a5a66f2345797543

Download Submit
C:\Windows\System\BwoduaE.exe

Filesize
2.4MB

MD5
48bdfa47604675fa695c682755b2526e

SHA1
7353e3eec2f67e2db0cf5a1370de88c0a37d946e

SHA256
d0398f0d63504d81d801ff5eb2e1a10a9292bac40d3de4ccd85303b641f6c5c3

SHA512
887bef0b6d9645c7a3ca040d981f7a583334dee0a4aeb1cd7d2635f0ea011354897940bda51324b3afaf886cd7020add4cad14cc5c0ec78cdcc2bdcf729a51e2

Download Submit
C:\Windows\System\EYxBHfD.exe

Filesize
2.4MB

MD5
8dd71766b21f1545ad9cda1f04d54c16

SHA1
a73ec6632699efe16771e6b3116fb1c26a7966ef

SHA256
1dc33ef75026c2f7fc9a9f03f22ec2d1ae41b9f65a93d0b0b0e980747dc22874

SHA512
4367af99a7ca8619cbf22dc135049ba1a5fb42c64e53a842bbdf51849d96df9280248214f2c6e58d880cb23f8c3d517970a169f41e545b9b75c0b66f8b5a1fca

Download Submit
C:\Windows\System\GJFmkCe.exe

Filesize
2.4MB

MD5
6d49ce12f4354de3842bdee71d734d1a

SHA1
0c6f0e8e9c2ac19668834f3c77080b10b0ed3391

SHA256
72218bb2c95bad9280bda546511f475de2188157fbb9bca13f29d65fa6ac3ebf

SHA512
0f300c8225bb2fdb9fd6d560f79ceb0998a762f98e8dc786f92e295c7c9ef6ed53651ca1dc11c2acb4d09e9ae26d7309b084e2b74c6554a6df4feeb032abd1d3

Download Submit
C:\Windows\System\HiDlRbl.exe

Filesize
2.4MB

MD5
701e1e739f12474de3058da86fb6a8fc

SHA1
2c6fbfc4b0d957afcb379e62218b9fac406b1efc

SHA256
bf0e946d0cb1b4e5e0c09281ae72331042a2bae34c26bc48b8dbf19efb31a9b0

SHA512
940e2a7541a81c4c6fc88f25f1d631dba71d0f8b4b8e914fe4259b037e1af2a39137bafce5bdee720d8ba1afe88bcdd7f03bb4f97fbec4c390a1dc2576cba33c

Download Submit
C:\Windows\System\RAsRFuB.exe

Filesize
2.4MB

MD5
89a623bc39ff924804dd8a605d92dcf6

SHA1
359eee6d791da4214b75333135a6f1707108738f

SHA256
de190f7726d3aaebbe6c8b10bd1978d96e4b8893491a7e485fbb98f9df53a2e4

SHA512
00520799919c655fec2c84a3ae5f127a9155336ebb897ed1031804b3562baf412a2c93a594360c76e883b6a464973c2bcc8021b67a3b01e1c5c4ed4c28b6f66a

Download Submit
C:\Windows\System\SKrUWGB.exe

Filesize
2.4MB

MD5
4e7718cfd57fc88811f3a0675c706896

SHA1
5942ddcc4e1619730d362ffde286969c540a313e

SHA256
529c36df6c718f9eef0ad9e71fea5f008d02c01b81447db927f4adc83558ba3c

SHA512
5fbef74098abada7d1d425d9daf601e9ddf9378f81b95146aaca661c83e8a6fec6d98e1e0b2ae5e670ed8139b8bc7a9526305e2fa9ecb0fe974ac4ca71462ba2

Download Submit
C:\Windows\System\SOvIDie.exe

Filesize
2.4MB

MD5
e31bdfbce814ab68d1d3c5de71cfce3d

SHA1
0ca9bc86f22669d1baa87e4c8997afd421e3d629

SHA256
2293261945d303be5953821abc7c22e0600e762dc71302a0d3f163b803dca941

SHA512
3951b62e72105774da0b653dc9dad6ee928baf1b6e35c27ff4eb3a0c4d576599f042f8bcbd3465e1140e31e07196c9994329a9425bd508d5fc0e779780600df4

