xmrig | 09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
Size

1.5MB
MD5

28ee700f85f8f9d42b6ddb75c2bfca80
SHA1

4962dbd5af354e12f065b29edfcb18dde271c2cc
SHA256

09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680
SHA512

4f932ea99d9ba6ba5971ab72341f5fa609d8003f4b12de6ae43aeb0008fcc314e37ab8b656691dda6ac89b5d630b9495a08e7f66fa0f655320b51161bb824b0a
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pY4p9XvOjeUlV/oPVHsv4TuUgGqj15G+y:ROdWCCi7/rahoyS6SHb8GSxy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral2/memory/5112-265-0x00007FF7D1870000-0x00007FF7D1BC1000-memory.dmp	xmrig
behavioral2/memory/1584-331-0x00007FF728590000-0x00007FF7288E1000-memory.dmp	xmrig
behavioral2/memory/2316-427-0x00007FF6C1AD0000-0x00007FF6C1E21000-memory.dmp	xmrig
behavioral2/memory/4544-722-0x00007FF7D1FC0000-0x00007FF7D2311000-memory.dmp	xmrig
behavioral2/memory/4840-826-0x00007FF6E0160000-0x00007FF6E04B1000-memory.dmp	xmrig
behavioral2/memory/4628-823-0x00007FF6F7A40000-0x00007FF6F7D91000-memory.dmp	xmrig
behavioral2/memory/3128-721-0x00007FF7AF300000-0x00007FF7AF651000-memory.dmp	xmrig
behavioral2/memory/4448-649-0x00007FF709070000-0x00007FF7093C1000-memory.dmp	xmrig
behavioral2/memory/3208-648-0x00007FF6F9180000-0x00007FF6F94D1000-memory.dmp	xmrig
behavioral2/memory/1316-915-0x00007FF730480000-0x00007FF7307D1000-memory.dmp	xmrig
behavioral2/memory/4380-913-0x00007FF78F8A0000-0x00007FF78FBF1000-memory.dmp	xmrig
behavioral2/memory/696-908-0x00007FF77CC40000-0x00007FF77CF91000-memory.dmp	xmrig
behavioral2/memory/1712-934-0x00007FF754CE0000-0x00007FF755031000-memory.dmp	xmrig
behavioral2/memory/3840-933-0x00007FF659600000-0x00007FF659951000-memory.dmp	xmrig
behavioral2/memory/4224-534-0x00007FF768B80000-0x00007FF768ED1000-memory.dmp	xmrig
behavioral2/memory/4120-513-0x00007FF7E20B0000-0x00007FF7E2401000-memory.dmp	xmrig
behavioral2/memory/2932-423-0x00007FF6F81D0000-0x00007FF6F8521000-memory.dmp	xmrig
behavioral2/memory/4592-327-0x00007FF744D50000-0x00007FF7450A1000-memory.dmp	xmrig
behavioral2/memory/4508-262-0x00007FF7DD7F0000-0x00007FF7DDB41000-memory.dmp	xmrig
behavioral2/memory/1680-212-0x00007FF6F49F0000-0x00007FF6F4D41000-memory.dmp	xmrig
behavioral2/memory/4424-163-0x00007FF6F86E0000-0x00007FF6F8A31000-memory.dmp	xmrig
behavioral2/memory/4008-108-0x00007FF79BC00000-0x00007FF79BF51000-memory.dmp	xmrig
behavioral2/memory/3536-44-0x00007FF6857D0000-0x00007FF685B21000-memory.dmp	xmrig
behavioral2/memory/4356-19-0x00007FF71D0F0000-0x00007FF71D441000-memory.dmp	xmrig
behavioral2/memory/640-2629-0x00007FF7E6180000-0x00007FF7E64D1000-memory.dmp	xmrig
behavioral2/memory/4236-2729-0x00007FF6DC2B0000-0x00007FF6DC601000-memory.dmp	xmrig
behavioral2/memory/2780-2730-0x00007FF627200000-0x00007FF627551000-memory.dmp	xmrig
behavioral2/memory/1492-2731-0x00007FF6EAF30000-0x00007FF6EB281000-memory.dmp	xmrig
behavioral2/memory/548-2764-0x00007FF742540000-0x00007FF742891000-memory.dmp	xmrig
behavioral2/memory/2544-2765-0x00007FF626920000-0x00007FF626C71000-memory.dmp	xmrig
behavioral2/memory/4424-2766-0x00007FF6F86E0000-0x00007FF6F8A31000-memory.dmp	xmrig
behavioral2/memory/4356-2768-0x00007FF71D0F0000-0x00007FF71D441000-memory.dmp	xmrig
behavioral2/memory/3536-2775-0x00007FF6857D0000-0x00007FF685B21000-memory.dmp	xmrig
behavioral2/memory/4236-2776-0x00007FF6DC2B0000-0x00007FF6DC601000-memory.dmp	xmrig
behavioral2/memory/2780-2779-0x00007FF627200000-0x00007FF627551000-memory.dmp	xmrig
behavioral2/memory/4008-2780-0x00007FF79BC00000-0x00007FF79BF51000-memory.dmp	xmrig
behavioral2/memory/1584-2782-0x00007FF728590000-0x00007FF7288E1000-memory.dmp	xmrig
behavioral2/memory/4380-2784-0x00007FF78F8A0000-0x00007FF78FBF1000-memory.dmp	xmrig
behavioral2/memory/1492-2795-0x00007FF6EAF30000-0x00007FF6EB281000-memory.dmp	xmrig
behavioral2/memory/2316-2796-0x00007FF6C1AD0000-0x00007FF6C1E21000-memory.dmp	xmrig
behavioral2/memory/4224-2809-0x00007FF768B80000-0x00007FF768ED1000-memory.dmp	xmrig
behavioral2/memory/2544-2814-0x00007FF626920000-0x00007FF626C71000-memory.dmp	xmrig
behavioral2/memory/696-2815-0x00007FF77CC40000-0x00007FF77CF91000-memory.dmp	xmrig
behavioral2/memory/1680-2811-0x00007FF6F49F0000-0x00007FF6F4D41000-memory.dmp	xmrig
behavioral2/memory/4120-2808-0x00007FF7E20B0000-0x00007FF7E2401000-memory.dmp	xmrig
behavioral2/memory/2932-2805-0x00007FF6F81D0000-0x00007FF6F8521000-memory.dmp	xmrig
behavioral2/memory/4508-2804-0x00007FF7DD7F0000-0x00007FF7DDB41000-memory.dmp	xmrig
behavioral2/memory/4424-2800-0x00007FF6F86E0000-0x00007FF6F8A31000-memory.dmp	xmrig
behavioral2/memory/3840-2793-0x00007FF659600000-0x00007FF659951000-memory.dmp	xmrig
behavioral2/memory/1316-2791-0x00007FF730480000-0x00007FF7307D1000-memory.dmp	xmrig
behavioral2/memory/4592-2788-0x00007FF744D50000-0x00007FF7450A1000-memory.dmp	xmrig
behavioral2/memory/548-2799-0x00007FF742540000-0x00007FF742891000-memory.dmp	xmrig
behavioral2/memory/5112-2787-0x00007FF7D1870000-0x00007FF7D1BC1000-memory.dmp	xmrig
behavioral2/memory/4840-2852-0x00007FF6E0160000-0x00007FF6E04B1000-memory.dmp	xmrig
behavioral2/memory/4448-2850-0x00007FF709070000-0x00007FF7093C1000-memory.dmp	xmrig
behavioral2/memory/4628-2862-0x00007FF6F7A40000-0x00007FF6F7D91000-memory.dmp	xmrig
behavioral2/memory/4544-2843-0x00007FF7D1FC0000-0x00007FF7D2311000-memory.dmp	xmrig
behavioral2/memory/3128-2842-0x00007FF7AF300000-0x00007FF7AF651000-memory.dmp	xmrig
behavioral2/memory/1712-2837-0x00007FF754CE0000-0x00007FF755031000-memory.dmp	xmrig
behavioral2/memory/3208-2835-0x00007FF6F9180000-0x00007FF6F94D1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4356	fSojkQm.exe
3536	lUUZYsF.exe
4236	Xwpffgo.exe
4380	OkOrTyI.exe
548	YpHKMbg.exe
2780	VYMwfmm.exe
2544	TWMSylz.exe
4008	kDegNUb.exe
1316	RGIPJec.exe
1492	XROmFNo.exe
4424	GapaELG.exe
1680	GgTzKqU.exe
4508	BYwpItl.exe
5112	YfHefDY.exe
4592	uPsEetl.exe
3840	gvKKLsK.exe
1584	LCdqLDk.exe
2932	zmZkHqy.exe
2316	YWfzdpG.exe
4120	bUCZvDZ.exe
4224	caLHbhO.exe
1712	ljmdWSJ.exe
3208	LMQIWPi.exe
4448	iApqeVS.exe
3128	JauCnFM.exe
4544	lOaOPxZ.exe
4628	DSwLktA.exe
4840	fLhvuun.exe
696	UjdQbAv.exe
904	wLPHzvY.exe
840	VSOpOSI.exe
1128	ZWRnWij.exe
3612	SRDqxSV.exe
2044	jpcumWS.exe
5036	XsrPMjT.exe
4192	SGPjSjk.exe
4768	EfeHUff.exe
1012	wKuGTjA.exe
1544	HgKFlKn.exe
4800	vXKoBYq.exe
2920	beNdHuJ.exe
4836	QUZlopb.exe
4936	HCEUSue.exe
3240	Xsoyigy.exe
2292	JeTneVS.exe
2212	pvDdydv.exe
1020	wYDNNXu.exe
3660	vxyZjBA.exe
3236	lwxaccs.exe
1672	RJngbry.exe
3108	WNFtnCo.exe
4536	xSEXPMf.exe
5016	QWuUUgc.exe
740	mkKLeuY.exe
1184	VGYbDYu.exe
3312	YTZOKjT.exe
4780	KGIKLqW.exe
1784	jILXawb.exe
1760	efxDIFj.exe
1984	OmwUCEI.exe
4568	hoUkBns.exe
2644	kQKgQOy.exe
2320	TKcqFvG.exe
3932	LvmGYgI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/640-0-0x00007FF7E6180000-0x00007FF7E64D1000-memory.dmp	upx
behavioral2/files/0x000a000000023528-5.dat	upx
behavioral2/files/0x000700000002356e-9.dat	upx
behavioral2/memory/2780-60-0x00007FF627200000-0x00007FF627551000-memory.dmp	upx
behavioral2/files/0x000700000002357d-178.dat	upx
behavioral2/memory/5112-265-0x00007FF7D1870000-0x00007FF7D1BC1000-memory.dmp	upx
behavioral2/memory/1584-331-0x00007FF728590000-0x00007FF7288E1000-memory.dmp	upx
behavioral2/memory/2316-427-0x00007FF6C1AD0000-0x00007FF6C1E21000-memory.dmp	upx
behavioral2/memory/4544-722-0x00007FF7D1FC0000-0x00007FF7D2311000-memory.dmp	upx
behavioral2/memory/4840-826-0x00007FF6E0160000-0x00007FF6E04B1000-memory.dmp	upx
behavioral2/memory/4628-823-0x00007FF6F7A40000-0x00007FF6F7D91000-memory.dmp	upx
behavioral2/memory/3128-721-0x00007FF7AF300000-0x00007FF7AF651000-memory.dmp	upx
behavioral2/memory/4448-649-0x00007FF709070000-0x00007FF7093C1000-memory.dmp	upx
behavioral2/memory/3208-648-0x00007FF6F9180000-0x00007FF6F94D1000-memory.dmp	upx
behavioral2/memory/1316-915-0x00007FF730480000-0x00007FF7307D1000-memory.dmp	upx
behavioral2/memory/4380-913-0x00007FF78F8A0000-0x00007FF78FBF1000-memory.dmp	upx
behavioral2/memory/696-908-0x00007FF77CC40000-0x00007FF77CF91000-memory.dmp	upx
behavioral2/memory/1712-934-0x00007FF754CE0000-0x00007FF755031000-memory.dmp	upx
behavioral2/memory/3840-933-0x00007FF659600000-0x00007FF659951000-memory.dmp	upx
behavioral2/memory/4224-534-0x00007FF768B80000-0x00007FF768ED1000-memory.dmp	upx
behavioral2/memory/4120-513-0x00007FF7E20B0000-0x00007FF7E2401000-memory.dmp	upx
behavioral2/memory/2932-423-0x00007FF6F81D0000-0x00007FF6F8521000-memory.dmp	upx
behavioral2/memory/4592-327-0x00007FF744D50000-0x00007FF7450A1000-memory.dmp	upx
behavioral2/memory/4508-262-0x00007FF7DD7F0000-0x00007FF7DDB41000-memory.dmp	upx
behavioral2/files/0x0007000000023595-199.dat	upx
behavioral2/files/0x000700000002358b-197.dat	upx
behavioral2/files/0x0007000000023594-195.dat	upx
behavioral2/files/0x0007000000023593-194.dat	upx
behavioral2/files/0x0007000000023589-193.dat	upx
behavioral2/files/0x0007000000023592-190.dat	upx
behavioral2/files/0x0007000000023580-186.dat	upx
behavioral2/files/0x000700000002357f-182.dat	upx
behavioral2/files/0x0007000000023591-181.dat	upx
behavioral2/files/0x0007000000023590-180.dat	upx
behavioral2/files/0x000700000002358f-177.dat	upx
behavioral2/files/0x0007000000023581-172.dat	upx
behavioral2/files/0x000700000002358e-168.dat	upx
behavioral2/memory/1680-212-0x00007FF6F49F0000-0x00007FF6F4D41000-memory.dmp	upx
behavioral2/memory/1492-154-0x00007FF6EAF30000-0x00007FF6EB281000-memory.dmp	upx
behavioral2/files/0x0007000000023577-151.dat	upx
behavioral2/files/0x000700000002358a-150.dat	upx
behavioral2/files/0x0007000000023587-140.dat	upx
behavioral2/files/0x0007000000023586-139.dat	upx
behavioral2/files/0x0007000000023585-137.dat	upx
behavioral2/files/0x0007000000023584-131.dat	upx
behavioral2/files/0x000700000002357b-129.dat	upx
behavioral2/files/0x0007000000023583-128.dat	upx
behavioral2/files/0x0007000000023578-123.dat	upx
behavioral2/memory/4424-163-0x00007FF6F86E0000-0x00007FF6F8A31000-memory.dmp	upx
behavioral2/files/0x000700000002358d-162.dat	upx
behavioral2/files/0x0007000000023573-112.dat	upx
behavioral2/files/0x0007000000023572-106.dat	upx
behavioral2/files/0x0007000000023575-103.dat	upx
behavioral2/files/0x0007000000023588-141.dat	upx
behavioral2/files/0x0007000000023570-95.dat	upx
behavioral2/files/0x000700000002357e-93.dat	upx
behavioral2/files/0x000700000002357c-86.dat	upx
behavioral2/files/0x0007000000023582-126.dat	upx
behavioral2/files/0x000700000002357a-122.dat	upx
behavioral2/files/0x0007000000023579-121.dat	upx
behavioral2/files/0x0007000000023576-115.dat	upx
behavioral2/memory/4008-108-0x00007FF79BC00000-0x00007FF79BF51000-memory.dmp	upx
behavioral2/memory/2544-71-0x00007FF626920000-0x00007FF626C71000-memory.dmp	upx
behavioral2/files/0x0007000000023571-70.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mGzXpIo.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\LMQIWPi.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\fqhxBBc.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\UBermvg.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\EdxBYFC.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\IlmvvIQ.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\Xsoyigy.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\cqSKqOk.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\ELsDYjS.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\ETfoToS.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\xddrYoh.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\KaqEIlf.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\Uidustv.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\HbyXIRP.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\edtsUKp.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\qjXJUtD.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\xfnMGoW.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\jMSFceY.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\IQmUoTZ.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\letyeVc.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\dLuzWYV.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\YlbGPQX.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\apxJCXc.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\zpEqKHC.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\jLsOeNr.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\FJHfvEc.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\fRSwDfK.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\vuLcMyl.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\jILXawb.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\onmuTBH.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\FgRGYDg.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\RkibAmC.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\skXxHmn.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\OjkVnGi.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\FwYsCkq.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\FqHbUKO.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\HQrMkvM.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\USkzwyD.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\bKpdFSJ.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\fdtERwn.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\ZYsFygA.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\QNCDKKm.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\cmNDQiY.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\fxVkjTO.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\mfcoXwb.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\KEXxqSc.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\LzKStIR.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\TyprbAn.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\WVvnMJt.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\Yqlaqav.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\YfHefDY.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\EbJdAiN.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\wOilYEb.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\ODjUeZX.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\hJNiplg.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\jBdoLYN.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\WZiyxQG.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\uUHuhmm.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\gAuOmTJ.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\ubpQxJK.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\GzjMHIv.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\fuwcjRj.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\DHKQkUt.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\HCEUSue.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4356	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	83
