xmrig | 97503858ede60b51915a0fca63c496296e835b7d0ba0a9d0cd0749382b5e6155

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
Size

2.5MB
MD5

ebd519189de1a6d64430893facf6ad20
SHA1

48d7b5c5dc22ce3ce5c263bf9602b12329b9dfd6
SHA256

97503858ede60b51915a0fca63c496296e835b7d0ba0a9d0cd0749382b5e6155
SHA512

7a185d0677440c34794b12098c670a456546337b726cdf6b315a987e4b10611d39358d56bc004888034aacb1cf302f4ab98e8b412bbaa728db91b489a0032ef6
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+Aj4km1MsBH6E12H0:BemTLkNdfE0pZrh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4676-0-0x00007FF65CE30000-0x00007FF65D184000-memory.dmp	xmrig
behavioral2/files/0x0008000000023414-5.dat	xmrig
behavioral2/memory/4224-10-0x00007FF6A13F0000-0x00007FF6A1744000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-11.dat	xmrig
behavioral2/files/0x0007000000023419-17.dat	xmrig
behavioral2/files/0x000700000002341d-37.dat	xmrig
behavioral2/files/0x000700000002341f-50.dat	xmrig
behavioral2/files/0x0007000000023422-66.dat	xmrig
behavioral2/files/0x0007000000023424-76.dat	xmrig
behavioral2/files/0x0007000000023426-86.dat	xmrig
behavioral2/files/0x0007000000023428-96.dat	xmrig
behavioral2/files/0x000700000002342d-121.dat	xmrig
behavioral2/files/0x0007000000023431-137.dat	xmrig
behavioral2/files/0x0007000000023435-157.dat	xmrig
behavioral2/memory/3272-717-0x00007FF63A2A0000-0x00007FF63A5F4000-memory.dmp	xmrig
behavioral2/memory/4164-718-0x00007FF79B770000-0x00007FF79BAC4000-memory.dmp	xmrig
behavioral2/memory/4820-720-0x00007FF65D300000-0x00007FF65D654000-memory.dmp	xmrig
behavioral2/memory/2608-719-0x00007FF776410000-0x00007FF776764000-memory.dmp	xmrig
behavioral2/memory/2956-721-0x00007FF7289D0000-0x00007FF728D24000-memory.dmp	xmrig
behavioral2/memory/1808-722-0x00007FF653200000-0x00007FF653554000-memory.dmp	xmrig
behavioral2/memory/2472-724-0x00007FF744120000-0x00007FF744474000-memory.dmp	xmrig
behavioral2/memory/3664-723-0x00007FF6557B0000-0x00007FF655B04000-memory.dmp	xmrig
behavioral2/memory/1928-725-0x00007FF6EC810000-0x00007FF6ECB64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023437-165.dat	xmrig
behavioral2/files/0x0007000000023436-160.dat	xmrig
behavioral2/files/0x0007000000023434-155.dat	xmrig
behavioral2/files/0x0007000000023433-151.dat	xmrig
behavioral2/files/0x0007000000023432-145.dat	xmrig
behavioral2/files/0x0007000000023430-135.dat	xmrig
behavioral2/files/0x000700000002342f-131.dat	xmrig
behavioral2/files/0x000700000002342e-125.dat	xmrig
behavioral2/files/0x000700000002342c-116.dat	xmrig
behavioral2/files/0x000700000002342b-111.dat	xmrig
behavioral2/files/0x000700000002342a-105.dat	xmrig
behavioral2/files/0x0007000000023429-100.dat	xmrig
behavioral2/files/0x0007000000023427-90.dat	xmrig
behavioral2/files/0x0007000000023425-80.dat	xmrig
behavioral2/files/0x0007000000023423-70.dat	xmrig
behavioral2/files/0x0007000000023421-58.dat	xmrig
behavioral2/files/0x0007000000023420-56.dat	xmrig
behavioral2/files/0x000700000002341e-43.dat	xmrig
behavioral2/files/0x000700000002341c-33.dat	xmrig
behavioral2/files/0x000700000002341b-27.dat	xmrig
behavioral2/files/0x000700000002341a-23.dat	xmrig
behavioral2/memory/1512-22-0x00007FF67F0A0000-0x00007FF67F3F4000-memory.dmp	xmrig
behavioral2/memory/2776-726-0x00007FF697CA0000-0x00007FF697FF4000-memory.dmp	xmrig
behavioral2/memory/2748-727-0x00007FF70AEF0000-0x00007FF70B244000-memory.dmp	xmrig
behavioral2/memory/3128-728-0x00007FF67A980000-0x00007FF67ACD4000-memory.dmp	xmrig
behavioral2/memory/5112-729-0x00007FF6C2600000-0x00007FF6C2954000-memory.dmp	xmrig
behavioral2/memory/4644-735-0x00007FF6755E0000-0x00007FF675934000-memory.dmp	xmrig
behavioral2/memory/1600-740-0x00007FF6630B0000-0x00007FF663404000-memory.dmp	xmrig
behavioral2/memory/264-787-0x00007FF6ED400000-0x00007FF6ED754000-memory.dmp	xmrig
behavioral2/memory/3952-783-0x00007FF69C440000-0x00007FF69C794000-memory.dmp	xmrig
behavioral2/memory/1852-776-0x00007FF6BC7E0000-0x00007FF6BCB34000-memory.dmp	xmrig
behavioral2/memory/2144-772-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp	xmrig
behavioral2/memory/2104-764-0x00007FF7ACBA0000-0x00007FF7ACEF4000-memory.dmp	xmrig
behavioral2/memory/2952-759-0x00007FF735FA0000-0x00007FF7362F4000-memory.dmp	xmrig
behavioral2/memory/2696-791-0x00007FF77A570000-0x00007FF77A8C4000-memory.dmp	xmrig
behavioral2/memory/4992-795-0x00007FF63D540000-0x00007FF63D894000-memory.dmp	xmrig
behavioral2/memory/1108-801-0x00007FF634280000-0x00007FF6345D4000-memory.dmp	xmrig
behavioral2/memory/5076-810-0x00007FF73B390000-0x00007FF73B6E4000-memory.dmp	xmrig
behavioral2/memory/1476-755-0x00007FF7BCF10000-0x00007FF7BD264000-memory.dmp	xmrig
behavioral2/memory/4960-747-0x00007FF772540000-0x00007FF772894000-memory.dmp	xmrig
behavioral2/memory/4676-2138-0x00007FF65CE30000-0x00007FF65D184000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4224	etMqLhq.exe
1512	mQLVIgu.exe
1108	WuTGUjn.exe
3272	CpRxIsa.exe
5076	KyFGXMN.exe
4164	OaEZMXG.exe
2608	CCljyYc.exe
4820	vhiQeLu.exe
2956	bQgctca.exe
1808	GgCocve.exe
3664	LzhXwFU.exe
2472	knOkbRv.exe
1928	antsxJi.exe
2776	JkOyina.exe
2748	NdgwxXz.exe
3128	oBswwnY.exe
5112	voqTEps.exe
4644	rkbeAHZ.exe
1600	JRopGnk.exe
4960	ZLfmrAx.exe
1476	trdZMJu.exe
2952	SfXipPZ.exe
2104	NtGNNvy.exe
2144	PemVnbH.exe
1852	znykwxn.exe
3952	puArOgG.exe
264	AtJqyFF.exe
2696	XkngfEN.exe
4992	zmkZCtv.exe
2512	KQKycTQ.exe
5044	RoxYdEr.exe
4688	idvAZgw.exe
1596	xKRjIJa.exe
3788	mmyOBtL.exe
1792	qJvSlos.exe
4748	glxZnFS.exe
2648	JOFzRkI.exe
1784	mPKczHW.exe
2168	wWIzVyD.exe
1880	jZfbjFU.exe
3668	hJRinQB.exe
4296	LmZTqbI.exe
4728	jSuKpMb.exe
1144	LOXOGKz.exe
4284	nLMqtcJ.exe
736	TTnrVwx.exe
2976	zrUwzgj.exe
820	ViOcSUl.exe
2172	RWaFuuj.exe
1376	vUdOTLg.exe
1620	fvsxuel.exe
4336	MWkjMMV.exe
4328	ReQTHBn.exe
3776	haEOVsQ.exe
3972	nhNNWJY.exe
4892	TIdjiDg.exe
1212	KuBTNTX.exe
3752	BXAOZql.exe
212	QvjOBqk.exe
1356	hWqUGTi.exe
2352	SwWaZeU.exe
4636	cXLPpwu.exe
3712	jfOwoyu.exe
3068	nZXZFQf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4676-0-0x00007FF65CE30000-0x00007FF65D184000-memory.dmp	upx
behavioral2/files/0x0008000000023414-5.dat	upx
behavioral2/memory/4224-10-0x00007FF6A13F0000-0x00007FF6A1744000-memory.dmp	upx
behavioral2/files/0x0007000000023418-11.dat	upx
behavioral2/files/0x0007000000023419-17.dat	upx
behavioral2/files/0x000700000002341d-37.dat	upx
behavioral2/files/0x000700000002341f-50.dat	upx
behavioral2/files/0x0007000000023422-66.dat	upx
behavioral2/files/0x0007000000023424-76.dat	upx
behavioral2/files/0x0007000000023426-86.dat	upx
behavioral2/files/0x0007000000023428-96.dat	upx
behavioral2/files/0x000700000002342d-121.dat	upx
behavioral2/files/0x0007000000023431-137.dat	upx
behavioral2/files/0x0007000000023435-157.dat	upx
behavioral2/memory/3272-717-0x00007FF63A2A0000-0x00007FF63A5F4000-memory.dmp	upx
behavioral2/memory/4164-718-0x00007FF79B770000-0x00007FF79BAC4000-memory.dmp	upx
behavioral2/memory/4820-720-0x00007FF65D300000-0x00007FF65D654000-memory.dmp	upx
behavioral2/memory/2608-719-0x00007FF776410000-0x00007FF776764000-memory.dmp	upx
behavioral2/memory/2956-721-0x00007FF7289D0000-0x00007FF728D24000-memory.dmp	upx
behavioral2/memory/1808-722-0x00007FF653200000-0x00007FF653554000-memory.dmp	upx
behavioral2/memory/2472-724-0x00007FF744120000-0x00007FF744474000-memory.dmp	upx
behavioral2/memory/3664-723-0x00007FF6557B0000-0x00007FF655B04000-memory.dmp	upx
behavioral2/memory/1928-725-0x00007FF6EC810000-0x00007FF6ECB64000-memory.dmp	upx
behavioral2/files/0x0007000000023437-165.dat	upx
behavioral2/files/0x0007000000023436-160.dat	upx
behavioral2/files/0x0007000000023434-155.dat	upx
behavioral2/files/0x0007000000023433-151.dat	upx
behavioral2/files/0x0007000000023432-145.dat	upx
behavioral2/files/0x0007000000023430-135.dat	upx
behavioral2/files/0x000700000002342f-131.dat	upx
behavioral2/files/0x000700000002342e-125.dat	upx
behavioral2/files/0x000700000002342c-116.dat	upx
behavioral2/files/0x000700000002342b-111.dat	upx
behavioral2/files/0x000700000002342a-105.dat	upx
behavioral2/files/0x0007000000023429-100.dat	upx
behavioral2/files/0x0007000000023427-90.dat	upx
behavioral2/files/0x0007000000023425-80.dat	upx
behavioral2/files/0x0007000000023423-70.dat	upx
behavioral2/files/0x0007000000023421-58.dat	upx
behavioral2/files/0x0007000000023420-56.dat	upx
behavioral2/files/0x000700000002341e-43.dat	upx
behavioral2/files/0x000700000002341c-33.dat	upx
behavioral2/files/0x000700000002341b-27.dat	upx
behavioral2/files/0x000700000002341a-23.dat	upx
behavioral2/memory/1512-22-0x00007FF67F0A0000-0x00007FF67F3F4000-memory.dmp	upx
behavioral2/memory/2776-726-0x00007FF697CA0000-0x00007FF697FF4000-memory.dmp	upx
behavioral2/memory/2748-727-0x00007FF70AEF0000-0x00007FF70B244000-memory.dmp	upx
behavioral2/memory/3128-728-0x00007FF67A980000-0x00007FF67ACD4000-memory.dmp	upx
behavioral2/memory/5112-729-0x00007FF6C2600000-0x00007FF6C2954000-memory.dmp	upx
behavioral2/memory/4644-735-0x00007FF6755E0000-0x00007FF675934000-memory.dmp	upx
behavioral2/memory/1600-740-0x00007FF6630B0000-0x00007FF663404000-memory.dmp	upx
behavioral2/memory/264-787-0x00007FF6ED400000-0x00007FF6ED754000-memory.dmp	upx
behavioral2/memory/3952-783-0x00007FF69C440000-0x00007FF69C794000-memory.dmp	upx
behavioral2/memory/1852-776-0x00007FF6BC7E0000-0x00007FF6BCB34000-memory.dmp	upx
behavioral2/memory/2144-772-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp	upx
behavioral2/memory/2104-764-0x00007FF7ACBA0000-0x00007FF7ACEF4000-memory.dmp	upx
behavioral2/memory/2952-759-0x00007FF735FA0000-0x00007FF7362F4000-memory.dmp	upx
behavioral2/memory/2696-791-0x00007FF77A570000-0x00007FF77A8C4000-memory.dmp	upx
behavioral2/memory/4992-795-0x00007FF63D540000-0x00007FF63D894000-memory.dmp	upx
behavioral2/memory/1108-801-0x00007FF634280000-0x00007FF6345D4000-memory.dmp	upx
behavioral2/memory/5076-810-0x00007FF73B390000-0x00007FF73B6E4000-memory.dmp	upx
behavioral2/memory/1476-755-0x00007FF7BCF10000-0x00007FF7BD264000-memory.dmp	upx
behavioral2/memory/4960-747-0x00007FF772540000-0x00007FF772894000-memory.dmp	upx
behavioral2/memory/4676-2138-0x00007FF65CE30000-0x00007FF65D184000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zSYguad.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\OWxGnWa.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\MigMMGH.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\sBlAgTe.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\CzuvQKO.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\nhNNWJY.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\UMCypkf.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\BlxZhiO.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\aDodfDz.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\pdOEUEo.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\NNzECbt.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\vruAAjb.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\BvowiWG.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\bQgctca.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\CuGUVmI.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\bpTYwfa.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\HOVGIjk.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\NhFkBXh.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\ZvoLslK.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\wvUxfnt.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\NCXcnPi.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\nHKbdxH.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\vmAwsGB.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\dcQyUhI.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\euoVGll.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\zJYpANF.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\JYUWOYZ.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\bDTMaTL.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\OVvyAME.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\stOTjTe.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\NFQBJWo.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\EwJEUVx.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\JtaOHCm.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\KQKycTQ.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\RoxYdEr.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\nidPBQj.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\aZVCMLX.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\fMzmpNy.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\mQLVIgu.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\AtJqyFF.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\zrUwzgj.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\rDopGMa.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\EGjkkVm.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\zpLECIH.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\EoRAUMe.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\UHKoYDr.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\wcUIJKh.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\UIudWPY.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\oxbnZIh.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\TAPdrhe.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\NdgwxXz.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\LOXOGKz.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\ueYNRLh.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\dPFNKmZ.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\jgtNjaX.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\NNzvGfV.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\JkOyina.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\idvAZgw.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\CvATjNh.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\BMLTvaP.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\ztfVPOf.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\auhcxRd.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\RoKPXrI.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
