xmrig | fb0e9eddf65d727423f1cdc09366ff97f0ddea9ac59756ec47b21b20914decb5

Analysis

max time kernel
132s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
Size

1.9MB
MD5

6b1c8adc49b80f09fe465c5d9537f740
SHA1

48ad1c52cf7d4dfed7eacca570e1fba16fba62d6
SHA256

fb0e9eddf65d727423f1cdc09366ff97f0ddea9ac59756ec47b21b20914decb5
SHA512

a3b21f217cedb146bdeda838747858cc887a65172100a371d267a43dff3ded90d1d15d556861738bac9e3a0a1d6094d40f73ec2a63845425292188be1936c911
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxxdcvou25dwpp:BemTLkNdfE0pZrQY

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4648-0-0x00007FF6144E0000-0x00007FF614834000-memory.dmp	xmrig
behavioral2/files/0x0008000000023420-4.dat	xmrig
behavioral2/files/0x0007000000023425-9.dat	xmrig
behavioral2/memory/3668-10-0x00007FF617BA0000-0x00007FF617EF4000-memory.dmp	xmrig
behavioral2/memory/2596-30-0x00007FF6C6420000-0x00007FF6C6774000-memory.dmp	xmrig
behavioral2/files/0x0007000000023428-39.dat	xmrig
behavioral2/files/0x000700000002342a-49.dat	xmrig
behavioral2/files/0x0007000000023433-88.dat	xmrig
behavioral2/files/0x0007000000023435-98.dat	xmrig
behavioral2/files/0x0007000000023436-107.dat	xmrig
behavioral2/files/0x000700000002343c-133.dat	xmrig
behavioral2/files/0x000700000002343f-146.dat	xmrig
behavioral2/files/0x0007000000023443-166.dat	xmrig
behavioral2/memory/4548-474-0x00007FF6A0680000-0x00007FF6A09D4000-memory.dmp	xmrig
behavioral2/memory/1148-481-0x00007FF624F80000-0x00007FF6252D4000-memory.dmp	xmrig
behavioral2/memory/5044-518-0x00007FF6FD490000-0x00007FF6FD7E4000-memory.dmp	xmrig
behavioral2/memory/4836-527-0x00007FF653CF0000-0x00007FF654044000-memory.dmp	xmrig
behavioral2/memory/5036-543-0x00007FF6A3010000-0x00007FF6A3364000-memory.dmp	xmrig
behavioral2/memory/812-545-0x00007FF617E20000-0x00007FF618174000-memory.dmp	xmrig
behavioral2/memory/4960-546-0x00007FF7B2F60000-0x00007FF7B32B4000-memory.dmp	xmrig
behavioral2/memory/5096-547-0x00007FF6F9180000-0x00007FF6F94D4000-memory.dmp	xmrig
behavioral2/memory/4932-548-0x00007FF6EA130000-0x00007FF6EA484000-memory.dmp	xmrig
behavioral2/memory/2072-549-0x00007FF6B1F60000-0x00007FF6B22B4000-memory.dmp	xmrig
behavioral2/memory/4868-550-0x00007FF7F2710000-0x00007FF7F2A64000-memory.dmp	xmrig
behavioral2/memory/4796-544-0x00007FF7FA810000-0x00007FF7FAB64000-memory.dmp	xmrig
behavioral2/memory/2156-540-0x00007FF722B80000-0x00007FF722ED4000-memory.dmp	xmrig
behavioral2/memory/452-537-0x00007FF649E90000-0x00007FF64A1E4000-memory.dmp	xmrig
behavioral2/memory/4568-513-0x00007FF6C9630000-0x00007FF6C9984000-memory.dmp	xmrig
behavioral2/memory/4748-510-0x00007FF757CB0000-0x00007FF758004000-memory.dmp	xmrig
behavioral2/memory/3496-503-0x00007FF6764E0000-0x00007FF676834000-memory.dmp	xmrig
behavioral2/memory/3728-500-0x00007FF718C60000-0x00007FF718FB4000-memory.dmp	xmrig
behavioral2/memory/2080-495-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp	xmrig
behavioral2/memory/1384-493-0x00007FF616150000-0x00007FF6164A4000-memory.dmp	xmrig
behavioral2/memory/5104-471-0x00007FF7621E0000-0x00007FF762534000-memory.dmp	xmrig
behavioral2/memory/4944-465-0x00007FF6DC7A0000-0x00007FF6DCAF4000-memory.dmp	xmrig
behavioral2/memory/2088-457-0x00007FF71E430000-0x00007FF71E784000-memory.dmp	xmrig
behavioral2/memory/4204-453-0x00007FF6DF830000-0x00007FF6DFB84000-memory.dmp	xmrig
behavioral2/memory/4872-447-0x00007FF76F0A0000-0x00007FF76F3F4000-memory.dmp	xmrig
behavioral2/memory/1276-444-0x00007FF643290000-0x00007FF6435E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023441-162.dat	xmrig
behavioral2/files/0x0007000000023442-161.dat	xmrig
behavioral2/files/0x0007000000023440-157.dat	xmrig
behavioral2/files/0x000700000002343e-147.dat	xmrig
behavioral2/files/0x000700000002343d-142.dat	xmrig
behavioral2/files/0x000700000002343b-131.dat	xmrig
behavioral2/files/0x000700000002343a-127.dat	xmrig
behavioral2/files/0x0007000000023439-121.dat	xmrig
behavioral2/files/0x0007000000023438-117.dat	xmrig
behavioral2/files/0x0007000000023437-111.dat	xmrig
behavioral2/files/0x0007000000023434-96.dat	xmrig
behavioral2/files/0x0007000000023432-84.dat	xmrig
behavioral2/files/0x0007000000023431-82.dat	xmrig
behavioral2/files/0x0007000000023430-76.dat	xmrig
behavioral2/files/0x000700000002342f-72.dat	xmrig
behavioral2/files/0x000700000002342e-67.dat	xmrig
behavioral2/files/0x000700000002342d-62.dat	xmrig
behavioral2/files/0x000700000002342c-57.dat	xmrig
behavioral2/files/0x000700000002342b-52.dat	xmrig
behavioral2/files/0x0007000000023429-44.dat	xmrig
behavioral2/files/0x0007000000023427-34.dat	xmrig
behavioral2/memory/1260-25-0x00007FF7DEA10000-0x00007FF7DED64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-20.dat	xmrig
behavioral2/files/0x0007000000023424-15.dat	xmrig
behavioral2/memory/4648-2072-0x00007FF6144E0000-0x00007FF614834000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3668	gdWoQTC.exe
1260	uHlNRpR.exe
2596	lihNwLD.exe
1276	jHrGcfP.exe
4872	dMAqAht.exe
4868	HhXKXqD.exe
4204	yDuCvqt.exe
2088	qpTCuBT.exe
4944	ulBPwUN.exe
5104	KKPmjjc.exe
4548	frkTQDd.exe
1148	WYURMFD.exe
1384	adhDSII.exe
2080	naZNqRt.exe
3728	MblksMw.exe
3496	suAAClh.exe
4748	yGimpUd.exe
4568	IwPEODI.exe
5044	qMMvhZY.exe
4836	UpPtPcR.exe
452	wjQSlHv.exe
2156	VtvMqEN.exe
5036	FLPgVGo.exe
4796	CFtATPY.exe
812	MXCInIt.exe
4960	POOFbId.exe
5096	eTYhNdb.exe
4932	ofMYRxu.exe
2072	BfZoqiB.exe
4716	yoolujw.exe
3676	qZtUVHd.exe
884	XgYOiIi.exe
1892	NIIJSZf.exe
2792	XlVWGEt.exe
1984	TFheXsn.exe
1668	RqIVeJm.exe
3784	rbiZBnJ.exe
4116	XxpzZpp.exe
2032	fMDSvZa.exe
1172	ozGWqhS.exe
1848	ndkgYIO.exe
2932	BNzByPp.exe
1612	bVmFBKx.exe
4012	zEQWIWM.exe
1232	mauVJMN.exe
3188	THDtjKF.exe
896	KvAWkzT.exe
5092	FkLGIRN.exe
3196	UvmAEMD.exe
4480	LSQLkKG.exe
3096	iBFzyvB.exe
5088	PavFvNF.exe
1920	MylLxBk.exe
4952	xTsyBoA.exe
4220	YbEBguj.exe
1588	hoVScwu.exe
2292	XXQkRQM.exe
2884	cxHNskt.exe
2004	QVsYUnm.exe
980	mXXVSWg.exe
2460	eIDNGKQ.exe
4260	mHqqjSw.exe
4512	kfzedUR.exe
4808	eflVfwW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4648-0-0x00007FF6144E0000-0x00007FF614834000-memory.dmp	upx
behavioral2/files/0x0008000000023420-4.dat	upx
behavioral2/files/0x0007000000023425-9.dat	upx
behavioral2/memory/3668-10-0x00007FF617BA0000-0x00007FF617EF4000-memory.dmp	upx
behavioral2/memory/2596-30-0x00007FF6C6420000-0x00007FF6C6774000-memory.dmp	upx
behavioral2/files/0x0007000000023428-39.dat	upx
behavioral2/files/0x000700000002342a-49.dat	upx
behavioral2/files/0x0007000000023433-88.dat	upx
behavioral2/files/0x0007000000023435-98.dat	upx
behavioral2/files/0x0007000000023436-107.dat	upx
behavioral2/files/0x000700000002343c-133.dat	upx
behavioral2/files/0x000700000002343f-146.dat	upx
behavioral2/files/0x0007000000023443-166.dat	upx
behavioral2/memory/4548-474-0x00007FF6A0680000-0x00007FF6A09D4000-memory.dmp	upx
behavioral2/memory/1148-481-0x00007FF624F80000-0x00007FF6252D4000-memory.dmp	upx
behavioral2/memory/5044-518-0x00007FF6FD490000-0x00007FF6FD7E4000-memory.dmp	upx
behavioral2/memory/4836-527-0x00007FF653CF0000-0x00007FF654044000-memory.dmp	upx
behavioral2/memory/5036-543-0x00007FF6A3010000-0x00007FF6A3364000-memory.dmp	upx
behavioral2/memory/812-545-0x00007FF617E20000-0x00007FF618174000-memory.dmp	upx
behavioral2/memory/4960-546-0x00007FF7B2F60000-0x00007FF7B32B4000-memory.dmp	upx
behavioral2/memory/5096-547-0x00007FF6F9180000-0x00007FF6F94D4000-memory.dmp	upx
behavioral2/memory/4932-548-0x00007FF6EA130000-0x00007FF6EA484000-memory.dmp	upx
behavioral2/memory/2072-549-0x00007FF6B1F60000-0x00007FF6B22B4000-memory.dmp	upx
behavioral2/memory/4868-550-0x00007FF7F2710000-0x00007FF7F2A64000-memory.dmp	upx
behavioral2/memory/4796-544-0x00007FF7FA810000-0x00007FF7FAB64000-memory.dmp	upx
behavioral2/memory/2156-540-0x00007FF722B80000-0x00007FF722ED4000-memory.dmp	upx
behavioral2/memory/452-537-0x00007FF649E90000-0x00007FF64A1E4000-memory.dmp	upx
behavioral2/memory/4568-513-0x00007FF6C9630000-0x00007FF6C9984000-memory.dmp	upx
behavioral2/memory/4748-510-0x00007FF757CB0000-0x00007FF758004000-memory.dmp	upx
behavioral2/memory/3496-503-0x00007FF6764E0000-0x00007FF676834000-memory.dmp	upx
behavioral2/memory/3728-500-0x00007FF718C60000-0x00007FF718FB4000-memory.dmp	upx
behavioral2/memory/2080-495-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp	upx
behavioral2/memory/1384-493-0x00007FF616150000-0x00007FF6164A4000-memory.dmp	upx
behavioral2/memory/5104-471-0x00007FF7621E0000-0x00007FF762534000-memory.dmp	upx
behavioral2/memory/4944-465-0x00007FF6DC7A0000-0x00007FF6DCAF4000-memory.dmp	upx
behavioral2/memory/2088-457-0x00007FF71E430000-0x00007FF71E784000-memory.dmp	upx
behavioral2/memory/4204-453-0x00007FF6DF830000-0x00007FF6DFB84000-memory.dmp	upx
behavioral2/memory/4872-447-0x00007FF76F0A0000-0x00007FF76F3F4000-memory.dmp	upx
behavioral2/memory/1276-444-0x00007FF643290000-0x00007FF6435E4000-memory.dmp	upx
behavioral2/files/0x0007000000023441-162.dat	upx
behavioral2/files/0x0007000000023442-161.dat	upx
behavioral2/files/0x0007000000023440-157.dat	upx
behavioral2/files/0x000700000002343e-147.dat	upx
behavioral2/files/0x000700000002343d-142.dat	upx
behavioral2/files/0x000700000002343b-131.dat	upx
behavioral2/files/0x000700000002343a-127.dat	upx
behavioral2/files/0x0007000000023439-121.dat	upx
behavioral2/files/0x0007000000023438-117.dat	upx
behavioral2/files/0x0007000000023437-111.dat	upx
behavioral2/files/0x0007000000023434-96.dat	upx
behavioral2/files/0x0007000000023432-84.dat	upx
behavioral2/files/0x0007000000023431-82.dat	upx
behavioral2/files/0x0007000000023430-76.dat	upx
behavioral2/files/0x000700000002342f-72.dat	upx
behavioral2/files/0x000700000002342e-67.dat	upx
behavioral2/files/0x000700000002342d-62.dat	upx
behavioral2/files/0x000700000002342c-57.dat	upx
behavioral2/files/0x000700000002342b-52.dat	upx
behavioral2/files/0x0007000000023429-44.dat	upx
behavioral2/files/0x0007000000023427-34.dat	upx
behavioral2/memory/1260-25-0x00007FF7DEA10000-0x00007FF7DED64000-memory.dmp	upx
behavioral2/files/0x0007000000023426-20.dat	upx
behavioral2/files/0x0007000000023424-15.dat	upx
behavioral2/memory/4648-2072-0x00007FF6144E0000-0x00007FF614834000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DOjaBCH.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\suAAClh.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\AKoYkMy.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\gKmdtlw.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\lrZMRpW.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\TunwYQS.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\ysGScsb.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\ROuxiYj.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\tQJPzgC.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\mMXJeyO.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\ruBexzw.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\MvtrYUN.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\qZtUVHd.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\KvAWkzT.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\MBuJmUW.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\NJyzrmK.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\MxQdrUD.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\WYURMFD.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\NXbzYIB.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\lMskdcy.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\PAfrHao.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\yDuCvqt.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\RVaxIDr.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\bOOXaXN.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\vwFxqcL.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\iJtbXFz.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\ifWOEOw.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\ZQhLOFg.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\qEgzGme.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\LbzjGfs.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\DGDNZMc.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\zyeqCtF.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\zhDekji.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\pqgkjPW.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\bPYHBDa.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\GulTyhw.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\yUCKHvF.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\tzahgZj.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\ndkgYIO.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\QVsYUnm.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\vfSzHEI.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\WImZyPd.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\tuigdif.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\tNwNWTi.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\YzVncnp.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\tSRuVJM.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\PVvZslU.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\lOBrVbG.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\QJCqZoA.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\gKfZhMc.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\AMnsNHo.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\pZLfpwy.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\NYCWaBZ.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\bBUaFuF.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\lihNwLD.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\PavFvNF.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\zQvGQqO.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\bbXBvrk.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\pmLIJGG.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\ofMYRxu.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\THDtjKF.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\ldytJAd.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\VWhLWff.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