PID 640 wrote to memory of 4356	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	83
PID 640 wrote to memory of 3536	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	84
PID 640 wrote to memory of 3536	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	84
PID 640 wrote to memory of 4236	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	85
PID 640 wrote to memory of 4236	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	85
PID 640 wrote to memory of 4380	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	86
PID 640 wrote to memory of 4380	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	86
PID 640 wrote to memory of 548	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	87
PID 640 wrote to memory of 548	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	87
PID 640 wrote to memory of 2780	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	88
PID 640 wrote to memory of 2780	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	88
PID 640 wrote to memory of 2544	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	89
PID 640 wrote to memory of 2544	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	89
PID 640 wrote to memory of 1492	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	90
PID 640 wrote to memory of 1492	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	90
PID 640 wrote to memory of 4008	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	91
PID 640 wrote to memory of 4008	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	91
PID 640 wrote to memory of 1316	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	92
PID 640 wrote to memory of 1316	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	92
PID 640 wrote to memory of 4424	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	93
PID 640 wrote to memory of 4424	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	93
PID 640 wrote to memory of 1680	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	94
PID 640 wrote to memory of 1680	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	94
PID 640 wrote to memory of 4508	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	95
PID 640 wrote to memory of 4508	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	95
PID 640 wrote to memory of 5112	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	96
PID 640 wrote to memory of 5112	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	96
PID 640 wrote to memory of 4592	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	97
PID 640 wrote to memory of 4592	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	97
PID 640 wrote to memory of 3840	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	98
PID 640 wrote to memory of 3840	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	98
PID 640 wrote to memory of 1584	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	99
PID 640 wrote to memory of 1584	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	99
PID 640 wrote to memory of 2932	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	100
PID 640 wrote to memory of 2932	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	100
PID 640 wrote to memory of 2316	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	101
PID 640 wrote to memory of 2316	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	101
PID 640 wrote to memory of 4120	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	102
PID 640 wrote to memory of 4120	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	102
PID 640 wrote to memory of 4224	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	103
PID 640 wrote to memory of 4224	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	103
PID 640 wrote to memory of 3612	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	104
PID 640 wrote to memory of 3612	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	104
PID 640 wrote to memory of 1712	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	105
PID 640 wrote to memory of 1712	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	105
PID 640 wrote to memory of 3208	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	106
PID 640 wrote to memory of 3208	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	106
PID 640 wrote to memory of 4448	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	107
PID 640 wrote to memory of 4448	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	107
PID 640 wrote to memory of 3128	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	108
PID 640 wrote to memory of 3128	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	108
PID 640 wrote to memory of 4544	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	109
PID 640 wrote to memory of 4544	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	109
PID 640 wrote to memory of 4628	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	110
PID 640 wrote to memory of 4628	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	110
PID 640 wrote to memory of 4840	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	111
PID 640 wrote to memory of 4840	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	111
PID 640 wrote to memory of 696	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	112
PID 640 wrote to memory of 696	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	112
PID 640 wrote to memory of 904	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	113
PID 640 wrote to memory of 904	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	113
PID 640 wrote to memory of 4800	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	114
PID 640 wrote to memory of 4800	640	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\System\fSojkQm.exe
  C:\Windows\System\fSojkQm.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\lUUZYsF.exe
  C:\Windows\System\lUUZYsF.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\Xwpffgo.exe
  C:\Windows\System\Xwpffgo.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\OkOrTyI.exe
  C:\Windows\System\OkOrTyI.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\YpHKMbg.exe
  C:\Windows\System\YpHKMbg.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\VYMwfmm.exe
  C:\Windows\System\VYMwfmm.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\TWMSylz.exe
  C:\Windows\System\TWMSylz.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\XROmFNo.exe
  C:\Windows\System\XROmFNo.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\kDegNUb.exe
  C:\Windows\System\kDegNUb.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\RGIPJec.exe
  C:\Windows\System\RGIPJec.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\GapaELG.exe
  C:\Windows\System\GapaELG.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\GgTzKqU.exe
  C:\Windows\System\GgTzKqU.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\BYwpItl.exe
  C:\Windows\System\BYwpItl.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\YfHefDY.exe
  C:\Windows\System\YfHefDY.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\uPsEetl.exe
  C:\Windows\System\uPsEetl.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\gvKKLsK.exe
  C:\Windows\System\gvKKLsK.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\LCdqLDk.exe
  C:\Windows\System\LCdqLDk.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\zmZkHqy.exe
  C:\Windows\System\zmZkHqy.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\YWfzdpG.exe
  C:\Windows\System\YWfzdpG.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\bUCZvDZ.exe
  C:\Windows\System\bUCZvDZ.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\caLHbhO.exe
  C:\Windows\System\caLHbhO.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\SRDqxSV.exe
  C:\Windows\System\SRDqxSV.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ljmdWSJ.exe
  C:\Windows\System\ljmdWSJ.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\LMQIWPi.exe
  C:\Windows\System\LMQIWPi.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\iApqeVS.exe
  C:\Windows\System\iApqeVS.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\JauCnFM.exe
  C:\Windows\System\JauCnFM.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\lOaOPxZ.exe
  C:\Windows\System\lOaOPxZ.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\DSwLktA.exe
  C:\Windows\System\DSwLktA.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\fLhvuun.exe
  C:\Windows\System\fLhvuun.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\UjdQbAv.exe
  C:\Windows\System\UjdQbAv.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\wLPHzvY.exe
  C:\Windows\System\wLPHzvY.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\vXKoBYq.exe
  C:\Windows\System\vXKoBYq.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\Xsoyigy.exe
  C:\Windows\System\Xsoyigy.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\VSOpOSI.exe
  C:\Windows\System\VSOpOSI.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\ZWRnWij.exe
  C:\Windows\System\ZWRnWij.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\jpcumWS.exe
  C:\Windows\System\jpcumWS.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\XsrPMjT.exe
  C:\Windows\System\XsrPMjT.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\SGPjSjk.exe
  C:\Windows\System\SGPjSjk.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\EfeHUff.exe
  C:\Windows\System\EfeHUff.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\wKuGTjA.exe
  C:\Windows\System\wKuGTjA.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\HgKFlKn.exe
  C:\Windows\System\HgKFlKn.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\beNdHuJ.exe
  C:\Windows\System\beNdHuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\QUZlopb.exe
  C:\Windows\System\QUZlopb.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\HCEUSue.exe
  C:\Windows\System\HCEUSue.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\JeTneVS.exe
  C:\Windows\System\JeTneVS.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\pvDdydv.exe
  C:\Windows\System\pvDdydv.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\wYDNNXu.exe
  C:\Windows\System\wYDNNXu.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\vxyZjBA.exe
  C:\Windows\System\vxyZjBA.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\lwxaccs.exe
  C:\Windows\System\lwxaccs.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\RJngbry.exe
  C:\Windows\System\RJngbry.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\zaNooqm.exe
  C:\Windows\System\zaNooqm.exe
  2⤵
  PID:4196
- C:\Windows\System\WNFtnCo.exe
  C:\Windows\System\WNFtnCo.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\xSEXPMf.exe
  C:\Windows\System\xSEXPMf.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\QWuUUgc.exe
  C:\Windows\System\QWuUUgc.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\mkKLeuY.exe
  C:\Windows\System\mkKLeuY.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\VGYbDYu.exe
  C:\Windows\System\VGYbDYu.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\YTZOKjT.exe
  C:\Windows\System\YTZOKjT.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\KGIKLqW.exe
  C:\Windows\System\KGIKLqW.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\jILXawb.exe
  C:\Windows\System\jILXawb.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\efxDIFj.exe
  C:\Windows\System\efxDIFj.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\OmwUCEI.exe
  C:\Windows\System\OmwUCEI.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\hoUkBns.exe
  C:\Windows\System\hoUkBns.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\kQKgQOy.exe
  C:\Windows\System\kQKgQOy.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\TKcqFvG.exe
  C:\Windows\System\TKcqFvG.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\LvmGYgI.exe
  C:\Windows\System\LvmGYgI.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\cQpNVxK.exe
  C:\Windows\System\cQpNVxK.exe
  2⤵
  PID:212
- C:\Windows\System\vPPkjRI.exe
  C:\Windows\System\vPPkjRI.exe
  2⤵
  PID:812
- C:\Windows\System\DyyjaOm.exe
  C:\Windows\System\DyyjaOm.exe
  2⤵
  PID:456
- C:\Windows\System\OCnHNJj.exe
  C:\Windows\System\OCnHNJj.exe
  2⤵
  PID:1988
- C:\Windows\System\WhAmqAQ.exe
  C:\Windows\System\WhAmqAQ.exe
  2⤵
  PID:1428
- C:\Windows\System\sXjFZMM.exe
  C:\Windows\System\sXjFZMM.exe
  2⤵
  PID:4352
