xmrig | 167c1722619586ff22aab7f52920dd971365928167d003cf9498926d3c9c351c

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
Size

2.7MB
MD5

eaa25840ca8318286581a7e5fd335ed0
SHA1

3bfc482191f7e9fcc75f1ffa24fb098beaf33fbf
SHA256

167c1722619586ff22aab7f52920dd971365928167d003cf9498926d3c9c351c
SHA512

17d72e23d092ad7fade99876dfa455995c039be76497790ef4f1790fd358b1287040b8e545bf5b3fabddfa0cba262261dceb3c1e36d5d748ea7001ebecd15819
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFof8GA9:BemTLkNdfE0pZrV56utgpPFoU

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1812-0-0x00007FF635920000-0x00007FF635C74000-memory.dmp	xmrig
behavioral2/files/0x0005000000023284-6.dat	xmrig
behavioral2/memory/4940-9-0x00007FF7E39F0000-0x00007FF7E3D44000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fa-8.dat	xmrig
behavioral2/files/0x00080000000233f6-15.dat	xmrig
behavioral2/files/0x00070000000233fd-29.dat	xmrig
behavioral2/files/0x00070000000233fc-30.dat	xmrig
behavioral2/memory/3724-36-0x00007FF78DFE0000-0x00007FF78E334000-memory.dmp	xmrig
behavioral2/memory/3860-38-0x00007FF62ABB0000-0x00007FF62AF04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023401-56.dat	xmrig
behavioral2/files/0x0007000000023403-65.dat	xmrig
behavioral2/files/0x0007000000023405-74.dat	xmrig
behavioral2/files/0x0007000000023408-86.dat	xmrig
behavioral2/files/0x000700000002340a-96.dat	xmrig
behavioral2/files/0x000700000002340c-110.dat	xmrig
behavioral2/files/0x0007000000023412-134.dat	xmrig
behavioral2/files/0x0007000000023419-169.dat	xmrig
behavioral2/memory/2888-586-0x00007FF6ACCB0000-0x00007FF6AD004000-memory.dmp	xmrig
behavioral2/memory/1032-589-0x00007FF777360000-0x00007FF7776B4000-memory.dmp	xmrig
behavioral2/memory/1988-588-0x00007FF70ADD0000-0x00007FF70B124000-memory.dmp	xmrig
behavioral2/memory/3996-590-0x00007FF626650000-0x00007FF6269A4000-memory.dmp	xmrig
behavioral2/memory/4920-593-0x00007FF7B7CA0000-0x00007FF7B7FF4000-memory.dmp	xmrig
behavioral2/memory/3344-595-0x00007FF76D350000-0x00007FF76D6A4000-memory.dmp	xmrig
behavioral2/memory/3240-594-0x00007FF780660000-0x00007FF7809B4000-memory.dmp	xmrig
behavioral2/memory/3548-592-0x00007FF7EE9D0000-0x00007FF7EED24000-memory.dmp	xmrig
behavioral2/memory/4816-596-0x00007FF704DE0000-0x00007FF705134000-memory.dmp	xmrig
behavioral2/memory/2804-597-0x00007FF6600D0000-0x00007FF660424000-memory.dmp	xmrig
behavioral2/memory/2872-599-0x00007FF6C22A0000-0x00007FF6C25F4000-memory.dmp	xmrig
behavioral2/memory/4336-598-0x00007FF7EDCF0000-0x00007FF7EE044000-memory.dmp	xmrig
behavioral2/memory/4580-601-0x00007FF699AD0000-0x00007FF699E24000-memory.dmp	xmrig
behavioral2/memory/3448-607-0x00007FF712300000-0x00007FF712654000-memory.dmp	xmrig
behavioral2/memory/3068-616-0x00007FF709BB0000-0x00007FF709F04000-memory.dmp	xmrig
behavioral2/memory/4604-613-0x00007FF7C7870000-0x00007FF7C7BC4000-memory.dmp	xmrig
behavioral2/memory/3916-608-0x00007FF60FC70000-0x00007FF60FFC4000-memory.dmp	xmrig
behavioral2/memory/2064-604-0x00007FF749E80000-0x00007FF74A1D4000-memory.dmp	xmrig
behavioral2/memory/2040-603-0x00007FF648C80000-0x00007FF648FD4000-memory.dmp	xmrig
behavioral2/memory/2664-602-0x00007FF720840000-0x00007FF720B94000-memory.dmp	xmrig
behavioral2/memory/1708-600-0x00007FF7D99E0000-0x00007FF7D9D34000-memory.dmp	xmrig
behavioral2/memory/1528-591-0x00007FF7CE8A0000-0x00007FF7CEBF4000-memory.dmp	xmrig
behavioral2/memory/4916-587-0x00007FF681C50000-0x00007FF681FA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-167.dat	xmrig
behavioral2/files/0x0007000000023418-164.dat	xmrig
behavioral2/files/0x0007000000023416-162.dat	xmrig
behavioral2/files/0x0007000000023415-157.dat	xmrig
behavioral2/files/0x0007000000023414-152.dat	xmrig
behavioral2/files/0x0007000000023413-147.dat	xmrig
behavioral2/files/0x0007000000023411-137.dat	xmrig
behavioral2/files/0x0007000000023410-132.dat	xmrig
behavioral2/files/0x000700000002340f-125.dat	xmrig
behavioral2/files/0x000700000002340e-119.dat	xmrig
behavioral2/files/0x000700000002340d-115.dat	xmrig
behavioral2/files/0x000700000002340b-104.dat	xmrig
behavioral2/files/0x0007000000023409-94.dat	xmrig
behavioral2/files/0x0007000000023407-84.dat	xmrig
behavioral2/files/0x0007000000023406-80.dat	xmrig
behavioral2/files/0x0007000000023404-70.dat	xmrig
behavioral2/files/0x0007000000023400-52.dat	xmrig
behavioral2/files/0x00070000000233ff-50.dat	xmrig
behavioral2/files/0x00070000000233fe-46.dat	xmrig
behavioral2/memory/3784-43-0x00007FF673620000-0x00007FF673974000-memory.dmp	xmrig
behavioral2/memory/4440-37-0x00007FF72A610000-0x00007FF72A964000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fb-28.dat	xmrig
behavioral2/memory/4136-24-0x00007FF657280000-0x00007FF6575D4000-memory.dmp	xmrig
behavioral2/memory/1812-2132-0x00007FF635920000-0x00007FF635C74000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4940	LDjujpN.exe
4136	UbSYDsl.exe
3724	iXqChgo.exe
3784	KgyiPID.exe
4440	hXomUrI.exe
2888	ulNXJTw.exe
3860	GlwSjsw.exe
3068	jgloudl.exe
4916	KYgZMzu.exe
1988	DJUPiEJ.exe
1032	koOGWCm.exe
3996	teFdQsF.exe
1528	jDRNsHq.exe
3548	xYgesXz.exe
4920	BhFeFdP.exe
3240	tpRhAea.exe
3344	ehAFHtp.exe
4816	ROZDQZf.exe
2804	PRiLWrV.exe
4336	EqNcZwK.exe
2872	bFSJzoi.exe
1708	pAhHbLq.exe
4580	TbRvgVM.exe
2664	fCZdNEy.exe
2040	kbnAeRU.exe
2064	eBBFRJu.exe
3448	TklPoHx.exe
3916	LaSlZOv.exe
4604	xbcUirE.exe
3560	vfbWBgx.exe
3624	uLjYRfM.exe
5012	nwfRHHt.exe
908	dWcwwXu.exe
5020	TeNzBuG.exe
1992	gAdshJl.exe
3340	kkTqAaJ.exe
1912	rHoWPBQ.exe
376	XbbFoRg.exe
3292	XJcUJiL.exe
1916	ygNUGeA.exe
2116	cWAJbya.exe
4024	cxTQTpk.exe
3304	WKJHTgt.exe
2632	kHCTNbD.exe
2972	BjNKJwT.exe
2516	KVmFfRc.exe
1540	PSydvmH.exe
4012	tKlYmZs.exe
2320	WoJTPkl.exe
1728	ESdpgid.exe
1152	ixalBzs.exe
4776	dusFvdt.exe
400	CeQAlMf.exe
3268	HerEeGq.exe
3760	QrQCUkF.exe
4948	iLtUPMm.exe
2252	TAnjFgA.exe
4300	DtpAhzi.exe
4268	ueLZXJd.exe
3692	UpfKyRB.exe
4760	bMkwwbZ.exe
1836	zssNSZt.exe
1644	CXYirxo.exe
1976	ESdspYR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1812-0-0x00007FF635920000-0x00007FF635C74000-memory.dmp	upx
behavioral2/files/0x0005000000023284-6.dat	upx
behavioral2/memory/4940-9-0x00007FF7E39F0000-0x00007FF7E3D44000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-8.dat	upx
behavioral2/files/0x00080000000233f6-15.dat	upx
behavioral2/files/0x00070000000233fd-29.dat	upx
behavioral2/files/0x00070000000233fc-30.dat	upx
behavioral2/memory/3724-36-0x00007FF78DFE0000-0x00007FF78E334000-memory.dmp	upx
behavioral2/memory/3860-38-0x00007FF62ABB0000-0x00007FF62AF04000-memory.dmp	upx
behavioral2/files/0x0007000000023401-56.dat	upx
behavioral2/files/0x0007000000023403-65.dat	upx
behavioral2/files/0x0007000000023405-74.dat	upx
behavioral2/files/0x0007000000023408-86.dat	upx
behavioral2/files/0x000700000002340a-96.dat	upx
behavioral2/files/0x000700000002340c-110.dat	upx
behavioral2/files/0x0007000000023412-134.dat	upx
behavioral2/files/0x0007000000023419-169.dat	upx
behavioral2/memory/2888-586-0x00007FF6ACCB0000-0x00007FF6AD004000-memory.dmp	upx
behavioral2/memory/1032-589-0x00007FF777360000-0x00007FF7776B4000-memory.dmp	upx
behavioral2/memory/1988-588-0x00007FF70ADD0000-0x00007FF70B124000-memory.dmp	upx
behavioral2/memory/3996-590-0x00007FF626650000-0x00007FF6269A4000-memory.dmp	upx
behavioral2/memory/4920-593-0x00007FF7B7CA0000-0x00007FF7B7FF4000-memory.dmp	upx
behavioral2/memory/3344-595-0x00007FF76D350000-0x00007FF76D6A4000-memory.dmp	upx
behavioral2/memory/3240-594-0x00007FF780660000-0x00007FF7809B4000-memory.dmp	upx
behavioral2/memory/3548-592-0x00007FF7EE9D0000-0x00007FF7EED24000-memory.dmp	upx
behavioral2/memory/4816-596-0x00007FF704DE0000-0x00007FF705134000-memory.dmp	upx
behavioral2/memory/2804-597-0x00007FF6600D0000-0x00007FF660424000-memory.dmp	upx
behavioral2/memory/2872-599-0x00007FF6C22A0000-0x00007FF6C25F4000-memory.dmp	upx
behavioral2/memory/4336-598-0x00007FF7EDCF0000-0x00007FF7EE044000-memory.dmp	upx
behavioral2/memory/4580-601-0x00007FF699AD0000-0x00007FF699E24000-memory.dmp	upx
behavioral2/memory/3448-607-0x00007FF712300000-0x00007FF712654000-memory.dmp	upx
behavioral2/memory/3068-616-0x00007FF709BB0000-0x00007FF709F04000-memory.dmp	upx
behavioral2/memory/4604-613-0x00007FF7C7870000-0x00007FF7C7BC4000-memory.dmp	upx
behavioral2/memory/3916-608-0x00007FF60FC70000-0x00007FF60FFC4000-memory.dmp	upx
behavioral2/memory/2064-604-0x00007FF749E80000-0x00007FF74A1D4000-memory.dmp	upx
behavioral2/memory/2040-603-0x00007FF648C80000-0x00007FF648FD4000-memory.dmp	upx
behavioral2/memory/2664-602-0x00007FF720840000-0x00007FF720B94000-memory.dmp	upx
behavioral2/memory/1708-600-0x00007FF7D99E0000-0x00007FF7D9D34000-memory.dmp	upx
behavioral2/memory/1528-591-0x00007FF7CE8A0000-0x00007FF7CEBF4000-memory.dmp	upx
behavioral2/memory/4916-587-0x00007FF681C50000-0x00007FF681FA4000-memory.dmp	upx
behavioral2/files/0x0007000000023417-167.dat	upx
behavioral2/files/0x0007000000023418-164.dat	upx
behavioral2/files/0x0007000000023416-162.dat	upx
behavioral2/files/0x0007000000023415-157.dat	upx
behavioral2/files/0x0007000000023414-152.dat	upx
behavioral2/files/0x0007000000023413-147.dat	upx
behavioral2/files/0x0007000000023411-137.dat	upx
behavioral2/files/0x0007000000023410-132.dat	upx
behavioral2/files/0x000700000002340f-125.dat	upx
behavioral2/files/0x000700000002340e-119.dat	upx
behavioral2/files/0x000700000002340d-115.dat	upx
behavioral2/files/0x000700000002340b-104.dat	upx
behavioral2/files/0x0007000000023409-94.dat	upx
behavioral2/files/0x0007000000023407-84.dat	upx
behavioral2/files/0x0007000000023406-80.dat	upx
behavioral2/files/0x0007000000023404-70.dat	upx
behavioral2/files/0x0007000000023400-52.dat	upx
behavioral2/files/0x00070000000233ff-50.dat	upx
behavioral2/files/0x00070000000233fe-46.dat	upx
behavioral2/memory/3784-43-0x00007FF673620000-0x00007FF673974000-memory.dmp	upx
behavioral2/memory/4440-37-0x00007FF72A610000-0x00007FF72A964000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-28.dat	upx
behavioral2/memory/4136-24-0x00007FF657280000-0x00007FF6575D4000-memory.dmp	upx
behavioral2/memory/1812-2132-0x00007FF635920000-0x00007FF635C74000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EoCXfBE.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\fwTUIIA.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\GOxKhIT.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\TklPoHx.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\cWAJbya.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\CEkZdwl.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\YARVQcW.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\kNjWhzX.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\InIxLEY.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\DUnFIlp.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ixalBzs.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\REiglKR.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\bqsrXgk.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ETKXNgc.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\xFzAigv.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\jPsuBtn.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\iViXYiZ.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\SvcZviW.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\SIQbMwC.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\hQRLcUH.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\yCinlYt.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\uJlDdAw.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\KVgBixh.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\iLtUPMm.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\LSixhLm.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\JYwWGve.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\DhXDhTL.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\REeDBmf.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\FynTLUq.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\aDuifJh.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\oWgpRFd.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ojbNphb.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\iZljjKt.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\YWvFIES.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\iXqChgo.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\LaSlZOv.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\IdHDDYi.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\OqystgA.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\AFWiaQk.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\BhFeFdP.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ecMrmHT.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\uEGoqkt.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\qLemKDx.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\bThGWwi.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\qaXzdVu.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\VgCmwOc.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\HPwLIDv.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\fmaSvpc.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\LKFNKdL.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\punAutB.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\kMFmOEV.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\yBGqXYE.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\OSZNIFv.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\KgKMMdw.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ESdpgid.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\pxUKxMn.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\sOqlNyf.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\IjSmDRd.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\LzPWStH.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\RegRBdl.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\XWOaENt.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\CNIEPhR.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\qsdrJVQ.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
