xmrig | 0301384a95fe014a33bf42d4396b23da2ba4cf847b2cc15cd25f35459c43b7b2

Analysis

max time kernel
104s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
Size

2.2MB
MD5

25a595846031fdefe8dab6f19bb3c590
SHA1

da4068fdb0dd886009bcf69021bf752ff8c3bca4
SHA256

0301384a95fe014a33bf42d4396b23da2ba4cf847b2cc15cd25f35459c43b7b2
SHA512

22ee4583ad105dc1232d2d16f3fd27de6363bcc65a0b9b34aa5f331c30be8a6c8c56f237a7ca4f6b59c278526163252676552e2319c240f15c93c9670eacb36b
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQW/zFdDlhw3XjI:oemTLkNdfE0pZrQQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3696-0-0x00007FF63F1F0000-0x00007FF63F544000-memory.dmp	xmrig
behavioral2/files/0x0007000000023381-5.dat	xmrig
behavioral2/memory/1012-7-0x00007FF7CC150000-0x00007FF7CC4A4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023539-9.dat	xmrig
behavioral2/files/0x000a000000023532-12.dat	xmrig
behavioral2/memory/4068-14-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	xmrig
behavioral2/memory/2540-19-0x00007FF6C4310000-0x00007FF6C4664000-memory.dmp	xmrig
behavioral2/files/0x000700000002353a-23.dat	xmrig
behavioral2/files/0x000700000002353b-34.dat	xmrig
behavioral2/files/0x000700000002353c-36.dat	xmrig
behavioral2/files/0x000700000002353d-44.dat	xmrig
behavioral2/files/0x000700000002353f-49.dat	xmrig
behavioral2/files/0x0007000000023540-59.dat	xmrig
behavioral2/files/0x0007000000023542-68.dat	xmrig
behavioral2/files/0x0007000000023543-74.dat	xmrig
behavioral2/files/0x0007000000023545-84.dat	xmrig
behavioral2/files/0x000700000002354c-119.dat	xmrig
behavioral2/files/0x000700000002354f-134.dat	xmrig
behavioral2/memory/5072-637-0x00007FF61F290000-0x00007FF61F5E4000-memory.dmp	xmrig
behavioral2/memory/4200-639-0x00007FF6456C0000-0x00007FF645A14000-memory.dmp	xmrig
behavioral2/memory/2984-638-0x00007FF7A0710000-0x00007FF7A0A64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023557-168.dat	xmrig
behavioral2/files/0x0007000000023556-165.dat	xmrig
behavioral2/files/0x0007000000023555-161.dat	xmrig
behavioral2/files/0x0007000000023554-158.dat	xmrig
behavioral2/files/0x0007000000023553-154.dat	xmrig
behavioral2/files/0x0007000000023552-149.dat	xmrig
behavioral2/files/0x0007000000023551-144.dat	xmrig
behavioral2/files/0x0007000000023550-139.dat	xmrig
behavioral2/files/0x000700000002354e-129.dat	xmrig
behavioral2/files/0x000700000002354d-123.dat	xmrig
behavioral2/files/0x000700000002354b-114.dat	xmrig
behavioral2/memory/5012-640-0x00007FF633890000-0x00007FF633BE4000-memory.dmp	xmrig
behavioral2/files/0x000700000002354a-109.dat	xmrig
behavioral2/memory/4016-641-0x00007FF62C7C0000-0x00007FF62CB14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023549-103.dat	xmrig
behavioral2/files/0x0007000000023548-99.dat	xmrig
behavioral2/memory/5052-648-0x00007FF7B11A0000-0x00007FF7B14F4000-memory.dmp	xmrig
behavioral2/memory/2752-663-0x00007FF6124D0000-0x00007FF612824000-memory.dmp	xmrig
behavioral2/memory/4420-684-0x00007FF6A4360000-0x00007FF6A46B4000-memory.dmp	xmrig
behavioral2/memory/4504-681-0x00007FF6576C0000-0x00007FF657A14000-memory.dmp	xmrig
behavioral2/memory/3200-693-0x00007FF7CD3C0000-0x00007FF7CD714000-memory.dmp	xmrig
behavioral2/memory/3096-711-0x00007FF6DE100000-0x00007FF6DE454000-memory.dmp	xmrig
behavioral2/memory/3848-709-0x00007FF668F90000-0x00007FF6692E4000-memory.dmp	xmrig
behavioral2/memory/2832-712-0x00007FF637210000-0x00007FF637564000-memory.dmp	xmrig
behavioral2/memory/64-718-0x00007FF64BBD0000-0x00007FF64BF24000-memory.dmp	xmrig
behavioral2/memory/3676-726-0x00007FF7FDEB0000-0x00007FF7FE204000-memory.dmp	xmrig
behavioral2/memory/1732-719-0x00007FF6977B0000-0x00007FF697B04000-memory.dmp	xmrig
behavioral2/memory/2728-717-0x00007FF6A3790000-0x00007FF6A3AE4000-memory.dmp	xmrig
behavioral2/memory/3968-706-0x00007FF615890000-0x00007FF615BE4000-memory.dmp	xmrig
behavioral2/memory/2392-704-0x00007FF6C1290000-0x00007FF6C15E4000-memory.dmp	xmrig
behavioral2/memory/4856-690-0x00007FF680CE0000-0x00007FF681034000-memory.dmp	xmrig
behavioral2/memory/4448-678-0x00007FF7003A0000-0x00007FF7006F4000-memory.dmp	xmrig
behavioral2/memory/4692-677-0x00007FF610E50000-0x00007FF6111A4000-memory.dmp	xmrig
behavioral2/memory/4616-673-0x00007FF6A6E00000-0x00007FF6A7154000-memory.dmp	xmrig
behavioral2/memory/1560-657-0x00007FF6828D0000-0x00007FF682C24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023547-94.dat	xmrig
behavioral2/files/0x0007000000023546-89.dat	xmrig
behavioral2/files/0x0007000000023544-78.dat	xmrig
behavioral2/files/0x0007000000023541-64.dat	xmrig
behavioral2/files/0x000700000002353e-48.dat	xmrig
behavioral2/memory/3956-32-0x00007FF6AE8F0000-0x00007FF6AEC44000-memory.dmp	xmrig
behavioral2/memory/540-29-0x00007FF6578E0000-0x00007FF657C34000-memory.dmp	xmrig
behavioral2/memory/3696-2014-0x00007FF63F1F0000-0x00007FF63F544000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1012	MiySpbt.exe
4068	QHqDTVy.exe
2540	ZyhUPXl.exe
540	QfSDaXW.exe
3956	hXqBLDB.exe
5072	bsDGTdQ.exe
3676	HusLsdL.exe
2984	DxwIqzs.exe
4200	KnJoKhx.exe
5012	WAgVkii.exe
4016	dHchBAx.exe
5052	QrCHiHN.exe
1560	FdplWOq.exe
2752	uIkWAdP.exe
4616	rkmrsnG.exe
4692	MMbFxoG.exe
4448	YnbdgSY.exe
4504	jhLlNSy.exe
4420	pNXipNe.exe
4856	QGIEbdi.exe
3200	mgjZORp.exe
2392	dUMuEWH.exe
3968	uqEgAWX.exe
3848	oCAjpBO.exe
3096	EfTuOcg.exe
2832	yvNNaUH.exe
2728	xLWwJDD.exe
64	jMvsdvp.exe
1732	YUQvINz.exe
1912	DTJbHVg.exe
3236	GnTMbTG.exe
1492	QKPwSvl.exe
1740	FFsCBVP.exe
1364	gcIdJnN.exe
3744	mzVUuak.exe
4048	nIWDHGO.exe
340	qQwNpOt.exe
5064	sxJcOFA.exe
3432	diDvKRK.exe
4180	ddAYnuK.exe
4216	XNKuKcU.exe
4580	CyXiOQn.exe
2080	NTuKyVJ.exe
3608	YTRiZmH.exe
4632	WwQwbdY.exe
808	gQnalqK.exe
3652	CiVDwuM.exe
3204	CoNGlqS.exe
4104	UAIeJFt.exe
4536	QuwvKla.exe
692	UfxXBqK.exe
3256	PjBauWD.exe
1580	aZSNhUH.exe
4592	JkDJoKf.exe
1556	ZiYahHQ.exe
2056	DiEzSdo.exe
3884	RroopKT.exe
2884	tbUxMRM.exe
2948	DaYEujN.exe
4568	gSGjjNT.exe
3944	KEyrReR.exe
1816	HLDkUqe.exe
4272	dsyBwKJ.exe
1088	NiyRbCL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3696-0-0x00007FF63F1F0000-0x00007FF63F544000-memory.dmp	upx
behavioral2/files/0x0007000000023381-5.dat	upx
behavioral2/memory/1012-7-0x00007FF7CC150000-0x00007FF7CC4A4000-memory.dmp	upx
behavioral2/files/0x0008000000023539-9.dat	upx
behavioral2/files/0x000a000000023532-12.dat	upx
behavioral2/memory/4068-14-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	upx
behavioral2/memory/2540-19-0x00007FF6C4310000-0x00007FF6C4664000-memory.dmp	upx
behavioral2/files/0x000700000002353a-23.dat	upx
behavioral2/files/0x000700000002353b-34.dat	upx
behavioral2/files/0x000700000002353c-36.dat	upx
behavioral2/files/0x000700000002353d-44.dat	upx
behavioral2/files/0x000700000002353f-49.dat	upx
behavioral2/files/0x0007000000023540-59.dat	upx
behavioral2/files/0x0007000000023542-68.dat	upx
behavioral2/files/0x0007000000023543-74.dat	upx
behavioral2/files/0x0007000000023545-84.dat	upx
behavioral2/files/0x000700000002354c-119.dat	upx
behavioral2/files/0x000700000002354f-134.dat	upx
behavioral2/memory/5072-637-0x00007FF61F290000-0x00007FF61F5E4000-memory.dmp	upx
behavioral2/memory/4200-639-0x00007FF6456C0000-0x00007FF645A14000-memory.dmp	upx
behavioral2/memory/2984-638-0x00007FF7A0710000-0x00007FF7A0A64000-memory.dmp	upx
behavioral2/files/0x0007000000023557-168.dat	upx
behavioral2/files/0x0007000000023556-165.dat	upx
behavioral2/files/0x0007000000023555-161.dat	upx
behavioral2/files/0x0007000000023554-158.dat	upx
behavioral2/files/0x0007000000023553-154.dat	upx
behavioral2/files/0x0007000000023552-149.dat	upx
behavioral2/files/0x0007000000023551-144.dat	upx
behavioral2/files/0x0007000000023550-139.dat	upx
behavioral2/files/0x000700000002354e-129.dat	upx
behavioral2/files/0x000700000002354d-123.dat	upx
behavioral2/files/0x000700000002354b-114.dat	upx
behavioral2/memory/5012-640-0x00007FF633890000-0x00007FF633BE4000-memory.dmp	upx
behavioral2/files/0x000700000002354a-109.dat	upx
behavioral2/memory/4016-641-0x00007FF62C7C0000-0x00007FF62CB14000-memory.dmp	upx
behavioral2/files/0x0007000000023549-103.dat	upx
behavioral2/files/0x0007000000023548-99.dat	upx
behavioral2/memory/5052-648-0x00007FF7B11A0000-0x00007FF7B14F4000-memory.dmp	upx
behavioral2/memory/2752-663-0x00007FF6124D0000-0x00007FF612824000-memory.dmp	upx
behavioral2/memory/4420-684-0x00007FF6A4360000-0x00007FF6A46B4000-memory.dmp	upx
behavioral2/memory/4504-681-0x00007FF6576C0000-0x00007FF657A14000-memory.dmp	upx
behavioral2/memory/3200-693-0x00007FF7CD3C0000-0x00007FF7CD714000-memory.dmp	upx
behavioral2/memory/3096-711-0x00007FF6DE100000-0x00007FF6DE454000-memory.dmp	upx
behavioral2/memory/3848-709-0x00007FF668F90000-0x00007FF6692E4000-memory.dmp	upx
behavioral2/memory/2832-712-0x00007FF637210000-0x00007FF637564000-memory.dmp	upx
behavioral2/memory/64-718-0x00007FF64BBD0000-0x00007FF64BF24000-memory.dmp	upx
behavioral2/memory/3676-726-0x00007FF7FDEB0000-0x00007FF7FE204000-memory.dmp	upx
behavioral2/memory/1732-719-0x00007FF6977B0000-0x00007FF697B04000-memory.dmp	upx
behavioral2/memory/2728-717-0x00007FF6A3790000-0x00007FF6A3AE4000-memory.dmp	upx
behavioral2/memory/3968-706-0x00007FF615890000-0x00007FF615BE4000-memory.dmp	upx
behavioral2/memory/2392-704-0x00007FF6C1290000-0x00007FF6C15E4000-memory.dmp	upx
behavioral2/memory/4856-690-0x00007FF680CE0000-0x00007FF681034000-memory.dmp	upx
behavioral2/memory/4448-678-0x00007FF7003A0000-0x00007FF7006F4000-memory.dmp	upx
behavioral2/memory/4692-677-0x00007FF610E50000-0x00007FF6111A4000-memory.dmp	upx
behavioral2/memory/4616-673-0x00007FF6A6E00000-0x00007FF6A7154000-memory.dmp	upx
behavioral2/memory/1560-657-0x00007FF6828D0000-0x00007FF682C24000-memory.dmp	upx
behavioral2/files/0x0007000000023547-94.dat	upx
behavioral2/files/0x0007000000023546-89.dat	upx
behavioral2/files/0x0007000000023544-78.dat	upx
behavioral2/files/0x0007000000023541-64.dat	upx
behavioral2/files/0x000700000002353e-48.dat	upx
behavioral2/memory/3956-32-0x00007FF6AE8F0000-0x00007FF6AEC44000-memory.dmp	upx
behavioral2/memory/540-29-0x00007FF6578E0000-0x00007FF657C34000-memory.dmp	upx
behavioral2/memory/3696-2014-0x00007FF63F1F0000-0x00007FF63F544000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XNKWVOC.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\XwvIFLC.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\ZalVaGy.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\oCAjpBO.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\GrDKVUJ.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\WkifRpn.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\nuvVLdM.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\FYvGhcI.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\NTnXvpV.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\CtYKVfB.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\cGmJdHb.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\uqEgAWX.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\HLDkUqe.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\lcyKoTP.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\bqIZCHc.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\iRFQhJE.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\mgjZORp.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\rntMQxN.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\DBXALgx.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\emMiCoj.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\IXWkkPk.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\fDLaWEz.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\GehcmNg.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\ZZUkYvo.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\jMtVUdg.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\drjvZdb.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\vTwCrrB.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\EKBkrwX.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\kMDCrEg.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\JoMSBgb.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\MiySpbt.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\nLdcSaq.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\thXqHpa.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\mQPojzv.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\dsyBwKJ.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\kpWTmNx.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\PplPtOP.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\dBdHYRz.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\rOgxwpS.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\SGmWkPS.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\DVMQcoH.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\yfDASwn.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\XkjXVKc.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\agyFBKi.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\ELSXcud.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\AoBMALL.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\JTYbDSq.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\yNCwbVU.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\uOZQOYw.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\pbKYRoG.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\cUKGlUt.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\sYQqEMB.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\SMGhIDm.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\sFCfrNN.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\vfNExrK.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\kkAxSxN.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\ShwqvWC.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\vqLbKHU.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\RrBpoLU.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\jMvsdvp.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\EXhfJjG.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\YSTRSSL.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\FoXFEbR.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
File created	C:\Windows\System\xpmQUjx.exe	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 1012	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	81
PID 3696 wrote to memory of 1012	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	81
PID 3696 wrote to memory of 4068	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	82
PID 3696 wrote to memory of 4068	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	82
PID 3696 wrote to memory of 2540	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	83
PID 3696 wrote to memory of 2540	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	83
PID 3696 wrote to memory of 540	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	84
PID 3696 wrote to memory of 540	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	84
PID 3696 wrote to memory of 3956	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	85
PID 3696 wrote to memory of 3956	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	85
PID 3696 wrote to memory of 5072	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	86
PID 3696 wrote to memory of 5072	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	86
PID 3696 wrote to memory of 3676	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	87
PID 3696 wrote to memory of 3676	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	87
PID 3696 wrote to memory of 2984	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	88
PID 3696 wrote to memory of 2984	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	88
PID 3696 wrote to memory of 4200	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	89
PID 3696 wrote to memory of 4200	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	89
PID 3696 wrote to memory of 5012	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	90
PID 3696 wrote to memory of 5012	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	90
PID 3696 wrote to memory of 4016	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	91
PID 3696 wrote to memory of 4016	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	91
PID 3696 wrote to memory of 5052	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	92
PID 3696 wrote to memory of 5052	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	92
PID 3696 wrote to memory of 1560	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	93
PID 3696 wrote to memory of 1560	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	93
PID 3696 wrote to memory of 2752	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	94
PID 3696 wrote to memory of 2752	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	94
PID 3696 wrote to memory of 4616	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	95
PID 3696 wrote to memory of 4616	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	95
PID 3696 wrote to memory of 4692	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	96
PID 3696 wrote to memory of 4692	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	96
PID 3696 wrote to memory of 4448	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	97
PID 3696 wrote to memory of 4448	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	97
PID 3696 wrote to memory of 4504	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	98
PID 3696 wrote to memory of 4504	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	98
PID 3696 wrote to memory of 4420	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	99
PID 3696 wrote to memory of 4420	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	99
PID 3696 wrote to memory of 4856	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	100
PID 3696 wrote to memory of 4856	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	100
PID 3696 wrote to memory of 3200	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	101
PID 3696 wrote to memory of 3200	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	101
PID 3696 wrote to memory of 2392	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	102
PID 3696 wrote to memory of 2392	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	102
PID 3696 wrote to memory of 3968	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	103
PID 3696 wrote to memory of 3968	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	103
PID 3696 wrote to memory of 3848	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	104
PID 3696 wrote to memory of 3848	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	104
PID 3696 wrote to memory of 3096	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	105
PID 3696 wrote to memory of 3096	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	105
PID 3696 wrote to memory of 2832	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	106
PID 3696 wrote to memory of 2832	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	106
PID 3696 wrote to memory of 2728	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	107
PID 3696 wrote to memory of 2728	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	107
PID 3696 wrote to memory of 64	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	108
PID 3696 wrote to memory of 64	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	108
PID 3696 wrote to memory of 1732	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	109
PID 3696 wrote to memory of 1732	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	109
PID 3696 wrote to memory of 1912	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	110
PID 3696 wrote to memory of 1912	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	110
PID 3696 wrote to memory of 3236	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	111
PID 3696 wrote to memory of 3236	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	111
PID 3696 wrote to memory of 1492	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	112
PID 3696 wrote to memory of 1492	3696	25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe	112

