xmrig | 067bbf88f0fd2ec90d4b6aaedbdbade8596165a40e3e8179785edcda5eebaf09

Analysis

max time kernel
116s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
Size

1.9MB
MD5

39f53c6ed7511175e0ad697139c9bb20
SHA1

f11cfba2b4d530c644f039f742ca01630e56c6e3
SHA256

067bbf88f0fd2ec90d4b6aaedbdbade8596165a40e3e8179785edcda5eebaf09
SHA512

6bd16b8e16b588ac9403a1180a8c40de1d8eae3907597bf8128ea14e6fc134f396dece2c64463f9c990f5e0f7f5641fcf13e72adf920ba25180ed0635c977166
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxxdcvou25dwc:BemTLkNdfE0pZrQB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1828-0-0x00007FF6E7E20000-0x00007FF6E8174000-memory.dmp	xmrig
behavioral2/files/0x00090000000233ea-5.dat	xmrig
behavioral2/memory/1420-14-0x00007FF62B3E0000-0x00007FF62B734000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f3-12.dat	xmrig
behavioral2/files/0x00070000000233f4-18.dat	xmrig
behavioral2/memory/4528-11-0x00007FF6AAF90000-0x00007FF6AB2E4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f5-29.dat	xmrig
behavioral2/files/0x00070000000233f6-30.dat	xmrig
behavioral2/files/0x00070000000233f8-53.dat	xmrig
behavioral2/files/0x00070000000233f9-54.dat	xmrig
behavioral2/files/0x00070000000233fc-61.dat	xmrig
behavioral2/files/0x0007000000023401-90.dat	xmrig
behavioral2/files/0x0007000000023407-120.dat	xmrig
behavioral2/files/0x000700000002340e-155.dat	xmrig
behavioral2/memory/540-699-0x00007FF678910000-0x00007FF678C64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-170.dat	xmrig
behavioral2/files/0x000700000002340f-168.dat	xmrig
behavioral2/files/0x0007000000023410-165.dat	xmrig
behavioral2/files/0x000700000002340d-158.dat	xmrig
behavioral2/files/0x000700000002340c-153.dat	xmrig
behavioral2/files/0x000700000002340b-148.dat	xmrig
behavioral2/files/0x000700000002340a-143.dat	xmrig
behavioral2/files/0x0007000000023409-138.dat	xmrig
behavioral2/files/0x0007000000023408-133.dat	xmrig
behavioral2/files/0x0007000000023406-123.dat	xmrig
behavioral2/files/0x0007000000023405-118.dat	xmrig
behavioral2/files/0x0007000000023404-113.dat	xmrig
behavioral2/files/0x0007000000023403-108.dat	xmrig
behavioral2/files/0x0007000000023402-103.dat	xmrig
behavioral2/files/0x0007000000023400-93.dat	xmrig
behavioral2/files/0x00070000000233ff-88.dat	xmrig
behavioral2/files/0x00070000000233fe-83.dat	xmrig
behavioral2/files/0x00070000000233fd-81.dat	xmrig
behavioral2/files/0x00070000000233fb-79.dat	xmrig
behavioral2/files/0x00070000000233fa-77.dat	xmrig
behavioral2/memory/2628-67-0x00007FF7DDC00000-0x00007FF7DDF54000-memory.dmp	xmrig
behavioral2/memory/3200-57-0x00007FF67C470000-0x00007FF67C7C4000-memory.dmp	xmrig
behavioral2/memory/1204-49-0x00007FF7E5830000-0x00007FF7E5B84000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f7-48.dat	xmrig
behavioral2/files/0x000a0000000233eb-43.dat	xmrig
behavioral2/memory/2144-38-0x00007FF6993F0000-0x00007FF699744000-memory.dmp	xmrig
behavioral2/memory/4948-25-0x00007FF794660000-0x00007FF7949B4000-memory.dmp	xmrig
behavioral2/memory/5060-700-0x00007FF629290000-0x00007FF6295E4000-memory.dmp	xmrig
behavioral2/memory/4664-701-0x00007FF738CB0000-0x00007FF739004000-memory.dmp	xmrig
behavioral2/memory/3228-702-0x00007FF7A97E0000-0x00007FF7A9B34000-memory.dmp	xmrig
behavioral2/memory/4404-704-0x00007FF772CF0000-0x00007FF773044000-memory.dmp	xmrig
behavioral2/memory/396-703-0x00007FF727DE0000-0x00007FF728134000-memory.dmp	xmrig
behavioral2/memory/3992-708-0x00007FF7C7A90000-0x00007FF7C7DE4000-memory.dmp	xmrig
behavioral2/memory/2220-719-0x00007FF7290B0000-0x00007FF729404000-memory.dmp	xmrig
behavioral2/memory/4508-715-0x00007FF677950000-0x00007FF677CA4000-memory.dmp	xmrig
behavioral2/memory/1688-712-0x00007FF774F90000-0x00007FF7752E4000-memory.dmp	xmrig
behavioral2/memory/676-732-0x00007FF6E2470000-0x00007FF6E27C4000-memory.dmp	xmrig
behavioral2/memory/2128-731-0x00007FF7CBFA0000-0x00007FF7CC2F4000-memory.dmp	xmrig
behavioral2/memory/852-740-0x00007FF66D370000-0x00007FF66D6C4000-memory.dmp	xmrig
behavioral2/memory/4200-743-0x00007FF7CE5C0000-0x00007FF7CE914000-memory.dmp	xmrig
behavioral2/memory/3468-760-0x00007FF653BF0000-0x00007FF653F44000-memory.dmp	xmrig
behavioral2/memory/4600-769-0x00007FF64FDE0000-0x00007FF650134000-memory.dmp	xmrig
behavioral2/memory/912-764-0x00007FF6934E0000-0x00007FF693834000-memory.dmp	xmrig
behavioral2/memory/2256-758-0x00007FF676DC0000-0x00007FF677114000-memory.dmp	xmrig
behavioral2/memory/372-755-0x00007FF6E2FB0000-0x00007FF6E3304000-memory.dmp	xmrig
behavioral2/memory/3896-749-0x00007FF764E70000-0x00007FF7651C4000-memory.dmp	xmrig
behavioral2/memory/1252-748-0x00007FF7158E0000-0x00007FF715C34000-memory.dmp	xmrig
behavioral2/memory/760-775-0x00007FF7661C0000-0x00007FF766514000-memory.dmp	xmrig
behavioral2/memory/2144-2154-0x00007FF6993F0000-0x00007FF699744000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4528	MenQzzp.exe
1420	kTnZGGW.exe
4948	kPvFmsD.exe
2144	UwLsXLo.exe
3200	VCOejdr.exe
1204	HTAFECX.exe
2628	sZPvNti.exe
912	dBPehmp.exe
540	acEgjfs.exe
5060	JQHzznC.exe
4664	ztwCWxm.exe
4600	pPhWOnq.exe
3228	uLttFXc.exe
396	YoOaXit.exe
760	twGTeHp.exe
4404	mYWhkOW.exe
3992	aSfyqDk.exe
1688	JrXlsBS.exe
4508	gZEPQYc.exe
2220	CYDLMtr.exe
2128	oZcmXHO.exe
676	LiFpHEp.exe
852	IbyCCPw.exe
4200	XLZYhcd.exe
1252	PbyyxQH.exe
3896	ElDzzVS.exe
372	JNGhHcA.exe
2256	oGKtdAx.exe
3468	GLDyEyJ.exe
2492	lxMaJoo.exe
2092	vFMEEGz.exe
2052	blhEFbX.exe
4464	mjxZEsS.exe
2916	YHjXrDa.exe
3352	iSYpFYs.exe
1656	ZOIGjpc.exe
3584	PjWKZws.exe
3964	zfAtRpN.exe
4348	BGXnogY.exe
436	iNYzYuM.exe
1948	jvyUauJ.exe
3120	PjbpGYI.exe
232	lmStyBc.exe
4292	gUrJewa.exe
3084	uvGMBzy.exe
1724	qtsiWqH.exe
1404	ntYVYWp.exe
4224	RbBxSgg.exe
5096	QhOwtXB.exe
1076	XubQskd.exe
3372	BHHdawF.exe
1976	BetsjLQ.exe
4968	pGmkSSx.exe
4548	iukGXaf.exe
2216	iArfgfq.exe
4136	ihmtIbf.exe
1744	WJsEUfP.exe
3684	Gkiigyt.exe
1624	XizlJMN.exe
3708	GNjfqIN.exe
2580	zxwlXNt.exe
1972	gvjfeRT.exe
2424	CADYEIb.exe
4868	DgYSNmM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1828-0-0x00007FF6E7E20000-0x00007FF6E8174000-memory.dmp	upx
behavioral2/files/0x00090000000233ea-5.dat	upx
behavioral2/memory/1420-14-0x00007FF62B3E0000-0x00007FF62B734000-memory.dmp	upx
behavioral2/files/0x00070000000233f3-12.dat	upx
behavioral2/files/0x00070000000233f4-18.dat	upx
behavioral2/memory/4528-11-0x00007FF6AAF90000-0x00007FF6AB2E4000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-29.dat	upx
behavioral2/files/0x00070000000233f6-30.dat	upx
behavioral2/files/0x00070000000233f8-53.dat	upx
behavioral2/files/0x00070000000233f9-54.dat	upx
behavioral2/files/0x00070000000233fc-61.dat	upx
behavioral2/files/0x0007000000023401-90.dat	upx
behavioral2/files/0x0007000000023407-120.dat	upx
behavioral2/files/0x000700000002340e-155.dat	upx
behavioral2/memory/540-699-0x00007FF678910000-0x00007FF678C64000-memory.dmp	upx
behavioral2/files/0x0007000000023411-170.dat	upx
behavioral2/files/0x000700000002340f-168.dat	upx
behavioral2/files/0x0007000000023410-165.dat	upx
behavioral2/files/0x000700000002340d-158.dat	upx
behavioral2/files/0x000700000002340c-153.dat	upx
behavioral2/files/0x000700000002340b-148.dat	upx
behavioral2/files/0x000700000002340a-143.dat	upx
behavioral2/files/0x0007000000023409-138.dat	upx
behavioral2/files/0x0007000000023408-133.dat	upx
behavioral2/files/0x0007000000023406-123.dat	upx
behavioral2/files/0x0007000000023405-118.dat	upx
behavioral2/files/0x0007000000023404-113.dat	upx
behavioral2/files/0x0007000000023403-108.dat	upx
behavioral2/files/0x0007000000023402-103.dat	upx
behavioral2/files/0x0007000000023400-93.dat	upx
behavioral2/files/0x00070000000233ff-88.dat	upx
behavioral2/files/0x00070000000233fe-83.dat	upx
behavioral2/files/0x00070000000233fd-81.dat	upx
behavioral2/files/0x00070000000233fb-79.dat	upx
behavioral2/files/0x00070000000233fa-77.dat	upx
behavioral2/memory/2628-67-0x00007FF7DDC00000-0x00007FF7DDF54000-memory.dmp	upx
behavioral2/memory/3200-57-0x00007FF67C470000-0x00007FF67C7C4000-memory.dmp	upx
behavioral2/memory/1204-49-0x00007FF7E5830000-0x00007FF7E5B84000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-48.dat	upx
behavioral2/files/0x000a0000000233eb-43.dat	upx
behavioral2/memory/2144-38-0x00007FF6993F0000-0x00007FF699744000-memory.dmp	upx
behavioral2/memory/4948-25-0x00007FF794660000-0x00007FF7949B4000-memory.dmp	upx
behavioral2/memory/5060-700-0x00007FF629290000-0x00007FF6295E4000-memory.dmp	upx
behavioral2/memory/4664-701-0x00007FF738CB0000-0x00007FF739004000-memory.dmp	upx
behavioral2/memory/3228-702-0x00007FF7A97E0000-0x00007FF7A9B34000-memory.dmp	upx
behavioral2/memory/4404-704-0x00007FF772CF0000-0x00007FF773044000-memory.dmp	upx
behavioral2/memory/396-703-0x00007FF727DE0000-0x00007FF728134000-memory.dmp	upx
behavioral2/memory/3992-708-0x00007FF7C7A90000-0x00007FF7C7DE4000-memory.dmp	upx
behavioral2/memory/2220-719-0x00007FF7290B0000-0x00007FF729404000-memory.dmp	upx
behavioral2/memory/4508-715-0x00007FF677950000-0x00007FF677CA4000-memory.dmp	upx
behavioral2/memory/1688-712-0x00007FF774F90000-0x00007FF7752E4000-memory.dmp	upx
behavioral2/memory/676-732-0x00007FF6E2470000-0x00007FF6E27C4000-memory.dmp	upx
behavioral2/memory/2128-731-0x00007FF7CBFA0000-0x00007FF7CC2F4000-memory.dmp	upx
behavioral2/memory/852-740-0x00007FF66D370000-0x00007FF66D6C4000-memory.dmp	upx
behavioral2/memory/4200-743-0x00007FF7CE5C0000-0x00007FF7CE914000-memory.dmp	upx
behavioral2/memory/3468-760-0x00007FF653BF0000-0x00007FF653F44000-memory.dmp	upx
behavioral2/memory/4600-769-0x00007FF64FDE0000-0x00007FF650134000-memory.dmp	upx
behavioral2/memory/912-764-0x00007FF6934E0000-0x00007FF693834000-memory.dmp	upx
behavioral2/memory/2256-758-0x00007FF676DC0000-0x00007FF677114000-memory.dmp	upx
behavioral2/memory/372-755-0x00007FF6E2FB0000-0x00007FF6E3304000-memory.dmp	upx
behavioral2/memory/3896-749-0x00007FF764E70000-0x00007FF7651C4000-memory.dmp	upx
behavioral2/memory/1252-748-0x00007FF7158E0000-0x00007FF715C34000-memory.dmp	upx
behavioral2/memory/760-775-0x00007FF7661C0000-0x00007FF766514000-memory.dmp	upx
behavioral2/memory/2144-2154-0x00007FF6993F0000-0x00007FF699744000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GdjaObB.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\zlkwAEY.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\eezYoUr.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\foDRtpI.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\phieCmT.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\FLBAJQz.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\GldIzyj.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\BtOaXbp.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\AGDzxme.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\rVZcDrD.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\oVTbWEx.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\fVwBfed.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\fAdpBxR.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\kTnZGGW.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\acEgjfs.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\AKgKlHp.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\hBljJZT.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\zoeMtCB.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\OOxTNTB.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\uXrnkMw.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\ooLWrOP.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\CryOqzn.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\CDVnQDA.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\urZKaut.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\lKddtIL.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\WJnbFhw.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\KNMNpQm.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\GTGqRdz.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\tmYgeRA.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\UPDcBdz.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\VCysoxj.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\Jaqjjgo.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\nMntBXB.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\eKjzDPQ.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\kPvFmsD.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\IaCxSld.