xmrig | ed6b11d8b9247b9d7bcdc220615a711e419b2d140e60bc6b18eeedf8160a3dd4

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
Size

2.1MB
MD5

995757e8e2cf206f9477cdf9ecbc81c0
SHA1

2b6a695bc73083e370c2ac1a49ee5d7c4f43f638
SHA256

ed6b11d8b9247b9d7bcdc220615a711e419b2d140e60bc6b18eeedf8160a3dd4
SHA512

2eb4a3e8d7a0e971e558abd45cce80a5f91385fa515930400f69eeac9c96101a57b90f55ff406f01150df70bbf4e209d3f32583ea616dab216b808a98cfdc8ff
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcYHd9qCZK+MN:BemTLkNdfE0pZrv

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/224-0-0x00007FF740EF0000-0x00007FF741244000-memory.dmp	xmrig
behavioral2/files/0x000800000002328e-5.dat	xmrig
behavioral2/memory/744-11-0x00007FF6E3FF0000-0x00007FF6E4344000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fe-26.dat	xmrig
behavioral2/files/0x00070000000233ff-31.dat	xmrig
behavioral2/files/0x0007000000023403-58.dat	xmrig
behavioral2/files/0x0007000000023405-68.dat	xmrig
behavioral2/files/0x0007000000023408-79.dat	xmrig
behavioral2/files/0x000700000002340a-92.dat	xmrig
behavioral2/files/0x000700000002340c-103.dat	xmrig
behavioral2/files/0x0007000000023410-119.dat	xmrig
behavioral2/files/0x0007000000023412-133.dat	xmrig
behavioral2/memory/2612-700-0x00007FF6F2A40000-0x00007FF6F2D94000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-167.dat	xmrig
behavioral2/files/0x0007000000023418-163.dat	xmrig
behavioral2/files/0x0007000000023419-162.dat	xmrig
behavioral2/files/0x0007000000023417-158.dat	xmrig
behavioral2/files/0x0007000000023416-153.dat	xmrig
behavioral2/files/0x0007000000023415-147.dat	xmrig
behavioral2/files/0x0007000000023414-143.dat	xmrig
behavioral2/files/0x0007000000023413-138.dat	xmrig
behavioral2/files/0x0007000000023411-127.dat	xmrig
behavioral2/files/0x000700000002340f-117.dat	xmrig
behavioral2/files/0x000700000002340e-113.dat	xmrig
behavioral2/files/0x000700000002340d-107.dat	xmrig
behavioral2/files/0x000700000002340b-98.dat	xmrig
behavioral2/files/0x0007000000023409-88.dat	xmrig
behavioral2/files/0x0007000000023407-77.dat	xmrig
behavioral2/files/0x0007000000023406-73.dat	xmrig
behavioral2/files/0x0007000000023404-62.dat	xmrig
behavioral2/files/0x0007000000023402-53.dat	xmrig
behavioral2/files/0x0007000000023401-45.dat	xmrig
behavioral2/files/0x0007000000023400-42.dat	xmrig
behavioral2/memory/5080-35-0x00007FF7B53F0000-0x00007FF7B5744000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-29.dat	xmrig
behavioral2/files/0x00070000000233fd-24.dat	xmrig
behavioral2/memory/3284-23-0x00007FF78B940000-0x00007FF78BC94000-memory.dmp	xmrig
behavioral2/memory/1376-14-0x00007FF765220000-0x00007FF765574000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fb-15.dat	xmrig
behavioral2/memory/4816-702-0x00007FF6E0160000-0x00007FF6E04B4000-memory.dmp	xmrig
behavioral2/memory/384-703-0x00007FF666C00000-0x00007FF666F54000-memory.dmp	xmrig
behavioral2/memory/5084-704-0x00007FF7AB2C0000-0x00007FF7AB614000-memory.dmp	xmrig
behavioral2/memory/3872-706-0x00007FF6A10E0000-0x00007FF6A1434000-memory.dmp	xmrig
behavioral2/memory/2588-707-0x00007FF671CB0000-0x00007FF672004000-memory.dmp	xmrig
behavioral2/memory/1648-705-0x00007FF617590000-0x00007FF6178E4000-memory.dmp	xmrig
behavioral2/memory/2172-701-0x00007FF7EE0A0000-0x00007FF7EE3F4000-memory.dmp	xmrig
behavioral2/memory/2904-708-0x00007FF63F320000-0x00007FF63F674000-memory.dmp	xmrig
behavioral2/memory/4952-709-0x00007FF6A3610000-0x00007FF6A3964000-memory.dmp	xmrig
behavioral2/memory/1948-711-0x00007FF6A4A60000-0x00007FF6A4DB4000-memory.dmp	xmrig
behavioral2/memory/4576-710-0x00007FF7727B0000-0x00007FF772B04000-memory.dmp	xmrig
behavioral2/memory/848-722-0x00007FF632B60000-0x00007FF632EB4000-memory.dmp	xmrig
behavioral2/memory/1508-735-0x00007FF6B3F10000-0x00007FF6B4264000-memory.dmp	xmrig
behavioral2/memory/4556-729-0x00007FF61DD60000-0x00007FF61E0B4000-memory.dmp	xmrig
behavioral2/memory/2140-789-0x00007FF6E02E0000-0x00007FF6E0634000-memory.dmp	xmrig
behavioral2/memory/3180-770-0x00007FF6B4ED0000-0x00007FF6B5224000-memory.dmp	xmrig
behavioral2/memory/2380-762-0x00007FF75FE30000-0x00007FF760184000-memory.dmp	xmrig
behavioral2/memory/1012-759-0x00007FF6A6A50000-0x00007FF6A6DA4000-memory.dmp	xmrig
behavioral2/memory/3748-748-0x00007FF6968B0000-0x00007FF696C04000-memory.dmp	xmrig
behavioral2/memory/4172-828-0x00007FF62C220000-0x00007FF62C574000-memory.dmp	xmrig
behavioral2/memory/712-804-0x00007FF6A8590000-0x00007FF6A88E4000-memory.dmp	xmrig
behavioral2/memory/468-810-0x00007FF74D240000-0x00007FF74D594000-memory.dmp	xmrig
behavioral2/memory/2012-852-0x00007FF603990000-0x00007FF603CE4000-memory.dmp	xmrig
behavioral2/memory/2620-868-0x00007FF68ABB0000-0x00007FF68AF04000-memory.dmp	xmrig
behavioral2/memory/1376-2105-0x00007FF765220000-0x00007FF765574000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
744	UagxKEc.exe
1376	lnpOziV.exe
3284	QlSTbzA.exe
5080	iTBPkgB.exe
4172	PlSKkFT.exe
2012	LtZknwo.exe
2620	mjrJyDe.exe
2612	enpJVpi.exe
2172	pdReynu.exe
4816	XHLIogk.exe
384	TKEXEEZ.exe
5084	EnBlADX.exe
1648	MRrGSiF.exe
3872	SHGRyuk.exe
2588	BhfwAYX.exe
2904	zMpOAcz.exe
4952	mZhPQZR.exe
4576	bQfahsc.exe
1948	WIXjbmI.exe
848	MvdKiLP.exe
4556	TcFVdpN.exe
1508	mEnQERD.exe
3748	XnXTCWs.exe
1012	BgnzdCx.exe
2380	oOMMxyM.exe
3180	vaaEjZM.exe
2140	qxGyKeh.exe
712	sTtoQmL.exe
468	KrorlHU.exe
2696	FibWMLt.exe
2544	abhtUCv.exe
4348	PYhUeDj.exe
3620	dYeXTgv.exe
3168	TjKSocv.exe
2524	JJkbnqr.exe
696	FhPhJAd.exe
3424	ExyXUfg.exe
5056	laoVtXn.exe
2580	vjJIheb.exe
3640	kHXGqpq.exe
3868	FshXYMW.exe
4028	ioFoHNx.exe
3296	HPghErr.exe
364	IBqMBgt.exe
4996	bjaKxsh.exe
4616	yWekdfv.exe
2284	vcJFVTH.exe
1236	pVfTvww.exe
1636	GKKXBdq.exe
4920	FbSKEcw.exe
852	BNkslua.exe
2520	fszzdLa.exe
420	HdXYpoL.exe
548	zEdkyPA.exe
2148	LJMoFHU.exe
3380	TWLiXJH.exe
4072	BMRUjDc.exe
4888	gTVSSVl.exe
1452	KhbamtT.exe
3548	BNfyTul.exe
2376	VDaotsZ.exe
1028	ZDOqHuX.exe
1232	CRxoWrF.exe
4164	hOkLxQN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/224-0-0x00007FF740EF0000-0x00007FF741244000-memory.dmp	upx
behavioral2/files/0x000800000002328e-5.dat	upx
behavioral2/memory/744-11-0x00007FF6E3FF0000-0x00007FF6E4344000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-26.dat	upx
behavioral2/files/0x00070000000233ff-31.dat	upx
behavioral2/files/0x0007000000023403-58.dat	upx
behavioral2/files/0x0007000000023405-68.dat	upx
behavioral2/files/0x0007000000023408-79.dat	upx
behavioral2/files/0x000700000002340a-92.dat	upx
behavioral2/files/0x000700000002340c-103.dat	upx
behavioral2/files/0x0007000000023410-119.dat	upx
behavioral2/files/0x0007000000023412-133.dat	upx
behavioral2/memory/2612-700-0x00007FF6F2A40000-0x00007FF6F2D94000-memory.dmp	upx
behavioral2/files/0x000700000002341a-167.dat	upx
behavioral2/files/0x0007000000023418-163.dat	upx
behavioral2/files/0x0007000000023419-162.dat	upx
behavioral2/files/0x0007000000023417-158.dat	upx
behavioral2/files/0x0007000000023416-153.dat	upx
behavioral2/files/0x0007000000023415-147.dat	upx
behavioral2/files/0x0007000000023414-143.dat	upx
behavioral2/files/0x0007000000023413-138.dat	upx
behavioral2/files/0x0007000000023411-127.dat	upx
behavioral2/files/0x000700000002340f-117.dat	upx
behavioral2/files/0x000700000002340e-113.dat	upx
behavioral2/files/0x000700000002340d-107.dat	upx
behavioral2/files/0x000700000002340b-98.dat	upx
behavioral2/files/0x0007000000023409-88.dat	upx
behavioral2/files/0x0007000000023407-77.dat	upx
behavioral2/files/0x0007000000023406-73.dat	upx
behavioral2/files/0x0007000000023404-62.dat	upx
behavioral2/files/0x0007000000023402-53.dat	upx
behavioral2/files/0x0007000000023401-45.dat	upx
behavioral2/files/0x0007000000023400-42.dat	upx
behavioral2/memory/5080-35-0x00007FF7B53F0000-0x00007FF7B5744000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-29.dat	upx
behavioral2/files/0x00070000000233fd-24.dat	upx
behavioral2/memory/3284-23-0x00007FF78B940000-0x00007FF78BC94000-memory.dmp	upx
behavioral2/memory/1376-14-0x00007FF765220000-0x00007FF765574000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-15.dat	upx
behavioral2/memory/4816-702-0x00007FF6E0160000-0x00007FF6E04B4000-memory.dmp	upx
behavioral2/memory/384-703-0x00007FF666C00000-0x00007FF666F54000-memory.dmp	upx
behavioral2/memory/5084-704-0x00007FF7AB2C0000-0x00007FF7AB614000-memory.dmp	upx
behavioral2/memory/3872-706-0x00007FF6A10E0000-0x00007FF6A1434000-memory.dmp	upx
behavioral2/memory/2588-707-0x00007FF671CB0000-0x00007FF672004000-memory.dmp	upx
behavioral2/memory/1648-705-0x00007FF617590000-0x00007FF6178E4000-memory.dmp	upx
behavioral2/memory/2172-701-0x00007FF7EE0A0000-0x00007FF7EE3F4000-memory.dmp	upx
behavioral2/memory/2904-708-0x00007FF63F320000-0x00007FF63F674000-memory.dmp	upx
behavioral2/memory/4952-709-0x00007FF6A3610000-0x00007FF6A3964000-memory.dmp	upx
behavioral2/memory/1948-711-0x00007FF6A4A60000-0x00007FF6A4DB4000-memory.dmp	upx
behavioral2/memory/4576-710-0x00007FF7727B0000-0x00007FF772B04000-memory.dmp	upx
behavioral2/memory/848-722-0x00007FF632B60000-0x00007FF632EB4000-memory.dmp	upx
behavioral2/memory/1508-735-0x00007FF6B3F10000-0x00007FF6B4264000-memory.dmp	upx
behavioral2/memory/4556-729-0x00007FF61DD60000-0x00007FF61E0B4000-memory.dmp	upx
behavioral2/memory/2140-789-0x00007FF6E02E0000-0x00007FF6E0634000-memory.dmp	upx
behavioral2/memory/3180-770-0x00007FF6B4ED0000-0x00007FF6B5224000-memory.dmp	upx
behavioral2/memory/2380-762-0x00007FF75FE30000-0x00007FF760184000-memory.dmp	upx
behavioral2/memory/1012-759-0x00007FF6A6A50000-0x00007FF6A6DA4000-memory.dmp	upx
behavioral2/memory/3748-748-0x00007FF6968B0000-0x00007FF696C04000-memory.dmp	upx
behavioral2/memory/4172-828-0x00007FF62C220000-0x00007FF62C574000-memory.dmp	upx
behavioral2/memory/712-804-0x00007FF6A8590000-0x00007FF6A88E4000-memory.dmp	upx
behavioral2/memory/468-810-0x00007FF74D240000-0x00007FF74D594000-memory.dmp	upx
behavioral2/memory/2012-852-0x00007FF603990000-0x00007FF603CE4000-memory.dmp	upx
behavioral2/memory/2620-868-0x00007FF68ABB0000-0x00007FF68AF04000-memory.dmp	upx
behavioral2/memory/1376-2105-0x00007FF765220000-0x00007FF765574000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CKHhXtB.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\tRswuwz.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\AhGWKty.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\rGSOVFi.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\YeshQph.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\bNFTHaK.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\BwraOXH.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\uqDFgTF.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\HpYfAKa.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\bjaKxsh.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\ZMBkucH.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\DGMhFPB.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\ptrptQr.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\ccZsfrV.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\QawaXZz.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\qatfZeP.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\WPNOlAo.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\VeqWDUI.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\TjKSocv.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\KVkfNTa.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\wMFvSby.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\AhaHkkM.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\pVfTvww.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\BYJpDSx.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\SigRSWS.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\RicwOAC.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\JJkbnqr.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\murgsUG.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\eIEDgKt.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\wTEMjpC.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\OBdJcEj.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\tEmooai.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\OmininC.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\iOavjBK.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\XnXTCWs.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\vaaEjZM.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\BoMCyku.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\IvPraxp.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\NwROovY.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\abhtUCv.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\usEuSFG.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\ikhXYuF.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\ITXfyxE.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\lLbLdFw.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\ooZrtKD.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\HSlgAHq.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\MzsvwZQ.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\XzZjGUC.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\XhjYoJU.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\YqQrbZC.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\njjRiPh.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\vErykNT.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\QZaDWvv.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\zTRsdYz.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\TQftyPN.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\KJBHzwT.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\sqymHrd.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\aRwXjsG.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\peMTgbw.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\ivwEVjh.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\MvdKiLP.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\LJMoFHU.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\UMklSoR.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