C:\Users\Admin\AppData\Local\Temp\25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\25a595846031fdefe8dab6f19bb3c590_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\System\MiySpbt.exe
  C:\Windows\System\MiySpbt.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\QHqDTVy.exe
  C:\Windows\System\QHqDTVy.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\ZyhUPXl.exe
  C:\Windows\System\ZyhUPXl.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\QfSDaXW.exe
  C:\Windows\System\QfSDaXW.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\hXqBLDB.exe
  C:\Windows\System\hXqBLDB.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\bsDGTdQ.exe
  C:\Windows\System\bsDGTdQ.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\HusLsdL.exe
  C:\Windows\System\HusLsdL.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\DxwIqzs.exe
  C:\Windows\System\DxwIqzs.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\KnJoKhx.exe
  C:\Windows\System\KnJoKhx.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\WAgVkii.exe
  C:\Windows\System\WAgVkii.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\dHchBAx.exe
  C:\Windows\System\dHchBAx.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\QrCHiHN.exe
  C:\Windows\System\QrCHiHN.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\FdplWOq.exe
  C:\Windows\System\FdplWOq.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\uIkWAdP.exe
  C:\Windows\System\uIkWAdP.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\rkmrsnG.exe
  C:\Windows\System\rkmrsnG.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\MMbFxoG.exe
  C:\Windows\System\MMbFxoG.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\YnbdgSY.exe
  C:\Windows\System\YnbdgSY.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\jhLlNSy.exe
  C:\Windows\System\jhLlNSy.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\pNXipNe.exe
  C:\Windows\System\pNXipNe.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\QGIEbdi.exe
  C:\Windows\System\QGIEbdi.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\mgjZORp.exe
  C:\Windows\System\mgjZORp.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\dUMuEWH.exe
  C:\Windows\System\dUMuEWH.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\uqEgAWX.exe
  C:\Windows\System\uqEgAWX.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\oCAjpBO.exe
  C:\Windows\System\oCAjpBO.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\EfTuOcg.exe
  C:\Windows\System\EfTuOcg.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\yvNNaUH.exe
  C:\Windows\System\yvNNaUH.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\xLWwJDD.exe
  C:\Windows\System\xLWwJDD.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\jMvsdvp.exe
  C:\Windows\System\jMvsdvp.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\YUQvINz.exe
  C:\Windows\System\YUQvINz.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\DTJbHVg.exe
  C:\Windows\System\DTJbHVg.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\GnTMbTG.exe
  C:\Windows\System\GnTMbTG.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\QKPwSvl.exe
  C:\Windows\System\QKPwSvl.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\FFsCBVP.exe
  C:\Windows\System\FFsCBVP.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\gcIdJnN.exe
  C:\Windows\System\gcIdJnN.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\mzVUuak.exe
  C:\Windows\System\mzVUuak.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\nIWDHGO.exe
  C:\Windows\System\nIWDHGO.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\qQwNpOt.exe
  C:\Windows\System\qQwNpOt.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\sxJcOFA.exe
  C:\Windows\System\sxJcOFA.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\diDvKRK.exe
  C:\Windows\System\diDvKRK.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\ddAYnuK.exe
  C:\Windows\System\ddAYnuK.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\XNKuKcU.exe
  C:\Windows\System\XNKuKcU.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\CyXiOQn.exe
  C:\Windows\System\CyXiOQn.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\NTuKyVJ.exe
  C:\Windows\System\NTuKyVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\YTRiZmH.exe
  C:\Windows\System\YTRiZmH.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\WwQwbdY.exe
  C:\Windows\System\WwQwbdY.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\gQnalqK.exe
  C:\Windows\System\gQnalqK.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\CiVDwuM.exe
  C:\Windows\System\CiVDwuM.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\CoNGlqS.exe
  C:\Windows\System\CoNGlqS.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\UAIeJFt.exe
  C:\Windows\System\UAIeJFt.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\QuwvKla.exe
  C:\Windows\System\QuwvKla.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\UfxXBqK.exe
  C:\Windows\System\UfxXBqK.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\PjBauWD.exe
  C:\Windows\System\PjBauWD.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\aZSNhUH.exe
  C:\Windows\System\aZSNhUH.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\JkDJoKf.exe
  C:\Windows\System\JkDJoKf.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\ZiYahHQ.exe
  C:\Windows\System\ZiYahHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\DiEzSdo.exe
  C:\Windows\System\DiEzSdo.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\RroopKT.exe
  C:\Windows\System\RroopKT.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\tbUxMRM.exe
  C:\Windows\System\tbUxMRM.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\DaYEujN.exe
  C:\Windows\System\DaYEujN.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\gSGjjNT.exe
  C:\Windows\System\gSGjjNT.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\KEyrReR.exe
  C:\Windows\System\KEyrReR.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\HLDkUqe.exe
  C:\Windows\System\HLDkUqe.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\dsyBwKJ.exe
  C:\Windows\System\dsyBwKJ.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\NiyRbCL.exe
  C:\Windows\System\NiyRbCL.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\SeSYMRB.exe
  C:\Windows\System\SeSYMRB.exe
  2⤵
  PID:4428
- C:\Windows\System\faqUzFq.exe
  C:\Windows\System\faqUzFq.exe
  2⤵
  PID:1048
- C:\Windows\System\GJzGFgR.exe
  C:\Windows\System\GJzGFgR.exe
  2⤵
  PID:1236
- C:\Windows\System\lcyKoTP.exe
  C:\Windows\System\lcyKoTP.exe
  2⤵
  PID:1552
- C:\Windows\System\qBdxSvJ.exe
  C:\Windows\System\qBdxSvJ.exe
  2⤵
  PID:3388
- C:\Windows\System\MQJUsSG.exe
  C:\Windows\System\MQJUsSG.exe
  2⤵
  PID:2256
- C:\Windows\System\kkAxSxN.exe
  C:\Windows\System\kkAxSxN.exe
  2⤵
  PID:4920
- C:\Windows\System\FvzfWer.exe
  C:\Windows\System\FvzfWer.exe
  2⤵
  PID:1460
- C:\Windows\System\hUQQweh.exe
  C:\Windows\System\hUQQweh.exe
  2⤵
  PID:2804
- C:\Windows\System\ASfmVNq.exe
  C:\Windows\System\ASfmVNq.exe
  2⤵
  PID:1676
- C:\Windows\System\UELoeZO.exe
  C:\Windows\System\UELoeZO.exe
  2⤵
  PID:3100
- C:\Windows\System\fELTrVY.exe
  C:\Windows\System\fELTrVY.exe
  2⤵
  PID:1888
- C:\Windows\System\ihcBYFb.exe
  C:\Windows\System\ihcBYFb.exe
  2⤵
  PID:4872
- C:\Windows\System\fkQNTMz.exe
  C:\Windows\System\fkQNTMz.exe
  2⤵
  PID:4388
- C:\Windows\System\WFjkroq.exe
  C:\Windows\System\WFjkroq.exe
  2⤵
  PID:4032
- C:\Windows\System\gSxieBF.exe
  C:\Windows\System\gSxieBF.exe
  2⤵
  PID:4820
- C:\Windows\System\tmADoGq.exe
  C:\Windows\System\tmADoGq.exe
  2⤵
  PID:2168
- C:\Windows\System\XLUcaiB.exe
  C:\Windows\System\XLUcaiB.exe
  2⤵
  PID:4636
- C:\Windows\System\VstULsC.exe
  C:\Windows\System\VstULsC.exe
  2⤵
  PID:3648
- C:\Windows\System\ksEJaJw.exe
  C:\Windows\System\ksEJaJw.exe
  2⤵
  PID:432
- C:\Windows\System\HYeYupL.exe
  C:\Windows\System\HYeYupL.exe
  2⤵
  PID:1872
- C:\Windows\System\mscUWli.exe
  C:\Windows\System\mscUWli.exe
  2⤵
  PID:3936
- C:\Windows\System\UVmjTds.exe
  C:\Windows\System\UVmjTds.exe
  2⤵
  PID:5140
- C:\Windows\System\GehcmNg.exe
  C:\Windows\System\GehcmNg.exe
  2⤵
  PID:5168
- C:\Windows\System\oEFTCgC.exe
  C:\Windows\System\oEFTCgC.exe
  2⤵
  PID:5196
- C:\Windows\System\GwbauFi.exe
  C:\Windows\System\GwbauFi.exe
  2⤵
  PID:5224
- C:\Windows\System\lzgKUdA.exe
  C:\Windows\System\lzgKUdA.exe
  2⤵
  PID:5252
- C:\Windows\System\MqyptAb.exe
  C:\Windows\System\MqyptAb.exe
  2⤵
  PID:5280
- C:\Windows\System\KqkerVa.exe
  C:\Windows\System\KqkerVa.exe
  2⤵
  PID:5304
- C:\Windows\System\FcwGbrf.exe
  C:\Windows\System\FcwGbrf.exe
  2⤵
  PID:5336
- C:\Windows\System\WQpFyGk.exe
  C:\Windows\System\WQpFyGk.exe
  2⤵
  PID:5360
- C:\Windows\System\wShjLQy.exe
  C:\Windows\System\wShjLQy.exe
  2⤵
  PID:5392
- C:\Windows\System\VlEiEmN.exe
  C:\Windows\System\VlEiEmN.exe
  2⤵
  PID:5420
- C:\Windows\System\OFJASGo.exe
  C:\Windows\System\OFJASGo.exe
  2⤵
  PID:5448
- C:\Windows\System\HPhpBOv.exe
  C:\Windows\System\HPhpBOv.exe
  2⤵
  PID:5476
- C:\Windows\System\GiLHkUy.exe
  C:\Windows\System\GiLHkUy.exe
  2⤵
  PID:5504
- C:\Windows\System\ZbKyrPy.exe
  C:\Windows\System\ZbKyrPy.exe
  2⤵
  PID:5532
- C:\Windows\System\giYbWhT.exe
  C:\Windows\System\giYbWhT.exe
  2⤵
  PID:5560
- C:\Windows\System\KvJgApd.exe
  C:\Windows\System\KvJgApd.exe
  2⤵
  PID:5588
- C:\Windows\System\WRJOfUc.exe
  C:\Windows\System\WRJOfUc.exe
  2⤵
  PID:5616
- C:\Windows\System\yeEKOhT.exe
  C:\Windows\System\yeEKOhT.exe
  2⤵
  PID:5644
- C:\Windows\System\eoyAVEz.exe
  C:\Windows\System\eoyAVEz.exe
  2⤵
  PID:5672
- C:\Windows\System\dcdKenY.exe
  C:\Windows\System\dcdKenY.exe
  2⤵
  PID:5700
- C:\Windows\System\wvBdshB.exe
  C:\Windows\System\wvBdshB.exe
  2⤵
  PID:5728
- C:\Windows\System\biYnBET.exe
  C:\Windows\System\biYnBET.exe
  2⤵
  PID:5756
- C:\Windows\System\KkOLlZy.exe
  C:\Windows\System\KkOLlZy.exe
  2⤵
  PID:5784
- C:\Windows\System\cVrKSZT.exe
  C:\Windows\System\cVrKSZT.exe
  2⤵
  PID:5812
- C:\Windows\System\jmDsQEC.exe
  C:\Windows\System\jmDsQEC.exe
  2⤵
  PID:5840
- C:\Windows\System\AkyFxLd.exe
  C:\Windows\System\AkyFxLd.exe
  2⤵
  PID:5864
- C:\Windows\System\XCPwcgT.exe
  C:\Windows\System\XCPwcgT.exe
  2⤵
  PID:5896
- C:\Windows\System\YUQFrwl.exe
  C:\Windows\System\YUQFrwl.exe
  2⤵
  PID:5924
- C:\Windows\System\tOFUBQP.exe
  C:\Windows\System\tOFUBQP.exe
  2⤵
  PID:5952
- C:\Windows\System\tNJUbiF.exe
  C:\Windows\System\tNJUbiF.exe
  2⤵
  PID:5980
- C:\Windows\System\pAfLhrb.exe
  C:\Windows\System\pAfLhrb.exe
  2⤵
  PID:6008
- C:\Windows\System\AYdYmeC.exe
  C:\Windows\System\AYdYmeC.exe
  2⤵
  PID:6036
- C:\Windows\System\hwbvrQF.exe
  C:\Windows\System\hwbvrQF.exe
  2⤵
  PID:6064
- C:\Windows\System\hkEICiS.exe
  C:\Windows\System\hkEICiS.exe
  2⤵
  PID:6092
- C:\Windows\System\yNmWyfE.exe
