xmrig | 99949d4fadd8069b62fc2e9fd7af940ac5fe464d3b7f7739cb530ca33a0ae136

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
Size

2.1MB
MD5

0e91651f1cf422587aec6951d40a1260
SHA1

4092a074d301141498e7e248875735d1d90677f9
SHA256

99949d4fadd8069b62fc2e9fd7af940ac5fe464d3b7f7739cb530ca33a0ae136
SHA512

a956d890c35c8c75c97f1dc46471329b50c6cdbe48f8b95d793f44743bff4fcaac714ddefac01c57f5df0ba234face0e58c75b01b4c8adc5122a6c4189eae14d
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQwNGyXGVfF:BemTLkNdfE0pZrQb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/412-0-0x00007FF7CA2E0000-0x00007FF7CA634000-memory.dmp	xmrig
behavioral2/files/0x000800000002323c-4.dat	xmrig
behavioral2/memory/4940-8-0x00007FF63C4A0000-0x00007FF63C7F4000-memory.dmp	xmrig
behavioral2/files/0x000800000002323f-10.dat	xmrig
behavioral2/memory/4428-14-0x00007FF6EAB80000-0x00007FF6EAED4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023240-11.dat	xmrig
behavioral2/files/0x0008000000023243-22.dat	xmrig
behavioral2/memory/1096-26-0x00007FF6A8D40000-0x00007FF6A9094000-memory.dmp	xmrig
behavioral2/files/0x0008000000023244-28.dat	xmrig
behavioral2/memory/4452-30-0x00007FF6D5B20000-0x00007FF6D5E74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023245-35.dat	xmrig
behavioral2/files/0x0007000000023246-39.dat	xmrig
behavioral2/files/0x0007000000023247-43.dat	xmrig
behavioral2/files/0x0007000000023248-47.dat	xmrig
behavioral2/files/0x0007000000023249-51.dat	xmrig
behavioral2/memory/3768-23-0x00007FF6658F0000-0x00007FF665C44000-memory.dmp	xmrig
behavioral2/files/0x000700000002324a-55.dat	xmrig
behavioral2/files/0x000700000002324b-59.dat	xmrig
behavioral2/files/0x000700000002324c-63.dat	xmrig
behavioral2/files/0x000700000002324e-71.dat	xmrig
behavioral2/files/0x000700000002324f-75.dat	xmrig
behavioral2/files/0x0007000000023250-79.dat	xmrig
behavioral2/files/0x0007000000023251-83.dat	xmrig
behavioral2/files/0x0007000000023252-86.dat	xmrig
behavioral2/files/0x0007000000023253-91.dat	xmrig
behavioral2/files/0x0007000000023254-95.dat	xmrig
behavioral2/files/0x0007000000023255-99.dat	xmrig
behavioral2/files/0x0007000000023256-103.dat	xmrig
behavioral2/files/0x0007000000023257-107.dat	xmrig
behavioral2/files/0x000700000002325a-119.dat	xmrig
behavioral2/files/0x000700000002325c-127.dat	xmrig
behavioral2/files/0x000700000002325d-131.dat	xmrig
behavioral2/files/0x000700000002325f-139.dat	xmrig
behavioral2/files/0x000700000002325e-135.dat	xmrig
behavioral2/files/0x000700000002325b-126.dat	xmrig
behavioral2/files/0x0007000000023259-117.dat	xmrig
behavioral2/files/0x0007000000023258-111.dat	xmrig
behavioral2/files/0x000700000002324d-67.dat	xmrig
behavioral2/memory/4168-249-0x00007FF6BBA90000-0x00007FF6BBDE4000-memory.dmp	xmrig
behavioral2/memory/3876-252-0x00007FF6CE830000-0x00007FF6CEB84000-memory.dmp	xmrig
behavioral2/memory/2444-256-0x00007FF7C0590000-0x00007FF7C08E4000-memory.dmp	xmrig
behavioral2/memory/1224-258-0x00007FF67CA10000-0x00007FF67CD64000-memory.dmp	xmrig
behavioral2/memory/760-266-0x00007FF6F9530000-0x00007FF6F9884000-memory.dmp	xmrig
behavioral2/memory/512-265-0x00007FF6C8E50000-0x00007FF6C91A4000-memory.dmp	xmrig
behavioral2/memory/396-267-0x00007FF7A6090000-0x00007FF7A63E4000-memory.dmp	xmrig
behavioral2/memory/4176-268-0x00007FF6086B0000-0x00007FF608A04000-memory.dmp	xmrig
behavioral2/memory/4956-272-0x00007FF7B8210000-0x00007FF7B8564000-memory.dmp	xmrig
behavioral2/memory/868-275-0x00007FF777BC0000-0x00007FF777F14000-memory.dmp	xmrig
behavioral2/memory/4764-277-0x00007FF694BC0000-0x00007FF694F14000-memory.dmp	xmrig
behavioral2/memory/628-279-0x00007FF71BAF0000-0x00007FF71BE44000-memory.dmp	xmrig
behavioral2/memory/3552-285-0x00007FF77EE90000-0x00007FF77F1E4000-memory.dmp	xmrig
behavioral2/memory/3844-287-0x00007FF7B37B0000-0x00007FF7B3B04000-memory.dmp	xmrig
behavioral2/memory/4444-289-0x00007FF7A6FE0000-0x00007FF7A7334000-memory.dmp	xmrig
behavioral2/memory/3524-294-0x00007FF629860000-0x00007FF629BB4000-memory.dmp	xmrig
behavioral2/memory/4852-293-0x00007FF7B95C0000-0x00007FF7B9914000-memory.dmp	xmrig
behavioral2/memory/4192-291-0x00007FF7D0930000-0x00007FF7D0C84000-memory.dmp	xmrig
behavioral2/memory/4560-286-0x00007FF63A990000-0x00007FF63ACE4000-memory.dmp	xmrig
behavioral2/memory/4904-284-0x00007FF721A00000-0x00007FF721D54000-memory.dmp	xmrig
behavioral2/memory/2516-312-0x00007FF7AC730000-0x00007FF7ACA84000-memory.dmp	xmrig
behavioral2/memory/2688-309-0x00007FF6A20F0000-0x00007FF6A2444000-memory.dmp	xmrig
behavioral2/memory/2072-308-0x00007FF759460000-0x00007FF7597B4000-memory.dmp	xmrig
behavioral2/memory/1856-307-0x00007FF7F3580000-0x00007FF7F38D4000-memory.dmp	xmrig
behavioral2/memory/4940-1835-0x00007FF63C4A0000-0x00007FF63C7F4000-memory.dmp	xmrig
behavioral2/memory/1096-1952-0x00007FF6A8D40000-0x00007FF6A9094000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4940	Qwyobqi.exe
4428	WlKVBHu.exe
3768	eOPrwpv.exe
1096	RtKjSYE.exe
4452	QJucydj.exe
4168	YviHRYU.exe
3876	lUuuIIf.exe
2444	wPCFRcH.exe
1224	kjQBnrA.exe
512	OxMAWUC.exe
760	PljdpHX.exe
396	GYnKaEo.exe
4176	WLgmFpL.exe
4956	MbmaEhc.exe
868	jGUlTEs.exe
4764	qNfztIc.exe
628	jAllFZQ.exe
4904	SUknaRA.exe
3552	jdKYCLv.exe
4560	fiPAWXv.exe
3844	EKtapZI.exe
4444	FansCIk.exe
4192	ywZeiYQ.exe
4852	rkMFGth.exe
3524	JglZdui.exe
1856	akXYsBM.exe
2072	umVxtvY.exe
2688	Dbncspx.exe
2516	UpzVrwd.exe
4840	ExBKNfZ.exe
4776	GzOZnkW.exe
3428	PmoRQtj.exe
2692	KvwCXzs.exe
3616	raoKrDh.exe
4864	YZNyhBD.exe
4592	BFukqjn.exe
3276	fykkNeS.exe
452	vfxYHio.exe
2728	WKkqtin.exe
1712	koWReSt.exe
532	WUIDcEu.exe
4360	QPzgYYV.exe
3132	iPCYVMo.exe
1656	VNfYaGn.exe
3016	wcCqmNt.exe
4976	LGnDbMc.exe
4500	nUnLDAb.exe
1868	MjFETuw.exe
4672	QUxqGnD.exe
2036	NifkCqu.exe
3036	shawCSx.exe
1212	zzyEgwD.exe
2848	zREcWMn.exe
1108	QrzrCHR.exe
764	fpGSXiy.exe
3688	sGGhKwA.exe
2080	GOiJOIU.exe
3572	IDxRqGF.exe
2304	ZmkdlJA.exe
3476	QFPVcpR.exe
2592	zfSuFGc.exe
1604	THgsmRD.exe
4784	FFbBkJG.exe
3196	aKnhrXz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/412-0-0x00007FF7CA2E0000-0x00007FF7CA634000-memory.dmp	upx
behavioral2/files/0x000800000002323c-4.dat	upx
behavioral2/memory/4940-8-0x00007FF63C4A0000-0x00007FF63C7F4000-memory.dmp	upx
behavioral2/files/0x000800000002323f-10.dat	upx
behavioral2/memory/4428-14-0x00007FF6EAB80000-0x00007FF6EAED4000-memory.dmp	upx
behavioral2/files/0x0008000000023240-11.dat	upx
behavioral2/files/0x0008000000023243-22.dat	upx
behavioral2/memory/1096-26-0x00007FF6A8D40000-0x00007FF6A9094000-memory.dmp	upx
behavioral2/files/0x0008000000023244-28.dat	upx
behavioral2/memory/4452-30-0x00007FF6D5B20000-0x00007FF6D5E74000-memory.dmp	upx
behavioral2/files/0x0007000000023245-35.dat	upx
behavioral2/files/0x0007000000023246-39.dat	upx
behavioral2/files/0x0007000000023247-43.dat	upx
behavioral2/files/0x0007000000023248-47.dat	upx
behavioral2/files/0x0007000000023249-51.dat	upx
behavioral2/memory/3768-23-0x00007FF6658F0000-0x00007FF665C44000-memory.dmp	upx
behavioral2/files/0x000700000002324a-55.dat	upx
behavioral2/files/0x000700000002324b-59.dat	upx
behavioral2/files/0x000700000002324c-63.dat	upx
behavioral2/files/0x000700000002324e-71.dat	upx
behavioral2/files/0x000700000002324f-75.dat	upx
behavioral2/files/0x0007000000023250-79.dat	upx
behavioral2/files/0x0007000000023251-83.dat	upx
behavioral2/files/0x0007000000023252-86.dat	upx
behavioral2/files/0x0007000000023253-91.dat	upx
behavioral2/files/0x0007000000023254-95.dat	upx
behavioral2/files/0x0007000000023255-99.dat	upx
behavioral2/files/0x0007000000023256-103.dat	upx
behavioral2/files/0x0007000000023257-107.dat	upx
behavioral2/files/0x000700000002325a-119.dat	upx
behavioral2/files/0x000700000002325c-127.dat	upx
behavioral2/files/0x000700000002325d-131.dat	upx
behavioral2/files/0x000700000002325f-139.dat	upx
behavioral2/files/0x000700000002325e-135.dat	upx
behavioral2/files/0x000700000002325b-126.dat	upx
behavioral2/files/0x0007000000023259-117.dat	upx
behavioral2/files/0x0007000000023258-111.dat	upx
behavioral2/files/0x000700000002324d-67.dat	upx
behavioral2/memory/4168-249-0x00007FF6BBA90000-0x00007FF6BBDE4000-memory.dmp	upx
behavioral2/memory/3876-252-0x00007FF6CE830000-0x00007FF6CEB84000-memory.dmp	upx
behavioral2/memory/2444-256-0x00007FF7C0590000-0x00007FF7C08E4000-memory.dmp	upx
behavioral2/memory/1224-258-0x00007FF67CA10000-0x00007FF67CD64000-memory.dmp	upx
behavioral2/memory/760-266-0x00007FF6F9530000-0x00007FF6F9884000-memory.dmp	upx
behavioral2/memory/512-265-0x00007FF6C8E50000-0x00007FF6C91A4000-memory.dmp	upx
behavioral2/memory/396-267-0x00007FF7A6090000-0x00007FF7A63E4000-memory.dmp	upx
behavioral2/memory/4176-268-0x00007FF6086B0000-0x00007FF608A04000-memory.dmp	upx
behavioral2/memory/4956-272-0x00007FF7B8210000-0x00007FF7B8564000-memory.dmp	upx
behavioral2/memory/868-275-0x00007FF777BC0000-0x00007FF777F14000-memory.dmp	upx
behavioral2/memory/4764-277-0x00007FF694BC0000-0x00007FF694F14000-memory.dmp	upx
behavioral2/memory/628-279-0x00007FF71BAF0000-0x00007FF71BE44000-memory.dmp	upx
behavioral2/memory/3552-285-0x00007FF77EE90000-0x00007FF77F1E4000-memory.dmp	upx
behavioral2/memory/3844-287-0x00007FF7B37B0000-0x00007FF7B3B04000-memory.dmp	upx
behavioral2/memory/4444-289-0x00007FF7A6FE0000-0x00007FF7A7334000-memory.dmp	upx
behavioral2/memory/3524-294-0x00007FF629860000-0x00007FF629BB4000-memory.dmp	upx
behavioral2/memory/4852-293-0x00007FF7B95C0000-0x00007FF7B9914000-memory.dmp	upx
behavioral2/memory/4192-291-0x00007FF7D0930000-0x00007FF7D0C84000-memory.dmp	upx
behavioral2/memory/4560-286-0x00007FF63A990000-0x00007FF63ACE4000-memory.dmp	upx
behavioral2/memory/4904-284-0x00007FF721A00000-0x00007FF721D54000-memory.dmp	upx
behavioral2/memory/2516-312-0x00007FF7AC730000-0x00007FF7ACA84000-memory.dmp	upx
behavioral2/memory/2688-309-0x00007FF6A20F0000-0x00007FF6A2444000-memory.dmp	upx
behavioral2/memory/2072-308-0x00007FF759460000-0x00007FF7597B4000-memory.dmp	upx
behavioral2/memory/1856-307-0x00007FF7F3580000-0x00007FF7F38D4000-memory.dmp	upx
behavioral2/memory/4940-1835-0x00007FF63C4A0000-0x00007FF63C7F4000-memory.dmp	upx
behavioral2/memory/1096-1952-0x00007FF6A8D40000-0x00007FF6A9094000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LzTkqTO.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\pugTPJl.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\tlDGAtJ.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\ciySoEj.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\pgLlPoT.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\vTDdjqM.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\PJRczLV.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\mDcFvHd.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\vMNbpJy.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\HMPrQTn.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\ydfTUfT.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\aAnkiEI.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\YZNyhBD.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\mgotzSg.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\wKgGHBr.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\HHgOLbO.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\DRARFmg.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\kWiqwZf.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\mbKtuYH.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\HUamccS.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\eianXhp.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\lnuLJMr.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\MiOLbSn.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\VzqIKFE.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\umVxtvY.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\xLmpjFX.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\QDNTcZk.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\WAFdUrE.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\fVKtlMR.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\GYnKaEo.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\VZTxYwx.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\MYIewBz.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\XfETCzY.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\gWlKbmd.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\DhzKhmy.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\KnKfgWb.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\pvgFnLT.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\rLjJyIn.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\CeKVpzl.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\bMwQCsQ.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\nHdsQhB.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\jAllFZQ.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\slAIAtm.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\wkfiiwt.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\yRuaeqZ.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\ZtVbZwV.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\HjYLRla.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\ucJuKLH.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\kbRmOno.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\oAxFKvm.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\vsQImBA.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\qyXqNXu.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\LgjKdHk.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\AKXEDtl.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\lWxRWxS.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\KXKoFWt.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\wzbwdnC.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\JglZdui.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\AZjOkFj.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\UZHhEul.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\iJjOmmV.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\bwYFmhO.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\kvLxqzb.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
