xmrig | 5656a14eba5dfacc9dbf3a852d452d409705ae34f7d1744922d4fdb28b701dcf

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
Size

2.0MB
MD5

dd944d1b72853c66a49da0543ec8e520
SHA1

032f12359330b5bf9be2d337b87adb756895b589
SHA256

5656a14eba5dfacc9dbf3a852d452d409705ae34f7d1744922d4fdb28b701dcf
SHA512

83b06ade26b40cdf83c6db1583b1ea46e523b8e43b9b1a4b8832e3c0ae02bb19aff4a63769d9fe8f33e5b8adb42e594f717e67266825a0bcd949e16f0e74351d
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQW/zFdDEANWQYkbZVmRkK7w:BemTLkNdfE0pZrQQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2332-0-0x00007FF6149D0000-0x00007FF614D24000-memory.dmp	xmrig
behavioral2/files/0x000800000002325a-6.dat	xmrig
behavioral2/memory/5008-8-0x00007FF793460000-0x00007FF7937B4000-memory.dmp	xmrig
behavioral2/files/0x000800000002325d-10.dat	xmrig
behavioral2/memory/4244-14-0x00007FF6FF2F0000-0x00007FF6FF644000-memory.dmp	xmrig
behavioral2/files/0x000800000002325f-11.dat	xmrig
behavioral2/memory/2004-22-0x00007FF79F8D0000-0x00007FF79FC24000-memory.dmp	xmrig
behavioral2/files/0x0008000000023261-24.dat	xmrig
behavioral2/files/0x0008000000023262-25.dat	xmrig
behavioral2/files/0x0007000000023263-32.dat	xmrig
behavioral2/files/0x0007000000023264-38.dat	xmrig
behavioral2/files/0x0007000000023265-41.dat	xmrig
behavioral2/files/0x0007000000023266-46.dat	xmrig
behavioral2/memory/4080-56-0x00007FF766550000-0x00007FF7668A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023267-61.dat	xmrig
behavioral2/files/0x000700000002326b-70.dat	xmrig
behavioral2/files/0x000700000002326e-87.dat	xmrig
behavioral2/files/0x0007000000023275-136.dat	xmrig
behavioral2/files/0x000700000002327a-151.dat	xmrig
behavioral2/files/0x000700000002327c-168.dat	xmrig
behavioral2/memory/5092-271-0x00007FF67F990000-0x00007FF67FCE4000-memory.dmp	xmrig
behavioral2/memory/2892-280-0x00007FF639390000-0x00007FF6396E4000-memory.dmp	xmrig
behavioral2/memory/4164-293-0x00007FF7FEAE0000-0x00007FF7FEE34000-memory.dmp	xmrig
behavioral2/memory/552-300-0x00007FF7384C0000-0x00007FF738814000-memory.dmp	xmrig
behavioral2/memory/3552-308-0x00007FF627BE0000-0x00007FF627F34000-memory.dmp	xmrig
behavioral2/memory/4880-310-0x00007FF681970000-0x00007FF681CC4000-memory.dmp	xmrig
behavioral2/memory/4160-309-0x00007FF7583A0000-0x00007FF7586F4000-memory.dmp	xmrig
behavioral2/memory/4916-307-0x00007FF6E2FA0000-0x00007FF6E32F4000-memory.dmp	xmrig
behavioral2/memory/1136-306-0x00007FF6C7440000-0x00007FF6C7794000-memory.dmp	xmrig
behavioral2/memory/3864-305-0x00007FF6337C0000-0x00007FF633B14000-memory.dmp	xmrig
behavioral2/memory/4336-304-0x00007FF7464A0000-0x00007FF7467F4000-memory.dmp	xmrig
behavioral2/memory/2796-303-0x00007FF6B5D40000-0x00007FF6B6094000-memory.dmp	xmrig
behavioral2/memory/4632-299-0x00007FF7BB780000-0x00007FF7BBAD4000-memory.dmp	xmrig
behavioral2/memory/1932-297-0x00007FF692FF0000-0x00007FF693344000-memory.dmp	xmrig
behavioral2/memory/1904-290-0x00007FF695300000-0x00007FF695654000-memory.dmp	xmrig
behavioral2/memory/2304-278-0x00007FF7B1790000-0x00007FF7B1AE4000-memory.dmp	xmrig
behavioral2/memory/2900-276-0x00007FF70D6F0000-0x00007FF70DA44000-memory.dmp	xmrig
behavioral2/memory/1568-277-0x00007FF77EE50000-0x00007FF77F1A4000-memory.dmp	xmrig
behavioral2/memory/888-275-0x00007FF6083F0000-0x00007FF608744000-memory.dmp	xmrig
behavioral2/memory/5088-274-0x00007FF61E290000-0x00007FF61E5E4000-memory.dmp	xmrig
behavioral2/memory/3504-273-0x00007FF7E12E0000-0x00007FF7E1634000-memory.dmp	xmrig
behavioral2/memory/4984-272-0x00007FF7BC730000-0x00007FF7BCA84000-memory.dmp	xmrig
behavioral2/memory/1972-270-0x00007FF7A7E50000-0x00007FF7A81A4000-memory.dmp	xmrig
behavioral2/memory/1388-269-0x00007FF692440000-0x00007FF692794000-memory.dmp	xmrig
behavioral2/memory/4176-267-0x00007FF6A1EB0000-0x00007FF6A2204000-memory.dmp	xmrig
behavioral2/files/0x000700000002327b-166.dat	xmrig
behavioral2/files/0x000700000002327e-165.dat	xmrig
behavioral2/files/0x000700000002327d-158.dat	xmrig
behavioral2/files/0x0007000000023279-155.dat	xmrig
behavioral2/files/0x0007000000023278-147.dat	xmrig
behavioral2/files/0x0007000000023277-143.dat	xmrig
behavioral2/files/0x0007000000023276-141.dat	xmrig
behavioral2/files/0x0007000000023274-130.dat	xmrig
behavioral2/files/0x0007000000023273-123.dat	xmrig
behavioral2/files/0x0007000000023272-110.dat	xmrig
behavioral2/files/0x0007000000023271-108.dat	xmrig
behavioral2/files/0x0007000000023270-106.dat	xmrig
behavioral2/files/0x000700000002326f-95.dat	xmrig
behavioral2/files/0x000700000002326d-91.dat	xmrig
behavioral2/files/0x000700000002326c-80.dat	xmrig
behavioral2/files/0x000700000002326a-73.dat	xmrig
behavioral2/files/0x0007000000023269-71.dat	xmrig
behavioral2/files/0x0007000000023268-68.dat	xmrig
behavioral2/memory/4244-2037-0x00007FF6FF2F0000-0x00007FF6FF644000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5008	xqwIbxa.exe
4244	ldkNneL.exe
2004	vsRknQp.exe
4080	pNfJxeO.exe
4176	QJSruyf.exe
4160	BgfudGi.exe
1388	ZnoXBHs.exe
1972	NQONAye.exe
5092	WowbHTO.exe
4984	iZSkHpE.exe
4880	pjzgnvI.exe
3504	Gowridk.exe
5088	QBhumPK.exe
888	ocKrIJn.exe
2900	QTaYFPV.exe
1568	ZtsLPvI.exe
2304	bOlePSd.exe
2892	cYmSgwC.exe
1904	RztxwEa.exe
4164	xgUyWmE.exe
1932	moXRpRC.exe
4632	lkghdJS.exe
552	fiCSBCq.exe
2796	BXkZKhu.exe
4336	vywrrpB.exe
3864	cwosCWR.exe
1136	tPPbVLR.exe
4916	loxzNPa.exe
3552	HmcPNDG.exe
4056	cJIuJfV.exe
4588	YfSHrZK.exe
3460	HidhjdE.exe
4900	lseHhYt.exe
3076	dIEHBPf.exe
3792	swAOXoY.exe
2308	XjTDhSm.exe
3464	MHgcwtO.exe
4440	ItrjPrE.exe
3268	istmxre.exe
2032	DcmPQWJ.exe
3372	TnkzzMd.exe
4576	QlKHrid.exe
3780	yvmsKmE.exe
4604	eGXqRwo.exe
3276	RJRlkUG.exe
2012	CpyByCn.exe
1804	UnkiVOl.exe
1668	oaUJTeo.exe
4708	ZYFiVnO.exe
1612	oAQsEct.exe
3472	nNohTvd.exe
2076	xmjeDLo.exe
3520	jjxzueN.exe
4532	ipmIbrS.exe
1160	sLXfjAh.exe
4268	zjmzgHI.exe
4376	jvzHkBP.exe
2116	LDszgAt.exe
1560	LelLXhU.exe
3244	jXrSJpF.exe
488	TwSXplN.exe
3772	ubNmpWi.exe
3880	KpmeDdp.exe
2972	zzlPiGI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2332-0-0x00007FF6149D0000-0x00007FF614D24000-memory.dmp	upx
behavioral2/files/0x000800000002325a-6.dat	upx
behavioral2/memory/5008-8-0x00007FF793460000-0x00007FF7937B4000-memory.dmp	upx
behavioral2/files/0x000800000002325d-10.dat	upx
behavioral2/memory/4244-14-0x00007FF6FF2F0000-0x00007FF6FF644000-memory.dmp	upx
behavioral2/files/0x000800000002325f-11.dat	upx
behavioral2/memory/2004-22-0x00007FF79F8D0000-0x00007FF79FC24000-memory.dmp	upx
behavioral2/files/0x0008000000023261-24.dat	upx
behavioral2/files/0x0008000000023262-25.dat	upx
behavioral2/files/0x0007000000023263-32.dat	upx
behavioral2/files/0x0007000000023264-38.dat	upx
behavioral2/files/0x0007000000023265-41.dat	upx
behavioral2/files/0x0007000000023266-46.dat	upx
behavioral2/memory/4080-56-0x00007FF766550000-0x00007FF7668A4000-memory.dmp	upx
behavioral2/files/0x0007000000023267-61.dat	upx
behavioral2/files/0x000700000002326b-70.dat	upx
behavioral2/files/0x000700000002326e-87.dat	upx
behavioral2/files/0x0007000000023275-136.dat	upx
behavioral2/files/0x000700000002327a-151.dat	upx
behavioral2/files/0x000700000002327c-168.dat	upx
behavioral2/memory/5092-271-0x00007FF67F990000-0x00007FF67FCE4000-memory.dmp	upx
behavioral2/memory/2892-280-0x00007FF639390000-0x00007FF6396E4000-memory.dmp	upx
behavioral2/memory/4164-293-0x00007FF7FEAE0000-0x00007FF7FEE34000-memory.dmp	upx
behavioral2/memory/552-300-0x00007FF7384C0000-0x00007FF738814000-memory.dmp	upx
behavioral2/memory/3552-308-0x00007FF627BE0000-0x00007FF627F34000-memory.dmp	upx
behavioral2/memory/4880-310-0x00007FF681970000-0x00007FF681CC4000-memory.dmp	upx
behavioral2/memory/4160-309-0x00007FF7583A0000-0x00007FF7586F4000-memory.dmp	upx
behavioral2/memory/4916-307-0x00007FF6E2FA0000-0x00007FF6E32F4000-memory.dmp	upx
behavioral2/memory/1136-306-0x00007FF6C7440000-0x00007FF6C7794000-memory.dmp	upx
behavioral2/memory/3864-305-0x00007FF6337C0000-0x00007FF633B14000-memory.dmp	upx
behavioral2/memory/4336-304-0x00007FF7464A0000-0x00007FF7467F4000-memory.dmp	upx
behavioral2/memory/2796-303-0x00007FF6B5D40000-0x00007FF6B6094000-memory.dmp	upx
behavioral2/memory/4632-299-0x00007FF7BB780000-0x00007FF7BBAD4000-memory.dmp	upx
behavioral2/memory/1932-297-0x00007FF692FF0000-0x00007FF693344000-memory.dmp	upx
behavioral2/memory/1904-290-0x00007FF695300000-0x00007FF695654000-memory.dmp	upx
behavioral2/memory/2304-278-0x00007FF7B1790000-0x00007FF7B1AE4000-memory.dmp	upx
behavioral2/memory/2900-276-0x00007FF70D6F0000-0x00007FF70DA44000-memory.dmp	upx
behavioral2/memory/1568-277-0x00007FF77EE50000-0x00007FF77F1A4000-memory.dmp	upx
behavioral2/memory/888-275-0x00007FF6083F0000-0x00007FF608744000-memory.dmp	upx
behavioral2/memory/5088-274-0x00007FF61E290000-0x00007FF61E5E4000-memory.dmp	upx
behavioral2/memory/3504-273-0x00007FF7E12E0000-0x00007FF7E1634000-memory.dmp	upx
behavioral2/memory/4984-272-0x00007FF7BC730000-0x00007FF7BCA84000-memory.dmp	upx
behavioral2/memory/1972-270-0x00007FF7A7E50000-0x00007FF7A81A4000-memory.dmp	upx
behavioral2/memory/1388-269-0x00007FF692440000-0x00007FF692794000-memory.dmp	upx
behavioral2/memory/4176-267-0x00007FF6A1EB0000-0x00007FF6A2204000-memory.dmp	upx
behavioral2/files/0x000700000002327b-166.dat	upx
behavioral2/files/0x000700000002327e-165.dat	upx
behavioral2/files/0x000700000002327d-158.dat	upx
behavioral2/files/0x0007000000023279-155.dat	upx
behavioral2/files/0x0007000000023278-147.dat	upx
behavioral2/files/0x0007000000023277-143.dat	upx
behavioral2/files/0x0007000000023276-141.dat	upx
behavioral2/files/0x0007000000023274-130.dat	upx
behavioral2/files/0x0007000000023273-123.dat	upx
behavioral2/files/0x0007000000023272-110.dat	upx
behavioral2/files/0x0007000000023271-108.dat	upx
behavioral2/files/0x0007000000023270-106.dat	upx
behavioral2/files/0x000700000002326f-95.dat	upx
behavioral2/files/0x000700000002326d-91.dat	upx
behavioral2/files/0x000700000002326c-80.dat	upx
behavioral2/files/0x000700000002326a-73.dat	upx
behavioral2/files/0x0007000000023269-71.dat	upx
behavioral2/files/0x0007000000023268-68.dat	upx
behavioral2/memory/4244-2037-0x00007FF6FF2F0000-0x00007FF6FF644000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oBPIouK.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\eUxIkji.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\AtVOxlW.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\EeMxTCy.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\ZetKACp.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\knhtctR.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\hPTqbBV.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\XFjEVEi.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\mYnPFAL.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\hZjJnze.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\soPqYHb.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\HfiwKPF.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\JuGEQSQ.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\XkpNyyJ.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\CaMnmHv.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\keajZPd.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\ZbKykMj.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\cnlkErK.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\jPscnDm.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\wfnwxLS.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\eYSfkJO.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\pEFyCzo.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\jEtQljA.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\IqfZpnF.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\xslVoCL.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\WoPLNVE.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\vSgcYNB.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\vjMqYUH.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\ezCUhDi.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\AMhkbui.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\yUElktJ.