xmrig | 0ff5ed018f01e47dbe2a0bd1f9b3fd1913da2b794f684315e32a05637f9c89f9

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
Size

2.0MB
MD5

60750c313270f501fb39de0ba329a3d0
SHA1

3296b41629d145d9af9b9e2bbb43812f35e98a05
SHA256

0ff5ed018f01e47dbe2a0bd1f9b3fd1913da2b794f684315e32a05637f9c89f9
SHA512

9b459b2b08387a51d79f533cecdf3bfaea7d6caf0752d66b0ff8d88b4fa5d1aef1f440d58160b439cd51ea63d8c39585b767369518ea2f0657f020e953127677
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQOY2UrwUveex:oemTLkNdfE0pZrQl

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1572-0-0x00007FF729D10000-0x00007FF72A064000-memory.dmp	xmrig
behavioral2/files/0x0007000000023429-9.dat	xmrig
behavioral2/memory/4708-32-0x00007FF723510000-0x00007FF723864000-memory.dmp	xmrig
behavioral2/files/0x0007000000023432-65.dat	xmrig
behavioral2/files/0x0007000000023438-84.dat	xmrig
behavioral2/files/0x0007000000023439-87.dat	xmrig
behavioral2/files/0x0007000000023441-139.dat	xmrig
behavioral2/files/0x0007000000023449-173.dat	xmrig
behavioral2/memory/4948-184-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp	xmrig
behavioral2/memory/2940-196-0x00007FF7B8470000-0x00007FF7B87C4000-memory.dmp	xmrig
behavioral2/memory/3368-203-0x00007FF779520000-0x00007FF779874000-memory.dmp	xmrig
behavioral2/memory/4784-208-0x00007FF7ADB10000-0x00007FF7ADE64000-memory.dmp	xmrig
behavioral2/memory/724-212-0x00007FF7565C0000-0x00007FF756914000-memory.dmp	xmrig
behavioral2/memory/4432-211-0x00007FF65A350000-0x00007FF65A6A4000-memory.dmp	xmrig
behavioral2/memory/2872-210-0x00007FF77A9C0000-0x00007FF77AD14000-memory.dmp	xmrig
behavioral2/memory/2976-209-0x00007FF66D2C0000-0x00007FF66D614000-memory.dmp	xmrig
behavioral2/memory/1284-207-0x00007FF716040000-0x00007FF716394000-memory.dmp	xmrig
behavioral2/memory/1064-206-0x00007FF79D170000-0x00007FF79D4C4000-memory.dmp	xmrig
behavioral2/memory/1316-205-0x00007FF6CD0E0000-0x00007FF6CD434000-memory.dmp	xmrig
behavioral2/memory/4448-204-0x00007FF60FBB0000-0x00007FF60FF04000-memory.dmp	xmrig
behavioral2/memory/4468-202-0x00007FF601100000-0x00007FF601454000-memory.dmp	xmrig
behavioral2/memory/1812-201-0x00007FF608180000-0x00007FF6084D4000-memory.dmp	xmrig
behavioral2/memory/4168-200-0x00007FF754EB0000-0x00007FF755204000-memory.dmp	xmrig
behavioral2/memory/60-199-0x00007FF603250000-0x00007FF6035A4000-memory.dmp	xmrig
behavioral2/memory/868-191-0x00007FF654C60000-0x00007FF654FB4000-memory.dmp	xmrig
behavioral2/memory/3100-183-0x00007FF6524B0000-0x00007FF652804000-memory.dmp	xmrig
behavioral2/memory/2212-182-0x00007FF7B23B0000-0x00007FF7B2704000-memory.dmp	xmrig
behavioral2/files/0x000700000002344b-181.dat	xmrig
behavioral2/files/0x000700000002343f-179.dat	xmrig
behavioral2/files/0x000700000002344a-178.dat	xmrig
behavioral2/files/0x000700000002343a-175.dat	xmrig
behavioral2/files/0x0007000000023448-169.dat	xmrig
behavioral2/files/0x000700000002343e-165.dat	xmrig
behavioral2/files/0x0007000000023447-164.dat	xmrig
behavioral2/memory/2108-160-0x00007FF67ECC0000-0x00007FF67F014000-memory.dmp	xmrig
behavioral2/files/0x0007000000023446-159.dat	xmrig
behavioral2/files/0x000700000002343d-157.dat	xmrig
behavioral2/files/0x0007000000023445-156.dat	xmrig
behavioral2/files/0x0007000000023444-155.dat	xmrig
behavioral2/files/0x0007000000023443-154.dat	xmrig
behavioral2/files/0x000700000002343b-150.dat	xmrig
behavioral2/files/0x000700000002343c-148.dat	xmrig
behavioral2/files/0x0007000000023435-146.dat	xmrig
behavioral2/files/0x0007000000023442-144.dat	xmrig
behavioral2/files/0x0007000000023440-134.dat	xmrig
behavioral2/memory/1920-131-0x00007FF77F530000-0x00007FF77F884000-memory.dmp	xmrig
behavioral2/memory/4576-111-0x00007FF66B9D0000-0x00007FF66BD24000-memory.dmp	xmrig
behavioral2/memory/1572-2107-0x00007FF729D10000-0x00007FF72A064000-memory.dmp	xmrig
behavioral2/files/0x0007000000023437-103.dat	xmrig
behavioral2/files/0x0007000000023434-101.dat	xmrig
behavioral2/files/0x0007000000023436-100.dat	xmrig
behavioral2/memory/4292-92-0x00007FF79ED50000-0x00007FF79F0A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-98.dat	xmrig
behavioral2/memory/864-81-0x00007FF707720000-0x00007FF707A74000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-77.dat	xmrig
behavioral2/files/0x000700000002342e-76.dat	xmrig
behavioral2/files/0x0007000000023431-72.dat	xmrig
behavioral2/files/0x0007000000023428-61.dat	xmrig
behavioral2/files/0x000700000002342c-57.dat	xmrig
behavioral2/memory/2420-56-0x00007FF7C85F0000-0x00007FF7C8944000-memory.dmp	xmrig
behavioral2/memory/900-52-0x00007FF695630000-0x00007FF695984000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-50.dat	xmrig
behavioral2/files/0x000700000002342b-45.dat	xmrig
behavioral2/files/0x000700000002342d-40.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1356	SttQRKO.exe
900	xXIElkS.exe
1152	dwGSVOL.exe
2420	qgwoqFd.exe
4708	IjSqgFP.exe
1284	qAVDISH.exe
864	KPtvDGj.exe
4292	TuElClr.exe
4576	AqazKti.exe
1920	XfgXMeU.exe
4784	qfNJqJY.exe
2108	pUUVruC.exe
2212	rGQdeBK.exe
3100	pcQOwZv.exe
2976	XgVqudi.exe
4948	ojawFMz.exe
868	KqjDVVf.exe
2940	RhHGbeI.exe
60	sDGvsYz.exe
2872	ioQuYKH.exe
4168	yTJNJUQ.exe
1812	WOOAtmF.exe
4432	GrNqXAN.exe
4468	ohlwDPO.exe
3368	eYKWlCP.exe
4448	SgfCuxU.exe
724	jeRIJFq.exe
1316	TKeGgUH.exe
1064	uZDspsk.exe
3468	jPfhGlu.exe
976	MpbCVJB.exe
2688	OCvBDLB.exe
3676	XKuXOeW.exe
4996	cjgkQCA.exe
3924	HPbHYdC.exe
728	IlfrTiO.exe
1720	OgIyMdX.exe
4884	yToebEV.exe
1944	OKcgKKb.exe
2868	deAvKkG.exe
1500	ZzlFuTK.exe
3732	TRwNzNZ.exe
2004	FPzZrBs.exe
3628	njpVvFj.exe
3980	nRpEJmq.exe
3284	mPyACdH.exe
4396	GTexGbO.exe
4520	oRJaJcq.exe
1352	KWuYvJT.exe
3464	xaDZECy.exe
4152	nWbVZLf.exe
4260	mwtJIhg.exe
4240	eQdnUgo.exe
2860	LuLQJAA.exe
3412	FUqVxGA.exe
1896	vSVMQmw.exe
2732	oiPbGYJ.exe
1880	DKpIrvN.exe
3868	AZokHxN.exe
4444	aFNVtke.exe
3864	uIYyZqv.exe
4536	bxdxgGi.exe
3488	CJQOhjX.exe
3180	iPNOwtl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1572-0-0x00007FF729D10000-0x00007FF72A064000-memory.dmp	upx
behavioral2/files/0x0007000000023429-9.dat	upx
behavioral2/memory/4708-32-0x00007FF723510000-0x00007FF723864000-memory.dmp	upx
behavioral2/files/0x0007000000023432-65.dat	upx
behavioral2/files/0x0007000000023438-84.dat	upx
behavioral2/files/0x0007000000023439-87.dat	upx
behavioral2/files/0x0007000000023441-139.dat	upx
behavioral2/files/0x0007000000023449-173.dat	upx
behavioral2/memory/4948-184-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp	upx
behavioral2/memory/2940-196-0x00007FF7B8470000-0x00007FF7B87C4000-memory.dmp	upx
behavioral2/memory/3368-203-0x00007FF779520000-0x00007FF779874000-memory.dmp	upx
behavioral2/memory/4784-208-0x00007FF7ADB10000-0x00007FF7ADE64000-memory.dmp	upx
behavioral2/memory/724-212-0x00007FF7565C0000-0x00007FF756914000-memory.dmp	upx
behavioral2/memory/4432-211-0x00007FF65A350000-0x00007FF65A6A4000-memory.dmp	upx
behavioral2/memory/2872-210-0x00007FF77A9C0000-0x00007FF77AD14000-memory.dmp	upx
behavioral2/memory/2976-209-0x00007FF66D2C0000-0x00007FF66D614000-memory.dmp	upx
behavioral2/memory/1284-207-0x00007FF716040000-0x00007FF716394000-memory.dmp	upx
behavioral2/memory/1064-206-0x00007FF79D170000-0x00007FF79D4C4000-memory.dmp	upx
behavioral2/memory/1316-205-0x00007FF6CD0E0000-0x00007FF6CD434000-memory.dmp	upx
behavioral2/memory/4448-204-0x00007FF60FBB0000-0x00007FF60FF04000-memory.dmp	upx
behavioral2/memory/4468-202-0x00007FF601100000-0x00007FF601454000-memory.dmp	upx
behavioral2/memory/1812-201-0x00007FF608180000-0x00007FF6084D4000-memory.dmp	upx
behavioral2/memory/4168-200-0x00007FF754EB0000-0x00007FF755204000-memory.dmp	upx
behavioral2/memory/60-199-0x00007FF603250000-0x00007FF6035A4000-memory.dmp	upx
behavioral2/memory/868-191-0x00007FF654C60000-0x00007FF654FB4000-memory.dmp	upx
behavioral2/memory/3100-183-0x00007FF6524B0000-0x00007FF652804000-memory.dmp	upx
behavioral2/memory/2212-182-0x00007FF7B23B0000-0x00007FF7B2704000-memory.dmp	upx
behavioral2/files/0x000700000002344b-181.dat	upx
behavioral2/files/0x000700000002343f-179.dat	upx
behavioral2/files/0x000700000002344a-178.dat	upx
behavioral2/files/0x000700000002343a-175.dat	upx
behavioral2/files/0x0007000000023448-169.dat	upx
behavioral2/files/0x000700000002343e-165.dat	upx
behavioral2/files/0x0007000000023447-164.dat	upx
behavioral2/memory/2108-160-0x00007FF67ECC0000-0x00007FF67F014000-memory.dmp	upx
behavioral2/files/0x0007000000023446-159.dat	upx
behavioral2/files/0x000700000002343d-157.dat	upx
behavioral2/files/0x0007000000023445-156.dat	upx
behavioral2/files/0x0007000000023444-155.dat	upx
behavioral2/files/0x0007000000023443-154.dat	upx
behavioral2/files/0x000700000002343b-150.dat	upx
behavioral2/files/0x000700000002343c-148.dat	upx
behavioral2/files/0x0007000000023435-146.dat	upx
behavioral2/files/0x0007000000023442-144.dat	upx
behavioral2/files/0x0007000000023440-134.dat	upx
behavioral2/memory/1920-131-0x00007FF77F530000-0x00007FF77F884000-memory.dmp	upx
behavioral2/memory/4576-111-0x00007FF66B9D0000-0x00007FF66BD24000-memory.dmp	upx
behavioral2/memory/1572-2107-0x00007FF729D10000-0x00007FF72A064000-memory.dmp	upx
behavioral2/files/0x0007000000023437-103.dat	upx
behavioral2/files/0x0007000000023434-101.dat	upx
behavioral2/files/0x0007000000023436-100.dat	upx
behavioral2/memory/4292-92-0x00007FF79ED50000-0x00007FF79F0A4000-memory.dmp	upx
behavioral2/files/0x0007000000023433-98.dat	upx
behavioral2/memory/864-81-0x00007FF707720000-0x00007FF707A74000-memory.dmp	upx
behavioral2/files/0x000700000002342f-77.dat	upx
behavioral2/files/0x000700000002342e-76.dat	upx
behavioral2/files/0x0007000000023431-72.dat	upx
behavioral2/files/0x0007000000023428-61.dat	upx
behavioral2/files/0x000700000002342c-57.dat	upx
behavioral2/memory/2420-56-0x00007FF7C85F0000-0x00007FF7C8944000-memory.dmp	upx
behavioral2/memory/900-52-0x00007FF695630000-0x00007FF695984000-memory.dmp	upx
behavioral2/files/0x0007000000023430-50.dat	upx
behavioral2/files/0x000700000002342b-45.dat	upx
behavioral2/files/0x000700000002342d-40.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eNBFwCo.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\qxCUBDi.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\HFvwVuc.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\eQdnUgo.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\zZRfzDf.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\HtbxIvJ.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\tUuhrMB.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\wNsuxKY.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\juLUXFd.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\FElKkiu.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\UIXtxCf.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\LfhJiwR.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\sLaddLV.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\ldAISdl.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\njpVvFj.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\CIpgIMx.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\wjlwIVb.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\bXNTcQZ.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\pghQdYL.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\dbpsgdA.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\xnWSJVJ.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\gLQwsag.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\CzhxGWJ.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\EfyIzGf.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\DCRFfhF.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\faXNItH.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\jfHVmyO.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\KoMSaKi.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\CxPEbBV.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\oFwaisk.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\ICEfHJm.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\vToUCdY.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\jbRGlhY.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\zMifXwl.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\zssmkOR.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\EUrUhZS.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\CmWUOiS.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\igJwOtM.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\LcjdSkh.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\MpbCVJB.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\ectbfPQ.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\YnjlNgM.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\SKibiJp.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\FUqVxGA.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\BAoQpKQ.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\MymgXXF.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZqXEgYC.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZYIpxdg.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\qAVDISH.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\fIWmDWz.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\HtrenTQ.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\FVtgajd.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\aZSPDFj.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\BWHXApg.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\gETBbTi.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\cwOvWXh.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\apLtHjh.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\LDQrPqo.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\GLfFHhZ.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\ELtezhy.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\EXWfInZ.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\heBiBee.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\DOlTMpH.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
