xmrig | f9a2d0c840a1eb4c958e5c7846c78a9797562d239a0a0351723109c0c25f0b57

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
Size

2.2MB
MD5

bc1b01f31580131eba74379a1c190f20
SHA1

cb3f39859f0de9cd0571d785f7b94cb631074cb9
SHA256

f9a2d0c840a1eb4c958e5c7846c78a9797562d239a0a0351723109c0c25f0b57
SHA512

b84799e0a5b08dac3cf399ef514531f3187d2e6015c40ae98f6935b156afebcaaf49d639812b2b2f1d5a2e1c06d348b12f74944079aee9fb52f4d5cd41f4bf06
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+AjES546c2dqOZpn:BemTLkNdfE0pZrY

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4808-0-0x00007FF76C790000-0x00007FF76CAE4000-memory.dmp	xmrig
behavioral2/files/0x000900000002341d-4.dat	xmrig
behavioral2/memory/2852-6-0x00007FF6A6E40000-0x00007FF6A7194000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-11.dat	xmrig
behavioral2/files/0x000700000002342e-21.dat	xmrig
behavioral2/memory/2160-14-0x00007FF623000000-0x00007FF623354000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-27.dat	xmrig
behavioral2/files/0x0007000000023430-33.dat	xmrig
behavioral2/files/0x0007000000023431-43.dat	xmrig
behavioral2/files/0x0007000000023433-52.dat	xmrig
behavioral2/files/0x0007000000023436-70.dat	xmrig
behavioral2/files/0x0007000000023438-80.dat	xmrig
behavioral2/files/0x000700000002343a-90.dat	xmrig
behavioral2/files/0x000700000002343e-105.dat	xmrig
behavioral2/files/0x0007000000023443-136.dat	xmrig
behavioral2/files/0x0007000000023448-157.dat	xmrig
behavioral2/memory/3296-759-0x00007FF676920000-0x00007FF676C74000-memory.dmp	xmrig
behavioral2/files/0x000700000002344b-170.dat	xmrig
behavioral2/files/0x0007000000023449-166.dat	xmrig
behavioral2/files/0x000700000002344a-165.dat	xmrig
behavioral2/files/0x0007000000023447-155.dat	xmrig
behavioral2/files/0x0007000000023446-151.dat	xmrig
behavioral2/files/0x0007000000023445-146.dat	xmrig
behavioral2/files/0x0007000000023444-140.dat	xmrig
behavioral2/files/0x0007000000023442-130.dat	xmrig
behavioral2/files/0x0007000000023441-126.dat	xmrig
behavioral2/files/0x0007000000023440-120.dat	xmrig
behavioral2/files/0x000700000002343f-116.dat	xmrig
behavioral2/files/0x000700000002343d-106.dat	xmrig
behavioral2/files/0x000700000002343c-100.dat	xmrig
behavioral2/files/0x000700000002343b-96.dat	xmrig
behavioral2/files/0x0007000000023439-86.dat	xmrig
behavioral2/files/0x0007000000023437-76.dat	xmrig
behavioral2/files/0x0007000000023435-66.dat	xmrig
behavioral2/files/0x0007000000023434-60.dat	xmrig
behavioral2/files/0x0007000000023432-50.dat	xmrig
behavioral2/memory/4092-42-0x00007FF719E40000-0x00007FF71A194000-memory.dmp	xmrig
behavioral2/memory/5068-41-0x00007FF69C0E0000-0x00007FF69C434000-memory.dmp	xmrig
behavioral2/memory/3904-38-0x00007FF7F5630000-0x00007FF7F5984000-memory.dmp	xmrig
behavioral2/memory/4816-29-0x00007FF7630B0000-0x00007FF763404000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-25.dat	xmrig
behavioral2/memory/4748-23-0x00007FF7442A0000-0x00007FF7445F4000-memory.dmp	xmrig
behavioral2/memory/952-760-0x00007FF701500000-0x00007FF701854000-memory.dmp	xmrig
behavioral2/memory/3432-761-0x00007FF75C220000-0x00007FF75C574000-memory.dmp	xmrig
behavioral2/memory/3632-762-0x00007FF72B6D0000-0x00007FF72BA24000-memory.dmp	xmrig
behavioral2/memory/2272-763-0x00007FF67A450000-0x00007FF67A7A4000-memory.dmp	xmrig
behavioral2/memory/2252-764-0x00007FF78EAA0000-0x00007FF78EDF4000-memory.dmp	xmrig
behavioral2/memory/1464-766-0x00007FF7514D0000-0x00007FF751824000-memory.dmp	xmrig
behavioral2/memory/1412-765-0x00007FF7D50B0000-0x00007FF7D5404000-memory.dmp	xmrig
behavioral2/memory/1428-767-0x00007FF7D3F00000-0x00007FF7D4254000-memory.dmp	xmrig
behavioral2/memory/2360-786-0x00007FF72C3E0000-0x00007FF72C734000-memory.dmp	xmrig
behavioral2/memory/552-814-0x00007FF742130000-0x00007FF742484000-memory.dmp	xmrig
behavioral2/memory/4908-822-0x00007FF719FC0000-0x00007FF71A314000-memory.dmp	xmrig
behavioral2/memory/2264-835-0x00007FF64E6C0000-0x00007FF64EA14000-memory.dmp	xmrig
behavioral2/memory/3728-829-0x00007FF652F90000-0x00007FF6532E4000-memory.dmp	xmrig
behavioral2/memory/3052-808-0x00007FF65A870000-0x00007FF65ABC4000-memory.dmp	xmrig
behavioral2/memory/4164-778-0x00007FF77C4E0000-0x00007FF77C834000-memory.dmp	xmrig
behavioral2/memory/4960-843-0x00007FF6FB2D0000-0x00007FF6FB624000-memory.dmp	xmrig
behavioral2/memory/3140-850-0x00007FF7575E0000-0x00007FF757934000-memory.dmp	xmrig
behavioral2/memory/3708-864-0x00007FF7B61F0000-0x00007FF7B6544000-memory.dmp	xmrig
behavioral2/memory/1848-869-0x00007FF7D34F0000-0x00007FF7D3844000-memory.dmp	xmrig
behavioral2/memory/940-856-0x00007FF66E6A0000-0x00007FF66E9F4000-memory.dmp	xmrig
behavioral2/memory/3204-852-0x00007FF685AB0000-0x00007FF685E04000-memory.dmp	xmrig
behavioral2/memory/4808-2113-0x00007FF76C790000-0x00007FF76CAE4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2852	OvbmSlP.exe
2160	IQBaUsw.exe
4748	nSmwOqQ.exe
4816	rVHJdTl.exe
3904	llFBTOZ.exe
4092	UZVQUho.exe
5068	qjOFUmI.exe
3296	rsaRAHt.exe
952	jRocEIQ.exe
3432	fYxOBsq.exe
3632	MxHRXVS.exe
2272	KxcvQLc.exe
2252	paHfUwg.exe
1412	hoXPgmG.exe
1464	nWibCLT.exe
1428	gQTmrDy.exe
4164	DJeEzRc.exe
2360	EaHixcJ.exe
3052	wRQqwNs.exe
552	FYVMekQ.exe
4908	tAQtKXF.exe
3728	WeeDacf.exe
2264	OYVqksJ.exe
4960	PsdXmWY.exe
3140	oQtRpku.exe
3204	cFMdDQs.exe
940	fwMSSaP.exe
3708	TWxLaPP.exe
1848	TKecJdy.exe
2200	dlDtRSj.exe
3232	CwAQCYJ.exe
1420	afNvSLC.exe
3168	zCXPlcU.exe
3836	yjwgmpr.exe
1756	lfTtWtD.exe
1452	XBMuCrY.exe
3348	jRnglKH.exe
1280	cuoVIgh.exe
5092	tLnMzcD.exe
2856	VOnSjpQ.exe
1960	kZcwgcN.exe
4832	PuxrXFF.exe
3260	OmCaaBm.exe
4828	KzNmtXN.exe
500	GCkvfMZ.exe
4712	hkcOYCj.exe
4424	WSEvVSV.exe
4428	fDuZJnr.exe
3316	kMQATKy.exe
1068	QVPgymJ.exe
3380	YtHxbDp.exe
892	yvNtxid.exe
2376	PerSOCn.exe
2352	aAXjbMZ.exe
2184	eQAGJgd.exe
212	FLHdDGr.exe
4548	EFpIxRP.exe
4360	kxXGqeG.exe
3588	hOWNGLe.exe
5084	CmaZbon.exe
1352	tOsoqGE.exe
2140	OMHRLim.exe
2496	sQnbiIE.exe
4620	RgxEKtr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4808-0-0x00007FF76C790000-0x00007FF76CAE4000-memory.dmp	upx
behavioral2/files/0x000900000002341d-4.dat	upx
behavioral2/memory/2852-6-0x00007FF6A6E40000-0x00007FF6A7194000-memory.dmp	upx
behavioral2/files/0x000700000002342c-11.dat	upx
behavioral2/files/0x000700000002342e-21.dat	upx
behavioral2/memory/2160-14-0x00007FF623000000-0x00007FF623354000-memory.dmp	upx
behavioral2/files/0x000700000002342d-27.dat	upx
behavioral2/files/0x0007000000023430-33.dat	upx
behavioral2/files/0x0007000000023431-43.dat	upx
behavioral2/files/0x0007000000023433-52.dat	upx
behavioral2/files/0x0007000000023436-70.dat	upx
behavioral2/files/0x0007000000023438-80.dat	upx
behavioral2/files/0x000700000002343a-90.dat	upx
behavioral2/files/0x000700000002343e-105.dat	upx
behavioral2/files/0x0007000000023443-136.dat	upx
behavioral2/files/0x0007000000023448-157.dat	upx
behavioral2/memory/3296-759-0x00007FF676920000-0x00007FF676C74000-memory.dmp	upx
behavioral2/files/0x000700000002344b-170.dat	upx
behavioral2/files/0x0007000000023449-166.dat	upx
behavioral2/files/0x000700000002344a-165.dat	upx
behavioral2/files/0x0007000000023447-155.dat	upx
behavioral2/files/0x0007000000023446-151.dat	upx
behavioral2/files/0x0007000000023445-146.dat	upx
behavioral2/files/0x0007000000023444-140.dat	upx
behavioral2/files/0x0007000000023442-130.dat	upx
behavioral2/files/0x0007000000023441-126.dat	upx
behavioral2/files/0x0007000000023440-120.dat	upx
behavioral2/files/0x000700000002343f-116.dat	upx
behavioral2/files/0x000700000002343d-106.dat	upx
behavioral2/files/0x000700000002343c-100.dat	upx
behavioral2/files/0x000700000002343b-96.dat	upx
behavioral2/files/0x0007000000023439-86.dat	upx
behavioral2/files/0x0007000000023437-76.dat	upx
behavioral2/files/0x0007000000023435-66.dat	upx
behavioral2/files/0x0007000000023434-60.dat	upx
behavioral2/files/0x0007000000023432-50.dat	upx
behavioral2/memory/4092-42-0x00007FF719E40000-0x00007FF71A194000-memory.dmp	upx
behavioral2/memory/5068-41-0x00007FF69C0E0000-0x00007FF69C434000-memory.dmp	upx
behavioral2/memory/3904-38-0x00007FF7F5630000-0x00007FF7F5984000-memory.dmp	upx
behavioral2/memory/4816-29-0x00007FF7630B0000-0x00007FF763404000-memory.dmp	upx
behavioral2/files/0x000700000002342f-25.dat	upx
behavioral2/memory/4748-23-0x00007FF7442A0000-0x00007FF7445F4000-memory.dmp	upx
behavioral2/memory/952-760-0x00007FF701500000-0x00007FF701854000-memory.dmp	upx
behavioral2/memory/3432-761-0x00007FF75C220000-0x00007FF75C574000-memory.dmp	upx
behavioral2/memory/3632-762-0x00007FF72B6D0000-0x00007FF72BA24000-memory.dmp	upx
behavioral2/memory/2272-763-0x00007FF67A450000-0x00007FF67A7A4000-memory.dmp	upx
behavioral2/memory/2252-764-0x00007FF78EAA0000-0x00007FF78EDF4000-memory.dmp	upx
behavioral2/memory/1464-766-0x00007FF7514D0000-0x00007FF751824000-memory.dmp	upx
behavioral2/memory/1412-765-0x00007FF7D50B0000-0x00007FF7D5404000-memory.dmp	upx
behavioral2/memory/1428-767-0x00007FF7D3F00000-0x00007FF7D4254000-memory.dmp	upx
behavioral2/memory/2360-786-0x00007FF72C3E0000-0x00007FF72C734000-memory.dmp	upx
behavioral2/memory/552-814-0x00007FF742130000-0x00007FF742484000-memory.dmp	upx
behavioral2/memory/4908-822-0x00007FF719FC0000-0x00007FF71A314000-memory.dmp	upx
behavioral2/memory/2264-835-0x00007FF64E6C0000-0x00007FF64EA14000-memory.dmp	upx
behavioral2/memory/3728-829-0x00007FF652F90000-0x00007FF6532E4000-memory.dmp	upx
behavioral2/memory/3052-808-0x00007FF65A870000-0x00007FF65ABC4000-memory.dmp	upx
behavioral2/memory/4164-778-0x00007FF77C4E0000-0x00007FF77C834000-memory.dmp	upx
behavioral2/memory/4960-843-0x00007FF6FB2D0000-0x00007FF6FB624000-memory.dmp	upx
behavioral2/memory/3140-850-0x00007FF7575E0000-0x00007FF757934000-memory.dmp	upx
behavioral2/memory/3708-864-0x00007FF7B61F0000-0x00007FF7B6544000-memory.dmp	upx
behavioral2/memory/1848-869-0x00007FF7D34F0000-0x00007FF7D3844000-memory.dmp	upx
behavioral2/memory/940-856-0x00007FF66E6A0000-0x00007FF66E9F4000-memory.dmp	upx
behavioral2/memory/3204-852-0x00007FF685AB0000-0x00007FF685E04000-memory.dmp	upx
behavioral2/memory/4808-2113-0x00007FF76C790000-0x00007FF76CAE4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hkcOYCj.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\iQVCVKe.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\RGFVrJU.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\EmvvDSg.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\tOsoqGE.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\XBfreWL.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\rscScca.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\hNEqAdG.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\fwMSSaP.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\lzSMnEf.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\bQMXgoH.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\nDyOmjl.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\KJVZfxa.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\ISgmYLp.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\RceqIHX.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\ggVFHRD.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\XlsAUHQ.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\YPmUClD.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\NiwFrVu.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\XgEwIaY.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\QTjyOFP.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\wNBpFmL.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\ghpDwwF.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\IfCdQLS.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\DPHUbZO.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\Tvhnjrc.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\gSrlNAM.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\qnWmHgQ.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\DeJRkzo.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\wgjRkLl.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\IQBaUsw.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\nYhUjAa.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\IWYELjL.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\iqfNBOG.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\hunwpAJ.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\ZnEwilV.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\yxYTuVy.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\byHyovE.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\FxMyTmx.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\tbaLIJi.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\ncpfWwj.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\AQYsgDe.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\ZIKOjmD.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\bDuOshx.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\NPWlBip.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\RIgTKPd.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\CmaZbon.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\DcSuGph.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\mmxCuZM.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\xCxSkrr.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\fvXaNUY.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\DJeEzRc.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\fwwyAWU.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\fzkreAf.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\qlPeaGD.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\ZbrFTLz.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\KCyIbpQ.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\cLLMfXs.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\aqiuSvA.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\QCmtgcK.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\JuZdYVE.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\TpVvQog.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\EaHixcJ.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
