xmrig | c45357c52c64bd6f8812633f848ce2311bec01e4468b3e0753131ac8209af3df

Analysis

max time kernel
143s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
Size

2.2MB
MD5

44ad3e69fa0958b3f94e18348464a510
SHA1

01bb8816861a3e200a28a49ee0571de83f912888
SHA256

c45357c52c64bd6f8812633f848ce2311bec01e4468b3e0753131ac8209af3df
SHA512

d5b10539cfebaa928f6302962addb0dc38a63738f38d27116c5b44a00ab5f41778d3f74daee4a99edbe6eab8611bf4ce9649dbee6cfcd766225fa4b9311f8057
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIlMm+ZQaLwBXhuh:oemTLkNdfE0pZrI

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4696-0-0x00007FF6EB2F0000-0x00007FF6EB644000-memory.dmp	xmrig
behavioral2/files/0x000a0000000233b6-4.dat	xmrig
behavioral2/files/0x00070000000233bf-8.dat	xmrig
behavioral2/memory/3804-30-0x00007FF726900000-0x00007FF726C54000-memory.dmp	xmrig
behavioral2/memory/2652-39-0x00007FF79CCA0000-0x00007FF79CFF4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233c4-47.dat	xmrig
behavioral2/files/0x00070000000233c5-53.dat	xmrig
behavioral2/files/0x00070000000233c6-57.dat	xmrig
behavioral2/files/0x00070000000233c7-66.dat	xmrig
behavioral2/files/0x00070000000233c8-71.dat	xmrig
behavioral2/files/0x00070000000233ca-81.dat	xmrig
behavioral2/files/0x00070000000233d2-117.dat	xmrig
behavioral2/files/0x00070000000233d9-150.dat	xmrig
behavioral2/files/0x00070000000233dc-165.dat	xmrig
behavioral2/memory/828-743-0x00007FF6F0540000-0x00007FF6F0894000-memory.dmp	xmrig
behavioral2/memory/1136-744-0x00007FF741F70000-0x00007FF7422C4000-memory.dmp	xmrig
behavioral2/memory/544-745-0x00007FF756470000-0x00007FF7567C4000-memory.dmp	xmrig
behavioral2/memory/3708-747-0x00007FF6BB6D0000-0x00007FF6BBA24000-memory.dmp	xmrig
behavioral2/memory/3892-758-0x00007FF600850000-0x00007FF600BA4000-memory.dmp	xmrig
behavioral2/memory/2908-765-0x00007FF634AE0000-0x00007FF634E34000-memory.dmp	xmrig
behavioral2/memory/724-753-0x00007FF758210000-0x00007FF758564000-memory.dmp	xmrig
behavioral2/files/0x00070000000233dd-170.dat	xmrig
behavioral2/files/0x00070000000233db-168.dat	xmrig
behavioral2/files/0x00070000000233da-163.dat	xmrig
behavioral2/files/0x00070000000233d8-151.dat	xmrig
behavioral2/files/0x00070000000233d7-146.dat	xmrig
behavioral2/files/0x00070000000233d6-141.dat	xmrig
behavioral2/files/0x00070000000233d5-135.dat	xmrig
behavioral2/files/0x00070000000233d4-131.dat	xmrig
behavioral2/files/0x00070000000233d3-126.dat	xmrig
behavioral2/files/0x00070000000233d1-115.dat	xmrig
behavioral2/files/0x00070000000233d0-111.dat	xmrig
behavioral2/files/0x00070000000233cf-106.dat	xmrig
behavioral2/files/0x00070000000233ce-101.dat	xmrig
behavioral2/files/0x00070000000233cd-96.dat	xmrig
behavioral2/files/0x00070000000233cc-91.dat	xmrig
behavioral2/files/0x00070000000233cb-86.dat	xmrig
behavioral2/files/0x00070000000233c9-76.dat	xmrig
behavioral2/memory/2076-773-0x00007FF77AF60000-0x00007FF77B2B4000-memory.dmp	xmrig
behavioral2/memory/4188-46-0x00007FF663D30000-0x00007FF664084000-memory.dmp	xmrig
behavioral2/files/0x00070000000233c3-44.dat	xmrig
behavioral2/files/0x00070000000233c2-40.dat	xmrig
behavioral2/files/0x00070000000233c1-36.dat	xmrig
behavioral2/memory/1456-35-0x00007FF797F80000-0x00007FF7982D4000-memory.dmp	xmrig
behavioral2/memory/768-31-0x00007FF6AEEA0000-0x00007FF6AF1F4000-memory.dmp	xmrig
behavioral2/memory/1516-24-0x00007FF6F51E0000-0x00007FF6F5534000-memory.dmp	xmrig
behavioral2/files/0x00070000000233c0-21.dat	xmrig
behavioral2/files/0x00070000000233be-20.dat	xmrig
behavioral2/memory/2008-12-0x00007FF7F5820000-0x00007FF7F5B74000-memory.dmp	xmrig
behavioral2/memory/1012-776-0x00007FF61A030000-0x00007FF61A384000-memory.dmp	xmrig
behavioral2/memory/2220-786-0x00007FF608E70000-0x00007FF6091C4000-memory.dmp	xmrig
behavioral2/memory/3164-801-0x00007FF7D98F0000-0x00007FF7D9C44000-memory.dmp	xmrig
behavioral2/memory/4720-814-0x00007FF757680000-0x00007FF7579D4000-memory.dmp	xmrig
behavioral2/memory/4800-819-0x00007FF6CB910000-0x00007FF6CBC64000-memory.dmp	xmrig
behavioral2/memory/3168-812-0x00007FF67FC50000-0x00007FF67FFA4000-memory.dmp	xmrig
behavioral2/memory/4320-809-0x00007FF707A70000-0x00007FF707DC4000-memory.dmp	xmrig
behavioral2/memory/4884-807-0x00007FF7CF9D0000-0x00007FF7CFD24000-memory.dmp	xmrig
behavioral2/memory/4632-795-0x00007FF655650000-0x00007FF6559A4000-memory.dmp	xmrig
behavioral2/memory/400-792-0x00007FF7C6170000-0x00007FF7C64C4000-memory.dmp	xmrig
behavioral2/memory/4792-784-0x00007FF7B6290000-0x00007FF7B65E4000-memory.dmp	xmrig
behavioral2/memory/436-828-0x00007FF75FAC0000-0x00007FF75FE14000-memory.dmp	xmrig
behavioral2/memory/1172-833-0x00007FF687800000-0x00007FF687B54000-memory.dmp	xmrig
behavioral2/memory/1768-832-0x00007FF638630000-0x00007FF638984000-memory.dmp	xmrig
behavioral2/memory/1456-2104-0x00007FF797F80000-0x00007FF7982D4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2008	CDmLboz.exe
1516	eeLJYjA.exe
3804	kYRkWjs.exe
768	XqMZRCY.exe
1456	YCScGxz.exe
2652	RaCWPvu.exe
4188	dGptNOl.exe
828	SMwIokF.exe
1136	YMhUQbn.exe
544	jbYFiTn.exe
3708	ZDzwoBT.exe
724	fnXbNku.exe
3892	WbwWtyN.exe
2908	QSQjvnp.exe
2076	UEbwDhU.exe
1012	bdfdapx.exe
4792	nBiHkwg.exe
2220	sYurkNr.exe
400	KeSrPKh.exe
4632	YWjUOyL.exe
3164	ngYHdOC.exe
4884	RTgoStl.exe
4320	cKUrTTR.exe
3168	KtHyENK.exe
4720	dGMdZpB.exe
4800	GRisPuJ.exe
436	fqEsMcr.exe
1768	pWXTJPX.exe
1172	EqVLhCK.exe
1608	npqEcCO.exe
4684	VMbiGcp.exe
2088	aygFjrS.exe
2648	DrViRZi.exe
3732	UucZasa.exe
4964	gLuXJKy.exe
2996	ttRtgsP.exe
4364	qcyjJZe.exe
3208	cmNCsVc.exe
408	EOTTfNi.exe
1852	gJqbMwj.exe
2184	TlaoPOo.exe
4000	PGBdGXc.exe
1356	KAhCTai.exe
4340	sSGNSWE.exe
1036	QJFvyZP.exe
1344	EsoqTPU.exe
1588	yaWKmzV.exe
4480	wDoNKZx.exe
3016	xYJjEYW.exe
888	RFNpbhk.exe
1480	OrdCQAw.exe
3860	jgNGssL.exe
3688	KuwFinQ.exe
4432	EhfSthi.exe
2116	vHwWTDH.exe
2172	uNpeWBo.exe
4044	iSxXfPZ.exe
4352	uvBhhSk.exe
2712	MbMzxoT.exe
3428	mIqgLZf.exe
832	wXCcNEQ.exe
3592	UDcvnvJ.exe
2984	TVKCvZf.exe
4164	kYRkdXo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4696-0-0x00007FF6EB2F0000-0x00007FF6EB644000-memory.dmp	upx
behavioral2/files/0x000a0000000233b6-4.dat	upx
behavioral2/files/0x00070000000233bf-8.dat	upx
behavioral2/memory/3804-30-0x00007FF726900000-0x00007FF726C54000-memory.dmp	upx
behavioral2/memory/2652-39-0x00007FF79CCA0000-0x00007FF79CFF4000-memory.dmp	upx
behavioral2/files/0x00070000000233c4-47.dat	upx
behavioral2/files/0x00070000000233c5-53.dat	upx
behavioral2/files/0x00070000000233c6-57.dat	upx
behavioral2/files/0x00070000000233c7-66.dat	upx
behavioral2/files/0x00070000000233c8-71.dat	upx
behavioral2/files/0x00070000000233ca-81.dat	upx
behavioral2/files/0x00070000000233d2-117.dat	upx
behavioral2/files/0x00070000000233d9-150.dat	upx
behavioral2/files/0x00070000000233dc-165.dat	upx
behavioral2/memory/828-743-0x00007FF6F0540000-0x00007FF6F0894000-memory.dmp	upx
behavioral2/memory/1136-744-0x00007FF741F70000-0x00007FF7422C4000-memory.dmp	upx
behavioral2/memory/544-745-0x00007FF756470000-0x00007FF7567C4000-memory.dmp	upx
behavioral2/memory/3708-747-0x00007FF6BB6D0000-0x00007FF6BBA24000-memory.dmp	upx
behavioral2/memory/3892-758-0x00007FF600850000-0x00007FF600BA4000-memory.dmp	upx
behavioral2/memory/2908-765-0x00007FF634AE0000-0x00007FF634E34000-memory.dmp	upx
behavioral2/memory/724-753-0x00007FF758210000-0x00007FF758564000-memory.dmp	upx
behavioral2/files/0x00070000000233dd-170.dat	upx
behavioral2/files/0x00070000000233db-168.dat	upx
behavioral2/files/0x00070000000233da-163.dat	upx
behavioral2/files/0x00070000000233d8-151.dat	upx
behavioral2/files/0x00070000000233d7-146.dat	upx
behavioral2/files/0x00070000000233d6-141.dat	upx
behavioral2/files/0x00070000000233d5-135.dat	upx
behavioral2/files/0x00070000000233d4-131.dat	upx
behavioral2/files/0x00070000000233d3-126.dat	upx
behavioral2/files/0x00070000000233d1-115.dat	upx
behavioral2/files/0x00070000000233d0-111.dat	upx
behavioral2/files/0x00070000000233cf-106.dat	upx
behavioral2/files/0x00070000000233ce-101.dat	upx
behavioral2/files/0x00070000000233cd-96.dat	upx
behavioral2/files/0x00070000000233cc-91.dat	upx
behavioral2/files/0x00070000000233cb-86.dat	upx
behavioral2/files/0x00070000000233c9-76.dat	upx
behavioral2/memory/2076-773-0x00007FF77AF60000-0x00007FF77B2B4000-memory.dmp	upx
behavioral2/memory/4188-46-0x00007FF663D30000-0x00007FF664084000-memory.dmp	upx
behavioral2/files/0x00070000000233c3-44.dat	upx
behavioral2/files/0x00070000000233c2-40.dat	upx
behavioral2/files/0x00070000000233c1-36.dat	upx
behavioral2/memory/1456-35-0x00007FF797F80000-0x00007FF7982D4000-memory.dmp	upx
behavioral2/memory/768-31-0x00007FF6AEEA0000-0x00007FF6AF1F4000-memory.dmp	upx
behavioral2/memory/1516-24-0x00007FF6F51E0000-0x00007FF6F5534000-memory.dmp	upx
behavioral2/files/0x00070000000233c0-21.dat	upx
behavioral2/files/0x00070000000233be-20.dat	upx
behavioral2/memory/2008-12-0x00007FF7F5820000-0x00007FF7F5B74000-memory.dmp	upx
behavioral2/memory/1012-776-0x00007FF61A030000-0x00007FF61A384000-memory.dmp	upx
behavioral2/memory/2220-786-0x00007FF608E70000-0x00007FF6091C4000-memory.dmp	upx
behavioral2/memory/3164-801-0x00007FF7D98F0000-0x00007FF7D9C44000-memory.dmp	upx
behavioral2/memory/4720-814-0x00007FF757680000-0x00007FF7579D4000-memory.dmp	upx
behavioral2/memory/4800-819-0x00007FF6CB910000-0x00007FF6CBC64000-memory.dmp	upx
behavioral2/memory/3168-812-0x00007FF67FC50000-0x00007FF67FFA4000-memory.dmp	upx
behavioral2/memory/4320-809-0x00007FF707A70000-0x00007FF707DC4000-memory.dmp	upx
behavioral2/memory/4884-807-0x00007FF7CF9D0000-0x00007FF7CFD24000-memory.dmp	upx
behavioral2/memory/4632-795-0x00007FF655650000-0x00007FF6559A4000-memory.dmp	upx
behavioral2/memory/400-792-0x00007FF7C6170000-0x00007FF7C64C4000-memory.dmp	upx
behavioral2/memory/4792-784-0x00007FF7B6290000-0x00007FF7B65E4000-memory.dmp	upx
behavioral2/memory/436-828-0x00007FF75FAC0000-0x00007FF75FE14000-memory.dmp	upx
behavioral2/memory/1172-833-0x00007FF687800000-0x00007FF687B54000-memory.dmp	upx
behavioral2/memory/1768-832-0x00007FF638630000-0x00007FF638984000-memory.dmp	upx
behavioral2/memory/1456-2104-0x00007FF797F80000-0x00007FF7982D4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jSkbxSs.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\BwofrjN.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\mHrGDcE.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\sMuEzoH.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\SXJuvcw.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\HECpdgH.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\niSUHdx.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\ZIVhQXp.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\YZrfJJG.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\aTmtsBY.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\KLfrPYq.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\RFNpbhk.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\kQpQimr.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\sLPGdaR.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\YMhUQbn.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\fqEsMcr.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\wWSaEOn.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\DZOTSOu.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\axHNNmx.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\yqgOvsz.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\hWzyDeu.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\PlaDwKc.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\qbFBKMR.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\mVltjLG.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\qVXpNjA.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\pWXTJPX.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\GdfJPZz.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\NojbHWA.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\FKKLgaO.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\qjEUexA.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\iNyMQkL.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\FVRakiQ.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\dGptNOl.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\amJgHAw.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\LzWsHqk.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\qegEhaI.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\mKUSAOK.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\ureuldg.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\UythtiS.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\WBbZZTo.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\gKTuxKc.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\cmNCsVc.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\iSxXfPZ.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\jBAjEFd.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\kpbaBgv.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\pypaKdI.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\ncpLtaQ.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\KmiMOOb.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\OsytZoT.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\YrkSMkv.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\yzMgXqP.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\AhfvCYt.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\JzyPXqj.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\njToFHF.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\CmqIaSX.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\CDmLboz.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\mXVBkNF.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\dpqjRAJ.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\FSCSzee.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\RlnwcOf.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\ZuWfgxx.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\rZzSbYD.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\egaHQuW.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