File created	C:\Windows\System\VRKacfs.exe	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 4940	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	83
PID 1812 wrote to memory of 4940	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	83
PID 1812 wrote to memory of 4136	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	84
PID 1812 wrote to memory of 4136	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	84
PID 1812 wrote to memory of 3724	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	85
PID 1812 wrote to memory of 3724	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	85
PID 1812 wrote to memory of 3784	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	86
PID 1812 wrote to memory of 3784	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	86
PID 1812 wrote to memory of 4440	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	87
PID 1812 wrote to memory of 4440	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	87
PID 1812 wrote to memory of 2888	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	88
PID 1812 wrote to memory of 2888	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	88
PID 1812 wrote to memory of 3860	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	89
PID 1812 wrote to memory of 3860	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	89
PID 1812 wrote to memory of 3068	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	90
PID 1812 wrote to memory of 3068	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	90
PID 1812 wrote to memory of 4916	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	91
PID 1812 wrote to memory of 4916	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	91
PID 1812 wrote to memory of 1988	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	92
PID 1812 wrote to memory of 1988	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	92
PID 1812 wrote to memory of 1032	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	93
PID 1812 wrote to memory of 1032	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	93
PID 1812 wrote to memory of 3996	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	94
PID 1812 wrote to memory of 3996	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	94
PID 1812 wrote to memory of 1528	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	95
PID 1812 wrote to memory of 1528	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	95
PID 1812 wrote to memory of 3548	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	96
PID 1812 wrote to memory of 3548	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	96
PID 1812 wrote to memory of 4920	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	97
PID 1812 wrote to memory of 4920	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	97
PID 1812 wrote to memory of 3240	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	98
PID 1812 wrote to memory of 3240	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	98
PID 1812 wrote to memory of 3344	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	99
PID 1812 wrote to memory of 3344	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	99
PID 1812 wrote to memory of 4816	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	100
PID 1812 wrote to memory of 4816	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	100
PID 1812 wrote to memory of 2804	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	101
PID 1812 wrote to memory of 2804	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	101
PID 1812 wrote to memory of 4336	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	102
PID 1812 wrote to memory of 4336	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	102
PID 1812 wrote to memory of 2872	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	103
PID 1812 wrote to memory of 2872	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	103
PID 1812 wrote to memory of 1708	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	104
PID 1812 wrote to memory of 1708	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	104
PID 1812 wrote to memory of 4580	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	105
PID 1812 wrote to memory of 4580	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	105
PID 1812 wrote to memory of 2664	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	106
PID 1812 wrote to memory of 2664	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	106
PID 1812 wrote to memory of 2040	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	107
PID 1812 wrote to memory of 2040	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	107
PID 1812 wrote to memory of 2064	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	108
PID 1812 wrote to memory of 2064	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	108
PID 1812 wrote to memory of 3448	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	109
PID 1812 wrote to memory of 3448	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	109
PID 1812 wrote to memory of 3916	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	110
PID 1812 wrote to memory of 3916	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	110
PID 1812 wrote to memory of 4604	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	111
PID 1812 wrote to memory of 4604	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	111
PID 1812 wrote to memory of 3560	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	112
PID 1812 wrote to memory of 3560	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	112
PID 1812 wrote to memory of 3624	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	113
PID 1812 wrote to memory of 3624	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	113
PID 1812 wrote to memory of 5012	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	114
PID 1812 wrote to memory of 5012	1812	eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\eaa25840ca8318286581a7e5fd335ed0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\System\LDjujpN.exe
  C:\Windows\System\LDjujpN.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\UbSYDsl.exe
  C:\Windows\System\UbSYDsl.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\iXqChgo.exe
  C:\Windows\System\iXqChgo.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\KgyiPID.exe
  C:\Windows\System\KgyiPID.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\hXomUrI.exe
  C:\Windows\System\hXomUrI.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\ulNXJTw.exe
  C:\Windows\System\ulNXJTw.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\GlwSjsw.exe
  C:\Windows\System\GlwSjsw.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\jgloudl.exe
  C:\Windows\System\jgloudl.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\KYgZMzu.exe
  C:\Windows\System\KYgZMzu.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\DJUPiEJ.exe
  C:\Windows\System\DJUPiEJ.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\koOGWCm.exe
  C:\Windows\System\koOGWCm.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\teFdQsF.exe
  C:\Windows\System\teFdQsF.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\jDRNsHq.exe
  C:\Windows\System\jDRNsHq.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\xYgesXz.exe
  C:\Windows\System\xYgesXz.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\BhFeFdP.exe
  C:\Windows\System\BhFeFdP.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\tpRhAea.exe
  C:\Windows\System\tpRhAea.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\ehAFHtp.exe
  C:\Windows\System\ehAFHtp.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\ROZDQZf.exe
  C:\Windows\System\ROZDQZf.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\PRiLWrV.exe
  C:\Windows\System\PRiLWrV.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\EqNcZwK.exe
  C:\Windows\System\EqNcZwK.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\bFSJzoi.exe
  C:\Windows\System\bFSJzoi.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\pAhHbLq.exe
  C:\Windows\System\pAhHbLq.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\TbRvgVM.exe
  C:\Windows\System\TbRvgVM.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\fCZdNEy.exe
  C:\Windows\System\fCZdNEy.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\kbnAeRU.exe
  C:\Windows\System\kbnAeRU.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\eBBFRJu.exe
  C:\Windows\System\eBBFRJu.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\TklPoHx.exe
  C:\Windows\System\TklPoHx.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\LaSlZOv.exe
  C:\Windows\System\LaSlZOv.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\xbcUirE.exe
  C:\Windows\System\xbcUirE.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\vfbWBgx.exe
  C:\Windows\System\vfbWBgx.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\uLjYRfM.exe
  C:\Windows\System\uLjYRfM.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\nwfRHHt.exe
  C:\Windows\System\nwfRHHt.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\dWcwwXu.exe
  C:\Windows\System\dWcwwXu.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\TeNzBuG.exe
  C:\Windows\System\TeNzBuG.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\gAdshJl.exe
  C:\Windows\System\gAdshJl.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\kkTqAaJ.exe
  C:\Windows\System\kkTqAaJ.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\rHoWPBQ.exe
  C:\Windows\System\rHoWPBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\XbbFoRg.exe
  C:\Windows\System\XbbFoRg.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\XJcUJiL.exe
  C:\Windows\System\XJcUJiL.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\ygNUGeA.exe
  C:\Windows\System\ygNUGeA.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\cWAJbya.exe
  C:\Windows\System\cWAJbya.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\cxTQTpk.exe
  C:\Windows\System\cxTQTpk.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\WKJHTgt.exe
  C:\Windows\System\WKJHTgt.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\kHCTNbD.exe
  C:\Windows\System\kHCTNbD.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\BjNKJwT.exe
  C:\Windows\System\BjNKJwT.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\KVmFfRc.exe
  C:\Windows\System\KVmFfRc.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\PSydvmH.exe
  C:\Windows\System\PSydvmH.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\tKlYmZs.exe
  C:\Windows\System\tKlYmZs.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\WoJTPkl.exe