File created	C:\Windows\System\imGXpde.exe	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3668	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	84
PID 4648 wrote to memory of 3668	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	84
PID 4648 wrote to memory of 1260	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	85
PID 4648 wrote to memory of 1260	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	85
PID 4648 wrote to memory of 2596	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	86
PID 4648 wrote to memory of 2596	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	86
PID 4648 wrote to memory of 1276	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	87
PID 4648 wrote to memory of 1276	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	87
PID 4648 wrote to memory of 4872	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	88
PID 4648 wrote to memory of 4872	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	88
PID 4648 wrote to memory of 4868	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	89
PID 4648 wrote to memory of 4868	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	89
PID 4648 wrote to memory of 4204	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	90
PID 4648 wrote to memory of 4204	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	90
PID 4648 wrote to memory of 2088	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	91
PID 4648 wrote to memory of 2088	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	91
PID 4648 wrote to memory of 4944	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	92
PID 4648 wrote to memory of 4944	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	92
PID 4648 wrote to memory of 5104	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	93
PID 4648 wrote to memory of 5104	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	93
PID 4648 wrote to memory of 4548	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	94
PID 4648 wrote to memory of 4548	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	94
PID 4648 wrote to memory of 1148	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	95
PID 4648 wrote to memory of 1148	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	95
PID 4648 wrote to memory of 1384	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	96
PID 4648 wrote to memory of 1384	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	96
PID 4648 wrote to memory of 2080	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	97
PID 4648 wrote to memory of 2080	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	97
PID 4648 wrote to memory of 3728	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	98
PID 4648 wrote to memory of 3728	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	98
PID 4648 wrote to memory of 3496	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	99
PID 4648 wrote to memory of 3496	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	99
PID 4648 wrote to memory of 4748	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	100
PID 4648 wrote to memory of 4748	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	100
PID 4648 wrote to memory of 4568	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	101
PID 4648 wrote to memory of 4568	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	101
PID 4648 wrote to memory of 5044	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	102
PID 4648 wrote to memory of 5044	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	102
PID 4648 wrote to memory of 4836	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	103
PID 4648 wrote to memory of 4836	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	103
PID 4648 wrote to memory of 452	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	104
PID 4648 wrote to memory of 452	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	104
PID 4648 wrote to memory of 2156	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	105
PID 4648 wrote to memory of 2156	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	105
PID 4648 wrote to memory of 5036	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	106
PID 4648 wrote to memory of 5036	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	106
PID 4648 wrote to memory of 4796	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	107
PID 4648 wrote to memory of 4796	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	107
PID 4648 wrote to memory of 812	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	108
PID 4648 wrote to memory of 812	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	108
PID 4648 wrote to memory of 4960	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	109
PID 4648 wrote to memory of 4960	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	109
PID 4648 wrote to memory of 5096	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	110
PID 4648 wrote to memory of 5096	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	110
PID 4648 wrote to memory of 4932	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	111
PID 4648 wrote to memory of 4932	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	111
PID 4648 wrote to memory of 2072	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	112
PID 4648 wrote to memory of 2072	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	112
PID 4648 wrote to memory of 4716	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	113
PID 4648 wrote to memory of 4716	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	113
PID 4648 wrote to memory of 3676	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	114
PID 4648 wrote to memory of 3676	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	114
PID 4648 wrote to memory of 884	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	115
PID 4648 wrote to memory of 884	4648	6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6b1c8adc49b80f09fe465c5d9537f740_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\System\gdWoQTC.exe
  C:\Windows\System\gdWoQTC.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\uHlNRpR.exe
  C:\Windows\System\uHlNRpR.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\lihNwLD.exe
  C:\Windows\System\lihNwLD.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\jHrGcfP.exe
  C:\Windows\System\jHrGcfP.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\dMAqAht.exe
  C:\Windows\System\dMAqAht.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\HhXKXqD.exe
  C:\Windows\System\HhXKXqD.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\yDuCvqt.exe
  C:\Windows\System\yDuCvqt.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\qpTCuBT.exe
  C:\Windows\System\qpTCuBT.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\ulBPwUN.exe
  C:\Windows\System\ulBPwUN.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\KKPmjjc.exe
  C:\Windows\System\KKPmjjc.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\frkTQDd.exe
  C:\Windows\System\frkTQDd.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\WYURMFD.exe
  C:\Windows\System\WYURMFD.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\adhDSII.exe
  C:\Windows\System\adhDSII.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\naZNqRt.exe
  C:\Windows\System\naZNqRt.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\MblksMw.exe
  C:\Windows\System\MblksMw.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\suAAClh.exe
  C:\Windows\System\suAAClh.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\yGimpUd.exe
  C:\Windows\System\yGimpUd.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\IwPEODI.exe
  C:\Windows\System\IwPEODI.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\qMMvhZY.exe
  C:\Windows\System\qMMvhZY.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\UpPtPcR.exe
  C:\Windows\System\UpPtPcR.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\wjQSlHv.exe
  C:\Windows\System\wjQSlHv.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\VtvMqEN.exe
  C:\Windows\System\VtvMqEN.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\FLPgVGo.exe
  C:\Windows\System\FLPgVGo.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\CFtATPY.exe
  C:\Windows\System\CFtATPY.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\MXCInIt.exe
  C:\Windows\System\MXCInIt.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\POOFbId.exe
  C:\Windows\System\POOFbId.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\eTYhNdb.exe
  C:\Windows\System\eTYhNdb.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\ofMYRxu.exe
  C:\Windows\System\ofMYRxu.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\BfZoqiB.exe
  C:\Windows\System\BfZoqiB.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\yoolujw.exe
  C:\Windows\System\yoolujw.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\qZtUVHd.exe
  C:\Windows\System\qZtUVHd.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\XgYOiIi.exe
  C:\Windows\System\XgYOiIi.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\NIIJSZf.exe
  C:\Windows\System\NIIJSZf.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\XlVWGEt.exe
  C:\Windows\System\XlVWGEt.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\TFheXsn.exe
  C:\Windows\System\TFheXsn.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\RqIVeJm.exe
  C:\Windows\System\RqIVeJm.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\rbiZBnJ.exe
  C:\Windows\System\rbiZBnJ.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\XxpzZpp.exe
  C:\Windows\System\XxpzZpp.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\fMDSvZa.exe
  C:\Windows\System\fMDSvZa.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\ozGWqhS.exe
  C:\Windows\System\ozGWqhS.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\ndkgYIO.exe
  C:\Windows\System\ndkgYIO.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\BNzByPp.exe
  C:\Windows\System\BNzByPp.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\bVmFBKx.exe
  C:\Windows\System\bVmFBKx.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\zEQWIWM.exe
  C:\Windows\System\zEQWIWM.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\mauVJMN.exe
  C:\Windows\System\mauVJMN.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\THDtjKF.exe
  C:\Windows\System\THDtjKF.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\KvAWkzT.exe
  C:\Windows\System\KvAWkzT.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\FkLGIRN.exe