File created	C:\Windows\System\cTcMTYi.exe	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 2008	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	84
PID 4696 wrote to memory of 2008	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	84
PID 4696 wrote to memory of 3804	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	85
PID 4696 wrote to memory of 3804	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	85
PID 4696 wrote to memory of 1516	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	86
PID 4696 wrote to memory of 1516	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	86
PID 4696 wrote to memory of 768	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	87
PID 4696 wrote to memory of 768	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	87
PID 4696 wrote to memory of 1456	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	88
PID 4696 wrote to memory of 1456	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	88
PID 4696 wrote to memory of 2652	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	89
PID 4696 wrote to memory of 2652	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	89
PID 4696 wrote to memory of 4188	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	90
PID 4696 wrote to memory of 4188	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	90
PID 4696 wrote to memory of 828	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	91
PID 4696 wrote to memory of 828	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	91
PID 4696 wrote to memory of 1136	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	92
PID 4696 wrote to memory of 1136	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	92
PID 4696 wrote to memory of 544	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	93
PID 4696 wrote to memory of 544	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	93
PID 4696 wrote to memory of 3708	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	94
PID 4696 wrote to memory of 3708	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	94
PID 4696 wrote to memory of 724	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	95
PID 4696 wrote to memory of 724	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	95
PID 4696 wrote to memory of 3892	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	96
PID 4696 wrote to memory of 3892	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	96
PID 4696 wrote to memory of 2908	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	97
PID 4696 wrote to memory of 2908	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	97
PID 4696 wrote to memory of 2076	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	98
PID 4696 wrote to memory of 2076	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	98
PID 4696 wrote to memory of 1012	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	99
PID 4696 wrote to memory of 1012	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	99
PID 4696 wrote to memory of 4792	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	100
PID 4696 wrote to memory of 4792	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	100
PID 4696 wrote to memory of 2220	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	101
PID 4696 wrote to memory of 2220	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	101
PID 4696 wrote to memory of 400	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	102
PID 4696 wrote to memory of 400	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	102
PID 4696 wrote to memory of 4632	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	103
PID 4696 wrote to memory of 4632	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	103
PID 4696 wrote to memory of 3164	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	104
PID 4696 wrote to memory of 3164	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	104
PID 4696 wrote to memory of 4884	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	105
PID 4696 wrote to memory of 4884	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	105
PID 4696 wrote to memory of 4320	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	106
PID 4696 wrote to memory of 4320	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	106
PID 4696 wrote to memory of 3168	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	107
PID 4696 wrote to memory of 3168	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	107
PID 4696 wrote to memory of 4720	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	108
PID 4696 wrote to memory of 4720	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	108
PID 4696 wrote to memory of 4800	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	109
PID 4696 wrote to memory of 4800	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	109
PID 4696 wrote to memory of 436	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	110
PID 4696 wrote to memory of 436	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	110
PID 4696 wrote to memory of 1768	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	111
PID 4696 wrote to memory of 1768	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	111
PID 4696 wrote to memory of 1172	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	112
PID 4696 wrote to memory of 1172	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	112
PID 4696 wrote to memory of 1608	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	113
PID 4696 wrote to memory of 1608	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	113
PID 4696 wrote to memory of 4684	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	114
PID 4696 wrote to memory of 4684	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	114
PID 4696 wrote to memory of 2088	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	115
PID 4696 wrote to memory of 2088	4696	44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\44ad3e69fa0958b3f94e18348464a510_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\System\CDmLboz.exe
  C:\Windows\System\CDmLboz.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\kYRkWjs.exe
  C:\Windows\System\kYRkWjs.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\eeLJYjA.exe
  C:\Windows\System\eeLJYjA.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\XqMZRCY.exe
  C:\Windows\System\XqMZRCY.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\YCScGxz.exe
  C:\Windows\System\YCScGxz.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\RaCWPvu.exe
  C:\Windows\System\RaCWPvu.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\dGptNOl.exe
  C:\Windows\System\dGptNOl.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\SMwIokF.exe
  C:\Windows\System\SMwIokF.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\YMhUQbn.exe
  C:\Windows\System\YMhUQbn.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\jbYFiTn.exe
  C:\Windows\System\jbYFiTn.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\ZDzwoBT.exe
  C:\Windows\System\ZDzwoBT.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\fnXbNku.exe
  C:\Windows\System\fnXbNku.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\WbwWtyN.exe
  C:\Windows\System\WbwWtyN.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\QSQjvnp.exe
  C:\Windows\System\QSQjvnp.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\UEbwDhU.exe
  C:\Windows\System\UEbwDhU.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\bdfdapx.exe
  C:\Windows\System\bdfdapx.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\nBiHkwg.exe
  C:\Windows\System\nBiHkwg.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\sYurkNr.exe
  C:\Windows\System\sYurkNr.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\KeSrPKh.exe
  C:\Windows\System\KeSrPKh.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\YWjUOyL.exe
  C:\Windows\System\YWjUOyL.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\ngYHdOC.exe
  C:\Windows\System\ngYHdOC.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\RTgoStl.exe
  C:\Windows\System\RTgoStl.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\cKUrTTR.exe
  C:\Windows\System\cKUrTTR.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\KtHyENK.exe
  C:\Windows\System\KtHyENK.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\dGMdZpB.exe
  C:\Windows\System\dGMdZpB.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\GRisPuJ.exe
  C:\Windows\System\GRisPuJ.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\fqEsMcr.exe
  C:\Windows\System\fqEsMcr.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\pWXTJPX.exe
  C:\Windows\System\pWXTJPX.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\EqVLhCK.exe
  C:\Windows\System\EqVLhCK.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\npqEcCO.exe
  C:\Windows\System\npqEcCO.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\VMbiGcp.exe
  C:\Windows\System\VMbiGcp.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\aygFjrS.exe
  C:\Windows\System\aygFjrS.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\DrViRZi.exe
  C:\Windows\System\DrViRZi.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\UucZasa.exe
  C:\Windows\System\UucZasa.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\gLuXJKy.exe
  C:\Windows\System\gLuXJKy.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\ttRtgsP.exe
  C:\Windows\System\ttRtgsP.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\qcyjJZe.exe
  C:\Windows\System\qcyjJZe.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\cmNCsVc.exe
  C:\Windows\System\cmNCsVc.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\EOTTfNi.exe
  C:\Windows\System\EOTTfNi.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\gJqbMwj.exe
  C:\Windows\System\gJqbMwj.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\TlaoPOo.exe
  C:\Windows\System\TlaoPOo.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\PGBdGXc.exe
  C:\Windows\System\PGBdGXc.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\KAhCTai.exe
  C:\Windows\System\KAhCTai.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\sSGNSWE.exe
  C:\Windows\System\sSGNSWE.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\QJFvyZP.exe
  C:\Windows\System\QJFvyZP.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\EsoqTPU.exe
  C:\Windows\System\EsoqTPU.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\yaWKmzV.exe
  C:\Windows\System\yaWKmzV.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\wDoNKZx.exe
  C:\Windows\System\wDoNKZx.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\xYJjEYW.exe
  C:\Windows\System\xYJjEYW.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\RFNpbhk.exe
