xmrig | 7cf6dfd7a40fa1ea2c81c55eb4b9f330646ff8c046d6a42e2e901af6e7965d0a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
Size

2.3MB
MD5

2bf572d4012dc60aa1ebd3458f90c900
SHA1

04f12110598f449e6f36e69fb55f97c0f65543ed
SHA256

7cf6dfd7a40fa1ea2c81c55eb4b9f330646ff8c046d6a42e2e901af6e7965d0a
SHA512

6ebe09043829d74568cd764151541a42b432e7a695bdfea268c19f54e5d22183a97aff76f0d01a9a30071f5f090361819d998e0a0e774e1f01ccfa1203d11a4c
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQUUvXjVTZLVOaOxdy+EV:oemTLkNdfE0pZrQT

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4252-0-0x00007FF648260000-0x00007FF6485B4000-memory.dmp	xmrig
behavioral2/files/0x000900000002341d-4.dat	xmrig
behavioral2/files/0x000700000002342c-11.dat	xmrig
behavioral2/files/0x000700000002342f-24.dat	xmrig
behavioral2/memory/876-37-0x00007FF656C60000-0x00007FF656FB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023435-63.dat	xmrig
behavioral2/files/0x000700000002343a-87.dat	xmrig
behavioral2/files/0x000700000002343d-99.dat	xmrig
behavioral2/files/0x0007000000023441-123.dat	xmrig
behavioral2/memory/4080-746-0x00007FF6DCF00000-0x00007FF6DD254000-memory.dmp	xmrig
behavioral2/memory/3508-747-0x00007FF7229D0000-0x00007FF722D24000-memory.dmp	xmrig
behavioral2/files/0x000700000002344b-167.dat	xmrig
behavioral2/files/0x0007000000023449-163.dat	xmrig
behavioral2/files/0x000700000002344a-162.dat	xmrig
behavioral2/files/0x0007000000023448-157.dat	xmrig
behavioral2/files/0x0007000000023447-153.dat	xmrig
behavioral2/files/0x0007000000023446-148.dat	xmrig
behavioral2/files/0x0007000000023445-143.dat	xmrig
behavioral2/files/0x0007000000023444-137.dat	xmrig
behavioral2/files/0x0007000000023443-133.dat	xmrig
behavioral2/files/0x0007000000023442-128.dat	xmrig
behavioral2/files/0x0007000000023440-118.dat	xmrig
behavioral2/files/0x000700000002343f-112.dat	xmrig
behavioral2/files/0x000700000002343e-108.dat	xmrig
behavioral2/files/0x000700000002343c-97.dat	xmrig
behavioral2/files/0x000700000002343b-93.dat	xmrig
behavioral2/files/0x0007000000023439-83.dat	xmrig
behavioral2/files/0x0007000000023438-77.dat	xmrig
behavioral2/files/0x0007000000023437-73.dat	xmrig
behavioral2/files/0x0007000000023436-67.dat	xmrig
behavioral2/memory/5000-748-0x00007FF6ADB40000-0x00007FF6ADE94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-58.dat	xmrig
behavioral2/files/0x0007000000023433-53.dat	xmrig
behavioral2/files/0x0007000000023432-47.dat	xmrig
behavioral2/files/0x0007000000023431-43.dat	xmrig
behavioral2/files/0x0007000000023430-36.dat	xmrig
behavioral2/files/0x000700000002342e-30.dat	xmrig
behavioral2/files/0x000700000002342d-25.dat	xmrig
behavioral2/memory/2984-23-0x00007FF7093D0000-0x00007FF709724000-memory.dmp	xmrig
behavioral2/memory/4880-749-0x00007FF6C1BF0000-0x00007FF6C1F44000-memory.dmp	xmrig
behavioral2/memory/848-751-0x00007FF776F70000-0x00007FF7772C4000-memory.dmp	xmrig
behavioral2/memory/4896-750-0x00007FF7ABD10000-0x00007FF7AC064000-memory.dmp	xmrig
behavioral2/memory/1064-16-0x00007FF7AC090000-0x00007FF7AC3E4000-memory.dmp	xmrig
behavioral2/memory/932-13-0x00007FF7B6790000-0x00007FF7B6AE4000-memory.dmp	xmrig
behavioral2/memory/3116-755-0x00007FF6D9D40000-0x00007FF6DA094000-memory.dmp	xmrig
behavioral2/memory/1548-762-0x00007FF664EA0000-0x00007FF6651F4000-memory.dmp	xmrig
behavioral2/memory/3572-763-0x00007FF694BA0000-0x00007FF694EF4000-memory.dmp	xmrig
behavioral2/memory/1144-768-0x00007FF749390000-0x00007FF7496E4000-memory.dmp	xmrig
behavioral2/memory/3128-774-0x00007FF74D2E0000-0x00007FF74D634000-memory.dmp	xmrig
behavioral2/memory/4812-779-0x00007FF76B690000-0x00007FF76B9E4000-memory.dmp	xmrig
behavioral2/memory/2244-784-0x00007FF674190000-0x00007FF6744E4000-memory.dmp	xmrig
behavioral2/memory/2900-798-0x00007FF665520000-0x00007FF665874000-memory.dmp	xmrig
behavioral2/memory/1856-795-0x00007FF6AF1C0000-0x00007FF6AF514000-memory.dmp	xmrig
behavioral2/memory/3908-789-0x00007FF7A2510000-0x00007FF7A2864000-memory.dmp	xmrig
behavioral2/memory/2456-810-0x00007FF6B6B60000-0x00007FF6B6EB4000-memory.dmp	xmrig
behavioral2/memory/4540-819-0x00007FF7A45E0000-0x00007FF7A4934000-memory.dmp	xmrig
behavioral2/memory/656-831-0x00007FF7B1B80000-0x00007FF7B1ED4000-memory.dmp	xmrig
behavioral2/memory/2752-828-0x00007FF755D80000-0x00007FF7560D4000-memory.dmp	xmrig
behavioral2/memory/4148-835-0x00007FF651470000-0x00007FF6517C4000-memory.dmp	xmrig
behavioral2/memory/3752-833-0x00007FF68DD50000-0x00007FF68E0A4000-memory.dmp	xmrig
behavioral2/memory/532-816-0x00007FF764320000-0x00007FF764674000-memory.dmp	xmrig
behavioral2/memory/5024-813-0x00007FF757850000-0x00007FF757BA4000-memory.dmp	xmrig
behavioral2/memory/3004-778-0x00007FF767C90000-0x00007FF767FE4000-memory.dmp	xmrig
behavioral2/memory/876-2058-0x00007FF656C60000-0x00007FF656FB4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
932	nwOGbpp.exe
1064	OxAcAqZ.exe
2984	pNOzPBo.exe
876	IgLXeWW.exe
4148	sdzMJAg.exe
4080	mAvWTtq.exe
3508	DVvgsKu.exe
5000	cRnveXS.exe
4880	LlUwzxj.exe
4896	APKnRko.exe
848	jgasvdr.exe
3116	ljWAgvQ.exe
1548	IIutowX.exe
3572	iJaWYdp.exe
1144	MsIQBts.exe
3128	mtTwHfb.exe
3004	acqHrFC.exe
4812	gUKckBi.exe
2244	hxCjxfF.exe
3908	VYsGVZQ.exe
1856	RnaeeUO.exe
2900	dStBtmi.exe
2456	HQwSAKk.exe
5024	bpeMdUM.exe
532	qCBXzzC.exe
4540	fgaYnTR.exe
2752	vNpWIgL.exe
656	OBqfUHH.exe
3752	zjWQoxu.exe
880	LSsrxxE.exe
976	HmvbWXe.exe
1420	piUenAo.exe
1784	ZtWgvzI.exe
3000	wINJuib.exe
3060	dFrElWR.exe
4716	UsgIVEF.exe
4144	HLfRuNB.exe
4864	FStNrLq.exe
2996	LhRfoaw.exe
2348	PHtosRt.exe
4232	VUoEIas.exe
3580	EhBBwDJ.exe
1044	dUMwaWl.exe
2516	cFhWtlT.exe
4448	RNYvHXZ.exe
1576	FEEzbit.exe
4480	xEXbSlL.exe
1208	zlyZcRF.exe
2852	EREPfBd.exe
2160	XmztKzq.exe
4084	bItFUTd.exe
2084	WAIiKvw.exe
3296	rzUuRLe.exe
2736	YIgbanr.exe
4296	tMtoMgd.exe
4664	DeQwYbi.exe
4720	QzrYttw.exe
988	kHKAUyZ.exe
4396	KiDkpBs.exe
2680	elHGdCr.exe
3724	tnPiEOC.exe
4348	VBDjONz.exe
4100	YFXOjmp.exe
3684	wHdmaoW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4252-0-0x00007FF648260000-0x00007FF6485B4000-memory.dmp	upx
behavioral2/files/0x000900000002341d-4.dat	upx
behavioral2/files/0x000700000002342c-11.dat	upx
behavioral2/files/0x000700000002342f-24.dat	upx
behavioral2/memory/876-37-0x00007FF656C60000-0x00007FF656FB4000-memory.dmp	upx
behavioral2/files/0x0007000000023435-63.dat	upx
behavioral2/files/0x000700000002343a-87.dat	upx
behavioral2/files/0x000700000002343d-99.dat	upx
behavioral2/files/0x0007000000023441-123.dat	upx
behavioral2/memory/4080-746-0x00007FF6DCF00000-0x00007FF6DD254000-memory.dmp	upx
behavioral2/memory/3508-747-0x00007FF7229D0000-0x00007FF722D24000-memory.dmp	upx
behavioral2/files/0x000700000002344b-167.dat	upx
behavioral2/files/0x0007000000023449-163.dat	upx
behavioral2/files/0x000700000002344a-162.dat	upx
behavioral2/files/0x0007000000023448-157.dat	upx
behavioral2/files/0x0007000000023447-153.dat	upx
behavioral2/files/0x0007000000023446-148.dat	upx
behavioral2/files/0x0007000000023445-143.dat	upx
behavioral2/files/0x0007000000023444-137.dat	upx
behavioral2/files/0x0007000000023443-133.dat	upx
behavioral2/files/0x0007000000023442-128.dat	upx
behavioral2/files/0x0007000000023440-118.dat	upx
behavioral2/files/0x000700000002343f-112.dat	upx
behavioral2/files/0x000700000002343e-108.dat	upx
behavioral2/files/0x000700000002343c-97.dat	upx
behavioral2/files/0x000700000002343b-93.dat	upx
behavioral2/files/0x0007000000023439-83.dat	upx
behavioral2/files/0x0007000000023438-77.dat	upx
behavioral2/files/0x0007000000023437-73.dat	upx
behavioral2/files/0x0007000000023436-67.dat	upx
behavioral2/memory/5000-748-0x00007FF6ADB40000-0x00007FF6ADE94000-memory.dmp	upx
behavioral2/files/0x0007000000023434-58.dat	upx
behavioral2/files/0x0007000000023433-53.dat	upx
behavioral2/files/0x0007000000023432-47.dat	upx
behavioral2/files/0x0007000000023431-43.dat	upx
behavioral2/files/0x0007000000023430-36.dat	upx
behavioral2/files/0x000700000002342e-30.dat	upx
behavioral2/files/0x000700000002342d-25.dat	upx
behavioral2/memory/2984-23-0x00007FF7093D0000-0x00007FF709724000-memory.dmp	upx
behavioral2/memory/4880-749-0x00007FF6C1BF0000-0x00007FF6C1F44000-memory.dmp	upx
behavioral2/memory/848-751-0x00007FF776F70000-0x00007FF7772C4000-memory.dmp	upx
behavioral2/memory/4896-750-0x00007FF7ABD10000-0x00007FF7AC064000-memory.dmp	upx
behavioral2/memory/1064-16-0x00007FF7AC090000-0x00007FF7AC3E4000-memory.dmp	upx
behavioral2/memory/932-13-0x00007FF7B6790000-0x00007FF7B6AE4000-memory.dmp	upx
behavioral2/memory/3116-755-0x00007FF6D9D40000-0x00007FF6DA094000-memory.dmp	upx
behavioral2/memory/1548-762-0x00007FF664EA0000-0x00007FF6651F4000-memory.dmp	upx
behavioral2/memory/3572-763-0x00007FF694BA0000-0x00007FF694EF4000-memory.dmp	upx
behavioral2/memory/1144-768-0x00007FF749390000-0x00007FF7496E4000-memory.dmp	upx
behavioral2/memory/3128-774-0x00007FF74D2E0000-0x00007FF74D634000-memory.dmp	upx
behavioral2/memory/4812-779-0x00007FF76B690000-0x00007FF76B9E4000-memory.dmp	upx
behavioral2/memory/2244-784-0x00007FF674190000-0x00007FF6744E4000-memory.dmp	upx
behavioral2/memory/2900-798-0x00007FF665520000-0x00007FF665874000-memory.dmp	upx
behavioral2/memory/1856-795-0x00007FF6AF1C0000-0x00007FF6AF514000-memory.dmp	upx
behavioral2/memory/3908-789-0x00007FF7A2510000-0x00007FF7A2864000-memory.dmp	upx
behavioral2/memory/2456-810-0x00007FF6B6B60000-0x00007FF6B6EB4000-memory.dmp	upx
behavioral2/memory/4540-819-0x00007FF7A45E0000-0x00007FF7A4934000-memory.dmp	upx
behavioral2/memory/656-831-0x00007FF7B1B80000-0x00007FF7B1ED4000-memory.dmp	upx
behavioral2/memory/2752-828-0x00007FF755D80000-0x00007FF7560D4000-memory.dmp	upx
behavioral2/memory/4148-835-0x00007FF651470000-0x00007FF6517C4000-memory.dmp	upx
behavioral2/memory/3752-833-0x00007FF68DD50000-0x00007FF68E0A4000-memory.dmp	upx
behavioral2/memory/532-816-0x00007FF764320000-0x00007FF764674000-memory.dmp	upx
behavioral2/memory/5024-813-0x00007FF757850000-0x00007FF757BA4000-memory.dmp	upx
behavioral2/memory/3004-778-0x00007FF767C90000-0x00007FF767FE4000-memory.dmp	upx
behavioral2/memory/876-2058-0x00007FF656C60000-0x00007FF656FB4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gjDkEOA.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\TTFLYHn.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\GarhAml.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\eCwgajJ.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\OAUDtjp.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\EpNAyzc.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\pTlfMSA.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\YcfoHcz.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\xVVHKcS.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\VCZrkVF.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\lkntXuT.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\mJrCZXm.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\HYSeLQZ.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\WiDliwX.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\OXJWWst.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\FGsghVG.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\DGXeiAM.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\nwOGbpp.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\LxyHIPk.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\mpiLgBI.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\PjZPDmL.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\IXyJymR.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\BFjPyiB.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\ZbkBOyH.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\OBqfUHH.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\IpTaLxH.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\jQHLdAh.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\XzDFvZM.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\nmyiZZy.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\UjspLYg.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\TNjdmTx.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\SpXIbNv.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\KiDkpBs.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\cfcEnGB.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\bIlTZeJ.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\QJWaxcu.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\MOTONqd.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\QcKrVjj.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\CJnxFNb.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\xiVVHYb.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\JRqxOFD.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\mXtkkdE.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\cHsranN.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\Sigxxzy.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\IgLXeWW.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\WAalJaP.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\eIpxcxX.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\hmMSvpf.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\MSfwoEU.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\NprxooC.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\SWlDpbK.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\OrZxqKV.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\zgZXQUh.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\ILRduVX.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\oysJkwT.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\sCnCWUF.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\ZKeeSlj.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\FxNHNNT.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\OLRArax.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\HmvbWXe.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\elHGdCr.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\bsDlKoH.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\YBBTzvs.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