  C:\Windows\System\FkLGIRN.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\UvmAEMD.exe
  C:\Windows\System\UvmAEMD.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\LSQLkKG.exe
  C:\Windows\System\LSQLkKG.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\iBFzyvB.exe
  C:\Windows\System\iBFzyvB.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\PavFvNF.exe
  C:\Windows\System\PavFvNF.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\MylLxBk.exe
  C:\Windows\System\MylLxBk.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\xTsyBoA.exe
  C:\Windows\System\xTsyBoA.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\YbEBguj.exe
  C:\Windows\System\YbEBguj.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\hoVScwu.exe
  C:\Windows\System\hoVScwu.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\XXQkRQM.exe
  C:\Windows\System\XXQkRQM.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\cxHNskt.exe
  C:\Windows\System\cxHNskt.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\QVsYUnm.exe
  C:\Windows\System\QVsYUnm.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\mXXVSWg.exe
  C:\Windows\System\mXXVSWg.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\eIDNGKQ.exe
  C:\Windows\System\eIDNGKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\mHqqjSw.exe
  C:\Windows\System\mHqqjSw.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\kfzedUR.exe
  C:\Windows\System\kfzedUR.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\eflVfwW.exe
  C:\Windows\System\eflVfwW.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\dkvyLPq.exe
  C:\Windows\System\dkvyLPq.exe
  2⤵
  PID:380
- C:\Windows\System\MBuJmUW.exe
  C:\Windows\System\MBuJmUW.exe
  2⤵
  PID:2348
- C:\Windows\System\tYXhyyO.exe
  C:\Windows\System\tYXhyyO.exe
  2⤵
  PID:4676
- C:\Windows\System\NJyzrmK.exe
  C:\Windows\System\NJyzrmK.exe
  2⤵
  PID:8
- C:\Windows\System\bcOMsGs.exe
  C:\Windows\System\bcOMsGs.exe
  2⤵
  PID:2632
- C:\Windows\System\EWlLWvF.exe
  C:\Windows\System\EWlLWvF.exe
  2⤵
  PID:4976
- C:\Windows\System\AeHEwuL.exe
  C:\Windows\System\AeHEwuL.exe
  2⤵
  PID:3828
- C:\Windows\System\ySdxzOW.exe
  C:\Windows\System\ySdxzOW.exe
  2⤵
  PID:560
- C:\Windows\System\kfiskNL.exe
  C:\Windows\System\kfiskNL.exe
  2⤵
  PID:3992
- C:\Windows\System\VtGHCfW.exe
  C:\Windows\System\VtGHCfW.exe
  2⤵
  PID:1664
- C:\Windows\System\tuigdif.exe
  C:\Windows\System\tuigdif.exe
  2⤵
  PID:2868
- C:\Windows\System\aItRdOq.exe
  C:\Windows\System\aItRdOq.exe
  2⤵
  PID:2448
- C:\Windows\System\pheVwho.exe
  C:\Windows\System\pheVwho.exe
  2⤵
  PID:1912
- C:\Windows\System\rVrwhHg.exe
  C:\Windows\System\rVrwhHg.exe
  2⤵
  PID:744
- C:\Windows\System\AKoYkMy.exe
  C:\Windows\System\AKoYkMy.exe
  2⤵
  PID:4844
- C:\Windows\System\BmRaHpI.exe
  C:\Windows\System\BmRaHpI.exe
  2⤵
  PID:3688
- C:\Windows\System\vfSzHEI.exe
  C:\Windows\System\vfSzHEI.exe
  2⤵
  PID:2640
- C:\Windows\System\iuoScBA.exe
  C:\Windows\System\iuoScBA.exe
  2⤵
  PID:4320
- C:\Windows\System\AgLbFwG.exe
  C:\Windows\System\AgLbFwG.exe
  2⤵
  PID:3292
- C:\Windows\System\LiXHwWK.exe
  C:\Windows\System\LiXHwWK.exe
  2⤵
  PID:4208
- C:\Windows\System\cOJecKJ.exe
  C:\Windows\System\cOJecKJ.exe
  2⤵
  PID:5144
- C:\Windows\System\dEUdRqq.exe
  C:\Windows\System\dEUdRqq.exe
  2⤵
  PID:5172
- C:\Windows\System\DZYKDrN.exe
  C:\Windows\System\DZYKDrN.exe
  2⤵
  PID:5196
- C:\Windows\System\jOPlwHe.exe
  C:\Windows\System\jOPlwHe.exe
  2⤵
  PID:5224
- C:\Windows\System\XzHGoTH.exe
  C:\Windows\System\XzHGoTH.exe
  2⤵
  PID:5252
- C:\Windows\System\vqqSTgr.exe
  C:\Windows\System\vqqSTgr.exe
  2⤵
  PID:5280
- C:\Windows\System\pfKpXEZ.exe
  C:\Windows\System\pfKpXEZ.exe
  2⤵
  PID:5308
- C:\Windows\System\AWAhXPp.exe
  C:\Windows\System\AWAhXPp.exe
  2⤵
  PID:5336
- C:\Windows\System\wfNxLOI.exe
  C:\Windows\System\wfNxLOI.exe
  2⤵
  PID:5364
- C:\Windows\System\zWFuGzo.exe
  C:\Windows\System\zWFuGzo.exe
  2⤵
  PID:5392
- C:\Windows\System\tSeAVYq.exe
  C:\Windows\System\tSeAVYq.exe
  2⤵
  PID:5424
- C:\Windows\System\jozxLVL.exe
  C:\Windows\System\jozxLVL.exe
  2⤵
  PID:5448
- C:\Windows\System\MxQdrUD.exe
  C:\Windows\System\MxQdrUD.exe
  2⤵
  PID:5480
- C:\Windows\System\blGxOiD.exe
  C:\Windows\System\blGxOiD.exe
  2⤵
  PID:5508
- C:\Windows\System\tOTxglk.exe
  C:\Windows\System\tOTxglk.exe
  2⤵
  PID:5532
- C:\Windows\System\LRjQPXN.exe
  C:\Windows\System\LRjQPXN.exe
  2⤵
  PID:5560
- C:\Windows\System\csSUCKz.exe
  C:\Windows\System\csSUCKz.exe
  2⤵
  PID:5592
- C:\Windows\System\QweqCZs.exe
  C:\Windows\System\QweqCZs.exe
  2⤵
  PID:5620
- C:\Windows\System\zvlTkmF.exe
  C:\Windows\System\zvlTkmF.exe
  2⤵
  PID:5644
- C:\Windows\System\myVgyCW.exe
  C:\Windows\System\myVgyCW.exe
  2⤵
  PID:5672
- C:\Windows\System\wqKpHub.exe
  C:\Windows\System\wqKpHub.exe
  2⤵
  PID:5704
- C:\Windows\System\sRhLORm.exe
  C:\Windows\System\sRhLORm.exe
  2⤵
  PID:5752
- C:\Windows\System\hBGbjbG.exe
  C:\Windows\System\hBGbjbG.exe
  2⤵
  PID:5780
- C:\Windows\System\mEHCIIp.exe
  C:\Windows\System\mEHCIIp.exe
  2⤵
  PID:5796
- C:\Windows\System\fNjaBgu.exe
  C:\Windows\System\fNjaBgu.exe
  2⤵
  PID:5820
- C:\Windows\System\aJxgSsf.exe
  C:\Windows\System\aJxgSsf.exe
  2⤵
  PID:5848
- C:\Windows\System\rBzXaCd.exe
  C:\Windows\System\rBzXaCd.exe
  2⤵
  PID:5868
- C:\Windows\System\hFawebH.exe
  C:\Windows\System\hFawebH.exe
  2⤵
  PID:5892
- C:\Windows\System\mqFDYaG.exe
  C:\Windows\System\mqFDYaG.exe
  2⤵
  PID:5924
- C:\Windows\System\KSstRQk.exe
  C:\Windows\System\KSstRQk.exe
  2⤵
  PID:5948
- C:\Windows\System\uYIzZNn.exe
  C:\Windows\System\uYIzZNn.exe
  2⤵
  PID:5976
- C:\Windows\System\zlHjptq.exe
  C:\Windows\System\zlHjptq.exe
  2⤵
  PID:6008
- C:\Windows\System\USkktux.exe
  C:\Windows\System\USkktux.exe
  2⤵
  PID:6036
- C:\Windows\System\asIZWwB.exe
  C:\Windows\System\asIZWwB.exe
  2⤵
  PID:6068
- C:\Windows\System\hxOgSYn.exe
  C:\Windows\System\hxOgSYn.exe
  2⤵
  PID:6092
- C:\Windows\System\cAjGQMV.exe
  C:\Windows\System\cAjGQMV.exe
  2⤵
  PID:6120
- C:\Windows\System\kPemJos.exe
  C:\Windows\System\kPemJos.exe
  2⤵
  PID:2524
- C:\Windows\System\LKhDhxm.exe
  C:\Windows\System\LKhDhxm.exe
  2⤵
  PID:4848
- C:\Windows\System\qyflWnY.exe
  C:\Windows\System\qyflWnY.exe
  2⤵
  PID:2472
- C:\Windows\System\ZClafAW.exe
  C:\Windows\System\ZClafAW.exe
  2⤵
  PID:5124
- C:\Windows\System\GUEEeqp.exe
  C:\Windows\System\GUEEeqp.exe
  2⤵
  PID:5264
- C:\Windows\System\ZUQPvaZ.exe
  C:\Windows\System\ZUQPvaZ.exe
  2⤵
  PID:5324
- C:\Windows\System\pqgkjPW.exe
  C:\Windows\System\pqgkjPW.exe
  2⤵
  PID:5404
- C:\Windows\System\FzqhpPa.exe
  C:\Windows\System\FzqhpPa.exe
  2⤵
  PID:5444
- C:\Windows\System\hqDbaQC.exe
  C:\Windows\System\hqDbaQC.exe
  2⤵
  PID:5516
- C:\Windows\System\qEgzGme.exe
  C:\Windows\System\qEgzGme.exe
  2⤵
  PID:5576
- C:\Windows\System\wDlzmvl.exe
  C:\Windows\System\wDlzmvl.exe
  2⤵
  PID:5612
- C:\Windows\System\YyAwBTW.exe
  C:\Windows\System\YyAwBTW.exe
  2⤵
  PID:2940
- C:\Windows\System\gdsIyrF.exe
  C:\Windows\System\gdsIyrF.exe
  2⤵
  PID:5732
- C:\Windows\System\rWWopmc.exe
  C:\Windows\System\rWWopmc.exe
  2⤵
  PID:5788
- C:\Windows\System\kojhRQZ.exe
  C:\Windows\System\kojhRQZ.exe
  2⤵
  PID:5844
- C:\Windows\System\jExemuv.exe
  C:\Windows\System\jExemuv.exe
  2⤵
  PID:5888
- C:\Windows\System\cIyyfky.exe
  C:\Windows\System\cIyyfky.exe
  2⤵
  PID:4816
- C:\Windows\System\PuSuCqm.exe
  C:\Windows\System\PuSuCqm.exe
  2⤵
  PID:5996
- C:\Windows\System\POnjHUs.exe
  C:\Windows\System\POnjHUs.exe
  2⤵
  PID:428
- C:\Windows\System\vDZFeIV.exe
  C:\Windows\System\vDZFeIV.exe
  2⤵
  PID:3476
- C:\Windows\System\fnzZOxq.exe
  C:\Windows\System\fnzZOxq.exe
  2⤵
  PID:1040
- C:\Windows\System\hfzUAas.exe
  C:\Windows\System\hfzUAas.exe
  2⤵
  PID:5348
- C:\Windows\System\yltLwdU.exe
  C:\Windows\System\yltLwdU.exe
  2⤵
  PID:5412
- C:\Windows\System\WImZyPd.exe
  C:\Windows\System\WImZyPd.exe
  2⤵
  PID:5660
- C:\Windows\System\mLYYOxD.exe
  C:\Windows\System\mLYYOxD.exe
  2⤵
  PID:4852
- C:\Windows\System\IIhLTGs.exe
  C:\Windows\System\IIhLTGs.exe
  2⤵
  PID:5688
- C:\Windows\System\xVeijqW.exe
  C:\Windows\System\xVeijqW.exe
  2⤵
  PID:5608
- C:\Windows\System\ojiTENG.exe
  C:\Windows\System\ojiTENG.exe
  2⤵
  PID:2228
- C:\Windows\System\IDaghkN.exe
  C:\Windows\System\IDaghkN.exe
  2⤵
  PID:336
- C:\Windows\System\zGQSgwE.exe
  C:\Windows\System\zGQSgwE.exe
  2⤵
  PID:5884
- C:\Windows\System\LmnlNuT.exe
  C:\Windows\System\LmnlNuT.exe
  2⤵
  PID:5992
- C:\Windows\System\DsOJLWL.exe
  C:\Windows\System\DsOJLWL.exe
  2⤵
  PID:3716
- C:\Windows\System\frDkMvO.exe
  C:\Windows\System\frDkMvO.exe
  2⤵
  PID:5384
- C:\Windows\System\mMyZZfn.exe
  C:\Windows\System\mMyZZfn.exe
  2⤵
  PID:5808
- C:\Windows\System\nhQsCxe.exe
  C:\Windows\System\nhQsCxe.exe
  2⤵
  PID:5972
- C:\Windows\System\eowTwKV.exe
  C:\Windows\System\eowTwKV.exe
  2⤵
  PID:2828
- C:\Windows\System\iFazrtq.exe
  C:\Windows\System\iFazrtq.exe
  2⤵
  PID:3456
- C:\Windows\System\FKtGJXo.exe
  C:\Windows\System\FKtGJXo.exe
  2⤵
  PID:3280
- C:\Windows\System\CPzLwuw.exe
  C:\Windows\System\CPzLwuw.exe
  2⤵
  PID:1144
- C:\Windows\System\CACqlOj.exe
  C:\Windows\System\CACqlOj.exe
  2⤵
  PID:6148
- C:\Windows\System\IpbATzo.exe
  C:\Windows\System\IpbATzo.exe
  2⤵
  PID:6180
- C:\Windows\System\zmsOcEI.exe
  C:\Windows\System\zmsOcEI.exe
  2⤵
  PID:6208
- C:\Windows\System\GvdnnGg.exe
  C:\Windows\System\GvdnnGg.exe
  2⤵
  PID:6240
- C:\Windows\System\LEUXTuR.exe
  C:\Windows\System\LEUXTuR.exe
  2⤵
  PID:6264
- C:\Windows\System\FRLtYQY.exe
  C:\Windows\System\FRLtYQY.exe
  2⤵
  PID:6292
- C:\Windows\System\vyTBPCX.exe
  C:\Windows\System\vyTBPCX.exe
  2⤵
  PID:6332
- C:\Windows\System\ldytJAd.exe
  C:\Windows\System\ldytJAd.exe
  2⤵
  PID:6348
- C:\Windows\System\ZzlQTFM.exe
  C:\Windows\System\ZzlQTFM.exe
  2⤵
  PID:6376
- C:\Windows\System\jLsuKaA.exe
  C:\Windows\System\jLsuKaA.exe
  2⤵
  PID:6396
- C:\Windows\System\aaDTfut.exe
  C:\Windows\System\aaDTfut.exe
  2⤵
  PID:6416
- C:\Windows\System\umOnuCe.exe
  C:\Windows\System\umOnuCe.exe
  2⤵
  PID:6436
- C:\Windows\System\WbsKRWr.exe
  C:\Windows\System\WbsKRWr.exe
  2⤵
  PID:6468
- C:\Windows\System\fFxdzYu.exe
  C:\Windows\System\fFxdzYu.exe
  2⤵
  PID:6496
- C:\Windows\System\bezgFkF.exe
  C:\Windows\System\bezgFkF.exe
  2⤵
  PID:6524
- C:\Windows\System\axkJfCQ.exe
  C:\Windows\System\axkJfCQ.exe
  2⤵
  PID:6572
- C:\Windows\System\KLiZOzT.exe
  C:\Windows\System\KLiZOzT.exe
  2⤵
  PID:6600
- C:\Windows\System\SbTjwGF.exe
  C:\Windows\System\SbTjwGF.exe
  2⤵
  PID:6620
- C:\Windows\System\WMNhLsE.exe
  C:\Windows\System\WMNhLsE.exe
  2⤵
  PID:6644
- C:\Windows\System\pswRyvB.exe
  C:\Windows\System\pswRyvB.exe
  2⤵
  PID:6664
- C:\Windows\System\JMtIzKL.exe
  C:\Windows\System\JMtIzKL.exe
  2⤵
  PID:6684
- C:\Windows\System\MwvrCFk.exe
  C:\Windows\System\MwvrCFk.exe
  2⤵
  PID:6708
- C:\Windows\System\RvjTfdI.exe
  C:\Windows\System\RvjTfdI.exe
  2⤵
  PID:6748
- C:\Windows\System\oxrbwUb.exe
  C:\Windows\System\oxrbwUb.exe
  2⤵
  PID:6808
- C:\Windows\System\qpqhNqX.exe
  C:\Windows\System\qpqhNqX.exe
  2⤵
  PID:6832
- C:\Windows\System\TjfIJkZ.exe
  C:\Windows\System\TjfIJkZ.exe
  2⤵
  PID:6852
- C:\Windows\System\aUQjvey.exe
  C:\Windows\System\aUQjvey.exe
  2⤵
  PID:6888
- C:\Windows\System\QswBzqI.exe
  C:\Windows\System\QswBzqI.exe
  2⤵
  PID:6916
- C:\Windows\System\OnuHJUM.exe
  C:\Windows\System\OnuHJUM.exe
  2⤵
  PID:6944
- C:\Windows\System\qoNmoUs.exe
  C:\Windows\System\qoNmoUs.exe
  2⤵
  PID:6976
- C:\Windows\System\PAhoaHo.exe
  C:\Windows\System\PAhoaHo.exe
  2⤵
  PID:7000
- C:\Windows\System\vBTygbM.exe
  C:\Windows\System\vBTygbM.exe
  2⤵
  PID:7068
- C:\Windows\System\tYcvYtp.exe
  C:\Windows\System\tYcvYtp.exe
  2⤵
  PID:7096
- C:\Windows\System\acdQYiH.exe
  C:\Windows\System\acdQYiH.exe
  2⤵
  PID:7116
- C:\Windows\System\LbzjGfs.exe
  C:\Windows\System\LbzjGfs.exe
  2⤵
  PID:7152
- C:\Windows\System\XLnMjIO.exe
  C:\Windows\System\XLnMjIO.exe
  2⤵
  PID:6176
- C:\Windows\System\pfJNPBG.exe
  C:\Windows\System\pfJNPBG.exe
  2⤵
  PID:6248
- C:\Windows\System\pQMbtON.exe
  C:\Windows\System\pQMbtON.exe
  2⤵