  C:\Windows\System\RFNpbhk.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\OrdCQAw.exe
  C:\Windows\System\OrdCQAw.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\jgNGssL.exe
  C:\Windows\System\jgNGssL.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\KuwFinQ.exe
  C:\Windows\System\KuwFinQ.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\EhfSthi.exe
  C:\Windows\System\EhfSthi.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\vHwWTDH.exe
  C:\Windows\System\vHwWTDH.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\uNpeWBo.exe
  C:\Windows\System\uNpeWBo.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\iSxXfPZ.exe
  C:\Windows\System\iSxXfPZ.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\uvBhhSk.exe
  C:\Windows\System\uvBhhSk.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\MbMzxoT.exe
  C:\Windows\System\MbMzxoT.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\mIqgLZf.exe
  C:\Windows\System\mIqgLZf.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\wXCcNEQ.exe
  C:\Windows\System\wXCcNEQ.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\UDcvnvJ.exe
  C:\Windows\System\UDcvnvJ.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\TVKCvZf.exe
  C:\Windows\System\TVKCvZf.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\kYRkdXo.exe
  C:\Windows\System\kYRkdXo.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\PaSuoCu.exe
  C:\Windows\System\PaSuoCu.exe
  2⤵
  PID:2000
- C:\Windows\System\sjMUYhs.exe
  C:\Windows\System\sjMUYhs.exe
  2⤵
  PID:2328
- C:\Windows\System\nDNCUTg.exe
  C:\Windows\System\nDNCUTg.exe
  2⤵
  PID:2288
- C:\Windows\System\QtDKbQu.exe
  C:\Windows\System\QtDKbQu.exe
  2⤵
  PID:4616
- C:\Windows\System\uLVgqAY.exe
  C:\Windows\System\uLVgqAY.exe
  2⤵
  PID:3268
- C:\Windows\System\hAZqeMe.exe
  C:\Windows\System\hAZqeMe.exe
  2⤵
  PID:4600
- C:\Windows\System\rrXVchP.exe
  C:\Windows\System\rrXVchP.exe
  2⤵
  PID:1412
- C:\Windows\System\wWSaEOn.exe
  C:\Windows\System\wWSaEOn.exe
  2⤵
  PID:440
- C:\Windows\System\IJDmjAn.exe
  C:\Windows\System\IJDmjAn.exe
  2⤵
  PID:5100
- C:\Windows\System\YUnbKfi.exe
  C:\Windows\System\YUnbKfi.exe
  2⤵
  PID:2372
- C:\Windows\System\WrmwYBr.exe
  C:\Windows\System\WrmwYBr.exe
  2⤵
  PID:1916
- C:\Windows\System\qNvETJR.exe
  C:\Windows\System\qNvETJR.exe
  2⤵
  PID:4664
- C:\Windows\System\fOnZtAU.exe
  C:\Windows\System\fOnZtAU.exe
  2⤵
  PID:5148
- C:\Windows\System\KAjqdqc.exe
  C:\Windows\System\KAjqdqc.exe
  2⤵
  PID:5176
- C:\Windows\System\jBAjEFd.exe
  C:\Windows\System\jBAjEFd.exe
  2⤵
  PID:5204
- C:\Windows\System\joTJBBN.exe
  C:\Windows\System\joTJBBN.exe
  2⤵
  PID:5232
- C:\Windows\System\TfZXLRA.exe
  C:\Windows\System\TfZXLRA.exe
  2⤵
  PID:5256
- C:\Windows\System\FSCSzee.exe
  C:\Windows\System\FSCSzee.exe
  2⤵
  PID:5292
- C:\Windows\System\yQsMJsH.exe
  C:\Windows\System\yQsMJsH.exe
  2⤵
  PID:5316
- C:\Windows\System\KKHQdtN.exe
  C:\Windows\System\KKHQdtN.exe
  2⤵
  PID:5344
- C:\Windows\System\inFpIwK.exe
  C:\Windows\System\inFpIwK.exe
  2⤵
  PID:5372
- C:\Windows\System\EPuLyKa.exe
  C:\Windows\System\EPuLyKa.exe
  2⤵
  PID:5400
- C:\Windows\System\KPPXsfK.exe
  C:\Windows\System\KPPXsfK.exe
  2⤵
  PID:5428
- C:\Windows\System\CfrnszB.exe
  C:\Windows\System\CfrnszB.exe
  2⤵
  PID:5456
- C:\Windows\System\xPGytuk.exe
  C:\Windows\System\xPGytuk.exe
  2⤵
  PID:5484
- C:\Windows\System\tTAKlDp.exe
  C:\Windows\System\tTAKlDp.exe
  2⤵
  PID:5512
- C:\Windows\System\LDdcxNU.exe
  C:\Windows\System\LDdcxNU.exe
  2⤵
  PID:5540
- C:\Windows\System\JAsvzVh.exe
  C:\Windows\System\JAsvzVh.exe
  2⤵
  PID:5568
- C:\Windows\System\fFSMygC.exe
  C:\Windows\System\fFSMygC.exe
  2⤵
  PID:5596
- C:\Windows\System\ureuldg.exe
  C:\Windows\System\ureuldg.exe
  2⤵
  PID:5624
- C:\Windows\System\TEHnFjk.exe
  C:\Windows\System\TEHnFjk.exe
  2⤵
  PID:5652
- C:\Windows\System\ncpLtaQ.exe
  C:\Windows\System\ncpLtaQ.exe
  2⤵
  PID:5680
- C:\Windows\System\NaOjwku.exe
  C:\Windows\System\NaOjwku.exe
  2⤵
  PID:5708
- C:\Windows\System\lithKck.exe
  C:\Windows\System\lithKck.exe
  2⤵
  PID:5732
- C:\Windows\System\yxRnqYh.exe
  C:\Windows\System\yxRnqYh.exe
  2⤵
  PID:5764
- C:\Windows\System\yzMgXqP.exe
  C:\Windows\System\yzMgXqP.exe
  2⤵
  PID:5792
- C:\Windows\System\LvpxtgA.exe
  C:\Windows\System\LvpxtgA.exe
  2⤵
  PID:5820
- C:\Windows\System\cPUcYPF.exe
  C:\Windows\System\cPUcYPF.exe
  2⤵
  PID:5848
- C:\Windows\System\kMIQkrk.exe
  C:\Windows\System\kMIQkrk.exe
  2⤵
  PID:5872
- C:\Windows\System\fPaJqYA.exe
  C:\Windows\System\fPaJqYA.exe
  2⤵
  PID:5904
- C:\Windows\System\hsreAJP.exe
  C:\Windows\System\hsreAJP.exe
  2⤵
  PID:5932
- C:\Windows\System\SWAoCPU.exe
  C:\Windows\System\SWAoCPU.exe
  2⤵
  PID:5960
- C:\Windows\System\uYunUyu.exe
  C:\Windows\System\uYunUyu.exe
  2⤵
  PID:5988
- C:\Windows\System\KeUDAGC.exe
  C:\Windows\System\KeUDAGC.exe
  2⤵
  PID:6016
- C:\Windows\System\OhVBYFZ.exe
  C:\Windows\System\OhVBYFZ.exe
  2⤵
  PID:6044
- C:\Windows\System\EoKVlIj.exe
  C:\Windows\System\EoKVlIj.exe
  2⤵
  PID:6072
- C:\Windows\System\VbzLEPz.exe
  C:\Windows\System\VbzLEPz.exe
  2⤵
  PID:6100
- C:\Windows\System\gJsHdZd.exe
  C:\Windows\System\gJsHdZd.exe
  2⤵
  PID:6128
- C:\Windows\System\ByJKouV.exe
  C:\Windows\System\ByJKouV.exe
  2⤵
  PID:4624
- C:\Windows\System\bsPHIUW.exe
  C:\Windows\System\bsPHIUW.exe
  2⤵
  PID:1712
- C:\Windows\System\wytaPgw.exe
  C:\Windows\System\wytaPgw.exe
  2⤵
  PID:4400
- C:\Windows\System\lXOFvUy.exe
  C:\Windows\System\lXOFvUy.exe
  2⤵
  PID:3092
- C:\Windows\System\DDjQJEs.exe
  C:\Windows\System\DDjQJEs.exe
  2⤵
  PID:3120
- C:\Windows\System\fpKDazN.exe
  C:\Windows\System\fpKDazN.exe
  2⤵
  PID:5132
- C:\Windows\System\TGZHrSr.exe
  C:\Windows\System\TGZHrSr.exe
  2⤵
  PID:5196
- C:\Windows\System\nbzeUEJ.exe
  C:\Windows\System\nbzeUEJ.exe
  2⤵
  PID:5252
- C:\Windows\System\lxVhLaX.exe
  C:\Windows\System\lxVhLaX.exe
  2⤵
  PID:5328
- C:\Windows\System\fwXUPuB.exe
  C:\Windows\System\fwXUPuB.exe
  2⤵
  PID:5388
- C:\Windows\System\ifcrOGI.exe
  C:\Windows\System\ifcrOGI.exe
  2⤵
  PID:5448
- C:\Windows\System\IMBJLho.exe
  C:\Windows\System\IMBJLho.exe
  2⤵
  PID:5524
- C:\Windows\System\MbkYPMO.exe
  C:\Windows\System\MbkYPMO.exe
  2⤵
  PID:5584
- C:\Windows\System\IwuBHZH.exe
  C:\Windows\System\IwuBHZH.exe
  2⤵
  PID:5644
- C:\Windows\System\GdfJPZz.exe
  C:\Windows\System\GdfJPZz.exe
  2⤵
  PID:5720
- C:\Windows\System\ddKvXyL.exe
  C:\Windows\System\ddKvXyL.exe
  2⤵
  PID:5780
- C:\Windows\System\MgHVYdQ.exe
  C:\Windows\System\MgHVYdQ.exe
  2⤵
  PID:5836
- C:\Windows\System\qzuvDuU.exe
  C:\Windows\System\qzuvDuU.exe
  2⤵
  PID:5896
- C:\Windows\System\apGhHTR.exe
  C:\Windows\System\apGhHTR.exe
  2⤵
  PID:5972
- C:\Windows\System\hAnLAzU.exe
  C:\Windows\System\hAnLAzU.exe
  2⤵
  PID:6028
- C:\Windows\System\DBUiqKe.exe
  C:\Windows\System\DBUiqKe.exe
  2⤵
  PID:6084
- C:\Windows\System\pxurXPF.exe
  C:\Windows\System\pxurXPF.exe
  2⤵
  PID:1948
- C:\Windows\System\xfSDQKh.exe
  C:\Windows\System\xfSDQKh.exe
  2⤵
  PID:1860
- C:\Windows\System\ddMXcba.exe
  C:\Windows\System\ddMXcba.exe
  2⤵
  PID:3124
- C:\Windows\System\dGhBvBO.exe
  C:\Windows\System\dGhBvBO.exe
  2⤵
  PID:5244
- C:\Windows\System\uHOwvPe.exe
  C:\Windows\System\uHOwvPe.exe
  2⤵
  PID:5416
- C:\Windows\System\xCrbhtj.exe
  C:\Windows\System\xCrbhtj.exe
  2⤵
  PID:5552
- C:\Windows\System\CjwiMZi.exe
  C:\Windows\System\CjwiMZi.exe
  2⤵
  PID:5692
- C:\Windows\System\GTBjepo.exe
  C:\Windows\System\GTBjepo.exe
  2⤵
  PID:3172
- C:\Windows\System\FHkOqKz.exe
  C:\Windows\System\FHkOqKz.exe
  2⤵
  PID:6172
- C:\Windows\System\fFzuHqN.exe
  C:\Windows\System\fFzuHqN.exe
  2⤵
  PID:6200
- C:\Windows\System\SynzphF.exe
  C:\Windows\System\SynzphF.exe
  2⤵
  PID:6228
- C:\Windows\System\jEhAEow.exe
  C:\Windows\System\jEhAEow.exe
  2⤵
  PID:6256
- C:\Windows\System\EGafefz.exe
  C:\Windows\System\EGafefz.exe
  2⤵
  PID:6280
- C:\Windows\System\kQpQimr.exe
  C:\Windows\System\kQpQimr.exe
  2⤵
  PID:6312
- C:\Windows\System\cRpdlGG.exe
  C:\Windows\System\cRpdlGG.exe
  2⤵
  PID:6340
- C:\Windows\System\LfUhDhv.exe
  C:\Windows\System\LfUhDhv.exe
  2⤵
  PID:6368
- C:\Windows\System\jfemQgD.exe
  C:\Windows\System\jfemQgD.exe
  2⤵
  PID:6396
- C:\Windows\System\sMuEzoH.exe
  C:\Windows\System\sMuEzoH.exe
  2⤵
  PID:6424
- C:\Windows\System\gZvjocs.exe
  C:\Windows\System\gZvjocs.exe
  2⤵
  PID:6452
- C:\Windows\System\SwBEscV.exe
  C:\Windows\System\SwBEscV.exe
  2⤵
  PID:6480
- C:\Windows\System\mGmDugz.exe
  C:\Windows\System\mGmDugz.exe
  2⤵
  PID:6508
- C:\Windows\System\IKhuLmh.exe
  C:\Windows\System\IKhuLmh.exe
  2⤵
  PID:6536
- C:\Windows\System\taBFyNx.exe
  C:\Windows\System\taBFyNx.exe
  2⤵
  PID:6564
- C:\Windows\System\DNZQGBf.exe
  C:\Windows\System\DNZQGBf.exe
  2⤵
  PID:6592
- C:\Windows\System\YxflsOS.exe
  C:\Windows\System\YxflsOS.exe
  2⤵
  PID:6620
- C:\Windows\System\GklElwu.exe
  C:\Windows\System\GklElwu.exe
  2⤵
  PID:6648
- C:\Windows\System\SPyPncg.exe
  C:\Windows\System\SPyPncg.exe
  2⤵
  PID:6676
- C:\Windows\System\OIwoVIK.exe
  C:\Windows\System\OIwoVIK.exe
  2⤵
  PID:6704
- C:\Windows\System\vbUvfjn.exe
  C:\Windows\System\vbUvfjn.exe
  2⤵
  PID:6732
- C:\Windows\System\OcYJIJh.exe
  C:\Windows\System\OcYJIJh.exe
  2⤵
  PID:6756
- C:\Windows\System\fqdXlqR.exe
  C:\Windows\System\fqdXlqR.exe
  2⤵
  PID:6784
- C:\Windows\System\SADtmqS.exe
  C:\Windows\System\SADtmqS.exe
  2⤵
  PID:6816
- C:\Windows\System\wgNXqKJ.exe
  C:\Windows\System\wgNXqKJ.exe
  2⤵
  PID:6840
- C:\Windows\System\MzKOQru.exe
  C:\Windows\System\MzKOQru.exe
  2⤵
  PID:6872
- C:\Windows\System\ljxlQXJ.exe
  C:\Windows\System\ljxlQXJ.exe
  2⤵
  PID:6900
- C:\Windows\System\YmoFPOm.exe
  C:\Windows\System\YmoFPOm.exe
  2⤵
  PID:6928
- C:\Windows\System\fPKbrbE.exe
  C:\Windows\System\fPKbrbE.exe
  2⤵
  PID:6956
- C:\Windows\System\PZzvpiD.exe
  C:\Windows\System\PZzvpiD.exe
  2⤵
  PID:6984
- C:\Windows\System\UmYOsAD.exe
  C:\Windows\System\UmYOsAD.exe
  2⤵
  PID:7012
- C:\Windows\System\SXJuvcw.exe
  C:\Windows\System\SXJuvcw.exe
  2⤵
  PID:7040
- C:\Windows\System\oANVwkp.exe
  C:\Windows\System\oANVwkp.exe
  2⤵
  PID:7068
- C:\Windows\System\IQWAYKx.exe
  C:\Windows\System\IQWAYKx.exe
  2⤵
  PID:7096
- C:\Windows\System\KVrnIUC.exe
  C:\Windows\System\KVrnIUC.exe
  2⤵
  PID:7124
- C:\Windows\System\JvqOyOm.exe
  C:\Windows\System\JvqOyOm.exe
  2⤵
  PID:7152
- C:\Windows\System\oopQRnp.exe
  C:\Windows\System\oopQRnp.exe
  2⤵
  PID:5924
- C:\Windows\System\nWvxHku.exe
  C:\Windows\System\nWvxHku.exe
  2⤵
  PID:6060
- C:\Windows\System\oLMZNBV.exe
  C:\Windows\System\oLMZNBV.exe
  2⤵
  PID:3972
- C:\Windows\System\jTuuBdy.exe
  C:\Windows\System\jTuuBdy.exe
  2⤵
  PID:5308
- C:\Windows\System\jpCEtyL.exe
  C:\Windows\System\jpCEtyL.exe
  2⤵
  PID:5616
- C:\Windows\System\PMLLluP.exe
  C:\Windows\System\PMLLluP.exe
  2⤵
  PID:1100
- C:\Windows\System\OObKCfP.exe
  C:\Windows\System\OObKCfP.exe
  2⤵
  PID:6220
- C:\Windows\System\QHaXVsU.exe
  C:\Windows\System\QHaXVsU.exe
  2⤵
  PID:6292
- C:\Windows\System\fisWsPb.exe
  C:\Windows\System\fisWsPb.exe
  2⤵
  PID:6352
- C:\Windows\System\LsknkSj.exe
  C:\Windows\System\LsknkSj.exe
  2⤵
  PID:6412
- C:\Windows\System\NQtTSII.exe
  C:\Windows\System\NQtTSII.exe
  2⤵
  PID:6472
- C:\Windows\System\WodcSrN.exe
  C:\Windows\System\WodcSrN.exe
  2⤵
  PID:6520
- C:\Windows\System\JcxUdog.exe
  C:\Windows\System\JcxUdog.exe
  2⤵
  PID:1000
- C:\Windows\System\AEBtYyf.exe
  C:\Windows\System\AEBtYyf.exe
  2⤵
  PID:6636
- C:\Windows\System\bPeVdUQ.exe
  C:\Windows\System\bPeVdUQ.exe
  2⤵
  PID:6696
- C:\Windows\System\mSOgyCp.exe
  C:\Windows\System\mSOgyCp.exe
  2⤵
  PID:6772
- C:\Windows\System\hZvAOup.exe
  C:\Windows\System\hZvAOup.exe
  2⤵
  PID:4220
- C:\Windows\System\iZiuDzz.exe
  C:\Windows\System\iZiuDzz.exe
  2⤵
  PID:6888
- C:\Windows\System\amJgHAw.exe
  C:\Windows\System\amJgHAw.exe
  2⤵
  PID:6948
- C:\Windows\System\xohkbMt.exe
  C:\Windows\System\xohkbMt.exe
  2⤵
  PID:7024
- C:\Windows\System\JejxKYP.exe
  C:\Windows\System\JejxKYP.exe
  2⤵
  PID:7084
- C:\Windows\System\LPGpzVi.exe
  C:\Windows\System\LPGpzVi.exe
  2⤵
  PID:7136
- C:\Windows\System\cmQjkse.exe
  C:\Windows\System\cmQjkse.exe
  2⤵
  PID:6000
- C:\Windows\System\OmZENNM.exe
  C:\Windows\System\OmZENNM.exe
  2⤵