  C:\Windows\System\WoJTPkl.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\ESdpgid.exe
  C:\Windows\System\ESdpgid.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\ixalBzs.exe
  C:\Windows\System\ixalBzs.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\dusFvdt.exe
  C:\Windows\System\dusFvdt.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\CeQAlMf.exe
  C:\Windows\System\CeQAlMf.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\HerEeGq.exe
  C:\Windows\System\HerEeGq.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\QrQCUkF.exe
  C:\Windows\System\QrQCUkF.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\iLtUPMm.exe
  C:\Windows\System\iLtUPMm.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\TAnjFgA.exe
  C:\Windows\System\TAnjFgA.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\DtpAhzi.exe
  C:\Windows\System\DtpAhzi.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\ueLZXJd.exe
  C:\Windows\System\ueLZXJd.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\UpfKyRB.exe
  C:\Windows\System\UpfKyRB.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\bMkwwbZ.exe
  C:\Windows\System\bMkwwbZ.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\zssNSZt.exe
  C:\Windows\System\zssNSZt.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\CXYirxo.exe
  C:\Windows\System\CXYirxo.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ESdspYR.exe
  C:\Windows\System\ESdspYR.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\HlRkYIH.exe
  C:\Windows\System\HlRkYIH.exe
  2⤵
  PID:1660
- C:\Windows\System\aNWOPLl.exe
  C:\Windows\System\aNWOPLl.exe
  2⤵
  PID:2352
- C:\Windows\System\WBhhasp.exe
  C:\Windows\System\WBhhasp.exe
  2⤵
  PID:2228
- C:\Windows\System\qsdrJVQ.exe
  C:\Windows\System\qsdrJVQ.exe
  2⤵
  PID:4320
- C:\Windows\System\IiNZNcU.exe
  C:\Windows\System\IiNZNcU.exe
  2⤵
  PID:3360
- C:\Windows\System\zDFTkqB.exe
  C:\Windows\System\zDFTkqB.exe
  2⤵
  PID:4656
- C:\Windows\System\kQUjnGx.exe
  C:\Windows\System\kQUjnGx.exe
  2⤵
  PID:1928
- C:\Windows\System\gpsKljD.exe
  C:\Windows\System\gpsKljD.exe
  2⤵
  PID:3152
- C:\Windows\System\OVGgOiA.exe
  C:\Windows\System\OVGgOiA.exe
  2⤵
  PID:4968
- C:\Windows\System\yWcNOEu.exe
  C:\Windows\System\yWcNOEu.exe
  2⤵
  PID:3672
- C:\Windows\System\vOvZUSJ.exe
  C:\Windows\System\vOvZUSJ.exe
  2⤵
  PID:4100
- C:\Windows\System\CQKKVpE.exe
  C:\Windows\System\CQKKVpE.exe
  2⤵
  PID:3700
- C:\Windows\System\wNGeaYK.exe
  C:\Windows\System\wNGeaYK.exe
  2⤵
  PID:4016
- C:\Windows\System\QcmyQsz.exe
  C:\Windows\System\QcmyQsz.exe
  2⤵
  PID:1856
- C:\Windows\System\gpeakFy.exe
  C:\Windows\System\gpeakFy.exe
  2⤵
  PID:4176
- C:\Windows\System\vbrJyHE.exe
  C:\Windows\System\vbrJyHE.exe
  2⤵
  PID:4180
- C:\Windows\System\XewJtcl.exe
  C:\Windows\System\XewJtcl.exe
  2⤵
  PID:4060
- C:\Windows\System\JoAWuzy.exe
  C:\Windows\System\JoAWuzy.exe
  2⤵
  PID:3284
- C:\Windows\System\niFByLD.exe
  C:\Windows\System\niFByLD.exe
  2⤵
  PID:4436
- C:\Windows\System\HhJqfoI.exe
  C:\Windows\System\HhJqfoI.exe
  2⤵
  PID:1920
- C:\Windows\System\CTEwonf.exe
  C:\Windows\System\CTEwonf.exe
  2⤵
  PID:5148
- C:\Windows\System\KsnIjXR.exe
  C:\Windows\System\KsnIjXR.exe
  2⤵
  PID:5176
- C:\Windows\System\SiEjNcI.exe
  C:\Windows\System\SiEjNcI.exe
  2⤵
  PID:5204
- C:\Windows\System\BTfkxRI.exe
  C:\Windows\System\BTfkxRI.exe
  2⤵
  PID:5232
- C:\Windows\System\VYAKSBN.exe
  C:\Windows\System\VYAKSBN.exe
  2⤵
  PID:5260
- C:\Windows\System\UkRJUSL.exe
  C:\Windows\System\UkRJUSL.exe
  2⤵
  PID:5288
- C:\Windows\System\xcBwcTc.exe
  C:\Windows\System\xcBwcTc.exe
  2⤵
  PID:5312
- C:\Windows\System\iqJawdG.exe
  C:\Windows\System\iqJawdG.exe
  2⤵
  PID:5344
- C:\Windows\System\LyvbZzf.exe
  C:\Windows\System\LyvbZzf.exe
  2⤵
  PID:5372
- C:\Windows\System\LdBRSot.exe
  C:\Windows\System\LdBRSot.exe
  2⤵
  PID:5400
- C:\Windows\System\ZhDCNrq.exe
  C:\Windows\System\ZhDCNrq.exe
  2⤵
  PID:5424
- C:\Windows\System\RijJGOt.exe
  C:\Windows\System\RijJGOt.exe
  2⤵
  PID:5460
- C:\Windows\System\ZKMEgpe.exe
  C:\Windows\System\ZKMEgpe.exe
  2⤵
  PID:5484
- C:\Windows\System\tvRlyei.exe
  C:\Windows\System\tvRlyei.exe
  2⤵
  PID:5508
- C:\Windows\System\FynTLUq.exe
  C:\Windows\System\FynTLUq.exe
  2⤵
  PID:5540
- C:\Windows\System\clYRmTh.exe
  C:\Windows\System\clYRmTh.exe
  2⤵
  PID:5564
- C:\Windows\System\dcCfHoV.exe
  C:\Windows\System\dcCfHoV.exe
  2⤵
  PID:5596
- C:\Windows\System\HPwLIDv.exe
  C:\Windows\System\HPwLIDv.exe
  2⤵
  PID:5624
- C:\Windows\System\KcIuzVA.exe
  C:\Windows\System\KcIuzVA.exe
  2⤵
  PID:5652
- C:\Windows\System\onrCzwq.exe
  C:\Windows\System\onrCzwq.exe
  2⤵
  PID:5680
- C:\Windows\System\JTSJjWp.exe
  C:\Windows\System\JTSJjWp.exe
  2⤵
  PID:5708
- C:\Windows\System\ecMrmHT.exe
  C:\Windows\System\ecMrmHT.exe
  2⤵
  PID:5736
- C:\Windows\System\QxqjImG.exe
  C:\Windows\System\QxqjImG.exe
  2⤵
  PID:5764
- C:\Windows\System\yhCxAVr.exe
  C:\Windows\System\yhCxAVr.exe
  2⤵
  PID:5792
- C:\Windows\System\isNHPpn.exe
  C:\Windows\System\isNHPpn.exe
  2⤵
  PID:5820
- C:\Windows\System\CEkZdwl.exe
  C:\Windows\System\CEkZdwl.exe
  2⤵
  PID:5848
- C:\Windows\System\dYdbLhZ.exe
  C:\Windows\System\dYdbLhZ.exe
  2⤵
  PID:5872
- C:\Windows\System\SBYiDcw.exe
  C:\Windows\System\SBYiDcw.exe
  2⤵
  PID:5904
- C:\Windows\System\PjKGZWN.exe
  C:\Windows\System\PjKGZWN.exe
  2⤵
  PID:5928
- C:\Windows\System\vXbLLoE.exe
  C:\Windows\System\vXbLLoE.exe
  2⤵
  PID:5960
- C:\Windows\System\CVErSfG.exe
  C:\Windows\System\CVErSfG.exe
  2⤵
  PID:5988
- C:\Windows\System\fTxhosC.exe
  C:\Windows\System\fTxhosC.exe
  2⤵
  PID:6012
- C:\Windows\System\AOjUuNW.exe
  C:\Windows\System\AOjUuNW.exe
  2⤵
  PID:6044
- C:\Windows\System\AUWkGZY.exe
  C:\Windows\System\AUWkGZY.exe
  2⤵
  PID:6072
- C:\Windows\System\ZaenoRe.exe
  C:\Windows\System\ZaenoRe.exe
  2⤵
  PID:6096
- C:\Windows\System\srVfFlj.exe
  C:\Windows\System\srVfFlj.exe
  2⤵
  PID:6128
- C:\Windows\System\CsIxLhC.exe
  C:\Windows\System\CsIxLhC.exe
  2⤵
  PID:2544
- C:\Windows\System\DulxOhd.exe
  C:\Windows\System\DulxOhd.exe
  2⤵
  PID:4128
- C:\Windows\System\iagfbPi.exe
  C:\Windows\System\iagfbPi.exe
  2⤵
  PID:3232
- C:\Windows\System\kCyYbZZ.exe
  C:\Windows\System\kCyYbZZ.exe
  2⤵
  PID:532
- C:\Windows\System\VRKacfs.exe
  C:\Windows\System\VRKacfs.exe
  2⤵
  PID:5188
- C:\Windows\System\lnWNhVR.exe
  C:\Windows\System\lnWNhVR.exe
  2⤵
  PID:5248
- C:\Windows\System\EoCXfBE.exe
  C:\Windows\System\EoCXfBE.exe
  2⤵
  PID:5304
- C:\Windows\System\gFWFfxf.exe
  C:\Windows\System\gFWFfxf.exe
  2⤵
  PID:5384
- C:\Windows\System\yEnnNBf.exe
  C:\Windows\System\yEnnNBf.exe
  2⤵
  PID:5444
- C:\Windows\System\RtwfGGZ.exe
  C:\Windows\System\RtwfGGZ.exe
  2⤵
  PID:5504
- C:\Windows\System\cSSYxve.exe
  C:\Windows\System\cSSYxve.exe
  2⤵
  PID:5580
- C:\Windows\System\dDYVXUQ.exe
  C:\Windows\System\dDYVXUQ.exe
  2⤵
  PID:5640
- C:\Windows\System\UcPPltX.exe
  C:\Windows\System\UcPPltX.exe
  2⤵
  PID:5696
- C:\Windows\System\mBRMLPH.exe
  C:\Windows\System\mBRMLPH.exe
  2⤵
  PID:5776
- C:\Windows\System\YwPVDOU.exe
  C:\Windows\System\YwPVDOU.exe
  2⤵
  PID:5836
- C:\Windows\System\pYJUvxd.exe
  C:\Windows\System\pYJUvxd.exe
  2⤵
  PID:5892
- C:\Windows\System\wfYsZnw.exe
  C:\Windows\System\wfYsZnw.exe
  2⤵
  PID:5952
- C:\Windows\System\KaDuYVa.exe
  C:\Windows\System\KaDuYVa.exe
  2⤵
  PID:6028
- C:\Windows\System\oqFEEGs.exe
  C:\Windows\System\oqFEEGs.exe
  2⤵
  PID:6084
- C:\Windows\System\hpWhToh.exe
  C:\Windows\System\hpWhToh.exe
  2⤵
  PID:6140
- C:\Windows\System\hRlbtpi.exe
  C:\Windows\System\hRlbtpi.exe
  2⤵
  PID:632
- C:\Windows\System\VrdmzAd.exe
  C:\Windows\System\VrdmzAd.exe
  2⤵
  PID:5160
- C:\Windows\System\pqTnzvP.exe
  C:\Windows\System\pqTnzvP.exe
  2⤵
  PID:5300
- C:\Windows\System\tzQnHYq.exe
  C:\Windows\System\tzQnHYq.exe
  2⤵
  PID:5476
- C:\Windows\System\zrImXWL.exe
  C:\Windows\System\zrImXWL.exe
  2⤵
  PID:5556
- C:\Windows\System\soJXWpR.exe
  C:\Windows\System\soJXWpR.exe
  2⤵
  PID:5692
- C:\Windows\System\npqOVPc.exe
  C:\Windows\System\npqOVPc.exe
  2⤵
  PID:5812
- C:\Windows\System\ERIsIaA.exe
  C:\Windows\System\ERIsIaA.exe
  2⤵
  PID:716
- C:\Windows\System\aIcaxqA.exe
  C:\Windows\System\aIcaxqA.exe
  2⤵
  PID:6116
- C:\Windows\System\SIQbMwC.exe
  C:\Windows\System\SIQbMwC.exe
  2⤵
  PID:4840
- C:\Windows\System\EoDRcaq.exe
  C:\Windows\System\EoDRcaq.exe
  2⤵
  PID:5420
- C:\Windows\System\zfqudDJ.exe
  C:\Windows\System\zfqudDJ.exe
  2⤵
  PID:5616
- C:\Windows\System\ppYdfsg.exe
  C:\Windows\System\ppYdfsg.exe
  2⤵
  PID:5924
- C:\Windows\System\CSasZGn.exe
  C:\Windows\System\CSasZGn.exe
  2⤵
  PID:6164
- C:\Windows\System\rFyMrva.exe
  C:\Windows\System\rFyMrva.exe
  2⤵
  PID:6188
- C:\Windows\System\LHMUYpe.exe
  C:\Windows\System\LHMUYpe.exe
  2⤵
  PID:6220
- C:\Windows\System\GqcMnXS.exe
  C:\Windows\System\GqcMnXS.exe
  2⤵
  PID:6248
- C:\Windows\System\qsyBIdy.exe
  C:\Windows\System\qsyBIdy.exe
  2⤵
  PID:6276
- C:\Windows\System\PMSVuaB.exe
  C:\Windows\System\PMSVuaB.exe
  2⤵
  PID:6304
- C:\Windows\System\PSBvbyp.exe
  C:\Windows\System\PSBvbyp.exe
  2⤵
  PID:6332
- C:\Windows\System\ATjWCxl.exe
  C:\Windows\System\ATjWCxl.exe
  2⤵
  PID:6360
- C:\Windows\System\wqSVKpG.exe
  C:\Windows\System\wqSVKpG.exe
  2⤵
  PID:6388
- C:\Windows\System\HSbtsbv.exe
  C:\Windows\System\HSbtsbv.exe
  2⤵
  PID:6416
- C:\Windows\System\iLVytRv.exe
  C:\Windows\System\iLVytRv.exe
  2⤵
  PID:6444
- C:\Windows\System\XWhrKvm.exe
  C:\Windows\System\XWhrKvm.exe
  2⤵
  PID:6472
- C:\Windows\System\hPaGfbF.exe
  C:\Windows\System\hPaGfbF.exe
  2⤵
  PID:6500
- C:\Windows\System\QELkSqQ.exe
  C:\Windows\System\QELkSqQ.exe
  2⤵
  PID:6528
- C:\Windows\System\xlTbWHU.exe
  C:\Windows\System\xlTbWHU.exe
  2⤵
  PID:6556
- C:\Windows\System\QVjZcst.exe
  C:\Windows\System\QVjZcst.exe
  2⤵
  PID:6584
- C:\Windows\System\kpjOEWR.exe
  C:\Windows\System\kpjOEWR.exe
  2⤵
  PID:6612
- C:\Windows\System\iGBnUIK.exe
  C:\Windows\System\iGBnUIK.exe
  2⤵
  PID:6640
- C:\Windows\System\nWStYBk.exe
  C:\Windows\System\nWStYBk.exe
  2⤵
  PID:6668
- C:\Windows\System\czePEqr.exe
  C:\Windows\System\czePEqr.exe
  2⤵
  PID:6800
- C:\Windows\System\cQHuzJP.exe
  C:\Windows\System\cQHuzJP.exe
  2⤵
  PID:6828
- C:\Windows\System\uPcjmGw.exe
  C:\Windows\System\uPcjmGw.exe
  2⤵
  PID:6860
- C:\Windows\System\GiteoHn.exe
  C:\Windows\System\GiteoHn.exe
  2⤵
  PID:6888
- C:\Windows\System\KyUeYzR.exe
  C:\Windows\System\KyUeYzR.exe
  2⤵
  PID:6916
- C:\Windows\System\LmOxIej.exe
  C:\Windows\System\LmOxIej.exe
  2⤵
  PID:6940
- C:\Windows\System\PbIvuzH.exe
  C:\Windows\System\PbIvuzH.exe
  2⤵
  PID:6996
- C:\Windows\System\vxaLvxV.exe
  C:\Windows\System\vxaLvxV.exe
  2⤵
  PID:7024
- C:\Windows\System\eAPImeV.exe
  C:\Windows\System\eAPImeV.exe
  2⤵
  PID:7044
- C:\Windows\System\fmaSvpc.exe
  C:\Windows\System\fmaSvpc.exe
  2⤵
  PID:7072
- C:\Windows\System\sJBRlXl.exe
  C:\Windows\System\sJBRlXl.exe
  2⤵
  PID:7104
- C:\Windows\System\HyPVxXk.exe
  C:\Windows\System\HyPVxXk.exe
  2⤵
  PID:5532
- C:\Windows\System\rxYVeVO.exe
  C:\Windows\System\rxYVeVO.exe
  2⤵
  PID:3264
- C:\Windows\System\EgkFDIP.exe
  C:\Windows\System\EgkFDIP.exe
  2⤵
  PID:6176
- C:\Windows\System\ahvFRZW.exe
  C:\Windows\System\ahvFRZW.exe
  2⤵
  PID:5104
- C:\Windows\System\erBeFKO.exe
  C:\Windows\System\erBeFKO.exe
  2⤵
  PID:6268
- C:\Windows\System\gVGYXLT.exe
  C:\Windows\System\gVGYXLT.exe
  2⤵
  PID:6316
- C:\Windows\System\piHVuYr.exe
  C:\Windows\System\piHVuYr.exe
  2⤵
  PID:2112
- C:\Windows\System\ikTdUye.exe
  C:\Windows\System\ikTdUye.exe
  2⤵
  PID:6492
- C:\Windows\System\JeARLDA.exe
  C:\Windows\System\JeARLDA.exe
  2⤵
  PID:6576
- C:\Windows\System\krYTXcc.exe
  C:\Windows\System\krYTXcc.exe
  2⤵
  PID:6596
- C:\Windows\System\EvoXXhF.exe
  C:\Windows\System\EvoXXhF.exe
  2⤵
  PID:1284
- C:\Windows\System\OpYpXqq.exe
  C:\Windows\System\OpYpXqq.exe
  2⤵
  PID:6720
- C:\Windows\System\aLPhXWp.exe
  C:\Windows\System\aLPhXWp.exe
  2⤵
  PID:4376
- C:\Windows\System\UzjNHil.exe
  C:\Windows\System\UzjNHil.exe
  2⤵
  PID:6848
- C:\Windows\System\QLgJfyM.exe
  C:\Windows\System\QLgJfyM.exe
  2⤵
  PID:4704
- C:\Windows\System\fwTUIIA.exe
  C:\Windows\System\fwTUIIA.exe
  2⤵
  PID:6932
