xmrig | 517ba1f8a17228c6a1c45053c03b45f3368d59158e982a817cf9f6c17e6802bc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
Size

2.0MB
MD5

4000ed61940f7831364d26a55ceb0fd0
SHA1

bdd586e000b9713d7e4f7e8d2db3d54ff9f0c05f
SHA256

517ba1f8a17228c6a1c45053c03b45f3368d59158e982a817cf9f6c17e6802bc
SHA512

fcea35453674e8eb5fd61a5dc18f947b745583a1a0033334df3afaf7f1b9229b7ebfa8d2a02f4dfbb3d4cf0d6283d6dd4a3d8632fec6b79a0cca4b2f5cf93c33
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXGvAFnhyN4aV:BemTLkNdfE0pZrC

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3040-0-0x00007FF6B1930000-0x00007FF6B1C84000-memory.dmp	xmrig
behavioral2/files/0x00080000000233d3-5.dat	xmrig
behavioral2/files/0x00070000000233d7-10.dat	xmrig
behavioral2/files/0x00070000000233d8-9.dat	xmrig
behavioral2/files/0x00070000000233db-32.dat	xmrig
behavioral2/files/0x00070000000233dd-41.dat	xmrig
behavioral2/files/0x00070000000233de-44.dat	xmrig
behavioral2/files/0x00070000000233df-55.dat	xmrig
behavioral2/files/0x00070000000233e0-60.dat	xmrig
behavioral2/files/0x00070000000233e1-65.dat	xmrig
behavioral2/files/0x00070000000233e4-79.dat	xmrig
behavioral2/files/0x00070000000233e7-91.dat	xmrig
behavioral2/files/0x00070000000233ed-125.dat	xmrig
behavioral2/files/0x00070000000233f1-141.dat	xmrig
behavioral2/memory/4484-348-0x00007FF72C290000-0x00007FF72C5E4000-memory.dmp	xmrig
behavioral2/memory/3260-353-0x00007FF629C60000-0x00007FF629FB4000-memory.dmp	xmrig
behavioral2/memory/1632-357-0x00007FF6F7960000-0x00007FF6F7CB4000-memory.dmp	xmrig
behavioral2/memory/3928-360-0x00007FF6250D0000-0x00007FF625424000-memory.dmp	xmrig
behavioral2/memory/4480-363-0x00007FF73B380000-0x00007FF73B6D4000-memory.dmp	xmrig
behavioral2/memory/1312-368-0x00007FF6D0580000-0x00007FF6D08D4000-memory.dmp	xmrig
behavioral2/memory/532-373-0x00007FF6AA6C0000-0x00007FF6AAA14000-memory.dmp	xmrig
behavioral2/memory/2368-378-0x00007FF614820000-0x00007FF614B74000-memory.dmp	xmrig
behavioral2/memory/4996-382-0x00007FF7F49F0000-0x00007FF7F4D44000-memory.dmp	xmrig
behavioral2/memory/2784-386-0x00007FF61FD40000-0x00007FF620094000-memory.dmp	xmrig
behavioral2/memory/4140-391-0x00007FF67DF60000-0x00007FF67E2B4000-memory.dmp	xmrig
behavioral2/memory/4960-392-0x00007FF6ABAF0000-0x00007FF6ABE44000-memory.dmp	xmrig
behavioral2/memory/848-390-0x00007FF67A960000-0x00007FF67ACB4000-memory.dmp	xmrig
behavioral2/memory/4668-389-0x00007FF7B77C0000-0x00007FF7B7B14000-memory.dmp	xmrig
behavioral2/memory/4816-388-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	xmrig
behavioral2/memory/4316-387-0x00007FF6171C0000-0x00007FF617514000-memory.dmp	xmrig
behavioral2/memory/4820-385-0x00007FF787D40000-0x00007FF788094000-memory.dmp	xmrig
behavioral2/memory/4904-384-0x00007FF608E60000-0x00007FF6091B4000-memory.dmp	xmrig
behavioral2/memory/2104-381-0x00007FF62B220000-0x00007FF62B574000-memory.dmp	xmrig
behavioral2/memory/3112-379-0x00007FF7ABFE0000-0x00007FF7AC334000-memory.dmp	xmrig
behavioral2/memory/1924-376-0x00007FF6FAD20000-0x00007FF6FB074000-memory.dmp	xmrig
behavioral2/memory/388-372-0x00007FF754240000-0x00007FF754594000-memory.dmp	xmrig
behavioral2/memory/3924-365-0x00007FF751A70000-0x00007FF751DC4000-memory.dmp	xmrig
behavioral2/memory/4732-362-0x00007FF6A7430000-0x00007FF6A7784000-memory.dmp	xmrig
behavioral2/memory/4080-361-0x00007FF78D860000-0x00007FF78DBB4000-memory.dmp	xmrig
behavioral2/memory/4164-359-0x00007FF744800000-0x00007FF744B54000-memory.dmp	xmrig
behavioral2/memory/112-358-0x00007FF622350000-0x00007FF6226A4000-memory.dmp	xmrig
behavioral2/memory/4292-351-0x00007FF680030000-0x00007FF680384000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f6-164.dat	xmrig
behavioral2/files/0x00070000000233f4-160.dat	xmrig
behavioral2/files/0x00070000000233f5-159.dat	xmrig
behavioral2/files/0x00070000000233f3-155.dat	xmrig
behavioral2/files/0x00070000000233f2-150.dat	xmrig
behavioral2/files/0x00070000000233f0-139.dat	xmrig
behavioral2/files/0x00070000000233ef-135.dat	xmrig
behavioral2/files/0x00070000000233ee-130.dat	xmrig
behavioral2/files/0x00070000000233ec-120.dat	xmrig
behavioral2/files/0x00070000000233eb-115.dat	xmrig
behavioral2/files/0x00070000000233ea-110.dat	xmrig
behavioral2/files/0x00070000000233e9-105.dat	xmrig
behavioral2/files/0x00070000000233e8-100.dat	xmrig
behavioral2/files/0x00070000000233e6-89.dat	xmrig
behavioral2/files/0x00070000000233e5-85.dat	xmrig
behavioral2/files/0x00070000000233e3-75.dat	xmrig
behavioral2/files/0x00070000000233e2-70.dat	xmrig
behavioral2/files/0x00070000000233dc-37.dat	xmrig
behavioral2/files/0x00070000000233da-27.dat	xmrig
behavioral2/files/0x00070000000233d9-22.dat	xmrig
behavioral2/memory/756-13-0x00007FF757170000-0x00007FF7574C4000-memory.dmp	xmrig
behavioral2/memory/3040-2089-0x00007FF6B1930000-0x00007FF6B1C84000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
756	bEBmqUN.exe
4140	dJPaCOZ.exe
4484	bIfUEQH.exe
4960	iwArOCf.exe
4292	aPmmlWv.exe
3260	kvUyYCs.exe
1632	TGTlypa.exe
112	pQiBdNZ.exe
4164	utFkLdS.exe
3928	bkuwQKk.exe
4080	hDIIFfz.exe
4732	EnQbqwE.exe
4480	bzgSrMF.exe
3924	gzciZLu.exe
1312	fJqbmXF.exe
388	RGLYUZj.exe
532	imKnsCq.exe
1924	DDqPRyh.exe
2368	fVOStzo.exe
3112	cIcUmDA.exe
2104	NbhFmXc.exe
4996	gLqzrXX.exe
4904	plBCMMo.exe
4820	ZjYJLaW.exe
2784	YypppeI.exe
4316	dRCVhAE.exe
4816	AmBFaoK.exe
4668	Gmblaen.exe
848	Mhrsmrm.exe
1628	enSfChT.exe
4052	PrqPgCT.exe
1896	sPuLqUb.exe
2848	BtoUNcC.exe
2680	kZkBKQU.exe
1332	KIYzsLT.exe
3524	KfzIWSc.exe
2928	pfBQlap.exe
4868	HmpUpzR.exe
4004	hPfgoLb.exe
2744	QwRffKu.exe
2216	ebSreWp.exe
3780	vFRjhbC.exe
4136	gjclmYb.exe
4628	yojEfiM.exe
1032	mcHogNM.exe
3584	waixUPW.exe
964	pRztgiN.exe
1132	yhOhsyx.exe
3212	LdQqByp.exe
4532	BXlYHpA.exe
1256	KyiHZHN.exe
8	YKIvtQF.exe
2160	kjbkubo.exe
4404	OkrCPGq.exe
4372	rwwOXgK.exe
4024	WnFUcLn.exe
2204	bMnbLCN.exe
3696	EtAYxHr.exe
3012	TcDSKwX.exe
2084	oLOhaEB.exe
1808	GDQttky.exe
5040	uUefLaP.exe
3648	ohvlweR.exe
4876	gutVxsr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3040-0-0x00007FF6B1930000-0x00007FF6B1C84000-memory.dmp	upx
behavioral2/files/0x00080000000233d3-5.dat	upx
behavioral2/files/0x00070000000233d7-10.dat	upx
behavioral2/files/0x00070000000233d8-9.dat	upx
behavioral2/files/0x00070000000233db-32.dat	upx
behavioral2/files/0x00070000000233dd-41.dat	upx
behavioral2/files/0x00070000000233de-44.dat	upx
behavioral2/files/0x00070000000233df-55.dat	upx
behavioral2/files/0x00070000000233e0-60.dat	upx
behavioral2/files/0x00070000000233e1-65.dat	upx
behavioral2/files/0x00070000000233e4-79.dat	upx
behavioral2/files/0x00070000000233e7-91.dat	upx
behavioral2/files/0x00070000000233ed-125.dat	upx
behavioral2/files/0x00070000000233f1-141.dat	upx
behavioral2/memory/4484-348-0x00007FF72C290000-0x00007FF72C5E4000-memory.dmp	upx
behavioral2/memory/3260-353-0x00007FF629C60000-0x00007FF629FB4000-memory.dmp	upx
behavioral2/memory/1632-357-0x00007FF6F7960000-0x00007FF6F7CB4000-memory.dmp	upx
behavioral2/memory/3928-360-0x00007FF6250D0000-0x00007FF625424000-memory.dmp	upx
behavioral2/memory/4480-363-0x00007FF73B380000-0x00007FF73B6D4000-memory.dmp	upx
behavioral2/memory/1312-368-0x00007FF6D0580000-0x00007FF6D08D4000-memory.dmp	upx
behavioral2/memory/532-373-0x00007FF6AA6C0000-0x00007FF6AAA14000-memory.dmp	upx
behavioral2/memory/2368-378-0x00007FF614820000-0x00007FF614B74000-memory.dmp	upx
behavioral2/memory/4996-382-0x00007FF7F49F0000-0x00007FF7F4D44000-memory.dmp	upx
behavioral2/memory/2784-386-0x00007FF61FD40000-0x00007FF620094000-memory.dmp	upx
behavioral2/memory/4140-391-0x00007FF67DF60000-0x00007FF67E2B4000-memory.dmp	upx
behavioral2/memory/4960-392-0x00007FF6ABAF0000-0x00007FF6ABE44000-memory.dmp	upx
behavioral2/memory/848-390-0x00007FF67A960000-0x00007FF67ACB4000-memory.dmp	upx
behavioral2/memory/4668-389-0x00007FF7B77C0000-0x00007FF7B7B14000-memory.dmp	upx
behavioral2/memory/4816-388-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	upx
behavioral2/memory/4316-387-0x00007FF6171C0000-0x00007FF617514000-memory.dmp	upx
behavioral2/memory/4820-385-0x00007FF787D40000-0x00007FF788094000-memory.dmp	upx
behavioral2/memory/4904-384-0x00007FF608E60000-0x00007FF6091B4000-memory.dmp	upx
behavioral2/memory/2104-381-0x00007FF62B220000-0x00007FF62B574000-memory.dmp	upx
behavioral2/memory/3112-379-0x00007FF7ABFE0000-0x00007FF7AC334000-memory.dmp	upx
behavioral2/memory/1924-376-0x00007FF6FAD20000-0x00007FF6FB074000-memory.dmp	upx
behavioral2/memory/388-372-0x00007FF754240000-0x00007FF754594000-memory.dmp	upx
behavioral2/memory/3924-365-0x00007FF751A70000-0x00007FF751DC4000-memory.dmp	upx
behavioral2/memory/4732-362-0x00007FF6A7430000-0x00007FF6A7784000-memory.dmp	upx
behavioral2/memory/4080-361-0x00007FF78D860000-0x00007FF78DBB4000-memory.dmp	upx
behavioral2/memory/4164-359-0x00007FF744800000-0x00007FF744B54000-memory.dmp	upx
behavioral2/memory/112-358-0x00007FF622350000-0x00007FF6226A4000-memory.dmp	upx
behavioral2/memory/4292-351-0x00007FF680030000-0x00007FF680384000-memory.dmp	upx
behavioral2/files/0x00070000000233f6-164.dat	upx
behavioral2/files/0x00070000000233f4-160.dat	upx
behavioral2/files/0x00070000000233f5-159.dat	upx
behavioral2/files/0x00070000000233f3-155.dat	upx
behavioral2/files/0x00070000000233f2-150.dat	upx
behavioral2/files/0x00070000000233f0-139.dat	upx
behavioral2/files/0x00070000000233ef-135.dat	upx
behavioral2/files/0x00070000000233ee-130.dat	upx
behavioral2/files/0x00070000000233ec-120.dat	upx
behavioral2/files/0x00070000000233eb-115.dat	upx
behavioral2/files/0x00070000000233ea-110.dat	upx
behavioral2/files/0x00070000000233e9-105.dat	upx
behavioral2/files/0x00070000000233e8-100.dat	upx
behavioral2/files/0x00070000000233e6-89.dat	upx
behavioral2/files/0x00070000000233e5-85.dat	upx
behavioral2/files/0x00070000000233e3-75.dat	upx
behavioral2/files/0x00070000000233e2-70.dat	upx
behavioral2/files/0x00070000000233dc-37.dat	upx
behavioral2/files/0x00070000000233da-27.dat	upx
behavioral2/files/0x00070000000233d9-22.dat	upx
behavioral2/memory/756-13-0x00007FF757170000-0x00007FF7574C4000-memory.dmp	upx
behavioral2/memory/3040-2089-0x00007FF6B1930000-0x00007FF6B1C84000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YBsCHdJ.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\nlbZwuD.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\FulCGKX.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\wzKsVBi.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\kHhaOFf.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\vEawGnl.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\IdVzekR.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\fVOStzo.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\NbhFmXc.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\gLqzrXX.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\htLRhkW.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\vgTTBkL.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\fNpFKog.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\GNAcVrH.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\sVAjlSg.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\flYeitd.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\DkQFyGu.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\NChhuqO.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\YALwUtC.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\BYrhxsE.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\oZnzWus.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\fkXbFOv.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\sKleZUA.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\VilERMr.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\mxrXUkD.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\DXEtduL.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\krKTMwt.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\UKiBGzy.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\NoVPCiX.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\RcWSQcZ.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\iJxBOCo.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\pNNsrza.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\FpTzUmm.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ddzSFXo.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\PukOIol.