  PID:4076
- C:\Windows\System\CLQYbvL.exe
  C:\Windows\System\CLQYbvL.exe
  2⤵
  PID:4728
- C:\Windows\System\OyXUeBp.exe
  C:\Windows\System\OyXUeBp.exe
  2⤵
  PID:3700
- C:\Windows\System\axSlzyP.exe
  C:\Windows\System\axSlzyP.exe
  2⤵
  PID:2632
- C:\Windows\System\DZOTSOu.exe
  C:\Windows\System\DZOTSOu.exe
  2⤵
  PID:6500
- C:\Windows\System\PhuWkgt.exe
  C:\Windows\System\PhuWkgt.exe
  2⤵
  PID:6612
- C:\Windows\System\eOiKYxA.exe
  C:\Windows\System\eOiKYxA.exe
  2⤵
  PID:6744
- C:\Windows\System\rZWxEYH.exe
  C:\Windows\System\rZWxEYH.exe
  2⤵
  PID:6856
- C:\Windows\System\YFXWzAf.exe
  C:\Windows\System\YFXWzAf.exe
  2⤵
  PID:6976
- C:\Windows\System\VnJQZcY.exe
  C:\Windows\System\VnJQZcY.exe
  2⤵
  PID:4280
- C:\Windows\System\INVaEDr.exe
  C:\Windows\System\INVaEDr.exe
  2⤵
  PID:6140
- C:\Windows\System\HArfTZu.exe
  C:\Windows\System\HArfTZu.exe
  2⤵
  PID:6188
- C:\Windows\System\hBqsuBa.exe
  C:\Windows\System\hBqsuBa.exe
  2⤵
  PID:6276
- C:\Windows\System\mLiKtoH.exe
  C:\Windows\System\mLiKtoH.exe
  2⤵
  PID:6552
- C:\Windows\System\msGVgfe.exe
  C:\Windows\System\msGVgfe.exe
  2⤵
  PID:4316
- C:\Windows\System\YetGsVV.exe
  C:\Windows\System\YetGsVV.exe
  2⤵
  PID:3452
- C:\Windows\System\bEdepIi.exe
  C:\Windows\System\bEdepIi.exe
  2⤵
  PID:7188
- C:\Windows\System\onfGQst.exe
  C:\Windows\System\onfGQst.exe
  2⤵
  PID:7216
- C:\Windows\System\bKxHRTg.exe
  C:\Windows\System\bKxHRTg.exe
  2⤵
  PID:7244
- C:\Windows\System\NojbHWA.exe
  C:\Windows\System\NojbHWA.exe
  2⤵
  PID:7272
- C:\Windows\System\aTIzPiZ.exe
  C:\Windows\System\aTIzPiZ.exe
  2⤵
  PID:7300
- C:\Windows\System\LXlQRUu.exe
  C:\Windows\System\LXlQRUu.exe
  2⤵
  PID:7328
- C:\Windows\System\kbQKAbA.exe
  C:\Windows\System\kbQKAbA.exe
  2⤵
  PID:7356
- C:\Windows\System\jBlvGeF.exe
  C:\Windows\System\jBlvGeF.exe
  2⤵
  PID:7384
- C:\Windows\System\YCSecOB.exe
  C:\Windows\System\YCSecOB.exe
  2⤵
  PID:7460
- C:\Windows\System\wWzAIJD.exe
  C:\Windows\System\wWzAIJD.exe
  2⤵
  PID:7504
- C:\Windows\System\sZyOWbW.exe
  C:\Windows\System\sZyOWbW.exe
  2⤵
  PID:7520
- C:\Windows\System\sfrvJIL.exe
  C:\Windows\System\sfrvJIL.exe
  2⤵
  PID:7540
- C:\Windows\System\DOsQSri.exe
  C:\Windows\System\DOsQSri.exe
  2⤵
  PID:7560
- C:\Windows\System\AhfvCYt.exe
  C:\Windows\System\AhfvCYt.exe
  2⤵
  PID:7588
- C:\Windows\System\cVIINUO.exe
  C:\Windows\System\cVIINUO.exe
  2⤵
  PID:7644
- C:\Windows\System\BRTJGWA.exe
  C:\Windows\System\BRTJGWA.exe
  2⤵
  PID:7680
- C:\Windows\System\HECpdgH.exe
  C:\Windows\System\HECpdgH.exe
  2⤵
  PID:7716
- C:\Windows\System\jrELAWK.exe
  C:\Windows\System\jrELAWK.exe
  2⤵
  PID:7736
- C:\Windows\System\vAbJqFd.exe
  C:\Windows\System\vAbJqFd.exe
  2⤵
  PID:7784
- C:\Windows\System\mVxlakL.exe
  C:\Windows\System\mVxlakL.exe
  2⤵
  PID:7812
- C:\Windows\System\lyjRpvY.exe
  C:\Windows\System\lyjRpvY.exe
  2⤵
  PID:7852
- C:\Windows\System\RMuSecK.exe
  C:\Windows\System\RMuSecK.exe
  2⤵
  PID:7872
- C:\Windows\System\IYXeyBu.exe
  C:\Windows\System\IYXeyBu.exe
  2⤵
  PID:7896
- C:\Windows\System\GfGJoXg.exe
  C:\Windows\System\GfGJoXg.exe
  2⤵
  PID:7916
- C:\Windows\System\CcMifLn.exe
  C:\Windows\System\CcMifLn.exe
  2⤵
  PID:7960
- C:\Windows\System\iXtTOdt.exe
  C:\Windows\System\iXtTOdt.exe
  2⤵
  PID:7984
- C:\Windows\System\sRRLTDS.exe
  C:\Windows\System\sRRLTDS.exe
  2⤵
  PID:8008
- C:\Windows\System\eZvJklT.exe
  C:\Windows\System\eZvJklT.exe
  2⤵
  PID:8056
- C:\Windows\System\dfkGkuV.exe
  C:\Windows\System\dfkGkuV.exe
  2⤵
  PID:8092
- C:\Windows\System\aUfSrzd.exe
  C:\Windows\System\aUfSrzd.exe
  2⤵
  PID:8112
- C:\Windows\System\PqOBpcP.exe
  C:\Windows\System\PqOBpcP.exe
  2⤵
  PID:8176
- C:\Windows\System\nfnbMKe.exe
  C:\Windows\System\nfnbMKe.exe
  2⤵
  PID:4004
- C:\Windows\System\mtFqdyY.exe
  C:\Windows\System\mtFqdyY.exe
  2⤵
  PID:380
- C:\Windows\System\htxfOvu.exe
  C:\Windows\System\htxfOvu.exe
  2⤵
  PID:4936
- C:\Windows\System\JULZifm.exe
  C:\Windows\System\JULZifm.exe
  2⤵
  PID:2952
- C:\Windows\System\bDqRuMi.exe
  C:\Windows\System\bDqRuMi.exe
  2⤵
  PID:6916
- C:\Windows\System\VTdmEuu.exe
  C:\Windows\System\VTdmEuu.exe
  2⤵
  PID:7236
- C:\Windows\System\FvqMRRM.exe
  C:\Windows\System\FvqMRRM.exe
  2⤵
  PID:5092
- C:\Windows\System\mXVBkNF.exe
  C:\Windows\System\mXVBkNF.exe
  2⤵
  PID:7288
- C:\Windows\System\HnhdEmB.exe
  C:\Windows\System\HnhdEmB.exe
  2⤵
  PID:1492
- C:\Windows\System\LUdQuVl.exe
  C:\Windows\System\LUdQuVl.exe
  2⤵
  PID:3976
- C:\Windows\System\nRspZLg.exe
  C:\Windows\System\nRspZLg.exe
  2⤵
  PID:7376
- C:\Windows\System\JzyPXqj.exe
  C:\Windows\System\JzyPXqj.exe
  2⤵
  PID:7396
- C:\Windows\System\QzzigLk.exe
  C:\Windows\System\QzzigLk.exe
  2⤵
  PID:4564
- C:\Windows\System\FGKcPxG.exe
  C:\Windows\System\FGKcPxG.exe
  2⤵
  PID:2704
- C:\Windows\System\CyprTqQ.exe
  C:\Windows\System\CyprTqQ.exe
  2⤵
  PID:7472
- C:\Windows\System\unkHIFe.exe
  C:\Windows\System\unkHIFe.exe
  2⤵
  PID:7516
- C:\Windows\System\JZQypNI.exe
  C:\Windows\System\JZQypNI.exe
  2⤵
  PID:7572
- C:\Windows\System\zGSotCc.exe
  C:\Windows\System\zGSotCc.exe
  2⤵
  PID:7664
- C:\Windows\System\RSxWoOh.exe
  C:\Windows\System\RSxWoOh.exe
  2⤵
  PID:7708
- C:\Windows\System\gPrUTEM.exe
  C:\Windows\System\gPrUTEM.exe
  2⤵
  PID:7868
- C:\Windows\System\uLtZksz.exe
  C:\Windows\System\uLtZksz.exe
  2⤵
  PID:7864
- C:\Windows\System\jdpZDPN.exe
  C:\Windows\System\jdpZDPN.exe
  2⤵
  PID:7976
- C:\Windows\System\qGNHFgV.exe
  C:\Windows\System\qGNHFgV.exe
  2⤵
  PID:8048
- C:\Windows\System\aWnSjqL.exe
  C:\Windows\System\aWnSjqL.exe
  2⤵
  PID:8124
- C:\Windows\System\yZrFgjS.exe
  C:\Windows\System\yZrFgjS.exe
  2⤵
  PID:7528
- C:\Windows\System\oSSElSV.exe
  C:\Windows\System\oSSElSV.exe
  2⤵
  PID:8184
- C:\Windows\System\BzEeQcP.exe
  C:\Windows\System\BzEeQcP.exe
  2⤵
  PID:7724
- C:\Windows\System\fhAXewh.exe
  C:\Windows\System\fhAXewh.exe
  2⤵
  PID:7804
- C:\Windows\System\ZnTZYNa.exe
  C:\Windows\System\ZnTZYNa.exe
  2⤵
  PID:7180
- C:\Windows\System\aBweyCB.exe
  C:\Windows\System\aBweyCB.exe
  2⤵
  PID:6800
- C:\Windows\System\yeYKYiF.exe
  C:\Windows\System\yeYKYiF.exe
  2⤵
  PID:3304
- C:\Windows\System\wbojXoZ.exe
  C:\Windows\System\wbojXoZ.exe
  2⤵
  PID:1564
- C:\Windows\System\bgLzwCq.exe
  C:\Windows\System\bgLzwCq.exe
  2⤵
  PID:7344
- C:\Windows\System\PcqSEKu.exe
  C:\Windows\System\PcqSEKu.exe
  2⤵
  PID:312
- C:\Windows\System\thmESct.exe
  C:\Windows\System\thmESct.exe
  2⤵
  PID:7484
- C:\Windows\System\tgDanPA.exe
  C:\Windows\System\tgDanPA.exe
  2⤵
  PID:940
- C:\Windows\System\JZrezpH.exe
  C:\Windows\System\JZrezpH.exe
  2⤵
  PID:7772
- C:\Windows\System\LzWsHqk.exe
  C:\Windows\System\LzWsHqk.exe
  2⤵
  PID:8000
- C:\Windows\System\RNoMUIu.exe
  C:\Windows\System\RNoMUIu.exe
  2⤵
  PID:8084
- C:\Windows\System\nuIFdbw.exe
  C:\Windows\System\nuIFdbw.exe
  2⤵
  PID:7696
- C:\Windows\System\fUwwsIv.exe
  C:\Windows\System\fUwwsIv.exe
  2⤵
  PID:8004
- C:\Windows\System\tEycRKb.exe
  C:\Windows\System\tEycRKb.exe
  2⤵
  PID:4860
- C:\Windows\System\XmJnZvo.exe
  C:\Windows\System\XmJnZvo.exe
  2⤵
  PID:7500
- C:\Windows\System\gnXNPHr.exe
  C:\Windows\System\gnXNPHr.exe
  2⤵
  PID:7884
- C:\Windows\System\tZmLLUJ.exe
  C:\Windows\System\tZmLLUJ.exe
  2⤵
  PID:7620
- C:\Windows\System\DqkRupr.exe
  C:\Windows\System\DqkRupr.exe
  2⤵
  PID:1248
- C:\Windows\System\ZVCAMbM.exe
  C:\Windows\System\ZVCAMbM.exe
  2⤵
  PID:7640
- C:\Windows\System\AyMLFjV.exe
  C:\Windows\System\AyMLFjV.exe
  2⤵
  PID:2092
- C:\Windows\System\nIwCgls.exe
  C:\Windows\System\nIwCgls.exe
  2⤵
  PID:4524
- C:\Windows\System\eaJJUcQ.exe
  C:\Windows\System\eaJJUcQ.exe
  2⤵
  PID:8228
- C:\Windows\System\sApfFpR.exe
  C:\Windows\System\sApfFpR.exe
  2⤵
  PID:8244
- C:\Windows\System\RIqWLYQ.exe
  C:\Windows\System\RIqWLYQ.exe
  2⤵
  PID:8288
- C:\Windows\System\gJftamW.exe
  C:\Windows\System\gJftamW.exe
  2⤵
  PID:8308
- C:\Windows\System\ZDVLkBt.exe
  C:\Windows\System\ZDVLkBt.exe
  2⤵
  PID:8344
- C:\Windows\System\OzHjVXX.exe
  C:\Windows\System\OzHjVXX.exe
  2⤵
  PID:8372
- C:\Windows\System\rnkNDXu.exe
  C:\Windows\System\rnkNDXu.exe
  2⤵
  PID:8388
- C:\Windows\System\MeLvXmI.exe
  C:\Windows\System\MeLvXmI.exe
  2⤵
  PID:8424
- C:\Windows\System\nYouxmm.exe
  C:\Windows\System\nYouxmm.exe
  2⤵
  PID:8456
- C:\Windows\System\endxzPa.exe
  C:\Windows\System\endxzPa.exe
  2⤵
  PID:8476
- C:\Windows\System\gROjTyu.exe
  C:\Windows\System\gROjTyu.exe
  2⤵
  PID:8504
- C:\Windows\System\IojNuVI.exe
  C:\Windows\System\IojNuVI.exe
  2⤵
  PID:8536
- C:\Windows\System\pOuVXKu.exe
  C:\Windows\System\pOuVXKu.exe
  2⤵
  PID:8560
- C:\Windows\System\OnJRLFt.exe
  C:\Windows\System\OnJRLFt.exe
  2⤵
  PID:8596
- C:\Windows\System\IvqnLzl.exe
  C:\Windows\System\IvqnLzl.exe
  2⤵
  PID:8616
- C:\Windows\System\TiOAjZC.exe
  C:\Windows\System\TiOAjZC.exe
  2⤵
  PID:8644
- C:\Windows\System\VHkxzXH.exe
  C:\Windows\System\VHkxzXH.exe
  2⤵
  PID:8684
- C:\Windows\System\BXQWwDK.exe
  C:\Windows\System\BXQWwDK.exe
  2⤵
  PID:8712
- C:\Windows\System\SdBWFDv.exe
  C:\Windows\System\SdBWFDv.exe
  2⤵
  PID:8728
- C:\Windows\System\qegEhaI.exe
  C:\Windows\System\qegEhaI.exe
  2⤵
  PID:8764
- C:\Windows\System\XTpWrkD.exe
  C:\Windows\System\XTpWrkD.exe
  2⤵
  PID:8792
- C:\Windows\System\eXkdzof.exe
  C:\Windows\System\eXkdzof.exe
  2⤵
  PID:8828
- C:\Windows\System\tyNaeur.exe
  C:\Windows\System\tyNaeur.exe
  2⤵
  PID:8856
- C:\Windows\System\yhPsjgA.exe
  C:\Windows\System\yhPsjgA.exe
  2⤵
  PID:8876
- C:\Windows\System\VVWNQxB.exe
  C:\Windows\System\VVWNQxB.exe
  2⤵
  PID:8900
- C:\Windows\System\bWnrszT.exe
  C:\Windows\System\bWnrszT.exe
  2⤵
  PID:8940
- C:\Windows\System\yqgOvsz.exe
  C:\Windows\System\yqgOvsz.exe
  2⤵
  PID:8968
- C:\Windows\System\FpXBbzi.exe
  C:\Windows\System\FpXBbzi.exe
  2⤵
  PID:8996
- C:\Windows\System\cEyrUST.exe
  C:\Windows\System\cEyrUST.exe
  2⤵
  PID:9020
- C:\Windows\System\iuZiumo.exe
  C:\Windows\System\iuZiumo.exe
  2⤵
  PID:9044
- C:\Windows\System\sSWqbnN.exe
  C:\Windows\System\sSWqbnN.exe
  2⤵
  PID:9080
- C:\Windows\System\YZrfJJG.exe
  C:\Windows\System\YZrfJJG.exe
  2⤵
  PID:9100
- C:\Windows\System\AlcVkpB.exe
  C:\Windows\System\AlcVkpB.exe
  2⤵
  PID:9116
- C:\Windows\System\dpqjRAJ.exe
  C:\Windows\System\dpqjRAJ.exe
  2⤵
  PID:9148
- C:\Windows\System\KbuCkvf.exe
  C:\Windows\System\KbuCkvf.exe
  2⤵
  PID:9164
- C:\Windows\System\OkuJDYh.exe
  C:\Windows\System\OkuJDYh.exe
  2⤵
  PID:8208
- C:\Windows\System\sbBCoTJ.exe
  C:\Windows\System\sbBCoTJ.exe
  2⤵
  PID:8264
- C:\Windows\System\lLVBbtJ.exe
  C:\Windows\System\lLVBbtJ.exe
  2⤵
  PID:8296
- C:\Windows\System\NBFjpEY.exe
  C:\Windows\System\NBFjpEY.exe
  2⤵
  PID:8356
- C:\Windows\System\frMXTtm.exe
  C:\Windows\System\frMXTtm.exe
  2⤵
  PID:8408
- C:\Windows\System\FKKLgaO.exe
  C:\Windows\System\FKKLgaO.exe
  2⤵
  PID:8556
- C:\Windows\System\PfVAHkb.exe
  C:\Windows\System\PfVAHkb.exe
  2⤵
  PID:8588
- C:\Windows\System\bpWWMlQ.exe
  C:\Windows\System\bpWWMlQ.exe
  2⤵
  PID:8664
- C:\Windows\System\npIQOGA.exe
  C:\Windows\System\npIQOGA.exe
  2⤵
  PID:8696
- C:\Windows\System\dStCdKi.exe
  C:\Windows\System\dStCdKi.exe
  2⤵
  PID:8740
- C:\Windows\System\lBvPgds.exe
  C:\Windows\System\lBvPgds.exe
  2⤵
  PID:8812
- C:\Windows\System\GGTNxqL.exe
  C:\Windows\System\GGTNxqL.exe
  2⤵
  PID:8864
- C:\Windows\System\sLPGdaR.exe
  C:\Windows\System\sLPGdaR.exe
  2⤵
  PID:8936
- C:\Windows\System\YroFhRU.exe
  C:\Windows\System\YroFhRU.exe
  2⤵
  PID:8980
- C:\Windows\System\sGlQEkW.exe
  C:\Windows\System\sGlQEkW.exe
  2⤵
  PID:9136
- C:\Windows\System\QYcwWOu.exe
  C:\Windows\System\QYcwWOu.exe
  2⤵
  PID:9160
- C:\Windows\System\BOkZIeg.exe
  C:\Windows\System\BOkZIeg.exe
  2⤵
  PID:8224
- C:\Windows\System\CUPwkGk.exe
  C:\Windows\System\CUPwkGk.exe
  2⤵
  PID:8384
- C:\Windows\System\IikFJSU.exe
  C:\Windows\System\IikFJSU.exe
  2⤵
  PID:8484
- C:\Windows\System\NghQIkn.exe
  C:\Windows\System\NghQIkn.exe
  2⤵
  PID:8668
- C:\Windows\System\ZMCsviP.exe
  C:\Windows\System\ZMCsviP.exe
  2⤵
  PID:8844
- C:\Windows\System\jFoDMTk.exe
  C:\Windows\System\jFoDMTk.exe
  2⤵
  PID:7972
- C:\Windows\System\Qomtbpe.exe
  C:\Windows\System\Qomtbpe.exe
  2⤵
  PID:9060
- C:\Windows\System\qrLzZEP.exe