File created	C:\Windows\System\afNvSLC.exe	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2852	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	84
PID 4808 wrote to memory of 2852	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	84
PID 4808 wrote to memory of 2160	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	85
PID 4808 wrote to memory of 2160	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	85
PID 4808 wrote to memory of 4748	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	86
PID 4808 wrote to memory of 4748	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	86
PID 4808 wrote to memory of 4816	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	87
PID 4808 wrote to memory of 4816	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	87
PID 4808 wrote to memory of 3904	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	88
PID 4808 wrote to memory of 3904	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	88
PID 4808 wrote to memory of 4092	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	89
PID 4808 wrote to memory of 4092	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	89
PID 4808 wrote to memory of 5068	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	90
PID 4808 wrote to memory of 5068	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	90
PID 4808 wrote to memory of 3296	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	91
PID 4808 wrote to memory of 3296	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	91
PID 4808 wrote to memory of 952	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	92
PID 4808 wrote to memory of 952	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	92
PID 4808 wrote to memory of 3432	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	93
PID 4808 wrote to memory of 3432	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	93
PID 4808 wrote to memory of 3632	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	94
PID 4808 wrote to memory of 3632	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	94
PID 4808 wrote to memory of 2272	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	95
PID 4808 wrote to memory of 2272	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	95
PID 4808 wrote to memory of 2252	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	96
PID 4808 wrote to memory of 2252	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	96
PID 4808 wrote to memory of 1412	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	97
PID 4808 wrote to memory of 1412	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	97
PID 4808 wrote to memory of 1464	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	98
PID 4808 wrote to memory of 1464	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	98
PID 4808 wrote to memory of 1428	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	99
PID 4808 wrote to memory of 1428	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	99
PID 4808 wrote to memory of 4164	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	100
PID 4808 wrote to memory of 4164	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	100
PID 4808 wrote to memory of 2360	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	101
PID 4808 wrote to memory of 2360	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	101
PID 4808 wrote to memory of 3052	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	102
PID 4808 wrote to memory of 3052	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	102
PID 4808 wrote to memory of 552	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	103
PID 4808 wrote to memory of 552	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	103
PID 4808 wrote to memory of 4908	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	104
PID 4808 wrote to memory of 4908	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	104
PID 4808 wrote to memory of 3728	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	105
PID 4808 wrote to memory of 3728	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	105
PID 4808 wrote to memory of 2264	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	106
PID 4808 wrote to memory of 2264	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	106
PID 4808 wrote to memory of 4960	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	107
PID 4808 wrote to memory of 4960	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	107
PID 4808 wrote to memory of 3140	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	108
PID 4808 wrote to memory of 3140	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	108
PID 4808 wrote to memory of 3204	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	109
PID 4808 wrote to memory of 3204	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	109
PID 4808 wrote to memory of 940	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	110
PID 4808 wrote to memory of 940	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	110
PID 4808 wrote to memory of 3708	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	111
PID 4808 wrote to memory of 3708	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	111
PID 4808 wrote to memory of 1848	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	112
PID 4808 wrote to memory of 1848	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	112
PID 4808 wrote to memory of 2200	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	113
PID 4808 wrote to memory of 2200	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	113
PID 4808 wrote to memory of 3232	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	114
PID 4808 wrote to memory of 3232	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	114
PID 4808 wrote to memory of 1420	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	115
PID 4808 wrote to memory of 1420	4808	bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bc1b01f31580131eba74379a1c190f20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System\OvbmSlP.exe
  C:\Windows\System\OvbmSlP.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\IQBaUsw.exe
  C:\Windows\System\IQBaUsw.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\nSmwOqQ.exe
  C:\Windows\System\nSmwOqQ.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\rVHJdTl.exe
  C:\Windows\System\rVHJdTl.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\llFBTOZ.exe
  C:\Windows\System\llFBTOZ.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\UZVQUho.exe
  C:\Windows\System\UZVQUho.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\qjOFUmI.exe
  C:\Windows\System\qjOFUmI.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\rsaRAHt.exe
  C:\Windows\System\rsaRAHt.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\jRocEIQ.exe
  C:\Windows\System\jRocEIQ.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\fYxOBsq.exe
  C:\Windows\System\fYxOBsq.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\MxHRXVS.exe
  C:\Windows\System\MxHRXVS.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\KxcvQLc.exe
  C:\Windows\System\KxcvQLc.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\paHfUwg.exe
  C:\Windows\System\paHfUwg.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\hoXPgmG.exe
  C:\Windows\System\hoXPgmG.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\nWibCLT.exe
  C:\Windows\System\nWibCLT.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\gQTmrDy.exe
  C:\Windows\System\gQTmrDy.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\DJeEzRc.exe
  C:\Windows\System\DJeEzRc.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\EaHixcJ.exe
  C:\Windows\System\EaHixcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\wRQqwNs.exe
  C:\Windows\System\wRQqwNs.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\FYVMekQ.exe
  C:\Windows\System\FYVMekQ.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\tAQtKXF.exe
  C:\Windows\System\tAQtKXF.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\WeeDacf.exe
  C:\Windows\System\WeeDacf.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\OYVqksJ.exe
  C:\Windows\System\OYVqksJ.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\PsdXmWY.exe
  C:\Windows\System\PsdXmWY.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\oQtRpku.exe
  C:\Windows\System\oQtRpku.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\cFMdDQs.exe
  C:\Windows\System\cFMdDQs.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\fwMSSaP.exe
  C:\Windows\System\fwMSSaP.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\TWxLaPP.exe
  C:\Windows\System\TWxLaPP.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\TKecJdy.exe
  C:\Windows\System\TKecJdy.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\dlDtRSj.exe
  C:\Windows\System\dlDtRSj.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\CwAQCYJ.exe
  C:\Windows\System\CwAQCYJ.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\afNvSLC.exe
  C:\Windows\System\afNvSLC.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\zCXPlcU.exe
  C:\Windows\System\zCXPlcU.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\yjwgmpr.exe
  C:\Windows\System\yjwgmpr.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\lfTtWtD.exe
  C:\Windows\System\lfTtWtD.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\XBMuCrY.exe
  C:\Windows\System\XBMuCrY.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\jRnglKH.exe
  C:\Windows\System\jRnglKH.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\cuoVIgh.exe
  C:\Windows\System\cuoVIgh.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\tLnMzcD.exe
  C:\Windows\System\tLnMzcD.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\VOnSjpQ.exe
  C:\Windows\System\VOnSjpQ.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\kZcwgcN.exe
  C:\Windows\System\kZcwgcN.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\PuxrXFF.exe
  C:\Windows\System\PuxrXFF.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\OmCaaBm.exe
  C:\Windows\System\OmCaaBm.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\KzNmtXN.exe
  C:\Windows\System\KzNmtXN.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\GCkvfMZ.exe
  C:\Windows\System\GCkvfMZ.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\hkcOYCj.exe
  C:\Windows\System\hkcOYCj.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\WSEvVSV.exe
  C:\Windows\System\WSEvVSV.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\fDuZJnr.exe
  C:\Windows\System\fDuZJnr.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\kMQATKy.exe