- C:\Windows\System\UoqXoSH.exe
  C:\Windows\System\UoqXoSH.exe
  2⤵
  PID:3300
- C:\Windows\System\XSwYfox.exe
  C:\Windows\System\XSwYfox.exe
  2⤵
  PID:4000
- C:\Windows\System\lqJINFV.exe
  C:\Windows\System\lqJINFV.exe
  2⤵
  PID:452
- C:\Windows\System\xhhTJgs.exe
  C:\Windows\System\xhhTJgs.exe
  2⤵
  PID:2768
- C:\Windows\System\nIYHENs.exe
  C:\Windows\System\nIYHENs.exe
  2⤵
  PID:3940
- C:\Windows\System\iDEMwLp.exe
  C:\Windows\System\iDEMwLp.exe
  2⤵
  PID:4232
- C:\Windows\System\HVKnnXc.exe
  C:\Windows\System\HVKnnXc.exe
  2⤵
  PID:1864
- C:\Windows\System\oYBGJOr.exe
  C:\Windows\System\oYBGJOr.exe
  2⤵
  PID:2296
- C:\Windows\System\zoNxKAR.exe
  C:\Windows\System\zoNxKAR.exe
  2⤵
  PID:1196
- C:\Windows\System\EpsgkUg.exe
  C:\Windows\System\EpsgkUg.exe
  2⤵
  PID:5052
- C:\Windows\System\SCAGCDG.exe
  C:\Windows\System\SCAGCDG.exe
  2⤵
  PID:1940
- C:\Windows\System\nMaLdfT.exe
  C:\Windows\System\nMaLdfT.exe
  2⤵
  PID:3568
- C:\Windows\System\SOKRZmn.exe
  C:\Windows\System\SOKRZmn.exe
  2⤵
  PID:5000
- C:\Windows\System\HyEgxmO.exe
  C:\Windows\System\HyEgxmO.exe
  2⤵
  PID:3960
- C:\Windows\System\gbRWtsh.exe
  C:\Windows\System\gbRWtsh.exe
  2⤵
  PID:5136
- C:\Windows\System\IXUXfrd.exe
  C:\Windows\System\IXUXfrd.exe
  2⤵
  PID:5160
- C:\Windows\System\GXWabLX.exe
  C:\Windows\System\GXWabLX.exe
  2⤵
  PID:5180
- C:\Windows\System\faZWVfv.exe
  C:\Windows\System\faZWVfv.exe
  2⤵
  PID:5200
- C:\Windows\System\LcOcKsZ.exe
  C:\Windows\System\LcOcKsZ.exe
  2⤵
  PID:5220
- C:\Windows\System\TjaMLbM.exe
  C:\Windows\System\TjaMLbM.exe
  2⤵
  PID:5244
- C:\Windows\System\muoSUlX.exe
  C:\Windows\System\muoSUlX.exe
  2⤵
  PID:5264
- C:\Windows\System\kPTrxjF.exe
  C:\Windows\System\kPTrxjF.exe
  2⤵
  PID:5284
- C:\Windows\System\cNXRRiG.exe
  C:\Windows\System\cNXRRiG.exe
  2⤵
  PID:5308
- C:\Windows\System\DPKvOVB.exe
  C:\Windows\System\DPKvOVB.exe
  2⤵
  PID:5328
- C:\Windows\System\uUHuhmm.exe
  C:\Windows\System\uUHuhmm.exe
  2⤵
  PID:5352
- C:\Windows\System\eGwYGEO.exe
  C:\Windows\System\eGwYGEO.exe
  2⤵
  PID:5368
- C:\Windows\System\LBCRMjh.exe
  C:\Windows\System\LBCRMjh.exe
  2⤵
  PID:5404
- C:\Windows\System\lpvEIeY.exe
  C:\Windows\System\lpvEIeY.exe
  2⤵
  PID:5424
- C:\Windows\System\zwCUxFH.exe
  C:\Windows\System\zwCUxFH.exe
  2⤵
  PID:5440
- C:\Windows\System\USsJAEM.exe
  C:\Windows\System\USsJAEM.exe
  2⤵
  PID:5456
- C:\Windows\System\SsCvOwV.exe
  C:\Windows\System\SsCvOwV.exe
  2⤵
  PID:5476
- C:\Windows\System\TUBCJPt.exe
  C:\Windows\System\TUBCJPt.exe
  2⤵
  PID:5496
- C:\Windows\System\ukNiMkS.exe
  C:\Windows\System\ukNiMkS.exe
  2⤵
  PID:5516
- C:\Windows\System\jnzhJfZ.exe
  C:\Windows\System\jnzhJfZ.exe
  2⤵
  PID:5540
- C:\Windows\System\BrjrGfg.exe
  C:\Windows\System\BrjrGfg.exe
  2⤵
  PID:5940
- C:\Windows\System\VNazBwr.exe
  C:\Windows\System\VNazBwr.exe
  2⤵
  PID:6012
- C:\Windows\System\VOtVZmy.exe
  C:\Windows\System\VOtVZmy.exe
  2⤵
  PID:6032
- C:\Windows\System\WwfFoje.exe
  C:\Windows\System\WwfFoje.exe
  2⤵
  PID:6048
- C:\Windows\System\SRegoaA.exe
  C:\Windows\System\SRegoaA.exe
  2⤵
  PID:6068
- C:\Windows\System\GoGtnLk.exe
  C:\Windows\System\GoGtnLk.exe
  2⤵
  PID:6084
- C:\Windows\System\rPOtBip.exe
  C:\Windows\System\rPOtBip.exe
  2⤵
  PID:6108
- C:\Windows\System\VYaCOgD.exe
  C:\Windows\System\VYaCOgD.exe
  2⤵
  PID:6128
- C:\Windows\System\ZpVJLjG.exe
  C:\Windows\System\ZpVJLjG.exe
  2⤵
  PID:2736
- C:\Windows\System\yAzLBkY.exe
  C:\Windows\System\yAzLBkY.exe
  2⤵
  PID:1268
- C:\Windows\System\VhvwtbG.exe
  C:\Windows\System\VhvwtbG.exe
  2⤵
  PID:4436
- C:\Windows\System\yXWlMah.exe
  C:\Windows\System\yXWlMah.exe
  2⤵
  PID:2120
- C:\Windows\System\ZDnzFxu.exe
  C:\Windows\System\ZDnzFxu.exe
  2⤵
  PID:4852
- C:\Windows\System\vsstiwV.exe
  C:\Windows\System\vsstiwV.exe
  2⤵
  PID:2900
- C:\Windows\System\HNtEJAn.exe
  C:\Windows\System\HNtEJAn.exe
  2⤵
  PID:4044
- C:\Windows\System\KlNCsiU.exe
  C:\Windows\System\KlNCsiU.exe
  2⤵
  PID:1080
- C:\Windows\System\CwZplzl.exe
  C:\Windows\System\CwZplzl.exe
  2⤵
  PID:4248
- C:\Windows\System\jKfmlMD.exe
  C:\Windows\System\jKfmlMD.exe
  2⤵
  PID:2528
- C:\Windows\System\aeFbNLS.exe
  C:\Windows\System\aeFbNLS.exe
  2⤵
  PID:464
- C:\Windows\System\QNCDKKm.exe
  C:\Windows\System\QNCDKKm.exe
  2⤵
  PID:1936
- C:\Windows\System\jVSyRut.exe
  C:\Windows\System\jVSyRut.exe
  2⤵
  PID:4328
- C:\Windows\System\aWrrgXu.exe
  C:\Windows\System\aWrrgXu.exe
  2⤵
  PID:1096
- C:\Windows\System\EMCCYCU.exe
  C:\Windows\System\EMCCYCU.exe
  2⤵
  PID:3144
- C:\Windows\System\erLHxLT.exe
  C:\Windows\System\erLHxLT.exe
  2⤵
  PID:5212
- C:\Windows\System\fuAtQnv.exe
  C:\Windows\System\fuAtQnv.exe
  2⤵
  PID:5240
- C:\Windows\System\USgAlmR.exe
  C:\Windows\System\USgAlmR.exe
  2⤵
  PID:5504
- C:\Windows\System\GEWntUW.exe
  C:\Windows\System\GEWntUW.exe
  2⤵
  PID:5348
- C:\Windows\System\NlhGsQS.exe
  C:\Windows\System\NlhGsQS.exe
  2⤵
  PID:5436
- C:\Windows\System\KJcdaHD.exe
  C:\Windows\System\KJcdaHD.exe
  2⤵
  PID:5512
- C:\Windows\System\QJGMlVe.exe
  C:\Windows\System\QJGMlVe.exe
  2⤵
  PID:5412
- C:\Windows\System\eWbSiLG.exe
  C:\Windows\System\eWbSiLG.exe
  2⤵
  PID:5524
- C:\Windows\System\JCpllbo.exe
  C:\Windows\System\JCpllbo.exe
  2⤵
  PID:5300
- C:\Windows\System\CUzzcwm.exe
  C:\Windows\System\CUzzcwm.exe
  2⤵
  PID:5400
- C:\Windows\System\BXnOsJW.exe
  C:\Windows\System\BXnOsJW.exe
  2⤵
  PID:5584
- C:\Windows\System\PsFgWKB.exe
  C:\Windows\System\PsFgWKB.exe
  2⤵
  PID:5620
- C:\Windows\System\jNKjoZk.exe
  C:\Windows\System\jNKjoZk.exe
  2⤵
  PID:6156
- C:\Windows\System\pfxjLhi.exe
  C:\Windows\System\pfxjLhi.exe
  2⤵
  PID:6172
- C:\Windows\System\tqeUgRP.exe
  C:\Windows\System\tqeUgRP.exe
  2⤵
  PID:6188
- C:\Windows\System\FThGvIf.exe
  C:\Windows\System\FThGvIf.exe
  2⤵
  PID:6208
- C:\Windows\System\DHcbKPx.exe
  C:\Windows\System\DHcbKPx.exe
  2⤵
  PID:6228
- C:\Windows\System\ndtGnUm.exe
  C:\Windows\System\ndtGnUm.exe
  2⤵
  PID:6244
- C:\Windows\System\jJfdvQk.exe
  C:\Windows\System\jJfdvQk.exe
  2⤵
  PID:6264
- C:\Windows\System\oMmSfms.exe
  C:\Windows\System\oMmSfms.exe
  2⤵
  PID:6280
- C:\Windows\System\etzjZSr.exe
  C:\Windows\System\etzjZSr.exe
  2⤵
  PID:6312
- C:\Windows\System\IebwWwj.exe
  C:\Windows\System\IebwWwj.exe
  2⤵
  PID:6352
- C:\Windows\System\iHueNyT.exe
  C:\Windows\System\iHueNyT.exe
  2⤵
  PID:6376
- C:\Windows\System\FZmufvF.exe
  C:\Windows\System\FZmufvF.exe
  2⤵
  PID:6400
- C:\Windows\System\LktzOfK.exe
  C:\Windows\System\LktzOfK.exe
  2⤵
  PID:6420
- C:\Windows\System\pwglnri.exe
  C:\Windows\System\pwglnri.exe
  2⤵
  PID:6436
- C:\Windows\System\IGrORoi.exe
  C:\Windows\System\IGrORoi.exe
  2⤵
  PID:6460
- C:\Windows\System\rRwqAkk.exe
  C:\Windows\System\rRwqAkk.exe
  2⤵
  PID:6484
- C:\Windows\System\aNQCKRD.exe
  C:\Windows\System\aNQCKRD.exe
  2⤵
  PID:6500
- C:\Windows\System\cmNDQiY.exe
  C:\Windows\System\cmNDQiY.exe
  2⤵
  PID:6516
- C:\Windows\System\VbZYyVA.exe
  C:\Windows\System\VbZYyVA.exe
  2⤵
  PID:6536
- C:\Windows\System\ZyNsCQG.exe
  C:\Windows\System\ZyNsCQG.exe
  2⤵
  PID:6556
- C:\Windows\System\UdTbnRg.exe
  C:\Windows\System\UdTbnRg.exe
  2⤵
  PID:6572
- C:\Windows\System\LPDMxZi.exe
  C:\Windows\System\LPDMxZi.exe
  2⤵
  PID:6588
- C:\Windows\System\GeSPMTA.exe
  C:\Windows\System\GeSPMTA.exe
  2⤵
  PID:6608
- C:\Windows\System\hZLwRmu.exe
  C:\Windows\System\hZLwRmu.exe
  2⤵
  PID:6624
- C:\Windows\System\uCGKLhI.exe
  C:\Windows\System\uCGKLhI.exe
  2⤵
  PID:6804
- C:\Windows\System\JjsNyqL.exe
  C:\Windows\System\JjsNyqL.exe
  2⤵
  PID:6828
- C:\Windows\System\sxUaDKc.exe
  C:\Windows\System\sxUaDKc.exe
  2⤵
  PID:6852
- C:\Windows\System\YZJtXxt.exe
  C:\Windows\System\YZJtXxt.exe
  2⤵
  PID:6872
- C:\Windows\System\SCcoJPd.exe
  C:\Windows\System\SCcoJPd.exe
  2⤵
  PID:6896
- C:\Windows\System\nCaUgQT.exe
  C:\Windows\System\nCaUgQT.exe
  2⤵
  PID:6916
- C:\Windows\System\TUIkgYb.exe
  C:\Windows\System\TUIkgYb.exe
  2⤵
  PID:6936
- C:\Windows\System\CPlruBk.exe
  C:\Windows\System\CPlruBk.exe
  2⤵
  PID:6960
- C:\Windows\System\fBTHsyJ.exe
  C:\Windows\System\fBTHsyJ.exe
  2⤵
  PID:6984
- C:\Windows\System\tLhDLNT.exe
  C:\Windows\System\tLhDLNT.exe
  2⤵
  PID:7004
- C:\Windows\System\uQkantT.exe
  C:\Windows\System\uQkantT.exe
  2⤵
  PID:7024
- C:\Windows\System\BTjYSAd.exe
  C:\Windows\System\BTjYSAd.exe
  2⤵
  PID:7048
- C:\Windows\System\jpbzIif.exe
  C:\Windows\System\jpbzIif.exe
  2⤵
  PID:7072
- C:\Windows\System\SvZstwB.exe
  C:\Windows\System\SvZstwB.exe
  2⤵
  PID:7088
- C:\Windows\System\zcudQxV.exe
  C:\Windows\System\zcudQxV.exe
  2⤵
  PID:7112
- C:\Windows\System\GNEgbTJ.exe
  C:\Windows\System\GNEgbTJ.exe
  2⤵
  PID:7132
- C:\Windows\System\onmuTBH.exe
  C:\Windows\System\onmuTBH.exe
  2⤵
  PID:7152
- C:\Windows\System\BbGLCob.exe
  C:\Windows\System\BbGLCob.exe
  2⤵
  PID:6056
- C:\Windows\System\RsiAKsf.exe
  C:\Windows\System\RsiAKsf.exe
  2⤵
  PID:6104
- C:\Windows\System\XCogasR.exe
  C:\Windows\System\XCogasR.exe
  2⤵
  PID:2872
- C:\Windows\System\qjRsSHn.exe
  C:\Windows\System\qjRsSHn.exe
  2⤵
  PID:1272
- C:\Windows\System\TNAgKAo.exe
  C:\Windows\System\TNAgKAo.exe
  2⤵
  PID:4216
- C:\Windows\System\jjJBXMj.exe
  C:\Windows\System\jjJBXMj.exe
  2⤵
  PID:3920
- C:\Windows\System\NNoIIrs.exe
  C:\Windows\System\NNoIIrs.exe
  2⤵
  PID:5664
- C:\Windows\System\rONSQfw.exe
  C:\Windows\System\rONSQfw.exe
  2⤵
  PID:6080
- C:\Windows\System\sfsdKnv.exe
  C:\Windows\System\sfsdKnv.exe
  2⤵
  PID:764
- C:\Windows\System\vwnOdaP.exe
  C:\Windows\System\vwnOdaP.exe
  2⤵
  PID:5872
- C:\Windows\System\VnMMhqe.exe
  C:\Windows\System\VnMMhqe.exe
  2⤵
  PID:5896
- C:\Windows\System\zAQdSjP.exe
  C:\Windows\System\zAQdSjP.exe
  2⤵
  PID:5916
- C:\Windows\System\XHgHyJX.exe
  C:\Windows\System\XHgHyJX.exe
  2⤵
  PID:5968
- C:\Windows\System\BWtzDzZ.exe
  C:\Windows\System\BWtzDzZ.exe
  2⤵
  PID:6028
- C:\Windows\System\MyVxZQr.exe
  C:\Windows\System\MyVxZQr.exe
  2⤵
  PID:3204
- C:\Windows\System\ZeIFefk.exe
  C:\Windows\System\ZeIFefk.exe
  2⤵
  PID:4412
- C:\Windows\System\AuIejZM.exe
  C:\Windows\System\AuIejZM.exe
  2⤵
  PID:5256
- C:\Windows\System\uqpJJxW.exe
  C:\Windows\System\uqpJJxW.exe
  2⤵
  PID:7188
- C:\Windows\System\lpCZTAA.exe
  C:\Windows\System\lpCZTAA.exe
  2⤵
  PID:7212
- C:\Windows\System\BJFEHUA.exe
  C:\Windows\System\BJFEHUA.exe
  2⤵
  PID:7232
- C:\Windows\System\LRcainK.exe
  C:\Windows\System\LRcainK.exe
  2⤵
  PID:7248
- C:\Windows\System\FjGZfHs.exe
  C:\Windows\System\FjGZfHs.exe
  2⤵
  PID:7272
- C:\Windows\System\VlumUaU.exe
  C:\Windows\System\VlumUaU.exe
  2⤵
  PID:7304
- C:\Windows\System\IwyQmIr.exe
  C:\Windows\System\IwyQmIr.exe
  2⤵
  PID:7328
- C:\Windows\System\BKLHgKq.exe
  C:\Windows\System\BKLHgKq.exe
  2⤵
  PID:7344
- C:\Windows\System\IQmUoTZ.exe
  C:\Windows\System\IQmUoTZ.exe
  2⤵
  PID:7368
- C:\Windows\System\RsUrfcF.exe
  C:\Windows\System\RsUrfcF.exe
  2⤵
  PID:7460
- C:\Windows\System\pieLogE.exe
  C:\Windows\System\pieLogE.exe
  2⤵
  PID:7480
- C:\Windows\System\zWIRSkd.exe
  C:\Windows\System\zWIRSkd.exe
  2⤵
  PID:7500
- C:\Windows\System\wQxHYad.exe
  C:\Windows\System\wQxHYad.exe
  2⤵
  PID:7528
- C:\Windows\System\xyNcudt.exe
  C:\Windows\System\xyNcudt.exe
  2⤵
  PID:7548
- C:\Windows\System\qloGvvP.exe
  C:\Windows\System\qloGvvP.exe
  2⤵
  PID:7568
- C:\Windows\System\LExCYye.exe
  C:\Windows\System\LExCYye.exe
  2⤵
  PID:7584
- C:\Windows\System\efAmkPy.exe
  C:\Windows\System\efAmkPy.exe
  2⤵
  PID:7600
- C:\Windows\System\FJPKafW.exe
  C:\Windows\System\FJPKafW.exe
  2⤵
  PID:7616
- C:\Windows\System\JLIFehi.exe
  C:\Windows\System\JLIFehi.exe
  2⤵
  PID:7640
- C:\Windows\System\QRYybKC.exe
  C:\Windows\System\QRYybKC.exe
  2⤵
  PID:7664
- C:\Windows\System\PIpeGmv.exe
  C:\Windows\System\PIpeGmv.exe
  2⤵
  PID:7684
- C:\Windows\System\PYPsFGu.exe
  C:\Windows\System\PYPsFGu.exe
  2⤵
  PID:7716
- C:\Windows\System\ZlqopaV.exe
  C:\Windows\System\ZlqopaV.exe
  2⤵
  PID:7740
- C:\Windows\System\SPnHHEb.exe
  C:\Windows\System\SPnHHEb.exe
  2⤵
  PID:7768
- C:\Windows\System\tDHKTXE.exe
  C:\Windows\System\tDHKTXE.exe
  2⤵
  PID:7792
- C:\Windows\System\srAkfyK.exe
  C:\Windows\System\srAkfyK.exe
  2⤵
  PID:7816
- C:\Windows\System\VPGHNxo.exe
  C:\Windows\System\VPGHNxo.exe
  2⤵
  PID:7840
- C:\Windows\System\fGiuwnm.exe
  C:\Windows\System\fGiuwnm.exe
  2⤵
  PID:7872
- C:\Windows\System\sRKuKcP.exe
  C:\Windows\System\sRKuKcP.exe
  2⤵
  PID:7900
- C:\Windows\System\qZYABJS.exe
  C:\Windows\System\qZYABJS.exe
  2⤵
  PID:7924
- C:\Windows\System\oAKjoqQ.exe
  C:\Windows\System\oAKjoqQ.exe
  2⤵
  PID:7944
- C:\Windows\System\fxVkjTO.exe
  C:\Windows\System\fxVkjTO.exe
  2⤵
  PID:7968
- C:\Windows\System\LjGsWmc.exe
  C:\Windows\System\LjGsWmc.exe
  2⤵
  PID:7984
- C:\Windows\System\vHqoeWz.exe
  C:\Windows\System\vHqoeWz.exe
  2⤵
  PID:8012
- C:\Windows\System\YqBDSBm.exe
  C:\Windows\System\YqBDSBm.exe
  2⤵
  PID:8036
- C:\Windows\System\HgbkVlp.exe
  C:\Windows\System\HgbkVlp.exe
  2⤵
  PID:8056
- C:\Windows\System\KhYslfy.exe
  C:\Windows\System\KhYslfy.exe
  2⤵
  PID:8080
- C:\Windows\System\WPiWfls.exe
  C:\Windows\System\WPiWfls.exe
  2⤵
  PID:8104
- C:\Windows\System\hkScscz.exe
  C:\Windows\System\hkScscz.exe
  2⤵
  PID:8160
- C:\Windows\System\SOzsarj.exe
  C:\Windows\System\SOzsarj.exe
  2⤵
  PID:8184
- C:\Windows\System\kkmFfWL.exe
  C:\Windows\System\kkmFfWL.exe
  2⤵
  PID:5432
