xmrig | 22dd9e765b4c4387130794d0c4e52d9b1d865b621fb5af6efd5a7031796e04f9

Analysis

max time kernel
147s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
Size

2.1MB
MD5

536237cf0f5f44b490565d79c76e7710
SHA1

ec8ceb3b0795851bcdd686574eb17a1aa62b56b7
SHA256

22dd9e765b4c4387130794d0c4e52d9b1d865b621fb5af6efd5a7031796e04f9
SHA512

0aad04dc8339da9c04ffd334e630b80c07f3ef9793468e8181a6615bf47ad793481910a998b417f58035d127b71cbddb637cba0b86a915ace61fed72c13aed89
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+A8JhP70M+:oemTLkNdfE0pZrE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2996-0-0x00007FF732060000-0x00007FF7323B4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023402-5.dat	xmrig
behavioral2/memory/1948-8-0x00007FF6996A0000-0x00007FF6999F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023406-15.dat	xmrig
behavioral2/files/0x0007000000023407-17.dat	xmrig
behavioral2/files/0x0007000000023409-29.dat	xmrig
behavioral2/files/0x000700000002340a-34.dat	xmrig
behavioral2/files/0x000700000002340c-46.dat	xmrig
behavioral2/files/0x000700000002340d-52.dat	xmrig
behavioral2/files/0x000700000002340e-57.dat	xmrig
behavioral2/files/0x0007000000023410-67.dat	xmrig
behavioral2/files/0x0007000000023413-78.dat	xmrig
behavioral2/files/0x0007000000023417-102.dat	xmrig
behavioral2/files/0x000700000002341a-117.dat	xmrig
behavioral2/files/0x000700000002341e-136.dat	xmrig
behavioral2/files/0x0007000000023421-152.dat	xmrig
behavioral2/memory/4336-732-0x00007FF73B210000-0x00007FF73B564000-memory.dmp	xmrig
behavioral2/memory/4868-733-0x00007FF65BB20000-0x00007FF65BE74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-166.dat	xmrig
behavioral2/memory/4952-734-0x00007FF652E90000-0x00007FF6531E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-162.dat	xmrig
behavioral2/files/0x0007000000023422-156.dat	xmrig
behavioral2/files/0x0007000000023420-147.dat	xmrig
behavioral2/files/0x000700000002341f-142.dat	xmrig
behavioral2/files/0x000700000002341d-132.dat	xmrig
behavioral2/files/0x000700000002341c-126.dat	xmrig
behavioral2/files/0x000700000002341b-122.dat	xmrig
behavioral2/files/0x0007000000023419-112.dat	xmrig
behavioral2/files/0x0007000000023418-106.dat	xmrig
behavioral2/files/0x0007000000023416-97.dat	xmrig
behavioral2/files/0x0007000000023415-91.dat	xmrig
behavioral2/files/0x0007000000023414-87.dat	xmrig
behavioral2/files/0x0007000000023412-74.dat	xmrig
behavioral2/files/0x0007000000023411-71.dat	xmrig
behavioral2/files/0x000700000002340f-61.dat	xmrig
behavioral2/files/0x000700000002340b-42.dat	xmrig
behavioral2/memory/2560-31-0x00007FF6627C0000-0x00007FF662B14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-25.dat	xmrig
behavioral2/memory/4208-21-0x00007FF6D74B0000-0x00007FF6D7804000-memory.dmp	xmrig
behavioral2/memory/4088-735-0x00007FF657F90000-0x00007FF6582E4000-memory.dmp	xmrig
behavioral2/memory/4448-736-0x00007FF6B5BC0000-0x00007FF6B5F14000-memory.dmp	xmrig
behavioral2/memory/4368-737-0x00007FF68E120000-0x00007FF68E474000-memory.dmp	xmrig
behavioral2/memory/5376-738-0x00007FF758000000-0x00007FF758354000-memory.dmp	xmrig
behavioral2/memory/4536-750-0x00007FF77CBA0000-0x00007FF77CEF4000-memory.dmp	xmrig
behavioral2/memory/4436-757-0x00007FF79DBF0000-0x00007FF79DF44000-memory.dmp	xmrig
behavioral2/memory/1376-747-0x00007FF66A720000-0x00007FF66AA74000-memory.dmp	xmrig
behavioral2/memory/5020-768-0x00007FF6A22C0000-0x00007FF6A2614000-memory.dmp	xmrig
behavioral2/memory/5032-778-0x00007FF643020000-0x00007FF643374000-memory.dmp	xmrig
behavioral2/memory/3620-784-0x00007FF68B200000-0x00007FF68B554000-memory.dmp	xmrig
behavioral2/memory/5100-794-0x00007FF634960000-0x00007FF634CB4000-memory.dmp	xmrig
behavioral2/memory/5372-791-0x00007FF701CD0000-0x00007FF702024000-memory.dmp	xmrig
behavioral2/memory/1852-787-0x00007FF67BE70000-0x00007FF67C1C4000-memory.dmp	xmrig
behavioral2/memory/936-832-0x00007FF6DE520000-0x00007FF6DE874000-memory.dmp	xmrig
behavioral2/memory/5432-842-0x00007FF651610000-0x00007FF651964000-memory.dmp	xmrig
behavioral2/memory/5436-827-0x00007FF7CF000000-0x00007FF7CF354000-memory.dmp	xmrig
behavioral2/memory/5672-811-0x00007FF7AB0E0000-0x00007FF7AB434000-memory.dmp	xmrig
behavioral2/memory/5416-815-0x00007FF6FF470000-0x00007FF6FF7C4000-memory.dmp	xmrig
behavioral2/memory/4552-804-0x00007FF625D00000-0x00007FF626054000-memory.dmp	xmrig
behavioral2/memory/3196-786-0x00007FF79CDF0000-0x00007FF79D144000-memory.dmp	xmrig
behavioral2/memory/4504-776-0x00007FF6CBB60000-0x00007FF6CBEB4000-memory.dmp	xmrig
behavioral2/memory/1980-775-0x00007FF75CCD0000-0x00007FF75D024000-memory.dmp	xmrig
behavioral2/memory/1160-771-0x00007FF7E9900000-0x00007FF7E9C54000-memory.dmp	xmrig
behavioral2/memory/2996-2129-0x00007FF732060000-0x00007FF7323B4000-memory.dmp	xmrig
behavioral2/memory/1948-2131-0x00007FF6996A0000-0x00007FF6999F4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1948	tAxPrMO.exe
4208	VkfjpkA.exe
2560	SVLxZit.exe
936	TWkKaKJ.exe
4336	YKySsZD.exe
4868	WOEyPfe.exe
5432	rnDkiJO.exe
4952	WxUuFXa.exe
4088	pAmcGVn.exe
4448	uTEHjig.exe
4368	TSdToTe.exe
5376	plPmgEW.exe
1376	tOcCIca.exe
4536	cpVvHmA.exe
4436	zuucxEv.exe
5020	KfgfNuq.exe
1160	uUOJCVe.exe
1980	QIHwSpS.exe
4504	EfYRKbe.exe
5032	zjQmEHW.exe
3620	hBcNPYL.exe
3196	zUOigil.exe
1852	OcTpTNA.exe
5372	WOMfSpQ.exe
5100	cnMbEiY.exe
4552	DvVXlJk.exe
5672	OAOWSRp.exe
5416	QemyjZH.exe
5436	MDwPduk.exe
3368	YlkzEuH.exe
4216	tbVtKeY.exe
392	nLdIUgS.exe
1096	mPVwjHa.exe
3040	gJHEwAz.exe
2148	QUrqanw.exe
2592	lWJhPgR.exe
4352	WeIHXQf.exe
4912	KEGazFy.exe
948	DCPqLGe.exe
3628	RyAuYlt.exe
2300	aKpOjVR.exe
3700	uOKtvWa.exe
1488	WZlUtMG.exe
4824	HJrLDOf.exe
5268	ueHETRW.exe
3644	XjrvXYx.exe
2792	JBuBVqr.exe
1532	wwrxPqA.exe
1768	aIDmoKd.exe
3128	QYCcHWJ.exe
4856	ZRTGsuS.exe
5284	UNjaomh.exe
4324	QNJbqmW.exe
388	CGLyGMn.exe
3080	lLQdDMW.exe
5136	iFLzeMH.exe
5460	uSXFFVT.exe
2912	HSZhtuw.exe
5676	KmXgmEg.exe
5608	OAhqODN.exe
3376	XyhdsUY.exe
2136	ieYQCmn.exe
4356	NAjuAnW.exe
2672	apqHtro.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2996-0-0x00007FF732060000-0x00007FF7323B4000-memory.dmp	upx
behavioral2/files/0x0008000000023402-5.dat	upx
behavioral2/memory/1948-8-0x00007FF6996A0000-0x00007FF6999F4000-memory.dmp	upx
behavioral2/files/0x0007000000023406-15.dat	upx
behavioral2/files/0x0007000000023407-17.dat	upx
behavioral2/files/0x0007000000023409-29.dat	upx
behavioral2/files/0x000700000002340a-34.dat	upx
behavioral2/files/0x000700000002340c-46.dat	upx
behavioral2/files/0x000700000002340d-52.dat	upx
behavioral2/files/0x000700000002340e-57.dat	upx
behavioral2/files/0x0007000000023410-67.dat	upx
behavioral2/files/0x0007000000023413-78.dat	upx
behavioral2/files/0x0007000000023417-102.dat	upx
behavioral2/files/0x000700000002341a-117.dat	upx
behavioral2/files/0x000700000002341e-136.dat	upx
behavioral2/files/0x0007000000023421-152.dat	upx
behavioral2/memory/4336-732-0x00007FF73B210000-0x00007FF73B564000-memory.dmp	upx
behavioral2/memory/4868-733-0x00007FF65BB20000-0x00007FF65BE74000-memory.dmp	upx
behavioral2/files/0x0007000000023424-166.dat	upx
behavioral2/memory/4952-734-0x00007FF652E90000-0x00007FF6531E4000-memory.dmp	upx
behavioral2/files/0x0007000000023423-162.dat	upx
behavioral2/files/0x0007000000023422-156.dat	upx
behavioral2/files/0x0007000000023420-147.dat	upx
behavioral2/files/0x000700000002341f-142.dat	upx
behavioral2/files/0x000700000002341d-132.dat	upx
behavioral2/files/0x000700000002341c-126.dat	upx
behavioral2/files/0x000700000002341b-122.dat	upx
behavioral2/files/0x0007000000023419-112.dat	upx
behavioral2/files/0x0007000000023418-106.dat	upx
behavioral2/files/0x0007000000023416-97.dat	upx
behavioral2/files/0x0007000000023415-91.dat	upx
behavioral2/files/0x0007000000023414-87.dat	upx
behavioral2/files/0x0007000000023412-74.dat	upx
behavioral2/files/0x0007000000023411-71.dat	upx
behavioral2/files/0x000700000002340f-61.dat	upx
behavioral2/files/0x000700000002340b-42.dat	upx
behavioral2/memory/2560-31-0x00007FF6627C0000-0x00007FF662B14000-memory.dmp	upx
behavioral2/files/0x0007000000023408-25.dat	upx
behavioral2/memory/4208-21-0x00007FF6D74B0000-0x00007FF6D7804000-memory.dmp	upx
behavioral2/memory/4088-735-0x00007FF657F90000-0x00007FF6582E4000-memory.dmp	upx
behavioral2/memory/4448-736-0x00007FF6B5BC0000-0x00007FF6B5F14000-memory.dmp	upx
behavioral2/memory/4368-737-0x00007FF68E120000-0x00007FF68E474000-memory.dmp	upx
behavioral2/memory/5376-738-0x00007FF758000000-0x00007FF758354000-memory.dmp	upx
behavioral2/memory/4536-750-0x00007FF77CBA0000-0x00007FF77CEF4000-memory.dmp	upx
behavioral2/memory/4436-757-0x00007FF79DBF0000-0x00007FF79DF44000-memory.dmp	upx
behavioral2/memory/1376-747-0x00007FF66A720000-0x00007FF66AA74000-memory.dmp	upx
behavioral2/memory/5020-768-0x00007FF6A22C0000-0x00007FF6A2614000-memory.dmp	upx
behavioral2/memory/5032-778-0x00007FF643020000-0x00007FF643374000-memory.dmp	upx
behavioral2/memory/3620-784-0x00007FF68B200000-0x00007FF68B554000-memory.dmp	upx
behavioral2/memory/5100-794-0x00007FF634960000-0x00007FF634CB4000-memory.dmp	upx
behavioral2/memory/5372-791-0x00007FF701CD0000-0x00007FF702024000-memory.dmp	upx
behavioral2/memory/1852-787-0x00007FF67BE70000-0x00007FF67C1C4000-memory.dmp	upx
behavioral2/memory/936-832-0x00007FF6DE520000-0x00007FF6DE874000-memory.dmp	upx
behavioral2/memory/5432-842-0x00007FF651610000-0x00007FF651964000-memory.dmp	upx
behavioral2/memory/5436-827-0x00007FF7CF000000-0x00007FF7CF354000-memory.dmp	upx
behavioral2/memory/5672-811-0x00007FF7AB0E0000-0x00007FF7AB434000-memory.dmp	upx
behavioral2/memory/5416-815-0x00007FF6FF470000-0x00007FF6FF7C4000-memory.dmp	upx
behavioral2/memory/4552-804-0x00007FF625D00000-0x00007FF626054000-memory.dmp	upx
behavioral2/memory/3196-786-0x00007FF79CDF0000-0x00007FF79D144000-memory.dmp	upx
behavioral2/memory/4504-776-0x00007FF6CBB60000-0x00007FF6CBEB4000-memory.dmp	upx
behavioral2/memory/1980-775-0x00007FF75CCD0000-0x00007FF75D024000-memory.dmp	upx
behavioral2/memory/1160-771-0x00007FF7E9900000-0x00007FF7E9C54000-memory.dmp	upx
behavioral2/memory/2996-2129-0x00007FF732060000-0x00007FF7323B4000-memory.dmp	upx
behavioral2/memory/1948-2131-0x00007FF6996A0000-0x00007FF6999F4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gLqPYXx.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\EAezYna.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\PmiAuky.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\dAzYPYa.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\JKQQTwJ.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\wPeIBTC.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\ESfOejo.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\MozcZSM.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\pDXbfSp.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\OfuOJxM.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\UNjaomh.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\onpVzdm.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\WCyXAzx.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\rgKtqZx.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\TezRZBN.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\tFsnGeg.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\gwUlIml.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\GbdwwvD.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\pAmcGVn.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\iixyRUm.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\crmTUdD.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\fgEvuGv.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\DmFdMYm.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\bUoipFd.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\OnuDTqZ.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\xofMOxF.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\VkfjpkA.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\hLqwToR.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\kjCgHjm.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\SshgkqI.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\FDKQEmX.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\WIKRFCR.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\WxUuFXa.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\tbVtKeY.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\mwFHjKb.