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\tPPbVLR.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\LHMqZYa.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\ErLvQdP.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\PrUtpdu.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\NcnjUZW.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\Rgmahxw.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\mcRGBnF.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\lUstJYC.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\ZtsLPvI.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\FRnVHAm.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\bijwSpV.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\uWGJWor.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\dEeCLOH.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\fFLThhM.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\wVlvvVj.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\pSHMzyn.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\czOccTx.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\rHSLSWG.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\anQpfDZ.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\KQcJpIE.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\GyWooZt.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\oPBXVxB.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\mmFMjUD.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\lFXtghC.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\ravfGhg.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\pHOmjbU.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\JsZtodZ.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\HHlzeQL.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\OuScSRk.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\ZXdAAQQ.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\PDayFoo.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\BQBodDO.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
File created	C:\Windows\System\SjFtbzC.exe	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 5008	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	91
PID 2332 wrote to memory of 5008	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	91
PID 2332 wrote to memory of 4244	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	92
PID 2332 wrote to memory of 4244	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	92
PID 2332 wrote to memory of 2004	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	93
PID 2332 wrote to memory of 2004	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	93
PID 2332 wrote to memory of 4080	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	94
PID 2332 wrote to memory of 4080	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	94
PID 2332 wrote to memory of 4176	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	95
PID 2332 wrote to memory of 4176	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	95
PID 2332 wrote to memory of 4160	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	96
PID 2332 wrote to memory of 4160	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	96
PID 2332 wrote to memory of 1388	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	97
PID 2332 wrote to memory of 1388	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	97
PID 2332 wrote to memory of 1972	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	98
PID 2332 wrote to memory of 1972	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	98
PID 2332 wrote to memory of 5092	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	99
PID 2332 wrote to memory of 5092	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	99
PID 2332 wrote to memory of 4984	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	100
PID 2332 wrote to memory of 4984	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	100
PID 2332 wrote to memory of 4880	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	101
PID 2332 wrote to memory of 4880	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	101
PID 2332 wrote to memory of 3504	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	102
PID 2332 wrote to memory of 3504	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	102
PID 2332 wrote to memory of 5088	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	103
PID 2332 wrote to memory of 5088	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	103
PID 2332 wrote to memory of 888	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	104
PID 2332 wrote to memory of 888	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	104
PID 2332 wrote to memory of 2900	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	105
PID 2332 wrote to memory of 2900	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	105
PID 2332 wrote to memory of 1568	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	106
PID 2332 wrote to memory of 1568	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	106
PID 2332 wrote to memory of 2304	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	107
PID 2332 wrote to memory of 2304	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	107
PID 2332 wrote to memory of 2892	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	108
PID 2332 wrote to memory of 2892	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	108
PID 2332 wrote to memory of 1904	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	109
PID 2332 wrote to memory of 1904	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	109
PID 2332 wrote to memory of 4164	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	110
PID 2332 wrote to memory of 4164	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	110
PID 2332 wrote to memory of 1932	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	111
PID 2332 wrote to memory of 1932	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	111
PID 2332 wrote to memory of 4632	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	112
PID 2332 wrote to memory of 4632	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	112
PID 2332 wrote to memory of 552	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	113
PID 2332 wrote to memory of 552	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	113
PID 2332 wrote to memory of 2796	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	114
PID 2332 wrote to memory of 2796	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	114
PID 2332 wrote to memory of 4336	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	115
PID 2332 wrote to memory of 4336	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	115
PID 2332 wrote to memory of 3864	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	116
PID 2332 wrote to memory of 3864	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	116
PID 2332 wrote to memory of 1136	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	117
PID 2332 wrote to memory of 1136	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	117
PID 2332 wrote to memory of 4916	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	118
PID 2332 wrote to memory of 4916	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	118
PID 2332 wrote to memory of 3552	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	119
PID 2332 wrote to memory of 3552	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	119
PID 2332 wrote to memory of 4056	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	120
PID 2332 wrote to memory of 4056	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	120
PID 2332 wrote to memory of 4588	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	121
PID 2332 wrote to memory of 4588	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	121
PID 2332 wrote to memory of 3460	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	122
PID 2332 wrote to memory of 3460	2332	dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\dd944d1b72853c66a49da0543ec8e520_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\System\xqwIbxa.exe
  C:\Windows\System\xqwIbxa.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\ldkNneL.exe
  C:\Windows\System\ldkNneL.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\vsRknQp.exe
  C:\Windows\System\vsRknQp.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\pNfJxeO.exe
  C:\Windows\System\pNfJxeO.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\QJSruyf.exe
  C:\Windows\System\QJSruyf.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\BgfudGi.exe
  C:\Windows\System\BgfudGi.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\ZnoXBHs.exe
  C:\Windows\System\ZnoXBHs.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\NQONAye.exe
  C:\Windows\System\NQONAye.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\WowbHTO.exe
  C:\Windows\System\WowbHTO.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\iZSkHpE.exe
  C:\Windows\System\iZSkHpE.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\pjzgnvI.exe
  C:\Windows\System\pjzgnvI.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\Gowridk.exe
  C:\Windows\System\Gowridk.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\QBhumPK.exe
  C:\Windows\System\QBhumPK.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\ocKrIJn.exe
  C:\Windows\System\ocKrIJn.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\QTaYFPV.exe
  C:\Windows\System\QTaYFPV.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ZtsLPvI.exe
  C:\Windows\System\ZtsLPvI.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\bOlePSd.exe
  C:\Windows\System\bOlePSd.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\cYmSgwC.exe
  C:\Windows\System\cYmSgwC.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\RztxwEa.exe
  C:\Windows\System\RztxwEa.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\xgUyWmE.exe
  C:\Windows\System\xgUyWmE.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\moXRpRC.exe
  C:\Windows\System\moXRpRC.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\lkghdJS.exe
  C:\Windows\System\lkghdJS.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\fiCSBCq.exe
  C:\Windows\System\fiCSBCq.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\BXkZKhu.exe
  C:\Windows\System\BXkZKhu.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\vywrrpB.exe
  C:\Windows\System\vywrrpB.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\cwosCWR.exe
  C:\Windows\System\cwosCWR.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\tPPbVLR.exe
  C:\Windows\System\tPPbVLR.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\loxzNPa.exe
  C:\Windows\System\loxzNPa.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\HmcPNDG.exe
  C:\Windows\System\HmcPNDG.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\cJIuJfV.exe
  C:\Windows\System\cJIuJfV.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\YfSHrZK.exe
  C:\Windows\System\YfSHrZK.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\HidhjdE.exe
  C:\Windows\System\HidhjdE.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\lseHhYt.exe
  C:\Windows\System\lseHhYt.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\dIEHBPf.exe
  C:\Windows\System\dIEHBPf.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\swAOXoY.exe
  C:\Windows\System\swAOXoY.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\XjTDhSm.exe
  C:\Windows\System\XjTDhSm.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\MHgcwtO.exe
  C:\Windows\System\MHgcwtO.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\ItrjPrE.exe
  C:\Windows\System\ItrjPrE.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\istmxre.exe
  C:\Windows\System\istmxre.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\DcmPQWJ.exe
  C:\Windows\System\DcmPQWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\TnkzzMd.exe
  C:\Windows\System\TnkzzMd.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\QlKHrid.exe
  C:\Windows\System\QlKHrid.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\yvmsKmE.exe
