xmrig | dc35f8f82c75c0444f7d3678aebffe879bf46a570b5386ad8a4d3841c8ad871e

Analysis

max time kernel
65s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
Size

3.4MB
MD5

2db3013055d5fa1240cb028d8fad06a0
SHA1

463bce5f8da21deb56633210ff0318c326ef6bf7
SHA256

dc35f8f82c75c0444f7d3678aebffe879bf46a570b5386ad8a4d3841c8ad871e
SHA512

a0031d22fa8e7dfe32563bc8d704446abfa59091ce340e20e5c63cbf703e5ab50a08e1e8a48eac47dfd74ced0c2cd6b2286e89533bf0966aaaecde0154d3244b
SSDEEP

98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc401:wFWPClFk1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1612-0-0x00007FF7CD6D0000-0x00007FF7CDAC5000-memory.dmp	xmrig
behavioral2/files/0x00090000000233f4-5.dat	xmrig
behavioral2/memory/1236-8-0x00007FF6A9950000-0x00007FF6A9D45000-memory.dmp	xmrig
behavioral2/files/0x0007000000023403-10.dat	xmrig
behavioral2/files/0x0007000000023404-11.dat	xmrig
behavioral2/memory/2564-19-0x00007FF72E2B0000-0x00007FF72E6A5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023405-24.dat	xmrig
behavioral2/memory/4788-21-0x00007FF623110000-0x00007FF623505000-memory.dmp	xmrig
behavioral2/memory/4908-26-0x00007FF7D25F0000-0x00007FF7D29E5000-memory.dmp	xmrig
behavioral2/files/0x0007000000023406-30.dat	xmrig
behavioral2/files/0x0010000000021f87-35.dat	xmrig
behavioral2/memory/4420-33-0x00007FF618D20000-0x00007FF619115000-memory.dmp	xmrig
behavioral2/memory/3328-38-0x00007FF647B00000-0x00007FF647EF5000-memory.dmp	xmrig
behavioral2/files/0x0005000000022ac3-40.dat	xmrig
behavioral2/memory/1996-42-0x00007FF6DBC50000-0x00007FF6DC045000-memory.dmp	xmrig
behavioral2/files/0x0005000000022ac6-47.dat	xmrig
behavioral2/files/0x0005000000022ac7-52.dat	xmrig
behavioral2/memory/2192-54-0x00007FF704B20000-0x00007FF704F15000-memory.dmp	xmrig
behavioral2/files/0x00090000000233fc-59.dat	xmrig
behavioral2/memory/4492-64-0x00007FF6CFE70000-0x00007FF6D0265000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-67.dat	xmrig
behavioral2/files/0x000700000002340a-83.dat	xmrig
behavioral2/files/0x000700000002340c-93.dat	xmrig
behavioral2/files/0x000700000002340d-98.dat	xmrig
behavioral2/files/0x000700000002340f-108.dat	xmrig
behavioral2/files/0x0007000000023411-116.dat	xmrig
behavioral2/files/0x0007000000023417-148.dat	xmrig
behavioral2/files/0x000700000002341c-173.dat	xmrig
behavioral2/memory/3924-622-0x00007FF7D6510000-0x00007FF7D6905000-memory.dmp	xmrig
behavioral2/memory/208-630-0x00007FF770680000-0x00007FF770A75000-memory.dmp	xmrig
behavioral2/memory/1056-637-0x00007FF7184B0000-0x00007FF7188A5000-memory.dmp	xmrig
behavioral2/memory/3716-633-0x00007FF66EDE0000-0x00007FF66F1D5000-memory.dmp	xmrig
behavioral2/memory/3600-643-0x00007FF6C24D0000-0x00007FF6C28C5000-memory.dmp	xmrig
behavioral2/memory/2240-640-0x00007FF7F56F0000-0x00007FF7F5AE5000-memory.dmp	xmrig
behavioral2/memory/5104-648-0x00007FF64B400000-0x00007FF64B7F5000-memory.dmp	xmrig
behavioral2/memory/4072-659-0x00007FF7D4F10000-0x00007FF7D5305000-memory.dmp	xmrig
behavioral2/memory/3760-655-0x00007FF628D00000-0x00007FF6290F5000-memory.dmp	xmrig
behavioral2/memory/1372-615-0x00007FF7C24F0000-0x00007FF7C28E5000-memory.dmp	xmrig
behavioral2/memory/4968-608-0x00007FF650A50000-0x00007FF650E45000-memory.dmp	xmrig
behavioral2/memory/1384-602-0x00007FF6AE690000-0x00007FF6AEA85000-memory.dmp	xmrig
behavioral2/memory/1068-599-0x00007FF69A030000-0x00007FF69A425000-memory.dmp	xmrig
behavioral2/memory/2564-597-0x00007FF72E2B0000-0x00007FF72E6A5000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-168.dat	xmrig
behavioral2/files/0x000700000002341a-163.dat	xmrig
behavioral2/files/0x0007000000023419-158.dat	xmrig
behavioral2/files/0x0007000000023418-153.dat	xmrig
behavioral2/files/0x0007000000023416-143.dat	xmrig
behavioral2/files/0x0007000000023415-138.dat	xmrig
behavioral2/files/0x0007000000023414-133.dat	xmrig
behavioral2/files/0x0007000000023413-128.dat	xmrig
behavioral2/files/0x0007000000023412-123.dat	xmrig
behavioral2/files/0x0007000000023410-113.dat	xmrig
behavioral2/files/0x000700000002340e-103.dat	xmrig
behavioral2/files/0x000700000002340b-88.dat	xmrig
behavioral2/files/0x0007000000023409-78.dat	xmrig
behavioral2/memory/1840-77-0x00007FF787590000-0x00007FF787985000-memory.dmp	xmrig
behavioral2/memory/2356-73-0x00007FF681060000-0x00007FF681455000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-71.dat	xmrig
behavioral2/memory/1612-65-0x00007FF7CD6D0000-0x00007FF7CDAC5000-memory.dmp	xmrig
behavioral2/memory/1612-1958-0x00007FF7CD6D0000-0x00007FF7CDAC5000-memory.dmp	xmrig
behavioral2/memory/1236-1959-0x00007FF6A9950000-0x00007FF6A9D45000-memory.dmp	xmrig
behavioral2/memory/2564-1960-0x00007FF72E2B0000-0x00007FF72E6A5000-memory.dmp	xmrig
behavioral2/memory/4788-1961-0x00007FF623110000-0x00007FF623505000-memory.dmp	xmrig
behavioral2/memory/4908-1962-0x00007FF7D25F0000-0x00007FF7D29E5000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1236	WMGIJDR.exe
2564	jiYaObF.exe
4788	OwyQzhW.exe
4908	wcidntg.exe
4420	hZYdpci.exe
3328	iZlLvSZ.exe
1996	HtnRXLR.exe
2192	jgTchrY.exe
4492	ExCUStR.exe
2356	QfNomFl.exe
1840	zrdpjjX.exe
3760	RoXrPOC.exe
4072	ddwuiXk.exe
1068	xGsPDYQ.exe
1384	JnzrHgj.exe
4968	vnPzHUU.exe
1372	KTjbzNA.exe
3924	MZUEmyi.exe
208	nezcnUK.exe
3716	buLwKAt.exe
1056	hBZvBkq.exe
2240	dxUcxKz.exe
3600	blNwMdT.exe
5104	NmGEHoh.exe
3968	FQEgMTP.exe
4568	dykdvyQ.exe
2344	QobqrdK.exe
3372	iWAUbjt.exe
4996	CiqQqPG.exe
4912	VCTseco.exe
2680	uMMwcsf.exe
5028	OcYIMPH.exe
2244	MzojPbd.exe
4588	ILSfhiu.exe
3932	tzuMhqt.exe
4944	mIbrDxs.exe
3408	JWzhNGv.exe
1724	gcmwFLu.exe
3556	FKkHOLq.exe
4352	kzGYcav.exe
1240	eiXKvPx.exe
3140	QPSXCZA.exe
4812	NnDxHpn.exe
4624	fsVfneB.exe
4868	fDcHixh.exe
224	SsQVAZI.exe
1060	MbtijdR.exe
3324	MAaMBzk.exe
3412	ANtFMKt.exe
1460	LKucPgx.exe
3228	wvOFFOx.exe
1864	hGxWNag.exe
540	uEhcDCt.exe
4556	mKppVXR.exe
2068	wLzUqYu.exe
4796	QfbTkyO.exe
1076	dEQqSTf.exe
2644	hjtLzBc.exe
60	PpxPvOr.exe
1820	WNtUoFU.exe
2996	idfUMcC.exe
764	VgYnelX.exe
3492	MjviGuL.exe
4468	BDoXrby.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1612-0-0x00007FF7CD6D0000-0x00007FF7CDAC5000-memory.dmp	upx
behavioral2/files/0x00090000000233f4-5.dat	upx
behavioral2/memory/1236-8-0x00007FF6A9950000-0x00007FF6A9D45000-memory.dmp	upx
behavioral2/files/0x0007000000023403-10.dat	upx
behavioral2/files/0x0007000000023404-11.dat	upx
behavioral2/memory/2564-19-0x00007FF72E2B0000-0x00007FF72E6A5000-memory.dmp	upx
behavioral2/files/0x0007000000023405-24.dat	upx
behavioral2/memory/4788-21-0x00007FF623110000-0x00007FF623505000-memory.dmp	upx
behavioral2/memory/4908-26-0x00007FF7D25F0000-0x00007FF7D29E5000-memory.dmp	upx
behavioral2/files/0x0007000000023406-30.dat	upx
behavioral2/files/0x0010000000021f87-35.dat	upx
behavioral2/memory/4420-33-0x00007FF618D20000-0x00007FF619115000-memory.dmp	upx
behavioral2/memory/3328-38-0x00007FF647B00000-0x00007FF647EF5000-memory.dmp	upx
behavioral2/files/0x0005000000022ac3-40.dat	upx
behavioral2/memory/1996-42-0x00007FF6DBC50000-0x00007FF6DC045000-memory.dmp	upx
behavioral2/files/0x0005000000022ac6-47.dat	upx
behavioral2/files/0x0005000000022ac7-52.dat	upx
behavioral2/memory/2192-54-0x00007FF704B20000-0x00007FF704F15000-memory.dmp	upx
behavioral2/files/0x00090000000233fc-59.dat	upx
behavioral2/memory/4492-64-0x00007FF6CFE70000-0x00007FF6D0265000-memory.dmp	upx
behavioral2/files/0x0007000000023408-67.dat	upx
behavioral2/files/0x000700000002340a-83.dat	upx
behavioral2/files/0x000700000002340c-93.dat	upx
behavioral2/files/0x000700000002340d-98.dat	upx
behavioral2/files/0x000700000002340f-108.dat	upx
behavioral2/files/0x0007000000023411-116.dat	upx
behavioral2/files/0x0007000000023417-148.dat	upx
behavioral2/files/0x000700000002341c-173.dat	upx
behavioral2/memory/3924-622-0x00007FF7D6510000-0x00007FF7D6905000-memory.dmp	upx
behavioral2/memory/208-630-0x00007FF770680000-0x00007FF770A75000-memory.dmp	upx
behavioral2/memory/1056-637-0x00007FF7184B0000-0x00007FF7188A5000-memory.dmp	upx
behavioral2/memory/3716-633-0x00007FF66EDE0000-0x00007FF66F1D5000-memory.dmp	upx
behavioral2/memory/3600-643-0x00007FF6C24D0000-0x00007FF6C28C5000-memory.dmp	upx
behavioral2/memory/2240-640-0x00007FF7F56F0000-0x00007FF7F5AE5000-memory.dmp	upx
behavioral2/memory/5104-648-0x00007FF64B400000-0x00007FF64B7F5000-memory.dmp	upx
behavioral2/memory/4072-659-0x00007FF7D4F10000-0x00007FF7D5305000-memory.dmp	upx
behavioral2/memory/3760-655-0x00007FF628D00000-0x00007FF6290F5000-memory.dmp	upx
behavioral2/memory/1372-615-0x00007FF7C24F0000-0x00007FF7C28E5000-memory.dmp	upx
behavioral2/memory/4968-608-0x00007FF650A50000-0x00007FF650E45000-memory.dmp	upx
behavioral2/memory/1384-602-0x00007FF6AE690000-0x00007FF6AEA85000-memory.dmp	upx
behavioral2/memory/1068-599-0x00007FF69A030000-0x00007FF69A425000-memory.dmp	upx
behavioral2/memory/2564-597-0x00007FF72E2B0000-0x00007FF72E6A5000-memory.dmp	upx
behavioral2/files/0x000700000002341b-168.dat	upx
behavioral2/files/0x000700000002341a-163.dat	upx
behavioral2/files/0x0007000000023419-158.dat	upx
behavioral2/files/0x0007000000023418-153.dat	upx
behavioral2/files/0x0007000000023416-143.dat	upx
behavioral2/files/0x0007000000023415-138.dat	upx
behavioral2/files/0x0007000000023414-133.dat	upx
behavioral2/files/0x0007000000023413-128.dat	upx
behavioral2/files/0x0007000000023412-123.dat	upx
behavioral2/files/0x0007000000023410-113.dat	upx
behavioral2/files/0x000700000002340e-103.dat	upx
behavioral2/files/0x000700000002340b-88.dat	upx
behavioral2/files/0x0007000000023409-78.dat	upx
behavioral2/memory/1840-77-0x00007FF787590000-0x00007FF787985000-memory.dmp	upx
behavioral2/memory/2356-73-0x00007FF681060000-0x00007FF681455000-memory.dmp	upx
behavioral2/files/0x0007000000023407-71.dat	upx
behavioral2/memory/1612-65-0x00007FF7CD6D0000-0x00007FF7CDAC5000-memory.dmp	upx
behavioral2/memory/1612-1958-0x00007FF7CD6D0000-0x00007FF7CDAC5000-memory.dmp	upx
behavioral2/memory/1236-1959-0x00007FF6A9950000-0x00007FF6A9D45000-memory.dmp	upx
behavioral2/memory/2564-1960-0x00007FF72E2B0000-0x00007FF72E6A5000-memory.dmp	upx
behavioral2/memory/4788-1961-0x00007FF623110000-0x00007FF623505000-memory.dmp	upx
behavioral2/memory/4908-1962-0x00007FF7D25F0000-0x00007FF7D29E5000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\JeGdoFp.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\VKDxsXq.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\eWtBEhz.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\RJZAFSg.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\JnzrHgj.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\VCTseco.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\PpxPvOr.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\bLjapno.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\lzNYihx.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\EevCiuj.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\PSazSLE.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\FvPmRxl.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\UjSRtam.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\aEavOxS.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\EqRdTdZ.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\qGnLeKQ.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\zrdpjjX.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\xGsPDYQ.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\iWAUbjt.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\DQWUcgI.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\YkhnUkd.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\MXkrLFc.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\TbsAREc.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\gbLBotF.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\ijGmMmk.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\DYhbmFX.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\EtwSRZB.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\AZvPRZz.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\GUvHiKq.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\GquvIuJ.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\jUVIzhk.