File created	C:\Windows\System\UEVdjbg.exe	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1356	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	83
PID 1572 wrote to memory of 1356	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	83
PID 1572 wrote to memory of 2420	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	84
PID 1572 wrote to memory of 2420	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	84
PID 1572 wrote to memory of 900	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	85
PID 1572 wrote to memory of 900	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	85
PID 1572 wrote to memory of 1152	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	86
PID 1572 wrote to memory of 1152	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	86
PID 1572 wrote to memory of 4708	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	87
PID 1572 wrote to memory of 4708	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	87
PID 1572 wrote to memory of 1284	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	88
PID 1572 wrote to memory of 1284	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	88
PID 1572 wrote to memory of 864	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	89
PID 1572 wrote to memory of 864	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	89
PID 1572 wrote to memory of 4292	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	90
PID 1572 wrote to memory of 4292	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	90
PID 1572 wrote to memory of 4576	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	91
PID 1572 wrote to memory of 4576	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	91
PID 1572 wrote to memory of 1920	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	92
PID 1572 wrote to memory of 1920	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	92
PID 1572 wrote to memory of 4784	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	93
PID 1572 wrote to memory of 4784	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	93
PID 1572 wrote to memory of 2108	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	94
PID 1572 wrote to memory of 2108	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	94
PID 1572 wrote to memory of 2212	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	95
PID 1572 wrote to memory of 2212	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	95
PID 1572 wrote to memory of 3100	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	96
PID 1572 wrote to memory of 3100	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	96
PID 1572 wrote to memory of 2940	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	97
PID 1572 wrote to memory of 2940	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	97
PID 1572 wrote to memory of 2976	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	98
PID 1572 wrote to memory of 2976	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	98
PID 1572 wrote to memory of 4948	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	99
PID 1572 wrote to memory of 4948	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	99
PID 1572 wrote to memory of 868	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	100
PID 1572 wrote to memory of 868	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	100
PID 1572 wrote to memory of 60	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	101
PID 1572 wrote to memory of 60	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	101
PID 1572 wrote to memory of 2872	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	102
PID 1572 wrote to memory of 2872	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	102
PID 1572 wrote to memory of 4168	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	103
PID 1572 wrote to memory of 4168	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	103
PID 1572 wrote to memory of 1812	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	104
PID 1572 wrote to memory of 1812	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	104
PID 1572 wrote to memory of 4432	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	105
PID 1572 wrote to memory of 4432	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	105
PID 1572 wrote to memory of 4468	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	106
PID 1572 wrote to memory of 4468	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	106
PID 1572 wrote to memory of 3368	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	107
PID 1572 wrote to memory of 3368	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	107
PID 1572 wrote to memory of 4448	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	108
PID 1572 wrote to memory of 4448	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	108
PID 1572 wrote to memory of 724	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	109
PID 1572 wrote to memory of 724	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	109
PID 1572 wrote to memory of 1316	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	110
PID 1572 wrote to memory of 1316	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	110
PID 1572 wrote to memory of 1064	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	111
PID 1572 wrote to memory of 1064	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	111
PID 1572 wrote to memory of 3468	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	112
PID 1572 wrote to memory of 3468	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	112
PID 1572 wrote to memory of 976	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	113
PID 1572 wrote to memory of 976	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	113
PID 1572 wrote to memory of 2688	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	114
PID 1572 wrote to memory of 2688	1572	60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\60750c313270f501fb39de0ba329a3d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\System\SttQRKO.exe
  C:\Windows\System\SttQRKO.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\qgwoqFd.exe
  C:\Windows\System\qgwoqFd.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\xXIElkS.exe
  C:\Windows\System\xXIElkS.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\dwGSVOL.exe
  C:\Windows\System\dwGSVOL.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\IjSqgFP.exe
  C:\Windows\System\IjSqgFP.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\qAVDISH.exe
  C:\Windows\System\qAVDISH.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\KPtvDGj.exe
  C:\Windows\System\KPtvDGj.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\TuElClr.exe
  C:\Windows\System\TuElClr.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\AqazKti.exe
  C:\Windows\System\AqazKti.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\XfgXMeU.exe
  C:\Windows\System\XfgXMeU.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\qfNJqJY.exe
  C:\Windows\System\qfNJqJY.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\pUUVruC.exe
  C:\Windows\System\pUUVruC.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\rGQdeBK.exe
  C:\Windows\System\rGQdeBK.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\pcQOwZv.exe
  C:\Windows\System\pcQOwZv.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\RhHGbeI.exe
  C:\Windows\System\RhHGbeI.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\XgVqudi.exe
  C:\Windows\System\XgVqudi.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\ojawFMz.exe
  C:\Windows\System\ojawFMz.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\KqjDVVf.exe
  C:\Windows\System\KqjDVVf.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\sDGvsYz.exe
  C:\Windows\System\sDGvsYz.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\ioQuYKH.exe
  C:\Windows\System\ioQuYKH.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\yTJNJUQ.exe
  C:\Windows\System\yTJNJUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\WOOAtmF.exe
  C:\Windows\System\WOOAtmF.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\GrNqXAN.exe
  C:\Windows\System\GrNqXAN.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\ohlwDPO.exe
  C:\Windows\System\ohlwDPO.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\eYKWlCP.exe
  C:\Windows\System\eYKWlCP.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\SgfCuxU.exe
  C:\Windows\System\SgfCuxU.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\jeRIJFq.exe
  C:\Windows\System\jeRIJFq.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\TKeGgUH.exe
  C:\Windows\System\TKeGgUH.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\uZDspsk.exe
  C:\Windows\System\uZDspsk.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\jPfhGlu.exe
  C:\Windows\System\jPfhGlu.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\MpbCVJB.exe
  C:\Windows\System\MpbCVJB.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\OCvBDLB.exe
  C:\Windows\System\OCvBDLB.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\XKuXOeW.exe
  C:\Windows\System\XKuXOeW.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\cjgkQCA.exe
  C:\Windows\System\cjgkQCA.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\HPbHYdC.exe
  C:\Windows\System\HPbHYdC.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\IlfrTiO.exe
  C:\Windows\System\IlfrTiO.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\OgIyMdX.exe
  C:\Windows\System\OgIyMdX.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\yToebEV.exe
  C:\Windows\System\yToebEV.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\OKcgKKb.exe
  C:\Windows\System\OKcgKKb.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\deAvKkG.exe
  C:\Windows\System\deAvKkG.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\ZzlFuTK.exe
  C:\Windows\System\ZzlFuTK.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\TRwNzNZ.exe
  C:\Windows\System\TRwNzNZ.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\FPzZrBs.exe
  C:\Windows\System\FPzZrBs.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\njpVvFj.exe
  C:\Windows\System\njpVvFj.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\nRpEJmq.exe
  C:\Windows\System\nRpEJmq.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\mPyACdH.exe
  C:\Windows\System\mPyACdH.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\GTexGbO.exe
  C:\Windows\System\GTexGbO.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\oRJaJcq.exe
  C:\Windows\System\oRJaJcq.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\KWuYvJT.exe
