xmrig | c6ef6d1a089e53552bec55c559e3e4e49359267ce7dd18b88cdb1b5ace70e284

Analysis

max time kernel
129s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
Size

2.0MB
MD5

18449d7f413576019a3b8e7565dfd570
SHA1

8d132ec94b61cee0b264ebf6d6d3572cb5da09a7
SHA256

c6ef6d1a089e53552bec55c559e3e4e49359267ce7dd18b88cdb1b5ace70e284
SHA512

2033f212606b68e58579a48b23207d53d057b800d27a47b666e8cf375431f05954284f6b72b53f1b9c9ed0d54fb9052dea737c635a886459998432009c424361
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXfh:BemTLkNdfE0pZrM

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2236-0-0x00007FF6DEFD0000-0x00007FF6DF324000-memory.dmp	xmrig
behavioral2/files/0x0008000000022f51-5.dat	xmrig
behavioral2/files/0x00070000000233f2-34.dat	xmrig
behavioral2/files/0x00070000000233f8-49.dat	xmrig
behavioral2/files/0x00070000000233ff-76.dat	xmrig
behavioral2/memory/3228-113-0x00007FF6461C0000-0x00007FF646514000-memory.dmp	xmrig
behavioral2/memory/4036-148-0x00007FF7031D0000-0x00007FF703524000-memory.dmp	xmrig
behavioral2/memory/3488-169-0x00007FF66EA20000-0x00007FF66ED74000-memory.dmp	xmrig
behavioral2/memory/4704-182-0x00007FF6BF4B0000-0x00007FF6BF804000-memory.dmp	xmrig
behavioral2/memory/1212-187-0x00007FF702C80000-0x00007FF702FD4000-memory.dmp	xmrig
behavioral2/memory/2484-193-0x00007FF7F23B0000-0x00007FF7F2704000-memory.dmp	xmrig
behavioral2/memory/4916-197-0x00007FF6A5AC0000-0x00007FF6A5E14000-memory.dmp	xmrig
behavioral2/memory/3720-196-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp	xmrig
behavioral2/memory/4928-195-0x00007FF78C9C0000-0x00007FF78CD14000-memory.dmp	xmrig
behavioral2/memory/4700-194-0x00007FF738FC0000-0x00007FF739314000-memory.dmp	xmrig
behavioral2/memory/3924-192-0x00007FF713970000-0x00007FF713CC4000-memory.dmp	xmrig
behavioral2/memory/3884-191-0x00007FF7A26F0000-0x00007FF7A2A44000-memory.dmp	xmrig
behavioral2/memory/748-190-0x00007FF7BDC30000-0x00007FF7BDF84000-memory.dmp	xmrig
behavioral2/memory/3680-189-0x00007FF76DFD0000-0x00007FF76E324000-memory.dmp	xmrig
behavioral2/memory/3460-188-0x00007FF6EB8C0000-0x00007FF6EBC14000-memory.dmp	xmrig
behavioral2/memory/676-186-0x00007FF729CC0000-0x00007FF72A014000-memory.dmp	xmrig
behavioral2/memory/3764-185-0x00007FF6E4AC0000-0x00007FF6E4E14000-memory.dmp	xmrig
behavioral2/memory/2756-184-0x00007FF75DCA0000-0x00007FF75DFF4000-memory.dmp	xmrig
behavioral2/memory/4584-183-0x00007FF6581F0000-0x00007FF658544000-memory.dmp	xmrig
behavioral2/memory/4848-180-0x00007FF731740000-0x00007FF731A94000-memory.dmp	xmrig
behavioral2/memory/4560-179-0x00007FF7CB000000-0x00007FF7CB354000-memory.dmp	xmrig
behavioral2/memory/3520-177-0x00007FF612490000-0x00007FF6127E4000-memory.dmp	xmrig
behavioral2/memory/5040-176-0x00007FF65AAB0000-0x00007FF65AE04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-174.dat	xmrig
behavioral2/files/0x000700000002340d-172.dat	xmrig
behavioral2/files/0x000700000002340f-165.dat	xmrig
behavioral2/files/0x000700000002340e-163.dat	xmrig
behavioral2/files/0x0007000000023407-161.dat	xmrig
behavioral2/files/0x000700000002340c-159.dat	xmrig
behavioral2/files/0x0007000000023406-157.dat	xmrig
behavioral2/files/0x000700000002340b-155.dat	xmrig
behavioral2/files/0x000700000002340a-153.dat	xmrig
behavioral2/files/0x0007000000023409-151.dat	xmrig
behavioral2/files/0x0007000000023408-149.dat	xmrig
behavioral2/memory/4660-147-0x00007FF7C5350000-0x00007FF7C56A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023404-144.dat	xmrig
behavioral2/files/0x0007000000023402-141.dat	xmrig
behavioral2/memory/364-135-0x00007FF706AD0000-0x00007FF706E24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023410-146.dat	xmrig
behavioral2/files/0x00070000000233fd-121.dat	xmrig
behavioral2/files/0x0007000000023401-119.dat	xmrig
behavioral2/files/0x00070000000233fa-112.dat	xmrig
behavioral2/files/0x0007000000023405-105.dat	xmrig
behavioral2/files/0x0007000000023403-97.dat	xmrig
behavioral2/files/0x00070000000233f6-96.dat	xmrig
behavioral2/files/0x00070000000233f5-92.dat	xmrig
behavioral2/files/0x00070000000233fb-83.dat	xmrig
behavioral2/files/0x00070000000233fc-82.dat	xmrig
behavioral2/files/0x0007000000023400-80.dat	xmrig
behavioral2/memory/4044-71-0x00007FF7B10F0000-0x00007FF7B1444000-memory.dmp	xmrig
behavioral2/memory/3432-64-0x00007FF62FD70000-0x00007FF6300C4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fe-63.dat	xmrig
behavioral2/files/0x00070000000233f9-52.dat	xmrig
behavioral2/files/0x00070000000233f3-50.dat	xmrig
behavioral2/files/0x00070000000233f7-45.dat	xmrig
behavioral2/memory/1820-38-0x00007FF6DF760000-0x00007FF6DFAB4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f4-25.dat	xmrig
behavioral2/memory/4220-18-0x00007FF67E2F0000-0x00007FF67E644000-memory.dmp	xmrig
behavioral2/memory/2236-2052-0x00007FF6DEFD0000-0x00007FF6DF324000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4220	lUUFLyt.exe
1820	ltmpjxI.exe
2484	AzuUEvc.exe
3432	aMZjHrv.exe
4044	QbwhBvX.exe
3228	LczLJeS.exe
364	naFUrYr.exe
4700	DjZxtVN.exe
4660	EpJVcWM.exe
4036	esPaljv.exe
3488	SjMnduV.exe
5040	Cboxquq.exe
3520	RPjgBiF.exe
4928	ZoHGfQc.exe
4560	jDbEhQr.exe
4848	NAIZJEZ.exe
4704	hvGSDoh.exe
4584	YskfXvH.exe
2756	XvkniTO.exe
3764	iTzGxTQ.exe
676	CzSKsIT.exe
1212	BGwluvG.exe
3720	fvdMkxb.exe
3460	kWHyGYe.exe
3680	YNXCQlk.exe
748	FQIqifu.exe
3884	WXUbHMo.exe
3924	AHrlhfi.exe
4916	sYNwkib.exe
2108	jSjtbfT.exe
1504	itLcyaM.exe
4064	AwzfYSB.exe
2152	SfngaLq.exe
944	DzAjXbW.exe
2968	UqLLIHW.exe
3112	VuWFWbx.exe
4864	WoacKtH.exe
4876	mSKDqbL.exe
4416	dBzjOqr.exe
4596	gJYBJub.exe
1204	rWYqgaz.exe
4480	mbXjRRP.exe
2120	WzcNvpW.exe
2132	ENgQEjX.exe
4568	qahOESp.exe
2800	syUveSe.exe
1332	NQVQBuS.exe
4504	Nqsctiy.exe
3960	kGaqdxZ.exe
1740	CKaxBpd.exe
4712	cPOmlcl.exe
1732	AGJymZD.exe
2932	vmzbuox.exe
2452	nTMjjMw.exe
2308	BEnQdgD.exe
1112	TXQIexp.exe
2368	yBYccrK.exe
2276	FRvEwWs.exe
4252	LVMSsZC.exe
1708	JNkuAiF.exe
1248	jumpICF.exe
3200	GviZRGt.exe
2032	NZuLsrv.exe
4032	kbLkgeE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2236-0-0x00007FF6DEFD0000-0x00007FF6DF324000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-5.dat	upx
behavioral2/files/0x00070000000233f2-34.dat	upx
behavioral2/files/0x00070000000233f8-49.dat	upx
behavioral2/files/0x00070000000233ff-76.dat	upx
behavioral2/memory/3228-113-0x00007FF6461C0000-0x00007FF646514000-memory.dmp	upx
behavioral2/memory/4036-148-0x00007FF7031D0000-0x00007FF703524000-memory.dmp	upx
behavioral2/memory/3488-169-0x00007FF66EA20000-0x00007FF66ED74000-memory.dmp	upx
behavioral2/memory/4704-182-0x00007FF6BF4B0000-0x00007FF6BF804000-memory.dmp	upx
behavioral2/memory/1212-187-0x00007FF702C80000-0x00007FF702FD4000-memory.dmp	upx
behavioral2/memory/2484-193-0x00007FF7F23B0000-0x00007FF7F2704000-memory.dmp	upx
behavioral2/memory/4916-197-0x00007FF6A5AC0000-0x00007FF6A5E14000-memory.dmp	upx
behavioral2/memory/3720-196-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp	upx
behavioral2/memory/4928-195-0x00007FF78C9C0000-0x00007FF78CD14000-memory.dmp	upx
behavioral2/memory/4700-194-0x00007FF738FC0000-0x00007FF739314000-memory.dmp	upx
behavioral2/memory/3924-192-0x00007FF713970000-0x00007FF713CC4000-memory.dmp	upx
behavioral2/memory/3884-191-0x00007FF7A26F0000-0x00007FF7A2A44000-memory.dmp	upx
behavioral2/memory/748-190-0x00007FF7BDC30000-0x00007FF7BDF84000-memory.dmp	upx
behavioral2/memory/3680-189-0x00007FF76DFD0000-0x00007FF76E324000-memory.dmp	upx
behavioral2/memory/3460-188-0x00007FF6EB8C0000-0x00007FF6EBC14000-memory.dmp	upx
behavioral2/memory/676-186-0x00007FF729CC0000-0x00007FF72A014000-memory.dmp	upx
behavioral2/memory/3764-185-0x00007FF6E4AC0000-0x00007FF6E4E14000-memory.dmp	upx
behavioral2/memory/2756-184-0x00007FF75DCA0000-0x00007FF75DFF4000-memory.dmp	upx
behavioral2/memory/4584-183-0x00007FF6581F0000-0x00007FF658544000-memory.dmp	upx
behavioral2/memory/4848-180-0x00007FF731740000-0x00007FF731A94000-memory.dmp	upx
behavioral2/memory/4560-179-0x00007FF7CB000000-0x00007FF7CB354000-memory.dmp	upx
behavioral2/memory/3520-177-0x00007FF612490000-0x00007FF6127E4000-memory.dmp	upx
behavioral2/memory/5040-176-0x00007FF65AAB0000-0x00007FF65AE04000-memory.dmp	upx
behavioral2/files/0x0007000000023411-174.dat	upx
behavioral2/files/0x000700000002340d-172.dat	upx
behavioral2/files/0x000700000002340f-165.dat	upx
behavioral2/files/0x000700000002340e-163.dat	upx
behavioral2/files/0x0007000000023407-161.dat	upx
behavioral2/files/0x000700000002340c-159.dat	upx
behavioral2/files/0x0007000000023406-157.dat	upx
behavioral2/files/0x000700000002340b-155.dat	upx
behavioral2/files/0x000700000002340a-153.dat	upx
behavioral2/files/0x0007000000023409-151.dat	upx
behavioral2/files/0x0007000000023408-149.dat	upx
behavioral2/memory/4660-147-0x00007FF7C5350000-0x00007FF7C56A4000-memory.dmp	upx
behavioral2/files/0x0007000000023404-144.dat	upx
behavioral2/files/0x0007000000023402-141.dat	upx
behavioral2/memory/364-135-0x00007FF706AD0000-0x00007FF706E24000-memory.dmp	upx
behavioral2/files/0x0007000000023410-146.dat	upx
behavioral2/files/0x00070000000233fd-121.dat	upx
behavioral2/files/0x0007000000023401-119.dat	upx
behavioral2/files/0x00070000000233fa-112.dat	upx
behavioral2/files/0x0007000000023405-105.dat	upx
behavioral2/files/0x0007000000023403-97.dat	upx
behavioral2/files/0x00070000000233f6-96.dat	upx
behavioral2/files/0x00070000000233f5-92.dat	upx
behavioral2/files/0x00070000000233fb-83.dat	upx
behavioral2/files/0x00070000000233fc-82.dat	upx
behavioral2/files/0x0007000000023400-80.dat	upx
behavioral2/memory/4044-71-0x00007FF7B10F0000-0x00007FF7B1444000-memory.dmp	upx
behavioral2/memory/3432-64-0x00007FF62FD70000-0x00007FF6300C4000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-63.dat	upx
behavioral2/files/0x00070000000233f9-52.dat	upx
behavioral2/files/0x00070000000233f3-50.dat	upx
behavioral2/files/0x00070000000233f7-45.dat	upx
behavioral2/memory/1820-38-0x00007FF6DF760000-0x00007FF6DFAB4000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-25.dat	upx
behavioral2/memory/4220-18-0x00007FF67E2F0000-0x00007FF67E644000-memory.dmp	upx
behavioral2/memory/2236-2052-0x00007FF6DEFD0000-0x00007FF6DF324000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kbLkgeE.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\UqncXeU.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\MWlUJOv.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\sOeCdtC.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\TgNQUpw.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\dQvRguu.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\GviZRGt.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\HwjBgTY.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\BISIzwj.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\HrJhpmc.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\NowSOoT.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\aUxNmLS.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\tiUeWxo.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\kbnLjyl.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\SYCnyxd.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\jumpICF.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\EegFwmD.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\bfEnXrX.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\unkLcWc.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\HGpVCLi.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\djkozXT.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\HacCvOl.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\GVOHyqZ.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\wRuvaGB.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\BrPZDZS.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\yiVaAsM.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\TjBkopZ.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\AGJymZD.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\hcFvVQm.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\xKFaSjl.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\XoxKkKW.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\yVliaOA.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\howumDe.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\SoyTPqg.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\iDLHlXP.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\EedeKzM.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\OyXVkbe.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\TXQIexp.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\fgKKsIt.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\yIUXOFL.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\vMlGSri.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\IdIytTv.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\EtJGmfb.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\CaCCIhh.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\SHpeDIt.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\IghmcqI.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\ALnZeig.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\OyhkAfY.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\ENfGvnl.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\AIsJHdh.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\bBXqINR.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\fLLaRhD.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\LoNMHXy.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\izstmBc.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\hBIDuBA.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\DobvQJX.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\BhMLQHe.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\CpAaYth.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\uNHhHlo.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\SfngaLq.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\lrBJjLK.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\uZQQorQ.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\BQEdgMd.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