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ASfcCgA.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\TagTIJG.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\iAAdkdg.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ApGFIIW.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\MrakMBn.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\lZzIMwP.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\lCWMXFp.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\LSAnxrI.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\CMtbbah.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\riogDoa.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\GDQttky.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\DnPFlvC.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\WCcsjWz.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\lCtKuXf.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\sFKodAs.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ebSreWp.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\GltuUea.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\RdHIvqF.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\QKNOhav.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ytDbwkC.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\jpaOUPY.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\AOTbXnO.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\rCKogHm.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\xQxGIox.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\dqwiarS.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\nKBHaPQ.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\EXGcHAD.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\FZJwyQd.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ldNWWZF.exe	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 756	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	82
PID 3040 wrote to memory of 756	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	82
PID 3040 wrote to memory of 4140	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	83
PID 3040 wrote to memory of 4140	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	83
PID 3040 wrote to memory of 4484	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	84
PID 3040 wrote to memory of 4484	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	84
PID 3040 wrote to memory of 4960	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	85
PID 3040 wrote to memory of 4960	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	85
PID 3040 wrote to memory of 4292	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	86
PID 3040 wrote to memory of 4292	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	86
PID 3040 wrote to memory of 3260	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	87
PID 3040 wrote to memory of 3260	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	87
PID 3040 wrote to memory of 1632	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	88
PID 3040 wrote to memory of 1632	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	88
PID 3040 wrote to memory of 112	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	89
PID 3040 wrote to memory of 112	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	89
PID 3040 wrote to memory of 4164	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	90
PID 3040 wrote to memory of 4164	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	90
PID 3040 wrote to memory of 3928	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	91
PID 3040 wrote to memory of 3928	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	91
PID 3040 wrote to memory of 4080	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	92
PID 3040 wrote to memory of 4080	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	92
PID 3040 wrote to memory of 4732	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	93
PID 3040 wrote to memory of 4732	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	93
PID 3040 wrote to memory of 4480	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	94
PID 3040 wrote to memory of 4480	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	94
PID 3040 wrote to memory of 3924	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	95
PID 3040 wrote to memory of 3924	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	95
PID 3040 wrote to memory of 1312	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	96
PID 3040 wrote to memory of 1312	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	96
PID 3040 wrote to memory of 388	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	97
PID 3040 wrote to memory of 388	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	97
PID 3040 wrote to memory of 532	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	98
PID 3040 wrote to memory of 532	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	98
PID 3040 wrote to memory of 1924	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	99
PID 3040 wrote to memory of 1924	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	99
PID 3040 wrote to memory of 2368	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	100
PID 3040 wrote to memory of 2368	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	100
PID 3040 wrote to memory of 3112	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	101
PID 3040 wrote to memory of 3112	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	101
PID 3040 wrote to memory of 2104	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	102
PID 3040 wrote to memory of 2104	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	102
PID 3040 wrote to memory of 4996	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	103
PID 3040 wrote to memory of 4996	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	103
PID 3040 wrote to memory of 4904	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	104
PID 3040 wrote to memory of 4904	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	104
PID 3040 wrote to memory of 4820	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	105
PID 3040 wrote to memory of 4820	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	105
PID 3040 wrote to memory of 2784	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	106
PID 3040 wrote to memory of 2784	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	106
PID 3040 wrote to memory of 4316	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	107
PID 3040 wrote to memory of 4316	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	107
PID 3040 wrote to memory of 4816	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	108
PID 3040 wrote to memory of 4816	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	108
PID 3040 wrote to memory of 4668	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	109
PID 3040 wrote to memory of 4668	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	109
PID 3040 wrote to memory of 848	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	110
PID 3040 wrote to memory of 848	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	110
PID 3040 wrote to memory of 1628	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	111
PID 3040 wrote to memory of 1628	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	111
PID 3040 wrote to memory of 4052	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	112
PID 3040 wrote to memory of 4052	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	112
PID 3040 wrote to memory of 1896	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	113
PID 3040 wrote to memory of 1896	3040	4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4000ed61940f7831364d26a55ceb0fd0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\System\bEBmqUN.exe
  C:\Windows\System\bEBmqUN.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\dJPaCOZ.exe
  C:\Windows\System\dJPaCOZ.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\bIfUEQH.exe
  C:\Windows\System\bIfUEQH.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\iwArOCf.exe
  C:\Windows\System\iwArOCf.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\aPmmlWv.exe
  C:\Windows\System\aPmmlWv.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\kvUyYCs.exe
  C:\Windows\System\kvUyYCs.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\TGTlypa.exe
  C:\Windows\System\TGTlypa.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\pQiBdNZ.exe
  C:\Windows\System\pQiBdNZ.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\utFkLdS.exe
  C:\Windows\System\utFkLdS.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\bkuwQKk.exe
  C:\Windows\System\bkuwQKk.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\hDIIFfz.exe
  C:\Windows\System\hDIIFfz.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\EnQbqwE.exe
  C:\Windows\System\EnQbqwE.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\bzgSrMF.exe
  C:\Windows\System\bzgSrMF.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\gzciZLu.exe
  C:\Windows\System\gzciZLu.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\fJqbmXF.exe
  C:\Windows\System\fJqbmXF.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\RGLYUZj.exe
  C:\Windows\System\RGLYUZj.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\imKnsCq.exe
  C:\Windows\System\imKnsCq.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\DDqPRyh.exe
  C:\Windows\System\DDqPRyh.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\fVOStzo.exe
  C:\Windows\System\fVOStzo.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\cIcUmDA.exe
  C:\Windows\System\cIcUmDA.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\NbhFmXc.exe
  C:\Windows\System\NbhFmXc.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\gLqzrXX.exe
  C:\Windows\System\gLqzrXX.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\plBCMMo.exe
  C:\Windows\System\plBCMMo.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\ZjYJLaW.exe
  C:\Windows\System\ZjYJLaW.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\YypppeI.exe
  C:\Windows\System\YypppeI.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\dRCVhAE.exe
  C:\Windows\System\dRCVhAE.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\AmBFaoK.exe
  C:\Windows\System\AmBFaoK.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\Gmblaen.exe
  C:\Windows\System\Gmblaen.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\Mhrsmrm.exe
  C:\Windows\System\Mhrsmrm.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\enSfChT.exe
  C:\Windows\System\enSfChT.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\PrqPgCT.exe
  C:\Windows\System\PrqPgCT.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\sPuLqUb.exe
  C:\Windows\System\sPuLqUb.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\BtoUNcC.exe
  C:\Windows\System\BtoUNcC.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\kZkBKQU.exe
  C:\Windows\System\kZkBKQU.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\KIYzsLT.exe
  C:\Windows\System\KIYzsLT.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\KfzIWSc.exe
  C:\Windows\System\KfzIWSc.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\pfBQlap.exe
  C:\Windows\System\pfBQlap.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\HmpUpzR.exe
  C:\Windows\System\HmpUpzR.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\hPfgoLb.exe
  C:\Windows\System\hPfgoLb.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\QwRffKu.exe
  C:\Windows\System\QwRffKu.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\ebSreWp.exe
  C:\Windows\System\ebSreWp.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\vFRjhbC.exe
  C:\Windows\System\vFRjhbC.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\gjclmYb.exe
  C:\Windows\System\gjclmYb.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\yojEfiM.exe
  C:\Windows\System\yojEfiM.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\mcHogNM.exe
  C:\Windows\System\mcHogNM.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\waixUPW.exe
  C:\Windows\System\waixUPW.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\pRztgiN.exe
  C:\Windows\System\pRztgiN.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\yhOhsyx.exe
  C:\Windows\System\yhOhsyx.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\LdQqByp.exe
