xmrig | 4b04f3b7159572086cdc7bd713c40e6072a8e93fa897413f9bcde415a8e4e83d

Analysis

max time kernel
97s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
Size

2.6MB
MD5

0473780ef314469c49583ba3565148a0
SHA1

92fe6775411f7ae2593342b6b08731986cdb5ed1
SHA256

4b04f3b7159572086cdc7bd713c40e6072a8e93fa897413f9bcde415a8e4e83d
SHA512

4b9ebc1cb63c485678b28cfb8befc751b74b59ea42c27fc0f54bd0c518f6e2133b55f6e98cff7e3b80da047b58b1863fbe59c97311f88379d43119fc4828c3cb
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoTzDE4Oj:BemTLkNdfE0pZrV56utgpPFoI

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3516-0-0x00007FF66EE80000-0x00007FF66F1D4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023400-5.dat	xmrig
behavioral2/files/0x0008000000023403-10.dat	xmrig
behavioral2/files/0x0007000000023407-26.dat	xmrig
behavioral2/files/0x0007000000023408-32.dat	xmrig
behavioral2/memory/2700-56-0x00007FF739F10000-0x00007FF73A264000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-72.dat	xmrig
behavioral2/files/0x0007000000023412-83.dat	xmrig
behavioral2/files/0x0007000000023419-113.dat	xmrig
behavioral2/files/0x000700000002341d-124.dat	xmrig
behavioral2/files/0x0007000000023420-143.dat	xmrig
behavioral2/memory/3320-158-0x00007FF6B68E0000-0x00007FF6B6C34000-memory.dmp	xmrig
behavioral2/memory/3536-170-0x00007FF7774E0000-0x00007FF777834000-memory.dmp	xmrig
behavioral2/memory/2072-175-0x00007FF62ECF0000-0x00007FF62F044000-memory.dmp	xmrig
behavioral2/memory/1536-180-0x00007FF7E6BE0000-0x00007FF7E6F34000-memory.dmp	xmrig
behavioral2/memory/4168-181-0x00007FF6DE570000-0x00007FF6DE8C4000-memory.dmp	xmrig
behavioral2/memory/4108-179-0x00007FF6A6980000-0x00007FF6A6CD4000-memory.dmp	xmrig
behavioral2/memory/440-178-0x00007FF6DB670000-0x00007FF6DB9C4000-memory.dmp	xmrig
behavioral2/memory/4880-177-0x00007FF765260000-0x00007FF7655B4000-memory.dmp	xmrig
behavioral2/memory/4092-176-0x00007FF69B0B0000-0x00007FF69B404000-memory.dmp	xmrig
behavioral2/memory/1904-174-0x00007FF6001F0000-0x00007FF600544000-memory.dmp	xmrig
behavioral2/memory/1124-173-0x00007FF6ECB20000-0x00007FF6ECE74000-memory.dmp	xmrig
behavioral2/memory/4512-172-0x00007FF711750000-0x00007FF711AA4000-memory.dmp	xmrig
behavioral2/memory/2396-171-0x00007FF6998E0000-0x00007FF699C34000-memory.dmp	xmrig
behavioral2/memory/4848-169-0x00007FF6D27C0000-0x00007FF6D2B14000-memory.dmp	xmrig
behavioral2/memory/1540-168-0x00007FF7B77A0000-0x00007FF7B7AF4000-memory.dmp	xmrig
behavioral2/memory/2324-167-0x00007FF757790000-0x00007FF757AE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-165.dat	xmrig
behavioral2/files/0x0007000000023421-163.dat	xmrig
behavioral2/files/0x000700000002341f-159.dat	xmrig
behavioral2/memory/2724-157-0x00007FF671E20000-0x00007FF672174000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-155.dat	xmrig
behavioral2/files/0x000700000002341e-153.dat	xmrig
behavioral2/files/0x000700000002341c-151.dat	xmrig
behavioral2/memory/2816-148-0x00007FF754F60000-0x00007FF7552B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-145.dat	xmrig
behavioral2/files/0x000700000002341b-141.dat	xmrig
behavioral2/files/0x000700000002341a-139.dat	xmrig
behavioral2/memory/1184-134-0x00007FF739CC0000-0x00007FF73A014000-memory.dmp	xmrig
behavioral2/memory/636-132-0x00007FF6F6D30000-0x00007FF6F7084000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-120.dat	xmrig
behavioral2/memory/3432-119-0x00007FF7D44E0000-0x00007FF7D4834000-memory.dmp	xmrig
behavioral2/memory/3640-104-0x00007FF613DD0000-0x00007FF614124000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-99.dat	xmrig
behavioral2/files/0x0007000000023415-109.dat	xmrig
behavioral2/files/0x0007000000023413-93.dat	xmrig
behavioral2/files/0x0007000000023411-91.dat	xmrig
behavioral2/files/0x000700000002340f-82.dat	xmrig
behavioral2/memory/396-79-0x00007FF7CAB10000-0x00007FF7CAE64000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-77.dat	xmrig
behavioral2/files/0x0007000000023410-74.dat	xmrig
behavioral2/memory/2824-70-0x00007FF780010000-0x00007FF780364000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-62.dat	xmrig
behavioral2/memory/1644-54-0x00007FF7C8D60000-0x00007FF7C90B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340b-53.dat	xmrig
behavioral2/files/0x0007000000023409-41.dat	xmrig
behavioral2/files/0x000700000002340a-42.dat	xmrig
behavioral2/files/0x0007000000023423-183.dat	xmrig
behavioral2/files/0x0007000000023425-190.dat	xmrig
behavioral2/memory/5096-38-0x00007FF6F3BE0000-0x00007FF6F3F34000-memory.dmp	xmrig
behavioral2/memory/3704-28-0x00007FF760640000-0x00007FF760994000-memory.dmp	xmrig
behavioral2/memory/3612-19-0x00007FF788B40000-0x00007FF788E94000-memory.dmp	xmrig
behavioral2/memory/3704-2116-0x00007FF760640000-0x00007FF760994000-memory.dmp	xmrig
behavioral2/memory/1644-2117-0x00007FF7C8D60000-0x00007FF7C90B4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3612	ovsrbqv.exe
3704	ZVbTapO.exe
5096	tROXyhG.exe
1124	dpYugSn.exe
1644	mhLWUoz.exe
2700	bWzHCVw.exe
1904	MsvTFEY.exe
2072	ZUZymMY.exe
2824	mSOCzaR.exe
396	oYqTjCE.exe
4092	LwVNSjR.exe
3640	dSjYaXg.exe
3432	DguvaIs.exe
636	lcZJSZz.exe
4880	ckXuhmd.exe
1184	gJojUJd.exe
440	UguWKmP.exe
2816	bSmcveV.exe
4108	ZAYPpqf.exe
2724	nftPAgM.exe
3320	JhXEJzc.exe
2324	IYpOnYH.exe
1540	XgbcruO.exe
4848	wthhyrt.exe
1536	YybYWly.exe
3536	Njaupvq.exe
4168	fwCbtBC.exe
2396	FHRRVkV.exe
4512	lUAaEIh.exe
2412	TCsLjib.exe
1480	DbObzqe.exe
4204	FvIQOms.exe
2128	RVgTHdJ.exe
928	OufHNnw.exe
1720	iAktLdy.exe
3956	LohhvCr.exe
3484	ypXFoPp.exe
1616	nWCNSRA.exe
4156	ujIcbDR.exe
4580	gytUSEr.exe
2160	jLqWmtb.exe
4592	oNSMIYT.exe
4920	asUcNUz.exe
2064	rwqAvAy.exe
3152	agcRuWZ.exe
392	gOyRuwY.exe
2760	JEqFwoT.exe
3140	XRKvrLQ.exe
4940	roevNaP.exe
4120	vwBlxfz.exe
3780	bscVXvM.exe
1144	CdWbvTG.exe
4676	DPsLpCs.exe
2524	nGqmXLR.exe
696	YNIADwU.exe
1788	qHrZFEs.exe
2616	guoDQTy.exe
3504	gkkHWPu.exe
4064	imIecke.exe
2264	hQpNFQB.exe
1240	usjGuiT.exe
1320	vSQBXLt.exe
2568	qQRaQYK.exe
2368	knuVNrM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3516-0-0x00007FF66EE80000-0x00007FF66F1D4000-memory.dmp	upx
behavioral2/files/0x0009000000023400-5.dat	upx
behavioral2/files/0x0008000000023403-10.dat	upx
behavioral2/files/0x0007000000023407-26.dat	upx
behavioral2/files/0x0007000000023408-32.dat	upx
behavioral2/memory/2700-56-0x00007FF739F10000-0x00007FF73A264000-memory.dmp	upx
behavioral2/files/0x000700000002340c-72.dat	upx
behavioral2/files/0x0007000000023412-83.dat	upx
behavioral2/files/0x0007000000023419-113.dat	upx
behavioral2/files/0x000700000002341d-124.dat	upx
behavioral2/files/0x0007000000023420-143.dat	upx
behavioral2/memory/3320-158-0x00007FF6B68E0000-0x00007FF6B6C34000-memory.dmp	upx
behavioral2/memory/3536-170-0x00007FF7774E0000-0x00007FF777834000-memory.dmp	upx
behavioral2/memory/2072-175-0x00007FF62ECF0000-0x00007FF62F044000-memory.dmp	upx
behavioral2/memory/1536-180-0x00007FF7E6BE0000-0x00007FF7E6F34000-memory.dmp	upx
behavioral2/memory/4168-181-0x00007FF6DE570000-0x00007FF6DE8C4000-memory.dmp	upx
behavioral2/memory/4108-179-0x00007FF6A6980000-0x00007FF6A6CD4000-memory.dmp	upx
behavioral2/memory/440-178-0x00007FF6DB670000-0x00007FF6DB9C4000-memory.dmp	upx
behavioral2/memory/4880-177-0x00007FF765260000-0x00007FF7655B4000-memory.dmp	upx
behavioral2/memory/4092-176-0x00007FF69B0B0000-0x00007FF69B404000-memory.dmp	upx
behavioral2/memory/1904-174-0x00007FF6001F0000-0x00007FF600544000-memory.dmp	upx
behavioral2/memory/1124-173-0x00007FF6ECB20000-0x00007FF6ECE74000-memory.dmp	upx
behavioral2/memory/4512-172-0x00007FF711750000-0x00007FF711AA4000-memory.dmp	upx
behavioral2/memory/2396-171-0x00007FF6998E0000-0x00007FF699C34000-memory.dmp	upx
behavioral2/memory/4848-169-0x00007FF6D27C0000-0x00007FF6D2B14000-memory.dmp	upx
behavioral2/memory/1540-168-0x00007FF7B77A0000-0x00007FF7B7AF4000-memory.dmp	upx
behavioral2/memory/2324-167-0x00007FF757790000-0x00007FF757AE4000-memory.dmp	upx
behavioral2/files/0x0007000000023422-165.dat	upx
behavioral2/files/0x0007000000023421-163.dat	upx
behavioral2/files/0x000700000002341f-159.dat	upx
behavioral2/memory/2724-157-0x00007FF671E20000-0x00007FF672174000-memory.dmp	upx
behavioral2/files/0x0007000000023418-155.dat	upx
behavioral2/files/0x000700000002341e-153.dat	upx
behavioral2/files/0x000700000002341c-151.dat	upx
behavioral2/memory/2816-148-0x00007FF754F60000-0x00007FF7552B4000-memory.dmp	upx
behavioral2/files/0x0007000000023417-145.dat	upx
behavioral2/files/0x000700000002341b-141.dat	upx
behavioral2/files/0x000700000002341a-139.dat	upx
behavioral2/memory/1184-134-0x00007FF739CC0000-0x00007FF73A014000-memory.dmp	upx
behavioral2/memory/636-132-0x00007FF6F6D30000-0x00007FF6F7084000-memory.dmp	upx
behavioral2/files/0x0007000000023416-120.dat	upx
behavioral2/memory/3432-119-0x00007FF7D44E0000-0x00007FF7D4834000-memory.dmp	upx
behavioral2/memory/3640-104-0x00007FF613DD0000-0x00007FF614124000-memory.dmp	upx
behavioral2/files/0x0007000000023414-99.dat	upx
behavioral2/files/0x0007000000023415-109.dat	upx
behavioral2/files/0x0007000000023413-93.dat	upx
behavioral2/files/0x0007000000023411-91.dat	upx
behavioral2/files/0x000700000002340f-82.dat	upx
behavioral2/memory/396-79-0x00007FF7CAB10000-0x00007FF7CAE64000-memory.dmp	upx
behavioral2/files/0x000700000002340e-77.dat	upx
behavioral2/files/0x0007000000023410-74.dat	upx
behavioral2/memory/2824-70-0x00007FF780010000-0x00007FF780364000-memory.dmp	upx
behavioral2/files/0x000700000002340d-62.dat	upx
behavioral2/memory/1644-54-0x00007FF7C8D60000-0x00007FF7C90B4000-memory.dmp	upx
behavioral2/files/0x000700000002340b-53.dat	upx
behavioral2/files/0x0007000000023409-41.dat	upx
behavioral2/files/0x000700000002340a-42.dat	upx
behavioral2/files/0x0007000000023423-183.dat	upx
behavioral2/files/0x0007000000023425-190.dat	upx
behavioral2/memory/5096-38-0x00007FF6F3BE0000-0x00007FF6F3F34000-memory.dmp	upx
behavioral2/memory/3704-28-0x00007FF760640000-0x00007FF760994000-memory.dmp	upx
behavioral2/memory/3612-19-0x00007FF788B40000-0x00007FF788E94000-memory.dmp	upx
behavioral2/memory/3704-2116-0x00007FF760640000-0x00007FF760994000-memory.dmp	upx
behavioral2/memory/1644-2117-0x00007FF7C8D60000-0x00007FF7C90B4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZUZymMY.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\aCCTQAh.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\MvHiSia.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\FHimbMh.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\XdKIudm.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\yDnhdFQ.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\gwRRTEa.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\bscVXvM.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\hXMJLLy.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\tTNOihk.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\MQcNyEW.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\uSwSJsb.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\vkKufEP.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\jxQthJG.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\swjyPtn.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\VyxIQpV.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\caPuthx.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\JXEpsQZ.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\imIecke.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\XXcSUUA.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\JgKbqiD.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\RJQEKGB.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\PIXqysH.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\izddkpw.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\icCYXkm.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\qiBixop.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\mSOCzaR.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\gJojUJd.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\WcTzdOc.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\DpCHQkw.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\bmJaOUr.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\oHqyojp.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\qlVBQtc.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\FvIQOms.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZiPLfTV.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\NaDolWg.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\FcNHFEV.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\AhyJfxT.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\yMARFob.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\AEDQotl.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\hiEGxZB.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\MAAXTEW.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\ivlxEkh.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\JZPPPLG.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\JIiOVrI.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\lVYZNYh.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\bCQEFJP.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\UlorFqF.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\MorHYCw.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\XRKvrLQ.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\DPsLpCs.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\qQRaQYK.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\ncMzPQz.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\aAUJOSm.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\flEduYk.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\pqptHzR.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\iEqLrla.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\XibwytK.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\LHgohpG.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\cCZHfsx.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\LohhvCr.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\NJEvmOQ.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\VHwyxov.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