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\ZGfDXfd.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\kGNvRNv.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\iArfgfq.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\liUbEup.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\UiCdytR.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\CgiRzmN.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\ecrbIwW.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\wHhmkYG.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\ZORDlQt.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\UvnSAPi.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\pANIbMD.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\GDzbhCu.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\MMQVeea.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\AxsDurN.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\aJQLwxu.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\XizlJMN.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\ovpacrU.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\vgnMAhi.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\ZaWegGi.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\uDPZzBD.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\mVXXYvJ.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\jvyUauJ.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\ZFYnbrm.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\RLHzhzy.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\unyVgIK.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\XWAhCDv.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\hTzZYXQ.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\EjYRkvu.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4528	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	84
PID 1828 wrote to memory of 4528	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	84
PID 1828 wrote to memory of 1420	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	85
PID 1828 wrote to memory of 1420	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	85
PID 1828 wrote to memory of 4948	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	86
PID 1828 wrote to memory of 4948	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	86
PID 1828 wrote to memory of 2144	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	87
PID 1828 wrote to memory of 2144	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	87
PID 1828 wrote to memory of 1204	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	88
PID 1828 wrote to memory of 1204	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	88
PID 1828 wrote to memory of 3200	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	89
PID 1828 wrote to memory of 3200	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	89
PID 1828 wrote to memory of 2628	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	90
PID 1828 wrote to memory of 2628	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	90
PID 1828 wrote to memory of 912	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	91
PID 1828 wrote to memory of 912	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	91
PID 1828 wrote to memory of 540	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	92
PID 1828 wrote to memory of 540	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	92
PID 1828 wrote to memory of 5060	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	93
PID 1828 wrote to memory of 5060	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	93
PID 1828 wrote to memory of 4664	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	94
PID 1828 wrote to memory of 4664	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	94
PID 1828 wrote to memory of 4600	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	95
PID 1828 wrote to memory of 4600	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	95
PID 1828 wrote to memory of 3228	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	96
PID 1828 wrote to memory of 3228	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	96
PID 1828 wrote to memory of 396	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	97
PID 1828 wrote to memory of 396	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	97
PID 1828 wrote to memory of 760	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	98
PID 1828 wrote to memory of 760	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	98
PID 1828 wrote to memory of 4404	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	99
PID 1828 wrote to memory of 4404	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	99
PID 1828 wrote to memory of 3992	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	100
PID 1828 wrote to memory of 3992	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	100
PID 1828 wrote to memory of 1688	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	101
PID 1828 wrote to memory of 1688	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	101
PID 1828 wrote to memory of 4508	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	102
PID 1828 wrote to memory of 4508	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	102
PID 1828 wrote to memory of 2220	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	103
PID 1828 wrote to memory of 2220	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	103
PID 1828 wrote to memory of 2128	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	104
PID 1828 wrote to memory of 2128	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	104
PID 1828 wrote to memory of 676	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	105
PID 1828 wrote to memory of 676	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	105
PID 1828 wrote to memory of 852	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	106
PID 1828 wrote to memory of 852	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	106
PID 1828 wrote to memory of 4200	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	107
PID 1828 wrote to memory of 4200	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	107
PID 1828 wrote to memory of 1252	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	108
PID 1828 wrote to memory of 1252	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	108
PID 1828 wrote to memory of 3896	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	109
PID 1828 wrote to memory of 3896	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	109
PID 1828 wrote to memory of 372	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	110
PID 1828 wrote to memory of 372	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	110
PID 1828 wrote to memory of 2256	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	111
PID 1828 wrote to memory of 2256	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	111
PID 1828 wrote to memory of 3468	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	112
PID 1828 wrote to memory of 3468	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	112
PID 1828 wrote to memory of 2492	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	113
PID 1828 wrote to memory of 2492	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	113
PID 1828 wrote to memory of 2092	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	114
PID 1828 wrote to memory of 2092	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	114
PID 1828 wrote to memory of 2052	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	115
PID 1828 wrote to memory of 2052	1828	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\System\MenQzzp.exe
  C:\Windows\System\MenQzzp.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\kTnZGGW.exe
  C:\Windows\System\kTnZGGW.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\kPvFmsD.exe
  C:\Windows\System\kPvFmsD.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\UwLsXLo.exe
  C:\Windows\System\UwLsXLo.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\HTAFECX.exe
  C:\Windows\System\HTAFECX.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\VCOejdr.exe
  C:\Windows\System\VCOejdr.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\sZPvNti.exe
  C:\Windows\System\sZPvNti.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\dBPehmp.exe
  C:\Windows\System\dBPehmp.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\acEgjfs.exe
  C:\Windows\System\acEgjfs.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\JQHzznC.exe
  C:\Windows\System\JQHzznC.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\ztwCWxm.exe
  C:\Windows\System\ztwCWxm.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\pPhWOnq.exe
  C:\Windows\System\pPhWOnq.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\uLttFXc.exe
  C:\Windows\System\uLttFXc.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\YoOaXit.exe
  C:\Windows\System\YoOaXit.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\twGTeHp.exe
  C:\Windows\System\twGTeHp.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\mYWhkOW.exe
  C:\Windows\System\mYWhkOW.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\aSfyqDk.exe
  C:\Windows\System\aSfyqDk.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\JrXlsBS.exe
  C:\Windows\System\JrXlsBS.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\gZEPQYc.exe
  C:\Windows\System\gZEPQYc.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\CYDLMtr.exe
  C:\Windows\System\CYDLMtr.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\oZcmXHO.exe
  C:\Windows\System\oZcmXHO.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\LiFpHEp.exe
  C:\Windows\System\LiFpHEp.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\IbyCCPw.exe
  C:\Windows\System\IbyCCPw.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\XLZYhcd.exe
  C:\Windows\System\XLZYhcd.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\PbyyxQH.exe
  C:\Windows\System\PbyyxQH.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\ElDzzVS.exe
  C:\Windows\System\ElDzzVS.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\JNGhHcA.exe
  C:\Windows\System\JNGhHcA.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\oGKtdAx.exe
  C:\Windows\System\oGKtdAx.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\GLDyEyJ.exe
  C:\Windows\System\GLDyEyJ.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\lxMaJoo.exe
  C:\Windows\System\lxMaJoo.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\vFMEEGz.exe
  C:\Windows\System\vFMEEGz.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\blhEFbX.exe
  C:\Windows\System\blhEFbX.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\mjxZEsS.exe
  C:\Windows\System\mjxZEsS.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\YHjXrDa.exe
  C:\Windows\System\YHjXrDa.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\iSYpFYs.exe
  C:\Windows\System\iSYpFYs.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\ZOIGjpc.exe
  C:\Windows\System\ZOIGjpc.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\PjWKZws.exe
  C:\Windows\System\PjWKZws.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\zfAtRpN.exe
  C:\Windows\System\zfAtRpN.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\BGXnogY.exe
  C:\Windows\System\BGXnogY.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\iNYzYuM.exe
  C:\Windows\System\iNYzYuM.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\jvyUauJ.exe
  C:\Windows\System\jvyUauJ.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\PjbpGYI.exe
  C:\Windows\System\PjbpGYI.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\lmStyBc.exe
  C:\Windows\System\lmStyBc.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\gUrJewa.exe
  C:\Windows\System\gUrJewa.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\uvGMBzy.exe
  C:\Windows\System\uvGMBzy.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\qtsiWqH.exe
  C:\Windows\System\qtsiWqH.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\ntYVYWp.exe
  C:\Windows\System\ntYVYWp.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\RbBxSgg.exe
  C:\Windows\System\RbBxSgg.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\QhOwtXB.exe
  C:\Windows\System\QhOwtXB.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\XubQskd.exe
  C:\Windows\System\XubQskd.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\BHHdawF.exe