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\feZipRk.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\vuggqFU.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\CjlPPFx.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\VFGXVwx.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\QudLpLl.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\BlTnLyh.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\yiQFaLq.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\lqwJyAC.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\FnZZxAr.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\nwXnvrT.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\yiblAnX.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\ScjmfYg.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\MCffBgR.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\OiyDpCt.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\JEsQWrr.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\BeGkWVr.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\ypqQKbx.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\MDwPduk.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\wwrxPqA.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\JvpFOjF.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\xSBcYtf.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\kyjkoZH.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\ODauLXz.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\yFmFkfb.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\NRcNvko.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\kjCQDxS.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\PdCHhwq.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\MLDDgez.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\MciyRRk.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 1948	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	84
PID 2996 wrote to memory of 1948	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	84
PID 2996 wrote to memory of 4208	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	85
PID 2996 wrote to memory of 4208	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	85
PID 2996 wrote to memory of 2560	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	88
PID 2996 wrote to memory of 2560	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	88
PID 2996 wrote to memory of 936	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	89
PID 2996 wrote to memory of 936	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	89
PID 2996 wrote to memory of 4336	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	90
PID 2996 wrote to memory of 4336	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	90
PID 2996 wrote to memory of 4868	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	91
PID 2996 wrote to memory of 4868	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	91
PID 2996 wrote to memory of 5432	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	92
PID 2996 wrote to memory of 5432	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	92
PID 2996 wrote to memory of 4952	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	93
PID 2996 wrote to memory of 4952	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	93
PID 2996 wrote to memory of 4088	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	94
PID 2996 wrote to memory of 4088	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	94
PID 2996 wrote to memory of 4448	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	95
PID 2996 wrote to memory of 4448	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	95
PID 2996 wrote to memory of 4368	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	96
PID 2996 wrote to memory of 4368	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	96
PID 2996 wrote to memory of 5376	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	97
PID 2996 wrote to memory of 5376	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	97
PID 2996 wrote to memory of 1376	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	98
PID 2996 wrote to memory of 1376	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	98
PID 2996 wrote to memory of 4536	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	99
PID 2996 wrote to memory of 4536	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	99
PID 2996 wrote to memory of 4436	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	100
PID 2996 wrote to memory of 4436	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	100
PID 2996 wrote to memory of 5020	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	101
PID 2996 wrote to memory of 5020	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	101
PID 2996 wrote to memory of 1160	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	102
PID 2996 wrote to memory of 1160	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	102
PID 2996 wrote to memory of 1980	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	103
PID 2996 wrote to memory of 1980	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	103
PID 2996 wrote to memory of 4504	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	104
PID 2996 wrote to memory of 4504	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	104
PID 2996 wrote to memory of 5032	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	105
PID 2996 wrote to memory of 5032	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	105
PID 2996 wrote to memory of 3620	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	106
PID 2996 wrote to memory of 3620	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	106
PID 2996 wrote to memory of 3196	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	107
PID 2996 wrote to memory of 3196	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	107
PID 2996 wrote to memory of 1852	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	108
PID 2996 wrote to memory of 1852	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	108
PID 2996 wrote to memory of 5372	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	109
PID 2996 wrote to memory of 5372	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	109
PID 2996 wrote to memory of 5100	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	110
PID 2996 wrote to memory of 5100	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	110
PID 2996 wrote to memory of 4552	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	111
PID 2996 wrote to memory of 4552	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	111
PID 2996 wrote to memory of 5672	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	112
PID 2996 wrote to memory of 5672	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	112
PID 2996 wrote to memory of 5416	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	113
PID 2996 wrote to memory of 5416	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	113
PID 2996 wrote to memory of 5436	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	114
PID 2996 wrote to memory of 5436	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	114
PID 2996 wrote to memory of 3368	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	115
PID 2996 wrote to memory of 3368	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	115
PID 2996 wrote to memory of 4216	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	116
PID 2996 wrote to memory of 4216	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	116
PID 2996 wrote to memory of 392	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	117
PID 2996 wrote to memory of 392	2996	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System\tAxPrMO.exe
  C:\Windows\System\tAxPrMO.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\VkfjpkA.exe
  C:\Windows\System\VkfjpkA.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\SVLxZit.exe
  C:\Windows\System\SVLxZit.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\TWkKaKJ.exe
  C:\Windows\System\TWkKaKJ.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\YKySsZD.exe
  C:\Windows\System\YKySsZD.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\WOEyPfe.exe
  C:\Windows\System\WOEyPfe.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\rnDkiJO.exe
  C:\Windows\System\rnDkiJO.exe
  2⤵
  - Executes dropped EXE
  PID:5432
- C:\Windows\System\WxUuFXa.exe
  C:\Windows\System\WxUuFXa.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\pAmcGVn.exe
  C:\Windows\System\pAmcGVn.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\uTEHjig.exe
  C:\Windows\System\uTEHjig.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\TSdToTe.exe
  C:\Windows\System\TSdToTe.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\plPmgEW.exe
  C:\Windows\System\plPmgEW.exe
  2⤵
  - Executes dropped EXE
  PID:5376
- C:\Windows\System\tOcCIca.exe
  C:\Windows\System\tOcCIca.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\cpVvHmA.exe
  C:\Windows\System\cpVvHmA.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\zuucxEv.exe
  C:\Windows\System\zuucxEv.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\KfgfNuq.exe
  C:\Windows\System\KfgfNuq.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\uUOJCVe.exe
  C:\Windows\System\uUOJCVe.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\QIHwSpS.exe
  C:\Windows\System\QIHwSpS.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\EfYRKbe.exe
  C:\Windows\System\EfYRKbe.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\zjQmEHW.exe
  C:\Windows\System\zjQmEHW.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\hBcNPYL.exe
  C:\Windows\System\hBcNPYL.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\zUOigil.exe
  C:\Windows\System\zUOigil.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\OcTpTNA.exe
  C:\Windows\System\OcTpTNA.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\WOMfSpQ.exe
  C:\Windows\System\WOMfSpQ.exe
  2⤵
  - Executes dropped EXE
  PID:5372
- C:\Windows\System\cnMbEiY.exe
  C:\Windows\System\cnMbEiY.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\DvVXlJk.exe
  C:\Windows\System\DvVXlJk.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\OAOWSRp.exe
  C:\Windows\System\OAOWSRp.exe
  2⤵
  - Executes dropped EXE
  PID:5672
- C:\Windows\System\QemyjZH.exe
  C:\Windows\System\QemyjZH.exe
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Windows\System\MDwPduk.exe
  C:\Windows\System\MDwPduk.exe
  2⤵
  - Executes dropped EXE
  PID:5436
- C:\Windows\System\YlkzEuH.exe
  C:\Windows\System\YlkzEuH.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\tbVtKeY.exe
  C:\Windows\System\tbVtKeY.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\nLdIUgS.exe
  C:\Windows\System\nLdIUgS.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\mPVwjHa.exe
  C:\Windows\System\mPVwjHa.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\gJHEwAz.exe
  C:\Windows\System\gJHEwAz.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\QUrqanw.exe
  C:\Windows\System\QUrqanw.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\lWJhPgR.exe
  C:\Windows\System\lWJhPgR.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\WeIHXQf.exe
  C:\Windows\System\WeIHXQf.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\KEGazFy.exe
  C:\Windows\System\KEGazFy.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\DCPqLGe.exe
  C:\Windows\System\DCPqLGe.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\RyAuYlt.exe
  C:\Windows\System\RyAuYlt.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\aKpOjVR.exe
  C:\Windows\System\aKpOjVR.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\uOKtvWa.exe
  C:\Windows\System\uOKtvWa.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\WZlUtMG.exe
  C:\Windows\System\WZlUtMG.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\HJrLDOf.exe
  C:\Windows\System\HJrLDOf.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\ueHETRW.exe
  C:\Windows\System\ueHETRW.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\XjrvXYx.exe
  C:\Windows\System\XjrvXYx.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\JBuBVqr.exe
  C:\Windows\System\JBuBVqr.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\wwrxPqA.exe
  C:\Windows\System\wwrxPqA.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\aIDmoKd.exe
  C:\Windows\System\aIDmoKd.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\QYCcHWJ.exe