  C:\Windows\System\kMQATKy.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\QVPgymJ.exe
  C:\Windows\System\QVPgymJ.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\YtHxbDp.exe
  C:\Windows\System\YtHxbDp.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\yvNtxid.exe
  C:\Windows\System\yvNtxid.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\PerSOCn.exe
  C:\Windows\System\PerSOCn.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\aAXjbMZ.exe
  C:\Windows\System\aAXjbMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\eQAGJgd.exe
  C:\Windows\System\eQAGJgd.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\FLHdDGr.exe
  C:\Windows\System\FLHdDGr.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\EFpIxRP.exe
  C:\Windows\System\EFpIxRP.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\kxXGqeG.exe
  C:\Windows\System\kxXGqeG.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\hOWNGLe.exe
  C:\Windows\System\hOWNGLe.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\CmaZbon.exe
  C:\Windows\System\CmaZbon.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\tOsoqGE.exe
  C:\Windows\System\tOsoqGE.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\OMHRLim.exe
  C:\Windows\System\OMHRLim.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\sQnbiIE.exe
  C:\Windows\System\sQnbiIE.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\RgxEKtr.exe
  C:\Windows\System\RgxEKtr.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\MLdtzjI.exe
  C:\Windows\System\MLdtzjI.exe
  2⤵
  PID:1228
- C:\Windows\System\nAajPxQ.exe
  C:\Windows\System\nAajPxQ.exe
  2⤵
  PID:2348
- C:\Windows\System\KQDVDkE.exe
  C:\Windows\System\KQDVDkE.exe
  2⤵
  PID:2116
- C:\Windows\System\plKeiaH.exe
  C:\Windows\System\plKeiaH.exe
  2⤵
  PID:1620
- C:\Windows\System\nOmcLcV.exe
  C:\Windows\System\nOmcLcV.exe
  2⤵
  PID:3744
- C:\Windows\System\dZUMeil.exe
  C:\Windows\System\dZUMeil.exe
  2⤵
  PID:1208
- C:\Windows\System\MRjzgWF.exe
  C:\Windows\System\MRjzgWF.exe
  2⤵
  PID:4652
- C:\Windows\System\beKfpCn.exe
  C:\Windows\System\beKfpCn.exe
  2⤵
  PID:4660
- C:\Windows\System\gZBrNDj.exe
  C:\Windows\System\gZBrNDj.exe
  2⤵
  PID:4200
- C:\Windows\System\fwwyAWU.exe
  C:\Windows\System\fwwyAWU.exe
  2⤵
  PID:4452
- C:\Windows\System\idKeVmD.exe
  C:\Windows\System\idKeVmD.exe
  2⤵
  PID:532
- C:\Windows\System\efpuoNw.exe
  C:\Windows\System\efpuoNw.exe
  2⤵
  PID:4872
- C:\Windows\System\dwttATg.exe
  C:\Windows\System\dwttATg.exe
  2⤵
  PID:5144
- C:\Windows\System\nMMnkSk.exe
  C:\Windows\System\nMMnkSk.exe
  2⤵
  PID:5172
- C:\Windows\System\LPoAhWP.exe
  C:\Windows\System\LPoAhWP.exe
  2⤵
  PID:5200
- C:\Windows\System\ZNOvKjq.exe
  C:\Windows\System\ZNOvKjq.exe
  2⤵
  PID:5228
- C:\Windows\System\foGTxHd.exe
  C:\Windows\System\foGTxHd.exe
  2⤵
  PID:5256
- C:\Windows\System\IJpzCxN.exe
  C:\Windows\System\IJpzCxN.exe
  2⤵
  PID:5284
- C:\Windows\System\ZtsBWmh.exe
  C:\Windows\System\ZtsBWmh.exe
  2⤵
  PID:5312
- C:\Windows\System\SaPSltQ.exe
  C:\Windows\System\SaPSltQ.exe
  2⤵
  PID:5340
- C:\Windows\System\Vwlyosb.exe
  C:\Windows\System\Vwlyosb.exe
  2⤵
  PID:5368
- C:\Windows\System\sSbWsVF.exe
  C:\Windows\System\sSbWsVF.exe
  2⤵
  PID:5396
- C:\Windows\System\PnRIuNW.exe
  C:\Windows\System\PnRIuNW.exe
  2⤵
  PID:5424
- C:\Windows\System\jJxVZRQ.exe
  C:\Windows\System\jJxVZRQ.exe
  2⤵
  PID:5452
- C:\Windows\System\nYhUjAa.exe
  C:\Windows\System\nYhUjAa.exe
  2⤵
  PID:5484
- C:\Windows\System\ZeYJGLN.exe
  C:\Windows\System\ZeYJGLN.exe
  2⤵
  PID:5508
- C:\Windows\System\uZVzkws.exe
  C:\Windows\System\uZVzkws.exe
  2⤵
  PID:5536
- C:\Windows\System\WBwpfpo.exe
  C:\Windows\System\WBwpfpo.exe
  2⤵
  PID:5564
- C:\Windows\System\jEoVjIt.exe
  C:\Windows\System\jEoVjIt.exe
  2⤵
  PID:5592
- C:\Windows\System\ShyJLTP.exe
  C:\Windows\System\ShyJLTP.exe
  2⤵
  PID:5620
- C:\Windows\System\HEkIcrO.exe
  C:\Windows\System\HEkIcrO.exe
  2⤵
  PID:5648
- C:\Windows\System\CvDdTyw.exe
  C:\Windows\System\CvDdTyw.exe
  2⤵
  PID:5676
- C:\Windows\System\uWzakdL.exe
  C:\Windows\System\uWzakdL.exe
  2⤵
  PID:5704
- C:\Windows\System\zsAVgdr.exe
  C:\Windows\System\zsAVgdr.exe
  2⤵
  PID:5732
- C:\Windows\System\SfLDCPH.exe
  C:\Windows\System\SfLDCPH.exe
  2⤵
  PID:5760
- C:\Windows\System\qaAKxYV.exe
  C:\Windows\System\qaAKxYV.exe
  2⤵
  PID:5788
- C:\Windows\System\ZeBxisE.exe
  C:\Windows\System\ZeBxisE.exe
  2⤵
  PID:5816
- C:\Windows\System\mvZZDjA.exe
  C:\Windows\System\mvZZDjA.exe
  2⤵
  PID:5844
- C:\Windows\System\XlsAUHQ.exe
  C:\Windows\System\XlsAUHQ.exe
  2⤵
  PID:5872
- C:\Windows\System\nSJBGLd.exe
  C:\Windows\System\nSJBGLd.exe
  2⤵
  PID:5900
- C:\Windows\System\oMQRZTJ.exe
  C:\Windows\System\oMQRZTJ.exe
  2⤵
  PID:5928
- C:\Windows\System\emENcEx.exe
  C:\Windows\System\emENcEx.exe
  2⤵
  PID:5956
- C:\Windows\System\IeFWReE.exe
  C:\Windows\System\IeFWReE.exe
  2⤵
  PID:5984
- C:\Windows\System\ZweiZgJ.exe
  C:\Windows\System\ZweiZgJ.exe
  2⤵
  PID:6008
- C:\Windows\System\UOghCSp.exe
  C:\Windows\System\UOghCSp.exe
  2⤵
  PID:6040
- C:\Windows\System\WTVnZOl.exe
  C:\Windows\System\WTVnZOl.exe
  2⤵
  PID:6068
- C:\Windows\System\yUTbizT.exe
  C:\Windows\System\yUTbizT.exe
  2⤵
  PID:6096
- C:\Windows\System\owCfGvt.exe
  C:\Windows\System\owCfGvt.exe
  2⤵
  PID:6124
- C:\Windows\System\tACtDye.exe
  C:\Windows\System\tACtDye.exe
  2⤵
  PID:2952
- C:\Windows\System\tGYVCyw.exe
  C:\Windows\System\tGYVCyw.exe
  2⤵
  PID:2768
- C:\Windows\System\jPqEojZ.exe
  C:\Windows\System\jPqEojZ.exe
  2⤵
  PID:4336
- C:\Windows\System\dBlOWgx.exe
  C:\Windows\System\dBlOWgx.exe
  2⤵
  PID:4444
- C:\Windows\System\oVENBPn.exe
  C:\Windows\System\oVENBPn.exe
  2⤵
  PID:3340
- C:\Windows\System\tchZqyp.exe
  C:\Windows\System\tchZqyp.exe
  2⤵
  PID:2760
- C:\Windows\System\uOYNzZw.exe
  C:\Windows\System\uOYNzZw.exe
  2⤵
  PID:5156
- C:\Windows\System\ISePVoz.exe
  C:\Windows\System\ISePVoz.exe
  2⤵
  PID:5216
- C:\Windows\System\OYIVHhL.exe
  C:\Windows\System\OYIVHhL.exe
  2⤵
  PID:5272
- C:\Windows\System\oecZrqF.exe
  C:\Windows\System\oecZrqF.exe
  2⤵
  PID:5332
- C:\Windows\System\kbHIQOU.exe
  C:\Windows\System\kbHIQOU.exe
  2⤵
  PID:5408
- C:\Windows\System\HjdVMeZ.exe
  C:\Windows\System\HjdVMeZ.exe
  2⤵
  PID:5468
- C:\Windows\System\zCptwwm.exe
  C:\Windows\System\zCptwwm.exe
  2⤵
  PID:5528
- C:\Windows\System\VnmawTu.exe
  C:\Windows\System\VnmawTu.exe
  2⤵
  PID:5604
- C:\Windows\System\SKpSKVD.exe
  C:\Windows\System\SKpSKVD.exe
  2⤵
  PID:5664
- C:\Windows\System\hgwYANK.exe
  C:\Windows\System\hgwYANK.exe
  2⤵
  PID:5724
- C:\Windows\System\FEKsZFC.exe
  C:\Windows\System\FEKsZFC.exe
  2⤵
  PID:5800
- C:\Windows\System\mnBysAY.exe
  C:\Windows\System\mnBysAY.exe
  2⤵
  PID:5856
- C:\Windows\System\NyezjFI.exe
  C:\Windows\System\NyezjFI.exe
  2⤵
  PID:5916
- C:\Windows\System\oLkdDcC.exe
  C:\Windows\System\oLkdDcC.exe
  2⤵
  PID:5968
- C:\Windows\System\xbhLCjB.exe
  C:\Windows\System\xbhLCjB.exe
  2⤵
  PID:6032
- C:\Windows\System\bnyvUzD.exe
  C:\Windows\System\bnyvUzD.exe
  2⤵
  PID:6108
- C:\Windows\System\RxgFVCm.exe
  C:\Windows\System\RxgFVCm.exe
  2⤵
  PID:3092
- C:\Windows\System\byHyovE.exe
  C:\Windows\System\byHyovE.exe
  2⤵
  PID:3428
- C:\Windows\System\XLpmKKj.exe
  C:\Windows\System\XLpmKKj.exe
  2⤵
  PID:2792
- C:\Windows\System\GAhTuhd.exe
  C:\Windows\System\GAhTuhd.exe
  2⤵
  PID:5244
- C:\Windows\System\ElzzhlD.exe
  C:\Windows\System\ElzzhlD.exe
  2⤵
  PID:5384
- C:\Windows\System\oXGfISl.exe
  C:\Windows\System\oXGfISl.exe
  2⤵
  PID:5556
- C:\Windows\System\mGvjyzn.exe
  C:\Windows\System\mGvjyzn.exe
  2⤵
  PID:5696
- C:\Windows\System\zZjhlqf.exe
  C:\Windows\System\zZjhlqf.exe
  2⤵
  PID:5832
- C:\Windows\System\ghpDwwF.exe
  C:\Windows\System\ghpDwwF.exe
  2⤵
  PID:6168
- C:\Windows\System\XryLQYy.exe
  C:\Windows\System\XryLQYy.exe
  2⤵
  PID:6200
- C:\Windows\System\VUFQiKj.exe
  C:\Windows\System\VUFQiKj.exe
  2⤵
  PID:6224
- C:\Windows\System\LUokGIf.exe
  C:\Windows\System\LUokGIf.exe
  2⤵
  PID:6252
- C:\Windows\System\itJESBN.exe
  C:\Windows\System\itJESBN.exe
  2⤵
  PID:6280
- C:\Windows\System\lNtmERW.exe
  C:\Windows\System\lNtmERW.exe
  2⤵
  PID:6308
- C:\Windows\System\aPDbEvN.exe
  C:\Windows\System\aPDbEvN.exe
  2⤵
  PID:6336
- C:\Windows\System\YPmUClD.exe
  C:\Windows\System\YPmUClD.exe
  2⤵
  PID:6364
- C:\Windows\System\CThRotF.exe
  C:\Windows\System\CThRotF.exe
  2⤵
  PID:6392
- C:\Windows\System\feKDvOM.exe
  C:\Windows\System\feKDvOM.exe
  2⤵
  PID:6420
- C:\Windows\System\RWHeWIX.exe
  C:\Windows\System\RWHeWIX.exe
  2⤵
  PID:6448
- C:\Windows\System\pjuNgkW.exe
  C:\Windows\System\pjuNgkW.exe
  2⤵
  PID:6476
- C:\Windows\System\KCyIbpQ.exe
  C:\Windows\System\KCyIbpQ.exe
  2⤵
  PID:6504
- C:\Windows\System\exLmtny.exe
  C:\Windows\System\exLmtny.exe
  2⤵
  PID:6532
- C:\Windows\System\fCDeEBb.exe
  C:\Windows\System\fCDeEBb.exe
  2⤵
  PID:6560
- C:\Windows\System\lWdHAUH.exe
  C:\Windows\System\lWdHAUH.exe
  2⤵
  PID:6588
- C:\Windows\System\CCGCLlX.exe
  C:\Windows\System\CCGCLlX.exe
  2⤵
  PID:6616
- C:\Windows\System\XzTsajC.exe
  C:\Windows\System\XzTsajC.exe
  2⤵
  PID:6644
- C:\Windows\System\YsuzEBj.exe
  C:\Windows\System\YsuzEBj.exe
  2⤵
  PID:6672
- C:\Windows\System\JBxsoub.exe
  C:\Windows\System\JBxsoub.exe
  2⤵
  PID:6700
- C:\Windows\System\zLpBFGy.exe
  C:\Windows\System\zLpBFGy.exe
  2⤵
  PID:6728
- C:\Windows\System\TtkZQkz.exe
  C:\Windows\System\TtkZQkz.exe
  2⤵
  PID:6756
- C:\Windows\System\PuXOOMq.exe
  C:\Windows\System\PuXOOMq.exe
  2⤵
  PID:6784
- C:\Windows\System\uyEsLtl.exe
  C:\Windows\System\uyEsLtl.exe
  2⤵
  PID:6812
- C:\Windows\System\nzAOhHb.exe
  C:\Windows\System\nzAOhHb.exe
  2⤵
  PID:6840
- C:\Windows\System\NgpMwjq.exe
  C:\Windows\System\NgpMwjq.exe
  2⤵
  PID:6864
- C:\Windows\System\acQlTqt.exe
  C:\Windows\System\acQlTqt.exe
  2⤵
  PID:6892
- C:\Windows\System\iFVcrUP.exe
  C:\Windows\System\iFVcrUP.exe
  2⤵
  PID:6924
- C:\Windows\System\DKGKmWe.exe
  C:\Windows\System\DKGKmWe.exe
  2⤵
  PID:6952
- C:\Windows\System\qDhINlD.exe
  C:\Windows\System\qDhINlD.exe
  2⤵
  PID:6980
- C:\Windows\System\SVeXHJv.exe
  C:\Windows\System\SVeXHJv.exe
  2⤵
  PID:7008
- C:\Windows\System\lbYbxeZ.exe
  C:\Windows\System\lbYbxeZ.exe
  2⤵
  PID:7036
- C:\Windows\System\Enieqzo.exe
  C:\Windows\System\Enieqzo.exe
  2⤵
  PID:7064
- C:\Windows\System\upLaMNm.exe
  C:\Windows\System\upLaMNm.exe
  2⤵
  PID:7092
- C:\Windows\System\wpfaKCO.exe
  C:\Windows\System\wpfaKCO.exe
  2⤵
  PID:7120
- C:\Windows\System\HLRrxQy.exe
  C:\Windows\System\HLRrxQy.exe
  2⤵
  PID:7148
- C:\Windows\System\OYxnXBR.exe
  C:\Windows\System\OYxnXBR.exe
  2⤵
  PID:5940
- C:\Windows\System\RBQpXvR.exe
  C:\Windows\System\RBQpXvR.exe
  2⤵
  PID:6080
- C:\Windows\System\pxKhGum.exe
  C:\Windows\System\pxKhGum.exe
  2⤵
  PID:4780
- C:\Windows\System\GWqbykW.exe
  C:\Windows\System\GWqbykW.exe
  2⤵
  PID:5304
- C:\Windows\System\wpHnNKv.exe
  C:\Windows\System\wpHnNKv.exe
  2⤵
  PID:5636
- C:\Windows\System\KpNRyMX.exe
  C:\Windows\System\KpNRyMX.exe
  2⤵
  PID:6160
- C:\Windows\System\fBbYSxZ.exe
  C:\Windows\System\fBbYSxZ.exe
  2⤵
  PID:6216
- C:\Windows\System\wieXdgM.exe
  C:\Windows\System\wieXdgM.exe
  2⤵
  PID:6272
- C:\Windows\System\DwGgRDG.exe
  C:\Windows\System\DwGgRDG.exe
  2⤵
  PID:6352
- C:\Windows\System\uOrjFIv.exe
  C:\Windows\System\uOrjFIv.exe
  2⤵
  PID:6412
- C:\Windows\System\hmWznDw.exe
  C:\Windows\System\hmWznDw.exe
  2⤵
  PID:6488
- C:\Windows\System\rDAVeYi.exe
  C:\Windows\System\rDAVeYi.exe
  2⤵
  PID:4148
- C:\Windows\System\iwdHTxf.exe
  C:\Windows\System\iwdHTxf.exe
  2⤵
  PID:6604
- C:\Windows\System\ioodkzx.exe
  C:\Windows\System\ioodkzx.exe
  2⤵
  PID:6660
- C:\Windows\System\zmXZujB.exe
  C:\Windows\System\zmXZujB.exe
  2⤵
  PID:6716
- C:\Windows\System\GtgUXEz.exe
  C:\Windows\System\GtgUXEz.exe
  2⤵
  PID:6796
- C:\Windows\System\IfCdQLS.exe
  C:\Windows\System\IfCdQLS.exe
  2⤵
  PID:6856
- C:\Windows\System\Witjszn.exe
  C:\Windows\System\Witjszn.exe
  2⤵
  PID:6912
- C:\Windows\System\LvsDOPL.exe
  C:\Windows\System\LvsDOPL.exe
  2⤵
  PID:6972
- C:\Windows\System\YGbdFXG.exe
  C:\Windows\System\YGbdFXG.exe
  2⤵
  PID:7048