  C:\Windows\System\yvmsKmE.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\eGXqRwo.exe
  C:\Windows\System\eGXqRwo.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\RJRlkUG.exe
  C:\Windows\System\RJRlkUG.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\CpyByCn.exe
  C:\Windows\System\CpyByCn.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\UnkiVOl.exe
  C:\Windows\System\UnkiVOl.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\oaUJTeo.exe
  C:\Windows\System\oaUJTeo.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\ZYFiVnO.exe
  C:\Windows\System\ZYFiVnO.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\oAQsEct.exe
  C:\Windows\System\oAQsEct.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\nNohTvd.exe
  C:\Windows\System\nNohTvd.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\xmjeDLo.exe
  C:\Windows\System\xmjeDLo.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\jjxzueN.exe
  C:\Windows\System\jjxzueN.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\ipmIbrS.exe
  C:\Windows\System\ipmIbrS.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\sLXfjAh.exe
  C:\Windows\System\sLXfjAh.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\zjmzgHI.exe
  C:\Windows\System\zjmzgHI.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\jvzHkBP.exe
  C:\Windows\System\jvzHkBP.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\LDszgAt.exe
  C:\Windows\System\LDszgAt.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\LelLXhU.exe
  C:\Windows\System\LelLXhU.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\jXrSJpF.exe
  C:\Windows\System\jXrSJpF.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\TwSXplN.exe
  C:\Windows\System\TwSXplN.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\ubNmpWi.exe
  C:\Windows\System\ubNmpWi.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\KpmeDdp.exe
  C:\Windows\System\KpmeDdp.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\zzlPiGI.exe
  C:\Windows\System\zzlPiGI.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\tKVeQql.exe
  C:\Windows\System\tKVeQql.exe
  2⤵
  PID:1172
- C:\Windows\System\GtijURa.exe
  C:\Windows\System\GtijURa.exe
  2⤵
  PID:5132
- C:\Windows\System\ejBWVka.exe
  C:\Windows\System\ejBWVka.exe
  2⤵
  PID:5152
- C:\Windows\System\wYtcJfg.exe
  C:\Windows\System\wYtcJfg.exe
  2⤵
  PID:5168
- C:\Windows\System\zWjLXUD.exe
  C:\Windows\System\zWjLXUD.exe
  2⤵
  PID:5184
- C:\Windows\System\PTdZeuI.exe
  C:\Windows\System\PTdZeuI.exe
  2⤵
  PID:5200
- C:\Windows\System\ajnzwlx.exe
  C:\Windows\System\ajnzwlx.exe
  2⤵
  PID:5328
- C:\Windows\System\IkphqxI.exe
  C:\Windows\System\IkphqxI.exe
  2⤵
  PID:5344
- C:\Windows\System\RiifOAj.exe
  C:\Windows\System\RiifOAj.exe
  2⤵
  PID:5364
- C:\Windows\System\wkyaktd.exe
  C:\Windows\System\wkyaktd.exe
  2⤵
  PID:5588
- C:\Windows\System\norKKox.exe
  C:\Windows\System\norKKox.exe
  2⤵
  PID:5612
- C:\Windows\System\ZFmPlVW.exe
  C:\Windows\System\ZFmPlVW.exe
  2⤵
  PID:5628
- C:\Windows\System\CkRyQwh.exe
  C:\Windows\System\CkRyQwh.exe
  2⤵
  PID:5656
- C:\Windows\System\FzgTaHe.exe
  C:\Windows\System\FzgTaHe.exe
  2⤵
  PID:5688
- C:\Windows\System\TnJpMya.exe
  C:\Windows\System\TnJpMya.exe
  2⤵
  PID:5716
- C:\Windows\System\cKkuYMY.exe
  C:\Windows\System\cKkuYMY.exe
  2⤵
  PID:5744
- C:\Windows\System\UPUwCfD.exe
  C:\Windows\System\UPUwCfD.exe
  2⤵
  PID:5772
- C:\Windows\System\zjrXPdl.exe
  C:\Windows\System\zjrXPdl.exe
  2⤵
  PID:5796
- C:\Windows\System\MyGYOoF.exe
  C:\Windows\System\MyGYOoF.exe
  2⤵
  PID:5824
- C:\Windows\System\nGHohcU.exe
  C:\Windows\System\nGHohcU.exe
  2⤵
  PID:5852
- C:\Windows\System\yISMfgw.exe
  C:\Windows\System\yISMfgw.exe
  2⤵
  PID:5876
- C:\Windows\System\powoEMO.exe
  C:\Windows\System\powoEMO.exe
  2⤵
  PID:5900
- C:\Windows\System\nIntDkz.exe
  C:\Windows\System\nIntDkz.exe
  2⤵
  PID:5932
- C:\Windows\System\OuScSRk.exe
  C:\Windows\System\OuScSRk.exe
  2⤵
  PID:5964
- C:\Windows\System\ZGqBQZC.exe
  C:\Windows\System\ZGqBQZC.exe
  2⤵
  PID:5996
- C:\Windows\System\yjEHahL.exe
  C:\Windows\System\yjEHahL.exe
  2⤵
  PID:6020
- C:\Windows\System\ugGeDCy.exe
  C:\Windows\System\ugGeDCy.exe
  2⤵
  PID:6052
- C:\Windows\System\jTDCWrA.exe
  C:\Windows\System\jTDCWrA.exe
  2⤵
  PID:6076
- C:\Windows\System\qVbnohx.exe
  C:\Windows\System\qVbnohx.exe
  2⤵
  PID:6104
- C:\Windows\System\TSWgRJQ.exe
  C:\Windows\System\TSWgRJQ.exe
  2⤵
  PID:6136
- C:\Windows\System\cXjpYzS.exe
  C:\Windows\System\cXjpYzS.exe
  2⤵
  PID:2788
- C:\Windows\System\jobDBCC.exe
  C:\Windows\System\jobDBCC.exe
  2⤵
  PID:4312
- C:\Windows\System\VQGtYKb.exe
  C:\Windows\System\VQGtYKb.exe
  2⤵
  PID:4656
- C:\Windows\System\sgFxkAv.exe
  C:\Windows\System\sgFxkAv.exe
  2⤵
  PID:4704
- C:\Windows\System\pPQwfiC.exe
  C:\Windows\System\pPQwfiC.exe
  2⤵
  PID:5124
- C:\Windows\System\mpBKKrV.exe
  C:\Windows\System\mpBKKrV.exe
  2⤵
  PID:2216
- C:\Windows\System\PPvYSyi.exe
  C:\Windows\System\PPvYSyi.exe
  2⤵
  PID:5276
- C:\Windows\System\PTEKqLt.exe
  C:\Windows\System\PTEKqLt.exe
  2⤵
  PID:5336
- C:\Windows\System\qRJYEnN.exe
  C:\Windows\System\qRJYEnN.exe
  2⤵
  PID:5452
- C:\Windows\System\zfofEOP.exe
  C:\Windows\System\zfofEOP.exe
  2⤵
  PID:4060
- C:\Windows\System\laPQVPI.exe
  C:\Windows\System\laPQVPI.exe
  2⤵
  PID:2728
- C:\Windows\System\WqwFgVB.exe
  C:\Windows\System\WqwFgVB.exe
  2⤵
  PID:4240
- C:\Windows\System\UeMypmM.exe
  C:\Windows\System\UeMypmM.exe
  2⤵
  PID:400
- C:\Windows\System\MImErCV.exe
  C:\Windows\System\MImErCV.exe
  2⤵
  PID:3996
- C:\Windows\System\QNYeUGm.exe
  C:\Windows\System\QNYeUGm.exe
  2⤵
  PID:2204
- C:\Windows\System\qqdePzI.exe
  C:\Windows\System\qqdePzI.exe
  2⤵
  PID:3392
- C:\Windows\System\AWBShJG.exe
  C:\Windows\System\AWBShJG.exe
  2⤵
  PID:2660
- C:\Windows\System\vQCeEib.exe
  C:\Windows\System\vQCeEib.exe
  2⤵
  PID:5224
- C:\Windows\System\mkzMBTg.exe
  C:\Windows\System\mkzMBTg.exe
  2⤵
  PID:2272
- C:\Windows\System\EnpeumI.exe
  C:\Windows\System\EnpeumI.exe
  2⤵
  PID:5596
- C:\Windows\System\rQcAPwQ.exe
  C:\Windows\System\rQcAPwQ.exe
  2⤵
  PID:5624
- C:\Windows\System\HPFkvdM.exe
  C:\Windows\System\HPFkvdM.exe
  2⤵
  PID:5432
- C:\Windows\System\KNGwRMn.exe
  C:\Windows\System\KNGwRMn.exe
  2⤵
  PID:5736
- C:\Windows\System\awVPzue.exe
  C:\Windows\System\awVPzue.exe
  2⤵
  PID:5788
- C:\Windows\System\WViTtQA.exe
  C:\Windows\System\WViTtQA.exe
  2⤵
  PID:5248
- C:\Windows\System\BCbvWYG.exe
  C:\Windows\System\BCbvWYG.exe
  2⤵
  PID:5840
- C:\Windows\System\ScKWcTu.exe
  C:\Windows\System\ScKWcTu.exe
  2⤵
  PID:5908
- C:\Windows\System\IQdIxlO.exe
  C:\Windows\System\IQdIxlO.exe
  2⤵
  PID:5980
- C:\Windows\System\HFmJRjM.exe
  C:\Windows\System\HFmJRjM.exe
  2⤵
  PID:6036
- C:\Windows\System\DXVKVTO.exe
  C:\Windows\System\DXVKVTO.exe
  2⤵
  PID:6068
- C:\Windows\System\EOZjzkZ.exe
  C:\Windows\System\EOZjzkZ.exe
  2⤵
  PID:6112
- C:\Windows\System\IlrhBiC.exe
  C:\Windows\System\IlrhBiC.exe
  2⤵
  PID:816
- C:\Windows\System\upSXtfJ.exe
  C:\Windows\System\upSXtfJ.exe
  2⤵
  PID:380
- C:\Windows\System\jzpPQmR.exe
  C:\Windows\System\jzpPQmR.exe
  2⤵
  PID:5312
- C:\Windows\System\GVIrgTv.exe
  C:\Windows\System\GVIrgTv.exe
  2⤵
  PID:5548
- C:\Windows\System\ORXpeHz.exe
  C:\Windows\System\ORXpeHz.exe
  2⤵
  PID:2676
- C:\Windows\System\UJMEPXl.exe
  C:\Windows\System\UJMEPXl.exe
  2⤵
  PID:60
- C:\Windows\System\XWyrTMb.exe
  C:\Windows\System\XWyrTMb.exe
  2⤵
  PID:976
- C:\Windows\System\GUcZsgV.exe
  C:\Windows\System\GUcZsgV.exe
  2⤵
  PID:5220
- C:\Windows\System\LfYiWSV.exe
  C:\Windows\System\LfYiWSV.exe
  2⤵
  PID:5600
- C:\Windows\System\weHUbPe.exe
  C:\Windows\System\weHUbPe.exe
  2⤵
  PID:5708
- C:\Windows\System\FLrqouv.exe
  C:\Windows\System\FLrqouv.exe
  2⤵
  PID:5520
- C:\Windows\System\VnrSDIL.exe
  C:\Windows\System\VnrSDIL.exe
  2⤵
  PID:5884
- C:\Windows\System\yzGuabs.exe
  C:\Windows\System\yzGuabs.exe
  2⤵
  PID:6092
- C:\Windows\System\QNlilHE.exe
  C:\Windows\System\QNlilHE.exe
  2⤵
  PID:1840
- C:\Windows\System\qRSwqNU.exe
  C:\Windows\System\qRSwqNU.exe
  2⤵
  PID:5052
- C:\Windows\System\eMBcBka.exe
  C:\Windows\System\eMBcBka.exe
  2⤵
  PID:984
- C:\Windows\System\vFYOmyI.exe
  C:\Windows\System\vFYOmyI.exe
  2⤵
  PID:5264
- C:\Windows\System\ySRJOVD.exe
  C:\Windows\System\ySRJOVD.exe
  2⤵
  PID:5684
- C:\Windows\System\LqIqeyx.exe
  C:\Windows\System\LqIqeyx.exe
  2⤵
  PID:6044
- C:\Windows\System\autWzbZ.exe
  C:\Windows\System\autWzbZ.exe
  2⤵
  PID:4840
- C:\Windows\System\kqndXBQ.exe
  C:\Windows\System\kqndXBQ.exe
  2⤵
  PID:3740
- C:\Windows\System\JuGEQSQ.exe
  C:\Windows\System\JuGEQSQ.exe
  2⤵
  PID:5192
- C:\Windows\System\daTtfGD.exe
  C:\Windows\System\daTtfGD.exe
  2⤵
  PID:5928
- C:\Windows\System\FkFYZZh.exe
  C:\Windows\System\FkFYZZh.exe
  2⤵
  PID:6156
- C:\Windows\System\WlRLlPu.exe
  C:\Windows\System\WlRLlPu.exe
  2⤵
  PID:6184
- C:\Windows\System\rnLvkKH.exe
  C:\Windows\System\rnLvkKH.exe
  2⤵
  PID:6212
- C:\Windows\System\FRnVHAm.exe
  C:\Windows\System\FRnVHAm.exe
  2⤵
  PID:6240
- C:\Windows\System\TcGqwCr.exe
  C:\Windows\System\TcGqwCr.exe
  2⤵
  PID:6268
- C:\Windows\System\uGQzbuu.exe
  C:\Windows\System\uGQzbuu.exe
  2⤵
  PID:6296
- C:\Windows\System\qJVONzV.exe
  C:\Windows\System\qJVONzV.exe
  2⤵
  PID:6324
- C:\Windows\System\NUSEqiW.exe
  C:\Windows\System\NUSEqiW.exe
  2⤵
  PID:6352
- C:\Windows\System\kIycsGl.exe
  C:\Windows\System\kIycsGl.exe
  2⤵
  PID:6380
- C:\Windows\System\EmJJEMG.exe
  C:\Windows\System\EmJJEMG.exe
  2⤵
  PID:6404
- C:\Windows\System\wqZGnFW.exe
  C:\Windows\System\wqZGnFW.exe
  2⤵
  PID:6428
- C:\Windows\System\artVApO.exe
  C:\Windows\System\artVApO.exe
  2⤵
  PID:6468
- C:\Windows\System\KhvlxnK.exe
  C:\Windows\System\KhvlxnK.exe
  2⤵
  PID:6492
- C:\Windows\System\hcPElLc.exe
  C:\Windows\System\hcPElLc.exe
  2⤵
  PID:6524
- C:\Windows\System\MFDbTdV.exe
  C:\Windows\System\MFDbTdV.exe
  2⤵
  PID:6548
- C:\Windows\System\BOcMZcv.exe
  C:\Windows\System\BOcMZcv.exe
  2⤵
  PID:6576
- C:\Windows\System\UruIzdq.exe
  C:\Windows\System\UruIzdq.exe
  2⤵
  PID:6600
- C:\Windows\System\jXmznze.exe
  C:\Windows\System\jXmznze.exe
  2⤵
  PID:6628
- C:\Windows\System\mEWiZgr.exe
  C:\Windows\System\mEWiZgr.exe
  2⤵
  PID:6656
- C:\Windows\System\eTOVwAf.exe
  C:\Windows\System\eTOVwAf.exe
  2⤵
  PID:6688
- C:\Windows\System\LcVdGtq.exe
  C:\Windows\System\LcVdGtq.exe
  2⤵
  PID:6716
- C:\Windows\System\rHSLSWG.exe
  C:\Windows\System\rHSLSWG.exe
  2⤵
  PID:6748
- C:\Windows\System\xFIUJbB.exe
  C:\Windows\System\xFIUJbB.exe
  2⤵
  PID:6776
- C:\Windows\System\iUWuAkN.exe
  C:\Windows\System\iUWuAkN.exe
  2⤵
  PID:6804
- C:\Windows\System\pgEwsuw.exe
  C:\Windows\System\pgEwsuw.exe
  2⤵
  PID:6824
- C:\Windows\System\CdWLnfs.exe
  C:\Windows\System\CdWLnfs.exe
  2⤵
  PID:6860
- C:\Windows\System\HTkadVP.exe
  C:\Windows\System\HTkadVP.exe
  2⤵
  PID:6892
- C:\Windows\System\oHYJKsn.exe
  C:\Windows\System\oHYJKsn.exe
  2⤵
  PID:6920
- C:\Windows\System\MebRUDl.exe
  C:\Windows\System\MebRUDl.exe
  2⤵
  PID:6944
- C:\Windows\System\HWZowmd.exe
  C:\Windows\System\HWZowmd.exe
  2⤵
  PID:6972
- C:\Windows\System\anQpfDZ.exe
  C:\Windows\System\anQpfDZ.exe
  2⤵
  PID:7004
- C:\Windows\System\BKBluff.exe
  C:\Windows\System\BKBluff.exe
  2⤵
  PID:7024
- C:\Windows\System\JPvngrW.exe
  C:\Windows\System\JPvngrW.exe
  2⤵
  PID:7056
- C:\Windows\System\zsRxeJy.exe
  C:\Windows\System\zsRxeJy.exe
  2⤵
  PID:7084
- C:\Windows\System\NWqTxwS.exe
  C:\Windows\System\NWqTxwS.exe
  2⤵
  PID:7112
- C:\Windows\System\JBgcMch.exe
  C:\Windows\System\JBgcMch.exe
  2⤵
  PID:7136
- C:\Windows\System\HfelnGU.exe
  C:\Windows\System\HfelnGU.exe
  2⤵
  PID:7160
- C:\Windows\System\ravfGhg.exe
  C:\Windows\System\ravfGhg.exe
  2⤵
  PID:6180
- C:\Windows\System\SwOHEgh.exe
  C:\Windows\System\SwOHEgh.exe
  2⤵
  PID:6236
- C:\Windows\System\sxJeFZV.exe
  C:\Windows\System\sxJeFZV.exe
  2⤵
  PID:6280
