xmrig | 75c2dd523e03d0b24151c68dcc2cb74f0812b623f265a9f5f2469b1a17e06fe7

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
Size

2.1MB
MD5

33d85cc404dc795ba593c854375a6600
SHA1

5dafde73f2e3858da5df4c175c6a8c65c6f1bf89
SHA256

75c2dd523e03d0b24151c68dcc2cb74f0812b623f265a9f5f2469b1a17e06fe7
SHA512

fbc37bd9c96492b7b812a267251c1dfb2bb7ff37d65cda83024f7b8e00a95fa51261550d69347242a4823460008c4bae351add27c695af004074d03c0bb05270
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQw5UP6Qsx7UtvR1:oemTLkNdfE0pZrQx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1540-0-0x00007FF7FC0F0000-0x00007FF7FC444000-memory.dmp	xmrig
behavioral2/files/0x0008000000023410-4.dat	xmrig
behavioral2/files/0x0007000000023415-18.dat	xmrig
behavioral2/files/0x0007000000023414-17.dat	xmrig
behavioral2/memory/4196-13-0x00007FF78BF90000-0x00007FF78C2E4000-memory.dmp	xmrig
behavioral2/memory/4872-29-0x00007FF6D0060000-0x00007FF6D03B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-39.dat	xmrig
behavioral2/files/0x000700000002341c-50.dat	xmrig
behavioral2/files/0x0007000000023420-65.dat	xmrig
behavioral2/files/0x000700000002341b-80.dat	xmrig
behavioral2/memory/652-120-0x00007FF664BF0000-0x00007FF664F44000-memory.dmp	xmrig
behavioral2/memory/1128-133-0x00007FF75EC40000-0x00007FF75EF94000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-145.dat	xmrig
behavioral2/memory/5048-157-0x00007FF753B20000-0x00007FF753E74000-memory.dmp	xmrig
behavioral2/memory/2644-162-0x00007FF6BC9E0000-0x00007FF6BCD34000-memory.dmp	xmrig
behavioral2/memory/4560-168-0x00007FF6FDF30000-0x00007FF6FE284000-memory.dmp	xmrig
behavioral2/memory/4908-170-0x00007FF775CC0000-0x00007FF776014000-memory.dmp	xmrig
behavioral2/memory/5052-169-0x00007FF7484A0000-0x00007FF7487F4000-memory.dmp	xmrig
behavioral2/memory/3912-167-0x00007FF79AEC0000-0x00007FF79B214000-memory.dmp	xmrig
behavioral2/memory/1392-166-0x00007FF7EEF50000-0x00007FF7EF2A4000-memory.dmp	xmrig
behavioral2/memory/440-165-0x00007FF7F0A40000-0x00007FF7F0D94000-memory.dmp	xmrig
behavioral2/memory/4296-164-0x00007FF62A800000-0x00007FF62AB54000-memory.dmp	xmrig
behavioral2/memory/4972-163-0x00007FF7EC1B0000-0x00007FF7EC504000-memory.dmp	xmrig
behavioral2/memory/4616-161-0x00007FF7256D0000-0x00007FF725A24000-memory.dmp	xmrig
behavioral2/memory/4632-160-0x00007FF6E3D00000-0x00007FF6E4054000-memory.dmp	xmrig
behavioral2/memory/5020-159-0x00007FF694A30000-0x00007FF694D84000-memory.dmp	xmrig
behavioral2/memory/3944-158-0x00007FF63FC00000-0x00007FF63FF54000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-155.dat	xmrig
behavioral2/memory/2400-154-0x00007FF71A7D0000-0x00007FF71AB24000-memory.dmp	xmrig
behavioral2/memory/2448-153-0x00007FF6FE020000-0x00007FF6FE374000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-151.dat	xmrig
behavioral2/files/0x000700000002342a-149.dat	xmrig
behavioral2/memory/844-147-0x00007FF7D3780000-0x00007FF7D3AD4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-143.dat	xmrig
behavioral2/files/0x0007000000023429-141.dat	xmrig
behavioral2/files/0x0007000000023428-139.dat	xmrig
behavioral2/memory/488-134-0x00007FF66A550000-0x00007FF66A8A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-131.dat	xmrig
behavioral2/files/0x0007000000023424-127.dat	xmrig
behavioral2/memory/4620-122-0x00007FF680E90000-0x00007FF6811E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-121.dat	xmrig
behavioral2/files/0x0007000000023427-108.dat	xmrig
behavioral2/files/0x0007000000023426-107.dat	xmrig
behavioral2/files/0x000700000002341d-106.dat	xmrig
behavioral2/files/0x000700000002341f-104.dat	xmrig
behavioral2/files/0x0007000000023425-99.dat	xmrig
behavioral2/files/0x000700000002341e-96.dat	xmrig
behavioral2/memory/2132-91-0x00007FF7F0C80000-0x00007FF7F0FD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-89.dat	xmrig
behavioral2/files/0x000700000002341a-76.dat	xmrig
behavioral2/memory/772-69-0x00007FF72EB60000-0x00007FF72EEB4000-memory.dmp	xmrig
behavioral2/memory/1132-66-0x00007FF6B1110000-0x00007FF6B1464000-memory.dmp	xmrig
behavioral2/memory/1212-51-0x00007FF7D23E0000-0x00007FF7D2734000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-57.dat	xmrig
behavioral2/files/0x0007000000023418-45.dat	xmrig
behavioral2/memory/3636-33-0x00007FF732E10000-0x00007FF733164000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-25.dat	xmrig
behavioral2/files/0x000700000002342f-172.dat	xmrig
behavioral2/files/0x0007000000023431-179.dat	xmrig
behavioral2/files/0x0007000000023432-191.dat	xmrig
behavioral2/files/0x0007000000023430-190.dat	xmrig
behavioral2/memory/4396-184-0x00007FF7BDCB0000-0x00007FF7BE004000-memory.dmp	xmrig
behavioral2/memory/4196-2123-0x00007FF78BF90000-0x00007FF78C2E4000-memory.dmp	xmrig
behavioral2/memory/1540-2124-0x00007FF7FC0F0000-0x00007FF7FC444000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4196	ARKdYrJ.exe
4872	tSpVhYj.exe
2644	fKHyEHD.exe
3636	KerthrG.exe
1212	nPnyYJS.exe
4972	MCvGvmH.exe
4296	AcvbEgq.exe
440	EhjRqeK.exe
1132	jXYYuYq.exe
772	fzGuyyZ.exe
1392	GcBUgkV.exe
2132	dFYhvGZ.exe
652	Hrfgbif.exe
4620	yKsoLTW.exe
3912	KvrxWPB.exe
1128	AkUSPIE.exe
488	wDejatu.exe
4560	uUjMKdv.exe
844	RTNzFRr.exe
2448	VoOUrQm.exe
2400	bGhvjDS.exe
5048	eYQsCRC.exe
3944	fzIkjca.exe
5052	qhcIISg.exe
5020	dHkjGFj.exe
4632	qYuEtVB.exe
4908	VBhDonr.exe
4616	sUJRakL.exe
4396	dlEMixu.exe
1016	GywBKib.exe
3844	ZIRXAAE.exe
2028	vAXHzOQ.exe
4904	sTiPIXk.exe
4108	lbkPzbA.exe
1284	jjQgUGw.exe
4124	jIYXkpP.exe
4540	WCPKZyA.exe
3360	ksszaMG.exe
2432	MGRwtnk.exe
4276	GZQQqOV.exe
4924	NRrmHTv.exe
4492	DfQpFym.exe
4140	JTdKrsm.exe
4912	vShRFTN.exe
3688	AZJDepc.exe
4788	vIWrTWP.exe
2056	emKMGTT.exe
4388	XkpBTmE.exe
3664	VxoQZDx.exe
2692	dFLvMgE.exe
388	IcQUiNZ.exe
4340	lnpiFLp.exe
2964	cqFykOH.exe
3832	DBmEkLi.exe
2036	VHtvEVa.exe
3612	Pxdpbyf.exe
2648	eBbkoII.exe
4796	cBbJyah.exe
3604	ZlsyaEE.exe
4828	ahOIFZy.exe
2500	cHSBGzv.exe
4000	csiUONX.exe
4268	MxNelei.exe
1736	olEJbWw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1540-0-0x00007FF7FC0F0000-0x00007FF7FC444000-memory.dmp	upx
behavioral2/files/0x0008000000023410-4.dat	upx
behavioral2/files/0x0007000000023415-18.dat	upx
behavioral2/files/0x0007000000023414-17.dat	upx
behavioral2/memory/4196-13-0x00007FF78BF90000-0x00007FF78C2E4000-memory.dmp	upx
behavioral2/memory/4872-29-0x00007FF6D0060000-0x00007FF6D03B4000-memory.dmp	upx
behavioral2/files/0x0007000000023416-39.dat	upx
behavioral2/files/0x000700000002341c-50.dat	upx
behavioral2/files/0x0007000000023420-65.dat	upx
behavioral2/files/0x000700000002341b-80.dat	upx
behavioral2/memory/652-120-0x00007FF664BF0000-0x00007FF664F44000-memory.dmp	upx
behavioral2/memory/1128-133-0x00007FF75EC40000-0x00007FF75EF94000-memory.dmp	upx
behavioral2/files/0x000700000002342c-145.dat	upx
behavioral2/memory/5048-157-0x00007FF753B20000-0x00007FF753E74000-memory.dmp	upx
behavioral2/memory/2644-162-0x00007FF6BC9E0000-0x00007FF6BCD34000-memory.dmp	upx
behavioral2/memory/4560-168-0x00007FF6FDF30000-0x00007FF6FE284000-memory.dmp	upx
behavioral2/memory/4908-170-0x00007FF775CC0000-0x00007FF776014000-memory.dmp	upx
behavioral2/memory/5052-169-0x00007FF7484A0000-0x00007FF7487F4000-memory.dmp	upx
behavioral2/memory/3912-167-0x00007FF79AEC0000-0x00007FF79B214000-memory.dmp	upx
behavioral2/memory/1392-166-0x00007FF7EEF50000-0x00007FF7EF2A4000-memory.dmp	upx
behavioral2/memory/440-165-0x00007FF7F0A40000-0x00007FF7F0D94000-memory.dmp	upx
behavioral2/memory/4296-164-0x00007FF62A800000-0x00007FF62AB54000-memory.dmp	upx
behavioral2/memory/4972-163-0x00007FF7EC1B0000-0x00007FF7EC504000-memory.dmp	upx
behavioral2/memory/4616-161-0x00007FF7256D0000-0x00007FF725A24000-memory.dmp	upx
behavioral2/memory/4632-160-0x00007FF6E3D00000-0x00007FF6E4054000-memory.dmp	upx
behavioral2/memory/5020-159-0x00007FF694A30000-0x00007FF694D84000-memory.dmp	upx
behavioral2/memory/3944-158-0x00007FF63FC00000-0x00007FF63FF54000-memory.dmp	upx
behavioral2/files/0x000700000002342e-155.dat	upx
behavioral2/memory/2400-154-0x00007FF71A7D0000-0x00007FF71AB24000-memory.dmp	upx
behavioral2/memory/2448-153-0x00007FF6FE020000-0x00007FF6FE374000-memory.dmp	upx
behavioral2/files/0x000700000002342d-151.dat	upx
behavioral2/files/0x000700000002342a-149.dat	upx
behavioral2/memory/844-147-0x00007FF7D3780000-0x00007FF7D3AD4000-memory.dmp	upx
behavioral2/files/0x000700000002342b-143.dat	upx
behavioral2/files/0x0007000000023429-141.dat	upx
behavioral2/files/0x0007000000023428-139.dat	upx
behavioral2/memory/488-134-0x00007FF66A550000-0x00007FF66A8A4000-memory.dmp	upx
behavioral2/files/0x0007000000023422-131.dat	upx
behavioral2/files/0x0007000000023424-127.dat	upx
behavioral2/memory/4620-122-0x00007FF680E90000-0x00007FF6811E4000-memory.dmp	upx
behavioral2/files/0x0007000000023421-121.dat	upx
behavioral2/files/0x0007000000023427-108.dat	upx
behavioral2/files/0x0007000000023426-107.dat	upx
behavioral2/files/0x000700000002341d-106.dat	upx
behavioral2/files/0x000700000002341f-104.dat	upx
behavioral2/files/0x0007000000023425-99.dat	upx
behavioral2/files/0x000700000002341e-96.dat	upx
behavioral2/memory/2132-91-0x00007FF7F0C80000-0x00007FF7F0FD4000-memory.dmp	upx
behavioral2/files/0x0007000000023423-89.dat	upx
behavioral2/files/0x000700000002341a-76.dat	upx
behavioral2/memory/772-69-0x00007FF72EB60000-0x00007FF72EEB4000-memory.dmp	upx
behavioral2/memory/1132-66-0x00007FF6B1110000-0x00007FF6B1464000-memory.dmp	upx
behavioral2/memory/1212-51-0x00007FF7D23E0000-0x00007FF7D2734000-memory.dmp	upx
behavioral2/files/0x0007000000023419-57.dat	upx
behavioral2/files/0x0007000000023418-45.dat	upx
behavioral2/memory/3636-33-0x00007FF732E10000-0x00007FF733164000-memory.dmp	upx
behavioral2/files/0x0007000000023417-25.dat	upx
behavioral2/files/0x000700000002342f-172.dat	upx
behavioral2/files/0x0007000000023431-179.dat	upx
behavioral2/files/0x0007000000023432-191.dat	upx
behavioral2/files/0x0007000000023430-190.dat	upx
behavioral2/memory/4396-184-0x00007FF7BDCB0000-0x00007FF7BE004000-memory.dmp	upx
behavioral2/memory/4196-2123-0x00007FF78BF90000-0x00007FF78C2E4000-memory.dmp	upx
behavioral2/memory/1540-2124-0x00007FF7FC0F0000-0x00007FF7FC444000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hIGTkGm.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\KWNSAvW.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\aBmlLvP.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\OZWuViy.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\VHtvEVa.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\cZomtFC.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\pXbPHxm.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\NfuoHhl.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\mskCQJA.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\jIONQxn.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\dlGjqRJ.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\nCPxEuS.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\fYNNMXX.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\qYvzbvd.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\MqmOYDT.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\VRMHHjg.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\pqYKywd.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\vIWrTWP.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\fEbaIhl.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\rhtNUnN.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\bpqbKYC.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\qwVPkAg.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\GJGoBOb.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\figKxoN.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\ftECjeK.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\wlOHFMX.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\tiirByu.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\obmIHET.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\hkONzMj.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\MQesVym.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\fUiPAjA.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\ZroqPbw.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\hHpEMAf.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\dPmYMHc.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\JCFKHYD.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\LjveImg.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\fECHtjH.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\ihBnjQn.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\LMVVSAD.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\tKZVAJl.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\GywBKib.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\FECMhrm.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\esiknGz.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\KuMgisx.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\sTiPIXk.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\AZJDepc.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\LhJUgqE.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\ohXICgu.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\XzwYYAl.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\vjBMriA.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\JPyuuqe.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\RMUqMoB.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\qsFULRJ.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\ZIRXAAE.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\zLoAVXN.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\lOyaFmt.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\jwRZhgK.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\gUTApCZ.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\XrpwWWO.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\onwWjaZ.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\OyPynDX.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\FYHmloA.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\HStvGrr.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
File created	C:\Windows\System\gvFZYik.exe	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4196	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	81
PID 1540 wrote to memory of 4196	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	81
PID 1540 wrote to memory of 4872	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	82
PID 1540 wrote to memory of 4872	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	82
PID 1540 wrote to memory of 2644	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	83
PID 1540 wrote to memory of 2644	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	83
PID 1540 wrote to memory of 3636	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	84
PID 1540 wrote to memory of 3636	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	84
PID 1540 wrote to memory of 1212	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	85
PID 1540 wrote to memory of 1212	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	85
PID 1540 wrote to memory of 4972	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	86
PID 1540 wrote to memory of 4972	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	86
PID 1540 wrote to memory of 4296	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	87
PID 1540 wrote to memory of 4296	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	87
PID 1540 wrote to memory of 440	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	88
PID 1540 wrote to memory of 440	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	88
PID 1540 wrote to memory of 1132	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	89
PID 1540 wrote to memory of 1132	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	89
PID 1540 wrote to memory of 772	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	90
PID 1540 wrote to memory of 772	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	90
PID 1540 wrote to memory of 1392	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	91
PID 1540 wrote to memory of 1392	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	91
PID 1540 wrote to memory of 2132	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	92
PID 1540 wrote to memory of 2132	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	92
PID 1540 wrote to memory of 652	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	93
PID 1540 wrote to memory of 652	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	93
PID 1540 wrote to memory of 4620	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	94
PID 1540 wrote to memory of 4620	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	94
PID 1540 wrote to memory of 3912	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	95
PID 1540 wrote to memory of 3912	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	95
PID 1540 wrote to memory of 1128	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	96
PID 1540 wrote to memory of 1128	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	96
PID 1540 wrote to memory of 488	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	97
PID 1540 wrote to memory of 488	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	97
PID 1540 wrote to memory of 4560	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	98
PID 1540 wrote to memory of 4560	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	98
PID 1540 wrote to memory of 844	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	99
PID 1540 wrote to memory of 844	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	99
PID 1540 wrote to memory of 2448	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	100
PID 1540 wrote to memory of 2448	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	100
PID 1540 wrote to memory of 2400	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	101
PID 1540 wrote to memory of 2400	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	101
PID 1540 wrote to memory of 5048	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	102
PID 1540 wrote to memory of 5048	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	102
PID 1540 wrote to memory of 3944	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	103
PID 1540 wrote to memory of 3944	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	103
PID 1540 wrote to memory of 5052	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	104
PID 1540 wrote to memory of 5052	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	104
PID 1540 wrote to memory of 5020	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	105
PID 1540 wrote to memory of 5020	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	105
PID 1540 wrote to memory of 4632	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	106
PID 1540 wrote to memory of 4632	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	106
PID 1540 wrote to memory of 4908	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	107
PID 1540 wrote to memory of 4908	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	107
PID 1540 wrote to memory of 4616	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	108
PID 1540 wrote to memory of 4616	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	108
PID 1540 wrote to memory of 4396	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	109
PID 1540 wrote to memory of 4396	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	109
PID 1540 wrote to memory of 3844	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	110
PID 1540 wrote to memory of 3844	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	110
PID 1540 wrote to memory of 1016	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	111
PID 1540 wrote to memory of 1016	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	111
PID 1540 wrote to memory of 2028	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	112
PID 1540 wrote to memory of 2028	1540	33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe	112

