xmrig | b715e78ddf492fc782c384c9213fd526d7265e2395471346ac11a1eaf7414afb

Analysis

max time kernel
121s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
Size

2.3MB
MD5

3eaef3c250a52f944d8df341bbc17460
SHA1

1f2de31c910cf87d3ee2faf2037c45577803738a
SHA256

b715e78ddf492fc782c384c9213fd526d7265e2395471346ac11a1eaf7414afb
SHA512

a81f910740000106cc9193d4510849e8ba5328aa35b488a8c731d8a9ea84571ef177e5439c1ade666283d1ad6bb18df035ee8bb8b2ab6c0b83108a26d9beadde
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6Y:oemTLkNdfE0pZrQm

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1280-0-0x00007FF70BF90000-0x00007FF70C2E4000-memory.dmp	xmrig
behavioral2/files/0x00060000000232a4-5.dat	xmrig
behavioral2/memory/4292-15-0x00007FF6ECDA0000-0x00007FF6ED0F4000-memory.dmp	xmrig
behavioral2/memory/1620-20-0x00007FF714A80000-0x00007FF714DD4000-memory.dmp	xmrig
behavioral2/memory/4396-25-0x00007FF716620000-0x00007FF716974000-memory.dmp	xmrig
behavioral2/memory/2084-41-0x00007FF6170C0000-0x00007FF617414000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-47.dat	xmrig
behavioral2/files/0x0007000000023410-59.dat	xmrig
behavioral2/memory/2144-62-0x00007FF688610000-0x00007FF688964000-memory.dmp	xmrig
behavioral2/memory/1284-71-0x00007FF7A4A20000-0x00007FF7A4D74000-memory.dmp	xmrig
behavioral2/memory/3456-74-0x00007FF692B00000-0x00007FF692E54000-memory.dmp	xmrig
behavioral2/memory/1036-73-0x00007FF7DB210000-0x00007FF7DB564000-memory.dmp	xmrig
behavioral2/memory/1188-72-0x00007FF79DE50000-0x00007FF79E1A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-69.dat	xmrig
behavioral2/memory/2672-68-0x00007FF625C00000-0x00007FF625F54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-82.dat	xmrig
behavioral2/files/0x0007000000023417-103.dat	xmrig
behavioral2/memory/3596-128-0x00007FF7742A0000-0x00007FF7745F4000-memory.dmp	xmrig
behavioral2/memory/1992-143-0x00007FF73EDE0000-0x00007FF73F134000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-155.dat	xmrig
behavioral2/files/0x0007000000023427-179.dat	xmrig
behavioral2/files/0x0007000000023426-178.dat	xmrig
behavioral2/files/0x0007000000023423-176.dat	xmrig
behavioral2/memory/3328-208-0x00007FF601A10000-0x00007FF601D64000-memory.dmp	xmrig
behavioral2/memory/1472-229-0x00007FF626040000-0x00007FF626394000-memory.dmp	xmrig
behavioral2/memory/2292-266-0x00007FF7765A0000-0x00007FF7768F4000-memory.dmp	xmrig
behavioral2/memory/4248-216-0x00007FF601410000-0x00007FF601764000-memory.dmp	xmrig
behavioral2/memory/4744-215-0x00007FF651BF0000-0x00007FF651F44000-memory.dmp	xmrig
behavioral2/memory/4076-214-0x00007FF6A9130000-0x00007FF6A9484000-memory.dmp	xmrig
behavioral2/memory/5004-213-0x00007FF7063B0000-0x00007FF706704000-memory.dmp	xmrig
behavioral2/memory/5008-212-0x00007FF7CC350000-0x00007FF7CC6A4000-memory.dmp	xmrig
behavioral2/memory/680-211-0x00007FF7AECD0000-0x00007FF7AF024000-memory.dmp	xmrig
behavioral2/memory/4660-207-0x00007FF613E60000-0x00007FF6141B4000-memory.dmp	xmrig
behavioral2/memory/2960-201-0x00007FF6F8480000-0x00007FF6F87D4000-memory.dmp	xmrig
behavioral2/memory/852-199-0x00007FF689FD0000-0x00007FF68A324000-memory.dmp	xmrig
behavioral2/memory/3660-198-0x00007FF71E790000-0x00007FF71EAE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-172.dat	xmrig
behavioral2/files/0x0007000000023424-169.dat	xmrig
behavioral2/files/0x0007000000023422-162.dat	xmrig
behavioral2/files/0x0007000000023421-160.dat	xmrig
behavioral2/files/0x000700000002341f-149.dat	xmrig
behavioral2/files/0x000700000002341e-141.dat	xmrig
behavioral2/files/0x000700000002341d-139.dat	xmrig
behavioral2/files/0x000700000002341c-137.dat	xmrig
behavioral2/files/0x000700000002341b-135.dat	xmrig
behavioral2/files/0x000700000002341a-133.dat	xmrig
behavioral2/files/0x0007000000023419-131.dat	xmrig
behavioral2/files/0x0007000000023418-129.dat	xmrig
behavioral2/files/0x0007000000023416-124.dat	xmrig
behavioral2/files/0x0007000000023415-122.dat	xmrig
behavioral2/memory/3616-121-0x00007FF6E5490000-0x00007FF6E57E4000-memory.dmp	xmrig
behavioral2/memory/784-110-0x00007FF727160000-0x00007FF7274B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-100.dat	xmrig
behavioral2/files/0x0008000000023404-92.dat	xmrig
behavioral2/files/0x000700000002340f-64.dat	xmrig
behavioral2/memory/908-61-0x00007FF680EC0000-0x00007FF681214000-memory.dmp	xmrig
behavioral2/files/0x000700000002340b-57.dat	xmrig
behavioral2/files/0x000700000002340d-55.dat	xmrig
behavioral2/memory/4516-51-0x00007FF7FC780000-0x00007FF7FCAD4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-44.dat	xmrig
behavioral2/files/0x0007000000023409-36.dat	xmrig
behavioral2/files/0x000700000002340c-35.dat	xmrig
behavioral2/files/0x0007000000023408-16.dat	xmrig
behavioral2/files/0x0007000000023407-9.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4292	VJGAVqT.exe
4396	WgZOpXV.exe
1620	RecDRIp.exe
2084	uebOTlf.exe
1188	nVjDCHL.exe
4516	UjfeVFH.exe
908	casNJrN.exe
2144	LUdUQtl.exe
1036	LRxZDzT.exe
3456	dNujSKX.exe
2672	kPXvqtp.exe
1284	UoOEwOV.exe
784	PnSYYPc.exe
3616	cHVrnbX.exe
3596	TwhUDoj.exe
1992	LDVIFCB.exe
3660	SPfrCZm.exe
852	SGMQdvh.exe
1472	QKobSbw.exe
2960	thsdxkI.exe
4660	SpnbMLJ.exe
3328	bFIfkHn.exe
680	HBxYkwN.exe
5008	TtikWuX.exe
5004	NKrRvAc.exe
2292	UaTibAX.exe
4076	NpesymH.exe
4744	aGnjczE.exe
4248	vFUpuyE.exe
960	YRkFLeN.exe
4576	giBjcBH.exe
4168	ZzNkKNG.exe
1056	wJgpdCS.exe
4136	MfUyRtU.exe
912	ExBeudW.exe
3500	QABrwyI.exe
3524	LJPXAhC.exe
3124	XHASLEX.exe
2632	WwEMKBD.exe
3740	YIJlESR.exe
1876	taziNhl.exe
1320	tpEmMWG.exe
3448	UkhoGZs.exe
4428	OraQvRv.exe
1048	xEwEZqB.exe
2124	ZTgTpQr.exe
1736	PQHihKx.exe
2532	vPrcYlD.exe
1948	VkszAca.exe
5100	OkwFfFX.exe
412	hpsoXoS.exe
1152	FlWuIOz.exe
3856	xBfsZEt.exe
3408	ouguEfc.exe
4584	wrnHFzG.exe
4544	KlQyERi.exe
732	hxEoPEr.exe
880	moOosKm.exe
2216	TgKIIKG.exe
4732	hQxZpRz.exe
1028	OrfWMIM.exe
4716	ouIYBzN.exe
1500	USmxXzy.exe
404	wtSAsCV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1280-0-0x00007FF70BF90000-0x00007FF70C2E4000-memory.dmp	upx
behavioral2/files/0x00060000000232a4-5.dat	upx
behavioral2/memory/4292-15-0x00007FF6ECDA0000-0x00007FF6ED0F4000-memory.dmp	upx
behavioral2/memory/1620-20-0x00007FF714A80000-0x00007FF714DD4000-memory.dmp	upx
behavioral2/memory/4396-25-0x00007FF716620000-0x00007FF716974000-memory.dmp	upx
behavioral2/memory/2084-41-0x00007FF6170C0000-0x00007FF617414000-memory.dmp	upx
behavioral2/files/0x000700000002340e-47.dat	upx
behavioral2/files/0x0007000000023410-59.dat	upx
behavioral2/memory/2144-62-0x00007FF688610000-0x00007FF688964000-memory.dmp	upx
behavioral2/memory/1284-71-0x00007FF7A4A20000-0x00007FF7A4D74000-memory.dmp	upx
behavioral2/memory/3456-74-0x00007FF692B00000-0x00007FF692E54000-memory.dmp	upx
behavioral2/memory/1036-73-0x00007FF7DB210000-0x00007FF7DB564000-memory.dmp	upx
behavioral2/memory/1188-72-0x00007FF79DE50000-0x00007FF79E1A4000-memory.dmp	upx
behavioral2/files/0x0007000000023411-69.dat	upx
behavioral2/memory/2672-68-0x00007FF625C00000-0x00007FF625F54000-memory.dmp	upx
behavioral2/files/0x0007000000023414-82.dat	upx
behavioral2/files/0x0007000000023417-103.dat	upx
behavioral2/memory/3596-128-0x00007FF7742A0000-0x00007FF7745F4000-memory.dmp	upx
behavioral2/memory/1992-143-0x00007FF73EDE0000-0x00007FF73F134000-memory.dmp	upx
behavioral2/files/0x0007000000023420-155.dat	upx
behavioral2/files/0x0007000000023427-179.dat	upx
behavioral2/files/0x0007000000023426-178.dat	upx
behavioral2/files/0x0007000000023423-176.dat	upx
behavioral2/memory/3328-208-0x00007FF601A10000-0x00007FF601D64000-memory.dmp	upx
behavioral2/memory/1472-229-0x00007FF626040000-0x00007FF626394000-memory.dmp	upx
behavioral2/memory/2292-266-0x00007FF7765A0000-0x00007FF7768F4000-memory.dmp	upx
behavioral2/memory/4248-216-0x00007FF601410000-0x00007FF601764000-memory.dmp	upx
behavioral2/memory/4744-215-0x00007FF651BF0000-0x00007FF651F44000-memory.dmp	upx
behavioral2/memory/4076-214-0x00007FF6A9130000-0x00007FF6A9484000-memory.dmp	upx
behavioral2/memory/5004-213-0x00007FF7063B0000-0x00007FF706704000-memory.dmp	upx
behavioral2/memory/5008-212-0x00007FF7CC350000-0x00007FF7CC6A4000-memory.dmp	upx
behavioral2/memory/680-211-0x00007FF7AECD0000-0x00007FF7AF024000-memory.dmp	upx
behavioral2/memory/4660-207-0x00007FF613E60000-0x00007FF6141B4000-memory.dmp	upx
behavioral2/memory/2960-201-0x00007FF6F8480000-0x00007FF6F87D4000-memory.dmp	upx
behavioral2/memory/852-199-0x00007FF689FD0000-0x00007FF68A324000-memory.dmp	upx
behavioral2/memory/3660-198-0x00007FF71E790000-0x00007FF71EAE4000-memory.dmp	upx
behavioral2/files/0x0007000000023425-172.dat	upx
behavioral2/files/0x0007000000023424-169.dat	upx
behavioral2/files/0x0007000000023422-162.dat	upx
behavioral2/files/0x0007000000023421-160.dat	upx
behavioral2/files/0x000700000002341f-149.dat	upx
behavioral2/files/0x000700000002341e-141.dat	upx
behavioral2/files/0x000700000002341d-139.dat	upx
behavioral2/files/0x000700000002341c-137.dat	upx
behavioral2/files/0x000700000002341b-135.dat	upx
behavioral2/files/0x000700000002341a-133.dat	upx
behavioral2/files/0x0007000000023419-131.dat	upx
behavioral2/files/0x0007000000023418-129.dat	upx
behavioral2/files/0x0007000000023416-124.dat	upx
behavioral2/files/0x0007000000023415-122.dat	upx
behavioral2/memory/3616-121-0x00007FF6E5490000-0x00007FF6E57E4000-memory.dmp	upx
behavioral2/memory/784-110-0x00007FF727160000-0x00007FF7274B4000-memory.dmp	upx
behavioral2/files/0x0007000000023412-100.dat	upx
behavioral2/files/0x0008000000023404-92.dat	upx
behavioral2/files/0x000700000002340f-64.dat	upx
behavioral2/memory/908-61-0x00007FF680EC0000-0x00007FF681214000-memory.dmp	upx
behavioral2/files/0x000700000002340b-57.dat	upx
behavioral2/files/0x000700000002340d-55.dat	upx
behavioral2/memory/4516-51-0x00007FF7FC780000-0x00007FF7FCAD4000-memory.dmp	upx
behavioral2/files/0x000700000002340a-44.dat	upx
behavioral2/files/0x0007000000023409-36.dat	upx
behavioral2/files/0x000700000002340c-35.dat	upx
behavioral2/files/0x0007000000023408-16.dat	upx
behavioral2/files/0x0007000000023407-9.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HZmJtqa.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\ghFQgJn.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\DUdBnyz.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\HmSCHRq.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\oLEVPfS.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\WGDIeWi.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\SGMQdvh.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\WjugoNc.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\bviaCpz.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\FygXbgA.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\yZFvquT.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\RPljwGY.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\UUmRPwc.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\TzDcdIe.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\ygMjZRu.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\XabUZdX.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\uhwIOuH.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\GQMezHG.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\RjyDCuu.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\MRQGmlU.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\RjVEoqb.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\QfXbqFI.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\VZiLLnL.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\rxMYZZP.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\hitVNOQ.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\wgbrkME.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\nVjDCHL.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\aGnjczE.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\KnNusjk.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\lkUTlUx.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\OraQvRv.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\JGZMtsH.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\WnDdYBY.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\dlNIsNZ.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\ikMiNeH.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\zpEaFBz.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\SpnbMLJ.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\UMupzvq.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\SOiLvps.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\TwhUDoj.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\qyHecVw.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\jYXHoIi.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\sPCovMe.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\IFlYBEy.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\bdFtXEf.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\iigHMuu.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\DPwtRFt.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\NDrsaAG.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\HlQvrTd.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\QJfjBVy.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\wztQSWB.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\tHFGiZH.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\TfUFjvc.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\jrwQFYV.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\wTcJMrO.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\ExBeudW.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\EVFuWdK.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\tZxfRhO.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\tltBNBa.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\dfaOZWR.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\UHyqnKv.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\oorpNpO.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\JBeThxb.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