- C:\Windows\System\fxbYFSy.exe
  C:\Windows\System\fxbYFSy.exe
  2⤵
  PID:6376
- C:\Windows\System\KtYzfHq.exe
  C:\Windows\System\KtYzfHq.exe
  2⤵
  PID:6424
- C:\Windows\System\bijwSpV.exe
  C:\Windows\System\bijwSpV.exe
  2⤵
  PID:6480
- C:\Windows\System\ZwJgjMM.exe
  C:\Windows\System\ZwJgjMM.exe
  2⤵
  PID:6540
- C:\Windows\System\DNMfWRm.exe
  C:\Windows\System\DNMfWRm.exe
  2⤵
  PID:6624
- C:\Windows\System\FVhRhft.exe
  C:\Windows\System\FVhRhft.exe
  2⤵
  PID:6680
- C:\Windows\System\hYLIpkp.exe
  C:\Windows\System\hYLIpkp.exe
  2⤵
  PID:6740
- C:\Windows\System\vSgcYNB.exe
  C:\Windows\System\vSgcYNB.exe
  2⤵
  PID:6816
- C:\Windows\System\WCloeax.exe
  C:\Windows\System\WCloeax.exe
  2⤵
  PID:6880
- C:\Windows\System\HGFLMDS.exe
  C:\Windows\System\HGFLMDS.exe
  2⤵
  PID:6908
- C:\Windows\System\nixDDlO.exe
  C:\Windows\System\nixDDlO.exe
  2⤵
  PID:7044
- C:\Windows\System\ZnRMXFo.exe
  C:\Windows\System\ZnRMXFo.exe
  2⤵
  PID:7100
- C:\Windows\System\CmBhLZo.exe
  C:\Windows\System\CmBhLZo.exe
  2⤵
  PID:6176
- C:\Windows\System\iyxjYjs.exe
  C:\Windows\System\iyxjYjs.exe
  2⤵
  PID:6320
- C:\Windows\System\gGMvlMY.exe
  C:\Windows\System\gGMvlMY.exe
  2⤵
  PID:6536
- C:\Windows\System\CuDPCIS.exe
  C:\Windows\System\CuDPCIS.exe
  2⤵
  PID:6648
- C:\Windows\System\VLQXExo.exe
  C:\Windows\System\VLQXExo.exe
  2⤵
  PID:6704
- C:\Windows\System\adOMtEG.exe
  C:\Windows\System\adOMtEG.exe
  2⤵
  PID:6844
- C:\Windows\System\uWGJWor.exe
  C:\Windows\System\uWGJWor.exe
  2⤵
  PID:6440
- C:\Windows\System\zbvLsHA.exe
  C:\Windows\System\zbvLsHA.exe
  2⤵
  PID:6232
- C:\Windows\System\pkkPTod.exe
  C:\Windows\System\pkkPTod.exe
  2⤵
  PID:6596
- C:\Windows\System\oBPIouK.exe
  C:\Windows\System\oBPIouK.exe
  2⤵
  PID:6916
- C:\Windows\System\mdKymfe.exe
  C:\Windows\System\mdKymfe.exe
  2⤵
  PID:7184
- C:\Windows\System\kQOiMxe.exe
  C:\Windows\System\kQOiMxe.exe
  2⤵
  PID:7224
- C:\Windows\System\OMYRQIz.exe
  C:\Windows\System\OMYRQIz.exe
  2⤵
  PID:7240
- C:\Windows\System\rMJdajy.exe
  C:\Windows\System\rMJdajy.exe
  2⤵
  PID:7276
- C:\Windows\System\YlksUxP.exe
  C:\Windows\System\YlksUxP.exe
  2⤵
  PID:7308
- C:\Windows\System\yksCwkb.exe
  C:\Windows\System\yksCwkb.exe
  2⤵
  PID:7336
- C:\Windows\System\ClfqHTX.exe
  C:\Windows\System\ClfqHTX.exe
  2⤵
  PID:7372
- C:\Windows\System\BiXItUj.exe
  C:\Windows\System\BiXItUj.exe
  2⤵
  PID:7396
- C:\Windows\System\EWjXlWN.exe
  C:\Windows\System\EWjXlWN.exe
  2⤵
  PID:7424
- C:\Windows\System\UDHpFuE.exe
  C:\Windows\System\UDHpFuE.exe
  2⤵
  PID:7444
- C:\Windows\System\BiIuVZj.exe
  C:\Windows\System\BiIuVZj.exe
  2⤵
  PID:7468
- C:\Windows\System\UjOBeWo.exe
  C:\Windows\System\UjOBeWo.exe
  2⤵
  PID:7496
- C:\Windows\System\eDqqxDt.exe
  C:\Windows\System\eDqqxDt.exe
  2⤵
  PID:7516
- C:\Windows\System\AWmYXbr.exe
  C:\Windows\System\AWmYXbr.exe
  2⤵
  PID:7540
- C:\Windows\System\gpKRZYT.exe
  C:\Windows\System\gpKRZYT.exe
  2⤵
  PID:7564
- C:\Windows\System\NgIIKYP.exe
  C:\Windows\System\NgIIKYP.exe
  2⤵
  PID:7588
- C:\Windows\System\eUxIkji.exe
  C:\Windows\System\eUxIkji.exe
  2⤵
  PID:7612
- C:\Windows\System\RdFxbtd.exe
  C:\Windows\System\RdFxbtd.exe
  2⤵
  PID:7640
- C:\Windows\System\sjMdWqd.exe
  C:\Windows\System\sjMdWqd.exe
  2⤵
  PID:7672
- C:\Windows\System\MFhoWQz.exe
  C:\Windows\System\MFhoWQz.exe
  2⤵
  PID:7692
- C:\Windows\System\DWQTtMN.exe
  C:\Windows\System\DWQTtMN.exe
  2⤵
  PID:7712
- C:\Windows\System\rTQQhAl.exe
  C:\Windows\System\rTQQhAl.exe
  2⤵
  PID:7740
- C:\Windows\System\KQcJpIE.exe
  C:\Windows\System\KQcJpIE.exe
  2⤵
  PID:7760
- C:\Windows\System\OgznBuG.exe
  C:\Windows\System\OgznBuG.exe
  2⤵
  PID:7788
- C:\Windows\System\YwhfpXU.exe
  C:\Windows\System\YwhfpXU.exe
  2⤵
  PID:7812
- C:\Windows\System\hWZznag.exe
  C:\Windows\System\hWZznag.exe
  2⤵
  PID:7840
- C:\Windows\System\mYnPFAL.exe
  C:\Windows\System\mYnPFAL.exe
  2⤵
  PID:7860
- C:\Windows\System\TapTdEk.exe
  C:\Windows\System\TapTdEk.exe
  2⤵
  PID:7884
- C:\Windows\System\AWwJakH.exe
  C:\Windows\System\AWwJakH.exe
  2⤵
  PID:7904
- C:\Windows\System\EiNZcIt.exe
  C:\Windows\System\EiNZcIt.exe
  2⤵
  PID:7932
- C:\Windows\System\LHMqZYa.exe
  C:\Windows\System\LHMqZYa.exe
  2⤵
  PID:7976
- C:\Windows\System\wNpzDgv.exe
  C:\Windows\System\wNpzDgv.exe
  2⤵
  PID:8080
- C:\Windows\System\ErLvQdP.exe
  C:\Windows\System\ErLvQdP.exe
  2⤵
  PID:8104
- C:\Windows\System\pEWxAeq.exe
  C:\Windows\System\pEWxAeq.exe
  2⤵
  PID:8128
- C:\Windows\System\VdrDnRP.exe
  C:\Windows\System\VdrDnRP.exe
  2⤵
  PID:8160
- C:\Windows\System\JyfqYMF.exe
  C:\Windows\System\JyfqYMF.exe
  2⤵
  PID:8180
- C:\Windows\System\cVwpYog.exe
  C:\Windows\System\cVwpYog.exe
  2⤵
  PID:6500
- C:\Windows\System\ccheIZP.exe
  C:\Windows\System\ccheIZP.exe
  2⤵
  PID:6836
- C:\Windows\System\AtVOxlW.exe
  C:\Windows\System\AtVOxlW.exe
  2⤵
  PID:7180
- C:\Windows\System\xzcfsTb.exe
  C:\Windows\System\xzcfsTb.exe
  2⤵
  PID:7252
- C:\Windows\System\AIXPzKV.exe
  C:\Windows\System\AIXPzKV.exe
  2⤵
  PID:7264
- C:\Windows\System\tpDcCnV.exe
  C:\Windows\System\tpDcCnV.exe
  2⤵
  PID:7348
- C:\Windows\System\xEVfguB.exe
  C:\Windows\System\xEVfguB.exe
  2⤵
  PID:7416
- C:\Windows\System\NkitwTS.exe
  C:\Windows\System\NkitwTS.exe
  2⤵
  PID:7456
- C:\Windows\System\UCywlAY.exe
  C:\Windows\System\UCywlAY.exe
  2⤵
  PID:7560
- C:\Windows\System\CggKrZE.exe
  C:\Windows\System\CggKrZE.exe
  2⤵
  PID:7508
- C:\Windows\System\dEeCLOH.exe
  C:\Windows\System\dEeCLOH.exe
  2⤵
  PID:7608
- C:\Windows\System\ydRqsFI.exe
  C:\Windows\System\ydRqsFI.exe
  2⤵
  PID:7732
- C:\Windows\System\YmyCALK.exe
  C:\Windows\System\YmyCALK.exe
  2⤵
  PID:7636
- C:\Windows\System\QwrdrLL.exe
  C:\Windows\System\QwrdrLL.exe
  2⤵
  PID:5112
- C:\Windows\System\GwFYheO.exe
  C:\Windows\System\GwFYheO.exe
  2⤵
  PID:7952
- C:\Windows\System\wfnwxLS.exe
  C:\Windows\System\wfnwxLS.exe
  2⤵
  PID:7984
- C:\Windows\System\SskFDbm.exe
  C:\Windows\System\SskFDbm.exe
  2⤵
  PID:7916
- C:\Windows\System\UriDHmX.exe
  C:\Windows\System\UriDHmX.exe
  2⤵
  PID:8100
- C:\Windows\System\DLVeJiD.exe
  C:\Windows\System\DLVeJiD.exe
  2⤵
  PID:8168
- C:\Windows\System\EeMxTCy.exe
  C:\Windows\System\EeMxTCy.exe
  2⤵
  PID:7176
- C:\Windows\System\LAGxBXR.exe
  C:\Windows\System\LAGxBXR.exe
  2⤵
  PID:7364
- C:\Windows\System\UJehgAP.exe
  C:\Windows\System\UJehgAP.exe
  2⤵
  PID:7552
- C:\Windows\System\TrXXzgF.exe
  C:\Windows\System\TrXXzgF.exe
  2⤵
  PID:7852
- C:\Windows\System\pHOmjbU.exe
  C:\Windows\System\pHOmjbU.exe
  2⤵
  PID:7432
- C:\Windows\System\jwevBwn.exe
  C:\Windows\System\jwevBwn.exe
  2⤵
  PID:7528
- C:\Windows\System\PwypvKZ.exe
  C:\Windows\System\PwypvKZ.exe
  2⤵
  PID:6412
- C:\Windows\System\wbEHmcS.exe
  C:\Windows\System\wbEHmcS.exe
  2⤵
  PID:7708
- C:\Windows\System\fNnUypl.exe
  C:\Windows\System\fNnUypl.exe
  2⤵
  PID:8220
- C:\Windows\System\MRFYOlZ.exe
  C:\Windows\System\MRFYOlZ.exe
  2⤵
  PID:8244
- C:\Windows\System\oVSpLLZ.exe
  C:\Windows\System\oVSpLLZ.exe
  2⤵
  PID:8272
- C:\Windows\System\eYSfkJO.exe
  C:\Windows\System\eYSfkJO.exe
  2⤵
  PID:8296
- C:\Windows\System\ZetKACp.exe
  C:\Windows\System\ZetKACp.exe
  2⤵
  PID:8316
- C:\Windows\System\iRTMmjj.exe
  C:\Windows\System\iRTMmjj.exe
  2⤵
  PID:8340
- C:\Windows\System\eTcdpjJ.exe
  C:\Windows\System\eTcdpjJ.exe
  2⤵
  PID:8364
- C:\Windows\System\FzGRcQT.exe
  C:\Windows\System\FzGRcQT.exe
  2⤵
  PID:8396
- C:\Windows\System\epCPflx.exe
  C:\Windows\System\epCPflx.exe
  2⤵
  PID:8424
- C:\Windows\System\BgBqEoX.exe
  C:\Windows\System\BgBqEoX.exe
  2⤵
  PID:8444
- C:\Windows\System\XkpNyyJ.exe
  C:\Windows\System\XkpNyyJ.exe
  2⤵
  PID:8540
- C:\Windows\System\kxupGCT.exe
  C:\Windows\System\kxupGCT.exe
  2⤵
  PID:8572
- C:\Windows\System\SHNMmlt.exe
  C:\Windows\System\SHNMmlt.exe
  2⤵
  PID:8608
- C:\Windows\System\XivleaA.exe
  C:\Windows\System\XivleaA.exe
  2⤵
  PID:8640
- C:\Windows\System\gQzxvWG.exe
  C:\Windows\System\gQzxvWG.exe
  2⤵
  PID:8668
- C:\Windows\System\anPofWl.exe
  C:\Windows\System\anPofWl.exe
  2⤵
  PID:8692
- C:\Windows\System\bUhKPzk.exe
  C:\Windows\System\bUhKPzk.exe
  2⤵
  PID:8716
- C:\Windows\System\nngyyDR.exe
  C:\Windows\System\nngyyDR.exe
  2⤵
  PID:8736
- C:\Windows\System\iSjpwye.exe
  C:\Windows\System\iSjpwye.exe
  2⤵
  PID:8764
- C:\Windows\System\TXyUVGZ.exe
  C:\Windows\System\TXyUVGZ.exe
  2⤵
  PID:8792
- C:\Windows\System\JtmbVsX.exe
  C:\Windows\System\JtmbVsX.exe
  2⤵
  PID:8808
- C:\Windows\System\ZtcbUsH.exe
  C:\Windows\System\ZtcbUsH.exe
  2⤵
  PID:8836
- C:\Windows\System\XzlbbKw.exe
  C:\Windows\System\XzlbbKw.exe
  2⤵
  PID:8856
- C:\Windows\System\lmIkvDe.exe
  C:\Windows\System\lmIkvDe.exe
  2⤵
  PID:8884
- C:\Windows\System\AaQXQjz.exe
  C:\Windows\System\AaQXQjz.exe
  2⤵
  PID:8912
- C:\Windows\System\xUpgyFg.exe
  C:\Windows\System\xUpgyFg.exe
  2⤵
  PID:8936
- C:\Windows\System\dPIOxAT.exe
  C:\Windows\System\dPIOxAT.exe
  2⤵
  PID:8964
- C:\Windows\System\kMusSZA.exe
  C:\Windows\System\kMusSZA.exe
  2⤵
  PID:8984
- C:\Windows\System\QJtRupL.exe
  C:\Windows\System\QJtRupL.exe
  2⤵
  PID:9012
- C:\Windows\System\ZcSPzkX.exe
  C:\Windows\System\ZcSPzkX.exe
  2⤵
  PID:9036
- C:\Windows\System\fdypkWI.exe
  C:\Windows\System\fdypkWI.exe
  2⤵
  PID:9060
- C:\Windows\System\KlnZVdC.exe
  C:\Windows\System\KlnZVdC.exe
  2⤵
  PID:9080
- C:\Windows\System\hMJAzRP.exe
  C:\Windows\System\hMJAzRP.exe
  2⤵
  PID:9108
- C:\Windows\System\kTbSiYX.exe
  C:\Windows\System\kTbSiYX.exe
  2⤵
  PID:9132
- C:\Windows\System\ZXdAAQQ.exe
  C:\Windows\System\ZXdAAQQ.exe
  2⤵
  PID:9156
- C:\Windows\System\BTTLfNp.exe
  C:\Windows\System\BTTLfNp.exe
  2⤵
  PID:9188
- C:\Windows\System\nbfLsMJ.exe
  C:\Windows\System\nbfLsMJ.exe
  2⤵
  PID:7756
- C:\Windows\System\geQrBQV.exe
  C:\Windows\System\geQrBQV.exe
  2⤵
  PID:7320
- C:\Windows\System\NbxhwRV.exe
  C:\Windows\System\NbxhwRV.exe
  2⤵
  PID:8240
- C:\Windows\System\iQFXmUQ.exe
  C:\Windows\System\iQFXmUQ.exe
  2⤵
  PID:8228
- C:\Windows\System\mZNQyjB.exe
  C:\Windows\System\mZNQyjB.exe
  2⤵
  PID:7920
- C:\Windows\System\UricjnB.exe
  C:\Windows\System\UricjnB.exe
  2⤵
  PID:8284
- C:\Windows\System\vPKiPBY.exe
  C:\Windows\System\vPKiPBY.exe
  2⤵
  PID:8512
- C:\Windows\System\RDfXDMd.exe
  C:\Windows\System\RDfXDMd.exe
  2⤵
  PID:8432
- C:\Windows\System\ZAFJgIJ.exe
  C:\Windows\System\ZAFJgIJ.exe
  2⤵
  PID:8616
- C:\Windows\System\DcyjfOq.exe
  C:\Windows\System\DcyjfOq.exe
  2⤵
  PID:8596
- C:\Windows\System\hZjJnze.exe
  C:\Windows\System\hZjJnze.exe
  2⤵
  PID:8748
- C:\Windows\System\vFJtvwl.exe
  C:\Windows\System\vFJtvwl.exe
  2⤵
  PID:8592
- C:\Windows\System\xtikMRy.exe
  C:\Windows\System\xtikMRy.exe
  2⤵
  PID:8816
- C:\Windows\System\KdkwIoC.exe
  C:\Windows\System\KdkwIoC.exe
  2⤵
  PID:8876
- C:\Windows\System\FERFRAE.exe
  C:\Windows\System\FERFRAE.exe
  2⤵
  PID:8980
- C:\Windows\System\knhtctR.exe
  C:\Windows\System\knhtctR.exe
  2⤵
  PID:8948
- C:\Windows\System\aOXPVrK.exe
  C:\Windows\System\aOXPVrK.exe
  2⤵
  PID:8932
- C:\Windows\System\WRxDZih.exe
  C:\Windows\System\WRxDZih.exe
  2⤵
  PID:8356
- C:\Windows\System\pkjwzFX.exe
  C:\Windows\System\pkjwzFX.exe
  2⤵
  PID:9052
- C:\Windows\System\ZmKuPHv.exe
  C:\Windows\System\ZmKuPHv.exe
  2⤵
  PID:8908
- C:\Windows\System\CJHBHOq.exe
  C:\Windows\System\CJHBHOq.exe
  2⤵
  PID:8664
- C:\Windows\System\EpgYCgR.exe
  C:\Windows\System\EpgYCgR.exe
  2⤵
  PID:8928
- C:\Windows\System\WbHXVlw.exe
  C:\Windows\System\WbHXVlw.exe
  2⤵
  PID:8312
- C:\Windows\System\jTqTyyS.exe
  C:\Windows\System\jTqTyyS.exe
  2⤵
  PID:7868
- C:\Windows\System\hPTqbBV.exe
  C:\Windows\System\hPTqbBV.exe
  2⤵
  PID:5544
- C:\Windows\System\gpbdjwO.exe
  C:\Windows\System\gpbdjwO.exe
  2⤵
  PID:9056
- C:\Windows\System\VpxJujr.exe
  C:\Windows\System\VpxJujr.exe
  2⤵
  PID:8756
- C:\Windows\System\fBamDRm.exe
  C:\Windows\System\fBamDRm.exe
  2⤵
  PID:9076
- C:\Windows\System\pMnxjPC.exe
