xmrig | e232c87e86e447e3311b38ef260200f025a54fb8eae07e6f4a3a8173920babfa

Analysis

max time kernel
122s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
Size

2.2MB
MD5

041767e3a5f3437480cd09e9418a0330
SHA1

d31aca9fd41168a147cec123fd82f52e3f4016f1
SHA256

e232c87e86e447e3311b38ef260200f025a54fb8eae07e6f4a3a8173920babfa
SHA512

7afec781face7d68eb5ffe71cb6fc833399e32e3490810810b9c876a9ddc06b0d0ed64930b974ff0a2a1fcd45bf39315ceb3dda230b2028beb1c3f09027a84d7
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMm+ZQaLwBXhux:BemTLkNdfE0pZry

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4048-0-0x00007FF632950000-0x00007FF632CA4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ed-7.dat	xmrig
behavioral2/files/0x00070000000233ef-19.dat	xmrig
behavioral2/files/0x00070000000233ee-17.dat	xmrig
behavioral2/files/0x00070000000233f1-36.dat	xmrig
behavioral2/files/0x00070000000233f2-42.dat	xmrig
behavioral2/files/0x00070000000233f6-62.dat	xmrig
behavioral2/files/0x00070000000233f7-75.dat	xmrig
behavioral2/files/0x00070000000233fd-97.dat	xmrig
behavioral2/files/0x0007000000023402-122.dat	xmrig
behavioral2/memory/3680-728-0x00007FF790A00000-0x00007FF790D54000-memory.dmp	xmrig
behavioral2/files/0x000700000002340b-167.dat	xmrig
behavioral2/files/0x0007000000023409-165.dat	xmrig
behavioral2/files/0x000700000002340a-162.dat	xmrig
behavioral2/files/0x0007000000023408-160.dat	xmrig
behavioral2/files/0x0007000000023407-155.dat	xmrig
behavioral2/files/0x0007000000023406-150.dat	xmrig
behavioral2/files/0x0007000000023405-145.dat	xmrig
behavioral2/files/0x0007000000023404-137.dat	xmrig
behavioral2/files/0x0007000000023403-133.dat	xmrig
behavioral2/files/0x0007000000023401-125.dat	xmrig
behavioral2/files/0x0007000000023400-120.dat	xmrig
behavioral2/files/0x00070000000233ff-115.dat	xmrig
behavioral2/files/0x00070000000233fe-110.dat	xmrig
behavioral2/files/0x00070000000233fc-100.dat	xmrig
behavioral2/files/0x00070000000233fb-95.dat	xmrig
behavioral2/files/0x00070000000233fa-90.dat	xmrig
behavioral2/memory/4704-729-0x00007FF7CA4B0000-0x00007FF7CA804000-memory.dmp	xmrig
behavioral2/memory/4132-730-0x00007FF620560000-0x00007FF6208B4000-memory.dmp	xmrig
behavioral2/memory/700-732-0x00007FF6E13F0000-0x00007FF6E1744000-memory.dmp	xmrig
behavioral2/memory/1216-731-0x00007FF7241E0000-0x00007FF724534000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f9-85.dat	xmrig
behavioral2/files/0x00070000000233f8-80.dat	xmrig
behavioral2/files/0x00070000000233f5-65.dat	xmrig
behavioral2/memory/1672-759-0x00007FF71B1F0000-0x00007FF71B544000-memory.dmp	xmrig
behavioral2/memory/3736-767-0x00007FF6E9370000-0x00007FF6E96C4000-memory.dmp	xmrig
behavioral2/memory/4552-764-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp	xmrig
behavioral2/memory/1744-755-0x00007FF6862C0000-0x00007FF686614000-memory.dmp	xmrig
behavioral2/memory/3500-753-0x00007FF72AF20000-0x00007FF72B274000-memory.dmp	xmrig
behavioral2/memory/3524-747-0x00007FF6C2950000-0x00007FF6C2CA4000-memory.dmp	xmrig
behavioral2/memory/4084-744-0x00007FF6DF430000-0x00007FF6DF784000-memory.dmp	xmrig
behavioral2/memory/4652-794-0x00007FF639AC0000-0x00007FF639E14000-memory.dmp	xmrig
behavioral2/memory/4532-796-0x00007FF63EF40000-0x00007FF63F294000-memory.dmp	xmrig
behavioral2/memory/2644-788-0x00007FF627A30000-0x00007FF627D84000-memory.dmp	xmrig
behavioral2/memory/3944-787-0x00007FF686830000-0x00007FF686B84000-memory.dmp	xmrig
behavioral2/memory/4572-784-0x00007FF626720000-0x00007FF626A74000-memory.dmp	xmrig
behavioral2/memory/2808-780-0x00007FF658860000-0x00007FF658BB4000-memory.dmp	xmrig
behavioral2/memory/5028-777-0x00007FF62A5A0000-0x00007FF62A8F4000-memory.dmp	xmrig
behavioral2/memory/972-776-0x00007FF72A720000-0x00007FF72AA74000-memory.dmp	xmrig
behavioral2/memory/2816-741-0x00007FF7D5250000-0x00007FF7D55A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f4-60.dat	xmrig
behavioral2/files/0x00070000000233f3-55.dat	xmrig
behavioral2/memory/816-799-0x00007FF6B0AE0000-0x00007FF6B0E34000-memory.dmp	xmrig
behavioral2/memory/4284-798-0x00007FF79B2A0000-0x00007FF79B5F4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f0-40.dat	xmrig
behavioral2/memory/2772-33-0x00007FF69A7D0000-0x00007FF69AB24000-memory.dmp	xmrig
behavioral2/memory/1228-28-0x00007FF78B330000-0x00007FF78B684000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ec-27.dat	xmrig
behavioral2/memory/2576-24-0x00007FF621450000-0x00007FF6217A4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233e8-21.dat	xmrig
behavioral2/memory/3556-13-0x00007FF75D5B0000-0x00007FF75D904000-memory.dmp	xmrig
behavioral2/memory/2844-804-0x00007FF6BF520000-0x00007FF6BF874000-memory.dmp	xmrig
behavioral2/memory/2948-808-0x00007FF76E560000-0x00007FF76E8B4000-memory.dmp	xmrig
behavioral2/memory/4048-2114-0x00007FF632950000-0x00007FF632CA4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3556	UUWxkpH.exe
2576	xZOoLVj.exe
3680	bLfXqDG.exe
1228	NmcRCcl.exe
2772	wbMHwrI.exe
4704	yIeMEmZ.exe
2948	sCSOYsC.exe
4132	GrZwDPX.exe
1216	BtPyKRh.exe
700	eNalhUY.exe
2816	FsLlBEA.exe
4084	pjYHSdL.exe
3524	JRtgRPr.exe
3500	PxSUVXr.exe
1744	TjJkbXc.exe
1672	lsYAPUT.exe
4552	mLfTXsB.exe
3736	yGgGvWH.exe
972	fwSXrwJ.exe
5028	MqBYgaI.exe
2808	yyklgIU.exe
4572	phIRzkF.exe
3944	jIaNckZ.exe
2644	ntCOYlp.exe
4652	bMoFVgu.exe
4532	zSQJjqS.exe
4284	IfDTMQs.exe
816	pCSbAnG.exe
2844	cCrBfcs.exe
2588	LzopRdD.exe
2684	MfsNAxK.exe
2804	bZBLbfH.exe
2124	SzbphNC.exe
2280	rJZNLPJ.exe
3916	JCirZhl.exe
4160	CDFYcvc.exe
1280	zkOZxTB.exe
5072	dtIpTzg.exe
3048	EUXUisZ.exe
2768	IuSoYtP.exe
4696	iuiFSUI.exe
4640	TQpmafZ.exe
4204	ZQYScaO.exe
2444	gDgjPaE.exe
4668	Ovsmkai.exe
4224	daPJLwx.exe
4508	dceoCgx.exe
1564	EtRZSeV.exe
1160	zdTifMS.exe
4664	bjRKlfj.exe
2268	fdfULia.exe
1376	MJQhBjh.exe
1636	mabSwbC.exe
2992	LJGpZpi.exe
2168	zjDiwUK.exe
872	TJgFTGw.exe
1568	WEaAOwJ.exe
2536	tHmPcmI.exe
840	CQfcTpE.exe
4656	KUVyLwv.exe
3800	OZfOwJO.exe
3764	FxmcuZf.exe
512	oTpMNXg.exe
2200	TkDyXqb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4048-0-0x00007FF632950000-0x00007FF632CA4000-memory.dmp	upx
behavioral2/files/0x00070000000233ed-7.dat	upx
behavioral2/files/0x00070000000233ef-19.dat	upx
behavioral2/files/0x00070000000233ee-17.dat	upx
behavioral2/files/0x00070000000233f1-36.dat	upx
behavioral2/files/0x00070000000233f2-42.dat	upx
behavioral2/files/0x00070000000233f6-62.dat	upx
behavioral2/files/0x00070000000233f7-75.dat	upx
behavioral2/files/0x00070000000233fd-97.dat	upx
behavioral2/files/0x0007000000023402-122.dat	upx
behavioral2/memory/3680-728-0x00007FF790A00000-0x00007FF790D54000-memory.dmp	upx
behavioral2/files/0x000700000002340b-167.dat	upx
behavioral2/files/0x0007000000023409-165.dat	upx
behavioral2/files/0x000700000002340a-162.dat	upx
behavioral2/files/0x0007000000023408-160.dat	upx
behavioral2/files/0x0007000000023407-155.dat	upx
behavioral2/files/0x0007000000023406-150.dat	upx
behavioral2/files/0x0007000000023405-145.dat	upx
behavioral2/files/0x0007000000023404-137.dat	upx
behavioral2/files/0x0007000000023403-133.dat	upx
behavioral2/files/0x0007000000023401-125.dat	upx
behavioral2/files/0x0007000000023400-120.dat	upx
behavioral2/files/0x00070000000233ff-115.dat	upx
behavioral2/files/0x00070000000233fe-110.dat	upx
behavioral2/files/0x00070000000233fc-100.dat	upx
behavioral2/files/0x00070000000233fb-95.dat	upx
behavioral2/files/0x00070000000233fa-90.dat	upx
behavioral2/memory/4704-729-0x00007FF7CA4B0000-0x00007FF7CA804000-memory.dmp	upx
behavioral2/memory/4132-730-0x00007FF620560000-0x00007FF6208B4000-memory.dmp	upx
behavioral2/memory/700-732-0x00007FF6E13F0000-0x00007FF6E1744000-memory.dmp	upx
behavioral2/memory/1216-731-0x00007FF7241E0000-0x00007FF724534000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-85.dat	upx
behavioral2/files/0x00070000000233f8-80.dat	upx
behavioral2/files/0x00070000000233f5-65.dat	upx
behavioral2/memory/1672-759-0x00007FF71B1F0000-0x00007FF71B544000-memory.dmp	upx
behavioral2/memory/3736-767-0x00007FF6E9370000-0x00007FF6E96C4000-memory.dmp	upx
behavioral2/memory/4552-764-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp	upx
behavioral2/memory/1744-755-0x00007FF6862C0000-0x00007FF686614000-memory.dmp	upx
behavioral2/memory/3500-753-0x00007FF72AF20000-0x00007FF72B274000-memory.dmp	upx
behavioral2/memory/3524-747-0x00007FF6C2950000-0x00007FF6C2CA4000-memory.dmp	upx
behavioral2/memory/4084-744-0x00007FF6DF430000-0x00007FF6DF784000-memory.dmp	upx
behavioral2/memory/4652-794-0x00007FF639AC0000-0x00007FF639E14000-memory.dmp	upx
behavioral2/memory/4532-796-0x00007FF63EF40000-0x00007FF63F294000-memory.dmp	upx
behavioral2/memory/2644-788-0x00007FF627A30000-0x00007FF627D84000-memory.dmp	upx
behavioral2/memory/3944-787-0x00007FF686830000-0x00007FF686B84000-memory.dmp	upx
behavioral2/memory/4572-784-0x00007FF626720000-0x00007FF626A74000-memory.dmp	upx
behavioral2/memory/2808-780-0x00007FF658860000-0x00007FF658BB4000-memory.dmp	upx
behavioral2/memory/5028-777-0x00007FF62A5A0000-0x00007FF62A8F4000-memory.dmp	upx
behavioral2/memory/972-776-0x00007FF72A720000-0x00007FF72AA74000-memory.dmp	upx
behavioral2/memory/2816-741-0x00007FF7D5250000-0x00007FF7D55A4000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-60.dat	upx
behavioral2/files/0x00070000000233f3-55.dat	upx
behavioral2/memory/816-799-0x00007FF6B0AE0000-0x00007FF6B0E34000-memory.dmp	upx
behavioral2/memory/4284-798-0x00007FF79B2A0000-0x00007FF79B5F4000-memory.dmp	upx
behavioral2/files/0x00070000000233f0-40.dat	upx
behavioral2/memory/2772-33-0x00007FF69A7D0000-0x00007FF69AB24000-memory.dmp	upx
behavioral2/memory/1228-28-0x00007FF78B330000-0x00007FF78B684000-memory.dmp	upx
behavioral2/files/0x00070000000233ec-27.dat	upx
behavioral2/memory/2576-24-0x00007FF621450000-0x00007FF6217A4000-memory.dmp	upx
behavioral2/files/0x00080000000233e8-21.dat	upx
behavioral2/memory/3556-13-0x00007FF75D5B0000-0x00007FF75D904000-memory.dmp	upx
behavioral2/memory/2844-804-0x00007FF6BF520000-0x00007FF6BF874000-memory.dmp	upx
behavioral2/memory/2948-808-0x00007FF76E560000-0x00007FF76E8B4000-memory.dmp	upx
behavioral2/memory/4048-2114-0x00007FF632950000-0x00007FF632CA4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wEdffvr.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\GmZnaYH.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\xSaMuiH.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\kCGWeCI.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\vekqQti.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\HsUtQRR.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\nhyPpku.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\KFWtlwm.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\hfTqUJJ.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\PXbxzZR.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\GfNknAi.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\MhdfPck.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\JYXxXsn.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\BtgqXCL.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\xFNfpMb.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\izBXZIu.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\mTTUBIu.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\FUvTcpb.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\enyXTTU.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\ZIkzcXd.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\noCmSkU.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\cTPeqgq.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\nCEOeEj.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\gGixQVJ.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\EgnGfpg.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\JVxtprC.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\PBzyimC.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\llCpuJF.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\twxToAq.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\FsLlBEA.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\EUXUisZ.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\ldInEPF.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\LzopRdD.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\yMQrIuv.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\eGuDfxz.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\ucWZpjv.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\tqlJuWs.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\Nwzedsz.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\WBlXigl.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\LAMhBKJ.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\spVsntS.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\iBEbKqe.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\ziUoYUI.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\gCfCmzZ.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\mLotOWW.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\gmEVpKi.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\TGwTmGe.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\AIuLWgK.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\SmPRzCW.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\lEPjTjN.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\QEIcdxj.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\ayAtKoD.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\PZxjJbI.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\kJeLWOI.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\hMvCTxt.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\GrZwDPX.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\NYNMNHs.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\YiIDjJB.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\UxqZEPy.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\VzeVIvd.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\CzOTBAb.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\iXTNSiN.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\xRAaOJP.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
