xmrig | 721720cb32befcc98215f059d719049ef92c811084f1313a834ed13bff0f86ae

Analysis

max time kernel
147s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
Size

2.2MB
MD5

b07f355c8763584124a551a4fffdac20
SHA1

0a9b7ca6a592492f84a6340d866c03e9179a77a6
SHA256

721720cb32befcc98215f059d719049ef92c811084f1313a834ed13bff0f86ae
SHA512

2cb47840b00ba743ff5dd7131f4f5d38e7d168309a8abbca70b8aa7f401ca32ab59f137b5f1326de322662367f94980a9feee7c02cd076ec8c09373538b1483b
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbbnlD52U7/dNS:BemTLkNdfE0pZrZ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4392-0-0x00007FF682E20000-0x00007FF683174000-memory.dmp	xmrig
behavioral2/files/0x0007000000023297-6.dat	xmrig
behavioral2/files/0x0007000000023423-28.dat	xmrig
behavioral2/memory/4264-36-0x00007FF6E5DB0000-0x00007FF6E6104000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-55.dat	xmrig
behavioral2/files/0x000700000002342c-66.dat	xmrig
behavioral2/files/0x000700000002342a-98.dat	xmrig
behavioral2/memory/3728-152-0x00007FF7434C0000-0x00007FF743814000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-167.dat	xmrig
behavioral2/memory/1360-174-0x00007FF678300000-0x00007FF678654000-memory.dmp	xmrig
behavioral2/memory/2160-177-0x00007FF7B6150000-0x00007FF7B64A4000-memory.dmp	xmrig
behavioral2/memory/2352-180-0x00007FF6443A0000-0x00007FF6446F4000-memory.dmp	xmrig
behavioral2/memory/3320-181-0x00007FF66EAA0000-0x00007FF66EDF4000-memory.dmp	xmrig
behavioral2/memory/4512-179-0x00007FF77FD90000-0x00007FF7800E4000-memory.dmp	xmrig
behavioral2/memory/1352-178-0x00007FF6CAC40000-0x00007FF6CAF94000-memory.dmp	xmrig
behavioral2/memory/5012-176-0x00007FF6D7AB0000-0x00007FF6D7E04000-memory.dmp	xmrig
behavioral2/memory/4000-175-0x00007FF6BB6A0000-0x00007FF6BB9F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343a-172.dat	xmrig
behavioral2/memory/4440-171-0x00007FF77EE90000-0x00007FF77F1E4000-memory.dmp	xmrig
behavioral2/memory/392-170-0x00007FF685A60000-0x00007FF685DB4000-memory.dmp	xmrig
behavioral2/memory/5000-169-0x00007FF7C3A60000-0x00007FF7C3DB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-165.dat	xmrig
behavioral2/files/0x0007000000023439-163.dat	xmrig
behavioral2/files/0x0007000000023438-160.dat	xmrig
behavioral2/memory/1100-159-0x00007FF705280000-0x00007FF7055D4000-memory.dmp	xmrig
behavioral2/memory/2984-158-0x00007FF6B7220000-0x00007FF6B7574000-memory.dmp	xmrig
behavioral2/files/0x0007000000023436-156.dat	xmrig
behavioral2/files/0x0007000000023435-144.dat	xmrig
behavioral2/files/0x0007000000023434-143.dat	xmrig
behavioral2/memory/1268-137-0x00007FF619790000-0x00007FF619AE4000-memory.dmp	xmrig
behavioral2/memory/2932-127-0x00007FF6FD3A0000-0x00007FF6FD6F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-135.dat	xmrig
behavioral2/files/0x0007000000023431-123.dat	xmrig
behavioral2/files/0x0007000000023437-130.dat	xmrig
behavioral2/memory/3064-120-0x00007FF632CB0000-0x00007FF633004000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-119.dat	xmrig
behavioral2/memory/3916-114-0x00007FF672E50000-0x00007FF6731A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-112.dat	xmrig
behavioral2/files/0x0007000000023432-109.dat	xmrig
behavioral2/files/0x000700000002342d-103.dat	xmrig
behavioral2/files/0x000700000002342b-101.dat	xmrig
behavioral2/memory/1456-95-0x00007FF7D56F0000-0x00007FF7D5A44000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-90.dat	xmrig
behavioral2/files/0x000700000002343d-185.dat	xmrig
behavioral2/memory/4392-1696-0x00007FF682E20000-0x00007FF683174000-memory.dmp	xmrig
behavioral2/memory/1752-2088-0x00007FF635100000-0x00007FF635454000-memory.dmp	xmrig
behavioral2/files/0x000800000002341e-190.dat	xmrig
behavioral2/memory/4976-83-0x00007FF77D550000-0x00007FF77D8A4000-memory.dmp	xmrig
behavioral2/memory/4248-80-0x00007FF6A24A0000-0x00007FF6A27F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023429-76.dat	xmrig
behavioral2/files/0x0007000000023428-72.dat	xmrig
behavioral2/files/0x0007000000023427-70.dat	xmrig
behavioral2/memory/2868-63-0x00007FF61DEE0000-0x00007FF61E234000-memory.dmp	xmrig
behavioral2/memory/2452-51-0x00007FF6F2970000-0x00007FF6F2CC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-47.dat	xmrig
behavioral2/memory/532-42-0x00007FF655790000-0x00007FF655AE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-39.dat	xmrig
behavioral2/memory/4476-30-0x00007FF61E4C0000-0x00007FF61E814000-memory.dmp	xmrig
behavioral2/memory/2184-25-0x00007FF77F8B0000-0x00007FF77FC04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-23.dat	xmrig
behavioral2/memory/1132-19-0x00007FF6FA720000-0x00007FF6FAA74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-17.dat	xmrig
behavioral2/files/0x000800000002341d-12.dat	xmrig
behavioral2/memory/1752-10-0x00007FF635100000-0x00007FF635454000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1752	VyEHUgN.exe
1132	yMtnTlC.exe
2184	zixYYyb.exe
4476	YIfOsvA.exe
4264	opCOrRg.exe
2452	hhaEkxN.exe
532	Yierefq.exe
2868	eSVNcHY.exe
4440	bGtvKpS.exe
1360	qvZQOvh.exe
4248	OePNcoB.exe
4000	ZCTvtwU.exe
4976	zBDCyvG.exe
1456	fOEubpR.exe
3916	XesHyeL.exe
5012	jgZZABi.exe
3064	uZVbxJj.exe
2932	dCzArJP.exe
2160	hBsRPtC.exe
1268	bWJvPby.exe
3728	fguJiEu.exe
1352	wsrOvpp.exe
2984	ZCAfHNW.exe
1100	YGfmrOr.exe
4512	vpThEnZ.exe
2352	BNMhcKq.exe
5000	yZbOaGa.exe
3320	MZUxoEM.exe
392	FznWNWl.exe
1892	qsuuhHO.exe
2092	LSjEudi.exe
5076	AYtmVgP.exe
4548	vIxmqNw.exe
2912	jjYMYuW.exe
4940	ZOJlOTV.exe
2368	dfjndRj.exe
4276	ybnCpVI.exe
2276	GlAmLnW.exe
2816	fdpNKJx.exe
1660	gfkoeYH.exe
4316	qDcyEgF.exe
2736	HTIPjRv.exe
3956	PpRrdfL.exe
428	IpOSKDv.exe
3272	RwwdyRN.exe
4052	BCosNmj.exe
2548	uCSMYTN.exe
1764	aMUKSNN.exe
2892	pHkEQZC.exe
1176	ekKtRMZ.exe
1736	whNiqNY.exe
4492	pdYrVkS.exe
632	boQrLhO.exe
4928	lAaLSZC.exe
4176	XxYpGyM.exe
4640	fZjgipo.exe
4900	fRQMDjt.exe
1316	PbnPGYy.exe
2708	lBSuQNn.exe
1428	IBMbJwc.exe
4540	meQFrei.exe
1472	oKUmMHz.exe
4056	uLUzBVv.exe
624	ltZPWJR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4392-0-0x00007FF682E20000-0x00007FF683174000-memory.dmp	upx
behavioral2/files/0x0007000000023297-6.dat	upx
behavioral2/files/0x0007000000023423-28.dat	upx
behavioral2/memory/4264-36-0x00007FF6E5DB0000-0x00007FF6E6104000-memory.dmp	upx
behavioral2/files/0x0007000000023426-55.dat	upx
behavioral2/files/0x000700000002342c-66.dat	upx
behavioral2/files/0x000700000002342a-98.dat	upx
behavioral2/memory/3728-152-0x00007FF7434C0000-0x00007FF743814000-memory.dmp	upx
behavioral2/files/0x000700000002343c-167.dat	upx
behavioral2/memory/1360-174-0x00007FF678300000-0x00007FF678654000-memory.dmp	upx
behavioral2/memory/2160-177-0x00007FF7B6150000-0x00007FF7B64A4000-memory.dmp	upx
behavioral2/memory/2352-180-0x00007FF6443A0000-0x00007FF6446F4000-memory.dmp	upx
behavioral2/memory/3320-181-0x00007FF66EAA0000-0x00007FF66EDF4000-memory.dmp	upx
behavioral2/memory/4512-179-0x00007FF77FD90000-0x00007FF7800E4000-memory.dmp	upx
behavioral2/memory/1352-178-0x00007FF6CAC40000-0x00007FF6CAF94000-memory.dmp	upx
behavioral2/memory/5012-176-0x00007FF6D7AB0000-0x00007FF6D7E04000-memory.dmp	upx
behavioral2/memory/4000-175-0x00007FF6BB6A0000-0x00007FF6BB9F4000-memory.dmp	upx
behavioral2/files/0x000700000002343a-172.dat	upx
behavioral2/memory/4440-171-0x00007FF77EE90000-0x00007FF77F1E4000-memory.dmp	upx
behavioral2/memory/392-170-0x00007FF685A60000-0x00007FF685DB4000-memory.dmp	upx
behavioral2/memory/5000-169-0x00007FF7C3A60000-0x00007FF7C3DB4000-memory.dmp	upx
behavioral2/files/0x000700000002343b-165.dat	upx
behavioral2/files/0x0007000000023439-163.dat	upx
behavioral2/files/0x0007000000023438-160.dat	upx
behavioral2/memory/1100-159-0x00007FF705280000-0x00007FF7055D4000-memory.dmp	upx
behavioral2/memory/2984-158-0x00007FF6B7220000-0x00007FF6B7574000-memory.dmp	upx
behavioral2/files/0x0007000000023436-156.dat	upx
behavioral2/files/0x0007000000023435-144.dat	upx
behavioral2/files/0x0007000000023434-143.dat	upx
behavioral2/memory/1268-137-0x00007FF619790000-0x00007FF619AE4000-memory.dmp	upx
behavioral2/memory/2932-127-0x00007FF6FD3A0000-0x00007FF6FD6F4000-memory.dmp	upx
behavioral2/files/0x0007000000023433-135.dat	upx
behavioral2/files/0x0007000000023431-123.dat	upx
behavioral2/files/0x0007000000023437-130.dat	upx
behavioral2/memory/3064-120-0x00007FF632CB0000-0x00007FF633004000-memory.dmp	upx
behavioral2/files/0x000700000002342e-119.dat	upx
behavioral2/memory/3916-114-0x00007FF672E50000-0x00007FF6731A4000-memory.dmp	upx
behavioral2/files/0x0007000000023430-112.dat	upx
behavioral2/files/0x0007000000023432-109.dat	upx
behavioral2/files/0x000700000002342d-103.dat	upx
behavioral2/files/0x000700000002342b-101.dat	upx
behavioral2/memory/1456-95-0x00007FF7D56F0000-0x00007FF7D5A44000-memory.dmp	upx
behavioral2/files/0x000700000002342f-90.dat	upx
behavioral2/files/0x000700000002343d-185.dat	upx
behavioral2/memory/4392-1696-0x00007FF682E20000-0x00007FF683174000-memory.dmp	upx
behavioral2/memory/1752-2088-0x00007FF635100000-0x00007FF635454000-memory.dmp	upx
behavioral2/files/0x000800000002341e-190.dat	upx
behavioral2/memory/4976-83-0x00007FF77D550000-0x00007FF77D8A4000-memory.dmp	upx
behavioral2/memory/4248-80-0x00007FF6A24A0000-0x00007FF6A27F4000-memory.dmp	upx
behavioral2/files/0x0007000000023429-76.dat	upx
behavioral2/files/0x0007000000023428-72.dat	upx
behavioral2/files/0x0007000000023427-70.dat	upx
behavioral2/memory/2868-63-0x00007FF61DEE0000-0x00007FF61E234000-memory.dmp	upx
behavioral2/memory/2452-51-0x00007FF6F2970000-0x00007FF6F2CC4000-memory.dmp	upx
behavioral2/files/0x0007000000023425-47.dat	upx
behavioral2/memory/532-42-0x00007FF655790000-0x00007FF655AE4000-memory.dmp	upx
behavioral2/files/0x0007000000023424-39.dat	upx
behavioral2/memory/4476-30-0x00007FF61E4C0000-0x00007FF61E814000-memory.dmp	upx
behavioral2/memory/2184-25-0x00007FF77F8B0000-0x00007FF77FC04000-memory.dmp	upx
behavioral2/files/0x0007000000023422-23.dat	upx
behavioral2/memory/1132-19-0x00007FF6FA720000-0x00007FF6FAA74000-memory.dmp	upx
behavioral2/files/0x0007000000023421-17.dat	upx
behavioral2/files/0x000800000002341d-12.dat	upx
behavioral2/memory/1752-10-0x00007FF635100000-0x00007FF635454000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eiFrwUe.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\HCmDWlJ.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\CYDSwAh.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\oCDoxHq.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\pHkEQZC.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\qugDjCw.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\AyFJpin.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\uusAwTC.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\GHkgqzk.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\lczOPsH.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\URGUDjX.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\CqRChAa.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\ZCTvtwU.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\nTLtZkc.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\JbbMSXe.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\AQDxJoW.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\ERBuGQk.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\CthkKtM.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\HicZtqZ.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\IPggCjV.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\LAoijTx.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\bXEXyWd.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\mDiROOl.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\qDYMNys.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\ClfNjIr.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\lkVtQGK.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\NjrgHse.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\MmYsWcS.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\bKqgGiK.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\WePZWfP.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\TQNfmBO.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\jjYMYuW.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\nZGwCxx.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\kWfBHQQ.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\sRctorB.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\QquOxBC.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\tOvsJdu.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\ZdozRzF.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\kxEGTCZ.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\SQHqhco.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\znFDDIJ.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\Mkssuuq.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\GQksaWc.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\TvJexLS.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\bNdbUZr.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\keYANeI.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\KQfJzDA.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\jZyvDLh.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\dXqgsbx.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\CHrlZCI.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\GAHZhif.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\IipYXcN.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\vtxrFnN.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\bLJiAJk.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\bGtvKpS.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\COfuJae.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\boQrLhO.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\VbPTpfv.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\HCeSZab.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\URruMek.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\XwiPwrA.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\bWJvPby.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\rotqnBf.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\ZXdaRVH.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 1752	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	83
PID 4392 wrote to memory of 1752	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	83
PID 4392 wrote to memory of 1132	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	84
PID 4392 wrote to memory of 1132	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	84
PID 4392 wrote to memory of 2184	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	85
PID 4392 wrote to memory of 2184	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	85
PID 4392 wrote to memory of 4476	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	86
PID 4392 wrote to memory of 4476	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	86
PID 4392 wrote to memory of 4264	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	87
PID 4392 wrote to memory of 4264	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	87
PID 4392 wrote to memory of 2452	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	88
PID 4392 wrote to memory of 2452	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	88
PID 4392 wrote to memory of 532	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	89
PID 4392 wrote to memory of 532	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	89
PID 4392 wrote to memory of 2868	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	90
PID 4392 wrote to memory of 2868	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	90
PID 4392 wrote to memory of 4440	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	91
PID 4392 wrote to memory of 4440	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	91
PID 4392 wrote to memory of 1360	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	92
PID 4392 wrote to memory of 1360	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	92
PID 4392 wrote to memory of 4248	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	93
PID 4392 wrote to memory of 4248	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	93
PID 4392 wrote to memory of 4976	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	94
PID 4392 wrote to memory of 4976	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	94
PID 4392 wrote to memory of 1456	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	95
PID 4392 wrote to memory of 1456	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	95
PID 4392 wrote to memory of 4000	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	96
PID 4392 wrote to memory of 4000	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	96
PID 4392 wrote to memory of 3916	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	97
PID 4392 wrote to memory of 3916	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	97
PID 4392 wrote to memory of 5012	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	98
PID 4392 wrote to memory of 5012	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	98
PID 4392 wrote to memory of 3064	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	99
PID 4392 wrote to memory of 3064	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	99
PID 4392 wrote to memory of 2932	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	100
PID 4392 wrote to memory of 2932	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	100
PID 4392 wrote to memory of 2160	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	101
PID 4392 wrote to memory of 2160	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	101
PID 4392 wrote to memory of 1268	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	102
PID 4392 wrote to memory of 1268	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	102
PID 4392 wrote to memory of 3728	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	103
PID 4392 wrote to memory of 3728	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	103
PID 4392 wrote to memory of 1352	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	104
PID 4392 wrote to memory of 1352	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	104
PID 4392 wrote to memory of 2984	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	105
PID 4392 wrote to memory of 2984	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	105
PID 4392 wrote to memory of 1100	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	106
PID 4392 wrote to memory of 1100	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	106
PID 4392 wrote to memory of 4512	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	107
PID 4392 wrote to memory of 4512	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	107
PID 4392 wrote to memory of 2352	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	108
PID 4392 wrote to memory of 2352	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	108
PID 4392 wrote to memory of 5000	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	109
PID 4392 wrote to memory of 5000	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	109
PID 4392 wrote to memory of 1892	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	110
PID 4392 wrote to memory of 1892	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	110
PID 4392 wrote to memory of 3320	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	111
PID 4392 wrote to memory of 3320	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	111
PID 4392 wrote to memory of 392	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	112
PID 4392 wrote to memory of 392	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	112
PID 4392 wrote to memory of 2092	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	113
PID 4392 wrote to memory of 2092	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	113
PID 4392 wrote to memory of 5076	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	116
PID 4392 wrote to memory of 5076	4392	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\2793707205\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\2793707205\zmstage.exe
1⤵
PID:3316

