xmrig | cefc8b74e939f216ed40f0f8832e3e0254a5a28bd6dbeb314605f89e763a4a7d

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 10:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
Size

2.2MB
MD5

5c294866afb6e1b3329fce4b60bd8360
SHA1

3f11f1eda83465a64dd7098ee20439ff572812e0
SHA256

cefc8b74e939f216ed40f0f8832e3e0254a5a28bd6dbeb314605f89e763a4a7d
SHA512

2b10dbcaed54dc5f2363425eede6e83158a095de9c3ae58c97ddd3b3c508e04ce7815894e406f068344bf8e40419d2fc0bd2cfbd6da5b32b74670823735939df
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIXGvAnCumyaGs2L:oemTLkNdfE0pZr3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4484-0-0x00007FF6C7860000-0x00007FF6C7BB4000-memory.dmp	xmrig
behavioral2/files/0x000a00000002341d-8.dat	xmrig
behavioral2/files/0x000700000002342b-7.dat	xmrig
behavioral2/files/0x000700000002342a-17.dat	xmrig
behavioral2/memory/4700-20-0x00007FF7FF810000-0x00007FF7FFB64000-memory.dmp	xmrig
behavioral2/memory/2572-21-0x00007FF76D090000-0x00007FF76D3E4000-memory.dmp	xmrig
behavioral2/memory/3252-10-0x00007FF750250000-0x00007FF7505A4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-23.dat	xmrig
behavioral2/files/0x0008000000023427-36.dat	xmrig
behavioral2/files/0x000700000002342f-42.dat	xmrig
behavioral2/memory/1208-56-0x00007FF68E010000-0x00007FF68E364000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-70.dat	xmrig
behavioral2/files/0x0007000000023436-87.dat	xmrig
behavioral2/files/0x0007000000023439-101.dat	xmrig
behavioral2/files/0x000700000002343b-112.dat	xmrig
behavioral2/files/0x0007000000023440-137.dat	xmrig
behavioral2/files/0x0007000000023444-157.dat	xmrig
behavioral2/files/0x0007000000023447-171.dat	xmrig
behavioral2/files/0x0007000000023446-167.dat	xmrig
behavioral2/files/0x0007000000023445-162.dat	xmrig
behavioral2/files/0x0007000000023443-152.dat	xmrig
behavioral2/files/0x0007000000023442-144.dat	xmrig
behavioral2/files/0x0007000000023441-142.dat	xmrig
behavioral2/files/0x000700000002343f-132.dat	xmrig
behavioral2/files/0x000700000002343e-127.dat	xmrig
behavioral2/files/0x000700000002343d-122.dat	xmrig
behavioral2/files/0x000700000002343c-117.dat	xmrig
behavioral2/files/0x000700000002343a-107.dat	xmrig
behavioral2/files/0x0007000000023438-97.dat	xmrig
behavioral2/files/0x0007000000023437-91.dat	xmrig
behavioral2/files/0x0007000000023435-81.dat	xmrig
behavioral2/files/0x0007000000023434-74.dat	xmrig
behavioral2/files/0x0007000000023431-72.dat	xmrig
behavioral2/files/0x0007000000023432-68.dat	xmrig
behavioral2/files/0x0007000000023430-66.dat	xmrig
behavioral2/files/0x000700000002342d-53.dat	xmrig
behavioral2/memory/3540-49-0x00007FF657C80000-0x00007FF657FD4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-45.dat	xmrig
behavioral2/memory/1468-41-0x00007FF644460000-0x00007FF6447B4000-memory.dmp	xmrig
behavioral2/memory/1960-38-0x00007FF6A4000000-0x00007FF6A4354000-memory.dmp	xmrig
behavioral2/memory/320-30-0x00007FF6F1350000-0x00007FF6F16A4000-memory.dmp	xmrig
behavioral2/memory/5088-687-0x00007FF765F20000-0x00007FF766274000-memory.dmp	xmrig
behavioral2/memory/2852-686-0x00007FF632790000-0x00007FF632AE4000-memory.dmp	xmrig
behavioral2/memory/4064-688-0x00007FF7D4DA0000-0x00007FF7D50F4000-memory.dmp	xmrig
behavioral2/memory/2988-690-0x00007FF6907F0000-0x00007FF690B44000-memory.dmp	xmrig
behavioral2/memory/4360-691-0x00007FF723330000-0x00007FF723684000-memory.dmp	xmrig
behavioral2/memory/1528-693-0x00007FF77B850000-0x00007FF77BBA4000-memory.dmp	xmrig
behavioral2/memory/628-692-0x00007FF7A49A0000-0x00007FF7A4CF4000-memory.dmp	xmrig
behavioral2/memory/2152-689-0x00007FF7D2640000-0x00007FF7D2994000-memory.dmp	xmrig
behavioral2/memory/4556-704-0x00007FF6C17C0000-0x00007FF6C1B14000-memory.dmp	xmrig
behavioral2/memory/1252-701-0x00007FF66CDA0000-0x00007FF66D0F4000-memory.dmp	xmrig
behavioral2/memory/2592-698-0x00007FF66AD60000-0x00007FF66B0B4000-memory.dmp	xmrig
behavioral2/memory/400-717-0x00007FF605F70000-0x00007FF6062C4000-memory.dmp	xmrig
behavioral2/memory/1004-718-0x00007FF786CB0000-0x00007FF787004000-memory.dmp	xmrig
behavioral2/memory/1728-724-0x00007FF700160000-0x00007FF7004B4000-memory.dmp	xmrig
behavioral2/memory/1476-725-0x00007FF61FA40000-0x00007FF61FD94000-memory.dmp	xmrig
behavioral2/memory/464-729-0x00007FF615260000-0x00007FF6155B4000-memory.dmp	xmrig
behavioral2/memory/1580-733-0x00007FF6B1580000-0x00007FF6B18D4000-memory.dmp	xmrig
behavioral2/memory/2052-741-0x00007FF6640D0000-0x00007FF664424000-memory.dmp	xmrig
behavioral2/memory/4856-737-0x00007FF776CD0000-0x00007FF777024000-memory.dmp	xmrig
behavioral2/memory/2996-734-0x00007FF7D6100000-0x00007FF7D6454000-memory.dmp	xmrig
behavioral2/memory/4240-710-0x00007FF61BD40000-0x00007FF61C094000-memory.dmp	xmrig
behavioral2/memory/4484-2010-0x00007FF6C7860000-0x00007FF6C7BB4000-memory.dmp	xmrig
behavioral2/memory/320-2178-0x00007FF6F1350000-0x00007FF6F16A4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3252	vwnnUur.exe
4700	jpMEFFH.exe
2572	PmVpqPK.exe
320	uzbqDZS.exe
1960	LQggxvz.exe
3540	MTogzDF.exe
1468	yRBWRgz.exe
2852	NXvDOwU.exe
1208	IwmwUeG.exe
4064	kjqSiMB.exe
5088	lJMzXuG.exe
2052	DUXZQmh.exe
2152	EQLkvoi.exe
2988	YdCHnfF.exe
4360	KpPlLVA.exe
628	pZqUtEI.exe
1528	pdaoxUv.exe
2592	TuaSMGx.exe
1252	bauRbfS.exe
4556	PnBnAcu.exe
4240	lEZDyFi.exe
400	szqrGiX.exe
1004	byeWsUV.exe
1728	LoaUvLw.exe
1476	FwrPHjJ.exe
464	rPUdfYn.exe
1580	twOhADs.exe
2996	vptXwPJ.exe
4856	YLoxnKu.exe
3064	mfDaVgN.exe
448	DEYhPGN.exe
1956	acxiqPt.exe
4744	aQFTcGv.exe
3104	WzuFAYm.exe
3648	SZfFiYb.exe
468	kSZhqCp.exe
1132	kTbUnbn.exe
2556	NpVEKjR.exe
4224	WgMJnJS.exe
2488	Eaxrudk.exe
3516	FczBzBG.exe
1356	DgPUTTe.exe
2596	yChNeVE.exe
948	oyjylsI.exe
952	QPvkdhN.exe
4876	AOAEohD.exe
924	myXIMbN.exe
816	LGQzdYi.exe
1764	LXEisAr.exe
1672	qUFBhqR.exe
3740	neKkSZB.exe
2660	IWoysWb.exe
3148	ErDpoWJ.exe
60	rvLRApA.exe
4792	PQDFxWz.exe
2624	fHgKihs.exe
3364	khpuPBa.exe
228	jfmUOep.exe
5112	abMfWZQ.exe
1540	PoztBYd.exe
3792	MeBkHgK.exe
740	yzIeYOS.exe
4116	EcdPkgP.exe
4164	jBpDqUO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4484-0-0x00007FF6C7860000-0x00007FF6C7BB4000-memory.dmp	upx
behavioral2/files/0x000a00000002341d-8.dat	upx
behavioral2/files/0x000700000002342b-7.dat	upx
behavioral2/files/0x000700000002342a-17.dat	upx
behavioral2/memory/4700-20-0x00007FF7FF810000-0x00007FF7FFB64000-memory.dmp	upx
behavioral2/memory/2572-21-0x00007FF76D090000-0x00007FF76D3E4000-memory.dmp	upx
behavioral2/memory/3252-10-0x00007FF750250000-0x00007FF7505A4000-memory.dmp	upx
behavioral2/files/0x000700000002342c-23.dat	upx
behavioral2/files/0x0008000000023427-36.dat	upx
behavioral2/files/0x000700000002342f-42.dat	upx
behavioral2/memory/1208-56-0x00007FF68E010000-0x00007FF68E364000-memory.dmp	upx
behavioral2/files/0x0007000000023433-70.dat	upx
behavioral2/files/0x0007000000023436-87.dat	upx
behavioral2/files/0x0007000000023439-101.dat	upx
behavioral2/files/0x000700000002343b-112.dat	upx
behavioral2/files/0x0007000000023440-137.dat	upx
behavioral2/files/0x0007000000023444-157.dat	upx
behavioral2/files/0x0007000000023447-171.dat	upx
behavioral2/files/0x0007000000023446-167.dat	upx
behavioral2/files/0x0007000000023445-162.dat	upx
behavioral2/files/0x0007000000023443-152.dat	upx
behavioral2/files/0x0007000000023442-144.dat	upx
behavioral2/files/0x0007000000023441-142.dat	upx
behavioral2/files/0x000700000002343f-132.dat	upx
behavioral2/files/0x000700000002343e-127.dat	upx
behavioral2/files/0x000700000002343d-122.dat	upx
behavioral2/files/0x000700000002343c-117.dat	upx
behavioral2/files/0x000700000002343a-107.dat	upx
behavioral2/files/0x0007000000023438-97.dat	upx
behavioral2/files/0x0007000000023437-91.dat	upx
behavioral2/files/0x0007000000023435-81.dat	upx
behavioral2/files/0x0007000000023434-74.dat	upx
behavioral2/files/0x0007000000023431-72.dat	upx
behavioral2/files/0x0007000000023432-68.dat	upx
behavioral2/files/0x0007000000023430-66.dat	upx
behavioral2/files/0x000700000002342d-53.dat	upx
behavioral2/memory/3540-49-0x00007FF657C80000-0x00007FF657FD4000-memory.dmp	upx
behavioral2/files/0x000700000002342e-45.dat	upx
behavioral2/memory/1468-41-0x00007FF644460000-0x00007FF6447B4000-memory.dmp	upx
behavioral2/memory/1960-38-0x00007FF6A4000000-0x00007FF6A4354000-memory.dmp	upx
behavioral2/memory/320-30-0x00007FF6F1350000-0x00007FF6F16A4000-memory.dmp	upx
behavioral2/memory/5088-687-0x00007FF765F20000-0x00007FF766274000-memory.dmp	upx
behavioral2/memory/2852-686-0x00007FF632790000-0x00007FF632AE4000-memory.dmp	upx
behavioral2/memory/4064-688-0x00007FF7D4DA0000-0x00007FF7D50F4000-memory.dmp	upx
behavioral2/memory/2988-690-0x00007FF6907F0000-0x00007FF690B44000-memory.dmp	upx
behavioral2/memory/4360-691-0x00007FF723330000-0x00007FF723684000-memory.dmp	upx
behavioral2/memory/1528-693-0x00007FF77B850000-0x00007FF77BBA4000-memory.dmp	upx
behavioral2/memory/628-692-0x00007FF7A49A0000-0x00007FF7A4CF4000-memory.dmp	upx
behavioral2/memory/2152-689-0x00007FF7D2640000-0x00007FF7D2994000-memory.dmp	upx
behavioral2/memory/4556-704-0x00007FF6C17C0000-0x00007FF6C1B14000-memory.dmp	upx
behavioral2/memory/1252-701-0x00007FF66CDA0000-0x00007FF66D0F4000-memory.dmp	upx
behavioral2/memory/2592-698-0x00007FF66AD60000-0x00007FF66B0B4000-memory.dmp	upx
behavioral2/memory/400-717-0x00007FF605F70000-0x00007FF6062C4000-memory.dmp	upx
behavioral2/memory/1004-718-0x00007FF786CB0000-0x00007FF787004000-memory.dmp	upx
behavioral2/memory/1728-724-0x00007FF700160000-0x00007FF7004B4000-memory.dmp	upx
behavioral2/memory/1476-725-0x00007FF61FA40000-0x00007FF61FD94000-memory.dmp	upx
behavioral2/memory/464-729-0x00007FF615260000-0x00007FF6155B4000-memory.dmp	upx
behavioral2/memory/1580-733-0x00007FF6B1580000-0x00007FF6B18D4000-memory.dmp	upx
behavioral2/memory/2052-741-0x00007FF6640D0000-0x00007FF664424000-memory.dmp	upx
behavioral2/memory/4856-737-0x00007FF776CD0000-0x00007FF777024000-memory.dmp	upx
behavioral2/memory/2996-734-0x00007FF7D6100000-0x00007FF7D6454000-memory.dmp	upx
behavioral2/memory/4240-710-0x00007FF61BD40000-0x00007FF61C094000-memory.dmp	upx
behavioral2/memory/4484-2010-0x00007FF6C7860000-0x00007FF6C7BB4000-memory.dmp	upx
behavioral2/memory/320-2178-0x00007FF6F1350000-0x00007FF6F16A4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oTzJIfa.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\cMgxEsP.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\ryyqfKo.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\DEYhPGN.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\ivKIpJO.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\vbObtjw.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\kldlSbw.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\OPfheIN.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\YGkOyRe.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\EHsXiSg.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\dmfMyAR.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\LQggxvz.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\OqRnwHk.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\tOVZtOs.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\tiwKTKI.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\RaToMZG.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\HhPYnkA.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\TyRuMRP.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\BVeOOEA.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\SWJmrAC.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\pvvJawz.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\SOJMjeV.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\UWihuUb.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\RmPxEcj.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\apvdsDB.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\KGqYOqx.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\kIEjzRx.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\DCSvUav.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\BOjYypP.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\qRPMalK.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\iryaaef.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\uzbqDZS.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\aOEmogr.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\EHMtmAF.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\YVgmSXc.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\TsnCLtd.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\XwALJaW.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\pdaoxUv.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\tPMLcFg.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\posLfBR.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\PvATOfP.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\UdJqHBs.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\vVTitWu.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\mljUoKI.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\GcmKZYb.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\xGreRqY.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\mfDaVgN.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\okvciEX.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\GmUgWgp.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\ZJACtkh.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\CeGjrsn.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\DHpudBs.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\wzKuvWF.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\LXEisAr.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\geAbBzd.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\MQEBdUd.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\uQEbbiT.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\JvpSFAp.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\fxJzCSR.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\TXPJfpS.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\WgMJnJS.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\RPGPxbh.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\lZGwXln.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