  PID:6308
- C:\Windows\System\HyVhQtL.exe
  C:\Windows\System\HyVhQtL.exe
  2⤵
  PID:6412
- C:\Windows\System\VWhLWff.exe
  C:\Windows\System\VWhLWff.exe
  2⤵
  PID:6476
- C:\Windows\System\LLNtSlP.exe
  C:\Windows\System\LLNtSlP.exe
  2⤵
  PID:6560
- C:\Windows\System\uAITOUZ.exe
  C:\Windows\System\uAITOUZ.exe
  2⤵
  PID:6616
- C:\Windows\System\NXbzYIB.exe
  C:\Windows\System\NXbzYIB.exe
  2⤵
  PID:6676
- C:\Windows\System\cnKwfJj.exe
  C:\Windows\System\cnKwfJj.exe
  2⤵
  PID:6732
- C:\Windows\System\CurymXV.exe
  C:\Windows\System\CurymXV.exe
  2⤵
  PID:6828
- C:\Windows\System\NadjTgr.exe
  C:\Windows\System\NadjTgr.exe
  2⤵
  PID:6900
- C:\Windows\System\FIRMWyh.exe
  C:\Windows\System\FIRMWyh.exe
  2⤵
  PID:6968
- C:\Windows\System\tPhHPEH.exe
  C:\Windows\System\tPhHPEH.exe
  2⤵
  PID:320
- C:\Windows\System\SuAPvFt.exe
  C:\Windows\System\SuAPvFt.exe
  2⤵
  PID:7092
- C:\Windows\System\yeZCUDv.exe
  C:\Windows\System\yeZCUDv.exe
  2⤵
  PID:3028
- C:\Windows\System\RYeGoqN.exe
  C:\Windows\System\RYeGoqN.exe
  2⤵
  PID:6284
- C:\Windows\System\RHCDbsU.exe
  C:\Windows\System\RHCDbsU.exe
  2⤵
  PID:6480
- C:\Windows\System\arTmoRo.exe
  C:\Windows\System\arTmoRo.exe
  2⤵
  PID:6632
- C:\Windows\System\ghvAIZP.exe
  C:\Windows\System\ghvAIZP.exe
  2⤵
  PID:6800
- C:\Windows\System\KDWufAf.exe
  C:\Windows\System\KDWufAf.exe
  2⤵
  PID:6964
- C:\Windows\System\IWNECCO.exe
  C:\Windows\System\IWNECCO.exe
  2⤵
  PID:7088
- C:\Windows\System\zoFznsm.exe
  C:\Windows\System\zoFznsm.exe
  2⤵
  PID:6424
- C:\Windows\System\NiVmEcR.exe
  C:\Windows\System\NiVmEcR.exe
  2⤵
  PID:6764
- C:\Windows\System\xnLlcFj.exe
  C:\Windows\System\xnLlcFj.exe
  2⤵
  PID:5724
- C:\Windows\System\dTncTii.exe
  C:\Windows\System\dTncTii.exe
  2⤵
  PID:7064
- C:\Windows\System\xtyYdzB.exe
  C:\Windows\System\xtyYdzB.exe
  2⤵
  PID:7188
- C:\Windows\System\AIjITjP.exe
  C:\Windows\System\AIjITjP.exe
  2⤵
  PID:7212
- C:\Windows\System\hmLTVlF.exe
  C:\Windows\System\hmLTVlF.exe
  2⤵
  PID:7252
- C:\Windows\System\RvWbDsy.exe
  C:\Windows\System\RvWbDsy.exe
  2⤵
  PID:7280
- C:\Windows\System\FWrZRtx.exe
  C:\Windows\System\FWrZRtx.exe
  2⤵
  PID:7308
- C:\Windows\System\WLJIXrx.exe
  C:\Windows\System\WLJIXrx.exe
  2⤵
  PID:7336
- C:\Windows\System\CEzlkEz.exe
  C:\Windows\System\CEzlkEz.exe
  2⤵
  PID:7364
- C:\Windows\System\yNcKXiK.exe
  C:\Windows\System\yNcKXiK.exe
  2⤵
  PID:7396
- C:\Windows\System\BegmOjG.exe
  C:\Windows\System\BegmOjG.exe
  2⤵
  PID:7432
- C:\Windows\System\SIhVsBL.exe
  C:\Windows\System\SIhVsBL.exe
  2⤵
  PID:7460
- C:\Windows\System\MOmkksK.exe
  C:\Windows\System\MOmkksK.exe
  2⤵
  PID:7496
- C:\Windows\System\lOBrVbG.exe
  C:\Windows\System\lOBrVbG.exe
  2⤵
  PID:7540
- C:\Windows\System\PRxKqQV.exe
  C:\Windows\System\PRxKqQV.exe
  2⤵
  PID:7560
- C:\Windows\System\TmHDZeZ.exe
  C:\Windows\System\TmHDZeZ.exe
  2⤵
  PID:7588
- C:\Windows\System\oEuellD.exe
  C:\Windows\System\oEuellD.exe
  2⤵
  PID:7616
- C:\Windows\System\TIzViht.exe
  C:\Windows\System\TIzViht.exe
  2⤵
  PID:7644
- C:\Windows\System\EVDvFWR.exe
  C:\Windows\System\EVDvFWR.exe
  2⤵
  PID:7712
- C:\Windows\System\LCgaumA.exe
  C:\Windows\System\LCgaumA.exe
  2⤵
  PID:7748
- C:\Windows\System\BXnIDJA.exe
  C:\Windows\System\BXnIDJA.exe
  2⤵
  PID:7788
- C:\Windows\System\utDzgjX.exe
  C:\Windows\System\utDzgjX.exe
  2⤵
  PID:7820
- C:\Windows\System\Wqmovei.exe
  C:\Windows\System\Wqmovei.exe
  2⤵
  PID:7856
- C:\Windows\System\zQvGQqO.exe
  C:\Windows\System\zQvGQqO.exe
  2⤵
  PID:7876
- C:\Windows\System\tODmfzf.exe
  C:\Windows\System\tODmfzf.exe
  2⤵
  PID:7916
- C:\Windows\System\jQMpxEd.exe
  C:\Windows\System\jQMpxEd.exe
  2⤵
  PID:7944
- C:\Windows\System\YORNFdV.exe
  C:\Windows\System\YORNFdV.exe
  2⤵
  PID:7976
- C:\Windows\System\buzApUi.exe
  C:\Windows\System\buzApUi.exe
  2⤵
  PID:8004
- C:\Windows\System\BuZvQcW.exe
  C:\Windows\System\BuZvQcW.exe
  2⤵
  PID:8036
- C:\Windows\System\QJCqZoA.exe
  C:\Windows\System\QJCqZoA.exe
  2⤵
  PID:8064
- C:\Windows\System\AfimBck.exe
  C:\Windows\System\AfimBck.exe
  2⤵
  PID:8092
- C:\Windows\System\gdzupGX.exe
  C:\Windows\System\gdzupGX.exe
  2⤵
  PID:8124
- C:\Windows\System\pgbxbBl.exe
  C:\Windows\System\pgbxbBl.exe
  2⤵
  PID:8152
- C:\Windows\System\yzNupJj.exe
  C:\Windows\System\yzNupJj.exe
  2⤵
  PID:6680
- C:\Windows\System\kkVdxVe.exe
  C:\Windows\System\kkVdxVe.exe
  2⤵
  PID:7196
- C:\Windows\System\uqSpsie.exe
  C:\Windows\System\uqSpsie.exe
  2⤵
  PID:7236
- C:\Windows\System\toJQlVD.exe
  C:\Windows\System\toJQlVD.exe
  2⤵
  PID:2316
- C:\Windows\System\imGXpde.exe
  C:\Windows\System\imGXpde.exe
  2⤵
  PID:7424
- C:\Windows\System\YeqApiL.exe
  C:\Windows\System\YeqApiL.exe
  2⤵
  PID:7456
- C:\Windows\System\NYCWaBZ.exe
  C:\Windows\System\NYCWaBZ.exe
  2⤵
  PID:7524
- C:\Windows\System\IQSlVnt.exe
  C:\Windows\System\IQSlVnt.exe
  2⤵
  PID:7640
- C:\Windows\System\RwfCyPd.exe
  C:\Windows\System\RwfCyPd.exe
  2⤵
  PID:7684
- C:\Windows\System\oqBitsf.exe
  C:\Windows\System\oqBitsf.exe
  2⤵
  PID:7852
- C:\Windows\System\xTwvFFn.exe
  C:\Windows\System\xTwvFFn.exe
  2⤵
  PID:7900
- C:\Windows\System\YQHaqmr.exe
  C:\Windows\System\YQHaqmr.exe
  2⤵
  PID:8056
- C:\Windows\System\veixCmn.exe
  C:\Windows\System\veixCmn.exe
  2⤵
  PID:8104
- C:\Windows\System\LPyfjjN.exe
  C:\Windows\System\LPyfjjN.exe
  2⤵
  PID:8148
- C:\Windows\System\dzhIARM.exe
  C:\Windows\System\dzhIARM.exe
  2⤵
  PID:7708
- C:\Windows\System\zelXrKO.exe
  C:\Windows\System\zelXrKO.exe
  2⤵
  PID:7224
- C:\Windows\System\EKFLkuY.exe
  C:\Windows\System\EKFLkuY.exe
  2⤵
  PID:7384
- C:\Windows\System\jXcWZjK.exe
  C:\Windows\System\jXcWZjK.exe
  2⤵
  PID:7608
- C:\Windows\System\TuojdzD.exe
  C:\Windows\System\TuojdzD.exe
  2⤵
  PID:7816
- C:\Windows\System\OYWoAkO.exe
  C:\Windows\System\OYWoAkO.exe
  2⤵
  PID:8060
- C:\Windows\System\rZYLeLP.exe
  C:\Windows\System\rZYLeLP.exe
  2⤵
  PID:8136
- C:\Windows\System\muzvROr.exe
  C:\Windows\System\muzvROr.exe
  2⤵
  PID:6928
- C:\Windows\System\oAdPabo.exe
  C:\Windows\System\oAdPabo.exe
  2⤵
  PID:7492
- C:\Windows\System\aWZPbxS.exe
  C:\Windows\System\aWZPbxS.exe
  2⤵
  PID:7956
- C:\Windows\System\KXWiAge.exe
  C:\Windows\System\KXWiAge.exe
  2⤵
  PID:7320
- C:\Windows\System\uzDdDOC.exe
  C:\Windows\System\uzDdDOC.exe
  2⤵
  PID:8216
- C:\Windows\System\DLhqcSs.exe
  C:\Windows\System\DLhqcSs.exe
  2⤵
  PID:8256
- C:\Windows\System\gXHEtli.exe
  C:\Windows\System\gXHEtli.exe
  2⤵
  PID:8284
- C:\Windows\System\LCxvUbV.exe
  C:\Windows\System\LCxvUbV.exe
  2⤵
  PID:8300
- C:\Windows\System\rIhuNtY.exe
  C:\Windows\System\rIhuNtY.exe
  2⤵
  PID:8328
- C:\Windows\System\sIdtnKl.exe
  C:\Windows\System\sIdtnKl.exe
  2⤵
  PID:8356
- C:\Windows\System\nHBIkad.exe
  C:\Windows\System\nHBIkad.exe
  2⤵
  PID:8396
- C:\Windows\System\vXuTyiU.exe
  C:\Windows\System\vXuTyiU.exe
  2⤵
  PID:8424
- C:\Windows\System\apXWOMO.exe
  C:\Windows\System\apXWOMO.exe
  2⤵
  PID:8452
- C:\Windows\System\RpNOGse.exe
  C:\Windows\System\RpNOGse.exe
  2⤵
  PID:8480
- C:\Windows\System\DpUcMra.exe
  C:\Windows\System\DpUcMra.exe
  2⤵
  PID:8512
- C:\Windows\System\eavXmAY.exe
  C:\Windows\System\eavXmAY.exe
  2⤵
  PID:8540
- C:\Windows\System\sJPnLgS.exe
  C:\Windows\System\sJPnLgS.exe
  2⤵
  PID:8568
- C:\Windows\System\xypLLRH.exe
  C:\Windows\System\xypLLRH.exe
  2⤵
  PID:8596
- C:\Windows\System\tPeDBcF.exe
  C:\Windows\System\tPeDBcF.exe
  2⤵
  PID:8624
- C:\Windows\System\rFgspaH.exe
  C:\Windows\System\rFgspaH.exe
  2⤵
  PID:8652
- C:\Windows\System\RzHJSQD.exe
  C:\Windows\System\RzHJSQD.exe
  2⤵
  PID:8680
- C:\Windows\System\ecnDRhF.exe
  C:\Windows\System\ecnDRhF.exe
  2⤵
  PID:8704
- C:\Windows\System\TfnfMzr.exe
  C:\Windows\System\TfnfMzr.exe
  2⤵
  PID:8736
- C:\Windows\System\DGDNZMc.exe
  C:\Windows\System\DGDNZMc.exe
  2⤵
  PID:8764
- C:\Windows\System\ELyHSed.exe
  C:\Windows\System\ELyHSed.exe
  2⤵
  PID:8792
- C:\Windows\System\RVaxIDr.exe
  C:\Windows\System\RVaxIDr.exe
  2⤵
  PID:8808
- C:\Windows\System\tUOSxAs.exe
  C:\Windows\System\tUOSxAs.exe
  2⤵
  PID:8824
- C:\Windows\System\TrQNEvC.exe
  C:\Windows\System\TrQNEvC.exe
  2⤵
  PID:8848
- C:\Windows\System\wOCoAvc.exe
  C:\Windows\System\wOCoAvc.exe
  2⤵
  PID:8864
- C:\Windows\System\ahPpTMh.exe
  C:\Windows\System\ahPpTMh.exe
  2⤵
  PID:8896
- C:\Windows\System\FWZMtjM.exe
  C:\Windows\System\FWZMtjM.exe
  2⤵
  PID:8924
- C:\Windows\System\sjFQRVD.exe
  C:\Windows\System\sjFQRVD.exe
  2⤵
  PID:8948
- C:\Windows\System\aCbwChQ.exe
  C:\Windows\System\aCbwChQ.exe
  2⤵
  PID:8980
- C:\Windows\System\ysGScsb.exe
  C:\Windows\System\ysGScsb.exe
  2⤵
  PID:9032
- C:\Windows\System\XuyGhGh.exe
  C:\Windows\System\XuyGhGh.exe
  2⤵
  PID:9076
- C:\Windows\System\RWpfBUb.exe
  C:\Windows\System\RWpfBUb.exe
  2⤵
  PID:9092
- C:\Windows\System\dOdmyNP.exe
  C:\Windows\System\dOdmyNP.exe
  2⤵
  PID:9120
- C:\Windows\System\qFTHeeS.exe
  C:\Windows\System\qFTHeeS.exe
  2⤵
  PID:9136
- C:\Windows\System\vUVSIrW.exe
  C:\Windows\System\vUVSIrW.exe
  2⤵
  PID:9164
- C:\Windows\System\mMXJeyO.exe
  C:\Windows\System\mMXJeyO.exe
  2⤵
  PID:8176
- C:\Windows\System\ROuxiYj.exe
  C:\Windows\System\ROuxiYj.exe
  2⤵
  PID:5912
- C:\Windows\System\GSVxIdh.exe
  C:\Windows\System\GSVxIdh.exe
  2⤵
  PID:8296
- C:\Windows\System\rIbgEgG.exe
  C:\Windows\System\rIbgEgG.exe
  2⤵
  PID:8340
- C:\Windows\System\QMGasnl.exe
  C:\Windows\System\QMGasnl.exe
  2⤵
  PID:8420
- C:\Windows\System\UEvfGPR.exe
  C:\Windows\System\UEvfGPR.exe
  2⤵
  PID:8476
- C:\Windows\System\ttFfFKf.exe
  C:\Windows\System\ttFfFKf.exe
  2⤵
  PID:8500
- C:\Windows\System\WubNwYn.exe
  C:\Windows\System\WubNwYn.exe
  2⤵
  PID:8532
- C:\Windows\System\ArORGXB.exe
  C:\Windows\System\ArORGXB.exe
  2⤵
  PID:8644
- C:\Windows\System\OqFKDHo.exe
  C:\Windows\System\OqFKDHo.exe
  2⤵
  PID:8692
- C:\Windows\System\RwGMTxv.exe
  C:\Windows\System\RwGMTxv.exe
  2⤵
  PID:8760
- C:\Windows\System\UChKJvM.exe
  C:\Windows\System\UChKJvM.exe
  2⤵
  PID:8860
- C:\Windows\System\zObrTCD.exe
  C:\Windows\System\zObrTCD.exe
  2⤵
  PID:8912
- C:\Windows\System\oULgakx.exe
  C:\Windows\System\oULgakx.exe
  2⤵
  PID:8988
- C:\Windows\System\hYQyHrB.exe
  C:\Windows\System\hYQyHrB.exe
  2⤵
  PID:9056
- C:\Windows\System\IOYvgrg.exe
  C:\Windows\System\IOYvgrg.exe
  2⤵
  PID:9128
- C:\Windows\System\zqFEuLS.exe
  C:\Windows\System\zqFEuLS.exe
  2⤵
  PID:8204
- C:\Windows\System\uVvanRu.exe
  C:\Windows\System\uVvanRu.exe
  2⤵
  PID:8392
- C:\Windows\System\FNVpDLB.exe
  C:\Windows\System\FNVpDLB.exe
  2⤵
  PID:8524
- C:\Windows\System\MqXAQqe.exe
  C:\Windows\System\MqXAQqe.exe
  2⤵
  PID:3696
- C:\Windows\System\pGZsrhJ.exe
  C:\Windows\System\pGZsrhJ.exe
  2⤵
  PID:8856
- C:\Windows\System\xQITVFn.exe
  C:\Windows\System\xQITVFn.exe
  2⤵
  PID:9060
- C:\Windows\System\QLvBNMp.exe
  C:\Windows\System\QLvBNMp.exe
  2⤵
  PID:9184
- C:\Windows\System\oTabOic.exe
  C:\Windows\System\oTabOic.exe
  2⤵
  PID:7704
- C:\Windows\System\VNijxIX.exe
  C:\Windows\System\VNijxIX.exe
  2⤵
  PID:8784
- C:\Windows\System\yeuRciw.exe
  C:\Windows\System\yeuRciw.exe
  2⤵
  PID:9112
- C:\Windows\System\QGnhfDJ.exe
  C:\Windows\System\QGnhfDJ.exe
  2⤵
  PID:3984
- C:\Windows\System\CIbOAfd.exe
  C:\Windows\System\CIbOAfd.exe
  2⤵
  PID:8372
- C:\Windows\System\KfHrjXZ.exe
  C:\Windows\System\KfHrjXZ.exe
  2⤵
  PID:9236
- C:\Windows\System\IpaFewR.exe
  C:\Windows\System\IpaFewR.exe
  2⤵
  PID:9264
- C:\Windows\System\qXwONFs.exe
  C:\Windows\System\qXwONFs.exe
  2⤵
  PID:9292
- C:\Windows\System\mHmFDSi.exe
  C:\Windows\System\mHmFDSi.exe
  2⤵
  PID:9324
- C:\Windows\System\soYfIlR.exe
  C:\Windows\System\soYfIlR.exe
  2⤵
  PID:9360
- C:\Windows\System\OGFkBBd.exe
  C:\Windows\System\OGFkBBd.exe
  2⤵
  PID:9388
- C:\Windows\System\tlpXyhe.exe
  C:\Windows\System\tlpXyhe.exe
  2⤵
  PID:9416
- C:\Windows\System\RELRvPd.exe
  C:\Windows\System\RELRvPd.exe
  2⤵
  PID:9444
- C:\Windows\System\cUSzjKR.exe
  C:\Windows\System\cUSzjKR.exe
  2⤵
  PID:9472
- C:\Windows\System\JZWgePU.exe
  C:\Windows\System\JZWgePU.exe
  2⤵
  PID:9500
- C:\Windows\System\iegnuIE.exe
  C:\Windows\System\iegnuIE.exe
  2⤵
  PID:9528
- C:\Windows\System\avLRqDl.exe