File created	C:\Windows\System\NBBeiBe.exe	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4220	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	84
PID 2236 wrote to memory of 4220	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	84
PID 2236 wrote to memory of 1820	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	85
PID 2236 wrote to memory of 1820	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	85
PID 2236 wrote to memory of 2484	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	86
PID 2236 wrote to memory of 2484	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	86
PID 2236 wrote to memory of 3432	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	87
PID 2236 wrote to memory of 3432	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	87
PID 2236 wrote to memory of 4044	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	88
PID 2236 wrote to memory of 4044	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	88
PID 2236 wrote to memory of 3228	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	89
PID 2236 wrote to memory of 3228	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	89
PID 2236 wrote to memory of 364	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	90
PID 2236 wrote to memory of 364	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	90
PID 2236 wrote to memory of 4660	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	91
PID 2236 wrote to memory of 4660	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	91
PID 2236 wrote to memory of 4036	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	92
PID 2236 wrote to memory of 4036	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	92
PID 2236 wrote to memory of 4700	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	93
PID 2236 wrote to memory of 4700	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	93
PID 2236 wrote to memory of 4560	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	94
PID 2236 wrote to memory of 4560	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	94
PID 2236 wrote to memory of 3488	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	95
PID 2236 wrote to memory of 3488	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	95
PID 2236 wrote to memory of 5040	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	96
PID 2236 wrote to memory of 5040	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	96
PID 2236 wrote to memory of 3520	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	97
PID 2236 wrote to memory of 3520	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	97
PID 2236 wrote to memory of 4928	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	98
PID 2236 wrote to memory of 4928	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	98
PID 2236 wrote to memory of 4848	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	99
PID 2236 wrote to memory of 4848	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	99
PID 2236 wrote to memory of 4704	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	100
PID 2236 wrote to memory of 4704	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	100
PID 2236 wrote to memory of 4584	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	101
PID 2236 wrote to memory of 4584	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	101
PID 2236 wrote to memory of 2756	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	102
PID 2236 wrote to memory of 2756	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	102
PID 2236 wrote to memory of 3764	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	103
PID 2236 wrote to memory of 3764	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	103
PID 2236 wrote to memory of 676	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	104
PID 2236 wrote to memory of 676	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	104
PID 2236 wrote to memory of 1212	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	105
PID 2236 wrote to memory of 1212	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	105
PID 2236 wrote to memory of 3924	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	106
PID 2236 wrote to memory of 3924	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	106
PID 2236 wrote to memory of 3720	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	107
PID 2236 wrote to memory of 3720	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	107
PID 2236 wrote to memory of 3460	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	108
PID 2236 wrote to memory of 3460	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	108
PID 2236 wrote to memory of 3680	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	109
PID 2236 wrote to memory of 3680	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	109
PID 2236 wrote to memory of 748	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	110
PID 2236 wrote to memory of 748	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	110
PID 2236 wrote to memory of 3884	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	111
PID 2236 wrote to memory of 3884	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	111
PID 2236 wrote to memory of 4916	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	112
PID 2236 wrote to memory of 4916	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	112
PID 2236 wrote to memory of 2108	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	113
PID 2236 wrote to memory of 2108	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	113
PID 2236 wrote to memory of 1504	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	114
PID 2236 wrote to memory of 1504	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	114
PID 2236 wrote to memory of 4064	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	115
PID 2236 wrote to memory of 4064	2236	18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18449d7f413576019a3b8e7565dfd570NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\System\lUUFLyt.exe
  C:\Windows\System\lUUFLyt.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\ltmpjxI.exe
  C:\Windows\System\ltmpjxI.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\AzuUEvc.exe
  C:\Windows\System\AzuUEvc.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\aMZjHrv.exe
  C:\Windows\System\aMZjHrv.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\QbwhBvX.exe
  C:\Windows\System\QbwhBvX.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\LczLJeS.exe
  C:\Windows\System\LczLJeS.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\naFUrYr.exe
  C:\Windows\System\naFUrYr.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\EpJVcWM.exe
  C:\Windows\System\EpJVcWM.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\esPaljv.exe
  C:\Windows\System\esPaljv.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\DjZxtVN.exe
  C:\Windows\System\DjZxtVN.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\jDbEhQr.exe
  C:\Windows\System\jDbEhQr.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\SjMnduV.exe
  C:\Windows\System\SjMnduV.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\Cboxquq.exe
  C:\Windows\System\Cboxquq.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\RPjgBiF.exe
  C:\Windows\System\RPjgBiF.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\ZoHGfQc.exe
  C:\Windows\System\ZoHGfQc.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\NAIZJEZ.exe
  C:\Windows\System\NAIZJEZ.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\hvGSDoh.exe
  C:\Windows\System\hvGSDoh.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\YskfXvH.exe
  C:\Windows\System\YskfXvH.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\XvkniTO.exe
  C:\Windows\System\XvkniTO.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\iTzGxTQ.exe
  C:\Windows\System\iTzGxTQ.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\CzSKsIT.exe
  C:\Windows\System\CzSKsIT.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\BGwluvG.exe
  C:\Windows\System\BGwluvG.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\AHrlhfi.exe
  C:\Windows\System\AHrlhfi.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\fvdMkxb.exe
  C:\Windows\System\fvdMkxb.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\kWHyGYe.exe
  C:\Windows\System\kWHyGYe.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\YNXCQlk.exe
  C:\Windows\System\YNXCQlk.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\FQIqifu.exe
  C:\Windows\System\FQIqifu.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\WXUbHMo.exe
  C:\Windows\System\WXUbHMo.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\sYNwkib.exe
  C:\Windows\System\sYNwkib.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\jSjtbfT.exe
  C:\Windows\System\jSjtbfT.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\itLcyaM.exe
  C:\Windows\System\itLcyaM.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\AwzfYSB.exe
  C:\Windows\System\AwzfYSB.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\SfngaLq.exe
  C:\Windows\System\SfngaLq.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\DzAjXbW.exe
  C:\Windows\System\DzAjXbW.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\UqLLIHW.exe
  C:\Windows\System\UqLLIHW.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\VuWFWbx.exe
  C:\Windows\System\VuWFWbx.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\WoacKtH.exe
  C:\Windows\System\WoacKtH.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\mSKDqbL.exe
  C:\Windows\System\mSKDqbL.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\dBzjOqr.exe
  C:\Windows\System\dBzjOqr.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\gJYBJub.exe
  C:\Windows\System\gJYBJub.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\rWYqgaz.exe
  C:\Windows\System\rWYqgaz.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\mbXjRRP.exe
  C:\Windows\System\mbXjRRP.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\WzcNvpW.exe
  C:\Windows\System\WzcNvpW.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\ENgQEjX.exe
  C:\Windows\System\ENgQEjX.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\qahOESp.exe
  C:\Windows\System\qahOESp.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\syUveSe.exe
  C:\Windows\System\syUveSe.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\NQVQBuS.exe
  C:\Windows\System\NQVQBuS.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\Nqsctiy.exe