  C:\Windows\System\QYCcHWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\ZRTGsuS.exe
  C:\Windows\System\ZRTGsuS.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\UNjaomh.exe
  C:\Windows\System\UNjaomh.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System\QNJbqmW.exe
  C:\Windows\System\QNJbqmW.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\CGLyGMn.exe
  C:\Windows\System\CGLyGMn.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\lLQdDMW.exe
  C:\Windows\System\lLQdDMW.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\iFLzeMH.exe
  C:\Windows\System\iFLzeMH.exe
  2⤵
  - Executes dropped EXE
  PID:5136
- C:\Windows\System\uSXFFVT.exe
  C:\Windows\System\uSXFFVT.exe
  2⤵
  - Executes dropped EXE
  PID:5460
- C:\Windows\System\HSZhtuw.exe
  C:\Windows\System\HSZhtuw.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\KmXgmEg.exe
  C:\Windows\System\KmXgmEg.exe
  2⤵
  - Executes dropped EXE
  PID:5676
- C:\Windows\System\OAhqODN.exe
  C:\Windows\System\OAhqODN.exe
  2⤵
  - Executes dropped EXE
  PID:5608
- C:\Windows\System\XyhdsUY.exe
  C:\Windows\System\XyhdsUY.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\ieYQCmn.exe
  C:\Windows\System\ieYQCmn.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\NAjuAnW.exe
  C:\Windows\System\NAjuAnW.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\apqHtro.exe
  C:\Windows\System\apqHtro.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\CBxVckl.exe
  C:\Windows\System\CBxVckl.exe
  2⤵
  PID:2664
- C:\Windows\System\cptxfsf.exe
  C:\Windows\System\cptxfsf.exe
  2⤵
  PID:2660
- C:\Windows\System\DGlbJjY.exe
  C:\Windows\System\DGlbJjY.exe
  2⤵
  PID:1360
- C:\Windows\System\UpyRIVW.exe
  C:\Windows\System\UpyRIVW.exe
  2⤵
  PID:5472
- C:\Windows\System\mwFHjKb.exe
  C:\Windows\System\mwFHjKb.exe
  2⤵
  PID:5160
- C:\Windows\System\ZUVjLfU.exe
  C:\Windows\System\ZUVjLfU.exe
  2⤵
  PID:2476
- C:\Windows\System\FOhyUeL.exe
  C:\Windows\System\FOhyUeL.exe
  2⤵
  PID:5732
- C:\Windows\System\ujawEtH.exe
  C:\Windows\System\ujawEtH.exe
  2⤵
  PID:3724
- C:\Windows\System\hIqdWpb.exe
  C:\Windows\System\hIqdWpb.exe
  2⤵
  PID:1608
- C:\Windows\System\vmwlXtS.exe
  C:\Windows\System\vmwlXtS.exe
  2⤵
  PID:2924
- C:\Windows\System\VibtIQD.exe
  C:\Windows\System\VibtIQD.exe
  2⤵
  PID:5476
- C:\Windows\System\tkJqkCx.exe
  C:\Windows\System\tkJqkCx.exe
  2⤵
  PID:6104
- C:\Windows\System\AZcKrhT.exe
  C:\Windows\System\AZcKrhT.exe
  2⤵
  PID:1332
- C:\Windows\System\EAezYna.exe
  C:\Windows\System\EAezYna.exe
  2⤵
  PID:3692
- C:\Windows\System\TCJYzZP.exe
  C:\Windows\System\TCJYzZP.exe
  2⤵
  PID:4480
- C:\Windows\System\yFmFkfb.exe
  C:\Windows\System\yFmFkfb.exe
  2⤵
  PID:3584
- C:\Windows\System\FVjlkRt.exe
  C:\Windows\System\FVjlkRt.exe
  2⤵
  PID:4316
- C:\Windows\System\baBHAtg.exe
  C:\Windows\System\baBHAtg.exe
  2⤵
  PID:5496
- C:\Windows\System\YivmbLV.exe
  C:\Windows\System\YivmbLV.exe
  2⤵
  PID:940
- C:\Windows\System\BnpYdhx.exe
  C:\Windows\System\BnpYdhx.exe
  2⤵
  PID:3528
- C:\Windows\System\TqWeRhc.exe
  C:\Windows\System\TqWeRhc.exe
  2⤵
  PID:368
- C:\Windows\System\ZKBoWTS.exe
  C:\Windows\System\ZKBoWTS.exe
  2⤵
  PID:4104
- C:\Windows\System\cxOFLwI.exe
  C:\Windows\System\cxOFLwI.exe
  2⤵
  PID:3188
- C:\Windows\System\LjGXlAr.exe
  C:\Windows\System\LjGXlAr.exe
  2⤵
  PID:4560
- C:\Windows\System\kTyStrZ.exe
  C:\Windows\System\kTyStrZ.exe
  2⤵
  PID:3112
- C:\Windows\System\nDevWyh.exe
  C:\Windows\System\nDevWyh.exe
  2⤵
  PID:2092
- C:\Windows\System\TEFXffZ.exe
  C:\Windows\System\TEFXffZ.exe
  2⤵
  PID:3952
- C:\Windows\System\PmiAuky.exe
  C:\Windows\System\PmiAuky.exe
  2⤵
  PID:4052
- C:\Windows\System\UPmFsYj.exe
  C:\Windows\System\UPmFsYj.exe
  2⤵
  PID:1824
- C:\Windows\System\lpjEUbB.exe
  C:\Windows\System\lpjEUbB.exe
  2⤵
  PID:1872
- C:\Windows\System\fLuCtbz.exe
  C:\Windows\System\fLuCtbz.exe
  2⤵
  PID:5044
- C:\Windows\System\bUoipFd.exe
  C:\Windows\System\bUoipFd.exe
  2⤵
  PID:6048
- C:\Windows\System\iixyRUm.exe
  C:\Windows\System\iixyRUm.exe
  2⤵
  PID:3844
- C:\Windows\System\QtSeUok.exe
  C:\Windows\System\QtSeUok.exe
  2⤵
  PID:1304
- C:\Windows\System\JvpFOjF.exe
  C:\Windows\System\JvpFOjF.exe
  2⤵
  PID:4280
- C:\Windows\System\dmrcuKf.exe
  C:\Windows\System\dmrcuKf.exe
  2⤵
  PID:2288
- C:\Windows\System\qkHumDP.exe
  C:\Windows\System\qkHumDP.exe
  2⤵
  PID:5540
- C:\Windows\System\BnEnIwZ.exe
  C:\Windows\System\BnEnIwZ.exe
  2⤵
  PID:5888
- C:\Windows\System\TxSmjgB.exe
  C:\Windows\System\TxSmjgB.exe
  2⤵
  PID:5768
- C:\Windows\System\teoRaPo.exe
  C:\Windows\System\teoRaPo.exe
  2⤵
  PID:3472
- C:\Windows\System\HWIyxhB.exe
  C:\Windows\System\HWIyxhB.exe
  2⤵
  PID:4936
- C:\Windows\System\iRFduyw.exe
  C:\Windows\System\iRFduyw.exe
  2⤵
  PID:4388
- C:\Windows\System\XMrSNjw.exe
  C:\Windows\System\XMrSNjw.exe
  2⤵
  PID:760
- C:\Windows\System\kcXgZkc.exe
  C:\Windows\System\kcXgZkc.exe
  2⤵
  PID:3636
- C:\Windows\System\dDjBfhx.exe
  C:\Windows\System\dDjBfhx.exe
  2⤵
  PID:2572
- C:\Windows\System\ZKecblP.exe
  C:\Windows\System\ZKecblP.exe
  2⤵
  PID:2436
- C:\Windows\System\ILSQkoc.exe
  C:\Windows\System\ILSQkoc.exe
  2⤵
  PID:4704
- C:\Windows\System\mCoyGwd.exe
  C:\Windows\System\mCoyGwd.exe
  2⤵
  PID:1596
- C:\Windows\System\pbsFPgd.exe
  C:\Windows\System\pbsFPgd.exe
  2⤵
  PID:3280
- C:\Windows\System\JIdVqup.exe
  C:\Windows\System\JIdVqup.exe
  2⤵
  PID:6112
- C:\Windows\System\yrTkTpf.exe
  C:\Windows\System\yrTkTpf.exe
  2⤵
  PID:5784
- C:\Windows\System\pDcwlKh.exe
  C:\Windows\System\pDcwlKh.exe
  2⤵
  PID:2844
- C:\Windows\System\crmTUdD.exe
  C:\Windows\System\crmTUdD.exe
  2⤵
  PID:1500
- C:\Windows\System\vdNYAXq.exe
  C:\Windows\System\vdNYAXq.exe
  2⤵
  PID:4628
- C:\Windows\System\RuJPlDO.exe
  C:\Windows\System\RuJPlDO.exe
  2⤵
  PID:3860
- C:\Windows\System\MRmrHyc.exe
  C:\Windows\System\MRmrHyc.exe
  2⤵
  PID:3428
- C:\Windows\System\jeEKtnX.exe
  C:\Windows\System\jeEKtnX.exe
  2⤵
  PID:4484
- C:\Windows\System\JGEUgIB.exe
  C:\Windows\System\JGEUgIB.exe
  2⤵
  PID:1860
- C:\Windows\System\hLqwToR.exe
  C:\Windows\System\hLqwToR.exe
  2⤵
  PID:1924
- C:\Windows\System\LLTeTuD.exe
  C:\Windows\System\LLTeTuD.exe
  2⤵
  PID:5556
- C:\Windows\System\DYxkAVp.exe
  C:\Windows\System\DYxkAVp.exe
  2⤵
  PID:1012
- C:\Windows\System\QudLpLl.exe
  C:\Windows\System\QudLpLl.exe
  2⤵
  PID:1084
- C:\Windows\System\XBYqTab.exe
  C:\Windows\System\XBYqTab.exe
  2⤵
  PID:4588
- C:\Windows\System\ImxMTJi.exe
  C:\Windows\System\ImxMTJi.exe
  2⤵
  PID:2812
- C:\Windows\System\JmNDuQO.exe
  C:\Windows\System\JmNDuQO.exe
  2⤵
  PID:4524
- C:\Windows\System\kjCgHjm.exe
  C:\Windows\System\kjCgHjm.exe
  2⤵
  PID:3812
- C:\Windows\System\QbtLziT.exe
  C:\Windows\System\QbtLziT.exe
  2⤵
  PID:1868
- C:\Windows\System\EiYYYhy.exe
  C:\Windows\System\EiYYYhy.exe
  2⤵
  PID:1516
- C:\Windows\System\VaWBGuj.exe
  C:\Windows\System\VaWBGuj.exe
  2⤵
  PID:3464
- C:\Windows\System\uJfYoIE.exe
  C:\Windows\System\uJfYoIE.exe
  2⤵
  PID:2412
- C:\Windows\System\KlKIakJ.exe
  C:\Windows\System\KlKIakJ.exe
  2⤵
  PID:6164
- C:\Windows\System\DBiNraF.exe
  C:\Windows\System\DBiNraF.exe
  2⤵
  PID:6192
- C:\Windows\System\jPirWaa.exe
  C:\Windows\System\jPirWaa.exe
  2⤵
  PID:6220
- C:\Windows\System\VBSElPo.exe
  C:\Windows\System\VBSElPo.exe
  2⤵
  PID:6248
- C:\Windows\System\NFQCsoY.exe
  C:\Windows\System\NFQCsoY.exe
  2⤵
  PID:6276
- C:\Windows\System\bWbONMJ.exe
  C:\Windows\System\bWbONMJ.exe
  2⤵
  PID:6304
- C:\Windows\System\vpNYuZY.exe
  C:\Windows\System\vpNYuZY.exe
  2⤵
  PID:6332
- C:\Windows\System\AKjmHEX.exe
  C:\Windows\System\AKjmHEX.exe
  2⤵
  PID:6360
- C:\Windows\System\NBRjuxl.exe
  C:\Windows\System\NBRjuxl.exe
  2⤵
  PID:6388
- C:\Windows\System\rYlUemV.exe
  C:\Windows\System\rYlUemV.exe
  2⤵
  PID:6416
- C:\Windows\System\ERUAkld.exe
  C:\Windows\System\ERUAkld.exe
  2⤵
  PID:6444
- C:\Windows\System\YQNERlp.exe
  C:\Windows\System\YQNERlp.exe
  2⤵
  PID:6472
- C:\Windows\System\NRcNvko.exe
  C:\Windows\System\NRcNvko.exe
  2⤵
  PID:6500
- C:\Windows\System\BPKtUna.exe
  C:\Windows\System\BPKtUna.exe
  2⤵
  PID:6528
- C:\Windows\System\SfGlSJF.exe
  C:\Windows\System\SfGlSJF.exe
  2⤵
  PID:6560
- C:\Windows\System\xmEqYVW.exe
  C:\Windows\System\xmEqYVW.exe
  2⤵
  PID:6592
- C:\Windows\System\hjehkLM.exe
  C:\Windows\System\hjehkLM.exe
  2⤵
  PID:6620
- C:\Windows\System\xSBcYtf.exe
  C:\Windows\System\xSBcYtf.exe
  2⤵
  PID:6652
- C:\Windows\System\KTkBkNk.exe
  C:\Windows\System\KTkBkNk.exe
  2⤵
  PID:6676
- C:\Windows\System\rXsgVVi.exe
  C:\Windows\System\rXsgVVi.exe
  2⤵
  PID:6708
- C:\Windows\System\NCSaLha.exe
  C:\Windows\System\NCSaLha.exe
  2⤵
  PID:6724
- C:\Windows\System\JoaRNEn.exe
  C:\Windows\System\JoaRNEn.exe
  2⤵
  PID:6752
- C:\Windows\System\tmjlisC.exe
  C:\Windows\System\tmjlisC.exe
  2⤵
  PID:6780
- C:\Windows\System\swOVFyi.exe
  C:\Windows\System\swOVFyi.exe
  2⤵
  PID:6808
- C:\Windows\System\IyGeawt.exe
  C:\Windows\System\IyGeawt.exe
  2⤵
  PID:6836
- C:\Windows\System\oWqhScv.exe
  C:\Windows\System\oWqhScv.exe
  2⤵
  PID:6864
- C:\Windows\System\tQZcAmA.exe
  C:\Windows\System\tQZcAmA.exe
  2⤵
  PID:6892
- C:\Windows\System\UJkXuiZ.exe
  C:\Windows\System\UJkXuiZ.exe
  2⤵
  PID:6920
- C:\Windows\System\cPiBKZu.exe
  C:\Windows\System\cPiBKZu.exe
  2⤵
  PID:6948
- C:\Windows\System\NBFTeor.exe
  C:\Windows\System\NBFTeor.exe
  2⤵
  PID:6976
- C:\Windows\System\bzLXTYz.exe
  C:\Windows\System\bzLXTYz.exe
  2⤵
  PID:7000
- C:\Windows\System\OJysKMa.exe
  C:\Windows\System\OJysKMa.exe
  2⤵
  PID:7028
- C:\Windows\System\GyiRZeX.exe
  C:\Windows\System\GyiRZeX.exe
  2⤵
  PID:7060
- C:\Windows\System\HuZeKXI.exe
  C:\Windows\System\HuZeKXI.exe
  2⤵
  PID:7088
- C:\Windows\System\LQKJcGO.exe
  C:\Windows\System\LQKJcGO.exe
  2⤵
  PID:7116
- C:\Windows\System\awrLQxi.exe
  C:\Windows\System\awrLQxi.exe
  2⤵
  PID:7144
- C:\Windows\System\JBPJoAt.exe
  C:\Windows\System\JBPJoAt.exe
  2⤵
  PID:5092
- C:\Windows\System\gRDyxLo.exe
  C:\Windows\System\gRDyxLo.exe
  2⤵
  PID:4056
- C:\Windows\System\xliMjsg.exe
  C:\Windows\System\xliMjsg.exe
  2⤵
  PID:3456
- C:\Windows\System\GvdkEuC.exe
  C:\Windows\System\GvdkEuC.exe
  2⤵
  PID:2364
- C:\Windows\System\GbCjHUv.exe
  C:\Windows\System\GbCjHUv.exe
  2⤵
  PID:2936
- C:\Windows\System\ipqUHND.exe
  C:\Windows\System\ipqUHND.exe
  2⤵
  PID:820
- C:\Windows\System\HMZcXOa.exe
  C:\Windows\System\HMZcXOa.exe
  2⤵
  PID:6184
- C:\Windows\System\aVyGwdQ.exe
  C:\Windows\System\aVyGwdQ.exe
  2⤵
  PID:6260
- C:\Windows\System\PheYAmI.exe
  C:\Windows\System\PheYAmI.exe
  2⤵
  PID:6316
- C:\Windows\System\tIOhoab.exe
  C:\Windows\System\tIOhoab.exe
  2⤵
  PID:6376
- C:\Windows\System\SshgkqI.exe
  C:\Windows\System\SshgkqI.exe
  2⤵
  PID:6436
- C:\Windows\System\nXAWzzS.exe
  C:\Windows\System\nXAWzzS.exe
  2⤵
  PID:6512
- C:\Windows\System\MozcZSM.exe
  C:\Windows\System\MozcZSM.exe
  2⤵
  PID:6580
- C:\Windows\System\fCPGDXC.exe
  C:\Windows\System\fCPGDXC.exe
  2⤵
  PID:6636
- C:\Windows\System\itMPzNZ.exe
  C:\Windows\System\itMPzNZ.exe
  2⤵
  PID:6696
- C:\Windows\System\kjCQDxS.exe
  C:\Windows\System\kjCQDxS.exe
  2⤵
  PID:6764
- C:\Windows\System\GMaVTeF.exe
  C:\Windows\System\GMaVTeF.exe
  2⤵
  PID:6820
- C:\Windows\System\ntRhteX.exe
  C:\Windows\System\ntRhteX.exe
  2⤵
  PID:6876
- C:\Windows\System\kyjkoZH.exe
  C:\Windows\System\kyjkoZH.exe
  2⤵
  PID:6936
- C:\Windows\System\pUCVoKV.exe
  C:\Windows\System\pUCVoKV.exe
  2⤵
  PID:6992
- C:\Windows\System\klRWBJh.exe
  C:\Windows\System\klRWBJh.exe
  2⤵
  PID:7052
- C:\Windows\System\sAOqLxV.exe
  C:\Windows\System\sAOqLxV.exe
  2⤵
  PID:7128
- C:\Windows\System\QshVmkV.exe
  C:\Windows\System\QshVmkV.exe
  2⤵
  PID:5952
- C:\Windows\System\MqxanUW.exe
  C:\Windows\System\MqxanUW.exe
  2⤵
  PID:5292
- C:\Windows\System\PdCHhwq.exe
  C:\Windows\System\PdCHhwq.exe
  2⤵
  PID:1020
- C:\Windows\System\HjbuMqL.exe
  C:\Windows\System\HjbuMqL.exe
  2⤵
  PID:6176
- C:\Windows\System\RNGVDdT.exe
  C:\Windows\System\RNGVDdT.exe
  2⤵
  PID:6348
- C:\Windows\System\bQxYjCe.exe
  C:\Windows\System\bQxYjCe.exe
  2⤵
  PID:6488
- C:\Windows\System\XOMOaDm.exe
  C:\Windows\System\XOMOaDm.exe
  2⤵
  PID:6608