File created	C:\Windows\System\isHaJFc.exe	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3252	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	84
PID 4484 wrote to memory of 3252	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	84
PID 4484 wrote to memory of 4700	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	85
PID 4484 wrote to memory of 4700	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	85
PID 4484 wrote to memory of 2572	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	86
PID 4484 wrote to memory of 2572	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	86
PID 4484 wrote to memory of 320	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	87
PID 4484 wrote to memory of 320	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	87
PID 4484 wrote to memory of 1960	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	88
PID 4484 wrote to memory of 1960	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	88
PID 4484 wrote to memory of 3540	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	89
PID 4484 wrote to memory of 3540	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	89
PID 4484 wrote to memory of 1468	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	90
PID 4484 wrote to memory of 1468	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	90
PID 4484 wrote to memory of 2852	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	91
PID 4484 wrote to memory of 2852	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	91
PID 4484 wrote to memory of 1208	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	92
PID 4484 wrote to memory of 1208	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	92
PID 4484 wrote to memory of 4064	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	93
PID 4484 wrote to memory of 4064	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	93
PID 4484 wrote to memory of 5088	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	94
PID 4484 wrote to memory of 5088	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	94
PID 4484 wrote to memory of 2052	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	95
PID 4484 wrote to memory of 2052	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	95
PID 4484 wrote to memory of 2152	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	96
PID 4484 wrote to memory of 2152	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	96
PID 4484 wrote to memory of 2988	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	97
PID 4484 wrote to memory of 2988	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	97
PID 4484 wrote to memory of 4360	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	98
PID 4484 wrote to memory of 4360	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	98
PID 4484 wrote to memory of 628	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	99
PID 4484 wrote to memory of 628	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	99
PID 4484 wrote to memory of 1528	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	100
PID 4484 wrote to memory of 1528	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	100
PID 4484 wrote to memory of 2592	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	101
PID 4484 wrote to memory of 2592	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	101
PID 4484 wrote to memory of 1252	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	102
PID 4484 wrote to memory of 1252	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	102
PID 4484 wrote to memory of 4556	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	103
PID 4484 wrote to memory of 4556	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	103
PID 4484 wrote to memory of 4240	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	104
PID 4484 wrote to memory of 4240	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	104
PID 4484 wrote to memory of 400	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	105
PID 4484 wrote to memory of 400	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	105
PID 4484 wrote to memory of 1004	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	106
PID 4484 wrote to memory of 1004	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	106
PID 4484 wrote to memory of 1728	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	107
PID 4484 wrote to memory of 1728	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	107
PID 4484 wrote to memory of 1476	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	108
PID 4484 wrote to memory of 1476	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	108
PID 4484 wrote to memory of 464	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	109
PID 4484 wrote to memory of 464	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	109
PID 4484 wrote to memory of 1580	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	110
PID 4484 wrote to memory of 1580	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	110
PID 4484 wrote to memory of 2996	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	111
PID 4484 wrote to memory of 2996	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	111
PID 4484 wrote to memory of 4856	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	112
PID 4484 wrote to memory of 4856	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	112
PID 4484 wrote to memory of 3064	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	113
PID 4484 wrote to memory of 3064	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	113
PID 4484 wrote to memory of 448	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	114
PID 4484 wrote to memory of 448	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	114
PID 4484 wrote to memory of 1956	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	115
PID 4484 wrote to memory of 1956	4484	5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5c294866afb6e1b3329fce4b60bd8360_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\System\vwnnUur.exe
  C:\Windows\System\vwnnUur.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\jpMEFFH.exe
  C:\Windows\System\jpMEFFH.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\PmVpqPK.exe
  C:\Windows\System\PmVpqPK.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\uzbqDZS.exe
  C:\Windows\System\uzbqDZS.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\LQggxvz.exe
  C:\Windows\System\LQggxvz.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\MTogzDF.exe
  C:\Windows\System\MTogzDF.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\yRBWRgz.exe
  C:\Windows\System\yRBWRgz.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\NXvDOwU.exe
  C:\Windows\System\NXvDOwU.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\IwmwUeG.exe
  C:\Windows\System\IwmwUeG.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\kjqSiMB.exe
  C:\Windows\System\kjqSiMB.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\lJMzXuG.exe
  C:\Windows\System\lJMzXuG.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\DUXZQmh.exe
  C:\Windows\System\DUXZQmh.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\EQLkvoi.exe
  C:\Windows\System\EQLkvoi.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\YdCHnfF.exe
  C:\Windows\System\YdCHnfF.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\KpPlLVA.exe
  C:\Windows\System\KpPlLVA.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\pZqUtEI.exe
  C:\Windows\System\pZqUtEI.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\pdaoxUv.exe
  C:\Windows\System\pdaoxUv.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\TuaSMGx.exe
  C:\Windows\System\TuaSMGx.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\bauRbfS.exe
  C:\Windows\System\bauRbfS.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\PnBnAcu.exe
  C:\Windows\System\PnBnAcu.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\lEZDyFi.exe
  C:\Windows\System\lEZDyFi.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\szqrGiX.exe
  C:\Windows\System\szqrGiX.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\byeWsUV.exe
  C:\Windows\System\byeWsUV.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\LoaUvLw.exe
  C:\Windows\System\LoaUvLw.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\FwrPHjJ.exe
  C:\Windows\System\FwrPHjJ.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\rPUdfYn.exe
  C:\Windows\System\rPUdfYn.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\twOhADs.exe
  C:\Windows\System\twOhADs.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\vptXwPJ.exe
  C:\Windows\System\vptXwPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\YLoxnKu.exe
  C:\Windows\System\YLoxnKu.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\mfDaVgN.exe
  C:\Windows\System\mfDaVgN.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\DEYhPGN.exe
  C:\Windows\System\DEYhPGN.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\acxiqPt.exe
  C:\Windows\System\acxiqPt.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\aQFTcGv.exe
  C:\Windows\System\aQFTcGv.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\WzuFAYm.exe
  C:\Windows\System\WzuFAYm.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\SZfFiYb.exe
  C:\Windows\System\SZfFiYb.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\kSZhqCp.exe
  C:\Windows\System\kSZhqCp.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\kTbUnbn.exe
  C:\Windows\System\kTbUnbn.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\NpVEKjR.exe
  C:\Windows\System\NpVEKjR.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\WgMJnJS.exe
  C:\Windows\System\WgMJnJS.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\Eaxrudk.exe
  C:\Windows\System\Eaxrudk.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\FczBzBG.exe
  C:\Windows\System\FczBzBG.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\DgPUTTe.exe
  C:\Windows\System\DgPUTTe.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\yChNeVE.exe
  C:\Windows\System\yChNeVE.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\oyjylsI.exe
  C:\Windows\System\oyjylsI.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\QPvkdhN.exe
  C:\Windows\System\QPvkdhN.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\AOAEohD.exe
  C:\Windows\System\AOAEohD.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\myXIMbN.exe
  C:\Windows\System\myXIMbN.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\LGQzdYi.exe
  C:\Windows\System\LGQzdYi.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\LXEisAr.exe