  C:\Windows\System\pMnxjPC.exe
  2⤵
  PID:9228
- C:\Windows\System\aFUcGOW.exe
  C:\Windows\System\aFUcGOW.exe
  2⤵
  PID:9244
- C:\Windows\System\kHTcVdj.exe
  C:\Windows\System\kHTcVdj.exe
  2⤵
  PID:9268
- C:\Windows\System\NoPXFYA.exe
  C:\Windows\System\NoPXFYA.exe
  2⤵
  PID:9284
- C:\Windows\System\IagSyqI.exe
  C:\Windows\System\IagSyqI.exe
  2⤵
  PID:9312
- C:\Windows\System\IvLDKdG.exe
  C:\Windows\System\IvLDKdG.exe
  2⤵
  PID:9340
- C:\Windows\System\tqEoMrg.exe
  C:\Windows\System\tqEoMrg.exe
  2⤵
  PID:9368
- C:\Windows\System\NcnjUZW.exe
  C:\Windows\System\NcnjUZW.exe
  2⤵
  PID:9392
- C:\Windows\System\GVxuStt.exe
  C:\Windows\System\GVxuStt.exe
  2⤵
  PID:9420
- C:\Windows\System\pyHVQHP.exe
  C:\Windows\System\pyHVQHP.exe
  2⤵
  PID:9444
- C:\Windows\System\rTVAuja.exe
  C:\Windows\System\rTVAuja.exe
  2⤵
  PID:9464
- C:\Windows\System\uUDRUpo.exe
  C:\Windows\System\uUDRUpo.exe
  2⤵
  PID:9516
- C:\Windows\System\bEySVsm.exe
  C:\Windows\System\bEySVsm.exe
  2⤵
  PID:9544
- C:\Windows\System\unTYdFq.exe
  C:\Windows\System\unTYdFq.exe
  2⤵
  PID:9568
- C:\Windows\System\vjMqYUH.exe
  C:\Windows\System\vjMqYUH.exe
  2⤵
  PID:9596
- C:\Windows\System\hzBZQYS.exe
  C:\Windows\System\hzBZQYS.exe
  2⤵
  PID:9620
- C:\Windows\System\YJNcJoK.exe
  C:\Windows\System\YJNcJoK.exe
  2⤵
  PID:9652
- C:\Windows\System\GyWooZt.exe
  C:\Windows\System\GyWooZt.exe
  2⤵
  PID:9676
- C:\Windows\System\ohbwvwv.exe
  C:\Windows\System\ohbwvwv.exe
  2⤵
  PID:9704
- C:\Windows\System\QXkTwYy.exe
  C:\Windows\System\QXkTwYy.exe
  2⤵
  PID:9724
- C:\Windows\System\zzVCqtf.exe
  C:\Windows\System\zzVCqtf.exe
  2⤵
  PID:9752
- C:\Windows\System\PDayFoo.exe
  C:\Windows\System\PDayFoo.exe
  2⤵
  PID:9776
- C:\Windows\System\RoSEWqi.exe
  C:\Windows\System\RoSEWqi.exe
  2⤵
  PID:9792
- C:\Windows\System\RqeyEuX.exe
  C:\Windows\System\RqeyEuX.exe
  2⤵
  PID:9820
- C:\Windows\System\pIlZwnR.exe
  C:\Windows\System\pIlZwnR.exe
  2⤵
  PID:9840
- C:\Windows\System\ykkiHdS.exe
  C:\Windows\System\ykkiHdS.exe
  2⤵
  PID:9864
- C:\Windows\System\VmSdFKm.exe
  C:\Windows\System\VmSdFKm.exe
  2⤵
  PID:9892
- C:\Windows\System\moIZMIn.exe
  C:\Windows\System\moIZMIn.exe
  2⤵
  PID:9920
- C:\Windows\System\KaXTqhy.exe
  C:\Windows\System\KaXTqhy.exe
  2⤵
  PID:9948
- C:\Windows\System\ezCUhDi.exe
  C:\Windows\System\ezCUhDi.exe
  2⤵
  PID:9976
- C:\Windows\System\ZEzvDqx.exe
  C:\Windows\System\ZEzvDqx.exe
  2⤵
  PID:9996
- C:\Windows\System\SCMwwpu.exe
  C:\Windows\System\SCMwwpu.exe
  2⤵
  PID:10024
- C:\Windows\System\vcAyDMx.exe
  C:\Windows\System\vcAyDMx.exe
  2⤵
  PID:10044
- C:\Windows\System\bDhqQqt.exe
  C:\Windows\System\bDhqQqt.exe
  2⤵
  PID:10068
- C:\Windows\System\RFtCHXq.exe
  C:\Windows\System\RFtCHXq.exe
  2⤵
  PID:10100
- C:\Windows\System\XZrdMTl.exe
  C:\Windows\System\XZrdMTl.exe
  2⤵
  PID:10128
- C:\Windows\System\CaMnmHv.exe
  C:\Windows\System\CaMnmHv.exe
  2⤵
  PID:10156
- C:\Windows\System\dlpYJVC.exe
  C:\Windows\System\dlpYJVC.exe
  2⤵
  PID:10188
- C:\Windows\System\RCxyUKa.exe
  C:\Windows\System\RCxyUKa.exe
  2⤵
  PID:10216
- C:\Windows\System\keajZPd.exe
  C:\Windows\System\keajZPd.exe
  2⤵
  PID:10236
- C:\Windows\System\dGWWJZc.exe
  C:\Windows\System\dGWWJZc.exe
  2⤵
  PID:8372
- C:\Windows\System\jjCaIhA.exe
  C:\Windows\System\jjCaIhA.exe
  2⤵
  PID:9224
- C:\Windows\System\dHHzOXD.exe
  C:\Windows\System\dHHzOXD.exe
  2⤵
  PID:9240
- C:\Windows\System\keQHjYr.exe
  C:\Windows\System\keQHjYr.exe
  2⤵
  PID:9328
- C:\Windows\System\xPShmpA.exe
  C:\Windows\System\xPShmpA.exe
  2⤵
  PID:9380
- C:\Windows\System\JsZtodZ.exe
  C:\Windows\System\JsZtodZ.exe
  2⤵
  PID:9508
- C:\Windows\System\rutJIkl.exe
  C:\Windows\System\rutJIkl.exe
  2⤵
  PID:9536
- C:\Windows\System\mZWWlWJ.exe
  C:\Windows\System\mZWWlWJ.exe
  2⤵
  PID:9672
- C:\Windows\System\kWmzoXE.exe
  C:\Windows\System\kWmzoXE.exe
  2⤵
  PID:9608
- C:\Windows\System\iMxHtvH.exe
  C:\Windows\System\iMxHtvH.exe
  2⤵
  PID:10016
- C:\Windows\System\DazMGtR.exe
  C:\Windows\System\DazMGtR.exe
  2⤵
  PID:9964
- C:\Windows\System\pBQvMmh.exe
  C:\Windows\System\pBQvMmh.exe
  2⤵
  PID:10088
- C:\Windows\System\cwZBbEi.exe
  C:\Windows\System\cwZBbEi.exe
  2⤵
  PID:10148
- C:\Windows\System\vXEfqMU.exe
  C:\Windows\System\vXEfqMU.exe
  2⤵
  PID:9556
- C:\Windows\System\NskJMuF.exe
  C:\Windows\System\NskJMuF.exe
  2⤵
  PID:9688
- C:\Windows\System\nnROWgG.exe
  C:\Windows\System\nnROWgG.exe
  2⤵
  PID:9264
- C:\Windows\System\WhNlTlg.exe
  C:\Windows\System\WhNlTlg.exe
  2⤵
  PID:9360
- C:\Windows\System\nPRMkvZ.exe
  C:\Windows\System\nPRMkvZ.exe
  2⤵
  PID:9928
- C:\Windows\System\oPBXVxB.exe
  C:\Windows\System\oPBXVxB.exe
  2⤵
  PID:10020
- C:\Windows\System\yrMmLmq.exe
  C:\Windows\System\yrMmLmq.exe
  2⤵
  PID:10064
- C:\Windows\System\xeZOCca.exe
  C:\Windows\System\xeZOCca.exe
  2⤵
  PID:10152
- C:\Windows\System\WzpubTK.exe
  C:\Windows\System\WzpubTK.exe
  2⤵
  PID:9440
- C:\Windows\System\KGXtKeb.exe
  C:\Windows\System\KGXtKeb.exe
  2⤵
  PID:10136
- C:\Windows\System\AMhkbui.exe
  C:\Windows\System\AMhkbui.exe
  2⤵
  PID:10196
- C:\Windows\System\VjGXSnE.exe
  C:\Windows\System\VjGXSnE.exe
  2⤵
  PID:10256
- C:\Windows\System\exrQyNc.exe
  C:\Windows\System\exrQyNc.exe
  2⤵
  PID:10304
- C:\Windows\System\tMbGxEp.exe
  C:\Windows\System\tMbGxEp.exe
  2⤵
  PID:10332
- C:\Windows\System\OttXCFL.exe
  C:\Windows\System\OttXCFL.exe
  2⤵
  PID:10360
- C:\Windows\System\PrUtpdu.exe
  C:\Windows\System\PrUtpdu.exe
  2⤵
  PID:10384
- C:\Windows\System\KjxxGQt.exe
  C:\Windows\System\KjxxGQt.exe
  2⤵
  PID:10404
- C:\Windows\System\GFHReGW.exe
  C:\Windows\System\GFHReGW.exe
  2⤵
  PID:10428
- C:\Windows\System\meGBuml.exe
  C:\Windows\System\meGBuml.exe
  2⤵
  PID:10456
- C:\Windows\System\sxLLdGb.exe
  C:\Windows\System\sxLLdGb.exe
  2⤵
  PID:10472
- C:\Windows\System\TfYOxts.exe
  C:\Windows\System\TfYOxts.exe
  2⤵
  PID:10496
- C:\Windows\System\soPqYHb.exe
  C:\Windows\System\soPqYHb.exe
  2⤵
  PID:10516
- C:\Windows\System\ybMuyeT.exe
  C:\Windows\System\ybMuyeT.exe
  2⤵
  PID:10532
- C:\Windows\System\KMYvTbz.exe
  C:\Windows\System\KMYvTbz.exe
  2⤵
  PID:10552
- C:\Windows\System\lmsxHcZ.exe
  C:\Windows\System\lmsxHcZ.exe
  2⤵
  PID:10576
- C:\Windows\System\UOchNHt.exe
  C:\Windows\System\UOchNHt.exe
  2⤵
  PID:10668
- C:\Windows\System\gZZyDiz.exe
  C:\Windows\System\gZZyDiz.exe
  2⤵
  PID:10704
- C:\Windows\System\wNRskzu.exe
  C:\Windows\System\wNRskzu.exe
  2⤵
  PID:10736
- C:\Windows\System\YNrUTqH.exe
  C:\Windows\System\YNrUTqH.exe
  2⤵
  PID:10756
- C:\Windows\System\ebNrVdA.exe
  C:\Windows\System\ebNrVdA.exe
  2⤵
  PID:10784
- C:\Windows\System\BQBodDO.exe
  C:\Windows\System\BQBodDO.exe
  2⤵
  PID:10816
- C:\Windows\System\tYeMJhK.exe
  C:\Windows\System\tYeMJhK.exe
  2⤵
  PID:10848
- C:\Windows\System\mGecJBh.exe
  C:\Windows\System\mGecJBh.exe
  2⤵
  PID:10868
- C:\Windows\System\aoSDFgo.exe
  C:\Windows\System\aoSDFgo.exe
  2⤵
  PID:10932
- C:\Windows\System\WQCjLFU.exe
  C:\Windows\System\WQCjLFU.exe
  2⤵
  PID:10960
- C:\Windows\System\ElJUVZR.exe
  C:\Windows\System\ElJUVZR.exe
  2⤵
  PID:10980
- C:\Windows\System\sTvARMO.exe
  C:\Windows\System\sTvARMO.exe
  2⤵
  PID:11044
- C:\Windows\System\KWNQsRR.exe
  C:\Windows\System\KWNQsRR.exe
  2⤵
  PID:11084
- C:\Windows\System\CUecCAn.exe
  C:\Windows\System\CUecCAn.exe
  2⤵
  PID:11112
- C:\Windows\System\FpelAyJ.exe
  C:\Windows\System\FpelAyJ.exe
  2⤵
  PID:11132
- C:\Windows\System\FhgZbLd.exe
  C:\Windows\System\FhgZbLd.exe
  2⤵
  PID:11156
- C:\Windows\System\NffyAAs.exe
  C:\Windows\System\NffyAAs.exe
  2⤵
  PID:11176
- C:\Windows\System\rACqlCe.exe
  C:\Windows\System\rACqlCe.exe
  2⤵
  PID:11200
- C:\Windows\System\pnPVsIg.exe
  C:\Windows\System\pnPVsIg.exe
  2⤵
  PID:11220
- C:\Windows\System\ULcDTeU.exe
  C:\Windows\System\ULcDTeU.exe
  2⤵
  PID:11240
- C:\Windows\System\fFLThhM.exe
  C:\Windows\System\fFLThhM.exe
  2⤵
  PID:11256
- C:\Windows\System\kEGQiwH.exe
  C:\Windows\System\kEGQiwH.exe
  2⤵
  PID:9352
- C:\Windows\System\mnvhDTK.exe
  C:\Windows\System\mnvhDTK.exe
  2⤵
  PID:10324
- C:\Windows\System\SiEYoOz.exe
  C:\Windows\System\SiEYoOz.exe
  2⤵
  PID:10296
- C:\Windows\System\kegjGyk.exe
  C:\Windows\System\kegjGyk.exe
  2⤵
  PID:10504
- C:\Windows\System\DKBFDaq.exe
  C:\Windows\System\DKBFDaq.exe
  2⤵
  PID:10368
- C:\Windows\System\bcSdtaY.exe
  C:\Windows\System\bcSdtaY.exe
  2⤵
  PID:10400
- C:\Windows\System\BjdRtWI.exe
  C:\Windows\System\BjdRtWI.exe
  2⤵
  PID:10548
- C:\Windows\System\MZxXwmB.exe
  C:\Windows\System\MZxXwmB.exe
  2⤵
  PID:10684
- C:\Windows\System\SBdFgTL.exe
  C:\Windows\System\SBdFgTL.exe
  2⤵
  PID:10692
- C:\Windows\System\iIpMfiD.exe
  C:\Windows\System\iIpMfiD.exe
  2⤵
  PID:10712
- C:\Windows\System\tLMaLcO.exe
  C:\Windows\System\tLMaLcO.exe
  2⤵
  PID:10828
- C:\Windows\System\cULCqHy.exe
  C:\Windows\System\cULCqHy.exe
  2⤵
  PID:10844
- C:\Windows\System\qOVPuQm.exe
  C:\Windows\System\qOVPuQm.exe
  2⤵
  PID:10988
- C:\Windows\System\FCSDZnR.exe
  C:\Windows\System\FCSDZnR.exe
  2⤵
  PID:11020
- C:\Windows\System\mvrMCAl.exe
  C:\Windows\System\mvrMCAl.exe
  2⤵
  PID:11152
- C:\Windows\System\NqAapPt.exe
  C:\Windows\System\NqAapPt.exe
  2⤵
  PID:11188
- C:\Windows\System\srzetkn.exe
  C:\Windows\System\srzetkn.exe
  2⤵
  PID:11212
- C:\Windows\System\ybkHklR.exe
  C:\Windows\System\ybkHklR.exe
  2⤵
  PID:10312
- C:\Windows\System\YQYDljL.exe
  C:\Windows\System\YQYDljL.exe
  2⤵
  PID:10248
- C:\Windows\System\rMsYpFI.exe
  C:\Windows\System\rMsYpFI.exe
  2⤵
  PID:876
- C:\Windows\System\yaqdlxp.exe
  C:\Windows\System\yaqdlxp.exe
  2⤵
  PID:10524
- C:\Windows\System\kxHPMqj.exe
  C:\Windows\System\kxHPMqj.exe
  2⤵
  PID:10856
- C:\Windows\System\hhaeTMA.exe
  C:\Windows\System\hhaeTMA.exe
  2⤵
  PID:10392
- C:\Windows\System\HRNPDRl.exe
  C:\Windows\System\HRNPDRl.exe
  2⤵
  PID:9848
- C:\Windows\System\TEuBbrH.exe
  C:\Windows\System\TEuBbrH.exe
  2⤵
  PID:11128
- C:\Windows\System\WKewgny.exe
  C:\Windows\System\WKewgny.exe
  2⤵
  PID:11184
- C:\Windows\System\pEFyCzo.exe
  C:\Windows\System\pEFyCzo.exe
  2⤵
  PID:11236
- C:\Windows\System\uTlLXgQ.exe
  C:\Windows\System\uTlLXgQ.exe
  2⤵
  PID:11284
- C:\Windows\System\simRtby.exe
  C:\Windows\System\simRtby.exe
  2⤵
  PID:11308
- C:\Windows\System\LHQTJZA.exe
  C:\Windows\System\LHQTJZA.exe
  2⤵
  PID:11336
- C:\Windows\System\NVpSvhM.exe
  C:\Windows\System\NVpSvhM.exe
  2⤵
  PID:11372
- C:\Windows\System\yXomova.exe
  C:\Windows\System\yXomova.exe
  2⤵
  PID:11396
- C:\Windows\System\SpKRfAz.exe
  C:\Windows\System\SpKRfAz.exe
  2⤵
  PID:11428
- C:\Windows\System\TzKDwJZ.exe
  C:\Windows\System\TzKDwJZ.exe
  2⤵
  PID:11456
- C:\Windows\System\eWVTgiI.exe
  C:\Windows\System\eWVTgiI.exe
  2⤵
  PID:11484
- C:\Windows\System\SlKDGXF.exe
  C:\Windows\System\SlKDGXF.exe
  2⤵
  PID:11508
- C:\Windows\System\rHKZDLs.exe
  C:\Windows\System\rHKZDLs.exe
  2⤵
  PID:11532
- C:\Windows\System\mIdBtFv.exe
  C:\Windows\System\mIdBtFv.exe
  2⤵
  PID:11560
- C:\Windows\System\wVlvvVj.exe
  C:\Windows\System\wVlvvVj.exe
  2⤵
  PID:11588
- C:\Windows\System\pjywpzf.exe
  C:\Windows\System\pjywpzf.exe
  2⤵
  PID:11608
- C:\Windows\System\lDFVByD.exe
  C:\Windows\System\lDFVByD.exe
  2⤵
  PID:11640
- C:\Windows\System\pSHMzyn.exe
  C:\Windows\System\pSHMzyn.exe
  2⤵
  PID:11664
- C:\Windows\System\FbKGDWi.exe
  C:\Windows\System\FbKGDWi.exe
  2⤵
  PID:11692
- C:\Windows\System\kGAVjNx.exe
  C:\Windows\System\kGAVjNx.exe
  2⤵
  PID:11716
- C:\Windows\System\cWOzhUL.exe
  C:\Windows\System\cWOzhUL.exe
  2⤵
  PID:11740
- C:\Windows\System\mmFMjUD.exe
  C:\Windows\System\mmFMjUD.exe
  2⤵
  PID:11768
- C:\Windows\System\cQwdCcG.exe
  C:\Windows\System\cQwdCcG.exe
  2⤵
  PID:11792
- C:\Windows\System\QOkRerV.exe
  C:\Windows\System\QOkRerV.exe
  2⤵
  PID:11816
- C:\Windows\System\XQSKJRT.exe
  C:\Windows\System\XQSKJRT.exe
  2⤵
  PID:11836
- C:\Windows\System\AGARMCB.exe
  C:\Windows\System\AGARMCB.exe