File created	C:\Windows\System\xqFavIP.exe	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3612	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	84
PID 3516 wrote to memory of 3612	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	84
PID 3516 wrote to memory of 3704	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	85
PID 3516 wrote to memory of 3704	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	85
PID 3516 wrote to memory of 5096	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	86
PID 3516 wrote to memory of 5096	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	86
PID 3516 wrote to memory of 1124	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	87
PID 3516 wrote to memory of 1124	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	87
PID 3516 wrote to memory of 1644	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	88
PID 3516 wrote to memory of 1644	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	88
PID 3516 wrote to memory of 2700	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	89
PID 3516 wrote to memory of 2700	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	89
PID 3516 wrote to memory of 1904	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	90
PID 3516 wrote to memory of 1904	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	90
PID 3516 wrote to memory of 2072	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	91
PID 3516 wrote to memory of 2072	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	91
PID 3516 wrote to memory of 2824	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	92
PID 3516 wrote to memory of 2824	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	92
PID 3516 wrote to memory of 396	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	93
PID 3516 wrote to memory of 396	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	93
PID 3516 wrote to memory of 4092	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	94
PID 3516 wrote to memory of 4092	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	94
PID 3516 wrote to memory of 3640	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	95
PID 3516 wrote to memory of 3640	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	95
PID 3516 wrote to memory of 3432	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	96
PID 3516 wrote to memory of 3432	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	96
PID 3516 wrote to memory of 636	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	97
PID 3516 wrote to memory of 636	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	97
PID 3516 wrote to memory of 4880	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	98
PID 3516 wrote to memory of 4880	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	98
PID 3516 wrote to memory of 1184	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	99
PID 3516 wrote to memory of 1184	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	99
PID 3516 wrote to memory of 440	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	100
PID 3516 wrote to memory of 440	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	100
PID 3516 wrote to memory of 2816	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	101
PID 3516 wrote to memory of 2816	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	101
PID 3516 wrote to memory of 1540	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	102
PID 3516 wrote to memory of 1540	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	102
PID 3516 wrote to memory of 4108	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	103
PID 3516 wrote to memory of 4108	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	103
PID 3516 wrote to memory of 2724	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	104
PID 3516 wrote to memory of 2724	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	104
PID 3516 wrote to memory of 3320	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	105
PID 3516 wrote to memory of 3320	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	105
PID 3516 wrote to memory of 2324	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	106
PID 3516 wrote to memory of 2324	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	106
PID 3516 wrote to memory of 4848	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	107
PID 3516 wrote to memory of 4848	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	107
PID 3516 wrote to memory of 1536	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	108
PID 3516 wrote to memory of 1536	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	108
PID 3516 wrote to memory of 3536	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	109
PID 3516 wrote to memory of 3536	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	109
PID 3516 wrote to memory of 4168	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	110
PID 3516 wrote to memory of 4168	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	110
PID 3516 wrote to memory of 2396	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	111
PID 3516 wrote to memory of 2396	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	111
PID 3516 wrote to memory of 4512	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	112
PID 3516 wrote to memory of 4512	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	112
PID 3516 wrote to memory of 2412	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	113
PID 3516 wrote to memory of 2412	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	113
PID 3516 wrote to memory of 1480	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	114
PID 3516 wrote to memory of 1480	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	114
PID 3516 wrote to memory of 4204	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	116
PID 3516 wrote to memory of 4204	3516	0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0473780ef314469c49583ba3565148a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\System\ovsrbqv.exe
  C:\Windows\System\ovsrbqv.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ZVbTapO.exe
  C:\Windows\System\ZVbTapO.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\tROXyhG.exe
  C:\Windows\System\tROXyhG.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\dpYugSn.exe
  C:\Windows\System\dpYugSn.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\mhLWUoz.exe
  C:\Windows\System\mhLWUoz.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\bWzHCVw.exe
  C:\Windows\System\bWzHCVw.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\MsvTFEY.exe
  C:\Windows\System\MsvTFEY.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\ZUZymMY.exe
  C:\Windows\System\ZUZymMY.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\mSOCzaR.exe
  C:\Windows\System\mSOCzaR.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\oYqTjCE.exe
  C:\Windows\System\oYqTjCE.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\LwVNSjR.exe
  C:\Windows\System\LwVNSjR.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\dSjYaXg.exe
  C:\Windows\System\dSjYaXg.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\DguvaIs.exe
  C:\Windows\System\DguvaIs.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\lcZJSZz.exe
  C:\Windows\System\lcZJSZz.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\ckXuhmd.exe
  C:\Windows\System\ckXuhmd.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\gJojUJd.exe
  C:\Windows\System\gJojUJd.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\UguWKmP.exe
  C:\Windows\System\UguWKmP.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\bSmcveV.exe
  C:\Windows\System\bSmcveV.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\XgbcruO.exe
  C:\Windows\System\XgbcruO.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\ZAYPpqf.exe
  C:\Windows\System\ZAYPpqf.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\nftPAgM.exe
  C:\Windows\System\nftPAgM.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\JhXEJzc.exe
  C:\Windows\System\JhXEJzc.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\IYpOnYH.exe
  C:\Windows\System\IYpOnYH.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\wthhyrt.exe
  C:\Windows\System\wthhyrt.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\YybYWly.exe
  C:\Windows\System\YybYWly.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\Njaupvq.exe
  C:\Windows\System\Njaupvq.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\fwCbtBC.exe
  C:\Windows\System\fwCbtBC.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\FHRRVkV.exe
  C:\Windows\System\FHRRVkV.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\lUAaEIh.exe
  C:\Windows\System\lUAaEIh.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\TCsLjib.exe
  C:\Windows\System\TCsLjib.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\DbObzqe.exe
  C:\Windows\System\DbObzqe.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\FvIQOms.exe
  C:\Windows\System\FvIQOms.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\RVgTHdJ.exe
  C:\Windows\System\RVgTHdJ.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\OufHNnw.exe
  C:\Windows\System\OufHNnw.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\iAktLdy.exe
  C:\Windows\System\iAktLdy.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\LohhvCr.exe
  C:\Windows\System\LohhvCr.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\ypXFoPp.exe
  C:\Windows\System\ypXFoPp.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\nWCNSRA.exe
  C:\Windows\System\nWCNSRA.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\ujIcbDR.exe
  C:\Windows\System\ujIcbDR.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\gytUSEr.exe
  C:\Windows\System\gytUSEr.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\jLqWmtb.exe
  C:\Windows\System\jLqWmtb.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\oNSMIYT.exe
  C:\Windows\System\oNSMIYT.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\asUcNUz.exe
  C:\Windows\System\asUcNUz.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\rwqAvAy.exe
  C:\Windows\System\rwqAvAy.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\agcRuWZ.exe
  C:\Windows\System\agcRuWZ.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\gOyRuwY.exe
  C:\Windows\System\gOyRuwY.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\JEqFwoT.exe
  C:\Windows\System\JEqFwoT.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\XRKvrLQ.exe
  C:\Windows\System\XRKvrLQ.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\roevNaP.exe