- C:\Windows\System\KZKeNKR.exe
  C:\Windows\System\KZKeNKR.exe
  2⤵
  PID:5488
- C:\Windows\System\FlYCzvN.exe
  C:\Windows\System\FlYCzvN.exe
  2⤵
  PID:5576
- C:\Windows\System\XPmPidw.exe
  C:\Windows\System\XPmPidw.exe
  2⤵
  PID:6168
- C:\Windows\System\bKnzGDJ.exe
  C:\Windows\System\bKnzGDJ.exe
  2⤵
  PID:6216
- C:\Windows\System\xWRoDMV.exe
  C:\Windows\System\xWRoDMV.exe
  2⤵
  PID:6252
- C:\Windows\System\uokuJcd.exe
  C:\Windows\System\uokuJcd.exe
  2⤵
  PID:6276
- C:\Windows\System\PMSAwJN.exe
  C:\Windows\System\PMSAwJN.exe
  2⤵
  PID:6348
- C:\Windows\System\zNzJzqQ.exe
  C:\Windows\System\zNzJzqQ.exe
  2⤵
  PID:6392
- C:\Windows\System\DpArKUl.exe
  C:\Windows\System\DpArKUl.exe
  2⤵
  PID:6428
- C:\Windows\System\aGYKGiM.exe
  C:\Windows\System\aGYKGiM.exe
  2⤵
  PID:6468
- C:\Windows\System\hcVqRBq.exe
  C:\Windows\System\hcVqRBq.exe
  2⤵
  PID:6508
- C:\Windows\System\YhsHPne.exe
  C:\Windows\System\YhsHPne.exe
  2⤵
  PID:6548
- C:\Windows\System\ChXyXJD.exe
  C:\Windows\System\ChXyXJD.exe
  2⤵
  PID:6584
- C:\Windows\System\GiSYRti.exe
  C:\Windows\System\GiSYRti.exe
  2⤵
  PID:6864
- C:\Windows\System\TQBJPLX.exe
  C:\Windows\System\TQBJPLX.exe
  2⤵
  PID:6904
- C:\Windows\System\yCjqqbi.exe
  C:\Windows\System\yCjqqbi.exe
  2⤵
  PID:7084
- C:\Windows\System\jVpCxuc.exe
  C:\Windows\System\jVpCxuc.exe
  2⤵
  PID:6064
- C:\Windows\System\Dkwjcye.exe
  C:\Windows\System\Dkwjcye.exe
  2⤵
  PID:5908
- C:\Windows\System\PtaJHfj.exe
  C:\Windows\System\PtaJHfj.exe
  2⤵
  PID:7240
- C:\Windows\System\zUdpOkU.exe
  C:\Windows\System\zUdpOkU.exe
  2⤵
  PID:7356
- C:\Windows\System\wgMAhee.exe
  C:\Windows\System\wgMAhee.exe
  2⤵
  PID:6704
- C:\Windows\System\VdVnCNe.exe
  C:\Windows\System\VdVnCNe.exe
  2⤵
  PID:7592
- C:\Windows\System\NeTDEku.exe
  C:\Windows\System\NeTDEku.exe
  2⤵
  PID:7624
- C:\Windows\System\rPLDKnb.exe
  C:\Windows\System\rPLDKnb.exe
  2⤵
  PID:7108
- C:\Windows\System\MnWPLVW.exe
  C:\Windows\System\MnWPLVW.exe
  2⤵
  PID:7144
- C:\Windows\System\ooCEHmb.exe
  C:\Windows\System\ooCEHmb.exe
  2⤵
  PID:952
- C:\Windows\System\UTaEiyX.exe
  C:\Windows\System\UTaEiyX.exe
  2⤵
  PID:5080
- C:\Windows\System\WVvnMJt.exe
  C:\Windows\System\WVvnMJt.exe
  2⤵
  PID:3684
- C:\Windows\System\qRqJQvp.exe
  C:\Windows\System\qRqJQvp.exe
  2⤵
  PID:5884
- C:\Windows\System\XmDFmvt.exe
  C:\Windows\System\XmDFmvt.exe
  2⤵
  PID:7916
- C:\Windows\System\McJIydH.exe
  C:\Windows\System\McJIydH.exe
  2⤵
  PID:6024
- C:\Windows\System\WzGZcvh.exe
  C:\Windows\System\WzGZcvh.exe
  2⤵
  PID:8004
- C:\Windows\System\dDIudwD.exe
  C:\Windows\System\dDIudwD.exe
  2⤵
  PID:7180
- C:\Windows\System\mQlMbTp.exe
  C:\Windows\System\mQlMbTp.exe
  2⤵
  PID:7224
- C:\Windows\System\FNsbYdH.exe
  C:\Windows\System\FNsbYdH.exe
  2⤵
  PID:7264
- C:\Windows\System\BlNogct.exe
  C:\Windows\System\BlNogct.exe
  2⤵
  PID:8096
- C:\Windows\System\IEEQOdl.exe
  C:\Windows\System\IEEQOdl.exe
  2⤵
  PID:7352
- C:\Windows\System\HwWEkoK.exe
  C:\Windows\System\HwWEkoK.exe
  2⤵
  PID:7376
- C:\Windows\System\hvueTSf.exe
  C:\Windows\System\hvueTSf.exe
  2⤵
  PID:8196
- C:\Windows\System\MEBjrun.exe
  C:\Windows\System\MEBjrun.exe
  2⤵
  PID:8252
- C:\Windows\System\VEKNrbn.exe
  C:\Windows\System\VEKNrbn.exe
  2⤵
  PID:8272
- C:\Windows\System\xFkMkub.exe
  C:\Windows\System\xFkMkub.exe
  2⤵
  PID:8296
- C:\Windows\System\IixRuNO.exe
  C:\Windows\System\IixRuNO.exe
  2⤵
  PID:8320
- C:\Windows\System\WTSiJUE.exe
  C:\Windows\System\WTSiJUE.exe
  2⤵
  PID:8336
- C:\Windows\System\iQaDCZC.exe
  C:\Windows\System\iQaDCZC.exe
  2⤵
  PID:8360
- C:\Windows\System\YYuRIwr.exe
  C:\Windows\System\YYuRIwr.exe
  2⤵
  PID:8384
- C:\Windows\System\npIwPko.exe
  C:\Windows\System\npIwPko.exe
  2⤵
  PID:8408
- C:\Windows\System\kPdZMXa.exe
  C:\Windows\System\kPdZMXa.exe
  2⤵
  PID:8428
- C:\Windows\System\pVmfqgK.exe
  C:\Windows\System\pVmfqgK.exe
  2⤵
  PID:8452
- C:\Windows\System\AGchHid.exe
  C:\Windows\System\AGchHid.exe
  2⤵
  PID:8480
- C:\Windows\System\XkfDSFZ.exe
  C:\Windows\System\XkfDSFZ.exe
  2⤵
  PID:8500
- C:\Windows\System\nnZMfpP.exe
  C:\Windows\System\nnZMfpP.exe
  2⤵
  PID:8520
- C:\Windows\System\OlluaCk.exe
  C:\Windows\System\OlluaCk.exe
  2⤵
  PID:8548
- C:\Windows\System\qsgqgug.exe
  C:\Windows\System\qsgqgug.exe
  2⤵
  PID:8572
- C:\Windows\System\XQeIdqX.exe
  C:\Windows\System\XQeIdqX.exe
  2⤵
  PID:8600
- C:\Windows\System\qsUeZpj.exe
  C:\Windows\System\qsUeZpj.exe
  2⤵
  PID:8616
- C:\Windows\System\bQSVKsg.exe
  C:\Windows\System\bQSVKsg.exe
  2⤵
  PID:8648
- C:\Windows\System\xddrYoh.exe
  C:\Windows\System\xddrYoh.exe
  2⤵
  PID:8680
- C:\Windows\System\bjKQViD.exe
  C:\Windows\System\bjKQViD.exe
  2⤵
  PID:8700
- C:\Windows\System\tfKkSTh.exe
  C:\Windows\System\tfKkSTh.exe
  2⤵
  PID:8720
- C:\Windows\System\cgiqgMJ.exe
  C:\Windows\System\cgiqgMJ.exe
  2⤵
  PID:8748
- C:\Windows\System\UgWdGPu.exe
  C:\Windows\System\UgWdGPu.exe
  2⤵
  PID:8772
- C:\Windows\System\nUlCqnG.exe
  C:\Windows\System\nUlCqnG.exe
  2⤵
  PID:8796
- C:\Windows\System\acIkXxN.exe
  C:\Windows\System\acIkXxN.exe
  2⤵
  PID:8820
- C:\Windows\System\FJHfvEc.exe
  C:\Windows\System\FJHfvEc.exe
  2⤵
  PID:8840
- C:\Windows\System\ZeomOBo.exe
  C:\Windows\System\ZeomOBo.exe
  2⤵
  PID:8864
- C:\Windows\System\ZlGZOKj.exe
  C:\Windows\System\ZlGZOKj.exe
  2⤵
  PID:7976
- C:\Windows\System\RhiXvpS.exe
  C:\Windows\System\RhiXvpS.exe
  2⤵
  PID:7452
- C:\Windows\System\YSNyjEw.exe
  C:\Windows\System\YSNyjEw.exe
  2⤵
  PID:7508
- C:\Windows\System\FoniSTz.exe
  C:\Windows\System\FoniSTz.exe
  2⤵
  PID:7576
- C:\Windows\System\wptXvNU.exe
  C:\Windows\System\wptXvNU.exe
  2⤵
  PID:7724
- C:\Windows\System\jFwbMSt.exe
  C:\Windows\System\jFwbMSt.exe
  2⤵
  PID:7780
- C:\Windows\System\cWJaEsW.exe
  C:\Windows\System\cWJaEsW.exe
  2⤵
  PID:7804
- C:\Windows\System\kgHaxkH.exe
  C:\Windows\System\kgHaxkH.exe
  2⤵
  PID:7936
- C:\Windows\System\PBfLvaf.exe
  C:\Windows\System\PBfLvaf.exe
  2⤵
  PID:8832
- C:\Windows\System\NqKRefl.exe
  C:\Windows\System\NqKRefl.exe
  2⤵
  PID:8044
- C:\Windows\System\WVWafxg.exe
  C:\Windows\System\WVWafxg.exe
  2⤵
  PID:8032
- C:\Windows\System\VnVZdbn.exe
  C:\Windows\System\VnVZdbn.exe
  2⤵
  PID:8588
- C:\Windows\System\VymeBYh.exe
  C:\Windows\System\VymeBYh.exe
  2⤵
  PID:6452
- C:\Windows\System\dZzsjGz.exe
  C:\Windows\System\dZzsjGz.exe
  2⤵
  PID:6544
- C:\Windows\System\tRPzfGJ.exe
  C:\Windows\System\tRPzfGJ.exe
  2⤵
  PID:8676
- C:\Windows\System\dRpjCDK.exe
  C:\Windows\System\dRpjCDK.exe
  2⤵
  PID:8716
- C:\Windows\System\UmyGuta.exe
  C:\Windows\System\UmyGuta.exe
  2⤵
  PID:8756
- C:\Windows\System\GVSKlpz.exe
  C:\Windows\System\GVSKlpz.exe
  2⤵
  PID:7612
- C:\Windows\System\vrfYqKT.exe
  C:\Windows\System\vrfYqKT.exe
  2⤵
  PID:5336
- C:\Windows\System\fObctBr.exe
  C:\Windows\System\fObctBr.exe
  2⤵
  PID:4676
- C:\Windows\System\FzKqemy.exe
  C:\Windows\System\FzKqemy.exe
  2⤵
  PID:6772
- C:\Windows\System\rxhCrOi.exe
  C:\Windows\System\rxhCrOi.exe
  2⤵
  PID:8244
- C:\Windows\System\gbUJVGX.exe
  C:\Windows\System\gbUJVGX.exe
  2⤵
  PID:8368
- C:\Windows\System\aYNFivb.exe
  C:\Windows\System\aYNFivb.exe
  2⤵
  PID:8436
- C:\Windows\System\CoRBBtG.exe
  C:\Windows\System\CoRBBtG.exe
  2⤵
  PID:8788
- C:\Windows\System\fRSwDfK.exe
  C:\Windows\System\fRSwDfK.exe
  2⤵
  PID:5860
- C:\Windows\System\iGViwrn.exe
  C:\Windows\System\iGViwrn.exe
  2⤵
  PID:8612
- C:\Windows\System\RWywqtY.exe
  C:\Windows\System\RWywqtY.exe
  2⤵
  PID:7676
- C:\Windows\System\CXbKkuK.exe
  C:\Windows\System\CXbKkuK.exe
  2⤵
  PID:8768
- C:\Windows\System\LlxnZty.exe
  C:\Windows\System\LlxnZty.exe
  2⤵
  PID:9188
- C:\Windows\System\mIdFiEI.exe
  C:\Windows\System\mIdFiEI.exe
  2⤵
  PID:9008
- C:\Windows\System\pLjGzET.exe
  C:\Windows\System\pLjGzET.exe
  2⤵
  PID:9068
- C:\Windows\System\XOWVJiO.exe
  C:\Windows\System\XOWVJiO.exe
  2⤵
  PID:8828
- C:\Windows\System\bUmIeeq.exe
  C:\Windows\System\bUmIeeq.exe
  2⤵
  PID:8536
- C:\Windows\System\KPWgiwe.exe
  C:\Windows\System\KPWgiwe.exe
  2⤵
  PID:8376
- C:\Windows\System\ElGIEJu.exe
  C:\Windows\System\ElGIEJu.exe
  2⤵
  PID:8264
- C:\Windows\System\hOjDiFZ.exe
  C:\Windows\System\hOjDiFZ.exe
  2⤵
  PID:8068
- C:\Windows\System\mIGxjvG.exe
  C:\Windows\System\mIGxjvG.exe
  2⤵
  PID:7884
- C:\Windows\System\OkGnLwj.exe
  C:\Windows\System\OkGnLwj.exe
  2⤵
  PID:7912
- C:\Windows\System\BMWsiUD.exe
  C:\Windows\System\BMWsiUD.exe
  2⤵
  PID:8232
- C:\Windows\System\lsYIwga.exe
  C:\Windows\System\lsYIwga.exe
  2⤵
  PID:9232
- C:\Windows\System\dFoIAiB.exe
  C:\Windows\System\dFoIAiB.exe
  2⤵
  PID:9252
- C:\Windows\System\XfMLcGE.exe
  C:\Windows\System\XfMLcGE.exe
  2⤵
  PID:9272
- C:\Windows\System\lEzqRqA.exe
  C:\Windows\System\lEzqRqA.exe
  2⤵
  PID:9292
- C:\Windows\System\WGMhzCS.exe
  C:\Windows\System\WGMhzCS.exe
  2⤵
  PID:9340
- C:\Windows\System\ZPqhfdB.exe
  C:\Windows\System\ZPqhfdB.exe
  2⤵
  PID:9364
- C:\Windows\System\JChaoCp.exe
  C:\Windows\System\JChaoCp.exe
  2⤵
  PID:9384
- C:\Windows\System\StWrumk.exe
  C:\Windows\System\StWrumk.exe
  2⤵
  PID:9400
- C:\Windows\System\JfKomXJ.exe
  C:\Windows\System\JfKomXJ.exe
  2⤵
  PID:9420
- C:\Windows\System\qWMNbOS.exe
  C:\Windows\System\qWMNbOS.exe
  2⤵
  PID:9444
- C:\Windows\System\gFNQbtH.exe
  C:\Windows\System\gFNQbtH.exe
  2⤵
  PID:9464
- C:\Windows\System\iTDhXMP.exe
  C:\Windows\System\iTDhXMP.exe
  2⤵
  PID:9492
- C:\Windows\System\KDDNrum.exe
  C:\Windows\System\KDDNrum.exe
  2⤵
  PID:9512
- C:\Windows\System\HaSqhGi.exe
  C:\Windows\System\HaSqhGi.exe
  2⤵
  PID:9536
- C:\Windows\System\PfTGatC.exe
  C:\Windows\System\PfTGatC.exe
  2⤵
  PID:9560
- C:\Windows\System\AZMcOKG.exe
  C:\Windows\System\AZMcOKG.exe
  2⤵
  PID:9584
- C:\Windows\System\HdPeDXM.exe
  C:\Windows\System\HdPeDXM.exe
  2⤵
  PID:9604
- C:\Windows\System\FgRGYDg.exe
  C:\Windows\System\FgRGYDg.exe
  2⤵
  PID:9624
- C:\Windows\System\tspDaVk.exe
  C:\Windows\System\tspDaVk.exe
  2⤵
  PID:9648
- C:\Windows\System\bLQkOKP.exe
  C:\Windows\System\bLQkOKP.exe
  2⤵
  PID:9672
- C:\Windows\System\CDeRLZJ.exe
  C:\Windows\System\CDeRLZJ.exe
  2⤵
  PID:9692
- C:\Windows\System\edtsUKp.exe
  C:\Windows\System\edtsUKp.exe
  2⤵
  PID:9712
- C:\Windows\System\UgykjaX.exe
  C:\Windows\System\UgykjaX.exe
  2⤵
  PID:9736
- C:\Windows\System\rLkOmhu.exe
  C:\Windows\System\rLkOmhu.exe
  2⤵
  PID:9764
- C:\Windows\System\PVCqUDh.exe
  C:\Windows\System\PVCqUDh.exe
  2⤵
  PID:9780
- C:\Windows\System\noKLzUR.exe
  C:\Windows\System\noKLzUR.exe
  2⤵
  PID:9800
- C:\Windows\System\pmBtnmw.exe
  C:\Windows\System\pmBtnmw.exe
  2⤵
  PID:9824
- C:\Windows\System\kiLoVaQ.exe
  C:\Windows\System\kiLoVaQ.exe
  2⤵
  PID:9848
- C:\Windows\System\QCkKaai.exe
  C:\Windows\System\QCkKaai.exe
  2⤵
  PID:9872
- C:\Windows\System\letyeVc.exe
  C:\Windows\System\letyeVc.exe
  2⤵
  PID:9896
- C:\Windows\System\NFxXxJK.exe
  C:\Windows\System\NFxXxJK.exe
  2⤵
  PID:9916
- C:\Windows\System\QfezKnH.exe
  C:\Windows\System\QfezKnH.exe
  2⤵
  PID:9936
- C:\Windows\System\RFGgQbF.exe
  C:\Windows\System\RFGgQbF.exe
  2⤵
  PID:9980
- C:\Windows\System\TkgtnbI.exe
  C:\Windows\System\TkgtnbI.exe
  2⤵
  PID:10000
- C:\Windows\System\dUxezEK.exe
  C:\Windows\System\dUxezEK.exe
  2⤵
  PID:10036
- C:\Windows\System\iGxhTpM.exe
  C:\Windows\System\iGxhTpM.exe
  2⤵
  PID:10060
- C:\Windows\System\CPaEoHE.exe
  C:\Windows\System\CPaEoHE.exe
  2⤵
  PID:10076
- C:\Windows\System\dLuzWYV.exe
  C:\Windows\System\dLuzWYV.exe
  2⤵
  PID:10092
- C:\Windows\System\FqHbUKO.exe
  C:\Windows\System\FqHbUKO.exe
  2⤵
  PID:10120
- C:\Windows\System\nCMMqKv.exe
  C:\Windows\System\nCMMqKv.exe
  2⤵
  PID:10148
- C:\Windows\System\pYjGkzh.exe
  C:\Windows\System\pYjGkzh.exe
  2⤵
  PID:10176
- C:\Windows\System\VnkHiaW.exe
  C:\Windows\System\VnkHiaW.exe
  2⤵
  PID:10196
- C:\Windows\System\JFdyMwV.exe
  C:\Windows\System\JFdyMwV.exe
  2⤵
  PID:10216
- C:\Windows\System\MaTIPoE.exe
  C:\Windows\System\MaTIPoE.exe
  2⤵
  PID:10236
- C:\Windows\System\XcJBYCM.exe
  C:\Windows\System\XcJBYCM.exe
  2⤵
  PID:2440
- C:\Windows\System\pPyuWMX.exe
  C:\Windows\System\pPyuWMX.exe
  2⤵
  PID:6780
- C:\Windows\System\MxgttkQ.exe
  C:\Windows\System\MxgttkQ.exe
  2⤵
  PID:8804
- C:\Windows\System\eLVTDyg.exe
  C:\Windows\System\eLVTDyg.exe
  2⤵
  PID:6004
- C:\Windows\System\JvOBKFt.exe
  C:\Windows\System\JvOBKFt.exe
  2⤵
  PID:2904
- C:\Windows\System\VPCUhle.exe
  C:\Windows\System\VPCUhle.exe
  2⤵
  PID:7060
- C:\Windows\System\UbZsglm.exe
  C:\Windows\System\UbZsglm.exe
  2⤵
  PID:8308
- C:\Windows\System\xQrPAwl.exe
  C:\Windows\System\xQrPAwl.exe
  2⤵
  PID:9148
- C:\Windows\System\ilMCbdz.exe
  C:\Windows\System\ilMCbdz.exe
  2⤵
  PID:9244
- C:\Windows\System\yHsKSdM.exe
  C:\Windows\System\yHsKSdM.exe
  2⤵
  PID:9288
- C:\Windows\System\zkMHigl.exe
  C:\Windows\System\zkMHigl.exe
  2⤵
  PID:9436
- C:\Windows\System\TShGPwL.exe
  C:\Windows\System\TShGPwL.exe
  2⤵
  PID:9488
- C:\Windows\System\muemxPQ.exe
  C:\Windows\System\muemxPQ.exe
  2⤵
  PID:10268
- C:\Windows\System\hRhMexx.exe
  C:\Windows\System\hRhMexx.exe
  2⤵
  PID:10296
- C:\Windows\System\etMeDJp.exe
  C:\Windows\System\etMeDJp.exe
  2⤵
  PID:10324
- C:\Windows\System\mAvNHSp.exe
  C:\Windows\System\mAvNHSp.exe
  2⤵
  PID:10356
- C:\Windows\System\oFPJVJJ.exe
  C:\Windows\System\oFPJVJJ.exe
  2⤵
  PID:10384
- C:\Windows\System\ClOUzvG.exe
  C:\Windows\System\ClOUzvG.exe
  2⤵
  PID:10404
