xmrig | 9893b7d2b49e9ea0c32ec035cdd7d3d587d0897fc753e8f5fb8e18cb7a871873

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
Size

2.2MB
MD5

3b94f11c9386193290c5c75968875cf0
SHA1

520e6553e1d6d70fcd135088d0738e9c3612bb11
SHA256

9893b7d2b49e9ea0c32ec035cdd7d3d587d0897fc753e8f5fb8e18cb7a871873
SHA512

bac15003704ceb66fb05cfea261a5e6d079aac3bd61d5310752c6f8393980910a3676b6ceddf0345b00202148ca8549f8a5cfca359c602b43db654c565a9370e
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQwNGyX687xWHMTnj:BemTLkNdfE0pZrQS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3640-0-0x00007FF6712B0000-0x00007FF671604000-memory.dmp	xmrig
behavioral2/files/0x0008000000023429-8.dat	xmrig
behavioral2/files/0x000700000002342d-10.dat	xmrig
behavioral2/files/0x000700000002342f-18.dat	xmrig
behavioral2/files/0x0007000000023430-27.dat	xmrig
behavioral2/files/0x0007000000023431-31.dat	xmrig
behavioral2/files/0x0007000000023433-48.dat	xmrig
behavioral2/files/0x0007000000023434-52.dat	xmrig
behavioral2/files/0x0007000000023439-78.dat	xmrig
behavioral2/files/0x000700000002343b-88.dat	xmrig
behavioral2/files/0x000700000002343d-98.dat	xmrig
behavioral2/files/0x0007000000023445-138.dat	xmrig
behavioral2/files/0x000700000002344a-165.dat	xmrig
behavioral2/memory/5020-501-0x00007FF6D3180000-0x00007FF6D34D4000-memory.dmp	xmrig
behavioral2/memory/4972-497-0x00007FF60DC80000-0x00007FF60DFD4000-memory.dmp	xmrig
behavioral2/memory/4704-515-0x00007FF6BDE60000-0x00007FF6BE1B4000-memory.dmp	xmrig
behavioral2/memory/2068-518-0x00007FF78D960000-0x00007FF78DCB4000-memory.dmp	xmrig
behavioral2/memory/4368-526-0x00007FF621340000-0x00007FF621694000-memory.dmp	xmrig
behavioral2/memory/4920-528-0x00007FF64ACA0000-0x00007FF64AFF4000-memory.dmp	xmrig
behavioral2/memory/1420-530-0x00007FF63D370000-0x00007FF63D6C4000-memory.dmp	xmrig
behavioral2/memory/5076-529-0x00007FF680980000-0x00007FF680CD4000-memory.dmp	xmrig
behavioral2/memory/3276-531-0x00007FF762FB0000-0x00007FF763304000-memory.dmp	xmrig
behavioral2/memory/4352-532-0x00007FF63ADC0000-0x00007FF63B114000-memory.dmp	xmrig
behavioral2/memory/4348-533-0x00007FF6CF940000-0x00007FF6CFC94000-memory.dmp	xmrig
behavioral2/memory/4824-534-0x00007FF7C1F50000-0x00007FF7C22A4000-memory.dmp	xmrig
behavioral2/memory/4772-527-0x00007FF613D60000-0x00007FF6140B4000-memory.dmp	xmrig
behavioral2/memory/448-536-0x00007FF76D4A0000-0x00007FF76D7F4000-memory.dmp	xmrig
behavioral2/memory/1912-535-0x00007FF670110000-0x00007FF670464000-memory.dmp	xmrig
behavioral2/memory/4648-538-0x00007FF691550000-0x00007FF6918A4000-memory.dmp	xmrig
behavioral2/memory/2508-537-0x00007FF76C770000-0x00007FF76CAC4000-memory.dmp	xmrig
behavioral2/memory/2864-539-0x00007FF6EB080000-0x00007FF6EB3D4000-memory.dmp	xmrig
behavioral2/memory/4596-513-0x00007FF6A1E10000-0x00007FF6A2164000-memory.dmp	xmrig
behavioral2/memory/2884-554-0x00007FF7E94B0000-0x00007FF7E9804000-memory.dmp	xmrig
behavioral2/memory/436-557-0x00007FF6F2A50000-0x00007FF6F2DA4000-memory.dmp	xmrig
behavioral2/memory/4656-553-0x00007FF777CB0000-0x00007FF778004000-memory.dmp	xmrig
behavioral2/memory/4280-549-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp	xmrig
behavioral2/memory/4916-510-0x00007FF6BFDD0000-0x00007FF6C0124000-memory.dmp	xmrig
behavioral2/memory/3888-507-0x00007FF722B10000-0x00007FF722E64000-memory.dmp	xmrig
behavioral2/files/0x000700000002344c-167.dat	xmrig
behavioral2/files/0x000700000002344b-162.dat	xmrig
behavioral2/files/0x0007000000023449-158.dat	xmrig
behavioral2/files/0x0007000000023448-153.dat	xmrig
behavioral2/files/0x0007000000023447-148.dat	xmrig
behavioral2/files/0x0007000000023446-143.dat	xmrig
behavioral2/files/0x0007000000023444-133.dat	xmrig
behavioral2/files/0x0007000000023443-128.dat	xmrig
behavioral2/files/0x0007000000023442-122.dat	xmrig
behavioral2/files/0x0007000000023441-118.dat	xmrig
behavioral2/files/0x0007000000023440-113.dat	xmrig
behavioral2/files/0x000700000002343f-108.dat	xmrig
behavioral2/files/0x000700000002343e-102.dat	xmrig
behavioral2/files/0x000700000002343c-93.dat	xmrig
behavioral2/files/0x000700000002343a-82.dat	xmrig
behavioral2/files/0x0007000000023438-73.dat	xmrig
behavioral2/files/0x0007000000023437-68.dat	xmrig
behavioral2/files/0x0007000000023436-62.dat	xmrig
behavioral2/files/0x0007000000023435-58.dat	xmrig
behavioral2/files/0x0007000000023432-40.dat	xmrig
behavioral2/memory/2588-32-0x00007FF6F50C0000-0x00007FF6F5414000-memory.dmp	xmrig
behavioral2/memory/2992-28-0x00007FF6D9F40000-0x00007FF6DA294000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-22.dat	xmrig
behavioral2/memory/2492-15-0x00007FF6B7030000-0x00007FF6B7384000-memory.dmp	xmrig
behavioral2/memory/1836-11-0x00007FF6D5E20000-0x00007FF6D6174000-memory.dmp	xmrig
behavioral2/memory/2492-2084-0x00007FF6B7030000-0x00007FF6B7384000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1836	tOxWtDh.exe
2492	mRJNFoi.exe
2992	dCrxQGA.exe
4972	SuaVHfe.exe
2588	Tcodida.exe
5020	QrELjUE.exe
436	lqLGcDH.exe
3888	URcqxuM.exe
4916	tKjzsVk.exe
4596	pbpNowA.exe
4704	pkhisHW.exe
2068	zWhwPGw.exe
4368	TsQMJJu.exe
4772	wbEExJS.exe
4920	fqlsaNM.exe
5076	LDkeqzd.exe
1420	CbtPozW.exe
3276	RUDNCTP.exe
4352	uJOnVEb.exe
4348	NjXkUEe.exe
4824	AaQKkjT.exe
1912	latoxhd.exe
448	KNvBwmI.exe
2508	AOBeBvc.exe
4648	DayWvtO.exe
2864	oiUGAEQ.exe
4280	EnVygDi.exe
4656	wFjIWHl.exe
2884	TlUKFDI.exe
2548	fyLhFSz.exe
4784	OaQMDWI.exe
3492	FiBxSSt.exe
5060	JCYmMMP.exe
1880	haJCtCT.exe
3652	GMVJDTY.exe
4080	QxLpgEK.exe
2016	rTOWWVZ.exe
4068	zWRHgYN.exe
3244	NbYtqnF.exe
2288	qVGuNfb.exe
1820	WcGbvIR.exe
3080	AqQoPls.exe
2416	eVJkeZs.exe
3880	EFdDUHy.exe
3532	JPyhAFy.exe
2216	UOwZhUp.exe
2824	LPNXpsr.exe
368	pzZOjJT.exe
4332	KTnaqDR.exe
4456	jkIpczx.exe
4852	TnqcTXi.exe
380	krkUNxL.exe
3644	XVBIytA.exe
4124	QNIYpra.exe
4880	rFwSWnm.exe
4636	swrdzZs.exe
2500	bingHTS.exe
5040	oMqdcqI.exe
4576	rEwpouc.exe
3860	LBByBEC.exe
376	BmKGpYS.exe
4428	wDDXVyX.exe
1568	GsDWxvs.exe
1036	GXytRbV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3640-0-0x00007FF6712B0000-0x00007FF671604000-memory.dmp	upx
behavioral2/files/0x0008000000023429-8.dat	upx
behavioral2/files/0x000700000002342d-10.dat	upx
behavioral2/files/0x000700000002342f-18.dat	upx
behavioral2/files/0x0007000000023430-27.dat	upx
behavioral2/files/0x0007000000023431-31.dat	upx
behavioral2/files/0x0007000000023433-48.dat	upx
behavioral2/files/0x0007000000023434-52.dat	upx
behavioral2/files/0x0007000000023439-78.dat	upx
behavioral2/files/0x000700000002343b-88.dat	upx
behavioral2/files/0x000700000002343d-98.dat	upx
behavioral2/files/0x0007000000023445-138.dat	upx
behavioral2/files/0x000700000002344a-165.dat	upx
behavioral2/memory/5020-501-0x00007FF6D3180000-0x00007FF6D34D4000-memory.dmp	upx
behavioral2/memory/4972-497-0x00007FF60DC80000-0x00007FF60DFD4000-memory.dmp	upx
behavioral2/memory/4704-515-0x00007FF6BDE60000-0x00007FF6BE1B4000-memory.dmp	upx
behavioral2/memory/2068-518-0x00007FF78D960000-0x00007FF78DCB4000-memory.dmp	upx
behavioral2/memory/4368-526-0x00007FF621340000-0x00007FF621694000-memory.dmp	upx
behavioral2/memory/4920-528-0x00007FF64ACA0000-0x00007FF64AFF4000-memory.dmp	upx
behavioral2/memory/1420-530-0x00007FF63D370000-0x00007FF63D6C4000-memory.dmp	upx
behavioral2/memory/5076-529-0x00007FF680980000-0x00007FF680CD4000-memory.dmp	upx
behavioral2/memory/3276-531-0x00007FF762FB0000-0x00007FF763304000-memory.dmp	upx
behavioral2/memory/4352-532-0x00007FF63ADC0000-0x00007FF63B114000-memory.dmp	upx
behavioral2/memory/4348-533-0x00007FF6CF940000-0x00007FF6CFC94000-memory.dmp	upx
behavioral2/memory/4824-534-0x00007FF7C1F50000-0x00007FF7C22A4000-memory.dmp	upx
behavioral2/memory/4772-527-0x00007FF613D60000-0x00007FF6140B4000-memory.dmp	upx
behavioral2/memory/448-536-0x00007FF76D4A0000-0x00007FF76D7F4000-memory.dmp	upx
behavioral2/memory/1912-535-0x00007FF670110000-0x00007FF670464000-memory.dmp	upx
behavioral2/memory/4648-538-0x00007FF691550000-0x00007FF6918A4000-memory.dmp	upx
behavioral2/memory/2508-537-0x00007FF76C770000-0x00007FF76CAC4000-memory.dmp	upx
behavioral2/memory/2864-539-0x00007FF6EB080000-0x00007FF6EB3D4000-memory.dmp	upx
behavioral2/memory/4596-513-0x00007FF6A1E10000-0x00007FF6A2164000-memory.dmp	upx
behavioral2/memory/2884-554-0x00007FF7E94B0000-0x00007FF7E9804000-memory.dmp	upx
behavioral2/memory/436-557-0x00007FF6F2A50000-0x00007FF6F2DA4000-memory.dmp	upx
behavioral2/memory/4656-553-0x00007FF777CB0000-0x00007FF778004000-memory.dmp	upx
behavioral2/memory/4280-549-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp	upx
behavioral2/memory/4916-510-0x00007FF6BFDD0000-0x00007FF6C0124000-memory.dmp	upx
behavioral2/memory/3888-507-0x00007FF722B10000-0x00007FF722E64000-memory.dmp	upx
behavioral2/files/0x000700000002344c-167.dat	upx
behavioral2/files/0x000700000002344b-162.dat	upx
behavioral2/files/0x0007000000023449-158.dat	upx
behavioral2/files/0x0007000000023448-153.dat	upx
behavioral2/files/0x0007000000023447-148.dat	upx
behavioral2/files/0x0007000000023446-143.dat	upx
behavioral2/files/0x0007000000023444-133.dat	upx
behavioral2/files/0x0007000000023443-128.dat	upx
behavioral2/files/0x0007000000023442-122.dat	upx
behavioral2/files/0x0007000000023441-118.dat	upx
behavioral2/files/0x0007000000023440-113.dat	upx
behavioral2/files/0x000700000002343f-108.dat	upx
behavioral2/files/0x000700000002343e-102.dat	upx
behavioral2/files/0x000700000002343c-93.dat	upx
behavioral2/files/0x000700000002343a-82.dat	upx
behavioral2/files/0x0007000000023438-73.dat	upx
behavioral2/files/0x0007000000023437-68.dat	upx
behavioral2/files/0x0007000000023436-62.dat	upx
behavioral2/files/0x0007000000023435-58.dat	upx
behavioral2/files/0x0007000000023432-40.dat	upx
behavioral2/memory/2588-32-0x00007FF6F50C0000-0x00007FF6F5414000-memory.dmp	upx
behavioral2/memory/2992-28-0x00007FF6D9F40000-0x00007FF6DA294000-memory.dmp	upx
behavioral2/files/0x000700000002342e-22.dat	upx
behavioral2/memory/2492-15-0x00007FF6B7030000-0x00007FF6B7384000-memory.dmp	upx
behavioral2/memory/1836-11-0x00007FF6D5E20000-0x00007FF6D6174000-memory.dmp	upx
behavioral2/memory/2492-2084-0x00007FF6B7030000-0x00007FF6B7384000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JCYmMMP.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\cyjFtmz.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\MjDJunj.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\kvNnuOX.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\kiCzCcT.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\vsXkNTC.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\JAUmwba.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\RDBNUxf.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\HzsmkzL.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\kHpchjM.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\SRhKIwE.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\PBrFvba.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\aLflSWh.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\VWIddav.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\eYVhccL.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\cprCexI.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\tfyysWf.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\UVPdMMe.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\FCXPnIg.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\VNLNUIs.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\sRVqmCF.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\AOBeBvc.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\krWxZse.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\WoTpmNz.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\BiZLeru.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\DTwAsMK.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\qqRcjOW.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\PCXjKMx.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\LFaluvX.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\wFjIWHl.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\cNOJmAe.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\EhrBekI.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\WDjnpob.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\erGWvOP.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\pkhisHW.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\lPZeAPo.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\yVShWYe.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\ZLIHOTu.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\tHUeJCF.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\wDNhRZl.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\MhKijUC.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\UKtYGpi.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\SVazaBh.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\JvxmEqN.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\uzeQTlE.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\CaGnzBA.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\CLuarax.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\pWctFoe.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\UfAGqMp.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\VRhxysr.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\wFSkAtr.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\ZjndCjt.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\vqrepQg.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\NJwChNJ.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\whlSKPU.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\BwjdRwA.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\NrLbUFr.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\FJzosyD.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\EFdDUHy.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\WHAMmUH.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\bPJxSIu.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\xfgtrWI.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\zchEXng.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