File created	C:\Windows\System\fgAlUhJ.exe	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 932	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	84
PID 4252 wrote to memory of 932	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	84
PID 4252 wrote to memory of 1064	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	85
PID 4252 wrote to memory of 1064	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	85
PID 4252 wrote to memory of 2984	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	86
PID 4252 wrote to memory of 2984	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	86
PID 4252 wrote to memory of 876	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	87
PID 4252 wrote to memory of 876	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	87
PID 4252 wrote to memory of 4148	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	88
PID 4252 wrote to memory of 4148	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	88
PID 4252 wrote to memory of 4080	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	89
PID 4252 wrote to memory of 4080	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	89
PID 4252 wrote to memory of 3508	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	90
PID 4252 wrote to memory of 3508	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	90
PID 4252 wrote to memory of 5000	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	91
PID 4252 wrote to memory of 5000	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	91
PID 4252 wrote to memory of 4880	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	92
PID 4252 wrote to memory of 4880	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	92
PID 4252 wrote to memory of 4896	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	93
PID 4252 wrote to memory of 4896	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	93
PID 4252 wrote to memory of 848	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	94
PID 4252 wrote to memory of 848	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	94
PID 4252 wrote to memory of 3116	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	95
PID 4252 wrote to memory of 3116	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	95
PID 4252 wrote to memory of 1548	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	96
PID 4252 wrote to memory of 1548	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	96
PID 4252 wrote to memory of 3572	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	97
PID 4252 wrote to memory of 3572	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	97
PID 4252 wrote to memory of 1144	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	98
PID 4252 wrote to memory of 1144	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	98
PID 4252 wrote to memory of 3128	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	99
PID 4252 wrote to memory of 3128	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	99
PID 4252 wrote to memory of 3004	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	100
PID 4252 wrote to memory of 3004	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	100
PID 4252 wrote to memory of 4812	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	101
PID 4252 wrote to memory of 4812	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	101
PID 4252 wrote to memory of 2244	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	102
PID 4252 wrote to memory of 2244	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	102
PID 4252 wrote to memory of 3908	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	103
PID 4252 wrote to memory of 3908	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	103
PID 4252 wrote to memory of 1856	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	104
PID 4252 wrote to memory of 1856	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	104
PID 4252 wrote to memory of 2900	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	105
PID 4252 wrote to memory of 2900	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	105
PID 4252 wrote to memory of 2456	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	106
PID 4252 wrote to memory of 2456	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	106
PID 4252 wrote to memory of 5024	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	107
PID 4252 wrote to memory of 5024	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	107
PID 4252 wrote to memory of 532	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	108
PID 4252 wrote to memory of 532	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	108
PID 4252 wrote to memory of 4540	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	109
PID 4252 wrote to memory of 4540	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	109
PID 4252 wrote to memory of 2752	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	110
PID 4252 wrote to memory of 2752	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	110
PID 4252 wrote to memory of 656	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	111
PID 4252 wrote to memory of 656	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	111
PID 4252 wrote to memory of 3752	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	112
PID 4252 wrote to memory of 3752	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	112
PID 4252 wrote to memory of 880	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	113
PID 4252 wrote to memory of 880	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	113
PID 4252 wrote to memory of 976	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	114
PID 4252 wrote to memory of 976	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	114
PID 4252 wrote to memory of 1420	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	115
PID 4252 wrote to memory of 1420	4252	2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2bf572d4012dc60aa1ebd3458f90c900_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\System\nwOGbpp.exe
  C:\Windows\System\nwOGbpp.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\OxAcAqZ.exe
  C:\Windows\System\OxAcAqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\pNOzPBo.exe
  C:\Windows\System\pNOzPBo.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\IgLXeWW.exe
  C:\Windows\System\IgLXeWW.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\sdzMJAg.exe
  C:\Windows\System\sdzMJAg.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\mAvWTtq.exe
  C:\Windows\System\mAvWTtq.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\DVvgsKu.exe
  C:\Windows\System\DVvgsKu.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\cRnveXS.exe
  C:\Windows\System\cRnveXS.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\LlUwzxj.exe
  C:\Windows\System\LlUwzxj.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\APKnRko.exe
  C:\Windows\System\APKnRko.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\jgasvdr.exe
  C:\Windows\System\jgasvdr.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\ljWAgvQ.exe
  C:\Windows\System\ljWAgvQ.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\IIutowX.exe
  C:\Windows\System\IIutowX.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\iJaWYdp.exe
  C:\Windows\System\iJaWYdp.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\MsIQBts.exe
  C:\Windows\System\MsIQBts.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\mtTwHfb.exe
  C:\Windows\System\mtTwHfb.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\acqHrFC.exe
  C:\Windows\System\acqHrFC.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\gUKckBi.exe
  C:\Windows\System\gUKckBi.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\hxCjxfF.exe
  C:\Windows\System\hxCjxfF.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\VYsGVZQ.exe
  C:\Windows\System\VYsGVZQ.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\RnaeeUO.exe
  C:\Windows\System\RnaeeUO.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\dStBtmi.exe
  C:\Windows\System\dStBtmi.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\HQwSAKk.exe
  C:\Windows\System\HQwSAKk.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\bpeMdUM.exe
  C:\Windows\System\bpeMdUM.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\qCBXzzC.exe
  C:\Windows\System\qCBXzzC.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\fgaYnTR.exe
  C:\Windows\System\fgaYnTR.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\vNpWIgL.exe
  C:\Windows\System\vNpWIgL.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\OBqfUHH.exe
  C:\Windows\System\OBqfUHH.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\zjWQoxu.exe
  C:\Windows\System\zjWQoxu.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\LSsrxxE.exe
  C:\Windows\System\LSsrxxE.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\HmvbWXe.exe
  C:\Windows\System\HmvbWXe.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\piUenAo.exe
  C:\Windows\System\piUenAo.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\ZtWgvzI.exe
  C:\Windows\System\ZtWgvzI.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\wINJuib.exe
  C:\Windows\System\wINJuib.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\dFrElWR.exe
  C:\Windows\System\dFrElWR.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\UsgIVEF.exe
  C:\Windows\System\UsgIVEF.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\HLfRuNB.exe
  C:\Windows\System\HLfRuNB.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\FStNrLq.exe
  C:\Windows\System\FStNrLq.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\LhRfoaw.exe
  C:\Windows\System\LhRfoaw.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\PHtosRt.exe
  C:\Windows\System\PHtosRt.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\VUoEIas.exe
  C:\Windows\System\VUoEIas.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\EhBBwDJ.exe
  C:\Windows\System\EhBBwDJ.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\dUMwaWl.exe
  C:\Windows\System\dUMwaWl.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\cFhWtlT.exe
  C:\Windows\System\cFhWtlT.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\RNYvHXZ.exe
  C:\Windows\System\RNYvHXZ.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\FEEzbit.exe
  C:\Windows\System\FEEzbit.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\xEXbSlL.exe
  C:\Windows\System\xEXbSlL.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\zlyZcRF.exe