File created	C:\Windows\System\MpXXANw.exe	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4224	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	83
PID 4676 wrote to memory of 4224	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	83
PID 4676 wrote to memory of 1512	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	84
PID 4676 wrote to memory of 1512	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	84
PID 4676 wrote to memory of 1108	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	85
PID 4676 wrote to memory of 1108	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	85
PID 4676 wrote to memory of 3272	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	86
PID 4676 wrote to memory of 3272	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	86
PID 4676 wrote to memory of 5076	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	87
PID 4676 wrote to memory of 5076	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	87
PID 4676 wrote to memory of 4164	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	88
PID 4676 wrote to memory of 4164	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	88
PID 4676 wrote to memory of 2608	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	89
PID 4676 wrote to memory of 2608	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	89
PID 4676 wrote to memory of 4820	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	90
PID 4676 wrote to memory of 4820	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	90
PID 4676 wrote to memory of 2956	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	91
PID 4676 wrote to memory of 2956	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	91
PID 4676 wrote to memory of 1808	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	92
PID 4676 wrote to memory of 1808	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	92
PID 4676 wrote to memory of 3664	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	93
PID 4676 wrote to memory of 3664	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	93
PID 4676 wrote to memory of 2472	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	94
PID 4676 wrote to memory of 2472	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	94
PID 4676 wrote to memory of 1928	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	95
PID 4676 wrote to memory of 1928	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	95
PID 4676 wrote to memory of 2776	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	96
PID 4676 wrote to memory of 2776	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	96
PID 4676 wrote to memory of 2748	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	97
PID 4676 wrote to memory of 2748	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	97
PID 4676 wrote to memory of 3128	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	98
PID 4676 wrote to memory of 3128	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	98
PID 4676 wrote to memory of 5112	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	99
PID 4676 wrote to memory of 5112	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	99
PID 4676 wrote to memory of 4644	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	100
PID 4676 wrote to memory of 4644	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	100
PID 4676 wrote to memory of 1600	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	101
PID 4676 wrote to memory of 1600	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	101
PID 4676 wrote to memory of 4960	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	102
PID 4676 wrote to memory of 4960	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	102
PID 4676 wrote to memory of 1476	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	103
PID 4676 wrote to memory of 1476	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	103
PID 4676 wrote to memory of 2952	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	104
PID 4676 wrote to memory of 2952	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	104
PID 4676 wrote to memory of 2104	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	105
PID 4676 wrote to memory of 2104	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	105
PID 4676 wrote to memory of 2144	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	106
PID 4676 wrote to memory of 2144	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	106
PID 4676 wrote to memory of 1852	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	107
PID 4676 wrote to memory of 1852	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	107
PID 4676 wrote to memory of 3952	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	108
PID 4676 wrote to memory of 3952	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	108
PID 4676 wrote to memory of 264	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	109
PID 4676 wrote to memory of 264	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	109
PID 4676 wrote to memory of 2696	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	110
PID 4676 wrote to memory of 2696	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	110
PID 4676 wrote to memory of 4992	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	111
PID 4676 wrote to memory of 4992	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	111
PID 4676 wrote to memory of 2512	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	112
PID 4676 wrote to memory of 2512	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	112
PID 4676 wrote to memory of 5044	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	113
PID 4676 wrote to memory of 5044	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	113
PID 4676 wrote to memory of 4688	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	114
PID 4676 wrote to memory of 4688	4676	ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ebd519189de1a6d64430893facf6ad20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\System\etMqLhq.exe
  C:\Windows\System\etMqLhq.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\mQLVIgu.exe
  C:\Windows\System\mQLVIgu.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\WuTGUjn.exe
  C:\Windows\System\WuTGUjn.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\CpRxIsa.exe
  C:\Windows\System\CpRxIsa.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\KyFGXMN.exe
  C:\Windows\System\KyFGXMN.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\OaEZMXG.exe
  C:\Windows\System\OaEZMXG.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\CCljyYc.exe
  C:\Windows\System\CCljyYc.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\vhiQeLu.exe
  C:\Windows\System\vhiQeLu.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\bQgctca.exe
  C:\Windows\System\bQgctca.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\GgCocve.exe
  C:\Windows\System\GgCocve.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\LzhXwFU.exe
  C:\Windows\System\LzhXwFU.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\knOkbRv.exe
  C:\Windows\System\knOkbRv.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\antsxJi.exe
  C:\Windows\System\antsxJi.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\JkOyina.exe
  C:\Windows\System\JkOyina.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\NdgwxXz.exe
  C:\Windows\System\NdgwxXz.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\oBswwnY.exe
  C:\Windows\System\oBswwnY.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\voqTEps.exe
  C:\Windows\System\voqTEps.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\rkbeAHZ.exe
  C:\Windows\System\rkbeAHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\JRopGnk.exe
  C:\Windows\System\JRopGnk.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ZLfmrAx.exe
  C:\Windows\System\ZLfmrAx.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\trdZMJu.exe
  C:\Windows\System\trdZMJu.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\SfXipPZ.exe
  C:\Windows\System\SfXipPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\NtGNNvy.exe
  C:\Windows\System\NtGNNvy.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\PemVnbH.exe
  C:\Windows\System\PemVnbH.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\znykwxn.exe
  C:\Windows\System\znykwxn.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\puArOgG.exe
  C:\Windows\System\puArOgG.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\AtJqyFF.exe
  C:\Windows\System\AtJqyFF.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\XkngfEN.exe
  C:\Windows\System\XkngfEN.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\zmkZCtv.exe
  C:\Windows\System\zmkZCtv.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\KQKycTQ.exe
  C:\Windows\System\KQKycTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\RoxYdEr.exe
  C:\Windows\System\RoxYdEr.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\idvAZgw.exe
  C:\Windows\System\idvAZgw.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\xKRjIJa.exe
  C:\Windows\System\xKRjIJa.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\mmyOBtL.exe
  C:\Windows\System\mmyOBtL.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\qJvSlos.exe
  C:\Windows\System\qJvSlos.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\glxZnFS.exe
  C:\Windows\System\glxZnFS.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\JOFzRkI.exe
  C:\Windows\System\JOFzRkI.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\mPKczHW.exe
  C:\Windows\System\mPKczHW.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\wWIzVyD.exe
  C:\Windows\System\wWIzVyD.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\jZfbjFU.exe
  C:\Windows\System\jZfbjFU.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\hJRinQB.exe
  C:\Windows\System\hJRinQB.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\LmZTqbI.exe
  C:\Windows\System\LmZTqbI.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\jSuKpMb.exe
  C:\Windows\System\jSuKpMb.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\LOXOGKz.exe
  C:\Windows\System\LOXOGKz.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\nLMqtcJ.exe
  C:\Windows\System\nLMqtcJ.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\TTnrVwx.exe
  C:\Windows\System\TTnrVwx.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\zrUwzgj.exe
  C:\Windows\System\zrUwzgj.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\ViOcSUl.exe
  C:\Windows\System\ViOcSUl.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\RWaFuuj.exe