  C:\Windows\System\roevNaP.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\vwBlxfz.exe
  C:\Windows\System\vwBlxfz.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\bscVXvM.exe
  C:\Windows\System\bscVXvM.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\CdWbvTG.exe
  C:\Windows\System\CdWbvTG.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\DPsLpCs.exe
  C:\Windows\System\DPsLpCs.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\nGqmXLR.exe
  C:\Windows\System\nGqmXLR.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\YNIADwU.exe
  C:\Windows\System\YNIADwU.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\qHrZFEs.exe
  C:\Windows\System\qHrZFEs.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\guoDQTy.exe
  C:\Windows\System\guoDQTy.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\gkkHWPu.exe
  C:\Windows\System\gkkHWPu.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\imIecke.exe
  C:\Windows\System\imIecke.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\hQpNFQB.exe
  C:\Windows\System\hQpNFQB.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\usjGuiT.exe
  C:\Windows\System\usjGuiT.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\vSQBXLt.exe
  C:\Windows\System\vSQBXLt.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\qQRaQYK.exe
  C:\Windows\System\qQRaQYK.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\knuVNrM.exe
  C:\Windows\System\knuVNrM.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\LDyhRSM.exe
  C:\Windows\System\LDyhRSM.exe
  2⤵
  PID:2856
- C:\Windows\System\eJhiqFk.exe
  C:\Windows\System\eJhiqFk.exe
  2⤵
  PID:2244
- C:\Windows\System\hkPoGPE.exe
  C:\Windows\System\hkPoGPE.exe
  2⤵
  PID:4680
- C:\Windows\System\maWSrZZ.exe
  C:\Windows\System\maWSrZZ.exe
  2⤵
  PID:3568
- C:\Windows\System\HCfgOaQ.exe
  C:\Windows\System\HCfgOaQ.exe
  2⤵
  PID:816
- C:\Windows\System\BZaRHbJ.exe
  C:\Windows\System\BZaRHbJ.exe
  2⤵
  PID:4420
- C:\Windows\System\BopXmHZ.exe
  C:\Windows\System\BopXmHZ.exe
  2⤵
  PID:2564
- C:\Windows\System\MQcNyEW.exe
  C:\Windows\System\MQcNyEW.exe
  2⤵
  PID:4368
- C:\Windows\System\LdZsMUy.exe
  C:\Windows\System\LdZsMUy.exe
  2⤵
  PID:2092
- C:\Windows\System\jFTTpHh.exe
  C:\Windows\System\jFTTpHh.exe
  2⤵
  PID:3228
- C:\Windows\System\PIXqysH.exe
  C:\Windows\System\PIXqysH.exe
  2⤵
  PID:1724
- C:\Windows\System\hIRCFPb.exe
  C:\Windows\System\hIRCFPb.exe
  2⤵
  PID:3292
- C:\Windows\System\flavMlH.exe
  C:\Windows\System\flavMlH.exe
  2⤵
  PID:4272
- C:\Windows\System\JgBZMHi.exe
  C:\Windows\System\JgBZMHi.exe
  2⤵
  PID:4056
- C:\Windows\System\yRUALJo.exe
  C:\Windows\System\yRUALJo.exe
  2⤵
  PID:980
- C:\Windows\System\IUqEtzJ.exe
  C:\Windows\System\IUqEtzJ.exe
  2⤵
  PID:4228
- C:\Windows\System\NBlIsCP.exe
  C:\Windows\System\NBlIsCP.exe
  2⤵
  PID:3520
- C:\Windows\System\nuegzbO.exe
  C:\Windows\System\nuegzbO.exe
  2⤵
  PID:3336
- C:\Windows\System\QIkcgHp.exe
  C:\Windows\System\QIkcgHp.exe
  2⤵
  PID:3488
- C:\Windows\System\nnbwVlB.exe
  C:\Windows\System\nnbwVlB.exe
  2⤵
  PID:4844
- C:\Windows\System\WvqFRmn.exe
  C:\Windows\System\WvqFRmn.exe
  2⤵
  PID:3960
- C:\Windows\System\GpAUxkW.exe
  C:\Windows\System\GpAUxkW.exe
  2⤵
  PID:2224
- C:\Windows\System\peFGJkP.exe
  C:\Windows\System\peFGJkP.exe
  2⤵
  PID:5032
- C:\Windows\System\GUKWaNF.exe
  C:\Windows\System\GUKWaNF.exe
  2⤵
  PID:3196
- C:\Windows\System\EehGvLy.exe
  C:\Windows\System\EehGvLy.exe
  2⤵
  PID:1628
- C:\Windows\System\ANicQXe.exe
  C:\Windows\System\ANicQXe.exe
  2⤵
  PID:3576
- C:\Windows\System\bUQrqtE.exe
  C:\Windows\System\bUQrqtE.exe
  2⤵
  PID:64
- C:\Windows\System\MTmUMEn.exe
  C:\Windows\System\MTmUMEn.exe
  2⤵
  PID:4260
- C:\Windows\System\ApigILE.exe
  C:\Windows\System\ApigILE.exe
  2⤵
  PID:1768
- C:\Windows\System\fsvbNAW.exe
  C:\Windows\System\fsvbNAW.exe
  2⤵
  PID:1464
- C:\Windows\System\ncMzPQz.exe
  C:\Windows\System\ncMzPQz.exe
  2⤵
  PID:2688
- C:\Windows\System\HYAhuMp.exe
  C:\Windows\System\HYAhuMp.exe
  2⤵
  PID:4856
- C:\Windows\System\XpvSGyV.exe
  C:\Windows\System\XpvSGyV.exe
  2⤵
  PID:5132
- C:\Windows\System\zOzrCIe.exe
  C:\Windows\System\zOzrCIe.exe
  2⤵
  PID:5160
- C:\Windows\System\qfTnbwo.exe
  C:\Windows\System\qfTnbwo.exe
  2⤵
  PID:5184
- C:\Windows\System\CUtBhxn.exe
  C:\Windows\System\CUtBhxn.exe
  2⤵
  PID:5212
- C:\Windows\System\FwvWFZj.exe
  C:\Windows\System\FwvWFZj.exe
  2⤵
  PID:5240
- C:\Windows\System\dJjPyfS.exe
  C:\Windows\System\dJjPyfS.exe
  2⤵
  PID:5268
- C:\Windows\System\MRdrXgK.exe
  C:\Windows\System\MRdrXgK.exe
  2⤵
  PID:5296
- C:\Windows\System\vyuNnuM.exe
  C:\Windows\System\vyuNnuM.exe
  2⤵
  PID:5324
- C:\Windows\System\VXpWNis.exe
  C:\Windows\System\VXpWNis.exe
  2⤵
  PID:5352
- C:\Windows\System\hdTzOPl.exe
  C:\Windows\System\hdTzOPl.exe
  2⤵
  PID:5388
- C:\Windows\System\gCHIcRn.exe
  C:\Windows\System\gCHIcRn.exe
  2⤵
  PID:5408
- C:\Windows\System\UgHNsuR.exe
  C:\Windows\System\UgHNsuR.exe
  2⤵
  PID:5436
- C:\Windows\System\CNeqcck.exe
  C:\Windows\System\CNeqcck.exe
  2⤵
  PID:5464
- C:\Windows\System\kUmPJdn.exe
  C:\Windows\System\kUmPJdn.exe
  2⤵
  PID:5492
- C:\Windows\System\lwVTGXs.exe
  C:\Windows\System\lwVTGXs.exe
  2⤵
  PID:5520
- C:\Windows\System\teFLjRM.exe
  C:\Windows\System\teFLjRM.exe
  2⤵
  PID:5548
- C:\Windows\System\HhrUGqJ.exe
  C:\Windows\System\HhrUGqJ.exe
  2⤵
  PID:5576
- C:\Windows\System\WcTzdOc.exe
  C:\Windows\System\WcTzdOc.exe
  2⤵
  PID:5608
- C:\Windows\System\VNLuBKC.exe
  C:\Windows\System\VNLuBKC.exe
  2⤵
  PID:5640
- C:\Windows\System\eUmQWEq.exe
  C:\Windows\System\eUmQWEq.exe
  2⤵
  PID:5660
- C:\Windows\System\cVKIwog.exe
  C:\Windows\System\cVKIwog.exe
  2⤵
  PID:5692
- C:\Windows\System\zeQHXAy.exe
  C:\Windows\System\zeQHXAy.exe
  2⤵
  PID:5716
- C:\Windows\System\NJEvmOQ.exe
  C:\Windows\System\NJEvmOQ.exe
  2⤵
  PID:5748
- C:\Windows\System\LbCjFXc.exe
  C:\Windows\System\LbCjFXc.exe
  2⤵
  PID:5776
- C:\Windows\System\JYxLWIO.exe
  C:\Windows\System\JYxLWIO.exe
  2⤵
  PID:5808
- C:\Windows\System\hUdkMmf.exe
  C:\Windows\System\hUdkMmf.exe
  2⤵
  PID:5828
- C:\Windows\System\ItelDsg.exe
  C:\Windows\System\ItelDsg.exe
  2⤵
  PID:5844
- C:\Windows\System\KqoZuKz.exe
  C:\Windows\System\KqoZuKz.exe
  2⤵
  PID:5860
- C:\Windows\System\FFYhPfY.exe
  C:\Windows\System\FFYhPfY.exe
  2⤵
  PID:5876
- C:\Windows\System\PaSHjAH.exe
  C:\Windows\System\PaSHjAH.exe
  2⤵
  PID:5908
- C:\Windows\System\RshXZfJ.exe
  C:\Windows\System\RshXZfJ.exe
  2⤵
  PID:5940
- C:\Windows\System\IaxmAWu.exe
  C:\Windows\System\IaxmAWu.exe
  2⤵
  PID:5984
- C:\Windows\System\QWycskm.exe
  C:\Windows\System\QWycskm.exe
  2⤵
  PID:6008
- C:\Windows\System\XqHAcwV.exe
  C:\Windows\System\XqHAcwV.exe
  2⤵
  PID:6044
- C:\Windows\System\ZxZzDHZ.exe
  C:\Windows\System\ZxZzDHZ.exe
  2⤵
  PID:6084
- C:\Windows\System\AesmuIL.exe
  C:\Windows\System\AesmuIL.exe
  2⤵
  PID:6112
- C:\Windows\System\EgHnmzn.exe
  C:\Windows\System\EgHnmzn.exe
  2⤵
  PID:6140
- C:\Windows\System\ekgvvSm.exe
  C:\Windows\System\ekgvvSm.exe
  2⤵
  PID:5148
- C:\Windows\System\AMhvoHm.exe
  C:\Windows\System\AMhvoHm.exe
  2⤵
  PID:5224
- C:\Windows\System\GUAewji.exe
  C:\Windows\System\GUAewji.exe
  2⤵
  PID:5292
- C:\Windows\System\FurGlDA.exe
  C:\Windows\System\FurGlDA.exe
  2⤵
  PID:5364
- C:\Windows\System\CkxhhSY.exe
  C:\Windows\System\CkxhhSY.exe
  2⤵
  PID:5448
- C:\Windows\System\zlCJfNj.exe
  C:\Windows\System\zlCJfNj.exe
  2⤵
  PID:5512
- C:\Windows\System\HqRBvjm.exe
  C:\Windows\System\HqRBvjm.exe
  2⤵
  PID:5572
- C:\Windows\System\eDjyWxm.exe
  C:\Windows\System\eDjyWxm.exe
  2⤵
  PID:5648
- C:\Windows\System\aAUJOSm.exe
  C:\Windows\System\aAUJOSm.exe
  2⤵
  PID:5684
- C:\Windows\System\BsYRUlv.exe
  C:\Windows\System\BsYRUlv.exe
  2⤵
  PID:5760
- C:\Windows\System\kPlzZUe.exe
  C:\Windows\System\kPlzZUe.exe
  2⤵
  PID:5840
- C:\Windows\System\cufhZvz.exe
  C:\Windows\System\cufhZvz.exe
  2⤵
  PID:5888
- C:\Windows\System\aCCTQAh.exe
  C:\Windows\System\aCCTQAh.exe
  2⤵
  PID:5964
- C:\Windows\System\lGSHHfK.exe
  C:\Windows\System\lGSHHfK.exe
  2⤵
  PID:6056
- C:\Windows\System\uaYwonP.exe
  C:\Windows\System\uaYwonP.exe
  2⤵
  PID:6124
- C:\Windows\System\hLLxjoM.exe
  C:\Windows\System\hLLxjoM.exe
  2⤵
  PID:5196
- C:\Windows\System\YBDVsil.exe
  C:\Windows\System\YBDVsil.exe
  2⤵
  PID:5376
- C:\Windows\System\IEgGigv.exe
  C:\Windows\System\IEgGigv.exe
  2⤵
  PID:5560
- C:\Windows\System\bwftLuY.exe
  C:\Windows\System\bwftLuY.exe
  2⤵
  PID:5708
- C:\Windows\System\OFOATmv.exe
  C:\Windows\System\OFOATmv.exe
  2⤵
  PID:5792
- C:\Windows\System\XIDkNhN.exe
  C:\Windows\System\XIDkNhN.exe
  2⤵
  PID:6032
- C:\Windows\System\POaoDYA.exe
  C:\Windows\System\POaoDYA.exe
  2⤵
  PID:5204
- C:\Windows\System\KudSilp.exe
  C:\Windows\System\KudSilp.exe
  2⤵
  PID:5488
- C:\Windows\System\qedgmtl.exe
  C:\Windows\System\qedgmtl.exe
  2⤵
  PID:5784
- C:\Windows\System\TeAnmkx.exe
  C:\Windows\System\TeAnmkx.exe
  2⤵
  PID:5424
- C:\Windows\System\UlacQPI.exe
  C:\Windows\System\UlacQPI.exe
  2⤵
  PID:5872
- C:\Windows\System\NSfJIac.exe
  C:\Windows\System\NSfJIac.exe
  2⤵
  PID:6148
- C:\Windows\System\ivlxEkh.exe
  C:\Windows\System\ivlxEkh.exe
  2⤵
  PID:6188
- C:\Windows\System\gUAtsQy.exe
  C:\Windows\System\gUAtsQy.exe
  2⤵
  PID:6220
- C:\Windows\System\qsIkhXE.exe
  C:\Windows\System\qsIkhXE.exe
  2⤵
  PID:6248
- C:\Windows\System\oIrskWY.exe
  C:\Windows\System\oIrskWY.exe
  2⤵
  PID:6264
- C:\Windows\System\sZnkAdY.exe
  C:\Windows\System\sZnkAdY.exe
  2⤵
  PID:6300
- C:\Windows\System\MDelabK.exe
  C:\Windows\System\MDelabK.exe
  2⤵
  PID:6320
- C:\Windows\System\wGYNCzH.exe
  C:\Windows\System\wGYNCzH.exe
  2⤵
  PID:6352
- C:\Windows\System\RzkfhOr.exe
  C:\Windows\System\RzkfhOr.exe
  2⤵
  PID:6388
- C:\Windows\System\omTGvna.exe
  C:\Windows\System\omTGvna.exe
  2⤵
  PID:6416
- C:\Windows\System\WKVEoCR.exe
  C:\Windows\System\WKVEoCR.exe
  2⤵
  PID:6444
- C:\Windows\System\eqqaklo.exe
  C:\Windows\System\eqqaklo.exe
  2⤵
  PID:6488
- C:\Windows\System\jXHJkSE.exe
  C:\Windows\System\jXHJkSE.exe
  2⤵
  PID:6516
- C:\Windows\System\VgZeDqt.exe
  C:\Windows\System\VgZeDqt.exe
  2⤵
  PID:6544
- C:\Windows\System\epfpdDn.exe
  C:\Windows\System\epfpdDn.exe
  2⤵
  PID:6568
- C:\Windows\System\bvSEPnR.exe
  C:\Windows\System\bvSEPnR.exe
  2⤵
  PID:6596
- C:\Windows\System\vIENWCX.exe
  C:\Windows\System\vIENWCX.exe
  2⤵
  PID:6636
- C:\Windows\System\IcTGjEb.exe
  C:\Windows\System\IcTGjEb.exe
  2⤵
  PID:6656
- C:\Windows\System\KhdODlr.exe
  C:\Windows\System\KhdODlr.exe
  2⤵
  PID:6700
- C:\Windows\System\VHwyxov.exe
  C:\Windows\System\VHwyxov.exe
  2⤵
  PID:6748
- C:\Windows\System\AeQZyOP.exe
  C:\Windows\System\AeQZyOP.exe
  2⤵
  PID:6792
- C:\Windows\System\NEzbdSv.exe
  C:\Windows\System\NEzbdSv.exe
  2⤵
  PID:6820
- C:\Windows\System\BhVLVTY.exe
  C:\Windows\System\BhVLVTY.exe
  2⤵
  PID:6836
- C:\Windows\System\wsWplaB.exe
  C:\Windows\System\wsWplaB.exe
  2⤵
  PID:6864
- C:\Windows\System\szWHLCm.exe
  C:\Windows\System\szWHLCm.exe
  2⤵
  PID:6892
- C:\Windows\System\DNBjlGw.exe
  C:\Windows\System\DNBjlGw.exe
  2⤵
  PID:6916
- C:\Windows\System\aBOIvkX.exe
  C:\Windows\System\aBOIvkX.exe
  2⤵
  PID:6956
- C:\Windows\System\ddotLnK.exe
  C:\Windows\System\ddotLnK.exe
  2⤵
  PID:6976
- C:\Windows\System\MvHiSia.exe
  C:\Windows\System\MvHiSia.exe
  2⤵
  PID:7004
- C:\Windows\System\bzpymWo.exe
  C:\Windows\System\bzpymWo.exe
  2⤵
  PID:7032
- C:\Windows\System\kZWdaCT.exe
  C:\Windows\System\kZWdaCT.exe
  2⤵
  PID:7052
- C:\Windows\System\pIrbtyI.exe
  C:\Windows\System\pIrbtyI.exe
  2⤵
  PID:7088
- C:\Windows\System\EjytZzn.exe
  C:\Windows\System\EjytZzn.exe
  2⤵
  PID:7136
- C:\Windows\System\uQhjGPR.exe
  C:\Windows\System\uQhjGPR.exe
  2⤵
  PID:7160
- C:\Windows\System\fYpvbCp.exe
  C:\Windows\System\fYpvbCp.exe
  2⤵
  PID:6104
- C:\Windows\System\JKnQufY.exe
  C:\Windows\System\JKnQufY.exe
  2⤵
  PID:6256
- C:\Windows\System\AVIZAhN.exe
  C:\Windows\System\AVIZAhN.exe
  2⤵
  PID:6316
- C:\Windows\System\hXMJLLy.exe
  C:\Windows\System\hXMJLLy.exe
  2⤵
  PID:6400
- C:\Windows\System\wepAnyz.exe
  C:\Windows\System\wepAnyz.exe
  2⤵
  PID:6472
- C:\Windows\System\VaAQFdM.exe
  C:\Windows\System\VaAQFdM.exe