- C:\Windows\System\oOwcBkP.exe
  C:\Windows\System\oOwcBkP.exe
  2⤵
  PID:10436
- C:\Windows\System\fqhxBBc.exe
  C:\Windows\System\fqhxBBc.exe
  2⤵
  PID:10456
- C:\Windows\System\CABGUkJ.exe
  C:\Windows\System\CABGUkJ.exe
  2⤵
  PID:10476
- C:\Windows\System\OUrasgp.exe
  C:\Windows\System\OUrasgp.exe
  2⤵
  PID:10504
- C:\Windows\System\zvnvLOn.exe
  C:\Windows\System\zvnvLOn.exe
  2⤵
  PID:10528
- C:\Windows\System\RumuQcw.exe
  C:\Windows\System\RumuQcw.exe
  2⤵
  PID:10552
- C:\Windows\System\sogYkje.exe
  C:\Windows\System\sogYkje.exe
  2⤵
  PID:10588
- C:\Windows\System\ZMPyJaC.exe
  C:\Windows\System\ZMPyJaC.exe
  2⤵
  PID:10616
- C:\Windows\System\ntFMEsX.exe
  C:\Windows\System\ntFMEsX.exe
  2⤵
  PID:10640
- C:\Windows\System\DIgXpwM.exe
  C:\Windows\System\DIgXpwM.exe
  2⤵
  PID:10668
- C:\Windows\System\jNKTqBw.exe
  C:\Windows\System\jNKTqBw.exe
  2⤵
  PID:10688
- C:\Windows\System\tASNJYM.exe
  C:\Windows\System\tASNJYM.exe
  2⤵
  PID:10704
- C:\Windows\System\NqpcZro.exe
  C:\Windows\System\NqpcZro.exe
  2⤵
  PID:10720
- C:\Windows\System\GHQvgxu.exe
  C:\Windows\System\GHQvgxu.exe
  2⤵
  PID:10736
- C:\Windows\System\bWbjaZz.exe
  C:\Windows\System\bWbjaZz.exe
  2⤵
  PID:10756
- C:\Windows\System\SHPahRQ.exe
  C:\Windows\System\SHPahRQ.exe
  2⤵
  PID:10776
- C:\Windows\System\QAFSsvf.exe
  C:\Windows\System\QAFSsvf.exe
  2⤵
  PID:10800
- C:\Windows\System\JosThyU.exe
  C:\Windows\System\JosThyU.exe
  2⤵
  PID:10820
- C:\Windows\System\xlZAjtK.exe
  C:\Windows\System\xlZAjtK.exe
  2⤵
  PID:10840
- C:\Windows\System\VMSIqXC.exe
  C:\Windows\System\VMSIqXC.exe
  2⤵
  PID:10860
- C:\Windows\System\JBcRBIh.exe
  C:\Windows\System\JBcRBIh.exe
  2⤵
  PID:10888
- C:\Windows\System\jITmhxt.exe
  C:\Windows\System\jITmhxt.exe
  2⤵
  PID:10904
- C:\Windows\System\zOMlkZn.exe
  C:\Windows\System\zOMlkZn.exe
  2⤵
  PID:10932
- C:\Windows\System\tpKueBb.exe
  C:\Windows\System\tpKueBb.exe
  2⤵
  PID:10952
- C:\Windows\System\kQmvalx.exe
  C:\Windows\System\kQmvalx.exe
  2⤵
  PID:10976
- C:\Windows\System\woIMbgw.exe
  C:\Windows\System\woIMbgw.exe
  2⤵
  PID:11008
- C:\Windows\System\GMZLcMj.exe
  C:\Windows\System\GMZLcMj.exe
  2⤵
  PID:11028
- C:\Windows\System\msIuZaV.exe
  C:\Windows\System\msIuZaV.exe
  2⤵
  PID:11056
- C:\Windows\System\EbJdAiN.exe
  C:\Windows\System\EbJdAiN.exe
  2⤵
  PID:11076
- C:\Windows\System\cqSKqOk.exe
  C:\Windows\System\cqSKqOk.exe
  2⤵
  PID:11100
- C:\Windows\System\eTqzuqk.exe
  C:\Windows\System\eTqzuqk.exe
  2⤵
  PID:11124
- C:\Windows\System\jbdyFVN.exe
  C:\Windows\System\jbdyFVN.exe
  2⤵
  PID:11140
- C:\Windows\System\rHaINVG.exe
  C:\Windows\System\rHaINVG.exe
  2⤵
  PID:11168
- C:\Windows\System\YSsAPRR.exe
  C:\Windows\System\YSsAPRR.exe
  2⤵
  PID:11184
- C:\Windows\System\peofzBe.exe
  C:\Windows\System\peofzBe.exe
  2⤵
  PID:11204
- C:\Windows\System\mhdozfS.exe
  C:\Windows\System\mhdozfS.exe
  2⤵
  PID:11224
- C:\Windows\System\OADfsoC.exe
  C:\Windows\System\OADfsoC.exe
  2⤵
  PID:11244
- C:\Windows\System\HQrMkvM.exe
  C:\Windows\System\HQrMkvM.exe
  2⤵
  PID:9572
- C:\Windows\System\NZSEPFZ.exe
  C:\Windows\System\NZSEPFZ.exe
  2⤵
  PID:9656
- C:\Windows\System\dJZbZnp.exe
  C:\Windows\System\dJZbZnp.exe
  2⤵
  PID:9728
- C:\Windows\System\ELsDYjS.exe
  C:\Windows\System\ELsDYjS.exe
  2⤵
  PID:9820
- C:\Windows\System\ODMDxvr.exe
  C:\Windows\System\ODMDxvr.exe
  2⤵
  PID:9908
- C:\Windows\System\IZaxANs.exe
  C:\Windows\System\IZaxANs.exe
  2⤵
  PID:8884
- C:\Windows\System\VUBOObx.exe
  C:\Windows\System\VUBOObx.exe
  2⤵
  PID:7184
- C:\Windows\System\RMWkOpR.exe
  C:\Windows\System\RMWkOpR.exe
  2⤵
  PID:6880
- C:\Windows\System\zjlocfp.exe
  C:\Windows\System\zjlocfp.exe
  2⤵
  PID:6492
- C:\Windows\System\YlbGPQX.exe
  C:\Windows\System\YlbGPQX.exe
  2⤵
  PID:6384
- C:\Windows\System\OUgTkAZ.exe
  C:\Windows\System\OUgTkAZ.exe
  2⤵
  PID:4788
- C:\Windows\System\CpVYpSt.exe
  C:\Windows\System\CpVYpSt.exe
  2⤵
  PID:10084
- C:\Windows\System\tTEywvT.exe
  C:\Windows\System\tTEywvT.exe
  2⤵
  PID:10168
- C:\Windows\System\popYiUw.exe
  C:\Windows\System\popYiUw.exe
  2⤵
  PID:9264
- C:\Windows\System\YffvyPP.exe
  C:\Windows\System\YffvyPP.exe
  2⤵
  PID:9284
- C:\Windows\System\FwHOpxE.exe
  C:\Windows\System\FwHOpxE.exe
  2⤵
  PID:6220
- C:\Windows\System\BkBFcfn.exe
  C:\Windows\System\BkBFcfn.exe
  2⤵
  PID:7632
- C:\Windows\System\VElvmSt.exe
  C:\Windows\System\VElvmSt.exe
  2⤵
  PID:7888
- C:\Windows\System\UiPyUjl.exe
  C:\Windows\System\UiPyUjl.exe
  2⤵
  PID:9480
- C:\Windows\System\dJdQYIt.exe
  C:\Windows\System\dJdQYIt.exe
  2⤵
  PID:10256
- C:\Windows\System\HZGeYpN.exe
  C:\Windows\System\HZGeYpN.exe
  2⤵
  PID:9508
- C:\Windows\System\JDvWDxe.exe
  C:\Windows\System\JDvWDxe.exe
  2⤵
  PID:9616
- C:\Windows\System\gAuOmTJ.exe
  C:\Windows\System\gAuOmTJ.exe
  2⤵
  PID:10368
- C:\Windows\System\dEqsQAR.exe
  C:\Windows\System\dEqsQAR.exe
  2⤵
  PID:10424
- C:\Windows\System\MluoIcj.exe
  C:\Windows\System\MluoIcj.exe
  2⤵
  PID:9868
- C:\Windows\System\hwnECcP.exe
  C:\Windows\System\hwnECcP.exe
  2⤵
  PID:9928
- C:\Windows\System\wOilYEb.exe
  C:\Windows\System\wOilYEb.exe
  2⤵
  PID:8920
- C:\Windows\System\CDwkSpr.exe
  C:\Windows\System\CDwkSpr.exe
  2⤵
  PID:9024
- C:\Windows\System\vNvkQTi.exe
  C:\Windows\System\vNvkQTi.exe
  2⤵
  PID:8584
- C:\Windows\System\DejHabA.exe
  C:\Windows\System\DejHabA.exe
  2⤵
  PID:8288
- C:\Windows\System\DyUHwix.exe
  C:\Windows\System\DyUHwix.exe
  2⤵
  PID:11288
- C:\Windows\System\erQaafw.exe
  C:\Windows\System\erQaafw.exe
  2⤵
  PID:11308
- C:\Windows\System\iTKgqKc.exe
  C:\Windows\System\iTKgqKc.exe
  2⤵
  PID:11328
- C:\Windows\System\MewkSJg.exe
  C:\Windows\System\MewkSJg.exe
  2⤵
  PID:11356
- C:\Windows\System\coEMkYB.exe
  C:\Windows\System\coEMkYB.exe
  2⤵
  PID:11372
- C:\Windows\System\lCklfji.exe
  C:\Windows\System\lCklfji.exe
  2⤵
  PID:11396
- C:\Windows\System\ubpQxJK.exe
  C:\Windows\System\ubpQxJK.exe
  2⤵
  PID:11416
- C:\Windows\System\dtHyvbi.exe
  C:\Windows\System\dtHyvbi.exe
  2⤵
  PID:11436
- C:\Windows\System\ZcdorFT.exe
  C:\Windows\System\ZcdorFT.exe
  2⤵
  PID:11456
- C:\Windows\System\tvdJgXf.exe
  C:\Windows\System\tvdJgXf.exe
  2⤵
  PID:11480
- C:\Windows\System\OaqYnCU.exe
  C:\Windows\System\OaqYnCU.exe
  2⤵
  PID:11500
- C:\Windows\System\oRMqRXl.exe
  C:\Windows\System\oRMqRXl.exe
  2⤵
  PID:11524
- C:\Windows\System\kFwsXOn.exe
  C:\Windows\System\kFwsXOn.exe
  2⤵
  PID:11544
- C:\Windows\System\JzxxYQX.exe
  C:\Windows\System\JzxxYQX.exe
  2⤵
  PID:11568
- C:\Windows\System\pYLPElw.exe
  C:\Windows\System\pYLPElw.exe
  2⤵
  PID:11584
- C:\Windows\System\OjkVnGi.exe
  C:\Windows\System\OjkVnGi.exe
  2⤵
  PID:11616
- C:\Windows\System\apxJCXc.exe
  C:\Windows\System\apxJCXc.exe
  2⤵
  PID:11636
- C:\Windows\System\TmnUhJv.exe
  C:\Windows\System\TmnUhJv.exe
  2⤵
  PID:11656
- C:\Windows\System\PbMMXMy.exe
  C:\Windows\System\PbMMXMy.exe
  2⤵
  PID:11704
- C:\Windows\System\zpEqKHC.exe
  C:\Windows\System\zpEqKHC.exe
  2⤵
  PID:11720
- C:\Windows\System\KuDxpGe.exe
  C:\Windows\System\KuDxpGe.exe
  2⤵
  PID:11744
- C:\Windows\System\IrjOUTo.exe
  C:\Windows\System\IrjOUTo.exe
  2⤵
  PID:11768
- C:\Windows\System\UhnjMFV.exe
  C:\Windows\System\UhnjMFV.exe
  2⤵
  PID:11792
- C:\Windows\System\SANqIlU.exe
  C:\Windows\System\SANqIlU.exe
  2⤵
  PID:11812
- C:\Windows\System\hijgVsk.exe
  C:\Windows\System\hijgVsk.exe
  2⤵
  PID:11840
- C:\Windows\System\XUpmuUY.exe
  C:\Windows\System\XUpmuUY.exe
  2⤵
  PID:11860
- C:\Windows\System\dkKunht.exe
  C:\Windows\System\dkKunht.exe
  2⤵
  PID:11880
- C:\Windows\System\rcMUHnN.exe
  C:\Windows\System\rcMUHnN.exe
  2⤵
  PID:11900
- C:\Windows\System\qcNLoww.exe
  C:\Windows\System\qcNLoww.exe
  2⤵
  PID:11924
- C:\Windows\System\yqcAjKt.exe
  C:\Windows\System\yqcAjKt.exe
  2⤵
  PID:11944
- C:\Windows\System\qFWTIQA.exe
  C:\Windows\System\qFWTIQA.exe
  2⤵
  PID:11976
- C:\Windows\System\phnmJGG.exe
  C:\Windows\System\phnmJGG.exe
  2⤵
  PID:11992
- C:\Windows\System\hUHfmjU.exe
  C:\Windows\System\hUHfmjU.exe
  2⤵
  PID:12016
- C:\Windows\System\qwwGCrw.exe
  C:\Windows\System\qwwGCrw.exe
  2⤵
  PID:12040
- C:\Windows\System\MUSirFk.exe
  C:\Windows\System\MUSirFk.exe
  2⤵
  PID:12064
- C:\Windows\System\rvSoXtH.exe
  C:\Windows\System\rvSoXtH.exe
  2⤵
  PID:12084
- C:\Windows\System\PUscwpy.exe
  C:\Windows\System\PUscwpy.exe
  2⤵
  PID:12104
- C:\Windows\System\lZPdavy.exe
  C:\Windows\System\lZPdavy.exe
  2⤵
  PID:12136
- C:\Windows\System\RMvyCyf.exe
  C:\Windows\System\RMvyCyf.exe
  2⤵
  PID:12156
- C:\Windows\System\jQyTXoa.exe
  C:\Windows\System\jQyTXoa.exe
  2⤵
  PID:12176
- C:\Windows\System\qjXJUtD.exe
  C:\Windows\System\qjXJUtD.exe
  2⤵
  PID:12196
- C:\Windows\System\QWoIZUq.exe
  C:\Windows\System\QWoIZUq.exe
  2⤵
  PID:12220
- C:\Windows\System\ZHYmvmR.exe
  C:\Windows\System\ZHYmvmR.exe
  2⤵
  PID:12264
- C:\Windows\System\DmxELoM.exe
  C:\Windows\System\DmxELoM.exe
  2⤵
  PID:12284
- C:\Windows\System\CmIucvN.exe
  C:\Windows\System\CmIucvN.exe
  2⤵
  PID:10132
- C:\Windows\System\PXczrXV.exe
  C:\Windows\System\PXczrXV.exe
  2⤵
  PID:10912
- C:\Windows\System\aXjqSjY.exe
  C:\Windows\System\aXjqSjY.exe
  2⤵
  PID:10948
- C:\Windows\System\BjyqdAf.exe
  C:\Windows\System\BjyqdAf.exe
  2⤵
  PID:11000
- C:\Windows\System\MBTpOdC.exe
  C:\Windows\System\MBTpOdC.exe
  2⤵
  PID:11036
- C:\Windows\System\ARqCXjH.exe
  C:\Windows\System\ARqCXjH.exe
  2⤵
  PID:9304
- C:\Windows\System\WCpaHfw.exe
  C:\Windows\System\WCpaHfw.exe
  2⤵
  PID:9352
- C:\Windows\System\CPaYmdN.exe
  C:\Windows\System\CPaYmdN.exe
  2⤵
  PID:9380
- C:\Windows\System\ZpurvXy.exe
  C:\Windows\System\ZpurvXy.exe
  2⤵
  PID:9600
- C:\Windows\System\cRwIhBl.exe
  C:\Windows\System\cRwIhBl.exe
  2⤵
  PID:10304
- C:\Windows\System\XILYedw.exe
  C:\Windows\System\XILYedw.exe
  2⤵
  PID:9924
- C:\Windows\System\JrqIHSX.exe
  C:\Windows\System\JrqIHSX.exe
  2⤵
  PID:8696
- C:\Windows\System\USkzwyD.exe
  C:\Windows\System\USkzwyD.exe
  2⤵
  PID:4456
- C:\Windows\System\ODjUeZX.exe
  C:\Windows\System\ODjUeZX.exe
  2⤵
  PID:9972
- C:\Windows\System\XwXGzRx.exe
  C:\Windows\System\XwXGzRx.exe
  2⤵
  PID:10016
- C:\Windows\System\xfnMGoW.exe
  C:\Windows\System\xfnMGoW.exe
  2⤵
  PID:10032
- C:\Windows\System\VXyrdgX.exe
  C:\Windows\System\VXyrdgX.exe
  2⤵
  PID:10108
- C:\Windows\System\pOuDpxG.exe
  C:\Windows\System\pOuDpxG.exe
  2⤵
  PID:12292
- C:\Windows\System\ygUDsQa.exe
  C:\Windows\System\ygUDsQa.exe
  2⤵
  PID:12308
- C:\Windows\System\mXPrgXW.exe
  C:\Windows\System\mXPrgXW.exe
  2⤵
  PID:12328
- C:\Windows\System\YKLLSYF.exe
  C:\Windows\System\YKLLSYF.exe
  2⤵
  PID:12352
- C:\Windows\System\PfyNaTq.exe
  C:\Windows\System\PfyNaTq.exe
  2⤵
  PID:12376
- C:\Windows\System\oahensQ.exe
  C:\Windows\System\oahensQ.exe
  2⤵
  PID:12400
- C:\Windows\System\LoYpEWz.exe
  C:\Windows\System\LoYpEWz.exe
  2⤵
  PID:12420
- C:\Windows\System\tBEkoxB.exe
  C:\Windows\System\tBEkoxB.exe
  2⤵
  PID:12440
- C:\Windows\System\IesIdhI.exe
  C:\Windows\System\IesIdhI.exe
  2⤵
  PID:12460
- C:\Windows\System\wOWqWfO.exe
  C:\Windows\System\wOWqWfO.exe
  2⤵
  PID:12480
- C:\Windows\System\wHqcQyc.exe
  C:\Windows\System\wHqcQyc.exe
  2⤵
  PID:12504
- C:\Windows\System\SOmCKXI.exe
  C:\Windows\System\SOmCKXI.exe
  2⤵
  PID:12524
- C:\Windows\System\fDkrLkP.exe
  C:\Windows\System\fDkrLkP.exe
  2⤵
  PID:12544
- C:\Windows\System\ovrwuUG.exe
  C:\Windows\System\ovrwuUG.exe
  2⤵
  PID:12600
- C:\Windows\System\GNTzBSY.exe
  C:\Windows\System\GNTzBSY.exe
  2⤵
  PID:12616
- C:\Windows\System\trMXoRY.exe
  C:\Windows\System\trMXoRY.exe
  2⤵
  PID:12636
- C:\Windows\System\vUfbLSv.exe
  C:\Windows\System\vUfbLSv.exe
  2⤵
  PID:12652
- C:\Windows\System\AQlIEZm.exe
  C:\Windows\System\AQlIEZm.exe
  2⤵
  PID:12676
- C:\Windows\System\ZbZAMQb.exe
  C:\Windows\System\ZbZAMQb.exe
  2⤵
  PID:12696
- C:\Windows\System\gANxlQO.exe
  C:\Windows\System\gANxlQO.exe
  2⤵
  PID:12724
- C:\Windows\System\ArhNdMj.exe
  C:\Windows\System\ArhNdMj.exe
  2⤵
  PID:12740
- C:\Windows\System\wVDRgXz.exe
  C:\Windows\System\wVDRgXz.exe
  2⤵
  PID:12764
- C:\Windows\System\iUpFUDm.exe
  C:\Windows\System\iUpFUDm.exe
  2⤵
  PID:12784
- C:\Windows\System\KTnosxT.exe
  C:\Windows\System\KTnosxT.exe
  2⤵
  PID:12804
- C:\Windows\System\RkibAmC.exe
  C:\Windows\System\RkibAmC.exe
  2⤵
  PID:12828
- C:\Windows\System\nqmkifX.exe
  C:\Windows\System\nqmkifX.exe
  2⤵
  PID:12844
- C:\Windows\System\CDWRWTZ.exe
  C:\Windows\System\CDWRWTZ.exe
  2⤵
  PID:12868
- C:\Windows\System\NzlZZvP.exe
  C:\Windows\System\NzlZZvP.exe
  2⤵
  PID:12892
- C:\Windows\System\wwsJlUp.exe
  C:\Windows\System\wwsJlUp.exe
  2⤵
  PID:12912
- C:\Windows\System\DVnqWYN.exe
  C:\Windows\System\DVnqWYN.exe
  2⤵
  PID:12936
- C:\Windows\System\KdhnMTr.exe
  C:\Windows\System\KdhnMTr.exe
  2⤵
  PID:12956
- C:\Windows\System\ddUFsJg.exe
  C:\Windows\System\ddUFsJg.exe
  2⤵
  PID:12980
- C:\Windows\System\JAgPQfY.exe
  C:\Windows\System\JAgPQfY.exe
  2⤵
  PID:13004
- C:\Windows\System\KArzKuB.exe
  C:\Windows\System\KArzKuB.exe
  2⤵
  PID:13028
- C:\Windows\System\BvTDScX.exe
  C:\Windows\System\BvTDScX.exe
  2⤵
  PID:13048
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13048 -s 252
    3⤵
    PID:12736
- C:\Windows\System\ddehjgN.exe
  C:\Windows\System\ddehjgN.exe
  2⤵
  PID:13076
- C:\Windows\System\pwxKsXr.exe
  C:\Windows\System\pwxKsXr.exe
  2⤵
  PID:13104
- C:\Windows\System\LeHwZPc.exe