File created	C:\Windows\System\oJFmErM.exe	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 4940	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	93
PID 412 wrote to memory of 4940	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	93
PID 412 wrote to memory of 4428	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	94
PID 412 wrote to memory of 4428	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	94
PID 412 wrote to memory of 3768	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	95
PID 412 wrote to memory of 3768	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	95
PID 412 wrote to memory of 1096	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	96
PID 412 wrote to memory of 1096	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	96
PID 412 wrote to memory of 4452	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	97
PID 412 wrote to memory of 4452	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	97
PID 412 wrote to memory of 4168	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	98
PID 412 wrote to memory of 4168	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	98
PID 412 wrote to memory of 3876	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	99
PID 412 wrote to memory of 3876	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	99
PID 412 wrote to memory of 2444	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	100
PID 412 wrote to memory of 2444	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	100
PID 412 wrote to memory of 1224	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	101
PID 412 wrote to memory of 1224	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	101
PID 412 wrote to memory of 512	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	102
PID 412 wrote to memory of 512	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	102
PID 412 wrote to memory of 760	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	103
PID 412 wrote to memory of 760	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	103
PID 412 wrote to memory of 396	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	104
PID 412 wrote to memory of 396	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	104
PID 412 wrote to memory of 4176	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	105
PID 412 wrote to memory of 4176	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	105
PID 412 wrote to memory of 4956	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	106
PID 412 wrote to memory of 4956	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	106
PID 412 wrote to memory of 868	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	107
PID 412 wrote to memory of 868	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	107
PID 412 wrote to memory of 4764	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	108
PID 412 wrote to memory of 4764	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	108
PID 412 wrote to memory of 628	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	109
PID 412 wrote to memory of 628	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	109
PID 412 wrote to memory of 4904	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	110
PID 412 wrote to memory of 4904	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	110
PID 412 wrote to memory of 3552	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	111
PID 412 wrote to memory of 3552	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	111
PID 412 wrote to memory of 4560	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	112
PID 412 wrote to memory of 4560	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	112
PID 412 wrote to memory of 3844	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	113
PID 412 wrote to memory of 3844	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	113
PID 412 wrote to memory of 4444	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	114
PID 412 wrote to memory of 4444	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	114
PID 412 wrote to memory of 4192	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	115
PID 412 wrote to memory of 4192	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	115
PID 412 wrote to memory of 4852	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	116
PID 412 wrote to memory of 4852	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	116
PID 412 wrote to memory of 3524	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	117
PID 412 wrote to memory of 3524	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	117
PID 412 wrote to memory of 1856	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	118
PID 412 wrote to memory of 1856	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	118
PID 412 wrote to memory of 2072	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	119
PID 412 wrote to memory of 2072	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	119
PID 412 wrote to memory of 2688	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	120
PID 412 wrote to memory of 2688	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	120
PID 412 wrote to memory of 2516	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	121
PID 412 wrote to memory of 2516	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	121
PID 412 wrote to memory of 4840	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	122
PID 412 wrote to memory of 4840	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	122
PID 412 wrote to memory of 4776	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	123
PID 412 wrote to memory of 4776	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	123
PID 412 wrote to memory of 3428	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	124
PID 412 wrote to memory of 3428	412	0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e91651f1cf422587aec6951d40a1260_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\System\Qwyobqi.exe
  C:\Windows\System\Qwyobqi.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\WlKVBHu.exe
  C:\Windows\System\WlKVBHu.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\eOPrwpv.exe
  C:\Windows\System\eOPrwpv.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\RtKjSYE.exe
  C:\Windows\System\RtKjSYE.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\QJucydj.exe
  C:\Windows\System\QJucydj.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\YviHRYU.exe
  C:\Windows\System\YviHRYU.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\lUuuIIf.exe
  C:\Windows\System\lUuuIIf.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\wPCFRcH.exe
  C:\Windows\System\wPCFRcH.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\kjQBnrA.exe
  C:\Windows\System\kjQBnrA.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\OxMAWUC.exe
  C:\Windows\System\OxMAWUC.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\PljdpHX.exe
  C:\Windows\System\PljdpHX.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\GYnKaEo.exe
  C:\Windows\System\GYnKaEo.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\WLgmFpL.exe
  C:\Windows\System\WLgmFpL.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\MbmaEhc.exe
  C:\Windows\System\MbmaEhc.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\jGUlTEs.exe
  C:\Windows\System\jGUlTEs.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\qNfztIc.exe
  C:\Windows\System\qNfztIc.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\jAllFZQ.exe
  C:\Windows\System\jAllFZQ.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\SUknaRA.exe
  C:\Windows\System\SUknaRA.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\jdKYCLv.exe
  C:\Windows\System\jdKYCLv.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\fiPAWXv.exe
  C:\Windows\System\fiPAWXv.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\EKtapZI.exe
  C:\Windows\System\EKtapZI.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\FansCIk.exe
  C:\Windows\System\FansCIk.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\ywZeiYQ.exe
  C:\Windows\System\ywZeiYQ.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\rkMFGth.exe
  C:\Windows\System\rkMFGth.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\JglZdui.exe
  C:\Windows\System\JglZdui.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\akXYsBM.exe
  C:\Windows\System\akXYsBM.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\umVxtvY.exe
  C:\Windows\System\umVxtvY.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\Dbncspx.exe
  C:\Windows\System\Dbncspx.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\UpzVrwd.exe
  C:\Windows\System\UpzVrwd.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\ExBKNfZ.exe
  C:\Windows\System\ExBKNfZ.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\GzOZnkW.exe
  C:\Windows\System\GzOZnkW.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\PmoRQtj.exe
  C:\Windows\System\PmoRQtj.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\KvwCXzs.exe
  C:\Windows\System\KvwCXzs.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\raoKrDh.exe
  C:\Windows\System\raoKrDh.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\YZNyhBD.exe
  C:\Windows\System\YZNyhBD.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\BFukqjn.exe
  C:\Windows\System\BFukqjn.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\fykkNeS.exe
  C:\Windows\System\fykkNeS.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\vfxYHio.exe
  C:\Windows\System\vfxYHio.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\WKkqtin.exe
  C:\Windows\System\WKkqtin.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\koWReSt.exe
  C:\Windows\System\koWReSt.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\WUIDcEu.exe
  C:\Windows\System\WUIDcEu.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\QPzgYYV.exe
  C:\Windows\System\QPzgYYV.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\iPCYVMo.exe
  C:\Windows\System\iPCYVMo.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\VNfYaGn.exe
  C:\Windows\System\VNfYaGn.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\wcCqmNt.exe
  C:\Windows\System\wcCqmNt.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\LGnDbMc.exe
  C:\Windows\System\LGnDbMc.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\nUnLDAb.exe
  C:\Windows\System\nUnLDAb.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\MjFETuw.exe
  C:\Windows\System\MjFETuw.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\QUxqGnD.exe
  C:\Windows\System\QUxqGnD.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\NifkCqu.exe
  C:\Windows\System\NifkCqu.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\shawCSx.exe
  C:\Windows\System\shawCSx.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\zzyEgwD.exe