  C:\Windows\System\LdQqByp.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\BXlYHpA.exe
  C:\Windows\System\BXlYHpA.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\KyiHZHN.exe
  C:\Windows\System\KyiHZHN.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\YKIvtQF.exe
  C:\Windows\System\YKIvtQF.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\kjbkubo.exe
  C:\Windows\System\kjbkubo.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\OkrCPGq.exe
  C:\Windows\System\OkrCPGq.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\rwwOXgK.exe
  C:\Windows\System\rwwOXgK.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\WnFUcLn.exe
  C:\Windows\System\WnFUcLn.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\bMnbLCN.exe
  C:\Windows\System\bMnbLCN.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\EtAYxHr.exe
  C:\Windows\System\EtAYxHr.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\TcDSKwX.exe
  C:\Windows\System\TcDSKwX.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\oLOhaEB.exe
  C:\Windows\System\oLOhaEB.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\GDQttky.exe
  C:\Windows\System\GDQttky.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\uUefLaP.exe
  C:\Windows\System\uUefLaP.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\ohvlweR.exe
  C:\Windows\System\ohvlweR.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\gutVxsr.exe
  C:\Windows\System\gutVxsr.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\NCsMClJ.exe
  C:\Windows\System\NCsMClJ.exe
  2⤵
  PID:4128
- C:\Windows\System\CuzBwkc.exe
  C:\Windows\System\CuzBwkc.exe
  2⤵
  PID:1388
- C:\Windows\System\jHGOyns.exe
  C:\Windows\System\jHGOyns.exe
  2⤵
  PID:1104
- C:\Windows\System\DnaXnIn.exe
  C:\Windows\System\DnaXnIn.exe
  2⤵
  PID:3688
- C:\Windows\System\IgEtKCg.exe
  C:\Windows\System\IgEtKCg.exe
  2⤵
  PID:1040
- C:\Windows\System\ARMFIYv.exe
  C:\Windows\System\ARMFIYv.exe
  2⤵
  PID:852
- C:\Windows\System\voPMYgk.exe
  C:\Windows\System\voPMYgk.exe
  2⤵
  PID:1760
- C:\Windows\System\vrnTmeG.exe
  C:\Windows\System\vrnTmeG.exe
  2⤵
  PID:4048
- C:\Windows\System\hKRWxTN.exe
  C:\Windows\System\hKRWxTN.exe
  2⤵
  PID:4632
- C:\Windows\System\KiyDBBi.exe
  C:\Windows\System\KiyDBBi.exe
  2⤵
  PID:3920
- C:\Windows\System\ZfkOfio.exe
  C:\Windows\System\ZfkOfio.exe
  2⤵
  PID:2560
- C:\Windows\System\tPOxIqM.exe
  C:\Windows\System\tPOxIqM.exe
  2⤵
  PID:4592
- C:\Windows\System\ooagbLx.exe
  C:\Windows\System\ooagbLx.exe
  2⤵
  PID:2812
- C:\Windows\System\uGdnayE.exe
  C:\Windows\System\uGdnayE.exe
  2⤵
  PID:60
- C:\Windows\System\rPWDoJx.exe
  C:\Windows\System\rPWDoJx.exe
  2⤵
  PID:1028
- C:\Windows\System\VozMLYq.exe
  C:\Windows\System\VozMLYq.exe
  2⤵
  PID:3732
- C:\Windows\System\DylYyOP.exe
  C:\Windows\System\DylYyOP.exe
  2⤵
  PID:3900
- C:\Windows\System\fPAQmmv.exe
  C:\Windows\System\fPAQmmv.exe
  2⤵
  PID:2504
- C:\Windows\System\IRRXBmu.exe
  C:\Windows\System\IRRXBmu.exe
  2⤵
  PID:4784
- C:\Windows\System\OJCxBuY.exe
  C:\Windows\System\OJCxBuY.exe
  2⤵
  PID:5080
- C:\Windows\System\WuoRqcn.exe
  C:\Windows\System\WuoRqcn.exe
  2⤵
  PID:1108
- C:\Windows\System\rekRiQM.exe
  C:\Windows\System\rekRiQM.exe
  2⤵
  PID:3716
- C:\Windows\System\EYRNqLp.exe
  C:\Windows\System\EYRNqLp.exe
  2⤵
  PID:2824
- C:\Windows\System\pJrgLRS.exe
  C:\Windows\System\pJrgLRS.exe
  2⤵
  PID:936
- C:\Windows\System\LdYTOEv.exe
  C:\Windows\System\LdYTOEv.exe
  2⤵
  PID:2112
- C:\Windows\System\wfqSyKB.exe
  C:\Windows\System\wfqSyKB.exe
  2⤵
  PID:2512
- C:\Windows\System\UyvNgOX.exe
  C:\Windows\System\UyvNgOX.exe
  2⤵
  PID:4596
- C:\Windows\System\XULsItK.exe
  C:\Windows\System\XULsItK.exe
  2⤵
  PID:5144
- C:\Windows\System\QWDolod.exe
  C:\Windows\System\QWDolod.exe
  2⤵
  PID:5172
- C:\Windows\System\HkecoYY.exe
  C:\Windows\System\HkecoYY.exe
  2⤵
  PID:5200
- C:\Windows\System\NKAqpEE.exe
  C:\Windows\System\NKAqpEE.exe
  2⤵
  PID:5228
- C:\Windows\System\RfvDrMX.exe
  C:\Windows\System\RfvDrMX.exe
  2⤵
  PID:5296
- C:\Windows\System\ejsCBRo.exe
  C:\Windows\System\ejsCBRo.exe
  2⤵
  PID:5320
- C:\Windows\System\htLRhkW.exe
  C:\Windows\System\htLRhkW.exe
  2⤵
  PID:5396
- C:\Windows\System\yfIVDUz.exe
  C:\Windows\System\yfIVDUz.exe
  2⤵
  PID:5416
- C:\Windows\System\qhyYTtG.exe
  C:\Windows\System\qhyYTtG.exe
  2⤵
  PID:5464
- C:\Windows\System\tDvOtaU.exe
  C:\Windows\System\tDvOtaU.exe
  2⤵
  PID:5600
- C:\Windows\System\fkXbFOv.exe
  C:\Windows\System\fkXbFOv.exe
  2⤵
  PID:5616
- C:\Windows\System\dvHBEVp.exe
  C:\Windows\System\dvHBEVp.exe
  2⤵
  PID:5644
- C:\Windows\System\ZHgeRpj.exe
  C:\Windows\System\ZHgeRpj.exe
  2⤵
  PID:5668
- C:\Windows\System\nKBHaPQ.exe
  C:\Windows\System\nKBHaPQ.exe
  2⤵
  PID:5740
- C:\Windows\System\cSBZgRs.exe
  C:\Windows\System\cSBZgRs.exe
  2⤵
  PID:5804
- C:\Windows\System\TVAaOvZ.exe
  C:\Windows\System\TVAaOvZ.exe
  2⤵
  PID:5820
- C:\Windows\System\QlgIKoR.exe
  C:\Windows\System\QlgIKoR.exe
  2⤵
  PID:5836
- C:\Windows\System\farMFKP.exe
  C:\Windows\System\farMFKP.exe
  2⤵
  PID:5916
- C:\Windows\System\CviAsEM.exe
  C:\Windows\System\CviAsEM.exe
  2⤵
  PID:5932
- C:\Windows\System\DzcWZBP.exe
  C:\Windows\System\DzcWZBP.exe
  2⤵
  PID:5948
- C:\Windows\System\zKyIVVW.exe
  C:\Windows\System\zKyIVVW.exe
  2⤵
  PID:5992
- C:\Windows\System\GEZfoHR.exe
  C:\Windows\System\GEZfoHR.exe
  2⤵
  PID:6032
- C:\Windows\System\cPKdxaB.exe
  C:\Windows\System\cPKdxaB.exe
  2⤵
  PID:6064
- C:\Windows\System\DnPFlvC.exe
  C:\Windows\System\DnPFlvC.exe
  2⤵
  PID:6092
- C:\Windows\System\BeEkEYe.exe
  C:\Windows\System\BeEkEYe.exe
  2⤵
  PID:3612
- C:\Windows\System\GNaPlvg.exe
  C:\Windows\System\GNaPlvg.exe
  2⤵
  PID:3304
- C:\Windows\System\UKiBGzy.exe
  C:\Windows\System\UKiBGzy.exe
  2⤵
  PID:5160
- C:\Windows\System\zJTXDGX.exe
  C:\Windows\System\zJTXDGX.exe
  2⤵
  PID:2548
- C:\Windows\System\KaqVRID.exe
  C:\Windows\System\KaqVRID.exe
  2⤵
  PID:5316
- C:\Windows\System\rlYHrcQ.exe
  C:\Windows\System\rlYHrcQ.exe
  2⤵
  PID:5412
- C:\Windows\System\VmcIhMp.exe
  C:\Windows\System\VmcIhMp.exe
  2⤵
  PID:4744
- C:\Windows\System\predzlx.exe
  C:\Windows\System\predzlx.exe
  2⤵
  PID:3740
- C:\Windows\System\VKKqhKi.exe
  C:\Windows\System\VKKqhKi.exe
  2⤵
  PID:3108
- C:\Windows\System\CkOhObj.exe
  C:\Windows\System\CkOhObj.exe
  2⤵
  PID:1212
- C:\Windows\System\AWVeyHV.exe
  C:\Windows\System\AWVeyHV.exe
  2⤵
  PID:2444
- C:\Windows\System\kreIhcZ.exe
  C:\Windows\System\kreIhcZ.exe
  2⤵
  PID:2756
- C:\Windows\System\zdukxIV.exe
  C:\Windows\System\zdukxIV.exe
  2⤵
  PID:2980
- C:\Windows\System\tskzagp.exe
  C:\Windows\System\tskzagp.exe
  2⤵
  PID:2464
- C:\Windows\System\vHUiHJG.exe
  C:\Windows\System\vHUiHJG.exe
  2⤵
  PID:1872
- C:\Windows\System\oDJmZBI.exe
  C:\Windows\System\oDJmZBI.exe
  2⤵
  PID:5628
- C:\Windows\System\vgTTBkL.exe
  C:\Windows\System\vgTTBkL.exe
  2⤵
  PID:5676
- C:\Windows\System\aHmaRKY.exe
  C:\Windows\System\aHmaRKY.exe
  2⤵
  PID:5716
- C:\Windows\System\LaXgsDX.exe
  C:\Windows\System\LaXgsDX.exe
  2⤵
  PID:5828
- C:\Windows\System\ElDvBUO.exe
  C:\Windows\System\ElDvBUO.exe
  2⤵
  PID:624
- C:\Windows\System\svMzQPG.exe
  C:\Windows\System\svMzQPG.exe
  2⤵
  PID:6008
- C:\Windows\System\zeHnnXZ.exe
  C:\Windows\System\zeHnnXZ.exe
  2⤵
  PID:6056
- C:\Windows\System\RlzlDvi.exe
  C:\Windows\System\RlzlDvi.exe
  2⤵
  PID:5748
- C:\Windows\System\FgomLcP.exe
  C:\Windows\System\FgomLcP.exe
  2⤵
  PID:4728
- C:\Windows\System\cOOUdHm.exe
  C:\Windows\System\cOOUdHm.exe
  2⤵
  PID:1548
- C:\Windows\System\MvtMpqP.exe
  C:\Windows\System\MvtMpqP.exe
  2⤵
  PID:5284
- C:\Windows\System\tIUoENG.exe
  C:\Windows\System\tIUoENG.exe
  2⤵
  PID:2472
- C:\Windows\System\MkVsWkR.exe
  C:\Windows\System\MkVsWkR.exe
  2⤵
  PID:4512
- C:\Windows\System\zLTSvfE.exe
  C:\Windows\System\zLTSvfE.exe
  2⤵
  PID:1820
- C:\Windows\System\xcwSZIp.exe
  C:\Windows\System\xcwSZIp.exe
  2⤵
  PID:4852
- C:\Windows\System\GXvOBtb.exe
  C:\Windows\System\GXvOBtb.exe
  2⤵
  PID:1180
- C:\Windows\System\GWImeQy.exe
  C:\Windows\System\GWImeQy.exe
  2⤵
  PID:2324
- C:\Windows\System\CVfmPTI.exe
  C:\Windows\System\CVfmPTI.exe
  2⤵
  PID:5816
- C:\Windows\System\RzjvLAM.exe
  C:\Windows\System\RzjvLAM.exe
  2⤵
  PID:5928
- C:\Windows\System\sQYIhDK.exe
  C:\Windows\System\sQYIhDK.exe
  2⤵
  PID:6088
- C:\Windows\System\EXGcHAD.exe
  C:\Windows\System\EXGcHAD.exe
  2⤵
  PID:6136
- C:\Windows\System\VZyFhrF.exe
  C:\Windows\System\VZyFhrF.exe
  2⤵
  PID:5076
- C:\Windows\System\gbVoUYq.exe
  C:\Windows\System\gbVoUYq.exe
  2⤵
  PID:5532
- C:\Windows\System\DmuCkap.exe
  C:\Windows\System\DmuCkap.exe
  2⤵
  PID:2400
- C:\Windows\System\sLLPMDW.exe
  C:\Windows\System\sLLPMDW.exe
  2⤵
  PID:5608
- C:\Windows\System\NtKTpub.exe
  C:\Windows\System\NtKTpub.exe
  2⤵
  PID:5372
- C:\Windows\System\XoMmnJa.exe
  C:\Windows\System\XoMmnJa.exe
  2⤵
  PID:5756
- C:\Windows\System\WLcxNUC.exe
  C:\Windows\System\WLcxNUC.exe
  2⤵
  PID:5392
- C:\Windows\System\RcchWXv.exe
  C:\Windows\System\RcchWXv.exe
  2⤵
  PID:2388
- C:\Windows\System\KQJtlbb.exe
  C:\Windows\System\KQJtlbb.exe
  2⤵
  PID:5548
- C:\Windows\System\ApGFIIW.exe
  C:\Windows\System\ApGFIIW.exe
  2⤵
  PID:2792
- C:\Windows\System\yoCrlXH.exe
  C:\Windows\System\yoCrlXH.exe
  2⤵
  PID:5524
- C:\Windows\System\msiGTbO.exe
  C:\Windows\System\msiGTbO.exe
  2⤵
  PID:6160
- C:\Windows\System\oCNkcJw.exe
  C:\Windows\System\oCNkcJw.exe
  2⤵
  PID:6188
- C:\Windows\System\gwymfth.exe
  C:\Windows\System\gwymfth.exe
  2⤵
  PID:6220
- C:\Windows\System\MEvWVil.exe
  C:\Windows\System\MEvWVil.exe
  2⤵
  PID:6248
- C:\Windows\System\beOiHkc.exe
  C:\Windows\System\beOiHkc.exe
  2⤵
  PID:6276
- C:\Windows\System\ewDmgLy.exe
  C:\Windows\System\ewDmgLy.exe
  2⤵
  PID:6304
- C:\Windows\System\dfnDOdw.exe
  C:\Windows\System\dfnDOdw.exe
  2⤵
  PID:6340
- C:\Windows\System\pPaRxvW.exe
  C:\Windows\System\pPaRxvW.exe
  2⤵
  PID:6368
- C:\Windows\System\cwApMhS.exe
  C:\Windows\System\cwApMhS.exe
  2⤵
  PID:6396
- C:\Windows\System\IqLptbP.exe
  C:\Windows\System\IqLptbP.exe
  2⤵
  PID:6432
- C:\Windows\System\PFgFQup.exe
  C:\Windows\System\PFgFQup.exe
  2⤵
  PID:6460
- C:\Windows\System\WCcsjWz.exe
  C:\Windows\System\WCcsjWz.exe
  2⤵
  PID:6488
- C:\Windows\System\TQEmflS.exe
  C:\Windows\System\TQEmflS.exe
  2⤵
  PID:6508
- C:\Windows\System\TXnVIXl.exe
  C:\Windows\System\TXnVIXl.exe
  2⤵
  PID:6544
- C:\Windows\System\TKtweFR.exe
  C:\Windows\System\TKtweFR.exe
  2⤵
  PID:6572
- C:\Windows\System\gkHxFfZ.exe
  C:\Windows\System\gkHxFfZ.exe
  2⤵
  PID:6600
- C:\Windows\System\MtchXbe.exe
  C:\Windows\System\MtchXbe.exe
  2⤵
  PID:6628
- C:\Windows\System\nyWpilV.exe
  C:\Windows\System\nyWpilV.exe
  2⤵
  PID:6656
- C:\Windows\System\wNCYVnD.exe
  C:\Windows\System\wNCYVnD.exe
  2⤵
  PID:6684
- C:\Windows\System\HHwzdfS.exe
  C:\Windows\System\HHwzdfS.exe
  2⤵
  PID:6712
- C:\Windows\System\MaYsWtZ.exe
  C:\Windows\System\MaYsWtZ.exe
  2⤵
  PID:6740
- C:\Windows\System\iyjbkgp.exe
  C:\Windows\System\iyjbkgp.exe
  2⤵
  PID:6768
- C:\Windows\System\NoVPCiX.exe
  C:\Windows\System\NoVPCiX.exe
  2⤵
  PID:6796
- C:\Windows\System\JAcDmES.exe
  C:\Windows\System\JAcDmES.exe
  2⤵
  PID:6824
- C:\Windows\System\arqftme.exe
  C:\Windows\System\arqftme.exe
  2⤵
  PID:6852
- C:\Windows\System\MFYfktW.exe
  C:\Windows\System\MFYfktW.exe
  2⤵
  PID:6880
- C:\Windows\System\ZzecApI.exe
  C:\Windows\System\ZzecApI.exe
  2⤵
  PID:6904
- C:\Windows\System\EkeypaL.exe
  C:\Windows\System\EkeypaL.exe
  2⤵
  PID:6928
- C:\Windows\System\HpYQNoC.exe
  C:\Windows\System\HpYQNoC.exe
  2⤵
  PID:6944
- C:\Windows\System\KtcuPfd.exe
  C:\Windows\System\KtcuPfd.exe
  2⤵
  PID:6972
- C:\Windows\System\WhYhxLF.exe
  C:\Windows\System\WhYhxLF.exe
  2⤵
  PID:7008
- C:\Windows\System\TyxQxBH.exe
  C:\Windows\System\TyxQxBH.exe
  2⤵
  PID:7040
- C:\Windows\System\rLADDyj.exe
  C:\Windows\System\rLADDyj.exe
  2⤵
  PID:7076
- C:\Windows\System\wNjEWYv.exe
  C:\Windows\System\wNjEWYv.exe
  2⤵
  PID:7092
- C:\Windows\System\kHhaOFf.exe
  C:\Windows\System\kHhaOFf.exe
  2⤵
  PID:7132
- C:\Windows\System\eCAvoXE.exe
  C:\Windows\System\eCAvoXE.exe
  2⤵
  PID:7160
- C:\Windows\System\flYeitd.exe