  C:\Windows\System\LeHwZPc.exe
  2⤵
  PID:13132
- C:\Windows\System\XhRSMuf.exe
  C:\Windows\System\XhRSMuf.exe
  2⤵
  PID:13160
- C:\Windows\System\zruWhda.exe
  C:\Windows\System\zruWhda.exe
  2⤵
  PID:13184
- C:\Windows\System\SRozHYO.exe
  C:\Windows\System\SRozHYO.exe
  2⤵
  PID:13200
- C:\Windows\System\CRZTXvi.exe
  C:\Windows\System\CRZTXvi.exe
  2⤵
  PID:13220
- C:\Windows\System\iqEUBeE.exe
  C:\Windows\System\iqEUBeE.exe
  2⤵
  PID:13248
- C:\Windows\System\zQKftGs.exe
  C:\Windows\System\zQKftGs.exe
  2⤵
  PID:13276
- C:\Windows\System\CJxEJMW.exe
  C:\Windows\System\CJxEJMW.exe
  2⤵
  PID:13292
- C:\Windows\System\JBtEwiN.exe
  C:\Windows\System\JBtEwiN.exe
  2⤵
  PID:11468
- C:\Windows\System\hAiLgvC.exe
  C:\Windows\System\hAiLgvC.exe
  2⤵
  PID:10232
- C:\Windows\System\QsNVkvn.exe
  C:\Windows\System\QsNVkvn.exe
  2⤵
  PID:6240
- C:\Windows\System\mrhgfNN.exe
  C:\Windows\System\mrhgfNN.exe
  2⤵
  PID:11116
- C:\Windows\System\HnVzkMK.exe
  C:\Windows\System\HnVzkMK.exe
  2⤵
  PID:7488
- C:\Windows\System\WUgEKfx.exe
  C:\Windows\System\WUgEKfx.exe
  2⤵
  PID:9240
- C:\Windows\System\kawPUMi.exe
  C:\Windows\System\kawPUMi.exe
  2⤵
  PID:4944
- C:\Windows\System\iqkjuAr.exe
  C:\Windows\System\iqkjuAr.exe
  2⤵
  PID:11716
- C:\Windows\System\TLqHhGw.exe
  C:\Windows\System\TLqHhGw.exe
  2⤵
  PID:11788
- C:\Windows\System\viyXbmi.exe
  C:\Windows\System\viyXbmi.exe
  2⤵
  PID:11836
- C:\Windows\System\gswVHRa.exe
  C:\Windows\System\gswVHRa.exe
  2⤵
  PID:11964
- C:\Windows\System\DLIzdZJ.exe
  C:\Windows\System\DLIzdZJ.exe
  2⤵
  PID:12032
- C:\Windows\System\cQTzUHx.exe
  C:\Windows\System\cQTzUHx.exe
  2⤵
  PID:10784
- C:\Windows\System\qoWTTMw.exe
  C:\Windows\System\qoWTTMw.exe
  2⤵
  PID:10816
- C:\Windows\System\BVcgMUC.exe
  C:\Windows\System\BVcgMUC.exe
  2⤵
  PID:11384
- C:\Windows\System\vtoNxZn.exe
  C:\Windows\System\vtoNxZn.exe
  2⤵
  PID:10968
- C:\Windows\System\XGenWrH.exe
  C:\Windows\System\XGenWrH.exe
  2⤵
  PID:11576
- C:\Windows\System\IePdEfD.exe
  C:\Windows\System\IePdEfD.exe
  2⤵
  PID:13328
- C:\Windows\System\FMtRkKg.exe
  C:\Windows\System\FMtRkKg.exe
  2⤵
  PID:13344
- C:\Windows\System\xiBWEiJ.exe
  C:\Windows\System\xiBWEiJ.exe
  2⤵
  PID:13360
- C:\Windows\System\gHSEwHk.exe
  C:\Windows\System\gHSEwHk.exe
  2⤵
  PID:13384
- C:\Windows\System\hGYuYPk.exe
  C:\Windows\System\hGYuYPk.exe
  2⤵
  PID:13428
- C:\Windows\System\eccHHbo.exe
  C:\Windows\System\eccHHbo.exe
  2⤵
  PID:13444
- C:\Windows\System\TjvhfNK.exe
  C:\Windows\System\TjvhfNK.exe
  2⤵
  PID:14092
- C:\Windows\System\PfJLmWo.exe
  C:\Windows\System\PfJLmWo.exe
  2⤵
  PID:14112
- C:\Windows\System\lqjzjFs.exe
  C:\Windows\System\lqjzjFs.exe
  2⤵
  PID:14128
- C:\Windows\System\ROElhQb.exe
  C:\Windows\System\ROElhQb.exe
  2⤵
  PID:14148
- C:\Windows\System\fzlUNEJ.exe
  C:\Windows\System\fzlUNEJ.exe
  2⤵
  PID:14168
- C:\Windows\System\kyGhMXj.exe
  C:\Windows\System\kyGhMXj.exe
  2⤵
  PID:14188
- C:\Windows\System\ETfoToS.exe
  C:\Windows\System\ETfoToS.exe
  2⤵
  PID:14212
- C:\Windows\System\cSIMEQe.exe
  C:\Windows\System\cSIMEQe.exe
  2⤵
  PID:14240
- C:\Windows\System\oMSOXkx.exe
  C:\Windows\System\oMSOXkx.exe
  2⤵
  PID:14260
- C:\Windows\System\dKszTpk.exe
  C:\Windows\System\dKszTpk.exe
  2⤵
  PID:14284
- C:\Windows\System\oUbYKLi.exe
  C:\Windows\System\oUbYKLi.exe
  2⤵
  PID:14308
- C:\Windows\System\xVpLXze.exe
  C:\Windows\System\xVpLXze.exe
  2⤵
  PID:14328
- C:\Windows\System\uMaYFwf.exe
  C:\Windows\System\uMaYFwf.exe
  2⤵
  PID:11108
- C:\Windows\System\WIzxxfJ.exe
  C:\Windows\System\WIzxxfJ.exe
  2⤵
  PID:11696
- C:\Windows\System\gVIfZWD.exe
  C:\Windows\System\gVIfZWD.exe
  2⤵
  PID:12704
- C:\Windows\System\ySjoKAr.exe
  C:\Windows\System\ySjoKAr.exe
  2⤵
  PID:11764
- C:\Windows\System\vYrCZeY.exe
  C:\Windows\System\vYrCZeY.exe
  2⤵
  PID:12792
- C:\Windows\System\iADdXzf.exe
  C:\Windows\System\iADdXzf.exe
  2⤵
  PID:11260
- C:\Windows\System\UDZonup.exe
  C:\Windows\System\UDZonup.exe
  2⤵
  PID:11868
- C:\Windows\System\cnXhDrl.exe
  C:\Windows\System\cnXhDrl.exe
  2⤵
  PID:12920
- C:\Windows\System\GzjMHIv.exe
  C:\Windows\System\GzjMHIv.exe
  2⤵
  PID:11908
- C:\Windows\System\cMYBAQX.exe
  C:\Windows\System\cMYBAQX.exe
  2⤵
  PID:13044
- C:\Windows\System\fPeamxm.exe
  C:\Windows\System\fPeamxm.exe
  2⤵
  PID:11068
- C:\Windows\System\iZvVjWB.exe
  C:\Windows\System\iZvVjWB.exe
  2⤵
  PID:10288
- C:\Windows\System\vdSMcmT.exe
  C:\Windows\System\vdSMcmT.exe
  2⤵
  PID:1592
- C:\Windows\System\BbmhfYo.exe
  C:\Windows\System\BbmhfYo.exe
  2⤵
  PID:9396
- C:\Windows\System\IrnfqZj.exe
  C:\Windows\System\IrnfqZj.exe
  2⤵
  PID:3880
- C:\Windows\System\mynoAQi.exe
  C:\Windows\System\mynoAQi.exe
  2⤵
  PID:9792
- C:\Windows\System\NkKNoov.exe
  C:\Windows\System\NkKNoov.exe
  2⤵
  PID:10524
- C:\Windows\System\FHQpxGg.exe
  C:\Windows\System\FHQpxGg.exe
  2⤵
  PID:9000
- C:\Windows\System\LPuUxmX.exe
  C:\Windows\System\LPuUxmX.exe
  2⤵
  PID:8420
- C:\Windows\System\ZsvCrsu.exe
  C:\Windows\System\ZsvCrsu.exe
  2⤵
  PID:11336
- C:\Windows\System\usSDDyA.exe
  C:\Windows\System\usSDDyA.exe
  2⤵
  PID:11432
- C:\Windows\System\BiGFuOP.exe
  C:\Windows\System\BiGFuOP.exe
  2⤵
  PID:11552
- C:\Windows\System\urExRit.exe
  C:\Windows\System\urExRit.exe
  2⤵
  PID:13356
- C:\Windows\System\GeUlZnK.exe
  C:\Windows\System\GeUlZnK.exe
  2⤵
  PID:12516
- C:\Windows\System\wfCXrFt.exe
  C:\Windows\System\wfCXrFt.exe
  2⤵
  PID:11608
- C:\Windows\System\SLMgtLm.exe
  C:\Windows\System\SLMgtLm.exe
  2⤵
  PID:12596
- C:\Windows\System\udYEBNq.exe
  C:\Windows\System\udYEBNq.exe
  2⤵
  PID:12684
- C:\Windows\System\RHHUdol.exe
  C:\Windows\System\RHHUdol.exe
  2⤵
  PID:12780
- C:\Windows\System\aUdypze.exe
  C:\Windows\System\aUdypze.exe
  2⤵
  PID:12904
- C:\Windows\System\phgltOM.exe
  C:\Windows\System\phgltOM.exe
  2⤵
  PID:12964
- C:\Windows\System\qRgHJbL.exe
  C:\Windows\System\qRgHJbL.exe
  2⤵
  PID:11940
- C:\Windows\System\UypGlNW.exe
  C:\Windows\System\UypGlNW.exe
  2⤵
  PID:11988
- C:\Windows\System\NubNurR.exe
  C:\Windows\System\NubNurR.exe
  2⤵
  PID:13196
- C:\Windows\System\ZbnyjDm.exe
  C:\Windows\System\ZbnyjDm.exe
  2⤵
  PID:13260
- C:\Windows\System\jjzoODr.exe
  C:\Windows\System\jjzoODr.exe
  2⤵
  PID:12120
- C:\Windows\System\YdygUOd.exe
  C:\Windows\System\YdygUOd.exe
  2⤵
  PID:13300
- C:\Windows\System\LLyOtuC.exe
  C:\Windows\System\LLyOtuC.exe
  2⤵
  PID:7560
- C:\Windows\System\hJNiplg.exe
  C:\Windows\System\hJNiplg.exe
  2⤵
  PID:4176
- C:\Windows\System\VeKXAqJ.exe
  C:\Windows\System\VeKXAqJ.exe
  2⤵
  PID:13680
- C:\Windows\System\iydFLuD.exe
  C:\Windows\System\iydFLuD.exe
  2⤵
  PID:12172
- C:\Windows\System\bTtmrmw.exe
  C:\Windows\System\bTtmrmw.exe
  2⤵
  PID:12212
- C:\Windows\System\VrAnXDM.exe
  C:\Windows\System\VrAnXDM.exe
  2⤵
  PID:9332
- C:\Windows\System\HsAYlxo.exe
  C:\Windows\System\HsAYlxo.exe
  2⤵
  PID:8476
- C:\Windows\System\NvaIATc.exe
  C:\Windows\System\NvaIATc.exe
  2⤵
  PID:10872
- C:\Windows\System\RMUjIWM.exe
  C:\Windows\System\RMUjIWM.exe
  2⤵
  PID:10112
- C:\Windows\System\jBdoLYN.exe
  C:\Windows\System\jBdoLYN.exe
  2⤵
  PID:9376
- C:\Windows\System\dNzEkPT.exe
  C:\Windows\System\dNzEkPT.exe
  2⤵
  PID:10812
- C:\Windows\System\JLKGCyy.exe
  C:\Windows\System\JLKGCyy.exe
  2⤵
  PID:9816
- C:\Windows\System\PeZdgrb.exe
  C:\Windows\System\PeZdgrb.exe
  2⤵
  PID:8328
- C:\Windows\System\MpyPubv.exe
  C:\Windows\System\MpyPubv.exe
  2⤵
  PID:11516
- C:\Windows\System\ReddlXe.exe
  C:\Windows\System\ReddlXe.exe
  2⤵
  PID:7124
- C:\Windows\System\DSdMvKt.exe
  C:\Windows\System\DSdMvKt.exe
  2⤵
  PID:13440
- C:\Windows\System\otMdHEB.exe
  C:\Windows\System\otMdHEB.exe
  2⤵
  PID:14064
- C:\Windows\System\jMSFceY.exe
  C:\Windows\System\jMSFceY.exe
  2⤵
  PID:13612
- C:\Windows\System\aNKcyiG.exe
  C:\Windows\System\aNKcyiG.exe
  2⤵
  PID:13644
- C:\Windows\System\FwYsCkq.exe
  C:\Windows\System\FwYsCkq.exe
  2⤵
  PID:13660
- C:\Windows\System\mfcoXwb.exe
  C:\Windows\System\mfcoXwb.exe
  2⤵
  PID:14108
- C:\Windows\System\vAxlwUN.exe
  C:\Windows\System\vAxlwUN.exe
  2⤵
  PID:14144
- C:\Windows\System\dBGICcH.exe
  C:\Windows\System\dBGICcH.exe
  2⤵
  PID:14184
- C:\Windows\System\PXJaKyf.exe
  C:\Windows\System\PXJaKyf.exe
  2⤵
  PID:11176
- C:\Windows\System\gJiehCa.exe
  C:\Windows\System\gJiehCa.exe
  2⤵
  PID:1668
- C:\Windows\System\FTWPDFH.exe
  C:\Windows\System\FTWPDFH.exe
  2⤵
  PID:11700
- C:\Windows\System\FbBxWba.exe
  C:\Windows\System\FbBxWba.exe
  2⤵
  PID:4484
- C:\Windows\System\GdSeNlp.exe
  C:\Windows\System\GdSeNlp.exe
  2⤵
  PID:4040
- C:\Windows\System\lzVEYtA.exe
  C:\Windows\System\lzVEYtA.exe
  2⤵
  PID:12496
- C:\Windows\System\pAwCXZL.exe
  C:\Windows\System\pAwCXZL.exe
  2⤵
  PID:3200
- C:\Windows\System\jGgvupE.exe
  C:\Windows\System\jGgvupE.exe
  2⤵
  PID:12168
- C:\Windows\System\iZrZTUd.exe
  C:\Windows\System\iZrZTUd.exe
  2⤵
  PID:9528
- C:\Windows\System\KHVhqlJ.exe
  C:\Windows\System\KHVhqlJ.exe
  2⤵
  PID:11096
- C:\Windows\System\OJyOFyI.exe
  C:\Windows\System\OJyOFyI.exe
  2⤵
  PID:11408
- C:\Windows\System\oDWZXIZ.exe
  C:\Windows\System\oDWZXIZ.exe
  2⤵
  PID:4556
- C:\Windows\System\rXmHWQk.exe
  C:\Windows\System\rXmHWQk.exe
  2⤵
  PID:13688
- C:\Windows\System\skXxHmn.exe
  C:\Windows\System\skXxHmn.exe
  2⤵
  PID:13236
- C:\Windows\System\HsfOlAJ.exe
  C:\Windows\System\HsfOlAJ.exe
  2⤵
  PID:12996
- C:\Windows\System\BgqKPvl.exe
  C:\Windows\System\BgqKPvl.exe
  2⤵
  PID:8852
- C:\Windows\System\RBSELUN.exe
  C:\Windows\System\RBSELUN.exe
  2⤵
  PID:9856
- C:\Windows\System\vgWIzkw.exe
  C:\Windows\System\vgWIzkw.exe
  2⤵
  PID:13216
- C:\Windows\System\YrQfkTu.exe
  C:\Windows\System\YrQfkTu.exe
  2⤵
  PID:13604
- C:\Windows\System\gSUZiru.exe
  C:\Windows\System\gSUZiru.exe
  2⤵
  PID:10068
- C:\Windows\System\nlRcFdn.exe
  C:\Windows\System\nlRcFdn.exe
  2⤵
  PID:13900
- C:\Windows\System\FRkzBoD.exe
  C:\Windows\System\FRkzBoD.exe
  2⤵
  PID:3480
- C:\Windows\System\WZiyxQG.exe
  C:\Windows\System\WZiyxQG.exe
  2⤵
  PID:13832
- C:\Windows\System\qGxXkvM.exe
  C:\Windows\System\qGxXkvM.exe
  2⤵
  PID:14340
- C:\Windows\System\wfIkxgi.exe
  C:\Windows\System\wfIkxgi.exe
  2⤵
  PID:14436
- C:\Windows\System\fSdvIce.exe
  C:\Windows\System\fSdvIce.exe
  2⤵
  PID:14504
- C:\Windows\System\eWEJrti.exe
  C:\Windows\System\eWEJrti.exe
  2⤵
  PID:14540
- C:\Windows\System\QCVfGXI.exe
  C:\Windows\System\QCVfGXI.exe
  2⤵
  PID:14560
- C:\Windows\System\ZEMZVKi.exe
  C:\Windows\System\ZEMZVKi.exe
  2⤵
  PID:14576
- C:\Windows\System\dGWyQgZ.exe
  C:\Windows\System\dGWyQgZ.exe
  2⤵
  PID:14596
- C:\Windows\System\ITIdkJm.exe
  C:\Windows\System\ITIdkJm.exe
  2⤵
  PID:14628
- C:\Windows\System\oxnpLSD.exe
  C:\Windows\System\oxnpLSD.exe
  2⤵
  PID:14648
- C:\Windows\System\rkLWqTf.exe
  C:\Windows\System\rkLWqTf.exe
  2⤵
  PID:14672
- C:\Windows\System\BouvzuJ.exe
  C:\Windows\System\BouvzuJ.exe
  2⤵
  PID:14700
- C:\Windows\System\amgDtdP.exe
  C:\Windows\System\amgDtdP.exe
  2⤵
  PID:14724
- C:\Windows\System\JgHqjOH.exe
  C:\Windows\System\JgHqjOH.exe
  2⤵
  PID:14788
- C:\Windows\System\nnDaaoy.exe
  C:\Windows\System\nnDaaoy.exe
  2⤵
  PID:14812
- C:\Windows\System\WFvOJGB.exe
  C:\Windows\System\WFvOJGB.exe
  2⤵
  PID:14844
- C:\Windows\System\hFARSPo.exe
  C:\Windows\System\hFARSPo.exe
  2⤵
  PID:14868
- C:\Windows\System\yRgWHMn.exe
  C:\Windows\System\yRgWHMn.exe
  2⤵
  PID:14892
- C:\Windows\System\kbYhqSs.exe
  C:\Windows\System\kbYhqSs.exe
  2⤵
  PID:14912
- C:\Windows\System\JVsUHNl.exe
  C:\Windows\System\JVsUHNl.exe
  2⤵
  PID:15292
- C:\Windows\System\lQaZpNe.exe
  C:\Windows\System\lQaZpNe.exe
  2⤵
  PID:14228
- C:\Windows\System\VvVIghg.exe
  C:\Windows\System\VvVIghg.exe
  2⤵
  PID:12408
- C:\Windows\System\AeSrJxa.exe
  C:\Windows\System\AeSrJxa.exe
  2⤵
  PID:13636
- C:\Windows\System\fdtERwn.exe
  C:\Windows\System\fdtERwn.exe
  2⤵
  PID:12876
- C:\Windows\System\zbfbUTT.exe
  C:\Windows\System\zbfbUTT.exe
  2⤵
  PID:14484
- C:\Windows\System\jrCkYZf.exe
  C:\Windows\System\jrCkYZf.exe
  2⤵
  PID:14500
- C:\Windows\System\mJJrxps.exe
  C:\Windows\System\mJJrxps.exe
  2⤵
  PID:14352
- C:\Windows\System\gHEQjSq.exe
  C:\Windows\System\gHEQjSq.exe
  2⤵
  PID:168
- C:\Windows\System\IXbLXJR.exe
  C:\Windows\System\IXbLXJR.exe
  2⤵
  PID:1524
- C:\Windows\System\PKrdsLa.exe
  C:\Windows\System\PKrdsLa.exe
  2⤵
  PID:13156
- C:\Windows\System\PEBLYUO.exe
  C:\Windows\System\PEBLYUO.exe
  2⤵
  PID:14492
- C:\Windows\System\noHVxaF.exe
  C:\Windows\System\noHVxaF.exe
  2⤵
  PID:14180
- C:\Windows\System\TSScfsL.exe
  C:\Windows\System\TSScfsL.exe
  2⤵
  PID:13168
- C:\Windows\System\DHKQkUt.exe
  C:\Windows\System\DHKQkUt.exe
  2⤵
  PID:14364
- C:\Windows\System\qOUJOgh.exe
  C:\Windows\System\qOUJOgh.exe
  2⤵
  PID:14400
- C:\Windows\System\KmspQTZ.exe
  C:\Windows\System\KmspQTZ.exe
  2⤵
  PID:14756
- C:\Windows\System\Dpvqaty.exe
  C:\Windows\System\Dpvqaty.exe
  2⤵
  PID:14476
- C:\Windows\System\WGFdydO.exe
  C:\Windows\System\WGFdydO.exe
  2⤵
  PID:14532
- C:\Windows\System\BnavUbj.exe
  C:\Windows\System\BnavUbj.exe
  2⤵
  PID:4540
- C:\Windows\System\IlmvvIQ.exe
  C:\Windows\System\IlmvvIQ.exe
  2⤵
  PID:14748
- C:\Windows\System\mGrFtaU.exe
  C:\Windows\System\mGrFtaU.exe
  2⤵
  PID:15004
- C:\Windows\System\mTBHeau.exe
  C:\Windows\System\mTBHeau.exe
  2⤵
  PID:15072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BYwpItl.exe