  C:\Windows\System\qrLzZEP.exe
  2⤵
  PID:8284
- C:\Windows\System\niSUHdx.exe
  C:\Windows\System\niSUHdx.exe
  2⤵
  PID:8640
- C:\Windows\System\AUwljBd.exe
  C:\Windows\System\AUwljBd.exe
  2⤵
  PID:8304
- C:\Windows\System\VlWNATG.exe
  C:\Windows\System\VlWNATG.exe
  2⤵
  PID:8920
- C:\Windows\System\pHJCPsQ.exe
  C:\Windows\System\pHJCPsQ.exe
  2⤵
  PID:9228
- C:\Windows\System\rFdfvfJ.exe
  C:\Windows\System\rFdfvfJ.exe
  2⤵
  PID:9244
- C:\Windows\System\pHmiSuz.exe
  C:\Windows\System\pHmiSuz.exe
  2⤵
  PID:9284
- C:\Windows\System\UecxyvR.exe
  C:\Windows\System\UecxyvR.exe
  2⤵
  PID:9312
- C:\Windows\System\hWFCsPp.exe
  C:\Windows\System\hWFCsPp.exe
  2⤵
  PID:9328
- C:\Windows\System\aTmtsBY.exe
  C:\Windows\System\aTmtsBY.exe
  2⤵
  PID:9368
- C:\Windows\System\cmRIzDP.exe
  C:\Windows\System\cmRIzDP.exe
  2⤵
  PID:9396
- C:\Windows\System\TiWZXnK.exe
  C:\Windows\System\TiWZXnK.exe
  2⤵
  PID:9424
- C:\Windows\System\DHacNiJ.exe
  C:\Windows\System\DHacNiJ.exe
  2⤵
  PID:9440
- C:\Windows\System\MrEXrEc.exe
  C:\Windows\System\MrEXrEc.exe
  2⤵
  PID:9480
- C:\Windows\System\fkUkivd.exe
  C:\Windows\System\fkUkivd.exe
  2⤵
  PID:9504
- C:\Windows\System\pUoqgZl.exe
  C:\Windows\System\pUoqgZl.exe
  2⤵
  PID:9540
- C:\Windows\System\tSWeHUj.exe
  C:\Windows\System\tSWeHUj.exe
  2⤵
  PID:9568
- C:\Windows\System\PuBHRMY.exe
  C:\Windows\System\PuBHRMY.exe
  2⤵
  PID:9600
- C:\Windows\System\XGyrbFr.exe
  C:\Windows\System\XGyrbFr.exe
  2⤵
  PID:9628
- C:\Windows\System\FaBgwVF.exe
  C:\Windows\System\FaBgwVF.exe
  2⤵
  PID:9648
- C:\Windows\System\kcPdMYW.exe
  C:\Windows\System\kcPdMYW.exe
  2⤵
  PID:9672
- C:\Windows\System\FHFbJbQ.exe
  C:\Windows\System\FHFbJbQ.exe
  2⤵
  PID:9712
- C:\Windows\System\RYlevde.exe
  C:\Windows\System\RYlevde.exe
  2⤵
  PID:9740
- C:\Windows\System\HiPQKqw.exe
  C:\Windows\System\HiPQKqw.exe
  2⤵
  PID:9768
- C:\Windows\System\ozeRvSh.exe
  C:\Windows\System\ozeRvSh.exe
  2⤵
  PID:9796
- C:\Windows\System\cRfUBiW.exe
  C:\Windows\System\cRfUBiW.exe
  2⤵
  PID:9824
- C:\Windows\System\YlHVGmy.exe
  C:\Windows\System\YlHVGmy.exe
  2⤵
  PID:9852
- C:\Windows\System\DiOefRF.exe
  C:\Windows\System\DiOefRF.exe
  2⤵
  PID:9868
- C:\Windows\System\sYPnOJE.exe
  C:\Windows\System\sYPnOJE.exe
  2⤵
  PID:9908
- C:\Windows\System\LFsmJZo.exe
  C:\Windows\System\LFsmJZo.exe
  2⤵
  PID:9936
- C:\Windows\System\fKjrULv.exe
  C:\Windows\System\fKjrULv.exe
  2⤵
  PID:9964
- C:\Windows\System\GhGhUWw.exe
  C:\Windows\System\GhGhUWw.exe
  2⤵
  PID:9980
- C:\Windows\System\GrSHbvp.exe
  C:\Windows\System\GrSHbvp.exe
  2⤵
  PID:10008
- C:\Windows\System\ziDlcFk.exe
  C:\Windows\System\ziDlcFk.exe
  2⤵
  PID:10044
- C:\Windows\System\hFFAADy.exe
  C:\Windows\System\hFFAADy.exe
  2⤵
  PID:10064
- C:\Windows\System\nVOhLPY.exe
  C:\Windows\System\nVOhLPY.exe
  2⤵
  PID:10092
- C:\Windows\System\OZuuoKj.exe
  C:\Windows\System\OZuuoKj.exe
  2⤵
  PID:10124
- C:\Windows\System\NvNOqNS.exe
  C:\Windows\System\NvNOqNS.exe
  2⤵
  PID:10140
- C:\Windows\System\tcbmdpU.exe
  C:\Windows\System\tcbmdpU.exe
  2⤵
  PID:10188
- C:\Windows\System\EHtKaba.exe
  C:\Windows\System\EHtKaba.exe
  2⤵
  PID:10212
- C:\Windows\System\xknXyNM.exe
  C:\Windows\System\xknXyNM.exe
  2⤵
  PID:10232
- C:\Windows\System\KYDiAaD.exe
  C:\Windows\System\KYDiAaD.exe
  2⤵
  PID:9236
- C:\Windows\System\cXvmBzC.exe
  C:\Windows\System\cXvmBzC.exe
  2⤵
  PID:9320
- C:\Windows\System\YMyLwok.exe
  C:\Windows\System\YMyLwok.exe
  2⤵
  PID:9388
- C:\Windows\System\RkIpIgx.exe
  C:\Windows\System\RkIpIgx.exe
  2⤵
  PID:9472
- C:\Windows\System\uXpNvkz.exe
  C:\Windows\System\uXpNvkz.exe
  2⤵
  PID:9552
- C:\Windows\System\SOXruMX.exe
  C:\Windows\System\SOXruMX.exe
  2⤵
  PID:9612
- C:\Windows\System\mCOwSrY.exe
  C:\Windows\System\mCOwSrY.exe
  2⤵
  PID:9640
- C:\Windows\System\qwMpGto.exe
  C:\Windows\System\qwMpGto.exe
  2⤵
  PID:9736
- C:\Windows\System\SfyEvSK.exe
  C:\Windows\System\SfyEvSK.exe
  2⤵
  PID:9808
- C:\Windows\System\LpdlltY.exe
  C:\Windows\System\LpdlltY.exe
  2⤵
  PID:9892
- C:\Windows\System\RrDMrSB.exe
  C:\Windows\System\RrDMrSB.exe
  2⤵
  PID:9932
- C:\Windows\System\RlnwcOf.exe
  C:\Windows\System\RlnwcOf.exe
  2⤵
  PID:10000
- C:\Windows\System\axHNNmx.exe
  C:\Windows\System\axHNNmx.exe
  2⤵
  PID:10032
- C:\Windows\System\mKUSAOK.exe
  C:\Windows\System\mKUSAOK.exe
  2⤵
  PID:10112
- C:\Windows\System\uDIUafs.exe
  C:\Windows\System\uDIUafs.exe
  2⤵
  PID:10224
- C:\Windows\System\KpRRASM.exe
  C:\Windows\System\KpRRASM.exe
  2⤵
  PID:9224
- C:\Windows\System\hPiNIUh.exe
  C:\Windows\System\hPiNIUh.exe
  2⤵
  PID:9364
- C:\Windows\System\AfbfpKt.exe
  C:\Windows\System\AfbfpKt.exe
  2⤵
  PID:9532
- C:\Windows\System\bOyOdBi.exe
  C:\Windows\System\bOyOdBi.exe
  2⤵
  PID:9588
- C:\Windows\System\YCDsBAS.exe
  C:\Windows\System\YCDsBAS.exe
  2⤵
  PID:9780
- C:\Windows\System\UeebCDD.exe
  C:\Windows\System\UeebCDD.exe
  2⤵
  PID:9920
- C:\Windows\System\RqGTxuk.exe
  C:\Windows\System\RqGTxuk.exe
  2⤵
  PID:10076
- C:\Windows\System\kEruEKt.exe
  C:\Windows\System\kEruEKt.exe
  2⤵
  PID:10208
- C:\Windows\System\iNyMQkL.exe
  C:\Windows\System\iNyMQkL.exe
  2⤵
  PID:9592
- C:\Windows\System\YPLeKQY.exe
  C:\Windows\System\YPLeKQY.exe
  2⤵
  PID:9848
- C:\Windows\System\QruYcWg.exe
  C:\Windows\System\QruYcWg.exe
  2⤵
  PID:10176
- C:\Windows\System\GQPObtq.exe
  C:\Windows\System\GQPObtq.exe
  2⤵
  PID:9960
- C:\Windows\System\BcfuzeO.exe
  C:\Windows\System\BcfuzeO.exe
  2⤵
  PID:10244
- C:\Windows\System\CcMytIM.exe
  C:\Windows\System\CcMytIM.exe
  2⤵
  PID:10264
- C:\Windows\System\kcDwdtq.exe
  C:\Windows\System\kcDwdtq.exe
  2⤵
  PID:10304
- C:\Windows\System\hWzyDeu.exe
  C:\Windows\System\hWzyDeu.exe
  2⤵
  PID:10320
- C:\Windows\System\UyOFlVS.exe
  C:\Windows\System\UyOFlVS.exe
  2⤵
  PID:10348
- C:\Windows\System\YiqyoRy.exe
  C:\Windows\System\YiqyoRy.exe
  2⤵
  PID:10376
- C:\Windows\System\BepfeJT.exe
  C:\Windows\System\BepfeJT.exe
  2⤵
  PID:10408
- C:\Windows\System\wpBMbkZ.exe
  C:\Windows\System\wpBMbkZ.exe
  2⤵
  PID:10428
- C:\Windows\System\veSgqXY.exe
  C:\Windows\System\veSgqXY.exe
  2⤵
  PID:10468
- C:\Windows\System\OGTBjaq.exe
  C:\Windows\System\OGTBjaq.exe
  2⤵
  PID:10504
- C:\Windows\System\YgNClpT.exe
  C:\Windows\System\YgNClpT.exe
  2⤵
  PID:10532
- C:\Windows\System\GryFheF.exe
  C:\Windows\System\GryFheF.exe
  2⤵
  PID:10560
- C:\Windows\System\ZNlHPOG.exe
  C:\Windows\System\ZNlHPOG.exe
  2⤵
  PID:10588
- C:\Windows\System\hvrwbEz.exe
  C:\Windows\System\hvrwbEz.exe
  2⤵
  PID:10616
- C:\Windows\System\YUljzVh.exe
  C:\Windows\System\YUljzVh.exe
  2⤵
  PID:10632
- C:\Windows\System\NoRUQzH.exe
  C:\Windows\System\NoRUQzH.exe
  2⤵
  PID:10672
- C:\Windows\System\BRplCTH.exe
  C:\Windows\System\BRplCTH.exe
  2⤵
  PID:10688
- C:\Windows\System\ghaEAsC.exe
  C:\Windows\System\ghaEAsC.exe
  2⤵
  PID:10728
- C:\Windows\System\kpbaBgv.exe
  C:\Windows\System\kpbaBgv.exe
  2⤵
  PID:10756
- C:\Windows\System\cSMgEZm.exe
  C:\Windows\System\cSMgEZm.exe
  2⤵
  PID:10780
- C:\Windows\System\RLezplv.exe
  C:\Windows\System\RLezplv.exe
  2⤵
  PID:10812
- C:\Windows\System\yXLQsTG.exe
  C:\Windows\System\yXLQsTG.exe
  2⤵
  PID:10840
- C:\Windows\System\CNdjZTK.exe
  C:\Windows\System\CNdjZTK.exe
  2⤵
  PID:10868
- C:\Windows\System\gwmziff.exe
  C:\Windows\System\gwmziff.exe
  2⤵
  PID:10884
- C:\Windows\System\jyiZIZo.exe
  C:\Windows\System\jyiZIZo.exe
  2⤵
  PID:10912
- C:\Windows\System\NOFOIuN.exe
  C:\Windows\System\NOFOIuN.exe
  2⤵
  PID:10944
- C:\Windows\System\JvmdKPJ.exe
  C:\Windows\System\JvmdKPJ.exe
  2⤵
  PID:10968
- C:\Windows\System\Gmwpzle.exe
  C:\Windows\System\Gmwpzle.exe
  2⤵
  PID:10984
- C:\Windows\System\XGbvzQg.exe
  C:\Windows\System\XGbvzQg.exe
  2⤵
  PID:11024
- C:\Windows\System\cipZPdh.exe
  C:\Windows\System\cipZPdh.exe
  2⤵
  PID:11052
- C:\Windows\System\njToFHF.exe
  C:\Windows\System\njToFHF.exe
  2⤵
  PID:11092
- C:\Windows\System\MBzFDGC.exe
  C:\Windows\System\MBzFDGC.exe
  2⤵
  PID:11120
- C:\Windows\System\lkKDTHY.exe
  C:\Windows\System\lkKDTHY.exe
  2⤵
  PID:11148
- C:\Windows\System\dSCxmVf.exe
  C:\Windows\System\dSCxmVf.exe
  2⤵
  PID:11176
- C:\Windows\System\mjnAMwy.exe
  C:\Windows\System\mjnAMwy.exe
  2⤵
  PID:11204
- C:\Windows\System\RajAfwj.exe
  C:\Windows\System\RajAfwj.exe
  2⤵
  PID:11224
- C:\Windows\System\iOIPfjD.exe
  C:\Windows\System\iOIPfjD.exe
  2⤵
  PID:11260
- C:\Windows\System\PlaDwKc.exe
  C:\Windows\System\PlaDwKc.exe
  2⤵
  PID:10300
- C:\Windows\System\iAkhemk.exe
  C:\Windows\System\iAkhemk.exe
  2⤵
  PID:10364
- C:\Windows\System\vZAufUX.exe
  C:\Windows\System\vZAufUX.exe
  2⤵
  PID:10368
- C:\Windows\System\tvkbeOl.exe
  C:\Windows\System\tvkbeOl.exe
  2⤵
  PID:10456
- C:\Windows\System\EEkcvZF.exe
  C:\Windows\System\EEkcvZF.exe
  2⤵
  PID:10524
- C:\Windows\System\jlhLCPa.exe
  C:\Windows\System\jlhLCPa.exe
  2⤵
  PID:10576
- C:\Windows\System\MypDqui.exe
  C:\Windows\System\MypDqui.exe
  2⤵
  PID:10664
- C:\Windows\System\nUkZoZJ.exe
  C:\Windows\System\nUkZoZJ.exe
  2⤵
  PID:10720
- C:\Windows\System\NklguLr.exe
  C:\Windows\System\NklguLr.exe
  2⤵
  PID:10804
- C:\Windows\System\CuQvNMH.exe
  C:\Windows\System\CuQvNMH.exe
  2⤵
  PID:10880
- C:\Windows\System\pJoyEsF.exe
  C:\Windows\System\pJoyEsF.exe
  2⤵
  PID:10924
- C:\Windows\System\QAEEqTb.exe
  C:\Windows\System\QAEEqTb.exe
  2⤵
  PID:11008
- C:\Windows\System\HPqGmtu.exe
  C:\Windows\System\HPqGmtu.exe
  2⤵
  PID:11076
- C:\Windows\System\TNYXhYI.exe
  C:\Windows\System\TNYXhYI.exe
  2⤵
  PID:11112
- C:\Windows\System\lThhoqb.exe
  C:\Windows\System\lThhoqb.exe
  2⤵
  PID:11196
- C:\Windows\System\GQBQDVD.exe
  C:\Windows\System\GQBQDVD.exe
  2⤵
  PID:11252
- C:\Windows\System\qbFBKMR.exe
  C:\Windows\System\qbFBKMR.exe
  2⤵
  PID:10312
- C:\Windows\System\nbqgqOb.exe
  C:\Windows\System\nbqgqOb.exe
  2⤵
  PID:10492
- C:\Windows\System\yHoMeqz.exe
  C:\Windows\System\yHoMeqz.exe
  2⤵
  PID:10624
- C:\Windows\System\HAWgkBc.exe
  C:\Windows\System\HAWgkBc.exe
  2⤵
  PID:10860
- C:\Windows\System\eCeBdzY.exe
  C:\Windows\System\eCeBdzY.exe
  2⤵
  PID:10956
- C:\Windows\System\zGVXoSL.exe
  C:\Windows\System\zGVXoSL.exe
  2⤵
  PID:11140
- C:\Windows\System\JayBlny.exe
  C:\Windows\System\JayBlny.exe
  2⤵
  PID:10256
- C:\Windows\System\QRgUSsg.exe
  C:\Windows\System\QRgUSsg.exe
  2⤵
  PID:5076
- C:\Windows\System\qDWkaAL.exe
  C:\Windows\System\qDWkaAL.exe
  2⤵
  PID:10900
- C:\Windows\System\Sswhoqd.exe
  C:\Windows\System\Sswhoqd.exe
  2⤵
  PID:11160
- C:\Windows\System\XrqxHBr.exe
  C:\Windows\System\XrqxHBr.exe
  2⤵
  PID:10436
- C:\Windows\System\qJnDWuu.exe
  C:\Windows\System\qJnDWuu.exe
  2⤵
  PID:11232
- C:\Windows\System\WAfroqP.exe
  C:\Windows\System\WAfroqP.exe
  2⤵
  PID:11296
- C:\Windows\System\rpWePiE.exe
  C:\Windows\System\rpWePiE.exe
  2⤵
  PID:11336
- C:\Windows\System\ZIVhQXp.exe
  C:\Windows\System\ZIVhQXp.exe
  2⤵
  PID:11356
- C:\Windows\System\EvrGzvV.exe
  C:\Windows\System\EvrGzvV.exe
  2⤵
  PID:11380
- C:\Windows\System\TcHUfUT.exe
  C:\Windows\System\TcHUfUT.exe
  2⤵
  PID:11420
- C:\Windows\System\QMYNlWQ.exe
  C:\Windows\System\QMYNlWQ.exe
  2⤵
  PID:11448
- C:\Windows\System\ZXGjdce.exe
  C:\Windows\System\ZXGjdce.exe
  2⤵
  PID:11476
- C:\Windows\System\zsGtsFt.exe
  C:\Windows\System\zsGtsFt.exe
  2⤵
  PID:11492
- C:\Windows\System\fqeGXYU.exe
  C:\Windows\System\fqeGXYU.exe
  2⤵
  PID:11524
- C:\Windows\System\qjEUexA.exe
  C:\Windows\System\qjEUexA.exe
  2⤵
  PID:11576
- C:\Windows\System\tQPXHjF.exe
  C:\Windows\System\tQPXHjF.exe
  2⤵
  PID:11604
- C:\Windows\System\LaPXPIF.exe
  C:\Windows\System\LaPXPIF.exe
  2⤵
  PID:11640
- C:\Windows\System\cJfbrGV.exe
  C:\Windows\System\cJfbrGV.exe
  2⤵
  PID:11668
- C:\Windows\System\mXUifQh.exe
  C:\Windows\System\mXUifQh.exe
  2⤵
  PID:11704
- C:\Windows\System\RezULOl.exe
  C:\Windows\System\RezULOl.exe
  2⤵
  PID:11732
- C:\Windows\System\mVltjLG.exe
  C:\Windows\System\mVltjLG.exe
  2⤵
  PID:11760
- C:\Windows\System\qFSVjSO.exe
  C:\Windows\System\qFSVjSO.exe
  2⤵
  PID:11800
- C:\Windows\System\LWKUdmA.exe
  C:\Windows\System\LWKUdmA.exe
  2⤵
  PID:11828
- C:\Windows\System\CtFnCsm.exe
  C:\Windows\System\CtFnCsm.exe
  2⤵
  PID:11852
- C:\Windows\System\cVFIggH.exe
  C:\Windows\System\cVFIggH.exe
  2⤵
  PID:11872