- C:\Windows\System\ghgkLkb.exe
  C:\Windows\System\ghgkLkb.exe
  2⤵
  PID:6968
- C:\Windows\System\ZNVBwmh.exe
  C:\Windows\System\ZNVBwmh.exe
  2⤵
  PID:7036
- C:\Windows\System\DkyuBFS.exe
  C:\Windows\System\DkyuBFS.exe
  2⤵
  PID:7164
- C:\Windows\System\YBFxjWe.exe
  C:\Windows\System\YBFxjWe.exe
  2⤵
  PID:2944
- C:\Windows\System\nvWlZRU.exe
  C:\Windows\System\nvWlZRU.exe
  2⤵
  PID:6296
- C:\Windows\System\LnhnMGd.exe
  C:\Windows\System\LnhnMGd.exe
  2⤵
  PID:6400
- C:\Windows\System\dbDokHc.exe
  C:\Windows\System\dbDokHc.exe
  2⤵
  PID:6600
- C:\Windows\System\dyUVAHh.exe
  C:\Windows\System\dyUVAHh.exe
  2⤵
  PID:7160
- C:\Windows\System\oCVRmiY.exe
  C:\Windows\System\oCVRmiY.exe
  2⤵
  PID:3224
- C:\Windows\System\qwjRyBj.exe
  C:\Windows\System\qwjRyBj.exe
  2⤵
  PID:6408
- C:\Windows\System\VmvMBPY.exe
  C:\Windows\System\VmvMBPY.exe
  2⤵
  PID:4676
- C:\Windows\System\saJCyzC.exe
  C:\Windows\System\saJCyzC.exe
  2⤵
  PID:4584
- C:\Windows\System\EcOMjmJ.exe
  C:\Windows\System\EcOMjmJ.exe
  2⤵
  PID:6880
- C:\Windows\System\zkNzkZw.exe
  C:\Windows\System\zkNzkZw.exe
  2⤵
  PID:7056
- C:\Windows\System\ZsGrRMt.exe
  C:\Windows\System\ZsGrRMt.exe
  2⤵
  PID:540
- C:\Windows\System\ofdffRu.exe
  C:\Windows\System\ofdffRu.exe
  2⤵
  PID:6568
- C:\Windows\System\PcubfoJ.exe
  C:\Windows\System\PcubfoJ.exe
  2⤵
  PID:4208
- C:\Windows\System\spcmoIN.exe
  C:\Windows\System\spcmoIN.exe
  2⤵
  PID:6428
- C:\Windows\System\UJyqkTr.exe
  C:\Windows\System\UJyqkTr.exe
  2⤵
  PID:6760
- C:\Windows\System\CFBHMnQ.exe
  C:\Windows\System\CFBHMnQ.exe
  2⤵
  PID:6740
- C:\Windows\System\yEvXYYg.exe
  C:\Windows\System\yEvXYYg.exe
  2⤵
  PID:6548
- C:\Windows\System\xtHpPvE.exe
  C:\Windows\System\xtHpPvE.exe
  2⤵
  PID:7084
- C:\Windows\System\LfPOfFk.exe
  C:\Windows\System\LfPOfFk.exe
  2⤵
  PID:7016
- C:\Windows\System\EWMqTOp.exe
  C:\Windows\System\EWMqTOp.exe
  2⤵
  PID:944
- C:\Windows\System\aYohzxc.exe
  C:\Windows\System\aYohzxc.exe
  2⤵
  PID:6744
- C:\Windows\System\REmdUfZ.exe
  C:\Windows\System\REmdUfZ.exe
  2⤵
  PID:6784
- C:\Windows\System\YXgpdUm.exe
  C:\Windows\System\YXgpdUm.exe
  2⤵
  PID:7188
- C:\Windows\System\ljUKDzr.exe
  C:\Windows\System\ljUKDzr.exe
  2⤵
  PID:7216
- C:\Windows\System\SUtEtGf.exe
  C:\Windows\System\SUtEtGf.exe
  2⤵
  PID:7244
- C:\Windows\System\BnxVsme.exe
  C:\Windows\System\BnxVsme.exe
  2⤵
  PID:7272
- C:\Windows\System\evTOMdQ.exe
  C:\Windows\System\evTOMdQ.exe
  2⤵
  PID:7300
- C:\Windows\System\YACwFJB.exe
  C:\Windows\System\YACwFJB.exe
  2⤵
  PID:7328
- C:\Windows\System\oNsPrtK.exe
  C:\Windows\System\oNsPrtK.exe
  2⤵
  PID:7356
- C:\Windows\System\ezAXVYj.exe
  C:\Windows\System\ezAXVYj.exe
  2⤵
  PID:7384
- C:\Windows\System\nUwoQsz.exe
  C:\Windows\System\nUwoQsz.exe
  2⤵
  PID:7412
- C:\Windows\System\ZupSCWa.exe
  C:\Windows\System\ZupSCWa.exe
  2⤵
  PID:7428
- C:\Windows\System\egmJJbD.exe
  C:\Windows\System\egmJJbD.exe
  2⤵
  PID:7468
- C:\Windows\System\fwlrUrG.exe
  C:\Windows\System\fwlrUrG.exe
  2⤵
  PID:7500
- C:\Windows\System\egMEOEf.exe
  C:\Windows\System\egMEOEf.exe
  2⤵
  PID:7528
- C:\Windows\System\dlrLvti.exe
  C:\Windows\System\dlrLvti.exe
  2⤵
  PID:7560
- C:\Windows\System\jyoeeXT.exe
  C:\Windows\System\jyoeeXT.exe
  2⤵
  PID:7588
- C:\Windows\System\chZfXOo.exe
  C:\Windows\System\chZfXOo.exe
  2⤵
  PID:7604
- C:\Windows\System\ksPdRMt.exe
  C:\Windows\System\ksPdRMt.exe
  2⤵
  PID:7644
- C:\Windows\System\ETKXNgc.exe
  C:\Windows\System\ETKXNgc.exe
  2⤵
  PID:7660
- C:\Windows\System\mnuhlsx.exe
  C:\Windows\System\mnuhlsx.exe
  2⤵
  PID:7688
- C:\Windows\System\hQRLcUH.exe
  C:\Windows\System\hQRLcUH.exe
  2⤵
  PID:7728
- C:\Windows\System\QIRwJYB.exe
  C:\Windows\System\QIRwJYB.exe
  2⤵
  PID:7748
- C:\Windows\System\uEGoqkt.exe
  C:\Windows\System\uEGoqkt.exe
  2⤵
  PID:7776
- C:\Windows\System\rSLpBoY.exe
  C:\Windows\System\rSLpBoY.exe
  2⤵
  PID:7792
- C:\Windows\System\vqgetXn.exe
  C:\Windows\System\vqgetXn.exe
  2⤵
  PID:7828
- C:\Windows\System\lkchSzk.exe
  C:\Windows\System\lkchSzk.exe
  2⤵
  PID:7864
- C:\Windows\System\LSixhLm.exe
  C:\Windows\System\LSixhLm.exe
  2⤵
  PID:7896
- C:\Windows\System\HQMWIWI.exe
  C:\Windows\System\HQMWIWI.exe
  2⤵
  PID:7924
- C:\Windows\System\QPDwdLN.exe
  C:\Windows\System\QPDwdLN.exe
  2⤵
  PID:7944
- C:\Windows\System\IdHDDYi.exe
  C:\Windows\System\IdHDDYi.exe
  2⤵
  PID:7968
- C:\Windows\System\qRHUeum.exe
  C:\Windows\System\qRHUeum.exe
  2⤵
  PID:7984
- C:\Windows\System\TVoIjot.exe
  C:\Windows\System\TVoIjot.exe
  2⤵
  PID:8012
- C:\Windows\System\FXhcVFf.exe
  C:\Windows\System\FXhcVFf.exe
  2⤵
  PID:8060
- C:\Windows\System\IjSmDRd.exe
  C:\Windows\System\IjSmDRd.exe
  2⤵
  PID:8084
- C:\Windows\System\YKwSXCa.exe
  C:\Windows\System\YKwSXCa.exe
  2⤵
  PID:8112
- C:\Windows\System\mXRBHtT.exe
  C:\Windows\System\mXRBHtT.exe
  2⤵
  PID:8148
- C:\Windows\System\hxwlQIo.exe
  C:\Windows\System\hxwlQIo.exe
  2⤵
  PID:8164
- C:\Windows\System\UpHUYja.exe
  C:\Windows\System\UpHUYja.exe
  2⤵
  PID:6896
- C:\Windows\System\IUhQZkC.exe
  C:\Windows\System\IUhQZkC.exe
  2⤵
  PID:7240
- C:\Windows\System\isMEiXk.exe
  C:\Windows\System\isMEiXk.exe
  2⤵
  PID:7284
- C:\Windows\System\kTyLsrQ.exe
  C:\Windows\System\kTyLsrQ.exe
  2⤵
  PID:7372
- C:\Windows\System\IwcKtKu.exe
  C:\Windows\System\IwcKtKu.exe
  2⤵
  PID:7444
- C:\Windows\System\iFilIHQ.exe
  C:\Windows\System\iFilIHQ.exe
  2⤵
  PID:7524
- C:\Windows\System\TFKOMMQ.exe
  C:\Windows\System\TFKOMMQ.exe
  2⤵
  PID:7556
- C:\Windows\System\qgfeJnY.exe
  C:\Windows\System\qgfeJnY.exe
  2⤵
  PID:7624
- C:\Windows\System\XzcvVHN.exe
  C:\Windows\System\XzcvVHN.exe
  2⤵
  PID:7676
- C:\Windows\System\crsMIZF.exe
  C:\Windows\System\crsMIZF.exe
  2⤵
  PID:7756
- C:\Windows\System\srBvwfd.exe
  C:\Windows\System\srBvwfd.exe
  2⤵
  PID:7800
- C:\Windows\System\DtKpSzA.exe
  C:\Windows\System\DtKpSzA.exe
  2⤵
  PID:7908
- C:\Windows\System\SXLEXeC.exe
  C:\Windows\System\SXLEXeC.exe
  2⤵
  PID:7960
- C:\Windows\System\mKlCSAn.exe
  C:\Windows\System\mKlCSAn.exe
  2⤵
  PID:8008
- C:\Windows\System\nwNpukU.exe
  C:\Windows\System\nwNpukU.exe
  2⤵
  PID:8032
- C:\Windows\System\YRLbuRU.exe
  C:\Windows\System\YRLbuRU.exe
  2⤵
  PID:8120
- C:\Windows\System\WYOJnFt.exe
  C:\Windows\System\WYOJnFt.exe
  2⤵
  PID:8180
- C:\Windows\System\wSKXSPn.exe
  C:\Windows\System\wSKXSPn.exe
  2⤵
  PID:7320
- C:\Windows\System\DoFvjmJ.exe
  C:\Windows\System\DoFvjmJ.exe
  2⤵
  PID:7584
- C:\Windows\System\teUzSzL.exe
  C:\Windows\System\teUzSzL.exe
  2⤵
  PID:7720
- C:\Windows\System\cDOrPbS.exe
  C:\Windows\System\cDOrPbS.exe
  2⤵
  PID:7852
- C:\Windows\System\WzOVMLu.exe
  C:\Windows\System\WzOVMLu.exe
  2⤵
  PID:7976
- C:\Windows\System\ApaPRwv.exe
  C:\Windows\System\ApaPRwv.exe
  2⤵
  PID:8160
- C:\Windows\System\lmbZxDa.exe
  C:\Windows\System\lmbZxDa.exe
  2⤵
  PID:7464
- C:\Windows\System\TqDIiyd.exe
  C:\Windows\System\TqDIiyd.exe
  2⤵
  PID:7768
- C:\Windows\System\TpPnpFc.exe
  C:\Windows\System\TpPnpFc.exe
  2⤵
  PID:7952
- C:\Windows\System\uolSKJj.exe
  C:\Windows\System\uolSKJj.exe
  2⤵
  PID:7812
- C:\Windows\System\YGxJrTe.exe
  C:\Windows\System\YGxJrTe.exe
  2⤵
  PID:7228
- C:\Windows\System\AqFPuIx.exe
  C:\Windows\System\AqFPuIx.exe
  2⤵
  PID:8216
- C:\Windows\System\sraKMWb.exe
  C:\Windows\System\sraKMWb.exe
  2⤵
  PID:8244
- C:\Windows\System\yCinlYt.exe
  C:\Windows\System\yCinlYt.exe
  2⤵
  PID:8272
- C:\Windows\System\debocuC.exe
  C:\Windows\System\debocuC.exe
  2⤵
  PID:8312
- C:\Windows\System\ywMAZlN.exe
  C:\Windows\System\ywMAZlN.exe
  2⤵
  PID:8340
- C:\Windows\System\zENRtKo.exe
  C:\Windows\System\zENRtKo.exe
  2⤵
  PID:8356
- C:\Windows\System\bsXyzQH.exe
  C:\Windows\System\bsXyzQH.exe
  2⤵
  PID:8372
- C:\Windows\System\DZZiTjj.exe
  C:\Windows\System\DZZiTjj.exe
  2⤵
  PID:8388
- C:\Windows\System\iJOQDnI.exe
  C:\Windows\System\iJOQDnI.exe
  2⤵
  PID:8448
- C:\Windows\System\hbMjHkS.exe
  C:\Windows\System\hbMjHkS.exe
  2⤵
  PID:8468
- C:\Windows\System\QaliSHc.exe
  C:\Windows\System\QaliSHc.exe
  2⤵
  PID:8488
- C:\Windows\System\aDuifJh.exe
  C:\Windows\System\aDuifJh.exe
  2⤵
  PID:8528
- C:\Windows\System\REiglKR.exe
  C:\Windows\System\REiglKR.exe
  2⤵
  PID:8556
- C:\Windows\System\rURFsXw.exe
  C:\Windows\System\rURFsXw.exe
  2⤵
  PID:8572
- C:\Windows\System\JwgAcyh.exe
  C:\Windows\System\JwgAcyh.exe
  2⤵
  PID:8608
- C:\Windows\System\QAidbqQ.exe
  C:\Windows\System\QAidbqQ.exe
  2⤵
  PID:8648
- C:\Windows\System\tkqVcTj.exe
  C:\Windows\System\tkqVcTj.exe
  2⤵
  PID:8676
- C:\Windows\System\iitOmUJ.exe
  C:\Windows\System\iitOmUJ.exe
  2⤵
  PID:8704
- C:\Windows\System\gkmYZKS.exe
  C:\Windows\System\gkmYZKS.exe
  2⤵
  PID:8720
- C:\Windows\System\oWgpRFd.exe
  C:\Windows\System\oWgpRFd.exe
  2⤵
  PID:8752
- C:\Windows\System\xHLcbFE.exe
  C:\Windows\System\xHLcbFE.exe
  2⤵
  PID:8776
- C:\Windows\System\eXAMgHY.exe
  C:\Windows\System\eXAMgHY.exe
  2⤵
  PID:8804
- C:\Windows\System\nZoVqyg.exe
  C:\Windows\System\nZoVqyg.exe
  2⤵
  PID:8832
- C:\Windows\System\mLgsyaa.exe
  C:\Windows\System\mLgsyaa.exe
  2⤵
  PID:8872
- C:\Windows\System\GTRbDVx.exe
  C:\Windows\System\GTRbDVx.exe
  2⤵
  PID:8904
- C:\Windows\System\ttgNxqt.exe
  C:\Windows\System\ttgNxqt.exe
  2⤵
  PID:8932
- C:\Windows\System\CBmrHsw.exe
  C:\Windows\System\CBmrHsw.exe
  2⤵
  PID:8948
- C:\Windows\System\AiOUtzu.exe
  C:\Windows\System\AiOUtzu.exe
  2⤵
  PID:8976
- C:\Windows\System\OAIZUjX.exe
  C:\Windows\System\OAIZUjX.exe
  2⤵
  PID:9016
- C:\Windows\System\UiXowkj.exe
  C:\Windows\System\UiXowkj.exe
  2⤵
  PID:9032
- C:\Windows\System\BCqPZya.exe
  C:\Windows\System\BCqPZya.exe
  2⤵
  PID:9072
- C:\Windows\System\oymXQlf.exe
  C:\Windows\System\oymXQlf.exe
  2⤵
  PID:9088
- C:\Windows\System\ghdwuco.exe
  C:\Windows\System\ghdwuco.exe
  2⤵
  PID:9116
- C:\Windows\System\PlGiOZK.exe
  C:\Windows\System\PlGiOZK.exe
  2⤵
  PID:9156
- C:\Windows\System\NSPTPfn.exe
  C:\Windows\System\NSPTPfn.exe
  2⤵
  PID:9172
- C:\Windows\System\rtvhkll.exe
  C:\Windows\System\rtvhkll.exe
  2⤵
  PID:9212
- C:\Windows\System\rzdoaLB.exe
  C:\Windows\System\rzdoaLB.exe
  2⤵
  PID:8252
- C:\Windows\System\AQcSzLG.exe
  C:\Windows\System\AQcSzLG.exe
  2⤵
  PID:8264
- C:\Windows\System\WpdCouB.exe
  C:\Windows\System\WpdCouB.exe
  2⤵
  PID:8352
- C:\Windows\System\TdyPcjA.exe
  C:\Windows\System\TdyPcjA.exe
  2⤵
  PID:8384
- C:\Windows\System\iGbUPjp.exe
  C:\Windows\System\iGbUPjp.exe
  2⤵
  PID:8464
- C:\Windows\System\cnBdcLl.exe
  C:\Windows\System\cnBdcLl.exe
  2⤵
  PID:8512
- C:\Windows\System\iDNALJh.exe
  C:\Windows\System\iDNALJh.exe
  2⤵
  PID:8564
- C:\Windows\System\VKCVlcr.exe
  C:\Windows\System\VKCVlcr.exe
  2⤵
  PID:8664
- C:\Windows\System\krVfflM.exe
  C:\Windows\System\krVfflM.exe
  2⤵
  PID:8716
- C:\Windows\System\lYVxauD.exe
  C:\Windows\System\lYVxauD.exe
  2⤵
  PID:8800
- C:\Windows\System\AJuDlxp.exe
  C:\Windows\System\AJuDlxp.exe
  2⤵
  PID:8856
- C:\Windows\System\zvJZWTT.exe
  C:\Windows\System\zvJZWTT.exe
  2⤵
  PID:8944
- C:\Windows\System\bqsrXgk.exe
  C:\Windows\System\bqsrXgk.exe
  2⤵
  PID:9004
- C:\Windows\System\ojbNphb.exe
  C:\Windows\System\ojbNphb.exe
  2⤵
  PID:9048
- C:\Windows\System\kAuDKlk.exe
  C:\Windows\System\kAuDKlk.exe
  2⤵
  PID:9104
- C:\Windows\System\qIwvSUU.exe
  C:\Windows\System\qIwvSUU.exe
  2⤵
  PID:9192
- C:\Windows\System\OUHnhJH.exe
  C:\Windows\System\OUHnhJH.exe
  2⤵
  PID:8308
- C:\Windows\System\dhzUzba.exe
  C:\Windows\System\dhzUzba.exe
  2⤵
  PID:8364
- C:\Windows\System\rqxXWIx.exe
  C:\Windows\System\rqxXWIx.exe
  2⤵
  PID:8428
- C:\Windows\System\RHHycMv.exe
  C:\Windows\System\RHHycMv.exe
  2⤵
  PID:8768
- C:\Windows\System\AeVLgMB.exe
  C:\Windows\System\AeVLgMB.exe
  2⤵
  PID:8916
- C:\Windows\System\qTkmfwL.exe
  C:\Windows\System\qTkmfwL.exe
  2⤵
  PID:8992
- C:\Windows\System\ZuksvTk.exe
  C:\Windows\System\ZuksvTk.exe
  2⤵
  PID:9132
- C:\Windows\System\KBJMbHP.exe
  C:\Windows\System\KBJMbHP.exe
  2⤵
  PID:8440
- C:\Windows\System\GNETKKy.exe
  C:\Windows\System\GNETKKy.exe
  2⤵
  PID:8692
- C:\Windows\System\RwlWsGP.exe
  C:\Windows\System\RwlWsGP.exe
  2⤵
  PID:9184
- C:\Windows\System\LfnODUu.exe
  C:\Windows\System\LfnODUu.exe
  2⤵
  PID:8960