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\zFEVUVU.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\awqoPPO.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\lVyrvwu.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\RcHCPtL.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\LPKCOjj.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\qxrcfKn.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\VmSJtLy.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\GIGmivy.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\bdwiuHS.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\fsVfneB.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\DNlNyuY.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\lvhBwwh.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\uEvRpGM.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\CfhwTWj.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\hvTcULz.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\VjJXgpG.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\NdqwaVu.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\jgTchrY.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\mggUDug.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\vIRGiwQ.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\REuCZJN.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\IqIJeqL.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\EbzWBGh.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\gZGZHrK.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\BMVIthi.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\dJYUXOf.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\OLpMvRI.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\rMwqMyh.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\uwrHpNr.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\XTtpyIB.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\lFztOVB.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\WaTMvxF.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
File created	C:\Windows\System32\nhtyrDw.exe	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1236	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	83
PID 1612 wrote to memory of 1236	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	83
PID 1612 wrote to memory of 2564	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	84
PID 1612 wrote to memory of 2564	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	84
PID 1612 wrote to memory of 4788	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	87
PID 1612 wrote to memory of 4788	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	87
PID 1612 wrote to memory of 4908	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	89
PID 1612 wrote to memory of 4908	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	89
PID 1612 wrote to memory of 4420	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	90
PID 1612 wrote to memory of 4420	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	90
PID 1612 wrote to memory of 3328	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	91
PID 1612 wrote to memory of 3328	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	91
PID 1612 wrote to memory of 1996	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	92
PID 1612 wrote to memory of 1996	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	92
PID 1612 wrote to memory of 2192	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	93
PID 1612 wrote to memory of 2192	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	93
PID 1612 wrote to memory of 4492	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	94
PID 1612 wrote to memory of 4492	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	94
PID 1612 wrote to memory of 2356	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	95
PID 1612 wrote to memory of 2356	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	95
PID 1612 wrote to memory of 1840	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	96
PID 1612 wrote to memory of 1840	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	96
PID 1612 wrote to memory of 3760	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	97
PID 1612 wrote to memory of 3760	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	97
PID 1612 wrote to memory of 4072	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	98
PID 1612 wrote to memory of 4072	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	98
PID 1612 wrote to memory of 1068	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	99
PID 1612 wrote to memory of 1068	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	99
PID 1612 wrote to memory of 1384	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	100
PID 1612 wrote to memory of 1384	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	100
PID 1612 wrote to memory of 4968	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	101
PID 1612 wrote to memory of 4968	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	101
PID 1612 wrote to memory of 1372	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	102
PID 1612 wrote to memory of 1372	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	102
PID 1612 wrote to memory of 3924	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	103
PID 1612 wrote to memory of 3924	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	103
PID 1612 wrote to memory of 208	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	104
PID 1612 wrote to memory of 208	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	104
PID 1612 wrote to memory of 3716	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	105
PID 1612 wrote to memory of 3716	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	105
PID 1612 wrote to memory of 1056	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	106
PID 1612 wrote to memory of 1056	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	106
PID 1612 wrote to memory of 2240	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	107
PID 1612 wrote to memory of 2240	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	107
PID 1612 wrote to memory of 3600	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	108
PID 1612 wrote to memory of 3600	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	108
PID 1612 wrote to memory of 5104	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	109
PID 1612 wrote to memory of 5104	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	109
PID 1612 wrote to memory of 3968	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	110
PID 1612 wrote to memory of 3968	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	110
PID 1612 wrote to memory of 4568	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	111
PID 1612 wrote to memory of 4568	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	111
PID 1612 wrote to memory of 2344	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	112
PID 1612 wrote to memory of 2344	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	112
PID 1612 wrote to memory of 3372	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	113
PID 1612 wrote to memory of 3372	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	113
PID 1612 wrote to memory of 4996	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	114
PID 1612 wrote to memory of 4996	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	114
PID 1612 wrote to memory of 4912	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	115
PID 1612 wrote to memory of 4912	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	115
PID 1612 wrote to memory of 2680	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	116
PID 1612 wrote to memory of 2680	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	116
PID 1612 wrote to memory of 5028	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	117
PID 1612 wrote to memory of 5028	1612	2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2db3013055d5fa1240cb028d8fad06a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\System32\WMGIJDR.exe
  C:\Windows\System32\WMGIJDR.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System32\jiYaObF.exe
  C:\Windows\System32\jiYaObF.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System32\OwyQzhW.exe
  C:\Windows\System32\OwyQzhW.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System32\wcidntg.exe
  C:\Windows\System32\wcidntg.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System32\hZYdpci.exe
  C:\Windows\System32\hZYdpci.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System32\iZlLvSZ.exe
  C:\Windows\System32\iZlLvSZ.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System32\HtnRXLR.exe
  C:\Windows\System32\HtnRXLR.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System32\jgTchrY.exe
  C:\Windows\System32\jgTchrY.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System32\ExCUStR.exe
  C:\Windows\System32\ExCUStR.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System32\QfNomFl.exe
  C:\Windows\System32\QfNomFl.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System32\zrdpjjX.exe
  C:\Windows\System32\zrdpjjX.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System32\RoXrPOC.exe
  C:\Windows\System32\RoXrPOC.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System32\ddwuiXk.exe
  C:\Windows\System32\ddwuiXk.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System32\xGsPDYQ.exe
  C:\Windows\System32\xGsPDYQ.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System32\JnzrHgj.exe
  C:\Windows\System32\JnzrHgj.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System32\vnPzHUU.exe
  C:\Windows\System32\vnPzHUU.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System32\KTjbzNA.exe
  C:\Windows\System32\KTjbzNA.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System32\MZUEmyi.exe
  C:\Windows\System32\MZUEmyi.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System32\nezcnUK.exe
  C:\Windows\System32\nezcnUK.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System32\buLwKAt.exe
  C:\Windows\System32\buLwKAt.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System32\hBZvBkq.exe
  C:\Windows\System32\hBZvBkq.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System32\dxUcxKz.exe
  C:\Windows\System32\dxUcxKz.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System32\blNwMdT.exe
  C:\Windows\System32\blNwMdT.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System32\NmGEHoh.exe
  C:\Windows\System32\NmGEHoh.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System32\FQEgMTP.exe
  C:\Windows\System32\FQEgMTP.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System32\dykdvyQ.exe
  C:\Windows\System32\dykdvyQ.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System32\QobqrdK.exe
  C:\Windows\System32\QobqrdK.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System32\iWAUbjt.exe
  C:\Windows\System32\iWAUbjt.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System32\CiqQqPG.exe
  C:\Windows\System32\CiqQqPG.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System32\VCTseco.exe
  C:\Windows\System32\VCTseco.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System32\uMMwcsf.exe
  C:\Windows\System32\uMMwcsf.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System32\OcYIMPH.exe
  C:\Windows\System32\OcYIMPH.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System32\MzojPbd.exe
  C:\Windows\System32\MzojPbd.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System32\ILSfhiu.exe
  C:\Windows\System32\ILSfhiu.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System32\tzuMhqt.exe
  C:\Windows\System32\tzuMhqt.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System32\mIbrDxs.exe
  C:\Windows\System32\mIbrDxs.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System32\JWzhNGv.exe
  C:\Windows\System32\JWzhNGv.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System32\gcmwFLu.exe
  C:\Windows\System32\gcmwFLu.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System32\FKkHOLq.exe
  C:\Windows\System32\FKkHOLq.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System32\kzGYcav.exe
