xmrig | a3d0b4234144a35189dd51bd6493d58e3db4da4f1e62a379872b916b6a32c61d

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
Size

1.8MB
MD5

062fd139bab14d94314704e9a8371320
SHA1

feea2987cf5e0a0023376bb821794edbb0420cab
SHA256

a3d0b4234144a35189dd51bd6493d58e3db4da4f1e62a379872b916b6a32c61d
SHA512

9ba176583948d3da682b0c4fe325b5e45160f8d7f56ce5e8a5243acc7c76b216ab6fa14b78e384b0ac46ab660c67b754805e3158ef726b92ac53dbb8bb8dd237
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9NcHFw:BemTLkNdfE0pZrP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4784-0-0x00007FF74DF30000-0x00007FF74E284000-memory.dmp	xmrig
behavioral2/files/0x0008000000023406-5.dat	xmrig
behavioral2/files/0x000700000002340b-7.dat	xmrig
behavioral2/memory/2940-22-0x00007FF6D84A0000-0x00007FF6D87F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-13.dat	xmrig
behavioral2/files/0x000700000002340f-40.dat	xmrig
behavioral2/files/0x0007000000023410-42.dat	xmrig
behavioral2/memory/1536-43-0x00007FF6310C0000-0x00007FF631414000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-61.dat	xmrig
behavioral2/files/0x0007000000023415-72.dat	xmrig
behavioral2/files/0x0007000000023417-88.dat	xmrig
behavioral2/files/0x000700000002341f-120.dat	xmrig
behavioral2/files/0x0007000000023425-158.dat	xmrig
behavioral2/memory/2264-567-0x00007FF7571B0000-0x00007FF757504000-memory.dmp	xmrig
behavioral2/memory/1244-568-0x00007FF700550000-0x00007FF7008A4000-memory.dmp	xmrig
behavioral2/memory/2916-570-0x00007FF6F23D0000-0x00007FF6F2724000-memory.dmp	xmrig
behavioral2/memory/1332-572-0x00007FF720B10000-0x00007FF720E64000-memory.dmp	xmrig
behavioral2/memory/2028-573-0x00007FF6EAB90000-0x00007FF6EAEE4000-memory.dmp	xmrig
behavioral2/memory/4440-571-0x00007FF6E0570000-0x00007FF6E08C4000-memory.dmp	xmrig
behavioral2/memory/1524-569-0x00007FF6A3F90000-0x00007FF6A42E4000-memory.dmp	xmrig
behavioral2/memory/4392-574-0x00007FF7AD2B0000-0x00007FF7AD604000-memory.dmp	xmrig
behavioral2/memory/2984-575-0x00007FF610200000-0x00007FF610554000-memory.dmp	xmrig
behavioral2/memory/3180-576-0x00007FF695C40000-0x00007FF695F94000-memory.dmp	xmrig
behavioral2/memory/2020-577-0x00007FF688760000-0x00007FF688AB4000-memory.dmp	xmrig
behavioral2/memory/4572-578-0x00007FF61DC70000-0x00007FF61DFC4000-memory.dmp	xmrig
behavioral2/memory/4340-600-0x00007FF7686C0000-0x00007FF768A14000-memory.dmp	xmrig
behavioral2/memory/1756-597-0x00007FF677760000-0x00007FF677AB4000-memory.dmp	xmrig
behavioral2/memory/3876-595-0x00007FF6BE0C0000-0x00007FF6BE414000-memory.dmp	xmrig
behavioral2/memory/2636-606-0x00007FF7AD560000-0x00007FF7AD8B4000-memory.dmp	xmrig
behavioral2/memory/1708-609-0x00007FF7AA020000-0x00007FF7AA374000-memory.dmp	xmrig
behavioral2/memory/3572-610-0x00007FF78E9C0000-0x00007FF78ED14000-memory.dmp	xmrig
behavioral2/memory/4160-592-0x00007FF66C560000-0x00007FF66C8B4000-memory.dmp	xmrig
behavioral2/memory/1284-586-0x00007FF62A190000-0x00007FF62A4E4000-memory.dmp	xmrig
behavioral2/memory/5084-583-0x00007FF7E7FC0000-0x00007FF7E8314000-memory.dmp	xmrig
behavioral2/memory/2244-617-0x00007FF69E3F0000-0x00007FF69E744000-memory.dmp	xmrig
behavioral2/files/0x0007000000023429-170.dat	xmrig
behavioral2/files/0x0007000000023427-168.dat	xmrig
behavioral2/files/0x0007000000023428-165.dat	xmrig
behavioral2/files/0x0007000000023426-163.dat	xmrig
behavioral2/files/0x0007000000023424-153.dat	xmrig
behavioral2/files/0x0007000000023423-148.dat	xmrig
behavioral2/files/0x0007000000023422-143.dat	xmrig
behavioral2/files/0x0007000000023421-138.dat	xmrig
behavioral2/files/0x0007000000023420-133.dat	xmrig
behavioral2/files/0x000700000002341e-123.dat	xmrig
behavioral2/files/0x000700000002341d-118.dat	xmrig
behavioral2/files/0x000700000002341c-113.dat	xmrig
behavioral2/files/0x000700000002341b-108.dat	xmrig
behavioral2/files/0x000700000002341a-103.dat	xmrig
behavioral2/files/0x0007000000023419-98.dat	xmrig
behavioral2/files/0x0007000000023418-93.dat	xmrig
behavioral2/files/0x0007000000023416-83.dat	xmrig
behavioral2/files/0x0007000000023414-70.dat	xmrig
behavioral2/files/0x0007000000023413-66.dat	xmrig
behavioral2/files/0x0007000000023411-56.dat	xmrig
behavioral2/memory/3440-47-0x00007FF796E80000-0x00007FF7971D4000-memory.dmp	xmrig
behavioral2/memory/756-38-0x00007FF732200000-0x00007FF732554000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-36.dat	xmrig
behavioral2/files/0x000700000002340d-35.dat	xmrig
behavioral2/files/0x000700000002340c-30.dat	xmrig
behavioral2/memory/4912-24-0x00007FF633640000-0x00007FF633994000-memory.dmp	xmrig
behavioral2/memory/2796-23-0x00007FF642E80000-0x00007FF6431D4000-memory.dmp	xmrig
behavioral2/memory/752-16-0x00007FF6E70F0000-0x00007FF6E7444000-memory.dmp	xmrig
behavioral2/memory/2940-2155-0x00007FF6D84A0000-0x00007FF6D87F4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
752	gBuXhRm.exe
2796	DtCjxVf.exe
2940	EwMylRu.exe
4912	pqxsMCq.exe
756	nGFuOWe.exe
1536	elueJYX.exe
3572	cToQmQc.exe
3440	cOcpqRx.exe
2244	EFLIPoI.exe
2264	WZMfuKy.exe
1244	scRGIHy.exe
1524	BSLrtwG.exe
2916	TaOGUif.exe
4440	qqKWdHZ.exe
1332	CEgpjDH.exe
2028	CDirQYz.exe
4392	uRtKBsT.exe
2984	pjypxMB.exe
3180	aHqpTOV.exe
2020	fhEYUXf.exe
4572	gUcAlTF.exe
5084	TPsTufV.exe
1284	yHvEVmO.exe
4160	XpcEFcC.exe
3876	bxURbzk.exe
1756	FyHIysl.exe
4340	duCdHRI.exe
2636	NbFNYwa.exe
1708	wxhRxHR.exe
3688	icgLnQm.exe
1580	GSrqUfz.exe
3024	tZYhrRu.exe
4500	vHElSiY.exe
3208	NDHOzdr.exe
1064	sPPqMHG.exe
1884	KYhJBmQ.exe
3728	sRXYBXB.exe
4480	SKnoHLe.exe
3576	eybyusq.exe
1516	WyBpttr.exe
4068	NtDrnCC.exe
4396	EwcvALh.exe
3924	StLjfwZ.exe
3832	RDCBjKv.exe
2268	fgYRzWI.exe
4320	QdIKuTU.exe
4968	AWaKVSr.exe
1600	LiiFogs.exe
4844	mZczOxm.exe
1736	HRAMqGv.exe
4724	IrAOGGc.exe
116	GhYqbcn.exe
4276	dsunEPi.exe
4280	npNUTBu.exe
636	eySkmFm.exe
4820	eheIkSi.exe
4952	kLyAGES.exe
2208	BcngtQK.exe
4488	lfHvAwo.exe
4596	IxjbJai.exe
1596	cWAJjtZ.exe
1872	NjuOkDu.exe
3016	uNVXexk.exe
1724	RFNyfYS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4784-0-0x00007FF74DF30000-0x00007FF74E284000-memory.dmp	upx
behavioral2/files/0x0008000000023406-5.dat	upx
behavioral2/files/0x000700000002340b-7.dat	upx
behavioral2/memory/2940-22-0x00007FF6D84A0000-0x00007FF6D87F4000-memory.dmp	upx
behavioral2/files/0x000700000002340a-13.dat	upx
behavioral2/files/0x000700000002340f-40.dat	upx
behavioral2/files/0x0007000000023410-42.dat	upx
behavioral2/memory/1536-43-0x00007FF6310C0000-0x00007FF631414000-memory.dmp	upx
behavioral2/files/0x0007000000023412-61.dat	upx
behavioral2/files/0x0007000000023415-72.dat	upx
behavioral2/files/0x0007000000023417-88.dat	upx
behavioral2/files/0x000700000002341f-120.dat	upx
behavioral2/files/0x0007000000023425-158.dat	upx
behavioral2/memory/2264-567-0x00007FF7571B0000-0x00007FF757504000-memory.dmp	upx
behavioral2/memory/1244-568-0x00007FF700550000-0x00007FF7008A4000-memory.dmp	upx
behavioral2/memory/2916-570-0x00007FF6F23D0000-0x00007FF6F2724000-memory.dmp	upx
behavioral2/memory/1332-572-0x00007FF720B10000-0x00007FF720E64000-memory.dmp	upx
behavioral2/memory/2028-573-0x00007FF6EAB90000-0x00007FF6EAEE4000-memory.dmp	upx
behavioral2/memory/4440-571-0x00007FF6E0570000-0x00007FF6E08C4000-memory.dmp	upx
behavioral2/memory/1524-569-0x00007FF6A3F90000-0x00007FF6A42E4000-memory.dmp	upx
behavioral2/memory/4392-574-0x00007FF7AD2B0000-0x00007FF7AD604000-memory.dmp	upx
behavioral2/memory/2984-575-0x00007FF610200000-0x00007FF610554000-memory.dmp	upx
behavioral2/memory/3180-576-0x00007FF695C40000-0x00007FF695F94000-memory.dmp	upx
behavioral2/memory/2020-577-0x00007FF688760000-0x00007FF688AB4000-memory.dmp	upx
behavioral2/memory/4572-578-0x00007FF61DC70000-0x00007FF61DFC4000-memory.dmp	upx
behavioral2/memory/4340-600-0x00007FF7686C0000-0x00007FF768A14000-memory.dmp	upx
behavioral2/memory/1756-597-0x00007FF677760000-0x00007FF677AB4000-memory.dmp	upx
behavioral2/memory/3876-595-0x00007FF6BE0C0000-0x00007FF6BE414000-memory.dmp	upx
behavioral2/memory/2636-606-0x00007FF7AD560000-0x00007FF7AD8B4000-memory.dmp	upx
behavioral2/memory/1708-609-0x00007FF7AA020000-0x00007FF7AA374000-memory.dmp	upx
behavioral2/memory/3572-610-0x00007FF78E9C0000-0x00007FF78ED14000-memory.dmp	upx
behavioral2/memory/4160-592-0x00007FF66C560000-0x00007FF66C8B4000-memory.dmp	upx
behavioral2/memory/1284-586-0x00007FF62A190000-0x00007FF62A4E4000-memory.dmp	upx
behavioral2/memory/5084-583-0x00007FF7E7FC0000-0x00007FF7E8314000-memory.dmp	upx
behavioral2/memory/2244-617-0x00007FF69E3F0000-0x00007FF69E744000-memory.dmp	upx
behavioral2/files/0x0007000000023429-170.dat	upx
behavioral2/files/0x0007000000023427-168.dat	upx
behavioral2/files/0x0007000000023428-165.dat	upx
behavioral2/files/0x0007000000023426-163.dat	upx
behavioral2/files/0x0007000000023424-153.dat	upx
behavioral2/files/0x0007000000023423-148.dat	upx
behavioral2/files/0x0007000000023422-143.dat	upx
behavioral2/files/0x0007000000023421-138.dat	upx
behavioral2/files/0x0007000000023420-133.dat	upx
behavioral2/files/0x000700000002341e-123.dat	upx
behavioral2/files/0x000700000002341d-118.dat	upx
behavioral2/files/0x000700000002341c-113.dat	upx
behavioral2/files/0x000700000002341b-108.dat	upx
behavioral2/files/0x000700000002341a-103.dat	upx
behavioral2/files/0x0007000000023419-98.dat	upx
behavioral2/files/0x0007000000023418-93.dat	upx
behavioral2/files/0x0007000000023416-83.dat	upx
behavioral2/files/0x0007000000023414-70.dat	upx
behavioral2/files/0x0007000000023413-66.dat	upx
behavioral2/files/0x0007000000023411-56.dat	upx
behavioral2/memory/3440-47-0x00007FF796E80000-0x00007FF7971D4000-memory.dmp	upx
behavioral2/memory/756-38-0x00007FF732200000-0x00007FF732554000-memory.dmp	upx
behavioral2/files/0x000700000002340e-36.dat	upx
behavioral2/files/0x000700000002340d-35.dat	upx
behavioral2/files/0x000700000002340c-30.dat	upx
behavioral2/memory/4912-24-0x00007FF633640000-0x00007FF633994000-memory.dmp	upx
behavioral2/memory/2796-23-0x00007FF642E80000-0x00007FF6431D4000-memory.dmp	upx
behavioral2/memory/752-16-0x00007FF6E70F0000-0x00007FF6E7444000-memory.dmp	upx
behavioral2/memory/2940-2155-0x00007FF6D84A0000-0x00007FF6D87F4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NyLlsTM.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\QdIKuTU.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\xYyfQXh.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\KiynqLW.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\JfEgBcZ.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\YFlSVpT.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\ALwziHl.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\rKhPJsc.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\hFUxydE.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\hPzWawo.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\YXmJdAD.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\EpqvJrR.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\PAPMLGa.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\PfyAFfu.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\pDVavto.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\DOntQmr.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\MynLIJU.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\BTfpRSu.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\XnDrWpn.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\refyOaP.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\NdsPxZq.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\cOcpqRx.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\icgLnQm.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\GtNaMgf.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\OnwskwE.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\pggIxWY.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\cHFziJY.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\LIzkOII.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\TZBWFAJ.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\yqGImkH.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\spTrbTc.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\XWHIQQj.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\cToQmQc.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\CrtyGLp.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\kUSRkKz.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\xFdoqKh.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\qOIWqhr.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\vxNJclF.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\VprhdNW.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\DYfkGTi.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\YBlnnFd.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\zayqPXW.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\olRrSaj.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\nniEqWc.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\mgFvxiB.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\gBuXhRm.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\sKAxgLr.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\rqSPTHT.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\XaSKvQl.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\xWaTxrx.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\KRVDnuE.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\AWaGhKV.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\ljGGGvp.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\MOBGZwv.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\OTNuvPs.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\AtGfjPz.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\pKWrIcH.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\eySkmFm.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\uxBwjQJ.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\PfKTNCu.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\rvxihWr.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\ussMhmq.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\NOADxNK.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
