xmrig | 4e4ecc99fb0979c2e8017dc599564311606c49488e3a174a516d32e0305d11b1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
Size

1.9MB
MD5

4d20907d4bef92c9ab8f669bc7b626a0
SHA1

82f46731cdf18354070426b6ab42ab18fa02876a
SHA256

4e4ecc99fb0979c2e8017dc599564311606c49488e3a174a516d32e0305d11b1
SHA512

36e021ac30845efca13b4177712131f8373606d36ddabccf30cebd15c28ae104273bdabfa10b70c535e457e3948c836810f0da54246605cbae5db2b4d02db8fc
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87N6:BemTLkNdfE0pZrN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3700-0-0x00007FF719E00000-0x00007FF71A154000-memory.dmp	xmrig
behavioral2/files/0x0009000000023400-4.dat	xmrig
behavioral2/files/0x0007000000023408-15.dat	xmrig
behavioral2/files/0x0007000000023409-8.dat	xmrig
behavioral2/memory/2924-33-0x00007FF796C10000-0x00007FF796F64000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-30.dat	xmrig
behavioral2/files/0x000700000002340f-45.dat	xmrig
behavioral2/files/0x000700000002340c-27.dat	xmrig
behavioral2/files/0x000700000002340e-40.dat	xmrig
behavioral2/files/0x000700000002340b-24.dat	xmrig
behavioral2/files/0x000700000002340a-22.dat	xmrig
behavioral2/memory/3016-16-0x00007FF6FF780000-0x00007FF6FFAD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-49.dat	xmrig
behavioral2/files/0x000700000002341d-99.dat	xmrig
behavioral2/files/0x0007000000023414-125.dat	xmrig
behavioral2/files/0x0007000000023416-148.dat	xmrig
behavioral2/files/0x0007000000023420-162.dat	xmrig
behavioral2/memory/2604-179-0x00007FF778BC0000-0x00007FF778F14000-memory.dmp	xmrig
behavioral2/memory/4372-185-0x00007FF63B080000-0x00007FF63B3D4000-memory.dmp	xmrig
behavioral2/memory/4640-194-0x00007FF6DD520000-0x00007FF6DD874000-memory.dmp	xmrig
behavioral2/memory/1164-193-0x00007FF6E2330000-0x00007FF6E2684000-memory.dmp	xmrig
behavioral2/memory/916-192-0x00007FF6E7A50000-0x00007FF6E7DA4000-memory.dmp	xmrig
behavioral2/memory/212-191-0x00007FF7EEAD0000-0x00007FF7EEE24000-memory.dmp	xmrig
behavioral2/memory/3820-190-0x00007FF764A60000-0x00007FF764DB4000-memory.dmp	xmrig
behavioral2/memory/3056-189-0x00007FF6599D0000-0x00007FF659D24000-memory.dmp	xmrig
behavioral2/memory/1280-188-0x00007FF771E90000-0x00007FF7721E4000-memory.dmp	xmrig
behavioral2/memory/4548-187-0x00007FF76F710000-0x00007FF76FA64000-memory.dmp	xmrig
behavioral2/memory/3648-186-0x00007FF7F0060000-0x00007FF7F03B4000-memory.dmp	xmrig
behavioral2/memory/736-184-0x00007FF7E6740000-0x00007FF7E6A94000-memory.dmp	xmrig
behavioral2/memory/2512-183-0x00007FF654F50000-0x00007FF6552A4000-memory.dmp	xmrig
behavioral2/memory/2204-182-0x00007FF790380000-0x00007FF7906D4000-memory.dmp	xmrig
behavioral2/memory/1540-181-0x00007FF67C200000-0x00007FF67C554000-memory.dmp	xmrig
behavioral2/memory/756-180-0x00007FF635620000-0x00007FF635974000-memory.dmp	xmrig
behavioral2/memory/408-178-0x00007FF665DC0000-0x00007FF666114000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-174.dat	xmrig
behavioral2/files/0x0007000000023425-172.dat	xmrig
behavioral2/memory/2564-171-0x00007FF7718C0000-0x00007FF771C14000-memory.dmp	xmrig
behavioral2/memory/4008-170-0x00007FF7D9C10000-0x00007FF7D9F64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-168.dat	xmrig
behavioral2/files/0x0007000000023423-166.dat	xmrig
behavioral2/files/0x0007000000023422-164.dat	xmrig
behavioral2/files/0x000700000002341f-160.dat	xmrig
behavioral2/memory/3284-159-0x00007FF79E330000-0x00007FF79E684000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-158.dat	xmrig
behavioral2/files/0x000700000002341e-156.dat	xmrig
behavioral2/files/0x0007000000023415-154.dat	xmrig
behavioral2/files/0x0007000000023413-152.dat	xmrig
behavioral2/memory/3760-146-0x00007FF71FB10000-0x00007FF71FE64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-137.dat	xmrig
behavioral2/files/0x000700000002341a-131.dat	xmrig
behavioral2/memory/4792-129-0x00007FF689B60000-0x00007FF689EB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-108.dat	xmrig
behavioral2/files/0x0007000000023419-106.dat	xmrig
behavioral2/files/0x000700000002341b-103.dat	xmrig
behavioral2/memory/1228-101-0x00007FF73BD00000-0x00007FF73C054000-memory.dmp	xmrig
behavioral2/memory/2432-100-0x00007FF78E110000-0x00007FF78E464000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-97.dat	xmrig
behavioral2/files/0x000700000002341c-96.dat	xmrig
behavioral2/files/0x0007000000023410-91.dat	xmrig
behavioral2/memory/468-81-0x00007FF62C420000-0x00007FF62C774000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-76.dat	xmrig
behavioral2/memory/3780-74-0x00007FF708CE0000-0x00007FF709034000-memory.dmp	xmrig
behavioral2/memory/3580-53-0x00007FF794E10000-0x00007FF795164000-memory.dmp	xmrig
behavioral2/memory/3700-2092-0x00007FF719E00000-0x00007FF71A154000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3016	hCwyIPU.exe
2924	UPBtDtq.exe
3056	PtCdhPq.exe
3580	yxVvTEe.exe
3780	eeqrhpL.exe
468	UmAdQPn.exe
2432	VYjpcii.exe
3820	OZWdvau.exe
1228	jPyzjSN.exe
4792	qQlTgAe.exe
3760	YWUKqsA.exe
212	EqxGuUm.exe
3284	EijDYak.exe
4008	zLoHquR.exe
916	lwnLqPe.exe
1164	uLyneFY.exe
2564	rKUdkfX.exe
408	FpDtyOC.exe
2604	XFKgrps.exe
756	dKbWCfH.exe
1540	CICozfF.exe
2204	BuVgtIQ.exe
2512	OZMadEr.exe
4640	jXMVWKq.exe
736	pDCQTLp.exe
4372	IpjLcQs.exe
3648	kIsHmyx.exe
4548	WivsiTp.exe
1280	QPQzlIl.exe
5040	omgMZlo.exe
3884	epNLpQM.exe
4840	GjKbnjd.exe
4128	nyPVlcm.exe
4480	mVkAipX.exe
4276	HdBDfep.exe
3040	wCWdANC.exe
836	SiNUzcP.exe
4040	uqrYFtW.exe
4036	tquRjNh.exe
4076	LufvrJp.exe
3992	tvrHKbr.exe
232	lEQqDVX.exe
4896	fGlOqoA.exe
2296	ZCGzmrb.exe
2760	wVoLNqa.exe
4232	arHVuhN.exe
4820	VJErbAO.exe
660	kcBVmqw.exe
1596	ugGLUEZ.exe
4868	JUjUREQ.exe
1008	iKskipe.exe
2412	HUmSMJo.exe
4444	uKhqFkv.exe
4496	qpglCJP.exe
4720	YlMKwpP.exe
1176	kJmdMBL.exe
3712	enxbfUr.exe
3684	GzjblFQ.exe
5052	KyOfQUF.exe
5036	ICTLpWo.exe
2104	rZmvVsC.exe
3336	JRuuPDL.exe
244	Ovdcfym.exe
3216	PMEZfeV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3700-0-0x00007FF719E00000-0x00007FF71A154000-memory.dmp	upx
behavioral2/files/0x0009000000023400-4.dat	upx
behavioral2/files/0x0007000000023408-15.dat	upx
behavioral2/files/0x0007000000023409-8.dat	upx
behavioral2/memory/2924-33-0x00007FF796C10000-0x00007FF796F64000-memory.dmp	upx
behavioral2/files/0x000700000002340d-30.dat	upx
behavioral2/files/0x000700000002340f-45.dat	upx
behavioral2/files/0x000700000002340c-27.dat	upx
behavioral2/files/0x000700000002340e-40.dat	upx
behavioral2/files/0x000700000002340b-24.dat	upx
behavioral2/files/0x000700000002340a-22.dat	upx
behavioral2/memory/3016-16-0x00007FF6FF780000-0x00007FF6FFAD4000-memory.dmp	upx
behavioral2/files/0x0007000000023411-49.dat	upx
behavioral2/files/0x000700000002341d-99.dat	upx
behavioral2/files/0x0007000000023414-125.dat	upx
behavioral2/files/0x0007000000023416-148.dat	upx
behavioral2/files/0x0007000000023420-162.dat	upx
behavioral2/memory/2604-179-0x00007FF778BC0000-0x00007FF778F14000-memory.dmp	upx
behavioral2/memory/4372-185-0x00007FF63B080000-0x00007FF63B3D4000-memory.dmp	upx
behavioral2/memory/4640-194-0x00007FF6DD520000-0x00007FF6DD874000-memory.dmp	upx
behavioral2/memory/1164-193-0x00007FF6E2330000-0x00007FF6E2684000-memory.dmp	upx
behavioral2/memory/916-192-0x00007FF6E7A50000-0x00007FF6E7DA4000-memory.dmp	upx
behavioral2/memory/212-191-0x00007FF7EEAD0000-0x00007FF7EEE24000-memory.dmp	upx
behavioral2/memory/3820-190-0x00007FF764A60000-0x00007FF764DB4000-memory.dmp	upx
behavioral2/memory/3056-189-0x00007FF6599D0000-0x00007FF659D24000-memory.dmp	upx
behavioral2/memory/1280-188-0x00007FF771E90000-0x00007FF7721E4000-memory.dmp	upx
behavioral2/memory/4548-187-0x00007FF76F710000-0x00007FF76FA64000-memory.dmp	upx
behavioral2/memory/3648-186-0x00007FF7F0060000-0x00007FF7F03B4000-memory.dmp	upx
behavioral2/memory/736-184-0x00007FF7E6740000-0x00007FF7E6A94000-memory.dmp	upx
behavioral2/memory/2512-183-0x00007FF654F50000-0x00007FF6552A4000-memory.dmp	upx
behavioral2/memory/2204-182-0x00007FF790380000-0x00007FF7906D4000-memory.dmp	upx
behavioral2/memory/1540-181-0x00007FF67C200000-0x00007FF67C554000-memory.dmp	upx
behavioral2/memory/756-180-0x00007FF635620000-0x00007FF635974000-memory.dmp	upx
behavioral2/memory/408-178-0x00007FF665DC0000-0x00007FF666114000-memory.dmp	upx
behavioral2/files/0x0007000000023426-174.dat	upx
behavioral2/files/0x0007000000023425-172.dat	upx
behavioral2/memory/2564-171-0x00007FF7718C0000-0x00007FF771C14000-memory.dmp	upx
behavioral2/memory/4008-170-0x00007FF7D9C10000-0x00007FF7D9F64000-memory.dmp	upx
behavioral2/files/0x0007000000023424-168.dat	upx
behavioral2/files/0x0007000000023423-166.dat	upx
behavioral2/files/0x0007000000023422-164.dat	upx
behavioral2/files/0x000700000002341f-160.dat	upx
behavioral2/memory/3284-159-0x00007FF79E330000-0x00007FF79E684000-memory.dmp	upx
behavioral2/files/0x0007000000023427-158.dat	upx
behavioral2/files/0x000700000002341e-156.dat	upx
behavioral2/files/0x0007000000023415-154.dat	upx
behavioral2/files/0x0007000000023413-152.dat	upx
behavioral2/memory/3760-146-0x00007FF71FB10000-0x00007FF71FE64000-memory.dmp	upx
behavioral2/files/0x0007000000023421-137.dat	upx
behavioral2/files/0x000700000002341a-131.dat	upx
behavioral2/memory/4792-129-0x00007FF689B60000-0x00007FF689EB4000-memory.dmp	upx
behavioral2/files/0x0007000000023418-108.dat	upx
behavioral2/files/0x0007000000023419-106.dat	upx
behavioral2/files/0x000700000002341b-103.dat	upx
behavioral2/memory/1228-101-0x00007FF73BD00000-0x00007FF73C054000-memory.dmp	upx
behavioral2/memory/2432-100-0x00007FF78E110000-0x00007FF78E464000-memory.dmp	upx
behavioral2/files/0x0007000000023417-97.dat	upx
behavioral2/files/0x000700000002341c-96.dat	upx
behavioral2/files/0x0007000000023410-91.dat	upx
behavioral2/memory/468-81-0x00007FF62C420000-0x00007FF62C774000-memory.dmp	upx
behavioral2/files/0x0007000000023412-76.dat	upx
behavioral2/memory/3780-74-0x00007FF708CE0000-0x00007FF709034000-memory.dmp	upx
behavioral2/memory/3580-53-0x00007FF794E10000-0x00007FF795164000-memory.dmp	upx
behavioral2/memory/3700-2092-0x00007FF719E00000-0x00007FF71A154000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XPpBUwr.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\KrIcwkv.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\YbJtnIs.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\UHLmkKy.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\omgMZlo.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\TYlQgSb.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\OamQzNY.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\BPvJWWx.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\peopWEf.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\vdWFoxB.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\WQNQkOf.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\SKUAzbi.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\uEFGDGP.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\oCaUpKC.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\FdfuFNb.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\EUolfIq.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\SOBmlvq.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\QhAcdXR.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\hHjbXCG.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\IfsLxlz.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\kXcVFHX.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\YPecAfa.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\luCekmm.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\mnKQcKU.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\cbohMVr.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\soLvghm.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\fOPsGvD.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\cEZBYJQ.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\EqxGuUm.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\YlMKwpP.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\redWYis.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\isXaWzY.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\IyxRadM.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\UmAdQPn.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\fUPXvXI.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\KZagRbi.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\QHSeVom.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\LBRYSif.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\anzqZYA.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\HjPBear.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\UDgBTIv.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\GuJuqLD.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\RhCnJxv.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\ISzsYEF.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\iqFqnGE.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\RTOVnTd.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\hsywQSk.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\PndiRUU.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\xMBTzeP.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\amLenpR.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\VJgdROE.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\EUsSANf.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\kcBVmqw.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\RDPwmuT.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\gbHeEIy.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\zReaqTi.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\GIIytHE.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\OZWdvau.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\FcZKrwb.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\pKqNgEZ.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\BCnoXzs.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\qfGWGiz.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\qjgxfhU.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