  C:\Windows\System\zzyEgwD.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\zREcWMn.exe
  C:\Windows\System\zREcWMn.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\QrzrCHR.exe
  C:\Windows\System\QrzrCHR.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\fpGSXiy.exe
  C:\Windows\System\fpGSXiy.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\sGGhKwA.exe
  C:\Windows\System\sGGhKwA.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\GOiJOIU.exe
  C:\Windows\System\GOiJOIU.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\IDxRqGF.exe
  C:\Windows\System\IDxRqGF.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\ZmkdlJA.exe
  C:\Windows\System\ZmkdlJA.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\QFPVcpR.exe
  C:\Windows\System\QFPVcpR.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\zfSuFGc.exe
  C:\Windows\System\zfSuFGc.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\THgsmRD.exe
  C:\Windows\System\THgsmRD.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\FFbBkJG.exe
  C:\Windows\System\FFbBkJG.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\aKnhrXz.exe
  C:\Windows\System\aKnhrXz.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\BhymGLt.exe
  C:\Windows\System\BhymGLt.exe
  2⤵
  PID:3436
- C:\Windows\System\DvSJymp.exe
  C:\Windows\System\DvSJymp.exe
  2⤵
  PID:8
- C:\Windows\System\effKzdJ.exe
  C:\Windows\System\effKzdJ.exe
  2⤵
  PID:1076
- C:\Windows\System\pLbKNtg.exe
  C:\Windows\System\pLbKNtg.exe
  2⤵
  PID:4384
- C:\Windows\System\MkltMtW.exe
  C:\Windows\System\MkltMtW.exe
  2⤵
  PID:1364
- C:\Windows\System\iVPyMXX.exe
  C:\Windows\System\iVPyMXX.exe
  2⤵
  PID:2676
- C:\Windows\System\uVNuzaW.exe
  C:\Windows\System\uVNuzaW.exe
  2⤵
  PID:1972
- C:\Windows\System\OWkdrib.exe
  C:\Windows\System\OWkdrib.exe
  2⤵
  PID:2716
- C:\Windows\System\CRPjmoJ.exe
  C:\Windows\System\CRPjmoJ.exe
  2⤵
  PID:4476
- C:\Windows\System\HUamccS.exe
  C:\Windows\System\HUamccS.exe
  2⤵
  PID:1004
- C:\Windows\System\XjMoFry.exe
  C:\Windows\System\XjMoFry.exe
  2⤵
  PID:3792
- C:\Windows\System\kgOXobF.exe
  C:\Windows\System\kgOXobF.exe
  2⤵
  PID:4084
- C:\Windows\System\QvXBXBV.exe
  C:\Windows\System\QvXBXBV.exe
  2⤵
  PID:4068
- C:\Windows\System\QtJMzzE.exe
  C:\Windows\System\QtJMzzE.exe
  2⤵
  PID:4300
- C:\Windows\System\slAIAtm.exe
  C:\Windows\System\slAIAtm.exe
  2⤵
  PID:4680
- C:\Windows\System\qFgljtj.exe
  C:\Windows\System\qFgljtj.exe
  2⤵
  PID:5108
- C:\Windows\System\AZjOkFj.exe
  C:\Windows\System\AZjOkFj.exe
  2⤵
  PID:3204
- C:\Windows\System\IGsiZUx.exe
  C:\Windows\System\IGsiZUx.exe
  2⤵
  PID:2368
- C:\Windows\System\yPIJGKC.exe
  C:\Windows\System\yPIJGKC.exe
  2⤵
  PID:5148
- C:\Windows\System\ChUrTuZ.exe
  C:\Windows\System\ChUrTuZ.exe
  2⤵
  PID:5176
- C:\Windows\System\LkohFQF.exe
  C:\Windows\System\LkohFQF.exe
  2⤵
  PID:5204
- C:\Windows\System\hMpxqaH.exe
  C:\Windows\System\hMpxqaH.exe
  2⤵
  PID:5228
- C:\Windows\System\llnutnM.exe
  C:\Windows\System\llnutnM.exe
  2⤵
  PID:5248
- C:\Windows\System\hnaAcLI.exe
  C:\Windows\System\hnaAcLI.exe
  2⤵
  PID:5284
- C:\Windows\System\PeXulYk.exe
  C:\Windows\System\PeXulYk.exe
  2⤵
  PID:5308
- C:\Windows\System\gLdGhSb.exe
  C:\Windows\System\gLdGhSb.exe
  2⤵
  PID:5332
- C:\Windows\System\AxnIEfv.exe
  C:\Windows\System\AxnIEfv.exe
  2⤵
  PID:5368
- C:\Windows\System\bHJQAtw.exe
  C:\Windows\System\bHJQAtw.exe
  2⤵
  PID:5392
- C:\Windows\System\TSPYDpK.exe
  C:\Windows\System\TSPYDpK.exe
  2⤵
  PID:5416
- C:\Windows\System\uzDrQSm.exe
  C:\Windows\System\uzDrQSm.exe
  2⤵
  PID:5452
- C:\Windows\System\NVAToFN.exe
  C:\Windows\System\NVAToFN.exe
  2⤵
  PID:5468
- C:\Windows\System\mgotzSg.exe
  C:\Windows\System\mgotzSg.exe
  2⤵
  PID:5496
- C:\Windows\System\kBBDAld.exe
  C:\Windows\System\kBBDAld.exe
  2⤵
  PID:5524
- C:\Windows\System\bSCGHJX.exe
  C:\Windows\System\bSCGHJX.exe
  2⤵
  PID:5544
- C:\Windows\System\PzQlvJp.exe
  C:\Windows\System\PzQlvJp.exe
  2⤵
  PID:5564
- C:\Windows\System\uElqzuS.exe
  C:\Windows\System\uElqzuS.exe
  2⤵
  PID:5600
- C:\Windows\System\bhIzYmm.exe
  C:\Windows\System\bhIzYmm.exe
  2⤵
  PID:5624
- C:\Windows\System\ymvGdqa.exe
  C:\Windows\System\ymvGdqa.exe
  2⤵
  PID:5656
- C:\Windows\System\CxGAEkm.exe
  C:\Windows\System\CxGAEkm.exe
  2⤵
  PID:5680
- C:\Windows\System\UZHhEul.exe
  C:\Windows\System\UZHhEul.exe
  2⤵
  PID:5744
- C:\Windows\System\IRrKMZj.exe
  C:\Windows\System\IRrKMZj.exe
  2⤵
  PID:5764
- C:\Windows\System\ZgRAXEi.exe
  C:\Windows\System\ZgRAXEi.exe
  2⤵
  PID:5780
- C:\Windows\System\SNgRWYs.exe
  C:\Windows\System\SNgRWYs.exe
  2⤵
  PID:5796
- C:\Windows\System\SoOiBZS.exe
  C:\Windows\System\SoOiBZS.exe
  2⤵
  PID:5824
- C:\Windows\System\wKgGHBr.exe
  C:\Windows\System\wKgGHBr.exe
  2⤵
  PID:5884
- C:\Windows\System\SbdKiug.exe
  C:\Windows\System\SbdKiug.exe
  2⤵
  PID:5904
- C:\Windows\System\FbUduXo.exe
  C:\Windows\System\FbUduXo.exe
  2⤵
  PID:5928
- C:\Windows\System\bOPlplw.exe
  C:\Windows\System\bOPlplw.exe
  2⤵
  PID:5960
- C:\Windows\System\LWpdrdZ.exe
  C:\Windows\System\LWpdrdZ.exe
  2⤵
  PID:5976
- C:\Windows\System\EaCjgoo.exe
  C:\Windows\System\EaCjgoo.exe
  2⤵
  PID:6020
- C:\Windows\System\ZRvBJUU.exe
  C:\Windows\System\ZRvBJUU.exe
  2⤵
  PID:6044
- C:\Windows\System\sQYHXUh.exe
  C:\Windows\System\sQYHXUh.exe
  2⤵
  PID:6072
- C:\Windows\System\KPnVjQx.exe
  C:\Windows\System\KPnVjQx.exe
  2⤵
  PID:6104
- C:\Windows\System\dtHQXPC.exe
  C:\Windows\System\dtHQXPC.exe
  2⤵
  PID:6140
- C:\Windows\System\tEDkHwu.exe
  C:\Windows\System\tEDkHwu.exe
  2⤵
  PID:5160
- C:\Windows\System\pHqBmBO.exe
  C:\Windows\System\pHqBmBO.exe
  2⤵
  PID:5216
- C:\Windows\System\DLTwqKC.exe
  C:\Windows\System\DLTwqKC.exe
  2⤵
  PID:4688
- C:\Windows\System\aSwdVNe.exe
  C:\Windows\System\aSwdVNe.exe
  2⤵
  PID:5344
- C:\Windows\System\iJjOmmV.exe
  C:\Windows\System\iJjOmmV.exe
  2⤵
  PID:5408
- C:\Windows\System\EpEeXtg.exe
  C:\Windows\System\EpEeXtg.exe
  2⤵
  PID:5508
- C:\Windows\System\XFBhNqI.exe
  C:\Windows\System\XFBhNqI.exe
  2⤵
  PID:5560
- C:\Windows\System\lcdjtds.exe
  C:\Windows\System\lcdjtds.exe
  2⤵
  PID:5588
- C:\Windows\System\hkSuLfb.exe
  C:\Windows\System\hkSuLfb.exe
  2⤵
  PID:5772
- C:\Windows\System\wUEvzAB.exe
  C:\Windows\System\wUEvzAB.exe
  2⤵
  PID:5792
- C:\Windows\System\PkpShbB.exe
  C:\Windows\System\PkpShbB.exe
  2⤵
  PID:5788
- C:\Windows\System\RYeVJHv.exe
  C:\Windows\System\RYeVJHv.exe
  2⤵
  PID:5896
- C:\Windows\System\fukmYcK.exe
  C:\Windows\System\fukmYcK.exe
  2⤵
  PID:5952
- C:\Windows\System\Hbbrkie.exe
  C:\Windows\System\Hbbrkie.exe
  2⤵
  PID:6012
- C:\Windows\System\YPhaJqL.exe
  C:\Windows\System\YPhaJqL.exe
  2⤵
  PID:6132
- C:\Windows\System\TxvvQJr.exe
  C:\Windows\System\TxvvQJr.exe
  2⤵
  PID:5192
- C:\Windows\System\ZDnmaIp.exe
  C:\Windows\System\ZDnmaIp.exe
  2⤵
  PID:5352
- C:\Windows\System\QdTCQcq.exe
  C:\Windows\System\QdTCQcq.exe
  2⤵
  PID:5436
- C:\Windows\System\vMNbpJy.exe
  C:\Windows\System\vMNbpJy.exe
  2⤵
  PID:5516
- C:\Windows\System\spQRMFh.exe
  C:\Windows\System\spQRMFh.exe
  2⤵
  PID:5716
- C:\Windows\System\ndaITDQ.exe
  C:\Windows\System\ndaITDQ.exe
  2⤵
  PID:5808
- C:\Windows\System\AGJmHWc.exe
  C:\Windows\System\AGJmHWc.exe
  2⤵
  PID:6004
- C:\Windows\System\jjcxDIa.exe
  C:\Windows\System\jjcxDIa.exe
  2⤵
  PID:5488
- C:\Windows\System\WcnINdx.exe
  C:\Windows\System\WcnINdx.exe
  2⤵
  PID:5816
- C:\Windows\System\AuvlNdW.exe
  C:\Windows\System\AuvlNdW.exe
  2⤵
  PID:5992
- C:\Windows\System\JEOgutg.exe
  C:\Windows\System\JEOgutg.exe
  2⤵
  PID:5612
- C:\Windows\System\YnYtzWD.exe
  C:\Windows\System\YnYtzWD.exe
  2⤵
  PID:6156
- C:\Windows\System\tadRLNi.exe
  C:\Windows\System\tadRLNi.exe
  2⤵
  PID:6184
- C:\Windows\System\ForhUrZ.exe
  C:\Windows\System\ForhUrZ.exe
  2⤵
  PID:6208
- C:\Windows\System\QHsiooN.exe
  C:\Windows\System\QHsiooN.exe
  2⤵
  PID:6232
- C:\Windows\System\KuXVrsc.exe
  C:\Windows\System\KuXVrsc.exe
  2⤵
  PID:6260
- C:\Windows\System\LvrZiZH.exe
  C:\Windows\System\LvrZiZH.exe
  2⤵
  PID:6284
- C:\Windows\System\qjBppaV.exe
  C:\Windows\System\qjBppaV.exe
  2⤵
  PID:6308
- C:\Windows\System\DKdATWS.exe
  C:\Windows\System\DKdATWS.exe
  2⤵
  PID:6328
- C:\Windows\System\uubvlyL.exe
  C:\Windows\System\uubvlyL.exe
  2⤵
  PID:6352
- C:\Windows\System\PetFdJG.exe
  C:\Windows\System\PetFdJG.exe
  2⤵
  PID:6408
- C:\Windows\System\dMbEqhp.exe
  C:\Windows\System\dMbEqhp.exe
  2⤵
  PID:6428
- C:\Windows\System\eianXhp.exe
  C:\Windows\System\eianXhp.exe
  2⤵
  PID:6460
- C:\Windows\System\BFonyYK.exe
  C:\Windows\System\BFonyYK.exe
  2⤵
  PID:6496
- C:\Windows\System\ffDfghF.exe
  C:\Windows\System\ffDfghF.exe
  2⤵
  PID:6520
- C:\Windows\System\uVBHBRV.exe
  C:\Windows\System\uVBHBRV.exe
  2⤵
  PID:6548
- C:\Windows\System\QqWuQdz.exe
  C:\Windows\System\QqWuQdz.exe
  2⤵
  PID:6588
- C:\Windows\System\TFuvKTk.exe
  C:\Windows\System\TFuvKTk.exe
  2⤵
  PID:6620
- C:\Windows\System\eZFuRsV.exe
  C:\Windows\System\eZFuRsV.exe
  2⤵
  PID:6648
- C:\Windows\System\SdHJDem.exe
  C:\Windows\System\SdHJDem.exe
  2⤵
  PID:6676
- C:\Windows\System\ZcinIBa.exe
  C:\Windows\System\ZcinIBa.exe
  2⤵
  PID:6692
- C:\Windows\System\XvpOCUd.exe
  C:\Windows\System\XvpOCUd.exe
  2⤵
  PID:6720
- C:\Windows\System\kbRmOno.exe
  C:\Windows\System\kbRmOno.exe
  2⤵
  PID:6748
- C:\Windows\System\AKEIPZi.exe
  C:\Windows\System\AKEIPZi.exe
  2⤵
  PID:6776
- C:\Windows\System\YmwfkQH.exe
  C:\Windows\System\YmwfkQH.exe
  2⤵
  PID:6812
- C:\Windows\System\IrQoLBG.exe
  C:\Windows\System\IrQoLBG.exe
  2⤵
  PID:6836
- C:\Windows\System\nujdQPH.exe
  C:\Windows\System\nujdQPH.exe
  2⤵
  PID:6864
- C:\Windows\System\KTzDlBQ.exe
  C:\Windows\System\KTzDlBQ.exe
  2⤵
  PID:6892
- C:\Windows\System\FRHKjAB.exe
  C:\Windows\System\FRHKjAB.exe
  2⤵
  PID:6916
- C:\Windows\System\kMzfOaD.exe
  C:\Windows\System\kMzfOaD.exe
  2⤵
  PID:6944
- C:\Windows\System\fFKUcAO.exe
  C:\Windows\System\fFKUcAO.exe
  2⤵
  PID:6964
- C:\Windows\System\dFNtkli.exe
  C:\Windows\System\dFNtkli.exe
  2⤵
  PID:6996
- C:\Windows\System\LNSWqZP.exe
  C:\Windows\System\LNSWqZP.exe
  2⤵
  PID:7020
- C:\Windows\System\kNzoVzv.exe
  C:\Windows\System\kNzoVzv.exe
  2⤵
  PID:7052
- C:\Windows\System\kAxbRjc.exe
  C:\Windows\System\kAxbRjc.exe
  2⤵
  PID:7088
- C:\Windows\System\eNsmazG.exe
  C:\Windows\System\eNsmazG.exe
  2⤵
  PID:7120
- C:\Windows\System\OmikKJH.exe
  C:\Windows\System\OmikKJH.exe
  2⤵
  PID:7148
- C:\Windows\System\NQQDqpi.exe
  C:\Windows\System\NQQDqpi.exe
  2⤵
  PID:6152
- C:\Windows\System\ktqjxvR.exe
  C:\Windows\System\ktqjxvR.exe
  2⤵
  PID:6200
- C:\Windows\System\hqAIfPY.exe
  C:\Windows\System\hqAIfPY.exe
  2⤵
  PID:6244
- C:\Windows\System\FwspFnH.exe
  C:\Windows\System\FwspFnH.exe
  2⤵
  PID:6340
- C:\Windows\System\dCUGSfu.exe
  C:\Windows\System\dCUGSfu.exe
  2⤵
  PID:6452
- C:\Windows\System\NgsWdkv.exe
  C:\Windows\System\NgsWdkv.exe
  2⤵
  PID:6492
- C:\Windows\System\PIvUUFM.exe
  C:\Windows\System\PIvUUFM.exe
  2⤵
  PID:6536
- C:\Windows\System\NGdmiFZ.exe
  C:\Windows\System\NGdmiFZ.exe
  2⤵
  PID:6584
- C:\Windows\System\bzIRurw.exe
  C:\Windows\System\bzIRurw.exe
  2⤵
  PID:6632
- C:\Windows\System\NfhsFcH.exe
  C:\Windows\System\NfhsFcH.exe
  2⤵
  PID:6688
- C:\Windows\System\bwYFmhO.exe
  C:\Windows\System\bwYFmhO.exe
  2⤵
  PID:6768
- C:\Windows\System\TOGuBky.exe
  C:\Windows\System\TOGuBky.exe
  2⤵
  PID:6804
- C:\Windows\System\IRoJhPK.exe
  C:\Windows\System\IRoJhPK.exe
  2⤵
  PID:6912
- C:\Windows\System\KkkeKVs.exe
  C:\Windows\System\KkkeKVs.exe
  2⤵
  PID:6956
- C:\Windows\System\ciySoEj.exe
  C:\Windows\System\ciySoEj.exe
  2⤵
  PID:7080
- C:\Windows\System\rkmQfGV.exe
  C:\Windows\System\rkmQfGV.exe
  2⤵
  PID:7140
- C:\Windows\System\ENDQLIQ.exe
  C:\Windows\System\ENDQLIQ.exe
  2⤵
  PID:6180
- C:\Windows\System\lbLjMTt.exe
  C:\Windows\System\lbLjMTt.exe
  2⤵
  PID:6400
- C:\Windows\System\uCRbFlu.exe
  C:\Windows\System\uCRbFlu.exe
  2⤵
  PID:6424
- C:\Windows\System\ewnTPFQ.exe
  C:\Windows\System\ewnTPFQ.exe
  2⤵
  PID:6556
- C:\Windows\System\HNCTgKx.exe
  C:\Windows\System\HNCTgKx.exe
  2⤵
  PID:6672
- C:\Windows\System\xrXcmMf.exe
  C:\Windows\System\xrXcmMf.exe
  2⤵
  PID:6876
- C:\Windows\System\TjeQfKJ.exe
  C:\Windows\System\TjeQfKJ.exe
  2⤵
  PID:6924
- C:\Windows\System\OhmghIU.exe
  C:\Windows\System\OhmghIU.exe