  C:\Windows\System\zlyZcRF.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\EREPfBd.exe
  C:\Windows\System\EREPfBd.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\XmztKzq.exe
  C:\Windows\System\XmztKzq.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\bItFUTd.exe
  C:\Windows\System\bItFUTd.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\WAIiKvw.exe
  C:\Windows\System\WAIiKvw.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\rzUuRLe.exe
  C:\Windows\System\rzUuRLe.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\YIgbanr.exe
  C:\Windows\System\YIgbanr.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\tMtoMgd.exe
  C:\Windows\System\tMtoMgd.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\DeQwYbi.exe
  C:\Windows\System\DeQwYbi.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\QzrYttw.exe
  C:\Windows\System\QzrYttw.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\kHKAUyZ.exe
  C:\Windows\System\kHKAUyZ.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\KiDkpBs.exe
  C:\Windows\System\KiDkpBs.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\elHGdCr.exe
  C:\Windows\System\elHGdCr.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\tnPiEOC.exe
  C:\Windows\System\tnPiEOC.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\VBDjONz.exe
  C:\Windows\System\VBDjONz.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\YFXOjmp.exe
  C:\Windows\System\YFXOjmp.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\wHdmaoW.exe
  C:\Windows\System\wHdmaoW.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\VeusdOA.exe
  C:\Windows\System\VeusdOA.exe
  2⤵
  PID:3092
- C:\Windows\System\ESTPiHu.exe
  C:\Windows\System\ESTPiHu.exe
  2⤵
  PID:2768
- C:\Windows\System\wjFNBpU.exe
  C:\Windows\System\wjFNBpU.exe
  2⤵
  PID:5036
- C:\Windows\System\qLGryUx.exe
  C:\Windows\System\qLGryUx.exe
  2⤵
  PID:4524
- C:\Windows\System\MekMUVy.exe
  C:\Windows\System\MekMUVy.exe
  2⤵
  PID:4140
- C:\Windows\System\FzDeVAs.exe
  C:\Windows\System\FzDeVAs.exe
  2⤵
  PID:4428
- C:\Windows\System\SDynCnz.exe
  C:\Windows\System\SDynCnz.exe
  2⤵
  PID:3064
- C:\Windows\System\yqGiqJE.exe
  C:\Windows\System\yqGiqJE.exe
  2⤵
  PID:1164
- C:\Windows\System\RbJrwKw.exe
  C:\Windows\System\RbJrwKw.exe
  2⤵
  PID:1464
- C:\Windows\System\qvDMTYh.exe
  C:\Windows\System\qvDMTYh.exe
  2⤵
  PID:2944
- C:\Windows\System\EpNAyzc.exe
  C:\Windows\System\EpNAyzc.exe
  2⤵
  PID:4912
- C:\Windows\System\MenBKUu.exe
  C:\Windows\System\MenBKUu.exe
  2⤵
  PID:1536
- C:\Windows\System\YcaVVqV.exe
  C:\Windows\System\YcaVVqV.exe
  2⤵
  PID:4580
- C:\Windows\System\UIsPgGE.exe
  C:\Windows\System\UIsPgGE.exe
  2⤵
  PID:5148
- C:\Windows\System\NNUnCSp.exe
  C:\Windows\System\NNUnCSp.exe
  2⤵
  PID:5176
- C:\Windows\System\IfvLIdJ.exe
  C:\Windows\System\IfvLIdJ.exe
  2⤵
  PID:5204
- C:\Windows\System\CHEgTOL.exe
  C:\Windows\System\CHEgTOL.exe
  2⤵
  PID:5232
- C:\Windows\System\WIjUdwy.exe
  C:\Windows\System\WIjUdwy.exe
  2⤵
  PID:5260
- C:\Windows\System\JoSQEyJ.exe
  C:\Windows\System\JoSQEyJ.exe
  2⤵
  PID:5288
- C:\Windows\System\qiHfzoD.exe
  C:\Windows\System\qiHfzoD.exe
  2⤵
  PID:5316
- C:\Windows\System\TzlCYjF.exe
  C:\Windows\System\TzlCYjF.exe
  2⤵
  PID:5344
- C:\Windows\System\qKekicS.exe
  C:\Windows\System\qKekicS.exe
  2⤵
  PID:5372
- C:\Windows\System\aglGjih.exe
  C:\Windows\System\aglGjih.exe
  2⤵
  PID:5400
- C:\Windows\System\spDYdQZ.exe
  C:\Windows\System\spDYdQZ.exe
  2⤵
  PID:5428
- C:\Windows\System\zOEeksm.exe
  C:\Windows\System\zOEeksm.exe
  2⤵
  PID:5456
- C:\Windows\System\SwuIqeO.exe
  C:\Windows\System\SwuIqeO.exe
  2⤵
  PID:5484
- C:\Windows\System\MSfwoEU.exe
  C:\Windows\System\MSfwoEU.exe
  2⤵
  PID:5512
- C:\Windows\System\olGsKIF.exe
  C:\Windows\System\olGsKIF.exe
  2⤵
  PID:5540
- C:\Windows\System\iiAXwuv.exe
  C:\Windows\System\iiAXwuv.exe
  2⤵
  PID:5572
- C:\Windows\System\Qrpodau.exe
  C:\Windows\System\Qrpodau.exe
  2⤵
  PID:5608
- C:\Windows\System\fTlSOot.exe
  C:\Windows\System\fTlSOot.exe
  2⤵
  PID:5636
- C:\Windows\System\ROJVWrE.exe
  C:\Windows\System\ROJVWrE.exe
  2⤵
  PID:5652
- C:\Windows\System\KLwCgkF.exe
  C:\Windows\System\KLwCgkF.exe
  2⤵
  PID:5680
- C:\Windows\System\maWptRn.exe
  C:\Windows\System\maWptRn.exe
  2⤵
  PID:5708
- C:\Windows\System\lTdjfUQ.exe
  C:\Windows\System\lTdjfUQ.exe
  2⤵
  PID:5736
- C:\Windows\System\dfFkVLT.exe
  C:\Windows\System\dfFkVLT.exe
  2⤵
  PID:5764
- C:\Windows\System\pTlfMSA.exe
  C:\Windows\System\pTlfMSA.exe
  2⤵
  PID:5792
- C:\Windows\System\WAalJaP.exe
  C:\Windows\System\WAalJaP.exe
  2⤵
  PID:5820
- C:\Windows\System\vFzptte.exe
  C:\Windows\System\vFzptte.exe
  2⤵
  PID:5848
- C:\Windows\System\RxGoBkf.exe
  C:\Windows\System\RxGoBkf.exe
  2⤵
  PID:5876
- C:\Windows\System\AXDtvZC.exe
  C:\Windows\System\AXDtvZC.exe
  2⤵
  PID:5904
- C:\Windows\System\wsOdSzz.exe
  C:\Windows\System\wsOdSzz.exe
  2⤵
  PID:5932
- C:\Windows\System\oIPvEAc.exe
  C:\Windows\System\oIPvEAc.exe
  2⤵
  PID:5960
- C:\Windows\System\oGBmFUW.exe
  C:\Windows\System\oGBmFUW.exe
  2⤵
  PID:5988
- C:\Windows\System\ZxGIpbH.exe
  C:\Windows\System\ZxGIpbH.exe
  2⤵
  PID:6016
- C:\Windows\System\IoCpNZh.exe
  C:\Windows\System\IoCpNZh.exe
  2⤵
  PID:6044
- C:\Windows\System\hkoDKMO.exe
  C:\Windows\System\hkoDKMO.exe
  2⤵
  PID:6072
- C:\Windows\System\jJXXDXt.exe
  C:\Windows\System\jJXXDXt.exe
  2⤵
  PID:6100
- C:\Windows\System\cfcEnGB.exe
  C:\Windows\System\cfcEnGB.exe
  2⤵
  PID:6128
- C:\Windows\System\YPLiYsd.exe
  C:\Windows\System\YPLiYsd.exe
  2⤵
  PID:1796
- C:\Windows\System\rQffkwd.exe
  C:\Windows\System\rQffkwd.exe
  2⤵
  PID:4564
- C:\Windows\System\ONhofyS.exe
  C:\Windows\System\ONhofyS.exe
  2⤵
  PID:4660
- C:\Windows\System\WCfVeFT.exe
  C:\Windows\System\WCfVeFT.exe
  2⤵
  PID:4064
- C:\Windows\System\wfHqGlh.exe
  C:\Windows\System\wfHqGlh.exe
  2⤵
  PID:2868
- C:\Windows\System\BmeWMEm.exe
  C:\Windows\System\BmeWMEm.exe
  2⤵
  PID:5164
- C:\Windows\System\MurZxtm.exe
  C:\Windows\System\MurZxtm.exe
  2⤵
  PID:1092
- C:\Windows\System\jQZNUkM.exe
  C:\Windows\System\jQZNUkM.exe
  2⤵
  PID:5280
- C:\Windows\System\oPCnldH.exe
  C:\Windows\System\oPCnldH.exe
  2⤵
  PID:5356
- C:\Windows\System\tWZxTxu.exe
  C:\Windows\System\tWZxTxu.exe
  2⤵
  PID:5416
- C:\Windows\System\VjqBlBa.exe
  C:\Windows\System\VjqBlBa.exe
  2⤵
  PID:5472
- C:\Windows\System\oysJkwT.exe
  C:\Windows\System\oysJkwT.exe
  2⤵
  PID:5532
- C:\Windows\System\fLHldtx.exe
  C:\Windows\System\fLHldtx.exe
  2⤵
  PID:5600
- C:\Windows\System\DiXsDcn.exe
  C:\Windows\System\DiXsDcn.exe
  2⤵
  PID:5648
- C:\Windows\System\aSadneX.exe
  C:\Windows\System\aSadneX.exe
  2⤵
  PID:5720
- C:\Windows\System\FbmaJtw.exe
  C:\Windows\System\FbmaJtw.exe
  2⤵
  PID:5780
- C:\Windows\System\ygDUuou.exe
  C:\Windows\System\ygDUuou.exe
  2⤵
  PID:5840
- C:\Windows\System\zymFMLO.exe
  C:\Windows\System\zymFMLO.exe
  2⤵
  PID:5916
- C:\Windows\System\hiJsinO.exe
  C:\Windows\System\hiJsinO.exe
  2⤵
  PID:5972
- C:\Windows\System\PVHadan.exe
  C:\Windows\System\PVHadan.exe
  2⤵
  PID:6032
- C:\Windows\System\ZZpSiXP.exe
  C:\Windows\System\ZZpSiXP.exe
  2⤵
  PID:6112
- C:\Windows\System\DhDgZAt.exe
  C:\Windows\System\DhDgZAt.exe
  2⤵
  PID:2116
- C:\Windows\System\UsxPMna.exe
  C:\Windows\System\UsxPMna.exe
  2⤵
  PID:2212
- C:\Windows\System\FcQyRfp.exe
  C:\Windows\System\FcQyRfp.exe
  2⤵
  PID:5140
- C:\Windows\System\VYEvXEZ.exe
  C:\Windows\System\VYEvXEZ.exe
  2⤵
  PID:5308
- C:\Windows\System\koNWgcI.exe
  C:\Windows\System\koNWgcI.exe
  2⤵
  PID:5444
- C:\Windows\System\YgXbEqW.exe
  C:\Windows\System\YgXbEqW.exe
  2⤵
  PID:5592
- C:\Windows\System\YcfoHcz.exe
  C:\Windows\System\YcfoHcz.exe
  2⤵
  PID:5748
- C:\Windows\System\fxpfloD.exe
  C:\Windows\System\fxpfloD.exe
  2⤵
  PID:5888
- C:\Windows\System\IpTaLxH.exe
  C:\Windows\System\IpTaLxH.exe
  2⤵
  PID:6168
- C:\Windows\System\pGYYqPi.exe
  C:\Windows\System\pGYYqPi.exe
  2⤵
  PID:6196
- C:\Windows\System\JtFFqHF.exe
  C:\Windows\System\JtFFqHF.exe
  2⤵
  PID:6224
- C:\Windows\System\KOJaoKQ.exe
  C:\Windows\System\KOJaoKQ.exe
  2⤵
  PID:6252
- C:\Windows\System\JpDkRRU.exe
  C:\Windows\System\JpDkRRU.exe
  2⤵
  PID:6280
- C:\Windows\System\mXtkkdE.exe
  C:\Windows\System\mXtkkdE.exe
  2⤵
  PID:6308
- C:\Windows\System\QcgZvks.exe
  C:\Windows\System\QcgZvks.exe
  2⤵
  PID:6336
- C:\Windows\System\BKqweHP.exe
  C:\Windows\System\BKqweHP.exe
  2⤵
  PID:6364
- C:\Windows\System\OEZGxgR.exe
  C:\Windows\System\OEZGxgR.exe
  2⤵
  PID:6392
- C:\Windows\System\VeIXXPt.exe
  C:\Windows\System\VeIXXPt.exe
  2⤵
  PID:6420
- C:\Windows\System\adSVxer.exe
  C:\Windows\System\adSVxer.exe
  2⤵
  PID:6448
- C:\Windows\System\sCnCWUF.exe
  C:\Windows\System\sCnCWUF.exe
  2⤵
  PID:6476
- C:\Windows\System\wJqoOsn.exe
  C:\Windows\System\wJqoOsn.exe
  2⤵
  PID:6504
- C:\Windows\System\AhclTaY.exe
  C:\Windows\System\AhclTaY.exe
  2⤵
  PID:6532
- C:\Windows\System\FmfHNNL.exe
  C:\Windows\System\FmfHNNL.exe
  2⤵
  PID:6560
- C:\Windows\System\PKBYShk.exe
  C:\Windows\System\PKBYShk.exe
  2⤵
  PID:6588
- C:\Windows\System\AcesBqp.exe
  C:\Windows\System\AcesBqp.exe
  2⤵
  PID:6616
- C:\Windows\System\MHLPihX.exe
  C:\Windows\System\MHLPihX.exe
  2⤵
  PID:6644
- C:\Windows\System\hjNoZzX.exe
  C:\Windows\System\hjNoZzX.exe
  2⤵
  PID:6672
- C:\Windows\System\sIIXFPK.exe
  C:\Windows\System\sIIXFPK.exe
  2⤵
  PID:6700
- C:\Windows\System\XLjXnIJ.exe
  C:\Windows\System\XLjXnIJ.exe
  2⤵
  PID:6728
- C:\Windows\System\PZBdpeB.exe
  C:\Windows\System\PZBdpeB.exe
  2⤵
  PID:6756
- C:\Windows\System\CoEYUSq.exe
  C:\Windows\System\CoEYUSq.exe
  2⤵
  PID:6784
- C:\Windows\System\BqCxiGE.exe
  C:\Windows\System\BqCxiGE.exe
  2⤵
  PID:6812
- C:\Windows\System\UEMTJhI.exe
  C:\Windows\System\UEMTJhI.exe
  2⤵
  PID:6840
- C:\Windows\System\nHUKsnU.exe
  C:\Windows\System\nHUKsnU.exe
  2⤵
  PID:6868
- C:\Windows\System\ZKeeSlj.exe
  C:\Windows\System\ZKeeSlj.exe
  2⤵
  PID:6896
- C:\Windows\System\AcgrESs.exe
  C:\Windows\System\AcgrESs.exe
  2⤵
  PID:6924
- C:\Windows\System\yVfgoUB.exe
  C:\Windows\System\yVfgoUB.exe
  2⤵
  PID:6952
- C:\Windows\System\ttsZARW.exe
  C:\Windows\System\ttsZARW.exe
  2⤵
  PID:6980
- C:\Windows\System\hmFUACg.exe
  C:\Windows\System\hmFUACg.exe
  2⤵
  PID:7008
- C:\Windows\System\wXeIQuo.exe
  C:\Windows\System\wXeIQuo.exe
  2⤵
  PID:7036
- C:\Windows\System\HgZGvPa.exe
  C:\Windows\System\HgZGvPa.exe
  2⤵
  PID:7064
- C:\Windows\System\qqkfYMz.exe
  C:\Windows\System\qqkfYMz.exe
  2⤵
  PID:7088
- C:\Windows\System\xEWJWFF.exe
  C:\Windows\System\xEWJWFF.exe
  2⤵
  PID:7120
- C:\Windows\System\NprxooC.exe
  C:\Windows\System\NprxooC.exe
  2⤵
  PID:7148
- C:\Windows\System\rGGfqor.exe
  C:\Windows\System\rGGfqor.exe
  2⤵
  PID:5952
- C:\Windows\System\duIpQzg.exe
  C:\Windows\System\duIpQzg.exe
  2⤵
  PID:6140
- C:\Windows\System\ZJrecJT.exe
  C:\Windows\System\ZJrecJT.exe
  2⤵
  PID:2416
- C:\Windows\System\yicRGtg.exe
  C:\Windows\System\yicRGtg.exe
  2⤵
  PID:5392
- C:\Windows\System\ifaNAQP.exe
  C:\Windows\System\ifaNAQP.exe
  2⤵
  PID:5808
- C:\Windows\System\AwPJfyi.exe
  C:\Windows\System\AwPJfyi.exe
  2⤵
  PID:6180
- C:\Windows\System\XIqODpO.exe
  C:\Windows\System\XIqODpO.exe
  2⤵
  PID:6240
- C:\Windows\System\gjDkEOA.exe
  C:\Windows\System\gjDkEOA.exe
  2⤵
  PID:6300
- C:\Windows\System\rbNgIgr.exe
  C:\Windows\System\rbNgIgr.exe
  2⤵
  PID:6376
- C:\Windows\System\SYXpBGJ.exe
  C:\Windows\System\SYXpBGJ.exe
  2⤵
  PID:6436
- C:\Windows\System\nztnrhy.exe
  C:\Windows\System\nztnrhy.exe
  2⤵
  PID:6496
- C:\Windows\System\vUusXyE.exe
  C:\Windows\System\vUusXyE.exe
  2⤵
  PID:6572
- C:\Windows\System\vWhCKXx.exe
  C:\Windows\System\vWhCKXx.exe
  2⤵
  PID:6628
- C:\Windows\System\raFBPcz.exe
  C:\Windows\System\raFBPcz.exe
  2⤵
  PID:4748
- C:\Windows\System\zPswacY.exe
  C:\Windows\System\zPswacY.exe
  2⤵
  PID:3904
- C:\Windows\System\nHPebsI.exe
  C:\Windows\System\nHPebsI.exe
  2⤵
  PID:6796
- C:\Windows\System\WPWrNRH.exe
  C:\Windows\System\WPWrNRH.exe
  2⤵
  PID:6852
- C:\Windows\System\anqUWci.exe
  C:\Windows\System\anqUWci.exe
  2⤵
  PID:6912
- C:\Windows\System\SxtyUWq.exe
  C:\Windows\System\SxtyUWq.exe