File created	C:\Windows\System\wepYClQ.exe	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 1836	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	82
PID 3640 wrote to memory of 1836	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	82
PID 3640 wrote to memory of 2492	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	83
PID 3640 wrote to memory of 2492	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	83
PID 3640 wrote to memory of 2992	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	84
PID 3640 wrote to memory of 2992	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	84
PID 3640 wrote to memory of 4972	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	85
PID 3640 wrote to memory of 4972	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	85
PID 3640 wrote to memory of 2588	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	86
PID 3640 wrote to memory of 2588	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	86
PID 3640 wrote to memory of 5020	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	87
PID 3640 wrote to memory of 5020	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	87
PID 3640 wrote to memory of 436	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	88
PID 3640 wrote to memory of 436	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	88
PID 3640 wrote to memory of 3888	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	89
PID 3640 wrote to memory of 3888	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	89
PID 3640 wrote to memory of 4916	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	90
PID 3640 wrote to memory of 4916	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	90
PID 3640 wrote to memory of 4596	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	91
PID 3640 wrote to memory of 4596	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	91
PID 3640 wrote to memory of 4704	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	92
PID 3640 wrote to memory of 4704	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	92
PID 3640 wrote to memory of 2068	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	93
PID 3640 wrote to memory of 2068	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	93
PID 3640 wrote to memory of 4368	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	94
PID 3640 wrote to memory of 4368	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	94
PID 3640 wrote to memory of 4772	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	95
PID 3640 wrote to memory of 4772	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	95
PID 3640 wrote to memory of 4920	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	96
PID 3640 wrote to memory of 4920	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	96
PID 3640 wrote to memory of 5076	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	97
PID 3640 wrote to memory of 5076	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	97
PID 3640 wrote to memory of 1420	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	98
PID 3640 wrote to memory of 1420	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	98
PID 3640 wrote to memory of 3276	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	99
PID 3640 wrote to memory of 3276	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	99
PID 3640 wrote to memory of 4352	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	100
PID 3640 wrote to memory of 4352	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	100
PID 3640 wrote to memory of 4348	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	101
PID 3640 wrote to memory of 4348	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	101
PID 3640 wrote to memory of 4824	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	102
PID 3640 wrote to memory of 4824	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	102
PID 3640 wrote to memory of 1912	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	103
PID 3640 wrote to memory of 1912	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	103
PID 3640 wrote to memory of 448	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	104
PID 3640 wrote to memory of 448	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	104
PID 3640 wrote to memory of 2508	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	105
PID 3640 wrote to memory of 2508	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	105
PID 3640 wrote to memory of 4648	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	106
PID 3640 wrote to memory of 4648	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	106
PID 3640 wrote to memory of 2864	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	107
PID 3640 wrote to memory of 2864	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	107
PID 3640 wrote to memory of 4280	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	108
PID 3640 wrote to memory of 4280	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	108
PID 3640 wrote to memory of 4656	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	109
PID 3640 wrote to memory of 4656	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	109
PID 3640 wrote to memory of 2884	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	110
PID 3640 wrote to memory of 2884	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	110
PID 3640 wrote to memory of 2548	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	111
PID 3640 wrote to memory of 2548	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	111
PID 3640 wrote to memory of 4784	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	112
PID 3640 wrote to memory of 4784	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	112
PID 3640 wrote to memory of 3492	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	113
PID 3640 wrote to memory of 3492	3640	3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3b94f11c9386193290c5c75968875cf0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\System\tOxWtDh.exe
  C:\Windows\System\tOxWtDh.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\mRJNFoi.exe
  C:\Windows\System\mRJNFoi.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\dCrxQGA.exe
  C:\Windows\System\dCrxQGA.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\SuaVHfe.exe
  C:\Windows\System\SuaVHfe.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\Tcodida.exe
  C:\Windows\System\Tcodida.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\QrELjUE.exe
  C:\Windows\System\QrELjUE.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\lqLGcDH.exe
  C:\Windows\System\lqLGcDH.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\URcqxuM.exe
  C:\Windows\System\URcqxuM.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\tKjzsVk.exe
  C:\Windows\System\tKjzsVk.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\pbpNowA.exe
  C:\Windows\System\pbpNowA.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\pkhisHW.exe
  C:\Windows\System\pkhisHW.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\zWhwPGw.exe
  C:\Windows\System\zWhwPGw.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\TsQMJJu.exe
  C:\Windows\System\TsQMJJu.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\wbEExJS.exe
  C:\Windows\System\wbEExJS.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\fqlsaNM.exe
  C:\Windows\System\fqlsaNM.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\LDkeqzd.exe
  C:\Windows\System\LDkeqzd.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\CbtPozW.exe
  C:\Windows\System\CbtPozW.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\RUDNCTP.exe
  C:\Windows\System\RUDNCTP.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\uJOnVEb.exe
  C:\Windows\System\uJOnVEb.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\NjXkUEe.exe
  C:\Windows\System\NjXkUEe.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\AaQKkjT.exe
  C:\Windows\System\AaQKkjT.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\latoxhd.exe
  C:\Windows\System\latoxhd.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\KNvBwmI.exe
  C:\Windows\System\KNvBwmI.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\AOBeBvc.exe
  C:\Windows\System\AOBeBvc.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\DayWvtO.exe
  C:\Windows\System\DayWvtO.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\oiUGAEQ.exe
  C:\Windows\System\oiUGAEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\EnVygDi.exe
  C:\Windows\System\EnVygDi.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\wFjIWHl.exe
  C:\Windows\System\wFjIWHl.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\TlUKFDI.exe
  C:\Windows\System\TlUKFDI.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\fyLhFSz.exe
  C:\Windows\System\fyLhFSz.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\OaQMDWI.exe
  C:\Windows\System\OaQMDWI.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\FiBxSSt.exe
  C:\Windows\System\FiBxSSt.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\JCYmMMP.exe
  C:\Windows\System\JCYmMMP.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\haJCtCT.exe
  C:\Windows\System\haJCtCT.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\GMVJDTY.exe
  C:\Windows\System\GMVJDTY.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\QxLpgEK.exe
  C:\Windows\System\QxLpgEK.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\rTOWWVZ.exe
  C:\Windows\System\rTOWWVZ.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\zWRHgYN.exe
  C:\Windows\System\zWRHgYN.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\NbYtqnF.exe
  C:\Windows\System\NbYtqnF.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\qVGuNfb.exe
  C:\Windows\System\qVGuNfb.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\WcGbvIR.exe
  C:\Windows\System\WcGbvIR.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\AqQoPls.exe
  C:\Windows\System\AqQoPls.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\eVJkeZs.exe
  C:\Windows\System\eVJkeZs.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\EFdDUHy.exe
  C:\Windows\System\EFdDUHy.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\JPyhAFy.exe
  C:\Windows\System\JPyhAFy.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\UOwZhUp.exe
  C:\Windows\System\UOwZhUp.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\LPNXpsr.exe
  C:\Windows\System\LPNXpsr.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\pzZOjJT.exe
  C:\Windows\System\pzZOjJT.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\KTnaqDR.exe