  C:\Windows\System\flYeitd.exe
  2⤵
  PID:6176
- C:\Windows\System\dYaRMWB.exe
  C:\Windows\System\dYaRMWB.exe
  2⤵
  PID:6240
- C:\Windows\System\SRkRQbt.exe
  C:\Windows\System\SRkRQbt.exe
  2⤵
  PID:6300
- C:\Windows\System\ndAgakI.exe
  C:\Windows\System\ndAgakI.exe
  2⤵
  PID:6392
- C:\Windows\System\IeVgcdW.exe
  C:\Windows\System\IeVgcdW.exe
  2⤵
  PID:6444
- C:\Windows\System\UwVnqkQ.exe
  C:\Windows\System\UwVnqkQ.exe
  2⤵
  PID:6528
- C:\Windows\System\sKleZUA.exe
  C:\Windows\System\sKleZUA.exe
  2⤵
  PID:6592
- C:\Windows\System\yxCKFiG.exe
  C:\Windows\System\yxCKFiG.exe
  2⤵
  PID:6724
- C:\Windows\System\qxyQnNe.exe
  C:\Windows\System\qxyQnNe.exe
  2⤵
  PID:6816
- C:\Windows\System\iTphlkA.exe
  C:\Windows\System\iTphlkA.exe
  2⤵
  PID:6876
- C:\Windows\System\keBHzGM.exe
  C:\Windows\System\keBHzGM.exe
  2⤵
  PID:6916
- C:\Windows\System\tJDyiPS.exe
  C:\Windows\System\tJDyiPS.exe
  2⤵
  PID:6988
- C:\Windows\System\OcfzURG.exe
  C:\Windows\System\OcfzURG.exe
  2⤵
  PID:7068
- C:\Windows\System\IlXMdcd.exe
  C:\Windows\System\IlXMdcd.exe
  2⤵
  PID:7144
- C:\Windows\System\hFDKyQY.exe
  C:\Windows\System\hFDKyQY.exe
  2⤵
  PID:6204
- C:\Windows\System\GQjmMSt.exe
  C:\Windows\System\GQjmMSt.exe
  2⤵
  PID:2992
- C:\Windows\System\OtvzMtl.exe
  C:\Windows\System\OtvzMtl.exe
  2⤵
  PID:6484
- C:\Windows\System\xVeBgNC.exe
  C:\Windows\System\xVeBgNC.exe
  2⤵
  PID:6668
- C:\Windows\System\PIwGJZN.exe
  C:\Windows\System\PIwGJZN.exe
  2⤵
  PID:5544
- C:\Windows\System\NiKAIWn.exe
  C:\Windows\System\NiKAIWn.exe
  2⤵
  PID:7004
- C:\Windows\System\cZXfifc.exe
  C:\Windows\System\cZXfifc.exe
  2⤵
  PID:7156
- C:\Windows\System\ddzSFXo.exe
  C:\Windows\System\ddzSFXo.exe
  2⤵
  PID:6428
- C:\Windows\System\aWyBCIR.exe
  C:\Windows\System\aWyBCIR.exe
  2⤵
  PID:6952
- C:\Windows\System\GiMTWFk.exe
  C:\Windows\System\GiMTWFk.exe
  2⤵
  PID:6332
- C:\Windows\System\aNTtiDK.exe
  C:\Windows\System\aNTtiDK.exe
  2⤵
  PID:6272
- C:\Windows\System\PLkaeKN.exe
  C:\Windows\System\PLkaeKN.exe
  2⤵
  PID:7176
- C:\Windows\System\kqqrLAp.exe
  C:\Windows\System\kqqrLAp.exe
  2⤵
  PID:7216
- C:\Windows\System\afiPvdT.exe
  C:\Windows\System\afiPvdT.exe
  2⤵
  PID:7244
- C:\Windows\System\CFAdduE.exe
  C:\Windows\System\CFAdduE.exe
  2⤵
  PID:7272
- C:\Windows\System\cHiFFpD.exe
  C:\Windows\System\cHiFFpD.exe
  2⤵
  PID:7300
- C:\Windows\System\YrVdaMl.exe
  C:\Windows\System\YrVdaMl.exe
  2⤵
  PID:7328
- C:\Windows\System\eYamxfM.exe
  C:\Windows\System\eYamxfM.exe
  2⤵
  PID:7356
- C:\Windows\System\TTDvuvT.exe
  C:\Windows\System\TTDvuvT.exe
  2⤵
  PID:7392
- C:\Windows\System\jlfRpkw.exe
  C:\Windows\System\jlfRpkw.exe
  2⤵
  PID:7416
- C:\Windows\System\VwjedFV.exe
  C:\Windows\System\VwjedFV.exe
  2⤵
  PID:7444
- C:\Windows\System\JCgcbzu.exe
  C:\Windows\System\JCgcbzu.exe
  2⤵
  PID:7472
- C:\Windows\System\GltuUea.exe
  C:\Windows\System\GltuUea.exe
  2⤵
  PID:7500
- C:\Windows\System\VyWmEax.exe
  C:\Windows\System\VyWmEax.exe
  2⤵
  PID:7528
- C:\Windows\System\XWKcYSd.exe
  C:\Windows\System\XWKcYSd.exe
  2⤵
  PID:7556
- C:\Windows\System\YVufNxD.exe
  C:\Windows\System\YVufNxD.exe
  2⤵
  PID:7584
- C:\Windows\System\hMHukOp.exe
  C:\Windows\System\hMHukOp.exe
  2⤵
  PID:7612
- C:\Windows\System\EqgkRQC.exe
  C:\Windows\System\EqgkRQC.exe
  2⤵
  PID:7640
- C:\Windows\System\ZEXmcQm.exe
  C:\Windows\System\ZEXmcQm.exe
  2⤵
  PID:7668
- C:\Windows\System\nvVSWaY.exe
  C:\Windows\System\nvVSWaY.exe
  2⤵
  PID:7696
- C:\Windows\System\sLWkmed.exe
  C:\Windows\System\sLWkmed.exe
  2⤵
  PID:7724
- C:\Windows\System\jpaOUPY.exe
  C:\Windows\System\jpaOUPY.exe
  2⤵
  PID:7752
- C:\Windows\System\pxXXzeM.exe
  C:\Windows\System\pxXXzeM.exe
  2⤵
  PID:7780
- C:\Windows\System\wjFBvDv.exe
  C:\Windows\System\wjFBvDv.exe
  2⤵
  PID:7812
- C:\Windows\System\nxMVpdf.exe
  C:\Windows\System\nxMVpdf.exe
  2⤵
  PID:7840
- C:\Windows\System\OryvIny.exe
  C:\Windows\System\OryvIny.exe
  2⤵
  PID:7868
- C:\Windows\System\QvPPpGn.exe
  C:\Windows\System\QvPPpGn.exe
  2⤵
  PID:7908
- C:\Windows\System\GfBgIEB.exe
  C:\Windows\System\GfBgIEB.exe
  2⤵
  PID:7932
- C:\Windows\System\wDmuZqN.exe
  C:\Windows\System\wDmuZqN.exe
  2⤵
  PID:7960
- C:\Windows\System\JepoaVE.exe
  C:\Windows\System\JepoaVE.exe
  2⤵
  PID:7988
- C:\Windows\System\oaZZcyb.exe
  C:\Windows\System\oaZZcyb.exe
  2⤵
  PID:8004
- C:\Windows\System\xwiFMZq.exe
  C:\Windows\System\xwiFMZq.exe
  2⤵
  PID:8044
- C:\Windows\System\zVozVYD.exe
  C:\Windows\System\zVozVYD.exe
  2⤵
  PID:8076
- C:\Windows\System\YCnZKJV.exe
  C:\Windows\System\YCnZKJV.exe
  2⤵
  PID:8100
- C:\Windows\System\syuAbDm.exe
  C:\Windows\System\syuAbDm.exe
  2⤵
  PID:8128
- C:\Windows\System\vWAVPpK.exe
  C:\Windows\System\vWAVPpK.exe
  2⤵
  PID:8156
- C:\Windows\System\LSAnxrI.exe
  C:\Windows\System\LSAnxrI.exe
  2⤵
  PID:8188
- C:\Windows\System\GIqUvlE.exe
  C:\Windows\System\GIqUvlE.exe
  2⤵
  PID:7240
- C:\Windows\System\xAhjYuU.exe
  C:\Windows\System\xAhjYuU.exe
  2⤵
  PID:7316
- C:\Windows\System\YBsCHdJ.exe
  C:\Windows\System\YBsCHdJ.exe
  2⤵
  PID:7376
- C:\Windows\System\PlZiDzh.exe
  C:\Windows\System\PlZiDzh.exe
  2⤵
  PID:7440
- C:\Windows\System\dDQVudn.exe
  C:\Windows\System\dDQVudn.exe
  2⤵
  PID:7548
- C:\Windows\System\DQkzlVX.exe
  C:\Windows\System\DQkzlVX.exe
  2⤵
  PID:7636
- C:\Windows\System\uGqZfoB.exe
  C:\Windows\System\uGqZfoB.exe
  2⤵
  PID:7744
- C:\Windows\System\YxyPyGq.exe
  C:\Windows\System\YxyPyGq.exe
  2⤵
  PID:7836
- C:\Windows\System\WKuSCKC.exe
  C:\Windows\System\WKuSCKC.exe
  2⤵
  PID:7916
- C:\Windows\System\cnlnadk.exe
  C:\Windows\System\cnlnadk.exe
  2⤵
  PID:8000
- C:\Windows\System\EyPsBAC.exe
  C:\Windows\System\EyPsBAC.exe
  2⤵
  PID:8068
- C:\Windows\System\nAWtkbn.exe
  C:\Windows\System\nAWtkbn.exe
  2⤵
  PID:7172
- C:\Windows\System\kMifgxD.exe
  C:\Windows\System\kMifgxD.exe
  2⤵
  PID:7352
- C:\Windows\System\lzcxYSc.exe
  C:\Windows\System\lzcxYSc.exe
  2⤵
  PID:7540
- C:\Windows\System\sYfJAAU.exe
  C:\Windows\System\sYfJAAU.exe
  2⤵
  PID:7972
- C:\Windows\System\fLUPElX.exe
  C:\Windows\System\fLUPElX.exe
  2⤵
  PID:7284
- C:\Windows\System\rXFxbbm.exe
  C:\Windows\System\rXFxbbm.exe
  2⤵
  PID:7952
- C:\Windows\System\UBAYLiP.exe
  C:\Windows\System\UBAYLiP.exe
  2⤵
  PID:7604
- C:\Windows\System\icNEKrI.exe
  C:\Windows\System\icNEKrI.exe
  2⤵
  PID:8208
- C:\Windows\System\qeWihMT.exe
  C:\Windows\System\qeWihMT.exe
  2⤵
  PID:8232
- C:\Windows\System\YDXWpJz.exe
  C:\Windows\System\YDXWpJz.exe
  2⤵
  PID:8280
- C:\Windows\System\vEawGnl.exe
  C:\Windows\System\vEawGnl.exe
  2⤵
  PID:8316
- C:\Windows\System\XsbYmVw.exe
  C:\Windows\System\XsbYmVw.exe
  2⤵
  PID:8344
- C:\Windows\System\vZPmNiA.exe
  C:\Windows\System\vZPmNiA.exe
  2⤵
  PID:8376
- C:\Windows\System\DkQFyGu.exe
  C:\Windows\System\DkQFyGu.exe
  2⤵
  PID:8408
- C:\Windows\System\dnMjOrI.exe
  C:\Windows\System\dnMjOrI.exe
  2⤵
  PID:8436
- C:\Windows\System\oNYJuvH.exe
  C:\Windows\System\oNYJuvH.exe
  2⤵
  PID:8476
- C:\Windows\System\FZJwyQd.exe
  C:\Windows\System\FZJwyQd.exe
  2⤵
  PID:8520
- C:\Windows\System\nqHIovl.exe
  C:\Windows\System\nqHIovl.exe
  2⤵
  PID:8540
- C:\Windows\System\ipiSplJ.exe
  C:\Windows\System\ipiSplJ.exe
  2⤵
  PID:8568
- C:\Windows\System\uLKduOy.exe
  C:\Windows\System\uLKduOy.exe
  2⤵
  PID:8596
- C:\Windows\System\RcWSQcZ.exe
  C:\Windows\System\RcWSQcZ.exe
  2⤵
  PID:8624
- C:\Windows\System\qaypeXD.exe
  C:\Windows\System\qaypeXD.exe
  2⤵
  PID:8656
- C:\Windows\System\jeBVDFb.exe
  C:\Windows\System\jeBVDFb.exe
  2⤵
  PID:8680
- C:\Windows\System\vHvhoRD.exe
  C:\Windows\System\vHvhoRD.exe
  2⤵
  PID:8708
- C:\Windows\System\YUyRxEH.exe
  C:\Windows\System\YUyRxEH.exe
  2⤵
  PID:8736
- C:\Windows\System\PokePVF.exe
  C:\Windows\System\PokePVF.exe
  2⤵
  PID:8768
- C:\Windows\System\DsqyrNq.exe
  C:\Windows\System\DsqyrNq.exe
  2⤵
  PID:8792
- C:\Windows\System\BRCkbXU.exe
  C:\Windows\System\BRCkbXU.exe
  2⤵
  PID:8820
- C:\Windows\System\LmDdCeg.exe
  C:\Windows\System\LmDdCeg.exe
  2⤵
  PID:8848
- C:\Windows\System\cFuTSbg.exe
  C:\Windows\System\cFuTSbg.exe
  2⤵
  PID:8876
- C:\Windows\System\PnMWeIQ.exe
  C:\Windows\System\PnMWeIQ.exe
  2⤵
  PID:8912
- C:\Windows\System\TPijgCn.exe
  C:\Windows\System\TPijgCn.exe
  2⤵
  PID:8932
- C:\Windows\System\ojQDlcV.exe
  C:\Windows\System\ojQDlcV.exe
  2⤵
  PID:8960
- C:\Windows\System\fWrtLkn.exe
  C:\Windows\System\fWrtLkn.exe
  2⤵
  PID:8988
- C:\Windows\System\pMIcVwo.exe
  C:\Windows\System\pMIcVwo.exe
  2⤵
  PID:9016
- C:\Windows\System\VqculFl.exe
  C:\Windows\System\VqculFl.exe
  2⤵
  PID:9044
- C:\Windows\System\ZrJgnTK.exe
  C:\Windows\System\ZrJgnTK.exe
  2⤵
  PID:9072
- C:\Windows\System\lbyAlHr.exe
  C:\Windows\System\lbyAlHr.exe
  2⤵
  PID:9100
- C:\Windows\System\CvEYmQk.exe
  C:\Windows\System\CvEYmQk.exe
  2⤵
  PID:9128
- C:\Windows\System\HrMgpIx.exe
  C:\Windows\System\HrMgpIx.exe
  2⤵
  PID:9156
- C:\Windows\System\UcymPiK.exe
  C:\Windows\System\UcymPiK.exe
  2⤵
  PID:9184
- C:\Windows\System\ldNWWZF.exe
  C:\Windows\System\ldNWWZF.exe
  2⤵
  PID:9212
- C:\Windows\System\JUpbEOI.exe
  C:\Windows\System\JUpbEOI.exe
  2⤵
  PID:8248
- C:\Windows\System\yLiPhyk.exe
  C:\Windows\System\yLiPhyk.exe
  2⤵
  PID:8288
- C:\Windows\System\JFPDrtK.exe
  C:\Windows\System\JFPDrtK.exe
  2⤵
  PID:8356
- C:\Windows\System\bfYlQmK.exe
  C:\Windows\System\bfYlQmK.exe
  2⤵
  PID:8428
- C:\Windows\System\zbmkhvs.exe
  C:\Windows\System\zbmkhvs.exe
  2⤵
  PID:8508
- C:\Windows\System\HUxpyaZ.exe
  C:\Windows\System\HUxpyaZ.exe
  2⤵
  PID:8584
- C:\Windows\System\QFzPFBN.exe
  C:\Windows\System\QFzPFBN.exe
  2⤵
  PID:8648
- C:\Windows\System\CwSvbOr.exe
  C:\Windows\System\CwSvbOr.exe
  2⤵
  PID:8724
- C:\Windows\System\BxWWaJY.exe
  C:\Windows\System\BxWWaJY.exe
  2⤵
  PID:8784
- C:\Windows\System\OPSYIrT.exe
  C:\Windows\System\OPSYIrT.exe
  2⤵
  PID:8844
- C:\Windows\System\iJxBOCo.exe
  C:\Windows\System\iJxBOCo.exe
  2⤵
  PID:8920
- C:\Windows\System\CvXwPIe.exe
  C:\Windows\System\CvXwPIe.exe
  2⤵
  PID:8984
- C:\Windows\System\aCNnIrD.exe
  C:\Windows\System\aCNnIrD.exe
  2⤵
  PID:9056
- C:\Windows\System\PsHSefS.exe
  C:\Windows\System\PsHSefS.exe
  2⤵
  PID:9120
- C:\Windows\System\dTwBfHh.exe
  C:\Windows\System\dTwBfHh.exe
  2⤵
  PID:9180
- C:\Windows\System\lmTTFXX.exe
  C:\Windows\System\lmTTFXX.exe
  2⤵
  PID:8228
- C:\Windows\System\RZutNkQ.exe
  C:\Windows\System\RZutNkQ.exe
  2⤵
  PID:8404
- C:\Windows\System\LABByfV.exe
  C:\Windows\System\LABByfV.exe
  2⤵
  PID:8564
- C:\Windows\System\SFkyHqu.exe
  C:\Windows\System\SFkyHqu.exe
  2⤵
  PID:8748
- C:\Windows\System\OaehiCB.exe
  C:\Windows\System\OaehiCB.exe
  2⤵
  PID:8896
- C:\Windows\System\sFxpRNa.exe
  C:\Windows\System\sFxpRNa.exe
  2⤵
  PID:9096
- C:\Windows\System\YFiphvq.exe
  C:\Windows\System\YFiphvq.exe
  2⤵
  PID:9208
- C:\Windows\System\lLdBdal.exe
  C:\Windows\System\lLdBdal.exe
  2⤵
  PID:8536
- C:\Windows\System\OGJoytd.exe
  C:\Windows\System\OGJoytd.exe
  2⤵
  PID:8892
- C:\Windows\System\QDiLCHc.exe
  C:\Windows\System\QDiLCHc.exe
  2⤵
  PID:8304
- C:\Windows\System\jtgFTVJ.exe
  C:\Windows\System\jtgFTVJ.exe
  2⤵
  PID:9040
- C:\Windows\System\nctYmAo.exe
  C:\Windows\System\nctYmAo.exe
  2⤵
  PID:8500
- C:\Windows\System\HBVKULw.exe
  C:\Windows\System\HBVKULw.exe
  2⤵
  PID:9244
- C:\Windows\System\ztaxVcw.exe
  C:\Windows\System\ztaxVcw.exe
  2⤵
  PID:9272
- C:\Windows\System\vblPsVY.exe
  C:\Windows\System\vblPsVY.exe
  2⤵
  PID:9300
- C:\Windows\System\UXsWlXD.exe
  C:\Windows\System\UXsWlXD.exe
  2⤵
  PID:9328
- C:\Windows\System\LWsewtB.exe
  C:\Windows\System\LWsewtB.exe
  2⤵
  PID:9356
- C:\Windows\System\AXbGCvS.exe
  C:\Windows\System\AXbGCvS.exe
  2⤵
  PID:9384
- C:\Windows\System\xGZWdbc.exe
  C:\Windows\System\xGZWdbc.exe
  2⤵
  PID:9412
- C:\Windows\System\xptbJhf.exe
  C:\Windows\System\xptbJhf.exe
  2⤵
  PID:9440
- C:\Windows\System\aqmkyVU.exe
  C:\Windows\System\aqmkyVU.exe
  2⤵
  PID:9468
- C:\Windows\System\UYPrQJp.exe
  C:\Windows\System\UYPrQJp.exe
  2⤵
  PID:9496
- C:\Windows\System\LSSiyGz.exe
  C:\Windows\System\LSSiyGz.exe
  2⤵
  PID:9524
- C:\Windows\System\ZllARmx.exe
  C:\Windows\System\ZllARmx.exe
  2⤵