  2⤵
  PID:11860
- C:\Windows\System\qErlcqB.exe
  C:\Windows\System\qErlcqB.exe
  2⤵
  PID:11892
- C:\Windows\System\qEiGIVY.exe
  C:\Windows\System\qEiGIVY.exe
  2⤵
  PID:11920
- C:\Windows\System\XNgTscR.exe
  C:\Windows\System\XNgTscR.exe
  2⤵
  PID:11944
- C:\Windows\System\iLpwGcP.exe
  C:\Windows\System\iLpwGcP.exe
  2⤵
  PID:11972
- C:\Windows\System\KrKAsEz.exe
  C:\Windows\System\KrKAsEz.exe
  2⤵
  PID:12004
- C:\Windows\System\MtKxijr.exe
  C:\Windows\System\MtKxijr.exe
  2⤵
  PID:12024
- C:\Windows\System\dhPounp.exe
  C:\Windows\System\dhPounp.exe
  2⤵
  PID:12048
- C:\Windows\System\QDDBlHL.exe
  C:\Windows\System\QDDBlHL.exe
  2⤵
  PID:12076
- C:\Windows\System\cdjkzPI.exe
  C:\Windows\System\cdjkzPI.exe
  2⤵
  PID:12168
- C:\Windows\System\sSzmBVU.exe
  C:\Windows\System\sSzmBVU.exe
  2⤵
  PID:12200
- C:\Windows\System\sZOLhXl.exe
  C:\Windows\System\sZOLhXl.exe
  2⤵
  PID:12228
- C:\Windows\System\xrGNWXl.exe
  C:\Windows\System\xrGNWXl.exe
  2⤵
  PID:12256
- C:\Windows\System\AfuVLMJ.exe
  C:\Windows\System\AfuVLMJ.exe
  2⤵
  PID:12284
- C:\Windows\System\UnzsZUJ.exe
  C:\Windows\System\UnzsZUJ.exe
  2⤵
  PID:10272
- C:\Windows\System\zWpokin.exe
  C:\Windows\System\zWpokin.exe
  2⤵
  PID:4816
- C:\Windows\System\ySEzjTP.exe
  C:\Windows\System\ySEzjTP.exe
  2⤵
  PID:10728
- C:\Windows\System\nxtfRSL.exe
  C:\Windows\System\nxtfRSL.exe
  2⤵
  PID:11520
- C:\Windows\System\pdPurQw.exe
  C:\Windows\System\pdPurQw.exe
  2⤵
  PID:11352
- C:\Windows\System\ifWXHBi.exe
  C:\Windows\System\ifWXHBi.exe
  2⤵
  PID:11416
- C:\Windows\System\saduVcX.exe
  C:\Windows\System\saduVcX.exe
  2⤵
  PID:11656
- C:\Windows\System\xPIFjxS.exe
  C:\Windows\System\xPIFjxS.exe
  2⤵
  PID:11712
- C:\Windows\System\YuFGgAn.exe
  C:\Windows\System\YuFGgAn.exe
  2⤵
  PID:4936
- C:\Windows\System\jEtQljA.exe
  C:\Windows\System\jEtQljA.exe
  2⤵
  PID:11604
- C:\Windows\System\UraGGrN.exe
  C:\Windows\System\UraGGrN.exe
  2⤵
  PID:11652
- C:\Windows\System\FnuCBvM.exe
  C:\Windows\System\FnuCBvM.exe
  2⤵
  PID:11728
- C:\Windows\System\wtZNIUx.exe
  C:\Windows\System\wtZNIUx.exe
  2⤵
  PID:11888
- C:\Windows\System\rZNytWC.exe
  C:\Windows\System\rZNytWC.exe
  2⤵
  PID:4512
- C:\Windows\System\wvRkvKD.exe
  C:\Windows\System\wvRkvKD.exe
  2⤵
  PID:11596
- C:\Windows\System\LisdHUR.exe
  C:\Windows\System\LisdHUR.exe
  2⤵
  PID:1780
- C:\Windows\System\MVCjPZC.exe
  C:\Windows\System\MVCjPZC.exe
  2⤵
  PID:3888
- C:\Windows\System\OeGjqtr.exe
  C:\Windows\System\OeGjqtr.exe
  2⤵
  PID:11852
- C:\Windows\System\KZxTkSA.exe
  C:\Windows\System\KZxTkSA.exe
  2⤵
  PID:11956
- C:\Windows\System\mLKuTKZ.exe
  C:\Windows\System\mLKuTKZ.exe
  2⤵
  PID:2288
- C:\Windows\System\sxUAbPF.exe
  C:\Windows\System\sxUAbPF.exe
  2⤵
  PID:2192
- C:\Windows\System\aQIqyTj.exe
  C:\Windows\System\aQIqyTj.exe
  2⤵
  PID:11780
- C:\Windows\System\RlNJKpn.exe
  C:\Windows\System\RlNJKpn.exe
  2⤵
  PID:12040
- C:\Windows\System\GTHQyME.exe
  C:\Windows\System\GTHQyME.exe
  2⤵
  PID:1420
- C:\Windows\System\DdnGYWl.exe
  C:\Windows\System\DdnGYWl.exe
  2⤵
  PID:3300
- C:\Windows\System\HELNBvZ.exe
  C:\Windows\System\HELNBvZ.exe
  2⤵
  PID:3168
- C:\Windows\System\UYLicvG.exe
  C:\Windows\System\UYLicvG.exe
  2⤵
  PID:12324
- C:\Windows\System\ErrRDzT.exe
  C:\Windows\System\ErrRDzT.exe
  2⤵
  PID:12340
- C:\Windows\System\MkflxHv.exe
  C:\Windows\System\MkflxHv.exe
  2⤵
  PID:12360
- C:\Windows\System\qaVGLsR.exe
  C:\Windows\System\qaVGLsR.exe
  2⤵
  PID:12384
- C:\Windows\System\sDDvdpW.exe
  C:\Windows\System\sDDvdpW.exe
  2⤵
  PID:12400
- C:\Windows\System\ORflBUC.exe
  C:\Windows\System\ORflBUC.exe
  2⤵
  PID:12444
- C:\Windows\System\Rgmahxw.exe
  C:\Windows\System\Rgmahxw.exe
  2⤵
  PID:12460
- C:\Windows\System\FymjOqR.exe
  C:\Windows\System\FymjOqR.exe
  2⤵
  PID:12484
- C:\Windows\System\TlldRtu.exe
  C:\Windows\System\TlldRtu.exe
  2⤵
  PID:12512
- C:\Windows\System\KWOkAFS.exe
  C:\Windows\System\KWOkAFS.exe
  2⤵
  PID:12576
- C:\Windows\System\pMdeOWh.exe
  C:\Windows\System\pMdeOWh.exe
  2⤵
  PID:12608
- C:\Windows\System\lGbFDZy.exe
  C:\Windows\System\lGbFDZy.exe
  2⤵
  PID:12640
- C:\Windows\System\qIvsODY.exe
  C:\Windows\System\qIvsODY.exe
  2⤵
  PID:12668
- C:\Windows\System\zzumNHs.exe
  C:\Windows\System\zzumNHs.exe
  2⤵
  PID:12700
- C:\Windows\System\XFjEVEi.exe
  C:\Windows\System\XFjEVEi.exe
  2⤵
  PID:12724
- C:\Windows\System\fCpUxvh.exe
  C:\Windows\System\fCpUxvh.exe
  2⤵
  PID:12748
- C:\Windows\System\lmNnCFD.exe
  C:\Windows\System\lmNnCFD.exe
  2⤵
  PID:12768
- C:\Windows\System\dOzqfhU.exe
  C:\Windows\System\dOzqfhU.exe
  2⤵
  PID:12788
- C:\Windows\System\TRfKFZO.exe
  C:\Windows\System\TRfKFZO.exe
  2⤵
  PID:12812
- C:\Windows\System\FYFSGWT.exe
  C:\Windows\System\FYFSGWT.exe
  2⤵
  PID:12848
- C:\Windows\System\PqAGroq.exe
  C:\Windows\System\PqAGroq.exe
  2⤵
  PID:12868
- C:\Windows\System\HHlzeQL.exe
  C:\Windows\System\HHlzeQL.exe
  2⤵
  PID:12884
- C:\Windows\System\kjNdVNB.exe
  C:\Windows\System\kjNdVNB.exe
  2⤵
  PID:12920
- C:\Windows\System\AZLlzZt.exe
  C:\Windows\System\AZLlzZt.exe
  2⤵
  PID:12976
- C:\Windows\System\IDoBAHc.exe
  C:\Windows\System\IDoBAHc.exe
  2⤵
  PID:13008
- C:\Windows\System\mcRGBnF.exe
  C:\Windows\System\mcRGBnF.exe
  2⤵
  PID:13032
- C:\Windows\System\IpSSRfe.exe
  C:\Windows\System\IpSSRfe.exe
  2⤵
  PID:13088
- C:\Windows\System\VvPXtsV.exe
  C:\Windows\System\VvPXtsV.exe
  2⤵
  PID:13112
- C:\Windows\System\zlcWQWv.exe
  C:\Windows\System\zlcWQWv.exe
  2⤵
  PID:13132
- C:\Windows\System\SjFtbzC.exe
  C:\Windows\System\SjFtbzC.exe
  2⤵
  PID:13160
- C:\Windows\System\mOIxWmp.exe
  C:\Windows\System\mOIxWmp.exe
  2⤵
  PID:13212
- C:\Windows\System\OZNlqwE.exe
  C:\Windows\System\OZNlqwE.exe
  2⤵
  PID:13236
- C:\Windows\System\gLSYQNJ.exe
  C:\Windows\System\gLSYQNJ.exe
  2⤵
  PID:13268
- C:\Windows\System\TTjrufu.exe
  C:\Windows\System\TTjrufu.exe
  2⤵
  PID:13296
- C:\Windows\System\lduEejq.exe
  C:\Windows\System\lduEejq.exe
  2⤵
  PID:12044
- C:\Windows\System\CoEjzVg.exe
  C:\Windows\System\CoEjzVg.exe
  2⤵
  PID:4844
- C:\Windows\System\nPYqIcL.exe
  C:\Windows\System\nPYqIcL.exe
  2⤵
  PID:12320
- C:\Windows\System\vPodncD.exe
  C:\Windows\System\vPodncD.exe
  2⤵
  PID:12380
- C:\Windows\System\DPFfALa.exe
  C:\Windows\System\DPFfALa.exe
  2⤵
  PID:12416
- C:\Windows\System\plTeeDD.exe
  C:\Windows\System\plTeeDD.exe
  2⤵
  PID:12524
- C:\Windows\System\HfiwKPF.exe
  C:\Windows\System\HfiwKPF.exe
  2⤵
  PID:11444
- C:\Windows\System\ajrFlzL.exe
  C:\Windows\System\ajrFlzL.exe
  2⤵
  PID:12552
- C:\Windows\System\hpmdmod.exe
  C:\Windows\System\hpmdmod.exe
  2⤵
  PID:12588
- C:\Windows\System\KLdlaZa.exe
  C:\Windows\System\KLdlaZa.exe
  2⤵
  PID:12736
- C:\Windows\System\HcFLCxa.exe
  C:\Windows\System\HcFLCxa.exe
  2⤵
  PID:12692
- C:\Windows\System\Yzaedax.exe
  C:\Windows\System\Yzaedax.exe
  2⤵
  PID:12832
- C:\Windows\System\EAPovLl.exe
  C:\Windows\System\EAPovLl.exe
  2⤵
  PID:12804
- C:\Windows\System\mcltLmL.exe
  C:\Windows\System\mcltLmL.exe
  2⤵
  PID:12880
- C:\Windows\System\qccLIYH.exe
  C:\Windows\System\qccLIYH.exe
  2⤵
  PID:13024
- C:\Windows\System\ShdxtOt.exe
  C:\Windows\System\ShdxtOt.exe
  2⤵
  PID:13128
- C:\Windows\System\qWWQvLl.exe
  C:\Windows\System\qWWQvLl.exe
  2⤵
  PID:13168
- C:\Windows\System\QvTVcAm.exe
  C:\Windows\System\QvTVcAm.exe
  2⤵
  PID:13228
- C:\Windows\System\TYIDtqv.exe
  C:\Windows\System\TYIDtqv.exe
  2⤵
  PID:4884
- C:\Windows\System\sOYgGRn.exe
  C:\Windows\System\sOYgGRn.exe
  2⤵
  PID:12480
- C:\Windows\System\seKjkXZ.exe
  C:\Windows\System\seKjkXZ.exe
  2⤵
  PID:12664
- C:\Windows\System\HRYsQgZ.exe
  C:\Windows\System\HRYsQgZ.exe
  2⤵
  PID:1828
- C:\Windows\System\aUETejG.exe
  C:\Windows\System\aUETejG.exe
  2⤵
  PID:12412
- C:\Windows\System\FcJAzoz.exe
  C:\Windows\System\FcJAzoz.exe
  2⤵
  PID:13064
- C:\Windows\System\zBUxGGg.exe
  C:\Windows\System\zBUxGGg.exe
  2⤵
  PID:13308
- C:\Windows\System\mDIfJAh.exe
  C:\Windows\System\mDIfJAh.exe
  2⤵
  PID:12856
- C:\Windows\System\xtGNkmJ.exe
  C:\Windows\System\xtGNkmJ.exe
  2⤵
  PID:13328
- C:\Windows\System\WxHMVdW.exe
  C:\Windows\System\WxHMVdW.exe
  2⤵
  PID:13356
- C:\Windows\System\czOccTx.exe
  C:\Windows\System\czOccTx.exe
  2⤵
  PID:13380
- C:\Windows\System\SUYrHWC.exe
  C:\Windows\System\SUYrHWC.exe
  2⤵
  PID:13400
- C:\Windows\System\SNDnmmq.exe
  C:\Windows\System\SNDnmmq.exe
  2⤵
  PID:13416
- C:\Windows\System\IcTrvzF.exe
  C:\Windows\System\IcTrvzF.exe
  2⤵
  PID:13456
- C:\Windows\System\EFgVKtA.exe
  C:\Windows\System\EFgVKtA.exe
  2⤵
  PID:13484
- C:\Windows\System\cYRJutL.exe
  C:\Windows\System\cYRJutL.exe
  2⤵
  PID:13508
- C:\Windows\System\gnRZWPJ.exe
  C:\Windows\System\gnRZWPJ.exe
  2⤵
  PID:13528
- C:\Windows\System\XBglUdR.exe
  C:\Windows\System\XBglUdR.exe
  2⤵
  PID:13544
- C:\Windows\System\LLuCywo.exe
  C:\Windows\System\LLuCywo.exe
  2⤵
  PID:13580
- C:\Windows\System\OHXntNN.exe
  C:\Windows\System\OHXntNN.exe
  2⤵
  PID:13616
- C:\Windows\System\wKqFVds.exe
  C:\Windows\System\wKqFVds.exe
  2⤵
  PID:13640
- C:\Windows\System\jwpPjAL.exe
  C:\Windows\System\jwpPjAL.exe
  2⤵
  PID:13672
- C:\Windows\System\esAznbT.exe
  C:\Windows\System\esAznbT.exe
  2⤵
  PID:13692
- C:\Windows\System\HDeTZqI.exe
  C:\Windows\System\HDeTZqI.exe
  2⤵
  PID:13720
- C:\Windows\System\sRgELKK.exe
  C:\Windows\System\sRgELKK.exe
  2⤵
  PID:13748
- C:\Windows\System\WVauwXm.exe
  C:\Windows\System\WVauwXm.exe
  2⤵
  PID:13768
- C:\Windows\System\CJmEztK.exe
  C:\Windows\System\CJmEztK.exe
  2⤵
  PID:13784
- C:\Windows\System\HexJZjp.exe
  C:\Windows\System\HexJZjp.exe
  2⤵
  PID:13800
- C:\Windows\System\xwsWnYL.exe
  C:\Windows\System\xwsWnYL.exe
  2⤵
  PID:13820
- C:\Windows\System\yUElktJ.exe
  C:\Windows\System\yUElktJ.exe
  2⤵
  PID:13836
- C:\Windows\System\MwuslvN.exe
  C:\Windows\System\MwuslvN.exe
  2⤵
  PID:13856
- C:\Windows\System\OZacCQH.exe
  C:\Windows\System\OZacCQH.exe
  2⤵
  PID:13876
- C:\Windows\System\HLzFcir.exe
  C:\Windows\System\HLzFcir.exe
  2⤵
  PID:13908
- C:\Windows\System\luFnffe.exe
  C:\Windows\System\luFnffe.exe
  2⤵
  PID:13984
- C:\Windows\System\sPsNTPQ.exe
  C:\Windows\System\sPsNTPQ.exe
  2⤵
  PID:14004
- C:\Windows\System\IqfZpnF.exe
  C:\Windows\System\IqfZpnF.exe
  2⤵
  PID:14072
- C:\Windows\System\QtRZccu.exe
  C:\Windows\System\QtRZccu.exe
  2⤵
  PID:14108
- C:\Windows\System\TySxFrl.exe
  C:\Windows\System\TySxFrl.exe
  2⤵
  PID:14136
- C:\Windows\System\BixAqAm.exe
  C:\Windows\System\BixAqAm.exe
  2⤵
  PID:14164
- C:\Windows\System\csfFcTR.exe
  C:\Windows\System\csfFcTR.exe
  2⤵
  PID:14200
- C:\Windows\System\KALUKPg.exe
  C:\Windows\System\KALUKPg.exe
  2⤵
  PID:14240
- C:\Windows\System\VDDULrf.exe
  C:\Windows\System\VDDULrf.exe
  2⤵
  PID:14272
- C:\Windows\System\pycRtgi.exe
  C:\Windows\System\pycRtgi.exe
  2⤵
  PID:14308
- C:\Windows\System\eahHqDa.exe
  C:\Windows\System\eahHqDa.exe
  2⤵
  PID:13144
- C:\Windows\System\BkKbWey.exe
  C:\Windows\System\BkKbWey.exe
  2⤵
  PID:12948
- C:\Windows\System\HDqwHLo.exe
  C:\Windows\System\HDqwHLo.exe
  2⤵
  PID:12972
- C:\Windows\System\NBdeRMF.exe
  C:\Windows\System\NBdeRMF.exe
  2⤵
  PID:12636
- C:\Windows\System\MdzGEKb.exe
  C:\Windows\System\MdzGEKb.exe
  2⤵
  PID:13320
- C:\Windows\System\wrpgjkb.exe
  C:\Windows\System\wrpgjkb.exe
  2⤵
  PID:13364
- C:\Windows\System\xslVoCL.exe
  C:\Windows\System\xslVoCL.exe
  2⤵
  PID:13408
- C:\Windows\System\KVLSaOW.exe
  C:\Windows\System\KVLSaOW.exe
  2⤵
  PID:13780
- C:\Windows\System\NwtkqBm.exe
  C:\Windows\System\NwtkqBm.exe
  2⤵
  PID:14012
- C:\Windows\System\MKWQzbW.exe
  C:\Windows\System\MKWQzbW.exe
  2⤵
  PID:13864
- C:\Windows\System\cBLmaSa.exe
  C:\Windows\System\cBLmaSa.exe
  2⤵
  PID:14304
- C:\Windows\System\WoPLNVE.exe
  C:\Windows\System\WoPLNVE.exe
  2⤵
  PID:14152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:12784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BXkZKhu.exe