  2⤵
  PID:6524
- C:\Windows\System\oGYaDBF.exe
  C:\Windows\System\oGYaDBF.exe
  2⤵
  PID:6580
- C:\Windows\System\RrgEVvm.exe
  C:\Windows\System\RrgEVvm.exe
  2⤵
  PID:6680
- C:\Windows\System\ZLwtHlJ.exe
  C:\Windows\System\ZLwtHlJ.exe
  2⤵
  PID:6804
- C:\Windows\System\qweqGVS.exe
  C:\Windows\System\qweqGVS.exe
  2⤵
  PID:6884
- C:\Windows\System\DnArxtW.exe
  C:\Windows\System\DnArxtW.exe
  2⤵
  PID:6944
- C:\Windows\System\GyYmfsf.exe
  C:\Windows\System\GyYmfsf.exe
  2⤵
  PID:7028
- C:\Windows\System\dztRrPv.exe
  C:\Windows\System\dztRrPv.exe
  2⤵
  PID:7040
- C:\Windows\System\VDOniyi.exe
  C:\Windows\System\VDOniyi.exe
  2⤵
  PID:6244
- C:\Windows\System\IcUFGRP.exe
  C:\Windows\System\IcUFGRP.exe
  2⤵
  PID:5992
- C:\Windows\System\UdwzupD.exe
  C:\Windows\System\UdwzupD.exe
  2⤵
  PID:6740
- C:\Windows\System\aoHsqUk.exe
  C:\Windows\System\aoHsqUk.exe
  2⤵
  PID:6848
- C:\Windows\System\CJkXPDi.exe
  C:\Windows\System\CJkXPDi.exe
  2⤵
  PID:7048
- C:\Windows\System\WYLZvZO.exe
  C:\Windows\System\WYLZvZO.exe
  2⤵
  PID:6664
- C:\Windows\System\QAFTLRg.exe
  C:\Windows\System\QAFTLRg.exe
  2⤵
  PID:6456
- C:\Windows\System\RjFCXJB.exe
  C:\Windows\System\RjFCXJB.exe
  2⤵
  PID:7188
- C:\Windows\System\MsJDnGk.exe
  C:\Windows\System\MsJDnGk.exe
  2⤵
  PID:7204
- C:\Windows\System\ARFepGC.exe
  C:\Windows\System\ARFepGC.exe
  2⤵
  PID:7220
- C:\Windows\System\FPRyDrU.exe
  C:\Windows\System\FPRyDrU.exe
  2⤵
  PID:7244
- C:\Windows\System\igVDjmy.exe
  C:\Windows\System\igVDjmy.exe
  2⤵
  PID:7260
- C:\Windows\System\eEJITPP.exe
  C:\Windows\System\eEJITPP.exe
  2⤵
  PID:7288
- C:\Windows\System\hpeBUrA.exe
  C:\Windows\System\hpeBUrA.exe
  2⤵
  PID:7336
- C:\Windows\System\wQQGiuE.exe
  C:\Windows\System\wQQGiuE.exe
  2⤵
  PID:7376
- C:\Windows\System\uWwUjJI.exe
  C:\Windows\System\uWwUjJI.exe
  2⤵
  PID:7424
- C:\Windows\System\jMixsMC.exe
  C:\Windows\System\jMixsMC.exe
  2⤵
  PID:7472
- C:\Windows\System\rdszUcK.exe
  C:\Windows\System\rdszUcK.exe
  2⤵
  PID:7504
- C:\Windows\System\bJmntTy.exe
  C:\Windows\System\bJmntTy.exe
  2⤵
  PID:7540
- C:\Windows\System\YHFqwAV.exe
  C:\Windows\System\YHFqwAV.exe
  2⤵
  PID:7572
- C:\Windows\System\uSwSJsb.exe
  C:\Windows\System\uSwSJsb.exe
  2⤵
  PID:7612
- C:\Windows\System\TTUwerV.exe
  C:\Windows\System\TTUwerV.exe
  2⤵
  PID:7640
- C:\Windows\System\izddkpw.exe
  C:\Windows\System\izddkpw.exe
  2⤵
  PID:7664
- C:\Windows\System\RckGaHW.exe
  C:\Windows\System\RckGaHW.exe
  2⤵
  PID:7684
- C:\Windows\System\JSiERcR.exe
  C:\Windows\System\JSiERcR.exe
  2⤵
  PID:7720
- C:\Windows\System\TCeTtCK.exe
  C:\Windows\System\TCeTtCK.exe
  2⤵
  PID:7744
- C:\Windows\System\hMzOtal.exe
  C:\Windows\System\hMzOtal.exe
  2⤵
  PID:7792
- C:\Windows\System\HIoHdxk.exe
  C:\Windows\System\HIoHdxk.exe
  2⤵
  PID:7816
- C:\Windows\System\XHmWSlZ.exe
  C:\Windows\System\XHmWSlZ.exe
  2⤵
  PID:7848
- C:\Windows\System\PtFGHSx.exe
  C:\Windows\System\PtFGHSx.exe
  2⤵
  PID:7876
- C:\Windows\System\QTVMRbx.exe
  C:\Windows\System\QTVMRbx.exe
  2⤵
  PID:7912
- C:\Windows\System\yVQQQyQ.exe
  C:\Windows\System\yVQQQyQ.exe
  2⤵
  PID:7932
- C:\Windows\System\DBluYJn.exe
  C:\Windows\System\DBluYJn.exe
  2⤵
  PID:7960
- C:\Windows\System\szjuWpF.exe
  C:\Windows\System\szjuWpF.exe
  2⤵
  PID:7988
- C:\Windows\System\YjVQouu.exe
  C:\Windows\System\YjVQouu.exe
  2⤵
  PID:8012
- C:\Windows\System\BDYAuiU.exe
  C:\Windows\System\BDYAuiU.exe
  2⤵
  PID:8040
- C:\Windows\System\WysEqxK.exe
  C:\Windows\System\WysEqxK.exe
  2⤵
  PID:8072
- C:\Windows\System\TQlaNUs.exe
  C:\Windows\System\TQlaNUs.exe
  2⤵
  PID:8104
- C:\Windows\System\ZkmtYSQ.exe
  C:\Windows\System\ZkmtYSQ.exe
  2⤵
  PID:8132
- C:\Windows\System\cfsMYni.exe
  C:\Windows\System\cfsMYni.exe
  2⤵
  PID:8160
- C:\Windows\System\BJygAyK.exe
  C:\Windows\System\BJygAyK.exe
  2⤵
  PID:7176
- C:\Windows\System\lpWdSbz.exe
  C:\Windows\System\lpWdSbz.exe
  2⤵
  PID:7212
- C:\Windows\System\zZMTSVd.exe
  C:\Windows\System\zZMTSVd.exe
  2⤵
  PID:7308
- C:\Windows\System\isIdkJe.exe
  C:\Windows\System\isIdkJe.exe
  2⤵
  PID:7368
- C:\Windows\System\aaMUJhK.exe
  C:\Windows\System\aaMUJhK.exe
  2⤵
  PID:7464
- C:\Windows\System\MEEKVrF.exe
  C:\Windows\System\MEEKVrF.exe
  2⤵
  PID:7536
- C:\Windows\System\VueFXNv.exe
  C:\Windows\System\VueFXNv.exe
  2⤵
  PID:7600
- C:\Windows\System\fjdzFlS.exe
  C:\Windows\System\fjdzFlS.exe
  2⤵
  PID:7712
- C:\Windows\System\zstQJvR.exe
  C:\Windows\System\zstQJvR.exe
  2⤵
  PID:7764
- C:\Windows\System\vkKufEP.exe
  C:\Windows\System\vkKufEP.exe
  2⤵
  PID:7860
- C:\Windows\System\BSnWfWo.exe
  C:\Windows\System\BSnWfWo.exe
  2⤵
  PID:7944
- C:\Windows\System\HslFUXT.exe
  C:\Windows\System\HslFUXT.exe
  2⤵
  PID:7972
- C:\Windows\System\UNmEHOC.exe
  C:\Windows\System\UNmEHOC.exe
  2⤵
  PID:8036
- C:\Windows\System\yoOlSrd.exe
  C:\Windows\System\yoOlSrd.exe
  2⤵
  PID:8124
- C:\Windows\System\BDRJGiC.exe
  C:\Windows\System\BDRJGiC.exe
  2⤵
  PID:7200
- C:\Windows\System\zSsCiXh.exe
  C:\Windows\System\zSsCiXh.exe
  2⤵
  PID:7232
- C:\Windows\System\fMJcNcO.exe
  C:\Windows\System\fMJcNcO.exe
  2⤵
  PID:7596
- C:\Windows\System\NlEsQSa.exe
  C:\Windows\System\NlEsQSa.exe
  2⤵
  PID:7736
- C:\Windows\System\TyHDBIZ.exe
  C:\Windows\System\TyHDBIZ.exe
  2⤵
  PID:7956
- C:\Windows\System\bMbveSm.exe
  C:\Windows\System\bMbveSm.exe
  2⤵
  PID:8084
- C:\Windows\System\pXyivUM.exe
  C:\Windows\System\pXyivUM.exe
  2⤵
  PID:7240
- C:\Windows\System\YXWCvEv.exe
  C:\Windows\System\YXWCvEv.exe
  2⤵
  PID:7896
- C:\Windows\System\syuNxSy.exe
  C:\Windows\System\syuNxSy.exe
  2⤵
  PID:7256
- C:\Windows\System\CptxHcY.exe
  C:\Windows\System\CptxHcY.exe
  2⤵
  PID:7844
- C:\Windows\System\jZTZOQj.exe
  C:\Windows\System\jZTZOQj.exe
  2⤵
  PID:8216
- C:\Windows\System\LKsoBom.exe
  C:\Windows\System\LKsoBom.exe
  2⤵
  PID:8244
- C:\Windows\System\aXABawp.exe
  C:\Windows\System\aXABawp.exe
  2⤵
  PID:8272
- C:\Windows\System\tyJXbrl.exe
  C:\Windows\System\tyJXbrl.exe
  2⤵
  PID:8300
- C:\Windows\System\eUAOVaJ.exe
  C:\Windows\System\eUAOVaJ.exe
  2⤵
  PID:8328
- C:\Windows\System\YVdiCUl.exe
  C:\Windows\System\YVdiCUl.exe
  2⤵
  PID:8360
- C:\Windows\System\xzAUklT.exe
  C:\Windows\System\xzAUklT.exe
  2⤵
  PID:8388
- C:\Windows\System\XRSfRZV.exe
  C:\Windows\System\XRSfRZV.exe
  2⤵
  PID:8416
- C:\Windows\System\VsFTcFq.exe
  C:\Windows\System\VsFTcFq.exe
  2⤵
  PID:8444
- C:\Windows\System\QDIJNhy.exe
  C:\Windows\System\QDIJNhy.exe
  2⤵
  PID:8472
- C:\Windows\System\eVDJLcm.exe
  C:\Windows\System\eVDJLcm.exe
  2⤵
  PID:8500
- C:\Windows\System\QdnnOLK.exe
  C:\Windows\System\QdnnOLK.exe
  2⤵
  PID:8532
- C:\Windows\System\dEwCfJk.exe
  C:\Windows\System\dEwCfJk.exe
  2⤵
  PID:8556
- C:\Windows\System\prSLZSk.exe
  C:\Windows\System\prSLZSk.exe
  2⤵
  PID:8588
- C:\Windows\System\mYsDMqe.exe
  C:\Windows\System\mYsDMqe.exe
  2⤵
  PID:8616
- C:\Windows\System\VquwAuV.exe
  C:\Windows\System\VquwAuV.exe
  2⤵
  PID:8640
- C:\Windows\System\IjoCgtg.exe
  C:\Windows\System\IjoCgtg.exe
  2⤵
  PID:8668
- C:\Windows\System\cRZApkT.exe
  C:\Windows\System\cRZApkT.exe
  2⤵
  PID:8696
- C:\Windows\System\xqFavIP.exe
  C:\Windows\System\xqFavIP.exe
  2⤵
  PID:8728
- C:\Windows\System\oPCYGub.exe
  C:\Windows\System\oPCYGub.exe
  2⤵
  PID:8752
- C:\Windows\System\JxCCKgY.exe
  C:\Windows\System\JxCCKgY.exe
  2⤵
  PID:8780
- C:\Windows\System\TtcEbqi.exe
  C:\Windows\System\TtcEbqi.exe
  2⤵
  PID:8808
- C:\Windows\System\AliAWIW.exe
  C:\Windows\System\AliAWIW.exe
  2⤵
  PID:8840
- C:\Windows\System\jxQthJG.exe
  C:\Windows\System\jxQthJG.exe
  2⤵
  PID:8868
- C:\Windows\System\Nxrunxs.exe
  C:\Windows\System\Nxrunxs.exe
  2⤵
  PID:8892
- C:\Windows\System\Eldumtj.exe
  C:\Windows\System\Eldumtj.exe
  2⤵
  PID:8924
- C:\Windows\System\LlmWTtA.exe
  C:\Windows\System\LlmWTtA.exe
  2⤵
  PID:8948
- C:\Windows\System\jjwcDOe.exe
  C:\Windows\System\jjwcDOe.exe
  2⤵
  PID:8976
- C:\Windows\System\YVXxtzE.exe
  C:\Windows\System\YVXxtzE.exe
  2⤵
  PID:9004
- C:\Windows\System\xLWbfDG.exe
  C:\Windows\System\xLWbfDG.exe
  2⤵
  PID:9032
- C:\Windows\System\HQZboDo.exe
  C:\Windows\System\HQZboDo.exe
  2⤵
  PID:9060
- C:\Windows\System\jRfqeia.exe
  C:\Windows\System\jRfqeia.exe
  2⤵
  PID:9088
- C:\Windows\System\wDjgNTV.exe
  C:\Windows\System\wDjgNTV.exe
  2⤵
  PID:9120
- C:\Windows\System\pocRDQS.exe
  C:\Windows\System\pocRDQS.exe
  2⤵
  PID:9144
- C:\Windows\System\kRmeQCq.exe
  C:\Windows\System\kRmeQCq.exe
  2⤵
  PID:9172
- C:\Windows\System\IKUdHWR.exe
  C:\Windows\System\IKUdHWR.exe
  2⤵
  PID:9200
- C:\Windows\System\KPOHBFs.exe
  C:\Windows\System\KPOHBFs.exe
  2⤵
  PID:7272
- C:\Windows\System\YNEvHEy.exe
  C:\Windows\System\YNEvHEy.exe
  2⤵
  PID:8240
- C:\Windows\System\txdAMts.exe
  C:\Windows\System\txdAMts.exe
  2⤵
  PID:8292
- C:\Windows\System\dMjeKUA.exe
  C:\Windows\System\dMjeKUA.exe
  2⤵
  PID:8380
- C:\Windows\System\wXCKeUo.exe
  C:\Windows\System\wXCKeUo.exe
  2⤵
  PID:8464
- C:\Windows\System\tgbRvED.exe
  C:\Windows\System\tgbRvED.exe
  2⤵
  PID:8512
- C:\Windows\System\BoqzQBo.exe
  C:\Windows\System\BoqzQBo.exe
  2⤵
  PID:8576
- C:\Windows\System\KPjRuVz.exe
  C:\Windows\System\KPjRuVz.exe
  2⤵
  PID:8636
- C:\Windows\System\zRXVRqF.exe
  C:\Windows\System\zRXVRqF.exe
  2⤵
  PID:8736
- C:\Windows\System\lTHvIsZ.exe
  C:\Windows\System\lTHvIsZ.exe
  2⤵
  PID:8800
- C:\Windows\System\HatfhKd.exe
  C:\Windows\System\HatfhKd.exe
  2⤵
  PID:8860
- C:\Windows\System\swjyPtn.exe
  C:\Windows\System\swjyPtn.exe
  2⤵
  PID:8904
- C:\Windows\System\KicdEhJ.exe
  C:\Windows\System\KicdEhJ.exe
  2⤵
  PID:8968
- C:\Windows\System\ezcdHYp.exe
  C:\Windows\System\ezcdHYp.exe
  2⤵
  PID:9044
- C:\Windows\System\bjkhYHn.exe
  C:\Windows\System\bjkhYHn.exe
  2⤵
  PID:9108
- C:\Windows\System\XQJkSrE.exe
  C:\Windows\System\XQJkSrE.exe
  2⤵
  PID:9188
- C:\Windows\System\nsCldQT.exe
  C:\Windows\System\nsCldQT.exe
  2⤵
  PID:8236
- C:\Windows\System\NdXdfjR.exe
  C:\Windows\System\NdXdfjR.exe
  2⤵
  PID:8436
- C:\Windows\System\MNQvjtW.exe
  C:\Windows\System\MNQvjtW.exe
  2⤵
  PID:8540
- C:\Windows\System\cCqFlho.exe
  C:\Windows\System\cCqFlho.exe
  2⤵
  PID:8688
- C:\Windows\System\TJNpCze.exe
  C:\Windows\System\TJNpCze.exe
  2⤵
  PID:8888
- C:\Windows\System\bheHCrO.exe
  C:\Windows\System\bheHCrO.exe
  2⤵
  PID:9024
- C:\Windows\System\SZqxouR.exe
  C:\Windows\System\SZqxouR.exe
  2⤵
  PID:9140
- C:\Windows\System\ZiPLfTV.exe
  C:\Windows\System\ZiPLfTV.exe
  2⤵
  PID:8340
- C:\Windows\System\sTsLhaU.exe
  C:\Windows\System\sTsLhaU.exe
  2⤵
  PID:8772
- C:\Windows\System\HKiEsMM.exe
  C:\Windows\System\HKiEsMM.exe
  2⤵
  PID:8496
- C:\Windows\System\rEZmlQo.exe
  C:\Windows\System\rEZmlQo.exe
  2⤵
  PID:4960
- C:\Windows\System\YaLCAvp.exe
  C:\Windows\System\YaLCAvp.exe
  2⤵
  PID:4692
- C:\Windows\System\DyaPXzX.exe
  C:\Windows\System\DyaPXzX.exe
  2⤵
  PID:3540
- C:\Windows\System\udheJbQ.exe
  C:\Windows\System\udheJbQ.exe
  2⤵
  PID:8324
- C:\Windows\System\ahGbSoW.exe
  C:\Windows\System\ahGbSoW.exe
  2⤵
  PID:4520
- C:\Windows\System\PSPkkZI.exe
  C:\Windows\System\PSPkkZI.exe
  2⤵
  PID:9224
- C:\Windows\System\mFAjNHn.exe
  C:\Windows\System\mFAjNHn.exe
  2⤵
  PID:9240
- C:\Windows\System\YeCzgxF.exe
  C:\Windows\System\YeCzgxF.exe
  2⤵
  PID:9268
- C:\Windows\System\XXcSUUA.exe
  C:\Windows\System\XXcSUUA.exe
  2⤵
  PID:9316
- C:\Windows\System\Oxqwfju.exe
  C:\Windows\System\Oxqwfju.exe
  2⤵
  PID:9352
- C:\Windows\System\NeEgwJg.exe
  C:\Windows\System\NeEgwJg.exe
  2⤵
  PID:9384
- C:\Windows\System\MjYOvTh.exe
  C:\Windows\System\MjYOvTh.exe
  2⤵
  PID:9404
- C:\Windows\System\ttIjGzB.exe
  C:\Windows\System\ttIjGzB.exe
  2⤵
  PID:9432
- C:\Windows\System\uXaykCh.exe
  C:\Windows\System\uXaykCh.exe
  2⤵
  PID:9468
- C:\Windows\System\YNtySCs.exe
  C:\Windows\System\YNtySCs.exe
  2⤵
  PID:9492
- C:\Windows\System\kotWySN.exe
  C:\Windows\System\kotWySN.exe
  2⤵
  PID:9532
- C:\Windows\System\XcldfNj.exe
  C:\Windows\System\XcldfNj.exe
  2⤵
  PID:9560
- C:\Windows\System\rdLIwpe.exe
  C:\Windows\System\rdLIwpe.exe
  2⤵
  PID:9580
- C:\Windows\System\ulJbPHb.exe
  C:\Windows\System\ulJbPHb.exe
  2⤵
  PID:9608
- C:\Windows\System\VSrOPrD.exe
  C:\Windows\System\VSrOPrD.exe
  2⤵