  C:\Windows\System32\kzGYcav.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System32\eiXKvPx.exe
  C:\Windows\System32\eiXKvPx.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System32\QPSXCZA.exe
  C:\Windows\System32\QPSXCZA.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System32\NnDxHpn.exe
  C:\Windows\System32\NnDxHpn.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System32\fsVfneB.exe
  C:\Windows\System32\fsVfneB.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System32\fDcHixh.exe
  C:\Windows\System32\fDcHixh.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System32\SsQVAZI.exe
  C:\Windows\System32\SsQVAZI.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System32\MbtijdR.exe
  C:\Windows\System32\MbtijdR.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System32\MAaMBzk.exe
  C:\Windows\System32\MAaMBzk.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System32\ANtFMKt.exe
  C:\Windows\System32\ANtFMKt.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System32\LKucPgx.exe
  C:\Windows\System32\LKucPgx.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System32\wvOFFOx.exe
  C:\Windows\System32\wvOFFOx.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System32\hGxWNag.exe
  C:\Windows\System32\hGxWNag.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System32\uEhcDCt.exe
  C:\Windows\System32\uEhcDCt.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System32\mKppVXR.exe
  C:\Windows\System32\mKppVXR.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System32\wLzUqYu.exe
  C:\Windows\System32\wLzUqYu.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System32\QfbTkyO.exe
  C:\Windows\System32\QfbTkyO.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System32\dEQqSTf.exe
  C:\Windows\System32\dEQqSTf.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System32\hjtLzBc.exe
  C:\Windows\System32\hjtLzBc.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System32\PpxPvOr.exe
  C:\Windows\System32\PpxPvOr.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System32\WNtUoFU.exe
  C:\Windows\System32\WNtUoFU.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System32\idfUMcC.exe
  C:\Windows\System32\idfUMcC.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System32\VgYnelX.exe
  C:\Windows\System32\VgYnelX.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System32\MjviGuL.exe
  C:\Windows\System32\MjviGuL.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System32\BDoXrby.exe
  C:\Windows\System32\BDoXrby.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System32\rALlYZl.exe
  C:\Windows\System32\rALlYZl.exe
  2⤵
  PID:2820
- C:\Windows\System32\GqbkAfh.exe
  C:\Windows\System32\GqbkAfh.exe
  2⤵
  PID:2076
- C:\Windows\System32\psuoYzy.exe
  C:\Windows\System32\psuoYzy.exe
  2⤵
  PID:1968
- C:\Windows\System32\fjhbNQt.exe
  C:\Windows\System32\fjhbNQt.exe
  2⤵
  PID:1720
- C:\Windows\System32\BMVIthi.exe
  C:\Windows\System32\BMVIthi.exe
  2⤵
  PID:908
- C:\Windows\System32\hYwVwvr.exe
  C:\Windows\System32\hYwVwvr.exe
  2⤵
  PID:4404
- C:\Windows\System32\UwXgCIp.exe
  C:\Windows\System32\UwXgCIp.exe
  2⤵
  PID:1888
- C:\Windows\System32\IzoeiRi.exe
  C:\Windows\System32\IzoeiRi.exe
  2⤵
  PID:3312
- C:\Windows\System32\pNzkYVG.exe
  C:\Windows\System32\pNzkYVG.exe
  2⤵
  PID:4980
- C:\Windows\System32\yyQavhe.exe
  C:\Windows\System32\yyQavhe.exe
  2⤵
  PID:2740
- C:\Windows\System32\MUctKgN.exe
  C:\Windows\System32\MUctKgN.exe
  2⤵
  PID:2864
- C:\Windows\System32\zFEVUVU.exe
  C:\Windows\System32\zFEVUVU.exe
  2⤵
  PID:1172
- C:\Windows\System32\mggUDug.exe
  C:\Windows\System32\mggUDug.exe
  2⤵
  PID:2324
- C:\Windows\System32\WwGvvay.exe
  C:\Windows\System32\WwGvvay.exe
  2⤵
  PID:2640
- C:\Windows\System32\UQLnDep.exe
  C:\Windows\System32\UQLnDep.exe
  2⤵
  PID:1472
- C:\Windows\System32\QperAas.exe
  C:\Windows\System32\QperAas.exe
  2⤵
  PID:3384
- C:\Windows\System32\YSrxEOd.exe
  C:\Windows\System32\YSrxEOd.exe
  2⤵
  PID:4428
- C:\Windows\System32\qdnHdnR.exe
  C:\Windows\System32\qdnHdnR.exe
  2⤵
  PID:3316
- C:\Windows\System32\JAKDcJM.exe
  C:\Windows\System32\JAKDcJM.exe
  2⤵
  PID:2104
- C:\Windows\System32\nSOJtRS.exe
  C:\Windows\System32\nSOJtRS.exe
  2⤵
  PID:5140
- C:\Windows\System32\qPiuaYR.exe
  C:\Windows\System32\qPiuaYR.exe
  2⤵
  PID:5168
- C:\Windows\System32\UzqmZWO.exe
  C:\Windows\System32\UzqmZWO.exe
  2⤵
  PID:5196
- C:\Windows\System32\KoEdaDZ.exe
  C:\Windows\System32\KoEdaDZ.exe
  2⤵
  PID:5224
- C:\Windows\System32\RhlDdry.exe
  C:\Windows\System32\RhlDdry.exe
  2⤵
  PID:5252
- C:\Windows\System32\jUIuawC.exe
  C:\Windows\System32\jUIuawC.exe
  2⤵
  PID:5280
- C:\Windows\System32\PSNguoS.exe
  C:\Windows\System32\PSNguoS.exe
  2⤵
  PID:5308
- C:\Windows\System32\FlEtUHw.exe
  C:\Windows\System32\FlEtUHw.exe
  2⤵
  PID:5336
- C:\Windows\System32\xfhwjLg.exe
  C:\Windows\System32\xfhwjLg.exe
  2⤵
  PID:5364
- C:\Windows\System32\iFHLdWu.exe
  C:\Windows\System32\iFHLdWu.exe
  2⤵
  PID:5400
- C:\Windows\System32\cMhZSrA.exe
  C:\Windows\System32\cMhZSrA.exe
  2⤵
  PID:5420
- C:\Windows\System32\dJYUXOf.exe
  C:\Windows\System32\dJYUXOf.exe
  2⤵
  PID:5456
- C:\Windows\System32\BoXRVwG.exe
  C:\Windows\System32\BoXRVwG.exe
  2⤵
  PID:5476
- C:\Windows\System32\sPcbSlW.exe
  C:\Windows\System32\sPcbSlW.exe
  2⤵
  PID:5512
- C:\Windows\System32\acMYHUP.exe
  C:\Windows\System32\acMYHUP.exe
  2⤵
  PID:5532
- C:\Windows\System32\awqoPPO.exe
  C:\Windows\System32\awqoPPO.exe
  2⤵
  PID:5560
- C:\Windows\System32\fvILdmm.exe
  C:\Windows\System32\fvILdmm.exe
  2⤵
  PID:5588
- C:\Windows\System32\yJSOkLP.exe
  C:\Windows\System32\yJSOkLP.exe
  2⤵
  PID:5616
- C:\Windows\System32\FeJBWVh.exe
  C:\Windows\System32\FeJBWVh.exe
  2⤵
  PID:5644
- C:\Windows\System32\SflPTrs.exe
  C:\Windows\System32\SflPTrs.exe
  2⤵
  PID:5672
- C:\Windows\System32\konumix.exe
  C:\Windows\System32\konumix.exe
  2⤵
  PID:5700
- C:\Windows\System32\rAJHXas.exe
  C:\Windows\System32\rAJHXas.exe
  2⤵
  PID:5728
- C:\Windows\System32\PdTtNGo.exe
  C:\Windows\System32\PdTtNGo.exe
  2⤵
  PID:5756
- C:\Windows\System32\MuhkRaY.exe
  C:\Windows\System32\MuhkRaY.exe
  2⤵
  PID:5784
- C:\Windows\System32\FvPmRxl.exe
  C:\Windows\System32\FvPmRxl.exe
  2⤵
  PID:5824
- C:\Windows\System32\MEgdUmO.exe
  C:\Windows\System32\MEgdUmO.exe
  2⤵
  PID:5840
- C:\Windows\System32\vUzqxPU.exe
  C:\Windows\System32\vUzqxPU.exe
  2⤵
  PID:5868
- C:\Windows\System32\VdxJjEU.exe
  C:\Windows\System32\VdxJjEU.exe
  2⤵
  PID:5896
- C:\Windows\System32\LxDXENs.exe
  C:\Windows\System32\LxDXENs.exe
  2⤵
  PID:5924
- C:\Windows\System32\oYQqxEb.exe
  C:\Windows\System32\oYQqxEb.exe
  2⤵
  PID:5952
- C:\Windows\System32\okerGmy.exe
  C:\Windows\System32\okerGmy.exe
  2⤵
  PID:5980
- C:\Windows\System32\beEfOdI.exe
  C:\Windows\System32\beEfOdI.exe
  2⤵
  PID:6008
- C:\Windows\System32\gbLBotF.exe
  C:\Windows\System32\gbLBotF.exe
  2⤵
  PID:6036
- C:\Windows\System32\JSMMOvH.exe
  C:\Windows\System32\JSMMOvH.exe
  2⤵
  PID:6064
- C:\Windows\System32\nozSBFZ.exe
  C:\Windows\System32\nozSBFZ.exe
  2⤵
  PID:6092
- C:\Windows\System32\rMkGypC.exe
  C:\Windows\System32\rMkGypC.exe
  2⤵
  PID:6120
- C:\Windows\System32\bDSGnGR.exe
  C:\Windows\System32\bDSGnGR.exe
  2⤵
  PID:2712
- C:\Windows\System32\HyFxSPE.exe
  C:\Windows\System32\HyFxSPE.exe
  2⤵
  PID:1528
- C:\Windows\System32\FOnQEsl.exe
  C:\Windows\System32\FOnQEsl.exe
  2⤵
  PID:4436
- C:\Windows\System32\BZprDcI.exe
  C:\Windows\System32\BZprDcI.exe
  2⤵
  PID:2772
- C:\Windows\System32\lFztOVB.exe
  C:\Windows\System32\lFztOVB.exe
  2⤵
  PID:5180
- C:\Windows\System32\aREzfpP.exe
  C:\Windows\System32\aREzfpP.exe
  2⤵
  PID:5240
- C:\Windows\System32\EdCGXWp.exe
  C:\Windows\System32\EdCGXWp.exe
  2⤵
  PID:5296
- C:\Windows\System32\moWxxpS.exe
  C:\Windows\System32\moWxxpS.exe
  2⤵
  PID:5376
- C:\Windows\System32\ivtCDog.exe
  C:\Windows\System32\ivtCDog.exe
  2⤵
  PID:5444
- C:\Windows\System32\NofVqgS.exe
  C:\Windows\System32\NofVqgS.exe
  2⤵
  PID:5528
- C:\Windows\System32\cFxJvgP.exe
  C:\Windows\System32\cFxJvgP.exe
  2⤵
  PID:5572
- C:\Windows\System32\abtPHTU.exe
  C:\Windows\System32\abtPHTU.exe
  2⤵
  PID:5640
- C:\Windows\System32\OyFTSuf.exe
  C:\Windows\System32\OyFTSuf.exe
  2⤵
  PID:5688
- C:\Windows\System32\EzHuyMk.exe
  C:\Windows\System32\EzHuyMk.exe
  2⤵
  PID:5768
- C:\Windows\System32\UjSRtam.exe
  C:\Windows\System32\UjSRtam.exe
  2⤵
  PID:5836
- C:\Windows\System32\zDUgUUF.exe
  C:\Windows\System32\zDUgUUF.exe
  2⤵
  PID:5920
- C:\Windows\System32\wyBwMoB.exe
  C:\Windows\System32\wyBwMoB.exe
  2⤵
  PID:5968
- C:\Windows\System32\PqqDxPD.exe
  C:\Windows\System32\PqqDxPD.exe
  2⤵
  PID:6032
- C:\Windows\System32\fwjWELG.exe
  C:\Windows\System32\fwjWELG.exe
  2⤵
  PID:6116
- C:\Windows\System32\ozwNrKI.exe
  C:\Windows\System32\ozwNrKI.exe
  2⤵
  PID:468
- C:\Windows\System32\dabVAjJ.exe
  C:\Windows\System32\dabVAjJ.exe
  2⤵
  PID:3936
- C:\Windows\System32\vKgqNxC.exe
  C:\Windows\System32\vKgqNxC.exe
  2⤵
  PID:5220
- C:\Windows\System32\lPCZKzk.exe
  C:\Windows\System32\lPCZKzk.exe
  2⤵
  PID:5396
- C:\Windows\System32\gWaBWTI.exe
  C:\Windows\System32\gWaBWTI.exe
  2⤵
  PID:5548
- C:\Windows\System32\xBVIyBn.exe
  C:\Windows\System32\xBVIyBn.exe
  2⤵
  PID:5660
- C:\Windows\System32\WNBxNWv.exe
  C:\Windows\System32\WNBxNWv.exe
  2⤵
  PID:5864
- C:\Windows\System32\zzLhpXr.exe
  C:\Windows\System32\zzLhpXr.exe
  2⤵
  PID:6020
- C:\Windows\System32\DNlNyuY.exe
  C:\Windows\System32\DNlNyuY.exe
  2⤵
  PID:1732
- C:\Windows\System32\VHzuTdm.exe
  C:\Windows\System32\VHzuTdm.exe
  2⤵
  PID:5152
- C:\Windows\System32\jQcYsGp.exe
  C:\Windows\System32\jQcYsGp.exe
  2⤵
  PID:5468
- C:\Windows\System32\fZHilAW.exe
  C:\Windows\System32\fZHilAW.exe
  2⤵
  PID:5800
- C:\Windows\System32\BHyDUok.exe
  C:\Windows\System32\BHyDUok.exe
  2⤵
  PID:6052
- C:\Windows\System32\fXbyZRZ.exe
  C:\Windows\System32\fXbyZRZ.exe
  2⤵
  PID:6164
- C:\Windows\System32\atTqjbV.exe
  C:\Windows\System32\atTqjbV.exe
  2⤵
  PID:6192
- C:\Windows\System32\kkpTRmy.exe
  C:\Windows\System32\kkpTRmy.exe
  2⤵
  PID:6220
- C:\Windows\System32\whuPHCs.exe
  C:\Windows\System32\whuPHCs.exe
  2⤵
  PID:6248
- C:\Windows\System32\JhElHmL.exe
  C:\Windows\System32\JhElHmL.exe
  2⤵
  PID:6276
- C:\Windows\System32\luoaEeU.exe
  C:\Windows\System32\luoaEeU.exe
  2⤵
  PID:6304
- C:\Windows\System32\bmcEVAY.exe
  C:\Windows\System32\bmcEVAY.exe
  2⤵
  PID:6332
- C:\Windows\System32\GmhGxau.exe
  C:\Windows\System32\GmhGxau.exe
  2⤵
  PID:6360
- C:\Windows\System32\LjuhwfX.exe
  C:\Windows\System32\LjuhwfX.exe
  2⤵
  PID:6388
- C:\Windows\System32\pvnKEWr.exe
  C:\Windows\System32\pvnKEWr.exe
  2⤵
  PID:6416
- C:\Windows\System32\QcriXTq.exe
  C:\Windows\System32\QcriXTq.exe
  2⤵
  PID:6444
- C:\Windows\System32\HUVHWRJ.exe
  C:\Windows\System32\HUVHWRJ.exe
  2⤵
  PID:6472
- C:\Windows\System32\EDAaRxz.exe
  C:\Windows\System32\EDAaRxz.exe
  2⤵
  PID:6500
- C:\Windows\System32\ijGmMmk.exe
  C:\Windows\System32\ijGmMmk.exe
  2⤵
  PID:6528
- C:\Windows\System32\XOaAKRY.exe
  C:\Windows\System32\XOaAKRY.exe
  2⤵
  PID:6556
- C:\Windows\System32\FlMETbq.exe
  C:\Windows\System32\FlMETbq.exe
  2⤵
  PID:6584
- C:\Windows\System32\fUVDtjG.exe
  C:\Windows\System32\fUVDtjG.exe
  2⤵
  PID:6612
- C:\Windows\System32\ijRyucf.exe
  C:\Windows\System32\ijRyucf.exe
  2⤵
  PID:6640
- C:\Windows\System32\qOMUdkT.exe
  C:\Windows\System32\qOMUdkT.exe
  2⤵
  PID:6668
- C:\Windows\System32\ddeiMUC.exe
  C:\Windows\System32\ddeiMUC.exe
  2⤵
  PID:6696
- C:\Windows\System32\ofwLDjE.exe
  C:\Windows\System32\ofwLDjE.exe
  2⤵
  PID:6724
- C:\Windows\System32\QGQnfAd.exe
  C:\Windows\System32\QGQnfAd.exe
  2⤵
  PID:6752
- C:\Windows\System32\eZcMuah.exe
  C:\Windows\System32\eZcMuah.exe
  2⤵
  PID:6820
- C:\Windows\System32\QnXOeem.exe
  C:\Windows\System32\QnXOeem.exe
  2⤵
  PID:6844
- C:\Windows\System32\hJIJxxa.exe
  C:\Windows\System32\hJIJxxa.exe
  2⤵
