xmrig | 31da1de8998c4d544d396b1d5a95274727a7d87b9cc9098c3ff635290e77e10a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
Size

2.2MB
MD5

9d1313e24ade2af3e1148aa0d71cfd90
SHA1

e759ffa9f3c3acfc6617dc22eab5bc4fff4df50e
SHA256

31da1de8998c4d544d396b1d5a95274727a7d87b9cc9098c3ff635290e77e10a
SHA512

6ddd753f04c93876f378570bc33f75606c538610a345d6ad98dafdaf5dc917cf9d10759a2d194050827025d07b8472dd64482e00f1923da1161172d9d8339b43
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQW/zFdDlhw3Xjtq:oemTLkNdfE0pZrQA

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1928-0-0x00007FF613A10000-0x00007FF613D64000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-7.dat	xmrig
behavioral2/files/0x0007000000023413-30.dat	xmrig
behavioral2/files/0x000700000002341c-77.dat	xmrig
behavioral2/files/0x0007000000023417-89.dat	xmrig
behavioral2/files/0x0007000000023422-122.dat	xmrig
behavioral2/files/0x0007000000023423-139.dat	xmrig
behavioral2/memory/2204-151-0x00007FF7DBA90000-0x00007FF7DBDE4000-memory.dmp	xmrig
behavioral2/memory/4496-155-0x00007FF6A0E30000-0x00007FF6A1184000-memory.dmp	xmrig
behavioral2/memory/100-160-0x00007FF6FBED0000-0x00007FF6FC224000-memory.dmp	xmrig
behavioral2/memory/4416-164-0x00007FF7B11A0000-0x00007FF7B14F4000-memory.dmp	xmrig
behavioral2/memory/1076-163-0x00007FF665510000-0x00007FF665864000-memory.dmp	xmrig
behavioral2/memory/2692-162-0x00007FF68D550000-0x00007FF68D8A4000-memory.dmp	xmrig
behavioral2/memory/1524-161-0x00007FF7DF9A0000-0x00007FF7DFCF4000-memory.dmp	xmrig
behavioral2/memory/5044-159-0x00007FF78DC80000-0x00007FF78DFD4000-memory.dmp	xmrig
behavioral2/memory/4088-158-0x00007FF7CE630000-0x00007FF7CE984000-memory.dmp	xmrig
behavioral2/memory/3680-157-0x00007FF7C9D70000-0x00007FF7CA0C4000-memory.dmp	xmrig
behavioral2/memory/3784-156-0x00007FF6E9140000-0x00007FF6E9494000-memory.dmp	xmrig
behavioral2/memory/4336-154-0x00007FF65A210000-0x00007FF65A564000-memory.dmp	xmrig
behavioral2/memory/4048-153-0x00007FF6DF150000-0x00007FF6DF4A4000-memory.dmp	xmrig
behavioral2/memory/320-152-0x00007FF794BF0000-0x00007FF794F44000-memory.dmp	xmrig
behavioral2/memory/2900-150-0x00007FF6DB260000-0x00007FF6DB5B4000-memory.dmp	xmrig
behavioral2/memory/2288-149-0x00007FF60AFC0000-0x00007FF60B314000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-147.dat	xmrig
behavioral2/files/0x0007000000023426-145.dat	xmrig
behavioral2/files/0x0007000000023425-143.dat	xmrig
behavioral2/files/0x0007000000023424-141.dat	xmrig
behavioral2/memory/4040-136-0x00007FF631750000-0x00007FF631AA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-134.dat	xmrig
behavioral2/files/0x0007000000023420-132.dat	xmrig
behavioral2/memory/2568-131-0x00007FF69D490000-0x00007FF69D7E4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341d-126.dat	xmrig
behavioral2/files/0x000700000002341f-120.dat	xmrig
behavioral2/memory/1184-119-0x00007FF6518F0000-0x00007FF651C44000-memory.dmp	xmrig
behavioral2/memory/1352-116-0x00007FF6E9260000-0x00007FF6E95B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-104.dat	xmrig
behavioral2/files/0x000700000002341a-99.dat	xmrig
behavioral2/files/0x000700000002341e-98.dat	xmrig
behavioral2/files/0x0007000000023419-96.dat	xmrig
behavioral2/files/0x0007000000023418-94.dat	xmrig
behavioral2/memory/5064-86-0x00007FF652A40000-0x00007FF652D94000-memory.dmp	xmrig
behavioral2/memory/3592-74-0x00007FF7AACF0000-0x00007FF7AB044000-memory.dmp	xmrig
behavioral2/memory/1496-63-0x00007FF613630000-0x00007FF613984000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-61.dat	xmrig
behavioral2/memory/3872-58-0x00007FF678E10000-0x00007FF679164000-memory.dmp	xmrig
behavioral2/files/0x0007000000023428-166.dat	xmrig
behavioral2/files/0x000800000002340b-170.dat	xmrig
behavioral2/files/0x000700000002342a-183.dat	xmrig
behavioral2/memory/4264-211-0x00007FF65EA40000-0x00007FF65ED94000-memory.dmp	xmrig
behavioral2/memory/2652-208-0x00007FF7C7E30000-0x00007FF7C8184000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-188.dat	xmrig
behavioral2/files/0x0007000000023429-181.dat	xmrig
behavioral2/files/0x0007000000023415-54.dat	xmrig
behavioral2/files/0x0007000000023414-51.dat	xmrig
behavioral2/files/0x0007000000023411-35.dat	xmrig
behavioral2/memory/1304-34-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-32.dat	xmrig
behavioral2/files/0x0007000000023410-31.dat	xmrig
behavioral2/memory/452-26-0x00007FF638F40000-0x00007FF639294000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-17.dat	xmrig
behavioral2/files/0x000800000002340a-8.dat	xmrig
behavioral2/memory/888-14-0x00007FF7069A0000-0x00007FF706CF4000-memory.dmp	xmrig
behavioral2/memory/1928-2149-0x00007FF613A10000-0x00007FF613D64000-memory.dmp	xmrig
behavioral2/memory/1304-2150-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
888	uNKygQI.exe
452	sGBciOE.exe
4088	MzcRoSp.exe
1304	UPiWCvf.exe
3872	nHUwVuP.exe
1496	wbxuqmJ.exe
5044	DFulLhn.exe
100	QeYBzYR.exe
3592	oQErPYw.exe
5064	OrwlAwV.exe
1524	iRVzkYM.exe
1352	OzsojYC.exe
1184	nlFApZC.exe
2568	tsQQdDw.exe
4040	xYrVela.exe
2692	iGckFaw.exe
2288	HnPRQKG.exe
1076	XGUHhUo.exe
2900	mWBcqFq.exe
2204	HhDUrFp.exe
320	mHcMZSv.exe
4416	ZbFPdGW.exe
4048	EQYyxOn.exe
4336	asttFNi.exe
4496	DTCexgS.exe
3784	sZrWuBc.exe
3680	khXCjyD.exe
2652	mmSoDZa.exe
4264	lfjaGOZ.exe
4492	WuUsIZX.exe
4588	tOUeqiM.exe
4232	PfiEknc.exe
1060	GspSYyI.exe
4756	mkfdMUR.exe
2404	TiBYNdC.exe
3672	KVYgmDa.exe
4108	MjyeQia.exe
2628	WllvTad.exe
2340	SOocOiX.exe
4532	lDjHTxN.exe
220	AKSMTMY.exe
400	sKOBGfk.exe
3320	mYBtMuK.exe
1348	RnUwQOI.exe
3712	DoppYLp.exe
2816	TQSERmT.exe
528	WXebClE.exe
3008	hbafouy.exe
4024	UdcFMml.exe
2260	cKcESil.exe
3992	iRKoTxo.exe
3708	WdnEffs.exe
4740	qXQUFTt.exe
2372	UeexVQQ.exe
1196	AXnDfse.exe
3744	PXHAMym.exe
5104	StRsjWv.exe
3492	fuFKGdq.exe
2576	VNpJAxo.exe
2804	PjVUqxp.exe
1716	IoBRAVs.exe
2436	AIJIwMC.exe
1408	lwVsaIl.exe
2600	hHepVoN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1928-0-0x00007FF613A10000-0x00007FF613D64000-memory.dmp	upx
behavioral2/files/0x000700000002340f-7.dat	upx
behavioral2/files/0x0007000000023413-30.dat	upx
behavioral2/files/0x000700000002341c-77.dat	upx
behavioral2/files/0x0007000000023417-89.dat	upx
behavioral2/files/0x0007000000023422-122.dat	upx
behavioral2/files/0x0007000000023423-139.dat	upx
behavioral2/memory/2204-151-0x00007FF7DBA90000-0x00007FF7DBDE4000-memory.dmp	upx
behavioral2/memory/4496-155-0x00007FF6A0E30000-0x00007FF6A1184000-memory.dmp	upx
behavioral2/memory/100-160-0x00007FF6FBED0000-0x00007FF6FC224000-memory.dmp	upx
behavioral2/memory/4416-164-0x00007FF7B11A0000-0x00007FF7B14F4000-memory.dmp	upx
behavioral2/memory/1076-163-0x00007FF665510000-0x00007FF665864000-memory.dmp	upx
behavioral2/memory/2692-162-0x00007FF68D550000-0x00007FF68D8A4000-memory.dmp	upx
behavioral2/memory/1524-161-0x00007FF7DF9A0000-0x00007FF7DFCF4000-memory.dmp	upx
behavioral2/memory/5044-159-0x00007FF78DC80000-0x00007FF78DFD4000-memory.dmp	upx
behavioral2/memory/4088-158-0x00007FF7CE630000-0x00007FF7CE984000-memory.dmp	upx
behavioral2/memory/3680-157-0x00007FF7C9D70000-0x00007FF7CA0C4000-memory.dmp	upx
behavioral2/memory/3784-156-0x00007FF6E9140000-0x00007FF6E9494000-memory.dmp	upx
behavioral2/memory/4336-154-0x00007FF65A210000-0x00007FF65A564000-memory.dmp	upx
behavioral2/memory/4048-153-0x00007FF6DF150000-0x00007FF6DF4A4000-memory.dmp	upx
behavioral2/memory/320-152-0x00007FF794BF0000-0x00007FF794F44000-memory.dmp	upx
behavioral2/memory/2900-150-0x00007FF6DB260000-0x00007FF6DB5B4000-memory.dmp	upx
behavioral2/memory/2288-149-0x00007FF60AFC0000-0x00007FF60B314000-memory.dmp	upx
behavioral2/files/0x0007000000023427-147.dat	upx
behavioral2/files/0x0007000000023426-145.dat	upx
behavioral2/files/0x0007000000023425-143.dat	upx
behavioral2/files/0x0007000000023424-141.dat	upx
behavioral2/memory/4040-136-0x00007FF631750000-0x00007FF631AA4000-memory.dmp	upx
behavioral2/files/0x0007000000023421-134.dat	upx
behavioral2/files/0x0007000000023420-132.dat	upx
behavioral2/memory/2568-131-0x00007FF69D490000-0x00007FF69D7E4000-memory.dmp	upx
behavioral2/files/0x000700000002341d-126.dat	upx
behavioral2/files/0x000700000002341f-120.dat	upx
behavioral2/memory/1184-119-0x00007FF6518F0000-0x00007FF651C44000-memory.dmp	upx
behavioral2/memory/1352-116-0x00007FF6E9260000-0x00007FF6E95B4000-memory.dmp	upx
behavioral2/files/0x000700000002341b-104.dat	upx
behavioral2/files/0x000700000002341a-99.dat	upx
behavioral2/files/0x000700000002341e-98.dat	upx
behavioral2/files/0x0007000000023419-96.dat	upx
behavioral2/files/0x0007000000023418-94.dat	upx
behavioral2/memory/5064-86-0x00007FF652A40000-0x00007FF652D94000-memory.dmp	upx
behavioral2/memory/3592-74-0x00007FF7AACF0000-0x00007FF7AB044000-memory.dmp	upx
behavioral2/memory/1496-63-0x00007FF613630000-0x00007FF613984000-memory.dmp	upx
behavioral2/files/0x0007000000023416-61.dat	upx
behavioral2/memory/3872-58-0x00007FF678E10000-0x00007FF679164000-memory.dmp	upx
behavioral2/files/0x0007000000023428-166.dat	upx
behavioral2/files/0x000800000002340b-170.dat	upx
behavioral2/files/0x000700000002342a-183.dat	upx
behavioral2/memory/4264-211-0x00007FF65EA40000-0x00007FF65ED94000-memory.dmp	upx
behavioral2/memory/2652-208-0x00007FF7C7E30000-0x00007FF7C8184000-memory.dmp	upx
behavioral2/files/0x000700000002342b-188.dat	upx
behavioral2/files/0x0007000000023429-181.dat	upx
behavioral2/files/0x0007000000023415-54.dat	upx
behavioral2/files/0x0007000000023414-51.dat	upx
behavioral2/files/0x0007000000023411-35.dat	upx
behavioral2/memory/1304-34-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp	upx
behavioral2/files/0x0007000000023412-32.dat	upx
behavioral2/files/0x0007000000023410-31.dat	upx
behavioral2/memory/452-26-0x00007FF638F40000-0x00007FF639294000-memory.dmp	upx
behavioral2/files/0x000700000002340e-17.dat	upx
behavioral2/files/0x000800000002340a-8.dat	upx
behavioral2/memory/888-14-0x00007FF7069A0000-0x00007FF706CF4000-memory.dmp	upx
behavioral2/memory/1928-2149-0x00007FF613A10000-0x00007FF613D64000-memory.dmp	upx
behavioral2/memory/1304-2150-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OrwlAwV.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\OhIUXRq.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\RkOynTx.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\RajaaGU.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\lDOpqOH.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\VPSzaek.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\RVCsMdg.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\nHUwVuP.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\FEVUByl.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\YTtRSmS.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\fZPJMCh.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\NPFDfPh.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\IzhxAVN.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\qUHGQwn.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\MzcRoSp.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\WuUsIZX.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\KXveswW.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\rKencwj.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\PnsxWmo.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\IClsOBj.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\iRVzkYM.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\byXcBVo.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\ygejQUl.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\PbzwwnH.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\rCmIJuH.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\hZFkIgX.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\oAqWSip.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\rjChREb.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\RgdfAna.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\dtUpfVZ.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\LSpGtvQ.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\SxwGXtK.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\OtGVBqB.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\xFoniAP.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\SPzKoJO.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\oDXAKEg.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\kPTicuP.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\hDxyHFD.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\vwkqitB.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\rOudwSi.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\FgOyQVE.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\paSVNUY.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\tOIVJqt.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\tyvrtqo.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\HtarqNV.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\xQsiEns.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\RklVYWm.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\RgCZSsH.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\egMfsay.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\xHijNra.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\yIfloFz.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\bCocZpf.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\bBRQdXx.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\cgAFjaM.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\ixlXIrk.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\ffTNzaG.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\QxFRFEZ.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\FDDflMo.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\gJYtwSY.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\inUgLED.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\NltKJUJ.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\yEknUJl.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\tFcgBgG.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