Download Submit
C:\Windows\System\aCjqGTv.exe

Filesize
2.4MB

MD5
2f2a18d2504b2a22258cfefb9fffee13

SHA1
a64563b6f93a52966d2f174ab00100dcc8bb1c37

SHA256
c909cc7f4652fc27130a7348e6488c6ade123a66e168882e97aff5cc90910c18

SHA512
0613ae3699eb2d084a0360df5ca22a81158b291e57afd41ce5c126a0175fc560878018f00638b61c480fcfc301125c722b9fdbb68b80e06c20017c83a2994605

Download Submit
C:\Windows\System\boHywqt.exe

Filesize
2.4MB

MD5
314bcd8286b6648101fdac9920b4485b

SHA1
beab5434d2cec22ea3ca344f70958f510f0ea946

SHA256
4e82b60c2683215f1c25a8dcf1c141dd9f4ced4aac8dbfc5d859fcf5ac8bc9b6

SHA512
e246b15ae551c2575f7b11122fc02c2193e0d5243340d6db97518558025b7152846f1ca53a11769a58b5fa4833120210507eac2fe40455155da165595de74189

Download Submit
C:\Windows\System\boQKjlg.exe

Filesize
2.4MB

MD5
c4e6638e2b0d4884530f5ef371e18bd8

SHA1
4e9aab0e13b789b841b2bfc97ea5de0d9781a70b

SHA256
e94faabfeac938e57afa358e548cb46d8f6443fe9b38d137a2eb040ce7a98635

SHA512
6142bf059659b46e3c30e1bbd4e598852e8558390370db74b7acc3c2db7da3355223fbf2a3ed013dab8bf66a44bd665a01d7117d36d7a1b056da096f22d62ec1

Download Submit
C:\Windows\System\dQYlDUj.exe

Filesize
2.4MB

MD5
2f552400924ab38879cae4cf29b8f43f

SHA1
105e61b2145aeeb5c7ecb5f98522df7cb488f2f5

SHA256
a2ad69aa3f9007825a7e4d7524255501bd6c8479f76250d499997a86322122ff

SHA512
a880cc74d94260a7311b3b1438a4dd01ff0ea2864e5f616ab7f438d5b28fb42069cb34655cd097a449f3bedccda9a8288e3d9df6bc1c31bc4425295c963e1d03

Download Submit
C:\Windows\System\eBNquSu.exe

Filesize
2.4MB

MD5
b0f1b0ee75441cddacce16572a31fd08

SHA1
b6486cf63952d9e6bb015922180a104cb6522dd9

SHA256
6eb092409784fa3d6b939198639b927628c08963001728f6c5ea1d81d681a98b

SHA512
46a648e06fa07fef0295e265959436ce6686eda2d9fd0449096f3e1ca46f6c1dd35944008a93490828993d86aea08b66918e321c2fd1e119fa7390c335f8c950

Download Submit
C:\Windows\System\eTMvexx.exe

Filesize
2.4MB

MD5
677592f73116589a1e7a9a6e9121f12d

SHA1
1516de25327cd65c8a68a795cdde1d606be70fc0

SHA256
30dc878403c75b2e38a84ed8f16487ef7c452b0ff8ca7c8fc3333ddc2097caa9

SHA512
24a95e73b2207560655584188c7a9450f23930241be54b7d0fa62c07f927bfd48de05fa192c7a14dee8d358090fe962993555d7b87c30a3a53445aa04b931d68

Download Submit
C:\Windows\System\ewQBDpo.exe

Filesize
2.4MB

MD5
9ed1f30d51c92f2e61938fd30654b03c

SHA1
4b13c22e618cea58a246e80630b61631fe6f1f65

SHA256
48a48ecd76e466dcac20a4467e850170b90fbc31955718fbfec163d0cff4ae97

SHA512
c59cdaae4f528c7079745aba8b5143b85a6f3ccefc9904c8a244602f3370917530221470ace2e8468e013f458bdee507888104ac4090b163b1eeabfd91e2661e

Download Submit
C:\Windows\System\ewchMDy.exe

Filesize
2.4MB

MD5
5a09854b4889c9421f69e4cac3307bd0

SHA1
6ec39f8a02ca0b36275a6e9adffc546506cf3395

SHA256
22d5d99bfb49b023b7461e63dcddfbe2c8b011ae67fe15d9d6447619acc8b97a

SHA512
383cad3976b6417f4b5ce04be3543174fee693b07f99f0b1785e0a5f4f20d84b51c6dcfedd6a8c4eafce2f5b0a477767f94b3674b4d3aff281c050dd74d68afe