  PID:6868
- C:\Windows\System32\ZTVVaBx.exe
  C:\Windows\System32\ZTVVaBx.exe
  2⤵
  PID:6900
- C:\Windows\System32\pbOJfZo.exe
  C:\Windows\System32\pbOJfZo.exe
  2⤵
  PID:6920
- C:\Windows\System32\soLhEtx.exe
  C:\Windows\System32\soLhEtx.exe
  2⤵
  PID:6960
- C:\Windows\System32\cIPyJyx.exe
  C:\Windows\System32\cIPyJyx.exe
  2⤵
  PID:7004
- C:\Windows\System32\PeUFGdb.exe
  C:\Windows\System32\PeUFGdb.exe
  2⤵
  PID:7024
- C:\Windows\System32\JeGdoFp.exe
  C:\Windows\System32\JeGdoFp.exe
  2⤵
  PID:7060
- C:\Windows\System32\ECOddtK.exe
  C:\Windows\System32\ECOddtK.exe
  2⤵
  PID:7092
- C:\Windows\System32\pyshrLV.exe
  C:\Windows\System32\pyshrLV.exe
  2⤵
  PID:7116
- C:\Windows\System32\vZAuUlB.exe
  C:\Windows\System32\vZAuUlB.exe
  2⤵
  PID:5348
- C:\Windows\System32\cITUKPI.exe
  C:\Windows\System32\cITUKPI.exe
  2⤵
  PID:1748
- C:\Windows\System32\CUkPILz.exe
  C:\Windows\System32\CUkPILz.exe
  2⤵
  PID:6148
- C:\Windows\System32\SQjzXfK.exe
  C:\Windows\System32\SQjzXfK.exe
  2⤵
  PID:2684
- C:\Windows\System32\pjqKnPi.exe
  C:\Windows\System32\pjqKnPi.exe
  2⤵
  PID:6288
- C:\Windows\System32\EarNrjn.exe
  C:\Windows\System32\EarNrjn.exe
  2⤵
  PID:6344
- C:\Windows\System32\NpKuWjS.exe
  C:\Windows\System32\NpKuWjS.exe
  2⤵
  PID:6384
- C:\Windows\System32\dpqcsvs.exe
  C:\Windows\System32\dpqcsvs.exe
  2⤵
  PID:6428
- C:\Windows\System32\QJxuHnL.exe
  C:\Windows\System32\QJxuHnL.exe
  2⤵
  PID:6568
- C:\Windows\System32\qzoavNz.exe
  C:\Windows\System32\qzoavNz.exe
  2⤵
  PID:6596
- C:\Windows\System32\eBtiCfJ.exe
  C:\Windows\System32\eBtiCfJ.exe
  2⤵
  PID:6656
- C:\Windows\System32\KmQkqfA.exe
  C:\Windows\System32\KmQkqfA.exe
  2⤵
  PID:2844
- C:\Windows\System32\tUAwtaJ.exe
  C:\Windows\System32\tUAwtaJ.exe
  2⤵
  PID:5056
- C:\Windows\System32\VPHGRvV.exe
  C:\Windows\System32\VPHGRvV.exe
  2⤵
  PID:6740
- C:\Windows\System32\KXsHevG.exe
  C:\Windows\System32\KXsHevG.exe
  2⤵
  PID:2276
- C:\Windows\System32\Xmalwjn.exe
  C:\Windows\System32\Xmalwjn.exe
  2⤵
  PID:6876
- C:\Windows\System32\anyPGks.exe
  C:\Windows\System32\anyPGks.exe
  2⤵
  PID:5044
- C:\Windows\System32\kAuHrBP.exe
  C:\Windows\System32\kAuHrBP.exe
  2⤵
  PID:6916
- C:\Windows\System32\vIvVYgK.exe
  C:\Windows\System32\vIvVYgK.exe
  2⤵
  PID:6912
- C:\Windows\System32\JkYvKkm.exe
  C:\Windows\System32\JkYvKkm.exe
  2⤵
  PID:6984
- C:\Windows\System32\yeUARxj.exe
  C:\Windows\System32\yeUARxj.exe
  2⤵
  PID:7088
- C:\Windows\System32\IaoIgeW.exe
  C:\Windows\System32\IaoIgeW.exe
  2⤵
  PID:7164
- C:\Windows\System32\uofMpWz.exe
  C:\Windows\System32\uofMpWz.exe
  2⤵
  PID:6216
- C:\Windows\System32\FcAwpVA.exe
  C:\Windows\System32\FcAwpVA.exe
  2⤵
  PID:1500
- C:\Windows\System32\hdViiQZ.exe
  C:\Windows\System32\hdViiQZ.exe
  2⤵
  PID:6348
- C:\Windows\System32\PUDzPJe.exe
  C:\Windows\System32\PUDzPJe.exe
  2⤵
  PID:6664
- C:\Windows\System32\kQsjMcy.exe
  C:\Windows\System32\kQsjMcy.exe
  2⤵
  PID:5092
- C:\Windows\System32\IRfiYjr.exe
  C:\Windows\System32\IRfiYjr.exe
  2⤵
  PID:6840
- C:\Windows\System32\vIRGiwQ.exe
  C:\Windows\System32\vIRGiwQ.exe
  2⤵
  PID:4992
- C:\Windows\System32\YotgsdW.exe
  C:\Windows\System32\YotgsdW.exe
  2⤵
  PID:6948
- C:\Windows\System32\ywpzdPu.exe
  C:\Windows\System32\ywpzdPu.exe
  2⤵
  PID:7140
- C:\Windows\System32\pYJQZBH.exe
  C:\Windows\System32\pYJQZBH.exe
  2⤵
  PID:3320
- C:\Windows\System32\WaTMvxF.exe
  C:\Windows\System32\WaTMvxF.exe
  2⤵
  PID:6692
- C:\Windows\System32\cBbRuNY.exe
  C:\Windows\System32\cBbRuNY.exe
  2⤵
  PID:6860
- C:\Windows\System32\jbnsTpO.exe
  C:\Windows\System32\jbnsTpO.exe
  2⤵
  PID:6176
- C:\Windows\System32\SHwclPr.exe
  C:\Windows\System32\SHwclPr.exe
  2⤵
  PID:6544
- C:\Windows\System32\QGBktSk.exe
  C:\Windows\System32\QGBktSk.exe
  2⤵
  PID:6572
- C:\Windows\System32\cSiFXwR.exe
  C:\Windows\System32\cSiFXwR.exe
  2⤵
  PID:7080
- C:\Windows\System32\HLRWmdK.exe
  C:\Windows\System32\HLRWmdK.exe
  2⤵
  PID:7196
- C:\Windows\System32\okJVLZP.exe
  C:\Windows\System32\okJVLZP.exe
  2⤵
  PID:7232
- C:\Windows\System32\KoAlZWw.exe
  C:\Windows\System32\KoAlZWw.exe
  2⤵
  PID:7264
- C:\Windows\System32\FnKffOD.exe
  C:\Windows\System32\FnKffOD.exe
  2⤵
  PID:7292
- C:\Windows\System32\XTBeCXD.exe
  C:\Windows\System32\XTBeCXD.exe
  2⤵
  PID:7320
- C:\Windows\System32\fwihxbJ.exe
  C:\Windows\System32\fwihxbJ.exe
  2⤵
  PID:7340
- C:\Windows\System32\JPxudxv.exe
  C:\Windows\System32\JPxudxv.exe
  2⤵
  PID:7376
- C:\Windows\System32\eqFcmcv.exe
  C:\Windows\System32\eqFcmcv.exe
  2⤵
  PID:7404
- C:\Windows\System32\lzNYihx.exe
  C:\Windows\System32\lzNYihx.exe
  2⤵
  PID:7424
- C:\Windows\System32\CWGRlYB.exe
  C:\Windows\System32\CWGRlYB.exe
  2⤵
  PID:7452
- C:\Windows\System32\euHPMkz.exe
  C:\Windows\System32\euHPMkz.exe
  2⤵
  PID:7484
- C:\Windows\System32\UppCaSH.exe
  C:\Windows\System32\UppCaSH.exe
  2⤵
  PID:7516
- C:\Windows\System32\KOQjgfv.exe
  C:\Windows\System32\KOQjgfv.exe
  2⤵
  PID:7544
- C:\Windows\System32\gbyljTj.exe
  C:\Windows\System32\gbyljTj.exe
  2⤵
  PID:7564
- C:\Windows\System32\TIMlDez.exe
  C:\Windows\System32\TIMlDez.exe
  2⤵
  PID:7592
- C:\Windows\System32\yevAiVZ.exe
  C:\Windows\System32\yevAiVZ.exe
  2⤵
  PID:7620
- C:\Windows\System32\ESjssrp.exe
  C:\Windows\System32\ESjssrp.exe
  2⤵
  PID:7656
- C:\Windows\System32\iHxjbFW.exe
  C:\Windows\System32\iHxjbFW.exe
  2⤵
  PID:7676
- C:\Windows\System32\HgZVhkL.exe
  C:\Windows\System32\HgZVhkL.exe
  2⤵
  PID:7704
- C:\Windows\System32\BOKPBpR.exe
  C:\Windows\System32\BOKPBpR.exe
  2⤵
  PID:7740
- C:\Windows\System32\NcmvLRc.exe
  C:\Windows\System32\NcmvLRc.exe
  2⤵
  PID:7760
- C:\Windows\System32\xOOoSVy.exe
  C:\Windows\System32\xOOoSVy.exe
  2⤵
  PID:7796
- C:\Windows\System32\JNbgcTh.exe
  C:\Windows\System32\JNbgcTh.exe
  2⤵
  PID:7820
- C:\Windows\System32\dSshrzB.exe
  C:\Windows\System32\dSshrzB.exe
  2⤵
  PID:7844
- C:\Windows\System32\xBPxoUP.exe
  C:\Windows\System32\xBPxoUP.exe
  2⤵
  PID:7876
- C:\Windows\System32\WMinEhD.exe
  C:\Windows\System32\WMinEhD.exe
  2⤵
  PID:7904
- C:\Windows\System32\IZWUqOr.exe
  C:\Windows\System32\IZWUqOr.exe
  2⤵
  PID:7928
- C:\Windows\System32\JYasiSW.exe
  C:\Windows\System32\JYasiSW.exe
  2⤵
  PID:7956
- C:\Windows\System32\GKkiCXA.exe
  C:\Windows\System32\GKkiCXA.exe
  2⤵
  PID:7984
- C:\Windows\System32\nhtyrDw.exe
  C:\Windows\System32\nhtyrDw.exe
  2⤵
  PID:8012
- C:\Windows\System32\mhfVVai.exe
  C:\Windows\System32\mhfVVai.exe
  2⤵
  PID:8040
- C:\Windows\System32\qrdjDit.exe
  C:\Windows\System32\qrdjDit.exe
  2⤵
  PID:8076
- C:\Windows\System32\lHxlDXy.exe
  C:\Windows\System32\lHxlDXy.exe
  2⤵
  PID:8104
- C:\Windows\System32\EevCiuj.exe
  C:\Windows\System32\EevCiuj.exe
  2⤵
  PID:8128
- C:\Windows\System32\ImVUUAo.exe
  C:\Windows\System32\ImVUUAo.exe
  2⤵
  PID:8156
- C:\Windows\System32\yLXfQLh.exe
  C:\Windows\System32\yLXfQLh.exe
  2⤵
  PID:8188
- C:\Windows\System32\tNddHbw.exe
  C:\Windows\System32\tNddHbw.exe
  2⤵
  PID:7240
- C:\Windows\System32\gfFKWWq.exe
  C:\Windows\System32\gfFKWWq.exe
  2⤵
  PID:7304
- C:\Windows\System32\CLqSFmX.exe
  C:\Windows\System32\CLqSFmX.exe
  2⤵
  PID:7364
- C:\Windows\System32\nLJFAPI.exe
  C:\Windows\System32\nLJFAPI.exe
  2⤵
  PID:7436
- C:\Windows\System32\vYzLewu.exe
  C:\Windows\System32\vYzLewu.exe
  2⤵
  PID:7496
- C:\Windows\System32\ReIeArT.exe
  C:\Windows\System32\ReIeArT.exe
  2⤵
  PID:7552
- C:\Windows\System32\upBwZEG.exe
  C:\Windows\System32\upBwZEG.exe
  2⤵
  PID:7612
- C:\Windows\System32\behvuXf.exe
  C:\Windows\System32\behvuXf.exe
  2⤵
  PID:7668
- C:\Windows\System32\BoLUePG.exe
  C:\Windows\System32\BoLUePG.exe
  2⤵
  PID:7696
- C:\Windows\System32\WbMKxTA.exe
  C:\Windows\System32\WbMKxTA.exe
  2⤵
  PID:7752
- C:\Windows\System32\VgsplWt.exe
  C:\Windows\System32\VgsplWt.exe
  2⤵
  PID:7808
- C:\Windows\System32\RKUxevB.exe
  C:\Windows\System32\RKUxevB.exe
  2⤵
  PID:7864
- C:\Windows\System32\wHTNSAO.exe
  C:\Windows\System32\wHTNSAO.exe
  2⤵
  PID:7924
- C:\Windows\System32\HRwQeRT.exe
  C:\Windows\System32\HRwQeRT.exe
  2⤵
  PID:7980
- C:\Windows\System32\OCsihlT.exe
  C:\Windows\System32\OCsihlT.exe
  2⤵
  PID:6400
- C:\Windows\System32\uEvRpGM.exe
  C:\Windows\System32\uEvRpGM.exe
  2⤵
  PID:8088
- C:\Windows\System32\VKDxsXq.exe
  C:\Windows\System32\VKDxsXq.exe
  2⤵
  PID:8152
- C:\Windows\System32\rrUrwsI.exe
  C:\Windows\System32\rrUrwsI.exe
  2⤵
  PID:7212
- C:\Windows\System32\FyPfauR.exe
  C:\Windows\System32\FyPfauR.exe
  2⤵
  PID:7388
- C:\Windows\System32\aEavOxS.exe
  C:\Windows\System32\aEavOxS.exe
  2⤵
  PID:7524
- C:\Windows\System32\kxvURtl.exe
  C:\Windows\System32\kxvURtl.exe
  2⤵
  PID:1880
- C:\Windows\System32\iTQWfNi.exe
  C:\Windows\System32\iTQWfNi.exe
  2⤵
  PID:7556
- C:\Windows\System32\AkRbiVs.exe
  C:\Windows\System32\AkRbiVs.exe
  2⤵
  PID:2948
- C:\Windows\System32\HAkPIVI.exe
  C:\Windows\System32\HAkPIVI.exe
  2⤵
  PID:7688
- C:\Windows\System32\dklGXJy.exe
  C:\Windows\System32\dklGXJy.exe
  2⤵
  PID:7840
- C:\Windows\System32\AKXtbPG.exe
  C:\Windows\System32\AKXtbPG.exe
  2⤵
  PID:5976
- C:\Windows\System32\xULDXfy.exe
  C:\Windows\System32\xULDXfy.exe
  2⤵
  PID:8060
- C:\Windows\System32\iWaPMSF.exe
  C:\Windows\System32\iWaPMSF.exe
  2⤵
  PID:7272
- C:\Windows\System32\eWuPKbe.exe
  C:\Windows\System32\eWuPKbe.exe
  2⤵
  PID:1392
- C:\Windows\System32\pNUZUNo.exe
  C:\Windows\System32\pNUZUNo.exe
  2⤵
  PID:5032
- C:\Windows\System32\deHvNhx.exe
  C:\Windows\System32\deHvNhx.exe
  2⤵
  PID:7888
- C:\Windows\System32\hlJTlqm.exe
  C:\Windows\System32\hlJTlqm.exe
  2⤵
  PID:8176
- C:\Windows\System32\OdVUriz.exe
  C:\Windows\System32\OdVUriz.exe
  2⤵
  PID:7584
- C:\Windows\System32\odiDMUf.exe
  C:\Windows\System32\odiDMUf.exe
  2⤵
  PID:8168
- C:\Windows\System32\EqRdTdZ.exe
  C:\Windows\System32\EqRdTdZ.exe
  2⤵
  PID:7784
- C:\Windows\System32\mjCVRRC.exe
  C:\Windows\System32\mjCVRRC.exe
  2⤵
  PID:8212
- C:\Windows\System32\eWtBEhz.exe
  C:\Windows\System32\eWtBEhz.exe
  2⤵
  PID:8240
- C:\Windows\System32\TOIleae.exe
  C:\Windows\System32\TOIleae.exe
  2⤵
  PID:8268
- C:\Windows\System32\OuXORnG.exe
  C:\Windows\System32\OuXORnG.exe
  2⤵
  PID:8296
- C:\Windows\System32\pjKccdS.exe
  C:\Windows\System32\pjKccdS.exe
  2⤵
  PID:8324
- C:\Windows\System32\xNqMJOu.exe
  C:\Windows\System32\xNqMJOu.exe
  2⤵
  PID:8352
- C:\Windows\System32\SoiBXVX.exe
  C:\Windows\System32\SoiBXVX.exe
  2⤵
  PID:8392
- C:\Windows\System32\BoBOQVG.exe
  C:\Windows\System32\BoBOQVG.exe
  2⤵
  PID:8420
- C:\Windows\System32\rMwqMyh.exe
  C:\Windows\System32\rMwqMyh.exe
  2⤵
  PID:8448
- C:\Windows\System32\RJZAFSg.exe
  C:\Windows\System32\RJZAFSg.exe
  2⤵
  PID:8476
- C:\Windows\System32\fzvJqJM.exe
  C:\Windows\System32\fzvJqJM.exe
  2⤵
  PID:8504
- C:\Windows\System32\GFGLIOm.exe
  C:\Windows\System32\GFGLIOm.exe
  2⤵
  PID:8532
- C:\Windows\System32\nPSFEtM.exe
  C:\Windows\System32\nPSFEtM.exe
  2⤵
  PID:8560
- C:\Windows\System32\VcZYEGR.exe
  C:\Windows\System32\VcZYEGR.exe
  2⤵
  PID:8588
- C:\Windows\System32\TEaEqvX.exe
  C:\Windows\System32\TEaEqvX.exe
  2⤵
  PID:8616
- C:\Windows\System32\pbLsaax.exe
  C:\Windows\System32\pbLsaax.exe
  2⤵
  PID:8644
- C:\Windows\System32\lqgrwol.exe
  C:\Windows\System32\lqgrwol.exe
  2⤵
  PID:8672
- C:\Windows\System32\DYhbmFX.exe
  C:\Windows\System32\DYhbmFX.exe
  2⤵
  PID:8700
- C:\Windows\System32\TQFpnQQ.exe
  C:\Windows\System32\TQFpnQQ.exe
  2⤵
  PID:8728
- C:\Windows\System32\iVVQnag.exe
  C:\Windows\System32\iVVQnag.exe
  2⤵
  PID:8756
- C:\Windows\System32\yuNUmaB.exe
  C:\Windows\System32\yuNUmaB.exe
  2⤵
  PID:8792
- C:\Windows\System32\yKECyLE.exe
  C:\Windows\System32\yKECyLE.exe
  2⤵
  PID:8812
- C:\Windows\System32\mSFEqby.exe
  C:\Windows\System32\mSFEqby.exe
  2⤵
  PID:8840
- C:\Windows\System32\bUxPfxe.exe
  C:\Windows\System32\bUxPfxe.exe
  2⤵
  PID:8868
- C:\Windows\System32\MNqymsU.exe
  C:\Windows\System32\MNqymsU.exe
  2⤵
  PID:8896
- C:\Windows\System32\SWVRnCm.exe
  C:\Windows\System32\SWVRnCm.exe
  2⤵
  PID:8924
