xmrig | 2198093a6434ba84f3c87d42eaa3ce8e308d7adce4dd7a760766c143c09179e7

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
Size

1.4MB
MD5

6286092f3070be5cdbd9308568418470
SHA1

765ed5bc13d2c52a50f19491fce7af1a20985b1a
SHA256

2198093a6434ba84f3c87d42eaa3ce8e308d7adce4dd7a760766c143c09179e7
SHA512

5e7d1df36fb633c8deec11016500b63712005714f51cd1718a357dfa557068cc9bfe5ef39fb2e17d5f0ef320dd0cf5d11c2b7ea20fa689e73fbf126acb683c1f
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8BoC09aYCmcxYraECNlCOq3vzZv3a:ROdWCCi7/rahwNUnj7Zq6K

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 56 IoCs

miner

resource	yara_rule
behavioral2/memory/648-33-0x00007FF74BE50000-0x00007FF74C1A1000-memory.dmp	xmrig
behavioral2/memory/4168-34-0x00007FF6A7B00000-0x00007FF6A7E51000-memory.dmp	xmrig
behavioral2/memory/4464-43-0x00007FF6A22C0000-0x00007FF6A2611000-memory.dmp	xmrig
behavioral2/memory/4552-47-0x00007FF6ECD90000-0x00007FF6ED0E1000-memory.dmp	xmrig
behavioral2/memory/3872-56-0x00007FF6D6F60000-0x00007FF6D72B1000-memory.dmp	xmrig
behavioral2/memory/4060-73-0x00007FF706640000-0x00007FF706991000-memory.dmp	xmrig
behavioral2/memory/1792-74-0x00007FF77D100000-0x00007FF77D451000-memory.dmp	xmrig
behavioral2/memory/2836-221-0x00007FF65E430000-0x00007FF65E781000-memory.dmp	xmrig
behavioral2/memory/3292-222-0x00007FF654230000-0x00007FF654581000-memory.dmp	xmrig
behavioral2/memory/1696-226-0x00007FF624A80000-0x00007FF624DD1000-memory.dmp	xmrig
behavioral2/memory/3308-230-0x00007FF636C40000-0x00007FF636F91000-memory.dmp	xmrig
behavioral2/memory/2880-229-0x00007FF69AA40000-0x00007FF69AD91000-memory.dmp	xmrig
behavioral2/memory/928-224-0x00007FF6C6290000-0x00007FF6C65E1000-memory.dmp	xmrig
behavioral2/memory/780-236-0x00007FF6409E0000-0x00007FF640D31000-memory.dmp	xmrig
behavioral2/memory/2172-245-0x00007FF7E9110000-0x00007FF7E9461000-memory.dmp	xmrig
behavioral2/memory/3280-250-0x00007FF77BCD0000-0x00007FF77C021000-memory.dmp	xmrig
behavioral2/memory/4016-254-0x00007FF644360000-0x00007FF6446B1000-memory.dmp	xmrig
behavioral2/memory/4580-249-0x00007FF76B5C0000-0x00007FF76B911000-memory.dmp	xmrig
behavioral2/memory/236-242-0x00007FF7D1550000-0x00007FF7D18A1000-memory.dmp	xmrig
behavioral2/memory/4864-265-0x00007FF694BC0000-0x00007FF694F11000-memory.dmp	xmrig
behavioral2/memory/744-267-0x00007FF6698B0000-0x00007FF669C01000-memory.dmp	xmrig
behavioral2/memory/2728-269-0x00007FF65F120000-0x00007FF65F471000-memory.dmp	xmrig
behavioral2/memory/4764-241-0x00007FF66FB30000-0x00007FF66FE81000-memory.dmp	xmrig
behavioral2/memory/868-280-0x00007FF612E20000-0x00007FF613171000-memory.dmp	xmrig
behavioral2/memory/3608-240-0x00007FF61D0C0000-0x00007FF61D411000-memory.dmp	xmrig
behavioral2/memory/3856-284-0x00007FF681AD0000-0x00007FF681E21000-memory.dmp	xmrig
behavioral2/memory/3672-290-0x00007FF6670F0000-0x00007FF667441000-memory.dmp	xmrig
behavioral2/memory/2836-2170-0x00007FF65E430000-0x00007FF65E781000-memory.dmp	xmrig
behavioral2/memory/744-2173-0x00007FF6698B0000-0x00007FF669C01000-memory.dmp	xmrig
behavioral2/memory/648-2175-0x00007FF74BE50000-0x00007FF74C1A1000-memory.dmp	xmrig
behavioral2/memory/2728-2177-0x00007FF65F120000-0x00007FF65F471000-memory.dmp	xmrig
behavioral2/memory/4168-2179-0x00007FF6A7B00000-0x00007FF6A7E51000-memory.dmp	xmrig
behavioral2/memory/4464-2202-0x00007FF6A22C0000-0x00007FF6A2611000-memory.dmp	xmrig
behavioral2/memory/4552-2203-0x00007FF6ECD90000-0x00007FF6ED0E1000-memory.dmp	xmrig
behavioral2/memory/880-2205-0x00007FF6B36E0000-0x00007FF6B3A31000-memory.dmp	xmrig
behavioral2/memory/3872-2207-0x00007FF6D6F60000-0x00007FF6D72B1000-memory.dmp	xmrig
behavioral2/memory/1548-2209-0x00007FF776D20000-0x00007FF777071000-memory.dmp	xmrig
behavioral2/memory/3292-2214-0x00007FF654230000-0x00007FF654581000-memory.dmp	xmrig
behavioral2/memory/1696-2217-0x00007FF624A80000-0x00007FF624DD1000-memory.dmp	xmrig
behavioral2/memory/3308-2223-0x00007FF636C40000-0x00007FF636F91000-memory.dmp	xmrig
behavioral2/memory/3608-2226-0x00007FF61D0C0000-0x00007FF61D411000-memory.dmp	xmrig
behavioral2/memory/4764-2228-0x00007FF66FB30000-0x00007FF66FE81000-memory.dmp	xmrig
behavioral2/memory/236-2232-0x00007FF7D1550000-0x00007FF7D18A1000-memory.dmp	xmrig
behavioral2/memory/3280-2236-0x00007FF77BCD0000-0x00007FF77C021000-memory.dmp	xmrig
behavioral2/memory/4580-2235-0x00007FF76B5C0000-0x00007FF76B911000-memory.dmp	xmrig
behavioral2/memory/4016-2238-0x00007FF644360000-0x00007FF6446B1000-memory.dmp	xmrig
behavioral2/memory/2172-2230-0x00007FF7E9110000-0x00007FF7E9461000-memory.dmp	xmrig
behavioral2/memory/780-2221-0x00007FF6409E0000-0x00007FF640D31000-memory.dmp	xmrig
behavioral2/memory/928-2218-0x00007FF6C6290000-0x00007FF6C65E1000-memory.dmp	xmrig
behavioral2/memory/2880-2224-0x00007FF69AA40000-0x00007FF69AD91000-memory.dmp	xmrig
behavioral2/memory/1792-2213-0x00007FF77D100000-0x00007FF77D451000-memory.dmp	xmrig
behavioral2/memory/868-2245-0x00007FF612E20000-0x00007FF613171000-memory.dmp	xmrig
behavioral2/memory/3672-2253-0x00007FF6670F0000-0x00007FF667441000-memory.dmp	xmrig
behavioral2/memory/4864-2244-0x00007FF694BC0000-0x00007FF694F11000-memory.dmp	xmrig
behavioral2/memory/3856-2241-0x00007FF681AD0000-0x00007FF681E21000-memory.dmp	xmrig
behavioral2/memory/3684-2265-0x00007FF662AE0000-0x00007FF662E31000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2836	jRqCdTy.exe
744	EOXOekr.exe
2728	sVzyyQz.exe
648	qttfZHS.exe
4168	gNrNwqV.exe
4464	KShFIkv.exe
4552	tAEctYu.exe
880	pNCiMLJ.exe
3872	nUAyuAI.exe
1548	YhhEepj.exe
3684	irHVcFB.exe
1792	zFkCIeF.exe
3292	FfNRQwE.exe
928	rHPxBcU.exe
1696	CVcFPAF.exe
2880	xqqKlcq.exe
3308	FkLIVsy.exe
780	QmMnxcm.exe
3608	tojzQXO.exe
4764	JxwdUaa.exe
236	qMaMgBP.exe
2172	kvBorlL.exe
4580	TlHMfGD.exe
3280	fIbksQi.exe
4016	ShEjVtW.exe
4864	SmwWlYW.exe
868	srhcwhc.exe
3856	QikqpCz.exe
3672	VxdtAGu.exe
2944	PIFZkqJ.exe
4524	bjwDMgg.exe
3604	PJtKKCn.exe
4644	ljuAzbm.exe
2304	xRHHslo.exe
1652	GkxMxiS.exe
1348	FNpIhuM.exe
3900	HzKnPaQ.exe
3344	ncjPsvI.exe
3968	nDRgLKt.exe
2064	sctZdti.exe
1640	LuPupzF.exe
2372	ZPfgwbD.exe
2972	dXdNJRZ.exe
1168	RaZFFCo.exe
4748	IeeOhaW.exe
4364	yvYDpfC.exe
2920	xGGBDvg.exe
944	FeyUUJd.exe
2572	UqHMoGQ.exe
4840	GPmSviL.exe
1152	MvwFdWZ.exe
372	SmtqDQv.exe
1564	qFhKJyI.exe
4320	ZNUYotq.exe
2848	ftZhLAx.exe
2120	pAYpham.exe
4556	aIaSPXw.exe
4832	PHqhNrn.exe
1768	umvMWGW.exe
960	WMgZJwy.exe
664	BSdxFJc.exe
2056	sSTwhxm.exe
2040	zXXyGNA.exe
3692	fJHcoZl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4060-0-0x00007FF706640000-0x00007FF706991000-memory.dmp	upx
behavioral2/files/0x0008000000023260-4.dat	upx
behavioral2/memory/2836-8-0x00007FF65E430000-0x00007FF65E781000-memory.dmp	upx
behavioral2/files/0x0008000000023263-10.dat	upx
behavioral2/memory/744-13-0x00007FF6698B0000-0x00007FF669C01000-memory.dmp	upx
behavioral2/files/0x0008000000023267-11.dat	upx
behavioral2/files/0x0008000000023268-22.dat	upx
behavioral2/memory/2728-21-0x00007FF65F120000-0x00007FF65F471000-memory.dmp	upx
behavioral2/files/0x0007000000023269-28.dat	upx
behavioral2/memory/648-33-0x00007FF74BE50000-0x00007FF74C1A1000-memory.dmp	upx
behavioral2/memory/4168-34-0x00007FF6A7B00000-0x00007FF6A7E51000-memory.dmp	upx
behavioral2/files/0x000700000002326a-35.dat	upx
behavioral2/files/0x000700000002326b-40.dat	upx
behavioral2/memory/4464-43-0x00007FF6A22C0000-0x00007FF6A2611000-memory.dmp	upx
behavioral2/memory/4552-47-0x00007FF6ECD90000-0x00007FF6ED0E1000-memory.dmp	upx
behavioral2/files/0x0008000000023264-45.dat	upx
behavioral2/memory/880-50-0x00007FF6B36E0000-0x00007FF6B3A31000-memory.dmp	upx
behavioral2/files/0x000700000002326c-54.dat	upx
behavioral2/memory/3872-56-0x00007FF6D6F60000-0x00007FF6D72B1000-memory.dmp	upx
behavioral2/files/0x000700000002326d-59.dat	upx
behavioral2/files/0x000700000002326e-62.dat	upx
behavioral2/memory/1548-64-0x00007FF776D20000-0x00007FF777071000-memory.dmp	upx
behavioral2/memory/3684-67-0x00007FF662AE0000-0x00007FF662E31000-memory.dmp	upx
behavioral2/files/0x000700000002326f-70.dat	upx
behavioral2/memory/4060-73-0x00007FF706640000-0x00007FF706991000-memory.dmp	upx
behavioral2/memory/1792-74-0x00007FF77D100000-0x00007FF77D451000-memory.dmp	upx
behavioral2/files/0x0007000000023270-78.dat	upx
behavioral2/files/0x0007000000023271-83.dat	upx
behavioral2/files/0x0007000000023272-88.dat	upx
behavioral2/files/0x0007000000023273-93.dat	upx
behavioral2/files/0x0007000000023274-98.dat	upx
behavioral2/files/0x0007000000023277-112.dat	upx
behavioral2/files/0x0007000000023279-120.dat	upx
behavioral2/files/0x000700000002327b-133.dat	upx
behavioral2/files/0x000700000002327c-138.dat	upx
behavioral2/files/0x000700000002327a-131.dat	upx
behavioral2/files/0x000700000002327e-148.dat	upx
behavioral2/files/0x000700000002327d-146.dat	upx
behavioral2/files/0x000700000002327f-153.dat	upx
behavioral2/files/0x0007000000023281-163.dat	upx
behavioral2/files/0x0007000000023283-173.dat	upx
behavioral2/files/0x0007000000023282-171.dat	upx
behavioral2/memory/2836-221-0x00007FF65E430000-0x00007FF65E781000-memory.dmp	upx
behavioral2/memory/3292-222-0x00007FF654230000-0x00007FF654581000-memory.dmp	upx
behavioral2/memory/1696-226-0x00007FF624A80000-0x00007FF624DD1000-memory.dmp	upx
behavioral2/memory/3308-230-0x00007FF636C40000-0x00007FF636F91000-memory.dmp	upx
behavioral2/memory/2880-229-0x00007FF69AA40000-0x00007FF69AD91000-memory.dmp	upx
behavioral2/memory/928-224-0x00007FF6C6290000-0x00007FF6C65E1000-memory.dmp	upx
behavioral2/memory/780-236-0x00007FF6409E0000-0x00007FF640D31000-memory.dmp	upx
behavioral2/memory/2172-245-0x00007FF7E9110000-0x00007FF7E9461000-memory.dmp	upx
behavioral2/memory/3280-250-0x00007FF77BCD0000-0x00007FF77C021000-memory.dmp	upx
behavioral2/memory/4016-254-0x00007FF644360000-0x00007FF6446B1000-memory.dmp	upx
behavioral2/memory/4580-249-0x00007FF76B5C0000-0x00007FF76B911000-memory.dmp	upx
behavioral2/memory/236-242-0x00007FF7D1550000-0x00007FF7D18A1000-memory.dmp	upx
behavioral2/memory/4864-265-0x00007FF694BC0000-0x00007FF694F11000-memory.dmp	upx
behavioral2/memory/744-267-0x00007FF6698B0000-0x00007FF669C01000-memory.dmp	upx
behavioral2/memory/2728-269-0x00007FF65F120000-0x00007FF65F471000-memory.dmp	upx
behavioral2/memory/4764-241-0x00007FF66FB30000-0x00007FF66FE81000-memory.dmp	upx
behavioral2/memory/868-280-0x00007FF612E20000-0x00007FF613171000-memory.dmp	upx
behavioral2/memory/3608-240-0x00007FF61D0C0000-0x00007FF61D411000-memory.dmp	upx
behavioral2/memory/3856-284-0x00007FF681AD0000-0x00007FF681E21000-memory.dmp	upx
behavioral2/memory/3672-290-0x00007FF6670F0000-0x00007FF667441000-memory.dmp	upx
behavioral2/files/0x0007000000023280-158.dat	upx