  PID:9552
- C:\Windows\System\KXOdPIN.exe
  C:\Windows\System\KXOdPIN.exe
  2⤵
  PID:9568
- C:\Windows\System\tMfZMrx.exe
  C:\Windows\System\tMfZMrx.exe
  2⤵
  PID:9584
- C:\Windows\System\hBkRzSX.exe
  C:\Windows\System\hBkRzSX.exe
  2⤵
  PID:9612
- C:\Windows\System\QktdFhA.exe
  C:\Windows\System\QktdFhA.exe
  2⤵
  PID:9636
- C:\Windows\System\FQMtmLn.exe
  C:\Windows\System\FQMtmLn.exe
  2⤵
  PID:9680
- C:\Windows\System\djGsqFs.exe
  C:\Windows\System\djGsqFs.exe
  2⤵
  PID:9716
- C:\Windows\System\VkXdrMD.exe
  C:\Windows\System\VkXdrMD.exe
  2⤵
  PID:9752
- C:\Windows\System\bQNCnqr.exe
  C:\Windows\System\bQNCnqr.exe
  2⤵
  PID:9780
- C:\Windows\System\fEuVDUU.exe
  C:\Windows\System\fEuVDUU.exe
  2⤵
  PID:9808
- C:\Windows\System\aTDCemk.exe
  C:\Windows\System\aTDCemk.exe
  2⤵
  PID:9836
- C:\Windows\System\laZDsaF.exe
  C:\Windows\System\laZDsaF.exe
  2⤵
  PID:9864
- C:\Windows\System\nxCmhZN.exe
  C:\Windows\System\nxCmhZN.exe
  2⤵
  PID:9892
- C:\Windows\System\MrakMBn.exe
  C:\Windows\System\MrakMBn.exe
  2⤵
  PID:9920
- C:\Windows\System\jaDBaKF.exe
  C:\Windows\System\jaDBaKF.exe
  2⤵
  PID:9948
- C:\Windows\System\woErqTg.exe
  C:\Windows\System\woErqTg.exe
  2⤵
  PID:9964
- C:\Windows\System\tZIUxbd.exe
  C:\Windows\System\tZIUxbd.exe
  2⤵
  PID:10004
- C:\Windows\System\TbNwPca.exe
  C:\Windows\System\TbNwPca.exe
  2⤵
  PID:10020
- C:\Windows\System\nUMNKGO.exe
  C:\Windows\System\nUMNKGO.exe
  2⤵
  PID:10048
- C:\Windows\System\kfLvaPk.exe
  C:\Windows\System\kfLvaPk.exe
  2⤵
  PID:10076
- C:\Windows\System\EUYHxQK.exe
  C:\Windows\System\EUYHxQK.exe
  2⤵
  PID:10104
- C:\Windows\System\hQslSzE.exe
  C:\Windows\System\hQslSzE.exe
  2⤵
  PID:10140
- C:\Windows\System\GeKnfqb.exe
  C:\Windows\System\GeKnfqb.exe
  2⤵
  PID:10172
- C:\Windows\System\jSRmTib.exe
  C:\Windows\System\jSRmTib.exe
  2⤵
  PID:10200
- C:\Windows\System\OWDslgO.exe
  C:\Windows\System\OWDslgO.exe
  2⤵
  PID:10228
- C:\Windows\System\EUcThaj.exe
  C:\Windows\System\EUcThaj.exe
  2⤵
  PID:9236
- C:\Windows\System\IdVzekR.exe
  C:\Windows\System\IdVzekR.exe
  2⤵
  PID:9320
- C:\Windows\System\FcAYnwc.exe
  C:\Windows\System\FcAYnwc.exe
  2⤵
  PID:9376
- C:\Windows\System\RMZTLLT.exe
  C:\Windows\System\RMZTLLT.exe
  2⤵
  PID:9424
- C:\Windows\System\zbyCWIM.exe
  C:\Windows\System\zbyCWIM.exe
  2⤵
  PID:9512
- C:\Windows\System\JZDFceN.exe
  C:\Windows\System\JZDFceN.exe
  2⤵
  PID:9580
- C:\Windows\System\LeqRUwJ.exe
  C:\Windows\System\LeqRUwJ.exe
  2⤵
  PID:9604
- C:\Windows\System\nUAHYAL.exe
  C:\Windows\System\nUAHYAL.exe
  2⤵
  PID:9708
- C:\Windows\System\fPKixmj.exe
  C:\Windows\System\fPKixmj.exe
  2⤵
  PID:9748
- C:\Windows\System\nrhNoor.exe
  C:\Windows\System\nrhNoor.exe
  2⤵
  PID:9832
- C:\Windows\System\pdKqZZA.exe
  C:\Windows\System\pdKqZZA.exe
  2⤵
  PID:9888
- C:\Windows\System\RRnxPhq.exe
  C:\Windows\System\RRnxPhq.exe
  2⤵
  PID:9932
- C:\Windows\System\wVuFXsU.exe
  C:\Windows\System\wVuFXsU.exe
  2⤵
  PID:10032
- C:\Windows\System\uBOMVXq.exe
  C:\Windows\System\uBOMVXq.exe
  2⤵
  PID:10088
- C:\Windows\System\oJQqBzl.exe
  C:\Windows\System\oJQqBzl.exe
  2⤵
  PID:10124
- C:\Windows\System\pNNsrza.exe
  C:\Windows\System\pNNsrza.exe
  2⤵
  PID:10216
- C:\Windows\System\tnDDKQp.exe
  C:\Windows\System\tnDDKQp.exe
  2⤵
  PID:9348
- C:\Windows\System\xWDjFcO.exe
  C:\Windows\System\xWDjFcO.exe
  2⤵
  PID:9488
- C:\Windows\System\dEUbySY.exe
  C:\Windows\System\dEUbySY.exe
  2⤵
  PID:9624
- C:\Windows\System\RyHeEFI.exe
  C:\Windows\System\RyHeEFI.exe
  2⤵
  PID:9796
- C:\Windows\System\jqZpeuF.exe
  C:\Windows\System\jqZpeuF.exe
  2⤵
  PID:9912
- C:\Windows\System\fsnihwP.exe
  C:\Windows\System\fsnihwP.exe
  2⤵
  PID:10068
- C:\Windows\System\KgobNHz.exe
  C:\Windows\System\KgobNHz.exe
  2⤵
  PID:9284
- C:\Windows\System\kJKyFak.exe
  C:\Windows\System\kJKyFak.exe
  2⤵
  PID:9396
- C:\Windows\System\PukOIol.exe
  C:\Windows\System\PukOIol.exe
  2⤵
  PID:9876
- C:\Windows\System\RnLAWZo.exe
  C:\Windows\System\RnLAWZo.exe
  2⤵
  PID:9228
- C:\Windows\System\JGyYdMM.exe
  C:\Windows\System\JGyYdMM.exe
  2⤵
  PID:10064
- C:\Windows\System\SRWEpfv.exe
  C:\Windows\System\SRWEpfv.exe
  2⤵
  PID:10248
- C:\Windows\System\VilERMr.exe
  C:\Windows\System\VilERMr.exe
  2⤵
  PID:10272
- C:\Windows\System\FWUTpBA.exe
  C:\Windows\System\FWUTpBA.exe
  2⤵
  PID:10304
- C:\Windows\System\mFUySAV.exe
  C:\Windows\System\mFUySAV.exe
  2⤵
  PID:10332
- C:\Windows\System\PuwFJMD.exe
  C:\Windows\System\PuwFJMD.exe
  2⤵
  PID:10360
- C:\Windows\System\CFiwUYf.exe
  C:\Windows\System\CFiwUYf.exe
  2⤵
  PID:10388
- C:\Windows\System\oeTUCTw.exe
  C:\Windows\System\oeTUCTw.exe
  2⤵
  PID:10404
- C:\Windows\System\iesSmAG.exe
  C:\Windows\System\iesSmAG.exe
  2⤵
  PID:10444
- C:\Windows\System\ICTdEeN.exe
  C:\Windows\System\ICTdEeN.exe
  2⤵
  PID:10460
- C:\Windows\System\SkozVez.exe
  C:\Windows\System\SkozVez.exe
  2⤵
  PID:10500
- C:\Windows\System\iOuSoyg.exe
  C:\Windows\System\iOuSoyg.exe
  2⤵
  PID:10528
- C:\Windows\System\ciSsWjn.exe
  C:\Windows\System\ciSsWjn.exe
  2⤵
  PID:10556
- C:\Windows\System\rjcQoJa.exe
  C:\Windows\System\rjcQoJa.exe
  2⤵
  PID:10572
- C:\Windows\System\NROoBQj.exe
  C:\Windows\System\NROoBQj.exe
  2⤵
  PID:10612
- C:\Windows\System\WmIQlmh.exe
  C:\Windows\System\WmIQlmh.exe
  2⤵
  PID:10640
- C:\Windows\System\UnFvWFb.exe
  C:\Windows\System\UnFvWFb.exe
  2⤵
  PID:10668
- C:\Windows\System\HxFmgmC.exe
  C:\Windows\System\HxFmgmC.exe
  2⤵
  PID:10684
- C:\Windows\System\lCtKuXf.exe
  C:\Windows\System\lCtKuXf.exe
  2⤵
  PID:10712
- C:\Windows\System\MxvUGZc.exe
  C:\Windows\System\MxvUGZc.exe
  2⤵
  PID:10740
- C:\Windows\System\sFKodAs.exe
  C:\Windows\System\sFKodAs.exe
  2⤵
  PID:10760
- C:\Windows\System\nImEhBI.exe
  C:\Windows\System\nImEhBI.exe
  2⤵
  PID:10788
- C:\Windows\System\mmMnhbO.exe
  C:\Windows\System\mmMnhbO.exe
  2⤵
  PID:10848
- C:\Windows\System\HtMnIpv.exe
  C:\Windows\System\HtMnIpv.exe
  2⤵
  PID:10888
- C:\Windows\System\cwZkUEd.exe
  C:\Windows\System\cwZkUEd.exe
  2⤵
  PID:10916
- C:\Windows\System\fNpFKog.exe
  C:\Windows\System\fNpFKog.exe
  2⤵
  PID:10932
- C:\Windows\System\egcOBIH.exe
  C:\Windows\System\egcOBIH.exe
  2⤵
  PID:10988
- C:\Windows\System\VJzLrDq.exe
  C:\Windows\System\VJzLrDq.exe
  2⤵
  PID:11004
- C:\Windows\System\CMtbbah.exe
  C:\Windows\System\CMtbbah.exe
  2⤵
  PID:11040
- C:\Windows\System\bKjpJAW.exe
  C:\Windows\System\bKjpJAW.exe
  2⤵
  PID:11076
- C:\Windows\System\SxpVJLb.exe
  C:\Windows\System\SxpVJLb.exe
  2⤵
  PID:11108
- C:\Windows\System\mvCPzsF.exe
  C:\Windows\System\mvCPzsF.exe
  2⤵
  PID:11128
- C:\Windows\System\mxrXUkD.exe
  C:\Windows\System\mxrXUkD.exe
  2⤵
  PID:11164
- C:\Windows\System\ojcURYY.exe
  C:\Windows\System\ojcURYY.exe
  2⤵
  PID:11192
- C:\Windows\System\OpsHTpt.exe
  C:\Windows\System\OpsHTpt.exe
  2⤵
  PID:11220
- C:\Windows\System\zKwEaas.exe
  C:\Windows\System\zKwEaas.exe
  2⤵
  PID:11248
- C:\Windows\System\hPShEGS.exe
  C:\Windows\System\hPShEGS.exe
  2⤵
  PID:10256
- C:\Windows\System\GTrhDcu.exe
  C:\Windows\System\GTrhDcu.exe
  2⤵
  PID:10300
- C:\Windows\System\aZNVyOI.exe
  C:\Windows\System\aZNVyOI.exe
  2⤵
  PID:10396
- C:\Windows\System\IVcnEvf.exe
  C:\Windows\System\IVcnEvf.exe
  2⤵
  PID:10452
- C:\Windows\System\ASfcCgA.exe
  C:\Windows\System\ASfcCgA.exe
  2⤵
  PID:10524
- C:\Windows\System\dYXRAki.exe
  C:\Windows\System\dYXRAki.exe
  2⤵
  PID:10600
- C:\Windows\System\QWLIjsP.exe
  C:\Windows\System\QWLIjsP.exe
  2⤵
  PID:10680
- C:\Windows\System\vgFRplj.exe
  C:\Windows\System\vgFRplj.exe
  2⤵
  PID:10676
- C:\Windows\System\dkGNtLm.exe
  C:\Windows\System\dkGNtLm.exe
  2⤵
  PID:10732
- C:\Windows\System\EGBTTsa.exe
  C:\Windows\System\EGBTTsa.exe
  2⤵
  PID:10880
- C:\Windows\System\YzLsxSi.exe
  C:\Windows\System\YzLsxSi.exe
  2⤵
  PID:10948
- C:\Windows\System\bJnAZja.exe
  C:\Windows\System\bJnAZja.exe
  2⤵
  PID:10996
- C:\Windows\System\MgSdxej.exe
  C:\Windows\System\MgSdxej.exe
  2⤵
  PID:11084
- C:\Windows\System\rTJUbjn.exe
  C:\Windows\System\rTJUbjn.exe
  2⤵
  PID:11156
- C:\Windows\System\gChZOII.exe
  C:\Windows\System\gChZOII.exe
  2⤵
  PID:11212
- C:\Windows\System\GNAcVrH.exe
  C:\Windows\System\GNAcVrH.exe
  2⤵
  PID:10284
- C:\Windows\System\KKMJDsM.exe
  C:\Windows\System\KKMJDsM.exe
  2⤵
  PID:10428
- C:\Windows\System\ahCkHdf.exe
  C:\Windows\System\ahCkHdf.exe
  2⤵
  PID:10512
- C:\Windows\System\wdQZYgn.exe
  C:\Windows\System\wdQZYgn.exe
  2⤵
  PID:10708
- C:\Windows\System\LieVRVd.exe
  C:\Windows\System\LieVRVd.exe
  2⤵
  PID:10844
- C:\Windows\System\mMMmobl.exe
  C:\Windows\System\mMMmobl.exe
  2⤵
  PID:11036
- C:\Windows\System\fsDoAat.exe
  C:\Windows\System\fsDoAat.exe
  2⤵
  PID:11208
- C:\Windows\System\adCwxsd.exe
  C:\Windows\System\adCwxsd.exe
  2⤵
  PID:10520
- C:\Windows\System\qMwFzaq.exe
  C:\Windows\System\qMwFzaq.exe
  2⤵
  PID:10924
- C:\Windows\System\ttkBJoR.exe
  C:\Windows\System\ttkBJoR.exe
  2⤵
  PID:10380
- C:\Windows\System\NFGjhXD.exe
  C:\Windows\System\NFGjhXD.exe
  2⤵
  PID:10592
- C:\Windows\System\IzAaJPY.exe
  C:\Windows\System\IzAaJPY.exe
  2⤵
  PID:11116
- C:\Windows\System\rZPKjMl.exe
  C:\Windows\System\rZPKjMl.exe
  2⤵
  PID:11280
- C:\Windows\System\qkkNkrF.exe
  C:\Windows\System\qkkNkrF.exe
  2⤵
  PID:11336
- C:\Windows\System\xQZmSMR.exe
  C:\Windows\System\xQZmSMR.exe
  2⤵
  PID:11364
- C:\Windows\System\BVfmRaW.exe
  C:\Windows\System\BVfmRaW.exe
  2⤵
  PID:11392
- C:\Windows\System\nNnzWxr.exe
  C:\Windows\System\nNnzWxr.exe
  2⤵
  PID:11420
- C:\Windows\System\PXyEzYC.exe
  C:\Windows\System\PXyEzYC.exe
  2⤵
  PID:11448
- C:\Windows\System\nlbZwuD.exe
  C:\Windows\System\nlbZwuD.exe
  2⤵
  PID:11476
- C:\Windows\System\wqokuBe.exe
  C:\Windows\System\wqokuBe.exe
  2⤵
  PID:11504
- C:\Windows\System\ZflCuQy.exe
  C:\Windows\System\ZflCuQy.exe
  2⤵
  PID:11520
- C:\Windows\System\PjntEsD.exe
  C:\Windows\System\PjntEsD.exe
  2⤵
  PID:11548
- C:\Windows\System\uZBKMzt.exe
  C:\Windows\System\uZBKMzt.exe
  2⤵
  PID:11576
- C:\Windows\System\JUgnkIG.exe
  C:\Windows\System\JUgnkIG.exe
  2⤵
  PID:11604
- C:\Windows\System\nqCuGCm.exe
  C:\Windows\System\nqCuGCm.exe
  2⤵
  PID:11644
- C:\Windows\System\PJJqFoY.exe
  C:\Windows\System\PJJqFoY.exe
  2⤵
  PID:11672
- C:\Windows\System\bhyXPFQ.exe
  C:\Windows\System\bhyXPFQ.exe
  2⤵
  PID:11700
- C:\Windows\System\gfrsrjD.exe
  C:\Windows\System\gfrsrjD.exe
  2⤵
  PID:11728
- C:\Windows\System\ofnLLzr.exe
  C:\Windows\System\ofnLLzr.exe
  2⤵
  PID:11756
- C:\Windows\System\KXInaDd.exe
  C:\Windows\System\KXInaDd.exe
  2⤵
  PID:11784
- C:\Windows\System\tXlCAla.exe
  C:\Windows\System\tXlCAla.exe
  2⤵
  PID:11812
- C:\Windows\System\kiVblUF.exe
  C:\Windows\System\kiVblUF.exe
  2⤵
  PID:11840
- C:\Windows\System\ebZXsUG.exe
  C:\Windows\System\ebZXsUG.exe
  2⤵
  PID:11872
- C:\Windows\System\RdHIvqF.exe
  C:\Windows\System\RdHIvqF.exe
  2⤵
  PID:11900
- C:\Windows\System\NChhuqO.exe
  C:\Windows\System\NChhuqO.exe
  2⤵
  PID:11928
- C:\Windows\System\aUCSkcP.exe
  C:\Windows\System\aUCSkcP.exe
  2⤵
  PID:11944
- C:\Windows\System\tDynZpm.exe
  C:\Windows\System\tDynZpm.exe
  2⤵
  PID:11964
- C:\Windows\System\PTdnVBn.exe
  C:\Windows\System\PTdnVBn.exe
  2⤵
  PID:12008
- C:\Windows\System\TagTIJG.exe
  C:\Windows\System\TagTIJG.exe
  2⤵
  PID:12040
- C:\Windows\System\KEhnmdY.exe
  C:\Windows\System\KEhnmdY.exe
  2⤵
  PID:12068
- C:\Windows\System\ICLTSzU.exe
  C:\Windows\System\ICLTSzU.exe
  2⤵
  PID:12096
- C:\Windows\System\iTxztKv.exe
  C:\Windows\System\iTxztKv.exe
  2⤵
  PID:12124
- C:\Windows\System\DXEtduL.exe
  C:\Windows\System\DXEtduL.exe
  2⤵
  PID:12152
- C:\Windows\System\BYFBEYP.exe
  C:\Windows\System\BYFBEYP.exe
  2⤵
  PID:12180
- C:\Windows\System\jZPNjsB.exe
  C:\Windows\System\jZPNjsB.exe
  2⤵
  PID:12208
- C:\Windows\System\nQYZgIw.exe
  C:\Windows\System\nQYZgIw.exe
  2⤵
  PID:12240
- C:\Windows\System\byYrTHF.exe
  C:\Windows\System\byYrTHF.exe
  2⤵
  PID:12264
- C:\Windows\System\AYkkLra.exe
  C:\Windows\System\AYkkLra.exe
  2⤵
  PID:11092
- C:\Windows\System\yfzTGic.exe
  C:\Windows\System\yfzTGic.exe
  2⤵
  PID:11328
- C:\Windows\System\pEEExLJ.exe
  C:\Windows\System\pEEExLJ.exe
  2⤵
  PID:11380