- C:\Windows\System\PHwWCiu.exe
  C:\Windows\System\PHwWCiu.exe
  2⤵
  PID:9052
- C:\Windows\System\hruNujQ.exe
  C:\Windows\System\hruNujQ.exe
  2⤵
  PID:9240
- C:\Windows\System\bNragCa.exe
  C:\Windows\System\bNragCa.exe
  2⤵
  PID:9256
- C:\Windows\System\bwJvihv.exe
  C:\Windows\System\bwJvihv.exe
  2⤵
  PID:9292
- C:\Windows\System\QTLlHZK.exe
  C:\Windows\System\QTLlHZK.exe
  2⤵
  PID:9324
- C:\Windows\System\EYoiXgL.exe
  C:\Windows\System\EYoiXgL.exe
  2⤵
  PID:9364
- C:\Windows\System\cIrfRyY.exe
  C:\Windows\System\cIrfRyY.exe
  2⤵
  PID:9380
- C:\Windows\System\LEnsubY.exe
  C:\Windows\System\LEnsubY.exe
  2⤵
  PID:9408
- C:\Windows\System\rLRWCbs.exe
  C:\Windows\System\rLRWCbs.exe
  2⤵
  PID:9448
- C:\Windows\System\ygaAoGF.exe
  C:\Windows\System\ygaAoGF.exe
  2⤵
  PID:9476
- C:\Windows\System\xrrdiHx.exe
  C:\Windows\System\xrrdiHx.exe
  2⤵
  PID:9504
- C:\Windows\System\ctUpHmH.exe
  C:\Windows\System\ctUpHmH.exe
  2⤵
  PID:9532
- C:\Windows\System\NFYQgir.exe
  C:\Windows\System\NFYQgir.exe
  2⤵
  PID:9560
- C:\Windows\System\cAPkNFQ.exe
  C:\Windows\System\cAPkNFQ.exe
  2⤵
  PID:9588
- C:\Windows\System\kzrIqGx.exe
  C:\Windows\System\kzrIqGx.exe
  2⤵
  PID:9616
- C:\Windows\System\IUmKAeE.exe
  C:\Windows\System\IUmKAeE.exe
  2⤵
  PID:9632
- C:\Windows\System\boWBjli.exe
  C:\Windows\System\boWBjli.exe
  2⤵
  PID:9688
- C:\Windows\System\fRGbRKR.exe
  C:\Windows\System\fRGbRKR.exe
  2⤵
  PID:9716
- C:\Windows\System\dKCpadB.exe
  C:\Windows\System\dKCpadB.exe
  2⤵
  PID:9732
- C:\Windows\System\lGaVdxG.exe
  C:\Windows\System\lGaVdxG.exe
  2⤵
  PID:9768
- C:\Windows\System\gPGBRDD.exe
  C:\Windows\System\gPGBRDD.exe
  2⤵
  PID:9788
- C:\Windows\System\kZRlSkd.exe
  C:\Windows\System\kZRlSkd.exe
  2⤵
  PID:9824
- C:\Windows\System\VWtBOIT.exe
  C:\Windows\System\VWtBOIT.exe
  2⤵
  PID:9884
- C:\Windows\System\IynwPwE.exe
  C:\Windows\System\IynwPwE.exe
  2⤵
  PID:9900
- C:\Windows\System\vcHgisT.exe
  C:\Windows\System\vcHgisT.exe
  2⤵
  PID:9920
- C:\Windows\System\YARVQcW.exe
  C:\Windows\System\YARVQcW.exe
  2⤵
  PID:9952
- C:\Windows\System\MCLgjIM.exe
  C:\Windows\System\MCLgjIM.exe
  2⤵
  PID:10004
- C:\Windows\System\IGEJHTO.exe
  C:\Windows\System\IGEJHTO.exe
  2⤵
  PID:10020
- C:\Windows\System\RoHKvvY.exe
  C:\Windows\System\RoHKvvY.exe
  2⤵
  PID:10048
- C:\Windows\System\SXHJOcK.exe
  C:\Windows\System\SXHJOcK.exe
  2⤵
  PID:10088
- C:\Windows\System\RTrtbMW.exe
  C:\Windows\System\RTrtbMW.exe
  2⤵
  PID:10116
- C:\Windows\System\MitAVIH.exe
  C:\Windows\System\MitAVIH.exe
  2⤵
  PID:10144
- C:\Windows\System\GBqmYOp.exe
  C:\Windows\System\GBqmYOp.exe
  2⤵
  PID:10172
- C:\Windows\System\llaeTgW.exe
  C:\Windows\System\llaeTgW.exe
  2⤵
  PID:10188
- C:\Windows\System\XihBUlt.exe
  C:\Windows\System\XihBUlt.exe
  2⤵
  PID:10224
- C:\Windows\System\CiFCsjJ.exe
  C:\Windows\System\CiFCsjJ.exe
  2⤵
  PID:9228
- C:\Windows\System\BjwLiXn.exe
  C:\Windows\System\BjwLiXn.exe
  2⤵
  PID:9320
- C:\Windows\System\BuPdYAe.exe
  C:\Windows\System\BuPdYAe.exe
  2⤵
  PID:9348
- C:\Windows\System\vUGUqjj.exe
  C:\Windows\System\vUGUqjj.exe
  2⤵
  PID:9444
- C:\Windows\System\GdYoQlu.exe
  C:\Windows\System\GdYoQlu.exe
  2⤵
  PID:9520
- C:\Windows\System\HjCHJQC.exe
  C:\Windows\System\HjCHJQC.exe
  2⤵
  PID:9584
- C:\Windows\System\kGHSMAc.exe
  C:\Windows\System\kGHSMAc.exe
  2⤵
  PID:9648
- C:\Windows\System\WkajrQe.exe
  C:\Windows\System\WkajrQe.exe
  2⤵
  PID:9724
- C:\Windows\System\EyUfjRI.exe
  C:\Windows\System\EyUfjRI.exe
  2⤵
  PID:9816
- C:\Windows\System\FPPaTKN.exe
  C:\Windows\System\FPPaTKN.exe
  2⤵
  PID:9844
- C:\Windows\System\UDqwxmQ.exe
  C:\Windows\System\UDqwxmQ.exe
  2⤵
  PID:9948
- C:\Windows\System\NRwCQoO.exe
  C:\Windows\System\NRwCQoO.exe
  2⤵
  PID:10012
- C:\Windows\System\FqZaAWJ.exe
  C:\Windows\System\FqZaAWJ.exe
  2⤵
  PID:10080
- C:\Windows\System\xkLjvRQ.exe
  C:\Windows\System\xkLjvRQ.exe
  2⤵
  PID:10140
- C:\Windows\System\RSLdiny.exe
  C:\Windows\System\RSLdiny.exe
  2⤵
  PID:10232
- C:\Windows\System\LzPWStH.exe
  C:\Windows\System\LzPWStH.exe
  2⤵
  PID:9280
- C:\Windows\System\QEseGzn.exe
  C:\Windows\System\QEseGzn.exe
  2⤵
  PID:9488
- C:\Windows\System\geGZtwc.exe
  C:\Windows\System\geGZtwc.exe
  2⤵
  PID:9628
- C:\Windows\System\kNjWhzX.exe
  C:\Windows\System\kNjWhzX.exe
  2⤵
  PID:9804
- C:\Windows\System\mYwqDdT.exe
  C:\Windows\System\mYwqDdT.exe
  2⤵
  PID:9980
- C:\Windows\System\UufFcyd.exe
  C:\Windows\System\UufFcyd.exe
  2⤵
  PID:10132
- C:\Windows\System\XdCaYDY.exe
  C:\Windows\System\XdCaYDY.exe
  2⤵
  PID:9268
- C:\Windows\System\kwpyPtg.exe
  C:\Windows\System\kwpyPtg.exe
  2⤵
  PID:9704
- C:\Windows\System\nJVSQwE.exe
  C:\Windows\System\nJVSQwE.exe
  2⤵
  PID:10064
- C:\Windows\System\FwlXhIf.exe
  C:\Windows\System\FwlXhIf.exe
  2⤵
  PID:9608
- C:\Windows\System\PScCHcg.exe
  C:\Windows\System\PScCHcg.exe
  2⤵
  PID:9908
- C:\Windows\System\gdDfCAq.exe
  C:\Windows\System\gdDfCAq.exe
  2⤵
  PID:10268
- C:\Windows\System\RHeGfJJ.exe
  C:\Windows\System\RHeGfJJ.exe
  2⤵
  PID:10296
- C:\Windows\System\InIxLEY.exe
  C:\Windows\System\InIxLEY.exe
  2⤵
  PID:10324
- C:\Windows\System\UEaAyCH.exe
  C:\Windows\System\UEaAyCH.exe
  2⤵
  PID:10352
- C:\Windows\System\OWquNjq.exe
  C:\Windows\System\OWquNjq.exe
  2⤵
  PID:10380
- C:\Windows\System\XmRkfWW.exe
  C:\Windows\System\XmRkfWW.exe
  2⤵
  PID:10408
- C:\Windows\System\YaJpfUA.exe
  C:\Windows\System\YaJpfUA.exe
  2⤵
  PID:10452
- C:\Windows\System\RegRBdl.exe
  C:\Windows\System\RegRBdl.exe
  2⤵
  PID:10480
- C:\Windows\System\pxUKxMn.exe
  C:\Windows\System\pxUKxMn.exe
  2⤵
  PID:10508
- C:\Windows\System\JYwWGve.exe
  C:\Windows\System\JYwWGve.exe
  2⤵
  PID:10564
- C:\Windows\System\vHBmMSc.exe
  C:\Windows\System\vHBmMSc.exe
  2⤵
  PID:10612
- C:\Windows\System\VFJvVeH.exe
  C:\Windows\System\VFJvVeH.exe
  2⤵
  PID:10644
- C:\Windows\System\fRXHFti.exe
  C:\Windows\System\fRXHFti.exe
  2⤵
  PID:10676
- C:\Windows\System\qAVFQRI.exe
  C:\Windows\System\qAVFQRI.exe
  2⤵
  PID:10704
- C:\Windows\System\nbLRuCT.exe
  C:\Windows\System\nbLRuCT.exe
  2⤵
  PID:10736
- C:\Windows\System\SUIkPsR.exe
  C:\Windows\System\SUIkPsR.exe
  2⤵
  PID:10784
- C:\Windows\System\FVviKzF.exe
  C:\Windows\System\FVviKzF.exe
  2⤵
  PID:10856
- C:\Windows\System\DWEMgET.exe
  C:\Windows\System\DWEMgET.exe
  2⤵
  PID:10888
- C:\Windows\System\DuSvuyK.exe
  C:\Windows\System\DuSvuyK.exe
  2⤵
  PID:10924
- C:\Windows\System\pDmJwSJ.exe
  C:\Windows\System\pDmJwSJ.exe
  2⤵
  PID:10944
- C:\Windows\System\GZIJWoa.exe
  C:\Windows\System\GZIJWoa.exe
  2⤵
  PID:10972
- C:\Windows\System\IREWBap.exe
  C:\Windows\System\IREWBap.exe
  2⤵
  PID:11012
- C:\Windows\System\QgVihfj.exe
  C:\Windows\System\QgVihfj.exe
  2⤵
  PID:11040
- C:\Windows\System\dFcCHMI.exe
  C:\Windows\System\dFcCHMI.exe
  2⤵
  PID:11068
- C:\Windows\System\mgbXhpH.exe
  C:\Windows\System\mgbXhpH.exe
  2⤵
  PID:11084
- C:\Windows\System\vlqUSnB.exe
  C:\Windows\System\vlqUSnB.exe
  2⤵
  PID:11112
- C:\Windows\System\ppTymun.exe
  C:\Windows\System\ppTymun.exe
  2⤵
  PID:11144
- C:\Windows\System\yFFowwV.exe
  C:\Windows\System\yFFowwV.exe
  2⤵
  PID:11180
- C:\Windows\System\DPVmyfP.exe
  C:\Windows\System\DPVmyfP.exe
  2⤵
  PID:11208
- C:\Windows\System\fJkurbP.exe
  C:\Windows\System\fJkurbP.exe
  2⤵
  PID:11236
- C:\Windows\System\xjJQsdW.exe
  C:\Windows\System\xjJQsdW.exe
  2⤵
  PID:9436
- C:\Windows\System\nQhspMV.exe
  C:\Windows\System\nQhspMV.exe
  2⤵
  PID:10308
- C:\Windows\System\wSbahDC.exe
  C:\Windows\System\wSbahDC.exe
  2⤵
  PID:10372
- C:\Windows\System\RUSfbuq.exe
  C:\Windows\System\RUSfbuq.exe
  2⤵
  PID:10468
- C:\Windows\System\fLydZBz.exe
  C:\Windows\System\fLydZBz.exe
  2⤵
  PID:10636
- C:\Windows\System\iViXYiZ.exe
  C:\Windows\System\iViXYiZ.exe
  2⤵
  PID:10688
- C:\Windows\System\TzYKHAI.exe
  C:\Windows\System\TzYKHAI.exe
  2⤵
  PID:10776
- C:\Windows\System\oxufoFg.exe
  C:\Windows\System\oxufoFg.exe
  2⤵
  PID:9472
- C:\Windows\System\mzKZSxF.exe
  C:\Windows\System\mzKZSxF.exe
  2⤵
  PID:10956
- C:\Windows\System\srGpPlw.exe
  C:\Windows\System\srGpPlw.exe
  2⤵
  PID:11024
- C:\Windows\System\hRJIeEp.exe
  C:\Windows\System\hRJIeEp.exe
  2⤵
  PID:11060
- C:\Windows\System\lsPUBCi.exe
  C:\Windows\System\lsPUBCi.exe
  2⤵
  PID:11104
- C:\Windows\System\qiNpXIy.exe
  C:\Windows\System\qiNpXIy.exe
  2⤵
  PID:11220
- C:\Windows\System\vRqtLgW.exe
  C:\Windows\System\vRqtLgW.exe
  2⤵
  PID:10288
- C:\Windows\System\XhuGjFS.exe
  C:\Windows\System\XhuGjFS.exe
  2⤵
  PID:10504
- C:\Windows\System\GbsBcAP.exe
  C:\Windows\System\GbsBcAP.exe
  2⤵
  PID:10728
- C:\Windows\System\dQmXQKt.exe
  C:\Windows\System\dQmXQKt.exe
  2⤵
  PID:10936
- C:\Windows\System\atmrojT.exe
  C:\Windows\System\atmrojT.exe
  2⤵
  PID:11100
- C:\Windows\System\qUzyggB.exe
  C:\Windows\System\qUzyggB.exe
  2⤵
  PID:10284
- C:\Windows\System\rOnBOdj.exe
  C:\Windows\System\rOnBOdj.exe
  2⤵
  PID:10716
- C:\Windows\System\iNJlOkB.exe
  C:\Windows\System\iNJlOkB.exe
  2⤵
  PID:11164
- C:\Windows\System\aRlmMxm.exe
  C:\Windows\System\aRlmMxm.exe
  2⤵
  PID:11032
- C:\Windows\System\IxEnkOz.exe
  C:\Windows\System\IxEnkOz.exe
  2⤵
  PID:11280
- C:\Windows\System\PlQnOqf.exe
  C:\Windows\System\PlQnOqf.exe
  2⤵
  PID:11308
- C:\Windows\System\GcNejkS.exe
  C:\Windows\System\GcNejkS.exe
  2⤵
  PID:11336
- C:\Windows\System\bRtLmAf.exe
  C:\Windows\System\bRtLmAf.exe
  2⤵
  PID:11364
- C:\Windows\System\RCCLMnU.exe
  C:\Windows\System\RCCLMnU.exe
  2⤵
  PID:11392
- C:\Windows\System\REJBRZN.exe
  C:\Windows\System\REJBRZN.exe
  2⤵
  PID:11420
- C:\Windows\System\CMKjpwE.exe
  C:\Windows\System\CMKjpwE.exe
  2⤵
  PID:11448
- C:\Windows\System\gSduvwn.exe
  C:\Windows\System\gSduvwn.exe
  2⤵
  PID:11476
- C:\Windows\System\dYKlVai.exe
  C:\Windows\System\dYKlVai.exe
  2⤵
  PID:11504
- C:\Windows\System\wxCmspJ.exe
  C:\Windows\System\wxCmspJ.exe
  2⤵
  PID:11532
- C:\Windows\System\nhviAzX.exe
  C:\Windows\System\nhviAzX.exe
  2⤵
  PID:11560
- C:\Windows\System\dlCbZQx.exe
  C:\Windows\System\dlCbZQx.exe
  2⤵
  PID:11592
- C:\Windows\System\UcbZXsT.exe
  C:\Windows\System\UcbZXsT.exe
  2⤵
  PID:11616
- C:\Windows\System\lOHefKw.exe
  C:\Windows\System\lOHefKw.exe
  2⤵
  PID:11644
- C:\Windows\System\VmtIaAu.exe
  C:\Windows\System\VmtIaAu.exe
  2⤵
  PID:11672
- C:\Windows\System\TKUnTpp.exe
  C:\Windows\System\TKUnTpp.exe
  2⤵
  PID:11700
- C:\Windows\System\sAbOSTc.exe
  C:\Windows\System\sAbOSTc.exe
  2⤵
  PID:11728
- C:\Windows\System\IIgKFKg.exe
  C:\Windows\System\IIgKFKg.exe
  2⤵
  PID:11756
- C:\Windows\System\PccrNhy.exe
  C:\Windows\System\PccrNhy.exe
  2⤵
  PID:11784
- C:\Windows\System\irUIpVY.exe
  C:\Windows\System\irUIpVY.exe
  2⤵
  PID:11812
- C:\Windows\System\VFvfwHc.exe
  C:\Windows\System\VFvfwHc.exe
  2⤵
  PID:11840
- C:\Windows\System\vpWyYDe.exe
  C:\Windows\System\vpWyYDe.exe
  2⤵
  PID:11868
- C:\Windows\System\UHhGwtc.exe
  C:\Windows\System\UHhGwtc.exe
  2⤵
  PID:11896
- C:\Windows\System\yYsFtOH.exe
  C:\Windows\System\yYsFtOH.exe
  2⤵
  PID:11924
- C:\Windows\System\gdmCHEm.exe
  C:\Windows\System\gdmCHEm.exe
  2⤵
  PID:11952
- C:\Windows\System\EQYcpMC.exe
  C:\Windows\System\EQYcpMC.exe
  2⤵
  PID:11980
- C:\Windows\System\BNJmhNk.exe
  C:\Windows\System\BNJmhNk.exe
  2⤵
  PID:12008
- C:\Windows\System\LKFNKdL.exe
  C:\Windows\System\LKFNKdL.exe
  2⤵
  PID:12036
- C:\Windows\System\VBApzSU.exe
  C:\Windows\System\VBApzSU.exe
  2⤵
  PID:12064
- C:\Windows\System\xRdpTrS.exe
  C:\Windows\System\xRdpTrS.exe
  2⤵
  PID:12092
- C:\Windows\System\TyrHLSU.exe
  C:\Windows\System\TyrHLSU.exe
  2⤵
  PID:12120
- C:\Windows\System\tXuPmKS.exe
  C:\Windows\System\tXuPmKS.exe
  2⤵
  PID:12148
- C:\Windows\System\pPwKBHH.exe
  C:\Windows\System\pPwKBHH.exe
  2⤵
  PID:12176
- C:\Windows\System\MaAKyTR.exe
  C:\Windows\System\MaAKyTR.exe
  2⤵
  PID:12204
- C:\Windows\System\SvcZviW.exe
  C:\Windows\System\SvcZviW.exe
  2⤵
  PID:12232
- C:\Windows\System\iqRxwqJ.exe
  C:\Windows\System\iqRxwqJ.exe
  2⤵
  PID:12260
- C:\Windows\System\GOxKhIT.exe
  C:\Windows\System\GOxKhIT.exe
  2⤵
  PID:11272
- C:\Windows\System\LMeTpwQ.exe
  C:\Windows\System\LMeTpwQ.exe
  2⤵
  PID:11332
- C:\Windows\System\LOuEIYS.exe
  C:\Windows\System\LOuEIYS.exe