File created	C:\Windows\System\EshZdIL.exe	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4292	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	83
PID 1280 wrote to memory of 4292	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	83
PID 1280 wrote to memory of 4396	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	84
PID 1280 wrote to memory of 4396	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	84
PID 1280 wrote to memory of 1620	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	85
PID 1280 wrote to memory of 1620	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	85
PID 1280 wrote to memory of 2084	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	86
PID 1280 wrote to memory of 2084	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	86
PID 1280 wrote to memory of 1188	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	87
PID 1280 wrote to memory of 1188	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	87
PID 1280 wrote to memory of 4516	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	88
PID 1280 wrote to memory of 4516	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	88
PID 1280 wrote to memory of 908	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	89
PID 1280 wrote to memory of 908	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	89
PID 1280 wrote to memory of 2144	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	90
PID 1280 wrote to memory of 2144	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	90
PID 1280 wrote to memory of 1036	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	91
PID 1280 wrote to memory of 1036	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	91
PID 1280 wrote to memory of 3456	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	92
PID 1280 wrote to memory of 3456	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	92
PID 1280 wrote to memory of 2672	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	93
PID 1280 wrote to memory of 2672	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	93
PID 1280 wrote to memory of 1284	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	94
PID 1280 wrote to memory of 1284	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	94
PID 1280 wrote to memory of 784	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	95
PID 1280 wrote to memory of 784	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	95
PID 1280 wrote to memory of 3616	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	96
PID 1280 wrote to memory of 3616	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	96
PID 1280 wrote to memory of 3596	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	97
PID 1280 wrote to memory of 3596	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	97
PID 1280 wrote to memory of 1992	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	98
PID 1280 wrote to memory of 1992	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	98
PID 1280 wrote to memory of 3660	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	99
PID 1280 wrote to memory of 3660	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	99
PID 1280 wrote to memory of 852	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	100
PID 1280 wrote to memory of 852	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	100
PID 1280 wrote to memory of 1472	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	101
PID 1280 wrote to memory of 1472	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	101
PID 1280 wrote to memory of 2960	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	102
PID 1280 wrote to memory of 2960	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	102
PID 1280 wrote to memory of 4660	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	103
PID 1280 wrote to memory of 4660	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	103
PID 1280 wrote to memory of 3328	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	104
PID 1280 wrote to memory of 3328	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	104
PID 1280 wrote to memory of 680	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	105
PID 1280 wrote to memory of 680	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	105
PID 1280 wrote to memory of 5008	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	106
PID 1280 wrote to memory of 5008	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	106
PID 1280 wrote to memory of 5004	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	107
PID 1280 wrote to memory of 5004	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	107
PID 1280 wrote to memory of 2292	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	108
PID 1280 wrote to memory of 2292	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	108
PID 1280 wrote to memory of 4076	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	109
PID 1280 wrote to memory of 4076	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	109
PID 1280 wrote to memory of 4744	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	110
PID 1280 wrote to memory of 4744	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	110
PID 1280 wrote to memory of 4248	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	111
PID 1280 wrote to memory of 4248	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	111
PID 1280 wrote to memory of 960	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	113
PID 1280 wrote to memory of 960	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	113
PID 1280 wrote to memory of 4576	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	114
PID 1280 wrote to memory of 4576	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	114
PID 1280 wrote to memory of 4168	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	115
PID 1280 wrote to memory of 4168	1280	3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3eaef3c250a52f944d8df341bbc17460_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System\VJGAVqT.exe
  C:\Windows\System\VJGAVqT.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\WgZOpXV.exe
  C:\Windows\System\WgZOpXV.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\RecDRIp.exe
  C:\Windows\System\RecDRIp.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\uebOTlf.exe
  C:\Windows\System\uebOTlf.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\nVjDCHL.exe
  C:\Windows\System\nVjDCHL.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\UjfeVFH.exe
  C:\Windows\System\UjfeVFH.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\casNJrN.exe
  C:\Windows\System\casNJrN.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\LUdUQtl.exe
  C:\Windows\System\LUdUQtl.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\LRxZDzT.exe
  C:\Windows\System\LRxZDzT.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\dNujSKX.exe
  C:\Windows\System\dNujSKX.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\kPXvqtp.exe
  C:\Windows\System\kPXvqtp.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\UoOEwOV.exe
  C:\Windows\System\UoOEwOV.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\PnSYYPc.exe
  C:\Windows\System\PnSYYPc.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\cHVrnbX.exe
  C:\Windows\System\cHVrnbX.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\TwhUDoj.exe
  C:\Windows\System\TwhUDoj.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\LDVIFCB.exe
  C:\Windows\System\LDVIFCB.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\SPfrCZm.exe
  C:\Windows\System\SPfrCZm.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\SGMQdvh.exe
  C:\Windows\System\SGMQdvh.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\QKobSbw.exe
  C:\Windows\System\QKobSbw.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\thsdxkI.exe
  C:\Windows\System\thsdxkI.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\SpnbMLJ.exe
  C:\Windows\System\SpnbMLJ.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\bFIfkHn.exe
  C:\Windows\System\bFIfkHn.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\HBxYkwN.exe
  C:\Windows\System\HBxYkwN.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\TtikWuX.exe
  C:\Windows\System\TtikWuX.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\NKrRvAc.exe
  C:\Windows\System\NKrRvAc.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\UaTibAX.exe
  C:\Windows\System\UaTibAX.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\NpesymH.exe
  C:\Windows\System\NpesymH.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\aGnjczE.exe
  C:\Windows\System\aGnjczE.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\vFUpuyE.exe
  C:\Windows\System\vFUpuyE.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\YRkFLeN.exe
  C:\Windows\System\YRkFLeN.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\giBjcBH.exe
  C:\Windows\System\giBjcBH.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\ZzNkKNG.exe
  C:\Windows\System\ZzNkKNG.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\wJgpdCS.exe
  C:\Windows\System\wJgpdCS.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\MfUyRtU.exe
  C:\Windows\System\MfUyRtU.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\ExBeudW.exe
  C:\Windows\System\ExBeudW.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\QABrwyI.exe
  C:\Windows\System\QABrwyI.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\LJPXAhC.exe
  C:\Windows\System\LJPXAhC.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\XHASLEX.exe
  C:\Windows\System\XHASLEX.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\WwEMKBD.exe
  C:\Windows\System\WwEMKBD.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\YIJlESR.exe
  C:\Windows\System\YIJlESR.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\taziNhl.exe
  C:\Windows\System\taziNhl.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\tpEmMWG.exe
  C:\Windows\System\tpEmMWG.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\UkhoGZs.exe
  C:\Windows\System\UkhoGZs.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\OraQvRv.exe
  C:\Windows\System\OraQvRv.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\xEwEZqB.exe
  C:\Windows\System\xEwEZqB.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\ZTgTpQr.exe
  C:\Windows\System\ZTgTpQr.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\PQHihKx.exe
  C:\Windows\System\PQHihKx.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\vPrcYlD.exe