  C:\Windows\System\LXEisAr.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\qUFBhqR.exe
  C:\Windows\System\qUFBhqR.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\neKkSZB.exe
  C:\Windows\System\neKkSZB.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\IWoysWb.exe
  C:\Windows\System\IWoysWb.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ErDpoWJ.exe
  C:\Windows\System\ErDpoWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\rvLRApA.exe
  C:\Windows\System\rvLRApA.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\PQDFxWz.exe
  C:\Windows\System\PQDFxWz.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\fHgKihs.exe
  C:\Windows\System\fHgKihs.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\khpuPBa.exe
  C:\Windows\System\khpuPBa.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\jfmUOep.exe
  C:\Windows\System\jfmUOep.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\abMfWZQ.exe
  C:\Windows\System\abMfWZQ.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\PoztBYd.exe
  C:\Windows\System\PoztBYd.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\MeBkHgK.exe
  C:\Windows\System\MeBkHgK.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\yzIeYOS.exe
  C:\Windows\System\yzIeYOS.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\EcdPkgP.exe
  C:\Windows\System\EcdPkgP.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\jBpDqUO.exe
  C:\Windows\System\jBpDqUO.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\KSQNwXK.exe
  C:\Windows\System\KSQNwXK.exe
  2⤵
  PID:2408
- C:\Windows\System\OqRnwHk.exe
  C:\Windows\System\OqRnwHk.exe
  2⤵
  PID:1784
- C:\Windows\System\yhfOPTm.exe
  C:\Windows\System\yhfOPTm.exe
  2⤵
  PID:1628
- C:\Windows\System\PvATOfP.exe
  C:\Windows\System\PvATOfP.exe
  2⤵
  PID:4504
- C:\Windows\System\xWloyaN.exe
  C:\Windows\System\xWloyaN.exe
  2⤵
  PID:2268
- C:\Windows\System\PIXCeXt.exe
  C:\Windows\System\PIXCeXt.exe
  2⤵
  PID:4100
- C:\Windows\System\eUruuTO.exe
  C:\Windows\System\eUruuTO.exe
  2⤵
  PID:824
- C:\Windows\System\rQymqjM.exe
  C:\Windows\System\rQymqjM.exe
  2⤵
  PID:3024
- C:\Windows\System\EfPmdGp.exe
  C:\Windows\System\EfPmdGp.exe
  2⤵
  PID:4672
- C:\Windows\System\JDvkWlf.exe
  C:\Windows\System\JDvkWlf.exe
  2⤵
  PID:3536
- C:\Windows\System\fiEPeGk.exe
  C:\Windows\System\fiEPeGk.exe
  2⤵
  PID:636
- C:\Windows\System\lhxwOuU.exe
  C:\Windows\System\lhxwOuU.exe
  2⤵
  PID:2340
- C:\Windows\System\JbFihlW.exe
  C:\Windows\System\JbFihlW.exe
  2⤵
  PID:4012
- C:\Windows\System\huYMmBc.exe
  C:\Windows\System\huYMmBc.exe
  2⤵
  PID:2296
- C:\Windows\System\FTebIMy.exe
  C:\Windows\System\FTebIMy.exe
  2⤵
  PID:4984
- C:\Windows\System\smFTgAU.exe
  C:\Windows\System\smFTgAU.exe
  2⤵
  PID:5016
- C:\Windows\System\DaqhOnJ.exe
  C:\Windows\System\DaqhOnJ.exe
  2⤵
  PID:5140
- C:\Windows\System\tNzburC.exe
  C:\Windows\System\tNzburC.exe
  2⤵
  PID:5168
- C:\Windows\System\PQiStpg.exe
  C:\Windows\System\PQiStpg.exe
  2⤵
  PID:5200
- C:\Windows\System\jYTFTyQ.exe
  C:\Windows\System\jYTFTyQ.exe
  2⤵
  PID:5224
- C:\Windows\System\tOVZtOs.exe
  C:\Windows\System\tOVZtOs.exe
  2⤵
  PID:5252
- C:\Windows\System\YbbICQe.exe
  C:\Windows\System\YbbICQe.exe
  2⤵
  PID:5280
- C:\Windows\System\KVDzIJk.exe
  C:\Windows\System\KVDzIJk.exe
  2⤵
  PID:5308
- C:\Windows\System\QjcxeyT.exe
  C:\Windows\System\QjcxeyT.exe
  2⤵
  PID:5336
- C:\Windows\System\jTsFYRJ.exe
  C:\Windows\System\jTsFYRJ.exe
  2⤵
  PID:5364
- C:\Windows\System\HSKyiax.exe
  C:\Windows\System\HSKyiax.exe
  2⤵
  PID:5392
- C:\Windows\System\CfaTrAQ.exe
  C:\Windows\System\CfaTrAQ.exe
  2⤵
  PID:5420
- C:\Windows\System\geAbBzd.exe
  C:\Windows\System\geAbBzd.exe
  2⤵
  PID:5448
- C:\Windows\System\LQSJLXu.exe
  C:\Windows\System\LQSJLXu.exe
  2⤵
  PID:5476
- C:\Windows\System\GshYDgR.exe
  C:\Windows\System\GshYDgR.exe
  2⤵
  PID:5504
- C:\Windows\System\qqPXqrC.exe
  C:\Windows\System\qqPXqrC.exe
  2⤵
  PID:5532
- C:\Windows\System\DKWyjDg.exe
  C:\Windows\System\DKWyjDg.exe
  2⤵
  PID:5560
- C:\Windows\System\vaZuGwD.exe
  C:\Windows\System\vaZuGwD.exe
  2⤵
  PID:5588
- C:\Windows\System\oCoaXYs.exe
  C:\Windows\System\oCoaXYs.exe
  2⤵
  PID:5616
- C:\Windows\System\jRSkOeJ.exe
  C:\Windows\System\jRSkOeJ.exe
  2⤵
  PID:5644
- C:\Windows\System\uiSjDqD.exe
  C:\Windows\System\uiSjDqD.exe
  2⤵
  PID:5672
- C:\Windows\System\DAsExCx.exe
  C:\Windows\System\DAsExCx.exe
  2⤵
  PID:5700
- C:\Windows\System\FekHmtu.exe
  C:\Windows\System\FekHmtu.exe
  2⤵
  PID:5728
- C:\Windows\System\ipnkUHQ.exe
  C:\Windows\System\ipnkUHQ.exe
  2⤵
  PID:5756
- C:\Windows\System\loMAhmp.exe
  C:\Windows\System\loMAhmp.exe
  2⤵
  PID:5784
- C:\Windows\System\oqmJpMw.exe
  C:\Windows\System\oqmJpMw.exe
  2⤵
  PID:5812
- C:\Windows\System\drwqEwP.exe
  C:\Windows\System\drwqEwP.exe
  2⤵
  PID:5840
- C:\Windows\System\xycsKxf.exe
  C:\Windows\System\xycsKxf.exe
  2⤵
  PID:5868
- C:\Windows\System\ixsEIwl.exe
  C:\Windows\System\ixsEIwl.exe
  2⤵
  PID:5896
- C:\Windows\System\vDuIycS.exe
  C:\Windows\System\vDuIycS.exe
  2⤵
  PID:5924
- C:\Windows\System\wRYrriZ.exe
  C:\Windows\System\wRYrriZ.exe
  2⤵
  PID:5952
- C:\Windows\System\iFmnbLf.exe
  C:\Windows\System\iFmnbLf.exe
  2⤵
  PID:5980
- C:\Windows\System\DCJGKdi.exe
  C:\Windows\System\DCJGKdi.exe
  2⤵
  PID:6008
- C:\Windows\System\FUYUMYG.exe
  C:\Windows\System\FUYUMYG.exe
  2⤵
  PID:6036
- C:\Windows\System\GMOYmZY.exe
  C:\Windows\System\GMOYmZY.exe
  2⤵
  PID:6064
- C:\Windows\System\hdujwKd.exe
  C:\Windows\System\hdujwKd.exe
  2⤵
  PID:6092
- C:\Windows\System\ivKIpJO.exe
  C:\Windows\System\ivKIpJO.exe
  2⤵
  PID:6120
- C:\Windows\System\YgiaMrW.exe
  C:\Windows\System\YgiaMrW.exe
  2⤵
  PID:3836
- C:\Windows\System\cnQAbRw.exe
  C:\Windows\System\cnQAbRw.exe
  2⤵
  PID:4880
- C:\Windows\System\SBigdiN.exe
  C:\Windows\System\SBigdiN.exe
  2⤵
  PID:4512
- C:\Windows\System\RrbpwuS.exe
  C:\Windows\System\RrbpwuS.exe
  2⤵
  PID:2316
- C:\Windows\System\lWgSgat.exe
  C:\Windows\System\lWgSgat.exe
  2⤵
  PID:1332
- C:\Windows\System\okvciEX.exe
  C:\Windows\System\okvciEX.exe
  2⤵
  PID:2216
- C:\Windows\System\chwRman.exe
  C:\Windows\System\chwRman.exe
  2⤵
  PID:5132
- C:\Windows\System\ncXkzXL.exe
  C:\Windows\System\ncXkzXL.exe
  2⤵
  PID:5208
- C:\Windows\System\pvvJawz.exe
  C:\Windows\System\pvvJawz.exe
  2⤵
  PID:5268
- C:\Windows\System\tiwKTKI.exe
  C:\Windows\System\tiwKTKI.exe
  2⤵
  PID:5328
- C:\Windows\System\NtjhBCE.exe
  C:\Windows\System\NtjhBCE.exe
  2⤵
  PID:5404
- C:\Windows\System\waVidPh.exe
  C:\Windows\System\waVidPh.exe
  2⤵
  PID:5464
- C:\Windows\System\skoZYee.exe
  C:\Windows\System\skoZYee.exe
  2⤵
  PID:5524
- C:\Windows\System\OacdOcE.exe
  C:\Windows\System\OacdOcE.exe
  2⤵
  PID:5600
- C:\Windows\System\mRfTDkj.exe
  C:\Windows\System\mRfTDkj.exe
  2⤵
  PID:5660
- C:\Windows\System\vLRBasp.exe
  C:\Windows\System\vLRBasp.exe
  2⤵
  PID:5716
- C:\Windows\System\oxooVpv.exe
  C:\Windows\System\oxooVpv.exe
  2⤵
  PID:5796
- C:\Windows\System\fJaKUCa.exe
  C:\Windows\System\fJaKUCa.exe
  2⤵
  PID:872
- C:\Windows\System\VjwsfPv.exe
  C:\Windows\System\VjwsfPv.exe
  2⤵
  PID:5912
- C:\Windows\System\KLvtYrY.exe
  C:\Windows\System\KLvtYrY.exe
  2⤵
  PID:5992
- C:\Windows\System\FrYovwq.exe
  C:\Windows\System\FrYovwq.exe
  2⤵
  PID:6048
- C:\Windows\System\TVPVgXI.exe
  C:\Windows\System\TVPVgXI.exe
  2⤵
  PID:6108
- C:\Windows\System\zVSmnub.exe
  C:\Windows\System\zVSmnub.exe
  2⤵
  PID:700
- C:\Windows\System\mKjNVds.exe
  C:\Windows\System\mKjNVds.exe
  2⤵
  PID:4396
- C:\Windows\System\SsJXweR.exe
  C:\Windows\System\SsJXweR.exe
  2⤵
  PID:868
- C:\Windows\System\UjaeitJ.exe
  C:\Windows\System\UjaeitJ.exe
  2⤵
  PID:5244
- C:\Windows\System\paZattx.exe
  C:\Windows\System\paZattx.exe
  2⤵
  PID:5432
- C:\Windows\System\UdJqHBs.exe
  C:\Windows\System\UdJqHBs.exe
  2⤵
  PID:5572
- C:\Windows\System\SLlsNUZ.exe
  C:\Windows\System\SLlsNUZ.exe
  2⤵
  PID:5712
- C:\Windows\System\vylfyNz.exe
  C:\Windows\System\vylfyNz.exe
  2⤵
  PID:5828
- C:\Windows\System\PZnHmML.exe
  C:\Windows\System\PZnHmML.exe
  2⤵
  PID:6000
- C:\Windows\System\HyAQvPQ.exe
  C:\Windows\System\HyAQvPQ.exe
  2⤵
  PID:6164
- C:\Windows\System\xnqBhAI.exe
  C:\Windows\System\xnqBhAI.exe
  2⤵
  PID:6192
- C:\Windows\System\PTJvbsr.exe
  C:\Windows\System\PTJvbsr.exe
  2⤵
  PID:6220
- C:\Windows\System\wUEhcUp.exe
  C:\Windows\System\wUEhcUp.exe
  2⤵
  PID:6248
- C:\Windows\System\lvQdvZL.exe
  C:\Windows\System\lvQdvZL.exe
  2⤵
  PID:6276
- C:\Windows\System\PHYQNii.exe
  C:\Windows\System\PHYQNii.exe
  2⤵
  PID:6304
- C:\Windows\System\sSGeXko.exe
  C:\Windows\System\sSGeXko.exe
  2⤵
  PID:6336
- C:\Windows\System\hxYhYVb.exe
  C:\Windows\System\hxYhYVb.exe
  2⤵
  PID:6368
- C:\Windows\System\EcOwTEd.exe
  C:\Windows\System\EcOwTEd.exe
  2⤵
  PID:6400
- C:\Windows\System\SytHJNF.exe
  C:\Windows\System\SytHJNF.exe
  2⤵
  PID:6424
- C:\Windows\System\UVTemnm.exe
  C:\Windows\System\UVTemnm.exe
  2⤵
  PID:6452
- C:\Windows\System\lrlZRGA.exe
  C:\Windows\System\lrlZRGA.exe
  2⤵
  PID:6480
- C:\Windows\System\QRBWzuv.exe
  C:\Windows\System\QRBWzuv.exe
  2⤵
  PID:6512
- C:\Windows\System\KcxWQVM.exe
  C:\Windows\System\KcxWQVM.exe
  2⤵
  PID:6540
- C:\Windows\System\aOEmogr.exe
  C:\Windows\System\aOEmogr.exe
  2⤵
  PID:6568
- C:\Windows\System\FnLvuJD.exe
  C:\Windows\System\FnLvuJD.exe
  2⤵
  PID:6584
- C:\Windows\System\zaahRMK.exe
  C:\Windows\System\zaahRMK.exe
  2⤵
  PID:6612
- C:\Windows\System\mHhYqBD.exe
  C:\Windows\System\mHhYqBD.exe
  2⤵
  PID:6640
- C:\Windows\System\bbqjQYU.exe
  C:\Windows\System\bbqjQYU.exe
  2⤵
  PID:6668
- C:\Windows\System\wGtZiHH.exe
  C:\Windows\System\wGtZiHH.exe
  2⤵
  PID:6696
- C:\Windows\System\OABsvoL.exe
  C:\Windows\System\OABsvoL.exe
  2⤵
  PID:6724
- C:\Windows\System\tPMLcFg.exe
  C:\Windows\System\tPMLcFg.exe
  2⤵
  PID:6752
- C:\Windows\System\fceLDFJ.exe
  C:\Windows\System\fceLDFJ.exe
  2⤵
  PID:6780
- C:\Windows\System\wopHldR.exe
  C:\Windows\System\wopHldR.exe
  2⤵
  PID:6808
- C:\Windows\System\KUIcrGh.exe
  C:\Windows\System\KUIcrGh.exe
  2⤵
  PID:6836
- C:\Windows\System\qJviJvT.exe
  C:\Windows\System\qJviJvT.exe
  2⤵
  PID:6864
- C:\Windows\System\zcnETWw.exe
  C:\Windows\System\zcnETWw.exe
  2⤵
  PID:6892
- C:\Windows\System\ILZCKir.exe
  C:\Windows\System\ILZCKir.exe
  2⤵
  PID:6920
- C:\Windows\System\IBMAuJx.exe
  C:\Windows\System\IBMAuJx.exe
  2⤵
  PID:6948
- C:\Windows\System\apPIhyb.exe
  C:\Windows\System\apPIhyb.exe
  2⤵
  PID:6976
- C:\Windows\System\HSBKmtT.exe
  C:\Windows\System\HSBKmtT.exe
  2⤵
  PID:7004
- C:\Windows\System\Tjsukvh.exe
  C:\Windows\System\Tjsukvh.exe
  2⤵
  PID:7032
- C:\Windows\System\SZPQvXi.exe
  C:\Windows\System\SZPQvXi.exe
  2⤵
  PID:7060
- C:\Windows\System\ozmOeBb.exe
  C:\Windows\System\ozmOeBb.exe
  2⤵
  PID:7088
- C:\Windows\System\sbWTKyG.exe
  C:\Windows\System\sbWTKyG.exe
  2⤵
  PID:7116
- C:\Windows\System\HWkhKMw.exe
  C:\Windows\System\HWkhKMw.exe
  2⤵
  PID:7144
- C:\Windows\System\JYvikQz.exe
  C:\Windows\System\JYvikQz.exe
  2⤵
  PID:6080
- C:\Windows\System\BwGoatB.exe
  C:\Windows\System\BwGoatB.exe
  2⤵
  PID:1712
- C:\Windows\System\tgeYtni.exe
  C:\Windows\System\tgeYtni.exe
  2⤵
  PID:5356
- C:\Windows\System\zStLgzC.exe
  C:\Windows\System\zStLgzC.exe
  2⤵
  PID:5688
- C:\Windows\System\SHDvJLL.exe
  C:\Windows\System\SHDvJLL.exe
  2⤵
  PID:6148
- C:\Windows\System\mfnZwvo.exe
  C:\Windows\System\mfnZwvo.exe
  2⤵
  PID:4624
- C:\Windows\System\KlrbGYl.exe
  C:\Windows\System\KlrbGYl.exe
  2⤵
  PID:6268
- C:\Windows\System\lHVszir.exe
  C:\Windows\System\lHVszir.exe
  2⤵
  PID:6332
- C:\Windows\System\lIzpKDP.exe
  C:\Windows\System\lIzpKDP.exe
  2⤵
  PID:6392
- C:\Windows\System\JCwpJEc.exe
  C:\Windows\System\JCwpJEc.exe
  2⤵
  PID:6448
- C:\Windows\System\fzxnTiw.exe
  C:\Windows\System\fzxnTiw.exe
  2⤵
  PID:6524
- C:\Windows\System\SYhLOJq.exe
  C:\Windows\System\SYhLOJq.exe
  2⤵
  PID:6580
- C:\Windows\System\hYdMiwK.exe
  C:\Windows\System\hYdMiwK.exe
  2⤵
  PID:6652
- C:\Windows\System\kvAzrIt.exe
  C:\Windows\System\kvAzrIt.exe
  2⤵
  PID:6708
- C:\Windows\System\fGMiorZ.exe
  C:\Windows\System\fGMiorZ.exe
  2⤵
  PID:6744
- C:\Windows\System\vKwndSp.exe
  C:\Windows\System\vKwndSp.exe
  2⤵
  PID:6824
- C:\Windows\System\hIlmOWD.exe