File created	C:\Windows\System\HqzWFxF.exe	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 752	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	83
PID 4784 wrote to memory of 752	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	83
PID 4784 wrote to memory of 2796	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	84
PID 4784 wrote to memory of 2796	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	84
PID 4784 wrote to memory of 2940	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	85
PID 4784 wrote to memory of 2940	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	85
PID 4784 wrote to memory of 4912	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	86
PID 4784 wrote to memory of 4912	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	86
PID 4784 wrote to memory of 756	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	87
PID 4784 wrote to memory of 756	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	87
PID 4784 wrote to memory of 1536	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	88
PID 4784 wrote to memory of 1536	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	88
PID 4784 wrote to memory of 3572	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	89
PID 4784 wrote to memory of 3572	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	89
PID 4784 wrote to memory of 3440	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	90
PID 4784 wrote to memory of 3440	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	90
PID 4784 wrote to memory of 2244	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	91
PID 4784 wrote to memory of 2244	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	91
PID 4784 wrote to memory of 2264	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	92
PID 4784 wrote to memory of 2264	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	92
PID 4784 wrote to memory of 1244	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	93
PID 4784 wrote to memory of 1244	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	93
PID 4784 wrote to memory of 1524	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	94
PID 4784 wrote to memory of 1524	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	94
PID 4784 wrote to memory of 2916	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	95
PID 4784 wrote to memory of 2916	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	95
PID 4784 wrote to memory of 4440	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	96
PID 4784 wrote to memory of 4440	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	96
PID 4784 wrote to memory of 1332	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	97
PID 4784 wrote to memory of 1332	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	97
PID 4784 wrote to memory of 2028	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	98
PID 4784 wrote to memory of 2028	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	98
PID 4784 wrote to memory of 4392	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	99
PID 4784 wrote to memory of 4392	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	99
PID 4784 wrote to memory of 2984	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	100
PID 4784 wrote to memory of 2984	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	100
PID 4784 wrote to memory of 3180	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	101
PID 4784 wrote to memory of 3180	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	101
PID 4784 wrote to memory of 2020	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	102
PID 4784 wrote to memory of 2020	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	102
PID 4784 wrote to memory of 4572	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	103
PID 4784 wrote to memory of 4572	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	103
PID 4784 wrote to memory of 5084	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	104
PID 4784 wrote to memory of 5084	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	104
PID 4784 wrote to memory of 1284	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	105
PID 4784 wrote to memory of 1284	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	105
PID 4784 wrote to memory of 4160	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	106
PID 4784 wrote to memory of 4160	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	106
PID 4784 wrote to memory of 3876	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	107
PID 4784 wrote to memory of 3876	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	107
PID 4784 wrote to memory of 1756	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	108
PID 4784 wrote to memory of 1756	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	108
PID 4784 wrote to memory of 4340	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	109
PID 4784 wrote to memory of 4340	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	109
PID 4784 wrote to memory of 2636	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	110
PID 4784 wrote to memory of 2636	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	110
PID 4784 wrote to memory of 1708	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	111
PID 4784 wrote to memory of 1708	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	111
PID 4784 wrote to memory of 3688	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	112
PID 4784 wrote to memory of 3688	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	112
PID 4784 wrote to memory of 1580	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	113
PID 4784 wrote to memory of 1580	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	113
PID 4784 wrote to memory of 3024	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	114
PID 4784 wrote to memory of 3024	4784	062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\062fd139bab14d94314704e9a8371320_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\System\gBuXhRm.exe
  C:\Windows\System\gBuXhRm.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\DtCjxVf.exe
  C:\Windows\System\DtCjxVf.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\EwMylRu.exe
  C:\Windows\System\EwMylRu.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\pqxsMCq.exe
  C:\Windows\System\pqxsMCq.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\nGFuOWe.exe
  C:\Windows\System\nGFuOWe.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\elueJYX.exe
  C:\Windows\System\elueJYX.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\cToQmQc.exe
  C:\Windows\System\cToQmQc.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\cOcpqRx.exe
  C:\Windows\System\cOcpqRx.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\EFLIPoI.exe
  C:\Windows\System\EFLIPoI.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\WZMfuKy.exe
  C:\Windows\System\WZMfuKy.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\scRGIHy.exe
  C:\Windows\System\scRGIHy.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\BSLrtwG.exe
  C:\Windows\System\BSLrtwG.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\TaOGUif.exe
  C:\Windows\System\TaOGUif.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\qqKWdHZ.exe
  C:\Windows\System\qqKWdHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\CEgpjDH.exe
  C:\Windows\System\CEgpjDH.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\CDirQYz.exe
  C:\Windows\System\CDirQYz.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\uRtKBsT.exe
  C:\Windows\System\uRtKBsT.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\pjypxMB.exe
  C:\Windows\System\pjypxMB.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\aHqpTOV.exe
  C:\Windows\System\aHqpTOV.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\fhEYUXf.exe
  C:\Windows\System\fhEYUXf.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\gUcAlTF.exe
  C:\Windows\System\gUcAlTF.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\TPsTufV.exe
  C:\Windows\System\TPsTufV.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\yHvEVmO.exe
  C:\Windows\System\yHvEVmO.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\XpcEFcC.exe
  C:\Windows\System\XpcEFcC.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\bxURbzk.exe
  C:\Windows\System\bxURbzk.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\FyHIysl.exe
  C:\Windows\System\FyHIysl.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\duCdHRI.exe
  C:\Windows\System\duCdHRI.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\NbFNYwa.exe
  C:\Windows\System\NbFNYwa.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\wxhRxHR.exe
  C:\Windows\System\wxhRxHR.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\icgLnQm.exe
  C:\Windows\System\icgLnQm.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\GSrqUfz.exe
  C:\Windows\System\GSrqUfz.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\tZYhrRu.exe
  C:\Windows\System\tZYhrRu.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\vHElSiY.exe
  C:\Windows\System\vHElSiY.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\NDHOzdr.exe
  C:\Windows\System\NDHOzdr.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\sPPqMHG.exe
  C:\Windows\System\sPPqMHG.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\KYhJBmQ.exe
  C:\Windows\System\KYhJBmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\sRXYBXB.exe
  C:\Windows\System\sRXYBXB.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\SKnoHLe.exe
  C:\Windows\System\SKnoHLe.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\eybyusq.exe
  C:\Windows\System\eybyusq.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\WyBpttr.exe
  C:\Windows\System\WyBpttr.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\NtDrnCC.exe
  C:\Windows\System\NtDrnCC.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\EwcvALh.exe
  C:\Windows\System\EwcvALh.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\StLjfwZ.exe
  C:\Windows\System\StLjfwZ.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\RDCBjKv.exe
  C:\Windows\System\RDCBjKv.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\fgYRzWI.exe
  C:\Windows\System\fgYRzWI.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\QdIKuTU.exe
  C:\Windows\System\QdIKuTU.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\AWaKVSr.exe
  C:\Windows\System\AWaKVSr.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\LiiFogs.exe
  C:\Windows\System\LiiFogs.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\mZczOxm.exe
  C:\Windows\System\mZczOxm.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\HRAMqGv.exe
  C:\Windows\System\HRAMqGv.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\IrAOGGc.exe