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2248

C:\Users\Admin\AppData\Local\Temp\b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\System\VyEHUgN.exe
  C:\Windows\System\VyEHUgN.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\yMtnTlC.exe
  C:\Windows\System\yMtnTlC.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\zixYYyb.exe
  C:\Windows\System\zixYYyb.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\YIfOsvA.exe
  C:\Windows\System\YIfOsvA.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\opCOrRg.exe
  C:\Windows\System\opCOrRg.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\hhaEkxN.exe
  C:\Windows\System\hhaEkxN.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\Yierefq.exe
  C:\Windows\System\Yierefq.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\eSVNcHY.exe
  C:\Windows\System\eSVNcHY.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\bGtvKpS.exe
  C:\Windows\System\bGtvKpS.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\qvZQOvh.exe
  C:\Windows\System\qvZQOvh.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\OePNcoB.exe
  C:\Windows\System\OePNcoB.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\zBDCyvG.exe
  C:\Windows\System\zBDCyvG.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\fOEubpR.exe
  C:\Windows\System\fOEubpR.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\ZCTvtwU.exe
  C:\Windows\System\ZCTvtwU.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\XesHyeL.exe
  C:\Windows\System\XesHyeL.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\jgZZABi.exe
  C:\Windows\System\jgZZABi.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\uZVbxJj.exe
  C:\Windows\System\uZVbxJj.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\dCzArJP.exe
  C:\Windows\System\dCzArJP.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\hBsRPtC.exe
  C:\Windows\System\hBsRPtC.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\bWJvPby.exe
  C:\Windows\System\bWJvPby.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\fguJiEu.exe
  C:\Windows\System\fguJiEu.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\wsrOvpp.exe
  C:\Windows\System\wsrOvpp.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\ZCAfHNW.exe
  C:\Windows\System\ZCAfHNW.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\YGfmrOr.exe
  C:\Windows\System\YGfmrOr.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\vpThEnZ.exe
  C:\Windows\System\vpThEnZ.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\BNMhcKq.exe
  C:\Windows\System\BNMhcKq.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\yZbOaGa.exe
  C:\Windows\System\yZbOaGa.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\qsuuhHO.exe
  C:\Windows\System\qsuuhHO.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\MZUxoEM.exe
  C:\Windows\System\MZUxoEM.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\FznWNWl.exe
  C:\Windows\System\FznWNWl.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\LSjEudi.exe
  C:\Windows\System\LSjEudi.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\AYtmVgP.exe
  C:\Windows\System\AYtmVgP.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\vIxmqNw.exe
  C:\Windows\System\vIxmqNw.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\jjYMYuW.exe
  C:\Windows\System\jjYMYuW.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\ZOJlOTV.exe
  C:\Windows\System\ZOJlOTV.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\dfjndRj.exe
  C:\Windows\System\dfjndRj.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\ybnCpVI.exe
  C:\Windows\System\ybnCpVI.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\GlAmLnW.exe
  C:\Windows\System\GlAmLnW.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\fdpNKJx.exe
  C:\Windows\System\fdpNKJx.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\gfkoeYH.exe
  C:\Windows\System\gfkoeYH.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\qDcyEgF.exe
  C:\Windows\System\qDcyEgF.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\HTIPjRv.exe
  C:\Windows\System\HTIPjRv.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\PpRrdfL.exe
  C:\Windows\System\PpRrdfL.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\IpOSKDv.exe
  C:\Windows\System\IpOSKDv.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\RwwdyRN.exe
  C:\Windows\System\RwwdyRN.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\BCosNmj.exe
  C:\Windows\System\BCosNmj.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\uCSMYTN.exe
  C:\Windows\System\uCSMYTN.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\aMUKSNN.exe
  C:\Windows\System\aMUKSNN.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\pHkEQZC.exe
  C:\Windows\System\pHkEQZC.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\ekKtRMZ.exe
  C:\Windows\System\ekKtRMZ.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\whNiqNY.exe
  C:\Windows\System\whNiqNY.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\pdYrVkS.exe
  C:\Windows\System\pdYrVkS.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\boQrLhO.exe
  C:\Windows\System\boQrLhO.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\lAaLSZC.exe
  C:\Windows\System\lAaLSZC.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\XxYpGyM.exe
  C:\Windows\System\XxYpGyM.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\fZjgipo.exe
  C:\Windows\System\fZjgipo.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\fRQMDjt.exe
  C:\Windows\System\fRQMDjt.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\PbnPGYy.exe
  C:\Windows\System\PbnPGYy.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\lBSuQNn.exe
  C:\Windows\System\lBSuQNn.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\IBMbJwc.exe
  C:\Windows\System\IBMbJwc.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\meQFrei.exe
  C:\Windows\System\meQFrei.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\oKUmMHz.exe
  C:\Windows\System\oKUmMHz.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\uLUzBVv.exe
  C:\Windows\System\uLUzBVv.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\ltZPWJR.exe
  C:\Windows\System\ltZPWJR.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\amvuWRg.exe
  C:\Windows\System\amvuWRg.exe
  2⤵
  PID:4884
- C:\Windows\System\SQHqhco.exe
  C:\Windows\System\SQHqhco.exe
  2⤵
  PID:4064
- C:\Windows\System\UtGmidm.exe
  C:\Windows\System\UtGmidm.exe
  2⤵
  PID:4344
- C:\Windows\System\qZUxPlb.exe
  C:\Windows\System\qZUxPlb.exe
  2⤵
  PID:3248
- C:\Windows\System\BaQRyko.exe
  C:\Windows\System\BaQRyko.exe
  2⤵
  PID:3316
- C:\Windows\System\oOnCgvZ.exe
  C:\Windows\System\oOnCgvZ.exe
  2⤵
  PID:4356
- C:\Windows\System\jsUojdQ.exe
  C:\Windows\System\jsUojdQ.exe
  2⤵
  PID:4808
- C:\Windows\System\zsnVtHh.exe
  C:\Windows\System\zsnVtHh.exe
  2⤵
  PID:1164
- C:\Windows\System\cmQzhyz.exe
  C:\Windows\System\cmQzhyz.exe
  2⤵
  PID:2992
- C:\Windows\System\nShJghX.exe
  C:\Windows\System\nShJghX.exe
  2⤵
  PID:4968
- C:\Windows\System\NAjAMdS.exe
  C:\Windows\System\NAjAMdS.exe
  2⤵
  PID:1168
- C:\Windows\System\GOdOTId.exe
  C:\Windows\System\GOdOTId.exe
  2⤵
  PID:1152
- C:\Windows\System\gBsBTiq.exe
  C:\Windows\System\gBsBTiq.exe
  2⤵
  PID:4404
- C:\Windows\System\raWpccJ.exe
  C:\Windows\System\raWpccJ.exe
  2⤵
  PID:4452
- C:\Windows\System\xdoEphx.exe
  C:\Windows\System\xdoEphx.exe
  2⤵
  PID:2292
- C:\Windows\System\oidVJei.exe
  C:\Windows\System\oidVJei.exe
  2⤵
  PID:3044
- C:\Windows\System\KGGpPtB.exe
  C:\Windows\System\KGGpPtB.exe
  2⤵
  PID:2404
- C:\Windows\System\DhvQQCr.exe
  C:\Windows\System\DhvQQCr.exe
  2⤵
  PID:4328
- C:\Windows\System\XlVaGHd.exe
  C:\Windows\System\XlVaGHd.exe
  2⤵
  PID:4972
- C:\Windows\System\KmiMXqa.exe
  C:\Windows\System\KmiMXqa.exe
  2⤵
  PID:2596
- C:\Windows\System\yAxMnkM.exe
  C:\Windows\System\yAxMnkM.exe
  2⤵
  PID:4024
- C:\Windows\System\dpxrZGD.exe
  C:\Windows\System\dpxrZGD.exe
  2⤵
  PID:3088
- C:\Windows\System\kRFVIaf.exe
  C:\Windows\System\kRFVIaf.exe
  2⤵
  PID:1760
- C:\Windows\System\TDgrXgS.exe
  C:\Windows\System\TDgrXgS.exe
  2⤵
  PID:1416
- C:\Windows\System\kDsNSIh.exe
  C:\Windows\System\kDsNSIh.exe
  2⤵
  PID:3500
- C:\Windows\System\pVLFuin.exe
  C:\Windows\System\pVLFuin.exe
  2⤵
  PID:2012
- C:\Windows\System\iznEaKK.exe
  C:\Windows\System\iznEaKK.exe
  2⤵
  PID:5140
- C:\Windows\System\lvbLpMX.exe
  C:\Windows\System\lvbLpMX.exe
  2⤵
  PID:5156
- C:\Windows\System\swaSLLj.exe
  C:\Windows\System\swaSLLj.exe
  2⤵
  PID:5196
- C:\Windows\System\CENAEiG.exe
  C:\Windows\System\CENAEiG.exe
  2⤵
  PID:5216
- C:\Windows\System\TvtoRvW.exe
  C:\Windows\System\TvtoRvW.exe
  2⤵
  PID:5244
- C:\Windows\System\mcufNRw.exe
  C:\Windows\System\mcufNRw.exe
  2⤵
  PID:5280
- C:\Windows\System\rbBoUDu.exe
  C:\Windows\System\rbBoUDu.exe
  2⤵
  PID:5312
- C:\Windows\System\GwwMnun.exe
  C:\Windows\System\GwwMnun.exe
  2⤵
  PID:5340
- C:\Windows\System\WGszYzs.exe
  C:\Windows\System\WGszYzs.exe
  2⤵
  PID:5368
- C:\Windows\System\BrqaYrs.exe
  C:\Windows\System\BrqaYrs.exe
  2⤵
  PID:5396
- C:\Windows\System\xvVbTQJ.exe
  C:\Windows\System\xvVbTQJ.exe
  2⤵
  PID:5424
- C:\Windows\System\nZGwCxx.exe
  C:\Windows\System\nZGwCxx.exe
  2⤵
  PID:5452
- C:\Windows\System\gQOxRlo.exe
  C:\Windows\System\gQOxRlo.exe
  2⤵
  PID:5488
- C:\Windows\System\lkVtQGK.exe
  C:\Windows\System\lkVtQGK.exe
  2⤵
  PID:5512
- C:\Windows\System\dtGINbL.exe
  C:\Windows\System\dtGINbL.exe
  2⤵
  PID:5540
- C:\Windows\System\FZAEYaG.exe
  C:\Windows\System\FZAEYaG.exe
  2⤵
  PID:5576
- C:\Windows\System\sNWdMXV.exe
  C:\Windows\System\sNWdMXV.exe
  2⤵
  PID:5604
- C:\Windows\System\FbgYFDW.exe
  C:\Windows\System\FbgYFDW.exe
  2⤵
  PID:5624
- C:\Windows\System\CUiWHbl.exe
  C:\Windows\System\CUiWHbl.exe
  2⤵
  PID:5652
- C:\Windows\System\rvytZdV.exe
  C:\Windows\System\rvytZdV.exe
  2⤵
  PID:5684
- C:\Windows\System\DKrxXKx.exe
  C:\Windows\System\DKrxXKx.exe
  2⤵
  PID:5716
- C:\Windows\System\EsotuBe.exe
  C:\Windows\System\EsotuBe.exe
  2⤵
  PID:5740
- C:\Windows\System\gHXKlSu.exe
  C:\Windows\System\gHXKlSu.exe
  2⤵
  PID:5780
- C:\Windows\System\JAYanid.exe
  C:\Windows\System\JAYanid.exe
  2⤵
  PID:5804
- C:\Windows\System\uqVYmsT.exe
  C:\Windows\System\uqVYmsT.exe
  2⤵
  PID:5828
- C:\Windows\System\uBakVUA.exe
  C:\Windows\System\uBakVUA.exe
  2⤵
  PID:5856
- C:\Windows\System\IWEazlV.exe
  C:\Windows\System\IWEazlV.exe
  2⤵
  PID:5884
- C:\Windows\System\JESUUvf.exe
  C:\Windows\System\JESUUvf.exe
  2⤵
  PID:5912
- C:\Windows\System\HicZtqZ.exe
  C:\Windows\System\HicZtqZ.exe
  2⤵
  PID:5944
- C:\Windows\System\uiCnXFG.exe
  C:\Windows\System\uiCnXFG.exe
  2⤵
  PID:5972
- C:\Windows\System\NkoOnmm.exe