behavioral2/files/0x0007000000023278-121.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BENFSXl.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\TgFZdve.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\CTZIXJW.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\FDtjREL.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\eGhLbrd.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\AajUKyn.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\HqwIBcI.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\cqLbCgg.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\fzBRCxS.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\HqJPJLA.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\EEEgtjh.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\sTyxqcI.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\OpFwjMr.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\gzIaARw.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\GkxMxiS.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\LdIwaZT.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\YfLwUqn.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\UEEZpZj.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\uBDGruR.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\ItSBqcs.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\FxghkEM.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\gjUHAfj.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\EJpthzr.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\IRAIrSI.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\dpIRfjD.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\CkAxwoH.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\PBbTfLa.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\MsRVMGn.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\gmJRVrt.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\diFwvpx.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\jCtsfFS.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\KIGTRCz.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\IqZcgkD.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\jZOyQqL.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\SWPsgsQ.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\ugfDMxh.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\xsymwIm.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\EOXOekr.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\FNpIhuM.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\tPvoOco.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\BdszGwI.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\SXCLfJB.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\DIKZBqo.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\vChgOqY.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\ggAyXsB.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\GMdgFbx.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\YUtOMzQ.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\KiwqLCp.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\HzzEYcJ.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\UZYlGiB.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\JjBxmON.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\OJYvNgB.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\fIjJTjj.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\IoSonJk.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\tTeNEjQ.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\DnzBDjC.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\VkLyBZy.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\jXvoDRf.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\DmEHiiq.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\xIaZtlY.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\VGrzlSo.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\unCJTwR.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\cPihcLJ.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
File created	C:\Windows\System\ICJfRzW.exe	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2836	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	92
PID 4060 wrote to memory of 2836	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	92
PID 4060 wrote to memory of 744	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	93
PID 4060 wrote to memory of 744	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	93
PID 4060 wrote to memory of 2728	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	94
PID 4060 wrote to memory of 2728	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	94
PID 4060 wrote to memory of 648	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	95
PID 4060 wrote to memory of 648	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	95
PID 4060 wrote to memory of 4168	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	96
PID 4060 wrote to memory of 4168	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	96
PID 4060 wrote to memory of 4464	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	97
PID 4060 wrote to memory of 4464	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	97
PID 4060 wrote to memory of 4552	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	98
PID 4060 wrote to memory of 4552	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	98
PID 4060 wrote to memory of 880	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	99
PID 4060 wrote to memory of 880	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	99
PID 4060 wrote to memory of 3872	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	100
PID 4060 wrote to memory of 3872	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	100
PID 4060 wrote to memory of 1548	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	101
PID 4060 wrote to memory of 1548	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	101
PID 4060 wrote to memory of 3684	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	102
PID 4060 wrote to memory of 3684	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	102
PID 4060 wrote to memory of 1792	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	103
PID 4060 wrote to memory of 1792	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	103
PID 4060 wrote to memory of 3292	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	104
PID 4060 wrote to memory of 3292	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	104
PID 4060 wrote to memory of 928	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	105
PID 4060 wrote to memory of 928	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	105
PID 4060 wrote to memory of 1696	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	106
PID 4060 wrote to memory of 1696	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	106
PID 4060 wrote to memory of 2880	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	107
PID 4060 wrote to memory of 2880	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	107
PID 4060 wrote to memory of 3308	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	108
PID 4060 wrote to memory of 3308	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	108
PID 4060 wrote to memory of 780	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	109
PID 4060 wrote to memory of 780	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	109
PID 4060 wrote to memory of 3608	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	110
PID 4060 wrote to memory of 3608	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	110
PID 4060 wrote to memory of 4764	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	111
PID 4060 wrote to memory of 4764	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	111
PID 4060 wrote to memory of 236	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	112
PID 4060 wrote to memory of 236	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	112
PID 4060 wrote to memory of 2172	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	113
PID 4060 wrote to memory of 2172	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	113
PID 4060 wrote to memory of 4580	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	114
PID 4060 wrote to memory of 4580	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	114
PID 4060 wrote to memory of 3280	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	115
PID 4060 wrote to memory of 3280	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	115
PID 4060 wrote to memory of 4016	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	116
PID 4060 wrote to memory of 4016	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	116
PID 4060 wrote to memory of 4864	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	117
PID 4060 wrote to memory of 4864	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	117
PID 4060 wrote to memory of 868	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	118
PID 4060 wrote to memory of 868	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	118
PID 4060 wrote to memory of 3856	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	119
PID 4060 wrote to memory of 3856	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	119
PID 4060 wrote to memory of 3672	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	120
PID 4060 wrote to memory of 3672	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	120
PID 4060 wrote to memory of 2944	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	121
PID 4060 wrote to memory of 2944	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	121
PID 4060 wrote to memory of 4524	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	122
PID 4060 wrote to memory of 4524	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	122
PID 4060 wrote to memory of 3604	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	123
PID 4060 wrote to memory of 3604	4060	6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6286092f3070be5cdbd9308568418470_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\System\jRqCdTy.exe
  C:\Windows\System\jRqCdTy.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\EOXOekr.exe
  C:\Windows\System\EOXOekr.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\sVzyyQz.exe
  C:\Windows\System\sVzyyQz.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\qttfZHS.exe
  C:\Windows\System\qttfZHS.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\gNrNwqV.exe
  C:\Windows\System\gNrNwqV.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\KShFIkv.exe
  C:\Windows\System\KShFIkv.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\tAEctYu.exe
  C:\Windows\System\tAEctYu.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\pNCiMLJ.exe