  C:\Windows\System\IrAOGGc.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\GhYqbcn.exe
  C:\Windows\System\GhYqbcn.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\dsunEPi.exe
  C:\Windows\System\dsunEPi.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\npNUTBu.exe
  C:\Windows\System\npNUTBu.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\eySkmFm.exe
  C:\Windows\System\eySkmFm.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\eheIkSi.exe
  C:\Windows\System\eheIkSi.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\kLyAGES.exe
  C:\Windows\System\kLyAGES.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\BcngtQK.exe
  C:\Windows\System\BcngtQK.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\lfHvAwo.exe
  C:\Windows\System\lfHvAwo.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\IxjbJai.exe
  C:\Windows\System\IxjbJai.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\cWAJjtZ.exe
  C:\Windows\System\cWAJjtZ.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\NjuOkDu.exe
  C:\Windows\System\NjuOkDu.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\uNVXexk.exe
  C:\Windows\System\uNVXexk.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\RFNyfYS.exe
  C:\Windows\System\RFNyfYS.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\llUbIMq.exe
  C:\Windows\System\llUbIMq.exe
  2⤵
  PID:3824
- C:\Windows\System\QWjNBao.exe
  C:\Windows\System\QWjNBao.exe
  2⤵
  PID:1860
- C:\Windows\System\DiLTOFf.exe
  C:\Windows\System\DiLTOFf.exe
  2⤵
  PID:2960
- C:\Windows\System\yyNWkqd.exe
  C:\Windows\System\yyNWkqd.exe
  2⤵
  PID:2060
- C:\Windows\System\KPOyznS.exe
  C:\Windows\System\KPOyznS.exe
  2⤵
  PID:2188
- C:\Windows\System\AWaGhKV.exe
  C:\Windows\System\AWaGhKV.exe
  2⤵
  PID:484
- C:\Windows\System\qLSYLMn.exe
  C:\Windows\System\qLSYLMn.exe
  2⤵
  PID:2932
- C:\Windows\System\UZsFSUw.exe
  C:\Windows\System\UZsFSUw.exe
  2⤵
  PID:2160
- C:\Windows\System\ONobuUY.exe
  C:\Windows\System\ONobuUY.exe
  2⤵
  PID:3268
- C:\Windows\System\jbBmWiY.exe
  C:\Windows\System\jbBmWiY.exe
  2⤵
  PID:2076
- C:\Windows\System\nBzxtQM.exe
  C:\Windows\System\nBzxtQM.exe
  2⤵
  PID:4536
- C:\Windows\System\CrtyGLp.exe
  C:\Windows\System\CrtyGLp.exe
  2⤵
  PID:900
- C:\Windows\System\ttuCFTT.exe
  C:\Windows\System\ttuCFTT.exe
  2⤵
  PID:3144
- C:\Windows\System\ERHcdZn.exe
  C:\Windows\System\ERHcdZn.exe
  2⤵
  PID:5092
- C:\Windows\System\YiTmjrk.exe
  C:\Windows\System\YiTmjrk.exe
  2⤵
  PID:3168
- C:\Windows\System\VWiWtak.exe
  C:\Windows\System\VWiWtak.exe
  2⤵
  PID:5036
- C:\Windows\System\rPFTyQQ.exe
  C:\Windows\System\rPFTyQQ.exe
  2⤵
  PID:1444
- C:\Windows\System\UVcOeDF.exe
  C:\Windows\System\UVcOeDF.exe
  2⤵
  PID:960
- C:\Windows\System\pcvCTVX.exe
  C:\Windows\System\pcvCTVX.exe
  2⤵
  PID:3288
- C:\Windows\System\BcHXFyp.exe
  C:\Windows\System\BcHXFyp.exe
  2⤵
  PID:5140
- C:\Windows\System\ctVBTFT.exe
  C:\Windows\System\ctVBTFT.exe
  2⤵
  PID:5168
- C:\Windows\System\UxRFouo.exe
  C:\Windows\System\UxRFouo.exe
  2⤵
  PID:5196
- C:\Windows\System\NOADxNK.exe
  C:\Windows\System\NOADxNK.exe
  2⤵
  PID:5224
- C:\Windows\System\Pxcuudo.exe
  C:\Windows\System\Pxcuudo.exe
  2⤵
  PID:5252
- C:\Windows\System\ajADlFq.exe
  C:\Windows\System\ajADlFq.exe
  2⤵
  PID:5280
- C:\Windows\System\dGmVIMb.exe
  C:\Windows\System\dGmVIMb.exe
  2⤵
  PID:5308
- C:\Windows\System\QRmjhoC.exe
  C:\Windows\System\QRmjhoC.exe
  2⤵
  PID:5336
- C:\Windows\System\TJqXRtf.exe
  C:\Windows\System\TJqXRtf.exe
  2⤵
  PID:5364
- C:\Windows\System\UJhoLyd.exe
  C:\Windows\System\UJhoLyd.exe
  2⤵
  PID:5392
- C:\Windows\System\hFUxydE.exe
  C:\Windows\System\hFUxydE.exe
  2⤵
  PID:5420
- C:\Windows\System\gwoiVEQ.exe
  C:\Windows\System\gwoiVEQ.exe
  2⤵
  PID:5448
- C:\Windows\System\VMoWAYK.exe
  C:\Windows\System\VMoWAYK.exe
  2⤵
  PID:5476
- C:\Windows\System\pDVavto.exe
  C:\Windows\System\pDVavto.exe
  2⤵
  PID:5504
- C:\Windows\System\olDbrvX.exe
  C:\Windows\System\olDbrvX.exe
  2⤵
  PID:5532
- C:\Windows\System\GtNaMgf.exe
  C:\Windows\System\GtNaMgf.exe
  2⤵
  PID:5560
- C:\Windows\System\kUSRkKz.exe
  C:\Windows\System\kUSRkKz.exe
  2⤵
  PID:5588
- C:\Windows\System\wtBUcvs.exe
  C:\Windows\System\wtBUcvs.exe
  2⤵
  PID:5616
- C:\Windows\System\AKhNtZM.exe
  C:\Windows\System\AKhNtZM.exe
  2⤵
  PID:5644
- C:\Windows\System\sIRCjfO.exe
  C:\Windows\System\sIRCjfO.exe
  2⤵
  PID:5672
- C:\Windows\System\udHAglq.exe
  C:\Windows\System\udHAglq.exe
  2⤵
  PID:5696
- C:\Windows\System\zaESLMT.exe
  C:\Windows\System\zaESLMT.exe
  2⤵
  PID:5724
- C:\Windows\System\hgyuGTR.exe
  C:\Windows\System\hgyuGTR.exe
  2⤵
  PID:5756
- C:\Windows\System\WEyvdXB.exe
  C:\Windows\System\WEyvdXB.exe
  2⤵
  PID:5780
- C:\Windows\System\itUMBXP.exe
  C:\Windows\System\itUMBXP.exe
  2⤵
  PID:5808
- C:\Windows\System\YDLETJw.exe
  C:\Windows\System\YDLETJw.exe
  2⤵
  PID:5840
- C:\Windows\System\xeNVynq.exe
  C:\Windows\System\xeNVynq.exe
  2⤵
  PID:5868
- C:\Windows\System\jIvxvTK.exe
  C:\Windows\System\jIvxvTK.exe
  2⤵
  PID:5896
- C:\Windows\System\CwHSDBA.exe
  C:\Windows\System\CwHSDBA.exe
  2⤵
  PID:5924
- C:\Windows\System\IqSqthq.exe
  C:\Windows\System\IqSqthq.exe
  2⤵
  PID:5952
- C:\Windows\System\wHlvXOL.exe
  C:\Windows\System\wHlvXOL.exe
  2⤵
  PID:5976
- C:\Windows\System\VkMmpbv.exe
  C:\Windows\System\VkMmpbv.exe
  2⤵
  PID:6008
- C:\Windows\System\ljGGGvp.exe
  C:\Windows\System\ljGGGvp.exe
  2⤵
  PID:6036
- C:\Windows\System\uvoBjMX.exe
  C:\Windows\System\uvoBjMX.exe
  2⤵
  PID:6064
- C:\Windows\System\OnwskwE.exe
  C:\Windows\System\OnwskwE.exe
  2⤵
  PID:6092
- C:\Windows\System\gmjDuSf.exe
  C:\Windows\System\gmjDuSf.exe
  2⤵
  PID:6120
- C:\Windows\System\UlZaDYk.exe
  C:\Windows\System\UlZaDYk.exe
  2⤵
  PID:464
- C:\Windows\System\HqzWFxF.exe
  C:\Windows\System\HqzWFxF.exe
  2⤵
  PID:2084
- C:\Windows\System\ybvPlLi.exe
  C:\Windows\System\ybvPlLi.exe
  2⤵
  PID:1228
- C:\Windows\System\cMdKYLA.exe
  C:\Windows\System\cMdKYLA.exe
  2⤵
  PID:4448
- C:\Windows\System\etEJGhQ.exe
  C:\Windows\System\etEJGhQ.exe
  2⤵
  PID:4384
- C:\Windows\System\cjfWwpp.exe
  C:\Windows\System\cjfWwpp.exe
  2⤵
  PID:1152
- C:\Windows\System\HJmUklS.exe
  C:\Windows\System\HJmUklS.exe
  2⤵
  PID:5128
- C:\Windows\System\UfkZSns.exe
  C:\Windows\System\UfkZSns.exe
  2⤵
  PID:5208
- C:\Windows\System\CHWDBSf.exe
  C:\Windows\System\CHWDBSf.exe
  2⤵
  PID:5268
- C:\Windows\System\kZeqAXR.exe
  C:\Windows\System\kZeqAXR.exe
  2⤵
  PID:5328
- C:\Windows\System\tvuelOw.exe
  C:\Windows\System\tvuelOw.exe
  2⤵
  PID:5404
- C:\Windows\System\rBsmufV.exe
  C:\Windows\System\rBsmufV.exe
  2⤵
  PID:5460
- C:\Windows\System\xRRUujD.exe
  C:\Windows\System\xRRUujD.exe
  2⤵
  PID:5520
- C:\Windows\System\GdVLwbn.exe
  C:\Windows\System\GdVLwbn.exe
  2⤵
  PID:5580
- C:\Windows\System\kOVxGsK.exe
  C:\Windows\System\kOVxGsK.exe
  2⤵
  PID:5656
- C:\Windows\System\zHUkcqX.exe
  C:\Windows\System\zHUkcqX.exe
  2⤵
  PID:5716
- C:\Windows\System\zsNzptz.exe
  C:\Windows\System\zsNzptz.exe
  2⤵
  PID:5796
- C:\Windows\System\zodCLBv.exe
  C:\Windows\System\zodCLBv.exe
  2⤵
  PID:5852
- C:\Windows\System\WmYyyZR.exe
  C:\Windows\System\WmYyyZR.exe
  2⤵
  PID:5912
- C:\Windows\System\sKAxgLr.exe
  C:\Windows\System\sKAxgLr.exe
  2⤵
  PID:5972
- C:\Windows\System\DOntQmr.exe
  C:\Windows\System\DOntQmr.exe
  2⤵
  PID:6048
- C:\Windows\System\ddPTcLs.exe
  C:\Windows\System\ddPTcLs.exe
  2⤵
  PID:6104
- C:\Windows\System\unALFny.exe
  C:\Windows\System\unALFny.exe
  2⤵
  PID:1288
- C:\Windows\System\ELioHIW.exe
  C:\Windows\System\ELioHIW.exe
  2⤵
  PID:4284
- C:\Windows\System\OWBPlSS.exe
  C:\Windows\System\OWBPlSS.exe
  2⤵
  PID:2256
- C:\Windows\System\izKsEBn.exe
  C:\Windows\System\izKsEBn.exe
  2⤵
  PID:5240
- C:\Windows\System\LIzkOII.exe
  C:\Windows\System\LIzkOII.exe
  2⤵
  PID:5380
- C:\Windows\System\xuTOSjC.exe
  C:\Windows\System\xuTOSjC.exe
  2⤵
  PID:5492
- C:\Windows\System\PpXBPOK.exe
  C:\Windows\System\PpXBPOK.exe
  2⤵
  PID:5576
- C:\Windows\System\CHAfjpi.exe
  C:\Windows\System\CHAfjpi.exe
  2⤵
  PID:4600
- C:\Windows\System\xeCCnxp.exe
  C:\Windows\System\xeCCnxp.exe
  2⤵
  PID:5832
- C:\Windows\System\nfVduNM.exe
  C:\Windows\System\nfVduNM.exe
  2⤵
  PID:5940
- C:\Windows\System\TZBWFAJ.exe
  C:\Windows\System\TZBWFAJ.exe
  2⤵
  PID:764
- C:\Windows\System\VjJUFsK.exe
  C:\Windows\System\VjJUFsK.exe
  2⤵
  PID:1968
- C:\Windows\System\KPOxxGh.exe
  C:\Windows\System\KPOxxGh.exe
  2⤵
  PID:5180
- C:\Windows\System\zQAPXCp.exe
  C:\Windows\System\zQAPXCp.exe
  2⤵
  PID:624
- C:\Windows\System\ZyTlCHi.exe
  C:\Windows\System\ZyTlCHi.exe
  2⤵
  PID:5748
- C:\Windows\System\iyzUHAg.exe
  C:\Windows\System\iyzUHAg.exe
  2⤵
  PID:1348
- C:\Windows\System\DRlOCaJ.exe
  C:\Windows\System\DRlOCaJ.exe
  2⤵
  PID:1624
- C:\Windows\System\kFGxciL.exe
  C:\Windows\System\kFGxciL.exe
  2⤵
  PID:6164
- C:\Windows\System\zhuNJZO.exe
  C:\Windows\System\zhuNJZO.exe
  2⤵
  PID:6196
- C:\Windows\System\qGtKppd.exe
  C:\Windows\System\qGtKppd.exe
  2⤵
  PID:6224
- C:\Windows\System\cyJuaYc.exe
  C:\Windows\System\cyJuaYc.exe
  2⤵
  PID:6252
- C:\Windows\System\xYyfQXh.exe
  C:\Windows\System\xYyfQXh.exe
  2⤵
  PID:6280
- C:\Windows\System\Bpkltnj.exe
  C:\Windows\System\Bpkltnj.exe
  2⤵
  PID:6308
- C:\Windows\System\xNNSHbn.exe
  C:\Windows\System\xNNSHbn.exe
  2⤵
  PID:6332
- C:\Windows\System\HWOfJkD.exe
  C:\Windows\System\HWOfJkD.exe
  2⤵
  PID:6364
- C:\Windows\System\hoMeWDr.exe
  C:\Windows\System\hoMeWDr.exe
  2⤵
  PID:6500
- C:\Windows\System\mJcYzYk.exe
  C:\Windows\System\mJcYzYk.exe
  2⤵
  PID:6532
- C:\Windows\System\jOZsVrP.exe
  C:\Windows\System\jOZsVrP.exe
  2⤵
  PID:6564
- C:\Windows\System\kNiDLOp.exe
  C:\Windows\System\kNiDLOp.exe
  2⤵
  PID:6584
- C:\Windows\System\zHAYOeO.exe
  C:\Windows\System\zHAYOeO.exe
  2⤵
  PID:6604
- C:\Windows\System\qRfrLoF.exe
  C:\Windows\System\qRfrLoF.exe
  2⤵
  PID:6652
- C:\Windows\System\TLkUymN.exe
  C:\Windows\System\TLkUymN.exe
  2⤵
  PID:6672
- C:\Windows\System\yKqrDEO.exe
  C:\Windows\System\yKqrDEO.exe
  2⤵
  PID:6716
- C:\Windows\System\CbApCbE.exe
  C:\Windows\System\CbApCbE.exe
  2⤵
  PID:6740
- C:\Windows\System\HeDnZhH.exe
  C:\Windows\System\HeDnZhH.exe
  2⤵
  PID:6816
- C:\Windows\System\xFdoqKh.exe
  C:\Windows\System\xFdoqKh.exe
  2⤵
  PID:6832
- C:\Windows\System\KWnVaZi.exe
  C:\Windows\System\KWnVaZi.exe
  2⤵
  PID:6856
- C:\Windows\System\wOvkMyW.exe
  C:\Windows\System\wOvkMyW.exe
  2⤵
  PID:6920
- C:\Windows\System\MYYWrPI.exe
  C:\Windows\System\MYYWrPI.exe
  2⤵
  PID:6948
- C:\Windows\System\QEwYhgA.exe
  C:\Windows\System\QEwYhgA.exe
  2⤵
  PID:6980
- C:\Windows\System\YPnrqwf.exe
  C:\Windows\System\YPnrqwf.exe
  2⤵
  PID:7008
- C:\Windows\System\eUhFgUC.exe
  C:\Windows\System\eUhFgUC.exe
  2⤵
  PID:7048
- C:\Windows\System\HyiAudB.exe
  C:\Windows\System\HyiAudB.exe
  2⤵
  PID:7096
- C:\Windows\System\UrzzKCa.exe
  C:\Windows\System\UrzzKCa.exe
  2⤵
  PID:7112
- C:\Windows\System\wSkLMkV.exe
  C:\Windows\System\wSkLMkV.exe
  2⤵
  PID:7144
- C:\Windows\System\RZkKPsN.exe
  C:\Windows\System\RZkKPsN.exe
  2⤵
  PID:7160
- C:\Windows\System\PbFTwRo.exe
  C:\Windows\System\PbFTwRo.exe
  2⤵
  PID:5688
- C:\Windows\System\AwExgcI.exe
  C:\Windows\System\AwExgcI.exe
  2⤵
  PID:6136
- C:\Windows\System\lLjsotk.exe
  C:\Windows\System\lLjsotk.exe
  2⤵
  PID:4180
- C:\Windows\System\iosmwBC.exe
  C:\Windows\System\iosmwBC.exe
  2⤵
  PID:6188
- C:\Windows\System\YqRLzXt.exe
  C:\Windows\System\YqRLzXt.exe
  2⤵
  PID:6236
- C:\Windows\System\TjVwJDx.exe
  C:\Windows\System\TjVwJDx.exe
  2⤵
  PID:6264
- C:\Windows\System\YNDDLId.exe
  C:\Windows\System\YNDDLId.exe
  2⤵
  PID:1072
- C:\Windows\System\IoHaRov.exe
  C:\Windows\System\IoHaRov.exe
  2⤵
  PID:1292
- C:\Windows\System\MOBGZwv.exe
  C:\Windows\System\MOBGZwv.exe
  2⤵
  PID:4768
- C:\Windows\System\rUPGMqs.exe
  C:\Windows\System\rUPGMqs.exe
  2⤵
  PID:760
- C:\Windows\System\QdgZAHQ.exe
  C:\Windows\System\QdgZAHQ.exe
  2⤵
  PID:3412
- C:\Windows\System\Ytnrnki.exe
  C:\Windows\System\Ytnrnki.exe
  2⤵
  PID:5108
- C:\Windows\System\ikoiOJe.exe
  C:\Windows\System\ikoiOJe.exe
  2⤵
  PID:2200
- C:\Windows\System\YZDIZWg.exe
  C:\Windows\System\YZDIZWg.exe
  2⤵
  PID:4032