Filesize
1.5MB

MD5
c0c0bb06d4a3bc13a0aa6deda219626e

SHA1
7de0fadbc8391537f383483cd2792d2999b3e74f

SHA256
1bf3bf90d0171605f3fe5ed85f814d9177d75e44d5ad46d2e137f35afab37156

SHA512
ad1c9a7a08cf60009e30d848555c9a852d5f61d916f0f4fcb880f53ecfb4d116d8124482f9794910fb955cae08ae5358544f42f69e1e51657b3bc43843a985ce

Download Submit
C:\Windows\System\DSwLktA.exe

Filesize
1.5MB

MD5
428bec578d4924c9ffee106ca6135b3d

SHA1
379f44a9349de0fa8ce1adc538e3e3ed93ababcb

SHA256
fd8600ec89c41a776cc6b87c427d52379f84a5a42e90d35d4de79521a0b8f204

SHA512
6f8faf5e29b9662e7c57a3cd47ea959c25c3993319f9b805e3e3f568eec03a50280a18d26ce7167c0fb6377ee1c7e5e12fe22f837a7898fa90b094c64383edec

Download Submit
C:\Windows\System\EfeHUff.exe

Filesize
1.5MB

MD5
e1cb7de494f98342d974a5bdf42ca321

SHA1
2ac3e83d922b3e49ca099457aa6eb39918af7ad2

SHA256
f963924f9b5b1f15e1e09cdde663aa2edd04010c9ea7af103c7e50e4926b204a

SHA512
24cf231bd9c041ad732d6a8d2f403f4b1c1f97a2d91e7bbfe2ce4d9b1a9a7cda41618510387389440ae38e90364b3d74c947582055713f2db27382053131ab32

Download Submit
C:\Windows\System\GapaELG.exe

Filesize
1.5MB

MD5
52485aa26831600cfcd7bfa4b833a9e0

SHA1
d445032374d3363a55356cfce6ad214e50e5b9bc

SHA256
7394e55bf11e65e5412add85b28469482c6564deba05e6620fdf1874d1b1a1a0

SHA512
0e9c63573a4eeed40e0a5de6fc26ae717fef53e2c70ad867c907eacb600cee6796c250f4d2890c58e0a24be2d7a9eb8858f84c8104ed3efe684ad73a364731cf

Download Submit
C:\Windows\System\GgTzKqU.exe

Filesize
1.5MB

MD5
e9f733a73b63a024299c391aec337edb

SHA1
fdc4e1a0a27de495e738d760e1c5519feafbaa07

SHA256
bc5d6c5c5131f345c99096e5238d6d5be67ca7acd35893e0970265bd623b8af0

SHA512
940a61f2538d15c110bc6d6838908496d6e2ac20d5a50a928c99abb3a14e508c30a9b79c9af0ea6bb22f267b9ed52a63e0dccb49273ae464d3907b5d6d3d43a8

Download Submit
C:\Windows\System\HgKFlKn.exe

Filesize
1.5MB

MD5
48c73c5d4300ef17a4b08d0cd466956f

SHA1
ff6acfb781236b564d911baaf89e895a82da4516

SHA256
14acc7c69704d17d1d174fb146601bfd6457657142f11b983a0a9d888a153bd5

SHA512
2fae26da0b1cd67ddbef949be0fe180844d57917961d41b205f7f34a6a2f84f1c9828c0675838f37e0937494caea8f436d92bcc5f5deee151e7beaed10cd057d

Download Submit
C:\Windows\System\JauCnFM.exe

Filesize
1.5MB

MD5
b11b276eede622ad0ff155070b0f77cf

SHA1
8e92ecbe83d55dfd932a0a46fbaee13645d9f4b6

SHA256
000be47dc188d223ca879e971019d7a7359eca1d056ca85fe869d9e5ff02aff5

SHA512
82a78856cd220727c7dc81a035b758eba9fd60a07b4d1dc254d6e2dbe894f131f3caf9d96bb80e31bdafebd852651154df53d336250d3b7a56bd7d23bc4028cc

Download Submit
C:\Windows\System\LCdqLDk.exe

Filesize
1.5MB

MD5
94923af9ff80389077a6f8da626f893b

SHA1
76998cbc253da3fc53311380889426cc778c058f

SHA256
048f6f25cf69a4ce42f00afa4463a3e15360721a4fc531ed7bf131574376183c

SHA512
217ca8eb3b6c857c132678516de21abc5f4bc750742e7a8356d931a983767e8c4306307db6776ae74d7ced6e62960a0e1af5adc4a9c570dc47d2c02becb6b4b4

Download Submit
C:\Windows\System\LMQIWPi.exe

Filesize
1.5MB

MD5
e792038a040e93b05601bdf55044d233

SHA1
b01e1c08376f23e751a08d0b880d15de8e1c2731

SHA256
bc9e4aacc2b26e35b0484ed635265df9daf358b7c5bbf0608f4ccd55dd01c0b1

SHA512
442c1dc4220e1e13c99660a4ece7d753dfb2d33dfb68a0805c3533f653ad64de4f224ba8bddb751a8d7a3a2e922f010d4e1c17024328bb9ca40096e4652ad5a8

Download Submit
C:\Windows\System\OkOrTyI.exe

Filesize
1.5MB

MD5
f99f77c5393de5ba2ee135178b5322f3

SHA1
ee1fac44fff555b51f2377affefa9dd7a7b98952

SHA256
1c90181fe80afb7b87b307917311d1b062db615a58089654491e9b48a9d4f33e

SHA512
f0b278e0333fd276faf78e050e558a9dde4a541df080dd8b3260f1586d107998543e536447f2fe6596ff0a359746d5b712124010c09a36a14248e5f317b87dff

Download Submit
C:\Windows\System\RGIPJec.exe

Filesize
1.5MB

MD5
1a63c57824910c3f078edabc3b9066fb

SHA1
a7590b023d71a8a8c74031168ec55f83adf13889

SHA256
c12c46baacc14dc76e232eb00357c0f25f983d66910c5d2e44ceaf7da7e56843

SHA512
359b50dada7bd96f0347b208541e4fa725b98df41a06967a6fc401ba85f59ef870e65a7412d2faba808f3f8b3ad1f0a5fc82f5bceff9b913b82400d08f31e176

Download Submit
C:\Windows\System\SGPjSjk.exe

Filesize
1.5MB

MD5
0e80fb198bb7f8b9d38009d180e630d6

SHA1
329ea46d966c80f71fbdc348cbe6088a8bc464b0

SHA256
8bfc749be1ec8b045e79b003c0376f6d10dde321af6b608cb3dbcdc749b6982d

SHA512
2b31ee23304e9867231a7c6da95adbd26b9883574141686f135c65e5a012963fee950bdc9fd76822e9bfaa4acb81566d4d52e50532d473e5c5cbb9113fca8e23

Download Submit
C:\Windows\System\SRDqxSV.exe

Filesize
1.5MB

MD5
544e97b67d4097a330381b0a77919e2e

SHA1
af37e99dbd8ee4f874cfc106ebc04be1bfef80c6

SHA256
64c4492797e703ca4b2afd0191e21b8803dc91ad977d4ef0638a263156d3a292

SHA512
29f4b50ace6fd00b25404f43af450b2172318e026353b1edca59276875ba99bb2c2b15b8ded13573473f7da842f7bc49296bc81be874a90aef3655b6fbd5df7c

Download Submit
C:\Windows\System\TWMSylz.exe

Filesize
1.5MB

MD5
ed76990fd611bd421b55c9cc2444f66a

SHA1
c97756b6c36f9afd4b3da6b23c20375facc362e3

SHA256
eb8119c906ed09347c25e12a1a418da47abf5c5221234a250b85112321367b56

SHA512
5060747901cec73297b928eb3558739f04bae849ad5366871c13e0261d73ddd1b57e856409157033e9bcac69cbb0882f8330262022b13a7fc539be60c57f1401

Download Submit
C:\Windows\System\UjdQbAv.exe

Filesize
1.5MB

MD5
00527c834efb590d28a4a8dadd38356d

SHA1
ccfff297d2e251b6e1fe2694805eba2862b38dba

SHA256
faf9872170006fc523f16dc66ac8286a6985d99139d00a0d0d732bcf944a0f7a

SHA512
def1603f4c1b016fdd1a13b1e16c0cc95a7daf480fb356b70a849d49562f4bb3ea9431d4b2cf33be19c27e7350940be50eea00d34fe5e3d0f5b7ab3895ba4f89

Download Submit
C:\Windows\System\VSOpOSI.exe

Filesize
1.5MB

MD5
7f2816a1739b53c31a971d2536155eb4

SHA1
e29e569ca0a716ddc7054d27d606e94569b0539b

SHA256
ee42388e688c92fe0653cb558221673475beeb7eeb6f0d3076b74a70b19cc4f8

SHA512
be5b8c56e0a0a6294e1a08548d37cedc2ac0ea1acbcdd512bb50ab13b3bb327fe9774bbef2fa9628c1a26298efb7b22d193653d95c5459a4cdc472eeb0e73278

Download Submit
C:\Windows\System\VYMwfmm.exe

Filesize
1.5MB

MD5
ece046279a814c14d2678666b8c804c3

SHA1
86f16a008b201fb069f98cf4cad0613d23a4defb

SHA256
0fca20adebe5ba4e8697c6dca5a7befd4dea45a8b9df195bca6ae70d24f4ceed

SHA512
8946497e5bf2b66e7ee64decfe360bb17ded6e129b717b02c94327ab35ffd75bb900af2fc089221e11cd43fa0b047597a7a8ab93a7286ff2152f17563aa89f46

Download Submit
C:\Windows\System\XROmFNo.exe

Filesize
1.5MB

MD5
b7aed2fb83b551af8460b58f6d520de6

SHA1
231946e9574885f8f95f20b6a5b39cc6c1cdc919

SHA256
3706d20bb7b45fd497eb0fda5628bb37a5a5bb96e0081c4c3c4b86dc52c03458

SHA512
c16f597e52b5c15807b260f8e5f7f61fbce8bbd0cbb894b29b3c351a4277e1a11322745bc5ceb515816fbe1785725b7beb3763011739d62efb7598a80dcfa452

Download Submit
C:\Windows\System\XsrPMjT.exe

Filesize
1.5MB

MD5
62c9a705e523a9ef5d2f215b8fbc2232

SHA1
182162d0c8f8715351bd0a1b5b985aee0ee3002b

SHA256
a3367e704f1b8cd1b0e0d8ff01d764ee83a82b40f5160ee35d70a796cf0755c9

SHA512
e8a6b5e4656bad806227908a8c27b903fa4df625e13d0ead278ea9f8b07b774886d1ba02771a0ff5d0b706a2d8acd08c2571640cb1029a57fbc33a238c0a2ecb

Download Submit
C:\Windows\System\Xwpffgo.exe

Filesize
1.5MB

MD5
d7654f3c5d4135ac3f324e361ecaf923

SHA1
2843ace8ee25bfb7db777232e094c932d7636c9a

SHA256
50abd7d9005db63a1589d126ee153a5fbe382a84980cc9e9603c34c5af7e9644

SHA512
cfc9c8141ca34b1655e65f726f77087c3a79883e00776b9f0a4b0d7746bb059e6eef59fd3a1ad220c80e7fdac8efcc3fdabfd140d775311c56a43d3d81162fb0

Download Submit
C:\Windows\System\YWfzdpG.exe

Filesize
1.5MB

MD5
da0b21dc745f15725121ae1a99de8ea2

SHA1
0f07d17c51b3ff5779c2f53669a8176d3f040e1d

SHA256
e871a0af7633aeca4b0d23eac050fda3390722e6e2a6215f8faa94c2e5d2dd73

SHA512
a12f9a998161330a0a27d2032c3039df3ed5c197604db85c5a188b232d213b23f4768752ed6c2bd899ba2da85ea3de53bd8584f247f3a1b51a2bd99cb0844119

Download Submit
C:\Windows\System\YfHefDY.exe

Filesize
1.5MB

MD5
9076858f6e22cf3d4d9788db24734dd1

SHA1
e65f83798c047c178625f8fe4ca7bc247a9a3134

SHA256
e7b0afc03bd66f81b3a8268b58a304812a4a3bccd38036978651b9f01b267083

SHA512
0bb791ff9651c6b896562e2e039a5ccd00eec7356073767c9d107c23f3560e3253557f045f8853cd395f9ae088e442d97729f61954f36a94fec84d55bc7a7870

Download Submit
C:\Windows\System\YpHKMbg.exe

Filesize
1.5MB

MD5
86bee9ffb7d900866bae07bd322ee592

SHA1
5b71518b336246c0daef18e632a61f55cac098e4

SHA256
ae4d4b4f2dd0c784ca9a6dc83f89fed96cb070792570000082742794ca87ddd8

SHA512
8f3cb76425930d7519c17c139b0d23a5b112da0e889174e04c924a62e004b1e935f78522b95b5a92b09e3bd589097a661ef013149b4db994c544a7a95674a7ef

Download Submit
C:\Windows\System\ZWRnWij.exe

Filesize
1.5MB

MD5
64add20799286a3d6a9df9b583ad4ab3

SHA1
93fed5dd9f7d4c684a3b149c6cd162091a1e72d0

SHA256
1018b6660db0599ecb38babbfe6fb6813a7ce4e43db4750d412a8495a0c2f15f

SHA512
394ebc68008bac3ba5589513d44b51f4bac58fe3b715c5bdff2bb7e1e3eb434f2bb38a65d9932f8b6ff7d0e8fb2a464d379f4fc6f3c0674afc58fa662be97ec8