  C:\Windows\System\KTnaqDR.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\jkIpczx.exe
  C:\Windows\System\jkIpczx.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\TnqcTXi.exe
  C:\Windows\System\TnqcTXi.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\krkUNxL.exe
  C:\Windows\System\krkUNxL.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\XVBIytA.exe
  C:\Windows\System\XVBIytA.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\QNIYpra.exe
  C:\Windows\System\QNIYpra.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\rFwSWnm.exe
  C:\Windows\System\rFwSWnm.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\swrdzZs.exe
  C:\Windows\System\swrdzZs.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\bingHTS.exe
  C:\Windows\System\bingHTS.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\oMqdcqI.exe
  C:\Windows\System\oMqdcqI.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\rEwpouc.exe
  C:\Windows\System\rEwpouc.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\LBByBEC.exe
  C:\Windows\System\LBByBEC.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\BmKGpYS.exe
  C:\Windows\System\BmKGpYS.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\wDDXVyX.exe
  C:\Windows\System\wDDXVyX.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\GsDWxvs.exe
  C:\Windows\System\GsDWxvs.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\GXytRbV.exe
  C:\Windows\System\GXytRbV.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\FkiNbXr.exe
  C:\Windows\System\FkiNbXr.exe
  2⤵
  PID:1584
- C:\Windows\System\XajBjnT.exe
  C:\Windows\System\XajBjnT.exe
  2⤵
  PID:3584
- C:\Windows\System\zchEXng.exe
  C:\Windows\System\zchEXng.exe
  2⤵
  PID:2452
- C:\Windows\System\rOPPlgL.exe
  C:\Windows\System\rOPPlgL.exe
  2⤵
  PID:3212
- C:\Windows\System\FbvqbSo.exe
  C:\Windows\System\FbvqbSo.exe
  2⤵
  PID:5108
- C:\Windows\System\TGUCgCD.exe
  C:\Windows\System\TGUCgCD.exe
  2⤵
  PID:4744
- C:\Windows\System\hlECeHM.exe
  C:\Windows\System\hlECeHM.exe
  2⤵
  PID:1828
- C:\Windows\System\BdEHJBJ.exe
  C:\Windows\System\BdEHJBJ.exe
  2⤵
  PID:1664
- C:\Windows\System\KxdyOal.exe
  C:\Windows\System\KxdyOal.exe
  2⤵
  PID:4308
- C:\Windows\System\fIuUZqh.exe
  C:\Windows\System\fIuUZqh.exe
  2⤵
  PID:4260
- C:\Windows\System\agSRVsW.exe
  C:\Windows\System\agSRVsW.exe
  2⤵
  PID:4432
- C:\Windows\System\IdHnfSk.exe
  C:\Windows\System\IdHnfSk.exe
  2⤵
  PID:5068
- C:\Windows\System\AoNBExr.exe
  C:\Windows\System\AoNBExr.exe
  2⤵
  PID:4508
- C:\Windows\System\tbQJmur.exe
  C:\Windows\System\tbQJmur.exe
  2⤵
  PID:872
- C:\Windows\System\mYGISPq.exe
  C:\Windows\System\mYGISPq.exe
  2⤵
  PID:2372
- C:\Windows\System\dCdaujn.exe
  C:\Windows\System\dCdaujn.exe
  2⤵
  PID:4540
- C:\Windows\System\oPGiSvn.exe
  C:\Windows\System\oPGiSvn.exe
  2⤵
  PID:4276
- C:\Windows\System\vHceDCJ.exe
  C:\Windows\System\vHceDCJ.exe
  2⤵
  PID:2488
- C:\Windows\System\yFRNRGT.exe
  C:\Windows\System\yFRNRGT.exe
  2⤵
  PID:5132
- C:\Windows\System\RbGozLg.exe
  C:\Windows\System\RbGozLg.exe
  2⤵
  PID:5156
- C:\Windows\System\GPgWrWZ.exe
  C:\Windows\System\GPgWrWZ.exe
  2⤵
  PID:5188
- C:\Windows\System\RPhwnle.exe
  C:\Windows\System\RPhwnle.exe
  2⤵
  PID:5216
- C:\Windows\System\lPZeAPo.exe
  C:\Windows\System\lPZeAPo.exe
  2⤵
  PID:5244
- C:\Windows\System\NJTPfxp.exe
  C:\Windows\System\NJTPfxp.exe
  2⤵
  PID:5272
- C:\Windows\System\bVCNiCb.exe
  C:\Windows\System\bVCNiCb.exe
  2⤵
  PID:5296
- C:\Windows\System\rvEvReQ.exe
  C:\Windows\System\rvEvReQ.exe
  2⤵
  PID:5328
- C:\Windows\System\WDCTORo.exe
  C:\Windows\System\WDCTORo.exe
  2⤵
  PID:5356
- C:\Windows\System\nYnLUnN.exe
  C:\Windows\System\nYnLUnN.exe
  2⤵
  PID:5380
- C:\Windows\System\MgUfqKK.exe
  C:\Windows\System\MgUfqKK.exe
  2⤵
  PID:5412
- C:\Windows\System\UpdvXLI.exe
  C:\Windows\System\UpdvXLI.exe
  2⤵
  PID:5440
- C:\Windows\System\jMNELfU.exe
  C:\Windows\System\jMNELfU.exe
  2⤵
  PID:5468
- C:\Windows\System\CsXgwFv.exe
  C:\Windows\System\CsXgwFv.exe
  2⤵
  PID:5492
- C:\Windows\System\PHfbNlB.exe
  C:\Windows\System\PHfbNlB.exe
  2⤵
  PID:5520
- C:\Windows\System\NXiFzTI.exe
  C:\Windows\System\NXiFzTI.exe
  2⤵
  PID:5548
- C:\Windows\System\XGDPuOF.exe
  C:\Windows\System\XGDPuOF.exe
  2⤵
  PID:5576
- C:\Windows\System\asyIoTG.exe
  C:\Windows\System\asyIoTG.exe
  2⤵
  PID:5604
- C:\Windows\System\uECwUha.exe
  C:\Windows\System\uECwUha.exe
  2⤵
  PID:5636
- C:\Windows\System\rQGgIqD.exe
  C:\Windows\System\rQGgIqD.exe
  2⤵
  PID:5664
- C:\Windows\System\QbFYQFL.exe
  C:\Windows\System\QbFYQFL.exe
  2⤵
  PID:5692
- C:\Windows\System\NxRqwvM.exe
  C:\Windows\System\NxRqwvM.exe
  2⤵
  PID:5720
- C:\Windows\System\rFVNxTY.exe
  C:\Windows\System\rFVNxTY.exe
  2⤵
  PID:5744
- C:\Windows\System\WdiceiA.exe
  C:\Windows\System\WdiceiA.exe
  2⤵
  PID:5772
- C:\Windows\System\srbxxab.exe
  C:\Windows\System\srbxxab.exe
  2⤵
  PID:5800
- C:\Windows\System\cyjFtmz.exe
  C:\Windows\System\cyjFtmz.exe
  2⤵
  PID:5828
- C:\Windows\System\BXBgCKH.exe
  C:\Windows\System\BXBgCKH.exe
  2⤵
  PID:5856
- C:\Windows\System\dXMaOEr.exe
  C:\Windows\System\dXMaOEr.exe
  2⤵
  PID:5884
- C:\Windows\System\rhQxcSU.exe
  C:\Windows\System\rhQxcSU.exe
  2⤵
  PID:5916
- C:\Windows\System\Ihrmlpb.exe
  C:\Windows\System\Ihrmlpb.exe
  2⤵
  PID:5944
- C:\Windows\System\FKaLXPB.exe
  C:\Windows\System\FKaLXPB.exe
  2⤵
  PID:5968
- C:\Windows\System\zkDQtng.exe
  C:\Windows\System\zkDQtng.exe
  2⤵
  PID:5996
- C:\Windows\System\dCkMWfm.exe
  C:\Windows\System\dCkMWfm.exe
  2⤵
  PID:6024
- C:\Windows\System\GOVRXxd.exe
  C:\Windows\System\GOVRXxd.exe
  2⤵
  PID:6052
- C:\Windows\System\ZFmRefU.exe
  C:\Windows\System\ZFmRefU.exe
  2⤵
  PID:6080
- C:\Windows\System\yVShWYe.exe
  C:\Windows\System\yVShWYe.exe
  2⤵
  PID:6108
- C:\Windows\System\lsqeiRk.exe
  C:\Windows\System\lsqeiRk.exe
  2⤵
  PID:6136
- C:\Windows\System\kPxhVQS.exe
  C:\Windows\System\kPxhVQS.exe
  2⤵
  PID:3044
- C:\Windows\System\CirjjGY.exe
  C:\Windows\System\CirjjGY.exe
  2⤵
  PID:876
- C:\Windows\System\YTPPbMu.exe
  C:\Windows\System\YTPPbMu.exe
  2⤵
  PID:2448
- C:\Windows\System\yuinfEh.exe
  C:\Windows\System\yuinfEh.exe
  2⤵
  PID:5152
- C:\Windows\System\WxstDea.exe
  C:\Windows\System\WxstDea.exe
  2⤵
  PID:5208
- C:\Windows\System\JCwuydE.exe
  C:\Windows\System\JCwuydE.exe
  2⤵
  PID:5284
- C:\Windows\System\IUIVvRp.exe
  C:\Windows\System\IUIVvRp.exe
  2⤵
  PID:5344
- C:\Windows\System\wFSkAtr.exe
  C:\Windows\System\wFSkAtr.exe
  2⤵
  PID:5404
- C:\Windows\System\wDNhRZl.exe
  C:\Windows\System\wDNhRZl.exe
  2⤵
  PID:5480
- C:\Windows\System\Vnjoeto.exe
  C:\Windows\System\Vnjoeto.exe
  2⤵
  PID:5536
- C:\Windows\System\WnLIUVl.exe
  C:\Windows\System\WnLIUVl.exe
  2⤵
  PID:5600
- C:\Windows\System\ljuZyrd.exe
  C:\Windows\System\ljuZyrd.exe
  2⤵
  PID:5656
- C:\Windows\System\nIctjjj.exe
  C:\Windows\System\nIctjjj.exe
  2⤵
  PID:5736
- C:\Windows\System\dWpdbWS.exe
  C:\Windows\System\dWpdbWS.exe
  2⤵
  PID:5792
- C:\Windows\System\czTpXwc.exe
  C:\Windows\System\czTpXwc.exe
  2⤵
  PID:5852
- C:\Windows\System\EyZpxwb.exe
  C:\Windows\System\EyZpxwb.exe
  2⤵
  PID:5904
- C:\Windows\System\fWeioSx.exe
  C:\Windows\System\fWeioSx.exe
  2⤵
  PID:5964
- C:\Windows\System\evMTVTJ.exe
  C:\Windows\System\evMTVTJ.exe
  2⤵
  PID:6040
- C:\Windows\System\VWIddav.exe
  C:\Windows\System\VWIddav.exe
  2⤵
  PID:6072
- C:\Windows\System\kQFnCwS.exe
  C:\Windows\System\kQFnCwS.exe
  2⤵
  PID:6132
- C:\Windows\System\YriRlGu.exe
  C:\Windows\System\YriRlGu.exe
  2⤵
  PID:2028
- C:\Windows\System\ZAHvFDs.exe
  C:\Windows\System\ZAHvFDs.exe
  2⤵
  PID:5180
- C:\Windows\System\Lhwevki.exe
  C:\Windows\System\Lhwevki.exe
  2⤵
  PID:5316
- C:\Windows\System\DyXIjqq.exe
  C:\Windows\System\DyXIjqq.exe
  2⤵
  PID:5452
- C:\Windows\System\UCEHuip.exe
  C:\Windows\System\UCEHuip.exe
  2⤵
  PID:5648
- C:\Windows\System\tRLBFsS.exe
  C:\Windows\System\tRLBFsS.exe
  2⤵
  PID:5764
- C:\Windows\System\GYCcDkI.exe
  C:\Windows\System\GYCcDkI.exe
  2⤵
  PID:5956
- C:\Windows\System\yIjYYoi.exe
  C:\Windows\System\yIjYYoi.exe
  2⤵
  PID:6016
- C:\Windows\System\tmRIYXc.exe
  C:\Windows\System\tmRIYXc.exe
  2⤵
  PID:3124
- C:\Windows\System\QlfxIAw.exe
  C:\Windows\System\QlfxIAw.exe
  2⤵
  PID:5124
- C:\Windows\System\ZLIHOTu.exe
  C:\Windows\System\ZLIHOTu.exe
  2⤵
  PID:3708
- C:\Windows\System\noPqAbG.exe
  C:\Windows\System\noPqAbG.exe
  2⤵
  PID:1604
- C:\Windows\System\KYcHdOC.exe
  C:\Windows\System\KYcHdOC.exe
  2⤵
  PID:4836
- C:\Windows\System\CXCIqwq.exe
  C:\Windows\System\CXCIqwq.exe
  2⤵
  PID:4624
- C:\Windows\System\vAyBFTs.exe
  C:\Windows\System\vAyBFTs.exe
  2⤵
  PID:2728
- C:\Windows\System\OUguSyf.exe
  C:\Windows\System\OUguSyf.exe
  2⤵
  PID:2044
- C:\Windows\System\KtaOToP.exe
  C:\Windows\System\KtaOToP.exe
  2⤵
  PID:4236
- C:\Windows\System\mYhiKJc.exe
  C:\Windows\System\mYhiKJc.exe
  2⤵
  PID:4968
- C:\Windows\System\krWxZse.exe
  C:\Windows\System\krWxZse.exe
  2⤵
  PID:4104
- C:\Windows\System\uPezhVX.exe
  C:\Windows\System\uPezhVX.exe
  2⤵
  PID:1196
- C:\Windows\System\oXoxejF.exe
  C:\Windows\System\oXoxejF.exe
  2⤵
  PID:744
- C:\Windows\System\oOTQqTJ.exe
  C:\Windows\System\oOTQqTJ.exe
  2⤵
  PID:1884
- C:\Windows\System\KFVGkKe.exe
  C:\Windows\System\KFVGkKe.exe
  2⤵
  PID:3740
- C:\Windows\System\cxOPrTh.exe
  C:\Windows\System\cxOPrTh.exe
  2⤵
  PID:6172
- C:\Windows\System\oltgpmd.exe
  C:\Windows\System\oltgpmd.exe
  2⤵
  PID:6188
- C:\Windows\System\uGQUuwG.exe
  C:\Windows\System\uGQUuwG.exe
  2⤵
  PID:6204
- C:\Windows\System\eJApxgv.exe
  C:\Windows\System\eJApxgv.exe
  2⤵
  PID:6236
- C:\Windows\System\TdXjQYv.exe
  C:\Windows\System\TdXjQYv.exe
  2⤵
  PID:6260
- C:\Windows\System\ZqLPnpg.exe
  C:\Windows\System\ZqLPnpg.exe
  2⤵
  PID:6304
- C:\Windows\System\nMEKJfl.exe
  C:\Windows\System\nMEKJfl.exe
  2⤵
  PID:6336
- C:\Windows\System\hNaWwGg.exe
  C:\Windows\System\hNaWwGg.exe
  2⤵
  PID:6368
- C:\Windows\System\LebHIJN.exe
  C:\Windows\System\LebHIJN.exe
  2⤵
  PID:6400
- C:\Windows\System\MhKijUC.exe
  C:\Windows\System\MhKijUC.exe
  2⤵
  PID:6420
- C:\Windows\System\RMbGaCs.exe
  C:\Windows\System\RMbGaCs.exe
  2⤵
  PID:6456
- C:\Windows\System\uLQmwrn.exe
  C:\Windows\System\uLQmwrn.exe
  2⤵
  PID:6484
- C:\Windows\System\nGHnHyn.exe
  C:\Windows\System\nGHnHyn.exe
  2⤵
  PID:6524
- C:\Windows\System\MjDJunj.exe
  C:\Windows\System\MjDJunj.exe
  2⤵
  PID:6564
- C:\Windows\System\QYBIhIf.exe
  C:\Windows\System\QYBIhIf.exe
  2⤵
  PID:6604
- C:\Windows\System\BcQyciH.exe
  C:\Windows\System\BcQyciH.exe
  2⤵
  PID:6632
- C:\Windows\System\tHUeJCF.exe
  C:\Windows\System\tHUeJCF.exe
  2⤵
  PID:6672
- C:\Windows\System\vdTXuFw.exe
  C:\Windows\System\vdTXuFw.exe
  2⤵
  PID:6692
- C:\Windows\System\kxaMVdw.exe
  C:\Windows\System\kxaMVdw.exe
  2⤵
  PID:6724
- C:\Windows\System\ilwBDNl.exe
  C:\Windows\System\ilwBDNl.exe
  2⤵
  PID:6752
- C:\Windows\System\uqcOHMD.exe
  C:\Windows\System\uqcOHMD.exe
  2⤵
  PID:6780
- C:\Windows\System\kvNnuOX.exe
  C:\Windows\System\kvNnuOX.exe
  2⤵
  PID:6844
- C:\Windows\System\ZZjSEiJ.exe
  C:\Windows\System\ZZjSEiJ.exe
  2⤵
  PID:6884
- C:\Windows\System\cbGGxEc.exe
  C:\Windows\System\cbGGxEc.exe
  2⤵
  PID:6912
- C:\Windows\System\qNySNkV.exe
  C:\Windows\System\qNySNkV.exe
  2⤵
  PID:6932
- C:\Windows\System\cEAHDBF.exe
  C:\Windows\System\cEAHDBF.exe
  2⤵
  PID:6980
- C:\Windows\System\ZWpLiBu.exe
  C:\Windows\System\ZWpLiBu.exe
  2⤵
  PID:7008
- C:\Windows\System\rfyTOJE.exe
  C:\Windows\System\rfyTOJE.exe
  2⤵
  PID:7056
- C:\Windows\System\NoVKgfU.exe
  C:\Windows\System\NoVKgfU.exe
  2⤵
  PID:7084
- C:\Windows\System\ngfzbjd.exe
  C:\Windows\System\ngfzbjd.exe
  2⤵
  PID:7100
- C:\Windows\System\Auhjavr.exe
  C:\Windows\System\Auhjavr.exe
  2⤵
  PID:7132
- C:\Windows\System\iRNjFST.exe
  C:\Windows\System\iRNjFST.exe
  2⤵
  PID:7152
- C:\Windows\System\xusEzOW.exe
  C:\Windows\System\xusEzOW.exe
  2⤵
  PID:3388
- C:\Windows\System\yxFOWSB.exe
  C:\Windows\System\yxFOWSB.exe
  2⤵
  PID:6252
- C:\Windows\System\eTsOBIZ.exe
  C:\Windows\System\eTsOBIZ.exe
  2⤵
  PID:6428
- C:\Windows\System\sLDsCLT.exe
  C:\Windows\System\sLDsCLT.exe
  2⤵
  PID:6496
- C:\Windows\System\WqiYiNo.exe