File created	C:\Windows\System\MMYcuxH.exe	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 744	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	84
PID 224 wrote to memory of 744	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	84
PID 224 wrote to memory of 1376	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	85
PID 224 wrote to memory of 1376	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	85
PID 224 wrote to memory of 3284	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	86
PID 224 wrote to memory of 3284	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	86
PID 224 wrote to memory of 5080	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	87
PID 224 wrote to memory of 5080	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	87
PID 224 wrote to memory of 4172	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	88
PID 224 wrote to memory of 4172	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	88
PID 224 wrote to memory of 2012	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	89
PID 224 wrote to memory of 2012	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	89
PID 224 wrote to memory of 2620	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	90
PID 224 wrote to memory of 2620	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	90
PID 224 wrote to memory of 2612	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	91
PID 224 wrote to memory of 2612	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	91
PID 224 wrote to memory of 2172	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	92
PID 224 wrote to memory of 2172	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	92
PID 224 wrote to memory of 4816	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	93
PID 224 wrote to memory of 4816	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	93
PID 224 wrote to memory of 384	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	94
PID 224 wrote to memory of 384	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	94
PID 224 wrote to memory of 5084	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	95
PID 224 wrote to memory of 5084	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	95
PID 224 wrote to memory of 1648	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	96
PID 224 wrote to memory of 1648	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	96
PID 224 wrote to memory of 3872	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	97
PID 224 wrote to memory of 3872	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	97
PID 224 wrote to memory of 2588	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	98
PID 224 wrote to memory of 2588	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	98
PID 224 wrote to memory of 2904	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	99
PID 224 wrote to memory of 2904	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	99
PID 224 wrote to memory of 4952	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	100
PID 224 wrote to memory of 4952	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	100
PID 224 wrote to memory of 4576	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	101
PID 224 wrote to memory of 4576	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	101
PID 224 wrote to memory of 1948	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	102
PID 224 wrote to memory of 1948	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	102
PID 224 wrote to memory of 848	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	103
PID 224 wrote to memory of 848	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	103
PID 224 wrote to memory of 4556	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	104
PID 224 wrote to memory of 4556	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	104
PID 224 wrote to memory of 1508	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	105
PID 224 wrote to memory of 1508	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	105
PID 224 wrote to memory of 3748	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	106
PID 224 wrote to memory of 3748	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	106
PID 224 wrote to memory of 1012	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	107
PID 224 wrote to memory of 1012	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	107
PID 224 wrote to memory of 2380	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	108
PID 224 wrote to memory of 2380	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	108
PID 224 wrote to memory of 3180	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	109
PID 224 wrote to memory of 3180	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	109
PID 224 wrote to memory of 2140	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	110
PID 224 wrote to memory of 2140	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	110
PID 224 wrote to memory of 712	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	111
PID 224 wrote to memory of 712	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	111
PID 224 wrote to memory of 468	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	112
PID 224 wrote to memory of 468	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	112
PID 224 wrote to memory of 2696	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	113
PID 224 wrote to memory of 2696	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	113
PID 224 wrote to memory of 2544	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	114
PID 224 wrote to memory of 2544	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	114
PID 224 wrote to memory of 4348	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	115
PID 224 wrote to memory of 4348	224	995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\995757e8e2cf206f9477cdf9ecbc81c0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\System\UagxKEc.exe
  C:\Windows\System\UagxKEc.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\lnpOziV.exe
  C:\Windows\System\lnpOziV.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\QlSTbzA.exe
  C:\Windows\System\QlSTbzA.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\iTBPkgB.exe
  C:\Windows\System\iTBPkgB.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\PlSKkFT.exe
  C:\Windows\System\PlSKkFT.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\LtZknwo.exe
  C:\Windows\System\LtZknwo.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\mjrJyDe.exe
  C:\Windows\System\mjrJyDe.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\enpJVpi.exe
  C:\Windows\System\enpJVpi.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\pdReynu.exe
  C:\Windows\System\pdReynu.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\XHLIogk.exe
  C:\Windows\System\XHLIogk.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\TKEXEEZ.exe
  C:\Windows\System\TKEXEEZ.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\EnBlADX.exe
  C:\Windows\System\EnBlADX.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\MRrGSiF.exe
  C:\Windows\System\MRrGSiF.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\SHGRyuk.exe
  C:\Windows\System\SHGRyuk.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\BhfwAYX.exe
  C:\Windows\System\BhfwAYX.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\zMpOAcz.exe
  C:\Windows\System\zMpOAcz.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\mZhPQZR.exe
  C:\Windows\System\mZhPQZR.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\bQfahsc.exe
  C:\Windows\System\bQfahsc.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\WIXjbmI.exe
  C:\Windows\System\WIXjbmI.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\MvdKiLP.exe
  C:\Windows\System\MvdKiLP.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\TcFVdpN.exe
  C:\Windows\System\TcFVdpN.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\mEnQERD.exe
  C:\Windows\System\mEnQERD.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\XnXTCWs.exe
  C:\Windows\System\XnXTCWs.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\BgnzdCx.exe
  C:\Windows\System\BgnzdCx.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\oOMMxyM.exe
  C:\Windows\System\oOMMxyM.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\vaaEjZM.exe
  C:\Windows\System\vaaEjZM.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\qxGyKeh.exe
  C:\Windows\System\qxGyKeh.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\sTtoQmL.exe
  C:\Windows\System\sTtoQmL.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\KrorlHU.exe
  C:\Windows\System\KrorlHU.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\FibWMLt.exe
  C:\Windows\System\FibWMLt.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\abhtUCv.exe
  C:\Windows\System\abhtUCv.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\PYhUeDj.exe
  C:\Windows\System\PYhUeDj.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\dYeXTgv.exe
  C:\Windows\System\dYeXTgv.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\TjKSocv.exe
  C:\Windows\System\TjKSocv.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\JJkbnqr.exe
  C:\Windows\System\JJkbnqr.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\FhPhJAd.exe
  C:\Windows\System\FhPhJAd.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\ExyXUfg.exe
  C:\Windows\System\ExyXUfg.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\laoVtXn.exe
  C:\Windows\System\laoVtXn.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\vjJIheb.exe
  C:\Windows\System\vjJIheb.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\kHXGqpq.exe
  C:\Windows\System\kHXGqpq.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\FshXYMW.exe
  C:\Windows\System\FshXYMW.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\ioFoHNx.exe
  C:\Windows\System\ioFoHNx.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\HPghErr.exe
  C:\Windows\System\HPghErr.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\IBqMBgt.exe
  C:\Windows\System\IBqMBgt.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\bjaKxsh.exe
  C:\Windows\System\bjaKxsh.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\yWekdfv.exe
  C:\Windows\System\yWekdfv.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\vcJFVTH.exe
  C:\Windows\System\vcJFVTH.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\pVfTvww.exe
  C:\Windows\System\pVfTvww.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\GKKXBdq.exe
  C:\Windows\System\GKKXBdq.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\FbSKEcw.exe