  C:\Windows\System\yNmWyfE.exe
  2⤵
  PID:6120
- C:\Windows\System\UvKKAia.exe
  C:\Windows\System\UvKKAia.exe
  2⤵
  PID:3776
- C:\Windows\System\AvcTHqg.exe
  C:\Windows\System\AvcTHqg.exe
  2⤵
  PID:2560
- C:\Windows\System\kkRsQhT.exe
  C:\Windows\System\kkRsQhT.exe
  2⤵
  PID:4476
- C:\Windows\System\ZzsOpwM.exe
  C:\Windows\System\ZzsOpwM.exe
  2⤵
  PID:4696
- C:\Windows\System\PmlAXrh.exe
  C:\Windows\System\PmlAXrh.exe
  2⤵
  PID:4828
- C:\Windows\System\uOZQOYw.exe
  C:\Windows\System\uOZQOYw.exe
  2⤵
  PID:2424
- C:\Windows\System\EcrumLh.exe
  C:\Windows\System\EcrumLh.exe
  2⤵
  PID:5160
- C:\Windows\System\YhhBUOv.exe
  C:\Windows\System\YhhBUOv.exe
  2⤵
  PID:5236
- C:\Windows\System\nrYyMTH.exe
  C:\Windows\System\nrYyMTH.exe
  2⤵
  PID:5296
- C:\Windows\System\iuIULfx.exe
  C:\Windows\System\iuIULfx.exe
  2⤵
  PID:5356
- C:\Windows\System\LQLvPGj.exe
  C:\Windows\System\LQLvPGj.exe
  2⤵
  PID:5412
- C:\Windows\System\GGsoTYC.exe
  C:\Windows\System\GGsoTYC.exe
  2⤵
  PID:5488
- C:\Windows\System\twNSupc.exe
  C:\Windows\System\twNSupc.exe
  2⤵
  PID:5548
- C:\Windows\System\piGEWUA.exe
  C:\Windows\System\piGEWUA.exe
  2⤵
  PID:5608
- C:\Windows\System\gDtPNvs.exe
  C:\Windows\System\gDtPNvs.exe
  2⤵
  PID:5664
- C:\Windows\System\oNSFTvX.exe
  C:\Windows\System\oNSFTvX.exe
  2⤵
  PID:5740
- C:\Windows\System\xpmQUjx.exe
  C:\Windows\System\xpmQUjx.exe
  2⤵
  PID:5800
- C:\Windows\System\vYOKQoW.exe
  C:\Windows\System\vYOKQoW.exe
  2⤵
  PID:5860
- C:\Windows\System\jtmCuKd.exe
  C:\Windows\System\jtmCuKd.exe
  2⤵
  PID:5936
- C:\Windows\System\ZrOmwoi.exe
  C:\Windows\System\ZrOmwoi.exe
  2⤵
  PID:5996
- C:\Windows\System\eBSMEFy.exe
  C:\Windows\System\eBSMEFy.exe
  2⤵
  PID:6056
- C:\Windows\System\zFHJbgZ.exe
  C:\Windows\System\zFHJbgZ.exe
  2⤵
  PID:6132
- C:\Windows\System\sTGILfD.exe
  C:\Windows\System\sTGILfD.exe
  2⤵
  PID:2648
- C:\Windows\System\pMNokwY.exe
  C:\Windows\System\pMNokwY.exe
  2⤵
  PID:3536
- C:\Windows\System\FPrdBOY.exe
  C:\Windows\System\FPrdBOY.exe
  2⤵
  PID:5152
- C:\Windows\System\fQZBhVp.exe
  C:\Windows\System\fQZBhVp.exe
  2⤵
  PID:5268
- C:\Windows\System\cQhvqXq.exe
  C:\Windows\System\cQhvqXq.exe
  2⤵
  PID:5408
- C:\Windows\System\ERFgaRE.exe
  C:\Windows\System\ERFgaRE.exe
  2⤵
  PID:5524
- C:\Windows\System\HmBIhoZ.exe
  C:\Windows\System\HmBIhoZ.exe
  2⤵
  PID:5712
- C:\Windows\System\fXxvsrP.exe
  C:\Windows\System\fXxvsrP.exe
  2⤵
  PID:5852
- C:\Windows\System\wsDzlkt.exe
  C:\Windows\System\wsDzlkt.exe
  2⤵
  PID:6024
- C:\Windows\System\gFNvWgT.exe
  C:\Windows\System\gFNvWgT.exe
  2⤵
  PID:4940
- C:\Windows\System\oIuhYtj.exe
  C:\Windows\System\oIuhYtj.exe
  2⤵
  PID:6148
- C:\Windows\System\ZaTRDqM.exe
  C:\Windows\System\ZaTRDqM.exe
  2⤵
  PID:6176
- C:\Windows\System\fUNxXeX.exe
  C:\Windows\System\fUNxXeX.exe
  2⤵
  PID:6204
- C:\Windows\System\MzcMCNx.exe
  C:\Windows\System\MzcMCNx.exe
  2⤵
  PID:6232
- C:\Windows\System\eDtpAoy.exe
  C:\Windows\System\eDtpAoy.exe
  2⤵
  PID:6264
- C:\Windows\System\jRkToOL.exe
  C:\Windows\System\jRkToOL.exe
  2⤵
  PID:6288
- C:\Windows\System\agyFBKi.exe
  C:\Windows\System\agyFBKi.exe
  2⤵
  PID:6316
- C:\Windows\System\KOGYzCU.exe
  C:\Windows\System\KOGYzCU.exe
  2⤵
  PID:6336
- C:\Windows\System\DVMQcoH.exe
  C:\Windows\System\DVMQcoH.exe
  2⤵
  PID:6364
- C:\Windows\System\aqmzXKp.exe
  C:\Windows\System\aqmzXKp.exe
  2⤵
  PID:6392
- C:\Windows\System\bqIZCHc.exe
  C:\Windows\System\bqIZCHc.exe
  2⤵
  PID:6420
- C:\Windows\System\oFZxkUK.exe
  C:\Windows\System\oFZxkUK.exe
  2⤵
  PID:6448
- C:\Windows\System\nnJBydn.exe
  C:\Windows\System\nnJBydn.exe
  2⤵
  PID:6476
- C:\Windows\System\KpBJoxQ.exe
  C:\Windows\System\KpBJoxQ.exe
  2⤵
  PID:6504
- C:\Windows\System\hgDIRKK.exe
  C:\Windows\System\hgDIRKK.exe
  2⤵
  PID:6532
- C:\Windows\System\nbhzCGF.exe
  C:\Windows\System\nbhzCGF.exe
  2⤵
  PID:6560
- C:\Windows\System\nmvmGyD.exe
  C:\Windows\System\nmvmGyD.exe
  2⤵
  PID:6588
- C:\Windows\System\AqyYODz.exe
  C:\Windows\System\AqyYODz.exe
  2⤵
  PID:6616
- C:\Windows\System\SANnDMN.exe
  C:\Windows\System\SANnDMN.exe
  2⤵
  PID:6644
- C:\Windows\System\clTgoQt.exe
  C:\Windows\System\clTgoQt.exe
  2⤵
  PID:6672
- C:\Windows\System\qSjsPMo.exe
  C:\Windows\System\qSjsPMo.exe
  2⤵
  PID:6700
- C:\Windows\System\gtkAwYX.exe
  C:\Windows\System\gtkAwYX.exe
  2⤵
  PID:6728
- C:\Windows\System\tndQTJQ.exe
  C:\Windows\System\tndQTJQ.exe
  2⤵
  PID:6756
- C:\Windows\System\kpWTmNx.exe
  C:\Windows\System\kpWTmNx.exe
  2⤵
  PID:6784
- C:\Windows\System\nJgLSZy.exe
  C:\Windows\System\nJgLSZy.exe
  2⤵
  PID:6812
- C:\Windows\System\rHriLyK.exe
  C:\Windows\System\rHriLyK.exe
  2⤵
  PID:6840
- C:\Windows\System\XJksqxK.exe
  C:\Windows\System\XJksqxK.exe
  2⤵
  PID:6868
- C:\Windows\System\lzNagJg.exe
  C:\Windows\System\lzNagJg.exe
  2⤵
  PID:6896
- C:\Windows\System\WkrNpxr.exe
  C:\Windows\System\WkrNpxr.exe
  2⤵
  PID:6924
- C:\Windows\System\FztcZmX.exe
  C:\Windows\System\FztcZmX.exe
  2⤵
  PID:6952
- C:\Windows\System\GnSErSc.exe
  C:\Windows\System\GnSErSc.exe
  2⤵
  PID:6980
- C:\Windows\System\ZWEdBjO.exe
  C:\Windows\System\ZWEdBjO.exe
  2⤵
  PID:7008
- C:\Windows\System\QrsCesx.exe
  C:\Windows\System\QrsCesx.exe
  2⤵
  PID:7036
- C:\Windows\System\qaULrbu.exe
  C:\Windows\System\qaULrbu.exe
  2⤵
  PID:7064
- C:\Windows\System\UYvmYWD.exe
  C:\Windows\System\UYvmYWD.exe
  2⤵
  PID:7092
- C:\Windows\System\wVkMqDS.exe
  C:\Windows\System\wVkMqDS.exe
  2⤵
  PID:7120
- C:\Windows\System\RPiiQTE.exe
  C:\Windows\System\RPiiQTE.exe
  2⤵
  PID:5656
- C:\Windows\System\yBbZWnn.exe
  C:\Windows\System\yBbZWnn.exe
  2⤵
  PID:5832
- C:\Windows\System\TYpWvaU.exe
  C:\Windows\System\TYpWvaU.exe
  2⤵
  PID:2352
- C:\Windows\System\oJooNWa.exe
  C:\Windows\System\oJooNWa.exe
  2⤵
  PID:6172
- C:\Windows\System\CvWXcYq.exe
  C:\Windows\System\CvWXcYq.exe
  2⤵
  PID:6224
- C:\Windows\System\JLcJaDa.exe
  C:\Windows\System\JLcJaDa.exe
  2⤵
  PID:6276
- C:\Windows\System\WnlzEDC.exe
  C:\Windows\System\WnlzEDC.exe
  2⤵
  PID:6332
- C:\Windows\System\VKtklGX.exe
  C:\Windows\System\VKtklGX.exe
  2⤵
  PID:6384
- C:\Windows\System\XzQeJBG.exe
  C:\Windows\System\XzQeJBG.exe
  2⤵
  PID:4208
- C:\Windows\System\IsktgXb.exe
  C:\Windows\System\IsktgXb.exe
  2⤵
  PID:6516
- C:\Windows\System\rJnCxIH.exe
  C:\Windows\System\rJnCxIH.exe
  2⤵
  PID:6548
- C:\Windows\System\nLdcSaq.exe
  C:\Windows\System\nLdcSaq.exe
  2⤵
  PID:6604
- C:\Windows\System\UmJtToC.exe
  C:\Windows\System\UmJtToC.exe
  2⤵
  PID:6656
- C:\Windows\System\AqyQjeY.exe
  C:\Windows\System\AqyQjeY.exe
  2⤵
  PID:6712
- C:\Windows\System\tpgRVqp.exe
  C:\Windows\System\tpgRVqp.exe
  2⤵
  PID:3152
- C:\Windows\System\XPWWgny.exe
  C:\Windows\System\XPWWgny.exe
  2⤵
  PID:6824
- C:\Windows\System\PfasYeK.exe
  C:\Windows\System\PfasYeK.exe
  2⤵
  PID:6860
- C:\Windows\System\FskNupL.exe
  C:\Windows\System\FskNupL.exe
  2⤵
  PID:6912
- C:\Windows\System\vnyVUPA.exe
  C:\Windows\System\vnyVUPA.exe
  2⤵
  PID:6972
- C:\Windows\System\JWaBfEu.exe
  C:\Windows\System\JWaBfEu.exe
  2⤵
  PID:7024
- C:\Windows\System\auQmYxY.exe
  C:\Windows\System\auQmYxY.exe
  2⤵
  PID:2016
- C:\Windows\System\geQTOhe.exe
  C:\Windows\System\geQTOhe.exe
  2⤵
  PID:2924
- C:\Windows\System\SUkrgIf.exe
  C:\Windows\System\SUkrgIf.exe
  2⤵
  PID:6108
- C:\Windows\System\ndPEAhj.exe
  C:\Windows\System\ndPEAhj.exe
  2⤵
  PID:6200
- C:\Windows\System\uFrFloa.exe
  C:\Windows\System\uFrFloa.exe
  2⤵
  PID:6256
- C:\Windows\System\DXpSXrg.exe
  C:\Windows\System\DXpSXrg.exe
  2⤵
  PID:3284
- C:\Windows\System\pyIWfkX.exe
  C:\Windows\System\pyIWfkX.exe
  2⤵
  PID:6468
- C:\Windows\System\JaaKzxx.exe
  C:\Windows\System\JaaKzxx.exe
  2⤵
  PID:6940
- C:\Windows\System\ZUbKxTf.exe
  C:\Windows\System\ZUbKxTf.exe
  2⤵
  PID:6880
- C:\Windows\System\vBakXXd.exe
  C:\Windows\System\vBakXXd.exe
  2⤵
  PID:4612
- C:\Windows\System\HzwmDCx.exe
  C:\Windows\System\HzwmDCx.exe
  2⤵
  PID:7144
- C:\Windows\System\PcuWIYL.exe
  C:\Windows\System\PcuWIYL.exe
  2⤵
  PID:6252
- C:\Windows\System\jpHpgDk.exe
  C:\Windows\System\jpHpgDk.exe
  2⤵
  PID:1696
- C:\Windows\System\EZqkfjv.exe
  C:\Windows\System\EZqkfjv.exe
  2⤵
  PID:7188
- C:\Windows\System\PplPtOP.exe
  C:\Windows\System\PplPtOP.exe
  2⤵
  PID:7216
- C:\Windows\System\uwvJUBm.exe
  C:\Windows\System\uwvJUBm.exe
  2⤵
  PID:7244
- C:\Windows\System\NqbDsUZ.exe
  C:\Windows\System\NqbDsUZ.exe
  2⤵
  PID:7272
- C:\Windows\System\KHmBEpr.exe
  C:\Windows\System\KHmBEpr.exe
  2⤵
  PID:7300
- C:\Windows\System\glqFelZ.exe
  C:\Windows\System\glqFelZ.exe
  2⤵
  PID:7328
- C:\Windows\System\hKnmqMo.exe
  C:\Windows\System\hKnmqMo.exe
  2⤵
  PID:7356
- C:\Windows\System\iADUGVw.exe
  C:\Windows\System\iADUGVw.exe
  2⤵
  PID:7384
- C:\Windows\System\wSpRujB.exe
  C:\Windows\System\wSpRujB.exe
  2⤵
  PID:7412
- C:\Windows\System\xNQyOAp.exe
  C:\Windows\System\xNQyOAp.exe
  2⤵
  PID:7440
- C:\Windows\System\wdjUrXx.exe
  C:\Windows\System\wdjUrXx.exe
  2⤵
  PID:7468
- C:\Windows\System\kTWcHwV.exe
  C:\Windows\System\kTWcHwV.exe
  2⤵
  PID:7496
- C:\Windows\System\dbWCqit.exe
  C:\Windows\System\dbWCqit.exe
  2⤵
  PID:7568
- C:\Windows\System\ILIkfTH.exe
  C:\Windows\System\ILIkfTH.exe
  2⤵
  PID:7608
- C:\Windows\System\uhakxgY.exe
  C:\Windows\System\uhakxgY.exe
  2⤵
  PID:7636
- C:\Windows\System\FRopmXG.exe
  C:\Windows\System\FRopmXG.exe
  2⤵
  PID:7652
- C:\Windows\System\eIdQAKG.exe
  C:\Windows\System\eIdQAKG.exe
  2⤵
  PID:7716
- C:\Windows\System\GnOqYIb.exe
  C:\Windows\System\GnOqYIb.exe
  2⤵
  PID:7740
- C:\Windows\System\opJWxsZ.exe
  C:\Windows\System\opJWxsZ.exe
  2⤵
  PID:7768
- C:\Windows\System\AOHDRTN.exe
  C:\Windows\System\AOHDRTN.exe
  2⤵
  PID:7796
- C:\Windows\System\uCjGLwc.exe
  C:\Windows\System\uCjGLwc.exe
  2⤵
  PID:7824
- C:\Windows\System\rtyNaPr.exe
  C:\Windows\System\rtyNaPr.exe
  2⤵
  PID:7872
- C:\Windows\System\acwjeDg.exe
  C:\Windows\System\acwjeDg.exe
  2⤵
  PID:7920
- C:\Windows\System\CebtGIg.exe
  C:\Windows\System\CebtGIg.exe
  2⤵
  PID:7940
- C:\Windows\System\MhXWgxa.exe
  C:\Windows\System\MhXWgxa.exe
  2⤵
  PID:7972
- C:\Windows\System\rkRSlOJ.exe
  C:\Windows\System\rkRSlOJ.exe
  2⤵
  PID:8000
- C:\Windows\System\rntMQxN.exe
  C:\Windows\System\rntMQxN.exe
  2⤵
  PID:8024
- C:\Windows\System\vfNExrK.exe
  C:\Windows\System\vfNExrK.exe
  2⤵
  PID:8052
- C:\Windows\System\YryVBxG.exe
  C:\Windows\System\YryVBxG.exe
  2⤵
  PID:8080
- C:\Windows\System\jMtVUdg.exe
  C:\Windows\System\jMtVUdg.exe
  2⤵
  PID:8108
- C:\Windows\System\oZghNhU.exe
  C:\Windows\System\oZghNhU.exe
  2⤵
  PID:8148
- C:\Windows\System\tycyIIo.exe
  C:\Windows\System\tycyIIo.exe
  2⤵
  PID:8176
- C:\Windows\System\URtrqFj.exe
  C:\Windows\System\URtrqFj.exe