- C:\Windows\System\VQRChxi.exe
  C:\Windows\System\VQRChxi.exe
  2⤵
  PID:6736
- C:\Windows\System\JILYIPm.exe
  C:\Windows\System\JILYIPm.exe
  2⤵
  PID:6856
- C:\Windows\System\dAzYPYa.exe
  C:\Windows\System\dAzYPYa.exe
  2⤵
  PID:1156
- C:\Windows\System\lmPQvKe.exe
  C:\Windows\System\lmPQvKe.exe
  2⤵
  PID:7104
- C:\Windows\System\peVVwvI.exe
  C:\Windows\System\peVVwvI.exe
  2⤵
  PID:5260
- C:\Windows\System\oNZkPTl.exe
  C:\Windows\System\oNZkPTl.exe
  2⤵
  PID:1520
- C:\Windows\System\nrMoHtp.exe
  C:\Windows\System\nrMoHtp.exe
  2⤵
  PID:7184
- C:\Windows\System\bCZBzHh.exe
  C:\Windows\System\bCZBzHh.exe
  2⤵
  PID:7216
- C:\Windows\System\BLHFcAP.exe
  C:\Windows\System\BLHFcAP.exe
  2⤵
  PID:7244
- C:\Windows\System\trhuQxg.exe
  C:\Windows\System\trhuQxg.exe
  2⤵
  PID:7272
- C:\Windows\System\nfEfYnW.exe
  C:\Windows\System\nfEfYnW.exe
  2⤵
  PID:7296
- C:\Windows\System\XSUtPRv.exe
  C:\Windows\System\XSUtPRv.exe
  2⤵
  PID:7328
- C:\Windows\System\BlTnLyh.exe
  C:\Windows\System\BlTnLyh.exe
  2⤵
  PID:7356
- C:\Windows\System\yiQFaLq.exe
  C:\Windows\System\yiQFaLq.exe
  2⤵
  PID:7384
- C:\Windows\System\dlurYXj.exe
  C:\Windows\System\dlurYXj.exe
  2⤵
  PID:7408
- C:\Windows\System\RBxdPSh.exe
  C:\Windows\System\RBxdPSh.exe
  2⤵
  PID:7440
- C:\Windows\System\JJsMqBS.exe
  C:\Windows\System\JJsMqBS.exe
  2⤵
  PID:7468
- C:\Windows\System\YNLoMzJ.exe
  C:\Windows\System\YNLoMzJ.exe
  2⤵
  PID:7496
- C:\Windows\System\RERDbEL.exe
  C:\Windows\System\RERDbEL.exe
  2⤵
  PID:7524
- C:\Windows\System\QXNWTxW.exe
  C:\Windows\System\QXNWTxW.exe
  2⤵
  PID:7552
- C:\Windows\System\PmiadQK.exe
  C:\Windows\System\PmiadQK.exe
  2⤵
  PID:7580
- C:\Windows\System\bjHKfDa.exe
  C:\Windows\System\bjHKfDa.exe
  2⤵
  PID:7608
- C:\Windows\System\jCtdbAp.exe
  C:\Windows\System\jCtdbAp.exe
  2⤵
  PID:7624
- C:\Windows\System\tTTlwZJ.exe
  C:\Windows\System\tTTlwZJ.exe
  2⤵
  PID:7652
- C:\Windows\System\fZnGmxC.exe
  C:\Windows\System\fZnGmxC.exe
  2⤵
  PID:7772
- C:\Windows\System\QgFycpA.exe
  C:\Windows\System\QgFycpA.exe
  2⤵
  PID:7796
- C:\Windows\System\ZnQpIrn.exe
  C:\Windows\System\ZnQpIrn.exe
  2⤵
  PID:7848
- C:\Windows\System\PzxPiWX.exe
  C:\Windows\System\PzxPiWX.exe
  2⤵
  PID:7872
- C:\Windows\System\THoBCzC.exe
  C:\Windows\System\THoBCzC.exe
  2⤵
  PID:7896
- C:\Windows\System\lymKMFf.exe
  C:\Windows\System\lymKMFf.exe
  2⤵
  PID:7924
- C:\Windows\System\CyTgFAJ.exe
  C:\Windows\System\CyTgFAJ.exe
  2⤵
  PID:7976
- C:\Windows\System\onpVzdm.exe
  C:\Windows\System\onpVzdm.exe
  2⤵
  PID:7996
- C:\Windows\System\qMJpqmH.exe
  C:\Windows\System\qMJpqmH.exe
  2⤵
  PID:8032
- C:\Windows\System\aMNXNIq.exe
  C:\Windows\System\aMNXNIq.exe
  2⤵
  PID:8052
- C:\Windows\System\gRyDJDN.exe
  C:\Windows\System\gRyDJDN.exe
  2⤵
  PID:8100
- C:\Windows\System\ZBVaPTD.exe
  C:\Windows\System\ZBVaPTD.exe
  2⤵
  PID:8136
- C:\Windows\System\TVfbWGd.exe
  C:\Windows\System\TVfbWGd.exe
  2⤵
  PID:8176
- C:\Windows\System\LYWpueT.exe
  C:\Windows\System\LYWpueT.exe
  2⤵
  PID:4328
- C:\Windows\System\rHIpbQk.exe
  C:\Windows\System\rHIpbQk.exe
  2⤵
  PID:6664
- C:\Windows\System\fGmGgHs.exe
  C:\Windows\System\fGmGgHs.exe
  2⤵
  PID:6932
- C:\Windows\System\aJrPMQw.exe
  C:\Windows\System\aJrPMQw.exe
  2⤵
  PID:7176
- C:\Windows\System\LEzaMNm.exe
  C:\Windows\System\LEzaMNm.exe
  2⤵
  PID:7204
- C:\Windows\System\VLyqiqE.exe
  C:\Windows\System\VLyqiqE.exe
  2⤵
  PID:5072
- C:\Windows\System\yIyFdGZ.exe
  C:\Windows\System\yIyFdGZ.exe
  2⤵
  PID:7264
- C:\Windows\System\VbzaRzD.exe
  C:\Windows\System\VbzaRzD.exe
  2⤵
  PID:7312
- C:\Windows\System\UbOLIqV.exe
  C:\Windows\System\UbOLIqV.exe
  2⤵
  PID:4092
- C:\Windows\System\avHTfDt.exe
  C:\Windows\System\avHTfDt.exe
  2⤵
  PID:7372
- C:\Windows\System\aZNGmzV.exe
  C:\Windows\System\aZNGmzV.exe
  2⤵
  PID:7404
- C:\Windows\System\PLyiDvL.exe
  C:\Windows\System\PLyiDvL.exe
  2⤵
  PID:7432
- C:\Windows\System\yKNodwu.exe
  C:\Windows\System\yKNodwu.exe
  2⤵
  PID:5508
- C:\Windows\System\MciyRRk.exe
  C:\Windows\System\MciyRRk.exe
  2⤵
  PID:4980
- C:\Windows\System\juscCMW.exe
  C:\Windows\System\juscCMW.exe
  2⤵
  PID:5544
- C:\Windows\System\SGgEgOB.exe
  C:\Windows\System\SGgEgOB.exe
  2⤵
  PID:4672
- C:\Windows\System\zVXKbjI.exe
  C:\Windows\System\zVXKbjI.exe
  2⤵
  PID:8060
- C:\Windows\System\BNjYVxD.exe
  C:\Windows\System\BNjYVxD.exe
  2⤵
  PID:8120
- C:\Windows\System\knGxntm.exe
  C:\Windows\System\knGxntm.exe
  2⤵
  PID:6292
- C:\Windows\System\NbJKDAT.exe
  C:\Windows\System\NbJKDAT.exe
  2⤵
  PID:1712
- C:\Windows\System\NuSaepK.exe
  C:\Windows\System\NuSaepK.exe
  2⤵
  PID:7200
- C:\Windows\System\WGmorMx.exe
  C:\Windows\System\WGmorMx.exe
  2⤵
  PID:7256
- C:\Windows\System\rIyGRgJ.exe
  C:\Windows\System\rIyGRgJ.exe
  2⤵
  PID:7460
- C:\Windows\System\NmlABjP.exe
  C:\Windows\System\NmlABjP.exe
  2⤵
  PID:3988
- C:\Windows\System\WRYivff.exe
  C:\Windows\System\WRYivff.exe
  2⤵
  PID:7616
- C:\Windows\System\juikvJe.exe
  C:\Windows\System\juikvJe.exe
  2⤵
  PID:4596
- C:\Windows\System\XpCrjiN.exe
  C:\Windows\System\XpCrjiN.exe
  2⤵
  PID:7760
- C:\Windows\System\ZEeCLDb.exe
  C:\Windows\System\ZEeCLDb.exe
  2⤵
  PID:8068
- C:\Windows\System\mYrIrVN.exe
  C:\Windows\System\mYrIrVN.exe
  2⤵
  PID:8188
- C:\Windows\System\RdRmILN.exe
  C:\Windows\System\RdRmILN.exe
  2⤵
  PID:2748
- C:\Windows\System\DzAvwvX.exe
  C:\Windows\System\DzAvwvX.exe
  2⤵
  PID:3880
- C:\Windows\System\qBIvnfE.exe
  C:\Windows\System\qBIvnfE.exe
  2⤵
  PID:7888
- C:\Windows\System\iabSkAC.exe
  C:\Windows\System\iabSkAC.exe
  2⤵
  PID:6572
- C:\Windows\System\xnZuMwO.exe
  C:\Windows\System\xnZuMwO.exe
  2⤵
  PID:5212
- C:\Windows\System\wWtUMFk.exe
  C:\Windows\System\wWtUMFk.exe
  2⤵
  PID:7488
- C:\Windows\System\IPiHQBk.exe
  C:\Windows\System\IPiHQBk.exe
  2⤵
  PID:396
- C:\Windows\System\GgDoefM.exe
  C:\Windows\System\GgDoefM.exe
  2⤵
  PID:3760
- C:\Windows\System\KjYPvPg.exe
  C:\Windows\System\KjYPvPg.exe
  2⤵
  PID:7768
- C:\Windows\System\eXlzVEL.exe
  C:\Windows\System\eXlzVEL.exe
  2⤵
  PID:920
- C:\Windows\System\cexcAla.exe
  C:\Windows\System\cexcAla.exe
  2⤵
  PID:7400
- C:\Windows\System\AAkzVgX.exe
  C:\Windows\System\AAkzVgX.exe
  2⤵
  PID:7564
- C:\Windows\System\fmpkxFn.exe
  C:\Windows\System\fmpkxFn.exe
  2⤵
  PID:7452
- C:\Windows\System\JVFUeDc.exe
  C:\Windows\System\JVFUeDc.exe
  2⤵
  PID:8028
- C:\Windows\System\xBMMnAN.exe
  C:\Windows\System\xBMMnAN.exe
  2⤵
  PID:8220
- C:\Windows\System\ARKjueQ.exe
  C:\Windows\System\ARKjueQ.exe
  2⤵
  PID:8240
- C:\Windows\System\PGcElkM.exe
  C:\Windows\System\PGcElkM.exe
  2⤵
  PID:8268
- C:\Windows\System\ISbAFTn.exe
  C:\Windows\System\ISbAFTn.exe
  2⤵
  PID:8308
- C:\Windows\System\LJennhT.exe
  C:\Windows\System\LJennhT.exe
  2⤵
  PID:8328
- C:\Windows\System\SIoELxN.exe
  C:\Windows\System\SIoELxN.exe
  2⤵
  PID:8352
- C:\Windows\System\lqwJyAC.exe
  C:\Windows\System\lqwJyAC.exe
  2⤵
  PID:8384
- C:\Windows\System\InhRibq.exe
  C:\Windows\System\InhRibq.exe
  2⤵
  PID:8408
- C:\Windows\System\WMhtFVl.exe
  C:\Windows\System\WMhtFVl.exe
  2⤵
  PID:8432
- C:\Windows\System\VuqrZga.exe
  C:\Windows\System\VuqrZga.exe
  2⤵
  PID:8464
- C:\Windows\System\QAiccWA.exe
  C:\Windows\System\QAiccWA.exe
  2⤵
  PID:8484
- C:\Windows\System\DESCcel.exe
  C:\Windows\System\DESCcel.exe
  2⤵
  PID:8520
- C:\Windows\System\dLuTsLb.exe
  C:\Windows\System\dLuTsLb.exe
  2⤵
  PID:8540
- C:\Windows\System\pGrqUzf.exe
  C:\Windows\System\pGrqUzf.exe
  2⤵
  PID:8568
- C:\Windows\System\BZRwRBK.exe
  C:\Windows\System\BZRwRBK.exe
  2⤵
  PID:8600
- C:\Windows\System\GhRsvZg.exe
  C:\Windows\System\GhRsvZg.exe
  2⤵
  PID:8628
- C:\Windows\System\yiblAnX.exe
  C:\Windows\System\yiblAnX.exe
  2⤵
  PID:8676
- C:\Windows\System\xELSaSo.exe
  C:\Windows\System\xELSaSo.exe
  2⤵
  PID:8696
- C:\Windows\System\rljkqrn.exe
  C:\Windows\System\rljkqrn.exe
  2⤵
  PID:8732
- C:\Windows\System\xTxAAGk.exe
  C:\Windows\System\xTxAAGk.exe
  2⤵
  PID:8748
- C:\Windows\System\pDXbfSp.exe
  C:\Windows\System\pDXbfSp.exe
  2⤵
  PID:8772
- C:\Windows\System\hPdbIeH.exe
  C:\Windows\System\hPdbIeH.exe
  2⤵
  PID:8816
- C:\Windows\System\iyXRaDj.exe
  C:\Windows\System\iyXRaDj.exe
  2⤵
  PID:8832
- C:\Windows\System\YPOgWAE.exe
  C:\Windows\System\YPOgWAE.exe
  2⤵
  PID:8860
- C:\Windows\System\UdKoAOy.exe
  C:\Windows\System\UdKoAOy.exe
  2⤵
  PID:8896
- C:\Windows\System\vGoIqdk.exe
  C:\Windows\System\vGoIqdk.exe
  2⤵
  PID:8916
- C:\Windows\System\hlbvimb.exe
  C:\Windows\System\hlbvimb.exe
  2⤵
  PID:8944
- C:\Windows\System\lXBUZAL.exe
  C:\Windows\System\lXBUZAL.exe
  2⤵
  PID:8964
- C:\Windows\System\rpZPWdV.exe
  C:\Windows\System\rpZPWdV.exe
  2⤵
  PID:9000
- C:\Windows\System\oKaUeor.exe
  C:\Windows\System\oKaUeor.exe
  2⤵
  PID:9032
- C:\Windows\System\AuWbtUZ.exe
  C:\Windows\System\AuWbtUZ.exe
  2⤵
  PID:9052
- C:\Windows\System\jtLuYvj.exe
  C:\Windows\System\jtLuYvj.exe
  2⤵
  PID:9068
- C:\Windows\System\IuUHVhV.exe
  C:\Windows\System\IuUHVhV.exe
  2⤵
  PID:9100
- C:\Windows\System\EmJoVbg.exe
  C:\Windows\System\EmJoVbg.exe
  2⤵
  PID:9140
- C:\Windows\System\lqcRPLx.exe
  C:\Windows\System\lqcRPLx.exe
  2⤵
  PID:9180
- C:\Windows\System\aFptAUS.exe
  C:\Windows\System\aFptAUS.exe
  2⤵
  PID:9204
- C:\Windows\System\YlmqILt.exe
  C:\Windows\System\YlmqILt.exe
  2⤵
  PID:5320
- C:\Windows\System\DktpoIF.exe
  C:\Windows\System\DktpoIF.exe
  2⤵
  PID:8232
- C:\Windows\System\BAotLVv.exe
  C:\Windows\System\BAotLVv.exe
  2⤵
  PID:8324
- C:\Windows\System\zYfwedF.exe
  C:\Windows\System\zYfwedF.exe
  2⤵
  PID:8396
- C:\Windows\System\zfmQdqO.exe
  C:\Windows\System\zfmQdqO.exe
  2⤵
  PID:8508
- C:\Windows\System\WCyXAzx.exe
  C:\Windows\System\WCyXAzx.exe
  2⤵
  PID:8536
- C:\Windows\System\uutNdPF.exe
  C:\Windows\System\uutNdPF.exe
  2⤵
  PID:8608
- C:\Windows\System\AggqtnJ.exe
  C:\Windows\System\AggqtnJ.exe
  2⤵
  PID:8660
- C:\Windows\System\rLwWUhB.exe
  C:\Windows\System\rLwWUhB.exe
  2⤵
  PID:8708
- C:\Windows\System\wpHhzvw.exe
  C:\Windows\System\wpHhzvw.exe
  2⤵
  PID:8760
- C:\Windows\System\OecrUAg.exe
  C:\Windows\System\OecrUAg.exe
  2⤵
  PID:8804
- C:\Windows\System\NLssGua.exe
  C:\Windows\System\NLssGua.exe
  2⤵
  PID:8880
- C:\Windows\System\VkIDTUt.exe
  C:\Windows\System\VkIDTUt.exe
  2⤵
  PID:8952
- C:\Windows\System\ODAUHry.exe
  C:\Windows\System\ODAUHry.exe
  2⤵
  PID:9048
- C:\Windows\System\PqGiAhb.exe
  C:\Windows\System\PqGiAhb.exe
  2⤵
  PID:9088
- C:\Windows\System\KlXkpDh.exe
  C:\Windows\System\KlXkpDh.exe
  2⤵
  PID:9160
- C:\Windows\System\ODauLXz.exe
  C:\Windows\System\ODauLXz.exe
  2⤵
  PID:8252
- C:\Windows\System\lEyQvYE.exe
  C:\Windows\System\lEyQvYE.exe
  2⤵
  PID:8364
- C:\Windows\System\yNuUmmY.exe
  C:\Windows\System\yNuUmmY.exe
  2⤵
  PID:8500
- C:\Windows\System\bFNmPAM.exe
  C:\Windows\System\bFNmPAM.exe
  2⤵
  PID:8620
- C:\Windows\System\ZbADvEK.exe
  C:\Windows\System\ZbADvEK.exe
  2⤵
  PID:8808
- C:\Windows\System\VAcGhJv.exe
  C:\Windows\System\VAcGhJv.exe
  2⤵
  PID:8844
- C:\Windows\System\SLfteDZ.exe
  C:\Windows\System\SLfteDZ.exe
  2⤵
  PID:9064
- C:\Windows\System\vIJXXyq.exe
  C:\Windows\System\vIJXXyq.exe
  2⤵
  PID:8372
- C:\Windows\System\qFPoqxZ.exe
  C:\Windows\System\qFPoqxZ.exe
  2⤵
  PID:8800
- C:\Windows\System\ScjmfYg.exe
  C:\Windows\System\ScjmfYg.exe
  2⤵
  PID:9060
- C:\Windows\System\JKQQTwJ.exe
  C:\Windows\System\JKQQTwJ.exe
  2⤵
  PID:8720
- C:\Windows\System\jgpybcS.exe
  C:\Windows\System\jgpybcS.exe
  2⤵
  PID:9232
- C:\Windows\System\TVCbLRx.exe
  C:\Windows\System\TVCbLRx.exe
  2⤵
  PID:9256
- C:\Windows\System\gwUlIml.exe
  C:\Windows\System\gwUlIml.exe
  2⤵
  PID:9308
- C:\Windows\System\jsJGOMy.exe
  C:\Windows\System\jsJGOMy.exe
  2⤵
  PID:9328
- C:\Windows\System\hdPMjpk.exe
  C:\Windows\System\hdPMjpk.exe
  2⤵
  PID:9368
- C:\Windows\System\PMTTWir.exe
  C:\Windows\System\PMTTWir.exe
  2⤵
  PID:9396
- C:\Windows\System\uSrNjNV.exe
  C:\Windows\System\uSrNjNV.exe
  2⤵
  PID:9424
- C:\Windows\System\qQPdLYq.exe
  C:\Windows\System\qQPdLYq.exe
  2⤵
  PID:9452
- C:\Windows\System\XteIKea.exe
  C:\Windows\System\XteIKea.exe
  2⤵
  PID:9480
- C:\Windows\System\DflqrUE.exe
  C:\Windows\System\DflqrUE.exe
  2⤵
  PID:9508
- C:\Windows\System\pQaMLgD.exe