File created	C:\Windows\System\kUHLJUo.exe	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3016	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	82
PID 3700 wrote to memory of 3016	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	82
PID 3700 wrote to memory of 2924	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	83
PID 3700 wrote to memory of 2924	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	83
PID 3700 wrote to memory of 3056	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	84
PID 3700 wrote to memory of 3056	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	84
PID 3700 wrote to memory of 3580	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	85
PID 3700 wrote to memory of 3580	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	85
PID 3700 wrote to memory of 3780	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	86
PID 3700 wrote to memory of 3780	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	86
PID 3700 wrote to memory of 468	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	87
PID 3700 wrote to memory of 468	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	87
PID 3700 wrote to memory of 2432	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	88
PID 3700 wrote to memory of 2432	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	88
PID 3700 wrote to memory of 3820	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	89
PID 3700 wrote to memory of 3820	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	89
PID 3700 wrote to memory of 1228	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	90
PID 3700 wrote to memory of 1228	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	90
PID 3700 wrote to memory of 4792	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	91
PID 3700 wrote to memory of 4792	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	91
PID 3700 wrote to memory of 3760	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	92
PID 3700 wrote to memory of 3760	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	92
PID 3700 wrote to memory of 212	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	93
PID 3700 wrote to memory of 212	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	93
PID 3700 wrote to memory of 1164	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	94
PID 3700 wrote to memory of 1164	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	94
PID 3700 wrote to memory of 3284	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	95
PID 3700 wrote to memory of 3284	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	95
PID 3700 wrote to memory of 4008	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	96
PID 3700 wrote to memory of 4008	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	96
PID 3700 wrote to memory of 2604	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	97
PID 3700 wrote to memory of 2604	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	97
PID 3700 wrote to memory of 916	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	98
PID 3700 wrote to memory of 916	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	98
PID 3700 wrote to memory of 2564	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	99
PID 3700 wrote to memory of 2564	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	99
PID 3700 wrote to memory of 408	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	100
PID 3700 wrote to memory of 408	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	100
PID 3700 wrote to memory of 756	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	101
PID 3700 wrote to memory of 756	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	101
PID 3700 wrote to memory of 1540	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	102
PID 3700 wrote to memory of 1540	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	102
PID 3700 wrote to memory of 2204	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	103
PID 3700 wrote to memory of 2204	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	103
PID 3700 wrote to memory of 2512	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	104
PID 3700 wrote to memory of 2512	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	104
PID 3700 wrote to memory of 3648	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	105
PID 3700 wrote to memory of 3648	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	105
PID 3700 wrote to memory of 4640	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	106
PID 3700 wrote to memory of 4640	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	106
PID 3700 wrote to memory of 736	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	107
PID 3700 wrote to memory of 736	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	107
PID 3700 wrote to memory of 4372	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	108
PID 3700 wrote to memory of 4372	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	108
PID 3700 wrote to memory of 4548	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	109
PID 3700 wrote to memory of 4548	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	109
PID 3700 wrote to memory of 1280	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	110
PID 3700 wrote to memory of 1280	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	110
PID 3700 wrote to memory of 5040	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	111
PID 3700 wrote to memory of 5040	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	111
PID 3700 wrote to memory of 3884	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	112
PID 3700 wrote to memory of 3884	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	112
PID 3700 wrote to memory of 4840	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	113
PID 3700 wrote to memory of 4840	3700	4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4d20907d4bef92c9ab8f669bc7b626a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\System\hCwyIPU.exe
  C:\Windows\System\hCwyIPU.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\UPBtDtq.exe
  C:\Windows\System\UPBtDtq.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\PtCdhPq.exe
  C:\Windows\System\PtCdhPq.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\yxVvTEe.exe
  C:\Windows\System\yxVvTEe.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\eeqrhpL.exe
  C:\Windows\System\eeqrhpL.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\UmAdQPn.exe
  C:\Windows\System\UmAdQPn.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\VYjpcii.exe
  C:\Windows\System\VYjpcii.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\OZWdvau.exe
  C:\Windows\System\OZWdvau.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\jPyzjSN.exe
  C:\Windows\System\jPyzjSN.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\qQlTgAe.exe
  C:\Windows\System\qQlTgAe.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\YWUKqsA.exe
  C:\Windows\System\YWUKqsA.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\EqxGuUm.exe
  C:\Windows\System\EqxGuUm.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\uLyneFY.exe
  C:\Windows\System\uLyneFY.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\EijDYak.exe
  C:\Windows\System\EijDYak.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\zLoHquR.exe
  C:\Windows\System\zLoHquR.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\XFKgrps.exe
  C:\Windows\System\XFKgrps.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\lwnLqPe.exe
  C:\Windows\System\lwnLqPe.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\rKUdkfX.exe
  C:\Windows\System\rKUdkfX.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\FpDtyOC.exe
  C:\Windows\System\FpDtyOC.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\dKbWCfH.exe
  C:\Windows\System\dKbWCfH.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\CICozfF.exe
  C:\Windows\System\CICozfF.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\BuVgtIQ.exe
  C:\Windows\System\BuVgtIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\OZMadEr.exe
  C:\Windows\System\OZMadEr.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\kIsHmyx.exe
  C:\Windows\System\kIsHmyx.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\jXMVWKq.exe
  C:\Windows\System\jXMVWKq.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\pDCQTLp.exe
  C:\Windows\System\pDCQTLp.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\IpjLcQs.exe
  C:\Windows\System\IpjLcQs.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\WivsiTp.exe
  C:\Windows\System\WivsiTp.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\QPQzlIl.exe
  C:\Windows\System\QPQzlIl.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\omgMZlo.exe
  C:\Windows\System\omgMZlo.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\epNLpQM.exe
  C:\Windows\System\epNLpQM.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\GjKbnjd.exe
  C:\Windows\System\GjKbnjd.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\nyPVlcm.exe
  C:\Windows\System\nyPVlcm.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\mVkAipX.exe
  C:\Windows\System\mVkAipX.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\HdBDfep.exe
  C:\Windows\System\HdBDfep.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\wCWdANC.exe
  C:\Windows\System\wCWdANC.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\SiNUzcP.exe
  C:\Windows\System\SiNUzcP.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\uqrYFtW.exe
  C:\Windows\System\uqrYFtW.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\tquRjNh.exe
  C:\Windows\System\tquRjNh.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\LufvrJp.exe
  C:\Windows\System\LufvrJp.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\tvrHKbr.exe
  C:\Windows\System\tvrHKbr.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\lEQqDVX.exe
  C:\Windows\System\lEQqDVX.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\fGlOqoA.exe
  C:\Windows\System\fGlOqoA.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\ZCGzmrb.exe
  C:\Windows\System\ZCGzmrb.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\wVoLNqa.exe
  C:\Windows\System\wVoLNqa.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\arHVuhN.exe
  C:\Windows\System\arHVuhN.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\VJErbAO.exe
  C:\Windows\System\VJErbAO.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\kcBVmqw.exe
  C:\Windows\System\kcBVmqw.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\ugGLUEZ.exe