  C:\Windows\System\hIlmOWD.exe
  2⤵
  PID:6880
- C:\Windows\System\GmUgWgp.exe
  C:\Windows\System\GmUgWgp.exe
  2⤵
  PID:6960
- C:\Windows\System\ZJACtkh.exe
  C:\Windows\System\ZJACtkh.exe
  2⤵
  PID:6992
- C:\Windows\System\SOJMjeV.exe
  C:\Windows\System\SOJMjeV.exe
  2⤵
  PID:7048
- C:\Windows\System\lvNDBTW.exe
  C:\Windows\System\lvNDBTW.exe
  2⤵
  PID:7080
- C:\Windows\System\AzbDnDs.exe
  C:\Windows\System\AzbDnDs.exe
  2⤵
  PID:7136
- C:\Windows\System\jUHRqMv.exe
  C:\Windows\System\jUHRqMv.exe
  2⤵
  PID:2284
- C:\Windows\System\BQkXPMt.exe
  C:\Windows\System\BQkXPMt.exe
  2⤵
  PID:6420
- C:\Windows\System\VqLDbqH.exe
  C:\Windows\System\VqLDbqH.exe
  2⤵
  PID:6496
- C:\Windows\System\VkAogbC.exe
  C:\Windows\System\VkAogbC.exe
  2⤵
  PID:6560
- C:\Windows\System\ilSPhDH.exe
  C:\Windows\System\ilSPhDH.exe
  2⤵
  PID:1692
- C:\Windows\System\vbObtjw.exe
  C:\Windows\System\vbObtjw.exe
  2⤵
  PID:6800
- C:\Windows\System\VXxdfdh.exe
  C:\Windows\System\VXxdfdh.exe
  2⤵
  PID:3948
- C:\Windows\System\uJpRBSZ.exe
  C:\Windows\System\uJpRBSZ.exe
  2⤵
  PID:556
- C:\Windows\System\EPujJSu.exe
  C:\Windows\System\EPujJSu.exe
  2⤵
  PID:4060
- C:\Windows\System\gHUsyKz.exe
  C:\Windows\System\gHUsyKz.exe
  2⤵
  PID:2704
- C:\Windows\System\mWBwDZS.exe
  C:\Windows\System\mWBwDZS.exe
  2⤵
  PID:3368
- C:\Windows\System\eSpETgt.exe
  C:\Windows\System\eSpETgt.exe
  2⤵
  PID:6316
- C:\Windows\System\apvdsDB.exe
  C:\Windows\System\apvdsDB.exe
  2⤵
  PID:6444
- C:\Windows\System\QoIGkSu.exe
  C:\Windows\System\QoIGkSu.exe
  2⤵
  PID:4516
- C:\Windows\System\qpMGWUs.exe
  C:\Windows\System\qpMGWUs.exe
  2⤵
  PID:6936
- C:\Windows\System\ubiRWuo.exe
  C:\Windows\System\ubiRWuo.exe
  2⤵
  PID:1524
- C:\Windows\System\EHMtmAF.exe
  C:\Windows\System\EHMtmAF.exe
  2⤵
  PID:7196
- C:\Windows\System\eNjVBLA.exe
  C:\Windows\System\eNjVBLA.exe
  2⤵
  PID:7224
- C:\Windows\System\SvWYumx.exe
  C:\Windows\System\SvWYumx.exe
  2⤵
  PID:7252
- C:\Windows\System\YqJDojj.exe
  C:\Windows\System\YqJDojj.exe
  2⤵
  PID:7280
- C:\Windows\System\NtlBIXR.exe
  C:\Windows\System\NtlBIXR.exe
  2⤵
  PID:7308
- C:\Windows\System\crhIzMZ.exe
  C:\Windows\System\crhIzMZ.exe
  2⤵
  PID:7336
- C:\Windows\System\zDitUcL.exe
  C:\Windows\System\zDitUcL.exe
  2⤵
  PID:7364
- C:\Windows\System\SohWlUE.exe
  C:\Windows\System\SohWlUE.exe
  2⤵
  PID:7392
- C:\Windows\System\woUgOSM.exe
  C:\Windows\System\woUgOSM.exe
  2⤵
  PID:7420
- C:\Windows\System\VHsSwlg.exe
  C:\Windows\System\VHsSwlg.exe
  2⤵
  PID:7448
- C:\Windows\System\gzczgtU.exe
  C:\Windows\System\gzczgtU.exe
  2⤵
  PID:7476
- C:\Windows\System\scKtHMd.exe
  C:\Windows\System\scKtHMd.exe
  2⤵
  PID:7504
- C:\Windows\System\RPGPxbh.exe
  C:\Windows\System\RPGPxbh.exe
  2⤵
  PID:7532
- C:\Windows\System\EcXxjGb.exe
  C:\Windows\System\EcXxjGb.exe
  2⤵
  PID:7560
- C:\Windows\System\ILgAnyt.exe
  C:\Windows\System\ILgAnyt.exe
  2⤵
  PID:7588
- C:\Windows\System\OxVcnOg.exe
  C:\Windows\System\OxVcnOg.exe
  2⤵
  PID:7616
- C:\Windows\System\oTzJIfa.exe
  C:\Windows\System\oTzJIfa.exe
  2⤵
  PID:7644
- C:\Windows\System\cyLreeg.exe
  C:\Windows\System\cyLreeg.exe
  2⤵
  PID:7672
- C:\Windows\System\NtFNIWN.exe
  C:\Windows\System\NtFNIWN.exe
  2⤵
  PID:7700
- C:\Windows\System\KGqYOqx.exe
  C:\Windows\System\KGqYOqx.exe
  2⤵
  PID:7728
- C:\Windows\System\knavdlJ.exe
  C:\Windows\System\knavdlJ.exe
  2⤵
  PID:7756
- C:\Windows\System\aWUzuQN.exe
  C:\Windows\System\aWUzuQN.exe
  2⤵
  PID:7784
- C:\Windows\System\OGsNirt.exe
  C:\Windows\System\OGsNirt.exe
  2⤵
  PID:7812
- C:\Windows\System\BZkNLrT.exe
  C:\Windows\System\BZkNLrT.exe
  2⤵
  PID:7832
- C:\Windows\System\GvbvLBB.exe
  C:\Windows\System\GvbvLBB.exe
  2⤵
  PID:7892
- C:\Windows\System\zQPrDha.exe
  C:\Windows\System\zQPrDha.exe
  2⤵
  PID:7976
- C:\Windows\System\NMxjoVI.exe
  C:\Windows\System\NMxjoVI.exe
  2⤵
  PID:8008
- C:\Windows\System\LZMmIvH.exe
  C:\Windows\System\LZMmIvH.exe
  2⤵
  PID:8028
- C:\Windows\System\ztqmndD.exe
  C:\Windows\System\ztqmndD.exe
  2⤵
  PID:8064
- C:\Windows\System\OAbjSBp.exe
  C:\Windows\System\OAbjSBp.exe
  2⤵
  PID:8104
- C:\Windows\System\XyDwAeQ.exe
  C:\Windows\System\XyDwAeQ.exe
  2⤵
  PID:8120
- C:\Windows\System\pRFswCZ.exe
  C:\Windows\System\pRFswCZ.exe
  2⤵
  PID:8136
- C:\Windows\System\WtaFikO.exe
  C:\Windows\System\WtaFikO.exe
  2⤵
  PID:7684
- C:\Windows\System\nlasVkI.exe
  C:\Windows\System\nlasVkI.exe
  2⤵
  PID:7608
- C:\Windows\System\fFaPKbB.exe
  C:\Windows\System\fFaPKbB.exe
  2⤵
  PID:7548
- C:\Windows\System\oNMPPfY.exe
  C:\Windows\System\oNMPPfY.exe
  2⤵
  PID:7488
- C:\Windows\System\knPcGEE.exe
  C:\Windows\System\knPcGEE.exe
  2⤵
  PID:7412
- C:\Windows\System\nekyTuy.exe
  C:\Windows\System\nekyTuy.exe
  2⤵
  PID:7352
- C:\Windows\System\eEJIjtX.exe
  C:\Windows\System\eEJIjtX.exe
  2⤵
  PID:7320
- C:\Windows\System\wgetzXu.exe
  C:\Windows\System\wgetzXu.exe
  2⤵
  PID:7244
- C:\Windows\System\dbykIGW.exe
  C:\Windows\System\dbykIGW.exe
  2⤵
  PID:7188
- C:\Windows\System\vmYLXzA.exe
  C:\Windows\System\vmYLXzA.exe
  2⤵
  PID:4680
- C:\Windows\System\NHcDCep.exe
  C:\Windows\System\NHcDCep.exe
  2⤵
  PID:5940
- C:\Windows\System\lGYlOed.exe
  C:\Windows\System\lGYlOed.exe
  2⤵
  PID:7692
- C:\Windows\System\gzvtgyK.exe
  C:\Windows\System\gzvtgyK.exe
  2⤵
  PID:7740
- C:\Windows\System\rVGpeDr.exe
  C:\Windows\System\rVGpeDr.exe
  2⤵
  PID:7828
- C:\Windows\System\vVTitWu.exe
  C:\Windows\System\vVTitWu.exe
  2⤵
  PID:7908
- C:\Windows\System\KQGywAX.exe
  C:\Windows\System\KQGywAX.exe
  2⤵
  PID:3960
- C:\Windows\System\fCVpYUr.exe
  C:\Windows\System\fCVpYUr.exe
  2⤵
  PID:3604
- C:\Windows\System\iTnsVir.exe
  C:\Windows\System\iTnsVir.exe
  2⤵
  PID:7960
- C:\Windows\System\WRrILKC.exe
  C:\Windows\System\WRrILKC.exe
  2⤵
  PID:8016
- C:\Windows\System\uVrMwkJ.exe
  C:\Windows\System\uVrMwkJ.exe
  2⤵
  PID:8116
- C:\Windows\System\prTxLwH.exe
  C:\Windows\System\prTxLwH.exe
  2⤵
  PID:8168
- C:\Windows\System\lQqmPay.exe
  C:\Windows\System\lQqmPay.exe
  2⤵
  PID:7520
- C:\Windows\System\lFmaMiY.exe
  C:\Windows\System\lFmaMiY.exe
  2⤵
  PID:7436
- C:\Windows\System\jGuMTop.exe
  C:\Windows\System\jGuMTop.exe
  2⤵
  PID:7236
- C:\Windows\System\IXbwHjG.exe
  C:\Windows\System\IXbwHjG.exe
  2⤵
  PID:3008
- C:\Windows\System\HHYEvZn.exe
  C:\Windows\System\HHYEvZn.exe
  2⤵
  PID:7688
- C:\Windows\System\MHovWQA.exe
  C:\Windows\System\MHovWQA.exe
  2⤵
  PID:1512
- C:\Windows\System\YGkOyRe.exe
  C:\Windows\System\YGkOyRe.exe
  2⤵
  PID:6364
- C:\Windows\System\sOOPrmH.exe
  C:\Windows\System\sOOPrmH.exe
  2⤵
  PID:3304
- C:\Windows\System\zWqeeDo.exe
  C:\Windows\System\zWqeeDo.exe
  2⤵
  PID:7628
- C:\Windows\System\SOFexOg.exe
  C:\Windows\System\SOFexOg.exe
  2⤵
  PID:7376
- C:\Windows\System\vVoOijO.exe
  C:\Windows\System\vVoOijO.exe
  2⤵
  PID:7108
- C:\Windows\System\MkNhifl.exe
  C:\Windows\System\MkNhifl.exe
  2⤵
  PID:4952
- C:\Windows\System\lbMxyum.exe
  C:\Windows\System\lbMxyum.exe
  2⤵
  PID:7720
- C:\Windows\System\JnoZTSv.exe
  C:\Windows\System\JnoZTSv.exe
  2⤵
  PID:7328
- C:\Windows\System\BxNtUkP.exe
  C:\Windows\System\BxNtUkP.exe
  2⤵
  PID:8204
- C:\Windows\System\RmMHWHL.exe
  C:\Windows\System\RmMHWHL.exe
  2⤵
  PID:8220
- C:\Windows\System\gFJBsna.exe
  C:\Windows\System\gFJBsna.exe
  2⤵
  PID:8248
- C:\Windows\System\BwJiXCa.exe
  C:\Windows\System\BwJiXCa.exe
  2⤵
  PID:8276
- C:\Windows\System\KDqkznS.exe
  C:\Windows\System\KDqkznS.exe
  2⤵
  PID:8316
- C:\Windows\System\TZeKoSG.exe
  C:\Windows\System\TZeKoSG.exe
  2⤵
  PID:8332
- C:\Windows\System\BpCBbFy.exe
  C:\Windows\System\BpCBbFy.exe
  2⤵
  PID:8360
- C:\Windows\System\avJdvPU.exe
  C:\Windows\System\avJdvPU.exe
  2⤵
  PID:8400
- C:\Windows\System\vmkNHhU.exe
  C:\Windows\System\vmkNHhU.exe
  2⤵
  PID:8428
- C:\Windows\System\ppTetFG.exe
  C:\Windows\System\ppTetFG.exe
  2⤵
  PID:8456
- C:\Windows\System\tivCPOY.exe
  C:\Windows\System\tivCPOY.exe
  2⤵
  PID:8472
- C:\Windows\System\GDDmfZs.exe
  C:\Windows\System\GDDmfZs.exe
  2⤵
  PID:8504
- C:\Windows\System\nrRAHZI.exe
  C:\Windows\System\nrRAHZI.exe
  2⤵
  PID:8528
- C:\Windows\System\kbtUtPF.exe
  C:\Windows\System\kbtUtPF.exe
  2⤵
  PID:8568
- C:\Windows\System\LhiFLIr.exe
  C:\Windows\System\LhiFLIr.exe
  2⤵
  PID:8600
- C:\Windows\System\iPUlNfT.exe
  C:\Windows\System\iPUlNfT.exe
  2⤵
  PID:8620
- C:\Windows\System\MQEBdUd.exe
  C:\Windows\System\MQEBdUd.exe
  2⤵
  PID:8656
- C:\Windows\System\hVxjWxi.exe
  C:\Windows\System\hVxjWxi.exe
  2⤵
  PID:8684
- C:\Windows\System\OIhnvBQ.exe
  C:\Windows\System\OIhnvBQ.exe
  2⤵
  PID:8700
- C:\Windows\System\sQsjxsl.exe
  C:\Windows\System\sQsjxsl.exe
  2⤵
  PID:8720
- C:\Windows\System\bpDkuhL.exe
  C:\Windows\System\bpDkuhL.exe
  2⤵
  PID:8768
- C:\Windows\System\sbHVLbO.exe
  C:\Windows\System\sbHVLbO.exe
  2⤵
  PID:8796
- C:\Windows\System\NNxttrU.exe
  C:\Windows\System\NNxttrU.exe
  2⤵
  PID:8812
- C:\Windows\System\pqxHWnE.exe
  C:\Windows\System\pqxHWnE.exe
  2⤵
  PID:8832
- C:\Windows\System\kfWKrHm.exe
  C:\Windows\System\kfWKrHm.exe
  2⤵
  PID:8856
- C:\Windows\System\FhgUzAZ.exe
  C:\Windows\System\FhgUzAZ.exe
  2⤵
  PID:8884
- C:\Windows\System\OJIPRGc.exe
  C:\Windows\System\OJIPRGc.exe
  2⤵
  PID:8912
- C:\Windows\System\nhSGorr.exe
  C:\Windows\System\nhSGorr.exe
  2⤵
  PID:8948
- C:\Windows\System\kIEjzRx.exe
  C:\Windows\System\kIEjzRx.exe
  2⤵
  PID:8988
- C:\Windows\System\dABICuK.exe
  C:\Windows\System\dABICuK.exe
  2⤵
  PID:9008
- C:\Windows\System\QrTdgYy.exe
  C:\Windows\System\QrTdgYy.exe
  2⤵
  PID:9036
- C:\Windows\System\icPMgDL.exe
  C:\Windows\System\icPMgDL.exe
  2⤵
  PID:9064
- C:\Windows\System\CLbmdZh.exe
  C:\Windows\System\CLbmdZh.exe
  2⤵
  PID:9104
- C:\Windows\System\mljUoKI.exe
  C:\Windows\System\mljUoKI.exe
  2⤵
  PID:9120
- C:\Windows\System\tJdtbTh.exe
  C:\Windows\System\tJdtbTh.exe
  2⤵
  PID:9156
- C:\Windows\System\NZYOEwT.exe
  C:\Windows\System\NZYOEwT.exe
  2⤵
  PID:9188
- C:\Windows\System\NmSiCCb.exe
  C:\Windows\System\NmSiCCb.exe
  2⤵
  PID:9204
- C:\Windows\System\WlsjFjg.exe
  C:\Windows\System\WlsjFjg.exe
  2⤵
  PID:8232
- C:\Windows\System\eJcYKCR.exe
  C:\Windows\System\eJcYKCR.exe
  2⤵
  PID:8300
- C:\Windows\System\yJuykRw.exe
  C:\Windows\System\yJuykRw.exe
  2⤵
  PID:8380
- C:\Windows\System\SpPXuqi.exe
  C:\Windows\System\SpPXuqi.exe
  2⤵
  PID:8444
- C:\Windows\System\kwfoKQW.exe
  C:\Windows\System\kwfoKQW.exe
  2⤵
  PID:8484
- C:\Windows\System\YfBOAXY.exe
  C:\Windows\System\YfBOAXY.exe
  2⤵
  PID:8540
- C:\Windows\System\kSUbBvT.exe
  C:\Windows\System\kSUbBvT.exe
  2⤵
  PID:8616
- C:\Windows\System\xLzkAyZ.exe
  C:\Windows\System\xLzkAyZ.exe
  2⤵
  PID:8696
- C:\Windows\System\zHxWdDV.exe
  C:\Windows\System\zHxWdDV.exe
  2⤵
  PID:8756
- C:\Windows\System\XWBesyH.exe
  C:\Windows\System\XWBesyH.exe
  2⤵
  PID:8788
- C:\Windows\System\MzwQFnx.exe
  C:\Windows\System\MzwQFnx.exe
  2⤵
  PID:8872
- C:\Windows\System\yvlSAzm.exe
  C:\Windows\System\yvlSAzm.exe
  2⤵
  PID:8940
- C:\Windows\System\RmObULu.exe
  C:\Windows\System\RmObULu.exe
  2⤵
  PID:9004
- C:\Windows\System\fPJUPFj.exe
  C:\Windows\System\fPJUPFj.exe
  2⤵
  PID:9048
- C:\Windows\System\pzGlBhB.exe
  C:\Windows\System\pzGlBhB.exe
  2⤵
  PID:9088
- C:\Windows\System\txousnt.exe
  C:\Windows\System\txousnt.exe
  2⤵
  PID:9168
- C:\Windows\System\GMfuShv.exe
  C:\Windows\System\GMfuShv.exe
  2⤵
  PID:8236
- C:\Windows\System\NaYumDd.exe
  C:\Windows\System\NaYumDd.exe
  2⤵
  PID:8512
- C:\Windows\System\HqFcvsv.exe
  C:\Windows\System\HqFcvsv.exe
  2⤵
  PID:8672
- C:\Windows\System\QVwkFwE.exe
  C:\Windows\System\QVwkFwE.exe
  2⤵
  PID:8808
- C:\Windows\System\zJbdEYE.exe
  C:\Windows\System\zJbdEYE.exe
  2⤵
  PID:9028
- C:\Windows\System\nqFpndX.exe
  C:\Windows\System\nqFpndX.exe
  2⤵
  PID:9196
- C:\Windows\System\ukieRKO.exe
  C:\Windows\System\ukieRKO.exe
  2⤵
  PID:8296
- C:\Windows\System\AqZyMhI.exe
  C:\Windows\System\AqZyMhI.exe
  2⤵
  PID:8448
- C:\Windows\System\CeGjrsn.exe
  C:\Windows\System\CeGjrsn.exe
  2⤵
  PID:8900
- C:\Windows\System\sQJjHXB.exe
  C:\Windows\System\sQJjHXB.exe
  2⤵
  PID:9020
- C:\Windows\System\gZryTCM.exe
  C:\Windows\System\gZryTCM.exe
  2⤵
  PID:7964
- C:\Windows\System\ArgYcfN.exe
  C:\Windows\System\ArgYcfN.exe
  2⤵
  PID:9244