  PID:9644
- C:\Windows\System\NDPqgJZ.exe
  C:\Windows\System\NDPqgJZ.exe
  2⤵
  PID:9660
- C:\Windows\System\bUYRZUH.exe
  C:\Windows\System\bUYRZUH.exe
  2⤵
  PID:9684
- C:\Windows\System\flEduYk.exe
  C:\Windows\System\flEduYk.exe
  2⤵
  PID:9708
- C:\Windows\System\NaDolWg.exe
  C:\Windows\System\NaDolWg.exe
  2⤵
  PID:9756
- C:\Windows\System\ihlJmeL.exe
  C:\Windows\System\ihlJmeL.exe
  2⤵
  PID:9784
- C:\Windows\System\HgnPIYn.exe
  C:\Windows\System\HgnPIYn.exe
  2⤵
  PID:9812
- C:\Windows\System\tsmlBLr.exe
  C:\Windows\System\tsmlBLr.exe
  2⤵
  PID:9840
- C:\Windows\System\JelvWDW.exe
  C:\Windows\System\JelvWDW.exe
  2⤵
  PID:9868
- C:\Windows\System\zSTDACc.exe
  C:\Windows\System\zSTDACc.exe
  2⤵
  PID:9896
- C:\Windows\System\CUkjbKW.exe
  C:\Windows\System\CUkjbKW.exe
  2⤵
  PID:9924
- C:\Windows\System\NUEhmhR.exe
  C:\Windows\System\NUEhmhR.exe
  2⤵
  PID:9952
- C:\Windows\System\JgKbqiD.exe
  C:\Windows\System\JgKbqiD.exe
  2⤵
  PID:9980
- C:\Windows\System\RGaqkmm.exe
  C:\Windows\System\RGaqkmm.exe
  2⤵
  PID:10008
- C:\Windows\System\yEBsEPs.exe
  C:\Windows\System\yEBsEPs.exe
  2⤵
  PID:10036
- C:\Windows\System\WvAahnF.exe
  C:\Windows\System\WvAahnF.exe
  2⤵
  PID:10064
- C:\Windows\System\aFNFSXV.exe
  C:\Windows\System\aFNFSXV.exe
  2⤵
  PID:10092
- C:\Windows\System\DiZswPu.exe
  C:\Windows\System\DiZswPu.exe
  2⤵
  PID:10120
- C:\Windows\System\yaQvGmr.exe
  C:\Windows\System\yaQvGmr.exe
  2⤵
  PID:10148
- C:\Windows\System\eQwVBgZ.exe
  C:\Windows\System\eQwVBgZ.exe
  2⤵
  PID:10176
- C:\Windows\System\XULklZs.exe
  C:\Windows\System\XULklZs.exe
  2⤵
  PID:10204
- C:\Windows\System\gnAiOML.exe
  C:\Windows\System\gnAiOML.exe
  2⤵
  PID:10232
- C:\Windows\System\PgzTsqM.exe
  C:\Windows\System\PgzTsqM.exe
  2⤵
  PID:9256
- C:\Windows\System\QXMhomf.exe
  C:\Windows\System\QXMhomf.exe
  2⤵
  PID:9336
- C:\Windows\System\FcNHFEV.exe
  C:\Windows\System\FcNHFEV.exe
  2⤵
  PID:9396
- C:\Windows\System\ZCeQNyj.exe
  C:\Windows\System\ZCeQNyj.exe
  2⤵
  PID:9476
- C:\Windows\System\ycqjmAj.exe
  C:\Windows\System\ycqjmAj.exe
  2⤵
  PID:9528
- C:\Windows\System\osQUaXK.exe
  C:\Windows\System\osQUaXK.exe
  2⤵
  PID:9604
- C:\Windows\System\wdRMPXy.exe
  C:\Windows\System\wdRMPXy.exe
  2⤵
  PID:9676
- C:\Windows\System\EvQilLN.exe
  C:\Windows\System\EvQilLN.exe
  2⤵
  PID:9740
- C:\Windows\System\mMfwNrE.exe
  C:\Windows\System\mMfwNrE.exe
  2⤵
  PID:9804
- C:\Windows\System\fbLOQMn.exe
  C:\Windows\System\fbLOQMn.exe
  2⤵
  PID:9856
- C:\Windows\System\YjmqFax.exe
  C:\Windows\System\YjmqFax.exe
  2⤵
  PID:9916
- C:\Windows\System\RXPMpls.exe
  C:\Windows\System\RXPMpls.exe
  2⤵
  PID:10000
- C:\Windows\System\GKpSCWQ.exe
  C:\Windows\System\GKpSCWQ.exe
  2⤵
  PID:10060
- C:\Windows\System\alqBtxy.exe
  C:\Windows\System\alqBtxy.exe
  2⤵
  PID:10132
- C:\Windows\System\KmbFsDF.exe
  C:\Windows\System\KmbFsDF.exe
  2⤵
  PID:9080
- C:\Windows\System\IjqTCOA.exe
  C:\Windows\System\IjqTCOA.exe
  2⤵
  PID:10224
- C:\Windows\System\DpCHQkw.exe
  C:\Windows\System\DpCHQkw.exe
  2⤵
  PID:9364
- C:\Windows\System\oljmhQd.exe
  C:\Windows\System\oljmhQd.exe
  2⤵
  PID:9556
- C:\Windows\System\baTpiap.exe
  C:\Windows\System\baTpiap.exe
  2⤵
  PID:9704
- C:\Windows\System\LrqXjCB.exe
  C:\Windows\System\LrqXjCB.exe
  2⤵
  PID:9852
- C:\Windows\System\fpzVSDi.exe
  C:\Windows\System\fpzVSDi.exe
  2⤵
  PID:10048
- C:\Windows\System\qBNLFXn.exe
  C:\Windows\System\qBNLFXn.exe
  2⤵
  PID:10172
- C:\Windows\System\nAVvxNa.exe
  C:\Windows\System\nAVvxNa.exe
  2⤵
  PID:9448
- C:\Windows\System\BSAlmIB.exe
  C:\Windows\System\BSAlmIB.exe
  2⤵
  PID:9836
- C:\Windows\System\LqISYnE.exe
  C:\Windows\System\LqISYnE.exe
  2⤵
  PID:9400
- C:\Windows\System\pqptHzR.exe
  C:\Windows\System\pqptHzR.exe
  2⤵
  PID:10032
- C:\Windows\System\QdiuXME.exe
  C:\Windows\System\QdiuXME.exe
  2⤵
  PID:9768
- C:\Windows\System\zRDuaqR.exe
  C:\Windows\System\zRDuaqR.exe
  2⤵
  PID:10268
- C:\Windows\System\hfREUmm.exe
  C:\Windows\System\hfREUmm.exe
  2⤵
  PID:10296
- C:\Windows\System\hjguSwD.exe
  C:\Windows\System\hjguSwD.exe
  2⤵
  PID:10324
- C:\Windows\System\xVSUaeq.exe
  C:\Windows\System\xVSUaeq.exe
  2⤵
  PID:10352
- C:\Windows\System\MorHYCw.exe
  C:\Windows\System\MorHYCw.exe
  2⤵
  PID:10380
- C:\Windows\System\glkptVc.exe
  C:\Windows\System\glkptVc.exe
  2⤵
  PID:10408
- C:\Windows\System\GMNBsvH.exe
  C:\Windows\System\GMNBsvH.exe
  2⤵
  PID:10436
- C:\Windows\System\AHURatO.exe
  C:\Windows\System\AHURatO.exe
  2⤵
  PID:10464
- C:\Windows\System\thfqRmY.exe
  C:\Windows\System\thfqRmY.exe
  2⤵
  PID:10492
- C:\Windows\System\vimnfpW.exe
  C:\Windows\System\vimnfpW.exe
  2⤵
  PID:10520
- C:\Windows\System\WnVgCqC.exe
  C:\Windows\System\WnVgCqC.exe
  2⤵
  PID:10548
- C:\Windows\System\fUHBrwe.exe
  C:\Windows\System\fUHBrwe.exe
  2⤵
  PID:10576
- C:\Windows\System\EmGOrYK.exe
  C:\Windows\System\EmGOrYK.exe
  2⤵
  PID:10604
- C:\Windows\System\GPXlEVj.exe
  C:\Windows\System\GPXlEVj.exe
  2⤵
  PID:10632
- C:\Windows\System\WxxIWnP.exe
  C:\Windows\System\WxxIWnP.exe
  2⤵
  PID:10660
- C:\Windows\System\ldteECJ.exe
  C:\Windows\System\ldteECJ.exe
  2⤵
  PID:10688
- C:\Windows\System\zyTdAYU.exe
  C:\Windows\System\zyTdAYU.exe
  2⤵
  PID:10716
- C:\Windows\System\jqjQeNO.exe
  C:\Windows\System\jqjQeNO.exe
  2⤵
  PID:10744
- C:\Windows\System\uPahyWr.exe
  C:\Windows\System\uPahyWr.exe
  2⤵
  PID:10772
- C:\Windows\System\RycMpXz.exe
  C:\Windows\System\RycMpXz.exe
  2⤵
  PID:10800
- C:\Windows\System\PvsEnDe.exe
  C:\Windows\System\PvsEnDe.exe
  2⤵
  PID:10828
- C:\Windows\System\FrJZWHV.exe
  C:\Windows\System\FrJZWHV.exe
  2⤵
  PID:10856
- C:\Windows\System\AlEwHjv.exe
  C:\Windows\System\AlEwHjv.exe
  2⤵
  PID:10884
- C:\Windows\System\KThmyQY.exe
  C:\Windows\System\KThmyQY.exe
  2⤵
  PID:10912
- C:\Windows\System\FFnbpko.exe
  C:\Windows\System\FFnbpko.exe
  2⤵
  PID:10940
- C:\Windows\System\mFUdUad.exe
  C:\Windows\System\mFUdUad.exe
  2⤵
  PID:10968
- C:\Windows\System\BEKgBxK.exe
  C:\Windows\System\BEKgBxK.exe
  2⤵
  PID:10996
- C:\Windows\System\OLcggix.exe
  C:\Windows\System\OLcggix.exe
  2⤵
  PID:11024
- C:\Windows\System\LFLaKYm.exe
  C:\Windows\System\LFLaKYm.exe
  2⤵
  PID:11052
- C:\Windows\System\TRJvyZG.exe
  C:\Windows\System\TRJvyZG.exe
  2⤵
  PID:11080
- C:\Windows\System\fHcYZgg.exe
  C:\Windows\System\fHcYZgg.exe
  2⤵
  PID:11108
- C:\Windows\System\icCYXkm.exe
  C:\Windows\System\icCYXkm.exe
  2⤵
  PID:11136
- C:\Windows\System\riLXQFX.exe
  C:\Windows\System\riLXQFX.exe
  2⤵
  PID:11164
- C:\Windows\System\UQNbmYt.exe
  C:\Windows\System\UQNbmYt.exe
  2⤵
  PID:11192
- C:\Windows\System\tTfWvzA.exe
  C:\Windows\System\tTfWvzA.exe
  2⤵
  PID:11208
- C:\Windows\System\jXzNXvX.exe
  C:\Windows\System\jXzNXvX.exe
  2⤵
  PID:11248
- C:\Windows\System\rrtBOaA.exe
  C:\Windows\System\rrtBOaA.exe
  2⤵
  PID:10252
- C:\Windows\System\fQbYtlY.exe
  C:\Windows\System\fQbYtlY.exe
  2⤵
  PID:10336
- C:\Windows\System\OSUAyqq.exe
  C:\Windows\System\OSUAyqq.exe
  2⤵
  PID:10396
- C:\Windows\System\wNLMGam.exe
  C:\Windows\System\wNLMGam.exe
  2⤵
  PID:10456
- C:\Windows\System\KnksmMm.exe
  C:\Windows\System\KnksmMm.exe
  2⤵
  PID:10536
- C:\Windows\System\ByWvMOi.exe
  C:\Windows\System\ByWvMOi.exe
  2⤵
  PID:10596
- C:\Windows\System\wohdpWG.exe
  C:\Windows\System\wohdpWG.exe
  2⤵
  PID:10672
- C:\Windows\System\RryhSnz.exe
  C:\Windows\System\RryhSnz.exe
  2⤵
  PID:10728
- C:\Windows\System\kZjsGzQ.exe
  C:\Windows\System\kZjsGzQ.exe
  2⤵
  PID:10796
- C:\Windows\System\iEqLrla.exe
  C:\Windows\System\iEqLrla.exe
  2⤵
  PID:10868
- C:\Windows\System\iAkICUF.exe
  C:\Windows\System\iAkICUF.exe
  2⤵
  PID:10936
- C:\Windows\System\rQdesdl.exe
  C:\Windows\System\rQdesdl.exe
  2⤵
  PID:10992
- C:\Windows\System\eRUEaBR.exe
  C:\Windows\System\eRUEaBR.exe
  2⤵
  PID:9964
- C:\Windows\System\dRuykNq.exe
  C:\Windows\System\dRuykNq.exe
  2⤵
  PID:11148
- C:\Windows\System\oDTCKFc.exe
  C:\Windows\System\oDTCKFc.exe
  2⤵
  PID:11176
- C:\Windows\System\ZlZCdYu.exe
  C:\Windows\System\ZlZCdYu.exe
  2⤵
  PID:11220
- C:\Windows\System\bjKdKHh.exe
  C:\Windows\System\bjKdKHh.exe
  2⤵
  PID:10372
- C:\Windows\System\AMttjFs.exe
  C:\Windows\System\AMttjFs.exe
  2⤵
  PID:10516
- C:\Windows\System\fcMndmS.exe
  C:\Windows\System\fcMndmS.exe
  2⤵
  PID:10656
- C:\Windows\System\AhyJfxT.exe
  C:\Windows\System\AhyJfxT.exe
  2⤵
  PID:10820
- C:\Windows\System\ustaead.exe
  C:\Windows\System\ustaead.exe
  2⤵
  PID:10904
- C:\Windows\System\ARsmWey.exe
  C:\Windows\System\ARsmWey.exe
  2⤵
  PID:11020
- C:\Windows\System\gUrgGPF.exe
  C:\Windows\System\gUrgGPF.exe
  2⤵
  PID:11100
- C:\Windows\System\lBbyJwd.exe
  C:\Windows\System\lBbyJwd.exe
  2⤵
  PID:10428
- C:\Windows\System\aigWRgE.exe
  C:\Windows\System\aigWRgE.exe
  2⤵
  PID:11036
- C:\Windows\System\ttTbPnb.exe
  C:\Windows\System\ttTbPnb.exe
  2⤵
  PID:10264
- C:\Windows\System\MhhnTZb.exe
  C:\Windows\System\MhhnTZb.exe
  2⤵
  PID:10960
- C:\Windows\System\PCMoOdT.exe
  C:\Windows\System\PCMoOdT.exe
  2⤵
  PID:11272
- C:\Windows\System\iZuANgE.exe
  C:\Windows\System\iZuANgE.exe
  2⤵
  PID:11300
- C:\Windows\System\PJJtdSf.exe
  C:\Windows\System\PJJtdSf.exe
  2⤵
  PID:11328
- C:\Windows\System\wihvhsp.exe
  C:\Windows\System\wihvhsp.exe
  2⤵
  PID:11356
- C:\Windows\System\QjgOEJL.exe
  C:\Windows\System\QjgOEJL.exe
  2⤵
  PID:11384
- C:\Windows\System\pxYxHIW.exe
  C:\Windows\System\pxYxHIW.exe
  2⤵
  PID:11424
- C:\Windows\System\ukcHCBK.exe
  C:\Windows\System\ukcHCBK.exe
  2⤵
  PID:11452
- C:\Windows\System\UhteLhP.exe
  C:\Windows\System\UhteLhP.exe
  2⤵
  PID:11480
- C:\Windows\System\HlMjPtK.exe
  C:\Windows\System\HlMjPtK.exe
  2⤵
  PID:11508
- C:\Windows\System\vIVYDvo.exe
  C:\Windows\System\vIVYDvo.exe
  2⤵
  PID:11532
- C:\Windows\System\cXKSXDG.exe
  C:\Windows\System\cXKSXDG.exe
  2⤵
  PID:11552
- C:\Windows\System\UabYEJY.exe
  C:\Windows\System\UabYEJY.exe
  2⤵
  PID:11580
- C:\Windows\System\RznYzij.exe
  C:\Windows\System\RznYzij.exe
  2⤵
  PID:11608
- C:\Windows\System\xNsQKlc.exe
  C:\Windows\System\xNsQKlc.exe
  2⤵
  PID:11636
- C:\Windows\System\zINObOh.exe
  C:\Windows\System\zINObOh.exe
  2⤵
  PID:11664
- C:\Windows\System\jBvFVMT.exe
  C:\Windows\System\jBvFVMT.exe
  2⤵
  PID:11692
- C:\Windows\System\VQcdqHp.exe
  C:\Windows\System\VQcdqHp.exe
  2⤵
  PID:11728
- C:\Windows\System\SReUhsX.exe
  C:\Windows\System\SReUhsX.exe
  2⤵
  PID:11760
- C:\Windows\System\BuzJQRv.exe
  C:\Windows\System\BuzJQRv.exe
  2⤵
  PID:11784
- C:\Windows\System\oZKAgAg.exe
  C:\Windows\System\oZKAgAg.exe
  2⤵
  PID:11804
- C:\Windows\System\qxMFKRD.exe
  C:\Windows\System\qxMFKRD.exe
  2⤵
  PID:11844
- C:\Windows\System\XNQlqLk.exe
  C:\Windows\System\XNQlqLk.exe
  2⤵
  PID:11872
- C:\Windows\System\wcunVAE.exe
  C:\Windows\System\wcunVAE.exe
  2⤵
  PID:11904
- C:\Windows\System\TOBXwDo.exe
  C:\Windows\System\TOBXwDo.exe
  2⤵
  PID:11936
- C:\Windows\System\mKKjZYt.exe
  C:\Windows\System\mKKjZYt.exe
  2⤵
  PID:11968
- C:\Windows\System\gIuANkZ.exe
  C:\Windows\System\gIuANkZ.exe
  2⤵
  PID:12000
- C:\Windows\System\VcmYnEX.exe
  C:\Windows\System\VcmYnEX.exe
  2⤵
  PID:12032
- C:\Windows\System\wBRxtpU.exe
  C:\Windows\System\wBRxtpU.exe
  2⤵
  PID:12080
- C:\Windows\System\duRaeDs.exe
  C:\Windows\System\duRaeDs.exe
  2⤵
  PID:12112
- C:\Windows\System\kphwiVw.exe
  C:\Windows\System\kphwiVw.exe
  2⤵
  PID:12132
- C:\Windows\System\FWAOntt.exe
  C:\Windows\System\FWAOntt.exe
  2⤵
  PID:12156
- C:\Windows\System\cWCTgOp.exe
  C:\Windows\System\cWCTgOp.exe
  2⤵
  PID:12196
- C:\Windows\System\yMARFob.exe
  C:\Windows\System\yMARFob.exe
  2⤵
  PID:12228
- C:\Windows\System\NJUxroc.exe
  C:\Windows\System\NJUxroc.exe
  2⤵
  PID:12256
- C:\Windows\System\yznCsyR.exe
  C:\Windows\System\yznCsyR.exe
  2⤵
  PID:11132
- C:\Windows\System\YyuIjkC.exe
  C:\Windows\System\YyuIjkC.exe
  2⤵
  PID:11380
- C:\Windows\System\xprWgbv.exe
  C:\Windows\System\xprWgbv.exe
  2⤵
  PID:11420
- C:\Windows\System\anWjLjU.exe
  C:\Windows\System\anWjLjU.exe
  2⤵
  PID:11492
- C:\Windows\System\lWNyDlM.exe
  C:\Windows\System\lWNyDlM.exe
  2⤵
  PID:11544
- C:\Windows\System\JZPPPLG.exe
  C:\Windows\System\JZPPPLG.exe
  2⤵
  PID:11604
- C:\Windows\System\DDmyTZx.exe