  2⤵
  PID:6272
- C:\Windows\System\BLKWCoW.exe
  C:\Windows\System\BLKWCoW.exe
  2⤵
  PID:5236
- C:\Windows\System\uZnnUXD.exe
  C:\Windows\System\uZnnUXD.exe
  2⤵
  PID:5324
- C:\Windows\System\hkhhRxD.exe
  C:\Windows\System\hkhhRxD.exe
  2⤵
  PID:7036
- C:\Windows\System\NPZnIyB.exe
  C:\Windows\System\NPZnIyB.exe
  2⤵
  PID:6344
- C:\Windows\System\jXVKTdN.exe
  C:\Windows\System\jXVKTdN.exe
  2⤵
  PID:7192
- C:\Windows\System\njWtyPy.exe
  C:\Windows\System\njWtyPy.exe
  2⤵
  PID:7216
- C:\Windows\System\QuvTwlS.exe
  C:\Windows\System\QuvTwlS.exe
  2⤵
  PID:7236
- C:\Windows\System\DhzKhmy.exe
  C:\Windows\System\DhzKhmy.exe
  2⤵
  PID:7256
- C:\Windows\System\JHERvSS.exe
  C:\Windows\System\JHERvSS.exe
  2⤵
  PID:7272
- C:\Windows\System\zEQYVbp.exe
  C:\Windows\System\zEQYVbp.exe
  2⤵
  PID:7292
- C:\Windows\System\eDBiOUL.exe
  C:\Windows\System\eDBiOUL.exe
  2⤵
  PID:7320
- C:\Windows\System\WlGdIjT.exe
  C:\Windows\System\WlGdIjT.exe
  2⤵
  PID:7348
- C:\Windows\System\kvLxqzb.exe
  C:\Windows\System\kvLxqzb.exe
  2⤵
  PID:7372
- C:\Windows\System\JYyUuOU.exe
  C:\Windows\System\JYyUuOU.exe
  2⤵
  PID:7396
- C:\Windows\System\yXLkhxK.exe
  C:\Windows\System\yXLkhxK.exe
  2⤵
  PID:7416
- C:\Windows\System\mpWgKgm.exe
  C:\Windows\System\mpWgKgm.exe
  2⤵
  PID:7556
- C:\Windows\System\LdufmcJ.exe
  C:\Windows\System\LdufmcJ.exe
  2⤵
  PID:7572
- C:\Windows\System\uwbigIA.exe
  C:\Windows\System\uwbigIA.exe
  2⤵
  PID:7588
- C:\Windows\System\lWxRWxS.exe
  C:\Windows\System\lWxRWxS.exe
  2⤵
  PID:7604
- C:\Windows\System\XPNgbpK.exe
  C:\Windows\System\XPNgbpK.exe
  2⤵
  PID:7668
- C:\Windows\System\xLmpjFX.exe
  C:\Windows\System\xLmpjFX.exe
  2⤵
  PID:7688
- C:\Windows\System\GziHVdh.exe
  C:\Windows\System\GziHVdh.exe
  2⤵
  PID:7716
- C:\Windows\System\xygyOtO.exe
  C:\Windows\System\xygyOtO.exe
  2⤵
  PID:7732
- C:\Windows\System\iPTylHj.exe
  C:\Windows\System\iPTylHj.exe
  2⤵
  PID:7752
- C:\Windows\System\rBPDVnH.exe
  C:\Windows\System\rBPDVnH.exe
  2⤵
  PID:7780
- C:\Windows\System\oJFmErM.exe
  C:\Windows\System\oJFmErM.exe
  2⤵
  PID:7812
- C:\Windows\System\oYGHGfo.exe
  C:\Windows\System\oYGHGfo.exe
  2⤵
  PID:7844
- C:\Windows\System\penMmrp.exe
  C:\Windows\System\penMmrp.exe
  2⤵
  PID:7868
- C:\Windows\System\CrZsWep.exe
  C:\Windows\System\CrZsWep.exe
  2⤵
  PID:7896
- C:\Windows\System\ELDyjTy.exe
  C:\Windows\System\ELDyjTy.exe
  2⤵
  PID:7920
- C:\Windows\System\TZLCKNP.exe
  C:\Windows\System\TZLCKNP.exe
  2⤵
  PID:7952
- C:\Windows\System\KbURxem.exe
  C:\Windows\System\KbURxem.exe
  2⤵
  PID:7972
- C:\Windows\System\ZpQAHVj.exe
  C:\Windows\System\ZpQAHVj.exe
  2⤵
  PID:7988
- C:\Windows\System\CYGYvWh.exe
  C:\Windows\System\CYGYvWh.exe
  2⤵
  PID:8012
- C:\Windows\System\kTNsTvR.exe
  C:\Windows\System\kTNsTvR.exe
  2⤵
  PID:8040
- C:\Windows\System\boywITC.exe
  C:\Windows\System\boywITC.exe
  2⤵
  PID:8060
- C:\Windows\System\XKRlSMj.exe
  C:\Windows\System\XKRlSMj.exe
  2⤵
  PID:8088
- C:\Windows\System\TfJPvZX.exe
  C:\Windows\System\TfJPvZX.exe
  2⤵
  PID:8120
- C:\Windows\System\DkrMNQy.exe
  C:\Windows\System\DkrMNQy.exe
  2⤵
  PID:8144
- C:\Windows\System\jlCgBpa.exe
  C:\Windows\System\jlCgBpa.exe
  2⤵
  PID:8164
- C:\Windows\System\EtBqvEi.exe
  C:\Windows\System\EtBqvEi.exe
  2⤵
  PID:6488
- C:\Windows\System\dzdNjHO.exe
  C:\Windows\System\dzdNjHO.exe
  2⤵
  PID:7180
- C:\Windows\System\ktcTwRO.exe
  C:\Windows\System\ktcTwRO.exe
  2⤵
  PID:7232
- C:\Windows\System\psPemSM.exe
  C:\Windows\System\psPemSM.exe
  2⤵
  PID:7268
- C:\Windows\System\yWDCjlX.exe
  C:\Windows\System\yWDCjlX.exe
  2⤵
  PID:7384
- C:\Windows\System\viJscmC.exe
  C:\Windows\System\viJscmC.exe
  2⤵
  PID:7452
- C:\Windows\System\FmQbliL.exe
  C:\Windows\System\FmQbliL.exe
  2⤵
  PID:7500
- C:\Windows\System\FYcxucL.exe
  C:\Windows\System\FYcxucL.exe
  2⤵
  PID:6880
- C:\Windows\System\oAxFKvm.exe
  C:\Windows\System\oAxFKvm.exe
  2⤵
  PID:7596
- C:\Windows\System\qPAYsuX.exe
  C:\Windows\System\qPAYsuX.exe
  2⤵
  PID:7640
- C:\Windows\System\XDmPpzl.exe
  C:\Windows\System\XDmPpzl.exe
  2⤵
  PID:7760
- C:\Windows\System\FvRWBdy.exe
  C:\Windows\System\FvRWBdy.exe
  2⤵
  PID:7804
- C:\Windows\System\zPmvNOY.exe
  C:\Windows\System\zPmvNOY.exe
  2⤵
  PID:7860
- C:\Windows\System\ABOnKlg.exe
  C:\Windows\System\ABOnKlg.exe
  2⤵
  PID:7944
- C:\Windows\System\NFlrtpj.exe
  C:\Windows\System\NFlrtpj.exe
  2⤵
  PID:7980
- C:\Windows\System\xvkWGOM.exe
  C:\Windows\System\xvkWGOM.exe
  2⤵
  PID:8028
- C:\Windows\System\QDNTcZk.exe
  C:\Windows\System\QDNTcZk.exe
  2⤵
  PID:8132
- C:\Windows\System\yOtyklX.exe
  C:\Windows\System\yOtyklX.exe
  2⤵
  PID:6832
- C:\Windows\System\BoqUMiI.exe
  C:\Windows\System\BoqUMiI.exe
  2⤵
  PID:7440
- C:\Windows\System\xWISAXV.exe
  C:\Windows\System\xWISAXV.exe
  2⤵
  PID:7300
- C:\Windows\System\YMKEQSZ.exe
  C:\Windows\System\YMKEQSZ.exe
  2⤵
  PID:7264
- C:\Windows\System\vsQImBA.exe
  C:\Windows\System\vsQImBA.exe
  2⤵
  PID:7504
- C:\Windows\System\QMKtFGC.exe
  C:\Windows\System\QMKtFGC.exe
  2⤵
  PID:7800
- C:\Windows\System\ieWArKZ.exe
  C:\Windows\System\ieWArKZ.exe
  2⤵
  PID:7568
- C:\Windows\System\PyZnWKm.exe
  C:\Windows\System\PyZnWKm.exe
  2⤵
  PID:8104
- C:\Windows\System\kjPVmNz.exe
  C:\Windows\System\kjPVmNz.exe
  2⤵
  PID:8152
- C:\Windows\System\dsTgWVk.exe
  C:\Windows\System\dsTgWVk.exe
  2⤵
  PID:8024
- C:\Windows\System\QxGnLAd.exe
  C:\Windows\System\QxGnLAd.exe
  2⤵
  PID:7620
- C:\Windows\System\jlQWrlb.exe
  C:\Windows\System\jlQWrlb.exe
  2⤵
  PID:8228
- C:\Windows\System\BfxaEkM.exe
  C:\Windows\System\BfxaEkM.exe
  2⤵
  PID:8252
- C:\Windows\System\PjxRGVf.exe
  C:\Windows\System\PjxRGVf.exe
  2⤵
  PID:8276
- C:\Windows\System\paFOeIk.exe
  C:\Windows\System\paFOeIk.exe
  2⤵
  PID:8304
- C:\Windows\System\YAmaOqc.exe
  C:\Windows\System\YAmaOqc.exe
  2⤵
  PID:8332
- C:\Windows\System\qSQpZoI.exe
  C:\Windows\System\qSQpZoI.exe
  2⤵
  PID:8360
- C:\Windows\System\shtyuqS.exe
  C:\Windows\System\shtyuqS.exe
  2⤵
  PID:8392
- C:\Windows\System\kzfOsNz.exe
  C:\Windows\System\kzfOsNz.exe
  2⤵
  PID:8420
- C:\Windows\System\IiWjycF.exe
  C:\Windows\System\IiWjycF.exe
  2⤵
  PID:8448
- C:\Windows\System\sijsWgF.exe
  C:\Windows\System\sijsWgF.exe
  2⤵
  PID:8472
- C:\Windows\System\DdZNPLm.exe
  C:\Windows\System\DdZNPLm.exe
  2⤵
  PID:8504
- C:\Windows\System\lnZASDc.exe
  C:\Windows\System\lnZASDc.exe
  2⤵
  PID:8532
- C:\Windows\System\agKjZqj.exe
  C:\Windows\System\agKjZqj.exe
  2⤵
  PID:8556
- C:\Windows\System\TjWPfup.exe
  C:\Windows\System\TjWPfup.exe
  2⤵
  PID:8588
- C:\Windows\System\GhsuzYo.exe
  C:\Windows\System\GhsuzYo.exe
  2⤵
  PID:8612
- C:\Windows\System\KlJCkzX.exe
  C:\Windows\System\KlJCkzX.exe
  2⤵
  PID:8640
- C:\Windows\System\JiSSduo.exe
  C:\Windows\System\JiSSduo.exe
  2⤵
  PID:8660
- C:\Windows\System\iNDZcAB.exe
  C:\Windows\System\iNDZcAB.exe
  2⤵
  PID:8692
- C:\Windows\System\AvyzLBB.exe
  C:\Windows\System\AvyzLBB.exe
  2⤵
  PID:8716
- C:\Windows\System\JrzsOAJ.exe
  C:\Windows\System\JrzsOAJ.exe
  2⤵
  PID:8744
- C:\Windows\System\bjeYfER.exe
  C:\Windows\System\bjeYfER.exe
  2⤵
  PID:8772
- C:\Windows\System\xhJzGKh.exe
  C:\Windows\System\xhJzGKh.exe
  2⤵
  PID:8804
- C:\Windows\System\mImVJjm.exe
  C:\Windows\System\mImVJjm.exe
  2⤵
  PID:8840
- C:\Windows\System\lWWTKci.exe
  C:\Windows\System\lWWTKci.exe
  2⤵
  PID:8864
- C:\Windows\System\nIlTaSm.exe
  C:\Windows\System\nIlTaSm.exe
  2⤵
  PID:8884
- C:\Windows\System\yUBoIAt.exe
  C:\Windows\System\yUBoIAt.exe
  2⤵
  PID:8912
- C:\Windows\System\PCQxdhR.exe
  C:\Windows\System\PCQxdhR.exe
  2⤵
  PID:8940
- C:\Windows\System\VDQXEsT.exe
  C:\Windows\System\VDQXEsT.exe
  2⤵
  PID:8972
- C:\Windows\System\ZKJJeeO.exe
  C:\Windows\System\ZKJJeeO.exe
  2⤵
  PID:8996
- C:\Windows\System\QyeTWHR.exe
  C:\Windows\System\QyeTWHR.exe
  2⤵
  PID:9024
- C:\Windows\System\wkfiiwt.exe
  C:\Windows\System\wkfiiwt.exe
  2⤵
  PID:9052
- C:\Windows\System\iWHWhiv.exe
  C:\Windows\System\iWHWhiv.exe
  2⤵
  PID:9084
- C:\Windows\System\doCoQiU.exe
  C:\Windows\System\doCoQiU.exe
  2⤵
  PID:9108
- C:\Windows\System\ftbMsAu.exe
  C:\Windows\System\ftbMsAu.exe
  2⤵
  PID:9140
- C:\Windows\System\UDjaGPn.exe
  C:\Windows\System\UDjaGPn.exe
  2⤵
  PID:9164
- C:\Windows\System\lnuLJMr.exe
  C:\Windows\System\lnuLJMr.exe
  2⤵
  PID:9196
- C:\Windows\System\EugRPgx.exe
  C:\Windows\System\EugRPgx.exe
  2⤵
  PID:7360
- C:\Windows\System\UCrdxPT.exe
  C:\Windows\System\UCrdxPT.exe
  2⤵
  PID:8108
- C:\Windows\System\htTQsSq.exe
  C:\Windows\System\htTQsSq.exe
  2⤵
  PID:8240
- C:\Windows\System\uEPUgMn.exe
  C:\Windows\System\uEPUgMn.exe
  2⤵
  PID:8244
- C:\Windows\System\JQaYPtF.exe
  C:\Windows\System\JQaYPtF.exe
  2⤵
  PID:8372
- C:\Windows\System\aEgWhhl.exe
  C:\Windows\System\aEgWhhl.exe
  2⤵
  PID:8436
- C:\Windows\System\SgjOPUd.exe
  C:\Windows\System\SgjOPUd.exe
  2⤵
  PID:8384
- C:\Windows\System\LhXydPa.exe
  C:\Windows\System\LhXydPa.exe
  2⤵
  PID:8604
- C:\Windows\System\IFHCQAo.exe
  C:\Windows\System\IFHCQAo.exe
  2⤵
  PID:8684
- C:\Windows\System\qRfqkkI.exe
  C:\Windows\System\qRfqkkI.exe
  2⤵
  PID:8780
- C:\Windows\System\JPfLIsG.exe
  C:\Windows\System\JPfLIsG.exe
  2⤵
  PID:8816
- C:\Windows\System\YAafnEF.exe
  C:\Windows\System\YAafnEF.exe
  2⤵
  PID:8832
- C:\Windows\System\XXqzsNn.exe
  C:\Windows\System\XXqzsNn.exe
  2⤵
  PID:8876
- C:\Windows\System\SESFPqX.exe
  C:\Windows\System\SESFPqX.exe
  2⤵
  PID:8848
- C:\Windows\System\fEppFoa.exe
  C:\Windows\System\fEppFoa.exe
  2⤵
  PID:8932
- C:\Windows\System\psSkRal.exe
  C:\Windows\System\psSkRal.exe
  2⤵
  PID:8964
- C:\Windows\System\MxJePOX.exe
  C:\Windows\System\MxJePOX.exe
  2⤵
  PID:9100
- C:\Windows\System\dCaPQCr.exe
  C:\Windows\System\dCaPQCr.exe
  2⤵
  PID:8208
- C:\Windows\System\KnKfgWb.exe
  C:\Windows\System\KnKfgWb.exe
  2⤵
  PID:9160
- C:\Windows\System\nnyUkTG.exe
  C:\Windows\System\nnyUkTG.exe
  2⤵
  PID:9188
- C:\Windows\System\vgNFLei.exe
  C:\Windows\System\vgNFLei.exe
  2⤵
  PID:8056
- C:\Windows\System\JQOwVQR.exe
  C:\Windows\System\JQOwVQR.exe
  2⤵
  PID:8548
- C:\Windows\System\gFwGhAR.exe
  C:\Windows\System\gFwGhAR.exe
  2⤵
  PID:8800
- C:\Windows\System\UVGDakk.exe
  C:\Windows\System\UVGDakk.exe
  2⤵
  PID:8440
- C:\Windows\System\CdtpQpY.exe
  C:\Windows\System\CdtpQpY.exe
  2⤵
  PID:9152
- C:\Windows\System\FgONluj.exe
  C:\Windows\System\FgONluj.exe
  2⤵
  PID:9120
- C:\Windows\System\DFbVLkH.exe
  C:\Windows\System\DFbVLkH.exe
  2⤵
  PID:9020
- C:\Windows\System\UDwIVoM.exe
  C:\Windows\System\UDwIVoM.exe
  2⤵
  PID:9132
- C:\Windows\System\pgLlPoT.exe
  C:\Windows\System\pgLlPoT.exe
  2⤵
  PID:9236
- C:\Windows\System\jDiHohy.exe
  C:\Windows\System\jDiHohy.exe
  2⤵
  PID:9260
- C:\Windows\System\LzTkqTO.exe
  C:\Windows\System\LzTkqTO.exe
  2⤵
  PID:9284
- C:\Windows\System\lsikQWv.exe
  C:\Windows\System\lsikQWv.exe
  2⤵
  PID:9308
- C:\Windows\System\vgFbCjJ.exe
  C:\Windows\System\vgFbCjJ.exe
  2⤵
  PID:9336
- C:\Windows\System\myEJaWL.exe
  C:\Windows\System\myEJaWL.exe
  2⤵
  PID:9364
- C:\Windows\System\bILxGHi.exe
  C:\Windows\System\bILxGHi.exe
  2⤵
  PID:9392
- C:\Windows\System\nAukqpS.exe
  C:\Windows\System\nAukqpS.exe
  2⤵
  PID:9428
- C:\Windows\System\qzVzPtn.exe
  C:\Windows\System\qzVzPtn.exe
  2⤵
  PID:9452
- C:\Windows\System\ekmtUkd.exe
  C:\Windows\System\ekmtUkd.exe
  2⤵
  PID:9476
- C:\Windows\System\RHYWXSW.exe
  C:\Windows\System\RHYWXSW.exe
  2⤵
  PID:9504
- C:\Windows\System\WCTHdOA.exe
  C:\Windows\System\WCTHdOA.exe
  2⤵
  PID:9536
- C:\Windows\System\cLyFySJ.exe
  C:\Windows\System\cLyFySJ.exe
  2⤵
  PID:9560
- C:\Windows\System\CbsLzcS.exe
  C:\Windows\System\CbsLzcS.exe
  2⤵
  PID:9596
- C:\Windows\System\dSWCUXD.exe
  C:\Windows\System\dSWCUXD.exe
  2⤵
  PID:9624
- C:\Windows\System\oqNAnLs.exe
  C:\Windows\System\oqNAnLs.exe
  2⤵
  PID:9644
- C:\Windows\System\HHgOLbO.exe
  C:\Windows\System\HHgOLbO.exe
  2⤵
  PID:9660
- C:\Windows\System\unpMIIQ.exe
  C:\Windows\System\unpMIIQ.exe
  2⤵
  PID:9684
- C:\Windows\System\YzRdhbA.exe
  C:\Windows\System\YzRdhbA.exe
  2⤵
  PID:9716
- C:\Windows\System\OkapESI.exe
  C:\Windows\System\OkapESI.exe
  2⤵
  PID:9740
- C:\Windows\System\bACdfbN.exe
  C:\Windows\System\bACdfbN.exe
  2⤵
  PID:9768
- C:\Windows\System\tqMwoFT.exe
  C:\Windows\System\tqMwoFT.exe
  2⤵
  PID:9792