File created	C:\Windows\System\BsqFBWp.exe	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3556	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	84
PID 4048 wrote to memory of 3556	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	84
PID 4048 wrote to memory of 2576	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	85
PID 4048 wrote to memory of 2576	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	85
PID 4048 wrote to memory of 2772	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	86
PID 4048 wrote to memory of 2772	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	86
PID 4048 wrote to memory of 3680	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	87
PID 4048 wrote to memory of 3680	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	87
PID 4048 wrote to memory of 1228	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	88
PID 4048 wrote to memory of 1228	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	88
PID 4048 wrote to memory of 4704	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	89
PID 4048 wrote to memory of 4704	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	89
PID 4048 wrote to memory of 2948	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	90
PID 4048 wrote to memory of 2948	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	90
PID 4048 wrote to memory of 4132	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	91
PID 4048 wrote to memory of 4132	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	91
PID 4048 wrote to memory of 1216	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	92
PID 4048 wrote to memory of 1216	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	92
PID 4048 wrote to memory of 700	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	93
PID 4048 wrote to memory of 700	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	93
PID 4048 wrote to memory of 2816	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	94
PID 4048 wrote to memory of 2816	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	94
PID 4048 wrote to memory of 4084	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	95
PID 4048 wrote to memory of 4084	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	95
PID 4048 wrote to memory of 3524	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	96
PID 4048 wrote to memory of 3524	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	96
PID 4048 wrote to memory of 3500	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	97
PID 4048 wrote to memory of 3500	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	97
PID 4048 wrote to memory of 1744	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	98
PID 4048 wrote to memory of 1744	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	98
PID 4048 wrote to memory of 1672	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	99
PID 4048 wrote to memory of 1672	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	99
PID 4048 wrote to memory of 4552	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	100
PID 4048 wrote to memory of 4552	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	100
PID 4048 wrote to memory of 3736	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	101
PID 4048 wrote to memory of 3736	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	101
PID 4048 wrote to memory of 972	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	102
PID 4048 wrote to memory of 972	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	102
PID 4048 wrote to memory of 5028	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	103
PID 4048 wrote to memory of 5028	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	103
PID 4048 wrote to memory of 2808	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	104
PID 4048 wrote to memory of 2808	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	104
PID 4048 wrote to memory of 4572	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	105
PID 4048 wrote to memory of 4572	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	105
PID 4048 wrote to memory of 3944	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	106
PID 4048 wrote to memory of 3944	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	106
PID 4048 wrote to memory of 2644	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	107
PID 4048 wrote to memory of 2644	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	107
PID 4048 wrote to memory of 4652	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	108
PID 4048 wrote to memory of 4652	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	108
PID 4048 wrote to memory of 4532	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	109
PID 4048 wrote to memory of 4532	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	109
PID 4048 wrote to memory of 4284	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	110
PID 4048 wrote to memory of 4284	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	110
PID 4048 wrote to memory of 816	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	111
PID 4048 wrote to memory of 816	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	111
PID 4048 wrote to memory of 2844	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	112
PID 4048 wrote to memory of 2844	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	112
PID 4048 wrote to memory of 2588	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	113
PID 4048 wrote to memory of 2588	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	113
PID 4048 wrote to memory of 2684	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	114
PID 4048 wrote to memory of 2684	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	114
PID 4048 wrote to memory of 2804	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	115
PID 4048 wrote to memory of 2804	4048	041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\041767e3a5f3437480cd09e9418a0330_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\System\UUWxkpH.exe
  C:\Windows\System\UUWxkpH.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\xZOoLVj.exe
  C:\Windows\System\xZOoLVj.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\wbMHwrI.exe
  C:\Windows\System\wbMHwrI.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\bLfXqDG.exe
  C:\Windows\System\bLfXqDG.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\NmcRCcl.exe
  C:\Windows\System\NmcRCcl.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\yIeMEmZ.exe
  C:\Windows\System\yIeMEmZ.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\sCSOYsC.exe
  C:\Windows\System\sCSOYsC.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\GrZwDPX.exe
  C:\Windows\System\GrZwDPX.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\BtPyKRh.exe
  C:\Windows\System\BtPyKRh.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\eNalhUY.exe
  C:\Windows\System\eNalhUY.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\FsLlBEA.exe
  C:\Windows\System\FsLlBEA.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\pjYHSdL.exe
  C:\Windows\System\pjYHSdL.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\JRtgRPr.exe
  C:\Windows\System\JRtgRPr.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\PxSUVXr.exe
  C:\Windows\System\PxSUVXr.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\TjJkbXc.exe
  C:\Windows\System\TjJkbXc.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\lsYAPUT.exe
  C:\Windows\System\lsYAPUT.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\mLfTXsB.exe
  C:\Windows\System\mLfTXsB.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\yGgGvWH.exe
  C:\Windows\System\yGgGvWH.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\fwSXrwJ.exe
  C:\Windows\System\fwSXrwJ.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\MqBYgaI.exe
  C:\Windows\System\MqBYgaI.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\yyklgIU.exe
  C:\Windows\System\yyklgIU.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\phIRzkF.exe
  C:\Windows\System\phIRzkF.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\jIaNckZ.exe
  C:\Windows\System\jIaNckZ.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\ntCOYlp.exe
  C:\Windows\System\ntCOYlp.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\bMoFVgu.exe
  C:\Windows\System\bMoFVgu.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\zSQJjqS.exe
  C:\Windows\System\zSQJjqS.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\IfDTMQs.exe
  C:\Windows\System\IfDTMQs.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\pCSbAnG.exe
  C:\Windows\System\pCSbAnG.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\cCrBfcs.exe
  C:\Windows\System\cCrBfcs.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\LzopRdD.exe
  C:\Windows\System\LzopRdD.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\MfsNAxK.exe
  C:\Windows\System\MfsNAxK.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\bZBLbfH.exe
  C:\Windows\System\bZBLbfH.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\SzbphNC.exe
  C:\Windows\System\SzbphNC.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\rJZNLPJ.exe
  C:\Windows\System\rJZNLPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\JCirZhl.exe
  C:\Windows\System\JCirZhl.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\CDFYcvc.exe
  C:\Windows\System\CDFYcvc.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\zkOZxTB.exe
  C:\Windows\System\zkOZxTB.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\dtIpTzg.exe
  C:\Windows\System\dtIpTzg.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\EUXUisZ.exe
  C:\Windows\System\EUXUisZ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\IuSoYtP.exe
  C:\Windows\System\IuSoYtP.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\iuiFSUI.exe
  C:\Windows\System\iuiFSUI.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\TQpmafZ.exe
  C:\Windows\System\TQpmafZ.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\ZQYScaO.exe
  C:\Windows\System\ZQYScaO.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\gDgjPaE.exe
  C:\Windows\System\gDgjPaE.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\Ovsmkai.exe
  C:\Windows\System\Ovsmkai.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\daPJLwx.exe
  C:\Windows\System\daPJLwx.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\dceoCgx.exe
  C:\Windows\System\dceoCgx.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\EtRZSeV.exe
  C:\Windows\System\EtRZSeV.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\zdTifMS.exe