File created	C:\Windows\System\PfWbOiM.exe	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 888	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	83
PID 1928 wrote to memory of 888	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	83
PID 1928 wrote to memory of 452	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	84
PID 1928 wrote to memory of 452	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	84
PID 1928 wrote to memory of 4088	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	85
PID 1928 wrote to memory of 4088	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	85
PID 1928 wrote to memory of 1304	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	86
PID 1928 wrote to memory of 1304	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	86
PID 1928 wrote to memory of 3872	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	87
PID 1928 wrote to memory of 3872	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	87
PID 1928 wrote to memory of 1496	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	88
PID 1928 wrote to memory of 1496	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	88
PID 1928 wrote to memory of 5044	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	89
PID 1928 wrote to memory of 5044	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	89
PID 1928 wrote to memory of 100	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	90
PID 1928 wrote to memory of 100	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	90
PID 1928 wrote to memory of 3592	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	91
PID 1928 wrote to memory of 3592	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	91
PID 1928 wrote to memory of 5064	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	92
PID 1928 wrote to memory of 5064	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	92
PID 1928 wrote to memory of 1524	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	93
PID 1928 wrote to memory of 1524	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	93
PID 1928 wrote to memory of 1352	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	94
PID 1928 wrote to memory of 1352	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	94
PID 1928 wrote to memory of 1184	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	95
PID 1928 wrote to memory of 1184	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	95
PID 1928 wrote to memory of 2568	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	96
PID 1928 wrote to memory of 2568	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	96
PID 1928 wrote to memory of 4040	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	97
PID 1928 wrote to memory of 4040	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	97
PID 1928 wrote to memory of 2692	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	98
PID 1928 wrote to memory of 2692	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	98
PID 1928 wrote to memory of 2288	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	99
PID 1928 wrote to memory of 2288	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	99
PID 1928 wrote to memory of 1076	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	100
PID 1928 wrote to memory of 1076	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	100
PID 1928 wrote to memory of 2900	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	101
PID 1928 wrote to memory of 2900	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	101
PID 1928 wrote to memory of 2204	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	102
PID 1928 wrote to memory of 2204	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	102
PID 1928 wrote to memory of 320	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	103
PID 1928 wrote to memory of 320	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	103
PID 1928 wrote to memory of 4416	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	104
PID 1928 wrote to memory of 4416	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	104
PID 1928 wrote to memory of 4048	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	105
PID 1928 wrote to memory of 4048	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	105
PID 1928 wrote to memory of 4336	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	106
PID 1928 wrote to memory of 4336	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	106
PID 1928 wrote to memory of 4496	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	107
PID 1928 wrote to memory of 4496	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	107
PID 1928 wrote to memory of 3784	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	108
PID 1928 wrote to memory of 3784	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	108
PID 1928 wrote to memory of 3680	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	109
PID 1928 wrote to memory of 3680	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	109
PID 1928 wrote to memory of 2652	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	110
PID 1928 wrote to memory of 2652	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	110
PID 1928 wrote to memory of 4264	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	111
PID 1928 wrote to memory of 4264	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	111
PID 1928 wrote to memory of 4492	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	114
PID 1928 wrote to memory of 4492	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	114
PID 1928 wrote to memory of 4588	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	115
PID 1928 wrote to memory of 4588	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	115
PID 1928 wrote to memory of 4232	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	116
PID 1928 wrote to memory of 4232	1928	9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9d1313e24ade2af3e1148aa0d71cfd90_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\System\uNKygQI.exe
  C:\Windows\System\uNKygQI.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\sGBciOE.exe
  C:\Windows\System\sGBciOE.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\MzcRoSp.exe
  C:\Windows\System\MzcRoSp.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\UPiWCvf.exe
  C:\Windows\System\UPiWCvf.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\nHUwVuP.exe
  C:\Windows\System\nHUwVuP.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\wbxuqmJ.exe
  C:\Windows\System\wbxuqmJ.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\DFulLhn.exe
  C:\Windows\System\DFulLhn.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\QeYBzYR.exe
  C:\Windows\System\QeYBzYR.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\oQErPYw.exe
  C:\Windows\System\oQErPYw.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\OrwlAwV.exe
  C:\Windows\System\OrwlAwV.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\iRVzkYM.exe
  C:\Windows\System\iRVzkYM.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\OzsojYC.exe
  C:\Windows\System\OzsojYC.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\nlFApZC.exe
  C:\Windows\System\nlFApZC.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\tsQQdDw.exe
  C:\Windows\System\tsQQdDw.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\xYrVela.exe
  C:\Windows\System\xYrVela.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\iGckFaw.exe
  C:\Windows\System\iGckFaw.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\HnPRQKG.exe
  C:\Windows\System\HnPRQKG.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\XGUHhUo.exe
  C:\Windows\System\XGUHhUo.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\mWBcqFq.exe
  C:\Windows\System\mWBcqFq.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\HhDUrFp.exe
  C:\Windows\System\HhDUrFp.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\mHcMZSv.exe
  C:\Windows\System\mHcMZSv.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\ZbFPdGW.exe
  C:\Windows\System\ZbFPdGW.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\EQYyxOn.exe
  C:\Windows\System\EQYyxOn.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\asttFNi.exe
  C:\Windows\System\asttFNi.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\DTCexgS.exe
  C:\Windows\System\DTCexgS.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\sZrWuBc.exe
  C:\Windows\System\sZrWuBc.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\khXCjyD.exe
  C:\Windows\System\khXCjyD.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\mmSoDZa.exe
  C:\Windows\System\mmSoDZa.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\lfjaGOZ.exe
  C:\Windows\System\lfjaGOZ.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\WuUsIZX.exe
  C:\Windows\System\WuUsIZX.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\tOUeqiM.exe
  C:\Windows\System\tOUeqiM.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\PfiEknc.exe
  C:\Windows\System\PfiEknc.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\GspSYyI.exe
  C:\Windows\System\GspSYyI.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\mkfdMUR.exe
  C:\Windows\System\mkfdMUR.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\TiBYNdC.exe
  C:\Windows\System\TiBYNdC.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\KVYgmDa.exe
  C:\Windows\System\KVYgmDa.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\MjyeQia.exe
  C:\Windows\System\MjyeQia.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\WllvTad.exe
  C:\Windows\System\WllvTad.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\SOocOiX.exe
  C:\Windows\System\SOocOiX.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\lDjHTxN.exe
  C:\Windows\System\lDjHTxN.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\AKSMTMY.exe
  C:\Windows\System\AKSMTMY.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\sKOBGfk.exe
  C:\Windows\System\sKOBGfk.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\mYBtMuK.exe
  C:\Windows\System\mYBtMuK.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\RnUwQOI.exe
  C:\Windows\System\RnUwQOI.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\DoppYLp.exe
  C:\Windows\System\DoppYLp.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\TQSERmT.exe
  C:\Windows\System\TQSERmT.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\WXebClE.exe
  C:\Windows\System\WXebClE.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\hbafouy.exe
  C:\Windows\System\hbafouy.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\UdcFMml.exe
  C:\Windows\System\UdcFMml.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\cKcESil.exe
  C:\Windows\System\cKcESil.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\iRKoTxo.exe
