xmrig | 04abf5387bb4f6dc602e662b4dfb68620512f1dfe188c047ee85de3a1e047825

Analysis

max time kernel
96s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
Size

2.3MB
MD5

99785520d3017cb6005b93aa64542390
SHA1

601bbcd0fd5ae7a067e74def26a032080bdc10a8
SHA256

04abf5387bb4f6dc602e662b4dfb68620512f1dfe188c047ee85de3a1e047825
SHA512

9f132aa3ab96997bdc17936118d1b154f918d99ce409d0661c368588a88d05b9a7e403bdfda102ec398519c4a3c85eb2ec771479dd3b59abd1b1ed8bf12f2bff
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+A4VBqxGLI9eP:BemTLkNdfE0pZrD

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1844-0-0x00007FF7AF140000-0x00007FF7AF494000-memory.dmp	xmrig
behavioral2/files/0x000800000002340e-5.dat	xmrig
behavioral2/files/0x0007000000023412-7.dat	xmrig
behavioral2/files/0x0008000000023411-8.dat	xmrig
behavioral2/files/0x0007000000023413-23.dat	xmrig
behavioral2/files/0x0007000000023418-47.dat	xmrig
behavioral2/files/0x000700000002341b-62.dat	xmrig
behavioral2/files/0x000700000002341c-71.dat	xmrig
behavioral2/files/0x0007000000023420-91.dat	xmrig
behavioral2/files/0x0007000000023423-100.dat	xmrig
behavioral2/files/0x0007000000023429-132.dat	xmrig
behavioral2/files/0x000700000002342b-146.dat	xmrig
behavioral2/files/0x000700000002342e-161.dat	xmrig
behavioral2/memory/1548-648-0x00007FF720DB0000-0x00007FF721104000-memory.dmp	xmrig
behavioral2/memory/1864-649-0x00007FF675740000-0x00007FF675A94000-memory.dmp	xmrig
behavioral2/memory/2024-650-0x00007FF6F0A80000-0x00007FF6F0DD4000-memory.dmp	xmrig
behavioral2/memory/3508-651-0x00007FF70A3D0000-0x00007FF70A724000-memory.dmp	xmrig
behavioral2/memory/324-652-0x00007FF6C5E50000-0x00007FF6C61A4000-memory.dmp	xmrig
behavioral2/memory/2288-653-0x00007FF72A3E0000-0x00007FF72A734000-memory.dmp	xmrig
behavioral2/memory/3496-654-0x00007FF7D4760000-0x00007FF7D4AB4000-memory.dmp	xmrig
behavioral2/memory/1396-655-0x00007FF787010000-0x00007FF787364000-memory.dmp	xmrig
behavioral2/memory/4696-656-0x00007FF7A36F0000-0x00007FF7A3A44000-memory.dmp	xmrig
behavioral2/memory/3672-658-0x00007FF6B31C0000-0x00007FF6B3514000-memory.dmp	xmrig
behavioral2/memory/2648-657-0x00007FF6DC230000-0x00007FF6DC584000-memory.dmp	xmrig
behavioral2/memory/400-670-0x00007FF679320000-0x00007FF679674000-memory.dmp	xmrig
behavioral2/memory/1652-685-0x00007FF7C0F30000-0x00007FF7C1284000-memory.dmp	xmrig
behavioral2/memory/5056-695-0x00007FF6629A0000-0x00007FF662CF4000-memory.dmp	xmrig
behavioral2/memory/1920-709-0x00007FF7496E0000-0x00007FF749A34000-memory.dmp	xmrig
behavioral2/memory/912-714-0x00007FF70AF30000-0x00007FF70B284000-memory.dmp	xmrig
behavioral2/memory/1296-717-0x00007FF7C0690000-0x00007FF7C09E4000-memory.dmp	xmrig
behavioral2/memory/4428-720-0x00007FF613EB0000-0x00007FF614204000-memory.dmp	xmrig
behavioral2/memory/3184-721-0x00007FF78FD80000-0x00007FF7900D4000-memory.dmp	xmrig
behavioral2/memory/2580-719-0x00007FF69AF60000-0x00007FF69B2B4000-memory.dmp	xmrig
behavioral2/memory/4964-713-0x00007FF7DED60000-0x00007FF7DF0B4000-memory.dmp	xmrig
behavioral2/memory/2408-708-0x00007FF642D60000-0x00007FF6430B4000-memory.dmp	xmrig
behavioral2/memory/4612-705-0x00007FF62FB80000-0x00007FF62FED4000-memory.dmp	xmrig
behavioral2/memory/2104-693-0x00007FF66DDF0000-0x00007FF66E144000-memory.dmp	xmrig
behavioral2/memory/3388-691-0x00007FF711160000-0x00007FF7114B4000-memory.dmp	xmrig
behavioral2/memory/1068-690-0x00007FF65E090000-0x00007FF65E3E4000-memory.dmp	xmrig
behavioral2/memory/1668-678-0x00007FF739740000-0x00007FF739A94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-165.dat	xmrig
behavioral2/files/0x000700000002342f-160.dat	xmrig
behavioral2/files/0x000700000002342d-155.dat	xmrig
behavioral2/files/0x000700000002342c-151.dat	xmrig
behavioral2/files/0x000700000002342a-141.dat	xmrig
behavioral2/files/0x0007000000023428-130.dat	xmrig
behavioral2/files/0x0007000000023427-126.dat	xmrig
behavioral2/files/0x0007000000023426-121.dat	xmrig
behavioral2/files/0x0007000000023425-116.dat	xmrig
behavioral2/files/0x0007000000023424-111.dat	xmrig
behavioral2/files/0x0007000000023422-101.dat	xmrig
behavioral2/files/0x0007000000023421-95.dat	xmrig
behavioral2/files/0x000700000002341f-83.dat	xmrig
behavioral2/files/0x000700000002341e-80.dat	xmrig
behavioral2/files/0x000700000002341d-76.dat	xmrig
behavioral2/files/0x000700000002341a-60.dat	xmrig
behavioral2/files/0x0007000000023419-56.dat	xmrig
behavioral2/files/0x0007000000023417-43.dat	xmrig
behavioral2/files/0x0007000000023416-38.dat	xmrig
behavioral2/files/0x0007000000023415-33.dat	xmrig
behavioral2/files/0x0007000000023414-28.dat	xmrig
behavioral2/memory/880-17-0x00007FF6405F0000-0x00007FF640944000-memory.dmp	xmrig
behavioral2/memory/3504-11-0x00007FF7D9F50000-0x00007FF7DA2A4000-memory.dmp	xmrig
behavioral2/memory/880-2112-0x00007FF6405F0000-0x00007FF640944000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3504	MOpfPSz.exe
880	xAnnWbO.exe
1548	uuujcHf.exe
3184	hjwJZSG.exe
1864	bAURlwE.exe
2024	JBjbkBw.exe
3508	WwItaHi.exe
324	JHHUuvT.exe
2288	NoraCut.exe
3496	fRGqFzm.exe
1396	eWQTeIc.exe
4696	qJLYsIR.exe
2648	wQSHclv.exe
3672	zOWonyJ.exe
400	qaAFqxn.exe
1668	coTJnxd.exe
1652	hXxwvJQ.exe
1068	EPzdUPq.exe
3388	pTSrOTL.exe
2104	kFHTmGp.exe
5056	YOLXLte.exe
4612	hBmwTgB.exe
2408	DDRrsiE.exe
1920	nhTpoFV.exe
4964	uLtCmXv.exe
912	miLnKqF.exe
1296	xifNhvl.exe
2580	ebKVOTC.exe
4428	KXURILG.exe
4544	yGAgZOB.exe
1812	kHLkYuj.exe
2156	WNJjNKc.exe
4024	hjabSXA.exe
4288	VYtczIR.exe
2928	uUlbNRA.exe
1952	lYOKmvu.exe
744	ARZQCsq.exe
1732	TfuSHFd.exe
4952	jcWssOb.exe
4452	BnzFpJX.exe
3468	SGXNTXE.exe
4632	SyqXqnF.exe
3480	UQuqeYO.exe
2716	hCQrrlg.exe
4828	pllICMN.exe
4764	NSDHock.exe
1792	RJiiEud.exe
1908	mOvtAUe.exe
2076	lKVJNhu.exe
2804	vBOitSd.exe
5060	xAodJAt.exe
1564	IADnsbs.exe
4444	EShjJmQ.exe
4028	atjkBbw.exe
3724	aMVjiSX.exe
4052	iDYebbZ.exe
3152	fjNjpwW.exe
3140	zFcdhtv.exe
3412	ortkAiC.exe
3536	SyzGfMq.exe
1072	uDBeiNp.exe
2092	qzUDmpD.exe
436	VfkPVBG.exe
528	vCucbtR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1844-0-0x00007FF7AF140000-0x00007FF7AF494000-memory.dmp	upx
behavioral2/files/0x000800000002340e-5.dat	upx
behavioral2/files/0x0007000000023412-7.dat	upx
behavioral2/files/0x0008000000023411-8.dat	upx
behavioral2/files/0x0007000000023413-23.dat	upx
behavioral2/files/0x0007000000023418-47.dat	upx
behavioral2/files/0x000700000002341b-62.dat	upx
behavioral2/files/0x000700000002341c-71.dat	upx
behavioral2/files/0x0007000000023420-91.dat	upx
behavioral2/files/0x0007000000023423-100.dat	upx
behavioral2/files/0x0007000000023429-132.dat	upx
behavioral2/files/0x000700000002342b-146.dat	upx
behavioral2/files/0x000700000002342e-161.dat	upx
behavioral2/memory/1548-648-0x00007FF720DB0000-0x00007FF721104000-memory.dmp	upx
behavioral2/memory/1864-649-0x00007FF675740000-0x00007FF675A94000-memory.dmp	upx
behavioral2/memory/2024-650-0x00007FF6F0A80000-0x00007FF6F0DD4000-memory.dmp	upx
behavioral2/memory/3508-651-0x00007FF70A3D0000-0x00007FF70A724000-memory.dmp	upx
behavioral2/memory/324-652-0x00007FF6C5E50000-0x00007FF6C61A4000-memory.dmp	upx
behavioral2/memory/2288-653-0x00007FF72A3E0000-0x00007FF72A734000-memory.dmp	upx
behavioral2/memory/3496-654-0x00007FF7D4760000-0x00007FF7D4AB4000-memory.dmp	upx
behavioral2/memory/1396-655-0x00007FF787010000-0x00007FF787364000-memory.dmp	upx
behavioral2/memory/4696-656-0x00007FF7A36F0000-0x00007FF7A3A44000-memory.dmp	upx
behavioral2/memory/3672-658-0x00007FF6B31C0000-0x00007FF6B3514000-memory.dmp	upx
behavioral2/memory/2648-657-0x00007FF6DC230000-0x00007FF6DC584000-memory.dmp	upx
behavioral2/memory/400-670-0x00007FF679320000-0x00007FF679674000-memory.dmp	upx
behavioral2/memory/1652-685-0x00007FF7C0F30000-0x00007FF7C1284000-memory.dmp	upx
behavioral2/memory/5056-695-0x00007FF6629A0000-0x00007FF662CF4000-memory.dmp	upx
behavioral2/memory/1920-709-0x00007FF7496E0000-0x00007FF749A34000-memory.dmp	upx
behavioral2/memory/912-714-0x00007FF70AF30000-0x00007FF70B284000-memory.dmp	upx
behavioral2/memory/1296-717-0x00007FF7C0690000-0x00007FF7C09E4000-memory.dmp	upx
behavioral2/memory/4428-720-0x00007FF613EB0000-0x00007FF614204000-memory.dmp	upx
behavioral2/memory/3184-721-0x00007FF78FD80000-0x00007FF7900D4000-memory.dmp	upx
behavioral2/memory/2580-719-0x00007FF69AF60000-0x00007FF69B2B4000-memory.dmp	upx
behavioral2/memory/4964-713-0x00007FF7DED60000-0x00007FF7DF0B4000-memory.dmp	upx
behavioral2/memory/2408-708-0x00007FF642D60000-0x00007FF6430B4000-memory.dmp	upx
behavioral2/memory/4612-705-0x00007FF62FB80000-0x00007FF62FED4000-memory.dmp	upx
behavioral2/memory/2104-693-0x00007FF66DDF0000-0x00007FF66E144000-memory.dmp	upx
behavioral2/memory/3388-691-0x00007FF711160000-0x00007FF7114B4000-memory.dmp	upx
behavioral2/memory/1068-690-0x00007FF65E090000-0x00007FF65E3E4000-memory.dmp	upx
behavioral2/memory/1668-678-0x00007FF739740000-0x00007FF739A94000-memory.dmp	upx
behavioral2/files/0x0007000000023430-165.dat	upx
behavioral2/files/0x000700000002342f-160.dat	upx
behavioral2/files/0x000700000002342d-155.dat	upx
behavioral2/files/0x000700000002342c-151.dat	upx
behavioral2/files/0x000700000002342a-141.dat	upx
behavioral2/files/0x0007000000023428-130.dat	upx
behavioral2/files/0x0007000000023427-126.dat	upx
behavioral2/files/0x0007000000023426-121.dat	upx
behavioral2/files/0x0007000000023425-116.dat	upx
behavioral2/files/0x0007000000023424-111.dat	upx
behavioral2/files/0x0007000000023422-101.dat	upx
behavioral2/files/0x0007000000023421-95.dat	upx
behavioral2/files/0x000700000002341f-83.dat	upx
behavioral2/files/0x000700000002341e-80.dat	upx
behavioral2/files/0x000700000002341d-76.dat	upx
behavioral2/files/0x000700000002341a-60.dat	upx
behavioral2/files/0x0007000000023419-56.dat	upx
behavioral2/files/0x0007000000023417-43.dat	upx
behavioral2/files/0x0007000000023416-38.dat	upx
behavioral2/files/0x0007000000023415-33.dat	upx
behavioral2/files/0x0007000000023414-28.dat	upx
behavioral2/memory/880-17-0x00007FF6405F0000-0x00007FF640944000-memory.dmp	upx
behavioral2/memory/3504-11-0x00007FF7D9F50000-0x00007FF7DA2A4000-memory.dmp	upx
behavioral2/memory/880-2112-0x00007FF6405F0000-0x00007FF640944000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HAqGPzB.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\oAcuThk.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\SkbYYgv.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\VAlHZEc.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\oshWppf.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\lZawMmt.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\eWQTeIc.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\SLyEQGM.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\rnOuvGW.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\XEIFeed.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\WLbrYGd.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\jXWQHyo.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\njxeBBR.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\bqRNHbc.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\yziXHBj.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\nGsvBNX.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\GAyoPOC.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\WtdQrWw.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\GDgvIff.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\gHxuufL.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\yJJHvXG.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\UfzqwIQ.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\ARZQCsq.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\xAodJAt.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\sLpkNDu.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\DDvFIbS.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\kaTnVqD.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\XklZnUW.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\wPUgTxH.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\ntEzqFh.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\XfJUFXp.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\FpllRvU.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\ViCdqnx.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\EMayMSv.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\jRwNCfd.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\rqIbauV.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\WpuzGrY.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\ZuUekyx.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\cBORegW.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\uLtCmXv.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\zFcdhtv.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\ziIgcCK.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\TMgUESA.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\SDyUtcE.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\nOqwODb.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\ZnHVhBG.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\WjdgLrw.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\wBCRGkm.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\acKeKbM.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\rDuQtiQ.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\sQqATlZ.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\ivTMuHd.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\zOWonyJ.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\QAFApyT.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\HpCVvZn.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\fNRXYPc.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\SjLrwgn.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\FHlXNXQ.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\coUZNkt.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\wufFvwD.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\bIcFjCI.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\AOTcYCQ.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\kuTUtco.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