- C:\Windows\System32\yZYLJGL.exe
  C:\Windows\System32\yZYLJGL.exe
  2⤵
  PID:8952
- C:\Windows\System32\qkLNrUO.exe
  C:\Windows\System32\qkLNrUO.exe
  2⤵
  PID:8980
- C:\Windows\System32\qqujTtx.exe
  C:\Windows\System32\qqujTtx.exe
  2⤵
  PID:9000
- C:\Windows\System32\YkhnUkd.exe
  C:\Windows\System32\YkhnUkd.exe
  2⤵
  PID:9032
- C:\Windows\System32\OpkHYko.exe
  C:\Windows\System32\OpkHYko.exe
  2⤵
  PID:9052
- C:\Windows\System32\qGnLeKQ.exe
  C:\Windows\System32\qGnLeKQ.exe
  2⤵
  PID:9084
- C:\Windows\System32\pAVVfGj.exe
  C:\Windows\System32\pAVVfGj.exe
  2⤵
  PID:9104
- C:\Windows\System32\sxnJOIf.exe
  C:\Windows\System32\sxnJOIf.exe
  2⤵
  PID:9148
- C:\Windows\System32\mgJPmDl.exe
  C:\Windows\System32\mgJPmDl.exe
  2⤵
  PID:9176
- C:\Windows\System32\vreowSD.exe
  C:\Windows\System32\vreowSD.exe
  2⤵
  PID:9204
- C:\Windows\System32\qEUyfXh.exe
  C:\Windows\System32\qEUyfXh.exe
  2⤵
  PID:8232
- C:\Windows\System32\KnjjmHs.exe
  C:\Windows\System32\KnjjmHs.exe
  2⤵
  PID:8312
- C:\Windows\System32\EqazOFF.exe
  C:\Windows\System32\EqazOFF.exe
  2⤵
  PID:8372
- C:\Windows\System32\reRaTPC.exe
  C:\Windows\System32\reRaTPC.exe
  2⤵
  PID:8412
- C:\Windows\System32\aarzacH.exe
  C:\Windows\System32\aarzacH.exe
  2⤵
  PID:8468
- C:\Windows\System32\MDAMPFI.exe
  C:\Windows\System32\MDAMPFI.exe
  2⤵
  PID:8528
- C:\Windows\System32\FNDffuQ.exe
  C:\Windows\System32\FNDffuQ.exe
  2⤵
  PID:8608
- C:\Windows\System32\cDgansu.exe
  C:\Windows\System32\cDgansu.exe
  2⤵
  PID:8668
- C:\Windows\System32\obbCpFI.exe
  C:\Windows\System32\obbCpFI.exe
  2⤵
  PID:8712
- C:\Windows\System32\cOGGpul.exe
  C:\Windows\System32\cOGGpul.exe
  2⤵
  PID:8808
- C:\Windows\System32\cZgmDMQ.exe
  C:\Windows\System32\cZgmDMQ.exe
  2⤵
  PID:8864
- C:\Windows\System32\jfJZUFY.exe
  C:\Windows\System32\jfJZUFY.exe
  2⤵
  PID:8940
- C:\Windows\System32\BMtcrYz.exe
  C:\Windows\System32\BMtcrYz.exe
  2⤵
  PID:8992
- C:\Windows\System32\fyrbZRj.exe
  C:\Windows\System32\fyrbZRj.exe
  2⤵
  PID:9064
- C:\Windows\System32\ucanyJk.exe
  C:\Windows\System32\ucanyJk.exe
  2⤵
  PID:9132
- C:\Windows\System32\nzaHFIM.exe
  C:\Windows\System32\nzaHFIM.exe
  2⤵
  PID:9168
- C:\Windows\System32\eaVgbNz.exe
  C:\Windows\System32\eaVgbNz.exe
  2⤵
  PID:8252
- C:\Windows\System32\ibTKZWJ.exe
  C:\Windows\System32\ibTKZWJ.exe
  2⤵
  PID:2484
- C:\Windows\System32\ktovMCy.exe
  C:\Windows\System32\ktovMCy.exe
  2⤵
  PID:8520
- C:\Windows\System32\dlQcycq.exe
  C:\Windows\System32\dlQcycq.exe
  2⤵
  PID:8656
- C:\Windows\System32\pmTrUPu.exe
  C:\Windows\System32\pmTrUPu.exe
  2⤵
  PID:8800
- C:\Windows\System32\GIGmivy.exe
  C:\Windows\System32\GIGmivy.exe
  2⤵
  PID:8964
- C:\Windows\System32\kTwgOlE.exe
  C:\Windows\System32\kTwgOlE.exe
  2⤵
  PID:9096
- C:\Windows\System32\tlwKoeW.exe
  C:\Windows\System32\tlwKoeW.exe
  2⤵
  PID:8224
- C:\Windows\System32\UhojoTb.exe
  C:\Windows\System32\UhojoTb.exe
  2⤵
  PID:8460
- C:\Windows\System32\wpRiOaJ.exe
  C:\Windows\System32\wpRiOaJ.exe
  2⤵
  PID:8748
- C:\Windows\System32\xngiWTJ.exe
  C:\Windows\System32\xngiWTJ.exe
  2⤵
  PID:4716
- C:\Windows\System32\OLpMvRI.exe
  C:\Windows\System32\OLpMvRI.exe
  2⤵
  PID:3432
- C:\Windows\System32\YwikCxZ.exe
  C:\Windows\System32\YwikCxZ.exe
  2⤵
  PID:1652
- C:\Windows\System32\VKSTpxO.exe
  C:\Windows\System32\VKSTpxO.exe
  2⤵
  PID:9240
- C:\Windows\System32\oJdCohV.exe
  C:\Windows\System32\oJdCohV.exe
  2⤵
  PID:9268
- C:\Windows\System32\ITJGmhq.exe
  C:\Windows\System32\ITJGmhq.exe
  2⤵
  PID:9296
- C:\Windows\System32\SsghjBP.exe
  C:\Windows\System32\SsghjBP.exe
  2⤵
  PID:9320
- C:\Windows\System32\svDtXGH.exe
  C:\Windows\System32\svDtXGH.exe
  2⤵
  PID:9352
- C:\Windows\System32\JelfFTP.exe
  C:\Windows\System32\JelfFTP.exe
  2⤵
  PID:9380
- C:\Windows\System32\aqFCyVI.exe
  C:\Windows\System32\aqFCyVI.exe
  2⤵
  PID:9404
- C:\Windows\System32\WXspqxS.exe
  C:\Windows\System32\WXspqxS.exe
  2⤵
  PID:9428
- C:\Windows\System32\rZixlwr.exe
  C:\Windows\System32\rZixlwr.exe
  2⤵
  PID:9464
- C:\Windows\System32\GrsaWCM.exe
  C:\Windows\System32\GrsaWCM.exe
  2⤵
  PID:9492
- C:\Windows\System32\PSazSLE.exe
  C:\Windows\System32\PSazSLE.exe
  2⤵
  PID:9520
- C:\Windows\System32\dzeykSA.exe
  C:\Windows\System32\dzeykSA.exe
  2⤵
  PID:9548
- C:\Windows\System32\TZYBNUJ.exe
  C:\Windows\System32\TZYBNUJ.exe
  2⤵
  PID:9576
- C:\Windows\System32\DXxRxsQ.exe
  C:\Windows\System32\DXxRxsQ.exe
  2⤵
  PID:9604
- C:\Windows\System32\EfnKaxD.exe
  C:\Windows\System32\EfnKaxD.exe
  2⤵
  PID:9620
- C:\Windows\System32\jKyDtEO.exe
  C:\Windows\System32\jKyDtEO.exe
  2⤵
  PID:9660
- C:\Windows\System32\LgiLbVw.exe
  C:\Windows\System32\LgiLbVw.exe
  2⤵
  PID:9692
- C:\Windows\System32\mTwSiKi.exe
  C:\Windows\System32\mTwSiKi.exe
  2⤵
  PID:9716
- C:\Windows\System32\lKTBTEa.exe
  C:\Windows\System32\lKTBTEa.exe
  2⤵
  PID:9732
- C:\Windows\System32\CIULcfG.exe
  C:\Windows\System32\CIULcfG.exe
  2⤵
  PID:9772
- C:\Windows\System32\UpYwiUR.exe
  C:\Windows\System32\UpYwiUR.exe
  2⤵
  PID:9800
- C:\Windows\System32\uwrHpNr.exe
  C:\Windows\System32\uwrHpNr.exe
  2⤵
  PID:9832
- C:\Windows\System32\buasvND.exe
  C:\Windows\System32\buasvND.exe
  2⤵
  PID:9856
- C:\Windows\System32\ssxOnQD.exe
  C:\Windows\System32\ssxOnQD.exe
  2⤵
  PID:9888
- C:\Windows\System32\ldMreLS.exe
  C:\Windows\System32\ldMreLS.exe
  2⤵
  PID:9912
- C:\Windows\System32\DHSguCS.exe
  C:\Windows\System32\DHSguCS.exe
  2⤵
  PID:9932
- C:\Windows\System32\UTTXyiH.exe
  C:\Windows\System32\UTTXyiH.exe
  2⤵
  PID:9972
- C:\Windows\System32\AbRLGgw.exe
  C:\Windows\System32\AbRLGgw.exe
  2⤵
  PID:10000
- C:\Windows\System32\iNOpbio.exe
  C:\Windows\System32\iNOpbio.exe
  2⤵
  PID:10020
- C:\Windows\System32\OTxxeJW.exe
  C:\Windows\System32\OTxxeJW.exe
  2⤵
  PID:10048
- C:\Windows\System32\CfhwTWj.exe
  C:\Windows\System32\CfhwTWj.exe
  2⤵
  PID:10084
- C:\Windows\System32\VecnELL.exe
  C:\Windows\System32\VecnELL.exe
  2⤵
  PID:10112
- C:\Windows\System32\PINoETU.exe
  C:\Windows\System32\PINoETU.exe
  2⤵
  PID:10140
- C:\Windows\System32\WcTTdEZ.exe
  C:\Windows\System32\WcTTdEZ.exe
  2⤵
  PID:10168
- C:\Windows\System32\KamoqnB.exe
  C:\Windows\System32\KamoqnB.exe
  2⤵
  PID:10188
- C:\Windows\System32\QcghpDh.exe
  C:\Windows\System32\QcghpDh.exe
  2⤵
  PID:10224
- C:\Windows\System32\fhfuznn.exe
  C:\Windows\System32\fhfuznn.exe
  2⤵
  PID:9236
- C:\Windows\System32\XSVRiWj.exe
  C:\Windows\System32\XSVRiWj.exe
  2⤵
  PID:9288
- C:\Windows\System32\LuWvGdl.exe
  C:\Windows\System32\LuWvGdl.exe
  2⤵
  PID:9348
- C:\Windows\System32\tnvHlnm.exe
  C:\Windows\System32\tnvHlnm.exe
  2⤵
  PID:9396
- C:\Windows\System32\QAfADgY.exe
  C:\Windows\System32\QAfADgY.exe
  2⤵
  PID:9456
- C:\Windows\System32\CEbKObP.exe
  C:\Windows\System32\CEbKObP.exe
  2⤵
  PID:9516
- C:\Windows\System32\zJzVlew.exe
  C:\Windows\System32\zJzVlew.exe
  2⤵
  PID:9116
- C:\Windows\System32\SAPPGIe.exe
  C:\Windows\System32\SAPPGIe.exe
  2⤵
  PID:9648
- C:\Windows\System32\vVVbfup.exe
  C:\Windows\System32\vVVbfup.exe
  2⤵
  PID:9700
- C:\Windows\System32\zRNSKCV.exe
  C:\Windows\System32\zRNSKCV.exe
  2⤵
  PID:9764
- C:\Windows\System32\wHuxitt.exe
  C:\Windows\System32\wHuxitt.exe
  2⤵
  PID:9812
- C:\Windows\System32\CRiSjZz.exe
  C:\Windows\System32\CRiSjZz.exe
  2⤵
  PID:720
- C:\Windows\System32\zkhYvpC.exe
  C:\Windows\System32\zkhYvpC.exe
  2⤵
  PID:9920
- C:\Windows\System32\xQFEOjA.exe
  C:\Windows\System32\xQFEOjA.exe
  2⤵
  PID:9960
- C:\Windows\System32\CSlOKKr.exe
  C:\Windows\System32\CSlOKKr.exe
  2⤵
  PID:10064
- C:\Windows\System32\nDfhDmz.exe
  C:\Windows\System32\nDfhDmz.exe
  2⤵
  PID:10108
- C:\Windows\System32\qChbEPF.exe
  C:\Windows\System32\qChbEPF.exe
  2⤵
  PID:10156
- C:\Windows\System32\ECsnwbe.exe
  C:\Windows\System32\ECsnwbe.exe
  2⤵
  PID:10232
- C:\Windows\System32\VZKiaiM.exe
  C:\Windows\System32\VZKiaiM.exe
  2⤵
  PID:9316
- C:\Windows\System32\pbHQzDi.exe
  C:\Windows\System32\pbHQzDi.exe
  2⤵
  PID:9416
- C:\Windows\System32\PEIfMiC.exe
  C:\Windows\System32\PEIfMiC.exe
  2⤵
  PID:9596
- C:\Windows\System32\vVTDpVt.exe
  C:\Windows\System32\vVTDpVt.exe
  2⤵
  PID:9728
- C:\Windows\System32\yofzexI.exe
  C:\Windows\System32\yofzexI.exe
  2⤵
  PID:1756
- C:\Windows\System32\egPXYAf.exe
  C:\Windows\System32\egPXYAf.exe
  2⤵
  PID:9992
- C:\Windows\System32\tgSMpSB.exe
  C:\Windows\System32\tgSMpSB.exe
  2⤵
  PID:10160
- C:\Windows\System32\fZYnDZL.exe
  C:\Windows\System32\fZYnDZL.exe
  2⤵
  PID:9280
- C:\Windows\System32\GoRTrCu.exe
  C:\Windows\System32\GoRTrCu.exe
  2⤵
  PID:9708
- C:\Windows\System32\mufZHcx.exe
  C:\Windows\System32\mufZHcx.exe
  2⤵
  PID:9956
- C:\Windows\System32\QydHdjJ.exe
  C:\Windows\System32\QydHdjJ.exe
  2⤵
  PID:10208
- C:\Windows\System32\oPzqAxy.exe
  C:\Windows\System32\oPzqAxy.exe
  2⤵
  PID:4400
- C:\Windows\System32\XZBvxBd.exe
  C:\Windows\System32\XZBvxBd.exe
  2⤵
  PID:4940
- C:\Windows\System32\lTNmYly.exe
  C:\Windows\System32\lTNmYly.exe
  2⤵
  PID:10272
- C:\Windows\System32\SYdRCGG.exe
  C:\Windows\System32\SYdRCGG.exe
  2⤵
  PID:10288
- C:\Windows\System32\owCWPCr.exe
  C:\Windows\System32\owCWPCr.exe
  2⤵
  PID:10316
- C:\Windows\System32\HcGrWNU.exe
  C:\Windows\System32\HcGrWNU.exe
  2⤵
  PID:10348
- C:\Windows\System32\dWlaPUL.exe
  C:\Windows\System32\dWlaPUL.exe
  2⤵
  PID:10372
- C:\Windows\System32\PGoIwoG.exe
  C:\Windows\System32\PGoIwoG.exe
  2⤵
  PID:10412
- C:\Windows\System32\lVyrvwu.exe
  C:\Windows\System32\lVyrvwu.exe
  2⤵
  PID:10440
- C:\Windows\System32\sxMsjWq.exe
  C:\Windows\System32\sxMsjWq.exe
  2⤵
  PID:10460
- C:\Windows\System32\KVaqaIL.exe
  C:\Windows\System32\KVaqaIL.exe
  2⤵
  PID:10496
- C:\Windows\System32\puQSwGS.exe
  C:\Windows\System32\puQSwGS.exe
  2⤵
  PID:10524
- C:\Windows\System32\bSqwHcF.exe
  C:\Windows\System32\bSqwHcF.exe
  2⤵
  PID:10552
- C:\Windows\System32\vWbhTxP.exe
  C:\Windows\System32\vWbhTxP.exe
  2⤵
  PID:10584
- C:\Windows\System32\KzyMICW.exe
  C:\Windows\System32\KzyMICW.exe
  2⤵
  PID:10616
- C:\Windows\System32\ogBFLoh.exe
  C:\Windows\System32\ogBFLoh.exe
  2⤵
  PID:10644
- C:\Windows\System32\ZRPbfub.exe
  C:\Windows\System32\ZRPbfub.exe
  2⤵
  PID:10668
- C:\Windows\System32\iwnAqtQ.exe
  C:\Windows\System32\iwnAqtQ.exe
  2⤵
  PID:10700
- C:\Windows\System32\pgYuqQu.exe
  C:\Windows\System32\pgYuqQu.exe
  2⤵
  PID:10728
- C:\Windows\System32\uiMOIyd.exe
  C:\Windows\System32\uiMOIyd.exe
  2⤵
  PID:10756
- C:\Windows\System32\TqvHrVB.exe
  C:\Windows\System32\TqvHrVB.exe
  2⤵
  PID:10784
- C:\Windows\System32\PrYmvtu.exe
  C:\Windows\System32\PrYmvtu.exe
  2⤵
  PID:10812
- C:\Windows\System32\MgWEcDd.exe
  C:\Windows\System32\MgWEcDd.exe
  2⤵
  PID:10840
- C:\Windows\System32\wtxrUfy.exe
  C:\Windows\System32\wtxrUfy.exe
  2⤵
  PID:10868
- C:\Windows\System32\IkcdHrL.exe
  C:\Windows\System32\IkcdHrL.exe
  2⤵
  PID:10896
- C:\Windows\System32\oDxKUXZ.exe
  C:\Windows\System32\oDxKUXZ.exe
  2⤵
  PID:10924
- C:\Windows\System32\yDZXnss.exe
  C:\Windows\System32\yDZXnss.exe
  2⤵
  PID:10952
- C:\Windows\System32\fVuqHxN.exe
  C:\Windows\System32\fVuqHxN.exe
  2⤵
  PID:10980
- C:\Windows\System32\DSJYnEU.exe
  C:\Windows\System32\DSJYnEU.exe
  2⤵
  PID:11008
- C:\Windows\System32\ouDYzbf.exe
  C:\Windows\System32\ouDYzbf.exe
  2⤵
  PID:11036
- C:\Windows\System32\mYMPEDC.exe
  C:\Windows\System32\mYMPEDC.exe
  2⤵
  PID:11064
- C:\Windows\System32\PmyZqER.exe
  C:\Windows\System32\PmyZqER.exe
  2⤵
  PID:11092
- C:\Windows\System32\yfZDNio.exe
  C:\Windows\System32\yfZDNio.exe
  2⤵
  PID:11120
- C:\Windows\System32\lSfbzrL.exe
  C:\Windows\System32\lSfbzrL.exe
  2⤵
  PID:11148
- C:\Windows\System32\hvTcULz.exe
  C:\Windows\System32\hvTcULz.exe
  2⤵
  PID:11176
- C:\Windows\System32\uRnApUm.exe
  C:\Windows\System32\uRnApUm.exe
  2⤵
  PID:11204
- C:\Windows\System32\sLLdthd.exe
  C:\Windows\System32\sLLdthd.exe
  2⤵
  PID:11232
- C:\Windows\System32\LMWvuwp.exe
  C:\Windows\System32\LMWvuwp.exe
  2⤵
  PID:11260
- C:\Windows\System32\RhKpYoF.exe