  C:\Windows\System\KWuYvJT.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\xaDZECy.exe
  C:\Windows\System\xaDZECy.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\nWbVZLf.exe
  C:\Windows\System\nWbVZLf.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\mwtJIhg.exe
  C:\Windows\System\mwtJIhg.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\eQdnUgo.exe
  C:\Windows\System\eQdnUgo.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\LuLQJAA.exe
  C:\Windows\System\LuLQJAA.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\FUqVxGA.exe
  C:\Windows\System\FUqVxGA.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\vSVMQmw.exe
  C:\Windows\System\vSVMQmw.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\oiPbGYJ.exe
  C:\Windows\System\oiPbGYJ.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\DKpIrvN.exe
  C:\Windows\System\DKpIrvN.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\AZokHxN.exe
  C:\Windows\System\AZokHxN.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\aFNVtke.exe
  C:\Windows\System\aFNVtke.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\uIYyZqv.exe
  C:\Windows\System\uIYyZqv.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\bxdxgGi.exe
  C:\Windows\System\bxdxgGi.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\CJQOhjX.exe
  C:\Windows\System\CJQOhjX.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\iPNOwtl.exe
  C:\Windows\System\iPNOwtl.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\fnJwWtF.exe
  C:\Windows\System\fnJwWtF.exe
  2⤵
  PID:1748
- C:\Windows\System\tmGtlNb.exe
  C:\Windows\System\tmGtlNb.exe
  2⤵
  PID:4296
- C:\Windows\System\vToUCdY.exe
  C:\Windows\System\vToUCdY.exe
  2⤵
  PID:2576
- C:\Windows\System\IPmjsSf.exe
  C:\Windows\System\IPmjsSf.exe
  2⤵
  PID:452
- C:\Windows\System\ZWPDvWJ.exe
  C:\Windows\System\ZWPDvWJ.exe
  2⤵
  PID:2292
- C:\Windows\System\AScJhxC.exe
  C:\Windows\System\AScJhxC.exe
  2⤵
  PID:5100
- C:\Windows\System\fFtsHxv.exe
  C:\Windows\System\fFtsHxv.exe
  2⤵
  PID:4332
- C:\Windows\System\xQANgTu.exe
  C:\Windows\System\xQANgTu.exe
  2⤵
  PID:1248
- C:\Windows\System\CiGTllq.exe
  C:\Windows\System\CiGTllq.exe
  2⤵
  PID:4220
- C:\Windows\System\rrMhvzi.exe
  C:\Windows\System\rrMhvzi.exe
  2⤵
  PID:3012
- C:\Windows\System\DxtRafp.exe
  C:\Windows\System\DxtRafp.exe
  2⤵
  PID:1884
- C:\Windows\System\OViWVnJ.exe
  C:\Windows\System\OViWVnJ.exe
  2⤵
  PID:2240
- C:\Windows\System\tiUZGdU.exe
  C:\Windows\System\tiUZGdU.exe
  2⤵
  PID:2912
- C:\Windows\System\OEqaQAH.exe
  C:\Windows\System\OEqaQAH.exe
  2⤵
  PID:2440
- C:\Windows\System\IbtImOs.exe
  C:\Windows\System\IbtImOs.exe
  2⤵
  PID:2668
- C:\Windows\System\hCDoUNK.exe
  C:\Windows\System\hCDoUNK.exe
  2⤵
  PID:2880
- C:\Windows\System\EnRNTXA.exe
  C:\Windows\System\EnRNTXA.exe
  2⤵
  PID:1348
- C:\Windows\System\xoMyMsN.exe
  C:\Windows\System\xoMyMsN.exe
  2⤵
  PID:4012
- C:\Windows\System\QSwfPqM.exe
  C:\Windows\System\QSwfPqM.exe
  2⤵
  PID:1980
- C:\Windows\System\jbRGlhY.exe
  C:\Windows\System\jbRGlhY.exe
  2⤵
  PID:2228
- C:\Windows\System\elooXeU.exe
  C:\Windows\System\elooXeU.exe
  2⤵
  PID:4680
- C:\Windows\System\HysOiwr.exe
  C:\Windows\System\HysOiwr.exe
  2⤵
  PID:1184
- C:\Windows\System\bXNTcQZ.exe
  C:\Windows\System\bXNTcQZ.exe
  2⤵
  PID:1960
- C:\Windows\System\BHYGdzt.exe
  C:\Windows\System\BHYGdzt.exe
  2⤵
  PID:4780
- C:\Windows\System\wwJztUg.exe
  C:\Windows\System\wwJztUg.exe
  2⤵
  PID:2320
- C:\Windows\System\Teobjtf.exe
  C:\Windows\System\Teobjtf.exe
  2⤵
  PID:3200
- C:\Windows\System\kdJHuDT.exe
  C:\Windows\System\kdJHuDT.exe
  2⤵
  PID:3144
- C:\Windows\System\cCkkyMn.exe
  C:\Windows\System\cCkkyMn.exe
  2⤵
  PID:852
- C:\Windows\System\HhOASbX.exe
  C:\Windows\System\HhOASbX.exe
  2⤵
  PID:3456
- C:\Windows\System\sKtibOX.exe
  C:\Windows\System\sKtibOX.exe
  2⤵
  PID:1760
- C:\Windows\System\POvFAZc.exe
  C:\Windows\System\POvFAZc.exe
  2⤵
  PID:4980
- C:\Windows\System\faXNItH.exe
  C:\Windows\System\faXNItH.exe
  2⤵
  PID:3216
- C:\Windows\System\hqptiHl.exe
  C:\Windows\System\hqptiHl.exe
  2⤵
  PID:3192
- C:\Windows\System\tsrMVWT.exe
  C:\Windows\System\tsrMVWT.exe
  2⤵
  PID:2932
- C:\Windows\System\LngRACO.exe
  C:\Windows\System\LngRACO.exe
  2⤵
  PID:3532
- C:\Windows\System\LlnvslG.exe
  C:\Windows\System\LlnvslG.exe
  2⤵
  PID:384
- C:\Windows\System\iPwUonM.exe
  C:\Windows\System\iPwUonM.exe
  2⤵
  PID:5148
- C:\Windows\System\xnWSJVJ.exe
  C:\Windows\System\xnWSJVJ.exe
  2⤵
  PID:5168
- C:\Windows\System\psuNOmZ.exe
  C:\Windows\System\psuNOmZ.exe
  2⤵
  PID:5200
- C:\Windows\System\BLAGTFL.exe
  C:\Windows\System\BLAGTFL.exe
  2⤵
  PID:5232
- C:\Windows\System\JfbJUYq.exe
  C:\Windows\System\JfbJUYq.exe
  2⤵
  PID:5268
- C:\Windows\System\OKTUAzT.exe
  C:\Windows\System\OKTUAzT.exe
  2⤵
  PID:5296
- C:\Windows\System\ethenBY.exe
  C:\Windows\System\ethenBY.exe
  2⤵
  PID:5324
- C:\Windows\System\qjImccF.exe
  C:\Windows\System\qjImccF.exe
  2⤵
  PID:5352
- C:\Windows\System\ybVcUaW.exe
  C:\Windows\System\ybVcUaW.exe
  2⤵
  PID:5380
- C:\Windows\System\eKhUCIy.exe
  C:\Windows\System\eKhUCIy.exe
  2⤵
  PID:5408
- C:\Windows\System\WPjNTtP.exe
  C:\Windows\System\WPjNTtP.exe
  2⤵
  PID:5436
- C:\Windows\System\ObpxcmV.exe
  C:\Windows\System\ObpxcmV.exe
  2⤵
  PID:5472
- C:\Windows\System\ffEGTiF.exe
  C:\Windows\System\ffEGTiF.exe
  2⤵
  PID:5496
- C:\Windows\System\SMpvCRF.exe
  C:\Windows\System\SMpvCRF.exe
  2⤵
  PID:5528
- C:\Windows\System\OQZofRB.exe
  C:\Windows\System\OQZofRB.exe
  2⤵
  PID:5556
- C:\Windows\System\zlZnrTt.exe
  C:\Windows\System\zlZnrTt.exe
  2⤵
  PID:5584
- C:\Windows\System\ZjOrPzU.exe
  C:\Windows\System\ZjOrPzU.exe
  2⤵
  PID:5612
- C:\Windows\System\pQUwvNT.exe
  C:\Windows\System\pQUwvNT.exe
  2⤵
  PID:5640
- C:\Windows\System\BVGmCjq.exe
  C:\Windows\System\BVGmCjq.exe
  2⤵
  PID:5672
- C:\Windows\System\vvdONCQ.exe
  C:\Windows\System\vvdONCQ.exe
  2⤵
  PID:5700
- C:\Windows\System\pNUAhmJ.exe
  C:\Windows\System\pNUAhmJ.exe
  2⤵
  PID:5728
- C:\Windows\System\ksczdZL.exe
  C:\Windows\System\ksczdZL.exe
  2⤵
  PID:5756
- C:\Windows\System\FJaENoF.exe
  C:\Windows\System\FJaENoF.exe
  2⤵
  PID:5772
- C:\Windows\System\ipArIsE.exe
  C:\Windows\System\ipArIsE.exe
  2⤵
  PID:5788
- C:\Windows\System\tGvJoMz.exe
  C:\Windows\System\tGvJoMz.exe
  2⤵
  PID:5804
- C:\Windows\System\vHxqlTd.exe
  C:\Windows\System\vHxqlTd.exe
  2⤵
  PID:5824
- C:\Windows\System\Osgjqtk.exe
  C:\Windows\System\Osgjqtk.exe
  2⤵
  PID:5852
- C:\Windows\System\mwnnvdP.exe
  C:\Windows\System\mwnnvdP.exe
  2⤵
  PID:5884
- C:\Windows\System\tdLdUcA.exe
  C:\Windows\System\tdLdUcA.exe
  2⤵
  PID:5924
- C:\Windows\System\PGBgNcL.exe
  C:\Windows\System\PGBgNcL.exe
  2⤵
  PID:5960
- C:\Windows\System\GZJdRBa.exe
  C:\Windows\System\GZJdRBa.exe
  2⤵
  PID:5992
- C:\Windows\System\hhheksg.exe
  C:\Windows\System\hhheksg.exe
  2⤵
  PID:6032
- C:\Windows\System\hjdyjlV.exe
  C:\Windows\System\hjdyjlV.exe
  2⤵
  PID:6068
- C:\Windows\System\EsKXxYy.exe
  C:\Windows\System\EsKXxYy.exe
  2⤵
  PID:6088
- C:\Windows\System\VDvZXdw.exe
  C:\Windows\System\VDvZXdw.exe
  2⤵
  PID:6108
- C:\Windows\System\GDJTQkB.exe
  C:\Windows\System\GDJTQkB.exe
  2⤵
  PID:6140
- C:\Windows\System\YmFbHjc.exe
  C:\Windows\System\YmFbHjc.exe
  2⤵
  PID:5160
- C:\Windows\System\qFRlMTT.exe
  C:\Windows\System\qFRlMTT.exe
  2⤵
  PID:5216
- C:\Windows\System\zMifXwl.exe
  C:\Windows\System\zMifXwl.exe
  2⤵
  PID:5292
- C:\Windows\System\kFbUSOK.exe
  C:\Windows\System\kFbUSOK.exe
  2⤵
  PID:5376
- C:\Windows\System\eHNoIYm.exe
  C:\Windows\System\eHNoIYm.exe
  2⤵
  PID:5432
- C:\Windows\System\BWHXApg.exe
  C:\Windows\System\BWHXApg.exe
  2⤵
  PID:5508
- C:\Windows\System\RVpndWS.exe
  C:\Windows\System\RVpndWS.exe
  2⤵
  PID:5580
- C:\Windows\System\jslZgNE.exe
  C:\Windows\System\jslZgNE.exe
  2⤵
  PID:4064
- C:\Windows\System\mquhgHf.exe
  C:\Windows\System\mquhgHf.exe
  2⤵
  PID:5692
- C:\Windows\System\EcWANth.exe
  C:\Windows\System\EcWANth.exe
  2⤵
  PID:5752
- C:\Windows\System\wSSgQLL.exe
  C:\Windows\System\wSSgQLL.exe
  2⤵
  PID:5784
- C:\Windows\System\UdViuJG.exe
  C:\Windows\System\UdViuJG.exe
  2⤵
  PID:5864
- C:\Windows\System\pxwZzDX.exe
  C:\Windows\System\pxwZzDX.exe
  2⤵
  PID:5880
- C:\Windows\System\GRIcWji.exe
  C:\Windows\System\GRIcWji.exe
  2⤵
  PID:6004
- C:\Windows\System\qYDppiP.exe
  C:\Windows\System\qYDppiP.exe
  2⤵
  PID:6060
- C:\Windows\System\DyEzRbj.exe
  C:\Windows\System\DyEzRbj.exe
  2⤵
  PID:6136
- C:\Windows\System\jPogIbi.exe
  C:\Windows\System\jPogIbi.exe
  2⤵
  PID:5280
- C:\Windows\System\XQlTpNl.exe
  C:\Windows\System\XQlTpNl.exe
  2⤵
  PID:5464
- C:\Windows\System\GBScAEL.exe
  C:\Windows\System\GBScAEL.exe
  2⤵
  PID:5632
- C:\Windows\System\fhYCJII.exe
  C:\Windows\System\fhYCJII.exe
  2⤵
  PID:5812
- C:\Windows\System\ZeJdcpY.exe
  C:\Windows\System\ZeJdcpY.exe
  2⤵
  PID:5948
- C:\Windows\System\YcJognI.exe
  C:\Windows\System\YcJognI.exe
  2⤵
  PID:6104
- C:\Windows\System\juLUXFd.exe
  C:\Windows\System\juLUXFd.exe
  2⤵
  PID:5780
- C:\Windows\System\osMzgDU.exe
  C:\Windows\System\osMzgDU.exe
  2⤵
  PID:5212
- C:\Windows\System\kMHPNhl.exe
  C:\Windows\System\kMHPNhl.exe
  2⤵
  PID:3604
- C:\Windows\System\tXaaAAR.exe
  C:\Windows\System\tXaaAAR.exe
  2⤵
  PID:948
- C:\Windows\System\DvpmKOI.exe
  C:\Windows\System\DvpmKOI.exe
  2⤵
  PID:524
- C:\Windows\System\IlJrKSr.exe
  C:\Windows\System\IlJrKSr.exe
  2⤵
  PID:6160
- C:\Windows\System\eoAVhUw.exe
  C:\Windows\System\eoAVhUw.exe
  2⤵
  PID:6188
- C:\Windows\System\BNYGrqp.exe
  C:\Windows\System\BNYGrqp.exe
  2⤵
  PID:6216
- C:\Windows\System\PxVKCLB.exe
  C:\Windows\System\PxVKCLB.exe
  2⤵
  PID:6248
- C:\Windows\System\QkVjdqT.exe
  C:\Windows\System\QkVjdqT.exe
  2⤵
  PID:6288
- C:\Windows\System\jfHVmyO.exe
  C:\Windows\System\jfHVmyO.exe
  2⤵
  PID:6320
- C:\Windows\System\qsjBCVf.exe
  C:\Windows\System\qsjBCVf.exe
  2⤵
  PID:6364
- C:\Windows\System\mZooRQn.exe
  C:\Windows\System\mZooRQn.exe
  2⤵
  PID:6400
- C:\Windows\System\HnCfKzA.exe
  C:\Windows\System\HnCfKzA.exe
  2⤵
  PID:6432
- C:\Windows\System\ZCquEEN.exe
  C:\Windows\System\ZCquEEN.exe
  2⤵
  PID:6452
- C:\Windows\System\kBApuhe.exe
  C:\Windows\System\kBApuhe.exe
  2⤵
  PID:6480
- C:\Windows\System\oCrGQIN.exe
  C:\Windows\System\oCrGQIN.exe
  2⤵
  PID:6516
- C:\Windows\System\UOtLJLa.exe
  C:\Windows\System\UOtLJLa.exe
  2⤵
  PID:6544
- C:\Windows\System\OIJtGZI.exe
  C:\Windows\System\OIJtGZI.exe
  2⤵
  PID:6572
- C:\Windows\System\SGvglay.exe
  C:\Windows\System\SGvglay.exe
  2⤵
  PID:6600
- C:\Windows\System\AWcZPCd.exe
  C:\Windows\System\AWcZPCd.exe
  2⤵
  PID:6632
- C:\Windows\System\CogxKxb.exe
  C:\Windows\System\CogxKxb.exe
  2⤵
  PID:6648
- C:\Windows\System\sLBxXmi.exe
  C:\Windows\System\sLBxXmi.exe
  2⤵
  PID:6680
- C:\Windows\System\oIwgpHS.exe
  C:\Windows\System\oIwgpHS.exe
  2⤵
  PID:6708
- C:\Windows\System\XMSofOy.exe
  C:\Windows\System\XMSofOy.exe
  2⤵
  PID:6736
- C:\Windows\System\eNBFwCo.exe
  C:\Windows\System\eNBFwCo.exe
  2⤵
  PID:6772
- C:\Windows\System\zssmkOR.exe
  C:\Windows\System\zssmkOR.exe
  2⤵
  PID:6804
- C:\Windows\System\gLQwsag.exe
  C:\Windows\System\gLQwsag.exe
  2⤵
  PID:6832
- C:\Windows\System\qCunkiN.exe
  C:\Windows\System\qCunkiN.exe
  2⤵
  PID:6868
- C:\Windows\System\DHaKaoj.exe
  C:\Windows\System\DHaKaoj.exe
  2⤵
  PID:6896
- C:\Windows\System\UeDtNNN.exe
  C:\Windows\System\UeDtNNN.exe
  2⤵
  PID:6924
- C:\Windows\System\FIXsltt.exe
  C:\Windows\System\FIXsltt.exe
  2⤵
  PID:6944
- C:\Windows\System\XlPrXZo.exe
  C:\Windows\System\XlPrXZo.exe
  2⤵
  PID:6980
- C:\Windows\System\nOeePdf.exe
  C:\Windows\System\nOeePdf.exe
  2⤵
  PID:7008
- C:\Windows\System\tBtBBFE.exe
  C:\Windows\System\tBtBBFE.exe
  2⤵
  PID:7036
- C:\Windows\System\uHACrCe.exe
  C:\Windows\System\uHACrCe.exe
  2⤵
  PID:7064
- C:\Windows\System\EUrUhZS.exe
  C:\Windows\System\EUrUhZS.exe
  2⤵
  PID:7080
- C:\Windows\System\zenYnnd.exe
  C:\Windows\System\zenYnnd.exe
  2⤵
  PID:7112
- C:\Windows\System\lMXgBso.exe
  C:\Windows\System\lMXgBso.exe