  C:\Windows\System\RWaFuuj.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\vUdOTLg.exe
  C:\Windows\System\vUdOTLg.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\fvsxuel.exe
  C:\Windows\System\fvsxuel.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\MWkjMMV.exe
  C:\Windows\System\MWkjMMV.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\ReQTHBn.exe
  C:\Windows\System\ReQTHBn.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\haEOVsQ.exe
  C:\Windows\System\haEOVsQ.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\nhNNWJY.exe
  C:\Windows\System\nhNNWJY.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\TIdjiDg.exe
  C:\Windows\System\TIdjiDg.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\KuBTNTX.exe
  C:\Windows\System\KuBTNTX.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\BXAOZql.exe
  C:\Windows\System\BXAOZql.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\QvjOBqk.exe
  C:\Windows\System\QvjOBqk.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\hWqUGTi.exe
  C:\Windows\System\hWqUGTi.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\SwWaZeU.exe
  C:\Windows\System\SwWaZeU.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\cXLPpwu.exe
  C:\Windows\System\cXLPpwu.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\jfOwoyu.exe
  C:\Windows\System\jfOwoyu.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\nZXZFQf.exe
  C:\Windows\System\nZXZFQf.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\frGfXGU.exe
  C:\Windows\System\frGfXGU.exe
  2⤵
  PID:408
- C:\Windows\System\wFYWvDy.exe
  C:\Windows\System\wFYWvDy.exe
  2⤵
  PID:4052
- C:\Windows\System\kgOFDZm.exe
  C:\Windows\System\kgOFDZm.exe
  2⤵
  PID:2984
- C:\Windows\System\LwKnxnt.exe
  C:\Windows\System\LwKnxnt.exe
  2⤵
  PID:4648
- C:\Windows\System\qRrQihb.exe
  C:\Windows\System\qRrQihb.exe
  2⤵
  PID:1576
- C:\Windows\System\KlLeBmB.exe
  C:\Windows\System\KlLeBmB.exe
  2⤵
  PID:3520
- C:\Windows\System\UMCypkf.exe
  C:\Windows\System\UMCypkf.exe
  2⤵
  PID:4980
- C:\Windows\System\zXQAmdG.exe
  C:\Windows\System\zXQAmdG.exe
  2⤵
  PID:4424
- C:\Windows\System\jIrDsuk.exe
  C:\Windows\System\jIrDsuk.exe
  2⤵
  PID:3036
- C:\Windows\System\HWjPrMd.exe
  C:\Windows\System\HWjPrMd.exe
  2⤵
  PID:1312
- C:\Windows\System\JRwtjWm.exe
  C:\Windows\System\JRwtjWm.exe
  2⤵
  PID:2588
- C:\Windows\System\SBbiPyN.exe
  C:\Windows\System\SBbiPyN.exe
  2⤵
  PID:3232
- C:\Windows\System\wkGnbkp.exe
  C:\Windows\System\wkGnbkp.exe
  2⤵
  PID:4896
- C:\Windows\System\RTxNhbP.exe
  C:\Windows\System\RTxNhbP.exe
  2⤵
  PID:4880
- C:\Windows\System\bDTMaTL.exe
  C:\Windows\System\bDTMaTL.exe
  2⤵
  PID:3692
- C:\Windows\System\NoTwWHU.exe
  C:\Windows\System\NoTwWHU.exe
  2⤵
  PID:4856
- C:\Windows\System\dzBgTDT.exe
  C:\Windows\System\dzBgTDT.exe
  2⤵
  PID:1800
- C:\Windows\System\AWAsdRn.exe
  C:\Windows\System\AWAsdRn.exe
  2⤵
  PID:5144
- C:\Windows\System\BrNfVlE.exe
  C:\Windows\System\BrNfVlE.exe
  2⤵
  PID:5168
- C:\Windows\System\FmrKpfd.exe
  C:\Windows\System\FmrKpfd.exe
  2⤵
  PID:5200
- C:\Windows\System\PrfKsXS.exe
  C:\Windows\System\PrfKsXS.exe
  2⤵
  PID:5228
- C:\Windows\System\aXfrBPX.exe
  C:\Windows\System\aXfrBPX.exe
  2⤵
  PID:5256
- C:\Windows\System\BlxZhiO.exe
  C:\Windows\System\BlxZhiO.exe
  2⤵
  PID:5284
- C:\Windows\System\ueYNRLh.exe
  C:\Windows\System\ueYNRLh.exe
  2⤵
  PID:5312
- C:\Windows\System\cUvEsRF.exe
  C:\Windows\System\cUvEsRF.exe
  2⤵
  PID:5340
- C:\Windows\System\bfGIRso.exe
  C:\Windows\System\bfGIRso.exe
  2⤵
  PID:5368
- C:\Windows\System\ymtOdFC.exe
  C:\Windows\System\ymtOdFC.exe
  2⤵
  PID:5396
- C:\Windows\System\rVakEQn.exe
  C:\Windows\System\rVakEQn.exe
  2⤵
  PID:5424
- C:\Windows\System\csRBuGp.exe
  C:\Windows\System\csRBuGp.exe
  2⤵
  PID:5452
- C:\Windows\System\dBTmwRG.exe
  C:\Windows\System\dBTmwRG.exe
  2⤵
  PID:5480
- C:\Windows\System\omWcpNU.exe
  C:\Windows\System\omWcpNU.exe
  2⤵
  PID:5508
- C:\Windows\System\xcElEUy.exe
  C:\Windows\System\xcElEUy.exe
  2⤵
  PID:5536
- C:\Windows\System\mkYqYni.exe
  C:\Windows\System\mkYqYni.exe
  2⤵
  PID:5564
- C:\Windows\System\sMhmyvR.exe
  C:\Windows\System\sMhmyvR.exe
  2⤵
  PID:5592
- C:\Windows\System\FEkcSvi.exe
  C:\Windows\System\FEkcSvi.exe
  2⤵
  PID:5620
- C:\Windows\System\tYzlxNC.exe
  C:\Windows\System\tYzlxNC.exe
  2⤵
  PID:5648
- C:\Windows\System\MwgbYxG.exe
  C:\Windows\System\MwgbYxG.exe
  2⤵
  PID:5676
- C:\Windows\System\qadntbS.exe
  C:\Windows\System\qadntbS.exe
  2⤵
  PID:5704
- C:\Windows\System\neMiXVy.exe
  C:\Windows\System\neMiXVy.exe
  2⤵
  PID:5728
- C:\Windows\System\sIirYdv.exe
  C:\Windows\System\sIirYdv.exe
  2⤵
  PID:5756
- C:\Windows\System\SnmpJJD.exe
  C:\Windows\System\SnmpJJD.exe
  2⤵
  PID:5788
- C:\Windows\System\LnCXPIE.exe
  C:\Windows\System\LnCXPIE.exe
  2⤵
  PID:5816
- C:\Windows\System\gbgKVdd.exe
  C:\Windows\System\gbgKVdd.exe
  2⤵
  PID:5844
- C:\Windows\System\AebpdvU.exe
  C:\Windows\System\AebpdvU.exe
  2⤵
  PID:5868
- C:\Windows\System\KtDUehf.exe
  C:\Windows\System\KtDUehf.exe
  2⤵
  PID:5896
- C:\Windows\System\BYsCcfF.exe
  C:\Windows\System\BYsCcfF.exe
  2⤵
  PID:5928
- C:\Windows\System\lwsqhMt.exe
  C:\Windows\System\lwsqhMt.exe
  2⤵
  PID:5956
- C:\Windows\System\VPQqoYW.exe
  C:\Windows\System\VPQqoYW.exe
  2⤵
  PID:5984
- C:\Windows\System\vNSYhdj.exe
  C:\Windows\System\vNSYhdj.exe
  2⤵
  PID:6008
- C:\Windows\System\RjgQWSp.exe
  C:\Windows\System\RjgQWSp.exe
  2⤵
  PID:6036
- C:\Windows\System\IyvGPSH.exe
  C:\Windows\System\IyvGPSH.exe
  2⤵
  PID:6068
- C:\Windows\System\YAtizPf.exe
  C:\Windows\System\YAtizPf.exe
  2⤵
  PID:6096
- C:\Windows\System\aZVCMLX.exe
  C:\Windows\System\aZVCMLX.exe
  2⤵
  PID:6124
- C:\Windows\System\iOsFKBH.exe
  C:\Windows\System\iOsFKBH.exe
  2⤵
  PID:2652
- C:\Windows\System\IPbtVHc.exe
  C:\Windows\System\IPbtVHc.exe
  2⤵
  PID:1368
- C:\Windows\System\sYNTZJg.exe
  C:\Windows\System\sYNTZJg.exe
  2⤵
  PID:3960
- C:\Windows\System\aBcUgTq.exe
  C:\Windows\System\aBcUgTq.exe
  2⤵
  PID:2756
- C:\Windows\System\CuGUVmI.exe
  C:\Windows\System\CuGUVmI.exe
  2⤵
  PID:3356
- C:\Windows\System\teOGvSm.exe
  C:\Windows\System\teOGvSm.exe
  2⤵
  PID:2576
- C:\Windows\System\HkUwpHI.exe
  C:\Windows\System\HkUwpHI.exe
  2⤵
  PID:4260
- C:\Windows\System\EzVGHhZ.exe
  C:\Windows\System\EzVGHhZ.exe
  2⤵
  PID:5184
- C:\Windows\System\NNSTYBP.exe
  C:\Windows\System\NNSTYBP.exe
  2⤵
  PID:5244
- C:\Windows\System\lRLGtkU.exe
  C:\Windows\System\lRLGtkU.exe
  2⤵
  PID:5304
- C:\Windows\System\ZvoLslK.exe
  C:\Windows\System\ZvoLslK.exe
  2⤵
  PID:5380
- C:\Windows\System\JBZEwMe.exe
  C:\Windows\System\JBZEwMe.exe
  2⤵
  PID:5440
- C:\Windows\System\cvJaqHP.exe
  C:\Windows\System\cvJaqHP.exe
  2⤵
  PID:5500
- C:\Windows\System\tRlHaiS.exe
  C:\Windows\System\tRlHaiS.exe
  2⤵
  PID:5576
- C:\Windows\System\UfEqcDu.exe
  C:\Windows\System\UfEqcDu.exe
  2⤵
  PID:5636
- C:\Windows\System\wqlEqxS.exe
  C:\Windows\System\wqlEqxS.exe
  2⤵
  PID:5696
- C:\Windows\System\hHTAYji.exe
  C:\Windows\System\hHTAYji.exe
  2⤵
  PID:5772
- C:\Windows\System\VnItriu.exe
  C:\Windows\System\VnItriu.exe
  2⤵
  PID:5832
- C:\Windows\System\tTtPmPL.exe
  C:\Windows\System\tTtPmPL.exe
  2⤵
  PID:5892
- C:\Windows\System\nHmzVJC.exe
  C:\Windows\System\nHmzVJC.exe
  2⤵
  PID:5968
- C:\Windows\System\vmAwsGB.exe
  C:\Windows\System\vmAwsGB.exe
  2⤵
  PID:6028
- C:\Windows\System\UIudWPY.exe
  C:\Windows\System\UIudWPY.exe
  2⤵
  PID:6088
- C:\Windows\System\VjemBCS.exe
  C:\Windows\System\VjemBCS.exe
  2⤵
  PID:1948
- C:\Windows\System\cXexCvl.exe
  C:\Windows\System\cXexCvl.exe
  2⤵
  PID:312
- C:\Windows\System\aGQUqsD.exe
  C:\Windows\System\aGQUqsD.exe
  2⤵
  PID:620
- C:\Windows\System\UAYdtAD.exe
  C:\Windows\System\UAYdtAD.exe
  2⤵
  PID:5212
- C:\Windows\System\AghHYeW.exe
  C:\Windows\System\AghHYeW.exe
  2⤵
  PID:5352
- C:\Windows\System\sdyVUqA.exe
  C:\Windows\System\sdyVUqA.exe
  2⤵
  PID:5492
- C:\Windows\System\LKRlCby.exe
  C:\Windows\System\LKRlCby.exe
  2⤵
  PID:432
- C:\Windows\System\vLSvMOR.exe
  C:\Windows\System\vLSvMOR.exe
  2⤵
  PID:5748
- C:\Windows\System\MIQTGPV.exe
  C:\Windows\System\MIQTGPV.exe
  2⤵
  PID:5920
- C:\Windows\System\MIraFYK.exe
  C:\Windows\System\MIraFYK.exe
  2⤵
  PID:6060
- C:\Windows\System\nuMsolk.exe
  C:\Windows\System\nuMsolk.exe
  2⤵
  PID:6168
- C:\Windows\System\IdiKPaZ.exe
  C:\Windows\System\IdiKPaZ.exe
  2⤵
  PID:6196
- C:\Windows\System\wvUxfnt.exe
  C:\Windows\System\wvUxfnt.exe
  2⤵
  PID:6224
- C:\Windows\System\iJlhxML.exe
  C:\Windows\System\iJlhxML.exe
  2⤵
  PID:6248
- C:\Windows\System\OVvyAME.exe
  C:\Windows\System\OVvyAME.exe
  2⤵
  PID:6280
- C:\Windows\System\LzLAHFI.exe
  C:\Windows\System\LzLAHFI.exe
  2⤵
  PID:6308
- C:\Windows\System\kInEGeF.exe
  C:\Windows\System\kInEGeF.exe
  2⤵
  PID:6336
- C:\Windows\System\UxRQnTM.exe
  C:\Windows\System\UxRQnTM.exe
  2⤵
  PID:6364
- C:\Windows\System\gpgueAi.exe
  C:\Windows\System\gpgueAi.exe
  2⤵
  PID:6392
- C:\Windows\System\rUQUAIg.exe
  C:\Windows\System\rUQUAIg.exe
  2⤵
  PID:6420
- C:\Windows\System\LBBjnNB.exe
  C:\Windows\System\LBBjnNB.exe
  2⤵
  PID:6448
- C:\Windows\System\sCfFuKx.exe
  C:\Windows\System\sCfFuKx.exe
  2⤵
  PID:6476
- C:\Windows\System\lPTWrsV.exe
  C:\Windows\System\lPTWrsV.exe
  2⤵
  PID:6504
- C:\Windows\System\zCtBrOM.exe
  C:\Windows\System\zCtBrOM.exe
  2⤵
  PID:6532
- C:\Windows\System\OvJSlCG.exe
  C:\Windows\System\OvJSlCG.exe
  2⤵
  PID:6560
- C:\Windows\System\dYRQTZO.exe
  C:\Windows\System\dYRQTZO.exe
  2⤵
  PID:6588
- C:\Windows\System\BQyTlgs.exe
  C:\Windows\System\BQyTlgs.exe
  2⤵
  PID:6616
- C:\Windows\System\LaRSYiY.exe
  C:\Windows\System\LaRSYiY.exe
  2⤵
  PID:6644
- C:\Windows\System\fIBtaRT.exe
  C:\Windows\System\fIBtaRT.exe
  2⤵
  PID:6672
- C:\Windows\System\MPcJtPM.exe
  C:\Windows\System\MPcJtPM.exe
  2⤵
  PID:6700
- C:\Windows\System\qyViTRA.exe
  C:\Windows\System\qyViTRA.exe
  2⤵
  PID:6728
- C:\Windows\System\DlqDMhE.exe
  C:\Windows\System\DlqDMhE.exe
  2⤵
  PID:6756
- C:\Windows\System\kmrYSxJ.exe
  C:\Windows\System\kmrYSxJ.exe
  2⤵
  PID:6784
- C:\Windows\System\HZEquVu.exe
  C:\Windows\System\HZEquVu.exe
  2⤵
  PID:6812
- C:\Windows\System\gQaaQTA.exe
  C:\Windows\System\gQaaQTA.exe
  2⤵
  PID:6840
- C:\Windows\System\uRupRbP.exe
  C:\Windows\System\uRupRbP.exe
  2⤵
  PID:6872
- C:\Windows\System\TmWCqnA.exe
  C:\Windows\System\TmWCqnA.exe
  2⤵
  PID:6896
- C:\Windows\System\eEDbnym.exe
  C:\Windows\System\eEDbnym.exe
  2⤵
  PID:6924
- C:\Windows\System\OomEaan.exe
  C:\Windows\System\OomEaan.exe
  2⤵
  PID:6952
- C:\Windows\System\rriSElS.exe
  C:\Windows\System\rriSElS.exe
  2⤵
  PID:6980
- C:\Windows\System\vifdBMg.exe
  C:\Windows\System\vifdBMg.exe
  2⤵
  PID:7008
- C:\Windows\System\FtFTAov.exe
  C:\Windows\System\FtFTAov.exe
  2⤵
  PID:7036
- C:\Windows\System\zlepyce.exe
  C:\Windows\System\zlepyce.exe
  2⤵
  PID:7064
- C:\Windows\System\uxGnOWe.exe
  C:\Windows\System\uxGnOWe.exe
  2⤵
  PID:7092
- C:\Windows\System\OeXuVTr.exe
  C:\Windows\System\OeXuVTr.exe
  2⤵
  PID:7124
- C:\Windows\System\uQQxEQL.exe
  C:\Windows\System\uQQxEQL.exe
  2⤵
  PID:7156
- C:\Windows\System\hLKYciQ.exe
  C:\Windows\System\hLKYciQ.exe
  2⤵
  PID:3672
- C:\Windows\System\IXIKNVU.exe
  C:\Windows\System\IXIKNVU.exe
  2⤵
  PID:1460
- C:\Windows\System\ORfcrbV.exe
  C:\Windows\System\ORfcrbV.exe
  2⤵
  PID:5416
- C:\Windows\System\QUqoCXe.exe
  C:\Windows\System\QUqoCXe.exe
  2⤵
  PID:5724
- C:\Windows\System\CcqotjP.exe
  C:\Windows\System\CcqotjP.exe
  2⤵
  PID:6004
- C:\Windows\System\srOFpwC.exe
  C:\Windows\System\srOFpwC.exe
  2⤵
  PID:6208
- C:\Windows\System\CvATjNh.exe
  C:\Windows\System\CvATjNh.exe
  2⤵
  PID:6268
- C:\Windows\System\viKWHAv.exe
  C:\Windows\System\viKWHAv.exe
  2⤵
  PID:6328
- C:\Windows\System\dPFNKmZ.exe
  C:\Windows\System\dPFNKmZ.exe
  2⤵
  PID:6384
- C:\Windows\System\kvDrJnQ.exe
  C:\Windows\System\kvDrJnQ.exe
  2⤵
  PID:6440
- C:\Windows\System\UOLiFyf.exe
  C:\Windows\System\UOLiFyf.exe
  2⤵
  PID:6516
- C:\Windows\System\EwvfpZK.exe
  C:\Windows\System\EwvfpZK.exe
  2⤵
  PID:6576
- C:\Windows\System\JpYalKS.exe
  C:\Windows\System\JpYalKS.exe
  2⤵
  PID:6636
- C:\Windows\System\jwIaqSP.exe
  C:\Windows\System\jwIaqSP.exe
  2⤵
  PID:3300
- C:\Windows\System\VIFIKFu.exe