  2⤵
  PID:6884
- C:\Windows\System\uCuirET.exe
  C:\Windows\System\uCuirET.exe
  2⤵
  PID:5992
- C:\Windows\System\vkPofrf.exe
  C:\Windows\System\vkPofrf.exe
  2⤵
  PID:7176
- C:\Windows\System\cGmJdHb.exe
  C:\Windows\System\cGmJdHb.exe
  2⤵
  PID:7232
- C:\Windows\System\rGNVTry.exe
  C:\Windows\System\rGNVTry.exe
  2⤵
  PID:7288
- C:\Windows\System\QiWvqGQ.exe
  C:\Windows\System\QiWvqGQ.exe
  2⤵
  PID:7344
- C:\Windows\System\gIcXuov.exe
  C:\Windows\System\gIcXuov.exe
  2⤵
  PID:7424
- C:\Windows\System\OfJFqyf.exe
  C:\Windows\System\OfJFqyf.exe
  2⤵
  PID:7452
- C:\Windows\System\CvxMWBH.exe
  C:\Windows\System\CvxMWBH.exe
  2⤵
  PID:3468
- C:\Windows\System\sInrLpG.exe
  C:\Windows\System\sInrLpG.exe
  2⤵
  PID:6104
- C:\Windows\System\NNjdVYu.exe
  C:\Windows\System\NNjdVYu.exe
  2⤵
  PID:5132
- C:\Windows\System\fUrQibU.exe
  C:\Windows\System\fUrQibU.exe
  2⤵
  PID:6544
- C:\Windows\System\xlgVYBG.exe
  C:\Windows\System\xlgVYBG.exe
  2⤵
  PID:7604
- C:\Windows\System\XpSRxPj.exe
  C:\Windows\System\XpSRxPj.exe
  2⤵
  PID:7616
- C:\Windows\System\WyDCfDQ.exe
  C:\Windows\System\WyDCfDQ.exe
  2⤵
  PID:4400
- C:\Windows\System\ZkEjqXp.exe
  C:\Windows\System\ZkEjqXp.exe
  2⤵
  PID:7756
- C:\Windows\System\FSVlcMq.exe
  C:\Windows\System\FSVlcMq.exe
  2⤵
  PID:7848
- C:\Windows\System\SsUYcIR.exe
  C:\Windows\System\SsUYcIR.exe
  2⤵
  PID:7900
- C:\Windows\System\dnjzCSl.exe
  C:\Windows\System\dnjzCSl.exe
  2⤵
  PID:7964
- C:\Windows\System\TBwQgzV.exe
  C:\Windows\System\TBwQgzV.exe
  2⤵
  PID:8040
- C:\Windows\System\BaBJeuy.exe
  C:\Windows\System\BaBJeuy.exe
  2⤵
  PID:8124
- C:\Windows\System\EwuZCua.exe
  C:\Windows\System\EwuZCua.exe
  2⤵
  PID:6964
- C:\Windows\System\iPHzVgI.exe
  C:\Windows\System\iPHzVgI.exe
  2⤵
  PID:6440
- C:\Windows\System\CmKJYrX.exe
  C:\Windows\System\CmKJYrX.exe
  2⤵
  PID:7320
- C:\Windows\System\tYRPCSK.exe
  C:\Windows\System\tYRPCSK.exe
  2⤵
  PID:7428
- C:\Windows\System\ieukXJA.exe
  C:\Windows\System\ieukXJA.exe
  2⤵
  PID:3288
- C:\Windows\System\YkAiUMZ.exe
  C:\Windows\System\YkAiUMZ.exe
  2⤵
  PID:6248
- C:\Windows\System\FBEsLnU.exe
  C:\Windows\System\FBEsLnU.exe
  2⤵
  PID:7728
- C:\Windows\System\thXqHpa.exe
  C:\Windows\System\thXqHpa.exe
  2⤵
  PID:7816
- C:\Windows\System\FdccsBS.exe
  C:\Windows\System\FdccsBS.exe
  2⤵
  PID:8012
- C:\Windows\System\brKuEfx.exe
  C:\Windows\System\brKuEfx.exe
  2⤵
  PID:6436
- C:\Windows\System\lZWPnnN.exe
  C:\Windows\System\lZWPnnN.exe
  2⤵
  PID:7484
- C:\Windows\System\YpsOFiY.exe
  C:\Windows\System\YpsOFiY.exe
  2⤵
  PID:6796
- C:\Windows\System\Zgykobc.exe
  C:\Windows\System\Zgykobc.exe
  2⤵
  PID:8096
- C:\Windows\System\MCDMqFJ.exe
  C:\Windows\System\MCDMqFJ.exe
  2⤵
  PID:6944
- C:\Windows\System\azKgZaZ.exe
  C:\Windows\System\azKgZaZ.exe
  2⤵
  PID:7540
- C:\Windows\System\sToDpjm.exe
  C:\Windows\System\sToDpjm.exe
  2⤵
  PID:8220
- C:\Windows\System\vQfNymn.exe
  C:\Windows\System\vQfNymn.exe
  2⤵
  PID:8248
- C:\Windows\System\eFyHBUO.exe
  C:\Windows\System\eFyHBUO.exe
  2⤵
  PID:8276
- C:\Windows\System\tUabJiq.exe
  C:\Windows\System\tUabJiq.exe
  2⤵
  PID:8304
- C:\Windows\System\paZKEgc.exe
  C:\Windows\System\paZKEgc.exe
  2⤵
  PID:8332
- C:\Windows\System\yTmvaJo.exe
  C:\Windows\System\yTmvaJo.exe
  2⤵
  PID:8364
- C:\Windows\System\vMFJEiy.exe
  C:\Windows\System\vMFJEiy.exe
  2⤵
  PID:8392
- C:\Windows\System\EFgfIAw.exe
  C:\Windows\System\EFgfIAw.exe
  2⤵
  PID:8420
- C:\Windows\System\DiWrtwn.exe
  C:\Windows\System\DiWrtwn.exe
  2⤵
  PID:8448
- C:\Windows\System\BhMeTfw.exe
  C:\Windows\System\BhMeTfw.exe
  2⤵
  PID:8476
- C:\Windows\System\pbKYRoG.exe
  C:\Windows\System\pbKYRoG.exe
  2⤵
  PID:8504
- C:\Windows\System\dubFIOb.exe
  C:\Windows\System\dubFIOb.exe
  2⤵
  PID:8532
- C:\Windows\System\YXqNpze.exe
  C:\Windows\System\YXqNpze.exe
  2⤵
  PID:8568
- C:\Windows\System\gywDTTi.exe
  C:\Windows\System\gywDTTi.exe
  2⤵
  PID:8588
- C:\Windows\System\LVzvYpj.exe
  C:\Windows\System\LVzvYpj.exe
  2⤵
  PID:8608
- C:\Windows\System\bjFgBUJ.exe
  C:\Windows\System\bjFgBUJ.exe
  2⤵
  PID:8640
- C:\Windows\System\ZvxRGri.exe
  C:\Windows\System\ZvxRGri.exe
  2⤵
  PID:8660
- C:\Windows\System\CZkXGaj.exe
  C:\Windows\System\CZkXGaj.exe
  2⤵
  PID:8700
- C:\Windows\System\oyxbmdY.exe
  C:\Windows\System\oyxbmdY.exe
  2⤵
  PID:8728
- C:\Windows\System\aGBYHsI.exe
  C:\Windows\System\aGBYHsI.exe
  2⤵
  PID:8756
- C:\Windows\System\uocpPqQ.exe
  C:\Windows\System\uocpPqQ.exe
  2⤵
  PID:8780
- C:\Windows\System\kHSkjbD.exe
  C:\Windows\System\kHSkjbD.exe
  2⤵
  PID:8812
- C:\Windows\System\chSxgpd.exe
  C:\Windows\System\chSxgpd.exe
  2⤵
  PID:8840
- C:\Windows\System\cUKGlUt.exe
  C:\Windows\System\cUKGlUt.exe
  2⤵
  PID:8868
- C:\Windows\System\zihvFPD.exe
  C:\Windows\System\zihvFPD.exe
  2⤵
  PID:8884
- C:\Windows\System\ItyCpun.exe
  C:\Windows\System\ItyCpun.exe
  2⤵
  PID:8912
- C:\Windows\System\dvTZecy.exe
  C:\Windows\System\dvTZecy.exe
  2⤵
  PID:8952
- C:\Windows\System\VetPTCX.exe
  C:\Windows\System\VetPTCX.exe
  2⤵
  PID:8980
- C:\Windows\System\ipfVsRJ.exe
  C:\Windows\System\ipfVsRJ.exe
  2⤵
  PID:9000
- C:\Windows\System\KCUNkrK.exe
  C:\Windows\System\KCUNkrK.exe
  2⤵
  PID:9024
- C:\Windows\System\sohFyvV.exe
  C:\Windows\System\sohFyvV.exe
  2⤵
  PID:9056
- C:\Windows\System\EtXYiNJ.exe
  C:\Windows\System\EtXYiNJ.exe
  2⤵
  PID:9092
- C:\Windows\System\XHkgCMO.exe
  C:\Windows\System\XHkgCMO.exe
  2⤵
  PID:9120
- C:\Windows\System\NBngobf.exe
  C:\Windows\System\NBngobf.exe
  2⤵
  PID:9148
- C:\Windows\System\blpRZNW.exe
  C:\Windows\System\blpRZNW.exe
  2⤵
  PID:9168
- C:\Windows\System\pqbrCWE.exe
  C:\Windows\System\pqbrCWE.exe
  2⤵
  PID:9204
- C:\Windows\System\uJLHcBp.exe
  C:\Windows\System\uJLHcBp.exe
  2⤵
  PID:7372
- C:\Windows\System\wecjgLg.exe
  C:\Windows\System\wecjgLg.exe
  2⤵
  PID:8236
- C:\Windows\System\xUNrJQx.exe
  C:\Windows\System\xUNrJQx.exe
  2⤵
  PID:8296
- C:\Windows\System\wyQrmsE.exe
  C:\Windows\System\wyQrmsE.exe
  2⤵
  PID:8356
- C:\Windows\System\PXouNAP.exe
  C:\Windows\System\PXouNAP.exe
  2⤵
  PID:8412
- C:\Windows\System\vOvxhfy.exe
  C:\Windows\System\vOvxhfy.exe
  2⤵
  PID:8492
- C:\Windows\System\lDmRoeT.exe
  C:\Windows\System\lDmRoeT.exe
  2⤵
  PID:8556
- C:\Windows\System\bSUsbIU.exe
  C:\Windows\System\bSUsbIU.exe
  2⤵
  PID:8680
- C:\Windows\System\AtJMASQ.exe
  C:\Windows\System\AtJMASQ.exe
  2⤵
  PID:8724
- C:\Windows\System\bYvnDUe.exe
  C:\Windows\System\bYvnDUe.exe
  2⤵
  PID:8764
- C:\Windows\System\TlzKRGB.exe
  C:\Windows\System\TlzKRGB.exe
  2⤵
  PID:8836
- C:\Windows\System\KEdbUPg.exe
  C:\Windows\System\KEdbUPg.exe
  2⤵
  PID:8896
- C:\Windows\System\HlXekCe.exe
  C:\Windows\System\HlXekCe.exe
  2⤵
  PID:9008
- C:\Windows\System\MIIrwLy.exe
  C:\Windows\System\MIIrwLy.exe
  2⤵
  PID:9084
- C:\Windows\System\qbtAVYK.exe
  C:\Windows\System\qbtAVYK.exe
  2⤵
  PID:9164
- C:\Windows\System\uuKQaOP.exe
  C:\Windows\System\uuKQaOP.exe
  2⤵
  PID:2868
- C:\Windows\System\yZQRlWO.exe
  C:\Windows\System\yZQRlWO.exe
  2⤵
  PID:8376
- C:\Windows\System\lxKKZdt.exe
  C:\Windows\System\lxKKZdt.exe
  2⤵
  PID:8468
- C:\Windows\System\mRQoiVi.exe
  C:\Windows\System\mRQoiVi.exe
  2⤵
  PID:8528
- C:\Windows\System\kZdWhKw.exe
  C:\Windows\System\kZdWhKw.exe
  2⤵
  PID:8692
- C:\Windows\System\EXhfJjG.exe
  C:\Windows\System\EXhfJjG.exe
  2⤵
  PID:8880
- C:\Windows\System\drjvZdb.exe
  C:\Windows\System\drjvZdb.exe
  2⤵
  PID:8992
- C:\Windows\System\oJzqHRa.exe
  C:\Windows\System\oJzqHRa.exe
  2⤵
  PID:8272
- C:\Windows\System\fzHddOy.exe
  C:\Windows\System\fzHddOy.exe
  2⤵
  PID:8460
- C:\Windows\System\GFFBhvK.exe
  C:\Windows\System\GFFBhvK.exe
  2⤵
  PID:8864
- C:\Windows\System\LGVxZEE.exe
  C:\Windows\System\LGVxZEE.exe
  2⤵
  PID:8904
- C:\Windows\System\sMbfNEa.exe
  C:\Windows\System\sMbfNEa.exe
  2⤵
  PID:8940
- C:\Windows\System\yEcuGre.exe
  C:\Windows\System\yEcuGre.exe
  2⤵
  PID:9240
- C:\Windows\System\RdMckqz.exe
  C:\Windows\System\RdMckqz.exe
  2⤵
  PID:9272
- C:\Windows\System\trQzGEz.exe
  C:\Windows\System\trQzGEz.exe
  2⤵
  PID:9372
- C:\Windows\System\oTcrIYH.exe
  C:\Windows\System\oTcrIYH.exe
  2⤵
  PID:9388
- C:\Windows\System\YSTRSSL.exe
  C:\Windows\System\YSTRSSL.exe
  2⤵
  PID:9412
- C:\Windows\System\JbEQXnt.exe
  C:\Windows\System\JbEQXnt.exe
  2⤵
  PID:9432
- C:\Windows\System\DsPHkKa.exe
  C:\Windows\System\DsPHkKa.exe
  2⤵
  PID:9452
- C:\Windows\System\cirvDSl.exe
  C:\Windows\System\cirvDSl.exe
  2⤵
  PID:9480
- C:\Windows\System\WWhbHqt.exe
  C:\Windows\System\WWhbHqt.exe
  2⤵
  PID:9520
- C:\Windows\System\FbBLXTU.exe
  C:\Windows\System\FbBLXTU.exe
  2⤵
  PID:9572
- C:\Windows\System\MkLCLyG.exe
  C:\Windows\System\MkLCLyG.exe
  2⤵
  PID:9588
- C:\Windows\System\JDgacrF.exe
  C:\Windows\System\JDgacrF.exe
  2⤵
  PID:9604
- C:\Windows\System\VGnZMpY.exe
  C:\Windows\System\VGnZMpY.exe
  2⤵
  PID:9620
- C:\Windows\System\oCmwTBA.exe
  C:\Windows\System\oCmwTBA.exe
  2⤵
  PID:9644
- C:\Windows\System\Gbwblhs.exe
  C:\Windows\System\Gbwblhs.exe
  2⤵
  PID:9668
- C:\Windows\System\kAxpQpH.exe
  C:\Windows\System\kAxpQpH.exe
  2⤵
  PID:9700
- C:\Windows\System\OBjmSDm.exe
  C:\Windows\System\OBjmSDm.exe
  2⤵
  PID:9736
- C:\Windows\System\xDzAYJM.exe
  C:\Windows\System\xDzAYJM.exe
  2⤵
  PID:9804
- C:\Windows\System\PteWXIw.exe
  C:\Windows\System\PteWXIw.exe
  2⤵
  PID:9820
- C:\Windows\System\ufwTiHf.exe
  C:\Windows\System\ufwTiHf.exe
  2⤵
  PID:9840
- C:\Windows\System\vJNrqjw.exe
  C:\Windows\System\vJNrqjw.exe
  2⤵
  PID:9872
- C:\Windows\System\WLpSPaj.exe
  C:\Windows\System\WLpSPaj.exe
  2⤵
  PID:9908
- C:\Windows\System\PghhDLI.exe
  C:\Windows\System\PghhDLI.exe
  2⤵
  PID:9932
- C:\Windows\System\zubTsUE.exe
  C:\Windows\System\zubTsUE.exe
  2⤵
  PID:9972
- C:\Windows\System\INCdtEV.exe
  C:\Windows\System\INCdtEV.exe
  2⤵
  PID:10012
- C:\Windows\System\WkifRpn.exe
  C:\Windows\System\WkifRpn.exe
  2⤵
  PID:10032
- C:\Windows\System\ItPTLdX.exe
  C:\Windows\System\ItPTLdX.exe
  2⤵
  PID:10060
- C:\Windows\System\mQPojzv.exe
  C:\Windows\System\mQPojzv.exe
  2⤵
  PID:10080
- C:\Windows\System\NFKuUvt.exe
  C:\Windows\System\NFKuUvt.exe
  2⤵
  PID:10112
- C:\Windows\System\VhwpNPk.exe
  C:\Windows\System\VhwpNPk.exe
  2⤵
  PID:10148
- C:\Windows\System\XkjXVKc.exe
  C:\Windows\System\XkjXVKc.exe
  2⤵
  PID:10172
- C:\Windows\System\swnzBdp.exe
  C:\Windows\System\swnzBdp.exe
  2⤵
  PID:10196
- C:\Windows\System\DBXALgx.exe
  C:\Windows\System\DBXALgx.exe
  2⤵
  PID:9224
- C:\Windows\System\LmwSNgK.exe
  C:\Windows\System\LmwSNgK.exe
  2⤵
  PID:9280
- C:\Windows\System\kBkfkTj.exe
  C:\Windows\System\kBkfkTj.exe
  2⤵
  PID:9288
- C:\Windows\System\AvnHLIR.exe
  C:\Windows\System\AvnHLIR.exe
  2⤵
  PID:9428