- C:\Windows\System\JxdFfjU.exe
  C:\Windows\System\JxdFfjU.exe
  2⤵
  PID:9268
- C:\Windows\System\EVHVbiz.exe
  C:\Windows\System\EVHVbiz.exe
  2⤵
  PID:9292
- C:\Windows\System\CElsSjy.exe
  C:\Windows\System\CElsSjy.exe
  2⤵
  PID:9324
- C:\Windows\System\LsoQXWO.exe
  C:\Windows\System\LsoQXWO.exe
  2⤵
  PID:9348
- C:\Windows\System\FubOnEF.exe
  C:\Windows\System\FubOnEF.exe
  2⤵
  PID:9376
- C:\Windows\System\vKzoinq.exe
  C:\Windows\System\vKzoinq.exe
  2⤵
  PID:9404
- C:\Windows\System\lFXSpZQ.exe
  C:\Windows\System\lFXSpZQ.exe
  2⤵
  PID:9432
- C:\Windows\System\LMJFDxw.exe
  C:\Windows\System\LMJFDxw.exe
  2⤵
  PID:9452
- C:\Windows\System\FYeMRDm.exe
  C:\Windows\System\FYeMRDm.exe
  2⤵
  PID:9468
- C:\Windows\System\zqxlxip.exe
  C:\Windows\System\zqxlxip.exe
  2⤵
  PID:9484
- C:\Windows\System\eaGpklY.exe
  C:\Windows\System\eaGpklY.exe
  2⤵
  PID:9532
- C:\Windows\System\UHDoqxU.exe
  C:\Windows\System\UHDoqxU.exe
  2⤵
  PID:9560
- C:\Windows\System\LDMUzEJ.exe
  C:\Windows\System\LDMUzEJ.exe
  2⤵
  PID:9596
- C:\Windows\System\JvrcEpP.exe
  C:\Windows\System\JvrcEpP.exe
  2⤵
  PID:9628
- C:\Windows\System\hAQsoYG.exe
  C:\Windows\System\hAQsoYG.exe
  2⤵
  PID:9652
- C:\Windows\System\lZGwXln.exe
  C:\Windows\System\lZGwXln.exe
  2⤵
  PID:9676
- C:\Windows\System\AVBqFFj.exe
  C:\Windows\System\AVBqFFj.exe
  2⤵
  PID:9716
- C:\Windows\System\uQEbbiT.exe
  C:\Windows\System\uQEbbiT.exe
  2⤵
  PID:9744
- C:\Windows\System\sekPtcW.exe
  C:\Windows\System\sekPtcW.exe
  2⤵
  PID:9780
- C:\Windows\System\tGsVEAv.exe
  C:\Windows\System\tGsVEAv.exe
  2⤵
  PID:9812
- C:\Windows\System\LUIUMat.exe
  C:\Windows\System\LUIUMat.exe
  2⤵
  PID:9828
- C:\Windows\System\qbCVswp.exe
  C:\Windows\System\qbCVswp.exe
  2⤵
  PID:9856
- C:\Windows\System\WCzuCto.exe
  C:\Windows\System\WCzuCto.exe
  2⤵
  PID:9896
- C:\Windows\System\zxbDjtn.exe
  C:\Windows\System\zxbDjtn.exe
  2⤵
  PID:9924
- C:\Windows\System\MLvpezN.exe
  C:\Windows\System\MLvpezN.exe
  2⤵
  PID:9940
- C:\Windows\System\XkSOcYG.exe
  C:\Windows\System\XkSOcYG.exe
  2⤵
  PID:9972
- C:\Windows\System\uNVloWg.exe
  C:\Windows\System\uNVloWg.exe
  2⤵
  PID:10008
- C:\Windows\System\naBkFpl.exe
  C:\Windows\System\naBkFpl.exe
  2⤵
  PID:10024
- C:\Windows\System\uwskfGn.exe
  C:\Windows\System\uwskfGn.exe
  2⤵
  PID:10040
- C:\Windows\System\MoYrPqu.exe
  C:\Windows\System\MoYrPqu.exe
  2⤵
  PID:10092
- C:\Windows\System\ulxQeLE.exe
  C:\Windows\System\ulxQeLE.exe
  2⤵
  PID:10120
- C:\Windows\System\DSWJkNE.exe
  C:\Windows\System\DSWJkNE.exe
  2⤵
  PID:10148
- C:\Windows\System\JNxjwUT.exe
  C:\Windows\System\JNxjwUT.exe
  2⤵
  PID:10176
- C:\Windows\System\PeDalQI.exe
  C:\Windows\System\PeDalQI.exe
  2⤵
  PID:10204
- C:\Windows\System\kqbcmuU.exe
  C:\Windows\System\kqbcmuU.exe
  2⤵
  PID:10232
- C:\Windows\System\iOMacZo.exe
  C:\Windows\System\iOMacZo.exe
  2⤵
  PID:9228
- C:\Windows\System\ZiBXSOc.exe
  C:\Windows\System\ZiBXSOc.exe
  2⤵
  PID:9304
- C:\Windows\System\YVgmSXc.exe
  C:\Windows\System\YVgmSXc.exe
  2⤵
  PID:9368
- C:\Windows\System\ngolehq.exe
  C:\Windows\System\ngolehq.exe
  2⤵
  PID:9416
- C:\Windows\System\WNCjbke.exe
  C:\Windows\System\WNCjbke.exe
  2⤵
  PID:9476
- C:\Windows\System\gipFeWC.exe
  C:\Windows\System\gipFeWC.exe
  2⤵
  PID:9580
- C:\Windows\System\SmFNAMp.exe
  C:\Windows\System\SmFNAMp.exe
  2⤵
  PID:9612
- C:\Windows\System\vMwgDjW.exe
  C:\Windows\System\vMwgDjW.exe
  2⤵
  PID:9648
- C:\Windows\System\xgldufS.exe
  C:\Windows\System\xgldufS.exe
  2⤵
  PID:9756
- C:\Windows\System\gZaRLXd.exe
  C:\Windows\System\gZaRLXd.exe
  2⤵
  PID:9820
- C:\Windows\System\GpuaHTk.exe
  C:\Windows\System\GpuaHTk.exe
  2⤵
  PID:9892
- C:\Windows\System\ryvTSsT.exe
  C:\Windows\System\ryvTSsT.exe
  2⤵
  PID:9932
- C:\Windows\System\EYfatYE.exe
  C:\Windows\System\EYfatYE.exe
  2⤵
  PID:10036
- C:\Windows\System\yLPszRt.exe
  C:\Windows\System\yLPszRt.exe
  2⤵
  PID:10084
- C:\Windows\System\xwYZmQL.exe
  C:\Windows\System\xwYZmQL.exe
  2⤵
  PID:10140
- C:\Windows\System\mFGlLKU.exe
  C:\Windows\System\mFGlLKU.exe
  2⤵
  PID:10172
- C:\Windows\System\bmozndZ.exe
  C:\Windows\System\bmozndZ.exe
  2⤵
  PID:8488
- C:\Windows\System\rccySKj.exe
  C:\Windows\System\rccySKj.exe
  2⤵
  PID:9344
- C:\Windows\System\ZKbgwfU.exe
  C:\Windows\System\ZKbgwfU.exe
  2⤵
  PID:9584
- C:\Windows\System\DLPBrAJ.exe
  C:\Windows\System\DLPBrAJ.exe
  2⤵
  PID:9760
- C:\Windows\System\jBPoVBw.exe
  C:\Windows\System\jBPoVBw.exe
  2⤵
  PID:9952
- C:\Windows\System\qCBJQDh.exe
  C:\Windows\System\qCBJQDh.exe
  2⤵
  PID:10064
- C:\Windows\System\skiYraE.exe
  C:\Windows\System\skiYraE.exe
  2⤵
  PID:10104
- C:\Windows\System\spmIxEp.exe
  C:\Windows\System\spmIxEp.exe
  2⤵
  PID:9388
- C:\Windows\System\StGhpmm.exe
  C:\Windows\System\StGhpmm.exe
  2⤵
  PID:9844
- C:\Windows\System\awSKUvb.exe
  C:\Windows\System\awSKUvb.exe
  2⤵
  PID:10032
- C:\Windows\System\MeVGRGW.exe
  C:\Windows\System\MeVGRGW.exe
  2⤵
  PID:9960
- C:\Windows\System\YZUyhOV.exe
  C:\Windows\System\YZUyhOV.exe
  2⤵
  PID:10244
- C:\Windows\System\uqiFxAN.exe
  C:\Windows\System\uqiFxAN.exe
  2⤵
  PID:10260
- C:\Windows\System\yCDNjIB.exe
  C:\Windows\System\yCDNjIB.exe
  2⤵
  PID:10300
- C:\Windows\System\kEmgFCH.exe
  C:\Windows\System\kEmgFCH.exe
  2⤵
  PID:10320
- C:\Windows\System\GRLnzdY.exe
  C:\Windows\System\GRLnzdY.exe
  2⤵
  PID:10356
- C:\Windows\System\hkAcSmH.exe
  C:\Windows\System\hkAcSmH.exe
  2⤵
  PID:10376
- C:\Windows\System\ugEaDte.exe
  C:\Windows\System\ugEaDte.exe
  2⤵
  PID:10404
- C:\Windows\System\kEZNKLg.exe
  C:\Windows\System\kEZNKLg.exe
  2⤵
  PID:10444
- C:\Windows\System\pabDCjs.exe
  C:\Windows\System\pabDCjs.exe
  2⤵
  PID:10460
- C:\Windows\System\DCSvUav.exe
  C:\Windows\System\DCSvUav.exe
  2⤵
  PID:10500
- C:\Windows\System\iyvdHFt.exe
  C:\Windows\System\iyvdHFt.exe
  2⤵
  PID:10528
- C:\Windows\System\lRodnna.exe
  C:\Windows\System\lRodnna.exe
  2⤵
  PID:10544
- C:\Windows\System\cmMdqkC.exe
  C:\Windows\System\cmMdqkC.exe
  2⤵
  PID:10576
- C:\Windows\System\WmOvIJs.exe
  C:\Windows\System\WmOvIJs.exe
  2⤵
  PID:10612
- C:\Windows\System\UWihuUb.exe
  C:\Windows\System\UWihuUb.exe
  2⤵
  PID:10628
- C:\Windows\System\aWRYOUN.exe
  C:\Windows\System\aWRYOUN.exe
  2⤵
  PID:10660
- C:\Windows\System\EadvORM.exe
  C:\Windows\System\EadvORM.exe
  2⤵
  PID:10684
- C:\Windows\System\ZHfUfzm.exe
  C:\Windows\System\ZHfUfzm.exe
  2⤵
  PID:10728
- C:\Windows\System\HcSAMtk.exe
  C:\Windows\System\HcSAMtk.exe
  2⤵
  PID:10756
- C:\Windows\System\faxGxYR.exe
  C:\Windows\System\faxGxYR.exe
  2⤵
  PID:10784
- C:\Windows\System\bUYXFPZ.exe
  C:\Windows\System\bUYXFPZ.exe
  2⤵
  PID:10800
- C:\Windows\System\gebCJOe.exe
  C:\Windows\System\gebCJOe.exe
  2⤵
  PID:10840
- C:\Windows\System\eInEagF.exe
  C:\Windows\System\eInEagF.exe
  2⤵
  PID:10868
- C:\Windows\System\tJTCjjr.exe
  C:\Windows\System\tJTCjjr.exe
  2⤵
  PID:10896
- C:\Windows\System\oYGwljU.exe
  C:\Windows\System\oYGwljU.exe
  2⤵
  PID:10920
- C:\Windows\System\yjYhrZS.exe
  C:\Windows\System\yjYhrZS.exe
  2⤵
  PID:10940
- C:\Windows\System\EbNtnem.exe
  C:\Windows\System\EbNtnem.exe
  2⤵
  PID:10968
- C:\Windows\System\QtJDVJv.exe
  C:\Windows\System\QtJDVJv.exe
  2⤵
  PID:11000
- C:\Windows\System\HFfixDm.exe
  C:\Windows\System\HFfixDm.exe
  2⤵
  PID:11036
- C:\Windows\System\jGshZVM.exe
  C:\Windows\System\jGshZVM.exe
  2⤵
  PID:11052
- C:\Windows\System\qAeJVIp.exe
  C:\Windows\System\qAeJVIp.exe
  2⤵
  PID:11080
- C:\Windows\System\WGkTPqU.exe
  C:\Windows\System\WGkTPqU.exe
  2⤵
  PID:11120
- C:\Windows\System\OUtzRbh.exe
  C:\Windows\System\OUtzRbh.exe
  2⤵
  PID:11144
- C:\Windows\System\qUtGkDB.exe
  C:\Windows\System\qUtGkDB.exe
  2⤵
  PID:11164
- C:\Windows\System\ADYhMiS.exe
  C:\Windows\System\ADYhMiS.exe
  2⤵
  PID:11200
- C:\Windows\System\SGHCyCC.exe
  C:\Windows\System\SGHCyCC.exe
  2⤵
  PID:11220
- C:\Windows\System\BXyspFi.exe
  C:\Windows\System\BXyspFi.exe
  2⤵
  PID:11260
- C:\Windows\System\khHaUAo.exe
  C:\Windows\System\khHaUAo.exe
  2⤵
  PID:10280
- C:\Windows\System\bwSItDC.exe
  C:\Windows\System\bwSItDC.exe
  2⤵
  PID:10312
- C:\Windows\System\shjtbbF.exe
  C:\Windows\System\shjtbbF.exe
  2⤵
  PID:10368
- C:\Windows\System\JSZXhFP.exe
  C:\Windows\System\JSZXhFP.exe
  2⤵
  PID:10424
- C:\Windows\System\JJNnUxX.exe
  C:\Windows\System\JJNnUxX.exe
  2⤵
  PID:10540
- C:\Windows\System\JvpSFAp.exe
  C:\Windows\System\JvpSFAp.exe
  2⤵
  PID:10572
- C:\Windows\System\UDTUaIB.exe
  C:\Windows\System\UDTUaIB.exe
  2⤵
  PID:10652
- C:\Windows\System\BFtzpsz.exe
  C:\Windows\System\BFtzpsz.exe
  2⤵
  PID:10700
- C:\Windows\System\NgNynBE.exe
  C:\Windows\System\NgNynBE.exe
  2⤵
  PID:10772
- C:\Windows\System\BLesOue.exe
  C:\Windows\System\BLesOue.exe
  2⤵
  PID:10820
- C:\Windows\System\wAXbwLj.exe
  C:\Windows\System\wAXbwLj.exe
  2⤵
  PID:10880
- C:\Windows\System\CAXNRuZ.exe
  C:\Windows\System\CAXNRuZ.exe
  2⤵
  PID:10992
- C:\Windows\System\RagCzEs.exe
  C:\Windows\System\RagCzEs.exe
  2⤵
  PID:11068
- C:\Windows\System\TjuYlbI.exe
  C:\Windows\System\TjuYlbI.exe
  2⤵
  PID:11104
- C:\Windows\System\sXqdYoc.exe
  C:\Windows\System\sXqdYoc.exe
  2⤵
  PID:11156
- C:\Windows\System\vLWBqpU.exe
  C:\Windows\System\vLWBqpU.exe
  2⤵
  PID:11216
- C:\Windows\System\itZbBbA.exe
  C:\Windows\System\itZbBbA.exe
  2⤵
  PID:10340
- C:\Windows\System\vVrqmRI.exe
  C:\Windows\System\vVrqmRI.exe
  2⤵
  PID:10480
- C:\Windows\System\IGiQsgV.exe
  C:\Windows\System\IGiQsgV.exe
  2⤵
  PID:10584
- C:\Windows\System\jqbwdAG.exe
  C:\Windows\System\jqbwdAG.exe
  2⤵
  PID:10740
- C:\Windows\System\spVIdQt.exe
  C:\Windows\System\spVIdQt.exe
  2⤵
  PID:10892
- C:\Windows\System\qlptLSZ.exe
  C:\Windows\System\qlptLSZ.exe
  2⤵
  PID:11020
- C:\Windows\System\uwQhVsa.exe
  C:\Windows\System\uwQhVsa.exe
  2⤵
  PID:11152
- C:\Windows\System\sHnXyUC.exe
  C:\Windows\System\sHnXyUC.exe
  2⤵
  PID:11236
- C:\Windows\System\AmCQZAP.exe
  C:\Windows\System\AmCQZAP.exe
  2⤵
  PID:10536
- C:\Windows\System\VVieKJl.exe
  C:\Windows\System\VVieKJl.exe
  2⤵
  PID:10852
- C:\Windows\System\spVeTzI.exe
  C:\Windows\System\spVeTzI.exe
  2⤵
  PID:10252
- C:\Windows\System\QbjQuaq.exe
  C:\Windows\System\QbjQuaq.exe
  2⤵
  PID:1544
- C:\Windows\System\vhxunnD.exe
  C:\Windows\System\vhxunnD.exe
  2⤵
  PID:10388
- C:\Windows\System\blDduYm.exe
  C:\Windows\System\blDduYm.exe
  2⤵
  PID:11284
- C:\Windows\System\isHaJFc.exe
  C:\Windows\System\isHaJFc.exe
  2⤵
  PID:11324
- C:\Windows\System\gCyDoSz.exe
  C:\Windows\System\gCyDoSz.exe
  2⤵
  PID:11352
- C:\Windows\System\PVCrQpH.exe
  C:\Windows\System\PVCrQpH.exe
  2⤵
  PID:11380
- C:\Windows\System\pqNknbY.exe
  C:\Windows\System\pqNknbY.exe
  2⤵
  PID:11396
- C:\Windows\System\EaebbuP.exe
  C:\Windows\System\EaebbuP.exe
  2⤵
  PID:11432
- C:\Windows\System\FdAqNJI.exe
  C:\Windows\System\FdAqNJI.exe
  2⤵
  PID:11464
- C:\Windows\System\FwXGeyu.exe
  C:\Windows\System\FwXGeyu.exe
  2⤵
  PID:11492
- C:\Windows\System\XRFhfDN.exe
  C:\Windows\System\XRFhfDN.exe
  2⤵
  PID:11520
- C:\Windows\System\fqIffob.exe
  C:\Windows\System\fqIffob.exe
  2⤵
  PID:11548
- C:\Windows\System\aSGyAJp.exe
  C:\Windows\System\aSGyAJp.exe
  2⤵
  PID:11572
- C:\Windows\System\RmPxEcj.exe
  C:\Windows\System\RmPxEcj.exe
  2⤵
  PID:11592
- C:\Windows\System\Eagntmf.exe
  C:\Windows\System\Eagntmf.exe
  2⤵
  PID:11632
- C:\Windows\System\JqCqpxN.exe
  C:\Windows\System\JqCqpxN.exe
  2⤵
  PID:11648
- C:\Windows\System\HLtIXih.exe
  C:\Windows\System\HLtIXih.exe
  2⤵
  PID:11688
- C:\Windows\System\rFZoPwb.exe
  C:\Windows\System\rFZoPwb.exe
  2⤵
  PID:11716
- C:\Windows\System\mZqSdeN.exe
  C:\Windows\System\mZqSdeN.exe
  2⤵
  PID:11736
- C:\Windows\System\BOjYypP.exe
  C:\Windows\System\BOjYypP.exe
  2⤵
  PID:11772
- C:\Windows\System\VyPcivm.exe
  C:\Windows\System\VyPcivm.exe
  2⤵
  PID:11800
- C:\Windows\System\bUrdEVd.exe
  C:\Windows\System\bUrdEVd.exe
  2⤵
  PID:11816
- C:\Windows\System\qpTxJAz.exe
  C:\Windows\System\qpTxJAz.exe
  2⤵
  PID:11856
- C:\Windows\System\QiABzwj.exe
  C:\Windows\System\QiABzwj.exe
  2⤵
  PID:11900
- C:\Windows\System\ngDpfdj.exe
  C:\Windows\System\ngDpfdj.exe
  2⤵
  PID:11920
- C:\Windows\System\ntAdorK.exe
  C:\Windows\System\ntAdorK.exe
  2⤵
  PID:11956