  C:\Windows\System\avLRqDl.exe
  2⤵
  PID:9552
- C:\Windows\System\YITDJdw.exe
  C:\Windows\System\YITDJdw.exe
  2⤵
  PID:9584
- C:\Windows\System\nBduyaW.exe
  C:\Windows\System\nBduyaW.exe
  2⤵
  PID:9612
- C:\Windows\System\vLUTiAZ.exe
  C:\Windows\System\vLUTiAZ.exe
  2⤵
  PID:9640
- C:\Windows\System\bgeKIHK.exe
  C:\Windows\System\bgeKIHK.exe
  2⤵
  PID:9668
- C:\Windows\System\jWgrEIj.exe
  C:\Windows\System\jWgrEIj.exe
  2⤵
  PID:9696
- C:\Windows\System\mjsdFrF.exe
  C:\Windows\System\mjsdFrF.exe
  2⤵
  PID:9728
- C:\Windows\System\eimyMpK.exe
  C:\Windows\System\eimyMpK.exe
  2⤵
  PID:9756
- C:\Windows\System\zmHWEXg.exe
  C:\Windows\System\zmHWEXg.exe
  2⤵
  PID:9784
- C:\Windows\System\axsMBpu.exe
  C:\Windows\System\axsMBpu.exe
  2⤵
  PID:9812
- C:\Windows\System\NzQhETc.exe
  C:\Windows\System\NzQhETc.exe
  2⤵
  PID:9840
- C:\Windows\System\lbbCGeC.exe
  C:\Windows\System\lbbCGeC.exe
  2⤵
  PID:9868
- C:\Windows\System\yQKFvOf.exe
  C:\Windows\System\yQKFvOf.exe
  2⤵
  PID:9900
- C:\Windows\System\krTrIYJ.exe
  C:\Windows\System\krTrIYJ.exe
  2⤵
  PID:9924
- C:\Windows\System\JqyYnBM.exe
  C:\Windows\System\JqyYnBM.exe
  2⤵
  PID:9948
- C:\Windows\System\lcinCZB.exe
  C:\Windows\System\lcinCZB.exe
  2⤵
  PID:9980
- C:\Windows\System\bNSMaeA.exe
  C:\Windows\System\bNSMaeA.exe
  2⤵
  PID:10004
- C:\Windows\System\vJeKBBj.exe
  C:\Windows\System\vJeKBBj.exe
  2⤵
  PID:10044
- C:\Windows\System\BTArHbY.exe
  C:\Windows\System\BTArHbY.exe
  2⤵
  PID:10072
- C:\Windows\System\bbXBvrk.exe
  C:\Windows\System\bbXBvrk.exe
  2⤵
  PID:10108
- C:\Windows\System\mrZgUAl.exe
  C:\Windows\System\mrZgUAl.exe
  2⤵
  PID:10128
- C:\Windows\System\PpqPXTk.exe
  C:\Windows\System\PpqPXTk.exe
  2⤵
  PID:10160
- C:\Windows\System\UCbQzWe.exe
  C:\Windows\System\UCbQzWe.exe
  2⤵
  PID:10176
- C:\Windows\System\hKoQZDO.exe
  C:\Windows\System\hKoQZDO.exe
  2⤵
  PID:10200
- C:\Windows\System\OhDdfnC.exe
  C:\Windows\System\OhDdfnC.exe
  2⤵
  PID:9228
- C:\Windows\System\RiMITVg.exe
  C:\Windows\System\RiMITVg.exe
  2⤵
  PID:9280
- C:\Windows\System\iqPyUYt.exe
  C:\Windows\System\iqPyUYt.exe
  2⤵
  PID:9372
- C:\Windows\System\SXNLrts.exe
  C:\Windows\System\SXNLrts.exe
  2⤵
  PID:9344
- C:\Windows\System\JeUTIWu.exe
  C:\Windows\System\JeUTIWu.exe
  2⤵
  PID:9488
- C:\Windows\System\ZpdPSjh.exe
  C:\Windows\System\ZpdPSjh.exe
  2⤵
  PID:9544
- C:\Windows\System\mjXIKPp.exe
  C:\Windows\System\mjXIKPp.exe
  2⤵
  PID:9636
- C:\Windows\System\gMbngGu.exe
  C:\Windows\System\gMbngGu.exe
  2⤵
  PID:9688
- C:\Windows\System\EgUGCgr.exe
  C:\Windows\System\EgUGCgr.exe
  2⤵
  PID:9740
- C:\Windows\System\bOOXaXN.exe
  C:\Windows\System\bOOXaXN.exe
  2⤵
  PID:9776
- C:\Windows\System\ljNGTGj.exe
  C:\Windows\System\ljNGTGj.exe
  2⤵
  PID:9836
- C:\Windows\System\nTAhcSd.exe
  C:\Windows\System\nTAhcSd.exe
  2⤵
  PID:9892
- C:\Windows\System\IFyImxe.exe
  C:\Windows\System\IFyImxe.exe
  2⤵
  PID:10000
- C:\Windows\System\tBbCNgE.exe
  C:\Windows\System\tBbCNgE.exe
  2⤵
  PID:10064
- C:\Windows\System\yqDJbxv.exe
  C:\Windows\System\yqDJbxv.exe
  2⤵
  PID:10152
- C:\Windows\System\kulHPnw.exe
  C:\Windows\System\kulHPnw.exe
  2⤵
  PID:9220
- C:\Windows\System\ZCkYuaV.exe
  C:\Windows\System\ZCkYuaV.exe
  2⤵
  PID:9456
- C:\Windows\System\dxXaFpf.exe
  C:\Windows\System\dxXaFpf.exe
  2⤵
  PID:9752
- C:\Windows\System\pnJoQFa.exe
  C:\Windows\System\pnJoQFa.exe
  2⤵
  PID:9972
- C:\Windows\System\IqnvIuu.exe
  C:\Windows\System\IqnvIuu.exe
  2⤵
  PID:10036
- C:\Windows\System\lTRQXKg.exe
  C:\Windows\System\lTRQXKg.exe
  2⤵
  PID:4028
- C:\Windows\System\FGJHQEk.exe
  C:\Windows\System\FGJHQEk.exe
  2⤵
  PID:9724
- C:\Windows\System\NsKAMDN.exe
  C:\Windows\System\NsKAMDN.exe
  2⤵
  PID:10252
- C:\Windows\System\ZRjyWUm.exe
  C:\Windows\System\ZRjyWUm.exe
  2⤵
  PID:10284
- C:\Windows\System\NlxYzin.exe
  C:\Windows\System\NlxYzin.exe
  2⤵
  PID:10336
- C:\Windows\System\GoOrzyU.exe
  C:\Windows\System\GoOrzyU.exe
  2⤵
  PID:10380
- C:\Windows\System\dEaduKs.exe
  C:\Windows\System\dEaduKs.exe
  2⤵
  PID:10412
- C:\Windows\System\hKQTgRr.exe
  C:\Windows\System\hKQTgRr.exe
  2⤵
  PID:10432
- C:\Windows\System\yLXfqML.exe
  C:\Windows\System\yLXfqML.exe
  2⤵
  PID:10460
- C:\Windows\System\KBdOguM.exe
  C:\Windows\System\KBdOguM.exe
  2⤵
  PID:10488
- C:\Windows\System\DqLIZoQ.exe
  C:\Windows\System\DqLIZoQ.exe
  2⤵
  PID:10512
- C:\Windows\System\EMDJlEv.exe
  C:\Windows\System\EMDJlEv.exe
  2⤵
  PID:10552
- C:\Windows\System\rdQGgee.exe
  C:\Windows\System\rdQGgee.exe
  2⤵
  PID:10584
- C:\Windows\System\KCSSBYS.exe
  C:\Windows\System\KCSSBYS.exe
  2⤵
  PID:10616
- C:\Windows\System\ZZqkbJE.exe
  C:\Windows\System\ZZqkbJE.exe
  2⤵
  PID:10644
- C:\Windows\System\stLixav.exe
  C:\Windows\System\stLixav.exe
  2⤵
  PID:10672
- C:\Windows\System\HyycHeN.exe
  C:\Windows\System\HyycHeN.exe
  2⤵
  PID:10708
- C:\Windows\System\JOCylAt.exe
  C:\Windows\System\JOCylAt.exe
  2⤵
  PID:10752
- C:\Windows\System\dHAJuPe.exe
  C:\Windows\System\dHAJuPe.exe
  2⤵
  PID:10784
- C:\Windows\System\rcjqkXF.exe
  C:\Windows\System\rcjqkXF.exe
  2⤵
  PID:10804
- C:\Windows\System\HgpOIUP.exe
  C:\Windows\System\HgpOIUP.exe
  2⤵
  PID:10832
- C:\Windows\System\cVqjrEs.exe
  C:\Windows\System\cVqjrEs.exe
  2⤵
  PID:10860
- C:\Windows\System\dGTMjnd.exe
  C:\Windows\System\dGTMjnd.exe
  2⤵
  PID:10888
- C:\Windows\System\xDOjNoY.exe
  C:\Windows\System\xDOjNoY.exe
  2⤵
  PID:10916
- C:\Windows\System\lJvkohh.exe
  C:\Windows\System\lJvkohh.exe
  2⤵
  PID:10944
- C:\Windows\System\OYdJVdB.exe
  C:\Windows\System\OYdJVdB.exe
  2⤵
  PID:10972
- C:\Windows\System\VKItzWf.exe
  C:\Windows\System\VKItzWf.exe
  2⤵
  PID:11000
- C:\Windows\System\xMaoJXV.exe
  C:\Windows\System\xMaoJXV.exe
  2⤵
  PID:11028
- C:\Windows\System\BQGtLcx.exe
  C:\Windows\System\BQGtLcx.exe
  2⤵
  PID:11056
- C:\Windows\System\ioTuwMJ.exe
  C:\Windows\System\ioTuwMJ.exe
  2⤵
  PID:11084
- C:\Windows\System\ScuOkPE.exe
  C:\Windows\System\ScuOkPE.exe
  2⤵
  PID:11112
- C:\Windows\System\CgKIjuN.exe
  C:\Windows\System\CgKIjuN.exe
  2⤵
  PID:11140
- C:\Windows\System\PqjFXYd.exe
  C:\Windows\System\PqjFXYd.exe
  2⤵
  PID:11168
- C:\Windows\System\PglAikL.exe
  C:\Windows\System\PglAikL.exe
  2⤵
  PID:11196
- C:\Windows\System\jFuJiwE.exe
  C:\Windows\System\jFuJiwE.exe
  2⤵
  PID:11228
- C:\Windows\System\TtPiGFf.exe
  C:\Windows\System\TtPiGFf.exe
  2⤵
  PID:11256
- C:\Windows\System\ebmgzup.exe
  C:\Windows\System\ebmgzup.exe
  2⤵
  PID:10308
- C:\Windows\System\gKmdtlw.exe
  C:\Windows\System\gKmdtlw.exe
  2⤵
  PID:10408
- C:\Windows\System\gKfZhMc.exe
  C:\Windows\System\gKfZhMc.exe
  2⤵
  PID:10448
- C:\Windows\System\tNwNWTi.exe
  C:\Windows\System\tNwNWTi.exe
  2⤵
  PID:10532
- C:\Windows\System\PdtNBFU.exe
  C:\Windows\System\PdtNBFU.exe
  2⤵
  PID:10600
- C:\Windows\System\ZlsladE.exe
  C:\Windows\System\ZlsladE.exe
  2⤵
  PID:10668
- C:\Windows\System\kBjWoDG.exe
  C:\Windows\System\kBjWoDG.exe
  2⤵
  PID:10728
- C:\Windows\System\XHOYdrT.exe
  C:\Windows\System\XHOYdrT.exe
  2⤵
  PID:10800
- C:\Windows\System\fBRoHVr.exe
  C:\Windows\System\fBRoHVr.exe
  2⤵
  PID:10876
- C:\Windows\System\OzXcTQj.exe
  C:\Windows\System\OzXcTQj.exe
  2⤵
  PID:10936
- C:\Windows\System\PfAJEzG.exe
  C:\Windows\System\PfAJEzG.exe
  2⤵
  PID:10996
- C:\Windows\System\wLBWden.exe
  C:\Windows\System\wLBWden.exe
  2⤵
  PID:11076
- C:\Windows\System\zxtLJTl.exe
  C:\Windows\System\zxtLJTl.exe
  2⤵
  PID:11132
- C:\Windows\System\dnTDMTs.exe
  C:\Windows\System\dnTDMTs.exe
  2⤵
  PID:11188
- C:\Windows\System\plXqGfW.exe
  C:\Windows\System\plXqGfW.exe
  2⤵
  PID:11252
- C:\Windows\System\XBXVhlc.exe
  C:\Windows\System\XBXVhlc.exe
  2⤵
  PID:10560
- C:\Windows\System\zEvrQOc.exe
  C:\Windows\System\zEvrQOc.exe
  2⤵
  PID:10640
- C:\Windows\System\jtcueMJ.exe
  C:\Windows\System\jtcueMJ.exe
  2⤵
  PID:10796
- C:\Windows\System\nQhpZhs.exe
  C:\Windows\System\nQhpZhs.exe
  2⤵
  PID:10984
- C:\Windows\System\uoFvdgN.exe
  C:\Windows\System\uoFvdgN.exe
  2⤵
  PID:11124
- C:\Windows\System\otnRSjT.exe
  C:\Windows\System\otnRSjT.exe
  2⤵
  PID:11220
- C:\Windows\System\SSIyFhw.exe
  C:\Windows\System\SSIyFhw.exe
  2⤵
  PID:10636
- C:\Windows\System\SjLrPHK.exe
  C:\Windows\System\SjLrPHK.exe
  2⤵
  PID:2204
- C:\Windows\System\QRHuhAH.exe
  C:\Windows\System\QRHuhAH.exe
  2⤵
  PID:10968
- C:\Windows\System\fKCKHuH.exe
  C:\Windows\System\fKCKHuH.exe
  2⤵
  PID:11268
- C:\Windows\System\NPEUxUg.exe
  C:\Windows\System\NPEUxUg.exe
  2⤵
  PID:11288
- C:\Windows\System\YPUHydE.exe
  C:\Windows\System\YPUHydE.exe
  2⤵
  PID:11328
- C:\Windows\System\kLYxiec.exe
  C:\Windows\System\kLYxiec.exe
  2⤵
  PID:11356
- C:\Windows\System\BdgtLAi.exe
  C:\Windows\System\BdgtLAi.exe
  2⤵
  PID:11384
- C:\Windows\System\wUeRKpF.exe
  C:\Windows\System\wUeRKpF.exe
  2⤵
  PID:11412
- C:\Windows\System\jWrBWjg.exe
  C:\Windows\System\jWrBWjg.exe
  2⤵
  PID:11440
- C:\Windows\System\lMskdcy.exe
  C:\Windows\System\lMskdcy.exe
  2⤵
  PID:11468
- C:\Windows\System\PHSIUCS.exe
  C:\Windows\System\PHSIUCS.exe
  2⤵
  PID:11496
- C:\Windows\System\crZjBJd.exe
  C:\Windows\System\crZjBJd.exe
  2⤵
  PID:11524
- C:\Windows\System\cLGHFUj.exe
  C:\Windows\System\cLGHFUj.exe
  2⤵
  PID:11552
- C:\Windows\System\UGndBDC.exe
  C:\Windows\System\UGndBDC.exe
  2⤵
  PID:11580
- C:\Windows\System\ScPmZlv.exe
  C:\Windows\System\ScPmZlv.exe
  2⤵
  PID:11608
- C:\Windows\System\dnLAasJ.exe
  C:\Windows\System\dnLAasJ.exe
  2⤵
  PID:11636
- C:\Windows\System\wfvkrgI.exe
  C:\Windows\System\wfvkrgI.exe
  2⤵
  PID:11664
- C:\Windows\System\GCfVVyM.exe
  C:\Windows\System\GCfVVyM.exe
  2⤵
  PID:11692
- C:\Windows\System\xDtYueT.exe
  C:\Windows\System\xDtYueT.exe
  2⤵
  PID:11720
- C:\Windows\System\OjSalFz.exe
  C:\Windows\System\OjSalFz.exe
  2⤵
  PID:11748
- C:\Windows\System\glgLqrq.exe
  C:\Windows\System\glgLqrq.exe
  2⤵
  PID:11776
- C:\Windows\System\dkHkHDZ.exe
  C:\Windows\System\dkHkHDZ.exe
  2⤵
  PID:11804
- C:\Windows\System\YeFyZpe.exe
  C:\Windows\System\YeFyZpe.exe
  2⤵
  PID:11832
- C:\Windows\System\VVgHEdT.exe
  C:\Windows\System\VVgHEdT.exe
  2⤵
  PID:11860
- C:\Windows\System\TNATpMl.exe
  C:\Windows\System\TNATpMl.exe
  2⤵
  PID:11888
- C:\Windows\System\PAfrHao.exe
  C:\Windows\System\PAfrHao.exe
  2⤵
  PID:11916
- C:\Windows\System\xwqjOyr.exe
  C:\Windows\System\xwqjOyr.exe
  2⤵
  PID:11944
- C:\Windows\System\BysHpbU.exe
  C:\Windows\System\BysHpbU.exe
  2⤵
  PID:11972
- C:\Windows\System\LpNDdnK.exe
  C:\Windows\System\LpNDdnK.exe
  2⤵
  PID:12000
- C:\Windows\System\umurYAs.exe
  C:\Windows\System\umurYAs.exe
  2⤵
  PID:12028
- C:\Windows\System\SsQMaSr.exe
  C:\Windows\System\SsQMaSr.exe
  2⤵
  PID:12056
- C:\Windows\System\ZHGhgCm.exe
  C:\Windows\System\ZHGhgCm.exe
  2⤵
  PID:12084
- C:\Windows\System\BEDUarW.exe
  C:\Windows\System\BEDUarW.exe
  2⤵
  PID:12112
- C:\Windows\System\cHiobNn.exe
  C:\Windows\System\cHiobNn.exe
  2⤵
  PID:12140
- C:\Windows\System\cxLVSvH.exe
  C:\Windows\System\cxLVSvH.exe
  2⤵
  PID:12168
- C:\Windows\System\BtVVbjg.exe
  C:\Windows\System\BtVVbjg.exe
  2⤵
  PID:12200
- C:\Windows\System\bvBESbA.exe
  C:\Windows\System\bvBESbA.exe
  2⤵
  PID:12228
- C:\Windows\System\xcpaAHV.exe
  C:\Windows\System\xcpaAHV.exe
  2⤵
  PID:12256
- C:\Windows\System\jsdsAky.exe
  C:\Windows\System\jsdsAky.exe
  2⤵
  PID:12284
- C:\Windows\System\ruBexzw.exe
  C:\Windows\System\ruBexzw.exe
  2⤵
  PID:11320
- C:\Windows\System\Icwelgx.exe
  C:\Windows\System\Icwelgx.exe
  2⤵
  PID:11380
- C:\Windows\System\yfYsIZE.exe
  C:\Windows\System\yfYsIZE.exe
  2⤵
  PID:11456
- C:\Windows\System\vcQcQnq.exe
  C:\Windows\System\vcQcQnq.exe
  2⤵
  PID:11516
- C:\Windows\System\bPYHBDa.exe
  C:\Windows\System\bPYHBDa.exe
  2⤵
  PID:11576
- C:\Windows\System\TNJMhHd.exe
  C:\Windows\System\TNJMhHd.exe
  2⤵
  PID:11648
- C:\Windows\System\QGeNIFB.exe
  C:\Windows\System\QGeNIFB.exe
  2⤵
  PID:11712
- C:\Windows\System\tQJPzgC.exe
  C:\Windows\System\tQJPzgC.exe
  2⤵
  PID:11772
- C:\Windows\System\GDHKXez.exe
  C:\Windows\System\GDHKXez.exe
  2⤵
  PID:11844
- C:\Windows\System\SbHHQDS.exe
  C:\Windows\System\SbHHQDS.exe
  2⤵
  PID:11908
- C:\Windows\System\NOARzjE.exe