  C:\Windows\System\NkoOnmm.exe
  2⤵
  PID:5988
- C:\Windows\System\gdaOAsl.exe
  C:\Windows\System\gdaOAsl.exe
  2⤵
  PID:6012
- C:\Windows\System\WauHvYI.exe
  C:\Windows\System\WauHvYI.exe
  2⤵
  PID:6052
- C:\Windows\System\IqMNAUK.exe
  C:\Windows\System\IqMNAUK.exe
  2⤵
  PID:6092
- C:\Windows\System\qugDjCw.exe
  C:\Windows\System\qugDjCw.exe
  2⤵
  PID:6124
- C:\Windows\System\pFlfgaw.exe
  C:\Windows\System\pFlfgaw.exe
  2⤵
  PID:5136
- C:\Windows\System\NjrgHse.exe
  C:\Windows\System\NjrgHse.exe
  2⤵
  PID:5204
- C:\Windows\System\RgLylOQ.exe
  C:\Windows\System\RgLylOQ.exe
  2⤵
  PID:5232
- C:\Windows\System\axltwzw.exe
  C:\Windows\System\axltwzw.exe
  2⤵
  PID:5328
- C:\Windows\System\llBfYqQ.exe
  C:\Windows\System\llBfYqQ.exe
  2⤵
  PID:5380
- C:\Windows\System\CRQlNSL.exe
  C:\Windows\System\CRQlNSL.exe
  2⤵
  PID:5436
- C:\Windows\System\GCIBGcz.exe
  C:\Windows\System\GCIBGcz.exe
  2⤵
  PID:5472
- C:\Windows\System\xdupmDH.exe
  C:\Windows\System\xdupmDH.exe
  2⤵
  PID:5568
- C:\Windows\System\wxScvyi.exe
  C:\Windows\System\wxScvyi.exe
  2⤵
  PID:5620
- C:\Windows\System\FoJCHvL.exe
  C:\Windows\System\FoJCHvL.exe
  2⤵
  PID:2944
- C:\Windows\System\TiWDAPM.exe
  C:\Windows\System\TiWDAPM.exe
  2⤵
  PID:5736
- C:\Windows\System\jZyvDLh.exe
  C:\Windows\System\jZyvDLh.exe
  2⤵
  PID:5796
- C:\Windows\System\GqJMUlX.exe
  C:\Windows\System\GqJMUlX.exe
  2⤵
  PID:5880
- C:\Windows\System\YEoCCpZ.exe
  C:\Windows\System\YEoCCpZ.exe
  2⤵
  PID:5964
- C:\Windows\System\nTSnMCc.exe
  C:\Windows\System\nTSnMCc.exe
  2⤵
  PID:6008
- C:\Windows\System\CuBvFhm.exe
  C:\Windows\System\CuBvFhm.exe
  2⤵
  PID:6080
- C:\Windows\System\WAMUOpj.exe
  C:\Windows\System\WAMUOpj.exe
  2⤵
  PID:6116
- C:\Windows\System\MoSCIFg.exe
  C:\Windows\System\MoSCIFg.exe
  2⤵
  PID:4920
- C:\Windows\System\AdFnnmp.exe
  C:\Windows\System\AdFnnmp.exe
  2⤵
  PID:5448
- C:\Windows\System\oWyCMuL.exe
  C:\Windows\System\oWyCMuL.exe
  2⤵
  PID:5588
- C:\Windows\System\CeXejhO.exe
  C:\Windows\System\CeXejhO.exe
  2⤵
  PID:5708
- C:\Windows\System\CLrtXVo.exe
  C:\Windows\System\CLrtXVo.exe
  2⤵
  PID:5868
- C:\Windows\System\uxhEPyp.exe
  C:\Windows\System\uxhEPyp.exe
  2⤵
  PID:6032
- C:\Windows\System\VVVBeLJ.exe
  C:\Windows\System\VVVBeLJ.exe
  2⤵
  PID:2788
- C:\Windows\System\QVeobkT.exe
  C:\Windows\System\QVeobkT.exe
  2⤵
  PID:3468
- C:\Windows\System\lkEjchu.exe
  C:\Windows\System\lkEjchu.exe
  2⤵
  PID:5792
- C:\Windows\System\HEpfRmo.exe
  C:\Windows\System\HEpfRmo.exe
  2⤵
  PID:5392
- C:\Windows\System\uYoVpaq.exe
  C:\Windows\System\uYoVpaq.exe
  2⤵
  PID:5152
- C:\Windows\System\ZWmyreT.exe
  C:\Windows\System\ZWmyreT.exe
  2⤵
  PID:1156
- C:\Windows\System\NfXYwst.exe
  C:\Windows\System\NfXYwst.exe
  2⤵
  PID:6176
- C:\Windows\System\RBjbeay.exe
  C:\Windows\System\RBjbeay.exe
  2⤵
  PID:6208
- C:\Windows\System\sUuGscd.exe
  C:\Windows\System\sUuGscd.exe
  2⤵
  PID:6244
- C:\Windows\System\BERemXT.exe
  C:\Windows\System\BERemXT.exe
  2⤵
  PID:6280
- C:\Windows\System\MaxFueP.exe
  C:\Windows\System\MaxFueP.exe
  2⤵
  PID:6308
- C:\Windows\System\gdUaWCs.exe
  C:\Windows\System\gdUaWCs.exe
  2⤵
  PID:6328
- C:\Windows\System\VyFPKNk.exe
  C:\Windows\System\VyFPKNk.exe
  2⤵
  PID:6348
- C:\Windows\System\SNIyTqm.exe
  C:\Windows\System\SNIyTqm.exe
  2⤵
  PID:6384
- C:\Windows\System\vDoYhaF.exe
  C:\Windows\System\vDoYhaF.exe
  2⤵
  PID:6420
- C:\Windows\System\oQrSmna.exe
  C:\Windows\System\oQrSmna.exe
  2⤵
  PID:6444
- C:\Windows\System\rYUHviO.exe
  C:\Windows\System\rYUHviO.exe
  2⤵
  PID:6472
- C:\Windows\System\yYCCZgR.exe
  C:\Windows\System\yYCCZgR.exe
  2⤵
  PID:6500
- C:\Windows\System\KvHNTGz.exe
  C:\Windows\System\KvHNTGz.exe
  2⤵
  PID:6544
- C:\Windows\System\dXqgsbx.exe
  C:\Windows\System\dXqgsbx.exe
  2⤵
  PID:6564
- C:\Windows\System\INrSBnV.exe
  C:\Windows\System\INrSBnV.exe
  2⤵
  PID:6596
- C:\Windows\System\aAcKvqr.exe
  C:\Windows\System\aAcKvqr.exe
  2⤵
  PID:6624
- C:\Windows\System\RvXmoGq.exe
  C:\Windows\System\RvXmoGq.exe
  2⤵
  PID:6652
- C:\Windows\System\WVESfjN.exe
  C:\Windows\System\WVESfjN.exe
  2⤵
  PID:6676
- C:\Windows\System\naqtpcI.exe
  C:\Windows\System\naqtpcI.exe
  2⤵
  PID:6708
- C:\Windows\System\nTLtZkc.exe
  C:\Windows\System\nTLtZkc.exe
  2⤵
  PID:6732
- C:\Windows\System\pYPaJLm.exe
  C:\Windows\System\pYPaJLm.exe
  2⤵
  PID:6760
- C:\Windows\System\eiFrwUe.exe
  C:\Windows\System\eiFrwUe.exe
  2⤵
  PID:6788
- C:\Windows\System\IKMnmAf.exe
  C:\Windows\System\IKMnmAf.exe
  2⤵
  PID:6816
- C:\Windows\System\bMyJzrf.exe
  C:\Windows\System\bMyJzrf.exe
  2⤵
  PID:6844
- C:\Windows\System\xEdpgXA.exe
  C:\Windows\System\xEdpgXA.exe
  2⤵
  PID:6872
- C:\Windows\System\VAXNJVy.exe
  C:\Windows\System\VAXNJVy.exe
  2⤵
  PID:6900
- C:\Windows\System\cyAixMv.exe
  C:\Windows\System\cyAixMv.exe
  2⤵
  PID:6928
- C:\Windows\System\accBeJN.exe
  C:\Windows\System\accBeJN.exe
  2⤵
  PID:6948
- C:\Windows\System\kWfBHQQ.exe
  C:\Windows\System\kWfBHQQ.exe
  2⤵
  PID:6980
- C:\Windows\System\xYukiwf.exe
  C:\Windows\System\xYukiwf.exe
  2⤵
  PID:7012
- C:\Windows\System\gacsHfX.exe
  C:\Windows\System\gacsHfX.exe
  2⤵
  PID:7040
- C:\Windows\System\OEWHPLy.exe
  C:\Windows\System\OEWHPLy.exe
  2⤵
  PID:7068
- C:\Windows\System\fceXkeA.exe
  C:\Windows\System\fceXkeA.exe
  2⤵
  PID:7096
- C:\Windows\System\JhbEOZk.exe
  C:\Windows\System\JhbEOZk.exe
  2⤵
  PID:7128
- C:\Windows\System\KGinBNq.exe
  C:\Windows\System\KGinBNq.exe
  2⤵
  PID:7152
- C:\Windows\System\MLJjAeK.exe
  C:\Windows\System\MLJjAeK.exe
  2⤵
  PID:6188
- C:\Windows\System\ZaskwfR.exe
  C:\Windows\System\ZaskwfR.exe
  2⤵
  PID:6264
- C:\Windows\System\ZoxocOB.exe
  C:\Windows\System\ZoxocOB.exe
  2⤵
  PID:6324
- C:\Windows\System\yDtoCmd.exe
  C:\Windows\System\yDtoCmd.exe
  2⤵
  PID:6408
- C:\Windows\System\sYwRJPr.exe
  C:\Windows\System\sYwRJPr.exe
  2⤵
  PID:6492
- C:\Windows\System\nvKfPXc.exe
  C:\Windows\System\nvKfPXc.exe
  2⤵
  PID:6556
- C:\Windows\System\vJXNgET.exe
  C:\Windows\System\vJXNgET.exe
  2⤵
  PID:6616
- C:\Windows\System\SxuwpIB.exe
  C:\Windows\System\SxuwpIB.exe
  2⤵
  PID:6716
- C:\Windows\System\lknzFyk.exe
  C:\Windows\System\lknzFyk.exe
  2⤵
  PID:6752
- C:\Windows\System\UkgUkDb.exe
  C:\Windows\System\UkgUkDb.exe
  2⤵
  PID:6828
- C:\Windows\System\LZCQkGh.exe
  C:\Windows\System\LZCQkGh.exe
  2⤵
  PID:6868
- C:\Windows\System\gbuodqv.exe
  C:\Windows\System\gbuodqv.exe
  2⤵
  PID:6920
- C:\Windows\System\RIOBdJa.exe
  C:\Windows\System\RIOBdJa.exe
  2⤵
  PID:6996
- C:\Windows\System\DUCOZgv.exe
  C:\Windows\System\DUCOZgv.exe
  2⤵
  PID:7052
- C:\Windows\System\yCGTwWH.exe
  C:\Windows\System\yCGTwWH.exe
  2⤵
  PID:7116
- C:\Windows\System\vnTPQMo.exe
  C:\Windows\System\vnTPQMo.exe
  2⤵
  PID:6228
- C:\Windows\System\qaoCjXq.exe
  C:\Windows\System\qaoCjXq.exe
  2⤵
  PID:6360
- C:\Windows\System\JiTvqyM.exe
  C:\Windows\System\JiTvqyM.exe
  2⤵
  PID:6528
- C:\Windows\System\wtKQjoO.exe
  C:\Windows\System\wtKQjoO.exe
  2⤵
  PID:6696
- C:\Windows\System\jYUcQBG.exe
  C:\Windows\System\jYUcQBG.exe
  2⤵
  PID:6840
- C:\Windows\System\EXAPngA.exe
  C:\Windows\System\EXAPngA.exe
  2⤵
  PID:6976
- C:\Windows\System\HCmDWlJ.exe
  C:\Windows\System\HCmDWlJ.exe
  2⤵
  PID:7144
- C:\Windows\System\MYrhugy.exe
  C:\Windows\System\MYrhugy.exe
  2⤵
  PID:6468
- C:\Windows\System\zvNAzKw.exe
  C:\Windows\System\zvNAzKw.exe
  2⤵
  PID:2840
- C:\Windows\System\odliEvj.exe
  C:\Windows\System\odliEvj.exe
  2⤵
  PID:2436
- C:\Windows\System\jNrVItM.exe
  C:\Windows\System\jNrVItM.exe
  2⤵
  PID:6800
- C:\Windows\System\CHrlZCI.exe
  C:\Windows\System\CHrlZCI.exe
  2⤵
  PID:6744
- C:\Windows\System\TwzhSdM.exe
  C:\Windows\System\TwzhSdM.exe
  2⤵
  PID:7192
- C:\Windows\System\oUiqIku.exe
  C:\Windows\System\oUiqIku.exe
  2⤵
  PID:7220
- C:\Windows\System\jXMDsui.exe
  C:\Windows\System\jXMDsui.exe
  2⤵
  PID:7248
- C:\Windows\System\XGxwCKR.exe
  C:\Windows\System\XGxwCKR.exe
  2⤵
  PID:7280
- C:\Windows\System\IpVnvRm.exe
  C:\Windows\System\IpVnvRm.exe
  2⤵
  PID:7308
- C:\Windows\System\lkIpHmt.exe
  C:\Windows\System\lkIpHmt.exe
  2⤵
  PID:7336
- C:\Windows\System\sRctorB.exe
  C:\Windows\System\sRctorB.exe
  2⤵
  PID:7364
- C:\Windows\System\uYafkVn.exe
  C:\Windows\System\uYafkVn.exe
  2⤵
  PID:7392
- C:\Windows\System\xTemAJT.exe
  C:\Windows\System\xTemAJT.exe
  2⤵
  PID:7420
- C:\Windows\System\VotqREY.exe
  C:\Windows\System\VotqREY.exe
  2⤵
  PID:7436
- C:\Windows\System\MdxXXBg.exe
  C:\Windows\System\MdxXXBg.exe
  2⤵
  PID:7456
- C:\Windows\System\APrSIYR.exe
  C:\Windows\System\APrSIYR.exe
  2⤵
  PID:7472
- C:\Windows\System\ZSMxsfN.exe
  C:\Windows\System\ZSMxsfN.exe
  2⤵
  PID:7492
- C:\Windows\System\WntpDhB.exe
  C:\Windows\System\WntpDhB.exe
  2⤵
  PID:7520
- C:\Windows\System\mAlpxkD.exe
  C:\Windows\System\mAlpxkD.exe
  2⤵
  PID:7564
- C:\Windows\System\NDkKJju.exe
  C:\Windows\System\NDkKJju.exe
  2⤵
  PID:7608
- C:\Windows\System\ylKABYU.exe
  C:\Windows\System\ylKABYU.exe
  2⤵
  PID:7644
- C:\Windows\System\rotqnBf.exe
  C:\Windows\System\rotqnBf.exe
  2⤵
  PID:7676
- C:\Windows\System\mmRZvFd.exe
  C:\Windows\System\mmRZvFd.exe
  2⤵
  PID:7696
- C:\Windows\System\uSbRplt.exe
  C:\Windows\System\uSbRplt.exe
  2⤵
  PID:7732
- C:\Windows\System\UARGRhJ.exe
  C:\Windows\System\UARGRhJ.exe
  2⤵
  PID:7760
- C:\Windows\System\QquOxBC.exe
  C:\Windows\System\QquOxBC.exe
  2⤵
  PID:7788
- C:\Windows\System\lNFoYkI.exe
  C:\Windows\System\lNFoYkI.exe
  2⤵
  PID:7816
- C:\Windows\System\wgCyjuR.exe
  C:\Windows\System\wgCyjuR.exe
  2⤵
  PID:7844
- C:\Windows\System\KQfJzDA.exe
  C:\Windows\System\KQfJzDA.exe
  2⤵
  PID:7876
- C:\Windows\System\NHqzMLY.exe
  C:\Windows\System\NHqzMLY.exe
  2⤵
  PID:7904
- C:\Windows\System\OnZTAhl.exe
  C:\Windows\System\OnZTAhl.exe
  2⤵
  PID:7920
- C:\Windows\System\yijFETp.exe
  C:\Windows\System\yijFETp.exe
  2⤵
  PID:7940
- C:\Windows\System\kTlwMGw.exe
  C:\Windows\System\kTlwMGw.exe
  2⤵
  PID:7980
- C:\Windows\System\lPdebBj.exe
  C:\Windows\System\lPdebBj.exe
  2⤵
  PID:8016
- C:\Windows\System\IdAdduj.exe
  C:\Windows\System\IdAdduj.exe
  2⤵
  PID:8056
- C:\Windows\System\cTOTbmS.exe
  C:\Windows\System\cTOTbmS.exe
  2⤵
  PID:8100
- C:\Windows\System\BkOWLEJ.exe
  C:\Windows\System\BkOWLEJ.exe
  2⤵
  PID:8136
- C:\Windows\System\XBuarVS.exe
  C:\Windows\System\XBuarVS.exe
  2⤵
  PID:8168
- C:\Windows\System\bzjwLrX.exe
  C:\Windows\System\bzjwLrX.exe
  2⤵
  PID:7176
- C:\Windows\System\oodeITb.exe
  C:\Windows\System\oodeITb.exe
  2⤵
  PID:7244
- C:\Windows\System\iXsphDe.exe
  C:\Windows\System\iXsphDe.exe
  2⤵
  PID:7304
- C:\Windows\System\FkvwUrY.exe
  C:\Windows\System\FkvwUrY.exe
  2⤵