  C:\Windows\System32\RhKpYoF.exe
  2⤵
  PID:10284
- C:\Windows\System32\WJtOGen.exe
  C:\Windows\System32\WJtOGen.exe
  2⤵
  PID:10340
- C:\Windows\System32\qFSAeVg.exe
  C:\Windows\System32\qFSAeVg.exe
  2⤵
  PID:10408
- C:\Windows\System32\HMEJlvL.exe
  C:\Windows\System32\HMEJlvL.exe
  2⤵
  PID:10480
- C:\Windows\System32\Dcnskoa.exe
  C:\Windows\System32\Dcnskoa.exe
  2⤵
  PID:10548
- C:\Windows\System32\gzYTnzc.exe
  C:\Windows\System32\gzYTnzc.exe
  2⤵
  PID:10632
- C:\Windows\System32\CYNwnan.exe
  C:\Windows\System32\CYNwnan.exe
  2⤵
  PID:10692
- C:\Windows\System32\EtwSRZB.exe
  C:\Windows\System32\EtwSRZB.exe
  2⤵
  PID:10768
- C:\Windows\System32\XuRTeQv.exe
  C:\Windows\System32\XuRTeQv.exe
  2⤵
  PID:10832
- C:\Windows\System32\QfhqJDd.exe
  C:\Windows\System32\QfhqJDd.exe
  2⤵
  PID:10892
- C:\Windows\System32\DrcpbFd.exe
  C:\Windows\System32\DrcpbFd.exe
  2⤵
  PID:10968
- C:\Windows\System32\rGuyHan.exe
  C:\Windows\System32\rGuyHan.exe
  2⤵
  PID:11028
- C:\Windows\System32\AKMWNgu.exe
  C:\Windows\System32\AKMWNgu.exe
  2⤵
  PID:11080
- C:\Windows\System32\deDvhdg.exe
  C:\Windows\System32\deDvhdg.exe
  2⤵
  PID:11132
- C:\Windows\System32\Oahksby.exe
  C:\Windows\System32\Oahksby.exe
  2⤵
  PID:11196
- C:\Windows\System32\MXkrLFc.exe
  C:\Windows\System32\MXkrLFc.exe
  2⤵
  PID:11256
- C:\Windows\System32\KxKneJz.exe
  C:\Windows\System32\KxKneJz.exe
  2⤵
  PID:10356
- C:\Windows\System32\NkMdCHK.exe
  C:\Windows\System32\NkMdCHK.exe
  2⤵
  PID:10536
- C:\Windows\System32\NAzJxGJ.exe
  C:\Windows\System32\NAzJxGJ.exe
  2⤵
  PID:10688
- C:\Windows\System32\lvhBwwh.exe
  C:\Windows\System32\lvhBwwh.exe
  2⤵
  PID:10860
- C:\Windows\System32\gBaTlGM.exe
  C:\Windows\System32\gBaTlGM.exe
  2⤵
  PID:11004
- C:\Windows\System32\iNGtyXr.exe
  C:\Windows\System32\iNGtyXr.exe
  2⤵
  PID:9512
- C:\Windows\System32\jYTtUth.exe
  C:\Windows\System32\jYTtUth.exe
  2⤵
  PID:10268
- C:\Windows\System32\GahBFDO.exe
  C:\Windows\System32\GahBFDO.exe
  2⤵
  PID:10660
- C:\Windows\System32\uZHUXtY.exe
  C:\Windows\System32\uZHUXtY.exe
  2⤵
  PID:10992
- C:\Windows\System32\NnvRYng.exe
  C:\Windows\System32\NnvRYng.exe
  2⤵
  PID:10468
- C:\Windows\System32\TYRuABm.exe
  C:\Windows\System32\TYRuABm.exe
  2⤵
  PID:11116
- C:\Windows\System32\cjXjUgR.exe
  C:\Windows\System32\cjXjUgR.exe
  2⤵
  PID:11276
- C:\Windows\System32\AZvPRZz.exe
  C:\Windows\System32\AZvPRZz.exe
  2⤵
  PID:11292
- C:\Windows\System32\LsUdHzn.exe
  C:\Windows\System32\LsUdHzn.exe
  2⤵
  PID:11320
- C:\Windows\System32\VjJXgpG.exe
  C:\Windows\System32\VjJXgpG.exe
  2⤵
  PID:11348
- C:\Windows\System32\GUvHiKq.exe
  C:\Windows\System32\GUvHiKq.exe
  2⤵
  PID:11376
- C:\Windows\System32\GCVogBD.exe
  C:\Windows\System32\GCVogBD.exe
  2⤵
  PID:11404
- C:\Windows\System32\TjVlvMl.exe
  C:\Windows\System32\TjVlvMl.exe
  2⤵
  PID:11432
- C:\Windows\System32\etoXuWi.exe
  C:\Windows\System32\etoXuWi.exe
  2⤵
  PID:11460
- C:\Windows\System32\LHknPIN.exe
  C:\Windows\System32\LHknPIN.exe
  2⤵
  PID:11488
- C:\Windows\System32\GquvIuJ.exe
  C:\Windows\System32\GquvIuJ.exe
  2⤵
  PID:11516
- C:\Windows\System32\bJXyQBa.exe
  C:\Windows\System32\bJXyQBa.exe
  2⤵
  PID:11544
- C:\Windows\System32\tnkpQWW.exe
  C:\Windows\System32\tnkpQWW.exe
  2⤵
  PID:11572
- C:\Windows\System32\czTTVGi.exe
  C:\Windows\System32\czTTVGi.exe
  2⤵
  PID:11600
- C:\Windows\System32\JNEzjHL.exe
  C:\Windows\System32\JNEzjHL.exe
  2⤵
  PID:11628
- C:\Windows\System32\NdqwaVu.exe
  C:\Windows\System32\NdqwaVu.exe
  2⤵
  PID:11656
- C:\Windows\System32\XpSrMOW.exe
  C:\Windows\System32\XpSrMOW.exe
  2⤵
  PID:11684
- C:\Windows\System32\fOxVpRy.exe
  C:\Windows\System32\fOxVpRy.exe
  2⤵
  PID:11712
- C:\Windows\System32\IqIJeqL.exe
  C:\Windows\System32\IqIJeqL.exe
  2⤵
  PID:11740
- C:\Windows\System32\naoQzQq.exe
  C:\Windows\System32\naoQzQq.exe
  2⤵
  PID:11768
- C:\Windows\System32\plamzMv.exe
  C:\Windows\System32\plamzMv.exe
  2⤵
  PID:11796
- C:\Windows\System32\BvKiJaP.exe
  C:\Windows\System32\BvKiJaP.exe
  2⤵
  PID:11828
- C:\Windows\System32\aAWUoAQ.exe
  C:\Windows\System32\aAWUoAQ.exe
  2⤵
  PID:11856
- C:\Windows\System32\JFoEJaC.exe
  C:\Windows\System32\JFoEJaC.exe
  2⤵
  PID:11884
- C:\Windows\System32\XTtpyIB.exe
  C:\Windows\System32\XTtpyIB.exe
  2⤵
  PID:11912
- C:\Windows\System32\hTarFXG.exe
  C:\Windows\System32\hTarFXG.exe
  2⤵
  PID:11948
- C:\Windows\System32\HmsaoYL.exe
  C:\Windows\System32\HmsaoYL.exe
  2⤵
  PID:11968
- C:\Windows\System32\DQWUcgI.exe
  C:\Windows\System32\DQWUcgI.exe
  2⤵
  PID:11996
- C:\Windows\System32\ltSGXym.exe
  C:\Windows\System32\ltSGXym.exe
  2⤵
  PID:12024
- C:\Windows\System32\BQhJfFW.exe
  C:\Windows\System32\BQhJfFW.exe
  2⤵
  PID:12052
- C:\Windows\System32\NrPkUCK.exe
  C:\Windows\System32\NrPkUCK.exe
  2⤵
  PID:12080
- C:\Windows\System32\sRlPjoC.exe
  C:\Windows\System32\sRlPjoC.exe
  2⤵
  PID:12108
- C:\Windows\System32\wxXiyxM.exe
  C:\Windows\System32\wxXiyxM.exe
  2⤵
  PID:12136
- C:\Windows\System32\iuWvTdZ.exe
  C:\Windows\System32\iuWvTdZ.exe
  2⤵
  PID:12164
- C:\Windows\System32\JwLzsUb.exe
  C:\Windows\System32\JwLzsUb.exe
  2⤵
  PID:12192
- C:\Windows\System32\twLisJm.exe
  C:\Windows\System32\twLisJm.exe
  2⤵
  PID:12220
- C:\Windows\System32\dYDjcLb.exe
  C:\Windows\System32\dYDjcLb.exe
  2⤵
  PID:12248
- C:\Windows\System32\bJbvTfU.exe
  C:\Windows\System32\bJbvTfU.exe
  2⤵
  PID:12276
- C:\Windows\System32\OXWoixn.exe
  C:\Windows\System32\OXWoixn.exe
  2⤵
  PID:11304
- C:\Windows\System32\duQlseu.exe
  C:\Windows\System32\duQlseu.exe
  2⤵
  PID:11340
- C:\Windows\System32\RZCDPoY.exe
  C:\Windows\System32\RZCDPoY.exe
  2⤵
  PID:11428
- C:\Windows\System32\EbzWBGh.exe
  C:\Windows\System32\EbzWBGh.exe
  2⤵
  PID:11484
- C:\Windows\System32\uGMkzcM.exe
  C:\Windows\System32\uGMkzcM.exe
  2⤵
  PID:11556
- C:\Windows\System32\VLYbLId.exe
  C:\Windows\System32\VLYbLId.exe
  2⤵
  PID:11620
- C:\Windows\System32\GtXEoKU.exe
  C:\Windows\System32\GtXEoKU.exe
  2⤵
  PID:11680
- C:\Windows\System32\HqDySuK.exe
  C:\Windows\System32\HqDySuK.exe
  2⤵
  PID:11752
- C:\Windows\System32\ZcCwYvc.exe
  C:\Windows\System32\ZcCwYvc.exe
  2⤵
  PID:11820
- C:\Windows\System32\bLjapno.exe
  C:\Windows\System32\bLjapno.exe
  2⤵
  PID:11880
- C:\Windows\System32\kJjOGnB.exe
  C:\Windows\System32\kJjOGnB.exe
  2⤵
  PID:11956
- C:\Windows\System32\ZLtPPBf.exe
  C:\Windows\System32\ZLtPPBf.exe
  2⤵
  PID:12016
- C:\Windows\System32\kIuPvii.exe
  C:\Windows\System32\kIuPvii.exe
  2⤵
  PID:12076
- C:\Windows\System32\jmtfikB.exe
  C:\Windows\System32\jmtfikB.exe
  2⤵
  PID:12148
- C:\Windows\System32\ZwxXmFm.exe
  C:\Windows\System32\ZwxXmFm.exe
  2⤵
  PID:12212
- C:\Windows\System32\GgSIuwf.exe
  C:\Windows\System32\GgSIuwf.exe
  2⤵
  PID:12272
- C:\Windows\System32\gUGIzGM.exe
  C:\Windows\System32\gUGIzGM.exe
  2⤵
  PID:11388
- C:\Windows\System32\gZGZHrK.exe
  C:\Windows\System32\gZGZHrK.exe
  2⤵
  PID:11536
- C:\Windows\System32\yPLbCsb.exe
  C:\Windows\System32\yPLbCsb.exe
  2⤵
  PID:11676
- C:\Windows\System32\wUMhsxb.exe
  C:\Windows\System32\wUMhsxb.exe
  2⤵
  PID:11852
- C:\Windows\System32\YhiCkpU.exe
  C:\Windows\System32\YhiCkpU.exe
  2⤵
  PID:11992
- C:\Windows\System32\BNjWbQv.exe
  C:\Windows\System32\BNjWbQv.exe
  2⤵
  PID:12132
- C:\Windows\System32\fQbxHYz.exe
  C:\Windows\System32\fQbxHYz.exe
  2⤵
  PID:11284
- C:\Windows\System32\RYxDUpE.exe
  C:\Windows\System32\RYxDUpE.exe
  2⤵
  PID:11648
- C:\Windows\System32\jUVIzhk.exe
  C:\Windows\System32\jUVIzhk.exe
  2⤵
  PID:11980
- C:\Windows\System32\qxrcfKn.exe
  C:\Windows\System32\qxrcfKn.exe
  2⤵
  PID:12268
- C:\Windows\System32\RvDVutr.exe
  C:\Windows\System32\RvDVutr.exe
  2⤵
  PID:12264
- C:\Windows\System32\JlQEVWJ.exe
  C:\Windows\System32\JlQEVWJ.exe
  2⤵
  PID:12292
- C:\Windows\System32\ZaUrgDm.exe
  C:\Windows\System32\ZaUrgDm.exe
  2⤵
  PID:12320
- C:\Windows\System32\rymBMNe.exe
  C:\Windows\System32\rymBMNe.exe
  2⤵
  PID:12348
- C:\Windows\System32\HemNUKD.exe
  C:\Windows\System32\HemNUKD.exe
  2⤵
  PID:12376
- C:\Windows\System32\ZSwSEHe.exe
  C:\Windows\System32\ZSwSEHe.exe
  2⤵
  PID:12404
- C:\Windows\System32\TLfAXEg.exe
  C:\Windows\System32\TLfAXEg.exe
  2⤵
  PID:12436
- C:\Windows\System32\FBovwZF.exe
  C:\Windows\System32\FBovwZF.exe
  2⤵
  PID:12464
- C:\Windows\System32\LYNXVVN.exe
  C:\Windows\System32\LYNXVVN.exe
  2⤵
  PID:12492
- C:\Windows\System32\OXinbxY.exe
  C:\Windows\System32\OXinbxY.exe
  2⤵
  PID:12520
- C:\Windows\System32\CqPTwII.exe
  C:\Windows\System32\CqPTwII.exe
  2⤵
  PID:12548
- C:\Windows\System32\naXKJhU.exe
  C:\Windows\System32\naXKJhU.exe
  2⤵
  PID:12576
- C:\Windows\System32\ILeUsPA.exe
  C:\Windows\System32\ILeUsPA.exe
  2⤵
  PID:12604
- C:\Windows\System32\tjbhsXe.exe
  C:\Windows\System32\tjbhsXe.exe
  2⤵
  PID:12632
- C:\Windows\System32\vHADVDj.exe
  C:\Windows\System32\vHADVDj.exe
  2⤵
  PID:12660
- C:\Windows\System32\AHaRMRL.exe
  C:\Windows\System32\AHaRMRL.exe
  2⤵
  PID:12688
- C:\Windows\System32\MvNATjP.exe
  C:\Windows\System32\MvNATjP.exe
  2⤵
  PID:12716
- C:\Windows\System32\eFFnyLA.exe
  C:\Windows\System32\eFFnyLA.exe
  2⤵
  PID:12744
- C:\Windows\System32\NInfbRD.exe
  C:\Windows\System32\NInfbRD.exe
  2⤵
  PID:12772
- C:\Windows\System32\bdwiuHS.exe
  C:\Windows\System32\bdwiuHS.exe
  2⤵
  PID:12800
- C:\Windows\System32\ABiaDqp.exe
  C:\Windows\System32\ABiaDqp.exe
  2⤵
  PID:12828
- C:\Windows\System32\WtUDAET.exe
  C:\Windows\System32\WtUDAET.exe
  2⤵
  PID:12856
- C:\Windows\System32\RcHCPtL.exe
  C:\Windows\System32\RcHCPtL.exe
  2⤵
  PID:12872
- C:\Windows\System32\LPKCOjj.exe
  C:\Windows\System32\LPKCOjj.exe
  2⤵
  PID:12912
- C:\Windows\System32\eFDNWSr.exe
  C:\Windows\System32\eFDNWSr.exe
  2⤵
  PID:12940
- C:\Windows\System32\jbwiVBQ.exe
  C:\Windows\System32\jbwiVBQ.exe
  2⤵
  PID:12968
- C:\Windows\System32\rLMRXVU.exe
  C:\Windows\System32\rLMRXVU.exe
  2⤵
  PID:12996
- C:\Windows\System32\yNPQfwF.exe
  C:\Windows\System32\yNPQfwF.exe
  2⤵
  PID:13024
- C:\Windows\System32\MNqYaqE.exe
  C:\Windows\System32\MNqYaqE.exe
  2⤵
  PID:13052
- C:\Windows\System32\OlsYMsD.exe
  C:\Windows\System32\OlsYMsD.exe
  2⤵
  PID:13080
- C:\Windows\System32\sTcLTPm.exe
  C:\Windows\System32\sTcLTPm.exe
  2⤵
  PID:13108
- C:\Windows\System32\ypBbTyT.exe
  C:\Windows\System32\ypBbTyT.exe
  2⤵
  PID:13136
- C:\Windows\System32\emVhQnr.exe
  C:\Windows\System32\emVhQnr.exe
  2⤵
  PID:13164
- C:\Windows\System32\IzwNSWn.exe
  C:\Windows\System32\IzwNSWn.exe
  2⤵
  PID:13192
- C:\Windows\System32\QcjNBSV.exe
  C:\Windows\System32\QcjNBSV.exe
  2⤵
  PID:13220
- C:\Windows\System32\OBcjUvU.exe
  C:\Windows\System32\OBcjUvU.exe
  2⤵
  PID:13248
- C:\Windows\System32\wytuyvh.exe
  C:\Windows\System32\wytuyvh.exe
  2⤵
  PID:13276
- C:\Windows\System32\VRkCtfe.exe
  C:\Windows\System32\VRkCtfe.exe
  2⤵
  PID:13304
- C:\Windows\System32\EWxRPzy.exe
  C:\Windows\System32\EWxRPzy.exe
  2⤵
  PID:12332
- C:\Windows\System32\REuCZJN.exe
  C:\Windows\System32\REuCZJN.exe
  2⤵
  PID:12396
- C:\Windows\System32\AAaIFDp.exe
  C:\Windows\System32\AAaIFDp.exe
  2⤵
  PID:12460
- C:\Windows\System32\CrkhcIo.exe
  C:\Windows\System32\CrkhcIo.exe
  2⤵
  PID:12532
- C:\Windows\System32\NfAYryU.exe
  C:\Windows\System32\NfAYryU.exe
  2⤵
  PID:12596
- C:\Windows\System32\BajntGD.exe
  C:\Windows\System32\BajntGD.exe
  2⤵
  PID:12656
- C:\Windows\System32\AeXhUMJ.exe
  C:\Windows\System32\AeXhUMJ.exe
  2⤵
  PID:12732
- C:\Windows\System32\CBdNLAy.exe
  C:\Windows\System32\CBdNLAy.exe
  2⤵
  PID:12792
- C:\Windows\System32\dHaweMd.exe
  C:\Windows\System32\dHaweMd.exe
  2⤵
  PID:12852
- C:\Windows\System32\ijjAxeL.exe
  C:\Windows\System32\ijjAxeL.exe
  2⤵
  PID:12924
- C:\Windows\System32\xFaqlqT.exe
  C:\Windows\System32\xFaqlqT.exe
  2⤵
  PID:12988
- C:\Windows\System32\wkGGqaH.exe
  C:\Windows\System32\wkGGqaH.exe
  2⤵
  PID:13048
- C:\Windows\System32\wuWwjrm.exe
  C:\Windows\System32\wuWwjrm.exe
  2⤵
  PID:13156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\CiqQqPG.exe