- C:\Windows\System\fHRnwgD.exe
  C:\Windows\System\fHRnwgD.exe
  2⤵
  PID:10756
- C:\Windows\System\QKNOhav.exe
  C:\Windows\System\QKNOhav.exe
  2⤵
  PID:11512
- C:\Windows\System\GERrBzp.exe
  C:\Windows\System\GERrBzp.exe
  2⤵
  PID:11564
- C:\Windows\System\vxiZAAO.exe
  C:\Windows\System\vxiZAAO.exe
  2⤵
  PID:11624
- C:\Windows\System\pRSxrMc.exe
  C:\Windows\System\pRSxrMc.exe
  2⤵
  PID:11716
- C:\Windows\System\zEORgMv.exe
  C:\Windows\System\zEORgMv.exe
  2⤵
  PID:11776
- C:\Windows\System\QwjOTOl.exe
  C:\Windows\System\QwjOTOl.exe
  2⤵
  PID:11808
- C:\Windows\System\NlMRiTn.exe
  C:\Windows\System\NlMRiTn.exe
  2⤵
  PID:11868
- C:\Windows\System\mwfShtW.exe
  C:\Windows\System\mwfShtW.exe
  2⤵
  PID:11960
- C:\Windows\System\xRUcXwU.exe
  C:\Windows\System\xRUcXwU.exe
  2⤵
  PID:12036
- C:\Windows\System\oaEjKsJ.exe
  C:\Windows\System\oaEjKsJ.exe
  2⤵
  PID:12084
- C:\Windows\System\XEbaKSd.exe
  C:\Windows\System\XEbaKSd.exe
  2⤵
  PID:12144
- C:\Windows\System\lZzIMwP.exe
  C:\Windows\System\lZzIMwP.exe
  2⤵
  PID:3052
- C:\Windows\System\FulCGKX.exe
  C:\Windows\System\FulCGKX.exe
  2⤵
  PID:1624
- C:\Windows\System\iLqupZO.exe
  C:\Windows\System\iLqupZO.exe
  2⤵
  PID:5380
- C:\Windows\System\ORTxZaz.exe
  C:\Windows\System\ORTxZaz.exe
  2⤵
  PID:12256
- C:\Windows\System\ZJdYeQB.exe
  C:\Windows\System\ZJdYeQB.exe
  2⤵
  PID:12280
- C:\Windows\System\bjxKAXv.exe
  C:\Windows\System\bjxKAXv.exe
  2⤵
  PID:11416
- C:\Windows\System\SksYcgd.exe
  C:\Windows\System\SksYcgd.exe
  2⤵
  PID:11544
- C:\Windows\System\uOBQQYB.exe
  C:\Windows\System\uOBQQYB.exe
  2⤵
  PID:11692
- C:\Windows\System\BYrhxsE.exe
  C:\Windows\System\BYrhxsE.exe
  2⤵
  PID:11804
- C:\Windows\System\rCKogHm.exe
  C:\Windows\System\rCKogHm.exe
  2⤵
  PID:11920
- C:\Windows\System\MePmTsU.exe
  C:\Windows\System\MePmTsU.exe
  2⤵
  PID:12064
- C:\Windows\System\OmDjcTM.exe
  C:\Windows\System\OmDjcTM.exe
  2⤵
  PID:12228
- C:\Windows\System\wdAUgNn.exe
  C:\Windows\System\wdAUgNn.exe
  2⤵
  PID:6644
- C:\Windows\System\NQMJjkp.exe
  C:\Windows\System\NQMJjkp.exe
  2⤵
  PID:11532
- C:\Windows\System\WOptHMz.exe
  C:\Windows\System\WOptHMz.exe
  2⤵
  PID:11896
- C:\Windows\System\YALwUtC.exe
  C:\Windows\System\YALwUtC.exe
  2⤵
  PID:12140
- C:\Windows\System\kcvCVht.exe
  C:\Windows\System\kcvCVht.exe
  2⤵
  PID:11140
- C:\Windows\System\LUzLRJK.exe
  C:\Windows\System\LUzLRJK.exe
  2⤵
  PID:6212
- C:\Windows\System\lxmVKMQ.exe
  C:\Windows\System\lxmVKMQ.exe
  2⤵
  PID:12296
- C:\Windows\System\GPWvnZs.exe
  C:\Windows\System\GPWvnZs.exe
  2⤵
  PID:12312
- C:\Windows\System\yywtblV.exe
  C:\Windows\System\yywtblV.exe
  2⤵
  PID:12352
- C:\Windows\System\aIsSOeJ.exe
  C:\Windows\System\aIsSOeJ.exe
  2⤵
  PID:12380
- C:\Windows\System\bEtZVvc.exe
  C:\Windows\System\bEtZVvc.exe
  2⤵
  PID:12396
- C:\Windows\System\nNqBUwW.exe
  C:\Windows\System\nNqBUwW.exe
  2⤵
  PID:12428
- C:\Windows\System\fZwpFbw.exe
  C:\Windows\System\fZwpFbw.exe
  2⤵
  PID:12464
- C:\Windows\System\tAiqDLO.exe
  C:\Windows\System\tAiqDLO.exe
  2⤵
  PID:12492
- C:\Windows\System\JmXBlBz.exe
  C:\Windows\System\JmXBlBz.exe
  2⤵
  PID:12520
- C:\Windows\System\bkPZQHa.exe
  C:\Windows\System\bkPZQHa.exe
  2⤵
  PID:12548
- C:\Windows\System\EOaodPK.exe
  C:\Windows\System\EOaodPK.exe
  2⤵
  PID:12568
- C:\Windows\System\jTBDcRC.exe
  C:\Windows\System\jTBDcRC.exe
  2⤵
  PID:12604
- C:\Windows\System\xQxGIox.exe
  C:\Windows\System\xQxGIox.exe
  2⤵
  PID:12620
- C:\Windows\System\dYbGIJi.exe
  C:\Windows\System\dYbGIJi.exe
  2⤵
  PID:12652
- C:\Windows\System\rCaXiDZ.exe
  C:\Windows\System\rCaXiDZ.exe
  2⤵
  PID:12692
- C:\Windows\System\cKzkIzP.exe
  C:\Windows\System\cKzkIzP.exe
  2⤵
  PID:12716
- C:\Windows\System\PbHMYKD.exe
  C:\Windows\System\PbHMYKD.exe
  2⤵
  PID:12744
- C:\Windows\System\gpTwREH.exe
  C:\Windows\System\gpTwREH.exe
  2⤵
  PID:12760
- C:\Windows\System\NvUbbzF.exe
  C:\Windows\System\NvUbbzF.exe
  2⤵
  PID:12800
- C:\Windows\System\wzKsVBi.exe
  C:\Windows\System\wzKsVBi.exe
  2⤵
  PID:12820
- C:\Windows\System\tHIbvqy.exe
  C:\Windows\System\tHIbvqy.exe
  2⤵
  PID:12864
- C:\Windows\System\FHqEnBU.exe
  C:\Windows\System\FHqEnBU.exe
  2⤵
  PID:12896
- C:\Windows\System\nwNawyj.exe
  C:\Windows\System\nwNawyj.exe
  2⤵
  PID:12924
- C:\Windows\System\DTsNfuF.exe
  C:\Windows\System\DTsNfuF.exe
  2⤵
  PID:12960
- C:\Windows\System\SgkROei.exe
  C:\Windows\System\SgkROei.exe
  2⤵
  PID:13028
- C:\Windows\System\MazfBnO.exe
  C:\Windows\System\MazfBnO.exe
  2⤵
  PID:13068
- C:\Windows\System\NqcbUUO.exe
  C:\Windows\System\NqcbUUO.exe
  2⤵
  PID:13112
- C:\Windows\System\HwxOlda.exe
  C:\Windows\System\HwxOlda.exe
  2⤵
  PID:13160
- C:\Windows\System\lCWMXFp.exe
  C:\Windows\System\lCWMXFp.exe
  2⤵
  PID:13180
- C:\Windows\System\gYRhhwn.exe
  C:\Windows\System\gYRhhwn.exe
  2⤵
  PID:13200
- C:\Windows\System\yySMXCR.exe
  C:\Windows\System\yySMXCR.exe
  2⤵
  PID:13220
- C:\Windows\System\ZjSqnno.exe
  C:\Windows\System\ZjSqnno.exe
  2⤵
  PID:13244
- C:\Windows\System\qCnNIsb.exe
  C:\Windows\System\qCnNIsb.exe
  2⤵
  PID:13308
- C:\Windows\System\CUKnqwt.exe
  C:\Windows\System\CUKnqwt.exe
  2⤵
  PID:12328
- C:\Windows\System\WymZJuc.exe
  C:\Windows\System\WymZJuc.exe
  2⤵
  PID:12420
- C:\Windows\System\GNXZlYB.exe
  C:\Windows\System\GNXZlYB.exe
  2⤵
  PID:12460
- C:\Windows\System\BWVAqsI.exe
  C:\Windows\System\BWVAqsI.exe
  2⤵
  PID:12504
- C:\Windows\System\xumZaLf.exe
  C:\Windows\System\xumZaLf.exe
  2⤵
  PID:12532
- C:\Windows\System\kIBLXXg.exe
  C:\Windows\System\kIBLXXg.exe
  2⤵
  PID:12644
- C:\Windows\System\sVAjlSg.exe
  C:\Windows\System\sVAjlSg.exe
  2⤵
  PID:12736
- C:\Windows\System\lRmWfTF.exe
  C:\Windows\System\lRmWfTF.exe
  2⤵
  PID:12872
- C:\Windows\System\amBJjYF.exe
  C:\Windows\System\amBJjYF.exe
  2⤵
  PID:12888
- C:\Windows\System\LcpvHza.exe
  C:\Windows\System\LcpvHza.exe
  2⤵
  PID:13012
- C:\Windows\System\xzuiaGR.exe
  C:\Windows\System\xzuiaGR.exe
  2⤵
  PID:13096
- C:\Windows\System\DtnSrii.exe
  C:\Windows\System\DtnSrii.exe
  2⤵
  PID:13172
- C:\Windows\System\lGMKddx.exe
  C:\Windows\System\lGMKddx.exe
  2⤵
  PID:13268
- C:\Windows\System\nJbDfcd.exe
  C:\Windows\System\nJbDfcd.exe
  2⤵
  PID:12308
- C:\Windows\System\ImNLYlc.exe
  C:\Windows\System\ImNLYlc.exe
  2⤵
  PID:12536
- C:\Windows\System\NlpiUCc.exe
  C:\Windows\System\NlpiUCc.exe
  2⤵
  PID:12660
- C:\Windows\System\kUENfds.exe
  C:\Windows\System\kUENfds.exe
  2⤵
  PID:12708
- C:\Windows\System\xgCgNIA.exe
  C:\Windows\System\xgCgNIA.exe
  2⤵
  PID:12948
- C:\Windows\System\tzqkKxp.exe
  C:\Windows\System\tzqkKxp.exe
  2⤵
  PID:13156
- C:\Windows\System\PGBivrx.exe
  C:\Windows\System\PGBivrx.exe
  2⤵
  PID:12456
- C:\Windows\System\eBuotnv.exe
  C:\Windows\System\eBuotnv.exe
  2⤵
  PID:13188
- C:\Windows\System\ytDbwkC.exe
  C:\Windows\System\ytDbwkC.exe
  2⤵
  PID:13324
- C:\Windows\System\NfBfLrk.exe
  C:\Windows\System\NfBfLrk.exe
  2⤵
  PID:13352
- C:\Windows\System\qMmJEkt.exe
  C:\Windows\System\qMmJEkt.exe
  2⤵
  PID:13380
- C:\Windows\System\tipySez.exe
  C:\Windows\System\tipySez.exe
  2⤵
  PID:13396
- C:\Windows\System\xNBlDYA.exe
  C:\Windows\System\xNBlDYA.exe
  2⤵
  PID:13424
- C:\Windows\System\dLxhDoe.exe
  C:\Windows\System\dLxhDoe.exe
  2⤵
  PID:13484
- C:\Windows\System\IfyjnKi.exe
  C:\Windows\System\IfyjnKi.exe
  2⤵
  PID:13500
- C:\Windows\System\xFeNaxF.exe
  C:\Windows\System\xFeNaxF.exe
  2⤵
  PID:13516
- C:\Windows\System\zRjolZU.exe
  C:\Windows\System\zRjolZU.exe
  2⤵
  PID:13548
- C:\Windows\System\GTWNFBu.exe
  C:\Windows\System\GTWNFBu.exe
  2⤵
  PID:13576
- C:\Windows\System\emSOCuc.exe
  C:\Windows\System\emSOCuc.exe
  2⤵
  PID:13604
- C:\Windows\System\KXtKccm.exe
  C:\Windows\System\KXtKccm.exe
  2⤵
  PID:13632
- C:\Windows\System\xLlpeqO.exe
  C:\Windows\System\xLlpeqO.exe
  2⤵
  PID:13664
- C:\Windows\System\jUbazvu.exe
  C:\Windows\System\jUbazvu.exe
  2⤵
  PID:13704
- C:\Windows\System\UHZzAHA.exe
  C:\Windows\System\UHZzAHA.exe
  2⤵
  PID:13732
- C:\Windows\System\YsvUSyI.exe
  C:\Windows\System\YsvUSyI.exe
  2⤵
  PID:13752
- C:\Windows\System\cKkuUeu.exe
  C:\Windows\System\cKkuUeu.exe
  2⤵
  PID:13780
- C:\Windows\System\KzoiikT.exe
  C:\Windows\System\KzoiikT.exe
  2⤵
  PID:13804
- C:\Windows\System\aUkVyYK.exe
  C:\Windows\System\aUkVyYK.exe
  2⤵
  PID:13844
- C:\Windows\System\RyvbDfA.exe
  C:\Windows\System\RyvbDfA.exe
  2⤵
  PID:13860
- C:\Windows\System\nOJYPho.exe
  C:\Windows\System\nOJYPho.exe
  2⤵
  PID:13884
- C:\Windows\System\dRHJaWY.exe
  C:\Windows\System\dRHJaWY.exe
  2⤵
  PID:13916
- C:\Windows\System\OzxNwLf.exe
  C:\Windows\System\OzxNwLf.exe
  2⤵
  PID:13948
- C:\Windows\System\LmuCUeB.exe
  C:\Windows\System\LmuCUeB.exe
  2⤵
  PID:13984
- C:\Windows\System\oyofeZn.exe
  C:\Windows\System\oyofeZn.exe
  2⤵
  PID:14004
- C:\Windows\System\tRMJbyV.exe
  C:\Windows\System\tRMJbyV.exe
  2⤵
  PID:14036
- C:\Windows\System\MVOrVfi.exe
  C:\Windows\System\MVOrVfi.exe
  2⤵
  PID:14056
- C:\Windows\System\QvlUywK.exe
  C:\Windows\System\QvlUywK.exe
  2⤵
  PID:14084
- C:\Windows\System\iAAdkdg.exe
  C:\Windows\System\iAAdkdg.exe
  2⤵
  PID:14124
- C:\Windows\System\fMCjLdk.exe
  C:\Windows\System\fMCjLdk.exe
  2⤵
  PID:14148
- C:\Windows\System\riogDoa.exe
  C:\Windows\System\riogDoa.exe
  2⤵
  PID:14180
- C:\Windows\System\fxYXnkk.exe
  C:\Windows\System\fxYXnkk.exe
  2⤵
  PID:14208
- C:\Windows\System\ufiQxJS.exe
  C:\Windows\System\ufiQxJS.exe
  2⤵
  PID:14236
- C:\Windows\System\OqeXbQL.exe
  C:\Windows\System\OqeXbQL.exe
  2⤵
  PID:14264
- C:\Windows\System\MjlhQwK.exe
  C:\Windows\System\MjlhQwK.exe
  2⤵
  PID:14280
- C:\Windows\System\UnZTqda.exe
  C:\Windows\System\UnZTqda.exe
  2⤵
  PID:14320
- C:\Windows\System\MNyMjEJ.exe
  C:\Windows\System\MNyMjEJ.exe
  2⤵
  PID:11996
- C:\Windows\System\xxTeopk.exe
  C:\Windows\System\xxTeopk.exe
  2⤵
  PID:13368
- C:\Windows\System\dqwiarS.exe
  C:\Windows\System\dqwiarS.exe
  2⤵
  PID:13416
- C:\Windows\System\FpTzUmm.exe
  C:\Windows\System\FpTzUmm.exe
  2⤵
  PID:13480
- C:\Windows\System\wgDzsDf.exe
  C:\Windows\System\wgDzsDf.exe
  2⤵
  PID:13560
- C:\Windows\System\jwmgTsX.exe
  C:\Windows\System\jwmgTsX.exe
  2⤵
  PID:13564
- C:\Windows\System\RJTRMKM.exe
  C:\Windows\System\RJTRMKM.exe
  2⤵
  PID:13700
- C:\Windows\System\BbSSiDm.exe
  C:\Windows\System\BbSSiDm.exe
  2⤵
  PID:13760
- C:\Windows\System\rtpniBD.exe
  C:\Windows\System\rtpniBD.exe
  2⤵
  PID:13824
- C:\Windows\System\HdhnnOZ.exe
  C:\Windows\System\HdhnnOZ.exe
  2⤵
  PID:13880
- C:\Windows\System\OAMobng.exe
  C:\Windows\System\OAMobng.exe
  2⤵
  PID:13956
- C:\Windows\System\LvvOvxm.exe
  C:\Windows\System\LvvOvxm.exe
  2⤵
  PID:14020
- C:\Windows\System\vTRDJCT.exe
  C:\Windows\System\vTRDJCT.exe
  2⤵
  PID:14052
- C:\Windows\System\rBNAFJl.exe
  C:\Windows\System\rBNAFJl.exe
  2⤵
  PID:14144
- C:\Windows\System\mjuLFrA.exe
  C:\Windows\System\mjuLFrA.exe
  2⤵
  PID:14220
- C:\Windows\System\VZxKseE.exe
  C:\Windows\System\VZxKseE.exe
  2⤵
  PID:14276
- C:\Windows\System\ovBHFen.exe
  C:\Windows\System\ovBHFen.exe
  2⤵
  PID:14332
- C:\Windows\System\dPQGbHs.exe
  C:\Windows\System\dPQGbHs.exe
  2⤵
  PID:13464
- C:\Windows\System\PcVusSb.exe
  C:\Windows\System\PcVusSb.exe
  2⤵
  PID:13600
- C:\Windows\System\uUKsVvs.exe
  C:\Windows\System\uUKsVvs.exe
  2⤵
  PID:13688
- C:\Windows\System\AOTbXnO.exe
  C:\Windows\System\AOTbXnO.exe
  2⤵
  PID:13852
- C:\Windows\System\UQDgfiE.exe
  C:\Windows\System\UQDgfiE.exe
  2⤵
  PID:13992
- C:\Windows\System\IVMgwnh.exe
  C:\Windows\System\IVMgwnh.exe
  2⤵
  PID:14204
- C:\Windows\System\zubJcNV.exe
  C:\Windows\System\zubJcNV.exe
  2⤵
  PID:14300
- C:\Windows\System\rKqkERz.exe
  C:\Windows\System\rKqkERz.exe
  2⤵
  PID:13748
- C:\Windows\System\ssUldLi.exe
  C:\Windows\System\ssUldLi.exe
  2⤵
  PID:13928
- C:\Windows\System\ZjUxaUK.exe
  C:\Windows\System\ZjUxaUK.exe
  2⤵
  PID:14256
- C:\Windows\System\Gsrzwqo.exe
  C:\Windows\System\Gsrzwqo.exe
  2⤵
  PID:14120
- C:\Windows\System\zSkQcXS.exe
  C:\Windows\System\zSkQcXS.exe
  2⤵
  PID:14364
- C:\Windows\System\hLSjZsa.exe
  C:\Windows\System\hLSjZsa.exe
  2⤵
  PID:14392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AmBFaoK.exe