  C:\Windows\System\iRKoTxo.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\WdnEffs.exe
  C:\Windows\System\WdnEffs.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\qXQUFTt.exe
  C:\Windows\System\qXQUFTt.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\UeexVQQ.exe
  C:\Windows\System\UeexVQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\AXnDfse.exe
  C:\Windows\System\AXnDfse.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\PXHAMym.exe
  C:\Windows\System\PXHAMym.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\StRsjWv.exe
  C:\Windows\System\StRsjWv.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\fuFKGdq.exe
  C:\Windows\System\fuFKGdq.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\VNpJAxo.exe
  C:\Windows\System\VNpJAxo.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\PjVUqxp.exe
  C:\Windows\System\PjVUqxp.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\IoBRAVs.exe
  C:\Windows\System\IoBRAVs.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\AIJIwMC.exe
  C:\Windows\System\AIJIwMC.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\lwVsaIl.exe
  C:\Windows\System\lwVsaIl.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\hHepVoN.exe
  C:\Windows\System\hHepVoN.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\YacEght.exe
  C:\Windows\System\YacEght.exe
  2⤵
  PID:1412
- C:\Windows\System\DrKjnwO.exe
  C:\Windows\System\DrKjnwO.exe
  2⤵
  PID:4552
- C:\Windows\System\unBlOCP.exe
  C:\Windows\System\unBlOCP.exe
  2⤵
  PID:4572
- C:\Windows\System\xEhMOXL.exe
  C:\Windows\System\xEhMOXL.exe
  2⤵
  PID:2164
- C:\Windows\System\UTuFMSE.exe
  C:\Windows\System\UTuFMSE.exe
  2⤵
  PID:3564
- C:\Windows\System\WAAWXfW.exe
  C:\Windows\System\WAAWXfW.exe
  2⤵
  PID:1652
- C:\Windows\System\xeYrLvJ.exe
  C:\Windows\System\xeYrLvJ.exe
  2⤵
  PID:2256
- C:\Windows\System\gKOmIhj.exe
  C:\Windows\System\gKOmIhj.exe
  2⤵
  PID:872
- C:\Windows\System\iGSoPVz.exe
  C:\Windows\System\iGSoPVz.exe
  2⤵
  PID:5116
- C:\Windows\System\FHywUYJ.exe
  C:\Windows\System\FHywUYJ.exe
  2⤵
  PID:4328
- C:\Windows\System\QSWcRMc.exe
  C:\Windows\System\QSWcRMc.exe
  2⤵
  PID:1244
- C:\Windows\System\szCIjgP.exe
  C:\Windows\System\szCIjgP.exe
  2⤵
  PID:940
- C:\Windows\System\nkXhVfw.exe
  C:\Windows\System\nkXhVfw.exe
  2⤵
  PID:4556
- C:\Windows\System\IySXmep.exe
  C:\Windows\System\IySXmep.exe
  2⤵
  PID:912
- C:\Windows\System\yIfloFz.exe
  C:\Windows\System\yIfloFz.exe
  2⤵
  PID:1924
- C:\Windows\System\YlQoCsJ.exe
  C:\Windows\System\YlQoCsJ.exe
  2⤵
  PID:4892
- C:\Windows\System\flGIihX.exe
  C:\Windows\System\flGIihX.exe
  2⤵
  PID:1616
- C:\Windows\System\DNZwmcY.exe
  C:\Windows\System\DNZwmcY.exe
  2⤵
  PID:2236
- C:\Windows\System\byXcBVo.exe
  C:\Windows\System\byXcBVo.exe
  2⤵
  PID:1548
- C:\Windows\System\Iygrikj.exe
  C:\Windows\System\Iygrikj.exe
  2⤵
  PID:1204
- C:\Windows\System\mgcmJzh.exe
  C:\Windows\System\mgcmJzh.exe
  2⤵
  PID:1372
- C:\Windows\System\WaBzXZy.exe
  C:\Windows\System\WaBzXZy.exe
  2⤵
  PID:4736
- C:\Windows\System\xTrrLrN.exe
  C:\Windows\System\xTrrLrN.exe
  2⤵
  PID:3604
- C:\Windows\System\viqBBEF.exe
  C:\Windows\System\viqBBEF.exe
  2⤵
  PID:3968
- C:\Windows\System\hjKLwgJ.exe
  C:\Windows\System\hjKLwgJ.exe
  2⤵
  PID:3440
- C:\Windows\System\sIlQLwL.exe
  C:\Windows\System\sIlQLwL.exe
  2⤵
  PID:2704
- C:\Windows\System\foZrVtm.exe
  C:\Windows\System\foZrVtm.exe
  2⤵
  PID:2248
- C:\Windows\System\nhBjdUT.exe
  C:\Windows\System\nhBjdUT.exe
  2⤵
  PID:4248
- C:\Windows\System\xIIjuGJ.exe
  C:\Windows\System\xIIjuGJ.exe
  2⤵
  PID:4356
- C:\Windows\System\bqcjfLp.exe
  C:\Windows\System\bqcjfLp.exe
  2⤵
  PID:2572
- C:\Windows\System\YPlcGnd.exe
  C:\Windows\System\YPlcGnd.exe
  2⤵
  PID:4016
- C:\Windows\System\VAQPjmR.exe
  C:\Windows\System\VAQPjmR.exe
  2⤵
  PID:2088
- C:\Windows\System\ntaKIgx.exe
  C:\Windows\System\ntaKIgx.exe
  2⤵
  PID:3172
- C:\Windows\System\UOEKBgz.exe
  C:\Windows\System\UOEKBgz.exe
  2⤵
  PID:4376
- C:\Windows\System\tTinEMd.exe
  C:\Windows\System\tTinEMd.exe
  2⤵
  PID:1132
- C:\Windows\System\SHBtGDP.exe
  C:\Windows\System\SHBtGDP.exe
  2⤵
  PID:780
- C:\Windows\System\fmCNJSy.exe
  C:\Windows\System\fmCNJSy.exe
  2⤵
  PID:3584
- C:\Windows\System\Mnnbwxq.exe
  C:\Windows\System\Mnnbwxq.exe
  2⤵
  PID:5024
- C:\Windows\System\FpvWrzI.exe
  C:\Windows\System\FpvWrzI.exe
  2⤵
  PID:1428
- C:\Windows\System\hZFkIgX.exe
  C:\Windows\System\hZFkIgX.exe
  2⤵
  PID:2988
- C:\Windows\System\jPFKZER.exe
  C:\Windows\System\jPFKZER.exe
  2⤵
  PID:5152
- C:\Windows\System\sKqplvr.exe
  C:\Windows\System\sKqplvr.exe
  2⤵
  PID:5168
- C:\Windows\System\hkxgLuS.exe
  C:\Windows\System\hkxgLuS.exe
  2⤵
  PID:5184
- C:\Windows\System\HOTgaKc.exe
  C:\Windows\System\HOTgaKc.exe
  2⤵
  PID:5212
- C:\Windows\System\KNfndzg.exe
  C:\Windows\System\KNfndzg.exe
  2⤵
  PID:5228
- C:\Windows\System\aIRJAJv.exe
  C:\Windows\System\aIRJAJv.exe
  2⤵
  PID:5244
- C:\Windows\System\pkNyQCK.exe
  C:\Windows\System\pkNyQCK.exe
  2⤵
  PID:5260
- C:\Windows\System\paBdzwG.exe
  C:\Windows\System\paBdzwG.exe
  2⤵
  PID:5284
- C:\Windows\System\mMxXhWh.exe
  C:\Windows\System\mMxXhWh.exe
  2⤵
  PID:5324
- C:\Windows\System\TGJQPsp.exe
  C:\Windows\System\TGJQPsp.exe
  2⤵
  PID:5368
- C:\Windows\System\OhIUXRq.exe
  C:\Windows\System\OhIUXRq.exe
  2⤵
  PID:5404
- C:\Windows\System\aOjBSny.exe
  C:\Windows\System\aOjBSny.exe
  2⤵
  PID:5428
- C:\Windows\System\YuKgcAW.exe
  C:\Windows\System\YuKgcAW.exe
  2⤵
  PID:5468
- C:\Windows\System\jVZjHcU.exe
  C:\Windows\System\jVZjHcU.exe
  2⤵
  PID:5512
- C:\Windows\System\JAgpPMX.exe
  C:\Windows\System\JAgpPMX.exe
  2⤵
  PID:5556
- C:\Windows\System\runoMvC.exe
  C:\Windows\System\runoMvC.exe
  2⤵
  PID:5588
- C:\Windows\System\xcxqbNX.exe
  C:\Windows\System\xcxqbNX.exe
  2⤵
  PID:5636
- C:\Windows\System\RtKKVUE.exe
  C:\Windows\System\RtKKVUE.exe
  2⤵
  PID:5652
- C:\Windows\System\qINQQoG.exe
  C:\Windows\System\qINQQoG.exe
  2⤵
  PID:5668
- C:\Windows\System\FcKgtEk.exe
  C:\Windows\System\FcKgtEk.exe
  2⤵
  PID:5708
- C:\Windows\System\cLGBkbF.exe
  C:\Windows\System\cLGBkbF.exe
  2⤵
  PID:5744
- C:\Windows\System\TihrcFF.exe
  C:\Windows\System\TihrcFF.exe
  2⤵
  PID:5764
- C:\Windows\System\zKwhdWq.exe
  C:\Windows\System\zKwhdWq.exe
  2⤵
  PID:5792
- C:\Windows\System\snTmbMu.exe
  C:\Windows\System\snTmbMu.exe
  2⤵
  PID:5828
- C:\Windows\System\zAEaQFn.exe
  C:\Windows\System\zAEaQFn.exe
  2⤵
  PID:5860
- C:\Windows\System\JOkkaGq.exe
  C:\Windows\System\JOkkaGq.exe
  2⤵
  PID:5876
- C:\Windows\System\fJuwRsP.exe
  C:\Windows\System\fJuwRsP.exe
  2⤵
  PID:5904
- C:\Windows\System\UvFQGFQ.exe
  C:\Windows\System\UvFQGFQ.exe
  2⤵
  PID:5944
- C:\Windows\System\gBYtfmE.exe
  C:\Windows\System\gBYtfmE.exe
  2⤵
  PID:5960
- C:\Windows\System\qCBhAfM.exe
  C:\Windows\System\qCBhAfM.exe
  2⤵
  PID:6000
- C:\Windows\System\ETYuyAs.exe
  C:\Windows\System\ETYuyAs.exe
  2⤵
  PID:6044
- C:\Windows\System\oSTDRKS.exe
  C:\Windows\System\oSTDRKS.exe
  2⤵
  PID:6076
- C:\Windows\System\eRVfrcK.exe
  C:\Windows\System\eRVfrcK.exe
  2⤵
  PID:6104
- C:\Windows\System\EShiOsI.exe
  C:\Windows\System\EShiOsI.exe
  2⤵
  PID:6132
- C:\Windows\System\VqMNjZn.exe
  C:\Windows\System\VqMNjZn.exe
  2⤵
  PID:5144
- C:\Windows\System\noiprnt.exe
  C:\Windows\System\noiprnt.exe
  2⤵
  PID:5272
- C:\Windows\System\NaMyylt.exe
  C:\Windows\System\NaMyylt.exe
  2⤵
  PID:5224
- C:\Windows\System\DIWAGgP.exe
  C:\Windows\System\DIWAGgP.exe
  2⤵
  PID:5276
- C:\Windows\System\nxAaubl.exe
  C:\Windows\System\nxAaubl.exe
  2⤵
  PID:5400
- C:\Windows\System\xcYtwDJ.exe
  C:\Windows\System\xcYtwDJ.exe
  2⤵
  PID:5480
- C:\Windows\System\IcGuOiT.exe
  C:\Windows\System\IcGuOiT.exe
  2⤵
  PID:5520
- C:\Windows\System\iOpNcsp.exe
  C:\Windows\System\iOpNcsp.exe
  2⤵
  PID:5580
- C:\Windows\System\rAFgxTg.exe
  C:\Windows\System\rAFgxTg.exe
  2⤵
  PID:5696
- C:\Windows\System\TYjzVix.exe
  C:\Windows\System\TYjzVix.exe
  2⤵
  PID:5756
- C:\Windows\System\aikhHsl.exe
  C:\Windows\System\aikhHsl.exe
  2⤵
  PID:5816
- C:\Windows\System\IhenBKn.exe
  C:\Windows\System\IhenBKn.exe
  2⤵
  PID:5888
- C:\Windows\System\vrlJceA.exe
  C:\Windows\System\vrlJceA.exe
  2⤵
  PID:5940
- C:\Windows\System\zLbkVTm.exe
  C:\Windows\System\zLbkVTm.exe
  2⤵
  PID:6040
- C:\Windows\System\YkLRpJT.exe
  C:\Windows\System\YkLRpJT.exe
  2⤵
  PID:6088
- C:\Windows\System\EloaxIc.exe
  C:\Windows\System\EloaxIc.exe
  2⤵
  PID:5164
- C:\Windows\System\OeDYTlL.exe
  C:\Windows\System\OeDYTlL.exe
  2⤵
  PID:5416
- C:\Windows\System\VsHYmKF.exe
  C:\Windows\System\VsHYmKF.exe
  2⤵
  PID:5544
- C:\Windows\System\JUMfGvj.exe
  C:\Windows\System\JUMfGvj.exe
  2⤵
  PID:5644
- C:\Windows\System\eaBQcTT.exe
  C:\Windows\System\eaBQcTT.exe
  2⤵
  PID:5896
- C:\Windows\System\QZTTkDe.exe
  C:\Windows\System\QZTTkDe.exe
  2⤵
  PID:6128
- C:\Windows\System\SnaxEKu.exe
  C:\Windows\System\SnaxEKu.exe
  2⤵
  PID:5204
- C:\Windows\System\cLBggtv.exe
  C:\Windows\System\cLBggtv.exe
  2⤵
  PID:5732
- C:\Windows\System\mrtckRp.exe
  C:\Windows\System\mrtckRp.exe
  2⤵
  PID:6116
- C:\Windows\System\KXveswW.exe
  C:\Windows\System\KXveswW.exe
  2⤵
  PID:5572
- C:\Windows\System\DiREirw.exe
  C:\Windows\System\DiREirw.exe
  2⤵
  PID:5320
- C:\Windows\System\gPCTCHY.exe
  C:\Windows\System\gPCTCHY.exe
  2⤵
  PID:6152
- C:\Windows\System\ymjEsdP.exe
  C:\Windows\System\ymjEsdP.exe
  2⤵
  PID:6196
- C:\Windows\System\oJruwLF.exe
  C:\Windows\System\oJruwLF.exe
  2⤵
  PID:6228
- C:\Windows\System\cJqJivs.exe
  C:\Windows\System\cJqJivs.exe
  2⤵
  PID:6244
- C:\Windows\System\oAqWSip.exe
  C:\Windows\System\oAqWSip.exe
  2⤵
  PID:6272
- C:\Windows\System\UsvNqAZ.exe
  C:\Windows\System\UsvNqAZ.exe
  2⤵
  PID:6312
- C:\Windows\System\QjZfkrL.exe
  C:\Windows\System\QjZfkrL.exe
  2⤵
  PID:6344
- C:\Windows\System\iCIujhH.exe
  C:\Windows\System\iCIujhH.exe
  2⤵
  PID:6360
- C:\Windows\System\spMImNa.exe
  C:\Windows\System\spMImNa.exe
  2⤵
  PID:6392
- C:\Windows\System\GpbrBuy.exe
  C:\Windows\System\GpbrBuy.exe
  2⤵
  PID:6416
- C:\Windows\System\dNithOw.exe
  C:\Windows\System\dNithOw.exe
  2⤵
  PID:6444
- C:\Windows\System\DbXzsbd.exe
  C:\Windows\System\DbXzsbd.exe
  2⤵
  PID:6472
- C:\Windows\System\uvQoJFq.exe
  C:\Windows\System\uvQoJFq.exe
  2⤵
  PID:6492
- C:\Windows\System\ycVlJzc.exe
  C:\Windows\System\ycVlJzc.exe
  2⤵
  PID:6532
- C:\Windows\System\iBPowBX.exe
  C:\Windows\System\iBPowBX.exe
  2⤵
  PID:6568
- C:\Windows\System\rslosbA.exe
  C:\Windows\System\rslosbA.exe
  2⤵
  PID:6596
- C:\Windows\System\FEVUByl.exe
  C:\Windows\System\FEVUByl.exe
  2⤵
  PID:6616
- C:\Windows\System\kMFDsuN.exe
  C:\Windows\System\kMFDsuN.exe
  2⤵
  PID:6644
- C:\Windows\System\MmuYeWg.exe
  C:\Windows\System\MmuYeWg.exe
  2⤵
  PID:6676
- C:\Windows\System\bwkjhtU.exe
  C:\Windows\System\bwkjhtU.exe
  2⤵
  PID:6704
- C:\Windows\System\wLUBCGc.exe
  C:\Windows\System\wLUBCGc.exe
  2⤵
  PID:6736
- C:\Windows\System\DSGaavo.exe
  C:\Windows\System\DSGaavo.exe
  2⤵
  PID:6772
- C:\Windows\System\juJTtIW.exe
  C:\Windows\System\juJTtIW.exe
  2⤵
  PID:6800
- C:\Windows\System\HWcmYVw.exe
  C:\Windows\System\HWcmYVw.exe
  2⤵
  PID:6828
- C:\Windows\System\TgXBxqI.exe
  C:\Windows\System\TgXBxqI.exe
  2⤵
  PID:6844
- C:\Windows\System\WVQZPtV.exe
  C:\Windows\System\WVQZPtV.exe
  2⤵
  PID:6860
- C:\Windows\System\qYuHfAr.exe
  C:\Windows\System\qYuHfAr.exe
  2⤵
  PID:6876
- C:\Windows\System\DirCCoJ.exe
  C:\Windows\System\DirCCoJ.exe
  2⤵
  PID:6896
- C:\Windows\System\vumbDPt.exe
  C:\Windows\System\vumbDPt.exe
  2⤵
  PID:6928
- C:\Windows\System\aIJmFpA.exe
  C:\Windows\System\aIJmFpA.exe
  2⤵
  PID:6964
- C:\Windows\System\kmzntim.exe
  C:\Windows\System\kmzntim.exe
  2⤵
  PID:7012
- C:\Windows\System\fGEFlid.exe
  C:\Windows\System\fGEFlid.exe
  2⤵
  PID:7028
- C:\Windows\System\jyOFPnF.exe
  C:\Windows\System\jyOFPnF.exe
  2⤵
  PID:7068
- C:\Windows\System\TFwQMNN.exe
  C:\Windows\System\TFwQMNN.exe
  2⤵
  PID:7108
- C:\Windows\System\cGGTpTf.exe
  C:\Windows\System\cGGTpTf.exe
  2⤵
  PID:7124
- C:\Windows\System\yIBzAQc.exe
  C:\Windows\System\yIBzAQc.exe
  2⤵
  PID:7152
- C:\Windows\System\jojMyuc.exe
  C:\Windows\System\jojMyuc.exe
  2⤵