  C:\Windows\System\vPrcYlD.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\VkszAca.exe
  C:\Windows\System\VkszAca.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\OkwFfFX.exe
  C:\Windows\System\OkwFfFX.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\hpsoXoS.exe
  C:\Windows\System\hpsoXoS.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\FlWuIOz.exe
  C:\Windows\System\FlWuIOz.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\xBfsZEt.exe
  C:\Windows\System\xBfsZEt.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\ouguEfc.exe
  C:\Windows\System\ouguEfc.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\wrnHFzG.exe
  C:\Windows\System\wrnHFzG.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\KlQyERi.exe
  C:\Windows\System\KlQyERi.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\hxEoPEr.exe
  C:\Windows\System\hxEoPEr.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\moOosKm.exe
  C:\Windows\System\moOosKm.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\TgKIIKG.exe
  C:\Windows\System\TgKIIKG.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\hQxZpRz.exe
  C:\Windows\System\hQxZpRz.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\OrfWMIM.exe
  C:\Windows\System\OrfWMIM.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\ouIYBzN.exe
  C:\Windows\System\ouIYBzN.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\USmxXzy.exe
  C:\Windows\System\USmxXzy.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\wtSAsCV.exe
  C:\Windows\System\wtSAsCV.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\mzthhbE.exe
  C:\Windows\System\mzthhbE.exe
  2⤵
  PID:3536
- C:\Windows\System\qWOZFbb.exe
  C:\Windows\System\qWOZFbb.exe
  2⤵
  PID:2664
- C:\Windows\System\WjugoNc.exe
  C:\Windows\System\WjugoNc.exe
  2⤵
  PID:5680
- C:\Windows\System\hUZcFAN.exe
  C:\Windows\System\hUZcFAN.exe
  2⤵
  PID:5700
- C:\Windows\System\tlaMtuv.exe
  C:\Windows\System\tlaMtuv.exe
  2⤵
  PID:5720
- C:\Windows\System\OJohhEW.exe
  C:\Windows\System\OJohhEW.exe
  2⤵
  PID:5740
- C:\Windows\System\GeCPDrq.exe
  C:\Windows\System\GeCPDrq.exe
  2⤵
  PID:5760
- C:\Windows\System\zDajyDH.exe
  C:\Windows\System\zDajyDH.exe
  2⤵
  PID:5788
- C:\Windows\System\AdsEwMD.exe
  C:\Windows\System\AdsEwMD.exe
  2⤵
  PID:5824
- C:\Windows\System\CfRJkOm.exe
  C:\Windows\System\CfRJkOm.exe
  2⤵
  PID:5872
- C:\Windows\System\YhijBSK.exe
  C:\Windows\System\YhijBSK.exe
  2⤵
  PID:5900
- C:\Windows\System\GnHvAgD.exe
  C:\Windows\System\GnHvAgD.exe
  2⤵
  PID:5924
- C:\Windows\System\rnlTilC.exe
  C:\Windows\System\rnlTilC.exe
  2⤵
  PID:5968
- C:\Windows\System\KOqEoGg.exe
  C:\Windows\System\KOqEoGg.exe
  2⤵
  PID:5996
- C:\Windows\System\krSSIfF.exe
  C:\Windows\System\krSSIfF.exe
  2⤵
  PID:6024
- C:\Windows\System\EoBHQFC.exe
  C:\Windows\System\EoBHQFC.exe
  2⤵
  PID:6056
- C:\Windows\System\DUdBnyz.exe
  C:\Windows\System\DUdBnyz.exe
  2⤵
  PID:6084
- C:\Windows\System\cRMejHj.exe
  C:\Windows\System\cRMejHj.exe
  2⤵
  PID:6120
- C:\Windows\System\gvRBNWx.exe
  C:\Windows\System\gvRBNWx.exe
  2⤵
  PID:2596
- C:\Windows\System\yZkSSib.exe
  C:\Windows\System\yZkSSib.exe
  2⤵
  PID:1504
- C:\Windows\System\RCaXLhB.exe
  C:\Windows\System\RCaXLhB.exe
  2⤵
  PID:4484
- C:\Windows\System\FDRHRki.exe
  C:\Windows\System\FDRHRki.exe
  2⤵
  PID:1116
- C:\Windows\System\OlIoHzD.exe
  C:\Windows\System\OlIoHzD.exe
  2⤵
  PID:2800
- C:\Windows\System\wtgKdot.exe
  C:\Windows\System\wtgKdot.exe
  2⤵
  PID:3624
- C:\Windows\System\kFrOeQJ.exe
  C:\Windows\System\kFrOeQJ.exe
  2⤵
  PID:1932
- C:\Windows\System\oGbBntE.exe
  C:\Windows\System\oGbBntE.exe
  2⤵
  PID:4984
- C:\Windows\System\vtOwbTW.exe
  C:\Windows\System\vtOwbTW.exe
  2⤵
  PID:3112
- C:\Windows\System\FtPMGsf.exe
  C:\Windows\System\FtPMGsf.exe
  2⤵
  PID:5192
- C:\Windows\System\omTslbn.exe
  C:\Windows\System\omTslbn.exe
  2⤵
  PID:5240
- C:\Windows\System\LoJzJTg.exe
  C:\Windows\System\LoJzJTg.exe
  2⤵
  PID:3924
- C:\Windows\System\okmymSB.exe
  C:\Windows\System\okmymSB.exe
  2⤵
  PID:1192
- C:\Windows\System\WXlSBmf.exe
  C:\Windows\System\WXlSBmf.exe
  2⤵
  PID:2464
- C:\Windows\System\HvwqFvd.exe
  C:\Windows\System\HvwqFvd.exe
  2⤵
  PID:4888
- C:\Windows\System\dNmymnR.exe
  C:\Windows\System\dNmymnR.exe
  2⤵
  PID:3904
- C:\Windows\System\RaKsfsd.exe
  C:\Windows\System\RaKsfsd.exe
  2⤵
  PID:2896
- C:\Windows\System\eeEwVVI.exe
  C:\Windows\System\eeEwVVI.exe
  2⤵
  PID:476
- C:\Windows\System\LNjLmUg.exe
  C:\Windows\System\LNjLmUg.exe
  2⤵
  PID:2384
- C:\Windows\System\gtHNPER.exe
  C:\Windows\System\gtHNPER.exe
  2⤵
  PID:3016
- C:\Windows\System\YBVUGYQ.exe
  C:\Windows\System\YBVUGYQ.exe
  2⤵
  PID:4492
- C:\Windows\System\UfRFmNu.exe
  C:\Windows\System\UfRFmNu.exe
  2⤵
  PID:1172
- C:\Windows\System\QreXUAJ.exe
  C:\Windows\System\QreXUAJ.exe
  2⤵
  PID:2872
- C:\Windows\System\RavEgiC.exe
  C:\Windows\System\RavEgiC.exe
  2⤵
  PID:5712
- C:\Windows\System\KMIzktL.exe
  C:\Windows\System\KMIzktL.exe
  2⤵
  PID:5664
- C:\Windows\System\UXRlJmZ.exe
  C:\Windows\System\UXRlJmZ.exe
  2⤵
  PID:5736
- C:\Windows\System\RhRgfdz.exe
  C:\Windows\System\RhRgfdz.exe
  2⤵
  PID:1896
- C:\Windows\System\PrghbRB.exe
  C:\Windows\System\PrghbRB.exe
  2⤵
  PID:4912
- C:\Windows\System\KHJMpWR.exe
  C:\Windows\System\KHJMpWR.exe
  2⤵
  PID:5868
- C:\Windows\System\dKPqaYq.exe
  C:\Windows\System\dKPqaYq.exe
  2⤵
  PID:5916
- C:\Windows\System\pFAcdvG.exe
  C:\Windows\System\pFAcdvG.exe
  2⤵
  PID:5992
- C:\Windows\System\TgOFJaw.exe
  C:\Windows\System\TgOFJaw.exe
  2⤵
  PID:6016
- C:\Windows\System\JuzPbUb.exe
  C:\Windows\System\JuzPbUb.exe
  2⤵
  PID:4968
- C:\Windows\System\BMzXdxh.exe
  C:\Windows\System\BMzXdxh.exe
  2⤵
  PID:6096
- C:\Windows\System\poymvKO.exe
  C:\Windows\System\poymvKO.exe
  2⤵
  PID:4468
- C:\Windows\System\dTTukEG.exe
  C:\Windows\System\dTTukEG.exe
  2⤵
  PID:3696
- C:\Windows\System\sBpJKsw.exe
  C:\Windows\System\sBpJKsw.exe
  2⤵
  PID:1120
- C:\Windows\System\fyUJoYv.exe
  C:\Windows\System\fyUJoYv.exe
  2⤵
  PID:5208
- C:\Windows\System\NezLEyp.exe
  C:\Windows\System\NezLEyp.exe
  2⤵
  PID:4140
- C:\Windows\System\QfXbqFI.exe
  C:\Windows\System\QfXbqFI.exe
  2⤵
  PID:2524
- C:\Windows\System\zuOwwbn.exe
  C:\Windows\System\zuOwwbn.exe
  2⤵
  PID:112
- C:\Windows\System\VVZItYb.exe
  C:\Windows\System\VVZItYb.exe
  2⤵
  PID:3952
- C:\Windows\System\fYwigHP.exe
  C:\Windows\System\fYwigHP.exe
  2⤵
  PID:6064
- C:\Windows\System\kfdxpfs.exe
  C:\Windows\System\kfdxpfs.exe
  2⤵
  PID:2056
- C:\Windows\System\EoUwxMq.exe
  C:\Windows\System\EoUwxMq.exe
  2⤵
  PID:5752
- C:\Windows\System\mBFhOHs.exe
  C:\Windows\System\mBFhOHs.exe
  2⤵
  PID:5956
- C:\Windows\System\QhqiZwK.exe
  C:\Windows\System\QhqiZwK.exe
  2⤵
  PID:6132
- C:\Windows\System\fpimDKj.exe
  C:\Windows\System\fpimDKj.exe
  2⤵
  PID:2512
- C:\Windows\System\PaFPuqF.exe
  C:\Windows\System\PaFPuqF.exe
  2⤵
  PID:2892
- C:\Windows\System\CCatafn.exe
  C:\Windows\System\CCatafn.exe
  2⤵
  PID:3280
- C:\Windows\System\AzPPqUj.exe
  C:\Windows\System\AzPPqUj.exe
  2⤵
  PID:1960
- C:\Windows\System\hfAtdpi.exe
  C:\Windows\System\hfAtdpi.exe
  2⤵
  PID:2724
- C:\Windows\System\JlnFjpQ.exe
  C:\Windows\System\JlnFjpQ.exe
  2⤵
  PID:4108
- C:\Windows\System\XmZIRbm.exe
  C:\Windows\System\XmZIRbm.exe
  2⤵
  PID:6108
- C:\Windows\System\HkebxyP.exe
  C:\Windows\System\HkebxyP.exe
  2⤵
  PID:4672
- C:\Windows\System\gqZaXFn.exe
  C:\Windows\System\gqZaXFn.exe
  2⤵
  PID:3380
- C:\Windows\System\bHFNexT.exe
  C:\Windows\System\bHFNexT.exe
  2⤵
  PID:6148
- C:\Windows\System\NhdKUgF.exe
  C:\Windows\System\NhdKUgF.exe
  2⤵
  PID:6176
- C:\Windows\System\bjtcwxr.exe
  C:\Windows\System\bjtcwxr.exe
  2⤵
  PID:6200
- C:\Windows\System\FQycHSd.exe
  C:\Windows\System\FQycHSd.exe
  2⤵
  PID:6220
- C:\Windows\System\eapYsHn.exe
  C:\Windows\System\eapYsHn.exe
  2⤵
  PID:6252
- C:\Windows\System\kRyttKT.exe
  C:\Windows\System\kRyttKT.exe
  2⤵
  PID:6280
- C:\Windows\System\FRGjYJR.exe
  C:\Windows\System\FRGjYJR.exe
  2⤵
  PID:6308
- C:\Windows\System\xFpnZyY.exe
  C:\Windows\System\xFpnZyY.exe
  2⤵
  PID:6332
- C:\Windows\System\kwSeqcG.exe
  C:\Windows\System\kwSeqcG.exe
  2⤵
  PID:6360
- C:\Windows\System\ZXGaSlD.exe
  C:\Windows\System\ZXGaSlD.exe
  2⤵
  PID:6420
- C:\Windows\System\HoaVUyU.exe
  C:\Windows\System\HoaVUyU.exe
  2⤵
  PID:6460
- C:\Windows\System\tkxTCqi.exe
  C:\Windows\System\tkxTCqi.exe
  2⤵
  PID:6492
- C:\Windows\System\PUiYmny.exe
  C:\Windows\System\PUiYmny.exe
  2⤵
  PID:6536
- C:\Windows\System\tmzqbUZ.exe
  C:\Windows\System\tmzqbUZ.exe
  2⤵
  PID:6552
- C:\Windows\System\VsRHVwb.exe
  C:\Windows\System\VsRHVwb.exe
  2⤵
  PID:6580
- C:\Windows\System\nUIGIID.exe
  C:\Windows\System\nUIGIID.exe
  2⤵
  PID:6632
- C:\Windows\System\ANPvKnc.exe
  C:\Windows\System\ANPvKnc.exe
  2⤵
  PID:6668
- C:\Windows\System\hLPlMSa.exe
  C:\Windows\System\hLPlMSa.exe
  2⤵
  PID:6688
- C:\Windows\System\BdrRdjc.exe
  C:\Windows\System\BdrRdjc.exe
  2⤵
  PID:6720
- C:\Windows\System\HmSCHRq.exe
  C:\Windows\System\HmSCHRq.exe
  2⤵
  PID:6756
- C:\Windows\System\nxFyvjH.exe
  C:\Windows\System\nxFyvjH.exe
  2⤵
  PID:6772
- C:\Windows\System\ORIGCCT.exe
  C:\Windows\System\ORIGCCT.exe
  2⤵
  PID:6788
- C:\Windows\System\QJfjBVy.exe
  C:\Windows\System\QJfjBVy.exe
  2⤵
  PID:6812
- C:\Windows\System\JlNlYvh.exe
  C:\Windows\System\JlNlYvh.exe
  2⤵
  PID:6840
- C:\Windows\System\hhUIdKW.exe
  C:\Windows\System\hhUIdKW.exe
  2⤵
  PID:6876
- C:\Windows\System\lvyKuOk.exe
  C:\Windows\System\lvyKuOk.exe
  2⤵
  PID:6916
- C:\Windows\System\TxsxWGI.exe
  C:\Windows\System\TxsxWGI.exe
  2⤵
  PID:6952
- C:\Windows\System\ejEwHGe.exe
  C:\Windows\System\ejEwHGe.exe
  2⤵
  PID:6980
- C:\Windows\System\IOSEIoq.exe
  C:\Windows\System\IOSEIoq.exe
  2⤵
  PID:7008
- C:\Windows\System\sEdjPjB.exe
  C:\Windows\System\sEdjPjB.exe
  2⤵
  PID:7032
- C:\Windows\System\QgvUbpK.exe
  C:\Windows\System\QgvUbpK.exe
  2⤵
  PID:7056
- C:\Windows\System\wIbIOIJ.exe
  C:\Windows\System\wIbIOIJ.exe
  2⤵
  PID:7084
- C:\Windows\System\rdsArEp.exe
  C:\Windows\System\rdsArEp.exe
  2⤵
  PID:7116
- C:\Windows\System\InTvfJM.exe
  C:\Windows\System\InTvfJM.exe
  2⤵
  PID:7140
- C:\Windows\System\RSDvagT.exe
  C:\Windows\System\RSDvagT.exe
  2⤵
  PID:7160
- C:\Windows\System\TzDcdIe.exe
  C:\Windows\System\TzDcdIe.exe
  2⤵
  PID:5232
- C:\Windows\System\nduaBei.exe
  C:\Windows\System\nduaBei.exe
  2⤵
  PID:6168
- C:\Windows\System\MKQDRVE.exe
  C:\Windows\System\MKQDRVE.exe
  2⤵
  PID:6236
- C:\Windows\System\ztCXBaO.exe
  C:\Windows\System\ztCXBaO.exe
  2⤵
  PID:6348
- C:\Windows\System\oVFGcrQ.exe
  C:\Windows\System\oVFGcrQ.exe
  2⤵
  PID:6324
- C:\Windows\System\tVXVcoa.exe
  C:\Windows\System\tVXVcoa.exe
  2⤵
  PID:6516
- C:\Windows\System\vSWbNwT.exe
  C:\Windows\System\vSWbNwT.exe
  2⤵
  PID:6504
- C:\Windows\System\JFWnnvz.exe
  C:\Windows\System\JFWnnvz.exe
  2⤵
  PID:6568
- C:\Windows\System\HPoGVmA.exe
  C:\Windows\System\HPoGVmA.exe
  2⤵
  PID:6644
- C:\Windows\System\VZiLLnL.exe
  C:\Windows\System\VZiLLnL.exe
  2⤵
  PID:6676
- C:\Windows\System\PLJCCSH.exe
  C:\Windows\System\PLJCCSH.exe
  2⤵
  PID:6836
- C:\Windows\System\HDBaBZH.exe
  C:\Windows\System\HDBaBZH.exe
  2⤵
  PID:6852
- C:\Windows\System\JfsnCtU.exe
  C:\Windows\System\JfsnCtU.exe
  2⤵
  PID:6924
- C:\Windows\System\uWzFVzq.exe
  C:\Windows\System\uWzFVzq.exe
  2⤵
  PID:7000
- C:\Windows\System\ygMjZRu.exe
  C:\Windows\System\ygMjZRu.exe
  2⤵
  PID:7048
- C:\Windows\System\IjzAohz.exe
  C:\Windows\System\IjzAohz.exe
  2⤵
  PID:7152
- C:\Windows\System\VmEFAEX.exe
  C:\Windows\System\VmEFAEX.exe
  2⤵
  PID:6156
- C:\Windows\System\FlMDVmz.exe
  C:\Windows\System\FlMDVmz.exe
  2⤵
  PID:6208
- C:\Windows\System\FRxFWLp.exe
  C:\Windows\System\FRxFWLp.exe
  2⤵
  PID:6320
- C:\Windows\System\YCqnorA.exe
  C:\Windows\System\YCqnorA.exe
  2⤵
  PID:6700
- C:\Windows\System\SRkSqcq.exe
  C:\Windows\System\SRkSqcq.exe
  2⤵
  PID:6964
- C:\Windows\System\LdVkFtG.exe
  C:\Windows\System\LdVkFtG.exe
  2⤵
  PID:6904
- C:\Windows\System\gvZjTgB.exe
  C:\Windows\System\gvZjTgB.exe
  2⤵
  PID:788
- C:\Windows\System\dfENUyU.exe
  C:\Windows\System\dfENUyU.exe