  C:\Windows\System\ugGLUEZ.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\JUjUREQ.exe
  C:\Windows\System\JUjUREQ.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\iKskipe.exe
  C:\Windows\System\iKskipe.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\HUmSMJo.exe
  C:\Windows\System\HUmSMJo.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\uKhqFkv.exe
  C:\Windows\System\uKhqFkv.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\qpglCJP.exe
  C:\Windows\System\qpglCJP.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\YlMKwpP.exe
  C:\Windows\System\YlMKwpP.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\kJmdMBL.exe
  C:\Windows\System\kJmdMBL.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\enxbfUr.exe
  C:\Windows\System\enxbfUr.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\GzjblFQ.exe
  C:\Windows\System\GzjblFQ.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\KyOfQUF.exe
  C:\Windows\System\KyOfQUF.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\ICTLpWo.exe
  C:\Windows\System\ICTLpWo.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\rZmvVsC.exe
  C:\Windows\System\rZmvVsC.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\JRuuPDL.exe
  C:\Windows\System\JRuuPDL.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\Ovdcfym.exe
  C:\Windows\System\Ovdcfym.exe
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Windows\System\PMEZfeV.exe
  C:\Windows\System\PMEZfeV.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\jvxcodG.exe
  C:\Windows\System\jvxcodG.exe
  2⤵
  PID:4524
- C:\Windows\System\FpsHUys.exe
  C:\Windows\System\FpsHUys.exe
  2⤵
  PID:1804
- C:\Windows\System\YpmBoRF.exe
  C:\Windows\System\YpmBoRF.exe
  2⤵
  PID:1340
- C:\Windows\System\pAyDhDP.exe
  C:\Windows\System\pAyDhDP.exe
  2⤵
  PID:928
- C:\Windows\System\CvxhsXd.exe
  C:\Windows\System\CvxhsXd.exe
  2⤵
  PID:992
- C:\Windows\System\SKUAzbi.exe
  C:\Windows\System\SKUAzbi.exe
  2⤵
  PID:5260
- C:\Windows\System\GOnEmLx.exe
  C:\Windows\System\GOnEmLx.exe
  2⤵
  PID:5276
- C:\Windows\System\iGDXBPB.exe
  C:\Windows\System\iGDXBPB.exe
  2⤵
  PID:5292
- C:\Windows\System\qggIiPM.exe
  C:\Windows\System\qggIiPM.exe
  2⤵
  PID:5312
- C:\Windows\System\mxEGKxh.exe
  C:\Windows\System\mxEGKxh.exe
  2⤵
  PID:5348
- C:\Windows\System\XPpBUwr.exe
  C:\Windows\System\XPpBUwr.exe
  2⤵
  PID:5420
- C:\Windows\System\XFXumJz.exe
  C:\Windows\System\XFXumJz.exe
  2⤵
  PID:5436
- C:\Windows\System\jAUnbAQ.exe
  C:\Windows\System\jAUnbAQ.exe
  2⤵
  PID:5452
- C:\Windows\System\PBncKXG.exe
  C:\Windows\System\PBncKXG.exe
  2⤵
  PID:5468
- C:\Windows\System\buggMoW.exe
  C:\Windows\System\buggMoW.exe
  2⤵
  PID:5504
- C:\Windows\System\nFqjGWh.exe
  C:\Windows\System\nFqjGWh.exe
  2⤵
  PID:5520
- C:\Windows\System\uarlJnf.exe
  C:\Windows\System\uarlJnf.exe
  2⤵
  PID:5584
- C:\Windows\System\SdBlGke.exe
  C:\Windows\System\SdBlGke.exe
  2⤵
  PID:5612
- C:\Windows\System\yRQlToA.exe
  C:\Windows\System\yRQlToA.exe
  2⤵
  PID:5640
- C:\Windows\System\hsywQSk.exe
  C:\Windows\System\hsywQSk.exe
  2⤵
  PID:5656
- C:\Windows\System\UdCuxLa.exe
  C:\Windows\System\UdCuxLa.exe
  2⤵
  PID:5680
- C:\Windows\System\vPkArxt.exe
  C:\Windows\System\vPkArxt.exe
  2⤵
  PID:5696
- C:\Windows\System\TlMDSHZ.exe
  C:\Windows\System\TlMDSHZ.exe
  2⤵
  PID:5724
- C:\Windows\System\iOAbsOV.exe
  C:\Windows\System\iOAbsOV.exe
  2⤵
  PID:5776
- C:\Windows\System\HOfskvs.exe
  C:\Windows\System\HOfskvs.exe
  2⤵
  PID:5820
- C:\Windows\System\MHAOdwW.exe
  C:\Windows\System\MHAOdwW.exe
  2⤵
  PID:5852
- C:\Windows\System\KNrJgPE.exe
  C:\Windows\System\KNrJgPE.exe
  2⤵
  PID:5880
- C:\Windows\System\SzyuOvh.exe
  C:\Windows\System\SzyuOvh.exe
  2⤵
  PID:5908
- C:\Windows\System\UeUkOpu.exe
  C:\Windows\System\UeUkOpu.exe
  2⤵
  PID:5952
- C:\Windows\System\jDRvtCl.exe
  C:\Windows\System\jDRvtCl.exe
  2⤵
  PID:5980
- C:\Windows\System\FpkRqss.exe
  C:\Windows\System\FpkRqss.exe
  2⤵
  PID:6028
- C:\Windows\System\AQvmNJL.exe
  C:\Windows\System\AQvmNJL.exe
  2⤵
  PID:6060
- C:\Windows\System\FcZKrwb.exe
  C:\Windows\System\FcZKrwb.exe
  2⤵
  PID:6100
- C:\Windows\System\ZNlnuJN.exe
  C:\Windows\System\ZNlnuJN.exe
  2⤵
  PID:6136
- C:\Windows\System\OzQoVqw.exe
  C:\Windows\System\OzQoVqw.exe
  2⤵
  PID:2896
- C:\Windows\System\wFZggLJ.exe
  C:\Windows\System\wFZggLJ.exe
  2⤵
  PID:2788
- C:\Windows\System\rbYdHHK.exe
  C:\Windows\System\rbYdHHK.exe
  2⤵
  PID:4968
- C:\Windows\System\dWgKTFL.exe
  C:\Windows\System\dWgKTFL.exe
  2⤵
  PID:4568
- C:\Windows\System\QyJOJps.exe
  C:\Windows\System\QyJOJps.exe
  2⤵
  PID:2492
- C:\Windows\System\ZtWuABY.exe
  C:\Windows\System\ZtWuABY.exe
  2⤵
  PID:2916
- C:\Windows\System\vXdtxdL.exe
  C:\Windows\System\vXdtxdL.exe
  2⤵
  PID:3264
- C:\Windows\System\dtMURcX.exe
  C:\Windows\System\dtMURcX.exe
  2⤵
  PID:3672
- C:\Windows\System\Szmntoc.exe
  C:\Windows\System\Szmntoc.exe
  2⤵
  PID:4676
- C:\Windows\System\HcbwnPY.exe
  C:\Windows\System\HcbwnPY.exe
  2⤵
  PID:4796
- C:\Windows\System\UopvFbS.exe
  C:\Windows\System\UopvFbS.exe
  2⤵
  PID:3416
- C:\Windows\System\fUPXvXI.exe
  C:\Windows\System\fUPXvXI.exe
  2⤵
  PID:3856
- C:\Windows\System\qVwWgkN.exe
  C:\Windows\System\qVwWgkN.exe
  2⤵
  PID:3640
- C:\Windows\System\RsZieDr.exe
  C:\Windows\System\RsZieDr.exe
  2⤵
  PID:5012
- C:\Windows\System\YnAssGU.exe
  C:\Windows\System\YnAssGU.exe
  2⤵
  PID:3320
- C:\Windows\System\KZagRbi.exe
  C:\Windows\System\KZagRbi.exe
  2⤵
  PID:3532
- C:\Windows\System\RDPwmuT.exe
  C:\Windows\System\RDPwmuT.exe
  2⤵
  PID:5104
- C:\Windows\System\gGejkOM.exe
  C:\Windows\System\gGejkOM.exe
  2⤵
  PID:1660
- C:\Windows\System\QHSeVom.exe
  C:\Windows\System\QHSeVom.exe
  2⤵
  PID:2720
- C:\Windows\System\MUNYGwe.exe
  C:\Windows\System\MUNYGwe.exe
  2⤵
  PID:5284
- C:\Windows\System\cHglREl.exe
  C:\Windows\System\cHglREl.exe
  2⤵
  PID:5356
- C:\Windows\System\NVAMxwb.exe
  C:\Windows\System\NVAMxwb.exe
  2⤵
  PID:5480
- C:\Windows\System\VdfnhZC.exe
  C:\Windows\System\VdfnhZC.exe
  2⤵
  PID:4052
- C:\Windows\System\hraHxzy.exe
  C:\Windows\System\hraHxzy.exe
  2⤵
  PID:5476
- C:\Windows\System\ACrHdgf.exe
  C:\Windows\System\ACrHdgf.exe
  2⤵
  PID:5536
- C:\Windows\System\PSZpYNt.exe
  C:\Windows\System\PSZpYNt.exe
  2⤵
  PID:5604
- C:\Windows\System\ByRMClP.exe
  C:\Windows\System\ByRMClP.exe
  2⤵
  PID:4560
- C:\Windows\System\HUqunEg.exe
  C:\Windows\System\HUqunEg.exe
  2⤵
  PID:5676
- C:\Windows\System\vMyRJkg.exe
  C:\Windows\System\vMyRJkg.exe
  2⤵
  PID:5708
- C:\Windows\System\AsiCedP.exe
  C:\Windows\System\AsiCedP.exe
  2⤵
  PID:5792
- C:\Windows\System\zuocQvR.exe
  C:\Windows\System\zuocQvR.exe
  2⤵
  PID:456
- C:\Windows\System\OmHCkOy.exe
  C:\Windows\System\OmHCkOy.exe
  2⤵
  PID:5944
- C:\Windows\System\xpcqpxm.exe
  C:\Windows\System\xpcqpxm.exe
  2⤵
  PID:5992
- C:\Windows\System\FXigLXk.exe
  C:\Windows\System\FXigLXk.exe
  2⤵
  PID:536
- C:\Windows\System\HzlAhXt.exe
  C:\Windows\System\HzlAhXt.exe
  2⤵
  PID:6132
- C:\Windows\System\mTXtrZJ.exe
  C:\Windows\System\mTXtrZJ.exe
  2⤵
  PID:2496
- C:\Windows\System\kFyuAjc.exe
  C:\Windows\System\kFyuAjc.exe
  2⤵
  PID:2424
- C:\Windows\System\redWYis.exe
  C:\Windows\System\redWYis.exe
  2⤵
  PID:5928
- C:\Windows\System\QHJLxZt.exe
  C:\Windows\System\QHJLxZt.exe
  2⤵
  PID:1316
- C:\Windows\System\yudutdm.exe
  C:\Windows\System\yudutdm.exe
  2⤵
  PID:4816
- C:\Windows\System\GssJpRY.exe
  C:\Windows\System\GssJpRY.exe
  2⤵
  PID:3960
- C:\Windows\System\NaAEfWq.exe
  C:\Windows\System\NaAEfWq.exe
  2⤵
  PID:3688
- C:\Windows\System\hkjHCQD.exe
  C:\Windows\System\hkjHCQD.exe
  2⤵
  PID:2264
- C:\Windows\System\LhyTbFx.exe
  C:\Windows\System\LhyTbFx.exe
  2⤵
  PID:3468
- C:\Windows\System\hXivrnc.exe
  C:\Windows\System\hXivrnc.exe
  2⤵
  PID:5304
- C:\Windows\System\gdWirYG.exe
  C:\Windows\System\gdWirYG.exe
  2⤵
  PID:4552
- C:\Windows\System\yLuevfM.exe
  C:\Windows\System\yLuevfM.exe
  2⤵
  PID:5548
- C:\Windows\System\KcCxqVU.exe
  C:\Windows\System\KcCxqVU.exe
  2⤵
  PID:5692
- C:\Windows\System\LJWpvYE.exe
  C:\Windows\System\LJWpvYE.exe
  2⤵
  PID:4196
- C:\Windows\System\jrjoCRe.exe
  C:\Windows\System\jrjoCRe.exe
  2⤵
  PID:5848
- C:\Windows\System\SigURIn.exe
  C:\Windows\System\SigURIn.exe
  2⤵
  PID:516
- C:\Windows\System\KyPiweS.exe
  C:\Windows\System\KyPiweS.exe
  2⤵
  PID:1800
- C:\Windows\System\SzgzHHf.exe
  C:\Windows\System\SzgzHHf.exe
  2⤵
  PID:3060
- C:\Windows\System\YthuYHl.exe
  C:\Windows\System\YthuYHl.exe
  2⤵
  PID:2636
- C:\Windows\System\tXlgmjI.exe
  C:\Windows\System\tXlgmjI.exe
  2⤵
  PID:2160
- C:\Windows\System\nTEIqjt.exe
  C:\Windows\System\nTEIqjt.exe
  2⤵
  PID:5360
- C:\Windows\System\EhNDurv.exe
  C:\Windows\System\EhNDurv.exe
  2⤵
  PID:5496
- C:\Windows\System\kmMORyr.exe
  C:\Windows\System\kmMORyr.exe
  2⤵
  PID:5812
- C:\Windows\System\QgSaKMG.exe
  C:\Windows\System\QgSaKMG.exe
  2⤵
  PID:4292
- C:\Windows\System\YhBIBeg.exe
  C:\Windows\System\YhBIBeg.exe
  2⤵
  PID:2356
- C:\Windows\System\LQaVWsd.exe
  C:\Windows\System\LQaVWsd.exe
  2⤵
  PID:5664
- C:\Windows\System\ZRhWWtH.exe
  C:\Windows\System\ZRhWWtH.exe
  2⤵
  PID:4448
- C:\Windows\System\yEKVqTF.exe
  C:\Windows\System\yEKVqTF.exe
  2⤵
  PID:2408
- C:\Windows\System\lgnyBYy.exe
  C:\Windows\System\lgnyBYy.exe
  2⤵
  PID:6184
- C:\Windows\System\BMttdZx.exe
  C:\Windows\System\BMttdZx.exe
  2⤵
  PID:6212
- C:\Windows\System\pKqNgEZ.exe
  C:\Windows\System\pKqNgEZ.exe
  2⤵
  PID:6244
- C:\Windows\System\PndiRUU.exe
  C:\Windows\System\PndiRUU.exe
  2⤵
  PID:6268
- C:\Windows\System\SxUfsOo.exe
  C:\Windows\System\SxUfsOo.exe
  2⤵
  PID:6292
- C:\Windows\System\aUoZnBQ.exe
  C:\Windows\System\aUoZnBQ.exe
  2⤵
  PID:6324
- C:\Windows\System\HPbBSae.exe
  C:\Windows\System\HPbBSae.exe
  2⤵
  PID:6352
- C:\Windows\System\sQOmoyU.exe
  C:\Windows\System\sQOmoyU.exe
  2⤵
  PID:6388
- C:\Windows\System\xiBSFkq.exe
  C:\Windows\System\xiBSFkq.exe
  2⤵
  PID:6408
- C:\Windows\System\uEFGDGP.exe
  C:\Windows\System\uEFGDGP.exe
  2⤵
  PID:6436
- C:\Windows\System\gMcTvMH.exe
  C:\Windows\System\gMcTvMH.exe
  2⤵
  PID:6464
- C:\Windows\System\QazknPA.exe
  C:\Windows\System\QazknPA.exe
  2⤵
  PID:6492
- C:\Windows\System\bveIBMM.exe
  C:\Windows\System\bveIBMM.exe
  2⤵
  PID:6528
- C:\Windows\System\ZLsFVIi.exe
  C:\Windows\System\ZLsFVIi.exe
  2⤵
  PID:6548
- C:\Windows\System\tbyIoTp.exe
  C:\Windows\System\tbyIoTp.exe
  2⤵
  PID:6576
- C:\Windows\System\glxlBrU.exe
  C:\Windows\System\glxlBrU.exe
  2⤵
  PID:6604
- C:\Windows\System\cymccDk.exe
  C:\Windows\System\cymccDk.exe
  2⤵
  PID:6640
- C:\Windows\System\AZMclFf.exe
  C:\Windows\System\AZMclFf.exe
  2⤵
  PID:6668
- C:\Windows\System\vaZPgbI.exe
  C:\Windows\System\vaZPgbI.exe
  2⤵
  PID:6696
- C:\Windows\System\yYYrGPc.exe
  C:\Windows\System\yYYrGPc.exe
  2⤵
  PID:6724
- C:\Windows\System\dTZduOq.exe
  C:\Windows\System\dTZduOq.exe
  2⤵
  PID:6740
- C:\Windows\System\isXaWzY.exe
  C:\Windows\System\isXaWzY.exe
  2⤵
  PID:6780
- C:\Windows\System\NZzNYEK.exe
  C:\Windows\System\NZzNYEK.exe
  2⤵
  PID:6808
- C:\Windows\System\mkUpbZm.exe
  C:\Windows\System\mkUpbZm.exe
  2⤵
  PID:6836
- C:\Windows\System\lTnAbbP.exe
  C:\Windows\System\lTnAbbP.exe
  2⤵
  PID:6864
- C:\Windows\System\OWBwMRY.exe
  C:\Windows\System\OWBwMRY.exe
  2⤵
  PID:6892
- C:\Windows\System\gIbnogr.exe
  C:\Windows\System\gIbnogr.exe
  2⤵
  PID:6920
- C:\Windows\System\DWhWkOa.exe
  C:\Windows\System\DWhWkOa.exe
  2⤵
  PID:6948
- C:\Windows\System\vWWozEr.exe
  C:\Windows\System\vWWozEr.exe
  2⤵
  PID:6976
- C:\Windows\System\VveAcRz.exe
  C:\Windows\System\VveAcRz.exe
  2⤵
  PID:7008
- C:\Windows\System\ilYosxV.exe
  C:\Windows\System\ilYosxV.exe
  2⤵
  PID:7028
- C:\Windows\System\gbHeEIy.exe
  C:\Windows\System\gbHeEIy.exe
  2⤵
  PID:7044
- C:\Windows\System\kXcVFHX.exe
  C:\Windows\System\kXcVFHX.exe
  2⤵
  PID:7076
- C:\Windows\System\akzgYav.exe
  C:\Windows\System\akzgYav.exe
  2⤵
  PID:7108
- C:\Windows\System\gVpdeRn.exe
  C:\Windows\System\gVpdeRn.exe
  2⤵
  PID:7136
- C:\Windows\System\IWyHchV.exe
  C:\Windows\System\IWyHchV.exe
  2⤵
  PID:5448
- C:\Windows\System\wncxDkh.exe
  C:\Windows\System\wncxDkh.exe
  2⤵
  PID:6168
- C:\Windows\System\NGfvezV.exe