- C:\Windows\System\VBZNhxV.exe
  C:\Windows\System\VBZNhxV.exe
  2⤵
  PID:11900
- C:\Windows\System\GqJwolv.exe
  C:\Windows\System\GqJwolv.exe
  2⤵
  PID:11924
- C:\Windows\System\hKTeyKv.exe
  C:\Windows\System\hKTeyKv.exe
  2⤵
  PID:11944
- C:\Windows\System\uYxAAjs.exe
  C:\Windows\System\uYxAAjs.exe
  2⤵
  PID:11992
- C:\Windows\System\CEcdHDT.exe
  C:\Windows\System\CEcdHDT.exe
  2⤵
  PID:12012
- C:\Windows\System\HDqfXgm.exe
  C:\Windows\System\HDqfXgm.exe
  2⤵
  PID:12052
- C:\Windows\System\IEVXXgV.exe
  C:\Windows\System\IEVXXgV.exe
  2⤵
  PID:12080
- C:\Windows\System\yKnurmw.exe
  C:\Windows\System\yKnurmw.exe
  2⤵
  PID:12108
- C:\Windows\System\mykpZml.exe
  C:\Windows\System\mykpZml.exe
  2⤵
  PID:12132
- C:\Windows\System\QHJCezq.exe
  C:\Windows\System\QHJCezq.exe
  2⤵
  PID:12152
- C:\Windows\System\sXGqQHo.exe
  C:\Windows\System\sXGqQHo.exe
  2⤵
  PID:12172
- C:\Windows\System\MCAogWc.exe
  C:\Windows\System\MCAogWc.exe
  2⤵
  PID:12208
- C:\Windows\System\unWBnYd.exe
  C:\Windows\System\unWBnYd.exe
  2⤵
  PID:12236
- C:\Windows\System\zuNWMTM.exe
  C:\Windows\System\zuNWMTM.exe
  2⤵
  PID:12264
- C:\Windows\System\UythtiS.exe
  C:\Windows\System\UythtiS.exe
  2⤵
  PID:11064
- C:\Windows\System\OuAZFhy.exe
  C:\Windows\System\OuAZFhy.exe
  2⤵
  PID:11312
- C:\Windows\System\DEWldHt.exe
  C:\Windows\System\DEWldHt.exe
  2⤵
  PID:11404
- C:\Windows\System\qSxurVT.exe
  C:\Windows\System\qSxurVT.exe
  2⤵
  PID:11464
- C:\Windows\System\eFDmFyA.exe
  C:\Windows\System\eFDmFyA.exe
  2⤵
  PID:11556
- C:\Windows\System\pypaKdI.exe
  C:\Windows\System\pypaKdI.exe
  2⤵
  PID:11600
- C:\Windows\System\HQqTnzQ.exe
  C:\Windows\System\HQqTnzQ.exe
  2⤵
  PID:11716
- C:\Windows\System\swoAoDd.exe
  C:\Windows\System\swoAoDd.exe
  2⤵
  PID:11776
- C:\Windows\System\UPUYRNS.exe
  C:\Windows\System\UPUYRNS.exe
  2⤵
  PID:2496
- C:\Windows\System\yBAtTAv.exe
  C:\Windows\System\yBAtTAv.exe
  2⤵
  PID:11864
- C:\Windows\System\TRdNHdK.exe
  C:\Windows\System\TRdNHdK.exe
  2⤵
  PID:11908
- C:\Windows\System\zQujRnX.exe
  C:\Windows\System\zQujRnX.exe
  2⤵
  PID:12008
- C:\Windows\System\hLmpDwA.exe
  C:\Windows\System\hLmpDwA.exe
  2⤵
  PID:12068
- C:\Windows\System\CmqIaSX.exe
  C:\Windows\System\CmqIaSX.exe
  2⤵
  PID:12124
- C:\Windows\System\aQYlLhl.exe
  C:\Windows\System\aQYlLhl.exe
  2⤵
  PID:12256
- C:\Windows\System\wzSxpwU.exe
  C:\Windows\System\wzSxpwU.exe
  2⤵
  PID:11324
- C:\Windows\System\fwVCbwL.exe
  C:\Windows\System\fwVCbwL.exe
  2⤵
  PID:11440
- C:\Windows\System\ApQidAI.exe
  C:\Windows\System\ApQidAI.exe
  2⤵
  PID:11696
- C:\Windows\System\KXFOmSU.exe
  C:\Windows\System\KXFOmSU.exe
  2⤵
  PID:11812
- C:\Windows\System\sVwPPBD.exe
  C:\Windows\System\sVwPPBD.exe
  2⤵
  PID:11964
- C:\Windows\System\xbIDeQD.exe
  C:\Windows\System\xbIDeQD.exe
  2⤵
  PID:12224
- C:\Windows\System\WBbZZTo.exe
  C:\Windows\System\WBbZZTo.exe
  2⤵
  PID:11376
- C:\Windows\System\ysWxEoL.exe
  C:\Windows\System\ysWxEoL.exe
  2⤵
  PID:11676
- C:\Windows\System\pKmYOEF.exe
  C:\Windows\System\pKmYOEF.exe
  2⤵
  PID:11888
- C:\Windows\System\kNxjfsj.exe
  C:\Windows\System\kNxjfsj.exe
  2⤵
  PID:11796
- C:\Windows\System\pWSSAXC.exe
  C:\Windows\System\pWSSAXC.exe
  2⤵
  PID:12296
- C:\Windows\System\YnlbsKw.exe
  C:\Windows\System\YnlbsKw.exe
  2⤵
  PID:12324
- C:\Windows\System\SDxRxGy.exe
  C:\Windows\System\SDxRxGy.exe
  2⤵
  PID:12348
- C:\Windows\System\gudcaTm.exe
  C:\Windows\System\gudcaTm.exe
  2⤵
  PID:12376
- C:\Windows\System\vJXhaPO.exe
  C:\Windows\System\vJXhaPO.exe
  2⤵
  PID:12428
- C:\Windows\System\RyYPDvX.exe
  C:\Windows\System\RyYPDvX.exe
  2⤵
  PID:12480
- C:\Windows\System\jJuFjcN.exe
  C:\Windows\System\jJuFjcN.exe
  2⤵
  PID:12500
- C:\Windows\System\DYKTpJA.exe
  C:\Windows\System\DYKTpJA.exe
  2⤵
  PID:12516
- C:\Windows\System\LyOBdpF.exe
  C:\Windows\System\LyOBdpF.exe
  2⤵
  PID:12544
- C:\Windows\System\VmeqDTO.exe
  C:\Windows\System\VmeqDTO.exe
  2⤵
  PID:12568
- C:\Windows\System\FDatQvt.exe
  C:\Windows\System\FDatQvt.exe
  2⤵
  PID:12620
- C:\Windows\System\GlYidRX.exe
  C:\Windows\System\GlYidRX.exe
  2⤵
  PID:12664
- C:\Windows\System\HzMOlVu.exe
  C:\Windows\System\HzMOlVu.exe
  2⤵
  PID:12696
- C:\Windows\System\lIwmftA.exe
  C:\Windows\System\lIwmftA.exe
  2⤵
  PID:12716
- C:\Windows\System\jSkbxSs.exe
  C:\Windows\System\jSkbxSs.exe
  2⤵
  PID:12756
- C:\Windows\System\aHjAJof.exe
  C:\Windows\System\aHjAJof.exe
  2⤵
  PID:12780
- C:\Windows\System\jZsWbhi.exe
  C:\Windows\System\jZsWbhi.exe
  2⤵
  PID:12816
- C:\Windows\System\jiwqNtO.exe
  C:\Windows\System\jiwqNtO.exe
  2⤵
  PID:12856
- C:\Windows\System\mQdjPSt.exe
  C:\Windows\System\mQdjPSt.exe
  2⤵
  PID:12904
- C:\Windows\System\RwyJbTy.exe
  C:\Windows\System\RwyJbTy.exe
  2⤵
  PID:12928
- C:\Windows\System\qpmpqxJ.exe
  C:\Windows\System\qpmpqxJ.exe
  2⤵
  PID:12996
- C:\Windows\System\KmiMOOb.exe
  C:\Windows\System\KmiMOOb.exe
  2⤵
  PID:13036
- C:\Windows\System\zuGiMhc.exe
  C:\Windows\System\zuGiMhc.exe
  2⤵
  PID:13060
- C:\Windows\System\rMRZtmS.exe
  C:\Windows\System\rMRZtmS.exe
  2⤵
  PID:13104
- C:\Windows\System\BwofrjN.exe
  C:\Windows\System\BwofrjN.exe
  2⤵
  PID:13128
- C:\Windows\System\DrkCQeI.exe
  C:\Windows\System\DrkCQeI.exe
  2⤵
  PID:13164
- C:\Windows\System\BdVnDdV.exe
  C:\Windows\System\BdVnDdV.exe
  2⤵
  PID:13200
- C:\Windows\System\OsytZoT.exe
  C:\Windows\System\OsytZoT.exe
  2⤵
  PID:13216
- C:\Windows\System\NRHczyG.exe
  C:\Windows\System\NRHczyG.exe
  2⤵
  PID:13260
- C:\Windows\System\hpruaHe.exe
  C:\Windows\System\hpruaHe.exe
  2⤵
  PID:13280
- C:\Windows\System\dfHftvC.exe
  C:\Windows\System\dfHftvC.exe
  2⤵
  PID:11860
- C:\Windows\System\ZYBFOHl.exe
  C:\Windows\System\ZYBFOHl.exe
  2⤵
  PID:12360
- C:\Windows\System\QsKnkLl.exe
  C:\Windows\System\QsKnkLl.exe
  2⤵
  PID:12456
- C:\Windows\System\AeADMko.exe
  C:\Windows\System\AeADMko.exe
  2⤵
  PID:12532
- C:\Windows\System\ToNILGs.exe
  C:\Windows\System\ToNILGs.exe
  2⤵
  PID:12612
- C:\Windows\System\ZuWfgxx.exe
  C:\Windows\System\ZuWfgxx.exe
  2⤵
  PID:12688
- C:\Windows\System\zgvtnes.exe
  C:\Windows\System\zgvtnes.exe
  2⤵
  PID:12796
- C:\Windows\System\qaNNozc.exe
  C:\Windows\System\qaNNozc.exe
  2⤵
  PID:12832
- C:\Windows\System\RAPtMhg.exe
  C:\Windows\System\RAPtMhg.exe
  2⤵
  PID:12924
- C:\Windows\System\hVegabS.exe
  C:\Windows\System\hVegabS.exe
  2⤵
  PID:13012
- C:\Windows\System\HkgOKTG.exe
  C:\Windows\System\HkgOKTG.exe
  2⤵
  PID:13124
- C:\Windows\System\AcncJCA.exe
  C:\Windows\System\AcncJCA.exe
  2⤵
  PID:13188
- C:\Windows\System\YrkSMkv.exe
  C:\Windows\System\YrkSMkv.exe
  2⤵
  PID:11352
- C:\Windows\System\pEACYWI.exe
  C:\Windows\System\pEACYWI.exe
  2⤵
  PID:13252
- C:\Windows\System\tAHFbmq.exe
  C:\Windows\System\tAHFbmq.exe
  2⤵
  PID:12344
- C:\Windows\System\JooMrIZ.exe
  C:\Windows\System\JooMrIZ.exe
  2⤵
  PID:12704
- C:\Windows\System\lbUGYpD.exe
  C:\Windows\System\lbUGYpD.exe
  2⤵
  PID:12900
- C:\Windows\System\ymGcdji.exe
  C:\Windows\System\ymGcdji.exe
  2⤵
  PID:3136
- C:\Windows\System\jgbftLC.exe
  C:\Windows\System\jgbftLC.exe
  2⤵
  PID:3364
- C:\Windows\System\eGHCKZF.exe
  C:\Windows\System\eGHCKZF.exe
  2⤵
  PID:13300
- C:\Windows\System\jEzyZCw.exe
  C:\Windows\System\jEzyZCw.exe
  2⤵
  PID:13244
- C:\Windows\System\ZhGpNOr.exe
  C:\Windows\System\ZhGpNOr.exe
  2⤵
  PID:12880
- C:\Windows\System\dAtNEPV.exe
  C:\Windows\System\dAtNEPV.exe
  2⤵
  PID:3980
- C:\Windows\System\DelDgnI.exe
  C:\Windows\System\DelDgnI.exe
  2⤵
  PID:13212
- C:\Windows\System\WpIjfCf.exe
  C:\Windows\System\WpIjfCf.exe
  2⤵
  PID:13176
- C:\Windows\System\mPlpRKM.exe
  C:\Windows\System\mPlpRKM.exe
  2⤵
  PID:13340
- C:\Windows\System\kvWrQeN.exe
  C:\Windows\System\kvWrQeN.exe
  2⤵
  PID:13368
- C:\Windows\System\PimMkhy.exe
  C:\Windows\System\PimMkhy.exe
  2⤵
  PID:13392
- C:\Windows\System\AhVKhXQ.exe
  C:\Windows\System\AhVKhXQ.exe
  2⤵
  PID:13420
- C:\Windows\System\ZWhucAq.exe
  C:\Windows\System\ZWhucAq.exe
  2⤵
  PID:13452
- C:\Windows\System\lGkDVbk.exe
  C:\Windows\System\lGkDVbk.exe
  2⤵
  PID:13472
- C:\Windows\System\gvwInoD.exe
  C:\Windows\System\gvwInoD.exe
  2⤵
  PID:13520
- C:\Windows\System\fefCVgn.exe
  C:\Windows\System\fefCVgn.exe
  2⤵
  PID:13540
- C:\Windows\System\qRSwZoW.exe
  C:\Windows\System\qRSwZoW.exe
  2⤵
  PID:13564
- C:\Windows\System\sUzuTSG.exe
  C:\Windows\System\sUzuTSG.exe
  2⤵
  PID:13612
- C:\Windows\System\mzSXFJp.exe
  C:\Windows\System\mzSXFJp.exe
  2⤵
  PID:13628
- C:\Windows\System\cnNTCxw.exe
  C:\Windows\System\cnNTCxw.exe
  2⤵
  PID:13660
- C:\Windows\System\FgaHveE.exe
  C:\Windows\System\FgaHveE.exe
  2⤵
  PID:13684
- C:\Windows\System\AckfMbp.exe
  C:\Windows\System\AckfMbp.exe
  2⤵
  PID:13712
- C:\Windows\System\ZeRqafV.exe
  C:\Windows\System\ZeRqafV.exe
  2⤵
  PID:13752
- C:\Windows\System\CFbURYZ.exe
  C:\Windows\System\CFbURYZ.exe
  2⤵
  PID:13768
- C:\Windows\System\kZHknON.exe
  C:\Windows\System\kZHknON.exe
  2⤵
  PID:13824
- C:\Windows\System\DflvKaW.exe
  C:\Windows\System\DflvKaW.exe
  2⤵
  PID:13840
- C:\Windows\System\ArVNCpd.exe
  C:\Windows\System\ArVNCpd.exe
  2⤵
  PID:13868
- C:\Windows\System\ohHEHII.exe
  C:\Windows\System\ohHEHII.exe
  2⤵
  PID:13884
- C:\Windows\System\rrzPczH.exe
  C:\Windows\System\rrzPczH.exe
  2⤵
  PID:13924
- C:\Windows\System\vFTgIjW.exe
  C:\Windows\System\vFTgIjW.exe
  2⤵
  PID:13948
- C:\Windows\System\KQtxPip.exe
  C:\Windows\System\KQtxPip.exe
  2⤵
  PID:13980
- C:\Windows\System\MkhjyRo.exe
  C:\Windows\System\MkhjyRo.exe
  2⤵
  PID:14008
- C:\Windows\System\xbDveEi.exe
  C:\Windows\System\xbDveEi.exe
  2⤵
  PID:14044
- C:\Windows\System\FZgzUWg.exe
  C:\Windows\System\FZgzUWg.exe
  2⤵
  PID:14084
- C:\Windows\System\uWyetyz.exe
  C:\Windows\System\uWyetyz.exe
  2⤵
  PID:14112
- C:\Windows\System\VOCbjdb.exe
  C:\Windows\System\VOCbjdb.exe
  2⤵
  PID:14156
- C:\Windows\System\hhuLBVC.exe
  C:\Windows\System\hhuLBVC.exe
  2⤵
  PID:14188
- C:\Windows\System\rZzSbYD.exe
  C:\Windows\System\rZzSbYD.exe
  2⤵
  PID:14208
- C:\Windows\System\JppBJPx.exe
  C:\Windows\System\JppBJPx.exe
  2⤵
  PID:14236
- C:\Windows\System\SNwkRZT.exe
  C:\Windows\System\SNwkRZT.exe
  2⤵
  PID:14252
- C:\Windows\System\higBPEo.exe
  C:\Windows\System\higBPEo.exe
  2⤵
  PID:14304
- C:\Windows\System\EZFRBRD.exe
  C:\Windows\System\EZFRBRD.exe
  2⤵
  PID:14328
- C:\Windows\System\ykkkNou.exe
  C:\Windows\System\ykkkNou.exe
  2⤵
  PID:13352
- C:\Windows\System\aeohvOc.exe
  C:\Windows\System\aeohvOc.exe
  2⤵
  PID:13408
- C:\Windows\System\MptYyvl.exe
  C:\Windows\System\MptYyvl.exe
  2⤵
  PID:13468
- C:\Windows\System\oeNUfDP.exe
  C:\Windows\System\oeNUfDP.exe
  2⤵
  PID:13580
- C:\Windows\System\rehaSGy.exe
  C:\Windows\System\rehaSGy.exe
  2⤵
  PID:13656
- C:\Windows\System\YyprCTt.exe
  C:\Windows\System\YyprCTt.exe
  2⤵
  PID:13724
- C:\Windows\System\gFodKti.exe
  C:\Windows\System\gFodKti.exe
  2⤵
  PID:13760
- C:\Windows\System\MfMbtMj.exe
  C:\Windows\System\MfMbtMj.exe
  2⤵
  PID:13836
- C:\Windows\System\GOKxyhv.exe
  C:\Windows\System\GOKxyhv.exe
  2⤵
  PID:13912
- C:\Windows\System\AjBLolD.exe
  C:\Windows\System\AjBLolD.exe
  2⤵
  PID:13992
- C:\Windows\System\LoAViJA.exe
  C:\Windows\System\LoAViJA.exe
  2⤵
  PID:12524
- C:\Windows\System\qJHctIL.exe
  C:\Windows\System\qJHctIL.exe
  2⤵
  PID:14124
- C:\Windows\System\rGgjFNw.exe
  C:\Windows\System\rGgjFNw.exe
  2⤵
  PID:14228
- C:\Windows\System\qVXpNjA.exe
  C:\Windows\System\qVXpNjA.exe
  2⤵
  PID:14296
- C:\Windows\System\ocZaMgv.exe
  C:\Windows\System\ocZaMgv.exe
  2⤵
  PID:14324
- C:\Windows\System\zXiOIsE.exe
  C:\Windows\System\zXiOIsE.exe
  2⤵
  PID:13508
- C:\Windows\System\BTdvuOW.exe
  C:\Windows\System\BTdvuOW.exe
  2⤵
  PID:13676
- C:\Windows\System\wJjwtOx.exe
  C:\Windows\System\wJjwtOx.exe
  2⤵
  PID:13748
- C:\Windows\System\sYNuBrg.exe
  C:\Windows\System\sYNuBrg.exe
  2⤵
  PID:13932
- C:\Windows\System\FBPybQk.exe
  C:\Windows\System\FBPybQk.exe
  2⤵
  PID:14020
- C:\Windows\System\cTcMTYi.exe
  C:\Windows\System\cTcMTYi.exe
  2⤵
  PID:14316
- C:\Windows\System\npKEaxX.exe
  C:\Windows\System\npKEaxX.exe
  2⤵
  PID:13648
- C:\Windows\System\HeFwZmE.exe
  C:\Windows\System\HeFwZmE.exe
  2⤵
  PID:13856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CDmLboz.exe