- C:\Windows\System\tPuAJbt.exe
  C:\Windows\System\tPuAJbt.exe
  2⤵
  PID:9540
- C:\Windows\System\REgsvTs.exe
  C:\Windows\System\REgsvTs.exe
  2⤵
  PID:9552
- C:\Windows\System\mervAUK.exe
  C:\Windows\System\mervAUK.exe
  2⤵
  PID:9640
- C:\Windows\System\kKeWdKo.exe
  C:\Windows\System\kKeWdKo.exe
  2⤵
  PID:9688
- C:\Windows\System\DbiEnXi.exe
  C:\Windows\System\DbiEnXi.exe
  2⤵
  PID:9800
- C:\Windows\System\tnJFAaQ.exe
  C:\Windows\System\tnJFAaQ.exe
  2⤵
  PID:9828
- C:\Windows\System\ROEjShf.exe
  C:\Windows\System\ROEjShf.exe
  2⤵
  PID:9920
- C:\Windows\System\difnAOx.exe
  C:\Windows\System\difnAOx.exe
  2⤵
  PID:9960
- C:\Windows\System\tKBBXly.exe
  C:\Windows\System\tKBBXly.exe
  2⤵
  PID:10052
- C:\Windows\System\dBdHYRz.exe
  C:\Windows\System\dBdHYRz.exe
  2⤵
  PID:10104
- C:\Windows\System\rOgxwpS.exe
  C:\Windows\System\rOgxwpS.exe
  2⤵
  PID:10188
- C:\Windows\System\vvGHadH.exe
  C:\Windows\System\vvGHadH.exe
  2⤵
  PID:9316
- C:\Windows\System\TwZkddQ.exe
  C:\Windows\System\TwZkddQ.exe
  2⤵
  PID:9424
- C:\Windows\System\ltjTdPB.exe
  C:\Windows\System\ltjTdPB.exe
  2⤵
  PID:9560
- C:\Windows\System\vAWjrqU.exe
  C:\Windows\System\vAWjrqU.exe
  2⤵
  PID:9756
- C:\Windows\System\HxBtsET.exe
  C:\Windows\System\HxBtsET.exe
  2⤵
  PID:9956
- C:\Windows\System\rjEqKaf.exe
  C:\Windows\System\rjEqKaf.exe
  2⤵
  PID:10076
- C:\Windows\System\KCTUytM.exe
  C:\Windows\System\KCTUytM.exe
  2⤵
  PID:10236
- C:\Windows\System\bBvePOu.exe
  C:\Windows\System\bBvePOu.exe
  2⤵
  PID:9468
- C:\Windows\System\LnBeJlG.exe
  C:\Windows\System\LnBeJlG.exe
  2⤵
  PID:9660
- C:\Windows\System\RCtmPGQ.exe
  C:\Windows\System\RCtmPGQ.exe
  2⤵
  PID:10108
- C:\Windows\System\UgZAVQK.exe
  C:\Windows\System\UgZAVQK.exe
  2⤵
  PID:8216
- C:\Windows\System\paezDfn.exe
  C:\Windows\System\paezDfn.exe
  2⤵
  PID:10248
- C:\Windows\System\pEaYNYz.exe
  C:\Windows\System\pEaYNYz.exe
  2⤵
  PID:10272
- C:\Windows\System\CmyVaZC.exe
  C:\Windows\System\CmyVaZC.exe
  2⤵
  PID:10312
- C:\Windows\System\XNKWVOC.exe
  C:\Windows\System\XNKWVOC.exe
  2⤵
  PID:10336
- C:\Windows\System\iRFQhJE.exe
  C:\Windows\System\iRFQhJE.exe
  2⤵
  PID:10360
- C:\Windows\System\nObkFpx.exe
  C:\Windows\System\nObkFpx.exe
  2⤵
  PID:10376
- C:\Windows\System\MSqAkhZ.exe
  C:\Windows\System\MSqAkhZ.exe
  2⤵
  PID:10420
- C:\Windows\System\UdVEtkB.exe
  C:\Windows\System\UdVEtkB.exe
  2⤵
  PID:10440
- C:\Windows\System\NCsecAw.exe
  C:\Windows\System\NCsecAw.exe
  2⤵
  PID:10480
- C:\Windows\System\PeipZgM.exe
  C:\Windows\System\PeipZgM.exe
  2⤵
  PID:10508
- C:\Windows\System\gKBRKfU.exe
  C:\Windows\System\gKBRKfU.exe
  2⤵
  PID:10540
- C:\Windows\System\PgKPCon.exe
  C:\Windows\System\PgKPCon.exe
  2⤵
  PID:10580
- C:\Windows\System\FPgSJoT.exe
  C:\Windows\System\FPgSJoT.exe
  2⤵
  PID:10596
- C:\Windows\System\lpULdFa.exe
  C:\Windows\System\lpULdFa.exe
  2⤵
  PID:10628
- C:\Windows\System\XgCpViT.exe
  C:\Windows\System\XgCpViT.exe
  2⤵
  PID:10652
- C:\Windows\System\gmBOjSo.exe
  C:\Windows\System\gmBOjSo.exe
  2⤵
  PID:10692
- C:\Windows\System\SGmWkPS.exe
  C:\Windows\System\SGmWkPS.exe
  2⤵
  PID:10712
- C:\Windows\System\OpXvhrm.exe
  C:\Windows\System\OpXvhrm.exe
  2⤵
  PID:10728
- C:\Windows\System\irdXfYE.exe
  C:\Windows\System\irdXfYE.exe
  2⤵
  PID:10748
- C:\Windows\System\HRyAtWk.exe
  C:\Windows\System\HRyAtWk.exe
  2⤵
  PID:10780
- C:\Windows\System\eqerlEa.exe
  C:\Windows\System\eqerlEa.exe
  2⤵
  PID:10828
- C:\Windows\System\QobIZyU.exe
  C:\Windows\System\QobIZyU.exe
  2⤵
  PID:10856
- C:\Windows\System\DahhnMV.exe
  C:\Windows\System\DahhnMV.exe
  2⤵
  PID:10884
- C:\Windows\System\idoKMIS.exe
  C:\Windows\System\idoKMIS.exe
  2⤵
  PID:10908
- C:\Windows\System\LBoeZor.exe
  C:\Windows\System\LBoeZor.exe
  2⤵
  PID:10940
- C:\Windows\System\JKIdThi.exe
  C:\Windows\System\JKIdThi.exe
  2⤵
  PID:10968
- C:\Windows\System\gZNsvnj.exe
  C:\Windows\System\gZNsvnj.exe
  2⤵
  PID:10984
- C:\Windows\System\xiOkobj.exe
  C:\Windows\System\xiOkobj.exe
  2⤵
  PID:11016
- C:\Windows\System\WgFddAA.exe
  C:\Windows\System\WgFddAA.exe
  2⤵
  PID:11048
- C:\Windows\System\NIflRsA.exe
  C:\Windows\System\NIflRsA.exe
  2⤵
  PID:11072
- C:\Windows\System\jFWCmVP.exe
  C:\Windows\System\jFWCmVP.exe
  2⤵
  PID:11108
- C:\Windows\System\ucZziSS.exe
  C:\Windows\System\ucZziSS.exe
  2⤵
  PID:11136
- C:\Windows\System\LyEOWXJ.exe
  C:\Windows\System\LyEOWXJ.exe
  2⤵
  PID:11172
- C:\Windows\System\bORGyer.exe
  C:\Windows\System\bORGyer.exe
  2⤵
  PID:11196
- C:\Windows\System\aWukPUk.exe
  C:\Windows\System\aWukPUk.exe
  2⤵
  PID:11212
- C:\Windows\System\gRlmMbZ.exe
  C:\Windows\System\gRlmMbZ.exe
  2⤵
  PID:11244
- C:\Windows\System\cZsgEJy.exe
  C:\Windows\System\cZsgEJy.exe
  2⤵
  PID:9260
- C:\Windows\System\HQgOBxa.exe
  C:\Windows\System\HQgOBxa.exe
  2⤵
  PID:10300
- C:\Windows\System\dUPWSmf.exe
  C:\Windows\System\dUPWSmf.exe
  2⤵
  PID:10412
- C:\Windows\System\kHqsytN.exe
  C:\Windows\System\kHqsytN.exe
  2⤵
  PID:10456
- C:\Windows\System\FYkWPkh.exe
  C:\Windows\System\FYkWPkh.exe
  2⤵
  PID:10504
- C:\Windows\System\JkuDLCY.exe
  C:\Windows\System\JkuDLCY.exe
  2⤵
  PID:10588
- C:\Windows\System\aisAejm.exe
  C:\Windows\System\aisAejm.exe
  2⤵
  PID:10648
- C:\Windows\System\vTwCrrB.exe
  C:\Windows\System\vTwCrrB.exe
  2⤵
  PID:10724
- C:\Windows\System\QMDCqmn.exe
  C:\Windows\System\QMDCqmn.exe
  2⤵
  PID:10816
- C:\Windows\System\ShwqvWC.exe
  C:\Windows\System\ShwqvWC.exe
  2⤵
  PID:10928
- C:\Windows\System\ONWussl.exe
  C:\Windows\System\ONWussl.exe
  2⤵
  PID:10956
- C:\Windows\System\AeIQJRl.exe
  C:\Windows\System\AeIQJRl.exe
  2⤵
  PID:11040
- C:\Windows\System\DnwOzZG.exe
  C:\Windows\System\DnwOzZG.exe
  2⤵
  PID:11096
- C:\Windows\System\qftcvGa.exe
  C:\Windows\System\qftcvGa.exe
  2⤵
  PID:11124
- C:\Windows\System\NFQNpbl.exe
  C:\Windows\System\NFQNpbl.exe
  2⤵
  PID:11192
- C:\Windows\System\VkdvIPX.exe
  C:\Windows\System\VkdvIPX.exe
  2⤵
  PID:11236
- C:\Windows\System\tujxIWq.exe
  C:\Windows\System\tujxIWq.exe
  2⤵
  PID:10400
- C:\Windows\System\iVmwbpz.exe
  C:\Windows\System\iVmwbpz.exe
  2⤵
  PID:10624
- C:\Windows\System\IcMinpa.exe
  C:\Windows\System\IcMinpa.exe
  2⤵
  PID:10720
- C:\Windows\System\sYQqEMB.exe
  C:\Windows\System\sYQqEMB.exe
  2⤵
  PID:10872
- C:\Windows\System\UVDkjDg.exe
  C:\Windows\System\UVDkjDg.exe
  2⤵
  PID:11032
- C:\Windows\System\QRiCNxI.exe
  C:\Windows\System\QRiCNxI.exe
  2⤵
  PID:9784
- C:\Windows\System\tzoTJWm.exe
  C:\Windows\System\tzoTJWm.exe
  2⤵
  PID:11064
- C:\Windows\System\EztgPNo.exe
  C:\Windows\System\EztgPNo.exe
  2⤵
  PID:9472
- C:\Windows\System\TYuGruG.exe
  C:\Windows\System\TYuGruG.exe
  2⤵
  PID:10776
- C:\Windows\System\ONVJYSK.exe
  C:\Windows\System\ONVJYSK.exe
  2⤵
  PID:9348
- C:\Windows\System\xvtDXhz.exe
  C:\Windows\System\xvtDXhz.exe
  2⤵
  PID:10980
- C:\Windows\System\ELSXcud.exe
  C:\Windows\System\ELSXcud.exe
  2⤵
  PID:11204
- C:\Windows\System\fpEACwT.exe
  C:\Windows\System\fpEACwT.exe
  2⤵
  PID:9352
- C:\Windows\System\XibSFXP.exe
  C:\Windows\System\XibSFXP.exe
  2⤵
  PID:11300
- C:\Windows\System\aNytFZi.exe
  C:\Windows\System\aNytFZi.exe
  2⤵
  PID:11328
- C:\Windows\System\vqLbKHU.exe
  C:\Windows\System\vqLbKHU.exe
  2⤵
  PID:11360
- C:\Windows\System\erzznic.exe
  C:\Windows\System\erzznic.exe
  2⤵
  PID:11376
- C:\Windows\System\dMiWdwZ.exe
  C:\Windows\System\dMiWdwZ.exe
  2⤵
  PID:11404
- C:\Windows\System\hsIkXWC.exe
  C:\Windows\System\hsIkXWC.exe
  2⤵
  PID:11444
- C:\Windows\System\bHQjWrW.exe
  C:\Windows\System\bHQjWrW.exe
  2⤵
  PID:11472
- C:\Windows\System\guEemPz.exe
  C:\Windows\System\guEemPz.exe
  2⤵
  PID:11500
- C:\Windows\System\qUvTxwd.exe
  C:\Windows\System\qUvTxwd.exe
  2⤵
  PID:11516
- C:\Windows\System\xQuNRcI.exe
  C:\Windows\System\xQuNRcI.exe
  2⤵
  PID:11548
- C:\Windows\System\IlpMmcH.exe
  C:\Windows\System\IlpMmcH.exe
  2⤵
  PID:11576
- C:\Windows\System\MMYlEat.exe
  C:\Windows\System\MMYlEat.exe
  2⤵
  PID:11612
- C:\Windows\System\wkVTJXc.exe
  C:\Windows\System\wkVTJXc.exe
  2⤵
  PID:11640
- C:\Windows\System\Lyrvxob.exe
  C:\Windows\System\Lyrvxob.exe
  2⤵
  PID:11668
- C:\Windows\System\PzLUSJR.exe
  C:\Windows\System\PzLUSJR.exe
  2⤵
  PID:11696
- C:\Windows\System\PBAUWWD.exe
  C:\Windows\System\PBAUWWD.exe
  2⤵
  PID:11712
- C:\Windows\System\bhwgxns.exe
  C:\Windows\System\bhwgxns.exe
  2⤵
  PID:11740
- C:\Windows\System\ovZZZgM.exe
  C:\Windows\System\ovZZZgM.exe
  2⤵
  PID:11768
- C:\Windows\System\cAeVINt.exe
  C:\Windows\System\cAeVINt.exe
  2⤵
  PID:11804
- C:\Windows\System\RrBpoLU.exe
  C:\Windows\System\RrBpoLU.exe
  2⤵
  PID:11824
- C:\Windows\System\WlowyqC.exe
  C:\Windows\System\WlowyqC.exe
  2⤵
  PID:11860
- C:\Windows\System\SMGhIDm.exe
  C:\Windows\System\SMGhIDm.exe
  2⤵
  PID:11880
- C:\Windows\System\jUeXfzP.exe
  C:\Windows\System\jUeXfzP.exe
  2⤵
  PID:11908
- C:\Windows\System\yqBMvmb.exe
  C:\Windows\System\yqBMvmb.exe
  2⤵
  PID:11948
- C:\Windows\System\ckqbQHF.exe
  C:\Windows\System\ckqbQHF.exe
  2⤵
  PID:11964
- C:\Windows\System\OcApgrn.exe
  C:\Windows\System\OcApgrn.exe
  2⤵
  PID:11992
- C:\Windows\System\OZiSxnN.exe
  C:\Windows\System\OZiSxnN.exe
  2⤵
  PID:12024
- C:\Windows\System\VJDkLlV.exe
  C:\Windows\System\VJDkLlV.exe
  2⤵
  PID:12056
- C:\Windows\System\VCzZbzJ.exe
  C:\Windows\System\VCzZbzJ.exe
  2⤵
  PID:12084
- C:\Windows\System\IimTAda.exe
  C:\Windows\System\IimTAda.exe
  2⤵
  PID:12144
- C:\Windows\System\mdxyPVm.exe
  C:\Windows\System\mdxyPVm.exe
  2⤵
  PID:12160
- C:\Windows\System\waISMKd.exe
  C:\Windows\System\waISMKd.exe
  2⤵
  PID:12188
- C:\Windows\System\yLcQbZQ.exe
  C:\Windows\System\yLcQbZQ.exe
  2⤵
  PID:12204
- C:\Windows\System\QNLNOSa.exe
  C:\Windows\System\QNLNOSa.exe
  2⤵
  PID:12244
- C:\Windows\System\laNoPdE.exe
  C:\Windows\System\laNoPdE.exe
  2⤵
  PID:12264
- C:\Windows\System\yfDASwn.exe
  C:\Windows\System\yfDASwn.exe
  2⤵
  PID:10492
- C:\Windows\System\EEBrZvF.exe
  C:\Windows\System\EEBrZvF.exe
  2⤵
  PID:11308
- C:\Windows\System\xomQVJq.exe
  C:\Windows\System\xomQVJq.exe
  2⤵
  PID:11356
- C:\Windows\System\tSSRRCA.exe
  C:\Windows\System\tSSRRCA.exe
  2⤵
  PID:11464
- C:\Windows\System\WLMPDYt.exe
  C:\Windows\System\WLMPDYt.exe
  2⤵
  PID:11512
- C:\Windows\System\emMiCoj.exe
  C:\Windows\System\emMiCoj.exe
  2⤵
  PID:11584
- C:\Windows\System\LTnIGwq.exe
  C:\Windows\System\LTnIGwq.exe
  2⤵
  PID:11624
- C:\Windows\System\bOMZXBg.exe
  C:\Windows\System\bOMZXBg.exe
  2⤵
  PID:11688
- C:\Windows\System\vUWMbwQ.exe
  C:\Windows\System\vUWMbwQ.exe
  2⤵
  PID:11764
- C:\Windows\System\OEEzowd.exe
  C:\Windows\System\OEEzowd.exe
  2⤵
  PID:11820
- C:\Windows\System\CzDwtTh.exe
  C:\Windows\System\CzDwtTh.exe
  2⤵
  PID:11892