  2⤵
  PID:6992
- C:\Windows\System\vfrunYe.exe
  C:\Windows\System\vfrunYe.exe
  2⤵
  PID:7028
- C:\Windows\System\SOTUWjH.exe
  C:\Windows\System\SOTUWjH.exe
  2⤵
  PID:7104
- C:\Windows\System\JnRbEHO.exe
  C:\Windows\System\JnRbEHO.exe
  2⤵
  PID:7164
- C:\Windows\System\vpehayY.exe
  C:\Windows\System\vpehayY.exe
  2⤵
  PID:4324
- C:\Windows\System\ajicpCT.exe
  C:\Windows\System\ajicpCT.exe
  2⤵
  PID:6152
- C:\Windows\System\BfNJKcD.exe
  C:\Windows\System\BfNJKcD.exe
  2⤵
  PID:6216
- C:\Windows\System\HJhsOJW.exe
  C:\Windows\System\HJhsOJW.exe
  2⤵
  PID:6348
- C:\Windows\System\XqQxPlK.exe
  C:\Windows\System\XqQxPlK.exe
  2⤵
  PID:6524
- C:\Windows\System\MClPtzj.exe
  C:\Windows\System\MClPtzj.exe
  2⤵
  PID:6636
- C:\Windows\System\VMZOvOp.exe
  C:\Windows\System\VMZOvOp.exe
  2⤵
  PID:6768
- C:\Windows\System\SWlDpbK.exe
  C:\Windows\System\SWlDpbK.exe
  2⤵
  PID:6880
- C:\Windows\System\pSlKOCU.exe
  C:\Windows\System\pSlKOCU.exe
  2⤵
  PID:2876
- C:\Windows\System\jQHLdAh.exe
  C:\Windows\System\jQHLdAh.exe
  2⤵
  PID:7080
- C:\Windows\System\dXwRfCm.exe
  C:\Windows\System\dXwRfCm.exe
  2⤵
  PID:2408
- C:\Windows\System\rrCSNCA.exe
  C:\Windows\System\rrCSNCA.exe
  2⤵
  PID:6160
- C:\Windows\System\ZagBhdo.exe
  C:\Windows\System\ZagBhdo.exe
  2⤵
  PID:6412
- C:\Windows\System\KsxfyXY.exe
  C:\Windows\System\KsxfyXY.exe
  2⤵
  PID:6692
- C:\Windows\System\gOUGrDz.exe
  C:\Windows\System\gOUGrDz.exe
  2⤵
  PID:7192
- C:\Windows\System\yteYqFE.exe
  C:\Windows\System\yteYqFE.exe
  2⤵
  PID:7220
- C:\Windows\System\fbuslhY.exe
  C:\Windows\System\fbuslhY.exe
  2⤵
  PID:7248
- C:\Windows\System\tdotkFP.exe
  C:\Windows\System\tdotkFP.exe
  2⤵
  PID:7276
- C:\Windows\System\dthahHh.exe
  C:\Windows\System\dthahHh.exe
  2⤵
  PID:7304
- C:\Windows\System\uwBXJJv.exe
  C:\Windows\System\uwBXJJv.exe
  2⤵
  PID:7332
- C:\Windows\System\ALqZtIJ.exe
  C:\Windows\System\ALqZtIJ.exe
  2⤵
  PID:7360
- C:\Windows\System\bsDlKoH.exe
  C:\Windows\System\bsDlKoH.exe
  2⤵
  PID:7388
- C:\Windows\System\bIlTZeJ.exe
  C:\Windows\System\bIlTZeJ.exe
  2⤵
  PID:7416
- C:\Windows\System\LxyHIPk.exe
  C:\Windows\System\LxyHIPk.exe
  2⤵
  PID:7444
- C:\Windows\System\RLUqRjm.exe
  C:\Windows\System\RLUqRjm.exe
  2⤵
  PID:7472
- C:\Windows\System\tgTCjVP.exe
  C:\Windows\System\tgTCjVP.exe
  2⤵
  PID:7500
- C:\Windows\System\mJrCZXm.exe
  C:\Windows\System\mJrCZXm.exe
  2⤵
  PID:7640
- C:\Windows\System\WGDeFnU.exe
  C:\Windows\System\WGDeFnU.exe
  2⤵
  PID:7672
- C:\Windows\System\PzvjShX.exe
  C:\Windows\System\PzvjShX.exe
  2⤵
  PID:7692
- C:\Windows\System\Gbgtvgt.exe
  C:\Windows\System\Gbgtvgt.exe
  2⤵
  PID:7736
- C:\Windows\System\AevFhee.exe
  C:\Windows\System\AevFhee.exe
  2⤵
  PID:7752
- C:\Windows\System\oHCigGL.exe
  C:\Windows\System\oHCigGL.exe
  2⤵
  PID:7788
- C:\Windows\System\PYLTYmS.exe
  C:\Windows\System\PYLTYmS.exe
  2⤵
  PID:7812
- C:\Windows\System\npizlQs.exe
  C:\Windows\System\npizlQs.exe
  2⤵
  PID:7836
- C:\Windows\System\onHTuUN.exe
  C:\Windows\System\onHTuUN.exe
  2⤵
  PID:7876
- C:\Windows\System\AgNQYfW.exe
  C:\Windows\System\AgNQYfW.exe
  2⤵
  PID:7896
- C:\Windows\System\Eogikpn.exe
  C:\Windows\System\Eogikpn.exe
  2⤵
  PID:7916
- C:\Windows\System\qBZiCUt.exe
  C:\Windows\System\qBZiCUt.exe
  2⤵
  PID:7944
- C:\Windows\System\qqUCbMW.exe
  C:\Windows\System\qqUCbMW.exe
  2⤵
  PID:7964
- C:\Windows\System\ZNtRmQA.exe
  C:\Windows\System\ZNtRmQA.exe
  2⤵
  PID:8032
- C:\Windows\System\oZrKxwS.exe
  C:\Windows\System\oZrKxwS.exe
  2⤵
  PID:8060
- C:\Windows\System\pYzumvr.exe
  C:\Windows\System\pYzumvr.exe
  2⤵
  PID:8120
- C:\Windows\System\SoRStjI.exe
  C:\Windows\System\SoRStjI.exe
  2⤵
  PID:8148
- C:\Windows\System\RieHhSw.exe
  C:\Windows\System\RieHhSw.exe
  2⤵
  PID:8168
- C:\Windows\System\MOTONqd.exe
  C:\Windows\System\MOTONqd.exe
  2⤵
  PID:8184
- C:\Windows\System\pMIEiVA.exe
  C:\Windows\System\pMIEiVA.exe
  2⤵
  PID:6828
- C:\Windows\System\FfgjoOl.exe
  C:\Windows\System\FfgjoOl.exe
  2⤵
  PID:7056
- C:\Windows\System\ZnTTPKk.exe
  C:\Windows\System\ZnTTPKk.exe
  2⤵
  PID:6064
- C:\Windows\System\QcKrVjj.exe
  C:\Windows\System\QcKrVjj.exe
  2⤵
  PID:7184
- C:\Windows\System\rgtHBbT.exe
  C:\Windows\System\rgtHBbT.exe
  2⤵
  PID:7348
- C:\Windows\System\lxAKWvz.exe
  C:\Windows\System\lxAKWvz.exe
  2⤵
  PID:7404
- C:\Windows\System\UpHQMMw.exe
  C:\Windows\System\UpHQMMw.exe
  2⤵
  PID:2284
- C:\Windows\System\xILufac.exe
  C:\Windows\System\xILufac.exe
  2⤵
  PID:7428
- C:\Windows\System\kMkSBMX.exe
  C:\Windows\System\kMkSBMX.exe
  2⤵
  PID:7464
- C:\Windows\System\VdeFlvX.exe
  C:\Windows\System\VdeFlvX.exe
  2⤵
  PID:4932
- C:\Windows\System\YDbofBd.exe
  C:\Windows\System\YDbofBd.exe
  2⤵
  PID:1708
- C:\Windows\System\OXJWWst.exe
  C:\Windows\System\OXJWWst.exe
  2⤵
  PID:1160
- C:\Windows\System\cHsranN.exe
  C:\Windows\System\cHsranN.exe
  2⤵
  PID:7520
- C:\Windows\System\oZkLEqq.exe
  C:\Windows\System\oZkLEqq.exe
  2⤵
  PID:7636
- C:\Windows\System\EUZZOlg.exe
  C:\Windows\System\EUZZOlg.exe
  2⤵
  PID:7796
- C:\Windows\System\AahwREk.exe
  C:\Windows\System\AahwREk.exe
  2⤵
  PID:7604
- C:\Windows\System\bPCSomy.exe
  C:\Windows\System\bPCSomy.exe
  2⤵
  PID:7884
- C:\Windows\System\uyqkoDC.exe
  C:\Windows\System\uyqkoDC.exe
  2⤵
  PID:7976
- C:\Windows\System\DPakJXY.exe
  C:\Windows\System\DPakJXY.exe
  2⤵
  PID:8052
- C:\Windows\System\KouVWOq.exe
  C:\Windows\System\KouVWOq.exe
  2⤵
  PID:8116
- C:\Windows\System\sOhUAQU.exe
  C:\Windows\System\sOhUAQU.exe
  2⤵
  PID:3192
- C:\Windows\System\RoCXzrA.exe
  C:\Windows\System\RoCXzrA.exe
  2⤵
  PID:7140
- C:\Windows\System\ySpazhT.exe
  C:\Windows\System\ySpazhT.exe
  2⤵
  PID:7208
- C:\Windows\System\TJuwsNd.exe
  C:\Windows\System\TJuwsNd.exe
  2⤵
  PID:7320
- C:\Windows\System\KiTAljY.exe
  C:\Windows\System\KiTAljY.exe
  2⤵
  PID:3140
- C:\Windows\System\zyJxDDj.exe
  C:\Windows\System\zyJxDDj.exe
  2⤵
  PID:7760
- C:\Windows\System\ffXVPPA.exe
  C:\Windows\System\ffXVPPA.exe
  2⤵
  PID:3788
- C:\Windows\System\OScrRiv.exe
  C:\Windows\System\OScrRiv.exe
  2⤵
  PID:3536
- C:\Windows\System\XzDFvZM.exe
  C:\Windows\System\XzDFvZM.exe
  2⤵
  PID:8128
- C:\Windows\System\YWtZfne.exe
  C:\Windows\System\YWtZfne.exe
  2⤵
  PID:7656
- C:\Windows\System\mTtMVRC.exe
  C:\Windows\System\mTtMVRC.exe
  2⤵
  PID:7800
- C:\Windows\System\plRkgkg.exe
  C:\Windows\System\plRkgkg.exe
  2⤵
  PID:7904
- C:\Windows\System\QJWaxcu.exe
  C:\Windows\System\QJWaxcu.exe
  2⤵
  PID:6712
- C:\Windows\System\IApHQHh.exe
  C:\Windows\System\IApHQHh.exe
  2⤵
  PID:3624
- C:\Windows\System\uotHHfJ.exe
  C:\Windows\System\uotHHfJ.exe
  2⤵
  PID:6600
- C:\Windows\System\uIFYFZm.exe
  C:\Windows\System\uIFYFZm.exe
  2⤵
  PID:1352
- C:\Windows\System\mpiLgBI.exe
  C:\Windows\System\mpiLgBI.exe
  2⤵
  PID:5044
- C:\Windows\System\xVVHKcS.exe
  C:\Windows\System\xVVHKcS.exe
  2⤵
  PID:8144
- C:\Windows\System\hqYgSKD.exe
  C:\Windows\System\hqYgSKD.exe
  2⤵
  PID:6964
- C:\Windows\System\ydCOOWG.exe
  C:\Windows\System\ydCOOWG.exe
  2⤵
  PID:8164
- C:\Windows\System\dikJNtn.exe
  C:\Windows\System\dikJNtn.exe
  2⤵
  PID:7928
- C:\Windows\System\YePtvai.exe
  C:\Windows\System\YePtvai.exe
  2⤵
  PID:7176
- C:\Windows\System\uhxlQjM.exe
  C:\Windows\System\uhxlQjM.exe
  2⤵
  PID:8204
- C:\Windows\System\jGywtAB.exe
  C:\Windows\System\jGywtAB.exe
  2⤵
  PID:8236
- C:\Windows\System\KVqALBs.exe
  C:\Windows\System\KVqALBs.exe
  2⤵
  PID:8252
- C:\Windows\System\cTGTcSt.exe
  C:\Windows\System\cTGTcSt.exe
  2⤵
  PID:8296
- C:\Windows\System\DWwuwdc.exe
  C:\Windows\System\DWwuwdc.exe
  2⤵
  PID:8316
- C:\Windows\System\TWjklka.exe
  C:\Windows\System\TWjklka.exe
  2⤵
  PID:8356
- C:\Windows\System\hDZirqf.exe
  C:\Windows\System\hDZirqf.exe
  2⤵
  PID:8372
- C:\Windows\System\VEZgANt.exe
  C:\Windows\System\VEZgANt.exe
  2⤵
  PID:8408
- C:\Windows\System\NcVhOrV.exe
  C:\Windows\System\NcVhOrV.exe
  2⤵
  PID:8440
- C:\Windows\System\bpnlGxt.exe
  C:\Windows\System\bpnlGxt.exe
  2⤵
  PID:8460
- C:\Windows\System\PvCKzlm.exe
  C:\Windows\System\PvCKzlm.exe
  2⤵
  PID:8476
- C:\Windows\System\WaYUpWr.exe
  C:\Windows\System\WaYUpWr.exe
  2⤵
  PID:8492
- C:\Windows\System\teJMTxj.exe
  C:\Windows\System\teJMTxj.exe
  2⤵
  PID:8520
- C:\Windows\System\vAMufOF.exe
  C:\Windows\System\vAMufOF.exe
  2⤵
  PID:8584
- C:\Windows\System\dDvprGu.exe
  C:\Windows\System\dDvprGu.exe
  2⤵
  PID:8612
- C:\Windows\System\foVRGOP.exe
  C:\Windows\System\foVRGOP.exe
  2⤵
  PID:8640
- C:\Windows\System\wBUmKYT.exe
  C:\Windows\System\wBUmKYT.exe
  2⤵
  PID:8656
- C:\Windows\System\MQHkcov.exe
  C:\Windows\System\MQHkcov.exe
  2⤵
  PID:8672
- C:\Windows\System\hoRmBhd.exe
  C:\Windows\System\hoRmBhd.exe
  2⤵
  PID:8712
- C:\Windows\System\lYJSOWY.exe
  C:\Windows\System\lYJSOWY.exe
  2⤵
  PID:8752
- C:\Windows\System\CJnxFNb.exe
  C:\Windows\System\CJnxFNb.exe
  2⤵
  PID:8780
- C:\Windows\System\yAYfqhK.exe
  C:\Windows\System\yAYfqhK.exe
  2⤵
  PID:8808
- C:\Windows\System\aFnYBXg.exe
  C:\Windows\System\aFnYBXg.exe
  2⤵
  PID:8836
- C:\Windows\System\xiVVHYb.exe
  C:\Windows\System\xiVVHYb.exe
  2⤵
  PID:8868
- C:\Windows\System\snAfAcc.exe
  C:\Windows\System\snAfAcc.exe
  2⤵
  PID:8896
- C:\Windows\System\rnAtTda.exe
  C:\Windows\System\rnAtTda.exe
  2⤵
  PID:8924
- C:\Windows\System\qPvcAXd.exe
  C:\Windows\System\qPvcAXd.exe
  2⤵
  PID:8952
- C:\Windows\System\DVRCqIZ.exe
  C:\Windows\System\DVRCqIZ.exe
  2⤵
  PID:8980
- C:\Windows\System\EAOgzPQ.exe
  C:\Windows\System\EAOgzPQ.exe
  2⤵
  PID:9008
- C:\Windows\System\zrVopxY.exe
  C:\Windows\System\zrVopxY.exe
  2⤵
  PID:9028
- C:\Windows\System\Tncprjv.exe
  C:\Windows\System\Tncprjv.exe
  2⤵
  PID:9068
- C:\Windows\System\gTlXvMW.exe
  C:\Windows\System\gTlXvMW.exe
  2⤵
  PID:9096
- C:\Windows\System\hFzdmJO.exe
  C:\Windows\System\hFzdmJO.exe
  2⤵
  PID:9112
- C:\Windows\System\CZUNVCr.exe
  C:\Windows\System\CZUNVCr.exe
  2⤵
  PID:9136
- C:\Windows\System\RppijVU.exe
  C:\Windows\System\RppijVU.exe
  2⤵
  PID:9168
- C:\Windows\System\KDqZkGI.exe
  C:\Windows\System\KDqZkGI.exe
  2⤵
  PID:9196
- C:\Windows\System\sMQCdrK.exe
  C:\Windows\System\sMQCdrK.exe
  2⤵
  PID:7924
- C:\Windows\System\KAhsPCs.exe
  C:\Windows\System\KAhsPCs.exe
  2⤵
  PID:8272
- C:\Windows\System\YftbIxW.exe
  C:\Windows\System\YftbIxW.exe
  2⤵
  PID:8344
- C:\Windows\System\khbcRgB.exe
  C:\Windows\System\khbcRgB.exe
  2⤵
  PID:8392
- C:\Windows\System\HoXMcJu.exe
  C:\Windows\System\HoXMcJu.exe
  2⤵
  PID:8468
- C:\Windows\System\WKRMKPq.exe
  C:\Windows\System\WKRMKPq.exe
  2⤵
  PID:8508
- C:\Windows\System\IPUFJQP.exe
  C:\Windows\System\IPUFJQP.exe
  2⤵
  PID:8608
- C:\Windows\System\EFDMJRo.exe
  C:\Windows\System\EFDMJRo.exe
  2⤵
  PID:8636
- C:\Windows\System\YBBTzvs.exe
  C:\Windows\System\YBBTzvs.exe
  2⤵
  PID:8688
- C:\Windows\System\VhMVYIC.exe
  C:\Windows\System\VhMVYIC.exe
  2⤵
  PID:8768
- C:\Windows\System\fgAlUhJ.exe
  C:\Windows\System\fgAlUhJ.exe
  2⤵
  PID:8848
- C:\Windows\System\LbctmdX.exe
  C:\Windows\System\LbctmdX.exe
  2⤵
  PID:8912
- C:\Windows\System\siyceuF.exe
  C:\Windows\System\siyceuF.exe
  2⤵
  PID:8976
- C:\Windows\System\JBtsPHz.exe
  C:\Windows\System\JBtsPHz.exe
  2⤵
  PID:9020
- C:\Windows\System\ScCFnce.exe
  C:\Windows\System\ScCFnce.exe
  2⤵
  PID:9104
- C:\Windows\System\zisiFfx.exe
  C:\Windows\System\zisiFfx.exe
  2⤵
  PID:9156
- C:\Windows\System\WlHqhxg.exe
  C:\Windows\System\WlHqhxg.exe
  2⤵
  PID:8248
- C:\Windows\System\BqeQAnW.exe
  C:\Windows\System\BqeQAnW.exe
  2⤵
  PID:8572
- C:\Windows\System\TKqisOF.exe
  C:\Windows\System\TKqisOF.exe
  2⤵
  PID:8744
- C:\Windows\System\thJjxhY.exe
  C:\Windows\System\thJjxhY.exe
  2⤵
  PID:8884
- C:\Windows\System\dVJYpDR.exe
  C:\Windows\System\dVJYpDR.exe
  2⤵
  PID:4036
- C:\Windows\System\agrjlPt.exe
  C:\Windows\System\agrjlPt.exe
  2⤵
  PID:8452
- C:\Windows\System\LOgnNxz.exe
  C:\Windows\System\LOgnNxz.exe
  2⤵
  PID:8800
- C:\Windows\System\IfCiJxK.exe
  C:\Windows\System\IfCiJxK.exe
  2⤵
  PID:8200
- C:\Windows\System\OHmauMU.exe
  C:\Windows\System\OHmauMU.exe
  2⤵
  PID:9220
- C:\Windows\System\gZTUIbm.exe
  C:\Windows\System\gZTUIbm.exe