  PID:6036
- C:\Windows\System\JInLVhg.exe
  C:\Windows\System\JInLVhg.exe
  2⤵
  PID:6260
- C:\Windows\System\lcWSWOb.exe
  C:\Windows\System\lcWSWOb.exe
  2⤵
  PID:6296
- C:\Windows\System\bCocZpf.exe
  C:\Windows\System\bCocZpf.exe
  2⤵
  PID:6408
- C:\Windows\System\XzGrRdb.exe
  C:\Windows\System\XzGrRdb.exe
  2⤵
  PID:6456
- C:\Windows\System\EzwHBVZ.exe
  C:\Windows\System\EzwHBVZ.exe
  2⤵
  PID:6512
- C:\Windows\System\STwUyAz.exe
  C:\Windows\System\STwUyAz.exe
  2⤵
  PID:6560
- C:\Windows\System\uBxFMGn.exe
  C:\Windows\System\uBxFMGn.exe
  2⤵
  PID:6652
- C:\Windows\System\HfZZSqo.exe
  C:\Windows\System\HfZZSqo.exe
  2⤵
  PID:6728
- C:\Windows\System\oCBRCSh.exe
  C:\Windows\System\oCBRCSh.exe
  2⤵
  PID:6764
- C:\Windows\System\HhYgiZe.exe
  C:\Windows\System\HhYgiZe.exe
  2⤵
  PID:6816
- C:\Windows\System\rGUBaCz.exe
  C:\Windows\System\rGUBaCz.exe
  2⤵
  PID:6912
- C:\Windows\System\tcAnymz.exe
  C:\Windows\System\tcAnymz.exe
  2⤵
  PID:6944
- C:\Windows\System\fVGJBZT.exe
  C:\Windows\System\fVGJBZT.exe
  2⤵
  PID:7040
- C:\Windows\System\HDAhsgD.exe
  C:\Windows\System\HDAhsgD.exe
  2⤵
  PID:7080
- C:\Windows\System\rfvszYa.exe
  C:\Windows\System\rfvszYa.exe
  2⤵
  PID:7164
- C:\Windows\System\RCrlGGy.exe
  C:\Windows\System\RCrlGGy.exe
  2⤵
  PID:6268
- C:\Windows\System\rKencwj.exe
  C:\Windows\System\rKencwj.exe
  2⤵
  PID:6480
- C:\Windows\System\YTtRSmS.exe
  C:\Windows\System\YTtRSmS.exe
  2⤵
  PID:6552
- C:\Windows\System\QAKOCWa.exe
  C:\Windows\System\QAKOCWa.exe
  2⤵
  PID:6856
- C:\Windows\System\TvxGwZX.exe
  C:\Windows\System\TvxGwZX.exe
  2⤵
  PID:6936
- C:\Windows\System\aHdGpiI.exe
  C:\Windows\System\aHdGpiI.exe
  2⤵
  PID:7148
- C:\Windows\System\JUYIpFT.exe
  C:\Windows\System\JUYIpFT.exe
  2⤵
  PID:6436
- C:\Windows\System\CUtjSKA.exe
  C:\Windows\System\CUtjSKA.exe
  2⤵
  PID:6584
- C:\Windows\System\HtarqNV.exe
  C:\Windows\System\HtarqNV.exe
  2⤵
  PID:6996
- C:\Windows\System\WiftUHs.exe
  C:\Windows\System\WiftUHs.exe
  2⤵
  PID:6464
- C:\Windows\System\uiVZEkC.exe
  C:\Windows\System\uiVZEkC.exe
  2⤵
  PID:6980
- C:\Windows\System\pRWcURV.exe
  C:\Windows\System\pRWcURV.exe
  2⤵
  PID:7176
- C:\Windows\System\VoudmgR.exe
  C:\Windows\System\VoudmgR.exe
  2⤵
  PID:7216
- C:\Windows\System\WRNCPUZ.exe
  C:\Windows\System\WRNCPUZ.exe
  2⤵
  PID:7232
- C:\Windows\System\dFekACi.exe
  C:\Windows\System\dFekACi.exe
  2⤵
  PID:7248
- C:\Windows\System\yFclBUi.exe
  C:\Windows\System\yFclBUi.exe
  2⤵
  PID:7288
- C:\Windows\System\JylIvIW.exe
  C:\Windows\System\JylIvIW.exe
  2⤵
  PID:7316
- C:\Windows\System\TlbkzJJ.exe
  C:\Windows\System\TlbkzJJ.exe
  2⤵
  PID:7344
- C:\Windows\System\yNdBJlX.exe
  C:\Windows\System\yNdBJlX.exe
  2⤵
  PID:7384
- C:\Windows\System\jyfSLKT.exe
  C:\Windows\System\jyfSLKT.exe
  2⤵
  PID:7412
- C:\Windows\System\irSQVCt.exe
  C:\Windows\System\irSQVCt.exe
  2⤵
  PID:7448
- C:\Windows\System\oCKSuaK.exe
  C:\Windows\System\oCKSuaK.exe
  2⤵
  PID:7472
- C:\Windows\System\vLJHZsK.exe
  C:\Windows\System\vLJHZsK.exe
  2⤵
  PID:7500
- C:\Windows\System\ZYiFOfG.exe
  C:\Windows\System\ZYiFOfG.exe
  2⤵
  PID:7528
- C:\Windows\System\rOudwSi.exe
  C:\Windows\System\rOudwSi.exe
  2⤵
  PID:7552
- C:\Windows\System\jFSxoTx.exe
  C:\Windows\System\jFSxoTx.exe
  2⤵
  PID:7572
- C:\Windows\System\pzdESlC.exe
  C:\Windows\System\pzdESlC.exe
  2⤵
  PID:7592
- C:\Windows\System\aGVJiAq.exe
  C:\Windows\System\aGVJiAq.exe
  2⤵
  PID:7636
- C:\Windows\System\aFzYOxe.exe
  C:\Windows\System\aFzYOxe.exe
  2⤵
  PID:7668
- C:\Windows\System\pMgkUXW.exe
  C:\Windows\System\pMgkUXW.exe
  2⤵
  PID:7696
- C:\Windows\System\UhPljot.exe
  C:\Windows\System\UhPljot.exe
  2⤵
  PID:7728
- C:\Windows\System\eVdyrHY.exe
  C:\Windows\System\eVdyrHY.exe
  2⤵
  PID:7764
- C:\Windows\System\RXguoil.exe
  C:\Windows\System\RXguoil.exe
  2⤵
  PID:7800
- C:\Windows\System\jBjNDYW.exe
  C:\Windows\System\jBjNDYW.exe
  2⤵
  PID:7824
- C:\Windows\System\aexFHlo.exe
  C:\Windows\System\aexFHlo.exe
  2⤵
  PID:7856
- C:\Windows\System\jIFRmJI.exe
  C:\Windows\System\jIFRmJI.exe
  2⤵
  PID:7880
- C:\Windows\System\xEskjad.exe
  C:\Windows\System\xEskjad.exe
  2⤵
  PID:7908
- C:\Windows\System\bBRQdXx.exe
  C:\Windows\System\bBRQdXx.exe
  2⤵
  PID:7928
- C:\Windows\System\OztLTzg.exe
  C:\Windows\System\OztLTzg.exe
  2⤵
  PID:7952
- C:\Windows\System\MTMevUS.exe
  C:\Windows\System\MTMevUS.exe
  2⤵
  PID:7980
- C:\Windows\System\ABKRxkC.exe
  C:\Windows\System\ABKRxkC.exe
  2⤵
  PID:8008
- C:\Windows\System\OtKjuFY.exe
  C:\Windows\System\OtKjuFY.exe
  2⤵
  PID:8036
- C:\Windows\System\MOABKMz.exe
  C:\Windows\System\MOABKMz.exe
  2⤵
  PID:8064
- C:\Windows\System\UdBZjRe.exe
  C:\Windows\System\UdBZjRe.exe
  2⤵
  PID:8092
- C:\Windows\System\mdQxtFZ.exe
  C:\Windows\System\mdQxtFZ.exe
  2⤵
  PID:8112
- C:\Windows\System\JVlCTln.exe
  C:\Windows\System\JVlCTln.exe
  2⤵
  PID:8136
- C:\Windows\System\mwCdeti.exe
  C:\Windows\System\mwCdeti.exe
  2⤵
  PID:8176
- C:\Windows\System\kIfbjKM.exe
  C:\Windows\System\kIfbjKM.exe
  2⤵
  PID:7188
- C:\Windows\System\xQsiEns.exe
  C:\Windows\System\xQsiEns.exe
  2⤵
  PID:7284
- C:\Windows\System\VgqINfT.exe
  C:\Windows\System\VgqINfT.exe
  2⤵
  PID:7268
- C:\Windows\System\NFcGaAS.exe
  C:\Windows\System\NFcGaAS.exe
  2⤵
  PID:7364
- C:\Windows\System\cgAFjaM.exe
  C:\Windows\System\cgAFjaM.exe
  2⤵
  PID:7428
- C:\Windows\System\MTsbstQ.exe
  C:\Windows\System\MTsbstQ.exe
  2⤵
  PID:7492
- C:\Windows\System\inUgLED.exe
  C:\Windows\System\inUgLED.exe
  2⤵
  PID:7548
- C:\Windows\System\TdWJmPK.exe
  C:\Windows\System\TdWJmPK.exe
  2⤵
  PID:7616
- C:\Windows\System\RklVYWm.exe
  C:\Windows\System\RklVYWm.exe
  2⤵
  PID:7684
- C:\Windows\System\avptkpF.exe
  C:\Windows\System\avptkpF.exe
  2⤵
  PID:7784
- C:\Windows\System\RgCZSsH.exe
  C:\Windows\System\RgCZSsH.exe
  2⤵
  PID:7872
- C:\Windows\System\pwurBQi.exe
  C:\Windows\System\pwurBQi.exe
  2⤵
  PID:7904
- C:\Windows\System\wcUAzpF.exe
  C:\Windows\System\wcUAzpF.exe
  2⤵
  PID:7992
- C:\Windows\System\HAZElpr.exe
  C:\Windows\System\HAZElpr.exe
  2⤵
  PID:8052
- C:\Windows\System\XaIptTA.exe
  C:\Windows\System\XaIptTA.exe
  2⤵
  PID:8100
- C:\Windows\System\vAKPjhu.exe
  C:\Windows\System\vAKPjhu.exe
  2⤵
  PID:8164
- C:\Windows\System\xFoniAP.exe
  C:\Windows\System\xFoniAP.exe
  2⤵
  PID:7224
- C:\Windows\System\WwgbeRJ.exe
  C:\Windows\System\WwgbeRJ.exe
  2⤵
  PID:7396
- C:\Windows\System\KVxYUQk.exe
  C:\Windows\System\KVxYUQk.exe
  2⤵
  PID:7520
- C:\Windows\System\JHXJjzf.exe
  C:\Windows\System\JHXJjzf.exe
  2⤵
  PID:7624
- C:\Windows\System\gZgKSik.exe
  C:\Windows\System\gZgKSik.exe
  2⤵
  PID:7864
- C:\Windows\System\RkOynTx.exe
  C:\Windows\System\RkOynTx.exe
  2⤵
  PID:7944
- C:\Windows\System\IpLmdMm.exe
  C:\Windows\System\IpLmdMm.exe
  2⤵
  PID:6884
- C:\Windows\System\PfWbOiM.exe
  C:\Windows\System\PfWbOiM.exe
  2⤵
  PID:7260
- C:\Windows\System\lYUNdng.exe
  C:\Windows\System\lYUNdng.exe
  2⤵
  PID:7456
- C:\Windows\System\HtJYvnu.exe
  C:\Windows\System\HtJYvnu.exe
  2⤵
  PID:8024
- C:\Windows\System\uMQyCRF.exe
  C:\Windows\System\uMQyCRF.exe
  2⤵
  PID:7308
- C:\Windows\System\JLSnuJg.exe
  C:\Windows\System\JLSnuJg.exe
  2⤵
  PID:8212
- C:\Windows\System\YJayeua.exe
  C:\Windows\System\YJayeua.exe
  2⤵
  PID:8228
- C:\Windows\System\RajaaGU.exe
  C:\Windows\System\RajaaGU.exe
  2⤵
  PID:8260
- C:\Windows\System\aYBLuCT.exe
  C:\Windows\System\aYBLuCT.exe
  2⤵
  PID:8284
- C:\Windows\System\LnMrHzv.exe
  C:\Windows\System\LnMrHzv.exe
  2⤵
  PID:8312
- C:\Windows\System\rjChREb.exe
  C:\Windows\System\rjChREb.exe
  2⤵
  PID:8340
- C:\Windows\System\scWfaHk.exe
  C:\Windows\System\scWfaHk.exe
  2⤵
  PID:8368
- C:\Windows\System\FlQPGXv.exe
  C:\Windows\System\FlQPGXv.exe
  2⤵
  PID:8408
- C:\Windows\System\ixlXIrk.exe
  C:\Windows\System\ixlXIrk.exe
  2⤵
  PID:8424
- C:\Windows\System\RGQQyGT.exe
  C:\Windows\System\RGQQyGT.exe
  2⤵
  PID:8444
- C:\Windows\System\qMVUSAT.exe
  C:\Windows\System\qMVUSAT.exe
  2⤵
  PID:8484
- C:\Windows\System\GkLTRcO.exe
  C:\Windows\System\GkLTRcO.exe
  2⤵
  PID:8500
- C:\Windows\System\mVWewBR.exe
  C:\Windows\System\mVWewBR.exe
  2⤵
  PID:8540
- C:\Windows\System\qHcLNHR.exe
  C:\Windows\System\qHcLNHR.exe
  2⤵
  PID:8568
- C:\Windows\System\lDOpqOH.exe
  C:\Windows\System\lDOpqOH.exe
  2⤵
  PID:8600
- C:\Windows\System\spmZwrz.exe
  C:\Windows\System\spmZwrz.exe
  2⤵
  PID:8624
- C:\Windows\System\LkPTxiE.exe
  C:\Windows\System\LkPTxiE.exe
  2⤵
  PID:8640
- C:\Windows\System\ttErqVI.exe
  C:\Windows\System\ttErqVI.exe
  2⤵
  PID:8672
- C:\Windows\System\qMtjssF.exe
  C:\Windows\System\qMtjssF.exe
  2⤵
  PID:8696
- C:\Windows\System\kJxCMza.exe
  C:\Windows\System\kJxCMza.exe
  2⤵
  PID:8724
- C:\Windows\System\RgdfAna.exe
  C:\Windows\System\RgdfAna.exe
  2⤵
  PID:8752
- C:\Windows\System\QNWxHyW.exe
  C:\Windows\System\QNWxHyW.exe
  2⤵
  PID:8780
- C:\Windows\System\HkvImwf.exe
  C:\Windows\System\HkvImwf.exe
  2⤵
  PID:8804
- C:\Windows\System\TnwMilS.exe
  C:\Windows\System\TnwMilS.exe
  2⤵
  PID:8836
- C:\Windows\System\hFljGXk.exe
  C:\Windows\System\hFljGXk.exe
  2⤵
  PID:8852
- C:\Windows\System\EnwObkc.exe
  C:\Windows\System\EnwObkc.exe
  2⤵
  PID:8892
- C:\Windows\System\LKRTfic.exe
  C:\Windows\System\LKRTfic.exe
  2⤵
  PID:8920
- C:\Windows\System\dtUpfVZ.exe
  C:\Windows\System\dtUpfVZ.exe
  2⤵
  PID:8952
- C:\Windows\System\ffTNzaG.exe
  C:\Windows\System\ffTNzaG.exe
  2⤵
  PID:8972
- C:\Windows\System\ZixRomy.exe
  C:\Windows\System\ZixRomy.exe
  2⤵
  PID:9000
- C:\Windows\System\uAwFCbM.exe
  C:\Windows\System\uAwFCbM.exe
  2⤵
  PID:9032
- C:\Windows\System\egMfsay.exe
  C:\Windows\System\egMfsay.exe
  2⤵
  PID:9072
- C:\Windows\System\ygejQUl.exe
  C:\Windows\System\ygejQUl.exe
  2⤵
  PID:9088
- C:\Windows\System\SNnpsjn.exe
  C:\Windows\System\SNnpsjn.exe
  2⤵
  PID:9116
- C:\Windows\System\znOAoLu.exe
  C:\Windows\System\znOAoLu.exe
  2⤵
  PID:9140
- C:\Windows\System\QxFRFEZ.exe
  C:\Windows\System\QxFRFEZ.exe
  2⤵
  PID:9184
- C:\Windows\System\QQoxfpR.exe
  C:\Windows\System\QQoxfpR.exe
  2⤵
  PID:9212
- C:\Windows\System\dPROAiO.exe
  C:\Windows\System\dPROAiO.exe
  2⤵
  PID:8244
- C:\Windows\System\FdiuFKD.exe
  C:\Windows\System\FdiuFKD.exe
  2⤵
  PID:8296
- C:\Windows\System\VrNRSpY.exe
  C:\Windows\System\VrNRSpY.exe
  2⤵
  PID:8356
- C:\Windows\System\rszFLnj.exe
  C:\Windows\System\rszFLnj.exe
  2⤵
  PID:8420
- C:\Windows\System\urzDgdK.exe
  C:\Windows\System\urzDgdK.exe
  2⤵
  PID:8436
- C:\Windows\System\YxXjNpP.exe
  C:\Windows\System\YxXjNpP.exe
  2⤵
  PID:8524
- C:\Windows\System\lTHegOd.exe
  C:\Windows\System\lTHegOd.exe
  2⤵
  PID:8612
- C:\Windows\System\swrfRFE.exe
  C:\Windows\System\swrfRFE.exe
  2⤵
  PID:8684
- C:\Windows\System\nPWAOms.exe
  C:\Windows\System\nPWAOms.exe
  2⤵
  PID:8768
- C:\Windows\System\HIEQamC.exe
  C:\Windows\System\HIEQamC.exe
  2⤵
  PID:8796
- C:\Windows\System\hVGgbSv.exe
  C:\Windows\System\hVGgbSv.exe
  2⤵
  PID:8844
- C:\Windows\System\LSpGtvQ.exe
  C:\Windows\System\LSpGtvQ.exe
  2⤵
  PID:8960
- C:\Windows\System\mEpmPnD.exe
  C:\Windows\System\mEpmPnD.exe
  2⤵
  PID:9028
- C:\Windows\System\lLhdmdh.exe
  C:\Windows\System\lLhdmdh.exe
  2⤵
  PID:9056
- C:\Windows\System\dLQPUgB.exe
  C:\Windows\System\dLQPUgB.exe
  2⤵
  PID:9168
- C:\Windows\System\JtFmmMZ.exe
  C:\Windows\System\JtFmmMZ.exe
  2⤵
  PID:9208
- C:\Windows\System\XetFyGC.exe
  C:\Windows\System\XetFyGC.exe
  2⤵
  PID:8200
- C:\Windows\System\dDQGtDt.exe
  C:\Windows\System\dDQGtDt.exe
  2⤵
  PID:8364
- C:\Windows\System\LeExdOk.exe
  C:\Windows\System\LeExdOk.exe
  2⤵
  PID:8520
- C:\Windows\System\htGcstX.exe
  C:\Windows\System\htGcstX.exe
  2⤵
  PID:8800
- C:\Windows\System\iKwIozS.exe
  C:\Windows\System\iKwIozS.exe
  2⤵
  PID:8912
- C:\Windows\System\OIMNjlR.exe
  C:\Windows\System\OIMNjlR.exe
  2⤵
  PID:9044
- C:\Windows\System\aQPMkBl.exe
  C:\Windows\System\aQPMkBl.exe
  2⤵
  PID:9136
- C:\Windows\System\DbrDdql.exe
  C:\Windows\System\DbrDdql.exe
  2⤵
  PID:8496
- C:\Windows\System\PXiuslz.exe
  C:\Windows\System\PXiuslz.exe
  2⤵
  PID:8468
- C:\Windows\System\zMCbocY.exe
  C:\Windows\System\zMCbocY.exe
  2⤵
  PID:9084
- C:\Windows\System\dleiULg.exe
  C:\Windows\System\dleiULg.exe
  2⤵
  PID:9224
- C:\Windows\System\TegZlHI.exe