  C:\Windows\System\zdTifMS.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\bjRKlfj.exe
  C:\Windows\System\bjRKlfj.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\fdfULia.exe
  C:\Windows\System\fdfULia.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\MJQhBjh.exe
  C:\Windows\System\MJQhBjh.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\mabSwbC.exe
  C:\Windows\System\mabSwbC.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\LJGpZpi.exe
  C:\Windows\System\LJGpZpi.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\zjDiwUK.exe
  C:\Windows\System\zjDiwUK.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\TJgFTGw.exe
  C:\Windows\System\TJgFTGw.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\WEaAOwJ.exe
  C:\Windows\System\WEaAOwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\tHmPcmI.exe
  C:\Windows\System\tHmPcmI.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\CQfcTpE.exe
  C:\Windows\System\CQfcTpE.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\KUVyLwv.exe
  C:\Windows\System\KUVyLwv.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\OZfOwJO.exe
  C:\Windows\System\OZfOwJO.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\FxmcuZf.exe
  C:\Windows\System\FxmcuZf.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\oTpMNXg.exe
  C:\Windows\System\oTpMNXg.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\TkDyXqb.exe
  C:\Windows\System\TkDyXqb.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\CwtIQrV.exe
  C:\Windows\System\CwtIQrV.exe
  2⤵
  PID:2260
- C:\Windows\System\vAspbUK.exe
  C:\Windows\System\vAspbUK.exe
  2⤵
  PID:2652
- C:\Windows\System\bwhfOCV.exe
  C:\Windows\System\bwhfOCV.exe
  2⤵
  PID:1144
- C:\Windows\System\spVsntS.exe
  C:\Windows\System\spVsntS.exe
  2⤵
  PID:4812
- C:\Windows\System\lziNXTW.exe
  C:\Windows\System\lziNXTW.exe
  2⤵
  PID:4468
- C:\Windows\System\LNwZdKS.exe
  C:\Windows\System\LNwZdKS.exe
  2⤵
  PID:3172
- C:\Windows\System\KqvCsKr.exe
  C:\Windows\System\KqvCsKr.exe
  2⤵
  PID:4108
- C:\Windows\System\KyRhEok.exe
  C:\Windows\System\KyRhEok.exe
  2⤵
  PID:3320
- C:\Windows\System\LGwUxGf.exe
  C:\Windows\System\LGwUxGf.exe
  2⤵
  PID:3768
- C:\Windows\System\XbQttTB.exe
  C:\Windows\System\XbQttTB.exe
  2⤵
  PID:4872
- C:\Windows\System\iBEbKqe.exe
  C:\Windows\System\iBEbKqe.exe
  2⤵
  PID:5148
- C:\Windows\System\GPUpJYz.exe
  C:\Windows\System\GPUpJYz.exe
  2⤵
  PID:5176
- C:\Windows\System\opWkErk.exe
  C:\Windows\System\opWkErk.exe
  2⤵
  PID:5204
- C:\Windows\System\bizDUYQ.exe
  C:\Windows\System\bizDUYQ.exe
  2⤵
  PID:5232
- C:\Windows\System\DarxBaY.exe
  C:\Windows\System\DarxBaY.exe
  2⤵
  PID:5260
- C:\Windows\System\OBuYLxz.exe
  C:\Windows\System\OBuYLxz.exe
  2⤵
  PID:5288
- C:\Windows\System\xvQSqNg.exe
  C:\Windows\System\xvQSqNg.exe
  2⤵
  PID:5316
- C:\Windows\System\HRbQuZp.exe
  C:\Windows\System\HRbQuZp.exe
  2⤵
  PID:5344
- C:\Windows\System\jrKTJKE.exe
  C:\Windows\System\jrKTJKE.exe
  2⤵
  PID:5372
- C:\Windows\System\AtPXGKo.exe
  C:\Windows\System\AtPXGKo.exe
  2⤵
  PID:5400
- C:\Windows\System\seiRZyM.exe
  C:\Windows\System\seiRZyM.exe
  2⤵
  PID:5428
- C:\Windows\System\bqlOySs.exe
  C:\Windows\System\bqlOySs.exe
  2⤵
  PID:5456
- C:\Windows\System\rYCrkTs.exe
  C:\Windows\System\rYCrkTs.exe
  2⤵
  PID:5484
- C:\Windows\System\FfbcleZ.exe
  C:\Windows\System\FfbcleZ.exe
  2⤵
  PID:5512
- C:\Windows\System\ypNwcRe.exe
  C:\Windows\System\ypNwcRe.exe
  2⤵
  PID:5540
- C:\Windows\System\ctUTxnb.exe
  C:\Windows\System\ctUTxnb.exe
  2⤵
  PID:5568
- C:\Windows\System\upxDbnb.exe
  C:\Windows\System\upxDbnb.exe
  2⤵
  PID:5596
- C:\Windows\System\rOixUah.exe
  C:\Windows\System\rOixUah.exe
  2⤵
  PID:5624
- C:\Windows\System\ldplPER.exe
  C:\Windows\System\ldplPER.exe
  2⤵
  PID:5652
- C:\Windows\System\FMtVgaK.exe
  C:\Windows\System\FMtVgaK.exe
  2⤵
  PID:5680
- C:\Windows\System\kIIeAsW.exe
  C:\Windows\System\kIIeAsW.exe
  2⤵
  PID:5708
- C:\Windows\System\lEPjTjN.exe
  C:\Windows\System\lEPjTjN.exe
  2⤵
  PID:5736
- C:\Windows\System\KocyxBc.exe
  C:\Windows\System\KocyxBc.exe
  2⤵
  PID:5764
- C:\Windows\System\gGixQVJ.exe
  C:\Windows\System\gGixQVJ.exe
  2⤵
  PID:5792
- C:\Windows\System\vhfYfbT.exe
  C:\Windows\System\vhfYfbT.exe
  2⤵
  PID:5820
- C:\Windows\System\iCODQSF.exe
  C:\Windows\System\iCODQSF.exe
  2⤵
  PID:5848
- C:\Windows\System\xMurltJ.exe
  C:\Windows\System\xMurltJ.exe
  2⤵
  PID:5876
- C:\Windows\System\VzeVIvd.exe
  C:\Windows\System\VzeVIvd.exe
  2⤵
  PID:5904
- C:\Windows\System\jaQBsOk.exe
  C:\Windows\System\jaQBsOk.exe
  2⤵
  PID:5932
- C:\Windows\System\PqaRpFR.exe
  C:\Windows\System\PqaRpFR.exe
  2⤵
  PID:5960
- C:\Windows\System\MhdfPck.exe
  C:\Windows\System\MhdfPck.exe
  2⤵
  PID:5988
- C:\Windows\System\KatUInE.exe
  C:\Windows\System\KatUInE.exe
  2⤵
  PID:6016
- C:\Windows\System\EgnGfpg.exe
  C:\Windows\System\EgnGfpg.exe
  2⤵
  PID:6044
- C:\Windows\System\JVxtprC.exe
  C:\Windows\System\JVxtprC.exe
  2⤵
  PID:6072
- C:\Windows\System\PRZxbwo.exe
  C:\Windows\System\PRZxbwo.exe
  2⤵
  PID:6100
- C:\Windows\System\dexFnkR.exe
  C:\Windows\System\dexFnkR.exe
  2⤵
  PID:6128
- C:\Windows\System\zHPwHwt.exe
  C:\Windows\System\zHPwHwt.exe
  2⤵
  PID:1980
- C:\Windows\System\yhZDJUA.exe
  C:\Windows\System\yhZDJUA.exe
  2⤵
  PID:1180
- C:\Windows\System\MlcQJzA.exe
  C:\Windows\System\MlcQJzA.exe
  2⤵
  PID:2056
- C:\Windows\System\HnjIEBb.exe
  C:\Windows\System\HnjIEBb.exe
  2⤵
  PID:4504
- C:\Windows\System\HRTzRXe.exe
  C:\Windows\System\HRTzRXe.exe
  2⤵
  PID:392
- C:\Windows\System\WdFLiBd.exe
  C:\Windows\System\WdFLiBd.exe
  2⤵
  PID:1084
- C:\Windows\System\aFLYEpx.exe
  C:\Windows\System\aFLYEpx.exe
  2⤵
  PID:5160
- C:\Windows\System\nKrVMNZ.exe
  C:\Windows\System\nKrVMNZ.exe
  2⤵
  PID:5224
- C:\Windows\System\TVMomuo.exe
  C:\Windows\System\TVMomuo.exe
  2⤵
  PID:5300
- C:\Windows\System\BgBLJht.exe
  C:\Windows\System\BgBLJht.exe
  2⤵
  PID:5360
- C:\Windows\System\VYAcOUX.exe
  C:\Windows\System\VYAcOUX.exe
  2⤵
  PID:5420
- C:\Windows\System\YFIjAXQ.exe
  C:\Windows\System\YFIjAXQ.exe
  2⤵
  PID:5496
- C:\Windows\System\RNEawZZ.exe
  C:\Windows\System\RNEawZZ.exe
  2⤵
  PID:5556
- C:\Windows\System\EuppkPn.exe
  C:\Windows\System\EuppkPn.exe
  2⤵
  PID:5616
- C:\Windows\System\LmFOcwY.exe
  C:\Windows\System\LmFOcwY.exe
  2⤵
  PID:5692
- C:\Windows\System\voItONA.exe
  C:\Windows\System\voItONA.exe
  2⤵
  PID:5752
- C:\Windows\System\zsxIQbd.exe
  C:\Windows\System\zsxIQbd.exe
  2⤵
  PID:5812
- C:\Windows\System\bSLLiDF.exe
  C:\Windows\System\bSLLiDF.exe
  2⤵
  PID:5888
- C:\Windows\System\FqSovkb.exe
  C:\Windows\System\FqSovkb.exe
  2⤵
  PID:5948
- C:\Windows\System\ouFSpQz.exe
  C:\Windows\System\ouFSpQz.exe
  2⤵
  PID:6008
- C:\Windows\System\NYNMNHs.exe
  C:\Windows\System\NYNMNHs.exe
  2⤵
  PID:6084
- C:\Windows\System\XAQmDKb.exe
  C:\Windows\System\XAQmDKb.exe
  2⤵
  PID:3716
- C:\Windows\System\FuZsyqx.exe
  C:\Windows\System\FuZsyqx.exe
  2⤵
  PID:1968
- C:\Windows\System\RLNgloE.exe
  C:\Windows\System\RLNgloE.exe
  2⤵
  PID:4140
- C:\Windows\System\enyXTTU.exe
  C:\Windows\System\enyXTTU.exe
  2⤵
  PID:5196
- C:\Windows\System\djVqBWD.exe
  C:\Windows\System\djVqBWD.exe
  2⤵
  PID:5336
- C:\Windows\System\qoQrjtd.exe
  C:\Windows\System\qoQrjtd.exe
  2⤵
  PID:5472
- C:\Windows\System\PQOtFof.exe
  C:\Windows\System\PQOtFof.exe
  2⤵
  PID:5644
- C:\Windows\System\DFMIjhf.exe
  C:\Windows\System\DFMIjhf.exe
  2⤵
  PID:5784
- C:\Windows\System\LMKowBA.exe
  C:\Windows\System\LMKowBA.exe
  2⤵
  PID:6168
- C:\Windows\System\FrXvLQD.exe
  C:\Windows\System\FrXvLQD.exe
  2⤵
  PID:6196
- C:\Windows\System\IMecGje.exe
  C:\Windows\System\IMecGje.exe
  2⤵
  PID:6224
- C:\Windows\System\xMDExjr.exe
  C:\Windows\System\xMDExjr.exe
  2⤵
  PID:6252
- C:\Windows\System\ZIkzcXd.exe
  C:\Windows\System\ZIkzcXd.exe
  2⤵
  PID:6280
- C:\Windows\System\svPPcyT.exe
  C:\Windows\System\svPPcyT.exe
  2⤵
  PID:6308
- C:\Windows\System\DCuxFVJ.exe
  C:\Windows\System\DCuxFVJ.exe
  2⤵
  PID:6340
- C:\Windows\System\usuGjQV.exe
  C:\Windows\System\usuGjQV.exe
  2⤵
  PID:6364
- C:\Windows\System\YxfIPEr.exe
  C:\Windows\System\YxfIPEr.exe
  2⤵
  PID:6392
- C:\Windows\System\ucBAcIl.exe
  C:\Windows\System\ucBAcIl.exe
  2⤵
  PID:6420
- C:\Windows\System\xzsZhcj.exe
  C:\Windows\System\xzsZhcj.exe
  2⤵
  PID:6448
- C:\Windows\System\wxwGmRA.exe
  C:\Windows\System\wxwGmRA.exe
  2⤵
  PID:6476
- C:\Windows\System\XQcqMDb.exe
  C:\Windows\System\XQcqMDb.exe
  2⤵
  PID:6508
- C:\Windows\System\bjEJqxr.exe
  C:\Windows\System\bjEJqxr.exe
  2⤵
  PID:6532
- C:\Windows\System\YCThvZK.exe
  C:\Windows\System\YCThvZK.exe
  2⤵
  PID:6560
- C:\Windows\System\zlomGTw.exe
  C:\Windows\System\zlomGTw.exe
  2⤵
  PID:6588
- C:\Windows\System\eavaSzj.exe
  C:\Windows\System\eavaSzj.exe
  2⤵
  PID:6616
- C:\Windows\System\JYXxXsn.exe
  C:\Windows\System\JYXxXsn.exe
  2⤵
  PID:6644
- C:\Windows\System\TljnVuh.exe
  C:\Windows\System\TljnVuh.exe
  2⤵
  PID:6672
- C:\Windows\System\GGfarhH.exe
  C:\Windows\System\GGfarhH.exe
  2⤵
  PID:6700
- C:\Windows\System\uKpGoMJ.exe
  C:\Windows\System\uKpGoMJ.exe
  2⤵
  PID:6728
- C:\Windows\System\gRYOsju.exe
  C:\Windows\System\gRYOsju.exe
  2⤵
  PID:6756
- C:\Windows\System\xxsKruH.exe
  C:\Windows\System\xxsKruH.exe
  2⤵
  PID:6784
- C:\Windows\System\dycAzik.exe
  C:\Windows\System\dycAzik.exe
  2⤵
  PID:6812
- C:\Windows\System\HsUtQRR.exe
  C:\Windows\System\HsUtQRR.exe
  2⤵
  PID:6840
- C:\Windows\System\KSScyFj.exe
  C:\Windows\System\KSScyFj.exe
  2⤵
  PID:6868
- C:\Windows\System\SCSaPzn.exe
  C:\Windows\System\SCSaPzn.exe
  2⤵
  PID:6896
- C:\Windows\System\nNwMYGf.exe
  C:\Windows\System\nNwMYGf.exe
  2⤵
  PID:6924
- C:\Windows\System\SsDpnFd.exe
  C:\Windows\System\SsDpnFd.exe
  2⤵
  PID:6952
- C:\Windows\System\AtuAfPo.exe
  C:\Windows\System\AtuAfPo.exe
  2⤵
  PID:6980
- C:\Windows\System\kuhuLcC.exe
  C:\Windows\System\kuhuLcC.exe
  2⤵
  PID:7008
- C:\Windows\System\fIJhesH.exe
  C:\Windows\System\fIJhesH.exe
  2⤵
  PID:7036
- C:\Windows\System\oYoJhMg.exe
  C:\Windows\System\oYoJhMg.exe
  2⤵
  PID:7064
- C:\Windows\System\cAusnzc.exe
  C:\Windows\System\cAusnzc.exe
  2⤵
  PID:7092
- C:\Windows\System\XJhCvbc.exe
  C:\Windows\System\XJhCvbc.exe
  2⤵
  PID:7120
- C:\Windows\System\POylzTQ.exe
  C:\Windows\System\POylzTQ.exe
  2⤵
  PID:7148
- C:\Windows\System\nftooOh.exe
  C:\Windows\System\nftooOh.exe
  2⤵
  PID:5864
- C:\Windows\System\eGuDfxz.exe
  C:\Windows\System\eGuDfxz.exe
  2⤵
  PID:6036
- C:\Windows\System\LiOBozc.exe
  C:\Windows\System\LiOBozc.exe
  2⤵
  PID:3604
- C:\Windows\System\VwbyYzY.exe
  C:\Windows\System\VwbyYzY.exe
  2⤵
  PID:5140
- C:\Windows\System\llESTNw.exe
  C:\Windows\System\llESTNw.exe
  2⤵
  PID:5532
- C:\Windows\System\VGYJJMZ.exe
  C:\Windows\System\VGYJJMZ.exe
  2⤵
  PID:6156
- C:\Windows\System\tABDyks.exe
  C:\Windows\System\tABDyks.exe
  2⤵
  PID:6216
- C:\Windows\System\koHYOvZ.exe
  C:\Windows\System\koHYOvZ.exe
  2⤵
  PID:6292
- C:\Windows\System\SeXIgNs.exe
  C:\Windows\System\SeXIgNs.exe
  2⤵
  PID:6356
- C:\Windows\System\GMNpeEF.exe
  C:\Windows\System\GMNpeEF.exe
  2⤵
  PID:6408
- C:\Windows\System\WRmmlFa.exe
  C:\Windows\System\WRmmlFa.exe
  2⤵
  PID:6468
- C:\Windows\System\TBYGOxO.exe
  C:\Windows\System\TBYGOxO.exe
  2⤵
  PID:6528
- C:\Windows\System\wpwyAQA.exe
  C:\Windows\System\wpwyAQA.exe
  2⤵
  PID:3364
- C:\Windows\System\OunuZGk.exe
  C:\Windows\System\OunuZGk.exe
  2⤵
  PID:6632
- C:\Windows\System\esrftFh.exe
  C:\Windows\System\esrftFh.exe
  2⤵
  PID:6692
- C:\Windows\System\XvyurNp.exe
  C:\Windows\System\XvyurNp.exe
  2⤵
  PID:6748
- C:\Windows\System\ifzESwk.exe
  C:\Windows\System\ifzESwk.exe
  2⤵
  PID:6824
- C:\Windows\System\eDEiWwB.exe
  C:\Windows\System\eDEiWwB.exe
  2⤵
  PID:6884
- C:\Windows\System\UnDqxsi.exe
  C:\Windows\System\UnDqxsi.exe
  2⤵
  PID:6944
- C:\Windows\System\XDaoOES.exe
  C:\Windows\System\XDaoOES.exe
  2⤵
  PID:6996
- C:\Windows\System\aPWGruc.exe
  C:\Windows\System\aPWGruc.exe
  2⤵
  PID:7052
- C:\Windows\System\oQDXZmb.exe
  C:\Windows\System\oQDXZmb.exe
  2⤵
  PID:7108
- C:\Windows\System\xCNMgUu.exe
  C:\Windows\System\xCNMgUu.exe
  2⤵
  PID:7164
- C:\Windows\System\GsXXWjO.exe
  C:\Windows\System\GsXXWjO.exe
  2⤵
  PID:6120
- C:\Windows\System\baqfnQr.exe