  2⤵
  PID:6524
- C:\Windows\System\ioLwEfa.exe
  C:\Windows\System\ioLwEfa.exe
  2⤵
  PID:7180
- C:\Windows\System\ysWvYzK.exe
  C:\Windows\System\ysWvYzK.exe
  2⤵
  PID:7220
- C:\Windows\System\LTPeLvt.exe
  C:\Windows\System\LTPeLvt.exe
  2⤵
  PID:7236
- C:\Windows\System\kmDuyRt.exe
  C:\Windows\System\kmDuyRt.exe
  2⤵
  PID:7268
- C:\Windows\System\VzRZbDD.exe
  C:\Windows\System\VzRZbDD.exe
  2⤵
  PID:7284
- C:\Windows\System\emFpTIC.exe
  C:\Windows\System\emFpTIC.exe
  2⤵
  PID:7308
- C:\Windows\System\qyHecVw.exe
  C:\Windows\System\qyHecVw.exe
  2⤵
  PID:7328
- C:\Windows\System\WlpYMti.exe
  C:\Windows\System\WlpYMti.exe
  2⤵
  PID:7352
- C:\Windows\System\GFMpPLw.exe
  C:\Windows\System\GFMpPLw.exe
  2⤵
  PID:7380
- C:\Windows\System\RTXmUku.exe
  C:\Windows\System\RTXmUku.exe
  2⤵
  PID:7424
- C:\Windows\System\wYzJnze.exe
  C:\Windows\System\wYzJnze.exe
  2⤵
  PID:7464
- C:\Windows\System\WwapkJs.exe
  C:\Windows\System\WwapkJs.exe
  2⤵
  PID:7488
- C:\Windows\System\myfymgz.exe
  C:\Windows\System\myfymgz.exe
  2⤵
  PID:7516
- C:\Windows\System\XjUNZJt.exe
  C:\Windows\System\XjUNZJt.exe
  2⤵
  PID:7548
- C:\Windows\System\CxTbCiE.exe
  C:\Windows\System\CxTbCiE.exe
  2⤵
  PID:7576
- C:\Windows\System\UMupzvq.exe
  C:\Windows\System\UMupzvq.exe
  2⤵
  PID:7596
- C:\Windows\System\qrfoGdL.exe
  C:\Windows\System\qrfoGdL.exe
  2⤵
  PID:7624
- C:\Windows\System\dyKkUcN.exe
  C:\Windows\System\dyKkUcN.exe
  2⤵
  PID:7668
- C:\Windows\System\KhWtZrI.exe
  C:\Windows\System\KhWtZrI.exe
  2⤵
  PID:7700
- C:\Windows\System\POWRXBa.exe
  C:\Windows\System\POWRXBa.exe
  2⤵
  PID:7724
- C:\Windows\System\quVqDvY.exe
  C:\Windows\System\quVqDvY.exe
  2⤵
  PID:7768
- C:\Windows\System\VnwTWqp.exe
  C:\Windows\System\VnwTWqp.exe
  2⤵
  PID:7796
- C:\Windows\System\QkJeCxa.exe
  C:\Windows\System\QkJeCxa.exe
  2⤵
  PID:7820
- C:\Windows\System\dEDoXfw.exe
  C:\Windows\System\dEDoXfw.exe
  2⤵
  PID:7852
- C:\Windows\System\eHlQhJJ.exe
  C:\Windows\System\eHlQhJJ.exe
  2⤵
  PID:7880
- C:\Windows\System\zCOtAlO.exe
  C:\Windows\System\zCOtAlO.exe
  2⤵
  PID:7920
- C:\Windows\System\SIJVhux.exe
  C:\Windows\System\SIJVhux.exe
  2⤵
  PID:7952
- C:\Windows\System\nhsowBi.exe
  C:\Windows\System\nhsowBi.exe
  2⤵
  PID:7992
- C:\Windows\System\sBNhUrH.exe
  C:\Windows\System\sBNhUrH.exe
  2⤵
  PID:8032
- C:\Windows\System\xKiGpTl.exe
  C:\Windows\System\xKiGpTl.exe
  2⤵
  PID:8056
- C:\Windows\System\GArPHXJ.exe
  C:\Windows\System\GArPHXJ.exe
  2⤵
  PID:8084
- C:\Windows\System\fziSvbX.exe
  C:\Windows\System\fziSvbX.exe
  2⤵
  PID:8100
- C:\Windows\System\VfEAScB.exe
  C:\Windows\System\VfEAScB.exe
  2⤵
  PID:8132
- C:\Windows\System\WGUobSQ.exe
  C:\Windows\System\WGUobSQ.exe
  2⤵
  PID:8160
- C:\Windows\System\PBzeNka.exe
  C:\Windows\System\PBzeNka.exe
  2⤵
  PID:1568
- C:\Windows\System\VTKGRKw.exe
  C:\Windows\System\VTKGRKw.exe
  2⤵
  PID:6780
- C:\Windows\System\TrPKWxu.exe
  C:\Windows\System\TrPKWxu.exe
  2⤵
  PID:7192
- C:\Windows\System\UXFMguB.exe
  C:\Windows\System\UXFMguB.exe
  2⤵
  PID:7316
- C:\Windows\System\iGwsQkn.exe
  C:\Windows\System\iGwsQkn.exe
  2⤵
  PID:7348
- C:\Windows\System\QpqPLpK.exe
  C:\Windows\System\QpqPLpK.exe
  2⤵
  PID:7436
- C:\Windows\System\dWBPSkp.exe
  C:\Windows\System\dWBPSkp.exe
  2⤵
  PID:4176
- C:\Windows\System\JGZMtsH.exe
  C:\Windows\System\JGZMtsH.exe
  2⤵
  PID:7656
- C:\Windows\System\yXGeqFQ.exe
  C:\Windows\System\yXGeqFQ.exe
  2⤵
  PID:7648
- C:\Windows\System\ewWFBWL.exe
  C:\Windows\System\ewWFBWL.exe
  2⤵
  PID:7716
- C:\Windows\System\FmVjayb.exe
  C:\Windows\System\FmVjayb.exe
  2⤵
  PID:7744
- C:\Windows\System\ognZbTd.exe
  C:\Windows\System\ognZbTd.exe
  2⤵
  PID:5012
- C:\Windows\System\KDxUEty.exe
  C:\Windows\System\KDxUEty.exe
  2⤵
  PID:7864
- C:\Windows\System\RjueUym.exe
  C:\Windows\System\RjueUym.exe
  2⤵
  PID:7936
- C:\Windows\System\fffrZiK.exe
  C:\Windows\System\fffrZiK.exe
  2⤵
  PID:8040
- C:\Windows\System\IpRVPav.exe
  C:\Windows\System\IpRVPav.exe
  2⤵
  PID:8096
- C:\Windows\System\YCSZZrh.exe
  C:\Windows\System\YCSZZrh.exe
  2⤵
  PID:6888
- C:\Windows\System\KSdeBBu.exe
  C:\Windows\System\KSdeBBu.exe
  2⤵
  PID:7256
- C:\Windows\System\KxdWYbT.exe
  C:\Windows\System\KxdWYbT.exe
  2⤵
  PID:7124
- C:\Windows\System\hitVNOQ.exe
  C:\Windows\System\hitVNOQ.exe
  2⤵
  PID:1672
- C:\Windows\System\FTxCYqD.exe
  C:\Windows\System\FTxCYqD.exe
  2⤵
  PID:4940
- C:\Windows\System\QLlgreD.exe
  C:\Windows\System\QLlgreD.exe
  2⤵
  PID:7784
- C:\Windows\System\UUieIRi.exe
  C:\Windows\System\UUieIRi.exe
  2⤵
  PID:7812
- C:\Windows\System\AJvDaRh.exe
  C:\Windows\System\AJvDaRh.exe
  2⤵
  PID:7988
- C:\Windows\System\jbCmPLB.exe
  C:\Windows\System\jbCmPLB.exe
  2⤵
  PID:1848
- C:\Windows\System\JigEvjQ.exe
  C:\Windows\System\JigEvjQ.exe
  2⤵
  PID:7528
- C:\Windows\System\amyLmtz.exe
  C:\Windows\System\amyLmtz.exe
  2⤵
  PID:7720
- C:\Windows\System\rylnSDt.exe
  C:\Windows\System\rylnSDt.exe
  2⤵
  PID:7264
- C:\Windows\System\YezwvyI.exe
  C:\Windows\System\YezwvyI.exe
  2⤵
  PID:7612
- C:\Windows\System\nHhEMzN.exe
  C:\Windows\System\nHhEMzN.exe
  2⤵
  PID:7840
- C:\Windows\System\Iswwzhj.exe
  C:\Windows\System\Iswwzhj.exe
  2⤵
  PID:8196
- C:\Windows\System\UdQlILB.exe
  C:\Windows\System\UdQlILB.exe
  2⤵
  PID:8228
- C:\Windows\System\uhvTBCV.exe
  C:\Windows\System\uhvTBCV.exe
  2⤵
  PID:8268
- C:\Windows\System\bviaCpz.exe
  C:\Windows\System\bviaCpz.exe
  2⤵
  PID:8292
- C:\Windows\System\hkuyhwB.exe
  C:\Windows\System\hkuyhwB.exe
  2⤵
  PID:8320
- C:\Windows\System\NDOTThj.exe
  C:\Windows\System\NDOTThj.exe
  2⤵
  PID:8348
- C:\Windows\System\YrXFXHU.exe
  C:\Windows\System\YrXFXHU.exe
  2⤵
  PID:8376
- C:\Windows\System\VxmdaoQ.exe
  C:\Windows\System\VxmdaoQ.exe
  2⤵
  PID:8416
- C:\Windows\System\EVFuWdK.exe
  C:\Windows\System\EVFuWdK.exe
  2⤵
  PID:8432
- C:\Windows\System\fEkBrmO.exe
  C:\Windows\System\fEkBrmO.exe
  2⤵
  PID:8488
- C:\Windows\System\UoFvrrb.exe
  C:\Windows\System\UoFvrrb.exe
  2⤵
  PID:8504
- C:\Windows\System\AfcHcun.exe
  C:\Windows\System\AfcHcun.exe
  2⤵
  PID:8532
- C:\Windows\System\OdpzktF.exe
  C:\Windows\System\OdpzktF.exe
  2⤵
  PID:8552
- C:\Windows\System\WLzmhJq.exe
  C:\Windows\System\WLzmhJq.exe
  2⤵
  PID:8576
- C:\Windows\System\UdjblfJ.exe
  C:\Windows\System\UdjblfJ.exe
  2⤵
  PID:8612
- C:\Windows\System\ekLHrCW.exe
  C:\Windows\System\ekLHrCW.exe
  2⤵
  PID:8632
- C:\Windows\System\xqcIdZc.exe
  C:\Windows\System\xqcIdZc.exe
  2⤵
  PID:8648
- C:\Windows\System\wztQSWB.exe
  C:\Windows\System\wztQSWB.exe
  2⤵
  PID:8680
- C:\Windows\System\KQRRheq.exe
  C:\Windows\System\KQRRheq.exe
  2⤵
  PID:8700
- C:\Windows\System\DrOeRwR.exe
  C:\Windows\System\DrOeRwR.exe
  2⤵
  PID:8728
- C:\Windows\System\IizTQFE.exe
  C:\Windows\System\IizTQFE.exe
  2⤵
  PID:8756
- C:\Windows\System\mKaOAhs.exe
  C:\Windows\System\mKaOAhs.exe
  2⤵
  PID:8776
- C:\Windows\System\PZCcvRX.exe
  C:\Windows\System\PZCcvRX.exe
  2⤵
  PID:8804
- C:\Windows\System\hIxVihj.exe
  C:\Windows\System\hIxVihj.exe
  2⤵
  PID:8828
- C:\Windows\System\pDujmZF.exe
  C:\Windows\System\pDujmZF.exe
  2⤵
  PID:8856
- C:\Windows\System\xlbAYRG.exe
  C:\Windows\System\xlbAYRG.exe
  2⤵
  PID:8884
- C:\Windows\System\GMalplL.exe
  C:\Windows\System\GMalplL.exe
  2⤵
  PID:8904
- C:\Windows\System\rdjJiRw.exe
  C:\Windows\System\rdjJiRw.exe
  2⤵
  PID:8932
- C:\Windows\System\PjJIFir.exe
  C:\Windows\System\PjJIFir.exe
  2⤵
  PID:8964
- C:\Windows\System\RPEzvbs.exe
  C:\Windows\System\RPEzvbs.exe
  2⤵
  PID:9004
- C:\Windows\System\djylfCj.exe
  C:\Windows\System\djylfCj.exe
  2⤵
  PID:9044
- C:\Windows\System\uWocpkB.exe
  C:\Windows\System\uWocpkB.exe
  2⤵
  PID:9072
- C:\Windows\System\vnPzkzA.exe
  C:\Windows\System\vnPzkzA.exe
  2⤵
  PID:9108
- C:\Windows\System\ZpSYBQr.exe
  C:\Windows\System\ZpSYBQr.exe
  2⤵
  PID:9128
- C:\Windows\System\icYAhhK.exe
  C:\Windows\System\icYAhhK.exe
  2⤵
  PID:9164
- C:\Windows\System\cilPnha.exe
  C:\Windows\System\cilPnha.exe
  2⤵
  PID:9192
- C:\Windows\System\VjsGSmG.exe
  C:\Windows\System\VjsGSmG.exe
  2⤵
  PID:8212
- C:\Windows\System\kCWpuDc.exe
  C:\Windows\System\kCWpuDc.exe
  2⤵
  PID:8256
- C:\Windows\System\BgHRBNX.exe
  C:\Windows\System\BgHRBNX.exe
  2⤵
  PID:8332
- C:\Windows\System\XNRKuBT.exe
  C:\Windows\System\XNRKuBT.exe
  2⤵
  PID:8404
- C:\Windows\System\cfRSvIg.exe
  C:\Windows\System\cfRSvIg.exe
  2⤵
  PID:8448
- C:\Windows\System\tGrfMHZ.exe
  C:\Windows\System\tGrfMHZ.exe
  2⤵
  PID:8524
- C:\Windows\System\gCYvdhL.exe
  C:\Windows\System\gCYvdhL.exe
  2⤵
  PID:8572
- C:\Windows\System\POGDFYR.exe
  C:\Windows\System\POGDFYR.exe
  2⤵
  PID:8608
- C:\Windows\System\BRmBBNp.exe
  C:\Windows\System\BRmBBNp.exe
  2⤵
  PID:8688
- C:\Windows\System\CpQLEcC.exe
  C:\Windows\System\CpQLEcC.exe
  2⤵
  PID:2884
- C:\Windows\System\LDGRPLK.exe
  C:\Windows\System\LDGRPLK.exe
  2⤵
  PID:8752
- C:\Windows\System\EGcXsdr.exe
  C:\Windows\System\EGcXsdr.exe
  2⤵
  PID:8848
- C:\Windows\System\BhunEri.exe
  C:\Windows\System\BhunEri.exe
  2⤵
  PID:8900
- C:\Windows\System\hYgrHHj.exe
  C:\Windows\System\hYgrHHj.exe
  2⤵
  PID:8988
- C:\Windows\System\kuAfScW.exe
  C:\Windows\System\kuAfScW.exe
  2⤵
  PID:9028
- C:\Windows\System\KgodViR.exe
  C:\Windows\System\KgodViR.exe
  2⤵
  PID:9096
- C:\Windows\System\WPUnDMs.exe
  C:\Windows\System\WPUnDMs.exe
  2⤵
  PID:9148
- C:\Windows\System\LrHHGEU.exe
  C:\Windows\System\LrHHGEU.exe
  2⤵
  PID:9212
- C:\Windows\System\yZNSvtE.exe
  C:\Windows\System\yZNSvtE.exe
  2⤵
  PID:8312
- C:\Windows\System\IYVizad.exe
  C:\Windows\System\IYVizad.exe
  2⤵
  PID:8452
- C:\Windows\System\hifLKxa.exe
  C:\Windows\System\hifLKxa.exe
  2⤵
  PID:8600
- C:\Windows\System\tHFGiZH.exe
  C:\Windows\System\tHFGiZH.exe
  2⤵
  PID:8792
- C:\Windows\System\AhwOmNj.exe
  C:\Windows\System\AhwOmNj.exe
  2⤵
  PID:8868
- C:\Windows\System\chJmSgz.exe
  C:\Windows\System\chJmSgz.exe
  2⤵
  PID:8960
- C:\Windows\System\RUgvtur.exe
  C:\Windows\System\RUgvtur.exe
  2⤵
  PID:9080
- C:\Windows\System\PAztoFi.exe
  C:\Windows\System\PAztoFi.exe
  2⤵
  PID:8396
- C:\Windows\System\ttUebek.exe
  C:\Windows\System\ttUebek.exe
  2⤵
  PID:8768
- C:\Windows\System\okISiOw.exe
  C:\Windows\System\okISiOw.exe
  2⤵
  PID:9176
- C:\Windows\System\QPgfeFN.exe
  C:\Windows\System\QPgfeFN.exe
  2⤵
  PID:9040
- C:\Windows\System\UWdbssM.exe
  C:\Windows\System\UWdbssM.exe
  2⤵
  PID:9064
- C:\Windows\System\dAfOKEJ.exe
  C:\Windows\System\dAfOKEJ.exe
  2⤵
  PID:9252
- C:\Windows\System\HvnlFiB.exe
  C:\Windows\System\HvnlFiB.exe
  2⤵
  PID:9272
- C:\Windows\System\CPzlNIn.exe
  C:\Windows\System\CPzlNIn.exe
  2⤵
  PID:9292
- C:\Windows\System\nFgMIqv.exe
  C:\Windows\System\nFgMIqv.exe
  2⤵
  PID:9328
- C:\Windows\System\IehFaio.exe
  C:\Windows\System\IehFaio.exe
  2⤵
  PID:9356
- C:\Windows\System\QtIleCZ.exe
  C:\Windows\System\QtIleCZ.exe
  2⤵
  PID:9380
- C:\Windows\System\kApjpBu.exe
  C:\Windows\System\kApjpBu.exe
  2⤵
  PID:9416
- C:\Windows\System\SIHTWCO.exe
  C:\Windows\System\SIHTWCO.exe
  2⤵
  PID:9440
- C:\Windows\System\kxbDAen.exe
  C:\Windows\System\kxbDAen.exe
  2⤵
  PID:9472
- C:\Windows\System\bdFtXEf.exe
  C:\Windows\System\bdFtXEf.exe
  2⤵
  PID:9496
- C:\Windows\System\OAwXgti.exe
  C:\Windows\System\OAwXgti.exe
  2⤵
  PID:9516
- C:\Windows\System\McaAewz.exe
  C:\Windows\System\McaAewz.exe
  2⤵
  PID:9540
- C:\Windows\System\EFlIUtv.exe
  C:\Windows\System\EFlIUtv.exe
  2⤵
  PID:9572
- C:\Windows\System\nOUbVZN.exe
  C:\Windows\System\nOUbVZN.exe
  2⤵
  PID:9604
- C:\Windows\System\yEwNVex.exe
  C:\Windows\System\yEwNVex.exe
  2⤵
  PID:9636
- C:\Windows\System\ifOMcpl.exe
  C:\Windows\System\ifOMcpl.exe
  2⤵
  PID:9668
- C:\Windows\System\hgivzkC.exe
  C:\Windows\System\hgivzkC.exe
  2⤵
  PID:9692
- C:\Windows\System\EDsAvvM.exe
  C:\Windows\System\EDsAvvM.exe
  2⤵
  PID:9720
- C:\Windows\System\zDuPmhT.exe
  C:\Windows\System\zDuPmhT.exe
  2⤵
  PID:9744
- C:\Windows\System\iigHMuu.exe
  C:\Windows\System\iigHMuu.exe
  2⤵
  PID:9776
- C:\Windows\System\dohtIag.exe
  C:\Windows\System\dohtIag.exe
  2⤵
  PID:9796
- C:\Windows\System\FCCQjrQ.exe