C:\Users\Admin\AppData\Local\Temp\33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\33d85cc404dc795ba593c854375a6600_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System\ARKdYrJ.exe
  C:\Windows\System\ARKdYrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\tSpVhYj.exe
  C:\Windows\System\tSpVhYj.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\fKHyEHD.exe
  C:\Windows\System\fKHyEHD.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\KerthrG.exe
  C:\Windows\System\KerthrG.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\nPnyYJS.exe
  C:\Windows\System\nPnyYJS.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\MCvGvmH.exe
  C:\Windows\System\MCvGvmH.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\AcvbEgq.exe
  C:\Windows\System\AcvbEgq.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\EhjRqeK.exe
  C:\Windows\System\EhjRqeK.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\jXYYuYq.exe
  C:\Windows\System\jXYYuYq.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\fzGuyyZ.exe
  C:\Windows\System\fzGuyyZ.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\GcBUgkV.exe
  C:\Windows\System\GcBUgkV.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\dFYhvGZ.exe
  C:\Windows\System\dFYhvGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\Hrfgbif.exe
  C:\Windows\System\Hrfgbif.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\yKsoLTW.exe
  C:\Windows\System\yKsoLTW.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\KvrxWPB.exe
  C:\Windows\System\KvrxWPB.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\AkUSPIE.exe
  C:\Windows\System\AkUSPIE.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\wDejatu.exe
  C:\Windows\System\wDejatu.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\uUjMKdv.exe
  C:\Windows\System\uUjMKdv.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\RTNzFRr.exe
  C:\Windows\System\RTNzFRr.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\VoOUrQm.exe
  C:\Windows\System\VoOUrQm.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\bGhvjDS.exe
  C:\Windows\System\bGhvjDS.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\eYQsCRC.exe
  C:\Windows\System\eYQsCRC.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\fzIkjca.exe
  C:\Windows\System\fzIkjca.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\qhcIISg.exe
  C:\Windows\System\qhcIISg.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\dHkjGFj.exe
  C:\Windows\System\dHkjGFj.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\qYuEtVB.exe
  C:\Windows\System\qYuEtVB.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\VBhDonr.exe
  C:\Windows\System\VBhDonr.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\sUJRakL.exe
  C:\Windows\System\sUJRakL.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\dlEMixu.exe
  C:\Windows\System\dlEMixu.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\ZIRXAAE.exe
  C:\Windows\System\ZIRXAAE.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\GywBKib.exe
  C:\Windows\System\GywBKib.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\vAXHzOQ.exe
  C:\Windows\System\vAXHzOQ.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\sTiPIXk.exe
  C:\Windows\System\sTiPIXk.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\lbkPzbA.exe
  C:\Windows\System\lbkPzbA.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\jjQgUGw.exe
  C:\Windows\System\jjQgUGw.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\jIYXkpP.exe
  C:\Windows\System\jIYXkpP.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\WCPKZyA.exe
  C:\Windows\System\WCPKZyA.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\ksszaMG.exe
  C:\Windows\System\ksszaMG.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\MGRwtnk.exe
  C:\Windows\System\MGRwtnk.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\GZQQqOV.exe
  C:\Windows\System\GZQQqOV.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\NRrmHTv.exe
  C:\Windows\System\NRrmHTv.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\DfQpFym.exe
  C:\Windows\System\DfQpFym.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\JTdKrsm.exe
  C:\Windows\System\JTdKrsm.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\vShRFTN.exe
  C:\Windows\System\vShRFTN.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\AZJDepc.exe
  C:\Windows\System\AZJDepc.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\vIWrTWP.exe
  C:\Windows\System\vIWrTWP.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\emKMGTT.exe
  C:\Windows\System\emKMGTT.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\XkpBTmE.exe
  C:\Windows\System\XkpBTmE.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\VxoQZDx.exe
  C:\Windows\System\VxoQZDx.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\dFLvMgE.exe
  C:\Windows\System\dFLvMgE.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\IcQUiNZ.exe
  C:\Windows\System\IcQUiNZ.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\lnpiFLp.exe
  C:\Windows\System\lnpiFLp.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\cqFykOH.exe
  C:\Windows\System\cqFykOH.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\DBmEkLi.exe
  C:\Windows\System\DBmEkLi.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\VHtvEVa.exe
  C:\Windows\System\VHtvEVa.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\Pxdpbyf.exe
  C:\Windows\System\Pxdpbyf.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\eBbkoII.exe
  C:\Windows\System\eBbkoII.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\cBbJyah.exe
  C:\Windows\System\cBbJyah.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\ZlsyaEE.exe
  C:\Windows\System\ZlsyaEE.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\ahOIFZy.exe
  C:\Windows\System\ahOIFZy.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\cHSBGzv.exe
  C:\Windows\System\cHSBGzv.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\csiUONX.exe
  C:\Windows\System\csiUONX.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\MxNelei.exe
  C:\Windows\System\MxNelei.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\olEJbWw.exe
  C:\Windows\System\olEJbWw.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\wavkUSa.exe
  C:\Windows\System\wavkUSa.exe
  2⤵
  PID:4208
- C:\Windows\System\bEdROPb.exe
  C:\Windows\System\bEdROPb.exe
  2⤵
  PID:2080
- C:\Windows\System\tkoPVKi.exe
  C:\Windows\System\tkoPVKi.exe
  2⤵
  PID:3532
- C:\Windows\System\dipxZIX.exe
  C:\Windows\System\dipxZIX.exe
  2⤵
  PID:1172
- C:\Windows\System\nwcpbnV.exe
  C:\Windows\System\nwcpbnV.exe
  2⤵
  PID:2988
- C:\Windows\System\LhJUgqE.exe
  C:\Windows\System\LhJUgqE.exe
  2⤵
  PID:4024
- C:\Windows\System\vIMDARg.exe
  C:\Windows\System\vIMDARg.exe
  2⤵
  PID:1492
- C:\Windows\System\pnxZoRz.exe
  C:\Windows\System\pnxZoRz.exe
  2⤵
  PID:2808
- C:\Windows\System\XYIwUec.exe
  C:\Windows\System\XYIwUec.exe
  2⤵
  PID:2604
- C:\Windows\System\jwRZhgK.exe
  C:\Windows\System\jwRZhgK.exe
  2⤵
  PID:500
- C:\Windows\System\BuTKHcc.exe
  C:\Windows\System\BuTKHcc.exe
  2⤵
  PID:3480
- C:\Windows\System\sjojNYG.exe
  C:\Windows\System\sjojNYG.exe
  2⤵
  PID:1204
- C:\Windows\System\gcVLDwy.exe
  C:\Windows\System\gcVLDwy.exe
  2⤵
  PID:3524
- C:\Windows\System\kIGGCaQ.exe
  C:\Windows\System\kIGGCaQ.exe
  2⤵
  PID:2984
- C:\Windows\System\ooMUrOG.exe
  C:\Windows\System\ooMUrOG.exe
  2⤵
  PID:1940
- C:\Windows\System\lNtVhPb.exe
  C:\Windows\System\lNtVhPb.exe
  2⤵
  PID:2596
- C:\Windows\System\cZomtFC.exe
  C:\Windows\System\cZomtFC.exe
  2⤵
  PID:4368
- C:\Windows\System\gUTApCZ.exe
  C:\Windows\System\gUTApCZ.exe
  2⤵
  PID:888
- C:\Windows\System\YwHHCIW.exe
  C:\Windows\System\YwHHCIW.exe
  2⤵
  PID:2592
- C:\Windows\System\bsnVEtA.exe
  C:\Windows\System\bsnVEtA.exe
  2⤵
  PID:1420
- C:\Windows\System\OUNeHmK.exe
  C:\Windows\System\OUNeHmK.exe
  2⤵
  PID:1044
- C:\Windows\System\PYWmnLX.exe
  C:\Windows\System\PYWmnLX.exe
  2⤵
  PID:1456
- C:\Windows\System\gsrBYvN.exe
  C:\Windows\System\gsrBYvN.exe
  2⤵
  PID:3136
- C:\Windows\System\fYNNMXX.exe
  C:\Windows\System\fYNNMXX.exe
  2⤵
  PID:3672
- C:\Windows\System\jNSUcqy.exe
  C:\Windows\System\jNSUcqy.exe
  2⤵
  PID:3312
- C:\Windows\System\DktwnHN.exe
  C:\Windows\System\DktwnHN.exe
  2⤵
  PID:1856
- C:\Windows\System\AKwiyqG.exe
  C:\Windows\System\AKwiyqG.exe
  2⤵
  PID:2368
- C:\Windows\System\ZLvgcIl.exe
  C:\Windows\System\ZLvgcIl.exe
  2⤵
  PID:1908
- C:\Windows\System\hHpEMAf.exe
  C:\Windows\System\hHpEMAf.exe
  2⤵
  PID:4184
- C:\Windows\System\GzCuTqf.exe
  C:\Windows\System\GzCuTqf.exe
  2⤵
  PID:4424
- C:\Windows\System\lEboiGc.exe
  C:\Windows\System\lEboiGc.exe
  2⤵
  PID:2576
- C:\Windows\System\miLCOZV.exe
  C:\Windows\System\miLCOZV.exe
  2⤵
  PID:760
- C:\Windows\System\rIIgdaa.exe
  C:\Windows\System\rIIgdaa.exe
  2⤵
  PID:3668
- C:\Windows\System\QOuuWrf.exe
  C:\Windows\System\QOuuWrf.exe
  2⤵
  PID:3344
- C:\Windows\System\qhGBLLl.exe
  C:\Windows\System\qhGBLLl.exe
  2⤵
  PID:2172
- C:\Windows\System\ikitZrZ.exe
  C:\Windows\System\ikitZrZ.exe
  2⤵
  PID:1156
- C:\Windows\System\CyXrAkP.exe
  C:\Windows\System\CyXrAkP.exe
  2⤵
  PID:4104
- C:\Windows\System\rDqHJpJ.exe
  C:\Windows\System\rDqHJpJ.exe
  2⤵
  PID:4932
- C:\Windows\System\NoRkFCK.exe
  C:\Windows\System\NoRkFCK.exe
  2⤵
  PID:3508
- C:\Windows\System\BQLMKPM.exe
  C:\Windows\System\BQLMKPM.exe
  2⤵
  PID:492
- C:\Windows\System\CXJeswl.exe
  C:\Windows\System\CXJeswl.exe
  2⤵
  PID:2120
- C:\Windows\System\GLBNgQU.exe
  C:\Windows\System\GLBNgQU.exe
  2⤵
  PID:2608
- C:\Windows\System\eButncq.exe
  C:\Windows\System\eButncq.exe
  2⤵
  PID:5076
- C:\Windows\System\ohXICgu.exe
  C:\Windows\System\ohXICgu.exe
  2⤵
  PID:1684
- C:\Windows\System\qPPVMdJ.exe
  C:\Windows\System\qPPVMdJ.exe
  2⤵
  PID:2496
- C:\Windows\System\vUTJMIV.exe
  C:\Windows\System\vUTJMIV.exe
  2⤵
  PID:892
- C:\Windows\System\EDUZDzW.exe
  C:\Windows\System\EDUZDzW.exe
  2⤵
  PID:4568
- C:\Windows\System\yLJOpdo.exe
  C:\Windows\System\yLJOpdo.exe
  2⤵
  PID:4416
- C:\Windows\System\BzXmGAH.exe
  C:\Windows\System\BzXmGAH.exe
  2⤵
  PID:4384
- C:\Windows\System\opxqpGR.exe
  C:\Windows\System\opxqpGR.exe
  2⤵
  PID:5156
- C:\Windows\System\Rakzxqj.exe
  C:\Windows\System\Rakzxqj.exe
  2⤵
  PID:5188
- C:\Windows\System\fmrGsNp.exe
  C:\Windows\System\fmrGsNp.exe
  2⤵
  PID:5228
- C:\Windows\System\qfRWMMs.exe
  C:\Windows\System\qfRWMMs.exe
  2⤵
  PID:5244
- C:\Windows\System\wBlNnWN.exe
  C:\Windows\System\wBlNnWN.exe
  2⤵
  PID:5264
- C:\Windows\System\dPmYMHc.exe
  C:\Windows\System\dPmYMHc.exe
  2⤵
  PID:5288
- C:\Windows\System\xVcNdBJ.exe
  C:\Windows\System\xVcNdBJ.exe
  2⤵
  PID:5324
- C:\Windows\System\yhrVhnf.exe
  C:\Windows\System\yhrVhnf.exe
  2⤵
  PID:5356
- C:\Windows\System\zgGeZvG.exe
  C:\Windows\System\zgGeZvG.exe