  2⤵
  PID:11404
- C:\Windows\System\ZPAdazx.exe
  C:\Windows\System\ZPAdazx.exe
  2⤵
  PID:11464
- C:\Windows\System\XcsSAOX.exe
  C:\Windows\System\XcsSAOX.exe
  2⤵
  PID:11528
- C:\Windows\System\fmbPnex.exe
  C:\Windows\System\fmbPnex.exe
  2⤵
  PID:11600
- C:\Windows\System\tVuYFuz.exe
  C:\Windows\System\tVuYFuz.exe
  2⤵
  PID:11664
- C:\Windows\System\hTFVhBJ.exe
  C:\Windows\System\hTFVhBJ.exe
  2⤵
  PID:11720
- C:\Windows\System\OqystgA.exe
  C:\Windows\System\OqystgA.exe
  2⤵
  PID:11796
- C:\Windows\System\sJxfPOs.exe
  C:\Windows\System\sJxfPOs.exe
  2⤵
  PID:11860
- C:\Windows\System\XDhNaru.exe
  C:\Windows\System\XDhNaru.exe
  2⤵
  PID:11916
- C:\Windows\System\dMWxlQy.exe
  C:\Windows\System\dMWxlQy.exe
  2⤵
  PID:11996
- C:\Windows\System\JIsyaQi.exe
  C:\Windows\System\JIsyaQi.exe
  2⤵
  PID:12056
- C:\Windows\System\hGAYPpO.exe
  C:\Windows\System\hGAYPpO.exe
  2⤵
  PID:12116
- C:\Windows\System\wbPiRBa.exe
  C:\Windows\System\wbPiRBa.exe
  2⤵
  PID:12188
- C:\Windows\System\zZumvOJ.exe
  C:\Windows\System\zZumvOJ.exe
  2⤵
  PID:12252
- C:\Windows\System\gHPbKJN.exe
  C:\Windows\System\gHPbKJN.exe
  2⤵
  PID:11328
- C:\Windows\System\ltIdRCK.exe
  C:\Windows\System\ltIdRCK.exe
  2⤵
  PID:11496
- C:\Windows\System\sCUFsXm.exe
  C:\Windows\System\sCUFsXm.exe
  2⤵
  PID:11640
- C:\Windows\System\hohkBhb.exe
  C:\Windows\System\hohkBhb.exe
  2⤵
  PID:11776
- C:\Windows\System\fFiaNSk.exe
  C:\Windows\System\fFiaNSk.exe
  2⤵
  PID:11944
- C:\Windows\System\tcUeUtz.exe
  C:\Windows\System\tcUeUtz.exe
  2⤵
  PID:12108
- C:\Windows\System\YPswxyQ.exe
  C:\Windows\System\YPswxyQ.exe
  2⤵
  PID:12244
- C:\Windows\System\XWOaENt.exe
  C:\Windows\System\XWOaENt.exe
  2⤵
  PID:11556
- C:\Windows\System\DUnFIlp.exe
  C:\Windows\System\DUnFIlp.exe
  2⤵
  PID:11908
- C:\Windows\System\gTqJefJ.exe
  C:\Windows\System\gTqJefJ.exe
  2⤵
  PID:12228
- C:\Windows\System\hLTDaCV.exe
  C:\Windows\System\hLTDaCV.exe
  2⤵
  PID:12032
- C:\Windows\System\qLemKDx.exe
  C:\Windows\System\qLemKDx.exe
  2⤵
  PID:12296
- C:\Windows\System\UuiLkFQ.exe
  C:\Windows\System\UuiLkFQ.exe
  2⤵
  PID:12312
- C:\Windows\System\DhXDhTL.exe
  C:\Windows\System\DhXDhTL.exe
  2⤵
  PID:12340
- C:\Windows\System\rcyXJeo.exe
  C:\Windows\System\rcyXJeo.exe
  2⤵
  PID:12380
- C:\Windows\System\KLnYjkp.exe
  C:\Windows\System\KLnYjkp.exe
  2⤵
  PID:12408
- C:\Windows\System\sOqlNyf.exe
  C:\Windows\System\sOqlNyf.exe
  2⤵
  PID:12436
- C:\Windows\System\DTdZLfF.exe
  C:\Windows\System\DTdZLfF.exe
  2⤵
  PID:12464
- C:\Windows\System\ZETYorb.exe
  C:\Windows\System\ZETYorb.exe
  2⤵
  PID:12492
- C:\Windows\System\cXrBMjs.exe
  C:\Windows\System\cXrBMjs.exe
  2⤵
  PID:12520
- C:\Windows\System\rWaCmPg.exe
  C:\Windows\System\rWaCmPg.exe
  2⤵
  PID:12548
- C:\Windows\System\mUVJDKN.exe
  C:\Windows\System\mUVJDKN.exe
  2⤵
  PID:12576
- C:\Windows\System\vGUrLEh.exe
  C:\Windows\System\vGUrLEh.exe
  2⤵
  PID:12604
- C:\Windows\System\bWscbdR.exe
  C:\Windows\System\bWscbdR.exe
  2⤵
  PID:12632
- C:\Windows\System\uPCfVDa.exe
  C:\Windows\System\uPCfVDa.exe
  2⤵
  PID:12660
- C:\Windows\System\CNIEPhR.exe
  C:\Windows\System\CNIEPhR.exe
  2⤵
  PID:12688
- C:\Windows\System\QLFlzQv.exe
  C:\Windows\System\QLFlzQv.exe
  2⤵
  PID:12716
- C:\Windows\System\aERMYmN.exe
  C:\Windows\System\aERMYmN.exe
  2⤵
  PID:12744
- C:\Windows\System\zbiVWvS.exe
  C:\Windows\System\zbiVWvS.exe
  2⤵
  PID:12788
- C:\Windows\System\REeDBmf.exe
  C:\Windows\System\REeDBmf.exe
  2⤵
  PID:12804
- C:\Windows\System\BCuHYli.exe
  C:\Windows\System\BCuHYli.exe
  2⤵
  PID:12844
- C:\Windows\System\oOczYdn.exe
  C:\Windows\System\oOczYdn.exe
  2⤵
  PID:12860
- C:\Windows\System\zWPtLDI.exe
  C:\Windows\System\zWPtLDI.exe
  2⤵
  PID:12896
- C:\Windows\System\xFzAigv.exe
  C:\Windows\System\xFzAigv.exe
  2⤵
  PID:12940
- C:\Windows\System\iWWqzho.exe
  C:\Windows\System\iWWqzho.exe
  2⤵
  PID:12964
- C:\Windows\System\punAutB.exe
  C:\Windows\System\punAutB.exe
  2⤵
  PID:13008
- C:\Windows\System\qaLfNzu.exe
  C:\Windows\System\qaLfNzu.exe
  2⤵
  PID:13036
- C:\Windows\System\ymRqgbQ.exe
  C:\Windows\System\ymRqgbQ.exe
  2⤵
  PID:13068
- C:\Windows\System\BoTAAZg.exe
  C:\Windows\System\BoTAAZg.exe
  2⤵
  PID:13096
- C:\Windows\System\UmEUCLQ.exe
  C:\Windows\System\UmEUCLQ.exe
  2⤵
  PID:13124
- C:\Windows\System\DqrsZsU.exe
  C:\Windows\System\DqrsZsU.exe
  2⤵
  PID:13152
- C:\Windows\System\FcmnmBP.exe
  C:\Windows\System\FcmnmBP.exe
  2⤵
  PID:13180
- C:\Windows\System\PIdzrOx.exe
  C:\Windows\System\PIdzrOx.exe
  2⤵
  PID:13208
- C:\Windows\System\YvVFJnQ.exe
  C:\Windows\System\YvVFJnQ.exe
  2⤵
  PID:13236
- C:\Windows\System\BDJOiOo.exe
  C:\Windows\System\BDJOiOo.exe
  2⤵
  PID:13264
- C:\Windows\System\AFWiaQk.exe
  C:\Windows\System\AFWiaQk.exe
  2⤵
  PID:13292
- C:\Windows\System\udKNFYO.exe
  C:\Windows\System\udKNFYO.exe
  2⤵
  PID:12292
- C:\Windows\System\UtHjnYN.exe
  C:\Windows\System\UtHjnYN.exe
  2⤵
  PID:12360
- C:\Windows\System\BZOWKxp.exe
  C:\Windows\System\BZOWKxp.exe
  2⤵
  PID:12428
- C:\Windows\System\mgGsWPk.exe
  C:\Windows\System\mgGsWPk.exe
  2⤵
  PID:12488
- C:\Windows\System\GVVUQPt.exe
  C:\Windows\System\GVVUQPt.exe
  2⤵
  PID:12564
- C:\Windows\System\GwSoprr.exe
  C:\Windows\System\GwSoprr.exe
  2⤵
  PID:12624
- C:\Windows\System\nTwJsdv.exe
  C:\Windows\System\nTwJsdv.exe
  2⤵
  PID:12684
- C:\Windows\System\jqfndIT.exe
  C:\Windows\System\jqfndIT.exe
  2⤵
  PID:12280
- C:\Windows\System\zSDBvcF.exe
  C:\Windows\System\zSDBvcF.exe
  2⤵
  PID:12816
- C:\Windows\System\DzzRHJJ.exe
  C:\Windows\System\DzzRHJJ.exe
  2⤵
  PID:2692
- C:\Windows\System\uJlDdAw.exe
  C:\Windows\System\uJlDdAw.exe
  2⤵
  PID:5108
- C:\Windows\System\NOcLbcE.exe
  C:\Windows\System\NOcLbcE.exe
  2⤵
  PID:12888
- C:\Windows\System\jBZAzxl.exe
  C:\Windows\System\jBZAzxl.exe
  2⤵
  PID:12988
- C:\Windows\System\OQpoXDZ.exe
  C:\Windows\System\OQpoXDZ.exe
  2⤵
  PID:13056
- C:\Windows\System\EKRJvEw.exe
  C:\Windows\System\EKRJvEw.exe
  2⤵
  PID:13116
- C:\Windows\System\eWElENZ.exe
  C:\Windows\System\eWElENZ.exe
  2⤵
  PID:13176
- C:\Windows\System\BnXRMgY.exe
  C:\Windows\System\BnXRMgY.exe
  2⤵
  PID:13248
- C:\Windows\System\rGHKRwB.exe
  C:\Windows\System\rGHKRwB.exe
  2⤵
  PID:11460
- C:\Windows\System\iGsAZNX.exe
  C:\Windows\System\iGsAZNX.exe
  2⤵
  PID:12404
- C:\Windows\System\fFRnSVg.exe
  C:\Windows\System\fFRnSVg.exe
  2⤵
  PID:12516
- C:\Windows\System\moEgQyR.exe
  C:\Windows\System\moEgQyR.exe
  2⤵
  PID:12732
- C:\Windows\System\yWgUkNq.exe
  C:\Windows\System\yWgUkNq.exe
  2⤵
  PID:4988
- C:\Windows\System\HAXJiPi.exe
  C:\Windows\System\HAXJiPi.exe
  2⤵
  PID:12932
- C:\Windows\System\SHlCvGT.exe
  C:\Windows\System\SHlCvGT.exe
  2⤵
  PID:13108
- C:\Windows\System\RhqXvcM.exe
  C:\Windows\System\RhqXvcM.exe
  2⤵
  PID:13228
- C:\Windows\System\RxwBqXO.exe
  C:\Windows\System\RxwBqXO.exe
  2⤵
  PID:12480
- C:\Windows\System\rdKickG.exe
  C:\Windows\System\rdKickG.exe
  2⤵
  PID:2284
- C:\Windows\System\kMFmOEV.exe
  C:\Windows\System\kMFmOEV.exe
  2⤵
  PID:13080
- C:\Windows\System\PmCzpgU.exe
  C:\Windows\System\PmCzpgU.exe
  2⤵
  PID:12652
- C:\Windows\System\gFPglgr.exe
  C:\Windows\System\gFPglgr.exe
  2⤵
  PID:12400
- C:\Windows\System\EaGTzoo.exe
  C:\Windows\System\EaGTzoo.exe
  2⤵
  PID:13320
- C:\Windows\System\QzkWuEi.exe
  C:\Windows\System\QzkWuEi.exe
  2⤵
  PID:13348
- C:\Windows\System\LBeGbTf.exe
  C:\Windows\System\LBeGbTf.exe
  2⤵
  PID:13376
- C:\Windows\System\nHlLtgk.exe
  C:\Windows\System\nHlLtgk.exe
  2⤵
  PID:13404
- C:\Windows\System\ffpjuWb.exe
  C:\Windows\System\ffpjuWb.exe
  2⤵
  PID:13432
- C:\Windows\System\bThGWwi.exe
  C:\Windows\System\bThGWwi.exe
  2⤵
  PID:13460
- C:\Windows\System\oSZwJdt.exe
  C:\Windows\System\oSZwJdt.exe
  2⤵
  PID:13488
- C:\Windows\System\SNUkdpC.exe
  C:\Windows\System\SNUkdpC.exe
  2⤵
  PID:13516
- C:\Windows\System\qaXzdVu.exe
  C:\Windows\System\qaXzdVu.exe
  2⤵
  PID:13544
- C:\Windows\System\VgCmwOc.exe
  C:\Windows\System\VgCmwOc.exe
  2⤵
  PID:13572
- C:\Windows\System\PkMFbIg.exe
  C:\Windows\System\PkMFbIg.exe
  2⤵
  PID:13600
- C:\Windows\System\iZljjKt.exe
  C:\Windows\System\iZljjKt.exe
  2⤵
  PID:13628
- C:\Windows\System\EPonrru.exe
  C:\Windows\System\EPonrru.exe
  2⤵
  PID:13672
- C:\Windows\System\TUlQMbz.exe
  C:\Windows\System\TUlQMbz.exe
  2⤵
  PID:13688
- C:\Windows\System\yBGqXYE.exe
  C:\Windows\System\yBGqXYE.exe
  2⤵
  PID:13716
- C:\Windows\System\fyahGxn.exe
  C:\Windows\System\fyahGxn.exe
  2⤵
  PID:13744
- C:\Windows\System\OBmAkvP.exe
  C:\Windows\System\OBmAkvP.exe
  2⤵
  PID:13772
- C:\Windows\System\TLZmIeV.exe
  C:\Windows\System\TLZmIeV.exe
  2⤵
  PID:13800
- C:\Windows\System\FhpAkaA.exe
  C:\Windows\System\FhpAkaA.exe
  2⤵
  PID:13828
- C:\Windows\System\qMiRdJZ.exe
  C:\Windows\System\qMiRdJZ.exe
  2⤵
  PID:13856
- C:\Windows\System\sPlQIKw.exe
  C:\Windows\System\sPlQIKw.exe
  2⤵
  PID:13884
- C:\Windows\System\tqgOpwm.exe
  C:\Windows\System\tqgOpwm.exe
  2⤵
  PID:13912
- C:\Windows\System\ojVAMUz.exe
  C:\Windows\System\ojVAMUz.exe
  2⤵
  PID:13940
- C:\Windows\System\bNqRvqB.exe
  C:\Windows\System\bNqRvqB.exe
  2⤵
  PID:13968
- C:\Windows\System\pSBgVel.exe
  C:\Windows\System\pSBgVel.exe
  2⤵
  PID:13996
- C:\Windows\System\dWLMSmu.exe
  C:\Windows\System\dWLMSmu.exe
  2⤵
  PID:14024
- C:\Windows\System\YTkfBgZ.exe
  C:\Windows\System\YTkfBgZ.exe
  2⤵
  PID:14052
- C:\Windows\System\qDlKSBJ.exe
  C:\Windows\System\qDlKSBJ.exe
  2⤵
  PID:14080
- C:\Windows\System\YWvFIES.exe
  C:\Windows\System\YWvFIES.exe
  2⤵
  PID:14108
- C:\Windows\System\wQvvLhC.exe
  C:\Windows\System\wQvvLhC.exe
  2⤵
  PID:14136
- C:\Windows\System\EsCpaqC.exe
  C:\Windows\System\EsCpaqC.exe
  2⤵
  PID:14164
- C:\Windows\System\pSUtYuZ.exe
  C:\Windows\System\pSUtYuZ.exe
  2⤵
  PID:14188
- C:\Windows\System\ddXZWhA.exe
  C:\Windows\System\ddXZWhA.exe
  2⤵
  PID:14220
- C:\Windows\System\OSZNIFv.exe
  C:\Windows\System\OSZNIFv.exe
  2⤵
  PID:14248
- C:\Windows\System\RzxuzUs.exe
  C:\Windows\System\RzxuzUs.exe
  2⤵
  PID:14276
- C:\Windows\System\eSHpduR.exe
  C:\Windows\System\eSHpduR.exe
  2⤵
  PID:14304
- C:\Windows\System\KgKMMdw.exe
  C:\Windows\System\KgKMMdw.exe
  2⤵
  PID:14332
- C:\Windows\System\QUBqTpP.exe
  C:\Windows\System\QUBqTpP.exe
  2⤵
  PID:13372
- C:\Windows\System\FDHHzxX.exe
  C:\Windows\System\FDHHzxX.exe
  2⤵
  PID:13424
- C:\Windows\System\ZOLQQlG.exe
  C:\Windows\System\ZOLQQlG.exe
  2⤵
  PID:13484
- C:\Windows\System\ccuzHpO.exe
  C:\Windows\System\ccuzHpO.exe
  2⤵
  PID:13556
- C:\Windows\System\snwGpnR.exe
  C:\Windows\System\snwGpnR.exe
  2⤵
  PID:13620
- C:\Windows\System\zMfntsu.exe
  C:\Windows\System\zMfntsu.exe
  2⤵
  PID:13684
- C:\Windows\System\LVSMVih.exe
  C:\Windows\System\LVSMVih.exe
  2⤵
  PID:13760
- C:\Windows\System\URHPxJZ.exe
  C:\Windows\System\URHPxJZ.exe
  2⤵
  PID:13820
- C:\Windows\System\AouZRMt.exe
  C:\Windows\System\AouZRMt.exe
  2⤵
  PID:13880
- C:\Windows\System\VhHiagM.exe
  C:\Windows\System\VhHiagM.exe
  2⤵
  PID:13952
- C:\Windows\System\XIUYhFq.exe
  C:\Windows\System\XIUYhFq.exe
  2⤵
  PID:14016
- C:\Windows\System\MfJnTcZ.exe
  C:\Windows\System\MfJnTcZ.exe
  2⤵
  PID:14076
- C:\Windows\System\JPGIcNK.exe
  C:\Windows\System\JPGIcNK.exe
  2⤵
  PID:14148
- C:\Windows\System\dwPoLAw.exe
  C:\Windows\System\dwPoLAw.exe
  2⤵
  PID:14208
- C:\Windows\System\AcmqaXZ.exe
  C:\Windows\System\AcmqaXZ.exe
  2⤵
  PID:14272
- C:\Windows\System\SdMJSjr.exe
  C:\Windows\System\SdMJSjr.exe
  2⤵
  PID:13332
- C:\Windows\System\VyWOvaE.exe
  C:\Windows\System\VyWOvaE.exe
  2⤵
  PID:13476
- C:\Windows\System\knWaPaB.exe
  C:\Windows\System\knWaPaB.exe
  2⤵
  PID:13616
- C:\Windows\System\xVKdDvP.exe
  C:\Windows\System\xVKdDvP.exe
  2⤵
  PID:13784
- C:\Windows\System\gVarJxD.exe
  C:\Windows\System\gVarJxD.exe
  2⤵
  PID:13928
- C:\Windows\System\TcdBQDG.exe
  C:\Windows\System\TcdBQDG.exe
  2⤵
  PID:14072
- C:\Windows\System\Jcfvxvy.exe
  C:\Windows\System\Jcfvxvy.exe
  2⤵
  PID:14240
- C:\Windows\System\oWjbDhe.exe
  C:\Windows\System\oWjbDhe.exe
  2⤵
  PID:13668
- C:\Windows\System\vTcPvfj.exe
  C:\Windows\System\vTcPvfj.exe
  2⤵
  PID:13992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BhFeFdP.exe