  C:\Windows\System\baqfnQr.exe
  2⤵
  PID:5720
- C:\Windows\System\maKsVvM.exe
  C:\Windows\System\maKsVvM.exe
  2⤵
  PID:6244
- C:\Windows\System\TzgMvxk.exe
  C:\Windows\System\TzgMvxk.exe
  2⤵
  PID:6380
- C:\Windows\System\PgpMVwa.exe
  C:\Windows\System\PgpMVwa.exe
  2⤵
  PID:6500
- C:\Windows\System\ulXAiJk.exe
  C:\Windows\System\ulXAiJk.exe
  2⤵
  PID:6600
- C:\Windows\System\eElyHdg.exe
  C:\Windows\System\eElyHdg.exe
  2⤵
  PID:6720
- C:\Windows\System\faryPqj.exe
  C:\Windows\System\faryPqj.exe
  2⤵
  PID:4076
- C:\Windows\System\PwZMcYv.exe
  C:\Windows\System\PwZMcYv.exe
  2⤵
  PID:6936
- C:\Windows\System\kCGWeCI.exe
  C:\Windows\System\kCGWeCI.exe
  2⤵
  PID:2036
- C:\Windows\System\YAQRBVW.exe
  C:\Windows\System\YAQRBVW.exe
  2⤵
  PID:7132
- C:\Windows\System\iDsWNdw.exe
  C:\Windows\System\iDsWNdw.exe
  2⤵
  PID:5132
- C:\Windows\System\sBONvQo.exe
  C:\Windows\System\sBONvQo.exe
  2⤵
  PID:6208
- C:\Windows\System\KpZWvCj.exe
  C:\Windows\System\KpZWvCj.exe
  2⤵
  PID:4500
- C:\Windows\System\eEPbEDp.exe
  C:\Windows\System\eEPbEDp.exe
  2⤵
  PID:6660
- C:\Windows\System\BZqODIm.exe
  C:\Windows\System\BZqODIm.exe
  2⤵
  PID:2584
- C:\Windows\System\Bqpjldz.exe
  C:\Windows\System\Bqpjldz.exe
  2⤵
  PID:6916
- C:\Windows\System\ofdnYuc.exe
  C:\Windows\System\ofdnYuc.exe
  2⤵
  PID:7188
- C:\Windows\System\kiisbMz.exe
  C:\Windows\System\kiisbMz.exe
  2⤵
  PID:7216
- C:\Windows\System\MuIyLDD.exe
  C:\Windows\System\MuIyLDD.exe
  2⤵
  PID:7244
- C:\Windows\System\OdSQLDb.exe
  C:\Windows\System\OdSQLDb.exe
  2⤵
  PID:7272
- C:\Windows\System\uMfwoAt.exe
  C:\Windows\System\uMfwoAt.exe
  2⤵
  PID:7300
- C:\Windows\System\AMFwdSw.exe
  C:\Windows\System\AMFwdSw.exe
  2⤵
  PID:7324
- C:\Windows\System\bEoWutM.exe
  C:\Windows\System\bEoWutM.exe
  2⤵
  PID:7416
- C:\Windows\System\ERHOdZI.exe
  C:\Windows\System\ERHOdZI.exe
  2⤵
  PID:7436
- C:\Windows\System\aywNLaU.exe
  C:\Windows\System\aywNLaU.exe
  2⤵
  PID:7492
- C:\Windows\System\noCmSkU.exe
  C:\Windows\System\noCmSkU.exe
  2⤵
  PID:7512
- C:\Windows\System\BDGOzJH.exe
  C:\Windows\System\BDGOzJH.exe
  2⤵
  PID:7540
- C:\Windows\System\qCFsgJz.exe
  C:\Windows\System\qCFsgJz.exe
  2⤵
  PID:7556
- C:\Windows\System\lAprLuq.exe
  C:\Windows\System\lAprLuq.exe
  2⤵
  PID:7608
- C:\Windows\System\iYzZwho.exe
  C:\Windows\System\iYzZwho.exe
  2⤵
  PID:7640
- C:\Windows\System\IdARykB.exe
  C:\Windows\System\IdARykB.exe
  2⤵
  PID:7664
- C:\Windows\System\EUGwgVf.exe
  C:\Windows\System\EUGwgVf.exe
  2⤵
  PID:7700
- C:\Windows\System\fhDiGxf.exe
  C:\Windows\System\fhDiGxf.exe
  2⤵
  PID:7760
- C:\Windows\System\hatdOwQ.exe
  C:\Windows\System\hatdOwQ.exe
  2⤵
  PID:7780
- C:\Windows\System\tsxzvpl.exe
  C:\Windows\System\tsxzvpl.exe
  2⤵
  PID:7808
- C:\Windows\System\YWYnzbd.exe
  C:\Windows\System\YWYnzbd.exe
  2⤵
  PID:7832
- C:\Windows\System\DjWOEXL.exe
  C:\Windows\System\DjWOEXL.exe
  2⤵
  PID:7856
- C:\Windows\System\sDrfkKf.exe
  C:\Windows\System\sDrfkKf.exe
  2⤵
  PID:7880
- C:\Windows\System\ayAtKoD.exe
  C:\Windows\System\ayAtKoD.exe
  2⤵
  PID:7908
- C:\Windows\System\YSDcKts.exe
  C:\Windows\System\YSDcKts.exe
  2⤵
  PID:7976
- C:\Windows\System\PwptVBw.exe
  C:\Windows\System\PwptVBw.exe
  2⤵
  PID:7996
- C:\Windows\System\BLeZXyv.exe
  C:\Windows\System\BLeZXyv.exe
  2⤵
  PID:8024
- C:\Windows\System\ZYZyFdw.exe
  C:\Windows\System\ZYZyFdw.exe
  2⤵
  PID:8056
- C:\Windows\System\XOXZxxF.exe
  C:\Windows\System\XOXZxxF.exe
  2⤵
  PID:8140
- C:\Windows\System\hmaobPA.exe
  C:\Windows\System\hmaobPA.exe
  2⤵
  PID:8180
- C:\Windows\System\baMSATQ.exe
  C:\Windows\System\baMSATQ.exe
  2⤵
  PID:2136
- C:\Windows\System\DOSyrJD.exe
  C:\Windows\System\DOSyrJD.exe
  2⤵
  PID:5328
- C:\Windows\System\XQhyuHi.exe
  C:\Windows\System\XQhyuHi.exe
  2⤵
  PID:6332
- C:\Windows\System\zPQyAKe.exe
  C:\Windows\System\zPQyAKe.exe
  2⤵
  PID:6664
- C:\Windows\System\IcTUpmU.exe
  C:\Windows\System\IcTUpmU.exe
  2⤵
  PID:1692
- C:\Windows\System\OcEdAHG.exe
  C:\Windows\System\OcEdAHG.exe
  2⤵
  PID:7200
- C:\Windows\System\oghPlSg.exe
  C:\Windows\System\oghPlSg.exe
  2⤵
  PID:7236
- C:\Windows\System\RxNJHLY.exe
  C:\Windows\System\RxNJHLY.exe
  2⤵
  PID:7312
- C:\Windows\System\BwKZnya.exe
  C:\Windows\System\BwKZnya.exe
  2⤵
  PID:3792
- C:\Windows\System\jxdkkjS.exe
  C:\Windows\System\jxdkkjS.exe
  2⤵
  PID:3376
- C:\Windows\System\EuOyVri.exe
  C:\Windows\System\EuOyVri.exe
  2⤵
  PID:7320
- C:\Windows\System\gfrZPyh.exe
  C:\Windows\System\gfrZPyh.exe
  2⤵
  PID:7424
- C:\Windows\System\LqlufaT.exe
  C:\Windows\System\LqlufaT.exe
  2⤵
  PID:7428
- C:\Windows\System\AuRxxlX.exe
  C:\Windows\System\AuRxxlX.exe
  2⤵
  PID:7480
- C:\Windows\System\fYfDDly.exe
  C:\Windows\System\fYfDDly.exe
  2⤵
  PID:7580
- C:\Windows\System\zHuQZoM.exe
  C:\Windows\System\zHuQZoM.exe
  2⤵
  PID:7692
- C:\Windows\System\KtayeCS.exe
  C:\Windows\System\KtayeCS.exe
  2⤵
  PID:7796
- C:\Windows\System\GaGKaLE.exe
  C:\Windows\System\GaGKaLE.exe
  2⤵
  PID:7904
- C:\Windows\System\saigbJr.exe
  C:\Windows\System\saigbJr.exe
  2⤵
  PID:7952
- C:\Windows\System\sluXnbe.exe
  C:\Windows\System\sluXnbe.exe
  2⤵
  PID:7988
- C:\Windows\System\nhyPpku.exe
  C:\Windows\System\nhyPpku.exe
  2⤵
  PID:8048
- C:\Windows\System\ZpaPZGG.exe
  C:\Windows\System\ZpaPZGG.exe
  2⤵
  PID:7680
- C:\Windows\System\KFWtlwm.exe
  C:\Windows\System\KFWtlwm.exe
  2⤵
  PID:7584
- C:\Windows\System\uelyPbt.exe
  C:\Windows\System\uelyPbt.exe
  2⤵
  PID:7888
- C:\Windows\System\BEqkBOw.exe
  C:\Windows\System\BEqkBOw.exe
  2⤵
  PID:8172
- C:\Windows\System\SNHZfWY.exe
  C:\Windows\System\SNHZfWY.exe
  2⤵
  PID:5976
- C:\Windows\System\OANmbmr.exe
  C:\Windows\System\OANmbmr.exe
  2⤵
  PID:2760
- C:\Windows\System\GGcNulO.exe
  C:\Windows\System\GGcNulO.exe
  2⤵
  PID:4080
- C:\Windows\System\SqwBFjJ.exe
  C:\Windows\System\SqwBFjJ.exe
  2⤵
  PID:7284
- C:\Windows\System\kZDLzmh.exe
  C:\Windows\System\kZDLzmh.exe
  2⤵
  PID:3552
- C:\Windows\System\mzyDAnl.exe
  C:\Windows\System\mzyDAnl.exe
  2⤵
  PID:7464
- C:\Windows\System\taGSuKH.exe
  C:\Windows\System\taGSuKH.exe
  2⤵
  PID:7524
- C:\Windows\System\ucWZpjv.exe
  C:\Windows\System\ucWZpjv.exe
  2⤵
  PID:688
- C:\Windows\System\eUSYonF.exe
  C:\Windows\System\eUSYonF.exe
  2⤵
  PID:7984
- C:\Windows\System\MoolegP.exe
  C:\Windows\System\MoolegP.exe
  2⤵
  PID:7652
- C:\Windows\System\jBjcUxe.exe
  C:\Windows\System\jBjcUxe.exe
  2⤵
  PID:8160
- C:\Windows\System\TFNIQxH.exe
  C:\Windows\System\TFNIQxH.exe
  2⤵
  PID:7172
- C:\Windows\System\yMQrIuv.exe
  C:\Windows\System\yMQrIuv.exe
  2⤵
  PID:7408
- C:\Windows\System\ZzBCZEo.exe
  C:\Windows\System\ZzBCZEo.exe
  2⤵
  PID:7772
- C:\Windows\System\PZxjJbI.exe
  C:\Windows\System\PZxjJbI.exe
  2⤵
  PID:8044
- C:\Windows\System\uEEUAEP.exe
  C:\Windows\System\uEEUAEP.exe
  2⤵
  PID:7080
- C:\Windows\System\QPjDSKb.exe
  C:\Windows\System\QPjDSKb.exe
  2⤵
  PID:7260
- C:\Windows\System\ssSxCPk.exe
  C:\Windows\System\ssSxCPk.exe
  2⤵
  PID:7788
- C:\Windows\System\OFmkXFk.exe
  C:\Windows\System\OFmkXFk.exe
  2⤵
  PID:8220
- C:\Windows\System\vWyZHXq.exe
  C:\Windows\System\vWyZHXq.exe
  2⤵
  PID:8244
- C:\Windows\System\wQINbEd.exe
  C:\Windows\System\wQINbEd.exe
  2⤵
  PID:8260
- C:\Windows\System\SlWzvhX.exe
  C:\Windows\System\SlWzvhX.exe
  2⤵
  PID:8292
- C:\Windows\System\QEIcdxj.exe
  C:\Windows\System\QEIcdxj.exe
  2⤵
  PID:8320
- C:\Windows\System\KAwhfBi.exe
  C:\Windows\System\KAwhfBi.exe
  2⤵
  PID:8348
- C:\Windows\System\LlhqfFQ.exe
  C:\Windows\System\LlhqfFQ.exe
  2⤵
  PID:8380
- C:\Windows\System\KYjePPW.exe
  C:\Windows\System\KYjePPW.exe
  2⤵
  PID:8416
- C:\Windows\System\oVgZCGL.exe
  C:\Windows\System\oVgZCGL.exe
  2⤵
  PID:8456
- C:\Windows\System\ivahIMR.exe
  C:\Windows\System\ivahIMR.exe
  2⤵
  PID:8484
- C:\Windows\System\Jppkszj.exe
  C:\Windows\System\Jppkszj.exe
  2⤵
  PID:8512
- C:\Windows\System\JiGFpIl.exe
  C:\Windows\System\JiGFpIl.exe
  2⤵
  PID:8540
- C:\Windows\System\oHZFDll.exe
  C:\Windows\System\oHZFDll.exe
  2⤵
  PID:8560
- C:\Windows\System\copJKqL.exe
  C:\Windows\System\copJKqL.exe
  2⤵
  PID:8588
- C:\Windows\System\qHIuoQm.exe
  C:\Windows\System\qHIuoQm.exe
  2⤵
  PID:8612
- C:\Windows\System\OKyZMxc.exe
  C:\Windows\System\OKyZMxc.exe
  2⤵
  PID:8652
- C:\Windows\System\bwlevFp.exe
  C:\Windows\System\bwlevFp.exe
  2⤵
  PID:8672
- C:\Windows\System\FNlDbJW.exe
  C:\Windows\System\FNlDbJW.exe
  2⤵
  PID:8696
- C:\Windows\System\HAIensu.exe
  C:\Windows\System\HAIensu.exe
  2⤵
  PID:8736
- C:\Windows\System\UGzQiHz.exe
  C:\Windows\System\UGzQiHz.exe
  2⤵
  PID:8764
- C:\Windows\System\mrtCxVo.exe
  C:\Windows\System\mrtCxVo.exe
  2⤵
  PID:8780
- C:\Windows\System\sFlqbLB.exe
  C:\Windows\System\sFlqbLB.exe
  2⤵
  PID:8796
- C:\Windows\System\TZFTgdW.exe
  C:\Windows\System\TZFTgdW.exe
  2⤵
  PID:8820
- C:\Windows\System\uQZZkJo.exe
  C:\Windows\System\uQZZkJo.exe
  2⤵
  PID:8840
- C:\Windows\System\yCOeNLt.exe
  C:\Windows\System\yCOeNLt.exe
  2⤵
  PID:8880
- C:\Windows\System\zuARvmW.exe
  C:\Windows\System\zuARvmW.exe
  2⤵
  PID:8932
- C:\Windows\System\amaQrec.exe
  C:\Windows\System\amaQrec.exe
  2⤵
  PID:8960
- C:\Windows\System\dtCvSzU.exe
  C:\Windows\System\dtCvSzU.exe
  2⤵
  PID:8976
- C:\Windows\System\uJwBRCF.exe
  C:\Windows\System\uJwBRCF.exe
  2⤵
  PID:9004
- C:\Windows\System\fEMwPqe.exe
  C:\Windows\System\fEMwPqe.exe
  2⤵
  PID:9020
- C:\Windows\System\IStOSAM.exe
  C:\Windows\System\IStOSAM.exe
  2⤵
  PID:9056
- C:\Windows\System\HFLHFnP.exe
  C:\Windows\System\HFLHFnP.exe
  2⤵
  PID:9084
- C:\Windows\System\RVwGJlp.exe
  C:\Windows\System\RVwGJlp.exe
  2⤵
  PID:9116
- C:\Windows\System\ldInEPF.exe
  C:\Windows\System\ldInEPF.exe
  2⤵
  PID:9144
- C:\Windows\System\CEbRaOC.exe
  C:\Windows\System\CEbRaOC.exe
  2⤵
  PID:9184
- C:\Windows\System\zYMnqfg.exe
  C:\Windows\System\zYMnqfg.exe
  2⤵
  PID:9212
- C:\Windows\System\EgYDjRN.exe
  C:\Windows\System\EgYDjRN.exe
  2⤵
  PID:8208
- C:\Windows\System\fItgsvM.exe
  C:\Windows\System\fItgsvM.exe
  2⤵
  PID:8284
- C:\Windows\System\MehpDtT.exe
  C:\Windows\System\MehpDtT.exe
  2⤵
  PID:8372
- C:\Windows\System\isgfseN.exe
  C:\Windows\System\isgfseN.exe
  2⤵
  PID:8448
- C:\Windows\System\kOfOEnH.exe
  C:\Windows\System\kOfOEnH.exe
  2⤵
  PID:8508
- C:\Windows\System\ugMflzM.exe
  C:\Windows\System\ugMflzM.exe
  2⤵
  PID:8568
- C:\Windows\System\TNFVldz.exe
  C:\Windows\System\TNFVldz.exe
  2⤵
  PID:8640
- C:\Windows\System\UxyBNVN.exe
  C:\Windows\System\UxyBNVN.exe
  2⤵
  PID:8716
- C:\Windows\System\zReKnoZ.exe
  C:\Windows\System\zReKnoZ.exe
  2⤵
  PID:8756
- C:\Windows\System\cSMWoFR.exe
  C:\Windows\System\cSMWoFR.exe
  2⤵
  PID:8828
- C:\Windows\System\vgMHLya.exe
  C:\Windows\System\vgMHLya.exe
  2⤵
  PID:8904
- C:\Windows\System\zJfWtAf.exe
  C:\Windows\System\zJfWtAf.exe
  2⤵
  PID:8968
- C:\Windows\System\CxDfuda.exe
  C:\Windows\System\CxDfuda.exe
  2⤵
  PID:9032
- C:\Windows\System\JcNrZHw.exe
  C:\Windows\System\JcNrZHw.exe
  2⤵
  PID:9104
- C:\Windows\System\CzOTBAb.exe
  C:\Windows\System\CzOTBAb.exe
  2⤵
  PID:9176
- C:\Windows\System\ChuGOcp.exe
  C:\Windows\System\ChuGOcp.exe
  2⤵
  PID:8232
- C:\Windows\System\BwcUUAj.exe
  C:\Windows\System\BwcUUAj.exe
  2⤵
  PID:8364
- C:\Windows\System\tWRPznb.exe
  C:\Windows\System\tWRPznb.exe
  2⤵
  PID:8500
- C:\Windows\System\gjIcggM.exe
  C:\Windows\System\gjIcggM.exe
  2⤵
  PID:8680
- C:\Windows\System\cvkJOae.exe
  C:\Windows\System\cvkJOae.exe
  2⤵
  PID:8876
- C:\Windows\System\uyBgSkP.exe
  C:\Windows\System\uyBgSkP.exe
  2⤵
  PID:9012
- C:\Windows\System\ukzlPxk.exe
  C:\Windows\System\ukzlPxk.exe
  2⤵
  PID:9136
- C:\Windows\System\EpgXelI.exe
  C:\Windows\System\EpgXelI.exe
  2⤵
  PID:8216
- C:\Windows\System\DHEUsSE.exe
  C:\Windows\System\DHEUsSE.exe
  2⤵
  PID:8812
- C:\Windows\System\aUFIhMG.exe
  C:\Windows\System\aUFIhMG.exe
  2⤵
  PID:8952
- C:\Windows\System\gWCGEeA.exe
  C:\Windows\System\gWCGEeA.exe
  2⤵
  PID:9200
- C:\Windows\System\qScGleX.exe
  C:\Windows\System\qScGleX.exe
  2⤵
  PID:9076
- C:\Windows\System\pMjpPEV.exe
  C:\Windows\System\pMjpPEV.exe
  2⤵
  PID:9252
- C:\Windows\System\RbgmnsP.exe
  C:\Windows\System\RbgmnsP.exe
  2⤵
  PID:9268
- C:\Windows\System\MCIZfBI.exe