  PID:7380
- C:\Windows\System\cUckVkx.exe
  C:\Windows\System\cUckVkx.exe
  2⤵
  PID:7452
- C:\Windows\System\oBzASNe.exe
  C:\Windows\System\oBzASNe.exe
  2⤵
  PID:7512
- C:\Windows\System\xwwrreS.exe
  C:\Windows\System\xwwrreS.exe
  2⤵
  PID:7548
- C:\Windows\System\HTcmHrQ.exe
  C:\Windows\System\HTcmHrQ.exe
  2⤵
  PID:7660
- C:\Windows\System\PNxbiLD.exe
  C:\Windows\System\PNxbiLD.exe
  2⤵
  PID:7716
- C:\Windows\System\GQksaWc.exe
  C:\Windows\System\GQksaWc.exe
  2⤵
  PID:7780
- C:\Windows\System\dpepkVN.exe
  C:\Windows\System\dpepkVN.exe
  2⤵
  PID:7840
- C:\Windows\System\wZMJXDP.exe
  C:\Windows\System\wZMJXDP.exe
  2⤵
  PID:7896
- C:\Windows\System\ofizkjP.exe
  C:\Windows\System\ofizkjP.exe
  2⤵
  PID:7996
- C:\Windows\System\DpSuKLS.exe
  C:\Windows\System\DpSuKLS.exe
  2⤵
  PID:8072
- C:\Windows\System\fIhMXSL.exe
  C:\Windows\System\fIhMXSL.exe
  2⤵
  PID:8128
- C:\Windows\System\cnvNwjr.exe
  C:\Windows\System\cnvNwjr.exe
  2⤵
  PID:7216
- C:\Windows\System\lxooeGD.exe
  C:\Windows\System\lxooeGD.exe
  2⤵
  PID:7360
- C:\Windows\System\CwIkLaU.exe
  C:\Windows\System\CwIkLaU.exe
  2⤵
  PID:7500
- C:\Windows\System\XyVhZWt.exe
  C:\Windows\System\XyVhZWt.exe
  2⤵
  PID:7692
- C:\Windows\System\kzPBBnB.exe
  C:\Windows\System\kzPBBnB.exe
  2⤵
  PID:7836
- C:\Windows\System\gjjQFcc.exe
  C:\Windows\System\gjjQFcc.exe
  2⤵
  PID:8012
- C:\Windows\System\DTYyxGW.exe
  C:\Windows\System\DTYyxGW.exe
  2⤵
  PID:6644
- C:\Windows\System\MiBjxlB.exe
  C:\Windows\System\MiBjxlB.exe
  2⤵
  PID:7508
- C:\Windows\System\NmKhBew.exe
  C:\Windows\System\NmKhBew.exe
  2⤵
  PID:7328
- C:\Windows\System\JmVyeFs.exe
  C:\Windows\System\JmVyeFs.exe
  2⤵
  PID:7916
- C:\Windows\System\jZUWdrz.exe
  C:\Windows\System\jZUWdrz.exe
  2⤵
  PID:7416
- C:\Windows\System\hOeidTK.exe
  C:\Windows\System\hOeidTK.exe
  2⤵
  PID:8208
- C:\Windows\System\VbPTpfv.exe
  C:\Windows\System\VbPTpfv.exe
  2⤵
  PID:8232
- C:\Windows\System\PSDPEuQ.exe
  C:\Windows\System\PSDPEuQ.exe
  2⤵
  PID:8280
- C:\Windows\System\smCRKiH.exe
  C:\Windows\System\smCRKiH.exe
  2⤵
  PID:8316
- C:\Windows\System\snIxwdH.exe
  C:\Windows\System\snIxwdH.exe
  2⤵
  PID:8348
- C:\Windows\System\HLWQMZL.exe
  C:\Windows\System\HLWQMZL.exe
  2⤵
  PID:8372
- C:\Windows\System\aZFTFXX.exe
  C:\Windows\System\aZFTFXX.exe
  2⤵
  PID:8404
- C:\Windows\System\beiMRjM.exe
  C:\Windows\System\beiMRjM.exe
  2⤵
  PID:8428
- C:\Windows\System\UvyibAy.exe
  C:\Windows\System\UvyibAy.exe
  2⤵
  PID:8456
- C:\Windows\System\OKGMFCH.exe
  C:\Windows\System\OKGMFCH.exe
  2⤵
  PID:8484
- C:\Windows\System\dXBapED.exe
  C:\Windows\System\dXBapED.exe
  2⤵
  PID:8512
- C:\Windows\System\jrQKRoN.exe
  C:\Windows\System\jrQKRoN.exe
  2⤵
  PID:8540
- C:\Windows\System\GAHZhif.exe
  C:\Windows\System\GAHZhif.exe
  2⤵
  PID:8568
- C:\Windows\System\PQfgEGB.exe
  C:\Windows\System\PQfgEGB.exe
  2⤵
  PID:8596
- C:\Windows\System\pwaMTGf.exe
  C:\Windows\System\pwaMTGf.exe
  2⤵
  PID:8632
- C:\Windows\System\axJhKCg.exe
  C:\Windows\System\axJhKCg.exe
  2⤵
  PID:8652
- C:\Windows\System\LaslWvq.exe
  C:\Windows\System\LaslWvq.exe
  2⤵
  PID:8688
- C:\Windows\System\kcPDleO.exe
  C:\Windows\System\kcPDleO.exe
  2⤵
  PID:8712
- C:\Windows\System\nQDVTkM.exe
  C:\Windows\System\nQDVTkM.exe
  2⤵
  PID:8740
- C:\Windows\System\tkvVoil.exe
  C:\Windows\System\tkvVoil.exe
  2⤵
  PID:8768
- C:\Windows\System\FMYTUav.exe
  C:\Windows\System\FMYTUav.exe
  2⤵
  PID:8804
- C:\Windows\System\wlDRxfG.exe
  C:\Windows\System\wlDRxfG.exe
  2⤵
  PID:8828
- C:\Windows\System\qOfyKKX.exe
  C:\Windows\System\qOfyKKX.exe
  2⤵
  PID:8872
- C:\Windows\System\biVXXQS.exe
  C:\Windows\System\biVXXQS.exe
  2⤵
  PID:8900
- C:\Windows\System\gXykvga.exe
  C:\Windows\System\gXykvga.exe
  2⤵
  PID:8920
- C:\Windows\System\DwZjAHe.exe
  C:\Windows\System\DwZjAHe.exe
  2⤵
  PID:8972
- C:\Windows\System\meWhmPL.exe
  C:\Windows\System\meWhmPL.exe
  2⤵
  PID:9012
- C:\Windows\System\tkkEzIq.exe
  C:\Windows\System\tkkEzIq.exe
  2⤵
  PID:9048
- C:\Windows\System\mqlQPzu.exe
  C:\Windows\System\mqlQPzu.exe
  2⤵
  PID:9088
- C:\Windows\System\KeuGTrX.exe
  C:\Windows\System\KeuGTrX.exe
  2⤵
  PID:9124
- C:\Windows\System\gsDPhXX.exe
  C:\Windows\System\gsDPhXX.exe
  2⤵
  PID:9160
- C:\Windows\System\UHNqSLI.exe
  C:\Windows\System\UHNqSLI.exe
  2⤵
  PID:9188
- C:\Windows\System\EUCZZjf.exe
  C:\Windows\System\EUCZZjf.exe
  2⤵
  PID:7808
- C:\Windows\System\JtEgAOK.exe
  C:\Windows\System\JtEgAOK.exe
  2⤵
  PID:8216
- C:\Windows\System\QjoJHir.exe
  C:\Windows\System\QjoJHir.exe
  2⤵
  PID:8336
- C:\Windows\System\nQicdLR.exe
  C:\Windows\System\nQicdLR.exe
  2⤵
  PID:8412
- C:\Windows\System\QsPlSvU.exe
  C:\Windows\System\QsPlSvU.exe
  2⤵
  PID:8476
- C:\Windows\System\zqbXBao.exe
  C:\Windows\System\zqbXBao.exe
  2⤵
  PID:8552
- C:\Windows\System\znFDDIJ.exe
  C:\Windows\System\znFDDIJ.exe
  2⤵
  PID:8664
- C:\Windows\System\AyFJpin.exe
  C:\Windows\System\AyFJpin.exe
  2⤵
  PID:8736
- C:\Windows\System\NSDaeMx.exe
  C:\Windows\System\NSDaeMx.exe
  2⤵
  PID:8864
- C:\Windows\System\EkMRXVv.exe
  C:\Windows\System\EkMRXVv.exe
  2⤵
  PID:8944
- C:\Windows\System\rRDpmOy.exe
  C:\Windows\System\rRDpmOy.exe
  2⤵
  PID:9040
- C:\Windows\System\PzSrBDM.exe
  C:\Windows\System\PzSrBDM.exe
  2⤵
  PID:9132
- C:\Windows\System\ZkKeEUQ.exe
  C:\Windows\System\ZkKeEUQ.exe
  2⤵
  PID:9200
- C:\Windows\System\tvMSbyw.exe
  C:\Windows\System\tvMSbyw.exe
  2⤵
  PID:8120
- C:\Windows\System\klUFaas.exe
  C:\Windows\System\klUFaas.exe
  2⤵
  PID:8392
- C:\Windows\System\vaMYUxG.exe
  C:\Windows\System\vaMYUxG.exe
  2⤵
  PID:8648
- C:\Windows\System\tzaICxE.exe
  C:\Windows\System\tzaICxE.exe
  2⤵
  PID:8892
- C:\Windows\System\tOvsJdu.exe
  C:\Windows\System\tOvsJdu.exe
  2⤵
  PID:9076
- C:\Windows\System\iQTJTxE.exe
  C:\Windows\System\iQTJTxE.exe
  2⤵
  PID:9172
- C:\Windows\System\OznvukY.exe
  C:\Windows\System\OznvukY.exe
  2⤵
  PID:8764
- C:\Windows\System\TUmMcuu.exe
  C:\Windows\System\TUmMcuu.exe
  2⤵
  PID:9212
- C:\Windows\System\rTFvJts.exe
  C:\Windows\System\rTFvJts.exe
  2⤵
  PID:9024
- C:\Windows\System\PkzMsnO.exe
  C:\Windows\System\PkzMsnO.exe
  2⤵
  PID:9256
- C:\Windows\System\IipYXcN.exe
  C:\Windows\System\IipYXcN.exe
  2⤵
  PID:9276
- C:\Windows\System\bOcxITo.exe
  C:\Windows\System\bOcxITo.exe
  2⤵
  PID:9304
- C:\Windows\System\IPggCjV.exe
  C:\Windows\System\IPggCjV.exe
  2⤵
  PID:9336
- C:\Windows\System\ELBOmnc.exe
  C:\Windows\System\ELBOmnc.exe
  2⤵
  PID:9368
- C:\Windows\System\uVebNfM.exe
  C:\Windows\System\uVebNfM.exe
  2⤵
  PID:9408
- C:\Windows\System\rfMlVdt.exe
  C:\Windows\System\rfMlVdt.exe
  2⤵
  PID:9448
- C:\Windows\System\nGwKlDy.exe
  C:\Windows\System\nGwKlDy.exe
  2⤵
  PID:9472
- C:\Windows\System\uusAwTC.exe
  C:\Windows\System\uusAwTC.exe
  2⤵
  PID:9500
- C:\Windows\System\oOMPYLl.exe
  C:\Windows\System\oOMPYLl.exe
  2⤵
  PID:9528
- C:\Windows\System\KGsdFIq.exe
  C:\Windows\System\KGsdFIq.exe
  2⤵
  PID:9556
- C:\Windows\System\lFQtWhE.exe
  C:\Windows\System\lFQtWhE.exe
  2⤵
  PID:9584
- C:\Windows\System\cBjykAQ.exe
  C:\Windows\System\cBjykAQ.exe
  2⤵
  PID:9612
- C:\Windows\System\rrlzFcc.exe
  C:\Windows\System\rrlzFcc.exe
  2⤵
  PID:9640
- C:\Windows\System\QtoGdyJ.exe
  C:\Windows\System\QtoGdyJ.exe
  2⤵
  PID:9668
- C:\Windows\System\hffhVir.exe
  C:\Windows\System\hffhVir.exe
  2⤵
  PID:9696
- C:\Windows\System\AgLyYnt.exe
  C:\Windows\System\AgLyYnt.exe
  2⤵
  PID:9728
- C:\Windows\System\ESKNsZs.exe
  C:\Windows\System\ESKNsZs.exe
  2⤵
  PID:9756
- C:\Windows\System\vKbwtzU.exe
  C:\Windows\System\vKbwtzU.exe
  2⤵
  PID:9784
- C:\Windows\System\dUCfaDO.exe
  C:\Windows\System\dUCfaDO.exe
  2⤵
  PID:9812
- C:\Windows\System\TvJexLS.exe
  C:\Windows\System\TvJexLS.exe
  2⤵
  PID:9840
- C:\Windows\System\QgYXraR.exe
  C:\Windows\System\QgYXraR.exe
  2⤵
  PID:9868
- C:\Windows\System\JgOlqkj.exe
  C:\Windows\System\JgOlqkj.exe
  2⤵
  PID:9896
- C:\Windows\System\htOchyR.exe
  C:\Windows\System\htOchyR.exe
  2⤵
  PID:9924
- C:\Windows\System\tUsngrH.exe
  C:\Windows\System\tUsngrH.exe
  2⤵
  PID:9952
- C:\Windows\System\xeXlUtQ.exe
  C:\Windows\System\xeXlUtQ.exe
  2⤵
  PID:9980
- C:\Windows\System\wutbvPm.exe
  C:\Windows\System\wutbvPm.exe
  2⤵
  PID:10008
- C:\Windows\System\IAfKzhv.exe
  C:\Windows\System\IAfKzhv.exe
  2⤵
  PID:10036
- C:\Windows\System\CYDSwAh.exe
  C:\Windows\System\CYDSwAh.exe
  2⤵
  PID:10064
- C:\Windows\System\MyGHMBn.exe
  C:\Windows\System\MyGHMBn.exe
  2⤵
  PID:10096
- C:\Windows\System\qyhlbeg.exe
  C:\Windows\System\qyhlbeg.exe
  2⤵
  PID:10124
- C:\Windows\System\NzBiopQ.exe
  C:\Windows\System\NzBiopQ.exe
  2⤵
  PID:10152
- C:\Windows\System\GnLNbzP.exe
  C:\Windows\System\GnLNbzP.exe
  2⤵
  PID:10180
- C:\Windows\System\GFRuUwD.exe
  C:\Windows\System\GFRuUwD.exe
  2⤵
  PID:10228
- C:\Windows\System\QrfmqnI.exe
  C:\Windows\System\QrfmqnI.exe
  2⤵
  PID:8504
- C:\Windows\System\wKKMTqa.exe
  C:\Windows\System\wKKMTqa.exe
  2⤵
  PID:9268
- C:\Windows\System\RlaDPvW.exe
  C:\Windows\System\RlaDPvW.exe
  2⤵
  PID:9328
- C:\Windows\System\ytboKsN.exe
  C:\Windows\System\ytboKsN.exe
  2⤵
  PID:9420
- C:\Windows\System\HKeCuwI.exe
  C:\Windows\System\HKeCuwI.exe
  2⤵
  PID:9492
- C:\Windows\System\jCqQfJF.exe
  C:\Windows\System\jCqQfJF.exe
  2⤵
  PID:9524
- C:\Windows\System\JltyELl.exe
  C:\Windows\System\JltyELl.exe
  2⤵
  PID:9596
- C:\Windows\System\EfKHhTV.exe
  C:\Windows\System\EfKHhTV.exe
  2⤵
  PID:9680
- C:\Windows\System\XfEvwbB.exe
  C:\Windows\System\XfEvwbB.exe
  2⤵
  PID:9748
- C:\Windows\System\HWyagwu.exe
  C:\Windows\System\HWyagwu.exe
  2⤵
  PID:9716
- C:\Windows\System\nkXSYGf.exe
  C:\Windows\System\nkXSYGf.exe
  2⤵
  PID:9860
- C:\Windows\System\ZdozRzF.exe
  C:\Windows\System\ZdozRzF.exe
  2⤵
  PID:9920
- C:\Windows\System\cICHRvz.exe
  C:\Windows\System\cICHRvz.exe
  2⤵
  PID:9992
- C:\Windows\System\cBcKNqB.exe
  C:\Windows\System\cBcKNqB.exe
  2⤵
  PID:10056
- C:\Windows\System\zALFYTB.exe
  C:\Windows\System\zALFYTB.exe
  2⤵
  PID:10136
- C:\Windows\System\vecsOSn.exe
  C:\Windows\System\vecsOSn.exe
  2⤵
  PID:10216
- C:\Windows\System\UaiINhq.exe
  C:\Windows\System\UaiINhq.exe
  2⤵
  PID:9264
- C:\Windows\System\AXAGtdm.exe
  C:\Windows\System\AXAGtdm.exe
  2⤵
  PID:9456
- C:\Windows\System\BasaXhj.exe
  C:\Windows\System\BasaXhj.exe
  2⤵
  PID:8680
- C:\Windows\System\mSWLmYC.exe
  C:\Windows\System\mSWLmYC.exe
  2⤵
  PID:9724
- C:\Windows\System\bDzxpPL.exe
  C:\Windows\System\bDzxpPL.exe
  2⤵
  PID:9852
- C:\Windows\System\XlFnVIL.exe
  C:\Windows\System\XlFnVIL.exe
  2⤵
  PID:10032
- C:\Windows\System\cmxlgIA.exe
  C:\Windows\System\cmxlgIA.exe
  2⤵
  PID:10200