  2⤵
  PID:7144
- C:\Windows\System\hoThUUG.exe
  C:\Windows\System\hoThUUG.exe
  2⤵
  PID:2216
- C:\Windows\System\dvsOHri.exe
  C:\Windows\System\dvsOHri.exe
  2⤵
  PID:6176
- C:\Windows\System\bTqzZsh.exe
  C:\Windows\System\bTqzZsh.exe
  2⤵
  PID:6244
- C:\Windows\System\pZTDNmG.exe
  C:\Windows\System\pZTDNmG.exe
  2⤵
  PID:6352
- C:\Windows\System\ZXPLrCT.exe
  C:\Windows\System\ZXPLrCT.exe
  2⤵
  PID:6420
- C:\Windows\System\fUoTSMP.exe
  C:\Windows\System\fUoTSMP.exe
  2⤵
  PID:6504
- C:\Windows\System\QRmVXrX.exe
  C:\Windows\System\QRmVXrX.exe
  2⤵
  PID:6584
- C:\Windows\System\PomFQGu.exe
  C:\Windows\System\PomFQGu.exe
  2⤵
  PID:6640
- C:\Windows\System\GcDrTSe.exe
  C:\Windows\System\GcDrTSe.exe
  2⤵
  PID:6748
- C:\Windows\System\fKdCvEc.exe
  C:\Windows\System\fKdCvEc.exe
  2⤵
  PID:6816
- C:\Windows\System\ITALycl.exe
  C:\Windows\System\ITALycl.exe
  2⤵
  PID:6860
- C:\Windows\System\aoKhFMa.exe
  C:\Windows\System\aoKhFMa.exe
  2⤵
  PID:6916
- C:\Windows\System\GRUEHyM.exe
  C:\Windows\System\GRUEHyM.exe
  2⤵
  PID:6992
- C:\Windows\System\wYVoLwQ.exe
  C:\Windows\System\wYVoLwQ.exe
  2⤵
  PID:7072
- C:\Windows\System\YmHKjGB.exe
  C:\Windows\System\YmHKjGB.exe
  2⤵
  PID:7160
- C:\Windows\System\fhowwsY.exe
  C:\Windows\System\fhowwsY.exe
  2⤵
  PID:2580
- C:\Windows\System\vfsGNcG.exe
  C:\Windows\System\vfsGNcG.exe
  2⤵
  PID:6472
- C:\Windows\System\PPgPdxg.exe
  C:\Windows\System\PPgPdxg.exe
  2⤵
  PID:6672
- C:\Windows\System\Ejsqvmv.exe
  C:\Windows\System\Ejsqvmv.exe
  2⤵
  PID:6888
- C:\Windows\System\UEVdjbg.exe
  C:\Windows\System\UEVdjbg.exe
  2⤵
  PID:7124
- C:\Windows\System\vwfhpMt.exe
  C:\Windows\System\vwfhpMt.exe
  2⤵
  PID:6284
- C:\Windows\System\zDocAEK.exe
  C:\Windows\System\zDocAEK.exe
  2⤵
  PID:6920
- C:\Windows\System\rbvlfhR.exe
  C:\Windows\System\rbvlfhR.exe
  2⤵
  PID:6768
- C:\Windows\System\hUeNIev.exe
  C:\Windows\System\hUeNIev.exe
  2⤵
  PID:7204
- C:\Windows\System\FElKkiu.exe
  C:\Windows\System\FElKkiu.exe
  2⤵
  PID:7244
- C:\Windows\System\FxYShbq.exe
  C:\Windows\System\FxYShbq.exe
  2⤵
  PID:7272
- C:\Windows\System\gzlrwDT.exe
  C:\Windows\System\gzlrwDT.exe
  2⤵
  PID:7300
- C:\Windows\System\JasukhR.exe
  C:\Windows\System\JasukhR.exe
  2⤵
  PID:7336
- C:\Windows\System\heBiBee.exe
  C:\Windows\System\heBiBee.exe
  2⤵
  PID:7372
- C:\Windows\System\zIDkRBW.exe
  C:\Windows\System\zIDkRBW.exe
  2⤵
  PID:7408
- C:\Windows\System\PcSTiTV.exe
  C:\Windows\System\PcSTiTV.exe
  2⤵
  PID:7436
- C:\Windows\System\BSQDkkq.exe
  C:\Windows\System\BSQDkkq.exe
  2⤵
  PID:7472
- C:\Windows\System\XzzqxdC.exe
  C:\Windows\System\XzzqxdC.exe
  2⤵
  PID:7508
- C:\Windows\System\pdMDWVp.exe
  C:\Windows\System\pdMDWVp.exe
  2⤵
  PID:7552
- C:\Windows\System\DrHWVqh.exe
  C:\Windows\System\DrHWVqh.exe
  2⤵
  PID:7588
- C:\Windows\System\iOxhUqq.exe
  C:\Windows\System\iOxhUqq.exe
  2⤵
  PID:7620
- C:\Windows\System\knHwByC.exe
  C:\Windows\System\knHwByC.exe
  2⤵
  PID:7652
- C:\Windows\System\GWgddVo.exe
  C:\Windows\System\GWgddVo.exe
  2⤵
  PID:7680
- C:\Windows\System\umDBHMT.exe
  C:\Windows\System\umDBHMT.exe
  2⤵
  PID:7708
- C:\Windows\System\EuEuWie.exe
  C:\Windows\System\EuEuWie.exe
  2⤵
  PID:7728
- C:\Windows\System\HioGtfi.exe
  C:\Windows\System\HioGtfi.exe
  2⤵
  PID:7748
- C:\Windows\System\rhqncUH.exe
  C:\Windows\System\rhqncUH.exe
  2⤵
  PID:7768
- C:\Windows\System\FSymfsj.exe
  C:\Windows\System\FSymfsj.exe
  2⤵
  PID:7800
- C:\Windows\System\GEkzBsf.exe
  C:\Windows\System\GEkzBsf.exe
  2⤵
  PID:7820
- C:\Windows\System\qJqDamW.exe
  C:\Windows\System\qJqDamW.exe
  2⤵
  PID:7848
- C:\Windows\System\pyjAEts.exe
  C:\Windows\System\pyjAEts.exe
  2⤵
  PID:7872
- C:\Windows\System\CDqYltC.exe
  C:\Windows\System\CDqYltC.exe
  2⤵
  PID:7904
- C:\Windows\System\XcjJBUP.exe
  C:\Windows\System\XcjJBUP.exe
  2⤵
  PID:7936
- C:\Windows\System\ZwnYPae.exe
  C:\Windows\System\ZwnYPae.exe
  2⤵
  PID:7956
- C:\Windows\System\qrEGvJu.exe
  C:\Windows\System\qrEGvJu.exe
  2⤵
  PID:7980
- C:\Windows\System\RshHwsN.exe
  C:\Windows\System\RshHwsN.exe
  2⤵
  PID:8024
- C:\Windows\System\LVPDTuh.exe
  C:\Windows\System\LVPDTuh.exe
  2⤵
  PID:8056
- C:\Windows\System\UMgyVXo.exe
  C:\Windows\System\UMgyVXo.exe
  2⤵
  PID:8092
- C:\Windows\System\fkCLlkL.exe
  C:\Windows\System\fkCLlkL.exe
  2⤵
  PID:8124
- C:\Windows\System\rFuMsuf.exe
  C:\Windows\System\rFuMsuf.exe
  2⤵
  PID:8152
- C:\Windows\System\brckEOq.exe
  C:\Windows\System\brckEOq.exe
  2⤵
  PID:8184
- C:\Windows\System\VoDyJgJ.exe
  C:\Windows\System\VoDyJgJ.exe
  2⤵
  PID:7212
- C:\Windows\System\RtAkPxK.exe
  C:\Windows\System\RtAkPxK.exe
  2⤵
  PID:7292
- C:\Windows\System\XCxcVjq.exe
  C:\Windows\System\XCxcVjq.exe
  2⤵
  PID:7360
- C:\Windows\System\rhdGCnk.exe
  C:\Windows\System\rhdGCnk.exe
  2⤵
  PID:7468
- C:\Windows\System\YsYtCEU.exe
  C:\Windows\System\YsYtCEU.exe
  2⤵
  PID:7540
- C:\Windows\System\dolejDg.exe
  C:\Windows\System\dolejDg.exe
  2⤵
  PID:7636
- C:\Windows\System\KKXuVCv.exe
  C:\Windows\System\KKXuVCv.exe
  2⤵
  PID:7692
- C:\Windows\System\YuagxNe.exe
  C:\Windows\System\YuagxNe.exe
  2⤵
  PID:7780
- C:\Windows\System\HfSXQWz.exe
  C:\Windows\System\HfSXQWz.exe
  2⤵
  PID:7812
- C:\Windows\System\HnYLCmM.exe
  C:\Windows\System\HnYLCmM.exe
  2⤵
  PID:7920
- C:\Windows\System\gwMtrXZ.exe
  C:\Windows\System\gwMtrXZ.exe
  2⤵
  PID:7996
- C:\Windows\System\HvnDDml.exe
  C:\Windows\System\HvnDDml.exe
  2⤵
  PID:8048
- C:\Windows\System\kLJgcUR.exe
  C:\Windows\System\kLJgcUR.exe
  2⤵
  PID:8108
- C:\Windows\System\TOShyjv.exe
  C:\Windows\System\TOShyjv.exe
  2⤵
  PID:7240
- C:\Windows\System\ufMDswZ.exe
  C:\Windows\System\ufMDswZ.exe
  2⤵
  PID:7444
- C:\Windows\System\EzIIFzh.exe
  C:\Windows\System\EzIIFzh.exe
  2⤵
  PID:7664
- C:\Windows\System\QylIqkI.exe
  C:\Windows\System\QylIqkI.exe
  2⤵
  PID:6512
- C:\Windows\System\nfaBNSa.exe
  C:\Windows\System\nfaBNSa.exe
  2⤵
  PID:7968
- C:\Windows\System\BAoQpKQ.exe
  C:\Windows\System\BAoQpKQ.exe
  2⤵
  PID:6416
- C:\Windows\System\zqBmyqx.exe
  C:\Windows\System\zqBmyqx.exe
  2⤵
  PID:7604
- C:\Windows\System\UvUFzyF.exe
  C:\Windows\System\UvUFzyF.exe
  2⤵
  PID:7916
- C:\Windows\System\DOhqLHM.exe
  C:\Windows\System\DOhqLHM.exe
  2⤵
  PID:7704
- C:\Windows\System\BuAegEw.exe
  C:\Windows\System\BuAegEw.exe
  2⤵
  PID:7404
- C:\Windows\System\CDCJnjR.exe
  C:\Windows\System\CDCJnjR.exe
  2⤵
  PID:8216
- C:\Windows\System\BINAZKa.exe
  C:\Windows\System\BINAZKa.exe
  2⤵
  PID:8244
- C:\Windows\System\VVvJhFH.exe
  C:\Windows\System\VVvJhFH.exe
  2⤵
  PID:8272
- C:\Windows\System\IwxqywK.exe
  C:\Windows\System\IwxqywK.exe
  2⤵
  PID:8296
- C:\Windows\System\qtZnlYn.exe
  C:\Windows\System\qtZnlYn.exe
  2⤵
  PID:8328
- C:\Windows\System\atmVrvM.exe
  C:\Windows\System\atmVrvM.exe
  2⤵
  PID:8356
- C:\Windows\System\PGiRyLr.exe
  C:\Windows\System\PGiRyLr.exe
  2⤵
  PID:8384
- C:\Windows\System\pghQdYL.exe
  C:\Windows\System\pghQdYL.exe
  2⤵
  PID:8412
- C:\Windows\System\SnfmdKy.exe
  C:\Windows\System\SnfmdKy.exe
  2⤵
  PID:8440
- C:\Windows\System\DoqcMBl.exe
  C:\Windows\System\DoqcMBl.exe
  2⤵
  PID:8468
- C:\Windows\System\UDtVjSs.exe
  C:\Windows\System\UDtVjSs.exe
  2⤵
  PID:8496
- C:\Windows\System\sLmdfHm.exe
  C:\Windows\System\sLmdfHm.exe
  2⤵
  PID:8524
- C:\Windows\System\zjvtPhe.exe
  C:\Windows\System\zjvtPhe.exe
  2⤵
  PID:8552
- C:\Windows\System\hiSZfPx.exe
  C:\Windows\System\hiSZfPx.exe
  2⤵
  PID:8580
- C:\Windows\System\Kzmphfe.exe
  C:\Windows\System\Kzmphfe.exe
  2⤵
  PID:8608
- C:\Windows\System\kKCkXhn.exe
  C:\Windows\System\kKCkXhn.exe
  2⤵
  PID:8636
- C:\Windows\System\QFSAorv.exe
  C:\Windows\System\QFSAorv.exe
  2⤵
  PID:8664
- C:\Windows\System\ugOSaBP.exe
  C:\Windows\System\ugOSaBP.exe
  2⤵
  PID:8692
- C:\Windows\System\yopMJlF.exe
  C:\Windows\System\yopMJlF.exe
  2⤵
  PID:8716
- C:\Windows\System\KrBwjhZ.exe
  C:\Windows\System\KrBwjhZ.exe
  2⤵
  PID:8748
- C:\Windows\System\ffbhBmz.exe
  C:\Windows\System\ffbhBmz.exe
  2⤵
  PID:8776
- C:\Windows\System\LvDiGyE.exe
  C:\Windows\System\LvDiGyE.exe
  2⤵
  PID:8804
- C:\Windows\System\eUxBaOw.exe
  C:\Windows\System\eUxBaOw.exe
  2⤵
  PID:8832
- C:\Windows\System\fIWmDWz.exe
  C:\Windows\System\fIWmDWz.exe
  2⤵
  PID:8860
- C:\Windows\System\SYqAmrG.exe
  C:\Windows\System\SYqAmrG.exe
  2⤵
  PID:8888
- C:\Windows\System\czEvQOq.exe
  C:\Windows\System\czEvQOq.exe
  2⤵
  PID:8916
- C:\Windows\System\YzfQcCm.exe
  C:\Windows\System\YzfQcCm.exe
  2⤵
  PID:8944
- C:\Windows\System\eXkUjvZ.exe
  C:\Windows\System\eXkUjvZ.exe
  2⤵
  PID:8980
- C:\Windows\System\AeKOIdb.exe
  C:\Windows\System\AeKOIdb.exe
  2⤵
  PID:9000
- C:\Windows\System\iGJwVWB.exe
  C:\Windows\System\iGJwVWB.exe
  2⤵
  PID:9028
- C:\Windows\System\fHPlYAa.exe
  C:\Windows\System\fHPlYAa.exe
  2⤵
  PID:9056
- C:\Windows\System\sgmCLNq.exe
  C:\Windows\System\sgmCLNq.exe
  2⤵
  PID:9084
- C:\Windows\System\pzfvpFq.exe
  C:\Windows\System\pzfvpFq.exe
  2⤵
  PID:9116
- C:\Windows\System\kLAoQbK.exe
  C:\Windows\System\kLAoQbK.exe
  2⤵
  PID:9140
- C:\Windows\System\fpdhjOb.exe
  C:\Windows\System\fpdhjOb.exe
  2⤵
  PID:9168
- C:\Windows\System\bMzTSGu.exe
  C:\Windows\System\bMzTSGu.exe
  2⤵
  PID:9196
- C:\Windows\System\AKUkhQv.exe
  C:\Windows\System\AKUkhQv.exe
  2⤵
  PID:8212
- C:\Windows\System\fRdfsPi.exe
  C:\Windows\System\fRdfsPi.exe
  2⤵
  PID:8304
- C:\Windows\System\sIiqkwr.exe
  C:\Windows\System\sIiqkwr.exe
  2⤵
  PID:8352
- C:\Windows\System\DupzJmr.exe
  C:\Windows\System\DupzJmr.exe
  2⤵
  PID:8408
- C:\Windows\System\pUtVktO.exe
  C:\Windows\System\pUtVktO.exe
  2⤵
  PID:8480
- C:\Windows\System\OEGYRpe.exe
  C:\Windows\System\OEGYRpe.exe
  2⤵
  PID:8544
- C:\Windows\System\mZMleis.exe
  C:\Windows\System\mZMleis.exe
  2⤵
  PID:8604
- C:\Windows\System\CiJDccT.exe
  C:\Windows\System\CiJDccT.exe
  2⤵
  PID:8684
- C:\Windows\System\KjvqLDl.exe
  C:\Windows\System\KjvqLDl.exe
  2⤵
  PID:8740
- C:\Windows\System\RXJmXQM.exe
  C:\Windows\System\RXJmXQM.exe
  2⤵
  PID:8800
- C:\Windows\System\GRApTpq.exe
  C:\Windows\System\GRApTpq.exe
  2⤵
  PID:8872
- C:\Windows\System\MymgXXF.exe
  C:\Windows\System\MymgXXF.exe
  2⤵
  PID:8936
- C:\Windows\System\XKGlWaS.exe
  C:\Windows\System\XKGlWaS.exe
  2⤵
  PID:8996
- C:\Windows\System\EqINrwJ.exe
  C:\Windows\System\EqINrwJ.exe
  2⤵
  PID:9068
- C:\Windows\System\uxPkJeP.exe
  C:\Windows\System\uxPkJeP.exe
  2⤵
  PID:9136
- C:\Windows\System\gaGiUKf.exe
  C:\Windows\System\gaGiUKf.exe
  2⤵
  PID:9192
- C:\Windows\System\vBFkwbU.exe
  C:\Windows\System\vBFkwbU.exe
  2⤵
  PID:8312
- C:\Windows\System\KoMSaKi.exe
  C:\Windows\System\KoMSaKi.exe
  2⤵
  PID:8508
- C:\Windows\System\yMxVUqj.exe
  C:\Windows\System\yMxVUqj.exe
  2⤵
  PID:8592
- C:\Windows\System\dpFYEyz.exe
  C:\Windows\System\dpFYEyz.exe
  2⤵
  PID:8648
- C:\Windows\System\kbGKvIe.exe
  C:\Windows\System\kbGKvIe.exe
  2⤵
  PID:8768
- C:\Windows\System\TKehdIf.exe
  C:\Windows\System\TKehdIf.exe
  2⤵
  PID:8900
- C:\Windows\System\VWzwLmt.exe
  C:\Windows\System\VWzwLmt.exe
  2⤵
  PID:9096
- C:\Windows\System\SKcXWDC.exe
  C:\Windows\System\SKcXWDC.exe
  2⤵
  PID:8404
- C:\Windows\System\BSyfCiS.exe
  C:\Windows\System\BSyfCiS.exe
  2⤵
  PID:8732
- C:\Windows\System\VeLpAxl.exe
  C:\Windows\System\VeLpAxl.exe
  2⤵
  PID:8208
- C:\Windows\System\ONlPtdT.exe
  C:\Windows\System\ONlPtdT.exe
  2⤵
  PID:9052
- C:\Windows\System\gdoTAMM.exe
  C:\Windows\System\gdoTAMM.exe
  2⤵
  PID:9224
- C:\Windows\System\rqnQwOn.exe
  C:\Windows\System\rqnQwOn.exe
  2⤵
  PID:9260
- C:\Windows\System\sAmGAFD.exe
  C:\Windows\System\sAmGAFD.exe
  2⤵
  PID:9280
- C:\Windows\System\gLtApqK.exe
  C:\Windows\System\gLtApqK.exe
  2⤵
  PID:9308
- C:\Windows\System\JzyRiiM.exe
  C:\Windows\System\JzyRiiM.exe
  2⤵
  PID:9336
- C:\Windows\System\zRTUHiL.exe
  C:\Windows\System\zRTUHiL.exe
  2⤵
  PID:9364
- C:\Windows\System\eHVLzsi.exe
  C:\Windows\System\eHVLzsi.exe
  2⤵
  PID:9392
- C:\Windows\System\kexJStz.exe
  C:\Windows\System\kexJStz.exe
  2⤵
  PID:9408
- C:\Windows\System\dJVKCgm.exe
  C:\Windows\System\dJVKCgm.exe
  2⤵
  PID:9444
- C:\Windows\System\ynoOYVj.exe