  C:\Windows\System\FCCQjrQ.exe
  2⤵
  PID:9832
- C:\Windows\System\zCOGaXm.exe
  C:\Windows\System\zCOGaXm.exe
  2⤵
  PID:9860
- C:\Windows\System\oUyUoWO.exe
  C:\Windows\System\oUyUoWO.exe
  2⤵
  PID:9876
- C:\Windows\System\SyfIrDO.exe
  C:\Windows\System\SyfIrDO.exe
  2⤵
  PID:9916
- C:\Windows\System\ZXGORTi.exe
  C:\Windows\System\ZXGORTi.exe
  2⤵
  PID:9952
- C:\Windows\System\OiuhIwX.exe
  C:\Windows\System\OiuhIwX.exe
  2⤵
  PID:9980
- C:\Windows\System\MdQFGak.exe
  C:\Windows\System\MdQFGak.exe
  2⤵
  PID:10000
- C:\Windows\System\JpYrziB.exe
  C:\Windows\System\JpYrziB.exe
  2⤵
  PID:10032
- C:\Windows\System\FyqNuzW.exe
  C:\Windows\System\FyqNuzW.exe
  2⤵
  PID:10052
- C:\Windows\System\FygXbgA.exe
  C:\Windows\System\FygXbgA.exe
  2⤵
  PID:10080
- C:\Windows\System\yrmtqIP.exe
  C:\Windows\System\yrmtqIP.exe
  2⤵
  PID:10096
- C:\Windows\System\ZXDoeER.exe
  C:\Windows\System\ZXDoeER.exe
  2⤵
  PID:10132
- C:\Windows\System\tsOdFBt.exe
  C:\Windows\System\tsOdFBt.exe
  2⤵
  PID:10160
- C:\Windows\System\PcGwBWM.exe
  C:\Windows\System\PcGwBWM.exe
  2⤵
  PID:10184
- C:\Windows\System\lCnAGXZ.exe
  C:\Windows\System\lCnAGXZ.exe
  2⤵
  PID:10216
- C:\Windows\System\yZFvquT.exe
  C:\Windows\System\yZFvquT.exe
  2⤵
  PID:10232
- C:\Windows\System\lGxaWRb.exe
  C:\Windows\System\lGxaWRb.exe
  2⤵
  PID:9268
- C:\Windows\System\toglbeA.exe
  C:\Windows\System\toglbeA.exe
  2⤵
  PID:9284
- C:\Windows\System\DlkdDDo.exe
  C:\Windows\System\DlkdDDo.exe
  2⤵
  PID:9404
- C:\Windows\System\tFbuJUs.exe
  C:\Windows\System\tFbuJUs.exe
  2⤵
  PID:9392
- C:\Windows\System\hUYZQTP.exe
  C:\Windows\System\hUYZQTP.exe
  2⤵
  PID:9512
- C:\Windows\System\lqnllTV.exe
  C:\Windows\System\lqnllTV.exe
  2⤵
  PID:9504
- C:\Windows\System\wyRfLNR.exe
  C:\Windows\System\wyRfLNR.exe
  2⤵
  PID:9656
- C:\Windows\System\KCtmiqm.exe
  C:\Windows\System\KCtmiqm.exe
  2⤵
  PID:9712
- C:\Windows\System\erBekYz.exe
  C:\Windows\System\erBekYz.exe
  2⤵
  PID:9704
- C:\Windows\System\sPCovMe.exe
  C:\Windows\System\sPCovMe.exe
  2⤵
  PID:9824
- C:\Windows\System\DiIeuNI.exe
  C:\Windows\System\DiIeuNI.exe
  2⤵
  PID:9812
- C:\Windows\System\vjfHJzW.exe
  C:\Windows\System\vjfHJzW.exe
  2⤵
  PID:9968
- C:\Windows\System\RmOxkgG.exe
  C:\Windows\System\RmOxkgG.exe
  2⤵
  PID:10064
- C:\Windows\System\WnDdYBY.exe
  C:\Windows\System\WnDdYBY.exe
  2⤵
  PID:10124
- C:\Windows\System\lCCfIBg.exe
  C:\Windows\System\lCCfIBg.exe
  2⤵
  PID:10092
- C:\Windows\System\wasWxVh.exe
  C:\Windows\System\wasWxVh.exe
  2⤵
  PID:9320
- C:\Windows\System\rCpOVBi.exe
  C:\Windows\System\rCpOVBi.exe
  2⤵
  PID:9372
- C:\Windows\System\XabUZdX.exe
  C:\Windows\System\XabUZdX.exe
  2⤵
  PID:9736
- C:\Windows\System\nOVmaqJ.exe
  C:\Windows\System\nOVmaqJ.exe
  2⤵
  PID:9976
- C:\Windows\System\OFqXDqQ.exe
  C:\Windows\System\OFqXDqQ.exe
  2⤵
  PID:10040
- C:\Windows\System\RPljwGY.exe
  C:\Windows\System\RPljwGY.exe
  2⤵
  PID:9756
- C:\Windows\System\oorpNpO.exe
  C:\Windows\System\oorpNpO.exe
  2⤵
  PID:9312
- C:\Windows\System\SbEkISq.exe
  C:\Windows\System\SbEkISq.exe
  2⤵
  PID:10248
- C:\Windows\System\kjzgTCp.exe
  C:\Windows\System\kjzgTCp.exe
  2⤵
  PID:10264
- C:\Windows\System\kfzutNC.exe
  C:\Windows\System\kfzutNC.exe
  2⤵
  PID:10300
- C:\Windows\System\SujbYvL.exe
  C:\Windows\System\SujbYvL.exe
  2⤵
  PID:10332
- C:\Windows\System\upwNYPE.exe
  C:\Windows\System\upwNYPE.exe
  2⤵
  PID:10368
- C:\Windows\System\DAEDElP.exe
  C:\Windows\System\DAEDElP.exe
  2⤵
  PID:10408
- C:\Windows\System\gzkNtpB.exe
  C:\Windows\System\gzkNtpB.exe
  2⤵
  PID:10444
- C:\Windows\System\qHJLCPO.exe
  C:\Windows\System\qHJLCPO.exe
  2⤵
  PID:10480
- C:\Windows\System\VEdCrye.exe
  C:\Windows\System\VEdCrye.exe
  2⤵
  PID:10508
- C:\Windows\System\KBzoYil.exe
  C:\Windows\System\KBzoYil.exe
  2⤵
  PID:10540
- C:\Windows\System\vOKLHHU.exe
  C:\Windows\System\vOKLHHU.exe
  2⤵
  PID:10564
- C:\Windows\System\aXPQXZa.exe
  C:\Windows\System\aXPQXZa.exe
  2⤵
  PID:10588
- C:\Windows\System\uqlqFqv.exe
  C:\Windows\System\uqlqFqv.exe
  2⤵
  PID:10624
- C:\Windows\System\TPLJDhS.exe
  C:\Windows\System\TPLJDhS.exe
  2⤵
  PID:10644
- C:\Windows\System\wKggycc.exe
  C:\Windows\System\wKggycc.exe
  2⤵
  PID:10668
- C:\Windows\System\iljsxtR.exe
  C:\Windows\System\iljsxtR.exe
  2⤵
  PID:10704
- C:\Windows\System\OTKGODp.exe
  C:\Windows\System\OTKGODp.exe
  2⤵
  PID:10732
- C:\Windows\System\SQixXha.exe
  C:\Windows\System\SQixXha.exe
  2⤵
  PID:10756
- C:\Windows\System\HZmJtqa.exe
  C:\Windows\System\HZmJtqa.exe
  2⤵
  PID:10788
- C:\Windows\System\ctySgJc.exe
  C:\Windows\System\ctySgJc.exe
  2⤵
  PID:10820
- C:\Windows\System\xripdCz.exe
  C:\Windows\System\xripdCz.exe
  2⤵
  PID:10844
- C:\Windows\System\pKDoPZt.exe
  C:\Windows\System\pKDoPZt.exe
  2⤵
  PID:10880
- C:\Windows\System\PyxBcsd.exe
  C:\Windows\System\PyxBcsd.exe
  2⤵
  PID:10900
- C:\Windows\System\QtpZmJE.exe
  C:\Windows\System\QtpZmJE.exe
  2⤵
  PID:10936
- C:\Windows\System\ZDAStPe.exe
  C:\Windows\System\ZDAStPe.exe
  2⤵
  PID:10968
- C:\Windows\System\MHrHURy.exe
  C:\Windows\System\MHrHURy.exe
  2⤵
  PID:10996
- C:\Windows\System\odBVlMg.exe
  C:\Windows\System\odBVlMg.exe
  2⤵
  PID:11028
- C:\Windows\System\GwZVKWz.exe
  C:\Windows\System\GwZVKWz.exe
  2⤵
  PID:11060
- C:\Windows\System\ZlbDTPP.exe
  C:\Windows\System\ZlbDTPP.exe
  2⤵
  PID:11084
- C:\Windows\System\VIuECMN.exe
  C:\Windows\System\VIuECMN.exe
  2⤵
  PID:11116
- C:\Windows\System\BNfkrNl.exe
  C:\Windows\System\BNfkrNl.exe
  2⤵
  PID:11152
- C:\Windows\System\RKsvBNZ.exe
  C:\Windows\System\RKsvBNZ.exe
  2⤵
  PID:11176
- C:\Windows\System\vpEauws.exe
  C:\Windows\System\vpEauws.exe
  2⤵
  PID:11196
- C:\Windows\System\TfUFjvc.exe
  C:\Windows\System\TfUFjvc.exe
  2⤵
  PID:11224
- C:\Windows\System\rLpsUlF.exe
  C:\Windows\System\rLpsUlF.exe
  2⤵
  PID:11248
- C:\Windows\System\SMobVaV.exe
  C:\Windows\System\SMobVaV.exe
  2⤵
  PID:10148
- C:\Windows\System\oEBNYZL.exe
  C:\Windows\System\oEBNYZL.exe
  2⤵
  PID:9676
- C:\Windows\System\PsynJDj.exe
  C:\Windows\System\PsynJDj.exe
  2⤵
  PID:10244
- C:\Windows\System\oRJPueh.exe
  C:\Windows\System\oRJPueh.exe
  2⤵
  PID:9768
- C:\Windows\System\ZjdZNYJ.exe
  C:\Windows\System\ZjdZNYJ.exe
  2⤵
  PID:10360
- C:\Windows\System\wUSyQPR.exe
  C:\Windows\System\wUSyQPR.exe
  2⤵
  PID:10312
- C:\Windows\System\UaeROFk.exe
  C:\Windows\System\UaeROFk.exe
  2⤵
  PID:10288
- C:\Windows\System\oLaRoHi.exe
  C:\Windows\System\oLaRoHi.exe
  2⤵
  PID:10424
- C:\Windows\System\UYWwLhY.exe
  C:\Windows\System\UYWwLhY.exe
  2⤵
  PID:10604
- C:\Windows\System\rsvwNYb.exe
  C:\Windows\System\rsvwNYb.exe
  2⤵
  PID:10692
- C:\Windows\System\SOiLvps.exe
  C:\Windows\System\SOiLvps.exe
  2⤵
  PID:10640
- C:\Windows\System\xUloPfW.exe
  C:\Windows\System\xUloPfW.exe
  2⤵
  PID:10784
- C:\Windows\System\UPIrXkH.exe
  C:\Windows\System\UPIrXkH.exe
  2⤵
  PID:10868
- C:\Windows\System\ORLVTpT.exe
  C:\Windows\System\ORLVTpT.exe
  2⤵
  PID:10832
- C:\Windows\System\ulXPtyP.exe
  C:\Windows\System\ulXPtyP.exe
  2⤵
  PID:11008
- C:\Windows\System\ZEQwfJq.exe
  C:\Windows\System\ZEQwfJq.exe
  2⤵
  PID:9144
- C:\Windows\System\ljqNGbm.exe
  C:\Windows\System\ljqNGbm.exe
  2⤵
  PID:11012
- C:\Windows\System\jrwQFYV.exe
  C:\Windows\System\jrwQFYV.exe
  2⤵
  PID:11236
- C:\Windows\System\SdisZpU.exe
  C:\Windows\System\SdisZpU.exe
  2⤵
  PID:11128
- C:\Windows\System\oLadHrm.exe
  C:\Windows\System\oLadHrm.exe
  2⤵
  PID:11188
- C:\Windows\System\inSKTEj.exe
  C:\Windows\System\inSKTEj.exe
  2⤵
  PID:10352
- C:\Windows\System\zmhBoNp.exe
  C:\Windows\System\zmhBoNp.exe
  2⤵
  PID:10616
- C:\Windows\System\wyVBfKQ.exe
  C:\Windows\System\wyVBfKQ.exe
  2⤵
  PID:10808
- C:\Windows\System\SRuZEbR.exe
  C:\Windows\System\SRuZEbR.exe
  2⤵
  PID:10928
- C:\Windows\System\jqNlbSB.exe
  C:\Windows\System\jqNlbSB.exe
  2⤵
  PID:10520
- C:\Windows\System\DPwtRFt.exe
  C:\Windows\System\DPwtRFt.exe
  2⤵
  PID:11232
- C:\Windows\System\uicbBDc.exe
  C:\Windows\System\uicbBDc.exe
  2⤵
  PID:11288
- C:\Windows\System\UpLtttl.exe
  C:\Windows\System\UpLtttl.exe
  2⤵
  PID:11320
- C:\Windows\System\qAfJeon.exe
  C:\Windows\System\qAfJeon.exe
  2⤵
  PID:11352
- C:\Windows\System\dfaOZWR.exe
  C:\Windows\System\dfaOZWR.exe
  2⤵
  PID:11372
- C:\Windows\System\BRxiWAe.exe
  C:\Windows\System\BRxiWAe.exe
  2⤵
  PID:11396
- C:\Windows\System\NvmUGfC.exe
  C:\Windows\System\NvmUGfC.exe
  2⤵
  PID:11424
- C:\Windows\System\NHcLxFK.exe
  C:\Windows\System\NHcLxFK.exe
  2⤵
  PID:11456
- C:\Windows\System\RIeUPal.exe
  C:\Windows\System\RIeUPal.exe
  2⤵
  PID:11472
- C:\Windows\System\xyVjkps.exe
  C:\Windows\System\xyVjkps.exe
  2⤵
  PID:11492
- C:\Windows\System\IRWBsIp.exe
  C:\Windows\System\IRWBsIp.exe
  2⤵
  PID:11608
- C:\Windows\System\RsQGKNd.exe
  C:\Windows\System\RsQGKNd.exe
  2⤵
  PID:11644
- C:\Windows\System\GosbMVP.exe
  C:\Windows\System\GosbMVP.exe
  2⤵
  PID:11676
- C:\Windows\System\NDrsaAG.exe
  C:\Windows\System\NDrsaAG.exe
  2⤵
  PID:11700
- C:\Windows\System\hlNmaHi.exe
  C:\Windows\System\hlNmaHi.exe
  2⤵
  PID:11720
- C:\Windows\System\BEkVJLC.exe
  C:\Windows\System\BEkVJLC.exe
  2⤵
  PID:11756
- C:\Windows\System\UUmRPwc.exe
  C:\Windows\System\UUmRPwc.exe
  2⤵
  PID:11780
- C:\Windows\System\iCWpciz.exe
  C:\Windows\System\iCWpciz.exe
  2⤵
  PID:11804
- C:\Windows\System\bOCChct.exe
  C:\Windows\System\bOCChct.exe
  2⤵
  PID:11828
- C:\Windows\System\FnPfYvj.exe
  C:\Windows\System\FnPfYvj.exe
  2⤵
  PID:11848
- C:\Windows\System\IeOprVz.exe
  C:\Windows\System\IeOprVz.exe
  2⤵
  PID:11872
- C:\Windows\System\ZaNShCx.exe
  C:\Windows\System\ZaNShCx.exe
  2⤵
  PID:11896
- C:\Windows\System\fdpKezy.exe
  C:\Windows\System\fdpKezy.exe
  2⤵
  PID:11924
- C:\Windows\System\MNjnvAz.exe
  C:\Windows\System\MNjnvAz.exe
  2⤵
  PID:11956
- C:\Windows\System\lOtxKPo.exe
  C:\Windows\System\lOtxKPo.exe
  2⤵
  PID:11996
- C:\Windows\System\sUMPgdL.exe
  C:\Windows\System\sUMPgdL.exe
  2⤵
  PID:12028
- C:\Windows\System\kURfteW.exe
  C:\Windows\System\kURfteW.exe
  2⤵
  PID:12060
- C:\Windows\System\SUNJXdc.exe
  C:\Windows\System\SUNJXdc.exe
  2⤵
  PID:12096
- C:\Windows\System\hNfTYXZ.exe
  C:\Windows\System\hNfTYXZ.exe
  2⤵
  PID:12112
- C:\Windows\System\sEXRcZd.exe
  C:\Windows\System\sEXRcZd.exe
  2⤵
  PID:12136
- C:\Windows\System\HQMhtkb.exe
  C:\Windows\System\HQMhtkb.exe
  2⤵
  PID:12156
- C:\Windows\System\DtWIeaB.exe
  C:\Windows\System\DtWIeaB.exe
  2⤵
  PID:12180
- C:\Windows\System\MuwjfiR.exe
  C:\Windows\System\MuwjfiR.exe
  2⤵
  PID:12204
- C:\Windows\System\zMVXTQe.exe
  C:\Windows\System\zMVXTQe.exe
  2⤵
  PID:12244
- C:\Windows\System\GKCZAJw.exe
  C:\Windows\System\GKCZAJw.exe
  2⤵
  PID:12272
- C:\Windows\System\DLeIwqp.exe
  C:\Windows\System\DLeIwqp.exe
  2⤵
  PID:10532
- C:\Windows\System\ahAJhWu.exe
  C:\Windows\System\ahAJhWu.exe
  2⤵
  PID:11268
- C:\Windows\System\vwXnqNj.exe
  C:\Windows\System\vwXnqNj.exe
  2⤵
  PID:11304
- C:\Windows\System\BlVBbfC.exe
  C:\Windows\System\BlVBbfC.exe
  2⤵
  PID:10280
- C:\Windows\System\UBjTKAK.exe
  C:\Windows\System\UBjTKAK.exe
  2⤵
  PID:11332
- C:\Windows\System\UleOhaU.exe
  C:\Windows\System\UleOhaU.exe
  2⤵
  PID:11212
- C:\Windows\System\NOOPRtT.exe
  C:\Windows\System\NOOPRtT.exe
  2⤵
  PID:11368
- C:\Windows\System\YJnwTEZ.exe
  C:\Windows\System\YJnwTEZ.exe
  2⤵
  PID:11440
- C:\Windows\System\uSwLrWt.exe
  C:\Windows\System\uSwLrWt.exe
  2⤵
  PID:11620
- C:\Windows\System\AaFefRE.exe
  C:\Windows\System\AaFefRE.exe
  2⤵
  PID:11560
- C:\Windows\System\glNjyhW.exe
  C:\Windows\System\glNjyhW.exe
  2⤵
  PID:11748
- C:\Windows\System\prvOgRr.exe
  C:\Windows\System\prvOgRr.exe
  2⤵
  PID:11792
- C:\Windows\System\ITKXbGF.exe
  C:\Windows\System\ITKXbGF.exe
  2⤵
  PID:11816
- C:\Windows\System\ElhHfCT.exe
  C:\Windows\System\ElhHfCT.exe
  2⤵
  PID:11892
- C:\Windows\System\qUqOOWD.exe
  C:\Windows\System\qUqOOWD.exe
  2⤵
  PID:11908
- C:\Windows\System\SIIftwR.exe
  C:\Windows\System\SIIftwR.exe
  2⤵
  PID:11944
- C:\Windows\System\bZDcjkh.exe
  C:\Windows\System\bZDcjkh.exe
  2⤵
  PID:12144
- C:\Windows\System\kluFxBE.exe
  C:\Windows\System\kluFxBE.exe