  C:\Windows\System\FbSKEcw.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\BNkslua.exe
  C:\Windows\System\BNkslua.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\fszzdLa.exe
  C:\Windows\System\fszzdLa.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\HdXYpoL.exe
  C:\Windows\System\HdXYpoL.exe
  2⤵
  - Executes dropped EXE
  PID:420
- C:\Windows\System\zEdkyPA.exe
  C:\Windows\System\zEdkyPA.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\LJMoFHU.exe
  C:\Windows\System\LJMoFHU.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\TWLiXJH.exe
  C:\Windows\System\TWLiXJH.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\BMRUjDc.exe
  C:\Windows\System\BMRUjDc.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\gTVSSVl.exe
  C:\Windows\System\gTVSSVl.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\KhbamtT.exe
  C:\Windows\System\KhbamtT.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\BNfyTul.exe
  C:\Windows\System\BNfyTul.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\VDaotsZ.exe
  C:\Windows\System\VDaotsZ.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ZDOqHuX.exe
  C:\Windows\System\ZDOqHuX.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\CRxoWrF.exe
  C:\Windows\System\CRxoWrF.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\hOkLxQN.exe
  C:\Windows\System\hOkLxQN.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\FazzigU.exe
  C:\Windows\System\FazzigU.exe
  2⤵
  PID:3592
- C:\Windows\System\yPlQSlS.exe
  C:\Windows\System\yPlQSlS.exe
  2⤵
  PID:2184
- C:\Windows\System\ABztXSf.exe
  C:\Windows\System\ABztXSf.exe
  2⤵
  PID:3356
- C:\Windows\System\DmxhYLS.exe
  C:\Windows\System\DmxhYLS.exe
  2⤵
  PID:3196
- C:\Windows\System\AACybYR.exe
  C:\Windows\System\AACybYR.exe
  2⤵
  PID:4720
- C:\Windows\System\PamBJRP.exe
  C:\Windows\System\PamBJRP.exe
  2⤵
  PID:1492
- C:\Windows\System\OxKdIXc.exe
  C:\Windows\System\OxKdIXc.exe
  2⤵
  PID:1484
- C:\Windows\System\InVtFXd.exe
  C:\Windows\System\InVtFXd.exe
  2⤵
  PID:828
- C:\Windows\System\wGszJuM.exe
  C:\Windows\System\wGszJuM.exe
  2⤵
  PID:1408
- C:\Windows\System\HpesbKb.exe
  C:\Windows\System\HpesbKb.exe
  2⤵
  PID:3716
- C:\Windows\System\NGAackd.exe
  C:\Windows\System\NGAackd.exe
  2⤵
  PID:660
- C:\Windows\System\qdwounE.exe
  C:\Windows\System\qdwounE.exe
  2⤵
  PID:1388
- C:\Windows\System\jUwRoNw.exe
  C:\Windows\System\jUwRoNw.exe
  2⤵
  PID:5124
- C:\Windows\System\PxuKyEB.exe
  C:\Windows\System\PxuKyEB.exe
  2⤵
  PID:5152
- C:\Windows\System\pbkCbeq.exe
  C:\Windows\System\pbkCbeq.exe
  2⤵
  PID:5180
- C:\Windows\System\BCSIeky.exe
  C:\Windows\System\BCSIeky.exe
  2⤵
  PID:5208
- C:\Windows\System\fkdAjqj.exe
  C:\Windows\System\fkdAjqj.exe
  2⤵
  PID:5236
- C:\Windows\System\uUBrdLm.exe
  C:\Windows\System\uUBrdLm.exe
  2⤵
  PID:5264
- C:\Windows\System\XzZjGUC.exe
  C:\Windows\System\XzZjGUC.exe
  2⤵
  PID:5292
- C:\Windows\System\DfPkGFh.exe
  C:\Windows\System\DfPkGFh.exe
  2⤵
  PID:5320
- C:\Windows\System\CvjzPsc.exe
  C:\Windows\System\CvjzPsc.exe
  2⤵
  PID:5348
- C:\Windows\System\ShlFgKx.exe
  C:\Windows\System\ShlFgKx.exe
  2⤵
  PID:5376
- C:\Windows\System\cGaDHUi.exe
  C:\Windows\System\cGaDHUi.exe
  2⤵
  PID:5404
- C:\Windows\System\KUmnKcd.exe
  C:\Windows\System\KUmnKcd.exe
  2⤵
  PID:5432
- C:\Windows\System\bNsqtLy.exe
  C:\Windows\System\bNsqtLy.exe
  2⤵
  PID:5460
- C:\Windows\System\WWRVfAC.exe
  C:\Windows\System\WWRVfAC.exe
  2⤵
  PID:5488
- C:\Windows\System\oSWOgcP.exe
  C:\Windows\System\oSWOgcP.exe
  2⤵
  PID:5516
- C:\Windows\System\vbBLhTH.exe
  C:\Windows\System\vbBLhTH.exe
  2⤵
  PID:5540
- C:\Windows\System\bhwxzbF.exe
  C:\Windows\System\bhwxzbF.exe
  2⤵
  PID:5572
- C:\Windows\System\nuUrXzS.exe
  C:\Windows\System\nuUrXzS.exe
  2⤵
  PID:5600
- C:\Windows\System\OOpaxYp.exe
  C:\Windows\System\OOpaxYp.exe
  2⤵
  PID:5628
- C:\Windows\System\DqwscAW.exe
  C:\Windows\System\DqwscAW.exe
  2⤵
  PID:5656
- C:\Windows\System\QRIRjAC.exe
  C:\Windows\System\QRIRjAC.exe
  2⤵
  PID:5684
- C:\Windows\System\KyJJTSJ.exe
  C:\Windows\System\KyJJTSJ.exe
  2⤵
  PID:5712
- C:\Windows\System\wkofHSO.exe
  C:\Windows\System\wkofHSO.exe
  2⤵
  PID:5740
- C:\Windows\System\UKCzAGC.exe
  C:\Windows\System\UKCzAGC.exe
  2⤵
  PID:5768
- C:\Windows\System\WVDmoYR.exe
  C:\Windows\System\WVDmoYR.exe
  2⤵
  PID:5796
- C:\Windows\System\jtPYKut.exe
  C:\Windows\System\jtPYKut.exe
  2⤵
  PID:5820
- C:\Windows\System\zVIiofm.exe
  C:\Windows\System\zVIiofm.exe
  2⤵
  PID:5852
- C:\Windows\System\ttrYSGG.exe
  C:\Windows\System\ttrYSGG.exe
  2⤵
  PID:5880
- C:\Windows\System\zZIPVAl.exe
  C:\Windows\System\zZIPVAl.exe
  2⤵
  PID:5908
- C:\Windows\System\evGwIUm.exe
  C:\Windows\System\evGwIUm.exe
  2⤵
  PID:5936
- C:\Windows\System\nIJgGNS.exe
  C:\Windows\System\nIJgGNS.exe
  2⤵
  PID:5964
- C:\Windows\System\bYeGQwr.exe
  C:\Windows\System\bYeGQwr.exe
  2⤵
  PID:5992
- C:\Windows\System\kkDOuHB.exe
  C:\Windows\System\kkDOuHB.exe
  2⤵
  PID:6020
- C:\Windows\System\fdzfxah.exe
  C:\Windows\System\fdzfxah.exe
  2⤵
  PID:6048
- C:\Windows\System\JkALbzi.exe
  C:\Windows\System\JkALbzi.exe
  2⤵
  PID:6076
- C:\Windows\System\wsNoHSO.exe
  C:\Windows\System\wsNoHSO.exe
  2⤵
  PID:6104
- C:\Windows\System\dPAcYYo.exe
  C:\Windows\System\dPAcYYo.exe
  2⤵
  PID:6132
- C:\Windows\System\TyUJUbv.exe
  C:\Windows\System\TyUJUbv.exe
  2⤵
  PID:3088
- C:\Windows\System\gupygUs.exe
  C:\Windows\System\gupygUs.exe
  2⤵
  PID:2256
- C:\Windows\System\IXouoMQ.exe
  C:\Windows\System\IXouoMQ.exe
  2⤵
  PID:1968
- C:\Windows\System\TQCSutx.exe
  C:\Windows\System\TQCSutx.exe
  2⤵
  PID:4344
- C:\Windows\System\OGtyuad.exe
  C:\Windows\System\OGtyuad.exe
  2⤵
  PID:2676
- C:\Windows\System\kElKkeH.exe
  C:\Windows\System\kElKkeH.exe
  2⤵
  PID:4116
- C:\Windows\System\apqaEkE.exe
  C:\Windows\System\apqaEkE.exe
  2⤵
  PID:5144
- C:\Windows\System\RDpNzhU.exe
  C:\Windows\System\RDpNzhU.exe
  2⤵
  PID:5224
- C:\Windows\System\kQVeYTp.exe
  C:\Windows\System\kQVeYTp.exe
  2⤵
  PID:5284
- C:\Windows\System\UMklSoR.exe
  C:\Windows\System\UMklSoR.exe
  2⤵
  PID:5360
- C:\Windows\System\tRswuwz.exe
  C:\Windows\System\tRswuwz.exe
  2⤵
  PID:5416
- C:\Windows\System\pxZrvEm.exe
  C:\Windows\System\pxZrvEm.exe
  2⤵
  PID:5480
- C:\Windows\System\DeIOziB.exe
  C:\Windows\System\DeIOziB.exe
  2⤵
  PID:5556
- C:\Windows\System\sCAZOAj.exe
  C:\Windows\System\sCAZOAj.exe
  2⤵
  PID:5616
- C:\Windows\System\uMIXheL.exe
  C:\Windows\System\uMIXheL.exe
  2⤵
  PID:5676
- C:\Windows\System\SQrxRGa.exe
  C:\Windows\System\SQrxRGa.exe
  2⤵
  PID:5752
- C:\Windows\System\YMosgnE.exe
  C:\Windows\System\YMosgnE.exe
  2⤵
  PID:5812
- C:\Windows\System\mmnnnVu.exe
  C:\Windows\System\mmnnnVu.exe
  2⤵
  PID:5872
- C:\Windows\System\FsGPlYg.exe
  C:\Windows\System\FsGPlYg.exe
  2⤵
  PID:5948
- C:\Windows\System\kpRglzh.exe
  C:\Windows\System\kpRglzh.exe
  2⤵
  PID:6008
- C:\Windows\System\DKsUhrc.exe
  C:\Windows\System\DKsUhrc.exe
  2⤵
  PID:6088
- C:\Windows\System\mrFhwOJ.exe
  C:\Windows\System\mrFhwOJ.exe
  2⤵
  PID:4904
- C:\Windows\System\EoRzpgJ.exe
  C:\Windows\System\EoRzpgJ.exe
  2⤵
  PID:4728
- C:\Windows\System\jQQqHDy.exe
  C:\Windows\System\jQQqHDy.exe
  2⤵
  PID:4940
- C:\Windows\System\gmYfKHX.exe
  C:\Windows\System\gmYfKHX.exe
  2⤵
  PID:5196
- C:\Windows\System\dYHjzgC.exe
  C:\Windows\System\dYHjzgC.exe
  2⤵
  PID:5312
- C:\Windows\System\ZMBkucH.exe
  C:\Windows\System\ZMBkucH.exe
  2⤵
  PID:5452
- C:\Windows\System\wIJyBIR.exe
  C:\Windows\System\wIJyBIR.exe
  2⤵
  PID:5592
- C:\Windows\System\AwzIIwJ.exe
  C:\Windows\System\AwzIIwJ.exe
  2⤵
  PID:5728
- C:\Windows\System\xWZgYqV.exe
  C:\Windows\System\xWZgYqV.exe
  2⤵
  PID:5900
- C:\Windows\System\murgsUG.exe
  C:\Windows\System\murgsUG.exe
  2⤵
  PID:6172
- C:\Windows\System\YXFNccE.exe
  C:\Windows\System\YXFNccE.exe
  2⤵
  PID:6200
- C:\Windows\System\nuHfoKt.exe
  C:\Windows\System\nuHfoKt.exe
  2⤵
  PID:6228
- C:\Windows\System\VeyuhCA.exe
  C:\Windows\System\VeyuhCA.exe
  2⤵
  PID:6256
- C:\Windows\System\qXnHMgD.exe
  C:\Windows\System\qXnHMgD.exe
  2⤵
  PID:6284
- C:\Windows\System\LPHYtDf.exe
  C:\Windows\System\LPHYtDf.exe
  2⤵
  PID:6312
- C:\Windows\System\uBnLOAp.exe
  C:\Windows\System\uBnLOAp.exe
  2⤵
  PID:6340
- C:\Windows\System\VNfjHAf.exe
  C:\Windows\System\VNfjHAf.exe
  2⤵
  PID:6376
- C:\Windows\System\IyUVnOf.exe
  C:\Windows\System\IyUVnOf.exe
  2⤵
  PID:6408
- C:\Windows\System\EntEGZH.exe
  C:\Windows\System\EntEGZH.exe
  2⤵
  PID:6436
- C:\Windows\System\HEjhEfM.exe
  C:\Windows\System\HEjhEfM.exe
  2⤵
  PID:6452
- C:\Windows\System\MWlYxaX.exe
  C:\Windows\System\MWlYxaX.exe
  2⤵
  PID:6480
- C:\Windows\System\nObzJeW.exe
  C:\Windows\System\nObzJeW.exe
  2⤵
  PID:6508
- C:\Windows\System\KWLulXv.exe
  C:\Windows\System\KWLulXv.exe
  2⤵
  PID:6536
- C:\Windows\System\ttDxIAe.exe
  C:\Windows\System\ttDxIAe.exe
  2⤵
  PID:6564
- C:\Windows\System\WQvDBvW.exe
  C:\Windows\System\WQvDBvW.exe
  2⤵
  PID:6592
- C:\Windows\System\dtKPtHG.exe
  C:\Windows\System\dtKPtHG.exe
  2⤵
  PID:6620
- C:\Windows\System\oGSLlJw.exe
  C:\Windows\System\oGSLlJw.exe
  2⤵
  PID:6648
- C:\Windows\System\kKgrtLL.exe
  C:\Windows\System\kKgrtLL.exe
  2⤵
  PID:6676
- C:\Windows\System\BoMCyku.exe
  C:\Windows\System\BoMCyku.exe
  2⤵
  PID:6704
- C:\Windows\System\YdyFIxz.exe
  C:\Windows\System\YdyFIxz.exe
  2⤵
  PID:6732
- C:\Windows\System\WjYbxBb.exe
  C:\Windows\System\WjYbxBb.exe
  2⤵
  PID:6760
- C:\Windows\System\KnkWdXC.exe
  C:\Windows\System\KnkWdXC.exe
  2⤵
  PID:6788
- C:\Windows\System\DGMhFPB.exe
  C:\Windows\System\DGMhFPB.exe
  2⤵
  PID:6816
- C:\Windows\System\QZaDWvv.exe
  C:\Windows\System\QZaDWvv.exe
  2⤵
  PID:6844
- C:\Windows\System\zXFTgOY.exe
  C:\Windows\System\zXFTgOY.exe
  2⤵
  PID:6868
- C:\Windows\System\tRRmRrt.exe
  C:\Windows\System\tRRmRrt.exe
  2⤵
  PID:6900
- C:\Windows\System\kSRUnyC.exe
  C:\Windows\System\kSRUnyC.exe
  2⤵
  PID:6928
- C:\Windows\System\ZWDYZbA.exe
  C:\Windows\System\ZWDYZbA.exe
  2⤵
  PID:6956
- C:\Windows\System\EjHAnFW.exe
  C:\Windows\System\EjHAnFW.exe
  2⤵
  PID:6984
- C:\Windows\System\AeoXcrj.exe
  C:\Windows\System\AeoXcrj.exe
  2⤵
  PID:7012
- C:\Windows\System\LgIechw.exe
  C:\Windows\System\LgIechw.exe
  2⤵
  PID:7040
- C:\Windows\System\SUXsPjk.exe
  C:\Windows\System\SUXsPjk.exe
  2⤵
  PID:7068
- C:\Windows\System\hEzVAuN.exe
  C:\Windows\System\hEzVAuN.exe
  2⤵
  PID:7096
- C:\Windows\System\zDaKnSe.exe
  C:\Windows\System\zDaKnSe.exe
  2⤵
  PID:7124
- C:\Windows\System\BYODfyf.exe
  C:\Windows\System\BYODfyf.exe
  2⤵
  PID:7152
- C:\Windows\System\pdyJxGe.exe
  C:\Windows\System\pdyJxGe.exe
  2⤵
  PID:5980
- C:\Windows\System\NNYmWiz.exe
  C:\Windows\System\NNYmWiz.exe
  2⤵
  PID:6124
- C:\Windows\System\QBuAHfJ.exe
  C:\Windows\System\QBuAHfJ.exe
  2⤵
  PID:1048
- C:\Windows\System\qqeQEiG.exe
  C:\Windows\System\qqeQEiG.exe
  2⤵
  PID:5392
- C:\Windows\System\ESQGZVK.exe
  C:\Windows\System\ESQGZVK.exe
  2⤵
  PID:5704
- C:\Windows\System\ptrptQr.exe
  C:\Windows\System\ptrptQr.exe
  2⤵
  PID:6184
- C:\Windows\System\rixpTna.exe
  C:\Windows\System\rixpTna.exe
  2⤵
  PID:6220
- C:\Windows\System\tEcGuQr.exe
  C:\Windows\System\tEcGuQr.exe
  2⤵
  PID:6296
- C:\Windows\System\cYrybAI.exe
  C:\Windows\System\cYrybAI.exe
  2⤵
  PID:6356
- C:\Windows\System\PkcFifd.exe
  C:\Windows\System\PkcFifd.exe
  2⤵
  PID:6424
- C:\Windows\System\BRnqiNj.exe
  C:\Windows\System\BRnqiNj.exe
  2⤵
  PID:6472
- C:\Windows\System\qatfZeP.exe
  C:\Windows\System\qatfZeP.exe
  2⤵
  PID:6548
- C:\Windows\System\FIkKZQN.exe
  C:\Windows\System\FIkKZQN.exe
  2⤵
  PID:6608
- C:\Windows\System\QTtPOaT.exe
  C:\Windows\System\QTtPOaT.exe
  2⤵
  PID:6660
- C:\Windows\System\djSLLIv.exe
  C:\Windows\System\djSLLIv.exe
  2⤵
  PID:6716
- C:\Windows\System\NlnbGkP.exe
  C:\Windows\System\NlnbGkP.exe
  2⤵
  PID:6776
- C:\Windows\System\CqUJlGs.exe
  C:\Windows\System\CqUJlGs.exe
  2⤵
  PID:6832
- C:\Windows\System\pnzcUKd.exe
  C:\Windows\System\pnzcUKd.exe
  2⤵
  PID:6888
- C:\Windows\System\wekXDyl.exe
  C:\Windows\System\wekXDyl.exe
  2⤵
  PID:6948
- C:\Windows\System\CICCauS.exe
  C:\Windows\System\CICCauS.exe
  2⤵
  PID:7004
- C:\Windows\System\Dfgcaoi.exe
  C:\Windows\System\Dfgcaoi.exe