File created	C:\Windows\System\ALKojQT.exe	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 3504	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	82
PID 1844 wrote to memory of 3504	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	82
PID 1844 wrote to memory of 880	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	83
PID 1844 wrote to memory of 880	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	83
PID 1844 wrote to memory of 1548	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	84
PID 1844 wrote to memory of 1548	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	84
PID 1844 wrote to memory of 3184	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	85
PID 1844 wrote to memory of 3184	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	85
PID 1844 wrote to memory of 1864	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	86
PID 1844 wrote to memory of 1864	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	86
PID 1844 wrote to memory of 2024	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	87
PID 1844 wrote to memory of 2024	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	87
PID 1844 wrote to memory of 3508	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	88
PID 1844 wrote to memory of 3508	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	88
PID 1844 wrote to memory of 324	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	89
PID 1844 wrote to memory of 324	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	89
PID 1844 wrote to memory of 2288	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	90
PID 1844 wrote to memory of 2288	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	90
PID 1844 wrote to memory of 3496	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	91
PID 1844 wrote to memory of 3496	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	91
PID 1844 wrote to memory of 1396	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	92
PID 1844 wrote to memory of 1396	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	92
PID 1844 wrote to memory of 4696	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	93
PID 1844 wrote to memory of 4696	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	93
PID 1844 wrote to memory of 2648	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	94
PID 1844 wrote to memory of 2648	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	94
PID 1844 wrote to memory of 3672	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	95
PID 1844 wrote to memory of 3672	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	95
PID 1844 wrote to memory of 400	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	96
PID 1844 wrote to memory of 400	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	96
PID 1844 wrote to memory of 1668	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	97
PID 1844 wrote to memory of 1668	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	97
PID 1844 wrote to memory of 1652	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	98
PID 1844 wrote to memory of 1652	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	98
PID 1844 wrote to memory of 1068	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	99
PID 1844 wrote to memory of 1068	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	99
PID 1844 wrote to memory of 3388	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	100
PID 1844 wrote to memory of 3388	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	100
PID 1844 wrote to memory of 2104	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	101
PID 1844 wrote to memory of 2104	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	101
PID 1844 wrote to memory of 5056	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	102
PID 1844 wrote to memory of 5056	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	102
PID 1844 wrote to memory of 4612	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	103
PID 1844 wrote to memory of 4612	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	103
PID 1844 wrote to memory of 2408	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	104
PID 1844 wrote to memory of 2408	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	104
PID 1844 wrote to memory of 1920	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	105
PID 1844 wrote to memory of 1920	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	105
PID 1844 wrote to memory of 4964	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	106
PID 1844 wrote to memory of 4964	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	106
PID 1844 wrote to memory of 912	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	107
PID 1844 wrote to memory of 912	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	107
PID 1844 wrote to memory of 1296	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	108
PID 1844 wrote to memory of 1296	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	108
PID 1844 wrote to memory of 2580	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	109
PID 1844 wrote to memory of 2580	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	109
PID 1844 wrote to memory of 4428	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	110
PID 1844 wrote to memory of 4428	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	110
PID 1844 wrote to memory of 4544	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	111
PID 1844 wrote to memory of 4544	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	111
PID 1844 wrote to memory of 1812	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	112
PID 1844 wrote to memory of 1812	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	112
PID 1844 wrote to memory of 2156	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	113
PID 1844 wrote to memory of 2156	1844	99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\99785520d3017cb6005b93aa64542390_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System\MOpfPSz.exe
  C:\Windows\System\MOpfPSz.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\xAnnWbO.exe
  C:\Windows\System\xAnnWbO.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\uuujcHf.exe
  C:\Windows\System\uuujcHf.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\hjwJZSG.exe
  C:\Windows\System\hjwJZSG.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\bAURlwE.exe
  C:\Windows\System\bAURlwE.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\JBjbkBw.exe
  C:\Windows\System\JBjbkBw.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\WwItaHi.exe
  C:\Windows\System\WwItaHi.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\JHHUuvT.exe
  C:\Windows\System\JHHUuvT.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\NoraCut.exe
  C:\Windows\System\NoraCut.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\fRGqFzm.exe
  C:\Windows\System\fRGqFzm.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\eWQTeIc.exe
  C:\Windows\System\eWQTeIc.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\qJLYsIR.exe
  C:\Windows\System\qJLYsIR.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\wQSHclv.exe
  C:\Windows\System\wQSHclv.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\zOWonyJ.exe
  C:\Windows\System\zOWonyJ.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\qaAFqxn.exe
  C:\Windows\System\qaAFqxn.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\coTJnxd.exe
  C:\Windows\System\coTJnxd.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\hXxwvJQ.exe
  C:\Windows\System\hXxwvJQ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\EPzdUPq.exe
  C:\Windows\System\EPzdUPq.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\pTSrOTL.exe
  C:\Windows\System\pTSrOTL.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\kFHTmGp.exe
  C:\Windows\System\kFHTmGp.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\YOLXLte.exe
  C:\Windows\System\YOLXLte.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\hBmwTgB.exe
  C:\Windows\System\hBmwTgB.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\DDRrsiE.exe
  C:\Windows\System\DDRrsiE.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\nhTpoFV.exe
  C:\Windows\System\nhTpoFV.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\uLtCmXv.exe
  C:\Windows\System\uLtCmXv.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\miLnKqF.exe
  C:\Windows\System\miLnKqF.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\xifNhvl.exe
  C:\Windows\System\xifNhvl.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\ebKVOTC.exe
  C:\Windows\System\ebKVOTC.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\KXURILG.exe
  C:\Windows\System\KXURILG.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\yGAgZOB.exe
  C:\Windows\System\yGAgZOB.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\kHLkYuj.exe
  C:\Windows\System\kHLkYuj.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\WNJjNKc.exe
  C:\Windows\System\WNJjNKc.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\hjabSXA.exe
  C:\Windows\System\hjabSXA.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\VYtczIR.exe
  C:\Windows\System\VYtczIR.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\uUlbNRA.exe
  C:\Windows\System\uUlbNRA.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\lYOKmvu.exe
  C:\Windows\System\lYOKmvu.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\ARZQCsq.exe
  C:\Windows\System\ARZQCsq.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\TfuSHFd.exe
  C:\Windows\System\TfuSHFd.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\jcWssOb.exe
  C:\Windows\System\jcWssOb.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\BnzFpJX.exe
  C:\Windows\System\BnzFpJX.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\SGXNTXE.exe
  C:\Windows\System\SGXNTXE.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\SyqXqnF.exe
  C:\Windows\System\SyqXqnF.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\UQuqeYO.exe
  C:\Windows\System\UQuqeYO.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\hCQrrlg.exe
  C:\Windows\System\hCQrrlg.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\pllICMN.exe
  C:\Windows\System\pllICMN.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\NSDHock.exe
  C:\Windows\System\NSDHock.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\RJiiEud.exe
  C:\Windows\System\RJiiEud.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\mOvtAUe.exe
  C:\Windows\System\mOvtAUe.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\lKVJNhu.exe
  C:\Windows\System\lKVJNhu.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\vBOitSd.exe
  C:\Windows\System\vBOitSd.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\xAodJAt.exe