  C:\Windows\System\Nqsctiy.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\kGaqdxZ.exe
  C:\Windows\System\kGaqdxZ.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\CKaxBpd.exe
  C:\Windows\System\CKaxBpd.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\cPOmlcl.exe
  C:\Windows\System\cPOmlcl.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\AGJymZD.exe
  C:\Windows\System\AGJymZD.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\vmzbuox.exe
  C:\Windows\System\vmzbuox.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\nTMjjMw.exe
  C:\Windows\System\nTMjjMw.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\BEnQdgD.exe
  C:\Windows\System\BEnQdgD.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\TXQIexp.exe
  C:\Windows\System\TXQIexp.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\yBYccrK.exe
  C:\Windows\System\yBYccrK.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\FRvEwWs.exe
  C:\Windows\System\FRvEwWs.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\LVMSsZC.exe
  C:\Windows\System\LVMSsZC.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\JNkuAiF.exe
  C:\Windows\System\JNkuAiF.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\jumpICF.exe
  C:\Windows\System\jumpICF.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\GviZRGt.exe
  C:\Windows\System\GviZRGt.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\NZuLsrv.exe
  C:\Windows\System\NZuLsrv.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\kbLkgeE.exe
  C:\Windows\System\kbLkgeE.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\tiUeWxo.exe
  C:\Windows\System\tiUeWxo.exe
  2⤵
  PID:2224
- C:\Windows\System\SbmCMXI.exe
  C:\Windows\System\SbmCMXI.exe
  2⤵
  PID:2720
- C:\Windows\System\hudCntZ.exe
  C:\Windows\System\hudCntZ.exe
  2⤵
  PID:444
- C:\Windows\System\PJJjLFY.exe
  C:\Windows\System\PJJjLFY.exe
  2⤵
  PID:2192
- C:\Windows\System\PxwSezh.exe
  C:\Windows\System\PxwSezh.exe
  2⤵
  PID:4108
- C:\Windows\System\JZEsseW.exe
  C:\Windows\System\JZEsseW.exe
  2⤵
  PID:4488
- C:\Windows\System\AfbpZMf.exe
  C:\Windows\System\AfbpZMf.exe
  2⤵
  PID:2324
- C:\Windows\System\WgWXruI.exe
  C:\Windows\System\WgWXruI.exe
  2⤵
  PID:3900
- C:\Windows\System\UqyeqWK.exe
  C:\Windows\System\UqyeqWK.exe
  2⤵
  PID:4640
- C:\Windows\System\CFqfaHN.exe
  C:\Windows\System\CFqfaHN.exe
  2⤵
  PID:3728
- C:\Windows\System\KbWNgLP.exe
  C:\Windows\System\KbWNgLP.exe
  2⤵
  PID:1152
- C:\Windows\System\DFuwrRu.exe
  C:\Windows\System\DFuwrRu.exe
  2⤵
  PID:1872
- C:\Windows\System\GRzweKD.exe
  C:\Windows\System\GRzweKD.exe
  2⤵
  PID:3664
- C:\Windows\System\TGtLCkt.exe
  C:\Windows\System\TGtLCkt.exe
  2⤵
  PID:2300
- C:\Windows\System\NCwUOiz.exe
  C:\Windows\System\NCwUOiz.exe
  2⤵
  PID:224
- C:\Windows\System\srDpGbr.exe
  C:\Windows\System\srDpGbr.exe
  2⤵
  PID:1924
- C:\Windows\System\kbnLjyl.exe
  C:\Windows\System\kbnLjyl.exe
  2⤵
  PID:2232
- C:\Windows\System\HwjBgTY.exe
  C:\Windows\System\HwjBgTY.exe
  2⤵
  PID:3284
- C:\Windows\System\gaYEAMO.exe
  C:\Windows\System\gaYEAMO.exe
  2⤵
  PID:1884
- C:\Windows\System\XzVARxl.exe
  C:\Windows\System\XzVARxl.exe
  2⤵
  PID:5144
- C:\Windows\System\WaOUpFw.exe
  C:\Windows\System\WaOUpFw.exe
  2⤵
  PID:5164
- C:\Windows\System\WQNXIRF.exe
  C:\Windows\System\WQNXIRF.exe
  2⤵
  PID:5192
- C:\Windows\System\pHCbTWG.exe
  C:\Windows\System\pHCbTWG.exe
  2⤵
  PID:5232
- C:\Windows\System\PsMcLzX.exe
  C:\Windows\System\PsMcLzX.exe
  2⤵
  PID:5248
- C:\Windows\System\ybCYqiN.exe
  C:\Windows\System\ybCYqiN.exe
  2⤵
  PID:5280
- C:\Windows\System\amgGWbz.exe
  C:\Windows\System\amgGWbz.exe
  2⤵
  PID:5316
- C:\Windows\System\HsaMKto.exe
  C:\Windows\System\HsaMKto.exe
  2⤵
  PID:5356
- C:\Windows\System\UUnKAiY.exe
  C:\Windows\System\UUnKAiY.exe
  2⤵
  PID:5384
- C:\Windows\System\CzCwcdE.exe
  C:\Windows\System\CzCwcdE.exe
  2⤵
  PID:5416
- C:\Windows\System\qTKbvRO.exe
  C:\Windows\System\qTKbvRO.exe
  2⤵
  PID:5444
- C:\Windows\System\yFsybpi.exe
  C:\Windows\System\yFsybpi.exe
  2⤵
  PID:5472
- C:\Windows\System\jjjfMDW.exe
  C:\Windows\System\jjjfMDW.exe
  2⤵
  PID:5492
- C:\Windows\System\vaxYuEH.exe
  C:\Windows\System\vaxYuEH.exe
  2⤵
  PID:5516
- C:\Windows\System\SsaQbBe.exe
  C:\Windows\System\SsaQbBe.exe
  2⤵
  PID:5548
- C:\Windows\System\bnVtCjD.exe
  C:\Windows\System\bnVtCjD.exe
  2⤵
  PID:5588
- C:\Windows\System\KQcAIcw.exe
  C:\Windows\System\KQcAIcw.exe
  2⤵
  PID:5636
- C:\Windows\System\tKSoUxS.exe
  C:\Windows\System\tKSoUxS.exe
  2⤵
  PID:5656
- C:\Windows\System\tUxQHhq.exe
  C:\Windows\System\tUxQHhq.exe
  2⤵
  PID:5688
- C:\Windows\System\IghmcqI.exe
  C:\Windows\System\IghmcqI.exe
  2⤵
  PID:5720
- C:\Windows\System\kqUwbdK.exe
  C:\Windows\System\kqUwbdK.exe
  2⤵
  PID:5748
- C:\Windows\System\gnmTOkb.exe
  C:\Windows\System\gnmTOkb.exe
  2⤵
  PID:5784
- C:\Windows\System\dpQQrMF.exe
  C:\Windows\System\dpQQrMF.exe
  2⤵
  PID:5828
- C:\Windows\System\SHAYLNU.exe
  C:\Windows\System\SHAYLNU.exe
  2⤵
  PID:5844
- C:\Windows\System\YZqGGTN.exe
  C:\Windows\System\YZqGGTN.exe
  2⤵
  PID:5880
- C:\Windows\System\IhWiLpE.exe
  C:\Windows\System\IhWiLpE.exe
  2⤵
  PID:5912
- C:\Windows\System\BISIzwj.exe
  C:\Windows\System\BISIzwj.exe
  2⤵
  PID:5932
- C:\Windows\System\izstmBc.exe
  C:\Windows\System\izstmBc.exe
  2⤵
  PID:5960
- C:\Windows\System\ERYKTuM.exe
  C:\Windows\System\ERYKTuM.exe
  2⤵
  PID:6004
- C:\Windows\System\NTsTAFZ.exe
  C:\Windows\System\NTsTAFZ.exe
  2⤵
  PID:6048
- C:\Windows\System\jInvdxF.exe
  C:\Windows\System\jInvdxF.exe
  2⤵
  PID:6076
- C:\Windows\System\LYEAVEY.exe
  C:\Windows\System\LYEAVEY.exe
  2⤵
  PID:6108
- C:\Windows\System\DzBIwle.exe
  C:\Windows\System\DzBIwle.exe
  2⤵
  PID:1416
- C:\Windows\System\TMcWMOs.exe
  C:\Windows\System\TMcWMOs.exe
  2⤵
  PID:2176
- C:\Windows\System\laPAbcl.exe
  C:\Windows\System\laPAbcl.exe
  2⤵
  PID:5132
- C:\Windows\System\NShLuzT.exe
  C:\Windows\System\NShLuzT.exe
  2⤵
  PID:5212
- C:\Windows\System\tKScUqd.exe
  C:\Windows\System\tKScUqd.exe
  2⤵
  PID:5276
- C:\Windows\System\fgKKsIt.exe
  C:\Windows\System\fgKKsIt.exe
  2⤵
  PID:5352
- C:\Windows\System\wSoHrxs.exe
  C:\Windows\System\wSoHrxs.exe
  2⤵
  PID:5396
- C:\Windows\System\JkDQZLy.exe
  C:\Windows\System\JkDQZLy.exe
  2⤵
  PID:5468
- C:\Windows\System\iMmypsO.exe
  C:\Windows\System\iMmypsO.exe
  2⤵
  PID:5532
- C:\Windows\System\nQVxrLu.exe
  C:\Windows\System\nQVxrLu.exe
  2⤵
  PID:5644
- C:\Windows\System\sfYTBjg.exe
  C:\Windows\System\sfYTBjg.exe
  2⤵
  PID:5704
- C:\Windows\System\utZlzRH.exe
  C:\Windows\System\utZlzRH.exe
  2⤵
  PID:5792
- C:\Windows\System\fjYOawH.exe
  C:\Windows\System\fjYOawH.exe
  2⤵
  PID:5868
- C:\Windows\System\PTwewgf.exe
  C:\Windows\System\PTwewgf.exe
  2⤵
  PID:5940
- C:\Windows\System\jFkjzPb.exe
  C:\Windows\System\jFkjzPb.exe
  2⤵
  PID:6028
- C:\Windows\System\jJhgVTx.exe
  C:\Windows\System\jJhgVTx.exe
  2⤵
  PID:6096
- C:\Windows\System\lrBJjLK.exe
  C:\Windows\System\lrBJjLK.exe
  2⤵
  PID:1244
- C:\Windows\System\mmsglca.exe
  C:\Windows\System\mmsglca.exe
  2⤵
  PID:5260
- C:\Windows\System\MjxMYZr.exe
  C:\Windows\System\MjxMYZr.exe
  2⤵
  PID:5428
- C:\Windows\System\mBYtDUl.exe
  C:\Windows\System\mBYtDUl.exe
  2⤵
  PID:5540
- C:\Windows\System\YTsXdbW.exe
  C:\Windows\System\YTsXdbW.exe
  2⤵
  PID:5708
- C:\Windows\System\jKXYfxr.exe
  C:\Windows\System\jKXYfxr.exe
  2⤵
  PID:5900
- C:\Windows\System\ubMKNPl.exe
  C:\Windows\System\ubMKNPl.exe
  2⤵
  PID:6064
- C:\Windows\System\FzzCdvP.exe
  C:\Windows\System\FzzCdvP.exe
  2⤵
  PID:5272
- C:\Windows\System\yxHjpsw.exe
  C:\Windows\System\yxHjpsw.exe
  2⤵
  PID:5668
- C:\Windows\System\DHzkfcq.exe
  C:\Windows\System\DHzkfcq.exe
  2⤵
  PID:5988
- C:\Windows\System\jLSBPCq.exe
  C:\Windows\System\jLSBPCq.exe
  2⤵
  PID:5480
- C:\Windows\System\TudMxLk.exe
  C:\Windows\System\TudMxLk.exe
  2⤵
  PID:5948
- C:\Windows\System\uBEZlkn.exe
  C:\Windows\System\uBEZlkn.exe
  2⤵
  PID:6168
- C:\Windows\System\aBuPguP.exe
  C:\Windows\System\aBuPguP.exe
  2⤵
  PID:6196
- C:\Windows\System\uASDQWQ.exe
  C:\Windows\System\uASDQWQ.exe
  2⤵
  PID:6228
- C:\Windows\System\dNUpAjk.exe
  C:\Windows\System\dNUpAjk.exe
  2⤵
  PID:6252
- C:\Windows\System\TZGWdnC.exe
  C:\Windows\System\TZGWdnC.exe
  2⤵
  PID:6284
- C:\Windows\System\CIUqvMx.exe
  C:\Windows\System\CIUqvMx.exe
  2⤵
  PID:6312
- C:\Windows\System\dzlgFOo.exe
  C:\Windows\System\dzlgFOo.exe
  2⤵
  PID:6336
- C:\Windows\System\RgoIIxP.exe
  C:\Windows\System\RgoIIxP.exe
  2⤵
  PID:6368
- C:\Windows\System\zppslTH.exe
  C:\Windows\System\zppslTH.exe
  2⤵
  PID:6384
- C:\Windows\System\aZYAjDd.exe
  C:\Windows\System\aZYAjDd.exe
  2⤵
  PID:6400
- C:\Windows\System\tqdbrLI.exe
  C:\Windows\System\tqdbrLI.exe
  2⤵
  PID:6428
- C:\Windows\System\ayWkxMV.exe
  C:\Windows\System\ayWkxMV.exe
  2⤵
  PID:6444
- C:\Windows\System\kOsORwq.exe
  C:\Windows\System\kOsORwq.exe
  2⤵
  PID:6468
- C:\Windows\System\kTUxLNp.exe
  C:\Windows\System\kTUxLNp.exe
  2⤵
  PID:6496
- C:\Windows\System\rKgOPWL.exe
  C:\Windows\System\rKgOPWL.exe
  2⤵
  PID:6528
- C:\Windows\System\kydXolZ.exe
  C:\Windows\System\kydXolZ.exe
  2⤵
  PID:6564
- C:\Windows\System\HDJkGOW.exe
  C:\Windows\System\HDJkGOW.exe
  2⤵
  PID:6600
- C:\Windows\System\SnuLnRN.exe
  C:\Windows\System\SnuLnRN.exe
  2⤵
  PID:6636
- C:\Windows\System\tLuueDB.exe
  C:\Windows\System\tLuueDB.exe
  2⤵
  PID:6664
- C:\Windows\System\rgnArxL.exe
  C:\Windows\System\rgnArxL.exe
  2⤵
  PID:6700
- C:\Windows\System\aTxuyTs.exe
  C:\Windows\System\aTxuyTs.exe
  2⤵
  PID:6732
- C:\Windows\System\cHeYlbF.exe
  C:\Windows\System\cHeYlbF.exe
  2⤵
  PID:6764
- C:\Windows\System\uTXMlSW.exe
  C:\Windows\System\uTXMlSW.exe
  2⤵
  PID:6800
- C:\Windows\System\mxVqKdu.exe
  C:\Windows\System\mxVqKdu.exe
  2⤵
  PID:6824
- C:\Windows\System\cfQQgFg.exe
  C:\Windows\System\cfQQgFg.exe
  2⤵
  PID:6860
- C:\Windows\System\PtfjDLM.exe
  C:\Windows\System\PtfjDLM.exe
  2⤵
  PID:6896
- C:\Windows\System\BrPZDZS.exe
  C:\Windows\System\BrPZDZS.exe
  2⤵
  PID:6936
- C:\Windows\System\RXNHNqd.exe
  C:\Windows\System\RXNHNqd.exe
  2⤵
  PID:6952
- C:\Windows\System\mkWKouj.exe
  C:\Windows\System\mkWKouj.exe
  2⤵
  PID:6988
- C:\Windows\System\CZACjNM.exe
  C:\Windows\System\CZACjNM.exe
  2⤵
  PID:7004
- C:\Windows\System\FrHXRCU.exe
  C:\Windows\System\FrHXRCU.exe
  2⤵
  PID:7032
- C:\Windows\System\dcWlfkH.exe
  C:\Windows\System\dcWlfkH.exe
  2⤵
  PID:7068
- C:\Windows\System\KXFlnwG.exe
  C:\Windows\System\KXFlnwG.exe
  2⤵
  PID:7108
- C:\Windows\System\XlBKPjN.exe
  C:\Windows\System\XlBKPjN.exe
  2⤵
  PID:7132
- C:\Windows\System\xeNiwKl.exe
  C:\Windows\System\xeNiwKl.exe
  2⤵
  PID:7164
- C:\Windows\System\mYnNsOn.exe
  C:\Windows\System\mYnNsOn.exe
  2⤵
  PID:6216
- C:\Windows\System\kaUdeda.exe
  C:\Windows\System\kaUdeda.exe
  2⤵
  PID:6308
- C:\Windows\System\DyqCHdf.exe
  C:\Windows\System\DyqCHdf.exe
  2⤵
  PID:6392
- C:\Windows\System\xzhMyre.exe
  C:\Windows\System\xzhMyre.exe
  2⤵
  PID:6480
- C:\Windows\System\kqKKYRl.exe
  C:\Windows\System\kqKKYRl.exe
  2⤵
  PID:6512
- C:\Windows\System\nhhlpZE.exe
  C:\Windows\System\nhhlpZE.exe
  2⤵
  PID:6560
- C:\Windows\System\WhMwpyx.exe
  C:\Windows\System\WhMwpyx.exe
  2⤵
  PID:6628
- C:\Windows\System\DvOatJP.exe
  C:\Windows\System\DvOatJP.exe
  2⤵
  PID:6720
- C:\Windows\System\EvHRJIt.exe
  C:\Windows\System\EvHRJIt.exe
  2⤵
  PID:6744
- C:\Windows\System\llbUrCo.exe
  C:\Windows\System\llbUrCo.exe
  2⤵
  PID:6812
- C:\Windows\System\ktKesyd.exe
  C:\Windows\System\ktKesyd.exe
  2⤵
  PID:2552
- C:\Windows\System\DZVMNEx.exe
  C:\Windows\System\DZVMNEx.exe
  2⤵
  PID:6920
- C:\Windows\System\ALnZeig.exe
  C:\Windows\System\ALnZeig.exe
  2⤵
  PID:6944
- C:\Windows\System\SuuxdfI.exe
  C:\Windows\System\SuuxdfI.exe
  2⤵
  PID:7020
- C:\Windows\System\rpnXbXM.exe
  C:\Windows\System\rpnXbXM.exe
  2⤵
  PID:7092
- C:\Windows\System\FzyhQpK.exe
  C:\Windows\System\FzyhQpK.exe
  2⤵
  PID:6188
- C:\Windows\System\wEmLIok.exe
  C:\Windows\System\wEmLIok.exe
  2⤵
  PID:6356
- C:\Windows\System\NDgvDdo.exe
  C:\Windows\System\NDgvDdo.exe
  2⤵
  PID:6608
- C:\Windows\System\mnBumTK.exe
  C:\Windows\System\mnBumTK.exe
  2⤵