- C:\Windows\System\ZNVPkPb.exe
  C:\Windows\System\ZNVPkPb.exe
  2⤵
  PID:6512
- C:\Windows\System\RwvHPhW.exe
  C:\Windows\System\RwvHPhW.exe
  2⤵
  PID:6552
- C:\Windows\System\jsCgvyS.exe
  C:\Windows\System\jsCgvyS.exe
  2⤵
  PID:1868
- C:\Windows\System\uBzDrGc.exe
  C:\Windows\System\uBzDrGc.exe
  2⤵
  PID:6736
- C:\Windows\System\GEBMYHD.exe
  C:\Windows\System\GEBMYHD.exe
  2⤵
  PID:1664
- C:\Windows\System\MSVMZBr.exe
  C:\Windows\System\MSVMZBr.exe
  2⤵
  PID:6844
- C:\Windows\System\XrCmFuQ.exe
  C:\Windows\System\XrCmFuQ.exe
  2⤵
  PID:6428
- C:\Windows\System\RFnYPOo.exe
  C:\Windows\System\RFnYPOo.exe
  2⤵
  PID:6448
- C:\Windows\System\UXJURkI.exe
  C:\Windows\System\UXJURkI.exe
  2⤵
  PID:7004
- C:\Windows\System\DQVqkDt.exe
  C:\Windows\System\DQVqkDt.exe
  2⤵
  PID:7060
- C:\Windows\System\vlXOOfI.exe
  C:\Windows\System\vlXOOfI.exe
  2⤵
  PID:6700
- C:\Windows\System\ZKMAXwl.exe
  C:\Windows\System\ZKMAXwl.exe
  2⤵
  PID:6804
- C:\Windows\System\khsnAhc.exe
  C:\Windows\System\khsnAhc.exe
  2⤵
  PID:5888
- C:\Windows\System\MynLIJU.exe
  C:\Windows\System\MynLIJU.exe
  2⤵
  PID:4992
- C:\Windows\System\krtUoCs.exe
  C:\Windows\System\krtUoCs.exe
  2⤵
  PID:6272
- C:\Windows\System\ySdying.exe
  C:\Windows\System\ySdying.exe
  2⤵
  PID:6324
- C:\Windows\System\hVlixeP.exe
  C:\Windows\System\hVlixeP.exe
  2⤵
  PID:1400
- C:\Windows\System\YYYQLDs.exe
  C:\Windows\System\YYYQLDs.exe
  2⤵
  PID:4484
- C:\Windows\System\BNYnQln.exe
  C:\Windows\System\BNYnQln.exe
  2⤵
  PID:4332
- C:\Windows\System\hPzWawo.exe
  C:\Windows\System\hPzWawo.exe
  2⤵
  PID:6708
- C:\Windows\System\EXNzPLw.exe
  C:\Windows\System\EXNzPLw.exe
  2⤵
  PID:6884
- C:\Windows\System\wZPcIEU.exe
  C:\Windows\System\wZPcIEU.exe
  2⤵
  PID:6972
- C:\Windows\System\SOfBsRJ.exe
  C:\Windows\System\SOfBsRJ.exe
  2⤵
  PID:6468
- C:\Windows\System\jjCDlRx.exe
  C:\Windows\System\jjCDlRx.exe
  2⤵
  PID:2668
- C:\Windows\System\RZJCogo.exe
  C:\Windows\System\RZJCogo.exe
  2⤵
  PID:6384
- C:\Windows\System\UsEqDxD.exe
  C:\Windows\System\UsEqDxD.exe
  2⤵
  PID:1744
- C:\Windows\System\maSgaJC.exe
  C:\Windows\System\maSgaJC.exe
  2⤵
  PID:6616
- C:\Windows\System\yuniQse.exe
  C:\Windows\System\yuniQse.exe
  2⤵
  PID:7152
- C:\Windows\System\MIYXtfZ.exe
  C:\Windows\System\MIYXtfZ.exe
  2⤵
  PID:2524
- C:\Windows\System\QAmJRrn.exe
  C:\Windows\System\QAmJRrn.exe
  2⤵
  PID:6492
- C:\Windows\System\oRezUGs.exe
  C:\Windows\System\oRezUGs.exe
  2⤵
  PID:7140
- C:\Windows\System\EAnKPzN.exe
  C:\Windows\System\EAnKPzN.exe
  2⤵
  PID:7184
- C:\Windows\System\wvlmzLN.exe
  C:\Windows\System\wvlmzLN.exe
  2⤵
  PID:7216
- C:\Windows\System\xcgHTvD.exe
  C:\Windows\System\xcgHTvD.exe
  2⤵
  PID:7232
- C:\Windows\System\WRhdzvG.exe
  C:\Windows\System\WRhdzvG.exe
  2⤵
  PID:7264
- C:\Windows\System\OLGeQaa.exe
  C:\Windows\System\OLGeQaa.exe
  2⤵
  PID:7300
- C:\Windows\System\OoLwSGt.exe
  C:\Windows\System\OoLwSGt.exe
  2⤵
  PID:7328
- C:\Windows\System\fSZTTto.exe
  C:\Windows\System\fSZTTto.exe
  2⤵
  PID:7356
- C:\Windows\System\ytBrhsf.exe
  C:\Windows\System\ytBrhsf.exe
  2⤵
  PID:7384
- C:\Windows\System\GrcvrDh.exe
  C:\Windows\System\GrcvrDh.exe
  2⤵
  PID:7412
- C:\Windows\System\VOsbBOG.exe
  C:\Windows\System\VOsbBOG.exe
  2⤵
  PID:7428
- C:\Windows\System\kccoREt.exe
  C:\Windows\System\kccoREt.exe
  2⤵
  PID:7456
- C:\Windows\System\PbWlooi.exe
  C:\Windows\System\PbWlooi.exe
  2⤵
  PID:7484
- C:\Windows\System\TNNZquJ.exe
  C:\Windows\System\TNNZquJ.exe
  2⤵
  PID:7524
- C:\Windows\System\NZLKldF.exe
  C:\Windows\System\NZLKldF.exe
  2⤵
  PID:7552
- C:\Windows\System\aBabLHb.exe
  C:\Windows\System\aBabLHb.exe
  2⤵
  PID:7580
- C:\Windows\System\nHJZJMc.exe
  C:\Windows\System\nHJZJMc.exe
  2⤵
  PID:7608
- C:\Windows\System\VrUsHHh.exe
  C:\Windows\System\VrUsHHh.exe
  2⤵
  PID:7636
- C:\Windows\System\DuYhOkZ.exe
  C:\Windows\System\DuYhOkZ.exe
  2⤵
  PID:7652
- C:\Windows\System\eoxIpoG.exe
  C:\Windows\System\eoxIpoG.exe
  2⤵
  PID:7680
- C:\Windows\System\XoqJLae.exe
  C:\Windows\System\XoqJLae.exe
  2⤵
  PID:7696
- C:\Windows\System\Gtcmrek.exe
  C:\Windows\System\Gtcmrek.exe
  2⤵
  PID:7712
- C:\Windows\System\NaDNaQY.exe
  C:\Windows\System\NaDNaQY.exe
  2⤵
  PID:7732
- C:\Windows\System\EXLTGwy.exe
  C:\Windows\System\EXLTGwy.exe
  2⤵
  PID:7752
- C:\Windows\System\kRDIbin.exe
  C:\Windows\System\kRDIbin.exe
  2⤵
  PID:7788
- C:\Windows\System\hPAuDrY.exe
  C:\Windows\System\hPAuDrY.exe
  2⤵
  PID:7848
- C:\Windows\System\zMvrBhe.exe
  C:\Windows\System\zMvrBhe.exe
  2⤵
  PID:7876
- C:\Windows\System\ubFEErB.exe
  C:\Windows\System\ubFEErB.exe
  2⤵
  PID:7908
- C:\Windows\System\eqZTISF.exe
  C:\Windows\System\eqZTISF.exe
  2⤵
  PID:7924
- C:\Windows\System\mPuePvd.exe
  C:\Windows\System\mPuePvd.exe
  2⤵
  PID:7940
- C:\Windows\System\mCsLQvt.exe
  C:\Windows\System\mCsLQvt.exe
  2⤵
  PID:7972
- C:\Windows\System\fhxuPqv.exe
  C:\Windows\System\fhxuPqv.exe
  2⤵
  PID:7996
- C:\Windows\System\WFmrDgt.exe
  C:\Windows\System\WFmrDgt.exe
  2⤵
  PID:8028
- C:\Windows\System\DUwWgkb.exe
  C:\Windows\System\DUwWgkb.exe
  2⤵
  PID:8056
- C:\Windows\System\WFJHGEV.exe
  C:\Windows\System\WFJHGEV.exe
  2⤵
  PID:8088
- C:\Windows\System\QWwXxtR.exe
  C:\Windows\System\QWwXxtR.exe
  2⤵
  PID:8116
- C:\Windows\System\ikEjLzo.exe
  C:\Windows\System\ikEjLzo.exe
  2⤵
  PID:8152
- C:\Windows\System\LOFYFDJ.exe
  C:\Windows\System\LOFYFDJ.exe
  2⤵
  PID:8188
- C:\Windows\System\VUzuHzD.exe
  C:\Windows\System\VUzuHzD.exe
  2⤵
  PID:7208
- C:\Windows\System\zHhdMHC.exe
  C:\Windows\System\zHhdMHC.exe
  2⤵
  PID:7296
- C:\Windows\System\CJRuXkG.exe
  C:\Windows\System\CJRuXkG.exe
  2⤵
  PID:7120
- C:\Windows\System\HqXArjL.exe
  C:\Windows\System\HqXArjL.exe
  2⤵
  PID:7404
- C:\Windows\System\OTNuvPs.exe
  C:\Windows\System\OTNuvPs.exe
  2⤵
  PID:7472
- C:\Windows\System\BHBRJeE.exe
  C:\Windows\System\BHBRJeE.exe
  2⤵
  PID:7512
- C:\Windows\System\vLDzKQN.exe
  C:\Windows\System\vLDzKQN.exe
  2⤵
  PID:7572
- C:\Windows\System\sBvlCug.exe
  C:\Windows\System\sBvlCug.exe
  2⤵
  PID:7648
- C:\Windows\System\zrVcFOh.exe
  C:\Windows\System\zrVcFOh.exe
  2⤵
  PID:7724
- C:\Windows\System\YJkNfuD.exe
  C:\Windows\System\YJkNfuD.exe
  2⤵
  PID:7784
- C:\Windows\System\PUbPZCe.exe
  C:\Windows\System\PUbPZCe.exe
  2⤵
  PID:7888
- C:\Windows\System\ObGmczp.exe
  C:\Windows\System\ObGmczp.exe
  2⤵
  PID:7960
- C:\Windows\System\dTelxVh.exe
  C:\Windows\System\dTelxVh.exe
  2⤵
  PID:7992
- C:\Windows\System\yFnPfuH.exe
  C:\Windows\System\yFnPfuH.exe
  2⤵
  PID:8044
- C:\Windows\System\BDGQUYe.exe
  C:\Windows\System\BDGQUYe.exe
  2⤵
  PID:8164
- C:\Windows\System\lWxNBjE.exe
  C:\Windows\System\lWxNBjE.exe
  2⤵
  PID:7172
- C:\Windows\System\YEVbKdJ.exe
  C:\Windows\System\YEVbKdJ.exe
  2⤵
  PID:7380
- C:\Windows\System\OcYWlfc.exe
  C:\Windows\System\OcYWlfc.exe
  2⤵
  PID:7548
- C:\Windows\System\mcNrGzh.exe
  C:\Windows\System\mcNrGzh.exe
  2⤵
  PID:7664
- C:\Windows\System\KbDzJuL.exe
  C:\Windows\System\KbDzJuL.exe
  2⤵
  PID:7840
- C:\Windows\System\bAggpuJ.exe
  C:\Windows\System\bAggpuJ.exe
  2⤵
  PID:7916
- C:\Windows\System\NPVnhyK.exe
  C:\Windows\System\NPVnhyK.exe
  2⤵
  PID:8144
- C:\Windows\System\pVdXILs.exe
  C:\Windows\System\pVdXILs.exe
  2⤵
  PID:7444
- C:\Windows\System\mTjrtxJ.exe
  C:\Windows\System\mTjrtxJ.exe
  2⤵
  PID:7704
- C:\Windows\System\goREHDM.exe
  C:\Windows\System\goREHDM.exe
  2⤵
  PID:8048
- C:\Windows\System\fuFvNIt.exe
  C:\Windows\System\fuFvNIt.exe
  2⤵
  PID:7804
- C:\Windows\System\ryLyUmL.exe
  C:\Windows\System\ryLyUmL.exe
  2⤵
  PID:8200
- C:\Windows\System\DZYwmrh.exe
  C:\Windows\System\DZYwmrh.exe
  2⤵
  PID:8228
- C:\Windows\System\VZZmqLF.exe
  C:\Windows\System\VZZmqLF.exe
  2⤵
  PID:8256
- C:\Windows\System\EkCPSDs.exe
  C:\Windows\System\EkCPSDs.exe
  2⤵
  PID:8284
- C:\Windows\System\EWzoMOk.exe
  C:\Windows\System\EWzoMOk.exe
  2⤵
  PID:8304
- C:\Windows\System\ypvGtdT.exe
  C:\Windows\System\ypvGtdT.exe
  2⤵
  PID:8328
- C:\Windows\System\pwpJeci.exe
  C:\Windows\System\pwpJeci.exe
  2⤵
  PID:8360
- C:\Windows\System\kXHGUHG.exe
  C:\Windows\System\kXHGUHG.exe
  2⤵
  PID:8380
- C:\Windows\System\lxZQmFj.exe
  C:\Windows\System\lxZQmFj.exe
  2⤵
  PID:8404
- C:\Windows\System\tkWJSJD.exe
  C:\Windows\System\tkWJSJD.exe
  2⤵
  PID:8428
- C:\Windows\System\GunMbuW.exe
  C:\Windows\System\GunMbuW.exe
  2⤵
  PID:8444
- C:\Windows\System\xbXFmwg.exe
  C:\Windows\System\xbXFmwg.exe
  2⤵
  PID:8472
- C:\Windows\System\oJcEXlZ.exe
  C:\Windows\System\oJcEXlZ.exe
  2⤵
  PID:8512
- C:\Windows\System\ACNozQq.exe
  C:\Windows\System\ACNozQq.exe
  2⤵
  PID:8564
- C:\Windows\System\BTfpRSu.exe
  C:\Windows\System\BTfpRSu.exe
  2⤵
  PID:8580
- C:\Windows\System\SxcRfWT.exe
  C:\Windows\System\SxcRfWT.exe
  2⤵
  PID:8608
- C:\Windows\System\EuObeaK.exe
  C:\Windows\System\EuObeaK.exe
  2⤵
  PID:8636
- C:\Windows\System\pyItuar.exe
  C:\Windows\System\pyItuar.exe
  2⤵
  PID:8664
- C:\Windows\System\friBviW.exe
  C:\Windows\System\friBviW.exe
  2⤵
  PID:8704
- C:\Windows\System\FfRcaCj.exe
  C:\Windows\System\FfRcaCj.exe
  2⤵
  PID:8720
- C:\Windows\System\DXMKHDC.exe
  C:\Windows\System\DXMKHDC.exe
  2⤵
  PID:8752
- C:\Windows\System\gYJUtWI.exe
  C:\Windows\System\gYJUtWI.exe
  2⤵
  PID:8832
- C:\Windows\System\VprhdNW.exe
  C:\Windows\System\VprhdNW.exe
  2⤵
  PID:8848
- C:\Windows\System\MoeLWbl.exe
  C:\Windows\System\MoeLWbl.exe
  2⤵
  PID:8864
- C:\Windows\System\ctTWrcN.exe
  C:\Windows\System\ctTWrcN.exe
  2⤵
  PID:8888
- C:\Windows\System\qyHcSRN.exe
  C:\Windows\System\qyHcSRN.exe
  2⤵
  PID:8920
- C:\Windows\System\EnMsFAK.exe
  C:\Windows\System\EnMsFAK.exe
  2⤵
  PID:8948
- C:\Windows\System\pggIxWY.exe
  C:\Windows\System\pggIxWY.exe
  2⤵
  PID:8980
- C:\Windows\System\nwFIpAx.exe
  C:\Windows\System\nwFIpAx.exe
  2⤵
  PID:9008
- C:\Windows\System\Nybsyjq.exe
  C:\Windows\System\Nybsyjq.exe
  2⤵
  PID:9032
- C:\Windows\System\cGIOIjf.exe
  C:\Windows\System\cGIOIjf.exe
  2⤵
  PID:9072
- C:\Windows\System\FNgloBG.exe
  C:\Windows\System\FNgloBG.exe
  2⤵
  PID:9100
- C:\Windows\System\bqxRPSI.exe
  C:\Windows\System\bqxRPSI.exe
  2⤵
  PID:9120
- C:\Windows\System\CHKvcDI.exe
  C:\Windows\System\CHKvcDI.exe
  2⤵
  PID:9144
- C:\Windows\System\rqSPTHT.exe
  C:\Windows\System\rqSPTHT.exe
  2⤵
  PID:9172
- C:\Windows\System\wObkClA.exe
  C:\Windows\System\wObkClA.exe
  2⤵
  PID:9200
- C:\Windows\System\YXmJdAD.exe
  C:\Windows\System\YXmJdAD.exe
  2⤵
  PID:8220
- C:\Windows\System\ubZWyXq.exe
  C:\Windows\System\ubZWyXq.exe
  2⤵
  PID:8280
- C:\Windows\System\QaQjHXp.exe
  C:\Windows\System\QaQjHXp.exe
  2⤵
  PID:8352
- C:\Windows\System\lwsNUif.exe
  C:\Windows\System\lwsNUif.exe
  2⤵
  PID:8400
- C:\Windows\System\GrKIJws.exe
  C:\Windows\System\GrKIJws.exe
  2⤵
  PID:8468
- C:\Windows\System\kWwwgaB.exe
  C:\Windows\System\kWwwgaB.exe
  2⤵
  PID:8576
- C:\Windows\System\tPzZFwQ.exe
  C:\Windows\System\tPzZFwQ.exe
  2⤵
  PID:8620
- C:\Windows\System\dCTthwI.exe
  C:\Windows\System\dCTthwI.exe
  2⤵
  PID:8700
- C:\Windows\System\qsYILxb.exe
  C:\Windows\System\qsYILxb.exe
  2⤵
  PID:8732
- C:\Windows\System\FdgpgDP.exe
  C:\Windows\System\FdgpgDP.exe
  2⤵
  PID:8772
- C:\Windows\System\MYLgsLo.exe
  C:\Windows\System\MYLgsLo.exe
  2⤵
  PID:8880
- C:\Windows\System\PtKyobH.exe
  C:\Windows\System\PtKyobH.exe
  2⤵
  PID:8964
- C:\Windows\System\rTsIOpw.exe
  C:\Windows\System\rTsIOpw.exe
  2⤵
  PID:8988
- C:\Windows\System\ibLPYQP.exe
  C:\Windows\System\ibLPYQP.exe
  2⤵
  PID:9128
- C:\Windows\System\myddfvr.exe
  C:\Windows\System\myddfvr.exe
  2⤵
  PID:9188
- C:\Windows\System\FiMjSgm.exe
  C:\Windows\System\FiMjSgm.exe
  2⤵
  PID:8252
- C:\Windows\System\QczlZjD.exe
  C:\Windows\System\QczlZjD.exe
  2⤵
  PID:8376
- C:\Windows\System\TwumGkQ.exe
  C:\Windows\System\TwumGkQ.exe
  2⤵
  PID:8460
- C:\Windows\System\zIivpoZ.exe
  C:\Windows\System\zIivpoZ.exe
  2⤵
  PID:8648
- C:\Windows\System\MtuYkrV.exe
  C:\Windows\System\MtuYkrV.exe
  2⤵
  PID:8768
- C:\Windows\System\XaSKvQl.exe
  C:\Windows\System\XaSKvQl.exe
  2⤵
  PID:9088
- C:\Windows\System\ZSYynHH.exe
  C:\Windows\System\ZSYynHH.exe
  2⤵
  PID:9156
- C:\Windows\System\aPgIdLC.exe
  C:\Windows\System\aPgIdLC.exe
  2⤵
  PID:8528
- C:\Windows\System\vQTyOKY.exe
  C:\Windows\System\vQTyOKY.exe