  C:\Windows\System\NOARzjE.exe
  2⤵
  PID:11968
- C:\Windows\System\eUZgBkE.exe
  C:\Windows\System\eUZgBkE.exe
  2⤵
  PID:12044
- C:\Windows\System\NUxXzFH.exe
  C:\Windows\System\NUxXzFH.exe
  2⤵
  PID:12104
- C:\Windows\System\zyeqCtF.exe
  C:\Windows\System\zyeqCtF.exe
  2⤵
  PID:12164
- C:\Windows\System\DmrJbov.exe
  C:\Windows\System\DmrJbov.exe
  2⤵
  PID:12224
- C:\Windows\System\YluBbPe.exe
  C:\Windows\System\YluBbPe.exe
  2⤵
  PID:11296
- C:\Windows\System\dzHBVum.exe
  C:\Windows\System\dzHBVum.exe
  2⤵
  PID:11436
- C:\Windows\System\JakIRIP.exe
  C:\Windows\System\JakIRIP.exe
  2⤵
  PID:11624
- C:\Windows\System\FUjdjLR.exe
  C:\Windows\System\FUjdjLR.exe
  2⤵
  PID:11764
- C:\Windows\System\tQRtahm.exe
  C:\Windows\System\tQRtahm.exe
  2⤵
  PID:11900
- C:\Windows\System\hbJwGya.exe
  C:\Windows\System\hbJwGya.exe
  2⤵
  PID:12024
- C:\Windows\System\kruiUKZ.exe
  C:\Windows\System\kruiUKZ.exe
  2⤵
  PID:12136
- C:\Windows\System\LJUZRct.exe
  C:\Windows\System\LJUZRct.exe
  2⤵
  PID:11428
- C:\Windows\System\gbwczwe.exe
  C:\Windows\System\gbwczwe.exe
  2⤵
  PID:11740
- C:\Windows\System\nfOlWFm.exe
  C:\Windows\System\nfOlWFm.exe
  2⤵
  PID:12020
- C:\Windows\System\HPcZfqp.exe
  C:\Windows\System\HPcZfqp.exe
  2⤵
  PID:11572
- C:\Windows\System\CpqbczQ.exe
  C:\Windows\System\CpqbczQ.exe
  2⤵
  PID:11276
- C:\Windows\System\jtqPMvS.exe
  C:\Windows\System\jtqPMvS.exe
  2⤵
  PID:11996
- C:\Windows\System\KQHzDlO.exe
  C:\Windows\System\KQHzDlO.exe
  2⤵
  PID:12316
- C:\Windows\System\SEbhysl.exe
  C:\Windows\System\SEbhysl.exe
  2⤵
  PID:12344
- C:\Windows\System\NPYTvri.exe
  C:\Windows\System\NPYTvri.exe
  2⤵
  PID:12376
- C:\Windows\System\dEoNlCd.exe
  C:\Windows\System\dEoNlCd.exe
  2⤵
  PID:12404
- C:\Windows\System\vHcQyaB.exe
  C:\Windows\System\vHcQyaB.exe
  2⤵
  PID:12432
- C:\Windows\System\SQKSdsn.exe
  C:\Windows\System\SQKSdsn.exe
  2⤵
  PID:12460
- C:\Windows\System\JRtZWTU.exe
  C:\Windows\System\JRtZWTU.exe
  2⤵
  PID:12488
- C:\Windows\System\STGAMwC.exe
  C:\Windows\System\STGAMwC.exe
  2⤵
  PID:12516
- C:\Windows\System\rRKomJv.exe
  C:\Windows\System\rRKomJv.exe
  2⤵
  PID:12544
- C:\Windows\System\aErnOmz.exe
  C:\Windows\System\aErnOmz.exe
  2⤵
  PID:12572
- C:\Windows\System\dJFTpnV.exe
  C:\Windows\System\dJFTpnV.exe
  2⤵
  PID:12600
- C:\Windows\System\RVQPDUq.exe
  C:\Windows\System\RVQPDUq.exe
  2⤵
  PID:12636
- C:\Windows\System\szCfqZN.exe
  C:\Windows\System\szCfqZN.exe
  2⤵
  PID:12676
- C:\Windows\System\PKecdCZ.exe
  C:\Windows\System\PKecdCZ.exe
  2⤵
  PID:12720
- C:\Windows\System\YaooEvL.exe
  C:\Windows\System\YaooEvL.exe
  2⤵
  PID:12748
- C:\Windows\System\IAYBGPJ.exe
  C:\Windows\System\IAYBGPJ.exe
  2⤵
  PID:12780
- C:\Windows\System\DytJcKV.exe
  C:\Windows\System\DytJcKV.exe
  2⤵
  PID:12816
- C:\Windows\System\miDTGln.exe
  C:\Windows\System\miDTGln.exe
  2⤵
  PID:12848
- C:\Windows\System\PXundiD.exe
  C:\Windows\System\PXundiD.exe
  2⤵
  PID:12880
- C:\Windows\System\ZCZRYqz.exe
  C:\Windows\System\ZCZRYqz.exe
  2⤵
  PID:12908
- C:\Windows\System\hxhGWOE.exe
  C:\Windows\System\hxhGWOE.exe
  2⤵
  PID:12940
- C:\Windows\System\bmXCZOw.exe
  C:\Windows\System\bmXCZOw.exe
  2⤵
  PID:12972
- C:\Windows\System\zhDekji.exe
  C:\Windows\System\zhDekji.exe
  2⤵
  PID:13000
- C:\Windows\System\hgBAAFn.exe
  C:\Windows\System\hgBAAFn.exe
  2⤵
  PID:13028
- C:\Windows\System\QpIcSDp.exe
  C:\Windows\System\QpIcSDp.exe
  2⤵
  PID:13056
- C:\Windows\System\MswdZet.exe
  C:\Windows\System\MswdZet.exe
  2⤵
  PID:13084
- C:\Windows\System\QJgnGTs.exe
  C:\Windows\System\QJgnGTs.exe
  2⤵
  PID:13112
- C:\Windows\System\AkOyCjA.exe
  C:\Windows\System\AkOyCjA.exe
  2⤵
  PID:13140
- C:\Windows\System\wXAXYGV.exe
  C:\Windows\System\wXAXYGV.exe
  2⤵
  PID:13168
- C:\Windows\System\TekszNe.exe
  C:\Windows\System\TekszNe.exe
  2⤵
  PID:13196
- C:\Windows\System\vILHbdf.exe
  C:\Windows\System\vILHbdf.exe
  2⤵
  PID:13224
- C:\Windows\System\pmLIJGG.exe
  C:\Windows\System\pmLIJGG.exe
  2⤵
  PID:13252
- C:\Windows\System\BSajOEE.exe
  C:\Windows\System\BSajOEE.exe
  2⤵
  PID:13280
- C:\Windows\System\vqFZZRO.exe
  C:\Windows\System\vqFZZRO.exe
  2⤵
  PID:13308
- C:\Windows\System\lrZMRpW.exe
  C:\Windows\System\lrZMRpW.exe
  2⤵
  PID:12352
- C:\Windows\System\DsjNGrB.exe
  C:\Windows\System\DsjNGrB.exe
  2⤵
  PID:12420
- C:\Windows\System\GulTyhw.exe
  C:\Windows\System\GulTyhw.exe
  2⤵
  PID:12480
- C:\Windows\System\iJtbXFz.exe
  C:\Windows\System\iJtbXFz.exe
  2⤵
  PID:12556
- C:\Windows\System\XCJHHnr.exe
  C:\Windows\System\XCJHHnr.exe
  2⤵
  PID:12612
- C:\Windows\System\pkJUIyF.exe
  C:\Windows\System\pkJUIyF.exe
  2⤵
  PID:12744
- C:\Windows\System\cmkpodc.exe
  C:\Windows\System\cmkpodc.exe
  2⤵
  PID:4496
- C:\Windows\System\NahpTzV.exe
  C:\Windows\System\NahpTzV.exe
  2⤵
  PID:12892
- C:\Windows\System\WScyeXV.exe
  C:\Windows\System\WScyeXV.exe
  2⤵
  PID:12964
- C:\Windows\System\WYijIse.exe
  C:\Windows\System\WYijIse.exe
  2⤵
  PID:13040
- C:\Windows\System\iVeQOHU.exe
  C:\Windows\System\iVeQOHU.exe
  2⤵
  PID:13104
- C:\Windows\System\VswxATf.exe
  C:\Windows\System\VswxATf.exe
  2⤵
  PID:13164
- C:\Windows\System\XyzVWNH.exe
  C:\Windows\System\XyzVWNH.exe
  2⤵
  PID:13208
- C:\Windows\System\TunwYQS.exe
  C:\Windows\System\TunwYQS.exe
  2⤵
  PID:13272
- C:\Windows\System\VzZXmYn.exe
  C:\Windows\System\VzZXmYn.exe
  2⤵
  PID:12328
- C:\Windows\System\bpFxeOH.exe
  C:\Windows\System\bpFxeOH.exe
  2⤵
  PID:12508
- C:\Windows\System\AMnsNHo.exe
  C:\Windows\System\AMnsNHo.exe
  2⤵
  PID:3440
- C:\Windows\System\peFaDCm.exe
  C:\Windows\System\peFaDCm.exe
  2⤵
  PID:12952
- C:\Windows\System\NILtbUK.exe
  C:\Windows\System\NILtbUK.exe
  2⤵
  PID:13080
- C:\Windows\System\YzVncnp.exe
  C:\Windows\System\YzVncnp.exe
  2⤵
  PID:13248
- C:\Windows\System\bDYbvYc.exe
  C:\Windows\System\bDYbvYc.exe
  2⤵
  PID:12476
- C:\Windows\System\bLqCbMQ.exe
  C:\Windows\System\bLqCbMQ.exe
  2⤵
  PID:12928
- C:\Windows\System\tYIedNj.exe
  C:\Windows\System\tYIedNj.exe
  2⤵
  PID:13212
- C:\Windows\System\BLsVpzw.exe
  C:\Windows\System\BLsVpzw.exe
  2⤵
  PID:13160
- C:\Windows\System\umKXRRp.exe
  C:\Windows\System\umKXRRp.exe
  2⤵
  PID:13320
- C:\Windows\System\btGVdvc.exe
  C:\Windows\System\btGVdvc.exe
  2⤵
  PID:13348
- C:\Windows\System\sedLVMb.exe
  C:\Windows\System\sedLVMb.exe
  2⤵
  PID:13376
- C:\Windows\System\qihznvl.exe
  C:\Windows\System\qihznvl.exe
  2⤵
  PID:13404
- C:\Windows\System\tSRuVJM.exe
  C:\Windows\System\tSRuVJM.exe
  2⤵
  PID:13436
- C:\Windows\System\dvGtAph.exe
  C:\Windows\System\dvGtAph.exe
  2⤵
  PID:13464
- C:\Windows\System\BElSumc.exe
  C:\Windows\System\BElSumc.exe
  2⤵
  PID:13492
- C:\Windows\System\wNjVICA.exe
  C:\Windows\System\wNjVICA.exe
  2⤵
  PID:13520
- C:\Windows\System\hVOBzml.exe
  C:\Windows\System\hVOBzml.exe
  2⤵
  PID:13548
- C:\Windows\System\ZAlfofg.exe
  C:\Windows\System\ZAlfofg.exe
  2⤵
  PID:13576
- C:\Windows\System\ifWOEOw.exe
  C:\Windows\System\ifWOEOw.exe
  2⤵
  PID:13604
- C:\Windows\System\zWcjjSL.exe
  C:\Windows\System\zWcjjSL.exe
  2⤵
  PID:13632
- C:\Windows\System\pmHEwhV.exe
  C:\Windows\System\pmHEwhV.exe
  2⤵
  PID:13660
- C:\Windows\System\YrkNRPO.exe
  C:\Windows\System\YrkNRPO.exe
  2⤵
  PID:13688
- C:\Windows\System\QiyUfPq.exe
  C:\Windows\System\QiyUfPq.exe
  2⤵
  PID:13716
- C:\Windows\System\wJtyMWj.exe
  C:\Windows\System\wJtyMWj.exe
  2⤵
  PID:13744
- C:\Windows\System\jDqlBck.exe
  C:\Windows\System\jDqlBck.exe
  2⤵
  PID:13772
- C:\Windows\System\McVvmvD.exe
  C:\Windows\System\McVvmvD.exe
  2⤵
  PID:13800
- C:\Windows\System\GUOtvhj.exe
  C:\Windows\System\GUOtvhj.exe
  2⤵
  PID:13828
- C:\Windows\System\DBrIjJu.exe
  C:\Windows\System\DBrIjJu.exe
  2⤵
  PID:13856
- C:\Windows\System\NmJlQHS.exe
  C:\Windows\System\NmJlQHS.exe
  2⤵
  PID:13884
- C:\Windows\System\FoynTtf.exe
  C:\Windows\System\FoynTtf.exe
  2⤵
  PID:13912
- C:\Windows\System\PVvZslU.exe
  C:\Windows\System\PVvZslU.exe
  2⤵
  PID:13940
- C:\Windows\System\ogWhQmW.exe
  C:\Windows\System\ogWhQmW.exe
  2⤵
  PID:13968
- C:\Windows\System\uIsePeS.exe
  C:\Windows\System\uIsePeS.exe
  2⤵
  PID:14000
- C:\Windows\System\CoavljG.exe
  C:\Windows\System\CoavljG.exe
  2⤵
  PID:14028
- C:\Windows\System\BjYbdSw.exe
  C:\Windows\System\BjYbdSw.exe
  2⤵
  PID:14056
- C:\Windows\System\gBZEHFk.exe
  C:\Windows\System\gBZEHFk.exe
  2⤵
  PID:14084
- C:\Windows\System\PeQPnYK.exe
  C:\Windows\System\PeQPnYK.exe
  2⤵
  PID:14112
- C:\Windows\System\DOjaBCH.exe
  C:\Windows\System\DOjaBCH.exe
  2⤵
  PID:14144
- C:\Windows\System\hcSYHRD.exe
  C:\Windows\System\hcSYHRD.exe
  2⤵
  PID:14172
- C:\Windows\System\ZhsdnpA.exe
  C:\Windows\System\ZhsdnpA.exe
  2⤵
  PID:14200
- C:\Windows\System\nXuHImt.exe
  C:\Windows\System\nXuHImt.exe
  2⤵
  PID:14228
- C:\Windows\System\MJViUqD.exe
  C:\Windows\System\MJViUqD.exe
  2⤵
  PID:14256
- C:\Windows\System\zwnzasP.exe
  C:\Windows\System\zwnzasP.exe
  2⤵
  PID:14284
- C:\Windows\System\nmUUdoS.exe
  C:\Windows\System\nmUUdoS.exe
  2⤵
  PID:14312
- C:\Windows\System\RqUjJBm.exe
  C:\Windows\System\RqUjJBm.exe
  2⤵
  PID:13316
- C:\Windows\System\UJasTDK.exe
  C:\Windows\System\UJasTDK.exe
  2⤵
  PID:13388
- C:\Windows\System\yGFSgaR.exe
  C:\Windows\System\yGFSgaR.exe
  2⤵
  PID:13456
- C:\Windows\System\eyRUtnr.exe
  C:\Windows\System\eyRUtnr.exe
  2⤵
  PID:13516
- C:\Windows\System\fBleyAr.exe
  C:\Windows\System\fBleyAr.exe
  2⤵
  PID:13588
- C:\Windows\System\PdOMHqT.exe
  C:\Windows\System\PdOMHqT.exe
  2⤵
  PID:13652
- C:\Windows\System\QDNxgTi.exe
  C:\Windows\System\QDNxgTi.exe
  2⤵
  PID:13712
- C:\Windows\System\ROYdYEx.exe
  C:\Windows\System\ROYdYEx.exe
  2⤵
  PID:13784
- C:\Windows\System\xuIdUIZ.exe
  C:\Windows\System\xuIdUIZ.exe
  2⤵
  PID:13848
- C:\Windows\System\VMBxMNj.exe
  C:\Windows\System\VMBxMNj.exe
  2⤵
  PID:3504
- C:\Windows\System\KQwMrtX.exe
  C:\Windows\System\KQwMrtX.exe
  2⤵
  PID:13908
- C:\Windows\System\rMpliho.exe
  C:\Windows\System\rMpliho.exe
  2⤵
  PID:13964
- C:\Windows\System\VeQOcmt.exe
  C:\Windows\System\VeQOcmt.exe
  2⤵
  PID:14040
- C:\Windows\System\bBUaFuF.exe
  C:\Windows\System\bBUaFuF.exe
  2⤵
  PID:14104
- C:\Windows\System\LNeJevH.exe
  C:\Windows\System\LNeJevH.exe
  2⤵
  PID:14168
- C:\Windows\System\aJxnfUN.exe
  C:\Windows\System\aJxnfUN.exe
  2⤵
  PID:14240
- C:\Windows\System\obWXbTs.exe
  C:\Windows\System\obWXbTs.exe
  2⤵
  PID:14304
- C:\Windows\System\ZQhLOFg.exe
  C:\Windows\System\ZQhLOFg.exe
  2⤵
  PID:13372
- C:\Windows\System\XewXBjw.exe
  C:\Windows\System\XewXBjw.exe
  2⤵
  PID:13544
- C:\Windows\System\Pysrnfj.exe
  C:\Windows\System\Pysrnfj.exe
  2⤵
  PID:13628
- C:\Windows\System\KZuDyfi.exe
  C:\Windows\System\KZuDyfi.exe
  2⤵
  PID:13844
- C:\Windows\System\tgEMJVs.exe
  C:\Windows\System\tgEMJVs.exe
  2⤵
  PID:13956
- C:\Windows\System\RCAYXmZ.exe
  C:\Windows\System\RCAYXmZ.exe
  2⤵
  PID:14080
- C:\Windows\System\AWQlrXX.exe
  C:\Windows\System\AWQlrXX.exe
  2⤵
  PID:14224
- C:\Windows\System\MvtrYUN.exe
  C:\Windows\System\MvtrYUN.exe
  2⤵
  PID:13484
- C:\Windows\System\slNQkdr.exe
  C:\Windows\System\slNQkdr.exe
  2⤵
  PID:13820
- C:\Windows\System\TUWxUlV.exe
  C:\Windows\System\TUWxUlV.exe
  2⤵
  PID:14068
- C:\Windows\System\yUCKHvF.exe
  C:\Windows\System\yUCKHvF.exe
  2⤵
  PID:13368
- C:\Windows\System\HxHGNWe.exe
  C:\Windows\System\HxHGNWe.exe
  2⤵
  PID:14332
- C:\Windows\System\dRZUpWM.exe
  C:\Windows\System\dRZUpWM.exe
  2⤵
  PID:14344
- C:\Windows\System\oWUWGry.exe
  C:\Windows\System\oWUWGry.exe
  2⤵
  PID:14372
- C:\Windows\System\aMINewu.exe
  C:\Windows\System\aMINewu.exe
  2⤵
  PID:14400
- C:\Windows\System\HQlAbui.exe
  C:\Windows\System\HQlAbui.exe
  2⤵
  PID:14428
- C:\Windows\System\pUnDdoM.exe
  C:\Windows\System\pUnDdoM.exe
  2⤵
  PID:14456
- C:\Windows\System\tzahgZj.exe
  C:\Windows\System\tzahgZj.exe
  2⤵
  PID:14484
- C:\Windows\System\FMfXMPr.exe
  C:\Windows\System\FMfXMPr.exe
  2⤵
  PID:14512
- C:\Windows\System\FHnTEaI.exe
  C:\Windows\System\FHnTEaI.exe
  2⤵
  PID:14540
- C:\Windows\System\QquLJjV.exe
  C:\Windows\System\QquLJjV.exe
  2⤵
  PID:14568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BfZoqiB.exe