- C:\Windows\System\RaToMZG.exe
  C:\Windows\System\RaToMZG.exe
  2⤵
  PID:12000
- C:\Windows\System\uIiccDh.exe
  C:\Windows\System\uIiccDh.exe
  2⤵
  PID:12024
- C:\Windows\System\fxJzCSR.exe
  C:\Windows\System\fxJzCSR.exe
  2⤵
  PID:12060
- C:\Windows\System\cMgxEsP.exe
  C:\Windows\System\cMgxEsP.exe
  2⤵
  PID:12080
- C:\Windows\System\posLfBR.exe
  C:\Windows\System\posLfBR.exe
  2⤵
  PID:12116
- C:\Windows\System\XVcXINf.exe
  C:\Windows\System\XVcXINf.exe
  2⤵
  PID:12140
- C:\Windows\System\fhXiIDR.exe
  C:\Windows\System\fhXiIDR.exe
  2⤵
  PID:12172
- C:\Windows\System\gnLRszL.exe
  C:\Windows\System\gnLRszL.exe
  2⤵
  PID:12196
- C:\Windows\System\DHpudBs.exe
  C:\Windows\System\DHpudBs.exe
  2⤵
  PID:12216
- C:\Windows\System\ibteyPQ.exe
  C:\Windows\System\ibteyPQ.exe
  2⤵
  PID:12252
- C:\Windows\System\AEEtknO.exe
  C:\Windows\System\AEEtknO.exe
  2⤵
  PID:11108
- C:\Windows\System\HhPYnkA.exe
  C:\Windows\System\HhPYnkA.exe
  2⤵
  PID:11308
- C:\Windows\System\ENiWLzV.exe
  C:\Windows\System\ENiWLzV.exe
  2⤵
  PID:11388
- C:\Windows\System\jZVKwcf.exe
  C:\Windows\System\jZVKwcf.exe
  2⤵
  PID:11456
- C:\Windows\System\IejEsJd.exe
  C:\Windows\System\IejEsJd.exe
  2⤵
  PID:11504
- C:\Windows\System\ntjdKgp.exe
  C:\Windows\System\ntjdKgp.exe
  2⤵
  PID:11564
- C:\Windows\System\ryyqfKo.exe
  C:\Windows\System\ryyqfKo.exe
  2⤵
  PID:11608
- C:\Windows\System\TXPJfpS.exe
  C:\Windows\System\TXPJfpS.exe
  2⤵
  PID:11680
- C:\Windows\System\KflmTsJ.exe
  C:\Windows\System\KflmTsJ.exe
  2⤵
  PID:11732
- C:\Windows\System\KOzuGnp.exe
  C:\Windows\System\KOzuGnp.exe
  2⤵
  PID:11792
- C:\Windows\System\kldlSbw.exe
  C:\Windows\System\kldlSbw.exe
  2⤵
  PID:11888
- C:\Windows\System\QzgFdhk.exe
  C:\Windows\System\QzgFdhk.exe
  2⤵
  PID:11944
- C:\Windows\System\SQtaPDe.exe
  C:\Windows\System\SQtaPDe.exe
  2⤵
  PID:11984
- C:\Windows\System\wshnNCC.exe
  C:\Windows\System\wshnNCC.exe
  2⤵
  PID:12052
- C:\Windows\System\ppiHxBO.exe
  C:\Windows\System\ppiHxBO.exe
  2⤵
  PID:12112
- C:\Windows\System\oEdFgvg.exe
  C:\Windows\System\oEdFgvg.exe
  2⤵
  PID:12180
- C:\Windows\System\uBxvqHt.exe
  C:\Windows\System\uBxvqHt.exe
  2⤵
  PID:12228
- C:\Windows\System\OOsmWqH.exe
  C:\Windows\System\OOsmWqH.exe
  2⤵
  PID:11280
- C:\Windows\System\dZvgvum.exe
  C:\Windows\System\dZvgvum.exe
  2⤵
  PID:11488
- C:\Windows\System\pOtFUwg.exe
  C:\Windows\System\pOtFUwg.exe
  2⤵
  PID:11700
- C:\Windows\System\MDlzTMj.exe
  C:\Windows\System\MDlzTMj.exe
  2⤵
  PID:11784
- C:\Windows\System\IJYWWVU.exe
  C:\Windows\System\IJYWWVU.exe
  2⤵
  PID:11852
- C:\Windows\System\naDbBld.exe
  C:\Windows\System\naDbBld.exe
  2⤵
  PID:12096
- C:\Windows\System\gCcyqKD.exe
  C:\Windows\System\gCcyqKD.exe
  2⤵
  PID:12280
- C:\Windows\System\XJPPcmM.exe
  C:\Windows\System\XJPPcmM.exe
  2⤵
  PID:11408
- C:\Windows\System\nFblrqo.exe
  C:\Windows\System\nFblrqo.exe
  2⤵
  PID:11928
- C:\Windows\System\PrGilMQ.exe
  C:\Windows\System\PrGilMQ.exe
  2⤵
  PID:12076
- C:\Windows\System\yvpTmDo.exe
  C:\Windows\System\yvpTmDo.exe
  2⤵
  PID:11744
- C:\Windows\System\lLkOSvj.exe
  C:\Windows\System\lLkOSvj.exe
  2⤵
  PID:12308
- C:\Windows\System\OPfheIN.exe
  C:\Windows\System\OPfheIN.exe
  2⤵
  PID:12324
- C:\Windows\System\BWFsDAC.exe
  C:\Windows\System\BWFsDAC.exe
  2⤵
  PID:12352
- C:\Windows\System\cbVrslf.exe
  C:\Windows\System\cbVrslf.exe
  2⤵
  PID:12380
- C:\Windows\System\dbsgZtA.exe
  C:\Windows\System\dbsgZtA.exe
  2⤵
  PID:12420
- C:\Windows\System\mNOtYxG.exe
  C:\Windows\System\mNOtYxG.exe
  2⤵
  PID:12468
- C:\Windows\System\zrtPMjA.exe
  C:\Windows\System\zrtPMjA.exe
  2⤵
  PID:12500
- C:\Windows\System\ioSqACs.exe
  C:\Windows\System\ioSqACs.exe
  2⤵
  PID:12524
- C:\Windows\System\yejZPvT.exe
  C:\Windows\System\yejZPvT.exe
  2⤵
  PID:12540
- C:\Windows\System\SCDKUbE.exe
  C:\Windows\System\SCDKUbE.exe
  2⤵
  PID:12568
- C:\Windows\System\trBVOVo.exe
  C:\Windows\System\trBVOVo.exe
  2⤵
  PID:12588
- C:\Windows\System\TAvQNFL.exe
  C:\Windows\System\TAvQNFL.exe
  2⤵
  PID:12624
- C:\Windows\System\JCsojrG.exe
  C:\Windows\System\JCsojrG.exe
  2⤵
  PID:12684
- C:\Windows\System\UtNbvAK.exe
  C:\Windows\System\UtNbvAK.exe
  2⤵
  PID:12724
- C:\Windows\System\aaNSJel.exe
  C:\Windows\System\aaNSJel.exe
  2⤵
  PID:12744
- C:\Windows\System\zVvQUIT.exe
  C:\Windows\System\zVvQUIT.exe
  2⤵
  PID:12788
- C:\Windows\System\jKitWIL.exe
  C:\Windows\System\jKitWIL.exe
  2⤵
  PID:12832
- C:\Windows\System\wzKuvWF.exe
  C:\Windows\System\wzKuvWF.exe
  2⤵
  PID:12856
- C:\Windows\System\Lwredih.exe
  C:\Windows\System\Lwredih.exe
  2⤵
  PID:12908
- C:\Windows\System\DITAKrt.exe
  C:\Windows\System\DITAKrt.exe
  2⤵
  PID:12936
- C:\Windows\System\iYmjsZV.exe
  C:\Windows\System\iYmjsZV.exe
  2⤵
  PID:12952
- C:\Windows\System\DZtQGXw.exe
  C:\Windows\System\DZtQGXw.exe
  2⤵
  PID:12968
- C:\Windows\System\yWSrsui.exe
  C:\Windows\System\yWSrsui.exe
  2⤵
  PID:13000
- C:\Windows\System\sdskXTs.exe
  C:\Windows\System\sdskXTs.exe
  2⤵
  PID:13036
- C:\Windows\System\mnZacXe.exe
  C:\Windows\System\mnZacXe.exe
  2⤵
  PID:13072
- C:\Windows\System\GjsFlPE.exe
  C:\Windows\System\GjsFlPE.exe
  2⤵
  PID:13088
- C:\Windows\System\KisuSke.exe
  C:\Windows\System\KisuSke.exe
  2⤵
  PID:13128
- C:\Windows\System\sxdoyBR.exe
  C:\Windows\System\sxdoyBR.exe
  2⤵
  PID:13192
- C:\Windows\System\hpXaEcX.exe
  C:\Windows\System\hpXaEcX.exe
  2⤵
  PID:13208
- C:\Windows\System\igCkCki.exe
  C:\Windows\System\igCkCki.exe
  2⤵
  PID:13228
- C:\Windows\System\mkpfyDL.exe
  C:\Windows\System\mkpfyDL.exe
  2⤵
  PID:13256
- C:\Windows\System\evQtlpA.exe
  C:\Windows\System\evQtlpA.exe
  2⤵
  PID:13288
- C:\Windows\System\gxavVwi.exe
  C:\Windows\System\gxavVwi.exe
  2⤵
  PID:12320
- C:\Windows\System\xeAwhJb.exe
  C:\Windows\System\xeAwhJb.exe
  2⤵
  PID:12372
- C:\Windows\System\cqjHGbS.exe
  C:\Windows\System\cqjHGbS.exe
  2⤵
  PID:12456
- C:\Windows\System\SDIRUlC.exe
  C:\Windows\System\SDIRUlC.exe
  2⤵
  PID:12552
- C:\Windows\System\mhGWkvk.exe
  C:\Windows\System\mhGWkvk.exe
  2⤵
  PID:12644
- C:\Windows\System\GcmKZYb.exe
  C:\Windows\System\GcmKZYb.exe
  2⤵
  PID:12676
- C:\Windows\System\LbaaTwZ.exe
  C:\Windows\System\LbaaTwZ.exe
  2⤵
  PID:12776
- C:\Windows\System\ENAQBQL.exe
  C:\Windows\System\ENAQBQL.exe
  2⤵
  PID:12876
- C:\Windows\System\jkTYhhS.exe
  C:\Windows\System\jkTYhhS.exe
  2⤵
  PID:12948
- C:\Windows\System\HlhrEUW.exe
  C:\Windows\System\HlhrEUW.exe
  2⤵
  PID:13024
- C:\Windows\System\JPZlwgf.exe
  C:\Windows\System\JPZlwgf.exe
  2⤵
  PID:13204
- C:\Windows\System\mBkuvip.exe
  C:\Windows\System\mBkuvip.exe
  2⤵
  PID:13240
- C:\Windows\System\pZEXmil.exe
  C:\Windows\System\pZEXmil.exe
  2⤵
  PID:13220
- C:\Windows\System\YBWcxlO.exe
  C:\Windows\System\YBWcxlO.exe
  2⤵
  PID:13284
- C:\Windows\System\GDsLyWw.exe
  C:\Windows\System\GDsLyWw.exe
  2⤵
  PID:12292
- C:\Windows\System\bThgSlm.exe
  C:\Windows\System\bThgSlm.exe
  2⤵
  PID:12488
- C:\Windows\System\TyRuMRP.exe
  C:\Windows\System\TyRuMRP.exe
  2⤵
  PID:12896
- C:\Windows\System\fmmeMRB.exe
  C:\Windows\System\fmmeMRB.exe
  2⤵
  PID:13144
- C:\Windows\System\fVwBUkY.exe
  C:\Windows\System\fVwBUkY.exe
  2⤵
  PID:13200
- C:\Windows\System\orhTXzT.exe
  C:\Windows\System\orhTXzT.exe
  2⤵
  PID:12672
- C:\Windows\System\EHsXiSg.exe
  C:\Windows\System\EHsXiSg.exe
  2⤵
  PID:12720
- C:\Windows\System\HtNoxVt.exe
  C:\Windows\System\HtNoxVt.exe
  2⤵
  PID:13116
- C:\Windows\System\emhOQxK.exe
  C:\Windows\System\emhOQxK.exe
  2⤵
  PID:12412
- C:\Windows\System\VCrndKk.exe
  C:\Windows\System\VCrndKk.exe
  2⤵
  PID:13352
- C:\Windows\System\RHwhSIE.exe
  C:\Windows\System\RHwhSIE.exe
  2⤵
  PID:13372
- C:\Windows\System\juFZAkJ.exe
  C:\Windows\System\juFZAkJ.exe
  2⤵
  PID:13392
- C:\Windows\System\wJaRxhN.exe
  C:\Windows\System\wJaRxhN.exe
  2⤵
  PID:13416
- C:\Windows\System\jSeNRwE.exe
  C:\Windows\System\jSeNRwE.exe
  2⤵
  PID:13476
- C:\Windows\System\lPaUfHt.exe
  C:\Windows\System\lPaUfHt.exe
  2⤵
  PID:13500
- C:\Windows\System\nqJeQIN.exe
  C:\Windows\System\nqJeQIN.exe
  2⤵
  PID:13532
- C:\Windows\System\ESVhAOA.exe
  C:\Windows\System\ESVhAOA.exe
  2⤵
  PID:13556
- C:\Windows\System\TtBVyBK.exe
  C:\Windows\System\TtBVyBK.exe
  2⤵
  PID:13572
- C:\Windows\System\vaOTwPz.exe
  C:\Windows\System\vaOTwPz.exe
  2⤵
  PID:13612
- C:\Windows\System\sOohtvW.exe
  C:\Windows\System\sOohtvW.exe
  2⤵
  PID:13652
- C:\Windows\System\IiIGOpe.exe
  C:\Windows\System\IiIGOpe.exe
  2⤵
  PID:13668
- C:\Windows\System\SgFbWIL.exe
  C:\Windows\System\SgFbWIL.exe
  2⤵
  PID:13684
- C:\Windows\System\ERCzLez.exe
  C:\Windows\System\ERCzLez.exe
  2⤵
  PID:13712
- C:\Windows\System\mnbanBO.exe
  C:\Windows\System\mnbanBO.exe
  2⤵
  PID:13736
- C:\Windows\System\rZRjOGq.exe
  C:\Windows\System\rZRjOGq.exe
  2⤵
  PID:13772
- C:\Windows\System\rmOGetv.exe
  C:\Windows\System\rmOGetv.exe
  2⤵
  PID:13828
- C:\Windows\System\TsnCLtd.exe
  C:\Windows\System\TsnCLtd.exe
  2⤵
  PID:13856
- C:\Windows\System\NkDXDTr.exe
  C:\Windows\System\NkDXDTr.exe
  2⤵
  PID:13884
- C:\Windows\System\PXPrQnO.exe
  C:\Windows\System\PXPrQnO.exe
  2⤵
  PID:13912
- C:\Windows\System\qRPMalK.exe
  C:\Windows\System\qRPMalK.exe
  2⤵
  PID:13928
- C:\Windows\System\kWlfaQB.exe
  C:\Windows\System\kWlfaQB.exe
  2⤵
  PID:13968
- C:\Windows\System\AyNzIwY.exe
  C:\Windows\System\AyNzIwY.exe
  2⤵
  PID:13996
- C:\Windows\System\TCCzhws.exe
  C:\Windows\System\TCCzhws.exe
  2⤵
  PID:14024
- C:\Windows\System\PYzcoxy.exe
  C:\Windows\System\PYzcoxy.exe
  2⤵
  PID:14048
- C:\Windows\System\QbUtcNo.exe
  C:\Windows\System\QbUtcNo.exe
  2⤵
  PID:14076
- C:\Windows\System\sJOakLN.exe
  C:\Windows\System\sJOakLN.exe
  2⤵
  PID:14104
- C:\Windows\System\fJpWbDF.exe
  C:\Windows\System\fJpWbDF.exe
  2⤵
  PID:14136
- C:\Windows\System\RsQZMcO.exe
  C:\Windows\System\RsQZMcO.exe
  2⤵
  PID:14176
- C:\Windows\System\NytDWuF.exe
  C:\Windows\System\NytDWuF.exe
  2⤵
  PID:14204
- C:\Windows\System\EXIyHau.exe
  C:\Windows\System\EXIyHau.exe
  2⤵
  PID:14232
- C:\Windows\System\onZyUCj.exe
  C:\Windows\System\onZyUCj.exe
  2⤵
  PID:14252
- C:\Windows\System\MDkwVQT.exe
  C:\Windows\System\MDkwVQT.exe
  2⤵
  PID:14276
- C:\Windows\System\lDBxXFR.exe
  C:\Windows\System\lDBxXFR.exe
  2⤵
  PID:14316
- C:\Windows\System\ItUXvVf.exe
  C:\Windows\System\ItUXvVf.exe
  2⤵
  PID:12612
- C:\Windows\System\TsyYMjm.exe
  C:\Windows\System\TsyYMjm.exe
  2⤵
  PID:4940
- C:\Windows\System\XRCkHfe.exe
  C:\Windows\System\XRCkHfe.exe
  2⤵
  PID:1384
- C:\Windows\System\HNEpnDG.exe
  C:\Windows\System\HNEpnDG.exe
  2⤵
  PID:13460
- C:\Windows\System\knFKeoA.exe
  C:\Windows\System\knFKeoA.exe
  2⤵
  PID:13472
- C:\Windows\System\hgmIKMz.exe
  C:\Windows\System\hgmIKMz.exe
  2⤵
  PID:13544
- C:\Windows\System\UZfkDke.exe
  C:\Windows\System\UZfkDke.exe
  2⤵
  PID:13596
- C:\Windows\System\uCbAEIp.exe
  C:\Windows\System\uCbAEIp.exe
  2⤵
  PID:13660
- C:\Windows\System\cFecOOY.exe
  C:\Windows\System\cFecOOY.exe
  2⤵
  PID:13704
- C:\Windows\System\xGreRqY.exe
  C:\Windows\System\xGreRqY.exe
  2⤵
  PID:13764
- C:\Windows\System\fNpzxzL.exe
  C:\Windows\System\fNpzxzL.exe
  2⤵
  PID:13840
- C:\Windows\System\fyzNslw.exe
  C:\Windows\System\fyzNslw.exe
  2⤵
  PID:13956
- C:\Windows\System\KlOThUm.exe
  C:\Windows\System\KlOThUm.exe
  2⤵
  PID:13992
- C:\Windows\System\BVeOOEA.exe
  C:\Windows\System\BVeOOEA.exe
  2⤵
  PID:14132
- C:\Windows\System\tRqGndM.exe
  C:\Windows\System\tRqGndM.exe
  2⤵
  PID:14196
- C:\Windows\System\XwALJaW.exe
  C:\Windows\System\XwALJaW.exe
  2⤵
  PID:14296
- C:\Windows\System\GejPUnY.exe
  C:\Windows\System\GejPUnY.exe
  2⤵
  PID:13248
- C:\Windows\System\UGVrfKJ.exe
  C:\Windows\System\UGVrfKJ.exe
  2⤵
  PID:13340
- C:\Windows\System\PVDiKnV.exe
  C:\Windows\System\PVDiKnV.exe
  2⤵
  PID:13512
- C:\Windows\System\vvIxiSi.exe
  C:\Windows\System\vvIxiSi.exe
  2⤵
  PID:13636
- C:\Windows\System\OzfqhHO.exe
  C:\Windows\System\OzfqhHO.exe
  2⤵
  PID:13804
- C:\Windows\System\SVbqnLe.exe
  C:\Windows\System\SVbqnLe.exe
  2⤵
  PID:13896
- C:\Windows\System\daFwMDq.exe
  C:\Windows\System\daFwMDq.exe
  2⤵
  PID:14096
- C:\Windows\System\lSOeBrm.exe
  C:\Windows\System\lSOeBrm.exe
  2⤵
  PID:13900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DEYhPGN.exe