  C:\Windows\System\xAodJAt.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\IADnsbs.exe
  C:\Windows\System\IADnsbs.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\EShjJmQ.exe
  C:\Windows\System\EShjJmQ.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\atjkBbw.exe
  C:\Windows\System\atjkBbw.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\aMVjiSX.exe
  C:\Windows\System\aMVjiSX.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\iDYebbZ.exe
  C:\Windows\System\iDYebbZ.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\fjNjpwW.exe
  C:\Windows\System\fjNjpwW.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\zFcdhtv.exe
  C:\Windows\System\zFcdhtv.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\ortkAiC.exe
  C:\Windows\System\ortkAiC.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\SyzGfMq.exe
  C:\Windows\System\SyzGfMq.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\uDBeiNp.exe
  C:\Windows\System\uDBeiNp.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\qzUDmpD.exe
  C:\Windows\System\qzUDmpD.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\VfkPVBG.exe
  C:\Windows\System\VfkPVBG.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\vCucbtR.exe
  C:\Windows\System\vCucbtR.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\oZBbUhI.exe
  C:\Windows\System\oZBbUhI.exe
  2⤵
  PID:1572
- C:\Windows\System\RibFrjB.exe
  C:\Windows\System\RibFrjB.exe
  2⤵
  PID:3524
- C:\Windows\System\yoThNIT.exe
  C:\Windows\System\yoThNIT.exe
  2⤵
  PID:4668
- C:\Windows\System\ziIgcCK.exe
  C:\Windows\System\ziIgcCK.exe
  2⤵
  PID:2508
- C:\Windows\System\sCyytqe.exe
  C:\Windows\System\sCyytqe.exe
  2⤵
  PID:3424
- C:\Windows\System\nelBGja.exe
  C:\Windows\System\nelBGja.exe
  2⤵
  PID:1872
- C:\Windows\System\xkgjUNb.exe
  C:\Windows\System\xkgjUNb.exe
  2⤵
  PID:3444
- C:\Windows\System\CvNNgMy.exe
  C:\Windows\System\CvNNgMy.exe
  2⤵
  PID:1608
- C:\Windows\System\xJxVwvg.exe
  C:\Windows\System\xJxVwvg.exe
  2⤵
  PID:4356
- C:\Windows\System\lYUmxJD.exe
  C:\Windows\System\lYUmxJD.exe
  2⤵
  PID:2960
- C:\Windows\System\MzXlyNV.exe
  C:\Windows\System\MzXlyNV.exe
  2⤵
  PID:3848
- C:\Windows\System\sLpkNDu.exe
  C:\Windows\System\sLpkNDu.exe
  2⤵
  PID:4852
- C:\Windows\System\VwQuqWJ.exe
  C:\Windows\System\VwQuqWJ.exe
  2⤵
  PID:4320
- C:\Windows\System\QUGwBlY.exe
  C:\Windows\System\QUGwBlY.exe
  2⤵
  PID:3172
- C:\Windows\System\niZVgfs.exe
  C:\Windows\System\niZVgfs.exe
  2⤵
  PID:1932
- C:\Windows\System\VFoTdNq.exe
  C:\Windows\System\VFoTdNq.exe
  2⤵
  PID:3440
- C:\Windows\System\DDvFIbS.exe
  C:\Windows\System\DDvFIbS.exe
  2⤵
  PID:4240
- C:\Windows\System\InvNjyZ.exe
  C:\Windows\System\InvNjyZ.exe
  2⤵
  PID:1264
- C:\Windows\System\bqXZxyg.exe
  C:\Windows\System\bqXZxyg.exe
  2⤵
  PID:3856
- C:\Windows\System\aTvZwuc.exe
  C:\Windows\System\aTvZwuc.exe
  2⤵
  PID:548
- C:\Windows\System\ltoxBZm.exe
  C:\Windows\System\ltoxBZm.exe
  2⤵
  PID:5144
- C:\Windows\System\NQHLkFN.exe
  C:\Windows\System\NQHLkFN.exe
  2⤵
  PID:5172
- C:\Windows\System\kqEcXcT.exe
  C:\Windows\System\kqEcXcT.exe
  2⤵
  PID:5196
- C:\Windows\System\QuhzImL.exe
  C:\Windows\System\QuhzImL.exe
  2⤵
  PID:5224
- C:\Windows\System\xSaPGcQ.exe
  C:\Windows\System\xSaPGcQ.exe
  2⤵
  PID:5256
- C:\Windows\System\KZHCRce.exe
  C:\Windows\System\KZHCRce.exe
  2⤵
  PID:5280
- C:\Windows\System\gLThtEW.exe
  C:\Windows\System\gLThtEW.exe
  2⤵
  PID:5316
- C:\Windows\System\EYfngiq.exe
  C:\Windows\System\EYfngiq.exe
  2⤵
  PID:5340
- C:\Windows\System\YmviVrv.exe
  C:\Windows\System\YmviVrv.exe
  2⤵
  PID:5368
- C:\Windows\System\uLYytIf.exe
  C:\Windows\System\uLYytIf.exe
  2⤵
  PID:5396
- C:\Windows\System\fBehivx.exe
  C:\Windows\System\fBehivx.exe
  2⤵
  PID:5424
- C:\Windows\System\OjCFdsg.exe
  C:\Windows\System\OjCFdsg.exe
  2⤵
  PID:5452
- C:\Windows\System\PIobyJF.exe
  C:\Windows\System\PIobyJF.exe
  2⤵
  PID:5480
- C:\Windows\System\VEwYAEo.exe
  C:\Windows\System\VEwYAEo.exe
  2⤵
  PID:5504
- C:\Windows\System\RuCrDyQ.exe
  C:\Windows\System\RuCrDyQ.exe
  2⤵
  PID:5532
- C:\Windows\System\GZYRNOJ.exe
  C:\Windows\System\GZYRNOJ.exe
  2⤵
  PID:5560
- C:\Windows\System\bMZkBAP.exe
  C:\Windows\System\bMZkBAP.exe
  2⤵
  PID:5592
- C:\Windows\System\jDfMnCX.exe
  C:\Windows\System\jDfMnCX.exe
  2⤵
  PID:5620
- C:\Windows\System\iQvtiJe.exe
  C:\Windows\System\iQvtiJe.exe
  2⤵
  PID:5648
- C:\Windows\System\RdQbqry.exe
  C:\Windows\System\RdQbqry.exe
  2⤵
  PID:5676
- C:\Windows\System\vaSvHOF.exe
  C:\Windows\System\vaSvHOF.exe
  2⤵
  PID:5704
- C:\Windows\System\ZmqvTzA.exe
  C:\Windows\System\ZmqvTzA.exe
  2⤵
  PID:5732
- C:\Windows\System\qTSnsLd.exe
  C:\Windows\System\qTSnsLd.exe
  2⤵
  PID:5760
- C:\Windows\System\svGJRKz.exe
  C:\Windows\System\svGJRKz.exe
  2⤵
  PID:5788
- C:\Windows\System\CpzlAJT.exe
  C:\Windows\System\CpzlAJT.exe
  2⤵
  PID:5812
- C:\Windows\System\eITyjYx.exe
  C:\Windows\System\eITyjYx.exe
  2⤵
  PID:5840
- C:\Windows\System\IOSOZDm.exe
  C:\Windows\System\IOSOZDm.exe
  2⤵
  PID:5872
- C:\Windows\System\nPimVhq.exe
  C:\Windows\System\nPimVhq.exe
  2⤵
  PID:5904
- C:\Windows\System\tsJXmmQ.exe
  C:\Windows\System\tsJXmmQ.exe
  2⤵
  PID:5928
- C:\Windows\System\fQaThtE.exe
  C:\Windows\System\fQaThtE.exe
  2⤵
  PID:5956
- C:\Windows\System\zKbwEPv.exe
  C:\Windows\System\zKbwEPv.exe
  2⤵
  PID:5984
- C:\Windows\System\kpeahuW.exe
  C:\Windows\System\kpeahuW.exe
  2⤵
  PID:6012
- C:\Windows\System\WnYllML.exe
  C:\Windows\System\WnYllML.exe
  2⤵
  PID:6036
- C:\Windows\System\DKeASiX.exe
  C:\Windows\System\DKeASiX.exe
  2⤵
  PID:6064
- C:\Windows\System\PTxmOMX.exe
  C:\Windows\System\PTxmOMX.exe
  2⤵
  PID:6096
- C:\Windows\System\aPehbfX.exe
  C:\Windows\System\aPehbfX.exe
  2⤵
  PID:6124
- C:\Windows\System\rqIbauV.exe
  C:\Windows\System\rqIbauV.exe
  2⤵
  PID:1340
- C:\Windows\System\HpJzLZq.exe
  C:\Windows\System\HpJzLZq.exe
  2⤵
  PID:3276
- C:\Windows\System\NxfMqZS.exe
  C:\Windows\System\NxfMqZS.exe
  2⤵
  PID:2860
- C:\Windows\System\gHxuufL.exe
  C:\Windows\System\gHxuufL.exe
  2⤵
  PID:4608
- C:\Windows\System\oxfwrdG.exe
  C:\Windows\System\oxfwrdG.exe
  2⤵
  PID:4480
- C:\Windows\System\WsUcPwe.exe
  C:\Windows\System\WsUcPwe.exe
  2⤵
  PID:4776
- C:\Windows\System\uHOwedM.exe
  C:\Windows\System\uHOwedM.exe
  2⤵
  PID:5184
- C:\Windows\System\HhcCJYH.exe
  C:\Windows\System\HhcCJYH.exe
  2⤵
  PID:5244
- C:\Windows\System\MHZLLLd.exe
  C:\Windows\System\MHZLLLd.exe
  2⤵
  PID:5300
- C:\Windows\System\HAqGPzB.exe
  C:\Windows\System\HAqGPzB.exe
  2⤵
  PID:5364
- C:\Windows\System\oAcuThk.exe
  C:\Windows\System\oAcuThk.exe
  2⤵
  PID:5436
- C:\Windows\System\twVjBvZ.exe
  C:\Windows\System\twVjBvZ.exe
  2⤵
  PID:5496
- C:\Windows\System\oqKOtUF.exe
  C:\Windows\System\oqKOtUF.exe
  2⤵
  PID:5556
- C:\Windows\System\QAFApyT.exe
  C:\Windows\System\QAFApyT.exe
  2⤵
  PID:5632
- C:\Windows\System\nQdaDpM.exe
  C:\Windows\System\nQdaDpM.exe
  2⤵
  PID:5668
- C:\Windows\System\xXJchJK.exe
  C:\Windows\System\xXJchJK.exe
  2⤵
  PID:5744
- C:\Windows\System\CRBRpLm.exe
  C:\Windows\System\CRBRpLm.exe
  2⤵
  PID:5808
- C:\Windows\System\FpllRvU.exe
  C:\Windows\System\FpllRvU.exe
  2⤵
  PID:5884
- C:\Windows\System\jPVtvOX.exe
  C:\Windows\System\jPVtvOX.exe
  2⤵
  PID:5940
- C:\Windows\System\Dkkgbgn.exe
  C:\Windows\System\Dkkgbgn.exe
  2⤵
  PID:6000
- C:\Windows\System\SLyEQGM.exe
  C:\Windows\System\SLyEQGM.exe
  2⤵
  PID:6060
- C:\Windows\System\pGrtKZH.exe
  C:\Windows\System\pGrtKZH.exe
  2⤵
  PID:6136
- C:\Windows\System\IejaLnh.exe
  C:\Windows\System\IejaLnh.exe
  2⤵
  PID:4408
- C:\Windows\System\HbUvbgt.exe
  C:\Windows\System\HbUvbgt.exe
  2⤵
  PID:4004
- C:\Windows\System\RIKDMrX.exe
  C:\Windows\System\RIKDMrX.exe
  2⤵
  PID:5212
- C:\Windows\System\jsXUzYM.exe
  C:\Windows\System\jsXUzYM.exe
  2⤵
  PID:5352
- C:\Windows\System\YiWWXcK.exe
  C:\Windows\System\YiWWXcK.exe
  2⤵
  PID:5468
- C:\Windows\System\RRAEMEC.exe
  C:\Windows\System\RRAEMEC.exe
  2⤵
  PID:5608
- C:\Windows\System\cfhOMdr.exe
  C:\Windows\System\cfhOMdr.exe
  2⤵
  PID:5724
- C:\Windows\System\QDxPoyP.exe
  C:\Windows\System\QDxPoyP.exe
  2⤵
  PID:5860
- C:\Windows\System\FFcBsfN.exe
  C:\Windows\System\FFcBsfN.exe
  2⤵
  PID:6148
- C:\Windows\System\fyzUlqm.exe
  C:\Windows\System\fyzUlqm.exe
  2⤵
  PID:6180
- C:\Windows\System\NGdtFPp.exe
  C:\Windows\System\NGdtFPp.exe
  2⤵
  PID:6212
- C:\Windows\System\jNiPhyL.exe
  C:\Windows\System\jNiPhyL.exe
  2⤵
  PID:6240
- C:\Windows\System\uiHAiRZ.exe
  C:\Windows\System\uiHAiRZ.exe
  2⤵
  PID:6260
- C:\Windows\System\xENSsLU.exe
  C:\Windows\System\xENSsLU.exe
  2⤵
  PID:6288
- C:\Windows\System\VbReOem.exe
  C:\Windows\System\VbReOem.exe
  2⤵
  PID:6316
- C:\Windows\System\eYMFjsb.exe
  C:\Windows\System\eYMFjsb.exe
  2⤵
  PID:6344
- C:\Windows\System\eCWXuhK.exe
  C:\Windows\System\eCWXuhK.exe
  2⤵
  PID:6372
- C:\Windows\System\EzWClls.exe
  C:\Windows\System\EzWClls.exe
  2⤵
  PID:6400
- C:\Windows\System\dMQEYqZ.exe
  C:\Windows\System\dMQEYqZ.exe
  2⤵
  PID:6428
- C:\Windows\System\KWnygYZ.exe
  C:\Windows\System\KWnygYZ.exe
  2⤵
  PID:6456
- C:\Windows\System\Lcmhpzy.exe
  C:\Windows\System\Lcmhpzy.exe
  2⤵
  PID:6484
- C:\Windows\System\iRXtdOY.exe
  C:\Windows\System\iRXtdOY.exe
  2⤵
  PID:6512
- C:\Windows\System\rhfgrwY.exe
  C:\Windows\System\rhfgrwY.exe
  2⤵
  PID:6540
- C:\Windows\System\OyNPmII.exe
  C:\Windows\System\OyNPmII.exe
  2⤵
  PID:6564
- C:\Windows\System\wAMKfiM.exe
  C:\Windows\System\wAMKfiM.exe
  2⤵
  PID:6596
- C:\Windows\System\bBYgcEy.exe
  C:\Windows\System\bBYgcEy.exe
  2⤵
  PID:6620
- C:\Windows\System\YCGlJuN.exe
  C:\Windows\System\YCGlJuN.exe
  2⤵
  PID:6652
- C:\Windows\System\SPEFJDQ.exe
  C:\Windows\System\SPEFJDQ.exe
  2⤵
  PID:6680
- C:\Windows\System\rnOuvGW.exe
  C:\Windows\System\rnOuvGW.exe
  2⤵
  PID:6708
- C:\Windows\System\yJGnhfq.exe
  C:\Windows\System\yJGnhfq.exe
  2⤵
  PID:6740
- C:\Windows\System\Vywgihf.exe
  C:\Windows\System\Vywgihf.exe
  2⤵
  PID:6772
- C:\Windows\System\bGWxlRB.exe
  C:\Windows\System\bGWxlRB.exe
  2⤵
  PID:6800
- C:\Windows\System\TMXXfSq.exe
  C:\Windows\System\TMXXfSq.exe
  2⤵
  PID:6820
- C:\Windows\System\LOHuRWf.exe
  C:\Windows\System\LOHuRWf.exe
  2⤵
  PID:6848
- C:\Windows\System\xXnpAMV.exe
  C:\Windows\System\xXnpAMV.exe
  2⤵
  PID:6876
- C:\Windows\System\VAlHZEc.exe
  C:\Windows\System\VAlHZEc.exe
  2⤵
  PID:6904
- C:\Windows\System\blqqTQK.exe
  C:\Windows\System\blqqTQK.exe
  2⤵
  PID:6932
- C:\Windows\System\hJBwQqP.exe
  C:\Windows\System\hJBwQqP.exe
  2⤵
  PID:6960
- C:\Windows\System\XxeRNtv.exe
  C:\Windows\System\XxeRNtv.exe
  2⤵
  PID:6988
- C:\Windows\System\crDkhWJ.exe
  C:\Windows\System\crDkhWJ.exe
  2⤵
  PID:7012
- C:\Windows\System\VRahcBf.exe
  C:\Windows\System\VRahcBf.exe
  2⤵
  PID:7044
- C:\Windows\System\MZLMAHL.exe
  C:\Windows\System\MZLMAHL.exe
  2⤵
  PID:7072
- C:\Windows\System\vRHfKdv.exe
  C:\Windows\System\vRHfKdv.exe
  2⤵
  PID:7100
- C:\Windows\System\CyJvNwq.exe
  C:\Windows\System\CyJvNwq.exe
  2⤵
  PID:7124
- C:\Windows\System\HhRqRzX.exe
  C:\Windows\System\HhRqRzX.exe
  2⤵
  PID:7152
- C:\Windows\System\BfECvoP.exe
  C:\Windows\System\BfECvoP.exe
  2⤵
  PID:6108
- C:\Windows\System\YEdlAkt.exe
  C:\Windows\System\YEdlAkt.exe
  2⤵
  PID:2692
- C:\Windows\System\ihhyKQU.exe
  C:\Windows\System\ihhyKQU.exe
  2⤵
  PID:5272
- C:\Windows\System\TqMilGF.exe
  C:\Windows\System\TqMilGF.exe
  2⤵
  PID:5548
- C:\Windows\System\ulaSTaL.exe
  C:\Windows\System\ulaSTaL.exe
  2⤵
  PID:5836
- C:\Windows\System\AOTcYCQ.exe
  C:\Windows\System\AOTcYCQ.exe
  2⤵
  PID:6176
- C:\Windows\System\wpQqQGf.exe
  C:\Windows\System\wpQqQGf.exe
  2⤵
  PID:6232
- C:\Windows\System\AyrNRiW.exe
  C:\Windows\System\AyrNRiW.exe
  2⤵
  PID:3120
- C:\Windows\System\kaTnVqD.exe
  C:\Windows\System\kaTnVqD.exe
  2⤵
  PID:6504
- C:\Windows\System\xoqpKVt.exe
  C:\Windows\System\xoqpKVt.exe
  2⤵
  PID:6560
- C:\Windows\System\WpuzGrY.exe
  C:\Windows\System\WpuzGrY.exe
  2⤵
  PID:6588
- C:\Windows\System\xgguZPw.exe
  C:\Windows\System\xgguZPw.exe
  2⤵
  PID:1444
- C:\Windows\System\GCBCaSj.exe
  C:\Windows\System\GCBCaSj.exe
  2⤵
  PID:6692
- C:\Windows\System\PxNyZQs.exe
  C:\Windows\System\PxNyZQs.exe
  2⤵
  PID:6736
- C:\Windows\System\oshWppf.exe
  C:\Windows\System\oshWppf.exe