  C:\Windows\System\WqiYiNo.exe
  2⤵
  PID:6556
- C:\Windows\System\ZDHyCNp.exe
  C:\Windows\System\ZDHyCNp.exe
  2⤵
  PID:6652
- C:\Windows\System\xjnlJlj.exe
  C:\Windows\System\xjnlJlj.exe
  2⤵
  PID:6712
- C:\Windows\System\hMdEpVZ.exe
  C:\Windows\System\hMdEpVZ.exe
  2⤵
  PID:6596
- C:\Windows\System\LFaluvX.exe
  C:\Windows\System\LFaluvX.exe
  2⤵
  PID:6904
- C:\Windows\System\HzsmkzL.exe
  C:\Windows\System\HzsmkzL.exe
  2⤵
  PID:6964
- C:\Windows\System\BukfScl.exe
  C:\Windows\System\BukfScl.exe
  2⤵
  PID:7004
- C:\Windows\System\beMmJer.exe
  C:\Windows\System\beMmJer.exe
  2⤵
  PID:7032
- C:\Windows\System\QFAzZZk.exe
  C:\Windows\System\QFAzZZk.exe
  2⤵
  PID:7080
- C:\Windows\System\IvBOEAT.exe
  C:\Windows\System\IvBOEAT.exe
  2⤵
  PID:7160
- C:\Windows\System\eKxAWFU.exe
  C:\Windows\System\eKxAWFU.exe
  2⤵
  PID:6272
- C:\Windows\System\WtGtGwb.exe
  C:\Windows\System\WtGtGwb.exe
  2⤵
  PID:6472
- C:\Windows\System\cNOJmAe.exe
  C:\Windows\System\cNOJmAe.exe
  2⤵
  PID:6616
- C:\Windows\System\EflrRzf.exe
  C:\Windows\System\EflrRzf.exe
  2⤵
  PID:6820
- C:\Windows\System\EUIpdhu.exe
  C:\Windows\System\EUIpdhu.exe
  2⤵
  PID:6580
- C:\Windows\System\DiYpBlj.exe
  C:\Windows\System\DiYpBlj.exe
  2⤵
  PID:7124
- C:\Windows\System\wreBKVH.exe
  C:\Windows\System\wreBKVH.exe
  2⤵
  PID:6392
- C:\Windows\System\GAnsehM.exe
  C:\Windows\System\GAnsehM.exe
  2⤵
  PID:6960
- C:\Windows\System\MDOuwec.exe
  C:\Windows\System\MDOuwec.exe
  2⤵
  PID:2188
- C:\Windows\System\srfNxPw.exe
  C:\Windows\System\srfNxPw.exe
  2⤵
  PID:6684
- C:\Windows\System\mxBWCpx.exe
  C:\Windows\System\mxBWCpx.exe
  2⤵
  PID:6248
- C:\Windows\System\sZutvpe.exe
  C:\Windows\System\sZutvpe.exe
  2⤵
  PID:7184
- C:\Windows\System\igUuJJb.exe
  C:\Windows\System\igUuJJb.exe
  2⤵
  PID:7228
- C:\Windows\System\rAvOVvP.exe
  C:\Windows\System\rAvOVvP.exe
  2⤵
  PID:7264
- C:\Windows\System\FCXPnIg.exe
  C:\Windows\System\FCXPnIg.exe
  2⤵
  PID:7288
- C:\Windows\System\kiCzCcT.exe
  C:\Windows\System\kiCzCcT.exe
  2⤵
  PID:7316
- C:\Windows\System\ETqdNVr.exe
  C:\Windows\System\ETqdNVr.exe
  2⤵
  PID:7344
- C:\Windows\System\tTSATos.exe
  C:\Windows\System\tTSATos.exe
  2⤵
  PID:7372
- C:\Windows\System\uBUwgrG.exe
  C:\Windows\System\uBUwgrG.exe
  2⤵
  PID:7400
- C:\Windows\System\YBNDDxG.exe
  C:\Windows\System\YBNDDxG.exe
  2⤵
  PID:7428
- C:\Windows\System\HRceihj.exe
  C:\Windows\System\HRceihj.exe
  2⤵
  PID:7460
- C:\Windows\System\QwlmnPZ.exe
  C:\Windows\System\QwlmnPZ.exe
  2⤵
  PID:7484
- C:\Windows\System\xOEyBfl.exe
  C:\Windows\System\xOEyBfl.exe
  2⤵
  PID:7520
- C:\Windows\System\PAmTIeU.exe
  C:\Windows\System\PAmTIeU.exe
  2⤵
  PID:7548
- C:\Windows\System\GmnUdfQ.exe
  C:\Windows\System\GmnUdfQ.exe
  2⤵
  PID:7576
- C:\Windows\System\tmUKtoU.exe
  C:\Windows\System\tmUKtoU.exe
  2⤵
  PID:7604
- C:\Windows\System\KCuuNDQ.exe
  C:\Windows\System\KCuuNDQ.exe
  2⤵
  PID:7632
- C:\Windows\System\SCRUTgg.exe
  C:\Windows\System\SCRUTgg.exe
  2⤵
  PID:7660
- C:\Windows\System\XRDQOdu.exe
  C:\Windows\System\XRDQOdu.exe
  2⤵
  PID:7684
- C:\Windows\System\NpRevAC.exe
  C:\Windows\System\NpRevAC.exe
  2⤵
  PID:7704
- C:\Windows\System\VtWswlE.exe
  C:\Windows\System\VtWswlE.exe
  2⤵
  PID:7724
- C:\Windows\System\wepYClQ.exe
  C:\Windows\System\wepYClQ.exe
  2⤵
  PID:7772
- C:\Windows\System\yoxdENU.exe
  C:\Windows\System\yoxdENU.exe
  2⤵
  PID:7800
- C:\Windows\System\caYpjDB.exe
  C:\Windows\System\caYpjDB.exe
  2⤵
  PID:7828
- C:\Windows\System\ZjndCjt.exe
  C:\Windows\System\ZjndCjt.exe
  2⤵
  PID:7856
- C:\Windows\System\LBoYyaV.exe
  C:\Windows\System\LBoYyaV.exe
  2⤵
  PID:7884
- C:\Windows\System\BqUpjJh.exe
  C:\Windows\System\BqUpjJh.exe
  2⤵
  PID:7912
- C:\Windows\System\myFKxEi.exe
  C:\Windows\System\myFKxEi.exe
  2⤵
  PID:7940
- C:\Windows\System\HjLpJcd.exe
  C:\Windows\System\HjLpJcd.exe
  2⤵
  PID:7972
- C:\Windows\System\aIeDvHh.exe
  C:\Windows\System\aIeDvHh.exe
  2⤵
  PID:8000
- C:\Windows\System\XuHEyPP.exe
  C:\Windows\System\XuHEyPP.exe
  2⤵
  PID:8028
- C:\Windows\System\uwwfZbW.exe
  C:\Windows\System\uwwfZbW.exe
  2⤵
  PID:8056
- C:\Windows\System\vQnbaWe.exe
  C:\Windows\System\vQnbaWe.exe
  2⤵
  PID:8084
- C:\Windows\System\KlouvFu.exe
  C:\Windows\System\KlouvFu.exe
  2⤵
  PID:8112
- C:\Windows\System\PODDwjx.exe
  C:\Windows\System\PODDwjx.exe
  2⤵
  PID:8128
- C:\Windows\System\mBvISey.exe
  C:\Windows\System\mBvISey.exe
  2⤵
  PID:8144
- C:\Windows\System\GiYLWiw.exe
  C:\Windows\System\GiYLWiw.exe
  2⤵
  PID:8184
- C:\Windows\System\PFuOxmF.exe
  C:\Windows\System\PFuOxmF.exe
  2⤵
  PID:7180
- C:\Windows\System\NbSSXxI.exe
  C:\Windows\System\NbSSXxI.exe
  2⤵
  PID:7272
- C:\Windows\System\zrBFsJp.exe
  C:\Windows\System\zrBFsJp.exe
  2⤵
  PID:7364
- C:\Windows\System\mqJITHv.exe
  C:\Windows\System\mqJITHv.exe
  2⤵
  PID:7412
- C:\Windows\System\wQfLnyV.exe
  C:\Windows\System\wQfLnyV.exe
  2⤵
  PID:1296
- C:\Windows\System\XolMTgE.exe
  C:\Windows\System\XolMTgE.exe
  2⤵
  PID:7512
- C:\Windows\System\QSPGTiw.exe
  C:\Windows\System\QSPGTiw.exe
  2⤵
  PID:7568
- C:\Windows\System\owgerjf.exe
  C:\Windows\System\owgerjf.exe
  2⤵
  PID:7628
- C:\Windows\System\lQhADky.exe
  C:\Windows\System\lQhADky.exe
  2⤵
  PID:4492
- C:\Windows\System\UjGauAD.exe
  C:\Windows\System\UjGauAD.exe
  2⤵
  PID:7752
- C:\Windows\System\KrkQXLD.exe
  C:\Windows\System\KrkQXLD.exe
  2⤵
  PID:7812
- C:\Windows\System\ffiKRQM.exe
  C:\Windows\System\ffiKRQM.exe
  2⤵
  PID:7876
- C:\Windows\System\xyLfIpN.exe
  C:\Windows\System\xyLfIpN.exe
  2⤵
  PID:7932
- C:\Windows\System\VvzNpUK.exe
  C:\Windows\System\VvzNpUK.exe
  2⤵
  PID:1592
- C:\Windows\System\KGdiFhu.exe
  C:\Windows\System\KGdiFhu.exe
  2⤵
  PID:5936
- C:\Windows\System\AcNaNOg.exe
  C:\Windows\System\AcNaNOg.exe
  2⤵
  PID:2180
- C:\Windows\System\dBUretd.exe
  C:\Windows\System\dBUretd.exe
  2⤵
  PID:8140
- C:\Windows\System\GKamXej.exe
  C:\Windows\System\GKamXej.exe
  2⤵
  PID:7176
- C:\Windows\System\DnhGkLm.exe
  C:\Windows\System\DnhGkLm.exe
  2⤵
  PID:3676
- C:\Windows\System\kaPXzbW.exe
  C:\Windows\System\kaPXzbW.exe
  2⤵
  PID:7540
- C:\Windows\System\JvoaYoD.exe
  C:\Windows\System\JvoaYoD.exe
  2⤵
  PID:7732
- C:\Windows\System\anbmZYR.exe
  C:\Windows\System\anbmZYR.exe
  2⤵
  PID:7908
- C:\Windows\System\YnMfOrf.exe
  C:\Windows\System\YnMfOrf.exe
  2⤵
  PID:8096
- C:\Windows\System\QtwcxCO.exe
  C:\Windows\System\QtwcxCO.exe
  2⤵
  PID:8180
- C:\Windows\System\WdgaWfF.exe
  C:\Windows\System\WdgaWfF.exe
  2⤵
  PID:7480
- C:\Windows\System\dKOoSxz.exe
  C:\Windows\System\dKOoSxz.exe
  2⤵
  PID:8020
- C:\Windows\System\CaGnzBA.exe
  C:\Windows\System\CaGnzBA.exe
  2⤵
  PID:7240
- C:\Windows\System\MPUcdrs.exe
  C:\Windows\System\MPUcdrs.exe
  2⤵
  PID:8124
- C:\Windows\System\RLmXAfE.exe
  C:\Windows\System\RLmXAfE.exe
  2⤵
  PID:8208
- C:\Windows\System\qBCQXJV.exe
  C:\Windows\System\qBCQXJV.exe
  2⤵
  PID:8236
- C:\Windows\System\dHJrOCK.exe
  C:\Windows\System\dHJrOCK.exe
  2⤵
  PID:8264
- C:\Windows\System\jjAerfq.exe
  C:\Windows\System\jjAerfq.exe
  2⤵
  PID:8292
- C:\Windows\System\MlTPlDO.exe
  C:\Windows\System\MlTPlDO.exe
  2⤵
  PID:8320
- C:\Windows\System\TsxxBEb.exe
  C:\Windows\System\TsxxBEb.exe
  2⤵
  PID:8348
- C:\Windows\System\UKtYGpi.exe
  C:\Windows\System\UKtYGpi.exe
  2⤵
  PID:8376
- C:\Windows\System\ZxQfwBP.exe
  C:\Windows\System\ZxQfwBP.exe
  2⤵
  PID:8408
- C:\Windows\System\UkYyahR.exe
  C:\Windows\System\UkYyahR.exe
  2⤵
  PID:8436
- C:\Windows\System\WoTpmNz.exe
  C:\Windows\System\WoTpmNz.exe
  2⤵
  PID:8464
- C:\Windows\System\xevKyHV.exe
  C:\Windows\System\xevKyHV.exe
  2⤵
  PID:8492
- C:\Windows\System\OutYbDm.exe
  C:\Windows\System\OutYbDm.exe
  2⤵
  PID:8520
- C:\Windows\System\JuMIdGZ.exe
  C:\Windows\System\JuMIdGZ.exe
  2⤵
  PID:8548
- C:\Windows\System\AOqYjwF.exe
  C:\Windows\System\AOqYjwF.exe
  2⤵
  PID:8576
- C:\Windows\System\nPYbRlQ.exe
  C:\Windows\System\nPYbRlQ.exe
  2⤵
  PID:8604
- C:\Windows\System\nWCIGbb.exe
  C:\Windows\System\nWCIGbb.exe
  2⤵
  PID:8632
- C:\Windows\System\UmvdfoP.exe
  C:\Windows\System\UmvdfoP.exe
  2⤵
  PID:8664
- C:\Windows\System\yIxBaSj.exe
  C:\Windows\System\yIxBaSj.exe
  2⤵
  PID:8688
- C:\Windows\System\EaxqXFi.exe
  C:\Windows\System\EaxqXFi.exe
  2⤵
  PID:8716
- C:\Windows\System\vzhpiyE.exe
  C:\Windows\System\vzhpiyE.exe
  2⤵
  PID:8744
- C:\Windows\System\WCRmxoM.exe
  C:\Windows\System\WCRmxoM.exe
  2⤵
  PID:8776
- C:\Windows\System\czMJQjG.exe
  C:\Windows\System\czMJQjG.exe
  2⤵
  PID:8800
- C:\Windows\System\sMaxVcA.exe
  C:\Windows\System\sMaxVcA.exe
  2⤵
  PID:8828
- C:\Windows\System\LtLzvQl.exe
  C:\Windows\System\LtLzvQl.exe
  2⤵
  PID:8860
- C:\Windows\System\DsalkbV.exe
  C:\Windows\System\DsalkbV.exe
  2⤵
  PID:8888
- C:\Windows\System\zfYUVXq.exe
  C:\Windows\System\zfYUVXq.exe
  2⤵
  PID:8916
- C:\Windows\System\hrnipTs.exe
  C:\Windows\System\hrnipTs.exe
  2⤵
  PID:8944
- C:\Windows\System\jCxMFsN.exe
  C:\Windows\System\jCxMFsN.exe
  2⤵
  PID:8972
- C:\Windows\System\xxykSiq.exe
  C:\Windows\System\xxykSiq.exe
  2⤵
  PID:9000
- C:\Windows\System\vqrepQg.exe
  C:\Windows\System\vqrepQg.exe
  2⤵
  PID:9032
- C:\Windows\System\NJwChNJ.exe
  C:\Windows\System\NJwChNJ.exe
  2⤵
  PID:9056
- C:\Windows\System\pVXOTXf.exe
  C:\Windows\System\pVXOTXf.exe
  2⤵
  PID:9084
- C:\Windows\System\iFcUFpd.exe
  C:\Windows\System\iFcUFpd.exe
  2⤵
  PID:9112
- C:\Windows\System\iMMXWvb.exe
  C:\Windows\System\iMMXWvb.exe
  2⤵
  PID:9140
- C:\Windows\System\nCJoArO.exe
  C:\Windows\System\nCJoArO.exe
  2⤵
  PID:9168
- C:\Windows\System\JezLoai.exe
  C:\Windows\System\JezLoai.exe
  2⤵
  PID:9196
- C:\Windows\System\QjwLKNR.exe
  C:\Windows\System\QjwLKNR.exe
  2⤵
  PID:8204
- C:\Windows\System\WHAMmUH.exe
  C:\Windows\System\WHAMmUH.exe
  2⤵
  PID:8260
- C:\Windows\System\ZSbgPTD.exe
  C:\Windows\System\ZSbgPTD.exe
  2⤵
  PID:8316
- C:\Windows\System\kmopvDs.exe
  C:\Windows\System\kmopvDs.exe
  2⤵
  PID:8392
- C:\Windows\System\ZOkgtfn.exe
  C:\Windows\System\ZOkgtfn.exe
  2⤵
  PID:8488
- C:\Windows\System\uqtUoHS.exe
  C:\Windows\System\uqtUoHS.exe
  2⤵
  PID:8560
- C:\Windows\System\jbqMhys.exe
  C:\Windows\System\jbqMhys.exe
  2⤵
  PID:8628
- C:\Windows\System\wVtEGJk.exe
  C:\Windows\System\wVtEGJk.exe
  2⤵
  PID:8728
- C:\Windows\System\SHKQjFS.exe
  C:\Windows\System\SHKQjFS.exe
  2⤵
  PID:8796
- C:\Windows\System\ZcWPIcZ.exe
  C:\Windows\System\ZcWPIcZ.exe
  2⤵
  PID:8908
- C:\Windows\System\kyGOxrO.exe
  C:\Windows\System\kyGOxrO.exe
  2⤵
  PID:8992
- C:\Windows\System\JpDcXUd.exe
  C:\Windows\System\JpDcXUd.exe
  2⤵
  PID:9080
- C:\Windows\System\rYGYtje.exe
  C:\Windows\System\rYGYtje.exe
  2⤵
  PID:9156
- C:\Windows\System\yucsUqo.exe
  C:\Windows\System\yucsUqo.exe
  2⤵
  PID:8312
- C:\Windows\System\QoySicQ.exe
  C:\Windows\System\QoySicQ.exe
  2⤵
  PID:8516
- C:\Windows\System\YpWNtSj.exe
  C:\Windows\System\YpWNtSj.exe
  2⤵
  PID:8756
- C:\Windows\System\Mjptrwg.exe
  C:\Windows\System\Mjptrwg.exe
  2⤵
  PID:8308
- C:\Windows\System\kEwoWVd.exe
  C:\Windows\System\kEwoWVd.exe
  2⤵
  PID:8484
- C:\Windows\System\xReWhtl.exe
  C:\Windows\System\xReWhtl.exe
  2⤵
  PID:9244
- C:\Windows\System\ooTfvJO.exe
  C:\Windows\System\ooTfvJO.exe
  2⤵
  PID:9264
- C:\Windows\System\yCIoEqK.exe
  C:\Windows\System\yCIoEqK.exe
  2⤵
  PID:9304
- C:\Windows\System\sjIZXSQ.exe
  C:\Windows\System\sjIZXSQ.exe
  2⤵
  PID:9332
- C:\Windows\System\NfEpImp.exe
  C:\Windows\System\NfEpImp.exe
  2⤵
  PID:9360
- C:\Windows\System\zmTLpFu.exe
  C:\Windows\System\zmTLpFu.exe
  2⤵
  PID:9392
- C:\Windows\System\TnLagUr.exe
  C:\Windows\System\TnLagUr.exe
  2⤵
  PID:9428
- C:\Windows\System\CvCCyBV.exe
  C:\Windows\System\CvCCyBV.exe
  2⤵
  PID:9464
- C:\Windows\System\FBqWYXA.exe
  C:\Windows\System\FBqWYXA.exe
  2⤵
  PID:9492
- C:\Windows\System\qZJUrnD.exe
  C:\Windows\System\qZJUrnD.exe
  2⤵
  PID:9520
- C:\Windows\System\pJagudM.exe
  C:\Windows\System\pJagudM.exe
  2⤵
  PID:9548
- C:\Windows\System\kHpchjM.exe
  C:\Windows\System\kHpchjM.exe
  2⤵
  PID:9576
- C:\Windows\System\qRCcIlv.exe
  C:\Windows\System\qRCcIlv.exe
  2⤵
  PID:9604
- C:\Windows\System\UrZkEPr.exe
  C:\Windows\System\UrZkEPr.exe
  2⤵
  PID:9632
- C:\Windows\System\aGBdwQs.exe