- C:\Windows\System\gvHcGRx.exe
  C:\Windows\System\gvHcGRx.exe
  2⤵
  PID:7084
- C:\Windows\System\kHtyhdQ.exe
  C:\Windows\System\kHtyhdQ.exe
  2⤵
  PID:7140
- C:\Windows\System\sKwzvVr.exe
  C:\Windows\System\sKwzvVr.exe
  2⤵
  PID:6024
- C:\Windows\System\tPiUvjl.exe
  C:\Windows\System\tPiUvjl.exe
  2⤵
  PID:5444
- C:\Windows\System\jdkJHpK.exe
  C:\Windows\System\jdkJHpK.exe
  2⤵
  PID:6184
- C:\Windows\System\IghzUun.exe
  C:\Windows\System\IghzUun.exe
  2⤵
  PID:6320
- C:\Windows\System\aoXyiyO.exe
  C:\Windows\System\aoXyiyO.exe
  2⤵
  PID:6460
- C:\Windows\System\FkyeVKv.exe
  C:\Windows\System\FkyeVKv.exe
  2⤵
  PID:6576
- C:\Windows\System\zBFhiGE.exe
  C:\Windows\System\zBFhiGE.exe
  2⤵
  PID:6712
- C:\Windows\System\wTMhnXJ.exe
  C:\Windows\System\wTMhnXJ.exe
  2⤵
  PID:6832
- C:\Windows\System\OijXEnj.exe
  C:\Windows\System\OijXEnj.exe
  2⤵
  PID:7000
- C:\Windows\System\DDHSPlF.exe
  C:\Windows\System\DDHSPlF.exe
  2⤵
  PID:7112
- C:\Windows\System\jJHHoll.exe
  C:\Windows\System\jJHHoll.exe
  2⤵
  PID:4812
- C:\Windows\System\nGuQbVd.exe
  C:\Windows\System\nGuQbVd.exe
  2⤵
  PID:7188
- C:\Windows\System\YSRNKPh.exe
  C:\Windows\System\YSRNKPh.exe
  2⤵
  PID:7216
- C:\Windows\System\eiBNvhX.exe
  C:\Windows\System\eiBNvhX.exe
  2⤵
  PID:7244
- C:\Windows\System\sdLAuOd.exe
  C:\Windows\System\sdLAuOd.exe
  2⤵
  PID:7272
- C:\Windows\System\MeARSVb.exe
  C:\Windows\System\MeARSVb.exe
  2⤵
  PID:7296
- C:\Windows\System\ZFpLwYJ.exe
  C:\Windows\System\ZFpLwYJ.exe
  2⤵
  PID:7328
- C:\Windows\System\Bnxjrqu.exe
  C:\Windows\System\Bnxjrqu.exe
  2⤵
  PID:7356
- C:\Windows\System\RqRDxGv.exe
  C:\Windows\System\RqRDxGv.exe
  2⤵
  PID:7384
- C:\Windows\System\FbhaGdV.exe
  C:\Windows\System\FbhaGdV.exe
  2⤵
  PID:7412
- C:\Windows\System\cLLMfXs.exe
  C:\Windows\System\cLLMfXs.exe
  2⤵
  PID:7440
- C:\Windows\System\dyqfSVU.exe
  C:\Windows\System\dyqfSVU.exe
  2⤵
  PID:7468
- C:\Windows\System\XFwyibi.exe
  C:\Windows\System\XFwyibi.exe
  2⤵
  PID:7496
- C:\Windows\System\DPHUbZO.exe
  C:\Windows\System\DPHUbZO.exe
  2⤵
  PID:7524
- C:\Windows\System\DbMsjUl.exe
  C:\Windows\System\DbMsjUl.exe
  2⤵
  PID:7552
- C:\Windows\System\eFXbDdJ.exe
  C:\Windows\System\eFXbDdJ.exe
  2⤵
  PID:7580
- C:\Windows\System\oavLNzw.exe
  C:\Windows\System\oavLNzw.exe
  2⤵
  PID:7604
- C:\Windows\System\iVXjHoa.exe
  C:\Windows\System\iVXjHoa.exe
  2⤵
  PID:7636
- C:\Windows\System\NiwFrVu.exe
  C:\Windows\System\NiwFrVu.exe
  2⤵
  PID:7664
- C:\Windows\System\bGbJDLb.exe
  C:\Windows\System\bGbJDLb.exe
  2⤵
  PID:7688
- C:\Windows\System\xYnfaSu.exe
  C:\Windows\System\xYnfaSu.exe
  2⤵
  PID:7828
- C:\Windows\System\nLREMMx.exe
  C:\Windows\System\nLREMMx.exe
  2⤵
  PID:7844
- C:\Windows\System\DSjrQAi.exe
  C:\Windows\System\DSjrQAi.exe
  2⤵
  PID:7864
- C:\Windows\System\ZBfjoyp.exe
  C:\Windows\System\ZBfjoyp.exe
  2⤵
  PID:7884
- C:\Windows\System\xesChPD.exe
  C:\Windows\System\xesChPD.exe
  2⤵
  PID:7924
- C:\Windows\System\lrghKhx.exe
  C:\Windows\System\lrghKhx.exe
  2⤵
  PID:7940
- C:\Windows\System\FxMyTmx.exe
  C:\Windows\System\FxMyTmx.exe
  2⤵
  PID:7960
- C:\Windows\System\WZiluGF.exe
  C:\Windows\System\WZiluGF.exe
  2⤵
  PID:7980
- C:\Windows\System\BMcXXnJ.exe
  C:\Windows\System\BMcXXnJ.exe
  2⤵
  PID:8024
- C:\Windows\System\XxpSthW.exe
  C:\Windows\System\XxpSthW.exe
  2⤵
  PID:8044
- C:\Windows\System\douRiZM.exe
  C:\Windows\System\douRiZM.exe
  2⤵
  PID:8060
- C:\Windows\System\MLXNhrA.exe
  C:\Windows\System\MLXNhrA.exe
  2⤵
  PID:8084
- C:\Windows\System\tuKzoMc.exe
  C:\Windows\System\tuKzoMc.exe
  2⤵
  PID:8108
- C:\Windows\System\EHvrYVi.exe
  C:\Windows\System\EHvrYVi.exe
  2⤵
  PID:8136
- C:\Windows\System\eghxJjo.exe
  C:\Windows\System\eghxJjo.exe
  2⤵
  PID:1928
- C:\Windows\System\VajKOmo.exe
  C:\Windows\System\VajKOmo.exe
  2⤵
  PID:6404
- C:\Windows\System\hiFULCI.exe
  C:\Windows\System\hiFULCI.exe
  2⤵
  PID:2384
- C:\Windows\System\cDWQImZ.exe
  C:\Windows\System\cDWQImZ.exe
  2⤵
  PID:3696
- C:\Windows\System\uHwaAcY.exe
  C:\Windows\System\uHwaAcY.exe
  2⤵
  PID:7200
- C:\Windows\System\tWCrmLx.exe
  C:\Windows\System\tWCrmLx.exe
  2⤵
  PID:7256
- C:\Windows\System\XddxXyW.exe
  C:\Windows\System\XddxXyW.exe
  2⤵
  PID:4724
- C:\Windows\System\kDBTjtL.exe
  C:\Windows\System\kDBTjtL.exe
  2⤵
  PID:4844
- C:\Windows\System\TNhxZds.exe
  C:\Windows\System\TNhxZds.exe
  2⤵
  PID:1272
- C:\Windows\System\rJNPYkI.exe
  C:\Windows\System\rJNPYkI.exe
  2⤵
  PID:7464
- C:\Windows\System\IhFDsQh.exe
  C:\Windows\System\IhFDsQh.exe
  2⤵
  PID:7512
- C:\Windows\System\zXpDqqU.exe
  C:\Windows\System\zXpDqqU.exe
  2⤵
  PID:7540
- C:\Windows\System\srOYAJB.exe
  C:\Windows\System\srOYAJB.exe
  2⤵
  PID:2900
- C:\Windows\System\KYpYESt.exe
  C:\Windows\System\KYpYESt.exe
  2⤵
  PID:4912
- C:\Windows\System\XgEwIaY.exe
  C:\Windows\System\XgEwIaY.exe
  2⤵
  PID:7656
- C:\Windows\System\rTFwBxd.exe
  C:\Windows\System\rTFwBxd.exe
  2⤵
  PID:7748
- C:\Windows\System\xvBIxFZ.exe
  C:\Windows\System\xvBIxFZ.exe
  2⤵
  PID:2576
- C:\Windows\System\XoUazmq.exe
  C:\Windows\System\XoUazmq.exe
  2⤵
  PID:2872
- C:\Windows\System\tuGfwgh.exe
  C:\Windows\System\tuGfwgh.exe
  2⤵
  PID:3388
- C:\Windows\System\kHciQJb.exe
  C:\Windows\System\kHciQJb.exe
  2⤵
  PID:788
- C:\Windows\System\nGzbBbe.exe
  C:\Windows\System\nGzbBbe.exe
  2⤵
  PID:7836
- C:\Windows\System\RSVplVw.exe
  C:\Windows\System\RSVplVw.exe
  2⤵
  PID:7972
- C:\Windows\System\VgrYDwp.exe
  C:\Windows\System\VgrYDwp.exe
  2⤵
  PID:8128
- C:\Windows\System\KTjdRaC.exe
  C:\Windows\System\KTjdRaC.exe
  2⤵
  PID:8092
- C:\Windows\System\GJsBBJr.exe
  C:\Windows\System\GJsBBJr.exe
  2⤵
  PID:7288
- C:\Windows\System\xgQGKNI.exe
  C:\Windows\System\xgQGKNI.exe
  2⤵
  PID:7424
- C:\Windows\System\xrBtJor.exe
  C:\Windows\System\xrBtJor.exe
  2⤵
  PID:7800
- C:\Windows\System\GACnBoz.exe
  C:\Windows\System\GACnBoz.exe
  2⤵
  PID:4488
- C:\Windows\System\UWkiRBj.exe
  C:\Windows\System\UWkiRBj.exe
  2⤵
  PID:4100
- C:\Windows\System\DJEBTvy.exe
  C:\Windows\System\DJEBTvy.exe
  2⤵
  PID:4764
- C:\Windows\System\MkrbMTT.exe
  C:\Windows\System\MkrbMTT.exe
  2⤵
  PID:3548
- C:\Windows\System\DcSuGph.exe
  C:\Windows\System\DcSuGph.exe
  2⤵
  PID:8040
- C:\Windows\System\dpZEesB.exe
  C:\Windows\System\dpZEesB.exe
  2⤵
  PID:8072
- C:\Windows\System\DbPwtgv.exe
  C:\Windows\System\DbPwtgv.exe
  2⤵
  PID:7284
- C:\Windows\System\UNIbBxL.exe
  C:\Windows\System\UNIbBxL.exe
  2⤵
  PID:5024
- C:\Windows\System\cCrdMCx.exe
  C:\Windows\System\cCrdMCx.exe
  2⤵
  PID:7648
- C:\Windows\System\aqiuSvA.exe
  C:\Windows\System\aqiuSvA.exe
  2⤵
  PID:5088
- C:\Windows\System\uvxxVHV.exe
  C:\Windows\System\uvxxVHV.exe
  2⤵
  PID:7824
- C:\Windows\System\sfVmYiF.exe
  C:\Windows\System\sfVmYiF.exe
  2⤵
  PID:3864
- C:\Windows\System\hCmAYWm.exe
  C:\Windows\System\hCmAYWm.exe
  2⤵
  PID:7484
- C:\Windows\System\gcYDPEE.exe
  C:\Windows\System\gcYDPEE.exe
  2⤵
  PID:7228
- C:\Windows\System\AKLLUVb.exe
  C:\Windows\System\AKLLUVb.exe
  2⤵
  PID:8168
- C:\Windows\System\eWadJFO.exe
  C:\Windows\System\eWadJFO.exe
  2⤵
  PID:4900
- C:\Windows\System\IyloyRS.exe
  C:\Windows\System\IyloyRS.exe
  2⤵
  PID:8220
- C:\Windows\System\ZhpzPcM.exe
  C:\Windows\System\ZhpzPcM.exe
  2⤵
  PID:8248
- C:\Windows\System\ohuTfqT.exe
  C:\Windows\System\ohuTfqT.exe
  2⤵
  PID:8276
- C:\Windows\System\xBzXcta.exe
  C:\Windows\System\xBzXcta.exe
  2⤵
  PID:8304
- C:\Windows\System\fzkreAf.exe
  C:\Windows\System\fzkreAf.exe
  2⤵
  PID:8320
- C:\Windows\System\TmBMbwJ.exe
  C:\Windows\System\TmBMbwJ.exe
  2⤵
  PID:8352
- C:\Windows\System\nItFvVa.exe
  C:\Windows\System\nItFvVa.exe
  2⤵
  PID:8388
- C:\Windows\System\lahnHAG.exe
  C:\Windows\System\lahnHAG.exe
  2⤵
  PID:8420
- C:\Windows\System\iQjIbPc.exe
  C:\Windows\System\iQjIbPc.exe
  2⤵
  PID:8452
- C:\Windows\System\xqgwqCt.exe
  C:\Windows\System\xqgwqCt.exe
  2⤵
  PID:8484
- C:\Windows\System\tbaLIJi.exe
  C:\Windows\System\tbaLIJi.exe
  2⤵
  PID:8512
- C:\Windows\System\XBfreWL.exe
  C:\Windows\System\XBfreWL.exe
  2⤵
  PID:8544
- C:\Windows\System\GVahqdx.exe
  C:\Windows\System\GVahqdx.exe
  2⤵
  PID:8572
- C:\Windows\System\rscScca.exe
  C:\Windows\System\rscScca.exe
  2⤵
  PID:8588
- C:\Windows\System\KcgOiND.exe
  C:\Windows\System\KcgOiND.exe
  2⤵
  PID:8620
- C:\Windows\System\UqNnguT.exe
  C:\Windows\System\UqNnguT.exe
  2⤵
  PID:8656
- C:\Windows\System\dmECniC.exe
  C:\Windows\System\dmECniC.exe
  2⤵
  PID:8672
- C:\Windows\System\lZBmmxL.exe
  C:\Windows\System\lZBmmxL.exe
  2⤵
  PID:8700
- C:\Windows\System\aPvgEEo.exe
  C:\Windows\System\aPvgEEo.exe
  2⤵
  PID:8720
- C:\Windows\System\NuUDXNa.exe
  C:\Windows\System\NuUDXNa.exe
  2⤵
  PID:8756
- C:\Windows\System\wKMIdet.exe
  C:\Windows\System\wKMIdet.exe
  2⤵
  PID:8784
- C:\Windows\System\DbqKqqV.exe
  C:\Windows\System\DbqKqqV.exe
  2⤵
  PID:8816
- C:\Windows\System\zfbxuUc.exe
  C:\Windows\System\zfbxuUc.exe
  2⤵
  PID:8840
- C:\Windows\System\QomQSZW.exe
  C:\Windows\System\QomQSZW.exe
  2⤵
  PID:8880
- C:\Windows\System\DRMEtpj.exe
  C:\Windows\System\DRMEtpj.exe
  2⤵
  PID:8896
- C:\Windows\System\Tvhnjrc.exe
  C:\Windows\System\Tvhnjrc.exe
  2⤵
  PID:8916
- C:\Windows\System\VumLBoa.exe
  C:\Windows\System\VumLBoa.exe
  2⤵
  PID:8956
- C:\Windows\System\yNheAWm.exe
  C:\Windows\System\yNheAWm.exe
  2⤵
  PID:8976
- C:\Windows\System\AxqPcSE.exe
  C:\Windows\System\AxqPcSE.exe
  2⤵
  PID:9008
- C:\Windows\System\ucRINEU.exe
  C:\Windows\System\ucRINEU.exe
  2⤵
  PID:9048
- C:\Windows\System\ZpxPVsc.exe
  C:\Windows\System\ZpxPVsc.exe
  2⤵
  PID:9064
- C:\Windows\System\wijRdEz.exe
  C:\Windows\System\wijRdEz.exe
  2⤵
  PID:9092
- C:\Windows\System\XKouyrd.exe
  C:\Windows\System\XKouyrd.exe
  2⤵
  PID:9120
- C:\Windows\System\rJlPmCG.exe
  C:\Windows\System\rJlPmCG.exe
  2⤵
  PID:9160
- C:\Windows\System\mqLoLdS.exe
  C:\Windows\System\mqLoLdS.exe
  2⤵
  PID:9192
- C:\Windows\System\OtSbSTx.exe
  C:\Windows\System\OtSbSTx.exe
  2⤵
  PID:9208
- C:\Windows\System\NChnbSw.exe
  C:\Windows\System\NChnbSw.exe
  2⤵
  PID:8272
- C:\Windows\System\LXvFSZW.exe
  C:\Windows\System\LXvFSZW.exe
  2⤵
  PID:8348
- C:\Windows\System\MibhpmE.exe
  C:\Windows\System\MibhpmE.exe
  2⤵
  PID:8368
- C:\Windows\System\dHcUxLW.exe
  C:\Windows\System\dHcUxLW.exe
  2⤵
  PID:8496
- C:\Windows\System\pjcDJTB.exe
  C:\Windows\System\pjcDJTB.exe
  2⤵
  PID:8568
- C:\Windows\System\ApYtSZx.exe
  C:\Windows\System\ApYtSZx.exe
  2⤵
  PID:8640
- C:\Windows\System\wZMMZui.exe
  C:\Windows\System\wZMMZui.exe
  2⤵
  PID:8664
- C:\Windows\System\EfKfSDO.exe
  C:\Windows\System\EfKfSDO.exe
  2⤵
  PID:8744
- C:\Windows\System\iQVCVKe.exe
  C:\Windows\System\iQVCVKe.exe
  2⤵
  PID:8804
- C:\Windows\System\zGHdFfL.exe
  C:\Windows\System\zGHdFfL.exe
  2⤵
  PID:8864
- C:\Windows\System\YXhMPov.exe
  C:\Windows\System\YXhMPov.exe
  2⤵
  PID:8940
- C:\Windows\System\pyrMIFg.exe
  C:\Windows\System\pyrMIFg.exe
  2⤵
  PID:8968
- C:\Windows\System\AbuNtuc.exe
  C:\Windows\System\AbuNtuc.exe
  2⤵
  PID:9028
- C:\Windows\System\oLRaTuR.exe
  C:\Windows\System\oLRaTuR.exe
  2⤵
  PID:9084
- C:\Windows\System\LTPgNjy.exe
  C:\Windows\System\LTPgNjy.exe
  2⤵
  PID:9204
- C:\Windows\System\aWzEeXl.exe
  C:\Windows\System\aWzEeXl.exe
  2⤵
  PID:8284
- C:\Windows\System\AclGFVW.exe
  C:\Windows\System\AclGFVW.exe
  2⤵
  PID:8468
- C:\Windows\System\agafBoX.exe
  C:\Windows\System\agafBoX.exe
  2⤵
  PID:8740
- C:\Windows\System\ppFGckB.exe
  C:\Windows\System\ppFGckB.exe
  2⤵
  PID:8888
- C:\Windows\System\duJLXJB.exe
  C:\Windows\System\duJLXJB.exe
  2⤵
  PID:3156
- C:\Windows\System\dyMdgoi.exe
  C:\Windows\System\dyMdgoi.exe
  2⤵
  PID:9180
- C:\Windows\System\yFjkhlV.exe
  C:\Windows\System\yFjkhlV.exe
  2⤵
  PID:8296
- C:\Windows\System\bSOvlUH.exe
  C:\Windows\System\bSOvlUH.exe
  2⤵
  PID:8684
- C:\Windows\System\MGatiHu.exe
  C:\Windows\System\MGatiHu.exe
  2⤵
  PID:8316
- C:\Windows\System\IDLgtqj.exe
  C:\Windows\System\IDLgtqj.exe
  2⤵
  PID:1748
- C:\Windows\System\NNXyONz.exe
  C:\Windows\System\NNXyONz.exe
  2⤵
  PID:8312
- C:\Windows\System\BtjZZpf.exe
  C:\Windows\System\BtjZZpf.exe
  2⤵
  PID:8892
- C:\Windows\System\DZCLIir.exe
  C:\Windows\System\DZCLIir.exe