  C:\Windows\System\MCIZfBI.exe
  2⤵
  PID:9300
- C:\Windows\System\qfGApAy.exe
  C:\Windows\System\qfGApAy.exe
  2⤵
  PID:9324
- C:\Windows\System\xiniedC.exe
  C:\Windows\System\xiniedC.exe
  2⤵
  PID:9364
- C:\Windows\System\shpmubQ.exe
  C:\Windows\System\shpmubQ.exe
  2⤵
  PID:9380
- C:\Windows\System\FGkRMLH.exe
  C:\Windows\System\FGkRMLH.exe
  2⤵
  PID:9416
- C:\Windows\System\DBTQYcC.exe
  C:\Windows\System\DBTQYcC.exe
  2⤵
  PID:9436
- C:\Windows\System\FxRyxHG.exe
  C:\Windows\System\FxRyxHG.exe
  2⤵
  PID:9476
- C:\Windows\System\IToVHQR.exe
  C:\Windows\System\IToVHQR.exe
  2⤵
  PID:9504
- C:\Windows\System\ZxdWhPl.exe
  C:\Windows\System\ZxdWhPl.exe
  2⤵
  PID:9528
- C:\Windows\System\MphYLGf.exe
  C:\Windows\System\MphYLGf.exe
  2⤵
  PID:9560
- C:\Windows\System\NVRLdcX.exe
  C:\Windows\System\NVRLdcX.exe
  2⤵
  PID:9588
- C:\Windows\System\VMHOJdE.exe
  C:\Windows\System\VMHOJdE.exe
  2⤵
  PID:9612
- C:\Windows\System\GHiDuXC.exe
  C:\Windows\System\GHiDuXC.exe
  2⤵
  PID:9628
- C:\Windows\System\otSopLq.exe
  C:\Windows\System\otSopLq.exe
  2⤵
  PID:9648
- C:\Windows\System\pvEQZMs.exe
  C:\Windows\System\pvEQZMs.exe
  2⤵
  PID:9700
- C:\Windows\System\ZaSmmhU.exe
  C:\Windows\System\ZaSmmhU.exe
  2⤵
  PID:9716
- C:\Windows\System\SQxIOuJ.exe
  C:\Windows\System\SQxIOuJ.exe
  2⤵
  PID:9748
- C:\Windows\System\cTPeqgq.exe
  C:\Windows\System\cTPeqgq.exe
  2⤵
  PID:9772
- C:\Windows\System\AFzOVmz.exe
  C:\Windows\System\AFzOVmz.exe
  2⤵
  PID:9800
- C:\Windows\System\VJrbvMI.exe
  C:\Windows\System\VJrbvMI.exe
  2⤵
  PID:9828
- C:\Windows\System\ROWCMDF.exe
  C:\Windows\System\ROWCMDF.exe
  2⤵
  PID:9856
- C:\Windows\System\fRGKLEl.exe
  C:\Windows\System\fRGKLEl.exe
  2⤵
  PID:9884
- C:\Windows\System\PBzyimC.exe
  C:\Windows\System\PBzyimC.exe
  2⤵
  PID:9924
- C:\Windows\System\JsozcZP.exe
  C:\Windows\System\JsozcZP.exe
  2⤵
  PID:9952
- C:\Windows\System\DAisMqZ.exe
  C:\Windows\System\DAisMqZ.exe
  2⤵
  PID:9980
- C:\Windows\System\VONuoWp.exe
  C:\Windows\System\VONuoWp.exe
  2⤵
  PID:10000
- C:\Windows\System\MZXrvVL.exe
  C:\Windows\System\MZXrvVL.exe
  2⤵
  PID:10036
- C:\Windows\System\VONzjfN.exe
  C:\Windows\System\VONzjfN.exe
  2⤵
  PID:10064
- C:\Windows\System\EAvTfnA.exe
  C:\Windows\System\EAvTfnA.exe
  2⤵
  PID:10080
- C:\Windows\System\TAzFmPB.exe
  C:\Windows\System\TAzFmPB.exe
  2⤵
  PID:10104
- C:\Windows\System\yhjitJo.exe
  C:\Windows\System\yhjitJo.exe
  2⤵
  PID:10136
- C:\Windows\System\pqEiZoH.exe
  C:\Windows\System\pqEiZoH.exe
  2⤵
  PID:10164
- C:\Windows\System\VReWHKb.exe
  C:\Windows\System\VReWHKb.exe
  2⤵
  PID:10204
- C:\Windows\System\UIBUNwQ.exe
  C:\Windows\System\UIBUNwQ.exe
  2⤵
  PID:10220
- C:\Windows\System\tqlJuWs.exe
  C:\Windows\System\tqlJuWs.exe
  2⤵
  PID:8288
- C:\Windows\System\fNIIjYe.exe
  C:\Windows\System\fNIIjYe.exe
  2⤵
  PID:9316
- C:\Windows\System\ruvirJT.exe
  C:\Windows\System\ruvirJT.exe
  2⤵
  PID:9376
- C:\Windows\System\ymrCftp.exe
  C:\Windows\System\ymrCftp.exe
  2⤵
  PID:9424
- C:\Windows\System\ajLHjqT.exe
  C:\Windows\System\ajLHjqT.exe
  2⤵
  PID:9492
- C:\Windows\System\bBkRBrD.exe
  C:\Windows\System\bBkRBrD.exe
  2⤵
  PID:9580
- C:\Windows\System\BUMFcJX.exe
  C:\Windows\System\BUMFcJX.exe
  2⤵
  PID:9608
- C:\Windows\System\EQHYmzS.exe
  C:\Windows\System\EQHYmzS.exe
  2⤵
  PID:9712
- C:\Windows\System\SDnwHWm.exe
  C:\Windows\System\SDnwHWm.exe
  2⤵
  PID:9768
- C:\Windows\System\REAvzXi.exe
  C:\Windows\System\REAvzXi.exe
  2⤵
  PID:9840
- C:\Windows\System\yDlvMgF.exe
  C:\Windows\System\yDlvMgF.exe
  2⤵
  PID:9908
- C:\Windows\System\Nwzedsz.exe
  C:\Windows\System\Nwzedsz.exe
  2⤵
  PID:9964
- C:\Windows\System\RmIXlsH.exe
  C:\Windows\System\RmIXlsH.exe
  2⤵
  PID:10052
- C:\Windows\System\OXllUJZ.exe
  C:\Windows\System\OXllUJZ.exe
  2⤵
  PID:10096
- C:\Windows\System\ZntKbKQ.exe
  C:\Windows\System\ZntKbKQ.exe
  2⤵
  PID:10124
- C:\Windows\System\mjCLpGA.exe
  C:\Windows\System\mjCLpGA.exe
  2⤵
  PID:10236
- C:\Windows\System\dZWTppG.exe
  C:\Windows\System\dZWTppG.exe
  2⤵
  PID:9260
- C:\Windows\System\muFbuVb.exe
  C:\Windows\System\muFbuVb.exe
  2⤵
  PID:9404
- C:\Windows\System\rqoZeMN.exe
  C:\Windows\System\rqoZeMN.exe
  2⤵
  PID:9548
- C:\Windows\System\gXoBnQQ.exe
  C:\Windows\System\gXoBnQQ.exe
  2⤵
  PID:9788
- C:\Windows\System\xebPlyO.exe
  C:\Windows\System\xebPlyO.exe
  2⤵
  PID:9968
- C:\Windows\System\llCpuJF.exe
  C:\Windows\System\llCpuJF.exe
  2⤵
  PID:10156
- C:\Windows\System\bYydKwN.exe
  C:\Windows\System\bYydKwN.exe
  2⤵
  PID:8340
- C:\Windows\System\YFZfNpT.exe
  C:\Windows\System\YFZfNpT.exe
  2⤵
  PID:9340
- C:\Windows\System\IenOwoh.exe
  C:\Windows\System\IenOwoh.exe
  2⤵
  PID:9944
- C:\Windows\System\BfIHkhd.exe
  C:\Windows\System\BfIHkhd.exe
  2⤵
  PID:9484
- C:\Windows\System\lSJZBRc.exe
  C:\Windows\System\lSJZBRc.exe
  2⤵
  PID:10176
- C:\Windows\System\tGTnwhP.exe
  C:\Windows\System\tGTnwhP.exe
  2⤵
  PID:10252
- C:\Windows\System\XVOKmQG.exe
  C:\Windows\System\XVOKmQG.exe
  2⤵
  PID:10280
- C:\Windows\System\CbTYxXI.exe
  C:\Windows\System\CbTYxXI.exe
  2⤵
  PID:10308
- C:\Windows\System\eukPOGD.exe
  C:\Windows\System\eukPOGD.exe
  2⤵
  PID:10336
- C:\Windows\System\LZQHYAo.exe
  C:\Windows\System\LZQHYAo.exe
  2⤵
  PID:10364
- C:\Windows\System\fOQtGiX.exe
  C:\Windows\System\fOQtGiX.exe
  2⤵
  PID:10392
- C:\Windows\System\NuxuWIV.exe
  C:\Windows\System\NuxuWIV.exe
  2⤵
  PID:10420
- C:\Windows\System\SLRBZZN.exe
  C:\Windows\System\SLRBZZN.exe
  2⤵
  PID:10436
- C:\Windows\System\dSEYgCE.exe
  C:\Windows\System\dSEYgCE.exe
  2⤵
  PID:10468
- C:\Windows\System\xSpTuOK.exe
  C:\Windows\System\xSpTuOK.exe
  2⤵
  PID:10492
- C:\Windows\System\qAREyeF.exe
  C:\Windows\System\qAREyeF.exe
  2⤵
  PID:10508
- C:\Windows\System\ZXmJWQK.exe
  C:\Windows\System\ZXmJWQK.exe
  2⤵
  PID:10548
- C:\Windows\System\XvGsKtp.exe
  C:\Windows\System\XvGsKtp.exe
  2⤵
  PID:10576
- C:\Windows\System\gnkktej.exe
  C:\Windows\System\gnkktej.exe
  2⤵
  PID:10604
- C:\Windows\System\UpHQSsD.exe
  C:\Windows\System\UpHQSsD.exe
  2⤵
  PID:10632
- C:\Windows\System\nWYIqwv.exe
  C:\Windows\System\nWYIqwv.exe
  2⤵
  PID:10672
- C:\Windows\System\mTTUBIu.exe
  C:\Windows\System\mTTUBIu.exe
  2⤵
  PID:10700
- C:\Windows\System\GZTEZxY.exe
  C:\Windows\System\GZTEZxY.exe
  2⤵
  PID:10728
- C:\Windows\System\GnyZneR.exe
  C:\Windows\System\GnyZneR.exe
  2⤵
  PID:10756
- C:\Windows\System\RTEWALV.exe
  C:\Windows\System\RTEWALV.exe
  2⤵
  PID:10784
- C:\Windows\System\wgSeXhM.exe
  C:\Windows\System\wgSeXhM.exe
  2⤵
  PID:10812
- C:\Windows\System\DqDHItO.exe
  C:\Windows\System\DqDHItO.exe
  2⤵
  PID:10832
- C:\Windows\System\AfvtwHk.exe
  C:\Windows\System\AfvtwHk.exe
  2⤵
  PID:10868
- C:\Windows\System\gybxysi.exe
  C:\Windows\System\gybxysi.exe
  2⤵
  PID:10896
- C:\Windows\System\dxRKKNB.exe
  C:\Windows\System\dxRKKNB.exe
  2⤵
  PID:10924
- C:\Windows\System\cnzZHqM.exe
  C:\Windows\System\cnzZHqM.exe
  2⤵
  PID:10952
- C:\Windows\System\qxFDXkL.exe
  C:\Windows\System\qxFDXkL.exe
  2⤵
  PID:10980
- C:\Windows\System\lGrcowE.exe
  C:\Windows\System\lGrcowE.exe
  2⤵
  PID:10996
- C:\Windows\System\ctjAOiX.exe
  C:\Windows\System\ctjAOiX.exe
  2⤵
  PID:11024
- C:\Windows\System\XPoiWgT.exe
  C:\Windows\System\XPoiWgT.exe
  2⤵
  PID:11052
- C:\Windows\System\tzhfkae.exe
  C:\Windows\System\tzhfkae.exe
  2⤵
  PID:11092
- C:\Windows\System\ZqBFJws.exe
  C:\Windows\System\ZqBFJws.exe
  2⤵
  PID:11120
- C:\Windows\System\KWjCOdf.exe
  C:\Windows\System\KWjCOdf.exe
  2⤵
  PID:11148
- C:\Windows\System\vqpyVSt.exe
  C:\Windows\System\vqpyVSt.exe
  2⤵
  PID:11176
- C:\Windows\System\YiZNNIa.exe
  C:\Windows\System\YiZNNIa.exe
  2⤵
  PID:11204
- C:\Windows\System\GllzWAe.exe
  C:\Windows\System\GllzWAe.exe
  2⤵
  PID:11232
- C:\Windows\System\VfUDgvb.exe
  C:\Windows\System\VfUDgvb.exe
  2⤵
  PID:10060
- C:\Windows\System\XrjATWS.exe
  C:\Windows\System\XrjATWS.exe
  2⤵
  PID:10264
- C:\Windows\System\PenPrPL.exe
  C:\Windows\System\PenPrPL.exe
  2⤵
  PID:10292
- C:\Windows\System\GyODrvV.exe
  C:\Windows\System\GyODrvV.exe
  2⤵
  PID:10380
- C:\Windows\System\jkCpfsz.exe
  C:\Windows\System\jkCpfsz.exe
  2⤵
  PID:10464
- C:\Windows\System\frFVqMV.exe
  C:\Windows\System\frFVqMV.exe
  2⤵
  PID:10500
- C:\Windows\System\SDFYcTk.exe
  C:\Windows\System\SDFYcTk.exe
  2⤵
  PID:10644
- C:\Windows\System\CByJqyW.exe
  C:\Windows\System\CByJqyW.exe
  2⤵
  PID:10720
- C:\Windows\System\wKWhITf.exe
  C:\Windows\System\wKWhITf.exe
  2⤵
  PID:10780
- C:\Windows\System\WBlXigl.exe
  C:\Windows\System\WBlXigl.exe
  2⤵
  PID:10852
- C:\Windows\System\dDdOdmn.exe
  C:\Windows\System\dDdOdmn.exe
  2⤵
  PID:10888
- C:\Windows\System\nLHEZLX.exe
  C:\Windows\System\nLHEZLX.exe
  2⤵
  PID:10944
- C:\Windows\System\YlFanYp.exe
  C:\Windows\System\YlFanYp.exe
  2⤵
  PID:10976
- C:\Windows\System\AMCKBXD.exe
  C:\Windows\System\AMCKBXD.exe
  2⤵
  PID:11088
- C:\Windows\System\pDQrjWJ.exe
  C:\Windows\System\pDQrjWJ.exe
  2⤵
  PID:11160
- C:\Windows\System\iXnjRIX.exe
  C:\Windows\System\iXnjRIX.exe
  2⤵
  PID:11224
- C:\Windows\System\emBTiBL.exe
  C:\Windows\System\emBTiBL.exe
  2⤵
  PID:2180
- C:\Windows\System\QwyNaKu.exe
  C:\Windows\System\QwyNaKu.exe
  2⤵
  PID:10332
- C:\Windows\System\clcsiZr.exe
  C:\Windows\System\clcsiZr.exe
  2⤵
  PID:10616
- C:\Windows\System\QRTDnhG.exe
  C:\Windows\System\QRTDnhG.exe
  2⤵
  PID:10684
- C:\Windows\System\ADyEhrb.exe
  C:\Windows\System\ADyEhrb.exe
  2⤵
  PID:10804
- C:\Windows\System\vekqQti.exe
  C:\Windows\System\vekqQti.exe
  2⤵
  PID:10972
- C:\Windows\System\iXEUyWS.exe
  C:\Windows\System\iXEUyWS.exe
  2⤵
  PID:11188
- C:\Windows\System\RdAtPtB.exe
  C:\Windows\System\RdAtPtB.exe
  2⤵
  PID:11252
- C:\Windows\System\IjNDpmx.exe
  C:\Windows\System\IjNDpmx.exe
  2⤵
  PID:10412
- C:\Windows\System\RAyHFzZ.exe
  C:\Windows\System\RAyHFzZ.exe
  2⤵
  PID:11036
- C:\Windows\System\yHwMGPY.exe
  C:\Windows\System\yHwMGPY.exe
  2⤵
  PID:11228
- C:\Windows\System\YiIDjJB.exe
  C:\Windows\System\YiIDjJB.exe
  2⤵
  PID:11244
- C:\Windows\System\BXkNZme.exe
  C:\Windows\System\BXkNZme.exe
  2⤵
  PID:11280
- C:\Windows\System\OmbKJbU.exe
  C:\Windows\System\OmbKJbU.exe
  2⤵
  PID:11320
- C:\Windows\System\PyCdtTr.exe
  C:\Windows\System\PyCdtTr.exe
  2⤵
  PID:11336
- C:\Windows\System\hfTqUJJ.exe
  C:\Windows\System\hfTqUJJ.exe
  2⤵
  PID:11376
- C:\Windows\System\MlbqJZR.exe
  C:\Windows\System\MlbqJZR.exe
  2⤵
  PID:11392
- C:\Windows\System\twxToAq.exe
  C:\Windows\System\twxToAq.exe
  2⤵
  PID:11420
- C:\Windows\System\AIuLWgK.exe
  C:\Windows\System\AIuLWgK.exe
  2⤵
  PID:11460
- C:\Windows\System\zLSEIri.exe
  C:\Windows\System\zLSEIri.exe
  2⤵
  PID:11476
- C:\Windows\System\IgqJvib.exe
  C:\Windows\System\IgqJvib.exe
  2⤵
  PID:11516
- C:\Windows\System\LsYVTYe.exe
  C:\Windows\System\LsYVTYe.exe
  2⤵
  PID:11544
- C:\Windows\System\wsCvFmH.exe
  C:\Windows\System\wsCvFmH.exe
  2⤵
  PID:11572
- C:\Windows\System\uChdtQL.exe
  C:\Windows\System\uChdtQL.exe
  2⤵
  PID:11600
- C:\Windows\System\AMmYfNJ.exe
  C:\Windows\System\AMmYfNJ.exe
  2⤵
  PID:11624
- C:\Windows\System\egIZmwJ.exe
  C:\Windows\System\egIZmwJ.exe
  2⤵
  PID:11644
- C:\Windows\System\MrsYCBW.exe
  C:\Windows\System\MrsYCBW.exe
  2⤵
  PID:11684
- C:\Windows\System\cCalQaG.exe
  C:\Windows\System\cCalQaG.exe
  2⤵
  PID:11700
- C:\Windows\System\maSVkEp.exe
  C:\Windows\System\maSVkEp.exe
  2⤵
  PID:11736
- C:\Windows\System\TbBFFlo.exe
  C:\Windows\System\TbBFFlo.exe
  2⤵
  PID:11756
- C:\Windows\System\bbPJUbg.exe
  C:\Windows\System\bbPJUbg.exe
  2⤵
  PID:11784
- C:\Windows\System\EXpWJKk.exe
  C:\Windows\System\EXpWJKk.exe
  2⤵
  PID:11816
- C:\Windows\System\fIOpoiY.exe
  C:\Windows\System\fIOpoiY.exe
  2⤵
  PID:11840
- C:\Windows\System\NesIRxf.exe
  C:\Windows\System\NesIRxf.exe
  2⤵
  PID:11880
- C:\Windows\System\ZnVlwUQ.exe
  C:\Windows\System\ZnVlwUQ.exe
  2⤵
  PID:11900
- C:\Windows\System\LAMhBKJ.exe
  C:\Windows\System\LAMhBKJ.exe
  2⤵
  PID:11936
- C:\Windows\System\AeSQMlA.exe
  C:\Windows\System\AeSQMlA.exe
  2⤵
  PID:11952
- C:\Windows\System\jFVxbEy.exe
  C:\Windows\System\jFVxbEy.exe
  2⤵
  PID:11992
- C:\Windows\System\XofSsXI.exe
  C:\Windows\System\XofSsXI.exe
  2⤵
  PID:12020
- C:\Windows\System\DpueLUO.exe