  C:\Windows\System\ynoOYVj.exe
  2⤵
  PID:9476
- C:\Windows\System\brLaEOQ.exe
  C:\Windows\System\brLaEOQ.exe
  2⤵
  PID:9504
- C:\Windows\System\VQgwpqO.exe
  C:\Windows\System\VQgwpqO.exe
  2⤵
  PID:9532
- C:\Windows\System\vQViLWG.exe
  C:\Windows\System\vQViLWG.exe
  2⤵
  PID:9560
- C:\Windows\System\QYtbVnX.exe
  C:\Windows\System\QYtbVnX.exe
  2⤵
  PID:9588
- C:\Windows\System\gETBbTi.exe
  C:\Windows\System\gETBbTi.exe
  2⤵
  PID:9616
- C:\Windows\System\dbpsgdA.exe
  C:\Windows\System\dbpsgdA.exe
  2⤵
  PID:9644
- C:\Windows\System\GDskDta.exe
  C:\Windows\System\GDskDta.exe
  2⤵
  PID:9672
- C:\Windows\System\vJvbLen.exe
  C:\Windows\System\vJvbLen.exe
  2⤵
  PID:9700
- C:\Windows\System\nIHWjvR.exe
  C:\Windows\System\nIHWjvR.exe
  2⤵
  PID:9728
- C:\Windows\System\kOlyLZK.exe
  C:\Windows\System\kOlyLZK.exe
  2⤵
  PID:9756
- C:\Windows\System\osfrePp.exe
  C:\Windows\System\osfrePp.exe
  2⤵
  PID:9784
- C:\Windows\System\aoPGeUp.exe
  C:\Windows\System\aoPGeUp.exe
  2⤵
  PID:9812
- C:\Windows\System\ZdZtxxM.exe
  C:\Windows\System\ZdZtxxM.exe
  2⤵
  PID:9840
- C:\Windows\System\JPqaBKH.exe
  C:\Windows\System\JPqaBKH.exe
  2⤵
  PID:9868
- C:\Windows\System\BVcIbBU.exe
  C:\Windows\System\BVcIbBU.exe
  2⤵
  PID:9896
- C:\Windows\System\secloPE.exe
  C:\Windows\System\secloPE.exe
  2⤵
  PID:9924
- C:\Windows\System\ibSkSCf.exe
  C:\Windows\System\ibSkSCf.exe
  2⤵
  PID:9952
- C:\Windows\System\SIrxfkl.exe
  C:\Windows\System\SIrxfkl.exe
  2⤵
  PID:9980
- C:\Windows\System\yZDIlaz.exe
  C:\Windows\System\yZDIlaz.exe
  2⤵
  PID:10008
- C:\Windows\System\vEqBibw.exe
  C:\Windows\System\vEqBibw.exe
  2⤵
  PID:10036
- C:\Windows\System\VkWfhZW.exe
  C:\Windows\System\VkWfhZW.exe
  2⤵
  PID:10060
- C:\Windows\System\LtvIgeq.exe
  C:\Windows\System\LtvIgeq.exe
  2⤵
  PID:10092
- C:\Windows\System\chdFNPS.exe
  C:\Windows\System\chdFNPS.exe
  2⤵
  PID:10124
- C:\Windows\System\WGPwjxc.exe
  C:\Windows\System\WGPwjxc.exe
  2⤵
  PID:10156
- C:\Windows\System\NFHdQQj.exe
  C:\Windows\System\NFHdQQj.exe
  2⤵
  PID:10196
- C:\Windows\System\FawrvfA.exe
  C:\Windows\System\FawrvfA.exe
  2⤵
  PID:10236
- C:\Windows\System\JBoBWzV.exe
  C:\Windows\System\JBoBWzV.exe
  2⤵
  PID:9272
- C:\Windows\System\HtrenTQ.exe
  C:\Windows\System\HtrenTQ.exe
  2⤵
  PID:9356
- C:\Windows\System\ywCfAOz.exe
  C:\Windows\System\ywCfAOz.exe
  2⤵
  PID:9420
- C:\Windows\System\kowzMUb.exe
  C:\Windows\System\kowzMUb.exe
  2⤵
  PID:9488
- C:\Windows\System\ieXSSKk.exe
  C:\Windows\System\ieXSSKk.exe
  2⤵
  PID:9552
- C:\Windows\System\DXXzKYg.exe
  C:\Windows\System\DXXzKYg.exe
  2⤵
  PID:9608
- C:\Windows\System\tWQCVyb.exe
  C:\Windows\System\tWQCVyb.exe
  2⤵
  PID:9684
- C:\Windows\System\UUaWOdm.exe
  C:\Windows\System\UUaWOdm.exe
  2⤵
  PID:9748
- C:\Windows\System\GcOZZlb.exe
  C:\Windows\System\GcOZZlb.exe
  2⤵
  PID:9808
- C:\Windows\System\zZRfzDf.exe
  C:\Windows\System\zZRfzDf.exe
  2⤵
  PID:9880
- C:\Windows\System\CvKCKPf.exe
  C:\Windows\System\CvKCKPf.exe
  2⤵
  PID:9944
- C:\Windows\System\LUcDwuC.exe
  C:\Windows\System\LUcDwuC.exe
  2⤵
  PID:10004
- C:\Windows\System\jgwfBac.exe
  C:\Windows\System\jgwfBac.exe
  2⤵
  PID:10076
- C:\Windows\System\hfmNNut.exe
  C:\Windows\System\hfmNNut.exe
  2⤵
  PID:10152
- C:\Windows\System\mworxEz.exe
  C:\Windows\System\mworxEz.exe
  2⤵
  PID:10216
- C:\Windows\System\fjoZMHr.exe
  C:\Windows\System\fjoZMHr.exe
  2⤵
  PID:9332
- C:\Windows\System\EqBoucX.exe
  C:\Windows\System\EqBoucX.exe
  2⤵
  PID:9516
- C:\Windows\System\cpfQhhw.exe
  C:\Windows\System\cpfQhhw.exe
  2⤵
  PID:9664
- C:\Windows\System\sSkLxnm.exe
  C:\Windows\System\sSkLxnm.exe
  2⤵
  PID:9804
- C:\Windows\System\tEsPUrZ.exe
  C:\Windows\System\tEsPUrZ.exe
  2⤵
  PID:8928
- C:\Windows\System\uyAWESe.exe
  C:\Windows\System\uyAWESe.exe
  2⤵
  PID:10104
- C:\Windows\System\kwttonW.exe
  C:\Windows\System\kwttonW.exe
  2⤵
  PID:9304
- C:\Windows\System\xdhajYX.exe
  C:\Windows\System\xdhajYX.exe
  2⤵
  PID:9600
- C:\Windows\System\YACLEPd.exe
  C:\Windows\System\YACLEPd.exe
  2⤵
  PID:10000
- C:\Windows\System\qlFYIDv.exe
  C:\Windows\System\qlFYIDv.exe
  2⤵
  PID:9580
- C:\Windows\System\CmWUOiS.exe
  C:\Windows\System\CmWUOiS.exe
  2⤵
  PID:9468
- C:\Windows\System\CnIsHUc.exe
  C:\Windows\System\CnIsHUc.exe
  2⤵
  PID:10256
- C:\Windows\System\BiutVLF.exe
  C:\Windows\System\BiutVLF.exe
  2⤵
  PID:10284
- C:\Windows\System\sYyLscg.exe
  C:\Windows\System\sYyLscg.exe
  2⤵
  PID:10304
- C:\Windows\System\pyyOyLN.exe
  C:\Windows\System\pyyOyLN.exe
  2⤵
  PID:10332
- C:\Windows\System\igJwOtM.exe
  C:\Windows\System\igJwOtM.exe
  2⤵
  PID:10372
- C:\Windows\System\GDuyxhd.exe
  C:\Windows\System\GDuyxhd.exe
  2⤵
  PID:10400
- C:\Windows\System\FTtyhuc.exe
  C:\Windows\System\FTtyhuc.exe
  2⤵
  PID:10428
- C:\Windows\System\clwqJuH.exe
  C:\Windows\System\clwqJuH.exe
  2⤵
  PID:10456
- C:\Windows\System\sHRTMUG.exe
  C:\Windows\System\sHRTMUG.exe
  2⤵
  PID:10484
- C:\Windows\System\rrNfvqu.exe
  C:\Windows\System\rrNfvqu.exe
  2⤵
  PID:10512
- C:\Windows\System\WwYlPcN.exe
  C:\Windows\System\WwYlPcN.exe
  2⤵
  PID:10540
- C:\Windows\System\qxCUBDi.exe
  C:\Windows\System\qxCUBDi.exe
  2⤵
  PID:10568
- C:\Windows\System\pxqgjUz.exe
  C:\Windows\System\pxqgjUz.exe
  2⤵
  PID:10596
- C:\Windows\System\cwOvWXh.exe
  C:\Windows\System\cwOvWXh.exe
  2⤵
  PID:10624
- C:\Windows\System\eGYMlka.exe
  C:\Windows\System\eGYMlka.exe
  2⤵
  PID:10652
- C:\Windows\System\ZvKyPSN.exe
  C:\Windows\System\ZvKyPSN.exe
  2⤵
  PID:10680
- C:\Windows\System\XqIcguf.exe
  C:\Windows\System\XqIcguf.exe
  2⤵
  PID:10708
- C:\Windows\System\AANIAhx.exe
  C:\Windows\System\AANIAhx.exe
  2⤵
  PID:10736
- C:\Windows\System\CzhxGWJ.exe
  C:\Windows\System\CzhxGWJ.exe
  2⤵
  PID:10764
- C:\Windows\System\ujOUunh.exe
  C:\Windows\System\ujOUunh.exe
  2⤵
  PID:10792
- C:\Windows\System\GwrfPhL.exe
  C:\Windows\System\GwrfPhL.exe
  2⤵
  PID:10824
- C:\Windows\System\gUHbSvM.exe
  C:\Windows\System\gUHbSvM.exe
  2⤵
  PID:10852
- C:\Windows\System\iqzdHcX.exe
  C:\Windows\System\iqzdHcX.exe
  2⤵
  PID:10880
- C:\Windows\System\mYdbrar.exe
  C:\Windows\System\mYdbrar.exe
  2⤵
  PID:10912
- C:\Windows\System\mXLfSjv.exe
  C:\Windows\System\mXLfSjv.exe
  2⤵
  PID:10940
- C:\Windows\System\wfrltBY.exe
  C:\Windows\System\wfrltBY.exe
  2⤵
  PID:10968
- C:\Windows\System\RKEurBh.exe
  C:\Windows\System\RKEurBh.exe
  2⤵
  PID:10996
- C:\Windows\System\OSsPnaq.exe
  C:\Windows\System\OSsPnaq.exe
  2⤵
  PID:11024
- C:\Windows\System\HtbxIvJ.exe
  C:\Windows\System\HtbxIvJ.exe
  2⤵
  PID:11052
- C:\Windows\System\ncBeSft.exe
  C:\Windows\System\ncBeSft.exe
  2⤵
  PID:11080
- C:\Windows\System\StOuIMb.exe
  C:\Windows\System\StOuIMb.exe
  2⤵
  PID:11108
- C:\Windows\System\QiubcSR.exe
  C:\Windows\System\QiubcSR.exe
  2⤵
  PID:11136
- C:\Windows\System\sDCMvDC.exe
  C:\Windows\System\sDCMvDC.exe
  2⤵
  PID:11164
- C:\Windows\System\AYoBDkF.exe
  C:\Windows\System\AYoBDkF.exe
  2⤵
  PID:11192
- C:\Windows\System\dtnLHGa.exe
  C:\Windows\System\dtnLHGa.exe
  2⤵
  PID:11220
- C:\Windows\System\kjAOuEp.exe
  C:\Windows\System\kjAOuEp.exe
  2⤵
  PID:11248
- C:\Windows\System\nGutZzl.exe
  C:\Windows\System\nGutZzl.exe
  2⤵
  PID:10268
- C:\Windows\System\JiWhyyG.exe
  C:\Windows\System\JiWhyyG.exe
  2⤵
  PID:10328
- C:\Windows\System\PQTprvq.exe
  C:\Windows\System\PQTprvq.exe
  2⤵
  PID:10396
- C:\Windows\System\DkZcpPH.exe
  C:\Windows\System\DkZcpPH.exe
  2⤵
  PID:10468
- C:\Windows\System\ZMIQuYn.exe
  C:\Windows\System\ZMIQuYn.exe
  2⤵
  PID:10532
- C:\Windows\System\DRJRKfh.exe
  C:\Windows\System\DRJRKfh.exe
  2⤵
  PID:10592
- C:\Windows\System\apLtHjh.exe
  C:\Windows\System\apLtHjh.exe
  2⤵
  PID:10664
- C:\Windows\System\pDmEaKF.exe
  C:\Windows\System\pDmEaKF.exe
  2⤵
  PID:10728
- C:\Windows\System\CIpgIMx.exe
  C:\Windows\System\CIpgIMx.exe
  2⤵
  PID:10780
- C:\Windows\System\fZHvxhi.exe
  C:\Windows\System\fZHvxhi.exe
  2⤵
  PID:10864
- C:\Windows\System\ZqXEgYC.exe
  C:\Windows\System\ZqXEgYC.exe
  2⤵
  PID:10932
- C:\Windows\System\OaAkmIp.exe
  C:\Windows\System\OaAkmIp.exe
  2⤵
  PID:10992
- C:\Windows\System\DtIIaKx.exe
  C:\Windows\System\DtIIaKx.exe
  2⤵
  PID:11064
- C:\Windows\System\LDQrPqo.exe
  C:\Windows\System\LDQrPqo.exe
  2⤵
  PID:11128
- C:\Windows\System\Ligyito.exe
  C:\Windows\System\Ligyito.exe
  2⤵
  PID:11188
- C:\Windows\System\EhLjShu.exe
  C:\Windows\System\EhLjShu.exe
  2⤵
  PID:11260
- C:\Windows\System\NYvBTJu.exe
  C:\Windows\System\NYvBTJu.exe
  2⤵
  PID:10384
- C:\Windows\System\uwznmZH.exe
  C:\Windows\System\uwznmZH.exe
  2⤵
  PID:10524
- C:\Windows\System\kPFlFAn.exe
  C:\Windows\System\kPFlFAn.exe
  2⤵
  PID:10692
- C:\Windows\System\TFHhZYB.exe
  C:\Windows\System\TFHhZYB.exe
  2⤵
  PID:10820
- C:\Windows\System\xNImCWw.exe
  C:\Windows\System\xNImCWw.exe
  2⤵
  PID:10988
- C:\Windows\System\QhYMtwF.exe
  C:\Windows\System\QhYMtwF.exe
  2⤵
  PID:11156
- C:\Windows\System\piGEIym.exe
  C:\Windows\System\piGEIym.exe
  2⤵
  PID:10316
- C:\Windows\System\LTZHGmM.exe
  C:\Windows\System\LTZHGmM.exe
  2⤵
  PID:10648
- C:\Windows\System\gULDFmn.exe
  C:\Windows\System\gULDFmn.exe
  2⤵
  PID:11048
- C:\Windows\System\FysutNm.exe
  C:\Windows\System\FysutNm.exe
  2⤵
  PID:10296
- C:\Windows\System\WlGboXi.exe
  C:\Windows\System\WlGboXi.exe
  2⤵
  PID:10300
- C:\Windows\System\YExQOII.exe
  C:\Windows\System\YExQOII.exe
  2⤵
  PID:11280
- C:\Windows\System\TYVUQFB.exe
  C:\Windows\System\TYVUQFB.exe
  2⤵
  PID:11308
- C:\Windows\System\LcjdSkh.exe
  C:\Windows\System\LcjdSkh.exe
  2⤵
  PID:11336
- C:\Windows\System\CxPEbBV.exe
  C:\Windows\System\CxPEbBV.exe
  2⤵
  PID:11364
- C:\Windows\System\OjpxGoR.exe
  C:\Windows\System\OjpxGoR.exe
  2⤵
  PID:11392
- C:\Windows\System\ZODfYWi.exe
  C:\Windows\System\ZODfYWi.exe
  2⤵
  PID:11420
- C:\Windows\System\kjdlcIK.exe
  C:\Windows\System\kjdlcIK.exe
  2⤵
  PID:11448
- C:\Windows\System\UIXtxCf.exe
  C:\Windows\System\UIXtxCf.exe
  2⤵
  PID:11476
- C:\Windows\System\YTgLGmA.exe
  C:\Windows\System\YTgLGmA.exe
  2⤵
  PID:11504
- C:\Windows\System\LfhJiwR.exe
  C:\Windows\System\LfhJiwR.exe
  2⤵
  PID:11520
- C:\Windows\System\TBRfpTn.exe
  C:\Windows\System\TBRfpTn.exe
  2⤵
  PID:11548
- C:\Windows\System\NjhoDGh.exe
  C:\Windows\System\NjhoDGh.exe
  2⤵
  PID:11584
- C:\Windows\System\JvlIUxE.exe
  C:\Windows\System\JvlIUxE.exe
  2⤵
  PID:11616
- C:\Windows\System\cPoamTo.exe
  C:\Windows\System\cPoamTo.exe
  2⤵
  PID:11644
- C:\Windows\System\JnuTaGw.exe
  C:\Windows\System\JnuTaGw.exe
  2⤵
  PID:11672
- C:\Windows\System\pVfhZFQ.exe
  C:\Windows\System\pVfhZFQ.exe
  2⤵
  PID:11704
- C:\Windows\System\pxhtFao.exe
  C:\Windows\System\pxhtFao.exe
  2⤵
  PID:11732
- C:\Windows\System\CCbJTIq.exe
  C:\Windows\System\CCbJTIq.exe
  2⤵
  PID:11760
- C:\Windows\System\SKibiJp.exe
  C:\Windows\System\SKibiJp.exe
  2⤵
  PID:11788
- C:\Windows\System\ruFKGzh.exe
  C:\Windows\System\ruFKGzh.exe
  2⤵
  PID:11816
- C:\Windows\System\oFtfosm.exe
  C:\Windows\System\oFtfosm.exe
  2⤵
  PID:11844
- C:\Windows\System\CqlXLkX.exe
  C:\Windows\System\CqlXLkX.exe
  2⤵
  PID:11872
- C:\Windows\System\ZMcEAFW.exe
  C:\Windows\System\ZMcEAFW.exe
  2⤵
  PID:11900
- C:\Windows\System\rlzYBUv.exe
  C:\Windows\System\rlzYBUv.exe
  2⤵
  PID:11928
- C:\Windows\System\ETPLXOW.exe
  C:\Windows\System\ETPLXOW.exe
  2⤵
  PID:11956
- C:\Windows\System\sfVPoYJ.exe
  C:\Windows\System\sfVPoYJ.exe
  2⤵
  PID:11984
- C:\Windows\System\ORizgjU.exe
  C:\Windows\System\ORizgjU.exe
  2⤵
  PID:12012
- C:\Windows\System\CVkQPen.exe
  C:\Windows\System\CVkQPen.exe
  2⤵
  PID:12040
- C:\Windows\System\ffIoMsN.exe
  C:\Windows\System\ffIoMsN.exe
  2⤵
  PID:12068
- C:\Windows\System\UjmyWBo.exe
  C:\Windows\System\UjmyWBo.exe
  2⤵
  PID:12096
- C:\Windows\System\YHqHpQm.exe
  C:\Windows\System\YHqHpQm.exe
  2⤵
  PID:12124
- C:\Windows\System\itWPFtB.exe
  C:\Windows\System\itWPFtB.exe
  2⤵
  PID:12160
- C:\Windows\System\zazbtTj.exe
  C:\Windows\System\zazbtTj.exe
  2⤵
  PID:12180
- C:\Windows\System\anAHWbN.exe
  C:\Windows\System\anAHWbN.exe
  2⤵
  PID:12208
- C:\Windows\System\gQOxrwa.exe
  C:\Windows\System\gQOxrwa.exe
  2⤵