  2⤵
  PID:5380
- C:\Windows\System\XAeHYvL.exe
  C:\Windows\System\XAeHYvL.exe
  2⤵
  PID:5404
- C:\Windows\System\RGSUeMg.exe
  C:\Windows\System\RGSUeMg.exe
  2⤵
  PID:5436
- C:\Windows\System\BWxoeNC.exe
  C:\Windows\System\BWxoeNC.exe
  2⤵
  PID:5472
- C:\Windows\System\PNVLIyl.exe
  C:\Windows\System\PNVLIyl.exe
  2⤵
  PID:5500
- C:\Windows\System\zLoAVXN.exe
  C:\Windows\System\zLoAVXN.exe
  2⤵
  PID:5536
- C:\Windows\System\ulXJCRq.exe
  C:\Windows\System\ulXJCRq.exe
  2⤵
  PID:5556
- C:\Windows\System\XrpwWWO.exe
  C:\Windows\System\XrpwWWO.exe
  2⤵
  PID:5592
- C:\Windows\System\IYRTfZE.exe
  C:\Windows\System\IYRTfZE.exe
  2⤵
  PID:5624
- C:\Windows\System\pXbPHxm.exe
  C:\Windows\System\pXbPHxm.exe
  2⤵
  PID:5648
- C:\Windows\System\AmIlkbi.exe
  C:\Windows\System\AmIlkbi.exe
  2⤵
  PID:5688
- C:\Windows\System\yvAzuAK.exe
  C:\Windows\System\yvAzuAK.exe
  2⤵
  PID:5716
- C:\Windows\System\fEbaIhl.exe
  C:\Windows\System\fEbaIhl.exe
  2⤵
  PID:5736
- C:\Windows\System\bPhkHrl.exe
  C:\Windows\System\bPhkHrl.exe
  2⤵
  PID:5764
- C:\Windows\System\NfuoHhl.exe
  C:\Windows\System\NfuoHhl.exe
  2⤵
  PID:5808
- C:\Windows\System\iwAITWJ.exe
  C:\Windows\System\iwAITWJ.exe
  2⤵
  PID:5828
- C:\Windows\System\JEmeRWo.exe
  C:\Windows\System\JEmeRWo.exe
  2⤵
  PID:5844
- C:\Windows\System\KGvuuAM.exe
  C:\Windows\System\KGvuuAM.exe
  2⤵
  PID:5888
- C:\Windows\System\PLxCYbP.exe
  C:\Windows\System\PLxCYbP.exe
  2⤵
  PID:5904
- C:\Windows\System\CaFUHaB.exe
  C:\Windows\System\CaFUHaB.exe
  2⤵
  PID:5932
- C:\Windows\System\HduwyLV.exe
  C:\Windows\System\HduwyLV.exe
  2⤵
  PID:5964
- C:\Windows\System\OYubVWr.exe
  C:\Windows\System\OYubVWr.exe
  2⤵
  PID:5988
- C:\Windows\System\zvpXPNz.exe
  C:\Windows\System\zvpXPNz.exe
  2⤵
  PID:6020
- C:\Windows\System\onwWjaZ.exe
  C:\Windows\System\onwWjaZ.exe
  2⤵
  PID:6044
- C:\Windows\System\YZXbYqV.exe
  C:\Windows\System\YZXbYqV.exe
  2⤵
  PID:6076
- C:\Windows\System\qyBVnXG.exe
  C:\Windows\System\qyBVnXG.exe
  2⤵
  PID:6112
- C:\Windows\System\NrtcYfa.exe
  C:\Windows\System\NrtcYfa.exe
  2⤵
  PID:2216
- C:\Windows\System\bLUfrAA.exe
  C:\Windows\System\bLUfrAA.exe
  2⤵
  PID:5140
- C:\Windows\System\XkmZDLo.exe
  C:\Windows\System\XkmZDLo.exe
  2⤵
  PID:5280
- C:\Windows\System\GGXbzEX.exe
  C:\Windows\System\GGXbzEX.exe
  2⤵
  PID:5260
- C:\Windows\System\hFCxIsD.exe
  C:\Windows\System\hFCxIsD.exe
  2⤵
  PID:5388
- C:\Windows\System\MrJVUAl.exe
  C:\Windows\System\MrJVUAl.exe
  2⤵
  PID:5488
- C:\Windows\System\hiAbifL.exe
  C:\Windows\System\hiAbifL.exe
  2⤵
  PID:5528
- C:\Windows\System\ewhgBpu.exe
  C:\Windows\System\ewhgBpu.exe
  2⤵
  PID:5612
- C:\Windows\System\ymbAomv.exe
  C:\Windows\System\ymbAomv.exe
  2⤵
  PID:5672
- C:\Windows\System\TYieyMh.exe
  C:\Windows\System\TYieyMh.exe
  2⤵
  PID:5752
- C:\Windows\System\vfcyXtp.exe
  C:\Windows\System\vfcyXtp.exe
  2⤵
  PID:5816
- C:\Windows\System\gGGrTrV.exe
  C:\Windows\System\gGGrTrV.exe
  2⤵
  PID:5884
- C:\Windows\System\rFZTShD.exe
  C:\Windows\System\rFZTShD.exe
  2⤵
  PID:5944
- C:\Windows\System\HlLOdbA.exe
  C:\Windows\System\HlLOdbA.exe
  2⤵
  PID:6016
- C:\Windows\System\qTvzhHH.exe
  C:\Windows\System\qTvzhHH.exe
  2⤵
  PID:6104
- C:\Windows\System\PZLEDkY.exe
  C:\Windows\System\PZLEDkY.exe
  2⤵
  PID:5200
- C:\Windows\System\FECMhrm.exe
  C:\Windows\System\FECMhrm.exe
  2⤵
  PID:5348
- C:\Windows\System\sPbCnVw.exe
  C:\Windows\System\sPbCnVw.exe
  2⤵
  PID:5464
- C:\Windows\System\vOAEtYn.exe
  C:\Windows\System\vOAEtYn.exe
  2⤵
  PID:5704
- C:\Windows\System\XCdJyke.exe
  C:\Windows\System\XCdJyke.exe
  2⤵
  PID:5840
- C:\Windows\System\FMNWSgB.exe
  C:\Windows\System\FMNWSgB.exe
  2⤵
  PID:5984
- C:\Windows\System\wxRDymK.exe
  C:\Windows\System\wxRDymK.exe
  2⤵
  PID:3988
- C:\Windows\System\AxKTgCD.exe
  C:\Windows\System\AxKTgCD.exe
  2⤵
  PID:5644
- C:\Windows\System\qjXuWAf.exe
  C:\Windows\System\qjXuWAf.exe
  2⤵
  PID:6060
- C:\Windows\System\hIGTkGm.exe
  C:\Windows\System\hIGTkGm.exe
  2⤵
  PID:5252
- C:\Windows\System\JCFKHYD.exe
  C:\Windows\System\JCFKHYD.exe
  2⤵
  PID:5372
- C:\Windows\System\APeArbO.exe
  C:\Windows\System\APeArbO.exe
  2⤵
  PID:6180
- C:\Windows\System\qYvzbvd.exe
  C:\Windows\System\qYvzbvd.exe
  2⤵
  PID:6204
- C:\Windows\System\rhtNUnN.exe
  C:\Windows\System\rhtNUnN.exe
  2⤵
  PID:6224
- C:\Windows\System\qEvzUjM.exe
  C:\Windows\System\qEvzUjM.exe
  2⤵
  PID:6252
- C:\Windows\System\pTqsHUf.exe
  C:\Windows\System\pTqsHUf.exe
  2⤵
  PID:6280
- C:\Windows\System\rdnREiS.exe
  C:\Windows\System\rdnREiS.exe
  2⤵
  PID:6320
- C:\Windows\System\tpGrlDM.exe
  C:\Windows\System\tpGrlDM.exe
  2⤵
  PID:6352
- C:\Windows\System\fNXJkmK.exe
  C:\Windows\System\fNXJkmK.exe
  2⤵
  PID:6384
- C:\Windows\System\shZqLGv.exe
  C:\Windows\System\shZqLGv.exe
  2⤵
  PID:6408
- C:\Windows\System\UWFSeat.exe
  C:\Windows\System\UWFSeat.exe
  2⤵
  PID:6440
- C:\Windows\System\dHqsbED.exe
  C:\Windows\System\dHqsbED.exe
  2⤵
  PID:6464
- C:\Windows\System\BYRzcEU.exe
  C:\Windows\System\BYRzcEU.exe
  2⤵
  PID:6480
- C:\Windows\System\VwfuQHs.exe
  C:\Windows\System\VwfuQHs.exe
  2⤵
  PID:6496
- C:\Windows\System\IdnOLOj.exe
  C:\Windows\System\IdnOLOj.exe
  2⤵
  PID:6512
- C:\Windows\System\gLkIRhx.exe
  C:\Windows\System\gLkIRhx.exe
  2⤵
  PID:6552
- C:\Windows\System\djzFeyv.exe
  C:\Windows\System\djzFeyv.exe
  2⤵
  PID:6588
- C:\Windows\System\mSWLUIu.exe
  C:\Windows\System\mSWLUIu.exe
  2⤵
  PID:6620
- C:\Windows\System\mtlSQtH.exe
  C:\Windows\System\mtlSQtH.exe
  2⤵
  PID:6660
- C:\Windows\System\KbRUOYw.exe
  C:\Windows\System\KbRUOYw.exe
  2⤵
  PID:6676
- C:\Windows\System\mrVwekE.exe
  C:\Windows\System\mrVwekE.exe
  2⤵
  PID:6704
- C:\Windows\System\qSoYtXv.exe
  C:\Windows\System\qSoYtXv.exe
  2⤵
  PID:6736
- C:\Windows\System\Lnmlwnn.exe
  C:\Windows\System\Lnmlwnn.exe
  2⤵
  PID:6760
- C:\Windows\System\bGMWInl.exe
  C:\Windows\System\bGMWInl.exe
  2⤵
  PID:6792
- C:\Windows\System\brQopxH.exe
  C:\Windows\System\brQopxH.exe
  2⤵
  PID:6828
- C:\Windows\System\efCpith.exe
  C:\Windows\System\efCpith.exe
  2⤵
  PID:6856
- C:\Windows\System\vnpxoEZ.exe
  C:\Windows\System\vnpxoEZ.exe
  2⤵
  PID:6888
- C:\Windows\System\qseWZXo.exe
  C:\Windows\System\qseWZXo.exe
  2⤵
  PID:6912
- C:\Windows\System\abWhRPy.exe
  C:\Windows\System\abWhRPy.exe
  2⤵
  PID:6940
- C:\Windows\System\lJzmJHD.exe
  C:\Windows\System\lJzmJHD.exe
  2⤵
  PID:6964
- C:\Windows\System\ZATFGEm.exe
  C:\Windows\System\ZATFGEm.exe
  2⤵
  PID:7012
- C:\Windows\System\msbeZBP.exe
  C:\Windows\System\msbeZBP.exe
  2⤵
  PID:7028
- C:\Windows\System\fHoALzG.exe
  C:\Windows\System\fHoALzG.exe
  2⤵
  PID:7056
- C:\Windows\System\yebfctu.exe
  C:\Windows\System\yebfctu.exe
  2⤵
  PID:7088
- C:\Windows\System\kROHdXX.exe
  C:\Windows\System\kROHdXX.exe
  2⤵
  PID:7120
- C:\Windows\System\PXYPeXJ.exe
  C:\Windows\System\PXYPeXJ.exe
  2⤵
  PID:7152
- C:\Windows\System\dEsSKyA.exe
  C:\Windows\System\dEsSKyA.exe
  2⤵
  PID:5748
- C:\Windows\System\SEKwABR.exe
  C:\Windows\System\SEKwABR.exe
  2⤵
  PID:6200
- C:\Windows\System\FWlWpxI.exe
  C:\Windows\System\FWlWpxI.exe
  2⤵
  PID:6304
- C:\Windows\System\nNJTGjm.exe
  C:\Windows\System\nNJTGjm.exe
  2⤵
  PID:6364
- C:\Windows\System\awWrviy.exe
  C:\Windows\System\awWrviy.exe
  2⤵
  PID:6420
- C:\Windows\System\cwPsMwj.exe
  C:\Windows\System\cwPsMwj.exe
  2⤵
  PID:6492
- C:\Windows\System\sDxeRas.exe
  C:\Windows\System\sDxeRas.exe
  2⤵
  PID:6532
- C:\Windows\System\mIdfQRJ.exe
  C:\Windows\System\mIdfQRJ.exe
  2⤵
  PID:6632
- C:\Windows\System\egdLifa.exe
  C:\Windows\System\egdLifa.exe
  2⤵
  PID:6688
- C:\Windows\System\uqRgBjJ.exe
  C:\Windows\System\uqRgBjJ.exe
  2⤵
  PID:6744
- C:\Windows\System\hkONzMj.exe
  C:\Windows\System\hkONzMj.exe
  2⤵
  PID:6808
- C:\Windows\System\HxbRhKn.exe
  C:\Windows\System\HxbRhKn.exe
  2⤵
  PID:6876
- C:\Windows\System\rNxOxbg.exe
  C:\Windows\System\rNxOxbg.exe
  2⤵
  PID:6924
- C:\Windows\System\oFjKmqO.exe
  C:\Windows\System\oFjKmqO.exe
  2⤵
  PID:7000
- C:\Windows\System\bLfDDWw.exe
  C:\Windows\System\bLfDDWw.exe
  2⤵
  PID:7044
- C:\Windows\System\CxHndzd.exe
  C:\Windows\System\CxHndzd.exe
  2⤵
  PID:7144
- C:\Windows\System\KRDdqis.exe
  C:\Windows\System\KRDdqis.exe
  2⤵
  PID:6248
- C:\Windows\System\BBIItHo.exe
  C:\Windows\System\BBIItHo.exe
  2⤵
  PID:6448
- C:\Windows\System\iSoqiEM.exe
  C:\Windows\System\iSoqiEM.exe
  2⤵
  PID:6604
- C:\Windows\System\xsffWQD.exe
  C:\Windows\System\xsffWQD.exe
  2⤵
  PID:6804
- C:\Windows\System\jHCovuq.exe
  C:\Windows\System\jHCovuq.exe
  2⤵
  PID:6928
- C:\Windows\System\mskCQJA.exe
  C:\Windows\System\mskCQJA.exe
  2⤵
  PID:7020
- C:\Windows\System\tOnrmfG.exe
  C:\Windows\System\tOnrmfG.exe
  2⤵
  PID:7108
- C:\Windows\System\jarPmtT.exe
  C:\Windows\System\jarPmtT.exe
  2⤵
  PID:6784
- C:\Windows\System\lCFAvmW.exe
  C:\Windows\System\lCFAvmW.exe
  2⤵
  PID:6980
- C:\Windows\System\jdXdtzG.exe
  C:\Windows\System\jdXdtzG.exe
  2⤵
  PID:6840
- C:\Windows\System\goivenR.exe
  C:\Windows\System\goivenR.exe
  2⤵
  PID:7176
- C:\Windows\System\uKHCAie.exe
  C:\Windows\System\uKHCAie.exe
  2⤵
  PID:7192
- C:\Windows\System\nseltHK.exe
  C:\Windows\System\nseltHK.exe
  2⤵
  PID:7220
- C:\Windows\System\NGxXRph.exe
  C:\Windows\System\NGxXRph.exe
  2⤵
  PID:7252
- C:\Windows\System\sMTJUqO.exe
  C:\Windows\System\sMTJUqO.exe
  2⤵
  PID:7276
- C:\Windows\System\TYryahj.exe
  C:\Windows\System\TYryahj.exe
  2⤵
  PID:7300
- C:\Windows\System\qxACBXF.exe
  C:\Windows\System\qxACBXF.exe
  2⤵
  PID:7344
- C:\Windows\System\UnahotL.exe
  C:\Windows\System\UnahotL.exe
  2⤵
  PID:7388
- C:\Windows\System\gClxACq.exe
  C:\Windows\System\gClxACq.exe
  2⤵
  PID:7416
- C:\Windows\System\fwatUcm.exe
  C:\Windows\System\fwatUcm.exe
  2⤵
  PID:7452
- C:\Windows\System\NcFuhEl.exe
  C:\Windows\System\NcFuhEl.exe
  2⤵
  PID:7488
- C:\Windows\System\pxyTxIc.exe
  C:\Windows\System\pxyTxIc.exe
  2⤵
  PID:7528
- C:\Windows\System\oZxVqsW.exe
  C:\Windows\System\oZxVqsW.exe
  2⤵
  PID:7564
- C:\Windows\System\TGTOabL.exe
  C:\Windows\System\TGTOabL.exe
  2⤵
  PID:7596
- C:\Windows\System\hYAFFqJ.exe
  C:\Windows\System\hYAFFqJ.exe
  2⤵
  PID:7624
- C:\Windows\System\xuAJXfP.exe
  C:\Windows\System\xuAJXfP.exe
  2⤵
  PID:7640
- C:\Windows\System\yIgsqoA.exe
  C:\Windows\System\yIgsqoA.exe
  2⤵
  PID:7660
- C:\Windows\System\nLnteMF.exe
  C:\Windows\System\nLnteMF.exe
  2⤵
  PID:7704
- C:\Windows\System\GWghTTg.exe
  C:\Windows\System\GWghTTg.exe
  2⤵
  PID:7740
- C:\Windows\System\BDfLufP.exe
  C:\Windows\System\BDfLufP.exe
  2⤵
  PID:7784
- C:\Windows\System\ZCKAxEU.exe
  C:\Windows\System\ZCKAxEU.exe
  2⤵
  PID:7808
- C:\Windows\System\USHxRjD.exe
  C:\Windows\System\USHxRjD.exe
  2⤵
  PID:7832
- C:\Windows\System\CfxRYku.exe