- C:\Windows\System\QKVWdBl.exe
  C:\Windows\System\QKVWdBl.exe
  2⤵
  PID:11956
- C:\Windows\System\ngsmJna.exe
  C:\Windows\System\ngsmJna.exe
  2⤵
  PID:12040
- C:\Windows\System\MWNEACn.exe
  C:\Windows\System\MWNEACn.exe
  2⤵
  PID:12068
- C:\Windows\System\ZOMxyAm.exe
  C:\Windows\System\ZOMxyAm.exe
  2⤵
  PID:12172
- C:\Windows\System\MLYgVHp.exe
  C:\Windows\System\MLYgVHp.exe
  2⤵
  PID:12236
- C:\Windows\System\zkXBjfZ.exe
  C:\Windows\System\zkXBjfZ.exe
  2⤵
  PID:10704
- C:\Windows\System\ovJzwoV.exe
  C:\Windows\System\ovJzwoV.exe
  2⤵
  PID:11392
- C:\Windows\System\njQYdXO.exe
  C:\Windows\System\njQYdXO.exe
  2⤵
  PID:11560
- C:\Windows\System\TtTorVg.exe
  C:\Windows\System\TtTorVg.exe
  2⤵
  PID:11752
- C:\Windows\System\cpwSgSZ.exe
  C:\Windows\System\cpwSgSZ.exe
  2⤵
  PID:11940
- C:\Windows\System\pztxYBA.exe
  C:\Windows\System\pztxYBA.exe
  2⤵
  PID:12228
- C:\Windows\System\vcBLTKx.exe
  C:\Windows\System\vcBLTKx.exe
  2⤵
  PID:11320
- C:\Windows\System\dUjywUR.exe
  C:\Windows\System\dUjywUR.exe
  2⤵
  PID:11736
- C:\Windows\System\XwvIFLC.exe
  C:\Windows\System\XwvIFLC.exe
  2⤵
  PID:12260
- C:\Windows\System\kvtmwSV.exe
  C:\Windows\System\kvtmwSV.exe
  2⤵
  PID:12180
- C:\Windows\System\HwgGjyD.exe
  C:\Windows\System\HwgGjyD.exe
  2⤵
  PID:11876
- C:\Windows\System\xwlmSBw.exe
  C:\Windows\System\xwlmSBw.exe
  2⤵
  PID:12328
- C:\Windows\System\bDmPxOW.exe
  C:\Windows\System\bDmPxOW.exe
  2⤵
  PID:12356
- C:\Windows\System\KCVroqk.exe
  C:\Windows\System\KCVroqk.exe
  2⤵
  PID:12384
- C:\Windows\System\atMkOsW.exe
  C:\Windows\System\atMkOsW.exe
  2⤵
  PID:12412
- C:\Windows\System\xeLKXCo.exe
  C:\Windows\System\xeLKXCo.exe
  2⤵
  PID:12440
- C:\Windows\System\KSnxcnz.exe
  C:\Windows\System\KSnxcnz.exe
  2⤵
  PID:12468
- C:\Windows\System\GqBNuxj.exe
  C:\Windows\System\GqBNuxj.exe
  2⤵
  PID:12496
- C:\Windows\System\BVhteFo.exe
  C:\Windows\System\BVhteFo.exe
  2⤵
  PID:12524
- C:\Windows\System\DkQhlev.exe
  C:\Windows\System\DkQhlev.exe
  2⤵
  PID:12544
- C:\Windows\System\uFkQwrb.exe
  C:\Windows\System\uFkQwrb.exe
  2⤵
  PID:12568
- C:\Windows\System\WQBQDRx.exe
  C:\Windows\System\WQBQDRx.exe
  2⤵
  PID:12584
- C:\Windows\System\OwPUOdY.exe
  C:\Windows\System\OwPUOdY.exe
  2⤵
  PID:12612
- C:\Windows\System\nuvVLdM.exe
  C:\Windows\System\nuvVLdM.exe
  2⤵
  PID:12648
- C:\Windows\System\vPVmjgi.exe
  C:\Windows\System\vPVmjgi.exe
  2⤵
  PID:12684
- C:\Windows\System\lveFxCs.exe
  C:\Windows\System\lveFxCs.exe
  2⤵
  PID:12736
- C:\Windows\System\FYvGhcI.exe
  C:\Windows\System\FYvGhcI.exe
  2⤵
  PID:12760
- C:\Windows\System\juuZDoh.exe
  C:\Windows\System\juuZDoh.exe
  2⤵
  PID:12784
- C:\Windows\System\iIeOdDS.exe
  C:\Windows\System\iIeOdDS.exe
  2⤵
  PID:12820
- C:\Windows\System\RfvgLTZ.exe
  C:\Windows\System\RfvgLTZ.exe
  2⤵
  PID:12836
- C:\Windows\System\mFWBBPM.exe
  C:\Windows\System\mFWBBPM.exe
  2⤵
  PID:12876
- C:\Windows\System\kwFjAeY.exe
  C:\Windows\System\kwFjAeY.exe
  2⤵
  PID:12904
- C:\Windows\System\yaSfeqh.exe
  C:\Windows\System\yaSfeqh.exe
  2⤵
  PID:12920
- C:\Windows\System\HlcNIUL.exe
  C:\Windows\System\HlcNIUL.exe
  2⤵
  PID:12948
- C:\Windows\System\RSgfntB.exe
  C:\Windows\System\RSgfntB.exe
  2⤵
  PID:12976
- C:\Windows\System\lKyjQyv.exe
  C:\Windows\System\lKyjQyv.exe
  2⤵
  PID:13016
- C:\Windows\System\vuVWiOt.exe
  C:\Windows\System\vuVWiOt.exe
  2⤵
  PID:13036
- C:\Windows\System\IvmwnWD.exe
  C:\Windows\System\IvmwnWD.exe
  2⤵
  PID:13072
- C:\Windows\System\UJMpLfV.exe
  C:\Windows\System\UJMpLfV.exe
  2⤵
  PID:13100
- C:\Windows\System\GMiivlp.exe
  C:\Windows\System\GMiivlp.exe
  2⤵
  PID:13124
- C:\Windows\System\uhCWeyg.exe
  C:\Windows\System\uhCWeyg.exe
  2⤵
  PID:13144
- C:\Windows\System\lYmatsV.exe
  C:\Windows\System\lYmatsV.exe
  2⤵
  PID:13176
- C:\Windows\System\EwxOizb.exe
  C:\Windows\System\EwxOizb.exe
  2⤵
  PID:13212
- C:\Windows\System\IxyAaDw.exe
  C:\Windows\System\IxyAaDw.exe
  2⤵
  PID:13240
- C:\Windows\System\onsHMcq.exe
  C:\Windows\System\onsHMcq.exe
  2⤵
  PID:13256
- C:\Windows\System\EKBkrwX.exe
  C:\Windows\System\EKBkrwX.exe
  2⤵
  PID:13272
- C:\Windows\System\WzKGDsf.exe
  C:\Windows\System\WzKGDsf.exe
  2⤵
  PID:11492
- C:\Windows\System\smBELyA.exe
  C:\Windows\System\smBELyA.exe
  2⤵
  PID:12352
- C:\Windows\System\NMHczrE.exe
  C:\Windows\System\NMHczrE.exe
  2⤵
  PID:12436
- C:\Windows\System\fJacavS.exe
  C:\Windows\System\fJacavS.exe
  2⤵
  PID:12508
- C:\Windows\System\AoBMALL.exe
  C:\Windows\System\AoBMALL.exe
  2⤵
  PID:12556
- C:\Windows\System\vgHAXrv.exe
  C:\Windows\System\vgHAXrv.exe
  2⤵
  PID:12604
- C:\Windows\System\ljkxsGK.exe
  C:\Windows\System\ljkxsGK.exe
  2⤵
  PID:12664
- C:\Windows\System\VPnxsDp.exe
  C:\Windows\System\VPnxsDp.exe
  2⤵
  PID:12768
- C:\Windows\System\IjjfsRe.exe
  C:\Windows\System\IjjfsRe.exe
  2⤵
  PID:12808
- C:\Windows\System\aeEtceo.exe
  C:\Windows\System\aeEtceo.exe
  2⤵
  PID:12868
- C:\Windows\System\CGNtbuV.exe
  C:\Windows\System\CGNtbuV.exe
  2⤵
  PID:12968
- C:\Windows\System\BLBCLoq.exe
  C:\Windows\System\BLBCLoq.exe
  2⤵
  PID:13044
- C:\Windows\System\aRPccYw.exe
  C:\Windows\System\aRPccYw.exe
  2⤵
  PID:13088
- C:\Windows\System\scjbMQh.exe
  C:\Windows\System\scjbMQh.exe
  2⤵
  PID:13132
- C:\Windows\System\ZZUkYvo.exe
  C:\Windows\System\ZZUkYvo.exe
  2⤵
  PID:13200
- C:\Windows\System\iMOLoPc.exe
  C:\Windows\System\iMOLoPc.exe
  2⤵
  PID:13300
- C:\Windows\System\xYGnuSg.exe
  C:\Windows\System\xYGnuSg.exe
  2⤵
  PID:12380
- C:\Windows\System\NTnXvpV.exe
  C:\Windows\System\NTnXvpV.exe
  2⤵
  PID:12532
- C:\Windows\System\CIQVEMA.exe
  C:\Windows\System\CIQVEMA.exe
  2⤵
  PID:12636
- C:\Windows\System\MxLLfVI.exe
  C:\Windows\System\MxLLfVI.exe
  2⤵
  PID:12792
- C:\Windows\System\EPWgXIP.exe
  C:\Windows\System\EPWgXIP.exe
  2⤵
  PID:12916
- C:\Windows\System\AMMmYWO.exe
  C:\Windows\System\AMMmYWO.exe
  2⤵
  PID:12964
- C:\Windows\System\PGQZZnX.exe
  C:\Windows\System\PGQZZnX.exe
  2⤵
  PID:13056
- C:\Windows\System\Intjfmw.exe
  C:\Windows\System\Intjfmw.exe
  2⤵
  PID:13184
- C:\Windows\System\qIYTLRo.exe
  C:\Windows\System\qIYTLRo.exe
  2⤵
  PID:12312
- C:\Windows\System\wppMSlT.exe
  C:\Windows\System\wppMSlT.exe
  2⤵
  PID:3148
- C:\Windows\System\nLViuci.exe
  C:\Windows\System\nLViuci.exe
  2⤵
  PID:13296
- C:\Windows\System\cxUvxIx.exe
  C:\Windows\System\cxUvxIx.exe
  2⤵
  PID:4804
- C:\Windows\System\dFbFvYh.exe
  C:\Windows\System\dFbFvYh.exe
  2⤵
  PID:13316
- C:\Windows\System\CbVPPjn.exe
  C:\Windows\System\CbVPPjn.exe
  2⤵
  PID:13348
- C:\Windows\System\qeQWBHS.exe
  C:\Windows\System\qeQWBHS.exe
  2⤵
  PID:13376
- C:\Windows\System\dDxPpiv.exe
  C:\Windows\System\dDxPpiv.exe
  2⤵
  PID:13392
- C:\Windows\System\SzzSzQp.exe
  C:\Windows\System\SzzSzQp.exe
  2⤵
  PID:13432
- C:\Windows\System\GrDKVUJ.exe
  C:\Windows\System\GrDKVUJ.exe
  2⤵
  PID:13460
- C:\Windows\System\vgwSAsu.exe
  C:\Windows\System\vgwSAsu.exe
  2⤵
  PID:13488
- C:\Windows\System\lsndPhD.exe
  C:\Windows\System\lsndPhD.exe
  2⤵
  PID:13516
- C:\Windows\System\bDysmKb.exe
  C:\Windows\System\bDysmKb.exe
  2⤵
  PID:13544
- C:\Windows\System\PquyCNz.exe
  C:\Windows\System\PquyCNz.exe
  2⤵
  PID:13560
- C:\Windows\System\yJzqQGt.exe
  C:\Windows\System\yJzqQGt.exe
  2⤵
  PID:13600
- C:\Windows\System\aFNtYpF.exe
  C:\Windows\System\aFNtYpF.exe
  2⤵
  PID:13628
- C:\Windows\System\NLLDSur.exe
  C:\Windows\System\NLLDSur.exe
  2⤵
  PID:13656
- C:\Windows\System\BocowMf.exe
  C:\Windows\System\BocowMf.exe
  2⤵
  PID:13684
- C:\Windows\System\CUfHIeG.exe
  C:\Windows\System\CUfHIeG.exe
  2⤵
  PID:13712
- C:\Windows\System\ZOKAWjR.exe
  C:\Windows\System\ZOKAWjR.exe
  2⤵
  PID:13740
- C:\Windows\System\CKHfGjE.exe
  C:\Windows\System\CKHfGjE.exe
  2⤵
  PID:13756
- C:\Windows\System\MAvaTHs.exe
  C:\Windows\System\MAvaTHs.exe
  2⤵
  PID:13776
- C:\Windows\System\IPXygnf.exe
  C:\Windows\System\IPXygnf.exe
  2⤵
  PID:13800
- C:\Windows\System\rUXuYQN.exe
  C:\Windows\System\rUXuYQN.exe
  2⤵
  PID:13864
- C:\Windows\System\BtZJYXX.exe
  C:\Windows\System\BtZJYXX.exe
  2⤵
  PID:13884
- C:\Windows\System\bzMeAJI.exe
  C:\Windows\System\bzMeAJI.exe
  2⤵
  PID:13912
- C:\Windows\System\fTZLPWq.exe
  C:\Windows\System\fTZLPWq.exe
  2⤵
  PID:13928
- C:\Windows\System\btpTnnJ.exe
  C:\Windows\System\btpTnnJ.exe
  2⤵
  PID:13968
- C:\Windows\System\hcolOsp.exe
  C:\Windows\System\hcolOsp.exe
  2⤵
  PID:13996
- C:\Windows\System\DiAyQlQ.exe
  C:\Windows\System\DiAyQlQ.exe
  2⤵
  PID:14024
- C:\Windows\System\HrBmtpo.exe
  C:\Windows\System\HrBmtpo.exe
  2⤵
  PID:14052
- C:\Windows\System\xMDEUQl.exe
  C:\Windows\System\xMDEUQl.exe
  2⤵
  PID:14072
- C:\Windows\System\IXWkkPk.exe
  C:\Windows\System\IXWkkPk.exe
  2⤵
  PID:14108
- C:\Windows\System\Vrdzipz.exe
  C:\Windows\System\Vrdzipz.exe
  2⤵
  PID:14128
- C:\Windows\System\nvzjZPM.exe
  C:\Windows\System\nvzjZPM.exe
  2⤵
  PID:14152
- C:\Windows\System\eONJUra.exe
  C:\Windows\System\eONJUra.exe
  2⤵
  PID:14168
- C:\Windows\System\CtYKVfB.exe
  C:\Windows\System\CtYKVfB.exe
  2⤵
  PID:14208
- C:\Windows\System\NvSOkdP.exe
  C:\Windows\System\NvSOkdP.exe
  2⤵
  PID:14236
- C:\Windows\System\OofxYsR.exe
  C:\Windows\System\OofxYsR.exe
  2⤵
  PID:14264
- C:\Windows\System\orUsyjz.exe
  C:\Windows\System\orUsyjz.exe
  2⤵
  PID:14304
- C:\Windows\System\dCqViZQ.exe
  C:\Windows\System\dCqViZQ.exe
  2⤵
  PID:14332
- C:\Windows\System\zbpsPom.exe
  C:\Windows\System\zbpsPom.exe
  2⤵
  PID:4604
- C:\Windows\System\EXtGKKR.exe
  C:\Windows\System\EXtGKKR.exe
  2⤵
  PID:4684
- C:\Windows\System\yhyfsCY.exe
  C:\Windows\System\yhyfsCY.exe
  2⤵
  PID:13384
- C:\Windows\System\FoXFEbR.exe
  C:\Windows\System\FoXFEbR.exe
  2⤵
  PID:13424
- C:\Windows\System\mfqrMsF.exe
  C:\Windows\System\mfqrMsF.exe
  2⤵
  PID:13508
- C:\Windows\System\GjPomVh.exe
  C:\Windows\System\GjPomVh.exe
  2⤵
  PID:13584
- C:\Windows\System\rWPLkZb.exe
  C:\Windows\System\rWPLkZb.exe
  2⤵
  PID:13680
- C:\Windows\System\HomESit.exe
  C:\Windows\System\HomESit.exe
  2⤵
  PID:13724
- C:\Windows\System\rtHaugm.exe
  C:\Windows\System\rtHaugm.exe
  2⤵
  PID:13752
- C:\Windows\System\KybZtQF.exe
  C:\Windows\System\KybZtQF.exe
  2⤵
  PID:13852
- C:\Windows\System\yCllaTA.exe
  C:\Windows\System\yCllaTA.exe
  2⤵
  PID:13924
- C:\Windows\System\kMDCrEg.exe
  C:\Windows\System\kMDCrEg.exe
  2⤵
  PID:13988
- C:\Windows\System\lhnLtPQ.exe
  C:\Windows\System\lhnLtPQ.exe
  2⤵
  PID:14044
- C:\Windows\System\uOsiLej.exe
  C:\Windows\System\uOsiLej.exe
  2⤵
  PID:14092
- C:\Windows\System\cHtVebt.exe
  C:\Windows\System\cHtVebt.exe
  2⤵
  PID:14160
- C:\Windows\System\idqIwEZ.exe
  C:\Windows\System\idqIwEZ.exe
  2⤵
  PID:14192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DTJbHVg.exe