  C:\Windows\System\VIFIKFu.exe
  2⤵
  PID:6768
- C:\Windows\System\bpTYwfa.exe
  C:\Windows\System\bpTYwfa.exe
  2⤵
  PID:6824
- C:\Windows\System\ozngoOe.exe
  C:\Windows\System\ozngoOe.exe
  2⤵
  PID:6888
- C:\Windows\System\ylXYqHc.exe
  C:\Windows\System\ylXYqHc.exe
  2⤵
  PID:6944
- C:\Windows\System\nwtldra.exe
  C:\Windows\System\nwtldra.exe
  2⤵
  PID:7020
- C:\Windows\System\KHRSYtn.exe
  C:\Windows\System\KHRSYtn.exe
  2⤵
  PID:7056
- C:\Windows\System\fsYkWvO.exe
  C:\Windows\System\fsYkWvO.exe
  2⤵
  PID:7108
- C:\Windows\System\yFKuWYW.exe
  C:\Windows\System\yFKuWYW.exe
  2⤵
  PID:7152
- C:\Windows\System\humpbld.exe
  C:\Windows\System\humpbld.exe
  2⤵
  PID:5276
- C:\Windows\System\OYDDvgY.exe
  C:\Windows\System\OYDDvgY.exe
  2⤵
  PID:5996
- C:\Windows\System\twUksMH.exe
  C:\Windows\System\twUksMH.exe
  2⤵
  PID:6240
- C:\Windows\System\stOTjTe.exe
  C:\Windows\System\stOTjTe.exe
  2⤵
  PID:6356
- C:\Windows\System\gRzJIkc.exe
  C:\Windows\System\gRzJIkc.exe
  2⤵
  PID:6468
- C:\Windows\System\eLjtNxT.exe
  C:\Windows\System\eLjtNxT.exe
  2⤵
  PID:6608
- C:\Windows\System\MpXXANw.exe
  C:\Windows\System\MpXXANw.exe
  2⤵
  PID:6740
- C:\Windows\System\YxIHfsz.exe
  C:\Windows\System\YxIHfsz.exe
  2⤵
  PID:6852
- C:\Windows\System\slEnFzp.exe
  C:\Windows\System\slEnFzp.exe
  2⤵
  PID:6916
- C:\Windows\System\MeUzZjZ.exe
  C:\Windows\System\MeUzZjZ.exe
  2⤵
  PID:7028
- C:\Windows\System\gRDwLQE.exe
  C:\Windows\System\gRDwLQE.exe
  2⤵
  PID:3224
- C:\Windows\System\hPNoloj.exe
  C:\Windows\System\hPNoloj.exe
  2⤵
  PID:6800
- C:\Windows\System\xgExfqq.exe
  C:\Windows\System\xgExfqq.exe
  2⤵
  PID:5016
- C:\Windows\System\NishMHj.exe
  C:\Windows\System\NishMHj.exe
  2⤵
  PID:3048
- C:\Windows\System\rdLQaGy.exe
  C:\Windows\System\rdLQaGy.exe
  2⤵
  PID:3488
- C:\Windows\System\KinGBZK.exe
  C:\Windows\System\KinGBZK.exe
  2⤵
  PID:6548
- C:\Windows\System\XQlJDst.exe
  C:\Windows\System\XQlJDst.exe
  2⤵
  PID:1272
- C:\Windows\System\aDodfDz.exe
  C:\Windows\System\aDodfDz.exe
  2⤵
  PID:744
- C:\Windows\System\oIIcJVa.exe
  C:\Windows\System\oIIcJVa.exe
  2⤵
  PID:2500
- C:\Windows\System\zJYpANF.exe
  C:\Windows\System\zJYpANF.exe
  2⤵
  PID:3908
- C:\Windows\System\HNxEXJw.exe
  C:\Windows\System\HNxEXJw.exe
  2⤵
  PID:6868
- C:\Windows\System\cNiVDBS.exe
  C:\Windows\System\cNiVDBS.exe
  2⤵
  PID:2312
- C:\Windows\System\NCXcnPi.exe
  C:\Windows\System\NCXcnPi.exe
  2⤵
  PID:3152
- C:\Windows\System\Shmnidx.exe
  C:\Windows\System\Shmnidx.exe
  2⤵
  PID:6688
- C:\Windows\System\UaKtUok.exe
  C:\Windows\System\UaKtUok.exe
  2⤵
  PID:7196
- C:\Windows\System\OErCbQk.exe
  C:\Windows\System\OErCbQk.exe
  2⤵
  PID:7228
- C:\Windows\System\eqQnnmG.exe
  C:\Windows\System\eqQnnmG.exe
  2⤵
  PID:7260
- C:\Windows\System\HZyowhN.exe
  C:\Windows\System\HZyowhN.exe
  2⤵
  PID:7304
- C:\Windows\System\pJFkxxJ.exe
  C:\Windows\System\pJFkxxJ.exe
  2⤵
  PID:7328
- C:\Windows\System\KmlyrVO.exe
  C:\Windows\System\KmlyrVO.exe
  2⤵
  PID:7356
- C:\Windows\System\LpBGnMr.exe
  C:\Windows\System\LpBGnMr.exe
  2⤵
  PID:7380
- C:\Windows\System\wmEUPHD.exe
  C:\Windows\System\wmEUPHD.exe
  2⤵
  PID:7408
- C:\Windows\System\DPntlyM.exe
  C:\Windows\System\DPntlyM.exe
  2⤵
  PID:7464
- C:\Windows\System\hCNncYg.exe
  C:\Windows\System\hCNncYg.exe
  2⤵
  PID:7548
- C:\Windows\System\syLClNW.exe
  C:\Windows\System\syLClNW.exe
  2⤵
  PID:7564
- C:\Windows\System\JprpWEe.exe
  C:\Windows\System\JprpWEe.exe
  2⤵
  PID:7592
- C:\Windows\System\PrOhwDo.exe
  C:\Windows\System\PrOhwDo.exe
  2⤵
  PID:7620
- C:\Windows\System\LztrNRl.exe
  C:\Windows\System\LztrNRl.exe
  2⤵
  PID:7644
- C:\Windows\System\bMBmrBv.exe
  C:\Windows\System\bMBmrBv.exe
  2⤵
  PID:7664
- C:\Windows\System\bSaEJfs.exe
  C:\Windows\System\bSaEJfs.exe
  2⤵
  PID:7696
- C:\Windows\System\DVQHZwm.exe
  C:\Windows\System\DVQHZwm.exe
  2⤵
  PID:7732
- C:\Windows\System\GmOnLWM.exe
  C:\Windows\System\GmOnLWM.exe
  2⤵
  PID:7752
- C:\Windows\System\OCebbqE.exe
  C:\Windows\System\OCebbqE.exe
  2⤵
  PID:7788
- C:\Windows\System\pdOEUEo.exe
  C:\Windows\System\pdOEUEo.exe
  2⤵
  PID:7812
- C:\Windows\System\ZjzabOi.exe
  C:\Windows\System\ZjzabOi.exe
  2⤵
  PID:7828
- C:\Windows\System\nvzsxJU.exe
  C:\Windows\System\nvzsxJU.exe
  2⤵
  PID:7848
- C:\Windows\System\DqDhgPL.exe
  C:\Windows\System\DqDhgPL.exe
  2⤵
  PID:7892
- C:\Windows\System\jJlxbNC.exe
  C:\Windows\System\jJlxbNC.exe
  2⤵
  PID:7912
- C:\Windows\System\dgkJucK.exe
  C:\Windows\System\dgkJucK.exe
  2⤵
  PID:7932
- C:\Windows\System\pbTYhGm.exe
  C:\Windows\System\pbTYhGm.exe
  2⤵
  PID:7976
- C:\Windows\System\hRvGpJM.exe
  C:\Windows\System\hRvGpJM.exe
  2⤵
  PID:8000
- C:\Windows\System\tncfgoa.exe
  C:\Windows\System\tncfgoa.exe
  2⤵
  PID:8032
- C:\Windows\System\dcQyUhI.exe
  C:\Windows\System\dcQyUhI.exe
  2⤵
  PID:8060
- C:\Windows\System\aNrltRH.exe
  C:\Windows\System\aNrltRH.exe
  2⤵
  PID:8084
- C:\Windows\System\VrDpceB.exe
  C:\Windows\System\VrDpceB.exe
  2⤵
  PID:8100
- C:\Windows\System\FSMzovk.exe
  C:\Windows\System\FSMzovk.exe
  2⤵
  PID:8148
- C:\Windows\System\zSYguad.exe
  C:\Windows\System\zSYguad.exe
  2⤵
  PID:8180
- C:\Windows\System\zvlxlKF.exe
  C:\Windows\System\zvlxlKF.exe
  2⤵
  PID:1712
- C:\Windows\System\HOVGIjk.exe
  C:\Windows\System\HOVGIjk.exe
  2⤵
  PID:4088
- C:\Windows\System\yAvyVDp.exe
  C:\Windows\System\yAvyVDp.exe
  2⤵
  PID:7204
- C:\Windows\System\OVJOHeN.exe
  C:\Windows\System\OVJOHeN.exe
  2⤵
  PID:7316
- C:\Windows\System\mdMhHXG.exe
  C:\Windows\System\mdMhHXG.exe
  2⤵
  PID:7348
- C:\Windows\System\NKONLLU.exe
  C:\Windows\System\NKONLLU.exe
  2⤵
  PID:7456
- C:\Windows\System\EBoINoV.exe
  C:\Windows\System\EBoINoV.exe
  2⤵
  PID:1920
- C:\Windows\System\hSTKBol.exe
  C:\Windows\System\hSTKBol.exe
  2⤵
  PID:7344
- C:\Windows\System\RWiZoLA.exe
  C:\Windows\System\RWiZoLA.exe
  2⤵
  PID:7584
- C:\Windows\System\EfaSpUM.exe
  C:\Windows\System\EfaSpUM.exe
  2⤵
  PID:7616
- C:\Windows\System\iQBQHPB.exe
  C:\Windows\System\iQBQHPB.exe
  2⤵
  PID:7712
- C:\Windows\System\NTDrFLm.exe
  C:\Windows\System\NTDrFLm.exe
  2⤵
  PID:7772
- C:\Windows\System\PDGOKmu.exe
  C:\Windows\System\PDGOKmu.exe
  2⤵
  PID:7844
- C:\Windows\System\JkqSXzz.exe
  C:\Windows\System\JkqSXzz.exe
  2⤵
  PID:7908
- C:\Windows\System\EkqJicl.exe
  C:\Windows\System\EkqJicl.exe
  2⤵
  PID:7964
- C:\Windows\System\NRfLvSD.exe
  C:\Windows\System\NRfLvSD.exe
  2⤵
  PID:7992
- C:\Windows\System\euoVGll.exe
  C:\Windows\System\euoVGll.exe
  2⤵
  PID:8072
- C:\Windows\System\wGqILjN.exe
  C:\Windows\System\wGqILjN.exe
  2⤵
  PID:8096
- C:\Windows\System\pguEonn.exe
  C:\Windows\System\pguEonn.exe
  2⤵
  PID:8172
- C:\Windows\System\tPzmyPy.exe
  C:\Windows\System\tPzmyPy.exe
  2⤵
  PID:3460
- C:\Windows\System\xeilpDU.exe
  C:\Windows\System\xeilpDU.exe
  2⤵
  PID:7212
- C:\Windows\System\KFrlUtR.exe
  C:\Windows\System\KFrlUtR.exe
  2⤵
  PID:7556
- C:\Windows\System\hvbILbp.exe
  C:\Windows\System\hvbILbp.exe
  2⤵
  PID:7688
- C:\Windows\System\YUMNCEa.exe
  C:\Windows\System\YUMNCEa.exe
  2⤵
  PID:7824
- C:\Windows\System\rIiiSlx.exe
  C:\Windows\System\rIiiSlx.exe
  2⤵
  PID:7952
- C:\Windows\System\hyloyCE.exe
  C:\Windows\System\hyloyCE.exe
  2⤵
  PID:8160
- C:\Windows\System\ZtXcREm.exe
  C:\Windows\System\ZtXcREm.exe
  2⤵
  PID:7372
- C:\Windows\System\UnyeXey.exe
  C:\Windows\System\UnyeXey.exe
  2⤵
  PID:7744
- C:\Windows\System\lQmzbtw.exe
  C:\Windows\System\lQmzbtw.exe
  2⤵
  PID:7904
- C:\Windows\System\BsmRvgn.exe
  C:\Windows\System\BsmRvgn.exe
  2⤵
  PID:6684
- C:\Windows\System\qhqIrVd.exe
  C:\Windows\System\qhqIrVd.exe
  2⤵
  PID:7612
- C:\Windows\System\zhbIuDm.exe
  C:\Windows\System\zhbIuDm.exe
  2⤵
  PID:8208
- C:\Windows\System\BMLTvaP.exe
  C:\Windows\System\BMLTvaP.exe
  2⤵
  PID:8236
- C:\Windows\System\BQyizWd.exe
  C:\Windows\System\BQyizWd.exe
  2⤵
  PID:8264
- C:\Windows\System\azSTjBK.exe
  C:\Windows\System\azSTjBK.exe
  2⤵
  PID:8292
- C:\Windows\System\iMsBeST.exe
  C:\Windows\System\iMsBeST.exe
  2⤵
  PID:8316
- C:\Windows\System\QZdgcRj.exe
  C:\Windows\System\QZdgcRj.exe
  2⤵
  PID:8348
- C:\Windows\System\jkRHMop.exe
  C:\Windows\System\jkRHMop.exe
  2⤵
  PID:8376
- C:\Windows\System\uzjMXUT.exe
  C:\Windows\System\uzjMXUT.exe
  2⤵
  PID:8404
- C:\Windows\System\ZKbfzUI.exe
  C:\Windows\System\ZKbfzUI.exe
  2⤵
  PID:8420
- C:\Windows\System\sMNUukR.exe
  C:\Windows\System\sMNUukR.exe
  2⤵
  PID:8448
- C:\Windows\System\FivTZjW.exe
  C:\Windows\System\FivTZjW.exe
  2⤵
  PID:8488
- C:\Windows\System\oNXyfuQ.exe
  C:\Windows\System\oNXyfuQ.exe
  2⤵
  PID:8516
- C:\Windows\System\kUiWOPg.exe
  C:\Windows\System\kUiWOPg.exe
  2⤵
  PID:8544
- C:\Windows\System\fSUOBNt.exe
  C:\Windows\System\fSUOBNt.exe
  2⤵
  PID:8572
- C:\Windows\System\YidDnnc.exe
  C:\Windows\System\YidDnnc.exe
  2⤵
  PID:8588
- C:\Windows\System\prQLaSt.exe
  C:\Windows\System\prQLaSt.exe
  2⤵
  PID:8608
- C:\Windows\System\uqFPyZa.exe
  C:\Windows\System\uqFPyZa.exe
  2⤵
  PID:8636
- C:\Windows\System\WYtagzD.exe
  C:\Windows\System\WYtagzD.exe
  2⤵
  PID:8660
- C:\Windows\System\leFADBS.exe
  C:\Windows\System\leFADBS.exe
  2⤵
  PID:8708
- C:\Windows\System\NNzECbt.exe
  C:\Windows\System\NNzECbt.exe
  2⤵
  PID:8728
- C:\Windows\System\XvwfgWy.exe
  C:\Windows\System\XvwfgWy.exe
  2⤵
  PID:8768
- C:\Windows\System\MXzjQHs.exe
  C:\Windows\System\MXzjQHs.exe
  2⤵
  PID:8796
- C:\Windows\System\kwSLJxR.exe
  C:\Windows\System\kwSLJxR.exe
  2⤵
  PID:8824
- C:\Windows\System\eOSRrwq.exe
  C:\Windows\System\eOSRrwq.exe
  2⤵
  PID:8852
- C:\Windows\System\ubXXqHH.exe
  C:\Windows\System\ubXXqHH.exe
  2⤵
  PID:8880
- C:\Windows\System\OoeztRZ.exe
  C:\Windows\System\OoeztRZ.exe
  2⤵
  PID:8908
- C:\Windows\System\LUBOdLw.exe
  C:\Windows\System\LUBOdLw.exe
  2⤵
  PID:8924
- C:\Windows\System\EoRAUMe.exe
  C:\Windows\System\EoRAUMe.exe
  2⤵
  PID:8964
- C:\Windows\System\naleNDL.exe
  C:\Windows\System\naleNDL.exe
  2⤵
  PID:8992
- C:\Windows\System\muKRosK.exe
  C:\Windows\System\muKRosK.exe
  2⤵
  PID:9020
- C:\Windows\System\JkqQtrg.exe
  C:\Windows\System\JkqQtrg.exe
  2⤵
  PID:9080
- C:\Windows\System\qrOEoKM.exe
  C:\Windows\System\qrOEoKM.exe
  2⤵
  PID:9108
- C:\Windows\System\IbfmWza.exe
  C:\Windows\System\IbfmWza.exe
  2⤵
  PID:9136
- C:\Windows\System\fZIikns.exe
  C:\Windows\System\fZIikns.exe
  2⤵
  PID:9152
- C:\Windows\System\JnjLtfX.exe
  C:\Windows\System\JnjLtfX.exe
  2⤵
  PID:9188
- C:\Windows\System\cYzihan.exe
  C:\Windows\System\cYzihan.exe
  2⤵
  PID:8196
- C:\Windows\System\dqrzHKQ.exe
  C:\Windows\System\dqrzHKQ.exe
  2⤵
  PID:8260
- C:\Windows\System\kpZbCYh.exe
  C:\Windows\System\kpZbCYh.exe
  2⤵
  PID:8360
- C:\Windows\System\GEdmTZp.exe
  C:\Windows\System\GEdmTZp.exe
  2⤵
  PID:8400
- C:\Windows\System\Wahayfa.exe
  C:\Windows\System\Wahayfa.exe
  2⤵
  PID:8540
- C:\Windows\System\GLOZzGu.exe
  C:\Windows\System\GLOZzGu.exe
  2⤵
  PID:8620
- C:\Windows\System\UHKoYDr.exe
  C:\Windows\System\UHKoYDr.exe
  2⤵
  PID:8696
- C:\Windows\System\KHEnntL.exe
  C:\Windows\System\KHEnntL.exe
  2⤵
  PID:8748
- C:\Windows\System\zhnNOst.exe
  C:\Windows\System\zhnNOst.exe
  2⤵
  PID:8820
- C:\Windows\System\RUAukMv.exe
  C:\Windows\System\RUAukMv.exe
  2⤵
  PID:8848
- C:\Windows\System\OWxGnWa.exe
  C:\Windows\System\OWxGnWa.exe
  2⤵
  PID:8948
- C:\Windows\System\iGDdsWS.exe
  C:\Windows\System\iGDdsWS.exe
  2⤵
  PID:8984
- C:\Windows\System\cviwWxh.exe
  C:\Windows\System\cviwWxh.exe
  2⤵
  PID:9096
- C:\Windows\System\ZjhOFhK.exe
  C:\Windows\System\ZjhOFhK.exe
  2⤵
  PID:9148
- C:\Windows\System\JaVQGsI.exe
  C:\Windows\System\JaVQGsI.exe
  2⤵
  PID:8256
- C:\Windows\System\appjSmQ.exe
  C:\Windows\System\appjSmQ.exe
  2⤵
  PID:8440
- C:\Windows\System\cHvSTVN.exe
  C:\Windows\System\cHvSTVN.exe
  2⤵
  PID:8580
- C:\Windows\System\OdDNfWF.exe
  C:\Windows\System\OdDNfWF.exe
  2⤵
  PID:8644
- C:\Windows\System\DrIvKWj.exe
  C:\Windows\System\DrIvKWj.exe
  2⤵
  PID:8836
- C:\Windows\System\aBgsQBT.exe
  C:\Windows\System\aBgsQBT.exe
  2⤵
  PID:7544
- C:\Windows\System\YFdeUra.exe
  C:\Windows\System\YFdeUra.exe
  2⤵
  PID:9208
- C:\Windows\System\IKfMNjN.exe
  C:\Windows\System\IKfMNjN.exe
  2⤵
  PID:8648
- C:\Windows\System\FwFHHpF.exe