  2⤵
  PID:7056
- C:\Windows\System\aFmUzqe.exe
  C:\Windows\System\aFmUzqe.exe
  2⤵
  PID:7108
- C:\Windows\System\ogRYdsd.exe
  C:\Windows\System\ogRYdsd.exe
  2⤵
  PID:5920
- C:\Windows\System\TjNHPfZ.exe
  C:\Windows\System\TjNHPfZ.exe
  2⤵
  PID:1796
- C:\Windows\System\TGjYlzK.exe
  C:\Windows\System\TGjYlzK.exe
  2⤵
  PID:5648
- C:\Windows\System\CtYdOOD.exe
  C:\Windows\System\CtYdOOD.exe
  2⤵
  PID:1196
- C:\Windows\System\RBKCwyM.exe
  C:\Windows\System\RBKCwyM.exe
  2⤵
  PID:6332
- C:\Windows\System\dofAnnm.exe
  C:\Windows\System\dofAnnm.exe
  2⤵
  PID:6444
- C:\Windows\System\RbyDyDL.exe
  C:\Windows\System\RbyDyDL.exe
  2⤵
  PID:6524
- C:\Windows\System\aBrmwkF.exe
  C:\Windows\System\aBrmwkF.exe
  2⤵
  PID:6640
- C:\Windows\System\LBkaIct.exe
  C:\Windows\System\LBkaIct.exe
  2⤵
  PID:1324
- C:\Windows\System\xwOgkso.exe
  C:\Windows\System\xwOgkso.exe
  2⤵
  PID:6860
- C:\Windows\System\lLbLdFw.exe
  C:\Windows\System\lLbLdFw.exe
  2⤵
  PID:5256
- C:\Windows\System\SAvHEmI.exe
  C:\Windows\System\SAvHEmI.exe
  2⤵
  PID:6160
- C:\Windows\System\DhLRjgV.exe
  C:\Windows\System\DhLRjgV.exe
  2⤵
  PID:4928
- C:\Windows\System\vvFENNH.exe
  C:\Windows\System\vvFENNH.exe
  2⤵
  PID:2056
- C:\Windows\System\htKuoUV.exe
  C:\Windows\System\htKuoUV.exe
  2⤵
  PID:6744
- C:\Windows\System\MVMbJJn.exe
  C:\Windows\System\MVMbJJn.exe
  2⤵
  PID:6636
- C:\Windows\System\XLkHZqQ.exe
  C:\Windows\System\XLkHZqQ.exe
  2⤵
  PID:2776
- C:\Windows\System\ajftjbA.exe
  C:\Windows\System\ajftjbA.exe
  2⤵
  PID:3852
- C:\Windows\System\CZiArmV.exe
  C:\Windows\System\CZiArmV.exe
  2⤵
  PID:4152
- C:\Windows\System\IUNdoaZ.exe
  C:\Windows\System\IUNdoaZ.exe
  2⤵
  PID:3648
- C:\Windows\System\nDCwgfV.exe
  C:\Windows\System\nDCwgfV.exe
  2⤵
  PID:1936
- C:\Windows\System\CmSuLty.exe
  C:\Windows\System\CmSuLty.exe
  2⤵
  PID:1528
- C:\Windows\System\CSLhYPc.exe
  C:\Windows\System\CSLhYPc.exe
  2⤵
  PID:7144
- C:\Windows\System\TyeuFLx.exe
  C:\Windows\System\TyeuFLx.exe
  2⤵
  PID:1972
- C:\Windows\System\AAObotz.exe
  C:\Windows\System\AAObotz.exe
  2⤵
  PID:1260
- C:\Windows\System\UabHLnP.exe
  C:\Windows\System\UabHLnP.exe
  2⤵
  PID:1432
- C:\Windows\System\vtmgfzy.exe
  C:\Windows\System\vtmgfzy.exe
  2⤵
  PID:6396
- C:\Windows\System\NeDvWSj.exe
  C:\Windows\System\NeDvWSj.exe
  2⤵
  PID:2888
- C:\Windows\System\AhGWKty.exe
  C:\Windows\System\AhGWKty.exe
  2⤵
  PID:7180
- C:\Windows\System\MPxQgrT.exe
  C:\Windows\System\MPxQgrT.exe
  2⤵
  PID:7200
- C:\Windows\System\hrNevol.exe
  C:\Windows\System\hrNevol.exe
  2⤵
  PID:7228
- C:\Windows\System\CLbBdRT.exe
  C:\Windows\System\CLbBdRT.exe
  2⤵
  PID:7248
- C:\Windows\System\mAcPKtp.exe
  C:\Windows\System\mAcPKtp.exe
  2⤵
  PID:7268
- C:\Windows\System\zTRsdYz.exe
  C:\Windows\System\zTRsdYz.exe
  2⤵
  PID:7308
- C:\Windows\System\oPdSJSF.exe
  C:\Windows\System\oPdSJSF.exe
  2⤵
  PID:7332
- C:\Windows\System\SDrllrA.exe
  C:\Windows\System\SDrllrA.exe
  2⤵
  PID:7372
- C:\Windows\System\CQzEZND.exe
  C:\Windows\System\CQzEZND.exe
  2⤵
  PID:7404
- C:\Windows\System\tolBSRd.exe
  C:\Windows\System\tolBSRd.exe
  2⤵
  PID:7424
- C:\Windows\System\ynQrXZY.exe
  C:\Windows\System\ynQrXZY.exe
  2⤵
  PID:7448
- C:\Windows\System\gQETLBk.exe
  C:\Windows\System\gQETLBk.exe
  2⤵
  PID:7472
- C:\Windows\System\JVOSzcz.exe
  C:\Windows\System\JVOSzcz.exe
  2⤵
  PID:7512
- C:\Windows\System\dRmiSLM.exe
  C:\Windows\System\dRmiSLM.exe
  2⤵
  PID:7544
- C:\Windows\System\mOtFYle.exe
  C:\Windows\System\mOtFYle.exe
  2⤵
  PID:7568
- C:\Windows\System\VsRwPKT.exe
  C:\Windows\System\VsRwPKT.exe
  2⤵
  PID:7588
- C:\Windows\System\PGdCTCc.exe
  C:\Windows\System\PGdCTCc.exe
  2⤵
  PID:7612
- C:\Windows\System\LMYHXMD.exe
  C:\Windows\System\LMYHXMD.exe
  2⤵
  PID:7632
- C:\Windows\System\ccZsfrV.exe
  C:\Windows\System\ccZsfrV.exe
  2⤵
  PID:7664
- C:\Windows\System\xbmXeFV.exe
  C:\Windows\System\xbmXeFV.exe
  2⤵
  PID:7692
- C:\Windows\System\PbnaeUJ.exe
  C:\Windows\System\PbnaeUJ.exe
  2⤵
  PID:7720
- C:\Windows\System\ImIDxLC.exe
  C:\Windows\System\ImIDxLC.exe
  2⤵
  PID:7736
- C:\Windows\System\kKmFRFc.exe
  C:\Windows\System\kKmFRFc.exe
  2⤵
  PID:7752
- C:\Windows\System\gZOqwKQ.exe
  C:\Windows\System\gZOqwKQ.exe
  2⤵
  PID:7772
- C:\Windows\System\LAHLPEL.exe
  C:\Windows\System\LAHLPEL.exe
  2⤵
  PID:7800
- C:\Windows\System\oieyKXv.exe
  C:\Windows\System\oieyKXv.exe
  2⤵
  PID:7824
- C:\Windows\System\aufvFlp.exe
  C:\Windows\System\aufvFlp.exe
  2⤵
  PID:7864
- C:\Windows\System\JdDiBbA.exe
  C:\Windows\System\JdDiBbA.exe
  2⤵
  PID:7884
- C:\Windows\System\IIDNGpT.exe
  C:\Windows\System\IIDNGpT.exe
  2⤵
  PID:7900
- C:\Windows\System\bWxWXaY.exe
  C:\Windows\System\bWxWXaY.exe
  2⤵
  PID:7916
- C:\Windows\System\HfYEbiP.exe
  C:\Windows\System\HfYEbiP.exe
  2⤵
  PID:7936
- C:\Windows\System\tvsMrkL.exe
  C:\Windows\System\tvsMrkL.exe
  2⤵
  PID:7964
- C:\Windows\System\MWAjjnB.exe
  C:\Windows\System\MWAjjnB.exe
  2⤵
  PID:7980
- C:\Windows\System\XhfnzcJ.exe
  C:\Windows\System\XhfnzcJ.exe
  2⤵
  PID:8024
- C:\Windows\System\XESwmRF.exe
  C:\Windows\System\XESwmRF.exe
  2⤵
  PID:8052
- C:\Windows\System\NuUQhCK.exe
  C:\Windows\System\NuUQhCK.exe
  2⤵
  PID:8144
- C:\Windows\System\CkuVQsP.exe
  C:\Windows\System\CkuVQsP.exe
  2⤵
  PID:8180
- C:\Windows\System\MQauXSZ.exe
  C:\Windows\System\MQauXSZ.exe
  2⤵
  PID:1136
- C:\Windows\System\WPNOlAo.exe
  C:\Windows\System\WPNOlAo.exe
  2⤵
  PID:1824
- C:\Windows\System\sxLksAh.exe
  C:\Windows\System\sxLksAh.exe
  2⤵
  PID:7176
- C:\Windows\System\HblBSlG.exe
  C:\Windows\System\HblBSlG.exe
  2⤵
  PID:7288
- C:\Windows\System\WuzTsJz.exe
  C:\Windows\System\WuzTsJz.exe
  2⤵
  PID:7432
- C:\Windows\System\VSZxYLW.exe
  C:\Windows\System\VSZxYLW.exe
  2⤵
  PID:7316
- C:\Windows\System\XHyFBmw.exe
  C:\Windows\System\XHyFBmw.exe
  2⤵
  PID:7420
- C:\Windows\System\QjsrsOb.exe
  C:\Windows\System\QjsrsOb.exe
  2⤵
  PID:7764
- C:\Windows\System\UzlBTtl.exe
  C:\Windows\System\UzlBTtl.exe
  2⤵
  PID:7908
- C:\Windows\System\huZPHDQ.exe
  C:\Windows\System\huZPHDQ.exe
  2⤵
  PID:7684
- C:\Windows\System\nrytbIe.exe
  C:\Windows\System\nrytbIe.exe
  2⤵
  PID:7748
- C:\Windows\System\EFYwqtc.exe
  C:\Windows\System\EFYwqtc.exe
  2⤵
  PID:7856
- C:\Windows\System\ElAOUsm.exe
  C:\Windows\System\ElAOUsm.exe
  2⤵
  PID:8156
- C:\Windows\System\ASTRKZB.exe
  C:\Windows\System\ASTRKZB.exe
  2⤵
  PID:7236
- C:\Windows\System\onPnLLj.exe
  C:\Windows\System\onPnLLj.exe
  2⤵
  PID:7600
- C:\Windows\System\cEEIygx.exe
  C:\Windows\System\cEEIygx.exe
  2⤵
  PID:7520
- C:\Windows\System\ChoMNoy.exe
  C:\Windows\System\ChoMNoy.exe
  2⤵
  PID:7976
- C:\Windows\System\qUWpXYn.exe
  C:\Windows\System\qUWpXYn.exe
  2⤵
  PID:7808
- C:\Windows\System\IvPraxp.exe
  C:\Windows\System\IvPraxp.exe
  2⤵
  PID:6500
- C:\Windows\System\WOHreoS.exe
  C:\Windows\System\WOHreoS.exe
  2⤵
  PID:7416
- C:\Windows\System\WIihCMW.exe
  C:\Windows\System\WIihCMW.exe
  2⤵
  PID:6584
- C:\Windows\System\IMzCGua.exe
  C:\Windows\System\IMzCGua.exe
  2⤵
  PID:7360
- C:\Windows\System\jOjxvPB.exe
  C:\Windows\System\jOjxvPB.exe
  2⤵
  PID:8044
- C:\Windows\System\SPmKXmv.exe
  C:\Windows\System\SPmKXmv.exe
  2⤵
  PID:8172
- C:\Windows\System\NlRTfNa.exe
  C:\Windows\System\NlRTfNa.exe
  2⤵
  PID:7760
- C:\Windows\System\eIEDgKt.exe
  C:\Windows\System\eIEDgKt.exe
  2⤵
  PID:7952
- C:\Windows\System\dWiufqf.exe
  C:\Windows\System\dWiufqf.exe
  2⤵
  PID:8200
- C:\Windows\System\rGSOVFi.exe
  C:\Windows\System\rGSOVFi.exe
  2⤵
  PID:8236
- C:\Windows\System\wsIrCiE.exe
  C:\Windows\System\wsIrCiE.exe
  2⤵
  PID:8272
- C:\Windows\System\gySPzEs.exe
  C:\Windows\System\gySPzEs.exe
  2⤵
  PID:8292
- C:\Windows\System\NwROovY.exe
  C:\Windows\System\NwROovY.exe
  2⤵
  PID:8320
- C:\Windows\System\tQSCzny.exe
  C:\Windows\System\tQSCzny.exe
  2⤵
  PID:8352
- C:\Windows\System\lRwGzgx.exe
  C:\Windows\System\lRwGzgx.exe
  2⤵
  PID:8388
- C:\Windows\System\qdEamAQ.exe
  C:\Windows\System\qdEamAQ.exe
  2⤵
  PID:8416
- C:\Windows\System\iZFlDRz.exe
  C:\Windows\System\iZFlDRz.exe
  2⤵
  PID:8444
- C:\Windows\System\ntvWZBT.exe
  C:\Windows\System\ntvWZBT.exe
  2⤵
  PID:8472
- C:\Windows\System\TQftyPN.exe
  C:\Windows\System\TQftyPN.exe
  2⤵
  PID:8500
- C:\Windows\System\kywADdB.exe
  C:\Windows\System\kywADdB.exe
  2⤵
  PID:8516
- C:\Windows\System\gQhurZP.exe
  C:\Windows\System\gQhurZP.exe
  2⤵
  PID:8544
- C:\Windows\System\aVOcPOB.exe
  C:\Windows\System\aVOcPOB.exe
  2⤵
  PID:8572
- C:\Windows\System\GrZsBMV.exe
  C:\Windows\System\GrZsBMV.exe
  2⤵
  PID:8604
- C:\Windows\System\gTaiZXS.exe
  C:\Windows\System\gTaiZXS.exe
  2⤵
  PID:8632
- C:\Windows\System\HACScuf.exe
  C:\Windows\System\HACScuf.exe
  2⤵
  PID:8660
- C:\Windows\System\BEwyEez.exe
  C:\Windows\System\BEwyEez.exe
  2⤵
  PID:8700
- C:\Windows\System\dugXIAg.exe
  C:\Windows\System\dugXIAg.exe
  2⤵
  PID:8728
- C:\Windows\System\SIChokF.exe
  C:\Windows\System\SIChokF.exe
  2⤵
  PID:8744
- C:\Windows\System\FcTQVbG.exe
  C:\Windows\System\FcTQVbG.exe
  2⤵
  PID:8780
- C:\Windows\System\ulJrdoA.exe
  C:\Windows\System\ulJrdoA.exe
  2⤵
  PID:8808
- C:\Windows\System\FhyyhmP.exe
  C:\Windows\System\FhyyhmP.exe
  2⤵
  PID:8848
- C:\Windows\System\IprFyos.exe
  C:\Windows\System\IprFyos.exe
  2⤵
  PID:8880
- C:\Windows\System\nLTtXNZ.exe
  C:\Windows\System\nLTtXNZ.exe
  2⤵
  PID:8908
- C:\Windows\System\KyBBNmj.exe
  C:\Windows\System\KyBBNmj.exe
  2⤵
  PID:8936
- C:\Windows\System\rVIZpxC.exe
  C:\Windows\System\rVIZpxC.exe
  2⤵
  PID:8964
- C:\Windows\System\ilNWNFr.exe
  C:\Windows\System\ilNWNFr.exe
  2⤵
  PID:8992
- C:\Windows\System\rurOaCc.exe
  C:\Windows\System\rurOaCc.exe
  2⤵
  PID:9028
- C:\Windows\System\RewxgCk.exe
  C:\Windows\System\RewxgCk.exe
  2⤵
  PID:9064
- C:\Windows\System\TUDrHwv.exe
  C:\Windows\System\TUDrHwv.exe
  2⤵
  PID:9080
- C:\Windows\System\loksDot.exe
  C:\Windows\System\loksDot.exe
  2⤵
  PID:9108
- C:\Windows\System\DkkRRym.exe
  C:\Windows\System\DkkRRym.exe
  2⤵
  PID:9136
- C:\Windows\System\hlmHRek.exe
  C:\Windows\System\hlmHRek.exe
  2⤵
  PID:9164
- C:\Windows\System\oFKFhXI.exe
  C:\Windows\System\oFKFhXI.exe
  2⤵
  PID:9200
- C:\Windows\System\huzuuZA.exe
  C:\Windows\System\huzuuZA.exe
  2⤵
  PID:7188
- C:\Windows\System\NGXcNoR.exe
  C:\Windows\System\NGXcNoR.exe
  2⤵
  PID:8232
- C:\Windows\System\KJBHzwT.exe
  C:\Windows\System\KJBHzwT.exe
  2⤵
  PID:8264
- C:\Windows\System\OTOwDhZ.exe
  C:\Windows\System\OTOwDhZ.exe
  2⤵
  PID:8344
- C:\Windows\System\hwdznWV.exe
  C:\Windows\System\hwdznWV.exe
  2⤵
  PID:8436
- C:\Windows\System\DKJxdSl.exe
  C:\Windows\System\DKJxdSl.exe
  2⤵
  PID:8492
- C:\Windows\System\sEGROmr.exe
  C:\Windows\System\sEGROmr.exe
  2⤵
  PID:8556
- C:\Windows\System\CDAggVn.exe
  C:\Windows\System\CDAggVn.exe
  2⤵
  PID:8656
- C:\Windows\System\wbHeLBZ.exe
  C:\Windows\System\wbHeLBZ.exe
  2⤵
  PID:8720
- C:\Windows\System\tldgdVT.exe
  C:\Windows\System\tldgdVT.exe
  2⤵
  PID:8772
- C:\Windows\System\EljPAAZ.exe
  C:\Windows\System\EljPAAZ.exe
  2⤵
  PID:8864
- C:\Windows\System\MMYcuxH.exe
  C:\Windows\System\MMYcuxH.exe
  2⤵
  PID:8952
- C:\Windows\System\glYkTXP.exe
  C:\Windows\System\glYkTXP.exe
  2⤵
  PID:9060
- C:\Windows\System\usEuSFG.exe
  C:\Windows\System\usEuSFG.exe
  2⤵
  PID:9128
- C:\Windows\System\EYukKBe.exe
  C:\Windows\System\EYukKBe.exe
  2⤵
  PID:9196
- C:\Windows\System\eXYweZx.exe
  C:\Windows\System\eXYweZx.exe
  2⤵
  PID:8288
- C:\Windows\System\hlCfDii.exe
  C:\Windows\System\hlCfDii.exe
  2⤵
  PID:8408
- C:\Windows\System\UkkzreV.exe
  C:\Windows\System\UkkzreV.exe
  2⤵
  PID:8484
- C:\Windows\System\gPfvsqT.exe
  C:\Windows\System\gPfvsqT.exe
  2⤵
  PID:8688
- C:\Windows\System\Elgevsl.exe
  C:\Windows\System\Elgevsl.exe
  2⤵
  PID:8796
- C:\Windows\System\OmIvZwg.exe
  C:\Windows\System\OmIvZwg.exe
  2⤵
  PID:9004
- C:\Windows\System\xRYUprr.exe
  C:\Windows\System\xRYUprr.exe
  2⤵
  PID:9176
- C:\Windows\System\ooZrtKD.exe
  C:\Windows\System\ooZrtKD.exe
  2⤵
  PID:8644
- C:\Windows\System\XhjYoJU.exe
  C:\Windows\System\XhjYoJU.exe
  2⤵
  PID:8960
- C:\Windows\System\kkflMYK.exe
  C:\Windows\System\kkflMYK.exe
  2⤵
  PID:8984
- C:\Windows\System\GqRFHNU.exe
  C:\Windows\System\GqRFHNU.exe
  2⤵