  C:\Windows\System\aGBdwQs.exe
  2⤵
  PID:9660
- C:\Windows\System\qTtJGDB.exe
  C:\Windows\System\qTtJGDB.exe
  2⤵
  PID:9688
- C:\Windows\System\hRqGxYA.exe
  C:\Windows\System\hRqGxYA.exe
  2⤵
  PID:9716
- C:\Windows\System\WCOfLzE.exe
  C:\Windows\System\WCOfLzE.exe
  2⤵
  PID:9744
- C:\Windows\System\fxcsKCa.exe
  C:\Windows\System\fxcsKCa.exe
  2⤵
  PID:9772
- C:\Windows\System\lMwdUwE.exe
  C:\Windows\System\lMwdUwE.exe
  2⤵
  PID:9800
- C:\Windows\System\huxNPTQ.exe
  C:\Windows\System\huxNPTQ.exe
  2⤵
  PID:9828
- C:\Windows\System\akTCHYU.exe
  C:\Windows\System\akTCHYU.exe
  2⤵
  PID:9856
- C:\Windows\System\ZwLGNIq.exe
  C:\Windows\System\ZwLGNIq.exe
  2⤵
  PID:9884
- C:\Windows\System\tltNeGI.exe
  C:\Windows\System\tltNeGI.exe
  2⤵
  PID:9912
- C:\Windows\System\VZKKgJs.exe
  C:\Windows\System\VZKKgJs.exe
  2⤵
  PID:9940
- C:\Windows\System\BiZLeru.exe
  C:\Windows\System\BiZLeru.exe
  2⤵
  PID:9968
- C:\Windows\System\dVuNFoV.exe
  C:\Windows\System\dVuNFoV.exe
  2⤵
  PID:9996
- C:\Windows\System\uGJDsNt.exe
  C:\Windows\System\uGJDsNt.exe
  2⤵
  PID:10024
- C:\Windows\System\CGOiYPA.exe
  C:\Windows\System\CGOiYPA.exe
  2⤵
  PID:10052
- C:\Windows\System\ffFVFXh.exe
  C:\Windows\System\ffFVFXh.exe
  2⤵
  PID:10080
- C:\Windows\System\hfrJzvo.exe
  C:\Windows\System\hfrJzvo.exe
  2⤵
  PID:10108
- C:\Windows\System\kZURtaj.exe
  C:\Windows\System\kZURtaj.exe
  2⤵
  PID:10136
- C:\Windows\System\RilEOOM.exe
  C:\Windows\System\RilEOOM.exe
  2⤵
  PID:10164
- C:\Windows\System\CLuarax.exe
  C:\Windows\System\CLuarax.exe
  2⤵
  PID:10192
- C:\Windows\System\NSXdyBq.exe
  C:\Windows\System\NSXdyBq.exe
  2⤵
  PID:10220
- C:\Windows\System\JiScRoz.exe
  C:\Windows\System\JiScRoz.exe
  2⤵
  PID:9240
- C:\Windows\System\HqlhBaB.exe
  C:\Windows\System\HqlhBaB.exe
  2⤵
  PID:9300
- C:\Windows\System\uQYrFVP.exe
  C:\Windows\System\uQYrFVP.exe
  2⤵
  PID:9372
- C:\Windows\System\hHNPNkI.exe
  C:\Windows\System\hHNPNkI.exe
  2⤵
  PID:9456
- C:\Windows\System\ThfDJai.exe
  C:\Windows\System\ThfDJai.exe
  2⤵
  PID:9516
- C:\Windows\System\Nbpycyz.exe
  C:\Windows\System\Nbpycyz.exe
  2⤵
  PID:9592
- C:\Windows\System\whlSKPU.exe
  C:\Windows\System\whlSKPU.exe
  2⤵
  PID:9652
- C:\Windows\System\OPAhUle.exe
  C:\Windows\System\OPAhUle.exe
  2⤵
  PID:9712
- C:\Windows\System\fyGODbK.exe
  C:\Windows\System\fyGODbK.exe
  2⤵
  PID:9792
- C:\Windows\System\ApOVidE.exe
  C:\Windows\System\ApOVidE.exe
  2⤵
  PID:9852
- C:\Windows\System\TRGULKu.exe
  C:\Windows\System\TRGULKu.exe
  2⤵
  PID:9924
- C:\Windows\System\aGHpPie.exe
  C:\Windows\System\aGHpPie.exe
  2⤵
  PID:9988
- C:\Windows\System\WRNhJco.exe
  C:\Windows\System\WRNhJco.exe
  2⤵
  PID:10064
- C:\Windows\System\YSPwMDV.exe
  C:\Windows\System\YSPwMDV.exe
  2⤵
  PID:10128
- C:\Windows\System\jkJcahN.exe
  C:\Windows\System\jkJcahN.exe
  2⤵
  PID:10188
- C:\Windows\System\ReCwbwn.exe
  C:\Windows\System\ReCwbwn.exe
  2⤵
  PID:9260
- C:\Windows\System\mUPFddx.exe
  C:\Windows\System\mUPFddx.exe
  2⤵
  PID:9416
- C:\Windows\System\drWWAvx.exe
  C:\Windows\System\drWWAvx.exe
  2⤵
  PID:9568
- C:\Windows\System\EhrBekI.exe
  C:\Windows\System\EhrBekI.exe
  2⤵
  PID:9680
- C:\Windows\System\VyMeiIv.exe
  C:\Windows\System\VyMeiIv.exe
  2⤵
  PID:9768
- C:\Windows\System\CRRTYMJ.exe
  C:\Windows\System\CRRTYMJ.exe
  2⤵
  PID:9880
- C:\Windows\System\jWJKaiU.exe
  C:\Windows\System\jWJKaiU.exe
  2⤵
  PID:10048
- C:\Windows\System\vsXkNTC.exe
  C:\Windows\System\vsXkNTC.exe
  2⤵
  PID:9504
- C:\Windows\System\bYtlHGI.exe
  C:\Windows\System\bYtlHGI.exe
  2⤵
  PID:9908
- C:\Windows\System\hFPRGHu.exe
  C:\Windows\System\hFPRGHu.exe
  2⤵
  PID:10216
- C:\Windows\System\KBShXwL.exe
  C:\Windows\System\KBShXwL.exe
  2⤵
  PID:10156
- C:\Windows\System\GJIvPUn.exe
  C:\Windows\System\GJIvPUn.exe
  2⤵
  PID:10248
- C:\Windows\System\LCMNfNW.exe
  C:\Windows\System\LCMNfNW.exe
  2⤵
  PID:10276
- C:\Windows\System\WhVmKEN.exe
  C:\Windows\System\WhVmKEN.exe
  2⤵
  PID:10304
- C:\Windows\System\lklTKJs.exe
  C:\Windows\System\lklTKJs.exe
  2⤵
  PID:10332
- C:\Windows\System\dWUtHRL.exe
  C:\Windows\System\dWUtHRL.exe
  2⤵
  PID:10360
- C:\Windows\System\KToHlgz.exe
  C:\Windows\System\KToHlgz.exe
  2⤵
  PID:10388
- C:\Windows\System\DLHuhDX.exe
  C:\Windows\System\DLHuhDX.exe
  2⤵
  PID:10416
- C:\Windows\System\cBYfAaR.exe
  C:\Windows\System\cBYfAaR.exe
  2⤵
  PID:10444
- C:\Windows\System\yRFCuUF.exe
  C:\Windows\System\yRFCuUF.exe
  2⤵
  PID:10472
- C:\Windows\System\yFIkrfB.exe
  C:\Windows\System\yFIkrfB.exe
  2⤵
  PID:10500
- C:\Windows\System\FLbfrZY.exe
  C:\Windows\System\FLbfrZY.exe
  2⤵
  PID:10528
- C:\Windows\System\KxZrZCJ.exe
  C:\Windows\System\KxZrZCJ.exe
  2⤵
  PID:10556
- C:\Windows\System\iZIhkfS.exe
  C:\Windows\System\iZIhkfS.exe
  2⤵
  PID:10584
- C:\Windows\System\UkmaOVr.exe
  C:\Windows\System\UkmaOVr.exe
  2⤵
  PID:10612
- C:\Windows\System\rJnJOTq.exe
  C:\Windows\System\rJnJOTq.exe
  2⤵
  PID:10640
- C:\Windows\System\GqgIfRO.exe
  C:\Windows\System\GqgIfRO.exe
  2⤵
  PID:10668
- C:\Windows\System\MNTqaHq.exe
  C:\Windows\System\MNTqaHq.exe
  2⤵
  PID:10696
- C:\Windows\System\ZjqUuhv.exe
  C:\Windows\System\ZjqUuhv.exe
  2⤵
  PID:10724
- C:\Windows\System\UwEkUrl.exe
  C:\Windows\System\UwEkUrl.exe
  2⤵
  PID:10752
- C:\Windows\System\jNaaaBK.exe
  C:\Windows\System\jNaaaBK.exe
  2⤵
  PID:10780
- C:\Windows\System\YPiZGCu.exe
  C:\Windows\System\YPiZGCu.exe
  2⤵
  PID:10808
- C:\Windows\System\shUqokt.exe
  C:\Windows\System\shUqokt.exe
  2⤵
  PID:10836
- C:\Windows\System\SVazaBh.exe
  C:\Windows\System\SVazaBh.exe
  2⤵
  PID:10864
- C:\Windows\System\VNLNUIs.exe
  C:\Windows\System\VNLNUIs.exe
  2⤵
  PID:10892
- C:\Windows\System\ppBrjJk.exe
  C:\Windows\System\ppBrjJk.exe
  2⤵
  PID:10920
- C:\Windows\System\WfVSXJG.exe
  C:\Windows\System\WfVSXJG.exe
  2⤵
  PID:10948
- C:\Windows\System\ZTBtyRB.exe
  C:\Windows\System\ZTBtyRB.exe
  2⤵
  PID:10976
- C:\Windows\System\NPSWOLF.exe
  C:\Windows\System\NPSWOLF.exe
  2⤵
  PID:11004
- C:\Windows\System\sIFzcAJ.exe
  C:\Windows\System\sIFzcAJ.exe
  2⤵
  PID:11032
- C:\Windows\System\JvxmEqN.exe
  C:\Windows\System\JvxmEqN.exe
  2⤵
  PID:11060
- C:\Windows\System\rWnHRTu.exe
  C:\Windows\System\rWnHRTu.exe
  2⤵
  PID:11088
- C:\Windows\System\zYXlzZB.exe
  C:\Windows\System\zYXlzZB.exe
  2⤵
  PID:11116
- C:\Windows\System\LaINqBU.exe
  C:\Windows\System\LaINqBU.exe
  2⤵
  PID:11144
- C:\Windows\System\NsPGhAx.exe
  C:\Windows\System\NsPGhAx.exe
  2⤵
  PID:11172
- C:\Windows\System\nlwcQtq.exe
  C:\Windows\System\nlwcQtq.exe
  2⤵
  PID:11200
- C:\Windows\System\LtLrCUz.exe
  C:\Windows\System\LtLrCUz.exe
  2⤵
  PID:11228
- C:\Windows\System\iVaeOwu.exe
  C:\Windows\System\iVaeOwu.exe
  2⤵
  PID:11256
- C:\Windows\System\bPJxSIu.exe
  C:\Windows\System\bPJxSIu.exe
  2⤵
  PID:10292
- C:\Windows\System\BwjdRwA.exe
  C:\Windows\System\BwjdRwA.exe
  2⤵
  PID:10352
- C:\Windows\System\YEnNHyw.exe
  C:\Windows\System\YEnNHyw.exe
  2⤵
  PID:10412
- C:\Windows\System\oxrRPLb.exe
  C:\Windows\System\oxrRPLb.exe
  2⤵
  PID:10484
- C:\Windows\System\GFxwqRy.exe
  C:\Windows\System\GFxwqRy.exe
  2⤵
  PID:10548
- C:\Windows\System\iagIGNv.exe
  C:\Windows\System\iagIGNv.exe
  2⤵
  PID:10604
- C:\Windows\System\eVNUvJG.exe
  C:\Windows\System\eVNUvJG.exe
  2⤵
  PID:10680
- C:\Windows\System\Rvmopil.exe
  C:\Windows\System\Rvmopil.exe
  2⤵
  PID:10744
- C:\Windows\System\JAUmwba.exe
  C:\Windows\System\JAUmwba.exe
  2⤵
  PID:10804
- C:\Windows\System\IADakQN.exe
  C:\Windows\System\IADakQN.exe
  2⤵
  PID:10876
- C:\Windows\System\IbcdynI.exe
  C:\Windows\System\IbcdynI.exe
  2⤵
  PID:10940
- C:\Windows\System\JPGUovI.exe
  C:\Windows\System\JPGUovI.exe
  2⤵
  PID:11000
- C:\Windows\System\SJZhyFj.exe
  C:\Windows\System\SJZhyFj.exe
  2⤵
  PID:11076
- C:\Windows\System\KqzbyUz.exe
  C:\Windows\System\KqzbyUz.exe
  2⤵
  PID:11136
- C:\Windows\System\pfGWxWD.exe
  C:\Windows\System\pfGWxWD.exe
  2⤵
  PID:11196
- C:\Windows\System\vxwRcSe.exe
  C:\Windows\System\vxwRcSe.exe
  2⤵
  PID:10260
- C:\Windows\System\ZuIsbSR.exe
  C:\Windows\System\ZuIsbSR.exe
  2⤵
  PID:10400
- C:\Windows\System\cHGMQqg.exe
  C:\Windows\System\cHGMQqg.exe
  2⤵
  PID:10544
- C:\Windows\System\alrrQAp.exe
  C:\Windows\System\alrrQAp.exe
  2⤵
  PID:10708
- C:\Windows\System\aLZTfwl.exe
  C:\Windows\System\aLZTfwl.exe
  2⤵
  PID:10856
- C:\Windows\System\QZlpdqc.exe
  C:\Windows\System\QZlpdqc.exe
  2⤵
  PID:10996
- C:\Windows\System\iggfwRf.exe
  C:\Windows\System\iggfwRf.exe
  2⤵
  PID:11132
- C:\Windows\System\TzKfWgb.exe
  C:\Windows\System\TzKfWgb.exe
  2⤵
  PID:10320
- C:\Windows\System\TgEBdQH.exe
  C:\Windows\System\TgEBdQH.exe
  2⤵
  PID:10660
- C:\Windows\System\bycpWSd.exe
  C:\Windows\System\bycpWSd.exe
  2⤵
  PID:10988
- C:\Windows\System\sdJonTr.exe
  C:\Windows\System\sdJonTr.exe
  2⤵
  PID:10520
- C:\Windows\System\jFnUORB.exe
  C:\Windows\System\jFnUORB.exe
  2⤵
  PID:11248
- C:\Windows\System\vDtBSet.exe
  C:\Windows\System\vDtBSet.exe
  2⤵
  PID:3384
- C:\Windows\System\sRVqmCF.exe
  C:\Windows\System\sRVqmCF.exe
  2⤵
  PID:532
- C:\Windows\System\vVrDrnC.exe
  C:\Windows\System\vVrDrnC.exe
  2⤵
  PID:2800
- C:\Windows\System\evytFPs.exe
  C:\Windows\System\evytFPs.exe
  2⤵
  PID:11276
- C:\Windows\System\MJoopjD.exe
  C:\Windows\System\MJoopjD.exe
  2⤵
  PID:11316
- C:\Windows\System\qDwwYzJ.exe
  C:\Windows\System\qDwwYzJ.exe
  2⤵
  PID:11360
- C:\Windows\System\sspVPSa.exe
  C:\Windows\System\sspVPSa.exe
  2⤵
  PID:11388
- C:\Windows\System\jiEwkrH.exe
  C:\Windows\System\jiEwkrH.exe
  2⤵
  PID:11416
- C:\Windows\System\DTwAsMK.exe
  C:\Windows\System\DTwAsMK.exe
  2⤵
  PID:11444
- C:\Windows\System\NrLbUFr.exe
  C:\Windows\System\NrLbUFr.exe
  2⤵
  PID:11472
- C:\Windows\System\YqrwRyW.exe
  C:\Windows\System\YqrwRyW.exe
  2⤵
  PID:11500
- C:\Windows\System\jGKmBVB.exe
  C:\Windows\System\jGKmBVB.exe
  2⤵
  PID:11528
- C:\Windows\System\nQtIskF.exe
  C:\Windows\System\nQtIskF.exe
  2⤵
  PID:11556
- C:\Windows\System\HzuHTwr.exe
  C:\Windows\System\HzuHTwr.exe
  2⤵
  PID:11584
- C:\Windows\System\Scrgxut.exe
  C:\Windows\System\Scrgxut.exe
  2⤵
  PID:11612
- C:\Windows\System\SRKfPCj.exe
  C:\Windows\System\SRKfPCj.exe
  2⤵
  PID:11640
- C:\Windows\System\DOoEFkH.exe
  C:\Windows\System\DOoEFkH.exe
  2⤵
  PID:11668
- C:\Windows\System\VYJFnkZ.exe
  C:\Windows\System\VYJFnkZ.exe
  2⤵
  PID:11696
- C:\Windows\System\oRUkbsD.exe
  C:\Windows\System\oRUkbsD.exe
  2⤵
  PID:11724
- C:\Windows\System\yWLfuWQ.exe
  C:\Windows\System\yWLfuWQ.exe
  2⤵
  PID:11752
- C:\Windows\System\XloVjpT.exe
  C:\Windows\System\XloVjpT.exe
  2⤵
  PID:11780
- C:\Windows\System\pgAQGef.exe
  C:\Windows\System\pgAQGef.exe
  2⤵
  PID:11808
- C:\Windows\System\QiHLTRS.exe
  C:\Windows\System\QiHLTRS.exe
  2⤵
  PID:11836
- C:\Windows\System\rXJwnWz.exe
  C:\Windows\System\rXJwnWz.exe
  2⤵
  PID:11864
- C:\Windows\System\DJqcxTn.exe
  C:\Windows\System\DJqcxTn.exe
  2⤵
  PID:11892
- C:\Windows\System\XHZEZsT.exe
  C:\Windows\System\XHZEZsT.exe
  2⤵
  PID:11920
- C:\Windows\System\IjctvAQ.exe
  C:\Windows\System\IjctvAQ.exe
  2⤵
  PID:11948
- C:\Windows\System\KyRkUwq.exe
  C:\Windows\System\KyRkUwq.exe
  2⤵
  PID:11976
- C:\Windows\System\QZYhKRI.exe
  C:\Windows\System\QZYhKRI.exe
  2⤵
  PID:12004
- C:\Windows\System\szlGwjq.exe
  C:\Windows\System\szlGwjq.exe
  2⤵
  PID:12032
- C:\Windows\System\JOscSQo.exe
  C:\Windows\System\JOscSQo.exe
  2⤵
  PID:12060
- C:\Windows\System\cZgfisk.exe
  C:\Windows\System\cZgfisk.exe
  2⤵
  PID:12088
- C:\Windows\System\mMglXnC.exe
  C:\Windows\System\mMglXnC.exe
  2⤵
  PID:12116
- C:\Windows\System\DimUODO.exe
  C:\Windows\System\DimUODO.exe
  2⤵
  PID:12144
- C:\Windows\System\OIHfjhD.exe
  C:\Windows\System\OIHfjhD.exe
  2⤵
  PID:12172
- C:\Windows\System\qFvtRES.exe
  C:\Windows\System\qFvtRES.exe
  2⤵
  PID:12200
- C:\Windows\System\jtpYwkO.exe
  C:\Windows\System\jtpYwkO.exe
  2⤵
  PID:12228
- C:\Windows\System\jCPJvbM.exe
  C:\Windows\System\jCPJvbM.exe
  2⤵
  PID:12256
- C:\Windows\System\icBpzDd.exe
  C:\Windows\System\icBpzDd.exe
  2⤵
  PID:12284
- C:\Windows\System\JARTurS.exe
  C:\Windows\System\JARTurS.exe
  2⤵
  PID:11336
- C:\Windows\System\ZsRTSRt.exe
  C:\Windows\System\ZsRTSRt.exe
  2⤵