Filesize
2.2MB

MD5
89d5c20ff45d7482b8f93ba28a864c11

SHA1
7e6df31afbaeaa5816948c04df1ccb8c28fa9359

SHA256
ffbcba5d70d01d8eed69510f582408d6d64dbd540c69efbff3df9c0c69eb0f7b

SHA512
7401bdc4c6efeb03f49509bbea0d45a85f536431e3006813c9a6e8945c030fbc645f6b19ec382a4694bb81950a219789ee40dd3d88f167c6f737ad5d840bfbe2

Download Submit
C:\Windows\System\DrViRZi.exe

Filesize
2.2MB

MD5
dd4dde3cd546a36afe89bf29e9c65baa

SHA1
d148727cd4356eec3fe1fbc0b436485a946441ea

SHA256
c3e98aba814d52ee97839d0929cac17abb4b3995c134f4dacb65ecc55f47c028

SHA512
b60a16916a13f94e0e610855087f38c7d3772aae1429d6efe7b1b05cc0c1f96dbda24f9d05684ac54ca473a048b3e777c0fe1a1b67c1eff64dcdd421921142e3

Download Submit
C:\Windows\System\EqVLhCK.exe

Filesize
2.2MB

MD5
c5b946d8994cfeeb5af9803ade419052

SHA1
c0fc4df9623b6424fd92f0282ca9f63c29213de2

SHA256
83aa49e7bcda967dffe5b0ca90013981f004733834c3e7a99b95febb33220a33

SHA512
95fd7a70e0536f9127a68a6ca278f3153a765be637817e04cdf8c4bd117de2c40aaabcfd8a0fe4743e23af18899cd1e78511f810c26f0c97e8fffe0c27625bba

Download Submit
C:\Windows\System\GRisPuJ.exe

Filesize
2.2MB

MD5
64cd3ca43738d8c921db51b6a736f214

SHA1
46accfeff3123a1ece19a4eae53b55ceb6a652d7

SHA256
0e2235871d3bb5d48a80b8c6af50db2bb6fb568cd71bbf067ebcd40d01f6d66d

SHA512
56ce5a58b6907b7b9f6c2d5688bd8b86e56565288d9f2faf22e294264007ee82110731fd5db8b50404364988bc32205a14f83df9a74e33ac12ba8c3e67322319

Download Submit
C:\Windows\System\KeSrPKh.exe

Filesize
2.2MB

MD5
457d61bd99299df7feb1e758564f6a9e

SHA1
969cd48927d1e493ee2a0d09d28f9b67bd62fae9

SHA256
d8ecc90d8ca1f181aba02c4afeb63ef103bfbcd3f41ba272b4a78f9f3779c84c

SHA512
05519d5ea26330f2e6f5946d40b676143300c9459fc3a3631d7fd68f5ad53567e8373f62475885fa5b13cc1696383108268d6cd1018331a3a78030484b194e6b

Download Submit
C:\Windows\System\KtHyENK.exe

Filesize
2.2MB

MD5
8c85fe7321e69bb9123019059d6e84dc

SHA1
f2b5158cb390c9da3358682f8ddd4d457ab8efc2

SHA256
d01d362199fb87e624c58fea9a9ebac1c5429c8b3e82ef59c011efe85765bdc2

SHA512
0c8899cb5ae563248b2ec1edd2fe0dc63975c5e712ad20f710f02025dfda058eb38f04ec6f0304a42f79aa2edaa9a9b730d2a5d44708e265ab6cf1074b7df042

Download Submit
C:\Windows\System\QSQjvnp.exe

Filesize
2.2MB

MD5
0ebf8ffbe3c307e4bf591994f2cbdb86

SHA1
e872ef21726b67eb563719d053e3e78bb7c0d654

SHA256
923c91861fd7ce052aea1c8f762376589a2a30f41dd03e7ee19a09c3e4cbcfc7

SHA512
f19edbaf61052eaf512be08eb2f6a1e1878c2469312bffd89aa9b7cccbf4992d3bfcf79ee06c3d4dfdccdaecac2a7668dcc7ab2d6b98b35addcba958874d1ff2

Download Submit
C:\Windows\System\RTgoStl.exe

Filesize
2.2MB

MD5
f96f79692c3cd11a9cf8ece5f16903ca

SHA1
e66b0ff8d11af9f2f731434e478a415f9f70507f

SHA256
5857c03205d6ed98c97aac7ac7f02e335d31ef1b4e0c49459a228ced1c71f9aa

SHA512
60c3f0315d5b1a8455249dfd10e4dddb144d423aed02980113005881248df934f93320aa7461c0406689145c1084560454cfd38dfb3eaae1dfb6f07a3437cff3

Download Submit
C:\Windows\System\RaCWPvu.exe

Filesize
2.2MB

MD5
e61a2357541d1566fc32cf99982ac0c0

SHA1
54488eb7d5f7ef8d1393308779f0cc4a03a0eef3

SHA256
1a13886aed4f4838a69c81954f0904f393109afdf4c02b15506b39926ff11686

SHA512
1d07600742c450b99489d662051a0b895cfb34a1e8ea119b328201d97b3925371ca78afa3c3a3df209ca40fa3d8d723035b7f1d623e3409b073051061cfbefc3

Download Submit
C:\Windows\System\SMwIokF.exe

Filesize
2.2MB

MD5
14d0dcbb60768b3fa0135c7e9536ef5c

SHA1
63d2a0c0f1986447e1720633a93a0f733e0e2c08

SHA256
9bb944731c33ecf25590463ea17e4e18fd70e7fe91036068537fad7d2de37194

SHA512
393739589e413d7c70a7ac947a373ad9fe42ce4b05ba85dc3638c2ba4f147bcf5f3d9ae80d59164cdbf9658b45a722f7abe5e57535325e9214e03d2a215eaf40

Download Submit
C:\Windows\System\UEbwDhU.exe

Filesize
2.2MB

MD5
0f6d48b2c6b8a53d5362a6c505dfc3ef

SHA1
a11860359a26a3c5294e28b9ed182938b1bbbaa4

SHA256
5e0d711c92ecf664f35a7e5678c409df787859ab69a59cba217a998724a2e669

SHA512
27d18539dcc2f7fce62bf693f093b34fe3e7da2bcd1b64bfcf8d0fae1953835cb437f825b923eff20c657750fc32df8812027b161c57af2f0229cc3d1a496b5a

Download Submit
C:\Windows\System\VMbiGcp.exe

Filesize
2.2MB

MD5
95583052eb53eca069deb493f065b504

SHA1
53167fbea20c6cf0341e1e4051042cf5067febd1

SHA256
7c8212836112ef90f098fbf57dd9038deda3aec8acf85d87962b0a099185fc26

SHA512
d87c2454a4e3f4991d7cc9c975ba37ebfb1150d2646c9c2b4ae3790da7f8a28b1d80b5b3906d4fc5ca6c5e947af74d54afbc2e439bd9703df81e2fc69dc9ae22

Download Submit
C:\Windows\System\WbwWtyN.exe

Filesize
2.2MB

MD5
66639a6fcf76f39a9be24c7425f94c0f

SHA1
a375719dc70ae49e0730c2917d9a5df1cbbef857

SHA256
d691c9f8e1c3c09154661a2bfa0aa86c1ca772960f067cb03dd6dda0c392b177

SHA512
4120b864944952115a7898d35ebae5c60c6f98fbc6957205b3093b61d748ca36b68aef791ea795efb7b5320c26467905f7040f3ab0f496cb480fda2f15da297a

Download Submit
C:\Windows\System\XqMZRCY.exe

Filesize
2.2MB

MD5
480b54673712b1a2715f10fe7223ec3e

SHA1
cde5f3bbaede30d2d4f553432e009ffb0716d8fe

SHA256
ea4bae5dba112cd1f94b85bcb187c382627e9e3f88172df340e8656256cd678d

SHA512
2918f065279fde3b40cb690b537992adc45ad7c3b7a7b2337bdaae07b916bfb9c13b178d76a988be36e6e216872bd3c74f0971c58b2d54c6621019475b4a5453

Download Submit
C:\Windows\System\YCScGxz.exe

Filesize
2.2MB

MD5
abbda9c8d323b42f0b80d27d1f197758

SHA1
bd9012a090f7b0e8f3c5e42c2b3527d9f31b45c8

SHA256
9ecf8ab8e7dadf68bd84a4042e25444155ecb7b4335645d20acd52450b5fed94

SHA512
d2bb9afeeea2813e421dd089b88a117ffb96daafa7ddf6dd44f1bd2a9f6466b438f18ee144d0ef9c2f9595038003ad78804adfeaf0a4cd914d9714eb06ef3176

Download Submit
C:\Windows\System\YMhUQbn.exe

Filesize
2.2MB

MD5
35daaf2608585d224fa6a7d35384585a

SHA1
1c3771d78459a43e26e010a4069a5280a519c701

SHA256
85f2b01dc1e19fb2762b587f03164dbaa601d5680c1a82c64695ec8ceed0b3ea

SHA512
a6b843ab0af4ca69a72dff7be94d0b65f9607e1996de557487e46166f23a0f7a0466724e566cfabb91423169425f22646f40f80a141551be510e0d9f83756ae3

Download Submit
C:\Windows\System\YWjUOyL.exe

Filesize
2.2MB

MD5
a8c99c875aa81cb0116a2c67e5df4c72

SHA1
99f383baed0a23f65eba510c5a87415d446f5631

SHA256
19757d782da773faf08f3e9bab356fd926cca898337125ecbcd8c1b26d341520

SHA512
898bd4f7bbfe932569b331c8550c52c9eb7c23ff01a6f601e9bdef6b125eb336cc63258ba033dad48d73664d8a3c4f6608a3bddb2057f72ec8fd1ce0846875c4

Download Submit
C:\Windows\System\ZDzwoBT.exe

Filesize
2.2MB

MD5
b71198c57b214ad25db01350f2f45ee2

SHA1
baab95ff74a978808eafb7537029737170911cf0

SHA256
7494e170c268110bf5e9e46d3e8bc6b6d9723149283478482f2c627fb2434f4b

SHA512
dacb37ba903e6b801339a1eed0dd0c131bf444f1c33d5a12a4d9baac8333b9eb1485bbf54232d7fe055f6f31a0a413292fcdfad44166508f37bee6b60842fd03