  2⤵
  PID:9244
- C:\Windows\System\pFocXXt.exe
  C:\Windows\System\pFocXXt.exe
  2⤵
  PID:9280
- C:\Windows\System\FzqoXDH.exe
  C:\Windows\System\FzqoXDH.exe
  2⤵
  PID:9308
- C:\Windows\System\WFXbtEA.exe
  C:\Windows\System\WFXbtEA.exe
  2⤵
  PID:9328
- C:\Windows\System\OEIOVNy.exe
  C:\Windows\System\OEIOVNy.exe
  2⤵
  PID:9352
- C:\Windows\System\XHhaSbE.exe
  C:\Windows\System\XHhaSbE.exe
  2⤵
  PID:9380
- C:\Windows\System\iOXLRZk.exe
  C:\Windows\System\iOXLRZk.exe
  2⤵
  PID:9416
- C:\Windows\System\tziHHiu.exe
  C:\Windows\System\tziHHiu.exe
  2⤵
  PID:9452
- C:\Windows\System\jaGFFbc.exe
  C:\Windows\System\jaGFFbc.exe
  2⤵
  PID:9488
- C:\Windows\System\hyehXkS.exe
  C:\Windows\System\hyehXkS.exe
  2⤵
  PID:9504
- C:\Windows\System\RXlkvch.exe
  C:\Windows\System\RXlkvch.exe
  2⤵
  PID:9524
- C:\Windows\System\EKfsZTO.exe
  C:\Windows\System\EKfsZTO.exe
  2⤵
  PID:9564
- C:\Windows\System\SEoheXq.exe
  C:\Windows\System\SEoheXq.exe
  2⤵
  PID:9596
- C:\Windows\System\dBfzzhi.exe
  C:\Windows\System\dBfzzhi.exe
  2⤵
  PID:9616
- C:\Windows\System\aKtibES.exe
  C:\Windows\System\aKtibES.exe
  2⤵
  PID:9640
- C:\Windows\System\zJAlvAe.exe
  C:\Windows\System\zJAlvAe.exe
  2⤵
  PID:9688
- C:\Windows\System\siRdapn.exe
  C:\Windows\System\siRdapn.exe
  2⤵
  PID:9724
- C:\Windows\System\HRIDUxM.exe
  C:\Windows\System\HRIDUxM.exe
  2⤵
  PID:9740
- C:\Windows\System\CPnOyLT.exe
  C:\Windows\System\CPnOyLT.exe
  2⤵
  PID:9768
- C:\Windows\System\ArssRro.exe
  C:\Windows\System\ArssRro.exe
  2⤵
  PID:9812
- C:\Windows\System\ojwsZDM.exe
  C:\Windows\System\ojwsZDM.exe
  2⤵
  PID:9828
- C:\Windows\System\jDlDvId.exe
  C:\Windows\System\jDlDvId.exe
  2⤵
  PID:9860
- C:\Windows\System\JlzIqWd.exe
  C:\Windows\System\JlzIqWd.exe
  2⤵
  PID:9892
- C:\Windows\System\mmxCuZM.exe
  C:\Windows\System\mmxCuZM.exe
  2⤵
  PID:9928
- C:\Windows\System\wEuygAo.exe
  C:\Windows\System\wEuygAo.exe
  2⤵
  PID:9952
- C:\Windows\System\muPAMOP.exe
  C:\Windows\System\muPAMOP.exe
  2⤵
  PID:9980
- C:\Windows\System\mhcGpCx.exe
  C:\Windows\System\mhcGpCx.exe
  2⤵
  PID:10016
- C:\Windows\System\CNgUuLy.exe
  C:\Windows\System\CNgUuLy.exe
  2⤵
  PID:10036
- C:\Windows\System\yobIDcp.exe
  C:\Windows\System\yobIDcp.exe
  2⤵
  PID:10056
- C:\Windows\System\KFeVymK.exe
  C:\Windows\System\KFeVymK.exe
  2⤵
  PID:10076
- C:\Windows\System\lzSMnEf.exe
  C:\Windows\System\lzSMnEf.exe
  2⤵
  PID:10112
- C:\Windows\System\lWJLLkY.exe
  C:\Windows\System\lWJLLkY.exe
  2⤵
  PID:10168
- C:\Windows\System\yyxrSfL.exe
  C:\Windows\System\yyxrSfL.exe
  2⤵
  PID:10188
- C:\Windows\System\MRjhVFZ.exe
  C:\Windows\System\MRjhVFZ.exe
  2⤵
  PID:10216
- C:\Windows\System\sYXLUOo.exe
  C:\Windows\System\sYXLUOo.exe
  2⤵
  PID:9228
- C:\Windows\System\ajOoheD.exe
  C:\Windows\System\ajOoheD.exe
  2⤵
  PID:9268
- C:\Windows\System\qVNsRiZ.exe
  C:\Windows\System\qVNsRiZ.exe
  2⤵
  PID:9372
- C:\Windows\System\hWjhAzs.exe
  C:\Windows\System\hWjhAzs.exe
  2⤵
  PID:9436
- C:\Windows\System\qmivZfK.exe
  C:\Windows\System\qmivZfK.exe
  2⤵
  PID:9588
- C:\Windows\System\zbezAhf.exe
  C:\Windows\System\zbezAhf.exe
  2⤵
  PID:9604
- C:\Windows\System\uudkOlc.exe
  C:\Windows\System\uudkOlc.exe
  2⤵
  PID:9712
- C:\Windows\System\ZetAIKf.exe
  C:\Windows\System\ZetAIKf.exe
  2⤵
  PID:9780
- C:\Windows\System\ERomcOR.exe
  C:\Windows\System\ERomcOR.exe
  2⤵
  PID:9884
- C:\Windows\System\YnZHUkQ.exe
  C:\Windows\System\YnZHUkQ.exe
  2⤵
  PID:9916
- C:\Windows\System\mmLvuAL.exe
  C:\Windows\System\mmLvuAL.exe
  2⤵
  PID:10024
- C:\Windows\System\kWZlKRw.exe
  C:\Windows\System\kWZlKRw.exe
  2⤵
  PID:10072
- C:\Windows\System\kaSqrlz.exe
  C:\Windows\System\kaSqrlz.exe
  2⤵
  PID:10200
- C:\Windows\System\kGpRITe.exe
  C:\Windows\System\kGpRITe.exe
  2⤵
  PID:9264
- C:\Windows\System\LjJesui.exe
  C:\Windows\System\LjJesui.exe
  2⤵
  PID:9612
- C:\Windows\System\uHfcflM.exe
  C:\Windows\System\uHfcflM.exe
  2⤵
  PID:9840
- C:\Windows\System\jqNaBGn.exe
  C:\Windows\System\jqNaBGn.exe
  2⤵
  PID:9844
- C:\Windows\System\TYqEJIx.exe
  C:\Windows\System\TYqEJIx.exe
  2⤵
  PID:10144
- C:\Windows\System\vspprQC.exe
  C:\Windows\System\vspprQC.exe
  2⤵
  PID:9392
- C:\Windows\System\gSrlNAM.exe
  C:\Windows\System\gSrlNAM.exe
  2⤵
  PID:9316
- C:\Windows\System\QOBbpgF.exe
  C:\Windows\System\QOBbpgF.exe
  2⤵
  PID:10248
- C:\Windows\System\OwFWCbw.exe
  C:\Windows\System\OwFWCbw.exe
  2⤵
  PID:10272
- C:\Windows\System\tdNHlIY.exe
  C:\Windows\System\tdNHlIY.exe
  2⤵
  PID:10300
- C:\Windows\System\GxixOkG.exe
  C:\Windows\System\GxixOkG.exe
  2⤵
  PID:10324
- C:\Windows\System\QCmtgcK.exe
  C:\Windows\System\QCmtgcK.exe
  2⤵
  PID:10372
- C:\Windows\System\bekyzAZ.exe
  C:\Windows\System\bekyzAZ.exe
  2⤵
  PID:10424
- C:\Windows\System\wCsdqyr.exe
  C:\Windows\System\wCsdqyr.exe
  2⤵
  PID:10456
- C:\Windows\System\ZSWTzPS.exe
  C:\Windows\System\ZSWTzPS.exe
  2⤵
  PID:10472
- C:\Windows\System\qBueHla.exe
  C:\Windows\System\qBueHla.exe
  2⤵
  PID:10504
- C:\Windows\System\sROtfVr.exe
  C:\Windows\System\sROtfVr.exe
  2⤵
  PID:10540
- C:\Windows\System\uNdUbma.exe
  C:\Windows\System\uNdUbma.exe
  2⤵
  PID:10568
- C:\Windows\System\uvYqDKK.exe
  C:\Windows\System\uvYqDKK.exe
  2⤵
  PID:10600
- C:\Windows\System\DkdEvlM.exe
  C:\Windows\System\DkdEvlM.exe
  2⤵
  PID:10616
- C:\Windows\System\sAMgyoU.exe
  C:\Windows\System\sAMgyoU.exe
  2⤵
  PID:10656
- C:\Windows\System\YKevozW.exe
  C:\Windows\System\YKevozW.exe
  2⤵
  PID:10672
- C:\Windows\System\wINjNeH.exe
  C:\Windows\System\wINjNeH.exe
  2⤵
  PID:10692
- C:\Windows\System\wdbjVbx.exe
  C:\Windows\System\wdbjVbx.exe
  2⤵
  PID:10712
- C:\Windows\System\tMmorjT.exe
  C:\Windows\System\tMmorjT.exe
  2⤵
  PID:10756
- C:\Windows\System\QTjyOFP.exe
  C:\Windows\System\QTjyOFP.exe
  2⤵
  PID:10788
- C:\Windows\System\fHefRen.exe
  C:\Windows\System\fHefRen.exe
  2⤵
  PID:10816
- C:\Windows\System\IKRGhZG.exe
  C:\Windows\System\IKRGhZG.exe
  2⤵
  PID:10844
- C:\Windows\System\coQxJdp.exe
  C:\Windows\System\coQxJdp.exe
  2⤵
  PID:10880
- C:\Windows\System\tSNznds.exe
  C:\Windows\System\tSNznds.exe
  2⤵
  PID:10908
- C:\Windows\System\LOfIogs.exe
  C:\Windows\System\LOfIogs.exe
  2⤵
  PID:10940
- C:\Windows\System\RNizRGq.exe
  C:\Windows\System\RNizRGq.exe
  2⤵
  PID:10956
- C:\Windows\System\LLkjEmu.exe
  C:\Windows\System\LLkjEmu.exe
  2⤵
  PID:10992
- C:\Windows\System\HoEmDwr.exe
  C:\Windows\System\HoEmDwr.exe
  2⤵
  PID:11008
- C:\Windows\System\NBRVvWq.exe
  C:\Windows\System\NBRVvWq.exe
  2⤵
  PID:11036
- C:\Windows\System\uStpams.exe
  C:\Windows\System\uStpams.exe
  2⤵
  PID:11056
- C:\Windows\System\GqNAEHb.exe
  C:\Windows\System\GqNAEHb.exe
  2⤵
  PID:11092
- C:\Windows\System\zXcSYPk.exe
  C:\Windows\System\zXcSYPk.exe
  2⤵
  PID:11136
- C:\Windows\System\siNhURC.exe
  C:\Windows\System\siNhURC.exe
  2⤵
  PID:11180
- C:\Windows\System\qnWmHgQ.exe
  C:\Windows\System\qnWmHgQ.exe
  2⤵
  PID:11196
- C:\Windows\System\kXvWKBh.exe
  C:\Windows\System\kXvWKBh.exe
  2⤵
  PID:11224
- C:\Windows\System\XCdCPfw.exe
  C:\Windows\System\XCdCPfw.exe
  2⤵
  PID:11240
- C:\Windows\System\MbXtNRX.exe
  C:\Windows\System\MbXtNRX.exe
  2⤵
  PID:10260
- C:\Windows\System\vIPQYQX.exe
  C:\Windows\System\vIPQYQX.exe
  2⤵
  PID:10316
- C:\Windows\System\TEOaxrR.exe
  C:\Windows\System\TEOaxrR.exe
  2⤵
  PID:10452
- C:\Windows\System\RceqIHX.exe
  C:\Windows\System\RceqIHX.exe
  2⤵
  PID:10500
- C:\Windows\System\GvtVwXe.exe
  C:\Windows\System\GvtVwXe.exe
  2⤵
  PID:10592
- C:\Windows\System\LNQYraB.exe
  C:\Windows\System\LNQYraB.exe
  2⤵
  PID:10644
- C:\Windows\System\rxPApkd.exe
  C:\Windows\System\rxPApkd.exe
  2⤵
  PID:10744
- C:\Windows\System\PnGGENg.exe
  C:\Windows\System\PnGGENg.exe
  2⤵
  PID:10800
- C:\Windows\System\BrQkdRF.exe
  C:\Windows\System\BrQkdRF.exe
  2⤵
  PID:10892
- C:\Windows\System\XZQjmjw.exe
  C:\Windows\System\XZQjmjw.exe
  2⤵
  PID:10980
- C:\Windows\System\uwWiUBy.exe
  C:\Windows\System\uwWiUBy.exe
  2⤵
  PID:1572
- C:\Windows\System\xxGIbXA.exe
  C:\Windows\System\xxGIbXA.exe
  2⤵
  PID:11076
- C:\Windows\System\sIByWsJ.exe
  C:\Windows\System\sIByWsJ.exe
  2⤵
  PID:11112
- C:\Windows\System\QhKFCuN.exe
  C:\Windows\System\QhKFCuN.exe
  2⤵
  PID:11188
- C:\Windows\System\EsvPqrS.exe
  C:\Windows\System\EsvPqrS.exe
  2⤵
  PID:9668
- C:\Windows\System\xCxSkrr.exe
  C:\Windows\System\xCxSkrr.exe
  2⤵
  PID:10448
- C:\Windows\System\uRoeKDb.exe
  C:\Windows\System\uRoeKDb.exe
  2⤵
  PID:10564
- C:\Windows\System\RWQdqvi.exe
  C:\Windows\System\RWQdqvi.exe
  2⤵
  PID:10836
- C:\Windows\System\YJHyYjU.exe
  C:\Windows\System\YJHyYjU.exe
  2⤵
  PID:10924
- C:\Windows\System\hcJMFfK.exe
  C:\Windows\System\hcJMFfK.exe
  2⤵
  PID:11148
- C:\Windows\System\NGxEHAm.exe
  C:\Windows\System\NGxEHAm.exe
  2⤵
  PID:11176
- C:\Windows\System\ZmSvsWe.exe
  C:\Windows\System\ZmSvsWe.exe
  2⤵
  PID:10320
- C:\Windows\System\LshUhZr.exe
  C:\Windows\System\LshUhZr.exe
  2⤵
  PID:1688
- C:\Windows\System\HCVTTmx.exe
  C:\Windows\System\HCVTTmx.exe
  2⤵
  PID:11052
- C:\Windows\System\IWYELjL.exe
  C:\Windows\System\IWYELjL.exe
  2⤵
  PID:4604
- C:\Windows\System\DDrsvmH.exe
  C:\Windows\System\DDrsvmH.exe
  2⤵
  PID:11084
- C:\Windows\System\zpGIzPY.exe
  C:\Windows\System\zpGIzPY.exe
  2⤵
  PID:11284
- C:\Windows\System\NaYbtHe.exe
  C:\Windows\System\NaYbtHe.exe
  2⤵
  PID:11304
- C:\Windows\System\GllypGs.exe
  C:\Windows\System\GllypGs.exe
  2⤵
  PID:11328
- C:\Windows\System\hckMMjC.exe
  C:\Windows\System\hckMMjC.exe
  2⤵
  PID:11356
- C:\Windows\System\JuZdYVE.exe
  C:\Windows\System\JuZdYVE.exe
  2⤵
  PID:11384
- C:\Windows\System\PmUJoGR.exe
  C:\Windows\System\PmUJoGR.exe
  2⤵
  PID:11412
- C:\Windows\System\mEASORK.exe
  C:\Windows\System\mEASORK.exe
  2⤵
  PID:11448
- C:\Windows\System\ZEgUnSV.exe
  C:\Windows\System\ZEgUnSV.exe
  2⤵
  PID:11480
- C:\Windows\System\kwTaTVh.exe
  C:\Windows\System\kwTaTVh.exe
  2⤵
  PID:11508
- C:\Windows\System\zFjKUma.exe
  C:\Windows\System\zFjKUma.exe
  2⤵
  PID:11536
- C:\Windows\System\EKhxZCu.exe
  C:\Windows\System\EKhxZCu.exe
  2⤵
  PID:11564
- C:\Windows\System\qlPeaGD.exe
  C:\Windows\System\qlPeaGD.exe
  2⤵
  PID:11584
- C:\Windows\System\lXkYlYx.exe
  C:\Windows\System\lXkYlYx.exe
  2⤵
  PID:11608
- C:\Windows\System\gXUHfPd.exe
  C:\Windows\System\gXUHfPd.exe
  2⤵
  PID:11648
- C:\Windows\System\DpJAUPr.exe
  C:\Windows\System\DpJAUPr.exe
  2⤵
  PID:11676
- C:\Windows\System\nKADvTr.exe
  C:\Windows\System\nKADvTr.exe
  2⤵
  PID:11704
- C:\Windows\System\ibbiFlb.exe
  C:\Windows\System\ibbiFlb.exe
  2⤵
  PID:11732
- C:\Windows\System\RkRolKw.exe
  C:\Windows\System\RkRolKw.exe
  2⤵
  PID:11756
- C:\Windows\System\QbNjlxe.exe
  C:\Windows\System\QbNjlxe.exe
  2⤵
  PID:11788
- C:\Windows\System\nrnYPbG.exe
  C:\Windows\System\nrnYPbG.exe
  2⤵
  PID:11816
- C:\Windows\System\crVEsrF.exe
  C:\Windows\System\crVEsrF.exe
  2⤵
  PID:11832
- C:\Windows\System\OaDmAqO.exe
  C:\Windows\System\OaDmAqO.exe
  2⤵
  PID:11872
- C:\Windows\System\yYzxumD.exe
  C:\Windows\System\yYzxumD.exe
  2⤵
  PID:11888
- C:\Windows\System\VKlbvOH.exe
  C:\Windows\System\VKlbvOH.exe
  2⤵
  PID:11916
- C:\Windows\System\ohDvCyD.exe
  C:\Windows\System\ohDvCyD.exe
  2⤵
  PID:11940
- C:\Windows\System\cocqnwC.exe
  C:\Windows\System\cocqnwC.exe
  2⤵
  PID:11960
- C:\Windows\System\mQLwBzz.exe
  C:\Windows\System\mQLwBzz.exe
  2⤵
  PID:11988
- C:\Windows\System\vSRBZdg.exe
  C:\Windows\System\vSRBZdg.exe
  2⤵
  PID:12036
- C:\Windows\System\RsjsVAr.exe
  C:\Windows\System\RsjsVAr.exe
  2⤵
  PID:12068
- C:\Windows\System\kIaiUCh.exe
  C:\Windows\System\kIaiUCh.exe
  2⤵
  PID:12100
- C:\Windows\System\bQMXgoH.exe
  C:\Windows\System\bQMXgoH.exe
  2⤵
  PID:12128
- C:\Windows\System\ncpfWwj.exe
  C:\Windows\System\ncpfWwj.exe
  2⤵
  PID:12144
- C:\Windows\System\dJEVJhE.exe
  C:\Windows\System\dJEVJhE.exe
  2⤵
  PID:12180
- C:\Windows\System\DvNEChr.exe
  C:\Windows\System\DvNEChr.exe
  2⤵
  PID:12212
- C:\Windows\System\vegWulD.exe
  C:\Windows\System\vegWulD.exe
  2⤵
  PID:12228
- C:\Windows\System\goGhXfX.exe
  C:\Windows\System\goGhXfX.exe
  2⤵
  PID:12256
- C:\Windows\System\MVgErmM.exe
  C:\Windows\System\MVgErmM.exe
  2⤵
  PID:11276