  PID:11400
- C:\Windows\System\swfGfIc.exe
  C:\Windows\System\swfGfIc.exe
  2⤵
  PID:11464
- C:\Windows\System\pWctFoe.exe
  C:\Windows\System\pWctFoe.exe
  2⤵
  PID:11496
- C:\Windows\System\QQvLQOc.exe
  C:\Windows\System\QQvLQOc.exe
  2⤵
  PID:11604
- C:\Windows\System\aJoAXDW.exe
  C:\Windows\System\aJoAXDW.exe
  2⤵
  PID:11664
- C:\Windows\System\DUUPBln.exe
  C:\Windows\System\DUUPBln.exe
  2⤵
  PID:11736
- C:\Windows\System\uzeQTlE.exe
  C:\Windows\System\uzeQTlE.exe
  2⤵
  PID:11800
- C:\Windows\System\LweEHCS.exe
  C:\Windows\System\LweEHCS.exe
  2⤵
  PID:11860
- C:\Windows\System\qDmbucs.exe
  C:\Windows\System\qDmbucs.exe
  2⤵
  PID:11932
- C:\Windows\System\SlpLgsP.exe
  C:\Windows\System\SlpLgsP.exe
  2⤵
  PID:11996
- C:\Windows\System\YpVDYtZ.exe
  C:\Windows\System\YpVDYtZ.exe
  2⤵
  PID:12056
- C:\Windows\System\qLWaJYS.exe
  C:\Windows\System\qLWaJYS.exe
  2⤵
  PID:12136
- C:\Windows\System\JUakciw.exe
  C:\Windows\System\JUakciw.exe
  2⤵
  PID:12192
- C:\Windows\System\HTKfgIu.exe
  C:\Windows\System\HTKfgIu.exe
  2⤵
  PID:12252
- C:\Windows\System\yScZKZr.exe
  C:\Windows\System\yScZKZr.exe
  2⤵
  PID:11356
- C:\Windows\System\KrDEJmG.exe
  C:\Windows\System\KrDEJmG.exe
  2⤵
  PID:11492
- C:\Windows\System\QkqjBoF.exe
  C:\Windows\System\QkqjBoF.exe
  2⤵
  PID:11660
- C:\Windows\System\wFElyjt.exe
  C:\Windows\System\wFElyjt.exe
  2⤵
  PID:11828
- C:\Windows\System\RBsbmic.exe
  C:\Windows\System\RBsbmic.exe
  2⤵
  PID:11972
- C:\Windows\System\NESeFQB.exe
  C:\Windows\System\NESeFQB.exe
  2⤵
  PID:12128
- C:\Windows\System\AwYsZYw.exe
  C:\Windows\System\AwYsZYw.exe
  2⤵
  PID:12280
- C:\Windows\System\NwPcvWg.exe
  C:\Windows\System\NwPcvWg.exe
  2⤵
  PID:11632
- C:\Windows\System\VtEkbtx.exe
  C:\Windows\System\VtEkbtx.exe
  2⤵
  PID:11960
- C:\Windows\System\iPkyTCh.exe
  C:\Windows\System\iPkyTCh.exe
  2⤵
  PID:11440
- C:\Windows\System\EgzqmMW.exe
  C:\Windows\System\EgzqmMW.exe
  2⤵
  PID:12240
- C:\Windows\System\SRhKIwE.exe
  C:\Windows\System\SRhKIwE.exe
  2⤵
  PID:12300
- C:\Windows\System\LvxIlfm.exe
  C:\Windows\System\LvxIlfm.exe
  2⤵
  PID:12328
- C:\Windows\System\vvlGUFb.exe
  C:\Windows\System\vvlGUFb.exe
  2⤵
  PID:12356
- C:\Windows\System\XcSVnRb.exe
  C:\Windows\System\XcSVnRb.exe
  2⤵
  PID:12384
- C:\Windows\System\EVkOTTy.exe
  C:\Windows\System\EVkOTTy.exe
  2⤵
  PID:12412
- C:\Windows\System\FOkZbvF.exe
  C:\Windows\System\FOkZbvF.exe
  2⤵
  PID:12440
- C:\Windows\System\NakASIM.exe
  C:\Windows\System\NakASIM.exe
  2⤵
  PID:12468
- C:\Windows\System\wgrqXIC.exe
  C:\Windows\System\wgrqXIC.exe
  2⤵
  PID:12496
- C:\Windows\System\yXlJQGd.exe
  C:\Windows\System\yXlJQGd.exe
  2⤵
  PID:12524
- C:\Windows\System\FXgcUDq.exe
  C:\Windows\System\FXgcUDq.exe
  2⤵
  PID:12552
- C:\Windows\System\iohaole.exe
  C:\Windows\System\iohaole.exe
  2⤵
  PID:12580
- C:\Windows\System\thtAwZs.exe
  C:\Windows\System\thtAwZs.exe
  2⤵
  PID:12608
- C:\Windows\System\AsCrUpK.exe
  C:\Windows\System\AsCrUpK.exe
  2⤵
  PID:12636
- C:\Windows\System\jbhVoUM.exe
  C:\Windows\System\jbhVoUM.exe
  2⤵
  PID:12664
- C:\Windows\System\gPgDAEm.exe
  C:\Windows\System\gPgDAEm.exe
  2⤵
  PID:12692
- C:\Windows\System\JaOJZOe.exe
  C:\Windows\System\JaOJZOe.exe
  2⤵
  PID:12716
- C:\Windows\System\iGenXlU.exe
  C:\Windows\System\iGenXlU.exe
  2⤵
  PID:12748
- C:\Windows\System\AsQScBI.exe
  C:\Windows\System\AsQScBI.exe
  2⤵
  PID:12768
- C:\Windows\System\aXDFOtH.exe
  C:\Windows\System\aXDFOtH.exe
  2⤵
  PID:12804
- C:\Windows\System\mQZGAel.exe
  C:\Windows\System\mQZGAel.exe
  2⤵
  PID:12832
- C:\Windows\System\CZABmIm.exe
  C:\Windows\System\CZABmIm.exe
  2⤵
  PID:12860
- C:\Windows\System\nwaVLHf.exe
  C:\Windows\System\nwaVLHf.exe
  2⤵
  PID:12884
- C:\Windows\System\dkjmGAQ.exe
  C:\Windows\System\dkjmGAQ.exe
  2⤵
  PID:12916
- C:\Windows\System\xfgtrWI.exe
  C:\Windows\System\xfgtrWI.exe
  2⤵
  PID:12944
- C:\Windows\System\agrAzfA.exe
  C:\Windows\System\agrAzfA.exe
  2⤵
  PID:12972
- C:\Windows\System\TuMYRDe.exe
  C:\Windows\System\TuMYRDe.exe
  2⤵
  PID:12988
- C:\Windows\System\MSpEVwq.exe
  C:\Windows\System\MSpEVwq.exe
  2⤵
  PID:13028
- C:\Windows\System\eYVhccL.exe
  C:\Windows\System\eYVhccL.exe
  2⤵
  PID:13044
- C:\Windows\System\uOcxlCO.exe
  C:\Windows\System\uOcxlCO.exe
  2⤵
  PID:13072
- C:\Windows\System\kXyDuEq.exe
  C:\Windows\System\kXyDuEq.exe
  2⤵
  PID:13100
- C:\Windows\System\PklyHHU.exe
  C:\Windows\System\PklyHHU.exe
  2⤵
  PID:13132
- C:\Windows\System\oUvACua.exe
  C:\Windows\System\oUvACua.exe
  2⤵
  PID:13156
- C:\Windows\System\dkqoJhv.exe
  C:\Windows\System\dkqoJhv.exe
  2⤵
  PID:13184
- C:\Windows\System\LePiUWC.exe
  C:\Windows\System\LePiUWC.exe
  2⤵
  PID:13212
- C:\Windows\System\qqRcjOW.exe
  C:\Windows\System\qqRcjOW.exe
  2⤵
  PID:13252
- C:\Windows\System\VEmYSOT.exe
  C:\Windows\System\VEmYSOT.exe
  2⤵
  PID:13280
- C:\Windows\System\zsJwkDo.exe
  C:\Windows\System\zsJwkDo.exe
  2⤵
  PID:13308
- C:\Windows\System\YEmFlku.exe
  C:\Windows\System\YEmFlku.exe
  2⤵
  PID:12340
- C:\Windows\System\UfAGqMp.exe
  C:\Windows\System\UfAGqMp.exe
  2⤵
  PID:12404
- C:\Windows\System\pSAsWXp.exe
  C:\Windows\System\pSAsWXp.exe
  2⤵
  PID:12464
- C:\Windows\System\vgoWLSC.exe
  C:\Windows\System\vgoWLSC.exe
  2⤵
  PID:12536
- C:\Windows\System\mBVVoUz.exe
  C:\Windows\System\mBVVoUz.exe
  2⤵
  PID:12572
- C:\Windows\System\DsLoMSH.exe
  C:\Windows\System\DsLoMSH.exe
  2⤵
  PID:12660
- C:\Windows\System\FIoVUmM.exe
  C:\Windows\System\FIoVUmM.exe
  2⤵
  PID:12736
- C:\Windows\System\EugPAkP.exe
  C:\Windows\System\EugPAkP.exe
  2⤵
  PID:12792
- C:\Windows\System\WDjnpob.exe
  C:\Windows\System\WDjnpob.exe
  2⤵
  PID:12848
- C:\Windows\System\hLYLdyC.exe
  C:\Windows\System\hLYLdyC.exe
  2⤵
  PID:12900
- C:\Windows\System\qCpLAyW.exe
  C:\Windows\System\qCpLAyW.exe
  2⤵
  PID:12956
- C:\Windows\System\cprCexI.exe
  C:\Windows\System\cprCexI.exe
  2⤵
  PID:13064
- C:\Windows\System\BfjAbDA.exe
  C:\Windows\System\BfjAbDA.exe
  2⤵
  PID:13088
- C:\Windows\System\tlRwwIU.exe
  C:\Windows\System\tlRwwIU.exe
  2⤵
  PID:13152
- C:\Windows\System\fjBEBkh.exe
  C:\Windows\System\fjBEBkh.exe
  2⤵
  PID:13232
- C:\Windows\System\BwMayrs.exe
  C:\Windows\System\BwMayrs.exe
  2⤵
  PID:13296
- C:\Windows\System\xOMXkXT.exe
  C:\Windows\System\xOMXkXT.exe
  2⤵
  PID:12380
- C:\Windows\System\hynobJG.exe
  C:\Windows\System\hynobJG.exe
  2⤵
  PID:12492
- C:\Windows\System\dTogshj.exe
  C:\Windows\System\dTogshj.exe
  2⤵
  PID:12756
- C:\Windows\System\eGZsPXK.exe
  C:\Windows\System\eGZsPXK.exe
  2⤵
  PID:12936
- C:\Windows\System\jyQetwq.exe
  C:\Windows\System\jyQetwq.exe
  2⤵
  PID:13036
- C:\Windows\System\HKciDzo.exe
  C:\Windows\System\HKciDzo.exe
  2⤵
  PID:13200
- C:\Windows\System\GhaNzOF.exe
  C:\Windows\System\GhaNzOF.exe
  2⤵
  PID:12396
- C:\Windows\System\DMDUlDN.exe
  C:\Windows\System\DMDUlDN.exe
  2⤵
  PID:12620
- C:\Windows\System\PiiqCGL.exe
  C:\Windows\System\PiiqCGL.exe
  2⤵
  PID:13148
- C:\Windows\System\xUpxEYD.exe
  C:\Windows\System\xUpxEYD.exe
  2⤵
  PID:12656
- C:\Windows\System\XndjDPR.exe
  C:\Windows\System\XndjDPR.exe
  2⤵
  PID:12320
- C:\Windows\System\dKOyVSO.exe
  C:\Windows\System\dKOyVSO.exe
  2⤵
  PID:13340
- C:\Windows\System\qYXEoUR.exe
  C:\Windows\System\qYXEoUR.exe
  2⤵
  PID:13368
- C:\Windows\System\CQikOdj.exe
  C:\Windows\System\CQikOdj.exe
  2⤵
  PID:13396
- C:\Windows\System\spGYYpU.exe
  C:\Windows\System\spGYYpU.exe
  2⤵
  PID:13424
- C:\Windows\System\huofbzh.exe
  C:\Windows\System\huofbzh.exe
  2⤵
  PID:13452
- C:\Windows\System\MsCCOAc.exe
  C:\Windows\System\MsCCOAc.exe
  2⤵
  PID:13480
- C:\Windows\System\qAwZQBG.exe
  C:\Windows\System\qAwZQBG.exe
  2⤵
  PID:13504
- C:\Windows\System\IXarwaj.exe
  C:\Windows\System\IXarwaj.exe
  2⤵
  PID:13524
- C:\Windows\System\svwzAVv.exe
  C:\Windows\System\svwzAVv.exe
  2⤵
  PID:13564
- C:\Windows\System\ufdUEuM.exe
  C:\Windows\System\ufdUEuM.exe
  2⤵
  PID:13592
- C:\Windows\System\yWSYaNH.exe
  C:\Windows\System\yWSYaNH.exe
  2⤵
  PID:13620
- C:\Windows\System\gKGSaQw.exe
  C:\Windows\System\gKGSaQw.exe
  2⤵
  PID:13636
- C:\Windows\System\lUbHPmW.exe
  C:\Windows\System\lUbHPmW.exe
  2⤵
  PID:13664
- C:\Windows\System\qrFTCNH.exe
  C:\Windows\System\qrFTCNH.exe
  2⤵
  PID:13692
- C:\Windows\System\erGWvOP.exe
  C:\Windows\System\erGWvOP.exe
  2⤵
  PID:13720
- C:\Windows\System\boQjXFQ.exe
  C:\Windows\System\boQjXFQ.exe
  2⤵
  PID:13748
- C:\Windows\System\QZBvqBD.exe
  C:\Windows\System\QZBvqBD.exe
  2⤵
  PID:13776
- C:\Windows\System\PJQppXP.exe
  C:\Windows\System\PJQppXP.exe
  2⤵
  PID:13804
- C:\Windows\System\bRVmYqR.exe
  C:\Windows\System\bRVmYqR.exe
  2⤵
  PID:13844
- C:\Windows\System\QnzpTJS.exe
  C:\Windows\System\QnzpTJS.exe
  2⤵
  PID:13872
- C:\Windows\System\ltwSuEQ.exe
  C:\Windows\System\ltwSuEQ.exe
  2⤵
  PID:13888
- C:\Windows\System\DunQKkx.exe
  C:\Windows\System\DunQKkx.exe
  2⤵
  PID:13924
- C:\Windows\System\yPqAXrb.exe
  C:\Windows\System\yPqAXrb.exe
  2⤵
  PID:13960
- C:\Windows\System\NwnZfBn.exe
  C:\Windows\System\NwnZfBn.exe
  2⤵
  PID:13984
- C:\Windows\System\PBrFvba.exe
  C:\Windows\System\PBrFvba.exe
  2⤵
  PID:14088
- C:\Windows\System\NEMrJoG.exe
  C:\Windows\System\NEMrJoG.exe
  2⤵
  PID:14112
- C:\Windows\System\vaYlAqH.exe
  C:\Windows\System\vaYlAqH.exe
  2⤵
  PID:14136
- C:\Windows\System\grgiQWm.exe
  C:\Windows\System\grgiQWm.exe
  2⤵
  PID:14160
- C:\Windows\System\oHnQjpR.exe
  C:\Windows\System\oHnQjpR.exe
  2⤵
  PID:14176
- C:\Windows\System\RMznkCs.exe
  C:\Windows\System\RMznkCs.exe
  2⤵
  PID:14204
- C:\Windows\System\heKDBwL.exe
  C:\Windows\System\heKDBwL.exe
  2⤵
  PID:14232
- C:\Windows\System\FjXTRJk.exe
  C:\Windows\System\FjXTRJk.exe
  2⤵
  PID:14260
- C:\Windows\System\xXNBISD.exe
  C:\Windows\System\xXNBISD.exe
  2⤵
  PID:14296
- C:\Windows\System\sajkaPr.exe
  C:\Windows\System\sajkaPr.exe
  2⤵
  PID:13364
- C:\Windows\System\IvaJIgt.exe
  C:\Windows\System\IvaJIgt.exe
  2⤵
  PID:13444
- C:\Windows\System\VRhxysr.exe
  C:\Windows\System\VRhxysr.exe
  2⤵
  PID:13492
- C:\Windows\System\ykYPjrq.exe
  C:\Windows\System\ykYPjrq.exe
  2⤵
  PID:13608
- C:\Windows\System\QMEoGYj.exe
  C:\Windows\System\QMEoGYj.exe
  2⤵
  PID:13648
- C:\Windows\System\PxyMfGa.exe
  C:\Windows\System\PxyMfGa.exe
  2⤵
  PID:13740
- C:\Windows\System\gSgNzbz.exe
  C:\Windows\System\gSgNzbz.exe
  2⤵
  PID:13764
- C:\Windows\System\gsbIaGI.exe
  C:\Windows\System\gsbIaGI.exe
  2⤵
  PID:13864
- C:\Windows\System\uKWdRMK.exe
  C:\Windows\System\uKWdRMK.exe
  2⤵
  PID:13956
- C:\Windows\System\jJWTExi.exe
  C:\Windows\System\jJWTExi.exe
  2⤵
  PID:14044
- C:\Windows\System\MLzgANV.exe
  C:\Windows\System\MLzgANV.exe
  2⤵
  PID:14152
- C:\Windows\System\oHpzjXU.exe
  C:\Windows\System\oHpzjXU.exe
  2⤵
  PID:14168
- C:\Windows\System\fgugXaq.exe
  C:\Windows\System\fgugXaq.exe
  2⤵
  PID:14196
- C:\Windows\System\CpXaEyt.exe
  C:\Windows\System\CpXaEyt.exe
  2⤵
  PID:14228
- C:\Windows\System\RDBNUxf.exe
  C:\Windows\System\RDBNUxf.exe
  2⤵
  PID:13336
- C:\Windows\System\PCXjKMx.exe
  C:\Windows\System\PCXjKMx.exe
  2⤵
  PID:13716
- C:\Windows\System\ScNIbZG.exe
  C:\Windows\System\ScNIbZG.exe
  2⤵
  PID:13900
- C:\Windows\System\FLaTmDz.exe
  C:\Windows\System\FLaTmDz.exe
  2⤵
  PID:13992
- C:\Windows\System\fqnuwhP.exe
  C:\Windows\System\fqnuwhP.exe
  2⤵
  PID:13388
- C:\Windows\System\aLflSWh.exe
  C:\Windows\System\aLflSWh.exe
  2⤵
  PID:13584
- C:\Windows\System\SjDvhnK.exe
  C:\Windows\System\SjDvhnK.exe
  2⤵
  PID:13948
- C:\Windows\System\IFoofoI.exe
  C:\Windows\System\IFoofoI.exe
  2⤵
  PID:14280
- C:\Windows\System\FJzosyD.exe
  C:\Windows\System\FJzosyD.exe
  2⤵
  PID:14128
- C:\Windows\System\hcUrjZP.exe
  C:\Windows\System\hcUrjZP.exe
  2⤵
  PID:14364
- C:\Windows\System\sgcxBub.exe
  C:\Windows\System\sgcxBub.exe
  2⤵
  PID:14392
- C:\Windows\System\HZzYYpv.exe
  C:\Windows\System\HZzYYpv.exe
  2⤵
  PID:14416
- C:\Windows\System\NyWTNjT.exe
  C:\Windows\System\NyWTNjT.exe
  2⤵
  PID:14448
- C:\Windows\System\EPSDjUQ.exe
  C:\Windows\System\EPSDjUQ.exe
  2⤵
  PID:14464
- C:\Windows\System\GwidkFZ.exe
  C:\Windows\System\GwidkFZ.exe
  2⤵
  PID:14492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AOBeBvc.exe