  C:\Windows\System\pNCiMLJ.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\nUAyuAI.exe
  C:\Windows\System\nUAyuAI.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\YhhEepj.exe
  C:\Windows\System\YhhEepj.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\irHVcFB.exe
  C:\Windows\System\irHVcFB.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\zFkCIeF.exe
  C:\Windows\System\zFkCIeF.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\FfNRQwE.exe
  C:\Windows\System\FfNRQwE.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\rHPxBcU.exe
  C:\Windows\System\rHPxBcU.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\CVcFPAF.exe
  C:\Windows\System\CVcFPAF.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\xqqKlcq.exe
  C:\Windows\System\xqqKlcq.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\FkLIVsy.exe
  C:\Windows\System\FkLIVsy.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\QmMnxcm.exe
  C:\Windows\System\QmMnxcm.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\tojzQXO.exe
  C:\Windows\System\tojzQXO.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\JxwdUaa.exe
  C:\Windows\System\JxwdUaa.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\qMaMgBP.exe
  C:\Windows\System\qMaMgBP.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\kvBorlL.exe
  C:\Windows\System\kvBorlL.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\TlHMfGD.exe
  C:\Windows\System\TlHMfGD.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\fIbksQi.exe
  C:\Windows\System\fIbksQi.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\ShEjVtW.exe
  C:\Windows\System\ShEjVtW.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\SmwWlYW.exe
  C:\Windows\System\SmwWlYW.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\srhcwhc.exe
  C:\Windows\System\srhcwhc.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\QikqpCz.exe
  C:\Windows\System\QikqpCz.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\VxdtAGu.exe
  C:\Windows\System\VxdtAGu.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\PIFZkqJ.exe
  C:\Windows\System\PIFZkqJ.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\bjwDMgg.exe
  C:\Windows\System\bjwDMgg.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\PJtKKCn.exe
  C:\Windows\System\PJtKKCn.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\ljuAzbm.exe
  C:\Windows\System\ljuAzbm.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\xRHHslo.exe
  C:\Windows\System\xRHHslo.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\GkxMxiS.exe
  C:\Windows\System\GkxMxiS.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\FNpIhuM.exe
  C:\Windows\System\FNpIhuM.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\HzKnPaQ.exe
  C:\Windows\System\HzKnPaQ.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\ncjPsvI.exe
  C:\Windows\System\ncjPsvI.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\nDRgLKt.exe
  C:\Windows\System\nDRgLKt.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\sctZdti.exe
  C:\Windows\System\sctZdti.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\LuPupzF.exe
  C:\Windows\System\LuPupzF.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ZPfgwbD.exe
  C:\Windows\System\ZPfgwbD.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\dXdNJRZ.exe
  C:\Windows\System\dXdNJRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\RaZFFCo.exe
  C:\Windows\System\RaZFFCo.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\IeeOhaW.exe
  C:\Windows\System\IeeOhaW.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\yvYDpfC.exe
  C:\Windows\System\yvYDpfC.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\xGGBDvg.exe
  C:\Windows\System\xGGBDvg.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\FeyUUJd.exe
  C:\Windows\System\FeyUUJd.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\UqHMoGQ.exe
  C:\Windows\System\UqHMoGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\GPmSviL.exe
  C:\Windows\System\GPmSviL.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\MvwFdWZ.exe
  C:\Windows\System\MvwFdWZ.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\SmtqDQv.exe
  C:\Windows\System\SmtqDQv.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\qFhKJyI.exe
  C:\Windows\System\qFhKJyI.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\ZNUYotq.exe
  C:\Windows\System\ZNUYotq.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\ftZhLAx.exe
  C:\Windows\System\ftZhLAx.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\pAYpham.exe
  C:\Windows\System\pAYpham.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\aIaSPXw.exe
  C:\Windows\System\aIaSPXw.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\PHqhNrn.exe
  C:\Windows\System\PHqhNrn.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\umvMWGW.exe
  C:\Windows\System\umvMWGW.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\WMgZJwy.exe
  C:\Windows\System\WMgZJwy.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\BSdxFJc.exe
  C:\Windows\System\BSdxFJc.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\sSTwhxm.exe
  C:\Windows\System\sSTwhxm.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\zXXyGNA.exe
  C:\Windows\System\zXXyGNA.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\fJHcoZl.exe
  C:\Windows\System\fJHcoZl.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\XiXkIoa.exe
  C:\Windows\System\XiXkIoa.exe
  2⤵
  PID:2644
- C:\Windows\System\pgQjmAQ.exe
  C:\Windows\System\pgQjmAQ.exe
  2⤵
  PID:2704
- C:\Windows\System\LFzhChM.exe
  C:\Windows\System\LFzhChM.exe
  2⤵
  PID:1208
- C:\Windows\System\gFSPgeu.exe
  C:\Windows\System\gFSPgeu.exe
  2⤵
  PID:1636
- C:\Windows\System\MkIutyl.exe
  C:\Windows\System\MkIutyl.exe
  2⤵
  PID:4568
- C:\Windows\System\bzvXWqa.exe
  C:\Windows\System\bzvXWqa.exe
  2⤵
  PID:4984
- C:\Windows\System\sVDVvcY.exe
  C:\Windows\System\sVDVvcY.exe
  2⤵
  PID:4512
- C:\Windows\System\mVuzpSg.exe
  C:\Windows\System\mVuzpSg.exe
  2⤵
  PID:4804
- C:\Windows\System\gmhaXcU.exe
  C:\Windows\System\gmhaXcU.exe
  2⤵
  PID:4540
- C:\Windows\System\CMuETju.exe
  C:\Windows\System\CMuETju.exe
  2⤵
  PID:4884
- C:\Windows\System\FAzTZKr.exe
  C:\Windows\System\FAzTZKr.exe
  2⤵
  PID:2960
- C:\Windows\System\ObzmImK.exe
  C:\Windows\System\ObzmImK.exe
  2⤵
  PID:5000
- C:\Windows\System\tWIdnrs.exe
  C:\Windows\System\tWIdnrs.exe
  2⤵
  PID:2684
- C:\Windows\System\pUAQsoK.exe
  C:\Windows\System\pUAQsoK.exe
  2⤵
  PID:2680
- C:\Windows\System\mZAKcqq.exe
  C:\Windows\System\mZAKcqq.exe
  2⤵
  PID:3568
- C:\Windows\System\INARIFR.exe
  C:\Windows\System\INARIFR.exe
  2⤵
  PID:3724
- C:\Windows\System\prfUwns.exe
  C:\Windows\System\prfUwns.exe
  2⤵
  PID:5032
- C:\Windows\System\oraDHOM.exe
  C:\Windows\System\oraDHOM.exe
  2⤵
  PID:3592
- C:\Windows\System\IIfIItp.exe
  C:\Windows\System\IIfIItp.exe
  2⤵
  PID:2192
- C:\Windows\System\alCyFJO.exe
  C:\Windows\System\alCyFJO.exe
  2⤵
  PID:216
- C:\Windows\System\NQvwNfO.exe
  C:\Windows\System\NQvwNfO.exe
  2⤵
  PID:5136
- C:\Windows\System\tNTQpNY.exe
  C:\Windows\System\tNTQpNY.exe
  2⤵
  PID:5180
- C:\Windows\System\wcCgqMX.exe
  C:\Windows\System\wcCgqMX.exe
  2⤵
  PID:5196
- C:\Windows\System\jCtsfFS.exe
  C:\Windows\System\jCtsfFS.exe
  2⤵
  PID:5232
- C:\Windows\System\JftLWcN.exe
  C:\Windows\System\JftLWcN.exe
  2⤵
  PID:5260
- C:\Windows\System\VkLyBZy.exe
  C:\Windows\System\VkLyBZy.exe
  2⤵
  PID:5292
- C:\Windows\System\jXvoDRf.exe
  C:\Windows\System\jXvoDRf.exe
  2⤵
  PID:5312
- C:\Windows\System\BPTyity.exe
  C:\Windows\System\BPTyity.exe
  2⤵
  PID:5332
- C:\Windows\System\cuWlWEv.exe
  C:\Windows\System\cuWlWEv.exe
  2⤵
  PID:5372
- C:\Windows\System\vHqkXlO.exe
  C:\Windows\System\vHqkXlO.exe
  2⤵
  PID:5404
- C:\Windows\System\jwzvxAq.exe
  C:\Windows\System\jwzvxAq.exe
  2⤵
  PID:5424
- C:\Windows\System\VFwjGgF.exe
  C:\Windows\System\VFwjGgF.exe
  2⤵
  PID:5468
- C:\Windows\System\UGjVftr.exe
  C:\Windows\System\UGjVftr.exe
  2⤵
  PID:5488
- C:\Windows\System\nBwtCIn.exe
  C:\Windows\System\nBwtCIn.exe
  2⤵
  PID:5524
- C:\Windows\System\FvykvrV.exe
  C:\Windows\System\FvykvrV.exe
  2⤵
  PID:5552
- C:\Windows\System\XWpwyTl.exe
  C:\Windows\System\XWpwyTl.exe
  2⤵
  PID:5584
- C:\Windows\System\eGhLbrd.exe
  C:\Windows\System\eGhLbrd.exe
  2⤵
  PID:5628
- C:\Windows\System\jGeljqJ.exe
  C:\Windows\System\jGeljqJ.exe
  2⤵
  PID:5648
- C:\Windows\System\AanHEqC.exe
  C:\Windows\System\AanHEqC.exe
  2⤵
  PID:5672
- C:\Windows\System\tyCubDg.exe
  C:\Windows\System\tyCubDg.exe
  2⤵
  PID:5688
- C:\Windows\System\SoKQFPB.exe
  C:\Windows\System\SoKQFPB.exe
  2⤵
  PID:5716
- C:\Windows\System\GeTXZVe.exe
  C:\Windows\System\GeTXZVe.exe
  2⤵
  PID:5748
- C:\Windows\System\HtkTpDn.exe
  C:\Windows\System\HtkTpDn.exe
  2⤵
  PID:5768
- C:\Windows\System\KIGTRCz.exe
  C:\Windows\System\KIGTRCz.exe
  2⤵
  PID:5840
- C:\Windows\System\trfLjIN.exe
  C:\Windows\System\trfLjIN.exe
  2⤵
  PID:5864
- C:\Windows\System\tPvoOco.exe
  C:\Windows\System\tPvoOco.exe
  2⤵
  PID:5884
- C:\Windows\System\EzymWXi.exe
  C:\Windows\System\EzymWXi.exe
  2⤵
  PID:5908
- C:\Windows\System\DyslPPw.exe
  C:\Windows\System\DyslPPw.exe
  2⤵
  PID:5936
- C:\Windows\System\AOopDOC.exe
  C:\Windows\System\AOopDOC.exe
  2⤵
  PID:5952
- C:\Windows\System\nOAcLXO.exe
  C:\Windows\System\nOAcLXO.exe
  2⤵
  PID:5972
- C:\Windows\System\QBQSHcu.exe
  C:\Windows\System\QBQSHcu.exe
  2⤵
  PID:5992
- C:\Windows\System\DOPCYhT.exe
  C:\Windows\System\DOPCYhT.exe
  2⤵
  PID:6012
- C:\Windows\System\fpplfBU.exe
  C:\Windows\System\fpplfBU.exe
  2⤵
  PID:6036
- C:\Windows\System\SkKcjfs.exe
  C:\Windows\System\SkKcjfs.exe
  2⤵
  PID:6052
- C:\Windows\System\uUaLEHw.exe
  C:\Windows\System\uUaLEHw.exe
  2⤵
  PID:6068
- C:\Windows\System\OdjKRmk.exe
  C:\Windows\System\OdjKRmk.exe
  2⤵
  PID:6092
- C:\Windows\System\rlZgnGC.exe
  C:\Windows\System\rlZgnGC.exe
  2⤵
  PID:6116
- C:\Windows\System\YZEwNZX.exe
  C:\Windows\System\YZEwNZX.exe
  2⤵
  PID:6132
- C:\Windows\System\wnhuJEd.exe
  C:\Windows\System\wnhuJEd.exe
  2⤵
  PID:5128
- C:\Windows\System\ZcdaxXA.exe
  C:\Windows\System\ZcdaxXA.exe
  2⤵
  PID:5248
- C:\Windows\System\kefJtGz.exe
  C:\Windows\System\kefJtGz.exe
  2⤵
  PID:5300
- C:\Windows\System\JtWQzhO.exe
  C:\Windows\System\JtWQzhO.exe
  2⤵
  PID:5340
- C:\Windows\System\XmmarDT.exe
  C:\Windows\System\XmmarDT.exe
  2⤵
  PID:5548
- C:\Windows\System\IqZcgkD.exe
  C:\Windows\System\IqZcgkD.exe
  2⤵
  PID:5580
- C:\Windows\System\tixBVMg.exe
  C:\Windows\System\tixBVMg.exe
  2⤵
  PID:5660