Download Submit
C:\Windows\System\hoDvGyt.exe

Filesize
2.4MB

MD5
a0c666bc90982ae9ec7a08033bbb3689

SHA1
4d7e6896e05f946b16d95c6fdd49f715941a004c

SHA256
ad8e730f914ab4094d3e98d6cc16f2900ca8ab33129c84ca3b04fbea186148ad

SHA512
7a139c815da57fedc427dd3dc9ad116a494cf21b30a4e362b3cf016df96fdba25f120b837890047363de0200bb3e7203fb1bbb124db6370dae435bdcd5b2f95b

Download Submit
C:\Windows\System\iFWENBs.exe

Filesize
2.4MB

MD5
91d9240feccbfade2e0aa6c7ac7b6a88

SHA1
436c821751c7a95d3336cc2508d691a1c8434cf4

SHA256
1da6fcd3f48db1aa03558df8b0dbee7fc272c66485ffac633e3cae55952a3837

SHA512
c321a2f3c02d51f90f7d26732cf2c1121a061cdb0cb02449348b4d2b10eee17372882c76836374bb7f258844c3f9bde64d86242cf3a0678cc8669addf016d1a0

Download Submit
C:\Windows\System\imspQVb.exe

Filesize
2.4MB

MD5
e5f544510a9c8091bcaaf5f40101c40b

SHA1
94ebb6b00d998fafa76667a0beb8118b30fd3339

SHA256
c78825ee7d458906baf5dbaa02cde89b044576d3143dfc4a23c7d64948a23921

SHA512
ab5e6291b7d962291756389e82d61e1f8aed68e959eed002cf5338a63f45955911b401e6a7338677434a8676f59db2bdd277e9f62195266934ead5ce973f8334

Download Submit
C:\Windows\System\lHqVBYU.exe

Filesize
2.4MB

MD5
52f9f23361ff5e57bafbc93dd2330b9c

SHA1
0ef7c4e1284b90c88d6cab6f5a09e27d9d4e991e

SHA256
f668d93abf4a88f2caabb106bcb48598350b418c64241958c7815ea858a5e007

SHA512
45a8babb4f9b413b928981a84473c6d3ce58ad9372c0389b7f65396f14b8717d8f34dabbdaeaa6bda6482f6bf9c54e1367f335d84d9926648c5d2ffafc0d55c1

Download Submit
C:\Windows\System\lMVbOdb.exe

Filesize
2.4MB

MD5
07a7996b7cab002ee4053d8000042767

SHA1
a37c4923ae3f6934f871f60d3ace10a906f83ec3

SHA256
fa2244de2401d8b111948bb8cf5b3aed02ec5d04e2bbd724ef9a144de2fc64e9

SHA512
32d16e5792e116ac888b65a6575449246c4ee680b61c5d1fe3efe8e45059388fa59207acb85b1c622d633bc8d75d253b421dd83e090211ec332842e4abbce6d2

Download Submit
C:\Windows\System\lOnQYCF.exe

Filesize
2.4MB

MD5
57b9a41e5afcb6720881ad6991b36f28

SHA1
cc0c4a33d9ec755a547256f6d2c0fceb57aeaf04

SHA256
0c7315d29033b5e4486f714a4f15beab3445fc403b0f678db78e5826f83eccf7

SHA512
1d045b9f74bc13cc20892effe20de585e9c8422bb8765c93ca951587fa3af686b6616c992e059ca921b233b0049d0746cbcb34ece2029d7f3c470fbbfaceb065

Download Submit
C:\Windows\System\mrcjWMr.exe

Filesize
2.4MB

MD5
29ebace1ef526d179753c307f0dbef68

SHA1
e390725896dd515549895211224961c05d9da5e8

SHA256
32e54e5c7f05dfb00fa587a895086bf901d19d9b73665a96541db40dbbc3177e

SHA512
8a177bdcdb8b35d45ab32ed0512cd91aa8cd7641b90a24cec25c5ba28b9d72a6e9c67f111a2f71b10d8c17840eb1c8d870693e394f15f3a7b855df9c07b543ab

Download Submit
C:\Windows\System\nhuZRSa.exe

Filesize
2.4MB

MD5
2fc2a67539ddba91cd27e0c8342bde85

SHA1
b0ce3c15b6b5339f5f5bcaebb9f95edd83ec13fa

SHA256
dfb076fd91fef46c2a30d8ac62b16dd0206cc073babfabbc5d5d0ffbc4ba6f10

SHA512
b8ac4e2a78a793adb2bf31734edae87ff1226d6ed07968f219d57f31ff5eefc88e2a32522b69e3f053e45b62ee4019aad230c4ee79cbd653ddd11a7c97613db1