Download Submit
C:\Windows\System\aygFjrS.exe

Filesize
2.2MB

MD5
0f9d5ade5032ef28710ca554f8f1e47f

SHA1
fadef3eaed16b5c5408344bb43c643e800419b23

SHA256
d93b494e8d72dc867a079b754c4359f954482ecf2920cbdd794b2ec80c231ee4

SHA512
c70d10f526695e0ab9657fdc2bfc652e43c9aea5eb1e91f77caae6ec900b679b16dd7eb6e614bc1239cf211c26fb13aba6d084c6e82d5408ab84d580b10cf632

Download Submit
C:\Windows\System\bdfdapx.exe

Filesize
2.2MB

MD5
5cf53dbcc051562604ef12a2a88fccfe

SHA1
bfe3fce2b12fa5ab77a35cf5a1cc077f0beae4ad

SHA256
44cb8613322fd242ba993b42c770d6847374cd18f634b5b32b9c62990f8418c3

SHA512
23360aaeeb3bcba244f2d8767f5340e61d3e56f8bc5355fc148491eb6cce6f48be0f356d1016441a4c8c98e51f75efbb7df676acf55c458d9528d73917d5c041

Download Submit
C:\Windows\System\cKUrTTR.exe

Filesize
2.2MB

MD5
1d7ec06f4789fbe53c1516cccd68ae71

SHA1
a34e8ab82f78c6ab4b40fad5d20b6133496ed358

SHA256
b7b17422826c2c9763c19a5c152c2c9fada00045e893530d590f0965589094a1

SHA512
4e45b84201cb8bc1c8abc329b695b5474f81ef69cf69d2c251b4be04a40a3a869627ebf40b357036c01397ee09e3b1cd753c756524bcfc4b0dabfd9b63c30b7b

Download Submit
C:\Windows\System\dGMdZpB.exe

Filesize
2.2MB

MD5
1c50bec4c1258ce124a626c81b42a417

SHA1
8dcb7d4d212fc167913c6ba9dde1799c55b34f8e

SHA256
2c40c10d081e762f9407af92ba290345498e1b1cabc6063e0745016c9cc3c23b

SHA512
691e51b67cbc7a39f666e329e608b529fe34fc7228f2c26c36e0c3f1d3259d67303c8237d6f66852b12f74cfb3995c566f96c6e16a3ad2bca25a9a6f3c1f740b

Download Submit
C:\Windows\System\dGptNOl.exe

Filesize
2.2MB

MD5
63f27f709487a4e5ca2075c61b2ba760

SHA1
846ed8db7c9e212a06017396ac758c5e0c646fa4

SHA256
f0fa33f777ac12ba0050d52dc2ef35d630a38d3cd8567e9196ab772cf1b1d752

SHA512
1970450789cf7e709718df6bb76396cd1bb215e7d701a5aaf6e20a72d0a2aec3e9b1c21fe44e7b0bb7e188941b6923ec937765a29f5b4cb0e0e8443478af598f

Download Submit
C:\Windows\System\eeLJYjA.exe

Filesize
2.2MB

MD5
04bce8c34ace86b55b90294cd54678b1

SHA1
d07c93c01d890544af10ce161e53ea087168eca6

SHA256
1d5dddf4712b88a90d5296d398e8b49c6d68c37cd72fad6bc285adfd1ea64db1

SHA512
8b7f342f1e00915b0451727a7b609baa6c06a30f33aaf91ba55359ca3b182256d84583badd4123610525740920151fda4b3f3bdb4e27c1ff0ae6c5a2c400c7bc

Download Submit
C:\Windows\System\fnXbNku.exe

Filesize
2.2MB

MD5
9d39864b57fa4049fc462c9274770d1d

SHA1
81717bf9fadc99dd183933918a95a4ef05860ad9

SHA256
9e061d6ec1f605fbd73a67291c9cdaa5099dd360e20dd59a2ef6495349284d9a

SHA512
68b56b639497b04f15f7b314c3fe6969a6e0232d9ebdb275c3f181655bf24889ecca1583daacb97480dbbaa68406f3d1cff83f69afff0adcad5bab5cb95ae64c

Download Submit
C:\Windows\System\fqEsMcr.exe

Filesize
2.2MB

MD5
9e745ae9428b02c26eb2a465099bddb7

SHA1
7a03a68313ea6f9078334a559496e20a1000b6fc

SHA256
ef47a2f89849dfd1d9a1b502a6612a6f8a4f47a47f0bc8452b914a8d5a228113

SHA512
9b77df4bc158634b7d56424887c96aecccc7cbce58225168ab363195397d2db4e8ebb66316750a4d6040d6a525e046af893083897b671c52eeed845d21b90fe4

Download Submit
C:\Windows\System\jbYFiTn.exe

Filesize
2.2MB

MD5
ddada15da9b5540da88afbca74ba9b87

SHA1
95768ed5bd8bf5b5b632ec913f57094764a2f975

SHA256
376fb706b5d6d92110ce36cf33b3aae5e3e9c59412a53a130c96df420805993a

SHA512
47ea870b857224414b39e9e5569360715df316052272a60b625d8eb58b64492a788295c497b91accf664845f908072e5e9fb69e0c9ccb6e0df5998467702c67c

Download Submit
C:\Windows\System\kYRkWjs.exe

Filesize
2.2MB

MD5
d8fc414cd290577b0193953809e5a1a1

SHA1
c86fced4e94ebd1d48fe1012f4c821394b37f542

SHA256
b68962647f5fc087c872c864c9e1273fed1b06f74899b2053e86f4fb2adeb27b

SHA512
5120ab4a42301416da67d0c0f4623608dec84d89ad48a68c7347f5cbd55d2a5d20e5c679259f0f784ddb90b00bdae03c9b60a634c3db664bbebb9f822c8a4944

Download Submit
C:\Windows\System\nBiHkwg.exe

Filesize
2.2MB

MD5
1c5faa3b6c61ca47a3750dd49749832e

SHA1
5750ea942124f97a9ab0b3df930a8081e0f56394

SHA256
a42b589cf00ed1da442b0a8773a4076f38e982baac45822ad3654ae164cde4c9

SHA512
c3c0a806b9208b8c032268d9c8e156add66ddb235467ca2df475e3785b47cbfdfec1c334050f3324b6d0721ca3fc219be1e6933270194c3a5dbfef8196f20023

Download Submit
C:\Windows\System\ngYHdOC.exe

Filesize
2.2MB

MD5
a15fa4414a3d72fcf759c0f3f441028d

SHA1
b1f516eed7717b55a2a80a24f3bad8a668f08708

SHA256
02264e47a9fbed6454017d393a09b98cded60b807dd537ed7c36db2829a4881b

SHA512
b87e38647d942a4a75a77760fe19f8c9af96893fe0c14ce8127c2ecbf168e491c039df590bc44c9333af03b79b82fcc6c76ceffa214c126968f10226bccf89db

Download Submit
C:\Windows\System\npqEcCO.exe

Filesize
2.2MB

MD5
ce6a16a48a383bd46cc18b61b09fbb4e

SHA1
c4e7f2f718816dae9b6ed0d46e6c4cbf657a7619

SHA256
12f187c6a7e753eebe5cbd3d38272d5f441ec27bfdc86477814cd345c8f8aea7

SHA512
98676bcadecb0f781c8af03502edab336ed678679b45c3494448cc52683066179d41ee9f6e427eae6d01e0edddcc4b1b4ba8ba29abfe39c92c927634337fba4c

Download Submit
C:\Windows\System\pWXTJPX.exe

Filesize
2.2MB

MD5
8e715e885039ca0484623cda416cdcf6

SHA1
de3dc28ef0b5a87976de4fdfefde658a7e9c0ede

SHA256
84380de40143a1392d0f7d748118f609926077b6e294941234d8a649b9e7d2ef

SHA512
c5c15a711b56bc987a8f32504f401428e7458e9f5d8f706e2936cd920b44577a523e9534d4e120835a4804ad69916179900e0808f929b5efc58fd26549aec63f

Download Submit
C:\Windows\System\sYurkNr.exe

Filesize
2.2MB

MD5
6c09933c60987e417d1d0a2d69361f58

SHA1
ddb4240beca86898fde0c784ea577ea02753ea55

SHA256
ecd03aff3767d1989273cc43127fbfb4ead4f6d04ce98f60259d1fdadc0f6678

SHA512
bd27f64cb0e7a956781c24a209f0e62e3d02db80dca9af99a60ed913078cd3a5e9c77e8290e4818c1d36fb481caf0bb3db648c4b95c277e58621cbbfb50bdcab

Download Submit
memory/400-792-0x00007FF7C6170000-0x00007FF7C64C4000-memory.dmp

Filesize
3.3MB

Download
memory/400-2128-0x00007FF7C6170000-0x00007FF7C64C4000-memory.dmp

Filesize
3.3MB

Download
memory/436-828-0x00007FF75FAC0000-0x00007FF75FE14000-memory.dmp

Filesize
3.3MB

Download
memory/436-2118-0x00007FF75FAC0000-0x00007FF75FE14000-memory.dmp

Filesize
3.3MB

Download
memory/544-2115-0x00007FF756470000-0x00007FF7567C4000-memory.dmp

Filesize
3.3MB

Download
memory/544-745-0x00007FF756470000-0x00007FF7567C4000-memory.dmp

Filesize
3.3MB

Download
memory/724-2134-0x00007FF758210000-0x00007FF758564000-memory.dmp

Filesize
3.3MB

Download
memory/724-753-0x00007FF758210000-0x00007FF758564000-memory.dmp

Filesize
3.3MB

Download
memory/768-2108-0x00007FF6AEEA0000-0x00007FF6AF1F4000-memory.dmp

Filesize
3.3MB

Download
memory/768-31-0x00007FF6AEEA0000-0x00007FF6AF1F4000-memory.dmp

Filesize
3.3MB

Download
memory/828-743-0x00007FF6F0540000-0x00007FF6F0894000-memory.dmp

Filesize
3.3MB

Download
memory/828-2111-0x00007FF6F0540000-0x00007FF6F0894000-memory.dmp

Filesize
3.3MB

Download
memory/1012-2130-0x00007FF61A030000-0x00007FF61A384000-memory.dmp

Filesize
3.3MB

Download
memory/1012-776-0x00007FF61A030000-0x00007FF61A384000-memory.dmp

Filesize
3.3MB

Download
memory/1136-744-0x00007FF741F70000-0x00007FF7422C4000-memory.dmp

Filesize
3.3MB

Download
memory/1136-2113-0x00007FF741F70000-0x00007FF7422C4000-memory.dmp

Filesize
3.3MB

Download
memory/1172-833-0x00007FF687800000-0x00007FF687B54000-memory.dmp

Filesize
3.3MB

Download
memory/1172-2120-0x00007FF687800000-0x00007FF687B54000-memory.dmp

Filesize
3.3MB

Download
memory/1456-2104-0x00007FF797F80000-0x00007FF7982D4000-memory.dmp

Filesize
3.3MB

Download
memory/1456-2117-0x00007FF797F80000-0x00007FF7982D4000-memory.dmp

Filesize
3.3MB

Download
memory/1456-35-0x00007FF797F80000-0x00007FF7982D4000-memory.dmp

Filesize
3.3MB

Download
memory/1516-24-0x00007FF6F51E0000-0x00007FF6F5534000-memory.dmp

Filesize
3.3MB

Download
memory/1516-2109-0x00007FF6F51E0000-0x00007FF6F5534000-memory.dmp

Filesize
3.3MB

Download
memory/1768-2119-0x00007FF638630000-0x00007FF638984000-memory.dmp

Filesize
3.3MB

Download
memory/1768-832-0x00007FF638630000-0x00007FF638984000-memory.dmp

Filesize
3.3MB

Download
memory/2008-12-0x00007FF7F5820000-0x00007FF7F5B74000-memory.dmp

Filesize
3.3MB

Download
memory/2008-2107-0x00007FF7F5820000-0x00007FF7F5B74000-memory.dmp

Filesize
3.3MB

Download
memory/2076-773-0x00007FF77AF60000-0x00007FF77B2B4000-memory.dmp

Filesize
3.3MB

Download
memory/2076-2131-0x00007FF77AF60000-0x00007FF77B2B4000-memory.dmp

Filesize
3.3MB

Download
memory/2220-2129-0x00007FF608E70000-0x00007FF6091C4000-memory.dmp

Filesize
3.3MB

Download
memory/2220-786-0x00007FF608E70000-0x00007FF6091C4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-39-0x00007FF79CCA0000-0x00007FF79CFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-2105-0x00007FF79CCA0000-0x00007FF79CFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-2114-0x00007FF79CCA0000-0x00007FF79CFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2908-2132-0x00007FF634AE0000-0x00007FF634E34000-memory.dmp

Filesize
3.3MB

Download
memory/2908-765-0x00007FF634AE0000-0x00007FF634E34000-memory.dmp

Filesize
3.3MB

Download
memory/3164-801-0x00007FF7D98F0000-0x00007FF7D9C44000-memory.dmp

Filesize
3.3MB

Download
memory/3164-2126-0x00007FF7D98F0000-0x00007FF7D9C44000-memory.dmp

Filesize
3.3MB

Download
memory/3168-2123-0x00007FF67FC50000-0x00007FF67FFA4000-memory.dmp

Filesize
3.3MB

Download
memory/3168-812-0x00007FF67FC50000-0x00007FF67FFA4000-memory.dmp

Filesize
3.3MB

Download
memory/3708-747-0x00007FF6BB6D0000-0x00007FF6BBA24000-memory.dmp

Filesize
3.3MB

Download
memory/3708-2116-0x00007FF6BB6D0000-0x00007FF6BBA24000-memory.dmp

Filesize
3.3MB

Download
memory/3804-30-0x00007FF726900000-0x00007FF726C54000-memory.dmp

Filesize
3.3MB

Download
memory/3804-2110-0x00007FF726900000-0x00007FF726C54000-memory.dmp

Filesize
3.3MB

Download
memory/3892-2133-0x00007FF600850000-0x00007FF600BA4000-memory.dmp

Filesize
3.3MB

Download
memory/3892-758-0x00007FF600850000-0x00007FF600BA4000-memory.dmp

Filesize
3.3MB

Download
memory/4188-2106-0x00007FF663D30000-0x00007FF664084000-memory.dmp

Filesize
3.3MB

Download
memory/4188-46-0x00007FF663D30000-0x00007FF664084000-memory.dmp

Filesize
3.3MB

Download
memory/4188-2112-0x00007FF663D30000-0x00007FF664084000-memory.dmp

Filesize
3.3MB

Download
memory/4320-2124-0x00007FF707A70000-0x00007FF707DC4000-memory.dmp

Filesize
3.3MB

Download
memory/4320-809-0x00007FF707A70000-0x00007FF707DC4000-memory.dmp

Filesize
3.3MB

Download
memory/4632-795-0x00007FF655650000-0x00007FF6559A4000-memory.dmp

Filesize
3.3MB

Download
memory/4632-2127-0x00007FF655650000-0x00007FF6559A4000-memory.dmp

Filesize
3.3MB

Download
memory/4696-0-0x00007FF6EB2F0000-0x00007FF6EB644000-memory.dmp

Filesize
3.3MB

Download
memory/4696-1-0x0000020FC0C10000-0x0000020FC0C20000-memory.dmp

Filesize
64KB

Download
memory/4720-2122-0x00007FF757680000-0x00007FF7579D4000-memory.dmp

Filesize
3.3MB

Download
memory/4720-814-0x00007FF757680000-0x00007FF7579D4000-memory.dmp

Filesize
3.3MB

Download
memory/4792-784-0x00007FF7B6290000-0x00007FF7B65E4000-memory.dmp

Filesize
3.3MB

Download
memory/4792-2135-0x00007FF7B6290000-0x00007FF7B65E4000-memory.dmp

Filesize
3.3MB

Download
memory/4800-819-0x00007FF6CB910000-0x00007FF6CBC64000-memory.dmp

Filesize
3.3MB

Download
memory/4800-2121-0x00007FF6CB910000-0x00007FF6CBC64000-memory.dmp

Filesize
3.3MB

Download
memory/4884-2125-0x00007FF7CF9D0000-0x00007FF7CFD24000-memory.dmp

Filesize
3.3MB

Download
memory/4884-807-0x00007FF7CF9D0000-0x00007FF7CFD24000-memory.dmp

Filesize
3.3MB

Download