  2⤵
  PID:4636
- C:\Windows\System\BwWboPW.exe
  C:\Windows\System\BwWboPW.exe
  2⤵
  PID:2164
- C:\Windows\System\mhUZkrT.exe
  C:\Windows\System\mhUZkrT.exe
  2⤵
  PID:6864
- C:\Windows\System\MjexGmU.exe
  C:\Windows\System\MjexGmU.exe
  2⤵
  PID:6916
- C:\Windows\System\DQuTMHx.exe
  C:\Windows\System\DQuTMHx.exe
  2⤵
  PID:6976
- C:\Windows\System\lhmaZpt.exe
  C:\Windows\System\lhmaZpt.exe
  2⤵
  PID:2668
- C:\Windows\System\HEsmxqJ.exe
  C:\Windows\System\HEsmxqJ.exe
  2⤵
  PID:1540
- C:\Windows\System\roiRadQ.exe
  C:\Windows\System\roiRadQ.exe
  2⤵
  PID:7144
- C:\Windows\System\wXShLbJ.exe
  C:\Windows\System\wXShLbJ.exe
  2⤵
  PID:3148
- C:\Windows\System\zcUVSZS.exe
  C:\Windows\System\zcUVSZS.exe
  2⤵
  PID:6256
- C:\Windows\System\HzejOkT.exe
  C:\Windows\System\HzejOkT.exe
  2⤵
  PID:4468
- C:\Windows\System\xyZByIi.exe
  C:\Windows\System\xyZByIi.exe
  2⤵
  PID:3700
- C:\Windows\System\wmkACmc.exe
  C:\Windows\System\wmkACmc.exe
  2⤵
  PID:6536
- C:\Windows\System\SrWvzUi.exe
  C:\Windows\System\SrWvzUi.exe
  2⤵
  PID:6496
- C:\Windows\System\dnPABii.exe
  C:\Windows\System\dnPABii.exe
  2⤵
  PID:6672
- C:\Windows\System\pQBcWoU.exe
  C:\Windows\System\pQBcWoU.exe
  2⤵
  PID:6812
- C:\Windows\System\XHHjhIe.exe
  C:\Windows\System\XHHjhIe.exe
  2⤵
  PID:7056
- C:\Windows\System\BKyRHtk.exe
  C:\Windows\System\BKyRHtk.exe
  2⤵
  PID:6412
- C:\Windows\System\XklZnUW.exe
  C:\Windows\System\XklZnUW.exe
  2⤵
  PID:4228
- C:\Windows\System\klbMnFx.exe
  C:\Windows\System\klbMnFx.exe
  2⤵
  PID:3232
- C:\Windows\System\HpCVvZn.exe
  C:\Windows\System\HpCVvZn.exe
  2⤵
  PID:6440
- C:\Windows\System\tvEVwpb.exe
  C:\Windows\System\tvEVwpb.exe
  2⤵
  PID:2896
- C:\Windows\System\AwhOete.exe
  C:\Windows\System\AwhOete.exe
  2⤵
  PID:4324
- C:\Windows\System\zAMZErA.exe
  C:\Windows\System\zAMZErA.exe
  2⤵
  PID:3788
- C:\Windows\System\xVkPdXj.exe
  C:\Windows\System\xVkPdXj.exe
  2⤵
  PID:2200
- C:\Windows\System\aBVezfN.exe
  C:\Windows\System\aBVezfN.exe
  2⤵
  PID:6788
- C:\Windows\System\DZvBcwC.exe
  C:\Windows\System\DZvBcwC.exe
  2⤵
  PID:1780
- C:\Windows\System\yXwylnf.exe
  C:\Windows\System\yXwylnf.exe
  2⤵
  PID:6444
- C:\Windows\System\uQgDzfI.exe
  C:\Windows\System\uQgDzfI.exe
  2⤵
  PID:5112
- C:\Windows\System\GbXsZwh.exe
  C:\Windows\System\GbXsZwh.exe
  2⤵
  PID:6272
- C:\Windows\System\nGsvBNX.exe
  C:\Windows\System\nGsvBNX.exe
  2⤵
  PID:6888
- C:\Windows\System\BGDgNQI.exe
  C:\Windows\System\BGDgNQI.exe
  2⤵
  PID:6768
- C:\Windows\System\iritfGB.exe
  C:\Windows\System\iritfGB.exe
  2⤵
  PID:6664
- C:\Windows\System\mtZgWYA.exe
  C:\Windows\System\mtZgWYA.exe
  2⤵
  PID:7176
- C:\Windows\System\VqjmLfT.exe
  C:\Windows\System\VqjmLfT.exe
  2⤵
  PID:7204
- C:\Windows\System\CdQnwlv.exe
  C:\Windows\System\CdQnwlv.exe
  2⤵
  PID:7248
- C:\Windows\System\UAtBpId.exe
  C:\Windows\System\UAtBpId.exe
  2⤵
  PID:7296
- C:\Windows\System\yVwksDx.exe
  C:\Windows\System\yVwksDx.exe
  2⤵
  PID:7324
- C:\Windows\System\gbwMJKV.exe
  C:\Windows\System\gbwMJKV.exe
  2⤵
  PID:7344
- C:\Windows\System\RRZvJsY.exe
  C:\Windows\System\RRZvJsY.exe
  2⤵
  PID:7368
- C:\Windows\System\ZuUekyx.exe
  C:\Windows\System\ZuUekyx.exe
  2⤵
  PID:7392
- C:\Windows\System\hWUuaqm.exe
  C:\Windows\System\hWUuaqm.exe
  2⤵
  PID:7416
- C:\Windows\System\NgWERdQ.exe
  C:\Windows\System\NgWERdQ.exe
  2⤵
  PID:7460
- C:\Windows\System\FhErmyQ.exe
  C:\Windows\System\FhErmyQ.exe
  2⤵
  PID:7484
- C:\Windows\System\iogBuUe.exe
  C:\Windows\System\iogBuUe.exe
  2⤵
  PID:7528
- C:\Windows\System\ejYSsaq.exe
  C:\Windows\System\ejYSsaq.exe
  2⤵
  PID:7556
- C:\Windows\System\txPpUfk.exe
  C:\Windows\System\txPpUfk.exe
  2⤵
  PID:7584
- C:\Windows\System\TMgUESA.exe
  C:\Windows\System\TMgUESA.exe
  2⤵
  PID:7612
- C:\Windows\System\XFFjfcA.exe
  C:\Windows\System\XFFjfcA.exe
  2⤵
  PID:7640
- C:\Windows\System\relOkWl.exe
  C:\Windows\System\relOkWl.exe
  2⤵
  PID:7656
- C:\Windows\System\TbsYnvy.exe
  C:\Windows\System\TbsYnvy.exe
  2⤵
  PID:7684
- C:\Windows\System\ViCdqnx.exe
  C:\Windows\System\ViCdqnx.exe
  2⤵
  PID:7724
- C:\Windows\System\ntEAvXl.exe
  C:\Windows\System\ntEAvXl.exe
  2⤵
  PID:7744
- C:\Windows\System\BJUYWtB.exe
  C:\Windows\System\BJUYWtB.exe
  2⤵
  PID:7768
- C:\Windows\System\rUfxRZP.exe
  C:\Windows\System\rUfxRZP.exe
  2⤵
  PID:7808
- C:\Windows\System\EMayMSv.exe
  C:\Windows\System\EMayMSv.exe
  2⤵
  PID:7836
- C:\Windows\System\SPhcxBd.exe
  C:\Windows\System\SPhcxBd.exe
  2⤵
  PID:7864
- C:\Windows\System\rhOPvei.exe
  C:\Windows\System\rhOPvei.exe
  2⤵
  PID:7892
- C:\Windows\System\fEOMCnI.exe
  C:\Windows\System\fEOMCnI.exe
  2⤵
  PID:7908
- C:\Windows\System\xXFqiWe.exe
  C:\Windows\System\xXFqiWe.exe
  2⤵
  PID:7940
- C:\Windows\System\rpAfGJQ.exe
  C:\Windows\System\rpAfGJQ.exe
  2⤵
  PID:7972
- C:\Windows\System\cHrmEaS.exe
  C:\Windows\System\cHrmEaS.exe
  2⤵
  PID:7996
- C:\Windows\System\ZuoLAjh.exe
  C:\Windows\System\ZuoLAjh.exe
  2⤵
  PID:8012
- C:\Windows\System\MxDnaaV.exe
  C:\Windows\System\MxDnaaV.exe
  2⤵
  PID:8044
- C:\Windows\System\IMEOVCT.exe
  C:\Windows\System\IMEOVCT.exe
  2⤵
  PID:8084
- C:\Windows\System\pfXxlXf.exe
  C:\Windows\System\pfXxlXf.exe
  2⤵
  PID:8120
- C:\Windows\System\ZOlHjnu.exe
  C:\Windows\System\ZOlHjnu.exe
  2⤵
  PID:8148
- C:\Windows\System\gkepBGJ.exe
  C:\Windows\System\gkepBGJ.exe
  2⤵
  PID:8176
- C:\Windows\System\MZKxdbq.exe
  C:\Windows\System\MZKxdbq.exe
  2⤵
  PID:7184
- C:\Windows\System\SDyUtcE.exe
  C:\Windows\System\SDyUtcE.exe
  2⤵
  PID:7232
- C:\Windows\System\atCgIdy.exe
  C:\Windows\System\atCgIdy.exe
  2⤵
  PID:7308
- C:\Windows\System\NELEqMH.exe
  C:\Windows\System\NELEqMH.exe
  2⤵
  PID:7408
- C:\Windows\System\TAftelC.exe
  C:\Windows\System\TAftelC.exe
  2⤵
  PID:7472
- C:\Windows\System\gUyLSWH.exe
  C:\Windows\System\gUyLSWH.exe
  2⤵
  PID:7552
- C:\Windows\System\ucZfmZn.exe
  C:\Windows\System\ucZfmZn.exe
  2⤵
  PID:7604
- C:\Windows\System\NqEDljd.exe
  C:\Windows\System\NqEDljd.exe
  2⤵
  PID:7672
- C:\Windows\System\jRwNCfd.exe
  C:\Windows\System\jRwNCfd.exe
  2⤵
  PID:7760
- C:\Windows\System\wZBNtnj.exe
  C:\Windows\System\wZBNtnj.exe
  2⤵
  PID:7804
- C:\Windows\System\NhzuWlX.exe
  C:\Windows\System\NhzuWlX.exe
  2⤵
  PID:7884
- C:\Windows\System\ZLajMWC.exe
  C:\Windows\System\ZLajMWC.exe
  2⤵
  PID:7968
- C:\Windows\System\RTMShpW.exe
  C:\Windows\System\RTMShpW.exe
  2⤵
  PID:8036
- C:\Windows\System\aYhhwJt.exe
  C:\Windows\System\aYhhwJt.exe
  2⤵
  PID:8096
- C:\Windows\System\dsuwsQH.exe
  C:\Windows\System\dsuwsQH.exe
  2⤵
  PID:8140
- C:\Windows\System\lRbdYoK.exe
  C:\Windows\System\lRbdYoK.exe
  2⤵
  PID:8188
- C:\Windows\System\rplKxMq.exe
  C:\Windows\System\rplKxMq.exe
  2⤵
  PID:7360
- C:\Windows\System\NgWEEff.exe
  C:\Windows\System\NgWEEff.exe
  2⤵
  PID:7580
- C:\Windows\System\WHMYeJu.exe
  C:\Windows\System\WHMYeJu.exe
  2⤵
  PID:3336
- C:\Windows\System\SIWTPLe.exe
  C:\Windows\System\SIWTPLe.exe
  2⤵
  PID:7860
- C:\Windows\System\bCNeOWa.exe
  C:\Windows\System\bCNeOWa.exe
  2⤵
  PID:7992
- C:\Windows\System\bjXdZrJ.exe
  C:\Windows\System\bjXdZrJ.exe
  2⤵
  PID:8160
- C:\Windows\System\DMFiMgf.exe
  C:\Windows\System\DMFiMgf.exe
  2⤵
  PID:7548
- C:\Windows\System\HvRuoyr.exe
  C:\Windows\System\HvRuoyr.exe
  2⤵
  PID:7920
- C:\Windows\System\SjwDhND.exe
  C:\Windows\System\SjwDhND.exe
  2⤵
  PID:7376
- C:\Windows\System\FKrvyMe.exe
  C:\Windows\System\FKrvyMe.exe
  2⤵
  PID:8132
- C:\Windows\System\dpuZLtK.exe
  C:\Windows\System\dpuZLtK.exe
  2⤵
  PID:7824
- C:\Windows\System\yJJHvXG.exe
  C:\Windows\System\yJJHvXG.exe
  2⤵
  PID:8228
- C:\Windows\System\vvDQRFT.exe
  C:\Windows\System\vvDQRFT.exe
  2⤵
  PID:8244
- C:\Windows\System\zljJcOb.exe
  C:\Windows\System\zljJcOb.exe
  2⤵
  PID:8284
- C:\Windows\System\gWkKPsQ.exe
  C:\Windows\System\gWkKPsQ.exe
  2⤵
  PID:8312
- C:\Windows\System\lhAzndx.exe
  C:\Windows\System\lhAzndx.exe
  2⤵
  PID:8340
- C:\Windows\System\ultSuQf.exe
  C:\Windows\System\ultSuQf.exe
  2⤵
  PID:8364
- C:\Windows\System\ZBPiThg.exe
  C:\Windows\System\ZBPiThg.exe
  2⤵
  PID:8392
- C:\Windows\System\EapVCmV.exe
  C:\Windows\System\EapVCmV.exe
  2⤵
  PID:8424
- C:\Windows\System\hehygqz.exe
  C:\Windows\System\hehygqz.exe
  2⤵
  PID:8452
- C:\Windows\System\fNRXYPc.exe
  C:\Windows\System\fNRXYPc.exe
  2⤵
  PID:8480
- C:\Windows\System\Zpdulbc.exe
  C:\Windows\System\Zpdulbc.exe
  2⤵
  PID:8496
- C:\Windows\System\GIYEglY.exe
  C:\Windows\System\GIYEglY.exe
  2⤵
  PID:8520
- C:\Windows\System\dqMxSPe.exe
  C:\Windows\System\dqMxSPe.exe
  2⤵
  PID:8564
- C:\Windows\System\wIXOpcW.exe
  C:\Windows\System\wIXOpcW.exe
  2⤵
  PID:8592
- C:\Windows\System\IxEiyGI.exe
  C:\Windows\System\IxEiyGI.exe
  2⤵
  PID:8620
- C:\Windows\System\UHzQJmt.exe
  C:\Windows\System\UHzQJmt.exe
  2⤵
  PID:8648
- C:\Windows\System\jGhJgZg.exe
  C:\Windows\System\jGhJgZg.exe
  2⤵
  PID:8680
- C:\Windows\System\yBXodTy.exe
  C:\Windows\System\yBXodTy.exe
  2⤵
  PID:8708
- C:\Windows\System\ClRZrHo.exe
  C:\Windows\System\ClRZrHo.exe
  2⤵
  PID:8724
- C:\Windows\System\ByxGlzA.exe
  C:\Windows\System\ByxGlzA.exe
  2⤵
  PID:8752
- C:\Windows\System\xsmYLxa.exe
  C:\Windows\System\xsmYLxa.exe
  2⤵
  PID:8796
- C:\Windows\System\TdnXWON.exe
  C:\Windows\System\TdnXWON.exe
  2⤵
  PID:8820
- C:\Windows\System\CDyHeVo.exe
  C:\Windows\System\CDyHeVo.exe
  2⤵
  PID:8844
- C:\Windows\System\rTnTAPZ.exe
  C:\Windows\System\rTnTAPZ.exe
  2⤵
  PID:8868
- C:\Windows\System\kpmERhg.exe
  C:\Windows\System\kpmERhg.exe
  2⤵
  PID:8900
- C:\Windows\System\nvxtuUB.exe
  C:\Windows\System\nvxtuUB.exe
  2⤵
  PID:8936
- C:\Windows\System\TiksJCq.exe
  C:\Windows\System\TiksJCq.exe
  2⤵
  PID:8964
- C:\Windows\System\hVqxWid.exe
  C:\Windows\System\hVqxWid.exe
  2⤵
  PID:8992
- C:\Windows\System\PEfanzB.exe
  C:\Windows\System\PEfanzB.exe
  2⤵
  PID:9020
- C:\Windows\System\tVzLoiv.exe
  C:\Windows\System\tVzLoiv.exe
  2⤵
  PID:9048
- C:\Windows\System\uVvPWjY.exe
  C:\Windows\System\uVvPWjY.exe
  2⤵
  PID:9064
- C:\Windows\System\acKeKbM.exe
  C:\Windows\System\acKeKbM.exe
  2⤵
  PID:9092
- C:\Windows\System\pYaJdik.exe
  C:\Windows\System\pYaJdik.exe
  2⤵
  PID:9120
- C:\Windows\System\btCYRXf.exe
  C:\Windows\System\btCYRXf.exe
  2⤵
  PID:9160
- C:\Windows\System\rDuQtiQ.exe
  C:\Windows\System\rDuQtiQ.exe
  2⤵
  PID:9188
- C:\Windows\System\ISAdRBo.exe
  C:\Windows\System\ISAdRBo.exe
  2⤵
  PID:8200
- C:\Windows\System\mPpXfFf.exe
  C:\Windows\System\mPpXfFf.exe
  2⤵
  PID:8236
- C:\Windows\System\majoEIq.exe
  C:\Windows\System\majoEIq.exe
  2⤵
  PID:8324
- C:\Windows\System\cyzOyxO.exe
  C:\Windows\System\cyzOyxO.exe
  2⤵
  PID:8380
- C:\Windows\System\XkAcGqU.exe
  C:\Windows\System\XkAcGqU.exe
  2⤵
  PID:8436
- C:\Windows\System\UXWXLgB.exe
  C:\Windows\System\UXWXLgB.exe
  2⤵
  PID:8468
- C:\Windows\System\gKoPiGt.exe
  C:\Windows\System\gKoPiGt.exe
  2⤵
  PID:8516
- C:\Windows\System\TRjXtPt.exe
  C:\Windows\System\TRjXtPt.exe
  2⤵
  PID:8604
- C:\Windows\System\FqWHEoy.exe
  C:\Windows\System\FqWHEoy.exe
  2⤵
  PID:8716
- C:\Windows\System\GAyoPOC.exe
  C:\Windows\System\GAyoPOC.exe
  2⤵
  PID:8788
- C:\Windows\System\njxeBBR.exe
  C:\Windows\System\njxeBBR.exe
  2⤵
  PID:8828
- C:\Windows\System\abpUAvj.exe
  C:\Windows\System\abpUAvj.exe
  2⤵
  PID:8924
- C:\Windows\System\Ghajbwa.exe
  C:\Windows\System\Ghajbwa.exe
  2⤵
  PID:8988
- C:\Windows\System\RdtHBxc.exe
  C:\Windows\System\RdtHBxc.exe
  2⤵
  PID:1592
- C:\Windows\System\JopryRM.exe
  C:\Windows\System\JopryRM.exe
  2⤵
  PID:212
- C:\Windows\System\OkGXxRf.exe
  C:\Windows\System\OkGXxRf.exe
  2⤵
  PID:9076
- C:\Windows\System\bnjwuVy.exe
  C:\Windows\System\bnjwuVy.exe
  2⤵
  PID:9108
- C:\Windows\System\jLDRWqr.exe
  C:\Windows\System\jLDRWqr.exe
  2⤵
  PID:9204
- C:\Windows\System\cFdbOVj.exe
  C:\Windows\System\cFdbOVj.exe
  2⤵
  PID:8348
- C:\Windows\System\AUmPnmF.exe
  C:\Windows\System\AUmPnmF.exe
  2⤵
  PID:8492
- C:\Windows\System\uAJBXZe.exe
  C:\Windows\System\uAJBXZe.exe
  2⤵
  PID:8560
- C:\Windows\System\ATMaHEn.exe
  C:\Windows\System\ATMaHEn.exe
  2⤵
  PID:8736
- C:\Windows\System\KpFYDUy.exe
  C:\Windows\System\KpFYDUy.exe
  2⤵
  PID:8888
- C:\Windows\System\frVwnfq.exe
  C:\Windows\System\frVwnfq.exe
  2⤵
  PID:7936
- C:\Windows\System\wPUgTxH.exe
  C:\Windows\System\wPUgTxH.exe