  C:\Windows\System\BHHdawF.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\BetsjLQ.exe
  C:\Windows\System\BetsjLQ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\pGmkSSx.exe
  C:\Windows\System\pGmkSSx.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\iukGXaf.exe
  C:\Windows\System\iukGXaf.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\iArfgfq.exe
  C:\Windows\System\iArfgfq.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\ihmtIbf.exe
  C:\Windows\System\ihmtIbf.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\WJsEUfP.exe
  C:\Windows\System\WJsEUfP.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\Gkiigyt.exe
  C:\Windows\System\Gkiigyt.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\XizlJMN.exe
  C:\Windows\System\XizlJMN.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\GNjfqIN.exe
  C:\Windows\System\GNjfqIN.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\zxwlXNt.exe
  C:\Windows\System\zxwlXNt.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\gvjfeRT.exe
  C:\Windows\System\gvjfeRT.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\CADYEIb.exe
  C:\Windows\System\CADYEIb.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\DgYSNmM.exe
  C:\Windows\System\DgYSNmM.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\RuWGeLt.exe
  C:\Windows\System\RuWGeLt.exe
  2⤵
  PID:4700
- C:\Windows\System\liUbEup.exe
  C:\Windows\System\liUbEup.exe
  2⤵
  PID:3476
- C:\Windows\System\MXjLXKf.exe
  C:\Windows\System\MXjLXKf.exe
  2⤵
  PID:4288
- C:\Windows\System\VGrVQuW.exe
  C:\Windows\System\VGrVQuW.exe
  2⤵
  PID:4568
- C:\Windows\System\upQLUhb.exe
  C:\Windows\System\upQLUhb.exe
  2⤵
  PID:1996
- C:\Windows\System\sCRyfPh.exe
  C:\Windows\System\sCRyfPh.exe
  2⤵
  PID:2132
- C:\Windows\System\nbAcKEz.exe
  C:\Windows\System\nbAcKEz.exe
  2⤵
  PID:1052
- C:\Windows\System\utEjZnF.exe
  C:\Windows\System\utEjZnF.exe
  2⤵
  PID:1544
- C:\Windows\System\mCUdnZs.exe
  C:\Windows\System\mCUdnZs.exe
  2⤵
  PID:5128
- C:\Windows\System\jmdniWl.exe
  C:\Windows\System\jmdniWl.exe
  2⤵
  PID:5156
- C:\Windows\System\ydwkfnJ.exe
  C:\Windows\System\ydwkfnJ.exe
  2⤵
  PID:5184
- C:\Windows\System\BJWkDfL.exe
  C:\Windows\System\BJWkDfL.exe
  2⤵
  PID:5212
- C:\Windows\System\JtodlJa.exe
  C:\Windows\System\JtodlJa.exe
  2⤵
  PID:5244
- C:\Windows\System\edJASNS.exe
  C:\Windows\System\edJASNS.exe
  2⤵
  PID:5268
- C:\Windows\System\xKDiieI.exe
  C:\Windows\System\xKDiieI.exe
  2⤵
  PID:5296
- C:\Windows\System\VCysoxj.exe
  C:\Windows\System\VCysoxj.exe
  2⤵
  PID:5324
- C:\Windows\System\ewhdjLt.exe
  C:\Windows\System\ewhdjLt.exe
  2⤵
  PID:5352
- C:\Windows\System\XaOeaMu.exe
  C:\Windows\System\XaOeaMu.exe
  2⤵
  PID:5376
- C:\Windows\System\LiIuWgH.exe
  C:\Windows\System\LiIuWgH.exe
  2⤵
  PID:5408
- C:\Windows\System\cIEQcxs.exe
  C:\Windows\System\cIEQcxs.exe
  2⤵
  PID:5436
- C:\Windows\System\UiCdytR.exe
  C:\Windows\System\UiCdytR.exe
  2⤵
  PID:5464
- C:\Windows\System\WJnbFhw.exe
  C:\Windows\System\WJnbFhw.exe
  2⤵
  PID:5492
- C:\Windows\System\vpIiumT.exe
  C:\Windows\System\vpIiumT.exe
  2⤵
  PID:5520
- C:\Windows\System\uSUYJac.exe
  C:\Windows\System\uSUYJac.exe
  2⤵
  PID:5548
- C:\Windows\System\PsvyjQe.exe
  C:\Windows\System\PsvyjQe.exe
  2⤵
  PID:5576
- C:\Windows\System\kQACIJy.exe
  C:\Windows\System\kQACIJy.exe
  2⤵
  PID:5604
- C:\Windows\System\nxlTiHF.exe
  C:\Windows\System\nxlTiHF.exe
  2⤵
  PID:5632
- C:\Windows\System\EYMDUXW.exe
  C:\Windows\System\EYMDUXW.exe
  2⤵
  PID:5660
- C:\Windows\System\TcckMYv.exe
  C:\Windows\System\TcckMYv.exe
  2⤵
  PID:5684
- C:\Windows\System\PKEcPjN.exe
  C:\Windows\System\PKEcPjN.exe
  2⤵
  PID:5716
- C:\Windows\System\nqBxBQQ.exe
  C:\Windows\System\nqBxBQQ.exe
  2⤵
  PID:5744
- C:\Windows\System\OkWljeb.exe
  C:\Windows\System\OkWljeb.exe
  2⤵
  PID:5772
- C:\Windows\System\jmtVBNI.exe
  C:\Windows\System\jmtVBNI.exe
  2⤵
  PID:5796
- C:\Windows\System\CYqEvxk.exe
  C:\Windows\System\CYqEvxk.exe
  2⤵
  PID:5824
- C:\Windows\System\OfCrrHi.exe
  C:\Windows\System\OfCrrHi.exe
  2⤵
  PID:5856
- C:\Windows\System\aQZqlav.exe
  C:\Windows\System\aQZqlav.exe
  2⤵
  PID:5884
- C:\Windows\System\OdmEhzp.exe
  C:\Windows\System\OdmEhzp.exe
  2⤵
  PID:5912
- C:\Windows\System\WTMLqAp.exe
  C:\Windows\System\WTMLqAp.exe
  2⤵
  PID:5940
- C:\Windows\System\WKvdAlo.exe
  C:\Windows\System\WKvdAlo.exe
  2⤵
  PID:5964
- C:\Windows\System\wprTGRO.exe
  C:\Windows\System\wprTGRO.exe
  2⤵
  PID:5996
- C:\Windows\System\drtldYF.exe
  C:\Windows\System\drtldYF.exe
  2⤵
  PID:6024
- C:\Windows\System\nsETOPT.exe
  C:\Windows\System\nsETOPT.exe
  2⤵
  PID:6052
- C:\Windows\System\YlWAvKM.exe
  C:\Windows\System\YlWAvKM.exe
  2⤵
  PID:6080
- C:\Windows\System\mYzHqbo.exe
  C:\Windows\System\mYzHqbo.exe
  2⤵
  PID:6112
- C:\Windows\System\SWbonTq.exe
  C:\Windows\System\SWbonTq.exe
  2⤵
  PID:6136
- C:\Windows\System\JUOZkcg.exe
  C:\Windows\System\JUOZkcg.exe
  2⤵
  PID:4996
- C:\Windows\System\rvaeVmJ.exe
  C:\Windows\System\rvaeVmJ.exe
  2⤵
  PID:3108
- C:\Windows\System\zTERVbl.exe
  C:\Windows\System\zTERVbl.exe
  2⤵
  PID:2428
- C:\Windows\System\ovpacrU.exe
  C:\Windows\System\ovpacrU.exe
  2⤵
  PID:388
- C:\Windows\System\iSMwAyr.exe
  C:\Windows\System\iSMwAyr.exe
  2⤵
  PID:3892
- C:\Windows\System\tSkjPJS.exe
  C:\Windows\System\tSkjPJS.exe
  2⤵
  PID:1924
- C:\Windows\System\HpzXgsD.exe
  C:\Windows\System\HpzXgsD.exe
  2⤵
  PID:5168
- C:\Windows\System\ZuLhVsd.exe
  C:\Windows\System\ZuLhVsd.exe
  2⤵
  PID:5224
- C:\Windows\System\FwXDlcg.exe
  C:\Windows\System\FwXDlcg.exe
  2⤵
  PID:5284
- C:\Windows\System\vsUkixp.exe
  C:\Windows\System\vsUkixp.exe
  2⤵
  PID:5364
- C:\Windows\System\SJjUuPd.exe
  C:\Windows\System\SJjUuPd.exe
  2⤵
  PID:5424
- C:\Windows\System\RIbxutG.exe
  C:\Windows\System\RIbxutG.exe
  2⤵
  PID:5484
- C:\Windows\System\RRiTFiW.exe
  C:\Windows\System\RRiTFiW.exe
  2⤵
  PID:5560
- C:\Windows\System\wtNIDSW.exe
  C:\Windows\System\wtNIDSW.exe
  2⤵
  PID:5616
- C:\Windows\System\MtfEAWQ.exe
  C:\Windows\System\MtfEAWQ.exe
  2⤵
  PID:5676
- C:\Windows\System\BHDjJVG.exe
  C:\Windows\System\BHDjJVG.exe
  2⤵
  PID:5736
- C:\Windows\System\PKSJrfe.exe
  C:\Windows\System\PKSJrfe.exe
  2⤵
  PID:5812
- C:\Windows\System\ZFYnbrm.exe
  C:\Windows\System\ZFYnbrm.exe
  2⤵
  PID:5872
- C:\Windows\System\BuAwvcE.exe
  C:\Windows\System\BuAwvcE.exe
  2⤵
  PID:5932
- C:\Windows\System\XoiMolY.exe
  C:\Windows\System\XoiMolY.exe
  2⤵
  PID:5988
- C:\Windows\System\grAHhWJ.exe
  C:\Windows\System\grAHhWJ.exe
  2⤵
  PID:6064
- C:\Windows\System\JtONXjg.exe
  C:\Windows\System\JtONXjg.exe
  2⤵
  PID:6128
- C:\Windows\System\OcYHiLK.exe
  C:\Windows\System\OcYHiLK.exe
  2⤵
  PID:3440
- C:\Windows\System\hSHPQfg.exe
  C:\Windows\System\hSHPQfg.exe
  2⤵
  PID:4364
- C:\Windows\System\beimRDa.exe
  C:\Windows\System\beimRDa.exe
  2⤵
  PID:5140
- C:\Windows\System\Oxviuoi.exe
  C:\Windows\System\Oxviuoi.exe
  2⤵
  PID:5280
- C:\Windows\System\ZORDlQt.exe
  C:\Windows\System\ZORDlQt.exe
  2⤵
  PID:5452
- C:\Windows\System\DfxsBKI.exe
  C:\Windows\System\DfxsBKI.exe
  2⤵
  PID:5588
- C:\Windows\System\OxNBuEq.exe
  C:\Windows\System\OxNBuEq.exe
  2⤵
  PID:5728
- C:\Windows\System\gzDpVYx.exe
  C:\Windows\System\gzDpVYx.exe
  2⤵
  PID:5900
- C:\Windows\System\lXcbhkQ.exe
  C:\Windows\System\lXcbhkQ.exe
  2⤵
  PID:6164
- C:\Windows\System\OMvExvu.exe
  C:\Windows\System\OMvExvu.exe
  2⤵
  PID:6192
- C:\Windows\System\raGkwuv.exe
  C:\Windows\System\raGkwuv.exe
  2⤵
  PID:6220
- C:\Windows\System\lkFVUPm.exe
  C:\Windows\System\lkFVUPm.exe
  2⤵
  PID:6248
- C:\Windows\System\SBRtvFs.exe
  C:\Windows\System\SBRtvFs.exe
  2⤵
  PID:6276
- C:\Windows\System\CyNeysm.exe
  C:\Windows\System\CyNeysm.exe
  2⤵
  PID:6300
- C:\Windows\System\geghoMq.exe
  C:\Windows\System\geghoMq.exe
  2⤵
  PID:6332
- C:\Windows\System\kabQMXy.exe
  C:\Windows\System\kabQMXy.exe
  2⤵
  PID:6360
- C:\Windows\System\qXPufcY.exe
  C:\Windows\System\qXPufcY.exe
  2⤵
  PID:6388
- C:\Windows\System\Pxefpip.exe
  C:\Windows\System\Pxefpip.exe
  2⤵
  PID:6412
- C:\Windows\System\scnOckj.exe
  C:\Windows\System\scnOckj.exe
  2⤵
  PID:6440
- C:\Windows\System\SLXnsXp.exe
  C:\Windows\System\SLXnsXp.exe
  2⤵
  PID:6468
- C:\Windows\System\iyPCZXd.exe
  C:\Windows\System\iyPCZXd.exe
  2⤵
  PID:6500
- C:\Windows\System\sdBkgoF.exe
  C:\Windows\System\sdBkgoF.exe
  2⤵
  PID:6528
- C:\Windows\System\CMQghso.exe
  C:\Windows\System\CMQghso.exe
  2⤵
  PID:6556
- C:\Windows\System\fQPABtn.exe
  C:\Windows\System\fQPABtn.exe
  2⤵
  PID:6584
- C:\Windows\System\IaCxSld.exe
  C:\Windows\System\IaCxSld.exe
  2⤵
  PID:6612
- C:\Windows\System\xPkegCD.exe
  C:\Windows\System\xPkegCD.exe
  2⤵
  PID:6640
- C:\Windows\System\EDVKnRA.exe
  C:\Windows\System\EDVKnRA.exe
  2⤵
  PID:6668
- C:\Windows\System\eXunBdI.exe
  C:\Windows\System\eXunBdI.exe
  2⤵
  PID:6696
- C:\Windows\System\HyhoycA.exe
  C:\Windows\System\HyhoycA.exe
  2⤵
  PID:6724
- C:\Windows\System\EFFdHHY.exe
  C:\Windows\System\EFFdHHY.exe
  2⤵
  PID:6752
- C:\Windows\System\uJMALGi.exe
  C:\Windows\System\uJMALGi.exe
  2⤵
  PID:6780
- C:\Windows\System\dRHgGOu.exe
  C:\Windows\System\dRHgGOu.exe
  2⤵
  PID:6808
- C:\Windows\System\IyKRFMx.exe
  C:\Windows\System\IyKRFMx.exe
  2⤵
  PID:6836
- C:\Windows\System\XopqhZy.exe
  C:\Windows\System\XopqhZy.exe
  2⤵
  PID:6864
- C:\Windows\System\KGlKpAP.exe
  C:\Windows\System\KGlKpAP.exe
  2⤵
  PID:6892
- C:\Windows\System\HRRnfUf.exe
  C:\Windows\System\HRRnfUf.exe
  2⤵
  PID:6920
- C:\Windows\System\AvlmcMZ.exe
  C:\Windows\System\AvlmcMZ.exe
  2⤵
  PID:6948
- C:\Windows\System\spRMibA.exe
  C:\Windows\System\spRMibA.exe
  2⤵
  PID:6976
- C:\Windows\System\CmpLGNA.exe
  C:\Windows\System\CmpLGNA.exe
  2⤵
  PID:7004
- C:\Windows\System\AKgKlHp.exe
  C:\Windows\System\AKgKlHp.exe
  2⤵
  PID:7032
- C:\Windows\System\srTHQik.exe
  C:\Windows\System\srTHQik.exe
  2⤵
  PID:7060
- C:\Windows\System\wObumGI.exe
  C:\Windows\System\wObumGI.exe
  2⤵
  PID:7088
- C:\Windows\System\pvxlBoM.exe
  C:\Windows\System\pvxlBoM.exe
  2⤵
  PID:7116
- C:\Windows\System\wRxEwoV.exe
  C:\Windows\System\wRxEwoV.exe
  2⤵
  PID:7148
- C:\Windows\System\DZLEJOs.exe
  C:\Windows\System\DZLEJOs.exe
  2⤵
  PID:5960
- C:\Windows\System\lcBJERX.exe
  C:\Windows\System\lcBJERX.exe
  2⤵
  PID:6100
- C:\Windows\System\UvnSAPi.exe
  C:\Windows\System\UvnSAPi.exe
  2⤵
  PID:3244
- C:\Windows\System\juUtzOX.exe
  C:\Windows\System\juUtzOX.exe
  2⤵
  PID:5392
- C:\Windows\System\FonLcAx.exe
  C:\Windows\System\FonLcAx.exe
  2⤵
  PID:5652
- C:\Windows\System\vgnMAhi.exe
  C:\Windows\System\vgnMAhi.exe
  2⤵
  PID:6176
- C:\Windows\System\TPfcWEN.exe
  C:\Windows\System\TPfcWEN.exe
  2⤵
  PID:1888
- C:\Windows\System\EkWJLcb.exe
  C:\Windows\System\EkWJLcb.exe
  2⤵
  PID:6292
- C:\Windows\System\nSbqsZk.exe
  C:\Windows\System\nSbqsZk.exe
  2⤵
  PID:6352
- C:\Windows\System\ofHjlFv.exe
  C:\Windows\System\ofHjlFv.exe
  2⤵
  PID:6428
- C:\Windows\System\mUxnaho.exe
  C:\Windows\System\mUxnaho.exe
  2⤵
  PID:6488
- C:\Windows\System\HyfSucQ.exe
  C:\Windows\System\HyfSucQ.exe
  2⤵
  PID:6548
- C:\Windows\System\KtcDFmP.exe
  C:\Windows\System\KtcDFmP.exe
  2⤵
  PID:6604
- C:\Windows\System\UiFAkkp.exe
  C:\Windows\System\UiFAkkp.exe
  2⤵
  PID:6680
- C:\Windows\System\TNBEmfZ.exe
  C:\Windows\System\TNBEmfZ.exe
  2⤵
  PID:6740
- C:\Windows\System\MOrzPgr.exe
  C:\Windows\System\MOrzPgr.exe
  2⤵
  PID:6796
- C:\Windows\System\pfHEmiG.exe
  C:\Windows\System\pfHEmiG.exe
  2⤵
  PID:6852
- C:\Windows\System\sjfXUom.exe
  C:\Windows\System\sjfXUom.exe
  2⤵
  PID:6912
- C:\Windows\System\xeMCcpT.exe
  C:\Windows\System\xeMCcpT.exe
  2⤵
  PID:6964
- C:\Windows\System\NgwJIUa.exe
  C:\Windows\System\NgwJIUa.exe
  2⤵
  PID:7016
- C:\Windows\System\fybJrSZ.exe
  C:\Windows\System\fybJrSZ.exe
  2⤵
  PID:7072
- C:\Windows\System\hoSykqW.exe
  C:\Windows\System\hoSykqW.exe
  2⤵
  PID:7128
- C:\Windows\System\mhXPpcu.exe
  C:\Windows\System\mhXPpcu.exe
  2⤵
  PID:6040
- C:\Windows\System\pWrMDyB.exe
  C:\Windows\System\pWrMDyB.exe
  2⤵
  PID:5260
- C:\Windows\System\BsZpVpK.exe
  C:\Windows\System\BsZpVpK.exe
  2⤵
  PID:6204
- C:\Windows\System\kTQWJQP.exe
  C:\Windows\System\kTQWJQP.exe