  C:\Windows\System\NGfvezV.exe
  2⤵
  PID:6260
- C:\Windows\System\HzddiWe.exe
  C:\Windows\System\HzddiWe.exe
  2⤵
  PID:6288
- C:\Windows\System\bTGFoOG.exe
  C:\Windows\System\bTGFoOG.exe
  2⤵
  PID:6400
- C:\Windows\System\KzTfCuD.exe
  C:\Windows\System\KzTfCuD.exe
  2⤵
  PID:6456
- C:\Windows\System\pszOYPl.exe
  C:\Windows\System\pszOYPl.exe
  2⤵
  PID:6536
- C:\Windows\System\JphpbWV.exe
  C:\Windows\System\JphpbWV.exe
  2⤵
  PID:6568
- C:\Windows\System\AsMYMKe.exe
  C:\Windows\System\AsMYMKe.exe
  2⤵
  PID:6628
- C:\Windows\System\qqlpECR.exe
  C:\Windows\System\qqlpECR.exe
  2⤵
  PID:6716
- C:\Windows\System\phYdOMs.exe
  C:\Windows\System\phYdOMs.exe
  2⤵
  PID:6792
- C:\Windows\System\FEcHaAt.exe
  C:\Windows\System\FEcHaAt.exe
  2⤵
  PID:6828
- C:\Windows\System\HZgtlmT.exe
  C:\Windows\System\HZgtlmT.exe
  2⤵
  PID:6880
- C:\Windows\System\BTFVcRe.exe
  C:\Windows\System\BTFVcRe.exe
  2⤵
  PID:6960
- C:\Windows\System\gANaJqo.exe
  C:\Windows\System\gANaJqo.exe
  2⤵
  PID:7000
- C:\Windows\System\ocYkRAK.exe
  C:\Windows\System\ocYkRAK.exe
  2⤵
  PID:7060
- C:\Windows\System\YPecAfa.exe
  C:\Windows\System\YPecAfa.exe
  2⤵
  PID:7100
- C:\Windows\System\YfYyWiB.exe
  C:\Windows\System\YfYyWiB.exe
  2⤵
  PID:7144
- C:\Windows\System\TieBICb.exe
  C:\Windows\System\TieBICb.exe
  2⤵
  PID:5300
- C:\Windows\System\Pfanrmo.exe
  C:\Windows\System\Pfanrmo.exe
  2⤵
  PID:6276
- C:\Windows\System\VxOwQDh.exe
  C:\Windows\System\VxOwQDh.exe
  2⤵
  PID:6380
- C:\Windows\System\WjxzFnA.exe
  C:\Windows\System\WjxzFnA.exe
  2⤵
  PID:6520
- C:\Windows\System\yErGWFO.exe
  C:\Windows\System\yErGWFO.exe
  2⤵
  PID:6692
- C:\Windows\System\IXpQJZh.exe
  C:\Windows\System\IXpQJZh.exe
  2⤵
  PID:6916
- C:\Windows\System\FmlIkQp.exe
  C:\Windows\System\FmlIkQp.exe
  2⤵
  PID:7036
- C:\Windows\System\btNXmmb.exe
  C:\Windows\System\btNXmmb.exe
  2⤵
  PID:6544
- C:\Windows\System\aXQXTwy.exe
  C:\Windows\System\aXQXTwy.exe
  2⤵
  PID:6904
- C:\Windows\System\vxMWdOG.exe
  C:\Windows\System\vxMWdOG.exe
  2⤵
  PID:7024
- C:\Windows\System\ZqCvMic.exe
  C:\Windows\System\ZqCvMic.exe
  2⤵
  PID:7176
- C:\Windows\System\EXKphrP.exe
  C:\Windows\System\EXKphrP.exe
  2⤵
  PID:7216
- C:\Windows\System\wpifrRm.exe
  C:\Windows\System\wpifrRm.exe
  2⤵
  PID:7244
- C:\Windows\System\xovRwwn.exe
  C:\Windows\System\xovRwwn.exe
  2⤵
  PID:7280
- C:\Windows\System\IKjzhGh.exe
  C:\Windows\System\IKjzhGh.exe
  2⤵
  PID:7296
- C:\Windows\System\BlLKGqn.exe
  C:\Windows\System\BlLKGqn.exe
  2⤵
  PID:7316
- C:\Windows\System\dopTZpt.exe
  C:\Windows\System\dopTZpt.exe
  2⤵
  PID:7348
- C:\Windows\System\mNtELCA.exe
  C:\Windows\System\mNtELCA.exe
  2⤵
  PID:7380
- C:\Windows\System\qTdFnHW.exe
  C:\Windows\System\qTdFnHW.exe
  2⤵
  PID:7416
- C:\Windows\System\dazdcmh.exe
  C:\Windows\System\dazdcmh.exe
  2⤵
  PID:7452
- C:\Windows\System\ZAFtDZZ.exe
  C:\Windows\System\ZAFtDZZ.exe
  2⤵
  PID:7488
- C:\Windows\System\vxrOznP.exe
  C:\Windows\System\vxrOznP.exe
  2⤵
  PID:7524
- C:\Windows\System\wAOxsYq.exe
  C:\Windows\System\wAOxsYq.exe
  2⤵
  PID:7552
- C:\Windows\System\wTIHKNl.exe
  C:\Windows\System\wTIHKNl.exe
  2⤵
  PID:7584
- C:\Windows\System\mWoaiPM.exe
  C:\Windows\System\mWoaiPM.exe
  2⤵
  PID:7608
- C:\Windows\System\SOBmlvq.exe
  C:\Windows\System\SOBmlvq.exe
  2⤵
  PID:7636
- C:\Windows\System\rDlPBga.exe
  C:\Windows\System\rDlPBga.exe
  2⤵
  PID:7664
- C:\Windows\System\FjoZChR.exe
  C:\Windows\System\FjoZChR.exe
  2⤵
  PID:7704
- C:\Windows\System\jumqCNX.exe
  C:\Windows\System\jumqCNX.exe
  2⤵
  PID:7728
- C:\Windows\System\IQIGkAq.exe
  C:\Windows\System\IQIGkAq.exe
  2⤵
  PID:7768
- C:\Windows\System\AUfVGaF.exe
  C:\Windows\System\AUfVGaF.exe
  2⤵
  PID:7796
- C:\Windows\System\jVYJtRT.exe
  C:\Windows\System\jVYJtRT.exe
  2⤵
  PID:7812
- C:\Windows\System\WCVBPex.exe
  C:\Windows\System\WCVBPex.exe
  2⤵
  PID:7860
- C:\Windows\System\eFTVFBZ.exe
  C:\Windows\System\eFTVFBZ.exe
  2⤵
  PID:7884
- C:\Windows\System\NitWVpv.exe
  C:\Windows\System\NitWVpv.exe
  2⤵
  PID:7916
- C:\Windows\System\UDgBTIv.exe
  C:\Windows\System\UDgBTIv.exe
  2⤵
  PID:7940
- C:\Windows\System\JVYVxsw.exe
  C:\Windows\System\JVYVxsw.exe
  2⤵
  PID:7980
- C:\Windows\System\AoLrrru.exe
  C:\Windows\System\AoLrrru.exe
  2⤵
  PID:8016
- C:\Windows\System\puvMCFJ.exe
  C:\Windows\System\puvMCFJ.exe
  2⤵
  PID:8064
- C:\Windows\System\hxNVYsI.exe
  C:\Windows\System\hxNVYsI.exe
  2⤵
  PID:8088
- C:\Windows\System\OcdCzjf.exe
  C:\Windows\System\OcdCzjf.exe
  2⤵
  PID:8116
- C:\Windows\System\gdcjUnu.exe
  C:\Windows\System\gdcjUnu.exe
  2⤵
  PID:8132
- C:\Windows\System\BdtolFg.exe
  C:\Windows\System\BdtolFg.exe
  2⤵
  PID:8172
- C:\Windows\System\xXCNNti.exe
  C:\Windows\System\xXCNNti.exe
  2⤵
  PID:7200
- C:\Windows\System\DnrzBJj.exe
  C:\Windows\System\DnrzBJj.exe
  2⤵
  PID:7212
- C:\Windows\System\FsnYEwM.exe
  C:\Windows\System\FsnYEwM.exe
  2⤵
  PID:7264
- C:\Windows\System\VqAPxkY.exe
  C:\Windows\System\VqAPxkY.exe
  2⤵
  PID:7388
- C:\Windows\System\xMBTzeP.exe
  C:\Windows\System\xMBTzeP.exe
  2⤵
  PID:7408
- C:\Windows\System\rJAWYDC.exe
  C:\Windows\System\rJAWYDC.exe
  2⤵
  PID:7480
- C:\Windows\System\IyxRadM.exe
  C:\Windows\System\IyxRadM.exe
  2⤵
  PID:7548
- C:\Windows\System\xxdtwWB.exe
  C:\Windows\System\xxdtwWB.exe
  2⤵
  PID:7604
- C:\Windows\System\HjZYiUH.exe
  C:\Windows\System\HjZYiUH.exe
  2⤵
  PID:7676
- C:\Windows\System\xgvnAzl.exe
  C:\Windows\System\xgvnAzl.exe
  2⤵
  PID:7760
- C:\Windows\System\rFkNslS.exe
  C:\Windows\System\rFkNslS.exe
  2⤵
  PID:7788
- C:\Windows\System\WYZioin.exe
  C:\Windows\System\WYZioin.exe
  2⤵
  PID:7840
- C:\Windows\System\vWOymnn.exe
  C:\Windows\System\vWOymnn.exe
  2⤵
  PID:7936
- C:\Windows\System\jVslxBw.exe
  C:\Windows\System\jVslxBw.exe
  2⤵
  PID:8040
- C:\Windows\System\OPHzrlI.exe
  C:\Windows\System\OPHzrlI.exe
  2⤵
  PID:8128
- C:\Windows\System\HZuTUJP.exe
  C:\Windows\System\HZuTUJP.exe
  2⤵
  PID:6664
- C:\Windows\System\luCekmm.exe
  C:\Windows\System\luCekmm.exe
  2⤵
  PID:7288
- C:\Windows\System\OnpwoRf.exe
  C:\Windows\System\OnpwoRf.exe
  2⤵
  PID:7404
- C:\Windows\System\mOEZfme.exe
  C:\Windows\System\mOEZfme.exe
  2⤵
  PID:7572
- C:\Windows\System\qvZEEAF.exe
  C:\Windows\System\qvZEEAF.exe
  2⤵
  PID:7736
- C:\Windows\System\PtpmYWN.exe
  C:\Windows\System\PtpmYWN.exe
  2⤵
  PID:7756
- C:\Windows\System\OHgKRkk.exe
  C:\Windows\System\OHgKRkk.exe
  2⤵
  PID:8028
- C:\Windows\System\xgBYzqe.exe
  C:\Windows\System\xgBYzqe.exe
  2⤵
  PID:7132
- C:\Windows\System\vKGqHyT.exe
  C:\Windows\System\vKGqHyT.exe
  2⤵
  PID:7540
- C:\Windows\System\amLenpR.exe
  C:\Windows\System\amLenpR.exe
  2⤵
  PID:7792
- C:\Windows\System\BzfBMVH.exe
  C:\Windows\System\BzfBMVH.exe
  2⤵
  PID:6488
- C:\Windows\System\vClqQzV.exe
  C:\Windows\System\vClqQzV.exe
  2⤵
  PID:8008
- C:\Windows\System\lEEzsSr.exe
  C:\Windows\System\lEEzsSr.exe
  2⤵
  PID:8216
- C:\Windows\System\gPTuOuI.exe
  C:\Windows\System\gPTuOuI.exe
  2⤵
  PID:8244
- C:\Windows\System\QhAcdXR.exe
  C:\Windows\System\QhAcdXR.exe
  2⤵
  PID:8272
- C:\Windows\System\NQkvRdt.exe
  C:\Windows\System\NQkvRdt.exe
  2⤵
  PID:8316
- C:\Windows\System\utisbZJ.exe
  C:\Windows\System\utisbZJ.exe
  2⤵
  PID:8332
- C:\Windows\System\oVriMVW.exe
  C:\Windows\System\oVriMVW.exe
  2⤵
  PID:8360
- C:\Windows\System\HaVivuB.exe
  C:\Windows\System\HaVivuB.exe
  2⤵
  PID:8388
- C:\Windows\System\TcSjdFe.exe
  C:\Windows\System\TcSjdFe.exe
  2⤵
  PID:8416
- C:\Windows\System\ZZdFXSa.exe
  C:\Windows\System\ZZdFXSa.exe
  2⤵
  PID:8452
- C:\Windows\System\mnKQcKU.exe
  C:\Windows\System\mnKQcKU.exe
  2⤵
  PID:8492
- C:\Windows\System\nxCoEFQ.exe
  C:\Windows\System\nxCoEFQ.exe
  2⤵
  PID:8516
- C:\Windows\System\puwEefR.exe
  C:\Windows\System\puwEefR.exe
  2⤵
  PID:8548
- C:\Windows\System\XrYCevV.exe
  C:\Windows\System\XrYCevV.exe
  2⤵
  PID:8588
- C:\Windows\System\eOelFFC.exe
  C:\Windows\System\eOelFFC.exe
  2⤵
  PID:8616
- C:\Windows\System\FIGMkKD.exe
  C:\Windows\System\FIGMkKD.exe
  2⤵
  PID:8656
- C:\Windows\System\MIiPcHE.exe
  C:\Windows\System\MIiPcHE.exe
  2⤵
  PID:8680
- C:\Windows\System\ZVaPDWP.exe
  C:\Windows\System\ZVaPDWP.exe
  2⤵
  PID:8704
- C:\Windows\System\QptxICf.exe
  C:\Windows\System\QptxICf.exe
  2⤵
  PID:8740
- C:\Windows\System\pWeWLHQ.exe
  C:\Windows\System\pWeWLHQ.exe
  2⤵
  PID:8760
- C:\Windows\System\nxgxvWr.exe
  C:\Windows\System\nxgxvWr.exe
  2⤵
  PID:8784
- C:\Windows\System\gcoUyFs.exe
  C:\Windows\System\gcoUyFs.exe
  2⤵
  PID:8812
- C:\Windows\System\zDLeBxR.exe
  C:\Windows\System\zDLeBxR.exe
  2⤵
  PID:8860
- C:\Windows\System\bKNgxXx.exe
  C:\Windows\System\bKNgxXx.exe
  2⤵
  PID:8880
- C:\Windows\System\ojFTVAd.exe
  C:\Windows\System\ojFTVAd.exe
  2⤵
  PID:8916
- C:\Windows\System\mIPjTEN.exe
  C:\Windows\System\mIPjTEN.exe
  2⤵
  PID:8940
- C:\Windows\System\METMRiG.exe
  C:\Windows\System\METMRiG.exe
  2⤵
  PID:8980
- C:\Windows\System\ROHkVYq.exe
  C:\Windows\System\ROHkVYq.exe
  2⤵
  PID:9028
- C:\Windows\System\SAMHspa.exe
  C:\Windows\System\SAMHspa.exe
  2⤵
  PID:9052
- C:\Windows\System\elJVcke.exe
  C:\Windows\System\elJVcke.exe
  2⤵
  PID:9092
- C:\Windows\System\cFfHJzy.exe
  C:\Windows\System\cFfHJzy.exe
  2⤵
  PID:9128
- C:\Windows\System\jYIKYED.exe
  C:\Windows\System\jYIKYED.exe
  2⤵
  PID:9156
- C:\Windows\System\RtjFPVX.exe
  C:\Windows\System\RtjFPVX.exe
  2⤵
  PID:9176
- C:\Windows\System\MNFbteT.exe
  C:\Windows\System\MNFbteT.exe
  2⤵
  PID:9208
- C:\Windows\System\lZzdBbR.exe
  C:\Windows\System\lZzdBbR.exe
  2⤵
  PID:8212
- C:\Windows\System\ZCnqTgt.exe
  C:\Windows\System\ZCnqTgt.exe
  2⤵
  PID:8284
- C:\Windows\System\aQhOCzy.exe
  C:\Windows\System\aQhOCzy.exe
  2⤵
  PID:8376
- C:\Windows\System\LBRYSif.exe
  C:\Windows\System\LBRYSif.exe
  2⤵
  PID:8436
- C:\Windows\System\XvJyDVd.exe
  C:\Windows\System\XvJyDVd.exe
  2⤵
  PID:8532
- C:\Windows\System\spUWQBz.exe
  C:\Windows\System\spUWQBz.exe
  2⤵
  PID:8604
- C:\Windows\System\wJMeCyV.exe
  C:\Windows\System\wJMeCyV.exe
  2⤵
  PID:8668
- C:\Windows\System\uZvXwxG.exe
  C:\Windows\System\uZvXwxG.exe
  2⤵
  PID:8728
- C:\Windows\System\DOJZmHB.exe
  C:\Windows\System\DOJZmHB.exe
  2⤵
  PID:8832
- C:\Windows\System\IhFIraR.exe
  C:\Windows\System\IhFIraR.exe
  2⤵
  PID:8928
- C:\Windows\System\MVLGEos.exe
  C:\Windows\System\MVLGEos.exe
  2⤵
  PID:9040
- C:\Windows\System\FUjEfrc.exe
  C:\Windows\System\FUjEfrc.exe
  2⤵
  PID:9148
- C:\Windows\System\vbxycsC.exe
  C:\Windows\System\vbxycsC.exe
  2⤵
  PID:8240
- C:\Windows\System\gEBpbtH.exe
  C:\Windows\System\gEBpbtH.exe
  2⤵
  PID:8432
- C:\Windows\System\uzezhFr.exe
  C:\Windows\System\uzezhFr.exe
  2⤵
  PID:8572
- C:\Windows\System\sjcANno.exe
  C:\Windows\System\sjcANno.exe
  2⤵
  PID:8776
- C:\Windows\System\lPjpcjN.exe
  C:\Windows\System\lPjpcjN.exe
  2⤵
  PID:8976
- C:\Windows\System\cCIYQWm.exe
  C:\Windows\System\cCIYQWm.exe
  2⤵
  PID:8200
- C:\Windows\System\DNrNvRO.exe
  C:\Windows\System\DNrNvRO.exe
  2⤵
  PID:8612
- C:\Windows\System\BCnoXzs.exe
  C:\Windows\System\BCnoXzs.exe
  2⤵
  PID:8820
- C:\Windows\System\tILYjsK.exe
  C:\Windows\System\tILYjsK.exe
  2⤵
  PID:9204
- C:\Windows\System\bFriySp.exe
  C:\Windows\System\bFriySp.exe
  2⤵
  PID:9232
- C:\Windows\System\anzqZYA.exe
  C:\Windows\System\anzqZYA.exe
  2⤵
  PID:9256
- C:\Windows\System\gHuIzOn.exe
  C:\Windows\System\gHuIzOn.exe
  2⤵
  PID:9284
- C:\Windows\System\JRpPCZC.exe
  C:\Windows\System\JRpPCZC.exe
  2⤵
  PID:9312
- C:\Windows\System\ratybqC.exe
  C:\Windows\System\ratybqC.exe
  2⤵
  PID:9336
- C:\Windows\System\YdRGtZf.exe
  C:\Windows\System\YdRGtZf.exe
  2⤵
  PID:9376
- C:\Windows\System\HDpLhuy.exe
  C:\Windows\System\HDpLhuy.exe
  2⤵
  PID:9416
- C:\Windows\System\pZCyapi.exe
  C:\Windows\System\pZCyapi.exe
  2⤵
  PID:9444
- C:\Windows\System\kSEtROg.exe
  C:\Windows\System\kSEtROg.exe
  2⤵
  PID:9480
- C:\Windows\System\PywWoCe.exe
  C:\Windows\System\PywWoCe.exe
  2⤵
  PID:9504
- C:\Windows\System\llBaDWo.exe
  C:\Windows\System\llBaDWo.exe
  2⤵
  PID:9524
- C:\Windows\System\wOUvDVi.exe
  C:\Windows\System\wOUvDVi.exe
  2⤵
  PID:9548
- C:\Windows\System\skAcWCR.exe
  C:\Windows\System\skAcWCR.exe
  2⤵
  PID:9568