  2⤵
  PID:9248
- C:\Windows\System\heoOtGc.exe
  C:\Windows\System\heoOtGc.exe
  2⤵
  PID:9276
- C:\Windows\System\yUDYxUY.exe
  C:\Windows\System\yUDYxUY.exe
  2⤵
  PID:9308
- C:\Windows\System\AtNpNra.exe
  C:\Windows\System\AtNpNra.exe
  2⤵
  PID:9344
- C:\Windows\System\HAnrkiR.exe
  C:\Windows\System\HAnrkiR.exe
  2⤵
  PID:9380
- C:\Windows\System\OneAoZy.exe
  C:\Windows\System\OneAoZy.exe
  2⤵
  PID:9424
- C:\Windows\System\KGvrxXC.exe
  C:\Windows\System\KGvrxXC.exe
  2⤵
  PID:9452
- C:\Windows\System\qlwvfcM.exe
  C:\Windows\System\qlwvfcM.exe
  2⤵
  PID:9484
- C:\Windows\System\XbLzelY.exe
  C:\Windows\System\XbLzelY.exe
  2⤵
  PID:9512
- C:\Windows\System\ZjpWDmS.exe
  C:\Windows\System\ZjpWDmS.exe
  2⤵
  PID:9544
- C:\Windows\System\HYSeLQZ.exe
  C:\Windows\System\HYSeLQZ.exe
  2⤵
  PID:9572
- C:\Windows\System\hmhNKbm.exe
  C:\Windows\System\hmhNKbm.exe
  2⤵
  PID:9600
- C:\Windows\System\Mtlfwcd.exe
  C:\Windows\System\Mtlfwcd.exe
  2⤵
  PID:9616
- C:\Windows\System\duJinhX.exe
  C:\Windows\System\duJinhX.exe
  2⤵
  PID:9656
- C:\Windows\System\wCOnSMk.exe
  C:\Windows\System\wCOnSMk.exe
  2⤵
  PID:9688
- C:\Windows\System\bjkTRBR.exe
  C:\Windows\System\bjkTRBR.exe
  2⤵
  PID:9716
- C:\Windows\System\aMxsLHx.exe
  C:\Windows\System\aMxsLHx.exe
  2⤵
  PID:9740
- C:\Windows\System\qDXwwOn.exe
  C:\Windows\System\qDXwwOn.exe
  2⤵
  PID:9760
- C:\Windows\System\uEyNhxR.exe
  C:\Windows\System\uEyNhxR.exe
  2⤵
  PID:9800
- C:\Windows\System\WWXBYyF.exe
  C:\Windows\System\WWXBYyF.exe
  2⤵
  PID:9824
- C:\Windows\System\OrZxqKV.exe
  C:\Windows\System\OrZxqKV.exe
  2⤵
  PID:9844
- C:\Windows\System\YlzMquT.exe
  C:\Windows\System\YlzMquT.exe
  2⤵
  PID:9900
- C:\Windows\System\YIFpsjC.exe
  C:\Windows\System\YIFpsjC.exe
  2⤵
  PID:9916
- C:\Windows\System\dDqHhpM.exe
  C:\Windows\System\dDqHhpM.exe
  2⤵
  PID:9936
- C:\Windows\System\cvmHePB.exe
  C:\Windows\System\cvmHePB.exe
  2⤵
  PID:9972
- C:\Windows\System\kpIvMqN.exe
  C:\Windows\System\kpIvMqN.exe
  2⤵
  PID:10000
- C:\Windows\System\DZkcmoK.exe
  C:\Windows\System\DZkcmoK.exe
  2⤵
  PID:10028
- C:\Windows\System\QlSxoPP.exe
  C:\Windows\System\QlSxoPP.exe
  2⤵
  PID:10056
- C:\Windows\System\ghdTEBs.exe
  C:\Windows\System\ghdTEBs.exe
  2⤵
  PID:10092
- C:\Windows\System\leSrUSu.exe
  C:\Windows\System\leSrUSu.exe
  2⤵
  PID:10128
- C:\Windows\System\QRBLPlx.exe
  C:\Windows\System\QRBLPlx.exe
  2⤵
  PID:10156
- C:\Windows\System\JjTXxnJ.exe
  C:\Windows\System\JjTXxnJ.exe
  2⤵
  PID:10184
- C:\Windows\System\wvEEADv.exe
  C:\Windows\System\wvEEADv.exe
  2⤵
  PID:10212
- C:\Windows\System\PFbMEvU.exe
  C:\Windows\System\PFbMEvU.exe
  2⤵
  PID:10232
- C:\Windows\System\hxfGVqa.exe
  C:\Windows\System\hxfGVqa.exe
  2⤵
  PID:9268
- C:\Windows\System\hgfAydO.exe
  C:\Windows\System\hgfAydO.exe
  2⤵
  PID:9328
- C:\Windows\System\RqajdhR.exe
  C:\Windows\System\RqajdhR.exe
  2⤵
  PID:9496
- C:\Windows\System\mvfvRyO.exe
  C:\Windows\System\mvfvRyO.exe
  2⤵
  PID:9608
- C:\Windows\System\vTxRhdd.exe
  C:\Windows\System\vTxRhdd.exe
  2⤵
  PID:9652
- C:\Windows\System\FiovLXo.exe
  C:\Windows\System\FiovLXo.exe
  2⤵
  PID:9784
- C:\Windows\System\YzaKLMX.exe
  C:\Windows\System\YzaKLMX.exe
  2⤵
  PID:9868
- C:\Windows\System\PGKsctv.exe
  C:\Windows\System\PGKsctv.exe
  2⤵
  PID:9960
- C:\Windows\System\PTPhieB.exe
  C:\Windows\System\PTPhieB.exe
  2⤵
  PID:10024
- C:\Windows\System\gbtJhPJ.exe
  C:\Windows\System\gbtJhPJ.exe
  2⤵
  PID:10084
- C:\Windows\System\tQfcdBG.exe
  C:\Windows\System\tQfcdBG.exe
  2⤵
  PID:3156
- C:\Windows\System\BVIlQwd.exe
  C:\Windows\System\BVIlQwd.exe
  2⤵
  PID:10144
- C:\Windows\System\AsNqljy.exe
  C:\Windows\System\AsNqljy.exe
  2⤵
  PID:10196
- C:\Windows\System\HXaZgZq.exe
  C:\Windows\System\HXaZgZq.exe
  2⤵
  PID:9300
- C:\Windows\System\AmLwQSC.exe
  C:\Windows\System\AmLwQSC.exe
  2⤵
  PID:9564
- C:\Windows\System\taoZLrD.exe
  C:\Windows\System\taoZLrD.exe
  2⤵
  PID:10012
- C:\Windows\System\EnuBVZz.exe
  C:\Windows\System\EnuBVZz.exe
  2⤵
  PID:2780
- C:\Windows\System\QRpemkY.exe
  C:\Windows\System\QRpemkY.exe
  2⤵
  PID:10180
- C:\Windows\System\qrwaNRL.exe
  C:\Windows\System\qrwaNRL.exe
  2⤵
  PID:9832
- C:\Windows\System\mmeoErz.exe
  C:\Windows\System\mmeoErz.exe
  2⤵
  PID:10176
- C:\Windows\System\pvPaQOK.exe
  C:\Windows\System\pvPaQOK.exe
  2⤵
  PID:10264
- C:\Windows\System\gXcoYar.exe
  C:\Windows\System\gXcoYar.exe
  2⤵
  PID:10308
- C:\Windows\System\BPMnmlb.exe
  C:\Windows\System\BPMnmlb.exe
  2⤵
  PID:10352
- C:\Windows\System\FhFNjKM.exe
  C:\Windows\System\FhFNjKM.exe
  2⤵
  PID:10368
- C:\Windows\System\MtQUefD.exe
  C:\Windows\System\MtQUefD.exe
  2⤵
  PID:10388
- C:\Windows\System\QvpnJDT.exe
  C:\Windows\System\QvpnJDT.exe
  2⤵
  PID:10428
- C:\Windows\System\bobvdRE.exe
  C:\Windows\System\bobvdRE.exe
  2⤵
  PID:10456
- C:\Windows\System\koDSQnF.exe
  C:\Windows\System\koDSQnF.exe
  2⤵
  PID:10480
- C:\Windows\System\vKzqBeQ.exe
  C:\Windows\System\vKzqBeQ.exe
  2⤵
  PID:10520
- C:\Windows\System\QsjMTqN.exe
  C:\Windows\System\QsjMTqN.exe
  2⤵
  PID:10548
- C:\Windows\System\RdcZcXM.exe
  C:\Windows\System\RdcZcXM.exe
  2⤵
  PID:10568
- C:\Windows\System\qOWXHFB.exe
  C:\Windows\System\qOWXHFB.exe
  2⤵
  PID:10592
- C:\Windows\System\ClLnffK.exe
  C:\Windows\System\ClLnffK.exe
  2⤵
  PID:10648
- C:\Windows\System\irhbYKb.exe
  C:\Windows\System\irhbYKb.exe
  2⤵
  PID:10664
- C:\Windows\System\ctixPmy.exe
  C:\Windows\System\ctixPmy.exe
  2⤵
  PID:10704
- C:\Windows\System\LqGnLoA.exe
  C:\Windows\System\LqGnLoA.exe
  2⤵
  PID:10732
- C:\Windows\System\bTIMQYm.exe
  C:\Windows\System\bTIMQYm.exe
  2⤵
  PID:10760
- C:\Windows\System\KwioZUR.exe
  C:\Windows\System\KwioZUR.exe
  2⤵
  PID:10788
- C:\Windows\System\GVwcJeI.exe
  C:\Windows\System\GVwcJeI.exe
  2⤵
  PID:10816
- C:\Windows\System\WBXPDrt.exe
  C:\Windows\System\WBXPDrt.exe
  2⤵
  PID:10840
- C:\Windows\System\EshFmFG.exe
  C:\Windows\System\EshFmFG.exe
  2⤵
  PID:10872
- C:\Windows\System\OBpkwOx.exe
  C:\Windows\System\OBpkwOx.exe
  2⤵
  PID:10896
- C:\Windows\System\foygZhB.exe
  C:\Windows\System\foygZhB.exe
  2⤵
  PID:10936
- C:\Windows\System\kzVJQVX.exe
  C:\Windows\System\kzVJQVX.exe
  2⤵
  PID:10972
- C:\Windows\System\hIxAhBI.exe
  C:\Windows\System\hIxAhBI.exe
  2⤵
  PID:10992
- C:\Windows\System\PjZPDmL.exe
  C:\Windows\System\PjZPDmL.exe
  2⤵
  PID:11012
- C:\Windows\System\sWmtsXg.exe
  C:\Windows\System\sWmtsXg.exe
  2⤵
  PID:11064
- C:\Windows\System\ZLyONXh.exe
  C:\Windows\System\ZLyONXh.exe
  2⤵
  PID:11116
- C:\Windows\System\eIpxcxX.exe
  C:\Windows\System\eIpxcxX.exe
  2⤵
  PID:11140
- C:\Windows\System\AcKNXge.exe
  C:\Windows\System\AcKNXge.exe
  2⤵
  PID:11168
- C:\Windows\System\RNCSwIY.exe
  C:\Windows\System\RNCSwIY.exe
  2⤵
  PID:11196
- C:\Windows\System\TTFLYHn.exe
  C:\Windows\System\TTFLYHn.exe
  2⤵
  PID:11224
- C:\Windows\System\uyvqsca.exe
  C:\Windows\System\uyvqsca.exe
  2⤵
  PID:11256
- C:\Windows\System\ygkdcDx.exe
  C:\Windows\System\ygkdcDx.exe
  2⤵
  PID:10256
- C:\Windows\System\BrYtflD.exe
  C:\Windows\System\BrYtflD.exe
  2⤵
  PID:10364
- C:\Windows\System\QAAfOiX.exe
  C:\Windows\System\QAAfOiX.exe
  2⤵
  PID:10408
- C:\Windows\System\nmyiZZy.exe
  C:\Windows\System\nmyiZZy.exe
  2⤵
  PID:10496
- C:\Windows\System\bHFhYwF.exe
  C:\Windows\System\bHFhYwF.exe
  2⤵
  PID:10588
- C:\Windows\System\bKBwGqs.exe
  C:\Windows\System\bKBwGqs.exe
  2⤵
  PID:10684
- C:\Windows\System\nHpEaYh.exe
  C:\Windows\System\nHpEaYh.exe
  2⤵
  PID:10772
- C:\Windows\System\lTTnSsF.exe
  C:\Windows\System\lTTnSsF.exe
  2⤵
  PID:10836
- C:\Windows\System\BJnLTdy.exe
  C:\Windows\System\BJnLTdy.exe
  2⤵
  PID:10920
- C:\Windows\System\BcTJxBB.exe
  C:\Windows\System\BcTJxBB.exe
  2⤵
  PID:11008
- C:\Windows\System\VCZrkVF.exe
  C:\Windows\System\VCZrkVF.exe
  2⤵
  PID:9212
- C:\Windows\System\cSLRLlr.exe
  C:\Windows\System\cSLRLlr.exe
  2⤵
  PID:9232
- C:\Windows\System\osYmoHd.exe
  C:\Windows\System\osYmoHd.exe
  2⤵
  PID:11136
- C:\Windows\System\xjraLds.exe
  C:\Windows\System\xjraLds.exe
  2⤵
  PID:11216
- C:\Windows\System\dnKfAyz.exe
  C:\Windows\System\dnKfAyz.exe
  2⤵
  PID:10328
- C:\Windows\System\pcEfFkd.exe
  C:\Windows\System\pcEfFkd.exe
  2⤵
  PID:10464
- C:\Windows\System\VEoUNED.exe
  C:\Windows\System\VEoUNED.exe
  2⤵
  PID:10644
- C:\Windows\System\iUvyYAl.exe
  C:\Windows\System\iUvyYAl.exe
  2⤵
  PID:10864
- C:\Windows\System\jgxYTqd.exe
  C:\Windows\System\jgxYTqd.exe
  2⤵
  PID:11004
- C:\Windows\System\MMqeOBC.exe
  C:\Windows\System\MMqeOBC.exe
  2⤵
  PID:7824
- C:\Windows\System\UjspLYg.exe
  C:\Windows\System\UjspLYg.exe
  2⤵
  PID:10380
- C:\Windows\System\cpjIMYP.exe
  C:\Windows\System\cpjIMYP.exe
  2⤵
  PID:10752
- C:\Windows\System\VUZTYDG.exe
  C:\Windows\System\VUZTYDG.exe
  2⤵
  PID:10980
- C:\Windows\System\aQgOiTL.exe
  C:\Windows\System\aQgOiTL.exe
  2⤵
  PID:10932
- C:\Windows\System\LxHfwFg.exe
  C:\Windows\System\LxHfwFg.exe
  2⤵
  PID:10728
- C:\Windows\System\GgTSrkQ.exe
  C:\Windows\System\GgTSrkQ.exe
  2⤵
  PID:11288
- C:\Windows\System\YouyKje.exe
  C:\Windows\System\YouyKje.exe
  2⤵
  PID:11320
- C:\Windows\System\XPqJApP.exe
  C:\Windows\System\XPqJApP.exe
  2⤵
  PID:11352
- C:\Windows\System\TSJWkRC.exe
  C:\Windows\System\TSJWkRC.exe
  2⤵
  PID:11388
- C:\Windows\System\QEPHHok.exe
  C:\Windows\System\QEPHHok.exe
  2⤵
  PID:11404
- C:\Windows\System\wVbxcZe.exe
  C:\Windows\System\wVbxcZe.exe
  2⤵
  PID:11432
- C:\Windows\System\rlqQAMm.exe
  C:\Windows\System\rlqQAMm.exe
  2⤵
  PID:11472
- C:\Windows\System\LwDGrMu.exe
  C:\Windows\System\LwDGrMu.exe
  2⤵
  PID:11500
- C:\Windows\System\YaeUmam.exe
  C:\Windows\System\YaeUmam.exe
  2⤵
  PID:11528
- C:\Windows\System\YYiFFuM.exe
  C:\Windows\System\YYiFFuM.exe
  2⤵
  PID:11560
- C:\Windows\System\wcRUmXX.exe
  C:\Windows\System\wcRUmXX.exe
  2⤵
  PID:11588
- C:\Windows\System\HBqIOuV.exe
  C:\Windows\System\HBqIOuV.exe
  2⤵
  PID:11616
- C:\Windows\System\DWSPAZk.exe
  C:\Windows\System\DWSPAZk.exe
  2⤵
  PID:11644
- C:\Windows\System\EfLeVRZ.exe
  C:\Windows\System\EfLeVRZ.exe
  2⤵
  PID:11672
- C:\Windows\System\GDNViRk.exe
  C:\Windows\System\GDNViRk.exe
  2⤵
  PID:11704
- C:\Windows\System\cXWCaau.exe
  C:\Windows\System\cXWCaau.exe
  2⤵
  PID:11736
- C:\Windows\System\aLOsuaV.exe
  C:\Windows\System\aLOsuaV.exe
  2⤵
  PID:11764
- C:\Windows\System\RhLkGpC.exe
  C:\Windows\System\RhLkGpC.exe
  2⤵
  PID:11792
- C:\Windows\System\bCsmJax.exe
  C:\Windows\System\bCsmJax.exe
  2⤵
  PID:11820
- C:\Windows\System\cSiktQz.exe
  C:\Windows\System\cSiktQz.exe
  2⤵
  PID:11848
- C:\Windows\System\PJMIKOT.exe
  C:\Windows\System\PJMIKOT.exe
  2⤵
  PID:11876
- C:\Windows\System\GmvrgNM.exe
  C:\Windows\System\GmvrgNM.exe
  2⤵
  PID:11904
- C:\Windows\System\sAmnIYV.exe
  C:\Windows\System\sAmnIYV.exe
  2⤵
  PID:11932
- C:\Windows\System\otDdbST.exe
  C:\Windows\System\otDdbST.exe
  2⤵
  PID:11960
- C:\Windows\System\SYOkJab.exe
  C:\Windows\System\SYOkJab.exe
  2⤵
  PID:11988
- C:\Windows\System\OHQkGIV.exe
  C:\Windows\System\OHQkGIV.exe
  2⤵
  PID:12016
- C:\Windows\System\eDnoIvL.exe
  C:\Windows\System\eDnoIvL.exe
  2⤵
  PID:12032
- C:\Windows\System\JRqxOFD.exe
  C:\Windows\System\JRqxOFD.exe
  2⤵
  PID:12072
- C:\Windows\System\AKhuKHS.exe
  C:\Windows\System\AKhuKHS.exe
  2⤵
  PID:12100
- C:\Windows\System\KweWLzR.exe
  C:\Windows\System\KweWLzR.exe
  2⤵
  PID:12128
- C:\Windows\System\FGsghVG.exe
  C:\Windows\System\FGsghVG.exe
  2⤵
  PID:12156
- C:\Windows\System\AKNPhVG.exe
  C:\Windows\System\AKNPhVG.exe
  2⤵
  PID:12184
- C:\Windows\System\iFtbPiK.exe
  C:\Windows\System\iFtbPiK.exe
  2⤵
  PID:12212
- C:\Windows\System\lxwtBuA.exe
  C:\Windows\System\lxwtBuA.exe
  2⤵
  PID:12240
- C:\Windows\System\QTOdneC.exe
  C:\Windows\System\QTOdneC.exe
  2⤵
  PID:12264
- C:\Windows\System\VjaMkMd.exe
  C:\Windows\System\VjaMkMd.exe
  2⤵
  PID:11284
- C:\Windows\System\ryOMOMP.exe
  C:\Windows\System\ryOMOMP.exe
  2⤵
  PID:11372
- C:\Windows\System\KjllIna.exe
  C:\Windows\System\KjllIna.exe
  2⤵
  PID:11444
- C:\Windows\System\ERtRhfK.exe
  C:\Windows\System\ERtRhfK.exe
  2⤵
  PID:11516
- C:\Windows\System\sZYzrhb.exe