  C:\Windows\System\TegZlHI.exe
  2⤵
  PID:9252
- C:\Windows\System\cigOWNT.exe
  C:\Windows\System\cigOWNT.exe
  2⤵
  PID:9280
- C:\Windows\System\IszfHlh.exe
  C:\Windows\System\IszfHlh.exe
  2⤵
  PID:9320
- C:\Windows\System\wlUlEDJ.exe
  C:\Windows\System\wlUlEDJ.exe
  2⤵
  PID:9336
- C:\Windows\System\iATfefs.exe
  C:\Windows\System\iATfefs.exe
  2⤵
  PID:9352
- C:\Windows\System\EPskfaK.exe
  C:\Windows\System\EPskfaK.exe
  2⤵
  PID:9380
- C:\Windows\System\kPCDFOh.exe
  C:\Windows\System\kPCDFOh.exe
  2⤵
  PID:9412
- C:\Windows\System\OLtCtpz.exe
  C:\Windows\System\OLtCtpz.exe
  2⤵
  PID:9460
- C:\Windows\System\WzhhgKk.exe
  C:\Windows\System\WzhhgKk.exe
  2⤵
  PID:9488
- C:\Windows\System\fwsHQUL.exe
  C:\Windows\System\fwsHQUL.exe
  2⤵
  PID:9516
- C:\Windows\System\iTjgnHH.exe
  C:\Windows\System\iTjgnHH.exe
  2⤵
  PID:9552
- C:\Windows\System\SPzKoJO.exe
  C:\Windows\System\SPzKoJO.exe
  2⤵
  PID:9580
- C:\Windows\System\xIdXLEb.exe
  C:\Windows\System\xIdXLEb.exe
  2⤵
  PID:9600
- C:\Windows\System\uQjYmcC.exe
  C:\Windows\System\uQjYmcC.exe
  2⤵
  PID:9616
- C:\Windows\System\ckUuoMU.exe
  C:\Windows\System\ckUuoMU.exe
  2⤵
  PID:9652
- C:\Windows\System\oDXAKEg.exe
  C:\Windows\System\oDXAKEg.exe
  2⤵
  PID:9676
- C:\Windows\System\UzGpdwj.exe
  C:\Windows\System\UzGpdwj.exe
  2⤵
  PID:9712
- C:\Windows\System\CtwLWgG.exe
  C:\Windows\System\CtwLWgG.exe
  2⤵
  PID:9740
- C:\Windows\System\ZakWkcj.exe
  C:\Windows\System\ZakWkcj.exe
  2⤵
  PID:9760
- C:\Windows\System\MLsXelr.exe
  C:\Windows\System\MLsXelr.exe
  2⤵
  PID:9800
- C:\Windows\System\DkSgcOD.exe
  C:\Windows\System\DkSgcOD.exe
  2⤵
  PID:9824
- C:\Windows\System\FDXfQGz.exe
  C:\Windows\System\FDXfQGz.exe
  2⤵
  PID:9844
- C:\Windows\System\udwAGpc.exe
  C:\Windows\System\udwAGpc.exe
  2⤵
  PID:9876
- C:\Windows\System\aoFPCrd.exe
  C:\Windows\System\aoFPCrd.exe
  2⤵
  PID:9912
- C:\Windows\System\SehICRL.exe
  C:\Windows\System\SehICRL.exe
  2⤵
  PID:9936
- C:\Windows\System\WyhxrpQ.exe
  C:\Windows\System\WyhxrpQ.exe
  2⤵
  PID:9968
- C:\Windows\System\PXmaPgJ.exe
  C:\Windows\System\PXmaPgJ.exe
  2⤵
  PID:9996
- C:\Windows\System\gWlzMQh.exe
  C:\Windows\System\gWlzMQh.exe
  2⤵
  PID:10020
- C:\Windows\System\ZLXEjLf.exe
  C:\Windows\System\ZLXEjLf.exe
  2⤵
  PID:10036
- C:\Windows\System\gABoOMf.exe
  C:\Windows\System\gABoOMf.exe
  2⤵
  PID:10056
- C:\Windows\System\mYYbyJG.exe
  C:\Windows\System\mYYbyJG.exe
  2⤵
  PID:10084
- C:\Windows\System\samzCHD.exe
  C:\Windows\System\samzCHD.exe
  2⤵
  PID:10116
- C:\Windows\System\MZXNIzy.exe
  C:\Windows\System\MZXNIzy.exe
  2⤵
  PID:10152
- C:\Windows\System\xqhkUkF.exe
  C:\Windows\System\xqhkUkF.exe
  2⤵
  PID:10180
- C:\Windows\System\QctDUOS.exe
  C:\Windows\System\QctDUOS.exe
  2⤵
  PID:10220
- C:\Windows\System\pFqeWaX.exe
  C:\Windows\System\pFqeWaX.exe
  2⤵
  PID:8324
- C:\Windows\System\fwAaLkw.exe
  C:\Windows\System\fwAaLkw.exe
  2⤵
  PID:9268
- C:\Windows\System\ltzCuhC.exe
  C:\Windows\System\ltzCuhC.exe
  2⤵
  PID:9304
- C:\Windows\System\xHijNra.exe
  C:\Windows\System\xHijNra.exe
  2⤵
  PID:9400
- C:\Windows\System\gtAqwQP.exe
  C:\Windows\System\gtAqwQP.exe
  2⤵
  PID:9368
- C:\Windows\System\FalJyel.exe
  C:\Windows\System\FalJyel.exe
  2⤵
  PID:9472
- C:\Windows\System\xfrnsjx.exe
  C:\Windows\System\xfrnsjx.exe
  2⤵
  PID:9588
- C:\Windows\System\wuhTXDr.exe
  C:\Windows\System\wuhTXDr.exe
  2⤵
  PID:9636
- C:\Windows\System\ZIPJpqn.exe
  C:\Windows\System\ZIPJpqn.exe
  2⤵
  PID:9684
- C:\Windows\System\CXxGTKG.exe
  C:\Windows\System\CXxGTKG.exe
  2⤵
  PID:9780
- C:\Windows\System\FDDflMo.exe
  C:\Windows\System\FDDflMo.exe
  2⤵
  PID:9812
- C:\Windows\System\JxxQXWn.exe
  C:\Windows\System\JxxQXWn.exe
  2⤵
  PID:9896
- C:\Windows\System\EYvvVVd.exe
  C:\Windows\System\EYvvVVd.exe
  2⤵
  PID:9960
- C:\Windows\System\bzHZGTB.exe
  C:\Windows\System\bzHZGTB.exe
  2⤵
  PID:10012
- C:\Windows\System\BEFIGvC.exe
  C:\Windows\System\BEFIGvC.exe
  2⤵
  PID:10068
- C:\Windows\System\lUSGxxi.exe
  C:\Windows\System\lUSGxxi.exe
  2⤵
  PID:10108
- C:\Windows\System\DxCeWEC.exe
  C:\Windows\System\DxCeWEC.exe
  2⤵
  PID:10192
- C:\Windows\System\QsjnHFE.exe
  C:\Windows\System\QsjnHFE.exe
  2⤵
  PID:9272
- C:\Windows\System\jNSbTEU.exe
  C:\Windows\System\jNSbTEU.exe
  2⤵
  PID:9348
- C:\Windows\System\QyKXbHw.exe
  C:\Windows\System\QyKXbHw.exe
  2⤵
  PID:9528
- C:\Windows\System\vebVkcR.exe
  C:\Windows\System\vebVkcR.exe
  2⤵
  PID:9728
- C:\Windows\System\gNQnzHM.exe
  C:\Windows\System\gNQnzHM.exe
  2⤵
  PID:9808
- C:\Windows\System\UYmHSwM.exe
  C:\Windows\System\UYmHSwM.exe
  2⤵
  PID:9892
- C:\Windows\System\yuZDslw.exe
  C:\Windows\System\yuZDslw.exe
  2⤵
  PID:10144
- C:\Windows\System\BPhvuAT.exe
  C:\Windows\System\BPhvuAT.exe
  2⤵
  PID:10128
- C:\Windows\System\QYKFsIv.exe
  C:\Windows\System\QYKFsIv.exe
  2⤵
  PID:9500
- C:\Windows\System\kRlfazH.exe
  C:\Windows\System\kRlfazH.exe
  2⤵
  PID:9612
- C:\Windows\System\KhCTLMW.exe
  C:\Windows\System\KhCTLMW.exe
  2⤵
  PID:10176
- C:\Windows\System\XEweHzq.exe
  C:\Windows\System\XEweHzq.exe
  2⤵
  PID:5084
- C:\Windows\System\JlljNJx.exe
  C:\Windows\System\JlljNJx.exe
  2⤵
  PID:9328
- C:\Windows\System\aTofujQ.exe
  C:\Windows\System\aTofujQ.exe
  2⤵
  PID:10248
- C:\Windows\System\GggIZQX.exe
  C:\Windows\System\GggIZQX.exe
  2⤵
  PID:10280
- C:\Windows\System\bSpAMuj.exe
  C:\Windows\System\bSpAMuj.exe
  2⤵
  PID:10316
- C:\Windows\System\GLACHxZ.exe
  C:\Windows\System\GLACHxZ.exe
  2⤵
  PID:10344
- C:\Windows\System\fCerNYX.exe
  C:\Windows\System\fCerNYX.exe
  2⤵
  PID:10368
- C:\Windows\System\RDjFfLO.exe
  C:\Windows\System\RDjFfLO.exe
  2⤵
  PID:10388
- C:\Windows\System\ikewepB.exe
  C:\Windows\System\ikewepB.exe
  2⤵
  PID:10416
- C:\Windows\System\xFaOxqe.exe
  C:\Windows\System\xFaOxqe.exe
  2⤵
  PID:10444
- C:\Windows\System\jSZnatf.exe
  C:\Windows\System\jSZnatf.exe
  2⤵
  PID:10464
- C:\Windows\System\NdZDpbB.exe
  C:\Windows\System\NdZDpbB.exe
  2⤵
  PID:10488
- C:\Windows\System\DGEbmhj.exe
  C:\Windows\System\DGEbmhj.exe
  2⤵
  PID:10516
- C:\Windows\System\OQOVsqu.exe
  C:\Windows\System\OQOVsqu.exe
  2⤵
  PID:10552
- C:\Windows\System\tYypTlZ.exe
  C:\Windows\System\tYypTlZ.exe
  2⤵
  PID:10572
- C:\Windows\System\thcdUyu.exe
  C:\Windows\System\thcdUyu.exe
  2⤵
  PID:10600
- C:\Windows\System\awAzRiD.exe
  C:\Windows\System\awAzRiD.exe
  2⤵
  PID:10648
- C:\Windows\System\gVFkCmF.exe
  C:\Windows\System\gVFkCmF.exe
  2⤵
  PID:10684
- C:\Windows\System\fZPJMCh.exe
  C:\Windows\System\fZPJMCh.exe
  2⤵
  PID:10700
- C:\Windows\System\KjuJBAi.exe
  C:\Windows\System\KjuJBAi.exe
  2⤵
  PID:10736
- C:\Windows\System\JpBRUig.exe
  C:\Windows\System\JpBRUig.exe
  2⤵
  PID:10756
- C:\Windows\System\DRZZnbg.exe
  C:\Windows\System\DRZZnbg.exe
  2⤵
  PID:10784
- C:\Windows\System\pcMtheZ.exe
  C:\Windows\System\pcMtheZ.exe
  2⤵
  PID:10812
- C:\Windows\System\fPfGSxt.exe
  C:\Windows\System\fPfGSxt.exe
  2⤵
  PID:10848
- C:\Windows\System\AgCtDRN.exe
  C:\Windows\System\AgCtDRN.exe
  2⤵
  PID:10864
- C:\Windows\System\DeixjbP.exe
  C:\Windows\System\DeixjbP.exe
  2⤵
  PID:10884
- C:\Windows\System\pmsNaVo.exe
  C:\Windows\System\pmsNaVo.exe
  2⤵
  PID:10908
- C:\Windows\System\HnEsJll.exe
  C:\Windows\System\HnEsJll.exe
  2⤵
  PID:10948
- C:\Windows\System\cfoLvXN.exe
  C:\Windows\System\cfoLvXN.exe
  2⤵
  PID:10976
- C:\Windows\System\EcIoNCx.exe
  C:\Windows\System\EcIoNCx.exe
  2⤵
  PID:11000
- C:\Windows\System\nxeriej.exe
  C:\Windows\System\nxeriej.exe
  2⤵
  PID:11036
- C:\Windows\System\qxzqZaB.exe
  C:\Windows\System\qxzqZaB.exe
  2⤵
  PID:11064
- C:\Windows\System\afovWQG.exe
  C:\Windows\System\afovWQG.exe
  2⤵
  PID:11092
- C:\Windows\System\NltKJUJ.exe
  C:\Windows\System\NltKJUJ.exe
  2⤵
  PID:11120
- C:\Windows\System\ZIAQIbq.exe
  C:\Windows\System\ZIAQIbq.exe
  2⤵
  PID:11136
- C:\Windows\System\gHoaliU.exe
  C:\Windows\System\gHoaliU.exe
  2⤵
  PID:11156
- C:\Windows\System\OeKkanl.exe
  C:\Windows\System\OeKkanl.exe
  2⤵
  PID:11188
- C:\Windows\System\wFLOWeT.exe
  C:\Windows\System\wFLOWeT.exe
  2⤵
  PID:11216
- C:\Windows\System\wmpIxuc.exe
  C:\Windows\System\wmpIxuc.exe
  2⤵
  PID:11236
- C:\Windows\System\LFpaJkB.exe
  C:\Windows\System\LFpaJkB.exe
  2⤵
  PID:10032
- C:\Windows\System\lZnWPXs.exe
  C:\Windows\System\lZnWPXs.exe
  2⤵
  PID:10300
- C:\Windows\System\RzDcNOe.exe
  C:\Windows\System\RzDcNOe.exe
  2⤵
  PID:10384
- C:\Windows\System\ZbKkfPz.exe
  C:\Windows\System\ZbKkfPz.exe
  2⤵
  PID:10452
- C:\Windows\System\GFPGycu.exe
  C:\Windows\System\GFPGycu.exe
  2⤵
  PID:10536
- C:\Windows\System\qmGnUZx.exe
  C:\Windows\System\qmGnUZx.exe
  2⤵
  PID:10588
- C:\Windows\System\iDBDYxl.exe
  C:\Windows\System\iDBDYxl.exe
  2⤵
  PID:10632
- C:\Windows\System\aDYlwVf.exe
  C:\Windows\System\aDYlwVf.exe
  2⤵
  PID:10724
- C:\Windows\System\ILwlTQo.exe
  C:\Windows\System\ILwlTQo.exe
  2⤵
  PID:10772
- C:\Windows\System\vngGclh.exe
  C:\Windows\System\vngGclh.exe
  2⤵
  PID:10860
- C:\Windows\System\nOyPEwz.exe
  C:\Windows\System\nOyPEwz.exe
  2⤵
  PID:10904
- C:\Windows\System\tEqdYmw.exe
  C:\Windows\System\tEqdYmw.exe
  2⤵
  PID:4776
- C:\Windows\System\FgOyQVE.exe
  C:\Windows\System\FgOyQVE.exe
  2⤵
  PID:11008
- C:\Windows\System\nbmDnKj.exe
  C:\Windows\System\nbmDnKj.exe
  2⤵
  PID:11060
- C:\Windows\System\kPTicuP.exe
  C:\Windows\System\kPTicuP.exe
  2⤵
  PID:11164
- C:\Windows\System\PnsxWmo.exe
  C:\Windows\System\PnsxWmo.exe
  2⤵
  PID:11176
- C:\Windows\System\ZzapYeD.exe
  C:\Windows\System\ZzapYeD.exe
  2⤵
  PID:10296
- C:\Windows\System\zZOtQuR.exe
  C:\Windows\System\zZOtQuR.exe
  2⤵
  PID:10276
- C:\Windows\System\XJGmTmM.exe
  C:\Windows\System\XJGmTmM.exe
  2⤵
  PID:10456
- C:\Windows\System\synUXLv.exe
  C:\Windows\System\synUXLv.exe
  2⤵
  PID:10616
- C:\Windows\System\ZTmBulc.exe
  C:\Windows\System\ZTmBulc.exe
  2⤵
  PID:10840
- C:\Windows\System\aXZjfFx.exe
  C:\Windows\System\aXZjfFx.exe
  2⤵
  PID:10996
- C:\Windows\System\hZjNShU.exe
  C:\Windows\System\hZjNShU.exe
  2⤵
  PID:11084
- C:\Windows\System\VRUDAuu.exe
  C:\Windows\System\VRUDAuu.exe
  2⤵
  PID:11224
- C:\Windows\System\dmjxquV.exe
  C:\Windows\System\dmjxquV.exe
  2⤵
  PID:10436
- C:\Windows\System\xSaekna.exe
  C:\Windows\System\xSaekna.exe
  2⤵
  PID:10824
- C:\Windows\System\pCXUugi.exe
  C:\Windows\System\pCXUugi.exe
  2⤵
  PID:11148
- C:\Windows\System\ZVfylUC.exe
  C:\Windows\System\ZVfylUC.exe
  2⤵
  PID:10748
- C:\Windows\System\Umtgtws.exe
  C:\Windows\System\Umtgtws.exe
  2⤵
  PID:11248
- C:\Windows\System\PvLFwot.exe
  C:\Windows\System\PvLFwot.exe
  2⤵
  PID:11272
- C:\Windows\System\PGUWzWW.exe
  C:\Windows\System\PGUWzWW.exe
  2⤵
  PID:11308
- C:\Windows\System\CUIeBDf.exe
  C:\Windows\System\CUIeBDf.exe
  2⤵
  PID:11336
- C:\Windows\System\LXPpobs.exe
  C:\Windows\System\LXPpobs.exe
  2⤵
  PID:11372
- C:\Windows\System\BTrikEx.exe
  C:\Windows\System\BTrikEx.exe
  2⤵
  PID:11396
- C:\Windows\System\IBmbnaG.exe
  C:\Windows\System\IBmbnaG.exe
  2⤵
  PID:11468
- C:\Windows\System\ckZamtf.exe
  C:\Windows\System\ckZamtf.exe
  2⤵
  PID:11484
- C:\Windows\System\nysOlDJ.exe
  C:\Windows\System\nysOlDJ.exe
  2⤵
  PID:11512
- C:\Windows\System\BmcpLvH.exe
  C:\Windows\System\BmcpLvH.exe
  2⤵
  PID:11536
- C:\Windows\System\UAKlBTk.exe
  C:\Windows\System\UAKlBTk.exe
  2⤵
  PID:11556
- C:\Windows\System\nHRNpsS.exe
  C:\Windows\System\nHRNpsS.exe
  2⤵
  PID:11592
- C:\Windows\System\aHiBgVX.exe
  C:\Windows\System\aHiBgVX.exe
  2⤵
  PID:11612
- C:\Windows\System\kMlZZMV.exe
  C:\Windows\System\kMlZZMV.exe
  2⤵
  PID:11628
- C:\Windows\System\XRvCZtM.exe
  C:\Windows\System\XRvCZtM.exe
  2⤵
  PID:11664
- C:\Windows\System\aWwYSKX.exe
  C:\Windows\System\aWwYSKX.exe
  2⤵
  PID:11684
- C:\Windows\System\gaVTOBI.exe
  C:\Windows\System\gaVTOBI.exe
  2⤵
  PID:11720
- C:\Windows\System\AYscgBF.exe
  C:\Windows\System\AYscgBF.exe
  2⤵
  PID:11752
- C:\Windows\System\LSKdOLS.exe
  C:\Windows\System\LSKdOLS.exe
  2⤵
  PID:11780
- C:\Windows\System\RvNjoLa.exe
  C:\Windows\System\RvNjoLa.exe
  2⤵
  PID:11808
- C:\Windows\System\YNgVhbr.exe
  C:\Windows\System\YNgVhbr.exe
  2⤵
  PID:11828
- C:\Windows\System\BiDrVwE.exe
  C:\Windows\System\BiDrVwE.exe
  2⤵
  PID:11852
- C:\Windows\System\TxqGKXu.exe