  C:\Windows\System\CfxRYku.exe
  2⤵
  PID:7860
- C:\Windows\System\bpqbKYC.exe
  C:\Windows\System\bpqbKYC.exe
  2⤵
  PID:7900
- C:\Windows\System\XKMKpaN.exe
  C:\Windows\System\XKMKpaN.exe
  2⤵
  PID:7928
- C:\Windows\System\qyJgHxT.exe
  C:\Windows\System\qyJgHxT.exe
  2⤵
  PID:7956
- C:\Windows\System\xhaDYmh.exe
  C:\Windows\System\xhaDYmh.exe
  2⤵
  PID:7988
- C:\Windows\System\GlnliCn.exe
  C:\Windows\System\GlnliCn.exe
  2⤵
  PID:8012
- C:\Windows\System\jhtDnxJ.exe
  C:\Windows\System\jhtDnxJ.exe
  2⤵
  PID:8048
- C:\Windows\System\mbtnPeZ.exe
  C:\Windows\System\mbtnPeZ.exe
  2⤵
  PID:8088
- C:\Windows\System\KCZHpeN.exe
  C:\Windows\System\KCZHpeN.exe
  2⤵
  PID:8120
- C:\Windows\System\MfOsOQg.exe
  C:\Windows\System\MfOsOQg.exe
  2⤵
  PID:8148
- C:\Windows\System\evinirE.exe
  C:\Windows\System\evinirE.exe
  2⤵
  PID:8188
- C:\Windows\System\ZcmedPK.exe
  C:\Windows\System\ZcmedPK.exe
  2⤵
  PID:7184
- C:\Windows\System\WdDPwQY.exe
  C:\Windows\System\WdDPwQY.exe
  2⤵
  PID:7264
- C:\Windows\System\RKBnlNF.exe
  C:\Windows\System\RKBnlNF.exe
  2⤵
  PID:7356
- C:\Windows\System\SxyUDCu.exe
  C:\Windows\System\SxyUDCu.exe
  2⤵
  PID:7444
- C:\Windows\System\idmKQdA.exe
  C:\Windows\System\idmKQdA.exe
  2⤵
  PID:7508
- C:\Windows\System\dlOfMTK.exe
  C:\Windows\System\dlOfMTK.exe
  2⤵
  PID:7548
- C:\Windows\System\jJsgHgL.exe
  C:\Windows\System\jJsgHgL.exe
  2⤵
  PID:7652
- C:\Windows\System\rsZqWTO.exe
  C:\Windows\System\rsZqWTO.exe
  2⤵
  PID:7728
- C:\Windows\System\FoRHagm.exe
  C:\Windows\System\FoRHagm.exe
  2⤵
  PID:7768
- C:\Windows\System\PqUakEO.exe
  C:\Windows\System\PqUakEO.exe
  2⤵
  PID:7856
- C:\Windows\System\UDYIPzZ.exe
  C:\Windows\System\UDYIPzZ.exe
  2⤵
  PID:7940
- C:\Windows\System\isDhEbk.exe
  C:\Windows\System\isDhEbk.exe
  2⤵
  PID:8076
- C:\Windows\System\CAQMIFD.exe
  C:\Windows\System\CAQMIFD.exe
  2⤵
  PID:8112
- C:\Windows\System\wyOuCFO.exe
  C:\Windows\System\wyOuCFO.exe
  2⤵
  PID:8160
- C:\Windows\System\tTRktPt.exe
  C:\Windows\System\tTRktPt.exe
  2⤵
  PID:7164
- C:\Windows\System\jmpAyWt.exe
  C:\Windows\System\jmpAyWt.exe
  2⤵
  PID:7328
- C:\Windows\System\wbAumTP.exe
  C:\Windows\System\wbAumTP.exe
  2⤵
  PID:7480
- C:\Windows\System\FZfOoOE.exe
  C:\Windows\System\FZfOoOE.exe
  2⤵
  PID:7676
- C:\Windows\System\VczXDwS.exe
  C:\Windows\System\VczXDwS.exe
  2⤵
  PID:7944
- C:\Windows\System\mMVcFjr.exe
  C:\Windows\System\mMVcFjr.exe
  2⤵
  PID:8080
- C:\Windows\System\nHEelah.exe
  C:\Windows\System\nHEelah.exe
  2⤵
  PID:6536
- C:\Windows\System\WdoEJGQ.exe
  C:\Windows\System\WdoEJGQ.exe
  2⤵
  PID:7884
- C:\Windows\System\TBbKkua.exe
  C:\Windows\System\TBbKkua.exe
  2⤵
  PID:7512
- C:\Windows\System\bBHeGsg.exe
  C:\Windows\System\bBHeGsg.exe
  2⤵
  PID:8168
- C:\Windows\System\APhjqCq.exe
  C:\Windows\System\APhjqCq.exe
  2⤵
  PID:8212
- C:\Windows\System\Nbgwmix.exe
  C:\Windows\System\Nbgwmix.exe
  2⤵
  PID:8248
- C:\Windows\System\SKCQlcp.exe
  C:\Windows\System\SKCQlcp.exe
  2⤵
  PID:8284
- C:\Windows\System\jvStcLh.exe
  C:\Windows\System\jvStcLh.exe
  2⤵
  PID:8312
- C:\Windows\System\EuDLjpy.exe
  C:\Windows\System\EuDLjpy.exe
  2⤵
  PID:8344
- C:\Windows\System\nbjGKwp.exe
  C:\Windows\System\nbjGKwp.exe
  2⤵
  PID:8376
- C:\Windows\System\AvScVMs.exe
  C:\Windows\System\AvScVMs.exe
  2⤵
  PID:8404
- C:\Windows\System\dGMimPg.exe
  C:\Windows\System\dGMimPg.exe
  2⤵
  PID:8428
- C:\Windows\System\TohfXwk.exe
  C:\Windows\System\TohfXwk.exe
  2⤵
  PID:8468
- C:\Windows\System\vWbHgij.exe
  C:\Windows\System\vWbHgij.exe
  2⤵
  PID:8504
- C:\Windows\System\qwVPkAg.exe
  C:\Windows\System\qwVPkAg.exe
  2⤵
  PID:8532
- C:\Windows\System\GAsAPWm.exe
  C:\Windows\System\GAsAPWm.exe
  2⤵
  PID:8564
- C:\Windows\System\VEJLpOW.exe
  C:\Windows\System\VEJLpOW.exe
  2⤵
  PID:8588
- C:\Windows\System\LOPxIFw.exe
  C:\Windows\System\LOPxIFw.exe
  2⤵
  PID:8616
- C:\Windows\System\GJGoBOb.exe
  C:\Windows\System\GJGoBOb.exe
  2⤵
  PID:8652
- C:\Windows\System\esiknGz.exe
  C:\Windows\System\esiknGz.exe
  2⤵
  PID:8676
- C:\Windows\System\CqjXtmn.exe
  C:\Windows\System\CqjXtmn.exe
  2⤵
  PID:8700
- C:\Windows\System\lOyaFmt.exe
  C:\Windows\System\lOyaFmt.exe
  2⤵
  PID:8728
- C:\Windows\System\SctaqEc.exe
  C:\Windows\System\SctaqEc.exe
  2⤵
  PID:8768
- C:\Windows\System\UrmkRXd.exe
  C:\Windows\System\UrmkRXd.exe
  2⤵
  PID:8788
- C:\Windows\System\nrYWUVZ.exe
  C:\Windows\System\nrYWUVZ.exe
  2⤵
  PID:8824
- C:\Windows\System\VWAotLl.exe
  C:\Windows\System\VWAotLl.exe
  2⤵
  PID:8848
- C:\Windows\System\WCcWaXT.exe
  C:\Windows\System\WCcWaXT.exe
  2⤵
  PID:8880
- C:\Windows\System\HhvBoGz.exe
  C:\Windows\System\HhvBoGz.exe
  2⤵
  PID:8896
- C:\Windows\System\uDjmlgx.exe
  C:\Windows\System\uDjmlgx.exe
  2⤵
  PID:8924
- C:\Windows\System\dOcwTQP.exe
  C:\Windows\System\dOcwTQP.exe
  2⤵
  PID:8952
- C:\Windows\System\IXCceYz.exe
  C:\Windows\System\IXCceYz.exe
  2⤵
  PID:8988
- C:\Windows\System\YecfMGx.exe
  C:\Windows\System\YecfMGx.exe
  2⤵
  PID:9012
- C:\Windows\System\sHPFFhU.exe
  C:\Windows\System\sHPFFhU.exe
  2⤵
  PID:9048
- C:\Windows\System\BXbCxhz.exe
  C:\Windows\System\BXbCxhz.exe
  2⤵
  PID:9068
- C:\Windows\System\GiDlwxH.exe
  C:\Windows\System\GiDlwxH.exe
  2⤵
  PID:9104
- C:\Windows\System\xlFSDTh.exe
  C:\Windows\System\xlFSDTh.exe
  2⤵
  PID:9124
- C:\Windows\System\CZAGbcw.exe
  C:\Windows\System\CZAGbcw.exe
  2⤵
  PID:9148
- C:\Windows\System\ilQIQqJ.exe
  C:\Windows\System\ilQIQqJ.exe
  2⤵
  PID:9168
- C:\Windows\System\azhWolh.exe
  C:\Windows\System\azhWolh.exe
  2⤵
  PID:9204
- C:\Windows\System\jIONQxn.exe
  C:\Windows\System\jIONQxn.exe
  2⤵
  PID:8004
- C:\Windows\System\TDTmuou.exe
  C:\Windows\System\TDTmuou.exe
  2⤵
  PID:8276
- C:\Windows\System\OFxBDTI.exe
  C:\Windows\System\OFxBDTI.exe
  2⤵
  PID:8308
- C:\Windows\System\obtBiVt.exe
  C:\Windows\System\obtBiVt.exe
  2⤵
  PID:8392
- C:\Windows\System\VoMfaOQ.exe
  C:\Windows\System\VoMfaOQ.exe
  2⤵
  PID:8424
- C:\Windows\System\MIrKfkA.exe
  C:\Windows\System\MIrKfkA.exe
  2⤵
  PID:8580
- C:\Windows\System\TotkNkb.exe
  C:\Windows\System\TotkNkb.exe
  2⤵
  PID:8688
- C:\Windows\System\kWcXLXQ.exe
  C:\Windows\System\kWcXLXQ.exe
  2⤵
  PID:8752
- C:\Windows\System\RgMVEDk.exe
  C:\Windows\System\RgMVEDk.exe
  2⤵
  PID:8804
- C:\Windows\System\LFwErur.exe
  C:\Windows\System\LFwErur.exe
  2⤵
  PID:8876
- C:\Windows\System\eRdVgZb.exe
  C:\Windows\System\eRdVgZb.exe
  2⤵
  PID:8948
- C:\Windows\System\FzZHXfK.exe
  C:\Windows\System\FzZHXfK.exe
  2⤵
  PID:9032
- C:\Windows\System\ajnQAgi.exe
  C:\Windows\System\ajnQAgi.exe
  2⤵
  PID:9028
- C:\Windows\System\YivDoDt.exe
  C:\Windows\System\YivDoDt.exe
  2⤵
  PID:9136
- C:\Windows\System\zGgLQpz.exe
  C:\Windows\System\zGgLQpz.exe
  2⤵
  PID:9188
- C:\Windows\System\pCrRRAj.exe
  C:\Windows\System\pCrRRAj.exe
  2⤵
  PID:8336
- C:\Windows\System\oorEOUL.exe
  C:\Windows\System\oorEOUL.exe
  2⤵
  PID:8456
- C:\Windows\System\bCqsxlH.exe
  C:\Windows\System\bCqsxlH.exe
  2⤵
  PID:8548
- C:\Windows\System\OicZFQa.exe
  C:\Windows\System\OicZFQa.exe
  2⤵
  PID:8832
- C:\Windows\System\qBBLMra.exe
  C:\Windows\System\qBBLMra.exe
  2⤵
  PID:8888
- C:\Windows\System\GhYuhYE.exe
  C:\Windows\System\GhYuhYE.exe
  2⤵
  PID:9088
- C:\Windows\System\tcDPAii.exe
  C:\Windows\System\tcDPAii.exe
  2⤵
  PID:8244
- C:\Windows\System\yahAagh.exe
  C:\Windows\System\yahAagh.exe
  2⤵
  PID:8748
- C:\Windows\System\KuMgisx.exe
  C:\Windows\System\KuMgisx.exe
  2⤵
  PID:8892
- C:\Windows\System\WtAGpBl.exe
  C:\Windows\System\WtAGpBl.exe
  2⤵
  PID:7920
- C:\Windows\System\qTsntcW.exe
  C:\Windows\System\qTsntcW.exe
  2⤵
  PID:9236
- C:\Windows\System\NgevnAS.exe
  C:\Windows\System\NgevnAS.exe
  2⤵
  PID:9260
- C:\Windows\System\XHucApN.exe
  C:\Windows\System\XHucApN.exe
  2⤵
  PID:9280
- C:\Windows\System\iKVxxTa.exe
  C:\Windows\System\iKVxxTa.exe
  2⤵
  PID:9316
- C:\Windows\System\omIgnLl.exe
  C:\Windows\System\omIgnLl.exe
  2⤵
  PID:9336
- C:\Windows\System\pCRTVep.exe
  C:\Windows\System\pCRTVep.exe
  2⤵
  PID:9368
- C:\Windows\System\KkQHVsA.exe
  C:\Windows\System\KkQHVsA.exe
  2⤵
  PID:9404
- C:\Windows\System\dzqQUZH.exe
  C:\Windows\System\dzqQUZH.exe
  2⤵
  PID:9420
- C:\Windows\System\XTTxnZW.exe
  C:\Windows\System\XTTxnZW.exe
  2⤵
  PID:9440
- C:\Windows\System\VMBIvPT.exe
  C:\Windows\System\VMBIvPT.exe
  2⤵
  PID:9468
- C:\Windows\System\YCYfRgi.exe
  C:\Windows\System\YCYfRgi.exe
  2⤵
  PID:9516
- C:\Windows\System\PxevaFJ.exe
  C:\Windows\System\PxevaFJ.exe
  2⤵
  PID:9532
- C:\Windows\System\IOgcgHm.exe
  C:\Windows\System\IOgcgHm.exe
  2⤵
  PID:9548
- C:\Windows\System\NjWUjcs.exe
  C:\Windows\System\NjWUjcs.exe
  2⤵
  PID:9576
- C:\Windows\System\bSbEmgC.exe
  C:\Windows\System\bSbEmgC.exe
  2⤵
  PID:9592
- C:\Windows\System\JnewFLW.exe
  C:\Windows\System\JnewFLW.exe
  2⤵
  PID:9624
- C:\Windows\System\MqmOYDT.exe
  C:\Windows\System\MqmOYDT.exe
  2⤵
  PID:9656
- C:\Windows\System\LyGdJoe.exe
  C:\Windows\System\LyGdJoe.exe
  2⤵
  PID:9680
- C:\Windows\System\pcUuTvp.exe
  C:\Windows\System\pcUuTvp.exe
  2⤵
  PID:9712
- C:\Windows\System\zsWiDGp.exe
  C:\Windows\System\zsWiDGp.exe
  2⤵
  PID:9752
- C:\Windows\System\YvtxkOD.exe
  C:\Windows\System\YvtxkOD.exe
  2⤵
  PID:9772
- C:\Windows\System\MIqJJXL.exe
  C:\Windows\System\MIqJJXL.exe
  2⤵
  PID:9808
- C:\Windows\System\DKAZVOP.exe
  C:\Windows\System\DKAZVOP.exe
  2⤵
  PID:9844
- C:\Windows\System\QdEouPk.exe
  C:\Windows\System\QdEouPk.exe
  2⤵
  PID:9864
- C:\Windows\System\pufxrfn.exe
  C:\Windows\System\pufxrfn.exe
  2⤵
  PID:9896
- C:\Windows\System\tpsgWsg.exe
  C:\Windows\System\tpsgWsg.exe
  2⤵
  PID:9928
- C:\Windows\System\iATPefR.exe
  C:\Windows\System\iATPefR.exe
  2⤵
  PID:9956
- C:\Windows\System\SnZojED.exe
  C:\Windows\System\SnZojED.exe
  2⤵
  PID:9980
- C:\Windows\System\FaYhipX.exe
  C:\Windows\System\FaYhipX.exe
  2⤵
  PID:10020
- C:\Windows\System\nUvJcgn.exe
  C:\Windows\System\nUvJcgn.exe
  2⤵
  PID:10048
- C:\Windows\System\nPWmALm.exe
  C:\Windows\System\nPWmALm.exe
  2⤵
  PID:10072
- C:\Windows\System\fDILJRg.exe
  C:\Windows\System\fDILJRg.exe
  2⤵
  PID:10096
- C:\Windows\System\WufXlHR.exe
  C:\Windows\System\WufXlHR.exe
  2⤵
  PID:10120
- C:\Windows\System\hCuAHQs.exe
  C:\Windows\System\hCuAHQs.exe
  2⤵
  PID:10148
- C:\Windows\System\DcUqRlt.exe
  C:\Windows\System\DcUqRlt.exe
  2⤵
  PID:10176
- C:\Windows\System\hvxgRxZ.exe
  C:\Windows\System\hvxgRxZ.exe
  2⤵
  PID:10200
- C:\Windows\System\FPjpeVI.exe
  C:\Windows\System\FPjpeVI.exe
  2⤵
  PID:10220
- C:\Windows\System\KmoxvOa.exe
  C:\Windows\System\KmoxvOa.exe
  2⤵
  PID:9076
- C:\Windows\System\OJzLQWG.exe
  C:\Windows\System\OJzLQWG.exe
  2⤵
  PID:9272
- C:\Windows\System\XOtRfqV.exe
  C:\Windows\System\XOtRfqV.exe
  2⤵
  PID:9376