Filesize
2.2MB

MD5
50b986ae53bb5dade9478888e0c49033

SHA1
98a317f13e803d4a827b6c0b0dddbd0eb9a329cd

SHA256
6455770a7a30a83765fbbad694542b3b329f03d4b6c012155566a2139c1273b5

SHA512
9e99b8323569fd155aa5db9c3e75774ea56e0bc576fd372b96064555560072a66e15a82f75979e82cdd119c4cba0946ff48351779534ab967396c175b6cb3293

Download Submit
C:\Windows\System\DUXZQmh.exe

Filesize
2.2MB

MD5
b2d6e6ee70838e00371b9e8989a9ab9e

SHA1
f614eeb14abb0b761a8e91c4016fc393ec6e9400

SHA256
ba07da562e72ec6117a374e501a35777facfd2e594004313632d4e7973e6c996

SHA512
30e225f3c7c042b576a93d0f10287c3e1725fb33cb21fac6f3d7f9363d3e1c3caa52000aefe8df7a26b9531817c0392ed16b8e38cbc6b5a27c9ad62da5faca06

Download Submit
C:\Windows\System\EQLkvoi.exe

Filesize
2.2MB

MD5
5c1c44964757b982fe7837bc1cb79c01

SHA1
fee4e98b5b2669a0649ab454ee83ce3495d0787a

SHA256
40cb154fbcc8e4a466e96194007b93074479a93029d84f56b270999c39a1055a

SHA512
ad21128ef16c0d850555edb0c5859bb9c186233e579fc9b2ac637f75e279d3d74fa19b00bd287f2efdb5913f51ffb4a1a3e7f26e5907628bfafadf5e29a7ed5d

Download Submit
C:\Windows\System\FwrPHjJ.exe

Filesize
2.2MB

MD5
ab992a9ca2dc952d301973d2ad81ddd9

SHA1
513ac18525e5594052abaa04950900750cf2e9f0

SHA256
e9e51d8720c3a166b681e7d6a17983d21bd8fea480274a762f421f2130debff6

SHA512
fea58bb09c7a0027999fa25b0888762c571f6e13066d103979072be50ba9c430fc4168439b7992dc39ad4a26089ce63fa562acaf004092f5fa061fe4c169a86c

Download Submit
C:\Windows\System\IwmwUeG.exe

Filesize
2.2MB

MD5
f0ab0d1578ea9d3bc0a8411ded4f460b

SHA1
b4b483d132374988b3b797323e69358143e58c18

SHA256
d7732e81202fcbd51c0a872083bf784140650173be18303b1f6dd600d0d5f6cc

SHA512
9c57d741a1bb5a87f7373ffb25d37a48eac10df4a6dac46c651013eece8bf5a061564a44296d19d61a557573a3bbe711c96ec71b3bebf20053a58aa801db4f20

Download Submit
C:\Windows\System\KpPlLVA.exe

Filesize
2.2MB

MD5
beed6a14a0baefd504d40d3bb9171a3c

SHA1
90fdd298ac98b152d9d549858c44327833274600

SHA256
d7ae1e26014d96cc7fb0c860ca8ad675a2c9ed749a1ea8396bc0c11cdb84226e

SHA512
96ceca338f85e44eb9de420fdb51e164fc50a4408e8375e2ba6858e29dfb2592c6db1d4509f62bc2a0ecb14a803195d0fbfea42f1a835d4583ae4754cae91151

Download Submit
C:\Windows\System\LQggxvz.exe

Filesize
2.2MB

MD5
1e0bcac43685b5dd80506d3f98e10050

SHA1
a3a6fc620222cb0418da8229a0ea7ec99f0fcb89

SHA256
1333131e831639ab87e06c4bd2373ec2984af03d2f077adf525b38be43709681

SHA512
3e9d69c12a58823b9a8613df5cd9ae8d5e03b1a74b5942bbb215b4ab28a976a3c11558f74ab5e760ec2aff2f959622fe3d2ea22309b688be4b3e3387d3e8f9c4

Download Submit
C:\Windows\System\LoaUvLw.exe

Filesize
2.2MB

MD5
164fb0aa642feb83baab7a5c5c004b8c

SHA1
f0796a20344068b9b84c7af6cd13cb7d8f2f507d

SHA256
824a9291058ee7fe654d6641ab942505a73016a98626e621dd30079573db6643

SHA512
f4aa565543032778d4740cd4fa59eb99d3d9ae0a8c0e5ea9f221ddf3fc9ca2bf7039d6a7a46cedf45c12b354b064c967cb0027d36e4bf0cae2cca14dd41231b5

Download Submit
C:\Windows\System\MTogzDF.exe

Filesize
2.2MB

MD5
161c5166393798b93f7ddb9694d26400

SHA1
6c40e090006366800ab007eea7a0137a65fc8f4d

SHA256
c958932109bab80997f2ae7803bb2f5c287508973ff0f884340cfaa0fb6a137f

SHA512
1c5b842080612b49f249e13399fe331238a5cc0456fa536b9ab0621f908f85d7f674735b2acf6f7d401b436779b92a60affc577eb98edbddfe38ac1bbb970bf2

Download Submit
C:\Windows\System\NXvDOwU.exe

Filesize
2.2MB

MD5
ddf8fa83d38ea8f283d227e0262e3385

SHA1
165a0d6509582647de132f1a8b085d7cad218943

SHA256
7737632c261941328a048e7e1683de7eaccbeaa651a13595471d888a747e51f6

SHA512
875728d74e5df94c91601821b4dcce3a1ee525f1ccdc86bb591ff61dfc5b6dcbafbbf36ee4a3a623158bc7e9df1ad884bbe6383bacc7607bf3953a4a57c7bf68

Download Submit
C:\Windows\System\PmVpqPK.exe

Filesize
2.2MB

MD5
d0e3df0577df74c696ad01e053418b7f

SHA1
43b786c857c7f4d3bacce901758387296f98c61f

SHA256
c18d361fb23223c55db81021f99722f7d0f5ef4f86d26e96aba15ecd117eabaf

SHA512
43986bdab8e8ee881f26e21c6290dca8925fb4bcc5db98f0653cf30cff0cec0d4cff3c298f9e0f4d862dff98ea193d3b9e23fc7f7f410b3183a184972ab40f12

Download Submit
C:\Windows\System\PnBnAcu.exe

Filesize
2.2MB

MD5
352fbdbeab435fac8d01310817d68af6

SHA1
b2403a6a6363f13441fde16cc3a1289a150ed05a

SHA256
fbedceda687fdf3701a36a25b9aa34fb0e433aad278c2df78e61c00ca49bbba0

SHA512
e938d854a781919e479154ab22bc8e4e01689a09e1f9fb5c18a617fdd50d26a8acf807bb1574f7a02e38c1a94423ab83aa78a67b6a4334096ae632b4179083ae

Download Submit
C:\Windows\System\TuaSMGx.exe

Filesize
2.2MB

MD5
9d9fafa8348f16d6084f54eed48c36e6

SHA1
09f6f8ae4fb3b3a3386bddefd7346a58fbc6b1a6

SHA256
8c1c50bb8e7586cecaee19ca3b382492ac38ee5ae081a7761a7756ebf2c71e62

SHA512
044fc0e4cdc15b7c5e7da817c650471bd1c8a3968e1c37fe5186c54650c2c97b1ff8cf08717758100a6dc4c489695876bb24e1242d920b149c2331a7ceaf002c

Download Submit
C:\Windows\System\YLoxnKu.exe

Filesize
2.2MB

MD5
296a784a3c7e4a644746eb6ba95e92d1

SHA1
da7591228df0f75094ded141a2a6ea46112c885c

SHA256
972628367846f33fd62e551d8cc88ecb4efdb59d322c1a25581c028df4f61c39

SHA512
37c8abfa215a4c2e861ca582c40a1aa97ef47a794481f80a15a5f1b9da0578c9b71c597c18be6cdc16edc5fa5bd6580bd761bebc80df0a23e1d5db2168c33d6e

Download Submit
C:\Windows\System\YdCHnfF.exe

Filesize
2.2MB

MD5
f4659691119cfc0b8e65d7be61b29ea9

SHA1
2ca3a0a7bebc6900d52f0a23d8ad92657415657a

SHA256
28c1a1091fd98df067b4246848e4395dc14fd878d6b444b7e7a71bcd4b73b3f3

SHA512
7f4222b0505689ff9cb102520fa64b516b300b62784845dd01e011c91897336e7cbdacece64ae095ba90bd2646d50a5c9e022a135e57cd794e918c8d5383533e

Download Submit
C:\Windows\System\acxiqPt.exe

Filesize
2.2MB

MD5
34bbb6afec3c2ad68ff1c38f506be1db

SHA1
2bc0e3152271661cf306ee5e6c540cf7e36e74d6

SHA256
a87ab41c868d8220a147aeda15089f6bfdc30f533e99700e702e46903788b030

SHA512
9c71dc1d1c78af97777e164ac0cd7fa547d2b3bfcd340b08cad13a5c4dd05357c40c46608c97570e155eb22febe5c4625ab02afd06e49333048a8a238776cebe

Download Submit
C:\Windows\System\bauRbfS.exe

Filesize
2.2MB

MD5
ddecc2d4c41e6636f124a4cbc81d09e1

SHA1
d5910d0c9e53ff36a078b6eb46249dbd50ceeee7

SHA256
eb27925eb4569a2ce9b8139446e333db650e38215ae859d31339cd449ee80cde

SHA512
eb457b311606c20c20e28f398ad1eab60c4d101e6e7081f18cbf839c6c20481a12214fe4c0b5a786bb2ba18900607b40a9ebd76c6a7c67c50a32fd7a9e48e95e

Download Submit
C:\Windows\System\byeWsUV.exe

Filesize
2.2MB

MD5
bf5f72e3441fd7b1a9cc6fad15199e64

SHA1
b4f287c0eb9d344615bd8b610a4d687743bb5a61

SHA256
037f2569187eed90d66eae30e57f27f75b081400cc63e7f3c01c1fa541fc3f96

SHA512
0d1c60a6b18fab9386bce92ff7bfcb53335e55a9dee2d5fd2523cacc2997ba41caf956ceefc917d7cb8bdfb521582ad43425e95519b8e86eb805eab88ef94bc3