  PID:4772
- C:\Windows\System\GzQTrcN.exe
  C:\Windows\System\GzQTrcN.exe
  2⤵
  PID:4768
- C:\Windows\System\HlALeLQ.exe
  C:\Windows\System\HlALeLQ.exe
  2⤵
  PID:7148
- C:\Windows\System\bajTIXU.exe
  C:\Windows\System\bajTIXU.exe
  2⤵
  PID:6420
- C:\Windows\System\FHXBlTA.exe
  C:\Windows\System\FHXBlTA.exe
  2⤵
  PID:6728
- C:\Windows\System\ScQVGJr.exe
  C:\Windows\System\ScQVGJr.exe
  2⤵
  PID:7152
- C:\Windows\System\hvcccFi.exe
  C:\Windows\System\hvcccFi.exe
  2⤵
  PID:6344
- C:\Windows\System\cufIvrj.exe
  C:\Windows\System\cufIvrj.exe
  2⤵
  PID:7196
- C:\Windows\System\HULkbjt.exe
  C:\Windows\System\HULkbjt.exe
  2⤵
  PID:7220
- C:\Windows\System\qpXSQEA.exe
  C:\Windows\System\qpXSQEA.exe
  2⤵
  PID:7248
- C:\Windows\System\LYJzkke.exe
  C:\Windows\System\LYJzkke.exe
  2⤵
  PID:7280
- C:\Windows\System\kHBuWny.exe
  C:\Windows\System\kHBuWny.exe
  2⤵
  PID:7312
- C:\Windows\System\uwBOYXf.exe
  C:\Windows\System\uwBOYXf.exe
  2⤵
  PID:7328
- C:\Windows\System\aDzzCSQ.exe
  C:\Windows\System\aDzzCSQ.exe
  2⤵
  PID:7344
- C:\Windows\System\HntUKwH.exe
  C:\Windows\System\HntUKwH.exe
  2⤵
  PID:7364
- C:\Windows\System\ltzNxBi.exe
  C:\Windows\System\ltzNxBi.exe
  2⤵
  PID:7396
- C:\Windows\System\SmuYIgd.exe
  C:\Windows\System\SmuYIgd.exe
  2⤵
  PID:7428
- C:\Windows\System\uNtjmnQ.exe
  C:\Windows\System\uNtjmnQ.exe
  2⤵
  PID:7456
- C:\Windows\System\qCxQRbd.exe
  C:\Windows\System\qCxQRbd.exe
  2⤵
  PID:7492
- C:\Windows\System\oSuNJht.exe
  C:\Windows\System\oSuNJht.exe
  2⤵
  PID:7532
- C:\Windows\System\wlKiTIi.exe
  C:\Windows\System\wlKiTIi.exe
  2⤵
  PID:7564
- C:\Windows\System\cDggukY.exe
  C:\Windows\System\cDggukY.exe
  2⤵
  PID:7592
- C:\Windows\System\gNfwRaS.exe
  C:\Windows\System\gNfwRaS.exe
  2⤵
  PID:7620
- C:\Windows\System\yVliaOA.exe
  C:\Windows\System\yVliaOA.exe
  2⤵
  PID:7648
- C:\Windows\System\XSnGHqc.exe
  C:\Windows\System\XSnGHqc.exe
  2⤵
  PID:7680
- C:\Windows\System\KXVlcTw.exe
  C:\Windows\System\KXVlcTw.exe
  2⤵
  PID:7708
- C:\Windows\System\kdsnhjV.exe
  C:\Windows\System\kdsnhjV.exe
  2⤵
  PID:7736
- C:\Windows\System\uJgZTCd.exe
  C:\Windows\System\uJgZTCd.exe
  2⤵
  PID:7768
- C:\Windows\System\vqHgwKB.exe
  C:\Windows\System\vqHgwKB.exe
  2⤵
  PID:7796
- C:\Windows\System\NHfQiUj.exe
  C:\Windows\System\NHfQiUj.exe
  2⤵
  PID:7824
- C:\Windows\System\uwLThwh.exe
  C:\Windows\System\uwLThwh.exe
  2⤵
  PID:7856
- C:\Windows\System\XgZbsLm.exe
  C:\Windows\System\XgZbsLm.exe
  2⤵
  PID:7884
- C:\Windows\System\vcQAvDu.exe
  C:\Windows\System\vcQAvDu.exe
  2⤵
  PID:7908
- C:\Windows\System\xwUGGvu.exe
  C:\Windows\System\xwUGGvu.exe
  2⤵
  PID:7940
- C:\Windows\System\CEVyNAW.exe
  C:\Windows\System\CEVyNAW.exe
  2⤵
  PID:7968
- C:\Windows\System\oACkqze.exe
  C:\Windows\System\oACkqze.exe
  2⤵
  PID:7996
- C:\Windows\System\fmflARH.exe
  C:\Windows\System\fmflARH.exe
  2⤵
  PID:8016
- C:\Windows\System\lonHNzm.exe
  C:\Windows\System\lonHNzm.exe
  2⤵
  PID:8052
- C:\Windows\System\hvjnZod.exe
  C:\Windows\System\hvjnZod.exe
  2⤵
  PID:8068
- C:\Windows\System\rYFNfIz.exe
  C:\Windows\System\rYFNfIz.exe
  2⤵
  PID:8104
- C:\Windows\System\howumDe.exe
  C:\Windows\System\howumDe.exe
  2⤵
  PID:8136
- C:\Windows\System\KwaRqYn.exe
  C:\Windows\System\KwaRqYn.exe
  2⤵
  PID:8164
- C:\Windows\System\KmkXInM.exe
  C:\Windows\System\KmkXInM.exe
  2⤵
  PID:6688
- C:\Windows\System\tNnIpwT.exe
  C:\Windows\System\tNnIpwT.exe
  2⤵
  PID:7212
- C:\Windows\System\AtJMxJn.exe
  C:\Windows\System\AtJMxJn.exe
  2⤵
  PID:7276
- C:\Windows\System\yoIVFlM.exe
  C:\Windows\System\yoIVFlM.exe
  2⤵
  PID:7356
- C:\Windows\System\KlHktSI.exe
  C:\Windows\System\KlHktSI.exe
  2⤵
  PID:7384
- C:\Windows\System\HCmkIsY.exe
  C:\Windows\System\HCmkIsY.exe
  2⤵
  PID:7480
- C:\Windows\System\LERHdmA.exe
  C:\Windows\System\LERHdmA.exe
  2⤵
  PID:7528
- C:\Windows\System\wRuvaGB.exe
  C:\Windows\System\wRuvaGB.exe
  2⤵
  PID:7604
- C:\Windows\System\IwDvNrb.exe
  C:\Windows\System\IwDvNrb.exe
  2⤵
  PID:7668
- C:\Windows\System\ZAVWIeq.exe
  C:\Windows\System\ZAVWIeq.exe
  2⤵
  PID:7704
- C:\Windows\System\EoZMdjj.exe
  C:\Windows\System\EoZMdjj.exe
  2⤵
  PID:7808
- C:\Windows\System\iTOCRjc.exe
  C:\Windows\System\iTOCRjc.exe
  2⤵
  PID:7876
- C:\Windows\System\HxRsmiE.exe
  C:\Windows\System\HxRsmiE.exe
  2⤵
  PID:7916
- C:\Windows\System\GvTkAYL.exe
  C:\Windows\System\GvTkAYL.exe
  2⤵
  PID:7992
- C:\Windows\System\UqncXeU.exe
  C:\Windows\System\UqncXeU.exe
  2⤵
  PID:8064
- C:\Windows\System\lJqAetL.exe
  C:\Windows\System\lJqAetL.exe
  2⤵
  PID:8148
- C:\Windows\System\BTQEmqT.exe
  C:\Windows\System\BTQEmqT.exe
  2⤵
  PID:7188
- C:\Windows\System\yldwnkV.exe
  C:\Windows\System\yldwnkV.exe
  2⤵
  PID:7308
- C:\Windows\System\OghcStK.exe
  C:\Windows\System\OghcStK.exe
  2⤵
  PID:7464
- C:\Windows\System\moqsfAf.exe
  C:\Windows\System\moqsfAf.exe
  2⤵
  PID:7644
- C:\Windows\System\VedPBOS.exe
  C:\Windows\System\VedPBOS.exe
  2⤵
  PID:7788
- C:\Windows\System\gpCarCE.exe
  C:\Windows\System\gpCarCE.exe
  2⤵
  PID:7936
- C:\Windows\System\pQACOLF.exe
  C:\Windows\System\pQACOLF.exe
  2⤵
  PID:8048
- C:\Windows\System\ipzIrPd.exe
  C:\Windows\System\ipzIrPd.exe
  2⤵
  PID:8176
- C:\Windows\System\unkLcWc.exe
  C:\Windows\System\unkLcWc.exe
  2⤵
  PID:7336
- C:\Windows\System\JZUPaHN.exe
  C:\Windows\System\JZUPaHN.exe
  2⤵
  PID:7732
- C:\Windows\System\BKvNadT.exe
  C:\Windows\System\BKvNadT.exe
  2⤵
  PID:8128
- C:\Windows\System\vdsVFAN.exe
  C:\Windows\System\vdsVFAN.exe
  2⤵
  PID:8216
- C:\Windows\System\ZKDWdAY.exe
  C:\Windows\System\ZKDWdAY.exe
  2⤵
  PID:8244
- C:\Windows\System\fJmNylv.exe
  C:\Windows\System\fJmNylv.exe
  2⤵
  PID:8276
- C:\Windows\System\kJpFJAK.exe
  C:\Windows\System\kJpFJAK.exe
  2⤵
  PID:8296
- C:\Windows\System\ixKNmSz.exe
  C:\Windows\System\ixKNmSz.exe
  2⤵
  PID:8332
- C:\Windows\System\ePsBTpZ.exe
  C:\Windows\System\ePsBTpZ.exe
  2⤵
  PID:8376
- C:\Windows\System\HtkrBPZ.exe
  C:\Windows\System\HtkrBPZ.exe
  2⤵
  PID:8404
- C:\Windows\System\DhDPFbr.exe
  C:\Windows\System\DhDPFbr.exe
  2⤵
  PID:8432
- C:\Windows\System\BLpOWUy.exe
  C:\Windows\System\BLpOWUy.exe
  2⤵
  PID:8472
- C:\Windows\System\YtcaWXA.exe
  C:\Windows\System\YtcaWXA.exe
  2⤵
  PID:8500
- C:\Windows\System\FqbIVCq.exe
  C:\Windows\System\FqbIVCq.exe
  2⤵
  PID:8528
- C:\Windows\System\SoyTPqg.exe
  C:\Windows\System\SoyTPqg.exe
  2⤵
  PID:8560
- C:\Windows\System\GUrZYYC.exe
  C:\Windows\System\GUrZYYC.exe
  2⤵
  PID:8576
- C:\Windows\System\BmZmXhQ.exe
  C:\Windows\System\BmZmXhQ.exe
  2⤵
  PID:8608
- C:\Windows\System\kCBbvQH.exe
  C:\Windows\System\kCBbvQH.exe
  2⤵
  PID:8624
- C:\Windows\System\QSyQcFU.exe
  C:\Windows\System\QSyQcFU.exe
  2⤵
  PID:8648
- C:\Windows\System\ALovjiw.exe
  C:\Windows\System\ALovjiw.exe
  2⤵
  PID:8664
- C:\Windows\System\vrNEIJi.exe
  C:\Windows\System\vrNEIJi.exe
  2⤵
  PID:8708
- C:\Windows\System\OyhkAfY.exe
  C:\Windows\System\OyhkAfY.exe
  2⤵
  PID:8740
- C:\Windows\System\ZZjURiv.exe
  C:\Windows\System\ZZjURiv.exe
  2⤵
  PID:8776
- C:\Windows\System\nmtysXm.exe
  C:\Windows\System\nmtysXm.exe
  2⤵
  PID:8812
- C:\Windows\System\CKnBrOe.exe
  C:\Windows\System\CKnBrOe.exe
  2⤵
  PID:8840
- C:\Windows\System\mQsSlHg.exe
  C:\Windows\System\mQsSlHg.exe
  2⤵
  PID:8860
- C:\Windows\System\CCSwVlp.exe
  C:\Windows\System\CCSwVlp.exe
  2⤵
  PID:8888
- C:\Windows\System\UKaTwmk.exe
  C:\Windows\System\UKaTwmk.exe
  2⤵
  PID:8904
- C:\Windows\System\yIUXOFL.exe
  C:\Windows\System\yIUXOFL.exe
  2⤵
  PID:8940
- C:\Windows\System\HrdGeWE.exe
  C:\Windows\System\HrdGeWE.exe
  2⤵
  PID:8980
- C:\Windows\System\HwLmzoj.exe
  C:\Windows\System\HwLmzoj.exe
  2⤵
  PID:9012
- C:\Windows\System\yiVaAsM.exe
  C:\Windows\System\yiVaAsM.exe
  2⤵
  PID:9044
- C:\Windows\System\spYEPDO.exe
  C:\Windows\System\spYEPDO.exe
  2⤵
  PID:9060
- C:\Windows\System\lYFBDzu.exe
  C:\Windows\System\lYFBDzu.exe
  2⤵
  PID:9092
- C:\Windows\System\efiiCHK.exe
  C:\Windows\System\efiiCHK.exe
  2⤵
  PID:9128
- C:\Windows\System\mlEJiQp.exe
  C:\Windows\System\mlEJiQp.exe
  2⤵
  PID:9156
- C:\Windows\System\Nqfgrtx.exe
  C:\Windows\System\Nqfgrtx.exe
  2⤵
  PID:9184
- C:\Windows\System\BZQvRSU.exe
  C:\Windows\System\BZQvRSU.exe
  2⤵
  PID:9212
- C:\Windows\System\bfEnXrX.exe
  C:\Windows\System\bfEnXrX.exe
  2⤵
  PID:8036
- C:\Windows\System\KblOLhi.exe
  C:\Windows\System\KblOLhi.exe
  2⤵
  PID:8224
- C:\Windows\System\CSwFaVZ.exe
  C:\Windows\System\CSwFaVZ.exe
  2⤵
  PID:8236
- C:\Windows\System\zSrIpxz.exe
  C:\Windows\System\zSrIpxz.exe
  2⤵
  PID:8344
- C:\Windows\System\TXdkszC.exe
  C:\Windows\System\TXdkszC.exe
  2⤵
  PID:8456
- C:\Windows\System\fdBmUGS.exe
  C:\Windows\System\fdBmUGS.exe
  2⤵
  PID:8496
- C:\Windows\System\ZQYXgHJ.exe
  C:\Windows\System\ZQYXgHJ.exe
  2⤵
  PID:8524
- C:\Windows\System\cAACSzf.exe
  C:\Windows\System\cAACSzf.exe
  2⤵
  PID:8604
- C:\Windows\System\wClRNpA.exe
  C:\Windows\System\wClRNpA.exe
  2⤵
  PID:8684
- C:\Windows\System\sFmcNEa.exe
  C:\Windows\System\sFmcNEa.exe
  2⤵
  PID:8728
- C:\Windows\System\KyWSrAX.exe
  C:\Windows\System\KyWSrAX.exe
  2⤵
  PID:8808
- C:\Windows\System\QaaAdkA.exe
  C:\Windows\System\QaaAdkA.exe
  2⤵
  PID:8916
- C:\Windows\System\vMlGSri.exe
  C:\Windows\System\vMlGSri.exe
  2⤵
  PID:8956
- C:\Windows\System\ZeOmjWB.exe
  C:\Windows\System\ZeOmjWB.exe
  2⤵
  PID:8996
- C:\Windows\System\VbTbuux.exe
  C:\Windows\System\VbTbuux.exe
  2⤵
  PID:9088
- C:\Windows\System\lfzERlv.exe
  C:\Windows\System\lfzERlv.exe
  2⤵
  PID:9140
- C:\Windows\System\hranlca.exe
  C:\Windows\System\hranlca.exe
  2⤵
  PID:7632
- C:\Windows\System\dyOKmFe.exe
  C:\Windows\System\dyOKmFe.exe
  2⤵
  PID:8252
- C:\Windows\System\clVyZjb.exe
  C:\Windows\System\clVyZjb.exe
  2⤵
  PID:8368
- C:\Windows\System\ezaUOft.exe
  C:\Windows\System\ezaUOft.exe
  2⤵
  PID:8512
- C:\Windows\System\OxurJPt.exe
  C:\Windows\System\OxurJPt.exe
  2⤵
  PID:8636
- C:\Windows\System\nVjvtxw.exe
  C:\Windows\System\nVjvtxw.exe
  2⤵
  PID:8796
- C:\Windows\System\PnQPxug.exe
  C:\Windows\System\PnQPxug.exe
  2⤵
  PID:8936
- C:\Windows\System\UhfZLbh.exe
  C:\Windows\System\UhfZLbh.exe
  2⤵
  PID:9112
- C:\Windows\System\skvNPRL.exe
  C:\Windows\System\skvNPRL.exe
  2⤵
  PID:9180
- C:\Windows\System\goZQKpB.exe
  C:\Windows\System\goZQKpB.exe
  2⤵
  PID:4728
- C:\Windows\System\LeaTXkR.exe
  C:\Windows\System\LeaTXkR.exe
  2⤵
  PID:8872
- C:\Windows\System\nLlBlyl.exe
  C:\Windows\System\nLlBlyl.exe
  2⤵
  PID:9196
- C:\Windows\System\DWKnQWH.exe
  C:\Windows\System\DWKnQWH.exe
  2⤵
  PID:8880
- C:\Windows\System\vCSuHhq.exe
  C:\Windows\System\vCSuHhq.exe
  2⤵
  PID:9080
- C:\Windows\System\pljFQRJ.exe
  C:\Windows\System\pljFQRJ.exe
  2⤵
  PID:9224
- C:\Windows\System\ZNQsMTh.exe
  C:\Windows\System\ZNQsMTh.exe
  2⤵
  PID:9260
- C:\Windows\System\IdIytTv.exe
  C:\Windows\System\IdIytTv.exe
  2⤵
  PID:9300
- C:\Windows\System\tPIXHDo.exe
  C:\Windows\System\tPIXHDo.exe
  2⤵
  PID:9332
- C:\Windows\System\WwyabdF.exe
  C:\Windows\System\WwyabdF.exe
  2⤵
  PID:9360
- C:\Windows\System\SSYeiFz.exe
  C:\Windows\System\SSYeiFz.exe
  2⤵
  PID:9376
- C:\Windows\System\fgPzyPo.exe
  C:\Windows\System\fgPzyPo.exe
  2⤵
  PID:9408
- C:\Windows\System\lOoDgzz.exe
  C:\Windows\System\lOoDgzz.exe
  2⤵
  PID:9444
- C:\Windows\System\mTcaAnY.exe
  C:\Windows\System\mTcaAnY.exe
  2⤵
  PID:9472
- C:\Windows\System\LpNhNzT.exe
  C:\Windows\System\LpNhNzT.exe
  2⤵
  PID:9500
- C:\Windows\System\TpTfEyW.exe
  C:\Windows\System\TpTfEyW.exe
  2⤵
  PID:9528
- C:\Windows\System\QAVJCMt.exe
  C:\Windows\System\QAVJCMt.exe
  2⤵
  PID:9556
- C:\Windows\System\bkwHlCV.exe
  C:\Windows\System\bkwHlCV.exe
  2⤵
  PID:9584
- C:\Windows\System\Vycindw.exe
  C:\Windows\System\Vycindw.exe
  2⤵
  PID:9612
- C:\Windows\System\jVWEsGf.exe
  C:\Windows\System\jVWEsGf.exe
  2⤵
  PID:9640
- C:\Windows\System\HGpVCLi.exe
  C:\Windows\System\HGpVCLi.exe
  2⤵
  PID:9668
- C:\Windows\System\CpAaYth.exe
  C:\Windows\System\CpAaYth.exe
  2⤵
  PID:9696
- C:\Windows\System\ERQIBUU.exe
  C:\Windows\System\ERQIBUU.exe
  2⤵
  PID:9716
- C:\Windows\System\QfojGnQ.exe
  C:\Windows\System\QfojGnQ.exe
  2⤵
  PID:9752
- C:\Windows\System\eSEGkHu.exe