- C:\Windows\System\bNgnUdA.exe
  C:\Windows\System\bNgnUdA.exe
  2⤵
  PID:9416
- C:\Windows\System\iMnkLFu.exe
  C:\Windows\System\iMnkLFu.exe
  2⤵
  PID:9508
- C:\Windows\System\vRDluhI.exe
  C:\Windows\System\vRDluhI.exe
  2⤵
  PID:9564
- C:\Windows\System\miyGqQN.exe
  C:\Windows\System\miyGqQN.exe
  2⤵
  PID:9620
- C:\Windows\System\QfkjiKS.exe
  C:\Windows\System\QfkjiKS.exe
  2⤵
  PID:9720
- C:\Windows\System\GdKUJlL.exe
  C:\Windows\System\GdKUJlL.exe
  2⤵
  PID:9700
- C:\Windows\System\PyskQCB.exe
  C:\Windows\System\PyskQCB.exe
  2⤵
  PID:9832
- C:\Windows\System\DTXvHeN.exe
  C:\Windows\System\DTXvHeN.exe
  2⤵
  PID:9856
- C:\Windows\System\xKUoivQ.exe
  C:\Windows\System\xKUoivQ.exe
  2⤵
  PID:9940
- C:\Windows\System\rpFnGBP.exe
  C:\Windows\System\rpFnGBP.exe
  2⤵
  PID:10032
- C:\Windows\System\abFAWmz.exe
  C:\Windows\System\abFAWmz.exe
  2⤵
  PID:10088
- C:\Windows\System\MYVFWGT.exe
  C:\Windows\System\MYVFWGT.exe
  2⤵
  PID:10140
- C:\Windows\System\PfWIVHb.exe
  C:\Windows\System\PfWIVHb.exe
  2⤵
  PID:10160
- C:\Windows\System\YEzzhGp.exe
  C:\Windows\System\YEzzhGp.exe
  2⤵
  PID:9220
- C:\Windows\System\SQcCpyI.exe
  C:\Windows\System\SQcCpyI.exe
  2⤵
  PID:9452
- C:\Windows\System\qsvUNIV.exe
  C:\Windows\System\qsvUNIV.exe
  2⤵
  PID:9560
- C:\Windows\System\aOLSyJk.exe
  C:\Windows\System\aOLSyJk.exe
  2⤵
  PID:9668
- C:\Windows\System\kbABJYo.exe
  C:\Windows\System\kbABJYo.exe
  2⤵
  PID:9880
- C:\Windows\System\dJYRLuU.exe
  C:\Windows\System\dJYRLuU.exe
  2⤵
  PID:10212
- C:\Windows\System\wKCusZI.exe
  C:\Windows\System\wKCusZI.exe
  2⤵
  PID:9412
- C:\Windows\System\nRvakqU.exe
  C:\Windows\System\nRvakqU.exe
  2⤵
  PID:9616
- C:\Windows\System\IQZIRWU.exe
  C:\Windows\System\IQZIRWU.exe
  2⤵
  PID:9156
- C:\Windows\System\LjveImg.exe
  C:\Windows\System\LjveImg.exe
  2⤵
  PID:10244
- C:\Windows\System\NxwcHxS.exe
  C:\Windows\System\NxwcHxS.exe
  2⤵
  PID:10276
- C:\Windows\System\QQvDxaR.exe
  C:\Windows\System\QQvDxaR.exe
  2⤵
  PID:10308
- C:\Windows\System\pjGIiYw.exe
  C:\Windows\System\pjGIiYw.exe
  2⤵
  PID:10348
- C:\Windows\System\lyEjQPa.exe
  C:\Windows\System\lyEjQPa.exe
  2⤵
  PID:10376
- C:\Windows\System\HYfOJzx.exe
  C:\Windows\System\HYfOJzx.exe
  2⤵
  PID:10400
- C:\Windows\System\vUslLRG.exe
  C:\Windows\System\vUslLRG.exe
  2⤵
  PID:10420
- C:\Windows\System\zahRhiD.exe
  C:\Windows\System\zahRhiD.exe
  2⤵
  PID:10460
- C:\Windows\System\uOraaVX.exe
  C:\Windows\System\uOraaVX.exe
  2⤵
  PID:10484
- C:\Windows\System\XfLDTtw.exe
  C:\Windows\System\XfLDTtw.exe
  2⤵
  PID:10504
- C:\Windows\System\gyeCkZz.exe
  C:\Windows\System\gyeCkZz.exe
  2⤵
  PID:10536
- C:\Windows\System\rslneYw.exe
  C:\Windows\System\rslneYw.exe
  2⤵
  PID:10564
- C:\Windows\System\pSuAiwN.exe
  C:\Windows\System\pSuAiwN.exe
  2⤵
  PID:10596
- C:\Windows\System\jrrzCUS.exe
  C:\Windows\System\jrrzCUS.exe
  2⤵
  PID:10624
- C:\Windows\System\yXUtTwj.exe
  C:\Windows\System\yXUtTwj.exe
  2⤵
  PID:10640
- C:\Windows\System\dNoTBaT.exe
  C:\Windows\System\dNoTBaT.exe
  2⤵
  PID:10672
- C:\Windows\System\ZHyNKeg.exe
  C:\Windows\System\ZHyNKeg.exe
  2⤵
  PID:10704
- C:\Windows\System\TqGctjN.exe
  C:\Windows\System\TqGctjN.exe
  2⤵
  PID:10736
- C:\Windows\System\eqWHHkU.exe
  C:\Windows\System\eqWHHkU.exe
  2⤵
  PID:10772
- C:\Windows\System\kCDVUBA.exe
  C:\Windows\System\kCDVUBA.exe
  2⤵
  PID:10792
- C:\Windows\System\fECHtjH.exe
  C:\Windows\System\fECHtjH.exe
  2⤵
  PID:10824
- C:\Windows\System\aytavBU.exe
  C:\Windows\System\aytavBU.exe
  2⤵
  PID:10856
- C:\Windows\System\Xthlerr.exe
  C:\Windows\System\Xthlerr.exe
  2⤵
  PID:10880
- C:\Windows\System\NNlmiXt.exe
  C:\Windows\System\NNlmiXt.exe
  2⤵
  PID:10904
- C:\Windows\System\IddcCFV.exe
  C:\Windows\System\IddcCFV.exe
  2⤵
  PID:10944
- C:\Windows\System\tfMdIeG.exe
  C:\Windows\System\tfMdIeG.exe
  2⤵
  PID:10960
- C:\Windows\System\OamTdEe.exe
  C:\Windows\System\OamTdEe.exe
  2⤵
  PID:10988
- C:\Windows\System\hPfcKQK.exe
  C:\Windows\System\hPfcKQK.exe
  2⤵
  PID:11016
- C:\Windows\System\NzqBBJA.exe
  C:\Windows\System\NzqBBJA.exe
  2⤵
  PID:11044
- C:\Windows\System\vCnGHBn.exe
  C:\Windows\System\vCnGHBn.exe
  2⤵
  PID:11072
- C:\Windows\System\dlGjqRJ.exe
  C:\Windows\System\dlGjqRJ.exe
  2⤵
  PID:11108
- C:\Windows\System\TzxtJwg.exe
  C:\Windows\System\TzxtJwg.exe
  2⤵
  PID:11128
- C:\Windows\System\eTXwlsM.exe
  C:\Windows\System\eTXwlsM.exe
  2⤵
  PID:11156
- C:\Windows\System\DPpAQyH.exe
  C:\Windows\System\DPpAQyH.exe
  2⤵
  PID:11184
- C:\Windows\System\DOKJdxo.exe
  C:\Windows\System\DOKJdxo.exe
  2⤵
  PID:11220
- C:\Windows\System\VJyngMn.exe
  C:\Windows\System\VJyngMn.exe
  2⤵
  PID:11240
- C:\Windows\System\GIzFrlY.exe
  C:\Windows\System\GIzFrlY.exe
  2⤵
  PID:10136
- C:\Windows\System\EegJryb.exe
  C:\Windows\System\EegJryb.exe
  2⤵
  PID:10260
- C:\Windows\System\JmMlfoT.exe
  C:\Windows\System\JmMlfoT.exe
  2⤵
  PID:10356
- C:\Windows\System\vBYIbaw.exe
  C:\Windows\System\vBYIbaw.exe
  2⤵
  PID:10476
- C:\Windows\System\aivhqNS.exe
  C:\Windows\System\aivhqNS.exe
  2⤵
  PID:10512
- C:\Windows\System\XzwYYAl.exe
  C:\Windows\System\XzwYYAl.exe
  2⤵
  PID:10588
- C:\Windows\System\VRMHHjg.exe
  C:\Windows\System\VRMHHjg.exe
  2⤵
  PID:10616
- C:\Windows\System\CiZHlJD.exe
  C:\Windows\System\CiZHlJD.exe
  2⤵
  PID:10636
- C:\Windows\System\vBkrzJA.exe
  C:\Windows\System\vBkrzJA.exe
  2⤵
  PID:10720
- C:\Windows\System\iCKfiTj.exe
  C:\Windows\System\iCKfiTj.exe
  2⤵
  PID:10804
- C:\Windows\System\nCPxEuS.exe
  C:\Windows\System\nCPxEuS.exe
  2⤵
  PID:10876
- C:\Windows\System\TAyWKYk.exe
  C:\Windows\System\TAyWKYk.exe
  2⤵
  PID:10936
- C:\Windows\System\DatWbrm.exe
  C:\Windows\System\DatWbrm.exe
  2⤵
  PID:11000
- C:\Windows\System\mSfSzOt.exe
  C:\Windows\System\mSfSzOt.exe
  2⤵
  PID:11064
- C:\Windows\System\egQrZTq.exe
  C:\Windows\System\egQrZTq.exe
  2⤵
  PID:11140
- C:\Windows\System\wlXpPLy.exe
  C:\Windows\System\wlXpPLy.exe
  2⤵
  PID:11228
- C:\Windows\System\IUMgWcg.exe
  C:\Windows\System\IUMgWcg.exe
  2⤵
  PID:9736
- C:\Windows\System\QKaQnPR.exe
  C:\Windows\System\QKaQnPR.exe
  2⤵
  PID:10392
- C:\Windows\System\VMyOnlM.exe
  C:\Windows\System\VMyOnlM.exe
  2⤵
  PID:10456
- C:\Windows\System\cLWSpKQ.exe
  C:\Windows\System\cLWSpKQ.exe
  2⤵
  PID:10652
- C:\Windows\System\vjBMriA.exe
  C:\Windows\System\vjBMriA.exe
  2⤵
  PID:10780
- C:\Windows\System\wvhRbhP.exe
  C:\Windows\System\wvhRbhP.exe
  2⤵
  PID:10916
- C:\Windows\System\krnTGoi.exe
  C:\Windows\System\krnTGoi.exe
  2⤵
  PID:11060
- C:\Windows\System\KWNSAvW.exe
  C:\Windows\System\KWNSAvW.exe
  2⤵
  PID:11236
- C:\Windows\System\GLVILBT.exe
  C:\Windows\System\GLVILBT.exe
  2⤵
  PID:10472
- C:\Windows\System\YcbuDGZ.exe
  C:\Windows\System\YcbuDGZ.exe
  2⤵
  PID:10632
- C:\Windows\System\oWIljAR.exe
  C:\Windows\System\oWIljAR.exe
  2⤵
  PID:11256
- C:\Windows\System\RpBzIgn.exe
  C:\Windows\System\RpBzIgn.exe
  2⤵
  PID:11096
- C:\Windows\System\IpLxTdl.exe
  C:\Windows\System\IpLxTdl.exe
  2⤵
  PID:11284
- C:\Windows\System\tkNKEni.exe
  C:\Windows\System\tkNKEni.exe
  2⤵
  PID:11308
- C:\Windows\System\nIyBNTI.exe
  C:\Windows\System\nIyBNTI.exe
  2⤵
  PID:11332
- C:\Windows\System\JWGpcBd.exe
  C:\Windows\System\JWGpcBd.exe
  2⤵
  PID:11356
- C:\Windows\System\OPBuvFL.exe
  C:\Windows\System\OPBuvFL.exe
  2⤵
  PID:11384
- C:\Windows\System\bUUrFdm.exe
  C:\Windows\System\bUUrFdm.exe
  2⤵
  PID:11416
- C:\Windows\System\vDdnlQP.exe
  C:\Windows\System\vDdnlQP.exe
  2⤵
  PID:11444
- C:\Windows\System\oUZldhB.exe
  C:\Windows\System\oUZldhB.exe
  2⤵
  PID:11464
- C:\Windows\System\qzISFdo.exe
  C:\Windows\System\qzISFdo.exe
  2⤵
  PID:11496
- C:\Windows\System\yTFzDjo.exe
  C:\Windows\System\yTFzDjo.exe
  2⤵
  PID:11528
- C:\Windows\System\figKxoN.exe
  C:\Windows\System\figKxoN.exe
  2⤵
  PID:11556
- C:\Windows\System\FAWHsDd.exe
  C:\Windows\System\FAWHsDd.exe
  2⤵
  PID:11584
- C:\Windows\System\FZKrSkl.exe
  C:\Windows\System\FZKrSkl.exe
  2⤵
  PID:11608
- C:\Windows\System\KhPKeKx.exe
  C:\Windows\System\KhPKeKx.exe
  2⤵
  PID:11624
- C:\Windows\System\TAZLYHr.exe
  C:\Windows\System\TAZLYHr.exe
  2⤵
  PID:11672
- C:\Windows\System\XQqFksn.exe
  C:\Windows\System\XQqFksn.exe
  2⤵
  PID:11688
- C:\Windows\System\GFCTYag.exe
  C:\Windows\System\GFCTYag.exe
  2⤵
  PID:11720
- C:\Windows\System\aBmlLvP.exe
  C:\Windows\System\aBmlLvP.exe
  2⤵
  PID:11756
- C:\Windows\System\OAhnWIb.exe
  C:\Windows\System\OAhnWIb.exe
  2⤵
  PID:11776
- C:\Windows\System\VSRPVwl.exe
  C:\Windows\System\VSRPVwl.exe
  2⤵
  PID:11816
- C:\Windows\System\OyPynDX.exe
  C:\Windows\System\OyPynDX.exe
  2⤵
  PID:11832
- C:\Windows\System\XtoJvfB.exe
  C:\Windows\System\XtoJvfB.exe
  2⤵
  PID:11868
- C:\Windows\System\qCBllqR.exe
  C:\Windows\System\qCBllqR.exe
  2⤵
  PID:11888
- C:\Windows\System\jDXOXgF.exe
  C:\Windows\System\jDXOXgF.exe
  2⤵
  PID:11928
- C:\Windows\System\NCPsMhv.exe
  C:\Windows\System\NCPsMhv.exe
  2⤵
  PID:11956
- C:\Windows\System\dscWlxz.exe
  C:\Windows\System\dscWlxz.exe
  2⤵
  PID:11972
- C:\Windows\System\UEcDwZX.exe
  C:\Windows\System\UEcDwZX.exe
  2⤵
  PID:12000
- C:\Windows\System\hFmhQxo.exe
  C:\Windows\System\hFmhQxo.exe
  2⤵
  PID:12028
- C:\Windows\System\dHDaVIv.exe
  C:\Windows\System\dHDaVIv.exe
  2⤵
  PID:12064
- C:\Windows\System\GzYuOGB.exe
  C:\Windows\System\GzYuOGB.exe
  2⤵
  PID:12080
- C:\Windows\System\AoaTXqy.exe
  C:\Windows\System\AoaTXqy.exe
  2⤵
  PID:12104
- C:\Windows\System\wQikmru.exe
  C:\Windows\System\wQikmru.exe
  2⤵
  PID:12140
- C:\Windows\System\aGdLHiR.exe
  C:\Windows\System\aGdLHiR.exe
  2⤵
  PID:12156
- C:\Windows\System\LSWBeMo.exe
  C:\Windows\System\LSWBeMo.exe
  2⤵
  PID:12172
- C:\Windows\System\NwAoRyA.exe
  C:\Windows\System\NwAoRyA.exe
  2⤵
  PID:12208
- C:\Windows\System\xnbWbyu.exe
  C:\Windows\System\xnbWbyu.exe
  2⤵
  PID:12240
- C:\Windows\System\kySfhxc.exe
  C:\Windows\System\kySfhxc.exe
  2⤵
  PID:12280
- C:\Windows\System\gjaQFGO.exe
  C:\Windows\System\gjaQFGO.exe
  2⤵
  PID:11320
- C:\Windows\System\JruZaNe.exe
  C:\Windows\System\JruZaNe.exe
  2⤵
  PID:11340
- C:\Windows\System\uurVvBL.exe
  C:\Windows\System\uurVvBL.exe
  2⤵
  PID:11424
- C:\Windows\System\SLYzTVp.exe
  C:\Windows\System\SLYzTVp.exe
  2⤵
  PID:11480
- C:\Windows\System\rRpBXkp.exe
  C:\Windows\System\rRpBXkp.exe
  2⤵
  PID:11552
- C:\Windows\System\pqYKywd.exe
  C:\Windows\System\pqYKywd.exe
  2⤵
  PID:11572
- C:\Windows\System\urorRyX.exe
  C:\Windows\System\urorRyX.exe
  2⤵
  PID:11644
- C:\Windows\System\yisAUEJ.exe
  C:\Windows\System\yisAUEJ.exe
  2⤵
  PID:11684
- C:\Windows\System\rANTyIK.exe
  C:\Windows\System\rANTyIK.exe
  2⤵
  PID:11772
- C:\Windows\System\vZisEju.exe
  C:\Windows\System\vZisEju.exe
  2⤵
  PID:11824
- C:\Windows\System\ihBnjQn.exe