Download Submit
C:\Windows\System\jpMEFFH.exe

Filesize
2.2MB

MD5
884fcc6819852dd920d15121daa01cd4

SHA1
949abe128d7e5d282a51d443310d91dcc9dc0178

SHA256
f006f779eb1e642a5a6d66f614e9882ed45805c1e042eee7c1692271e4dd3f11

SHA512
93869f5d2354051e099b84c903605342c45312071d52bae87a4dac4f1b90ce2f2a66bfdf6362ed37a93b0481fea93f0cc640827a333ab5681d5ca13891447091

Download Submit
C:\Windows\System\kjqSiMB.exe

Filesize
2.2MB

MD5
9b9c2ea1f85d4880747be8d07b0d4d36

SHA1
6032d2711235d0b14c0c0b82b3c8e22282a63d22

SHA256
c40c6faf21b445e079da4a863e2b9d418e9a1eba6a1b079237aa2f47d52a8d78

SHA512
500304739ff3a23f18f96ea8af659adefc7efbbf2ac1aaa60ed4448c600ca82101707e407043912ca3e6ad6b264787d250bf8b8584db61f71b6a7574c94d7ee1

Download Submit
C:\Windows\System\lEZDyFi.exe

Filesize
2.2MB

MD5
62b34d09ec56b142341883136cd2bb50

SHA1
e292f15c1482cce7d635ee5fd65da8a79444e472

SHA256
6cc619ec191b88de232f3873c473da299ef43019a8ed143099481aaeb27eb4c3

SHA512
9acd029982758306b48857e45b21bd3db25bf6321414db5f0fffd14d5807b2af43f697039eb4e7064c1c62a999afecf2dc7f702389139eea72276dbb7d3a4d03

Download Submit
C:\Windows\System\lJMzXuG.exe

Filesize
2.2MB

MD5
09749d969ebd27f7b8c0fd78d609c519

SHA1
02d01350fad84453a5a2c5a07a4adb5460767c00

SHA256
1e2093ac75b14cd17800777f8ccb6041649eb46386bf038a686561fbf7762a54

SHA512
72b0ccb81d0ffb1ba7f2f4d6a379ad9dc9db2690eb7993eaac2db4a8871711f77e5a929586a77570635d8148c84c21b78d958223a248128968f30ea8d33e974b

Download Submit
C:\Windows\System\mfDaVgN.exe

Filesize
2.2MB

MD5
ead58c2580f844a494504fce4359e8df

SHA1
02d6c5b51b5885f9ce842b02d8b668f7e7306cae

SHA256
2775771e46bb0ee072a7dd00aa639ecbcd80142ed8cddb06f96d07b056e20712

SHA512
1e877921f3e163678ffc272b6ef119bbff386232ca26e2742dc1264f5efe20a6cf393d9e575dc5d20840ae4c07eb6ec55da3585ab8e854250dd4bf94dd87e3b4

Download Submit
C:\Windows\System\pZqUtEI.exe

Filesize
2.2MB

MD5
a9e8753914f350e73a232cd48512200b

SHA1
779ee341d26540b1bfa3bda2dae7f63024038cd1

SHA256
61b42a4762c3e9b3cf19392705bfdbc43bfb8bffe8f4935a4ed3f61d2c03368b

SHA512
d6185aa0f320dabb828ec022c931d5237642344fd2dbff0a489d8bd5d67da7e9d40b002322c7ee630294c6e670f225e108b1c916642a87fe46016864b42785ac

Download Submit
C:\Windows\System\pdaoxUv.exe

Filesize
2.2MB

MD5
b571658bf89e381ae25838461cc14a82

SHA1
eba21403c398cac6044fe030236ba56fe08d25da

SHA256
9b1b34fa1ca7c58a51edd86af41b190566e2141a3e385ffcead82e4c90d084ab

SHA512
d604f45052b6411a4575e292c321340df5d36daa0e8c7c89ca1b85b800848c026d270b80a340c7a3960be47ca148bca2e7487d31022de4b03967a784cadfc678

Download Submit
C:\Windows\System\rPUdfYn.exe

Filesize
2.2MB

MD5
99ad55f6df101265664d88406591d6fd

SHA1
e23a5b6b16541f13d60dd2895404e8bd1092cdaa

SHA256
8c30b346c525221f0c67cefbd01311ef535f865ae480a2aff5aa666694e2ec26

SHA512
4b27e239cbf8f03ff9ce01b87467fd3f58c9f75de4c9f37269fbcadcf7a7a3e26022d9326994c75acc5f78366f0e4fee7ba1c7e9a4f004b0f8928d0eafabe0bc

Download Submit
C:\Windows\System\szqrGiX.exe

Filesize
2.2MB

MD5
c2384a0b1fbab65a2b7fad1b10465256

SHA1
b730ca3cb060b66ababebf4c9cb5203120bcc21b

SHA256
94651a3ba7a10c135636ce0ae0e3cbe289481a2ac7b6ac53755f9305b9de5e7c

SHA512
6dedf1e236744144ee0eec6efe59a6eda835c7aad7d7cb7ac21f22dde7bcdd6c1a02d14c00ac55c4b2b8695892fbba2c2fdee032d34913bd2740c0a43095fec0

Download Submit
C:\Windows\System\twOhADs.exe

Filesize
2.2MB

MD5
6b5d07e37046a9b41f008728ffea0353

SHA1
d2deb1c9e2da688895beea156817629cbec234c2

SHA256
f78eedd24cb594c779b5b2afbf0447473da49159ca8e8a9e77cd26956ac90f02

SHA512
027366f099e15ce124348aab56ec6ca5f931cd231dc7cfee8977213d480ec647ab2c914177d5dfd3273b097a74629bc1a9ae3f0ffe3349e41216d7dcf7840108

Download Submit
C:\Windows\System\uzbqDZS.exe

Filesize
2.2MB

MD5
e93d2275e89a805fe70bd07f8129f9b1

SHA1
be00119720fd0c4c7c906a886568ed2326e39a5c

SHA256
018a77014754189d1bc63227df8563120652ec9538982822ce1ec0736e44a86b

SHA512
43a1e2c5234dc2c36953453b471578847f92fa51cac2bd83cab3d9ad7278e96c30978674e4352b4e86781ed9743451c0d275e9c93ee1da74c92a9c15442bb253

Download Submit
C:\Windows\System\vptXwPJ.exe

Filesize
2.2MB

MD5
35030bb7cc83365dc6675b2fd8a06485

SHA1
9274d4a8c8dc484ecf77c84f292c0213fb573b6d

SHA256
277868058d86bb5e17d4430e657c0e6c3f3421cbeb826c0dd25bf81c62444484

SHA512
6445371ed5fd9b53e20553745cae0c1f22b6c1c2a10318924907f38d30d3a8e9222c0bdabc894dbdad3c6947a554123620191dd8b49eef4d8deeaf2af603f63c

Download Submit
C:\Windows\System\vwnnUur.exe

Filesize
2.2MB

MD5
0e8e7bd268e87eab8782cef8ae88811c

SHA1
1acae4b1d387227c5397e95f1f80b0f461dec163

SHA256
b5431d395bf4542aaeb6c0e47f2eef2c6354fb078691a846dab658b141aaaea4

SHA512
555940a5ffe5fa91f9657193793e71adee6741b50c36bf21a76024f1dfe15fceb6821c261cf26aaac5351ad6e703ee599e9ec3619da98276ab1e7ecb206fabd1

Download Submit
C:\Windows\System\yRBWRgz.exe

Filesize
2.2MB

MD5
038165380b0bab236d7139a2944db2c3

SHA1
667ac00a61476b6ae1bd586874a28a684c806b4d

SHA256
90f01340dc08daec294a695a8348e83ac8f5c966604a2137cc967f474172354d

SHA512
d974e8b87238bec1592f75469c818e96268a4b0aab2e49e4bd09ba67be5469cc48d0f81683fa796fcffaf4616a4135587d6a5bef9b1d777db6d41ee2e004edc7

Download Submit
memory/320-30-0x00007FF6F1350000-0x00007FF6F16A4000-memory.dmp

Filesize
3.3MB

Download
memory/320-2186-0x00007FF6F1350000-0x00007FF6F16A4000-memory.dmp

Filesize
3.3MB

Download
memory/320-2178-0x00007FF6F1350000-0x00007FF6F16A4000-memory.dmp

Filesize
3.3MB

Download
memory/400-2205-0x00007FF605F70000-0x00007FF6062C4000-memory.dmp

Filesize
3.3MB

Download
memory/400-717-0x00007FF605F70000-0x00007FF6062C4000-memory.dmp

Filesize
3.3MB

Download
memory/464-729-0x00007FF615260000-0x00007FF6155B4000-memory.dmp

Filesize
3.3MB

Download
memory/464-2198-0x00007FF615260000-0x00007FF6155B4000-memory.dmp

Filesize
3.3MB

Download
memory/628-2211-0x00007FF7A49A0000-0x00007FF7A4CF4000-memory.dmp

Filesize
3.3MB

Download
memory/628-692-0x00007FF7A49A0000-0x00007FF7A4CF4000-memory.dmp

Filesize
3.3MB

Download
memory/1004-2204-0x00007FF786CB0000-0x00007FF787004000-memory.dmp

Filesize
3.3MB

Download
memory/1004-718-0x00007FF786CB0000-0x00007FF787004000-memory.dmp

Filesize
3.3MB

Download
memory/1208-2182-0x00007FF68E010000-0x00007FF68E364000-memory.dmp

Filesize
3.3MB

Download
memory/1208-2193-0x00007FF68E010000-0x00007FF68E364000-memory.dmp

Filesize
3.3MB

Download
memory/1208-56-0x00007FF68E010000-0x00007FF68E364000-memory.dmp

Filesize
3.3MB

Download
memory/1252-2208-0x00007FF66CDA0000-0x00007FF66D0F4000-memory.dmp

Filesize
3.3MB

Download
memory/1252-701-0x00007FF66CDA0000-0x00007FF66D0F4000-memory.dmp

Filesize
3.3MB

Download
memory/1468-2188-0x00007FF644460000-0x00007FF6447B4000-memory.dmp

Filesize
3.3MB

Download
memory/1468-2180-0x00007FF644460000-0x00007FF6447B4000-memory.dmp

Filesize
3.3MB

Download
memory/1468-41-0x00007FF644460000-0x00007FF6447B4000-memory.dmp

Filesize
3.3MB

Download
memory/1476-2201-0x00007FF61FA40000-0x00007FF61FD94000-memory.dmp

Filesize
3.3MB

Download
memory/1476-725-0x00007FF61FA40000-0x00007FF61FD94000-memory.dmp

Filesize
3.3MB

Download
memory/1528-693-0x00007FF77B850000-0x00007FF77BBA4000-memory.dmp

Filesize
3.3MB

Download
memory/1528-2210-0x00007FF77B850000-0x00007FF77BBA4000-memory.dmp

Filesize
3.3MB

Download
memory/1580-2197-0x00007FF6B1580000-0x00007FF6B18D4000-memory.dmp

Filesize
3.3MB

Download
memory/1580-733-0x00007FF6B1580000-0x00007FF6B18D4000-memory.dmp

Filesize
3.3MB

Download
memory/1728-724-0x00007FF700160000-0x00007FF7004B4000-memory.dmp

Filesize
3.3MB

Download
memory/1728-2202-0x00007FF700160000-0x00007FF7004B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-2179-0x00007FF6A4000000-0x00007FF6A4354000-memory.dmp

Filesize
3.3MB

Download
memory/1960-2189-0x00007FF6A4000000-0x00007FF6A4354000-memory.dmp

Filesize
3.3MB

Download
memory/1960-38-0x00007FF6A4000000-0x00007FF6A4354000-memory.dmp

Filesize
3.3MB

Download
memory/2052-741-0x00007FF6640D0000-0x00007FF664424000-memory.dmp

Filesize
3.3MB

Download
memory/2052-2195-0x00007FF6640D0000-0x00007FF664424000-memory.dmp

Filesize
3.3MB

Download
memory/2152-2194-0x00007FF7D2640000-0x00007FF7D2994000-memory.dmp

Filesize
3.3MB

Download
memory/2152-689-0x00007FF7D2640000-0x00007FF7D2994000-memory.dmp

Filesize
3.3MB

Download
memory/2572-21-0x00007FF76D090000-0x00007FF76D3E4000-memory.dmp

Filesize
3.3MB

Download
memory/2572-2184-0x00007FF76D090000-0x00007FF76D3E4000-memory.dmp

Filesize
3.3MB

Download
memory/2592-698-0x00007FF66AD60000-0x00007FF66B0B4000-memory.dmp

Filesize
3.3MB

Download
memory/2592-2209-0x00007FF66AD60000-0x00007FF66B0B4000-memory.dmp

Filesize
3.3MB

Download
memory/2852-2187-0x00007FF632790000-0x00007FF632AE4000-memory.dmp

Filesize
3.3MB

Download
memory/2852-686-0x00007FF632790000-0x00007FF632AE4000-memory.dmp

Filesize
3.3MB

Download
memory/2988-690-0x00007FF6907F0000-0x00007FF690B44000-memory.dmp

Filesize
3.3MB

Download
memory/2988-2196-0x00007FF6907F0000-0x00007FF690B44000-memory.dmp

Filesize
3.3MB

Download
memory/2996-2200-0x00007FF7D6100000-0x00007FF7D6454000-memory.dmp

Filesize
3.3MB

Download
memory/2996-734-0x00007FF7D6100000-0x00007FF7D6454000-memory.dmp

Filesize
3.3MB

Download
memory/3252-2183-0x00007FF750250000-0x00007FF7505A4000-memory.dmp

Filesize
3.3MB

Download
memory/3252-10-0x00007FF750250000-0x00007FF7505A4000-memory.dmp

Filesize
3.3MB

Download
memory/3540-2190-0x00007FF657C80000-0x00007FF657FD4000-memory.dmp

Filesize
3.3MB

Download
memory/3540-2181-0x00007FF657C80000-0x00007FF657FD4000-memory.dmp

Filesize
3.3MB

Download
memory/3540-49-0x00007FF657C80000-0x00007FF657FD4000-memory.dmp

Filesize
3.3MB

Download
memory/4064-688-0x00007FF7D4DA0000-0x00007FF7D50F4000-memory.dmp

Filesize
3.3MB

Download
memory/4064-2191-0x00007FF7D4DA0000-0x00007FF7D50F4000-memory.dmp

Filesize
3.3MB

Download
memory/4240-710-0x00007FF61BD40000-0x00007FF61C094000-memory.dmp

Filesize
3.3MB

Download
memory/4240-2206-0x00007FF61BD40000-0x00007FF61C094000-memory.dmp

Filesize
3.3MB

Download
memory/4360-2203-0x00007FF723330000-0x00007FF723684000-memory.dmp

Filesize
3.3MB

Download
memory/4360-691-0x00007FF723330000-0x00007FF723684000-memory.dmp

Filesize
3.3MB

Download
memory/4484-0-0x00007FF6C7860000-0x00007FF6C7BB4000-memory.dmp

Filesize
3.3MB

Download
memory/4484-1-0x0000022F523A0000-0x0000022F523B0000-memory.dmp

Filesize
64KB

Download
memory/4484-2010-0x00007FF6C7860000-0x00007FF6C7BB4000-memory.dmp

Filesize
3.3MB

Download
memory/4556-2207-0x00007FF6C17C0000-0x00007FF6C1B14000-memory.dmp

Filesize
3.3MB

Download
memory/4556-704-0x00007FF6C17C0000-0x00007FF6C1B14000-memory.dmp

Filesize
3.3MB

Download
memory/4700-20-0x00007FF7FF810000-0x00007FF7FFB64000-memory.dmp

Filesize
3.3MB

Download
memory/4700-2185-0x00007FF7FF810000-0x00007FF7FFB64000-memory.dmp

Filesize
3.3MB

Download
memory/4856-737-0x00007FF776CD0000-0x00007FF777024000-memory.dmp

Filesize
3.3MB

Download
memory/4856-2199-0x00007FF776CD0000-0x00007FF777024000-memory.dmp

Filesize
3.3MB

Download
memory/5088-687-0x00007FF765F20000-0x00007FF766274000-memory.dmp

Filesize
3.3MB

Download
memory/5088-2192-0x00007FF765F20000-0x00007FF766274000-memory.dmp

Filesize
3.3MB

Download