- C:\Windows\System\iiVZczm.exe
  C:\Windows\System\iiVZczm.exe
  2⤵
  PID:9820
- C:\Windows\System\qyXqNXu.exe
  C:\Windows\System\qyXqNXu.exe
  2⤵
  PID:9840
- C:\Windows\System\lUkJRxL.exe
  C:\Windows\System\lUkJRxL.exe
  2⤵
  PID:9860
- C:\Windows\System\HMPrQTn.exe
  C:\Windows\System\HMPrQTn.exe
  2⤵
  PID:9884
- C:\Windows\System\onyJisS.exe
  C:\Windows\System\onyJisS.exe
  2⤵
  PID:9912
- C:\Windows\System\PhfjuKu.exe
  C:\Windows\System\PhfjuKu.exe
  2⤵
  PID:9948
- C:\Windows\System\qTAUoQo.exe
  C:\Windows\System\qTAUoQo.exe
  2⤵
  PID:9976
- C:\Windows\System\Tlxplke.exe
  C:\Windows\System\Tlxplke.exe
  2⤵
  PID:9996
- C:\Windows\System\zKtjCBT.exe
  C:\Windows\System\zKtjCBT.exe
  2⤵
  PID:10020
- C:\Windows\System\WAFdUrE.exe
  C:\Windows\System\WAFdUrE.exe
  2⤵
  PID:10120
- C:\Windows\System\UEuiaSC.exe
  C:\Windows\System\UEuiaSC.exe
  2⤵
  PID:10160
- C:\Windows\System\PmeGTlr.exe
  C:\Windows\System\PmeGTlr.exe
  2⤵
  PID:10200
- C:\Windows\System\GhxlGwu.exe
  C:\Windows\System\GhxlGwu.exe
  2⤵
  PID:10224
- C:\Windows\System\SSNwwcV.exe
  C:\Windows\System\SSNwwcV.exe
  2⤵
  PID:8728
- C:\Windows\System\reLAcez.exe
  C:\Windows\System\reLAcez.exe
  2⤵
  PID:9180
- C:\Windows\System\yvDgzSh.exe
  C:\Windows\System\yvDgzSh.exe
  2⤵
  PID:9296
- C:\Windows\System\zvBgwcf.exe
  C:\Windows\System\zvBgwcf.exe
  2⤵
  PID:9348
- C:\Windows\System\LvYWxaK.exe
  C:\Windows\System\LvYWxaK.exe
  2⤵
  PID:9416
- C:\Windows\System\CAXpUCo.exe
  C:\Windows\System\CAXpUCo.exe
  2⤵
  PID:9176
- C:\Windows\System\JZThAZj.exe
  C:\Windows\System\JZThAZj.exe
  2⤵
  PID:9616
- C:\Windows\System\UmiqMcJ.exe
  C:\Windows\System\UmiqMcJ.exe
  2⤵
  PID:9672
- C:\Windows\System\jvxqxJK.exe
  C:\Windows\System\jvxqxJK.exe
  2⤵
  PID:9360
- C:\Windows\System\FheLoWp.exe
  C:\Windows\System\FheLoWp.exe
  2⤵
  PID:9756
- C:\Windows\System\QUAksWf.exe
  C:\Windows\System\QUAksWf.exe
  2⤵
  PID:9816
- C:\Windows\System\Ckaurxg.exe
  C:\Windows\System\Ckaurxg.exe
  2⤵
  PID:9516
- C:\Windows\System\HlXUgwk.exe
  C:\Windows\System\HlXUgwk.exe
  2⤵
  PID:9580
- C:\Windows\System\iQmCYgk.exe
  C:\Windows\System\iQmCYgk.exe
  2⤵
  PID:4000
- C:\Windows\System\IIrMOdG.exe
  C:\Windows\System\IIrMOdG.exe
  2⤵
  PID:9960
- C:\Windows\System\siPTDJk.exe
  C:\Windows\System\siPTDJk.exe
  2⤵
  PID:9812
- C:\Windows\System\IemkpFb.exe
  C:\Windows\System\IemkpFb.exe
  2⤵
  PID:10036
- C:\Windows\System\hqyqYmN.exe
  C:\Windows\System\hqyqYmN.exe
  2⤵
  PID:10008
- C:\Windows\System\ydfTUfT.exe
  C:\Windows\System\ydfTUfT.exe
  2⤵
  PID:8296
- C:\Windows\System\pvgFnLT.exe
  C:\Windows\System\pvgFnLT.exe
  2⤵
  PID:9804
- C:\Windows\System\OpBwxoh.exe
  C:\Windows\System\OpBwxoh.exe
  2⤵
  PID:9232
- C:\Windows\System\pugTPJl.exe
  C:\Windows\System\pugTPJl.exe
  2⤵
  PID:9276
- C:\Windows\System\qIgRBkE.exe
  C:\Windows\System\qIgRBkE.exe
  2⤵
  PID:9388
- C:\Windows\System\xSPkAfQ.exe
  C:\Windows\System\xSPkAfQ.exe
  2⤵
  PID:9444
- C:\Windows\System\RVopJCj.exe
  C:\Windows\System\RVopJCj.exe
  2⤵
  PID:10244
- C:\Windows\System\BvyQRGC.exe
  C:\Windows\System\BvyQRGC.exe
  2⤵
  PID:10272
- C:\Windows\System\rNdkgyI.exe
  C:\Windows\System\rNdkgyI.exe
  2⤵
  PID:10300
- C:\Windows\System\yAfkpvD.exe
  C:\Windows\System\yAfkpvD.exe
  2⤵
  PID:10332
- C:\Windows\System\YQWZBCe.exe
  C:\Windows\System\YQWZBCe.exe
  2⤵
  PID:10356
- C:\Windows\System\ONorXiv.exe
  C:\Windows\System\ONorXiv.exe
  2⤵
  PID:10376
- C:\Windows\System\VeftOBQ.exe
  C:\Windows\System\VeftOBQ.exe
  2⤵
  PID:10408
- C:\Windows\System\SQLXRGF.exe
  C:\Windows\System\SQLXRGF.exe
  2⤵
  PID:10428
- C:\Windows\System\OoSBNrT.exe
  C:\Windows\System\OoSBNrT.exe
  2⤵
  PID:10448
- C:\Windows\System\bYpFBOk.exe
  C:\Windows\System\bYpFBOk.exe
  2⤵
  PID:10472
- C:\Windows\System\xMmbWXA.exe
  C:\Windows\System\xMmbWXA.exe
  2⤵
  PID:10496
- C:\Windows\System\NdxmTog.exe
  C:\Windows\System\NdxmTog.exe
  2⤵
  PID:10520
- C:\Windows\System\ldpmqTE.exe
  C:\Windows\System\ldpmqTE.exe
  2⤵
  PID:10544
- C:\Windows\System\yiuVPdz.exe
  C:\Windows\System\yiuVPdz.exe
  2⤵
  PID:10572
- C:\Windows\System\tlDGAtJ.exe
  C:\Windows\System\tlDGAtJ.exe
  2⤵
  PID:10600
- C:\Windows\System\DRARFmg.exe
  C:\Windows\System\DRARFmg.exe
  2⤵
  PID:10620
- C:\Windows\System\dXZkpEB.exe
  C:\Windows\System\dXZkpEB.exe
  2⤵
  PID:10652
- C:\Windows\System\nRgGFzt.exe
  C:\Windows\System\nRgGFzt.exe
  2⤵
  PID:10668
- C:\Windows\System\XSBlTix.exe
  C:\Windows\System\XSBlTix.exe
  2⤵
  PID:10700
- C:\Windows\System\DdUMNGb.exe
  C:\Windows\System\DdUMNGb.exe
  2⤵
  PID:10724
- C:\Windows\System\ryHghsY.exe
  C:\Windows\System\ryHghsY.exe
  2⤵
  PID:10752
- C:\Windows\System\PtRUNgt.exe
  C:\Windows\System\PtRUNgt.exe
  2⤵
  PID:10776
- C:\Windows\System\yAdzKWp.exe
  C:\Windows\System\yAdzKWp.exe
  2⤵
  PID:10796
- C:\Windows\System\HQtHCLl.exe
  C:\Windows\System\HQtHCLl.exe
  2⤵
  PID:10824
- C:\Windows\System\uTUwdjh.exe
  C:\Windows\System\uTUwdjh.exe
  2⤵
  PID:10928
- C:\Windows\System\spIPVLZ.exe
  C:\Windows\System\spIPVLZ.exe
  2⤵
  PID:10960
- C:\Windows\System\URHHzEO.exe
  C:\Windows\System\URHHzEO.exe
  2⤵
  PID:10992
- C:\Windows\System\AJgsgfK.exe
  C:\Windows\System\AJgsgfK.exe
  2⤵
  PID:11012
- C:\Windows\System\PZhytrJ.exe
  C:\Windows\System\PZhytrJ.exe
  2⤵
  PID:11036
- C:\Windows\System\mkaNFNO.exe
  C:\Windows\System\mkaNFNO.exe
  2⤵
  PID:11064
- C:\Windows\System\lEuaRkE.exe
  C:\Windows\System\lEuaRkE.exe
  2⤵
  PID:11084
- C:\Windows\System\AnqpiES.exe
  C:\Windows\System\AnqpiES.exe
  2⤵
  PID:11200
- C:\Windows\System\WkNShze.exe
  C:\Windows\System\WkNShze.exe
  2⤵
  PID:11228
- C:\Windows\System\TbMjTLJ.exe
  C:\Windows\System\TbMjTLJ.exe
  2⤵
  PID:11256
- C:\Windows\System\RluZwhg.exe
  C:\Windows\System\RluZwhg.exe
  2⤵
  PID:9872
- C:\Windows\System\cmDmJih.exe
  C:\Windows\System\cmDmJih.exe
  2⤵
  PID:8896
- C:\Windows\System\uBAAtWz.exe
  C:\Windows\System\uBAAtWz.exe
  2⤵
  PID:9964
- C:\Windows\System\eeRDEfN.exe
  C:\Windows\System\eeRDEfN.exe
  2⤵
  PID:8760
- C:\Windows\System\jUtAAzA.exe
  C:\Windows\System\jUtAAzA.exe
  2⤵
  PID:10508
- C:\Windows\System\vTDdjqM.exe
  C:\Windows\System\vTDdjqM.exe
  2⤵
  PID:10444
- C:\Windows\System\NeKIwnz.exe
  C:\Windows\System\NeKIwnz.exe
  2⤵
  PID:10344
- C:\Windows\System\PawBAuQ.exe
  C:\Windows\System\PawBAuQ.exe
  2⤵
  PID:10556
- C:\Windows\System\eOTiNAV.exe
  C:\Windows\System\eOTiNAV.exe
  2⤵
  PID:10484
- C:\Windows\System\AXizlQJ.exe
  C:\Windows\System\AXizlQJ.exe
  2⤵
  PID:10564
- C:\Windows\System\nGqRkDo.exe
  C:\Windows\System\nGqRkDo.exe
  2⤵
  PID:10740
- C:\Windows\System\ZJsdRqk.exe
  C:\Windows\System\ZJsdRqk.exe
  2⤵
  PID:10784
- C:\Windows\System\zmoENzE.exe
  C:\Windows\System\zmoENzE.exe
  2⤵
  PID:10812
- C:\Windows\System\yXjWnFx.exe
  C:\Windows\System\yXjWnFx.exe
  2⤵
  PID:10648
- C:\Windows\System\piOJJnz.exe
  C:\Windows\System\piOJJnz.exe
  2⤵
  PID:11072
- C:\Windows\System\yRuaeqZ.exe
  C:\Windows\System\yRuaeqZ.exe
  2⤵
  PID:11008
- C:\Windows\System\JBxvobK.exe
  C:\Windows\System\JBxvobK.exe
  2⤵
  PID:11156
- C:\Windows\System\kLtMiSL.exe
  C:\Windows\System\kLtMiSL.exe
  2⤵
  PID:10968
- C:\Windows\System\GRGxuiJ.exe
  C:\Windows\System\GRGxuiJ.exe
  2⤵
  PID:11032
- C:\Windows\System\QkJzAet.exe
  C:\Windows\System\QkJzAet.exe
  2⤵
  PID:10264
- C:\Windows\System\GDZPUmP.exe
  C:\Windows\System\GDZPUmP.exe
  2⤵
  PID:7540
- C:\Windows\System\xcxKjoh.exe
  C:\Windows\System\xcxKjoh.exe
  2⤵
  PID:9576
- C:\Windows\System\QGGiMUy.exe
  C:\Windows\System\QGGiMUy.exe
  2⤵
  PID:7548
- C:\Windows\System\VrcOnHC.exe
  C:\Windows\System\VrcOnHC.exe
  2⤵
  PID:4724
- C:\Windows\System\VZTxYwx.exe
  C:\Windows\System\VZTxYwx.exe
  2⤵
  PID:10712
- C:\Windows\System\DZvVzOM.exe
  C:\Windows\System\DZvVzOM.exe
  2⤵
  PID:10888
- C:\Windows\System\lGeABvk.exe
  C:\Windows\System\lGeABvk.exe
  2⤵
  PID:11060
- C:\Windows\System\oWaFfsk.exe
  C:\Windows\System\oWaFfsk.exe
  2⤵
  PID:11044
- C:\Windows\System\wkMrUJj.exe
  C:\Windows\System\wkMrUJj.exe
  2⤵
  PID:11216
- C:\Windows\System\yifXAgt.exe
  C:\Windows\System\yifXAgt.exe
  2⤵
  PID:10948
- C:\Windows\System\brOpIHH.exe
  C:\Windows\System\brOpIHH.exe
  2⤵
  PID:4024
- C:\Windows\System\zVxDbkv.exe
  C:\Windows\System\zVxDbkv.exe
  2⤵
  PID:11308
- C:\Windows\System\gpylPrv.exe
  C:\Windows\System\gpylPrv.exe
  2⤵
  PID:11360
- C:\Windows\System\EAFzeZB.exe
  C:\Windows\System\EAFzeZB.exe
  2⤵
  PID:11388
- C:\Windows\System\MiOLbSn.exe
  C:\Windows\System\MiOLbSn.exe
  2⤵
  PID:11404
- C:\Windows\System\oYlrLER.exe
  C:\Windows\System\oYlrLER.exe
  2⤵
  PID:11424
- C:\Windows\System\HpVHOuY.exe
  C:\Windows\System\HpVHOuY.exe
  2⤵
  PID:11444
- C:\Windows\System\qQAHNbv.exe
  C:\Windows\System\qQAHNbv.exe
  2⤵
  PID:11468
- C:\Windows\System\PJRczLV.exe
  C:\Windows\System\PJRczLV.exe
  2⤵
  PID:11496
- C:\Windows\System\qQjYZrn.exe
  C:\Windows\System\qQjYZrn.exe
  2⤵
  PID:11520
- C:\Windows\System\VLHEajG.exe
  C:\Windows\System\VLHEajG.exe
  2⤵
  PID:11552
- C:\Windows\System\dIaWbZq.exe
  C:\Windows\System\dIaWbZq.exe
  2⤵
  PID:11580
- C:\Windows\System\Aeutwim.exe
  C:\Windows\System\Aeutwim.exe
  2⤵
  PID:11600
- C:\Windows\System\kWiqwZf.exe
  C:\Windows\System\kWiqwZf.exe
  2⤵
  PID:11616
- C:\Windows\System\gFYAWoz.exe
  C:\Windows\System\gFYAWoz.exe
  2⤵
  PID:11640
- C:\Windows\System\QCuHBty.exe
  C:\Windows\System\QCuHBty.exe
  2⤵
  PID:11664
- C:\Windows\System\mFBAdWC.exe
  C:\Windows\System\mFBAdWC.exe
  2⤵
  PID:11696
- C:\Windows\System\ijqhqWx.exe
  C:\Windows\System\ijqhqWx.exe
  2⤵
  PID:11712
- C:\Windows\System\aZRKDfd.exe
  C:\Windows\System\aZRKDfd.exe
  2⤵
  PID:11736
- C:\Windows\System\yFAtCsJ.exe
  C:\Windows\System\yFAtCsJ.exe
  2⤵
  PID:11768
- C:\Windows\System\XenIwvn.exe
  C:\Windows\System\XenIwvn.exe
  2⤵
  PID:11788
- C:\Windows\System\tBGlDsJ.exe
  C:\Windows\System\tBGlDsJ.exe
  2⤵
  PID:11820
- C:\Windows\System\iRduvpb.exe
  C:\Windows\System\iRduvpb.exe
  2⤵
  PID:11852
- C:\Windows\System\fPiDxEi.exe
  C:\Windows\System\fPiDxEi.exe
  2⤵
  PID:11880
- C:\Windows\System\vIJWjXn.exe
  C:\Windows\System\vIJWjXn.exe
  2⤵
  PID:11952
- C:\Windows\System\AiOiBpr.exe
  C:\Windows\System\AiOiBpr.exe
  2⤵
  PID:11968
- C:\Windows\System\UisdtSb.exe
  C:\Windows\System\UisdtSb.exe
  2⤵
  PID:11996
- C:\Windows\System\RSFeUno.exe
  C:\Windows\System\RSFeUno.exe
  2⤵
  PID:12032
- C:\Windows\System\MYIewBz.exe
  C:\Windows\System\MYIewBz.exe
  2⤵
  PID:12052
- C:\Windows\System\wzbwdnC.exe
  C:\Windows\System\wzbwdnC.exe
  2⤵
  PID:12076
- C:\Windows\System\LgjKdHk.exe
  C:\Windows\System\LgjKdHk.exe
  2⤵
  PID:12104
- C:\Windows\System\lXOCHKu.exe
  C:\Windows\System\lXOCHKu.exe
  2⤵
  PID:12132
- C:\Windows\System\wUHEIkT.exe
  C:\Windows\System\wUHEIkT.exe
  2⤵
  PID:12156
- C:\Windows\System\vDNuxVe.exe
  C:\Windows\System\vDNuxVe.exe
  2⤵
  PID:12184
- C:\Windows\System\NAfsnRP.exe
  C:\Windows\System\NAfsnRP.exe
  2⤵
  PID:12208
- C:\Windows\System\DXXwImd.exe
  C:\Windows\System\DXXwImd.exe
  2⤵
  PID:12244
- C:\Windows\System\qKpIEaK.exe
  C:\Windows\System\qKpIEaK.exe
  2⤵
  PID:12264
- C:\Windows\System\aGQPerm.exe
  C:\Windows\System\aGQPerm.exe
  2⤵
  PID:9604
- C:\Windows\System\XsiTgHg.exe
  C:\Windows\System\XsiTgHg.exe
  2⤵
  PID:10660
- C:\Windows\System\ZVatXpm.exe
  C:\Windows\System\ZVatXpm.exe
  2⤵
  PID:10284
- C:\Windows\System\mobzHZn.exe
  C:\Windows\System\mobzHZn.exe
  2⤵
  PID:11288
- C:\Windows\System\KqmiFnV.exe
  C:\Windows\System\KqmiFnV.exe
  2⤵
  PID:11024
- C:\Windows\System\fayiMPN.exe
  C:\Windows\System\fayiMPN.exe
  2⤵
  PID:11416
- C:\Windows\System\PEDkqdE.exe
  C:\Windows\System\PEDkqdE.exe
  2⤵
  PID:11356
- C:\Windows\System\wxxUVxZ.exe
  C:\Windows\System\wxxUVxZ.exe
  2⤵
  PID:11576
- C:\Windows\System\uMQgGmp.exe
  C:\Windows\System\uMQgGmp.exe
  2⤵
  PID:11484
- C:\Windows\System\mfywgLg.exe
  C:\Windows\System\mfywgLg.exe
  2⤵
  PID:11796
- C:\Windows\System\HMRYcsN.exe
  C:\Windows\System\HMRYcsN.exe
  2⤵
  PID:11516
- C:\Windows\System\hziSRpG.exe
  C:\Windows\System\hziSRpG.exe
  2⤵
  PID:11572
- C:\Windows\System\zhnMOkg.exe
  C:\Windows\System\zhnMOkg.exe
  2⤵
  PID:11804
- C:\Windows\System\DnwWYYv.exe
  C:\Windows\System\DnwWYYv.exe
  2⤵
  PID:11632
- C:\Windows\System\VwnoeOb.exe
  C:\Windows\System\VwnoeOb.exe
  2⤵
  PID:11964
- C:\Windows\System\FhKMTOu.exe