  2⤵
  PID:6264
- C:\Windows\System\LLeXCqP.exe
  C:\Windows\System\LLeXCqP.exe
  2⤵
  PID:672
- C:\Windows\System\kGllrpf.exe
  C:\Windows\System\kGllrpf.exe
  2⤵
  PID:6520
- C:\Windows\System\ZccDmyr.exe
  C:\Windows\System\ZccDmyr.exe
  2⤵
  PID:6632
- C:\Windows\System\KNMNpQm.exe
  C:\Windows\System\KNMNpQm.exe
  2⤵
  PID:6768
- C:\Windows\System\JqMMMdn.exe
  C:\Windows\System\JqMMMdn.exe
  2⤵
  PID:6880
- C:\Windows\System\CCBZUNP.exe
  C:\Windows\System\CCBZUNP.exe
  2⤵
  PID:6960
- C:\Windows\System\xRXZboX.exe
  C:\Windows\System\xRXZboX.exe
  2⤵
  PID:7048
- C:\Windows\System\rTRTITy.exe
  C:\Windows\System\rTRTITy.exe
  2⤵
  PID:4564
- C:\Windows\System\uslTGjg.exe
  C:\Windows\System\uslTGjg.exe
  2⤵
  PID:3924
- C:\Windows\System\MKptXaC.exe
  C:\Windows\System\MKptXaC.exe
  2⤵
  PID:6460
- C:\Windows\System\RBXwbMQ.exe
  C:\Windows\System\RBXwbMQ.exe
  2⤵
  PID:4744
- C:\Windows\System\gpNgIvH.exe
  C:\Windows\System\gpNgIvH.exe
  2⤵
  PID:3940
- C:\Windows\System\OGkZeIV.exe
  C:\Windows\System\OGkZeIV.exe
  2⤵
  PID:4872
- C:\Windows\System\dskdYha.exe
  C:\Windows\System\dskdYha.exe
  2⤵
  PID:856
- C:\Windows\System\lEEPyLa.exe
  C:\Windows\System\lEEPyLa.exe
  2⤵
  PID:752
- C:\Windows\System\gtbyGHm.exe
  C:\Windows\System\gtbyGHm.exe
  2⤵
  PID:5956
- C:\Windows\System\aNKBhvu.exe
  C:\Windows\System\aNKBhvu.exe
  2⤵
  PID:3092
- C:\Windows\System\hzQPnbh.exe
  C:\Windows\System\hzQPnbh.exe
  2⤵
  PID:6940
- C:\Windows\System\onejFYT.exe
  C:\Windows\System\onejFYT.exe
  2⤵
  PID:6348
- C:\Windows\System\SPIGBrA.exe
  C:\Windows\System\SPIGBrA.exe
  2⤵
  PID:7204
- C:\Windows\System\OgLBdsz.exe
  C:\Windows\System\OgLBdsz.exe
  2⤵
  PID:7236
- C:\Windows\System\JcRVqeL.exe
  C:\Windows\System\JcRVqeL.exe
  2⤵
  PID:7260
- C:\Windows\System\TFYhcCq.exe
  C:\Windows\System\TFYhcCq.exe
  2⤵
  PID:7284
- C:\Windows\System\uXrnkMw.exe
  C:\Windows\System\uXrnkMw.exe
  2⤵
  PID:7304
- C:\Windows\System\MdlaTzr.exe
  C:\Windows\System\MdlaTzr.exe
  2⤵
  PID:7324
- C:\Windows\System\imqLtBi.exe
  C:\Windows\System\imqLtBi.exe
  2⤵
  PID:7356
- C:\Windows\System\BYFCrLO.exe
  C:\Windows\System\BYFCrLO.exe
  2⤵
  PID:7384
- C:\Windows\System\GdjaObB.exe
  C:\Windows\System\GdjaObB.exe
  2⤵
  PID:7424
- C:\Windows\System\BejNeOR.exe
  C:\Windows\System\BejNeOR.exe
  2⤵
  PID:7456
- C:\Windows\System\UdniDRe.exe
  C:\Windows\System\UdniDRe.exe
  2⤵
  PID:7652
- C:\Windows\System\iWDEzTB.exe
  C:\Windows\System\iWDEzTB.exe
  2⤵
  PID:7728
- C:\Windows\System\WAqzqoX.exe
  C:\Windows\System\WAqzqoX.exe
  2⤵
  PID:7744
- C:\Windows\System\uCsFaHu.exe
  C:\Windows\System\uCsFaHu.exe
  2⤵
  PID:7772
- C:\Windows\System\LEOrTEz.exe
  C:\Windows\System\LEOrTEz.exe
  2⤵
  PID:7796
- C:\Windows\System\yKJKEwf.exe
  C:\Windows\System\yKJKEwf.exe
  2⤵
  PID:7816
- C:\Windows\System\MXmKoxf.exe
  C:\Windows\System\MXmKoxf.exe
  2⤵
  PID:7844
- C:\Windows\System\MdWZMhT.exe
  C:\Windows\System\MdWZMhT.exe
  2⤵
  PID:7872
- C:\Windows\System\YnBORjY.exe
  C:\Windows\System\YnBORjY.exe
  2⤵
  PID:7912
- C:\Windows\System\NxkZwBn.exe
  C:\Windows\System\NxkZwBn.exe
  2⤵
  PID:7928
- C:\Windows\System\xNSQudE.exe
  C:\Windows\System\xNSQudE.exe
  2⤵
  PID:7968
- C:\Windows\System\jeurIsP.exe
  C:\Windows\System\jeurIsP.exe
  2⤵
  PID:7984
- C:\Windows\System\vTkRwCi.exe
  C:\Windows\System\vTkRwCi.exe
  2⤵
  PID:8012
- C:\Windows\System\UyfgpZp.exe
  C:\Windows\System\UyfgpZp.exe
  2⤵
  PID:8052
- C:\Windows\System\KfFGQSY.exe
  C:\Windows\System\KfFGQSY.exe
  2⤵
  PID:8080
- C:\Windows\System\SREFgho.exe
  C:\Windows\System\SREFgho.exe
  2⤵
  PID:8096
- C:\Windows\System\prBLvps.exe
  C:\Windows\System\prBLvps.exe
  2⤵
  PID:8128
- C:\Windows\System\DxiaGAQ.exe
  C:\Windows\System\DxiaGAQ.exe
  2⤵
  PID:8152
- C:\Windows\System\iBBZvmp.exe
  C:\Windows\System\iBBZvmp.exe
  2⤵
  PID:2584
- C:\Windows\System\FcUxLoD.exe
  C:\Windows\System\FcUxLoD.exe
  2⤵
  PID:6572
- C:\Windows\System\NEDLxGz.exe
  C:\Windows\System\NEDLxGz.exe
  2⤵
  PID:5044
- C:\Windows\System\Agiunct.exe
  C:\Windows\System\Agiunct.exe
  2⤵
  PID:7100
- C:\Windows\System\qIOrWfY.exe
  C:\Windows\System\qIOrWfY.exe
  2⤵
  PID:7256
- C:\Windows\System\qTOzLBA.exe
  C:\Windows\System\qTOzLBA.exe
  2⤵
  PID:7276
- C:\Windows\System\cjWoaTU.exe
  C:\Windows\System\cjWoaTU.exe
  2⤵
  PID:7376
- C:\Windows\System\gYtnFos.exe
  C:\Windows\System\gYtnFos.exe
  2⤵
  PID:7496
- C:\Windows\System\hBljJZT.exe
  C:\Windows\System\hBljJZT.exe
  2⤵
  PID:7620
- C:\Windows\System\MqaYmAZ.exe
  C:\Windows\System\MqaYmAZ.exe
  2⤵
  PID:7268
- C:\Windows\System\XVVPUMu.exe
  C:\Windows\System\XVVPUMu.exe
  2⤵
  PID:7536
- C:\Windows\System\JjCgiaA.exe
  C:\Windows\System\JjCgiaA.exe
  2⤵
  PID:7568
- C:\Windows\System\LPkDlbC.exe
  C:\Windows\System\LPkDlbC.exe
  2⤵
  PID:7760
- C:\Windows\System\CgiRzmN.exe
  C:\Windows\System\CgiRzmN.exe
  2⤵
  PID:7812
- C:\Windows\System\ModvvSG.exe
  C:\Windows\System\ModvvSG.exe
  2⤵
  PID:7888
- C:\Windows\System\NUgKSdR.exe
  C:\Windows\System\NUgKSdR.exe
  2⤵
  PID:7924
- C:\Windows\System\EvMGrXY.exe
  C:\Windows\System\EvMGrXY.exe
  2⤵
  PID:7976
- C:\Windows\System\jZZeOwm.exe
  C:\Windows\System\jZZeOwm.exe
  2⤵
  PID:8032
- C:\Windows\System\GDzbhCu.exe
  C:\Windows\System\GDzbhCu.exe
  2⤵
  PID:8124
- C:\Windows\System\ttIvxDO.exe
  C:\Windows\System\ttIvxDO.exe
  2⤵
  PID:3428
- C:\Windows\System\XslZWNw.exe
  C:\Windows\System\XslZWNw.exe
  2⤵
  PID:1372
- C:\Windows\System\vnzEtVe.exe
  C:\Windows\System\vnzEtVe.exe
  2⤵
  PID:7320
- C:\Windows\System\yLBKytM.exe
  C:\Windows\System\yLBKytM.exe
  2⤵
  PID:7412
- C:\Windows\System\mLQIGaT.exe
  C:\Windows\System\mLQIGaT.exe
  2⤵
  PID:7296
- C:\Windows\System\nwjhHrV.exe
  C:\Windows\System\nwjhHrV.exe
  2⤵
  PID:7720
- C:\Windows\System\bICLgaf.exe
  C:\Windows\System\bICLgaf.exe
  2⤵
  PID:7856
- C:\Windows\System\dhGMuoE.exe
  C:\Windows\System\dhGMuoE.exe
  2⤵
  PID:8044
- C:\Windows\System\bHzfquG.exe
  C:\Windows\System\bHzfquG.exe
  2⤵
  PID:7184
- C:\Windows\System\vzoLbsR.exe
  C:\Windows\System\vzoLbsR.exe
  2⤵
  PID:7528
- C:\Windows\System\JkRViyy.exe
  C:\Windows\System\JkRViyy.exe
  2⤵
  PID:8088
- C:\Windows\System\sFpjidj.exe
  C:\Windows\System\sFpjidj.exe
  2⤵
  PID:392
- C:\Windows\System\RcpLGjV.exe
  C:\Windows\System\RcpLGjV.exe
  2⤵
  PID:8048
- C:\Windows\System\pCTcjnP.exe
  C:\Windows\System\pCTcjnP.exe
  2⤵
  PID:8196
- C:\Windows\System\MMQVeea.exe
  C:\Windows\System\MMQVeea.exe
  2⤵
  PID:8220
- C:\Windows\System\ipgBKhB.exe
  C:\Windows\System\ipgBKhB.exe
  2⤵
  PID:8256
- C:\Windows\System\YAuvjEB.exe
  C:\Windows\System\YAuvjEB.exe
  2⤵
  PID:8276
- C:\Windows\System\Rtfdlou.exe
  C:\Windows\System\Rtfdlou.exe
  2⤵
  PID:8300
- C:\Windows\System\cEOJVYU.exe
  C:\Windows\System\cEOJVYU.exe
  2⤵
  PID:8336
- C:\Windows\System\kMFoKKN.exe
  C:\Windows\System\kMFoKKN.exe
  2⤵
  PID:8368
- C:\Windows\System\BtOaXbp.exe
  C:\Windows\System\BtOaXbp.exe
  2⤵
  PID:8392
- C:\Windows\System\ftKIzmP.exe
  C:\Windows\System\ftKIzmP.exe
  2⤵
  PID:8420
- C:\Windows\System\UexvnsM.exe
  C:\Windows\System\UexvnsM.exe
  2⤵
  PID:8444
- C:\Windows\System\dHVdzPU.exe
  C:\Windows\System\dHVdzPU.exe
  2⤵
  PID:8472
- C:\Windows\System\qJeHzIL.exe
  C:\Windows\System\qJeHzIL.exe
  2⤵
  PID:8500
- C:\Windows\System\XzUJepJ.exe
  C:\Windows\System\XzUJepJ.exe
  2⤵
  PID:8532
- C:\Windows\System\FMiGltm.exe
  C:\Windows\System\FMiGltm.exe
  2⤵
  PID:8560
- C:\Windows\System\xHvJSMv.exe
  C:\Windows\System\xHvJSMv.exe
  2⤵
  PID:8588
- C:\Windows\System\iTbIBlq.exe
  C:\Windows\System\iTbIBlq.exe
  2⤵
  PID:8616
- C:\Windows\System\daZrLqg.exe
  C:\Windows\System\daZrLqg.exe
  2⤵
  PID:8656
- C:\Windows\System\lMvaWZV.exe
  C:\Windows\System\lMvaWZV.exe
  2⤵
  PID:8684
- C:\Windows\System\EYvrhtW.exe
  C:\Windows\System\EYvrhtW.exe
  2⤵
  PID:8700
- C:\Windows\System\AxsDurN.exe
  C:\Windows\System\AxsDurN.exe
  2⤵
  PID:8728
- C:\Windows\System\CzNmDsc.exe
  C:\Windows\System\CzNmDsc.exe
  2⤵
  PID:8756
- C:\Windows\System\UbDWlQC.exe
  C:\Windows\System\UbDWlQC.exe
  2⤵
  PID:8788
- C:\Windows\System\YIiJhUy.exe
  C:\Windows\System\YIiJhUy.exe
  2⤵
  PID:8816
- C:\Windows\System\xOxlIjz.exe
  C:\Windows\System\xOxlIjz.exe
  2⤵
  PID:8852
- C:\Windows\System\aGEomOx.exe
  C:\Windows\System\aGEomOx.exe
  2⤵
  PID:8868
- C:\Windows\System\NnonRBg.exe
  C:\Windows\System\NnonRBg.exe
  2⤵
  PID:8896
- C:\Windows\System\RLHzhzy.exe
  C:\Windows\System\RLHzhzy.exe
  2⤵
  PID:8924
- C:\Windows\System\SUINVHt.exe
  C:\Windows\System\SUINVHt.exe
  2⤵
  PID:8952
- C:\Windows\System\ooLWrOP.exe
  C:\Windows\System\ooLWrOP.exe
  2⤵
  PID:8980
- C:\Windows\System\wzzbRwf.exe
  C:\Windows\System\wzzbRwf.exe
  2⤵
  PID:8996
- C:\Windows\System\uGtVEws.exe
  C:\Windows\System\uGtVEws.exe
  2⤵
  PID:9040
- C:\Windows\System\gZUlNyq.exe
  C:\Windows\System\gZUlNyq.exe
  2⤵
  PID:9064
- C:\Windows\System\lnzMvZR.exe
  C:\Windows\System\lnzMvZR.exe
  2⤵
  PID:9092
- C:\Windows\System\iyROoqz.exe
  C:\Windows\System\iyROoqz.exe
  2⤵
  PID:9120
- C:\Windows\System\UhPCEHU.exe
  C:\Windows\System\UhPCEHU.exe
  2⤵
  PID:9160
- C:\Windows\System\unyVgIK.exe
  C:\Windows\System\unyVgIK.exe
  2⤵
  PID:9188
- C:\Windows\System\qGWRdmk.exe
  C:\Windows\System\qGWRdmk.exe
  2⤵
  PID:9204
- C:\Windows\System\udEjPVp.exe
  C:\Windows\System\udEjPVp.exe
  2⤵
  PID:8208
- C:\Windows\System\HjKBHXf.exe
  C:\Windows\System\HjKBHXf.exe
  2⤵
  PID:8264
- C:\Windows\System\FoSNblg.exe
  C:\Windows\System\FoSNblg.exe
  2⤵
  PID:8356
- C:\Windows\System\zjRPBEv.exe
  C:\Windows\System\zjRPBEv.exe
  2⤵
  PID:8408
- C:\Windows\System\xoMgcjN.exe
  C:\Windows\System\xoMgcjN.exe
  2⤵
  PID:8528
- C:\Windows\System\TkmYZIm.exe
  C:\Windows\System\TkmYZIm.exe
  2⤵
  PID:8544
- C:\Windows\System\ecrbIwW.exe
  C:\Windows\System\ecrbIwW.exe
  2⤵
  PID:8604
- C:\Windows\System\jRUHlVe.exe
  C:\Windows\System\jRUHlVe.exe
  2⤵
  PID:8676
- C:\Windows\System\CDVnQDA.exe
  C:\Windows\System\CDVnQDA.exe
  2⤵
  PID:8716
- C:\Windows\System\LQbDpXL.exe
  C:\Windows\System\LQbDpXL.exe
  2⤵
  PID:8796
- C:\Windows\System\qeByWRB.exe
  C:\Windows\System\qeByWRB.exe
  2⤵
  PID:8892
- C:\Windows\System\BPNSksN.exe
  C:\Windows\System\BPNSksN.exe
  2⤵
  PID:8972
- C:\Windows\System\xmnNuRB.exe
  C:\Windows\System\xmnNuRB.exe
  2⤵
  PID:8988
- C:\Windows\System\WqPPfmh.exe
  C:\Windows\System\WqPPfmh.exe
  2⤵
  PID:9084
- C:\Windows\System\Jaqjjgo.exe
  C:\Windows\System\Jaqjjgo.exe
  2⤵
  PID:9104
- C:\Windows\System\ecBUSKT.exe
  C:\Windows\System\ecBUSKT.exe
  2⤵
  PID:9176
- C:\Windows\System\dCPZBfM.exe
  C:\Windows\System\dCPZBfM.exe
  2⤵
  PID:8236
- C:\Windows\System\XcjMabL.exe
  C:\Windows\System\XcjMabL.exe
  2⤵
  PID:8460
- C:\Windows\System\NTkFOgg.exe
  C:\Windows\System\NTkFOgg.exe
  2⤵
  PID:8576
- C:\Windows\System\YAlDwyf.exe
  C:\Windows\System\YAlDwyf.exe
  2⤵
  PID:8748
- C:\Windows\System\JGlKyFr.exe
  C:\Windows\System\JGlKyFr.exe
  2⤵
  PID:8884
- C:\Windows\System\otumBaq.exe
  C:\Windows\System\otumBaq.exe
  2⤵
  PID:7280
- C:\Windows\System\mVNHGVE.exe
  C:\Windows\System\mVNHGVE.exe
  2⤵
  PID:9140
- C:\Windows\System\APtwrYt.exe
  C:\Windows\System\APtwrYt.exe
  2⤵
  PID:8512
- C:\Windows\System\DJEBgWa.exe
  C:\Windows\System\DJEBgWa.exe
  2⤵
  PID:8720
- C:\Windows\System\wuUJvHL.exe
  C:\Windows\System\wuUJvHL.exe
  2⤵
  PID:9076
- C:\Windows\System\YhIZDPt.exe
  C:\Windows\System\YhIZDPt.exe
  2⤵
  PID:8548
- C:\Windows\System\mRxLSga.exe
  C:\Windows\System\mRxLSga.exe
  2⤵
  PID:9232
- C:\Windows\System\sxivfQj.exe
  C:\Windows\System\sxivfQj.exe
  2⤵
  PID:9248
- C:\Windows\System\QMQRqqK.exe
  C:\Windows\System\QMQRqqK.exe
  2⤵
  PID:9280
- C:\Windows\System\skUaGjC.exe
  C:\Windows\System\skUaGjC.exe
  2⤵
  PID:9304
- C:\Windows\System\aYYiSRx.exe
  C:\Windows\System\aYYiSRx.exe
  2⤵
  PID:9320
- C:\Windows\System\qTTdvmp.exe
  C:\Windows\System\qTTdvmp.exe
  2⤵
  PID:9372
- C:\Windows\System\MoGYkTe.exe
  C:\Windows\System\MoGYkTe.exe
  2⤵
  PID:9388
- C:\Windows\System\AkuZWMl.exe
  C:\Windows\System\AkuZWMl.exe
  2⤵
  PID:9416
- C:\Windows\System\dOaLMxJ.exe
  C:\Windows\System\dOaLMxJ.exe
  2⤵
  PID:9444
- C:\Windows\System\aJQLwxu.exe
  C:\Windows\System\aJQLwxu.exe
  2⤵