  C:\Windows\System\TxqGKXu.exe
  2⤵
  PID:11884
- C:\Windows\System\FftCNPs.exe
  C:\Windows\System\FftCNPs.exe
  2⤵
  PID:11920
- C:\Windows\System\FSdikUK.exe
  C:\Windows\System\FSdikUK.exe
  2⤵
  PID:11956
- C:\Windows\System\JdNMqMW.exe
  C:\Windows\System\JdNMqMW.exe
  2⤵
  PID:11976
- C:\Windows\System\sCtDmdS.exe
  C:\Windows\System\sCtDmdS.exe
  2⤵
  PID:12004
- C:\Windows\System\FVjlTmo.exe
  C:\Windows\System\FVjlTmo.exe
  2⤵
  PID:12032
- C:\Windows\System\YyrOTiX.exe
  C:\Windows\System\YyrOTiX.exe
  2⤵
  PID:12052
- C:\Windows\System\nqWLruO.exe
  C:\Windows\System\nqWLruO.exe
  2⤵
  PID:12084
- C:\Windows\System\pbLvKtO.exe
  C:\Windows\System\pbLvKtO.exe
  2⤵
  PID:12112
- C:\Windows\System\Oattyxo.exe
  C:\Windows\System\Oattyxo.exe
  2⤵
  PID:12144
- C:\Windows\System\fpSsrOk.exe
  C:\Windows\System\fpSsrOk.exe
  2⤵
  PID:12160
- C:\Windows\System\NIoEWiT.exe
  C:\Windows\System\NIoEWiT.exe
  2⤵
  PID:12188
- C:\Windows\System\SSTKkin.exe
  C:\Windows\System\SSTKkin.exe
  2⤵
  PID:12224
- C:\Windows\System\mpMTxHs.exe
  C:\Windows\System\mpMTxHs.exe
  2⤵
  PID:12256
- C:\Windows\System\NPFDfPh.exe
  C:\Windows\System\NPFDfPh.exe
  2⤵
  PID:12284
- C:\Windows\System\qfvpQHP.exe
  C:\Windows\System\qfvpQHP.exe
  2⤵
  PID:11368
- C:\Windows\System\NSqmGmG.exe
  C:\Windows\System\NSqmGmG.exe
  2⤵
  PID:11356
- C:\Windows\System\PYDsxmZ.exe
  C:\Windows\System\PYDsxmZ.exe
  2⤵
  PID:11444
- C:\Windows\System\TjmpWnU.exe
  C:\Windows\System\TjmpWnU.exe
  2⤵
  PID:1312
- C:\Windows\System\tELyfbU.exe
  C:\Windows\System\tELyfbU.exe
  2⤵
  PID:11504
- C:\Windows\System\iYsuAjw.exe
  C:\Windows\System\iYsuAjw.exe
  2⤵
  PID:11568
- C:\Windows\System\tppHKMr.exe
  C:\Windows\System\tppHKMr.exe
  2⤵
  PID:11656
- C:\Windows\System\guRAiFp.exe
  C:\Windows\System\guRAiFp.exe
  2⤵
  PID:11704
- C:\Windows\System\UHZxthj.exe
  C:\Windows\System\UHZxthj.exe
  2⤵
  PID:11776
- C:\Windows\System\ycJdPBY.exe
  C:\Windows\System\ycJdPBY.exe
  2⤵
  PID:11816
- C:\Windows\System\nqejJsH.exe
  C:\Windows\System\nqejJsH.exe
  2⤵
  PID:11908
- C:\Windows\System\zubrYTB.exe
  C:\Windows\System\zubrYTB.exe
  2⤵
  PID:11948
- C:\Windows\System\cKgpHTQ.exe
  C:\Windows\System\cKgpHTQ.exe
  2⤵
  PID:12028
- C:\Windows\System\hKRCkZH.exe
  C:\Windows\System\hKRCkZH.exe
  2⤵
  PID:12108
- C:\Windows\System\aoheVZh.exe
  C:\Windows\System\aoheVZh.exe
  2⤵
  PID:12096
- C:\Windows\System\LrMlEsv.exe
  C:\Windows\System\LrMlEsv.exe
  2⤵
  PID:12212
- C:\Windows\System\KiqVoyP.exe
  C:\Windows\System\KiqVoyP.exe
  2⤵
  PID:12268
- C:\Windows\System\IzhxAVN.exe
  C:\Windows\System\IzhxAVN.exe
  2⤵
  PID:11388
- C:\Windows\System\tZNrnxh.exe
  C:\Windows\System\tZNrnxh.exe
  2⤵
  PID:11424
- C:\Windows\System\zjcrpRD.exe
  C:\Windows\System\zjcrpRD.exe
  2⤵
  PID:11712
- C:\Windows\System\ILQmwCU.exe
  C:\Windows\System\ILQmwCU.exe
  2⤵
  PID:11800
- C:\Windows\System\UmeiPdC.exe
  C:\Windows\System\UmeiPdC.exe
  2⤵
  PID:11968
- C:\Windows\System\ZMjvXOH.exe
  C:\Windows\System\ZMjvXOH.exe
  2⤵
  PID:12176
- C:\Windows\System\dLvNMub.exe
  C:\Windows\System\dLvNMub.exe
  2⤵
  PID:12244
- C:\Windows\System\hTEpxbA.exe
  C:\Windows\System\hTEpxbA.exe
  2⤵
  PID:11548
- C:\Windows\System\ttNYFDI.exe
  C:\Windows\System\ttNYFDI.exe
  2⤵
  PID:11936
- C:\Windows\System\wPfOjbs.exe
  C:\Windows\System\wPfOjbs.exe
  2⤵
  PID:12232
- C:\Windows\System\YzRgGME.exe
  C:\Windows\System\YzRgGME.exe
  2⤵
  PID:11324
- C:\Windows\System\AmEIzAH.exe
  C:\Windows\System\AmEIzAH.exe
  2⤵
  PID:11876
- C:\Windows\System\RVVHXqQ.exe
  C:\Windows\System\RVVHXqQ.exe
  2⤵
  PID:12304
- C:\Windows\System\zIboSmM.exe
  C:\Windows\System\zIboSmM.exe
  2⤵
  PID:12328
- C:\Windows\System\yEknUJl.exe
  C:\Windows\System\yEknUJl.exe
  2⤵
  PID:12356
- C:\Windows\System\otpEfVP.exe
  C:\Windows\System\otpEfVP.exe
  2⤵
  PID:12384
- C:\Windows\System\RrXnSyE.exe
  C:\Windows\System\RrXnSyE.exe
  2⤵
  PID:12404
- C:\Windows\System\uYzCOPg.exe
  C:\Windows\System\uYzCOPg.exe
  2⤵
  PID:12436
- C:\Windows\System\whudZoX.exe
  C:\Windows\System\whudZoX.exe
  2⤵
  PID:12484
- C:\Windows\System\YPeljEE.exe
  C:\Windows\System\YPeljEE.exe
  2⤵
  PID:12516
- C:\Windows\System\ohweBKj.exe
  C:\Windows\System\ohweBKj.exe
  2⤵
  PID:12540
- C:\Windows\System\UVsdded.exe
  C:\Windows\System\UVsdded.exe
  2⤵
  PID:12568
- C:\Windows\System\BOWnmMc.exe
  C:\Windows\System\BOWnmMc.exe
  2⤵
  PID:12600
- C:\Windows\System\iiSAJCo.exe
  C:\Windows\System\iiSAJCo.exe
  2⤵
  PID:12644
- C:\Windows\System\aRyXRFq.exe
  C:\Windows\System\aRyXRFq.exe
  2⤵
  PID:12672
- C:\Windows\System\SkilTxC.exe
  C:\Windows\System\SkilTxC.exe
  2⤵
  PID:12688
- C:\Windows\System\wsEpduv.exe
  C:\Windows\System\wsEpduv.exe
  2⤵
  PID:12724
- C:\Windows\System\LrGOAbP.exe
  C:\Windows\System\LrGOAbP.exe
  2⤵
  PID:12744
- C:\Windows\System\hDxyHFD.exe
  C:\Windows\System\hDxyHFD.exe
  2⤵
  PID:12772
- C:\Windows\System\bFbUcZd.exe
  C:\Windows\System\bFbUcZd.exe
  2⤵
  PID:12788
- C:\Windows\System\CAnuKYM.exe
  C:\Windows\System\CAnuKYM.exe
  2⤵
  PID:12824
- C:\Windows\System\VzZIlHt.exe
  C:\Windows\System\VzZIlHt.exe
  2⤵
  PID:12856
- C:\Windows\System\mubmpDu.exe
  C:\Windows\System\mubmpDu.exe
  2⤵
  PID:12872
- C:\Windows\System\zxZCWAd.exe
  C:\Windows\System\zxZCWAd.exe
  2⤵
  PID:12908
- C:\Windows\System\HCnYvuG.exe
  C:\Windows\System\HCnYvuG.exe
  2⤵
  PID:12936
- C:\Windows\System\zMdMQfe.exe
  C:\Windows\System\zMdMQfe.exe
  2⤵
  PID:12972
- C:\Windows\System\eMvrnSI.exe
  C:\Windows\System\eMvrnSI.exe
  2⤵
  PID:13008
- C:\Windows\System\WzxzZOc.exe
  C:\Windows\System\WzxzZOc.exe
  2⤵
  PID:13036
- C:\Windows\System\TMuFxMd.exe
  C:\Windows\System\TMuFxMd.exe
  2⤵
  PID:13068
- C:\Windows\System\vwkqitB.exe
  C:\Windows\System\vwkqitB.exe
  2⤵
  PID:13092
- C:\Windows\System\QQZkpvS.exe
  C:\Windows\System\QQZkpvS.exe
  2⤵
  PID:13124
- C:\Windows\System\YcYRUCB.exe
  C:\Windows\System\YcYRUCB.exe
  2⤵
  PID:13152
- C:\Windows\System\tRBFuGb.exe
  C:\Windows\System\tRBFuGb.exe
  2⤵
  PID:13180
- C:\Windows\System\gbgiFrF.exe
  C:\Windows\System\gbgiFrF.exe
  2⤵
  PID:13208
- C:\Windows\System\xkuBRpu.exe
  C:\Windows\System\xkuBRpu.exe
  2⤵
  PID:13236
- C:\Windows\System\faKZmla.exe
  C:\Windows\System\faKZmla.exe
  2⤵
  PID:13268
- C:\Windows\System\ZOEdBwt.exe
  C:\Windows\System\ZOEdBwt.exe
  2⤵
  PID:13300
- C:\Windows\System\SlupCkN.exe
  C:\Windows\System\SlupCkN.exe
  2⤵
  PID:11288
- C:\Windows\System\oktlUXf.exe
  C:\Windows\System\oktlUXf.exe
  2⤵
  PID:12364
- C:\Windows\System\WGmgyMc.exe
  C:\Windows\System\WGmgyMc.exe
  2⤵
  PID:12416
- C:\Windows\System\MQpTTaD.exe
  C:\Windows\System\MQpTTaD.exe
  2⤵
  PID:12504
- C:\Windows\System\wrmiATG.exe
  C:\Windows\System\wrmiATG.exe
  2⤵
  PID:12500
- C:\Windows\System\cVFWbfD.exe
  C:\Windows\System\cVFWbfD.exe
  2⤵
  PID:12596
- C:\Windows\System\wCmRIzd.exe
  C:\Windows\System\wCmRIzd.exe
  2⤵
  PID:12664
- C:\Windows\System\FpUhsZL.exe
  C:\Windows\System\FpUhsZL.exe
  2⤵
  PID:12704
- C:\Windows\System\VPSzaek.exe
  C:\Windows\System\VPSzaek.exe
  2⤵
  PID:12784
- C:\Windows\System\oMkSHvW.exe
  C:\Windows\System\oMkSHvW.exe
  2⤵
  PID:12812
- C:\Windows\System\dUYriYd.exe
  C:\Windows\System\dUYriYd.exe
  2⤵
  PID:12884
- C:\Windows\System\JogGOAM.exe
  C:\Windows\System\JogGOAM.exe
  2⤵
  PID:12932
- C:\Windows\System\iqBdbKl.exe
  C:\Windows\System\iqBdbKl.exe
  2⤵
  PID:12992
- C:\Windows\System\HahwrTO.exe
  C:\Windows\System\HahwrTO.exe
  2⤵
  PID:13064
- C:\Windows\System\ojfHOpJ.exe
  C:\Windows\System\ojfHOpJ.exe
  2⤵
  PID:13120
- C:\Windows\System\GZgHgAz.exe
  C:\Windows\System\GZgHgAz.exe
  2⤵
  PID:13196
- C:\Windows\System\IClsOBj.exe
  C:\Windows\System\IClsOBj.exe
  2⤵
  PID:13248
- C:\Windows\System\BLszqip.exe
  C:\Windows\System\BLszqip.exe
  2⤵
  PID:12076
- C:\Windows\System\zxZnypA.exe
  C:\Windows\System\zxZnypA.exe
  2⤵
  PID:12380
- C:\Windows\System\dBOAKnQ.exe
  C:\Windows\System\dBOAKnQ.exe
  2⤵
  PID:12680
- C:\Windows\System\bAwSfVG.exe
  C:\Windows\System\bAwSfVG.exe
  2⤵
  PID:12780
- C:\Windows\System\gtzRTjw.exe
  C:\Windows\System\gtzRTjw.exe
  2⤵
  PID:12928
- C:\Windows\System\nBXvLCa.exe
  C:\Windows\System\nBXvLCa.exe
  2⤵
  PID:13056
- C:\Windows\System\uVpqtGO.exe
  C:\Windows\System\uVpqtGO.exe
  2⤵
  PID:13140
- C:\Windows\System\syOgokD.exe
  C:\Windows\System\syOgokD.exe
  2⤵
  PID:12432
- C:\Windows\System\ErTdsbA.exe
  C:\Windows\System\ErTdsbA.exe
  2⤵
  PID:12736
- C:\Windows\System\lmdAUFN.exe
  C:\Windows\System\lmdAUFN.exe
  2⤵
  PID:12924
- C:\Windows\System\ELKcUtZ.exe
  C:\Windows\System\ELKcUtZ.exe
  2⤵
  PID:13168
- C:\Windows\System\ecrBujO.exe
  C:\Windows\System\ecrBujO.exe
  2⤵
  PID:12532
- C:\Windows\System\luFTWYq.exe
  C:\Windows\System\luFTWYq.exe
  2⤵
  PID:13328
- C:\Windows\System\EHxmnaT.exe
  C:\Windows\System\EHxmnaT.exe
  2⤵
  PID:13356
- C:\Windows\System\mukinqz.exe
  C:\Windows\System\mukinqz.exe
  2⤵
  PID:13384
- C:\Windows\System\WaeVLGo.exe
  C:\Windows\System\WaeVLGo.exe
  2⤵
  PID:13420
- C:\Windows\System\BhkHHol.exe
  C:\Windows\System\BhkHHol.exe
  2⤵
  PID:13452
- C:\Windows\System\djvPtUM.exe
  C:\Windows\System\djvPtUM.exe
  2⤵
  PID:13484
- C:\Windows\System\gjZDntT.exe
  C:\Windows\System\gjZDntT.exe
  2⤵
  PID:13512
- C:\Windows\System\EsGGfsw.exe
  C:\Windows\System\EsGGfsw.exe
  2⤵
  PID:13540
- C:\Windows\System\sDrOnQm.exe
  C:\Windows\System\sDrOnQm.exe
  2⤵
  PID:13568
- C:\Windows\System\JlrMquT.exe
  C:\Windows\System\JlrMquT.exe
  2⤵
  PID:13584
- C:\Windows\System\oJgWEJu.exe
  C:\Windows\System\oJgWEJu.exe
  2⤵
  PID:13616
- C:\Windows\System\eDrNTaS.exe
  C:\Windows\System\eDrNTaS.exe
  2⤵
  PID:13664
- C:\Windows\System\LeuBFJq.exe
  C:\Windows\System\LeuBFJq.exe
  2⤵
  PID:13680
- C:\Windows\System\vmXofeJ.exe
  C:\Windows\System\vmXofeJ.exe
  2⤵
  PID:13708
- C:\Windows\System\fxbGKht.exe
  C:\Windows\System\fxbGKht.exe
  2⤵
  PID:13740
- C:\Windows\System\EHpIPMA.exe
  C:\Windows\System\EHpIPMA.exe
  2⤵
  PID:13768
- C:\Windows\System\rCmIoCt.exe
  C:\Windows\System\rCmIoCt.exe
  2⤵
  PID:13808
- C:\Windows\System\JiItNze.exe
  C:\Windows\System\JiItNze.exe
  2⤵
  PID:13824
- C:\Windows\System\eIEczkK.exe
  C:\Windows\System\eIEczkK.exe
  2⤵
  PID:13848
- C:\Windows\System\paSVNUY.exe
  C:\Windows\System\paSVNUY.exe
  2⤵
  PID:13888
- C:\Windows\System\Uyoeenl.exe
  C:\Windows\System\Uyoeenl.exe
  2⤵
  PID:13920
- C:\Windows\System\BDKrfUR.exe
  C:\Windows\System\BDKrfUR.exe
  2⤵
  PID:13940
- C:\Windows\System\geBVAqM.exe
  C:\Windows\System\geBVAqM.exe
  2⤵
  PID:13968
- C:\Windows\System\WfGQZuv.exe
  C:\Windows\System\WfGQZuv.exe
  2⤵
  PID:13996
- C:\Windows\System\gebIDha.exe
  C:\Windows\System\gebIDha.exe
  2⤵
  PID:14032
- C:\Windows\System\PTGgQum.exe
  C:\Windows\System\PTGgQum.exe
  2⤵
  PID:14060
- C:\Windows\System\jbDBhIg.exe
  C:\Windows\System\jbDBhIg.exe
  2⤵
  PID:14092
- C:\Windows\System\iUWlhpO.exe
  C:\Windows\System\iUWlhpO.exe
  2⤵
  PID:14128
- C:\Windows\System\TXzgNhD.exe
  C:\Windows\System\TXzgNhD.exe
  2⤵
  PID:14144
- C:\Windows\System\DQqiFJP.exe
  C:\Windows\System\DQqiFJP.exe
  2⤵
  PID:14172
- C:\Windows\System\ypAnaED.exe
  C:\Windows\System\ypAnaED.exe
  2⤵
  PID:14200
- C:\Windows\System\ZGKBCkw.exe
  C:\Windows\System\ZGKBCkw.exe
  2⤵
  PID:14228
- C:\Windows\System\dSjdlLS.exe
  C:\Windows\System\dSjdlLS.exe
  2⤵
  PID:14256
- C:\Windows\System\DvJzVzf.exe
  C:\Windows\System\DvJzVzf.exe
  2⤵
  PID:14284
- C:\Windows\System\OapZKNs.exe
  C:\Windows\System\OapZKNs.exe
  2⤵
  PID:14312
- C:\Windows\System\RVCsMdg.exe
  C:\Windows\System\RVCsMdg.exe
  2⤵
  PID:14328
- C:\Windows\System\SxwGXtK.exe
  C:\Windows\System\SxwGXtK.exe
  2⤵
  PID:13368
- C:\Windows\System\BgnnfAy.exe
  C:\Windows\System\BgnnfAy.exe
  2⤵
  PID:13444
- C:\Windows\System\kTHhxec.exe
  C:\Windows\System\kTHhxec.exe
  2⤵
  PID:13480
- C:\Windows\System\xaDldOZ.exe
  C:\Windows\System\xaDldOZ.exe
  2⤵
  PID:13556
- C:\Windows\System\TXHACnx.exe
  C:\Windows\System\TXHACnx.exe
  2⤵
  PID:13608
- C:\Windows\System\OhsTfCC.exe
  C:\Windows\System\OhsTfCC.exe
  2⤵
  PID:13652
- C:\Windows\System\HoWHSHk.exe
  C:\Windows\System\HoWHSHk.exe
  2⤵
  PID:13752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DFulLhn.exe