  C:\Windows\System\pQaMLgD.exe
  2⤵
  PID:9524
- C:\Windows\System\wfKesYG.exe
  C:\Windows\System\wfKesYG.exe
  2⤵
  PID:9560
- C:\Windows\System\dCJjZIW.exe
  C:\Windows\System\dCJjZIW.exe
  2⤵
  PID:9580
- C:\Windows\System\GChMcby.exe
  C:\Windows\System\GChMcby.exe
  2⤵
  PID:9608
- C:\Windows\System\WWaIjpo.exe
  C:\Windows\System\WWaIjpo.exe
  2⤵
  PID:9640
- C:\Windows\System\EvTXaih.exe
  C:\Windows\System\EvTXaih.exe
  2⤵
  PID:9676
- C:\Windows\System\azRGUlQ.exe
  C:\Windows\System\azRGUlQ.exe
  2⤵
  PID:9692
- C:\Windows\System\HMDfOru.exe
  C:\Windows\System\HMDfOru.exe
  2⤵
  PID:9732
- C:\Windows\System\yqyApRk.exe
  C:\Windows\System\yqyApRk.exe
  2⤵
  PID:9760
- C:\Windows\System\nKLKpiR.exe
  C:\Windows\System\nKLKpiR.exe
  2⤵
  PID:9788
- C:\Windows\System\KpHIlTi.exe
  C:\Windows\System\KpHIlTi.exe
  2⤵
  PID:9816
- C:\Windows\System\fgEvuGv.exe
  C:\Windows\System\fgEvuGv.exe
  2⤵
  PID:9844
- C:\Windows\System\xvePxVa.exe
  C:\Windows\System\xvePxVa.exe
  2⤵
  PID:9872
- C:\Windows\System\BTWcned.exe
  C:\Windows\System\BTWcned.exe
  2⤵
  PID:9896
- C:\Windows\System\rgKtqZx.exe
  C:\Windows\System\rgKtqZx.exe
  2⤵
  PID:9920
- C:\Windows\System\zmeLjyY.exe
  C:\Windows\System\zmeLjyY.exe
  2⤵
  PID:9952
- C:\Windows\System\fvmeKtc.exe
  C:\Windows\System\fvmeKtc.exe
  2⤵
  PID:9980
- C:\Windows\System\KfzBuND.exe
  C:\Windows\System\KfzBuND.exe
  2⤵
  PID:10008
- C:\Windows\System\qvpcZJd.exe
  C:\Windows\System\qvpcZJd.exe
  2⤵
  PID:10032
- C:\Windows\System\pNvXszu.exe
  C:\Windows\System\pNvXszu.exe
  2⤵
  PID:10068
- C:\Windows\System\BybyUZo.exe
  C:\Windows\System\BybyUZo.exe
  2⤵
  PID:10100
- C:\Windows\System\GbJIUKg.exe
  C:\Windows\System\GbJIUKg.exe
  2⤵
  PID:10116
- C:\Windows\System\PLRTjtE.exe
  C:\Windows\System\PLRTjtE.exe
  2⤵
  PID:10144
- C:\Windows\System\GwHnjpu.exe
  C:\Windows\System\GwHnjpu.exe
  2⤵
  PID:10172
- C:\Windows\System\xNKYaHw.exe
  C:\Windows\System\xNKYaHw.exe
  2⤵
  PID:10200
- C:\Windows\System\YMoKjTq.exe
  C:\Windows\System\YMoKjTq.exe
  2⤵
  PID:10228
- C:\Windows\System\eEkTSez.exe
  C:\Windows\System\eEkTSez.exe
  2⤵
  PID:9240
- C:\Windows\System\NCYAJZI.exe
  C:\Windows\System\NCYAJZI.exe
  2⤵
  PID:9284
- C:\Windows\System\UUGXhgD.exe
  C:\Windows\System\UUGXhgD.exe
  2⤵
  PID:9380
- C:\Windows\System\XilDKVO.exe
  C:\Windows\System\XilDKVO.exe
  2⤵
  PID:9448
- C:\Windows\System\JwwPjuW.exe
  C:\Windows\System\JwwPjuW.exe
  2⤵
  PID:9476
- C:\Windows\System\OnuDTqZ.exe
  C:\Windows\System\OnuDTqZ.exe
  2⤵
  PID:9548
- C:\Windows\System\SInUipf.exe
  C:\Windows\System\SInUipf.exe
  2⤵
  PID:9624
- C:\Windows\System\OXWjGgE.exe
  C:\Windows\System\OXWjGgE.exe
  2⤵
  PID:9712
- C:\Windows\System\WsZIMZN.exe
  C:\Windows\System\WsZIMZN.exe
  2⤵
  PID:9772
- C:\Windows\System\TImfAUR.exe
  C:\Windows\System\TImfAUR.exe
  2⤵
  PID:9828
- C:\Windows\System\feZipRk.exe
  C:\Windows\System\feZipRk.exe
  2⤵
  PID:9880
- C:\Windows\System\MCffBgR.exe
  C:\Windows\System\MCffBgR.exe
  2⤵
  PID:9932
- C:\Windows\System\PUesJmJ.exe
  C:\Windows\System\PUesJmJ.exe
  2⤵
  PID:10016
- C:\Windows\System\XZVWSbL.exe
  C:\Windows\System\XZVWSbL.exe
  2⤵
  PID:10064
- C:\Windows\System\FMhoIfd.exe
  C:\Windows\System\FMhoIfd.exe
  2⤵
  PID:10160
- C:\Windows\System\lnQEfNS.exe
  C:\Windows\System\lnQEfNS.exe
  2⤵
  PID:10216
- C:\Windows\System\qnwfChz.exe
  C:\Windows\System\qnwfChz.exe
  2⤵
  PID:9288
- C:\Windows\System\JnYwFgg.exe
  C:\Windows\System\JnYwFgg.exe
  2⤵
  PID:9412
- C:\Windows\System\tiAdGKm.exe
  C:\Windows\System\tiAdGKm.exe
  2⤵
  PID:9536
- C:\Windows\System\LufdKOB.exe
  C:\Windows\System\LufdKOB.exe
  2⤵
  PID:9684
- C:\Windows\System\WDhfLnT.exe
  C:\Windows\System\WDhfLnT.exe
  2⤵
  PID:9812
- C:\Windows\System\GhcVWmA.exe
  C:\Windows\System\GhcVWmA.exe
  2⤵
  PID:9988
- C:\Windows\System\wmGMZPs.exe
  C:\Windows\System\wmGMZPs.exe
  2⤵
  PID:10028
- C:\Windows\System\AMnoLRL.exe
  C:\Windows\System\AMnoLRL.exe
  2⤵
  PID:10192
- C:\Windows\System\cPjQXyC.exe
  C:\Windows\System\cPjQXyC.exe
  2⤵
  PID:9592
- C:\Windows\System\jHsUdun.exe
  C:\Windows\System\jHsUdun.exe
  2⤵
  PID:10044
- C:\Windows\System\SEnLlbq.exe
  C:\Windows\System\SEnLlbq.exe
  2⤵
  PID:10180
- C:\Windows\System\SVTxKws.exe
  C:\Windows\System\SVTxKws.exe
  2⤵
  PID:9028
- C:\Windows\System\tiBlgJx.exe
  C:\Windows\System\tiBlgJx.exe
  2⤵
  PID:10260
- C:\Windows\System\CObXKZV.exe
  C:\Windows\System\CObXKZV.exe
  2⤵
  PID:10292
- C:\Windows\System\jqDWHmF.exe
  C:\Windows\System\jqDWHmF.exe
  2⤵
  PID:10324
- C:\Windows\System\IHUmuWL.exe
  C:\Windows\System\IHUmuWL.exe
  2⤵
  PID:10356
- C:\Windows\System\XwAVwVh.exe
  C:\Windows\System\XwAVwVh.exe
  2⤵
  PID:10380
- C:\Windows\System\ixzLCUI.exe
  C:\Windows\System\ixzLCUI.exe
  2⤵
  PID:10400
- C:\Windows\System\HgdzZQI.exe
  C:\Windows\System\HgdzZQI.exe
  2⤵
  PID:10432
- C:\Windows\System\qqDsotX.exe
  C:\Windows\System\qqDsotX.exe
  2⤵
  PID:10468
- C:\Windows\System\xGHezqw.exe
  C:\Windows\System\xGHezqw.exe
  2⤵
  PID:10492
- C:\Windows\System\ZEwIhCX.exe
  C:\Windows\System\ZEwIhCX.exe
  2⤵
  PID:10512
- C:\Windows\System\xofMOxF.exe
  C:\Windows\System\xofMOxF.exe
  2⤵
  PID:10552
- C:\Windows\System\MaQQvoc.exe
  C:\Windows\System\MaQQvoc.exe
  2⤵
  PID:10580
- C:\Windows\System\AJDSuhQ.exe
  C:\Windows\System\AJDSuhQ.exe
  2⤵
  PID:10608
- C:\Windows\System\iUENYUb.exe
  C:\Windows\System\iUENYUb.exe
  2⤵
  PID:10636
- C:\Windows\System\bYfjlJU.exe
  C:\Windows\System\bYfjlJU.exe
  2⤵
  PID:10664
- C:\Windows\System\iHOCBsr.exe
  C:\Windows\System\iHOCBsr.exe
  2⤵
  PID:10680
- C:\Windows\System\ZrdkKCe.exe
  C:\Windows\System\ZrdkKCe.exe
  2⤵
  PID:10708
- C:\Windows\System\NzZrPBK.exe
  C:\Windows\System\NzZrPBK.exe
  2⤵
  PID:10732
- C:\Windows\System\DmFdMYm.exe
  C:\Windows\System\DmFdMYm.exe
  2⤵
  PID:10760
- C:\Windows\System\IchvcgQ.exe
  C:\Windows\System\IchvcgQ.exe
  2⤵
  PID:10796
- C:\Windows\System\pEbCUGo.exe
  C:\Windows\System\pEbCUGo.exe
  2⤵
  PID:10820
- C:\Windows\System\gQsrzsz.exe
  C:\Windows\System\gQsrzsz.exe
  2⤵
  PID:10864
- C:\Windows\System\NEVMBPG.exe
  C:\Windows\System\NEVMBPG.exe
  2⤵
  PID:10892
- C:\Windows\System\XHqrtiN.exe
  C:\Windows\System\XHqrtiN.exe
  2⤵
  PID:10908
- C:\Windows\System\KiPXauN.exe
  C:\Windows\System\KiPXauN.exe
  2⤵
  PID:10936
- C:\Windows\System\fHNgVym.exe
  C:\Windows\System\fHNgVym.exe
  2⤵
  PID:10972
- C:\Windows\System\ZGsjKym.exe
  C:\Windows\System\ZGsjKym.exe
  2⤵
  PID:10992
- C:\Windows\System\gupKoOv.exe
  C:\Windows\System\gupKoOv.exe
  2⤵
  PID:11020
- C:\Windows\System\gHMCXku.exe
  C:\Windows\System\gHMCXku.exe
  2⤵
  PID:11056
- C:\Windows\System\WRAjsGI.exe
  C:\Windows\System\WRAjsGI.exe
  2⤵
  PID:11076
- C:\Windows\System\vinqVVa.exe
  C:\Windows\System\vinqVVa.exe
  2⤵
  PID:11116
- C:\Windows\System\WYEPXIt.exe
  C:\Windows\System\WYEPXIt.exe
  2⤵
  PID:11136
- C:\Windows\System\qEPzPrG.exe
  C:\Windows\System\qEPzPrG.exe
  2⤵
  PID:11172
- C:\Windows\System\BIlMIgk.exe
  C:\Windows\System\BIlMIgk.exe
  2⤵
  PID:11188
- C:\Windows\System\ZqDwYsb.exe
  C:\Windows\System\ZqDwYsb.exe
  2⤵
  PID:11224
- C:\Windows\System\PvelGfI.exe
  C:\Windows\System\PvelGfI.exe
  2⤵
  PID:11244
- C:\Windows\System\aQMAGLI.exe
  C:\Windows\System\aQMAGLI.exe
  2⤵
  PID:11260
- C:\Windows\System\BTLCLvE.exe
  C:\Windows\System\BTLCLvE.exe
  2⤵
  PID:10300
- C:\Windows\System\ZtYhiqF.exe
  C:\Windows\System\ZtYhiqF.exe
  2⤵
  PID:10364
- C:\Windows\System\hXnwqey.exe
  C:\Windows\System\hXnwqey.exe
  2⤵
  PID:10440
- C:\Windows\System\mXyNEUh.exe
  C:\Windows\System\mXyNEUh.exe
  2⤵
  PID:10500
- C:\Windows\System\mLTIIUE.exe
  C:\Windows\System\mLTIIUE.exe
  2⤵
  PID:10564
- C:\Windows\System\dykkqUy.exe
  C:\Windows\System\dykkqUy.exe
  2⤵
  PID:10624
- C:\Windows\System\zEhaTsQ.exe
  C:\Windows\System\zEhaTsQ.exe
  2⤵
  PID:10720
- C:\Windows\System\ptXcqRA.exe
  C:\Windows\System\ptXcqRA.exe
  2⤵
  PID:10776
- C:\Windows\System\GbdwwvD.exe
  C:\Windows\System\GbdwwvD.exe
  2⤵
  PID:10844
- C:\Windows\System\bjBQTnY.exe
  C:\Windows\System\bjBQTnY.exe
  2⤵
  PID:10884
- C:\Windows\System\FnZZxAr.exe
  C:\Windows\System\FnZZxAr.exe
  2⤵
  PID:10920
- C:\Windows\System\coUEdzq.exe
  C:\Windows\System\coUEdzq.exe
  2⤵
  PID:11004
- C:\Windows\System\lXwmJpN.exe
  C:\Windows\System\lXwmJpN.exe
  2⤵
  PID:11092
- C:\Windows\System\zYScOya.exe
  C:\Windows\System\zYScOya.exe
  2⤵
  PID:11164
- C:\Windows\System\FWdXVQI.exe
  C:\Windows\System\FWdXVQI.exe
  2⤵
  PID:11184
- C:\Windows\System\XyUQFap.exe
  C:\Windows\System\XyUQFap.exe
  2⤵
  PID:10340
- C:\Windows\System\vujtcJr.exe
  C:\Windows\System\vujtcJr.exe
  2⤵
  PID:10420
- C:\Windows\System\yVonIDP.exe
  C:\Windows\System\yVonIDP.exe
  2⤵
  PID:10532
- C:\Windows\System\ipleqmI.exe
  C:\Windows\System\ipleqmI.exe
  2⤵
  PID:10780
- C:\Windows\System\hLmcTTj.exe
  C:\Windows\System\hLmcTTj.exe
  2⤵
  PID:10948
- C:\Windows\System\BaaIEuS.exe
  C:\Windows\System\BaaIEuS.exe
  2⤵
  PID:11012
- C:\Windows\System\WvcJqOD.exe
  C:\Windows\System\WvcJqOD.exe
  2⤵
  PID:11236
- C:\Windows\System\yWuVzhN.exe
  C:\Windows\System\yWuVzhN.exe
  2⤵
  PID:10392
- C:\Windows\System\LeuzLpS.exe
  C:\Windows\System\LeuzLpS.exe
  2⤵
  PID:10748
- C:\Windows\System\wPeIBTC.exe
  C:\Windows\System\wPeIBTC.exe
  2⤵
  PID:11068
- C:\Windows\System\CUKmFQP.exe
  C:\Windows\System\CUKmFQP.exe
  2⤵
  PID:10600
- C:\Windows\System\inXgTZO.exe
  C:\Windows\System\inXgTZO.exe
  2⤵
  PID:11232
- C:\Windows\System\CeaGfob.exe
  C:\Windows\System\CeaGfob.exe
  2⤵
  PID:11284
- C:\Windows\System\SYZtAPp.exe
  C:\Windows\System\SYZtAPp.exe
  2⤵
  PID:11312
- C:\Windows\System\xbiEMDX.exe
  C:\Windows\System\xbiEMDX.exe
  2⤵
  PID:11352
- C:\Windows\System\OiyDpCt.exe
  C:\Windows\System\OiyDpCt.exe
  2⤵
  PID:11380
- C:\Windows\System\LYgUUnm.exe
  C:\Windows\System\LYgUUnm.exe
  2⤵
  PID:11408
- C:\Windows\System\gIcavDo.exe
  C:\Windows\System\gIcavDo.exe
  2⤵
  PID:11436
- C:\Windows\System\KLIujiY.exe
  C:\Windows\System\KLIujiY.exe
  2⤵
  PID:11464
- C:\Windows\System\huybDGX.exe
  C:\Windows\System\huybDGX.exe
  2⤵
  PID:11480
- C:\Windows\System\iOZcFOV.exe
  C:\Windows\System\iOZcFOV.exe
  2⤵
  PID:11508
- C:\Windows\System\PZkfdOO.exe
  C:\Windows\System\PZkfdOO.exe
  2⤵
  PID:11536
- C:\Windows\System\zSAAveu.exe
  C:\Windows\System\zSAAveu.exe
  2⤵
  PID:11564
- C:\Windows\System\yKNhNUu.exe
  C:\Windows\System\yKNhNUu.exe
  2⤵
  PID:11592
- C:\Windows\System\rEKqFFu.exe
  C:\Windows\System\rEKqFFu.exe
  2⤵
  PID:11620
- C:\Windows\System\JoDuBZW.exe
  C:\Windows\System\JoDuBZW.exe
  2⤵
  PID:11660
- C:\Windows\System\ypqQKbx.exe
  C:\Windows\System\ypqQKbx.exe
  2⤵
  PID:11688
- C:\Windows\System\LKAFMre.exe
  C:\Windows\System\LKAFMre.exe
  2⤵
  PID:11704
- C:\Windows\System\EKlKpTX.exe
  C:\Windows\System\EKlKpTX.exe
  2⤵
  PID:11720
- C:\Windows\System\cftUTXC.exe
  C:\Windows\System\cftUTXC.exe
  2⤵
  PID:11748
- C:\Windows\System\zxIPBhq.exe
  C:\Windows\System\zxIPBhq.exe
  2⤵
  PID:11784
- C:\Windows\System\XbhlyEz.exe
  C:\Windows\System\XbhlyEz.exe
  2⤵
  PID:11812
- C:\Windows\System\FPyFHwi.exe
  C:\Windows\System\FPyFHwi.exe
  2⤵
  PID:11860
- C:\Windows\System\TChjMhJ.exe
  C:\Windows\System\TChjMhJ.exe
  2⤵
  PID:11888
- C:\Windows\System\zVWXFjW.exe
  C:\Windows\System\zVWXFjW.exe
  2⤵
  PID:11904
- C:\Windows\System\MqZOQOv.exe
  C:\Windows\System\MqZOQOv.exe
  2⤵
  PID:11932
- C:\Windows\System\XcjsThH.exe
  C:\Windows\System\XcjsThH.exe
  2⤵
  PID:11960
- C:\Windows\System\ESfOejo.exe
  C:\Windows\System\ESfOejo.exe
  2⤵
  PID:11988
- C:\Windows\System\GNpYUfq.exe
  C:\Windows\System\GNpYUfq.exe
  2⤵
  PID:12008
- C:\Windows\System\TGQPCen.exe
  C:\Windows\System\TGQPCen.exe
  2⤵
  PID:12032
- C:\Windows\System\PFJyADM.exe
  C:\Windows\System\PFJyADM.exe
  2⤵
  PID:12060
- C:\Windows\System\uSKDkal.exe
  C:\Windows\System\uSKDkal.exe
  2⤵
  PID:12096
- C:\Windows\System\iPULdnb.exe
  C:\Windows\System\iPULdnb.exe
  2⤵
  PID:12140
- C:\Windows\System\eSDDgnM.exe
  C:\Windows\System\eSDDgnM.exe
  2⤵
  PID:12168
- C:\Windows\System\cfhLElv.exe
  C:\Windows\System\cfhLElv.exe
  2⤵
  PID:12196
- C:\Windows\System\qLUSgmq.exe
  C:\Windows\System\qLUSgmq.exe
  2⤵
  PID:12220
- C:\Windows\System\xiYvHpQ.exe