  C:\Windows\System\DpueLUO.exe
  2⤵
  PID:12036
- C:\Windows\System\hDiNYrI.exe
  C:\Windows\System\hDiNYrI.exe
  2⤵
  PID:12072
- C:\Windows\System\ZklxePG.exe
  C:\Windows\System\ZklxePG.exe
  2⤵
  PID:12096
- C:\Windows\System\uVqgHsf.exe
  C:\Windows\System\uVqgHsf.exe
  2⤵
  PID:12112
- C:\Windows\System\suYDsCb.exe
  C:\Windows\System\suYDsCb.exe
  2⤵
  PID:12144
- C:\Windows\System\flpNptJ.exe
  C:\Windows\System\flpNptJ.exe
  2⤵
  PID:12180
- C:\Windows\System\wkisrGe.exe
  C:\Windows\System\wkisrGe.exe
  2⤵
  PID:12204
- C:\Windows\System\vYhtzVg.exe
  C:\Windows\System\vYhtzVg.exe
  2⤵
  PID:12240
- C:\Windows\System\TKetwFV.exe
  C:\Windows\System\TKetwFV.exe
  2⤵
  PID:12264
- C:\Windows\System\lNepJWJ.exe
  C:\Windows\System\lNepJWJ.exe
  2⤵
  PID:11272
- C:\Windows\System\gzsONqW.exe
  C:\Windows\System\gzsONqW.exe
  2⤵
  PID:11304
- C:\Windows\System\gxfzWHl.exe
  C:\Windows\System\gxfzWHl.exe
  2⤵
  PID:11384
- C:\Windows\System\RCmQwWF.exe
  C:\Windows\System\RCmQwWF.exe
  2⤵
  PID:11472
- C:\Windows\System\gmEVpKi.exe
  C:\Windows\System\gmEVpKi.exe
  2⤵
  PID:11528
- C:\Windows\System\xLMsgRz.exe
  C:\Windows\System\xLMsgRz.exe
  2⤵
  PID:11616
- C:\Windows\System\PkejotX.exe
  C:\Windows\System\PkejotX.exe
  2⤵
  PID:11668
- C:\Windows\System\LarmDBZ.exe
  C:\Windows\System\LarmDBZ.exe
  2⤵
  PID:11720
- C:\Windows\System\XSQjnXW.exe
  C:\Windows\System\XSQjnXW.exe
  2⤵
  PID:11772
- C:\Windows\System\uUeCamK.exe
  C:\Windows\System\uUeCamK.exe
  2⤵
  PID:11260
- C:\Windows\System\pbwfrCk.exe
  C:\Windows\System\pbwfrCk.exe
  2⤵
  PID:11860
- C:\Windows\System\vBFhvzX.exe
  C:\Windows\System\vBFhvzX.exe
  2⤵
  PID:12032
- C:\Windows\System\oeJhAjv.exe
  C:\Windows\System\oeJhAjv.exe
  2⤵
  PID:12060
- C:\Windows\System\AbjikED.exe
  C:\Windows\System\AbjikED.exe
  2⤵
  PID:12084
- C:\Windows\System\MavojUv.exe
  C:\Windows\System\MavojUv.exe
  2⤵
  PID:12188
- C:\Windows\System\gnrCWQr.exe
  C:\Windows\System\gnrCWQr.exe
  2⤵
  PID:12228
- C:\Windows\System\dHwywAJ.exe
  C:\Windows\System\dHwywAJ.exe
  2⤵
  PID:11308
- C:\Windows\System\yRjeLpI.exe
  C:\Windows\System\yRjeLpI.exe
  2⤵
  PID:11568
- C:\Windows\System\UIdPuLr.exe
  C:\Windows\System\UIdPuLr.exe
  2⤵
  PID:11692
- C:\Windows\System\AjuYMjU.exe
  C:\Windows\System\AjuYMjU.exe
  2⤵
  PID:11836
- C:\Windows\System\JYuFacb.exe
  C:\Windows\System\JYuFacb.exe
  2⤵
  PID:12108
- C:\Windows\System\TGwTmGe.exe
  C:\Windows\System\TGwTmGe.exe
  2⤵
  PID:12232
- C:\Windows\System\CMGIHDZ.exe
  C:\Windows\System\CMGIHDZ.exe
  2⤵
  PID:11508
- C:\Windows\System\sDggQlS.exe
  C:\Windows\System\sDggQlS.exe
  2⤵
  PID:3872
- C:\Windows\System\rwGHvPt.exe
  C:\Windows\System\rwGHvPt.exe
  2⤵
  PID:11408
- C:\Windows\System\QZlgvfm.exe
  C:\Windows\System\QZlgvfm.exe
  2⤵
  PID:12312
- C:\Windows\System\jfLqHJf.exe
  C:\Windows\System\jfLqHJf.exe
  2⤵
  PID:12328
- C:\Windows\System\PXbxzZR.exe
  C:\Windows\System\PXbxzZR.exe
  2⤵
  PID:12356
- C:\Windows\System\nkrgWSW.exe
  C:\Windows\System\nkrgWSW.exe
  2⤵
  PID:12396
- C:\Windows\System\ecCXzQZ.exe
  C:\Windows\System\ecCXzQZ.exe
  2⤵
  PID:12432
- C:\Windows\System\PoEfpoz.exe
  C:\Windows\System\PoEfpoz.exe
  2⤵
  PID:12448
- C:\Windows\System\NwDTCbk.exe
  C:\Windows\System\NwDTCbk.exe
  2⤵
  PID:12476
- C:\Windows\System\zcxIaTT.exe
  C:\Windows\System\zcxIaTT.exe
  2⤵
  PID:12504
- C:\Windows\System\pJrlfzY.exe
  C:\Windows\System\pJrlfzY.exe
  2⤵
  PID:12544
- C:\Windows\System\zXdyEaT.exe
  C:\Windows\System\zXdyEaT.exe
  2⤵
  PID:12576
- C:\Windows\System\bGYvwKx.exe
  C:\Windows\System\bGYvwKx.exe
  2⤵
  PID:12604
- C:\Windows\System\XyvEJFx.exe
  C:\Windows\System\XyvEJFx.exe
  2⤵
  PID:12644
- C:\Windows\System\qbhGeke.exe
  C:\Windows\System\qbhGeke.exe
  2⤵
  PID:12672
- C:\Windows\System\WGbZqdg.exe
  C:\Windows\System\WGbZqdg.exe
  2⤵
  PID:12708
- C:\Windows\System\ZarfMOI.exe
  C:\Windows\System\ZarfMOI.exe
  2⤵
  PID:12724
- C:\Windows\System\FUvTcpb.exe
  C:\Windows\System\FUvTcpb.exe
  2⤵
  PID:12764
- C:\Windows\System\rDvKtHJ.exe
  C:\Windows\System\rDvKtHJ.exe
  2⤵
  PID:12784
- C:\Windows\System\lxEJldR.exe
  C:\Windows\System\lxEJldR.exe
  2⤵
  PID:12832
- C:\Windows\System\nCEOeEj.exe
  C:\Windows\System\nCEOeEj.exe
  2⤵
  PID:12860
- C:\Windows\System\SBqMKKx.exe
  C:\Windows\System\SBqMKKx.exe
  2⤵
  PID:12880
- C:\Windows\System\VmoZfQF.exe
  C:\Windows\System\VmoZfQF.exe
  2⤵
  PID:12916
- C:\Windows\System\rJssvZe.exe
  C:\Windows\System\rJssvZe.exe
  2⤵
  PID:12944
- C:\Windows\System\tHMfiTI.exe
  C:\Windows\System\tHMfiTI.exe
  2⤵
  PID:12960
- C:\Windows\System\GfNknAi.exe
  C:\Windows\System\GfNknAi.exe
  2⤵
  PID:12988
- C:\Windows\System\qlsFrxt.exe
  C:\Windows\System\qlsFrxt.exe
  2⤵
  PID:13032
- C:\Windows\System\DidiAoU.exe
  C:\Windows\System\DidiAoU.exe
  2⤵
  PID:13060
- C:\Windows\System\xFNfpMb.exe
  C:\Windows\System\xFNfpMb.exe
  2⤵
  PID:13076
- C:\Windows\System\YTezZQU.exe
  C:\Windows\System\YTezZQU.exe
  2⤵
  PID:13116
- C:\Windows\System\bLtjrVY.exe
  C:\Windows\System\bLtjrVY.exe
  2⤵
  PID:13144
- C:\Windows\System\zaFlSDU.exe
  C:\Windows\System\zaFlSDU.exe
  2⤵
  PID:13172
- C:\Windows\System\ztrROzp.exe
  C:\Windows\System\ztrROzp.exe
  2⤵
  PID:13200
- C:\Windows\System\tvJLwhH.exe
  C:\Windows\System\tvJLwhH.exe
  2⤵
  PID:13228
- C:\Windows\System\mEGzqrj.exe
  C:\Windows\System\mEGzqrj.exe
  2⤵
  PID:13256
- C:\Windows\System\ZMerGdI.exe
  C:\Windows\System\ZMerGdI.exe
  2⤵
  PID:13272
- C:\Windows\System\eJnQgJn.exe
  C:\Windows\System\eJnQgJn.exe
  2⤵
  PID:13300
- C:\Windows\System\FFuuzpb.exe
  C:\Windows\System\FFuuzpb.exe
  2⤵
  PID:10404
- C:\Windows\System\ziUoYUI.exe
  C:\Windows\System\ziUoYUI.exe
  2⤵
  PID:12320
- C:\Windows\System\kJeLWOI.exe
  C:\Windows\System\kJeLWOI.exe
  2⤵
  PID:12424
- C:\Windows\System\CsyFpIv.exe
  C:\Windows\System\CsyFpIv.exe
  2⤵
  PID:12536
- C:\Windows\System\QGpTzOh.exe
  C:\Windows\System\QGpTzOh.exe
  2⤵
  PID:12560
- C:\Windows\System\AViIMrk.exe
  C:\Windows\System\AViIMrk.exe
  2⤵
  PID:12652
- C:\Windows\System\SgKlITa.exe
  C:\Windows\System\SgKlITa.exe
  2⤵
  PID:12796
- C:\Windows\System\vvdtGdv.exe
  C:\Windows\System\vvdtGdv.exe
  2⤵
  PID:12872
- C:\Windows\System\uMwvfKJ.exe
  C:\Windows\System\uMwvfKJ.exe
  2⤵
  PID:12936
- C:\Windows\System\cEuhRgx.exe
  C:\Windows\System\cEuhRgx.exe
  2⤵
  PID:12984
- C:\Windows\System\EwXFSbV.exe
  C:\Windows\System\EwXFSbV.exe
  2⤵
  PID:13052
- C:\Windows\System\WcRFLzM.exe
  C:\Windows\System\WcRFLzM.exe
  2⤵
  PID:13128
- C:\Windows\System\tBrQLkQ.exe
  C:\Windows\System\tBrQLkQ.exe
  2⤵
  PID:13216
- C:\Windows\System\APLlLFy.exe
  C:\Windows\System\APLlLFy.exe
  2⤵
  PID:13264
- C:\Windows\System\LIZhLSd.exe
  C:\Windows\System\LIZhLSd.exe
  2⤵
  PID:1244
- C:\Windows\System\eOXGOEt.exe
  C:\Windows\System\eOXGOEt.exe
  2⤵
  PID:12324
- C:\Windows\System\dgbJzdF.exe
  C:\Windows\System\dgbJzdF.exe
  2⤵
  PID:12488
- C:\Windows\System\hqGFWoU.exe
  C:\Windows\System\hqGFWoU.exe
  2⤵
  PID:12680
- C:\Windows\System\VAqVwys.exe
  C:\Windows\System\VAqVwys.exe
  2⤵
  PID:2432
- C:\Windows\System\noNmmXX.exe
  C:\Windows\System\noNmmXX.exe
  2⤵
  PID:6992
- C:\Windows\System\CfchXcg.exe
  C:\Windows\System\CfchXcg.exe
  2⤵
  PID:12956
- C:\Windows\System\WxrGivA.exe
  C:\Windows\System\WxrGivA.exe
  2⤵
  PID:13100
- C:\Windows\System\QZETdZM.exe
  C:\Windows\System\QZETdZM.exe
  2⤵
  PID:13268
- C:\Windows\System\ADZQDqF.exe
  C:\Windows\System\ADZQDqF.exe
  2⤵
  PID:7756
- C:\Windows\System\cupnfQX.exe
  C:\Windows\System\cupnfQX.exe
  2⤵
  PID:12972
- C:\Windows\System\bjFuOye.exe
  C:\Windows\System\bjFuOye.exe
  2⤵
  PID:13188
- C:\Windows\System\qrZnGxi.exe
  C:\Windows\System\qrZnGxi.exe
  2⤵
  PID:13320
- C:\Windows\System\cluwoLP.exe
  C:\Windows\System\cluwoLP.exe
  2⤵
  PID:13344
- C:\Windows\System\NwLmpFW.exe
  C:\Windows\System\NwLmpFW.exe
  2⤵
  PID:13392
- C:\Windows\System\WkBsjLu.exe
  C:\Windows\System\WkBsjLu.exe
  2⤵
  PID:13416
- C:\Windows\System\OgrFcxi.exe
  C:\Windows\System\OgrFcxi.exe
  2⤵
  PID:13460
- C:\Windows\System\RIGanKO.exe
  C:\Windows\System\RIGanKO.exe
  2⤵
  PID:13488
- C:\Windows\System\pnwmBdG.exe
  C:\Windows\System\pnwmBdG.exe
  2⤵
  PID:13520
- C:\Windows\System\PKPJcnu.exe
  C:\Windows\System\PKPJcnu.exe
  2⤵
  PID:13552
- C:\Windows\System\uUPreST.exe
  C:\Windows\System\uUPreST.exe
  2⤵
  PID:13596
- C:\Windows\System\zOyaXEP.exe
  C:\Windows\System\zOyaXEP.exe
  2⤵
  PID:13620
- C:\Windows\System\aeAlAdQ.exe
  C:\Windows\System\aeAlAdQ.exe
  2⤵
  PID:13644
- C:\Windows\System\dFFbuiH.exe
  C:\Windows\System\dFFbuiH.exe
  2⤵
  PID:13676
- C:\Windows\System\MijXSmd.exe
  C:\Windows\System\MijXSmd.exe
  2⤵
  PID:13716
- C:\Windows\System\zftKEKf.exe
  C:\Windows\System\zftKEKf.exe
  2⤵
  PID:13752
- C:\Windows\System\ktKpvGU.exe
  C:\Windows\System\ktKpvGU.exe
  2⤵
  PID:13780
- C:\Windows\System\NiggNnm.exe
  C:\Windows\System\NiggNnm.exe
  2⤵
  PID:13824
- C:\Windows\System\OOMPURa.exe
  C:\Windows\System\OOMPURa.exe
  2⤵
  PID:13856
- C:\Windows\System\gCfCmzZ.exe
  C:\Windows\System\gCfCmzZ.exe
  2⤵
  PID:13896
- C:\Windows\System\kOYufKU.exe
  C:\Windows\System\kOYufKU.exe
  2⤵
  PID:13924
- C:\Windows\System\Xkaetec.exe
  C:\Windows\System\Xkaetec.exe
  2⤵
  PID:13952
- C:\Windows\System\LwvYjUk.exe
  C:\Windows\System\LwvYjUk.exe
  2⤵
  PID:13972
- C:\Windows\System\CoCyijW.exe
  C:\Windows\System\CoCyijW.exe
  2⤵
  PID:14012
- C:\Windows\System\EylNcIF.exe
  C:\Windows\System\EylNcIF.exe
  2⤵
  PID:14028
- C:\Windows\System\BeWKhtV.exe
  C:\Windows\System\BeWKhtV.exe
  2⤵
  PID:14064
- C:\Windows\System\OiZmWAK.exe
  C:\Windows\System\OiZmWAK.exe
  2⤵
  PID:14084
- C:\Windows\System\vVxGlEg.exe
  C:\Windows\System\vVxGlEg.exe
  2⤵
  PID:14112
- C:\Windows\System\bktTyOu.exe
  C:\Windows\System\bktTyOu.exe
  2⤵
  PID:14132
- C:\Windows\System\bSRCqXS.exe
  C:\Windows\System\bSRCqXS.exe
  2⤵
  PID:14192
- C:\Windows\System\iXTNSiN.exe
  C:\Windows\System\iXTNSiN.exe
  2⤵
  PID:14208
- C:\Windows\System\yJqueDj.exe
  C:\Windows\System\yJqueDj.exe
  2⤵
  PID:14224
- C:\Windows\System\RFbsdJg.exe
  C:\Windows\System\RFbsdJg.exe
  2⤵
  PID:14252
- C:\Windows\System\cnveRsq.exe
  C:\Windows\System\cnveRsq.exe
  2⤵
  PID:14292
- C:\Windows\System\qSoIRTj.exe
  C:\Windows\System\qSoIRTj.exe
  2⤵
  PID:14332
- C:\Windows\System\fqmeoFx.exe
  C:\Windows\System\fqmeoFx.exe
  2⤵
  PID:13380
- C:\Windows\System\xaAHeno.exe
  C:\Windows\System\xaAHeno.exe
  2⤵
  PID:13440
- C:\Windows\System\OjIJggC.exe
  C:\Windows\System\OjIJggC.exe
  2⤵
  PID:13480
- C:\Windows\System\YXLgUZh.exe
  C:\Windows\System\YXLgUZh.exe
  2⤵
  PID:60
- C:\Windows\System\YbGmlgS.exe
  C:\Windows\System\YbGmlgS.exe
  2⤵
  PID:13564
- C:\Windows\System\kJMooCh.exe
  C:\Windows\System\kJMooCh.exe
  2⤵
  PID:13660
- C:\Windows\System\HpIaFtZ.exe
  C:\Windows\System\HpIaFtZ.exe
  2⤵
  PID:13684
- C:\Windows\System\xhbmuwS.exe
  C:\Windows\System\xhbmuwS.exe
  2⤵
  PID:13820
- C:\Windows\System\bSEKCSy.exe
  C:\Windows\System\bSEKCSy.exe
  2⤵
  PID:13916
- C:\Windows\System\esvoKTP.exe
  C:\Windows\System\esvoKTP.exe
  2⤵
  PID:13960
- C:\Windows\System\fOfdVUx.exe
  C:\Windows\System\fOfdVUx.exe
  2⤵
  PID:14024
- C:\Windows\System\hruYRxT.exe
  C:\Windows\System\hruYRxT.exe
  2⤵
  PID:14080
- C:\Windows\System\rsEpidP.exe
  C:\Windows\System\rsEpidP.exe
  2⤵
  PID:1408
- C:\Windows\System\mLOacpA.exe
  C:\Windows\System\mLOacpA.exe
  2⤵
  PID:14220
- C:\Windows\System\BJigNOj.exe
  C:\Windows\System\BJigNOj.exe
  2⤵
  PID:14304
- C:\Windows\System\syIjwlg.exe
  C:\Windows\System\syIjwlg.exe
  2⤵
  PID:14324
- C:\Windows\System\inWxbXj.exe
  C:\Windows\System\inWxbXj.exe
  2⤵
  PID:13504
- C:\Windows\System\iSyNhlr.exe
  C:\Windows\System\iSyNhlr.exe
  2⤵
  PID:13608
- C:\Windows\System\aIJfyRf.exe
  C:\Windows\System\aIJfyRf.exe
  2⤵
  PID:13808
- C:\Windows\System\hGgJDcG.exe
  C:\Windows\System\hGgJDcG.exe
  2⤵
  PID:14060
- C:\Windows\System\IxJqqaZ.exe
  C:\Windows\System\IxJqqaZ.exe
  2⤵
  PID:14140
- C:\Windows\System\zGbimGz.exe
  C:\Windows\System\zGbimGz.exe
  2⤵
  PID:13536
- C:\Windows\System\bOKAorw.exe
  C:\Windows\System\bOKAorw.exe
  2⤵
  PID:13876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BtPyKRh.exe