  C:\Windows\System\ihBnjQn.exe
  2⤵
  PID:11864
- C:\Windows\System\qlAoIOe.exe
  C:\Windows\System\qlAoIOe.exe
  2⤵
  PID:11968
- C:\Windows\System\cVApGvd.exe
  C:\Windows\System\cVApGvd.exe
  2⤵
  PID:12088
- C:\Windows\System\qJmsAbS.exe
  C:\Windows\System\qJmsAbS.exe
  2⤵
  PID:12192
- C:\Windows\System\xkhldic.exe
  C:\Windows\System\xkhldic.exe
  2⤵
  PID:12184
- C:\Windows\System\JPyuuqe.exe
  C:\Windows\System\JPyuuqe.exe
  2⤵
  PID:12276
- C:\Windows\System\uGyXdbk.exe
  C:\Windows\System\uGyXdbk.exe
  2⤵
  PID:11316
- C:\Windows\System\gtnQIVw.exe
  C:\Windows\System\gtnQIVw.exe
  2⤵
  PID:11580
- C:\Windows\System\iAovKzU.exe
  C:\Windows\System\iAovKzU.exe
  2⤵
  PID:11620
- C:\Windows\System\lMvOTnD.exe
  C:\Windows\System\lMvOTnD.exe
  2⤵
  PID:11664
- C:\Windows\System\TqovTbf.exe
  C:\Windows\System\TqovTbf.exe
  2⤵
  PID:11916
- C:\Windows\System\vZffnHB.exe
  C:\Windows\System\vZffnHB.exe
  2⤵
  PID:12048
- C:\Windows\System\MqmvBmv.exe
  C:\Windows\System\MqmvBmv.exe
  2⤵
  PID:12260
- C:\Windows\System\xDmvTTs.exe
  C:\Windows\System\xDmvTTs.exe
  2⤵
  PID:11348
- C:\Windows\System\WYQbKTk.exe
  C:\Windows\System\WYQbKTk.exe
  2⤵
  PID:2668
- C:\Windows\System\OvtojoC.exe
  C:\Windows\System\OvtojoC.exe
  2⤵
  PID:12016
- C:\Windows\System\wicFzxk.exe
  C:\Windows\System\wicFzxk.exe
  2⤵
  PID:12328
- C:\Windows\System\uebUtSe.exe
  C:\Windows\System\uebUtSe.exe
  2⤵
  PID:12344
- C:\Windows\System\ckAuamJ.exe
  C:\Windows\System\ckAuamJ.exe
  2⤵
  PID:12372
- C:\Windows\System\FYHmloA.exe
  C:\Windows\System\FYHmloA.exe
  2⤵
  PID:12400
- C:\Windows\System\RMUqMoB.exe
  C:\Windows\System\RMUqMoB.exe
  2⤵
  PID:12428
- C:\Windows\System\QNlDfDi.exe
  C:\Windows\System\QNlDfDi.exe
  2⤵
  PID:12456
- C:\Windows\System\ZWkpRYr.exe
  C:\Windows\System\ZWkpRYr.exe
  2⤵
  PID:12472
- C:\Windows\System\zkzytZP.exe
  C:\Windows\System\zkzytZP.exe
  2⤵
  PID:12508
- C:\Windows\System\SPzckAF.exe
  C:\Windows\System\SPzckAF.exe
  2⤵
  PID:12540
- C:\Windows\System\TnJbrNV.exe
  C:\Windows\System\TnJbrNV.exe
  2⤵
  PID:12560
- C:\Windows\System\YKAkJKE.exe
  C:\Windows\System\YKAkJKE.exe
  2⤵
  PID:12592
- C:\Windows\System\EdRsCaQ.exe
  C:\Windows\System\EdRsCaQ.exe
  2⤵
  PID:12620
- C:\Windows\System\Eskjvvt.exe
  C:\Windows\System\Eskjvvt.exe
  2⤵
  PID:12652
- C:\Windows\System\LpOGDbr.exe
  C:\Windows\System\LpOGDbr.exe
  2⤵
  PID:12688
- C:\Windows\System\myurSbw.exe
  C:\Windows\System\myurSbw.exe
  2⤵
  PID:12720
- C:\Windows\System\FonSfPK.exe
  C:\Windows\System\FonSfPK.exe
  2⤵
  PID:12744
- C:\Windows\System\UajqTBI.exe
  C:\Windows\System\UajqTBI.exe
  2⤵
  PID:12784
- C:\Windows\System\HaTlErr.exe
  C:\Windows\System\HaTlErr.exe
  2⤵
  PID:12808
- C:\Windows\System\dLgSPOM.exe
  C:\Windows\System\dLgSPOM.exe
  2⤵
  PID:12848
- C:\Windows\System\kfzmxoL.exe
  C:\Windows\System\kfzmxoL.exe
  2⤵
  PID:12864
- C:\Windows\System\ChsYdoY.exe
  C:\Windows\System\ChsYdoY.exe
  2⤵
  PID:12880
- C:\Windows\System\gWmUlro.exe
  C:\Windows\System\gWmUlro.exe
  2⤵
  PID:12912
- C:\Windows\System\yKWubem.exe
  C:\Windows\System\yKWubem.exe
  2⤵
  PID:12928
- C:\Windows\System\paHBjjn.exe
  C:\Windows\System\paHBjjn.exe
  2⤵
  PID:12960
- C:\Windows\System\AvoFIfu.exe
  C:\Windows\System\AvoFIfu.exe
  2⤵
  PID:13000
- C:\Windows\System\CAGROIr.exe
  C:\Windows\System\CAGROIr.exe
  2⤵
  PID:13036
- C:\Windows\System\pFusQPL.exe
  C:\Windows\System\pFusQPL.exe
  2⤵
  PID:13064
- C:\Windows\System\ZPQSbmk.exe
  C:\Windows\System\ZPQSbmk.exe
  2⤵
  PID:13096
- C:\Windows\System\SmafAcg.exe
  C:\Windows\System\SmafAcg.exe
  2⤵
  PID:13136
- C:\Windows\System\PmgmBuI.exe
  C:\Windows\System\PmgmBuI.exe
  2⤵
  PID:13152
- C:\Windows\System\DinpRmY.exe
  C:\Windows\System\DinpRmY.exe
  2⤵
  PID:13180
- C:\Windows\System\QmOeHcC.exe
  C:\Windows\System\QmOeHcC.exe
  2⤵
  PID:13200
- C:\Windows\System\ADHJjmt.exe
  C:\Windows\System\ADHJjmt.exe
  2⤵
  PID:13236
- C:\Windows\System\VJVfYKR.exe
  C:\Windows\System\VJVfYKR.exe
  2⤵
  PID:13272
- C:\Windows\System\GpFONUZ.exe
  C:\Windows\System\GpFONUZ.exe
  2⤵
  PID:13300
- C:\Windows\System\ygVLlvd.exe
  C:\Windows\System\ygVLlvd.exe
  2⤵
  PID:11856
- C:\Windows\System\ZJtKEyT.exe
  C:\Windows\System\ZJtKEyT.exe
  2⤵
  PID:12340
- C:\Windows\System\zRfXXtp.exe
  C:\Windows\System\zRfXXtp.exe
  2⤵
  PID:12420
- C:\Windows\System\ftECjeK.exe
  C:\Windows\System\ftECjeK.exe
  2⤵
  PID:12516
- C:\Windows\System\hlhafjD.exe
  C:\Windows\System\hlhafjD.exe
  2⤵
  PID:12568
- C:\Windows\System\LMVVSAD.exe
  C:\Windows\System\LMVVSAD.exe
  2⤵
  PID:12676
- C:\Windows\System\jfTiFHc.exe
  C:\Windows\System\jfTiFHc.exe
  2⤵
  PID:12796
- C:\Windows\System\AhjKBSA.exe
  C:\Windows\System\AhjKBSA.exe
  2⤵
  PID:12900
- C:\Windows\System\HdXQlEX.exe
  C:\Windows\System\HdXQlEX.exe
  2⤵
  PID:12984
- C:\Windows\System\fZxcoqy.exe
  C:\Windows\System\fZxcoqy.exe
  2⤵
  PID:13056
- C:\Windows\System\jxIcUMz.exe
  C:\Windows\System\jxIcUMz.exe
  2⤵
  PID:13124
- C:\Windows\System\PTQmOyL.exe
  C:\Windows\System\PTQmOyL.exe
  2⤵
  PID:13212
- C:\Windows\System\brHLbWM.exe
  C:\Windows\System\brHLbWM.exe
  2⤵
  PID:13268
- C:\Windows\System\czzThrC.exe
  C:\Windows\System\czzThrC.exe
  2⤵
  PID:12660
- C:\Windows\System\OjDDDiZ.exe
  C:\Windows\System\OjDDDiZ.exe
  2⤵
  PID:12464
- C:\Windows\System\XTydDDb.exe
  C:\Windows\System\XTydDDb.exe
  2⤵
  PID:12876
- C:\Windows\System\HKcQnLO.exe
  C:\Windows\System\HKcQnLO.exe
  2⤵
  PID:12860
- C:\Windows\System\CHZtRUJ.exe
  C:\Windows\System\CHZtRUJ.exe
  2⤵
  PID:12996
- C:\Windows\System\gAYDene.exe
  C:\Windows\System\gAYDene.exe
  2⤵
  PID:13144
- C:\Windows\System\fUiPAjA.exe
  C:\Windows\System\fUiPAjA.exe
  2⤵
  PID:12368
- C:\Windows\System\HStvGrr.exe
  C:\Windows\System\HStvGrr.exe
  2⤵
  PID:12908
- C:\Windows\System\efZjbia.exe
  C:\Windows\System\efZjbia.exe
  2⤵
  PID:12320
- C:\Windows\System\KSfhZOZ.exe
  C:\Windows\System\KSfhZOZ.exe
  2⤵
  PID:13328
- C:\Windows\System\JFMJBsP.exe
  C:\Windows\System\JFMJBsP.exe
  2⤵
  PID:13344
- C:\Windows\System\tKZVAJl.exe
  C:\Windows\System\tKZVAJl.exe
  2⤵
  PID:13364
- C:\Windows\System\aJxZEEv.exe
  C:\Windows\System\aJxZEEv.exe
  2⤵
  PID:13380
- C:\Windows\System\rMrcjBF.exe
  C:\Windows\System\rMrcjBF.exe
  2⤵
  PID:13412
- C:\Windows\System\zqHkKjv.exe
  C:\Windows\System\zqHkKjv.exe
  2⤵
  PID:13428
- C:\Windows\System\gbVtmlt.exe
  C:\Windows\System\gbVtmlt.exe
  2⤵
  PID:13460
- C:\Windows\System\VeWSOqK.exe
  C:\Windows\System\VeWSOqK.exe
  2⤵
  PID:13488
- C:\Windows\System\AWtMExi.exe
  C:\Windows\System\AWtMExi.exe
  2⤵
  PID:13520
- C:\Windows\System\sHPiPew.exe
  C:\Windows\System\sHPiPew.exe
  2⤵
  PID:13548
- C:\Windows\System\cTUyZBe.exe
  C:\Windows\System\cTUyZBe.exe
  2⤵
  PID:13576
- C:\Windows\System\FWbsCAc.exe
  C:\Windows\System\FWbsCAc.exe
  2⤵
  PID:13600
- C:\Windows\System\kRAXzke.exe
  C:\Windows\System\kRAXzke.exe
  2⤵
  PID:13636
- C:\Windows\System\gZrzpWZ.exe
  C:\Windows\System\gZrzpWZ.exe
  2⤵
  PID:13676
- C:\Windows\System\PCbdMUS.exe
  C:\Windows\System\PCbdMUS.exe
  2⤵
  PID:13708
- C:\Windows\System\rIpKYXd.exe
  C:\Windows\System\rIpKYXd.exe
  2⤵
  PID:13736
- C:\Windows\System\jTEYqkp.exe
  C:\Windows\System\jTEYqkp.exe
  2⤵
  PID:13756
- C:\Windows\System\TkVBOmS.exe
  C:\Windows\System\TkVBOmS.exe
  2⤵
  PID:13784
- C:\Windows\System\nkJJHZJ.exe
  C:\Windows\System\nkJJHZJ.exe
  2⤵
  PID:13812
- C:\Windows\System\qDnUMxY.exe
  C:\Windows\System\qDnUMxY.exe
  2⤵
  PID:13836
- C:\Windows\System\jWBnciW.exe
  C:\Windows\System\jWBnciW.exe
  2⤵
  PID:13860
- C:\Windows\System\dEMDDQd.exe
  C:\Windows\System\dEMDDQd.exe
  2⤵
  PID:13884
- C:\Windows\System\PMuawsg.exe
  C:\Windows\System\PMuawsg.exe
  2⤵
  PID:13908
- C:\Windows\System\ilmVvyi.exe
  C:\Windows\System\ilmVvyi.exe
  2⤵
  PID:13932
- C:\Windows\System\FitMSeK.exe
  C:\Windows\System\FitMSeK.exe
  2⤵
  PID:13952
- C:\Windows\System\EFrkJWE.exe
  C:\Windows\System\EFrkJWE.exe
  2⤵
  PID:13992
- C:\Windows\System\dzlnAgz.exe
  C:\Windows\System\dzlnAgz.exe
  2⤵
  PID:14020
- C:\Windows\System\EMkTOGT.exe
  C:\Windows\System\EMkTOGT.exe
  2⤵
  PID:14056
- C:\Windows\System\AYeMnqe.exe
  C:\Windows\System\AYeMnqe.exe
  2⤵
  PID:14088
- C:\Windows\System\QRiezcl.exe
  C:\Windows\System\QRiezcl.exe
  2⤵
  PID:14116
- C:\Windows\System\EXJfKdE.exe
  C:\Windows\System\EXJfKdE.exe
  2⤵
  PID:14160
- C:\Windows\System\jktKVDQ.exe
  C:\Windows\System\jktKVDQ.exe
  2⤵
  PID:14188
- C:\Windows\System\wlOHFMX.exe
  C:\Windows\System\wlOHFMX.exe
  2⤵
  PID:14232
- C:\Windows\System\uikKxGu.exe
  C:\Windows\System\uikKxGu.exe
  2⤵
  PID:14248
- C:\Windows\System\PhYTSur.exe
  C:\Windows\System\PhYTSur.exe
  2⤵
  PID:14276
- C:\Windows\System\izgVOoo.exe
  C:\Windows\System\izgVOoo.exe
  2⤵
  PID:14312
- C:\Windows\System\QmndIIu.exe
  C:\Windows\System\QmndIIu.exe
  2⤵
  PID:11800
- C:\Windows\System\GTuTVug.exe
  C:\Windows\System\GTuTVug.exe
  2⤵
  PID:13404
- C:\Windows\System\wYIntEx.exe
  C:\Windows\System\wYIntEx.exe
  2⤵
  PID:13336
- C:\Windows\System\qLuoAtp.exe
  C:\Windows\System\qLuoAtp.exe
  2⤵
  PID:13536
- C:\Windows\System\FbBzCXs.exe
  C:\Windows\System\FbBzCXs.exe
  2⤵
  PID:13596
- C:\Windows\System\qsFULRJ.exe
  C:\Windows\System\qsFULRJ.exe
  2⤵
  PID:13560
- C:\Windows\System\xNRYpnn.exe
  C:\Windows\System\xNRYpnn.exe
  2⤵
  PID:1080
- C:\Windows\System\ZroqPbw.exe
  C:\Windows\System\ZroqPbw.exe
  2⤵
  PID:13768
- C:\Windows\System\IWIqdIw.exe
  C:\Windows\System\IWIqdIw.exe
  2⤵
  PID:13848
- C:\Windows\System\QFYLJCf.exe
  C:\Windows\System\QFYLJCf.exe
  2⤵
  PID:13876
- C:\Windows\System\Jadfaek.exe
  C:\Windows\System\Jadfaek.exe
  2⤵
  PID:13976
- C:\Windows\System\jQLMquE.exe
  C:\Windows\System\jQLMquE.exe
  2⤵
  PID:13988
- C:\Windows\System\jnWhuup.exe
  C:\Windows\System\jnWhuup.exe
  2⤵
  PID:14112
- C:\Windows\System\tiirByu.exe
  C:\Windows\System\tiirByu.exe
  2⤵
  PID:14172
- C:\Windows\System\MCUEMoi.exe
  C:\Windows\System\MCUEMoi.exe
  2⤵
  PID:2724
- C:\Windows\System\PGXJFax.exe
  C:\Windows\System\PGXJFax.exe
  2⤵
  PID:14196
- C:\Windows\System\OZWuViy.exe
  C:\Windows\System\OZWuViy.exe
  2⤵
  PID:4900
- C:\Windows\System\ZUWjnTE.exe
  C:\Windows\System\ZUWjnTE.exe
  2⤵
  PID:12856
- C:\Windows\System\WtRjPay.exe
  C:\Windows\System\WtRjPay.exe
  2⤵
  PID:13372
- C:\Windows\System\DTMqmVL.exe
  C:\Windows\System\DTMqmVL.exe
  2⤵
  PID:13504
- C:\Windows\System\ayEGYQr.exe
  C:\Windows\System\ayEGYQr.exe
  2⤵
  PID:13720
- C:\Windows\System\WxtVvIl.exe
  C:\Windows\System\WxtVvIl.exe
  2⤵
  PID:13832
- C:\Windows\System\GepfzOP.exe
  C:\Windows\System\GepfzOP.exe
  2⤵
  PID:13972
- C:\Windows\System\HGJBoue.exe
  C:\Windows\System\HGJBoue.exe
  2⤵
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ARKdYrJ.exe