  C:\Windows\System\xiYvHpQ.exe
  2⤵
  PID:12240
- C:\Windows\System\QXjZRYG.exe
  C:\Windows\System\QXjZRYG.exe
  2⤵
  PID:12268
- C:\Windows\System\MdPtart.exe
  C:\Windows\System\MdPtart.exe
  2⤵
  PID:11304
- C:\Windows\System\ppOzTSb.exe
  C:\Windows\System\ppOzTSb.exe
  2⤵
  PID:11372
- C:\Windows\System\JmxOVbH.exe
  C:\Windows\System\JmxOVbH.exe
  2⤵
  PID:11428
- C:\Windows\System\RustzoN.exe
  C:\Windows\System\RustzoN.exe
  2⤵
  PID:11492
- C:\Windows\System\nwXnvrT.exe
  C:\Windows\System\nwXnvrT.exe
  2⤵
  PID:11556
- C:\Windows\System\IQzOEqP.exe
  C:\Windows\System\IQzOEqP.exe
  2⤵
  PID:11608
- C:\Windows\System\zBAgbEs.exe
  C:\Windows\System\zBAgbEs.exe
  2⤵
  PID:11684
- C:\Windows\System\qyLUTnw.exe
  C:\Windows\System\qyLUTnw.exe
  2⤵
  PID:11736
- C:\Windows\System\SGnVTIM.exe
  C:\Windows\System\SGnVTIM.exe
  2⤵
  PID:11776
- C:\Windows\System\JEsQWrr.exe
  C:\Windows\System\JEsQWrr.exe
  2⤵
  PID:11856
- C:\Windows\System\BaYcgvh.exe
  C:\Windows\System\BaYcgvh.exe
  2⤵
  PID:11916
- C:\Windows\System\uMrEFpU.exe
  C:\Windows\System\uMrEFpU.exe
  2⤵
  PID:12020
- C:\Windows\System\suqwHRB.exe
  C:\Windows\System\suqwHRB.exe
  2⤵
  PID:12112
- C:\Windows\System\thCMfmT.exe
  C:\Windows\System\thCMfmT.exe
  2⤵
  PID:12188
- C:\Windows\System\FynDVDR.exe
  C:\Windows\System\FynDVDR.exe
  2⤵
  PID:12252
- C:\Windows\System\aQgQydn.exe
  C:\Windows\System\aQgQydn.exe
  2⤵
  PID:11308
- C:\Windows\System\CulmHhj.exe
  C:\Windows\System\CulmHhj.exe
  2⤵
  PID:11456
- C:\Windows\System\IAirzvM.exe
  C:\Windows\System\IAirzvM.exe
  2⤵
  PID:11672
- C:\Windows\System\goPvtOF.exe
  C:\Windows\System\goPvtOF.exe
  2⤵
  PID:11972
- C:\Windows\System\gLqPYXx.exe
  C:\Windows\System\gLqPYXx.exe
  2⤵
  PID:12044
- C:\Windows\System\GNGxhfe.exe
  C:\Windows\System\GNGxhfe.exe
  2⤵
  PID:12236
- C:\Windows\System\IRGFolZ.exe
  C:\Windows\System\IRGFolZ.exe
  2⤵
  PID:11344
- C:\Windows\System\nnpCIaZ.exe
  C:\Windows\System\nnpCIaZ.exe
  2⤵
  PID:11808
- C:\Windows\System\yQTgOkr.exe
  C:\Windows\System\yQTgOkr.exe
  2⤵
  PID:11924
- C:\Windows\System\GxUUCGF.exe
  C:\Windows\System\GxUUCGF.exe
  2⤵
  PID:11656
- C:\Windows\System\vuggqFU.exe
  C:\Windows\System\vuggqFU.exe
  2⤵
  PID:12304
- C:\Windows\System\YiKmxTd.exe
  C:\Windows\System\YiKmxTd.exe
  2⤵
  PID:12344
- C:\Windows\System\FDKQEmX.exe
  C:\Windows\System\FDKQEmX.exe
  2⤵
  PID:12360
- C:\Windows\System\GoyQvrf.exe
  C:\Windows\System\GoyQvrf.exe
  2⤵
  PID:12388
- C:\Windows\System\HyuoaZF.exe
  C:\Windows\System\HyuoaZF.exe
  2⤵
  PID:12408
- C:\Windows\System\SOepJhG.exe
  C:\Windows\System\SOepJhG.exe
  2⤵
  PID:12456
- C:\Windows\System\xGZSfdb.exe
  C:\Windows\System\xGZSfdb.exe
  2⤵
  PID:12484
- C:\Windows\System\DVCIPEz.exe
  C:\Windows\System\DVCIPEz.exe
  2⤵
  PID:12512
- C:\Windows\System\ButuZeN.exe
  C:\Windows\System\ButuZeN.exe
  2⤵
  PID:12540
- C:\Windows\System\CPmwAiE.exe
  C:\Windows\System\CPmwAiE.exe
  2⤵
  PID:12568
- C:\Windows\System\noCFDcQ.exe
  C:\Windows\System\noCFDcQ.exe
  2⤵
  PID:12596
- C:\Windows\System\eseGprT.exe
  C:\Windows\System\eseGprT.exe
  2⤵
  PID:12624
- C:\Windows\System\TezRZBN.exe
  C:\Windows\System\TezRZBN.exe
  2⤵
  PID:12664
- C:\Windows\System\NfxMIQd.exe
  C:\Windows\System\NfxMIQd.exe
  2⤵
  PID:12680
- C:\Windows\System\RiHbjhU.exe
  C:\Windows\System\RiHbjhU.exe
  2⤵
  PID:12708
- C:\Windows\System\MfkEQrQ.exe
  C:\Windows\System\MfkEQrQ.exe
  2⤵
  PID:12732
- C:\Windows\System\znaaAvj.exe
  C:\Windows\System\znaaAvj.exe
  2⤵
  PID:12756
- C:\Windows\System\agjPfRd.exe
  C:\Windows\System\agjPfRd.exe
  2⤵
  PID:12780
- C:\Windows\System\yAOrBuI.exe
  C:\Windows\System\yAOrBuI.exe
  2⤵
  PID:12808
- C:\Windows\System\ePCYtJN.exe
  C:\Windows\System\ePCYtJN.exe
  2⤵
  PID:12828
- C:\Windows\System\YrnWnKa.exe
  C:\Windows\System\YrnWnKa.exe
  2⤵
  PID:12844
- C:\Windows\System\eLnoHho.exe
  C:\Windows\System\eLnoHho.exe
  2⤵
  PID:12872
- C:\Windows\System\yuTYjrm.exe
  C:\Windows\System\yuTYjrm.exe
  2⤵
  PID:12896
- C:\Windows\System\OfuOJxM.exe
  C:\Windows\System\OfuOJxM.exe
  2⤵
  PID:12944
- C:\Windows\System\Ojiamkt.exe
  C:\Windows\System\Ojiamkt.exe
  2⤵
  PID:12980
- C:\Windows\System\GGOkDem.exe
  C:\Windows\System\GGOkDem.exe
  2⤵
  PID:13008
- C:\Windows\System\szppIMT.exe
  C:\Windows\System\szppIMT.exe
  2⤵
  PID:13048
- C:\Windows\System\scwZGrq.exe
  C:\Windows\System\scwZGrq.exe
  2⤵
  PID:13068
- C:\Windows\System\WEaxuAv.exe
  C:\Windows\System\WEaxuAv.exe
  2⤵
  PID:13088
- C:\Windows\System\XmfZfCM.exe
  C:\Windows\System\XmfZfCM.exe
  2⤵
  PID:13132
- C:\Windows\System\wjynvgD.exe
  C:\Windows\System\wjynvgD.exe
  2⤵
  PID:13160
- C:\Windows\System\kSgPlAu.exe
  C:\Windows\System\kSgPlAu.exe
  2⤵
  PID:13188
- C:\Windows\System\RLMCKeo.exe
  C:\Windows\System\RLMCKeo.exe
  2⤵
  PID:13204
- C:\Windows\System\vYcOMoF.exe
  C:\Windows\System\vYcOMoF.exe
  2⤵
  PID:13232
- C:\Windows\System\osXKGiV.exe
  C:\Windows\System\osXKGiV.exe
  2⤵
  PID:13272
- C:\Windows\System\utkCfcO.exe
  C:\Windows\System\utkCfcO.exe
  2⤵
  PID:13288
- C:\Windows\System\kcaabPU.exe
  C:\Windows\System\kcaabPU.exe
  2⤵
  PID:12080
- C:\Windows\System\ogaeTjr.exe
  C:\Windows\System\ogaeTjr.exe
  2⤵
  PID:12356
- C:\Windows\System\qfZDiZQ.exe
  C:\Windows\System\qfZDiZQ.exe
  2⤵
  PID:12404
- C:\Windows\System\QOYoASf.exe
  C:\Windows\System\QOYoASf.exe
  2⤵
  PID:12480
- C:\Windows\System\cTJIAOD.exe
  C:\Windows\System\cTJIAOD.exe
  2⤵
  PID:12536
- C:\Windows\System\ZIUYPGx.exe
  C:\Windows\System\ZIUYPGx.exe
  2⤵
  PID:12632
- C:\Windows\System\hEChqOV.exe
  C:\Windows\System\hEChqOV.exe
  2⤵
  PID:12696
- C:\Windows\System\XLBljeG.exe
  C:\Windows\System\XLBljeG.exe
  2⤵
  PID:12752
- C:\Windows\System\yCRCTCv.exe
  C:\Windows\System\yCRCTCv.exe
  2⤵
  PID:12800
- C:\Windows\System\tkdQtgw.exe
  C:\Windows\System\tkdQtgw.exe
  2⤵
  PID:12860
- C:\Windows\System\VFGXVwx.exe
  C:\Windows\System\VFGXVwx.exe
  2⤵
  PID:12956
- C:\Windows\System\zoqrESY.exe
  C:\Windows\System\zoqrESY.exe
  2⤵
  PID:13040
- C:\Windows\System\nYjNdnJ.exe
  C:\Windows\System\nYjNdnJ.exe
  2⤵
  PID:13120
- C:\Windows\System\zwYtkNy.exe
  C:\Windows\System\zwYtkNy.exe
  2⤵
  PID:13156
- C:\Windows\System\lbGeaHC.exe
  C:\Windows\System\lbGeaHC.exe
  2⤵
  PID:13228
- C:\Windows\System\ACxfibz.exe
  C:\Windows\System\ACxfibz.exe
  2⤵
  PID:13284
- C:\Windows\System\CjlPPFx.exe
  C:\Windows\System\CjlPPFx.exe
  2⤵
  PID:12620
- C:\Windows\System\lrtRawa.exe
  C:\Windows\System\lrtRawa.exe
  2⤵
  PID:12728
- C:\Windows\System\sAtyLWa.exe
  C:\Windows\System\sAtyLWa.exe
  2⤵
  PID:12840
- C:\Windows\System\dChFlXt.exe
  C:\Windows\System\dChFlXt.exe
  2⤵
  PID:13004
- C:\Windows\System\RwBTgaU.exe
  C:\Windows\System\RwBTgaU.exe
  2⤵
  PID:13152
- C:\Windows\System\MkbBhRX.exe
  C:\Windows\System\MkbBhRX.exe
  2⤵
  PID:4712
- C:\Windows\System\mzEzmgB.exe
  C:\Windows\System\mzEzmgB.exe
  2⤵
  PID:4896
- C:\Windows\System\KjPKstf.exe
  C:\Windows\System\KjPKstf.exe
  2⤵
  PID:12768
- C:\Windows\System\ZwZzwLH.exe
  C:\Windows\System\ZwZzwLH.exe
  2⤵
  PID:2304
- C:\Windows\System\LNLiUKw.exe
  C:\Windows\System\LNLiUKw.exe
  2⤵
  PID:12656
- C:\Windows\System\fPuotCR.exe
  C:\Windows\System\fPuotCR.exe
  2⤵
  PID:13324
- C:\Windows\System\fBRuQad.exe
  C:\Windows\System\fBRuQad.exe
  2⤵
  PID:13360
- C:\Windows\System\eICrcsU.exe
  C:\Windows\System\eICrcsU.exe
  2⤵
  PID:13396
- C:\Windows\System\DkdIYBP.exe
  C:\Windows\System\DkdIYBP.exe
  2⤵
  PID:13436
- C:\Windows\System\HddnLgN.exe
  C:\Windows\System\HddnLgN.exe
  2⤵
  PID:13460
- C:\Windows\System\BCmZkaF.exe
  C:\Windows\System\BCmZkaF.exe
  2⤵
  PID:13500
- C:\Windows\System\hdxpyYt.exe
  C:\Windows\System\hdxpyYt.exe
  2⤵
  PID:13536
- C:\Windows\System\aMhNErI.exe
  C:\Windows\System\aMhNErI.exe
  2⤵
  PID:13568
- C:\Windows\System\BTjfsPh.exe
  C:\Windows\System\BTjfsPh.exe
  2⤵
  PID:13600
- C:\Windows\System\VXOGZYI.exe
  C:\Windows\System\VXOGZYI.exe
  2⤵
  PID:13640
- C:\Windows\System\dfeQgqd.exe
  C:\Windows\System\dfeQgqd.exe
  2⤵
  PID:13664
- C:\Windows\System\GjuefZw.exe
  C:\Windows\System\GjuefZw.exe
  2⤵
  PID:13688
- C:\Windows\System\sqhwMng.exe
  C:\Windows\System\sqhwMng.exe
  2⤵
  PID:13724
- C:\Windows\System\RBMntUM.exe
  C:\Windows\System\RBMntUM.exe
  2⤵
  PID:13756
- C:\Windows\System\sRMorGl.exe
  C:\Windows\System\sRMorGl.exe
  2⤵
  PID:13800
- C:\Windows\System\mTuzHDJ.exe
  C:\Windows\System\mTuzHDJ.exe
  2⤵
  PID:13848
- C:\Windows\System\WfAbPGW.exe
  C:\Windows\System\WfAbPGW.exe
  2⤵
  PID:13876
- C:\Windows\System\GEbnigS.exe
  C:\Windows\System\GEbnigS.exe
  2⤵
  PID:13900
- C:\Windows\System\pgxSneS.exe
  C:\Windows\System\pgxSneS.exe
  2⤵
  PID:13920
- C:\Windows\System\MPuzGlO.exe
  C:\Windows\System\MPuzGlO.exe
  2⤵
  PID:13948
- C:\Windows\System\RMBhrGk.exe
  C:\Windows\System\RMBhrGk.exe
  2⤵
  PID:13976
- C:\Windows\System\ujGxqcy.exe
  C:\Windows\System\ujGxqcy.exe
  2⤵
  PID:14000
- C:\Windows\System\OBLfltG.exe
  C:\Windows\System\OBLfltG.exe
  2⤵
  PID:14024
- C:\Windows\System\QbzIOzc.exe
  C:\Windows\System\QbzIOzc.exe
  2⤵
  PID:14056
- C:\Windows\System\DGHxDxh.exe
  C:\Windows\System\DGHxDxh.exe
  2⤵
  PID:14076
- C:\Windows\System\QgxkKUX.exe
  C:\Windows\System\QgxkKUX.exe
  2⤵
  PID:14120
- C:\Windows\System\kLvomfo.exe
  C:\Windows\System\kLvomfo.exe
  2⤵
  PID:14156
- C:\Windows\System\mpHiRLC.exe
  C:\Windows\System\mpHiRLC.exe
  2⤵
  PID:14172
- C:\Windows\System\vLdPGBm.exe
  C:\Windows\System\vLdPGBm.exe
  2⤵
  PID:14212
- C:\Windows\System\EeFVRfU.exe
  C:\Windows\System\EeFVRfU.exe
  2⤵
  PID:14248
- C:\Windows\System\KALfeXh.exe
  C:\Windows\System\KALfeXh.exe
  2⤵
  PID:14268
- C:\Windows\System\jZahTgM.exe
  C:\Windows\System\jZahTgM.exe
  2⤵
  PID:14300
- C:\Windows\System\hMfQkBP.exe
  C:\Windows\System\hMfQkBP.exe
  2⤵
  PID:14324
- C:\Windows\System\BdlOxrY.exe
  C:\Windows\System\BdlOxrY.exe
  2⤵
  PID:13348
- C:\Windows\System\nuTZxzY.exe
  C:\Windows\System\nuTZxzY.exe
  2⤵
  PID:3164
- C:\Windows\System\czOvLfz.exe
  C:\Windows\System\czOvLfz.exe
  2⤵
  PID:13484
- C:\Windows\System\WIKRFCR.exe
  C:\Windows\System\WIKRFCR.exe
  2⤵
  PID:13552
- C:\Windows\System\mCWhSML.exe
  C:\Windows\System\mCWhSML.exe
  2⤵
  PID:4288
- C:\Windows\System\WlCUJar.exe
  C:\Windows\System\WlCUJar.exe
  2⤵
  PID:13656
- C:\Windows\System\eBLAQVT.exe
  C:\Windows\System\eBLAQVT.exe
  2⤵
  PID:13740
- C:\Windows\System\osKDfoa.exe
  C:\Windows\System\osKDfoa.exe
  2⤵
  PID:13792
- C:\Windows\System\EEMNmzE.exe
  C:\Windows\System\EEMNmzE.exe
  2⤵
  PID:13960
- C:\Windows\System\pjoxBWW.exe
  C:\Windows\System\pjoxBWW.exe
  2⤵
  PID:13996
- C:\Windows\System\eTpjZtH.exe
  C:\Windows\System\eTpjZtH.exe
  2⤵
  PID:14040
- C:\Windows\System\wdEBhhg.exe
  C:\Windows\System\wdEBhhg.exe
  2⤵
  PID:2096
- C:\Windows\System\pNTeUpY.exe
  C:\Windows\System\pNTeUpY.exe
  2⤵
  PID:14192
- C:\Windows\System\yRlgBFG.exe
  C:\Windows\System\yRlgBFG.exe
  2⤵
  PID:14288
- C:\Windows\System\NRzXxVa.exe
  C:\Windows\System\NRzXxVa.exe
  2⤵
  PID:13428
- C:\Windows\System\SIsPjrF.exe
  C:\Windows\System\SIsPjrF.exe
  2⤵
  PID:13448
- C:\Windows\System\OrfQXWM.exe
  C:\Windows\System\OrfQXWM.exe
  2⤵
  PID:13672
- C:\Windows\System\gLLUNEW.exe
  C:\Windows\System\gLLUNEW.exe
  2⤵
  PID:13892
- C:\Windows\System\XAOkLKr.exe
  C:\Windows\System\XAOkLKr.exe
  2⤵
  PID:14048
- C:\Windows\System\MwkMYJr.exe
  C:\Windows\System\MwkMYJr.exe
  2⤵
  PID:3120
- C:\Windows\System\uavCuGC.exe
  C:\Windows\System\uavCuGC.exe
  2⤵
  PID:14260
- C:\Windows\System\kfOhDDD.exe
  C:\Windows\System\kfOhDDD.exe
  2⤵
  PID:13528
- C:\Windows\System\lLeUYGG.exe
  C:\Windows\System\lLeUYGG.exe
  2⤵
  PID:13932
- C:\Windows\System\XAcimIx.exe
  C:\Windows\System\XAcimIx.exe
  2⤵
  PID:14232
- C:\Windows\System\drqvdoY.exe
  C:\Windows\System\drqvdoY.exe
  2⤵
  PID:13776
- C:\Windows\System\YrAkWyV.exe
  C:\Windows\System\YrAkWyV.exe
  2⤵
  PID:14344
- C:\Windows\System\dFRAYRi.exe
  C:\Windows\System\dFRAYRi.exe
  2⤵
  PID:14372
- C:\Windows\System\DvmLyeu.exe
  C:\Windows\System\DvmLyeu.exe
  2⤵
  PID:14400
- C:\Windows\System\yGoSpuC.exe
  C:\Windows\System\yGoSpuC.exe
  2⤵
  PID:14416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DvVXlJk.exe