  C:\Windows\System\sZYzrhb.exe
  2⤵
  PID:11580
- C:\Windows\System\SUvRFRk.exe
  C:\Windows\System\SUvRFRk.exe
  2⤵
  PID:11640
- C:\Windows\System\qurnAfh.exe
  C:\Windows\System\qurnAfh.exe
  2⤵
  PID:11716
- C:\Windows\System\kneRbLG.exe
  C:\Windows\System\kneRbLG.exe
  2⤵
  PID:11784
- C:\Windows\System\dKQYLUG.exe
  C:\Windows\System\dKQYLUG.exe
  2⤵
  PID:11844
- C:\Windows\System\DGXeiAM.exe
  C:\Windows\System\DGXeiAM.exe
  2⤵
  PID:11896
- C:\Windows\System\FxNHNNT.exe
  C:\Windows\System\FxNHNNT.exe
  2⤵
  PID:11984
- C:\Windows\System\Omdhqrv.exe
  C:\Windows\System\Omdhqrv.exe
  2⤵
  PID:12060
- C:\Windows\System\OWujdrJ.exe
  C:\Windows\System\OWujdrJ.exe
  2⤵
  PID:12120
- C:\Windows\System\GarhAml.exe
  C:\Windows\System\GarhAml.exe
  2⤵
  PID:12176
- C:\Windows\System\prRWhjz.exe
  C:\Windows\System\prRWhjz.exe
  2⤵
  PID:12236
- C:\Windows\System\oVqcRyk.exe
  C:\Windows\System\oVqcRyk.exe
  2⤵
  PID:11336
- C:\Windows\System\cRtlLlC.exe
  C:\Windows\System\cRtlLlC.exe
  2⤵
  PID:11492
- C:\Windows\System\izykWKP.exe
  C:\Windows\System\izykWKP.exe
  2⤵
  PID:11636
- C:\Windows\System\BnuYShW.exe
  C:\Windows\System\BnuYShW.exe
  2⤵
  PID:11812
- C:\Windows\System\lyEgqNL.exe
  C:\Windows\System\lyEgqNL.exe
  2⤵
  PID:11976
- C:\Windows\System\ZCWJbyv.exe
  C:\Windows\System\ZCWJbyv.exe
  2⤵
  PID:12112
- C:\Windows\System\flVJTjl.exe
  C:\Windows\System\flVJTjl.exe
  2⤵
  PID:12284
- C:\Windows\System\ZRfRqBj.exe
  C:\Windows\System\ZRfRqBj.exe
  2⤵
  PID:11604
- C:\Windows\System\nVrbuiI.exe
  C:\Windows\System\nVrbuiI.exe
  2⤵
  PID:11944
- C:\Windows\System\bTbzTsx.exe
  C:\Windows\System\bTbzTsx.exe
  2⤵
  PID:11420
- C:\Windows\System\qluAvZo.exe
  C:\Windows\System\qluAvZo.exe
  2⤵
  PID:12196
- C:\Windows\System\tkGzaZO.exe
  C:\Windows\System\tkGzaZO.exe
  2⤵
  PID:12292
- C:\Windows\System\BZXlRzz.exe
  C:\Windows\System\BZXlRzz.exe
  2⤵
  PID:12320
- C:\Windows\System\CWCVHyI.exe
  C:\Windows\System\CWCVHyI.exe
  2⤵
  PID:12348
- C:\Windows\System\EMnlrgt.exe
  C:\Windows\System\EMnlrgt.exe
  2⤵
  PID:12376
- C:\Windows\System\JATXIoF.exe
  C:\Windows\System\JATXIoF.exe
  2⤵
  PID:12412
- C:\Windows\System\AVhxGzI.exe
  C:\Windows\System\AVhxGzI.exe
  2⤵
  PID:12464
- C:\Windows\System\CzWsYmP.exe
  C:\Windows\System\CzWsYmP.exe
  2⤵
  PID:12496
- C:\Windows\System\opYdxAi.exe
  C:\Windows\System\opYdxAi.exe
  2⤵
  PID:12524
- C:\Windows\System\PxBgYfk.exe
  C:\Windows\System\PxBgYfk.exe
  2⤵
  PID:12552
- C:\Windows\System\ZZWsHFp.exe
  C:\Windows\System\ZZWsHFp.exe
  2⤵
  PID:12580
- C:\Windows\System\NUlUSna.exe
  C:\Windows\System\NUlUSna.exe
  2⤵
  PID:12608
- C:\Windows\System\jqODUiA.exe
  C:\Windows\System\jqODUiA.exe
  2⤵
  PID:12636
- C:\Windows\System\cuKJPsV.exe
  C:\Windows\System\cuKJPsV.exe
  2⤵
  PID:12664
- C:\Windows\System\yGtVizv.exe
  C:\Windows\System\yGtVizv.exe
  2⤵
  PID:12692
- C:\Windows\System\GazcOgk.exe
  C:\Windows\System\GazcOgk.exe
  2⤵
  PID:12720
- C:\Windows\System\oQkvall.exe
  C:\Windows\System\oQkvall.exe
  2⤵
  PID:12748
- C:\Windows\System\nfHMLKA.exe
  C:\Windows\System\nfHMLKA.exe
  2⤵
  PID:12776
- C:\Windows\System\IcXqOvM.exe
  C:\Windows\System\IcXqOvM.exe
  2⤵
  PID:12804
- C:\Windows\System\eCwgajJ.exe
  C:\Windows\System\eCwgajJ.exe
  2⤵
  PID:12832
- C:\Windows\System\HdgxVEp.exe
  C:\Windows\System\HdgxVEp.exe
  2⤵
  PID:12860
- C:\Windows\System\GvOdgil.exe
  C:\Windows\System\GvOdgil.exe
  2⤵
  PID:12888
- C:\Windows\System\GFBhiPk.exe
  C:\Windows\System\GFBhiPk.exe
  2⤵
  PID:12916
- C:\Windows\System\ZOsWbpR.exe
  C:\Windows\System\ZOsWbpR.exe
  2⤵
  PID:12944
- C:\Windows\System\zgZXQUh.exe
  C:\Windows\System\zgZXQUh.exe
  2⤵
  PID:12972
- C:\Windows\System\qXltqOa.exe
  C:\Windows\System\qXltqOa.exe
  2⤵
  PID:13000
- C:\Windows\System\dLolGTK.exe
  C:\Windows\System\dLolGTK.exe
  2⤵
  PID:13028
- C:\Windows\System\AKiHBox.exe
  C:\Windows\System\AKiHBox.exe
  2⤵
  PID:13056
- C:\Windows\System\gUUVXJR.exe
  C:\Windows\System\gUUVXJR.exe
  2⤵
  PID:13084
- C:\Windows\System\PfAgVzy.exe
  C:\Windows\System\PfAgVzy.exe
  2⤵
  PID:13112
- C:\Windows\System\BFjPyiB.exe
  C:\Windows\System\BFjPyiB.exe
  2⤵
  PID:13140
- C:\Windows\System\pibAvnP.exe
  C:\Windows\System\pibAvnP.exe
  2⤵
  PID:13168
- C:\Windows\System\iEUAHyw.exe
  C:\Windows\System\iEUAHyw.exe
  2⤵
  PID:13196
- C:\Windows\System\rPIVgZV.exe
  C:\Windows\System\rPIVgZV.exe
  2⤵
  PID:13212
- C:\Windows\System\WiDliwX.exe
  C:\Windows\System\WiDliwX.exe
  2⤵
  PID:13240
- C:\Windows\System\nAXXqIx.exe
  C:\Windows\System\nAXXqIx.exe
  2⤵
  PID:13280
- C:\Windows\System\rdnQYcm.exe
  C:\Windows\System\rdnQYcm.exe
  2⤵
  PID:13308
- C:\Windows\System\HLsluFk.exe
  C:\Windows\System\HLsluFk.exe
  2⤵
  PID:12344
- C:\Windows\System\zlmtdIG.exe
  C:\Windows\System\zlmtdIG.exe
  2⤵
  PID:12408
- C:\Windows\System\efPlDQD.exe
  C:\Windows\System\efPlDQD.exe
  2⤵
  PID:12492
- C:\Windows\System\hmMSvpf.exe
  C:\Windows\System\hmMSvpf.exe
  2⤵
  PID:12572
- C:\Windows\System\UPotppz.exe
  C:\Windows\System\UPotppz.exe
  2⤵
  PID:12632
- C:\Windows\System\CVPGRuM.exe
  C:\Windows\System\CVPGRuM.exe
  2⤵
  PID:12712
- C:\Windows\System\MYbNNZZ.exe
  C:\Windows\System\MYbNNZZ.exe
  2⤵
  PID:12772
- C:\Windows\System\neGnqNz.exe
  C:\Windows\System\neGnqNz.exe
  2⤵
  PID:12848
- C:\Windows\System\qEEPGNc.exe
  C:\Windows\System\qEEPGNc.exe
  2⤵
  PID:12908
- C:\Windows\System\vyuERvf.exe
  C:\Windows\System\vyuERvf.exe
  2⤵
  PID:12968
- C:\Windows\System\EHPQbMN.exe
  C:\Windows\System\EHPQbMN.exe
  2⤵
  PID:13044
- C:\Windows\System\JFoYDbt.exe
  C:\Windows\System\JFoYDbt.exe
  2⤵
  PID:13100
- C:\Windows\System\TUmByuL.exe
  C:\Windows\System\TUmByuL.exe
  2⤵
  PID:13160
- C:\Windows\System\KaARBNT.exe
  C:\Windows\System\KaARBNT.exe
  2⤵
  PID:13228
- C:\Windows\System\kijDaLr.exe
  C:\Windows\System\kijDaLr.exe
  2⤵
  PID:13296
- C:\Windows\System\DRcrQuw.exe
  C:\Windows\System\DRcrQuw.exe
  2⤵
  PID:12404
- C:\Windows\System\Sigxxzy.exe
  C:\Windows\System\Sigxxzy.exe
  2⤵
  PID:12520
- C:\Windows\System\OAUDtjp.exe
  C:\Windows\System\OAUDtjp.exe
  2⤵
  PID:12688
- C:\Windows\System\PsHXsVB.exe
  C:\Windows\System\PsHXsVB.exe
  2⤵
  PID:12876
- C:\Windows\System\xyIDsQg.exe
  C:\Windows\System\xyIDsQg.exe
  2⤵
  PID:13020
- C:\Windows\System\ghyPNIk.exe
  C:\Windows\System\ghyPNIk.exe
  2⤵
  PID:13152
- C:\Windows\System\WWpGwev.exe
  C:\Windows\System\WWpGwev.exe
  2⤵
  PID:12336
- C:\Windows\System\AWDepRw.exe
  C:\Windows\System\AWDepRw.exe
  2⤵
  PID:12676
- C:\Windows\System\LYoxgqQ.exe
  C:\Windows\System\LYoxgqQ.exe
  2⤵
  PID:12996
- C:\Windows\System\FxUSRIO.exe
  C:\Windows\System\FxUSRIO.exe
  2⤵
  PID:12604
- C:\Windows\System\TAnIefC.exe
  C:\Windows\System\TAnIefC.exe
  2⤵
  PID:13320
- C:\Windows\System\mRnTwsB.exe
  C:\Windows\System\mRnTwsB.exe
  2⤵
  PID:13348
- C:\Windows\System\JAzwJCC.exe
  C:\Windows\System\JAzwJCC.exe
  2⤵
  PID:13376
- C:\Windows\System\cBAhtCI.exe
  C:\Windows\System\cBAhtCI.exe
  2⤵
  PID:13404
- C:\Windows\System\rfDxFqV.exe
  C:\Windows\System\rfDxFqV.exe
  2⤵
  PID:13432
- C:\Windows\System\dSUjWgT.exe
  C:\Windows\System\dSUjWgT.exe
  2⤵
  PID:13460
- C:\Windows\System\pcUfIsE.exe
  C:\Windows\System\pcUfIsE.exe
  2⤵
  PID:13488
- C:\Windows\System\IXyJymR.exe
  C:\Windows\System\IXyJymR.exe
  2⤵
  PID:13516
- C:\Windows\System\ejiRwie.exe
  C:\Windows\System\ejiRwie.exe
  2⤵
  PID:13552
- C:\Windows\System\RyLglBu.exe
  C:\Windows\System\RyLglBu.exe
  2⤵
  PID:13580
- C:\Windows\System\yhfHaWw.exe
  C:\Windows\System\yhfHaWw.exe
  2⤵
  PID:13608
- C:\Windows\System\dGvNbvt.exe
  C:\Windows\System\dGvNbvt.exe
  2⤵
  PID:13636
- C:\Windows\System\ShvizWe.exe
  C:\Windows\System\ShvizWe.exe
  2⤵
  PID:13664
- C:\Windows\System\bnNWdrr.exe
  C:\Windows\System\bnNWdrr.exe
  2⤵
  PID:13696
- C:\Windows\System\OLRArax.exe
  C:\Windows\System\OLRArax.exe
  2⤵
  PID:13724
- C:\Windows\System\KnptZPK.exe
  C:\Windows\System\KnptZPK.exe
  2⤵
  PID:13760
- C:\Windows\System\CbwKeVI.exe
  C:\Windows\System\CbwKeVI.exe
  2⤵
  PID:13792
- C:\Windows\System\ILRduVX.exe
  C:\Windows\System\ILRduVX.exe
  2⤵
  PID:13820
- C:\Windows\System\SxgvUnC.exe
  C:\Windows\System\SxgvUnC.exe
  2⤵
  PID:13848
- C:\Windows\System\vVodDyS.exe
  C:\Windows\System\vVodDyS.exe
  2⤵
  PID:13876
- C:\Windows\System\iyXufBl.exe
  C:\Windows\System\iyXufBl.exe
  2⤵
  PID:13904
- C:\Windows\System\xTECBmU.exe
  C:\Windows\System\xTECBmU.exe
  2⤵
  PID:13932
- C:\Windows\System\blLECSv.exe
  C:\Windows\System\blLECSv.exe
  2⤵
  PID:13960
- C:\Windows\System\ogkaaQc.exe
  C:\Windows\System\ogkaaQc.exe
  2⤵
  PID:13992
- C:\Windows\System\TzAMvOc.exe
  C:\Windows\System\TzAMvOc.exe
  2⤵
  PID:14024
- C:\Windows\System\izivGdu.exe
  C:\Windows\System\izivGdu.exe
  2⤵
  PID:14052
- C:\Windows\System\ZbkBOyH.exe
  C:\Windows\System\ZbkBOyH.exe
  2⤵
  PID:14080
- C:\Windows\System\NmbGOOk.exe
  C:\Windows\System\NmbGOOk.exe
  2⤵
  PID:14108
- C:\Windows\System\xDrJVBW.exe
  C:\Windows\System\xDrJVBW.exe
  2⤵
  PID:14136
- C:\Windows\System\tmAUSgc.exe
  C:\Windows\System\tmAUSgc.exe
  2⤵
  PID:14164
- C:\Windows\System\TNjdmTx.exe
  C:\Windows\System\TNjdmTx.exe
  2⤵
  PID:14192
- C:\Windows\System\xDCJTrn.exe
  C:\Windows\System\xDCJTrn.exe
  2⤵
  PID:14248
- C:\Windows\System\SyTCHmr.exe
  C:\Windows\System\SyTCHmr.exe
  2⤵
  PID:14276
- C:\Windows\System\gxRNVEW.exe
  C:\Windows\System\gxRNVEW.exe
  2⤵
  PID:14304
- C:\Windows\System\mQECvuW.exe
  C:\Windows\System\mQECvuW.exe
  2⤵
  PID:13252
- C:\Windows\System\QviOmhB.exe
  C:\Windows\System\QviOmhB.exe
  2⤵
  PID:3080
- C:\Windows\System\NajNmPn.exe
  C:\Windows\System\NajNmPn.exe
  2⤵
  PID:13368
- C:\Windows\System\IWkvPgG.exe
  C:\Windows\System\IWkvPgG.exe
  2⤵
  PID:13428
- C:\Windows\System\BKWKfVN.exe
  C:\Windows\System\BKWKfVN.exe
  2⤵
  PID:13500
- C:\Windows\System\vMvklhI.exe
  C:\Windows\System\vMvklhI.exe
  2⤵
  PID:13572
- C:\Windows\System\wTFpOwK.exe
  C:\Windows\System\wTFpOwK.exe
  2⤵
  PID:13628
- C:\Windows\System\vYJIbLo.exe
  C:\Windows\System\vYJIbLo.exe
  2⤵
  PID:13692
- C:\Windows\System\ehJssLU.exe
  C:\Windows\System\ehJssLU.exe
  2⤵
  PID:13780
- C:\Windows\System\iFBfNfj.exe
  C:\Windows\System\iFBfNfj.exe
  2⤵
  PID:13840
- C:\Windows\System\rGSBOgo.exe
  C:\Windows\System\rGSBOgo.exe
  2⤵
  PID:13900
- C:\Windows\System\SvlkYKQ.exe
  C:\Windows\System\SvlkYKQ.exe
  2⤵
  PID:13956
- C:\Windows\System\TuOjbQx.exe
  C:\Windows\System\TuOjbQx.exe
  2⤵
  PID:14044
- C:\Windows\System\fYITIBz.exe
  C:\Windows\System\fYITIBz.exe
  2⤵
  PID:14104
- C:\Windows\System\EZvLKvU.exe
  C:\Windows\System\EZvLKvU.exe
  2⤵
  PID:14180
- C:\Windows\System\ONoHECG.exe
  C:\Windows\System\ONoHECG.exe
  2⤵
  PID:14264
- C:\Windows\System\sTbOHsW.exe
  C:\Windows\System\sTbOHsW.exe
  2⤵
  PID:14332
- C:\Windows\System\cEvsFtu.exe
  C:\Windows\System\cEvsFtu.exe
  2⤵
  PID:13396
- C:\Windows\System\SzXvIWu.exe
  C:\Windows\System\SzXvIWu.exe
  2⤵
  PID:12548
- C:\Windows\System\wpTbfca.exe
  C:\Windows\System\wpTbfca.exe
  2⤵
  PID:13808
- C:\Windows\System\fhakSNa.exe
  C:\Windows\System\fhakSNa.exe
  2⤵
  PID:13948
- C:\Windows\System\dVxswXh.exe
  C:\Windows\System\dVxswXh.exe
  2⤵
  PID:14100
- C:\Windows\System\ZelHeSg.exe
  C:\Windows\System\ZelHeSg.exe
  2⤵
  PID:14296
- C:\Windows\System\dvSmClk.exe
  C:\Windows\System\dvSmClk.exe
  2⤵
  PID:13568
- C:\Windows\System\aUhOujY.exe
  C:\Windows\System\aUhOujY.exe
  2⤵
  PID:13896
- C:\Windows\System\rwuZtKd.exe
  C:\Windows\System\rwuZtKd.exe
  2⤵
  PID:13752
- C:\Windows\System\qmmDNan.exe
  C:\Windows\System\qmmDNan.exe
  2⤵
  PID:14208
- C:\Windows\System\IRusSFB.exe
  C:\Windows\System\IRusSFB.exe
  2⤵
  PID:14344
- C:\Windows\System\zkrAOLK.exe
  C:\Windows\System\zkrAOLK.exe
  2⤵
  PID:14372
- C:\Windows\System\nZILnha.exe
  C:\Windows\System\nZILnha.exe
  2⤵
  PID:14400
- C:\Windows\System\JTmVdaQ.exe
  C:\Windows\System\JTmVdaQ.exe
  2⤵
  PID:14428
- C:\Windows\System\lkntXuT.exe
  C:\Windows\System\lkntXuT.exe
  2⤵
  PID:14456
- C:\Windows\System\mmTUDtJ.exe
  C:\Windows\System\mmTUDtJ.exe
  2⤵
  PID:14484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\APKnRko.exe