Filesize
2.2MB

MD5
67703e8f33096915674f59c72ce11b1c

SHA1
3a1fedeade9d589ca14fb371b6173e58bc54b8b7

SHA256
6528ad91f35b91e329296caddc70b341ea7936242eee611bfa7ccceec4481abe

SHA512
462bf1ba4633871538b6574373b5d1c9e4935c5d463c1aa50c50fb1e9b7a3ccc3e3756708a24e99cb9164652f068ed5a37737892334755610f6ff64d80e83d10

Download Submit
C:\Windows\System\FsLlBEA.exe

Filesize
2.2MB

MD5
d1c2923cbaf3380815c4eb9de9cde9bd

SHA1
c87b21db0bbb99f8737e6fa6f13850635d39a4b3

SHA256
bdafc81dbc7ad62f4f8601e3193d54d584aefb613ab7dcf8e51a8e62fae52c6b

SHA512
b645cf49f85775f7a806d09ee9ef78b1c0f5fd63a634028a7bce5d389cd963aa53a7e12239a05b43e500a1502676f762e1aa3f8815357fb8b305b9637b65ee06

Download Submit
C:\Windows\System\GrZwDPX.exe

Filesize
2.2MB

MD5
dec4fb2f6ce874c42ea2e00077bfbb8f

SHA1
8cded65fc0e49ac53ac87b40b592723719cba67e

SHA256
08993daa94aeafd7d18f05e6dcb1685fdd5942b44bae7b43ca862997b092ea4d

SHA512
29f4ecda97f8a644bd72bf8bbfba34f0e32317980769c559dd618f7f5678bee0cb5a922f3479a342bd282b1f1dd7641d7cc8186578932fdfe6347abf25084a86

Download Submit
C:\Windows\System\IfDTMQs.exe

Filesize
2.2MB

MD5
072dcf1d82858ae7745afa7fe89b785b

SHA1
ca73713dde3dc4f9c7f3d33db982edd3664dbe18

SHA256
ca44975c39eb7969bf2813e4e9e351d04e9a0877671db555f781e8db0d00051a

SHA512
550fa22a489fe4a973ea26869ad73c99cd263a54feb7d7ec842bfaf20c6d0f622783d41cb0010068a3d07c31ca8c9d7e1bc9cbced507915c9c9a40ed1bb67b20

Download Submit
C:\Windows\System\JRtgRPr.exe

Filesize
2.2MB

MD5
0f6c52c8e198501928b07e75aaefe6e3

SHA1
f32fdbf4b3fb021631ba74bb35e1a9ce8e18112d

SHA256
2d3cc7d50a8808d2cc0718900a2200dad85eb293ca91371d279e672052c4aa09

SHA512
f0934bb7b5d94730346e874db36b374ee94f751305cd8795cc6613495ccb638e09838d3d6ebd81558aa2bae588869dc8010a05c11069ddfb44546dc718a6bddb

Download Submit
C:\Windows\System\LzopRdD.exe

Filesize
2.2MB

MD5
2e9f97bb79720c87f2fd7be9372fdc9d

SHA1
0ed8197d419001b53aaa5c34016204f8ca45781b

SHA256
793641f7304ea3e55fb65743b8fd4464fbff57d9a8dd66505009dc0b12315a0b

SHA512
5c434e31ac7f7b0fd9154f6f9533d525aeb6600a2652140f1dd2318be0a7dbe03ed2cea05b6d821ef83cbc1bd220ca329ea243ccb839270228914f041fc3eae6

Download Submit
C:\Windows\System\MfsNAxK.exe

Filesize
2.2MB

MD5
3e0bc32c40315678f92b9f4ed6c059c6

SHA1
0757a6bcd0263caed59d3edbcd8defa7404136ee

SHA256
ea8899f58ff626ffb94b7d01296a23db7958c2ab83b99ddd5d596bb72830bd7b

SHA512
7b3f18040699d65a212219cc84fb9c3ee26837318b2384e5f7000b7e99fb4c58292e1168b532e52bad1306b79221bdab5e0f505a13cfd9a64f7f8f60720cb2fd

Download Submit
C:\Windows\System\MqBYgaI.exe

Filesize
2.2MB

MD5
472ef2990b541238c27540e63138f4e5

SHA1
deaf0571d2cf0a12f1a6da29d261438cab574323

SHA256
09afba9355f164e9e951f7769208a79225e82134b2538e4a6957ff1a5eb9203c

SHA512
85a53e0743d3afec715f3f6515dce03ea69692832e737f097ce0f2261f419173e4c2936bc4dd46da139e1fe028c88e56427a07b4e17d5d27669ebf051d480959

Download Submit
C:\Windows\System\NmcRCcl.exe

Filesize
2.2MB

MD5
818609c8c37481edfa4d3779b375e263

SHA1
f99a93f0cebc333aa9b901fa914e0c3cde7d66fb

SHA256
be55c0b9d6aaf6649eb1f1de15fed36918a6cd2be29c5296bd2005891559f983

SHA512
1ef12625b8ffe5fcdb051a8a3d9bb10a546cfcc5c65885cfd4e9fe94b53bf096f3c7a8845fcb79064b006babb33c183739b8b2e0b4fb345d880f7b05c8fd2266

Download Submit
C:\Windows\System\PxSUVXr.exe

Filesize
2.2MB

MD5
7270040c690792113539e0638e029b15

SHA1
acd8ae4afe116802f1115a6f9dfb63cd7d9fba11

SHA256
332fb6497fd4ec4e152649f6559bd689a4dc5e6f1102d687bef5b1839c7cfcf9

SHA512
a13df2daa22f559a61f26f44724c12a8bc10cd221f52a66e1450a82fab77225bd65f6435bf3f4d3913557821d8eecb015976cdf7751a3f30a78f449a09862437

Download Submit
C:\Windows\System\SzbphNC.exe

Filesize
2.2MB

MD5
c30769023f23d9f42f058e7b5c6017cf

SHA1
1cc2ba988eba2b523dfa0761b653a021b8979747

SHA256
e2125d933ca7b8d8ef902043a0d819d1f6bd607f2171615301941b48755f2461

SHA512
a9328d7c9c6e334daf10f8faf52e09bf1868c64ed472913a9569283e72aa8abf35442314888e3d3ef212a37cc46a0b3353902f50d5c285fe9e104817fb2d6e6e

Download Submit
C:\Windows\System\TjJkbXc.exe

Filesize
2.2MB

MD5
b508f2feffd1f3919706e3b0e1cc35ad

SHA1
1ae0a283604a1448d51830ec8337ecc47253d0ef

SHA256
873751a9177f8264d43986c1b8005c3ec562dfa724fa0714a52ae860e1e6f978

SHA512
6c0fc795fec763e3553b41fca988d2731c587be777a0a0ec4e48ee70f7def19f96cb2d2368f7608f2a0b427f67fd3aad872c1f3758bd1c6e9ffa8986c4f4626c

Download Submit
C:\Windows\System\UUWxkpH.exe

Filesize
2.2MB

MD5
990c27872306a1126a6088bb7aeb438f

SHA1
e2f75c3126bcb947ece310c366442886b67ce803

SHA256
154ee747170778e2ee794cb1a5aca6ddae033ec613656b005d8e4ce42714a184

SHA512
f0927adfb9e8de75462fd98a3155dd26f53d7eacbf867853462dd84aca0324234d308f084237314abfafa71351943aa80020c41f92578cea674a080aee659871

Download Submit
C:\Windows\System\bLfXqDG.exe

Filesize
2.2MB

MD5
5931e36eb77bca0ed5c7b92945316eed

SHA1
a905031b8e17025665b454af7af47f79dc35d00c

SHA256
269e74302e3438abd30ca5745f61c21fcb4bdea4f37b6f4f29fd9631cd3b97ed

SHA512
3122e4f10604180069e274439603065f84b2916c831e522413cff822a89369c882dd296c202c3b57f0e09b4a4dc381ab1aac9c1f706da46eba8021e504f7c85d

Download Submit
C:\Windows\System\bMoFVgu.exe

Filesize
2.2MB

MD5
9eb1df64f921877ca95dab19c131fbf9

SHA1
dc34dc573d2dac35ebfce27f021c51f0af2eec5f

SHA256
b4443daf1b527f268b15c60f4651fd62800e8d81872d23e0358be6fd2de8b360

SHA512
a8f58054c7aa7180f0a2b7c69cea7a17fdc5b6ee25541ff92770a398df649f391dfb5e3e665ac72c6ca8bc45352c96bb648ee35aaeb74b52c1267e73b0c86055

Download Submit
C:\Windows\System\bZBLbfH.exe

Filesize
2.2MB

MD5
a54da7b544244a603eed59ebea0384d0

SHA1
1290f82683d9d175f4a56b6f354ef518f5e98d7c

SHA256
7a5071a24282b94c501be28b4949a41ccf0c5643aa60375266876c874e8484ac

SHA512
f713fef2ce8c118bc011f696928af3e7784c2f60dfb74f35b375160904fc47af9fe13d5514436e0e7697d84744627df1b0b7724dc2c79f9b72daced7edf4ab1c

Download Submit
C:\Windows\System\cCrBfcs.exe

Filesize
2.2MB

MD5
955428bed6f73f73beaa58c1e3722e37

SHA1
0d0fa0ca3ee270ec970e8b03f8fd807c09c2671a

SHA256
2b18ee79abaac07b313d34e1b7881bab1963a3ae1df90b6a4d06c7ef9918b9c4

SHA512
c7839918a557ed67d68cc9d3daabe3ced7dffa6ad84f1e56a8f84fd0dc28d86e702f7f2120cdf4126162944e425cc3ac03358b976350ea98e970b27361da20e2

Download Submit
C:\Windows\System\eNalhUY.exe

Filesize
2.2MB

MD5
87a07f1e8200e8e753504ecb96585365

SHA1
4f97b79872a3c5d02f40bea0393feefaba0ed750

SHA256
19eb72443bfffaf729312b8eba5526bdec304666750d1ef3f53f31023bb97f29

SHA512
d3545b29f3778573e35faa76a9344a3cb7f91ed8c46c5b677299a55dbf375a7a55a4d2276104afc7144e637a0d6aad6607372bf86c4b110c516a714b5d80ea53

Download Submit
C:\Windows\System\fwSXrwJ.exe

Filesize
2.2MB

MD5
24f31efff6a1cebde9bc49699f4f4826

SHA1
13ca1f7312b06ac5ae4cdc4788c8c1e54d85c8ba

SHA256
4ec78a8f88cddc00f2589176f4d23405ee6ec469ee8919632353fde9fb83c920

SHA512
38348d7fcf9421f98bd928b21e68ccfc3dbdb387fbcf7f3999c630614cc8aeb7e54c23cb76f0e757410a12ffcbedf41ce26b7d9c1cd961c935235708d1280d77