  2⤵
  PID:9156
- C:\Windows\System\uBlWDpc.exe
  C:\Windows\System\uBlWDpc.exe
  2⤵
  PID:7956
- C:\Windows\System\VFKcyYG.exe
  C:\Windows\System\VFKcyYG.exe
  2⤵
  PID:8700
- C:\Windows\System\wgQKhSN.exe
  C:\Windows\System\wgQKhSN.exe
  2⤵
  PID:9032
- C:\Windows\System\pakqtJm.exe
  C:\Windows\System\pakqtJm.exe
  2⤵
  PID:8512
- C:\Windows\System\zUpHgMf.exe
  C:\Windows\System\zUpHgMf.exe
  2⤵
  PID:9224
- C:\Windows\System\PWTGMsr.exe
  C:\Windows\System\PWTGMsr.exe
  2⤵
  PID:9240
- C:\Windows\System\qSwwvjn.exe
  C:\Windows\System\qSwwvjn.exe
  2⤵
  PID:9300
- C:\Windows\System\riHSJuX.exe
  C:\Windows\System\riHSJuX.exe
  2⤵
  PID:9324
- C:\Windows\System\XHOzdAU.exe
  C:\Windows\System\XHOzdAU.exe
  2⤵
  PID:9348
- C:\Windows\System\UdebmSl.exe
  C:\Windows\System\UdebmSl.exe
  2⤵
  PID:9388
- C:\Windows\System\JRXVYkB.exe
  C:\Windows\System\JRXVYkB.exe
  2⤵
  PID:9404
- C:\Windows\System\aqopiOB.exe
  C:\Windows\System\aqopiOB.exe
  2⤵
  PID:9432
- C:\Windows\System\yLWWxux.exe
  C:\Windows\System\yLWWxux.exe
  2⤵
  PID:9468
- C:\Windows\System\rCqDcND.exe
  C:\Windows\System\rCqDcND.exe
  2⤵
  PID:9500
- C:\Windows\System\DRWHUIa.exe
  C:\Windows\System\DRWHUIa.exe
  2⤵
  PID:9528
- C:\Windows\System\LWHtKWm.exe
  C:\Windows\System\LWHtKWm.exe
  2⤵
  PID:9556
- C:\Windows\System\khIlDoZ.exe
  C:\Windows\System\khIlDoZ.exe
  2⤵
  PID:9584
- C:\Windows\System\ykjcqOx.exe
  C:\Windows\System\ykjcqOx.exe
  2⤵
  PID:9612
- C:\Windows\System\aaAELTi.exe
  C:\Windows\System\aaAELTi.exe
  2⤵
  PID:9640
- C:\Windows\System\JOJCqRk.exe
  C:\Windows\System\JOJCqRk.exe
  2⤵
  PID:9668
- C:\Windows\System\vYYwCOT.exe
  C:\Windows\System\vYYwCOT.exe
  2⤵
  PID:9696
- C:\Windows\System\rvBVnlm.exe
  C:\Windows\System\rvBVnlm.exe
  2⤵
  PID:9712
- C:\Windows\System\ntEzqFh.exe
  C:\Windows\System\ntEzqFh.exe
  2⤵
  PID:9748
- C:\Windows\System\XtUIVxC.exe
  C:\Windows\System\XtUIVxC.exe
  2⤵
  PID:9780
- C:\Windows\System\bxhZUHI.exe
  C:\Windows\System\bxhZUHI.exe
  2⤵
  PID:9808
- C:\Windows\System\ExMqQkQ.exe
  C:\Windows\System\ExMqQkQ.exe
  2⤵
  PID:9836
- C:\Windows\System\bBQDTEf.exe
  C:\Windows\System\bBQDTEf.exe
  2⤵
  PID:9864
- C:\Windows\System\MNijXIU.exe
  C:\Windows\System\MNijXIU.exe
  2⤵
  PID:9892
- C:\Windows\System\lGXPVtZ.exe
  C:\Windows\System\lGXPVtZ.exe
  2⤵
  PID:9916
- C:\Windows\System\mgoJrSV.exe
  C:\Windows\System\mgoJrSV.exe
  2⤵
  PID:9948
- C:\Windows\System\WtdQrWw.exe
  C:\Windows\System\WtdQrWw.exe
  2⤵
  PID:9976
- C:\Windows\System\kivTgqA.exe
  C:\Windows\System\kivTgqA.exe
  2⤵
  PID:10004
- C:\Windows\System\bqRNHbc.exe
  C:\Windows\System\bqRNHbc.exe
  2⤵
  PID:10032
- C:\Windows\System\nBjJQrN.exe
  C:\Windows\System\nBjJQrN.exe
  2⤵
  PID:10060
- C:\Windows\System\xkdsemR.exe
  C:\Windows\System\xkdsemR.exe
  2⤵
  PID:10088
- C:\Windows\System\yXjUsXk.exe
  C:\Windows\System\yXjUsXk.exe
  2⤵
  PID:10116
- C:\Windows\System\CTSXvQD.exe
  C:\Windows\System\CTSXvQD.exe
  2⤵
  PID:10144
- C:\Windows\System\nFMdlwi.exe
  C:\Windows\System\nFMdlwi.exe
  2⤵
  PID:10172
- C:\Windows\System\HdJvLqn.exe
  C:\Windows\System\HdJvLqn.exe
  2⤵
  PID:10188
- C:\Windows\System\bunLEgJ.exe
  C:\Windows\System\bunLEgJ.exe
  2⤵
  PID:10236
- C:\Windows\System\zwHrZBn.exe
  C:\Windows\System\zwHrZBn.exe
  2⤵
  PID:9256
- C:\Windows\System\XfJUFXp.exe
  C:\Windows\System\XfJUFXp.exe
  2⤵
  PID:9336
- C:\Windows\System\ZUmpCjf.exe
  C:\Windows\System\ZUmpCjf.exe
  2⤵
  PID:9420
- C:\Windows\System\uhhvdEj.exe
  C:\Windows\System\uhhvdEj.exe
  2⤵
  PID:9460
- C:\Windows\System\CGRDwLL.exe
  C:\Windows\System\CGRDwLL.exe
  2⤵
  PID:9540
- C:\Windows\System\LSxROLt.exe
  C:\Windows\System\LSxROLt.exe
  2⤵
  PID:9580
- C:\Windows\System\cYvWUMU.exe
  C:\Windows\System\cYvWUMU.exe
  2⤵
  PID:9680
- C:\Windows\System\kuTUtco.exe
  C:\Windows\System\kuTUtco.exe
  2⤵
  PID:9736
- C:\Windows\System\eYXnmoY.exe
  C:\Windows\System\eYXnmoY.exe
  2⤵
  PID:9804
- C:\Windows\System\bgMZVpH.exe
  C:\Windows\System\bgMZVpH.exe
  2⤵
  PID:9880
- C:\Windows\System\fMqMSVp.exe
  C:\Windows\System\fMqMSVp.exe
  2⤵
  PID:9936
- C:\Windows\System\qvcDYTN.exe
  C:\Windows\System\qvcDYTN.exe
  2⤵
  PID:9996
- C:\Windows\System\hLEvoOZ.exe
  C:\Windows\System\hLEvoOZ.exe
  2⤵
  PID:10072
- C:\Windows\System\QOgGaKa.exe
  C:\Windows\System\QOgGaKa.exe
  2⤵
  PID:10108
- C:\Windows\System\cBORegW.exe
  C:\Windows\System\cBORegW.exe
  2⤵
  PID:10180
- C:\Windows\System\KWCBzkl.exe
  C:\Windows\System\KWCBzkl.exe
  2⤵
  PID:9232
- C:\Windows\System\BytjfMS.exe
  C:\Windows\System\BytjfMS.exe
  2⤵
  PID:8808
- C:\Windows\System\YILMsbk.exe
  C:\Windows\System\YILMsbk.exe
  2⤵
  PID:9572
- C:\Windows\System\cwrPzHj.exe
  C:\Windows\System\cwrPzHj.exe
  2⤵
  PID:9772
- C:\Windows\System\MKmtHUP.exe
  C:\Windows\System\MKmtHUP.exe
  2⤵
  PID:9856
- C:\Windows\System\XOcFGPH.exe
  C:\Windows\System\XOcFGPH.exe
  2⤵
  PID:10024
- C:\Windows\System\wZXVQGH.exe
  C:\Windows\System\wZXVQGH.exe
  2⤵
  PID:10076
- C:\Windows\System\pcdEeno.exe
  C:\Windows\System\pcdEeno.exe
  2⤵
  PID:10228
- C:\Windows\System\FdzScMS.exe
  C:\Windows\System\FdzScMS.exe
  2⤵
  PID:9932
- C:\Windows\System\XgQIRXW.exe
  C:\Windows\System\XgQIRXW.exe
  2⤵
  PID:9444
- C:\Windows\System\VOVBtET.exe
  C:\Windows\System\VOVBtET.exe
  2⤵
  PID:9664
- C:\Windows\System\CziaCRE.exe
  C:\Windows\System\CziaCRE.exe
  2⤵
  PID:10256
- C:\Windows\System\AwVdnBa.exe
  C:\Windows\System\AwVdnBa.exe
  2⤵
  PID:10284
- C:\Windows\System\QzeonbY.exe
  C:\Windows\System\QzeonbY.exe
  2⤵
  PID:10312
- C:\Windows\System\NyeCuqb.exe
  C:\Windows\System\NyeCuqb.exe
  2⤵
  PID:10340
- C:\Windows\System\XgUqHFk.exe
  C:\Windows\System\XgUqHFk.exe
  2⤵
  PID:10368
- C:\Windows\System\DKwvGLO.exe
  C:\Windows\System\DKwvGLO.exe
  2⤵
  PID:10396
- C:\Windows\System\bncVArc.exe
  C:\Windows\System\bncVArc.exe
  2⤵
  PID:10424
- C:\Windows\System\JCFNwqm.exe
  C:\Windows\System\JCFNwqm.exe
  2⤵
  PID:10452
- C:\Windows\System\IpgMDFe.exe
  C:\Windows\System\IpgMDFe.exe
  2⤵
  PID:10480
- C:\Windows\System\yziXHBj.exe
  C:\Windows\System\yziXHBj.exe
  2⤵
  PID:10508
- C:\Windows\System\WMwTUDT.exe
  C:\Windows\System\WMwTUDT.exe
  2⤵
  PID:10536
- C:\Windows\System\NFNlBGb.exe
  C:\Windows\System\NFNlBGb.exe
  2⤵
  PID:10552
- C:\Windows\System\riJMMYy.exe
  C:\Windows\System\riJMMYy.exe
  2⤵
  PID:10592
- C:\Windows\System\wxzKxFU.exe
  C:\Windows\System\wxzKxFU.exe
  2⤵
  PID:10620
- C:\Windows\System\QCSPwwe.exe
  C:\Windows\System\QCSPwwe.exe
  2⤵
  PID:10648
- C:\Windows\System\oUwjONc.exe
  C:\Windows\System\oUwjONc.exe
  2⤵
  PID:10676
- C:\Windows\System\bnlGxiO.exe
  C:\Windows\System\bnlGxiO.exe
  2⤵
  PID:10704
- C:\Windows\System\nefPPLk.exe
  C:\Windows\System\nefPPLk.exe
  2⤵
  PID:10720
- C:\Windows\System\DxsGKkB.exe
  C:\Windows\System\DxsGKkB.exe
  2⤵
  PID:10748
- C:\Windows\System\nOqwODb.exe
  C:\Windows\System\nOqwODb.exe
  2⤵
  PID:10788
- C:\Windows\System\lcyQBiy.exe
  C:\Windows\System\lcyQBiy.exe
  2⤵
  PID:10816
- C:\Windows\System\CUzbyVq.exe
  C:\Windows\System\CUzbyVq.exe
  2⤵
  PID:10844
- C:\Windows\System\zPAcSRo.exe
  C:\Windows\System\zPAcSRo.exe
  2⤵
  PID:10872
- C:\Windows\System\FUCerjD.exe
  C:\Windows\System\FUCerjD.exe
  2⤵
  PID:10892
- C:\Windows\System\hPPrXrk.exe
  C:\Windows\System\hPPrXrk.exe
  2⤵
  PID:10928
- C:\Windows\System\XsoSNhM.exe
  C:\Windows\System\XsoSNhM.exe
  2⤵
  PID:10956
- C:\Windows\System\BXSjGWh.exe
  C:\Windows\System\BXSjGWh.exe
  2⤵
  PID:10972
- C:\Windows\System\SjLrwgn.exe
  C:\Windows\System\SjLrwgn.exe
  2⤵
  PID:11012
- C:\Windows\System\TtJCmtD.exe
  C:\Windows\System\TtJCmtD.exe
  2⤵
  PID:11036
- C:\Windows\System\baxGwLH.exe
  C:\Windows\System\baxGwLH.exe
  2⤵
  PID:11056
- C:\Windows\System\dqZasTp.exe
  C:\Windows\System\dqZasTp.exe
  2⤵
  PID:11076
- C:\Windows\System\llkauLO.exe
  C:\Windows\System\llkauLO.exe
  2⤵
  PID:11120
- C:\Windows\System\AZMbsWp.exe
  C:\Windows\System\AZMbsWp.exe
  2⤵
  PID:11140
- C:\Windows\System\XEIFeed.exe
  C:\Windows\System\XEIFeed.exe
  2⤵
  PID:11156
- C:\Windows\System\YdryLoR.exe
  C:\Windows\System\YdryLoR.exe
  2⤵
  PID:11184
- C:\Windows\System\uychKgJ.exe
  C:\Windows\System\uychKgJ.exe
  2⤵
  PID:11236
- C:\Windows\System\SkbYYgv.exe
  C:\Windows\System\SkbYYgv.exe
  2⤵
  PID:10688
- C:\Windows\System\GOsvypy.exe
  C:\Windows\System\GOsvypy.exe
  2⤵
  PID:10732
- C:\Windows\System\GDgvIff.exe
  C:\Windows\System\GDgvIff.exe
  2⤵
  PID:10812
- C:\Windows\System\lPkosff.exe
  C:\Windows\System\lPkosff.exe
  2⤵
  PID:10864
- C:\Windows\System\nFuhJjb.exe
  C:\Windows\System\nFuhJjb.exe
  2⤵
  PID:10944
- C:\Windows\System\vMhRQpb.exe
  C:\Windows\System\vMhRQpb.exe
  2⤵
  PID:11024
- C:\Windows\System\lVmIabg.exe
  C:\Windows\System\lVmIabg.exe
  2⤵
  PID:11088
- C:\Windows\System\djEQnwq.exe
  C:\Windows\System\djEQnwq.exe
  2⤵
  PID:11132
- C:\Windows\System\wQxgAIY.exe
  C:\Windows\System\wQxgAIY.exe
  2⤵
  PID:11200
- C:\Windows\System\DDmeLmi.exe
  C:\Windows\System\DDmeLmi.exe
  2⤵
  PID:10136
- C:\Windows\System\XqvJlOr.exe
  C:\Windows\System\XqvJlOr.exe
  2⤵
  PID:10296
- C:\Windows\System\fKjQEvp.exe
  C:\Windows\System\fKjQEvp.exe
  2⤵
  PID:10384
- C:\Windows\System\dxYgBRD.exe
  C:\Windows\System\dxYgBRD.exe
  2⤵
  PID:10504
- C:\Windows\System\EDxdNla.exe
  C:\Windows\System\EDxdNla.exe
  2⤵
  PID:10444
- C:\Windows\System\OcAgiJZ.exe
  C:\Windows\System\OcAgiJZ.exe
  2⤵
  PID:10604
- C:\Windows\System\gfKhbyR.exe
  C:\Windows\System\gfKhbyR.exe
  2⤵
  PID:10640
- C:\Windows\System\rkeoLrm.exe
  C:\Windows\System\rkeoLrm.exe
  2⤵
  PID:10712
- C:\Windows\System\IAeLmxk.exe
  C:\Windows\System\IAeLmxk.exe
  2⤵
  PID:10808
- C:\Windows\System\YLbcJaa.exe
  C:\Windows\System\YLbcJaa.exe
  2⤵
  PID:11048
- C:\Windows\System\FHlXNXQ.exe
  C:\Windows\System\FHlXNXQ.exe
  2⤵
  PID:11216
- C:\Windows\System\nXdvGBo.exe
  C:\Windows\System\nXdvGBo.exe
  2⤵
  PID:10324
- C:\Windows\System\Vetzcjm.exe
  C:\Windows\System\Vetzcjm.exe
  2⤵
  PID:10464
- C:\Windows\System\tJdBrnz.exe
  C:\Windows\System\tJdBrnz.exe
  2⤵
  PID:10632
- C:\Windows\System\wfyNOoh.exe
  C:\Windows\System\wfyNOoh.exe
  2⤵
  PID:10800
- C:\Windows\System\ZzpUsCE.exe
  C:\Windows\System\ZzpUsCE.exe
  2⤵
  PID:10276
- C:\Windows\System\qMAxHkw.exe
  C:\Windows\System\qMAxHkw.exe
  2⤵
  PID:11004
- C:\Windows\System\CZKscZV.exe
  C:\Windows\System\CZKscZV.exe
  2⤵
  PID:11268
- C:\Windows\System\lQAIaLA.exe
  C:\Windows\System\lQAIaLA.exe
  2⤵
  PID:11284
- C:\Windows\System\pcWadit.exe
  C:\Windows\System\pcWadit.exe
  2⤵
  PID:11312
- C:\Windows\System\cgFrZcE.exe
  C:\Windows\System\cgFrZcE.exe
  2⤵
  PID:11340
- C:\Windows\System\ZlbhXTA.exe
  C:\Windows\System\ZlbhXTA.exe
  2⤵
  PID:11368
- C:\Windows\System\coUZNkt.exe
  C:\Windows\System\coUZNkt.exe
  2⤵
  PID:11396
- C:\Windows\System\nZoemhu.exe
  C:\Windows\System\nZoemhu.exe
  2⤵
  PID:11424
- C:\Windows\System\KxhlEoQ.exe
  C:\Windows\System\KxhlEoQ.exe
  2⤵
  PID:11452
- C:\Windows\System\wQMhKhx.exe
  C:\Windows\System\wQMhKhx.exe
  2⤵
  PID:11480
- C:\Windows\System\XWRQonx.exe
  C:\Windows\System\XWRQonx.exe
  2⤵
  PID:11508
- C:\Windows\System\QhSbEIy.exe
  C:\Windows\System\QhSbEIy.exe
  2⤵
  PID:11536
- C:\Windows\System\MXUAwIi.exe
  C:\Windows\System\MXUAwIi.exe
  2⤵
  PID:11564
- C:\Windows\System\rVvsFmL.exe
  C:\Windows\System\rVvsFmL.exe
  2⤵
  PID:11592
- C:\Windows\System\CtseVWR.exe
  C:\Windows\System\CtseVWR.exe
  2⤵
  PID:11620
- C:\Windows\System\umATjce.exe
  C:\Windows\System\umATjce.exe
  2⤵
  PID:11648
- C:\Windows\System\pzcgXiV.exe
  C:\Windows\System\pzcgXiV.exe
  2⤵
  PID:11676
- C:\Windows\System\rwwcVfn.exe
  C:\Windows\System\rwwcVfn.exe
  2⤵
  PID:11704
- C:\Windows\System\CnWerdR.exe
  C:\Windows\System\CnWerdR.exe
  2⤵
  PID:11732
- C:\Windows\System\locEGuR.exe
  C:\Windows\System\locEGuR.exe
  2⤵
  PID:11760
- C:\Windows\System\lEHTopa.exe
  C:\Windows\System\lEHTopa.exe
  2⤵
  PID:11788
- C:\Windows\System\UjdSQrv.exe
  C:\Windows\System\UjdSQrv.exe
  2⤵
  PID:11808
- C:\Windows\System\cIaBYdN.exe
  C:\Windows\System\cIaBYdN.exe
  2⤵
  PID:11832
- C:\Windows\System\WLbrYGd.exe
  C:\Windows\System\WLbrYGd.exe
  2⤵
  PID:11860
- C:\Windows\System\weQHvKa.exe
  C:\Windows\System\weQHvKa.exe
  2⤵
  PID:11888
- C:\Windows\System\aDhbwyw.exe