Filesize
2.7MB

MD5
5d8d39d4573cbf20cf82a23410bc5d50

SHA1
658414dcb9d4bcfa1681db75ec95082db7d90edb

SHA256
a07f70d3c915bd074dd671cdfd332aca6d1ebfa5176d424436ca98ccd776d622

SHA512
b4dbba467df9db520f1e08e09a2771a35edfa090a7e5eefbf34d90d6367df482fe9ef01d83c7f772f5f117540c918bab85fbb157b9fe196760eb75b8ed5cbb70

Download Submit
C:\Windows\System\DJUPiEJ.exe

Filesize
2.7MB

MD5
8e7c4ccb8bab280a975e60aece214657

SHA1
bdb8a5e31910db7a16b03db4bd746067d7544f96

SHA256
4288fc4bf5b20f400bdcc8d1cd9ac3e0e85a976e40e88f9b28bfa2727f8f4410

SHA512
96e8727aaf178397b1de287dd99322b81d6eb48377398dd0c8bab667984be5b88d4c9382fc17ee3d1a2e845f99506bcbb2334f1b4f7346bac01b847e04394462

Download Submit
C:\Windows\System\EqNcZwK.exe

Filesize
2.7MB

MD5
eb7d31abdb6edcaca8bcb9a3d6f4555a

SHA1
4bc05a59323d0bcdb4df32e52317c396cf25cb5b

SHA256
a4c70d77e72185392e9dcb568f7e9df9e44de490de13925d2563d020b85cc908

SHA512
410767d05e0cbd46f530750efeb8626a1ab4c704b8f92634597cc9face55cfad527986231cc53d5db21fa1df0c3de7d1049980c97581969ddda680dc092e7e17

Download Submit
C:\Windows\System\GlwSjsw.exe

Filesize
2.7MB

MD5
acb031ecde8c1a121c8e13a6668ca230

SHA1
84f67a8b6f1333988e8e71537a5c5e3a9cc80650

SHA256
0421c8db9b8fa3a90991d2b05f253d47f3e7f36aed53354eddc801a30cc3e0ce

SHA512
2f5653a0f39f98f3542aa348470c63ca04ab1104b9162763d3a37d033f91aa4e1be7f7edcee27e7c571f2cd3eaa16ffb8c72da7764dd04e63d7b6740eb1bd935

Download Submit
C:\Windows\System\KYgZMzu.exe

Filesize
2.7MB

MD5
704854f57ed67e8459bc8710c9006625

SHA1
fdb59da9f07a69df4eab82229a17a19656a34cce

SHA256
200912aa44aee4e255162f5963029fc99b8da309f533868cd3cb51ecea5b8c85

SHA512
e0ca3533af499ae7f8328c6dd2872a33505a6d7167dd55f3455a077b1788350e024a8be24720e0133ba95350b871ebc4ebae745a9a2cc6ef1622aac4167c4847

Download Submit
C:\Windows\System\KgyiPID.exe

Filesize
2.7MB

MD5
f85c4ad75070955cf68880782be888f6

SHA1
5e2ac8ab8e2c9788ea2a801f894f9b030ec37048

SHA256
29b581d83e65980dd9263d8171389db3bc23c1e823eda9b0eebf0f0e0cb13d72

SHA512
39025e741ad7557fac8c3153f09acde34cd775d18bd118a4e096ad62a967017fecbcb2e10a338026689633290cd3833f982f556488110ce5ea687b5e3693ab4b

Download Submit
C:\Windows\System\LDjujpN.exe

Filesize
2.7MB

MD5
86100de0118730fc0da9c418fdeab04e

SHA1
1aa2b07fa773d0964d6c8cfe32edb44a3b591d6a

SHA256
04b5b6488802843ff7a0417a83a7cc5f952d015f6a7c4bb8eb428bdcbffb3606

SHA512
18f5dede27ab85b41717bfc8ca1a12fba88ba68ea668fc2519042b9f32547e00f850bfbca58f2aa967078b6a14e8c65e2396b691f40cdbf31206017e033a748f

Download Submit
C:\Windows\System\LaSlZOv.exe

Filesize
2.7MB

MD5
b8a75cd460c2808f85969dbc6af59656

SHA1
10ad05e6c1e324f7a6e7ce05aefc394af9cfd3e8

SHA256
c9faddaace0bc10f35aa28a4b2e4f23e89453b7758dd4b8211ba78eef2f3b6ac

SHA512
3a3fb78c098b6a7d68dd38a5e45efdb656cbbecaf1f9ed2b021492cff3b373d582839f0f6417a57e9d4f176ff0a53fd528e2449251dcd1c1591942f1055359a4

Download Submit
C:\Windows\System\PRiLWrV.exe

Filesize
2.7MB

MD5
576576d9b3476ba6ffd3e173a452aa10

SHA1
89a3bfd1eefeee0ca4831901ac7aa0203d9a0013

SHA256
ab5295c8c1d6edcdad293a79954949faafcac4705ec854e4852422b8d39d45fc

SHA512
9fc099c9cd06c35ed9c9c123f30f47af9bc21cc03d87fd2de33fcf51fe106ec956254af034abd02723acb725ae470f4c6fa718f6ed5e2750b0bd687cd4f0da44

Download Submit
C:\Windows\System\ROZDQZf.exe

Filesize
2.7MB

MD5
292649fe9444413d07a169641015bd44

SHA1
ec3e28a1caa36b7556a5d5e9a6aba1f4302b283b

SHA256
e8c9ea03b5e9eef039f9bddd0664df44e5db00e3ab0f4b00347b58327a98f01d

SHA512
e2767d808fa6528d7ac9b7c0a50e448673aa48ca6ae0fa93267364d5a96479d9c54c3adbfed1d864b0c3baacecb76fa19c41ff9a25717550f9161053e3340eff

Download Submit
C:\Windows\System\TbRvgVM.exe

Filesize
2.7MB

MD5
bb8cfb32221ea2cde7f0efabf6bd9370

SHA1
1e47c033d82c317f5fa795dffff275a4584efad6

SHA256
3e41355d6f8e6201e7cc6bbd60505c795fb351f80c839394489370c4dfe1d244

SHA512
eb7fc4028e3c61e4337c6ca245601230130ee2f3d64735c3c43526ecab83eab6e186d6abc28e50b12e51e59a6f328f8f5da911dcfdfa5d94a18b82fe146c91ad

Download Submit
C:\Windows\System\TklPoHx.exe

Filesize
2.7MB

MD5
8c53f7399006dd72672d037581750c40

SHA1
182a89949f2b8d78e9579d782a3de02583eb54ac

SHA256
756b6eec04f72697d21f39e9c8605c7caf16d1d31b7dc17bc1b6730488f1a888

SHA512
dfb82edf8ee3c89c46abece8f185092fc4c0b8eb947748ef6d68da50345042e6148f937c49dad8bef6fbaed40c6b16e169f89c7931a573c465cf0238e97d6238

Download Submit
C:\Windows\System\UbSYDsl.exe

Filesize
2.7MB

MD5
4bd290684ab825226351dbccb737ade7

SHA1
a8f7f5026f379798ee8786bc10ed54f620c47003

SHA256
26a00658d6a63c844784c4501b003ea85d39194f44d329ca70f2ae86310d0fbb

SHA512
ad565933fcd20142846b3183b9506b624f37bee5f5461aed91dce7db5374f79fa0dd0c5b0e7075c4631a817295969a6c03c3026e16906c178ede311f4d310637

Download Submit
C:\Windows\System\bFSJzoi.exe

Filesize
2.7MB

MD5
1a307d9f258813232ef814f05ac506b6

SHA1
b564bd8ece6a859c144f15abf70e71841299c92c

SHA256
a8db26519833597b61c6d47cbd17e9d11549248a62696b88a41b95962a2bd1ce

SHA512
d007a60439db9b9fec86bf0162b00a0800d6b509c5be195a7233a6b3cd355ff79eefdd23048073217f56b07551b0dd392d57ade0c2721956331e2d4d3ed3ef17

Download Submit
C:\Windows\System\dWcwwXu.exe

Filesize
2.7MB

MD5
9c8749b9ca526e25f3f985166b239307

SHA1
02156e6b6117cacb3b8f17037cc1ef45efbb0c5a

SHA256
ec5bd18795abf42c308c2b3819c7a143dc73fd56530f14715514731aa2b69c7c

SHA512
3d74f39fae7efcac8e2e8411e4e2fc9bb60ab277d1ef55217d14eb45f1886222e7d026542826fe3893c491fe61bee9e590a04e9e540a6e2daf9ca066c02ffc92

Download Submit
C:\Windows\System\eBBFRJu.exe

Filesize
2.7MB

MD5
67fa1d2276121978e933bd9d6a8cb63b

SHA1
f0ff54631ccb935d362655aca62daee5396d23ce

SHA256
6f1ace7f32a188ce80127c17329a29b263d6133aae020fe3409c8e02ac08cc6e

SHA512
e6e8366f2cc767c76d48be9cb2ba63827ec0b36c15ca0a08812033e60307d61255e5b6ed4fdbf906f5a02d773e521fe3108375b331071a351326996806dc35ed

Download Submit
C:\Windows\System\ehAFHtp.exe

Filesize
2.7MB

MD5
e4dac22d3801469de3ac6628256682db

SHA1
ca0929760fdd0a6ba9a2caad15ec2609ddfe9654

SHA256
a0086ed078184216d52df50feca3329e491ed4d885f14f822dc254902fb291f0

SHA512
671e95e413eb7a9e4a24b7e41a3f298b79646ee3972ffc01a13271b7c1cd46d97bf0e6f48641305ca857192280e3b61ddf5b0f4116bcc53077b1155753fc7199

Download Submit
C:\Windows\System\fCZdNEy.exe

Filesize
2.7MB

MD5
033c7b36ea4a4a1a5ee54c792206c1d5

SHA1
b7d8817ae6ae70dcf25b9934c1e292137bf7671c

SHA256
7b88ccad27f5a9f0465d2f28dc081f0adecc7506618b29c93d15c67d1b18339f

SHA512
f091a1dd7a4b3a8f622c0cdf3e9d85bf62902978093ec80d48e4018f83dcc4d2221d7aa15d64f12b9dd42441ab41b8443f2924b700f02ab955181f71c479e370

Download Submit
C:\Windows\System\hXomUrI.exe

Filesize
2.7MB

MD5
1969ba66ee3b7b48361f4f18ec9d9ab9

SHA1
4cd9f62e8441cc726197091520f8972028543ba5

SHA256
6f37e9c55ede5b72420529e3beae43403d8045c564144fca9622303431ef03f2

SHA512
9a18b09542420b148462952076614bcfcaa6e68540c6dc90056dd9d915679b1915580adfab8b64f1c2068738d26867a31c69e4198eae8615565a2abf1719a31f