  PID:9472
- C:\Windows\System\CnXeupj.exe
  C:\Windows\System\CnXeupj.exe
  2⤵
  PID:9512
- C:\Windows\System\AFLBFLa.exe
  C:\Windows\System\AFLBFLa.exe
  2⤵
  PID:9540
- C:\Windows\System\nnIeKyt.exe
  C:\Windows\System\nnIeKyt.exe
  2⤵
  PID:9556
- C:\Windows\System\wTTufHq.exe
  C:\Windows\System\wTTufHq.exe
  2⤵
  PID:9596
- C:\Windows\System\qGoRPgz.exe
  C:\Windows\System\qGoRPgz.exe
  2⤵
  PID:9624
- C:\Windows\System\YSPfQPA.exe
  C:\Windows\System\YSPfQPA.exe
  2⤵
  PID:9652
- C:\Windows\System\AwInmyw.exe
  C:\Windows\System\AwInmyw.exe
  2⤵
  PID:9680
- C:\Windows\System\urZKaut.exe
  C:\Windows\System\urZKaut.exe
  2⤵
  PID:9708
- C:\Windows\System\LxnVnFr.exe
  C:\Windows\System\LxnVnFr.exe
  2⤵
  PID:9736
- C:\Windows\System\jsxAnAb.exe
  C:\Windows\System\jsxAnAb.exe
  2⤵
  PID:9752
- C:\Windows\System\joSsFmN.exe
  C:\Windows\System\joSsFmN.exe
  2⤵
  PID:9780
- C:\Windows\System\gpCbEhD.exe
  C:\Windows\System\gpCbEhD.exe
  2⤵
  PID:9808
- C:\Windows\System\JkAtCLj.exe
  C:\Windows\System\JkAtCLj.exe
  2⤵
  PID:9824
- C:\Windows\System\bgMrAZt.exe
  C:\Windows\System\bgMrAZt.exe
  2⤵
  PID:9848
- C:\Windows\System\efzltJg.exe
  C:\Windows\System\efzltJg.exe
  2⤵
  PID:9884
- C:\Windows\System\FlFJdRb.exe
  C:\Windows\System\FlFJdRb.exe
  2⤵
  PID:9908
- C:\Windows\System\aswoaeE.exe
  C:\Windows\System\aswoaeE.exe
  2⤵
  PID:9936
- C:\Windows\System\ZGfDXfd.exe
  C:\Windows\System\ZGfDXfd.exe
  2⤵
  PID:9984
- C:\Windows\System\YaddWiL.exe
  C:\Windows\System\YaddWiL.exe
  2⤵
  PID:10004
- C:\Windows\System\XsqSwZp.exe
  C:\Windows\System\XsqSwZp.exe
  2⤵
  PID:10032
- C:\Windows\System\osOYrdH.exe
  C:\Windows\System\osOYrdH.exe
  2⤵
  PID:10064
- C:\Windows\System\ILyfzrI.exe
  C:\Windows\System\ILyfzrI.exe
  2⤵
  PID:10080
- C:\Windows\System\kFTDVVY.exe
  C:\Windows\System\kFTDVVY.exe
  2⤵
  PID:10120
- C:\Windows\System\OeedZgR.exe
  C:\Windows\System\OeedZgR.exe
  2⤵
  PID:10144
- C:\Windows\System\SfyYTgZ.exe
  C:\Windows\System\SfyYTgZ.exe
  2⤵
  PID:10168
- C:\Windows\System\BNWiTpj.exe
  C:\Windows\System\BNWiTpj.exe
  2⤵
  PID:10204
- C:\Windows\System\wHhmkYG.exe
  C:\Windows\System\wHhmkYG.exe
  2⤵
  PID:10232
- C:\Windows\System\SrPcgOV.exe
  C:\Windows\System\SrPcgOV.exe
  2⤵
  PID:9240
- C:\Windows\System\TykLuFq.exe
  C:\Windows\System\TykLuFq.exe
  2⤵
  PID:9316
- C:\Windows\System\YBXpGqR.exe
  C:\Windows\System\YBXpGqR.exe
  2⤵
  PID:9428
- C:\Windows\System\pANIbMD.exe
  C:\Windows\System\pANIbMD.exe
  2⤵
  PID:9436
- C:\Windows\System\UohfmZe.exe
  C:\Windows\System\UohfmZe.exe
  2⤵
  PID:9492
- C:\Windows\System\xYFUugg.exe
  C:\Windows\System\xYFUugg.exe
  2⤵
  PID:9524
- C:\Windows\System\QZpfzYj.exe
  C:\Windows\System\QZpfzYj.exe
  2⤵
  PID:9588
- C:\Windows\System\CsMyeib.exe
  C:\Windows\System\CsMyeib.exe
  2⤵
  PID:9640
- C:\Windows\System\BBeOaJJ.exe
  C:\Windows\System\BBeOaJJ.exe
  2⤵
  PID:9744
- C:\Windows\System\yBGHhir.exe
  C:\Windows\System\yBGHhir.exe
  2⤵
  PID:9820
- C:\Windows\System\FibQzVh.exe
  C:\Windows\System\FibQzVh.exe
  2⤵
  PID:9860
- C:\Windows\System\arramfl.exe
  C:\Windows\System\arramfl.exe
  2⤵
  PID:9964
- C:\Windows\System\owJuSKS.exe
  C:\Windows\System\owJuSKS.exe
  2⤵
  PID:10028
- C:\Windows\System\AGDzxme.exe
  C:\Windows\System\AGDzxme.exe
  2⤵
  PID:10100
- C:\Windows\System\imNxCMh.exe
  C:\Windows\System\imNxCMh.exe
  2⤵
  PID:10224
- C:\Windows\System\AuwNnuu.exe
  C:\Windows\System\AuwNnuu.exe
  2⤵
  PID:9224
- C:\Windows\System\TyUfvqJ.exe
  C:\Windows\System\TyUfvqJ.exe
  2⤵
  PID:9300
- C:\Windows\System\PJqCEeO.exe
  C:\Windows\System\PJqCEeO.exe
  2⤵
  PID:9548
- C:\Windows\System\vFXNuOO.exe
  C:\Windows\System\vFXNuOO.exe
  2⤵
  PID:9728
- C:\Windows\System\hBVWQdM.exe
  C:\Windows\System\hBVWQdM.exe
  2⤵
  PID:9836
- C:\Windows\System\SMsYBnU.exe
  C:\Windows\System\SMsYBnU.exe
  2⤵
  PID:9924
- C:\Windows\System\OXdnQMm.exe
  C:\Windows\System\OXdnQMm.exe
  2⤵
  PID:10156
- C:\Windows\System\MbdPFeg.exe
  C:\Windows\System\MbdPFeg.exe
  2⤵
  PID:9456
- C:\Windows\System\PcOBigF.exe
  C:\Windows\System\PcOBigF.exe
  2⤵
  PID:9672
- C:\Windows\System\SahOUQa.exe
  C:\Windows\System\SahOUQa.exe
  2⤵
  PID:10016
- C:\Windows\System\bGrFdWZ.exe
  C:\Windows\System\bGrFdWZ.exe
  2⤵
  PID:9792
- C:\Windows\System\NQvKrHO.exe
  C:\Windows\System\NQvKrHO.exe
  2⤵
  PID:9264
- C:\Windows\System\PRrbPvt.exe
  C:\Windows\System\PRrbPvt.exe
  2⤵
  PID:10268
- C:\Windows\System\zoeMtCB.exe
  C:\Windows\System\zoeMtCB.exe
  2⤵
  PID:10284
- C:\Windows\System\RxGAJXB.exe
  C:\Windows\System\RxGAJXB.exe
  2⤵
  PID:10320
- C:\Windows\System\ZVbnQuO.exe
  C:\Windows\System\ZVbnQuO.exe
  2⤵
  PID:10340
- C:\Windows\System\BuJGnRB.exe
  C:\Windows\System\BuJGnRB.exe
  2⤵
  PID:10360
- C:\Windows\System\kXACcKB.exe
  C:\Windows\System\kXACcKB.exe
  2⤵
  PID:10408
- C:\Windows\System\IzMAsmn.exe
  C:\Windows\System\IzMAsmn.exe
  2⤵
  PID:10424
- C:\Windows\System\GTGqRdz.exe
  C:\Windows\System\GTGqRdz.exe
  2⤵
  PID:10452
- C:\Windows\System\PbvKfuK.exe
  C:\Windows\System\PbvKfuK.exe
  2⤵
  PID:10468
- C:\Windows\System\TJWlsdZ.exe
  C:\Windows\System\TJWlsdZ.exe
  2⤵
  PID:10520
- C:\Windows\System\BQQJNGj.exe
  C:\Windows\System\BQQJNGj.exe
  2⤵
  PID:10544
- C:\Windows\System\OOxTNTB.exe
  C:\Windows\System\OOxTNTB.exe
  2⤵
  PID:10572
- C:\Windows\System\tJcafTL.exe
  C:\Windows\System\tJcafTL.exe
  2⤵
  PID:10596
- C:\Windows\System\YRUkihB.exe
  C:\Windows\System\YRUkihB.exe
  2⤵
  PID:10620
- C:\Windows\System\MQqtmtT.exe
  C:\Windows\System\MQqtmtT.exe
  2⤵
  PID:10652
- C:\Windows\System\NyBNXUM.exe
  C:\Windows\System\NyBNXUM.exe
  2⤵
  PID:10676
- C:\Windows\System\zlkwAEY.exe
  C:\Windows\System\zlkwAEY.exe
  2⤵
  PID:10692
- C:\Windows\System\VAGZaeH.exe
  C:\Windows\System\VAGZaeH.exe
  2⤵
  PID:10708
- C:\Windows\System\kgzCFYU.exe
  C:\Windows\System\kgzCFYU.exe
  2⤵
  PID:10728
- C:\Windows\System\lmmKNyj.exe
  C:\Windows\System\lmmKNyj.exe
  2⤵
  PID:10748
- C:\Windows\System\eezYoUr.exe
  C:\Windows\System\eezYoUr.exe
  2⤵
  PID:10812
- C:\Windows\System\kKyNRXM.exe
  C:\Windows\System\kKyNRXM.exe
  2⤵
  PID:10848
- C:\Windows\System\SVolBPr.exe
  C:\Windows\System\SVolBPr.exe
  2⤵
  PID:10876
- C:\Windows\System\EArhwzo.exe
  C:\Windows\System\EArhwzo.exe
  2⤵
  PID:10912
- C:\Windows\System\LbcudSn.exe
  C:\Windows\System\LbcudSn.exe
  2⤵
  PID:10932
- C:\Windows\System\TFxupBT.exe
  C:\Windows\System\TFxupBT.exe
  2⤵
  PID:10976
- C:\Windows\System\hSVQTCu.exe
  C:\Windows\System\hSVQTCu.exe
  2⤵
  PID:11004
- C:\Windows\System\cvLOnJL.exe
  C:\Windows\System\cvLOnJL.exe
  2⤵
  PID:11032
- C:\Windows\System\aStXamw.exe
  C:\Windows\System\aStXamw.exe
  2⤵
  PID:11060
- C:\Windows\System\etXmRrC.exe
  C:\Windows\System\etXmRrC.exe
  2⤵
  PID:11088
- C:\Windows\System\JXkAZvV.exe
  C:\Windows\System\JXkAZvV.exe
  2⤵
  PID:11116
- C:\Windows\System\ePirmBg.exe
  C:\Windows\System\ePirmBg.exe
  2⤵
  PID:11144
- C:\Windows\System\zWsPJzi.exe
  C:\Windows\System\zWsPJzi.exe
  2⤵
  PID:11172
- C:\Windows\System\fTGriiU.exe
  C:\Windows\System\fTGriiU.exe
  2⤵
  PID:11200
- C:\Windows\System\tmYgeRA.exe
  C:\Windows\System\tmYgeRA.exe
  2⤵
  PID:11228
- C:\Windows\System\zTwSQLG.exe
  C:\Windows\System\zTwSQLG.exe
  2⤵
  PID:11244
- C:\Windows\System\MZgZqSN.exe
  C:\Windows\System\MZgZqSN.exe
  2⤵
  PID:10256
- C:\Windows\System\KAbtAsJ.exe
  C:\Windows\System\KAbtAsJ.exe
  2⤵
  PID:10316
- C:\Windows\System\XGXGTtA.exe
  C:\Windows\System\XGXGTtA.exe
  2⤵
  PID:10384
- C:\Windows\System\JvOoFqz.exe
  C:\Windows\System\JvOoFqz.exe
  2⤵
  PID:10464
- C:\Windows\System\fpbdLqJ.exe
  C:\Windows\System\fpbdLqJ.exe
  2⤵
  PID:10508
- C:\Windows\System\qJtJdLg.exe
  C:\Windows\System\qJtJdLg.exe
  2⤵
  PID:10568
- C:\Windows\System\FmgvjTO.exe
  C:\Windows\System\FmgvjTO.exe
  2⤵
  PID:10660
- C:\Windows\System\ixckApX.exe
  C:\Windows\System\ixckApX.exe
  2⤵
  PID:10704
- C:\Windows\System\HsPjyie.exe
  C:\Windows\System\HsPjyie.exe
  2⤵
  PID:10772
- C:\Windows\System\tvgiDQy.exe
  C:\Windows\System\tvgiDQy.exe
  2⤵
  PID:10820
- C:\Windows\System\uZvUXay.exe
  C:\Windows\System\uZvUXay.exe
  2⤵
  PID:10900
- C:\Windows\System\TDvlfUL.exe
  C:\Windows\System\TDvlfUL.exe
  2⤵
  PID:10928
- C:\Windows\System\HKCQbAp.exe
  C:\Windows\System\HKCQbAp.exe
  2⤵
  PID:11044
- C:\Windows\System\OblaCHU.exe
  C:\Windows\System\OblaCHU.exe
  2⤵
  PID:11132
- C:\Windows\System\QcaRcNg.exe
  C:\Windows\System\QcaRcNg.exe
  2⤵
  PID:11184
- C:\Windows\System\WOUDIZt.exe
  C:\Windows\System\WOUDIZt.exe
  2⤵
  PID:11236
- C:\Windows\System\EJqRAez.exe
  C:\Windows\System\EJqRAez.exe
  2⤵
  PID:10296
- C:\Windows\System\ZFyiPvB.exe
  C:\Windows\System\ZFyiPvB.exe
  2⤵
  PID:10436
- C:\Windows\System\wpeklXj.exe
  C:\Windows\System\wpeklXj.exe
  2⤵
  PID:10604
- C:\Windows\System\ekJLKLm.exe
  C:\Windows\System\ekJLKLm.exe
  2⤵
  PID:10836
- C:\Windows\System\uUmKyPd.exe
  C:\Windows\System\uUmKyPd.exe
  2⤵
  PID:10968
- C:\Windows\System\RRKkvBO.exe
  C:\Windows\System\RRKkvBO.exe
  2⤵
  PID:11084
- C:\Windows\System\uyYGzJT.exe
  C:\Windows\System\uyYGzJT.exe
  2⤵
  PID:11192
- C:\Windows\System\nAJoqMw.exe
  C:\Windows\System\nAJoqMw.exe
  2⤵
  PID:10488
- C:\Windows\System\IPWwiMj.exe
  C:\Windows\System\IPWwiMj.exe
  2⤵
  PID:10688
- C:\Windows\System\JHyAmns.exe
  C:\Windows\System\JHyAmns.exe
  2⤵
  PID:10528
- C:\Windows\System\XWAhCDv.exe
  C:\Windows\System\XWAhCDv.exe
  2⤵
  PID:10864
- C:\Windows\System\IZZScGU.exe
  C:\Windows\System\IZZScGU.exe
  2⤵
  PID:11272
- C:\Windows\System\kMysPkz.exe
  C:\Windows\System\kMysPkz.exe
  2⤵
  PID:11300
- C:\Windows\System\zQtTyvU.exe
  C:\Windows\System\zQtTyvU.exe
  2⤵
  PID:11324
- C:\Windows\System\zHoKsrk.exe
  C:\Windows\System\zHoKsrk.exe
  2⤵
  PID:11352
- C:\Windows\System\ZYTgYYF.exe
  C:\Windows\System\ZYTgYYF.exe
  2⤵
  PID:11376
- C:\Windows\System\SQBQLIu.exe
  C:\Windows\System\SQBQLIu.exe
  2⤵
  PID:11412
- C:\Windows\System\euDsbwU.exe
  C:\Windows\System\euDsbwU.exe
  2⤵
  PID:11440
- C:\Windows\System\HGrBOOy.exe
  C:\Windows\System\HGrBOOy.exe
  2⤵
  PID:11456
- C:\Windows\System\qxGGQhJ.exe
  C:\Windows\System\qxGGQhJ.exe
  2⤵
  PID:11512
- C:\Windows\System\pAxWAZa.exe
  C:\Windows\System\pAxWAZa.exe
  2⤵
  PID:11540
- C:\Windows\System\JLYylYG.exe
  C:\Windows\System\JLYylYG.exe
  2⤵
  PID:11556
- C:\Windows\System\urIicro.exe
  C:\Windows\System\urIicro.exe
  2⤵
  PID:11588
- C:\Windows\System\fuNasBS.exe
  C:\Windows\System\fuNasBS.exe
  2⤵
  PID:11612
- C:\Windows\System\gMXpMoT.exe
  C:\Windows\System\gMXpMoT.exe
  2⤵
  PID:11640
- C:\Windows\System\sLDhomX.exe
  C:\Windows\System\sLDhomX.exe
  2⤵
  PID:11680
- C:\Windows\System\xWhiXUa.exe
  C:\Windows\System\xWhiXUa.exe
  2⤵
  PID:11696
- C:\Windows\System\foDRtpI.exe
  C:\Windows\System\foDRtpI.exe
  2⤵
  PID:11736
- C:\Windows\System\aqyVADH.exe
  C:\Windows\System\aqyVADH.exe
  2⤵
  PID:11752
- C:\Windows\System\WqySqnt.exe
  C:\Windows\System\WqySqnt.exe
  2⤵
  PID:11780
- C:\Windows\System\nhdpcYf.exe
  C:\Windows\System\nhdpcYf.exe
  2⤵
  PID:11800
- C:\Windows\System\cHYcqen.exe
  C:\Windows\System\cHYcqen.exe
  2⤵
  PID:11824
- C:\Windows\System\mrXfnCX.exe
  C:\Windows\System\mrXfnCX.exe
  2⤵
  PID:11852
- C:\Windows\System\hXeQIfY.exe
  C:\Windows\System\hXeQIfY.exe
  2⤵
  PID:11888
- C:\Windows\System\qFUqfoz.exe
  C:\Windows\System\qFUqfoz.exe
  2⤵
  PID:11924
- C:\Windows\System\yKdwgAk.exe
  C:\Windows\System\yKdwgAk.exe
  2⤵
  PID:11952
- C:\Windows\System\gGJwEUR.exe
  C:\Windows\System\gGJwEUR.exe
  2⤵
  PID:11980
- C:\Windows\System\rKpyOZT.exe
  C:\Windows\System\rKpyOZT.exe
  2⤵
  PID:12012
- C:\Windows\System\lmVLctl.exe
  C:\Windows\System\lmVLctl.exe
  2⤵
  PID:12036
- C:\Windows\System\qYztNcE.exe
  C:\Windows\System\qYztNcE.exe
  2⤵
  PID:12068
- C:\Windows\System\PYYDeKL.exe
  C:\Windows\System\PYYDeKL.exe
  2⤵
  PID:12104
- C:\Windows\System\tZBKtTZ.exe
  C:\Windows\System\tZBKtTZ.exe
  2⤵
  PID:12132
- C:\Windows\System\HAnMAWL.exe
  C:\Windows\System\HAnMAWL.exe
  2⤵
  PID:12156
- C:\Windows\System\esVSNet.exe
  C:\Windows\System\esVSNet.exe
  2⤵
  PID:12184
- C:\Windows\System\KLGAPLM.exe
  C:\Windows\System\KLGAPLM.exe
  2⤵
  PID:12204
- C:\Windows\System\PWRYMXj.exe