Filesize
3.4MB

MD5
16da9e2a8d20c77756aba8dbdbb46eb0

SHA1
40c100baa5170eaa3f11c68aeb6446b52b0aef52

SHA256
6f6297354d5094cbbc959c2bcd23bc8000d85c443b56f6a5b6e6e1cf4370e1f7

SHA512
da60f2c87e479d4c73bb5d2c90ce1617f24fc130bc3d297f430efe061a7f36b2549fb81ed318b10d781a722152e8a3ffb1d6c76240b4cdba5df41a18b545f63b

Download Submit
C:\Windows\System32\ExCUStR.exe

Filesize
3.4MB

MD5
42952a89b2b39cacb06b8280a36b9c92

SHA1
f910566446a9b72c0cc096eeecca8805c55ef7b3

SHA256
f704759d9272e2ff1240e80b1303da5787814d8219d8a8a5cbe8a44476e90023

SHA512
4d2e2274ea4a42b221007c96eebc406fda8bc486cd3fc248e44acb2d97a9ac654af1be5c49b9015bc9afa1766e614b9b986bb3fc20803b043de18585006b00c9

Download Submit
C:\Windows\System32\FQEgMTP.exe

Filesize
3.4MB

MD5
d68ba41bae37b58b8b24461aa4338f97

SHA1
52d73ef5089df3addea42441776c029141636a0b

SHA256
41a4c3a6dd03d76046344152898062f8a692e897e2a9f950c913925d2043d0ce

SHA512
58ece5bcc121955a16bbe9749f89599f1a9526f09253b77865f044d7666d541f1c6587b37a9739639d23907bd1962256d1349f170336978b012ab13b497a4625

Download Submit
C:\Windows\System32\HtnRXLR.exe

Filesize
3.4MB

MD5
d638db36933c831d5214f994c218c780

SHA1
e504789ab9823f77c783f738bdd60b11f48a77fa

SHA256
99d1001119f0258920481e83868ba1dc4f7a80e1aad11bccdd1994f198188567

SHA512
f1271e28a81596d4bb89ee092354fa81dd6c8e5129fe68918f27de30812c53c268259afa74b4c74082a89c152f09488f67f57f0aa262f52f01fac9b63944c242

Download Submit
C:\Windows\System32\JnzrHgj.exe

Filesize
3.4MB

MD5
6c312f70fee9deefed9803ae143b8078

SHA1
37e4ebbea50507dbf060ca8bf7783844611b5930

SHA256
a289d8fd5b2813e63b103881977b8195e5c71abb9b6dbd086857a6c5d1eddfcf

SHA512
7011faa9b7204dc80ea2bf7696842200b90358a64e13001892beff5b0fabd654d09f410833594002a0c2faea92483495728539ed17cce25950c74831b107d31f

Download Submit
C:\Windows\System32\KTjbzNA.exe

Filesize
3.4MB

MD5
2d646fb88fd2b2ac7dc9c002a1fdbaef

SHA1
0f39b8395d5a4e112192c88f359728dcf91297f6

SHA256
67ad80df96a75eb1e51c98f757e3d26f10df6941ac025d335851ff12fed9efa0

SHA512
d2d20252d30a17576975c463d53c25a0a7d4685bb1099402864549d18e0452b1784410de98335d4acc0dbf3fbe35ecca88d6f03ffaaffb7e2cd26dbd38db8eac

Download Submit
C:\Windows\System32\MZUEmyi.exe

Filesize
3.4MB

MD5
47443e3893673ca0e1c57f999fb15b17

SHA1
97caf726afb932e3441b440fefe884cf0e84cbd2

SHA256
9d9f013153f870b463366e6edf1a1e25768712ac73eb4c5d3dcd5f16f5d642cd

SHA512
0879edf72ec1a60102eff5864aef1b6b48e6bf7d1f3da13cdfcbab5015b3ca3a535e87b5aae0dcd0f7ed7183036bc852ff528f6098bc0e4b360893664c4caf95

Download Submit
C:\Windows\System32\NmGEHoh.exe

Filesize
3.4MB

MD5
20426d263750f861062177b3b994793d

SHA1
2f058fa91eee79bd708a89863fe275e6f3036495

SHA256
59b5382f5d3e30ca90a2ed00c846f278297c8b850baf8b529c480c347584871e

SHA512
32c0ebb0c2b2346388e352cc5c577ee5df1427f94bc4e3ee87cac98b6fde029b58d2cf7916c28d01164dec0b7d6ca3635e8b93e88e55491b0ff1ae74c8815e17

Download Submit
C:\Windows\System32\OcYIMPH.exe

Filesize
3.4MB

MD5
8ac7ffec6aa77535de1dcecfc0dc9f10

SHA1
2f00c047c0c3a88d71f7e03c7ba1e1113c614a78

SHA256
3920306ab42e1ffba05354726c511e043b7b2b7e8ae119d27fde7155d25b8a2f

SHA512
15e371ef447f1cd1d024503ed3d466d644bc3206f7f69a052df030058c974f819739eeb07316609dcf125666270994a3b3913101b821b302c51fa2c071c0a0c8

Download Submit
C:\Windows\System32\OwyQzhW.exe

Filesize
3.4MB

MD5
7111d2f67d1ad29c9c43169a8ad2c45a

SHA1
c344db9e8f15a9502c69b385da639bfb6957b661

SHA256
f7c057c5316bd667d0730941a499763b1eb98a44ca64aa2159265da8675f3884

SHA512
c0a8e8fd45272287b39022dfe6a18af1cf3e077b550f262a65254f29488a8f8a787278e7e8789016d57ce82b9300a5b862c78da119237c40c5afb46f401b0b62

Download Submit
C:\Windows\System32\QfNomFl.exe

Filesize
3.4MB

MD5
76ec155dc52af39bdc2a088064d81163

SHA1
327513d8ded2d51b1699dbcfc508b273f901db31

SHA256
4e12daf6531c7decde73e8c54b4537123292f9ec20986cbe77333892338f7fd4

SHA512
35945ecbbab5e71faec8c6314a1d8cd76550ebad7312f211eff927cb8a8fb6dafd32049d419233273105c4497b0c4d96fffeba61aa8d02da6b2b5f984194a5bb

Download Submit
C:\Windows\System32\QobqrdK.exe

Filesize
3.4MB

MD5
5a2d64a208400560200c9cb4b64e802d

SHA1
ae84d2dc4d05c728de204348cc013012ceb193fb

SHA256
2046f476aca649e1a29bf0b7d2d510c57866d0b1d190740b9ac46bcf8cfebf9d

SHA512
044100bce35dcdc8857786ac734c44ea9f297ed9059c8a75c84f34960f3503f53bb279d1a466bc3f04032f6ce3ad8171291bf7e441381162a39c191c94cf4cec

Download Submit
C:\Windows\System32\RoXrPOC.exe

Filesize
3.4MB

MD5
e3214cf2166f43f846e06fad2379d529

SHA1
465ff0f498e9ea05a59c886928ce7f1abc58e13d

SHA256
c348ff2399b2c590be359306ec78582fb3c637f21d5390da1dd889faeedfd214

SHA512
42e55b7ce5420bccc626878aa1c3c111bdefcccb6732caeb2e3286d8dc8cda2be5995b52c3521b20e8fec5ab8e530c5c3f66c27c88e31bda42626efb3562272c

Download Submit
C:\Windows\System32\VCTseco.exe

Filesize
3.4MB

MD5
869eb52e00a893ef6cfb6aee19320224

SHA1
21c478f5acc4a4b9e083fa311bd566840caf2289

SHA256
5f1565f4198e653a28866d4bae4af94ce3e84260a85a438deed65455bab0b9c7

SHA512
345069dd80f7269c2d0ed2ac70f00a6fb31c2c716fde1c09b248a78842f6a9dfad00dae1a7178e39feb697770b5ecb100f2ca9aa3f5ffbfe24e8c9213be699ce

Download Submit
C:\Windows\System32\WMGIJDR.exe

Filesize
3.4MB

MD5
98d2efa70e7561edc82565d922407bc2

SHA1
a9fc872e80a0c82982dddc617b59ee5399d8522e

SHA256
2c2c5dd20eba3a8e1408c2018a3a6aa1b48c33cbc74532095c807d42b0b5c2f6

SHA512
aaecedd769b5a7f0938e32ab56397e16fc61007e3fd8e9db76dcd18428ed15ddc895cf2d7faeb5bbf6079a76c75afb07b74302571d08e3feeb68cdf58086a7ab

Download Submit
C:\Windows\System32\blNwMdT.exe

Filesize
3.4MB

MD5
69cb896616b8196d3c72d0d21b1e4d54

SHA1
14047cbe04f183bf41ea5967f93b6709705b82a2

SHA256
924f0987bdf95e8db36a634232861df4730c2456035c92dc99cf65dac4b4fd38

SHA512
362a38dde89e3a441a33d83ad472294b1cb708095ba6e02fbe88d1bb2255be96fbde040a048e6ee1f452edc6b13a0f1fb13a754944d05f09169d435cb1d64139

Download Submit
C:\Windows\System32\buLwKAt.exe

Filesize
3.4MB

MD5
22245414b32d73d903ab3058d4aaf051

SHA1
19c4bfbb01ad3687683ad289436f05117da7d602

SHA256
b75a6d244127dddccccb3995fc4f517b1380d5db4555ffd621cee0c2c4505d7f

SHA512
509dd65349e59f0552f2d1631895212751ef2505325be32030731ad1948576ffd3bb9881f1eb4f68f3a727988d79781e61497d2cc44250d95c73aab9d58080fe