  C:\Windows\System\FwFHHpF.exe
  2⤵
  PID:8980
- C:\Windows\System\MigMMGH.exe
  C:\Windows\System\MigMMGH.exe
  2⤵
  PID:8392
- C:\Windows\System\hkpFfyU.exe
  C:\Windows\System\hkpFfyU.exe
  2⤵
  PID:9220
- C:\Windows\System\BVJJykP.exe
  C:\Windows\System\BVJJykP.exe
  2⤵
  PID:9256
- C:\Windows\System\BwxBWQX.exe
  C:\Windows\System\BwxBWQX.exe
  2⤵
  PID:9292
- C:\Windows\System\xlqearP.exe
  C:\Windows\System\xlqearP.exe
  2⤵
  PID:9324
- C:\Windows\System\OvWGqDY.exe
  C:\Windows\System\OvWGqDY.exe
  2⤵
  PID:9352
- C:\Windows\System\VbruZid.exe
  C:\Windows\System\VbruZid.exe
  2⤵
  PID:9380
- C:\Windows\System\HwRKVxt.exe
  C:\Windows\System\HwRKVxt.exe
  2⤵
  PID:9416
- C:\Windows\System\ZojtMqM.exe
  C:\Windows\System\ZojtMqM.exe
  2⤵
  PID:9448
- C:\Windows\System\weNgfYl.exe
  C:\Windows\System\weNgfYl.exe
  2⤵
  PID:9480
- C:\Windows\System\PXQHWOB.exe
  C:\Windows\System\PXQHWOB.exe
  2⤵
  PID:9496
- C:\Windows\System\vlsptRR.exe
  C:\Windows\System\vlsptRR.exe
  2⤵
  PID:9516
- C:\Windows\System\aYaJaZF.exe
  C:\Windows\System\aYaJaZF.exe
  2⤵
  PID:9560
- C:\Windows\System\YPUVqjq.exe
  C:\Windows\System\YPUVqjq.exe
  2⤵
  PID:9580
- C:\Windows\System\OaKDWiW.exe
  C:\Windows\System\OaKDWiW.exe
  2⤵
  PID:9600
- C:\Windows\System\vNJZyZR.exe
  C:\Windows\System\vNJZyZR.exe
  2⤵
  PID:9636
- C:\Windows\System\nHKbdxH.exe
  C:\Windows\System\nHKbdxH.exe
  2⤵
  PID:9672
- C:\Windows\System\GTDBtsa.exe
  C:\Windows\System\GTDBtsa.exe
  2⤵
  PID:9688
- C:\Windows\System\YNMnaky.exe
  C:\Windows\System\YNMnaky.exe
  2⤵
  PID:9736
- C:\Windows\System\tjhfGFt.exe
  C:\Windows\System\tjhfGFt.exe
  2⤵
  PID:9764
- C:\Windows\System\KMmtZns.exe
  C:\Windows\System\KMmtZns.exe
  2⤵
  PID:9788
- C:\Windows\System\vsWCKuR.exe
  C:\Windows\System\vsWCKuR.exe
  2⤵
  PID:9808
- C:\Windows\System\rhFBmyv.exe
  C:\Windows\System\rhFBmyv.exe
  2⤵
  PID:9848
- C:\Windows\System\GekhKoW.exe
  C:\Windows\System\GekhKoW.exe
  2⤵
  PID:9864
- C:\Windows\System\SIOEiMq.exe
  C:\Windows\System\SIOEiMq.exe
  2⤵
  PID:9892
- C:\Windows\System\eOqjBRD.exe
  C:\Windows\System\eOqjBRD.exe
  2⤵
  PID:9912
- C:\Windows\System\aIjeQHk.exe
  C:\Windows\System\aIjeQHk.exe
  2⤵
  PID:9956
- C:\Windows\System\zNqFXEY.exe
  C:\Windows\System\zNqFXEY.exe
  2⤵
  PID:9988
- C:\Windows\System\eVeqNkn.exe
  C:\Windows\System\eVeqNkn.exe
  2⤵
  PID:10016
- C:\Windows\System\iTUWJdI.exe
  C:\Windows\System\iTUWJdI.exe
  2⤵
  PID:10044
- C:\Windows\System\dcRrdmO.exe
  C:\Windows\System\dcRrdmO.exe
  2⤵
  PID:10064
- C:\Windows\System\xgpuDyT.exe
  C:\Windows\System\xgpuDyT.exe
  2⤵
  PID:10088
- C:\Windows\System\sxmBldu.exe
  C:\Windows\System\sxmBldu.exe
  2⤵
  PID:10128
- C:\Windows\System\hDMtPIT.exe
  C:\Windows\System\hDMtPIT.exe
  2⤵
  PID:10156
- C:\Windows\System\wcUIJKh.exe
  C:\Windows\System\wcUIJKh.exe
  2⤵
  PID:10188
- C:\Windows\System\tSpwYnN.exe
  C:\Windows\System\tSpwYnN.exe
  2⤵
  PID:10204
- C:\Windows\System\tpKQVXG.exe
  C:\Windows\System\tpKQVXG.exe
  2⤵
  PID:8512
- C:\Windows\System\MHFiuLa.exe
  C:\Windows\System\MHFiuLa.exe
  2⤵
  PID:9280
- C:\Windows\System\OhgzWAH.exe
  C:\Windows\System\OhgzWAH.exe
  2⤵
  PID:9344
- C:\Windows\System\vDUtCdV.exe
  C:\Windows\System\vDUtCdV.exe
  2⤵
  PID:9396
- C:\Windows\System\JRvbZHw.exe
  C:\Windows\System\JRvbZHw.exe
  2⤵
  PID:9464
- C:\Windows\System\cqtZJVL.exe
  C:\Windows\System\cqtZJVL.exe
  2⤵
  PID:9512
- C:\Windows\System\YSNwacZ.exe
  C:\Windows\System\YSNwacZ.exe
  2⤵
  PID:9592
- C:\Windows\System\gCaPBeG.exe
  C:\Windows\System\gCaPBeG.exe
  2⤵
  PID:9620
- C:\Windows\System\PppMVVl.exe
  C:\Windows\System\PppMVVl.exe
  2⤵
  PID:9716
- C:\Windows\System\hlWVGjf.exe
  C:\Windows\System\hlWVGjf.exe
  2⤵
  PID:9800
- C:\Windows\System\NmBCeIk.exe
  C:\Windows\System\NmBCeIk.exe
  2⤵
  PID:9860
- C:\Windows\System\nIrYZuI.exe
  C:\Windows\System\nIrYZuI.exe
  2⤵
  PID:9880
- C:\Windows\System\OFBORwL.exe
  C:\Windows\System\OFBORwL.exe
  2⤵
  PID:9980
- C:\Windows\System\NDMoGre.exe
  C:\Windows\System\NDMoGre.exe
  2⤵
  PID:10012
- C:\Windows\System\JcmhFnr.exe
  C:\Windows\System\JcmhFnr.exe
  2⤵
  PID:10076
- C:\Windows\System\rdqQnie.exe
  C:\Windows\System\rdqQnie.exe
  2⤵
  PID:10120
- C:\Windows\System\jgtNjaX.exe
  C:\Windows\System\jgtNjaX.exe
  2⤵
  PID:10184
- C:\Windows\System\oxbnZIh.exe
  C:\Windows\System\oxbnZIh.exe
  2⤵
  PID:1652
- C:\Windows\System\rrbUfEi.exe
  C:\Windows\System\rrbUfEi.exe
  2⤵
  PID:2936
- C:\Windows\System\zRzEkBv.exe
  C:\Windows\System\zRzEkBv.exe
  2⤵
  PID:9576
- C:\Windows\System\ryyoipg.exe
  C:\Windows\System\ryyoipg.exe
  2⤵
  PID:9708
- C:\Windows\System\BLymWDj.exe
  C:\Windows\System\BLymWDj.exe
  2⤵
  PID:9876
- C:\Windows\System\ADQrGWz.exe
  C:\Windows\System\ADQrGWz.exe
  2⤵
  PID:10008
- C:\Windows\System\LuwlXZe.exe
  C:\Windows\System\LuwlXZe.exe
  2⤵
  PID:4756
- C:\Windows\System\RoKPXrI.exe
  C:\Windows\System\RoKPXrI.exe
  2⤵
  PID:9164
- C:\Windows\System\bFLNjEm.exe
  C:\Windows\System\bFLNjEm.exe
  2⤵
  PID:9624
- C:\Windows\System\ChchRWY.exe
  C:\Windows\System\ChchRWY.exe
  2⤵
  PID:9904
- C:\Windows\System\IkhFWPZ.exe
  C:\Windows\System\IkhFWPZ.exe
  2⤵
  PID:9248
- C:\Windows\System\yEbxeyn.exe
  C:\Windows\System\yEbxeyn.exe
  2⤵
  PID:9772
- C:\Windows\System\vruAAjb.exe
  C:\Windows\System\vruAAjb.exe
  2⤵
  PID:4496
- C:\Windows\System\rDopGMa.exe
  C:\Windows\System\rDopGMa.exe
  2⤵
  PID:10292
- C:\Windows\System\qmzRiPH.exe
  C:\Windows\System\qmzRiPH.exe
  2⤵
  PID:10308
- C:\Windows\System\uaHFKHL.exe
  C:\Windows\System\uaHFKHL.exe
  2⤵
  PID:10348
- C:\Windows\System\OazhHKW.exe
  C:\Windows\System\OazhHKW.exe
  2⤵
  PID:10376
- C:\Windows\System\ERyyfBd.exe
  C:\Windows\System\ERyyfBd.exe
  2⤵
  PID:10404
- C:\Windows\System\BvowiWG.exe
  C:\Windows\System\BvowiWG.exe
  2⤵
  PID:10432
- C:\Windows\System\UdPqxRp.exe
  C:\Windows\System\UdPqxRp.exe
  2⤵
  PID:10448
- C:\Windows\System\vPLQzfd.exe
  C:\Windows\System\vPLQzfd.exe
  2⤵
  PID:10476
- C:\Windows\System\olthjmG.exe
  C:\Windows\System\olthjmG.exe
  2⤵
  PID:10516
- C:\Windows\System\YLnBiId.exe
  C:\Windows\System\YLnBiId.exe
  2⤵
  PID:10544
- C:\Windows\System\afNXDDZ.exe
  C:\Windows\System\afNXDDZ.exe
  2⤵
  PID:10572
- C:\Windows\System\jCCKmso.exe
  C:\Windows\System\jCCKmso.exe
  2⤵
  PID:10600
- C:\Windows\System\NwUCUcw.exe
  C:\Windows\System\NwUCUcw.exe
  2⤵
  PID:10628
- C:\Windows\System\uyKwlEY.exe
  C:\Windows\System\uyKwlEY.exe
  2⤵
  PID:10656
- C:\Windows\System\gakaFzq.exe
  C:\Windows\System\gakaFzq.exe
  2⤵
  PID:10684
- C:\Windows\System\yKWEOqm.exe
  C:\Windows\System\yKWEOqm.exe
  2⤵
  PID:10716
- C:\Windows\System\MBmpsQk.exe
  C:\Windows\System\MBmpsQk.exe
  2⤵
  PID:10744
- C:\Windows\System\pNCPHte.exe
  C:\Windows\System\pNCPHte.exe
  2⤵
  PID:10760
- C:\Windows\System\nidPBQj.exe
  C:\Windows\System\nidPBQj.exe
  2⤵
  PID:10784
- C:\Windows\System\ZcGdbYs.exe
  C:\Windows\System\ZcGdbYs.exe
  2⤵
  PID:10828
- C:\Windows\System\OJEeuuy.exe
  C:\Windows\System\OJEeuuy.exe
  2⤵
  PID:10860
- C:\Windows\System\XTVhPkM.exe
  C:\Windows\System\XTVhPkM.exe
  2⤵
  PID:10888
- C:\Windows\System\lAfWaGS.exe
  C:\Windows\System\lAfWaGS.exe
  2⤵
  PID:10916
- C:\Windows\System\CSNBsLW.exe
  C:\Windows\System\CSNBsLW.exe
  2⤵
  PID:10944
- C:\Windows\System\mceJKOi.exe
  C:\Windows\System\mceJKOi.exe
  2⤵
  PID:10972
- C:\Windows\System\kIcaiNu.exe
  C:\Windows\System\kIcaiNu.exe
  2⤵
  PID:10992
- C:\Windows\System\HqmRmhj.exe
  C:\Windows\System\HqmRmhj.exe
  2⤵
  PID:11012
- C:\Windows\System\JLLEVnW.exe
  C:\Windows\System\JLLEVnW.exe
  2⤵
  PID:11048
- C:\Windows\System\WCytJJe.exe
  C:\Windows\System\WCytJJe.exe
  2⤵
  PID:11084
- C:\Windows\System\LAeWLkJ.exe
  C:\Windows\System\LAeWLkJ.exe
  2⤵
  PID:11100
- C:\Windows\System\uTSSNPN.exe
  C:\Windows\System\uTSSNPN.exe
  2⤵
  PID:11136
- C:\Windows\System\AEbXrIp.exe
  C:\Windows\System\AEbXrIp.exe
  2⤵
  PID:11168
- C:\Windows\System\ZhUeyPz.exe
  C:\Windows\System\ZhUeyPz.exe
  2⤵
  PID:11196
- C:\Windows\System\pjjRUuu.exe
  C:\Windows\System\pjjRUuu.exe
  2⤵
  PID:11212
- C:\Windows\System\OWcxiUC.exe
  C:\Windows\System\OWcxiUC.exe
  2⤵
  PID:11252
- C:\Windows\System\frZJqhI.exe
  C:\Windows\System\frZJqhI.exe
  2⤵
  PID:9508
- C:\Windows\System\XQBLDYW.exe
  C:\Windows\System\XQBLDYW.exe
  2⤵
  PID:3136
- C:\Windows\System\UcpMhla.exe
  C:\Windows\System\UcpMhla.exe
  2⤵
  PID:10340
- C:\Windows\System\vlfJaOV.exe
  C:\Windows\System\vlfJaOV.exe
  2⤵
  PID:10428
- C:\Windows\System\XqnuJgf.exe
  C:\Windows\System\XqnuJgf.exe
  2⤵
  PID:4824
- C:\Windows\System\HiRrWQu.exe
  C:\Windows\System\HiRrWQu.exe
  2⤵
  PID:10508
- C:\Windows\System\LRKOgCc.exe
  C:\Windows\System\LRKOgCc.exe
  2⤵
  PID:10540
- C:\Windows\System\dyuWxDJ.exe
  C:\Windows\System\dyuWxDJ.exe
  2⤵
  PID:10644
- C:\Windows\System\HFQdngy.exe
  C:\Windows\System\HFQdngy.exe
  2⤵
  PID:10712
- C:\Windows\System\TvDLpZr.exe
  C:\Windows\System\TvDLpZr.exe
  2⤵
  PID:10768
- C:\Windows\System\TxdUBNx.exe
  C:\Windows\System\TxdUBNx.exe
  2⤵
  PID:10884
- C:\Windows\System\DNpAXAU.exe
  C:\Windows\System\DNpAXAU.exe
  2⤵
  PID:10904
- C:\Windows\System\mbEhGnZ.exe
  C:\Windows\System\mbEhGnZ.exe
  2⤵
  PID:11008
- C:\Windows\System\egVVovy.exe
  C:\Windows\System\egVVovy.exe
  2⤵
  PID:11080
- C:\Windows\System\mjamoqo.exe
  C:\Windows\System\mjamoqo.exe
  2⤵
  PID:11128
- C:\Windows\System\xObOYJM.exe
  C:\Windows\System\xObOYJM.exe
  2⤵
  PID:11192
- C:\Windows\System\wvRzllQ.exe
  C:\Windows\System\wvRzllQ.exe
  2⤵
  PID:11232
- C:\Windows\System\XQnEKCr.exe
  C:\Windows\System\XQnEKCr.exe
  2⤵
  PID:10300
- C:\Windows\System\hcnUojI.exe
  C:\Windows\System\hcnUojI.exe
  2⤵
  PID:10468
- C:\Windows\System\hAvQWvg.exe
  C:\Windows\System\hAvQWvg.exe
  2⤵
  PID:10592
- C:\Windows\System\rRgNphL.exe
  C:\Windows\System\rRgNphL.exe
  2⤵
  PID:10820
- C:\Windows\System\hhuvXYd.exe
  C:\Windows\System\hhuvXYd.exe
  2⤵
  PID:11024
- C:\Windows\System\diMEAQy.exe
  C:\Windows\System\diMEAQy.exe
  2⤵
  PID:11064
- C:\Windows\System\ljKefLU.exe
  C:\Windows\System\ljKefLU.exe
  2⤵
  PID:3800
- C:\Windows\System\neLxYzl.exe
  C:\Windows\System\neLxYzl.exe
  2⤵
  PID:10500
- C:\Windows\System\qGhlhco.exe
  C:\Windows\System\qGhlhco.exe
  2⤵
  PID:10956
- C:\Windows\System\uAzvvWL.exe
  C:\Windows\System\uAzvvWL.exe
  2⤵
  PID:11096
- C:\Windows\System\hPoKEZs.exe
  C:\Windows\System\hPoKEZs.exe
  2⤵
  PID:2356
- C:\Windows\System\wtqqGZI.exe
  C:\Windows\System\wtqqGZI.exe
  2⤵
  PID:10848
- C:\Windows\System\YYsBlex.exe
  C:\Windows\System\YYsBlex.exe
  2⤵
  PID:11288
- C:\Windows\System\CyoomJR.exe
  C:\Windows\System\CyoomJR.exe
  2⤵
  PID:11308
- C:\Windows\System\auhcxRd.exe
  C:\Windows\System\auhcxRd.exe
  2⤵
  PID:11340
- C:\Windows\System\GsKwWbc.exe
  C:\Windows\System\GsKwWbc.exe
  2⤵
  PID:11380
- C:\Windows\System\KqQBdjT.exe
  C:\Windows\System\KqQBdjT.exe
  2⤵
  PID:11400
- C:\Windows\System\EGjkkVm.exe
  C:\Windows\System\EGjkkVm.exe
  2⤵
  PID:11428
- C:\Windows\System\tzDFJVM.exe
  C:\Windows\System\tzDFJVM.exe
  2⤵
  PID:11464
- C:\Windows\System\sBhDrZm.exe
  C:\Windows\System\sBhDrZm.exe
  2⤵
  PID:11480
- C:\Windows\System\paYHLxf.exe
  C:\Windows\System\paYHLxf.exe
  2⤵
  PID:11520
- C:\Windows\System\QDQvYeV.exe
  C:\Windows\System\QDQvYeV.exe
  2⤵
  PID:11552
- C:\Windows\System\xZUyHXw.exe
  C:\Windows\System\xZUyHXw.exe
  2⤵
  PID:11568
- C:\Windows\System\NhFkBXh.exe
  C:\Windows\System\NhFkBXh.exe
  2⤵
  PID:11608
- C:\Windows\System\VfNsbds.exe
  C:\Windows\System\VfNsbds.exe
  2⤵
  PID:11636
- C:\Windows\System\tvRipNv.exe
  C:\Windows\System\tvRipNv.exe
  2⤵
  PID:11664
- C:\Windows\System\DvWPxYt.exe
  C:\Windows\System\DvWPxYt.exe
  2⤵
  PID:11700
- C:\Windows\System\rnkxUzP.exe
  C:\Windows\System\rnkxUzP.exe
  2⤵
  PID:11728
- C:\Windows\System\VViHggB.exe
  C:\Windows\System\VViHggB.exe
  2⤵
  PID:11772
- C:\Windows\System\btmJksp.exe
  C:\Windows\System\btmJksp.exe
  2⤵
  PID:11796
- C:\Windows\System\IjYGfPR.exe
  C:\Windows\System\IjYGfPR.exe
  2⤵
  PID:11836
- C:\Windows\System\bwTeLPn.exe
  C:\Windows\System\bwTeLPn.exe
  2⤵
  PID:11864
- C:\Windows\System\PLBOvye.exe
  C:\Windows\System\PLBOvye.exe
  2⤵
  PID:11880
- C:\Windows\System\TAPdrhe.exe