  C:\Windows\System\PWRYMXj.exe
  2⤵
  PID:12240
- C:\Windows\System\bvVrWxk.exe
  C:\Windows\System\bvVrWxk.exe
  2⤵
  PID:12272
- C:\Windows\System\aJyIbwF.exe
  C:\Windows\System\aJyIbwF.exe
  2⤵
  PID:10744
- C:\Windows\System\PQNfxEE.exe
  C:\Windows\System\PQNfxEE.exe
  2⤵
  PID:11340
- C:\Windows\System\zosDlNT.exe
  C:\Windows\System\zosDlNT.exe
  2⤵
  PID:11400
- C:\Windows\System\eRWtKaF.exe
  C:\Windows\System\eRWtKaF.exe
  2⤵
  PID:11432
- C:\Windows\System\swNJcaq.exe
  C:\Windows\System\swNJcaq.exe
  2⤵
  PID:11532
- C:\Windows\System\RtGrWeT.exe
  C:\Windows\System\RtGrWeT.exe
  2⤵
  PID:11604
- C:\Windows\System\NAgVcML.exe
  C:\Windows\System\NAgVcML.exe
  2⤵
  PID:11652
- C:\Windows\System\TuGUEmC.exe
  C:\Windows\System\TuGUEmC.exe
  2⤵
  PID:11728
- C:\Windows\System\DpsFYIa.exe
  C:\Windows\System\DpsFYIa.exe
  2⤵
  PID:11768
- C:\Windows\System\pGmrrXS.exe
  C:\Windows\System\pGmrrXS.exe
  2⤵
  PID:11868
- C:\Windows\System\JofGSCJ.exe
  C:\Windows\System\JofGSCJ.exe
  2⤵
  PID:11900
- C:\Windows\System\VYtFLEx.exe
  C:\Windows\System\VYtFLEx.exe
  2⤵
  PID:11964
- C:\Windows\System\qyyJgLy.exe
  C:\Windows\System\qyyJgLy.exe
  2⤵
  PID:12024
- C:\Windows\System\phieCmT.exe
  C:\Windows\System\phieCmT.exe
  2⤵
  PID:12064
- C:\Windows\System\rVZcDrD.exe
  C:\Windows\System\rVZcDrD.exe
  2⤵
  PID:12116
- C:\Windows\System\ibwyKIn.exe
  C:\Windows\System\ibwyKIn.exe
  2⤵
  PID:12168
- C:\Windows\System\PalJHMh.exe
  C:\Windows\System\PalJHMh.exe
  2⤵
  PID:12268
- C:\Windows\System\tCIbhZJ.exe
  C:\Windows\System\tCIbhZJ.exe
  2⤵
  PID:11284
- C:\Windows\System\vLCZaeB.exe
  C:\Windows\System\vLCZaeB.exe
  2⤵
  PID:11448
- C:\Windows\System\FNnUMuM.exe
  C:\Windows\System\FNnUMuM.exe
  2⤵
  PID:11572
- C:\Windows\System\cwzUGkm.exe
  C:\Windows\System\cwzUGkm.exe
  2⤵
  PID:11748
- C:\Windows\System\XIQmZeo.exe
  C:\Windows\System\XIQmZeo.exe
  2⤵
  PID:11844
- C:\Windows\System\uPCDOmK.exe
  C:\Windows\System\uPCDOmK.exe
  2⤵
  PID:12004
- C:\Windows\System\gHFLWmh.exe
  C:\Windows\System\gHFLWmh.exe
  2⤵
  PID:12088
- C:\Windows\System\mRGdlxH.exe
  C:\Windows\System\mRGdlxH.exe
  2⤵
  PID:11472
- C:\Windows\System\zAlZyva.exe
  C:\Windows\System\zAlZyva.exe
  2⤵
  PID:12164
- C:\Windows\System\ckkraLq.exe
  C:\Windows\System\ckkraLq.exe
  2⤵
  PID:11940
- C:\Windows\System\KlmhYxY.exe
  C:\Windows\System\KlmhYxY.exe
  2⤵
  PID:12320
- C:\Windows\System\JzeEhwQ.exe
  C:\Windows\System\JzeEhwQ.exe
  2⤵
  PID:12352
- C:\Windows\System\hTzZYXQ.exe
  C:\Windows\System\hTzZYXQ.exe
  2⤵
  PID:12376
- C:\Windows\System\OhUtAsR.exe
  C:\Windows\System\OhUtAsR.exe
  2⤵
  PID:12404
- C:\Windows\System\wPhuUDs.exe
  C:\Windows\System\wPhuUDs.exe
  2⤵
  PID:12432
- C:\Windows\System\GMVGqPD.exe
  C:\Windows\System\GMVGqPD.exe
  2⤵
  PID:12448
- C:\Windows\System\ZZwBoIM.exe
  C:\Windows\System\ZZwBoIM.exe
  2⤵
  PID:12504
- C:\Windows\System\AgLKMHq.exe
  C:\Windows\System\AgLKMHq.exe
  2⤵
  PID:12520
- C:\Windows\System\DVcuiAV.exe
  C:\Windows\System\DVcuiAV.exe
  2⤵
  PID:12544
- C:\Windows\System\ksIVbRd.exe
  C:\Windows\System\ksIVbRd.exe
  2⤵
  PID:12564
- C:\Windows\System\PZZSAhN.exe
  C:\Windows\System\PZZSAhN.exe
  2⤵
  PID:12596
- C:\Windows\System\arhGWkM.exe
  C:\Windows\System\arhGWkM.exe
  2⤵
  PID:12632
- C:\Windows\System\ZDAjwMD.exe
  C:\Windows\System\ZDAjwMD.exe
  2⤵
  PID:12656
- C:\Windows\System\NFdmIpL.exe
  C:\Windows\System\NFdmIpL.exe
  2⤵
  PID:12680
- C:\Windows\System\uJUScEL.exe
  C:\Windows\System\uJUScEL.exe
  2⤵
  PID:12700
- C:\Windows\System\wwekIcZ.exe
  C:\Windows\System\wwekIcZ.exe
  2⤵
  PID:12720
- C:\Windows\System\PHZIeFr.exe
  C:\Windows\System\PHZIeFr.exe
  2⤵
  PID:12748
- C:\Windows\System\MIQIweW.exe
  C:\Windows\System\MIQIweW.exe
  2⤵
  PID:12772
- C:\Windows\System\yPhQuMl.exe
  C:\Windows\System\yPhQuMl.exe
  2⤵
  PID:12800
- C:\Windows\System\lOZNznV.exe
  C:\Windows\System\lOZNznV.exe
  2⤵
  PID:12856
- C:\Windows\System\xvPHSXO.exe
  C:\Windows\System\xvPHSXO.exe
  2⤵
  PID:12892
- C:\Windows\System\ntIHIHm.exe
  C:\Windows\System\ntIHIHm.exe
  2⤵
  PID:12920
- C:\Windows\System\hJKpGbH.exe
  C:\Windows\System\hJKpGbH.exe
  2⤵
  PID:12944
- C:\Windows\System\FLBAJQz.exe
  C:\Windows\System\FLBAJQz.exe
  2⤵
  PID:12972
- C:\Windows\System\HgykzsF.exe
  C:\Windows\System\HgykzsF.exe
  2⤵
  PID:12996
- C:\Windows\System\zOSzMBt.exe
  C:\Windows\System\zOSzMBt.exe
  2⤵
  PID:13032
- C:\Windows\System\JCwbVYq.exe
  C:\Windows\System\JCwbVYq.exe
  2⤵
  PID:13060
- C:\Windows\System\lRHIzgd.exe
  C:\Windows\System\lRHIzgd.exe
  2⤵
  PID:13088
- C:\Windows\System\UEAoZDW.exe
  C:\Windows\System\UEAoZDW.exe
  2⤵
  PID:13116
- C:\Windows\System\NRFlhpp.exe
  C:\Windows\System\NRFlhpp.exe
  2⤵
  PID:13156
- C:\Windows\System\JHrOuJu.exe
  C:\Windows\System\JHrOuJu.exe
  2⤵
  PID:13180
- C:\Windows\System\QSInCAp.exe
  C:\Windows\System\QSInCAp.exe
  2⤵
  PID:13200
- C:\Windows\System\JyAhKEs.exe
  C:\Windows\System\JyAhKEs.exe
  2⤵
  PID:13228
- C:\Windows\System\wrwgAKq.exe
  C:\Windows\System\wrwgAKq.exe
  2⤵
  PID:13268
- C:\Windows\System\WvlVMIZ.exe
  C:\Windows\System\WvlVMIZ.exe
  2⤵
  PID:13296
- C:\Windows\System\wWHPVQY.exe
  C:\Windows\System\wWHPVQY.exe
  2⤵
  PID:12296
- C:\Windows\System\HuiNVFt.exe
  C:\Windows\System\HuiNVFt.exe
  2⤵
  PID:12336
- C:\Windows\System\ZaWegGi.exe
  C:\Windows\System\ZaWegGi.exe
  2⤵
  PID:12416
- C:\Windows\System\jmqfxFB.exe
  C:\Windows\System\jmqfxFB.exe
  2⤵
  PID:12512
- C:\Windows\System\PlaFhbx.exe
  C:\Windows\System\PlaFhbx.exe
  2⤵
  PID:12540
- C:\Windows\System\yrzFvNu.exe
  C:\Windows\System\yrzFvNu.exe
  2⤵
  PID:12592
- C:\Windows\System\xaLtEeK.exe
  C:\Windows\System\xaLtEeK.exe
  2⤵
  PID:12708
- C:\Windows\System\TyWCKrI.exe
  C:\Windows\System\TyWCKrI.exe
  2⤵
  PID:12908
- C:\Windows\System\XIOwamY.exe
  C:\Windows\System\XIOwamY.exe
  2⤵
  PID:12904
- C:\Windows\System\ELPMGJH.exe
  C:\Windows\System\ELPMGJH.exe
  2⤵
  PID:12968
- C:\Windows\System\NMlfuco.exe
  C:\Windows\System\NMlfuco.exe
  2⤵
  PID:13048
- C:\Windows\System\mefSsqC.exe
  C:\Windows\System\mefSsqC.exe
  2⤵
  PID:13172
- C:\Windows\System\dVPPPNg.exe
  C:\Windows\System\dVPPPNg.exe
  2⤵
  PID:13260
- C:\Windows\System\NXPvdYa.exe
  C:\Windows\System\NXPvdYa.exe
  2⤵
  PID:12176
- C:\Windows\System\kGNvRNv.exe
  C:\Windows\System\kGNvRNv.exe
  2⤵
  PID:12388
- C:\Windows\System\eXzgDBM.exe
  C:\Windows\System\eXzgDBM.exe
  2⤵
  PID:3792
- C:\Windows\System\NkEBbnj.exe
  C:\Windows\System\NkEBbnj.exe
  2⤵
  PID:4304
- C:\Windows\System\HoZRVTk.exe
  C:\Windows\System\HoZRVTk.exe
  2⤵
  PID:12984
- C:\Windows\System\MdrhpAX.exe
  C:\Windows\System\MdrhpAX.exe
  2⤵
  PID:13128
- C:\Windows\System\RFAJCop.exe
  C:\Windows\System\RFAJCop.exe
  2⤵
  PID:12496
- C:\Windows\System\miCImKj.exe
  C:\Windows\System\miCImKj.exe
  2⤵
  PID:4896
- C:\Windows\System\iUNzkGQ.exe
  C:\Windows\System\iUNzkGQ.exe
  2⤵
  PID:12668
- C:\Windows\System\kTXAeNk.exe
  C:\Windows\System\kTXAeNk.exe
  2⤵
  PID:13332
- C:\Windows\System\gTHXfqH.exe
  C:\Windows\System\gTHXfqH.exe
  2⤵
  PID:13348
- C:\Windows\System\eXaxJPm.exe
  C:\Windows\System\eXaxJPm.exe
  2⤵
  PID:13384
- C:\Windows\System\DWOohSI.exe
  C:\Windows\System\DWOohSI.exe
  2⤵
  PID:13412
- C:\Windows\System\dhFzvyx.exe
  C:\Windows\System\dhFzvyx.exe
  2⤵
  PID:13444
- C:\Windows\System\tGXFuCu.exe
  C:\Windows\System\tGXFuCu.exe
  2⤵
  PID:13468
- C:\Windows\System\bYYWEeK.exe
  C:\Windows\System\bYYWEeK.exe
  2⤵
  PID:13492
- C:\Windows\System\uZhftdY.exe
  C:\Windows\System\uZhftdY.exe
  2⤵
  PID:13520
- C:\Windows\System\QbLJKXY.exe
  C:\Windows\System\QbLJKXY.exe
  2⤵
  PID:13556
- C:\Windows\System\DlQmHHB.exe
  C:\Windows\System\DlQmHHB.exe
  2⤵
  PID:13588
- C:\Windows\System\yxxORdO.exe
  C:\Windows\System\yxxORdO.exe
  2⤵
  PID:13652
- C:\Windows\System\DQQFnHK.exe
  C:\Windows\System\DQQFnHK.exe
  2⤵
  PID:13688
- C:\Windows\System\bTLcPcU.exe
  C:\Windows\System\bTLcPcU.exe
  2⤵
  PID:13728
- C:\Windows\System\XbDNGns.exe
  C:\Windows\System\XbDNGns.exe
  2⤵
  PID:13744
- C:\Windows\System\HyTtigU.exe
  C:\Windows\System\HyTtigU.exe
  2⤵
  PID:13784
- C:\Windows\System\rDhgkEv.exe
  C:\Windows\System\rDhgkEv.exe
  2⤵
  PID:13800
- C:\Windows\System\VtFKSVW.exe
  C:\Windows\System\VtFKSVW.exe
  2⤵
  PID:13832
- C:\Windows\System\hFJTZMn.exe
  C:\Windows\System\hFJTZMn.exe
  2⤵
  PID:13856
- C:\Windows\System\tQsUCyb.exe
  C:\Windows\System\tQsUCyb.exe
  2⤵
  PID:13876
- C:\Windows\System\zVCanci.exe
  C:\Windows\System\zVCanci.exe
  2⤵
  PID:13928
- C:\Windows\System\UFbGniX.exe
  C:\Windows\System\UFbGniX.exe
  2⤵
  PID:13944
- C:\Windows\System\KwBGljg.exe
  C:\Windows\System\KwBGljg.exe
  2⤵
  PID:13960
- C:\Windows\System\oVTbWEx.exe
  C:\Windows\System\oVTbWEx.exe
  2⤵
  PID:14012
- C:\Windows\System\hAvmAEI.exe
  C:\Windows\System\hAvmAEI.exe
  2⤵
  PID:14040
- C:\Windows\System\fVwBfed.exe
  C:\Windows\System\fVwBfed.exe
  2⤵
  PID:14060
- C:\Windows\System\tPxzSOq.exe
  C:\Windows\System\tPxzSOq.exe
  2⤵
  PID:14076
- C:\Windows\System\SggwAWt.exe
  C:\Windows\System\SggwAWt.exe
  2⤵
  PID:14100
- C:\Windows\System\UPDcBdz.exe
  C:\Windows\System\UPDcBdz.exe
  2⤵
  PID:14136
- C:\Windows\System\VCIrNyI.exe
  C:\Windows\System\VCIrNyI.exe
  2⤵
  PID:14176
- C:\Windows\System\yoMydkR.exe
  C:\Windows\System\yoMydkR.exe
  2⤵
  PID:14196
- C:\Windows\System\dvwkdXZ.exe
  C:\Windows\System\dvwkdXZ.exe
  2⤵
  PID:14220
- C:\Windows\System\MUVaFJb.exe
  C:\Windows\System\MUVaFJb.exe
  2⤵
  PID:14252
- C:\Windows\System\KfCsRpH.exe
  C:\Windows\System\KfCsRpH.exe
  2⤵
  PID:14276
- C:\Windows\System\yEECYhK.exe
  C:\Windows\System\yEECYhK.exe
  2⤵
  PID:14304
- C:\Windows\System\VaNxEjZ.exe
  C:\Windows\System\VaNxEjZ.exe
  2⤵
  PID:14328
- C:\Windows\System\NEzfeWw.exe
  C:\Windows\System\NEzfeWw.exe
  2⤵
  PID:13404
- C:\Windows\System\VNMdLEc.exe
  C:\Windows\System\VNMdLEc.exe
  2⤵
  PID:13504
- C:\Windows\System\yAxjiPX.exe
  C:\Windows\System\yAxjiPX.exe
  2⤵
  PID:13508
- C:\Windows\System\LdEQxrT.exe
  C:\Windows\System\LdEQxrT.exe
  2⤵
  PID:13680
- C:\Windows\System\CryOqzn.exe
  C:\Windows\System\CryOqzn.exe
  2⤵
  PID:13724
- C:\Windows\System\lQGgDSJ.exe
  C:\Windows\System\lQGgDSJ.exe
  2⤵
  PID:13768
- C:\Windows\System\xnBDufs.exe
  C:\Windows\System\xnBDufs.exe
  2⤵
  PID:13908
- C:\Windows\System\osUtnQu.exe
  C:\Windows\System\osUtnQu.exe
  2⤵
  PID:13972
- C:\Windows\System\lKddtIL.exe
  C:\Windows\System\lKddtIL.exe
  2⤵
  PID:14028
- C:\Windows\System\QDbBLtL.exe
  C:\Windows\System\QDbBLtL.exe
  2⤵
  PID:2260
- C:\Windows\System\qhmzoCv.exe
  C:\Windows\System\qhmzoCv.exe
  2⤵
  PID:14112
- C:\Windows\System\YRCxTmW.exe
  C:\Windows\System\YRCxTmW.exe
  2⤵
  PID:14188
- C:\Windows\System\zdJZelJ.exe
  C:\Windows\System\zdJZelJ.exe
  2⤵
  PID:14208
- C:\Windows\System\otMEXmo.exe
  C:\Windows\System\otMEXmo.exe
  2⤵
  PID:14292
- C:\Windows\System\BpHVBGQ.exe
  C:\Windows\System\BpHVBGQ.exe
  2⤵
  PID:13368
- C:\Windows\System\bazKpup.exe
  C:\Windows\System\bazKpup.exe
  2⤵
  PID:13704
- C:\Windows\System\KaDqfjp.exe
  C:\Windows\System\KaDqfjp.exe
  2⤵
  PID:13840
- C:\Windows\System\knvORyS.exe
  C:\Windows\System\knvORyS.exe
  2⤵
  PID:13988
- C:\Windows\System\ZnnbFmA.exe
  C:\Windows\System\ZnnbFmA.exe
  2⤵
  PID:14164
- C:\Windows\System\mmtNSBS.exe
  C:\Windows\System\mmtNSBS.exe
  2⤵
  PID:14272
- C:\Windows\System\ZCrGxlv.exe
  C:\Windows\System\ZCrGxlv.exe
  2⤵
  PID:14320
- C:\Windows\System\gwKUnLw.exe
  C:\Windows\System\gwKUnLw.exe
  2⤵
  PID:13772
- C:\Windows\System\ThaLmDJ.exe
  C:\Windows\System\ThaLmDJ.exe
  2⤵
  PID:13408
- C:\Windows\System\BwipgeM.exe
  C:\Windows\System\BwipgeM.exe
  2⤵
  PID:14216
- C:\Windows\System\hHFDvdZ.exe
  C:\Windows\System\hHFDvdZ.exe
  2⤵
  PID:14356
- C:\Windows\System\AXLJpWJ.exe
  C:\Windows\System\AXLJpWJ.exe
  2⤵
  PID:14372
- C:\Windows\System\jBsoXXJ.exe
  C:\Windows\System\jBsoXXJ.exe
  2⤵
  PID:14404
- C:\Windows\System\UAgFxQl.exe
  C:\Windows\System\UAgFxQl.exe
  2⤵
  PID:14428
- C:\Windows\System\XXQkPoI.exe
  C:\Windows\System\XXQkPoI.exe
  2⤵
  PID:14444
- C:\Windows\System\pTjSDdC.exe
  C:\Windows\System\pTjSDdC.exe
  2⤵
  PID:14484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CYDLMtr.exe