Download Submit
C:\Windows\System\pxAwYhy.exe

Filesize
2.4MB

MD5
dbd3f321f34ce0e41e9328b0b9410fac

SHA1
beff2a2c4d44f56db04df5e3660cec710834a051

SHA256
426f3135bd92f4c7ca2b0c846d62142a6d75886e44cfd9aa0b66a0f976bb670c

SHA512
7dd349198b9b2c8049a9357a258d0665d924345c61095b0f052274261ea3bd814a06c777fa3769bc737563bebee46273c586c6113dd07da00f399a5a0d776d49

Download Submit
C:\Windows\System\qWJxdBU.exe

Filesize
2.4MB

MD5
76ba28746693d5a5234a1b05832478b1

SHA1
5bac055b0d1e8b9cc85f6b58318b5ab7465e32d6

SHA256
2c0853d49ea2aff4cfa860ce8574a101f083e801bf16f1d218fd729c76a0867f

SHA512
033b36e5c5b6cbcc8de54eed530e0545e8d14eef5764108547d7004e290a5c229eb31db2502a46c14fdd2079fb1d91630155e8cf9b36696c6d380c70b0d8de1b

Download Submit
C:\Windows\System\rKyMqvd.exe

Filesize
2.4MB

MD5
7492e8b8de6681b8d614dc89d36696a8

SHA1
c5809f1c90083982a9f8e084958eef120bfa1151

SHA256
6d665364cb22a5721463b40e6887261c5a871497a6fba3a7f77e897f5fad741c

SHA512
185cb99f1c8227650abc148cc439b2f38312b2af56e77a75d62a37c5d6c7450f1aebd19533475905f37ab7ea202c9011db292254e2acc43407b4c7a244e55e71

Download Submit
C:\Windows\System\rwaFXkO.exe

Filesize
2.4MB

MD5
010533e2cf84e86e54dc96eb15a5a9b3

SHA1
1d99b05e7bc74386eac9808b89df2854f293a2f6

SHA256
fa83ef7f558256f1bea9160a72d10482555e585450300c15529bbd543a5da771

SHA512
a1ea179e90fa29daf94768dd23cbae7d9b76999f95ec7fb191cf925d88393fe879017095baf70aec5779fa1ea5b4d9d73daa157bde0b98f6adc36adbbf13f0c6

Download Submit
C:\Windows\System\sMGckUX.exe

Filesize
2.4MB

MD5
36cebbb02e06cbdef092fe404174a635

SHA1
a08477fd147ad9dbb4c9641182cc0d3329b90740

SHA256
5f6693ef6f1c1203f87a9ea0417bdd9fe92e04db676d293e45f5168367aa644f

SHA512
4450631ebc6df48531066b40942b46aeac47de36d56cf89562f9896f30e728ff341e123ec6fa089b7b80917e6c99fd948ad375ad469165772f688633fa4b2d5c

Download Submit
C:\Windows\System\tMtAACc.exe

Filesize
2.4MB

MD5
89785a378b345d8be78f04292f0de190

SHA1
065e3df6b36882bc24b8379a619ed36f4acc83c5

SHA256
1790015d00a565f7c72b6018aea8078ce771bd7664bd23418f1a9dc22a35f74a

SHA512
48f1f21af4bea13ffa802d6df5bc13d3b73c263858f426bf46fa335c959982fb60a29e1db85d3b94b4e60690c99a06bc9be83004f8d2e66e14403525e815a673

Download Submit
C:\Windows\System\tfBnGWg.exe

Filesize
2.4MB

MD5
7ade512e49279dc08d5a1a0fe9cd0a8e

SHA1
5fe85fc799157659fbf228f2b4e3750aaede06e4

SHA256
f71992a1a6590fde1dfa3fa2d45fa65caa79102f888afb76612738f3278f0f5b

SHA512
c5415e19718a99db796f4484e7ef0f9eea9767603969ebd10bec9392e8d475133fd72217403ecac2f8f5f981083eb09bcc7d753d0e2e940879e44b43f5146777

Download Submit
C:\Windows\System\vpnKFFW.exe

Filesize
2.4MB

MD5
23aca592cb34d74711267a788375b7c4

SHA1
8355a7f60622ebfa887478a2978cca9ecc065910

SHA256
f9ab5932a673209879a51c2824a43c50af50539f36f967c63fad5e3cad5e3029

SHA512
455108d5af3176a1cb47a701126795e154a6e5f29f4df3e47bbceb820bc321c8238525136689b8ce0512836520d224b9f2a515954450b9c17547cf0632e5d8f5