- C:\Windows\System\DHCpSil.exe
  C:\Windows\System\DHCpSil.exe
  2⤵
  PID:5712
- C:\Windows\System\WmdVWJx.exe
  C:\Windows\System\WmdVWJx.exe
  2⤵
  PID:5608
- C:\Windows\System\VTKzJho.exe
  C:\Windows\System\VTKzJho.exe
  2⤵
  PID:5776
- C:\Windows\System\NXixJda.exe
  C:\Windows\System\NXixJda.exe
  2⤵
  PID:5760
- C:\Windows\System\eiKYGAA.exe
  C:\Windows\System\eiKYGAA.exe
  2⤵
  PID:5852
- C:\Windows\System\bwPJfIz.exe
  C:\Windows\System\bwPJfIz.exe
  2⤵
  PID:5932
- C:\Windows\System\oqVOhfY.exe
  C:\Windows\System\oqVOhfY.exe
  2⤵
  PID:5984
- C:\Windows\System\lzylFsn.exe
  C:\Windows\System\lzylFsn.exe
  2⤵
  PID:228
- C:\Windows\System\eutVcDm.exe
  C:\Windows\System\eutVcDm.exe
  2⤵
  PID:5328
- C:\Windows\System\FCBLEZp.exe
  C:\Windows\System\FCBLEZp.exe
  2⤵
  PID:5464
- C:\Windows\System\dJrJySg.exe
  C:\Windows\System\dJrJySg.exe
  2⤵
  PID:5664
- C:\Windows\System\emGfrwZ.exe
  C:\Windows\System\emGfrwZ.exe
  2⤵
  PID:5668
- C:\Windows\System\xUJecZP.exe
  C:\Windows\System\xUJecZP.exe
  2⤵
  PID:5744
- C:\Windows\System\cwNqbUk.exe
  C:\Windows\System\cwNqbUk.exe
  2⤵
  PID:6060
- C:\Windows\System\dpIRfjD.exe
  C:\Windows\System\dpIRfjD.exe
  2⤵
  PID:6104
- C:\Windows\System\gEgVXKs.exe
  C:\Windows\System\gEgVXKs.exe
  2⤵
  PID:5272
- C:\Windows\System\hwSttLt.exe
  C:\Windows\System\hwSttLt.exe
  2⤵
  PID:5148
- C:\Windows\System\xlAVMKw.exe
  C:\Windows\System\xlAVMKw.exe
  2⤵
  PID:5980
- C:\Windows\System\RDMSjcM.exe
  C:\Windows\System\RDMSjcM.exe
  2⤵
  PID:6156
- C:\Windows\System\kMaVCjq.exe
  C:\Windows\System\kMaVCjq.exe
  2⤵
  PID:6184
- C:\Windows\System\paxUgtr.exe
  C:\Windows\System\paxUgtr.exe
  2⤵
  PID:6204
- C:\Windows\System\xZStuUi.exe
  C:\Windows\System\xZStuUi.exe
  2⤵
  PID:6224
- C:\Windows\System\okligFN.exe
  C:\Windows\System\okligFN.exe
  2⤵
  PID:6248
- C:\Windows\System\nKSGkoe.exe
  C:\Windows\System\nKSGkoe.exe
  2⤵
  PID:6284
- C:\Windows\System\ASNvRlm.exe
  C:\Windows\System\ASNvRlm.exe
  2⤵
  PID:6332
- C:\Windows\System\LdIwaZT.exe
  C:\Windows\System\LdIwaZT.exe
  2⤵
  PID:6368
- C:\Windows\System\GHCZwov.exe
  C:\Windows\System\GHCZwov.exe
  2⤵
  PID:6384
- C:\Windows\System\tYyWPDL.exe
  C:\Windows\System\tYyWPDL.exe
  2⤵
  PID:6412
- C:\Windows\System\VRfiwNC.exe
  C:\Windows\System\VRfiwNC.exe
  2⤵
  PID:6432
- C:\Windows\System\eFnfHom.exe
  C:\Windows\System\eFnfHom.exe
  2⤵
  PID:6460
- C:\Windows\System\EylSFZf.exe
  C:\Windows\System\EylSFZf.exe
  2⤵
  PID:6476
- C:\Windows\System\WTlqcAC.exe
  C:\Windows\System\WTlqcAC.exe
  2⤵
  PID:6512
- C:\Windows\System\yroovVL.exe
  C:\Windows\System\yroovVL.exe
  2⤵
  PID:6560
- C:\Windows\System\dytVpOk.exe
  C:\Windows\System\dytVpOk.exe
  2⤵
  PID:6580
- C:\Windows\System\jxCHjUQ.exe
  C:\Windows\System\jxCHjUQ.exe
  2⤵
  PID:6612
- C:\Windows\System\ihfNzjV.exe
  C:\Windows\System\ihfNzjV.exe
  2⤵
  PID:6632
- C:\Windows\System\KOhCsPb.exe
  C:\Windows\System\KOhCsPb.exe
  2⤵
  PID:6656
- C:\Windows\System\UZYlGiB.exe
  C:\Windows\System\UZYlGiB.exe
  2⤵
  PID:6672
- C:\Windows\System\jBhRxHV.exe
  C:\Windows\System\jBhRxHV.exe
  2⤵
  PID:6700
- C:\Windows\System\QQthtQq.exe
  C:\Windows\System\QQthtQq.exe
  2⤵
  PID:6748
- C:\Windows\System\UxpWprx.exe
  C:\Windows\System\UxpWprx.exe
  2⤵
  PID:6776
- C:\Windows\System\ZcxKQcR.exe
  C:\Windows\System\ZcxKQcR.exe
  2⤵
  PID:6804
- C:\Windows\System\KJYERvg.exe
  C:\Windows\System\KJYERvg.exe
  2⤵
  PID:6824
- C:\Windows\System\ydlSnBg.exe
  C:\Windows\System\ydlSnBg.exe
  2⤵
  PID:6844
- C:\Windows\System\HmyIFNU.exe
  C:\Windows\System\HmyIFNU.exe
  2⤵
  PID:6864
- C:\Windows\System\mnrSBbl.exe
  C:\Windows\System\mnrSBbl.exe
  2⤵
  PID:6892
- C:\Windows\System\iavtQDD.exe
  C:\Windows\System\iavtQDD.exe
  2⤵
  PID:6908
- C:\Windows\System\CkAxwoH.exe
  C:\Windows\System\CkAxwoH.exe
  2⤵
  PID:6932
- C:\Windows\System\ZaNqOzG.exe
  C:\Windows\System\ZaNqOzG.exe
  2⤵
  PID:6956
- C:\Windows\System\pADJsrv.exe
  C:\Windows\System\pADJsrv.exe
  2⤵
  PID:6972
- C:\Windows\System\iJxjHWK.exe
  C:\Windows\System\iJxjHWK.exe
  2⤵
  PID:6992
- C:\Windows\System\MCkZbzf.exe
  C:\Windows\System\MCkZbzf.exe
  2⤵
  PID:7016
- C:\Windows\System\SOEcumI.exe
  C:\Windows\System\SOEcumI.exe
  2⤵
  PID:7064
- C:\Windows\System\AFodyHZ.exe
  C:\Windows\System\AFodyHZ.exe
  2⤵
  PID:7108
- C:\Windows\System\btsARVO.exe
  C:\Windows\System\btsARVO.exe
  2⤵
  PID:7124
- C:\Windows\System\LIwtgem.exe
  C:\Windows\System\LIwtgem.exe
  2⤵
  PID:7152
- C:\Windows\System\yzpwMmf.exe
  C:\Windows\System\yzpwMmf.exe
  2⤵
  PID:5704
- C:\Windows\System\HpByLEs.exe
  C:\Windows\System\HpByLEs.exe
  2⤵
  PID:1296
- C:\Windows\System\DsbblDc.exe
  C:\Windows\System\DsbblDc.exe
  2⤵
  PID:6340
- C:\Windows\System\FCbzbNt.exe
  C:\Windows\System\FCbzbNt.exe
  2⤵
  PID:6380
- C:\Windows\System\RWqtqlB.exe
  C:\Windows\System\RWqtqlB.exe
  2⤵
  PID:6440
- C:\Windows\System\OcqFiSI.exe
  C:\Windows\System\OcqFiSI.exe
  2⤵
  PID:6508
- C:\Windows\System\JjBxmON.exe
  C:\Windows\System\JjBxmON.exe
  2⤵
  PID:6568
- C:\Windows\System\eYXOWWI.exe
  C:\Windows\System\eYXOWWI.exe
  2⤵
  PID:6664
- C:\Windows\System\KfKaJvn.exe
  C:\Windows\System\KfKaJvn.exe
  2⤵
  PID:6708
- C:\Windows\System\CDWTQUy.exe
  C:\Windows\System\CDWTQUy.exe
  2⤵
  PID:6796
- C:\Windows\System\NsLmDph.exe
  C:\Windows\System\NsLmDph.exe
  2⤵
  PID:6988
- C:\Windows\System\fvrucaP.exe
  C:\Windows\System\fvrucaP.exe
  2⤵
  PID:6964
- C:\Windows\System\prptPaP.exe
  C:\Windows\System\prptPaP.exe
  2⤵
  PID:7088
- C:\Windows\System\theFfJV.exe
  C:\Windows\System\theFfJV.exe
  2⤵
  PID:7132
- C:\Windows\System\LvdGcTg.exe
  C:\Windows\System\LvdGcTg.exe
  2⤵
  PID:7100
- C:\Windows\System\YfLwUqn.exe
  C:\Windows\System\YfLwUqn.exe
  2⤵
  PID:5892
- C:\Windows\System\KSGXjtt.exe
  C:\Windows\System\KSGXjtt.exe
  2⤵
  PID:6344
- C:\Windows\System\HBlxLLL.exe
  C:\Windows\System\HBlxLLL.exe
  2⤵
  PID:6400
- C:\Windows\System\PZicxfo.exe
  C:\Windows\System\PZicxfo.exe
  2⤵
  PID:6716
- C:\Windows\System\kOxDpMO.exe
  C:\Windows\System\kOxDpMO.exe
  2⤵
  PID:6840
- C:\Windows\System\xeusVbD.exe
  C:\Windows\System\xeusVbD.exe
  2⤵
  PID:7056
- C:\Windows\System\mpNmHGV.exe
  C:\Windows\System\mpNmHGV.exe
  2⤵
  PID:6968
- C:\Windows\System\WJrPMNf.exe
  C:\Windows\System\WJrPMNf.exe
  2⤵
  PID:6324
- C:\Windows\System\qYBcEdN.exe
  C:\Windows\System\qYBcEdN.exe
  2⤵
  PID:5448
- C:\Windows\System\AajUKyn.exe
  C:\Windows\System\AajUKyn.exe
  2⤵
  PID:5240
- C:\Windows\System\WjEtWdT.exe
  C:\Windows\System\WjEtWdT.exe
  2⤵
  PID:6652
- C:\Windows\System\wXZfnQk.exe
  C:\Windows\System\wXZfnQk.exe
  2⤵
  PID:7180
- C:\Windows\System\EmHsKup.exe
  C:\Windows\System\EmHsKup.exe
  2⤵
  PID:7216
- C:\Windows\System\dVjwxSU.exe
  C:\Windows\System\dVjwxSU.exe
  2⤵
  PID:7268
- C:\Windows\System\IWhJyga.exe
  C:\Windows\System\IWhJyga.exe
  2⤵
  PID:7288
- C:\Windows\System\WMjZJEp.exe
  C:\Windows\System\WMjZJEp.exe
  2⤵
  PID:7320
- C:\Windows\System\JFnFoUy.exe
  C:\Windows\System\JFnFoUy.exe
  2⤵
  PID:7344
- C:\Windows\System\VwACHga.exe
  C:\Windows\System\VwACHga.exe
  2⤵
  PID:7364
- C:\Windows\System\JDXKjSy.exe
  C:\Windows\System\JDXKjSy.exe
  2⤵
  PID:7424
- C:\Windows\System\ZGiorwS.exe
  C:\Windows\System\ZGiorwS.exe
  2⤵
  PID:7456
- C:\Windows\System\uuDtjqQ.exe
  C:\Windows\System\uuDtjqQ.exe
  2⤵
  PID:7476
- C:\Windows\System\vChgOqY.exe
  C:\Windows\System\vChgOqY.exe
  2⤵
  PID:7504
- C:\Windows\System\JYzqrJo.exe
  C:\Windows\System\JYzqrJo.exe
  2⤵
  PID:7536
- C:\Windows\System\ggAyXsB.exe
  C:\Windows\System\ggAyXsB.exe
  2⤵
  PID:7572
- C:\Windows\System\LWnLPkv.exe
  C:\Windows\System\LWnLPkv.exe
  2⤵
  PID:7596
- C:\Windows\System\iZZFUpK.exe
  C:\Windows\System\iZZFUpK.exe
  2⤵
  PID:7620
- C:\Windows\System\GZSjpwj.exe
  C:\Windows\System\GZSjpwj.exe
  2⤵
  PID:7636
- C:\Windows\System\rUHKtOi.exe
  C:\Windows\System\rUHKtOi.exe
  2⤵
  PID:7656
- C:\Windows\System\CdSoKaa.exe
  C:\Windows\System\CdSoKaa.exe
  2⤵
  PID:7676
- C:\Windows\System\gNQGdYs.exe
  C:\Windows\System\gNQGdYs.exe
  2⤵
  PID:7704
- C:\Windows\System\MeurdDK.exe
  C:\Windows\System\MeurdDK.exe
  2⤵
  PID:7728
- C:\Windows\System\OAXamPz.exe
  C:\Windows\System\OAXamPz.exe
  2⤵
  PID:7748
- C:\Windows\System\lzMmXpa.exe
  C:\Windows\System\lzMmXpa.exe
  2⤵
  PID:7768
- C:\Windows\System\ItpYgbB.exe
  C:\Windows\System\ItpYgbB.exe
  2⤵
  PID:7788
- C:\Windows\System\pPJKuHc.exe
  C:\Windows\System\pPJKuHc.exe
  2⤵
  PID:7880
- C:\Windows\System\qYxFOss.exe
  C:\Windows\System\qYxFOss.exe
  2⤵
  PID:7924
- C:\Windows\System\REmabcj.exe
  C:\Windows\System\REmabcj.exe
  2⤵
  PID:7944
- C:\Windows\System\kDNUJvm.exe
  C:\Windows\System\kDNUJvm.exe
  2⤵
  PID:7992
- C:\Windows\System\ESgSiUX.exe
  C:\Windows\System\ESgSiUX.exe
  2⤵
  PID:8012
- C:\Windows\System\qDtCFqW.exe
  C:\Windows\System\qDtCFqW.exe
  2⤵
  PID:8040
- C:\Windows\System\sulkNqO.exe
  C:\Windows\System\sulkNqO.exe
  2⤵
  PID:8096
- C:\Windows\System\QOsjAqB.exe
  C:\Windows\System\QOsjAqB.exe
  2⤵
  PID:8116
- C:\Windows\System\swwZAWY.exe
  C:\Windows\System\swwZAWY.exe
  2⤵
  PID:8136
- C:\Windows\System\JfyGbBv.exe
  C:\Windows\System\JfyGbBv.exe
  2⤵
  PID:8168
- C:\Windows\System\zXAOGXT.exe
  C:\Windows\System\zXAOGXT.exe
  2⤵
  PID:8188
- C:\Windows\System\hvmknNS.exe
  C:\Windows\System\hvmknNS.exe
  2⤵
  PID:7192
- C:\Windows\System\tEBrezx.exe
  C:\Windows\System\tEBrezx.exe
  2⤵
  PID:7212
- C:\Windows\System\ynzJHDb.exe
  C:\Windows\System\ynzJHDb.exe
  2⤵
  PID:7240
- C:\Windows\System\CenCBDB.exe
  C:\Windows\System\CenCBDB.exe
  2⤵
  PID:7300
- C:\Windows\System\mqjuCeo.exe
  C:\Windows\System\mqjuCeo.exe
  2⤵
  PID:7452
- C:\Windows\System\fHCvpvQ.exe
  C:\Windows\System\fHCvpvQ.exe
  2⤵
  PID:7496
- C:\Windows\System\oqwwTke.exe
  C:\Windows\System\oqwwTke.exe
  2⤵
  PID:7568
- C:\Windows\System\HqJPJLA.exe
  C:\Windows\System\HqJPJLA.exe
  2⤵
  PID:7668
- C:\Windows\System\sCRcieW.exe
  C:\Windows\System\sCRcieW.exe
  2⤵
  PID:7764
- C:\Windows\System\wYSgutH.exe
  C:\Windows\System\wYSgutH.exe
  2⤵
  PID:7836
- C:\Windows\System\YFrlAGj.exe
  C:\Windows\System\YFrlAGj.exe
  2⤵
  PID:7800
- C:\Windows\System\nRButMC.exe
  C:\Windows\System\nRButMC.exe
  2⤵
  PID:7912
- C:\Windows\System\DvZTTGc.exe
  C:\Windows\System\DvZTTGc.exe
  2⤵
  PID:8008
- C:\Windows\System\gtUKiNz.exe
  C:\Windows\System\gtUKiNz.exe
  2⤵
  PID:8056
- C:\Windows\System\NgIlaxH.exe
  C:\Windows\System\NgIlaxH.exe
  2⤵
  PID:8112
- C:\Windows\System\HkGEnqT.exe
  C:\Windows\System\HkGEnqT.exe
  2⤵
  PID:8160
- C:\Windows\System\bLwKJCN.exe