- C:\Windows\System\TYlQgSb.exe
  C:\Windows\System\TYlQgSb.exe
  2⤵
  PID:9600
- C:\Windows\System\KVgrxvW.exe
  C:\Windows\System\KVgrxvW.exe
  2⤵
  PID:9640
- C:\Windows\System\MPwSREA.exe
  C:\Windows\System\MPwSREA.exe
  2⤵
  PID:9668
- C:\Windows\System\OaldZqY.exe
  C:\Windows\System\OaldZqY.exe
  2⤵
  PID:9708
- C:\Windows\System\zuFoFcl.exe
  C:\Windows\System\zuFoFcl.exe
  2⤵
  PID:9744
- C:\Windows\System\bUxwzkl.exe
  C:\Windows\System\bUxwzkl.exe
  2⤵
  PID:9760
- C:\Windows\System\COsleVB.exe
  C:\Windows\System\COsleVB.exe
  2⤵
  PID:9800
- C:\Windows\System\zgdfCQj.exe
  C:\Windows\System\zgdfCQj.exe
  2⤵
  PID:9832
- C:\Windows\System\TDMNXJF.exe
  C:\Windows\System\TDMNXJF.exe
  2⤵
  PID:9860
- C:\Windows\System\maGXSXG.exe
  C:\Windows\System\maGXSXG.exe
  2⤵
  PID:9888
- C:\Windows\System\HCDxcSv.exe
  C:\Windows\System\HCDxcSv.exe
  2⤵
  PID:9944
- C:\Windows\System\EzEoIZH.exe
  C:\Windows\System\EzEoIZH.exe
  2⤵
  PID:9960
- C:\Windows\System\XIkGJqj.exe
  C:\Windows\System\XIkGJqj.exe
  2⤵
  PID:9996
- C:\Windows\System\RSPtrCg.exe
  C:\Windows\System\RSPtrCg.exe
  2⤵
  PID:10024
- C:\Windows\System\iBZuqqu.exe
  C:\Windows\System\iBZuqqu.exe
  2⤵
  PID:10052
- C:\Windows\System\nFjcIFU.exe
  C:\Windows\System\nFjcIFU.exe
  2⤵
  PID:10088
- C:\Windows\System\wzttfCK.exe
  C:\Windows\System\wzttfCK.exe
  2⤵
  PID:10112
- C:\Windows\System\OamQzNY.exe
  C:\Windows\System\OamQzNY.exe
  2⤵
  PID:10140
- C:\Windows\System\dbusSnd.exe
  C:\Windows\System\dbusSnd.exe
  2⤵
  PID:10168
- C:\Windows\System\GuJuqLD.exe
  C:\Windows\System\GuJuqLD.exe
  2⤵
  PID:10196
- C:\Windows\System\BsueVEJ.exe
  C:\Windows\System\BsueVEJ.exe
  2⤵
  PID:10212
- C:\Windows\System\AosePLp.exe
  C:\Windows\System\AosePLp.exe
  2⤵
  PID:10228
- C:\Windows\System\vlwddEt.exe
  C:\Windows\System\vlwddEt.exe
  2⤵
  PID:9224
- C:\Windows\System\BPvJWWx.exe
  C:\Windows\System\BPvJWWx.exe
  2⤵
  PID:9268
- C:\Windows\System\HjPBear.exe
  C:\Windows\System\HjPBear.exe
  2⤵
  PID:9352
- C:\Windows\System\NNTPmrW.exe
  C:\Windows\System\NNTPmrW.exe
  2⤵
  PID:9368
- C:\Windows\System\zcKpxPt.exe
  C:\Windows\System\zcKpxPt.exe
  2⤵
  PID:9468
- C:\Windows\System\KOJRaLV.exe
  C:\Windows\System\KOJRaLV.exe
  2⤵
  PID:9544
- C:\Windows\System\BMyyzPU.exe
  C:\Windows\System\BMyyzPU.exe
  2⤵
  PID:9652
- C:\Windows\System\uQBrKlw.exe
  C:\Windows\System\uQBrKlw.exe
  2⤵
  PID:9720
- C:\Windows\System\UHonCev.exe
  C:\Windows\System\UHonCev.exe
  2⤵
  PID:9768
- C:\Windows\System\peopWEf.exe
  C:\Windows\System\peopWEf.exe
  2⤵
  PID:9848
- C:\Windows\System\cTmCqla.exe
  C:\Windows\System\cTmCqla.exe
  2⤵
  PID:8528
- C:\Windows\System\PeFSeab.exe
  C:\Windows\System\PeFSeab.exe
  2⤵
  PID:9992
- C:\Windows\System\tnlLDfX.exe
  C:\Windows\System\tnlLDfX.exe
  2⤵
  PID:10040
- C:\Windows\System\uwuJCLp.exe
  C:\Windows\System\uwuJCLp.exe
  2⤵
  PID:10128
- C:\Windows\System\lPxmtML.exe
  C:\Windows\System\lPxmtML.exe
  2⤵
  PID:10208
- C:\Windows\System\nYAQdPT.exe
  C:\Windows\System\nYAQdPT.exe
  2⤵
  PID:8736
- C:\Windows\System\DSpEXkl.exe
  C:\Windows\System\DSpEXkl.exe
  2⤵
  PID:9344
- C:\Windows\System\DbEFVNN.exe
  C:\Windows\System\DbEFVNN.exe
  2⤵
  PID:9452
- C:\Windows\System\ZgGHQiX.exe
  C:\Windows\System\ZgGHQiX.exe
  2⤵
  PID:9588
- C:\Windows\System\yVhuzyN.exe
  C:\Windows\System\yVhuzyN.exe
  2⤵
  PID:9812
- C:\Windows\System\QqqtcOE.exe
  C:\Windows\System\QqqtcOE.exe
  2⤵
  PID:9988
- C:\Windows\System\UvnjUph.exe
  C:\Windows\System\UvnjUph.exe
  2⤵
  PID:10124
- C:\Windows\System\kSsIdrq.exe
  C:\Windows\System\kSsIdrq.exe
  2⤵
  PID:10220
- C:\Windows\System\jGkLxWv.exe
  C:\Windows\System\jGkLxWv.exe
  2⤵
  PID:9540
- C:\Windows\System\SVzzGzF.exe
  C:\Windows\System\SVzzGzF.exe
  2⤵
  PID:9920
- C:\Windows\System\iKzGUXZ.exe
  C:\Windows\System\iKzGUXZ.exe
  2⤵
  PID:9228
- C:\Windows\System\UjsfMVX.exe
  C:\Windows\System\UjsfMVX.exe
  2⤵
  PID:9356
- C:\Windows\System\RhCnJxv.exe
  C:\Windows\System\RhCnJxv.exe
  2⤵
  PID:10260
- C:\Windows\System\xuFCfsh.exe
  C:\Windows\System\xuFCfsh.exe
  2⤵
  PID:10284
- C:\Windows\System\Vbxpewi.exe
  C:\Windows\System\Vbxpewi.exe
  2⤵
  PID:10316
- C:\Windows\System\RQpFQqS.exe
  C:\Windows\System\RQpFQqS.exe
  2⤵
  PID:10348
- C:\Windows\System\iDsJcqv.exe
  C:\Windows\System\iDsJcqv.exe
  2⤵
  PID:10388
- C:\Windows\System\RLAAMRc.exe
  C:\Windows\System\RLAAMRc.exe
  2⤵
  PID:10416
- C:\Windows\System\TqNsUwa.exe
  C:\Windows\System\TqNsUwa.exe
  2⤵
  PID:10452
- C:\Windows\System\LayIeMr.exe
  C:\Windows\System\LayIeMr.exe
  2⤵
  PID:10484
- C:\Windows\System\Vnsicga.exe
  C:\Windows\System\Vnsicga.exe
  2⤵
  PID:10512
- C:\Windows\System\hHjbXCG.exe
  C:\Windows\System\hHjbXCG.exe
  2⤵
  PID:10540
- C:\Windows\System\KUaCPZf.exe
  C:\Windows\System\KUaCPZf.exe
  2⤵
  PID:10568
- C:\Windows\System\SwDUwDA.exe
  C:\Windows\System\SwDUwDA.exe
  2⤵
  PID:10596
- C:\Windows\System\iukqvfx.exe
  C:\Windows\System\iukqvfx.exe
  2⤵
  PID:10624
- C:\Windows\System\NDpOAkJ.exe
  C:\Windows\System\NDpOAkJ.exe
  2⤵
  PID:10652
- C:\Windows\System\CkOCjQi.exe
  C:\Windows\System\CkOCjQi.exe
  2⤵
  PID:10680
- C:\Windows\System\FHQvVUn.exe
  C:\Windows\System\FHQvVUn.exe
  2⤵
  PID:10708
- C:\Windows\System\XcNpgdo.exe
  C:\Windows\System\XcNpgdo.exe
  2⤵
  PID:10736
- C:\Windows\System\URnQQou.exe
  C:\Windows\System\URnQQou.exe
  2⤵
  PID:10768
- C:\Windows\System\OKBNufm.exe
  C:\Windows\System\OKBNufm.exe
  2⤵
  PID:10792
- C:\Windows\System\pFHcGMa.exe
  C:\Windows\System\pFHcGMa.exe
  2⤵
  PID:10812
- C:\Windows\System\ArGvSvU.exe
  C:\Windows\System\ArGvSvU.exe
  2⤵
  PID:10836
- C:\Windows\System\rjZsUYj.exe
  C:\Windows\System\rjZsUYj.exe
  2⤵
  PID:10864
- C:\Windows\System\VJgdROE.exe
  C:\Windows\System\VJgdROE.exe
  2⤵
  PID:10896
- C:\Windows\System\mUWTaVY.exe
  C:\Windows\System\mUWTaVY.exe
  2⤵
  PID:10924
- C:\Windows\System\PRcWVjH.exe
  C:\Windows\System\PRcWVjH.exe
  2⤵
  PID:10948
- C:\Windows\System\PRIaNpz.exe
  C:\Windows\System\PRIaNpz.exe
  2⤵
  PID:10980
- C:\Windows\System\knXVKhX.exe
  C:\Windows\System\knXVKhX.exe
  2⤵
  PID:11012
- C:\Windows\System\IjJEGxK.exe
  C:\Windows\System\IjJEGxK.exe
  2⤵
  PID:11048
- C:\Windows\System\eXKpuwz.exe
  C:\Windows\System\eXKpuwz.exe
  2⤵
  PID:11068
- C:\Windows\System\iexJHqC.exe
  C:\Windows\System\iexJHqC.exe
  2⤵
  PID:11100
- C:\Windows\System\eZMBOcd.exe
  C:\Windows\System\eZMBOcd.exe
  2⤵
  PID:11124
- C:\Windows\System\ttmpCTl.exe
  C:\Windows\System\ttmpCTl.exe
  2⤵
  PID:11156
- C:\Windows\System\nOnPjZt.exe
  C:\Windows\System\nOnPjZt.exe
  2⤵
  PID:11180
- C:\Windows\System\HDTfCWL.exe
  C:\Windows\System\HDTfCWL.exe
  2⤵
  PID:11212
- C:\Windows\System\WeCNRYv.exe
  C:\Windows\System\WeCNRYv.exe
  2⤵
  PID:11248
- C:\Windows\System\tDuYmHf.exe
  C:\Windows\System\tDuYmHf.exe
  2⤵
  PID:9296
- C:\Windows\System\zcqOVIb.exe
  C:\Windows\System\zcqOVIb.exe
  2⤵
  PID:10280
- C:\Windows\System\EvNxeJG.exe
  C:\Windows\System\EvNxeJG.exe
  2⤵
  PID:10344
- C:\Windows\System\ISzsYEF.exe
  C:\Windows\System\ISzsYEF.exe
  2⤵
  PID:10404
- C:\Windows\System\gSGLywP.exe
  C:\Windows\System\gSGLywP.exe
  2⤵
  PID:10428
- C:\Windows\System\fLJgxGy.exe
  C:\Windows\System\fLJgxGy.exe
  2⤵
  PID:10480
- C:\Windows\System\DWrosJi.exe
  C:\Windows\System\DWrosJi.exe
  2⤵
  PID:10560
- C:\Windows\System\RIIwVyr.exe
  C:\Windows\System\RIIwVyr.exe
  2⤵
  PID:10620
- C:\Windows\System\qhbOTpz.exe
  C:\Windows\System\qhbOTpz.exe
  2⤵
  PID:10692
- C:\Windows\System\ZeafCFo.exe
  C:\Windows\System\ZeafCFo.exe
  2⤵
  PID:10776
- C:\Windows\System\oHwgyBH.exe
  C:\Windows\System\oHwgyBH.exe
  2⤵
  PID:10852
- C:\Windows\System\IfsLxlz.exe
  C:\Windows\System\IfsLxlz.exe
  2⤵
  PID:10912
- C:\Windows\System\KeROEkM.exe
  C:\Windows\System\KeROEkM.exe
  2⤵
  PID:11004
- C:\Windows\System\mJMfHmU.exe
  C:\Windows\System\mJMfHmU.exe
  2⤵
  PID:11064
- C:\Windows\System\DzqVpTI.exe
  C:\Windows\System\DzqVpTI.exe
  2⤵
  PID:11168
- C:\Windows\System\zReaqTi.exe
  C:\Windows\System\zReaqTi.exe
  2⤵
  PID:11220
- C:\Windows\System\cbohMVr.exe
  C:\Windows\System\cbohMVr.exe
  2⤵
  PID:10104
- C:\Windows\System\tCByFbz.exe
  C:\Windows\System\tCByFbz.exe
  2⤵
  PID:10356
- C:\Windows\System\ugDbzFS.exe
  C:\Windows\System\ugDbzFS.exe
  2⤵
  PID:10468
- C:\Windows\System\ICioAYO.exe
  C:\Windows\System\ICioAYO.exe
  2⤵
  PID:10616
- C:\Windows\System\Gbhlyli.exe
  C:\Windows\System\Gbhlyli.exe
  2⤵
  PID:10800
- C:\Windows\System\qfGWGiz.exe
  C:\Windows\System\qfGWGiz.exe
  2⤵
  PID:10880
- C:\Windows\System\FacgWOG.exe
  C:\Windows\System\FacgWOG.exe
  2⤵
  PID:11040
- C:\Windows\System\omPeXaj.exe
  C:\Windows\System\omPeXaj.exe
  2⤵
  PID:11164
- C:\Windows\System\RbULmqa.exe
  C:\Windows\System\RbULmqa.exe
  2⤵
  PID:10308
- C:\Windows\System\itlSfLC.exe
  C:\Windows\System\itlSfLC.exe
  2⤵
  PID:10592
- C:\Windows\System\iRyQYiG.exe
  C:\Windows\System\iRyQYiG.exe
  2⤵
  PID:11280
- C:\Windows\System\LyVOLTB.exe
  C:\Windows\System\LyVOLTB.exe
  2⤵
  PID:11296
- C:\Windows\System\BNrFoQb.exe
  C:\Windows\System\BNrFoQb.exe
  2⤵
  PID:11324
- C:\Windows\System\illhATW.exe
  C:\Windows\System\illhATW.exe
  2⤵
  PID:11352
- C:\Windows\System\JrtRiqH.exe
  C:\Windows\System\JrtRiqH.exe
  2⤵
  PID:11392
- C:\Windows\System\uUlwQMC.exe
  C:\Windows\System\uUlwQMC.exe
  2⤵
  PID:11424
- C:\Windows\System\qYjWbHO.exe
  C:\Windows\System\qYjWbHO.exe
  2⤵
  PID:11456
- C:\Windows\System\JCDDzzb.exe
  C:\Windows\System\JCDDzzb.exe
  2⤵
  PID:11480
- C:\Windows\System\rmCvaTb.exe
  C:\Windows\System\rmCvaTb.exe
  2⤵
  PID:11508
- C:\Windows\System\kAARelC.exe
  C:\Windows\System\kAARelC.exe
  2⤵
  PID:11540
- C:\Windows\System\CbgHdqW.exe
  C:\Windows\System\CbgHdqW.exe
  2⤵
  PID:11572
- C:\Windows\System\agZQqHP.exe
  C:\Windows\System\agZQqHP.exe
  2⤵
  PID:11592
- C:\Windows\System\RRIgPFV.exe
  C:\Windows\System\RRIgPFV.exe
  2⤵
  PID:11620
- C:\Windows\System\xqtPwyG.exe
  C:\Windows\System\xqtPwyG.exe
  2⤵
  PID:11640
- C:\Windows\System\yzAtoNb.exe
  C:\Windows\System\yzAtoNb.exe
  2⤵
  PID:11668
- C:\Windows\System\LGXTSWl.exe
  C:\Windows\System\LGXTSWl.exe
  2⤵
  PID:11696
- C:\Windows\System\NuBAlax.exe
  C:\Windows\System\NuBAlax.exe
  2⤵
  PID:11724
- C:\Windows\System\KCcvduh.exe
  C:\Windows\System\KCcvduh.exe
  2⤵
  PID:11756
- C:\Windows\System\HNbVxEf.exe
  C:\Windows\System\HNbVxEf.exe
  2⤵
  PID:11772
- C:\Windows\System\TseFbXM.exe
  C:\Windows\System\TseFbXM.exe
  2⤵
  PID:11800
- C:\Windows\System\IGTuJHf.exe
  C:\Windows\System\IGTuJHf.exe
  2⤵
  PID:11824
- C:\Windows\System\advOVND.exe
  C:\Windows\System\advOVND.exe
  2⤵
  PID:11856
- C:\Windows\System\VSwCTvE.exe
  C:\Windows\System\VSwCTvE.exe
  2⤵
  PID:11892
- C:\Windows\System\tZxfWMG.exe
  C:\Windows\System\tZxfWMG.exe
  2⤵
  PID:11924
- C:\Windows\System\PBESSbL.exe
  C:\Windows\System\PBESSbL.exe
  2⤵
  PID:11956
- C:\Windows\System\VPSGvNJ.exe
  C:\Windows\System\VPSGvNJ.exe
  2⤵
  PID:11988
- C:\Windows\System\FpkdfLi.exe
  C:\Windows\System\FpkdfLi.exe
  2⤵
  PID:12024
- C:\Windows\System\ifUPNCG.exe
  C:\Windows\System\ifUPNCG.exe
  2⤵
  PID:12064
- C:\Windows\System\soLvghm.exe
  C:\Windows\System\soLvghm.exe
  2⤵
  PID:12096
- C:\Windows\System\MVgLfXl.exe
  C:\Windows\System\MVgLfXl.exe
  2⤵
  PID:12116
- C:\Windows\System\TeBhbva.exe
  C:\Windows\System\TeBhbva.exe
  2⤵
  PID:12152
- C:\Windows\System\qvZwDLN.exe
  C:\Windows\System\qvZwDLN.exe
  2⤵
  PID:12184
- C:\Windows\System\oRPHKFz.exe
  C:\Windows\System\oRPHKFz.exe
  2⤵
  PID:12216
- C:\Windows\System\sHLdTGI.exe
  C:\Windows\System\sHLdTGI.exe
  2⤵
  PID:12240
- C:\Windows\System\zzlGHDm.exe
  C:\Windows\System\zzlGHDm.exe
  2⤵
  PID:12276
- C:\Windows\System\KrIcwkv.exe
  C:\Windows\System\KrIcwkv.exe
  2⤵
  PID:10728
- C:\Windows\System\luFKrmM.exe
  C:\Windows\System\luFKrmM.exe
  2⤵
  PID:11144
- C:\Windows\System\yWARiXv.exe
  C:\Windows\System\yWARiXv.exe
  2⤵
  PID:11288
- C:\Windows\System\PXQZvql.exe
  C:\Windows\System\PXQZvql.exe
  2⤵
  PID:11348
- C:\Windows\System\RvKGNCh.exe
  C:\Windows\System\RvKGNCh.exe
  2⤵
  PID:11528
- C:\Windows\System\TbsDWFn.exe
  C:\Windows\System\TbsDWFn.exe
  2⤵
  PID:11584