Download Submit
C:\Windows\System\bUCZvDZ.exe

Filesize
1.5MB

MD5
798c878a37f31a68054f3869864b4354

SHA1
d1ac189b0aa466cf63177983a13148dd1e45c168

SHA256
2f963857ed534b7ccf76ebe22eaa2fcba915c26ab7492e984bb1f1f54e1bf3c8

SHA512
57694897a1663527236f44e27e5a1b35a00796b71ef41f8e10fd6d27978842dce9916dc4617068c9d5fbb18eac0de6eb41dedcb5eb027e953ec444d47007df74

Download Submit
C:\Windows\System\beNdHuJ.exe

Filesize
1.5MB

MD5
892e5493ed9c06f73a4886276dce0055

SHA1
43187d2398e2585124209b9ee1c6395319e7fa94

SHA256
5719de3cfec2ef07bcd7683f8c833b6d2de8a92c97ee4512de0684ad30f65b1b

SHA512
b205d7c3b4a3fdc62b51f367e691feeb3d346e8e8bb9e722b9d1733774155fd3354be617335ababdb9a7ba149adaa218d5fccc5f39a18af1531f7407112f5d41

Download Submit
C:\Windows\System\caLHbhO.exe

Filesize
1.5MB

MD5
5f46d56fe4929db63a5c9d294f5f182c

SHA1
151a0aadda5bf07d8b25a84d45f2fd880645c497

SHA256
c7f61c2253f02320f259eadbaa166617367dff5ed3f35f8da6020e79b0193bb4

SHA512
217adbf5faa201f2f8773857c98fb9f26ac1f98bd73f54a5ee9f55b03bdd0bc74602ca59751de86a61ae31cc7da664e2123f249e7415d0dd54ff05cc9da8c3f5

Download Submit
C:\Windows\System\fLhvuun.exe

Filesize
1.5MB

MD5
8f9163e5f51123b9c6c81bd8ba397f8c

SHA1
52f81c882c2a953e336c3f3f244c01fc6a3ee6d1

SHA256
e921803a4f586b0f4b26949b734f98663a6ba55de3492f64d6d6ca9f557cd993

SHA512
47cfcd7ca97f37b79d5f96b02c5219234659777c4561f23c0b083e94fa5aa46fa5b5d1bbaacba6240918da8de1b1ae827f9baec768f1d3e70b34052c11c40ae5

Download Submit
C:\Windows\System\fSojkQm.exe

Filesize
1.5MB

MD5
b0656e31b583ea405b2de7d4a2e30751

SHA1
02afe1387573a9dcd91c660477d9b480116e4869

SHA256
1648cc3f3c1e9ac4016ad513b7fcae3fbc2101d48802801a2b8aaef7d78f886d

SHA512
88c543f98e3b52e4cd4df1b85dac33b01e3c8bb1e653e1653f4eaa9881479d46f827148219e2bd46d814f7d4491163de2ddebcd22da28d28de3db1e0e0b83a96

Download Submit
C:\Windows\System\gvKKLsK.exe

Filesize
1.5MB

MD5
7b90eb057b5409d9daa5bcf4d47134e7

SHA1
9ac8973b9493c2e53c55fd3b7d11e4fb34612abe

SHA256
049ba50175a3c097c8c8f2d761def05c5f8bcf44636e73e729a4a1c044679e49

SHA512
8b5f9d20c8b4bc9167561bb384f011e433f700f588582e0024d93ae0482c7234c053c69086571c77e2f33c6efa3ab12494a1f1c65889103058a432d79ad1e185

Download Submit
C:\Windows\System\iApqeVS.exe

Filesize
1.5MB

MD5
8a252f693135129bf3bc2cfd2e1e5b7e

SHA1
8498d38adc7244495e049a12c5b31c63b048ddd3

SHA256
e32bc4ecd7c8046497474ede91b6b64671ffe77debf01a14cdda2a1f5e122022

SHA512
f2e338e181637c27c9ad15fc8b69bd17185174aed1740fcdcb4bdce6e14422c360d09d5fc0187801caea1a98c42b6608d1429b6c5dad43de58e4cd0196bcb191

Download Submit
C:\Windows\System\jpcumWS.exe

Filesize
1.5MB

MD5
ed2a6dacd6f4e2552382fa741e80dabe

SHA1
4e001790252931263fffe484072dc6e77cfff7be

SHA256
fb45d074cafc2a4e7a507927b1cba0039dd4b8e0f0af08ac58ae815336193505

SHA512
0da7fb62d49e30dc82b29726864e36bfece759a175577ec8ff532767fb115a6f9f3a49f2594803095f9e34e39f29a1d7f01ea47fa7350ad30c629026b9f8448a

Download Submit
C:\Windows\System\kDegNUb.exe

Filesize
1.5MB

MD5
553f05ea9e9fdf32bdf884b8fb9e5c9f

SHA1
729fe20948450524684f5890e2860236ad71516f

SHA256
59449d9d23e8468f58cd377bf9fd45425eccb5dd9018a1a13c79c33111bc067a

SHA512
6ef0cd8c3260611fbcadcbe49ae5fba8bfa45a768c5e08fdee464f01f2643910d8c61bcaa27e0597e4cf5a10db070930b6746e5d54641722b9494d31e8b91377

Download Submit
C:\Windows\System\lOaOPxZ.exe

Filesize
1.5MB

MD5
77e39ffe24985e3b535440ff8259bd6c

SHA1
ba73bc731c2c0cb77ae51ef2e1aa5df7d4167c50

SHA256
4c6cc00602a2fe2b41a3ea09d8cabdc502e92c0936eb7be465000d80818cf376

SHA512
20606106b86fb600a3c59bec53f292dfa4015d9f86f1433fc1713459ffb1e02e0098fdad3505a356225211efb9947efc11df61b61e7abca6684bdd14b4731fce

Download Submit
C:\Windows\System\lUUZYsF.exe

Filesize
1.5MB

MD5
cf19ab8b7c77157015d638b453f2bd90

SHA1
388bbd417346901bcb993bbd2e6aca61dfb566a8

SHA256
37de91bfbcf9ad5caa8c1df2eb25dfee955ad176642d17f6c59e507718609c7f

SHA512
85b514f5ef19a6f323b635f626618e4aba76ac8619df7561c7338d4302133171395c7c25c484cc94446a33919ca0f3f285b0a1a1e8fc70e72d51240c05aae5d1

Download Submit
C:\Windows\System\ljmdWSJ.exe

Filesize
1.5MB

MD5
fefd9398ef1b49def028d6bd9dde070c

SHA1
1d59566e8e3e0ed9519b1460503ef894cc2b5565

SHA256
078535d313e8fe9ad61d7f271fa38f3177fc6356cea0fca54749e861a2c1845a

SHA512
f2083bc7ab5910bbb8009818d694f7a10e5b8703f8221e21c8a18353f957052c1d607c870b430be848e11e7f2c12b115870d486512336c122a25c6854d738e52

Download Submit
C:\Windows\System\uPsEetl.exe

Filesize
1.5MB

MD5
ec52b228f73ad99f41ea5fc050d19b2d

SHA1
3501e2993b43d8a86466f62f59636ba51ab4e53e

SHA256
1578f01b6112d5585dc486e8a0028c8faef7ecf1ee7453d4fb9d9583bb9a64b2

SHA512
daaa5837d08d133fa6a9400707d23d5e5b721b67c5116b30abf81a1892e046ce18cb569ecbda0dd9c074f78661d9ce49f2959013c799f249797cebd08ae807ac

Download Submit
C:\Windows\System\vXKoBYq.exe

Filesize
1.5MB

MD5
e1fdad0c715008ab9a8c3de7abaee443

SHA1
e3d1696159ff5f708984e396c6dcf08027d643e0

SHA256
f110c2ab780c76f7b4d65d7c456e7297904d8850175afb12aab758777e291c11

SHA512
10895bbb2283b64bcbc72e5109480ee2800af7ebd9565334c44941670cecf5590635248d4b3a598f883fca0278257b0a8b17986f7a8f3b034ee045d41467d999

Download Submit
C:\Windows\System\wKuGTjA.exe

Filesize
1.5MB

MD5
dccea9654c3558c415925dfa90e35f82

SHA1
de6e846d7b0e4c499ee8be43fe701594156d8b56

SHA256
21169941eb4cb79debf89cf5d579f5655e5bad4c6c8625754af4971a8eb7c4f4

SHA512
bf2cbc3066555e1fa0c623a2195ea0530d89b84de2e84329d8c28c5b1447f376423b20f53ea7d7a61e928aa3cc1912f6a654fc771f7f874b078983937b43437b

Download Submit
C:\Windows\System\wLPHzvY.exe

Filesize
1.5MB

MD5
bfa791426f15a61d28cc708e4e5f7b06

SHA1
ae58cfbd2c154148747c4a233f9b69b91cdf3b9b

SHA256
29dd068e611ca4bb806c9cda5d280768d8a0b4e761205c16e8c5c2d8b8c942f2

SHA512
540d2ba62a1a2a713678df4af21c79ef284172c0cbd3102f39efbc5467229d34bb7aa440d77e010310a2486525100a6c4d891479145c7fa1d384f951fa6e4c38

Download Submit
C:\Windows\System\zmZkHqy.exe

Filesize
1.5MB

MD5
08bcdb44c77c92483db843c1bd38bdca

SHA1
f59d818a2a24e84e7df4f39362a01709c040dc59

SHA256
249732a2be18ae574d9df6bdd1d74bba12d5c0f7703b945b560322230de3cc50

SHA512
7dc17e49c31f68f18d5e62330302b24b8d4e9f599a8ea45eb9d59fe752652c102c5912879fc0a838d3b576b1677e646b45fc68a879077a74a380710dc7965e64

Download Submit
memory/548-2799-0x00007FF742540000-0x00007FF742891000-memory.dmp

Filesize
3.3MB

Download
memory/548-50-0x00007FF742540000-0x00007FF742891000-memory.dmp

Filesize
3.3MB

Download
memory/548-2764-0x00007FF742540000-0x00007FF742891000-memory.dmp

Filesize
3.3MB

Download
memory/640-0-0x00007FF7E6180000-0x00007FF7E64D1000-memory.dmp

Filesize
3.3MB

Download
memory/640-1-0x0000015A9FD30000-0x0000015A9FD40000-memory.dmp

Filesize
64KB

Download
memory/640-2629-0x00007FF7E6180000-0x00007FF7E64D1000-memory.dmp

Filesize
3.3MB

Download
memory/696-908-0x00007FF77CC40000-0x00007FF77CF91000-memory.dmp

Filesize
3.3MB

Download
memory/696-2815-0x00007FF77CC40000-0x00007FF77CF91000-memory.dmp

Filesize
3.3MB

Download
memory/1316-2791-0x00007FF730480000-0x00007FF7307D1000-memory.dmp

Filesize
3.3MB

Download
memory/1316-915-0x00007FF730480000-0x00007FF7307D1000-memory.dmp

Filesize
3.3MB

Download
memory/1492-2731-0x00007FF6EAF30000-0x00007FF6EB281000-memory.dmp

Filesize
3.3MB

Download
memory/1492-2795-0x00007FF6EAF30000-0x00007FF6EB281000-memory.dmp

Filesize
3.3MB

Download
memory/1492-154-0x00007FF6EAF30000-0x00007FF6EB281000-memory.dmp

Filesize
3.3MB

Download
memory/1584-2782-0x00007FF728590000-0x00007FF7288E1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-331-0x00007FF728590000-0x00007FF7288E1000-memory.dmp

Filesize
3.3MB

Download
memory/1680-212-0x00007FF6F49F0000-0x00007FF6F4D41000-memory.dmp

Filesize
3.3MB

Download
memory/1680-2811-0x00007FF6F49F0000-0x00007FF6F4D41000-memory.dmp

Filesize
3.3MB

Download
memory/1712-934-0x00007FF754CE0000-0x00007FF755031000-memory.dmp

Filesize
3.3MB

Download
memory/1712-2837-0x00007FF754CE0000-0x00007FF755031000-memory.dmp

Filesize
3.3MB

Download
memory/2316-2796-0x00007FF6C1AD0000-0x00007FF6C1E21000-memory.dmp

Filesize
3.3MB

Download
memory/2316-427-0x00007FF6C1AD0000-0x00007FF6C1E21000-memory.dmp

Filesize
3.3MB

Download
memory/2544-2814-0x00007FF626920000-0x00007FF626C71000-memory.dmp

Filesize
3.3MB

Download
memory/2544-71-0x00007FF626920000-0x00007FF626C71000-memory.dmp

Filesize
3.3MB

Download
memory/2544-2765-0x00007FF626920000-0x00007FF626C71000-memory.dmp

Filesize
3.3MB

Download
memory/2780-2779-0x00007FF627200000-0x00007FF627551000-memory.dmp

Filesize
3.3MB

Download
memory/2780-60-0x00007FF627200000-0x00007FF627551000-memory.dmp

Filesize
3.3MB

Download
memory/2780-2730-0x00007FF627200000-0x00007FF627551000-memory.dmp

Filesize
3.3MB

Download
memory/2932-423-0x00007FF6F81D0000-0x00007FF6F8521000-memory.dmp

Filesize
3.3MB

Download
memory/2932-2805-0x00007FF6F81D0000-0x00007FF6F8521000-memory.dmp

Filesize
3.3MB

Download
memory/3128-2842-0x00007FF7AF300000-0x00007FF7AF651000-memory.dmp

Filesize
3.3MB

Download
memory/3128-721-0x00007FF7AF300000-0x00007FF7AF651000-memory.dmp

Filesize
3.3MB

Download
memory/3208-648-0x00007FF6F9180000-0x00007FF6F94D1000-memory.dmp

Filesize
3.3MB

Download
memory/3208-2835-0x00007FF6F9180000-0x00007FF6F94D1000-memory.dmp

Filesize
3.3MB

Download
memory/3536-44-0x00007FF6857D0000-0x00007FF685B21000-memory.dmp

Filesize
3.3MB

Download
memory/3536-2775-0x00007FF6857D0000-0x00007FF685B21000-memory.dmp

Filesize
3.3MB

Download
memory/3840-2793-0x00007FF659600000-0x00007FF659951000-memory.dmp

Filesize
3.3MB

Download
memory/3840-933-0x00007FF659600000-0x00007FF659951000-memory.dmp

Filesize
3.3MB

Download
memory/4008-108-0x00007FF79BC00000-0x00007FF79BF51000-memory.dmp

Filesize
3.3MB

Download
memory/4008-2780-0x00007FF79BC00000-0x00007FF79BF51000-memory.dmp

Filesize
3.3MB

Download
memory/4120-513-0x00007FF7E20B0000-0x00007FF7E2401000-memory.dmp

Filesize
3.3MB

Download
memory/4120-2808-0x00007FF7E20B0000-0x00007FF7E2401000-memory.dmp

Filesize
3.3MB

Download
memory/4224-534-0x00007FF768B80000-0x00007FF768ED1000-memory.dmp

Filesize
3.3MB

Download
memory/4224-2809-0x00007FF768B80000-0x00007FF768ED1000-memory.dmp

Filesize
3.3MB

Download
memory/4236-2729-0x00007FF6DC2B0000-0x00007FF6DC601000-memory.dmp

Filesize
3.3MB

Download
memory/4236-2776-0x00007FF6DC2B0000-0x00007FF6DC601000-memory.dmp

Filesize
3.3MB

Download
memory/4236-26-0x00007FF6DC2B0000-0x00007FF6DC601000-memory.dmp

Filesize
3.3MB

Download
memory/4356-19-0x00007FF71D0F0000-0x00007FF71D441000-memory.dmp

Filesize
3.3MB

Download
memory/4356-2768-0x00007FF71D0F0000-0x00007FF71D441000-memory.dmp

Filesize
3.3MB

Download
memory/4380-2784-0x00007FF78F8A0000-0x00007FF78FBF1000-memory.dmp

Filesize
3.3MB

Download
memory/4380-913-0x00007FF78F8A0000-0x00007FF78FBF1000-memory.dmp

Filesize
3.3MB

Download
memory/4424-163-0x00007FF6F86E0000-0x00007FF6F8A31000-memory.dmp

Filesize
3.3MB

Download
memory/4424-2800-0x00007FF6F86E0000-0x00007FF6F8A31000-memory.dmp

Filesize
3.3MB

Download
memory/4424-2766-0x00007FF6F86E0000-0x00007FF6F8A31000-memory.dmp

Filesize
3.3MB

Download
memory/4448-2850-0x00007FF709070000-0x00007FF7093C1000-memory.dmp

Filesize
3.3MB

Download
memory/4448-649-0x00007FF709070000-0x00007FF7093C1000-memory.dmp

Filesize
3.3MB

Download
memory/4508-262-0x00007FF7DD7F0000-0x00007FF7DDB41000-memory.dmp

Filesize
3.3MB

Download
memory/4508-2804-0x00007FF7DD7F0000-0x00007FF7DDB41000-memory.dmp

Filesize
3.3MB

Download
memory/4544-722-0x00007FF7D1FC0000-0x00007FF7D2311000-memory.dmp

Filesize
3.3MB

Download
memory/4544-2843-0x00007FF7D1FC0000-0x00007FF7D2311000-memory.dmp

Filesize
3.3MB

Download
memory/4592-2788-0x00007FF744D50000-0x00007FF7450A1000-memory.dmp

Filesize
3.3MB

Download
memory/4592-327-0x00007FF744D50000-0x00007FF7450A1000-memory.dmp

Filesize
3.3MB

Download
memory/4628-2862-0x00007FF6F7A40000-0x00007FF6F7D91000-memory.dmp

Filesize
3.3MB

Download
memory/4628-823-0x00007FF6F7A40000-0x00007FF6F7D91000-memory.dmp

Filesize
3.3MB

Download
memory/4840-2852-0x00007FF6E0160000-0x00007FF6E04B1000-memory.dmp

Filesize
3.3MB

Download
memory/4840-826-0x00007FF6E0160000-0x00007FF6E04B1000-memory.dmp

Filesize
3.3MB

Download
memory/5112-2787-0x00007FF7D1870000-0x00007FF7D1BC1000-memory.dmp

Filesize
3.3MB

Download
memory/5112-265-0x00007FF7D1870000-0x00007FF7D1BC1000-memory.dmp

Filesize
3.3MB

Download