- C:\Windows\System\QFUuFOe.exe
  C:\Windows\System\QFUuFOe.exe
  2⤵
  PID:11316
- C:\Windows\System\PIRigtO.exe
  C:\Windows\System\PIRigtO.exe
  2⤵
  PID:11344
- C:\Windows\System\WdhRjSy.exe
  C:\Windows\System\WdhRjSy.exe
  2⤵
  PID:11368
- C:\Windows\System\gHmAOFW.exe
  C:\Windows\System\gHmAOFW.exe
  2⤵
  PID:11464
- C:\Windows\System\RGFVrJU.exe
  C:\Windows\System\RGFVrJU.exe
  2⤵
  PID:11532
- C:\Windows\System\AWfoiKO.exe
  C:\Windows\System\AWfoiKO.exe
  2⤵
  PID:11596
- C:\Windows\System\iqfNBOG.exe
  C:\Windows\System\iqfNBOG.exe
  2⤵
  PID:11700
- C:\Windows\System\DeJRkzo.exe
  C:\Windows\System\DeJRkzo.exe
  2⤵
  PID:11780
- C:\Windows\System\hiWNZrq.exe
  C:\Windows\System\hiWNZrq.exe
  2⤵
  PID:11848
- C:\Windows\System\bxJhUrL.exe
  C:\Windows\System\bxJhUrL.exe
  2⤵
  PID:11932
- C:\Windows\System\cEctgrs.exe
  C:\Windows\System\cEctgrs.exe
  2⤵
  PID:11972
- C:\Windows\System\uJbkCVh.exe
  C:\Windows\System\uJbkCVh.exe
  2⤵
  PID:12048
- C:\Windows\System\hNEqAdG.exe
  C:\Windows\System\hNEqAdG.exe
  2⤵
  PID:2220
- C:\Windows\System\ggVFHRD.exe
  C:\Windows\System\ggVFHRD.exe
  2⤵
  PID:12140
- C:\Windows\System\jPLYtPX.exe
  C:\Windows\System\jPLYtPX.exe
  2⤵
  PID:12208
- C:\Windows\System\PMoWQmb.exe
  C:\Windows\System\PMoWQmb.exe
  2⤵
  PID:11268
- C:\Windows\System\TswzCsI.exe
  C:\Windows\System\TswzCsI.exe
  2⤵
  PID:11348
- C:\Windows\System\LknEuiH.exe
  C:\Windows\System\LknEuiH.exe
  2⤵
  PID:11572
- C:\Windows\System\VCHcgQd.exe
  C:\Windows\System\VCHcgQd.exe
  2⤵
  PID:11692
- C:\Windows\System\YqWLjJw.exe
  C:\Windows\System\YqWLjJw.exe
  2⤵
  PID:11956
- C:\Windows\System\oyMBxQd.exe
  C:\Windows\System\oyMBxQd.exe
  2⤵
  PID:12120
- C:\Windows\System\AQYsgDe.exe
  C:\Windows\System\AQYsgDe.exe
  2⤵
  PID:12188
- C:\Windows\System\pawlnAU.exe
  C:\Windows\System\pawlnAU.exe
  2⤵
  PID:11292
- C:\Windows\System\kPfTyXU.exe
  C:\Windows\System\kPfTyXU.exe
  2⤵
  PID:12112
- C:\Windows\System\Bixyfei.exe
  C:\Windows\System\Bixyfei.exe
  2⤵
  PID:11496
- C:\Windows\System\qBDBJOW.exe
  C:\Windows\System\qBDBJOW.exe
  2⤵
  PID:11952
- C:\Windows\System\mpxxmqI.exe
  C:\Windows\System\mpxxmqI.exe
  2⤵
  PID:12296
- C:\Windows\System\HuoZbgN.exe
  C:\Windows\System\HuoZbgN.exe
  2⤵
  PID:12316
- C:\Windows\System\mAoGaAN.exe
  C:\Windows\System\mAoGaAN.exe
  2⤵
  PID:12340
- C:\Windows\System\biJSIRc.exe
  C:\Windows\System\biJSIRc.exe
  2⤵
  PID:12372
- C:\Windows\System\LhsRhHq.exe
  C:\Windows\System\LhsRhHq.exe
  2⤵
  PID:12404
- C:\Windows\System\tprrnfV.exe
  C:\Windows\System\tprrnfV.exe
  2⤵
  PID:12460
- C:\Windows\System\vkqZDtj.exe
  C:\Windows\System\vkqZDtj.exe
  2⤵
  PID:12484
- C:\Windows\System\HfggMcI.exe
  C:\Windows\System\HfggMcI.exe
  2⤵
  PID:12524
- C:\Windows\System\nDyOmjl.exe
  C:\Windows\System\nDyOmjl.exe
  2⤵
  PID:12552
- C:\Windows\System\dXzmCjp.exe
  C:\Windows\System\dXzmCjp.exe
  2⤵
  PID:12584
- C:\Windows\System\rQQkQkF.exe
  C:\Windows\System\rQQkQkF.exe
  2⤵
  PID:12624
- C:\Windows\System\ZIKOjmD.exe
  C:\Windows\System\ZIKOjmD.exe
  2⤵
  PID:12648
- C:\Windows\System\TpVvQog.exe
  C:\Windows\System\TpVvQog.exe
  2⤵
  PID:12668
- C:\Windows\System\ZOxecTo.exe
  C:\Windows\System\ZOxecTo.exe
  2⤵
  PID:12696
- C:\Windows\System\cDFwujy.exe
  C:\Windows\System\cDFwujy.exe
  2⤵
  PID:12736
- C:\Windows\System\MvgqERA.exe
  C:\Windows\System\MvgqERA.exe
  2⤵
  PID:12764
- C:\Windows\System\KJVZfxa.exe
  C:\Windows\System\KJVZfxa.exe
  2⤵
  PID:12792
- C:\Windows\System\hunwpAJ.exe
  C:\Windows\System\hunwpAJ.exe
  2⤵
  PID:12820
- C:\Windows\System\TZBCwPa.exe
  C:\Windows\System\TZBCwPa.exe
  2⤵
  PID:12844
- C:\Windows\System\lPfNdXf.exe
  C:\Windows\System\lPfNdXf.exe
  2⤵
  PID:12872
- C:\Windows\System\yJBVkdG.exe
  C:\Windows\System\yJBVkdG.exe
  2⤵
  PID:12908
- C:\Windows\System\onISIDd.exe
  C:\Windows\System\onISIDd.exe
  2⤵
  PID:12936
- C:\Windows\System\jTpUGPn.exe
  C:\Windows\System\jTpUGPn.exe
  2⤵
  PID:12964
- C:\Windows\System\pkJshfT.exe
  C:\Windows\System\pkJshfT.exe
  2⤵
  PID:12992
- C:\Windows\System\rIvrViX.exe
  C:\Windows\System\rIvrViX.exe
  2⤵
  PID:13024
- C:\Windows\System\QHmGmgI.exe
  C:\Windows\System\QHmGmgI.exe
  2⤵
  PID:13040
- C:\Windows\System\SizKgiW.exe
  C:\Windows\System\SizKgiW.exe
  2⤵
  PID:13056
- C:\Windows\System\IlNSatT.exe
  C:\Windows\System\IlNSatT.exe
  2⤵
  PID:13100
- C:\Windows\System\Cctnbih.exe
  C:\Windows\System\Cctnbih.exe
  2⤵
  PID:13124
- C:\Windows\System\hddUHCe.exe
  C:\Windows\System\hddUHCe.exe
  2⤵
  PID:13152
- C:\Windows\System\kZTtqog.exe
  C:\Windows\System\kZTtqog.exe
  2⤵
  PID:13192
- C:\Windows\System\mSjiUsz.exe
  C:\Windows\System\mSjiUsz.exe
  2⤵
  PID:13212
- C:\Windows\System\zDBXmyq.exe
  C:\Windows\System\zDBXmyq.exe
  2⤵
  PID:13248
- C:\Windows\System\HwoyhNF.exe
  C:\Windows\System\HwoyhNF.exe
  2⤵
  PID:13276
- C:\Windows\System\HOYvVkO.exe
  C:\Windows\System\HOYvVkO.exe
  2⤵
  PID:13292
- C:\Windows\System\dMuxABb.exe
  C:\Windows\System\dMuxABb.exe
  2⤵
  PID:12332
- C:\Windows\System\KxzFlos.exe
  C:\Windows\System\KxzFlos.exe
  2⤵
  PID:12348
- C:\Windows\System\WtxxHOw.exe
  C:\Windows\System\WtxxHOw.exe
  2⤵
  PID:12480
- C:\Windows\System\cmFzwAI.exe
  C:\Windows\System\cmFzwAI.exe
  2⤵
  PID:12508
- C:\Windows\System\OgfoBjc.exe
  C:\Windows\System\OgfoBjc.exe
  2⤵
  PID:12580
- C:\Windows\System\vHKYiLW.exe
  C:\Windows\System\vHKYiLW.exe
  2⤵
  PID:12684
- C:\Windows\System\JFLuekM.exe
  C:\Windows\System\JFLuekM.exe
  2⤵
  PID:12752
- C:\Windows\System\JpONEPE.exe
  C:\Windows\System\JpONEPE.exe
  2⤵
  PID:12804
- C:\Windows\System\kqIyASz.exe
  C:\Windows\System\kqIyASz.exe
  2⤵
  PID:12856
- C:\Windows\System\VskKCwm.exe
  C:\Windows\System\VskKCwm.exe
  2⤵
  PID:12924
- C:\Windows\System\ikykOJP.exe
  C:\Windows\System\ikykOJP.exe
  2⤵
  PID:12988
- C:\Windows\System\iWtaLll.exe
  C:\Windows\System\iWtaLll.exe
  2⤵
  PID:13048
- C:\Windows\System\cXodJuZ.exe
  C:\Windows\System\cXodJuZ.exe
  2⤵
  PID:13068
- C:\Windows\System\MFraqmC.exe
  C:\Windows\System\MFraqmC.exe
  2⤵
  PID:13148
- C:\Windows\System\aNFuOLr.exe
  C:\Windows\System\aNFuOLr.exe
  2⤵
  PID:13232
- C:\Windows\System\UsSoeok.exe
  C:\Windows\System\UsSoeok.exe
  2⤵
  PID:12336
- C:\Windows\System\jBxvhJK.exe
  C:\Windows\System\jBxvhJK.exe
  2⤵
  PID:12396
- C:\Windows\System\SBRsbdx.exe
  C:\Windows\System\SBRsbdx.exe
  2⤵
  PID:12596
- C:\Windows\System\FJAkrTd.exe
  C:\Windows\System\FJAkrTd.exe
  2⤵
  PID:12836
- C:\Windows\System\bDuOshx.exe
  C:\Windows\System\bDuOshx.exe
  2⤵
  PID:13136
- C:\Windows\System\UWwUzOW.exe
  C:\Windows\System\UWwUzOW.exe
  2⤵
  PID:2152
- C:\Windows\System\TOJAKoF.exe
  C:\Windows\System\TOJAKoF.exe
  2⤵
  PID:13268
- C:\Windows\System\gTqkkbD.exe
  C:\Windows\System\gTqkkbD.exe
  2⤵
  PID:13112
- C:\Windows\System\HLgzQaH.exe
  C:\Windows\System\HLgzQaH.exe
  2⤵
  PID:12308
- C:\Windows\System\krmYhJj.exe
  C:\Windows\System\krmYhJj.exe
  2⤵
  PID:12660
- C:\Windows\System\fFWYAEV.exe
  C:\Windows\System\fFWYAEV.exe
  2⤵
  PID:1532
- C:\Windows\System\vXZDfdj.exe
  C:\Windows\System\vXZDfdj.exe
  2⤵
  PID:13284
- C:\Windows\System\lQojueL.exe
  C:\Windows\System\lQojueL.exe
  2⤵
  PID:13176
- C:\Windows\System\NYUWJbr.exe
  C:\Windows\System\NYUWJbr.exe
  2⤵
  PID:13324
- C:\Windows\System\bhiogWy.exe
  C:\Windows\System\bhiogWy.exe
  2⤵
  PID:13352
- C:\Windows\System\ECObeuK.exe
  C:\Windows\System\ECObeuK.exe
  2⤵
  PID:13368
- C:\Windows\System\wNBpFmL.exe
  C:\Windows\System\wNBpFmL.exe
  2⤵
  PID:13396
- C:\Windows\System\ldpwQvS.exe
  C:\Windows\System\ldpwQvS.exe
  2⤵
  PID:13436
- C:\Windows\System\dGurAtR.exe
  C:\Windows\System\dGurAtR.exe
  2⤵
  PID:13464
- C:\Windows\System\sVxfBFQ.exe
  C:\Windows\System\sVxfBFQ.exe
  2⤵
  PID:13496
- C:\Windows\System\RoHcOPB.exe
  C:\Windows\System\RoHcOPB.exe
  2⤵
  PID:13516
- C:\Windows\System\sJVioZe.exe
  C:\Windows\System\sJVioZe.exe
  2⤵
  PID:13540
- C:\Windows\System\vFDHtIG.exe
  C:\Windows\System\vFDHtIG.exe
  2⤵
  PID:13556
- C:\Windows\System\aJhoeIX.exe
  C:\Windows\System\aJhoeIX.exe
  2⤵
  PID:13608
- C:\Windows\System\HONyrzr.exe
  C:\Windows\System\HONyrzr.exe
  2⤵
  PID:13628
- C:\Windows\System\BQnFFBt.exe
  C:\Windows\System\BQnFFBt.exe
  2⤵
  PID:13652
- C:\Windows\System\kAMZbgI.exe
  C:\Windows\System\kAMZbgI.exe
  2⤵
  PID:13692
- C:\Windows\System\yDKGyZE.exe
  C:\Windows\System\yDKGyZE.exe
  2⤵
  PID:13720
- C:\Windows\System\NgaVaaf.exe
  C:\Windows\System\NgaVaaf.exe
  2⤵
  PID:13748
- C:\Windows\System\mczaWpb.exe
  C:\Windows\System\mczaWpb.exe
  2⤵
  PID:13776
- C:\Windows\System\OCONcKW.exe
  C:\Windows\System\OCONcKW.exe
  2⤵
  PID:13792
- C:\Windows\System\PovPURy.exe
  C:\Windows\System\PovPURy.exe
  2⤵
  PID:13820
- C:\Windows\System\JmjcNNj.exe
  C:\Windows\System\JmjcNNj.exe
  2⤵
  PID:13860
- C:\Windows\System\NNALkpV.exe
  C:\Windows\System\NNALkpV.exe
  2⤵
  PID:13880
- C:\Windows\System\oPczOAp.exe
  C:\Windows\System\oPczOAp.exe
  2⤵
  PID:13912
- C:\Windows\System\GpJTdXZ.exe
  C:\Windows\System\GpJTdXZ.exe
  2⤵
  PID:13932
- C:\Windows\System\qJPBcoV.exe
  C:\Windows\System\qJPBcoV.exe
  2⤵
  PID:13972
- C:\Windows\System\kFQcVCx.exe
  C:\Windows\System\kFQcVCx.exe
  2⤵
  PID:14000
- C:\Windows\System\AAkxnaz.exe
  C:\Windows\System\AAkxnaz.exe
  2⤵
  PID:14028
- C:\Windows\System\wgjRkLl.exe
  C:\Windows\System\wgjRkLl.exe
  2⤵
  PID:14056
- C:\Windows\System\insugVK.exe
  C:\Windows\System\insugVK.exe
  2⤵
  PID:14084
- C:\Windows\System\cLHrfTg.exe
  C:\Windows\System\cLHrfTg.exe
  2⤵
  PID:14112
- C:\Windows\System\KNTijda.exe
  C:\Windows\System\KNTijda.exe
  2⤵
  PID:14140
- C:\Windows\System\TNOiEvd.exe
  C:\Windows\System\TNOiEvd.exe
  2⤵
  PID:14156
- C:\Windows\System\ZPwNPVU.exe
  C:\Windows\System\ZPwNPVU.exe
  2⤵
  PID:14196
- C:\Windows\System\IpQJRqW.exe
  C:\Windows\System\IpQJRqW.exe
  2⤵
  PID:14216
- C:\Windows\System\ZbrFTLz.exe
  C:\Windows\System\ZbrFTLz.exe
  2⤵
  PID:14240
- C:\Windows\System\RaJAaON.exe
  C:\Windows\System\RaJAaON.exe
  2⤵
  PID:14268
- C:\Windows\System\HxLDzls.exe
  C:\Windows\System\HxLDzls.exe
  2⤵
  PID:14296
- C:\Windows\System\wzLjepr.exe
  C:\Windows\System\wzLjepr.exe
  2⤵
  PID:14324
- C:\Windows\System\kSdBxOB.exe
  C:\Windows\System\kSdBxOB.exe
  2⤵
  PID:13336
- C:\Windows\System\OKAlEBV.exe
  C:\Windows\System\OKAlEBV.exe
  2⤵
  PID:13408
- C:\Windows\System\JNOUXhP.exe
  C:\Windows\System\JNOUXhP.exe
  2⤵
  PID:13448
- C:\Windows\System\eYfHBGN.exe
  C:\Windows\System\eYfHBGN.exe
  2⤵
  PID:13504
- C:\Windows\System\fvXaNUY.exe
  C:\Windows\System\fvXaNUY.exe
  2⤵
  PID:13640
- C:\Windows\System\uPJiTNA.exe
  C:\Windows\System\uPJiTNA.exe
  2⤵
  PID:13676
- C:\Windows\System\JjYtcIA.exe
  C:\Windows\System\JjYtcIA.exe
  2⤵
  PID:13740
- C:\Windows\System\yxYTuVy.exe
  C:\Windows\System\yxYTuVy.exe
  2⤵
  PID:13832
- C:\Windows\System\NdxowXC.exe
  C:\Windows\System\NdxowXC.exe
  2⤵
  PID:13904
- C:\Windows\System\eUFeQIk.exe
  C:\Windows\System\eUFeQIk.exe
  2⤵
  PID:13960
- C:\Windows\System\BtgVojl.exe
  C:\Windows\System\BtgVojl.exe
  2⤵
  PID:14024
- C:\Windows\System\ZIgTUPe.exe
  C:\Windows\System\ZIgTUPe.exe
  2⤵
  PID:14096
- C:\Windows\System\NPWlBip.exe
  C:\Windows\System\NPWlBip.exe
  2⤵
  PID:14132
- C:\Windows\System\TJhFcrc.exe
  C:\Windows\System\TJhFcrc.exe
  2⤵
  PID:14180
- C:\Windows\System\ETeDWqw.exe
  C:\Windows\System\ETeDWqw.exe
  2⤵
  PID:14260
- C:\Windows\System\YAokHcH.exe
  C:\Windows\System\YAokHcH.exe
  2⤵
  PID:14316
- C:\Windows\System\ZnEwilV.exe
  C:\Windows\System\ZnEwilV.exe
  2⤵
  PID:13380
- C:\Windows\System\swvouds.exe
  C:\Windows\System\swvouds.exe
  2⤵
  PID:13592
- C:\Windows\System\gQsUmmI.exe
  C:\Windows\System\gQsUmmI.exe
  2⤵
  PID:13768
- C:\Windows\System\KUicrEs.exe
  C:\Windows\System\KUicrEs.exe
  2⤵
  PID:13868
- C:\Windows\System\LJSwkQd.exe
  C:\Windows\System\LJSwkQd.exe
  2⤵
  PID:13992
- C:\Windows\System\UYYlTMt.exe
  C:\Windows\System\UYYlTMt.exe
  2⤵
  PID:14168
- C:\Windows\System\SEOyFql.exe
  C:\Windows\System\SEOyFql.exe
  2⤵
  PID:14288
- C:\Windows\System\XUreOPN.exe
  C:\Windows\System\XUreOPN.exe
  2⤵
  PID:13320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CwAQCYJ.exe