  C:\Windows\System\DDmyTZx.exe
  2⤵
  PID:11676
- C:\Windows\System\UUqxiMu.exe
  C:\Windows\System\UUqxiMu.exe
  2⤵
  PID:11752
- C:\Windows\System\EBiRzQX.exe
  C:\Windows\System\EBiRzQX.exe
  2⤵
  PID:11832
- C:\Windows\System\LmjRuls.exe
  C:\Windows\System\LmjRuls.exe
  2⤵
  PID:11896
- C:\Windows\System\nwyyEZR.exe
  C:\Windows\System\nwyyEZR.exe
  2⤵
  PID:11976
- C:\Windows\System\RJQEKGB.exe
  C:\Windows\System\RJQEKGB.exe
  2⤵
  PID:12052
- C:\Windows\System\oLsBUxU.exe
  C:\Windows\System\oLsBUxU.exe
  2⤵
  PID:12124
- C:\Windows\System\KLIplFD.exe
  C:\Windows\System\KLIplFD.exe
  2⤵
  PID:12216
- C:\Windows\System\wmczByT.exe
  C:\Windows\System\wmczByT.exe
  2⤵
  PID:4916
- C:\Windows\System\QkhnWlq.exe
  C:\Windows\System\QkhnWlq.exe
  2⤵
  PID:11524
- C:\Windows\System\vNooHOT.exe
  C:\Windows\System\vNooHOT.exe
  2⤵
  PID:11816
- C:\Windows\System\qiBixop.exe
  C:\Windows\System\qiBixop.exe
  2⤵
  PID:11744
- C:\Windows\System\JIiOVrI.exe
  C:\Windows\System\JIiOVrI.exe
  2⤵
  PID:11856
- C:\Windows\System\NgeJnmA.exe
  C:\Windows\System\NgeJnmA.exe
  2⤵
  PID:12044
- C:\Windows\System\qVDMkWp.exe
  C:\Windows\System\qVDMkWp.exe
  2⤵
  PID:12168
- C:\Windows\System\YioAsdL.exe
  C:\Windows\System\YioAsdL.exe
  2⤵
  PID:12280
- C:\Windows\System\kgBTDDz.exe
  C:\Windows\System\kgBTDDz.exe
  2⤵
  PID:11756
- C:\Windows\System\SkHpcgr.exe
  C:\Windows\System\SkHpcgr.exe
  2⤵
  PID:12176
- C:\Windows\System\gSakTAZ.exe
  C:\Windows\System\gSakTAZ.exe
  2⤵
  PID:12332
- C:\Windows\System\qUmEtbB.exe
  C:\Windows\System\qUmEtbB.exe
  2⤵
  PID:12376
- C:\Windows\System\xGPuZHM.exe
  C:\Windows\System\xGPuZHM.exe
  2⤵
  PID:12416
- C:\Windows\System\ECQGpzu.exe
  C:\Windows\System\ECQGpzu.exe
  2⤵
  PID:12444
- C:\Windows\System\QAiEOhq.exe
  C:\Windows\System\QAiEOhq.exe
  2⤵
  PID:12480
- C:\Windows\System\IMtmqLK.exe
  C:\Windows\System\IMtmqLK.exe
  2⤵
  PID:12512
- C:\Windows\System\AEDQotl.exe
  C:\Windows\System\AEDQotl.exe
  2⤵
  PID:12528
- C:\Windows\System\PkQroUE.exe
  C:\Windows\System\PkQroUE.exe
  2⤵
  PID:12556
- C:\Windows\System\FMhBwBX.exe
  C:\Windows\System\FMhBwBX.exe
  2⤵
  PID:12584
- C:\Windows\System\nLrvZXS.exe
  C:\Windows\System\nLrvZXS.exe
  2⤵
  PID:12624
- C:\Windows\System\ttYLxtZ.exe
  C:\Windows\System\ttYLxtZ.exe
  2⤵
  PID:12640
- C:\Windows\System\CNZuLMb.exe
  C:\Windows\System\CNZuLMb.exe
  2⤵
  PID:12660
- C:\Windows\System\PiQQXiR.exe
  C:\Windows\System\PiQQXiR.exe
  2⤵
  PID:12700
- C:\Windows\System\AtDfasD.exe
  C:\Windows\System\AtDfasD.exe
  2⤵
  PID:12732
- C:\Windows\System\ibKHqhF.exe
  C:\Windows\System\ibKHqhF.exe
  2⤵
  PID:12760
- C:\Windows\System\GuibiFx.exe
  C:\Windows\System\GuibiFx.exe
  2⤵
  PID:12792
- C:\Windows\System\RFrzZAk.exe
  C:\Windows\System\RFrzZAk.exe
  2⤵
  PID:12808
- C:\Windows\System\JGRrnTM.exe
  C:\Windows\System\JGRrnTM.exe
  2⤵
  PID:12844
- C:\Windows\System\YtijvSW.exe
  C:\Windows\System\YtijvSW.exe
  2⤵
  PID:12864
- C:\Windows\System\pFetSGZ.exe
  C:\Windows\System\pFetSGZ.exe
  2⤵
  PID:12888
- C:\Windows\System\Ncuumls.exe
  C:\Windows\System\Ncuumls.exe
  2⤵
  PID:12920
- C:\Windows\System\nBsDXCQ.exe
  C:\Windows\System\nBsDXCQ.exe
  2⤵
  PID:12936
- C:\Windows\System\lVYZNYh.exe
  C:\Windows\System\lVYZNYh.exe
  2⤵
  PID:12976
- C:\Windows\System\bCQEFJP.exe
  C:\Windows\System\bCQEFJP.exe
  2⤵
  PID:13004
- C:\Windows\System\UubgwIv.exe
  C:\Windows\System\UubgwIv.exe
  2⤵
  PID:13032
- C:\Windows\System\qlVBQtc.exe
  C:\Windows\System\qlVBQtc.exe
  2⤵
  PID:13060
- C:\Windows\System\pryNKsH.exe
  C:\Windows\System\pryNKsH.exe
  2⤵
  PID:13092
- C:\Windows\System\IcshyeZ.exe
  C:\Windows\System\IcshyeZ.exe
  2⤵
  PID:13128
- C:\Windows\System\BxViGHj.exe
  C:\Windows\System\BxViGHj.exe
  2⤵
  PID:13144
- C:\Windows\System\hiEGxZB.exe
  C:\Windows\System\hiEGxZB.exe
  2⤵
  PID:13180
- C:\Windows\System\ySfmpEM.exe
  C:\Windows\System\ySfmpEM.exe
  2⤵
  PID:13208
- C:\Windows\System\ZSnVSUf.exe
  C:\Windows\System\ZSnVSUf.exe
  2⤵
  PID:13240
- C:\Windows\System\TIkCXyv.exe
  C:\Windows\System\TIkCXyv.exe
  2⤵
  PID:13268
- C:\Windows\System\MAAXTEW.exe
  C:\Windows\System\MAAXTEW.exe
  2⤵
  PID:13288
- C:\Windows\System\VgQPgVk.exe
  C:\Windows\System\VgQPgVk.exe
  2⤵
  PID:12236
- C:\Windows\System\BKsonJm.exe
  C:\Windows\System\BKsonJm.exe
  2⤵
  PID:12320
- C:\Windows\System\VyxIQpV.exe
  C:\Windows\System\VyxIQpV.exe
  2⤵
  PID:12360
- C:\Windows\System\YEmdDZy.exe
  C:\Windows\System\YEmdDZy.exe
  2⤵
  PID:12408
- C:\Windows\System\Bdfwdgy.exe
  C:\Windows\System\Bdfwdgy.exe
  2⤵
  PID:12500
- C:\Windows\System\EEvUyQW.exe
  C:\Windows\System\EEvUyQW.exe
  2⤵
  PID:12596
- C:\Windows\System\zGhaEDs.exe
  C:\Windows\System\zGhaEDs.exe
  2⤵
  PID:12648
- C:\Windows\System\qjewUBn.exe
  C:\Windows\System\qjewUBn.exe
  2⤵
  PID:12712
- C:\Windows\System\czFIaHL.exe
  C:\Windows\System\czFIaHL.exe
  2⤵
  PID:12768
- C:\Windows\System\wFLjWTC.exe
  C:\Windows\System\wFLjWTC.exe
  2⤵
  PID:12852
- C:\Windows\System\kAlPbHV.exe
  C:\Windows\System\kAlPbHV.exe
  2⤵
  PID:12880
- C:\Windows\System\GeRvARi.exe
  C:\Windows\System\GeRvARi.exe
  2⤵
  PID:12964
- C:\Windows\System\yqiHTqT.exe
  C:\Windows\System\yqiHTqT.exe
  2⤵
  PID:13024
- C:\Windows\System\lbhyuob.exe
  C:\Windows\System\lbhyuob.exe
  2⤵
  PID:13088
- C:\Windows\System\mtDlsIn.exe
  C:\Windows\System\mtDlsIn.exe
  2⤵
  PID:13168
- C:\Windows\System\uBFacrV.exe
  C:\Windows\System\uBFacrV.exe
  2⤵
  PID:13252
- C:\Windows\System\XzUzarc.exe
  C:\Windows\System\XzUzarc.exe
  2⤵
  PID:13296
- C:\Windows\System\tBsliYZ.exe
  C:\Windows\System\tBsliYZ.exe
  2⤵
  PID:12312
- C:\Windows\System\XAIQxWv.exe
  C:\Windows\System\XAIQxWv.exe
  2⤵
  PID:12476
- C:\Windows\System\ECqqbAf.exe
  C:\Windows\System\ECqqbAf.exe
  2⤵
  PID:12632
- C:\Windows\System\yBErDef.exe
  C:\Windows\System\yBErDef.exe
  2⤵
  PID:12828
- C:\Windows\System\UlorFqF.exe
  C:\Windows\System\UlorFqF.exe
  2⤵
  PID:12932
- C:\Windows\System\OOXgYPm.exe
  C:\Windows\System\OOXgYPm.exe
  2⤵
  PID:13048
- C:\Windows\System\nancWiE.exe
  C:\Windows\System\nancWiE.exe
  2⤵
  PID:13156
- C:\Windows\System\LayLpPL.exe
  C:\Windows\System\LayLpPL.exe
  2⤵
  PID:13308
- C:\Windows\System\XibwytK.exe
  C:\Windows\System\XibwytK.exe
  2⤵
  PID:12608
- C:\Windows\System\ZlfiiNS.exe
  C:\Windows\System\ZlfiiNS.exe
  2⤵
  PID:12916
- C:\Windows\System\qcDRjyE.exe
  C:\Windows\System\qcDRjyE.exe
  2⤵
  PID:12996
- C:\Windows\System\DBRXwUB.exe
  C:\Windows\System\DBRXwUB.exe
  2⤵
  PID:12716
- C:\Windows\System\rwMoKPF.exe
  C:\Windows\System\rwMoKPF.exe
  2⤵
  PID:13316
- C:\Windows\System\ZRstbGL.exe
  C:\Windows\System\ZRstbGL.exe
  2⤵
  PID:13344
- C:\Windows\System\jhmaCxI.exe
  C:\Windows\System\jhmaCxI.exe
  2⤵
  PID:13372
- C:\Windows\System\OFphRMs.exe
  C:\Windows\System\OFphRMs.exe
  2⤵
  PID:13404
- C:\Windows\System\VoljMZf.exe
  C:\Windows\System\VoljMZf.exe
  2⤵
  PID:13440
- C:\Windows\System\pxrUtIL.exe
  C:\Windows\System\pxrUtIL.exe
  2⤵
  PID:13460
- C:\Windows\System\bFfoJHN.exe
  C:\Windows\System\bFfoJHN.exe
  2⤵
  PID:13496
- C:\Windows\System\mwCOGYR.exe
  C:\Windows\System\mwCOGYR.exe
  2⤵
  PID:13524
- C:\Windows\System\huRpPMc.exe
  C:\Windows\System\huRpPMc.exe
  2⤵
  PID:13552
- C:\Windows\System\qRFvYgF.exe
  C:\Windows\System\qRFvYgF.exe
  2⤵
  PID:13580
- C:\Windows\System\mQRILZG.exe
  C:\Windows\System\mQRILZG.exe
  2⤵
  PID:13596
- C:\Windows\System\fOkZGig.exe
  C:\Windows\System\fOkZGig.exe
  2⤵
  PID:13636
- C:\Windows\System\SZLZYQP.exe
  C:\Windows\System\SZLZYQP.exe
  2⤵
  PID:13664
- C:\Windows\System\FHimbMh.exe
  C:\Windows\System\FHimbMh.exe
  2⤵
  PID:13680
- C:\Windows\System\CcolRdD.exe
  C:\Windows\System\CcolRdD.exe
  2⤵
  PID:13716
- C:\Windows\System\ATXIuXD.exe
  C:\Windows\System\ATXIuXD.exe
  2⤵
  PID:13744
- C:\Windows\System\gHNmDge.exe
  C:\Windows\System\gHNmDge.exe
  2⤵
  PID:13776
- C:\Windows\System\FXMylAO.exe
  C:\Windows\System\FXMylAO.exe
  2⤵
  PID:13816
- C:\Windows\System\WPYnAIS.exe
  C:\Windows\System\WPYnAIS.exe
  2⤵
  PID:13832
- C:\Windows\System\JSLzfHc.exe
  C:\Windows\System\JSLzfHc.exe
  2⤵
  PID:13860
- C:\Windows\System\dCuwPhA.exe
  C:\Windows\System\dCuwPhA.exe
  2⤵
  PID:13888
- C:\Windows\System\ZjKDJAD.exe
  C:\Windows\System\ZjKDJAD.exe
  2⤵
  PID:13908
- C:\Windows\System\LHgohpG.exe
  C:\Windows\System\LHgohpG.exe
  2⤵
  PID:13924
- C:\Windows\System\ADYAusK.exe
  C:\Windows\System\ADYAusK.exe
  2⤵
  PID:13964
- C:\Windows\System\ansocHz.exe
  C:\Windows\System\ansocHz.exe
  2⤵
  PID:13992
- C:\Windows\System\GoYZKai.exe
  C:\Windows\System\GoYZKai.exe
  2⤵
  PID:14028
- C:\Windows\System\XdKIudm.exe
  C:\Windows\System\XdKIudm.exe
  2⤵
  PID:14060
- C:\Windows\System\WBXuqAY.exe
  C:\Windows\System\WBXuqAY.exe
  2⤵
  PID:14088
- C:\Windows\System\ANhaIok.exe
  C:\Windows\System\ANhaIok.exe
  2⤵
  PID:14116
- C:\Windows\System\PZuVcmK.exe
  C:\Windows\System\PZuVcmK.exe
  2⤵
  PID:14144
- C:\Windows\System\EpNidoL.exe
  C:\Windows\System\EpNidoL.exe
  2⤵
  PID:14176
- C:\Windows\System\FDhvnGm.exe
  C:\Windows\System\FDhvnGm.exe
  2⤵
  PID:14196
- C:\Windows\System\caPuthx.exe
  C:\Windows\System\caPuthx.exe
  2⤵
  PID:14232
- C:\Windows\System\tFiSmLG.exe
  C:\Windows\System\tFiSmLG.exe
  2⤵
  PID:14256
- C:\Windows\System\XPgICWC.exe
  C:\Windows\System\XPgICWC.exe
  2⤵
  PID:14280
- C:\Windows\System\QxGUeEI.exe
  C:\Windows\System\QxGUeEI.exe
  2⤵
  PID:14316
- C:\Windows\System\Clnbahu.exe
  C:\Windows\System\Clnbahu.exe
  2⤵
  PID:13044
- C:\Windows\System\DByjljG.exe
  C:\Windows\System\DByjljG.exe
  2⤵
  PID:13360
- C:\Windows\System\tVWACho.exe
  C:\Windows\System\tVWACho.exe
  2⤵
  PID:13432
- C:\Windows\System\JbSuvCz.exe
  C:\Windows\System\JbSuvCz.exe
  2⤵
  PID:13512
- C:\Windows\System\ZtdbkJx.exe
  C:\Windows\System\ZtdbkJx.exe
  2⤵
  PID:13572
- C:\Windows\System\kDYZVzB.exe
  C:\Windows\System\kDYZVzB.exe
  2⤵
  PID:13624
- C:\Windows\System\Jpzjvlm.exe
  C:\Windows\System\Jpzjvlm.exe
  2⤵
  PID:13708
- C:\Windows\System\tTNOihk.exe
  C:\Windows\System\tTNOihk.exe
  2⤵
  PID:13764
- C:\Windows\System\WARNqWD.exe
  C:\Windows\System\WARNqWD.exe
  2⤵
  PID:13792
- C:\Windows\System\xphhEBL.exe
  C:\Windows\System\xphhEBL.exe
  2⤵
  PID:13856
- C:\Windows\System\lDpeokr.exe
  C:\Windows\System\lDpeokr.exe
  2⤵
  PID:13884
- C:\Windows\System\xbmyQOI.exe
  C:\Windows\System\xbmyQOI.exe
  2⤵
  PID:13952
- C:\Windows\System\rKgvyOB.exe
  C:\Windows\System\rKgvyOB.exe
  2⤵
  PID:14076
- C:\Windows\System\cCZHfsx.exe
  C:\Windows\System\cCZHfsx.exe
  2⤵
  PID:14104
- C:\Windows\System\xRIyQgx.exe
  C:\Windows\System\xRIyQgx.exe
  2⤵
  PID:14184
- C:\Windows\System\JSgFPiz.exe
  C:\Windows\System\JSgFPiz.exe
  2⤵
  PID:14244
- C:\Windows\System\UrOVpBX.exe
  C:\Windows\System\UrOVpBX.exe
  2⤵
  PID:14276
- C:\Windows\System\ElHLmAH.exe
  C:\Windows\System\ElHLmAH.exe
  2⤵
  PID:13384
- C:\Windows\System\QUzokbK.exe
  C:\Windows\System\QUzokbK.exe
  2⤵
  PID:13508
- C:\Windows\System\jlYVDZa.exe
  C:\Windows\System\jlYVDZa.exe
  2⤵
  PID:13692
- C:\Windows\System\JVBmRdb.exe
  C:\Windows\System\JVBmRdb.exe
  2⤵
  PID:13788
- C:\Windows\System\ncuTbLc.exe
  C:\Windows\System\ncuTbLc.exe
  2⤵
  PID:13948
- C:\Windows\System\MrOQUci.exe
  C:\Windows\System\MrOQUci.exe
  2⤵
  PID:14084
- C:\Windows\System\HDgXJHe.exe
  C:\Windows\System\HDgXJHe.exe
  2⤵
  PID:14192
- C:\Windows\System\ploYvjL.exe
  C:\Windows\System\ploYvjL.exe
  2⤵
  PID:13424
- C:\Windows\System\TBOtzxg.exe
  C:\Windows\System\TBOtzxg.exe
  2⤵
  PID:13916
- C:\Windows\System\Gogzhjq.exe
  C:\Windows\System\Gogzhjq.exe
  2⤵
  PID:14164
- C:\Windows\System\bmJaOUr.exe
  C:\Windows\System\bmJaOUr.exe
  2⤵
  PID:13740
- C:\Windows\System\HinjTjI.exe
  C:\Windows\System\HinjTjI.exe
  2⤵
  PID:14348
- C:\Windows\System\BwLkUuH.exe
  C:\Windows\System\BwLkUuH.exe
  2⤵
  PID:14368
- C:\Windows\System\oHqyojp.exe
  C:\Windows\System\oHqyojp.exe
  2⤵
  PID:14412
- C:\Windows\System\FUjskZQ.exe
  C:\Windows\System\FUjskZQ.exe
  2⤵
  PID:14432
- C:\Windows\System\JnPDrOm.exe
  C:\Windows\System\JnPDrOm.exe
  2⤵
  PID:14460
- C:\Windows\System\NSkyHjB.exe
  C:\Windows\System\NSkyHjB.exe
  2⤵
  PID:14556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DbObzqe.exe