Download Submit
C:\Windows\System\zLoOEIK.exe

Filesize
2.4MB

MD5
1ce3acde5171996bcfd6ad096f09200b

SHA1
e4d6815e54c3f5e8cb5210748c5ce25e94e854b2

SHA256
ecc6ea8b6f46e3a8b4a3719053e2d81ae08a7327521b3f9d05ea076a96c116e4

SHA512
8c4c649910b6891b3416a1acc169e0919f79e9d4c2251982d476a8375f9b0a23c4b6e5ebb28af6cce430a77c4b5f42ea3c5883aae926b207e92686d9a2ab973c

Download Submit
memory/392-784-0x00007FF7E1E70000-0x00007FF7E21C4000-memory.dmp

Filesize
3.3MB

Download
memory/392-2107-0x00007FF7E1E70000-0x00007FF7E21C4000-memory.dmp

Filesize
3.3MB

Download
memory/432-0-0x00007FF7A6E60000-0x00007FF7A71B4000-memory.dmp

Filesize
3.3MB

Download
memory/432-1-0x00000253477A0000-0x00000253477B0000-memory.dmp

Filesize
64KB

Download
memory/540-2102-0x00007FF6A10F0000-0x00007FF6A1444000-memory.dmp

Filesize
3.3MB

Download
memory/540-777-0x00007FF6A10F0000-0x00007FF6A1444000-memory.dmp

Filesize
3.3MB

Download
memory/732-2079-0x00007FF6E6A60000-0x00007FF6E6DB4000-memory.dmp

Filesize
3.3MB

Download
memory/732-2087-0x00007FF6E6A60000-0x00007FF6E6DB4000-memory.dmp

Filesize
3.3MB

Download
memory/732-50-0x00007FF6E6A60000-0x00007FF6E6DB4000-memory.dmp

Filesize
3.3MB

Download
memory/1000-2099-0x00007FF717560000-0x00007FF7178B4000-memory.dmp

Filesize
3.3MB

Download
memory/1000-741-0x00007FF717560000-0x00007FF7178B4000-memory.dmp

Filesize
3.3MB

Download
memory/1008-2098-0x00007FF644000000-0x00007FF644354000-memory.dmp

Filesize
3.3MB

Download
memory/1008-746-0x00007FF644000000-0x00007FF644354000-memory.dmp

Filesize
3.3MB

Download
memory/1396-2105-0x00007FF68E960000-0x00007FF68ECB4000-memory.dmp

Filesize
3.3MB

Download
memory/1396-792-0x00007FF68E960000-0x00007FF68ECB4000-memory.dmp

Filesize
3.3MB

Download
memory/1480-2084-0x00007FF6F3990000-0x00007FF6F3CE4000-memory.dmp

Filesize
3.3MB

Download
memory/1480-802-0x00007FF6F3990000-0x00007FF6F3CE4000-memory.dmp

Filesize
3.3MB

Download
memory/1544-2097-0x00007FF72C6B0000-0x00007FF72CA04000-memory.dmp

Filesize
3.3MB

Download
memory/1544-771-0x00007FF72C6B0000-0x00007FF72CA04000-memory.dmp

Filesize
3.3MB

Download
memory/1572-2104-0x00007FF604C00000-0x00007FF604F54000-memory.dmp

Filesize
3.3MB

Download
memory/1572-766-0x00007FF604C00000-0x00007FF604F54000-memory.dmp

Filesize
3.3MB

Download
memory/1700-2094-0x00007FF7EEB50000-0x00007FF7EEEA4000-memory.dmp

Filesize
3.3MB

Download
memory/1700-752-0x00007FF7EEB50000-0x00007FF7EEEA4000-memory.dmp

Filesize
3.3MB

Download
memory/1792-788-0x00007FF677FE0000-0x00007FF678334000-memory.dmp

Filesize
3.3MB

Download
memory/1792-2101-0x00007FF677FE0000-0x00007FF678334000-memory.dmp

Filesize
3.3MB

Download
memory/2000-2089-0x00007FF68B9A0000-0x00007FF68BCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2000-711-0x00007FF68B9A0000-0x00007FF68BCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2852-776-0x00007FF72A7F0000-0x00007FF72AB44000-memory.dmp