  C:\Windows\System\FhKMTOu.exe
  2⤵
  PID:11708
- C:\Windows\System\zcjLZow.exe
  C:\Windows\System\zcjLZow.exe
  2⤵
  PID:11980
- C:\Windows\System\gOBnAcs.exe
  C:\Windows\System\gOBnAcs.exe
  2⤵
  PID:12168
- C:\Windows\System\riZVRkZ.exe
  C:\Windows\System\riZVRkZ.exe
  2⤵
  PID:12048
- C:\Windows\System\fgxIMmm.exe
  C:\Windows\System\fgxIMmm.exe
  2⤵
  PID:12256
- C:\Windows\System\CjXDAOK.exe
  C:\Windows\System\CjXDAOK.exe
  2⤵
  PID:12120
- C:\Windows\System\rKKCZMs.exe
  C:\Windows\System\rKKCZMs.exe
  2⤵
  PID:10504
- C:\Windows\System\yVMQXSP.exe
  C:\Windows\System\yVMQXSP.exe
  2⤵
  PID:12204
- C:\Windows\System\QCIUigC.exe
  C:\Windows\System\QCIUigC.exe
  2⤵
  PID:11460
- C:\Windows\System\KPOlvbV.exe
  C:\Windows\System\KPOlvbV.exe
  2⤵
  PID:11568
- C:\Windows\System\SkZlkwV.exe
  C:\Windows\System\SkZlkwV.exe
  2⤵
  PID:11848
- C:\Windows\System\LysqDaS.exe
  C:\Windows\System\LysqDaS.exe
  2⤵
  PID:12200
- C:\Windows\System\kfPsrzh.exe
  C:\Windows\System\kfPsrzh.exe
  2⤵
  PID:12304
- C:\Windows\System\CvUfUBP.exe
  C:\Windows\System\CvUfUBP.exe
  2⤵
  PID:12328
- C:\Windows\System\HCyNGDH.exe
  C:\Windows\System\HCyNGDH.exe
  2⤵
  PID:12352
- C:\Windows\System\sTXoQTP.exe
  C:\Windows\System\sTXoQTP.exe
  2⤵
  PID:12380
- C:\Windows\System\lqbRvDc.exe
  C:\Windows\System\lqbRvDc.exe
  2⤵
  PID:12404
- C:\Windows\System\VoVOzWg.exe
  C:\Windows\System\VoVOzWg.exe
  2⤵
  PID:12432
- C:\Windows\System\RMZuwxT.exe
  C:\Windows\System\RMZuwxT.exe
  2⤵
  PID:12456
- C:\Windows\System\ZHagchI.exe
  C:\Windows\System\ZHagchI.exe
  2⤵
  PID:12476
- C:\Windows\System\BwQupAP.exe
  C:\Windows\System\BwQupAP.exe
  2⤵
  PID:12504
- C:\Windows\System\iLBLYlR.exe
  C:\Windows\System\iLBLYlR.exe
  2⤵
  PID:12528
- C:\Windows\System\UEEQrjR.exe
  C:\Windows\System\UEEQrjR.exe
  2⤵
  PID:12560
- C:\Windows\System\rcatMRS.exe
  C:\Windows\System\rcatMRS.exe
  2⤵
  PID:12576
- C:\Windows\System\HHIpgLm.exe
  C:\Windows\System\HHIpgLm.exe
  2⤵
  PID:12604
- C:\Windows\System\IzKCdJZ.exe
  C:\Windows\System\IzKCdJZ.exe
  2⤵
  PID:12636
- C:\Windows\System\LCymqRR.exe
  C:\Windows\System\LCymqRR.exe
  2⤵
  PID:12656
- C:\Windows\System\iGcrzFm.exe
  C:\Windows\System\iGcrzFm.exe
  2⤵
  PID:12748
- C:\Windows\System\ZtVbZwV.exe
  C:\Windows\System\ZtVbZwV.exe
  2⤵
  PID:12768
- C:\Windows\System\ZkysNHf.exe
  C:\Windows\System\ZkysNHf.exe
  2⤵
  PID:12800
- C:\Windows\System\LLwqfwu.exe
  C:\Windows\System\LLwqfwu.exe
  2⤵
  PID:12828
- C:\Windows\System\EqEpQeL.exe
  C:\Windows\System\EqEpQeL.exe
  2⤵
  PID:12856
- C:\Windows\System\CiTYGbF.exe
  C:\Windows\System\CiTYGbF.exe
  2⤵
  PID:12888
- C:\Windows\System\luOIxgS.exe
  C:\Windows\System\luOIxgS.exe
  2⤵
  PID:12916
- C:\Windows\System\uinyGbL.exe
  C:\Windows\System\uinyGbL.exe
  2⤵
  PID:13292
- C:\Windows\System\WLYOfrG.exe
  C:\Windows\System\WLYOfrG.exe
  2⤵
  PID:11396
- C:\Windows\System\rOlvUAB.exe
  C:\Windows\System\rOlvUAB.exe
  2⤵
  PID:12068
- C:\Windows\System\dyeBkJd.exe
  C:\Windows\System\dyeBkJd.exe
  2⤵
  PID:12260
- C:\Windows\System\adQZIIM.exe
  C:\Windows\System\adQZIIM.exe
  2⤵
  PID:10920
- C:\Windows\System\rVWqjCr.exe
  C:\Windows\System\rVWqjCr.exe
  2⤵
  PID:11732
- C:\Windows\System\tiUjwEM.exe
  C:\Windows\System\tiUjwEM.exe
  2⤵
  PID:10768
- C:\Windows\System\FLzpdGD.exe
  C:\Windows\System\FLzpdGD.exe
  2⤵
  PID:11432
- C:\Windows\System\RPMzHXk.exe
  C:\Windows\System\RPMzHXk.exe
  2⤵
  PID:12628
- C:\Windows\System\urEzLdA.exe
  C:\Windows\System\urEzLdA.exe
  2⤵
  PID:12400
- C:\Windows\System\EPvEvAd.exe
  C:\Windows\System\EPvEvAd.exe
  2⤵
  PID:11268
- C:\Windows\System\MGLnJMZ.exe
  C:\Windows\System\MGLnJMZ.exe
  2⤵
  PID:12592
- C:\Windows\System\rLjJyIn.exe
  C:\Windows\System\rLjJyIn.exe
  2⤵
  PID:12324
- C:\Windows\System\suqEgmm.exe
  C:\Windows\System\suqEgmm.exe
  2⤵
  PID:12744
- C:\Windows\System\rTyhRMQ.exe
  C:\Windows\System\rTyhRMQ.exe
  2⤵
  PID:12700
- C:\Windows\System\PvxFcTP.exe
  C:\Windows\System\PvxFcTP.exe
  2⤵
  PID:12740
- C:\Windows\System\otMqZUz.exe
  C:\Windows\System\otMqZUz.exe
  2⤵
  PID:12876
- C:\Windows\System\XSTKpDG.exe
  C:\Windows\System\XSTKpDG.exe
  2⤵
  PID:12816
- C:\Windows\System\aorULfQ.exe
  C:\Windows\System\aorULfQ.exe
  2⤵
  PID:12940
- C:\Windows\System\uhlztuQ.exe
  C:\Windows\System\uhlztuQ.exe
  2⤵
  PID:13060
- C:\Windows\System\rPcVGlX.exe
  C:\Windows\System\rPcVGlX.exe
  2⤵
  PID:13216
- C:\Windows\System\VzqIKFE.exe
  C:\Windows\System\VzqIKFE.exe
  2⤵
  PID:13276
- C:\Windows\System\VgOswFF.exe
  C:\Windows\System\VgOswFF.exe
  2⤵
  PID:11944
- C:\Windows\System\CQXdrlb.exe
  C:\Windows\System\CQXdrlb.exe
  2⤵
  PID:13288
- C:\Windows\System\OfJZRdL.exe
  C:\Windows\System\OfJZRdL.exe
  2⤵
  PID:10592
- C:\Windows\System\hZgVohz.exe
  C:\Windows\System\hZgVohz.exe
  2⤵
  PID:12396
- C:\Windows\System\DKJGVeF.exe
  C:\Windows\System\DKJGVeF.exe
  2⤵
  PID:12376
- C:\Windows\System\UAKcUPX.exe
  C:\Windows\System\UAKcUPX.exe
  2⤵
  PID:12652
- C:\Windows\System\ncPfBVw.exe
  C:\Windows\System\ncPfBVw.exe
  2⤵
  PID:12944
- C:\Windows\System\PXRHtqg.exe
  C:\Windows\System\PXRHtqg.exe
  2⤵
  PID:13068
- C:\Windows\System\pBriqTF.exe
  C:\Windows\System\pBriqTF.exe
  2⤵
  PID:13212
- C:\Windows\System\MfZeZuI.exe
  C:\Windows\System\MfZeZuI.exe
  2⤵
  PID:13020
- C:\Windows\System\HYxYGgM.exe
  C:\Windows\System\HYxYGgM.exe
  2⤵
  PID:12928
- C:\Windows\System\BTOBuWM.exe
  C:\Windows\System\BTOBuWM.exe
  2⤵
  PID:10984
- C:\Windows\System\ArOsMgs.exe
  C:\Windows\System\ArOsMgs.exe
  2⤵
  PID:12648
- C:\Windows\System\PHfBwaR.exe
  C:\Windows\System\PHfBwaR.exe
  2⤵
  PID:12776
- C:\Windows\System\SVoqdgA.exe
  C:\Windows\System\SVoqdgA.exe
  2⤵
  PID:13004
- C:\Windows\System\keIRaVi.exe
  C:\Windows\System\keIRaVi.exe
  2⤵
  PID:13324
- C:\Windows\System\rHyaKCa.exe
  C:\Windows\System\rHyaKCa.exe
  2⤵
  PID:13348
- C:\Windows\System\OimIzpW.exe
  C:\Windows\System\OimIzpW.exe
  2⤵
  PID:13368
- C:\Windows\System\MzsAbhy.exe
  C:\Windows\System\MzsAbhy.exe
  2⤵
  PID:13396
- C:\Windows\System\AZmSgqe.exe
  C:\Windows\System\AZmSgqe.exe
  2⤵
  PID:13428
- C:\Windows\System\PcTRSPM.exe
  C:\Windows\System\PcTRSPM.exe
  2⤵
  PID:13480
- C:\Windows\System\ZUtILii.exe
  C:\Windows\System\ZUtILii.exe
  2⤵
  PID:13508
- C:\Windows\System\AkKIeaE.exe
  C:\Windows\System\AkKIeaE.exe
  2⤵
  PID:13540
- C:\Windows\System\HjYLRla.exe
  C:\Windows\System\HjYLRla.exe
  2⤵
  PID:13556
- C:\Windows\System\FDhEJZv.exe
  C:\Windows\System\FDhEJZv.exe
  2⤵
  PID:13576
- C:\Windows\System\kOUzLgY.exe
  C:\Windows\System\kOUzLgY.exe
  2⤵
  PID:13600
- C:\Windows\System\buRWdpu.exe
  C:\Windows\System\buRWdpu.exe
  2⤵
  PID:13624
- C:\Windows\System\NalddpI.exe
  C:\Windows\System\NalddpI.exe
  2⤵
  PID:13644
- C:\Windows\System\FlGGWgb.exe
  C:\Windows\System\FlGGWgb.exe
  2⤵
  PID:13664
- C:\Windows\System\GuNbNhu.exe
  C:\Windows\System\GuNbNhu.exe
  2⤵
  PID:13680
- C:\Windows\System\RPImTHC.exe
  C:\Windows\System\RPImTHC.exe
  2⤵
  PID:13700
- C:\Windows\System\buJitVD.exe
  C:\Windows\System\buJitVD.exe
  2⤵
  PID:13724
- C:\Windows\System\qLbmaSi.exe
  C:\Windows\System\qLbmaSi.exe
  2⤵
  PID:13744
- C:\Windows\System\XPNtacQ.exe
  C:\Windows\System\XPNtacQ.exe
  2⤵
  PID:13760
- C:\Windows\System\CeKVpzl.exe
  C:\Windows\System\CeKVpzl.exe
  2⤵
  PID:13776
- C:\Windows\System\gTbXTWS.exe
  C:\Windows\System\gTbXTWS.exe
  2⤵
  PID:13796
- C:\Windows\System\yaUIpdl.exe
  C:\Windows\System\yaUIpdl.exe
  2⤵
  PID:13816
- C:\Windows\System\AKXEDtl.exe
  C:\Windows\System\AKXEDtl.exe
  2⤵
  PID:13832
- C:\Windows\System\PuyQEcc.exe
  C:\Windows\System\PuyQEcc.exe
  2⤵
  PID:13864
- C:\Windows\System\cWSLNMX.exe
  C:\Windows\System\cWSLNMX.exe
  2⤵
  PID:13892
- C:\Windows\System\VpoqyZT.exe
  C:\Windows\System\VpoqyZT.exe
  2⤵
  PID:13916
- C:\Windows\System\EOUSITB.exe
  C:\Windows\System\EOUSITB.exe
  2⤵
  PID:13932
- C:\Windows\System\uGyTrFa.exe
  C:\Windows\System\uGyTrFa.exe
  2⤵
  PID:13956
- C:\Windows\System\OmPzOXp.exe
  C:\Windows\System\OmPzOXp.exe
  2⤵
  PID:13976
- C:\Windows\System\ValeikR.exe
  C:\Windows\System\ValeikR.exe
  2⤵
  PID:13992
- C:\Windows\System\KWzRUmi.exe
  C:\Windows\System\KWzRUmi.exe
  2⤵
  PID:14012
- C:\Windows\System\fJYsmeb.exe
  C:\Windows\System\fJYsmeb.exe
  2⤵
  PID:14032
- C:\Windows\System\kFGZXdD.exe
  C:\Windows\System\kFGZXdD.exe
  2⤵
  PID:14056
- C:\Windows\System\yYioXNM.exe
  C:\Windows\System\yYioXNM.exe
  2⤵
  PID:14076
- C:\Windows\System\oJbVdYB.exe
  C:\Windows\System\oJbVdYB.exe
  2⤵
  PID:14100
- C:\Windows\System\jCLEzga.exe
  C:\Windows\System\jCLEzga.exe
  2⤵
  PID:14120
- C:\Windows\System\jqPWFuC.exe
  C:\Windows\System\jqPWFuC.exe
  2⤵
  PID:14136
- C:\Windows\System\pzzneQR.exe
  C:\Windows\System\pzzneQR.exe
  2⤵
  PID:14168
- C:\Windows\System\qBCzXcc.exe
  C:\Windows\System\qBCzXcc.exe
  2⤵
  PID:14184
- C:\Windows\System\fVKtlMR.exe
  C:\Windows\System\fVKtlMR.exe
  2⤵
  PID:14200
- C:\Windows\System\InNzTxg.exe
  C:\Windows\System\InNzTxg.exe
  2⤵
  PID:14224
- C:\Windows\System\THZeQfd.exe
  C:\Windows\System\THZeQfd.exe
  2⤵
  PID:14240
- C:\Windows\System\TNmdDWG.exe
  C:\Windows\System\TNmdDWG.exe
  2⤵
  PID:14256
- C:\Windows\System\ERfqUnx.exe
  C:\Windows\System\ERfqUnx.exe
  2⤵
  PID:14272
- C:\Windows\System\cLkMMNy.exe
  C:\Windows\System\cLkMMNy.exe
  2⤵
  PID:14300
- C:\Windows\System\jiDMrRb.exe
  C:\Windows\System\jiDMrRb.exe
  2⤵
  PID:14324
- C:\Windows\System\ywdhPzL.exe
  C:\Windows\System\ywdhPzL.exe
  2⤵
  PID:12984
- C:\Windows\System\dvOftyK.exe
  C:\Windows\System\dvOftyK.exe
  2⤵
  PID:13344
- C:\Windows\System\AgRjPxa.exe
  C:\Windows\System\AgRjPxa.exe
  2⤵
  PID:11564
- C:\Windows\System\POLhqmY.exe
  C:\Windows\System\POLhqmY.exe
  2⤵
  PID:13412
- C:\Windows\System\zOetQcz.exe
  C:\Windows\System\zOetQcz.exe
  2⤵
  PID:13340
- C:\Windows\System\xTtmdoR.exe
  C:\Windows\System\xTtmdoR.exe
  2⤵
  PID:13448
- C:\Windows\System\YZogtEQ.exe
  C:\Windows\System\YZogtEQ.exe
  2⤵
  PID:3976
- C:\Windows\System\jqEUJjS.exe
  C:\Windows\System\jqEUJjS.exe
  2⤵
  PID:13592
- C:\Windows\System\FDtcRZc.exe
  C:\Windows\System\FDtcRZc.exe
  2⤵
  PID:13652
- C:\Windows\System\muZvBhj.exe
  C:\Windows\System\muZvBhj.exe
  2⤵
  PID:13620
- C:\Windows\System\MLdtNdm.exe
  C:\Windows\System\MLdtNdm.exe
  2⤵
  PID:13660
- C:\Windows\System\cklOLmU.exe
  C:\Windows\System\cklOLmU.exe
  2⤵
  PID:13564
- C:\Windows\System\UnFMVPt.exe
  C:\Windows\System\UnFMVPt.exe
  2⤵
  PID:13696
- C:\Windows\System\xyuNuSm.exe
  C:\Windows\System\xyuNuSm.exe
  2⤵
  PID:13924
- C:\Windows\System\TIECYpH.exe
  C:\Windows\System\TIECYpH.exe
  2⤵
  PID:13988
- C:\Windows\System\rUfCYSa.exe
  C:\Windows\System\rUfCYSa.exe
  2⤵
  PID:13856
- C:\Windows\System\QrNrtMk.exe
  C:\Windows\System\QrNrtMk.exe
  2⤵
  PID:13884
- C:\Windows\System\kSVEWzB.exe
  C:\Windows\System\kSVEWzB.exe
  2⤵
  PID:14072
- C:\Windows\System\AhUyyPP.exe
  C:\Windows\System\AhUyyPP.exe
  2⤵
  PID:13752
- C:\Windows\System\ucJuKLH.exe
  C:\Windows\System\ucJuKLH.exe
  2⤵
  PID:14528
- C:\Windows\System\EAItiJa.exe
  C:\Windows\System\EAItiJa.exe
  2⤵
  PID:14544
- C:\Windows\System\xBkmufs.exe
  C:\Windows\System\xBkmufs.exe
  2⤵
  PID:14560
- C:\Windows\System\oPThBmC.exe
  C:\Windows\System\oPThBmC.exe
  2⤵
  PID:14576
- C:\Windows\System\IBpuvdD.exe
  C:\Windows\System\IBpuvdD.exe
  2⤵
  PID:14596
- C:\Windows\System\KNivKYI.exe
  C:\Windows\System\KNivKYI.exe
  2⤵
  PID:14620
- C:\Windows\System\PdCahgV.exe
  C:\Windows\System\PdCahgV.exe
  2⤵
  PID:14656
- C:\Windows\System\pyNyGEY.exe
  C:\Windows\System\pyNyGEY.exe
  2⤵
  PID:14688
- C:\Windows\System\OEyHtlQ.exe
  C:\Windows\System\OEyHtlQ.exe
  2⤵
  PID:14716
- C:\Windows\System\KVGaEjJ.exe
  C:\Windows\System\KVGaEjJ.exe
  2⤵
  PID:14764
- C:\Windows\System\bMwQCsQ.exe
  C:\Windows\System\bMwQCsQ.exe
  2⤵
  PID:14796
- C:\Windows\System\kVZBEDe.exe
  C:\Windows\System\kVZBEDe.exe
  2⤵
  PID:14820
- C:\Windows\System\SgzKYhW.exe
  C:\Windows\System\SgzKYhW.exe
  2⤵
  PID:14848
- C:\Windows\System\fDRqemI.exe
  C:\Windows\System\fDRqemI.exe
  2⤵
  PID:15020
- C:\Windows\System\QbKKfDj.exe
  C:\Windows\System\QbKKfDj.exe
  2⤵
  PID:15036
- C:\Windows\System\NFXMGMt.exe
  C:\Windows\System\NFXMGMt.exe
  2⤵
  PID:15080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\Dbncspx.exe