Filesize
2.0MB

MD5
eeb65849c4f3eab0969f6ca0961953d1

SHA1
4ca1535e4882b12de7b3a86801ae511a5499c2d7

SHA256
b6d41781d26c1073f9ff2a75d903059853b434cc1783a48fb86f91ced85cff52

SHA512
63a28f2c2d779e57fe65cf443fca442bd55da3c480ec380fd261749d48d194dc3ea4c8833923fb3b76173d74704f23469362c7583cfe67bffacf18d793b90200

Download Submit
C:\Windows\System\BgfudGi.exe

Filesize
2.0MB

MD5
bd715b09df04a93fc7a340748c45ad39

SHA1
580668c1cf49f05ed675844a61136339eafe4bb0

SHA256
560ef88aa1bb04b3ef130d17c1eda89557f0d3330f3b652725af36f84e9b85aa

SHA512
c9baa5ef7f30e7ecd1dd8af3f54e7ed30db5de2fe28cde231484fe66dec8f6f76a45f96abd626e307fad2546945800eb0c3f1c864e5bb4fac976868a4d22d366

Download Submit
C:\Windows\System\Gowridk.exe

Filesize
2.0MB

MD5
faf9849aed313f60fe66a99935fab69f

SHA1
8d2ab16005771967795cd901bae185a96e08142d

SHA256
54378f2f45d66c569fb74b4a432e131631bc6ccdd90bbea37234800edf00b506

SHA512
18ed9b5e32a531392b759863bcd7f9908b7462a3c61db2dadbe6c1271d0c2ce71443d63e0042765d94894d7af76caf5748c56f4fa00a9e61cc734caa3beb2edb

Download Submit
C:\Windows\System\HidhjdE.exe

Filesize
2.0MB

MD5
d11fec04132d4aee2810f41eba8ce759

SHA1
a4cd8b44f9c4ebfd772fab53b5ca310c51642839

SHA256
a4c2e17a538f7c3eb8edce52d87f2de8e06938c5412276b8be162a2a64321f0e

SHA512
411c948df7b881d68d76d44d619401c25169a8e146bfb9d31296d7756c5b05e2b47b39419b4178b666a19951d6af8773344330a29451d01cada63d5d2b5acd46

Download Submit
C:\Windows\System\HmcPNDG.exe

Filesize
2.0MB

MD5
2931fcf107fe15ec1059f603934c61fa

SHA1
b8af518ac3f9a44789f9d7d54e5643e946d53780

SHA256
b4cde17cf96086f39231fe73f2d3d5f7936221c60cd84b998041dcb2b9338957

SHA512
0415f689349a56a37e876dfd316731ff273668d4e5187ed7f8bd6e1fb71e5e446279a338ad1f38748c435de0107241b817bfbcf0c9f4ed7bf02522ef4aa5275a

Download Submit
C:\Windows\System\NQONAye.exe

Filesize
2.0MB

MD5
969b08886835280fed82f2e702ec310f

SHA1
cab4add85d1a4117c3c0a229e9f4cb6853e9adef

SHA256
a645cd40357d22750539f8c201d5dd28203e8a4efaa67e9960c395130e7aed48

SHA512
da0d29256deadbeb853ae6613ae51c5ba532a5a673cc6e530387da98d2847298870fac29d3eae10c0858261d8e3f965045d981f0e1dd14452c0750163c1ba71d

Download Submit
C:\Windows\System\QBhumPK.exe

Filesize
2.0MB

MD5
2e69902329d904875f096c437e95e11c

SHA1
926ee3d532f99f4b5dad7537d6f15a8ec055c298

SHA256
2d92083fd857a1162eb997a8687b9455729f56a86aa34fb9dffa5ffac318477e

SHA512
141d38e4cae3eb92b480c7f5dba6dbf17bd69b7d294e485028d3ef1f3c292be7fa7f4bc8923fd2305268897ca857c86c1fbeb2d178b20ed6927124fe703ac919

Download Submit
C:\Windows\System\QJSruyf.exe

Filesize
2.0MB

MD5
1e4d096a02b0d86814b1b3a6cd4025b5

SHA1
0be651865a646ae7a49860019878cce4c2fee6ff

SHA256
03ea41d03e579e05b37a5b999647111be96882411556849be46c67a0e8b0b3b6

SHA512
60605ab3550f7a8755295fd93142b509c11ff35f78207e6bbdc563cb03e96269f542d796d16fd44af1ab88925e5946c94f8037b80acf22b1a0291712bdd7a476

Download Submit
C:\Windows\System\QTaYFPV.exe

Filesize
2.0MB

MD5
63f153918c34c4010012711fa842385a

SHA1
22b94df552fe33c0b18bf166e0afc9f39c25c942

SHA256
c2994cd664f1147b5e2c2a403b744969cbec8f2b1863d486381643fc7eb15d21

SHA512
f103280b11b59b0a417d56be4ce9ad7c826bf6c69e4d4dce0287e60dda3f3c5c145052eeb5c91fc597967ae968c99a326b04cc2b4c27449efff813df34a5b616

Download Submit
C:\Windows\System\RztxwEa.exe

Filesize
2.0MB

MD5
581c79d34c9c904cdc8fe33117ccc65c

SHA1
4cf9bb8729abf2939fd0c56abfc4af7a8fb4064a

SHA256
ebe1db0d9f5141cade625456639737f25af5a394782f4a10247a021e799f8e45

SHA512
f67510b60f3fcb6d14ea7e98dee764607b8cb326dd07ec97673e30d6f742831e28a9f9583f855a74dd96655e7d060fc2ed12a2af487f868f483ba899d955c575

Download Submit
C:\Windows\System\WowbHTO.exe

Filesize
2.0MB

MD5
bef45e72c5bda3966f90f0730abee9df

SHA1
e05e55f07e54acb8216546d223629c6433df9238

SHA256
627e2429ea4e8404247a6ab2dc52dbcbec36497b5041e91d82e683b151ce45f0

SHA512
c03ba3ffeee2375e220e5a9d09ce6fecd156edb0ae903ef1266631603a58dfe7480ad37b278c4f3e8a8ab33db87911fe7be8eb55a76de843c7339b3ca7799268

Download Submit
C:\Windows\System\YfSHrZK.exe

Filesize
2.0MB

MD5
2282a9265573ab1d6e553219f5e164a8

SHA1
77d78b771d5163a7715352aa767f2813da799cd4

SHA256
5bbf0ad904c3657c1e57e86d66f26c9494f47cd717cdf260009ba9c51ced5a24

SHA512
31abe144fa6d81d856772dc2bb35f28bc5da923bcd9b23833f6ab9d94bd198ef2d940694246ffcd9e4d600c71947fe694156a3e0d930f75efea56873d862a8f5

Download Submit
C:\Windows\System\ZnoXBHs.exe

Filesize
2.0MB

MD5
5d0ef3d60619e1bf3dc8234184c50681

SHA1
bb0014b180185023902bd1a99703f7a211d41729

SHA256
ba5c088e9c37500414ccd209d179053440997e40136ccae6dded7788f8d2fdbb

SHA512
ebe8d2e65e1b84296db413b4ffc6ca666d61c9035065edb083eecc1a86cde8815c54989f4e03b4263dcec55e2e3e7eec7e03a01d2283f5cfea562e4cb7147eb0

Download Submit
C:\Windows\System\ZtsLPvI.exe

Filesize
2.0MB

MD5
ad55cb0e908cf08eb1e03543d32460c5

SHA1
8c7ef800e0535519df387d1a7155018310c816cc

SHA256
cbb29763e373df34d755b745e5348d8aa6f9ebf5a70a34afeb5eb2bcac4686c6

SHA512
fd85386674659ee0d14462de6bd5887b4e02dc54e4236e99e2cb116f6a435fb1c8ffea2b12f127fc339c07b0ce9391bb89577aaf6edc0c932d619b31225fefbd

Download Submit
C:\Windows\System\bOlePSd.exe

Filesize
2.0MB

MD5
57d379c7077ecb84d6a511e12c77b18b

SHA1
ed686847cf743e3811a9d37cda19dddf3bf6acb8

SHA256
d40461a6db15e030e6365aae34791e4ff16d510731b19d09c9d38795ded124f8

SHA512
f19cffa0498917499f90cc6185787deafc16d266effd4857b2e3eb907b9bc47b3f5a818e1af2698cdc3d7996855a6ff03f67f41c4c1dd7f1ae6609ab34b41885

Download Submit
C:\Windows\System\cJIuJfV.exe

Filesize
2.0MB

MD5
912d120ff5394e73ff25f1a8faf712ca

SHA1
b71cf022bb02b5efd5c97b8c0b5c35d504598550

SHA256
3ccb67e48b8b6bc242d210f56b5d4ce904be0aa31b2ad53e2c2a3304e41dc107

SHA512
f5035947786e127dea8ee7e91189fd29488354b826bd1f4f080b1e697de3e3ba1335ff5b6c46ac3326aebcbb15cb973827cd6e62a55c693127fcb4c210e18dc1

Download Submit
C:\Windows\System\cYmSgwC.exe

Filesize
2.0MB

MD5
91c8e6e967bb6870a192bd45e9f5f4cb

SHA1
e471f4fc9d60f07ff2bfc65dd5b17cc6bfd423c4

SHA256
54b15102847e53d5e45a4bca3bbbeaebc46c3fba332bcaa6fdb88a6a34c8b5a6

SHA512
d278fccae102ab0b4e4f4d0e0b33d508de51ed21c36ccaf3a40b75e28d485a9e8e15236f3e6ff7fb65618332697b108f0b696f52238186046f686259ba93172a

Download Submit
C:\Windows\System\cwosCWR.exe

Filesize
2.0MB

MD5
bf90809054373817d58049edf2b9818f

SHA1
a29fe53c6816e7a5303e8691343ac42dbdbfd65e

SHA256
3a6bfacede4dfa23fcff2be3f35a9df76ab370f1b35f0da06f00453a79bbcecc

SHA512
150b2f22c34784027e1496665af35828704bd1fbdb13fe6533132ce901befba547b0bc6fe133e09c05bd3d47f8e0470f252c7d9a522d1fed0e0dac54c92c0ea1

Download Submit
C:\Windows\System\fiCSBCq.exe

Filesize
2.0MB

MD5
d77edacc5bd6ac2c10c9054f30d2bb36

SHA1
acf695fdfff7b2bf722c160f6463291671cfeb06

SHA256
61dcd79bf578dbbfd453ee763be8a58a5d4264b0ca690a4d141890fcdd17e99b

SHA512
68540d39c0497c4950430ddac962644788e86392804c0117b6d669307f7e598fd2c641b4893cc793fbf944ddedeace194d64a37540e16f5eb23c16500c3435d3