Filesize
2.3MB

MD5
a581610e440c513786e1e44ebcb53f66

SHA1
b444c4b11908a357c8e0266be6f490370cd0eeb6

SHA256
4530eae94f14a756ebbc20da1c1741853f64511f779951ffc52c43ca8ec0e0a5

SHA512
762e4126c24c35ab7d75950568331be4adb747c2d228eba539b92d6a66679dfc0d072e837d1689a68ff14801fd59d367106c1e49fc85628b7cd53c4deca24c29

Download Submit
C:\Windows\System\DVvgsKu.exe

Filesize
2.3MB

MD5
5bdc34e2f43193455942ad59dd954ad9

SHA1
92df4af80cf27f54d5bbb322cf287e2f9d514066

SHA256
e5de7f45ac3cf025b2aee09152ca7d7330026f3cfa62077561cc85f2f19efa48

SHA512
5e03ce17eb5d5920e414b05d0649321765af4d38afea45f8c3290d929b0df88b1cb8938574ad008e0ac4d6b201f205d108424bda09544a538ed3e682e951ca9c

Download Submit
C:\Windows\System\HQwSAKk.exe

Filesize
2.3MB

MD5
1c4b2541d47aa9e317488d4ef956c870

SHA1
cbdfd9584cae9e89443289d3aa4df12457c11d54

SHA256
bcd4cd6abbf28405796f5404519043ce6381b8dd411909090ac7dc913d791679

SHA512
59dc28c17f4e85ea371cdff73ed6585d67ad3215459fe80c89718b56fec021d9bfe6c5e9fd6d87d6b5d20d78ddbde7d33e356f209bfc56930887c6a816651d71

Download Submit
C:\Windows\System\HmvbWXe.exe

Filesize
2.3MB

MD5
f6e84475dcf8767dfd2b7c5469585891

SHA1
678b60eb96b61bd3ac4a82a829a7e80265fa7f34

SHA256
a85e155f2bf2ff8aa202cb0579bdcb87f87c7348d785ce3b52235033eabd55ca

SHA512
c9e670b3869c1e7a084c5e8fe849d949918e77e40835b2e3b26a36c8cb95efcd948792663fc7eaddfcbdf872b4d2f3e3b2aa7500ffe4f04537d23dd3d1f2ab48

Download Submit
C:\Windows\System\IIutowX.exe

Filesize
2.3MB

MD5
8c95875d1bca72e2b3c3690d24b282ee

SHA1
4c4db59f12414a468d475ed0c12eb12807002f91

SHA256
674acba00f2ed7b9335298461b3ce999530548969bfc567190aa26330837f40c

SHA512
48dcb0f269ce7e192216e79a9c13843c50acd2c1a801fdc78db072804a65d0cd3a16e681aff79a7ee362562ba5461ac4747c55622452427b04d08486f5cd91a3

Download Submit
C:\Windows\System\IgLXeWW.exe

Filesize
2.3MB

MD5
1ffa3329b3b4d92f65cf7baeda16add6

SHA1
7a39da2e0a6c8e751840606c83b3c636a2b96636

SHA256
4a059d8b5f6567c8a30a3419475b0af562b5886b0f83d7bff49b108c45ee3915

SHA512
39a5a3cd0fc3f3fcfe8c60c3d78d3bf1a860607c766260bb3b67557b5a368c07a91d27c84c2aab13c2371e7aa159b8e70306483bcc24a1e059c640c87e9d115e

Download Submit
C:\Windows\System\LSsrxxE.exe

Filesize
2.3MB

MD5
e9526c35dbec8967deeb7ce5aa73f808

SHA1
12adadf87be857826fd0d044292c1b038e1d1c90

SHA256
1a3ee74f7b1961ae072c52a70110c0f49d02e71144679fe3157d8399b7ba4691

SHA512
3f95af647037778828ba42dd91af071c56cb8824776a3a39b37346dc64fc2580be66b3a4a3ccd80ed6e0e7c383c2b7bf9f4ebd096a2b840a71d8e56b1c64064c

Download Submit
C:\Windows\System\LlUwzxj.exe

Filesize
2.3MB

MD5
c619b7ced3aa005f7314a854a23ba915

SHA1
b382dca412ea088767d92818c8cf967c1ce45045

SHA256
9d1edc7883a1fa279ffcda67756852068c837a8edaf8161d6c611df29abed4a8

SHA512
ae48ab328f6efc7d010dbe429650879d9614189f4c8f08d326e602c98ce838a814384b3c94514dd275836801ebc96608cc44da1dfc59b045389566df8662ffff

Download Submit
C:\Windows\System\MsIQBts.exe

Filesize
2.3MB

MD5
0c853618f267b54978f1d793e348513c

SHA1
d9895d6858e632d062aa84ae3bf1ff4b110f8238

SHA256
a5a68cac8166ee393af555cf13049679b9dbac270fbb7ffe738f73fbd1091c1e

SHA512
fba815da0498e8c43c606fdfc623754b579891ea832b70f66ee53eee6572bf2672be8214d8e6bb234028980f14cd91766da0db3f9ba96cbf0ff3364f8de76545

Download Submit
C:\Windows\System\OBqfUHH.exe

Filesize
2.3MB

MD5
c29615bb6d1faff703089af4ddd7b748

SHA1
4a95f91e9e078f9dae4c4bd9d49e15e4c3fd7bb8

SHA256
5d0062db3917ab51f7c3f8658c21ab63f9fd1286bbd1d4a74e688d221a29dfd5

SHA512
b60faf644e9b7d1ecbbb8af43fd4300744fb89935db08899319d91e4c9e4eef0e56561bf1869eb8f56efbe2e495b6e2e2a349b5ea88fba1703dcac494eab86bb

Download Submit
C:\Windows\System\OxAcAqZ.exe

Filesize
2.3MB

MD5
1dbfeb8f181ea6ac62ed0375de07c8e2

SHA1
1b3c33c110117d8b56aa2cadc14741f8dd91fcf1

SHA256
46515bf85304f255bac2b004b1497100fa5ea4b5ad8d4bf6132f4e2e8203bfdb

SHA512
212638beacc85140d358046db3dd86132a9819811edba6b1c5f1a183c6a906f929f7e1518ac9c9065bc8568c27e2ec7a2c9b7cba036ce4301b625fa74500241a

Download Submit
C:\Windows\System\RnaeeUO.exe

Filesize
2.3MB

MD5
2a2e53f8f3c6324c95faa25ef3361a94

SHA1
f526355d99588236a3812c440feab53bdf8d275b

SHA256
e2e5db0dee9370a29301d9b870905b67c8419e4cab7dc44690cdc98045bde3e5

SHA512
a948a4188d89a09ce8b0bc11947893c986ec7ac6d4c7dbc26b4b525f33b767964adac634589c52e5d0720637665ce5571f002a97dc059e8bf37b591acc2b641b

Download Submit
C:\Windows\System\VYsGVZQ.exe

Filesize
2.3MB

MD5
636642e1d442d2b871299aa7593fc664

SHA1
d235b40ac48f29666b26ba12c79ed74fac63515c

SHA256
4c54d29dd2933423893fa9cf12172f3fc20eed93d50349fcd7fe1437199279e8

SHA512
adcf77c2381111463a85ade697e5cd1392c0227cccc48555fde2a160c3d77895b086e3f4ddb54395fca9c51d25a073ee11824342190cce599764ce5330bb1bc4

Download Submit
C:\Windows\System\ZtWgvzI.exe

Filesize
2.3MB

MD5
5c62f32a66d10c7894070c4902cdfbb9

SHA1
826f11cceb9e413ca0202e90d4da00059c77f2ab

SHA256
24ef4df3a77ef20d9c23ff30ce5088eec0b41ea76a7c4ae49efc048aa66b3c01

SHA512
a91d6d9fe488d3bd4aecb87414e3e56dfeb2f089e39595cc8bb2fb322d7d5bc1a0a68d4c16f31c7f74d053e3817583ecf6926184ccf88c97a9029eab708e7109

Download Submit
C:\Windows\System\acqHrFC.exe

Filesize
2.3MB

MD5
61ae5b7d539fe6ec6a6dc00c3d3a0f6c

SHA1
0c2ab20cd473bf6284f0a75555c525f9432db3bc

SHA256
b43d883a238b6691e873b9e095f6def262be37171038998e6824b33d46b2c9be

SHA512
b5b42303337e200d91d2d41252dc77b26436bfce66cf8149bf2234b54489f222b6ab1241a6f17c2c8cebb248d7f89f3605f288fc201f3a0529cab5531a607312

Download Submit
C:\Windows\System\bpeMdUM.exe

Filesize
2.3MB

MD5
f35976278051320a84e033c9888a9706

SHA1
2dfc08d0345b034b22a28c4bf0b78660c719fdb7

SHA256
6d508aabb6d9bd7ea7fbf61b49e5887eeefebab792829f2ebea4c7b0e68372b7

SHA512
6abe42299ffbbca4cf5692f6a9e13d8af9a1dca6f8f8d5539c3422aed5fca4da480b97dbd59e0538510f3ee08ce0254b0343cb5efdf82361949f0a371269d879

Download Submit
C:\Windows\System\cRnveXS.exe

Filesize
2.3MB

MD5
b05aa254eca5560608ccabbe1ce29a5e

SHA1
3a19742fbf26c198f3adaf1e0387da869a078960

SHA256
9d81c9dd450d97e6eb2d05bfed4d4c46f83c713fb17507fea1e4b6a232c8afba

SHA512
403ba02f82ebb7447888a6b6b4483b55642bb09335d4cd14bfbd3647a5b06f09a160082875fd05a8bb8f67778e8c1279971ba71d4e933e37ceba1703c9147a32

Download Submit
C:\Windows\System\dStBtmi.exe

Filesize
2.3MB

MD5
66bda5b99d4801aeda6a1183de93ca7a

SHA1
db2dc980b8e56a8ad659af8d70b0b9a939ccf3c1

SHA256
69d10f474c6d2f61378b2474680141029eff24df5b5315f0aefc10d52daf4992

SHA512
17e9688aab19b4f0bbba8aeb7be73b2b9c20b33b3552a333f6b975f28a13f3985f639c72a6f1153e904fa1ffd64f2306425737edee662f94282de5b6cd7c0edc

Download Submit
C:\Windows\System\fgaYnTR.exe

Filesize
2.3MB

MD5
300e4743b55289b0a759eca7cd4bfb5a

SHA1
3fcf603d3e7bf26e11a70b57b9cd74de5d7ec7f5

SHA256
53752375e8494d435e791993a47f7ec4766fb93d0c450226cb5274b18be02e4a

SHA512
6e1891add66a627c7c1c20e212bb3dc9dab1f2ef3dc63980c91e5865b8f7a4422222663a7b9021c661e554c330200c06a489d2a9f6033b380fd0dca655dede43