  C:\Windows\System\bLwKJCN.exe
  2⤵
  PID:6424
- C:\Windows\System\hSuNlCm.exe
  C:\Windows\System\hSuNlCm.exe
  2⤵
  PID:7384
- C:\Windows\System\WswPWqA.exe
  C:\Windows\System\WswPWqA.exe
  2⤵
  PID:7376
- C:\Windows\System\TKUbMHC.exe
  C:\Windows\System\TKUbMHC.exe
  2⤵
  PID:7784
- C:\Windows\System\oipwivI.exe
  C:\Windows\System\oipwivI.exe
  2⤵
  PID:7700
- C:\Windows\System\lBIZhom.exe
  C:\Windows\System\lBIZhom.exe
  2⤵
  PID:8004
- C:\Windows\System\gbCKBpX.exe
  C:\Windows\System\gbCKBpX.exe
  2⤵
  PID:8060
- C:\Windows\System\fDLsOGL.exe
  C:\Windows\System\fDLsOGL.exe
  2⤵
  PID:7312
- C:\Windows\System\cDXSgJE.exe
  C:\Windows\System\cDXSgJE.exe
  2⤵
  PID:8208
- C:\Windows\System\jZOyQqL.exe
  C:\Windows\System\jZOyQqL.exe
  2⤵
  PID:8224
- C:\Windows\System\BecPoFO.exe
  C:\Windows\System\BecPoFO.exe
  2⤵
  PID:8256
- C:\Windows\System\gyiAedt.exe
  C:\Windows\System\gyiAedt.exe
  2⤵
  PID:8276
- C:\Windows\System\YsEKtkp.exe
  C:\Windows\System\YsEKtkp.exe
  2⤵
  PID:8308
- C:\Windows\System\lFeSYqz.exe
  C:\Windows\System\lFeSYqz.exe
  2⤵
  PID:8324
- C:\Windows\System\KyvmnEy.exe
  C:\Windows\System\KyvmnEy.exe
  2⤵
  PID:8352
- C:\Windows\System\yPqQVrJ.exe
  C:\Windows\System\yPqQVrJ.exe
  2⤵
  PID:8372
- C:\Windows\System\rnJAiXf.exe
  C:\Windows\System\rnJAiXf.exe
  2⤵
  PID:8396
- C:\Windows\System\ihVgcUh.exe
  C:\Windows\System\ihVgcUh.exe
  2⤵
  PID:8452
- C:\Windows\System\NnbiORZ.exe
  C:\Windows\System\NnbiORZ.exe
  2⤵
  PID:8480
- C:\Windows\System\RicwsSb.exe
  C:\Windows\System\RicwsSb.exe
  2⤵
  PID:8500
- C:\Windows\System\bAKLpRH.exe
  C:\Windows\System\bAKLpRH.exe
  2⤵
  PID:8520
- C:\Windows\System\QtcKYvN.exe
  C:\Windows\System\QtcKYvN.exe
  2⤵
  PID:8544
- C:\Windows\System\MDumXxP.exe
  C:\Windows\System\MDumXxP.exe
  2⤵
  PID:8560
- C:\Windows\System\EiKBybp.exe
  C:\Windows\System\EiKBybp.exe
  2⤵
  PID:8576
- C:\Windows\System\EyuaMbL.exe
  C:\Windows\System\EyuaMbL.exe
  2⤵
  PID:8592
- C:\Windows\System\ONjUDmM.exe
  C:\Windows\System\ONjUDmM.exe
  2⤵
  PID:8616
- C:\Windows\System\hqJYcCb.exe
  C:\Windows\System\hqJYcCb.exe
  2⤵
  PID:8636
- C:\Windows\System\rIJjiJe.exe
  C:\Windows\System\rIJjiJe.exe
  2⤵
  PID:8656
- C:\Windows\System\WfpAHgi.exe
  C:\Windows\System\WfpAHgi.exe
  2⤵
  PID:8676
- C:\Windows\System\QOmwEAW.exe
  C:\Windows\System\QOmwEAW.exe
  2⤵
  PID:8700
- C:\Windows\System\mJwRZNK.exe
  C:\Windows\System\mJwRZNK.exe
  2⤵
  PID:8720
- C:\Windows\System\oqEJzrD.exe
  C:\Windows\System\oqEJzrD.exe
  2⤵
  PID:8740
- C:\Windows\System\tuvLUBj.exe
  C:\Windows\System\tuvLUBj.exe
  2⤵
  PID:8764
- C:\Windows\System\WpPYGFR.exe
  C:\Windows\System\WpPYGFR.exe
  2⤵
  PID:8784
- C:\Windows\System\PgLVeMN.exe
  C:\Windows\System\PgLVeMN.exe
  2⤵
  PID:8808
- C:\Windows\System\BdszGwI.exe
  C:\Windows\System\BdszGwI.exe
  2⤵
  PID:8828
- C:\Windows\System\opPHWFo.exe
  C:\Windows\System\opPHWFo.exe
  2⤵
  PID:8848
- C:\Windows\System\OWSFUFG.exe
  C:\Windows\System\OWSFUFG.exe
  2⤵
  PID:8976
- C:\Windows\System\QqDpBeW.exe
  C:\Windows\System\QqDpBeW.exe
  2⤵
  PID:8996
- C:\Windows\System\lTNACmG.exe
  C:\Windows\System\lTNACmG.exe
  2⤵
  PID:9012
- C:\Windows\System\ZvgfaFD.exe
  C:\Windows\System\ZvgfaFD.exe
  2⤵
  PID:9028
- C:\Windows\System\kvlmjCa.exe
  C:\Windows\System\kvlmjCa.exe
  2⤵
  PID:9044
- C:\Windows\System\EEEgtjh.exe
  C:\Windows\System\EEEgtjh.exe
  2⤵
  PID:9064
- C:\Windows\System\lBuAsMn.exe
  C:\Windows\System\lBuAsMn.exe
  2⤵
  PID:9092
- C:\Windows\System\gmJRVrt.exe
  C:\Windows\System\gmJRVrt.exe
  2⤵
  PID:9116
- C:\Windows\System\PBbTfLa.exe
  C:\Windows\System\PBbTfLa.exe
  2⤵
  PID:9140
- C:\Windows\System\ecwGEzj.exe
  C:\Windows\System\ecwGEzj.exe
  2⤵
  PID:9160
- C:\Windows\System\kJWuxer.exe
  C:\Windows\System\kJWuxer.exe
  2⤵
  PID:9180
- C:\Windows\System\HyEnpoe.exe
  C:\Windows\System\HyEnpoe.exe
  2⤵
  PID:9204
- C:\Windows\System\dTHIOYj.exe
  C:\Windows\System\dTHIOYj.exe
  2⤵
  PID:7968
- C:\Windows\System\OJYvNgB.exe
  C:\Windows\System\OJYvNgB.exe
  2⤵
  PID:8200
- C:\Windows\System\EajDAMR.exe
  C:\Windows\System\EajDAMR.exe
  2⤵
  PID:8220
- C:\Windows\System\ieIFTQg.exe
  C:\Windows\System\ieIFTQg.exe
  2⤵
  PID:8320
- C:\Windows\System\MiuhRJT.exe
  C:\Windows\System\MiuhRJT.exe
  2⤵
  PID:8388
- C:\Windows\System\kquYKZm.exe
  C:\Windows\System\kquYKZm.exe
  2⤵
  PID:8464
- C:\Windows\System\igqQxjj.exe
  C:\Windows\System\igqQxjj.exe
  2⤵
  PID:8532
- C:\Windows\System\WZckMAp.exe
  C:\Windows\System\WZckMAp.exe
  2⤵
  PID:8600
- C:\Windows\System\JbqvXdp.exe
  C:\Windows\System\JbqvXdp.exe
  2⤵
  PID:8628
- C:\Windows\System\DfjCBVt.exe
  C:\Windows\System\DfjCBVt.exe
  2⤵
  PID:8672
- C:\Windows\System\qYrvlLz.exe
  C:\Windows\System\qYrvlLz.exe
  2⤵
  PID:8512
- C:\Windows\System\UUKrgkW.exe
  C:\Windows\System\UUKrgkW.exe
  2⤵
  PID:8732
- C:\Windows\System\OYMcPZI.exe
  C:\Windows\System\OYMcPZI.exe
  2⤵
  PID:8668
- C:\Windows\System\PCZnWSY.exe
  C:\Windows\System\PCZnWSY.exe
  2⤵
  PID:8792
- C:\Windows\System\fhSoIlI.exe
  C:\Windows\System\fhSoIlI.exe
  2⤵
  PID:8824
- C:\Windows\System\gGbqhqV.exe
  C:\Windows\System\gGbqhqV.exe
  2⤵
  PID:8864
- C:\Windows\System\pxSkUQY.exe
  C:\Windows\System\pxSkUQY.exe
  2⤵
  PID:8988
- C:\Windows\System\YLILYfU.exe
  C:\Windows\System\YLILYfU.exe
  2⤵
  PID:9040
- C:\Windows\System\lremuiP.exe
  C:\Windows\System\lremuiP.exe
  2⤵
  PID:9104
- C:\Windows\System\vLuJMfw.exe
  C:\Windows\System\vLuJMfw.exe
  2⤵
  PID:8084
- C:\Windows\System\wpcyiDE.exe
  C:\Windows\System\wpcyiDE.exe
  2⤵
  PID:8316
- C:\Windows\System\INOdWHs.exe
  C:\Windows\System\INOdWHs.exe
  2⤵
  PID:9172
- C:\Windows\System\YoPaHTA.exe
  C:\Windows\System\YoPaHTA.exe
  2⤵
  PID:9072
- C:\Windows\System\GyUHTjL.exe
  C:\Windows\System\GyUHTjL.exe
  2⤵
  PID:9236
- C:\Windows\System\LYvymGk.exe
  C:\Windows\System\LYvymGk.exe
  2⤵
  PID:9256
- C:\Windows\System\ZcqQIYZ.exe
  C:\Windows\System\ZcqQIYZ.exe
  2⤵
  PID:9280
- C:\Windows\System\MvXfeuz.exe
  C:\Windows\System\MvXfeuz.exe
  2⤵
  PID:9304
- C:\Windows\System\AsCIodi.exe
  C:\Windows\System\AsCIodi.exe
  2⤵
  PID:9324
- C:\Windows\System\NEWwsHC.exe
  C:\Windows\System\NEWwsHC.exe
  2⤵
  PID:9348
- C:\Windows\System\wAReQhu.exe
  C:\Windows\System\wAReQhu.exe
  2⤵
  PID:9372
- C:\Windows\System\ZuwffUd.exe
  C:\Windows\System\ZuwffUd.exe
  2⤵
  PID:9392
- C:\Windows\System\hzzbBZA.exe
  C:\Windows\System\hzzbBZA.exe
  2⤵
  PID:9412
- C:\Windows\System\AyRXkGa.exe
  C:\Windows\System\AyRXkGa.exe
  2⤵
  PID:9432
- C:\Windows\System\hQlJRdV.exe
  C:\Windows\System\hQlJRdV.exe
  2⤵
  PID:9452
- C:\Windows\System\BeyKmLb.exe
  C:\Windows\System\BeyKmLb.exe
  2⤵
  PID:9480
- C:\Windows\System\rgeBVkQ.exe
  C:\Windows\System\rgeBVkQ.exe
  2⤵
  PID:9504
- C:\Windows\System\DEzYwet.exe
  C:\Windows\System\DEzYwet.exe
  2⤵
  PID:9524
- C:\Windows\System\qTRAAmG.exe
  C:\Windows\System\qTRAAmG.exe
  2⤵
  PID:9552
- C:\Windows\System\AVAbozr.exe
  C:\Windows\System\AVAbozr.exe
  2⤵
  PID:9576
- C:\Windows\System\nMzboZx.exe
  C:\Windows\System\nMzboZx.exe
  2⤵
  PID:9600
- C:\Windows\System\fpTDgUG.exe
  C:\Windows\System\fpTDgUG.exe
  2⤵
  PID:9620
- C:\Windows\System\PJsEFKm.exe
  C:\Windows\System\PJsEFKm.exe
  2⤵
  PID:9640
- C:\Windows\System\aRnHOOI.exe
  C:\Windows\System\aRnHOOI.exe
  2⤵
  PID:9660
- C:\Windows\System\BzPUWtW.exe
  C:\Windows\System\BzPUWtW.exe
  2⤵
  PID:9684
- C:\Windows\System\jfnybPS.exe
  C:\Windows\System\jfnybPS.exe
  2⤵
  PID:9704
- C:\Windows\System\MYtrekv.exe
  C:\Windows\System\MYtrekv.exe
  2⤵
  PID:9724
- C:\Windows\System\vYEzYvc.exe
  C:\Windows\System\vYEzYvc.exe
  2⤵
  PID:9748
- C:\Windows\System\eGqzIHM.exe
  C:\Windows\System\eGqzIHM.exe
  2⤵
  PID:9772
- C:\Windows\System\voBpnge.exe
  C:\Windows\System\voBpnge.exe
  2⤵
  PID:9800
- C:\Windows\System\UEEZpZj.exe
  C:\Windows\System\UEEZpZj.exe
  2⤵
  PID:9816
- C:\Windows\System\VGrzlSo.exe
  C:\Windows\System\VGrzlSo.exe
  2⤵
  PID:9840
- C:\Windows\System\uezkLLA.exe
  C:\Windows\System\uezkLLA.exe
  2⤵
  PID:9860
- C:\Windows\System\kbGBlKJ.exe
  C:\Windows\System\kbGBlKJ.exe
  2⤵
  PID:9884
- C:\Windows\System\ufxhAER.exe
  C:\Windows\System\ufxhAER.exe
  2⤵
  PID:9900
- C:\Windows\System\ZTmXgGx.exe
  C:\Windows\System\ZTmXgGx.exe
  2⤵
  PID:9920
- C:\Windows\System\AqgqMsF.exe
  C:\Windows\System\AqgqMsF.exe
  2⤵
  PID:9940
- C:\Windows\System\sTyxqcI.exe
  C:\Windows\System\sTyxqcI.exe
  2⤵
  PID:9964
- C:\Windows\System\SuyoEfd.exe
  C:\Windows\System\SuyoEfd.exe
  2⤵
  PID:9988
- C:\Windows\System\pswWIbO.exe
  C:\Windows\System\pswWIbO.exe
  2⤵
  PID:10008
- C:\Windows\System\BENFSXl.exe
  C:\Windows\System\BENFSXl.exe
  2⤵
  PID:10036
- C:\Windows\System\DCMONHb.exe
  C:\Windows\System\DCMONHb.exe
  2⤵
  PID:10056
- C:\Windows\System\nXHtOPM.exe
  C:\Windows\System\nXHtOPM.exe
  2⤵
  PID:10080
- C:\Windows\System\NorbGwL.exe
  C:\Windows\System\NorbGwL.exe
  2⤵
  PID:10100
- C:\Windows\System\wMmaUlN.exe
  C:\Windows\System\wMmaUlN.exe
  2⤵
  PID:10120
- C:\Windows\System\MsRVMGn.exe
  C:\Windows\System\MsRVMGn.exe
  2⤵
  PID:10164
- C:\Windows\System\TAjumTs.exe
  C:\Windows\System\TAjumTs.exe
  2⤵
  PID:10192
- C:\Windows\System\xZOflWk.exe
  C:\Windows\System\xZOflWk.exe
  2⤵
  PID:10212
- C:\Windows\System\YyvrbpB.exe
  C:\Windows\System\YyvrbpB.exe
  2⤵
  PID:8332
- C:\Windows\System\uBIScBb.exe
  C:\Windows\System\uBIScBb.exe
  2⤵
  PID:9188
- C:\Windows\System\YtMIuWU.exe
  C:\Windows\System\YtMIuWU.exe
  2⤵
  PID:8216
- C:\Windows\System\mWEnpCD.exe
  C:\Windows\System\mWEnpCD.exe
  2⤵
  PID:8572
- C:\Windows\System\DmEHiiq.exe
  C:\Windows\System\DmEHiiq.exe
  2⤵
  PID:8552
- C:\Windows\System\xIaZtlY.exe
  C:\Windows\System\xIaZtlY.exe
  2⤵
  PID:8712
- C:\Windows\System\gOhIJrw.exe
  C:\Windows\System\gOhIJrw.exe
  2⤵
  PID:8840
- C:\Windows\System\hehaGCd.exe
  C:\Windows\System\hehaGCd.exe
  2⤵
  PID:9252
- C:\Windows\System\HqwIBcI.exe
  C:\Windows\System\HqwIBcI.exe
  2⤵
  PID:9300
- C:\Windows\System\CXfuXLG.exe
  C:\Windows\System\CXfuXLG.exe
  2⤵
  PID:8412
- C:\Windows\System\JrGxgTH.exe
  C:\Windows\System\JrGxgTH.exe
  2⤵
  PID:9400
- C:\Windows\System\VzmxUOZ.exe
  C:\Windows\System\VzmxUOZ.exe
  2⤵
  PID:8612
- C:\Windows\System\UnuFhSj.exe
  C:\Windows\System\UnuFhSj.exe
  2⤵
  PID:9084
- C:\Windows\System\UmqTQXU.exe
  C:\Windows\System\UmqTQXU.exe
  2⤵
  PID:9592
- C:\Windows\System\SljckHM.exe
  C:\Windows\System\SljckHM.exe
  2⤵
  PID:9848
- C:\Windows\System\yensEVi.exe
  C:\Windows\System\yensEVi.exe
  2⤵
  PID:9916
- C:\Windows\System\LEZpRNw.exe