  2⤵
  PID:8504
- C:\Windows\System\YLzGUGT.exe
  C:\Windows\System\YLzGUGT.exe
  2⤵
  PID:9016
- C:\Windows\System\qlayRQc.exe
  C:\Windows\System\qlayRQc.exe
  2⤵
  PID:7772
- C:\Windows\System\DYfkGTi.exe
  C:\Windows\System\DYfkGTi.exe
  2⤵
  PID:9232
- C:\Windows\System\ROfWvKB.exe
  C:\Windows\System\ROfWvKB.exe
  2⤵
  PID:9256
- C:\Windows\System\TcSrgEG.exe
  C:\Windows\System\TcSrgEG.exe
  2⤵
  PID:9276
- C:\Windows\System\tBShfsf.exe
  C:\Windows\System\tBShfsf.exe
  2⤵
  PID:9308
- C:\Windows\System\fgAbYVB.exe
  C:\Windows\System\fgAbYVB.exe
  2⤵
  PID:9340
- C:\Windows\System\MyCFpSd.exe
  C:\Windows\System\MyCFpSd.exe
  2⤵
  PID:9372
- C:\Windows\System\OXCGSJZ.exe
  C:\Windows\System\OXCGSJZ.exe
  2⤵
  PID:9400
- C:\Windows\System\AiynmCM.exe
  C:\Windows\System\AiynmCM.exe
  2⤵
  PID:9424
- C:\Windows\System\LMSCHzo.exe
  C:\Windows\System\LMSCHzo.exe
  2⤵
  PID:9476
- C:\Windows\System\XWEUPmK.exe
  C:\Windows\System\XWEUPmK.exe
  2⤵
  PID:9504
- C:\Windows\System\NyoHRNj.exe
  C:\Windows\System\NyoHRNj.exe
  2⤵
  PID:9520
- C:\Windows\System\DLJSGoM.exe
  C:\Windows\System\DLJSGoM.exe
  2⤵
  PID:9548
- C:\Windows\System\LbEKMcS.exe
  C:\Windows\System\LbEKMcS.exe
  2⤵
  PID:9576
- C:\Windows\System\QDpQqXb.exe
  C:\Windows\System\QDpQqXb.exe
  2⤵
  PID:9604
- C:\Windows\System\AtGfjPz.exe
  C:\Windows\System\AtGfjPz.exe
  2⤵
  PID:9632
- C:\Windows\System\NIjQGXn.exe
  C:\Windows\System\NIjQGXn.exe
  2⤵
  PID:9660
- C:\Windows\System\QqGPmLY.exe
  C:\Windows\System\QqGPmLY.exe
  2⤵
  PID:9688
- C:\Windows\System\ELaCTZE.exe
  C:\Windows\System\ELaCTZE.exe
  2⤵
  PID:9716
- C:\Windows\System\CkdjGCE.exe
  C:\Windows\System\CkdjGCE.exe
  2⤵
  PID:9748
- C:\Windows\System\AbVpaxi.exe
  C:\Windows\System\AbVpaxi.exe
  2⤵
  PID:9788
- C:\Windows\System\ZAKefLG.exe
  C:\Windows\System\ZAKefLG.exe
  2⤵
  PID:9816
- C:\Windows\System\YuXprfY.exe
  C:\Windows\System\YuXprfY.exe
  2⤵
  PID:9844
- C:\Windows\System\pBhfsAM.exe
  C:\Windows\System\pBhfsAM.exe
  2⤵
  PID:9872
- C:\Windows\System\cHFziJY.exe
  C:\Windows\System\cHFziJY.exe
  2⤵
  PID:9888
- C:\Windows\System\cqQdVKW.exe
  C:\Windows\System\cqQdVKW.exe
  2⤵
  PID:9928
- C:\Windows\System\HJGHXbt.exe
  C:\Windows\System\HJGHXbt.exe
  2⤵
  PID:9944
- C:\Windows\System\qOIWqhr.exe
  C:\Windows\System\qOIWqhr.exe
  2⤵
  PID:9964
- C:\Windows\System\bQiSOaE.exe
  C:\Windows\System\bQiSOaE.exe
  2⤵
  PID:10000
- C:\Windows\System\WHcCtWA.exe
  C:\Windows\System\WHcCtWA.exe
  2⤵
  PID:10028
- C:\Windows\System\yZaxuWm.exe
  C:\Windows\System\yZaxuWm.exe
  2⤵
  PID:10068
- C:\Windows\System\LVCIofI.exe
  C:\Windows\System\LVCIofI.exe
  2⤵
  PID:10084
- C:\Windows\System\KvbofJT.exe
  C:\Windows\System\KvbofJT.exe
  2⤵
  PID:10116
- C:\Windows\System\dlUsSQM.exe
  C:\Windows\System\dlUsSQM.exe
  2⤵
  PID:10140
- C:\Windows\System\XnDrWpn.exe
  C:\Windows\System\XnDrWpn.exe
  2⤵
  PID:10168
- C:\Windows\System\ysXhmeY.exe
  C:\Windows\System\ysXhmeY.exe
  2⤵
  PID:10204
- C:\Windows\System\InMNBSX.exe
  C:\Windows\System\InMNBSX.exe
  2⤵
  PID:10224
- C:\Windows\System\mLCebRe.exe
  C:\Windows\System\mLCebRe.exe
  2⤵
  PID:9224
- C:\Windows\System\lRsiWOb.exe
  C:\Windows\System\lRsiWOb.exe
  2⤵
  PID:9264
- C:\Windows\System\ORFKvuJ.exe
  C:\Windows\System\ORFKvuJ.exe
  2⤵
  PID:9320
- C:\Windows\System\refyOaP.exe
  C:\Windows\System\refyOaP.exe
  2⤵
  PID:9368
- C:\Windows\System\ZaWkoYA.exe
  C:\Windows\System\ZaWkoYA.exe
  2⤵
  PID:9468
- C:\Windows\System\ifIdFRG.exe
  C:\Windows\System\ifIdFRG.exe
  2⤵
  PID:9516
- C:\Windows\System\fOyYGfu.exe
  C:\Windows\System\fOyYGfu.exe
  2⤵
  PID:9560
- C:\Windows\System\YBlnnFd.exe
  C:\Windows\System\YBlnnFd.exe
  2⤵
  PID:9620
- C:\Windows\System\tIzGZEc.exe
  C:\Windows\System\tIzGZEc.exe
  2⤵
  PID:9732
- C:\Windows\System\KuDvhpz.exe
  C:\Windows\System\KuDvhpz.exe
  2⤵
  PID:9784
- C:\Windows\System\kIUASjc.exe
  C:\Windows\System\kIUASjc.exe
  2⤵
  PID:9860
- C:\Windows\System\LNPSdeD.exe
  C:\Windows\System\LNPSdeD.exe
  2⤵
  PID:9920
- C:\Windows\System\VnVAQpJ.exe
  C:\Windows\System\VnVAQpJ.exe
  2⤵
  PID:9960
- C:\Windows\System\NdsPxZq.exe
  C:\Windows\System\NdsPxZq.exe
  2⤵
  PID:9984
- C:\Windows\System\PGifefm.exe
  C:\Windows\System\PGifefm.exe
  2⤵
  PID:10112
- C:\Windows\System\kZPLwJU.exe
  C:\Windows\System\kZPLwJU.exe
  2⤵
  PID:10196
- C:\Windows\System\EpqvJrR.exe
  C:\Windows\System\EpqvJrR.exe
  2⤵
  PID:8416
- C:\Windows\System\dAGKAAJ.exe
  C:\Windows\System\dAGKAAJ.exe
  2⤵
  PID:9300
- C:\Windows\System\mPpiaPu.exe
  C:\Windows\System\mPpiaPu.exe
  2⤵
  PID:9444
- C:\Windows\System\FzhITcM.exe
  C:\Windows\System\FzhITcM.exe
  2⤵
  PID:9644
- C:\Windows\System\KiynqLW.exe
  C:\Windows\System\KiynqLW.exe
  2⤵
  PID:9728
- C:\Windows\System\VIPSrHJ.exe
  C:\Windows\System\VIPSrHJ.exe
  2⤵
  PID:9904
- C:\Windows\System\tphrAEZ.exe
  C:\Windows\System\tphrAEZ.exe
  2⤵
  PID:10064
- C:\Windows\System\LHNCqxl.exe
  C:\Windows\System\LHNCqxl.exe
  2⤵
  PID:9292
- C:\Windows\System\ncHpliP.exe
  C:\Windows\System\ncHpliP.exe
  2⤵
  PID:9676
- C:\Windows\System\CRkCmQG.exe
  C:\Windows\System\CRkCmQG.exe
  2⤵
  PID:10016
- C:\Windows\System\NXxYdtU.exe
  C:\Windows\System\NXxYdtU.exe
  2⤵
  PID:9500
- C:\Windows\System\vAvLImE.exe
  C:\Windows\System\vAvLImE.exe
  2⤵
  PID:9952
- C:\Windows\System\axJMuNG.exe
  C:\Windows\System\axJMuNG.exe
  2⤵
  PID:10248
- C:\Windows\System\yqGImkH.exe
  C:\Windows\System\yqGImkH.exe
  2⤵
  PID:10276
- C:\Windows\System\gemGXCd.exe
  C:\Windows\System\gemGXCd.exe
  2⤵
  PID:10304
- C:\Windows\System\WHIadNT.exe
  C:\Windows\System\WHIadNT.exe
  2⤵
  PID:10344
- C:\Windows\System\DwULqqR.exe
  C:\Windows\System\DwULqqR.exe
  2⤵
  PID:10360
- C:\Windows\System\iYhorLG.exe
  C:\Windows\System\iYhorLG.exe
  2⤵
  PID:10388
- C:\Windows\System\zmMTVeA.exe
  C:\Windows\System\zmMTVeA.exe
  2⤵
  PID:10412
- C:\Windows\System\zZEuRaJ.exe
  C:\Windows\System\zZEuRaJ.exe
  2⤵
  PID:10444
- C:\Windows\System\UiYTNzx.exe
  C:\Windows\System\UiYTNzx.exe
  2⤵
  PID:10484
- C:\Windows\System\GdCFiWo.exe
  C:\Windows\System\GdCFiWo.exe
  2⤵
  PID:10500
- C:\Windows\System\jHszrjn.exe
  C:\Windows\System\jHszrjn.exe
  2⤵
  PID:10540
- C:\Windows\System\pVpvvTL.exe
  C:\Windows\System\pVpvvTL.exe
  2⤵
  PID:10568
- C:\Windows\System\KEwmQKi.exe
  C:\Windows\System\KEwmQKi.exe
  2⤵
  PID:10596
- C:\Windows\System\LrYFFxX.exe
  C:\Windows\System\LrYFFxX.exe
  2⤵
  PID:10624
- C:\Windows\System\QclpQiD.exe
  C:\Windows\System\QclpQiD.exe
  2⤵
  PID:10652
- C:\Windows\System\YrImliV.exe
  C:\Windows\System\YrImliV.exe
  2⤵
  PID:10668
- C:\Windows\System\PdmEICg.exe
  C:\Windows\System\PdmEICg.exe
  2⤵
  PID:10700
- C:\Windows\System\escTWmI.exe
  C:\Windows\System\escTWmI.exe
  2⤵
  PID:10724
- C:\Windows\System\CsqYuhD.exe
  C:\Windows\System\CsqYuhD.exe
  2⤵
  PID:10752
- C:\Windows\System\iHyVPgI.exe
  C:\Windows\System\iHyVPgI.exe
  2⤵
  PID:10792
- C:\Windows\System\jqZISjC.exe
  C:\Windows\System\jqZISjC.exe
  2⤵
  PID:10808
- C:\Windows\System\xDfMuLt.exe
  C:\Windows\System\xDfMuLt.exe
  2⤵
  PID:10836
- C:\Windows\System\bWvfLDZ.exe
  C:\Windows\System\bWvfLDZ.exe
  2⤵
  PID:10876
- C:\Windows\System\peuxCOU.exe
  C:\Windows\System\peuxCOU.exe
  2⤵
  PID:10896
- C:\Windows\System\uxBwjQJ.exe
  C:\Windows\System\uxBwjQJ.exe
  2⤵
  PID:10916
- C:\Windows\System\iwCiVkQ.exe
  C:\Windows\System\iwCiVkQ.exe
  2⤵
  PID:10940
- C:\Windows\System\JfEgBcZ.exe
  C:\Windows\System\JfEgBcZ.exe
  2⤵
  PID:10964
- C:\Windows\System\uVtnLVu.exe
  C:\Windows\System\uVtnLVu.exe
  2⤵
  PID:11020
- C:\Windows\System\NsWOonp.exe
  C:\Windows\System\NsWOonp.exe
  2⤵
  PID:11040
- C:\Windows\System\wOGQRSJ.exe
  C:\Windows\System\wOGQRSJ.exe
  2⤵
  PID:11068
- C:\Windows\System\yJKIPrk.exe
  C:\Windows\System\yJKIPrk.exe
  2⤵
  PID:11096
- C:\Windows\System\sElJfud.exe
  C:\Windows\System\sElJfud.exe
  2⤵
  PID:11136
- C:\Windows\System\xCjtwtH.exe
  C:\Windows\System\xCjtwtH.exe
  2⤵
  PID:11156
- C:\Windows\System\DXqgiaK.exe
  C:\Windows\System\DXqgiaK.exe
  2⤵
  PID:11180
- C:\Windows\System\aevbFwn.exe
  C:\Windows\System\aevbFwn.exe
  2⤵
  PID:11204
- C:\Windows\System\hTCpjmw.exe
  C:\Windows\System\hTCpjmw.exe
  2⤵
  PID:11224
- C:\Windows\System\ytYGiZQ.exe
  C:\Windows\System\ytYGiZQ.exe
  2⤵
  PID:11240
- C:\Windows\System\fmsnaDO.exe
  C:\Windows\System\fmsnaDO.exe
  2⤵
  PID:10268
- C:\Windows\System\KdkkXQp.exe
  C:\Windows\System\KdkkXQp.exe
  2⤵
  PID:10316
- C:\Windows\System\AUrcZTM.exe
  C:\Windows\System\AUrcZTM.exe
  2⤵
  PID:10404
- C:\Windows\System\GxUAjKK.exe
  C:\Windows\System\GxUAjKK.exe
  2⤵
  PID:10428
- C:\Windows\System\OIrUHZL.exe
  C:\Windows\System\OIrUHZL.exe
  2⤵
  PID:10496
- C:\Windows\System\dhnZiRA.exe
  C:\Windows\System\dhnZiRA.exe
  2⤵
  PID:10560
- C:\Windows\System\firmjIe.exe
  C:\Windows\System\firmjIe.exe
  2⤵
  PID:10680
- C:\Windows\System\SmppNWc.exe
  C:\Windows\System\SmppNWc.exe
  2⤵
  PID:10748
- C:\Windows\System\kLKKvsz.exe
  C:\Windows\System\kLKKvsz.exe
  2⤵
  PID:10832
- C:\Windows\System\NOlYNGv.exe
  C:\Windows\System\NOlYNGv.exe
  2⤵
  PID:10848
- C:\Windows\System\iGxJtfq.exe
  C:\Windows\System\iGxJtfq.exe
  2⤵
  PID:10928
- C:\Windows\System\lJjwZMh.exe
  C:\Windows\System\lJjwZMh.exe
  2⤵
  PID:11000
- C:\Windows\System\bfacwDO.exe
  C:\Windows\System\bfacwDO.exe
  2⤵
  PID:11052
- C:\Windows\System\xWaTxrx.exe
  C:\Windows\System\xWaTxrx.exe
  2⤵
  PID:11116
- C:\Windows\System\mjgiyPL.exe
  C:\Windows\System\mjgiyPL.exe
  2⤵
  PID:11220
- C:\Windows\System\zZiKGSM.exe
  C:\Windows\System\zZiKGSM.exe
  2⤵
  PID:9600
- C:\Windows\System\DOfFhjY.exe
  C:\Windows\System\DOfFhjY.exe
  2⤵
  PID:10372
- C:\Windows\System\zNnCdcc.exe
  C:\Windows\System\zNnCdcc.exe
  2⤵
  PID:10552
- C:\Windows\System\xjBtvXY.exe
  C:\Windows\System\xjBtvXY.exe
  2⤵
  PID:10640
- C:\Windows\System\XjfugrS.exe
  C:\Windows\System\XjfugrS.exe
  2⤵
  PID:10784
- C:\Windows\System\tTJfkUL.exe
  C:\Windows\System\tTJfkUL.exe
  2⤵
  PID:10960
- C:\Windows\System\AEuSYnC.exe
  C:\Windows\System\AEuSYnC.exe
  2⤵
  PID:11088
- C:\Windows\System\YKagOEd.exe
  C:\Windows\System\YKagOEd.exe
  2⤵
  PID:11196
- C:\Windows\System\EZgwbZA.exe
  C:\Windows\System\EZgwbZA.exe
  2⤵
  PID:10804
- C:\Windows\System\GTXERAN.exe
  C:\Windows\System\GTXERAN.exe
  2⤵
  PID:11260
- C:\Windows\System\eWISCZo.exe
  C:\Windows\System\eWISCZo.exe
  2⤵
  PID:10720
- C:\Windows\System\ZzBtWSX.exe
  C:\Windows\System\ZzBtWSX.exe
  2⤵
  PID:11284
- C:\Windows\System\IWbnkGs.exe
  C:\Windows\System\IWbnkGs.exe
  2⤵
  PID:11300
- C:\Windows\System\ezllKzb.exe
  C:\Windows\System\ezllKzb.exe
  2⤵
  PID:11328
- C:\Windows\System\KZRjsGN.exe
  C:\Windows\System\KZRjsGN.exe
  2⤵
  PID:11356
- C:\Windows\System\bwWvPHp.exe
  C:\Windows\System\bwWvPHp.exe
  2⤵
  PID:11384
- C:\Windows\System\PAPMLGa.exe
  C:\Windows\System\PAPMLGa.exe
  2⤵
  PID:11400
- C:\Windows\System\EvpSoaL.exe
  C:\Windows\System\EvpSoaL.exe
  2⤵
  PID:11428
- C:\Windows\System\bbjIJiN.exe
  C:\Windows\System\bbjIJiN.exe
  2⤵
  PID:11444
- C:\Windows\System\WwPTQkO.exe
  C:\Windows\System\WwPTQkO.exe
  2⤵
  PID:11464
- C:\Windows\System\oOmPwjE.exe
  C:\Windows\System\oOmPwjE.exe
  2⤵
  PID:11524
- C:\Windows\System\gWEaXOU.exe
  C:\Windows\System\gWEaXOU.exe
  2⤵
  PID:11552
- C:\Windows\System\ZMvlBIg.exe
  C:\Windows\System\ZMvlBIg.exe
  2⤵
  PID:11588
- C:\Windows\System\OlkkZPA.exe
  C:\Windows\System\OlkkZPA.exe
  2⤵
  PID:11608
- C:\Windows\System\mKxbXte.exe
  C:\Windows\System\mKxbXte.exe
  2⤵
  PID:11636
- C:\Windows\System\nddvnJy.exe
  C:\Windows\System\nddvnJy.exe
  2⤵
  PID:11664
- C:\Windows\System\GePbKdl.exe
  C:\Windows\System\GePbKdl.exe
  2⤵
  PID:11692
- C:\Windows\System\zayqPXW.exe
  C:\Windows\System\zayqPXW.exe
  2⤵
  PID:11724
- C:\Windows\System\UCmegNz.exe
  C:\Windows\System\UCmegNz.exe
  2⤵
  PID:11744
- C:\Windows\System\PfKTNCu.exe
  C:\Windows\System\PfKTNCu.exe
  2⤵
  PID:11776
- C:\Windows\System\yYGnkXR.exe
  C:\Windows\System\yYGnkXR.exe
  2⤵
  PID:11804
- C:\Windows\System\wBXUBlE.exe
  C:\Windows\System\wBXUBlE.exe
  2⤵
  PID:11844
- C:\Windows\System\vwBtMhX.exe
  C:\Windows\System\vwBtMhX.exe
  2⤵
  PID:11860
- C:\Windows\System\nzJZVZK.exe
  C:\Windows\System\nzJZVZK.exe
  2⤵
  PID:11888