Filesize
2.0MB

MD5
31de7ad9892893bc190e65379b381679

SHA1
cd6c181fac23adf2ecdb5da927cd72902a210eea

SHA256
bd8717d42f026b6ea5c9c047303dc5923a76709c16cc922d56f0552db3953731

SHA512
a6cf77999c3ee91a10f3d3fbdea4c77820d02342b0a07160fee27b4a68a741dac0a5a9f579570fd6c6d08c5284d9b67c2d80dbf977549b923575fc6db4cfbb28

Download Submit
C:\Windows\System\BtoUNcC.exe

Filesize
2.0MB

MD5
baab149ef8ef020254f3f81046d58851

SHA1
73928cf7c743f43a3d16145bdba893cf3fbbf370

SHA256
3bbaecec8da695e16b5cd822fcfaf7b1ba244d739c0b14a7d8ee414fceb04e33

SHA512
43838b08c4625cac09b5bd5755ef0dd3a23732d822fa687831361abe73db2ad22f784cd6ee26b03150cd9f72b5a4a8812386aeebc969fc89e1ccc9880fa09a7a

Download Submit
C:\Windows\System\DDqPRyh.exe

Filesize
2.0MB

MD5
7b74af229e26396f5d5710805c4bce43

SHA1
0f659d6fe8b8837ffca9e70e410aa3168a22bc0b

SHA256
98e745255800cc6b6bebbda6a5b45dd5071194fcda0cc1a08d7c8d3ac0e4ef96

SHA512
66f3b9097cea43b438a05c144185da9ffff2c66a5d5469b61017dc334e98603adfd209671098ff9e17dd09a805d3bfa769b1299be088cc97917be2f7ae79d6e7

Download Submit
C:\Windows\System\EnQbqwE.exe

Filesize
2.0MB

MD5
b218aff37a340ae110f3109da2f0c6b9

SHA1
83dd9a68ddbe62087e771f15a546178e013996cf

SHA256
2e77d3642b4b67753967b61253c5f6fffb24b027c479a1f5e91b936da8866568

SHA512
86044b1c4ed33dbeb02a91b178b683a2c358ae3d21968750df40d5d761d193305685f28861f118e8dba9cb28456168a420cd9c184bc58c169b078d3ed81028af

Download Submit
C:\Windows\System\Gmblaen.exe

Filesize
2.0MB

MD5
d36260147f64c90cb048ac6261e2b37d

SHA1
ffc6eb6bdaff7a8a6468440e204fe0e71917728f

SHA256
ba4967e86e1d8cf52bee4993274aa980b6edbc5cd3cc4bf613ef83feb8a6cf78

SHA512
5f87a1fb99db65440acdaad81bb9199d7fcbae9a7a9e00f0320f086e59fe6c0877effc12bda09e10fabf7190fde949ee25736abfd44b31daee15608080f4b9c3

Download Submit
C:\Windows\System\Mhrsmrm.exe

Filesize
2.0MB

MD5
c29f76c52f17c81df9d18c3f59be364b

SHA1
8fb67948e6fd1d41b900d1c756d5f6e1ad71d2be

SHA256
ab3e5926e4f6eaa16726debfe5b8179eb47a193c5c14dd2858fbe56266b6cebd

SHA512
16481124e7cdbeaafef72eb7890eed012b522b11b2d2323d03ba4dcc467d73b552c41287a2a88e8ef2cb70367d4f081defde791a1481be281783bdd0e07f5dd5

Download Submit
C:\Windows\System\NbhFmXc.exe

Filesize
2.0MB

MD5
762482b1e6c918c8d97b0710dccb7edf

SHA1
3a8159711052f92557e5ed1433912e7fe8eda2fb

SHA256
cb749b8e2dce217dde4e149e0c74efe82af46bba526868b1d8e13701a2e5c329

SHA512
23190bed8b4eed45ef235de531a73f474d4739de24604104b586066255cd56c141d59cabcf5e397d94869969b659bceaf213ccc234d173a30d284a4f02fcc059

Download Submit
C:\Windows\System\PrqPgCT.exe

Filesize
2.0MB

MD5
241fc4e70657a0ff75bc6f889d829617

SHA1
d7da23fb728f8571dbebe3a4325d852de45fae54

SHA256
50be3dc52942c919afc915cd2ae2c830257aa7191bcf782091472ecd72292406

SHA512
6e20947ff8611bf829cf6a65b2b3f1cf2d97f966e386948bcf1fc754582caa8ae42fd9a15f92ee0a7b9dd1b0b4ca2c6417b86e2cf92b9a552e4a76476da4cf6d

Download Submit
C:\Windows\System\RGLYUZj.exe

Filesize
2.0MB

MD5
3c9e2f241a3dda75779358754b6054c7

SHA1
ca61928fdc98d8cfd7d2624895ace18ae0e1d14d

SHA256
210282aaa5b3be5c97573d3d9c8e06fa1f7ff810eba89ee5f6d160bda0a6e486

SHA512
dd489b24e40ccf9b7356978123c53402ddc54e345eacf68d85507608edd6885c8a3270a2a0964fe1cb8c79c78fe413e97db3e70a63b7bb0fa68fbe1951169bdf

Download Submit
C:\Windows\System\TGTlypa.exe

Filesize
2.0MB

MD5
4652dd9bc0eba29af22592270f3bfe39

SHA1
e6c62c2fac7441e5dc6d5ca66f68bfdf19f85186

SHA256
43c6ee81802a57b97fc6d9bfc71178f8bd5736b46550eb0800cbd3d5e522c0e2

SHA512
d9c3c3ba164fca285df788060522b0d82bf112b0aa4d94c7c0f626a7fc8f76576d6186dd1584e4fcb18d41d73f6000a7d1fc7801a23ac31613e49938862be893

Download Submit
C:\Windows\System\YypppeI.exe

Filesize
2.0MB

MD5
75e7a022dbce8878ea1855614729a564

SHA1
9547cfc92f19a4d97cace42271f36b8e46011fa6

SHA256
a0152ea0f438c5e050dd9087f34a0da4475ea9fe2717f403e4b690b1b1b2e54f

SHA512
d6783b09205764043a8b4f2896140cb72b3c7f1e0f735e9abb98fe6888fd3ab58cf2782007da3ea77b05ebc5273a94731949b521432e323901e1194263bf457e

Download Submit
C:\Windows\System\ZjYJLaW.exe

Filesize
2.0MB

MD5
69f7fbb8a2a3fcf3953c5e4d4b1f3442

SHA1
6884990d4d8e9a4182d2da114a3dcef144048f6a

SHA256
97b6323ca0387dc8144bf5a58c2bedd329efda10afe7e3f24d206911f9bb4167

SHA512
ed36e9bc141ec87b9e90fca47c5e02daee8b8615b4046013641366a0a99129882671ed3af627f190edaa0942805fcf1bf06e16a8e6bc95e21d37d1fe7b3a6df4

Download Submit
C:\Windows\System\aPmmlWv.exe

Filesize
2.0MB

MD5
ad7d28a3030c158aa9ba03d147042181

SHA1
4ccf1ab8d02ebde19098ff6720b199df14f8112c

SHA256
2194d9af9820a8c956702969de9a2258e540e426cb0ae196b95d1f169b5ac7c1

SHA512
d2570765d5000d64acac1b675a7dee9c24696b286779cf1e6551e9acc75c5c838fa67694123d91d7be432fd2d93a182348f3f6abc0d228322fc42f2ebaa8f2b8

Download Submit
C:\Windows\System\bEBmqUN.exe

Filesize
2.0MB

MD5
0ebf36672227fadbe971ad73bd5c8143

SHA1
a2ede052f136a9327ac0e9509459278e75cf5b6e

SHA256
6b9dfc82da64ce3f06676fe522f91a67182d5521387955d8dbc6540215b3169a

SHA512
831573eb80c3c6a9fec77149543274bea149f2e32c2a85eaff61f9f3afb41693d7bedd1fe43b574f2fe1734e8b1dcc48e05b4530b19b2b0ef0662f9f1d7e70c0

Download Submit
C:\Windows\System\bIfUEQH.exe

Filesize
2.0MB

MD5
f5d0811ea9a09ab5cb876034697bffe9

SHA1
ad00d594cfb40ddfcee2c815ab524ceae434b3d2

SHA256
ac7effd14327931341a665f942a48eed51ec6a59707167738fb0a0d92bd9cfec

SHA512
36b56be14d31c3361b9e56a935bbfb3d013e78f49a707d10b46b048f91c5e777bf4f4974d12f7a8ab4042694263e2f215d076d90401c98f06a8ce91e11dcb3d1

Download Submit
C:\Windows\System\bkuwQKk.exe

Filesize
2.0MB

MD5
5fe0163521147af8f2b829292921def8

SHA1
94fd49f995acbc8e174d1b2d4cfcecc930368e93

SHA256
8459128ef667580bfa7bd107ce2e20264c40ae7b00c5e1a60c7826be7a637f5a

SHA512
a318da7cec402d1e371c25b77d591443c3ef886bdb8f7e7864eb805ae14f015a120c28b4de5b7a1ce46690a33cc6ea4a436c8a50b80cb4908d43aee4c65d5909

Download Submit
C:\Windows\System\bzgSrMF.exe

Filesize
2.0MB

MD5
7f7ed0cbc37c71bbf3061ab174458420

SHA1
8c04de3ee499e2b4f974eec01f85b565853f3116

SHA256
f52b9e207853269b464d4e1ca4cd7b6d86aafcce1b3a535c40af9ac99e4968c3

SHA512
b34901eecba1b1a5595da13d4c020093265ed0507ce49ad8def4656972362e9cd6f89d13103fd62bd24f79ae815f3a9ba039c5499b536896d0df82966a105101

Download Submit
C:\Windows\System\cIcUmDA.exe

Filesize
2.0MB

MD5
f966bad26990c10113faf718671ed3a1

SHA1
8ef8efc1ae2f6b32162837bef22aa54d402d109c

SHA256
3e9773a02063ede6a911bd0e14bf311edc33b1f38e397cb10059536ebd857cce

SHA512
f7ce5a983b8cdbfce3bd1ffd91e67eeb87d22b76f52bf1707cae26c75ce35be8bf09f6d19719db06bd4fcd241ee61bd1ebb22824212986a8c8f7416057aa2a54

Download Submit
C:\Windows\System\dJPaCOZ.exe

Filesize
2.0MB

MD5
369339ca3b2d450d0fabc96089ed1bbc

SHA1
f0cbd4be8861a97d5814d78e7750d809bcd8c325

SHA256
2188387f9f2b020b7904aa33badb4118de3d06b6f70cbebe8d52bba76b6392a5

SHA512
932d055a662f3d369e69d8cada2d64734e93bb5967b67091389064bf0f14975d1eb70cf2ef8cd120f8f1e70b33c794c5ab52e6e25531f0b9ad38b3edce5498f2