  C:\Windows\System\LEZpRNw.exe
  2⤵
  PID:9460
- C:\Windows\System\NVnBGtb.exe
  C:\Windows\System\NVnBGtb.exe
  2⤵
  PID:9500
- C:\Windows\System\nYdmwmH.exe
  C:\Windows\System\nYdmwmH.exe
  2⤵
  PID:10024
- C:\Windows\System\JKtnGzh.exe
  C:\Windows\System\JKtnGzh.exe
  2⤵
  PID:10072
- C:\Windows\System\TMqAobB.exe
  C:\Windows\System\TMqAobB.exe
  2⤵
  PID:10160
- C:\Windows\System\aFBdOCX.exe
  C:\Windows\System\aFBdOCX.exe
  2⤵
  PID:10256
- C:\Windows\System\uyvTDVY.exe
  C:\Windows\System\uyvTDVY.exe
  2⤵
  PID:10280
- C:\Windows\System\wLweiQD.exe
  C:\Windows\System\wLweiQD.exe
  2⤵
  PID:10304
- C:\Windows\System\CXCdOsw.exe
  C:\Windows\System\CXCdOsw.exe
  2⤵
  PID:10324
- C:\Windows\System\mbIQMCR.exe
  C:\Windows\System\mbIQMCR.exe
  2⤵
  PID:10348
- C:\Windows\System\AdMpXDE.exe
  C:\Windows\System\AdMpXDE.exe
  2⤵
  PID:10368
- C:\Windows\System\IRHSQet.exe
  C:\Windows\System\IRHSQet.exe
  2⤵
  PID:10384
- C:\Windows\System\GuBFsMA.exe
  C:\Windows\System\GuBFsMA.exe
  2⤵
  PID:10400
- C:\Windows\System\BPYOggh.exe
  C:\Windows\System\BPYOggh.exe
  2⤵
  PID:10420
- C:\Windows\System\fNmOTbZ.exe
  C:\Windows\System\fNmOTbZ.exe
  2⤵
  PID:10440
- C:\Windows\System\AczQReE.exe
  C:\Windows\System\AczQReE.exe
  2⤵
  PID:10456
- C:\Windows\System\rkvRVuY.exe
  C:\Windows\System\rkvRVuY.exe
  2⤵
  PID:10480
- C:\Windows\System\QQofbrd.exe
  C:\Windows\System\QQofbrd.exe
  2⤵
  PID:10508
- C:\Windows\System\zZNGPlc.exe
  C:\Windows\System\zZNGPlc.exe
  2⤵
  PID:10532
- C:\Windows\System\pdvHRls.exe
  C:\Windows\System\pdvHRls.exe
  2⤵
  PID:10556
- C:\Windows\System\GMdgFbx.exe
  C:\Windows\System\GMdgFbx.exe
  2⤵
  PID:10572
- C:\Windows\System\fIjJTjj.exe
  C:\Windows\System\fIjJTjj.exe
  2⤵
  PID:10588
- C:\Windows\System\SMyhQNo.exe
  C:\Windows\System\SMyhQNo.exe
  2⤵
  PID:10604
- C:\Windows\System\QkdXkjv.exe
  C:\Windows\System\QkdXkjv.exe
  2⤵
  PID:10620
- C:\Windows\System\YufqIlS.exe
  C:\Windows\System\YufqIlS.exe
  2⤵
  PID:10640
- C:\Windows\System\TwbBAdV.exe
  C:\Windows\System\TwbBAdV.exe
  2⤵
  PID:10664
- C:\Windows\System\JKSVoIn.exe
  C:\Windows\System\JKSVoIn.exe
  2⤵
  PID:10696
- C:\Windows\System\nKKUYCV.exe
  C:\Windows\System\nKKUYCV.exe
  2⤵
  PID:10720
- C:\Windows\System\dZNSICz.exe
  C:\Windows\System\dZNSICz.exe
  2⤵
  PID:9676
- C:\Windows\System\UsPSqTa.exe
  C:\Windows\System\UsPSqTa.exe
  2⤵
  PID:9716
- C:\Windows\System\vCkrDAt.exe
  C:\Windows\System\vCkrDAt.exe
  2⤵
  PID:10184
- C:\Windows\System\zRvnGey.exe
  C:\Windows\System\zRvnGey.exe
  2⤵
  PID:9516
- C:\Windows\System\YUtOMzQ.exe
  C:\Windows\System\YUtOMzQ.exe
  2⤵
  PID:10412
- C:\Windows\System\DUbSQJL.exe
  C:\Windows\System\DUbSQJL.exe
  2⤵
  PID:9248
- C:\Windows\System\ryDhhsL.exe
  C:\Windows\System\ryDhhsL.exe
  2⤵
  PID:9388
- C:\Windows\System\XrRoRZt.exe
  C:\Windows\System\XrRoRZt.exe
  2⤵
  PID:9076
- C:\Windows\System\PTrBboC.exe
  C:\Windows\System\PTrBboC.exe
  2⤵
  PID:10108
- C:\Windows\System\udjcCnI.exe
  C:\Windows\System\udjcCnI.exe
  2⤵
  PID:10692
- C:\Windows\System\mImijag.exe
  C:\Windows\System\mImijag.exe
  2⤵
  PID:10000
- C:\Windows\System\EJpthzr.exe
  C:\Windows\System\EJpthzr.exe
  2⤵
  PID:10268
- C:\Windows\System\cqSmmVR.exe
  C:\Windows\System\cqSmmVR.exe
  2⤵
  PID:10332
- C:\Windows\System\hofPmpl.exe
  C:\Windows\System\hofPmpl.exe
  2⤵
  PID:8540
- C:\Windows\System\LdhANHv.exe
  C:\Windows\System\LdhANHv.exe
  2⤵
  PID:10488
- C:\Windows\System\TzVtnMb.exe
  C:\Windows\System\TzVtnMb.exe
  2⤵
  PID:9812
- C:\Windows\System\lENAMiV.exe
  C:\Windows\System\lENAMiV.exe
  2⤵
  PID:9836
- C:\Windows\System\eLbWLch.exe
  C:\Windows\System\eLbWLch.exe
  2⤵
  PID:10636
- C:\Windows\System\xrRzdtm.exe
  C:\Windows\System\xrRzdtm.exe
  2⤵
  PID:10676
- C:\Windows\System\VrWTqFc.exe
  C:\Windows\System\VrWTqFc.exe
  2⤵
  PID:10872
- C:\Windows\System\jPotitm.exe
  C:\Windows\System\jPotitm.exe
  2⤵
  PID:9520
- C:\Windows\System\OpFwjMr.exe
  C:\Windows\System\OpFwjMr.exe
  2⤵
  PID:10288
- C:\Windows\System\SXCLfJB.exe
  C:\Windows\System\SXCLfJB.exe
  2⤵
  PID:10376
- C:\Windows\System\okVnUwO.exe
  C:\Windows\System\okVnUwO.exe
  2⤵
  PID:10860
- C:\Windows\System\EOnlWdF.exe
  C:\Windows\System\EOnlWdF.exe
  2⤵
  PID:10684
- C:\Windows\System\FoyncWO.exe
  C:\Windows\System\FoyncWO.exe
  2⤵
  PID:10888
- C:\Windows\System\SmKUwHu.exe
  C:\Windows\System\SmKUwHu.exe
  2⤵
  PID:10908
- C:\Windows\System\brYaECa.exe
  C:\Windows\System\brYaECa.exe
  2⤵
  PID:11240
- C:\Windows\System\rYRnkfy.exe
  C:\Windows\System\rYRnkfy.exe
  2⤵
  PID:9928
- C:\Windows\System\zzcnKsw.exe
  C:\Windows\System\zzcnKsw.exe
  2⤵
  PID:11080
- C:\Windows\System\RqwfiKI.exe
  C:\Windows\System\RqwfiKI.exe
  2⤵
  PID:11160
- C:\Windows\System\zhLwcSu.exe
  C:\Windows\System\zhLwcSu.exe
  2⤵
  PID:11268
- C:\Windows\System\PXeJiPD.exe
  C:\Windows\System\PXeJiPD.exe
  2⤵
  PID:11292
- C:\Windows\System\WiSJdij.exe
  C:\Windows\System\WiSJdij.exe
  2⤵
  PID:11312
- C:\Windows\System\NlsWsdI.exe
  C:\Windows\System\NlsWsdI.exe
  2⤵
  PID:11328
- C:\Windows\System\qZVdoFb.exe
  C:\Windows\System\qZVdoFb.exe
  2⤵
  PID:11360
- C:\Windows\System\ECTaZbD.exe
  C:\Windows\System\ECTaZbD.exe
  2⤵
  PID:11388
- C:\Windows\System\TKnRyGm.exe
  C:\Windows\System\TKnRyGm.exe
  2⤵
  PID:11408
- C:\Windows\System\dDGYXFk.exe
  C:\Windows\System\dDGYXFk.exe
  2⤵
  PID:11436
- C:\Windows\System\wZBtZRb.exe
  C:\Windows\System\wZBtZRb.exe
  2⤵
  PID:11456
- C:\Windows\System\QtIBafE.exe
  C:\Windows\System\QtIBafE.exe
  2⤵
  PID:11476
- C:\Windows\System\QlGfKHE.exe
  C:\Windows\System\QlGfKHE.exe
  2⤵
  PID:11496
- C:\Windows\System\NJCwwNQ.exe
  C:\Windows\System\NJCwwNQ.exe
  2⤵
  PID:11512
- C:\Windows\System\WxeMHWN.exe
  C:\Windows\System\WxeMHWN.exe
  2⤵
  PID:11528
- C:\Windows\System\RkNHAGC.exe
  C:\Windows\System\RkNHAGC.exe
  2⤵
  PID:11548
- C:\Windows\System\EDYyvTx.exe
  C:\Windows\System\EDYyvTx.exe
  2⤵
  PID:11568
- C:\Windows\System\EQWfXCZ.exe
  C:\Windows\System\EQWfXCZ.exe
  2⤵
  PID:11584
- C:\Windows\System\BYlIAoN.exe
  C:\Windows\System\BYlIAoN.exe
  2⤵
  PID:11600
- C:\Windows\System\SQEjJjC.exe
  C:\Windows\System\SQEjJjC.exe
  2⤵
  PID:11616
- C:\Windows\System\BNAItGW.exe
  C:\Windows\System\BNAItGW.exe
  2⤵
  PID:11632
- C:\Windows\System\hnkklkp.exe
  C:\Windows\System\hnkklkp.exe
  2⤵
  PID:11652
- C:\Windows\System\lJtadwA.exe
  C:\Windows\System\lJtadwA.exe
  2⤵
  PID:11688
- C:\Windows\System\gRPHUfN.exe
  C:\Windows\System\gRPHUfN.exe
  2⤵
  PID:11712
- C:\Windows\System\GBvsNjl.exe
  C:\Windows\System\GBvsNjl.exe
  2⤵
  PID:11776
- C:\Windows\System\DvFHujf.exe
  C:\Windows\System\DvFHujf.exe
  2⤵
  PID:11796
- C:\Windows\System\bWxUyOl.exe
  C:\Windows\System\bWxUyOl.exe
  2⤵
  PID:11812
- C:\Windows\System\wsHMDWw.exe
  C:\Windows\System\wsHMDWw.exe
  2⤵
  PID:11828
- C:\Windows\System\uBDGruR.exe
  C:\Windows\System\uBDGruR.exe
  2⤵
  PID:11844
- C:\Windows\System\TMxIfPT.exe
  C:\Windows\System\TMxIfPT.exe
  2⤵
  PID:11860
- C:\Windows\System\KiwqLCp.exe
  C:\Windows\System\KiwqLCp.exe
  2⤵
  PID:11876
- C:\Windows\System\cbpKBzm.exe
  C:\Windows\System\cbpKBzm.exe
  2⤵
  PID:11900
- C:\Windows\System\lXFjJNh.exe
  C:\Windows\System\lXFjJNh.exe
  2⤵
  PID:11916
- C:\Windows\System\FnjPjEx.exe
  C:\Windows\System\FnjPjEx.exe
  2⤵
  PID:11932
- C:\Windows\System\xVXhfTW.exe
  C:\Windows\System\xVXhfTW.exe
  2⤵
  PID:11948
- C:\Windows\System\cmNdCeo.exe
  C:\Windows\System\cmNdCeo.exe
  2⤵
  PID:11964
- C:\Windows\System\jklGJKz.exe
  C:\Windows\System\jklGJKz.exe
  2⤵
  PID:11980
- C:\Windows\System\TPKaUuI.exe
  C:\Windows\System\TPKaUuI.exe
  2⤵
  PID:12016
- C:\Windows\System\pCKqBae.exe
  C:\Windows\System\pCKqBae.exe
  2⤵
  PID:12040
- C:\Windows\System\oCGOotD.exe
  C:\Windows\System\oCGOotD.exe
  2⤵
  PID:12064
- C:\Windows\System\wVjynHy.exe
  C:\Windows\System\wVjynHy.exe
  2⤵
  PID:12088
- C:\Windows\System\rgxgvfX.exe
  C:\Windows\System\rgxgvfX.exe
  2⤵
  PID:12104
- C:\Windows\System\jgabRzU.exe
  C:\Windows\System\jgabRzU.exe
  2⤵
  PID:12124
- C:\Windows\System\RjXgYMF.exe
  C:\Windows\System\RjXgYMF.exe
  2⤵
  PID:12156
- C:\Windows\System\UyBrzHC.exe
  C:\Windows\System\UyBrzHC.exe
  2⤵
  PID:12180
- C:\Windows\System\rrgtgDs.exe
  C:\Windows\System\rrgtgDs.exe
  2⤵
  PID:12200
- C:\Windows\System\OZOLvcq.exe
  C:\Windows\System\OZOLvcq.exe
  2⤵
  PID:12220
- C:\Windows\System\jFOFAqV.exe
  C:\Windows\System\jFOFAqV.exe
  2⤵
  PID:12244
- C:\Windows\System\kqgmnqu.exe
  C:\Windows\System\kqgmnqu.exe
  2⤵
  PID:12272
- C:\Windows\System\aFXaBTJ.exe
  C:\Windows\System\aFXaBTJ.exe
  2⤵
  PID:11224
- C:\Windows\System\bzeGjjz.exe
  C:\Windows\System\bzeGjjz.exe
  2⤵
  PID:9784
- C:\Windows\System\IjrWqbE.exe
  C:\Windows\System\IjrWqbE.exe
  2⤵
  PID:10428
- C:\Windows\System\MNtujOB.exe
  C:\Windows\System\MNtujOB.exe
  2⤵
  PID:9408
- C:\Windows\System\gzIaARw.exe
  C:\Windows\System\gzIaARw.exe
  2⤵
  PID:10128
- C:\Windows\System\pHFyIAz.exe
  C:\Windows\System\pHFyIAz.exe
  2⤵
  PID:10448
- C:\Windows\System\vMTKJLb.exe
  C:\Windows\System\vMTKJLb.exe
  2⤵
  PID:10580
- C:\Windows\System\qqvDghr.exe
  C:\Windows\System\qqvDghr.exe
  2⤵
  PID:10092
- C:\Windows\System\IIAelYz.exe
  C:\Windows\System\IIAelYz.exe
  2⤵
  PID:9632
- C:\Windows\System\iEkiaIi.exe
  C:\Windows\System\iEkiaIi.exe
  2⤵
  PID:10964
- C:\Windows\System\cZPAmMy.exe
  C:\Windows\System\cZPAmMy.exe
  2⤵
  PID:11048
- C:\Windows\System\HzzEYcJ.exe
  C:\Windows\System\HzzEYcJ.exe
  2⤵
  PID:11308
- C:\Windows\System\xiEeayB.exe
  C:\Windows\System\xiEeayB.exe
  2⤵
  PID:9448
- C:\Windows\System\AietQix.exe
  C:\Windows\System\AietQix.exe
  2⤵
  PID:11376
- C:\Windows\System\AbEfbpU.exe
  C:\Windows\System\AbEfbpU.exe
  2⤵
  PID:11428
- C:\Windows\System\BMCRdEp.exe
  C:\Windows\System\BMCRdEp.exe
  2⤵
  PID:10704
- C:\Windows\System\dgRcKEX.exe
  C:\Windows\System\dgRcKEX.exe
  2⤵
  PID:11756
- C:\Windows\System\vYiIvoo.exe
  C:\Windows\System\vYiIvoo.exe
  2⤵
  PID:10648
- C:\Windows\System\VyhMZJV.exe
  C:\Windows\System\VyhMZJV.exe
  2⤵
  PID:11840
- C:\Windows\System\fVGfXyH.exe
  C:\Windows\System\fVGfXyH.exe
  2⤵
  PID:11884
- C:\Windows\System\itfLbKQ.exe
  C:\Windows\System\itfLbKQ.exe
  2⤵
  PID:11540
- C:\Windows\System\VZbrlln.exe
  C:\Windows\System\VZbrlln.exe
  2⤵
  PID:11960
- C:\Windows\System\nJSBMSD.exe
  C:\Windows\System\nJSBMSD.exe
  2⤵
  PID:11992
- C:\Windows\System\agSTgdl.exe
  C:\Windows\System\agSTgdl.exe
  2⤵
  PID:12132
- C:\Windows\System\PQixgOL.exe
  C:\Windows\System\PQixgOL.exe
  2⤵
  PID:12176