- C:\Windows\System\FrGQlck.exe
  C:\Windows\System\FrGQlck.exe
  2⤵
  PID:9824
- C:\Windows\System\UbvxBAx.exe
  C:\Windows\System\UbvxBAx.exe
  2⤵
  PID:9184
- C:\Windows\System\AikCKUB.exe
  C:\Windows\System\AikCKUB.exe
  2⤵
  PID:9972
- C:\Windows\System\OqSLyIi.exe
  C:\Windows\System\OqSLyIi.exe
  2⤵
  PID:10252
- C:\Windows\System\lZZynAW.exe
  C:\Windows\System\lZZynAW.exe
  2⤵
  PID:10284
- C:\Windows\System\oMSZhFz.exe
  C:\Windows\System\oMSZhFz.exe
  2⤵
  PID:10316
- C:\Windows\System\JkjeDKm.exe
  C:\Windows\System\JkjeDKm.exe
  2⤵
  PID:10344
- C:\Windows\System\JkqqAbc.exe
  C:\Windows\System\JkqqAbc.exe
  2⤵
  PID:10372
- C:\Windows\System\UaFFGmK.exe
  C:\Windows\System\UaFFGmK.exe
  2⤵
  PID:10408
- C:\Windows\System\HbbjkfK.exe
  C:\Windows\System\HbbjkfK.exe
  2⤵
  PID:10440
- C:\Windows\System\WuNjKpq.exe
  C:\Windows\System\WuNjKpq.exe
  2⤵
  PID:10468
- C:\Windows\System\OSGkgTe.exe
  C:\Windows\System\OSGkgTe.exe
  2⤵
  PID:10488
- C:\Windows\System\tJZOKHh.exe
  C:\Windows\System\tJZOKHh.exe
  2⤵
  PID:10516
- C:\Windows\System\rLWTsnm.exe
  C:\Windows\System\rLWTsnm.exe
  2⤵
  PID:10548
- C:\Windows\System\YrzxWPE.exe
  C:\Windows\System\YrzxWPE.exe
  2⤵
  PID:10584
- C:\Windows\System\bNdbUZr.exe
  C:\Windows\System\bNdbUZr.exe
  2⤵
  PID:10612
- C:\Windows\System\XeGIKEX.exe
  C:\Windows\System\XeGIKEX.exe
  2⤵
  PID:10640
- C:\Windows\System\bvCvrsV.exe
  C:\Windows\System\bvCvrsV.exe
  2⤵
  PID:10668
- C:\Windows\System\yaTaeXi.exe
  C:\Windows\System\yaTaeXi.exe
  2⤵
  PID:10696
- C:\Windows\System\sEFATsk.exe
  C:\Windows\System\sEFATsk.exe
  2⤵
  PID:10724
- C:\Windows\System\JpMcOiY.exe
  C:\Windows\System\JpMcOiY.exe
  2⤵
  PID:10752
- C:\Windows\System\NefOukV.exe
  C:\Windows\System\NefOukV.exe
  2⤵
  PID:10780
- C:\Windows\System\vMRbPOh.exe
  C:\Windows\System\vMRbPOh.exe
  2⤵
  PID:10808
- C:\Windows\System\VseGEej.exe
  C:\Windows\System\VseGEej.exe
  2⤵
  PID:10836
- C:\Windows\System\LAoijTx.exe
  C:\Windows\System\LAoijTx.exe
  2⤵
  PID:10860
- C:\Windows\System\WekvkNA.exe
  C:\Windows\System\WekvkNA.exe
  2⤵
  PID:10892
- C:\Windows\System\yBJyqoq.exe
  C:\Windows\System\yBJyqoq.exe
  2⤵
  PID:10924
- C:\Windows\System\bXEXyWd.exe
  C:\Windows\System\bXEXyWd.exe
  2⤵
  PID:10952
- C:\Windows\System\NywSSfr.exe
  C:\Windows\System\NywSSfr.exe
  2⤵
  PID:10980
- C:\Windows\System\GHkgqzk.exe
  C:\Windows\System\GHkgqzk.exe
  2⤵
  PID:11012
- C:\Windows\System\PDNuPOz.exe
  C:\Windows\System\PDNuPOz.exe
  2⤵
  PID:11044
- C:\Windows\System\UBiUbaP.exe
  C:\Windows\System\UBiUbaP.exe
  2⤵
  PID:11076
- C:\Windows\System\uDCWhmB.exe
  C:\Windows\System\uDCWhmB.exe
  2⤵
  PID:11104
- C:\Windows\System\VIiHNRR.exe
  C:\Windows\System\VIiHNRR.exe
  2⤵
  PID:11132
- C:\Windows\System\BIitYJt.exe
  C:\Windows\System\BIitYJt.exe
  2⤵
  PID:11160
- C:\Windows\System\HCeSZab.exe
  C:\Windows\System\HCeSZab.exe
  2⤵
  PID:11188
- C:\Windows\System\adqvyiY.exe
  C:\Windows\System\adqvyiY.exe
  2⤵
  PID:11216
- C:\Windows\System\lnIIKKc.exe
  C:\Windows\System\lnIIKKc.exe
  2⤵
  PID:11244
- C:\Windows\System\JfUgJxU.exe
  C:\Windows\System\JfUgJxU.exe
  2⤵
  PID:10268
- C:\Windows\System\NRCWCvW.exe
  C:\Windows\System\NRCWCvW.exe
  2⤵
  PID:10328
- C:\Windows\System\KjUdtVV.exe
  C:\Windows\System\KjUdtVV.exe
  2⤵
  PID:10400
- C:\Windows\System\gtdNbdi.exe
  C:\Windows\System\gtdNbdi.exe
  2⤵
  PID:10460
- C:\Windows\System\GLZRVXP.exe
  C:\Windows\System\GLZRVXP.exe
  2⤵
  PID:10580
- C:\Windows\System\GQYdYoZ.exe
  C:\Windows\System\GQYdYoZ.exe
  2⤵
  PID:10652
- C:\Windows\System\mnaamIw.exe
  C:\Windows\System\mnaamIw.exe
  2⤵
  PID:10720
- C:\Windows\System\CiNUObL.exe
  C:\Windows\System\CiNUObL.exe
  2⤵
  PID:10792
- C:\Windows\System\UTTkRDW.exe
  C:\Windows\System\UTTkRDW.exe
  2⤵
  PID:10856
- C:\Windows\System\hkfLwWB.exe
  C:\Windows\System\hkfLwWB.exe
  2⤵
  PID:10920
- C:\Windows\System\hupRfRN.exe
  C:\Windows\System\hupRfRN.exe
  2⤵
  PID:10992
- C:\Windows\System\KXXUoqp.exe
  C:\Windows\System\KXXUoqp.exe
  2⤵
  PID:11064
- C:\Windows\System\zHnbsvC.exe
  C:\Windows\System\zHnbsvC.exe
  2⤵
  PID:11128
- C:\Windows\System\zBsKVko.exe
  C:\Windows\System\zBsKVko.exe
  2⤵
  PID:11200
- C:\Windows\System\mDiROOl.exe
  C:\Windows\System\mDiROOl.exe
  2⤵
  PID:10020
- C:\Windows\System\KTYqYfD.exe
  C:\Windows\System\KTYqYfD.exe
  2⤵
  PID:10428
- C:\Windows\System\wteffJl.exe
  C:\Windows\System\wteffJl.exe
  2⤵
  PID:10636
- C:\Windows\System\OfipYKT.exe
  C:\Windows\System\OfipYKT.exe
  2⤵
  PID:10772
- C:\Windows\System\fyezTgU.exe
  C:\Windows\System\fyezTgU.exe
  2⤵
  PID:10948
- C:\Windows\System\DLWZZki.exe
  C:\Windows\System\DLWZZki.exe
  2⤵
  PID:11124
- C:\Windows\System\duKTURW.exe
  C:\Windows\System\duKTURW.exe
  2⤵
  PID:10244
- C:\Windows\System\kxEGTCZ.exe
  C:\Windows\System\kxEGTCZ.exe
  2⤵
  PID:10540
- C:\Windows\System\pfqZQtK.exe
  C:\Windows\System\pfqZQtK.exe
  2⤵
  PID:11056
- C:\Windows\System\KCCBhiq.exe
  C:\Windows\System\KCCBhiq.exe
  2⤵
  PID:10396
- C:\Windows\System\BISewdI.exe
  C:\Windows\System\BISewdI.exe
  2⤵
  PID:11256
- C:\Windows\System\DkFXcNP.exe
  C:\Windows\System\DkFXcNP.exe
  2⤵
  PID:11272
- C:\Windows\System\pLnNKJj.exe
  C:\Windows\System\pLnNKJj.exe
  2⤵
  PID:11300
- C:\Windows\System\HnNgymu.exe
  C:\Windows\System\HnNgymu.exe
  2⤵
  PID:11328
- C:\Windows\System\QZhFggC.exe
  C:\Windows\System\QZhFggC.exe
  2⤵
  PID:11356
- C:\Windows\System\UikOVMc.exe
  C:\Windows\System\UikOVMc.exe
  2⤵
  PID:11392
- C:\Windows\System\cNzbNDy.exe
  C:\Windows\System\cNzbNDy.exe
  2⤵
  PID:11432
- C:\Windows\System\cbEOZUw.exe
  C:\Windows\System\cbEOZUw.exe
  2⤵
  PID:11460
- C:\Windows\System\beTErSY.exe
  C:\Windows\System\beTErSY.exe
  2⤵
  PID:11512
- C:\Windows\System\KgGiyiJ.exe
  C:\Windows\System\KgGiyiJ.exe
  2⤵
  PID:11532
- C:\Windows\System\JiruQSQ.exe
  C:\Windows\System\JiruQSQ.exe
  2⤵
  PID:11560
- C:\Windows\System\nZDjpXL.exe
  C:\Windows\System\nZDjpXL.exe
  2⤵
  PID:11596
- C:\Windows\System\lczOPsH.exe
  C:\Windows\System\lczOPsH.exe
  2⤵
  PID:11624
- C:\Windows\System\NUNaJNQ.exe
  C:\Windows\System\NUNaJNQ.exe
  2⤵
  PID:11640
- C:\Windows\System\vtxrFnN.exe
  C:\Windows\System\vtxrFnN.exe
  2⤵
  PID:11668
- C:\Windows\System\kPfpbWI.exe
  C:\Windows\System\kPfpbWI.exe
  2⤵
  PID:11696
- C:\Windows\System\URruMek.exe
  C:\Windows\System\URruMek.exe
  2⤵
  PID:11720
- C:\Windows\System\LIJtxmz.exe
  C:\Windows\System\LIJtxmz.exe
  2⤵
  PID:11748
- C:\Windows\System\HZntsCO.exe
  C:\Windows\System\HZntsCO.exe
  2⤵
  PID:11772
- C:\Windows\System\EWVqWzX.exe
  C:\Windows\System\EWVqWzX.exe
  2⤵
  PID:11800
- C:\Windows\System\QyJkOzZ.exe
  C:\Windows\System\QyJkOzZ.exe
  2⤵
  PID:11836
- C:\Windows\System\kKtrmIu.exe
  C:\Windows\System\kKtrmIu.exe
  2⤵
  PID:11860
- C:\Windows\System\CEVawzj.exe
  C:\Windows\System\CEVawzj.exe
  2⤵
  PID:11884
- C:\Windows\System\ECkvWwF.exe
  C:\Windows\System\ECkvWwF.exe
  2⤵
  PID:11908
- C:\Windows\System\lnIvrEG.exe
  C:\Windows\System\lnIvrEG.exe
  2⤵
  PID:11948
- C:\Windows\System\SVBRGMT.exe
  C:\Windows\System\SVBRGMT.exe
  2⤵
  PID:11976
- C:\Windows\System\UiNDOnW.exe
  C:\Windows\System\UiNDOnW.exe
  2⤵
  PID:12000
- C:\Windows\System\wnydqmo.exe
  C:\Windows\System\wnydqmo.exe
  2⤵
  PID:12032
- C:\Windows\System\JpKxisS.exe
  C:\Windows\System\JpKxisS.exe
  2⤵
  PID:12060
- C:\Windows\System\VnBYaTi.exe
  C:\Windows\System\VnBYaTi.exe
  2⤵
  PID:12104
- C:\Windows\System\lhFwDPd.exe
  C:\Windows\System\lhFwDPd.exe
  2⤵
  PID:12136
- C:\Windows\System\EBEDOMW.exe
  C:\Windows\System\EBEDOMW.exe
  2⤵
  PID:12176
- C:\Windows\System\kKgfgln.exe
  C:\Windows\System\kKgfgln.exe
  2⤵
  PID:12204
- C:\Windows\System\UsRjQpt.exe
  C:\Windows\System\UsRjQpt.exe
  2⤵
  PID:12232
- C:\Windows\System\xLJKNbW.exe
  C:\Windows\System\xLJKNbW.exe
  2⤵
  PID:12248
- C:\Windows\System\azgBgfz.exe
  C:\Windows\System\azgBgfz.exe
  2⤵
  PID:12272
- C:\Windows\System\keYANeI.exe
  C:\Windows\System\keYANeI.exe
  2⤵
  PID:11292
- C:\Windows\System\pQLHaIl.exe
  C:\Windows\System\pQLHaIl.exe
  2⤵
  PID:10260
- C:\Windows\System\BWPFBrD.exe
  C:\Windows\System\BWPFBrD.exe
  2⤵
  PID:11368
- C:\Windows\System\xPabcEO.exe
  C:\Windows\System\xPabcEO.exe
  2⤵
  PID:11448
- C:\Windows\System\IgDNIxP.exe
  C:\Windows\System\IgDNIxP.exe
  2⤵
  PID:11556
- C:\Windows\System\otvBPyk.exe
  C:\Windows\System\otvBPyk.exe
  2⤵
  PID:11620
- C:\Windows\System\YspIhwk.exe
  C:\Windows\System\YspIhwk.exe
  2⤵
  PID:11708
- C:\Windows\System\PMTSexG.exe
  C:\Windows\System\PMTSexG.exe
  2⤵
  PID:11744
- C:\Windows\System\umHmrUR.exe
  C:\Windows\System\umHmrUR.exe
  2⤵
  PID:11820
- C:\Windows\System\EWxjNmi.exe
  C:\Windows\System\EWxjNmi.exe
  2⤵
  PID:11940
- C:\Windows\System\iDmlTXx.exe
  C:\Windows\System\iDmlTXx.exe
  2⤵
  PID:11920
- C:\Windows\System\mVjrVen.exe
  C:\Windows\System\mVjrVen.exe
  2⤵
  PID:12028
- C:\Windows\System\QituYYp.exe
  C:\Windows\System\QituYYp.exe
  2⤵
  PID:12072
- C:\Windows\System\iEXSONU.exe
  C:\Windows\System\iEXSONU.exe
  2⤵
  PID:12156
- C:\Windows\System\MtTiQcj.exe
  C:\Windows\System\MtTiQcj.exe
  2⤵
  PID:12240
- C:\Windows\System\dIOvmBg.exe
  C:\Windows\System\dIOvmBg.exe
  2⤵
  PID:11312
- C:\Windows\System\oeWlAzn.exe
  C:\Windows\System\oeWlAzn.exe
  2⤵
  PID:10072
- C:\Windows\System\dIoHpjC.exe
  C:\Windows\System\dIoHpjC.exe
  2⤵
  PID:11500
- C:\Windows\System\cjxAtVL.exe
  C:\Windows\System\cjxAtVL.exe
  2⤵
  PID:11648
- C:\Windows\System\WhoJyVY.exe
  C:\Windows\System\WhoJyVY.exe
  2⤵
  PID:11636
- C:\Windows\System\XqNrerQ.exe
  C:\Windows\System\XqNrerQ.exe
  2⤵
  PID:11796
- C:\Windows\System\dfKPNTp.exe
  C:\Windows\System\dfKPNTp.exe
  2⤵
  PID:12024
- C:\Windows\System\AKCODWq.exe
  C:\Windows\System\AKCODWq.exe
  2⤵
  PID:12132
- C:\Windows\System\NBCofrJ.exe
  C:\Windows\System\NBCofrJ.exe
  2⤵
  PID:12256
- C:\Windows\System\JbbMSXe.exe
  C:\Windows\System\JbbMSXe.exe
  2⤵
  PID:11444
- C:\Windows\System\sYKPKTL.exe
  C:\Windows\System\sYKPKTL.exe
  2⤵
  PID:11736
- C:\Windows\System\nwjCcBI.exe
  C:\Windows\System\nwjCcBI.exe
  2⤵
  PID:12056
- C:\Windows\System\vAnkFLS.exe
  C:\Windows\System\vAnkFLS.exe
  2⤵
  PID:11492
- C:\Windows\System\aQwotuA.exe
  C:\Windows\System\aQwotuA.exe
  2⤵
  PID:12264
- C:\Windows\System\ubXQlGp.exe
  C:\Windows\System\ubXQlGp.exe
  2⤵
  PID:12020
- C:\Windows\System\GObZufe.exe
  C:\Windows\System\GObZufe.exe
  2⤵
  PID:12316
- C:\Windows\System\BcTyInw.exe
  C:\Windows\System\BcTyInw.exe
  2⤵
  PID:12344
- C:\Windows\System\GHPkIGP.exe
  C:\Windows\System\GHPkIGP.exe
  2⤵
  PID:12372
- C:\Windows\System\vNdJvOD.exe
  C:\Windows\System\vNdJvOD.exe
  2⤵
  PID:12412