Download Submit
C:\Windows\System32\ddwuiXk.exe

Filesize
3.4MB

MD5
cd1f35387c66a29d6e108cef6695d725

SHA1
7ea1841605e99fa60fe8a20b7af978e2ee381401

SHA256
43ae9b2a04d77914128f8b79325b6e7cd9e2a7e7ff9fabe52bbd08d871dae96c

SHA512
d8777fd4e09176c4ac345a539d58eda55121792590827077c89efaa5fe3a1689d94863b0ab622bcecabf793397425aed18d03a66d38c9cd049b3018c8f574432

Download Submit
C:\Windows\System32\dxUcxKz.exe

Filesize
3.4MB

MD5
efd912f7ab927889a84990019c04fa2a

SHA1
4645e69a45700a965d7007f85511364b8fa3f953

SHA256
2b8b17308a1a37843f3a2cc5c1f9cb1861a511a2cf5451d82aaefd9bd3b178e4

SHA512
2047c835f60353185ec930449763f898047f22b06d36ccc81bb556067e1a78815e5964b7d72b7307768bb2535d2abec84fe17ca395f60a8d1f82c6e979133c10

Download Submit
C:\Windows\System32\dykdvyQ.exe

Filesize
3.4MB

MD5
80fce7e4240223e901e87236057087d8

SHA1
f28274f97cca3d46f7431bdf9b52a1dd8d61d8d7

SHA256
5d0983d2285e884d10175791b82295a4880c511526e09b836fe15177f553f308

SHA512
13d1ef7e9dbdce5cbce2c77a688eb730fe95416dfc9e12e0fdea686a8aaf7c672cac04d73b0a2ca01b65f26a1419448abc02bf250af95f8b3f6a3b114e17efd4

Download Submit
C:\Windows\System32\hBZvBkq.exe

Filesize
3.4MB

MD5
95a5f6f4b47f8d8fae45e0b6d706fcfe

SHA1
dbb5ab360ae97b0a697c759833ce6e4303540c86

SHA256
9392e045ba0680bc79e6836f5476ba3a3386e500575e50b970d5b2319fff72cd

SHA512
039e02536503b8232bd36941afa844b16038e9ffb92bd2e3b4e74abe167d9a9b959b24bb48a3d4429abd2a55345424e0468544d9d80d3c2c5e8ea9602586b2ea

Download Submit
C:\Windows\System32\hZYdpci.exe

Filesize
3.4MB

MD5
5da3036d4ef42e6d2839d5340ad4e401

SHA1
e4f4cb4e72952ea449bc228d2aa8ca59f15c2928

SHA256
43be8c01ed1f849bb0f5e1bf25dab0086b8a258150351ec1441742ec2d4fbed8

SHA512
c904842b903c48ffb4acdd6acb29240679cc9620d9677c0bdaa91c3ad2d8a7e35f3a2cd072da83811d3ec636c6392a8d750984662e6fdab9f5446dc7a3e5a0b9

Download Submit
C:\Windows\System32\iWAUbjt.exe

Filesize
3.4MB

MD5
b60a4cffc074a5143c5c3fa91ed3ee0b

SHA1
db2fdea13f939438ecb5ebafc01b99d485f774a1

SHA256
34d69f087bfeb3019e3f2e8416ba784388a426629eae48f41e1c44657743ceaf

SHA512
78196f49e154f2b53e0ebc80dac092fc9971783dcc14f4aa0341dbe868227a6bc801e858d17df13c8f522e62a43c21088f2878b09271f5c2dfbf2f33317cc53a

Download Submit
C:\Windows\System32\iZlLvSZ.exe

Filesize
3.4MB

MD5
ddb237dd6ae935ab3d00ced436346635

SHA1
923640ebc3478a72f4aa7326aadffaa2a3827bf1

SHA256
283c1b222168560b2ec48e66606f2bf69044a6457634dcb39149c8c2b88b9028

SHA512
1354a9c51a18cca771970a5c94c338c997c3c0d53048ea477e30b0584faf137438ba5e3d6e1e361988584609b0a1c76ef0bc695447e560abfd0dffa773ff9bad

Download Submit
C:\Windows\System32\jgTchrY.exe

Filesize
3.4MB

MD5
aa76d06090c79b429959ba163f7f62f1

SHA1
42c057fecf4d3789a20d9dc454b2b9f1d23c07c1

SHA256
6ede8cb32881096e9a69c6a1bad494bb123dbd3a6bb097946ea1bfbfdc05cf2d

SHA512
0901ec8b9083097a7a378c67670b8bad44bfd525d246c176b8b809c36dc2d82d6658f8911dd76550de70dec69cbdaab3895f56dabe343bd374d395a917cb480d

Download Submit
C:\Windows\System32\jiYaObF.exe

Filesize
3.4MB

MD5
e7411f3c79e4c85df6d896bba7952fa3

SHA1
e896c5734840f260256e1e07e34e809c8cd34859

SHA256
30bbba7bf714a4c3cffe0ab02faaa86d0ddd6e520c1573f8b427e75ccd753d3e

SHA512
cdaec34226fc10eecd37fa0eb4cb5352a642dc69a0c01a6e531a1b31d664d622b322a47a5eba0c7155cb6252442c7ce19e73973fc6bb3c88e632ba6dcf86ffc4

Download Submit
C:\Windows\System32\nezcnUK.exe

Filesize
3.4MB

MD5
2963be151af1d90cd83a1c832a89fdbc

SHA1
2d145a47fa01b57e6ba5109b023f4fdd7301f656

SHA256
94e3b52323929af24ca6d92bd9b343014a1f9d540e41706e9ec0022c1981a8b7

SHA512
db579baf75d348c198b73e642a8a112f30e89415d7e2c88348083f5de15c142f4fd2ba2f2a4fba6998be0e025aebdc761dfc300ea7e852410a34d7ea86e93374

Download Submit
C:\Windows\System32\uMMwcsf.exe

Filesize
3.4MB

MD5
f53c7dbd1eafb23013663c8842160cf9

SHA1
35bd211ff02ad63349ac1d8e9a93bbd2e4b29953

SHA256
b1fc75c78560fedf7fea8776bb00a022564c88dfb0cbf5208023f26670bc561a

SHA512
1745c118969896f54125b92c50dab48998528ab26af34c1269f773e1c62b0b3249f553649d535cd9ab79aadedfdb8acf7d896f427c2ca6b0c17f52251f3b3475

Download Submit
C:\Windows\System32\vnPzHUU.exe

Filesize
3.4MB

MD5
2aa9e839236c0daa6d00df1bbc462837

SHA1
6bd4fd57f5cfab417c8b043d195b3bc0a7ae3352

SHA256
24eac901a3575d124be45fed23e8f5bb886ceb36a9336d93e4f67cc27c2cff2a

SHA512
99d86300e63b4043f9fef24e741a63f9f059f728d9c5c2d53de22913d40cb9c15b2fe82d85509ba781ebcde1daad53c8ae2d1e802e35812ceef853eac44dbb92

Download Submit
C:\Windows\System32\wcidntg.exe

Filesize
3.4MB

MD5
aba5fd21acadf98de76f48c1b57c323d

SHA1
fbb31dc08e97896908c73876677e8f2f6dd21c32

SHA256
190441186c2612f38600fb285872cfb14951de806bcc7d49925b160d6e29145f

SHA512
ba1f9e7b2d490f98f860d68651d45db648dab245f41332eb930351cf663e993d97adc06c4b54aeac92be91624ad5b5acf5a6c7f21d76817849b94781daf1c1aa

Download Submit
C:\Windows\System32\xGsPDYQ.exe

Filesize
3.4MB

MD5
22a26075c057d5d963ad06bf3a8303f0

SHA1
e3824198acbf354ed1bab5e7d57adcf4153bd097

SHA256
a00cf2acd5acbb788009da4a176eed644b6b6162976ce86c19dae702e1ba63fa

SHA512
32e20ee963ef99099adbc8155cf7b0bc90c8f5c4d3583a4bfbbfaa8fbe547c5f5e0579c91885db4d6eb43262fa3c7fdbe925b47f0efd1ee80d76a3ef761dde42

Download Submit
C:\Windows\System32\zrdpjjX.exe

Filesize
3.4MB

MD5
7d9a2f0153d69d5b93ad397ca8821e54

SHA1
27f5fde26616bfb2297006d9a111e581b9889617

SHA256
c1e9fb513344bee0ed6daa11bfc2d4db426ac9d81484ecdc67d30a91a7021964

SHA512
911cdba5aa5edaf414e4a8d07d7c7cce483cbbd27b6e2373fa762a29b5ca4521684cf830369c2f93106bf4de8ae17a1426067d63fc350816ab043609a8cc909d

Download Submit
memory/208-1977-0x00007FF770680000-0x00007FF770A75000-memory.dmp

Filesize
4.0MB

Download
memory/208-630-0x00007FF770680000-0x00007FF770A75000-memory.dmp

Filesize
4.0MB

Download
memory/1056-637-0x00007FF7184B0000-0x00007FF7188A5000-memory.dmp

Filesize
4.0MB

Download
memory/1056-1981-0x00007FF7184B0000-0x00007FF7188A5000-memory.dmp

Filesize
4.0MB

Download
memory/1068-599-0x00007FF69A030000-0x00007FF69A425000-memory.dmp

Filesize
4.0MB

Download
memory/1068-1972-0x00007FF69A030000-0x00007FF69A425000-memory.dmp

Filesize
4.0MB

Download
memory/1236-1959-0x00007FF6A9950000-0x00007FF6A9D45000-memory.dmp

Filesize
4.0MB

Download
memory/1236-8-0x00007FF6A9950000-0x00007FF6A9D45000-memory.dmp

Filesize
4.0MB

Download
memory/1372-1975-0x00007FF7C24F0000-0x00007FF7C28E5000-memory.dmp

Filesize
4.0MB

Download
memory/1372-615-0x00007FF7C24F0000-0x00007FF7C28E5000-memory.dmp

Filesize
4.0MB

Download
memory/1384-602-0x00007FF6AE690000-0x00007FF6AEA85000-memory.dmp

Filesize
4.0MB

Download
memory/1384-1974-0x00007FF6AE690000-0x00007FF6AEA85000-memory.dmp

Filesize
4.0MB

Download
memory/1612-1958-0x00007FF7CD6D0000-0x00007FF7CDAC5000-memory.dmp

Filesize
4.0MB

Download
memory/1612-65-0x00007FF7CD6D0000-0x00007FF7CDAC5000-memory.dmp

Filesize
4.0MB

Download
memory/1612-1-0x0000020F783B0000-0x0000020F783C0000-memory.dmp

Filesize
64KB

Download
memory/1612-0-0x00007FF7CD6D0000-0x00007FF7CDAC5000-memory.dmp

Filesize
4.0MB

Download
memory/1840-1969-0x00007FF787590000-0x00007FF787985000-memory.dmp

Filesize
4.0MB

Download
memory/1840-77-0x00007FF787590000-0x00007FF787985000-memory.dmp

Filesize
4.0MB

Download
memory/1996-42-0x00007FF6DBC50000-0x00007FF6DC045000-memory.dmp

Filesize
4.0MB

Download
memory/1996-1965-0x00007FF6DBC50000-0x00007FF6DC045000-memory.dmp

Filesize
4.0MB

Download
memory/2192-1966-0x00007FF704B20000-0x00007FF704F15000-memory.dmp

Filesize
4.0MB

Download
memory/2192-54-0x00007FF704B20000-0x00007FF704F15000-memory.dmp

Filesize
4.0MB

Download
memory/2240-640-0x00007FF7F56F0000-0x00007FF7F5AE5000-memory.dmp

Filesize
4.0MB

Download
memory/2240-1978-0x00007FF7F56F0000-0x00007FF7F5AE5000-memory.dmp

Filesize
4.0MB

Download
memory/2356-73-0x00007FF681060000-0x00007FF681455000-memory.dmp

Filesize
4.0MB

Download
memory/2356-1968-0x00007FF681060000-0x00007FF681455000-memory.dmp

Filesize
4.0MB

Download
memory/2564-19-0x00007FF72E2B0000-0x00007FF72E6A5000-memory.dmp

Filesize
4.0MB

Download
memory/2564-1960-0x00007FF72E2B0000-0x00007FF72E6A5000-memory.dmp

Filesize
4.0MB

Download
memory/2564-597-0x00007FF72E2B0000-0x00007FF72E6A5000-memory.dmp

Filesize
4.0MB

Download
memory/3328-38-0x00007FF647B00000-0x00007FF647EF5000-memory.dmp

Filesize
4.0MB

Download
memory/3328-1964-0x00007FF647B00000-0x00007FF647EF5000-memory.dmp

Filesize
4.0MB

Download
memory/3600-643-0x00007FF6C24D0000-0x00007FF6C28C5000-memory.dmp

Filesize
4.0MB

Download
memory/3600-1979-0x00007FF6C24D0000-0x00007FF6C28C5000-memory.dmp

Filesize
4.0MB

Download
memory/3716-633-0x00007FF66EDE0000-0x00007FF66F1D5000-memory.dmp

Filesize
4.0MB

Download
memory/3716-1980-0x00007FF66EDE0000-0x00007FF66F1D5000-memory.dmp

Filesize
4.0MB

Download
memory/3760-655-0x00007FF628D00000-0x00007FF6290F5000-memory.dmp

Filesize
4.0MB

Download
memory/3760-1970-0x00007FF628D00000-0x00007FF6290F5000-memory.dmp

Filesize
4.0MB

Download
memory/3924-1973-0x00007FF7D6510000-0x00007FF7D6905000-memory.dmp

Filesize
4.0MB

Download
memory/3924-622-0x00007FF7D6510000-0x00007FF7D6905000-memory.dmp

Filesize
4.0MB

Download
memory/4072-1971-0x00007FF7D4F10000-0x00007FF7D5305000-memory.dmp

Filesize
4.0MB

Download
memory/4072-659-0x00007FF7D4F10000-0x00007FF7D5305000-memory.dmp

Filesize
4.0MB

Download
memory/4420-33-0x00007FF618D20000-0x00007FF619115000-memory.dmp

Filesize
4.0MB

Download
memory/4420-1963-0x00007FF618D20000-0x00007FF619115000-memory.dmp

Filesize
4.0MB

Download
memory/4492-64-0x00007FF6CFE70000-0x00007FF6D0265000-memory.dmp

Filesize
4.0MB

Download
memory/4492-1967-0x00007FF6CFE70000-0x00007FF6D0265000-memory.dmp

Filesize
4.0MB

Download
memory/4788-1961-0x00007FF623110000-0x00007FF623505000-memory.dmp

Filesize
4.0MB

Download
memory/4788-21-0x00007FF623110000-0x00007FF623505000-memory.dmp

Filesize
4.0MB

Download
memory/4908-26-0x00007FF7D25F0000-0x00007FF7D29E5000-memory.dmp

Filesize
4.0MB

Download
memory/4908-1962-0x00007FF7D25F0000-0x00007FF7D29E5000-memory.dmp

Filesize
4.0MB

Download
memory/4968-1976-0x00007FF650A50000-0x00007FF650E45000-memory.dmp

Filesize
4.0MB

Download
memory/4968-608-0x00007FF650A50000-0x00007FF650E45000-memory.dmp

Filesize
4.0MB

Download
memory/5104-648-0x00007FF64B400000-0x00007FF64B7F5000-memory.dmp

Filesize
4.0MB

Download
memory/5104-1982-0x00007FF64B400000-0x00007FF64B7F5000-memory.dmp

Filesize
4.0MB

Download