- C:\Windows\System\olRrSaj.exe
  C:\Windows\System\olRrSaj.exe
  2⤵
  PID:11920
- C:\Windows\System\nniEqWc.exe
  C:\Windows\System\nniEqWc.exe
  2⤵
  PID:11956
- C:\Windows\System\XbuzFaN.exe
  C:\Windows\System\XbuzFaN.exe
  2⤵
  PID:11984
- C:\Windows\System\vxNJclF.exe
  C:\Windows\System\vxNJclF.exe
  2⤵
  PID:12012
- C:\Windows\System\xZWHSND.exe
  C:\Windows\System\xZWHSND.exe
  2⤵
  PID:12032
- C:\Windows\System\wwQXOwx.exe
  C:\Windows\System\wwQXOwx.exe
  2⤵
  PID:12060
- C:\Windows\System\BJNIyrC.exe
  C:\Windows\System\BJNIyrC.exe
  2⤵
  PID:12084
- C:\Windows\System\KIQtIoT.exe
  C:\Windows\System\KIQtIoT.exe
  2⤵
  PID:12112
- C:\Windows\System\hnnYvHH.exe
  C:\Windows\System\hnnYvHH.exe
  2⤵
  PID:12144
- C:\Windows\System\rtpkDaG.exe
  C:\Windows\System\rtpkDaG.exe
  2⤵
  PID:12172
- C:\Windows\System\RWsPIww.exe
  C:\Windows\System\RWsPIww.exe
  2⤵
  PID:12200
- C:\Windows\System\DOZiefj.exe
  C:\Windows\System\DOZiefj.exe
  2⤵
  PID:12240
- C:\Windows\System\GyBCymf.exe
  C:\Windows\System\GyBCymf.exe
  2⤵
  PID:12268
- C:\Windows\System\xhcGqqn.exe
  C:\Windows\System\xhcGqqn.exe
  2⤵
  PID:10932
- C:\Windows\System\zIoMYgT.exe
  C:\Windows\System\zIoMYgT.exe
  2⤵
  PID:11316
- C:\Windows\System\Kjllkmx.exe
  C:\Windows\System\Kjllkmx.exe
  2⤵
  PID:11368
- C:\Windows\System\esPRAEj.exe
  C:\Windows\System\esPRAEj.exe
  2⤵
  PID:11440
- C:\Windows\System\aUKvHWK.exe
  C:\Windows\System\aUKvHWK.exe
  2⤵
  PID:11504
- C:\Windows\System\aPasDFn.exe
  C:\Windows\System\aPasDFn.exe
  2⤵
  PID:11560
- C:\Windows\System\uNXrfdy.exe
  C:\Windows\System\uNXrfdy.exe
  2⤵
  PID:11620
- C:\Windows\System\QBXcRlO.exe
  C:\Windows\System\QBXcRlO.exe
  2⤵
  PID:11684
- C:\Windows\System\VCoRHIS.exe
  C:\Windows\System\VCoRHIS.exe
  2⤵
  PID:11768
- C:\Windows\System\pwGdorg.exe
  C:\Windows\System\pwGdorg.exe
  2⤵
  PID:11832
- C:\Windows\System\TsyDhha.exe
  C:\Windows\System\TsyDhha.exe
  2⤵
  PID:11876
- C:\Windows\System\djJMqCA.exe
  C:\Windows\System\djJMqCA.exe
  2⤵
  PID:11976
- C:\Windows\System\PMIBZEm.exe
  C:\Windows\System\PMIBZEm.exe
  2⤵
  PID:12000
- C:\Windows\System\kZxnDLz.exe
  C:\Windows\System\kZxnDLz.exe
  2⤵
  PID:12076
- C:\Windows\System\zQUAYDZ.exe
  C:\Windows\System\zQUAYDZ.exe
  2⤵
  PID:12136
- C:\Windows\System\YGVtjWD.exe
  C:\Windows\System\YGVtjWD.exe
  2⤵
  PID:12188
- C:\Windows\System\DOZKgtI.exe
  C:\Windows\System\DOZKgtI.exe
  2⤵
  PID:12232
- C:\Windows\System\zCPsWou.exe
  C:\Windows\System\zCPsWou.exe
  2⤵
  PID:12260
- C:\Windows\System\BiqLlVo.exe
  C:\Windows\System\BiqLlVo.exe
  2⤵
  PID:11476
- C:\Windows\System\YFlSVpT.exe
  C:\Windows\System\YFlSVpT.exe
  2⤵
  PID:11632
- C:\Windows\System\xMwCytp.exe
  C:\Windows\System\xMwCytp.exe
  2⤵
  PID:11736
- C:\Windows\System\MvIJjsf.exe
  C:\Windows\System\MvIJjsf.exe
  2⤵
  PID:11952
- C:\Windows\System\Qbfohqe.exe
  C:\Windows\System\Qbfohqe.exe
  2⤵
  PID:12020
- C:\Windows\System\hgVCPAO.exe
  C:\Windows\System\hgVCPAO.exe
  2⤵
  PID:12236
- C:\Windows\System\QRLTTAc.exe
  C:\Windows\System\QRLTTAc.exe
  2⤵
  PID:11396
- C:\Windows\System\nGfdBNm.exe
  C:\Windows\System\nGfdBNm.exe
  2⤵
  PID:11704
- C:\Windows\System\AOwTXcr.exe
  C:\Windows\System\AOwTXcr.exe
  2⤵
  PID:11576
- C:\Windows\System\SgCrFOx.exe
  C:\Windows\System\SgCrFOx.exe
  2⤵
  PID:12104
- C:\Windows\System\pzWMflv.exe
  C:\Windows\System\pzWMflv.exe
  2⤵
  PID:12184
- C:\Windows\System\AZRuCxs.exe
  C:\Windows\System\AZRuCxs.exe
  2⤵
  PID:12316
- C:\Windows\System\GgQGrSC.exe
  C:\Windows\System\GgQGrSC.exe
  2⤵
  PID:12344
- C:\Windows\System\KUfxxEB.exe
  C:\Windows\System\KUfxxEB.exe
  2⤵
  PID:12372
- C:\Windows\System\vjYvvSq.exe
  C:\Windows\System\vjYvvSq.exe
  2⤵
  PID:12400
- C:\Windows\System\htgimIe.exe
  C:\Windows\System\htgimIe.exe
  2⤵
  PID:12416
- C:\Windows\System\Uecckdd.exe
  C:\Windows\System\Uecckdd.exe
  2⤵
  PID:12468
- C:\Windows\System\uPaBXAY.exe
  C:\Windows\System\uPaBXAY.exe
  2⤵
  PID:12496
- C:\Windows\System\bEwtyVv.exe
  C:\Windows\System\bEwtyVv.exe
  2⤵
  PID:12516
- C:\Windows\System\sVzrgYh.exe
  C:\Windows\System\sVzrgYh.exe
  2⤵
  PID:12540
- C:\Windows\System\hxSbluW.exe
  C:\Windows\System\hxSbluW.exe
  2⤵
  PID:12580
- C:\Windows\System\hHvRpcM.exe
  C:\Windows\System\hHvRpcM.exe
  2⤵
  PID:12608
- C:\Windows\System\dwnoJkK.exe
  C:\Windows\System\dwnoJkK.exe
  2⤵
  PID:12636
- C:\Windows\System\npsueUq.exe
  C:\Windows\System\npsueUq.exe
  2⤵
  PID:12652
- C:\Windows\System\BehHoYm.exe
  C:\Windows\System\BehHoYm.exe
  2⤵
  PID:12684
- C:\Windows\System\QSGMBFB.exe
  C:\Windows\System\QSGMBFB.exe
  2⤵
  PID:12724
- C:\Windows\System\cCWnIWM.exe
  C:\Windows\System\cCWnIWM.exe
  2⤵
  PID:12740
- C:\Windows\System\lqbPNMw.exe
  C:\Windows\System\lqbPNMw.exe
  2⤵
  PID:12780
- C:\Windows\System\rJcfJcx.exe
  C:\Windows\System\rJcfJcx.exe
  2⤵
  PID:12796
- C:\Windows\System\ocYQaHs.exe
  C:\Windows\System\ocYQaHs.exe
  2⤵
  PID:12820
- C:\Windows\System\EWUzsFq.exe
  C:\Windows\System\EWUzsFq.exe
  2⤵
  PID:12844
- C:\Windows\System\EXITCqr.exe
  C:\Windows\System\EXITCqr.exe
  2⤵
  PID:12872
- C:\Windows\System\KRVDnuE.exe
  C:\Windows\System\KRVDnuE.exe
  2⤵
  PID:12892
- C:\Windows\System\EfPPzNc.exe
  C:\Windows\System\EfPPzNc.exe
  2⤵
  PID:12932
- C:\Windows\System\DDkUgtN.exe
  C:\Windows\System\DDkUgtN.exe
  2⤵
  PID:12960
- C:\Windows\System\boaSFhI.exe
  C:\Windows\System\boaSFhI.exe
  2⤵
  PID:12992
- C:\Windows\System\sNxUAns.exe
  C:\Windows\System\sNxUAns.exe
  2⤵
  PID:13012
- C:\Windows\System\ifyFKCO.exe
  C:\Windows\System\ifyFKCO.exe
  2⤵
  PID:13052
- C:\Windows\System\GeYUZra.exe
  C:\Windows\System\GeYUZra.exe
  2⤵
  PID:13088
- C:\Windows\System\uPHEjhT.exe
  C:\Windows\System\uPHEjhT.exe
  2⤵
  PID:13104
- C:\Windows\System\WzUPeIy.exe
  C:\Windows\System\WzUPeIy.exe
  2⤵
  PID:13124
- C:\Windows\System\CcXnVAH.exe
  C:\Windows\System\CcXnVAH.exe
  2⤵
  PID:13160
- C:\Windows\System\HvvFKUE.exe
  C:\Windows\System\HvvFKUE.exe
  2⤵
  PID:13184
- C:\Windows\System\XMQrtSX.exe
  C:\Windows\System\XMQrtSX.exe
  2⤵
  PID:13216
- C:\Windows\System\iEUzMIb.exe
  C:\Windows\System\iEUzMIb.exe
  2⤵
  PID:13260
- C:\Windows\System\IpJvLKq.exe
  C:\Windows\System\IpJvLKq.exe
  2⤵
  PID:13276
- C:\Windows\System\sueaDTh.exe
  C:\Windows\System\sueaDTh.exe
  2⤵
  PID:10852
- C:\Windows\System\VHqXpOx.exe
  C:\Windows\System\VHqXpOx.exe
  2⤵
  PID:12392
- C:\Windows\System\ugBgSnd.exe
  C:\Windows\System\ugBgSnd.exe
  2⤵
  PID:12360
- C:\Windows\System\MhWxGvb.exe
  C:\Windows\System\MhWxGvb.exe
  2⤵
  PID:12432
- C:\Windows\System\uYCgcFv.exe
  C:\Windows\System\uYCgcFv.exe
  2⤵
  PID:12484
- C:\Windows\System\tEfrHsB.exe
  C:\Windows\System\tEfrHsB.exe
  2⤵
  PID:12532
- C:\Windows\System\EjDqrWo.exe
  C:\Windows\System\EjDqrWo.exe
  2⤵
  PID:12628
- C:\Windows\System\wZsoLQZ.exe
  C:\Windows\System\wZsoLQZ.exe
  2⤵
  PID:12708
- C:\Windows\System\mIVThVQ.exe
  C:\Windows\System\mIVThVQ.exe
  2⤵
  PID:12768
- C:\Windows\System\ALwziHl.exe
  C:\Windows\System\ALwziHl.exe
  2⤵
  PID:12140
- C:\Windows\System\XCNxZNm.exe
  C:\Windows\System\XCNxZNm.exe
  2⤵
  PID:12928
- C:\Windows\System\cPCHciH.exe
  C:\Windows\System\cPCHciH.exe
  2⤵
  PID:12976
- C:\Windows\System\UKFfLfN.exe
  C:\Windows\System\UKFfLfN.exe
  2⤵
  PID:13040
- C:\Windows\System\ikLdaze.exe
  C:\Windows\System\ikLdaze.exe
  2⤵
  PID:13132
- C:\Windows\System\PfyAFfu.exe
  C:\Windows\System\PfyAFfu.exe
  2⤵
  PID:13144
- C:\Windows\System\FLWQJkK.exe
  C:\Windows\System\FLWQJkK.exe
  2⤵
  PID:13200
- C:\Windows\System\rtjlgFL.exe
  C:\Windows\System\rtjlgFL.exe
  2⤵
  PID:13268
- C:\Windows\System\dDjGZEt.exe
  C:\Windows\System\dDjGZEt.exe
  2⤵
  PID:12308
- C:\Windows\System\hZbyNRz.exe
  C:\Windows\System\hZbyNRz.exe
  2⤵
  PID:12648
- C:\Windows\System\jNXNrDl.exe
  C:\Windows\System\jNXNrDl.exe
  2⤵
  PID:12624
- C:\Windows\System\HRdqkpR.exe
  C:\Windows\System\HRdqkpR.exe
  2⤵
  PID:12792
- C:\Windows\System\kxxnftH.exe
  C:\Windows\System\kxxnftH.exe
  2⤵
  PID:12900
- C:\Windows\System\fPpxsMg.exe
  C:\Windows\System\fPpxsMg.exe
  2⤵
  PID:13048
- C:\Windows\System\mtaAdnr.exe
  C:\Windows\System\mtaAdnr.exe
  2⤵
  PID:2568
- C:\Windows\System\rWthJww.exe
  C:\Windows\System\rWthJww.exe
  2⤵
  PID:12576
- C:\Windows\System\LYonNpP.exe
  C:\Windows\System\LYonNpP.exe
  2⤵
  PID:1688
- C:\Windows\System\KJPsJNm.exe
  C:\Windows\System\KJPsJNm.exe
  2⤵
  PID:12924
- C:\Windows\System\hwdopPZ.exe
  C:\Windows\System\hwdopPZ.exe
  2⤵
  PID:2432
- C:\Windows\System\yDFWXfq.exe
  C:\Windows\System\yDFWXfq.exe
  2⤵
  PID:4452
- C:\Windows\System\ErrdxsG.exe
  C:\Windows\System\ErrdxsG.exe
  2⤵
  PID:12860
- C:\Windows\System\EnYrdqW.exe
  C:\Windows\System\EnYrdqW.exe
  2⤵
  PID:4884
- C:\Windows\System\WYqVuGM.exe
  C:\Windows\System\WYqVuGM.exe
  2⤵
  PID:12388
- C:\Windows\System\RNabEtE.exe
  C:\Windows\System\RNabEtE.exe
  2⤵
  PID:13344
- C:\Windows\System\DGvLFRr.exe
  C:\Windows\System\DGvLFRr.exe
  2⤵
  PID:13380
- C:\Windows\System\FCwVbCm.exe
  C:\Windows\System\FCwVbCm.exe
  2⤵
  PID:13404
- C:\Windows\System\wupBFmh.exe
  C:\Windows\System\wupBFmh.exe
  2⤵
  PID:13444
- C:\Windows\System\hUgJntd.exe
  C:\Windows\System\hUgJntd.exe
  2⤵
  PID:13464
- C:\Windows\System\qjiihRR.exe
  C:\Windows\System\qjiihRR.exe
  2⤵
  PID:13500
- C:\Windows\System\JXkwIEj.exe
  C:\Windows\System\JXkwIEj.exe
  2⤵
  PID:13520
- C:\Windows\System\iJemhaR.exe
  C:\Windows\System\iJemhaR.exe
  2⤵
  PID:13556
- C:\Windows\System\gGPodRs.exe
  C:\Windows\System\gGPodRs.exe
  2⤵
  PID:13596
- C:\Windows\System\BQGnPRL.exe
  C:\Windows\System\BQGnPRL.exe
  2⤵
  PID:13632
- C:\Windows\System\AYjwcGO.exe
  C:\Windows\System\AYjwcGO.exe
  2⤵
  PID:13680
- C:\Windows\System\JJBNSZb.exe
  C:\Windows\System\JJBNSZb.exe
  2⤵
  PID:13712
- C:\Windows\System\SrlGcMm.exe
  C:\Windows\System\SrlGcMm.exe
  2⤵
  PID:13740
- C:\Windows\System\IQzzaRa.exe
  C:\Windows\System\IQzzaRa.exe
  2⤵
  PID:13772
- C:\Windows\System\fKmHjyP.exe
  C:\Windows\System\fKmHjyP.exe
  2⤵
  PID:13800
- C:\Windows\System\DSnezqz.exe
  C:\Windows\System\DSnezqz.exe
  2⤵
  PID:13828
- C:\Windows\System\ISdiMDy.exe
  C:\Windows\System\ISdiMDy.exe
  2⤵
  PID:13856
- C:\Windows\System\KnIOfaM.exe
  C:\Windows\System\KnIOfaM.exe
  2⤵
  PID:13884
- C:\Windows\System\GzPXcmF.exe
  C:\Windows\System\GzPXcmF.exe
  2⤵
  PID:13916
- C:\Windows\System\rvxihWr.exe
  C:\Windows\System\rvxihWr.exe
  2⤵
  PID:13944
- C:\Windows\System\DdgTiLx.exe
  C:\Windows\System\DdgTiLx.exe
  2⤵
  PID:13972
- C:\Windows\System\ukYEhoN.exe
  C:\Windows\System\ukYEhoN.exe
  2⤵
  PID:14000
- C:\Windows\System\MgpSxZl.exe
  C:\Windows\System\MgpSxZl.exe
  2⤵
  PID:14028
- C:\Windows\System\gKdTCpw.exe
  C:\Windows\System\gKdTCpw.exe
  2⤵
  PID:14056
- C:\Windows\System\zqbricO.exe
  C:\Windows\System\zqbricO.exe
  2⤵
  PID:14084
- C:\Windows\System\wRUhzlB.exe
  C:\Windows\System\wRUhzlB.exe
  2⤵
  PID:14112
- C:\Windows\System\fnaDLTh.exe
  C:\Windows\System\fnaDLTh.exe
  2⤵
  PID:14140
- C:\Windows\System\TAkqHaG.exe
  C:\Windows\System\TAkqHaG.exe
  2⤵
  PID:14168
- C:\Windows\System\UiPXwJu.exe
  C:\Windows\System\UiPXwJu.exe
  2⤵
  PID:14196
- C:\Windows\System\sZwALWV.exe
  C:\Windows\System\sZwALWV.exe
  2⤵
  PID:14240
- C:\Windows\System\spTrbTc.exe
  C:\Windows\System\spTrbTc.exe
  2⤵
  PID:14264
- C:\Windows\System\PGoiqMq.exe
  C:\Windows\System\PGoiqMq.exe
  2⤵
  PID:14284
- C:\Windows\System\zVwxcpM.exe
  C:\Windows\System\zVwxcpM.exe
  2⤵
  PID:13100
- C:\Windows\System\YLKUGig.exe
  C:\Windows\System\YLKUGig.exe
  2⤵
  PID:13392
- C:\Windows\System\Ebeqbcd.exe
  C:\Windows\System\Ebeqbcd.exe
  2⤵
  PID:13488
- C:\Windows\System\uNVBZoa.exe
  C:\Windows\System\uNVBZoa.exe
  2⤵
  PID:13516
- C:\Windows\System\mgFvxiB.exe
  C:\Windows\System\mgFvxiB.exe
  2⤵
  PID:13588
- C:\Windows\System\HXanFMJ.exe
  C:\Windows\System\HXanFMJ.exe
  2⤵
  PID:4860
- C:\Windows\System\OpPwlkn.exe
  C:\Windows\System\OpPwlkn.exe
  2⤵
  PID:13724
- C:\Windows\System\enAGcaD.exe
  C:\Windows\System\enAGcaD.exe
  2⤵
  PID:13788
- C:\Windows\System\XJbxQHU.exe
  C:\Windows\System\XJbxQHU.exe
  2⤵
  PID:13852
- C:\Windows\System\xTtjDBl.exe
  C:\Windows\System\xTtjDBl.exe
  2⤵
  PID:13928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BSLrtwG.exe