  C:\Windows\System\eSEGkHu.exe
  2⤵
  PID:9788
- C:\Windows\System\KolCkgo.exe
  C:\Windows\System\KolCkgo.exe
  2⤵
  PID:9820
- C:\Windows\System\mStlGPp.exe
  C:\Windows\System\mStlGPp.exe
  2⤵
  PID:9848
- C:\Windows\System\UMFqmxH.exe
  C:\Windows\System\UMFqmxH.exe
  2⤵
  PID:9876
- C:\Windows\System\INZbNSo.exe
  C:\Windows\System\INZbNSo.exe
  2⤵
  PID:9900
- C:\Windows\System\lsOkAQY.exe
  C:\Windows\System\lsOkAQY.exe
  2⤵
  PID:9944
- C:\Windows\System\lzzntwg.exe
  C:\Windows\System\lzzntwg.exe
  2⤵
  PID:9980
- C:\Windows\System\KALoWDr.exe
  C:\Windows\System\KALoWDr.exe
  2⤵
  PID:10016
- C:\Windows\System\dCoNmEL.exe
  C:\Windows\System\dCoNmEL.exe
  2⤵
  PID:10044
- C:\Windows\System\kbeQORY.exe
  C:\Windows\System\kbeQORY.exe
  2⤵
  PID:10084
- C:\Windows\System\hcFvVQm.exe
  C:\Windows\System\hcFvVQm.exe
  2⤵
  PID:10128
- C:\Windows\System\zDJNkcH.exe
  C:\Windows\System\zDJNkcH.exe
  2⤵
  PID:10144
- C:\Windows\System\WReMNtH.exe
  C:\Windows\System\WReMNtH.exe
  2⤵
  PID:10164
- C:\Windows\System\ZUzCbDM.exe
  C:\Windows\System\ZUzCbDM.exe
  2⤵
  PID:10208
- C:\Windows\System\OJSvMAG.exe
  C:\Windows\System\OJSvMAG.exe
  2⤵
  PID:10228
- C:\Windows\System\uJKluIT.exe
  C:\Windows\System\uJKluIT.exe
  2⤵
  PID:9256
- C:\Windows\System\HMXpFeL.exe
  C:\Windows\System\HMXpFeL.exe
  2⤵
  PID:9356
- C:\Windows\System\okYwnvU.exe
  C:\Windows\System\okYwnvU.exe
  2⤵
  PID:9440
- C:\Windows\System\SHPcvoX.exe
  C:\Windows\System\SHPcvoX.exe
  2⤵
  PID:9496
- C:\Windows\System\ombPLZK.exe
  C:\Windows\System\ombPLZK.exe
  2⤵
  PID:9568
- C:\Windows\System\ZFmSdUz.exe
  C:\Windows\System\ZFmSdUz.exe
  2⤵
  PID:4564
- C:\Windows\System\hUaLNOh.exe
  C:\Windows\System\hUaLNOh.exe
  2⤵
  PID:9688
- C:\Windows\System\XAgugNf.exe
  C:\Windows\System\XAgugNf.exe
  2⤵
  PID:9736
- C:\Windows\System\UvTXzlQ.exe
  C:\Windows\System\UvTXzlQ.exe
  2⤵
  PID:9784
- C:\Windows\System\rqdUxOL.exe
  C:\Windows\System\rqdUxOL.exe
  2⤵
  PID:9884
- C:\Windows\System\HrJhpmc.exe
  C:\Windows\System\HrJhpmc.exe
  2⤵
  PID:9992
- C:\Windows\System\yskPhTo.exe
  C:\Windows\System\yskPhTo.exe
  2⤵
  PID:10096
- C:\Windows\System\tSMwDkq.exe
  C:\Windows\System\tSMwDkq.exe
  2⤵
  PID:9828
- C:\Windows\System\RyLArrK.exe
  C:\Windows\System\RyLArrK.exe
  2⤵
  PID:9220
- C:\Windows\System\ENfGvnl.exe
  C:\Windows\System\ENfGvnl.exe
  2⤵
  PID:9468
- C:\Windows\System\GhRqPhk.exe
  C:\Windows\System\GhRqPhk.exe
  2⤵
  PID:9580
- C:\Windows\System\uDGRcwA.exe
  C:\Windows\System\uDGRcwA.exe
  2⤵
  PID:9660
- C:\Windows\System\YBJfDZK.exe
  C:\Windows\System\YBJfDZK.exe
  2⤵
  PID:10004
- C:\Windows\System\BokalCz.exe
  C:\Windows\System\BokalCz.exe
  2⤵
  PID:9812
- C:\Windows\System\uZQQorQ.exe
  C:\Windows\System\uZQQorQ.exe
  2⤵
  PID:10068
- C:\Windows\System\RkGVsYq.exe
  C:\Windows\System\RkGVsYq.exe
  2⤵
  PID:9316
- C:\Windows\System\xCMXlkM.exe
  C:\Windows\System\xCMXlkM.exe
  2⤵
  PID:9540
- C:\Windows\System\ZRhUrrU.exe
  C:\Windows\System\ZRhUrrU.exe
  2⤵
  PID:10244
- C:\Windows\System\zOvOTjH.exe
  C:\Windows\System\zOvOTjH.exe
  2⤵
  PID:10264
- C:\Windows\System\AIsJHdh.exe
  C:\Windows\System\AIsJHdh.exe
  2⤵
  PID:10296
- C:\Windows\System\ARiOOPO.exe
  C:\Windows\System\ARiOOPO.exe
  2⤵
  PID:10332
- C:\Windows\System\erPAWun.exe
  C:\Windows\System\erPAWun.exe
  2⤵
  PID:10372
- C:\Windows\System\eEAbbuA.exe
  C:\Windows\System\eEAbbuA.exe
  2⤵
  PID:10412
- C:\Windows\System\HBUgSfw.exe
  C:\Windows\System\HBUgSfw.exe
  2⤵
  PID:10440
- C:\Windows\System\DSxjHAC.exe
  C:\Windows\System\DSxjHAC.exe
  2⤵
  PID:10472
- C:\Windows\System\lUwhdsp.exe
  C:\Windows\System\lUwhdsp.exe
  2⤵
  PID:10492
- C:\Windows\System\lzJBbJr.exe
  C:\Windows\System\lzJBbJr.exe
  2⤵
  PID:10528
- C:\Windows\System\dNUEfvT.exe
  C:\Windows\System\dNUEfvT.exe
  2⤵
  PID:10552
- C:\Windows\System\xuuAhfp.exe
  C:\Windows\System\xuuAhfp.exe
  2⤵
  PID:10580
- C:\Windows\System\huvQSVC.exe
  C:\Windows\System\huvQSVC.exe
  2⤵
  PID:10596
- C:\Windows\System\BLEkhlP.exe
  C:\Windows\System\BLEkhlP.exe
  2⤵
  PID:10632
- C:\Windows\System\ecTqXmb.exe
  C:\Windows\System\ecTqXmb.exe
  2⤵
  PID:10668
- C:\Windows\System\UIgEkMk.exe
  C:\Windows\System\UIgEkMk.exe
  2⤵
  PID:10696
- C:\Windows\System\zoEmMsv.exe
  C:\Windows\System\zoEmMsv.exe
  2⤵
  PID:10724
- C:\Windows\System\sOvVGDh.exe
  C:\Windows\System\sOvVGDh.exe
  2⤵
  PID:10760
- C:\Windows\System\TyxgHDn.exe
  C:\Windows\System\TyxgHDn.exe
  2⤵
  PID:10800
- C:\Windows\System\LXSJgoI.exe
  C:\Windows\System\LXSJgoI.exe
  2⤵
  PID:10840
- C:\Windows\System\HLGHnjG.exe
  C:\Windows\System\HLGHnjG.exe
  2⤵
  PID:10864
- C:\Windows\System\hWZBers.exe
  C:\Windows\System\hWZBers.exe
  2⤵
  PID:10888
- C:\Windows\System\EyAeZyI.exe
  C:\Windows\System\EyAeZyI.exe
  2⤵
  PID:10920
- C:\Windows\System\uNHhHlo.exe
  C:\Windows\System\uNHhHlo.exe
  2⤵
  PID:10960
- C:\Windows\System\BOkYrHH.exe
  C:\Windows\System\BOkYrHH.exe
  2⤵
  PID:10976
- C:\Windows\System\QOWUfJC.exe
  C:\Windows\System\QOWUfJC.exe
  2⤵
  PID:11004
- C:\Windows\System\bBXqINR.exe
  C:\Windows\System\bBXqINR.exe
  2⤵
  PID:11032
- C:\Windows\System\XYPQFen.exe
  C:\Windows\System\XYPQFen.exe
  2⤵
  PID:11072
- C:\Windows\System\AYSqSOg.exe
  C:\Windows\System\AYSqSOg.exe
  2⤵
  PID:11100
- C:\Windows\System\hADjZYm.exe
  C:\Windows\System\hADjZYm.exe
  2⤵
  PID:11116
- C:\Windows\System\EcfHDUO.exe
  C:\Windows\System\EcfHDUO.exe
  2⤵
  PID:11152
- C:\Windows\System\DfJLUrj.exe
  C:\Windows\System\DfJLUrj.exe
  2⤵
  PID:11180
- C:\Windows\System\lPpFVcI.exe
  C:\Windows\System\lPpFVcI.exe
  2⤵
  PID:11204
- C:\Windows\System\gpBYXnc.exe
  C:\Windows\System\gpBYXnc.exe
  2⤵
  PID:11240
- C:\Windows\System\GwdSuvh.exe
  C:\Windows\System\GwdSuvh.exe
  2⤵
  PID:9712
- C:\Windows\System\WUffMsP.exe
  C:\Windows\System\WUffMsP.exe
  2⤵
  PID:9932
- C:\Windows\System\iDLHlXP.exe
  C:\Windows\System\iDLHlXP.exe
  2⤵
  PID:10260
- C:\Windows\System\uYelaTg.exe
  C:\Windows\System\uYelaTg.exe
  2⤵
  PID:10356
- C:\Windows\System\iAuwudg.exe
  C:\Windows\System\iAuwudg.exe
  2⤵
  PID:10396
- C:\Windows\System\idxDJxh.exe
  C:\Windows\System\idxDJxh.exe
  2⤵
  PID:10480
- C:\Windows\System\hPEINeu.exe
  C:\Windows\System\hPEINeu.exe
  2⤵
  PID:10504
- C:\Windows\System\NxbimSF.exe
  C:\Windows\System\NxbimSF.exe
  2⤵
  PID:10608
- C:\Windows\System\djkozXT.exe
  C:\Windows\System\djkozXT.exe
  2⤵
  PID:10656
- C:\Windows\System\TyVvznx.exe
  C:\Windows\System\TyVvznx.exe
  2⤵
  PID:10676
- C:\Windows\System\fLLaRhD.exe
  C:\Windows\System\fLLaRhD.exe
  2⤵
  PID:10776
- C:\Windows\System\BQEdgMd.exe
  C:\Windows\System\BQEdgMd.exe
  2⤵
  PID:10832
- C:\Windows\System\LXpJuqr.exe
  C:\Windows\System\LXpJuqr.exe
  2⤵
  PID:2396
- C:\Windows\System\jaxUksX.exe
  C:\Windows\System\jaxUksX.exe
  2⤵
  PID:10940
- C:\Windows\System\ZDWjtWg.exe
  C:\Windows\System\ZDWjtWg.exe
  2⤵
  PID:10988
- C:\Windows\System\denJTIg.exe
  C:\Windows\System\denJTIg.exe
  2⤵
  PID:11056
- C:\Windows\System\dndWLrj.exe
  C:\Windows\System\dndWLrj.exe
  2⤵
  PID:11112
- C:\Windows\System\slbrJcl.exe
  C:\Windows\System\slbrJcl.exe
  2⤵
  PID:11136
- C:\Windows\System\yhHmOSK.exe
  C:\Windows\System\yhHmOSK.exe
  2⤵
  PID:9636
- C:\Windows\System\pJTKOJT.exe
  C:\Windows\System\pJTKOJT.exe
  2⤵
  PID:10216
- C:\Windows\System\AFiLUbv.exe
  C:\Windows\System\AFiLUbv.exe
  2⤵
  PID:10308
- C:\Windows\System\kZyZRml.exe
  C:\Windows\System\kZyZRml.exe
  2⤵
  PID:10560
- C:\Windows\System\HacCvOl.exe
  C:\Windows\System\HacCvOl.exe
  2⤵
  PID:10644
- C:\Windows\System\CcHqdiv.exe
  C:\Windows\System\CcHqdiv.exe
  2⤵
  PID:10752
- C:\Windows\System\DjbJCOU.exe
  C:\Windows\System\DjbJCOU.exe
  2⤵
  PID:4156
- C:\Windows\System\gqufDob.exe
  C:\Windows\System\gqufDob.exe
  2⤵
  PID:10876
- C:\Windows\System\twvtwat.exe
  C:\Windows\System\twvtwat.exe
  2⤵
  PID:11044
- C:\Windows\System\ljaakdm.exe
  C:\Windows\System\ljaakdm.exe
  2⤵
  PID:11224
- C:\Windows\System\pMaSjlT.exe
  C:\Windows\System\pMaSjlT.exe
  2⤵
  PID:9844
- C:\Windows\System\DmnwmoH.exe
  C:\Windows\System\DmnwmoH.exe
  2⤵
  PID:10828
- C:\Windows\System\vCSKDiI.exe
  C:\Windows\System\vCSKDiI.exe
  2⤵
  PID:11168
- C:\Windows\System\kFOpUXj.exe
  C:\Windows\System\kFOpUXj.exe
  2⤵
  PID:11276
- C:\Windows\System\PwyqhuJ.exe
  C:\Windows\System\PwyqhuJ.exe
  2⤵
  PID:11312
- C:\Windows\System\brigmtN.exe
  C:\Windows\System\brigmtN.exe
  2⤵
  PID:11336
- C:\Windows\System\jyIJIMT.exe
  C:\Windows\System\jyIJIMT.exe
  2⤵
  PID:11372
- C:\Windows\System\ZyzRvAq.exe
  C:\Windows\System\ZyzRvAq.exe
  2⤵
  PID:11388
- C:\Windows\System\dwFEggT.exe
  C:\Windows\System\dwFEggT.exe
  2⤵
  PID:11432
- C:\Windows\System\EaJtYEd.exe
  C:\Windows\System\EaJtYEd.exe
  2⤵
  PID:11452
- C:\Windows\System\JuuxwNd.exe
  C:\Windows\System\JuuxwNd.exe
  2⤵
  PID:11484
- C:\Windows\System\PfyCqmj.exe
  C:\Windows\System\PfyCqmj.exe
  2⤵
  PID:11524
- C:\Windows\System\uNaXDpT.exe
  C:\Windows\System\uNaXDpT.exe
  2⤵
  PID:11544
- C:\Windows\System\ADTPeEc.exe
  C:\Windows\System\ADTPeEc.exe
  2⤵
  PID:11568
- C:\Windows\System\iWzauUg.exe
  C:\Windows\System\iWzauUg.exe
  2⤵
  PID:11596
- C:\Windows\System\sDjEHiT.exe
  C:\Windows\System\sDjEHiT.exe
  2⤵
  PID:11624
- C:\Windows\System\KpPXAha.exe
  C:\Windows\System\KpPXAha.exe
  2⤵
  PID:11664
- C:\Windows\System\EedeKzM.exe
  C:\Windows\System\EedeKzM.exe
  2⤵
  PID:11692
- C:\Windows\System\RdyDbAO.exe
  C:\Windows\System\RdyDbAO.exe
  2⤵
  PID:11720
- C:\Windows\System\agUXyLJ.exe
  C:\Windows\System\agUXyLJ.exe
  2⤵
  PID:11736
- C:\Windows\System\EegFwmD.exe
  C:\Windows\System\EegFwmD.exe
  2⤵
  PID:11784
- C:\Windows\System\lrCemHR.exe
  C:\Windows\System\lrCemHR.exe
  2⤵
  PID:11804
- C:\Windows\System\BIUxEcx.exe
  C:\Windows\System\BIUxEcx.exe
  2⤵
  PID:11832
- C:\Windows\System\ClDUCwP.exe
  C:\Windows\System\ClDUCwP.exe
  2⤵
  PID:11860
- C:\Windows\System\SYCnyxd.exe
  C:\Windows\System\SYCnyxd.exe
  2⤵
  PID:11888
- C:\Windows\System\qAqBeot.exe
  C:\Windows\System\qAqBeot.exe
  2⤵
  PID:11928
- C:\Windows\System\AMuqMHE.exe
  C:\Windows\System\AMuqMHE.exe
  2⤵
  PID:11944
- C:\Windows\System\zozOptB.exe
  C:\Windows\System\zozOptB.exe
  2⤵
  PID:11972
- C:\Windows\System\mTiSRZN.exe
  C:\Windows\System\mTiSRZN.exe
  2⤵
  PID:12000
- C:\Windows\System\KDQZOqJ.exe
  C:\Windows\System\KDQZOqJ.exe
  2⤵
  PID:12016
- C:\Windows\System\klCgong.exe
  C:\Windows\System\klCgong.exe
  2⤵
  PID:12040
- C:\Windows\System\GVOHyqZ.exe
  C:\Windows\System\GVOHyqZ.exe
  2⤵
  PID:12072
- C:\Windows\System\BhMLQHe.exe
  C:\Windows\System\BhMLQHe.exe
  2⤵
  PID:12088
- C:\Windows\System\XhXEMGC.exe
  C:\Windows\System\XhXEMGC.exe
  2⤵
  PID:12116
- C:\Windows\System\lWlPAZQ.exe
  C:\Windows\System\lWlPAZQ.exe
  2⤵
  PID:12144
- C:\Windows\System\uBubmdW.exe
  C:\Windows\System\uBubmdW.exe
  2⤵
  PID:12176
- C:\Windows\System\lHrOlhk.exe
  C:\Windows\System\lHrOlhk.exe
  2⤵
  PID:12212
- C:\Windows\System\GzMMGDs.exe
  C:\Windows\System\GzMMGDs.exe
  2⤵
  PID:12236
- C:\Windows\System\asHVktT.exe
  C:\Windows\System\asHVktT.exe
  2⤵
  PID:12268
- C:\Windows\System\XTksNYm.exe
  C:\Windows\System\XTksNYm.exe
  2⤵
  PID:10524
- C:\Windows\System\wKntslT.exe
  C:\Windows\System\wKntslT.exe
  2⤵
  PID:10324
- C:\Windows\System\XxWAEip.exe
  C:\Windows\System\XxWAEip.exe
  2⤵
  PID:10996
- C:\Windows\System\xFrqmXe.exe
  C:\Windows\System\xFrqmXe.exe
  2⤵
  PID:11412
- C:\Windows\System\eAHkxbV.exe
  C:\Windows\System\eAHkxbV.exe
  2⤵
  PID:11468
- C:\Windows\System\kEIDbcS.exe
  C:\Windows\System\kEIDbcS.exe
  2⤵
  PID:11532
- C:\Windows\System\tKBAQzk.exe
  C:\Windows\System\tKBAQzk.exe
  2⤵
  PID:11608
- C:\Windows\System\RUVPeSg.exe
  C:\Windows\System\RUVPeSg.exe
  2⤵
  PID:11680
- C:\Windows\System\Qsvzeua.exe
  C:\Windows\System\Qsvzeua.exe
  2⤵
  PID:11728
- C:\Windows\System\xKFaSjl.exe
  C:\Windows\System\xKFaSjl.exe
  2⤵
  PID:11824
- C:\Windows\System\NBBeiBe.exe
  C:\Windows\System\NBBeiBe.exe
  2⤵
  PID:11876
- C:\Windows\System\ZyecSEe.exe
  C:\Windows\System\ZyecSEe.exe
  2⤵
  PID:11960
- C:\Windows\System\oEmPdta.exe
  C:\Windows\System\oEmPdta.exe
  2⤵
  PID:11984
- C:\Windows\System\BHNBWLZ.exe