Filesize
2.2MB

MD5
829cd98a635fc6f3f72a811cb56cb7c0

SHA1
f8fc25c12c41d18f9016136da0de81ff558bdabc

SHA256
fdd5cbb6ecca629c41404cf2053dff254fbff462c2478f8278769a66852ef51d

SHA512
045e241f742bdf29de7d340f20f4f416e9002fb6790b08908a339f5d2f500a2c2581ed927a807ca1cc0aa1914c82620f0f216801a173bdb2729e7c3aeaa262aa

Download Submit
C:\Windows\System\DxwIqzs.exe

Filesize
2.2MB

MD5
1b67bb042139c65677a935fc32f21a61

SHA1
ae91ffc04b79dd68b2b87256b6a7fe28a3e947a2

SHA256
9944077a4d762f66aded09ef83e88b0dab0a97598b8ff82ae6c1eef2e570d090

SHA512
83bfe7ff336f2a3c0e5a74cbe777039cd5a2fc271c6027b2d2758a779ca359a2913365828a29033ffaee8b84f128b1733fbfaec51768495a0b998182c4e0b71b

Download Submit
C:\Windows\System\EfTuOcg.exe

Filesize
2.2MB

MD5
8af4e712d07eab6f891ce1173a8fe98d

SHA1
9f8cd0493881eb30cf0ebc70c55d6c5521042961

SHA256
b2aeb9d54ee28bbf4d255088a74a22ac79a5682ac6cd52cd118cd5e802babf21

SHA512
1bf2061c217f307a1f0d51ce73d34b5f4cf9231aee6d422a49be70bef9a18d23442190492a1f9bd67a24d95101e939acca3e016c451c4b824ae02192786d6550

Download Submit
C:\Windows\System\FFsCBVP.exe

Filesize
2.2MB

MD5
dd94758b77ec6be69bd65890c1ceaa08

SHA1
b54053a7db90f8ab17c88036d0735ebc84dbbb68

SHA256
e337160f7aaf329f3e3669b6c3045b0c3aa348dd57ee9da116064a8ec0409bea

SHA512
af69d333dc27c0263e429837b26f587c0fdcf86231a0bf22a7d1e69811b82fc6af202b419ebb1d1754b62af353c65246e8543b315b6d46e07164de1eb87fb20e

Download Submit
C:\Windows\System\FdplWOq.exe

Filesize
2.2MB

MD5
b1a59e35ee76438230af107ddc072b0d

SHA1
435d407786e3d091bc59e383b6a2c86bcdf7e327

SHA256
08fa35adce9bae523e2946a0dc0e3b7c846bd34c3f7fc9e51b2db5874c77ba68

SHA512
df468b8b20c8f8f2f7444af771562bdc96ba6e0fdda62b14979a5dfebe3033a1a8be5852df265ad8a765bf491e69959c239e60c4475b5f4a2e31f1e2521e08e9

Download Submit
C:\Windows\System\GnTMbTG.exe

Filesize
2.2MB

MD5
652d5802b64735698120d7d2cfe50cd7

SHA1
ff158fb42eba16146acac2e0a8b1e358a5988cbf

SHA256
7bfb0b609a234975e58f7c8ed6a959510c363c95fa82799e77d749760e2bab8f

SHA512
2f1328d35870ae7fc7c9489101dcee50ab7c0dbdaff1d64aea7fd0ff373c718dfab25ae136f3f06d34d18c073a90de44e6cc4f42483aa4392dad7773cf4753f4

Download Submit
C:\Windows\System\HusLsdL.exe

Filesize
2.2MB

MD5
ad6a2d331e787d84e0a2f7d12930f54c

SHA1
e7ffb6d308549814c8d2eaa142dc694940a1c38d

SHA256
d38f6c2fec51acf68f83c039edd6f97600d9ea4d1bca65e31851db5e7a92697c

SHA512
367761bb3626c4a56d1dc24349496249bf5e08e515b12322cb5cd600a56c906d731855c2e31cf978412933209dbb1a725fd37fc0076e0f4f872670a249b1ef1b

Download Submit
C:\Windows\System\KnJoKhx.exe

Filesize
2.2MB

MD5
00f5743d3950a188cff87e949f076b2a

SHA1
3db628f1b39f09c50d0c3df4d875565bc829e407

SHA256
cd3083895f5f73e16ccd84bea6e6919cf6720a3f2deba0dafe6fdaa8c96ee359

SHA512
884670f4f9afa1b40aec09e36261afbca5fcb21bf55e32822b5d9e72c84e171904fba176f7240d45cb379923c508f3c3b51fa96b20e2823fe48a94681556a96a

Download Submit
C:\Windows\System\MMbFxoG.exe

Filesize
2.2MB

MD5
c46533a94fd93db002188c185473e04b

SHA1
76b5914e212f12f601ecac4a17480f8d900952c4

SHA256
bf74d653c23e402861a2d6b45ca386a7fbf78ab9b6d0c7629644b632aa01805f

SHA512
1e6c4e043a788a34a45d0ccbe4f88b88fff2a0d68e4c077b6708160942ca23a4a17b0ff3f8ef911b19e4ccdce9fc00cbbfe02871b2bf935e2778b5f7bb800c13

Download Submit
C:\Windows\System\MiySpbt.exe

Filesize
2.2MB

MD5
f3751e42071287ff9dc632842b6fde98

SHA1
edb7302f318ded73b866040a4df41524cd28bbb2

SHA256
c3f578a42fce5baf068a4a52c27dcf17f3abb6268028ece247d7ca7d8ba5dbf6

SHA512
a825cc8d4625574f657499939e9b9907053ea045cbcc28e2e595079009d2292f10f7e6fc0e5012d2afaa57baf203309c88975d4ed1e12f3f1b328922778da90a

Download Submit
C:\Windows\System\QGIEbdi.exe

Filesize
2.2MB

MD5
21bce9cd87291ab63cfa6b05e58f258c

SHA1
eda48bc20b75ee8511d772a73c551552e66ee897

SHA256
343c88a22fd072185b383ea58ea19e661569dcd7a689a30aae46c6e311d84642

SHA512
9195f478342f35afdae7e8e3f63a3e3ea4aad89dd5a1fcfa926f4b56e43b8a5ee276d0d249859d67ded9ee6330b17961d48771d60aae0f1af51fe7355b7d1e4f

Download Submit
C:\Windows\System\QHqDTVy.exe

Filesize
2.2MB

MD5
480b09746e505844399a5c4d07a3971d

SHA1
54da7a06d54af6041ae443aef86258d392220d57

SHA256
50f84708372931e48232abcb3ee6de49cdb04dbe1e23c617c0c4e92112931ca1

SHA512
cb131f042493e075f44fc96af93663e36f29f6d046b3768fc7e0fe5a16a3376133706c14ad81f99f77e4e0b96e31054f77afbb545c993269ba6f6baa0e34abda

Download Submit
C:\Windows\System\QKPwSvl.exe

Filesize
2.2MB

MD5
3e0449cfdb6e0002c33188e2d2a54d0d

SHA1
471735ba3abe5fc3ba9b12239158081d4df331cb

SHA256
e4857205216fc0613e238810e1401c4b8a9eabdd1895d998ba8e213b7ffb0559

SHA512
36a7bbd6f926d3a4f26116bd7509c3105d8284f5599d4da5a588a985528c58ac1f3e8c7043a3ea0da377b702aa25c363795ca7464b2bb1f6bc913f75fe7f31e3

Download Submit
C:\Windows\System\QfSDaXW.exe

Filesize
2.2MB

MD5
9f04641e328b1cdead69818789811dd3

SHA1
3c851e73da5ff5216a6beedd455e22304182b151

SHA256
a25199cc0387cfb1aa7362b596b713b6ca8d33279ff7b27008c9082f65e3f096

SHA512
06bf03dd8d5812152fd9c64ad6147888981467c4a42a2c0e2295f45aa843d005683c405b7e5edb91a69e76bb1284a89dc8eb81b527583267a5a96af8cd06e442

Download Submit
C:\Windows\System\QrCHiHN.exe

Filesize
2.2MB

MD5
dcb76352e459d9484bb12bd819a3b99d

SHA1
d21e2a026b137de058c47b227d01fbf4cd5667ff

SHA256
9141de7b950654fd7a7fa2a6b3f546bf3c5abb757cb1d120722c3b624e474c36

SHA512
475593054a2759b5dbd60eace2789fae81e3aa73d2e8a14a683e6b02397cae2cad9d331e5bf7302c80388526fb818ab86770fc10bd48853560b2005890d36e5f

Download Submit
C:\Windows\System\WAgVkii.exe

Filesize
2.2MB

MD5
d634409baf7e00eb73cca16f16413c53

SHA1
9d2fd23683ae12fe58b9b0ffd85dd062e1ae1f32

SHA256
06f443ea7d2a36be8306e696fa2483e37b78fe88c636f4f43b9530d14171cac0

SHA512
792388b08e5f47a9a6b1485ea3b13417c1f8831433b74e5dd3f81ea86629f344287b802befdadeec9e3698d168ec79a50d04b657472c71c6665e15455b62104b

Download Submit
C:\Windows\System\YUQvINz.exe

Filesize
2.2MB

MD5
1ed218bcb536a23194c4f798422a3b8f

SHA1
7d5f8272d7d5c58d2dd559f3002a9b76206701cd

SHA256
9bd043854ec28982777b6f5a1f77a462ca4c3aed5e899f664c31f0e0b9b2ad6a

SHA512
6b2d6c2d1416d71587756b80876008b99cdc5b81aae0ec39e738f473a8b0a6f4546663a327776ccc4cdac623309584b86d4d61d65f13f3217108ac1c1199bf2b

Download Submit
C:\Windows\System\YnbdgSY.exe

Filesize
2.2MB

MD5
2ddc9f93802d609301f213f35d3d7cf7

SHA1
48ab33fe1c5f1ad8835867a38abe8bfa9a05472b

SHA256
483208f84ca08c003e2081a07e90f8cf617e9e0d4847b5f262c96e90ebf70298

SHA512
54c7762e899e4c8b18eb253a246eebac4b923db3b05628a82dfbb0ff950adabad9d277a9653fbef9685d7264e1ef87bbed55f8b8466ea0329f356b5f842083ef

Download Submit
C:\Windows\System\ZyhUPXl.exe

Filesize
2.2MB

MD5
32b41c94ced38833a81264fddec3b121

SHA1
83bb1dc669dba7f655e403aa6f2be8b3bf1799f5

SHA256
bdebc02f53ed54dcb00560edeefb3ea2beaf3c7bb206f454b96f7f99ad8d1006

SHA512
ed2a9dff02f98a91090f4b139c019f9f02116b0563fa2018ae6294afcb56ddb54fe2a57a205dc1ce1db506f18bc6c75dd48e7ef28900518d1bc37b36828a904d