Filesize
2.2MB

MD5
86131ab1282ed3eca2efb619d1319c97

SHA1
e393ba130b7d38e02d15f839e9acbb0a8da918d7

SHA256
d79ce3b6ae17150857b00f9a4fca8e9996f924dcbdb43e472604bb95270215c9

SHA512
1cc301b06ea821d4cfa7d7007d88ee12c92b24340aedf194f5621896174ddabb94488c4b229f5a9a0c129b9f25cd2c89635abe819d7c69a0cdcdcb2e2eb42981

Download Submit
C:\Windows\System\AaQKkjT.exe

Filesize
2.2MB

MD5
fd2e3c81562275a369a9715edfb8e3c3

SHA1
e2f8fe5c34e14502a80d7fb2c69776583fd8ae67

SHA256
bbdcdcd78b3842e3a4d454b9674bbb46b58cf6d5b6506f75c0f7dabfba2579d5

SHA512
337f21fca162ca5a314f936d334cb9964f5e1cfd599cc27704ccac356eac618c41db531d5e4fbc0307258dd204414472ed062d56c7676c5137dd72443ece87e5

Download Submit
C:\Windows\System\CbtPozW.exe

Filesize
2.2MB

MD5
558ddc6f80dcb4a32d1b2501e55b693b

SHA1
6784745902f30584fc3f33f4a3e653282c5f910e

SHA256
2ce58e1dbdf578111e91580cb95490ec16ef01b341d34684b7bc032da3186264

SHA512
c14cb9b14540c9e320fbed23c73c99c23fd45922fd0692b0cae66e8edc6de1e9db739b9a36325405eb9be6e17c8449fa6080a355da68e157c9a2eb604812fd60

Download Submit
C:\Windows\System\DayWvtO.exe

Filesize
2.2MB

MD5
94b0040d676bc5c89666ac8b92794a95

SHA1
f05f72ff92ed3163feccd0fdecb11d2b8e71f9e8

SHA256
17e245df3b740bbbf55de390644e0495992f12adc62675062332461e57cff973

SHA512
19c8941da7371c8163c8f4c4fbc7fa9d887d4d296e09d628068b4b9efbf5a16c30f25c2339b00080bb644ca5655c38bc40665be82deffbc61fb45071987b87a0

Download Submit
C:\Windows\System\EnVygDi.exe

Filesize
2.2MB

MD5
8d79b2c736280ee47e96936b378646e6

SHA1
237866544c59db003a443815cf8c327d028bdd95

SHA256
b7eadca03a092714538651a12f8c05a94c52c3a1e1a371a38d5308dc46849986

SHA512
93cb05809a510a5e48e5e2bc34a6635af1802f63484c02c9d2a95b2ce9686213e1b95c55b9d4bdd42d4afb3a38568faf1929d754bfc88b698dafe20a65bfacb8

Download Submit
C:\Windows\System\FiBxSSt.exe

Filesize
2.2MB

MD5
e69e4584a74f4fc7ba04de7354dce95d

SHA1
1987201d4c12df95c56822378d313149b8119a1c

SHA256
7ebc455fef794efc90f40cb27d7367b60274c6e4317d41fef31ee4d95b2b3368

SHA512
822244fe212ff4fbed4debe3ddfb3ad98f2d2f223c154f64adc46d49d39799a3de482f34ac8a57553a59767154f75996713baf89494b65199c04a3b6ed41f678

Download Submit
C:\Windows\System\JCYmMMP.exe

Filesize
2.2MB

MD5
3cc89245656c89c0f43f3a2fa02cd008

SHA1
43b5015c53eced5281a4b82f05c0e97eb3b9113a

SHA256
c1d1d2e1b57500186ebfecfce9b2869a8f349e346abc2d8930bbbe9f96a20002

SHA512
6e4f2be1856a38835f1541ad73c48d8b498135a9516b1d9c87941dfdd62034ae20c65a31e4325fca015df26a2906e685bb9dcd2541fde470f595cf26d4c1e94f

Download Submit
C:\Windows\System\KNvBwmI.exe

Filesize
2.2MB

MD5
e4f8e1ade5637129a3d278981981f21e

SHA1
79bb1be424075f55a3c6b457b2049a82a4294187

SHA256
73e54983a644ae9d03363e3e884a9957f3af9746ec3f74cbc4df8eedc16ec22b

SHA512
a3d05dd6411bd8df12f85f09e55d2864b6e7abf1b3b6c8114146e9a8bef970f8803d4d8cdb1c6fed3698d24891d6e2ec58c475127b3c9411e228ea405467d326

Download Submit
C:\Windows\System\LDkeqzd.exe

Filesize
2.2MB

MD5
8fac7e48aaaf75ba7ad88c3194bdac51

SHA1
e7dbbb5f72c7e10a64fc8dfc0df70bd39510a3c5

SHA256
334d65220e8f2d5d20c7036ebc8b85194f22aa32dee4668f952848b463315952

SHA512
5061ee93c8e55c0b29f2347eda28987eb19174eb84558e99d660e528e41b7069219ca48856da42e76e9fbe21f2c33e9b7ad4a4dbac969a56882bb24a4d690dd7

Download Submit
C:\Windows\System\NjXkUEe.exe

Filesize
2.2MB

MD5
ef6102d613263755d02c89252aba5e7e

SHA1
0fd2ede2810dd0a60fda2044a3e600198abbeae5

SHA256
948721ef2ea14511251833c58da3313232873e2d214bf645fcaeaf332d9a7ef2

SHA512
c1d562987587c00887bea41dd5504ed6943a63081e09d35ce67778a7fe44e8c59ba020afb31dc2467f6f2911aee9c392bae52ca5b3261fb3b8e0a836ace1f491

Download Submit
C:\Windows\System\OaQMDWI.exe

Filesize
2.2MB

MD5
fce8f75ceee46bd978240d7a1244388e

SHA1
75c12bbdc3dc64d84c2f352d713fa21e42365ddb

SHA256
6ceb085221d8df404bd8b4b04f9900aa1fa3ac81e7e9ca0d3e1e61a42b6dd840

SHA512
80c8ab4964b263d33afef42d1e190d3dd3d8ff27f320c2032c9b67aac0a6cc4f9a1aecbb559669f08952cdf4ec5ac672e6c4727874262395c16921bfee61c026

Download Submit
C:\Windows\System\QrELjUE.exe

Filesize
2.2MB

MD5
e815269edcb6a9d399db26c34f8e61d1

SHA1
2e53d4e1b597c2a1627aa20a0d3e7dfe681c9920

SHA256
ec1e2cc597dd232740e6743d4e8936bc4a9be5b62c76ead9a0017a3c19f2183c

SHA512
63efcb30ea6411e237a56c429d181692bef24bbd1a4b19a158717c9e0b083641e1ce4dd735fdbf40c1c0e51baf1ed6f74b6c355ab25cd7478c75e5e96cc5863f

Download Submit
C:\Windows\System\RUDNCTP.exe

Filesize
2.2MB

MD5
a56541a68dc542184fc61c6994b0a369

SHA1
ebea32b4687be54d690e5ab516d121c7e0c19ea8

SHA256
fec51513e605c564aa879e628bd07bee5b7bda35dc638bf1fdc3ce97dd0c77b0

SHA512
ecd94e8cade605da83fcec51acc5d3334ed8f66ddec88648fc18de418ef3b1017db5bfa26b4ca9d031261ed3d8415fc651d448d3b30537790ccbdff689505137

Download Submit
C:\Windows\System\SuaVHfe.exe

Filesize
2.2MB

MD5
ef85d2d31099655543cbe753dcba1a84

SHA1
dacc61742b71ea1de6ef96fd94fccd0f1ba62407

SHA256
3dc9776cb44bac2c109856b8274e68d49016c6d72f0256205ca70105c66354b0

SHA512
1391b42086c03ba66450f8b7b0b4fd22106d31dccd442962a876d2b804d983bb9feae819d5a85db99c541e7fccc1843a2d1ceeabdb06b6c36d27f7d8d007cc22

Download Submit
C:\Windows\System\Tcodida.exe

Filesize
2.2MB

MD5
c6f6ac997c5694109ecd8de6094f14b0

SHA1
64b160a60831b57a960196d3c685326f3857511b

SHA256
97d1d0fa762a8be3aaf5cdb9ea55e2a588f2c99c25f2cbbb394323251c29429d

SHA512
07f5c4c8e879ccb421e331713e11721d123505d97a5999bd39d09bce1c9cc6dd4876bb3ada623716026802717fca65230f03b03fc3a2332e765c769326c0d32e

Download Submit
C:\Windows\System\TlUKFDI.exe

Filesize
2.2MB

MD5
01e9b1ea9c48368fd20dec830609d72b

SHA1
c03409f9203e5bfecf0ccf3c47af4f2e2d9aeced

SHA256
1b0f9eecf85e4fb73b5d2970b22f54d4fd29b06343ee100c39c07c37afbeb759

SHA512
dc8296ff5391b378fd86169bd2195f48b5fbd975c03090ab4ab6d2a8d79b77639e6ba44438631b9b8dfbfb08583182a0d45a8ab88903c6ac05b493ab623c2282

Download Submit
C:\Windows\System\TsQMJJu.exe

Filesize
2.2MB

MD5
a279fbef88a8935e931b519864d3438d

SHA1
61d3581bb7b2b0ef1beaf262b1d1eb87f2d73233

SHA256
d84cf50e6d9570f5b903aebad881d33e5eb22186c0d1cd496133dc86c1170883

SHA512
a4a5d721d7a4c63c80b194752b1c158877389e8b8270d4cade1886600bc880d43b0739730bede6084003c45c9ed70818a14ccf537143fd5b7a7e0aa200716971

Download Submit
C:\Windows\System\URcqxuM.exe

Filesize
2.2MB

MD5
0c03cef8b5e7a703d317b9a19011b453

SHA1
6f96051324006e41600e24659366b792536c3819

SHA256
c6a179f826d80b555f6cecb74be1ef4b9f4d3f4862febf8339d59f4a05f055e7

SHA512
ab4121927b6a8c76c84bfe93c4246c4bb12a769098481051a7bae7dc8fb4e43941559e5b7d88eda8e76be9a34c81aa6a764c9ea6e9ff94e8c313a2f4dee1a9e8

Download Submit
C:\Windows\System\dCrxQGA.exe

Filesize
2.2MB

MD5
6c56568541270d3337761ef675de2b70

SHA1
ee6a7a3c15252db4bf0a258e7c61669a1cb67241

SHA256
aaf025c57d0b4e93c853245553e1203694152fe101107199bebec5c695121306

SHA512
d258564d25dd530d414198cc42b969b74afbfa94e8c14d798944fdec0e0ac947c343a05240a69deafac05de552814ae49aaba4a1915820439d449e2649a4705a