Filesize
2.1MB

MD5
7ed9df022874d01d3ec597421518ed3d

SHA1
b24dd79a490a32cd78d390926bfa4eee0d9d8d55

SHA256
45f44ce3a536f9c93b22ca6e560e56af22717b47767a29f3d2563f0f9a17d93b

SHA512
3a3b3206207cdf15df20acc0d4378941ebde3aaf9a73cb28bff39600a8ab71e527ed4a4612b207a23feb9fe4b9334d62756782ab58b930d7e01531b829894c08

Download Submit
C:\Windows\System\EfYRKbe.exe

Filesize
2.1MB

MD5
892778d1b5c4d5a08ef0b166e685aa0e

SHA1
8dabe07c01bf58ac09e25881f8d13fa12b5522fb

SHA256
ac1067089f447497ec6f60902a42bd0fa77841bc9f90d99b04322260ce7533f0

SHA512
a00dd0620559d3d9456ff315d8e64cfb39e13959b9d2c71e13b57538cf38fd8e66b166d96633a343502780dfda8932496520358a8ec43a8f0698ae442bbd3ef8

Download Submit
C:\Windows\System\KfgfNuq.exe

Filesize
2.1MB

MD5
d61ac9f164792731426be401fd9bbb2f

SHA1
93c817c96581b0b44ddb2e252ca5456c7ff038da

SHA256
e54b75fb0a7f074d6fcdf41fdbe68357f7f08379167a9967f782615aacc8526b

SHA512
cb1e6c36658ca6895bca723475f237014e6455dfea137468cafae7877b4f94c954fe313092fe7a4f78203c8c602a5130e4c070184abe25a819e5bb76e512a291

Download Submit
C:\Windows\System\MDwPduk.exe

Filesize
2.1MB

MD5
5136f5832650d77f5f0fb6ac1c97f0b9

SHA1
1788d802a123a81d5c7026e2491981bd34efd64d

SHA256
127af6d86647efcd7ed886659f69f8429feac4d2ddf0d6ed5bd3947941cf6f4a

SHA512
6e354e0baedcda2edf7c993779423374eed638b4ecb01cc882697116c9238e93b4515b79a9d371c6b6f4e33515074da9bf693270ea080e558211a6fe7895dade

Download Submit
C:\Windows\System\OAOWSRp.exe

Filesize
2.1MB

MD5
20b7dbb3eedc880f72513af867bb5ce3

SHA1
2446bf3af6037e9b148c7f8de813fe40c85783a4

SHA256
a1d14721727b0f43c9745d1a792a8c40eb000726c992171a794c1845237d8b02

SHA512
cfc11e35819b515092dfb1433a0116580113a088928b757c7d3e3bb7400c975392c4f559bc43cb60dc24abcd0d78547fc2d817065fcb8606d06255c9529d735f

Download Submit
C:\Windows\System\OcTpTNA.exe

Filesize
2.1MB

MD5
61f330575cf7150ba58339c621dd8cf0

SHA1
29a02b52a95a5949f61db7ae4fec08d5d5a42067

SHA256
294232fb149d4ef875ee7622d752c1f04befed532124bb9c0ca8feb7b9a55926

SHA512
f29a75e18eeca9673e96045e60de1f2f03217f55ccb37c8332362897ff2837d5e24974a187e71829557362fd21b5da0bfc8f697b74431ca351bebd84f5c751c7

Download Submit
C:\Windows\System\QIHwSpS.exe

Filesize
2.1MB

MD5
978691d9cc1009ce4a275de82676f02e

SHA1
3b50c04bd9977c959d20dfcc1dcc24e3c0487d8b

SHA256
0b04316934becf6843c297691892f93377cb42b68e054e400f68d33252058886

SHA512
d0ab90a4d738555353818dfb00c7dbac4c4f458a1d9703fcd921e229f616c1804fc8614d8109e723fcb401bda633135e5282501ceff8e4efcc8db9ae9604bf51

Download Submit
C:\Windows\System\QemyjZH.exe

Filesize
2.1MB

MD5
b1246835dda299cb76541a6913d55367

SHA1
bff6663e2035a39a1d79ce385fd0f3f3f9296ea9

SHA256
8ae71ee401bcb038f250ede5648d3fa855c2f4d7c030c1611faf3823d0cd80da

SHA512
2b0b0aef9243eb033b4b6a38022dac1e9a98b2651d7655d8a3c25d2c9ede5d0ae8ed65d043c8e6ad8887ca1656d569f7ea356065f8f0ba67fcd7db41d4970b14

Download Submit
C:\Windows\System\SVLxZit.exe

Filesize
2.1MB

MD5
2046a9fc734a74ca2198b2a21b042d21

SHA1
d3a7b6543f9d0fd766be4fdaf9d200c361b55740

SHA256
91dcbe0527416777273761948484758767df08adc33d1d4f6365a411a354325c

SHA512
b420e1ce97c8cba6297c62e0a4dff6b809db9ed630bdeb52df9181d0d7b0f9a3bcdfca08c2eda3ba45138f2a982ce4cf4c24d87ba258ccdfd4097b1f1ecbfcd6

Download Submit
C:\Windows\System\TSdToTe.exe

Filesize
2.1MB

MD5
0a32fda07a6f084db40e6f8823bf4e88

SHA1
cdca76bde87381dd308fd585b860cd978b1ac2bb

SHA256
60990f093ca46e0082ef58b563cd0dbaaf21d87e34409611693ab4e284c1c741

SHA512
93ab75ce7c1e461ad85d6f05726295ccbfedffe915b60551e54e3537eca64be1f6c6a600d25121d7ffc70ea2303219be500da3f64691123ae8c548ae4986da5e

Download Submit
C:\Windows\System\TWkKaKJ.exe

Filesize
2.1MB

MD5
83b170a273fc204da02c90346c45b423

SHA1
e261ff9ce7a9d9b57c67d1dcabec52134118c41c

SHA256
405d14abf04b53090c3430edc36810099e4c5335e929f3f71140b3d9c23a0a4b

SHA512
ccd1d88584512e1df88e69e9db55403f88680d08f7299eb497ca9ee017c68fde5ac085456d4c0291651c7b6f90a134d86f5f0965985a70b2bb095eed51dfcd6c

Download Submit
C:\Windows\System\VkfjpkA.exe

Filesize
2.1MB

MD5
1bd8c6eadd20b9bea83ddb3c3c61b153

SHA1
4593efb8b5739eb5d2df4ab2583a8d558aceb80f

SHA256
a495ae726f167b66a2b410d6bb3734af1f65d51b732957e6639c9bfd76224812

SHA512
d14f9e6f4510619c58456ced3c40ae9edb50cd3fe9972d5d9a4d0b2b75d237a1a1db689b91cf9023a6255b04ac67080a4d92a065150698d431a3156e8dd118b3

Download Submit
C:\Windows\System\WOEyPfe.exe

Filesize
2.1MB

MD5
2d0ad717f281f6d8c992427b0452b300

SHA1
ff82d6666cea78074f056437c5b1e8bf20f620c0

SHA256
9ed1a00c1d2820068b55904ee6cfaefaf1199299ae18c41de1ca815744f16da0

SHA512
02b542467b4dcf1aff9dc66cb0872a615bfc85bf6d268dc48e1b7a0d25587fa2f5f5b35b45512adb3b560e79d71a5914d7cd6d73bd1cab0d8291a98f08e9feb1

Download Submit
C:\Windows\System\WOMfSpQ.exe

Filesize
2.1MB

MD5
1e7038a0612f59b63d9e17e5f1ae1ac8

SHA1
0793eae8d72cc5c4ff1a6dd5b0fe0e7ffef79a07

SHA256
434e23d92569204204ae1bc47d27d91a5a9e328b66dd4d259c5e888da675bc32

SHA512
142a6d3a63cfe52be5468cfdc4dac95dc94562406d1ef20206aa4872c3c55fa503d6b559515fc472b5d450c7271b22f98f3419107df387d71ce5d1790ea29154

Download Submit
C:\Windows\System\WxUuFXa.exe

Filesize
2.1MB

MD5
bc4083261f340954b191c23dcb7910db

SHA1
2e2fef76e19c83e4b80462bc26a2ba76f24c5d97

SHA256
fa060730af587623f87b5b30c226c5fabdeffcfc713a2a8ae99a7ae722bc8c6f

SHA512
a0d8edb3a8551dc7e8f17e8783d613312c0760d469763ecfd37bf46f9d2df0c5dc068ee329a8d399512de77232d21334e889e9c702ba76b606092821c49aedcc

Download Submit
C:\Windows\System\YKySsZD.exe

Filesize
2.1MB

MD5
3e3ebb49424e2afe9c55cf39b487f232

SHA1
1221446f813f465a6fd475411e6d37eee7fda4c2

SHA256
ea079a455da66a2e567932518022c451af417ce9b54a4f13da92e07794aa4eb2

SHA512
64feb0ab106863376716a5d179f8600982738918cae3241daca6e40a4ccacf107cfd4a3b5844fd37b703b835317c180a2b5ecedb78236f0ddf4f211c109369f1

Download Submit
C:\Windows\System\YlkzEuH.exe

Filesize
2.1MB

MD5
e4a95adbdd1815dd2c500a69183c2c6f

SHA1
2581e638309333e46dd940544440c104d5adf34c

SHA256
d6252447dba9a646c448725484e30dc9a9fed25bddb9d904466201fa78c30452

SHA512
cd1ff9fe64a5f06bdf8d19891dab1b5271d4ecffacb9f8e60396edaa5bb3bf23a91cf2d8e22ae98fb303731b54c7efb705c4dd6a1e87607b6433183d2a1eea79

Download Submit
C:\Windows\System\cnMbEiY.exe

Filesize
2.1MB

MD5
55a7eba35d160ad0c562eaa5d0662004

SHA1
187c1d1261a071c4cbf96de6587c5b6579425ad5

SHA256
05412585b3a44c2054c151275c64e6eb56cca9d1d90c299134880dcd6aeede88

SHA512
a5c9a9944d65e25853918fe7f12bfe0bdab1ccc652c026766c7f61e72492c3c0b03bf752499056b0aa3fe516973babf24c2811b4568f41df36fd5945dfabc37d