  PID:12236
- C:\Windows\System\woTiIWg.exe
  C:\Windows\System\woTiIWg.exe
  2⤵
  PID:12264
- C:\Windows\System\AEtfHHp.exe
  C:\Windows\System\AEtfHHp.exe
  2⤵
  PID:10980
- C:\Windows\System\vGjSVXn.exe
  C:\Windows\System\vGjSVXn.exe
  2⤵
  PID:11328
- C:\Windows\System\HFvwVuc.exe
  C:\Windows\System\HFvwVuc.exe
  2⤵
  PID:11388
- C:\Windows\System\gLOnCWT.exe
  C:\Windows\System\gLOnCWT.exe
  2⤵
  PID:11460
- C:\Windows\System\SmyJugK.exe
  C:\Windows\System\SmyJugK.exe
  2⤵
  PID:11532
- C:\Windows\System\bdrzJlZ.exe
  C:\Windows\System\bdrzJlZ.exe
  2⤵
  PID:11592
- C:\Windows\System\OAYWdhV.exe
  C:\Windows\System\OAYWdhV.exe
  2⤵
  PID:11656
- C:\Windows\System\EfyIzGf.exe
  C:\Windows\System\EfyIzGf.exe
  2⤵
  PID:11724
- C:\Windows\System\ectbfPQ.exe
  C:\Windows\System\ectbfPQ.exe
  2⤵
  PID:11784
- C:\Windows\System\oFwaisk.exe
  C:\Windows\System\oFwaisk.exe
  2⤵
  PID:11856
- C:\Windows\System\kWLpLmW.exe
  C:\Windows\System\kWLpLmW.exe
  2⤵
  PID:11920
- C:\Windows\System\PmRCQLD.exe
  C:\Windows\System\PmRCQLD.exe
  2⤵
  PID:11968
- C:\Windows\System\yWHtePM.exe
  C:\Windows\System\yWHtePM.exe
  2⤵
  PID:12052
- C:\Windows\System\PLzUMId.exe
  C:\Windows\System\PLzUMId.exe
  2⤵
  PID:12120
- C:\Windows\System\HEBRTdJ.exe
  C:\Windows\System\HEBRTdJ.exe
  2⤵
  PID:12192
- C:\Windows\System\GLfFHhZ.exe
  C:\Windows\System\GLfFHhZ.exe
  2⤵
  PID:12256
- C:\Windows\System\ZYoHovq.exe
  C:\Windows\System\ZYoHovq.exe
  2⤵
  PID:11320
- C:\Windows\System\iIdUxHt.exe
  C:\Windows\System\iIdUxHt.exe
  2⤵
  PID:11492
- C:\Windows\System\CYOsTQn.exe
  C:\Windows\System\CYOsTQn.exe
  2⤵
  PID:11636
- C:\Windows\System\fQRgOos.exe
  C:\Windows\System\fQRgOos.exe
  2⤵
  PID:11780
- C:\Windows\System\gPhetdi.exe
  C:\Windows\System\gPhetdi.exe
  2⤵
  PID:11952
- C:\Windows\System\CJdPtZJ.exe
  C:\Windows\System\CJdPtZJ.exe
  2⤵
  PID:12112
- C:\Windows\System\OnZeAwQ.exe
  C:\Windows\System\OnZeAwQ.exe
  2⤵
  PID:12248
- C:\Windows\System\dFuCroi.exe
  C:\Windows\System\dFuCroi.exe
  2⤵
  PID:11536
- C:\Windows\System\OKNKdwp.exe
  C:\Windows\System\OKNKdwp.exe
  2⤵
  PID:11896
- C:\Windows\System\kdABvJE.exe
  C:\Windows\System\kdABvJE.exe
  2⤵
  PID:12220
- C:\Windows\System\obIJBQX.exe
  C:\Windows\System\obIJBQX.exe
  2⤵
  PID:11840
- C:\Windows\System\pyYkixM.exe
  C:\Windows\System\pyYkixM.exe
  2⤵
  PID:11692
- C:\Windows\System\POaWtni.exe
  C:\Windows\System\POaWtni.exe
  2⤵
  PID:12312
- C:\Windows\System\bvLCGaR.exe
  C:\Windows\System\bvLCGaR.exe
  2⤵
  PID:12344
- C:\Windows\System\lCBAJYM.exe
  C:\Windows\System\lCBAJYM.exe
  2⤵
  PID:12372
- C:\Windows\System\eOnpyUm.exe
  C:\Windows\System\eOnpyUm.exe
  2⤵
  PID:12412
- C:\Windows\System\ruArUcE.exe
  C:\Windows\System\ruArUcE.exe
  2⤵
  PID:12428
- C:\Windows\System\NUrJmAR.exe
  C:\Windows\System\NUrJmAR.exe
  2⤵
  PID:12456
- C:\Windows\System\dSHnKtS.exe
  C:\Windows\System\dSHnKtS.exe
  2⤵
  PID:12484
- C:\Windows\System\rmjbywd.exe
  C:\Windows\System\rmjbywd.exe
  2⤵
  PID:12512
- C:\Windows\System\tUuhrMB.exe
  C:\Windows\System\tUuhrMB.exe
  2⤵
  PID:12540
- C:\Windows\System\NVuGiCr.exe
  C:\Windows\System\NVuGiCr.exe
  2⤵
  PID:12568
- C:\Windows\System\iIihqKz.exe
  C:\Windows\System\iIihqKz.exe
  2⤵
  PID:12616
- C:\Windows\System\yRhTLRt.exe
  C:\Windows\System\yRhTLRt.exe
  2⤵
  PID:12648
- C:\Windows\System\IDRaoVB.exe
  C:\Windows\System\IDRaoVB.exe
  2⤵
  PID:12672
- C:\Windows\System\yPMIErZ.exe
  C:\Windows\System\yPMIErZ.exe
  2⤵
  PID:12708
- C:\Windows\System\jylSbFV.exe
  C:\Windows\System\jylSbFV.exe
  2⤵
  PID:12752
- C:\Windows\System\TmUAKxk.exe
  C:\Windows\System\TmUAKxk.exe
  2⤵
  PID:12780
- C:\Windows\System\azHASzL.exe
  C:\Windows\System\azHASzL.exe
  2⤵
  PID:12812
- C:\Windows\System\wjlwIVb.exe
  C:\Windows\System\wjlwIVb.exe
  2⤵
  PID:12852
- C:\Windows\System\ENjAhrY.exe
  C:\Windows\System\ENjAhrY.exe
  2⤵
  PID:12880
- C:\Windows\System\WZTrcie.exe
  C:\Windows\System\WZTrcie.exe
  2⤵
  PID:12908
- C:\Windows\System\FVtgajd.exe
  C:\Windows\System\FVtgajd.exe
  2⤵
  PID:12948
- C:\Windows\System\YoeQHBu.exe
  C:\Windows\System\YoeQHBu.exe
  2⤵
  PID:12996
- C:\Windows\System\QooWhtR.exe
  C:\Windows\System\QooWhtR.exe
  2⤵
  PID:13036
- C:\Windows\System\gZfiBga.exe
  C:\Windows\System\gZfiBga.exe
  2⤵
  PID:13056
- C:\Windows\System\jBjcjHq.exe
  C:\Windows\System\jBjcjHq.exe
  2⤵
  PID:13100
- C:\Windows\System\lMYBnJx.exe
  C:\Windows\System\lMYBnJx.exe
  2⤵
  PID:13132
- C:\Windows\System\ELtezhy.exe
  C:\Windows\System\ELtezhy.exe
  2⤵
  PID:13160
- C:\Windows\System\VYZeykC.exe
  C:\Windows\System\VYZeykC.exe
  2⤵
  PID:13188
- C:\Windows\System\YxYOKhc.exe
  C:\Windows\System\YxYOKhc.exe
  2⤵
  PID:13208
- C:\Windows\System\gtorzJj.exe
  C:\Windows\System\gtorzJj.exe
  2⤵
  PID:13224
- C:\Windows\System\QFOYniP.exe
  C:\Windows\System\QFOYniP.exe
  2⤵
  PID:13240
- C:\Windows\System\lDSlvVj.exe
  C:\Windows\System\lDSlvVj.exe
  2⤵
  PID:13260
- C:\Windows\System\QVkmGQN.exe
  C:\Windows\System\QVkmGQN.exe
  2⤵
  PID:13284
- C:\Windows\System\dAaFgIy.exe
  C:\Windows\System\dAaFgIy.exe
  2⤵
  PID:13304
- C:\Windows\System\cigSoXu.exe
  C:\Windows\System\cigSoXu.exe
  2⤵
  PID:12356
- C:\Windows\System\sLaddLV.exe
  C:\Windows\System\sLaddLV.exe
  2⤵
  PID:1740
- C:\Windows\System\JnvilwP.exe
  C:\Windows\System\JnvilwP.exe
  2⤵
  PID:12440
- C:\Windows\System\sNmywbC.exe
  C:\Windows\System\sNmywbC.exe
  2⤵
  PID:12508
- C:\Windows\System\iQGTwLE.exe
  C:\Windows\System\iQGTwLE.exe
  2⤵
  PID:12560
- C:\Windows\System\FkeQaAp.exe
  C:\Windows\System\FkeQaAp.exe
  2⤵
  PID:12628
- C:\Windows\System\lDKnfmq.exe
  C:\Windows\System\lDKnfmq.exe
  2⤵
  PID:12692
- C:\Windows\System\Fnapudm.exe
  C:\Windows\System\Fnapudm.exe
  2⤵
  PID:12800
- C:\Windows\System\pIramiE.exe
  C:\Windows\System\pIramiE.exe
  2⤵
  PID:12844
- C:\Windows\System\LQjnXVG.exe
  C:\Windows\System\LQjnXVG.exe
  2⤵
  PID:12940
- C:\Windows\System\TbFZKXW.exe
  C:\Windows\System\TbFZKXW.exe
  2⤵
  PID:13052
- C:\Windows\System\oBdccZj.exe
  C:\Windows\System\oBdccZj.exe
  2⤵
  PID:13148
- C:\Windows\System\Hetmtga.exe
  C:\Windows\System\Hetmtga.exe
  2⤵
  PID:13232
- C:\Windows\System\hPnaexH.exe
  C:\Windows\System\hPnaexH.exe
  2⤵
  PID:13272
- C:\Windows\System\wNsuxKY.exe
  C:\Windows\System\wNsuxKY.exe
  2⤵
  PID:12588
- C:\Windows\System\vaGCXVY.exe
  C:\Windows\System\vaGCXVY.exe
  2⤵
  PID:4544
- C:\Windows\System\LtLZibF.exe
  C:\Windows\System\LtLZibF.exe
  2⤵
  PID:12768
- C:\Windows\System\FnVkoLG.exe
  C:\Windows\System\FnVkoLG.exe
  2⤵
  PID:12888
- C:\Windows\System\jILqUYt.exe
  C:\Windows\System\jILqUYt.exe
  2⤵
  PID:13120
- C:\Windows\System\pXpjTCF.exe
  C:\Windows\System\pXpjTCF.exe
  2⤵
  PID:13256
- C:\Windows\System\UDjuVYB.exe
  C:\Windows\System\UDjuVYB.exe
  2⤵
  PID:12760
- C:\Windows\System\evGpxvN.exe
  C:\Windows\System\evGpxvN.exe
  2⤵
  PID:13184
- C:\Windows\System\KFajtyA.exe
  C:\Windows\System\KFajtyA.exe
  2⤵
  PID:12476
- C:\Windows\System\XKbCWLc.exe
  C:\Windows\System\XKbCWLc.exe
  2⤵
  PID:13088
- C:\Windows\System\ICOvlCu.exe
  C:\Windows\System\ICOvlCu.exe
  2⤵
  PID:13332
- C:\Windows\System\mTxAarn.exe
  C:\Windows\System\mTxAarn.exe
  2⤵
  PID:13360
- C:\Windows\System\hfuAKxh.exe
  C:\Windows\System\hfuAKxh.exe
  2⤵
  PID:13388
- C:\Windows\System\bSHWcxB.exe
  C:\Windows\System\bSHWcxB.exe
  2⤵
  PID:13416
- C:\Windows\System\YnjlNgM.exe
  C:\Windows\System\YnjlNgM.exe
  2⤵
  PID:13444
- C:\Windows\System\UInsBHB.exe
  C:\Windows\System\UInsBHB.exe
  2⤵
  PID:13472
- C:\Windows\System\EXWfInZ.exe
  C:\Windows\System\EXWfInZ.exe
  2⤵
  PID:13500
- C:\Windows\System\znZvaBY.exe
  C:\Windows\System\znZvaBY.exe
  2⤵
  PID:13528
- C:\Windows\System\PuHwVLZ.exe
  C:\Windows\System\PuHwVLZ.exe
  2⤵
  PID:13556
- C:\Windows\System\jqpGsgt.exe
  C:\Windows\System\jqpGsgt.exe
  2⤵
  PID:13584
- C:\Windows\System\fVNrDXF.exe
  C:\Windows\System\fVNrDXF.exe
  2⤵
  PID:13612
- C:\Windows\System\EBiYTgA.exe
  C:\Windows\System\EBiYTgA.exe
  2⤵
  PID:13640
- C:\Windows\System\bkMaxaI.exe
  C:\Windows\System\bkMaxaI.exe
  2⤵
  PID:13668
- C:\Windows\System\adfmOSp.exe
  C:\Windows\System\adfmOSp.exe
  2⤵
  PID:13696
- C:\Windows\System\fdzrsrX.exe
  C:\Windows\System\fdzrsrX.exe
  2⤵
  PID:13724
- C:\Windows\System\STwkAEz.exe
  C:\Windows\System\STwkAEz.exe
  2⤵
  PID:13752
- C:\Windows\System\lYjhYFh.exe
  C:\Windows\System\lYjhYFh.exe
  2⤵
  PID:13780
- C:\Windows\System\ICEfHJm.exe
  C:\Windows\System\ICEfHJm.exe
  2⤵
  PID:13808
- C:\Windows\System\qAxjFxU.exe
  C:\Windows\System\qAxjFxU.exe
  2⤵
  PID:13836
- C:\Windows\System\cmDHedq.exe
  C:\Windows\System\cmDHedq.exe
  2⤵
  PID:13864
- C:\Windows\System\GzjRvKK.exe
  C:\Windows\System\GzjRvKK.exe
  2⤵
  PID:13892
- C:\Windows\System\tbUJQNY.exe
  C:\Windows\System\tbUJQNY.exe
  2⤵
  PID:13920
- C:\Windows\System\QYTLWlP.exe
  C:\Windows\System\QYTLWlP.exe
  2⤵
  PID:13948
- C:\Windows\System\WBVNeuA.exe
  C:\Windows\System\WBVNeuA.exe
  2⤵
  PID:13976
- C:\Windows\System\ldAISdl.exe
  C:\Windows\System\ldAISdl.exe
  2⤵
  PID:14004
- C:\Windows\System\zqwIDif.exe
  C:\Windows\System\zqwIDif.exe
  2⤵
  PID:14032
- C:\Windows\System\KpRPjWn.exe
  C:\Windows\System\KpRPjWn.exe
  2⤵
  PID:14064
- C:\Windows\System\YQyVeHf.exe
  C:\Windows\System\YQyVeHf.exe
  2⤵
  PID:14080
- C:\Windows\System\lLGQeGt.exe
  C:\Windows\System\lLGQeGt.exe
  2⤵
  PID:14096
- C:\Windows\System\prgSneA.exe
  C:\Windows\System\prgSneA.exe
  2⤵
  PID:14124
- C:\Windows\System\EHNVGNa.exe
  C:\Windows\System\EHNVGNa.exe
  2⤵
  PID:14164
- C:\Windows\System\JdMthcX.exe
  C:\Windows\System\JdMthcX.exe
  2⤵
  PID:14196
- C:\Windows\System\iLoQNlU.exe
  C:\Windows\System\iLoQNlU.exe
  2⤵
  PID:14232
- C:\Windows\System\VVmhoEx.exe
  C:\Windows\System\VVmhoEx.exe
  2⤵
  PID:14260
- C:\Windows\System\QwSrqGN.exe
  C:\Windows\System\QwSrqGN.exe
  2⤵
  PID:14288
- C:\Windows\System\FpZZcGj.exe
  C:\Windows\System\FpZZcGj.exe
  2⤵
  PID:14316
- C:\Windows\System\pDAGdoN.exe
  C:\Windows\System\pDAGdoN.exe
  2⤵
  PID:13328
- C:\Windows\System\UOvdHoz.exe
  C:\Windows\System\UOvdHoz.exe
  2⤵
  PID:13400
- C:\Windows\System\SQTFPSY.exe
  C:\Windows\System\SQTFPSY.exe
  2⤵
  PID:13456
- C:\Windows\System\KygYuDW.exe
  C:\Windows\System\KygYuDW.exe
  2⤵
  PID:13524
- C:\Windows\System\bgfSASV.exe
  C:\Windows\System\bgfSASV.exe
  2⤵
  PID:13596
- C:\Windows\System\yozINCs.exe
  C:\Windows\System\yozINCs.exe
  2⤵
  PID:13632
- C:\Windows\System\VHBupNX.exe
  C:\Windows\System\VHBupNX.exe
  2⤵
  PID:13680
- C:\Windows\System\PIdzTxu.exe
  C:\Windows\System\PIdzTxu.exe
  2⤵
  PID:13748
- C:\Windows\System\fJwtWGv.exe
  C:\Windows\System\fJwtWGv.exe
  2⤵
  PID:13820
- C:\Windows\System\GtOKACP.exe
  C:\Windows\System\GtOKACP.exe
  2⤵
  PID:13904
- C:\Windows\System\rfMtjmO.exe
  C:\Windows\System\rfMtjmO.exe
  2⤵
  PID:13972
- C:\Windows\System\OmyIxwt.exe
  C:\Windows\System\OmyIxwt.exe
  2⤵
  PID:14048
- C:\Windows\System\gtrrtSe.exe
  C:\Windows\System\gtrrtSe.exe
  2⤵
  PID:14112
- C:\Windows\System\IdHqnSl.exe
  C:\Windows\System\IdHqnSl.exe
  2⤵
  PID:14188
- C:\Windows\System\biBgmuz.exe
  C:\Windows\System\biBgmuz.exe
  2⤵
  PID:14228
- C:\Windows\System\CAyreXX.exe
  C:\Windows\System\CAyreXX.exe
  2⤵
  PID:14300
- C:\Windows\System\oxCADnX.exe
  C:\Windows\System\oxCADnX.exe
  2⤵
  PID:13380
- C:\Windows\System\PNXAlCK.exe
  C:\Windows\System\PNXAlCK.exe
  2⤵
  PID:13520
- C:\Windows\System\broEbrA.exe
  C:\Windows\System\broEbrA.exe
  2⤵
  PID:13708
- C:\Windows\System\zrueBdq.exe
  C:\Windows\System\zrueBdq.exe
  2⤵
  PID:13792
- C:\Windows\System\WoNzJZT.exe
  C:\Windows\System\WoNzJZT.exe
  2⤵
  PID:14028
- C:\Windows\System\DOlTMpH.exe
  C:\Windows\System\DOlTMpH.exe
  2⤵
  PID:14060
- C:\Windows\System\ItRiJZa.exe
  C:\Windows\System\ItRiJZa.exe
  2⤵
  PID:14256
- C:\Windows\System\aGgKsWO.exe
  C:\Windows\System\aGgKsWO.exe
  2⤵
  PID:13484
- C:\Windows\System\TOCsCOz.exe
  C:\Windows\System\TOCsCOz.exe
  2⤵
  PID:13884
- C:\Windows\System\dfLwGdw.exe
  C:\Windows\System\dfLwGdw.exe
  2⤵
  PID:14220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AqazKti.exe