  PID:8836
- C:\Windows\System\yNmfOSd.exe
  C:\Windows\System\yNmfOSd.exe
  2⤵
  PID:9240
- C:\Windows\System\YiLurnt.exe
  C:\Windows\System\YiLurnt.exe
  2⤵
  PID:9280
- C:\Windows\System\ynMPryj.exe
  C:\Windows\System\ynMPryj.exe
  2⤵
  PID:9308
- C:\Windows\System\MkrHzVh.exe
  C:\Windows\System\MkrHzVh.exe
  2⤵
  PID:9324
- C:\Windows\System\uTWnDPl.exe
  C:\Windows\System\uTWnDPl.exe
  2⤵
  PID:9344
- C:\Windows\System\BVPQFiw.exe
  C:\Windows\System\BVPQFiw.exe
  2⤵
  PID:9368
- C:\Windows\System\OrPWcMc.exe
  C:\Windows\System\OrPWcMc.exe
  2⤵
  PID:9396
- C:\Windows\System\ZkaVldA.exe
  C:\Windows\System\ZkaVldA.exe
  2⤵
  PID:9436
- C:\Windows\System\GOPEspg.exe
  C:\Windows\System\GOPEspg.exe
  2⤵
  PID:9472
- C:\Windows\System\wcGvhhh.exe
  C:\Windows\System\wcGvhhh.exe
  2⤵
  PID:9504
- C:\Windows\System\BSpmhbL.exe
  C:\Windows\System\BSpmhbL.exe
  2⤵
  PID:9524
- C:\Windows\System\NtCDYOM.exe
  C:\Windows\System\NtCDYOM.exe
  2⤵
  PID:9540
- C:\Windows\System\xCQAGrO.exe
  C:\Windows\System\xCQAGrO.exe
  2⤵
  PID:9580
- C:\Windows\System\aTSGFKU.exe
  C:\Windows\System\aTSGFKU.exe
  2⤵
  PID:9608
- C:\Windows\System\AcgLvGf.exe
  C:\Windows\System\AcgLvGf.exe
  2⤵
  PID:9636
- C:\Windows\System\vfnlqXt.exe
  C:\Windows\System\vfnlqXt.exe
  2⤵
  PID:9652
- C:\Windows\System\pLdWLnY.exe
  C:\Windows\System\pLdWLnY.exe
  2⤵
  PID:9668
- C:\Windows\System\GGLsNhM.exe
  C:\Windows\System\GGLsNhM.exe
  2⤵
  PID:9712
- C:\Windows\System\qsjPVCl.exe
  C:\Windows\System\qsjPVCl.exe
  2⤵
  PID:9736
- C:\Windows\System\fpBttuB.exe
  C:\Windows\System\fpBttuB.exe
  2⤵
  PID:9760
- C:\Windows\System\gpBykkw.exe
  C:\Windows\System\gpBykkw.exe
  2⤵
  PID:9780
- C:\Windows\System\PXNEziQ.exe
  C:\Windows\System\PXNEziQ.exe
  2⤵
  PID:9808
- C:\Windows\System\qVVMqNv.exe
  C:\Windows\System\qVVMqNv.exe
  2⤵
  PID:9840
- C:\Windows\System\KVkfNTa.exe
  C:\Windows\System\KVkfNTa.exe
  2⤵
  PID:9868
- C:\Windows\System\iQmFhDx.exe
  C:\Windows\System\iQmFhDx.exe
  2⤵
  PID:9904
- C:\Windows\System\saIzBIQ.exe
  C:\Windows\System\saIzBIQ.exe
  2⤵
  PID:9940
- C:\Windows\System\LLBtBgu.exe
  C:\Windows\System\LLBtBgu.exe
  2⤵
  PID:9972
- C:\Windows\System\DzgXVPP.exe
  C:\Windows\System\DzgXVPP.exe
  2⤵
  PID:9992
- C:\Windows\System\snDjCRR.exe
  C:\Windows\System\snDjCRR.exe
  2⤵
  PID:10020
- C:\Windows\System\NMYlCgM.exe
  C:\Windows\System\NMYlCgM.exe
  2⤵
  PID:10072
- C:\Windows\System\XyOteqV.exe
  C:\Windows\System\XyOteqV.exe
  2⤵
  PID:10088
- C:\Windows\System\BwraOXH.exe
  C:\Windows\System\BwraOXH.exe
  2⤵
  PID:10128
- C:\Windows\System\gKXAbWL.exe
  C:\Windows\System\gKXAbWL.exe
  2⤵
  PID:10144
- C:\Windows\System\SoIrjpX.exe
  C:\Windows\System\SoIrjpX.exe
  2⤵
  PID:10168
- C:\Windows\System\qFSJFLb.exe
  C:\Windows\System\qFSJFLb.exe
  2⤵
  PID:10184
- C:\Windows\System\CvEGdvC.exe
  C:\Windows\System\CvEGdvC.exe
  2⤵
  PID:10236
- C:\Windows\System\qExIdzH.exe
  C:\Windows\System\qExIdzH.exe
  2⤵
  PID:9264
- C:\Windows\System\cySoKcS.exe
  C:\Windows\System\cySoKcS.exe
  2⤵
  PID:9356
- C:\Windows\System\CSDnjER.exe
  C:\Windows\System\CSDnjER.exe
  2⤵
  PID:9424
- C:\Windows\System\sGYdYrn.exe
  C:\Windows\System\sGYdYrn.exe
  2⤵
  PID:9456
- C:\Windows\System\YkcJmnz.exe
  C:\Windows\System\YkcJmnz.exe
  2⤵
  PID:9496
- C:\Windows\System\jEConzv.exe
  C:\Windows\System\jEConzv.exe
  2⤵
  PID:9600
- C:\Windows\System\olqWYOB.exe
  C:\Windows\System\olqWYOB.exe
  2⤵
  PID:9648
- C:\Windows\System\QoOQfPi.exe
  C:\Windows\System\QoOQfPi.exe
  2⤵
  PID:9692
- C:\Windows\System\yELNcMU.exe
  C:\Windows\System\yELNcMU.exe
  2⤵
  PID:9748
- C:\Windows\System\HYSxNvi.exe
  C:\Windows\System\HYSxNvi.exe
  2⤵
  PID:9796
- C:\Windows\System\ZlPZdwq.exe
  C:\Windows\System\ZlPZdwq.exe
  2⤵
  PID:9952
- C:\Windows\System\TCejXGg.exe
  C:\Windows\System\TCejXGg.exe
  2⤵
  PID:9988
- C:\Windows\System\RCGdcVB.exe
  C:\Windows\System\RCGdcVB.exe
  2⤵
  PID:10080
- C:\Windows\System\falJNmv.exe
  C:\Windows\System\falJNmv.exe
  2⤵
  PID:10136
- C:\Windows\System\MPgCCta.exe
  C:\Windows\System\MPgCCta.exe
  2⤵
  PID:10208
- C:\Windows\System\DHVhBbq.exe
  C:\Windows\System\DHVhBbq.exe
  2⤵
  PID:9292
- C:\Windows\System\xTZEpmT.exe
  C:\Windows\System\xTZEpmT.exe
  2⤵
  PID:9488
- C:\Windows\System\wMFvSby.exe
  C:\Windows\System\wMFvSby.exe
  2⤵
  PID:9628
- C:\Windows\System\oxJYJPI.exe
  C:\Windows\System\oxJYJPI.exe
  2⤵
  PID:9728
- C:\Windows\System\dlioNjb.exe
  C:\Windows\System\dlioNjb.exe
  2⤵
  PID:9896
- C:\Windows\System\pomhlUK.exe
  C:\Windows\System\pomhlUK.exe
  2⤵
  PID:9956
- C:\Windows\System\AXnDJgR.exe
  C:\Windows\System\AXnDJgR.exe
  2⤵
  PID:10120
- C:\Windows\System\NTiqZZc.exe
  C:\Windows\System\NTiqZZc.exe
  2⤵
  PID:9104
- C:\Windows\System\BgrzsJB.exe
  C:\Windows\System\BgrzsJB.exe
  2⤵
  PID:9688
- C:\Windows\System\ftYkvCs.exe
  C:\Windows\System\ftYkvCs.exe
  2⤵
  PID:9888
- C:\Windows\System\HSlgAHq.exe
  C:\Windows\System\HSlgAHq.exe
  2⤵
  PID:9352
- C:\Windows\System\LqWeaOH.exe
  C:\Windows\System\LqWeaOH.exe
  2⤵
  PID:10244
- C:\Windows\System\ytxmCIz.exe
  C:\Windows\System\ytxmCIz.exe
  2⤵
  PID:10272
- C:\Windows\System\cDKbFCA.exe
  C:\Windows\System\cDKbFCA.exe
  2⤵
  PID:10300
- C:\Windows\System\Jtnjfku.exe
  C:\Windows\System\Jtnjfku.exe
  2⤵
  PID:10332
- C:\Windows\System\utcIEEM.exe
  C:\Windows\System\utcIEEM.exe
  2⤵
  PID:10360
- C:\Windows\System\FQUftBP.exe
  C:\Windows\System\FQUftBP.exe
  2⤵
  PID:10388
- C:\Windows\System\pUvUSCv.exe
  C:\Windows\System\pUvUSCv.exe
  2⤵
  PID:10428
- C:\Windows\System\eFAVXos.exe
  C:\Windows\System\eFAVXos.exe
  2⤵
  PID:10444
- C:\Windows\System\uqDFgTF.exe
  C:\Windows\System\uqDFgTF.exe
  2⤵
  PID:10472
- C:\Windows\System\gUDoZGw.exe
  C:\Windows\System\gUDoZGw.exe
  2⤵
  PID:10488
- C:\Windows\System\xyolxvk.exe
  C:\Windows\System\xyolxvk.exe
  2⤵
  PID:10524
- C:\Windows\System\CtPvfVN.exe
  C:\Windows\System\CtPvfVN.exe
  2⤵
  PID:10556
- C:\Windows\System\kuiKHDs.exe
  C:\Windows\System\kuiKHDs.exe
  2⤵
  PID:10580
- C:\Windows\System\xeTcGHp.exe
  C:\Windows\System\xeTcGHp.exe
  2⤵
  PID:10624
- C:\Windows\System\HyfmteM.exe
  C:\Windows\System\HyfmteM.exe
  2⤵
  PID:10640
- C:\Windows\System\wNyfROH.exe
  C:\Windows\System\wNyfROH.exe
  2⤵
  PID:10668
- C:\Windows\System\afGmYCK.exe
  C:\Windows\System\afGmYCK.exe
  2⤵
  PID:10708
- C:\Windows\System\PeLFfzP.exe
  C:\Windows\System\PeLFfzP.exe
  2⤵
  PID:10736
- C:\Windows\System\RKXtvBA.exe
  C:\Windows\System\RKXtvBA.exe
  2⤵
  PID:10752
- C:\Windows\System\MzsvwZQ.exe
  C:\Windows\System\MzsvwZQ.exe
  2⤵
  PID:10780
- C:\Windows\System\PEOhDar.exe
  C:\Windows\System\PEOhDar.exe
  2⤵
  PID:10820
- C:\Windows\System\GpckSRk.exe
  C:\Windows\System\GpckSRk.exe
  2⤵
  PID:10848
- C:\Windows\System\TtqmicR.exe
  C:\Windows\System\TtqmicR.exe
  2⤵
  PID:10876
- C:\Windows\System\ZASZENr.exe
  C:\Windows\System\ZASZENr.exe
  2⤵
  PID:10900
- C:\Windows\System\EkAuYJt.exe
  C:\Windows\System\EkAuYJt.exe
  2⤵
  PID:10920
- C:\Windows\System\COWCIpF.exe
  C:\Windows\System\COWCIpF.exe
  2⤵
  PID:10948
- C:\Windows\System\tlSXsrG.exe
  C:\Windows\System\tlSXsrG.exe
  2⤵
  PID:10988
- C:\Windows\System\CIpXqev.exe
  C:\Windows\System\CIpXqev.exe
  2⤵
  PID:11016
- C:\Windows\System\fIEizqU.exe
  C:\Windows\System\fIEizqU.exe
  2⤵
  PID:11044
- C:\Windows\System\OJTwcRd.exe
  C:\Windows\System\OJTwcRd.exe
  2⤵
  PID:11060
- C:\Windows\System\bZfWxVP.exe
  C:\Windows\System\bZfWxVP.exe
  2⤵
  PID:11088
- C:\Windows\System\EuFNVty.exe
  C:\Windows\System\EuFNVty.exe
  2⤵
  PID:11124
- C:\Windows\System\zsWiSeE.exe
  C:\Windows\System\zsWiSeE.exe
  2⤵
  PID:11144
- C:\Windows\System\ncZLfZh.exe
  C:\Windows\System\ncZLfZh.exe
  2⤵
  PID:11172
- C:\Windows\System\moONnue.exe
  C:\Windows\System\moONnue.exe
  2⤵
  PID:11200
- C:\Windows\System\uGUKIKo.exe
  C:\Windows\System\uGUKIKo.exe
  2⤵
  PID:11228
- C:\Windows\System\IBxSdgI.exe
  C:\Windows\System\IBxSdgI.exe
  2⤵
  PID:9800
- C:\Windows\System\MoeRgNs.exe
  C:\Windows\System\MoeRgNs.exe
  2⤵
  PID:10316
- C:\Windows\System\PTRiQRY.exe
  C:\Windows\System\PTRiQRY.exe
  2⤵
  PID:10292
- C:\Windows\System\lVnvcur.exe
  C:\Windows\System\lVnvcur.exe
  2⤵
  PID:10372
- C:\Windows\System\lvWLIIf.exe
  C:\Windows\System\lvWLIIf.exe
  2⤵
  PID:10440
- C:\Windows\System\EGOGEQk.exe
  C:\Windows\System\EGOGEQk.exe
  2⤵
  PID:10544
- C:\Windows\System\NoqNKrp.exe
  C:\Windows\System\NoqNKrp.exe
  2⤵
  PID:10608
- C:\Windows\System\KOMzDVi.exe
  C:\Windows\System\KOMzDVi.exe
  2⤵
  PID:10684
- C:\Windows\System\TuxMrHB.exe
  C:\Windows\System\TuxMrHB.exe
  2⤵
  PID:10748
- C:\Windows\System\wYGKhYw.exe
  C:\Windows\System\wYGKhYw.exe
  2⤵
  PID:10792
- C:\Windows\System\zoamxYD.exe
  C:\Windows\System\zoamxYD.exe
  2⤵
  PID:10884
- C:\Windows\System\PwtuVHE.exe
  C:\Windows\System\PwtuVHE.exe
  2⤵
  PID:10912
- C:\Windows\System\dtXWvlP.exe
  C:\Windows\System\dtXWvlP.exe
  2⤵
  PID:11032
- C:\Windows\System\ZrxjLFZ.exe
  C:\Windows\System\ZrxjLFZ.exe
  2⤵
  PID:11052
- C:\Windows\System\lEPSkym.exe
  C:\Windows\System\lEPSkym.exe
  2⤵
  PID:11132
- C:\Windows\System\gyGyRuD.exe
  C:\Windows\System\gyGyRuD.exe
  2⤵
  PID:11212
- C:\Windows\System\MGRobAr.exe
  C:\Windows\System\MGRobAr.exe
  2⤵
  PID:11260
- C:\Windows\System\HjVPswE.exe
  C:\Windows\System\HjVPswE.exe
  2⤵
  PID:9984
- C:\Windows\System\udNJuMn.exe
  C:\Windows\System\udNJuMn.exe
  2⤵
  PID:10500
- C:\Windows\System\isAWhbj.exe
  C:\Windows\System\isAWhbj.exe
  2⤵
  PID:10572
- C:\Windows\System\RzgbXvz.exe
  C:\Windows\System\RzgbXvz.exe
  2⤵
  PID:10864
- C:\Windows\System\qZZqFec.exe
  C:\Windows\System\qZZqFec.exe
  2⤵
  PID:11000
- C:\Windows\System\dyrOqxy.exe
  C:\Windows\System\dyrOqxy.exe
  2⤵
  PID:11076
- C:\Windows\System\aetHfkG.exe
  C:\Windows\System\aetHfkG.exe
  2⤵
  PID:10260
- C:\Windows\System\utppDwL.exe
  C:\Windows\System\utppDwL.exe
  2⤵
  PID:10664
- C:\Windows\System\zcOxvHw.exe
  C:\Windows\System\zcOxvHw.exe
  2⤵
  PID:10916
- C:\Windows\System\mmYFnjv.exe
  C:\Windows\System\mmYFnjv.exe
  2⤵
  PID:10484
- C:\Windows\System\AuUxfXv.exe
  C:\Windows\System\AuUxfXv.exe
  2⤵
  PID:11224
- C:\Windows\System\QZTzJQh.exe
  C:\Windows\System\QZTzJQh.exe
  2⤵
  PID:11276
- C:\Windows\System\KrlzWJU.exe
  C:\Windows\System\KrlzWJU.exe
  2⤵
  PID:11300
- C:\Windows\System\xQkecCs.exe
  C:\Windows\System\xQkecCs.exe
  2⤵
  PID:11340
- C:\Windows\System\kFznUJj.exe
  C:\Windows\System\kFznUJj.exe
  2⤵
  PID:11368
- C:\Windows\System\SfNGHcN.exe
  C:\Windows\System\SfNGHcN.exe
  2⤵
  PID:11396
- C:\Windows\System\cyQNObv.exe
  C:\Windows\System\cyQNObv.exe
  2⤵
  PID:11424
- C:\Windows\System\kgaiwbP.exe
  C:\Windows\System\kgaiwbP.exe
  2⤵
  PID:11440
- C:\Windows\System\LcRCmDi.exe
  C:\Windows\System\LcRCmDi.exe
  2⤵
  PID:11468
- C:\Windows\System\XeFeZqP.exe
  C:\Windows\System\XeFeZqP.exe
  2⤵
  PID:11508
- C:\Windows\System\MLRbKoH.exe
  C:\Windows\System\MLRbKoH.exe
  2⤵
  PID:11536
- C:\Windows\System\zLLULwY.exe
  C:\Windows\System\zLLULwY.exe
  2⤵
  PID:11552
- C:\Windows\System\uQbhOoX.exe
  C:\Windows\System\uQbhOoX.exe
  2⤵
  PID:11588
- C:\Windows\System\nzNcLRR.exe
  C:\Windows\System\nzNcLRR.exe
  2⤵
  PID:11620
- C:\Windows\System\AhaHkkM.exe
  C:\Windows\System\AhaHkkM.exe
  2⤵
  PID:11648
- C:\Windows\System\sqymHrd.exe
  C:\Windows\System\sqymHrd.exe
  2⤵
  PID:11696
- C:\Windows\System\TcYtIho.exe
  C:\Windows\System\TcYtIho.exe
  2⤵
  PID:11712
- C:\Windows\System\qoPzsGC.exe
  C:\Windows\System\qoPzsGC.exe
  2⤵
  PID:11740
- C:\Windows\System\vNnuOIT.exe
  C:\Windows\System\vNnuOIT.exe
  2⤵
  PID:11768
- C:\Windows\System\wTEMjpC.exe
  C:\Windows\System\wTEMjpC.exe
  2⤵
  PID:11788
- C:\Windows\System\YeshQph.exe
  C:\Windows\System\YeshQph.exe
  2⤵
  PID:11828
- C:\Windows\System\RAxgKMw.exe
  C:\Windows\System\RAxgKMw.exe
  2⤵
  PID:11856
- C:\Windows\System\aFeZDAY.exe
  C:\Windows\System\aFeZDAY.exe
  2⤵
  PID:11908
- C:\Windows\System\GqpvqlN.exe
  C:\Windows\System\GqpvqlN.exe
  2⤵
  PID:11928
- C:\Windows\System\bNFTHaK.exe
  C:\Windows\System\bNFTHaK.exe
  2⤵
  PID:11964
- C:\Windows\System\AJNGhBZ.exe
  C:\Windows\System\AJNGhBZ.exe
  2⤵
  PID:12004
- C:\Windows\System\vaOeBQI.exe