  C:\Windows\System\aDhbwyw.exe
  2⤵
  PID:11908
- C:\Windows\System\OPprZvV.exe
  C:\Windows\System\OPprZvV.exe
  2⤵
  PID:11944
- C:\Windows\System\nEMkoAN.exe
  C:\Windows\System\nEMkoAN.exe
  2⤵
  PID:11984
- C:\Windows\System\lZawMmt.exe
  C:\Windows\System\lZawMmt.exe
  2⤵
  PID:12012
- C:\Windows\System\SzpTixg.exe
  C:\Windows\System\SzpTixg.exe
  2⤵
  PID:12040
- C:\Windows\System\toMvpSO.exe
  C:\Windows\System\toMvpSO.exe
  2⤵
  PID:12060
- C:\Windows\System\WCNOIgr.exe
  C:\Windows\System\WCNOIgr.exe
  2⤵
  PID:12088
- C:\Windows\System\qCtFyqd.exe
  C:\Windows\System\qCtFyqd.exe
  2⤵
  PID:12116
- C:\Windows\System\psxmdfz.exe
  C:\Windows\System\psxmdfz.exe
  2⤵
  PID:12144
- C:\Windows\System\vsSVqMm.exe
  C:\Windows\System\vsSVqMm.exe
  2⤵
  PID:12176
- C:\Windows\System\nnUlNTs.exe
  C:\Windows\System\nnUlNTs.exe
  2⤵
  PID:12200
- C:\Windows\System\PDjUsFE.exe
  C:\Windows\System\PDjUsFE.exe
  2⤵
  PID:12228
- C:\Windows\System\NbWNwJr.exe
  C:\Windows\System\NbWNwJr.exe
  2⤵
  PID:12256
- C:\Windows\System\fIYfiYF.exe
  C:\Windows\System\fIYfiYF.exe
  2⤵
  PID:12276
- C:\Windows\System\SWEwZrs.exe
  C:\Windows\System\SWEwZrs.exe
  2⤵
  PID:11352
- C:\Windows\System\GVqjxQF.exe
  C:\Windows\System\GVqjxQF.exe
  2⤵
  PID:11388
- C:\Windows\System\aLsJvpp.exe
  C:\Windows\System\aLsJvpp.exe
  2⤵
  PID:11476
- C:\Windows\System\vjMIdtA.exe
  C:\Windows\System\vjMIdtA.exe
  2⤵
  PID:11548
- C:\Windows\System\ZnHVhBG.exe
  C:\Windows\System\ZnHVhBG.exe
  2⤵
  PID:11612
- C:\Windows\System\ysgFDCk.exe
  C:\Windows\System\ysgFDCk.exe
  2⤵
  PID:9340
- C:\Windows\System\orjOaoA.exe
  C:\Windows\System\orjOaoA.exe
  2⤵
  PID:11728
- C:\Windows\System\gKuTrVs.exe
  C:\Windows\System\gKuTrVs.exe
  2⤵
  PID:11780
- C:\Windows\System\lqIIDMt.exe
  C:\Windows\System\lqIIDMt.exe
  2⤵
  PID:11848
- C:\Windows\System\aaKEcqT.exe
  C:\Windows\System\aaKEcqT.exe
  2⤵
  PID:11880
- C:\Windows\System\zNiVwUL.exe
  C:\Windows\System\zNiVwUL.exe
  2⤵
  PID:11916
- C:\Windows\System\PXUTUHa.exe
  C:\Windows\System\PXUTUHa.exe
  2⤵
  PID:12028
- C:\Windows\System\bpXhnCU.exe
  C:\Windows\System\bpXhnCU.exe
  2⤵
  PID:12100
- C:\Windows\System\wAFpKzc.exe
  C:\Windows\System\wAFpKzc.exe
  2⤵
  PID:12132
- C:\Windows\System\aZSCJSA.exe
  C:\Windows\System\aZSCJSA.exe
  2⤵
  PID:12240
- C:\Windows\System\LZsCjeC.exe
  C:\Windows\System\LZsCjeC.exe
  2⤵
  PID:12272
- C:\Windows\System\ZVZDIpr.exe
  C:\Windows\System\ZVZDIpr.exe
  2⤵
  PID:11472
- C:\Windows\System\yenZLDR.exe
  C:\Windows\System\yenZLDR.exe
  2⤵
  PID:11604
- C:\Windows\System\NSQIbLf.exe
  C:\Windows\System\NSQIbLf.exe
  2⤵
  PID:11816
- C:\Windows\System\WaZqLAg.exe
  C:\Windows\System\WaZqLAg.exe
  2⤵
  PID:11932
- C:\Windows\System\zKcxjZZ.exe
  C:\Windows\System\zKcxjZZ.exe
  2⤵
  PID:12024
- C:\Windows\System\wgcoJWZ.exe
  C:\Windows\System\wgcoJWZ.exe
  2⤵
  PID:12172
- C:\Windows\System\YfrOVpt.exe
  C:\Windows\System\YfrOVpt.exe
  2⤵
  PID:11436
- C:\Windows\System\mKnXfhZ.exe
  C:\Windows\System\mKnXfhZ.exe
  2⤵
  PID:11588
- C:\Windows\System\LvgGPAo.exe
  C:\Windows\System\LvgGPAo.exe
  2⤵
  PID:12076
- C:\Windows\System\ExKQoOG.exe
  C:\Windows\System\ExKQoOG.exe
  2⤵
  PID:12212
- C:\Windows\System\nLPDPSa.exe
  C:\Windows\System\nLPDPSa.exe
  2⤵
  PID:12248
- C:\Windows\System\WFpWdLA.exe
  C:\Windows\System\WFpWdLA.exe
  2⤵
  PID:12308
- C:\Windows\System\EaWjTxy.exe
  C:\Windows\System\EaWjTxy.exe
  2⤵
  PID:12348
- C:\Windows\System\rWQDjbf.exe
  C:\Windows\System\rWQDjbf.exe
  2⤵
  PID:12376
- C:\Windows\System\HfKjytC.exe
  C:\Windows\System\HfKjytC.exe
  2⤵
  PID:12404
- C:\Windows\System\fPtTLyY.exe
  C:\Windows\System\fPtTLyY.exe
  2⤵
  PID:12432
- C:\Windows\System\kPOJNWO.exe
  C:\Windows\System\kPOJNWO.exe
  2⤵
  PID:12460
- C:\Windows\System\NkfLtAl.exe
  C:\Windows\System\NkfLtAl.exe
  2⤵
  PID:12476
- C:\Windows\System\czQIhrn.exe
  C:\Windows\System\czQIhrn.exe
  2⤵
  PID:12500
- C:\Windows\System\FtpDGes.exe
  C:\Windows\System\FtpDGes.exe
  2⤵
  PID:12532
- C:\Windows\System\sQqATlZ.exe
  C:\Windows\System\sQqATlZ.exe
  2⤵
  PID:12580
- C:\Windows\System\wIxIpqS.exe
  C:\Windows\System\wIxIpqS.exe
  2⤵
  PID:12608
- C:\Windows\System\YJHeRaC.exe
  C:\Windows\System\YJHeRaC.exe
  2⤵
  PID:12632
- C:\Windows\System\ILaidrM.exe
  C:\Windows\System\ILaidrM.exe
  2⤵
  PID:12664
- C:\Windows\System\WjdgLrw.exe
  C:\Windows\System\WjdgLrw.exe
  2⤵
  PID:12692
- C:\Windows\System\uxKzeNC.exe
  C:\Windows\System\uxKzeNC.exe
  2⤵
  PID:12720
- C:\Windows\System\EsNkGrG.exe
  C:\Windows\System\EsNkGrG.exe
  2⤵
  PID:12748
- C:\Windows\System\MSdqHoS.exe
  C:\Windows\System\MSdqHoS.exe
  2⤵
  PID:12776
- C:\Windows\System\XgULRYo.exe
  C:\Windows\System\XgULRYo.exe
  2⤵
  PID:12808
- C:\Windows\System\UgDZObo.exe
  C:\Windows\System\UgDZObo.exe
  2⤵
  PID:12824
- C:\Windows\System\cDLeEBP.exe
  C:\Windows\System\cDLeEBP.exe
  2⤵
  PID:12864
- C:\Windows\System\cWtGLjo.exe
  C:\Windows\System\cWtGLjo.exe
  2⤵
  PID:12892
- C:\Windows\System\NVjwYvU.exe
  C:\Windows\System\NVjwYvU.exe
  2⤵
  PID:12920
- C:\Windows\System\LktktVV.exe
  C:\Windows\System\LktktVV.exe
  2⤵
  PID:12948
- C:\Windows\System\uchvxHu.exe
  C:\Windows\System\uchvxHu.exe
  2⤵
  PID:12976
- C:\Windows\System\XlxAgyl.exe
  C:\Windows\System\XlxAgyl.exe
  2⤵
  PID:13004
- C:\Windows\System\FpeygPU.exe
  C:\Windows\System\FpeygPU.exe
  2⤵
  PID:13020
- C:\Windows\System\NXyoznL.exe
  C:\Windows\System\NXyoznL.exe
  2⤵
  PID:13048
- C:\Windows\System\PvuccmO.exe
  C:\Windows\System\PvuccmO.exe
  2⤵
  PID:13084
- C:\Windows\System\GqlTbne.exe
  C:\Windows\System\GqlTbne.exe
  2⤵
  PID:13116
- C:\Windows\System\nubGnjc.exe
  C:\Windows\System\nubGnjc.exe
  2⤵
  PID:13144
- C:\Windows\System\KmVcmLm.exe
  C:\Windows\System\KmVcmLm.exe
  2⤵
  PID:13172
- C:\Windows\System\ArfAiOO.exe
  C:\Windows\System\ArfAiOO.exe
  2⤵
  PID:13200
- C:\Windows\System\BSmoAvC.exe
  C:\Windows\System\BSmoAvC.exe
  2⤵
  PID:13224
- C:\Windows\System\GUNFjDr.exe
  C:\Windows\System\GUNFjDr.exe
  2⤵
  PID:13256
- C:\Windows\System\hnmZGwf.exe
  C:\Windows\System\hnmZGwf.exe
  2⤵
  PID:13284
- C:\Windows\System\XFtiwwD.exe
  C:\Windows\System\XFtiwwD.exe
  2⤵
  PID:11532
- C:\Windows\System\ihbMrfC.exe
  C:\Windows\System\ihbMrfC.exe
  2⤵
  PID:12336
- C:\Windows\System\dssCztC.exe
  C:\Windows\System\dssCztC.exe
  2⤵
  PID:12388
- C:\Windows\System\BYRTfQQ.exe
  C:\Windows\System\BYRTfQQ.exe
  2⤵
  PID:12452
- C:\Windows\System\hZbBmHI.exe
  C:\Windows\System\hZbBmHI.exe
  2⤵
  PID:12512
- C:\Windows\System\FytOUZZ.exe
  C:\Windows\System\FytOUZZ.exe
  2⤵
  PID:12600
- C:\Windows\System\SLohPgp.exe
  C:\Windows\System\SLohPgp.exe
  2⤵
  PID:12616
- C:\Windows\System\jyOgaSD.exe
  C:\Windows\System\jyOgaSD.exe
  2⤵
  PID:12676
- C:\Windows\System\ihqwdPH.exe
  C:\Windows\System\ihqwdPH.exe
  2⤵
  PID:12788
- C:\Windows\System\eHYUYNU.exe
  C:\Windows\System\eHYUYNU.exe
  2⤵
  PID:12852
- C:\Windows\System\JaVLXnP.exe
  C:\Windows\System\JaVLXnP.exe
  2⤵
  PID:12888
- C:\Windows\System\VOqDbvu.exe
  C:\Windows\System\VOqDbvu.exe
  2⤵
  PID:12960
- C:\Windows\System\thZMDZY.exe
  C:\Windows\System\thZMDZY.exe
  2⤵
  PID:13016
- C:\Windows\System\ALKojQT.exe
  C:\Windows\System\ALKojQT.exe
  2⤵
  PID:13076
- C:\Windows\System\mZvrXRk.exe
  C:\Windows\System\mZvrXRk.exe
  2⤵
  PID:13156
- C:\Windows\System\jGthrZO.exe
  C:\Windows\System\jGthrZO.exe
  2⤵
  PID:916
- C:\Windows\System\fChdaAS.exe
  C:\Windows\System\fChdaAS.exe
  2⤵
  PID:1912
- C:\Windows\System\XIEVkJg.exe
  C:\Windows\System\XIEVkJg.exe
  2⤵
  PID:13280
- C:\Windows\System\ivTMuHd.exe
  C:\Windows\System\ivTMuHd.exe
  2⤵
  PID:12340
- C:\Windows\System\VYKoPux.exe
  C:\Windows\System\VYKoPux.exe
  2⤵
  PID:12520
- C:\Windows\System\BmgSgIV.exe
  C:\Windows\System\BmgSgIV.exe
  2⤵
  PID:12624
- C:\Windows\System\rEZpwny.exe
  C:\Windows\System\rEZpwny.exe
  2⤵
  PID:12736
- C:\Windows\System\nNMvmPQ.exe
  C:\Windows\System\nNMvmPQ.exe
  2⤵
  PID:12796
- C:\Windows\System\cLGzOQq.exe
  C:\Windows\System\cLGzOQq.exe
  2⤵
  PID:13100
- C:\Windows\System\PZWPSNX.exe
  C:\Windows\System\PZWPSNX.exe
  2⤵
  PID:1472
- C:\Windows\System\KnvjgeB.exe
  C:\Windows\System\KnvjgeB.exe
  2⤵
  PID:12364
- C:\Windows\System\PKaGezq.exe
  C:\Windows\System\PKaGezq.exe
  2⤵
  PID:12836
- C:\Windows\System\FzZRjOW.exe
  C:\Windows\System\FzZRjOW.exe
  2⤵
  PID:13000
- C:\Windows\System\bLLBCDH.exe
  C:\Windows\System\bLLBCDH.exe
  2⤵
  PID:13248
- C:\Windows\System\qdzCrQz.exe
  C:\Windows\System\qdzCrQz.exe
  2⤵
  PID:12916
- C:\Windows\System\sTAVOxy.exe
  C:\Windows\System\sTAVOxy.exe
  2⤵
  PID:13320
- C:\Windows\System\EFGWatz.exe
  C:\Windows\System\EFGWatz.exe
  2⤵
  PID:13352
- C:\Windows\System\xROVHtI.exe
  C:\Windows\System\xROVHtI.exe
  2⤵
  PID:13380
- C:\Windows\System\vwaPirY.exe
  C:\Windows\System\vwaPirY.exe
  2⤵
  PID:13412
- C:\Windows\System\oqMLtOG.exe
  C:\Windows\System\oqMLtOG.exe
  2⤵
  PID:13436
- C:\Windows\System\lHfKIpt.exe
  C:\Windows\System\lHfKIpt.exe
  2⤵
  PID:13468
- C:\Windows\System\KcnqQxD.exe
  C:\Windows\System\KcnqQxD.exe
  2⤵
  PID:13496
- C:\Windows\System\DVbyfua.exe
  C:\Windows\System\DVbyfua.exe
  2⤵
  PID:13524
- C:\Windows\System\wOWlRnf.exe
  C:\Windows\System\wOWlRnf.exe
  2⤵
  PID:13552
- C:\Windows\System\ieUyKZn.exe
  C:\Windows\System\ieUyKZn.exe
  2⤵
  PID:13568
- C:\Windows\System\gUdcCcl.exe
  C:\Windows\System\gUdcCcl.exe
  2⤵
  PID:13596
- C:\Windows\System\FWPwqTU.exe
  C:\Windows\System\FWPwqTU.exe
  2⤵
  PID:13636
- C:\Windows\System\BliEfXH.exe
  C:\Windows\System\BliEfXH.exe
  2⤵
  PID:13664
- C:\Windows\System\wCSWgNh.exe
  C:\Windows\System\wCSWgNh.exe
  2⤵
  PID:13684
- C:\Windows\System\HZxLjKW.exe
  C:\Windows\System\HZxLjKW.exe
  2⤵
  PID:13712
- C:\Windows\System\yUJHpwR.exe
  C:\Windows\System\yUJHpwR.exe
  2⤵
  PID:13740
- C:\Windows\System\yEpjyAq.exe
  C:\Windows\System\yEpjyAq.exe
  2⤵
  PID:13764
- C:\Windows\System\lyGOPAb.exe
  C:\Windows\System\lyGOPAb.exe
  2⤵
  PID:13792
- C:\Windows\System\RAOWPcr.exe
  C:\Windows\System\RAOWPcr.exe
  2⤵
  PID:13824
- C:\Windows\System\ZPDVaog.exe
  C:\Windows\System\ZPDVaog.exe
  2⤵
  PID:13860
- C:\Windows\System\mIvdPOJ.exe
  C:\Windows\System\mIvdPOJ.exe
  2⤵
  PID:13888
- C:\Windows\System\tmwlZir.exe
  C:\Windows\System\tmwlZir.exe
  2⤵
  PID:13916
- C:\Windows\System\BjdbroE.exe
  C:\Windows\System\BjdbroE.exe
  2⤵
  PID:13944
- C:\Windows\System\UnWCCRV.exe
  C:\Windows\System\UnWCCRV.exe
  2⤵
  PID:13968
- C:\Windows\System\rKUkmcn.exe
  C:\Windows\System\rKUkmcn.exe
  2⤵
  PID:14000
- C:\Windows\System\HzmTqfO.exe
  C:\Windows\System\HzmTqfO.exe
  2⤵
  PID:14020
- C:\Windows\System\UfzqwIQ.exe
  C:\Windows\System\UfzqwIQ.exe
  2⤵
  PID:14044
- C:\Windows\System\GSdNIcb.exe
  C:\Windows\System\GSdNIcb.exe
  2⤵
  PID:14072
- C:\Windows\System\SXhfepG.exe
  C:\Windows\System\SXhfepG.exe
  2⤵
  PID:14096
- C:\Windows\System\BxbhsWi.exe
  C:\Windows\System\BxbhsWi.exe
  2⤵
  PID:14128
- C:\Windows\System\EYRdsFm.exe
  C:\Windows\System\EYRdsFm.exe
  2⤵
  PID:14168
- C:\Windows\System\ItSQNTI.exe
  C:\Windows\System\ItSQNTI.exe
  2⤵
  PID:14184
- C:\Windows\System\dRvZowo.exe
  C:\Windows\System\dRvZowo.exe
  2⤵
  PID:14212
- C:\Windows\System\otLClOo.exe
  C:\Windows\System\otLClOo.exe
  2⤵
  PID:14240
- C:\Windows\System\FSimSgm.exe
  C:\Windows\System\FSimSgm.exe
  2⤵
  PID:14268
- C:\Windows\System\cCxYMal.exe
  C:\Windows\System\cCxYMal.exe
  2⤵
  PID:14296
- C:\Windows\System\hFnPwHZ.exe
  C:\Windows\System\hFnPwHZ.exe
  2⤵
  PID:4536
- C:\Windows\System\tqhlvKN.exe
  C:\Windows\System\tqhlvKN.exe
  2⤵
  PID:13336
- C:\Windows\System\WsyMxRQ.exe
  C:\Windows\System\WsyMxRQ.exe
  2⤵
  PID:13408
- C:\Windows\System\fFUsCKV.exe
  C:\Windows\System\fFUsCKV.exe
  2⤵
  PID:13464
- C:\Windows\System\wkITEFK.exe
  C:\Windows\System\wkITEFK.exe
  2⤵
  PID:13480
- C:\Windows\System\iJvpleC.exe
  C:\Windows\System\iJvpleC.exe
  2⤵
  PID:13584
- C:\Windows\System\ZPmeJwR.exe
  C:\Windows\System\ZPmeJwR.exe
  2⤵
  PID:1648
- C:\Windows\System\ZJMHQYQ.exe
  C:\Windows\System\ZJMHQYQ.exe
  2⤵
  PID:13700
- C:\Windows\System\OkhZHez.exe
  C:\Windows\System\OkhZHez.exe
  2⤵
  PID:13760
- C:\Windows\System\xtsrbGt.exe
  C:\Windows\System\xtsrbGt.exe
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DDRrsiE.exe