Filesize
2.1MB

MD5
1bb34196f024a752019029d774bf431a

SHA1
57c96a01e8bd4f26bf50030aba0014f4733e2ff4

SHA256
b2aea810dc88ab6ac1e42628ad97f1e0825d2cc271e91d7a8953d299bf45900f

SHA512
b435057ab3b78e741dbe848d67b9f2c6cea839229bb34602165d249ee950994c3172ad774117f9d9fb0ba4ad378f33bd7f10db87a593e940fe378b8133b5fcb5

Download Submit
C:\Windows\System\AcvbEgq.exe

Filesize
2.2MB

MD5
cb817bec03e88f3a9f96f23f3b73af17

SHA1
59d53fe9468758a30d6f93fdd0f587eac0534c1e

SHA256
2eb6e53a4843f161eae6c73619f0da6be140027ab67e4797aef0fc583780ec78

SHA512
a8571bb6e61d8aa8a213955fe994fd98a7919cf3ab437103ec0dac9ffcf658fe9d5ed20759e5d890d8e6bf7bc8dc25dbd3bc24b42d36319dd23cbcecca8b0cab

Download Submit
C:\Windows\System\AkUSPIE.exe

Filesize
2.2MB

MD5
452a417995e09c9f918a8e7a87be2f6e

SHA1
6e4425e13ede510bcb79e811a6c127da9591eb45

SHA256
17e5c86333ea7cdab3ee489db2654a95261c94883d5470794df648503dce02ad

SHA512
9db1f18a00f11dfe568619ea720fe0849242b47ab85c60ad5e08a4621b74929c79dd6ecb15fbb3a6728a5c61936db73cd0443223cd4bb041f683d66a4726cd3a

Download Submit
C:\Windows\System\EhjRqeK.exe

Filesize
2.2MB

MD5
4af37bec0a909a0abab5a29219619a26

SHA1
907881df53b50be0cff7d209d3480cd1a3f14024

SHA256
24f43682fa19ca19518949bae1a76f578d020f6592b2be8f6d58c0e30ea59006

SHA512
a076687642e440a92624272b166705f1784a26d20bda21f0f2986824f824d7b3829f76f12003e4b28c2fa736b0dca89561875f5f8e7a48d31b3bdb12464bff59

Download Submit
C:\Windows\System\GcBUgkV.exe

Filesize
2.2MB

MD5
574cbe3e52f8dd489257160902646ca1

SHA1
909a940656e7bd64911a12529e381caf12271d6f

SHA256
da6d795cf6bf0107e8d75cb1c26b65f2e69196ea8edf6c1f971dd308af2acdee

SHA512
834933f9e1b656de40dd2ec78aed67b2eebf797ab9918109f2deb0126af89b4c3cbdf96047f1102cb13a61947efed988de4b5e4b1cdd3713c6084864ed510d6c

Download Submit
C:\Windows\System\GywBKib.exe

Filesize
2.2MB

MD5
b6bf2a5e53b613f2c34b5ee6f14fabc6

SHA1
2d9a2f1b62ce42fcb93eb9a547271e06eb01da03

SHA256
1f46ba714d5a7327bdfa6d770b68d6d27c12b291cabbe8db97d4143c6b25f648

SHA512
7e099269a7d1ac7742ed03673c24bc5be1f7770511027197269fab3025a8df79c9e0905a2d4f41aad887564d7adb2f38756aff0b44976f549afd20a31f6eb98e

Download Submit
C:\Windows\System\Hrfgbif.exe

Filesize
2.2MB

MD5
8ac0e029177849807795e72c7b508bbf

SHA1
c55d295d6479fa190f4865b4d9a1cd676fff7f1a

SHA256
bc8fcbbe49b1a67e5158da5e53a4788e0748bc869f86074d306525b563588ea9

SHA512
33f1fc3ed2347dedd9843d46c94b6d124da39fed3fe2378c7c50096b1e22386b485ef225ed0d3dcc876235176adc3c034a960870d0d73f174f9aac95e7cb1191

Download Submit
C:\Windows\System\KerthrG.exe

Filesize
2.1MB

MD5
1c26d9628ab0e28b495d58f65a2853b3

SHA1
227b43b8224630ea6effce21f51f4d401159f0ea

SHA256
67c18955dc5880322606b2ae5c95ec644c5ac2144baafc1bfbcfb5d43ef9437b

SHA512
07d0d778313fced7167b18d5b49371455cebc1e3caf0cb5199d82edebbec48e24d892c7b77eef0bb194bdd7bb38b8068c3cd2c2790768d2297e059345e6e6280

Download Submit
C:\Windows\System\KvrxWPB.exe

Filesize
2.2MB

MD5
c71d21540bacade52c8aa7a485f2fcde

SHA1
c2b78d6d9a9c799562243dd35fd0c42db1623d85

SHA256
09a4d96c637f6a037df55d41e0f2032ab2eb81cb4dc1b38dc0285183577522af

SHA512
2ed1f010e1a8cdf8d5a3d516cc88685c040b762ffacda1000e08f07b706a98377bcc91dac8ccd6e247c7d8d9a8937ce1c6528f2b4b0b46cc17d34279bb8b8a08

Download Submit
C:\Windows\System\MCvGvmH.exe

Filesize
2.1MB

MD5
c1bca3caf38631f7480518fe6126af02

SHA1
876bcfd3db9058fc631b76755656caf6e618e56d

SHA256
661a833bbd3bfea4828fd26dffb02e187f21dc3e399b998484754b2e2b85c1d7

SHA512
feaa054cfef3e45f40ea987ef41a6a6836fa611636c45a8ee15dee41ba4a025b925bd557d7290d7d331cf1c3afbede7993f1ebf8535d070d831d94f60f2946cf

Download Submit
C:\Windows\System\RTNzFRr.exe

Filesize
2.2MB

MD5
e7d086c96c81c1d2307e3dbf61e30d73

SHA1
dfafddb1f729fab4aac57ac86b2233a5ab743b1d

SHA256
1671dae441672d74d41362638e7535dcba16d9c83d3275b700ef0c47075bad14

SHA512
4aa164d8bdcdc34cc4713a88651bd95fc5a88ee3a3705552c5afbe03631904dbe472f327b7e3479f547d5d0c8e75d817962a7ff4ffd723de689eac5ce12f776d

Download Submit
C:\Windows\System\VBhDonr.exe

Filesize
2.2MB

MD5
a55ac65ecef8731f205d6331f43879a2

SHA1
d433c26fbe682563e6a4cc73cc5c1bfc056a1619

SHA256
b54f44e631516993ccf43441e9d1a7d8c87b8e9ee13c403cefe170c1f730bdf8

SHA512
d2e3b46b59314a719a548e5b8fdd1f83eff3267302e710d3e348f3c4d658768a2de115e32ba6f8da82d0141a5a284b95801ad3055a9650cafa112618568b42e5

Download Submit
C:\Windows\System\VoOUrQm.exe

Filesize
2.2MB

MD5
1068cc6016b7a99db0180d44edaa7b42

SHA1
068a49e8d3fbdde657baf9d7e2637e11996840f9

SHA256
27f66c92986a8bcaf02c2e30d5998142f9310fb82434f1c866f7e0885d5a8199

SHA512
5a4a55bacd4f6bb9c3dcd0f88d101f62add087d615fcdd838c56b5298edd439102b229f97e21bd663fa1f687b6282fbd116929a307dcd6ad1f656736809a79a7

Download Submit
C:\Windows\System\ZIRXAAE.exe

Filesize
2.2MB

MD5
f343d202d0cf60bbba639efa691c6d69

SHA1
bb9a2c62d3e13de27d56ec8f62a052dca711fe4f

SHA256
50b11f69bb4ac4d0934302db82f2c7553187c3ec869ec48f32664776157b6c67

SHA512
6e09c2f4faf1cb29cd5f375b0445c798e9650a8ba8ad21d7cf8feca3e2771153d262ba68cade73985c67f0f489bf1ec5cbdd4b21e85395e4b0003b46aa789f64

Download Submit
C:\Windows\System\bGhvjDS.exe

Filesize
2.2MB

MD5
54aef5c60e02617d82635a9ebcb5f606

SHA1
be0d19270f2542da0e102cf85897dda23042b5aa

SHA256
3e0229aa2ee34724ed30de1b4a0ecebfd046af82d3c87b5fc0f7f7d1060c2bd4

SHA512
a15a398bf64588df90e5f962c1abaa5cfa43dc8ab3fa1043d1d629a8de5663547d1b41b3145d2e47d395177e954bfbfa5dc4ac4e2efe91b8ebee829dc55a0adc

Download Submit
C:\Windows\System\dFYhvGZ.exe

Filesize
2.2MB

MD5
a325014ce1de3ee727a37494c2049555

SHA1
4fbe792be859a55dc56f906f422bcb16e813b9e2

SHA256
e2f0b900151ea863ab7c557adc82061ddc3e1e4c00a2cd09b61e0750936964f3

SHA512
3a13b9fb2b1b222fa640b9964032b3896b8a0b5ec34bb185601c2a3d78f5d7ae45a8418376c47963f623454dff898a3658055db10628f729a22ceed405111497

Download Submit
C:\Windows\System\dHkjGFj.exe

Filesize
2.2MB

MD5
731342d453b71e8cbf97ede3d1355a3d

SHA1
fb3282d60e198828cbcf4207ea410b00e5ca5797

SHA256
c4ac1bb32fa28cbb0371ff1346adddcb30a762bdbff3ca0b907f818f7c2a8acf

SHA512
0e23342306a0492daf6dbc4e13c66a590c0edae63a8e03b77ec39fca4cb55b1f244d7a998bce8f0c8795dd2af0b531f36cae1cb2ef704a5877d5ce6c7b95590d

Download Submit
C:\Windows\System\dlEMixu.exe

Filesize
2.2MB

MD5
9e08d307324d03150c1f3f00236d6a4d

SHA1
6ca890e51bfb7d5bfb95419e396d811a772be4c3

SHA256
541f048b60848c2337e8db5a08fad884a01d80bc9b86e901eec576359b260e1c

SHA512
a01ddf5a47cfcb502f0ef36fc2d7c662dc9f24215b10a0569a685fee9823bbd1c6093eb9a66eabb8091765e5f42bb5cadc28e04865106d6ba010428d4e39a758

Download Submit
C:\Windows\System\eYQsCRC.exe

Filesize
2.2MB

MD5
061b882b036f0794ace6fe3ebabef3de

SHA1
1ecf2eae559a29b524a8bc4224065871a55e6b0d

SHA256
e335c965b367665a95ab3e56537f9c73cfaae16ccc43a5ddebc80e9d19d36997

SHA512
04ef7c2c52da841154d5d286c5fbada91d7ac0c02ad61a9bc613eb71b50aa39d8312f6f7bf9691655b34a982dfbb41e212570b1907ee43fa8ccf976f5c761225

Download Submit
C:\Windows\System\fKHyEHD.exe

Filesize
2.1MB

MD5
3292de0b8497e86b6982882fcd421bbc

SHA1
6009b0b7220048035c113a5a9da3c2ef0f38cbd4

SHA256
7416e92e9d6d30fd20d9ede21a8d3700b8e5efe5f67f88ee3f379be60ae7f517

SHA512
48076e2d1dd6b4911bcc2d326709eabee81ae634789a44ef01d41ad0ec07286dc6ccfac8f50512afea7ee9f51731cc6b4708b9e097390159e242f594ff789ea4