  C:\Windows\System\vaOeBQI.exe
  2⤵
  PID:12032
- C:\Windows\System\ikhXYuF.exe
  C:\Windows\System\ikhXYuF.exe
  2⤵
  PID:12052
- C:\Windows\System\ltpKqHv.exe
  C:\Windows\System\ltpKqHv.exe
  2⤵
  PID:12092
- C:\Windows\System\gBwPGmk.exe
  C:\Windows\System\gBwPGmk.exe
  2⤵
  PID:12116
- C:\Windows\System\npxTnjV.exe
  C:\Windows\System\npxTnjV.exe
  2⤵
  PID:12136
- C:\Windows\System\mSLVSjg.exe
  C:\Windows\System\mSLVSjg.exe
  2⤵
  PID:12160
- C:\Windows\System\TVqrWgS.exe
  C:\Windows\System\TVqrWgS.exe
  2⤵
  PID:12192
- C:\Windows\System\BYJpDSx.exe
  C:\Windows\System\BYJpDSx.exe
  2⤵
  PID:12208
- C:\Windows\System\JxAlnJe.exe
  C:\Windows\System\JxAlnJe.exe
  2⤵
  PID:12244
- C:\Windows\System\xLkyyGD.exe
  C:\Windows\System\xLkyyGD.exe
  2⤵
  PID:12264
- C:\Windows\System\oVXzwrT.exe
  C:\Windows\System\oVXzwrT.exe
  2⤵
  PID:10620
- C:\Windows\System\ixVInrT.exe
  C:\Windows\System\ixVInrT.exe
  2⤵
  PID:11324
- C:\Windows\System\YqQrbZC.exe
  C:\Windows\System\YqQrbZC.exe
  2⤵
  PID:11360
- C:\Windows\System\clCotsB.exe
  C:\Windows\System\clCotsB.exe
  2⤵
  PID:11452
- C:\Windows\System\WBlvJyX.exe
  C:\Windows\System\WBlvJyX.exe
  2⤵
  PID:11572
- C:\Windows\System\WqRtlPy.exe
  C:\Windows\System\WqRtlPy.exe
  2⤵
  PID:11616
- C:\Windows\System\IBdQXbo.exe
  C:\Windows\System\IBdQXbo.exe
  2⤵
  PID:11708
- C:\Windows\System\bXTbNZg.exe
  C:\Windows\System\bXTbNZg.exe
  2⤵
  PID:11796
- C:\Windows\System\nlGMLeu.exe
  C:\Windows\System\nlGMLeu.exe
  2⤵
  PID:11888
- C:\Windows\System\CmUQQiX.exe
  C:\Windows\System\CmUQQiX.exe
  2⤵
  PID:11920
- C:\Windows\System\ZCZTTwf.exe
  C:\Windows\System\ZCZTTwf.exe
  2⤵
  PID:12040
- C:\Windows\System\tEmooai.exe
  C:\Windows\System\tEmooai.exe
  2⤵
  PID:12088
- C:\Windows\System\MQRMDwV.exe
  C:\Windows\System\MQRMDwV.exe
  2⤵
  PID:12152
- C:\Windows\System\OmininC.exe
  C:\Windows\System\OmininC.exe
  2⤵
  PID:12232
- C:\Windows\System\THMYRhd.exe
  C:\Windows\System\THMYRhd.exe
  2⤵
  PID:12280
- C:\Windows\System\rToKtug.exe
  C:\Windows\System\rToKtug.exe
  2⤵
  PID:11364
- C:\Windows\System\Xzqdtmd.exe
  C:\Windows\System\Xzqdtmd.exe
  2⤵
  PID:11544
- C:\Windows\System\ITXfyxE.exe
  C:\Windows\System\ITXfyxE.exe
  2⤵
  PID:11640
- C:\Windows\System\MghvbQS.exe
  C:\Windows\System\MghvbQS.exe
  2⤵
  PID:11844
- C:\Windows\System\LLGGtoa.exe
  C:\Windows\System\LLGGtoa.exe
  2⤵
  PID:12024
- C:\Windows\System\MJTSVdb.exe
  C:\Windows\System\MJTSVdb.exe
  2⤵
  PID:12112
- C:\Windows\System\duNhQzP.exe
  C:\Windows\System\duNhQzP.exe
  2⤵
  PID:11328
- C:\Windows\System\ONxcXOk.exe
  C:\Windows\System\ONxcXOk.exe
  2⤵
  PID:11756
- C:\Windows\System\HhQdcCL.exe
  C:\Windows\System\HhQdcCL.exe
  2⤵
  PID:12204
- C:\Windows\System\njjRiPh.exe
  C:\Windows\System\njjRiPh.exe
  2⤵
  PID:11564
- C:\Windows\System\iyOoPUB.exe
  C:\Windows\System\iyOoPUB.exe
  2⤵
  PID:3552
- C:\Windows\System\rKkpKQB.exe
  C:\Windows\System\rKkpKQB.exe
  2⤵
  PID:12308
- C:\Windows\System\djRrNih.exe
  C:\Windows\System\djRrNih.exe
  2⤵
  PID:12348
- C:\Windows\System\JmoSvEb.exe
  C:\Windows\System\JmoSvEb.exe
  2⤵
  PID:12364
- C:\Windows\System\vOkWguo.exe
  C:\Windows\System\vOkWguo.exe
  2⤵
  PID:12404
- C:\Windows\System\CqvJpIV.exe
  C:\Windows\System\CqvJpIV.exe
  2⤵
  PID:12420
- C:\Windows\System\vuFEoKh.exe
  C:\Windows\System\vuFEoKh.exe
  2⤵
  PID:12448
- C:\Windows\System\qnFqYpq.exe
  C:\Windows\System\qnFqYpq.exe
  2⤵
  PID:12472
- C:\Windows\System\dNYEVtU.exe
  C:\Windows\System\dNYEVtU.exe
  2⤵
  PID:12496
- C:\Windows\System\xJMGPuM.exe
  C:\Windows\System\xJMGPuM.exe
  2⤵
  PID:12532
- C:\Windows\System\johpnBY.exe
  C:\Windows\System\johpnBY.exe
  2⤵
  PID:12548
- C:\Windows\System\ofsxwIw.exe
  C:\Windows\System\ofsxwIw.exe
  2⤵
  PID:12584
- C:\Windows\System\zgzVaJH.exe
  C:\Windows\System\zgzVaJH.exe
  2⤵
  PID:12612
- C:\Windows\System\gaMAqDc.exe
  C:\Windows\System\gaMAqDc.exe
  2⤵
  PID:12632
- C:\Windows\System\OaRWUwa.exe
  C:\Windows\System\OaRWUwa.exe
  2⤵
  PID:12660
- C:\Windows\System\wdqZQUB.exe
  C:\Windows\System\wdqZQUB.exe
  2⤵
  PID:12688
- C:\Windows\System\DfdqxFd.exe
  C:\Windows\System\DfdqxFd.exe
  2⤵
  PID:12728
- C:\Windows\System\oCRemAI.exe
  C:\Windows\System\oCRemAI.exe
  2⤵
  PID:12768
- C:\Windows\System\meXmHJZ.exe
  C:\Windows\System\meXmHJZ.exe
  2⤵
  PID:12784
- C:\Windows\System\OSnEFgN.exe
  C:\Windows\System\OSnEFgN.exe
  2⤵
  PID:12828
- C:\Windows\System\EOwyVtk.exe
  C:\Windows\System\EOwyVtk.exe
  2⤵
  PID:12856
- C:\Windows\System\LfJDjrq.exe
  C:\Windows\System\LfJDjrq.exe
  2⤵
  PID:12896
- C:\Windows\System\RpUxIOQ.exe
  C:\Windows\System\RpUxIOQ.exe
  2⤵
  PID:12912
- C:\Windows\System\OaopTQP.exe
  C:\Windows\System\OaopTQP.exe
  2⤵
  PID:12940
- C:\Windows\System\vYGncIs.exe
  C:\Windows\System\vYGncIs.exe
  2⤵
  PID:12980
- C:\Windows\System\xETZFyF.exe
  C:\Windows\System\xETZFyF.exe
  2⤵
  PID:13008
- C:\Windows\System\OBdJcEj.exe
  C:\Windows\System\OBdJcEj.exe
  2⤵
  PID:13024
- C:\Windows\System\NxptFYz.exe
  C:\Windows\System\NxptFYz.exe
  2⤵
  PID:13048
- C:\Windows\System\vjOGjUi.exe
  C:\Windows\System\vjOGjUi.exe
  2⤵
  PID:13072
- C:\Windows\System\ICvuNtB.exe
  C:\Windows\System\ICvuNtB.exe
  2⤵
  PID:13092
- C:\Windows\System\JQIBHYF.exe
  C:\Windows\System\JQIBHYF.exe
  2⤵
  PID:13116
- C:\Windows\System\zesDaos.exe
  C:\Windows\System\zesDaos.exe
  2⤵
  PID:13168
- C:\Windows\System\QGBpfXc.exe
  C:\Windows\System\QGBpfXc.exe
  2⤵
  PID:13196
- C:\Windows\System\fGnNGwq.exe
  C:\Windows\System\fGnNGwq.exe
  2⤵
  PID:13228
- C:\Windows\System\dWttBbs.exe
  C:\Windows\System\dWttBbs.exe
  2⤵
  PID:13276
- C:\Windows\System\uLtUBwR.exe
  C:\Windows\System\uLtUBwR.exe
  2⤵
  PID:13300
- C:\Windows\System\hiAckhL.exe
  C:\Windows\System\hiAckhL.exe
  2⤵
  PID:12300
- C:\Windows\System\HpYfAKa.exe
  C:\Windows\System\HpYfAKa.exe
  2⤵
  PID:12384
- C:\Windows\System\vsFgtVw.exe
  C:\Windows\System\vsFgtVw.exe
  2⤵
  PID:12512
- C:\Windows\System\hVdzBQS.exe
  C:\Windows\System\hVdzBQS.exe
  2⤵
  PID:12504
- C:\Windows\System\IEiSQna.exe
  C:\Windows\System\IEiSQna.exe
  2⤵
  PID:12644
- C:\Windows\System\rukzOqB.exe
  C:\Windows\System\rukzOqB.exe
  2⤵
  PID:12780
- C:\Windows\System\lrczvak.exe
  C:\Windows\System\lrczvak.exe
  2⤵
  PID:12888
- C:\Windows\System\bctXwsK.exe
  C:\Windows\System\bctXwsK.exe
  2⤵
  PID:12928
- C:\Windows\System\VPWKGVG.exe
  C:\Windows\System\VPWKGVG.exe
  2⤵
  PID:13040
- C:\Windows\System\EAkrDzv.exe
  C:\Windows\System\EAkrDzv.exe
  2⤵
  PID:13080
- C:\Windows\System\gCrRtos.exe
  C:\Windows\System\gCrRtos.exe
  2⤵
  PID:13164
- C:\Windows\System\COvgcMg.exe
  C:\Windows\System\COvgcMg.exe
  2⤵
  PID:13272
- C:\Windows\System\JxwYGTF.exe
  C:\Windows\System\JxwYGTF.exe
  2⤵
  PID:12344
- C:\Windows\System\JBTzRwc.exe
  C:\Windows\System\JBTzRwc.exe
  2⤵
  PID:12412
- C:\Windows\System\vErykNT.exe
  C:\Windows\System\vErykNT.exe
  2⤵
  PID:12652
- C:\Windows\System\pgSjXPx.exe
  C:\Windows\System\pgSjXPx.exe
  2⤵
  PID:2680
- C:\Windows\System\NeNyBQi.exe
  C:\Windows\System\NeNyBQi.exe
  2⤵
  PID:1628
- C:\Windows\System\NfEKZfY.exe
  C:\Windows\System\NfEKZfY.exe
  2⤵
  PID:13292
- C:\Windows\System\LVQQJbv.exe
  C:\Windows\System\LVQQJbv.exe
  2⤵
  PID:1128
- C:\Windows\System\kvJqgpv.exe
  C:\Windows\System\kvJqgpv.exe
  2⤵
  PID:13056
- C:\Windows\System\QtKnnAT.exe
  C:\Windows\System\QtKnnAT.exe
  2⤵
  PID:4168
- C:\Windows\System\EQbWTBm.exe
  C:\Windows\System\EQbWTBm.exe
  2⤵
  PID:1588
- C:\Windows\System\xptArON.exe
  C:\Windows\System\xptArON.exe
  2⤵
  PID:13328
- C:\Windows\System\aRwXjsG.exe
  C:\Windows\System\aRwXjsG.exe
  2⤵
  PID:13344
- C:\Windows\System\KLZtWiF.exe
  C:\Windows\System\KLZtWiF.exe
  2⤵
  PID:13368
- C:\Windows\System\TZiefYT.exe
  C:\Windows\System\TZiefYT.exe
  2⤵
  PID:13412
- C:\Windows\System\nqYXmOm.exe
  C:\Windows\System\nqYXmOm.exe
  2⤵
  PID:13428
- C:\Windows\System\JKnhguo.exe
  C:\Windows\System\JKnhguo.exe
  2⤵
  PID:13448
- C:\Windows\System\SigRSWS.exe
  C:\Windows\System\SigRSWS.exe
  2⤵
  PID:13508
- C:\Windows\System\JGhgxRa.exe
  C:\Windows\System\JGhgxRa.exe
  2⤵
  PID:13536
- C:\Windows\System\kTvNybf.exe
  C:\Windows\System\kTvNybf.exe
  2⤵
  PID:13564
- C:\Windows\System\euOkdLi.exe
  C:\Windows\System\euOkdLi.exe
  2⤵
  PID:13620
- C:\Windows\System\oAszmnc.exe
  C:\Windows\System\oAszmnc.exe
  2⤵
  PID:13636
- C:\Windows\System\SwdEyYh.exe
  C:\Windows\System\SwdEyYh.exe
  2⤵
  PID:13664
- C:\Windows\System\wKaYHlo.exe
  C:\Windows\System\wKaYHlo.exe
  2⤵
  PID:13680
- C:\Windows\System\mXDjFSu.exe
  C:\Windows\System\mXDjFSu.exe
  2⤵
  PID:13712
- C:\Windows\System\uavOIsC.exe
  C:\Windows\System\uavOIsC.exe
  2⤵
  PID:13736
- C:\Windows\System\kyyGtQm.exe
  C:\Windows\System\kyyGtQm.exe
  2⤵
  PID:13764
- C:\Windows\System\icqUxVb.exe
  C:\Windows\System\icqUxVb.exe
  2⤵
  PID:13796
- C:\Windows\System\peMTgbw.exe
  C:\Windows\System\peMTgbw.exe
  2⤵
  PID:13824
- C:\Windows\System\RLtbPjL.exe
  C:\Windows\System\RLtbPjL.exe
  2⤵
  PID:13844
- C:\Windows\System\YFxpIIh.exe
  C:\Windows\System\YFxpIIh.exe
  2⤵
  PID:13900
- C:\Windows\System\cjjPKRk.exe
  C:\Windows\System\cjjPKRk.exe
  2⤵
  PID:13936
- C:\Windows\System\YXllDmd.exe
  C:\Windows\System\YXllDmd.exe
  2⤵
  PID:13964
- C:\Windows\System\qeqURHQ.exe
  C:\Windows\System\qeqURHQ.exe
  2⤵
  PID:13980
- C:\Windows\System\bUzWooM.exe
  C:\Windows\System\bUzWooM.exe
  2⤵
  PID:14000
- C:\Windows\System\oNIaItN.exe
  C:\Windows\System\oNIaItN.exe
  2⤵
  PID:14040
- C:\Windows\System\pDezMuh.exe
  C:\Windows\System\pDezMuh.exe
  2⤵
  PID:14076
- C:\Windows\System\RicwOAC.exe
  C:\Windows\System\RicwOAC.exe
  2⤵
  PID:14104
- C:\Windows\System\vlwpmcB.exe
  C:\Windows\System\vlwpmcB.exe
  2⤵
  PID:14132
- C:\Windows\System\MBzYkek.exe
  C:\Windows\System\MBzYkek.exe
  2⤵
  PID:14160
- C:\Windows\System\OYyIrDK.exe
  C:\Windows\System\OYyIrDK.exe
  2⤵
  PID:14192
- C:\Windows\System\pPInsNz.exe
  C:\Windows\System\pPInsNz.exe
  2⤵
  PID:14208
- C:\Windows\System\qIfjKgg.exe
  C:\Windows\System\qIfjKgg.exe
  2⤵
  PID:14248
- C:\Windows\System\NtSrhhR.exe
  C:\Windows\System\NtSrhhR.exe
  2⤵
  PID:14268
- C:\Windows\System\jYiMMEr.exe
  C:\Windows\System\jYiMMEr.exe
  2⤵
  PID:14304
- C:\Windows\System\HPCrKwU.exe
  C:\Windows\System\HPCrKwU.exe
  2⤵
  PID:14320
- C:\Windows\System\dKUcmoq.exe
  C:\Windows\System\dKUcmoq.exe
  2⤵
  PID:13340
- C:\Windows\System\mTFrnWO.exe
  C:\Windows\System\mTFrnWO.exe
  2⤵
  PID:13364
- C:\Windows\System\iOavjBK.exe
  C:\Windows\System\iOavjBK.exe
  2⤵
  PID:13408
- C:\Windows\System\kOHovyz.exe
  C:\Windows\System\kOHovyz.exe
  2⤵
  PID:13504
- C:\Windows\System\AooxuZF.exe
  C:\Windows\System\AooxuZF.exe
  2⤵
  PID:13552
- C:\Windows\System\QawaXZz.exe
  C:\Windows\System\QawaXZz.exe
  2⤵
  PID:1072
- C:\Windows\System\RYxbbuY.exe
  C:\Windows\System\RYxbbuY.exe
  2⤵
  PID:13752
- C:\Windows\System\HVtZUYZ.exe
  C:\Windows\System\HVtZUYZ.exe
  2⤵
  PID:13788
- C:\Windows\System\pBpqYBN.exe
  C:\Windows\System\pBpqYBN.exe
  2⤵
  PID:13832
- C:\Windows\System\imdSpIL.exe
  C:\Windows\System\imdSpIL.exe
  2⤵
  PID:13896
- C:\Windows\System\QQKqOIP.exe
  C:\Windows\System\QQKqOIP.exe
  2⤵
  PID:13976
- C:\Windows\System\qfohSJQ.exe
  C:\Windows\System\qfohSJQ.exe
  2⤵
  PID:14052
- C:\Windows\System\jYkeeyO.exe
  C:\Windows\System\jYkeeyO.exe
  2⤵
  PID:14120
- C:\Windows\System\LcPPMYX.exe
  C:\Windows\System\LcPPMYX.exe
  2⤵
  PID:14204
- C:\Windows\System\pLVxlkc.exe
  C:\Windows\System\pLVxlkc.exe
  2⤵
  PID:14276
- C:\Windows\System\OJjBPnv.exe
  C:\Windows\System\OJjBPnv.exe
  2⤵
  PID:14296
- C:\Windows\System\gWOaGNW.exe
  C:\Windows\System\gWOaGNW.exe
  2⤵
  PID:13320
- C:\Windows\System\GYuhBKG.exe
  C:\Windows\System\GYuhBKG.exe
  2⤵
  PID:13480
- C:\Windows\System\XVXjAkW.exe
  C:\Windows\System\XVXjAkW.exe
  2⤵
  PID:13656
- C:\Windows\System\FxChwRd.exe
  C:\Windows\System\FxChwRd.exe
  2⤵
  PID:13732
- C:\Windows\System\rGlVDAx.exe
  C:\Windows\System\rGlVDAx.exe
  2⤵
  PID:2052
- C:\Windows\System\xjJJziw.exe
  C:\Windows\System\xjJJziw.exe
  2⤵
  PID:14020
- C:\Windows\System\eDITJTl.exe
  C:\Windows\System\eDITJTl.exe
  2⤵
  PID:14188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BgnzdCx.exe