- C:\Windows\System\ieGCumF.exe
  C:\Windows\System\ieGCumF.exe
  2⤵
  PID:12428
- C:\Windows\System\wwmyyUS.exe
  C:\Windows\System\wwmyyUS.exe
  2⤵
  PID:12456
- C:\Windows\System\khqowFE.exe
  C:\Windows\System\khqowFE.exe
  2⤵
  PID:12484
- C:\Windows\System\XKfklFs.exe
  C:\Windows\System\XKfklFs.exe
  2⤵
  PID:12512
- C:\Windows\System\kVALTzj.exe
  C:\Windows\System\kVALTzj.exe
  2⤵
  PID:12540
- C:\Windows\System\GdkxFFe.exe
  C:\Windows\System\GdkxFFe.exe
  2⤵
  PID:12568
- C:\Windows\System\piRBeXw.exe
  C:\Windows\System\piRBeXw.exe
  2⤵
  PID:12596
- C:\Windows\System\eKsUdDC.exe
  C:\Windows\System\eKsUdDC.exe
  2⤵
  PID:12624
- C:\Windows\System\VbpaZBL.exe
  C:\Windows\System\VbpaZBL.exe
  2⤵
  PID:12652
- C:\Windows\System\AVuEufq.exe
  C:\Windows\System\AVuEufq.exe
  2⤵
  PID:12680
- C:\Windows\System\AQDxJoW.exe
  C:\Windows\System\AQDxJoW.exe
  2⤵
  PID:12708
- C:\Windows\System\EcvRTrV.exe
  C:\Windows\System\EcvRTrV.exe
  2⤵
  PID:12736
- C:\Windows\System\lfaTxNO.exe
  C:\Windows\System\lfaTxNO.exe
  2⤵
  PID:12764
- C:\Windows\System\YSlInVQ.exe
  C:\Windows\System\YSlInVQ.exe
  2⤵
  PID:12792
- C:\Windows\System\ERBuGQk.exe
  C:\Windows\System\ERBuGQk.exe
  2⤵
  PID:12820
- C:\Windows\System\bLJiAJk.exe
  C:\Windows\System\bLJiAJk.exe
  2⤵
  PID:12836
- C:\Windows\System\XwiPwrA.exe
  C:\Windows\System\XwiPwrA.exe
  2⤵
  PID:12856
- C:\Windows\System\MmYsWcS.exe
  C:\Windows\System\MmYsWcS.exe
  2⤵
  PID:12872
- C:\Windows\System\COfuJae.exe
  C:\Windows\System\COfuJae.exe
  2⤵
  PID:12888
- C:\Windows\System\XDNKWNJ.exe
  C:\Windows\System\XDNKWNJ.exe
  2⤵
  PID:12924
- C:\Windows\System\WmwsINk.exe
  C:\Windows\System\WmwsINk.exe
  2⤵
  PID:12960
- C:\Windows\System\uyJhcOy.exe
  C:\Windows\System\uyJhcOy.exe
  2⤵
  PID:13008
- C:\Windows\System\dUuMSAX.exe
  C:\Windows\System\dUuMSAX.exe
  2⤵
  PID:13060
- C:\Windows\System\NNxVFtq.exe
  C:\Windows\System\NNxVFtq.exe
  2⤵
  PID:13088
- C:\Windows\System\xZermOh.exe
  C:\Windows\System\xZermOh.exe
  2⤵
  PID:13104
- C:\Windows\System\ACLrOpc.exe
  C:\Windows\System\ACLrOpc.exe
  2⤵
  PID:13132
- C:\Windows\System\VPRtlTz.exe
  C:\Windows\System\VPRtlTz.exe
  2⤵
  PID:13160
- C:\Windows\System\fUVZire.exe
  C:\Windows\System\fUVZire.exe
  2⤵
  PID:13188
- C:\Windows\System\NmuWOCE.exe
  C:\Windows\System\NmuWOCE.exe
  2⤵
  PID:13216
- C:\Windows\System\erTiaMv.exe
  C:\Windows\System\erTiaMv.exe
  2⤵
  PID:13244
- C:\Windows\System\pMMDxUL.exe
  C:\Windows\System\pMMDxUL.exe
  2⤵
  PID:13272
- C:\Windows\System\phTTSQA.exe
  C:\Windows\System\phTTSQA.exe
  2⤵
  PID:13304
- C:\Windows\System\jnEVnHa.exe
  C:\Windows\System\jnEVnHa.exe
  2⤵
  PID:12336
- C:\Windows\System\COvdGXw.exe
  C:\Windows\System\COvdGXw.exe
  2⤵
  PID:4268
- C:\Windows\System\HZUBQvE.exe
  C:\Windows\System\HZUBQvE.exe
  2⤵
  PID:1984
- C:\Windows\System\jVcvVcE.exe
  C:\Windows\System\jVcvVcE.exe
  2⤵
  PID:4532
- C:\Windows\System\MZWPlPT.exe
  C:\Windows\System\MZWPlPT.exe
  2⤵
  PID:7412
- C:\Windows\System\WQOxCZo.exe
  C:\Windows\System\WQOxCZo.exe
  2⤵
  PID:12396
- C:\Windows\System\rRIvtaf.exe
  C:\Windows\System\rRIvtaf.exe
  2⤵
  PID:12468
- C:\Windows\System\kXxBqpe.exe
  C:\Windows\System\kXxBqpe.exe
  2⤵
  PID:12532
- C:\Windows\System\uDqYalk.exe
  C:\Windows\System\uDqYalk.exe
  2⤵
  PID:12592
- C:\Windows\System\pHUBrHf.exe
  C:\Windows\System\pHUBrHf.exe
  2⤵
  PID:12664
- C:\Windows\System\sSEaOEn.exe
  C:\Windows\System\sSEaOEn.exe
  2⤵
  PID:12728
- C:\Windows\System\lNCzOLZ.exe
  C:\Windows\System\lNCzOLZ.exe
  2⤵
  PID:12788
- C:\Windows\System\NCITmzt.exe
  C:\Windows\System\NCITmzt.exe
  2⤵
  PID:12828
- C:\Windows\System\bKqgGiK.exe
  C:\Windows\System\bKqgGiK.exe
  2⤵
  PID:12932
- C:\Windows\System\ftgPTlk.exe
  C:\Windows\System\ftgPTlk.exe
  2⤵
  PID:12976
- C:\Windows\System\sXDopjA.exe
  C:\Windows\System\sXDopjA.exe
  2⤵
  PID:13056
- C:\Windows\System\JAYSKWU.exe
  C:\Windows\System\JAYSKWU.exe
  2⤵
  PID:13116
- C:\Windows\System\XykAwsJ.exe
  C:\Windows\System\XykAwsJ.exe
  2⤵
  PID:13184
- C:\Windows\System\ikAQiVF.exe
  C:\Windows\System\ikAQiVF.exe
  2⤵
  PID:13240
- C:\Windows\System\YPmPjEh.exe
  C:\Windows\System\YPmPjEh.exe
  2⤵
  PID:12300
- C:\Windows\System\fUNxnag.exe
  C:\Windows\System\fUNxnag.exe
  2⤵
  PID:1560
- C:\Windows\System\vELduZO.exe
  C:\Windows\System\vELduZO.exe
  2⤵
  PID:6376
- C:\Windows\System\CcqFHCM.exe
  C:\Windows\System\CcqFHCM.exe
  2⤵
  PID:12496
- C:\Windows\System\qunMKZO.exe
  C:\Windows\System\qunMKZO.exe
  2⤵
  PID:12644
- C:\Windows\System\EbVsBzG.exe
  C:\Windows\System\EbVsBzG.exe
  2⤵
  PID:12868
- C:\Windows\System\WQcohZj.exe
  C:\Windows\System\WQcohZj.exe
  2⤵
  PID:12900
- C:\Windows\System\ngfrotf.exe
  C:\Windows\System\ngfrotf.exe
  2⤵
  PID:13096
- C:\Windows\System\FLJekdx.exe
  C:\Windows\System\FLJekdx.exe
  2⤵
  PID:13236
- C:\Windows\System\xpdlHeW.exe
  C:\Windows\System\xpdlHeW.exe
  2⤵
  PID:2424
- C:\Windows\System\rHSNMMu.exe
  C:\Windows\System\rHSNMMu.exe
  2⤵
  PID:12588
- C:\Windows\System\NpdvYlo.exe
  C:\Windows\System\NpdvYlo.exe
  2⤵
  PID:12920
- C:\Windows\System\vXAjFEW.exe
  C:\Windows\System\vXAjFEW.exe
  2⤵
  PID:13296
- C:\Windows\System\AUFzkDa.exe
  C:\Windows\System\AUFzkDa.exe
  2⤵
  PID:2272
- C:\Windows\System\fJaDNFY.exe
  C:\Windows\System\fJaDNFY.exe
  2⤵
  PID:2248
- C:\Windows\System\BBPuXLT.exe
  C:\Windows\System\BBPuXLT.exe
  2⤵
  PID:12756
- C:\Windows\System\PBwtmqd.exe
  C:\Windows\System\PBwtmqd.exe
  2⤵
  PID:12408
- C:\Windows\System\BnXwElz.exe
  C:\Windows\System\BnXwElz.exe
  2⤵
  PID:13328
- C:\Windows\System\QBJCKOI.exe
  C:\Windows\System\QBJCKOI.exe
  2⤵
  PID:13356
- C:\Windows\System\gWhoWlH.exe
  C:\Windows\System\gWhoWlH.exe
  2⤵
  PID:13384
- C:\Windows\System\RaICSHC.exe
  C:\Windows\System\RaICSHC.exe
  2⤵
  PID:13400
- C:\Windows\System\CCOPnbY.exe
  C:\Windows\System\CCOPnbY.exe
  2⤵
  PID:13428
- C:\Windows\System\xvMDMMQ.exe
  C:\Windows\System\xvMDMMQ.exe
  2⤵
  PID:13456
- C:\Windows\System\AIsKHGw.exe
  C:\Windows\System\AIsKHGw.exe
  2⤵
  PID:13496
- C:\Windows\System\LWNjMyd.exe
  C:\Windows\System\LWNjMyd.exe
  2⤵
  PID:13524
- C:\Windows\System\Mkssuuq.exe
  C:\Windows\System\Mkssuuq.exe
  2⤵
  PID:13552
- C:\Windows\System\wOxEFKT.exe
  C:\Windows\System\wOxEFKT.exe
  2⤵
  PID:13580
- C:\Windows\System\qDYMNys.exe
  C:\Windows\System\qDYMNys.exe
  2⤵
  PID:13608
- C:\Windows\System\jQToywS.exe
  C:\Windows\System\jQToywS.exe
  2⤵
  PID:13636
- C:\Windows\System\QSLFdKs.exe
  C:\Windows\System\QSLFdKs.exe
  2⤵
  PID:13664
- C:\Windows\System\uZnNiOM.exe
  C:\Windows\System\uZnNiOM.exe
  2⤵
  PID:13692
- C:\Windows\System\rTCPFLY.exe
  C:\Windows\System\rTCPFLY.exe
  2⤵
  PID:13720
- C:\Windows\System\zHpFAVT.exe
  C:\Windows\System\zHpFAVT.exe
  2⤵
  PID:13748
- C:\Windows\System\WePZWfP.exe
  C:\Windows\System\WePZWfP.exe
  2⤵
  PID:13776
- C:\Windows\System\wONvxqe.exe
  C:\Windows\System\wONvxqe.exe
  2⤵
  PID:13804
- C:\Windows\System\bipLBZF.exe
  C:\Windows\System\bipLBZF.exe
  2⤵
  PID:13832
- C:\Windows\System\GmrWAYs.exe
  C:\Windows\System\GmrWAYs.exe
  2⤵
  PID:13860
- C:\Windows\System\wyspOYv.exe
  C:\Windows\System\wyspOYv.exe
  2⤵
  PID:13888
- C:\Windows\System\ZadftMn.exe
  C:\Windows\System\ZadftMn.exe
  2⤵
  PID:13916
- C:\Windows\System\mEGetsN.exe
  C:\Windows\System\mEGetsN.exe
  2⤵
  PID:13944
- C:\Windows\System\lcxUaIF.exe
  C:\Windows\System\lcxUaIF.exe
  2⤵
  PID:13972
- C:\Windows\System\TQNfmBO.exe
  C:\Windows\System\TQNfmBO.exe
  2⤵
  PID:14000
- C:\Windows\System\OMWYxoN.exe
  C:\Windows\System\OMWYxoN.exe
  2⤵
  PID:14028
- C:\Windows\System\bZHuRDf.exe
  C:\Windows\System\bZHuRDf.exe
  2⤵
  PID:14056
- C:\Windows\System\CthkKtM.exe
  C:\Windows\System\CthkKtM.exe
  2⤵
  PID:14084
- C:\Windows\System\kCOnGiu.exe
  C:\Windows\System\kCOnGiu.exe
  2⤵
  PID:14112
- C:\Windows\System\qNuIrba.exe
  C:\Windows\System\qNuIrba.exe
  2⤵
  PID:14140
- C:\Windows\System\WEoaapM.exe
  C:\Windows\System\WEoaapM.exe
  2⤵
  PID:14168
- C:\Windows\System\ZXdaRVH.exe
  C:\Windows\System\ZXdaRVH.exe
  2⤵
  PID:14196
- C:\Windows\System\hkUjZED.exe
  C:\Windows\System\hkUjZED.exe
  2⤵
  PID:14224
- C:\Windows\System\FhmbEYy.exe
  C:\Windows\System\FhmbEYy.exe
  2⤵
  PID:14264
- C:\Windows\System\vjXVmWJ.exe
  C:\Windows\System\vjXVmWJ.exe
  2⤵
  PID:14304
- C:\Windows\System\xDDniOw.exe
  C:\Windows\System\xDDniOw.exe
  2⤵
  PID:13320
- C:\Windows\System\hQfIrKf.exe
  C:\Windows\System\hQfIrKf.exe
  2⤵
  PID:13412
- C:\Windows\System\oETYKJc.exe
  C:\Windows\System\oETYKJc.exe
  2⤵
  PID:13480
- C:\Windows\System\kergJas.exe
  C:\Windows\System\kergJas.exe
  2⤵
  PID:13576
- C:\Windows\System\JrPKPwB.exe
  C:\Windows\System\JrPKPwB.exe
  2⤵
  PID:13632
- C:\Windows\System\fPTJiAb.exe
  C:\Windows\System\fPTJiAb.exe
  2⤵
  PID:13704
- C:\Windows\System\caqvTTy.exe
  C:\Windows\System\caqvTTy.exe
  2⤵
  PID:13760
- C:\Windows\System\ESYCyfq.exe
  C:\Windows\System\ESYCyfq.exe
  2⤵
  PID:13900
- C:\Windows\System\xBYExQv.exe
  C:\Windows\System\xBYExQv.exe
  2⤵
  PID:13968
- C:\Windows\System\VegaYLT.exe
  C:\Windows\System\VegaYLT.exe
  2⤵
  PID:14052
- C:\Windows\System\lSKPhBT.exe
  C:\Windows\System\lSKPhBT.exe
  2⤵
  PID:14124
- C:\Windows\System\lXQANeU.exe
  C:\Windows\System\lXQANeU.exe
  2⤵
  PID:14208
- C:\Windows\System\ClfNjIr.exe
  C:\Windows\System\ClfNjIr.exe
  2⤵
  PID:14300
- C:\Windows\System\URGUDjX.exe
  C:\Windows\System\URGUDjX.exe
  2⤵
  PID:13468
- C:\Windows\System\gQdkYVu.exe
  C:\Windows\System\gQdkYVu.exe
  2⤵
  PID:13628
- C:\Windows\System\UMIDsey.exe
  C:\Windows\System\UMIDsey.exe
  2⤵
  PID:13688
- C:\Windows\System\euvClda.exe
  C:\Windows\System\euvClda.exe
  2⤵
  PID:13852
- C:\Windows\System\BffZRFG.exe
  C:\Windows\System\BffZRFG.exe
  2⤵
  PID:14020
- C:\Windows\System\Kkakgcg.exe
  C:\Windows\System\Kkakgcg.exe
  2⤵
  PID:14096
- C:\Windows\System\brOhUcA.exe
  C:\Windows\System\brOhUcA.exe
  2⤵
  PID:14192
- C:\Windows\System\zoTnpkT.exe
  C:\Windows\System\zoTnpkT.exe
  2⤵
  PID:13620
- C:\Windows\System\iSamCnT.exe
  C:\Windows\System\iSamCnT.exe
  2⤵
  PID:14080
- C:\Windows\System\FCizWXu.exe
  C:\Windows\System\FCizWXu.exe
  2⤵
  PID:14352
- C:\Windows\System\eBlSIke.exe
  C:\Windows\System\eBlSIke.exe
  2⤵
  PID:14384
- C:\Windows\System\mFmefTq.exe
  C:\Windows\System\mFmefTq.exe
  2⤵
  PID:14416
- C:\Windows\System\xLdSUny.exe
  C:\Windows\System\xLdSUny.exe
  2⤵
  PID:14452
- C:\Windows\System\nhMgtAb.exe
  C:\Windows\System\nhMgtAb.exe
  2⤵
  PID:14476
- C:\Windows\System\CPYncFE.exe
  C:\Windows\System\CPYncFE.exe
  2⤵
  PID:14504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AYtmVgP.exe