Download Submit
C:\Windows\System\gUKckBi.exe

Filesize
2.3MB

MD5
90e49b7ad7cad02a6420196c9e21a093

SHA1
624a9432c5a84a4437a1f8b294c1594d57e6816d

SHA256
8c0c5f346fa71cd89e27054d1e8c940d67ed4c83b0c7a7095d2f532c1e102eb9

SHA512
ebe240b6e10747fc7d204427c5d650cd920fb5ace735a8318d8db46b82b514c1952f0e8bce5c83c4afece0e80c380d021615675ce1adf7cef46de0ada429a1ca

Download Submit
C:\Windows\System\hxCjxfF.exe

Filesize
2.3MB

MD5
5b7504b4e388524530a22eb41ac3d2c3

SHA1
b70061aa8719b624270fc94b9365c12c9969132f

SHA256
67ec74877e850c6bc224cce80517a24d6563fcb4446bf5aaa5a073907d59aeef

SHA512
e953518ad8eb8011df4520a4aaa498c6b8195b32e7676e1e1d8a25881c333309f11d386643ffec00a70a8884c59cc7f0a2fcbf944eaeddabfc964c3382f3385e

Download Submit
C:\Windows\System\iJaWYdp.exe

Filesize
2.3MB

MD5
080517bddf7db79ad7e0b65ef4e31a2e

SHA1
d547d6137152938ebc12c741ffe33ba2c2875b52

SHA256
1221492d08ad67fef821dbae70971893915ac492ab60ba6243cd5ab69a02eaf9

SHA512
d379b2244e0da6c44c6862be863b89aa92c904b1f6f9cee80894b379db7085fcf79d9291ac6e0e08ff354ef0d40ff88ee607c6897729cdc1a191fd65d6dfd289

Download Submit
C:\Windows\System\jgasvdr.exe

Filesize
2.3MB

MD5
c5f76d00062d59f7c809a6024f1fe805

SHA1
4306f28f8b7e9e3847ac3d5dfbf603cc5520c733

SHA256
9e72fbdf448890c296f72509652abb8fb67d04c911aa73d7651bc208c3110619

SHA512
187d730fa6b9ce1a15f5eff70d09cc21bba3077f92f9a4f7c462e74c8c0131dd144a7dc92263d7eac214a26831c852e4ec5bcb77fec5a8184e6b3015b87e0027

Download Submit
C:\Windows\System\ljWAgvQ.exe

Filesize
2.3MB

MD5
77c3a0b566e190c2f5e253d336f56736

SHA1
55a46012e969002f78c78bdd9c4b923d1b90387f

SHA256
3877ddf9c610b166744745deee44b7ee289983d020acc67cdcf89f2b6ee6e2ee

SHA512
a2357f38827400960393f97454031b2df8d4115131035e9232f2a5566bcdbd5956216addc29b12e0f9acd5b82fddb69934ccb4920643e6244bc80e7e5480da73

Download Submit
C:\Windows\System\mAvWTtq.exe

Filesize
2.3MB

MD5
da653b0ac1b7c0d6a2b360c067abee61

SHA1
1f492b55cc9749ae66af0441becd4ff79eabb730

SHA256
85a6a3bab93909d5ce0cfe30d82e0668f1472f94463eedd74d86267a0fb13f61

SHA512
de99b01b1f868f403269f09aed0e440b892b1d0020f491f545ca422c33a2733cdd6c1473d54446777dabde82c2dc9599680d1a130a7eecaf4443dc76620f7947

Download Submit
C:\Windows\System\mtTwHfb.exe

Filesize
2.3MB

MD5
580b508147fe9b27a142b23a3e1c512f

SHA1
c8fcf21fb3ac7886b31f45a7870912cc339fbf71

SHA256
cde372772f5337e6806b7ca45ac0c177a3d26aeccb94414610b895895bb927d2

SHA512
7c20209ecf123761945c38832a94c2fc42586fc5331ad8eb4575c7e8510fbe51bea2d898d3e43f9a113efd960e9dd36a5dcff01fcd99bfc96c9a5026ee4fa13b

Download Submit
C:\Windows\System\nwOGbpp.exe

Filesize
2.3MB

MD5
f40dc2274d799a99e226d02c15907f35

SHA1
727886b5e141e3f0b72cdf27e6a6b7d1e2ee9c2c

SHA256
6df202f8c94e527d16864d103b7595bf5c4054e44aef64d0247ba655fa474cc7

SHA512
f9f78e192e483fdac4ee33d9e18c5898270e1386f4e9795fab2cae43752cb7b144ced852035e00ead1e04e2f6fe9086f73b68a46adfb9f88040935f247cc4878

Download Submit
C:\Windows\System\pNOzPBo.exe

Filesize
2.3MB

MD5
9f8a35220d8a2e809628623a327212f9

SHA1
8fa083f54876ab016063c732ce2732a6edfc0c12

SHA256
d1846d685a0f17e4c5affc88ab8dfac143516b3fb12fa00e57b093f3ac949564

SHA512
8dd582778670832d3cf78d6b59c4b6088c56b1c0ed5c4376a13f9a32021308f70331ed8961cf313bf742eaf219d2407d345e9811bb6cbd8928401aa1a4acaf50

Download Submit
C:\Windows\System\piUenAo.exe

Filesize
2.3MB

MD5
22f3d81a6222dfbed6d41913362acedb

SHA1
0acce1c506ba1fb2274ba257975d4a5da5260173

SHA256
2d112b9a168965b07bf63620584e6b41d2265dd860ddfdbe1369f66c4264f9f1

SHA512
1cee444ace9e149d70ae07c617fd48a0a3d4f4e11794714d91e2eaf9936bb1e53d15f04265fee25d93a0db81f26392c5b2ad92f026b009626114fdcadffa3321

Download Submit
C:\Windows\System\qCBXzzC.exe

Filesize
2.3MB

MD5
d876d5de583a95a10817f47b028c7cde

SHA1
5878fad82cd0337493edb6b6de85046d87bcd047

SHA256
2fbffcad5a9ac674ac2f91ff23c8f9ee2c2778368f80b7cf60c16f5970d7edf6

SHA512
1d53ca531c95711c62bc60c3acb21a4f5487777cd4b8954ab0aa64f62097f35a975d7b2d1c65710901fdf1e1b8bbba907405e3a6fb1ea63a46bcee2fd0d9d8b0

Download Submit
C:\Windows\System\sdzMJAg.exe

Filesize
2.3MB

MD5
cc9b9c6ae3f64b177514101aae5bf8be

SHA1
e6d5ea51ee2c23a9026542b0d4e8a25be8b43f5a

SHA256
8633528a1c8c6560b936262bb7be0dd66ef931fe7752e7aee412b2ca245d3456

SHA512
2015004e272240e979ec3a83fa5b0223029507a688a41a0cba9cde374642b9afc61c1b1f47400c5c2d7b23db07601746a10cf4a973a0e826fea5781d10750e31

Download Submit
C:\Windows\System\vNpWIgL.exe

Filesize
2.3MB

MD5
0e34bfa80b3e13722c633bc6005f915a

SHA1
9bdddc80847af643aa602b727040268c530f3316

SHA256
bf28c7288f523056bdb7cd0d6404ac672523d442111bf2e3717cadae2964bf8a

SHA512
76b43415042ff43bf94311c9c53f6b9583f04d1effdb3d2021a771ea58e302187e5e9bdc07f0450f0d4def4731c1ee72f7dd44e6f93e5d1fdf1f8c1074c3b740

Download Submit
C:\Windows\System\zjWQoxu.exe

Filesize
2.3MB

MD5
11918407cbbe22e4db8f7fca254abda2

SHA1
e1f02fa5784f3c1e17a37df77e179159ecb23261

SHA256
ba39ce9020922f923f63e8e16d2ac6a35c407478248b026a34058e28608953ab

SHA512
084bff21f5553c3a89dac1792ecd7016d6d3a766f023dd382988c49044140850dd26bf7156726fa96a8f124c8a10134a5745c6ea2573d1bbab0f1cbb0fb90ae3

Download Submit
memory/532-816-0x00007FF764320000-0x00007FF764674000-memory.dmp

Filesize
3.3MB

Download
memory/532-2077-0x00007FF764320000-0x00007FF764674000-memory.dmp

Filesize
3.3MB

Download
memory/656-2083-0x00007FF7B1B80000-0x00007FF7B1ED4000-memory.dmp

Filesize
3.3MB

Download
memory/656-831-0x00007FF7B1B80000-0x00007FF7B1ED4000-memory.dmp

Filesize
3.3MB

Download
memory/848-2070-0x00007FF776F70000-0x00007FF7772C4000-memory.dmp

Filesize
3.3MB

Download
memory/848-751-0x00007FF776F70000-0x00007FF7772C4000-memory.dmp

Filesize
3.3MB

Download
memory/876-2063-0x00007FF656C60000-0x00007FF656FB4000-memory.dmp

Filesize
3.3MB

Download
memory/876-2058-0x00007FF656C60000-0x00007FF656FB4000-memory.dmp

Filesize
3.3MB

Download
memory/876-37-0x00007FF656C60000-0x00007FF656FB4000-memory.dmp

Filesize
3.3MB

Download
memory/932-13-0x00007FF7B6790000-0x00007FF7B6AE4000-memory.dmp

Filesize
3.3MB

Download
memory/932-2060-0x00007FF7B6790000-0x00007FF7B6AE4000-memory.dmp

Filesize
3.3MB

Download
memory/1064-16-0x00007FF7AC090000-0x00007FF7AC3E4000-memory.dmp

Filesize
3.3MB

Download
memory/1064-2061-0x00007FF7AC090000-0x00007FF7AC3E4000-memory.dmp

Filesize
3.3MB

Download
memory/1144-2082-0x00007FF749390000-0x00007FF7496E4000-memory.dmp

Filesize
3.3MB

Download
memory/1144-768-0x00007FF749390000-0x00007FF7496E4000-memory.dmp

Filesize
3.3MB

Download
memory/1548-762-0x00007FF664EA0000-0x00007FF6651F4000-memory.dmp

Filesize
3.3MB

Download
memory/1548-2072-0x00007FF664EA0000-0x00007FF6651F4000-memory.dmp

Filesize
3.3MB

Download
memory/1856-2084-0x00007FF6AF1C0000-0x00007FF6AF514000-memory.dmp

Filesize
3.3MB

Download
memory/1856-795-0x00007FF6AF1C0000-0x00007FF6AF514000-memory.dmp

Filesize
3.3MB

Download
memory/2244-2086-0x00007FF674190000-0x00007FF6744E4000-memory.dmp

Filesize
3.3MB

Download
memory/2244-784-0x00007FF674190000-0x00007FF6744E4000-memory.dmp

Filesize
3.3MB

Download
memory/2456-810-0x00007FF6B6B60000-0x00007FF6B6EB4000-memory.dmp

Filesize
3.3MB

Download
memory/2456-2079-0x00007FF6B6B60000-0x00007FF6B6EB4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-828-0x00007FF755D80000-0x00007FF7560D4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-2075-0x00007FF755D80000-0x00007FF7560D4000-memory.dmp

Filesize
3.3MB

Download
memory/2900-798-0x00007FF665520000-0x00007FF665874000-memory.dmp

Filesize
3.3MB

Download
memory/2900-2080-0x00007FF665520000-0x00007FF665874000-memory.dmp

Filesize
3.3MB

Download
memory/2984-2062-0x00007FF7093D0000-0x00007FF709724000-memory.dmp

Filesize
3.3MB

Download
memory/2984-2059-0x00007FF7093D0000-0x00007FF709724000-memory.dmp

Filesize
3.3MB

Download
memory/2984-23-0x00007FF7093D0000-0x00007FF709724000-memory.dmp

Filesize
3.3MB

Download
memory/3004-2088-0x00007FF767C90000-0x00007FF767FE4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-778-0x00007FF767C90000-0x00007FF767FE4000-memory.dmp

Filesize
3.3MB

Download
memory/3116-755-0x00007FF6D9D40000-0x00007FF6DA094000-memory.dmp

Filesize
3.3MB

Download
memory/3116-2069-0x00007FF6D9D40000-0x00007FF6DA094000-memory.dmp

Filesize
3.3MB

Download
memory/3128-2081-0x00007FF74D2E0000-0x00007FF74D634000-memory.dmp

Filesize
3.3MB

Download
memory/3128-774-0x00007FF74D2E0000-0x00007FF74D634000-memory.dmp

Filesize
3.3MB

Download
memory/3508-747-0x00007FF7229D0000-0x00007FF722D24000-memory.dmp

Filesize
3.3MB

Download
memory/3508-2066-0x00007FF7229D0000-0x00007FF722D24000-memory.dmp

Filesize
3.3MB

Download
memory/3572-763-0x00007FF694BA0000-0x00007FF694EF4000-memory.dmp

Filesize
3.3MB

Download
memory/3572-2073-0x00007FF694BA0000-0x00007FF694EF4000-memory.dmp

Filesize
3.3MB

Download
memory/3752-833-0x00007FF68DD50000-0x00007FF68E0A4000-memory.dmp

Filesize
3.3MB

Download
memory/3752-2074-0x00007FF68DD50000-0x00007FF68E0A4000-memory.dmp

Filesize
3.3MB

Download
memory/3908-789-0x00007FF7A2510000-0x00007FF7A2864000-memory.dmp

Filesize
3.3MB

Download
memory/3908-2085-0x00007FF7A2510000-0x00007FF7A2864000-memory.dmp

Filesize
3.3MB

Download
memory/4080-2065-0x00007FF6DCF00000-0x00007FF6DD254000-memory.dmp

Filesize
3.3MB

Download
memory/4080-746-0x00007FF6DCF00000-0x00007FF6DD254000-memory.dmp

Filesize
3.3MB

Download
memory/4148-2064-0x00007FF651470000-0x00007FF6517C4000-memory.dmp

Filesize
3.3MB

Download
memory/4148-835-0x00007FF651470000-0x00007FF6517C4000-memory.dmp

Filesize
3.3MB

Download
memory/4252-1-0x000002AC2D3A0000-0x000002AC2D3B0000-memory.dmp

Filesize
64KB

Download
memory/4252-0-0x00007FF648260000-0x00007FF6485B4000-memory.dmp

Filesize
3.3MB

Download
memory/4540-2076-0x00007FF7A45E0000-0x00007FF7A4934000-memory.dmp

Filesize
3.3MB

Download
memory/4540-819-0x00007FF7A45E0000-0x00007FF7A4934000-memory.dmp

Filesize
3.3MB

Download
memory/4812-779-0x00007FF76B690000-0x00007FF76B9E4000-memory.dmp

Filesize
3.3MB

Download
memory/4812-2087-0x00007FF76B690000-0x00007FF76B9E4000-memory.dmp

Filesize
3.3MB

Download
memory/4880-749-0x00007FF6C1BF0000-0x00007FF6C1F44000-memory.dmp

Filesize
3.3MB

Download
memory/4880-2068-0x00007FF6C1BF0000-0x00007FF6C1F44000-memory.dmp

Filesize
3.3MB

Download
memory/4896-750-0x00007FF7ABD10000-0x00007FF7AC064000-memory.dmp

Filesize
3.3MB

Download
memory/4896-2071-0x00007FF7ABD10000-0x00007FF7AC064000-memory.dmp

Filesize
3.3MB

Download
memory/5000-748-0x00007FF6ADB40000-0x00007FF6ADE94000-memory.dmp

Filesize
3.3MB

Download
memory/5000-2067-0x00007FF6ADB40000-0x00007FF6ADE94000-memory.dmp

Filesize
3.3MB

Download
memory/5024-2078-0x00007FF757850000-0x00007FF757BA4000-memory.dmp

Filesize
3.3MB

Download
memory/5024-813-0x00007FF757850000-0x00007FF757BA4000-memory.dmp

Filesize
3.3MB

Download