Filesize
1.9MB

MD5
e6bb590c8acb12fa4387a756c288e748

SHA1
368c815a9958d5cae8fbe5c03ebbc1a426ffdfe2

SHA256
adef9cf02ae8d643cc50f3b6e4d808c01be5c476a5660ce763318e0e6c3a168d

SHA512
4a74d52526c783e41cc2f46b21f2318351c10057d5963e9a5d77fbfa1284e4fcd6bf6ce75c60c1dbc82d578c4332800b68b55099b27e3d1c7410e240f737368f

Download Submit
C:\Windows\System\CFtATPY.exe

Filesize
1.9MB

MD5
73f49ddebb3549013e974fc3925cc441

SHA1
a71bb93b6acad83d62629c78c3d85e8ad5ade377

SHA256
27e50b89f216862303c0dec1eb185037c8e116f66f0ccf8f730225d4af08b200

SHA512
b635f47d8b1ee6bd253478145b37c523c98344e65ce33f979e61ba89cdf8ee7911d98cfcc209e31e18a239a0b19674dbc546013baa0754e99eca81f724d43093

Download Submit
C:\Windows\System\FLPgVGo.exe

Filesize
1.9MB

MD5
25da4e1b1679dd446956a89e386fdb67

SHA1
a79df4a85ad6b74b3689beb3148d0028fd4ee1f7

SHA256
0826baee7478a5eb6f8fa4947398da50b0ff674ca48c9fbbc044aaea3b09e583

SHA512
282947317324f94ead4de77d04674e524f3e975ceca63a6524a6d52fe4c5793c6e7474a875c5aa0e6c7ce7eeea6087afececded8fb4674a88530148e22bb274d

Download Submit
C:\Windows\System\HhXKXqD.exe

Filesize
1.9MB

MD5
2e80807f46e96ad0f22084e55da86e1c

SHA1
1cad694d27556e9eb3af2f76eb80c3b9ead71fce

SHA256
45f40546e925b7ce2e8baa04a51dcf337ad5fd91959d4978c9831dfc6056fbcf

SHA512
361d4fd382244603488400511d7f4b34c20f9cca792893b50f3d7a68e079c0bb0fb8c742f905ce77e2729d34530995802cf3e791192f2cebf8293e08e3f4659e

Download Submit
C:\Windows\System\IwPEODI.exe

Filesize
1.9MB

MD5
f4eb8bb15af01c561b80c17bc50f5719

SHA1
8c0836d6c04bca95e0eb0fecd1a450deab891190

SHA256
fa22ab50dac89fe2be3308002bcfb9f40b6e23e29dc464ce0daad9dfa7e18ef7

SHA512
4bc830d4540a4d2142c51859fc370f1145132d83d0165bb0b5067f3aa3afc1b0127ceff2d55137f820de27d0a6d41f3140414da62fae934cadf8fb37998909fa

Download Submit
C:\Windows\System\KKPmjjc.exe

Filesize
1.9MB

MD5
0b3e636a29e6b374275d40230eba7dcb

SHA1
7a88932938ec8db4eb789db9c7a17bd4aa1c7e5d

SHA256
4e8dda0eef3454a55149638482f4e06c5f55bdf5b2b670af176f56cef7ee58c5

SHA512
8a67c57e707fdacd444a98b6bfea03cebdb4eea9b0d67733c29c35a92f84e6c0bd06bcdc2024eafeb56b1afab7ddc1051c402d87629261faabcba50f6cd1697a

Download Submit
C:\Windows\System\MXCInIt.exe

Filesize
1.9MB

MD5
3a3ddb7f07a974fa5d38574c76c9357d

SHA1
2c8753d62ae8438334120e59f226b871e87a0192

SHA256
75c7b42dbe38146e1c286a9a232d937c817344366d28c304557cd82c37ce2d63

SHA512
bb978d71b720517099f745684b847f1359c590972feaf7606031adfeb02dafcc878b341215536c3cc0a05a386b9199d2840ad5352aa565d991d65a713573374c

Download Submit
C:\Windows\System\MblksMw.exe

Filesize
1.9MB

MD5
bc75c55603aced5110bb466afb984b39

SHA1
42accef1f6f5455de31e2be5b0a8bd4a77c9ac7f

SHA256
dcd37edc22a6bf33b395abe1c19f9708600afcf4b9b8b2f61c2042349b0edd34

SHA512
dc6be1e4813b7fec636bfb9f038110ebe9b51a2b2410003c57d19e91bf5756d3494d037c2b51c13025ccae8485d3be3a6ab9edc19e021a71716a8495a8454114

Download Submit
C:\Windows\System\NIIJSZf.exe

Filesize
1.9MB

MD5
e7c77f12cf124cc407113df48fcbc5c7

SHA1
7a8426aa34917c01eaa129c5324bc2b1a8c67c08

SHA256
4e6cff65ab124993500f0b4c29ef6509d729b8e22231c92fdb4c741b1d6e2832

SHA512
ac1a44455c065c3679ef62237de0cef676599e93b467d51ace83dfa4036e5e2c18866064979db0e751de2c650ad7c64811c907f200a8e21f8d8288bd287ea433

Download Submit
C:\Windows\System\POOFbId.exe

Filesize
1.9MB

MD5
2b1fbfee8941fdd3313b8340a96fa977

SHA1
fecd6913b74708454bdee622fd59980a4a873a97

SHA256
042437ab205af4e98db6e286f1633aa5a25b620eeeb099119eea8257f048c65e

SHA512
e9e8078cd2baea855cde6ccd30d150f14139032b7b73ac704c60101a45a4e36c93248d45c8de0ff55f8695bf7b033997bc227eb9246f4ab1bd08a706a699afb8

Download Submit
C:\Windows\System\UpPtPcR.exe

Filesize
1.9MB

MD5
31cdd81e710d4faf4eabd859155e8720

SHA1
96e96779105ed156a116f96f309194cff0bc8e14

SHA256
4e52355e015524167c833f02b3b2a78eb079201e97249de3e89da3d9d5fab741

SHA512
2cbd4176c59c1a277aa798e4c186a7bbee9c3839a64d739fafaa1305d1777062f15ba1229a1dfd4e2da73e3fdf93f4a172cb273f282b0ee16afe0ea51cd86392

Download Submit
C:\Windows\System\VtvMqEN.exe

Filesize
1.9MB

MD5
51069acf6d2680877ed69c014ea8328d

SHA1
53476547037df1508074ecc84b01c399b3822bd8

SHA256
5fa733142e1e49d0e3522125e312cc9cc52bf9df5e967eb184307c12150d34cc

SHA512
c90b4f0ecf34ee323891aceada886e344daa88c48309140ac12be5fb3a06038a7005025b4ac1fd6e2bd0e2e8fa63373b3c80ae23d75e6d8730bd2e1f383fe526

Download Submit
C:\Windows\System\WYURMFD.exe

Filesize
1.9MB

MD5
e3861965b534246f1815caa9fb481937

SHA1
2ffb02697e78c8c081564cb1c91c8b2b4b4e26ed

SHA256
98637f28f9c22875fb7efe029dfb80145c2616711df5829c2f3b8f1fe30bd263

SHA512
d145597e9c655f29e306be834346c56a6ff4f697b45eeaea85da28ad3e658e8ad74b5d121ddab31d266678d6dc31a142a6e4f9d90d787d6a46a145e6e8bf303b

Download Submit
C:\Windows\System\XgYOiIi.exe

Filesize
1.9MB

MD5
ffa7374d3654a944e89acc3ca1bd2d69

SHA1
7415d55537124e5c029b43539bfabc193843c194

SHA256
36efb4e7938157b504bc5039d9623393cce68c86f5b061f1d639dc954449e074

SHA512
bcfbd22e3f490b1ad7b70f06e437ea1b5c5f45f701c9c344f9000d5c210867d318c57c9790e1b9de07e2cd50ac7c732d4668531342fbc46958755811220ce3a1

Download Submit
C:\Windows\System\adhDSII.exe

Filesize
1.9MB

MD5
3a64d1257e381968151e92ac230a9a4a

SHA1
49dd1851b9759f7ae7ec9ffa3738d8030b557776

SHA256
65e429018b1b4f392c308872b434b606c3f97ec91722eceb8b4d636d893f7256

SHA512
e8b276e18a9f69776bf1a0855c3ad38b20d0a80f080b85bd5e8b95e17eff9d5a91381705d4bc700d08dbb765b81d528ee26482d00b14dbb314bf31e3806bab6e

Download Submit
C:\Windows\System\dMAqAht.exe

Filesize
1.9MB

MD5
1d4aea8e299c6bdf4108c364f933d7df

SHA1
95ffe13433be38ade2a616be4ed7d3bb3e7b28ae

SHA256
add839b8af7934861b73c3874cf8f9e9df9473ecb7c718f49b055bf2fe4a84c0

SHA512
5ea976727297fe785c5bebf45bea29b8d84ceb7b69bf6328999feaed1b45b1ce9f91acc3772bac52fd030d09d5b123e3414310863a8382658f2fe28b7bf71aa9

Download Submit
C:\Windows\System\eTYhNdb.exe

Filesize
1.9MB

MD5
81c018ef5c5278de57f7605dc62b2cb3

SHA1
05eee946a0b9c700b6b2105f9ed0e3141369124b

SHA256
79fefb6c8c1632cc51076ddfd401c0eb400403d66177401cf0dff3e41526edde

SHA512
02f9b86e8965b8ec9fba5e2241ab9c58271c9ac5874ab34012c411df41dd1b31f35eb4d68be676e86fd8a33923a1570358d068f11f41df86939ddd4649614fd8

Download Submit
C:\Windows\System\frkTQDd.exe

Filesize
1.9MB

MD5
4adaa157f825b693ad4473b18aec4637

SHA1
8300a41878a8ac19b496dc579292888028318ed3

SHA256
b1d24a98495ded874e4ddab5830c2442951c4ff5a779d8a65f83787377236739

SHA512
5b35d21f27a914322d73733590a2409364a66a3605766066e18b8926133d0bc193bbc40e461ec9c74eaf33eb83716b48f0230a8bbdb95802ae4ccc41592a0d90

Download Submit
C:\Windows\System\gdWoQTC.exe

Filesize
1.9MB

MD5
3c364dfc7cae9ca7f9fad3998e51e97f

SHA1
f1f046381c12fa5eb3e742a5007d27d4c364159c

SHA256
7b8c40bf055f23b2f6d34f2cedae37182a3f5f74f15509ea55bf02fba324e489

SHA512
d15a49d88558c53ee3984b715e4455c8fc1ef6cbf17c97bf4ff032d579266ee95337e51136a12d29b852ff9be3760e27b8e7d57c875c46ad2b7a186fc5cf7a1c