Filesize
2.1MB

MD5
dfd7315708b3da879a4b883c446c1db8

SHA1
0fc13e9a60ee3bc964bef8764c16f9e9101ffa1b

SHA256
0c5b6877dec71c8827da8659c5fc502817d14e6a2f00101eb9e99d1254b23a48

SHA512
a223a2cc60d92ce11967a0bf1aec4511a5ac445573c8ec67d0a664be0fadf0f53ecd6b67952e6cd8db362ffee34ac39886e5de1cdc561582a60e427b241f2f61

Download Submit
C:\Windows\System\EKtapZI.exe

Filesize
2.1MB

MD5
4190e694abcb5acf158f37143e07ea2e

SHA1
648a6a7d2c7b33fcc47550e604b14b1aa49e5361

SHA256
31d9a391f545cce0ee149ce4f082473ea88266cb8e7591c1d7e4774a90fd034d

SHA512
7d18641f9b125ca2b8081c7ebd947b42ca2750838fc2f68413b99786d731b6c48c8a0a81fad4af141314f4650361d79ad0392d3c5cf2ac6e234eb46d88ee4bd2

Download Submit
C:\Windows\System\ExBKNfZ.exe

Filesize
2.1MB

MD5
64386ee1fb406dde47b0a69524ee43c5

SHA1
90228509831c97f759ea8ce81862ce339fbe553b

SHA256
0bc7d588469890a9f22096e03e512f6ec0a3bec85a7726e761d1df599d33d659

SHA512
d4491c6ba60634d53fe3e677272dbca1fa218ed91a1edfdea78e28fc487ec3ce0425d38d8f49e3ceb335819c03ac6890d0c239fc12ebf0bcacaf8077222f01f7

Download Submit
C:\Windows\System\FansCIk.exe

Filesize
2.1MB

MD5
c01555fcfc3ce2af3ca600346464832e

SHA1
2515a09c29c9fc05e37130345432ff11de58212c

SHA256
c6a7f16d34a5d24f177932af3ed26dd2bb05cef138e1a717aa119a23237d905b

SHA512
b027d766b597939d716ef1714fde417457bf75d98a69ef2d1e80c6ec6cb1590c73199722f5c31529e6eeeadbcf4f762fcfb1a0c035d41524c914ba0ee163d69b

Download Submit
C:\Windows\System\GYnKaEo.exe

Filesize
2.1MB

MD5
4ca0ebe338512c82df3f987366227ef0

SHA1
52343b0ebb4ee948ab3d1d7088ae72178f0dfd55

SHA256
5dd2179e2a6a61b1316733a88403413a54a4154f63eac1b1c4c959ae06026cdd

SHA512
94cfc0d1a12807ef1b0eab9e1ddcbce1c405ffd40ccbc978dc5d324322cea21612a5ec16561f1bd66b8e5e3d211043ecd4111a552cdfe37d1c72e98551c15a45

Download Submit
C:\Windows\System\GzOZnkW.exe

Filesize
2.1MB

MD5
80aabad24fbfa89f4186cba584831652

SHA1
091fa834c7f03382277815634af7272d19b8cd05

SHA256
2c184114948d748dd2931313c995c9da442798a0a8e576a1d98f665c0d173b15

SHA512
39c32969855d2824b59f0b8093346a3a3767c8f2e04056f2aa41428b3c4d5e32be80a2321a5105e964a66f73787e10858a7b21fea071d137b5db7dd5e5096720

Download Submit
C:\Windows\System\JglZdui.exe

Filesize
2.1MB

MD5
934823549c86fab0175d95e5780f295a

SHA1
889b7767d3ac7ffae702e21c39b09d5f0541bdfb

SHA256
c25769c1928288f1c0609f62cb85efe7b6bfaf8aa47136e3de5760e161e78ce8

SHA512
1c93dd37059b3fbbc0d976f3094f44e3a49ff75343cf9f88bc1fa39df2ea39b5910e480f288ebc55adcf131dc97f84fbc12c84589de81d1c19fc16c333a7551e

Download Submit
C:\Windows\System\MbmaEhc.exe

Filesize
2.1MB

MD5
775b7749e0d06b66d1583d59c3edf859

SHA1
a4de4ad8baf7c959f9e7320816990e0cafd6a501

SHA256
3e8f826496a8c7124b2b1d91bc5e6baf151d94c3f7f0160ef9c79ad890b37605

SHA512
9346c1d8cad69b567ee6d35e411885abb64431c1746a1824917344b4138ebf9ea77ba13c744b31e9314cef2d537ae57d4f6fb9c8cd18064357267bffc94405cd

Download Submit
C:\Windows\System\OxMAWUC.exe

Filesize
2.1MB

MD5
16fb71067d33dd5f40695e54fa26a24b

SHA1
89d461160b7d182fd9796a372211064a2286bd65

SHA256
9c2ea1e106ae1a4ddefce38b2825588c044c6b4714fa07cdcd0a8f55ca4e5aa8

SHA512
9446f48a757117470affe80ed268c4b99be53dd0d44067bd2edf2844d35720d7c2faf91432faa83a970673a013ae811c16b45246c4e0848e766f7b9de2f1cb74

Download Submit
C:\Windows\System\PljdpHX.exe

Filesize
2.1MB

MD5
3db1794dba07535228dff1b360a7368a

SHA1
4c34065ea622488ce8d840a71e55f8b975c650f7

SHA256
fabfb084bc883be69e0d41b37aada9ad7bd31df35eb58bfc07dcd7abd5e5b2c8

SHA512
94323454d95d38a3874e9d3c2d985a82e1963cde1c0a9883981b5c012fc66599e61ecaac1792bd86bbe755990d48f141d43d531a3ccb0c911ebbadd9524f2362

Download Submit
C:\Windows\System\PmoRQtj.exe

Filesize
2.1MB

MD5
87af890e7179cf3719c71d2e0133fff6

SHA1
a6d134cc7b4a40a6f32b48a8d2ed05032c5050da

SHA256
c76f911c6dda888412f46b08981c9c3328d4ec0e955c936a5f7148b6831c4e5c

SHA512
88d09e8552a62453ed1e00aa0f559291c7fc2629712272244f2388bb551e411f3196258e846c4553906aab926e88f941b2a5351a3813bce41c5bed35f637db3d

Download Submit
C:\Windows\System\QJucydj.exe

Filesize
2.1MB

MD5
d8c9dad62fa5658395e48379182f21b4

SHA1
8271ce4e1ef960e77479594ceed018ccda210a4b

SHA256
95ea8eeef2e15d1770feae6d04a423b4d654ba8e7dacc9855bbc6da09b8e759b

SHA512
7d6a4b0705c081967211ce08f9f5c0969c4e379db8d0883e4c218330cbf364d2521a593a2c9ec28f5523d94fc3a0295645483aa8b5c5f498f219eb8936e19f5f

Download Submit
C:\Windows\System\Qwyobqi.exe

Filesize
2.1MB

MD5
c8a82eb5535321353435aced9b04b8d1

SHA1
1de99c726829f8212202ccf290884bffae9056e5

SHA256
c67ff4ddbfba724778e4772500ba9f6809c992614493588d1fce099a18b3e24b

SHA512
eb4c6d234a3ed34e8b1fc94a62646c6eafb8df079ef9f2577681e6aef8ac99e8df1745017134ad3ef96c452badb9845e43017c762c8cc3ca1488d7043ed86114

Download Submit
C:\Windows\System\RtKjSYE.exe

Filesize
2.1MB

MD5
df1e929b1015fc5dcb505831193941dc

SHA1
c3a862d97313036cf530486da4889ae5a70c2f0d

SHA256
6ecf62b45df7910120a9a7aa08e2d4faf0ee9b24b9076364aafdb53796eddec8

SHA512
7e9aa140c59cbc79364bd6e508f3f3d776b68d661022e1b5101cc2dee60d07aac9b8bc78fd6fbfd8d4475ff96f6aa9cdc3ed05d14527a89eea20657e2c5a6483

Download Submit
C:\Windows\System\SUknaRA.exe

Filesize
2.1MB

MD5
f7e7811809433778bfaa5ee74fa77e3d

SHA1
436883169789cb9eac423e6b8926b210e9ffc4fd

SHA256
2562c3f8ce05bc91a97135d0af950af80fbe9aba6829343192e534115ff5e601

SHA512
381ccf1579b45d1ca58709ec8afa6afcdae236e9519ebeab1c872b10fb669b69e2706e1d3dc4c692d0a6c0b05b5646d92a6c0df7deb78a7e721851c349c48368

Download Submit
C:\Windows\System\UpzVrwd.exe

Filesize
2.1MB

MD5
8488ca4af42a6c2f54775f1d557a5f1d

SHA1
8fe6520d4a028fd2281e6b808e85d7db20e96bc3

SHA256
8d5fd66d8524a060e998c77e665defee3a05b1c739eb275639e28a2efc8bea55

SHA512
a90497206b0699bae4a4821242d9fe3d1c1096ff4499a2b56b80964cb90c4a1b345921c4c0b3cda59cd5a736d2acdd212682eed4bec97c8609af6ce423b9b4f7

Download Submit
C:\Windows\System\WLgmFpL.exe

Filesize
2.1MB

MD5
6a0658bb826bf0e47fea60c78e497bb1

SHA1
c18d550bd3ab55cf93bc951aecb6e676fa4a6211

SHA256
9616592a80458ce01968930b085a36941ee0e0af1d384da81e892f59afd05c2a

SHA512
b86f1727d0221d895950daeee5ff560e31f2dc4a1d5507f72547d77fcc9b35d9812ed75cbd1a08af32b268a65b1fb76dc1dc4051655b6b662e8d339d89ddb637