- C:\Windows\System\IRAIrSI.exe
  C:\Windows\System\IRAIrSI.exe
  2⤵
  PID:10032
- C:\Windows\System\TgFZdve.exe
  C:\Windows\System\TgFZdve.exe
  2⤵
  PID:11452
- C:\Windows\System\WLrGAVH.exe
  C:\Windows\System\WLrGAVH.exe
  2⤵
  PID:10616
- C:\Windows\System\IkHmZsE.exe
  C:\Windows\System\IkHmZsE.exe
  2⤵
  PID:11804
- C:\Windows\System\kinuSIm.exe
  C:\Windows\System\kinuSIm.exe
  2⤵
  PID:11608
- C:\Windows\System\mFtzEah.exe
  C:\Windows\System\mFtzEah.exe
  2⤵
  PID:11372
- C:\Windows\System\vQbeNcV.exe
  C:\Windows\System\vQbeNcV.exe
  2⤵
  PID:11116
- C:\Windows\System\WJUxQcj.exe
  C:\Windows\System\WJUxQcj.exe
  2⤵
  PID:4316
- C:\Windows\System\QEtXEwJ.exe
  C:\Windows\System\QEtXEwJ.exe
  2⤵
  PID:12292
- C:\Windows\System\xIidXXF.exe
  C:\Windows\System\xIidXXF.exe
  2⤵
  PID:12620
- C:\Windows\System\ofxeoRB.exe
  C:\Windows\System\ofxeoRB.exe
  2⤵
  PID:12636
- C:\Windows\System\ZFFHBoO.exe
  C:\Windows\System\ZFFHBoO.exe
  2⤵
  PID:12652
- C:\Windows\System\qwHLCYW.exe
  C:\Windows\System\qwHLCYW.exe
  2⤵
  PID:12672
- C:\Windows\System\bXOyaTe.exe
  C:\Windows\System\bXOyaTe.exe
  2⤵
  PID:12700
- C:\Windows\System\xqAaaOt.exe
  C:\Windows\System\xqAaaOt.exe
  2⤵
  PID:12716
- C:\Windows\System\iiycnal.exe
  C:\Windows\System\iiycnal.exe
  2⤵
  PID:12732
- C:\Windows\System\aQVblWf.exe
  C:\Windows\System\aQVblWf.exe
  2⤵
  PID:12748
- C:\Windows\System\GNEQjCg.exe
  C:\Windows\System\GNEQjCg.exe
  2⤵
  PID:12764
- C:\Windows\System\khEQQmO.exe
  C:\Windows\System\khEQQmO.exe
  2⤵
  PID:12784
- C:\Windows\System\pZfxBzp.exe
  C:\Windows\System\pZfxBzp.exe
  2⤵
  PID:12800
- C:\Windows\System\unCJTwR.exe
  C:\Windows\System\unCJTwR.exe
  2⤵
  PID:12816
- C:\Windows\System\OQdDtVK.exe
  C:\Windows\System\OQdDtVK.exe
  2⤵
  PID:12832
- C:\Windows\System\fGZytAZ.exe
  C:\Windows\System\fGZytAZ.exe
  2⤵
  PID:12848
- C:\Windows\System\diFwvpx.exe
  C:\Windows\System\diFwvpx.exe
  2⤵
  PID:12868
- C:\Windows\System\PAJleqf.exe
  C:\Windows\System\PAJleqf.exe
  2⤵
  PID:12888
- C:\Windows\System\iOgkCyz.exe
  C:\Windows\System\iOgkCyz.exe
  2⤵
  PID:12916
- C:\Windows\System\qSnqymL.exe
  C:\Windows\System\qSnqymL.exe
  2⤵
  PID:12936
- C:\Windows\System\EGvLJeG.exe
  C:\Windows\System\EGvLJeG.exe
  2⤵
  PID:12952
- C:\Windows\System\ymayMLF.exe
  C:\Windows\System\ymayMLF.exe
  2⤵
  PID:12980
- C:\Windows\System\ddRbGCr.exe
  C:\Windows\System\ddRbGCr.exe
  2⤵
  PID:13008
- C:\Windows\System\JQdCNTd.exe
  C:\Windows\System\JQdCNTd.exe
  2⤵
  PID:13040
- C:\Windows\System\mYvvSgp.exe
  C:\Windows\System\mYvvSgp.exe
  2⤵
  PID:13080
- C:\Windows\System\fyODFzw.exe
  C:\Windows\System\fyODFzw.exe
  2⤵
  PID:13116
- C:\Windows\System\uureFtJ.exe
  C:\Windows\System\uureFtJ.exe
  2⤵
  PID:13136
- C:\Windows\System\pOSJFLj.exe
  C:\Windows\System\pOSJFLj.exe
  2⤵
  PID:13164
- C:\Windows\System\kTUaBrv.exe
  C:\Windows\System\kTUaBrv.exe
  2⤵
  PID:13184
- C:\Windows\System\cTUVqtE.exe
  C:\Windows\System\cTUVqtE.exe
  2⤵
  PID:13200
- C:\Windows\System\EQDNuOZ.exe
  C:\Windows\System\EQDNuOZ.exe
  2⤵
  PID:13220
- C:\Windows\System\YxgSTpA.exe
  C:\Windows\System\YxgSTpA.exe
  2⤵
  PID:13244
- C:\Windows\System\IoSonJk.exe
  C:\Windows\System\IoSonJk.exe
  2⤵
  PID:13264
- C:\Windows\System\UgVTios.exe
  C:\Windows\System\UgVTios.exe
  2⤵
  PID:13284
- C:\Windows\System\nNycciF.exe
  C:\Windows\System\nNycciF.exe
  2⤵
  PID:13308
- C:\Windows\System\wafiQaH.exe
  C:\Windows\System\wafiQaH.exe
  2⤵
  PID:844
- C:\Windows\System\gAeDvMD.exe
  C:\Windows\System\gAeDvMD.exe
  2⤵
  PID:9020
- C:\Windows\System\jCtdIcY.exe
  C:\Windows\System\jCtdIcY.exe
  2⤵
  PID:11784
- C:\Windows\System\IiIQGcY.exe
  C:\Windows\System\IiIQGcY.exe
  2⤵
  PID:11856
- C:\Windows\System\IPXlFWT.exe
  C:\Windows\System\IPXlFWT.exe
  2⤵
  PID:11324
- C:\Windows\System\tTeNEjQ.exe
  C:\Windows\System\tTeNEjQ.exe
  2⤵
  PID:11508
- C:\Windows\System\aDARjPl.exe
  C:\Windows\System\aDARjPl.exe
  2⤵
  PID:12164
- C:\Windows\System\iGXikkN.exe
  C:\Windows\System\iGXikkN.exe
  2⤵
  PID:10936
- C:\Windows\System\dArdViD.exe
  C:\Windows\System\dArdViD.exe
  2⤵
  PID:12476
- C:\Windows\System\pHpZnkw.exe
  C:\Windows\System\pHpZnkw.exe
  2⤵
  PID:12516
- C:\Windows\System\wklAYkG.exe
  C:\Windows\System\wklAYkG.exe
  2⤵
  PID:11524
- C:\Windows\System\GGehcmH.exe
  C:\Windows\System\GGehcmH.exe
  2⤵
  PID:12708
- C:\Windows\System\AJjpCOn.exe
  C:\Windows\System\AJjpCOn.exe
  2⤵
  PID:12860
- C:\Windows\System\ItSBqcs.exe
  C:\Windows\System\ItSBqcs.exe
  2⤵
  PID:12924
- C:\Windows\System\IIffUJR.exe
  C:\Windows\System\IIffUJR.exe
  2⤵
  PID:11892
- C:\Windows\System\OHVuZHa.exe
  C:\Windows\System\OHVuZHa.exe
  2⤵
  PID:12968
- C:\Windows\System\kCOVOfe.exe
  C:\Windows\System\kCOVOfe.exe
  2⤵
  PID:12464
- C:\Windows\System\byQgVyJ.exe
  C:\Windows\System\byQgVyJ.exe
  2⤵
  PID:12524
- C:\Windows\System\fFUTKec.exe
  C:\Windows\System\fFUTKec.exe
  2⤵
  PID:12532
- C:\Windows\System\aMAhKxX.exe
  C:\Windows\System\aMAhKxX.exe
  2⤵
  PID:12560
- C:\Windows\System\GPHbybw.exe
  C:\Windows\System\GPHbybw.exe
  2⤵
  PID:13112
- C:\Windows\System\DIKZBqo.exe
  C:\Windows\System\DIKZBqo.exe
  2⤵
  PID:12300
- C:\Windows\System\khklMSG.exe
  C:\Windows\System\khklMSG.exe
  2⤵
  PID:13216
- C:\Windows\System\SCvRVVK.exe
  C:\Windows\System\SCvRVVK.exe
  2⤵
  PID:13128
- C:\Windows\System\SgRYmvc.exe
  C:\Windows\System\SgRYmvc.exe
  2⤵
  PID:12668
- C:\Windows\System\QgGSuxT.exe
  C:\Windows\System\QgGSuxT.exe
  2⤵
  PID:12728
- C:\Windows\System\ZShYWUQ.exe
  C:\Windows\System\ZShYWUQ.exe
  2⤵
  PID:13096
- C:\Windows\System\vSAUwVf.exe
  C:\Windows\System\vSAUwVf.exe
  2⤵
  PID:12396
- C:\Windows\System\EmvXLvN.exe
  C:\Windows\System\EmvXLvN.exe
  2⤵
  PID:13236
- C:\Windows\System\cqLbCgg.exe
  C:\Windows\System\cqLbCgg.exe
  2⤵
  PID:4816
- C:\Windows\System\bZzrqXy.exe
  C:\Windows\System\bZzrqXy.exe
  2⤵
  PID:13324
- C:\Windows\System\nrBLOvX.exe
  C:\Windows\System\nrBLOvX.exe
  2⤵
  PID:13340
- C:\Windows\System\CTZIXJW.exe
  C:\Windows\System\CTZIXJW.exe
  2⤵
  PID:13356
- C:\Windows\System\KcgYRyS.exe
  C:\Windows\System\KcgYRyS.exe
  2⤵
  PID:13372
- C:\Windows\System\PLlQMgi.exe
  C:\Windows\System\PLlQMgi.exe
  2⤵
  PID:13388
- C:\Windows\System\TayzXtz.exe
  C:\Windows\System\TayzXtz.exe
  2⤵
  PID:13404
- C:\Windows\System\qzIimwt.exe
  C:\Windows\System\qzIimwt.exe
  2⤵
  PID:13420
- C:\Windows\System\ptyJJqp.exe
  C:\Windows\System\ptyJJqp.exe
  2⤵
  PID:13436
- C:\Windows\System\SWPsgsQ.exe
  C:\Windows\System\SWPsgsQ.exe
  2⤵
  PID:13452
- C:\Windows\System\CCmIbqa.exe
  C:\Windows\System\CCmIbqa.exe
  2⤵
  PID:13468
- C:\Windows\System\GMYoWDl.exe
  C:\Windows\System\GMYoWDl.exe
  2⤵
  PID:13484
- C:\Windows\System\zGDDxuo.exe
  C:\Windows\System\zGDDxuo.exe
  2⤵
  PID:13500
- C:\Windows\System\KyhkkQX.exe
  C:\Windows\System\KyhkkQX.exe
  2⤵
  PID:13516
- C:\Windows\System\kyfdAoG.exe
  C:\Windows\System\kyfdAoG.exe
  2⤵
  PID:13532
- C:\Windows\System\HFrOIFA.exe
  C:\Windows\System\HFrOIFA.exe
  2⤵
  PID:13552
- C:\Windows\System\fweIgDY.exe
  C:\Windows\System\fweIgDY.exe
  2⤵
  PID:13568
- C:\Windows\System\OIVqrJV.exe
  C:\Windows\System\OIVqrJV.exe
  2⤵
  PID:13584
- C:\Windows\System\TNYiSmN.exe
  C:\Windows\System\TNYiSmN.exe
  2⤵
  PID:13608
- C:\Windows\System\cPihcLJ.exe
  C:\Windows\System\cPihcLJ.exe
  2⤵
  PID:13632
- C:\Windows\System\yNhyMNZ.exe
  C:\Windows\System\yNhyMNZ.exe
  2⤵
  PID:13656
- C:\Windows\System\CByIAEt.exe
  C:\Windows\System\CByIAEt.exe
  2⤵
  PID:13676
- C:\Windows\System\zZlzUKo.exe
  C:\Windows\System\zZlzUKo.exe
  2⤵
  PID:13696
- C:\Windows\System\AGtJWax.exe
  C:\Windows\System\AGtJWax.exe
  2⤵
  PID:13720
- C:\Windows\System\MHaxadK.exe
  C:\Windows\System\MHaxadK.exe
  2⤵
  PID:13984
- C:\Windows\System\QoflfWr.exe
  C:\Windows\System\QoflfWr.exe
  2⤵
  PID:14004
- C:\Windows\System\mLnzAmg.exe
  C:\Windows\System\mLnzAmg.exe
  2⤵
  PID:14024
- C:\Windows\System\VogWwfR.exe
  C:\Windows\System\VogWwfR.exe
  2⤵
  PID:14040
- C:\Windows\System\cIGxUmr.exe
  C:\Windows\System\cIGxUmr.exe
  2⤵
  PID:14064
- C:\Windows\System\EEeOqKj.exe
  C:\Windows\System\EEeOqKj.exe
  2⤵
  PID:14104
- C:\Windows\System\CIHXfUu.exe
  C:\Windows\System\CIHXfUu.exe
  2⤵
  PID:14128
- C:\Windows\System\UhRIJoG.exe
  C:\Windows\System\UhRIJoG.exe
  2⤵
  PID:14156
- C:\Windows\System\deQexHO.exe
  C:\Windows\System\deQexHO.exe
  2⤵
  PID:14288
- C:\Windows\System\FZOfcYI.exe
  C:\Windows\System\FZOfcYI.exe
  2⤵
  PID:14312
- C:\Windows\System\FxghkEM.exe
  C:\Windows\System\FxghkEM.exe
  2⤵
  PID:13192
- C:\Windows\System\wFipKWP.exe
  C:\Windows\System\wFipKWP.exe
  2⤵
  PID:12644
- C:\Windows\System\mNaBsGd.exe
  C:\Windows\System\mNaBsGd.exe
  2⤵
  PID:13072
- C:\Windows\System\FDtjREL.exe
  C:\Windows\System\FDtjREL.exe
  2⤵
  PID:13212
- C:\Windows\System\GNTHTTV.exe
  C:\Windows\System\GNTHTTV.exe
  2⤵
  PID:13512
- C:\Windows\System\bZmEZUX.exe
  C:\Windows\System\bZmEZUX.exe
  2⤵
  PID:12456
- C:\Windows\System\pQZnxcD.exe
  C:\Windows\System\pQZnxcD.exe
  2⤵
  PID:12724
- C:\Windows\System\ugfDMxh.exe
  C:\Windows\System\ugfDMxh.exe
  2⤵
  PID:13132
- C:\Windows\System\kOTDztv.exe
  C:\Windows\System\kOTDztv.exe
  2⤵
  PID:13088
- C:\Windows\System\qsMWkpz.exe
  C:\Windows\System\qsMWkpz.exe
  2⤵
  PID:13476
- C:\Windows\System\XpYKEkb.exe
  C:\Windows\System\XpYKEkb.exe
  2⤵
  PID:13580
- C:\Windows\System\sRPqGhJ.exe
  C:\Windows\System\sRPqGhJ.exe
  2⤵
  PID:14036
- C:\Windows\System\ROxkNBh.exe
  C:\Windows\System\ROxkNBh.exe
  2⤵
  PID:13816
- C:\Windows\System\QjuKejZ.exe
  C:\Windows\System\QjuKejZ.exe
  2⤵
  PID:14124
- C:\Windows\System\WoQicwY.exe
  C:\Windows\System\WoQicwY.exe
  2⤵
  PID:13876
- C:\Windows\System\qQfvBJi.exe
  C:\Windows\System\qQfvBJi.exe
  2⤵
  PID:12492
- C:\Windows\System\XDdMJeg.exe
  C:\Windows\System\XDdMJeg.exe
  2⤵
  PID:13412
- C:\Windows\System\HruvbUX.exe
  C:\Windows\System\HruvbUX.exe
  2⤵
  PID:13448
- C:\Windows\System\KXowGge.exe
  C:\Windows\System\KXowGge.exe
  2⤵
  PID:14204
- C:\Windows\System\FTWwtYo.exe
  C:\Windows\System\FTWwtYo.exe
  2⤵
  PID:13600
- C:\Windows\System\LcgfMGk.exe
  C:\Windows\System\LcgfMGk.exe
  2⤵
  PID:13692
- C:\Windows\System\LSaECfP.exe
  C:\Windows\System\LSaECfP.exe
  2⤵
  PID:13968
- C:\Windows\System\HaaGAMv.exe
  C:\Windows\System\HaaGAMv.exe
  2⤵
  PID:13796
- C:\Windows\System\KtLwIkY.exe
  C:\Windows\System\KtLwIkY.exe
  2⤵
  PID:14168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5456 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CVcFPAF.exe