  2⤵
  PID:12164
- C:\Windows\System\oPsEfkl.exe
  C:\Windows\System\oPsEfkl.exe
  2⤵
  PID:11044
- C:\Windows\System\jXrbfZv.exe
  C:\Windows\System\jXrbfZv.exe
  2⤵
  PID:10960
- C:\Windows\System\UPYGNPc.exe
  C:\Windows\System\UPYGNPc.exe
  2⤵
  PID:10500
- C:\Windows\System\UnGnYIM.exe
  C:\Windows\System\UnGnYIM.exe
  2⤵
  PID:11480
- C:\Windows\System\tgWUnTB.exe
  C:\Windows\System\tgWUnTB.exe
  2⤵
  PID:11664
- C:\Windows\System\avltuDQ.exe
  C:\Windows\System\avltuDQ.exe
  2⤵
  PID:11744
- C:\Windows\System\RJexLng.exe
  C:\Windows\System\RJexLng.exe
  2⤵
  PID:11092
- C:\Windows\System\wWlROIi.exe
  C:\Windows\System\wWlROIi.exe
  2⤵
  PID:10392
- C:\Windows\System\Nxxtxci.exe
  C:\Windows\System\Nxxtxci.exe
  2⤵
  PID:12128
- C:\Windows\System\ZSDpZRT.exe
  C:\Windows\System\ZSDpZRT.exe
  2⤵
  PID:11364
- C:\Windows\System\JBeThxb.exe
  C:\Windows\System\JBeThxb.exe
  2⤵
  PID:11968
- C:\Windows\System\UXGhQAB.exe
  C:\Windows\System\UXGhQAB.exe
  2⤵
  PID:12304
- C:\Windows\System\jsHdBPi.exe
  C:\Windows\System\jsHdBPi.exe
  2⤵
  PID:12332
- C:\Windows\System\vFUOHJn.exe
  C:\Windows\System\vFUOHJn.exe
  2⤵
  PID:12352
- C:\Windows\System\kaoTpyv.exe
  C:\Windows\System\kaoTpyv.exe
  2⤵
  PID:12384
- C:\Windows\System\LklKMRD.exe
  C:\Windows\System\LklKMRD.exe
  2⤵
  PID:12412
- C:\Windows\System\gNRUxmr.exe
  C:\Windows\System\gNRUxmr.exe
  2⤵
  PID:12440
- C:\Windows\System\dXCwEMZ.exe
  C:\Windows\System\dXCwEMZ.exe
  2⤵
  PID:12464
- C:\Windows\System\OYAzLwt.exe
  C:\Windows\System\OYAzLwt.exe
  2⤵
  PID:12484
- C:\Windows\System\SaHeVyC.exe
  C:\Windows\System\SaHeVyC.exe
  2⤵
  PID:12504
- C:\Windows\System\roTUZln.exe
  C:\Windows\System\roTUZln.exe
  2⤵
  PID:12532
- C:\Windows\System\NDwtqhV.exe
  C:\Windows\System\NDwtqhV.exe
  2⤵
  PID:12556
- C:\Windows\System\UmnkCrS.exe
  C:\Windows\System\UmnkCrS.exe
  2⤵
  PID:12596
- C:\Windows\System\MBXWWDv.exe
  C:\Windows\System\MBXWWDv.exe
  2⤵
  PID:12632
- C:\Windows\System\egtUAKc.exe
  C:\Windows\System\egtUAKc.exe
  2⤵
  PID:12660
- C:\Windows\System\uhwIOuH.exe
  C:\Windows\System\uhwIOuH.exe
  2⤵
  PID:12684
- C:\Windows\System\iFrmuuf.exe
  C:\Windows\System\iFrmuuf.exe
  2⤵
  PID:12704
- C:\Windows\System\UBxHFLC.exe
  C:\Windows\System\UBxHFLC.exe
  2⤵
  PID:12736
- C:\Windows\System\sbXXGmj.exe
  C:\Windows\System\sbXXGmj.exe
  2⤵
  PID:12772
- C:\Windows\System\zCOZfuT.exe
  C:\Windows\System\zCOZfuT.exe
  2⤵
  PID:12804
- C:\Windows\System\UGItRBE.exe
  C:\Windows\System\UGItRBE.exe
  2⤵
  PID:12832
- C:\Windows\System\yibGJSj.exe
  C:\Windows\System\yibGJSj.exe
  2⤵
  PID:12852
- C:\Windows\System\izAgjol.exe
  C:\Windows\System\izAgjol.exe
  2⤵
  PID:12868
- C:\Windows\System\HuoYhzR.exe
  C:\Windows\System\HuoYhzR.exe
  2⤵
  PID:12896
- C:\Windows\System\dxqkxtS.exe
  C:\Windows\System\dxqkxtS.exe
  2⤵
  PID:12944
- C:\Windows\System\UHyqnKv.exe
  C:\Windows\System\UHyqnKv.exe
  2⤵
  PID:12968
- C:\Windows\System\yAyILwr.exe
  C:\Windows\System\yAyILwr.exe
  2⤵
  PID:13000
- C:\Windows\System\iWblKFg.exe
  C:\Windows\System\iWblKFg.exe
  2⤵
  PID:13032
- C:\Windows\System\jBhTjzD.exe
  C:\Windows\System\jBhTjzD.exe
  2⤵
  PID:13088
- C:\Windows\System\UZgTpaH.exe
  C:\Windows\System\UZgTpaH.exe
  2⤵
  PID:13116
- C:\Windows\System\TlrbrJg.exe
  C:\Windows\System\TlrbrJg.exe
  2⤵
  PID:13132
- C:\Windows\System\FJDmHrU.exe
  C:\Windows\System\FJDmHrU.exe
  2⤵
  PID:13152
- C:\Windows\System\pqPoWbf.exe
  C:\Windows\System\pqPoWbf.exe
  2⤵
  PID:13176
- C:\Windows\System\kKvDduv.exe
  C:\Windows\System\kKvDduv.exe
  2⤵
  PID:13192
- C:\Windows\System\OkgISXG.exe
  C:\Windows\System\OkgISXG.exe
  2⤵
  PID:13224
- C:\Windows\System\lCtHFyg.exe
  C:\Windows\System\lCtHFyg.exe
  2⤵
  PID:13244
- C:\Windows\System\dlNIsNZ.exe
  C:\Windows\System\dlNIsNZ.exe
  2⤵
  PID:13272
- C:\Windows\System\gLeJJav.exe
  C:\Windows\System\gLeJJav.exe
  2⤵
  PID:13292
- C:\Windows\System\EshZdIL.exe
  C:\Windows\System\EshZdIL.exe
  2⤵
  PID:12292
- C:\Windows\System\nxWIhgj.exe
  C:\Windows\System\nxWIhgj.exe
  2⤵
  PID:12264
- C:\Windows\System\UFkTbcX.exe
  C:\Windows\System\UFkTbcX.exe
  2⤵
  PID:12400
- C:\Windows\System\OQOytpK.exe
  C:\Windows\System\OQOytpK.exe
  2⤵
  PID:12372
- C:\Windows\System\jRqxgSq.exe
  C:\Windows\System\jRqxgSq.exe
  2⤵
  PID:12528
- C:\Windows\System\GQMezHG.exe
  C:\Windows\System\GQMezHG.exe
  2⤵
  PID:12564
- C:\Windows\System\rfbwfbv.exe
  C:\Windows\System\rfbwfbv.exe
  2⤵
  PID:12616
- C:\Windows\System\XyokMPl.exe
  C:\Windows\System\XyokMPl.exe
  2⤵
  PID:12716
- C:\Windows\System\igHVFyI.exe
  C:\Windows\System\igHVFyI.exe
  2⤵
  PID:12764
- C:\Windows\System\DfhVZSr.exe
  C:\Windows\System\DfhVZSr.exe
  2⤵
  PID:12784
- C:\Windows\System\VyIefny.exe
  C:\Windows\System\VyIefny.exe
  2⤵
  PID:12828
- C:\Windows\System\eeeClxj.exe
  C:\Windows\System\eeeClxj.exe
  2⤵
  PID:12904
- C:\Windows\System\TDPgQek.exe
  C:\Windows\System\TDPgQek.exe
  2⤵
  PID:12960
- C:\Windows\System\OjGRHSx.exe
  C:\Windows\System\OjGRHSx.exe
  2⤵
  PID:13044
- C:\Windows\System\CJGrhDA.exe
  C:\Windows\System\CJGrhDA.exe
  2⤵
  PID:13100
- C:\Windows\System\BCGLMrU.exe
  C:\Windows\System\BCGLMrU.exe
  2⤵
  PID:13160
- C:\Windows\System\MHopIqf.exe
  C:\Windows\System\MHopIqf.exe
  2⤵
  PID:13216
- C:\Windows\System\ceGJUhr.exe
  C:\Windows\System\ceGJUhr.exe
  2⤵
  PID:13204
- C:\Windows\System\suNTrFO.exe
  C:\Windows\System\suNTrFO.exe
  2⤵
  PID:13304
- C:\Windows\System\PiSqTBS.exe
  C:\Windows\System\PiSqTBS.exe
  2⤵
  PID:12480
- C:\Windows\System\PcSCfss.exe
  C:\Windows\System\PcSCfss.exe
  2⤵
  PID:11836
- C:\Windows\System\pKeNoxy.exe
  C:\Windows\System\pKeNoxy.exe
  2⤵
  PID:12364
- C:\Windows\System\wUDfVJo.exe
  C:\Windows\System\wUDfVJo.exe
  2⤵
  PID:12456
- C:\Windows\System\xUKclbN.exe
  C:\Windows\System\xUKclbN.exe
  2⤵
  PID:13020
- C:\Windows\System\QkENfMS.exe
  C:\Windows\System\QkENfMS.exe
  2⤵
  PID:1956
- C:\Windows\System\PPxEsaj.exe
  C:\Windows\System\PPxEsaj.exe
  2⤵
  PID:13128
- C:\Windows\System\gDBkCMK.exe
  C:\Windows\System\gDBkCMK.exe
  2⤵
  PID:4680
- C:\Windows\System\rWupXNF.exe
  C:\Windows\System\rWupXNF.exe
  2⤵
  PID:12760
- C:\Windows\System\HkbRPCL.exe
  C:\Windows\System\HkbRPCL.exe
  2⤵
  PID:12916
- C:\Windows\System\txsMkfB.exe
  C:\Windows\System\txsMkfB.exe
  2⤵
  PID:13324
- C:\Windows\System\pBtHGfu.exe
  C:\Windows\System\pBtHGfu.exe
  2⤵
  PID:13352
- C:\Windows\System\BqREFfr.exe
  C:\Windows\System\BqREFfr.exe
  2⤵
  PID:13388
- C:\Windows\System\IoEPUei.exe
  C:\Windows\System\IoEPUei.exe
  2⤵
  PID:13424
- C:\Windows\System\oRHCElf.exe
  C:\Windows\System\oRHCElf.exe
  2⤵
  PID:13464
- C:\Windows\System\hrSrMdd.exe
  C:\Windows\System\hrSrMdd.exe
  2⤵
  PID:13492
- C:\Windows\System\UvGNsQE.exe
  C:\Windows\System\UvGNsQE.exe
  2⤵
  PID:13520
- C:\Windows\System\AoSjwHK.exe
  C:\Windows\System\AoSjwHK.exe
  2⤵
  PID:13540
- C:\Windows\System\HMUdhnS.exe
  C:\Windows\System\HMUdhnS.exe
  2⤵
  PID:13568
- C:\Windows\System\bRnEZUd.exe
  C:\Windows\System\bRnEZUd.exe
  2⤵
  PID:13600
- C:\Windows\System\QLDTyBO.exe
  C:\Windows\System\QLDTyBO.exe
  2⤵
  PID:13624
- C:\Windows\System\YQywlab.exe
  C:\Windows\System\YQywlab.exe
  2⤵
  PID:13668
- C:\Windows\System\TNUJkZS.exe
  C:\Windows\System\TNUJkZS.exe
  2⤵
  PID:13700
- C:\Windows\System\RxZkMRR.exe
  C:\Windows\System\RxZkMRR.exe
  2⤵
  PID:13728
- C:\Windows\System\uaTWrGZ.exe
  C:\Windows\System\uaTWrGZ.exe
  2⤵
  PID:13760
- C:\Windows\System\qgQMqWC.exe
  C:\Windows\System\qgQMqWC.exe
  2⤵
  PID:13796
- C:\Windows\System\NEKYtcF.exe
  C:\Windows\System\NEKYtcF.exe
  2⤵
  PID:13824
- C:\Windows\System\mShxPmn.exe
  C:\Windows\System\mShxPmn.exe
  2⤵
  PID:13848
- C:\Windows\System\qAthBpe.exe
  C:\Windows\System\qAthBpe.exe
  2⤵
  PID:13868
- C:\Windows\System\wTcJMrO.exe
  C:\Windows\System\wTcJMrO.exe
  2⤵
  PID:13892
- C:\Windows\System\TwAZtmO.exe
  C:\Windows\System\TwAZtmO.exe
  2⤵
  PID:13920
- C:\Windows\System\oLEVPfS.exe
  C:\Windows\System\oLEVPfS.exe
  2⤵
  PID:13948
- C:\Windows\System\ckqqzSu.exe
  C:\Windows\System\ckqqzSu.exe
  2⤵
  PID:13968
- C:\Windows\System\IpdfDCd.exe
  C:\Windows\System\IpdfDCd.exe
  2⤵
  PID:13992
- C:\Windows\System\GCMPuxC.exe
  C:\Windows\System\GCMPuxC.exe
  2⤵
  PID:14016
- C:\Windows\System\HaLwLwg.exe
  C:\Windows\System\HaLwLwg.exe
  2⤵
  PID:14052
- C:\Windows\System\jpVMTAD.exe
  C:\Windows\System\jpVMTAD.exe
  2⤵
  PID:14076
- C:\Windows\System\CFklXzQ.exe
  C:\Windows\System\CFklXzQ.exe
  2⤵
  PID:14096
- C:\Windows\System\fYsabRY.exe
  C:\Windows\System\fYsabRY.exe
  2⤵
  PID:14124
- C:\Windows\System\tZxfRhO.exe
  C:\Windows\System\tZxfRhO.exe
  2⤵
  PID:14148
- C:\Windows\System\mdAnIAm.exe
  C:\Windows\System\mdAnIAm.exe
  2⤵
  PID:14172
- C:\Windows\System\TaEriOU.exe
  C:\Windows\System\TaEriOU.exe
  2⤵
  PID:14200
- C:\Windows\System\NdelCQd.exe
  C:\Windows\System\NdelCQd.exe
  2⤵
  PID:14232
- C:\Windows\System\GxMpJUu.exe
  C:\Windows\System\GxMpJUu.exe
  2⤵
  PID:14260
- C:\Windows\System\WGDIeWi.exe
  C:\Windows\System\WGDIeWi.exe
  2⤵
  PID:14292
- C:\Windows\System\ffOczwU.exe
  C:\Windows\System\ffOczwU.exe
  2⤵
  PID:12932
- C:\Windows\System\UxzRsse.exe
  C:\Windows\System\UxzRsse.exe
  2⤵
  PID:13144
- C:\Windows\System\xkQzwVK.exe
  C:\Windows\System\xkQzwVK.exe
  2⤵
  PID:13364
- C:\Windows\System\lHQXVJw.exe
  C:\Windows\System\lHQXVJw.exe
  2⤵
  PID:13400
- C:\Windows\System\odXOrqv.exe
  C:\Windows\System\odXOrqv.exe
  2⤵
  PID:13420
- C:\Windows\System\VqkNPbj.exe
  C:\Windows\System\VqkNPbj.exe
  2⤵
  PID:13532
- C:\Windows\System\wgbrkME.exe
  C:\Windows\System\wgbrkME.exe
  2⤵
  PID:13716
- C:\Windows\System\VzIsrsx.exe
  C:\Windows\System\VzIsrsx.exe
  2⤵
  PID:13644
- C:\Windows\System\dpbnQUj.exe
  C:\Windows\System\dpbnQUj.exe
  2⤵
  PID:13688
- C:\Windows\System\UQTuAOh.exe
  C:\Windows\System\UQTuAOh.exe
  2⤵
  PID:13816
- C:\Windows\System\dbieihs.exe
  C:\Windows\System\dbieihs.exe
  2⤵
  PID:13928
- C:\Windows\System\GlBBuig.exe
  C:\Windows\System\GlBBuig.exe
  2⤵
  PID:13904
- C:\Windows\System\arQHGKM.exe
  C:\Windows\System\arQHGKM.exe
  2⤵
  PID:14028
- C:\Windows\System\XpKUdZa.exe
  C:\Windows\System\XpKUdZa.exe
  2⤵
  PID:14092
- C:\Windows\System\ghFQgJn.exe
  C:\Windows\System\ghFQgJn.exe
  2⤵
  PID:14164
- C:\Windows\System\mgyQRdu.exe
  C:\Windows\System\mgyQRdu.exe
  2⤵
  PID:14072
- C:\Windows\System\RjyDCuu.exe
  C:\Windows\System\RjyDCuu.exe
  2⤵
  PID:14224
- C:\Windows\System\inPhsDq.exe
  C:\Windows\System\inPhsDq.exe
  2⤵
  PID:14312
- C:\Windows\System\mIYddPs.exe
  C:\Windows\System\mIYddPs.exe
  2⤵
  PID:14328
- C:\Windows\System\IFlYBEy.exe
  C:\Windows\System\IFlYBEy.exe
  2⤵
  PID:13536
- C:\Windows\System\NGfWoXS.exe
  C:\Windows\System\NGfWoXS.exe
  2⤵
  PID:13484
- C:\Windows\System\uYrJCUk.exe
  C:\Windows\System\uYrJCUk.exe
  2⤵
  PID:13748
- C:\Windows\System\ikMiNeH.exe
  C:\Windows\System\ikMiNeH.exe
  2⤵
  PID:14060
- C:\Windows\System\hvkQqoO.exe
  C:\Windows\System\hvkQqoO.exe
  2⤵
  PID:14004
- C:\Windows\System\JNdeMUO.exe
  C:\Windows\System\JNdeMUO.exe
  2⤵
  PID:13340
- C:\Windows\System\tKrBUJj.exe
  C:\Windows\System\tKrBUJj.exe
  2⤵
  PID:12724
- C:\Windows\System\tAnanZJ.exe
  C:\Windows\System\tAnanZJ.exe
  2⤵
  PID:13504
- C:\Windows\System\kFdZlzq.exe
  C:\Windows\System\kFdZlzq.exe
  2⤵
  PID:14040
- C:\Windows\System\bkQXinP.exe
  C:\Windows\System\bkQXinP.exe
  2⤵
  PID:14364
- C:\Windows\System\MIaWxxo.exe
  C:\Windows\System\MIaWxxo.exe
  2⤵
  PID:14392
- C:\Windows\System\ndvlZHr.exe
  C:\Windows\System\ndvlZHr.exe
  2⤵
  PID:14416
- C:\Windows\System\HuZQUAR.exe
  C:\Windows\System\HuZQUAR.exe
  2⤵
  PID:14436
- C:\Windows\System\Bvudmrd.exe
  C:\Windows\System\Bvudmrd.exe
  2⤵
  PID:14472
- C:\Windows\System\roFqWYj.exe
  C:\Windows\System\roFqWYj.exe
  2⤵
  PID:14496
- C:\Windows\System\tmTPsyi.exe
  C:\Windows\System\tmTPsyi.exe
  2⤵
  PID:14520
- C:\Windows\System\oXIsCeW.exe
  C:\Windows\System\oXIsCeW.exe
  2⤵
  PID:14544
- C:\Windows\System\tltBNBa.exe
  C:\Windows\System\tltBNBa.exe
  2⤵
  PID:14580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\HBxYkwN.exe