Filesize
2.0MB

MD5
c003a4888dbb087543112346788f0bb1

SHA1
e44653c4ddb6123011ad69dc961d64900ccedb7e

SHA256
6927a58bec628ad06acb08b63bdcf2c71a20b852fa77ece04d144c57b85bc1bb

SHA512
6994a33dd12ae223e2c950f8f489ce3b5c80455e00d3166d4df627d6f41b0ff352d30d9545796c6411eae1b17150bc2f2492d4ae8f4de7151ae629cc0be30acd

Download Submit
C:\Windows\System\GrNqXAN.exe

Filesize
2.0MB

MD5
deff1ff97d1d3cb01315c6837549023e

SHA1
9dc149a2ebd7bace759a80ec9245ed1ccc2984d8

SHA256
d458c9d845bf1ef90b2f1d8809ece7642dc5a4adc2dcfb8865c8d760a0ccc171

SHA512
c22c4fe1b15156dc1e6da488b95bf166ed1559e41ae3d0bbdaa257e7f251081869e368256df122d0ab95065138ffcf46ca019eb023415540b3e1e29e98f34489

Download Submit
C:\Windows\System\HPbHYdC.exe

Filesize
2.0MB

MD5
9787f9f09dde88e25b921735c81600fa

SHA1
1ca44f07eb4b24ca6277a380ac56add3a97b7fe5

SHA256
8e1edbbab1c240faab94295620b991d522e9c2cab0f978b7b8adfaa494a98fff

SHA512
3e8cf58128f32da9fa0384a476409d571322d35a7e343d4bfcedf95d135bb4c0b5b5ea1eeae835f10d8e8cc1ad81a2ce7ee2b6029fac517ddd887aafb0fce7c8

Download Submit
C:\Windows\System\IjSqgFP.exe

Filesize
2.0MB

MD5
d058dfa41dd551d93f67d102c4c76d0d

SHA1
9eccea142ab5475e04b70e641d33e284d7cc7e67

SHA256
bf589cc34d3dab8cadb42a6f196d3d65498cc8bedf014be74fa1d9ea6fcb6b39

SHA512
cf25ff2bccfd85bd65597790852f1845ae9d3bb74f992b5727e2bb1c165c6a03e3b30fbe17f77d0c73f6b2818eee77a2c027e5a5d12f2be2dab76b9366940ca5

Download Submit
C:\Windows\System\IlfrTiO.exe

Filesize
2.0MB

MD5
0ef3c9618b956f0f9de02106c137b8e7

SHA1
8e7a7737f8f7b350ae7119bcd4f4a71d11eb22f7

SHA256
c75753e61e9d1798baf58b522c786fab0ceb220ddde7963344880a0ce1b5b2b6

SHA512
40d3992141405efb51514c6ed5469ce9226ee345ec7fa456f0f011c48d33e321782ca22921a621264b1c3fffb614081486c676c451d7e06570004a87337772e8

Download Submit
C:\Windows\System\KPtvDGj.exe

Filesize
2.0MB

MD5
36cab8a65715b1dbe11bc77b3673e981

SHA1
56c89f42135e34bcee198455a0187110f989d4c8

SHA256
1da7925d5d4b6d259704febaaeb9cccbb8c33983a6193c81b38a31d3c68caef2

SHA512
4152336c2a584b0517fb97bd27e2c525c9801595c0600a3b9f17faabe0dc8ebf03cd4c3df7edc2deaf2fde0b2542889676e5a1df21be5c9b6c9ea17f828a6eb4

Download Submit
C:\Windows\System\KqjDVVf.exe

Filesize
2.0MB

MD5
c74ba0ab98e6314c1205753c2272942d

SHA1
7b61f55fa1a9ab60a0fee29b385f06e479b67e51

SHA256
cf26b8a562e8bbc1c6e2fd9d8422801ef1461d998f392f81d0903fb37fa5b36f

SHA512
f07c98ff430875da6df8c7c1afc34393b2c2d1b5c310af8bb7b680180f10cfe3bb9ae4d46b84d4f9ab4e116cdce7fd8645cfbccc96a0915110114cc32bcc7186

Download Submit
C:\Windows\System\MpbCVJB.exe

Filesize
2.0MB

MD5
2eabf6c15d9b7fcee091b99e7cbb02c9

SHA1
344d74300ee84fe48d4c73e7bebff645cbd519f7

SHA256
27c73addfac9c07c6a0923085d1ab2f52067d79b1e2073e3213a99a44f80d037

SHA512
f2d7331f235d0b37253847f110132d988b0c150932735fb8749eac89b956abd08bc6fd76a1a811c7ec9b975f3784035c2f012c8680b1d04d42b7be5f1e6b6092

Download Submit
C:\Windows\System\OCvBDLB.exe

Filesize
2.0MB

MD5
92e730319a5dd5c29f4630d26285a407

SHA1
488e40781f3cb74be82f64b6cb2a18f75bda4a39

SHA256
2d2a3ef0f617c61a0888ca3f88aad601ee64a8b1e33f253cf4c0a6d91af36618

SHA512
e90564a45ea98306f372294f5cbf7ce09b80ba2ee11602bf47e36219f8b66829633969acea4b7e63a52346114c5df138616aec58109a4eeaebf09798aeca4a72

Download Submit
C:\Windows\System\OgIyMdX.exe

Filesize
2.0MB

MD5
6b7daebed9fd6c475d6938a76f7eb758

SHA1
2f130ff4257216be74526ffe8b435e0b72852d2b

SHA256
aae5b00b67525b67d842c5066cbc7bc6583d71d09036a704524835fdb836bf61

SHA512
a77cc2bea8b7bd869be5f6ee84224f078be9b135245722ecc669e55b66ca0146c6f9fd371b0cf394c41ba220edbf1cfa7373581a5b8b23ae75fc283bd0110ff6

Download Submit
C:\Windows\System\RhHGbeI.exe

Filesize
2.0MB

MD5
a4dffd41405636d2f57a1400f4ff8639

SHA1
a094a7e3ec2650d36c3456f73be3ae339f21f820

SHA256
00685c9fe9d06a35b33b7e66ae51e7487ebea409a50ed08015c3bdd20214efb1

SHA512
5b0e795b48c9de9a2ec720d0004cb53b6a270f8c587f11783bd1e595f5010ec52ee889816aa563414a5153cfe3f681f23f7dc7da9e6ca259af5593a94e905253

Download Submit
C:\Windows\System\SgfCuxU.exe

Filesize
2.0MB

MD5
f2fe11209ce80b982d4a8ed5ace8cb3d

SHA1
1b31bdb9a6ec343cdfa73c6212ba72363677eefa

SHA256
74e6c29f28bb930e0aa203cc86728b6d132ffed4796005a921e869b979f5d8be

SHA512
7e2cd18d2dcfa2627cd3f1300488efd2c93a2d38f5b35ec06c48f957f8bc0dd49653f7aded3db78dcad9677c21057948df1466b625fc7cec4aaf48c6b1fe1ab4

Download Submit
C:\Windows\System\SttQRKO.exe

Filesize
2.0MB

MD5
ab2c8f6ee7d617973f2ae1d0790107f3

SHA1
1093c8bc31c7421e72df307fab52b0511189b0ab

SHA256
a6355e70151d4d2c2fb68b73fbcc8575dbb6caf3e5900c5529926430c19558f6

SHA512
88995f8a743eaf6543d0657438a78be66c19f5efc3761aa1dd3130dd3ad2bf886da21e61e348a98c2aa1d493e579842240e7527ae763c808419c083039bc1116

Download Submit
C:\Windows\System\TKeGgUH.exe

Filesize
2.0MB

MD5
c8acfee22175d4e5bf06f663c39ae627

SHA1
71edf36cfacb526ae78482e2fca3714a9be203c8

SHA256
0567c47dea963d8be5100ce66aa13a6a7d44151a7eba9703052d45c67c583746

SHA512
a08f77e9fccf218f8df0eea2147030771d2a7e4d67cef51f1c98e311f3b09889c22450b653259086033f5cb0782252e925bc998f1d057df7aae450d6e1a98a1d

Download Submit
C:\Windows\System\TuElClr.exe

Filesize
2.0MB

MD5
bf91a22c581a22744b08cf85d305b718

SHA1
996c464542cf82634821ce6c8711c44b0f62f57f

SHA256
4f2832510f0153df5fb135554d739c768ccbae9ea4589019099d0163a116ba82

SHA512
ab0dcca5a13d9a77271bccecb1525d47dc6d1853b898630708a0ef137ec146328d062c903964b0147bc43175cdeee3fb8322840a123bf874532f2db7e38f8b47

Download Submit
C:\Windows\System\WOOAtmF.exe

Filesize
2.0MB

MD5
1e2e3e4264ccc5a707bd79e8f7e78f1b

SHA1
5b5e90b28b0c702d4833c1b064de560a7061cd0e

SHA256
e35972c863b3e4722fec0f661e95dec0c214edacdc190781773f71ef0f88b69f

SHA512
ebb5e591ce99d25640c32c576aa85b1dd57f586635f66fe19510d9400c085470ee80bac07b490511abdd4b32435309d9db49b24d80ce984eaa146e6e8849f47c

Download Submit
C:\Windows\System\XKuXOeW.exe

Filesize
2.0MB

MD5
487d0dff8a0d5c34355ca0bd72da54cf

SHA1
bcde18cf100124abd93e29388c9a3ee2e2eb6ba4

SHA256
ae721caacce95bb91a29222470b3458ab67bbb6c8b3919848b1419e807f8b1aa

SHA512
805332b28d978aa161e23e459d6b215440fab42f71fcd5bac4b6e2a8e9be7e29f8abdbd1fc92498f59ab974cb3706e16c7b3dad803df20edb887e3b92e3a28c0

Download Submit
C:\Windows\System\XfgXMeU.exe

Filesize
2.0MB

MD5
3f613f80d429b236213ed8cdfe4b7108

SHA1
ae606fd4db2cc2eca3133a69ccaccceecc6110da

SHA256
b69b655fb27a5cd859922806a24b0ad9f9bfd87f418642c0c50dfb8c0de5469e

SHA512
af68398c63acbf1b889f72ee0b31735c069ee97520ba61c27c014728e1ae0961dad42f89fee87dd917a415f84a83a24f2da7d36f413792b424e28ecb60dc74d1

Download Submit
C:\Windows\System\XgVqudi.exe

Filesize
2.0MB

MD5
a5ae778192caba7344845c848f4d6031

SHA1
6eb5ac8f721f3ed4398a47a0510126ce3bae5068

SHA256
fdfb91a00e99dd25712c33c8317aec5e91fa2942b8ec63cea19d68cde3a7af74

SHA512
b59a862da2527e021b12fdcf1957c2d2e182866420ce37ac8249297ac73d6de7813057bcae5f6812399521bbaf7d6c96a37a408bae05faf5552f55e9f14b944a

Download Submit
C:\Windows\System\cjgkQCA.exe

Filesize
2.0MB

MD5
121efea6cef1fd01d70144a95c841e17

SHA1
1a2a73fc62b3b3844c49488b8ddd1682358c2537

SHA256
a9b420ba1296569777d939c38e238bc67c1aeb979e35557780aa5235c9d73f67

SHA512
110534e9151d1eb97e3318b822cad989a13b641494f2511d493f59e74712cf68c496a7e16b94546557fa108c6371434f5475c546a0bfb65c458534d949634522

Download Submit
C:\Windows\System\dwGSVOL.exe

Filesize
2.0MB

MD5
cc176cbaff72be3e733875769d31a2d0

SHA1
0cf93cb256ef8ac0c68d476c8fe9ccf1aed609dd

SHA256
f9e8e8b6c38e5415a83fa93022b41ab811e0a4afa55cfef74eaf61819a7e54d4

SHA512
99f132ae92e7c9fb0ef5a515bc2af80b1426df844d2848d5c7b75f39c811d1e937ea6bed94db800482538dff3d87a36fb8c5d08468f2d0fc25444cfffcefa38f

Download Submit
C:\Windows\System\eYKWlCP.exe

Filesize
2.0MB

MD5
bf08665a78fd61ff69595bb370cade7f

SHA1
29bd03e8d8b82ef12dc1c932ca6ae50d66f7f40a

SHA256
7b749a34ded64947531e5a6c6493a68894420989417f144f8997acb2368fe010

SHA512
67402e9922b6b20c36591305ef95c5c2517eac877bcd7de63343514b906db751899f129741a3682debd9c15aaf651c5335c76721c1cad73fed04029c8d6187aa