Filesize
2.2MB

MD5
b584907423d77cd48c9a4dfb5b718c1d

SHA1
308a01aeac4ab90ee8b161ae3b0d7e66c9647cb0

SHA256
62483f1a3a09d85248704f2acb86ec6316843ddd052b0f16d7b7b6607bb06aa0

SHA512
3081528d43868c23984253c8808720d07e4b4b61b94d474037a82ccf1ec30ca68621875625acb9bbdc317b54ef173de1f5043ba5ca39ee7d62522661c3ef6ccf

Download Submit
C:\Windows\System\BNMhcKq.exe

Filesize
2.2MB

MD5
980d0dd23eed016dd518ed21256cb671

SHA1
5b02fe7c0c7eb637276aa82de5b9bb23cf774cbb

SHA256
216a53b73271cda30ed2ff937168a429570c09594a2fe17c56ec38c44c6fd5c1

SHA512
0550dc8a9f5b830279ca2955f8f285f8b1f3ffe215f6f6a48933b17dac3a5110c3cef8cc60a140724537a591b92fa045503b90042cdd3484d0e04e0735adcb2b

Download Submit
C:\Windows\System\FznWNWl.exe

Filesize
2.2MB

MD5
f8939e988923d05b00697b69cf3c15d6

SHA1
2e7ed0fad5f967c61cfc1b2ef8c931d0cdf77d66

SHA256
f4f82a18e5eea8d31bc98bc1dc41790c4aba0a5fcddc72fecf40bdcb313724bc

SHA512
54ac92fd219512d70fae5846b8a57b61ca43d95b367093dd4060d68529ca56a863aee1c558c2085e0685e771a7aa9c7663d280fdd1336f4718771d8451e93068

Download Submit
C:\Windows\System\LSjEudi.exe

Filesize
2.2MB

MD5
38e629f7137118dbae7fadf86b72a930

SHA1
affe36d961ec93bdbd435915418c38b875d01034

SHA256
488543ca3f33a36b4c49298f1f9204c325e695df45edaef3cc1f8f83cbf3eb6c

SHA512
7b2602e6bc217da37b6f34b989f7f7ca9435100895b54dba44e04c9485d7127782057654a5b29c4079fff8d2a058440fac3febe26fcd8bff0bbf05e31b994be0

Download Submit
C:\Windows\System\MZUxoEM.exe

Filesize
2.2MB

MD5
9e86b7e696228a9110d3d2aee89c8635

SHA1
1aeee4eb88b5fef369c6d9df669a172be1efcc94

SHA256
b5f5aaf5f80fa468696fe40e18918ffef266cb211dbbacc6e5deaa6e8b03037d

SHA512
c0baf048000970e1ea04d3192a66641634d5658ac84881bf1c4fbac4fe9d614e3fdaa720364b091caa3041a5f2b1096d5ff194e7400605b1fa835422c5ce1d8d

Download Submit
C:\Windows\System\OePNcoB.exe

Filesize
2.2MB

MD5
15647ccc4eca23288b6bb628da4fd339

SHA1
ba523b49a4d4cffa2f2228ec060561fc1eca2bcd

SHA256
2db67a9a5a69176aeef00d2fd6a70d89d5f6e6cd15f8f2266e33bef2b8a56fa9

SHA512
de56ecf099ab8a62dc966694399ca83eacf14f634df1cdb527b889bd7a0a965f3616fbdd606edf9641ea6ac55ba8f734956ff5a4acf9012445a63d6f04e58773

Download Submit
C:\Windows\System\VyEHUgN.exe

Filesize
2.2MB

MD5
1fb83b9a8dc2e380bf0f5f730da3915e

SHA1
b4830b2103eb5663218824fd12ce36df557ad962

SHA256
410e5eacc4ec267cce8fc0619d3ebfcb60d4904624feec4ce67afb0fd6fd1966

SHA512
e7c35dc1a725b9277648f40158ab34d521ac056a2d57cffe858fe340c6bb7a3472abdd87398c989c26c482c4c6ef194181f7ed8720535bb85aad16d45997060a

Download Submit
C:\Windows\System\XesHyeL.exe

Filesize
2.2MB

MD5
e745367b65e52821d3a0a8e685fe75cf

SHA1
eca266c097e661c9cc9f044bea3dadabbfc940b7

SHA256
0c0a4edfb41b7574ed659b874c15ed0140faac5e0d2009790de065f9669675f9

SHA512
a2f84d416244cd0ea80c6981453190e692f4f9782164145564d5a4bc7a76df5993a0707e8061d35dc26ba4cf6843ac03b397a06265d2c6e41e022d9520744a82

Download Submit
C:\Windows\System\YGfmrOr.exe

Filesize
2.2MB

MD5
4d97b6a4f555f69c3da362c0e840c4ba

SHA1
627682adc19f83defb1bb1d1610d6ce037166eb2

SHA256
285dca09faceb0a24d0d1a09e07b63d8263e3d286468be92bbf8104f9cfe1bc5

SHA512
90ed97f485d276e3c4beca818fb65fdd031bc9944530ff381f1b389db93b80f3391c8111e72d669c8f89e283c3b9d8618eea7c563626b90f964fb14a77a88561

Download Submit
C:\Windows\System\YIfOsvA.exe

Filesize
2.2MB

MD5
a5189d5a62a2f428590a42ecb8930fa3

SHA1
14e9d540c5c5fdbf8e373b7c8ae2b85059e4ec4e

SHA256
2da2e1136d815a2fe459c716b9f14348803d16ee99fa3de52e55e3a29d9d2ef9

SHA512
3b70205660a5eee96f7708d766bd2a624762be619cfcdf075fb785fab0053768a2fcdc42603afa6540e6cd57c682f34b1afb2e5fdb110c977489731ae74c1d36

Download Submit
C:\Windows\System\Yierefq.exe

Filesize
2.2MB

MD5
cd258830aefa011fb91424feff23823b

SHA1
cd49820e474fa377bb7cbb594d4e9d5ab531d9e0

SHA256
785d48694ec8f8adb1b3f27af1df9aac18c24d12efe6fddf6f36c85508343152

SHA512
b7299d3599c244883fa0381f6d185d3ce308e1d3a44a724a03252d5cf37285fb17b0dc2094f2f52fb26704b4115929f1617dff5dd7c52f45a34b2213687dbc8e

Download Submit
C:\Windows\System\ZCAfHNW.exe

Filesize
2.2MB

MD5
7d8e2001c2f5f3636e628443019f6791

SHA1
03be4e03edf5f7aa33c471123135b5e36b8a6d98

SHA256
de7a6c8872aa35bd8adb2acf190d4a31e4aeed4a3f3194ebaf80a1efb73545d6

SHA512
04c4d71969ed15e19c0304cc49df69738a308c7c25b361ce1677b28951cb82263ad705487f13ab9a2b77c5527f8db5c296ca46e240538e12cc13b0cf2eb95b24

Download Submit
C:\Windows\System\ZCTvtwU.exe

Filesize
2.2MB

MD5
8593890f57e3001f050d65ff6422c1f0

SHA1
b153082fb6b8c6dbceb63516ebb1de1e6ed42180

SHA256
4958a2e72edeab1adc2228ed44ee40e19a91423a1d06723f795b3837b20601a2

SHA512
daaa5b5e124d9e1f467b42b8f4e3410d2a79266aa2b489d05e4eefcfa42227a389d7f7612cc183687688aa61ebf4beeee655d3b25a71f3e8bab85ff8f993e311

Download Submit
C:\Windows\System\bGtvKpS.exe

Filesize
2.2MB

MD5
bce0151ecb27d6fc42b46afa506ffa7a

SHA1
eb1ce300d89516fb35b7792f157eb6ea1d30a733

SHA256
7a78197be1b4dd242ddf240fb8e364d053ae77c4cd8fdbd6dd356371caaba03c

SHA512
38454ec1c64d146fb1b90df5e662a5cdc31762a70405b67579b3e0ee14a1e7139f05762ddb4522e9e73e4455bfb79f35e111a9a1e9174b678fd85fc7e0e1f320

Download Submit
C:\Windows\System\bWJvPby.exe

Filesize
2.2MB

MD5
250bed2c7c3f71952a6ed51535934b17

SHA1
dc961c9c9cb9781245a68e3b3338e90d09bf682c

SHA256
fbdfa7d2bc1a86951cd4301aa7abbb12fe50ed5db131eb742cc41583268716e3

SHA512
f5ad3d260c8bd3f9c497a973b8e85305b4b3589a0a624115835ca53bacb40b07df0909e60c4b71cf273b6299663897b1caeb58e947309a345d4da27db2a33c1d

Download Submit
C:\Windows\System\dCzArJP.exe

Filesize
2.2MB

MD5
d191ac5b6e8514692452683bb1a0418c

SHA1
5f11489d127930249388d03352270c2bec31a276

SHA256
d49ef4d84c82afdbc5e6a6be015ed0fd54d3d6e010095f451f4f64e5ae5949ba

SHA512
b76be2e5d8f6ca1a683e8625d887468063ffb237cf0b1e4382ed9dbbcc1ebb72632168a34fbd7a2927d661521c375672bf68469000601c9b6a946976c010910e

Download Submit
C:\Windows\System\eSVNcHY.exe

Filesize
2.2MB

MD5
7067291c71b4821d275371e5f951a5fa

SHA1
581cc33417a69a82d7d7f7906ff22f902d624b79

SHA256
25978db115791165e2249212e831f98be42e5daa92e49a389dc169969512ed20

SHA512
8fcb6766f311fe86754ece6a1ff62f7c99dce4e53f06f59f692a0f58dad025d7abbf09a8418377122589745202301492e2b1b87998585cf94ed0a68a99828ca3

Download Submit
C:\Windows\System\fOEubpR.exe

Filesize
2.2MB

MD5
724cab111695a5cde4e1c4335dc9b953

SHA1
9940745bb15b08d8e171157a8ea6bedd4bcfd93e

SHA256
12f19f6ebd643744faabb9fd8c61c6d8d0b8c39c7d3397e61fe9977fc6308d7c

SHA512
d5283bb275c8df9cce913e20a1f9403952f0d301362fe68b0b1429828dc5425eeb70fece1ae1195ad5c9063dacff4830b8688cc45757fc315d5712f5b2f32c80

Download Submit
C:\Windows\System\fguJiEu.exe

Filesize
2.2MB

MD5
1fcf987b938d5a6ae7bbce71525709b3

SHA1
81f38ebc1078c6917bccd4307eb6d5cf6dc4e4f6

SHA256
4b53597f4b3bf0ab1d49e57a85611154174c4a3fa716b4be72f9af755a90c7c5

SHA512
3b09d01c570ae3e9c7efaa16d20d744b47672c6e5309b37935ea6b2ca5698465a3bac9d5bb0ab0b6ced1354192883c5712896d4b107cd66485510f034cf388ea

Download Submit
C:\Windows\System\hBsRPtC.exe

Filesize
2.2MB

MD5
96a9a125cf4f20eca63f9d787248bde8

SHA1
eb667519baeee5d69066f675a8492f287fc16827

SHA256
61d5c973728db18f5f42044898bef5722eb21db4022f65e8ce24bf25f1dd63f4

SHA512
1004217996fa86c7e8ea92962c31e5b41ae3ba4e42441aad43f6394a2bdca8f1b5666e301fa8ea4e76cd708cb4ce81497775e825b5e7fd3dbb3f5018ab3fc0dd