Filesize
1.9MB

MD5
49b7f4c01b1ded06e01da0a1fe43d85c

SHA1
93b3bf2a87bd92559c9c0c0c952a8531f0ad607a

SHA256
74a5b623c9cd968769471f0249caaa2de99ecd0382c07bcd9c407ac1e1ba5f3e

SHA512
a237460d74af1932140274f483ef145157e2f0871568d4a6d146ba6fe349491771f0eb28efdda4fff95ad8ace67b626630ca49c9be8f130b902f9506ddc05d04

Download Submit
C:\Windows\System\ElDzzVS.exe

Filesize
1.9MB

MD5
a13264b409650c2e7822be5ff93533ee

SHA1
ba3612dacf60bbf5c877e88cd4bbe36992e351f7

SHA256
cf087dd29aa6a67f796b832d670d285729868e05514c13a7977d21b0d34899e5

SHA512
f22212e5ad91dea677463804c8e4002fcaf01b7e42e454bdad0f2b892145a46e417c2427b41806c20be64d2ccf934d1351409968cce39145eec8873ac0a53caa

Download Submit
C:\Windows\System\GLDyEyJ.exe

Filesize
1.9MB

MD5
0c8fefbf1fccb4789adcfa9a7f3f17c8

SHA1
72c2afe99c1e9b8211ca9a498987fb796f1d11b9

SHA256
2605f4428220c0db8423f73b9f0b564ee144f566bed5c788b507b1ca5a9c2750

SHA512
7a2870a20338b2c1d9bfec7ebdf0bd59cefabde5954ff6c93020d7ec31a2306e078edb9ea58bd6c7bd26271ea8c4bf2a317a6a196755c316df594d59197f3ab7

Download Submit
C:\Windows\System\HTAFECX.exe

Filesize
1.9MB

MD5
691631b09bda807cc4d09a66589e6c93

SHA1
cf89c06eb6feb615db23dc7f2e1c2e54988542ed

SHA256
db1da8630a1f99480c76f8c0dfb3d01189093b71959089472d6865ea15d151cf

SHA512
11a9b32b3b9a6ac3f7b3ef40d9120c847378e9ac575a1749ceba33e5eba1411421d83208a1ed11ac1dceead867d1d084244d92813752c29c8c262ae1cc49e2b8

Download Submit
C:\Windows\System\IbyCCPw.exe

Filesize
1.9MB

MD5
e09747e1e0efb3f3e6b4f2488bfe7c4e

SHA1
962384f3931b13c01e773271cec17d3165219230

SHA256
e6f67742dbb3db34099b7be26306616b91a86fba3f9763248f5ba6368ed45bf7

SHA512
f5e425670e27776851cd1359e8b10532ba4f949fda978cd77a0d8f1efcd5dcc9bd616bbf133aa23bab83a054e568d493c240e602d747802e06713d107b1502d4

Download Submit
C:\Windows\System\JNGhHcA.exe

Filesize
1.9MB

MD5
9f0f1b87bbe6e049466fe72403e3c4a9

SHA1
67ddf0ee3d766e7d55b4526a697b074f179bd11d

SHA256
ceb5042cb2b65fedca829789560fd3db12fea84236fd726077dc9931629dda8d

SHA512
3eac965d63cbc2138ae9789d04896d7f9e94a01c30c29380348efe9d5cc1674d8e3c44e9734e0305e7bff848e5c9c6104cc2bdeac1ab590eec289d96e3887302

Download Submit
C:\Windows\System\JQHzznC.exe

Filesize
1.9MB

MD5
e08605df9a2e7b7fee4ea0aebf907676

SHA1
7fdd6deef5f225f91f134ec7372f4faf15d6f6cf

SHA256
7facfbe4e8db8736c1424e4246c63ab0d871772075a9316416d999bd28a4ac0d

SHA512
0b13e51c6aaed643064bcb0085f7ee7c63cc76aaac4c7055c46bf138ee207251f2891639d2274f5b93ab74a54d1eaa4576959bd0f5857ac4f91eda7dd668cb6a

Download Submit
C:\Windows\System\JrXlsBS.exe

Filesize
1.9MB

MD5
164121942c57007306513ce8db812723

SHA1
ef6770d11fe5b61b3e902580dfa56d5893eccad0

SHA256
5729beb75f90835d4bd742461fc0fceb2e2c85ab29d72bbca3188153729e719e

SHA512
836ffda9340299b8ec086d9bb14aeba619ff5f5dc8c6f0c13a9b8fbbf14d34d2e631bd532955be6ea80113ce8cb2a2b1b3ce4598a79522010f0a19b18e060b07

Download Submit
C:\Windows\System\LiFpHEp.exe

Filesize
1.9MB

MD5
2f55175a59e01eeac4851738e7930d65

SHA1
c46c27dd58cbf29b8f0ef6e4d2167c8865a3a847

SHA256
caaf1e0c4809d834d826e96cafe602ee16e7108facb75b70688fd254563e26f1

SHA512
4e74a7eba96b6fba52fc9cff85046ca815716d76211103ddf45cc392517f14f97ede41fc733e0fffb45213dad84e60face0b01d2fe97e56765a2104fac418295

Download Submit
C:\Windows\System\MenQzzp.exe

Filesize
1.9MB

MD5
8665bacc90eb2102d5e6b23ba104dbdb

SHA1
4bb3cbc5d5473b5364f7f9394b42f880f546faa6

SHA256
d6e9a33234ea0cdeb798ca1165d64390106b6b8776bda153687079e522e94991

SHA512
2c4447f288979f46e330a361539d2a84552123c4076fbad001157e33bcedbe4e978e3bae251d3b757eaaa0e29f03c031c6d017a7143b0ed2e56478c0b9e4be19

Download Submit
C:\Windows\System\PbyyxQH.exe

Filesize
1.9MB

MD5
348bf85f4ab10a2dc0a31a36f7356bd9

SHA1
2fb3a9a2328af465e9202e3f3cfb6165bc835032

SHA256
112401cbb409a0c06340f02b83b21bb464a4ac4bbe9b61ad47f36f7b60290aeb

SHA512
2351596b78f61985329d8c6879280d253361f86d51217141e05664bb156469b305097daf7abe455a7450c4dbb76dbbd4f929d096fa8deff447e88e71bedef152

Download Submit
C:\Windows\System\UwLsXLo.exe

Filesize
1.9MB

MD5
5aa3be719abfea59461168ac82ce2472

SHA1
a387081ef83e15cc659736f653b97f05f34d2600

SHA256
b1c1dde33a68068ac1d5d52717845222df2702bde53ad67759f59c30fd2bd19d

SHA512
2510c894d94d36101a5b5f090fc11312b388bbe8d605ea2c5d11b0698afa9711087a4f8e9eef464c121104a2d7d3ad2203a8250fe4115f8f68fa9c47cfbfffa2

Download Submit
C:\Windows\System\VCOejdr.exe

Filesize
1.9MB

MD5
5c5224b6ee8085711d98d6faeda432b3

SHA1
4da6bf256576132afda6e5dbe0fffceba2f96163

SHA256
e349ff2356d1f099f47812f8e4f4c368c3e1409a2c0fcafdcfd44e01dcb4f8bf

SHA512
6ae7fafb611d8e5eb9c71f5b6c963eb933cf35328643c97f3f43b07db6816b716d1c6a74e6e1333fd6fb793564e6b4eb564b78f90e4995a6f53e452084a3fba5

Download Submit
C:\Windows\System\XLZYhcd.exe

Filesize
1.9MB

MD5
cd97a6725c603ad2c0c689ff18b4887d

SHA1
cae0690e75f22d03f65e318b9082b65924b5bf8e

SHA256
68d559f1338a684b90eafdf7a6047a737b3b71445ccff6d74122ab5f88ece353

SHA512
36c1667be273abca8bf4ceede12e14657ec2253fbf6bc7d45b52ad8717e57cbcfd307e2ebc75cb2005e110d7abb43315d20c605055c9115284a92a9238158ae4

Download Submit
C:\Windows\System\YoOaXit.exe

Filesize
1.9MB

MD5
744ba65e4e2abac73d267bb6074714dd

SHA1
af806eef76996ae3fb6c7abe8fcdada5444b23a3

SHA256
4a7fab369b5492ce11af7bbb9f73be4d2b1d9a24ff5ecb455160e5744417c2f4

SHA512
e7db36c9403da53b0cbc8086bd7a15578922760016c31fd47753b847bdb70aa897f190415b38bd118ef38f30e8a5945308ed5b9edb0ab9ff308d8ed8426051e5

Download Submit
C:\Windows\System\aSfyqDk.exe

Filesize
1.9MB

MD5
9f896104eba4457dd377142faf1debc7

SHA1
efcf02b78ddcfd004ffed47b7d542de18af3949c

SHA256
2b49bad85b9f62d261a093e76b926fc36df60e163a75bcf21de7019a7b2f6724

SHA512
9bf9df7385fefc4e5842a794ae19082eafe392839ecbc1e8c3e3a64edcb57b5b7178ca67845c6e3900378d2175d78ab11fee2a7c84b8162cf90865364235424d

Download Submit
C:\Windows\System\acEgjfs.exe

Filesize
1.9MB

MD5
ff6ea7f8d7ee86e3d97660e0939e0f50

SHA1
a31cd6db2173190d85a94b688ac0516ffffb843e

SHA256
54d71b2477b629cb42d04040b1e76bf2a40c1fc9ef2d973fba6b7bc04e1b8f23

SHA512
11b4cfc200a013bdf6cac9916fb4faacdd8e3cd356ff33cde3c59321bd25049fbe1ebcf4569b7c119d47cd3f2c78aa01b161c423ce7f357973f0564145fde5b1

Download Submit
C:\Windows\System\blhEFbX.exe

Filesize
1.9MB

MD5
18ea0601db2222557c23a9e331da7f7a

SHA1
1f551d8a34e395273dcdf1aa684f2ac9c1ee0272

SHA256
64e6288ee8b60a57b6e3b0a34edd4b0699f0f16e5155bb37a5f137340f6ca384

SHA512
ff9888a2d86ce8c60a57b5c9c2bb4c85978479338fc00fba6e4f95ae0f4974f9c1f68757401bb545de0728dbbb565daecdae8e870d1ddf4f111b8e1e4fe83cc6

Download Submit
C:\Windows\System\dBPehmp.exe

Filesize
1.9MB

MD5
8831537ae1a1fd7891d5577a2d260e5d

SHA1
642b08009a3a91503ca2dd06692c3980a8ba84c3

SHA256
74c81e8ebef368636be9d8baa4403fdcb585f4e78a0c7d5d4a351d7c196a3aaa

SHA512
fbc40f316e3c8bee5bbf7774c0a30874343c40dbd4cbe7c38e5e8ef3611bce177a91761363a15b1c511a559a9affdd458945b2627e2478f1ce2b8b5bd3cb9a1e