Filesize
2.3MB

MD5
1ec79cd2d19077f592cb08cbbb77b4e6

SHA1
656c1a81addaf6070ddda1c61b98573d3aabb68c

SHA256
1ea52b668f227c25f31f2e6aa92cad0000f741ef1c7bb52bc0ba5c6cf02ef73c

SHA512
ee1dbd2877af8e9226f8f4a042b6ed2338683a3a0c2add9ffd33f452e731ca5edd9983e5f6d140167bfe126deda38bc2b71f27d97d56cf49925a22ccd1e777a0

Download Submit
C:\Windows\System\LDVIFCB.exe

Filesize
2.3MB

MD5
b2e1cee26937f155dd926152f70bec3e

SHA1
60530ff7a4ae8e8a54d649c244603026b8a5b39f

SHA256
1be3eaedc20d1facdfa1c5ed952045e294664af584a0dcbfe9b8aadd936ff81c

SHA512
6a243f5c0d942d7b4ce217ad9dae2cc23e91020b558fe878424eaf5cf7752f52f388eb38070df97a229539abb4320c0b7e000ee392176be09b813db25952c152

Download Submit
C:\Windows\System\LRxZDzT.exe

Filesize
2.3MB

MD5
09898ee5cbc8f46f1ad1da49f3f6ad34

SHA1
54be3974161f51d4312e730e9a1fd584a59a835a

SHA256
43f9aac4e419b04588d5f5da3dcf8008d6fa1491c031420377a93573ccc248eb

SHA512
e94ed19504aaac6ef570d835af6475a51423947a81deaf66a82fbec85d895d64fc11f485cc7e35c26ff9d526e867b628798d64616d3bbf0153d71d7b4d42f21a

Download Submit
C:\Windows\System\LUdUQtl.exe

Filesize
2.3MB

MD5
a2343b199368e08176af2848e28a1bb6

SHA1
a8c028dcc65147aa81afc75ed1a850e4844e0856

SHA256
e501ea3eb3abcfa151a8aa653cbd1602c13c88bddb623e368538b5b95d3b559e

SHA512
18d15698ec533a49e71239b4ebbba4d04ac313113186da83031ec6f211e3f969dd6498143c5233d13e55bf29d4448a32bf249fd900d613809101c709264b32d3

Download Submit
C:\Windows\System\MfUyRtU.exe

Filesize
2.3MB

MD5
e41da8d6128bbe73db618b6b1e828a90

SHA1
7aa4b8ff6a7c2695713f2ee0f0633301c81f8ca7

SHA256
7eb7d4a3455530e1b0ef3ff328d24b19e3b61a2321f4e42808a2efc9c3032bef

SHA512
4d49accd6edf10cf0d7500866c0f2f97439e77cd4f6405f0fb49f864907dbf5998a3ed8cece20014d8604a1acfd2d93ca77525dbbdef7f906769cafa0691ea0a

Download Submit
C:\Windows\System\NKrRvAc.exe

Filesize
2.3MB

MD5
acdfbd9b154ea6d2e424e2338c2b9cda

SHA1
18921add4954c0aaac0d559435036451aa2d7e40

SHA256
e03e6ff08fc73f791eff3d5f02e021ef637353c8b850aa53fc204d5483840ce5

SHA512
9addd838c04e4e322f2639e0bbfcc24a4c9e36274518ba52d6e042672ce36779221b5fcaa41eba481319dbbfdeb7d0e9aad4bf21135799dc22d3e5b916e1b795

Download Submit
C:\Windows\System\NpesymH.exe

Filesize
2.3MB

MD5
86c329bf3833094d794c903213b992b5

SHA1
eafc553778bf17f3667c17493e48a60f566342b1

SHA256
b23bf56297139a8e3194f8fba098327bfb1674300efb46c3b4ae6cc46a7a8f70

SHA512
3328d6930699db16c714cfbb4441d53418bb828b30c23981b22dc423485e79b9c6a3035d1d2fe045efccd4a04d99d13bcda80e0704e3be135aa1c21f70aa58b1

Download Submit
C:\Windows\System\PnSYYPc.exe

Filesize
2.3MB

MD5
5d8801dc8d66fcd81b302b5d4613ab58

SHA1
3afb9a758fe15ec346b2b6cd7eeb13ded180a7b8

SHA256
d0c3f095023d439520e1eb50363cb6aaa05f47a388a94a70c23679db077ccb16

SHA512
eceed738564706dd837cf6fbe247ffd986889681b324ebf0ef2ad9f8f0612bff6d5d8df5000dc34cd52dde188ac6e2de88186e75c93bbc0c0f09683946640cbf

Download Submit
C:\Windows\System\QKobSbw.exe

Filesize
2.3MB

MD5
7e09f9741043d5949bbf2e57e38deda0

SHA1
fdb4a6492b12faa1b92a47346fe246fb0e8c0c25

SHA256
dcd9e5e7008a530cb7aebadc0e1f905064e3fc234c9da89140f229353159a69e

SHA512
df488bea76921e54f94750838bd8d3899c86f6e6b511f25b33fdfd7a8e724882652beb7ca4dc7a3eee6ddce923fe2a3e470511fc46b2d5583e52c25fa5e5107a

Download Submit
C:\Windows\System\RecDRIp.exe

Filesize
2.3MB

MD5
45cc1dd124e73c3ca75fb2e0bba0e31e

SHA1
2036ef19a31c14e6df831a77c19aecdb0dcb730c

SHA256
8dd07c3e69254597f2dcebb656a27a0bf985c29a863b57170e3f8578df24927f

SHA512
ba0af6700267edb060f6a3c06d52654e30ac0a956fa4bfe99ffab206d587b79cba1516a1b0173e33bfd556a4ae09491e98b755960fa6108e8e1117d95278d3e1

Download Submit
C:\Windows\System\SGMQdvh.exe

Filesize
2.3MB

MD5
70defb102db170bb6a3c1a2e84983449

SHA1
bad1ef3ae7fb72674aba444f8812b791afa9d639

SHA256
d415e288da4f46f2f4b7882b45d98f4b7ba91967fbb92695d21a5ab07c328658

SHA512
4a5105d66b48e918edc52e8947c25c6480a502b093b8bfb2f5edabcddf76135dd1ed7c99ea3dce65efb77f2a3d1d20f6cfa5f27adf87d1c58b9dbe5b9d80e6f4

Download Submit
C:\Windows\System\SPfrCZm.exe

Filesize
2.3MB

MD5
f5ffb7a23742b1d6cc6d459ca06ddf7c

SHA1
e0369a1a9024e21804046e8def215f1d3aff2928

SHA256
71476fe47d4a3354d864dd54aa50071d76cc0ffea07f8200208d3ba71bc73080

SHA512
e81f264be1ebfe374130f573c79d8cddbd2d6b913bbd8f9d612c5d255fde30bffd7e925a040faf3a3056bb9158cb8bc6014cd897457c01460d10ca107797650e

Download Submit
C:\Windows\System\SpnbMLJ.exe

Filesize
2.3MB

MD5
74fc3e315f57065dfff93f46470e177d

SHA1
a952858dfdb8f7de431a0a04ecbcae267d85c1bb

SHA256
f1ff064dad197a29525ce895d0e01f96ebe20a4a05c052f4ce9e6cab76dc5ff9

SHA512
e61e5d602f562f08f716e0bd93600eab1b3b9623f49795670f1786e7f2c43a639eb245ae66381bac8df8e18e3330e4f8a29a4e8852d33fa8549748feb1d54a67

Download Submit
C:\Windows\System\TtikWuX.exe

Filesize
2.3MB

MD5
a071aa64fdb87751bdc73093ff31479d

SHA1
48f0ad15a7e965b8d0736517ea4ef78cbd5e63f1

SHA256
147ca49f3df4a6df04f000887378f7b2b4f38c283a1e457d3e3b9a59d750c14c

SHA512
f6f3e12587d356e8dcd5f532594dca98b6910e32137764c64c88800db2829c8a1478fdfcd39bd7b52abc4a13385fa10b9dd3f1756a18939a15a74256e36752bd

Download Submit
C:\Windows\System\TwhUDoj.exe

Filesize
2.3MB

MD5
9ecc53972c36642d0b40ca7ce723f1b1

SHA1
3b9cedcc6877a79f67da938eb8e15009ee18dfb2

SHA256
3c7fbf1d5ed7ebe012fcf5b332c9a2a8bcc0881fa23412d89b7b898cdee8be41

SHA512
501e453498126158ddc4df5c6777879088aef2f2ceccce4b6208a987b698f6b6e7b532c8a09866af35ecd67cbd188345db05ce9016ffaedf7352a9c17d5b4410

Download Submit
C:\Windows\System\UaTibAX.exe

Filesize
2.3MB

MD5
a18384e5207fdb407ec6d60afcc9802b

SHA1
04094c8d2684aa3886f1856c286373dcb288fccc

SHA256
e48fc3319181d623dc61cc33d240759b1258c1deab28f888e88988ebd960f3d2

SHA512
58d0cd692351b351417b1536b2b890ec8d2c896e974d7ba3b83f246979a3d33e12414dfe1b6b235ca27194d963715f86f14b8ff91d562c92e0b6ce8e1180d88d

Download Submit
C:\Windows\System\UjfeVFH.exe

Filesize
2.3MB

MD5
31542cc3df6bc31dbc24099502b2e5d1

SHA1
82fc618eb1f08fe5bd816676534142a21c32b56b

SHA256
48eeef02a62e8442e424fe29f7671ba2ef1e0b159d7bbabe5af6850084970a91

SHA512
3ff6a3b6ae3113dddc73d67b519161fd9b7383fdfe7cb8c964c48cfdbd64a1be406c7976355ae93b0d150655ea46b44b6503292ea4408ab2382670dba0bd770d

Download Submit
C:\Windows\System\UoOEwOV.exe

Filesize
2.3MB

MD5
93de59c4d6a9069e7720e3b2a1575574

SHA1
acc75da45a0f299ac819f7f6d724437b1529665c

SHA256
204352347f2605d75f34df80143a54ee17207d4220af6ed47cf8007fcb024c1e

SHA512
57c6dfb99241685100a9cc0c29861bb4b61dc4ac84304d6a6baa8a79bd9ac894de3fbdf569f460da8383637bb9ea37a4fbc09e0a204b8cd8ff2b64eea071f901

Download Submit
C:\Windows\System\VJGAVqT.exe

Filesize
2.3MB

MD5
43582d0565b716d58b87ae34818d0411

SHA1
a4a61d359ec91d43b4bc26a23335226af5c7faa7

SHA256
a8a75e6df4bfc0971bd8bb2f94568d050aef5b7343f19e629122d2b7a822514c

SHA512
0dbeba77740aaecc42207ef2f01ca82a8e9daaf528f66792b7c758f6c8b1b4acfb65ed087053abe9d3afb0de7994c6a032963aaba7e6ee257429e7a2800ce002

Download Submit
C:\Windows\System\WgZOpXV.exe

Filesize
2.3MB

MD5
f39954cee9665966a2413d3b29e62458

SHA1
7443b1daa2d88f523c693a0900f4114eaef25f3f

SHA256
77bb9e962bf4226b2d10b04528fb063587ead9e50c52864c3e0b9f2537a7bb6e

SHA512
3aee43482412b091f04edde9c075aa27f167a44cdc362ed5c814e697aebb02ddb257cf4a9dd33e464086ae03254ae886dd9ae6afaf96f2394a0c435b692ee300

Download Submit
C:\Windows\System\YRkFLeN.exe

Filesize
2.3MB

MD5
188d038d7c610f12c4bc9ebfea6679f0

SHA1
87223aaa1a2f98fcb48429be0dd08c0205460c32

SHA256
1b58117cb758003889ee76dd39155e68583080d844e8f4a738af264719f7f2e3

SHA512
472be491b6b5e1494ac7b99a90a8199e3be86624e6a64fcb9a0d38f0d2b35458b34bcb19f220d78faed66a3b2b777dd7618a149886d9cf98d33c5b77cb3c041c