- C:\Windows\System\YTmPOVm.exe
  C:\Windows\System\YTmPOVm.exe
  2⤵
  PID:11612
- C:\Windows\System\RUPPrBi.exe
  C:\Windows\System\RUPPrBi.exe
  2⤵
  PID:11652
- C:\Windows\System\qfqjsow.exe
  C:\Windows\System\qfqjsow.exe
  2⤵
  PID:11720
- C:\Windows\System\bQxUpZT.exe
  C:\Windows\System\bQxUpZT.exe
  2⤵
  PID:11812
- C:\Windows\System\EiMzbEn.exe
  C:\Windows\System\EiMzbEn.exe
  2⤵
  PID:11848
- C:\Windows\System\ynIJrmq.exe
  C:\Windows\System\ynIJrmq.exe
  2⤵
  PID:11944
- C:\Windows\System\ExPIDLf.exe
  C:\Windows\System\ExPIDLf.exe
  2⤵
  PID:12056
- C:\Windows\System\fcjLsrH.exe
  C:\Windows\System\fcjLsrH.exe
  2⤵
  PID:12080
- C:\Windows\System\WOvvhpI.exe
  C:\Windows\System\WOvvhpI.exe
  2⤵
  PID:12168
- C:\Windows\System\NFybcgm.exe
  C:\Windows\System\NFybcgm.exe
  2⤵
  PID:12204
- C:\Windows\System\CyHjINi.exe
  C:\Windows\System\CyHjINi.exe
  2⤵
  PID:12264
- C:\Windows\System\hSJvVMR.exe
  C:\Windows\System\hSJvVMR.exe
  2⤵
  PID:11340
- C:\Windows\System\pzefTIL.exe
  C:\Windows\System\pzefTIL.exe
  2⤵
  PID:11388
- C:\Windows\System\VNPmLmT.exe
  C:\Windows\System\VNPmLmT.exe
  2⤵
  PID:11504
- C:\Windows\System\uAIkGJj.exe
  C:\Windows\System\uAIkGJj.exe
  2⤵
  PID:11708
- C:\Windows\System\LLdQLaU.exe
  C:\Windows\System\LLdQLaU.exe
  2⤵
  PID:11820
- C:\Windows\System\ffkCXmZ.exe
  C:\Windows\System\ffkCXmZ.exe
  2⤵
  PID:11984
- C:\Windows\System\DBWjiNH.exe
  C:\Windows\System\DBWjiNH.exe
  2⤵
  PID:12048
- C:\Windows\System\YAGRuBy.exe
  C:\Windows\System\YAGRuBy.exe
  2⤵
  PID:12212
- C:\Windows\System\asHkiju.exe
  C:\Windows\System\asHkiju.exe
  2⤵
  PID:11384
- C:\Windows\System\EUsSANf.exe
  C:\Windows\System\EUsSANf.exe
  2⤵
  PID:11872
- C:\Windows\System\vBgycwb.exe
  C:\Windows\System\vBgycwb.exe
  2⤵
  PID:10964
- C:\Windows\System\sPXnrpg.exe
  C:\Windows\System\sPXnrpg.exe
  2⤵
  PID:11368
- C:\Windows\System\HXYHGmH.exe
  C:\Windows\System\HXYHGmH.exe
  2⤵
  PID:12296
- C:\Windows\System\VtyxnDK.exe
  C:\Windows\System\VtyxnDK.exe
  2⤵
  PID:12312
- C:\Windows\System\OOqweMW.exe
  C:\Windows\System\OOqweMW.exe
  2⤵
  PID:12352
- C:\Windows\System\nzHJLgj.exe
  C:\Windows\System\nzHJLgj.exe
  2⤵
  PID:12380
- C:\Windows\System\xUBJeWA.exe
  C:\Windows\System\xUBJeWA.exe
  2⤵
  PID:12396
- C:\Windows\System\oCaUpKC.exe
  C:\Windows\System\oCaUpKC.exe
  2⤵
  PID:12436
- C:\Windows\System\YBnSqsr.exe
  C:\Windows\System\YBnSqsr.exe
  2⤵
  PID:12452
- C:\Windows\System\XpHykHP.exe
  C:\Windows\System\XpHykHP.exe
  2⤵
  PID:12476
- C:\Windows\System\IObBtGv.exe
  C:\Windows\System\IObBtGv.exe
  2⤵
  PID:12512
- C:\Windows\System\gzrhcOb.exe
  C:\Windows\System\gzrhcOb.exe
  2⤵
  PID:12548
- C:\Windows\System\RXceWZx.exe
  C:\Windows\System\RXceWZx.exe
  2⤵
  PID:12576
- C:\Windows\System\omOAlBx.exe
  C:\Windows\System\omOAlBx.exe
  2⤵
  PID:12604
- C:\Windows\System\FziytdP.exe
  C:\Windows\System\FziytdP.exe
  2⤵
  PID:12620
- C:\Windows\System\YbJtnIs.exe
  C:\Windows\System\YbJtnIs.exe
  2⤵
  PID:12648
- C:\Windows\System\BgNJwyQ.exe
  C:\Windows\System\BgNJwyQ.exe
  2⤵
  PID:12668
- C:\Windows\System\fOPsGvD.exe
  C:\Windows\System\fOPsGvD.exe
  2⤵
  PID:12688
- C:\Windows\System\jSIlWwm.exe
  C:\Windows\System\jSIlWwm.exe
  2⤵
  PID:12720
- C:\Windows\System\AylXiUA.exe
  C:\Windows\System\AylXiUA.exe
  2⤵
  PID:12760
- C:\Windows\System\CMcRupO.exe
  C:\Windows\System\CMcRupO.exe
  2⤵
  PID:12776
- C:\Windows\System\cJChmox.exe
  C:\Windows\System\cJChmox.exe
  2⤵
  PID:12816
- C:\Windows\System\UvwREuv.exe
  C:\Windows\System\UvwREuv.exe
  2⤵
  PID:12852
- C:\Windows\System\RdOLVJv.exe
  C:\Windows\System\RdOLVJv.exe
  2⤵
  PID:12884
- C:\Windows\System\MkgjwWE.exe
  C:\Windows\System\MkgjwWE.exe
  2⤵
  PID:12912
- C:\Windows\System\vLUEtTj.exe
  C:\Windows\System\vLUEtTj.exe
  2⤵
  PID:12940
- C:\Windows\System\FdfuFNb.exe
  C:\Windows\System\FdfuFNb.exe
  2⤵
  PID:12968
- C:\Windows\System\LufxaeQ.exe
  C:\Windows\System\LufxaeQ.exe
  2⤵
  PID:12984
- C:\Windows\System\EYEUHzr.exe
  C:\Windows\System\EYEUHzr.exe
  2⤵
  PID:13000
- C:\Windows\System\PSbQVdR.exe
  C:\Windows\System\PSbQVdR.exe
  2⤵
  PID:13032
- C:\Windows\System\Zvndpvz.exe
  C:\Windows\System\Zvndpvz.exe
  2⤵
  PID:13060
- C:\Windows\System\sMxFBvX.exe
  C:\Windows\System\sMxFBvX.exe
  2⤵
  PID:13084
- C:\Windows\System\cEZBYJQ.exe
  C:\Windows\System\cEZBYJQ.exe
  2⤵
  PID:13120
- C:\Windows\System\PPmRvYb.exe
  C:\Windows\System\PPmRvYb.exe
  2⤵
  PID:13152
- C:\Windows\System\haVTkQG.exe
  C:\Windows\System\haVTkQG.exe
  2⤵
  PID:13180
- C:\Windows\System\nyOPBHA.exe
  C:\Windows\System\nyOPBHA.exe
  2⤵
  PID:13208
- C:\Windows\System\oUpMGYn.exe
  C:\Windows\System\oUpMGYn.exe
  2⤵
  PID:13248
- C:\Windows\System\beDEZvG.exe
  C:\Windows\System\beDEZvG.exe
  2⤵
  PID:13276
- C:\Windows\System\Dtdibph.exe
  C:\Windows\System\Dtdibph.exe
  2⤵
  PID:13304
- C:\Windows\System\dBvtdYq.exe
  C:\Windows\System\dBvtdYq.exe
  2⤵
  PID:12308
- C:\Windows\System\vdWFoxB.exe
  C:\Windows\System\vdWFoxB.exe
  2⤵
  PID:12392
- C:\Windows\System\gFCLvmp.exe
  C:\Windows\System\gFCLvmp.exe
  2⤵
  PID:12460
- C:\Windows\System\hkfMmZu.exe
  C:\Windows\System\hkfMmZu.exe
  2⤵
  PID:12508
- C:\Windows\System\bprDUKM.exe
  C:\Windows\System\bprDUKM.exe
  2⤵
  PID:12544
- C:\Windows\System\iqFqnGE.exe
  C:\Windows\System\iqFqnGE.exe
  2⤵
  PID:12616
- C:\Windows\System\MVbpDqb.exe
  C:\Windows\System\MVbpDqb.exe
  2⤵
  PID:12712
- C:\Windows\System\XOUwjyr.exe
  C:\Windows\System\XOUwjyr.exe
  2⤵
  PID:12796
- C:\Windows\System\HngMHPb.exe
  C:\Windows\System\HngMHPb.exe
  2⤵
  PID:12832
- C:\Windows\System\oqRWzDz.exe
  C:\Windows\System\oqRWzDz.exe
  2⤵
  PID:12872
- C:\Windows\System\KTqmzOJ.exe
  C:\Windows\System\KTqmzOJ.exe
  2⤵
  PID:12952
- C:\Windows\System\gHGtJtV.exe
  C:\Windows\System\gHGtJtV.exe
  2⤵
  PID:12980
- C:\Windows\System\pvyqlwK.exe
  C:\Windows\System\pvyqlwK.exe
  2⤵
  PID:13048
- C:\Windows\System\HbDdeDe.exe
  C:\Windows\System\HbDdeDe.exe
  2⤵
  PID:13080
- C:\Windows\System\xhsiJwB.exe
  C:\Windows\System\xhsiJwB.exe
  2⤵
  PID:13220
- C:\Windows\System\Uccqbjs.exe
  C:\Windows\System\Uccqbjs.exe
  2⤵
  PID:13264
- C:\Windows\System\DMgEjTv.exe
  C:\Windows\System\DMgEjTv.exe
  2⤵
  PID:12292
- C:\Windows\System\lcVrizJ.exe
  C:\Windows\System\lcVrizJ.exe
  2⤵
  PID:12492
- C:\Windows\System\kVATWEB.exe
  C:\Windows\System\kVATWEB.exe
  2⤵
  PID:12636
- C:\Windows\System\WQNQkOf.exe
  C:\Windows\System\WQNQkOf.exe
  2⤵
  PID:12840
- C:\Windows\System\NVgjyDw.exe
  C:\Windows\System\NVgjyDw.exe
  2⤵
  PID:12960
- C:\Windows\System\NjBOlnc.exe
  C:\Windows\System\NjBOlnc.exe
  2⤵
  PID:13076
- C:\Windows\System\BFBrSgn.exe
  C:\Windows\System\BFBrSgn.exe
  2⤵
  PID:13300
- C:\Windows\System\bjccgpK.exe
  C:\Windows\System\bjccgpK.exe
  2⤵
  PID:12572
- C:\Windows\System\wvKjURq.exe
  C:\Windows\System\wvKjURq.exe
  2⤵
  PID:12904
- C:\Windows\System\bqHOdqp.exe
  C:\Windows\System\bqHOdqp.exe
  2⤵
  PID:12388
- C:\Windows\System\vFqTVhl.exe
  C:\Windows\System\vFqTVhl.exe
  2⤵
  PID:13168
- C:\Windows\System\mGBEUQz.exe
  C:\Windows\System\mGBEUQz.exe
  2⤵
  PID:13316
- C:\Windows\System\mlDfySo.exe
  C:\Windows\System\mlDfySo.exe
  2⤵
  PID:13344
- C:\Windows\System\wbrwWmt.exe
  C:\Windows\System\wbrwWmt.exe
  2⤵
  PID:13372
- C:\Windows\System\dLEAnRQ.exe
  C:\Windows\System\dLEAnRQ.exe
  2⤵
  PID:13392
- C:\Windows\System\VsLxhfw.exe
  C:\Windows\System\VsLxhfw.exe
  2⤵
  PID:13408
- C:\Windows\System\qjgxfhU.exe
  C:\Windows\System\qjgxfhU.exe
  2⤵
  PID:13440
- C:\Windows\System\ZbLlhNZ.exe
  C:\Windows\System\ZbLlhNZ.exe
  2⤵
  PID:13468
- C:\Windows\System\enYVvbV.exe
  C:\Windows\System\enYVvbV.exe
  2⤵
  PID:13496
- C:\Windows\System\aZMVTkx.exe
  C:\Windows\System\aZMVTkx.exe
  2⤵
  PID:13520
- C:\Windows\System\uUUnizG.exe
  C:\Windows\System\uUUnizG.exe
  2⤵
  PID:13544
- C:\Windows\System\JOcjota.exe
  C:\Windows\System\JOcjota.exe
  2⤵
  PID:13576
- C:\Windows\System\JXxsUOp.exe
  C:\Windows\System\JXxsUOp.exe
  2⤵
  PID:13604
- C:\Windows\System\tkehITN.exe
  C:\Windows\System\tkehITN.exe
  2⤵
  PID:13620
- C:\Windows\System\vEKLIAW.exe
  C:\Windows\System\vEKLIAW.exe
  2⤵
  PID:13652
- C:\Windows\System\OqEDUrt.exe
  C:\Windows\System\OqEDUrt.exe
  2⤵
  PID:13680
- C:\Windows\System\EyJalRV.exe
  C:\Windows\System\EyJalRV.exe
  2⤵
  PID:13696
- C:\Windows\System\ukuNjuM.exe
  C:\Windows\System\ukuNjuM.exe
  2⤵
  PID:13728
- C:\Windows\System\McVJcxt.exe
  C:\Windows\System\McVJcxt.exe
  2⤵
  PID:13812
- C:\Windows\System\IeqtZsh.exe
  C:\Windows\System\IeqtZsh.exe
  2⤵
  PID:13844
- C:\Windows\System\kERCyRn.exe
  C:\Windows\System\kERCyRn.exe
  2⤵
  PID:13872
- C:\Windows\System\EbykqMi.exe
  C:\Windows\System\EbykqMi.exe
  2⤵
  PID:13888
- C:\Windows\System\FPfRsTG.exe
  C:\Windows\System\FPfRsTG.exe
  2⤵
  PID:13916
- C:\Windows\System\AoEmFIA.exe
  C:\Windows\System\AoEmFIA.exe
  2⤵
  PID:13944
- C:\Windows\System\dQkpeXb.exe
  C:\Windows\System\dQkpeXb.exe
  2⤵
  PID:13960
- C:\Windows\System\RTOVnTd.exe
  C:\Windows\System\RTOVnTd.exe
  2⤵
  PID:13988
- C:\Windows\System\kUHLJUo.exe
  C:\Windows\System\kUHLJUo.exe
  2⤵
  PID:14008
- C:\Windows\System\oIpfoMv.exe
  C:\Windows\System\oIpfoMv.exe
  2⤵
  PID:14032
- C:\Windows\System\OOaaJQG.exe
  C:\Windows\System\OOaaJQG.exe
  2⤵
  PID:14056
- C:\Windows\System\CJbcEat.exe
  C:\Windows\System\CJbcEat.exe
  2⤵
  PID:14088
- C:\Windows\System\ImgjtoQ.exe
  C:\Windows\System\ImgjtoQ.exe
  2⤵
  PID:14104
- C:\Windows\System\wHHHFDP.exe
  C:\Windows\System\wHHHFDP.exe
  2⤵
  PID:14136
- C:\Windows\System\YnwiEnY.exe
  C:\Windows\System\YnwiEnY.exe
  2⤵
  PID:14160
- C:\Windows\System\PQOCOjx.exe
  C:\Windows\System\PQOCOjx.exe
  2⤵
  PID:14184
- C:\Windows\System\RDYIrIA.exe
  C:\Windows\System\RDYIrIA.exe
  2⤵
  PID:14220
- C:\Windows\System\yNWGXyj.exe
  C:\Windows\System\yNWGXyj.exe
  2⤵
  PID:14256
- C:\Windows\System\XPKCfim.exe
  C:\Windows\System\XPKCfim.exe
  2⤵
  PID:14280
- C:\Windows\System\ODpaZlh.exe
  C:\Windows\System\ODpaZlh.exe
  2⤵
  PID:14320
- C:\Windows\System\FvAujCM.exe
  C:\Windows\System\FvAujCM.exe
  2⤵
  PID:13332
- C:\Windows\System\dQATVXN.exe
  C:\Windows\System\dQATVXN.exe
  2⤵
  PID:13420
- C:\Windows\System\iMMkgHB.exe
  C:\Windows\System\iMMkgHB.exe
  2⤵
  PID:13476
- C:\Windows\System\UYhATBC.exe
  C:\Windows\System\UYhATBC.exe
  2⤵
  PID:13588
- C:\Windows\System\cVQDaOH.exe
  C:\Windows\System\cVQDaOH.exe
  2⤵
  PID:13640
- C:\Windows\System\kwEPxGt.exe
  C:\Windows\System\kwEPxGt.exe
  2⤵
  PID:13660
- C:\Windows\System\oMSlGnH.exe
  C:\Windows\System\oMSlGnH.exe
  2⤵
  PID:13740
- C:\Windows\System\LbUlwZq.exe
  C:\Windows\System\LbUlwZq.exe
  2⤵
  PID:13800
- C:\Windows\System\ykOgJzp.exe
  C:\Windows\System\ykOgJzp.exe
  2⤵
  PID:13864
- C:\Windows\System\YIQigMx.exe
  C:\Windows\System\YIQigMx.exe
  2⤵
  PID:13952
- C:\Windows\System\xgSMJzn.exe
  C:\Windows\System\xgSMJzn.exe
  2⤵
  PID:14016
- C:\Windows\System\XAoiWzc.exe
  C:\Windows\System\XAoiWzc.exe
  2⤵
  PID:14112
- C:\Windows\System\uRswgPR.exe
  C:\Windows\System\uRswgPR.exe
  2⤵
  PID:14124
- C:\Windows\System\KolbPWS.exe
  C:\Windows\System\KolbPWS.exe
  2⤵
  PID:14332
- C:\Windows\System\iFAfTHi.exe
  C:\Windows\System\iFAfTHi.exe
  2⤵
  PID:14312
- C:\Windows\System\KTVKvLH.exe
  C:\Windows\System\KTVKvLH.exe
  2⤵
  PID:13512
- C:\Windows\System\BUvKVcO.exe
  C:\Windows\System\BUvKVcO.exe
  2⤵
  PID:13724
- C:\Windows\System\ytCFJHM.exe
  C:\Windows\System\ytCFJHM.exe
  2⤵
  PID:13716
- C:\Windows\System\ijNuoVf.exe
  C:\Windows\System\ijNuoVf.exe
  2⤵
  PID:13820
- C:\Windows\System\WfRmIOw.exe
  C:\Windows\System\WfRmIOw.exe
  2⤵
  PID:14200
- C:\Windows\System\AeMiBxQ.exe
  C:\Windows\System\AeMiBxQ.exe
  2⤵
  PID:13388
- C:\Windows\System\GIIytHE.exe
  C:\Windows\System\GIIytHE.exe
  2⤵
  PID:14352
- C:\Windows\System\ztbPuSc.exe
  C:\Windows\System\ztbPuSc.exe
  2⤵
  PID:14380
- C:\Windows\System\AphBlJc.exe
  C:\Windows\System\AphBlJc.exe
  2⤵
  PID:14408
- C:\Windows\System\wwRUhHR.exe
  C:\Windows\System\wwRUhHR.exe
  2⤵
  PID:14432
- C:\Windows\System\KXBCKrp.exe
  C:\Windows\System\KXBCKrp.exe
  2⤵
  PID:14468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BuVgtIQ.exe