Download Submit
C:\Windows\System\WlKVBHu.exe

Filesize
2.1MB

MD5
e30eb7c72514ebc8891082b2be7f1a9c

SHA1
97baccbeca6246135b6020bb5cbc49b76da8519b

SHA256
1bb50b38be8b6486c7841b1419325c391c2ce1dce639c4f932f7a8972fd02c9a

SHA512
f617abb03185796111115d05fd91da8dfa6add50963134e3732a64575073658045e9b60f5ea7d27bbb28407b9834737a215bc68f5d6014a4ec9a0f15f92b2715

Download Submit
C:\Windows\System\YviHRYU.exe

Filesize
2.1MB

MD5
271d45348ec3539e4ba0d9710b4938b8

SHA1
5d4777ca9dfacc991e915c850236e780b189be2f

SHA256
dbba4b345b5d0bc49ff209326330c0796b75a77ecca2b723820085e2230bf5ea

SHA512
61d786193eac3320e20c6c263ddf79a56f6017c1358c898efa778595d6031e5635f3b8757bb96610c567c67c14e8db380774a6dcee8465c8a3057dcd637b8c59

Download Submit
C:\Windows\System\akXYsBM.exe

Filesize
2.1MB

MD5
576e1c2aad9cbe380112341e158878a1

SHA1
c7eb2a630c0c18251481164ccf70ae05dd6c8400

SHA256
077d6ce0350184b005c5a1b892289152e5c2c8a183201fa4b6bdc157fa6a5912

SHA512
39c4e595f207f785b3fc59848d8f1ec8cdf18efd1972e95b29a1babeaee810023f87f5233f25523b7d4889a9b1b3a2d20d34a3442cf2a082367f89ae7377010c

Download Submit
C:\Windows\System\eOPrwpv.exe

Filesize
2.1MB

MD5
c6f35f299ee613affeabf862a05b339d

SHA1
b70bd5f1033a7e1392513a45f5d0442a34a57b0b

SHA256
f89d0ec55b7f607cff060d940750c6377e92f5db733dd86a1f8d9f0334ff086a

SHA512
6c67f2dbacd4773087b78a5efe5f4cdb3604af77b853ec0dfd9728b7e69d6e8627cad1b31122642cc1718fdc77b31de19a22951cdc7894f6e60102e51fa091f7

Download Submit
C:\Windows\System\fiPAWXv.exe

Filesize
2.1MB

MD5
6efc67bb3aa0849f99c283e0ce17f219

SHA1
8b30ba54b0ed2a991be59b2146d3f3c44d6d5075

SHA256
c1a7c6f78e0d47715a5c9a5ab4d52ad8724658d228e9e9bd2a7cb765e572caeb

SHA512
4e04bf9dae7cea554f2922ffc60064cf9701e0cfab3303c6b35ecd929b803a9cec045ad6f8ebf957765498b5ed8caecda3a6e00bcc8c9be969c7d20663404097

Download Submit
C:\Windows\System\jAllFZQ.exe

Filesize
2.1MB

MD5
45ecd0c50a39f59d430fe60a1dbfbf48

SHA1
eeaa45b3bea0f49417fe48727a0708a4e49255f3

SHA256
f0791fabae9b2605bb5d1ba57c6ac43982ed3c65a6bd0788d178bb8f15777a32

SHA512
d2315b93a9928c1ddb69ad3cf8ccf0bd69197c37a82a7a97852b065c2961a38d1dc19e2b8702907adbbfa1475468e378fa9a1f3e5b2300ea3651394c4d0e73b9

Download Submit
C:\Windows\System\jGUlTEs.exe

Filesize
2.1MB

MD5
2ba2dbbe57030feb3768cfe1f5de650d

SHA1
da4ccb7ee7488d759ca2b2408aa7134a6ef4f10a

SHA256
aa6f6a27b1fd86445b1b06b594ee33160919b811665a0943f8aae8d57b3ae678

SHA512
87d2d1ff7220b98a0f8967e233add59d58252274fd9f19bfe8db5ed5fd37985a80ffae5ca54acd1210f8144b69be0a248e5013b02c65b6e1bc5401c27faeab13

Download Submit
C:\Windows\System\jdKYCLv.exe

Filesize
2.1MB

MD5
c7ae2de8853dd6333d19257ee886dc88

SHA1
a0823d9546d3daa30680a01d53a461d9bc237dd6

SHA256
8d26e5ca94316423baeb76b4fd1698b99b49487884405a396f5a7f905edc8e02

SHA512
dee26b900b019b1822332e3a5a6973e72dc61c025938e09a56e5fadca9c2dcb0817fa39b7af04376a5cb91d7c6ad161a8ca78d60e912b9085148606aff622b2a

Download Submit
C:\Windows\System\kjQBnrA.exe

Filesize
2.1MB

MD5
68dbf75fb7d75578846a4afc819fbfd8

SHA1
79501ec24bacc4e086728465cdfee6e6d643825c

SHA256
5b0d88a3525af6f0f20ac5585566ceb7f970380d9be46477c0798b1ffeca1fc9

SHA512
9c53f62c5608a6eab9d0eb5a910787a05d4002e774efba920c419c8fb41fe45c4437de2d4bc415e5c8a24260f5e8b7f17bcf4d32a3be14217853776a38bb9b23

Download Submit
C:\Windows\System\lUuuIIf.exe

Filesize
2.1MB

MD5
69a395b2c2fe5740784f6af7198da0f1

SHA1
ed5f457f87704ad9398210569832e203f7bf64e2

SHA256
bcef20608be252ee68a69da7cff27e5fde95c042edc08e44b77c1645b9054d4b

SHA512
a391dbd4c0c46722ad99857d76a365c7301e22e1af792abf5316b4d04234f82a592b598314b5606fb19d0d7617bb4aa1a23d9ab3711298b6fe99e30d192672de

Download Submit
C:\Windows\System\qNfztIc.exe

Filesize
2.1MB

MD5
5b52541170b9778e500e3cda869623ac

SHA1
00bf3b4397242f433a4901350878f52fc025478e

SHA256
9d7df3470f936c6f1c662300261f5dff3f218aa70633bff11a8132e6410d4fd4

SHA512
67d1ce2013005d58d98c2283b664cb9ca80d495cc0eff37648b4578c5e3355d2f808159b7b8d26a65c21a03d584bf89b5656ab7e9f16b398f941146b4c986d9e

Download Submit
C:\Windows\System\rkMFGth.exe

Filesize
2.1MB

MD5
d3277ba22f7d07d0aa5a11732938b015

SHA1
2999fd95074dc807923ff7e29cbc5270b252bab7

SHA256
bd91fa7d468fc0c6d07c7fb3138dc16fb460e5ad35d42c36212494c4193957ad

SHA512
9f7593ccb5f76024b424d628fb989d35fe0a5c771541f433ce2dccbf16db8a399ca134da35ead9cde4fff4592dda9aff40b37bcc56c3e77b8c5de33b8105a4c3

Download Submit
C:\Windows\System\umVxtvY.exe

Filesize
2.1MB

MD5
c8472d1ac34d22c8a6ce5249f59abed0

SHA1
876239878dbec33e491f3bab1b6e5ca25ac24e3e

SHA256
20ef304bef979031b9a99aa61d3864e4d53a5a18044c2d776b06bb0c724baa2b

SHA512
ce9979527216af8551cf985f90e9a394e45ca935cef91aceb49bf53177716c4ec96b5a43307fb03b32015752a86d527ebb88ab755ca5366b84a60cb5ecd4189d

Download Submit
C:\Windows\System\wPCFRcH.exe

Filesize
2.1MB

MD5
ae4509f582eb4b222d04ae8d55c45686

SHA1
3a5a972f0860e00053fee5a6c0c5b88aed13e614

SHA256
8cd2eaef01213ae695539c83906dfc2e19207965c907a7a423fdffdd2d6b77b2

SHA512
b041c9b8167add66e9a0d3cc3b147796b9f60419e58ab4c09abae91a1fff505cfb35bf36f7da99be9d0be35af7863f2080af6a80e660833dad5cb769e8ba6737

Download Submit
C:\Windows\System\ywZeiYQ.exe

Filesize
2.1MB

MD5
b3c400a029c73464d7640a476bc2da77

SHA1
cd14e83785bfe36a219f9b6e85f849e72d4501e8

SHA256
5c4a2737c125e23454bd46feb69146548845c81647ea2156aea3ffe529fded6e

SHA512
a9f03d9b93beb985706facc74953c02cbb2f924e8ff741af9b22ca01fe9a96ee634ab529ed49c47594142531f041a870e770023c6469eb23e929c16c8134ddf4

Download Submit
memory/396-267-0x00007FF7A6090000-0x00007FF7A63E4000-memory.dmp

Filesize
3.3MB

Download
memory/396-2171-0x00007FF7A6090000-0x00007FF7A63E4000-memory.dmp

Filesize
3.3MB

Download
memory/412-0-0x00007FF7CA2E0000-0x00007FF7CA634000-memory.dmp

Filesize
3.3MB

Download
memory/412-1-0x0000020A5D700000-0x0000020A5D710000-memory.dmp

Filesize
64KB

Download
memory/512-2168-0x00007FF6C8E50000-0x00007FF6C91A4000-memory.dmp

Filesize
3.3MB

Download
memory/512-265-0x00007FF6C8E50000-0x00007FF6C91A4000-memory.dmp

Filesize
3.3MB

Download
memory/628-2165-0x00007FF71BAF0000-0x00007FF71BE44000-memory.dmp

Filesize
3.3MB

Download
memory/628-279-0x00007FF71BAF0000-0x00007FF71BE44000-memory.dmp

Filesize
3.3MB

Download
memory/760-266-0x00007FF6F9530000-0x00007FF6F9884000-memory.dmp

Filesize
3.3MB

Download
memory/760-2180-0x00007FF6F9530000-0x00007FF6F9884000-memory.dmp

Filesize
3.3MB

Download
memory/868-2172-0x00007FF777BC0000-0x00007FF777F14000-memory.dmp

Filesize
3.3MB

Download
memory/868-275-0x00007FF777BC0000-0x00007FF777F14000-memory.dmp

Filesize
3.3MB

Download
memory/1096-26-0x00007FF6A8D40000-0x00007FF6A9094000-memory.dmp

Filesize
3.3MB

Download
memory/1096-1952-0x00007FF6A8D40000-0x00007FF6A9094000-memory.dmp

Filesize
3.3MB

Download
memory/1224-2188-0x00007FF67CA10000-0x00007FF67CD64000-memory.dmp

Filesize
3.3MB

Download
memory/1224-258-0x00007FF67CA10000-0x00007FF67CD64000-memory.dmp

Filesize
3.3MB

Download
memory/1856-2170-0x00007FF7F3580000-0x00007FF7F38D4000-memory.dmp

Filesize
3.3MB

Download
memory/1856-307-0x00007FF7F3580000-0x00007FF7F38D4000-memory.dmp

Filesize
3.3MB

Download
memory/2072-2169-0x00007FF759460000-0x00007FF7597B4000-memory.dmp

Filesize
3.3MB

Download
memory/2072-308-0x00007FF759460000-0x00007FF7597B4000-memory.dmp

Filesize
3.3MB

Download
memory/2444-2187-0x00007FF7C0590000-0x00007FF7C08E4000-memory.dmp

Filesize
3.3MB

Download
memory/2444-256-0x00007FF7C0590000-0x00007FF7C08E4000-memory.dmp

Filesize
3.3MB

Download
memory/2516-2179-0x00007FF7AC730000-0x00007FF7ACA84000-memory.dmp

Filesize
3.3MB

Download
memory/2516-312-0x00007FF7AC730000-0x00007FF7ACA84000-memory.dmp

Filesize
3.3MB

Download
memory/2688-309-0x00007FF6A20F0000-0x00007FF6A2444000-memory.dmp

Filesize
3.3MB

Download
memory/2688-2174-0x00007FF6A20F0000-0x00007FF6A2444000-memory.dmp

Filesize
3.3MB

Download
memory/3524-294-0x00007FF629860000-0x00007FF629BB4000-memory.dmp

Filesize
3.3MB

Download
memory/3524-2177-0x00007FF629860000-0x00007FF629BB4000-memory.dmp

Filesize
3.3MB

Download
memory/3552-285-0x00007FF77EE90000-0x00007FF77F1E4000-memory.dmp

Filesize
3.3MB

Download
memory/3552-2182-0x00007FF77EE90000-0x00007FF77F1E4000-memory.dmp

Filesize
3.3MB

Download
memory/3768-1944-0x00007FF6658F0000-0x00007FF665C44000-memory.dmp

Filesize
3.3MB

Download
memory/3768-23-0x00007FF6658F0000-0x00007FF665C44000-memory.dmp

Filesize
3.3MB

Download
memory/3844-287-0x00007FF7B37B0000-0x00007FF7B3B04000-memory.dmp

Filesize
3.3MB

Download
memory/3844-2183-0x00007FF7B37B0000-0x00007FF7B3B04000-memory.dmp

Filesize
3.3MB

Download
memory/3876-252-0x00007FF6CE830000-0x00007FF6CEB84000-memory.dmp

Filesize
3.3MB

Download
memory/3876-2164-0x00007FF6CE830000-0x00007FF6CEB84000-memory.dmp

Filesize
3.3MB

Download
memory/4168-2173-0x00007FF6BBA90000-0x00007FF6BBDE4000-memory.dmp

Filesize
3.3MB

Download
memory/4168-249-0x00007FF6BBA90000-0x00007FF6BBDE4000-memory.dmp

Filesize
3.3MB

Download
memory/4176-2176-0x00007FF6086B0000-0x00007FF608A04000-memory.dmp

Filesize
3.3MB

Download
memory/4176-268-0x00007FF6086B0000-0x00007FF608A04000-memory.dmp

Filesize
3.3MB

Download
memory/4192-291-0x00007FF7D0930000-0x00007FF7D0C84000-memory.dmp

Filesize
3.3MB

Download
memory/4192-2184-0x00007FF7D0930000-0x00007FF7D0C84000-memory.dmp

Filesize
3.3MB

Download
memory/4428-14-0x00007FF6EAB80000-0x00007FF6EAED4000-memory.dmp

Filesize
3.3MB

Download
memory/4428-1919-0x00007FF6EAB80000-0x00007FF6EAED4000-memory.dmp

Filesize
3.3MB

Download
memory/4444-289-0x00007FF7A6FE0000-0x00007FF7A7334000-memory.dmp

Filesize
3.3MB

Download
memory/4444-2166-0x00007FF7A6FE0000-0x00007FF7A7334000-memory.dmp

Filesize
3.3MB

Download
memory/4452-30-0x00007FF6D5B20000-0x00007FF6D5E74000-memory.dmp

Filesize
3.3MB

Download
memory/4452-2186-0x00007FF6D5B20000-0x00007FF6D5E74000-memory.dmp

Filesize
3.3MB

Download
memory/4560-286-0x00007FF63A990000-0x00007FF63ACE4000-memory.dmp

Filesize
3.3MB

Download
memory/4560-2167-0x00007FF63A990000-0x00007FF63ACE4000-memory.dmp

Filesize
3.3MB

Download
memory/4764-277-0x00007FF694BC0000-0x00007FF694F14000-memory.dmp

Filesize
3.3MB

Download
memory/4764-2185-0x00007FF694BC0000-0x00007FF694F14000-memory.dmp

Filesize
3.3MB

Download
memory/4852-2178-0x00007FF7B95C0000-0x00007FF7B9914000-memory.dmp

Filesize
3.3MB

Download
memory/4852-293-0x00007FF7B95C0000-0x00007FF7B9914000-memory.dmp

Filesize
3.3MB

Download
memory/4904-284-0x00007FF721A00000-0x00007FF721D54000-memory.dmp

Filesize
3.3MB

Download
memory/4904-2175-0x00007FF721A00000-0x00007FF721D54000-memory.dmp

Filesize
3.3MB

Download
memory/4940-1835-0x00007FF63C4A0000-0x00007FF63C7F4000-memory.dmp

Filesize
3.3MB

Download
memory/4940-8-0x00007FF63C4A0000-0x00007FF63C7F4000-memory.dmp

Filesize
3.3MB

Download
memory/4956-2181-0x00007FF7B8210000-0x00007FF7B8564000-memory.dmp

Filesize
3.3MB

Download
memory/4956-272-0x00007FF7B8210000-0x00007FF7B8564000-memory.dmp

Filesize
3.3MB

Download