Download Submit
C:\Windows\System\ZzNkKNG.exe

Filesize
2.3MB

MD5
bf87eecb72ba5124a09248f3155dce9e

SHA1
72b5ca0841ccc4feba60e043ae302adb589d0e0b

SHA256
ac15afe772115eb5fff4c4732b310474656cfb8a4f713c1d617b57bb623061d3

SHA512
acea49fba98c917f301bab6d9ba408c7ada902fe37b5b521ba67a7778373a7041d35c9de548f53c4f298844ed2efbaa36faa88e5eca43cfaf7df80cce3bb6592

Download Submit
C:\Windows\System\aGnjczE.exe

Filesize
2.3MB

MD5
af347d3ce0ef6dca4a5b594632a39d97

SHA1
4915048a0066ecec09702b559c809dab5a154f27

SHA256
507cc2c63a03bd13f2ceee2f37ef9dc275a3f2f38e6962ee0721b64f42e5484a

SHA512
df7e22f26af7948494c18ab0b2b5abd6333c98337ae53fe062485da0e6f76b25e0e19c4e66105a7d9f7030904df8daf3fdbd34ce7b6eb77cb4df4bfd91ecf38e

Download Submit
C:\Windows\System\bFIfkHn.exe

Filesize
2.3MB

MD5
629f62ad0403d47b9bf2f8209dcd3434

SHA1
e1b1db693603de934975b00d28255be52097384e

SHA256
7b548cbf218d95826f8d3c09c900c69bfcce6a404c3d9cf4247adf4612a5621f

SHA512
873939b54a441a7bea3692dd40467e2bb01807f66d482ccbdcf20b2eaf80d07cb135c13792ee4025c2e258ac05f33d05b2448db8682f69dc5ce16d45a1d686ff

Download Submit
C:\Windows\System\cHVrnbX.exe

Filesize
2.3MB

MD5
f6dd61c6524853c01c612eff228506a2

SHA1
385d562db4c59aa904dd301b05ada4459df35ca2

SHA256
f9b63b89a4f797035ab7d2d61e901ef634402ddca6c9073ee3f2317666775ad8

SHA512
436cb76f61e534902a87273f8e12778f8f926954257a6dc1dc4c064fc8746d61c40286044c790140e82cf481adf2b01d89df7c369527435dc526f11145ef1a2b

Download Submit
C:\Windows\System\casNJrN.exe

Filesize
2.3MB

MD5
2405747d16ce00cc591901084dba9646

SHA1
949e419b36eab8209b5a001951e95839f4ed793c

SHA256
8cea7fa4c4528b83fc1ef24302c60af09666791945bb73f391ef4a16e231b4e0

SHA512
4a5c9a5053eb76adf12504fc85f1e24826f6bc52c509442bb5106fa851cb0c27ba75418e86e88efdc6ce46714248b1acaafa56cdbbdc5c59e98358d2ea415ce4

Download Submit
C:\Windows\System\dNujSKX.exe

Filesize
2.3MB

MD5
d67cb0e85d1541d4eb195f6319198b65

SHA1
b031ba044ab9e63c1e01a501addd90ebd1f381b6

SHA256
0e72bd8bcda273c617c9cb589ae1a986a65d3a91336ed1f68a398e65eff0f44c

SHA512
999547cc750d39433847a7b3cf179db330421fa3f5ec9e45cb32b1129c79f4dce188b19ab26acd4e622b5b1e67b803251e7a5382523522ed97dad9d9f6eb7d87

Download Submit
C:\Windows\System\giBjcBH.exe

Filesize
2.3MB

MD5
898b80b457a42036e3bc9cf19d8946dd

SHA1
df8989c10d53545a26877eeeac49c45ea284d0a8

SHA256
4138b02340983c7e3f13b6712cf13d8a05de3b1517401ab3c4baff624a70af2e

SHA512
e70743f7d4a332aeba0ab3699431abf0e629ac3904eef6a107a724ed220cab80159bdf85c062cb99ec455e239029ac7f128dd180eb9f754a8a103fe948b851ab

Download Submit
C:\Windows\System\kPXvqtp.exe

Filesize
2.3MB

MD5
67ac51580fe2107189f2b32714a80350

SHA1
dfc773d33055939606e3270e1e28117a8142713a

SHA256
bb4b2a6901e596cd946808f04c0053e5400ab5748f77b6dc6780bae91e73723e

SHA512
5d4580fddfc50ea518f7973c9c0420994d7ae5f0cd278f3c0e5e48d3b699244b96debdbc30cfd7798c105a91a9740400b331f91d2c16049e9b491f64c7bee174

Download Submit
C:\Windows\System\nVjDCHL.exe

Filesize
2.3MB

MD5
f4a0de2a90415ed9099b5500378233ee

SHA1
4ef73cfa22c19a6dfd1fb1fc8f5ffc464919f4cd

SHA256
2bda4f583ddc480c4a6125b526594e130b6af9cee406361ac425e280acf5ec58

SHA512
ae00350d0ba81ca05f9f5dfc1c2a4087de14eaa70453b2eebfa149167df770c51f49889b7adcd48152b2a597f5da0aff3f3ef48f7203f5005df1afcaed33dec2

Download Submit
C:\Windows\System\thsdxkI.exe

Filesize
2.3MB

MD5
f729ae3cacd52d4fef1c457f997e8d83

SHA1
4d9b18839d4f95ca0ec11e5cda6bec9e13d6e453

SHA256
4904861f7494d9e3e4d3046c94d2c18264d7c4d15c3200db9947eb78fcbd4111

SHA512
62afd28db7d1bd35730efd8da1a30dfb77a995406db345c73ef2cb86c94ff8c4b22e46f789e1d18381a2a60d6757c7fd57fb4ff4485a33cc2c854cb4bba22a01

Download Submit
C:\Windows\System\uebOTlf.exe

Filesize
2.3MB

MD5
a7f74a9b3fe38ad0baebcda6d60ddbef

SHA1
506966588d9da0d9888d0e53628cc1605d8da9db

SHA256
7bf1390256c0af77d5f25fdfddbc8feab48921d7164f1c38ab26a1015989d8bb

SHA512
9a7f2935ce4e6f3864bfe09269f8f11c42579e063fed6ade304eafb1d4b51327d7f88f796e9609e73438003e60f8cb7c7f3ae6d9260dffe5fcd2554364ad8918

Download Submit
C:\Windows\System\vFUpuyE.exe

Filesize
2.3MB

MD5
6be3d2912e3ed2fcb170ba783fd80263

SHA1
b0f334288cf39528c3c9099841319dcaebb0102b

SHA256
8c821f8d3d873c00891bd4aba186001998b9f05a72a678a7ee31b95855b8beb7

SHA512
c9d758970b2c83b47c792225af02dd7432bf479dfb488dc6124e19f9236250740c962354729cc55fff9e4c9015d9048ebe541b1324360ae1915d20e4002f722c

Download Submit
C:\Windows\System\wJgpdCS.exe

Filesize
2.3MB

MD5
44708a19793502ef8d6eac29bf117c0d

SHA1
1fdba0674237616f0e1bcec44c936a6c98fc67b9

SHA256
8522e276d5ebd5b7b3393f13eecb242161335d63731be2d7c4755e39a00c0afe

SHA512
085a0564075a6067536f049ffe9f89a586eb25c3c8ba17a5cf75d21ea2ae3dcf9cc4db966d149c7a0e8e7ad6a2b46d4b99d5cd08a0604681217288120ee61c37

Download Submit
memory/680-211-0x00007FF7AECD0000-0x00007FF7AF024000-memory.dmp

Filesize
3.3MB

Download
memory/680-2124-0x00007FF7AECD0000-0x00007FF7AF024000-memory.dmp

Filesize
3.3MB

Download
memory/784-2117-0x00007FF727160000-0x00007FF7274B4000-memory.dmp

Filesize
3.3MB

Download
memory/784-110-0x00007FF727160000-0x00007FF7274B4000-memory.dmp

Filesize
3.3MB

Download
memory/852-199-0x00007FF689FD0000-0x00007FF68A324000-memory.dmp

Filesize
3.3MB

Download
memory/852-2120-0x00007FF689FD0000-0x00007FF68A324000-memory.dmp

Filesize
3.3MB

Download
memory/908-2106-0x00007FF680EC0000-0x00007FF681214000-memory.dmp

Filesize
3.3MB

Download
memory/908-61-0x00007FF680EC0000-0x00007FF681214000-memory.dmp

Filesize
3.3MB

Download
memory/1036-2108-0x00007FF7DB210000-0x00007FF7DB564000-memory.dmp

Filesize
3.3MB

Download
memory/1036-73-0x00007FF7DB210000-0x00007FF7DB564000-memory.dmp

Filesize
3.3MB

Download
memory/1188-2109-0x00007FF79DE50000-0x00007FF79E1A4000-memory.dmp

Filesize
3.3MB

Download
memory/1188-72-0x00007FF79DE50000-0x00007FF79E1A4000-memory.dmp

Filesize
3.3MB

Download
memory/1280-0-0x00007FF70BF90000-0x00007FF70C2E4000-memory.dmp

Filesize
3.3MB

Download
memory/1280-2098-0x00007FF70BF90000-0x00007FF70C2E4000-memory.dmp

Filesize
3.3MB

Download
memory/1280-1-0x0000020711EC0000-0x0000020711ED0000-memory.dmp

Filesize
64KB

Download
memory/1284-71-0x00007FF7A4A20000-0x00007FF7A4D74000-memory.dmp

Filesize
3.3MB

Download
memory/1284-2114-0x00007FF7A4A20000-0x00007FF7A4D74000-memory.dmp

Filesize
3.3MB

Download
memory/1472-229-0x00007FF626040000-0x00007FF626394000-memory.dmp

Filesize
3.3MB

Download
memory/1472-2121-0x00007FF626040000-0x00007FF626394000-memory.dmp

Filesize
3.3MB

Download
memory/1620-20-0x00007FF714A80000-0x00007FF714DD4000-memory.dmp

Filesize
3.3MB

Download
memory/1620-2105-0x00007FF714A80000-0x00007FF714DD4000-memory.dmp

Filesize
3.3MB

Download
memory/1620-2100-0x00007FF714A80000-0x00007FF714DD4000-memory.dmp

Filesize
3.3MB

Download
memory/1992-143-0x00007FF73EDE0000-0x00007FF73F134000-memory.dmp

Filesize
3.3MB

Download
memory/1992-2118-0x00007FF73EDE0000-0x00007FF73F134000-memory.dmp

Filesize
3.3MB

Download
memory/2084-2107-0x00007FF6170C0000-0x00007FF617414000-memory.dmp

Filesize
3.3MB

Download
memory/2084-41-0x00007FF6170C0000-0x00007FF617414000-memory.dmp

Filesize
3.3MB

Download
memory/2084-2101-0x00007FF6170C0000-0x00007FF617414000-memory.dmp

Filesize
3.3MB

Download
memory/2144-62-0x00007FF688610000-0x00007FF688964000-memory.dmp

Filesize
3.3MB

Download
memory/2144-2110-0x00007FF688610000-0x00007FF688964000-memory.dmp

Filesize
3.3MB

Download
memory/2292-266-0x00007FF7765A0000-0x00007FF7768F4000-memory.dmp

Filesize
3.3MB

Download
memory/2292-2128-0x00007FF7765A0000-0x00007FF7768F4000-memory.dmp

Filesize
3.3MB

Download
memory/2672-2113-0x00007FF625C00000-0x00007FF625F54000-memory.dmp

Filesize
3.3MB

Download
memory/2672-68-0x00007FF625C00000-0x00007FF625F54000-memory.dmp

Filesize
3.3MB

Download
memory/2960-2123-0x00007FF6F8480000-0x00007FF6F87D4000-memory.dmp

Filesize
3.3MB

Download
memory/2960-201-0x00007FF6F8480000-0x00007FF6F87D4000-memory.dmp

Filesize
3.3MB

Download
memory/3328-208-0x00007FF601A10000-0x00007FF601D64000-memory.dmp

Filesize
3.3MB

Download
memory/3328-2125-0x00007FF601A10000-0x00007FF601D64000-memory.dmp

Filesize
3.3MB

Download
memory/3456-2112-0x00007FF692B00000-0x00007FF692E54000-memory.dmp

Filesize
3.3MB

Download
memory/3456-74-0x00007FF692B00000-0x00007FF692E54000-memory.dmp

Filesize
3.3MB

Download
memory/3596-128-0x00007FF7742A0000-0x00007FF7745F4000-memory.dmp

Filesize
3.3MB

Download
memory/3596-2115-0x00007FF7742A0000-0x00007FF7745F4000-memory.dmp

Filesize
3.3MB

Download
memory/3616-2116-0x00007FF6E5490000-0x00007FF6E57E4000-memory.dmp

Filesize
3.3MB

Download
memory/3616-121-0x00007FF6E5490000-0x00007FF6E57E4000-memory.dmp

Filesize
3.3MB

Download
memory/3660-198-0x00007FF71E790000-0x00007FF71EAE4000-memory.dmp

Filesize
3.3MB

Download
memory/3660-2119-0x00007FF71E790000-0x00007FF71EAE4000-memory.dmp

Filesize
3.3MB

Download
memory/4076-214-0x00007FF6A9130000-0x00007FF6A9484000-memory.dmp

Filesize
3.3MB

Download
memory/4076-2129-0x00007FF6A9130000-0x00007FF6A9484000-memory.dmp

Filesize
3.3MB

Download
memory/4248-216-0x00007FF601410000-0x00007FF601764000-memory.dmp

Filesize
3.3MB

Download
memory/4248-2130-0x00007FF601410000-0x00007FF601764000-memory.dmp

Filesize
3.3MB

Download
memory/4292-2104-0x00007FF6ECDA0000-0x00007FF6ED0F4000-memory.dmp

Filesize
3.3MB

Download
memory/4292-2099-0x00007FF6ECDA0000-0x00007FF6ED0F4000-memory.dmp

Filesize
3.3MB

Download
memory/4292-15-0x00007FF6ECDA0000-0x00007FF6ED0F4000-memory.dmp

Filesize
3.3MB

Download
memory/4396-2103-0x00007FF716620000-0x00007FF716974000-memory.dmp

Filesize
3.3MB

Download
memory/4396-25-0x00007FF716620000-0x00007FF716974000-memory.dmp

Filesize
3.3MB

Download
memory/4516-2102-0x00007FF7FC780000-0x00007FF7FCAD4000-memory.dmp

Filesize
3.3MB

Download
memory/4516-2111-0x00007FF7FC780000-0x00007FF7FCAD4000-memory.dmp

Filesize
3.3MB

Download
memory/4516-51-0x00007FF7FC780000-0x00007FF7FCAD4000-memory.dmp

Filesize
3.3MB

Download
memory/4660-207-0x00007FF613E60000-0x00007FF6141B4000-memory.dmp

Filesize
3.3MB

Download
memory/4660-2122-0x00007FF613E60000-0x00007FF6141B4000-memory.dmp

Filesize
3.3MB

Download
memory/4744-2131-0x00007FF651BF0000-0x00007FF651F44000-memory.dmp

Filesize
3.3MB

Download
memory/4744-215-0x00007FF651BF0000-0x00007FF651F44000-memory.dmp

Filesize
3.3MB

Download
memory/5004-2126-0x00007FF7063B0000-0x00007FF706704000-memory.dmp

Filesize
3.3MB

Download
memory/5004-213-0x00007FF7063B0000-0x00007FF706704000-memory.dmp

Filesize
3.3MB

Download
memory/5008-2127-0x00007FF7CC350000-0x00007FF7CC6A4000-memory.dmp

Filesize
3.3MB

Download
memory/5008-212-0x00007FF7CC350000-0x00007FF7CC6A4000-memory.dmp

Filesize
3.3MB

Download