Download Submit
C:\Windows\System\bsDGTdQ.exe

Filesize
2.2MB

MD5
a893359f2871bb2a864c922cf3c7a7aa

SHA1
62ba625f6e7fd1c2b60930cea096792802662dd6

SHA256
df00f9bc1ec20e638d626f3332d88ffc0d73c9daf58ffc638a27597f80a2833a

SHA512
5cdaec7a988d742436670cf5c0b83b81abe6d31b304d6677783fc5b9f60b5424088df925848ed231483405d816d30b6f2beec08d2ec46a1aac58836330f648ec

Download Submit
C:\Windows\System\dHchBAx.exe

Filesize
2.2MB

MD5
92998f033b15a5cc992987e3bce470e0

SHA1
b5c552473fbf933287163e94c3ea0b7cc2aabee8

SHA256
2d348656d50da8a17e21ee5ee39f9f55b8a9c5723dd1e6b8217b4625f9fceb77

SHA512
5c55f3a0ecded750b5309c2f9acc5c9e23a939ec59839bb7c7c04fda94e0806d46d4f9ae3ad132938cc4d9522f18d7d6a293943db5feb43503f0a86ce5e9a30d

Download Submit
C:\Windows\System\dUMuEWH.exe

Filesize
2.2MB

MD5
96847f004cc58a9bdf979137271a687f

SHA1
944d31beb199d2897b1af7b3a6552276025f6642

SHA256
14a730170ed59da3f9d12d9ee211b5c18c50e0a821754535db438fa76eaf0132

SHA512
041b8ca86af3c454d222c3be3881db14d00e924d06b8e5a2352370cdd05eb7d861d3c1368753c05981200673dc8628559c17fda1fada6a2d179b1fa2cdaaee5a

Download Submit
C:\Windows\System\hXqBLDB.exe

Filesize
2.2MB

MD5
308ec6cb244aa4affaf97c216c9e8308

SHA1
d9a6381376031360382ccd8c6dd7c5381ec8ced2

SHA256
77c0c8f70fc10ceb6beac4dbb00b4c9a3fd62325dcdd9af4b374183ced437f67

SHA512
d5c926592fc4dff9e42b4a40626b1678807d7d9396c08a4ba9029545b59a9ed0c96586ed729f17ba64cce6d2fcc96b15a043aff5fb9f90fc983b5a37d495e4da

Download Submit
C:\Windows\System\jMvsdvp.exe

Filesize
2.2MB

MD5
a4e28e57490100d531be97fa8f0af171

SHA1
3d9fda8577fc20030f3c34172dfde7b5aa46ab3e

SHA256
2d8ebaacaa94fb76e2a312c4fc1bfc6618fe25d9c139c671885290030b560618

SHA512
486f8b84af456add744eb8fff383174517ecd7af12305f303adad31bb4b752bd3a525fc362fb92c0da8f76770d6983cebae3c344a71148c77e47aaf30acd71ae

Download Submit
C:\Windows\System\jhLlNSy.exe

Filesize
2.2MB

MD5
0a7b0e84ffa54d4a15faaab837180fb3

SHA1
63699a74d8f5709ac83ffae162ad6f3992c0b0a8

SHA256
67a2fd9320491bbc47593ac0c34ea3c9bd448a5028241665aa5c8a9c0c702481

SHA512
119884aa701ae2996c076decd82e09c923f56be89aaf82cb938bbc4fd342c159b052849d50d705d01f4cae1576899d5244c3edddba82c0c9b24f4fabf9f22a6f

Download Submit
C:\Windows\System\mgjZORp.exe

Filesize
2.2MB

MD5
d11d56703c428dcb7a5a2b88268fb563

SHA1
5a03f59fa7ef1f8daf048164b4a0f2857c951ae2

SHA256
69c4b58c1f77aadb7a2208a3acf15d6c1210564c50ae45af0831bc46dd652254

SHA512
4b9454c393c622f4d1adc69f7d232e724599a7631a0c1decefddd34b2f1f46bd1b6446e3c7bd5ce27400a1e1cdf5500855c7127711ebbbfb0934be953c3422d7

Download Submit
C:\Windows\System\oCAjpBO.exe

Filesize
2.2MB

MD5
918e7819744d6f4b05c09f4f09e76855

SHA1
4f9a7e6eab010aa96d92998b746d39b88f5068f9

SHA256
ad1bae93dd94a1c55067188fe2ea95f3a0e3f63a02890406355ff59ac2f15407

SHA512
28aca014e9c3d57f0dae74d02ced6fccc8bfba6bf7e1fd9575fdeb146d727b159c16ed37b6c66841a03bb06f38372d7dd70557be830f0e1f6f52dff18f4ef20c

Download Submit
C:\Windows\System\pNXipNe.exe

Filesize
2.2MB

MD5
84aca1baa3cca1b1ca33eb704b19922c

SHA1
037042d32a4194bff2e642fae5f691e134a3da24

SHA256
4606e7142a3908931626f90b1795e5498bde0007d1ed73423f28f0c32b1861ad

SHA512
9962ca45c0f99e52749848c76af9e293a781f04e8a6fbba34c755bc212de788175cf63ef3eceb7996f3c2e34de351cf08d13b40d0915741286e94db8291f1596

Download Submit
C:\Windows\System\rkmrsnG.exe

Filesize
2.2MB

MD5
af4d60d2f74782da090b4fb47a11a9aa

SHA1
44e2feb18d67bae898fda9bda1959a1bf5a17b70

SHA256
25c2bd1801049d37d2990ec680cc947813d8d459cbaa91d20c0f539f1b249318

SHA512
b4f322e2de8b7f02c817d7ed3433b282a506d83fd4ceb58b38fd3184f2850129cb2e02833c78adfe8acbc67ffa9d35cd1b9a6c04b09dbd4eed444c101a7d1df7

Download Submit
C:\Windows\System\uIkWAdP.exe

Filesize
2.2MB

MD5
ab1d6bd668d983ced7561290dadf7c3e

SHA1
042e82267ca8647ffcd4d94f784a84c0e5152cc8

SHA256
a2e6488b87801c96f253ba6146e81c12cbb5ea1ca158453d384989d58b19081c

SHA512
63d1837056f8c5ce37383edd7cc850410f0813b50ac7aa8c984b4fdd1657899d81b2cf6a8f57820739ced1481b73c926a791414cf6aff7e52e0f95ed3fcce580

Download Submit
C:\Windows\System\uqEgAWX.exe

Filesize
2.2MB

MD5
5d89d3af14da58159011293d19bd091f

SHA1
57f45753301b4ff7e1a951041718d73e602aafc3

SHA256
8b3fb1b821b0a6e651426da1e5d18bc4e11dd686c77e65f305a77b99386e1161

SHA512
17ce55c45078b2cfcd6d2ec06740609cebccf5e9692ec50927a6dad639fa7e7b839001413ec8ad7b621977995020d1530a3b91608ae410dbf7e37440fb5b89b6

Download Submit
C:\Windows\System\xLWwJDD.exe

Filesize
2.2MB

MD5
52d91c71ae35d22cde8c6106e151ab54

SHA1
b51453ae57ae967801cefd6b688a4946abe2dc81

SHA256
e96bd1de34b856b8d5e280a69935d59621b218d174df4654d6edd50d3f0432a0

SHA512
a14b3ae75b9ca6cb97b54fbcbb4c34bc3a895c09581975e193dd7f502128b5b39a23e6f18a07566f44eb456f5d229b98587de835f11e5aceee9814c330f4e4f6

Download Submit
C:\Windows\System\yvNNaUH.exe

Filesize
2.2MB

MD5
6ccd34ab56828c21157b6941dab9fa95

SHA1
a8775b601c976342182cc92dd6dcd2dd20bc77d3

SHA256
474836193abb817cbebebb3059dbf0c5fda00ec981deb20f8342a11fd127b3c3

SHA512
dcac4b1e9c37eb5602dba730fc7a5fadc9af860a72f37e5788f7a5e339b432767363d49a352bc519a1de36211acbf1e0114e2861d4c71e28db37e4faffaf5375

Download Submit
memory/64-718-0x00007FF64BBD0000-0x00007FF64BF24000-memory.dmp

Filesize
3.3MB

Download
memory/64-2126-0x00007FF64BBD0000-0x00007FF64BF24000-memory.dmp

Filesize
3.3MB

Download
memory/540-29-0x00007FF6578E0000-0x00007FF657C34000-memory.dmp

Filesize
3.3MB

Download
memory/540-2107-0x00007FF6578E0000-0x00007FF657C34000-memory.dmp

Filesize
3.3MB

Download
memory/1012-2100-0x00007FF7CC150000-0x00007FF7CC4A4000-memory.dmp

Filesize
3.3MB

Download
memory/1012-7-0x00007FF7CC150000-0x00007FF7CC4A4000-memory.dmp

Filesize
3.3MB

Download
memory/1012-2104-0x00007FF7CC150000-0x00007FF7CC4A4000-memory.dmp

Filesize
3.3MB

Download
memory/1560-2113-0x00007FF6828D0000-0x00007FF682C24000-memory.dmp

Filesize
3.3MB

Download
memory/1560-657-0x00007FF6828D0000-0x00007FF682C24000-memory.dmp

Filesize
3.3MB

Download
memory/1732-2125-0x00007FF6977B0000-0x00007FF697B04000-memory.dmp

Filesize
3.3MB

Download
memory/1732-719-0x00007FF6977B0000-0x00007FF697B04000-memory.dmp

Filesize
3.3MB

Download
memory/2392-2131-0x00007FF6C1290000-0x00007FF6C15E4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-704-0x00007FF6C1290000-0x00007FF6C15E4000-memory.dmp

Filesize
3.3MB

Download
memory/2540-2106-0x00007FF6C4310000-0x00007FF6C4664000-memory.dmp

Filesize
3.3MB

Download
memory/2540-2101-0x00007FF6C4310000-0x00007FF6C4664000-memory.dmp

Filesize
3.3MB

Download
memory/2540-19-0x00007FF6C4310000-0x00007FF6C4664000-memory.dmp

Filesize
3.3MB

Download
memory/2728-2127-0x00007FF6A3790000-0x00007FF6A3AE4000-memory.dmp

Filesize
3.3MB

Download
memory/2728-717-0x00007FF6A3790000-0x00007FF6A3AE4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-2112-0x00007FF6124D0000-0x00007FF612824000-memory.dmp

Filesize
3.3MB

Download
memory/2752-663-0x00007FF6124D0000-0x00007FF612824000-memory.dmp

Filesize
3.3MB

Download
memory/2832-712-0x00007FF637210000-0x00007FF637564000-memory.dmp

Filesize
3.3MB

Download
memory/2832-2128-0x00007FF637210000-0x00007FF637564000-memory.dmp

Filesize
3.3MB

Download
memory/2984-2118-0x00007FF7A0710000-0x00007FF7A0A64000-memory.dmp

Filesize
3.3MB

Download
memory/2984-638-0x00007FF7A0710000-0x00007FF7A0A64000-memory.dmp

Filesize
3.3MB

Download
memory/3096-711-0x00007FF6DE100000-0x00007FF6DE454000-memory.dmp

Filesize
3.3MB

Download
memory/3096-2129-0x00007FF6DE100000-0x00007FF6DE454000-memory.dmp

Filesize
3.3MB

Download
memory/3200-693-0x00007FF7CD3C0000-0x00007FF7CD714000-memory.dmp

Filesize
3.3MB

Download
memory/3200-2123-0x00007FF7CD3C0000-0x00007FF7CD714000-memory.dmp

Filesize
3.3MB

Download
memory/3676-2110-0x00007FF7FDEB0000-0x00007FF7FE204000-memory.dmp

Filesize
3.3MB

Download
memory/3676-726-0x00007FF7FDEB0000-0x00007FF7FE204000-memory.dmp

Filesize
3.3MB

Download
memory/3696-0-0x00007FF63F1F0000-0x00007FF63F544000-memory.dmp

Filesize
3.3MB

Download
memory/3696-1-0x0000025285780000-0x0000025285790000-memory.dmp

Filesize
64KB

Download
memory/3696-2014-0x00007FF63F1F0000-0x00007FF63F544000-memory.dmp

Filesize
3.3MB

Download
memory/3848-2130-0x00007FF668F90000-0x00007FF6692E4000-memory.dmp

Filesize
3.3MB

Download
memory/3848-709-0x00007FF668F90000-0x00007FF6692E4000-memory.dmp

Filesize
3.3MB

Download
memory/3956-2108-0x00007FF6AE8F0000-0x00007FF6AEC44000-memory.dmp

Filesize
3.3MB

Download
memory/3956-32-0x00007FF6AE8F0000-0x00007FF6AEC44000-memory.dmp

Filesize
3.3MB

Download
memory/3956-2102-0x00007FF6AE8F0000-0x00007FF6AEC44000-memory.dmp

Filesize
3.3MB

Download
memory/3968-2132-0x00007FF615890000-0x00007FF615BE4000-memory.dmp

Filesize
3.3MB

Download
memory/3968-706-0x00007FF615890000-0x00007FF615BE4000-memory.dmp

Filesize
3.3MB

Download
memory/4016-641-0x00007FF62C7C0000-0x00007FF62CB14000-memory.dmp

Filesize
3.3MB

Download
memory/4016-2115-0x00007FF62C7C0000-0x00007FF62CB14000-memory.dmp

Filesize
3.3MB

Download
memory/4068-14-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp

Filesize
3.3MB

Download
memory/4068-2105-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp

Filesize
3.3MB

Download
memory/4200-639-0x00007FF6456C0000-0x00007FF645A14000-memory.dmp

Filesize
3.3MB

Download
memory/4200-2117-0x00007FF6456C0000-0x00007FF645A14000-memory.dmp

Filesize
3.3MB

Download
memory/4420-684-0x00007FF6A4360000-0x00007FF6A46B4000-memory.dmp

Filesize
3.3MB

Download
memory/4420-2122-0x00007FF6A4360000-0x00007FF6A46B4000-memory.dmp

Filesize
3.3MB

Download
memory/4448-2120-0x00007FF7003A0000-0x00007FF7006F4000-memory.dmp

Filesize
3.3MB

Download
memory/4448-678-0x00007FF7003A0000-0x00007FF7006F4000-memory.dmp

Filesize
3.3MB

Download
memory/4504-2121-0x00007FF6576C0000-0x00007FF657A14000-memory.dmp

Filesize
3.3MB

Download
memory/4504-681-0x00007FF6576C0000-0x00007FF657A14000-memory.dmp

Filesize
3.3MB

Download
memory/4616-673-0x00007FF6A6E00000-0x00007FF6A7154000-memory.dmp

Filesize
3.3MB

Download
memory/4616-2111-0x00007FF6A6E00000-0x00007FF6A7154000-memory.dmp

Filesize
3.3MB

Download
memory/4692-677-0x00007FF610E50000-0x00007FF6111A4000-memory.dmp

Filesize
3.3MB

Download
memory/4692-2119-0x00007FF610E50000-0x00007FF6111A4000-memory.dmp

Filesize
3.3MB

Download
memory/4856-2124-0x00007FF680CE0000-0x00007FF681034000-memory.dmp

Filesize
3.3MB

Download
memory/4856-690-0x00007FF680CE0000-0x00007FF681034000-memory.dmp

Filesize
3.3MB

Download
memory/5012-2116-0x00007FF633890000-0x00007FF633BE4000-memory.dmp

Filesize
3.3MB

Download
memory/5012-640-0x00007FF633890000-0x00007FF633BE4000-memory.dmp

Filesize
3.3MB

Download
memory/5052-648-0x00007FF7B11A0000-0x00007FF7B14F4000-memory.dmp

Filesize
3.3MB

Download
memory/5052-2114-0x00007FF7B11A0000-0x00007FF7B14F4000-memory.dmp

Filesize
3.3MB

Download
memory/5072-2103-0x00007FF61F290000-0x00007FF61F5E4000-memory.dmp

Filesize
3.3MB

Download
memory/5072-2109-0x00007FF61F290000-0x00007FF61F5E4000-memory.dmp

Filesize
3.3MB

Download
memory/5072-637-0x00007FF61F290000-0x00007FF61F5E4000-memory.dmp

Filesize
3.3MB

Download