Filesize
2.3MB

MD5
6f4355683e42c07bf95c8b0013102681

SHA1
233d445ed3232168b3a3058e9d82b2fe62605530

SHA256
af765252b5e92a980926a859796bdf25c8bfbfba9aa3c6ca095b535d4ac5d174

SHA512
2ac50980381c3658276789b58df8b83549f112a96d053def60351a795769c3871a001d31839728a4753e7afa94189b73f12a339ece9ccfdbbae11853a81b3651

Download Submit
C:\Windows\System\EPzdUPq.exe

Filesize
2.3MB

MD5
53285669e9c87218c9c469521b017c75

SHA1
7a158face7e74e2c5df5024c5f36b2f05fdaec14

SHA256
25bcdb4f62ef1e2c510af893836edbc322b48a0e02ee8f42f8a2d94d3e5d1293

SHA512
baa38ff3290c9d42e4d2efe63ce891d52a3288f90705300e711d339bb60e9deb716166d306da76d6cb2bfa519857451910cd9476c0cba8a7e6d2ed97bdac8500

Download Submit
C:\Windows\System\JBjbkBw.exe

Filesize
2.3MB

MD5
dbc6e6c1d52b8251550e611e163c80a3

SHA1
f410cc227977467a72d99425d41a646b0ac7be33

SHA256
6eb20c405665a4d9384fe2163cc2d278d407aa967708799d2000e8280265ea06

SHA512
b99ba882d30d3bfea3dd4b118abb4298a2f3f02f60fac41b71ee83c3e146f9161cd9ed57fd20e766c98a79102e6abc56fca1b4745072dbbf11a465e630a63085

Download Submit
C:\Windows\System\JHHUuvT.exe

Filesize
2.3MB

MD5
8c2a3eaa77795bb213163fda81d03f25

SHA1
d28cb24200a462353ad9c5d73884930d7edbc958

SHA256
b81f344b0ed2e17a8d655772be3900d5577d94707fcb0d53a9a8ec45af845963

SHA512
e96b98d1882e48097c7341f42fd595cdfa878667dad5b8f84e19ff95597fd2e31dbc5cf99b3a188479c8a29c825fdc6c9aa4b7c432b677ad978c516df9226d40

Download Submit
C:\Windows\System\KXURILG.exe

Filesize
2.3MB

MD5
8ab9db7e83e9efc57040c7cf2325cdf4

SHA1
dd83584cf4380e93551d743b2e7c9845f2b331ca

SHA256
6bbb6445b2cc82332d36b8aec025b95e6c1a228ef0f6624ea8ca9119655304c3

SHA512
0f073855bdfff8477130b23c8dd992d0bedb4f305a873f358483c88e65747aaca11afe1e84bac87ed3ad11549e1a2f1e19f53e9fb0898cbfad6e647cb03856bb

Download Submit
C:\Windows\System\MOpfPSz.exe

Filesize
2.3MB

MD5
8bf2bbca08a2dca8512a14a0241f25ce

SHA1
6911e9b8639adc555aaacdb2fbb74ee2d8796b3f

SHA256
68b3d3a1811ad88e9d8e7f6fe6dc73131acabbada6ace1de6f4bc6630979a0c4

SHA512
3b262bc15882654bdbad1f29be9362201c7dd42d8a068be1bb367cdf165f96d5cefd00ab1c26981274579ce166554c10454d2cca60afa3e7288ce728f4437352

Download Submit
C:\Windows\System\NoraCut.exe

Filesize
2.3MB

MD5
a2dbdeed61bef6f5193ed2f7bcf8d784

SHA1
20267dbe869bfa2e6bf162c13893ed711a678300

SHA256
9eee52aae19e4d0c740c4948a400c60d7eb4f5481ee560c2380568fcf024605d

SHA512
2a85c3da7b0f993e50697f6c876596f8f1d169e0da7ad1948007428aabcc19892701e9a5442a3b25afa713945f5c5cab4d302163df6f3a0dba08baa71fd94ebe

Download Submit
C:\Windows\System\WNJjNKc.exe

Filesize
2.3MB

MD5
ca2b402b260cd700f549d86749af7c26

SHA1
c47fe4133a71fcd195cb146e8d6312da76e998ad

SHA256
0fa7e9c5bb252ce1e2ac800dae3c6a3741ad529bd4eec17d45369fd63f954e71

SHA512
8b41cb13a8825abc0ce9e1a1602a77a60bc596afcfb90347b28e523144dff0cab973826224dff3eb6d7044dc7ef9499e449ad50659ea0956790fc0bb85073223

Download Submit
C:\Windows\System\WwItaHi.exe

Filesize
2.3MB

MD5
a0db200fbbb89f01ca5bbba72baad1de

SHA1
22ef615737bbfbcd3338a727a74f718530f60c20

SHA256
2abbbd1b14866fe6c930ce0d263e9c3aa41a42835a0042ebaa1ec2fe9409980e

SHA512
0c755fa8e0c517a78ec4f9f75cdae75f2873ee4444248a8a6256fa432d6fdeab402779af60bf02174bf19646664ea46cc6809b34d9f71538550597b17dc82fbd

Download Submit
C:\Windows\System\YOLXLte.exe

Filesize
2.3MB

MD5
21e4e7afd01e31be3ce18d616a1451be

SHA1
54389c7a849c933042e1360c61f47ebd8deb7148

SHA256
a7dd2d6972265b160deb7d22a548807ebb946daa54a7ce64028be6fb8173d9e4

SHA512
c041c7965a00a8c949b9cc0e0d36292b14f35f69aed23eb2131af8a47f532af7196b6ccf117520f44d159010e1ad8e4445f380b648dd023dedb5293586345fae

Download Submit
C:\Windows\System\bAURlwE.exe

Filesize
2.3MB

MD5
6ab5866d5a186f6b76c07b6c90842adc

SHA1
8934274fc934cc8be845b495cdc95476978e0905

SHA256
c6c17d6329bf5a6e0d81d24b7f4acbcbbe90268c922700e6833ece186fb08879

SHA512
22da2d14db88f07fe6d7b3b0b9dd0d4f94fb29771cda06181bf554ee425fc89c9fc84a510d492bcabaf700d9d45d9180728a7d1b2a64f089c5d14c7621ed4949

Download Submit
C:\Windows\System\coTJnxd.exe

Filesize
2.3MB

MD5
65b4b94614ce8f19bbd3746b6d88fa8e

SHA1
04b9c94e7a450c4f9c2d73d43ad3e04fe059007d

SHA256
0027d8a4178c6094f42b35387026cfd0912059acf1ac4ff54176222cbe27ae99

SHA512
c6dad5ddd7ee70347dcaf198ad33678da315c24c637a810655ffb85079a94fcf75637f43342f85e156768c29a814397770dc6cdffa6eb9a2276903dd74c189c7

Download Submit
C:\Windows\System\eWQTeIc.exe

Filesize
2.3MB

MD5
36799c0254056dd6e64e83ad3a61ce73

SHA1
5b6a4e7653923ad43b5cc7be6d2cf25c90b66133

SHA256
2f3f25770ac0b195d5159b923e20756bce85ce601497ab7a02ebc40ebbf3e8ea

SHA512
784c12db73bf0a88d4367f1c3497a4266afa00da42a4a37e0014352bdcd330fd93f31d6e282529e2661050c5be6cadf6b72c79970c928ec6f622913521d42620

Download Submit
C:\Windows\System\ebKVOTC.exe

Filesize
2.3MB

MD5
1e4512b5779804a1097b603132531958

SHA1
4d6664fe31d9ed9428729f4b3988665f669851d8

SHA256
790f9cac2194a4e0226334fed3921f03af43c3bd526fbee4245ad72464f826b0

SHA512
a0682bb71f371e4eb3c9a37ac0888203ea10366beba0b8636ecce6ce612fab0de3a2297fc1d31d61886a9b0638df697f80b0ed41c2c0925e5e3c23580f6ca2d1

Download Submit
C:\Windows\System\fRGqFzm.exe

Filesize
2.3MB

MD5
166160190ad736a50efe2c14c18f835e

SHA1
a7b10eced0fba347b3e412435766ce55cfc780b0

SHA256
f4ced900957d3cc2e8a242dd1c5cc8aa772007da9987734de3a8a0d3a71f91c3

SHA512
187280b67c35351b0282d2b478614e5032137dbc341b6c5962743f1a4096b301dc322b8e6c867595281abb02b3cd5775521c398e6411287dc14d54e17f5981a2

Download Submit
C:\Windows\System\hBmwTgB.exe

Filesize
2.3MB

MD5
5bbd96f63bca9621640ee79200072288

SHA1
2dfcaf72374a078a51dc666c84cf4cc014ab4dff

SHA256
e8dc2a734d396b3c26963ecf07b9180c22faa45cb3858c77a726c8b08c9fe2f9

SHA512
bbe1f98f9ac0d3982e4268250f67ddf015bf6931c94cf26e347134397fe1cba1d3e92afff43a2cf3ae0d976de14313d7c8f1f4b9dea1f84264e8147c500a5b17

Download Submit
C:\Windows\System\hXxwvJQ.exe

Filesize
2.3MB

MD5
b4fd7ecfbd91d057fefa6342ea162905

SHA1
1c9a8ce82af967ee02ca329ed3c27026a26171b9

SHA256
270dd2f0cbd36fb2d77a45fc9dc4907fbf1d630d3aa2345abc1d8498ef8551ff

SHA512
6bb50665b0df29a6855612cc8b9384b6bf69b06740c258c8cdda38af014e976b7c191c0c427dfd82fdf8f4be3e87a6b2f717b2083a8b2ff04f69f1da7467cbf4

Download Submit
C:\Windows\System\hjabSXA.exe

Filesize
2.3MB

MD5
0e8494dff8526ac9c7691bb45af76c4b

SHA1
090674de493f9fdca47afcc152b5d0b4d4f03cac

SHA256
424becb00c067058205c34d6138d3710cb61c8adce8dcb2ba963cd39739a3b5c

SHA512
8b05c12ec02d81f04da24b6ba60d82c12512fca2f33ae84356db0ee3b7ef506ba9e1c2e35683bcc263a4bcc4d2f704fc4cf0a6789a1c48208e14d93f1a35ace8