Filesize
2.2MB

MD5
f5aed5a85dc8d8b15b9860ba1b8d9cf4

SHA1
798af6da5931ecaed628fa75ff1ffc846ec36f96

SHA256
3e92a85728689663e1f65a9a5a1e892a7d48f3c44c842bf42ea630f1978519af

SHA512
2c0c3ffb93ded0d67bca0e4b69f5f4c8f49e5b99143dff98346f60864f4a31be1c6738daf030ce84edd1ae032e15c8bbb63fa5639ec6da8597f8df973da190f4

Download Submit
C:\Windows\System\DTCexgS.exe

Filesize
2.2MB

MD5
b0d3f4f5ccff890dac7455afef045c0e

SHA1
e8239c8ddcc65f161c780a1cf04529576ae46d33

SHA256
1f71ad265040e2193851876278cd1f86f3922ac4fa20619b63263591b733b9d7

SHA512
e70412805c6e72ceb977481ea20ee26d237b8f5a893811203618e55344ea66136e1311b74445d69de2ce62df1816ef9c606de26805c6db11145b26c2b3369bbc

Download Submit
C:\Windows\System\EQYyxOn.exe

Filesize
2.2MB

MD5
922ac8c8b702c896b2c42a32ca46093f

SHA1
ee66cb99ff9ac9a117846d5b4b341e19b16caaf9

SHA256
96cca13d60c9b3241c1a4f58afb05f438ec95b47a4166d9cd048cb58bfc3b1f4

SHA512
c36fa8ed1447e8fe9cd72bcf56dc35da9a3d248e3b598ee6c184f9a5d785959fef4973f4068965a5f13a4e8d5f358d2ad5065386074fd41b5b6d8f7e6e9d4fd0

Download Submit
C:\Windows\System\HhDUrFp.exe

Filesize
2.2MB

MD5
ca304047c0d9622f5839db712eb9aed9

SHA1
ec3d0336790e69f76cd058ea74d6f1dc265ace38

SHA256
c1fa11d950af0121a7fe57514572f9563728d95a5aa0cf26a29e2b01de1f47ed

SHA512
f23e8dcea11d40448c18c167130e2eac48270a6a3e67aece1384d7584a0258322369cd46a0d5fadd47b2472e709bf5e5633ad0b075f3f55684494b70b7a7222b

Download Submit
C:\Windows\System\HnPRQKG.exe

Filesize
2.2MB

MD5
0d2413550158e68c2e9140f437a3fded

SHA1
04d1355e5d5e998fbb15041b24043f0f6aa71763

SHA256
2aa5cb93897432a84bd4d3a77211158d48c8d6996a87bf3b8024ad08804e3c95

SHA512
d5204eefa25d0825a35250f78293c51fb14fdf26e0a5ca80ed5334b094341f1b21b6a2a265edaba051faf8988b18d8d9f1c3cf4305f47321f09fb2a408f9a88d

Download Submit
C:\Windows\System\MzcRoSp.exe

Filesize
2.2MB

MD5
ee788c218902c5a4d922e191baac571b

SHA1
20d1e799ea84f6b5cfa389bf1c38f3d4906c24cd

SHA256
47f209d554c9bbf007df19507c7503aa839ec85b1da6de591160c1a10610bf16

SHA512
921aab1e3d349b4ca334f4c9a46a283bc801f78b36503b2dcf0fa70451a539af7e9bdf8ccc1c8335b94d8859c0ed6d27d0e29ae5276b02f587670aad23999eb5

Download Submit
C:\Windows\System\OrwlAwV.exe

Filesize
2.2MB

MD5
267071479b805b388a4721c9f7c66377

SHA1
6bf13de5a8000c1fa212375326ed7ab0071eacfc

SHA256
a7ba21e6f414e80e10ccb8d48ae8a12a3cae0000dd9abb06316c9aeeeb6d7d2a

SHA512
4b10c36e29ba7c04b4142f962744818773cd6649152892819b58e6f2a82e7b59f394082e1331cd2f9856dffbdd9f72c32d2d151925e05b3c776f3c2f78eec768

Download Submit
C:\Windows\System\OzsojYC.exe

Filesize
2.2MB

MD5
0cd2394d5b797c39fd34d533c772c151

SHA1
146fa6bb8105f2826471fb66e1eb8fde29296daf

SHA256
a9ffe341e4c189018b51673ffb73f042f234cb540a15e489c796256460219ecb

SHA512
9f0b3e1a9b669d511c03f5b4efda8a05d5c127d4d6f08137c32067d218d292f11ca38c94771d410403b20a2aa34686980135574fd3370e43474dae3fd1ac364e

Download Submit
C:\Windows\System\PfiEknc.exe

Filesize
2.2MB

MD5
616755bbd8e48b3ff61baab1883eb89d

SHA1
3e78efca8d600336346c2e36570f04a233f98ef3

SHA256
cf48227815c4af9d7faa68f1f337db61d059a528216422ec165e96cce0e7dadb

SHA512
a549e79e739fc410a81e219b179017f1d11440435db07c291f3e39ce0f29ff5c14fd365877a8f79fedc87a47549d6869c492a4ed48e1ad2790d4b2f613a5bbdb

Download Submit
C:\Windows\System\QeYBzYR.exe

Filesize
2.2MB

MD5
79938329f4341382aeda12399375c5cd

SHA1
7135e1b42bec659185b272e7d9421d704c0a7110

SHA256
5fee272a000b5009a96ded0ca2f54d7e334d805447fdd039e08b2fd3a00ce183

SHA512
86e3e097eba56f72e427275f2d4e2edc340181b9fc1089931abf7542a541297cf6b1680c1e0d6e2b260f2e7a31c79bc8db057c2a3ad698e27882468a34211d2a

Download Submit
C:\Windows\System\UPiWCvf.exe

Filesize
2.2MB

MD5
90a2ae36f65c436b68f4e8711fdbaf08

SHA1
6488bc46119101f44dd911d1c23a02401ebe73d7

SHA256
772dbb07f99f57ca2995f066f71233016c4057916d5379622130d4381bf5ae0e

SHA512
c77183169472e21637c86fc54ccd877988eb5a595fca8f0fadc41cb11577fe4bec4879c2c2758ec7c158556577299d05ac50c9f137c9cdcd4a164527bfdfe6c1

Download Submit
C:\Windows\System\WuUsIZX.exe

Filesize
2.2MB

MD5
578ce0488696c74309c7e83a665488e0

SHA1
f29ff207db47846b98f8e689b9a767cd22810cc9

SHA256
4423c6187e23f7b2dd26284e4f8482bdaf58c533e8d3c1202452cd43dbd19477

SHA512
8c9361fb720ae16160fd9043a7403b94a9b3abaa83f20ae1f48b5646bc22ebb82219ea44b67dfeda39040f570ace1aaaffc17429b4ac28fd9a7d75843a9722ab

Download Submit
C:\Windows\System\XGUHhUo.exe

Filesize
2.2MB

MD5
f2f3891d0f09f07c5aab7738b5905e11

SHA1
f8804ecdf9a800b13842f64bdad4750a37219645

SHA256
9198e05a796cff0f2964cfe9b3668774297a5ba952ef8b2a21d45aa9ba7352d1

SHA512
5c78a3e584896c39c5bc3a7664ef47b8157c488dc977e3f0414dee42203b20556fea3adb31bc22f4374cae0a9a546ce4cf2d8ee2fbad57d3f70f3540bb569668

Download Submit
C:\Windows\System\ZbFPdGW.exe

Filesize
2.2MB

MD5
cfbc52d3ee05fe3357f6d6d331be88e5

SHA1
4ebd9ba85ff6874c8d2a4f4359d8045393086e38

SHA256
5825222635c553a36a0178eee069975e212e419befa3e7ea66ce688378414822

SHA512
27ee528fed8a412420e830d7007c0023fb07837fdc85fa25fb8d6181296ea05f00a1c3defd55f081ed08544774fd14e87508a76c9100d60b928aa1ab2b0836d5

Download Submit
C:\Windows\System\asttFNi.exe

Filesize
2.2MB

MD5
4a146c82144ffcbfaed4b751e4206bb7

SHA1
b0d2293ba9bae129bd8318529ced49db21ebccdb

SHA256
c62a59975eec91b211d8d3f4e27d87db162fb3c70b622c688f948ff076a0a69e

SHA512
2ad3cba20d32c7a39ba56d605b8e6fcbc1dd4930c079b686fce82e113357f4485785736bf89ac44a8738c2b34d2b12cd38686278fc69e418340d0725023842c4

Download Submit
C:\Windows\System\iGckFaw.exe

Filesize
2.2MB

MD5
d0e9593ab3359392985ffa8e307e4002

SHA1
ac0d6eeef03f2df4d4c708f2bae6361b2a6d404d

SHA256
2132a0bf79ff0e3540b73e223b01612ad2486a93217289c47e51a37f71d61aa1

SHA512
baceaabe4dd2e6f7842b28fa51838b765c41b03e17bab65498eba8ae79770b37bc445ced26920e4fb76f3054856be2de8363bb64325a7292f69fe602dc957601

Download Submit
C:\Windows\System\iRVzkYM.exe

Filesize
2.2MB

MD5
2b208193cacade2665c6829d0173297d

SHA1
766c9ccc1832eac43a30ef987c5d60acd648dd2a

SHA256
8d3a38387bb37249ca0750bea36f912ad8f1440ffb189d8575cfad9239f0c302

SHA512
477e9006047a7b52ecf2ebe39df6d595ed13d1bdc51d89df94aeab58a06e04b3415e77dc9b5adf5a4b2aff00efd73e270c6aea9c9b4e60c6c749518260853dd8

Download Submit
C:\Windows\System\khXCjyD.exe

Filesize
2.2MB

MD5
2a06729a65aa188e0720cf613ffe0ca6

SHA1
194a2be2eded8cb92836edd225e9880e8c4e5b00

SHA256
512da4c32678ab671ec027bf59a7f36bea8b162861df2e302b33caf9411e9601

SHA512
f6b05204754624c42ef582676bb373301473d69dbca98062e0c0eb1f6ca210d3cc37b073fff15833d1679c6b9ea658965ed7b20ab1a87b8ca1b3f8b2e26baf40