  C:\Windows\System\TAPdrhe.exe
  2⤵
  PID:11920
- C:\Windows\System\zpLECIH.exe
  C:\Windows\System\zpLECIH.exe
  2⤵
  PID:11948
- C:\Windows\System\oSXOboy.exe
  C:\Windows\System\oSXOboy.exe
  2⤵
  PID:11976
- C:\Windows\System\VvnBrfv.exe
  C:\Windows\System\VvnBrfv.exe
  2⤵
  PID:11996
- C:\Windows\System\fCtRNCR.exe
  C:\Windows\System\fCtRNCR.exe
  2⤵
  PID:12032
- C:\Windows\System\xKkZGMj.exe
  C:\Windows\System\xKkZGMj.exe
  2⤵
  PID:12056
- C:\Windows\System\IYzOnrv.exe
  C:\Windows\System\IYzOnrv.exe
  2⤵
  PID:12076
- C:\Windows\System\dWyDZDj.exe
  C:\Windows\System\dWyDZDj.exe
  2⤵
  PID:12116
- C:\Windows\System\ZEIPVgx.exe
  C:\Windows\System\ZEIPVgx.exe
  2⤵
  PID:12144
- C:\Windows\System\SrxWRYM.exe
  C:\Windows\System\SrxWRYM.exe
  2⤵
  PID:12172
- C:\Windows\System\Fugdebg.exe
  C:\Windows\System\Fugdebg.exe
  2⤵
  PID:12208
- C:\Windows\System\fipoidn.exe
  C:\Windows\System\fipoidn.exe
  2⤵
  PID:12232
- C:\Windows\System\gpXhIIA.exe
  C:\Windows\System\gpXhIIA.exe
  2⤵
  PID:12248
- C:\Windows\System\ayDeOSu.exe
  C:\Windows\System\ayDeOSu.exe
  2⤵
  PID:11268
- C:\Windows\System\tzCRUBd.exe
  C:\Windows\System\tzCRUBd.exe
  2⤵
  PID:11356
- C:\Windows\System\lKYpnwa.exe
  C:\Windows\System\lKYpnwa.exe
  2⤵
  PID:11376
- C:\Windows\System\FFfvDWq.exe
  C:\Windows\System\FFfvDWq.exe
  2⤵
  PID:11500
- C:\Windows\System\XrWqzhQ.exe
  C:\Windows\System\XrWqzhQ.exe
  2⤵
  PID:11584
- C:\Windows\System\PjgrhLY.exe
  C:\Windows\System\PjgrhLY.exe
  2⤵
  PID:11660
- C:\Windows\System\PuSaVVB.exe
  C:\Windows\System\PuSaVVB.exe
  2⤵
  PID:11740
- C:\Windows\System\MiFAsXM.exe
  C:\Windows\System\MiFAsXM.exe
  2⤵
  PID:11860
- C:\Windows\System\XmgpfxX.exe
  C:\Windows\System\XmgpfxX.exe
  2⤵
  PID:11960
- C:\Windows\System\ZsndjoV.exe
  C:\Windows\System\ZsndjoV.exe
  2⤵
  PID:12020
- C:\Windows\System\ztfVPOf.exe
  C:\Windows\System\ztfVPOf.exe
  2⤵
  PID:12096
- C:\Windows\System\KaMtezF.exe
  C:\Windows\System\KaMtezF.exe
  2⤵
  PID:12156
- C:\Windows\System\PjwcRbq.exe
  C:\Windows\System\PjwcRbq.exe
  2⤵
  PID:12284
- C:\Windows\System\NFQBJWo.exe
  C:\Windows\System\NFQBJWo.exe
  2⤵
  PID:11328
- C:\Windows\System\SUpydwg.exe
  C:\Windows\System\SUpydwg.exe
  2⤵
  PID:11604
- C:\Windows\System\XqeBKNP.exe
  C:\Windows\System\XqeBKNP.exe
  2⤵
  PID:11816
- C:\Windows\System\SPboPZT.exe
  C:\Windows\System\SPboPZT.exe
  2⤵
  PID:11332
- C:\Windows\System\sBlAgTe.exe
  C:\Windows\System\sBlAgTe.exe
  2⤵
  PID:11276
- C:\Windows\System\Syrnhrt.exe
  C:\Windows\System\Syrnhrt.exe
  2⤵
  PID:12356
- C:\Windows\System\UbvdeTB.exe
  C:\Windows\System\UbvdeTB.exe
  2⤵
  PID:12372
- C:\Windows\System\CcuyOxS.exe
  C:\Windows\System\CcuyOxS.exe
  2⤵
  PID:12400
- C:\Windows\System\wVSDYWI.exe
  C:\Windows\System\wVSDYWI.exe
  2⤵
  PID:12420
- C:\Windows\System\urxfuUl.exe
  C:\Windows\System\urxfuUl.exe
  2⤵
  PID:12440
- C:\Windows\System\dcaHuuo.exe
  C:\Windows\System\dcaHuuo.exe
  2⤵
  PID:12480
- C:\Windows\System\sJqnugg.exe
  C:\Windows\System\sJqnugg.exe
  2⤵
  PID:12504
- C:\Windows\System\uVbhsoQ.exe
  C:\Windows\System\uVbhsoQ.exe
  2⤵
  PID:12528
- C:\Windows\System\lhYfZeG.exe
  C:\Windows\System\lhYfZeG.exe
  2⤵
  PID:12560
- C:\Windows\System\sXZWCzB.exe
  C:\Windows\System\sXZWCzB.exe
  2⤵
  PID:12604
- C:\Windows\System\HkhlysG.exe
  C:\Windows\System\HkhlysG.exe
  2⤵
  PID:12620
- C:\Windows\System\mMVnoia.exe
  C:\Windows\System\mMVnoia.exe
  2⤵
  PID:12648
- C:\Windows\System\eEKWmBU.exe
  C:\Windows\System\eEKWmBU.exe
  2⤵
  PID:12676
- C:\Windows\System\XrAqCbv.exe
  C:\Windows\System\XrAqCbv.exe
  2⤵
  PID:12728
- C:\Windows\System\OmFbJQu.exe
  C:\Windows\System\OmFbJQu.exe
  2⤵
  PID:12756
- C:\Windows\System\GhlrIeB.exe
  C:\Windows\System\GhlrIeB.exe
  2⤵
  PID:12772
- C:\Windows\System\molvcsh.exe
  C:\Windows\System\molvcsh.exe
  2⤵
  PID:12808
- C:\Windows\System\KEcbtxG.exe
  C:\Windows\System\KEcbtxG.exe
  2⤵
  PID:12836
- C:\Windows\System\wQdnCPn.exe
  C:\Windows\System\wQdnCPn.exe
  2⤵
  PID:12860
- C:\Windows\System\EpFRfgQ.exe
  C:\Windows\System\EpFRfgQ.exe
  2⤵
  PID:12884
- C:\Windows\System\fMzmpNy.exe
  C:\Windows\System\fMzmpNy.exe
  2⤵
  PID:12904
- C:\Windows\System\uRcoFAL.exe
  C:\Windows\System\uRcoFAL.exe
  2⤵
  PID:12948
- C:\Windows\System\dUVpwJm.exe
  C:\Windows\System\dUVpwJm.exe
  2⤵
  PID:12980
- C:\Windows\System\UABfGjF.exe
  C:\Windows\System\UABfGjF.exe
  2⤵
  PID:13004
- C:\Windows\System\osWYmGF.exe
  C:\Windows\System\osWYmGF.exe
  2⤵
  PID:13044
- C:\Windows\System\pjVRszJ.exe
  C:\Windows\System\pjVRszJ.exe
  2⤵
  PID:13076
- C:\Windows\System\oxmndRS.exe
  C:\Windows\System\oxmndRS.exe
  2⤵
  PID:13096
- C:\Windows\System\fhVkKUo.exe
  C:\Windows\System\fhVkKUo.exe
  2⤵
  PID:13128
- C:\Windows\System\NxPunfZ.exe
  C:\Windows\System\NxPunfZ.exe
  2⤵
  PID:13168
- C:\Windows\System\rfRSFzY.exe
  C:\Windows\System\rfRSFzY.exe
  2⤵
  PID:13196
- C:\Windows\System\WkFKIUG.exe
  C:\Windows\System\WkFKIUG.exe
  2⤵
  PID:13224
- C:\Windows\System\OzInBYE.exe
  C:\Windows\System\OzInBYE.exe
  2⤵
  PID:13248
- C:\Windows\System\zqfgjKH.exe
  C:\Windows\System\zqfgjKH.exe
  2⤵
  PID:13268
- C:\Windows\System\scSqowS.exe
  C:\Windows\System\scSqowS.exe
  2⤵
  PID:13296
- C:\Windows\System\OfjsCuu.exe
  C:\Windows\System\OfjsCuu.exe
  2⤵
  PID:9240
- C:\Windows\System\YlYFCdj.exe
  C:\Windows\System\YlYFCdj.exe
  2⤵
  PID:8224
- C:\Windows\System\YDwRxev.exe
  C:\Windows\System\YDwRxev.exe
  2⤵
  PID:12412
- C:\Windows\System\wYdmNWF.exe
  C:\Windows\System\wYdmNWF.exe
  2⤵
  PID:12436
- C:\Windows\System\nzvSEcu.exe
  C:\Windows\System\nzvSEcu.exe
  2⤵
  PID:12552
- C:\Windows\System\UbkMjVj.exe
  C:\Windows\System\UbkMjVj.exe
  2⤵
  PID:12640
- C:\Windows\System\irhrBBV.exe
  C:\Windows\System\irhrBBV.exe
  2⤵
  PID:12668
- C:\Windows\System\gTvZZKY.exe
  C:\Windows\System\gTvZZKY.exe
  2⤵
  PID:12712
- C:\Windows\System\VdQoVBZ.exe
  C:\Windows\System\VdQoVBZ.exe
  2⤵
  PID:12792
- C:\Windows\System\RidJyek.exe
  C:\Windows\System\RidJyek.exe
  2⤵
  PID:12868
- C:\Windows\System\JibfoBD.exe
  C:\Windows\System\JibfoBD.exe
  2⤵
  PID:12932
- C:\Windows\System\EdDQEuz.exe
  C:\Windows\System\EdDQEuz.exe
  2⤵
  PID:12968
- C:\Windows\System\ryrEUSV.exe
  C:\Windows\System\ryrEUSV.exe
  2⤵
  PID:13040
- C:\Windows\System\DLIVNmW.exe
  C:\Windows\System\DLIVNmW.exe
  2⤵
  PID:13112
- C:\Windows\System\ChXKMnH.exe
  C:\Windows\System\ChXKMnH.exe
  2⤵
  PID:13140
- C:\Windows\System\RNLMvdV.exe
  C:\Windows\System\RNLMvdV.exe
  2⤵
  PID:13288
- C:\Windows\System\JCwVYEs.exe
  C:\Windows\System\JCwVYEs.exe
  2⤵
  PID:12336
- C:\Windows\System\SmcNpdn.exe
  C:\Windows\System\SmcNpdn.exe
  2⤵
  PID:2044
- C:\Windows\System\mNIFiII.exe
  C:\Windows\System\mNIFiII.exe
  2⤵
  PID:12576
- C:\Windows\System\SgTEDHA.exe
  C:\Windows\System\SgTEDHA.exe
  2⤵
  PID:12704
- C:\Windows\System\gOrBoCt.exe
  C:\Windows\System\gOrBoCt.exe
  2⤵
  PID:12844
- C:\Windows\System\oukadcr.exe
  C:\Windows\System\oukadcr.exe
  2⤵
  PID:13016
- C:\Windows\System\NNzvGfV.exe
  C:\Windows\System\NNzvGfV.exe
  2⤵
  PID:13260
- C:\Windows\System\RSkbueV.exe
  C:\Windows\System\RSkbueV.exe
  2⤵
  PID:12512
- C:\Windows\System\yyiHbWp.exe
  C:\Windows\System\yyiHbWp.exe
  2⤵
  PID:4584
- C:\Windows\System\aEGMNBM.exe
  C:\Windows\System\aEGMNBM.exe
  2⤵
  PID:12960
- C:\Windows\System\HrCbpIO.exe
  C:\Windows\System\HrCbpIO.exe
  2⤵
  PID:3424
- C:\Windows\System\yKJAbAY.exe
  C:\Windows\System\yKJAbAY.exe
  2⤵
  PID:1076
- C:\Windows\System\MopqgCe.exe
  C:\Windows\System\MopqgCe.exe
  2⤵
  PID:12828
- C:\Windows\System\YvJptLT.exe
  C:\Windows\System\YvJptLT.exe
  2⤵
  PID:13216
- C:\Windows\System\aHhlbZt.exe
  C:\Windows\System\aHhlbZt.exe
  2⤵
  PID:13332
- C:\Windows\System\rZlufAN.exe
  C:\Windows\System\rZlufAN.exe
  2⤵
  PID:13396
- C:\Windows\System\sqdPGHJ.exe
  C:\Windows\System\sqdPGHJ.exe
  2⤵
  PID:13424
- C:\Windows\System\rWHInDW.exe
  C:\Windows\System\rWHInDW.exe
  2⤵
  PID:13444
- C:\Windows\System\EwJEUVx.exe
  C:\Windows\System\EwJEUVx.exe
  2⤵
  PID:13472
- C:\Windows\System\LDkwDEi.exe
  C:\Windows\System\LDkwDEi.exe
  2⤵
  PID:13496
- C:\Windows\System\MPwHnzG.exe
  C:\Windows\System\MPwHnzG.exe
  2⤵
  PID:13536
- C:\Windows\System\SphihqZ.exe
  C:\Windows\System\SphihqZ.exe
  2⤵
  PID:13552
- C:\Windows\System\xRXIxkZ.exe
  C:\Windows\System\xRXIxkZ.exe
  2⤵
  PID:13580
- C:\Windows\System\raNGDFm.exe
  C:\Windows\System\raNGDFm.exe
  2⤵
  PID:13604
- C:\Windows\System\KuVPFzG.exe
  C:\Windows\System\KuVPFzG.exe
  2⤵
  PID:13648
- C:\Windows\System\DpkTOOs.exe
  C:\Windows\System\DpkTOOs.exe
  2⤵
  PID:13676
- C:\Windows\System\UhUshdp.exe
  C:\Windows\System\UhUshdp.exe
  2⤵
  PID:13692
- C:\Windows\System\rKQuzZC.exe
  C:\Windows\System\rKQuzZC.exe
  2⤵
  PID:13724
- C:\Windows\System\rGZYgtD.exe
  C:\Windows\System\rGZYgtD.exe
  2⤵
  PID:13748
- C:\Windows\System\TvSIbmk.exe
  C:\Windows\System\TvSIbmk.exe
  2⤵
  PID:13776
- C:\Windows\System\ckOHbmN.exe
  C:\Windows\System\ckOHbmN.exe
  2⤵
  PID:13824
- C:\Windows\System\xaaQEPY.exe
  C:\Windows\System\xaaQEPY.exe
  2⤵
  PID:13844
- C:\Windows\System\ZarETGH.exe
  C:\Windows\System\ZarETGH.exe
  2⤵
  PID:13868
- C:\Windows\System\tLIVbBD.exe
  C:\Windows\System\tLIVbBD.exe
  2⤵
  PID:13896
- C:\Windows\System\UFkiFvQ.exe
  C:\Windows\System\UFkiFvQ.exe
  2⤵
  PID:13948
- C:\Windows\System\urUsrGe.exe
  C:\Windows\System\urUsrGe.exe
  2⤵
  PID:13984
- C:\Windows\System\FSvxXJA.exe
  C:\Windows\System\FSvxXJA.exe
  2⤵
  PID:14004
- C:\Windows\System\uLuGVwh.exe
  C:\Windows\System\uLuGVwh.exe
  2⤵
  PID:14020
- C:\Windows\System\BXdrhib.exe
  C:\Windows\System\BXdrhib.exe
  2⤵
  PID:14072
- C:\Windows\System\UXyddzN.exe
  C:\Windows\System\UXyddzN.exe
  2⤵
  PID:14100
- C:\Windows\System\DZOdlOQ.exe
  C:\Windows\System\DZOdlOQ.exe
  2⤵
  PID:14128
- C:\Windows\System\GtZmQoI.exe
  C:\Windows\System\GtZmQoI.exe
  2⤵
  PID:14156
- C:\Windows\System\uoxWDTI.exe
  C:\Windows\System\uoxWDTI.exe
  2⤵
  PID:14172
- C:\Windows\System\VjAeySF.exe
  C:\Windows\System\VjAeySF.exe
  2⤵
  PID:14204
- C:\Windows\System\HhbyaPX.exe
  C:\Windows\System\HhbyaPX.exe
  2⤵
  PID:14228
- C:\Windows\System\gnrkdXd.exe
  C:\Windows\System\gnrkdXd.exe
  2⤵
  PID:14268
- C:\Windows\System\wbXJUBU.exe
  C:\Windows\System\wbXJUBU.exe
  2⤵
  PID:14296
- C:\Windows\System\lgDwvUZ.exe
  C:\Windows\System\lgDwvUZ.exe
  2⤵
  PID:14312
- C:\Windows\System\cIdGufp.exe
  C:\Windows\System\cIdGufp.exe
  2⤵
  PID:13328
- C:\Windows\System\CtNTtuK.exe
  C:\Windows\System\CtNTtuK.exe
  2⤵
  PID:13324
- C:\Windows\System\weDiyKW.exe
  C:\Windows\System\weDiyKW.exe
  2⤵
  PID:13436
- C:\Windows\System\nVAzQue.exe
  C:\Windows\System\nVAzQue.exe
  2⤵
  PID:13492
- C:\Windows\System\tKHHzmg.exe
  C:\Windows\System\tKHHzmg.exe
  2⤵
  PID:13600
- C:\Windows\System\oLPsKYG.exe
  C:\Windows\System\oLPsKYG.exe
  2⤵
  PID:13704
- C:\Windows\System\qenVhWN.exe
  C:\Windows\System\qenVhWN.exe
  2⤵
  PID:13796
- C:\Windows\System\yqLXMxb.exe
  C:\Windows\System\yqLXMxb.exe
  2⤵
  PID:13840
- C:\Windows\System\yUlVNtP.exe
  C:\Windows\System\yUlVNtP.exe
  2⤵
  PID:13888
- C:\Windows\System\TIdgCIO.exe
  C:\Windows\System\TIdgCIO.exe
  2⤵
  PID:13968
- C:\Windows\System\CzuvQKO.exe
  C:\Windows\System\CzuvQKO.exe
  2⤵
  PID:14068
- C:\Windows\System\rriaZoH.exe
  C:\Windows\System\rriaZoH.exe
  2⤵
  PID:14144
- C:\Windows\System\XysKMwc.exe
  C:\Windows\System\XysKMwc.exe
  2⤵
  PID:14168
- C:\Windows\System\yeLpjRV.exe
  C:\Windows\System\yeLpjRV.exe
  2⤵
  PID:14224
- C:\Windows\System\RBJmpPB.exe
  C:\Windows\System\RBJmpPB.exe
  2⤵
  PID:14280
- C:\Windows\System\CFbNlqj.exe
  C:\Windows\System\CFbNlqj.exe
  2⤵
  PID:4008
- C:\Windows\System\xzVIhCJ.exe
  C:\Windows\System\xzVIhCJ.exe
  2⤵
  PID:13408
- C:\Windows\System\yDPjdOn.exe
  C:\Windows\System\yDPjdOn.exe
  2⤵
  PID:13732
- C:\Windows\System\mUXFRFK.exe
  C:\Windows\System\mUXFRFK.exe
  2⤵
  PID:13852
- C:\Windows\System\LIMjTzt.exe
  C:\Windows\System\LIMjTzt.exe
  2⤵
  PID:14084
- C:\Windows\System\WeMGaUq.exe
  C:\Windows\System\WeMGaUq.exe
  2⤵
  PID:14220
- C:\Windows\System\HJSzhPg.exe
  C:\Windows\System\HJSzhPg.exe
  2⤵
  PID:12764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AtJqyFF.exe