Download Submit
C:\Windows\System\iXqChgo.exe

Filesize
2.7MB

MD5
3832200ca739ffbaabde64f08d8dcc89

SHA1
e3c9223663e576a132175b832909ac8451bf5f43

SHA256
6747c5b681a9fb741ed20eb15897b40f56cd83a29bf5b0466da952620bfca70b

SHA512
5194a972b4e07cfb1b176a52d98e05a02ac145f15ef6508de8f838016aab362089bade17cbdc2f3f5d43983cf3bd3df553497bc7565e827dbeec06264d2fd51e

Download Submit
C:\Windows\System\jDRNsHq.exe

Filesize
2.7MB

MD5
be8646f5ba7786153719fdc60f334aba

SHA1
40c9852cfdb22d729ef554a78404db1db840380b

SHA256
da8c30f664b034435a538e14fb65044f5ae7691bc929cb00bb179a5da626c91e

SHA512
ae807109c4dde56ac3e6e108e68a75197f9b1e75497d1562c595a825703da624822a9c0b8a3f351c171b3994fb79afaf54544ad4d605bd8d282ad4f1462ddc46

Download Submit
C:\Windows\System\jgloudl.exe

Filesize
2.7MB

MD5
06ef13b538c63b0f8eeb2e66585e3d2a

SHA1
e1149034a8198911ae832b2afa4106dbf599db41

SHA256
74f2812161773ee871b60fc31ebff5dc686c8a5e88684f70f4874815d249c30c

SHA512
8c99be6ae283ab110071f4ef61a21882619d0b241675270bb5bc80cae96d3017ae30fab06dfb4f7a0e9f8966c244217098a2213e868f7b62d632ea0a1a9b9ae1

Download Submit
C:\Windows\System\kbnAeRU.exe

Filesize
2.7MB

MD5
bf3f77bc08a4aa7dd7c7d49302e6b3c3

SHA1
cbaa4fc9f1ecca04680e55b24e5d2e18e0c1fa4a

SHA256
178e88aa133aa0edb25c5d6e1613375924ab80b215f88742e9dc22fed52158d8

SHA512
a85f9d07e332e046154bb80c8d1813680ce81f434a5512aa10a3c49dfcfd05bd157d03c29c127b505373429cd5c7872b4d66b1d177b31b080f0fdced5c73fcc9

Download Submit
C:\Windows\System\koOGWCm.exe

Filesize
2.7MB

MD5
eb2fd40ce1545536c509140feae2c316

SHA1
07bec99b8e68354c633a5bc4d511d45b1b224d38

SHA256
2c000c325b9c9899ad3987119975a5c610192e619f106ca95274c5135db51680

SHA512
3d3a2ac0e523ad75d19db8885ccaff09252786ce6967cc04fae33ea34ce5c0bbff188a601d88d5e7fd003f31f571fb417faa51bd03d0eb2996dde086b672543a

Download Submit
C:\Windows\System\nwfRHHt.exe

Filesize
2.7MB

MD5
fb9d77ec09d48f813d0b2bdf91701c43

SHA1
7b9691f00bd85c0c9def5169cb39718191b63744

SHA256
e5378185647991a350996a19bb6b3a6decd3f185c536754b3299264728bf6b37

SHA512
7a7b4f6791c93a6f876c602e01e4843b8b53cd85c3a7f92ee3d4f520491aca0f231b0a1b7d5e97ff7b2fdf2815ca31f4b9c3c6941fe7a539d82ed530643090f9

Download Submit
C:\Windows\System\pAhHbLq.exe

Filesize
2.7MB

MD5
173b2f8402e0d3306e4acbb5ad1b1ac5

SHA1
9da0b4d8c8596746dcc3d947cd87d9c7274016bc

SHA256
3ad0c9069d8fc545f55961cf3405c7ee38f441ae3ed4507d50de081292c4255c

SHA512
f9489d8b61e77060478267c422d4898af72f0eb0fef6b0fecdf1c72b6552181f0c51fee34d15dab9c82e850efe1fb4bd6c5f22937a9c42d0ba610e3bfb09a4fd

Download Submit
C:\Windows\System\teFdQsF.exe

Filesize
2.7MB

MD5
17688e6481c3ff0fffeb3b687914f531

SHA1
5e5ee8ced4d5b976b363e0fa9303cae504fec4f2

SHA256
2d43f76eeccf1cb9a859684ee27c77667c14e5afe2ac91021d64fee83ae7cf80

SHA512
65099ede3c7935314edcbafcb694cc691b8b880ebc5dc2c9094e4973710c1be87579ed558a97d8d3681c3971a8df4a21f7df386c9a38d7e4ad72e97d0d70bb7d

Download Submit
C:\Windows\System\tpRhAea.exe

Filesize
2.7MB

MD5
f1c38cace49d65b2270a9a98f29e279f

SHA1
1a1aeaa8feb3262b2af9060f580d5264a7cf2600

SHA256
8f7d5722ab863d4cb53adfda1b101ab5e61d261dd4174ad8498a6ef66ad3bc45

SHA512
df7998bdb9dbd11ae2922b58c43caad25a1c1975caeda2e5841501400a9fa41a13213c119302fac88c28eeee0a36b4c0a81e29f1096c18c74d65463d151fc69b

Download Submit
C:\Windows\System\uLjYRfM.exe

Filesize
2.7MB

MD5
e82f770d0e5c193bf2e8ff426e7af5a9

SHA1
3d956ab62d60618b10a0af133a6d5b40f537f904

SHA256
0825477d98c7c1fdcd3fd29edbc8e90fa0021e85a9ff9d71c3635f6b8f289b61

SHA512
ea28051a318d997203c31aadc3d6f00723f805051f662a857ec70e4097133dce23c4d90a1875b5a9d9fe2293d2da62c1fee2d7a595c46339f428f162333955cd

Download Submit
C:\Windows\System\ulNXJTw.exe

Filesize
2.7MB

MD5
13ae1fb613e1f4fd707b0b191bed0c22

SHA1
a59a414859d31a977aa81850a1751e51e262080e

SHA256
0d8451c0c8d390af76e80d04f6dfd869b2eafe4004ed142227926ea2eb0cc2a3

SHA512
c7bec4845b385a203985aa2dd90e2af42d2eb8934d6b9c3bd528f1ab8b4ba833deccc62495882b3d104e31302a7ecb9a33d50a06e4deded24b9aad6f409ea8d0

Download Submit
C:\Windows\System\vfbWBgx.exe

Filesize
2.7MB

MD5
0e7c438733ba5b73f73756146dfbbcdc

SHA1
608f718584bef1544999d5a5d8d2a6b4904595a1

SHA256
add7d60f8bdc63ec3354e4f81b765c4c5946f91f9908c09895fa43f5b9854c8e

SHA512
2017537a3add2630d846829d795b939b034dd385a67b5510db0a785fc616e207d10e19c6d7e8861ed07b127214308d88f1a30d7d41d94978736d5e7c4d1f9fc7

Download Submit
C:\Windows\System\xYgesXz.exe

Filesize
2.7MB

MD5
34b5aa585ab0f250a1e4867fcbd8e32e

SHA1
70c93a258a991b8990df13def964dfd2e6d6dc0d

SHA256
aa9e3a262cb95b29c1397cc993f648bd31d3ab86a1d67e6c2383b51b14466052

SHA512
5b9f2fcd5d0d354b43e4e09c1c5a459450dd1d19e92d3aacbe8ec1cfde97ef93507873ec599d0f93c0b8359e08bdaa30c843534304867682c9e554467ffc5f72

Download Submit
C:\Windows\System\xbcUirE.exe

Filesize
2.7MB

MD5
3d73b2c332c0813209e2fc3dfa78cb74

SHA1
6f6aa68a2b5c0c9f7bc0a5a85bbe6c5a51871fa2

SHA256
33224809130df44855e6bbd60b7750e73809518d62c724e51cc682e54d431cac

SHA512
5f133ab98f0d333d317e099797da205543c6e1cb665ee64e23ad075bcb5d34f9ca3a799a5af25b362ed758903885f5cf03209115dce079e826acfbd26a2202f9

Download Submit
memory/1032-2146-0x00007FF777360000-0x00007FF7776B4000-memory.dmp

Filesize
3.3MB

Download
memory/1032-589-0x00007FF777360000-0x00007FF7776B4000-memory.dmp

Filesize
3.3MB

Download
memory/1528-591-0x00007FF7CE8A0000-0x00007FF7CEBF4000-memory.dmp

Filesize
3.3MB

Download
memory/1528-2153-0x00007FF7CE8A0000-0x00007FF7CEBF4000-memory.dmp

Filesize
3.3MB

Download
memory/1708-600-0x00007FF7D99E0000-0x00007FF7D9D34000-memory.dmp

Filesize
3.3MB

Download
memory/1708-2156-0x00007FF7D99E0000-0x00007FF7D9D34000-memory.dmp

Filesize
3.3MB

Download
memory/1812-0-0x00007FF635920000-0x00007FF635C74000-memory.dmp

Filesize
3.3MB

Download
memory/1812-2132-0x00007FF635920000-0x00007FF635C74000-memory.dmp

Filesize
3.3MB

Download
memory/1812-1-0x0000014FE1650000-0x0000014FE1660000-memory.dmp

Filesize
64KB

Download
memory/1988-588-0x00007FF70ADD0000-0x00007FF70B124000-memory.dmp

Filesize
3.3MB

Download
memory/1988-2145-0x00007FF70ADD0000-0x00007FF70B124000-memory.dmp

Filesize
3.3MB

Download
memory/2040-603-0x00007FF648C80000-0x00007FF648FD4000-memory.dmp

Filesize
3.3MB

Download
memory/2040-2164-0x00007FF648C80000-0x00007FF648FD4000-memory.dmp

Filesize
3.3MB

Download
memory/2064-604-0x00007FF749E80000-0x00007FF74A1D4000-memory.dmp

Filesize
3.3MB

Download
memory/2064-2161-0x00007FF749E80000-0x00007FF74A1D4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-2159-0x00007FF720840000-0x00007FF720B94000-memory.dmp

Filesize
3.3MB

Download
memory/2664-602-0x00007FF720840000-0x00007FF720B94000-memory.dmp

Filesize
3.3MB

Download
memory/2804-597-0x00007FF6600D0000-0x00007FF660424000-memory.dmp

Filesize
3.3MB

Download
memory/2804-2154-0x00007FF6600D0000-0x00007FF660424000-memory.dmp

Filesize
3.3MB

Download
memory/2872-2157-0x00007FF6C22A0000-0x00007FF6C25F4000-memory.dmp

Filesize
3.3MB

Download
memory/2872-599-0x00007FF6C22A0000-0x00007FF6C25F4000-memory.dmp

Filesize
3.3MB

Download
memory/2888-2141-0x00007FF6ACCB0000-0x00007FF6AD004000-memory.dmp

Filesize
3.3MB

Download
memory/2888-586-0x00007FF6ACCB0000-0x00007FF6AD004000-memory.dmp

Filesize
3.3MB

Download
memory/3068-2144-0x00007FF709BB0000-0x00007FF709F04000-memory.dmp

Filesize
3.3MB

Download
memory/3068-616-0x00007FF709BB0000-0x00007FF709F04000-memory.dmp

Filesize
3.3MB

Download
memory/3240-594-0x00007FF780660000-0x00007FF7809B4000-memory.dmp

Filesize
3.3MB

Download
memory/3240-2149-0x00007FF780660000-0x00007FF7809B4000-memory.dmp

Filesize
3.3MB

Download
memory/3344-595-0x00007FF76D350000-0x00007FF76D6A4000-memory.dmp

Filesize
3.3MB

Download
memory/3344-2148-0x00007FF76D350000-0x00007FF76D6A4000-memory.dmp

Filesize
3.3MB

Download
memory/3448-607-0x00007FF712300000-0x00007FF712654000-memory.dmp

Filesize
3.3MB

Download
memory/3448-2162-0x00007FF712300000-0x00007FF712654000-memory.dmp

Filesize
3.3MB

Download
memory/3548-592-0x00007FF7EE9D0000-0x00007FF7EED24000-memory.dmp

Filesize
3.3MB

Download
memory/3548-2151-0x00007FF7EE9D0000-0x00007FF7EED24000-memory.dmp

Filesize
3.3MB

Download
memory/3724-2138-0x00007FF78DFE0000-0x00007FF78E334000-memory.dmp

Filesize
3.3MB

Download
memory/3724-36-0x00007FF78DFE0000-0x00007FF78E334000-memory.dmp

Filesize
3.3MB

Download
memory/3784-2140-0x00007FF673620000-0x00007FF673974000-memory.dmp

Filesize
3.3MB

Download
memory/3784-43-0x00007FF673620000-0x00007FF673974000-memory.dmp

Filesize
3.3MB

Download
memory/3860-38-0x00007FF62ABB0000-0x00007FF62AF04000-memory.dmp

Filesize
3.3MB

Download
memory/3860-2135-0x00007FF62ABB0000-0x00007FF62AF04000-memory.dmp

Filesize
3.3MB

Download
memory/3860-2142-0x00007FF62ABB0000-0x00007FF62AF04000-memory.dmp

Filesize
3.3MB

Download
memory/3916-608-0x00007FF60FC70000-0x00007FF60FFC4000-memory.dmp

Filesize
3.3MB

Download
memory/3916-2160-0x00007FF60FC70000-0x00007FF60FFC4000-memory.dmp

Filesize
3.3MB

Download
memory/3996-590-0x00007FF626650000-0x00007FF6269A4000-memory.dmp

Filesize
3.3MB

Download
memory/3996-2152-0x00007FF626650000-0x00007FF6269A4000-memory.dmp

Filesize
3.3MB

Download
memory/4136-2137-0x00007FF657280000-0x00007FF6575D4000-memory.dmp

Filesize
3.3MB

Download
memory/4136-2134-0x00007FF657280000-0x00007FF6575D4000-memory.dmp

Filesize
3.3MB

Download
memory/4136-24-0x00007FF657280000-0x00007FF6575D4000-memory.dmp

Filesize
3.3MB

Download
memory/4336-2155-0x00007FF7EDCF0000-0x00007FF7EE044000-memory.dmp

Filesize
3.3MB

Download
memory/4336-598-0x00007FF7EDCF0000-0x00007FF7EE044000-memory.dmp

Filesize
3.3MB

Download
memory/4440-37-0x00007FF72A610000-0x00007FF72A964000-memory.dmp

Filesize
3.3MB

Download
memory/4440-2139-0x00007FF72A610000-0x00007FF72A964000-memory.dmp

Filesize
3.3MB

Download
memory/4580-2158-0x00007FF699AD0000-0x00007FF699E24000-memory.dmp

Filesize
3.3MB

Download
memory/4580-601-0x00007FF699AD0000-0x00007FF699E24000-memory.dmp

Filesize
3.3MB

Download
memory/4604-2163-0x00007FF7C7870000-0x00007FF7C7BC4000-memory.dmp

Filesize
3.3MB

Download
memory/4604-613-0x00007FF7C7870000-0x00007FF7C7BC4000-memory.dmp

Filesize
3.3MB

Download
memory/4816-596-0x00007FF704DE0000-0x00007FF705134000-memory.dmp

Filesize
3.3MB

Download
memory/4816-2147-0x00007FF704DE0000-0x00007FF705134000-memory.dmp

Filesize
3.3MB

Download
memory/4916-587-0x00007FF681C50000-0x00007FF681FA4000-memory.dmp

Filesize
3.3MB

Download
memory/4916-2143-0x00007FF681C50000-0x00007FF681FA4000-memory.dmp

Filesize
3.3MB

Download
memory/4920-593-0x00007FF7B7CA0000-0x00007FF7B7FF4000-memory.dmp

Filesize
3.3MB

Download
memory/4920-2150-0x00007FF7B7CA0000-0x00007FF7B7FF4000-memory.dmp

Filesize
3.3MB

Download
memory/4940-2133-0x00007FF7E39F0000-0x00007FF7E3D44000-memory.dmp

Filesize
3.3MB

Download
memory/4940-2136-0x00007FF7E39F0000-0x00007FF7E3D44000-memory.dmp

Filesize
3.3MB

Download
memory/4940-9-0x00007FF7E39F0000-0x00007FF7E3D44000-memory.dmp

Filesize
3.3MB

Download