Filesize
2.3MB

MD5
9ec6307ac749ed69fa87f25188f09325

SHA1
4636e0febb26da4517cc775a3cf34a52051f1ad8

SHA256
567f004a54afbc881681f30dde270166de6901af57f5f1507f42236f60026248

SHA512
19f2c93bb2982ed6dd986a76bafa304756d239dbaf0e86fd60a957fb3451ec7ac70b202288b66567275d037e7726bb27e643ef082380bf497cf64be710ed8e44

Download Submit
C:\Windows\System\DJeEzRc.exe

Filesize
2.3MB

MD5
6f916bae850d108be3455f13a1cc9315

SHA1
9a5434f0698978bc484f90aa9f3c64fa991fea81

SHA256
970423f61868c42e2ae13c6722be3f67631ae7bcb0eed9adadc8aca768fe18e3

SHA512
c3b2d414e3adf548576c37f176b4330327cf4808b1f587b14caa00017c935cd023aecdb500f2b7d7a76c9732895934a31e7c355ad19dc71646c1dfeb4b4e44d3

Download Submit
C:\Windows\System\EaHixcJ.exe

Filesize
2.3MB

MD5
9b317e6c941a5b698b30baddf162f8c9

SHA1
b0f20ec09fa4d1694fd614cef2aca1a52bd29c7c

SHA256
bf645d09cff385ea95b16fc3304489776451e4bbbece986afbcb15814d98ef2e

SHA512
7649c8bf4a6aeee723026529af9ecb30a481298db6fcf91c27553740de400d2aebd98e6c434d815e94d9e2aab6a7766a627662c9b1addfe30be733a91ffaee8f

Download Submit
C:\Windows\System\FYVMekQ.exe

Filesize
2.3MB

MD5
d995ae6cfd6b067844ddbc964f475c8a

SHA1
d96fd6144082ad8cf26a1d43db5f2c0a44847411

SHA256
83bf5da36b7dc08e55f2b0d709db9ff11daef801765d33bda8ad85ca011e18e9

SHA512
c0ff901236a0cb24f1001b5a08bb7f3dfb7c29617fec27eb9f45d6f51cfb4bb1779cacf968ba3f1d29f042b575c5d0e3fa1c4c59c69a6f5fa3852689791d031c

Download Submit
C:\Windows\System\IQBaUsw.exe

Filesize
2.2MB

MD5
bfb25405375ebea801e26fc6db90a35f

SHA1
9a8d41ebb5e8c9f1ee2324332cf92a356a18c776

SHA256
5a4aaf96c4c21e5798a858c393f7d370dbb3363a81f15dfe1208bf7086520795

SHA512
975b940bc51cd130d4e0c0893a52eb9745cf137aa8ceb79010e26b62e5743f8a5dbe88ea0e3c848184554576ae750b37295cef56cc6590942914276db8af4be2

Download Submit
C:\Windows\System\KxcvQLc.exe

Filesize
2.2MB

MD5
07ee72586252eaa4281da2c67cf51bee

SHA1
3f4b68d63492d6eaf92e90080aa4150aab537646

SHA256
953ce99ed2d5ed46482fa596831c6bb6bc2ff9e4142469ed488d9b2a078cf26d

SHA512
8ecb60e2d5b900cfb749a92e90f3890235342be7e2132f399eca76cb764980e78c8a1bf44e2df4dab303a403d7e77b5d70ffba3a72f818890723edd066ae9a1e

Download Submit
C:\Windows\System\MxHRXVS.exe

Filesize
2.2MB

MD5
28d3e7936e8fd86f4a0905b67bd78bcd

SHA1
aedd356445342dab22eb2cce0094bb4ba0d1a0e4

SHA256
69e25aef84e730db0dc2b8baa3fead43aeb4b1d4a553c85230f7b383e1fd0d40

SHA512
25cca2a0c88c88cf0db5ddc2377b7ea50e8645be48b62a0c795cdccddba16602ef8c2ca50dd74b7dbf67ebe73f538e2ebb6c06775962c18cc0d64b199b0a00aa

Download Submit
C:\Windows\System\OYVqksJ.exe

Filesize
2.3MB

MD5
29c70b8146277c601c3dc8f1390077ce

SHA1
368df456103e879a3426d1b960f7cf26e1c3dced

SHA256
5e2225cf0088e9144d3e366fdf5c064de946ef0418898d1da3da49fc4ccc368a

SHA512
19fdbf0da7fda3f99b9f1b9b13edf585d03bd458d563dec63b94f8b3571c1e5eb26705ae3cb77e38552337fc089f26149dcb4e57917a6cd0eef1fad91e385f4a

Download Submit
C:\Windows\System\OvbmSlP.exe

Filesize
2.2MB

MD5
fecbbc165121c45cc9b8e50672b54009

SHA1
d493205f862f927588f80fbf239b71792b3a2dfb

SHA256
4768c6695ac35af23434035d134611eb281769448415270257dfae7a1a937641

SHA512
b2ae3ee701b7e598f3a49de9026f3e23820fdaaf3c1a5c1a72768fd0010c1a3d153ea82788c562a34b68f4219336482b3a0b89e4c0b29e3cab4a878269c83324

Download Submit
C:\Windows\System\PsdXmWY.exe

Filesize
2.3MB

MD5
5bdede80bf76be1c75a0c3f3a4e30763

SHA1
d5cdeaad4ae700414afa63d5783a3c52226c3d23

SHA256
5ab8cff1635f2f51823c828580be639305b51a4d90d1c6b33d9187b3f58b67f3

SHA512
0873cfd968461ee06b03ab00329dcc577ad6cbdf7e785248856e636fd47b3abb45930bf200df5ba10d610baa8a9daeb653e5ce56ce769fc50f0e67e305cd8659

Download Submit
C:\Windows\System\TKecJdy.exe

Filesize
2.3MB

MD5
dfbcd6a52d20cfe12b8f76f9dbd8dc42

SHA1
4a5ed9146928f5c6a26fac604ad1b33319bf9c35

SHA256
9136c49f543bbba86919f649b7db51fe67a62feefe81527799e656e6df84bc1f

SHA512
faf23ba9025fa5c6f1f5a2f83b34c53abfd4cecc8b67789512ff87b983d97d2f032e088f91591197cfe8c5e422017ee5e5ac5316a28340040896a1462e802ff3

Download Submit
C:\Windows\System\TWxLaPP.exe

Filesize
2.3MB

MD5
f6c7d4f6867a087b0f6cb969c3fb4512

SHA1
73bfb8410f58fb19b74bc4e752f444d1db043e2a

SHA256
70dae172a281ece52784ecc51f87ed015da9a427f17aedf0722e7b99c845c9f8

SHA512
ac9052a0c0305e5f1ffc0b8603b9ec2960cf7ec8cef9ff62b26010f2bf4c9395d415b7a389d508a02d85489181dc65961ae66c4bd3b1f1f02eaaf99bba134b34

Download Submit
C:\Windows\System\UZVQUho.exe

Filesize
2.2MB

MD5
4adec8137c02a8e720e9022effc56131

SHA1
9c513406d959acb840a09c5015ca5d09f2fa03d9

SHA256
ce2af4f6edbb3b3b77681b0c9d693da6af443046d8746c102c84de0a6212ce95

SHA512
28a7835e36b2f4db7e538e6c872bf3e40138a5c90475bcdad98c12bd772ae7e6cdd00d536e5c88a417d174873cceaac1d3e5d82bdb248f4da380b8a7b4c7b2db

Download Submit
C:\Windows\System\WeeDacf.exe

Filesize
2.3MB

MD5
270318c80d2d9ba2817ea814e9169f7f

SHA1
64f59d88c25489ddc037c9861a88540d2ef7cf38

SHA256
091a0f9d4cbedfbf906e3ceda765b7ec4651b1b6138c0d7316b070cb5575781a

SHA512
a124be22a0ea7b09b23f2a9025dee9cca03a35720748e6a827e5c73c526f9db5484973a2c8cc85e4e5a5c1f92bcaed72807a93e027fd216b7543b83e1fa2bab9

Download Submit
C:\Windows\System\afNvSLC.exe

Filesize
2.3MB

MD5
6d36ca1e1a76143e2758ba397b0bc1f2

SHA1
3d637e8843e026d3b4be1837ce49925000065b2a

SHA256
de1f31b0c47641dbb3ad818cbb0c12f72cfe7c9e962f2fd0b48f05a964cf5181

SHA512
8432695453d0fdc20a8061e1b2a7879859f3c67ce7409ab11e82722ba84b08cc5442246085ae96d89a5cfb87b4b4dd35771fabbeabc5913e6cfcc63965580920

Download Submit
C:\Windows\System\cFMdDQs.exe

Filesize
2.3MB

MD5
159545374b4cbc84b887b51b5d736793

SHA1
9d62dfb58dd495540cd5d531638635250db73431

SHA256
7b60e120380bfb2e248ea26409ccf8793498818b08143004ba4a663765875432

SHA512
15f89e7a8894a0331b479ff6f8d2c1d5cc3e3d42eb163ccc417fb9a9f95f1730449237c95004e5df871070fb5468a57ec09a34b083f9a909acf31fb811b0385a

Download Submit
C:\Windows\System\dlDtRSj.exe

Filesize
2.3MB

MD5
d9cf0d1d9488da493bb4b388e4b6a9ab

SHA1
8b546fb22a4c8d60794242b3c1f51e1a5c8e42e9

SHA256
05ea989ef0f0dfc98422eaec6cb1fda1f4745216286b24f227227bd70683715f

SHA512
ec85e64eb1c0c96f3ff10ec1e49a894565f3b431aad31081d62afdd24dd4ec84e4ba1b4fe73faaac583bff7a984b70a2d367671942f7fae872d2b75b004b7269

Download Submit
C:\Windows\System\fYxOBsq.exe

Filesize
2.2MB

MD5
428928f3c80cef68f7700365a4d4a06e

SHA1
fce053c82b05cacc8113ecc1c151416617a8ccc7

SHA256
0f4f2969ae046fca8fe3b39b56741cf4a68444e1400c09867c6774881bac04c0

SHA512
d12fbf2999d00748556be64d56075ecfa23623e480cbf2948dfb6127e2ce635e022f2e78e7a79cb0c0539a3bd107efbb202168e39ef1142c4d9c064f9110d855

Download Submit
C:\Windows\System\fwMSSaP.exe

Filesize
2.3MB

MD5
791169d091069493a16128e62300ecfe

SHA1
e4d817ca2850e0b361e82e2509d01e25301a95bf

SHA256
75bcc6158faf6592f89a65b973b006c16f9b4de071be1afad0febf54c14fbd7b

SHA512
7c71782592049872c82d862f2a72095624c572da3f529270dc2ff2e01a5352073820134c4755bf425325c9bd1d300847feb706d51a76b85bf0e7b1f1b8645c57

Download Submit
C:\Windows\System\gQTmrDy.exe

Filesize
2.3MB

MD5
d91ab5253ed97661739b6c7a6024de2f

SHA1
db66e24112458f1794fdaac227d2ae7c9f4de13b

SHA256
b9f5bb4c7008398e6964666e874dd74a5bf162c15160d2148e5c8c96c42932a9

SHA512
a983d18c4f7f871f827d1a55065e69af6d162fbf7628081ab43025e6fd9c1abc490d852639e6a24f39af52c1c749d800eca7a857d6b152e00ba25d374a93a0d2