Download Submit
C:\Windows\System\ioQuYKH.exe

Filesize
2.0MB

MD5
249cbd2cd98756616413f2b57da3ee77

SHA1
50735bfd3de74f501e8dd91a46be101eaee91700

SHA256
ef17f3524df769cff10d8b7f147ac408a675613d2c6f268264479c438fefa9eb

SHA512
f7c81551735145345f8f76b145a441cd5eccb24cb6dece856dcd15321d5351f7255f71d7f2a78c862dbca622a84b69537bc83da4c59d20a840872cf10cffc9ae

Download Submit
C:\Windows\System\jPfhGlu.exe

Filesize
2.0MB

MD5
e833dcb431fd662df7557882577c96c7

SHA1
a71ccff1a75341c670b844049312f9485ea16763

SHA256
f6ee680efac6b92ac1518049e79f563161715c5350926dea3605f81a2e4e8f33

SHA512
5dfc8cd406adc2d3092d32f5a3d690654438f61286194646af63891be408cdb6cb65c5f26f5b2e290473245e5f4a070981b4ddee8874f7973eb1cb8415e5d0db

Download Submit
C:\Windows\System\jeRIJFq.exe

Filesize
2.0MB

MD5
b88f22ee84475e924561d3899f532efa

SHA1
08d56f9db9d7eec4e49d2429e2c303d4b214c2ff

SHA256
f3f270afda3c33cedcff3984ac842cefef1d8d2660d281a3611892c6193fc0a7

SHA512
19655f275aba1acf1ba3e527d8d94e9f9c7f192a1511464267e57cc2ae9394c3a37af41b105d5c974218952b17942cb479a3d5a13041b477409901520226f14f

Download Submit
C:\Windows\System\ohlwDPO.exe

Filesize
2.0MB

MD5
04bcb0c3a1233fd21c0252cc7717d929

SHA1
ef952c7e2e3ded3a50b00cb11351bfbcac551229

SHA256
5d63aa0fbf012ce5eb518b37d4c7934f05c1b6b394c27ecd8f8e7d6e5f4d81fb

SHA512
c661cd51fdf22810f7c09536d57448c728f4705959e2ed00edf2a5744ecca8999cf6fa8dd4892ab9792f154d3739b393e2886e444a64119b95ff2fd7a6029a21

Download Submit
C:\Windows\System\ojawFMz.exe

Filesize
2.0MB

MD5
d27278b6f28034849c03f76d405f2493

SHA1
447eb494b4484ac1b99ef3c03bdca26f07f3a9c2

SHA256
f45e6475131f61f163ff8449b49f0b156d614828a35b7d25987f75906213489a

SHA512
7cced32f07527c46b0919afb15e42119eeb81941d7426e8c80f59634e8812d6143b6af028e6e9d91dc266e1c411306feaf6cbf2127f52c43825e5bd80cf9ffc2

Download Submit
C:\Windows\System\pUUVruC.exe

Filesize
2.0MB

MD5
7128804d8b0be23a7f0eb16cd886ad23

SHA1
59cb1fc65e6874147159e863205d1578680692d2

SHA256
7594bc9bdecba214fc084cb6b6cab868c6801a64de5180f3b8cbc22483802123

SHA512
490e49311d31881d9e4f95d642edc25848df485d94c4b749cd57012c82665afb4afe8b29dff3be10a26c8626f4cdfd3fa419f0ecebaff39857b423d9c979dda8

Download Submit
C:\Windows\System\pcQOwZv.exe

Filesize
2.0MB

MD5
254ea8a7e4c64808676bba7efcdd4ec3

SHA1
7873edaa07152c0065254223478529532ae63a6c

SHA256
8645df8950f4d9034b226ab363e208f80f3de8732839afbf2e47db3d4a63617f

SHA512
e2bd53a6db1edd210b8d92f68a8acebc9747705ef91ff7c0a90e4464c15387d8453631b188c2b2c9f0e11a213e31a051330954cb26887f1723913f2ba74292d4

Download Submit
C:\Windows\System\qAVDISH.exe

Filesize
2.0MB

MD5
522b2b8d31a1b4107185be9d9c56e5a4

SHA1
d3fadf2ef546728f6798b95255038b27a6555f70

SHA256
d55f9198e3139e8580ac041133a9543f250e07fe4eedf94d32d579fa000c00dd

SHA512
7feffcf619a7821510b6399bd15e9ea1da7dd0d865943ebe3218cc6a41b84ba8bef5c3f2fa81fd38351cbca8a161fb97916a68d6affa6e125a871c92a0e5d8c9

Download Submit
C:\Windows\System\qfNJqJY.exe

Filesize
2.0MB

MD5
83eb5dd0d66391b9578c814ec583115e

SHA1
38e786e5e584ea953064ab6929c722203cc61389

SHA256
0767fbe1105f4b59ac96b4ceba9eaca3fa6c67b2779da2db4721be7d72a70534

SHA512
996806c92165dffd24563158f6d5082306476e7c38cbf54601f9a75627e2ed22ca49da10a143385bee9449722c6a1367fe9611d11cdc5eecf7081e405feb0131

Download Submit
C:\Windows\System\qgwoqFd.exe

Filesize
2.0MB

MD5
17f27a7e3bc0b7b422d73469fea23758

SHA1
7672049346079aac4073e68f27425b5b0655a19f

SHA256
5eb3f29b4312391a7d60b43e208bb25cb4a4104b26945d378726ff1d574abf72

SHA512
43bd93ec87d86fa05ca3e27182045e8ba3f2d5abf6846ca7496a06b3ecb9a68fb035caab18690da5994d629370283b87f7b0d460b759d914d72982168873ea60

Download Submit
C:\Windows\System\rGQdeBK.exe

Filesize
2.0MB

MD5
f53ea1b5f5709f50944948b579f27e54

SHA1
f031712ad4b69fc84055b03a9e0718c2ac8e0f90

SHA256
a2aad5672402455ccc60f1a8139b24db1ef10edfe0aad5ab1d849089fdb36838

SHA512
bcc3508efa378f7f165f7a607bb12c58b76bd5d12122967648219f303e810df709822ede9e51c3d2a67754e89169cd338976bea66a2bc01853be12dc8fa2ed99

Download Submit
C:\Windows\System\sDGvsYz.exe

Filesize
2.0MB

MD5
a01af47923d716f1cf36ced609fe084d

SHA1
16418cd06682d37cb52fe420e7242437b2eef54b

SHA256
1cf2d294d48f93f9276fb43bc63f1df5e95b829bf61877a50d72bb4cda249c69

SHA512
07d74f236e1b9e846417a918c31e43f4d4bf96eb1fc0071775885b089aef29c74a62ebe9acb32e9a47cb3c0f68c8a65ca6a1ec4a4799225c58a14d8896916d13

Download Submit
C:\Windows\System\uZDspsk.exe

Filesize
2.0MB

MD5
d444442c7da11e2fa6632d0ba5d08ebc

SHA1
4b190bded3eff7efc0d3f6741de31bcfe08821b3

SHA256
806ca4667320bcafe756331f0a7e0a44b1a9f98e08c6ac42d1a2dbd560f4b12e

SHA512
b0123e76b05f2da362b28cebb03a85698d66aaa8154e557246b84e9cd2c7307e0e283c1969d5ae2b3823854c6e8f5fe430e30eead54e13e8342f2e696e035d77

Download Submit
C:\Windows\System\xXIElkS.exe

Filesize
2.0MB

MD5
e5dca5a63229c86e34bb36473fd0f0da

SHA1
7fbdb2cf714b7a2474855f6fda4846aff96b0cae

SHA256
d1af6fcdf2e20c2159e1a27a14ec16efe484958597a5a2c1e08fa6bbf2d5495a

SHA512
a91c691428e3fb7a90aba5e9872b88a32d4bbbb32465df1ef2986288d421545ef909ce8378ea1dd06b99adfe189b70254764f0235cdc72280d666c9abcb39404

Download Submit
C:\Windows\System\yTJNJUQ.exe

Filesize
2.0MB

MD5
29c80ab0010d952a52121078d2859b0e

SHA1
b752ad5f2684d310dac9f053c447e5d18247a4cf

SHA256
58ee545c4228e38a954be1869648c51e10d1bc2198f6e5758ccd379a9a4f8aaf

SHA512
132ea771e2e247cdc42399eac7be4f3ef8b6c4bbd3d2785defd1c5bc552d140ae66ec8f8a6f78f3338d065641f52293e8ae25f0f6a27f4d2a41b2fbb26c7d08d

Download Submit
memory/60-199-0x00007FF603250000-0x00007FF6035A4000-memory.dmp

Filesize
3.3MB

Download
memory/60-2134-0x00007FF603250000-0x00007FF6035A4000-memory.dmp

Filesize
3.3MB

Download
memory/724-212-0x00007FF7565C0000-0x00007FF756914000-memory.dmp

Filesize
3.3MB

Download
memory/724-2136-0x00007FF7565C0000-0x00007FF756914000-memory.dmp

Filesize
3.3MB

Download
memory/864-2113-0x00007FF707720000-0x00007FF707A74000-memory.dmp

Filesize
3.3MB

Download
memory/864-81-0x00007FF707720000-0x00007FF707A74000-memory.dmp

Filesize
3.3MB

Download
memory/868-191-0x00007FF654C60000-0x00007FF654FB4000-memory.dmp

Filesize
3.3MB

Download
memory/868-2124-0x00007FF654C60000-0x00007FF654FB4000-memory.dmp

Filesize
3.3MB

Download
memory/900-2111-0x00007FF695630000-0x00007FF695984000-memory.dmp

Filesize
3.3MB

Download
memory/900-52-0x00007FF695630000-0x00007FF695984000-memory.dmp

Filesize
3.3MB

Download
memory/1064-206-0x00007FF79D170000-0x00007FF79D4C4000-memory.dmp

Filesize
3.3MB

Download
memory/1064-2137-0x00007FF79D170000-0x00007FF79D4C4000-memory.dmp

Filesize
3.3MB

Download
memory/1152-2112-0x00007FF680700000-0x00007FF680A54000-memory.dmp

Filesize
3.3MB

Download
memory/1152-27-0x00007FF680700000-0x00007FF680A54000-memory.dmp

Filesize
3.3MB

Download
memory/1284-207-0x00007FF716040000-0x00007FF716394000-memory.dmp

Filesize
3.3MB

Download
memory/1284-2116-0x00007FF716040000-0x00007FF716394000-memory.dmp

Filesize
3.3MB

Download
memory/1316-2138-0x00007FF6CD0E0000-0x00007FF6CD434000-memory.dmp

Filesize
3.3MB

Download
memory/1316-205-0x00007FF6CD0E0000-0x00007FF6CD434000-memory.dmp

Filesize
3.3MB

Download
memory/1356-19-0x00007FF61ABF0000-0x00007FF61AF44000-memory.dmp

Filesize
3.3MB

Download
memory/1356-2110-0x00007FF61ABF0000-0x00007FF61AF44000-memory.dmp

Filesize
3.3MB

Download
memory/1572-1-0x0000021A034B0000-0x0000021A034C0000-memory.dmp

Filesize
64KB

Download
memory/1572-0-0x00007FF729D10000-0x00007FF72A064000-memory.dmp

Filesize
3.3MB

Download
memory/1572-2107-0x00007FF729D10000-0x00007FF72A064000-memory.dmp

Filesize
3.3MB

Download
memory/1812-2128-0x00007FF608180000-0x00007FF6084D4000-memory.dmp

Filesize
3.3MB

Download
memory/1812-201-0x00007FF608180000-0x00007FF6084D4000-memory.dmp

Filesize
3.3MB

Download
memory/1920-131-0x00007FF77F530000-0x00007FF77F884000-memory.dmp

Filesize
3.3MB

Download
memory/1920-2115-0x00007FF77F530000-0x00007FF77F884000-memory.dmp

Filesize
3.3MB

Download
memory/2108-160-0x00007FF67ECC0000-0x00007FF67F014000-memory.dmp

Filesize
3.3MB

Download
memory/2108-2121-0x00007FF67ECC0000-0x00007FF67F014000-memory.dmp

Filesize
3.3MB

Download
memory/2212-182-0x00007FF7B23B0000-0x00007FF7B2704000-memory.dmp

Filesize
3.3MB

Download
memory/2212-2127-0x00007FF7B23B0000-0x00007FF7B2704000-memory.dmp

Filesize
3.3MB

Download
memory/2420-2109-0x00007FF7C85F0000-0x00007FF7C8944000-memory.dmp

Filesize
3.3MB

Download
memory/2420-2117-0x00007FF7C85F0000-0x00007FF7C8944000-memory.dmp

Filesize
3.3MB

Download
memory/2420-56-0x00007FF7C85F0000-0x00007FF7C8944000-memory.dmp

Filesize
3.3MB

Download
memory/2872-2132-0x00007FF77A9C0000-0x00007FF77AD14000-memory.dmp

Filesize
3.3MB

Download
memory/2872-210-0x00007FF77A9C0000-0x00007FF77AD14000-memory.dmp

Filesize
3.3MB

Download
memory/2940-2133-0x00007FF7B8470000-0x00007FF7B87C4000-memory.dmp

Filesize
3.3MB

Download
memory/2940-196-0x00007FF7B8470000-0x00007FF7B87C4000-memory.dmp

Filesize
3.3MB

Download
memory/2976-209-0x00007FF66D2C0000-0x00007FF66D614000-memory.dmp

Filesize
3.3MB

Download
memory/2976-2126-0x00007FF66D2C0000-0x00007FF66D614000-memory.dmp

Filesize
3.3MB

Download
memory/3100-183-0x00007FF6524B0000-0x00007FF652804000-memory.dmp

Filesize
3.3MB

Download
memory/3100-2122-0x00007FF6524B0000-0x00007FF652804000-memory.dmp

Filesize
3.3MB

Download
memory/3368-2135-0x00007FF779520000-0x00007FF779874000-memory.dmp

Filesize
3.3MB

Download
memory/3368-203-0x00007FF779520000-0x00007FF779874000-memory.dmp

Filesize
3.3MB

Download
memory/4168-2129-0x00007FF754EB0000-0x00007FF755204000-memory.dmp

Filesize
3.3MB

Download
memory/4168-200-0x00007FF754EB0000-0x00007FF755204000-memory.dmp

Filesize
3.3MB

Download
memory/4292-92-0x00007FF79ED50000-0x00007FF79F0A4000-memory.dmp

Filesize
3.3MB

Download
memory/4292-2120-0x00007FF79ED50000-0x00007FF79F0A4000-memory.dmp

Filesize
3.3MB

Download
memory/4432-211-0x00007FF65A350000-0x00007FF65A6A4000-memory.dmp

Filesize
3.3MB

Download
memory/4432-2130-0x00007FF65A350000-0x00007FF65A6A4000-memory.dmp

Filesize
3.3MB

Download
memory/4448-2125-0x00007FF60FBB0000-0x00007FF60FF04000-memory.dmp

Filesize
3.3MB

Download
memory/4448-204-0x00007FF60FBB0000-0x00007FF60FF04000-memory.dmp

Filesize
3.3MB

Download
memory/4468-202-0x00007FF601100000-0x00007FF601454000-memory.dmp

Filesize
3.3MB

Download
memory/4468-2131-0x00007FF601100000-0x00007FF601454000-memory.dmp

Filesize
3.3MB

Download
memory/4576-2119-0x00007FF66B9D0000-0x00007FF66BD24000-memory.dmp

Filesize
3.3MB

Download
memory/4576-111-0x00007FF66B9D0000-0x00007FF66BD24000-memory.dmp

Filesize
3.3MB

Download
memory/4708-32-0x00007FF723510000-0x00007FF723864000-memory.dmp

Filesize
3.3MB

Download
memory/4708-2108-0x00007FF723510000-0x00007FF723864000-memory.dmp

Filesize
3.3MB

Download
memory/4708-2114-0x00007FF723510000-0x00007FF723864000-memory.dmp

Filesize
3.3MB

Download
memory/4784-2118-0x00007FF7ADB10000-0x00007FF7ADE64000-memory.dmp

Filesize
3.3MB

Download
memory/4784-208-0x00007FF7ADB10000-0x00007FF7ADE64000-memory.dmp

Filesize
3.3MB

Download
memory/4948-184-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp

Filesize
3.3MB

Download
memory/4948-2123-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp

Filesize
3.3MB

Download