Filesize
2.5MB

MD5
ecf1faf4576619fd953611312df26032

SHA1
7305613e5a53a98dbb4e4a0b168f7ecb7c872957

SHA256
ce1e3fde67f1917eff3d58cf107fb57c099085db60d32d2051b91afaaba069cf

SHA512
41733635ddd503e3187cc4ff1761fddaaa3dd5b8353823faa7e3f1f0cb3b4d6e9df0d96b0827cb9a4cea73aeac1ad70f39a5bc716c446368409c78e9330f09bd

Download Submit
C:\Windows\System\CCljyYc.exe

Filesize
2.5MB

MD5
7d76f0161e57b8aa8a819d478988df6a

SHA1
130ea811bf34a1a1c4fb8d7d423bfcab8cd0b980

SHA256
0574571b7d57770612ce1f9b2daab0f5bf9ff88669e655adf6f06a1cf947e174

SHA512
5fbe7b62d469f2592af6439671e6c5071428bd1fbc12180c9928e087246630a858b3a8330565b789183c216d285c7ee6378f5787ebdde67ccb4e095ea5832687

Download Submit
C:\Windows\System\CpRxIsa.exe

Filesize
2.5MB

MD5
c65a1e491e82619bf6754386711591a0

SHA1
bb535cf69dc5332863287459260df82f84613cfa

SHA256
5ad9697e34c6536fba7ed5a6b9a31e5b45fcaf0b57f2e57f0423ff17b7090af1

SHA512
f4c5d6372ce79afdb38f48de48c8e266d5bf1a241dcddab1b262633c68d6d8174929d7dbfdd3f6d81fca63a6021d00be90a44aaaaae4f1d46f3e283ae0e92792

Download Submit
C:\Windows\System\GgCocve.exe

Filesize
2.5MB

MD5
c868b62e5cb40141d1beb033a8b91a9d

SHA1
0e5bdf81d59b450edae68465404b6c44bd1ceee2

SHA256
556f082cd5084f2d8d4de508d595045327059b00f62c66a9665c82c521754260

SHA512
b9d48f8e8516cf0ff1eafb20f955bc8760f2d1f0ed53d998abf225bfce35e03b123a9691d3ac70ab4cc1917a7891fd04195dd31da537b0712ead4621a8ad9e06

Download Submit
C:\Windows\System\JRopGnk.exe

Filesize
2.5MB

MD5
fa99dd6a15e9823792a0f0d791b9e2b4

SHA1
dc342345a924f9f0d0ff2d31d640a78b1e9692d4

SHA256
d3969c25339f9a9c1942544f12899642337cc9c22fcc769d8f48c81d5a114dc6

SHA512
3d66585496ca3fbb768181a1b7d5d5df4e4000ec4ae8812c5c1cde45ea299ef061656e120fa2447385f62780058efbbc8c4bafb6588c2fd1e380544b01a3066f

Download Submit
C:\Windows\System\JkOyina.exe

Filesize
2.5MB

MD5
fd7b03bbdeaa26ac6e7e4b383606273d

SHA1
6e9f789a3690f31dbf3973b8346c99b00bdf7272

SHA256
bd8a9b64381af1779f022aba36726428f758c032cafc5a3c5c8d5f870efa8a95

SHA512
6ba9abb515c59b582d60a326bad7b965c719aed4ab2082bd61931e9e047c7d38e9d02d008a3985d240d63cbffcec0cb802e6220d5436c353ff43e79df538ce03

Download Submit
C:\Windows\System\KQKycTQ.exe

Filesize
2.5MB

MD5
759292fbd0dca630b0940f4389f73a6c

SHA1
1c861e759eb7100b20b9f87f2dbe862840fbd99f

SHA256
b8fb7eb3d5a43607387a6c9659a720ba9279307bc0851b98b8aa7875e61a434d

SHA512
a4bacfa6a5e29033249bef647eeef8bca0252ccb98856e084c729bf69b118dfcfcdad7c246a7778931df789ac4b445af9e0d308bfe9b793d0efd6cede85da33d

Download Submit
C:\Windows\System\KyFGXMN.exe

Filesize
2.5MB

MD5
5a0bbd887280a4357b1992bad6e5d2e3

SHA1
006292a59575eb66f852a1312d310d6d68e5c3d0

SHA256
5dac438d5ca24cb4016ca39a0fcca4f5d0d99a5c3f7538d3d882149a7e001860

SHA512
95225c49758d33462a274042f0d28f12f05127f8edd252fb1ec901747a2151fc5e9a2663663c80448a464ab9e372066ad8727586a965e3e39d4765640d332390

Download Submit
C:\Windows\System\LzhXwFU.exe

Filesize
2.5MB

MD5
fc8987bace5a23b82736424daa537a85

SHA1
06a103ead87deff42d3f2aca95b3c7d2cecad0db

SHA256
17ca7b3b6c1ff3f2f7cde043fb83f761acca470a580f7fc67ff8da6be3b90739

SHA512
0d59c97dec51c61b05f59c6d2bed17689a76609fbd5bc1a84517e264d1abfb1802e1e5bfd4edb2c237fbaee940a97879502b14999e544a7d98bad4fd95b0b821

Download Submit
C:\Windows\System\NdgwxXz.exe

Filesize
2.5MB

MD5
fa3dcf0fcbadeae93da4c09d153e8590

SHA1
600c059e6f84024b75a4b5b7738bf05f011487a5

SHA256
56a9ed7dc69514b873b1871dfacf946eee6151045c45b7d6adca868fa58d74c4

SHA512
0d2474fc0b78b2e26841aa9ff0782d70fb93208b943de243b18be1f689d979d67e621af40619a296f76968331470995ddb424ba0afe77adaf9e310db72936585

Download Submit
C:\Windows\System\NtGNNvy.exe

Filesize
2.5MB

MD5
061598376745386dc66b0239472c1e4d

SHA1
f916f164e036db6d79bcb78b1535a6e52a20e4c4

SHA256
d1f822f41bb3e96f014a1837e27bf8e4c9131259c158072bc970a934a03859bc

SHA512
99d24fee28ed35f87b7f9fcf570d01973df24a01d388700df27211b6b40cdcdfdf1f90e1dee9a5a47fb35da066a1d0087783237a28734fbbe9c03320b2d501e2

Download Submit
C:\Windows\System\OaEZMXG.exe

Filesize
2.5MB

MD5
35fb3b14b6a71a9ee22c9f2d7c29f20c

SHA1
cb07d18f470cec357553d0870b6bc71b5b8c15f8

SHA256
05b64fbdbb0e6a963312b3860f1607ce1191798ddef1349091558388a8a81a96

SHA512
fb1b405d4ee9d7a2a742c432d86f3e65f3df6b1987f82ba34b33ff4d94ad7b784fa7a1684a8ad09525fc0e830f238166a47cf978272b5964a84736e28e2b83a8

Download Submit
C:\Windows\System\PemVnbH.exe

Filesize
2.5MB

MD5
e2c7b955cce1d36b55a06c7fb6e19c00

SHA1
11670c773a240d4e32174876d9286528fa49925f

SHA256
856974fefaa658ead41dfa78096adcc53b9f299d0b2e7b0c7f787fc1582fb0a9

SHA512
cf08ec254fcef5e2c42c261f3aa104fc6889936a3b31cda74c68c3b9a6c565ead67927cce528d658bcad7b7542b7a22d3c8bcd0efce258dd8a1ce199a753373b

Download Submit
C:\Windows\System\RoxYdEr.exe

Filesize
2.5MB

MD5
15b924eb0e70e7b62fd33211f8a29f62

SHA1
6176c108a3f336c78817ac70f34cb1819a5c1374

SHA256
78dcc1375bcf6652611544eb82d26215b6bdc225bf100295396f28c9d06b6f42

SHA512
81418a007f053fdf26834e3d4b94c374fa03f2d078fc2e8a2645615d38c92255c644093a24fad8e781b3a85c374df8d6fae2ef0baf40a8d2a55b20c0e56f6878

Download Submit
C:\Windows\System\SfXipPZ.exe

Filesize
2.5MB

MD5
6c1f1a967de130b2bc0f09f8077f3f34

SHA1
fdd6fef1d3dbe79c4d4f79f943f23df909c84f18

SHA256
4383200717154f51a66624f02e3e596475217900a6b3d7c79e1915debdfa805a

SHA512
17bac57335b479d7ba2a6b0bdd2652cc9620acac96afa00d7655e903288a36a91ced6161818442f136ee8907066bae2119dc1cd1a15ac716a0d2cb4c6a6af575

Download Submit
C:\Windows\System\WuTGUjn.exe

Filesize
2.5MB

MD5
76c7517d2963af67c94d5b508055e6bf

SHA1
9977c6fdf4f5393179cbd48a4886cf69582ae00e

SHA256
40880b4cfb7a50fa51d5ad616cb8a86872a5d2077c0e934836f8499c6e5fbf22

SHA512
31f88849485195f0f81f5a8d368d39adb07b5fe43f07a08b0374963ea801bd263cddd778a925a7e35cbdaa82530033c960b7028077c3391ef8c431c1f7d91a6b

Download Submit
C:\Windows\System\XkngfEN.exe

Filesize
2.5MB

MD5
d03bec2770cd1d1548e37fd1d4b1c562

SHA1
ead7517789d29a9b5b5cae69e522535c3c59430c

SHA256
32cafe33ea3cd057c415dfa0cf8cebef896d8a5bc59f12d3097bd3e743392fef

SHA512
f9bdf367b8942f92ec855e5416c7583b34cda9923a5c77c6005e298d0da93cc961158930cc746e189e8fc285a6254b89f6a7ff5590b5515f6e11186aef2e0eae

Download Submit
C:\Windows\System\ZLfmrAx.exe

Filesize
2.5MB

MD5
383e3d8bcc55ac63eacc9716fcfc7990

SHA1
5092c90152bd43fb3e70ed29030a120430ce3fbd

SHA256
a2c22936ede119843857ac9b6fe50390501a27e1a9dc38840fb2cc52364dcabe

SHA512
ea307e62462e76672bc0ccfb4daa537b7bca16cd3425896e3f50137c8c81f421007708d0de742c32ee7b50069191d40f3689c8e4983617dd28efdb589a4337f5

Download Submit
C:\Windows\System\antsxJi.exe

Filesize
2.5MB

MD5
23e3fa21f5813e95cbc81c4504273afd

SHA1
011bfdd37dc2858852950cd4f770c02e251459aa

SHA256
f749a61dc489365e3e0f0d1ef1881411a517c807739da4049fe1e22925ead68f

SHA512
30f3671b7cafacb39711e99710feb4b3ef92329872779ba92bb26e09c91668eadb4d85e5cb0d49d0bceaa51a82f1d8d0645490b058f514948e14a96692bfdb36