  C:\Windows\System\BHNBWLZ.exe
  2⤵
  PID:12108
- C:\Windows\System\nCVgFxd.exe
  C:\Windows\System\nCVgFxd.exe
  2⤵
  PID:12140
- C:\Windows\System\TNodIXO.exe
  C:\Windows\System\TNodIXO.exe
  2⤵
  PID:12184
- C:\Windows\System\cGYKOEa.exe
  C:\Windows\System\cGYKOEa.exe
  2⤵
  PID:10592
- C:\Windows\System\imHGNLN.exe
  C:\Windows\System\imHGNLN.exe
  2⤵
  PID:11308
- C:\Windows\System\InKgmTz.exe
  C:\Windows\System\InKgmTz.exe
  2⤵
  PID:11440
- C:\Windows\System\DnODhvw.exe
  C:\Windows\System\DnODhvw.exe
  2⤵
  PID:11676
- C:\Windows\System\XNDSWaK.exe
  C:\Windows\System\XNDSWaK.exe
  2⤵
  PID:11796
- C:\Windows\System\ImFRqFo.exe
  C:\Windows\System\ImFRqFo.exe
  2⤵
  PID:11988
- C:\Windows\System\iQYZsLq.exe
  C:\Windows\System\iQYZsLq.exe
  2⤵
  PID:12124
- C:\Windows\System\qXgzEll.exe
  C:\Windows\System\qXgzEll.exe
  2⤵
  PID:12068
- C:\Windows\System\qwurqMg.exe
  C:\Windows\System\qwurqMg.exe
  2⤵
  PID:12232
- C:\Windows\System\sOQJamR.exe
  C:\Windows\System\sOQJamR.exe
  2⤵
  PID:11384
- C:\Windows\System\htzRuGx.exe
  C:\Windows\System\htzRuGx.exe
  2⤵
  PID:11760
- C:\Windows\System\MWlUJOv.exe
  C:\Windows\System\MWlUJOv.exe
  2⤵
  PID:10184
- C:\Windows\System\XdkYMrn.exe
  C:\Windows\System\XdkYMrn.exe
  2⤵
  PID:12320
- C:\Windows\System\TjBkopZ.exe
  C:\Windows\System\TjBkopZ.exe
  2⤵
  PID:12352
- C:\Windows\System\LMNXaOZ.exe
  C:\Windows\System\LMNXaOZ.exe
  2⤵
  PID:12372
- C:\Windows\System\vWkMgNz.exe
  C:\Windows\System\vWkMgNz.exe
  2⤵
  PID:12400
- C:\Windows\System\ojUEVTo.exe
  C:\Windows\System\ojUEVTo.exe
  2⤵
  PID:12432
- C:\Windows\System\GyVqSku.exe
  C:\Windows\System\GyVqSku.exe
  2⤵
  PID:12472
- C:\Windows\System\UuqQAKT.exe
  C:\Windows\System\UuqQAKT.exe
  2⤵
  PID:12492
- C:\Windows\System\VcBOajD.exe
  C:\Windows\System\VcBOajD.exe
  2⤵
  PID:12520
- C:\Windows\System\fshlcLA.exe
  C:\Windows\System\fshlcLA.exe
  2⤵
  PID:12544
- C:\Windows\System\zBMeFMF.exe
  C:\Windows\System\zBMeFMF.exe
  2⤵
  PID:12576
- C:\Windows\System\peTNQUL.exe
  C:\Windows\System\peTNQUL.exe
  2⤵
  PID:12604
- C:\Windows\System\FwbqyfL.exe
  C:\Windows\System\FwbqyfL.exe
  2⤵
  PID:12636
- C:\Windows\System\jPaEGpS.exe
  C:\Windows\System\jPaEGpS.exe
  2⤵
  PID:12668
- C:\Windows\System\EtJGmfb.exe
  C:\Windows\System\EtJGmfb.exe
  2⤵
  PID:12700
- C:\Windows\System\MswAjPq.exe
  C:\Windows\System\MswAjPq.exe
  2⤵
  PID:12716
- C:\Windows\System\PpRIvtb.exe
  C:\Windows\System\PpRIvtb.exe
  2⤵
  PID:12732
- C:\Windows\System\LoNMHXy.exe
  C:\Windows\System\LoNMHXy.exe
  2⤵
  PID:12768
- C:\Windows\System\JWoXgKP.exe
  C:\Windows\System\JWoXgKP.exe
  2⤵
  PID:12792
- C:\Windows\System\BgtTICb.exe
  C:\Windows\System\BgtTICb.exe
  2⤵
  PID:12816
- C:\Windows\System\gLAmHMx.exe
  C:\Windows\System\gLAmHMx.exe
  2⤵
  PID:12848
- C:\Windows\System\DIGptBd.exe
  C:\Windows\System\DIGptBd.exe
  2⤵
  PID:12884
- C:\Windows\System\zwrrXhM.exe
  C:\Windows\System\zwrrXhM.exe
  2⤵
  PID:12912
- C:\Windows\System\CaCCIhh.exe
  C:\Windows\System\CaCCIhh.exe
  2⤵
  PID:12940
- C:\Windows\System\vQAdrFw.exe
  C:\Windows\System\vQAdrFw.exe
  2⤵
  PID:12964
- C:\Windows\System\zUUaWFV.exe
  C:\Windows\System\zUUaWFV.exe
  2⤵
  PID:12984
- C:\Windows\System\FcjDYjI.exe
  C:\Windows\System\FcjDYjI.exe
  2⤵
  PID:13012
- C:\Windows\System\UYBQzxI.exe
  C:\Windows\System\UYBQzxI.exe
  2⤵
  PID:13048
- C:\Windows\System\DcBJRgS.exe
  C:\Windows\System\DcBJRgS.exe
  2⤵
  PID:13080
- C:\Windows\System\menXZrM.exe
  C:\Windows\System\menXZrM.exe
  2⤵
  PID:13112
- C:\Windows\System\pYwqRar.exe
  C:\Windows\System\pYwqRar.exe
  2⤵
  PID:13136
- C:\Windows\System\vbhyDbT.exe
  C:\Windows\System\vbhyDbT.exe
  2⤵
  PID:13164
- C:\Windows\System\BMCppBe.exe
  C:\Windows\System\BMCppBe.exe
  2⤵
  PID:13192
- C:\Windows\System\zGqEAWJ.exe
  C:\Windows\System\zGqEAWJ.exe
  2⤵
  PID:13220
- C:\Windows\System\dePZOdx.exe
  C:\Windows\System\dePZOdx.exe
  2⤵
  PID:13252
- C:\Windows\System\DkdvoaX.exe
  C:\Windows\System\DkdvoaX.exe
  2⤵
  PID:13268
- C:\Windows\System\FnWOHew.exe
  C:\Windows\System\FnWOHew.exe
  2⤵
  PID:13292
- C:\Windows\System\ANjfGeH.exe
  C:\Windows\System\ANjfGeH.exe
  2⤵
  PID:13308
- C:\Windows\System\HDKEKqf.exe
  C:\Windows\System\HDKEKqf.exe
  2⤵
  PID:12340
- C:\Windows\System\MofZBMV.exe
  C:\Windows\System\MofZBMV.exe
  2⤵
  PID:12392
- C:\Windows\System\hOvCkeC.exe
  C:\Windows\System\hOvCkeC.exe
  2⤵
  PID:12460
- C:\Windows\System\FUusIUq.exe
  C:\Windows\System\FUusIUq.exe
  2⤵
  PID:12552
- C:\Windows\System\zCtaEWY.exe
  C:\Windows\System\zCtaEWY.exe
  2⤵
  PID:12624
- C:\Windows\System\dLwnOWx.exe
  C:\Windows\System\dLwnOWx.exe
  2⤵
  PID:12684
- C:\Windows\System\hDdTcPO.exe
  C:\Windows\System\hDdTcPO.exe
  2⤵
  PID:12708
- C:\Windows\System\zcThHCr.exe
  C:\Windows\System\zcThHCr.exe
  2⤵
  PID:12744
- C:\Windows\System\getRdfQ.exe
  C:\Windows\System\getRdfQ.exe
  2⤵
  PID:12812
- C:\Windows\System\DhKlxEQ.exe
  C:\Windows\System\DhKlxEQ.exe
  2⤵
  PID:12872
- C:\Windows\System\NowSOoT.exe
  C:\Windows\System\NowSOoT.exe
  2⤵
  PID:12932
- C:\Windows\System\ORsfgDp.exe
  C:\Windows\System\ORsfgDp.exe
  2⤵
  PID:13024
- C:\Windows\System\eDuxeoC.exe
  C:\Windows\System\eDuxeoC.exe
  2⤵
  PID:13036
- C:\Windows\System\QshQVuB.exe
  C:\Windows\System\QshQVuB.exe
  2⤵
  PID:13288
- C:\Windows\System\qbsbvDm.exe
  C:\Windows\System\qbsbvDm.exe
  2⤵
  PID:13304
- C:\Windows\System\jXCPDkE.exe
  C:\Windows\System\jXCPDkE.exe
  2⤵
  PID:12332
- C:\Windows\System\ClAPKGQ.exe
  C:\Windows\System\ClAPKGQ.exe
  2⤵
  PID:12452
- C:\Windows\System\sajnANZ.exe
  C:\Windows\System\sajnANZ.exe
  2⤵
  PID:12592
- C:\Windows\System\CDFNZZV.exe
  C:\Windows\System\CDFNZZV.exe
  2⤵
  PID:12712
- C:\Windows\System\DobvQJX.exe
  C:\Windows\System\DobvQJX.exe
  2⤵
  PID:12840
- C:\Windows\System\hJgOYla.exe
  C:\Windows\System\hJgOYla.exe
  2⤵
  PID:13132
- C:\Windows\System\nLAiteF.exe
  C:\Windows\System\nLAiteF.exe
  2⤵
  PID:13076
- C:\Windows\System\aSJrIoJ.exe
  C:\Windows\System\aSJrIoJ.exe
  2⤵
  PID:13260
- C:\Windows\System\ShjuOpg.exe
  C:\Windows\System\ShjuOpg.exe
  2⤵
  PID:12360
- C:\Windows\System\dOWeRWF.exe
  C:\Windows\System\dOWeRWF.exe
  2⤵
  PID:12724
- C:\Windows\System\TlZHsxu.exe
  C:\Windows\System\TlZHsxu.exe
  2⤵
  PID:12784
- C:\Windows\System\DqhzhNl.exe
  C:\Windows\System\DqhzhNl.exe
  2⤵
  PID:13284
- C:\Windows\System\UriFliR.exe
  C:\Windows\System\UriFliR.exe
  2⤵
  PID:13324
- C:\Windows\System\rWtOGuD.exe
  C:\Windows\System\rWtOGuD.exe
  2⤵
  PID:13348
- C:\Windows\System\OdEKLPq.exe
  C:\Windows\System\OdEKLPq.exe
  2⤵
  PID:13380
- C:\Windows\System\sUfmnKx.exe
  C:\Windows\System\sUfmnKx.exe
  2⤵
  PID:13404
- C:\Windows\System\zjiEdMM.exe
  C:\Windows\System\zjiEdMM.exe
  2⤵
  PID:13432
- C:\Windows\System\wdgrwgz.exe
  C:\Windows\System\wdgrwgz.exe
  2⤵
  PID:13456
- C:\Windows\System\hBIDuBA.exe
  C:\Windows\System\hBIDuBA.exe
  2⤵
  PID:13476
- C:\Windows\System\pBtEFiR.exe
  C:\Windows\System\pBtEFiR.exe
  2⤵
  PID:13516
- C:\Windows\System\ZnwKHAa.exe
  C:\Windows\System\ZnwKHAa.exe
  2⤵
  PID:13548
- C:\Windows\System\cIXOGJK.exe
  C:\Windows\System\cIXOGJK.exe
  2⤵
  PID:13564
- C:\Windows\System\AmiyKXU.exe
  C:\Windows\System\AmiyKXU.exe
  2⤵
  PID:13588
- C:\Windows\System\aHFxiiE.exe
  C:\Windows\System\aHFxiiE.exe
  2⤵
  PID:13620
- C:\Windows\System\efqgQts.exe
  C:\Windows\System\efqgQts.exe
  2⤵
  PID:13640
- C:\Windows\System\ZCKJfiJ.exe
  C:\Windows\System\ZCKJfiJ.exe
  2⤵
  PID:13676
- C:\Windows\System\wZbHNtU.exe
  C:\Windows\System\wZbHNtU.exe
  2⤵
  PID:13708
- C:\Windows\System\upuOObU.exe
  C:\Windows\System\upuOObU.exe
  2⤵
  PID:13740
- C:\Windows\System\iJMbYGT.exe
  C:\Windows\System\iJMbYGT.exe
  2⤵
  PID:13764
- C:\Windows\System\auCFZkx.exe
  C:\Windows\System\auCFZkx.exe
  2⤵
  PID:13800
- C:\Windows\System\nTHiSlL.exe
  C:\Windows\System\nTHiSlL.exe
  2⤵
  PID:13824
- C:\Windows\System\LLEBZwZ.exe
  C:\Windows\System\LLEBZwZ.exe
  2⤵
  PID:13852
- C:\Windows\System\sOeCdtC.exe
  C:\Windows\System\sOeCdtC.exe
  2⤵
  PID:13872
- C:\Windows\System\qdbSsfc.exe
  C:\Windows\System\qdbSsfc.exe
  2⤵
  PID:13904
- C:\Windows\System\lAPrDYo.exe
  C:\Windows\System\lAPrDYo.exe
  2⤵
  PID:13936
- C:\Windows\System\zJMdUAs.exe
  C:\Windows\System\zJMdUAs.exe
  2⤵
  PID:13964
- C:\Windows\System\utzhYUi.exe
  C:\Windows\System\utzhYUi.exe
  2⤵
  PID:13988
- C:\Windows\System\ExJwFDK.exe
  C:\Windows\System\ExJwFDK.exe
  2⤵
  PID:14012
- C:\Windows\System\YKJWUbY.exe
  C:\Windows\System\YKJWUbY.exe
  2⤵
  PID:14040
- C:\Windows\System\nNYpzFp.exe
  C:\Windows\System\nNYpzFp.exe
  2⤵
  PID:14064
- C:\Windows\System\qfIwuku.exe
  C:\Windows\System\qfIwuku.exe
  2⤵
  PID:14092
- C:\Windows\System\rQnzDAN.exe
  C:\Windows\System\rQnzDAN.exe
  2⤵
  PID:14124
- C:\Windows\System\TgNQUpw.exe
  C:\Windows\System\TgNQUpw.exe
  2⤵
  PID:14148
- C:\Windows\System\tqRpoKw.exe
  C:\Windows\System\tqRpoKw.exe
  2⤵
  PID:14184
- C:\Windows\System\VZtdjTB.exe
  C:\Windows\System\VZtdjTB.exe
  2⤵
  PID:14216
- C:\Windows\System\RhLWdDR.exe
  C:\Windows\System\RhLWdDR.exe
  2⤵
  PID:14236
- C:\Windows\System\PjdZexC.exe
  C:\Windows\System\PjdZexC.exe
  2⤵
  PID:14256
- C:\Windows\System\aUxNmLS.exe
  C:\Windows\System\aUxNmLS.exe
  2⤵
  PID:14292
- C:\Windows\System\dwkzeaj.exe
  C:\Windows\System\dwkzeaj.exe
  2⤵
  PID:14324
- C:\Windows\System\ppJmAFk.exe
  C:\Windows\System\ppJmAFk.exe
  2⤵
  PID:12788
- C:\Windows\System\xnSiMkg.exe
  C:\Windows\System\xnSiMkg.exe
  2⤵
  PID:13344
- C:\Windows\System\WYAihrm.exe
  C:\Windows\System\WYAihrm.exe
  2⤵
  PID:13424
- C:\Windows\System\quwfPAF.exe
  C:\Windows\System\quwfPAF.exe
  2⤵
  PID:13528
- C:\Windows\System\GWvnQOJ.exe
  C:\Windows\System\GWvnQOJ.exe
  2⤵
  PID:13540
- C:\Windows\System\LiDNMaG.exe
  C:\Windows\System\LiDNMaG.exe
  2⤵
  PID:13656
- C:\Windows\System\DTulKEd.exe
  C:\Windows\System\DTulKEd.exe
  2⤵
  PID:13664
- C:\Windows\System\bsIEqPj.exe
  C:\Windows\System\bsIEqPj.exe
  2⤵
  PID:13756
- C:\Windows\System\KIAmknF.exe
  C:\Windows\System\KIAmknF.exe
  2⤵
  PID:13816
- C:\Windows\System\FIEMDVG.exe
  C:\Windows\System\FIEMDVG.exe
  2⤵
  PID:2652
- C:\Windows\System\BWfYnaT.exe
  C:\Windows\System\BWfYnaT.exe
  2⤵
  PID:13920
- C:\Windows\System\SHpeDIt.exe
  C:\Windows\System\SHpeDIt.exe
  2⤵
  PID:13948
- C:\Windows\System\rzweBSu.exe
  C:\Windows\System\rzweBSu.exe
  2⤵
  PID:13996
- C:\Windows\System\HEhKCfn.exe
  C:\Windows\System\HEhKCfn.exe
  2⤵
  PID:14108
- C:\Windows\System\fyfcFfT.exe
  C:\Windows\System\fyfcFfT.exe
  2⤵
  PID:14088
- C:\Windows\System\CLcUHbp.exe
  C:\Windows\System\CLcUHbp.exe
  2⤵
  PID:14136
- C:\Windows\System\IBUXjdU.exe
  C:\Windows\System\IBUXjdU.exe
  2⤵
  PID:14228
- C:\Windows\System\TXsGhIR.exe
  C:\Windows\System\TXsGhIR.exe
  2⤵
  PID:14280
- C:\Windows\System\JYtLgRi.exe
  C:\Windows\System\JYtLgRi.exe
  2⤵
  PID:13376
- C:\Windows\System\tgmUTFQ.exe
  C:\Windows\System\tgmUTFQ.exe
  2⤵
  PID:13556
- C:\Windows\System\icRkYfM.exe
  C:\Windows\System\icRkYfM.exe
  2⤵
  PID:13696
- C:\Windows\System\GVHxioO.exe
  C:\Windows\System\GVHxioO.exe
  2⤵
  PID:13780
- C:\Windows\System\XoxKkKW.exe
  C:\Windows\System\XoxKkKW.exe
  2⤵
  PID:13892
- C:\Windows\System\upBBcID.exe
  C:\Windows\System\upBBcID.exe
  2⤵
  PID:14084
- C:\Windows\System\ETrDdOG.exe
  C:\Windows\System\ETrDdOG.exe
  2⤵
  PID:14104
- C:\Windows\System\dQvRguu.exe
  C:\Windows\System\dQvRguu.exe
  2⤵
  PID:12364
- C:\Windows\System\xmGGnAK.exe
  C:\Windows\System\xmGGnAK.exe
  2⤵
  PID:13216
- C:\Windows\System\YHrkKBX.exe
  C:\Windows\System\YHrkKBX.exe
  2⤵
  PID:13980
- C:\Windows\System\HoyBakd.exe
  C:\Windows\System\HoyBakd.exe
  2⤵
  PID:14208
- C:\Windows\System\TxhrbUM.exe
  C:\Windows\System\TxhrbUM.exe
  2⤵
  PID:14352
- C:\Windows\System\UsNeOHz.exe
  C:\Windows\System\UsNeOHz.exe
  2⤵
  PID:14368
- C:\Windows\System\yDhsffs.exe
  C:\Windows\System\yDhsffs.exe
  2⤵
  PID:14392
- C:\Windows\System\ZmimOEo.exe
  C:\Windows\System\ZmimOEo.exe
  2⤵
  PID:14412
- C:\Windows\System\CAvSmuV.exe
  C:\Windows\System\CAvSmuV.exe
  2⤵
  PID:14428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AHrlhfi.exe