Download Submit
C:\Windows\System\dRCVhAE.exe

Filesize
2.0MB

MD5
13a8b87491478eb689f65a99c85b0802

SHA1
74a5ee1016ed798f12aa52a73462cd43eefe96a1

SHA256
9f8496cf6c117a1288f26fcb52759f7ce4ddd3357954dfffff1874af74b8c07b

SHA512
591681ca3d092b7e38a1a6ba6c9da9673b5e8234f4c85422ac9fc1c8ac6ed4628c1dd4360e4925c762099ae6c8ded9fad14d1b4510654465f156662213e35e0f

Download Submit
C:\Windows\System\enSfChT.exe

Filesize
2.0MB

MD5
1baf506c26e96035592af5198f51f522

SHA1
8786eaaffd3bc03361e4fd4cd731f63ff0b2d198

SHA256
e34ad9e06ba5bbdcc4ef46fab1c939907f319423fdde4cb6fe1c5f0808d10c0d

SHA512
7316ec3969cce9e0e4d77194a446c6e6e8262d19e36c4f3fdb92a41e83155d5c37335e69e25f3f69be711462b476f79685b903e6b8e3aea63ec192a44bd5c962

Download Submit
C:\Windows\System\fJqbmXF.exe

Filesize
2.0MB

MD5
868a4d48def8d44b99f999c40896f4ce

SHA1
871f64b938b0131a442eee5a298bd939a6475ce2

SHA256
37d3514abdb5ab26419885765c69cee011df0156c8f15477b53becc985f4b7ca

SHA512
9a852461f7f5e69d9aaf21953b2dff538e63927b00d41dd158d41f775332b8c789079ad662298aa3a548b5c1cec7967015180a67d7d977f38e93bfe3f3b62fe9

Download Submit
C:\Windows\System\fVOStzo.exe

Filesize
2.0MB

MD5
16c7d6cd6ae0f983919ce8e53a3b7435

SHA1
88c835f5f9f9f49b43d270f99ba113395fbd9353

SHA256
a578a9deaacd3503be13465d740463a8092545930d7c95b31f703a77f7cade19

SHA512
cd88209ee1df19d8bde3589d16304e7cd3ff5f313db91ef20fa5bc361e9f708900987f5b5b9530eed468ab925fb58a28c7eb0fa548642769fe5876245e02d295

Download Submit
C:\Windows\System\gLqzrXX.exe

Filesize
2.0MB

MD5
04ad7bc07b5c1b7982257bf199cbd1eb

SHA1
a1c432078648f2abcd17091c8676cec0bd45dfb3

SHA256
7349efc9fa51938990b8779548375b8391aac321f9fbb99662aead2e225ec106

SHA512
8d10e86c73555a32cbd0fe5df6d09232ffcbfcf1fa96a79fe3867b714829317e1bb3c7fb8994d578d7fe250735b2a0dfb5e95a79a8aa12fde0c2134698fef051

Download Submit
C:\Windows\System\gzciZLu.exe

Filesize
2.0MB

MD5
e03f6ca11d628791269fcdc2704c1f10

SHA1
129779d8194bcfa403c0fb0da38784b6bec31a14

SHA256
25ee41f09fd8b79f6a548eea2574cc73837f35f3a29671e2114e142db8a534ff

SHA512
f2452d3a0c96d99376344f0d3a7fe93f537daf03e5fa38da743ba0f4b2b09614d3a781812bef024669b822837226c4701ab81682bc58b58cc7a012d4e6fd0c48

Download Submit
C:\Windows\System\hDIIFfz.exe

Filesize
2.0MB

MD5
d097d8598749ab37f400d87e7402e5f0

SHA1
b269fd44bfd3fd162d45213224105684ea706ec5

SHA256
eea35271ad0423c2c5c0c50835775f56a9176c0221da9134e6f3a7b288cacadf

SHA512
7bc6ba817f5d26da64946d0a94f5a1dccd8caad31d0855a1d5e5e4f7eb2936c8aeef99cc830c5bf0bef0c758618704e479a9b90fe9bce5db87a53476d93e5242

Download Submit
C:\Windows\System\imKnsCq.exe

Filesize
2.0MB

MD5
c16a17d4852fb4db5eea74f5a20f88f1

SHA1
011a7bf808e9293f5c4d6832a68ebb508e0dc8e9

SHA256
592cca9a0e62c9da2493c65160b51c7604d2a61d7dad0df252cf69daada04310

SHA512
a299f1797d7b9a50f5bf4798ac0815acaa86df47c8f3ce05cdcb44ec30387a7b0e71400202c652489eb94986cf2ab297add41319d2a59198b304cc12e50ff9ab

Download Submit
C:\Windows\System\iwArOCf.exe

Filesize
2.0MB

MD5
951c33f977db61c0b01101853b87f001

SHA1
9a3781991152d48923a28b49e4417755819e7fb4

SHA256
6177c4d740736d942104afa83e57ba0318f5e9804d83dac4f145dd023a622924

SHA512
3ec515d59b15da4ddcac7446bb85de91bb1373e7e4c8e67db08ae1bbd51816ee19cdcd28331d779afbd0ca3016ae42bb3ace47d1b9093c280261281f06449ca9

Download Submit
C:\Windows\System\kvUyYCs.exe

Filesize
2.0MB

MD5
f350195d663389471b12e9ce1d5761e2

SHA1
e7fa7a53c0a18b5b18745b0d8c7733a0aa036a3b

SHA256
c62a0d23a424d70075b5b369c8345b5cbb05bd450f8162d2f093de7bc0828f61

SHA512
add7ca8995f44cde61bd780a6e82bad8df1b9ec99439f872d1d42ebfb012cd5c7505c973cdb441f7bcdcc981f1d6d6a7b57b1a6f8f5dd2472682470cdadea119

Download Submit
C:\Windows\System\pQiBdNZ.exe

Filesize
2.0MB

MD5
804cfe73d047c0889082ea1382365945

SHA1
d342419d98dd9556ffb1d0c6c89e065b42042b82

SHA256
a0325bc1ad884f032d39c54d942d4ab88b2940248e1eece3c84e71396a490a6f

SHA512
2f2357a42f238892ad1d17b556373a0fd6a94225cd977feff4d96e8a877c07425e2980f72dc01e3ca3bdbfa0be435159b35f010b49aa1fa368e14b002ba9c33f

Download Submit
C:\Windows\System\plBCMMo.exe

Filesize
2.0MB

MD5
9a9bf4a3afe60106e1c5af13d9410446

SHA1
1b90cef712bff53ff37095ef25f11f807a976b60

SHA256
5a1b06e8b47925acd9772bedc78d3e7465f39357e6c1489b0d2c412dda6c9180

SHA512
2fd2849441ba1560e3ef5bd721f58cfdd20e7ee34564666c109061c29d9aa7a000f328988aef3b7678c125f421e041c73ed9defb174e452f8c18bbda5146c45c

Download Submit
C:\Windows\System\sPuLqUb.exe

Filesize
2.0MB

MD5
25e2017054312f3553ae6a7da5299ac6

SHA1
935df4d8a3083ed10ed40d3ac88af959aff0b608

SHA256
46b2523dd771b81a79705fdc53d599dcd61b6f324446ef7bd6c37bfc330aedd9

SHA512
bc8e7ab49c09c61af9a1210efb449081ceb7f8d1b32259f9a7f0e1dfad42d76bfaf55fa072b3240d954278e3d55f2a44d3cba8106366098d99272e7f538ad996

Download Submit
C:\Windows\System\utFkLdS.exe

Filesize
2.0MB

MD5
bce5bce90c8979fd8179b047f45919de

SHA1
c43124f034ca1659b70174456e300acf76520862

SHA256
abe24ffad26471e1a91d462430f075a53e1359b902762317841f66c0d0349c8e

SHA512
653bfe1c3104f5831eaa11cd757071fe368b3331353e4ef01dcc06718068b17951abbc0474b79e0ffb1c3c7519352008402cac656f6f6c5d1ee7e6a49754708a

Download Submit
memory/112-2097-0x00007FF622350000-0x00007FF6226A4000-memory.dmp

Filesize
3.3MB

Download
memory/112-358-0x00007FF622350000-0x00007FF6226A4000-memory.dmp

Filesize
3.3MB

Download
memory/388-372-0x00007FF754240000-0x00007FF754594000-memory.dmp

Filesize
3.3MB

Download
memory/388-2107-0x00007FF754240000-0x00007FF754594000-memory.dmp

Filesize
3.3MB

Download
memory/532-373-0x00007FF6AA6C0000-0x00007FF6AAA14000-memory.dmp

Filesize
3.3MB

Download
memory/532-2104-0x00007FF6AA6C0000-0x00007FF6AAA14000-memory.dmp

Filesize
3.3MB

Download
memory/756-2090-0x00007FF757170000-0x00007FF7574C4000-memory.dmp

Filesize
3.3MB

Download
memory/756-13-0x00007FF757170000-0x00007FF7574C4000-memory.dmp

Filesize
3.3MB

Download
memory/848-2117-0x00007FF67A960000-0x00007FF67ACB4000-memory.dmp

Filesize
3.3MB

Download
memory/848-390-0x00007FF67A960000-0x00007FF67ACB4000-memory.dmp

Filesize
3.3MB

Download
memory/1312-368-0x00007FF6D0580000-0x00007FF6D08D4000-memory.dmp

Filesize
3.3MB

Download
memory/1312-2105-0x00007FF6D0580000-0x00007FF6D08D4000-memory.dmp

Filesize
3.3MB

Download
memory/1632-357-0x00007FF6F7960000-0x00007FF6F7CB4000-memory.dmp

Filesize
3.3MB

Download
memory/1632-2095-0x00007FF6F7960000-0x00007FF6F7CB4000-memory.dmp

Filesize
3.3MB

Download
memory/1924-2103-0x00007FF6FAD20000-0x00007FF6FB074000-memory.dmp

Filesize
3.3MB

Download
memory/1924-376-0x00007FF6FAD20000-0x00007FF6FB074000-memory.dmp

Filesize
3.3MB

Download
memory/2104-2100-0x00007FF62B220000-0x00007FF62B574000-memory.dmp

Filesize
3.3MB

Download
memory/2104-381-0x00007FF62B220000-0x00007FF62B574000-memory.dmp

Filesize
3.3MB

Download
memory/2368-2102-0x00007FF614820000-0x00007FF614B74000-memory.dmp

Filesize
3.3MB

Download
memory/2368-378-0x00007FF614820000-0x00007FF614B74000-memory.dmp

Filesize
3.3MB

Download
memory/2784-386-0x00007FF61FD40000-0x00007FF620094000-memory.dmp

Filesize
3.3MB

Download
memory/2784-2114-0x00007FF61FD40000-0x00007FF620094000-memory.dmp

Filesize
3.3MB

Download
memory/3040-2089-0x00007FF6B1930000-0x00007FF6B1C84000-memory.dmp

Filesize
3.3MB

Download
memory/3040-1-0x00000175B6C00000-0x00000175B6C10000-memory.dmp

Filesize
64KB

Download
memory/3040-0-0x00007FF6B1930000-0x00007FF6B1C84000-memory.dmp

Filesize
3.3MB

Download
memory/3112-2101-0x00007FF7ABFE0000-0x00007FF7AC334000-memory.dmp

Filesize
3.3MB

Download
memory/3112-379-0x00007FF7ABFE0000-0x00007FF7AC334000-memory.dmp

Filesize
3.3MB

Download
memory/3260-353-0x00007FF629C60000-0x00007FF629FB4000-memory.dmp

Filesize
3.3MB

Download
memory/3260-2096-0x00007FF629C60000-0x00007FF629FB4000-memory.dmp

Filesize
3.3MB

Download
memory/3924-365-0x00007FF751A70000-0x00007FF751DC4000-memory.dmp

Filesize
3.3MB

Download
memory/3924-2108-0x00007FF751A70000-0x00007FF751DC4000-memory.dmp

Filesize
3.3MB

Download
memory/3928-2111-0x00007FF6250D0000-0x00007FF625424000-memory.dmp

Filesize
3.3MB

Download
memory/3928-360-0x00007FF6250D0000-0x00007FF625424000-memory.dmp

Filesize
3.3MB

Download
memory/4080-2110-0x00007FF78D860000-0x00007FF78DBB4000-memory.dmp

Filesize
3.3MB

Download
memory/4080-361-0x00007FF78D860000-0x00007FF78DBB4000-memory.dmp

Filesize
3.3MB

Download
memory/4140-2092-0x00007FF67DF60000-0x00007FF67E2B4000-memory.dmp

Filesize
3.3MB

Download
memory/4140-391-0x00007FF67DF60000-0x00007FF67E2B4000-memory.dmp

Filesize
3.3MB

Download
memory/4164-2112-0x00007FF744800000-0x00007FF744B54000-memory.dmp

Filesize
3.3MB

Download
memory/4164-359-0x00007FF744800000-0x00007FF744B54000-memory.dmp

Filesize
3.3MB

Download
memory/4292-351-0x00007FF680030000-0x00007FF680384000-memory.dmp

Filesize
3.3MB

Download
memory/4292-2094-0x00007FF680030000-0x00007FF680384000-memory.dmp

Filesize
3.3MB

Download
memory/4316-387-0x00007FF6171C0000-0x00007FF617514000-memory.dmp

Filesize
3.3MB

Download
memory/4316-2115-0x00007FF6171C0000-0x00007FF617514000-memory.dmp

Filesize
3.3MB

Download
memory/4480-363-0x00007FF73B380000-0x00007FF73B6D4000-memory.dmp

Filesize
3.3MB

Download
memory/4480-2106-0x00007FF73B380000-0x00007FF73B6D4000-memory.dmp

Filesize
3.3MB

Download
memory/4484-348-0x00007FF72C290000-0x00007FF72C5E4000-memory.dmp

Filesize
3.3MB

Download
memory/4484-2091-0x00007FF72C290000-0x00007FF72C5E4000-memory.dmp

Filesize
3.3MB

Download
memory/4668-389-0x00007FF7B77C0000-0x00007FF7B7B14000-memory.dmp

Filesize
3.3MB

Download
memory/4668-2118-0x00007FF7B77C0000-0x00007FF7B7B14000-memory.dmp

Filesize
3.3MB

Download
memory/4732-362-0x00007FF6A7430000-0x00007FF6A7784000-memory.dmp

Filesize
3.3MB

Download
memory/4732-2109-0x00007FF6A7430000-0x00007FF6A7784000-memory.dmp

Filesize
3.3MB

Download
memory/4816-2116-0x00007FF670CB0000-0x00007FF671004000-memory.dmp

Filesize
3.3MB

Download
memory/4816-388-0x00007FF670CB0000-0x00007FF671004000-memory.dmp

Filesize
3.3MB

Download
memory/4820-2113-0x00007FF787D40000-0x00007FF788094000-memory.dmp

Filesize
3.3MB

Download
memory/4820-385-0x00007FF787D40000-0x00007FF788094000-memory.dmp

Filesize
3.3MB

Download
memory/4904-384-0x00007FF608E60000-0x00007FF6091B4000-memory.dmp

Filesize
3.3MB

Download
memory/4904-2099-0x00007FF608E60000-0x00007FF6091B4000-memory.dmp

Filesize
3.3MB

Download
memory/4960-392-0x00007FF6ABAF0000-0x00007FF6ABE44000-memory.dmp

Filesize
3.3MB

Download
memory/4960-2093-0x00007FF6ABAF0000-0x00007FF6ABE44000-memory.dmp

Filesize
3.3MB

Download
memory/4996-382-0x00007FF7F49F0000-0x00007FF7F4D44000-memory.dmp

Filesize
3.3MB

Download
memory/4996-2098-0x00007FF7F49F0000-0x00007FF7F4D44000-memory.dmp

Filesize
3.3MB

Download