Download Submit
C:\Windows\System\hoXPgmG.exe

Filesize
2.3MB

MD5
124553a3ca3a2a80148559e1cc4fe38d

SHA1
73a0afa8e3089c224228485ee90ca80861e36bd9

SHA256
092704abc08ca424c2561966cb2d90e7c08c529c41b70e92e5e9bd8e9e03b891

SHA512
bc188a156bce2146bc9bb696757aac1d7ff380eb0c672d3f404a0d7dd0cdf1e2357e0bc9adaa7817ba4fdd3ba8f62a9186a3e38a2a7b72998963149f8b6ef7a7

Download Submit
C:\Windows\System\jRocEIQ.exe

Filesize
2.2MB

MD5
fa1b85cfa4c301f01042857cbe6f5b64

SHA1
dd82b840d0b443b97979a1e42389e4a5ebc3662e

SHA256
792fd4e266eff46c27b51299535ecec46b9859946c4406bf8221f2ed0280ae2c

SHA512
51f540daca07b5ea0a9d2d9031ad3daf7766ba869b070790aff2e2e952a6c5eb5dcf5fdcfb74102a5853fb398241213588afe7d337d83f7b88cbf59d6da1bfb1

Download Submit
C:\Windows\System\llFBTOZ.exe

Filesize
2.2MB

MD5
3c80f533994ce7c559d4499f8d4c4ed4

SHA1
e02f78c2052a2fe7523140bba4c69bea1fe07da0

SHA256
ff0b5f6457fea192b90ab85d5589250dbdd0abb3dc04bd478db559f2a3e933a6

SHA512
f60863d523e7e76d3b948292184a3e45ab5a17d1879c773fa52203dbbdee968250783d41e06f6eb5edbdc15ab1aa8ba8b7c2e4f02914c9ca19a62b93ee4c37b2

Download Submit
C:\Windows\System\nSmwOqQ.exe

Filesize
2.2MB

MD5
31d80f06ac6cb72f7648d4f5b41e1c17

SHA1
8bc8d15f11ef7dacdfcd05c1cd4cb6b35275960b

SHA256
1fe98151ee3db38dbe56c556cc722efa669d898b3f7cad8db322f30a29cc2d27

SHA512
c83227730ec423dc53c3450e0007dad4f8e7e3879f9458373dae6c3e33bc518a6c0e29ebcdf06cf848e8f9d605e8fe7baa15561d0005cdaeb805f68aa912b460

Download Submit
C:\Windows\System\nWibCLT.exe

Filesize
2.3MB

MD5
4d1fb55f13f636d59fda18aca1fe2e4b

SHA1
1509d7ed06c63cb1cf4bbde432190b7329176bb6

SHA256
ba25ff54eb3e215bbe61afda4e5a4b683990b64e2a1b5992e23bab77626d1ec5

SHA512
6906fdb055f16855dc830c65dbf1d8c72c405479f88d49a0cf8365197dd86a42154cb8b662a92efadd24585045c00872fb1c4f9668b84cbcc98632dd428c068f

Download Submit
C:\Windows\System\oQtRpku.exe

Filesize
2.3MB

MD5
b8ff61fa21b218f5117c0140a16b56fa

SHA1
f4c0be24237777e945e85467a46a946f477251fe

SHA256
c4414211a699f7e814978621112e46655dd77dbf22da4b67bae49e32e79c664e

SHA512
338cfab02889bb3b00cacdf287f0da09f4165a200fc78ab99a0867783848b8e90e7abe44c3fc66d958f5c014530d30f6ed7dc032c8786104feb999c14ebdaaac

Download Submit
C:\Windows\System\paHfUwg.exe

Filesize
2.2MB

MD5
58b4597cd0469db0cb0fb52b7b9e60e5

SHA1
be25587ee984e0595e224730a10e992e66eee50e

SHA256
e715f41e51d6e89ee6763e412809fb26d63d4d3090004a9d9c5b343b87b98806

SHA512
7a97df056d9315f97e7006ed87b8eace457032bb4a00632e6b5a5a92c344def9faedf96f6a58aa904ed9bc7fd5c757fe7ce361402326353071243965b96f27ad

Download Submit
C:\Windows\System\qjOFUmI.exe

Filesize
2.2MB

MD5
0625bea30a34de3cbdc9ffe884f64386

SHA1
9cba683f23068e1a27ece8d840956239969b0b25

SHA256
7d603ba7579aa8b6305f597e5a82353b92f75b23fedca5bbbf78d78735cfd32e

SHA512
b3b872a9ab64039245ca298e84e33c6925f9d1c0039f89751c942a8e08c23a36d62ab2d73f7390e333389a5d40423e91d5e25418e0c3b61250327f9c8fc329ea

Download Submit
C:\Windows\System\rVHJdTl.exe

Filesize
2.2MB

MD5
cca6d80d74b74ad7f3521563493bc2c9

SHA1
b788795396c34a86372ce85ba415967f2f5f48a1

SHA256
dd2ec008828306dd5fdf6ffc527343d6d32cbf234f6959e26176e97c37e13f85

SHA512
40b786e9554bea83375c432b0a32ca3db1d94d926b09c958daee835e63b316334874ba336eeff4cf17791379b636e233f81eadfe6c8982131b7ee276ce532c21

Download Submit
C:\Windows\System\rsaRAHt.exe

Filesize
2.2MB

MD5
840acc74f6e0cf3bf6c2079adbe03050

SHA1
d2e15297890115fe6661dff56d90c061be597c3a

SHA256
fccea3aed5de29a74843ad1c5fd849bdeb583522c1235dfba730abb6c4ff0f43

SHA512
e17c54b9261c0aa673a8702b8a1fc8aac1d8a761298cfee5793dd5437fadfa41249a4fcf7e5fee57ce4b66038d8fce8142fa4dc4fbf65645098958c6dd49f397

Download Submit
C:\Windows\System\tAQtKXF.exe

Filesize
2.3MB

MD5
00c4ffb842fdee6f2556c80b4c96180c

SHA1
25767ea37c7440baad255de7224ffb7f06630e36

SHA256
896ee6b973e4773ed59661a11f8b88f632e8f7257b897a9d85c5c1fa8f62d7e7

SHA512
e603d4c2a376fe6ce3fe2d1a9dd5fc3c291d6e731dff130daa98b57623f7548cf575724d018721f4297c80e2bf6cc61a39f5dc3a4c7ad20d7d258de6fc40ecd6

Download Submit
C:\Windows\System\wRQqwNs.exe

Filesize
2.3MB

MD5
19c86e5f81650cde208bd18b85c62aa8

SHA1
be267c8f3ff223122a45b42227b1c00347118d9f

SHA256
d923e7b63e23b3ecfe9247cf8bb39e6379c11c339f23869cf43eb8b58e7d3233

SHA512
e607f6c2de0738a97c81c35b82a4eadace77f64b204c4ca230b3f6701ebe9056051d55b1c4591d844bfc97c749410b01260dba0bd6e445d6a4264e4845f0a473

Download Submit
C:\Windows\System\zCXPlcU.exe

Filesize
2.3MB

MD5
d117b6489fd39b3792da7e370796901e

SHA1
7d451787c35b17e2ed5296a2753ea829338b595d

SHA256
c3a3d246280c00188004e7ad380999093aaa77cf871c1bda6fea11bdfe7a746f

SHA512
6db56ad0bb3a4d8092dd5a18845423388055817989039c0f5a57f187115e4a4951f7d4628060b3dc5a258ab9b4a031c9e95854844c9b6ea7283e8d223902692d

Download Submit
memory/552-814-0x00007FF742130000-0x00007FF742484000-memory.dmp

Filesize
3.3MB

Download
memory/552-2138-0x00007FF742130000-0x00007FF742484000-memory.dmp

Filesize
3.3MB

Download
memory/940-2147-0x00007FF66E6A0000-0x00007FF66E9F4000-memory.dmp

Filesize
3.3MB

Download
memory/940-856-0x00007FF66E6A0000-0x00007FF66E9F4000-memory.dmp

Filesize
3.3MB

Download
memory/952-760-0x00007FF701500000-0x00007FF701854000-memory.dmp

Filesize
3.3MB

Download
memory/952-2130-0x00007FF701500000-0x00007FF701854000-memory.dmp

Filesize
3.3MB

Download
memory/1412-2135-0x00007FF7D50B0000-0x00007FF7D5404000-memory.dmp

Filesize
3.3MB

Download
memory/1412-765-0x00007FF7D50B0000-0x00007FF7D5404000-memory.dmp

Filesize
3.3MB

Download
memory/1428-2126-0x00007FF7D3F00000-0x00007FF7D4254000-memory.dmp

Filesize
3.3MB

Download
memory/1428-767-0x00007FF7D3F00000-0x00007FF7D4254000-memory.dmp

Filesize
3.3MB

Download
memory/1464-766-0x00007FF7514D0000-0x00007FF751824000-memory.dmp

Filesize
3.3MB

Download
memory/1464-2127-0x00007FF7514D0000-0x00007FF751824000-memory.dmp

Filesize
3.3MB

Download
memory/1848-2140-0x00007FF7D34F0000-0x00007FF7D3844000-memory.dmp

Filesize
3.3MB

Download
memory/1848-869-0x00007FF7D34F0000-0x00007FF7D3844000-memory.dmp

Filesize
3.3MB

Download
memory/2160-2120-0x00007FF623000000-0x00007FF623354000-memory.dmp

Filesize
3.3MB

Download
memory/2160-14-0x00007FF623000000-0x00007FF623354000-memory.dmp

Filesize
3.3MB

Download
memory/2160-2115-0x00007FF623000000-0x00007FF623354000-memory.dmp

Filesize
3.3MB

Download
memory/2252-764-0x00007FF78EAA0000-0x00007FF78EDF4000-memory.dmp

Filesize
3.3MB

Download
memory/2252-2136-0x00007FF78EAA0000-0x00007FF78EDF4000-memory.dmp

Filesize
3.3MB

Download
memory/2264-2143-0x00007FF64E6C0000-0x00007FF64EA14000-memory.dmp

Filesize
3.3MB

Download
memory/2264-835-0x00007FF64E6C0000-0x00007FF64EA14000-memory.dmp

Filesize
3.3MB

Download
memory/2272-2128-0x00007FF67A450000-0x00007FF67A7A4000-memory.dmp

Filesize
3.3MB

Download
memory/2272-763-0x00007FF67A450000-0x00007FF67A7A4000-memory.dmp

Filesize
3.3MB

Download
memory/2360-786-0x00007FF72C3E0000-0x00007FF72C734000-memory.dmp

Filesize
3.3MB

Download
memory/2360-2134-0x00007FF72C3E0000-0x00007FF72C734000-memory.dmp

Filesize
3.3MB

Download
memory/2852-6-0x00007FF6A6E40000-0x00007FF6A7194000-memory.dmp

Filesize
3.3MB

Download
memory/2852-2119-0x00007FF6A6E40000-0x00007FF6A7194000-memory.dmp

Filesize
3.3MB

Download
memory/2852-2114-0x00007FF6A6E40000-0x00007FF6A7194000-memory.dmp

Filesize
3.3MB

Download
memory/3052-808-0x00007FF65A870000-0x00007FF65ABC4000-memory.dmp

Filesize
3.3MB

Download
memory/3052-2137-0x00007FF65A870000-0x00007FF65ABC4000-memory.dmp

Filesize
3.3MB

Download
memory/3140-850-0x00007FF7575E0000-0x00007FF757934000-memory.dmp

Filesize
3.3MB

Download
memory/3140-2144-0x00007FF7575E0000-0x00007FF757934000-memory.dmp

Filesize
3.3MB

Download
memory/3204-852-0x00007FF685AB0000-0x00007FF685E04000-memory.dmp

Filesize
3.3MB

Download
memory/3204-2146-0x00007FF685AB0000-0x00007FF685E04000-memory.dmp

Filesize
3.3MB

Download
memory/3296-759-0x00007FF676920000-0x00007FF676C74000-memory.dmp

Filesize
3.3MB

Download
memory/3296-2131-0x00007FF676920000-0x00007FF676C74000-memory.dmp

Filesize
3.3MB

Download
memory/3432-761-0x00007FF75C220000-0x00007FF75C574000-memory.dmp

Filesize
3.3MB

Download
memory/3432-2133-0x00007FF75C220000-0x00007FF75C574000-memory.dmp

Filesize
3.3MB

Download
memory/3632-2125-0x00007FF72B6D0000-0x00007FF72BA24000-memory.dmp

Filesize
3.3MB

Download
memory/3632-762-0x00007FF72B6D0000-0x00007FF72BA24000-memory.dmp

Filesize
3.3MB

Download
memory/3708-2141-0x00007FF7B61F0000-0x00007FF7B6544000-memory.dmp

Filesize
3.3MB

Download
memory/3708-864-0x00007FF7B61F0000-0x00007FF7B6544000-memory.dmp

Filesize
3.3MB

Download
memory/3728-2145-0x00007FF652F90000-0x00007FF6532E4000-memory.dmp

Filesize
3.3MB

Download
memory/3728-829-0x00007FF652F90000-0x00007FF6532E4000-memory.dmp

Filesize
3.3MB

Download
memory/3904-2121-0x00007FF7F5630000-0x00007FF7F5984000-memory.dmp

Filesize
3.3MB

Download
memory/3904-38-0x00007FF7F5630000-0x00007FF7F5984000-memory.dmp

Filesize
3.3MB

Download
memory/4092-2123-0x00007FF719E40000-0x00007FF71A194000-memory.dmp

Filesize
3.3MB

Download
memory/4092-42-0x00007FF719E40000-0x00007FF71A194000-memory.dmp

Filesize
3.3MB

Download
memory/4164-2129-0x00007FF77C4E0000-0x00007FF77C834000-memory.dmp

Filesize
3.3MB

Download
memory/4164-778-0x00007FF77C4E0000-0x00007FF77C834000-memory.dmp

Filesize
3.3MB

Download
memory/4748-2122-0x00007FF7442A0000-0x00007FF7445F4000-memory.dmp

Filesize
3.3MB

Download
memory/4748-23-0x00007FF7442A0000-0x00007FF7445F4000-memory.dmp

Filesize
3.3MB

Download
memory/4748-2116-0x00007FF7442A0000-0x00007FF7445F4000-memory.dmp

Filesize
3.3MB

Download
memory/4808-1-0x0000026820E10000-0x0000026820E20000-memory.dmp

Filesize
64KB

Download
memory/4808-2113-0x00007FF76C790000-0x00007FF76CAE4000-memory.dmp

Filesize
3.3MB

Download
memory/4808-0-0x00007FF76C790000-0x00007FF76CAE4000-memory.dmp

Filesize
3.3MB

Download
memory/4816-2124-0x00007FF7630B0000-0x00007FF763404000-memory.dmp

Filesize
3.3MB

Download
memory/4816-2117-0x00007FF7630B0000-0x00007FF763404000-memory.dmp

Filesize
3.3MB

Download
memory/4816-29-0x00007FF7630B0000-0x00007FF763404000-memory.dmp

Filesize
3.3MB

Download
memory/4908-822-0x00007FF719FC0000-0x00007FF71A314000-memory.dmp

Filesize
3.3MB

Download
memory/4908-2139-0x00007FF719FC0000-0x00007FF71A314000-memory.dmp

Filesize
3.3MB

Download
memory/4960-843-0x00007FF6FB2D0000-0x00007FF6FB624000-memory.dmp

Filesize
3.3MB

Download
memory/4960-2142-0x00007FF6FB2D0000-0x00007FF6FB624000-memory.dmp

Filesize
3.3MB

Download
memory/5068-2132-0x00007FF69C0E0000-0x00007FF69C434000-memory.dmp

Filesize
3.3MB

Download
memory/5068-41-0x00007FF69C0E0000-0x00007FF69C434000-memory.dmp

Filesize
3.3MB

Download
memory/5068-2118-0x00007FF69C0E0000-0x00007FF69C434000-memory.dmp

Filesize
3.3MB

Download