Download Submit
C:\Windows\System\fzGuyyZ.exe

Filesize
2.2MB

MD5
c55725ba5016ee800cd6b6c6febb723a

SHA1
117d9e8c775c607cf45b33b0898eb5bd13f39d10

SHA256
33325abb25e435c3d0090066f1fa6999be64e70fdaaeafbf4533de187b57a3c3

SHA512
fe6dcd293a043d00d94d6a843df3ade4b03e529cbf1a6c10c3c73ffa947f18a1ff6ddc2ce5fd3a05c55c9cdbbd94ce5a8e62606329086900dd31035697b3010d

Download Submit
C:\Windows\System\fzIkjca.exe

Filesize
2.2MB

MD5
4cad0f393b57dcaf5f0f0f08ff17a5c4

SHA1
0385617504e47cea9bae6a72017b999467673125

SHA256
9ae124248b59d093686c71273729927f30763d29fa4cc6b0768b07f163238662

SHA512
21d41bea335ff0bbd07b8dd47bb9bb84ff0d3a379893dd74d00bc423de7591b2d02dd73a04323be188591e330fbbf2b120fa6201fda9a09482893378e0c900b8

Download Submit
C:\Windows\System\jXYYuYq.exe

Filesize
2.2MB

MD5
f5b07bd7424cf1c191191e07cd17f94d

SHA1
76cd02c542db01715896b1e5f24d512490ceeee8

SHA256
7377111fce2f7d433d5c97b5eec03ed2893a1103aa59bd868fe48f87e573ce39

SHA512
b223b87a7da76d1472ff2b49453c5705604913dd6b5ccce0ae01b4f22511609559435ed5f4a646f3b8366a230eaeffde961fa459bfcdfb475eb252350549f4bd

Download Submit
C:\Windows\System\nPnyYJS.exe

Filesize
2.1MB

MD5
30c5b1e33f570afc729c2cba47c4e80f

SHA1
8ef9f876d9119121526a8df80bc6fc4ca0b09125

SHA256
3ed48b0d369fae1440d80fb8ecb9c72178cfb3df2caa2e99d5860c3d6c4b636d

SHA512
02e3729db8887e96084cb2a7bb87b64a1ead98da0aa889977c50d79471774504ce3cb073c41e9310017d163be7eb3a87cdc6b39136d9d23a1d7603627cf16811

Download Submit
C:\Windows\System\qYuEtVB.exe

Filesize
2.2MB

MD5
d8ff37cfe1fa2e3060cfadc30c1a07dd

SHA1
4f890f4c9681ab3d650e81513c31dce2f9925f04

SHA256
baee20d7166ac446a9fa571210e35e741c357956db777a9fa2c84a17eb80e453

SHA512
c85bc8087838c2a30aa7559e4d12f6b671877467ba8e5d131806ea3ed62ade3aae23017f0becb385adc97e0e0da5e81017070959c6c532d42635e279b7f6ce13

Download Submit
C:\Windows\System\qhcIISg.exe

Filesize
2.2MB

MD5
5b98e71e101e5a41dc200f9d650d87dc

SHA1
a7904801ce3b380774b038ce2317b3d03dccf9f1

SHA256
f1ec8f1aa97dbf7f7c2cf7de5fb1cf7305b8ebcbeb6cc83c6310bf583ddc60ea

SHA512
58bcc1b904a6ddb7529b3d97aeee6dd627b93dd16625070c8d19a9e96c59670babc75eba0631ed4e6cb45b7529bf01866b91b5c2d14220549c0f175777db74af

Download Submit
C:\Windows\System\sUJRakL.exe

Filesize
2.2MB

MD5
7657fd6d7c8778d1b288e8d576fddd9d

SHA1
ea9ece305d4ec27c6f70c19abbaa43c4757f174a

SHA256
edae62496337bb01c672d9d403e6d28b47dfb55fe4a2ef228a62d26ba73fc37b

SHA512
698bbc1b38e049e9131c558abc5d30783c06f14767f44066ebd13248f17fc2f495d78736d1ceb5d58c3770e22902a2ef9c51edd0eff16c8769b460fdfbbfd393

Download Submit
C:\Windows\System\tSpVhYj.exe

Filesize
2.1MB

MD5
321d27f798aaab6f32df8e2db9521dde

SHA1
8d115bb977f6a1d5e007a0508550aae61ab93d36

SHA256
b979af14dec849ccd8b6c12fba231f09cbc5dd26d8fd60602256071c777aae1b

SHA512
6b34203f9f8ee14ced0a7699e5d575068fc0b4b22449127fe8da862620679892a30a60f7c2f795e82ff6e906ca8cfb515eeda94c7752d192e5d3f68779c6e848

Download Submit
C:\Windows\System\uUjMKdv.exe

Filesize
2.2MB

MD5
de60e7c60cc818df09ce7d82abe8098c

SHA1
6f1ced950e181444aeca7b6a04fc5f7895990af3

SHA256
816509ed22f13dd3f5f5c0db384c0f3073231c6bc590c91e15a53110e674911e

SHA512
90fc101649def62755731b3f335141a6f81eafe1a97c96351aeab6474edf3a7ac9c5f642c2fbd4f25163dd6044c93f69304b8563bd664f543b968398ba375069

Download Submit
C:\Windows\System\vAXHzOQ.exe

Filesize
2.2MB

MD5
95f56a0538e0e353e79a77c9aadcb58b

SHA1
c3e995b1599e039ee41cb7d95305f063d57db40c

SHA256
65a8256905438e1c1049ce1ce3a44292d0bf739dfd4d68dd8b96d5204d2334dc

SHA512
2a7e0f2d4a6e63a463c8a867e2ef71d5935e61cd1e042938df1998350fb96ad32fd0265c01521b498c754c1667d827886b209a7a9ba3c29d9746b4a371b86da0

Download Submit
C:\Windows\System\wDejatu.exe

Filesize
2.2MB

MD5
57d4eeb1806c978dd52f235007343b55

SHA1
85f84d3eb4cb10ee82f16747424ac5da97e95fee

SHA256
d1d151b886c1e83bd85569950f9c718cab40fe5788329f0f72a07572a8cf1fc9

SHA512
72f0c886cac62eecb116663dfa3f6cfba7eec05a53ba4bfca44554fe9574380f705403ee974d45925e6fc425ee5b3d085d30f9a2e3acba20da232d2bd0f5ef66

Download Submit
C:\Windows\System\yKsoLTW.exe

Filesize
2.2MB

MD5
2473bc20bdc86d44dd88139e72b35183

SHA1
740df5da11b4ee446fe0a4d40bc720d2d0b6bf2b

SHA256
997a65bedb8d3729427324c09338ebe4e28c6e77e8858f16589f89536f8aa852

SHA512
153ff65230af36abb1ad6bc80a57097411a766f65956186df49f57f9086eedfb1d9b138c235051bc37a1d7b7c50617e7204cf2af9ea2905a7c76af0974d2585f

Download Submit
memory/440-2140-0x00007FF7F0A40000-0x00007FF7F0D94000-memory.dmp

Filesize
3.3MB

Download
memory/440-165-0x00007FF7F0A40000-0x00007FF7F0D94000-memory.dmp

Filesize
3.3MB

Download
memory/488-2152-0x00007FF66A550000-0x00007FF66A8A4000-memory.dmp

Filesize
3.3MB

Download
memory/488-134-0x00007FF66A550000-0x00007FF66A8A4000-memory.dmp

Filesize
3.3MB

Download
memory/652-2129-0x00007FF664BF0000-0x00007FF664F44000-memory.dmp

Filesize
3.3MB

Download
memory/652-2149-0x00007FF664BF0000-0x00007FF664F44000-memory.dmp

Filesize
3.3MB

Download
memory/652-120-0x00007FF664BF0000-0x00007FF664F44000-memory.dmp

Filesize
3.3MB

Download
memory/772-69-0x00007FF72EB60000-0x00007FF72EEB4000-memory.dmp

Filesize
3.3MB

Download
memory/772-2138-0x00007FF72EB60000-0x00007FF72EEB4000-memory.dmp

Filesize
3.3MB

Download
memory/844-147-0x00007FF7D3780000-0x00007FF7D3AD4000-memory.dmp

Filesize
3.3MB

Download
memory/844-2151-0x00007FF7D3780000-0x00007FF7D3AD4000-memory.dmp

Filesize
3.3MB

Download
memory/1128-133-0x00007FF75EC40000-0x00007FF75EF94000-memory.dmp

Filesize
3.3MB

Download
memory/1128-2130-0x00007FF75EC40000-0x00007FF75EF94000-memory.dmp

Filesize
3.3MB

Download
memory/1128-2141-0x00007FF75EC40000-0x00007FF75EF94000-memory.dmp

Filesize
3.3MB

Download
memory/1132-2150-0x00007FF6B1110000-0x00007FF6B1464000-memory.dmp

Filesize
3.3MB

Download
memory/1132-2127-0x00007FF6B1110000-0x00007FF6B1464000-memory.dmp

Filesize
3.3MB

Download
memory/1132-66-0x00007FF6B1110000-0x00007FF6B1464000-memory.dmp

Filesize
3.3MB

Download
memory/1212-2134-0x00007FF7D23E0000-0x00007FF7D2734000-memory.dmp

Filesize
3.3MB

Download
memory/1212-51-0x00007FF7D23E0000-0x00007FF7D2734000-memory.dmp

Filesize
3.3MB

Download
memory/1392-2146-0x00007FF7EEF50000-0x00007FF7EF2A4000-memory.dmp

Filesize
3.3MB

Download
memory/1392-166-0x00007FF7EEF50000-0x00007FF7EF2A4000-memory.dmp

Filesize
3.3MB

Download
memory/1540-2124-0x00007FF7FC0F0000-0x00007FF7FC444000-memory.dmp

Filesize
3.3MB

Download
memory/1540-0-0x00007FF7FC0F0000-0x00007FF7FC444000-memory.dmp

Filesize
3.3MB

Download
memory/1540-1-0x00000203666E0000-0x00000203666F0000-memory.dmp

Filesize
64KB

Download
memory/2132-2143-0x00007FF7F0C80000-0x00007FF7F0FD4000-memory.dmp

Filesize
3.3MB

Download
memory/2132-2128-0x00007FF7F0C80000-0x00007FF7F0FD4000-memory.dmp

Filesize
3.3MB

Download
memory/2132-91-0x00007FF7F0C80000-0x00007FF7F0FD4000-memory.dmp

Filesize
3.3MB

Download
memory/2400-154-0x00007FF71A7D0000-0x00007FF71AB24000-memory.dmp

Filesize
3.3MB

Download
memory/2400-2147-0x00007FF71A7D0000-0x00007FF71AB24000-memory.dmp

Filesize
3.3MB

Download
memory/2448-153-0x00007FF6FE020000-0x00007FF6FE374000-memory.dmp

Filesize
3.3MB

Download
memory/2448-2148-0x00007FF6FE020000-0x00007FF6FE374000-memory.dmp

Filesize
3.3MB

Download
memory/2644-2135-0x00007FF6BC9E0000-0x00007FF6BCD34000-memory.dmp

Filesize
3.3MB

Download
memory/2644-162-0x00007FF6BC9E0000-0x00007FF6BCD34000-memory.dmp

Filesize
3.3MB

Download
memory/3636-2136-0x00007FF732E10000-0x00007FF733164000-memory.dmp

Filesize
3.3MB

Download
memory/3636-2126-0x00007FF732E10000-0x00007FF733164000-memory.dmp

Filesize
3.3MB

Download
memory/3636-33-0x00007FF732E10000-0x00007FF733164000-memory.dmp

Filesize
3.3MB

Download
memory/3912-167-0x00007FF79AEC0000-0x00007FF79B214000-memory.dmp

Filesize
3.3MB

Download
memory/3912-2144-0x00007FF79AEC0000-0x00007FF79B214000-memory.dmp

Filesize
3.3MB

Download
memory/3944-158-0x00007FF63FC00000-0x00007FF63FF54000-memory.dmp

Filesize
3.3MB

Download
memory/3944-2156-0x00007FF63FC00000-0x00007FF63FF54000-memory.dmp

Filesize
3.3MB

Download
memory/4196-13-0x00007FF78BF90000-0x00007FF78C2E4000-memory.dmp

Filesize
3.3MB

Download
memory/4196-2123-0x00007FF78BF90000-0x00007FF78C2E4000-memory.dmp

Filesize
3.3MB

Download
memory/4196-2132-0x00007FF78BF90000-0x00007FF78C2E4000-memory.dmp

Filesize
3.3MB

Download
memory/4296-2139-0x00007FF62A800000-0x00007FF62AB54000-memory.dmp

Filesize
3.3MB

Download
memory/4296-164-0x00007FF62A800000-0x00007FF62AB54000-memory.dmp

Filesize
3.3MB

Download
memory/4396-2160-0x00007FF7BDCB0000-0x00007FF7BE004000-memory.dmp

Filesize
3.3MB

Download
memory/4396-2131-0x00007FF7BDCB0000-0x00007FF7BE004000-memory.dmp

Filesize
3.3MB

Download
memory/4396-184-0x00007FF7BDCB0000-0x00007FF7BE004000-memory.dmp

Filesize
3.3MB

Download
memory/4560-168-0x00007FF6FDF30000-0x00007FF6FE284000-memory.dmp

Filesize
3.3MB

Download
memory/4560-2142-0x00007FF6FDF30000-0x00007FF6FE284000-memory.dmp

Filesize
3.3MB

Download
memory/4616-2158-0x00007FF7256D0000-0x00007FF725A24000-memory.dmp

Filesize
3.3MB

Download
memory/4616-161-0x00007FF7256D0000-0x00007FF725A24000-memory.dmp

Filesize
3.3MB

Download
memory/4620-2145-0x00007FF680E90000-0x00007FF6811E4000-memory.dmp

Filesize
3.3MB

Download
memory/4620-122-0x00007FF680E90000-0x00007FF6811E4000-memory.dmp

Filesize
3.3MB

Download
memory/4632-2153-0x00007FF6E3D00000-0x00007FF6E4054000-memory.dmp

Filesize
3.3MB

Download
memory/4632-160-0x00007FF6E3D00000-0x00007FF6E4054000-memory.dmp

Filesize
3.3MB

Download
memory/4872-2133-0x00007FF6D0060000-0x00007FF6D03B4000-memory.dmp

Filesize
3.3MB

Download
memory/4872-29-0x00007FF6D0060000-0x00007FF6D03B4000-memory.dmp

Filesize
3.3MB

Download
memory/4872-2125-0x00007FF6D0060000-0x00007FF6D03B4000-memory.dmp

Filesize
3.3MB

Download
memory/4908-170-0x00007FF775CC0000-0x00007FF776014000-memory.dmp

Filesize
3.3MB

Download
memory/4908-2159-0x00007FF775CC0000-0x00007FF776014000-memory.dmp

Filesize
3.3MB

Download
memory/4972-163-0x00007FF7EC1B0000-0x00007FF7EC504000-memory.dmp

Filesize
3.3MB

Download
memory/4972-2137-0x00007FF7EC1B0000-0x00007FF7EC504000-memory.dmp

Filesize
3.3MB

Download
memory/5020-2155-0x00007FF694A30000-0x00007FF694D84000-memory.dmp

Filesize
3.3MB

Download
memory/5020-159-0x00007FF694A30000-0x00007FF694D84000-memory.dmp

Filesize
3.3MB

Download
memory/5048-2154-0x00007FF753B20000-0x00007FF753E74000-memory.dmp

Filesize
3.3MB

Download
memory/5048-157-0x00007FF753B20000-0x00007FF753E74000-memory.dmp

Filesize
3.3MB

Download
memory/5052-169-0x00007FF7484A0000-0x00007FF7487F4000-memory.dmp

Filesize
3.3MB

Download
memory/5052-2157-0x00007FF7484A0000-0x00007FF7487F4000-memory.dmp

Filesize
3.3MB

Download