Filesize
2.6MB

MD5
1beb5d54d356f3b9131eab4bd2423252

SHA1
c4a2fe1d60de5ed4918a6ddd8e88c1c63ac8aa95

SHA256
7c8eb1523a3154fc5b9f35bd3f5811eae8035a73dbdcd4cf3f055f2b7d60e867

SHA512
93d7f2daa88d8beb5167cf681d70138143b94265204a8f439b3cb264166d6583a357b8df1e050b3eece163c30e421176941efa15016d23a7b3196be6832d635d

Download Submit
C:\Windows\System\DguvaIs.exe

Filesize
2.6MB

MD5
5967d812955b1104e7535a312139704a

SHA1
928ad7be3174f9e10a012c6bca30c162fdf66e8b

SHA256
fdf22c663ef69bccb69bc98ce83ecf4299c023a853cfc21bcfd71dc2c8a62136

SHA512
9b84f8c247e13cf9157366462b942f317f599c7390b02aff20043b1e9265ec1489bf4249c1f888712d6b3bdabcba0ed2b04a27194dfe22b1c4b6213d2c8b4dfa

Download Submit
C:\Windows\System\FHRRVkV.exe

Filesize
2.6MB

MD5
17a097551a71883da1d3c0caaea81cdf

SHA1
c9e7270fb78e5ed5865d8b639acd468f710a1560

SHA256
976ef424be7c3b0ce91cb449424cc7c7754874510322a67b519b2ba8c02cac3e

SHA512
ab87eb6a60097cbd1baef4a768bfc7973072ea2309d3344fbd062405d2863de9cae6714ea330a1b1c69b9cf3ea1df480b7b4d61fa22ed54fea0e090643e15c02

Download Submit
C:\Windows\System\FvIQOms.exe

Filesize
2.6MB

MD5
1c3a7f3d0d72faa7e8e94259b3c2a119

SHA1
328c6a1d20aeb6583de80b072be94ee1353c11c5

SHA256
a1a35b112a46a64a21e1e214da79a3081bb95cd24061ad2069635afde6979503

SHA512
8fd6b33b503a55290bdea90636c74543ce76d382578194af96d5b9d471064cefd63e50ce28805f445eaea33ed27e5018c413a4a54dd8ea495ef14d723916e1d4

Download Submit
C:\Windows\System\IYpOnYH.exe

Filesize
2.6MB

MD5
5cf95926e8b78820d8d5af7028e68ab1

SHA1
fe33615fab85d519d834023b913beea27c7fc827

SHA256
38d92016de8bec4fc2e1859e2ec3efc67b98f0a989d6fa484fc683e4070c9d01

SHA512
9f85cb61ec7e522337ef3fdec358c84ae33846e52aaab90ce59765146dce1f5b50afe12f2ccaa28385940d7760f80d562e430d4cdebb0b59c2768110aa8dc74c

Download Submit
C:\Windows\System\JhXEJzc.exe

Filesize
2.6MB

MD5
67d40319523031ce9d7c2ed1a6b6dba1

SHA1
c66fde364a5d8110a2d7f61854ac6b78e9553816

SHA256
41cb96d66302f8aa2053b75ff0914aa6765c1c664374cfce5872eee3a4253a66

SHA512
389ab7c42655d0a4e3754c624d9f1c556919640b6d78c91a7e9de003387d25b802a129a165546b873bf51c58b6d679412378ed1d72be617d75499f8ba20a3ed6

Download Submit
C:\Windows\System\LwVNSjR.exe

Filesize
2.6MB

MD5
161c55a668eb20341abdaa8a246ac9c2

SHA1
e4a91f35d976d91085b2a5c564c447cef41cf26f

SHA256
a1e2db59ef9845b58c04b068610f130795cf7f16ccc926e38e6921e4fdc66dd4

SHA512
a69374021f2ddf7c7925ac7a318c8bb3e686ef14fe8def267418307fd44d4f9b4a92f6f3bccbbab92523e740e3717d6c0ffa6a33114cf5b1d562ed1cc922360b

Download Submit
C:\Windows\System\MsvTFEY.exe

Filesize
2.6MB

MD5
e85f4f011862589928fe17b7158321aa

SHA1
a78fecbabc6356270d4f11513f33bd158e52b143

SHA256
f68c7780e460ce60fef2eca8f84ef95b7641c9608aedf5cd3dd08fbcfbb4cfd0

SHA512
006f0c90d2b0b821752ac8827945a947438430866d862645a7891a2382ccbaebed4bfecc57e5f3671da7c9bfa4fa323fd2e7617601678f0345af0e3f6dc7f559

Download Submit
C:\Windows\System\Njaupvq.exe

Filesize
2.6MB

MD5
c72ea5fde08d9b3a0e770089475feeb5

SHA1
082de24bebc1c4cd8199b3875f190687423721ab

SHA256
0a9e5762163d0f59939b5fb5d2a992a14ec940bd758916c327d1a99851147070

SHA512
81541649cd853b28efbdb8546f14ddad5c164faa622fd5673892cc7383962334b86f8beca3955d679f91cacd9a3c0e3c8c16a91370541a663b1b248555aa7e8e

Download Submit
C:\Windows\System\TCsLjib.exe

Filesize
2.6MB

MD5
04608f9d033b98e888f9c57a69ab9f5a

SHA1
5d77978bcb472439d753fe9b65134236cb1fa461

SHA256
9500205e31b57c2838af0a9c5950eec8fd0a1d28c5af95f730f72152284a67ec

SHA512
4c7c3a7f071c6391fe0b58e312b1406e5c1f1f2372db5bba9e3d0c3b777ecd6edf38dc196287ee126775c0209740ead64cb3375a649f9ac830ff24f8fffc5da2

Download Submit
C:\Windows\System\UguWKmP.exe

Filesize
2.6MB

MD5
f5a0b572cf642384294b4f56aa0d4552

SHA1
245f27f629eaa7591b8e5f127a79f356979eb785

SHA256
889fddb9a7b6f9ba02a9b7953ec51ad1ff5aec762095af3ae8698ec2b4f5fc40

SHA512
76c02b065db15392e6f586998e07ed0ef4eed5893b822aeab739ac741b1d475d03bc9104c0e8def05d7475c3bbd608145122f890494f81fd5b28efb948187da3

Download Submit
C:\Windows\System\XgbcruO.exe

Filesize
2.6MB

MD5
7da04f2657b6dba8b907185e435b4e7e

SHA1
6e7721cb435febc9166ee7069e6897584a3d0410

SHA256
4fe63ca245b2c414eccbf2654341f37687a92798e0e1899ba7fac98a2905cf17

SHA512
df4d713454d0bde92004763b8e1f2e24297d33f3bfb63e68bd1a80f79556bd472c8987cbaa0337c9b1c853d7fa74b77295ee0b9e912f7d7249741675e12d997b

Download Submit
C:\Windows\System\YybYWly.exe

Filesize
2.6MB

MD5
9e6a13714c6b2556a8054b1ad9183151

SHA1
f520492a5ac35f14d38f242b8fdf92fa23bd1cf9

SHA256
b52a674113164de8dc0e5ae8fc9b9061dcec2c2432e06f15ffbaf6e56ba5db36

SHA512
b25d5e17491feabe744138608cfc1428b8e6b80bb0a6e8b0aa25173a0ccda6e1b33ea87fbe9b01f09075b72e46a95a85fdbf79009a13633b52db648615f405e4

Download Submit
C:\Windows\System\ZAYPpqf.exe

Filesize
2.6MB

MD5
f9fd313cb42d8b0af710aadc7c3e9610

SHA1
cca0b71b8b93d241b63cf9eb0ee546ea15802d9a

SHA256
77ad5443fe6328eaac5d2c8ab167be04f5787d7f36a6afbd6d296b8f36b0279e

SHA512
d2515731c8812dd039e36f0190e6ecc2a6a3aa97fa1f39bd3d5bc0591b65108ccd2b71df99803c62e4d94b8a2ec7db6d1ab94ca0be6d4f12b78296bc10accf2c

Download Submit
C:\Windows\System\ZUZymMY.exe

Filesize
2.6MB

MD5
e7ab8e17cf615f227e944ea500e71fb0

SHA1
0efe7004450f55f16695ef5827ee7c83364904a0

SHA256
9990201207bdfab096943acd7578145784599b361b8dbd39647d75c413ae66fd

SHA512
a3bf5e32f09b4c8bc08b4dac82deaf97db883f880fb440e8557bfde1b48cd277f8abdf1763e211c24b1f7e5594ba4d0ac3e617dd5ddde87fb596e981a0647e0c

Download Submit
C:\Windows\System\ZVbTapO.exe

Filesize
2.6MB

MD5
da6c5ae68ececc169f980f60e97685fe

SHA1
3f9300476eff6035102a536a282fe2be1d2961df

SHA256
dec0acb7651ef42af666b52280f0508f6afa93ec02d697922cd38ae29906b280

SHA512
1d8ec03e2b08d618acadc71e819bb89066779e5b3837b9b890a8d46107d6fe4ab91cc165e2049e36975879c1cdd678f3b008e868311bd4632832a799992521e2

Download Submit
C:\Windows\System\bSmcveV.exe

Filesize
2.6MB

MD5
5a4a0a5fddb0c46e9358037bdd53bbae

SHA1
b2d63fdcd98c8ccd4b1ee8e1593c11727ef68add

SHA256
8b7a1ba805453f2b0ccf2709382acaf91bc5ef1d1f128e1f0982e5848121a308

SHA512
91653b96b27a3a196feeea3b0c9ed03723f735249dae27696691fa1ebc058e8e83ec3fb3d8117ff3c3f0c23952bcf53ab70a3126fe5a77b0e86fd55698cde134

Download Submit
C:\Windows\System\bWzHCVw.exe

Filesize
2.6MB

MD5
0185bea0ebadaac12bee7c976077ed48

SHA1
64a832a42c7cb3fed7a78556e331ca6241deebe5

SHA256
d09bb834fdc81ccbc475067aa81a475cbcba25d9e7ee6561672b10d243b5365d

SHA512
ac9b9fe150e4c76f218736ef9abf235c86dc53ddf1d3634f400eca5d300c1f0bc793608ff23937be56c9a0a0a8324b207ae1013cbf0c0f6b293fc499a09e488e