Filesize
2.1MB

MD5
63d7ff063e3cbba34475176dcc8c78d5

SHA1
4e59e56c73ed1f9840a79e0139e6ef194352e3c4

SHA256
c48c7e4b81869413b2101bb9f96786b12a9b1130028ce5334ec6ec69a9e75e89

SHA512
561728b85d93803554f986e25dff44f202d9bf86d64a5e53bb74808182e43e8d3a736b6b4edb5525825196da57930b2cf68f436dff35686aa77445018003a755

Download Submit
C:\Windows\System\BhfwAYX.exe

Filesize
2.1MB

MD5
855a2897de95bfe550c3ea3c6e10659f

SHA1
0e19151a04c26e9c78dc3a2decbbdfb41790872f

SHA256
5783715820a6545fa4e4db5e099877ca3f964f12292410d2210d1026fbee26f1

SHA512
0f53d65c4136585fcf3b366f0cbb3e5988d31b56b5f48a3ea06fc9f8c8dce144ef50fc28bd0a1a77cd90a45a6851ac388ad2b903b388ece98780685c068f9c3e

Download Submit
C:\Windows\System\EnBlADX.exe

Filesize
2.1MB

MD5
a937c0378ba4d3c147c9cc54567b944a

SHA1
abab8569d8c8c69bfdfc9a22c091faa464b288e3

SHA256
63bc76636cfb23ea97014958656339a18e87a6c7bdc6d34b8b031c2f84cafe01

SHA512
4bf5d2ec0de71c658d347c40ba1fc8def2de0335fae2a2583774f8d89fe0c0850b323ed5a5994ed370ffac5783e3e3a8d0fdcc5bae6045cc37cbc78f42556003

Download Submit
C:\Windows\System\FibWMLt.exe

Filesize
2.1MB

MD5
f12558b1f911764273c09b55c6481d9f

SHA1
4a7b1dd6ba701fab39fc9841bfcaabeddc5484b2

SHA256
478147c9ab8aafe3370db403480516ec8b8d66abd73603abd5b34484e47c94d3

SHA512
8ee5ba5dfe6bb1160ec9b758f30e8a2ede9adfd34ff1f1b27be574116cbfe3103001aae8abfe77d60cb802465f9db11ec51db72ce3ae6060e63aac461c42c7b8

Download Submit
C:\Windows\System\KrorlHU.exe

Filesize
2.1MB

MD5
63fd7f76035aae5aeb5840b6b2dc51e7

SHA1
eb718c547b3546835156d0a8006503c7a6a483b9

SHA256
e6c3c62d4dee72355da5cbf276b80818c589929e5566863b81c868a436327527

SHA512
97ed722b3ef5ca3c363ae62e0b29684d7497c059ffcc58ac35b9cbcf0e1676200cf4ada5413ff3b152a962b787da9f7f0b6965762b7d64bf1b9e7807f832637a

Download Submit
C:\Windows\System\LtZknwo.exe

Filesize
2.1MB

MD5
4ce6da935d878d701e5ecaa60bdb6092

SHA1
984a309ec9329e0ad53bb97ce18f3bb331b163d9

SHA256
ac30cdade434868a3dbd362b288a1494fda38584d70e343822ee90b320cffc90

SHA512
e0b5f7e97a54062dd64068b2b10a9da202171759ca8b84fede9160a51316f6afab14d7bfea74b6673805bea13d72e8dcf2eec7c6352f4874e08fbe7b52be78dc

Download Submit
C:\Windows\System\MRrGSiF.exe

Filesize
2.1MB

MD5
fb233224138a270399e4e205169c3480

SHA1
77674006fab4a66e876eae1d6433e061d181022b

SHA256
8bf7581b0fd53aa3b24b750c1838ce2e4beeda48acf249587e41b5def28ad301

SHA512
e5eb6bc2500754a3eb47646a14553969a4f04e6061ce847d325cfeaaf2606d002aa73ac3ee564833fbf14c2b5fb16e01bde94ed26d653aa87b3ee20b235558be

Download Submit
C:\Windows\System\MvdKiLP.exe

Filesize
2.1MB

MD5
86cc74fef62700447f50857e6ae3e275

SHA1
2ea9d7d9d62ccebdd6fc1fe44a545638173df5a9

SHA256
5c905af871b8dc3b033956467bf7ac23ce9780f81d241584ecb0e22155e2fae9

SHA512
65295e1656e069fe4305e898062b88454159259cfd99c1d6a057e4678f6bd5c8ea5d98de015c22bd9bca53af34d95b2d748ff56eac0fe25436cba446b91692f2

Download Submit
C:\Windows\System\PYhUeDj.exe

Filesize
2.1MB

MD5
71d88436b1783ee9bc6a28ec1353025a

SHA1
bbea9e2d2cf8d0ecdeedaa3d7edd8731937e5ce1

SHA256
36da186da502cd23397efb8d08d37c4373b9d260b9d2e5d0c9e86bfdda09ba91

SHA512
94dc7da64e95ca2310dbcfa3572891f6471fa8c69b09134c69927d3c745ac1a750770cb71334f7dce3d09c8c0d6eaf26757b659bcbf925dd4b731cecd06d4cab

Download Submit
C:\Windows\System\PlSKkFT.exe

Filesize
2.1MB

MD5
f53434fd299bd7b213e15d0e1895733d

SHA1
ca730a850f7393d9d9662eeece24053724751e25

SHA256
88634fa17ca96bc8823899649040278253ac604de1804768219c1cc9345d9a9c

SHA512
6241477ffed410e82d3496c7d05386d0c0e1f29b146e2d978dd7ac5a366d2f1041b0cddb4d0c64c40e2f9e0b35a02d61684dcef30a064e47cb2392f9131f477d

Download Submit
C:\Windows\System\QlSTbzA.exe

Filesize
2.1MB

MD5
34b7b5121f6d952fc04be4f9605e686a

SHA1
cc9da264dc54a2b89a84c6856058ba3b5bd13489

SHA256
071d53747c852d869cb7cc937973422d7efec567323a6fda55ca1cf06dfff479

SHA512
21a4c4bcaa74bc73fad7a384ba5bcfdc6457c10dd2aa1a77d5acb91cc00d9426a1db5d5c9859955248ecacde13436208531543b9eb9b6df723443e74a47235e3

Download Submit
C:\Windows\System\SHGRyuk.exe

Filesize
2.1MB

MD5
351d50a98a642ebf6714c1aa63b76436

SHA1
434ebdeb6791fb958f377604445710ec54219b4b

SHA256
9ecf42be7f0497e1126cc58a1a94c61825378b7ad3e3d8d2670f9e0adcffa2ea

SHA512
af1f6a96df24bfc066cc5bb3acf994237db9645f3cee9e2be50e92dc61e56889fffc4b771a79363a232428ffc5d33044f52ae12d7f4daf20156be5cfe201f40b

Download Submit
C:\Windows\System\TKEXEEZ.exe

Filesize
2.1MB

MD5
5ca134d8426ac9288ffb54a22d2b4c7c

SHA1
b02ed5916fe739bd55ee66673f06237bdb4e415f

SHA256
2c0b25b44af78b65ba450c15e243d7001b8e97f6c6f5d8594e94374f71d6f5c3

SHA512
0db213bddf115782a25c8e35a66a0525ece775b16711266bdc323c930a4d4306fabeec66f8d5b62ad2601ba956d8212343950c3c553ee9841739f555431c9870

Download Submit
C:\Windows\System\TcFVdpN.exe

Filesize
2.1MB

MD5
a8314d3f87b83a1dd6098d0c906b89d5

SHA1
93f1a24b7fc300e0d9506c298dd3226d7c72404b

SHA256
78b3a04e0b605d401b4e0b51de751bd124ac44436a291afe6d51782ca51c28c5

SHA512
393d824066b7f2f7a66de4ec88c387001e34e152ecbddf9e2dc30fe747d8cd2d1bb264b112628797487f3e4d72c9819c3042ce0d461f546e3cd11cf117507851

Download Submit
C:\Windows\System\UagxKEc.exe

Filesize
2.1MB

MD5
949a6622c9345de9805ea68963aef550

SHA1
1381a20c3753e993c779d3ebff5ce2c5d48f9eb7

SHA256
0fd5969a6b478ee661dd59a3274ee1997c6d7e8a62e50b7b14741230178510f4

SHA512
1000e981a9866317cfaf6942ad3edccd5968518053b2112705e707347d2c32ee4de2b6eac08a09555b75dbcb1c29123972655850efc47a8f8cac7deb1eb2e2c4

Download Submit
C:\Windows\System\WIXjbmI.exe

Filesize
2.1MB

MD5
d73757120aac13d60737c1aac6825c2b

SHA1
d6a075269bd75194175bdb7dc940f2e7d5e41eed

SHA256
89541d4a994e558967ade69b6cd4ee7b7e6292bc53b24fa674d81d8fb46f9634

SHA512
1040dc118ce17856d08de337142ce0c627aa459dba02dc64ea13408c74a3dcbda600a94d1452dc74ecf04f25d638009c8f3371867c188ce829d8cb03f0167ec0

Download Submit
C:\Windows\System\XHLIogk.exe

Filesize
2.1MB

MD5
18651c29b9dafe08f7c11a90082d2fa0

SHA1
3acd0471ee794d1fedf09ee3e55a9d152495b03e

SHA256
a71506986e6669bf74900febf03ec28971e7160b98650ff9a4c02805144fdf6a

SHA512
37679a8e77237f8510727cb58e57ba6faf4ff01353fda82e1495089c2dab653d689bf046d5a7dc458e0f8e239758e94189e1301eb67afd11f28c901e2dc42f29

Download Submit
C:\Windows\System\XnXTCWs.exe

Filesize
2.1MB

MD5
bfcd7ab352a3a71602f05b5f5193131f

SHA1
45b9360fca97fa07a2668083837321d7dcf4edda

SHA256
f8763a50405dfefc0d6f1850f40c3c08718f8a3a82cbec58fa743af50d43bf05

SHA512
3494087ec37ba54220ed7c4cc20a6109088dd9cd6cc94a6d64d1e6411191d68d6c1e3ee09f5edf07c8caf5d2f4a26c747f977042790018a004ceb6cab8bba0df

Download Submit
C:\Windows\System\abhtUCv.exe

Filesize
2.1MB

MD5
9a47d103ec908d9eed68bf5eb7aefd8c

SHA1
6cdf291fe98b9fdc0885ebd2cf31781ed01dcf14

SHA256
0f54ec277e58de3b22359aadd09b1bce05a7571ba1daa82ea65e0a173e624b92

SHA512
1570e07553069a12ea21606b896de30db82f6dcfaea919933bea5dc17cabb79e10990e5d6ae8072387c1e97a5c80f8831644c034a3f26171f0306eb9d33d56e5