Download Submit
C:\Windows\System\cpVvHmA.exe

Filesize
2.1MB

MD5
26dca2c1fa9b945abe775c362c85be39

SHA1
a864b6cc5ecbfce46f0b1ab8c1f1e23dd72cef46

SHA256
dc36fb9f10804eaf09f81dbe0b67c0b48011eda5dbb1a2d03486b6f1a0b64801

SHA512
4419eb95da3022e77db8f4869282d5aca5c0c5b6e4d04c761e6ecd57055d4972dd844f1deb1b67409388078503c6e36a02e7fc01d4227c3d772d5315e3c7a2f7

Download Submit
C:\Windows\System\hBcNPYL.exe

Filesize
2.1MB

MD5
3fb5bcf823be673e325da2d58022fc53

SHA1
8031d4f9fda5548c1534fe35d9d09da04a22800d

SHA256
86ceed0c50067542ca19389d0f98c1eb7a4ae0564e57c664c924066da1797dd1

SHA512
9e87668ff361f7c978b54be180a1b162ddef306c63432798b59b600590f201fd327ad6826f8ad8741c00109527f60ecc8d5121cf33b4c018dd0d4df8b6600127

Download Submit
C:\Windows\System\nLdIUgS.exe

Filesize
2.1MB

MD5
3e35f15fb1c23e5721ea5f5942d151e9

SHA1
4389b6d006e53e5ae9b39c875499b8f4c03b46d3

SHA256
c7be22d184fc3a1aeea2c846d3e83369e980b26151072ac7064698b30ea248b5

SHA512
5adb09a92f7e1f5c89ff43896baa575097cea72cc825e30180802959c58bbc4544080b7fac499b4d89ffb093c2d08beaf918d6d1322139cd2194d4a38666612d

Download Submit
C:\Windows\System\pAmcGVn.exe

Filesize
2.1MB

MD5
12944536da803180b99d611d01ce8aa4

SHA1
f0e8eae66cb1f13584f1c91fc472bc4f43319859

SHA256
e1ff426788a8ccaac87c5a12f5bd3e5a3e791b2209e7e107e317bd0f58a9541f

SHA512
ebe4df7ae19d443190556ad45dfb052104d4ca275993f9dba899fdc259111627b65dd9beb36dfd71b3de18c00bf76354f39f2ded5daafc4781710c93742ef8a3

Download Submit
C:\Windows\System\plPmgEW.exe

Filesize
2.1MB

MD5
0f8acb6dd6aa80e35b61fb9a7837a92e

SHA1
5d2582fe4c356c9f7c8f46ae072e03944dda85b4

SHA256
9350949f9c3d919e4ff1eeb60a4c9912ac92f8ff58730210790958bc15a4a066

SHA512
dd5875a7da2b5ffa1887033473d19ba4b04ab769301c2a2b9fbeca252e7af4eba132ddcfb8f881ff17446296d07e823d2948a352d11b0f6048c7d00877510aeb

Download Submit
C:\Windows\System\rnDkiJO.exe

Filesize
2.1MB

MD5
fbb250bc0898c0a2b258fd33da3bb1a4

SHA1
f50b5eec8d4c2013edf393297d9be53d4a1fe228

SHA256
8458560ecde0c983de15fa527abfdb29c55c2c85735e51b1d11cda18e0a0124d

SHA512
78e688366761f43c0ecf948f4618b520ff1c9cf67e17d5a35f913e4a9756a4126c4779dae2ea67affec4ee89da43d747a401f90729e2e6e6be4760fe0b5fc8fa

Download Submit
C:\Windows\System\tAxPrMO.exe

Filesize
2.1MB

MD5
a02b69dbd255f275c52a78245959a79f

SHA1
60f7f68ea9a55a187beacc0182c5e809cea9492d

SHA256
b26a84a913776bfaa824f41572ea5c2c9099ab747546b65414f103e723f7244b

SHA512
cb2d3177f3fe52f966257504d76553dfa56ba7ab2acd7a10c2d4301490cc51c51cd96a6986fd1c7268133a00772dd7c5a4004bdd87d8b9fd11abf79c2812f0da

Download Submit
C:\Windows\System\tOcCIca.exe

Filesize
2.1MB

MD5
1f96e86952560dac25ad2f70d74b57e7

SHA1
ca0e33842bfd9eb2164fbc6d08bb25730ccc2045

SHA256
e69907644fdb12dc0ae7995d485bcf0804653151a1549769c7bb8a023b786c47

SHA512
7af06342680d07c2efa89a6664d85ef85705d812ab0c482fb9f2f01153ac8549e77f76b8eaf03a875c0f5c70cc75a014e365907525e293ff9f7c55849ac8eb33

Download Submit
C:\Windows\System\tbVtKeY.exe

Filesize
2.1MB

MD5
d95b78c4f1420fd8a775885db76a0278

SHA1
74e3fc5efa11cef9ccd6811a3969b40d46c93708

SHA256
81d8cec3b418a1a3014448f036c6d5f444eed1faba2829c4eb872737b9f481cd

SHA512
5b7624d0e8b2c49505f0f15e4fe25fcb10e7ca222f46451bfdda04a230be3e314b13fa6132cdd3b9efdacf558e825502a2b16e5c0f17a52d692a502cf3afef6a

Download Submit
C:\Windows\System\uTEHjig.exe

Filesize
2.1MB

MD5
ee6d2f424749ab8e7e53cf3808aef056

SHA1
5fb54e22833e2758f6f746a61d7331434b0a3c90

SHA256
43d8d15b4830fedf54df83cd8273031b44e35c69e3d98d6c869af49a46615108

SHA512
b096f1a1f1705b654c6266da808593de0f628040714174fab7ead106ab5dc4d07c648ac81cc8f72fe0f594e8034a30d6f5075ad7e99560d6b79a2fae458a7601

Download Submit
C:\Windows\System\uUOJCVe.exe

Filesize
2.1MB

MD5
1e0538687c075501016a2f1e685b8f63

SHA1
27dd5912256c91d3f7daf72f100a3c4d37c1b6f7

SHA256
3880faa7630e95f38919df3e39e1be1eadb2ef0af639b553513639d865b58f50

SHA512
685e443a0fdd577ec7c1b55044295687047a9c9096648183bdbf3420d3189f2bdf366d6bb02f9773c08146b3b09f566832e19b458421803cf25ed022498913d1

Download Submit
C:\Windows\System\zUOigil.exe

Filesize
2.1MB

MD5
b932ab7c2f00a8fdd3c630e9a9ac159c

SHA1
12ed4c21fb612fc4ac80b8cb44bc241992965564

SHA256
da8abeaeeec09bab7b5d8627b0f6c98db10dbe5d9eea946ee4c5ef20b67e4678

SHA512
5218781d0476e6f38e44c37e73ce307b821da7a77fb49315a2a22f7b42044a308ec8772223bae12c31862eddb28a2be1e9ae3d8c47faf333a6c90ecbde99d8e2

Download Submit
C:\Windows\System\zjQmEHW.exe

Filesize
2.1MB

MD5
43c6fa3d18a25853a02577038e014a60

SHA1
d3e43fe1d1b0f518aba8a8b3fec29e2e4e3a6923

SHA256
76391148a156ef3cd4a43f09c113ebda7bd4bad4141b1f8976e0f5085e9fc26a

SHA512
70481974c9c646cbcba21547f4360de2368969d32a20b067ad6427257c92a56fd21a02ac24342655a9e3112750b778f8cb5630c925c0bc0256243ea45020eb44

Download Submit
C:\Windows\System\zuucxEv.exe

Filesize
2.1MB

MD5
2b8337900adcea442c26ed17996e6836

SHA1
7772c2d104e866bb9ae9e161098e355709e2678a

SHA256
9abeac69c3d691acac63b0dd536e2eb1ddb8f4b5d7cd7c29816ff352d322e797

SHA512
026b301b72f05a05d10bc51c954ea5d9340554540e0d91256bf39422b1cfc206732d91da828728a3d1a39fbc09f3afd818feaa995400a5b31c4433f7ca4a1bf1

Download Submit
memory/936-2141-0x00007FF6DE520000-0x00007FF6DE874000-memory.dmp

Filesize
3.3MB

Download
memory/936-832-0x00007FF6DE520000-0x00007FF6DE874000-memory.dmp

Filesize
3.3MB

Download
memory/1160-771-0x00007FF7E9900000-0x00007FF7E9C54000-memory.dmp

Filesize
3.3MB

Download
memory/1160-2154-0x00007FF7E9900000-0x00007FF7E9C54000-memory.dmp

Filesize
3.3MB

Download
memory/1376-747-0x00007FF66A720000-0x00007FF66AA74000-memory.dmp

Filesize
3.3MB

Download
memory/1376-2146-0x00007FF66A720000-0x00007FF66AA74000-memory.dmp

Filesize
3.3MB

Download
memory/1852-2159-0x00007FF67BE70000-0x00007FF67C1C4000-memory.dmp

Filesize
3.3MB

Download
memory/1852-787-0x00007FF67BE70000-0x00007FF67C1C4000-memory.dmp

Filesize
3.3MB

Download
memory/1948-8-0x00007FF6996A0000-0x00007FF6999F4000-memory.dmp

Filesize
3.3MB

Download
memory/1948-2131-0x00007FF6996A0000-0x00007FF6999F4000-memory.dmp

Filesize
3.3MB

Download
memory/1948-2133-0x00007FF6996A0000-0x00007FF6999F4000-memory.dmp

Filesize
3.3MB

Download
memory/1980-775-0x00007FF75CCD0000-0x00007FF75D024000-memory.dmp

Filesize
3.3MB

Download
memory/1980-2155-0x00007FF75CCD0000-0x00007FF75D024000-memory.dmp

Filesize
3.3MB

Download
memory/2560-31-0x00007FF6627C0000-0x00007FF662B14000-memory.dmp

Filesize
3.3MB

Download
memory/2560-2135-0x00007FF6627C0000-0x00007FF662B14000-memory.dmp

Filesize
3.3MB

Download
memory/2996-2129-0x00007FF732060000-0x00007FF7323B4000-memory.dmp

Filesize
3.3MB

Download
memory/2996-1-0x000002B07A400000-0x000002B07A410000-memory.dmp

Filesize
64KB

Download
memory/2996-0-0x00007FF732060000-0x00007FF7323B4000-memory.dmp

Filesize
3.3MB

Download
memory/3196-2160-0x00007FF79CDF0000-0x00007FF79D144000-memory.dmp

Filesize
3.3MB

Download
memory/3196-786-0x00007FF79CDF0000-0x00007FF79D144000-memory.dmp

Filesize
3.3MB

Download
memory/3620-784-0x00007FF68B200000-0x00007FF68B554000-memory.dmp

Filesize
3.3MB

Download
memory/3620-2161-0x00007FF68B200000-0x00007FF68B554000-memory.dmp

Filesize
3.3MB

Download
memory/4088-735-0x00007FF657F90000-0x00007FF6582E4000-memory.dmp

Filesize
3.3MB

Download
memory/4088-2137-0x00007FF657F90000-0x00007FF6582E4000-memory.dmp

Filesize
3.3MB

Download
memory/4208-2134-0x00007FF6D74B0000-0x00007FF6D7804000-memory.dmp

Filesize
3.3MB

Download
memory/4208-21-0x00007FF6D74B0000-0x00007FF6D7804000-memory.dmp

Filesize
3.3MB

Download
memory/4336-2132-0x00007FF73B210000-0x00007FF73B564000-memory.dmp

Filesize
3.3MB

Download
memory/4336-2140-0x00007FF73B210000-0x00007FF73B564000-memory.dmp

Filesize
3.3MB

Download
memory/4336-732-0x00007FF73B210000-0x00007FF73B564000-memory.dmp

Filesize
3.3MB

Download
memory/4368-2142-0x00007FF68E120000-0x00007FF68E474000-memory.dmp

Filesize
3.3MB

Download
memory/4368-737-0x00007FF68E120000-0x00007FF68E474000-memory.dmp

Filesize
3.3MB

Download
memory/4436-757-0x00007FF79DBF0000-0x00007FF79DF44000-memory.dmp

Filesize
3.3MB

Download
memory/4436-2147-0x00007FF79DBF0000-0x00007FF79DF44000-memory.dmp

Filesize
3.3MB

Download
memory/4448-2144-0x00007FF6B5BC0000-0x00007FF6B5F14000-memory.dmp

Filesize
3.3MB

Download
memory/4448-736-0x00007FF6B5BC0000-0x00007FF6B5F14000-memory.dmp

Filesize
3.3MB

Download
memory/4504-776-0x00007FF6CBB60000-0x00007FF6CBEB4000-memory.dmp

Filesize
3.3MB

Download
memory/4504-2152-0x00007FF6CBB60000-0x00007FF6CBEB4000-memory.dmp

Filesize
3.3MB

Download
memory/4536-750-0x00007FF77CBA0000-0x00007FF77CEF4000-memory.dmp

Filesize
3.3MB

Download
memory/4536-2145-0x00007FF77CBA0000-0x00007FF77CEF4000-memory.dmp

Filesize
3.3MB

Download
memory/4552-2151-0x00007FF625D00000-0x00007FF626054000-memory.dmp

Filesize
3.3MB

Download
memory/4552-804-0x00007FF625D00000-0x00007FF626054000-memory.dmp

Filesize
3.3MB

Download
memory/4868-2136-0x00007FF65BB20000-0x00007FF65BE74000-memory.dmp

Filesize
3.3MB

Download
memory/4868-733-0x00007FF65BB20000-0x00007FF65BE74000-memory.dmp

Filesize
3.3MB

Download
memory/4952-734-0x00007FF652E90000-0x00007FF6531E4000-memory.dmp

Filesize
3.3MB

Download
memory/4952-2138-0x00007FF652E90000-0x00007FF6531E4000-memory.dmp

Filesize
3.3MB

Download
memory/5020-768-0x00007FF6A22C0000-0x00007FF6A2614000-memory.dmp

Filesize
3.3MB

Download
memory/5020-2156-0x00007FF6A22C0000-0x00007FF6A2614000-memory.dmp

Filesize
3.3MB

Download
memory/5032-2153-0x00007FF643020000-0x00007FF643374000-memory.dmp

Filesize
3.3MB

Download
memory/5032-778-0x00007FF643020000-0x00007FF643374000-memory.dmp

Filesize
3.3MB

Download
memory/5100-794-0x00007FF634960000-0x00007FF634CB4000-memory.dmp

Filesize
3.3MB

Download
memory/5100-2157-0x00007FF634960000-0x00007FF634CB4000-memory.dmp

Filesize
3.3MB

Download
memory/5372-791-0x00007FF701CD0000-0x00007FF702024000-memory.dmp

Filesize
3.3MB

Download
memory/5372-2158-0x00007FF701CD0000-0x00007FF702024000-memory.dmp

Filesize
3.3MB

Download
memory/5376-2143-0x00007FF758000000-0x00007FF758354000-memory.dmp

Filesize
3.3MB

Download
memory/5376-738-0x00007FF758000000-0x00007FF758354000-memory.dmp

Filesize
3.3MB

Download
memory/5416-2149-0x00007FF6FF470000-0x00007FF6FF7C4000-memory.dmp

Filesize
3.3MB

Download
memory/5416-815-0x00007FF6FF470000-0x00007FF6FF7C4000-memory.dmp

Filesize
3.3MB

Download
memory/5432-842-0x00007FF651610000-0x00007FF651964000-memory.dmp

Filesize
3.3MB

Download
memory/5432-2139-0x00007FF651610000-0x00007FF651964000-memory.dmp

Filesize
3.3MB

Download
memory/5436-2148-0x00007FF7CF000000-0x00007FF7CF354000-memory.dmp

Filesize
3.3MB

Download
memory/5436-827-0x00007FF7CF000000-0x00007FF7CF354000-memory.dmp

Filesize
3.3MB

Download
memory/5672-2150-0x00007FF7AB0E0000-0x00007FF7AB434000-memory.dmp

Filesize
3.3MB

Download
memory/5672-811-0x00007FF7AB0E0000-0x00007FF7AB434000-memory.dmp

Filesize
3.3MB

Download