Download Submit
C:\Windows\System\ckXuhmd.exe

Filesize
2.6MB

MD5
35963c047d7394dc9c938248ff560eb9

SHA1
5078c9f1ce1a31ab66e4bbbd871cae3ff53272c1

SHA256
45568122191d47758de0b7c64f5e0d75e1c90dfa73020c6b1811a81c58dd7b53

SHA512
47d6eda9025b0f8132a81998b8844ed82186c9a545c5fa5f59a21c12402eea54c52b807b3982f53567e254923be9846bc1c0f8f190dd6a41a49190aba3f0aa3e

Download Submit
C:\Windows\System\dSjYaXg.exe

Filesize
2.6MB

MD5
54847ab6448f4ce22d5cca98dc1b725b

SHA1
c01f9521e54991b09cd913a1d5b867510fbb051c

SHA256
f70b7bf0f391201d507caea22279262518d38ee2438216ac0dbee4f3e430d7d1

SHA512
c2b2b485b291293ef32e46073cfd1c4f91969c04c8af659c21a543a479e3efbad8d2c7592f0e1d1769f56d6b2903f6e55140aba25d5de95ce96565c5042d7141

Download Submit
C:\Windows\System\dpYugSn.exe

Filesize
2.6MB

MD5
e151badb113b5f5973f6d34c673d187b

SHA1
309981f0fe8a2ac00e030cfef35ba67b4d6cdeaf

SHA256
bf8e931ec7f9174b2ea1fd115bb5e66997a117b0d24661af4a7805fc48d5b38b

SHA512
790cd65ee228c1a32e4e722649aa5ede84b2ed3c80885f77de65fbd2809312633083a79857f1377233de0468b93225321aabfeb3e5e70e57aea1e80e91d39019

Download Submit
C:\Windows\System\fwCbtBC.exe

Filesize
2.6MB

MD5
f1a8d1a9939670d55f1218b17f2a1ddf

SHA1
02962a27cf1edb1716b37c988ed92c5242725295

SHA256
888c2aefa83ac30f50c694f11979c91e3519f2c01fe9009f63464b5121dbe1b8

SHA512
d76bb7e4c16c560bf1cb9b975312f0d0081afc229f4ab4d5ae279666bb1ab1c6828fe0df3b1bba3ca6036c46dd756a5f52318e5d1e2f8e46008d870bede3d19e

Download Submit
C:\Windows\System\gJojUJd.exe

Filesize
2.6MB

MD5
9471006e5889ca967c00e7e7d0ed6cb7

SHA1
e5dad89a0ed25cfd100c77cb293f6b3988f72f91

SHA256
b81b9cd75c27b5d5ece7ac4d0740fa805ed0a410abea661e6d4a742963a674f9

SHA512
f483ce0c97b80da292e142a152fa3027c95cdc69e5727eaa40a908b6300ccda907722f8ff40a1a3dfce061a8a90230b5f8931b1bf8e56c37b94e5576aaec9f93

Download Submit
C:\Windows\System\lUAaEIh.exe

Filesize
2.6MB

MD5
d17cf20cb43db8e2c21b6be5ed9d2ba7

SHA1
c3e71878650ad9de74ea2c25a6e513e999f177d3

SHA256
ac8fa937fb7d4783b647768615ff9b1f5d3225f7eda4072596380474a15ebbed

SHA512
d175bbea467a8b4cf085e8ce1b74f67dd03c85ec766162c672adbf35ff4a44497edad9261ddbaf7628a8a11d0561c029e50c4965e8f1954994a8a192dfc831ce

Download Submit
C:\Windows\System\lcZJSZz.exe

Filesize
2.6MB

MD5
7468373bb2c4352163e34b4c3932c6d0

SHA1
964af36b4702d1b5f54168343b1a3e882b551aa7

SHA256
fc8f7c03f214dd63988d58e63966660ef4b0be7f696b2f7c60058fbb94eccb88

SHA512
f1a20d97b3b53693540f58746a9c7924e0c364b2e0fd42ef7151d2d5ef397e4587a26688ce497fda2f6154a9cb37fca26db76e651fac38ae7468c504f6fa0705

Download Submit
C:\Windows\System\mSOCzaR.exe

Filesize
2.6MB

MD5
3e2bcbb1dddc2ec6ca302cecd16e1b18

SHA1
5c01542096c25d95eac1b86070a94e0805a12c43

SHA256
9949212d7b90e81d07a56c98afebbd97975bc94f259b7296eff69421b16603bb

SHA512
9fc3f5ba15a66dc6279543bcbbe9b98314f5be0865cb0097f0179d909238c9dbc7c4adf4f2b517edbcb5f954fae6eda941cb681b88d6c5247952f0848a8442af

Download Submit
C:\Windows\System\mhLWUoz.exe

Filesize
2.6MB

MD5
d879a2e46c6d370be84a6518738b4404

SHA1
289a68c4d5023e9ac72c731ff99b1dbd6533645d

SHA256
19b7ad7cc2a2d4cdb08252822564856a3df4d9c7c790f12cc651a724e1d328d1

SHA512
688f2dc224f750c807c3655c26f339275fec59aa94bb678234f644462d2465588eb690856a997e0be37fe097023c658eda75659aa262f8dc36d4d65892e7cb7a

Download Submit
C:\Windows\System\nftPAgM.exe

Filesize
2.6MB

MD5
f8f2bd834e27771e13aee122642e89ef

SHA1
55eb026a11347e90f333f61cfe78d756b6785785

SHA256
434b8a59e2a797647951e8544aaa644b9a7e82c56de81f321a397384f43ee1c5

SHA512
b754dfc46d45401840ddac847e945a4f445e03b1f47d7e70189e7912931da8ee6bdb2102cb25a0fd072f309ef4862d7b5a69181162288eca74343f4e961bf11a

Download Submit
C:\Windows\System\oYqTjCE.exe

Filesize
2.6MB

MD5
71b659c85c34c5a2f3c8a5753d8c1a22

SHA1
14dbb5af770ceecf0fa5f70dc72300de37d76d9a

SHA256
2afb528fb57766399fe2a4d36a074f092b7125e8b1f7d4572a299303a1040457

SHA512
2a2dcfd8552e9c842b03370c0420f2643a37353cbd3af04047c50e6e529ad13ddbe89dbfd797166573f9e71c759c862a5d45508c311cb4f2c433d80261f968c2

Download Submit
C:\Windows\System\ovsrbqv.exe

Filesize
2.6MB

MD5
a42e850877d365e82c9d7a926bea9458

SHA1
990e02e263fbf2debb39628a4917ed439af023b4

SHA256
b4afc508e220492071cbb2931f9b44fca64d79efccc5c843c31d428cfd0ede88

SHA512
a8fa1f7afb7073059be9f1f831a213df81dc9c0f44fcdbd854ef89823de6f69e253550c904449d357791aceabec76cd605e0627e479d3752ec874b77f60a5d32

Download Submit
C:\Windows\System\tROXyhG.exe

Filesize
2.6MB

MD5
f612a19f071c1e275787196ba679fff5

SHA1
8c892457168b9abb803c5fdacc0e4199558d82e8

SHA256
5e112f2ead841420d1eab848f0d316036cf43ad845913c78575fa94571adec6e

SHA512
c780e6693da7de8d3a15a054def5e21959d0e49f5f22d9d6694548e18db342d0db0e06ee3d06c093b0a68468447c5d1d351d65a9ccc724750b21c4bef535d2e4

Download Submit
C:\Windows\System\wthhyrt.exe

Filesize
2.6MB

MD5
9401e3c6edc6153924ba0eba9676fa4a

SHA1
fbe39398cef42f1c0d78db331f0abfd6f9f07136

SHA256
64e87675d5464d1572d91e89298355355e057432c7630a59c3ee207fea411b22

SHA512
ae864b6a99032af6eb606bbf7b1d66971e13eaf6f4144a9dc7943335a16d97e8ec24939e5bdc51b532a6ba388802fb72c6403ddf0f9a3ceffe626363ced266b6

Download Submit
memory/396-2119-0x00007FF7CAB10000-0x00007FF7CAE64000-memory.dmp

Filesize
3.3MB

Download
memory/396-79-0x00007FF7CAB10000-0x00007FF7CAE64000-memory.dmp

Filesize
3.3MB

Download
memory/396-2128-0x00007FF7CAB10000-0x00007FF7CAE64000-memory.dmp

Filesize
3.3MB

Download
memory/440-2136-0x00007FF6DB670000-0x00007FF6DB9C4000-memory.dmp

Filesize
3.3MB

Download
memory/440-178-0x00007FF6DB670000-0x00007FF6DB9C4000-memory.dmp

Filesize
3.3MB

Download
memory/636-2131-0x00007FF6F6D30000-0x00007FF6F7084000-memory.dmp

Filesize
3.3MB

Download
memory/636-132-0x00007FF6F6D30000-0x00007FF6F7084000-memory.dmp

Filesize
3.3MB

Download
memory/1124-2123-0x00007FF6ECB20000-0x00007FF6ECE74000-memory.dmp

Filesize
3.3MB

Download
memory/1124-173-0x00007FF6ECB20000-0x00007FF6ECE74000-memory.dmp

Filesize
3.3MB

Download
memory/1184-134-0x00007FF739CC0000-0x00007FF73A014000-memory.dmp

Filesize
3.3MB

Download
memory/1184-2135-0x00007FF739CC0000-0x00007FF73A014000-memory.dmp

Filesize
3.3MB

Download
memory/1536-180-0x00007FF7E6BE0000-0x00007FF7E6F34000-memory.dmp

Filesize
3.3MB

Download
memory/1536-2140-0x00007FF7E6BE0000-0x00007FF7E6F34000-memory.dmp

Filesize
3.3MB

Download
memory/1540-2141-0x00007FF7B77A0000-0x00007FF7B7AF4000-memory.dmp

Filesize
3.3MB

Download
memory/1540-168-0x00007FF7B77A0000-0x00007FF7B7AF4000-memory.dmp

Filesize
3.3MB

Download
memory/1644-2117-0x00007FF7C8D60000-0x00007FF7C90B4000-memory.dmp

Filesize
3.3MB

Download
memory/1644-2124-0x00007FF7C8D60000-0x00007FF7C90B4000-memory.dmp

Filesize
3.3MB

Download
memory/1644-54-0x00007FF7C8D60000-0x00007FF7C90B4000-memory.dmp

Filesize
3.3MB

Download
memory/1904-2127-0x00007FF6001F0000-0x00007FF600544000-memory.dmp

Filesize
3.3MB

Download
memory/1904-174-0x00007FF6001F0000-0x00007FF600544000-memory.dmp

Filesize
3.3MB

Download
memory/2072-175-0x00007FF62ECF0000-0x00007FF62F044000-memory.dmp

Filesize
3.3MB

Download
memory/2072-2129-0x00007FF62ECF0000-0x00007FF62F044000-memory.dmp

Filesize
3.3MB

Download
memory/2324-167-0x00007FF757790000-0x00007FF757AE4000-memory.dmp

Filesize
3.3MB

Download
memory/2324-2142-0x00007FF757790000-0x00007FF757AE4000-memory.dmp

Filesize
3.3MB

Download
memory/2396-2148-0x00007FF6998E0000-0x00007FF699C34000-memory.dmp

Filesize
3.3MB

Download
memory/2396-171-0x00007FF6998E0000-0x00007FF699C34000-memory.dmp

Filesize
3.3MB

Download
memory/2700-2125-0x00007FF739F10000-0x00007FF73A264000-memory.dmp

Filesize
3.3MB

Download
memory/2700-56-0x00007FF739F10000-0x00007FF73A264000-memory.dmp

Filesize
3.3MB

Download
memory/2700-2118-0x00007FF739F10000-0x00007FF73A264000-memory.dmp

Filesize
3.3MB

Download
memory/2724-2144-0x00007FF671E20000-0x00007FF672174000-memory.dmp

Filesize
3.3MB

Download
memory/2724-157-0x00007FF671E20000-0x00007FF672174000-memory.dmp

Filesize
3.3MB

Download
memory/2816-2145-0x00007FF754F60000-0x00007FF7552B4000-memory.dmp

Filesize
3.3MB

Download
memory/2816-148-0x00007FF754F60000-0x00007FF7552B4000-memory.dmp

Filesize
3.3MB

Download
memory/2824-70-0x00007FF780010000-0x00007FF780364000-memory.dmp

Filesize
3.3MB

Download
memory/2824-2126-0x00007FF780010000-0x00007FF780364000-memory.dmp

Filesize
3.3MB

Download
memory/3320-158-0x00007FF6B68E0000-0x00007FF6B6C34000-memory.dmp

Filesize
3.3MB

Download
memory/3320-2143-0x00007FF6B68E0000-0x00007FF6B6C34000-memory.dmp

Filesize
3.3MB

Download
memory/3432-119-0x00007FF7D44E0000-0x00007FF7D4834000-memory.dmp

Filesize
3.3MB

Download
memory/3432-2132-0x00007FF7D44E0000-0x00007FF7D4834000-memory.dmp

Filesize
3.3MB

Download
memory/3516-0-0x00007FF66EE80000-0x00007FF66F1D4000-memory.dmp

Filesize
3.3MB

Download
memory/3516-1-0x000001321AD00000-0x000001321AD10000-memory.dmp

Filesize
64KB

Download
memory/3536-2138-0x00007FF7774E0000-0x00007FF777834000-memory.dmp

Filesize
3.3MB

Download
memory/3536-170-0x00007FF7774E0000-0x00007FF777834000-memory.dmp

Filesize
3.3MB

Download
memory/3612-2120-0x00007FF788B40000-0x00007FF788E94000-memory.dmp

Filesize
3.3MB

Download
memory/3612-19-0x00007FF788B40000-0x00007FF788E94000-memory.dmp

Filesize
3.3MB

Download
memory/3640-104-0x00007FF613DD0000-0x00007FF614124000-memory.dmp

Filesize
3.3MB

Download
memory/3640-2130-0x00007FF613DD0000-0x00007FF614124000-memory.dmp

Filesize
3.3MB

Download
memory/3704-2121-0x00007FF760640000-0x00007FF760994000-memory.dmp

Filesize
3.3MB

Download
memory/3704-28-0x00007FF760640000-0x00007FF760994000-memory.dmp

Filesize
3.3MB

Download
memory/3704-2116-0x00007FF760640000-0x00007FF760994000-memory.dmp

Filesize
3.3MB

Download
memory/4092-2133-0x00007FF69B0B0000-0x00007FF69B404000-memory.dmp

Filesize
3.3MB

Download
memory/4092-176-0x00007FF69B0B0000-0x00007FF69B404000-memory.dmp

Filesize
3.3MB

Download
memory/4108-179-0x00007FF6A6980000-0x00007FF6A6CD4000-memory.dmp

Filesize
3.3MB

Download
memory/4108-2137-0x00007FF6A6980000-0x00007FF6A6CD4000-memory.dmp

Filesize
3.3MB

Download
memory/4168-181-0x00007FF6DE570000-0x00007FF6DE8C4000-memory.dmp

Filesize
3.3MB

Download
memory/4168-2146-0x00007FF6DE570000-0x00007FF6DE8C4000-memory.dmp

Filesize
3.3MB

Download
memory/4512-2147-0x00007FF711750000-0x00007FF711AA4000-memory.dmp

Filesize
3.3MB

Download
memory/4512-172-0x00007FF711750000-0x00007FF711AA4000-memory.dmp

Filesize
3.3MB

Download
memory/4848-169-0x00007FF6D27C0000-0x00007FF6D2B14000-memory.dmp

Filesize
3.3MB

Download
memory/4848-2139-0x00007FF6D27C0000-0x00007FF6D2B14000-memory.dmp

Filesize
3.3MB

Download
memory/4880-177-0x00007FF765260000-0x00007FF7655B4000-memory.dmp

Filesize
3.3MB

Download
memory/4880-2134-0x00007FF765260000-0x00007FF7655B4000-memory.dmp

Filesize
3.3MB

Download
memory/5096-2122-0x00007FF6F3BE0000-0x00007FF6F3F34000-memory.dmp

Filesize
3.3MB

Download
memory/5096-38-0x00007FF6F3BE0000-0x00007FF6F3F34000-memory.dmp

Filesize
3.3MB

Download