Download Submit
C:\Windows\System\jIaNckZ.exe

Filesize
2.2MB

MD5
7c09c7e49c33f652069beccb6a96c02f

SHA1
3b67e6c84d532a02bb774a5ba29f43ea46e0eca0

SHA256
c7546a184a495ddfe3442f4ec6e653be46a8518f27a4d270bdf31b7f3fb832d8

SHA512
6fc0f7f7c2e7b5ccd3e5f223b21361284e24aab0e00dc07259f7ebce44e5cb5c117eb249aa3f86f1a3810f282b1a669d7b37c41f739ff6b1638832c66196ca98

Download Submit
C:\Windows\System\lsYAPUT.exe

Filesize
2.2MB

MD5
9bd7ce82a447bf7797abb74df8f08ffa

SHA1
cad58177aa16f8bb2c1095dda86e19e0e135867b

SHA256
8d86eb7f8858066af1ca8405fd8b686b3667cf631a155c52ab7afdd1461d32cf

SHA512
18a7783e52e87d31378f05c2ce658c5c95e421979c3b3b245baaeb07ef584c0e0f693df22badc827a5eea36fc53e8f1049b25d4ef0f7209828b08cbb981f8aa3

Download Submit
C:\Windows\System\mLfTXsB.exe

Filesize
2.2MB

MD5
1d8cd4283c53e596ec643da42592cd21

SHA1
4de5e951171531608079c41dd6b1b34e9a8e5697

SHA256
e045a192472987f549e7c79fa860f2548f4180809c4c1ff97cbf463c8878c346

SHA512
c0c03f286b3cf12a323212b63f9cf2658ea98c5df086354452f2351b39db580ca79a8996b8c8d1488ff4f231a4a089d4c97105feac28825fa02d07fefb1a1448

Download Submit
C:\Windows\System\ntCOYlp.exe

Filesize
2.2MB

MD5
e449626242d0bdf033aba48d995fd31b

SHA1
0ad9d599818dcd0d06a0c33ec569c87e7872b81d

SHA256
fca572317a527691906bf2348cf8f733c729b13028c4f70b9c80c994fa4a2de6

SHA512
7a7ee81b94420517fd2e0fd53a6fbcf23e3255e54ef3bb9d03e5d73a3982828346f5c011549c5469c633e2118a2066672075ec54872f03d1e4d07873a726038e

Download Submit
C:\Windows\System\pCSbAnG.exe

Filesize
2.2MB

MD5
e77ec53b5892d3d5b1bf123a669ce2a8

SHA1
9a306e558145e706d9fcf33ca9c41e4c9ce2fcc8

SHA256
64553a4404a86abdc8e16347cf90761f2312cd7b3e7c32ce457cb05c848f1606

SHA512
0221b3e5c445bf7d37a426ddb2170516f3bb8b4c1ef2e439182b9479e6295c7669a7ef9168f232a269af69708a6b917f821131bd600f52499584d99a2af88743

Download Submit
C:\Windows\System\phIRzkF.exe

Filesize
2.2MB

MD5
4bf06f4246ca6d0301ae160e70fd3b5f

SHA1
bf02cb3ce1ef66ce5097aa4895e3cae4fcad5dfa

SHA256
f3e9dcdc79925794e6311194a276d2a2359b57f1f3bb1c1bbe91a765000dea87

SHA512
e319570d41c3247ca89cf0377c824a6c0ef7a49d98eece200647b87f2e876a2d371cf000d41b69992fd70da7507e146cb53ddd476a0aabc46de7fe35b752c7f1

Download Submit
C:\Windows\System\pjYHSdL.exe

Filesize
2.2MB

MD5
26127e2ce8f120ba892da57daaa72fb7

SHA1
6e6817ff2314d65dfa17de27471e9277fb9c0976

SHA256
61ae0d84e50e4e552574a0aa89e26c354f78c37b894576e8dd4b71337ba1915b

SHA512
7fe0d52b2044ea1062c0ab5067c9167f62a93ba5a8e3c904c819e64ed637812f4a97eb98cdea9a30e01d67b88a060ab7475ca4aa09f5b386784e76b31165ba09

Download Submit
C:\Windows\System\sCSOYsC.exe

Filesize
2.2MB

MD5
74ad9bcf5cb04c6f4b2d2d0a68065fc7

SHA1
be5b1e58ea2c17e736d78e0955c7bca01e59400d

SHA256
e5fb274692827b14e425feb477bf1b3749900bc666723001f77df872608a299a

SHA512
16fe02787a4dcb6b0da60f003f9329a8c8fd2579b068686344114e701977f26cd35bec7ef81f5b0e432692024979ecb53f46e947dec8a6f96df6b2bb0b12a4f1

Download Submit
C:\Windows\System\wbMHwrI.exe

Filesize
2.2MB

MD5
dc0b3c537911a0989bcddf8ead594709

SHA1
636bc9700e35e026651ffde8a83bc282c16ce36b

SHA256
4a8bf601e83638a4006d27a93d99037d22d341996e0bb27cb2b090d7ffb36a22

SHA512
4754ad640eb209b4c077e33dd027ac7bc8b6b5c20c1adf1f9f9bd0f431a0475b1a964ff216263f3858b81a5fb40837d9c51ec66e06f27ea0dbf9add4e9ce6f85

Download Submit
C:\Windows\System\xZOoLVj.exe

Filesize
2.2MB

MD5
ac951eebe8c81cf08dd5f23507939bcd

SHA1
ce579cbb257429ffc0faf6bbef5e749945fb07ab

SHA256
473a1f2d96b2bb65af5814458d0f4f6557a082e20a307f87f886659eaadb0db3

SHA512
251c50011dcecbd47e55c0da285f4b961af05eec919de1768e6b5f54b8a1d5591128e87d0dfb825de19a2b403ec85c690d649d349b510d326152c62b276d514b

Download Submit
C:\Windows\System\yGgGvWH.exe

Filesize
2.2MB

MD5
3d54f64775ae6d1adab2b71a65392d57

SHA1
19b7ebfcda4a413a67fdf493bd91c9f513480ad7

SHA256
828805e3dbfc6ccea7ede207475739eade93d61552b9576b2ebef89810091487

SHA512
762a432b01f281f4e32f041747934f283a6ca7c65919d7ee7c340711bed68bc8fee1c91ffbd961d3157cd8b30b935445aea85ce2dad777d3a81ee1f8899d849d

Download Submit
C:\Windows\System\yIeMEmZ.exe

Filesize
2.2MB

MD5
315d4060d5e7f19680f2d44c207269fd

SHA1
a5ca1acd2510e0e14348b37572b9e1d95688763b

SHA256
6c72ac71659a94aff4a6cf90c5c8df01af3b26a40591f726eeb96bae28be742d

SHA512
5f4df4c495d07ab1f67475a390e4a34b054b86483bc40e33a36d73d064e99640651bc53f7f7b844a5fc0025054baabcf485acfdd8763b77efc3a7eeac81dfd15

Download Submit
C:\Windows\System\yyklgIU.exe

Filesize
2.2MB

MD5
bfe35b57a6ab330b6eef7ceb5ecc54c7

SHA1
ccb1e2b00c14e13a653dacbbc3e8e0b9736d3e08

SHA256
7a392f92b9b8177a81df6742ba7078e0adc416b3ba68b65bb596cef4f885abb7

SHA512
f3dc2dc88d6e9b36f9086222546e3d585b0a221bc33a8f3202946e7e7371c1716a2440c9fb150a95f0da1fdf63b35ad0fee1030b2053426b06bb8918c1f1a2a7

Download Submit
C:\Windows\System\zSQJjqS.exe

Filesize
2.2MB

MD5
f7abda6368bba37472dac5831b7dccf0

SHA1
2173b7ea4061ad266142a36fc99d60779f9e645d

SHA256
7e70723dd716929113d138c97ea1e1229bc75217f9a966d16137b68e1afe70ab

SHA512
ef6b273de68a0fb8bcb1bb94cad3779472fdead5c39730b929b83171fcf2d9e2d8fbb66843b17240bbc86ab9ba4b5e560acbef57bd76883942eaaaffe7ffe5e1

Download Submit
memory/700-2127-0x00007FF6E13F0000-0x00007FF6E1744000-memory.dmp

Filesize
3.3MB

Download
memory/700-732-0x00007FF6E13F0000-0x00007FF6E1744000-memory.dmp

Filesize
3.3MB

Download
memory/816-2141-0x00007FF6B0AE0000-0x00007FF6B0E34000-memory.dmp

Filesize
3.3MB

Download
memory/816-799-0x00007FF6B0AE0000-0x00007FF6B0E34000-memory.dmp

Filesize
3.3MB

Download
memory/972-2135-0x00007FF72A720000-0x00007FF72AA74000-memory.dmp

Filesize
3.3MB

Download
memory/972-776-0x00007FF72A720000-0x00007FF72AA74000-memory.dmp

Filesize
3.3MB

Download
memory/1216-2125-0x00007FF7241E0000-0x00007FF724534000-memory.dmp

Filesize
3.3MB

Download
memory/1216-731-0x00007FF7241E0000-0x00007FF724534000-memory.dmp

Filesize
3.3MB

Download
memory/1228-2124-0x00007FF78B330000-0x00007FF78B684000-memory.dmp

Filesize
3.3MB

Download
memory/1228-2117-0x00007FF78B330000-0x00007FF78B684000-memory.dmp

Filesize
3.3MB

Download
memory/1228-28-0x00007FF78B330000-0x00007FF78B684000-memory.dmp

Filesize
3.3MB

Download
memory/1672-759-0x00007FF71B1F0000-0x00007FF71B544000-memory.dmp

Filesize
3.3MB

Download
memory/1672-2138-0x00007FF71B1F0000-0x00007FF71B544000-memory.dmp

Filesize
3.3MB

Download
memory/1744-755-0x00007FF6862C0000-0x00007FF686614000-memory.dmp

Filesize
3.3MB

Download
memory/1744-2139-0x00007FF6862C0000-0x00007FF686614000-memory.dmp

Filesize
3.3MB

Download
memory/2576-2121-0x00007FF621450000-0x00007FF6217A4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-2116-0x00007FF621450000-0x00007FF6217A4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-24-0x00007FF621450000-0x00007FF6217A4000-memory.dmp

Filesize
3.3MB

Download
memory/2644-2145-0x00007FF627A30000-0x00007FF627D84000-memory.dmp

Filesize
3.3MB

Download
memory/2644-788-0x00007FF627A30000-0x00007FF627D84000-memory.dmp

Filesize
3.3MB

Download
memory/2772-33-0x00007FF69A7D0000-0x00007FF69AB24000-memory.dmp

Filesize
3.3MB

Download
memory/2772-2123-0x00007FF69A7D0000-0x00007FF69AB24000-memory.dmp

Filesize
3.3MB

Download
memory/2772-2118-0x00007FF69A7D0000-0x00007FF69AB24000-memory.dmp

Filesize
3.3MB

Download
memory/2808-780-0x00007FF658860000-0x00007FF658BB4000-memory.dmp

Filesize
3.3MB

Download
memory/2808-2133-0x00007FF658860000-0x00007FF658BB4000-memory.dmp

Filesize
3.3MB

Download
memory/2816-741-0x00007FF7D5250000-0x00007FF7D55A4000-memory.dmp

Filesize
3.3MB

Download
memory/2816-2126-0x00007FF7D5250000-0x00007FF7D55A4000-memory.dmp

Filesize
3.3MB

Download
memory/2844-2147-0x00007FF6BF520000-0x00007FF6BF874000-memory.dmp

Filesize
3.3MB

Download
memory/2844-804-0x00007FF6BF520000-0x00007FF6BF874000-memory.dmp

Filesize
3.3MB

Download
memory/2948-808-0x00007FF76E560000-0x00007FF76E8B4000-memory.dmp

Filesize
3.3MB

Download
memory/2948-2128-0x00007FF76E560000-0x00007FF76E8B4000-memory.dmp

Filesize
3.3MB

Download
memory/3500-753-0x00007FF72AF20000-0x00007FF72B274000-memory.dmp

Filesize
3.3MB

Download
memory/3500-2132-0x00007FF72AF20000-0x00007FF72B274000-memory.dmp

Filesize
3.3MB

Download
memory/3524-747-0x00007FF6C2950000-0x00007FF6C2CA4000-memory.dmp

Filesize
3.3MB

Download
memory/3524-2131-0x00007FF6C2950000-0x00007FF6C2CA4000-memory.dmp

Filesize
3.3MB

Download
memory/3556-13-0x00007FF75D5B0000-0x00007FF75D904000-memory.dmp

Filesize
3.3MB

Download
memory/3556-2115-0x00007FF75D5B0000-0x00007FF75D904000-memory.dmp

Filesize
3.3MB

Download
memory/3556-2120-0x00007FF75D5B0000-0x00007FF75D904000-memory.dmp

Filesize
3.3MB

Download
memory/3680-2119-0x00007FF790A00000-0x00007FF790D54000-memory.dmp

Filesize
3.3MB

Download
memory/3680-728-0x00007FF790A00000-0x00007FF790D54000-memory.dmp

Filesize
3.3MB

Download
memory/3736-767-0x00007FF6E9370000-0x00007FF6E96C4000-memory.dmp

Filesize
3.3MB

Download
memory/3736-2136-0x00007FF6E9370000-0x00007FF6E96C4000-memory.dmp

Filesize
3.3MB

Download
memory/3944-2140-0x00007FF686830000-0x00007FF686B84000-memory.dmp

Filesize
3.3MB

Download
memory/3944-787-0x00007FF686830000-0x00007FF686B84000-memory.dmp

Filesize
3.3MB

Download
memory/4048-0-0x00007FF632950000-0x00007FF632CA4000-memory.dmp

Filesize
3.3MB

Download
memory/4048-1-0x000001EF29F90000-0x000001EF29FA0000-memory.dmp

Filesize
64KB

Download
memory/4048-2114-0x00007FF632950000-0x00007FF632CA4000-memory.dmp

Filesize
3.3MB

Download
memory/4084-2130-0x00007FF6DF430000-0x00007FF6DF784000-memory.dmp

Filesize
3.3MB

Download
memory/4084-744-0x00007FF6DF430000-0x00007FF6DF784000-memory.dmp

Filesize
3.3MB

Download
memory/4132-2129-0x00007FF620560000-0x00007FF6208B4000-memory.dmp

Filesize
3.3MB

Download
memory/4132-730-0x00007FF620560000-0x00007FF6208B4000-memory.dmp

Filesize
3.3MB

Download
memory/4284-2142-0x00007FF79B2A0000-0x00007FF79B5F4000-memory.dmp

Filesize
3.3MB

Download
memory/4284-798-0x00007FF79B2A0000-0x00007FF79B5F4000-memory.dmp

Filesize
3.3MB

Download
memory/4532-796-0x00007FF63EF40000-0x00007FF63F294000-memory.dmp

Filesize
3.3MB

Download
memory/4532-2143-0x00007FF63EF40000-0x00007FF63F294000-memory.dmp

Filesize
3.3MB

Download
memory/4552-764-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp

Filesize
3.3MB

Download
memory/4552-2137-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp

Filesize
3.3MB

Download
memory/4572-784-0x00007FF626720000-0x00007FF626A74000-memory.dmp

Filesize
3.3MB

Download
memory/4572-2134-0x00007FF626720000-0x00007FF626A74000-memory.dmp

Filesize
3.3MB

Download
memory/4652-2144-0x00007FF639AC0000-0x00007FF639E14000-memory.dmp

Filesize
3.3MB

Download
memory/4652-794-0x00007FF639AC0000-0x00007FF639E14000-memory.dmp

Filesize
3.3MB

Download
memory/4704-2122-0x00007FF7CA4B0000-0x00007FF7CA804000-memory.dmp

Filesize
3.3MB

Download
memory/4704-729-0x00007FF7CA4B0000-0x00007FF7CA804000-memory.dmp

Filesize
3.3MB

Download
memory/5028-777-0x00007FF62A5A0000-0x00007FF62A8F4000-memory.dmp

Filesize
3.3MB

Download
memory/5028-2146-0x00007FF62A5A0000-0x00007FF62A8F4000-memory.dmp

Filesize
3.3MB

Download