Filesize
2.0MB

MD5
ad66ee15d47f2bf5fec4d3a46ddc5edc

SHA1
844914956596cfcbdbf77e6a970145c9550765e9

SHA256
83999fd84ba258c117b098688ffa3b7e13a948081955c37fea39c69ead71c935

SHA512
aff4936ac55ff33a05e1e1d0ea83c927f4e00b75e3b5a4970949a3ac3d2bed7c3980bef4a695d2d86837f4801d208392fb6d53e2277625b37e93a51d7cf307ef

Download Submit
C:\Windows\System\AwzfYSB.exe

Filesize
2.0MB

MD5
fe3cda37b11f95ce623322b692333aa0

SHA1
4dcba8eb4bdd762e425001bea75f3780b43f67bf

SHA256
38583370b7004e03de408c427cec9f72901849bfe9d64782c6718eebb75ee3b0

SHA512
75d550be07f22ddbc6883a85f082959deab75cc63f9484cdd274ec10c872b24326f907bbc1c3fa6b67cb28b9db57e73d675834ada0fe68ec798190b1128be49c

Download Submit
C:\Windows\System\AzuUEvc.exe

Filesize
2.0MB

MD5
a7f9a0667b049875359310b5021c1be0

SHA1
900bd7fed7540b54d5ce213f2dca69c65b898c7d

SHA256
d4b62c4a72c7c0b883a7e68c58bbfa1ac5691d50b50fdb354ab8b2b6ab5112dd

SHA512
af02b788d08d7d52262f6829fac0e5f30664d81505760534c17350a53ca5a92b1fabe66435fb67f01461d302a07a1a02c4dda76d263f337769e6b01379bdf298

Download Submit
C:\Windows\System\BGwluvG.exe

Filesize
2.0MB

MD5
08c8111bd0196475a13a616d71df6dae

SHA1
f0544f7971e11813dafe44f6338fcf47f0af5ff6

SHA256
6e848b7d4c9e82a280f28a092aa0eca24670d0c87e2ccf3e3f5f942f0b78e6ab

SHA512
465d1201cff5c6b76e399a6b8e4b3945458e2a1627d249118cfcd9910aeb31ba3e3939f34b87a4851f9a69e9b4d0c3be24854957f41cdf9c191c3e23fa484db1

Download Submit
C:\Windows\System\Cboxquq.exe

Filesize
2.0MB

MD5
4136a3f3b6960303347897cfcf4c951e

SHA1
ce46c19a905281a4af5b4097a64a9eac413ca39b

SHA256
bb37674e04c09ff93ccb6260b5b5ee44a6338df9ad713650d3324ee7a49c858b

SHA512
72d9356b17d7668a10fea914037d81db20e648d67c6fb35a4dac4677bc515ef09ef5767a75a7901ff2d7497b15c9016d59f73b6c6e83fc4cca5012d0bd18bef4

Download Submit
C:\Windows\System\CzSKsIT.exe

Filesize
2.0MB

MD5
64fe28d7eaea4ddc1d1e1570ee848608

SHA1
78971339aa01663dcd91802d40a5e5d6c0397bbe

SHA256
95dfc306ce9d6b926ad10ff6ab0c2765c5182ae78e25799ed2770f81fc2cf746

SHA512
d03d3fcb65399e71143349433cffad6222bc35cad1ea3ef7fa9da1f14e5a8552e972b8bd5df15a94b0577b5222b32cf739384ca22e3ad42a1ba2f5c146fd9a30

Download Submit
C:\Windows\System\DjZxtVN.exe

Filesize
2.0MB

MD5
16d162c2efe6ff313530e6aef09ccfa4

SHA1
93891358ecaff76fae3941c8e7f72dbfc8eb1de4

SHA256
0dc4e22ab2eedb43c879e12af3ea108a3b3f9459353f29c6c8d3aed5ae1c2847

SHA512
bdea41276ab917e98cd4aabd1967b215e3f4331e6dd37f3275437a31ca845eb1e39f292f77c6fbfc7310efc838c8e312d5faecb283c4e6a5f12405106270c612

Download Submit
C:\Windows\System\EpJVcWM.exe

Filesize
2.0MB

MD5
81866711d32fe01cce5ed8fde414979c

SHA1
a95d94845c8c21e3a822fb2d8bdd4014ed40ba6c

SHA256
e1ded6b31ab7e188e4e0542e14c2fc8b2058e3475e31bf4fadcd2db42e9b8c55

SHA512
f749f160dd777a331eb2eff2ee2c86276450046fba7287efeb4da69d75ff51b27ad033a92e489d02953a332d9a574cf7762c745f565f62a5a6c3bddebf67f8c9

Download Submit
C:\Windows\System\FQIqifu.exe

Filesize
2.0MB

MD5
895e45dcb5d2e3bbb0c5d4b4f770dc93

SHA1
0b4a2e40f33923f4174b8a3bd0d4b37a3861d167

SHA256
237c613aa8c29be47b360387275763f33801cce112609ec9e0996ec2589ce2f3

SHA512
277d7fdebf5e1bb5a948c402626b66a4b853a2d41d3036fc0e9c8e7e0ce377a8a6f872851746cf68ce44beb4adf82359018ab15883a46ada7a01ff0d9b02f9a7

Download Submit
C:\Windows\System\LczLJeS.exe

Filesize
2.0MB

MD5
d49a23e36ffad99e6a17e51fc14c3fce

SHA1
27aee74e89a2b2939178e7f77c6e2c4179fd7917

SHA256
59dc95ef1c05b0f5e134ec448950c367942512d888fdf0d3675fc63f1ce08937

SHA512
c0f15882bbe122c8e2439a29daca040eba6eeedb2f35bbc87f3070aa1e3b3ef17ea1f3d47c3e8af8b0f2064c3c5b3ab4de58dd00fecb4fd986ad327c3d3a7f91

Download Submit
C:\Windows\System\NAIZJEZ.exe

Filesize
2.0MB

MD5
61dba57ec0274ee9330f7b1b9a2fdee9

SHA1
a5e70189363a07075411692e366c112ae577e1a8

SHA256
6ca8198c431c5f6221fdeaa6fe98f922d5bb158ad6c830b525eb76c10df1c9bf

SHA512
e04fdaf48abbe202b2b7fd96efc0323d52d29388486eff3d4fa19fc909dfa7f2729efb14341b62a0e0d67d430ee6ca8d3229a4ef27418dfc5391365e10d1e06a

Download Submit
C:\Windows\System\QbwhBvX.exe

Filesize
2.0MB

MD5
50b525c8c820fd1069367f3aa547be1b

SHA1
88ca5480d26079fc93d6618dbb98750f4dcff0f8

SHA256
61c65269bb342fd487e1b3f6fbdc2854deac250f3a0dcbac5dda48116dda5af9

SHA512
a3d60c9addfbc6d596b92bc9abc839d82353dd90561acd32ec2652c534516688cc3d27e2e63a1940b76a5a4dbe900796058295625cf9a0937765ba4fe8c40b61

Download Submit
C:\Windows\System\RPjgBiF.exe

Filesize
2.0MB

MD5
abaca3c0b66a03582c9149560ac39019

SHA1
1bb5565d92fd72014af5058115180919478ff236

SHA256
3410971e7c8e0466a4a3342400f6b7ab58ebd918d5a2fdccd46e6ffb8b60c3b7

SHA512
f2b1378c04c93398e968c783749f698055416d7653980a5ea4b243c5b15604bd1b7e3e466986f282fa65259ad78722f308886ef026c76e0a9d13801f17ad1c00

Download Submit
C:\Windows\System\SfngaLq.exe

Filesize
2.0MB

MD5
8b1f05f121831ba10de11dd82c805310

SHA1
dd6e39b90e6382527fe7cf1de3cca2c04ba14b39

SHA256
a614599be4c47986b6f85e1536ce9076bdc071077074c732a0e3d3ed69119037

SHA512
4f795cc56a523359c7a91fc59521e735066a034a408d8799ef6b653ef576e29fcb2dc44136109bcd28e39a1cbd4f2f05f5e596df4d20cd1c41e0302173f46fb4

Download Submit
C:\Windows\System\SjMnduV.exe

Filesize
2.0MB

MD5
7de4fdcc145ebf07bc31ad9958699105

SHA1
543709c8cb0406b808d0204d8c48af1609d60752

SHA256
fc51adb3a11ffb2ce2bedd71cd3403fb09e44c98d926e734d51926120151fdab

SHA512
5dba2eb50e81cf8ea82acdec0d7f0c5ee0aefacc7689e7cc3c3d729731a49d86c6284c0fcb9978408aad72e93bdc5f1ca0bdf014f6b076f2df25c4c4ac3bac6e

Download Submit
C:\Windows\System\WXUbHMo.exe

Filesize
2.0MB

MD5
bb3da39b3e91a8cca0ede4cf2fc046b1

SHA1
b7cebcfaf5d5aba612407b053a9e835d1c5b46a6

SHA256
c8033538131ea65d1298c5265d430a2b732e5ee4b979f4fec99ae30a7a17279b

SHA512
2f88c810d4f77db121c88477df0ea5e9e1b1635e04fe925450a9aa9335f87086183fa26319f5b0f49d64dece2477bdbf278cbb0d943a8cf17ce0176e454fd7d4

Download Submit
C:\Windows\System\XvkniTO.exe

Filesize
2.0MB

MD5
4d7953aa3f26e03528cf1d220a881464

SHA1
6214b02644f6b5d8919b50ade6956e8727622b44

SHA256
7f2dc2e749ca7ae61c8dc782f0dac6e6f6929bf003dfe40a557fd8dfe9ebcc59

SHA512
cbfbbdfdffed6be16c8fa99946e8c20bf0581a6e405472669f31331c74712af5bac1bcf676eb0df3fb76ef5c63e1e3092e2bf187850ece53332ac80927b6ab7e

Download Submit
C:\Windows\System\YNXCQlk.exe

Filesize
2.0MB

MD5
857a5730c78e74795c6e7b1803699cc6

SHA1
a3dbe62d72ba281c95bacebf2102a476b527016c

SHA256
63b7d38933d8275dc82694d604c40cd4a2579d39611988c14db7d77d08588ac1

SHA512
46b6cfac218cdf2bb4512e0b3e9ec5f81dc6d353d815f818108aeaefef5017c25cf2aa353a8479526b442e3841d87e94f3709ea4e9565f62b1d95b3e2fd4d7c7

Download Submit
C:\Windows\System\YskfXvH.exe

Filesize
2.0MB

MD5
94efffa554bee03c029de600b53bdefd

SHA1
342bd9344fe158d250821eb7d9fa0ac904eb0bc7

SHA256
f857983414e8f1ef32d1354124a09c42b4c2c94432dd24c91ebe0885b7ea34b1

SHA512
e9f3a07400b8c455dd933d582d7ae5e720a0a328ffef8119669dfeb66c0b7d2a842afc2a962cd7548c43755a4be7ce44a14f4452ddb5ad79b82549e1470d73d1