Download Submit
C:\Windows\System\fqlsaNM.exe

Filesize
2.2MB

MD5
30811bad96d7488fa4f442573bb36a2c

SHA1
2a7d1261695a117475637153a7f07fae8cc29c64

SHA256
abf5b4c6e41b4cae508f4e14a5dc9c094ce15215970c19212faea91ca7ecdb5e

SHA512
3f2a1dbb917b6da646a3b70bad92a6c0dce3423212cd165d937742390657bb9f3f15e288ab31257922db4e3d1ddb86e6625e17b0b2a777b8dddc3f76c4dc5802

Download Submit
C:\Windows\System\fyLhFSz.exe

Filesize
2.2MB

MD5
1d7903f37bab0b38026cf49f13057b8b

SHA1
2aa43d548d56f8528b8a180599f26530b85091cb

SHA256
ec5486d69d60f332c2b4bf71c91a0a9ebd90761cac6b3ad9db623789dc90e681

SHA512
af9457528309990b6c25598543093e972258508095c094984843412459c203f6b30495de5d35edad4cffb0603546555185d49fd3175f5f8029d06037241ccb80

Download Submit
C:\Windows\System\latoxhd.exe

Filesize
2.2MB

MD5
b2f3ce1596daa2f9167ed3e9db1d94fd

SHA1
ebc6bd3c096adfab1fec8ab31b2d1a658bda5b80

SHA256
2c783a3201de2bfe1f42781de3cc7b2d9f2cea4e79689c5500652c6d2c5c629f

SHA512
65789fb8d2c380d97723f5ba064d5f1c6b6eed875c17daf3f59545a348351fae17bd242e51bbec4cb69cb27151826036a82c7f377b0e5416fa909a0dd86f6e7f

Download Submit
C:\Windows\System\lqLGcDH.exe

Filesize
2.2MB

MD5
ff586938d3f1c637f6b343196ea4c469

SHA1
fedfaf1bdd585f1879e981cd61f0297fadd4f591

SHA256
a4926aa1f71157c10ce92a2c017d4f6065b59e7c4fbbcddba70d27a81c3fa86c

SHA512
9a25b9b32b9135ad1f9b40f4d3fa878488c286be455caebb2a2ecb5672a0a508184de6cd134c16a0dc59580326883aced5f9a889e85f02d371b697b9aee47e43

Download Submit
C:\Windows\System\mRJNFoi.exe

Filesize
2.2MB

MD5
e8b637817bd135054f43d3ea77a4bf8c

SHA1
e3155993a5204d2f1fc80250bcf90aa8f6b6226a

SHA256
b223b39058eb08d1221fc645a055f52f319662842d98bbadb24c063e47e13cd6

SHA512
f16e1910916f44658e9e4dc6f179f3cc4a83511d762813767ff199e418a3badfde9c2e74a4acbc34ee4637b3d8a54fcb7f8c1a9d392a17c42e20a0860af3d7c5

Download Submit
C:\Windows\System\oiUGAEQ.exe

Filesize
2.2MB

MD5
d7f2de3b57cfdab603759b66a6f92f58

SHA1
45900237b31cf039b082d34da2c836b2d89ad0d3

SHA256
a4eea38165da66ae2ef319d361ee0ba5109286659aaa5759cae941ce26e1038b

SHA512
b2326afe5eaeada06f71b6dbe068f087aec1817b137efdcad5eaf468b5d273fad94b6674553d478ec59f44c3b70b8ffd034196cdeef95d3279b0a8faf01af8c2

Download Submit
C:\Windows\System\pbpNowA.exe

Filesize
2.2MB

MD5
7fe00f38ec3634093f9225dc3bf2f8d7

SHA1
c60e2538f0d364891d93aedca1ef688867fa5165

SHA256
8d0027bcbc0110f484083896ae839e02f06d52792514b88a475113bd5d0d7aa4

SHA512
284d6fc81ed95a827e5667a74f99a08a98ba353cea1141549f4b8ba8d7a630eeecf4c31ec9c7f1462b122f47c5cb5b6a6791a6af9e064bc013d9ad9729c30378

Download Submit
C:\Windows\System\pkhisHW.exe

Filesize
2.2MB

MD5
87ffb1448e6dcb8052d55b7cb8a6f14e

SHA1
cf134eefbe686584eac32d1850a62a3841790d7d

SHA256
0d477b68456b3f5f0e7415f3622a375a60fa2666a717335c5a2f0fb785509be2

SHA512
b36bbc8e229d41b4af86e966bf9aa4570a63bbe4d697542248d25e2cb5696bb41b6dc241d276464eb910e84e95b7776fbaaa74f74f473775032d848d927e9cd5

Download Submit
C:\Windows\System\tKjzsVk.exe

Filesize
2.2MB

MD5
6e858d5b8b0f86214150afdaa151828f

SHA1
cf151ff9e839f918825bb3907e2d36ffab2d5083

SHA256
1fac3e9d4289c0d8207d1e35ece97bb5e1491f3b4bfb81e85fdcaf0e6c2ae589

SHA512
ade81c3f8f966c9e26f84f8b644ba2e141233949b8bcfe06bbf9d4de66307a7762a434bef8837654d336704e40bc8f06dd18ef772a108c519be07c4940cd4ea5

Download Submit
C:\Windows\System\tOxWtDh.exe

Filesize
2.2MB

MD5
c3c0daf19c1e591769efa41141734770

SHA1
6261b0ba1d922dbbe7409f4eb299c8b049e48674

SHA256
fa3d831a3f3744e4dbf77c6dcb6552f2931189f13713b74ca0be4c6652761d9c

SHA512
3b40f038a90bddd574921eefbac7c342412ed39a32829aa5323f65f4f0842d2042a4a31e3cd08ff0896f03f18a41334239c97f18fdc8862c5770c6ba5e82874b

Download Submit
C:\Windows\System\uJOnVEb.exe

Filesize
2.2MB

MD5
a0b864b089a223d4eb1a0332a7dd1ec0

SHA1
bc0ebb84bc87a92959b3e4e87f261e2810ce4211

SHA256
fc19b006502b9853fc3180eb39122d79c5d0178bd31e52d7cc976db7b8c8470f

SHA512
b332678f098f4bb6f4bc66aab09808a9219be32bd0076109c6a56813b4a92891525f5d5b496938637a1c1a910a21aabdf36baa5f6610bfe874a757c8ad380b8f

Download Submit
C:\Windows\System\wFjIWHl.exe

Filesize
2.2MB

MD5
9a12c791a76adad3f23e5fffecfd75c5

SHA1
3dcb54de994449e69000de44fbca97d5ff223a28

SHA256
53d20d18c6d1278cec53f2fcca6d3a0174d5872d35cb905bb95648001314a9ea

SHA512
8328241ee133a74c3ae8d47ec22b47fc7914e5c15ca3a5e0eae987542ee5b01ebdabf0bdbb2d0c7774ea738bb98504360f78e8985b27353401d8a497e2c0dd09

Download Submit
C:\Windows\System\wbEExJS.exe

Filesize
2.2MB

MD5
e48d336a35458925b991e541835eb264

SHA1
c23e52ea542bd51763bf246a2b99df36b68f7acd

SHA256
f2f5622ef6cc931bc7810335d7689db35d2202035d03e0ce75a6db4d2b3b0f6b

SHA512
20f1bc3e4f36e404cdb1c113090a1669d56e2e1d3159399264f376e671654be10760ff7b2ed3c0100de2585eb181265de32358bd25d27fe0f5180b77fedbc80d

Download Submit
C:\Windows\System\zWhwPGw.exe

Filesize
2.2MB

MD5
cc951fee0d3d257c8a8e649c27486294

SHA1
69640d5831d66c94a92aaff58e9fc9aa98dd0665

SHA256
43c88ce8bd0b79bee57c514293185d88cadea1f1f6e8a11199b47fb858a1b1d0

SHA512
c6e458f0adeb0e70ca43498a48fcdabd4119ab9e8aa18628c6ff240bcf6146fc6f036ff952f10c8ae2484b103a359427f889aaf6b81c6b60c3f570850e7d4313

Download Submit
memory/436-557-0x00007FF6F2A50000-0x00007FF6F2DA4000-memory.dmp

Filesize
3.3MB

Download
memory/436-2093-0x00007FF6F2A50000-0x00007FF6F2DA4000-memory.dmp

Filesize
3.3MB

Download
memory/448-2108-0x00007FF76D4A0000-0x00007FF76D7F4000-memory.dmp

Filesize
3.3MB

Download
memory/448-536-0x00007FF76D4A0000-0x00007FF76D7F4000-memory.dmp

Filesize
3.3MB

Download
memory/1420-2101-0x00007FF63D370000-0x00007FF63D6C4000-memory.dmp

Filesize
3.3MB

Download
memory/1420-530-0x00007FF63D370000-0x00007FF63D6C4000-memory.dmp

Filesize
3.3MB

Download
memory/1836-11-0x00007FF6D5E20000-0x00007FF6D6174000-memory.dmp

Filesize
3.3MB

Download
memory/1836-2087-0x00007FF6D5E20000-0x00007FF6D6174000-memory.dmp

Filesize
3.3MB

Download
memory/1912-535-0x00007FF670110000-0x00007FF670464000-memory.dmp

Filesize
3.3MB

Download
memory/1912-2110-0x00007FF670110000-0x00007FF670464000-memory.dmp

Filesize
3.3MB

Download
memory/2068-518-0x00007FF78D960000-0x00007FF78DCB4000-memory.dmp

Filesize
3.3MB

Download
memory/2068-2098-0x00007FF78D960000-0x00007FF78DCB4000-memory.dmp

Filesize
3.3MB

Download
memory/2492-2088-0x00007FF6B7030000-0x00007FF6B7384000-memory.dmp

Filesize
3.3MB

Download
memory/2492-2084-0x00007FF6B7030000-0x00007FF6B7384000-memory.dmp

Filesize
3.3MB

Download
memory/2492-15-0x00007FF6B7030000-0x00007FF6B7384000-memory.dmp

Filesize
3.3MB

Download
memory/2508-2115-0x00007FF76C770000-0x00007FF76CAC4000-memory.dmp

Filesize
3.3MB

Download
memory/2508-537-0x00007FF76C770000-0x00007FF76CAC4000-memory.dmp

Filesize
3.3MB

Download
memory/2588-2092-0x00007FF6F50C0000-0x00007FF6F5414000-memory.dmp

Filesize
3.3MB

Download
memory/2588-2086-0x00007FF6F50C0000-0x00007FF6F5414000-memory.dmp

Filesize
3.3MB

Download
memory/2588-32-0x00007FF6F50C0000-0x00007FF6F5414000-memory.dmp

Filesize
3.3MB

Download
memory/2864-539-0x00007FF6EB080000-0x00007FF6EB3D4000-memory.dmp

Filesize
3.3MB

Download
memory/2864-2113-0x00007FF6EB080000-0x00007FF6EB3D4000-memory.dmp

Filesize
3.3MB

Download
memory/2884-2109-0x00007FF7E94B0000-0x00007FF7E9804000-memory.dmp

Filesize
3.3MB

Download
memory/2884-554-0x00007FF7E94B0000-0x00007FF7E9804000-memory.dmp

Filesize
3.3MB

Download
memory/2992-2090-0x00007FF6D9F40000-0x00007FF6DA294000-memory.dmp

Filesize
3.3MB

Download
memory/2992-28-0x00007FF6D9F40000-0x00007FF6DA294000-memory.dmp

Filesize
3.3MB

Download
memory/2992-2085-0x00007FF6D9F40000-0x00007FF6DA294000-memory.dmp

Filesize
3.3MB

Download
memory/3276-2100-0x00007FF762FB0000-0x00007FF763304000-memory.dmp

Filesize
3.3MB

Download
memory/3276-531-0x00007FF762FB0000-0x00007FF763304000-memory.dmp

Filesize
3.3MB

Download
memory/3640-1-0x000002732F520000-0x000002732F530000-memory.dmp

Filesize
64KB

Download
memory/3640-0-0x00007FF6712B0000-0x00007FF671604000-memory.dmp

Filesize
3.3MB

Download
memory/3888-2094-0x00007FF722B10000-0x00007FF722E64000-memory.dmp

Filesize
3.3MB

Download
memory/3888-507-0x00007FF722B10000-0x00007FF722E64000-memory.dmp

Filesize
3.3MB

Download
memory/4280-2112-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp

Filesize
3.3MB

Download
memory/4280-549-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp

Filesize
3.3MB

Download
memory/4348-533-0x00007FF6CF940000-0x00007FF6CFC94000-memory.dmp

Filesize
3.3MB

Download
memory/4348-2106-0x00007FF6CF940000-0x00007FF6CFC94000-memory.dmp

Filesize
3.3MB

Download
memory/4352-2103-0x00007FF63ADC0000-0x00007FF63B114000-memory.dmp

Filesize
3.3MB

Download
memory/4352-532-0x00007FF63ADC0000-0x00007FF63B114000-memory.dmp

Filesize
3.3MB

Download
memory/4368-2099-0x00007FF621340000-0x00007FF621694000-memory.dmp

Filesize
3.3MB

Download
memory/4368-526-0x00007FF621340000-0x00007FF621694000-memory.dmp

Filesize
3.3MB

Download
memory/4596-2097-0x00007FF6A1E10000-0x00007FF6A2164000-memory.dmp

Filesize
3.3MB

Download
memory/4596-513-0x00007FF6A1E10000-0x00007FF6A2164000-memory.dmp

Filesize
3.3MB

Download
memory/4648-2114-0x00007FF691550000-0x00007FF6918A4000-memory.dmp

Filesize
3.3MB

Download
memory/4648-538-0x00007FF691550000-0x00007FF6918A4000-memory.dmp

Filesize
3.3MB

Download
memory/4656-553-0x00007FF777CB0000-0x00007FF778004000-memory.dmp

Filesize
3.3MB

Download
memory/4656-2111-0x00007FF777CB0000-0x00007FF778004000-memory.dmp

Filesize
3.3MB

Download
memory/4704-2096-0x00007FF6BDE60000-0x00007FF6BE1B4000-memory.dmp

Filesize
3.3MB

Download
memory/4704-515-0x00007FF6BDE60000-0x00007FF6BE1B4000-memory.dmp

Filesize
3.3MB

Download
memory/4772-527-0x00007FF613D60000-0x00007FF6140B4000-memory.dmp

Filesize
3.3MB

Download
memory/4772-2105-0x00007FF613D60000-0x00007FF6140B4000-memory.dmp

Filesize
3.3MB

Download
memory/4824-534-0x00007FF7C1F50000-0x00007FF7C22A4000-memory.dmp

Filesize
3.3MB

Download
memory/4824-2107-0x00007FF7C1F50000-0x00007FF7C22A4000-memory.dmp

Filesize
3.3MB

Download
memory/4916-2095-0x00007FF6BFDD0000-0x00007FF6C0124000-memory.dmp

Filesize
3.3MB

Download
memory/4916-510-0x00007FF6BFDD0000-0x00007FF6C0124000-memory.dmp

Filesize
3.3MB

Download
memory/4920-2104-0x00007FF64ACA0000-0x00007FF64AFF4000-memory.dmp

Filesize
3.3MB

Download
memory/4920-528-0x00007FF64ACA0000-0x00007FF64AFF4000-memory.dmp

Filesize
3.3MB

Download
memory/4972-497-0x00007FF60DC80000-0x00007FF60DFD4000-memory.dmp

Filesize
3.3MB

Download
memory/4972-2089-0x00007FF60DC80000-0x00007FF60DFD4000-memory.dmp

Filesize
3.3MB

Download
memory/5020-2091-0x00007FF6D3180000-0x00007FF6D34D4000-memory.dmp

Filesize
3.3MB

Download
memory/5020-501-0x00007FF6D3180000-0x00007FF6D34D4000-memory.dmp

Filesize
3.3MB

Download
memory/5076-2102-0x00007FF680980000-0x00007FF680CD4000-memory.dmp

Filesize
3.3MB

Download
memory/5076-529-0x00007FF680980000-0x00007FF680CD4000-memory.dmp

Filesize
3.3MB

Download