Download Submit
C:\Windows\System\hhaEkxN.exe

Filesize
2.2MB

MD5
c52f511e38a5d28f1fbf01c4d7a20d4e

SHA1
6d6d09400392e3da0ed09640c0ea33c487ce647d

SHA256
7fd67c2ca66eb6f20db2794d9c6b2ec9f402d2442243e48e7e929f2618fd4496

SHA512
0e3b1e0ef66e6dc7cec255276b16858c08bcb79f39068ccb0acdb0b10a772966dd7c666902ba80099db507d0e5cb734d404fc228db805807b8edbc0d35972175

Download Submit
C:\Windows\System\jgZZABi.exe

Filesize
2.2MB

MD5
be5f5366a6821c1ff9023c8d7e922fd8

SHA1
438ba631770d07b7afbe73e1f01aff1d0e4e4407

SHA256
277929240e9ff5a68964acb9b4cd6411fd034fe40fb008ac65f3325b7bc0c182

SHA512
6d68bcd73eea035ca59389c2d74f21a64dc2e0972a5a43d0bc3800c7d5b0a71645b9dd0fc6581c30dc33ee4dfefd7135ee1d86bfff8e88ca8d6c77a72bf2347f

Download Submit
C:\Windows\System\opCOrRg.exe

Filesize
2.2MB

MD5
0b5ff8b605503bf5b9211d703dad5225

SHA1
5ceab5b9f7ddcedd57217d2a7592a2fafdc45b2d

SHA256
59fed35bb07397ee9c3163793fb53db91e4cbd5b4b391fa94e77845f8f7c9fe9

SHA512
115cd34f98f79aac75ce997c432df3a0564506274ae24b2850c058aa3f47ecc05ad7d4f4b5be981c2cc3ae8f16bea4078f128c35d06688cd07cc80f5fff3982d

Download Submit
C:\Windows\System\qsuuhHO.exe

Filesize
2.2MB

MD5
12f053fbc8e586d8867b117aa7692c77

SHA1
6203d19a9880492af9ee34fa8c2e4051bf59d98c

SHA256
a1c4fd8ee3ab1a35f3f9e24618a4b083dc515f9dacfc16a848b9c795f6c5de5d

SHA512
e8dbae6be1cbc51a1020d3705701197a28a71b67a976e56da4b6a78b1d2a7b719b58c326108c3e76cfd37efd29e4e8b941567b72e755bfd2ab82e0993121e690

Download Submit
C:\Windows\System\qvZQOvh.exe

Filesize
2.2MB

MD5
14ed3d91cd8a7dc8cf3c114c13cecfcb

SHA1
fe2f0e95a329751442df260f56c1dbbf648b9d9b

SHA256
ec92f924ba69b2e7a7dfada96ea26fda94b84c7e893b0261a0e1c80484c7dfc4

SHA512
6bd43e32f18bc095ce985a144b3233b7d5da91ea889b8d51cf524cd3d763013737fcf90ca5a8fccec39cc79c63b71eaf804468918250b76029cd331bdcd3f427

Download Submit
C:\Windows\System\uZVbxJj.exe

Filesize
2.2MB

MD5
3cd46516cffb77b1c5985efe03e61b6a

SHA1
4f314e4b00d56f00a9e23597a1437651d48cbee6

SHA256
51dc9bce396a090ad1f12faa7b59ca6f25f9a52e87334edba5a8a9c39e54e977

SHA512
c88ef7976bfd45eb9f62d0f6e1981115f56aca43972c7b7a22f56d8fd4d0e7cdec68e4d18f2a1d08197d6e1c74dded86264afe71b8f2381e472b035e39f53582

Download Submit
C:\Windows\System\vpThEnZ.exe

Filesize
2.2MB

MD5
3c21e8ccb08d1f13e478471d56ddd0a5

SHA1
30cd606b691ab42f38a18bc91573c8050bf7b05b

SHA256
1c5771cf1a05629124441ccd5525e82c4616bcea3c2c0951da876e68deb33d2b

SHA512
3f4258f0267dfd1316ec407e6c16e97a880ec65fa5ba15a56cb3c759c61ea15f517a6a5c3224328d2cda842f5d32bb7e3ec257eb2b1ada3a39b5790c75b0bb26

Download Submit
C:\Windows\System\wsrOvpp.exe

Filesize
2.2MB

MD5
0fa663ceda2c50a4eaa69ce11a341102

SHA1
7bf7735a9729e1121e4bf40a0ad655657c85acb8

SHA256
096c781a5f0f275f9fc181470c2c712a79d9985bdb684d4687e9b85806e442cf

SHA512
c2cb5bb5d0dfc5ac3540c5972228707b438e34082574afee49438c7b32066e9694d3b3c5444d565e1cd24133093ae41b22e9c49c1d15a97cf6a5ad52fcf6edee

Download Submit
C:\Windows\System\yMtnTlC.exe

Filesize
2.2MB

MD5
5f1eb678cd6280ce8d1e76b4d9d76cec

SHA1
5e14582b55c08dcefd4a110e411c9476ba4a61b7

SHA256
59f3b167233c5f1eec485170887acf4959dc1c2154ec9ac8d8cac92dc9be013e

SHA512
fae0b110bf4988e9982d811a0c038de93454476d28f75852ef3010a964b2a43d056d0fcdec1f5c507759826b639f2d9989b3340a3f8661eed68bca33fc46012e

Download Submit
C:\Windows\System\yZbOaGa.exe

Filesize
2.2MB

MD5
3b72f33023c4957806d2306b0be05266

SHA1
0146967a280b175723ed1d4e64529bc5d97d5b4b

SHA256
6c28abeb0ca2050edd3c376e03d66e0cd9e825eb7a4a120656482008604346e1

SHA512
4f9c7c325dda2309dc21e94a5e04721380224edaa0339895768658861b3a1c9eb85dbd12dfa35631ab8161af95d407c7309b4c91800245bb0f824a86c6afb179

Download Submit
C:\Windows\System\zBDCyvG.exe

Filesize
2.2MB

MD5
3acc3c44f7e077722647eead5e739d06

SHA1
51a592e0299b8e42eec274978c24c1a2db9632d4

SHA256
01a115637617ba626d1ac0f3e85c39ca78b81f51c8c825e43abd3318de706ed4

SHA512
a6afa3dda700086c4c3ed06de00e1cf6aae193895dc7ba0bf05a910d344f27b6d4d39d5a99074c2c5c061304b7f9d344355b568556f1111073d5f0fdc08f375e

Download Submit
C:\Windows\System\zixYYyb.exe

Filesize
2.2MB

MD5
f53172a09236b09d6e0ba558be9341eb

SHA1
1e0870ed5f7db928e6cbcf9a3f0f5703c664bfc1

SHA256
f6876f1a39a3465245bae4cc694134213b6c684e466f3a5a48b7add644214e3e

SHA512
ef9d71a980ca782371d4a492ef48d2c67448b3feba7544195a532a7bcf2a838b68fc0155a7cdfa73116ec887f99a07767617b2ea5fa1870c8879dd2943181a8e

Download Submit
memory/392-170-0x00007FF685A60000-0x00007FF685DB4000-memory.dmp

Filesize
3.3MB

Download
memory/392-2121-0x00007FF685A60000-0x00007FF685DB4000-memory.dmp

Filesize
3.3MB

Download
memory/532-42-0x00007FF655790000-0x00007FF655AE4000-memory.dmp

Filesize
3.3MB

Download
memory/532-2090-0x00007FF655790000-0x00007FF655AE4000-memory.dmp

Filesize
3.3MB

Download
memory/532-2104-0x00007FF655790000-0x00007FF655AE4000-memory.dmp

Filesize
3.3MB

Download
memory/1100-159-0x00007FF705280000-0x00007FF7055D4000-memory.dmp

Filesize
3.3MB

Download
memory/1100-2124-0x00007FF705280000-0x00007FF7055D4000-memory.dmp

Filesize
3.3MB

Download
memory/1132-2099-0x00007FF6FA720000-0x00007FF6FAA74000-memory.dmp

Filesize
3.3MB

Download
memory/1132-19-0x00007FF6FA720000-0x00007FF6FAA74000-memory.dmp

Filesize
3.3MB

Download
memory/1268-2117-0x00007FF619790000-0x00007FF619AE4000-memory.dmp

Filesize
3.3MB

Download
memory/1268-137-0x00007FF619790000-0x00007FF619AE4000-memory.dmp

Filesize
3.3MB

Download
memory/1352-178-0x00007FF6CAC40000-0x00007FF6CAF94000-memory.dmp

Filesize
3.3MB

Download
memory/1352-2118-0x00007FF6CAC40000-0x00007FF6CAF94000-memory.dmp

Filesize
3.3MB

Download
memory/1360-174-0x00007FF678300000-0x00007FF678654000-memory.dmp

Filesize
3.3MB

Download
memory/1360-2106-0x00007FF678300000-0x00007FF678654000-memory.dmp

Filesize
3.3MB

Download
memory/1456-95-0x00007FF7D56F0000-0x00007FF7D5A44000-memory.dmp

Filesize
3.3MB

Download
memory/1456-2114-0x00007FF7D56F0000-0x00007FF7D5A44000-memory.dmp

Filesize
3.3MB

Download
memory/1456-2094-0x00007FF7D56F0000-0x00007FF7D5A44000-memory.dmp

Filesize
3.3MB

Download
memory/1752-2088-0x00007FF635100000-0x00007FF635454000-memory.dmp

Filesize
3.3MB

Download
memory/1752-2098-0x00007FF635100000-0x00007FF635454000-memory.dmp

Filesize
3.3MB

Download
memory/1752-10-0x00007FF635100000-0x00007FF635454000-memory.dmp

Filesize
3.3MB

Download
memory/2160-2112-0x00007FF7B6150000-0x00007FF7B64A4000-memory.dmp

Filesize
3.3MB

Download
memory/2160-177-0x00007FF7B6150000-0x00007FF7B64A4000-memory.dmp

Filesize
3.3MB

Download
memory/2184-2100-0x00007FF77F8B0000-0x00007FF77FC04000-memory.dmp

Filesize
3.3MB

Download
memory/2184-25-0x00007FF77F8B0000-0x00007FF77FC04000-memory.dmp

Filesize
3.3MB

Download
memory/2352-180-0x00007FF6443A0000-0x00007FF6446F4000-memory.dmp

Filesize
3.3MB

Download
memory/2352-2123-0x00007FF6443A0000-0x00007FF6446F4000-memory.dmp

Filesize
3.3MB

Download
memory/2452-2103-0x00007FF6F2970000-0x00007FF6F2CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2452-51-0x00007FF6F2970000-0x00007FF6F2CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2452-2091-0x00007FF6F2970000-0x00007FF6F2CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2868-2105-0x00007FF61DEE0000-0x00007FF61E234000-memory.dmp

Filesize
3.3MB

Download
memory/2868-63-0x00007FF61DEE0000-0x00007FF61E234000-memory.dmp

Filesize
3.3MB

Download
memory/2868-2092-0x00007FF61DEE0000-0x00007FF61E234000-memory.dmp

Filesize
3.3MB

Download
memory/2932-127-0x00007FF6FD3A0000-0x00007FF6FD6F4000-memory.dmp

Filesize
3.3MB

Download
memory/2932-2116-0x00007FF6FD3A0000-0x00007FF6FD6F4000-memory.dmp

Filesize
3.3MB

Download
memory/2984-158-0x00007FF6B7220000-0x00007FF6B7574000-memory.dmp

Filesize
3.3MB

Download
memory/2984-2119-0x00007FF6B7220000-0x00007FF6B7574000-memory.dmp

Filesize
3.3MB

Download
memory/3064-2110-0x00007FF632CB0000-0x00007FF633004000-memory.dmp

Filesize
3.3MB

Download
memory/3064-120-0x00007FF632CB0000-0x00007FF633004000-memory.dmp

Filesize
3.3MB

Download
memory/3320-181-0x00007FF66EAA0000-0x00007FF66EDF4000-memory.dmp

Filesize
3.3MB

Download
memory/3320-2125-0x00007FF66EAA0000-0x00007FF66EDF4000-memory.dmp

Filesize
3.3MB

Download
memory/3728-2126-0x00007FF7434C0000-0x00007FF743814000-memory.dmp

Filesize
3.3MB

Download
memory/3728-2096-0x00007FF7434C0000-0x00007FF743814000-memory.dmp

Filesize
3.3MB

Download
memory/3728-152-0x00007FF7434C0000-0x00007FF743814000-memory.dmp

Filesize
3.3MB

Download
memory/3916-2095-0x00007FF672E50000-0x00007FF6731A4000-memory.dmp

Filesize
3.3MB

Download
memory/3916-2120-0x00007FF672E50000-0x00007FF6731A4000-memory.dmp

Filesize
3.3MB

Download
memory/3916-114-0x00007FF672E50000-0x00007FF6731A4000-memory.dmp

Filesize
3.3MB

Download
memory/4000-175-0x00007FF6BB6A0000-0x00007FF6BB9F4000-memory.dmp

Filesize
3.3MB

Download
memory/4000-2109-0x00007FF6BB6A0000-0x00007FF6BB9F4000-memory.dmp

Filesize
3.3MB

Download
memory/4248-2108-0x00007FF6A24A0000-0x00007FF6A27F4000-memory.dmp

Filesize
3.3MB

Download
memory/4248-2093-0x00007FF6A24A0000-0x00007FF6A27F4000-memory.dmp

Filesize
3.3MB

Download
memory/4248-80-0x00007FF6A24A0000-0x00007FF6A27F4000-memory.dmp

Filesize
3.3MB

Download
memory/4264-2102-0x00007FF6E5DB0000-0x00007FF6E6104000-memory.dmp

Filesize
3.3MB

Download
memory/4264-36-0x00007FF6E5DB0000-0x00007FF6E6104000-memory.dmp

Filesize
3.3MB

Download
memory/4264-2089-0x00007FF6E5DB0000-0x00007FF6E6104000-memory.dmp

Filesize
3.3MB

Download
memory/4392-0-0x00007FF682E20000-0x00007FF683174000-memory.dmp

Filesize
3.3MB

Download
memory/4392-1-0x0000019E9FE10000-0x0000019E9FE20000-memory.dmp

Filesize
64KB

Download
memory/4392-1696-0x00007FF682E20000-0x00007FF683174000-memory.dmp

Filesize
3.3MB

Download
memory/4440-2107-0x00007FF77EE90000-0x00007FF77F1E4000-memory.dmp

Filesize
3.3MB

Download
memory/4440-171-0x00007FF77EE90000-0x00007FF77F1E4000-memory.dmp

Filesize
3.3MB

Download
memory/4476-30-0x00007FF61E4C0000-0x00007FF61E814000-memory.dmp

Filesize
3.3MB

Download
memory/4476-2101-0x00007FF61E4C0000-0x00007FF61E814000-memory.dmp

Filesize
3.3MB

Download
memory/4512-2113-0x00007FF77FD90000-0x00007FF7800E4000-memory.dmp

Filesize
3.3MB

Download
memory/4512-179-0x00007FF77FD90000-0x00007FF7800E4000-memory.dmp

Filesize
3.3MB

Download
memory/4976-83-0x00007FF77D550000-0x00007FF77D8A4000-memory.dmp

Filesize
3.3MB

Download
memory/4976-2111-0x00007FF77D550000-0x00007FF77D8A4000-memory.dmp

Filesize
3.3MB

Download
memory/4976-2097-0x00007FF77D550000-0x00007FF77D8A4000-memory.dmp

Filesize
3.3MB

Download
memory/5000-169-0x00007FF7C3A60000-0x00007FF7C3DB4000-memory.dmp

Filesize
3.3MB

Download
memory/5000-2122-0x00007FF7C3A60000-0x00007FF7C3DB4000-memory.dmp

Filesize
3.3MB

Download
memory/5012-2115-0x00007FF6D7AB0000-0x00007FF6D7E04000-memory.dmp

Filesize
3.3MB

Download
memory/5012-176-0x00007FF6D7AB0000-0x00007FF6D7E04000-memory.dmp

Filesize
3.3MB

Download