Filesize
1.8MB

MD5
460338c4cdb3888838430fe7784edaf7

SHA1
9a144e497e8483686a454ff795a9f52323bca3a7

SHA256
e12347b6e57f9f06f669438e37eb50516ac9a750f613836460b20ae3424b7cb8

SHA512
3c7faaaa33834aa52b1fcd74b16a4e9571cc928eeac9bb9cf62eb814b1627d3ddedad04bf0bc34c84de7869e97e630a098c0b8da30ca81d40a8796e91451260b

Download Submit
C:\Windows\System\CDirQYz.exe

Filesize
1.8MB

MD5
ebfcdcf281a8fe32b26b9ef1c1f8142a

SHA1
76cb66d9fcbad5819d0964a751a85cbef7fe4d3a

SHA256
6ff4646f28c79189593112f2d7112f3a81990d1614bd39571bea693e3a9fc32b

SHA512
a7e6baab8756e53abd685cfae7d49c07b0cedb60492bd19f4df96a6091679deda763b9717d56d3c47e8e4d62cd122016be7f67602246102343d2f81d58a47cde

Download Submit
C:\Windows\System\CEgpjDH.exe

Filesize
1.8MB

MD5
8836ba4a12b97ec74501259b1a44e06a

SHA1
f37cfd2ae23a85e348faf2c464e6509cd42fb2fb

SHA256
3572475ce594ed0ea0d82e65dc5afec6111aed0fd37a562fc6f856bae37c918a

SHA512
893f63973b69a0eb9da3ea55bab447d08235eea91026ab53826936086490d9bd787f7202ebd48997c4cff19b0b08c8567247b3f31c710ff625668cd77e0b0e0c

Download Submit
C:\Windows\System\DtCjxVf.exe

Filesize
1.8MB

MD5
ecb66da902801930e2f765fb92d57daa

SHA1
b7782447ba955638e0c73001d20a7debfeb2982f

SHA256
313abc52c6ca90739232bfdbee6f59f4fec5cb6ba085f95bc46500421aad64b8

SHA512
584e9ba7198fd5e011bc5545c23a9264b442a9029751cf55407086e0c224a5ecabf0ed286503744fc5072a4e1e89762c775d3b3a640ac2eef91b191ff3777bd8

Download Submit
C:\Windows\System\EFLIPoI.exe

Filesize
1.8MB

MD5
c978c3bf5c5955857624e44feb37b309

SHA1
d37f1acb14dac3b206edeaec6aa723f01454a7d1

SHA256
f28ace3acc91c0277a7c877f5cd07dd31cde9a5d56c6dfcb954018e90fd0a4bb

SHA512
6db354a15272764916aa04ae374fcecb7b20de7174f58fd6352f4e507ef2ca01823202df52f19205c442827008046bcb40a8fa3b08ec6ea76e0052db18a9e254

Download Submit
C:\Windows\System\EwMylRu.exe

Filesize
1.8MB

MD5
ff562779e2de29d2b08f02a7fb3b0afe

SHA1
d55f46aa40de817ce24039dcf77e59acb9737742

SHA256
5182e5e8e294590385a1d0fc7b596ca92af6b78ab5f6d786702d430da74263a2

SHA512
f25a5495b9276f709ec469aa171d6734e73ea8e508549ab5a1c0c1cfacb7194bf78f67a7aab600860ffedd9c0e530186a9d5a4bd29c844dce560f2bd326ff62c

Download Submit
C:\Windows\System\FyHIysl.exe

Filesize
1.8MB

MD5
ad873eb220bf500b1e7808f3657c5a16

SHA1
488421e1dca43e9967880e9e2f74f76a7855c5d8

SHA256
558986e42619713f6a53d65975249ba9e14f1efe88f350969066c2111c824c6c

SHA512
32d4693fec62569c7a2d18dbdeda8c7b118968ae386c84b42889081a85a44de08db639acbc31ef13ee261faaaad3d168da36646919a1e2922f23a1cb7f70667b

Download Submit
C:\Windows\System\GSrqUfz.exe

Filesize
1.8MB

MD5
cdd8325846566d52a8cffbd4b56cc27e

SHA1
f957dfd2182316bedd90cdfb916207a6750d106f

SHA256
2bc4293c85df1b119cf101a586180164aa981eccbc3cdfe6a28a0c01f9fdc8cf

SHA512
6f688d2791c220305c775bbfc109ee4ad2e2d7e7c0f8f87ffa4cb6a198806c34657910f347290a8c81db600c4301d1c7297541d025c753d2262b45b144aa807b

Download Submit
C:\Windows\System\NbFNYwa.exe

Filesize
1.8MB

MD5
976c3024a65755d803bd9cd6d82f0df2

SHA1
b7a783ded2e84c14054470277d9bd91043fd72ab

SHA256
03436c2268f8a8fb118d5423498684bd65641c6c91be054620a76b9991633bd0

SHA512
e6689897c347e2572e139476cb488edb4cb8937e33e85e3961b19d7f2870f904e5a1ae870782cec67163b41f522b959824897437b5472afb907447ba917bcd87

Download Submit
C:\Windows\System\TPsTufV.exe

Filesize
1.8MB

MD5
067fe351725b351931509cb6a53bef50

SHA1
1146078271d26d68c21fdf92af0411d56ec5b616

SHA256
84be4a0c3a4f607dfb8d3d6638fd4f4c770799e9c82b3ce2f94eb6a1ef08f496

SHA512
9b553dd6b7004eca13096100c93a0947690b3aca56b44ff62b4983e9f94bea943f8c22a3cde2a4a2bf61210e4f088652deaec06e226c17a782fbfd76af6d90fb

Download Submit
C:\Windows\System\TaOGUif.exe

Filesize
1.8MB

MD5
62212c0dab5153e5978fc3c576206ed2

SHA1
d3ef1d97210307f098294644d98cd9dc73e3cdf4

SHA256
d94ee8b1e3d49dd8b455486818df0d4044452a101bbab29ae7adc0004beba028

SHA512
db9a2e319203957029610958bc0f2bef9c7530099c363b3358eea2475ae918a218e81fabe7ed07a496e40a7470d9422605cd0e70286afcb8786b3e4513334ce7

Download Submit
C:\Windows\System\WZMfuKy.exe

Filesize
1.8MB

MD5
58ad675a1519f94d9552532705141ca0

SHA1
5d4acafd6a1c3042437a16f88dc82d0c99f2d747

SHA256
5901c4b19a59fba2aab2832dcef049f25d4ca207a76afa8538ff9558f384b489

SHA512
f3e76f3dd25b3e18bff723ae28ef2abc51a78cf975136e27e3fa833b194ab4dde509e0cc203873668c23d629573f4fb2c0f5242e793d8e8d5c83a5e4630de7ab

Download Submit
C:\Windows\System\XpcEFcC.exe

Filesize
1.8MB

MD5
6f58520a56d9c9d58394f6856eed8023

SHA1
5e89ed758a61e21443d349f6a8888498795e8e2d

SHA256
a4ceef41327b7c684d80e0ef3a548f0b7cbc7dee2ecb415489a295b9642474f7

SHA512
eeeee618dd9128294d441453e63935f9257a9df6e814dd845456f27c5e959d54a73c4b1d994746491a4cee62a961d91298a45a6f04becaf4a517bb5a68868a8c

Download Submit
C:\Windows\System\aHqpTOV.exe

Filesize
1.8MB

MD5
236d774f0dc0946e3c8e1de85d152c25

SHA1
2c5223897d569745887945d37e2ca91edaa9ebcd

SHA256
d4fe8f85e8a372c03b102df85ae505fd8a13bda1aadc6a1765efb77d58e049a1

SHA512
2ba58746b2ada9ed2b47494695b0fe01b431f8dc47a418c1568b2e9456e159fdd6d904baf45cd1da552e8552246679b2d718443fc7c8ac541b3726c3e1e63f0f

Download Submit
C:\Windows\System\bxURbzk.exe

Filesize
1.8MB

MD5
a7a7fed7644f49c187ae8896775827a6

SHA1
e4536c0472cd7e1ce80e39f40194453ea543a70e

SHA256
c15e29bbe611ec954188c7d48e7c032231291fc1f6fb05b5d5ab037e83239b6b

SHA512
fdb61e1796a576cba10cf3003128c16ec6f2ec8792e10bd10b5903cfc43590ef119cfa9eb4f62191f7e9f508db758fd2ce0d413fe899b6ce4a6ffc591aefb5e2

Download Submit
C:\Windows\System\cOcpqRx.exe

Filesize
1.8MB

MD5
b2140fe2585ba20e47fb957df94f48d5

SHA1
e35946e91d88e6e721f60c0c6bd33b7a4eeb14e3

SHA256
babc772c30aee26a52c51a2e31c7ef21c115892fb01b262da47ad64ee2eda882

SHA512
39fa4d3feecf7db6a4d647556ca3206e44a58f8769a3e9cc1ead19e3e8cf04482dd9a9a47f956b8bb24ffe486e59caa79328a31655f38f1c1ac29a28b1978a09

Download Submit
C:\Windows\System\cToQmQc.exe

Filesize
1.8MB

MD5
d6e2bf35ab9afad777b02eeb1d78c260

SHA1
ae610cbe42920ed0db124bca4cab52594941b2a5

SHA256
7c179ee36abe7b0849718537556bf6fce1a4c62ff487d6a5491eeaf9ad104fc3

SHA512
6e2770746eaa5f6fcbfc07223ceb2c512998e5773e8307bd23f45e8f545f0fb5b15183a852ce9ca5a262c0678d51630c9410e8d20798d279b5fd1275d95da42a

Download Submit
C:\Windows\System\duCdHRI.exe

Filesize
1.8MB

MD5
e82315c50fcae065ea5eb2c035ea1813

SHA1
b540b228add9d704865b256dcec64004a8daf0c1

SHA256
58d65abedf86e173f0190379247d8d555959d0ee7ee04462f7894d0db9bd2414

SHA512
92b50e37b903dabc3fa9b6100812804876b9b2202fce0a9d5e31e57513393207efc2d8af3808d76ed4df674e0e1d9536e26865a19d5be87d9a8a80059597ae63

Download Submit
C:\Windows\System\elueJYX.exe

Filesize
1.8MB

MD5
b16b21bf4f0e86811155551f03150d09

SHA1
31b4e73c8a21801c1e70714bfccc4576f419f4b3

SHA256
2bc07d3c3342e207ecaae870105708f1425823f1ec75f13c14351a93f697931c

SHA512
2af3259d71c63f9c2f0fce498d525a0d8193779317beb74856275b50280b9afcbf24fc37a85517f0d049d9ada53087e8f5c820451e03430018c1e59cc2ec4a35