Filesize
1.9MB

MD5
22d77f1d25743036f10899e3957c914f

SHA1
4ef94891d8848fd69910a6a64a92924f42d2b199

SHA256
17e69433879163632a35026cbcf71af79f912095243f16a93af34bafb970b2b1

SHA512
72cc501628fc9126bbb50c1150e637ad5de3710097b21138f83e44ad8aea34445d6dcc4b20c39e4a2be32bd8e91394ca9c0744087e332175ad0082944b32cff6

Download Submit
C:\Windows\System\CICozfF.exe

Filesize
1.9MB

MD5
a0bcad29cdd61c31b2d879429825b846

SHA1
480fe2addf2108ac6148cc42d102a6f2a9fce8e7

SHA256
377a561e82d39892de027ec10c0115db498d4921cca5742cba129d1eefe7df59

SHA512
4866aac35dced86b22db330fa06509e8f1394bbacd648f5b0d084d54ac9bbf0c061a6c9000bb41947b66886d16011864f38081519ddef3807d0da9b064e4003f

Download Submit
C:\Windows\System\EijDYak.exe

Filesize
1.9MB

MD5
aeeee6c95e0a926a43f346608396a0e6

SHA1
9aeda6f378ff1ae9778c263d1790c477287a4d3f

SHA256
0ebc8ccaf243d5a45ac9c5df155004271d3bcfe2029e464a0e946af8bad6b5da

SHA512
88ad6341c4a08dd6d030a74e83aebddf752d042e5aca4c1069b68ab17eb82e770e741fddf99e034b149b3bf46491327c5e8b47172671851baf41f534adcc1192

Download Submit
C:\Windows\System\EqxGuUm.exe

Filesize
1.9MB

MD5
138bf9be88c0ff3517321fc6011c4e8f

SHA1
4d7236a032d6e24e4a29f4ea949d734a6d540bcc

SHA256
ab1f637896eeb7aa32da04970fbec2a06a93c0a1a0182bec5a9fafe2673470ee

SHA512
21e5ea0d6dc572af90dbcc2ed470f51971b42862d8129948c828cfb86f7cdd03cb8d0f64c057d24460ee7b83798a42421aeac1948ddd9adf9009495c9c16a2e4

Download Submit
C:\Windows\System\FpDtyOC.exe

Filesize
1.9MB

MD5
f87926a9afc02a4a21b52d1d64e9593c

SHA1
8961da862b585d15bdf4b90d95e686c956577098

SHA256
411dfd5cf8aacff2f8e8fd56734e3d73e7c44c01004179da7130ac62274deed1

SHA512
488d261f011bea5fd4e1e7620518be74fb763fae81268436bded28fcaba46fe6173ca5592e55a88868d243b4e46f4666ed206a10c5fcda1cb34e3de771fa86f0

Download Submit
C:\Windows\System\GjKbnjd.exe

Filesize
1.9MB

MD5
cd8c7b130e671688fb3d6f85091032b5

SHA1
0a1a78bd3b0717024c845d03be7c46e7fb547f0e

SHA256
f64decb1f815f619a30228b4bf6f745707bd6f4dcadb8fdce84d27aa1be90d7d

SHA512
d9933e708d44de76b0c02082b4b4441c0739c886096599e458391ea42d9ced63a7a570884798fdba223108aad83724d43a2338ace32c38f38bcf49641464120f

Download Submit
C:\Windows\System\IpjLcQs.exe

Filesize
1.9MB

MD5
f3b83394e1e57ae23ae07d99fef0dcfa

SHA1
2dca5019dfc91519bd5fca45400b05e28b30a927

SHA256
3583e58633afc41cbce33a6c49b11041c85ee02c9f8183694952c463704569f4

SHA512
3a70cf02ab859001ce899d43da44f5403234f3d8d99be1401619f77017be872211fb046861d95482a20de78b92db4effbe1e00bf38df083d87411e1d0860481e

Download Submit
C:\Windows\System\OZMadEr.exe

Filesize
1.9MB

MD5
e54ca7b7d19fed8c9d52920985a6c404

SHA1
8cc334c1f8d625d376c3d36d78445ddfcbf0d6ff

SHA256
55967320070b7d919398d16f36353850154e00096f66e9010ef679849ba94c02

SHA512
ba1dcdee7e4c4f81b365dac5d92c6403fc51ac07a3d09db11fd5eef622e5c07cf98a1e5d7592bfe6ea5643106734f650576074a35e1ffc7b0cafceefc16e028f

Download Submit
C:\Windows\System\OZWdvau.exe

Filesize
1.9MB

MD5
4fe2b888b510e106793a32699df455d0

SHA1
05998c2b9b04701ae8f950d9916b8e0ec2bb7254

SHA256
bd5ed8017483a4b047b04e229b653961b9e01e141ee6ef84ce7e1e0b788a2bb8

SHA512
78c51df4b5bf169d78e6c13a7ded6dbf5fb87aaa8aee82f941d80d1df7823f5a3b68641fa36803785566c6846eabac3d716ca42a3244d44c6716f9c174415f40

Download Submit
C:\Windows\System\PtCdhPq.exe

Filesize
1.9MB

MD5
44a5d36df4b5019bd39a84dba4b83d43

SHA1
666e78f5f0632a825ca643efc8bd010334fd5f14

SHA256
dcd0246fbf2a2ddff1f00c2093c0107f4f1bfeeb10f100c3c14c99048f1c2099

SHA512
02f9491e21f80c582bc439c6a918d42580216293f7ad01a7df3308461efe1b670f78e5409cf228be4d922f93a88f8f82b641ec21d332cd9fda6484c3d4f7fd9b

Download Submit
C:\Windows\System\QPQzlIl.exe

Filesize
1.9MB

MD5
e530ef70fadf13c77a58778235086f3d

SHA1
208bacdeb1b53a3483b66fd31a95eb3ee78662aa

SHA256
df2703e2f6b3cacf415c891fe20e356b81e62f458579fea2bef15f6b1d613ef3

SHA512
f493745322203a7aa251234a082d5dff0a1c481a44eed5482aebb1d1efe4e2aeefa73f36dd8853c63053ca29bad38ffd824711dcd47735916b3adf20a9854a4b

Download Submit
C:\Windows\System\UPBtDtq.exe

Filesize
1.9MB

MD5
55d428d03e635b9447b7370868674ce9

SHA1
8234a0b4993f1c7730b6ebeb4b495e63be20c6b2

SHA256
aa1864a2aa5e2aee45134e8c1d003987538918b9a78a8b1bab4482136fd34f67

SHA512
b9655b302ec1b7746d0568dbb0849f7876ed7fe55728f58b27e26e778392267442e3d9705985d0685f9c50a6024299e8ec434ad29ac2d0659af3ebff0a248ad8

Download Submit
C:\Windows\System\UmAdQPn.exe

Filesize
1.9MB

MD5
6a04236d40894c62fd40034a87006ea4

SHA1
b91553c942bc9d2fc1ba269ea69d124704bc4ef2

SHA256
e68bc072167880109a56de5ec93bf996e40ee76d9b15aede477404f168dbe0c4

SHA512
db9def5430a5693afd8fcf901ffab857254bafbba7440e5cc490781d27832c5d1567f2f8f696ababc8140e3fa5b74ca0a7573e580cbbd87205bc434ce2a5191b

Download Submit
C:\Windows\System\VYjpcii.exe

Filesize
1.9MB

MD5
5a64ced44ba03c23d59dcd3994b890d0

SHA1
823261bdf23bc7f192bef28ff64b53afa39dbbd7

SHA256
2a4c845380c35f7f0e561571cc28a03afa1d94d5e98a5782eef140ea02877b42

SHA512
8daf914e5f755676d8ddb7e1d21de4c7a6439405d8d366f3f333710714dd3b4071d1acb79553190e9844be48ac6f61314f5c66a7d8fead0e70ea9cce560137c4

Download Submit
C:\Windows\System\WivsiTp.exe

Filesize
1.9MB

MD5
da3e25ff21a1c9d99bbc251f0d11550c

SHA1
469f249b1e43b25922f075dcc4d5ce3142f645b2

SHA256
162db1e2ea0506b2df2136405057c61f7054a7bb2927c7153b2838301aeccd51

SHA512
8a7db5ec2cc0ace9637884643353a0a92fce512295caa30a81f7076cdd606e860230eac81abde23399a42aa7692b5bb2fff33302ee575bea39b55e907ea9f1d4

Download Submit
C:\Windows\System\XFKgrps.exe

Filesize
1.9MB

MD5
b9840f3c60a99abd460c13dbf9e1482d

SHA1
98a282267a5fe7152038ebec6bf164dbe8aacef2

SHA256
41b913c415790c994012872a550280755c40803be423deae60057d7decfa7a0a

SHA512
d79f50d830d8834a46d278595c3c4d8f6a0adb7e2a0936cbf7f94af4d5d3266daece8cfb08792ff6a3834b449a876584b76352be5d07bd7c75a74b6f4ddb9d1c

Download Submit
C:\Windows\System\YWUKqsA.exe

Filesize
1.9MB

MD5
bf175b176ca280760b1e4bf30c4bfc5e

SHA1
653901ee0f98128e26d02bd43c1302e3c5dfa049

SHA256
b9ab5c27958cf7dcabb2f1c9fd9a1c3f69e910922e56298842c5fff0c71efd63

SHA512
9bbe18ef11b3f141258c0cf53ca25bf913e823ab46f2b77c79fb85663f8f38fcec643360e45bc3c6ef3753d7a7d61583c990ec80ec4ed1b4fabb244990dd34d2

Download Submit
C:\Windows\System\dKbWCfH.exe

Filesize
1.9MB

MD5
ac01f15d5f8f53861599b3d46fbd1207

SHA1
4f037fb0605e02520bcf4750fdd3dafdbe10a8cb

SHA256
186d7bfd5ae2b199854e8d682384123db49f3dd4b66c7d938c4e7c2ffab1f5af

SHA512
d5e41319053dddaa4b5bcf8ce63a592d4732d5dd1485e4da7f3f5bb52d39258dddb4d0a2fcf4b3c95926e96fde1a642b4a1ab32bda644db8e699420ef1edd8a8

Download Submit
C:\Windows\System\eeqrhpL.exe

Filesize
1.9MB

MD5
009f7cfe1a50622a362054fb2bfd3e45

SHA1
3e503f9e35287ceee2624e64c180c220a99d39a6

SHA256
2f2fd80e00a0f5d220978b5d82b4e19f927f4ad07e1a052ca42c6b270f58b128

SHA512
c36bfacd6bfcf6ab175c96a4bca7377d0729976bb827b3b486dca932556eed360b98b4eea35580cc0a83ff7240f3f87a8cd90ef00ff1a9335be64524e6615d4e