Download Submit
C:\Windows\System\lfjaGOZ.exe

Filesize
2.2MB

MD5
08b3685755b67738d5696d6a5df6c817

SHA1
1560b4bda99d092689f5987d4b67c598c8d03a4d

SHA256
ec06e460aa172aac88887595fb9d5e774d4643ec4e8d8e6b62cbaf15f176dcd0

SHA512
1b606cba9236d394a2b0e04a64f3ffbafe4bd23c2f66c3203daa2ca29a128277ddb49e260342f1ceeb749a9bd3047de3f9b79b05dbe0382cb77cfb1ec02955ae

Download Submit
C:\Windows\System\mHcMZSv.exe

Filesize
2.2MB

MD5
4c31ee44d5a3ea92172d844d0523c56c

SHA1
e6bef47e4f8f039657557b0eea96f868c515216c

SHA256
fb6813efd188637c84e9bcfac3a9795cde76f31c190055b8263d502394ac8998

SHA512
40da0618fe93a18d7fd0d53d0f539e78d1d955b66ce67fa4af0e8b2fa9bec0d8449f2955c0d7689b241fa45844d1b8220a94d07ce91d824fe12216c67c63dd5b

Download Submit
C:\Windows\System\mWBcqFq.exe

Filesize
2.2MB

MD5
0f02dc48501938ddb19a760614ecf15b

SHA1
8509a18032885527cd74022c9ee85ee74f8f1003

SHA256
d56d2cc3daabb51bda5e32abb9f08052fa19c64975faaa6ea21706761b82698b

SHA512
58f92312987637ef21d47790ce203cde2b56b4f3298d22f4e1a7ba5eb01afb802cd5676e01b36f345dc29c8da0f83beb5e93e2acc690e822904afd3bcc717331

Download Submit
C:\Windows\System\mmSoDZa.exe

Filesize
2.2MB

MD5
c10f5fa80982755baabda2e754b30a97

SHA1
864982b362920bed15eb1e46d34dd9394a0a4f6a

SHA256
96b511dfdb09982db53ac739f4b0b9209186797f2b841ae3f7ab2d5d720c31ef

SHA512
e97a5116c3ba80e3340fdf87aa68be421d98054f4e252b0eb4bd300a0e4e9baf59eebf79e2fadbc83326dfa04168e67b88be057c5d2a2cd8a083ef8d294b0cf9

Download Submit
C:\Windows\System\nHUwVuP.exe

Filesize
2.2MB

MD5
03017a1bd098f9ac22ea52d3ed5439a1

SHA1
c5bd8160eee56617353993888b090fb62e7fb30c

SHA256
f43c99ec61f67a4ff13179d763421c32075883360d14726a2a06558b2d41c31c

SHA512
633def673896fe0ecf3313ca3a54272712795ec22b2d3b4552563eebebb2b7d3709582fe008a9bb3c66cc3849b17434d0015526a82fe72d3ca66ff1e18f998d6

Download Submit
C:\Windows\System\nlFApZC.exe

Filesize
2.2MB

MD5
7d97675e3098be6b802cd46e73a5b3d5

SHA1
d55f57794959eca1d4017edba710b18e9bf10ce8

SHA256
5c40c636e0a89590f45f011a24ab6fe787358d0d089523fdfc5a0b6535fa6f0a

SHA512
735137329ddf28813ae7d6158410b369f83f24f773029e69e234b17ec31ccacda78cba499447aefa2d879f77602b1b03dac9b53ba3d82c65175e642d44e637f7

Download Submit
C:\Windows\System\oQErPYw.exe

Filesize
2.2MB

MD5
c7156514d56e2d4926379277569bb8a4

SHA1
dfda91a53804c55d6949f5d97a6ad07107cfa644

SHA256
70b4c3a6a8be19d31361cce4eaade05a37f5586678a6ca7b287903509a6f2768

SHA512
bca9b7f507d60caf19eb1f9f5af6379be19f77f3829bb3daf9f0cef800322176c9eae1e69ea16aa25d86ebc4b40f6807d9eccf4d0b790742da56a23146d4b798

Download Submit
C:\Windows\System\sGBciOE.exe

Filesize
2.2MB

MD5
b8bb0be4f911cb6bb8a7ea9ccf36a225

SHA1
4801607edc982cb08354ca9d8ac4542cfed4daaf

SHA256
caa2e9d83a229560b9c9c101ef8035396ca79f2ffd945d253e3698b63e5a1e62

SHA512
b1a36d643056c428f202c88720a683ee84bd56fd657a26b360553d663ecddbe3c26824fdfdc307cacca306b216938546a4ed97beac47ab8bc7355d36664ffe6d

Download Submit
C:\Windows\System\sZrWuBc.exe

Filesize
2.2MB

MD5
0284f987cd75f6088ed84ed295e6a5a2

SHA1
cff71a25d45a17d11d5daec62a683ab80f4b68c9

SHA256
7996ec730c0f3501a5d12cd9e8e630e8c3600902593a472c38cc188a5cc7d584

SHA512
99c981ef0c3bb94628aa2e6e409b8f922f78888c7ff9b077e1aedf20e2d0d26caebf771dd1fab56bf686464fb555db295f1492cef7fe72e20e6d1e1b9160af54

Download Submit
C:\Windows\System\tOUeqiM.exe

Filesize
2.2MB

MD5
6f424f31d0edf5cfb350f20a4f3ce2b3

SHA1
0ae52f9b2b58ca9f9304e48d80f6e2f44e2a7df8

SHA256
321fbe3dd78886f0a550ef4573efefbb256d12cf8bb9edc10249603fe6a1ac4b

SHA512
ac9776a4635c117d020076013aa09fcbdbda21eeaba55243e88186a38bb42f514a435794d95a6f01b9edfa6b6e8a226e3bcbbc8565309c81016365811c840c93

Download Submit
C:\Windows\System\tsQQdDw.exe

Filesize
2.2MB

MD5
1b338beaabd6ecf0af1c0377248003f5

SHA1
18cd49e45ac5c214e128c2bf62cc96f3baf86af1

SHA256
a5f8863278d81c8714b156cf176eaef4b1ca85860dcf9b632fbc905dcae64da5

SHA512
8db3e1a4b9cf5856a5f5c9979c776a4696372f88be294c7772061b596dee650c7b8a707bf04302ccc66a3fce4443e711bc8615a8972fdab353066077bd228d15

Download Submit
C:\Windows\System\uNKygQI.exe

Filesize
2.2MB

MD5
245792588fe7a3ce09716ee6be5f2882

SHA1
d8c89709affe9d78b3661653117ed5483081aecd

SHA256
44d1f7111680fc2781b811e1bffc97d188ab5cf933d8c99a4b07b8932dd32cc7

SHA512
c2c96ec5731069d4aaa498b1241bc1b7d8a4cce1392b0cd8088e07720b49bf3751491d820098f67ccd07f7656d1025685d880d8ebfa10b5eebd74323fe06acd0

Download Submit
C:\Windows\System\wbxuqmJ.exe

Filesize
2.2MB

MD5
b3add89ce493c338f27dc90aa8867ec0

SHA1
e987bce407df7e3e0b75808c6822ec33fa8752df

SHA256
f51f5be7f106849a3649f4329e2b3965c0f38b5e04ae11c5925cb4ceb06ddd1f

SHA512
aa6781109f8586f1457da694b0345064f87c5d37f2d6db72ba51c7a6cda5c71c6178217dbac869c8d494770d987c19cbc05f2a5763c63ecfa27ec670e96c3562

Download Submit
C:\Windows\System\xYrVela.exe

Filesize
2.2MB

MD5
0467aa944ee80741718cb419282481fc

SHA1
c84bc62b315589a6d783facfa79d2cea8879dd26

SHA256
250966264cd50d45c4de49c84a203d1c43c78dee1afab0f2b6fd3fe9949a4b26

SHA512
4a7b69741865d18131ca573ac68dd083c2ce1719173d9ffae9cfcb02e6264f3bb23465c19d73bd5e2e6e55d737b720ed350481a28feb6f33f71363772b1129d1

Download Submit
memory/100-2161-0x00007FF6FBED0000-0x00007FF6FC224000-memory.dmp

Filesize
3.3MB

Download
memory/100-160-0x00007FF6FBED0000-0x00007FF6FC224000-memory.dmp

Filesize
3.3MB

Download
memory/320-2178-0x00007FF794BF0000-0x00007FF794F44000-memory.dmp

Filesize
3.3MB

Download
memory/320-152-0x00007FF794BF0000-0x00007FF794F44000-memory.dmp

Filesize
3.3MB

Download
memory/452-2153-0x00007FF638F40000-0x00007FF639294000-memory.dmp

Filesize
3.3MB

Download
memory/452-26-0x00007FF638F40000-0x00007FF639294000-memory.dmp

Filesize
3.3MB

Download
memory/888-14-0x00007FF7069A0000-0x00007FF706CF4000-memory.dmp

Filesize
3.3MB

Download
memory/888-2154-0x00007FF7069A0000-0x00007FF706CF4000-memory.dmp

Filesize
3.3MB

Download
memory/1076-163-0x00007FF665510000-0x00007FF665864000-memory.dmp

Filesize
3.3MB

Download
memory/1076-2165-0x00007FF665510000-0x00007FF665864000-memory.dmp

Filesize
3.3MB

Download
memory/1184-2163-0x00007FF6518F0000-0x00007FF651C44000-memory.dmp

Filesize
3.3MB

Download
memory/1184-119-0x00007FF6518F0000-0x00007FF651C44000-memory.dmp

Filesize
3.3MB

Download
memory/1304-2155-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp

Filesize
3.3MB

Download
memory/1304-2150-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp

Filesize
3.3MB

Download
memory/1304-34-0x00007FF625CA0000-0x00007FF625FF4000-memory.dmp

Filesize
3.3MB

Download
memory/1352-2157-0x00007FF6E9260000-0x00007FF6E95B4000-memory.dmp

Filesize
3.3MB

Download
memory/1352-2152-0x00007FF6E9260000-0x00007FF6E95B4000-memory.dmp

Filesize
3.3MB

Download
memory/1352-116-0x00007FF6E9260000-0x00007FF6E95B4000-memory.dmp

Filesize
3.3MB

Download
memory/1496-63-0x00007FF613630000-0x00007FF613984000-memory.dmp

Filesize
3.3MB

Download
memory/1496-2159-0x00007FF613630000-0x00007FF613984000-memory.dmp

Filesize
3.3MB

Download
memory/1524-161-0x00007FF7DF9A0000-0x00007FF7DFCF4000-memory.dmp

Filesize
3.3MB

Download
memory/1524-2158-0x00007FF7DF9A0000-0x00007FF7DFCF4000-memory.dmp

Filesize
3.3MB

Download
memory/1928-1-0x0000028FDB1C0000-0x0000028FDB1D0000-memory.dmp

Filesize
64KB

Download
memory/1928-2149-0x00007FF613A10000-0x00007FF613D64000-memory.dmp

Filesize
3.3MB

Download
memory/1928-0-0x00007FF613A10000-0x00007FF613D64000-memory.dmp

Filesize
3.3MB

Download
memory/2204-2179-0x00007FF7DBA90000-0x00007FF7DBDE4000-memory.dmp

Filesize
3.3MB

Download
memory/2204-151-0x00007FF7DBA90000-0x00007FF7DBDE4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-149-0x00007FF60AFC0000-0x00007FF60B314000-memory.dmp

Filesize
3.3MB

Download
memory/2288-2176-0x00007FF60AFC0000-0x00007FF60B314000-memory.dmp

Filesize
3.3MB

Download
memory/2568-2166-0x00007FF69D490000-0x00007FF69D7E4000-memory.dmp

Filesize
3.3MB

Download
memory/2568-131-0x00007FF69D490000-0x00007FF69D7E4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-208-0x00007FF7C7E30000-0x00007FF7C8184000-memory.dmp

Filesize
3.3MB

Download
memory/2652-2180-0x00007FF7C7E30000-0x00007FF7C8184000-memory.dmp

Filesize
3.3MB

Download
memory/2692-2167-0x00007FF68D550000-0x00007FF68D8A4000-memory.dmp

Filesize
3.3MB

Download
memory/2692-162-0x00007FF68D550000-0x00007FF68D8A4000-memory.dmp

Filesize
3.3MB

Download
memory/2900-150-0x00007FF6DB260000-0x00007FF6DB5B4000-memory.dmp

Filesize
3.3MB

Download
memory/2900-2169-0x00007FF6DB260000-0x00007FF6DB5B4000-memory.dmp

Filesize
3.3MB

Download
memory/3592-2160-0x00007FF7AACF0000-0x00007FF7AB044000-memory.dmp

Filesize
3.3MB

Download
memory/3592-74-0x00007FF7AACF0000-0x00007FF7AB044000-memory.dmp

Filesize
3.3MB

Download
memory/3680-157-0x00007FF7C9D70000-0x00007FF7CA0C4000-memory.dmp

Filesize
3.3MB

Download
memory/3680-2171-0x00007FF7C9D70000-0x00007FF7CA0C4000-memory.dmp

Filesize
3.3MB

Download
memory/3784-156-0x00007FF6E9140000-0x00007FF6E9494000-memory.dmp

Filesize
3.3MB

Download
memory/3784-2172-0x00007FF6E9140000-0x00007FF6E9494000-memory.dmp

Filesize
3.3MB

Download
memory/3872-58-0x00007FF678E10000-0x00007FF679164000-memory.dmp

Filesize
3.3MB

Download
memory/3872-2151-0x00007FF678E10000-0x00007FF679164000-memory.dmp

Filesize
3.3MB

Download
memory/3872-2164-0x00007FF678E10000-0x00007FF679164000-memory.dmp

Filesize
3.3MB

Download
memory/4040-136-0x00007FF631750000-0x00007FF631AA4000-memory.dmp

Filesize
3.3MB

Download
memory/4040-2170-0x00007FF631750000-0x00007FF631AA4000-memory.dmp

Filesize
3.3MB

Download
memory/4048-2177-0x00007FF6DF150000-0x00007FF6DF4A4000-memory.dmp

Filesize
3.3MB

Download
memory/4048-153-0x00007FF6DF150000-0x00007FF6DF4A4000-memory.dmp

Filesize
3.3MB

Download
memory/4088-2156-0x00007FF7CE630000-0x00007FF7CE984000-memory.dmp

Filesize
3.3MB

Download
memory/4088-158-0x00007FF7CE630000-0x00007FF7CE984000-memory.dmp

Filesize
3.3MB

Download
memory/4264-2181-0x00007FF65EA40000-0x00007FF65ED94000-memory.dmp

Filesize
3.3MB

Download
memory/4264-211-0x00007FF65EA40000-0x00007FF65ED94000-memory.dmp

Filesize
3.3MB

Download
memory/4336-2174-0x00007FF65A210000-0x00007FF65A564000-memory.dmp

Filesize
3.3MB

Download
memory/4336-154-0x00007FF65A210000-0x00007FF65A564000-memory.dmp

Filesize
3.3MB

Download
memory/4416-164-0x00007FF7B11A0000-0x00007FF7B14F4000-memory.dmp

Filesize
3.3MB

Download
memory/4416-2175-0x00007FF7B11A0000-0x00007FF7B14F4000-memory.dmp

Filesize
3.3MB

Download
memory/4496-2173-0x00007FF6A0E30000-0x00007FF6A1184000-memory.dmp

Filesize
3.3MB

Download
memory/4496-155-0x00007FF6A0E30000-0x00007FF6A1184000-memory.dmp

Filesize
3.3MB

Download
memory/5044-2168-0x00007FF78DC80000-0x00007FF78DFD4000-memory.dmp

Filesize
3.3MB

Download
memory/5044-159-0x00007FF78DC80000-0x00007FF78DFD4000-memory.dmp

Filesize
3.3MB

Download
memory/5064-2162-0x00007FF652A40000-0x00007FF652D94000-memory.dmp

Filesize
3.3MB

Download
memory/5064-86-0x00007FF652A40000-0x00007FF652D94000-memory.dmp

Filesize
3.3MB

Download