Download Submit
C:\Windows\System\fhEYUXf.exe

Filesize
1.8MB

MD5
b32a1e99123614f12a45da614bc731ea

SHA1
98864aec0f64f49b135726521fac17d87c957933

SHA256
664f8f74b42274e151a4b82e77cd04c739062d5dc3eeba0eedd4ef3cb790a24f

SHA512
a673b75cb952b21076c09257a08bcc3061fdf2e582bad22f70f4148e49c948ae2bbdd09ccdc49992c13992bb05282d9e6546cb754e15dc01b4c4fd32497ac501

Download Submit
C:\Windows\System\gBuXhRm.exe

Filesize
1.8MB

MD5
c7f916e92577bcf9e98669c779d6f45e

SHA1
0cb3b5798f4252e87a1aaecfdb9b7cba2e947741

SHA256
48479613a8abaf7d775524ebba8c23b9e841ef364c813cd5e6c38ca90e49090a

SHA512
f7e1f9037ccdc0913de5a3c3be310cdf22250e8a4a1584d5d21e8d8787301cc37380e5fd52caf28b87867da98204ded776c19ec51b995164256a15af93c32232

Download Submit
C:\Windows\System\gUcAlTF.exe

Filesize
1.8MB

MD5
f6bd5385fbf644ccd034270fe2a7220d

SHA1
2e704406353d0d729fe7816e417836c1f3a08b15

SHA256
b2dca2a30e63b3c09a16284dac589d084e409bfc303e2548c5163f3c01943152

SHA512
0e47b594e3d15486254e16a0ee6d2710c994d21d1a0297a4892d95c66f4fe7a43e17281feb54e36ca2a4056a06d6da0f1c9e40934cb98f7521f8d18f7de98a87

Download Submit
C:\Windows\System\icgLnQm.exe

Filesize
1.8MB

MD5
417aff90ae218098473430764bee0612

SHA1
def24a41b9f17ba2b0f51c44bfe09059120751b8

SHA256
84867e3f70f5569ae32bb81736e72de3d08bd2ea300abd661eb706ca2242c3b0

SHA512
5387c46221a56ade1885a504200a97caa8d2cbc9cabe19d2f75a7abd7d3f1a374558cdcda46063b05c029bd0318574867393027c2a3c1a7720accd8e8f34e1b6

Download Submit
C:\Windows\System\nGFuOWe.exe

Filesize
1.8MB

MD5
41ee8172fff9d2b2f408645b9059eff4

SHA1
a91fa21cddd78725b5f12681ec4c97cb1c815ef2

SHA256
fb7707943fe57c05d56407ee934884685a3adcafa7701e92147e5f4e1b83b249

SHA512
c7395003799acd1b4da7b58b7487a44b4d71bbeffe6dac4fde91f747e7c5fc8020b9b33dfec1a640a9fe9a08ed6692f9af1963b31625683e81d2d6f95b816b9a

Download Submit
C:\Windows\System\pjypxMB.exe

Filesize
1.8MB

MD5
12e7b2301dc6b37c28a98bb71530324a

SHA1
4fa9560bc1f4d47a0dcabb4d06ba47791ced0577

SHA256
cf63c30ba0b999854960131afe434ec622767fb8e1a453f177f0ea5d3625eff6

SHA512
67f03913425c8351dbb6fff826bb966993ba9e1e93819ca192c8a82de4895c2912b3e943ca3385636bf450cbd1839434f18e966e549e4499214f11d46d606c35

Download Submit
C:\Windows\System\pqxsMCq.exe

Filesize
1.8MB

MD5
2600599e8444badccbfe45e4c172ec4c

SHA1
d19d419a03def3dab9318fff972c1a1ce0a2e39a

SHA256
70c114874e7d9206b5b318946a59c04d4f7cbfdc8f8c0934d5ec166a7591b691

SHA512
d6d8fdef337c585ad581e9954dd6e3d762cac883bccb0827f2deaf6d878f11c697967cc0fd60c4c77385176b59e4062917bc6b6eda15ee63235b67305b4a0f5d

Download Submit
C:\Windows\System\qqKWdHZ.exe

Filesize
1.8MB

MD5
6d2a631b5b54895c6cf79e67d96ab56b

SHA1
fda14eff187daa6505c8cc63ead7d429f02b5830

SHA256
c4e89d9ac5699755924c259c0ddbefe45986b38987bee29bb84f92c2dda5346e

SHA512
1f5c5cef098bb0df94ea1ee875e71419d2aee7ee35373138369ffa02e288bf3394adc6af0cc64828de8d5a217d172a9d4433eac86397a51fb1a017465b35688a

Download Submit
C:\Windows\System\scRGIHy.exe

Filesize
1.8MB

MD5
a29d83085bfcdbbce58edf76fba6b0df

SHA1
0c73557864aa136ffd0d08ff9c1ef9ef38a43198

SHA256
3b80c353d24552c65c4419d559bbd4780cb07273a15e3552ada71e071b746404

SHA512
74bda662cbfe2de399a218699622d6acb8df1d4bde70110dd6f21a91cfe37964431e42dfed2950fe8adcc4e5fb0b761847ef6c569f9426b217bc12b8533d9427

Download Submit
C:\Windows\System\tZYhrRu.exe

Filesize
1.8MB

MD5
6b73e6349d48fa99b7959f68b3b4c579

SHA1
ebef0b44b6d9bddb728cae1dd49d426ac24575d5

SHA256
7167db35df03faeca0a4040b0d8f1193a6b81c26c394287db5e082b9c962249b

SHA512
e157f7dc7ed6dc8c6183596745b4051807f2f7546f91ee3667b336597c1afb4253a32e2670cb067e1aa6a5b5cec80202d1fc16c3b8dd90adae1fb47e66e7665d

Download Submit
C:\Windows\System\uRtKBsT.exe

Filesize
1.8MB

MD5
b0a9c483d83fd2a1cd8fc756b8ed2586

SHA1
abd7aeadb2c5c1b96eb3d656dffbf306211c93ad

SHA256
fb0b940e712489e531259bd753774298ae4aa7dd089f5daa62fd952aa6a7ec04

SHA512
a34a43159f00fcd8288a83550dabb626e3d89d3b4f59d06bcaaa943694ebb6603cad4d19e604a78a7ba9ab193f86dfdc0c5c7f1c90553c79de6dfc08634b7512

Download Submit
C:\Windows\System\vHElSiY.exe

Filesize
1.8MB

MD5
2332f12cf8c6ab8dddd50fc8db93119f

SHA1
562b02a330e27dbfc94c05c77c17bc4983e3b32e

SHA256
6d1fe83bafb3d316a05c749d11984e5f3db9527a3d6dad10739624b94379ea91

SHA512
f810537c64375108fb69f596d0bf86e79ae98fb7cdcf2a823753e964550dae08d7e685b6393cd344c0c24feaec3da9aac348bf813dc1da0e5b21d992925204ba

Download Submit
C:\Windows\System\wxhRxHR.exe

Filesize
1.8MB

MD5
e617e5a410ebd3980dcefc02c8003bbb

SHA1
e2cf31f4e80fc23e1371ed8709a21a113a97c973

SHA256
ddb5bbfbb6ca61aacff6ba445f1783c0204170553184a96547992e878690d4a3

SHA512
5daccde2fb3962027c928df42d31f53be353a6f2c0a2f4bd7c83019a47bf70dfa2e7e2cd13481a0da837e7d7e933bc5c160bfd4e942755d2af7ead0d1932a4ff

Download Submit
C:\Windows\System\yHvEVmO.exe

Filesize
1.8MB

MD5
f25b1454a68be77a7cac49ac10333502

SHA1
042d08df6316f2164f09d1e6c97beb1e00f0c2b5

SHA256
ad924d8bb08e528538d54291521a10fa4ecaf7576885ca03384e79811687aebc

SHA512
0ad3c69d46af3b60f5811c4f01212c9bae70a86823ef0ea530a34d1389f18bc5dce9507a05cd62c4427355c00d9a99f3a9db27defe9e0a7e3d98fdb2b909b29b

Download Submit
memory/752-16-0x00007FF6E70F0000-0x00007FF6E7444000-memory.dmp

Filesize
3.3MB

Download
memory/752-2159-0x00007FF6E70F0000-0x00007FF6E7444000-memory.dmp

Filesize
3.3MB

Download
memory/756-2165-0x00007FF732200000-0x00007FF732554000-memory.dmp

Filesize
3.3MB

Download
memory/756-38-0x00007FF732200000-0x00007FF732554000-memory.dmp

Filesize
3.3MB

Download
memory/756-2157-0x00007FF732200000-0x00007FF732554000-memory.dmp

Filesize
3.3MB

Download
memory/1244-568-0x00007FF700550000-0x00007FF7008A4000-memory.dmp

Filesize
3.3MB

Download
memory/1244-2169-0x00007FF700550000-0x00007FF7008A4000-memory.dmp

Filesize
3.3MB

Download
memory/1284-586-0x00007FF62A190000-0x00007FF62A4E4000-memory.dmp

Filesize
3.3MB

Download
memory/1284-2176-0x00007FF62A190000-0x00007FF62A4E4000-memory.dmp

Filesize
3.3MB

Download
memory/1332-2173-0x00007FF720B10000-0x00007FF720E64000-memory.dmp

Filesize
3.3MB

Download
memory/1332-572-0x00007FF720B10000-0x00007FF720E64000-memory.dmp

Filesize
3.3MB

Download
memory/1524-2171-0x00007FF6A3F90000-0x00007FF6A42E4000-memory.dmp

Filesize
3.3MB

Download
memory/1524-569-0x00007FF6A3F90000-0x00007FF6A42E4000-memory.dmp

Filesize
3.3MB

Download
memory/1536-43-0x00007FF6310C0000-0x00007FF631414000-memory.dmp

Filesize
3.3MB

Download
memory/1536-2163-0x00007FF6310C0000-0x00007FF631414000-memory.dmp

Filesize
3.3MB

Download
memory/1708-2185-0x00007FF7AA020000-0x00007FF7AA374000-memory.dmp

Filesize
3.3MB

Download
memory/1708-609-0x00007FF7AA020000-0x00007FF7AA374000-memory.dmp

Filesize
3.3MB

Download
memory/1756-2187-0x00007FF677760000-0x00007FF677AB4000-memory.dmp

Filesize
3.3MB

Download
memory/1756-597-0x00007FF677760000-0x00007FF677AB4000-memory.dmp

Filesize
3.3MB

Download
memory/2020-577-0x00007FF688760000-0x00007FF688AB4000-memory.dmp

Filesize
3.3MB

Download
memory/2020-2179-0x00007FF688760000-0x00007FF688AB4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-573-0x00007FF6EAB90000-0x00007FF6EAEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-2174-0x00007FF6EAB90000-0x00007FF6EAEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2244-617-0x00007FF69E3F0000-0x00007FF69E744000-memory.dmp

Filesize
3.3MB

Download
memory/2244-2167-0x00007FF69E3F0000-0x00007FF69E744000-memory.dmp

Filesize
3.3MB

Download
memory/2264-567-0x00007FF7571B0000-0x00007FF757504000-memory.dmp

Filesize
3.3MB

Download
memory/2264-2168-0x00007FF7571B0000-0x00007FF757504000-memory.dmp

Filesize
3.3MB

Download
memory/2636-606-0x00007FF7AD560000-0x00007FF7AD8B4000-memory.dmp

Filesize
3.3MB

Download
memory/2636-2183-0x00007FF7AD560000-0x00007FF7AD8B4000-memory.dmp

Filesize
3.3MB

Download
memory/2796-23-0x00007FF642E80000-0x00007FF6431D4000-memory.dmp

Filesize
3.3MB

Download
memory/2796-2160-0x00007FF642E80000-0x00007FF6431D4000-memory.dmp

Filesize
3.3MB

Download
memory/2916-2170-0x00007FF6F23D0000-0x00007FF6F2724000-memory.dmp

Filesize
3.3MB

Download
memory/2916-570-0x00007FF6F23D0000-0x00007FF6F2724000-memory.dmp

Filesize
3.3MB

Download
memory/2940-22-0x00007FF6D84A0000-0x00007FF6D87F4000-memory.dmp

Filesize
3.3MB

Download
memory/2940-2155-0x00007FF6D84A0000-0x00007FF6D87F4000-memory.dmp

Filesize
3.3MB

Download
memory/2940-2161-0x00007FF6D84A0000-0x00007FF6D87F4000-memory.dmp

Filesize
3.3MB

Download
memory/2984-2181-0x00007FF610200000-0x00007FF610554000-memory.dmp

Filesize
3.3MB

Download
memory/2984-575-0x00007FF610200000-0x00007FF610554000-memory.dmp

Filesize
3.3MB

Download
memory/3180-576-0x00007FF695C40000-0x00007FF695F94000-memory.dmp

Filesize
3.3MB

Download
memory/3180-2180-0x00007FF695C40000-0x00007FF695F94000-memory.dmp

Filesize
3.3MB

Download
memory/3440-2158-0x00007FF796E80000-0x00007FF7971D4000-memory.dmp

Filesize
3.3MB

Download
memory/3440-2164-0x00007FF796E80000-0x00007FF7971D4000-memory.dmp

Filesize
3.3MB

Download
memory/3440-47-0x00007FF796E80000-0x00007FF7971D4000-memory.dmp

Filesize
3.3MB

Download
memory/3572-2166-0x00007FF78E9C0000-0x00007FF78ED14000-memory.dmp

Filesize
3.3MB

Download
memory/3572-610-0x00007FF78E9C0000-0x00007FF78ED14000-memory.dmp

Filesize
3.3MB

Download
memory/3876-595-0x00007FF6BE0C0000-0x00007FF6BE414000-memory.dmp

Filesize
3.3MB

Download
memory/3876-2184-0x00007FF6BE0C0000-0x00007FF6BE414000-memory.dmp

Filesize
3.3MB

Download
memory/4160-2182-0x00007FF66C560000-0x00007FF66C8B4000-memory.dmp

Filesize
3.3MB

Download
memory/4160-592-0x00007FF66C560000-0x00007FF66C8B4000-memory.dmp

Filesize
3.3MB

Download
memory/4340-600-0x00007FF7686C0000-0x00007FF768A14000-memory.dmp

Filesize
3.3MB

Download
memory/4340-2186-0x00007FF7686C0000-0x00007FF768A14000-memory.dmp

Filesize
3.3MB

Download
memory/4392-574-0x00007FF7AD2B0000-0x00007FF7AD604000-memory.dmp

Filesize
3.3MB

Download
memory/4392-2175-0x00007FF7AD2B0000-0x00007FF7AD604000-memory.dmp

Filesize
3.3MB

Download
memory/4440-571-0x00007FF6E0570000-0x00007FF6E08C4000-memory.dmp

Filesize
3.3MB

Download
memory/4440-2172-0x00007FF6E0570000-0x00007FF6E08C4000-memory.dmp

Filesize
3.3MB

Download
memory/4572-578-0x00007FF61DC70000-0x00007FF61DFC4000-memory.dmp

Filesize
3.3MB

Download
memory/4572-2178-0x00007FF61DC70000-0x00007FF61DFC4000-memory.dmp

Filesize
3.3MB

Download
memory/4784-1-0x00000228A39F0000-0x00000228A3A00000-memory.dmp

Filesize
64KB

Download
memory/4784-0-0x00007FF74DF30000-0x00007FF74E284000-memory.dmp

Filesize
3.3MB

Download
memory/4912-2156-0x00007FF633640000-0x00007FF633994000-memory.dmp

Filesize
3.3MB

Download
memory/4912-2162-0x00007FF633640000-0x00007FF633994000-memory.dmp

Filesize
3.3MB

Download
memory/4912-24-0x00007FF633640000-0x00007FF633994000-memory.dmp

Filesize
3.3MB

Download
memory/5084-2177-0x00007FF7E7FC0000-0x00007FF7E8314000-memory.dmp

Filesize
3.3MB

Download
memory/5084-583-0x00007FF7E7FC0000-0x00007FF7E8314000-memory.dmp

Filesize
3.3MB

Download