Download Submit
C:\Windows\System\epNLpQM.exe

Filesize
1.9MB

MD5
754182a0905170156570edb6b60092b9

SHA1
a77a2d9f2fc07ce5a6a518ac4f4e8a3062e1dd9e

SHA256
b2908bd9b8e4c87393792dcb6e2df4cfeeecba32444b9e7e0758b25a14eed25e

SHA512
11349dd5761725a85f5aca1f1e06eea2cc30e43455bd7fff18c3e77abde89f0e899b437b43d375fa01d159fa6af74e7a25323190fe9eee906cab65e8ccbea5c1

Download Submit
C:\Windows\System\hCwyIPU.exe

Filesize
1.9MB

MD5
75c13676aaa600bb0e56e7d9dce3164f

SHA1
7d19aceef595f1afdc9a9b49508adb3dc3cf2592

SHA256
60694c1653ff756f720625195bdf4a5e1bc332d528605141e47773971ef69023

SHA512
55d3acb928da668feb33dc1f52036a97398d6b67aadcaae37f952d395a7e8f278eda9aadec61bcbe7cb39869c39b9287b2936f035576fe6a47faf3a649fee0e6

Download Submit
C:\Windows\System\jPyzjSN.exe

Filesize
1.9MB

MD5
c4d3f0f1a400f0b1b6dcc7767b868bc6

SHA1
e14cccc36c9bb728a4f241ac4827c49e3307a28d

SHA256
e899b98135541bb053f7e5011f33534bdb92d07626b537adaf15f52de80acc07

SHA512
7f2edf3ec552f1f18b2a73fb52c58f4b5cec379b1bb94c05c53550e0df05f9a1d2e96409fefad68859252ab26c53f86175f52f92e85fd89b211eaa7b0d1fdb9e

Download Submit
C:\Windows\System\jXMVWKq.exe

Filesize
1.9MB

MD5
b8103b54018c10649c7d6659531073fb

SHA1
8c4a022a5e883cbe92224a902cb30075bcb7d7eb

SHA256
8b0bbcc47773efaa0b350263224918527b13b4ccfdc8c72ec6c2d19f28c29222

SHA512
f4fa575ac64f52fdb9249e76eb8424aab48c46791156ff70026464316b02daa80f042cf9930ca62ac827ab2a4c5977db21a98c124e122a7b29529fe0fd0d5331

Download Submit
C:\Windows\System\kIsHmyx.exe

Filesize
1.9MB

MD5
9afb47c00f4c4c2ae80d88c9f857e082

SHA1
f839a1c5093167beea2a26a0f135627ddf285f3f

SHA256
87c3cac6a1eeb322f4deface928c941680d934ca83ddd6e05b2808bc5a1b8ac6

SHA512
dc13b2a816732e0692a436a3e77cc6e061b1026268fc86330b7151eb52dc710c79fc4ad3c9caebe39ab2375dd850d4dfb01805ec6961900c7519100f802d970a

Download Submit
C:\Windows\System\lwnLqPe.exe

Filesize
1.9MB

MD5
252ca6109d4c45d16f031c0258e44014

SHA1
1b45621dc31fe4b5b8651037fd9f324269f457c9

SHA256
57ae21469f0f2c2d37fe0e91b8c04190e45aae7e71a6d9eed3a75135bb6a1753

SHA512
ef5bac419a28cdee80c513d00502684d8eea8dc6aceca34606933d43b245cb7f4985a8f83110f74d8a4d2b6ab3b5a8106e5ad487d8434c7b43a2add8c7a1253c

Download Submit
C:\Windows\System\nyPVlcm.exe

Filesize
1.9MB

MD5
06636e3d34bc79421feb09ece27c49cc

SHA1
f0d6888793de97f43a76091e8ab9ed882327e746

SHA256
bc7ee363cd5dce4c1988ab1eb14aee82368eb4604965f81f229bd43356e1ca3a

SHA512
35e059e001be5e58c6de00ff115f728cf5a7b6eb20a49ba632c584d2555dd04305024dae2454cda47adea70c06fe73acd38a342885ffe3a9a35f28109a020d08

Download Submit
C:\Windows\System\omgMZlo.exe

Filesize
1.9MB

MD5
64f164c8e76f447edbced720d8ea71c8

SHA1
e611af8fe157c921a95429064d057995cf86d4fa

SHA256
dd004ac00b363a91e5e456eee03b9b4947e977335e823daa88b6a347634b5036

SHA512
c2871746cb0c21efd45a2e51354685c379f17b88fc0affdb56ddf2cf1168cae8d41983d222a37d32992751fed132726d0ba1a2354b5dfdf6a3332e3460337891

Download Submit
C:\Windows\System\pDCQTLp.exe

Filesize
1.9MB

MD5
475ab26824957157a9e4e41f23b1b7cb

SHA1
87c0d96c76aa5f616dda14fa6220ec2c1222c426

SHA256
217753824a2d4833810a640f1893089ec074ec19b32a50b8881b91bab055a6c7

SHA512
b5842357b3a339b6550aa467ae088a358728c93e3d92ceed22c9c101165562424a5b9e522619b9a97a71616943237c1af2dc97aa6660b714a3f3c36ad83c46cc

Download Submit
C:\Windows\System\qQlTgAe.exe

Filesize
1.9MB

MD5
dd4cb0a9c6c6207d7a75b5558ec4f64b

SHA1
b63f3d0de7c9df02da0cc5c99f4018cbbb9b5010

SHA256
a0e7e060b3448004b82bb69e56705b1f7807588780da9ab9b4d59f3a7c23ed8a

SHA512
fa88346ede9a63d314e6f0ba145fc5f6239a34a0dc55f180c8cc5e279799fe7d40585c2fd1cb5e175b2bf140bed29e824f0f38fbff8fc064c79526397cd35d2c

Download Submit
C:\Windows\System\rKUdkfX.exe

Filesize
1.9MB

MD5
9aba993cc863a8a47bbc8021c6dee51a

SHA1
1912bcf965122c272abc537edde1a64cd8cd804c

SHA256
1066b28769bb4abc5c05c0563adf804fa5e58f69306b60c2e47d4294197f3d67

SHA512
1b6b2279fa3b4765c49ff18a262b72920e5e3459b164aaaa4d6d90b940d3dca09f842d38ab3b1673dbff8e9c3422681d6c1c4d951b058ad184153f6474180664

Download Submit
C:\Windows\System\uLyneFY.exe

Filesize
1.9MB

MD5
ffc41689f8dc5c9da4e185d69a0d044d

SHA1
69df5c873b31084df86f8e40d30e17058723c89e

SHA256
d2d8a1de6e2f2e51f61cc7951e1527da5a8fa2d3e2be99d39ae79d1b4886f827

SHA512
54338f6cbfbee616f37b80e7e6b927b83076e135085c081464050b5aec3f9a835ff3f7d84c38a8c5d1cf0dcf051920a5f2eb70bb1ae9355f9465063777a6be21

Download Submit
C:\Windows\System\yxVvTEe.exe

Filesize
1.9MB

MD5
8f9a90514ee4b2f534ef6f2505d139b6

SHA1
a66025e4a51fba68c1e4729e16172059a79e1bff

SHA256
a4487da4633c1944b5f83d8ca65d72996b23ce14919273c3a022054db4eae92c

SHA512
89849fd55a0276a949db061a91f4e946fe86fa4d2120a704198dbf9ae01086591a38e0cabd83f66d207d9381268437d3c90ab352b5a4c099572a7a0aac6bceee

Download Submit
C:\Windows\System\zLoHquR.exe

Filesize
1.9MB

MD5
7e398846033e51f6d019e676d72e5357

SHA1
0bc331f9e59438232e945c1f7793cc6bada702d1

SHA256
eff90fbfddb4eb6e5a79f5d05707608a3e3ae451cfc9ed8b9a5489bcc06040cc

SHA512
ed705254ba735980668806e6bd3ed15c3cc7ea87e4a8a27cfd1735a4a02ed2202a5344ba1816e60610f6335f4016cfecb5e594150a6b15fddcd541090efea9b2

Download Submit
memory/212-191-0x00007FF7EEAD0000-0x00007FF7EEE24000-memory.dmp

Filesize
3.3MB

Download
memory/212-2105-0x00007FF7EEAD0000-0x00007FF7EEE24000-memory.dmp

Filesize
3.3MB

Download
memory/408-2107-0x00007FF665DC0000-0x00007FF666114000-memory.dmp

Filesize
3.3MB

Download
memory/408-178-0x00007FF665DC0000-0x00007FF666114000-memory.dmp

Filesize
3.3MB

Download
memory/468-81-0x00007FF62C420000-0x00007FF62C774000-memory.dmp

Filesize
3.3MB

Download
memory/468-2101-0x00007FF62C420000-0x00007FF62C774000-memory.dmp

Filesize
3.3MB

Download
memory/736-2116-0x00007FF7E6740000-0x00007FF7E6A94000-memory.dmp

Filesize
3.3MB

Download
memory/736-184-0x00007FF7E6740000-0x00007FF7E6A94000-memory.dmp

Filesize
3.3MB

Download
memory/756-180-0x00007FF635620000-0x00007FF635974000-memory.dmp

Filesize
3.3MB

Download
memory/756-2121-0x00007FF635620000-0x00007FF635974000-memory.dmp

Filesize
3.3MB

Download
memory/916-2111-0x00007FF6E7A50000-0x00007FF6E7DA4000-memory.dmp

Filesize
3.3MB

Download
memory/916-192-0x00007FF6E7A50000-0x00007FF6E7DA4000-memory.dmp

Filesize
3.3MB

Download
memory/1164-193-0x00007FF6E2330000-0x00007FF6E2684000-memory.dmp

Filesize
3.3MB

Download
memory/1164-2120-0x00007FF6E2330000-0x00007FF6E2684000-memory.dmp

Filesize
3.3MB

Download
memory/1228-2124-0x00007FF73BD00000-0x00007FF73C054000-memory.dmp

Filesize
3.3MB

Download
memory/1228-2095-0x00007FF73BD00000-0x00007FF73C054000-memory.dmp

Filesize
3.3MB

Download
memory/1228-101-0x00007FF73BD00000-0x00007FF73C054000-memory.dmp

Filesize
3.3MB

Download
memory/1280-188-0x00007FF771E90000-0x00007FF7721E4000-memory.dmp

Filesize
3.3MB

Download
memory/1280-2114-0x00007FF771E90000-0x00007FF7721E4000-memory.dmp

Filesize
3.3MB

Download
memory/1540-181-0x00007FF67C200000-0x00007FF67C554000-memory.dmp

Filesize
3.3MB

Download
memory/1540-2104-0x00007FF67C200000-0x00007FF67C554000-memory.dmp

Filesize
3.3MB

Download
memory/2204-2112-0x00007FF790380000-0x00007FF7906D4000-memory.dmp

Filesize
3.3MB

Download
memory/2204-182-0x00007FF790380000-0x00007FF7906D4000-memory.dmp

Filesize
3.3MB

Download
memory/2432-100-0x00007FF78E110000-0x00007FF78E464000-memory.dmp

Filesize
3.3MB

Download
memory/2432-2102-0x00007FF78E110000-0x00007FF78E464000-memory.dmp

Filesize
3.3MB

Download
memory/2512-2106-0x00007FF654F50000-0x00007FF6552A4000-memory.dmp

Filesize
3.3MB

Download
memory/2512-183-0x00007FF654F50000-0x00007FF6552A4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-2109-0x00007FF7718C0000-0x00007FF771C14000-memory.dmp

Filesize
3.3MB

Download
memory/2564-171-0x00007FF7718C0000-0x00007FF771C14000-memory.dmp

Filesize
3.3MB

Download
memory/2604-179-0x00007FF778BC0000-0x00007FF778F14000-memory.dmp

Filesize
3.3MB

Download
memory/2604-2122-0x00007FF778BC0000-0x00007FF778F14000-memory.dmp

Filesize
3.3MB

Download
memory/2924-33-0x00007FF796C10000-0x00007FF796F64000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2098-0x00007FF796C10000-0x00007FF796F64000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2093-0x00007FF796C10000-0x00007FF796F64000-memory.dmp

Filesize
3.3MB

Download
memory/3016-16-0x00007FF6FF780000-0x00007FF6FFAD4000-memory.dmp

Filesize
3.3MB

Download
memory/3016-2096-0x00007FF6FF780000-0x00007FF6FFAD4000-memory.dmp

Filesize
3.3MB

Download
memory/3056-189-0x00007FF6599D0000-0x00007FF659D24000-memory.dmp

Filesize
3.3MB

Download
memory/3056-2099-0x00007FF6599D0000-0x00007FF659D24000-memory.dmp

Filesize
3.3MB

Download
memory/3284-159-0x00007FF79E330000-0x00007FF79E684000-memory.dmp

Filesize
3.3MB

Download
memory/3284-2123-0x00007FF79E330000-0x00007FF79E684000-memory.dmp

Filesize
3.3MB

Download
memory/3580-53-0x00007FF794E10000-0x00007FF795164000-memory.dmp

Filesize
3.3MB

Download
memory/3580-2097-0x00007FF794E10000-0x00007FF795164000-memory.dmp

Filesize
3.3MB

Download
memory/3648-186-0x00007FF7F0060000-0x00007FF7F03B4000-memory.dmp

Filesize
3.3MB

Download
memory/3648-2119-0x00007FF7F0060000-0x00007FF7F03B4000-memory.dmp

Filesize
3.3MB

Download
memory/3700-2092-0x00007FF719E00000-0x00007FF71A154000-memory.dmp

Filesize
3.3MB

Download
memory/3700-1-0x000001822D900000-0x000001822D910000-memory.dmp

Filesize
64KB

Download
memory/3700-0-0x00007FF719E00000-0x00007FF71A154000-memory.dmp

Filesize
3.3MB

Download
memory/3760-146-0x00007FF71FB10000-0x00007FF71FE64000-memory.dmp

Filesize
3.3MB

Download
memory/3760-2108-0x00007FF71FB10000-0x00007FF71FE64000-memory.dmp

Filesize
3.3MB

Download
memory/3780-2094-0x00007FF708CE0000-0x00007FF709034000-memory.dmp

Filesize
3.3MB

Download
memory/3780-2100-0x00007FF708CE0000-0x00007FF709034000-memory.dmp

Filesize
3.3MB

Download
memory/3780-74-0x00007FF708CE0000-0x00007FF709034000-memory.dmp

Filesize
3.3MB

Download
memory/3820-190-0x00007FF764A60000-0x00007FF764DB4000-memory.dmp

Filesize
3.3MB

Download
memory/3820-2103-0x00007FF764A60000-0x00007FF764DB4000-memory.dmp

Filesize
3.3MB

Download
memory/4008-170-0x00007FF7D9C10000-0x00007FF7D9F64000-memory.dmp

Filesize
3.3MB

Download
memory/4008-2117-0x00007FF7D9C10000-0x00007FF7D9F64000-memory.dmp

Filesize
3.3MB

Download
memory/4372-2113-0x00007FF63B080000-0x00007FF63B3D4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-185-0x00007FF63B080000-0x00007FF63B3D4000-memory.dmp

Filesize
3.3MB

Download
memory/4548-2115-0x00007FF76F710000-0x00007FF76FA64000-memory.dmp

Filesize
3.3MB

Download
memory/4548-187-0x00007FF76F710000-0x00007FF76FA64000-memory.dmp

Filesize
3.3MB

Download
memory/4640-194-0x00007FF6DD520000-0x00007FF6DD874000-memory.dmp

Filesize
3.3MB

Download
memory/4640-2118-0x00007FF6DD520000-0x00007FF6DD874000-memory.dmp

Filesize
3.3MB

Download
memory/4792-2110-0x00007FF689B60000-0x00007FF689EB4000-memory.dmp

Filesize
3.3MB

Download
memory/4792-129-0x00007FF689B60000-0x00007FF689EB4000-memory.dmp

Filesize
3.3MB

Download