Download Submit
C:\Windows\System\ZoHGfQc.exe

Filesize
2.0MB

MD5
76ba8948e0590606433c08e084fe05dd

SHA1
0bd124d1c290d97ead575d9c0a3c0292a20781c6

SHA256
04ba049716ca28aa5880c1eb4e4f3accc00c10ff7f947193ae5d5540496b27bf

SHA512
30758932f79dad3eac99b446b536d193068ea502b83d761e1b554b4f28cfebe2f4b99db3a71b3d9fccb5e6cb0aee2fec06c60c929923750bff0cd1c0b8af60bb

Download Submit
C:\Windows\System\aMZjHrv.exe

Filesize
2.0MB

MD5
c3750350a5439da6921663b86d11a825

SHA1
b99b3ea5e792728206b64b42f750f4388233b758

SHA256
d5a6cae26e96506fcab174b738d071b2d98c124c4e33eb4f0987d88906c96b11

SHA512
fe4c223877f4f80143a62da91875b1afcbd665e4d86eb49a3a254128912adf2f8997d137ee0a89fd0b4133d9c154dcd877050979c53d6ca6d2488e4e3db3a7f6

Download Submit
C:\Windows\System\esPaljv.exe

Filesize
2.0MB

MD5
6514568052a16cae2b3bb876fabf237b

SHA1
1b045baf5ace003e17041a2a2c0c34cd6fe46731

SHA256
b29543a31a30be3d074e90e45f30b01c15d3d02f457d83a6e7e303db786a482c

SHA512
10b4554090757739e2f69dd062f92505260087afc2c5d45a3198e2eaa75d23b70538c4cbd41ee9e2123db53cc2baf09af8645dd0eddf038985b00a07b692e5f9

Download Submit
C:\Windows\System\fvdMkxb.exe

Filesize
2.0MB

MD5
14af240e2fb336bc10905e54ef948b1c

SHA1
33622483bbf263f2a011c6124de7db562d7df36c

SHA256
1fa43256980b4a9e7217efd99c175c1938ac552946bf20abf3a97020decbe863

SHA512
b73880e64d130d394b51a302647cdd9a9547dded68414f029fb6ee5af3293b28f978688bb0c4cb184fb67eef5f84b5c663b1244afa20b21791419098e4309c7b

Download Submit
C:\Windows\System\hvGSDoh.exe

Filesize
2.0MB

MD5
57e2eb476ff90a6f2f1eaae4190d4c78

SHA1
a5a1640c451321b8d408fbd5ccbb0f3e4196ed67

SHA256
c032cf41234a9d0e304a22b367e639b5d810b3d9a0fcfa9b5149bc3dcc2e81e1

SHA512
8f489539ec5b6293c4ad8348f7e5defc23fde95259613efe38c86c5e48abc6eb12c28a09bec24f727f76de31a3bd74270592e75c13b9ae30d644857bf5f60816

Download Submit
C:\Windows\System\iTzGxTQ.exe

Filesize
2.0MB

MD5
01a8a15b161dea1bfdbf4e88d1384cc9

SHA1
190732af5767acc96253d63b208080ee5218be20

SHA256
084f8bc63206891cce9278effc605c5ae2297416023e89a86e200c2cbb7e2745

SHA512
64272089f54c638501c54e80e3102391ec39cbec66ea598e595e24d8c1374c5234fcb20fad193b2a24e97db3c5f81f0297fed6189efc0c18968dffed0e1c96f1

Download Submit
C:\Windows\System\itLcyaM.exe

Filesize
2.0MB

MD5
cd59748a8f248118f7fa38a66b4d1fae

SHA1
fec7f9c89023fa3b5f59495c03bf7f20e588bf0d

SHA256
33ec8a4fd6abfb25153a888bc1ebb284a0a69ff0519b1668f8bd59092170b0bd

SHA512
95aae35c4c4a0f991fadcd0aa4c2d81663c5d8caa0bb957e48e2b483857551a25fa7e2a357ced0620533a584128c88b7821ba8252d0073494b67cdebe930df79

Download Submit
C:\Windows\System\jDbEhQr.exe

Filesize
2.0MB

MD5
cba9fe3e7d2d214198e07fd9bdd0ac44

SHA1
6d11dcee830307ed3b2ff2ee88563a3203a5833e

SHA256
c8efa598b0081ec60635669d2df8df539a677de66194072bc74af3ead9423cd5

SHA512
9e7a7e44a5df949e7d9025cfb3f6fd82db5ab5dd7ead372595172c5ca28daca8cb96f02fe6c088d6001701f3318be3ff2757312a557e896b80d767b462a8724f

Download Submit
C:\Windows\System\jSjtbfT.exe

Filesize
2.0MB

MD5
f337019ffafbb12f03c81dd6d87d6161

SHA1
b2c0b222ea89b0537e1d962806ca16ad2c44f436

SHA256
6c3cd596f134c1ef7e035dff387e96e2b256ef93cfef427613b7c2f3c2df01bb

SHA512
317a97fec0ee270674d50e1266c313570e0c6f975f9cddda5b409807f49cdab7ddbed0ab69f8e9f826164becc2bf9c5c8ab14b9393db6d414ed76f8b093688cf

Download Submit
C:\Windows\System\kWHyGYe.exe

Filesize
2.0MB

MD5
a5b366d816c30c3e53fabd7236ad8140

SHA1
d8b2cbf5c3642439e12c2125a1b4e5f6a70777e8

SHA256
a03e1695ca57c8b578ac3bb075e3f70d61e4aeaa1f4cdbb79d8de35f24aa8549

SHA512
6a91df7e594b3c09730b5ff723eb548eb1c7a83d80345a59455334345d8fe67fa487effa3d7e991c7e527d337bc20a24fd7e96ea940d355b8e00b467e0f90469

Download Submit
C:\Windows\System\lUUFLyt.exe

Filesize
2.0MB

MD5
f7378d19fc4c1d2a4a9a759f2c9f36de

SHA1
b669f651dbc417f1b22ad473184a9a083270f021

SHA256
71ab78ef839e14c0d6667f530c745b43e9328868023346f21a8742c427726e4b

SHA512
c3ee5ddfd31d1c3a30b476840001cbeb359cf3579502af6936be04fa925a84c8f42742f29d3f58fbf25178884fc7fcc9fe3272936101434b996782fad7886391

Download Submit
C:\Windows\System\ltmpjxI.exe

Filesize
2.0MB

MD5
3f9c2ec8de27422794bcbb3c22491650

SHA1
02332e5c97191227b3881ddb4c502254f528a4ed

SHA256
3067780f3609561ac7e2b477573366eb49fc7f5fe88700bebcee39b6f59cac53

SHA512
3c8ac14a93caf4bae7ae7431b24553d1123c9d1f6c147952d4fecb711ae7c262d14366f8855617d27782957cbf2c70b8329b7ea46b70d850a04e73985491d7b1

Download Submit
C:\Windows\System\naFUrYr.exe

Filesize
2.0MB

MD5
e71932cfa101d5f8dbc084e435043c03

SHA1
b2f747305a08ff69ef72db9d3d485edd67d61d84

SHA256
77ff8d53e8f28320cb801424f6b02ad80b7480c8ce08cea94f20e9b3694ed339

SHA512
4f0ace974e0550903010eb708f821aa53c3fef7f16e71e194fe96470f89e85ec5de1bc61ebdac00d28da0bb2c144bdaa63f1be2e80f1f20df167220b45751a5f

Download Submit
C:\Windows\System\sYNwkib.exe

Filesize
2.0MB

MD5
6c627456d2a8c1681971c0770bc45bdf

SHA1
8372763a0b1e4e732d8a49ea87c75381abfd2063

SHA256
7edb70a94c904ff0da32c3fe27766dd538de0957b77a3c7ddfe68647e86add6f

SHA512
cca3cd6cd85c67ee71aa39260dd6e28fde2a36b6f2c285943b2343cf76d55d91db42f74f172b008c3e62b58a675fa423e74180a4a0ba8efb0a632e93f3ba869d

Download Submit
memory/364-2065-0x00007FF706AD0000-0x00007FF706E24000-memory.dmp

Filesize
3.3MB

Download
memory/364-135-0x00007FF706AD0000-0x00007FF706E24000-memory.dmp

Filesize
3.3MB

Download
memory/676-2067-0x00007FF729CC0000-0x00007FF72A014000-memory.dmp

Filesize
3.3MB

Download
memory/676-186-0x00007FF729CC0000-0x00007FF72A014000-memory.dmp

Filesize
3.3MB

Download
memory/748-190-0x00007FF7BDC30000-0x00007FF7BDF84000-memory.dmp

Filesize
3.3MB

Download
memory/748-2075-0x00007FF7BDC30000-0x00007FF7BDF84000-memory.dmp

Filesize
3.3MB

Download
memory/1212-187-0x00007FF702C80000-0x00007FF702FD4000-memory.dmp

Filesize
3.3MB

Download
memory/1212-2074-0x00007FF702C80000-0x00007FF702FD4000-memory.dmp

Filesize
3.3MB

Download
memory/1820-2066-0x00007FF6DF760000-0x00007FF6DFAB4000-memory.dmp

Filesize
3.3MB

Download
memory/1820-2053-0x00007FF6DF760000-0x00007FF6DFAB4000-memory.dmp

Filesize
3.3MB

Download
memory/1820-38-0x00007FF6DF760000-0x00007FF6DFAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2236-0-0x00007FF6DEFD0000-0x00007FF6DF324000-memory.dmp

Filesize
3.3MB

Download
memory/2236-2052-0x00007FF6DEFD0000-0x00007FF6DF324000-memory.dmp

Filesize
3.3MB

Download
memory/2236-1-0x0000022FC2550000-0x0000022FC2560000-memory.dmp

Filesize
64KB

Download
memory/2484-2059-0x00007FF7F23B0000-0x00007FF7F2704000-memory.dmp

Filesize
3.3MB

Download
memory/2484-193-0x00007FF7F23B0000-0x00007FF7F2704000-memory.dmp

Filesize
3.3MB

Download
memory/2756-2061-0x00007FF75DCA0000-0x00007FF75DFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2756-184-0x00007FF75DCA0000-0x00007FF75DFF4000-memory.dmp

Filesize
3.3MB

Download
memory/3228-2068-0x00007FF6461C0000-0x00007FF646514000-memory.dmp

Filesize
3.3MB

Download
memory/3228-113-0x00007FF6461C0000-0x00007FF646514000-memory.dmp

Filesize
3.3MB

Download
memory/3432-64-0x00007FF62FD70000-0x00007FF6300C4000-memory.dmp

Filesize
3.3MB

Download
memory/3432-2056-0x00007FF62FD70000-0x00007FF6300C4000-memory.dmp

Filesize
3.3MB

Download
memory/3460-188-0x00007FF6EB8C0000-0x00007FF6EBC14000-memory.dmp

Filesize
3.3MB

Download
memory/3460-2077-0x00007FF6EB8C0000-0x00007FF6EBC14000-memory.dmp

Filesize
3.3MB

Download
memory/3488-169-0x00007FF66EA20000-0x00007FF66ED74000-memory.dmp

Filesize
3.3MB

Download
memory/3488-2064-0x00007FF66EA20000-0x00007FF66ED74000-memory.dmp

Filesize
3.3MB

Download
memory/3520-177-0x00007FF612490000-0x00007FF6127E4000-memory.dmp

Filesize
3.3MB

Download
memory/3520-2060-0x00007FF612490000-0x00007FF6127E4000-memory.dmp

Filesize
3.3MB

Download
memory/3680-2076-0x00007FF76DFD0000-0x00007FF76E324000-memory.dmp

Filesize
3.3MB

Download
memory/3680-189-0x00007FF76DFD0000-0x00007FF76E324000-memory.dmp

Filesize
3.3MB

Download
memory/3720-196-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp

Filesize
3.3MB

Download
memory/3720-2071-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp

Filesize
3.3MB

Download
memory/3764-185-0x00007FF6E4AC0000-0x00007FF6E4E14000-memory.dmp

Filesize
3.3MB

Download
memory/3764-2078-0x00007FF6E4AC0000-0x00007FF6E4E14000-memory.dmp

Filesize
3.3MB

Download
memory/3884-2073-0x00007FF7A26F0000-0x00007FF7A2A44000-memory.dmp

Filesize
3.3MB

Download
memory/3884-191-0x00007FF7A26F0000-0x00007FF7A2A44000-memory.dmp

Filesize
3.3MB

Download
memory/3924-192-0x00007FF713970000-0x00007FF713CC4000-memory.dmp

Filesize
3.3MB

Download
memory/3924-2072-0x00007FF713970000-0x00007FF713CC4000-memory.dmp

Filesize
3.3MB

Download
memory/4036-2058-0x00007FF7031D0000-0x00007FF703524000-memory.dmp

Filesize
3.3MB

Download
memory/4036-148-0x00007FF7031D0000-0x00007FF703524000-memory.dmp

Filesize
3.3MB

Download
memory/4044-2062-0x00007FF7B10F0000-0x00007FF7B1444000-memory.dmp

Filesize
3.3MB

Download
memory/4044-2055-0x00007FF7B10F0000-0x00007FF7B1444000-memory.dmp

Filesize
3.3MB

Download
memory/4044-71-0x00007FF7B10F0000-0x00007FF7B1444000-memory.dmp

Filesize
3.3MB

Download
memory/4220-18-0x00007FF67E2F0000-0x00007FF67E644000-memory.dmp

Filesize
3.3MB

Download
memory/4220-2054-0x00007FF67E2F0000-0x00007FF67E644000-memory.dmp

Filesize
3.3MB

Download
memory/4220-2057-0x00007FF67E2F0000-0x00007FF67E644000-memory.dmp

Filesize
3.3MB

Download
memory/4560-179-0x00007FF7CB000000-0x00007FF7CB354000-memory.dmp

Filesize
3.3MB

Download
memory/4560-2063-0x00007FF7CB000000-0x00007FF7CB354000-memory.dmp

Filesize
3.3MB

Download
memory/4584-183-0x00007FF6581F0000-0x00007FF658544000-memory.dmp

Filesize
3.3MB

Download
memory/4584-2079-0x00007FF6581F0000-0x00007FF658544000-memory.dmp

Filesize
3.3MB

Download
memory/4660-2081-0x00007FF7C5350000-0x00007FF7C56A4000-memory.dmp

Filesize
3.3MB

Download
memory/4660-147-0x00007FF7C5350000-0x00007FF7C56A4000-memory.dmp

Filesize
3.3MB

Download
memory/4700-2069-0x00007FF738FC0000-0x00007FF739314000-memory.dmp

Filesize
3.3MB

Download
memory/4700-194-0x00007FF738FC0000-0x00007FF739314000-memory.dmp

Filesize
3.3MB

Download
memory/4704-2080-0x00007FF6BF4B0000-0x00007FF6BF804000-memory.dmp

Filesize
3.3MB

Download
memory/4704-182-0x00007FF6BF4B0000-0x00007FF6BF804000-memory.dmp

Filesize
3.3MB

Download
memory/4848-2084-0x00007FF731740000-0x00007FF731A94000-memory.dmp

Filesize
3.3MB

Download
memory/4848-180-0x00007FF731740000-0x00007FF731A94000-memory.dmp

Filesize
3.3MB

Download
memory/4916-2070-0x00007FF6A5AC0000-0x00007FF6A5E14000-memory.dmp

Filesize
3.3MB

Download
memory/4916-197-0x00007FF6A5AC0000-0x00007FF6A5E14000-memory.dmp

Filesize
3.3MB

Download
memory/4928-2082-0x00007FF78C9C0000-0x00007FF78CD14000-memory.dmp

Filesize
3.3MB

Download
memory/4928-195-0x00007FF78C9C0000-0x00007FF78CD14000-memory.dmp

Filesize
3.3MB

Download
memory/5040-2083-0x00007FF65AAB0000-0x00007FF65AE04000-memory.dmp

Filesize
3.3MB

Download
memory/5040-176-0x00007FF65AAB0000-0x00007FF65AE04000-memory.dmp

Filesize
3.3MB

Download