Download Submit
C:\Windows\System\iZSkHpE.exe

Filesize
2.0MB

MD5
7584b853a8bb9835b3c9d50447a45a1d

SHA1
98d18b4b3968b728a6420c275f3c0fc05dd31d1a

SHA256
c535ccfd46f97226b89e7166250cdba42c1a3efbd6e4eef38d5793475fd5fe29

SHA512
8aacf2652ae6c25be3c9f43db24d03229f4edd9ab67fa4bf9430518b55feb351f1ea4464c90a2f206c776b462ddeb8721426871c7a5d1f90802b12ca73fac1ec

Download Submit
C:\Windows\System\ldkNneL.exe

Filesize
2.0MB

MD5
c71722d1021d59d2d67d94e2eadaa275

SHA1
a7398a8b46d281fc47e1863e614a614de358cf45

SHA256
31d102b8bf1fcdc352ac0b511d2118ff64b62c88991fa0cfded3fefda51acc2e

SHA512
8ec0ec39c5bf6fb487fa643bd228a20a9c5348e2a373d1b7482d2ef820969f179c246e2b4b3c913efc34bfd4dfb07d1e5e9a62d236bcc2fb8588bf95e39a6f6d

Download Submit
C:\Windows\System\lkghdJS.exe

Filesize
2.0MB

MD5
818b55840fce69ee003ee8eed233e8f2

SHA1
2f1f5baa336091a9b21aba8dd08bd52e8c1d0295

SHA256
7d4d213a1d1be496ba1acfb39b9ab8ebef2143d2b968a4bbd08b362c5eb51b4e

SHA512
678add64b337433e2a74bbe819c867ec931bc40d714a414b52ea06362c67f82f70a05015288a9cbc1ef8b1324a8ba2f5a9a77aee72b188776228839cc1fcf4c0

Download Submit
C:\Windows\System\loxzNPa.exe

Filesize
2.0MB

MD5
af54170d01b863ceb49957a3b13fa897

SHA1
48d8a92ab1a34a6dd7ff600913a60c8939e49979

SHA256
3bc1bafd535d4192efa0f2db7b9f579eb5c6d643bdb00d8164ed6e073f83a27d

SHA512
571f43e4925514ccd909cd58486966bb39c03017a88b6a28f9792d01b09d7f7d7063dcafd3c3a199b6d2dd768b47c39346e31ecb536abe53b9c4956d995ed36e

Download Submit
C:\Windows\System\lseHhYt.exe

Filesize
2.0MB

MD5
c9fd345bb3cd2772be2804545eb14006

SHA1
fd19c6342eddcbf6708e3cd14a450dd223a05038

SHA256
cf52471fac298de85f47c3f2a399ce9b2939854d5bc2fdab08634c921f295847

SHA512
c2dda1aedff5196d6294d40889d131d0ab234845458a1fdd241c01b50ec82de35c0b525066ff0d091f60a1790da626b59b5c032341eade3d9f2bcc5e4157d9a3

Download Submit
C:\Windows\System\moXRpRC.exe

Filesize
2.0MB

MD5
c42020feec2a3314bd8aaf6a1aa9328e

SHA1
6f1b905b55ebd4e5fe1d615b6e1b8711a1ca75ac

SHA256
cb8116f306f367101a6544bb88b901a5bb5d5fbdd17825ef689ca05cf59bea4b

SHA512
2881383a05f162c1ce37ef7ac40aa4a97e2466989e8a89df4f9de505310dbe4dd23cbb88ee4d0562a1ebe4f40e8015dd08b3d29ca9bc785c5a4bb2ea983da916

Download Submit
C:\Windows\System\ocKrIJn.exe

Filesize
2.0MB

MD5
952bdf2044a83d8f43576f5232cb3fac

SHA1
a0b53a9d35241a36e23a327808f3dc1217f0a7a0

SHA256
f35a1674b630e7277eabe003982f1700d07a8794dc2dbee8f77bf3f2949fd93a

SHA512
17b873fec785efb2b42dd70ca661d0118df94cb4e794cfd427ca0caebeadd1d15066be8ce2bd7dbb90d35cf2c5b0cc7259504814965d228deb606322a9b91ef7

Download Submit
C:\Windows\System\pNfJxeO.exe

Filesize
2.0MB

MD5
be0ec46bf5e98bf3abf719e917c4a297

SHA1
0afa96d1d6e78e674a5329fc012c11d41dfba1f8

SHA256
d6c6e779574b57475f6d202afee6df1e962376c9a3b048ea2ccabe0eb82a417c

SHA512
b9bda85bbcd8980a713bb7270e5e91a5bce9c3689ffbee312692e674a05831c2d05e59b6b60f4ca3580c739a8d2a7b51fe0aca0929f33895c5fc173cf8581e90

Download Submit
C:\Windows\System\pjzgnvI.exe

Filesize
2.0MB

MD5
273bae57507f39cd06ca21196aaa9786

SHA1
e7dfe4c16ed82da120d85339b58476b7c40d9184

SHA256
ec14c08b2551439705b6f98e582da263090b9e5047aa0c865669053107d96e80

SHA512
52573fef86a19cf32cb75d1e69a40cf87cdc06808e428355c531c12eaf123eff6b211b0406452aa8ac60656ab17b5355daa2400dc0f534bc1df9ee5a4c4f2ca5

Download Submit
C:\Windows\System\tPPbVLR.exe

Filesize
2.0MB

MD5
ab88727b618e54b58939c4c023df9d50

SHA1
63a701d507663cacf62d966660a37bcae233af23

SHA256
4d793ee1922b8cff353094396dad1c73a7de9f039026fe8f5e9ea8ee9404cff6

SHA512
4055908711fe9fe9574982e90db642715c62637f546ccb49db64af78b1aaa46a1529780dd34dd8c4ae6cbb64c44e9999cf5e4a04e688531dec13c8518addd1c9

Download Submit
C:\Windows\System\vsRknQp.exe

Filesize
2.0MB

MD5
33fe1dd4caa2f499697837b93b02dfa9

SHA1
2e1d26f68ad003dbf9c9beca0aee40c566a8cad9

SHA256
7fcf59c55879d1fe8417de1c4a3c07473f1e4139b4ed6cfd5402bdb70bb94743

SHA512
957ac319ff9101ccfb45fce78ba99867db2acff0f44973f233609718d64983fa86dd7805e5a9a191019836d9155b0adb1b8e5d9d8cf8cc948c2dab470906934d

Download Submit
C:\Windows\System\vywrrpB.exe

Filesize
2.0MB

MD5
8deb79d8daa1bebbeee3b3db2db04d3c

SHA1
7616dc773626550dc798b88b88b55757e1170996

SHA256
a0bfaf2e703242dbee38202286b9c52face94a81b097455f775441e82ff582a0

SHA512
1e20a428db8d8b28f26f74b1d37ff25139db5506052180f413e8f2334a036f2b90a232386a2ee6a03ce529ed5ed9b18ebe7e65ae8659f16bbd9fa82dbe5a252b

Download Submit
C:\Windows\System\xgUyWmE.exe

Filesize
2.0MB

MD5
bf677434c4a44b27aeb71748abf8f1ec

SHA1
9573bbb29434df495db96b4e10a671587a0a3ce8

SHA256
47dca45c5f9e588415933fec2a3d855db6bd367f1be2c85c7f98706beea3ca60

SHA512
78634a5a81519a457d5344e735a02126ca6e8d1e064d40cd76384fbd6af11130cff7e7c70db63e8c8e89f3270cb93550a9334d4a00939da3257b186994a59ffa

Download Submit
C:\Windows\System\xqwIbxa.exe

Filesize
2.0MB

MD5
b1ea2b8311617e7ef286cc7d5ae24f0c

SHA1
ee16c4a1886f3cce233f5a553c4c05746b0f27d9

SHA256
6a06ff3687e829f54e17b30a896187f5562c6544432fc51a0b6106526daff7c1

SHA512
853393da89ac6c20f4bf58105434e7d6fb1ce6d4c0cf4e7d4aa575a07adb0afe7cc2881d9603cb316ab26c169e7ad35e41018c3f19b06c708abca15dc12a9f25

Download Submit
memory/552-300-0x00007FF7384C0000-0x00007FF738814000-memory.dmp

Filesize
3.3MB

Download
memory/552-2058-0x00007FF7384C0000-0x00007FF738814000-memory.dmp

Filesize
3.3MB

Download
memory/888-2047-0x00007FF6083F0000-0x00007FF608744000-memory.dmp

Filesize
3.3MB

Download
memory/888-275-0x00007FF6083F0000-0x00007FF608744000-memory.dmp

Filesize
3.3MB

Download
memory/1136-306-0x00007FF6C7440000-0x00007FF6C7794000-memory.dmp

Filesize
3.3MB

Download
memory/1136-2061-0x00007FF6C7440000-0x00007FF6C7794000-memory.dmp

Filesize
3.3MB

Download
memory/1388-2042-0x00007FF692440000-0x00007FF692794000-memory.dmp

Filesize
3.3MB

Download
memory/1388-269-0x00007FF692440000-0x00007FF692794000-memory.dmp

Filesize
3.3MB

Download
memory/1568-2053-0x00007FF77EE50000-0x00007FF77F1A4000-memory.dmp

Filesize
3.3MB

Download
memory/1568-277-0x00007FF77EE50000-0x00007FF77F1A4000-memory.dmp

Filesize
3.3MB

Download
memory/1904-2057-0x00007FF695300000-0x00007FF695654000-memory.dmp

Filesize
3.3MB

Download
memory/1904-290-0x00007FF695300000-0x00007FF695654000-memory.dmp

Filesize
3.3MB

Download
memory/1932-2054-0x00007FF692FF0000-0x00007FF693344000-memory.dmp

Filesize
3.3MB

Download
memory/1932-297-0x00007FF692FF0000-0x00007FF693344000-memory.dmp

Filesize
3.3MB

Download
memory/1972-270-0x00007FF7A7E50000-0x00007FF7A81A4000-memory.dmp

Filesize
3.3MB

Download
memory/1972-2044-0x00007FF7A7E50000-0x00007FF7A81A4000-memory.dmp

Filesize
3.3MB

Download
memory/2004-2038-0x00007FF79F8D0000-0x00007FF79FC24000-memory.dmp

Filesize
3.3MB

Download
memory/2004-22-0x00007FF79F8D0000-0x00007FF79FC24000-memory.dmp

Filesize
3.3MB

Download
memory/2304-2052-0x00007FF7B1790000-0x00007FF7B1AE4000-memory.dmp

Filesize
3.3MB

Download
memory/2304-278-0x00007FF7B1790000-0x00007FF7B1AE4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-2065-0x00007FF6149D0000-0x00007FF614D24000-memory.dmp

Filesize
3.3MB

Download
memory/2332-0-0x00007FF6149D0000-0x00007FF614D24000-memory.dmp

Filesize
3.3MB

Download
memory/2332-1-0x000001C76C800000-0x000001C76C810000-memory.dmp

Filesize
64KB

Download
memory/2796-303-0x00007FF6B5D40000-0x00007FF6B6094000-memory.dmp

Filesize
3.3MB

Download
memory/2796-2060-0x00007FF6B5D40000-0x00007FF6B6094000-memory.dmp

Filesize
3.3MB

Download
memory/2892-280-0x00007FF639390000-0x00007FF6396E4000-memory.dmp

Filesize
3.3MB

Download
memory/2892-2051-0x00007FF639390000-0x00007FF6396E4000-memory.dmp

Filesize
3.3MB

Download
memory/2900-2050-0x00007FF70D6F0000-0x00007FF70DA44000-memory.dmp

Filesize
3.3MB

Download
memory/2900-276-0x00007FF70D6F0000-0x00007FF70DA44000-memory.dmp

Filesize
3.3MB

Download
memory/3504-273-0x00007FF7E12E0000-0x00007FF7E1634000-memory.dmp

Filesize
3.3MB

Download
memory/3504-2048-0x00007FF7E12E0000-0x00007FF7E1634000-memory.dmp

Filesize
3.3MB

Download
memory/3552-2062-0x00007FF627BE0000-0x00007FF627F34000-memory.dmp

Filesize
3.3MB

Download
memory/3552-308-0x00007FF627BE0000-0x00007FF627F34000-memory.dmp

Filesize
3.3MB

Download
memory/3864-2064-0x00007FF6337C0000-0x00007FF633B14000-memory.dmp

Filesize
3.3MB

Download
memory/3864-305-0x00007FF6337C0000-0x00007FF633B14000-memory.dmp

Filesize
3.3MB

Download
memory/4080-56-0x00007FF766550000-0x00007FF7668A4000-memory.dmp

Filesize
3.3MB

Download
memory/4080-2039-0x00007FF766550000-0x00007FF7668A4000-memory.dmp

Filesize
3.3MB

Download
memory/4160-2040-0x00007FF7583A0000-0x00007FF7586F4000-memory.dmp

Filesize
3.3MB

Download
memory/4160-309-0x00007FF7583A0000-0x00007FF7586F4000-memory.dmp

Filesize
3.3MB

Download
memory/4164-293-0x00007FF7FEAE0000-0x00007FF7FEE34000-memory.dmp

Filesize
3.3MB

Download
memory/4164-2056-0x00007FF7FEAE0000-0x00007FF7FEE34000-memory.dmp

Filesize
3.3MB

Download
memory/4176-2041-0x00007FF6A1EB0000-0x00007FF6A2204000-memory.dmp

Filesize
3.3MB

Download
memory/4176-267-0x00007FF6A1EB0000-0x00007FF6A2204000-memory.dmp

Filesize
3.3MB

Download
memory/4244-2037-0x00007FF6FF2F0000-0x00007FF6FF644000-memory.dmp

Filesize
3.3MB

Download
memory/4244-14-0x00007FF6FF2F0000-0x00007FF6FF644000-memory.dmp

Filesize
3.3MB

Download
memory/4336-304-0x00007FF7464A0000-0x00007FF7467F4000-memory.dmp

Filesize
3.3MB

Download
memory/4336-2059-0x00007FF7464A0000-0x00007FF7467F4000-memory.dmp

Filesize
3.3MB

Download
memory/4632-299-0x00007FF7BB780000-0x00007FF7BBAD4000-memory.dmp

Filesize
3.3MB

Download
memory/4632-2055-0x00007FF7BB780000-0x00007FF7BBAD4000-memory.dmp

Filesize
3.3MB

Download
memory/4880-2046-0x00007FF681970000-0x00007FF681CC4000-memory.dmp

Filesize
3.3MB

Download
memory/4880-310-0x00007FF681970000-0x00007FF681CC4000-memory.dmp

Filesize
3.3MB

Download
memory/4916-2063-0x00007FF6E2FA0000-0x00007FF6E32F4000-memory.dmp

Filesize
3.3MB

Download
memory/4916-307-0x00007FF6E2FA0000-0x00007FF6E32F4000-memory.dmp

Filesize
3.3MB

Download
memory/4984-2045-0x00007FF7BC730000-0x00007FF7BCA84000-memory.dmp

Filesize
3.3MB

Download
memory/4984-272-0x00007FF7BC730000-0x00007FF7BCA84000-memory.dmp

Filesize
3.3MB

Download
memory/5008-8-0x00007FF793460000-0x00007FF7937B4000-memory.dmp

Filesize
3.3MB

Download
memory/5088-274-0x00007FF61E290000-0x00007FF61E5E4000-memory.dmp

Filesize
3.3MB

Download
memory/5088-2049-0x00007FF61E290000-0x00007FF61E5E4000-memory.dmp

Filesize
3.3MB

Download
memory/5092-2043-0x00007FF67F990000-0x00007FF67FCE4000-memory.dmp

Filesize
3.3MB

Download
memory/5092-271-0x00007FF67F990000-0x00007FF67FCE4000-memory.dmp

Filesize
3.3MB

Download