Download Submit
C:\Windows\System\hjwJZSG.exe

Filesize
2.3MB

MD5
383ba2b31d4b8b94b745b4a77f322b45

SHA1
619625ee930cba34109b81e5738012fc8234df60

SHA256
851cd994ec295d94da74be3500dc4df64fae8f7677e82cda5e9847927daef107

SHA512
944fc2ca01c5b24b6dde8562a528d6589bf1462e17e7fb007c5f2870df627142f0a1e4fb276d1b22bce19479e0910e4ec52eb1dd00e39fae253c622df9f0bddd

Download Submit
C:\Windows\System\kFHTmGp.exe

Filesize
2.3MB

MD5
b7082977b0a1440c9b25b6cfb54db146

SHA1
6d4c7b858ff5527a9fc6ad8202973c3ce5195229

SHA256
2c9eead06bee4818d4d41f5ffa36ffc9eef84383383c117f34c5a90274889e1a

SHA512
4fc43678eb6c0600e5b90f02d7897a72012f6700d4286ab3dc86fd1092c97d98d5b04a0b100dfb5158c3cf53df7b1c10b226c6adc8f44dbb5a99f29f9dda19fe

Download Submit
C:\Windows\System\kHLkYuj.exe

Filesize
2.3MB

MD5
c427f3c8e868f8d3de73b2a3e5d1ef73

SHA1
393f6153abf0d4c6d9a38f1913a622d707eed259

SHA256
802a42904b1d15644fafe9b26a699706163106341df779b14dff0f0a8efc145c

SHA512
8e74c5d65061e1c7e0eb68d18be431f0e9b555c80e700607b96cc6a153a96b13bacb76bfff736d853bb1e8bf7b10843a2f92b1fb39aa7f8c143cde73c3e05997

Download Submit
C:\Windows\System\miLnKqF.exe

Filesize
2.3MB

MD5
73f06821a9f2fe7c936b75f79cc9d64c

SHA1
61373001206c7ed461d24b8cf14394fd9a37836b

SHA256
c55b062e7237df1005854e4210a70805ef9b8998c0e600f2c0416a58e4a3e308

SHA512
31b9696a3e3848285c37fb42565c51702a6aebc9deb01d4521d3f2a8bd645120bcb477ef132e7703b7b0a8d10b7cd1e19d6602b6a89ba95f197b7cde75a0f964

Download Submit
C:\Windows\System\nhTpoFV.exe

Filesize
2.3MB

MD5
269f731bb929e72a45345b792bc3ea9c

SHA1
7742b7662da646417f996fd2cb48600156b120a3

SHA256
873c6f243bc195377ebd00a5018009a8cd59fb76b895b8c72f63b09531991a81

SHA512
eacbc9d78a9e0a49712b6c68885a57b84536f147389f9d353fc8b679c9de2a591ab0d02fd311dd0f6a807010627bcbba65cb77fdd101dad8cfda2f858c73d2b2

Download Submit
C:\Windows\System\pTSrOTL.exe

Filesize
2.3MB

MD5
bcbb3231e687e58ce14def83f25fc459

SHA1
54bf7860530ed02b77cb45dbd4737ed8e5a3e832

SHA256
62c58198064d4422aa1788b1f73b1c6102c82431d1632421063abf0ad9efe500

SHA512
a3dd9c9ffac2e9c3f5fb10f1c0db3a25b86eb5f071477404b3c4fde085825efb63d12ff581ec24de0eaf99a6d1fddb8585994f11a090f7142b00833d5dc5170a

Download Submit
C:\Windows\System\qJLYsIR.exe

Filesize
2.3MB

MD5
352012f01f2dcf1fefa38bbd129f5879

SHA1
3a87b452263da5f1e3db7f71ab8e905aa2c43893

SHA256
a57ac369aa796530dd16c008df7b94b00d2b097d78d7a235d3dc3b6a186f443e

SHA512
f907fee791d94527c10a142ba142d5774f57acffa3fbe268209714fcd3ee639f699e3e63427956c81d6132d84835e8ab4a3438b03f111281e0da72ecdf32d7ac

Download Submit
C:\Windows\System\qaAFqxn.exe

Filesize
2.3MB

MD5
9c144c5d0d4fbebde133be32fa07aa18

SHA1
2ca097fc79c1867a9da7030548d3f8bdf0333139

SHA256
c6901b9afbad1d2dd17ad82c23e088dffa8a06aa657ad2698fedd98611f1da1c

SHA512
b5ec31f0f05c43ffa27142fe8e72d8301c3487d6660ad22b0b85966b7e2e4e63c7775eb98798c9343dc259a454acb9da253b4ab321658c42532a358d3ed5a4d3

Download Submit
C:\Windows\System\uLtCmXv.exe

Filesize
2.3MB

MD5
48eef0b8c56e8a1d60f63734346d4ae9

SHA1
479cda9fae8c45f48265790517e96d4e415e83fc

SHA256
afc0ea9b8c81376e8a5ec03062782fe55aa95113890d2cca0c343727f7a57e8c

SHA512
35513ca70d481f64341ded4170225f25da9dc8ba8bd6ade8ae1732f8f8ae88180fc22de4819b1c52154a69fa1e8ae8354a95249882787b111741d3445daa7783

Download Submit
C:\Windows\System\uuujcHf.exe

Filesize
2.3MB

MD5
981118ab56a12d1c3aa627aeddc1b4ee

SHA1
39807b6a116d654754ca1f7d3bcee90809b9e043

SHA256
89688a4e494faf486133c2e5e95ed90f07f1e5cec15f6f5ecc26b679f7fa9fb1

SHA512
9397824cee14c91134005f41bed68c33433d2b0e3fccda110aa73d3dd17fffff97955070c8871c5ec119cab7e28b578fe3e8b3a18b610d78f011edf6a62af0ae

Download Submit
C:\Windows\System\wQSHclv.exe

Filesize
2.3MB

MD5
6eb4e291171f2418a7baa784db295507

SHA1
49813fcbc35e23aa542d5f639d6745e4998898cd

SHA256
1157631fa6528fddbf597b43eb1c082a3b7be02243b4750a39f2423149bcfdba

SHA512
258015fd77c0849505af64081d9283d7ceef888fa0c64fbc916e832ee15f9526c8e235eb9fa0c8b85e00986a7bf176e885892f0c7147178917ddbb500b0ceb94

Download Submit
C:\Windows\System\xAnnWbO.exe

Filesize
2.3MB

MD5
309d2125a940cb41291460701ce68df9

SHA1
616c129d005355300589f2bfb762ea48a6d1668a

SHA256
95ef11682b7a3bb3efb06450b5bb721ed707dd1d42fa28663c061ee7e237df6f

SHA512
a6744bcde56f5f64e3ee831c99f56213b4b30338b9eed8c391636b05418316ccc1ee83044d6554afd86bdbe36cefc8acb9a439ebe4d624e8e48f1d6ef18a4707

Download Submit
C:\Windows\System\xifNhvl.exe

Filesize
2.3MB

MD5
a0535d0f071d6a9707d25e19a33bc6a6

SHA1
30763f58fe9876212089c597e69db1abb2f2a262

SHA256
5c83ae5c07ae9459940e08177c3be296e3333399cc8c05d3342da426c1a74e45

SHA512
aedae1ffeb22d691c713dc19a2f9971e3735cf82e37e3b2d666b0e687c3ab22799e0b2f22ba56502207156760611aabafd62984d04dad2ed9edd983a97b4a7bc

Download Submit
C:\Windows\System\yGAgZOB.exe

Filesize
2.3MB

MD5
3be4fab4617773ed2116718cdabec690

SHA1
268a428d9a12d2bb463495caa11f0629a150637e

SHA256
53c0a9ba1ce60bfd65e47ff787d4844ad0bf15b8fedc124886d51a7eb27798fe

SHA512
a0d1df8eccfb388f425019361647825b4dd148c8023ce5a5103e1e708aca57fc7c82c27740142f00be6acf885b800251bca1321876fb9c90837cce266b5486dd

Download Submit
C:\Windows\System\zOWonyJ.exe

Filesize
2.3MB

MD5
ef5e108660f656cf580de9e53eb6c71f

SHA1
e5418b2303131c768ef71430984604c385ac0f90

SHA256
0572ec232fb237e7bd93e6773620b6e8570779b4e179fc972e9f7dd3ab610e31

SHA512
74fb325fe33893877db292a4d05e4d96c7a1e2ddd5d926fdd1f7f9d98bb6a751866ff0e17ec5fcc2faa1fc8f30c7e648a1b6d39e48e9e3c326a83dc8f96cd6cc

Download Submit
memory/324-2120-0x00007FF6C5E50000-0x00007FF6C61A4000-memory.dmp

Filesize
3.3MB

Download
memory/324-652-0x00007FF6C5E50000-0x00007FF6C61A4000-memory.dmp

Filesize
3.3MB

Download
memory/400-2125-0x00007FF679320000-0x00007FF679674000-memory.dmp

Filesize
3.3MB

Download
memory/400-670-0x00007FF679320000-0x00007FF679674000-memory.dmp

Filesize
3.3MB

Download
memory/880-2115-0x00007FF6405F0000-0x00007FF640944000-memory.dmp

Filesize
3.3MB

Download
memory/880-2112-0x00007FF6405F0000-0x00007FF640944000-memory.dmp

Filesize
3.3MB

Download
memory/880-17-0x00007FF6405F0000-0x00007FF640944000-memory.dmp

Filesize
3.3MB

Download
memory/912-714-0x00007FF70AF30000-0x00007FF70B284000-memory.dmp

Filesize
3.3MB

Download
memory/912-2139-0x00007FF70AF30000-0x00007FF70B284000-memory.dmp

Filesize
3.3MB

Download
memory/1068-690-0x00007FF65E090000-0x00007FF65E3E4000-memory.dmp

Filesize
3.3MB

Download
memory/1068-2126-0x00007FF65E090000-0x00007FF65E3E4000-memory.dmp

Filesize
3.3MB

Download
memory/1296-717-0x00007FF7C0690000-0x00007FF7C09E4000-memory.dmp

Filesize
3.3MB

Download
memory/1296-2142-0x00007FF7C0690000-0x00007FF7C09E4000-memory.dmp

Filesize
3.3MB

Download
memory/1396-2131-0x00007FF787010000-0x00007FF787364000-memory.dmp

Filesize
3.3MB

Download
memory/1396-655-0x00007FF787010000-0x00007FF787364000-memory.dmp

Filesize
3.3MB

Download
memory/1548-2116-0x00007FF720DB0000-0x00007FF721104000-memory.dmp

Filesize
3.3MB

Download
memory/1548-2113-0x00007FF720DB0000-0x00007FF721104000-memory.dmp

Filesize
3.3MB

Download
memory/1548-648-0x00007FF720DB0000-0x00007FF721104000-memory.dmp

Filesize
3.3MB

Download
memory/1652-685-0x00007FF7C0F30000-0x00007FF7C1284000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2127-0x00007FF7C0F30000-0x00007FF7C1284000-memory.dmp

Filesize
3.3MB

Download
memory/1668-2124-0x00007FF739740000-0x00007FF739A94000-memory.dmp

Filesize
3.3MB

Download
memory/1668-678-0x00007FF739740000-0x00007FF739A94000-memory.dmp

Filesize
3.3MB

Download
memory/1844-1-0x00000225152F0000-0x0000022515300000-memory.dmp

Filesize
64KB

Download
memory/1844-0-0x00007FF7AF140000-0x00007FF7AF494000-memory.dmp

Filesize
3.3MB

Download
memory/1864-2119-0x00007FF675740000-0x00007FF675A94000-memory.dmp

Filesize
3.3MB

Download
memory/1864-649-0x00007FF675740000-0x00007FF675A94000-memory.dmp

Filesize
3.3MB

Download
memory/1920-2136-0x00007FF7496E0000-0x00007FF749A34000-memory.dmp

Filesize
3.3MB

Download
memory/1920-709-0x00007FF7496E0000-0x00007FF749A34000-memory.dmp

Filesize
3.3MB

Download
memory/2024-2121-0x00007FF6F0A80000-0x00007FF6F0DD4000-memory.dmp

Filesize
3.3MB

Download
memory/2024-650-0x00007FF6F0A80000-0x00007FF6F0DD4000-memory.dmp

Filesize
3.3MB

Download
memory/2104-2137-0x00007FF66DDF0000-0x00007FF66E144000-memory.dmp

Filesize
3.3MB

Download
memory/2104-693-0x00007FF66DDF0000-0x00007FF66E144000-memory.dmp

Filesize
3.3MB

Download
memory/2288-653-0x00007FF72A3E0000-0x00007FF72A734000-memory.dmp

Filesize
3.3MB

Download
memory/2288-2123-0x00007FF72A3E0000-0x00007FF72A734000-memory.dmp

Filesize
3.3MB

Download
memory/2408-2134-0x00007FF642D60000-0x00007FF6430B4000-memory.dmp

Filesize
3.3MB

Download
memory/2408-708-0x00007FF642D60000-0x00007FF6430B4000-memory.dmp

Filesize
3.3MB

Download
memory/2580-719-0x00007FF69AF60000-0x00007FF69B2B4000-memory.dmp

Filesize
3.3MB

Download
memory/2580-2138-0x00007FF69AF60000-0x00007FF69B2B4000-memory.dmp

Filesize
3.3MB

Download
memory/2648-2132-0x00007FF6DC230000-0x00007FF6DC584000-memory.dmp

Filesize
3.3MB

Download
memory/2648-657-0x00007FF6DC230000-0x00007FF6DC584000-memory.dmp

Filesize
3.3MB

Download
memory/3184-2117-0x00007FF78FD80000-0x00007FF7900D4000-memory.dmp

Filesize
3.3MB

Download
memory/3184-721-0x00007FF78FD80000-0x00007FF7900D4000-memory.dmp

Filesize
3.3MB

Download
memory/3388-2128-0x00007FF711160000-0x00007FF7114B4000-memory.dmp

Filesize
3.3MB

Download
memory/3388-691-0x00007FF711160000-0x00007FF7114B4000-memory.dmp

Filesize
3.3MB

Download
memory/3496-654-0x00007FF7D4760000-0x00007FF7D4AB4000-memory.dmp

Filesize
3.3MB

Download
memory/3496-2122-0x00007FF7D4760000-0x00007FF7D4AB4000-memory.dmp

Filesize
3.3MB

Download
memory/3504-2114-0x00007FF7D9F50000-0x00007FF7DA2A4000-memory.dmp

Filesize
3.3MB

Download
memory/3504-11-0x00007FF7D9F50000-0x00007FF7DA2A4000-memory.dmp

Filesize
3.3MB

Download
memory/3508-2118-0x00007FF70A3D0000-0x00007FF70A724000-memory.dmp

Filesize
3.3MB

Download
memory/3508-651-0x00007FF70A3D0000-0x00007FF70A724000-memory.dmp

Filesize
3.3MB

Download
memory/3672-658-0x00007FF6B31C0000-0x00007FF6B3514000-memory.dmp

Filesize
3.3MB

Download
memory/3672-2130-0x00007FF6B31C0000-0x00007FF6B3514000-memory.dmp

Filesize
3.3MB

Download
memory/4428-2141-0x00007FF613EB0000-0x00007FF614204000-memory.dmp

Filesize
3.3MB

Download
memory/4428-720-0x00007FF613EB0000-0x00007FF614204000-memory.dmp

Filesize
3.3MB

Download
memory/4612-705-0x00007FF62FB80000-0x00007FF62FED4000-memory.dmp

Filesize
3.3MB

Download
memory/4612-2135-0x00007FF62FB80000-0x00007FF62FED4000-memory.dmp

Filesize
3.3MB

Download
memory/4696-2129-0x00007FF7A36F0000-0x00007FF7A3A44000-memory.dmp

Filesize
3.3MB

Download
memory/4696-656-0x00007FF7A36F0000-0x00007FF7A3A44000-memory.dmp

Filesize
3.3MB

Download
memory/4964-713-0x00007FF7DED60000-0x00007FF7DF0B4000-memory.dmp

Filesize
3.3MB

Download
memory/4964-2140-0x00007FF7DED60000-0x00007FF7DF0B4000-memory.dmp

Filesize
3.3MB

Download
memory/5056-695-0x00007FF6629A0000-0x00007FF662CF4000-memory.dmp

Filesize
3.3MB

Download
memory/5056-2133-0x00007FF6629A0000-0x00007FF662CF4000-memory.dmp

Filesize
3.3MB

Download