Download Submit
C:\Windows\System\bQfahsc.exe

Filesize
2.1MB

MD5
90ae3e2bbcefd71c8a50f94240f30ca0

SHA1
4fd8a26dde66ffd5758b19fa0b76f6c0436de000

SHA256
9c6dbe7ca24695cb8d2713a76c276e21566ac742bc1218bec62e828d15bcbd30

SHA512
120de77997f82e3ba14530375c229ef3b4655921dc84a2a7f5cde88a97f6c1dec8cec162701333a99e05ff2cb25804f635c0fecc6a6548e11d934d75cad8099e

Download Submit
C:\Windows\System\dYeXTgv.exe

Filesize
2.1MB

MD5
1262e01a53ec9973f5098a38b8be501c

SHA1
6a9817736da63961b8e4b2e3b888b6a9fd9abc50

SHA256
ec727e2138cdc051309a20d8e378ec7304f4feff4b397103c93eb379bbcd73aa

SHA512
e6d5b8baa2c754ecf7f78fb115be301aa08a6ecd795723c4e8681dbb970beebe7b59cee205acd63d24c44d39c8a15a08cde2530cb40a60e2f056f796dafb54cd

Download Submit
C:\Windows\System\enpJVpi.exe

Filesize
2.1MB

MD5
ea994edc12c5099ba770af5ed5deb75a

SHA1
a2324fcd0964e8fa6fb0d048038e572f6cbbcfc7

SHA256
f4a1482a8b6d43629a684d8feb6ad0b19d1ee9ca85be0c389cef242c5c1a1e50

SHA512
2db63f613a0803a9194b915b4faed81c8728a28ae910c7f8ea3bd0ddeacdc1722b7596047a61243535df285b9d662b55699c8faa55bbef3364e4098f5f0f6d03

Download Submit
C:\Windows\System\iTBPkgB.exe

Filesize
2.1MB

MD5
8ebca0f69db3d7804fb0c15475308be7

SHA1
31207bd59d21aeb2941d9b67a408a28643805d1b

SHA256
b9e9889d005258ac7cf6718fb6b5d7a8a489335e110d4abfcdea1f2cec369f50

SHA512
3bf6e45727f330bb4f97c9d547a586b86719b9ca56e640ccae2476b5915e755d2cff45c9a9a27cf82c7aa039c1a47b590c151d5d54c37e3536ab76b6130a6732

Download Submit
C:\Windows\System\lnpOziV.exe

Filesize
2.1MB

MD5
ba91dcb65381ee1367194bda9f339730

SHA1
3c1082eee99d755263f002480a43e304ff6a3420

SHA256
579b2d740d1a5004aaace5fd558799af8a6b121c0587b88b3bb605309078991c

SHA512
316125ab5941cd2664f8da80bfa135e7534edbb7054f362fce741daf538536ea01633251d63c59f9b0f8a645e0da7491fc6ce69196d8644921e53501bafc2ddc

Download Submit
C:\Windows\System\mEnQERD.exe

Filesize
2.1MB

MD5
e5067735625018060566be88fcb95738

SHA1
34c394b1c669ced5d100d6ed6ddd20cc65e7f135

SHA256
79972d050904c14c80251610c4e65cf4d667f401daec45cfdd50238986d4a3f5

SHA512
561a171e32ba03c3a0a35624c3e0406b3c198ec2e24bab20c2aca86c87fdf8b0a4a361a0f6d439b6a520bd356f8e9e814ee978c0fdd2fbb48f6d51fbb15c36f1

Download Submit
C:\Windows\System\mZhPQZR.exe

Filesize
2.1MB

MD5
3fc23c0d0603d2e047f14b49de73ee84

SHA1
f3431205c10e228f7dfdda3cd44815b0d4317884

SHA256
127c21c715b3b54b7ab08cf02ccac10b3348211c3a90c0f013d323732bd18a56

SHA512
53c7d4d4be981ccdc85dbd02bd2ebdcb56f70e9860cd4f2be4f2407708e009d3921189228b76d03cf8f04a2f3b3d92f65549bb9b6b0a35f69243fec263bec01a

Download Submit
C:\Windows\System\mjrJyDe.exe

Filesize
2.1MB

MD5
08007b71de8cabe138546d40547420e8

SHA1
1472986a0e6ac956329e06851f015b88f8058edf

SHA256
97eea958335d7dc9d38832ead732804c33666833dee8651079552e6a71f1cc2f

SHA512
9610d385b9931d1fc37dfe2792bbd90be934bf1d0da61aead119565a1a42532b6abc7ff8d64f0093e0e40eae429c7d50e5edbef32a1d095ce03ee4dcb33429e6

Download Submit
C:\Windows\System\oOMMxyM.exe

Filesize
2.1MB

MD5
912e851f7fab804b406bba73be5ce078

SHA1
a5bd0ad9002f3fe0a9f5469fd182bb240964970f

SHA256
e0e0324ddd9056788e8b712ca7ff9a4fd64cc8bdd5f2f242f01e127952fb4de8

SHA512
4e169681a193a3abd3b70c37ec2d21f8bde0006c68b733ec483ddf94b1cbcdb3dfce39b5d528140d595f6686b933c732602dafaa5488d7d44b9126bd04c693c6

Download Submit
C:\Windows\System\pdReynu.exe

Filesize
2.1MB

MD5
36d0401d97cb9ce472f07459a44daf49

SHA1
a797a1dee19c79e055ff0b17078aeab01b938a46

SHA256
4e31655cd0888c07dda66a28e4918ef55b7be688735337280c0c8df98b712ab5

SHA512
5c77121a90bdee1b137ee673814054267aa98afeaa207c2c40e1cb083672b3982003ca92376778859f166f000a3640c656329ebd823eaa7f9198bd5d7b8a1245

Download Submit
C:\Windows\System\qxGyKeh.exe

Filesize
2.1MB

MD5
6700537656f1f0e41157a8eeb7591773

SHA1
98ff9fb97de97114fd4cf84cdb6f126a882f6cf1

SHA256
f81e4cd95ae45576b19b0e2c2a780c5904c6de67dfe17bc051328b7f8caff83e

SHA512
e296bb5a874c1bc7916a96a7df0e3ff9acfe96bb52ce393734b4bcf124451b1160e934fcecd02d5dd2d1baa1a82afb1fd250c7a7c817982c713a0f1c769b2752

Download Submit
C:\Windows\System\sTtoQmL.exe

Filesize
2.1MB

MD5
1d15d2436341bd1b8d367745ebdc2008

SHA1
8d4bd006b78a2f8caa2550078f7c3fd7f16e4cf7

SHA256
95eaa67104ac4aa27e208274dd0c65639d577d88f85a9787cd5364abb2d8bedc

SHA512
d9e6ea6f8d4aee39fd0cedeb2cc4dd7b62eb27c0f7031ea6fca7634feac559b8ea66e8ddfefbff417938726e569905c16e27d1d062605e092edcb358c2b72481

Download Submit
C:\Windows\System\vaaEjZM.exe

Filesize
2.1MB

MD5
f4521ff60fe5f48bff24b6c1adb580e5

SHA1
bd478f8d579b8456ea7c1bb96cf3a6f4263c9ef0

SHA256
c30c838b0edef250d1b1360eccf687feb85b2fad6ebefed7b157146dbd93d555

SHA512
7bcdf65263250eba31a860c970238ab57e0d73edcaf5feb979768b4a0fc256d3ac416a75b3f29c444afe23aba9e25ed595c76cfd7821f750110690709260faec

Download Submit
C:\Windows\System\zMpOAcz.exe

Filesize
2.1MB

MD5
8f2a0ff02ab9e6b0eb8a956a62019281

SHA1
031385b98ece3bab8fd86bc978aec5fabdf1bb1f

SHA256
4f16a8013997f9813a0ad7733cfd3163e8a85c67de47db25ae9d50b078ae68f8

SHA512
0efa2cb20c5a45082d9dd65287e4f4c35a055aa210d05c6f3ac59c8fc589d47dce9d7ac864f966d3ee7dc9f883c14f121988b61cbba5db76a8a7cee5b87c7b64

Download Submit
memory/224-1-0x00000275D5E60000-0x00000275D5E70000-memory.dmp

Filesize
64KB

Download
memory/224-0-0x00007FF740EF0000-0x00007FF741244000-memory.dmp

Filesize
3.3MB

Download
memory/384-703-0x00007FF666C00000-0x00007FF666F54000-memory.dmp

Filesize
3.3MB

Download
memory/384-2118-0x00007FF666C00000-0x00007FF666F54000-memory.dmp

Filesize
3.3MB

Download
memory/468-810-0x00007FF74D240000-0x00007FF74D594000-memory.dmp

Filesize
3.3MB

Download
memory/468-2135-0x00007FF74D240000-0x00007FF74D594000-memory.dmp

Filesize
3.3MB

Download
memory/712-804-0x00007FF6A8590000-0x00007FF6A88E4000-memory.dmp

Filesize
3.3MB

Download
memory/712-2127-0x00007FF6A8590000-0x00007FF6A88E4000-memory.dmp

Filesize
3.3MB

Download
memory/744-11-0x00007FF6E3FF0000-0x00007FF6E4344000-memory.dmp

Filesize
3.3MB

Download
memory/744-2107-0x00007FF6E3FF0000-0x00007FF6E4344000-memory.dmp

Filesize
3.3MB

Download
memory/848-2132-0x00007FF632B60000-0x00007FF632EB4000-memory.dmp

Filesize
3.3MB

Download
memory/848-722-0x00007FF632B60000-0x00007FF632EB4000-memory.dmp

Filesize
3.3MB

Download
memory/1012-759-0x00007FF6A6A50000-0x00007FF6A6DA4000-memory.dmp

Filesize
3.3MB

Download
memory/1012-2128-0x00007FF6A6A50000-0x00007FF6A6DA4000-memory.dmp

Filesize
3.3MB

Download
memory/1376-2105-0x00007FF765220000-0x00007FF765574000-memory.dmp

Filesize
3.3MB

Download
memory/1376-2108-0x00007FF765220000-0x00007FF765574000-memory.dmp

Filesize
3.3MB

Download
memory/1376-14-0x00007FF765220000-0x00007FF765574000-memory.dmp

Filesize
3.3MB

Download
memory/1508-735-0x00007FF6B3F10000-0x00007FF6B4264000-memory.dmp

Filesize
3.3MB

Download
memory/1508-2125-0x00007FF6B3F10000-0x00007FF6B4264000-memory.dmp

Filesize
3.3MB

Download
memory/1648-2113-0x00007FF617590000-0x00007FF6178E4000-memory.dmp

Filesize
3.3MB

Download
memory/1648-705-0x00007FF617590000-0x00007FF6178E4000-memory.dmp

Filesize
3.3MB

Download
memory/1948-711-0x00007FF6A4A60000-0x00007FF6A4DB4000-memory.dmp

Filesize
3.3MB

Download
memory/1948-2133-0x00007FF6A4A60000-0x00007FF6A4DB4000-memory.dmp

Filesize
3.3MB

Download
memory/2012-2117-0x00007FF603990000-0x00007FF603CE4000-memory.dmp

Filesize
3.3MB

Download
memory/2012-852-0x00007FF603990000-0x00007FF603CE4000-memory.dmp

Filesize
3.3MB

Download
memory/2140-789-0x00007FF6E02E0000-0x00007FF6E0634000-memory.dmp

Filesize
3.3MB

Download
memory/2140-2134-0x00007FF6E02E0000-0x00007FF6E0634000-memory.dmp

Filesize
3.3MB

Download
memory/2172-701-0x00007FF7EE0A0000-0x00007FF7EE3F4000-memory.dmp

Filesize
3.3MB

Download
memory/2172-2116-0x00007FF7EE0A0000-0x00007FF7EE3F4000-memory.dmp

Filesize
3.3MB

Download
memory/2380-762-0x00007FF75FE30000-0x00007FF760184000-memory.dmp

Filesize
3.3MB

Download
memory/2380-2129-0x00007FF75FE30000-0x00007FF760184000-memory.dmp

Filesize
3.3MB

Download
memory/2588-707-0x00007FF671CB0000-0x00007FF672004000-memory.dmp

Filesize
3.3MB

Download
memory/2588-2121-0x00007FF671CB0000-0x00007FF672004000-memory.dmp

Filesize
3.3MB

Download
memory/2612-700-0x00007FF6F2A40000-0x00007FF6F2D94000-memory.dmp

Filesize
3.3MB

Download
memory/2612-2112-0x00007FF6F2A40000-0x00007FF6F2D94000-memory.dmp

Filesize
3.3MB

Download
memory/2620-868-0x00007FF68ABB0000-0x00007FF68AF04000-memory.dmp

Filesize
3.3MB

Download
memory/2620-2111-0x00007FF68ABB0000-0x00007FF68AF04000-memory.dmp

Filesize
3.3MB

Download
memory/2904-2122-0x00007FF63F320000-0x00007FF63F674000-memory.dmp

Filesize
3.3MB

Download
memory/2904-708-0x00007FF63F320000-0x00007FF63F674000-memory.dmp

Filesize
3.3MB

Download
memory/3180-770-0x00007FF6B4ED0000-0x00007FF6B5224000-memory.dmp

Filesize
3.3MB

Download
memory/3180-2126-0x00007FF6B4ED0000-0x00007FF6B5224000-memory.dmp

Filesize
3.3MB

Download
memory/3284-2110-0x00007FF78B940000-0x00007FF78BC94000-memory.dmp

Filesize
3.3MB

Download
memory/3284-2106-0x00007FF78B940000-0x00007FF78BC94000-memory.dmp

Filesize
3.3MB

Download
memory/3284-23-0x00007FF78B940000-0x00007FF78BC94000-memory.dmp

Filesize
3.3MB

Download
memory/3748-748-0x00007FF6968B0000-0x00007FF696C04000-memory.dmp

Filesize
3.3MB

Download
memory/3748-2130-0x00007FF6968B0000-0x00007FF696C04000-memory.dmp

Filesize
3.3MB

Download
memory/3872-2119-0x00007FF6A10E0000-0x00007FF6A1434000-memory.dmp

Filesize
3.3MB

Download
memory/3872-706-0x00007FF6A10E0000-0x00007FF6A1434000-memory.dmp

Filesize
3.3MB

Download
memory/4172-2120-0x00007FF62C220000-0x00007FF62C574000-memory.dmp

Filesize
3.3MB

Download
memory/4172-828-0x00007FF62C220000-0x00007FF62C574000-memory.dmp

Filesize
3.3MB

Download
memory/4556-2131-0x00007FF61DD60000-0x00007FF61E0B4000-memory.dmp

Filesize
3.3MB

Download
memory/4556-729-0x00007FF61DD60000-0x00007FF61E0B4000-memory.dmp

Filesize
3.3MB

Download
memory/4576-2124-0x00007FF7727B0000-0x00007FF772B04000-memory.dmp

Filesize
3.3MB

Download
memory/4576-710-0x00007FF7727B0000-0x00007FF772B04000-memory.dmp

Filesize
3.3MB

Download
memory/4816-702-0x00007FF6E0160000-0x00007FF6E04B4000-memory.dmp

Filesize
3.3MB

Download
memory/4816-2115-0x00007FF6E0160000-0x00007FF6E04B4000-memory.dmp

Filesize
3.3MB

Download
memory/4952-2123-0x00007FF6A3610000-0x00007FF6A3964000-memory.dmp

Filesize
3.3MB

Download
memory/4952-709-0x00007FF6A3610000-0x00007FF6A3964000-memory.dmp

Filesize
3.3MB

Download
memory/5080-2109-0x00007FF7B53F0000-0x00007FF7B5744000-memory.dmp

Filesize
3.3MB

Download
memory/5080-35-0x00007FF7B53F0000-0x00007FF7B5744000-memory.dmp

Filesize
3.3MB

Download
memory/5084-704-0x00007FF7AB2C0000-0x00007FF7AB614000-memory.dmp

Filesize
3.3MB

Download
memory/5084-2114-0x00007FF7AB2C0000-0x00007FF7AB614000-memory.dmp

Filesize
3.3MB

Download