Download Submit
C:\Windows\System\bQgctca.exe

Filesize
2.5MB

MD5
31f0825baa415c196230ccefe11da66a

SHA1
2c80dd3bc5ba98ae10d7f3f4407aaa4adfc8d8d9

SHA256
2f1539010f544677e18b56738e8f00e278b2787eed841dbb31e080eaeef77a04

SHA512
002dd3b0b4bf680e4a5bc45b37644cf5f12d28e14906c405bafb17b9c62e56e22d6886f6c5eb0207022555afb73d949176cb62dad4d0448d88733f1e4afef9d9

Download Submit
C:\Windows\System\etMqLhq.exe

Filesize
2.5MB

MD5
1712bf5ddbb75b7657909c235d7e5734

SHA1
1d500ed801da989553cb6563cb6f41abb5d99f56

SHA256
4ad7d2af62f763eff5f433d148e023664cba1d2ac35c86fa45457fea1e700476

SHA512
134d68cbdb495f5da86b39d3f2e8cc0f2800d7ba4c1e28f735cb302093cb2eadec19494972e5ed0280d56e3dc11af0dcfe41dcf680de7b56bf35827b16702813

Download Submit
C:\Windows\System\idvAZgw.exe

Filesize
2.5MB

MD5
345c8b56f9a3705fac7ae372a79a6a3d

SHA1
d7a09bdb587dc2a55f8b18df8ee3ce1c6b578043

SHA256
3a251f86be4200bb1349fcd0bd589670e0c4c5cc8a125e290ae61aa478260289

SHA512
74daff528c76605666ba47dc8d7716ea9f80e7d554b7f560f22cd3904713dd58802de01563860e52d79fbdf4dd556b65187918f72d4720ec6a9c9200f10e5c28

Download Submit
C:\Windows\System\knOkbRv.exe

Filesize
2.5MB

MD5
6b521feb4fbc7e60620ca87d856c51ef

SHA1
9caf16717734b8ac098417a90b9afa42264c03ca

SHA256
912fd5c032854cca0f1326c22cd3fd42ba625ba8623f6f8699b0d21d6cec2162

SHA512
fa4bea999c2d967b70321e9ac70cf1547d933555099086b44fbef9ee9e1326728adf8153e1be01efc08be472f828874573973ec03094828159c646b864a72b5d

Download Submit
C:\Windows\System\mQLVIgu.exe

Filesize
2.5MB

MD5
4b5ca96b97700d02dfbcd18e06283313

SHA1
493ee72cfc77cff191e08ccfa3dfbfd1fb57d06e

SHA256
a01a760edc1cd65f58ffc08d45271bdd0db201d77d0034e12e9fd2bca1ccaa79

SHA512
556af3172342505a3964e008e4c73985bf3a34ab8ce707066da4ded8a6ca0f2b95512a60506b9222a5a52358cfbe047b5b98a116e80c425673b052d20dea038e

Download Submit
C:\Windows\System\oBswwnY.exe

Filesize
2.5MB

MD5
bab6d914ca65e9f6a18986176a134657

SHA1
59f83d9c64d2dcf950fc9b905f417b838004151b

SHA256
fa590a30566bf0673b3ec37a9b594250746e3e34b3c765a61f65aedbc71f55a4

SHA512
5157a970c89b831da37c19f392524b22844cfe517de1874e9b8a5f6c89ccb04fa179d9a1463c4336e397a740e1c1187d40acb79e47ede9d6f478f6ee3778fff8

Download Submit
C:\Windows\System\puArOgG.exe

Filesize
2.5MB

MD5
f255db48292799e017f974aea1b20c25

SHA1
3bd74677cb310d7fb944bd118c0a4b982e0fb940

SHA256
199c71ebf3f333f945558cb1d606e48a892dc32f48a2ed14664ed5daa5f7bb77

SHA512
1336f2671f6cf1357e96d9267859a36ed35910e2faf7feaddba72feb1a3fb274c9df6daaae649f77f79f6906f38fde62e39c6d7c2c63137efdcc56616dd3b418

Download Submit
C:\Windows\System\rkbeAHZ.exe

Filesize
2.5MB

MD5
b0f29100f0ae149d818052ca944fe905

SHA1
684c9484702c2cd7c4aaeddb1d49b6d4150e1c8c

SHA256
47f1b7ec78f766c5421e876fcda90e84d18f2d0e73d33aa51457bb0d68ac6a58

SHA512
3ab573fb28831ff41cecc3aae18a2f343e94c0ceb9d7eaea83e738df2dca801695d78b496e55a187dfe6cf94a2204e5d920a70b6c6257f369deb920026c6a5ea

Download Submit
C:\Windows\System\trdZMJu.exe

Filesize
2.5MB

MD5
0172d750cac6b00b23f3afda0992f751

SHA1
de1c179c9cb43e7d37f0a446217d6be7a1fa010c

SHA256
8db2ddc1951988e1eaf9d47475c7e3cafd4bf3973f455b50b46dc0fe114300bb

SHA512
abfe7e837e2ad3d89e39966844d3bf44ed47aa3d2e42536094dc1b5cfb3fae3cf8b86696b2a854748a254dfa194ed34255ec3c862b4502650f7268f92cd11643

Download Submit
C:\Windows\System\vhiQeLu.exe

Filesize
2.5MB

MD5
26e74d6e6346583b4b0b5d88f88dee89

SHA1
2bc155962cc01e50752f64ab59256174dfc563d2

SHA256
af46b1d0c4bd60ad224477e5839d1ed1b465000694ca7a9f0f1473211467dc14

SHA512
c150ca07eb2106956f8d208bc36d06a5308e092222c3ea596256f6e8e9c0971bf69cb6c8f193d3b0c2fee312a0cbd7681828718129de5579b034252e2863b25b

Download Submit
C:\Windows\System\voqTEps.exe

Filesize
2.5MB

MD5
d314cad4da46f2e652a192eabe6a60d4

SHA1
e6393769f1debdb77d554720d5f91f63355a7ab0

SHA256
30a4ac9fa4aa31ce8516ef86d90cc0314386b84a2bde21923043ad98808172bf

SHA512
da40a0c56d4624dce37ed20d8e90281bfeddcf32f80feb653697be7c41c9acf6122322e22ad7f782d452492c0298a61ae80c827e06077d947b076a5311b73d67

Download Submit
C:\Windows\System\xKRjIJa.exe

Filesize
2.5MB

MD5
bb7f35e295a4899012eb81b1bb8243af

SHA1
5ecf049445e08d2cc0fa92e5303c52ead2195015

SHA256
f2a1d535e3ffbb9379f12a7cd1d43254671d54210907ed957ee82dab2f841501

SHA512
3cf1cfe5f77e32fda6f621e921a0b3eec7caa5ff7f5d1e1c42cbac7aa9cd6f8ec636c9d7b8397ccd513cfd19f3fe992cd3b51d88240e5658b774633d42c1748e

Download Submit
C:\Windows\System\zmkZCtv.exe

Filesize
2.5MB

MD5
c030f51fa3f1c309850f94168a393211

SHA1
ac6d2e1a41b33e6eb554a45c4f15c99ee1317ba6

SHA256
ee6ac704f3d99af0a9a8dcaa3d43d13aacf1fd2a5dbf23953b9d4d5d9eee983d

SHA512
01bff7455f4478476e3eca054d58188bc31cd4167f01949302d0b75038b7e54d928fc3f92fd7bb1471cefc5e809bc4f7f86e88340d8d57f5a945b839a57bcc90

Download Submit
C:\Windows\System\znykwxn.exe

Filesize
2.5MB

MD5
9e8b68fb87be3680e5ba865ec0d16bd3

SHA1
6815a088363f74c0d3615b29177658b3775e7668

SHA256
7b2272d3ca2906ded9dcabecf2a1d8651f06db6de5d224017c2350ab2ff9ffa7

SHA512
fc33711d4a38dea91f3b53dc8fced03fa2da2b0f2a2545d0b1ce50d65e2230e36659706881df5e54040faae5f3df30d9a6782e834d16d6a55e296a18c99c88a4

Download Submit
memory/264-787-0x00007FF6ED400000-0x00007FF6ED754000-memory.dmp

Filesize
3.3MB

Download
memory/264-2167-0x00007FF6ED400000-0x00007FF6ED754000-memory.dmp

Filesize
3.3MB

Download
memory/1108-801-0x00007FF634280000-0x00007FF6345D4000-memory.dmp

Filesize
3.3MB

Download
memory/1108-2142-0x00007FF634280000-0x00007FF6345D4000-memory.dmp

Filesize
3.3MB

Download
memory/1476-755-0x00007FF7BCF10000-0x00007FF7BD264000-memory.dmp

Filesize
3.3MB

Download
memory/1476-2152-0x00007FF7BCF10000-0x00007FF7BD264000-memory.dmp

Filesize
3.3MB

Download
memory/1512-22-0x00007FF67F0A0000-0x00007FF67F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/1512-2143-0x00007FF67F0A0000-0x00007FF67F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/1512-2139-0x00007FF67F0A0000-0x00007FF67F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/1600-740-0x00007FF6630B0000-0x00007FF663404000-memory.dmp

Filesize
3.3MB

Download
memory/1600-2153-0x00007FF6630B0000-0x00007FF663404000-memory.dmp

Filesize
3.3MB

Download
memory/1808-2149-0x00007FF653200000-0x00007FF653554000-memory.dmp

Filesize
3.3MB

Download
memory/1808-722-0x00007FF653200000-0x00007FF653554000-memory.dmp

Filesize
3.3MB

Download
memory/1852-776-0x00007FF6BC7E0000-0x00007FF6BCB34000-memory.dmp

Filesize
3.3MB

Download
memory/1852-2164-0x00007FF6BC7E0000-0x00007FF6BCB34000-memory.dmp

Filesize
3.3MB

Download
memory/1928-2162-0x00007FF6EC810000-0x00007FF6ECB64000-memory.dmp

Filesize
3.3MB

Download
memory/1928-725-0x00007FF6EC810000-0x00007FF6ECB64000-memory.dmp

Filesize
3.3MB

Download
memory/2104-2150-0x00007FF7ACBA0000-0x00007FF7ACEF4000-memory.dmp

Filesize
3.3MB

Download
memory/2104-764-0x00007FF7ACBA0000-0x00007FF7ACEF4000-memory.dmp

Filesize
3.3MB

Download
memory/2144-772-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp

Filesize
3.3MB

Download
memory/2144-2165-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp

Filesize
3.3MB

Download
memory/2472-724-0x00007FF744120000-0x00007FF744474000-memory.dmp

Filesize
3.3MB

Download
memory/2472-2163-0x00007FF744120000-0x00007FF744474000-memory.dmp

Filesize
3.3MB

Download
memory/2608-2146-0x00007FF776410000-0x00007FF776764000-memory.dmp

Filesize
3.3MB

Download
memory/2608-719-0x00007FF776410000-0x00007FF776764000-memory.dmp

Filesize
3.3MB

Download
memory/2696-791-0x00007FF77A570000-0x00007FF77A8C4000-memory.dmp

Filesize
3.3MB

Download
memory/2696-2168-0x00007FF77A570000-0x00007FF77A8C4000-memory.dmp

Filesize
3.3MB

Download
memory/2748-2160-0x00007FF70AEF0000-0x00007FF70B244000-memory.dmp

Filesize
3.3MB

Download
memory/2748-727-0x00007FF70AEF0000-0x00007FF70B244000-memory.dmp

Filesize
3.3MB

Download
memory/2776-2161-0x00007FF697CA0000-0x00007FF697FF4000-memory.dmp

Filesize
3.3MB

Download
memory/2776-726-0x00007FF697CA0000-0x00007FF697FF4000-memory.dmp

Filesize
3.3MB

Download
memory/2952-759-0x00007FF735FA0000-0x00007FF7362F4000-memory.dmp

Filesize
3.3MB

Download
memory/2952-2151-0x00007FF735FA0000-0x00007FF7362F4000-memory.dmp

Filesize
3.3MB

Download
memory/2956-2156-0x00007FF7289D0000-0x00007FF728D24000-memory.dmp

Filesize
3.3MB

Download
memory/2956-721-0x00007FF7289D0000-0x00007FF728D24000-memory.dmp

Filesize
3.3MB

Download
memory/3128-728-0x00007FF67A980000-0x00007FF67ACD4000-memory.dmp

Filesize
3.3MB

Download
memory/3128-2159-0x00007FF67A980000-0x00007FF67ACD4000-memory.dmp

Filesize
3.3MB

Download
memory/3272-717-0x00007FF63A2A0000-0x00007FF63A5F4000-memory.dmp

Filesize
3.3MB

Download
memory/3272-2140-0x00007FF63A2A0000-0x00007FF63A5F4000-memory.dmp

Filesize
3.3MB

Download
memory/3272-2147-0x00007FF63A2A0000-0x00007FF63A5F4000-memory.dmp

Filesize
3.3MB

Download
memory/3664-723-0x00007FF6557B0000-0x00007FF655B04000-memory.dmp

Filesize
3.3MB

Download
memory/3664-2155-0x00007FF6557B0000-0x00007FF655B04000-memory.dmp

Filesize
3.3MB

Download
memory/3952-2166-0x00007FF69C440000-0x00007FF69C794000-memory.dmp

Filesize
3.3MB

Download
memory/3952-783-0x00007FF69C440000-0x00007FF69C794000-memory.dmp

Filesize
3.3MB

Download
memory/4164-2144-0x00007FF79B770000-0x00007FF79BAC4000-memory.dmp

Filesize
3.3MB

Download
memory/4164-718-0x00007FF79B770000-0x00007FF79BAC4000-memory.dmp

Filesize
3.3MB

Download
memory/4224-2141-0x00007FF6A13F0000-0x00007FF6A1744000-memory.dmp

Filesize
3.3MB

Download
memory/4224-10-0x00007FF6A13F0000-0x00007FF6A1744000-memory.dmp

Filesize
3.3MB

Download
memory/4644-735-0x00007FF6755E0000-0x00007FF675934000-memory.dmp

Filesize
3.3MB

Download
memory/4644-2157-0x00007FF6755E0000-0x00007FF675934000-memory.dmp

Filesize
3.3MB

Download
memory/4676-2138-0x00007FF65CE30000-0x00007FF65D184000-memory.dmp

Filesize
3.3MB

Download
memory/4676-0-0x00007FF65CE30000-0x00007FF65D184000-memory.dmp

Filesize
3.3MB

Download
memory/4676-1-0x0000021476180000-0x0000021476190000-memory.dmp

Filesize
64KB

Download
memory/4820-2148-0x00007FF65D300000-0x00007FF65D654000-memory.dmp

Filesize
3.3MB

Download
memory/4820-720-0x00007FF65D300000-0x00007FF65D654000-memory.dmp

Filesize
3.3MB

Download
memory/4960-747-0x00007FF772540000-0x00007FF772894000-memory.dmp

Filesize
3.3MB

Download
memory/4960-2154-0x00007FF772540000-0x00007FF772894000-memory.dmp

Filesize
3.3MB

Download
memory/4992-795-0x00007FF63D540000-0x00007FF63D894000-memory.dmp

Filesize
3.3MB

Download
memory/4992-2169-0x00007FF63D540000-0x00007FF63D894000-memory.dmp

Filesize
3.3MB

Download
memory/5076-810-0x00007FF73B390000-0x00007FF73B6E4000-memory.dmp

Filesize
3.3MB

Download
memory/5076-2145-0x00007FF73B390000-0x00007FF73B6E4000-memory.dmp

Filesize
3.3MB

Download
memory/5112-2158-0x00007FF6C2600000-0x00007FF6C2954000-memory.dmp

Filesize
3.3MB

Download
memory/5112-729-0x00007FF6C2600000-0x00007FF6C2954000-memory.dmp

Filesize
3.3MB

Download