Download Submit
C:\Windows\System\jHrGcfP.exe

Filesize
1.9MB

MD5
81b87f8246720460e91e2204c24510e4

SHA1
bdc5e5b507cc3b77c46284cafb62e412cee317cd

SHA256
55e9bd14c001a0460ca39e5de06064624fd51b3f46bcecffa08d7f47a05a5675

SHA512
58de01cb00550a2b2aeb85b22371a8f9f7ea389ce35d9c092df028e10cafc4245d81d037ad9388d1ea8d9e43820da8fd83f8d4dc70f9e2da35bdfd9653e2a371

Download Submit
C:\Windows\System\lihNwLD.exe

Filesize
1.9MB

MD5
9a1b23dc34e17940a3c47e452ff85ee1

SHA1
e9c021a46befd338fef49370897922ea98078e45

SHA256
a3cf5810ff6ae0c8c691adb3995eb110fe0a661e21c105d81592d891263bdea6

SHA512
8610605a618b8de1830d9caf6026ef338dde47acf69d188554636591c3c2e918cbcdbda7b77d87b424f2769fe59feb61693bad4ed8c54f4cef9dc6891e4694b2

Download Submit
C:\Windows\System\naZNqRt.exe

Filesize
1.9MB

MD5
7bb933ac87885e585b699da6049a14df

SHA1
faf95b7785cc869cd6596e864549cb21cf5075b4

SHA256
120f561a5ab5a96c4f3154e14f1dc55d124f9d61fc70ceca72716b1bc2193392

SHA512
b77eb907e8fa2d82e1883de6decfa2fc0f56316c173572de31b3f7549c2276bcde2a769fa9cb930c62206aba35ad98d270d62a4b4c158a81bc478cab943e5cd6

Download Submit
C:\Windows\System\ofMYRxu.exe

Filesize
1.9MB

MD5
204fe8ac74d43616767d583c1d1ce1bc

SHA1
5d1a498e13d223f5c4edb68fcf48318adebcaf1b

SHA256
5b530938a9ffc39584abe13ff27a649d2bf5bae9df7f66c7026a58fc417a4776

SHA512
fc8161383cd4f52e842587410b4c7b24afe7001aa4747a870da6168e65ec4f0c08432bd19f43437236c00390f73f03ef57044edf1fee913c09c3473c7014cbad

Download Submit
C:\Windows\System\qMMvhZY.exe

Filesize
1.9MB

MD5
9f853864e69790f770de0787d2e03b4f

SHA1
c89e93e44ac94e7df7fc24a8591a0287b1416beb

SHA256
a815df5008e6b47526a985c519daf79f4f2db1a79ff3206a193526311dc07513

SHA512
b2cf3b591346f2ab9996baabef9a8cf77867442a1545122a0d06a5654894b1d1709ba1829316d73165d63be8d83c4b1df1a122d505f671b4b3596c7fbbcca71a

Download Submit
C:\Windows\System\qZtUVHd.exe

Filesize
1.9MB

MD5
e352a733c43c4c12b8ae8e0510cd32d3

SHA1
fa01dc9d237dd0f683d06e5703041098068c30e4

SHA256
7e50a9bba79b5d5f8010997b2b79385e92d10cc964d25327427045beea595563

SHA512
354b7fa181bb6ee8d49433107b84ecacfcf066b93f1d2e8b89651727be85684ab79459341c6d4347d437ccd893adfd392d4c1f1520c2d5c3149f739a0eaeb114

Download Submit
C:\Windows\System\qpTCuBT.exe

Filesize
1.9MB

MD5
741f7411fe6ea0a96b3096ba0a8dc345

SHA1
feccc8bd1c053d504298539040a5dafad174694f

SHA256
d452ffa11a3804dbc17f42958367f74e4d23610724f7f7581d88c1f16677c0cf

SHA512
72f9c4dac32808dd241ef34159bbd0b3e3811a3861d761b2f9a4c19ad249c191b5aec33b56783ac71adb577799da5e86c8b2569d37ee569e51f259eb233f9b1e

Download Submit
C:\Windows\System\suAAClh.exe

Filesize
1.9MB

MD5
dd62fbe43da88a398be0669bfb72d8fc

SHA1
ef1f4039260d9ac81f5d45d9e71e0588f32f2a97

SHA256
272bf5422346eeedff794fa18864004f60027210858875242db1ac4e220249e7

SHA512
4845dacc578975bc2b3764eae3d55e8cae42225ff973b27b2a52fe55eded1058eaba49d2ca1fdf31008e4e0304890f58c910cedd2c1386186547e50e5d0276ca

Download Submit
C:\Windows\System\uHlNRpR.exe

Filesize
1.9MB

MD5
e693af5a21a6dd291d8d60652d004b64

SHA1
f98e3c6f75eeb62871889c1e0b460e1ec0212fda

SHA256
01cebcc1249d3e0d491a51dc6b131779769e52c5f11ea5aa61f447c0dc8e4703

SHA512
83c8ea1abdcdd568fcc30428b08c933f6499024bf407b16d7415123331a788cfd7661916bd323094a1c91ba8f76e6246277b6939e40181c9f13e60bf39413628

Download Submit
C:\Windows\System\ulBPwUN.exe

Filesize
1.9MB

MD5
e26194a68149b434ced3225e86dfc2f4

SHA1
752769c234c33d432d326aee28b4e649bbe9e171

SHA256
1c70a524767a6f04c2aad96673c265ba3f4391fbd4bcbca3a101c72db6dd6c71

SHA512
acfe96063bd65b5f98eac8d725acaf9b7b57d5e4a320d5c9d3595531ab33f9e31c66743a523272f1f15f90109e90a1cff61ff57421fbe245ba406ff54e6e71ac

Download Submit
C:\Windows\System\wjQSlHv.exe

Filesize
1.9MB

MD5
35e6b0ad5f666b8ce1d49eaee3138221

SHA1
74aef80eb96146aacfde9a904fe5ae9b1a96508e

SHA256
e28b7a1dece5808aab67467b74ea43121744198556912ceebbd41c3d2efe7d31

SHA512
7e87b9780c06a668834db2879eb567280375c93989aa4a8d7e5ef13ff7516e82e41d4e9eda3d8e89c6734a4a6e5b8cae4f727966d396c88af9551a4711387b3c

Download Submit
C:\Windows\System\yDuCvqt.exe

Filesize
1.9MB

MD5
2c6e37aa83bc09be6c6908635777f30a

SHA1
78b9a8cc062d8e57c6a4e674e498fb3720f47645

SHA256
4341a66e7f17fbd1d7408097f260d5715a8c811ee75694fc09fc355c4a07e14e

SHA512
ce4658527a9f4f53a98a835d651b3afab3aa091840d2d1c6abfc996890a90d7955ed4ce0f45f0801cf8c3b2300ad8a88603739e3395a46ee062306537a1b73b5

Download Submit
C:\Windows\System\yGimpUd.exe

Filesize
1.9MB

MD5
9934aeaa76762d50d57bce5d03322206

SHA1
c1a99116905fe831870344fd2678369bfc06a90d

SHA256
a54f2bba6c3461aa193d972f2342c4e1cafc3bc75f0fdf3d6d596ac00b82910b

SHA512
0496db7a7f3d413f4d42d96bae41678580bff7934713b7d4d1e4abffdb8f5f1555f710deff2662217b29cd23ec982944e24ad69b59e8d504b76f704ae9be8a29

Download Submit
C:\Windows\System\yoolujw.exe

Filesize
1.9MB

MD5
596012f7e58dc1a11b126dbe792f25c7

SHA1
1909e90f016fd43e8b011ddcc19bebaee438d650

SHA256
96a26aa5d066f4a187f4b01ec87d0d9aabc1c24780a7b4cf77335cc415dee263

SHA512
b68680c16bbee6bcbbb7121bfb5bd0da08baada93fd8b94d3cd4f9579f37a39bba776f89efead57245fba31658bae052c5564c740610cce078289617c18a3382

Download Submit
memory/452-2101-0x00007FF649E90000-0x00007FF64A1E4000-memory.dmp

Filesize
3.3MB

Download
memory/452-537-0x00007FF649E90000-0x00007FF64A1E4000-memory.dmp

Filesize
3.3MB

Download
memory/812-2099-0x00007FF617E20000-0x00007FF618174000-memory.dmp

Filesize
3.3MB

Download
memory/812-545-0x00007FF617E20000-0x00007FF618174000-memory.dmp

Filesize
3.3MB

Download
memory/1148-2089-0x00007FF624F80000-0x00007FF6252D4000-memory.dmp

Filesize
3.3MB

Download
memory/1148-481-0x00007FF624F80000-0x00007FF6252D4000-memory.dmp

Filesize
3.3MB

Download
memory/1260-25-0x00007FF7DEA10000-0x00007FF7DED64000-memory.dmp

Filesize
3.3MB

Download
memory/1260-2076-0x00007FF7DEA10000-0x00007FF7DED64000-memory.dmp

Filesize
3.3MB

Download
memory/1276-444-0x00007FF643290000-0x00007FF6435E4000-memory.dmp

Filesize
3.3MB

Download
memory/1276-2077-0x00007FF643290000-0x00007FF6435E4000-memory.dmp

Filesize
3.3MB

Download
memory/1384-2088-0x00007FF616150000-0x00007FF6164A4000-memory.dmp

Filesize
3.3MB

Download
memory/1384-493-0x00007FF616150000-0x00007FF6164A4000-memory.dmp

Filesize
3.3MB

Download
memory/2072-549-0x00007FF6B1F60000-0x00007FF6B22B4000-memory.dmp

Filesize
3.3MB

Download
memory/2072-2095-0x00007FF6B1F60000-0x00007FF6B22B4000-memory.dmp

Filesize
3.3MB

Download
memory/2080-2086-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp

Filesize
3.3MB

Download
memory/2080-495-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp

Filesize
3.3MB

Download
memory/2088-2083-0x00007FF71E430000-0x00007FF71E784000-memory.dmp

Filesize
3.3MB

Download
memory/2088-457-0x00007FF71E430000-0x00007FF71E784000-memory.dmp

Filesize
3.3MB

Download
memory/2156-540-0x00007FF722B80000-0x00007FF722ED4000-memory.dmp

Filesize
3.3MB

Download
memory/2156-2103-0x00007FF722B80000-0x00007FF722ED4000-memory.dmp

Filesize
3.3MB

Download
memory/2596-2078-0x00007FF6C6420000-0x00007FF6C6774000-memory.dmp

Filesize
3.3MB

Download
memory/2596-2074-0x00007FF6C6420000-0x00007FF6C6774000-memory.dmp

Filesize
3.3MB

Download
memory/2596-30-0x00007FF6C6420000-0x00007FF6C6774000-memory.dmp

Filesize
3.3MB

Download
memory/3496-2085-0x00007FF6764E0000-0x00007FF676834000-memory.dmp

Filesize
3.3MB

Download
memory/3496-503-0x00007FF6764E0000-0x00007FF676834000-memory.dmp

Filesize
3.3MB

Download
memory/3668-10-0x00007FF617BA0000-0x00007FF617EF4000-memory.dmp

Filesize
3.3MB

Download
memory/3668-2075-0x00007FF617BA0000-0x00007FF617EF4000-memory.dmp

Filesize
3.3MB

Download
memory/3728-500-0x00007FF718C60000-0x00007FF718FB4000-memory.dmp

Filesize
3.3MB

Download
memory/3728-2087-0x00007FF718C60000-0x00007FF718FB4000-memory.dmp

Filesize
3.3MB

Download
memory/4204-2081-0x00007FF6DF830000-0x00007FF6DFB84000-memory.dmp

Filesize
3.3MB

Download
memory/4204-453-0x00007FF6DF830000-0x00007FF6DFB84000-memory.dmp

Filesize
3.3MB

Download
memory/4548-2090-0x00007FF6A0680000-0x00007FF6A09D4000-memory.dmp

Filesize
3.3MB

Download
memory/4548-474-0x00007FF6A0680000-0x00007FF6A09D4000-memory.dmp

Filesize
3.3MB

Download
memory/4568-2092-0x00007FF6C9630000-0x00007FF6C9984000-memory.dmp

Filesize
3.3MB

Download
memory/4568-513-0x00007FF6C9630000-0x00007FF6C9984000-memory.dmp

Filesize
3.3MB

Download
memory/4648-1-0x0000021927A30000-0x0000021927A40000-memory.dmp

Filesize
64KB

Download
memory/4648-0-0x00007FF6144E0000-0x00007FF614834000-memory.dmp

Filesize
3.3MB

Download
memory/4648-2072-0x00007FF6144E0000-0x00007FF614834000-memory.dmp

Filesize
3.3MB

Download
memory/4748-510-0x00007FF757CB0000-0x00007FF758004000-memory.dmp

Filesize
3.3MB

Download
memory/4748-2091-0x00007FF757CB0000-0x00007FF758004000-memory.dmp

Filesize
3.3MB

Download
memory/4796-2100-0x00007FF7FA810000-0x00007FF7FAB64000-memory.dmp

Filesize
3.3MB

Download
memory/4796-544-0x00007FF7FA810000-0x00007FF7FAB64000-memory.dmp

Filesize
3.3MB

Download
memory/4836-2102-0x00007FF653CF0000-0x00007FF654044000-memory.dmp

Filesize
3.3MB

Download
memory/4836-527-0x00007FF653CF0000-0x00007FF654044000-memory.dmp

Filesize
3.3MB

Download
memory/4868-550-0x00007FF7F2710000-0x00007FF7F2A64000-memory.dmp

Filesize
3.3MB

Download
memory/4868-2079-0x00007FF7F2710000-0x00007FF7F2A64000-memory.dmp

Filesize
3.3MB

Download
memory/4872-447-0x00007FF76F0A0000-0x00007FF76F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/4872-2080-0x00007FF76F0A0000-0x00007FF76F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/4932-548-0x00007FF6EA130000-0x00007FF6EA484000-memory.dmp

Filesize
3.3MB

Download
memory/4932-2096-0x00007FF6EA130000-0x00007FF6EA484000-memory.dmp

Filesize
3.3MB

Download
memory/4944-465-0x00007FF6DC7A0000-0x00007FF6DCAF4000-memory.dmp

Filesize
3.3MB

Download
memory/4944-2082-0x00007FF6DC7A0000-0x00007FF6DCAF4000-memory.dmp

Filesize
3.3MB

Download
memory/4960-2098-0x00007FF7B2F60000-0x00007FF7B32B4000-memory.dmp

Filesize
3.3MB

Download
memory/4960-546-0x00007FF7B2F60000-0x00007FF7B32B4000-memory.dmp

Filesize
3.3MB

Download
memory/5036-543-0x00007FF6A3010000-0x00007FF6A3364000-memory.dmp

Filesize
3.3MB

Download
memory/5036-2094-0x00007FF6A3010000-0x00007FF6A3364000-memory.dmp

Filesize
3.3MB

Download
memory/5044-518-0x00007FF6FD490000-0x00007FF6FD7E4000-memory.dmp

Filesize
3.3MB

Download
memory/5044-2093-0x00007FF6FD490000-0x00007FF6FD7E4000-memory.dmp

Filesize
3.3MB

Download
memory/5096-547-0x00007FF6F9180000-0x00007FF6F94D4000-memory.dmp

Filesize
3.3MB

Download
memory/5096-2097-0x00007FF6F9180000-0x00007FF6F94D4000-memory.dmp

Filesize
3.3MB

Download
memory/5104-471-0x00007FF7621E0000-0x00007FF762534000-memory.dmp

Filesize
3.3MB

Download
memory/5104-2084-0x00007FF7621E0000-0x00007FF762534000-memory.dmp

Filesize
3.3MB

Download