Filesize
3.3MB

Download
memory/2852-2103-0x00007FF72A7F0000-0x00007FF72AB44000-memory.dmp

Filesize
3.3MB

Download
memory/2968-2090-0x00007FF6A8A20000-0x00007FF6A8D74000-memory.dmp

Filesize
3.3MB

Download
memory/2968-707-0x00007FF6A8A20000-0x00007FF6A8D74000-memory.dmp

Filesize
3.3MB

Download
memory/3284-2077-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp

Filesize
3.3MB

Download
memory/3284-12-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp

Filesize
3.3MB

Download
memory/3284-2081-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp

Filesize
3.3MB

Download
memory/3352-759-0x00007FF7775F0000-0x00007FF777944000-memory.dmp

Filesize
3.3MB

Download
memory/3352-2096-0x00007FF7775F0000-0x00007FF777944000-memory.dmp

Filesize
3.3MB

Download
memory/3388-722-0x00007FF758260000-0x00007FF7585B4000-memory.dmp

Filesize
3.3MB

Download
memory/3388-2092-0x00007FF758260000-0x00007FF7585B4000-memory.dmp

Filesize
3.3MB

Download
memory/3704-696-0x00007FF7C40B0000-0x00007FF7C4404000-memory.dmp

Filesize
3.3MB

Download
memory/3704-2086-0x00007FF7C40B0000-0x00007FF7C4404000-memory.dmp

Filesize
3.3MB

Download
memory/3784-2083-0x00007FF60C7C0000-0x00007FF60CB14000-memory.dmp

Filesize
3.3MB

Download
memory/3784-2078-0x00007FF60C7C0000-0x00007FF60CB14000-memory.dmp

Filesize
3.3MB

Download
memory/3784-31-0x00007FF60C7C0000-0x00007FF60CB14000-memory.dmp

Filesize
3.3MB

Download
memory/3824-736-0x00007FF789850000-0x00007FF789BA4000-memory.dmp

Filesize
3.3MB

Download
memory/3824-2100-0x00007FF789850000-0x00007FF789BA4000-memory.dmp

Filesize
3.3MB

Download
memory/3988-2088-0x00007FF6459D0000-0x00007FF645D24000-memory.dmp

Filesize
3.3MB

Download
memory/3988-803-0x00007FF6459D0000-0x00007FF645D24000-memory.dmp

Filesize
3.3MB

Download
memory/4032-2093-0x00007FF761570000-0x00007FF7618C4000-memory.dmp

Filesize
3.3MB

Download
memory/4032-719-0x00007FF761570000-0x00007FF7618C4000-memory.dmp

Filesize
3.3MB

Download
memory/4128-2082-0x00007FF627B60000-0x00007FF627EB4000-memory.dmp

Filesize
3.3MB

Download
memory/4128-20-0x00007FF627B60000-0x00007FF627EB4000-memory.dmp

Filesize
3.3MB

Download
memory/4188-2095-0x00007FF638CD0000-0x00007FF639024000-memory.dmp

Filesize
3.3MB

Download
memory/4188-733-0x00007FF638CD0000-0x00007FF639024000-memory.dmp

Filesize
3.3MB

Download
memory/4240-2080-0x00007FF603450000-0x00007FF6037A4000-memory.dmp

Filesize
3.3MB

Download
memory/4240-7-0x00007FF603450000-0x00007FF6037A4000-memory.dmp

Filesize
3.3MB

Download
memory/4428-800-0x00007FF7C7730000-0x00007FF7C7A84000-memory.dmp

Filesize
3.3MB

Download
memory/4428-2108-0x00007FF7C7730000-0x00007FF7C7A84000-memory.dmp

Filesize
3.3MB

Download
memory/4636-726-0x00007FF6E6170000-0x00007FF6E64C4000-memory.dmp

Filesize
3.3MB

Download
memory/4636-2091-0x00007FF6E6170000-0x00007FF6E64C4000-memory.dmp

Filesize
3.3MB

Download
memory/4964-2106-0x00007FF6C6900000-0x00007FF6C6C54000-memory.dmp

Filesize
3.3MB

Download
memory/4964-795-0x00007FF6C6900000-0x00007FF6C6C54000-memory.dmp

Filesize
3.3MB

Download
memory/5072-2085-0x00007FF72C8C0000-0x00007FF72CC14000-memory.dmp

Filesize
3.3MB

Download
memory/5072-702-0x00007FF72C8C0000-0x00007FF72CC14000-memory.dmp

Filesize
3.3MB

Download