Download Submit
C:\Windows\System\gZEPQYc.exe

Filesize
1.9MB

MD5
4e6d76b8fc980960ad5a46795d4f2e40

SHA1
0e95aff4e9daa2657e866b79f22eead9afb6c2e5

SHA256
ea82a53efe7771d166c0e8bb2b5b336280cd06ee2c9094c0112b85878fda75fa

SHA512
6a0235d42c9d9045d0a9d6b81f65f962866301e34b655a43fbac2d66ee560fb5499379687f5caaf7e9cb05ecee0f6f4719080e0880220c38a2baaf725602af1f

Download Submit
C:\Windows\System\kPvFmsD.exe

Filesize
1.9MB

MD5
ac7249c41e42877b65dc568ee5f56498

SHA1
4ae54617119379e97f30f2031135b7731c01523a

SHA256
22e2513b55e6e1ddd083305f7e09f4c604b5ead091c2770be88a92d18a094d31

SHA512
3a7e84ed9d702366784704aaaf2a1f957c4112e7cdadc4ec2ed1e172d2515450c10e844e6ebc6f73e44b38ad36f20dbd8c1e283ecf41d21426ce67b5ebb5db68

Download Submit
C:\Windows\System\kTnZGGW.exe

Filesize
1.9MB

MD5
a7ee19197c09ba2192b50ef583b93eb3

SHA1
e9dc6f5338a5bec52654f78187811369ddffa75d

SHA256
b4c80130e8dbf7b37342221edc9bc7addf8f3eaf6221c5cb20fc6572e99809ba

SHA512
1ea068ccc20a1f8adac3f888d74b879519999ddf494c3f4df4199b838acefcb66f5b4ce1607517e14f94f0d8ace5e42fc26d323dc4802143cfe210be8fa95a8d

Download Submit
C:\Windows\System\lxMaJoo.exe

Filesize
1.9MB

MD5
2ada6f1742177dc55f68b516ca547165

SHA1
ef4a83f47cb430453d5e02964c747a93929bf82b

SHA256
6f814661eba17195b7d99790c8d958f39aa9daa9783772df887d31ad377875a4

SHA512
4614cc915e6209412e6421896cde7e0b068b6c5011769aba13e0345f0ce9f4141fe3bbf8e6f880586c97107e1542bc82077f109bb7a058d7a38c7631dae16cfc

Download Submit
C:\Windows\System\mYWhkOW.exe

Filesize
1.9MB

MD5
76ae06fea58ecc9d6866b05185c20a82

SHA1
f08b0bf1a2b6ac6f0e695f2ca9a23498e26c997d

SHA256
acd48f63c4468bd56c8287338025fc8886c7d6c24de96275bc84c292ee0e525b

SHA512
4f8e73aa4c55795f24be70bb2193728548285f7e4c25b1a6a0b8d61ad8df68fdb83cbe43f7f20a6eaed66ef890529dbee87548c0658dd4a4b9617d575e350ceb

Download Submit
C:\Windows\System\mjxZEsS.exe

Filesize
1.9MB

MD5
44dd15985dd9204d393c44a2406bce60

SHA1
37416c0d2c487c99c2c72dcec2ff844e6a2d4c06

SHA256
37a0c6d77df6cf1b24680549ccdf97014bae039ee8d0d68cf17650fe65831335

SHA512
faca8d82840efd9c242320e8398ea4929dae2830673ff63361a814fb1b83a379093c6b4d5abecc8a52c69126ffa6c08f57b3c998a5e781479c8175d696751c9d

Download Submit
C:\Windows\System\oGKtdAx.exe

Filesize
1.9MB

MD5
16979a6eb8e64cb7b21dfcc1d9271ff5

SHA1
c2053f3c136ccc775d33c30e9c683d0ed7bb0bbc

SHA256
fa70a0669a07ba5527c27e88b57176975669faafda52fce1b1528b452de45ded

SHA512
091aff48a65fc289097f145eaa5d8f58ed69f792c735f31136ee8a933929deb03b27688fc04507a0e6a61d2af3cde761795729b9e5164ed920b8458295bdb81b

Download Submit
C:\Windows\System\oZcmXHO.exe

Filesize
1.9MB

MD5
76eeee328c7bc1dcc364036587164deb

SHA1
48d7337752cad0da986d182595d6e502fdf7b2bc

SHA256
110dbc799b265ee3bb2df733e7d434db17063e212b13302e640af53af3b19110

SHA512
d57be303cc66fd285696516cd20a3979b496e85a1a4340aa7c39d61c6fb6c16400521ce68964c14cd28a44c10ee43f21269ad73a0d7d43145847f7f2fbcdf16b

Download Submit
C:\Windows\System\pPhWOnq.exe

Filesize
1.9MB

MD5
e78c31f889e0f581796e848852755d76

SHA1
295cab37bea731e21080ba7e90af67d40de90f81

SHA256
a126c30b1604c728a328cc077c09971b50aa500a0aa851d8eb49c820ff7cf7a8

SHA512
237acbbf51047ef74ff314c8dc8cf86925efe471add33ebc3a731b16eb7db8e943154e411cca31bdf15c3c55240f886fa44811be23cb57c39ac65e181c34d2e2

Download Submit
C:\Windows\System\sZPvNti.exe

Filesize
1.9MB

MD5
248c0a119d20135d825409111d017979

SHA1
28d68434ccdd29054ea1fee61d0bfcc1dcacaef0

SHA256
ef982443669b73e34d5270695fdeed5a76e076344fc96eea7fc56e04022af5a7

SHA512
826b4c225c014895598d769af866c7b8d86540f254ee6c6cfd8d7d09a13dec8306617c50b94a3ac9b29dd7d87718456644be48b5300d6588a485801d2121a56c

Download Submit
C:\Windows\System\twGTeHp.exe

Filesize
1.9MB

MD5
93278569deb0fc0362314930672559d7

SHA1
2d7d0d5ec06c5871718bf3a562d26fe9dd29f274

SHA256
542f4663e1346a13bc743af30e6376570c450d098a8768db2be9e15aa08439a1

SHA512
256a0ed41be4a5f9c046373bef1939470530c775386b44c0bc43cb349a5c9abe4838d34d90190ee0411f817814a4ab1cd7e504c1cfa8983d207cb613b41ccdb5

Download Submit
C:\Windows\System\uLttFXc.exe

Filesize
1.9MB

MD5
0c02b7af9c0264421068515c8818994b

SHA1
1cf167bc09e241e9693b1f8529d59e99bf32901c

SHA256
bc2a7ab9a7d90190f6828fd7727739ecab67e76ee962e5006291875c43500492

SHA512
35eaebd561abdedf948edceef03e57c0a0827dfc87847a58d9b62b627374082999839301e9035ae2471be64bab7551c1a970f46439795bc899b0eccc7e71c8e8

Download Submit
C:\Windows\System\vFMEEGz.exe

Filesize
1.9MB

MD5
7e3a23d4cf7a314e5f80a41e5142c56e

SHA1
8107b2d80c58a60d7e11bc05260f97b2e10de37b

SHA256
109ceeaf15b1ba85b7a8d07a6b08d36b707425a0e9ba3e5670826e1d9a462f44

SHA512
d2d752f5090b605a044d0eebb0a7b6f90931e25d84747685201e815b4b8ba550edd261f4954c4cac3b6662bb8e61105994f8b2e946bc9eeaa2c0dfba9504f352

Download Submit
C:\Windows\System\ztwCWxm.exe

Filesize
1.9MB

MD5
3b397c3066c9de22e8cef2ed2ace127f

SHA1
0034ce167aae2316221ea788243c515502e2dc78

SHA256
822ee90bab73d12d6524be2ac251111413d474d0ad68c6709058591bbab2ccd6

SHA512
86b1a86115dae65ee65a8d1f81b6ef8ce6571348f60160c4e1ad1de47783096acf1161a7e4ea83bd40321bf419b2c2588089350850b7acfb5bae301784dcf69c

Download Submit
memory/372-755-0x00007FF6E2FB0000-0x00007FF6E3304000-memory.dmp

Filesize
3.3MB

Download
memory/372-2167-0x00007FF6E2FB0000-0x00007FF6E3304000-memory.dmp

Filesize
3.3MB

Download
memory/396-703-0x00007FF727DE0000-0x00007FF728134000-memory.dmp

Filesize
3.3MB

Download
memory/396-2179-0x00007FF727DE0000-0x00007FF728134000-memory.dmp

Filesize
3.3MB

Download
memory/540-2183-0x00007FF678910000-0x00007FF678C64000-memory.dmp

Filesize
3.3MB

Download
memory/540-2155-0x00007FF678910000-0x00007FF678C64000-memory.dmp

Filesize
3.3MB

Download
memory/540-699-0x00007FF678910000-0x00007FF678C64000-memory.dmp

Filesize
3.3MB

Download
memory/676-2173-0x00007FF6E2470000-0x00007FF6E27C4000-memory.dmp

Filesize
3.3MB

Download
memory/676-732-0x00007FF6E2470000-0x00007FF6E27C4000-memory.dmp

Filesize
3.3MB

Download
memory/760-775-0x00007FF7661C0000-0x00007FF766514000-memory.dmp

Filesize
3.3MB

Download
memory/760-2178-0x00007FF7661C0000-0x00007FF766514000-memory.dmp

Filesize
3.3MB

Download
memory/852-2171-0x00007FF66D370000-0x00007FF66D6C4000-memory.dmp

Filesize
3.3MB

Download
memory/852-740-0x00007FF66D370000-0x00007FF66D6C4000-memory.dmp

Filesize
3.3MB

Download
memory/912-2166-0x00007FF6934E0000-0x00007FF693834000-memory.dmp

Filesize
3.3MB

Download
memory/912-764-0x00007FF6934E0000-0x00007FF693834000-memory.dmp

Filesize
3.3MB

Download
memory/1204-2159-0x00007FF7E5830000-0x00007FF7E5B84000-memory.dmp

Filesize
3.3MB

Download
memory/1204-49-0x00007FF7E5830000-0x00007FF7E5B84000-memory.dmp

Filesize
3.3MB

Download
memory/1252-748-0x00007FF7158E0000-0x00007FF715C34000-memory.dmp

Filesize
3.3MB

Download
memory/1252-2170-0x00007FF7158E0000-0x00007FF715C34000-memory.dmp

Filesize
3.3MB

Download
memory/1420-14-0x00007FF62B3E0000-0x00007FF62B734000-memory.dmp

Filesize
3.3MB

Download
memory/1420-2157-0x00007FF62B3E0000-0x00007FF62B734000-memory.dmp

Filesize
3.3MB

Download
memory/1688-712-0x00007FF774F90000-0x00007FF7752E4000-memory.dmp

Filesize
3.3MB

Download
memory/1688-2176-0x00007FF774F90000-0x00007FF7752E4000-memory.dmp

Filesize
3.3MB

Download
memory/1828-0-0x00007FF6E7E20000-0x00007FF6E8174000-memory.dmp

Filesize
3.3MB

Download
memory/1828-1-0x000001C4969B0000-0x000001C4969C0000-memory.dmp

Filesize
64KB

Download
memory/2128-731-0x00007FF7CBFA0000-0x00007FF7CC2F4000-memory.dmp

Filesize
3.3MB

Download
memory/2128-2172-0x00007FF7CBFA0000-0x00007FF7CC2F4000-memory.dmp

Filesize
3.3MB

Download
memory/2144-2160-0x00007FF6993F0000-0x00007FF699744000-memory.dmp

Filesize
3.3MB

Download
memory/2144-38-0x00007FF6993F0000-0x00007FF699744000-memory.dmp

Filesize
3.3MB

Download
memory/2144-2154-0x00007FF6993F0000-0x00007FF699744000-memory.dmp

Filesize
3.3MB

Download
memory/2220-719-0x00007FF7290B0000-0x00007FF729404000-memory.dmp

Filesize
3.3MB

Download
memory/2220-2165-0x00007FF7290B0000-0x00007FF729404000-memory.dmp

Filesize
3.3MB

Download
memory/2256-2168-0x00007FF676DC0000-0x00007FF677114000-memory.dmp

Filesize
3.3MB

Download
memory/2256-758-0x00007FF676DC0000-0x00007FF677114000-memory.dmp

Filesize
3.3MB

Download
memory/2628-2162-0x00007FF7DDC00000-0x00007FF7DDF54000-memory.dmp

Filesize
3.3MB

Download
memory/2628-67-0x00007FF7DDC00000-0x00007FF7DDF54000-memory.dmp

Filesize
3.3MB

Download
memory/3200-57-0x00007FF67C470000-0x00007FF67C7C4000-memory.dmp

Filesize
3.3MB

Download
memory/3200-2161-0x00007FF67C470000-0x00007FF67C7C4000-memory.dmp

Filesize
3.3MB

Download
memory/3228-702-0x00007FF7A97E0000-0x00007FF7A9B34000-memory.dmp

Filesize
3.3MB

Download
memory/3228-2180-0x00007FF7A97E0000-0x00007FF7A9B34000-memory.dmp

Filesize
3.3MB

Download
memory/3468-760-0x00007FF653BF0000-0x00007FF653F44000-memory.dmp

Filesize
3.3MB

Download
memory/3468-2184-0x00007FF653BF0000-0x00007FF653F44000-memory.dmp

Filesize
3.3MB

Download
memory/3896-749-0x00007FF764E70000-0x00007FF7651C4000-memory.dmp

Filesize
3.3MB

Download
memory/3896-2169-0x00007FF764E70000-0x00007FF7651C4000-memory.dmp

Filesize
3.3MB

Download
memory/3992-2175-0x00007FF7C7A90000-0x00007FF7C7DE4000-memory.dmp

Filesize
3.3MB

Download
memory/3992-708-0x00007FF7C7A90000-0x00007FF7C7DE4000-memory.dmp

Filesize
3.3MB

Download
memory/4200-2164-0x00007FF7CE5C0000-0x00007FF7CE914000-memory.dmp

Filesize
3.3MB

Download
memory/4200-743-0x00007FF7CE5C0000-0x00007FF7CE914000-memory.dmp

Filesize
3.3MB

Download
memory/4404-704-0x00007FF772CF0000-0x00007FF773044000-memory.dmp

Filesize
3.3MB

Download
memory/4404-2177-0x00007FF772CF0000-0x00007FF773044000-memory.dmp

Filesize
3.3MB

Download
memory/4508-2174-0x00007FF677950000-0x00007FF677CA4000-memory.dmp

Filesize
3.3MB

Download
memory/4508-715-0x00007FF677950000-0x00007FF677CA4000-memory.dmp

Filesize
3.3MB

Download
memory/4528-2156-0x00007FF6AAF90000-0x00007FF6AB2E4000-memory.dmp

Filesize
3.3MB

Download
memory/4528-11-0x00007FF6AAF90000-0x00007FF6AB2E4000-memory.dmp

Filesize
3.3MB

Download
memory/4600-2163-0x00007FF64FDE0000-0x00007FF650134000-memory.dmp

Filesize
3.3MB

Download
memory/4600-769-0x00007FF64FDE0000-0x00007FF650134000-memory.dmp

Filesize
3.3MB

Download
memory/4664-701-0x00007FF738CB0000-0x00007FF739004000-memory.dmp

Filesize
3.3MB

Download
memory/4664-2181-0x00007FF738CB0000-0x00007FF739004000-memory.dmp

Filesize
3.3MB

Download
memory/4948-25-0x00007FF794660000-0x00007FF7949B4000-memory.dmp

Filesize
3.3MB

Download
memory/4948-2158-0x00007FF794660000-0x00007FF7949B4000-memory.dmp

Filesize
3.3MB

Download
memory/5060-700-0x00007FF629290000-0x00007FF6295E4000-memory.dmp

Filesize
3.3MB

Download
memory/5060-2182-0x00007FF629290000-0x00007FF6295E4000-memory.dmp

Filesize
3.3MB

Download