Filesize
1.4MB

MD5
7ab82efeede53a38a9eec393bed98c1a

SHA1
7eb4989a8e55f08576e1cbbf3a2b96d9d00088aa

SHA256
0869f4bf71e21f92747574dc47c39e4dafd6b106157a77159ab801a021fbeb12

SHA512
b4d65391ae77ee94c4ab4b923bb575e8383237293a53222452afaa3b0394eb42ab7bc867bb2d90b1d0234318e679c97c3fd2ddd4892a5ed5048204211d786685

Download Submit
C:\Windows\System\EOXOekr.exe

Filesize
1.4MB

MD5
51f5c838f881be56ca1169a0f737bab9

SHA1
4568d67fce37541f6049672185b9f93f888abb1b

SHA256
73328034ba971c3f4c0ac910b231efd11c49e7f9bee6ac855c8632f1f87b0b93

SHA512
9328b6b9b0b3deb0d760b695283c8f7fda0e86906009802105cf0d4e644c31f89e406b8d2e60f3a8787760f1629e1db84642fbc7383bde94cf63edcc15640d93

Download Submit
C:\Windows\System\FfNRQwE.exe

Filesize
1.4MB

MD5
2a53f9c2e0c5257364c88fdac2a7b5e7

SHA1
c7f1c8f1a8e5ce3fd0dea319ff3af69251732184

SHA256
791d4052cc1564041a7ce5519684a18e8f32ec1c19c9979c9d26c99a92cd5e03

SHA512
370700f051f2d7324486b9b6bb2ef046e12a35f95178aa7ca67313c946cd8360d5b140750048996ca27abdf55632e461047465b3b6443a7d76d7f80d987635b6

Download Submit
C:\Windows\System\FkLIVsy.exe

Filesize
1.4MB

MD5
b4f22b861bc256b77a1cc433a6e09072

SHA1
b049130c15b594ef695485b2a03488b3a070f584

SHA256
382e03367fe3253a21f7c7beb264e2556ec353d92589acc6765e3b90e6435782

SHA512
94f79b66c859eac7477eea1408d960d99a13af07a8134da6f6cc28ffac81e972b32633ae76fa481b307df1a3d5566cd3d2640360fa20036bec5a03f5ae1f89e9

Download Submit
C:\Windows\System\JxwdUaa.exe

Filesize
1.4MB

MD5
be9d6e76ba945da8cde6a943f8d4e284

SHA1
c50a828646aabf9058b5f70772f1d4e5118cecef

SHA256
e2c0fbfc44b71ab762c6fb78775ec31b7220e6607e13f77687f7a9001f338a96

SHA512
c8b2556f3c52a9171ca13b56a2425f3f781bea889ff016f79e9881c1d30b497f04213dfdaebbe794a5d42e177c2b483565a54c4ffb994cd361cdd1f79503f39a

Download Submit
C:\Windows\System\KShFIkv.exe

Filesize
1.4MB

MD5
d2fa7558b7c3208bb9704388d0c35d51

SHA1
98103add6f8b012e44d5359cf229f657385a35d1

SHA256
2076845e57c5f4df527d572343e2ba67600e806b291ad6e8d2098a8d47c5e13f

SHA512
93f383b566fccb88152fbdbd5cff6b21e06d615a74cdbf3b116f0d0114de91b3c6db43f695d9f05711590d59263dc78ae170b57f5126ff0c5ad3afde390a90bb

Download Submit
C:\Windows\System\PIFZkqJ.exe

Filesize
1.4MB

MD5
e4dfb3c6f034a7227ac6454488397eef

SHA1
1a751188a37d688589dcfa2d64469248d043d442

SHA256
f32cbd4dbf2abf40c4d50cb87312ab7949f50b9297e9d68570aad636e77fb71b

SHA512
551a9c9d7393a74a312105ce2befc969c14866f17a379d9e1cc47a9bb58c690dd010304d7fd183400a2305fc0592231d74a75dfd1f4f268e553e67f146954483

Download Submit
C:\Windows\System\PJtKKCn.exe

Filesize
1.4MB

MD5
c0d3d5555429f30c14ca7d7e2efec248

SHA1
b58466e304ebd2873af856a28eb2b3ea5ea2c7d3

SHA256
ac81496f1bb4687d61d51a4abd773f0a0b3ae5d8111b7865bc584f27c74d928e

SHA512
351580ad9904913a4228aefa0b3911a85b9c5f047bf30fdcba641ba9ecd2d9175642e78864d6f717b2d66f5f8680ac8ac761fba6c1fb6a4d53120efaa9146b6b

Download Submit
C:\Windows\System\QikqpCz.exe

Filesize
1.4MB

MD5
b1259d8878a7d8fcc053355db53ed9c8

SHA1
d1f0d0f2bef52b03250c9522c3fe71c1632799cf

SHA256
af4ac944c6b8780704a11e671afe20b33a32bce2c13afa947181d9785cbb0f75

SHA512
8596cb8ec4249b3112cf46ef36813a91f34d160312742cec2e5389728b8f81cbe3b3681bc9678d128875491657e4f8617edac41e13216be4971e8890c820d3ee

Download Submit
C:\Windows\System\QmMnxcm.exe

Filesize
1.4MB

MD5
843189130fd2e9b647631d405bf72472

SHA1
e222568a39e94af7f1af299134c5d60ee5799d4e

SHA256
14e56ac1e69a93b7be4924959815fcc7b49805822662e7a97fba85e775d01a35

SHA512
19633fc73912a149f73d00596f19be139b1bf5d84b26f09d9a819b9c0ffb35d45bfc551f806e93f7cc0fce54900e0dfed8634b2c1a4e8701083a8c9197139f3c

Download Submit
C:\Windows\System\ShEjVtW.exe

Filesize
1.4MB

MD5
c5d585e58e63845d8d144dcf00f6c2e2

SHA1
b39cf985ade85b88a79a619e9a96dd5e3657c47b

SHA256
fbef33096a6c69fb2a2b728ac73fc92971eec19146d5d1e56679332aedf943cb

SHA512
0b7f3f6d79db5578f41a2551e2013428d70c42aec61cb33e3280884208fd38b8cc4e21cbff172fe3a47a13bf250b347d41e627de6cbc3177f02068233261bada

Download Submit
C:\Windows\System\SmwWlYW.exe

Filesize
1.4MB

MD5
3f3936ea7244292efe7965c4f9533469

SHA1
281e3b6068e33b49e8955f0abced6763ad1f4be3

SHA256
757fb5b891a69d0cc554a8e5e748b35db1a0c3c6b25d2fb555d45e94db787919

SHA512
e1b4e984dc05661b89dc019fcc195abff1f4440521c2a11732d400b57cebf1ebad667eea6f58d80cb08de0f203f696734bfdbd0b9882595a99d3de3ee0f189d2

Download Submit
C:\Windows\System\TlHMfGD.exe

Filesize
1.4MB

MD5
4c05cab6e95afe2c829e4a87bffb8863

SHA1
905d4fd29229963007286b58409a42264023b21f

SHA256
b9210399388f7da6842ed4ef59183a738cb371632a72c555174d64cb599f7462

SHA512
d3f80d58995933c062b3f48725f919dd9747d593c5be3df29a2923e5af41805b0458e295ecc33352208ec55ff824d6778df84b22a2f38e8afaf68c984db21736

Download Submit
C:\Windows\System\VxdtAGu.exe

Filesize
1.4MB

MD5
d1be9223e7db3f781c7d76b4011b6ac9

SHA1
4bcc5e1abf7ce88a8b9c8a271502b92c77b8b638

SHA256
e8c7162389c45a3394e8bb7eef0b667b06e73178bee212fd788de995958a1605

SHA512
6375283a41e4ce973ca138cc74ef937e52e17ef5b098dbdb8b6e2f4530e542dca97055640ed78af9b8394b3e222ebad508d0f06a62cec564156bb9d4d54a1435

Download Submit
C:\Windows\System\YhhEepj.exe

Filesize
1.4MB

MD5
6fbff7e876197bbd47d4f50d10bdadee

SHA1
229f58b3d73498698bf251ae1d0109188a65561c

SHA256
07642c9d5f65ef5bf9a8472f78dc55147f28a1eb192eeb3f6c921a83ad087bbb

SHA512
85708a99183f22077d771ed74b181075dd1faadd04cc01c0193f16278f128d925dc843da5c26fe3f5892944df3f98adc20db156d6de4d704606460b77f74a664

Download Submit
C:\Windows\System\bjwDMgg.exe

Filesize
1.4MB

MD5
d52d576c6ac790b8f28c8fe1df73613a

SHA1
9818e274418da85e8f72aa52411b8d6a778548c2

SHA256
fe01d853fbda88d5ea8a19e82051dcfe9ff61c9bd2405b236d4473d1fc4ed0ff

SHA512
5d1eba72040ea99352166d125054c94558249275497da5cb20d85071a2b032350b409c1ac8a98d9458ca291b274a04b783ea26fd598f8cf34c61f0285674989d

Download Submit
C:\Windows\System\fIbksQi.exe

Filesize
1.4MB

MD5
5fda83863067d320d790c66a99a5a284

SHA1
5d4f66195bf0f9339a8bf0269fa9fd31cf67cd8f

SHA256
694c9d77929d2e5709f93a98405a465698e3bbacac71572b5bf9915aa3e6d58b

SHA512
1d0190f78ec5fb3adb813367c0a244fd31c51e189ce779d9bfbe00bff8f98f4549310c4d80504ff5f24dec2695ea40824ab75e398795a495c475428ec76e2f9a

Download Submit
C:\Windows\System\gNrNwqV.exe

Filesize
1.4MB

MD5
795cd2c16e38de9d15c46527a9f5490c

SHA1
9ffd5738d7d475080ebcb7da1a60495ccba06f4e

SHA256
93bda2cf3d88d6b28993adbfa5234e44bd7ccff2a36b4acec8f65a641d1c074e

SHA512
8fd59ab68dca907bb585935fc9315daf9b46a6ede7efd49acb1027caef1482b5f7957fd12948179e3baed33bb29f66698bef7aa68f92d6b63f65c377ad37841b

Download Submit
C:\Windows\System\irHVcFB.exe

Filesize
1.4MB

MD5
f4e4312aecaa5bf5cd2669de724d658e

SHA1
d4c9d2836bf4237f96b2d010f73353c88cc04e2b

SHA256
2076f5dd9c09c93877ac737f77384defedcd664eb05356265243bcce3ebe9557

SHA512
bcb1fe09e9e02b2e720b2cf8583754c3d413c90b153743336b713c22bcb7a929fdaaff4843467f861be1fcc4eaae91f6d1e57d98f1d73c9ced17b9cda7155b2d

Download Submit
C:\Windows\System\jRqCdTy.exe

Filesize
1.4MB

MD5
70bc56732279c0f70c545bf21909ad54

SHA1
4f2285f7ce44b9523ebfcde88435ef4dbb43d413

SHA256
852fe467f2d2364cd71d60cd7fcb98d09a2efc6f9b7140b1d3b7da5757f8ed74

SHA512
da5bde669a10ee0ab969c4cd552cbe73cf93303621b6da53ce01dfd86640ef872927fff45eb37f9f6016a782e3803786a801e5bfd550898271408732a5c473f0

Download Submit
C:\Windows\System\kvBorlL.exe

Filesize
1.4MB

MD5
a5e1d9a503d2fc64946b8bf17374b1d0

SHA1
6b6006141fa4a1c117d7b18c5702d761e2a42714

SHA256
bea3e7f127d9ce9dbf190a3765cb2b5303d74682bd71f8e28e102a5f0f0b2561

SHA512
48faaa90204fc90f900924e87e05d542f9598ae1f6f4d52bacfdca8b2fd5dffe7346fc0ee5b68d40c7e6acb8073228cd6403a3c2236b5239e15c73fc85ab09a3

Download Submit
C:\Windows\System\nUAyuAI.exe

Filesize
1.4MB

MD5
cfb5cb5dbe2ef88ace2542f2a30acae2

SHA1
36ca045075df269e3ae06a8062283ed679be6394

SHA256
315de5d194f6bca42beb8c11d66f7d2a3938e113264f84c26ccd26d5a4647e81

SHA512
aef8d188ebc26ec7cd24e9de5efbca98ccda04bf6d70b571f678e1ca0c5eee7e702be266c398c48c675a49d191b7613cb2087bc50a0b638d89ff14a76f02d3ff

Download Submit
C:\Windows\System\pNCiMLJ.exe

Filesize
1.4MB

MD5
812754cf5e85d2e5c523cdc7b9656f70

SHA1
e0fcf5bff7af77f1b6b81f697f2cdf4d4f480c92

SHA256
57d1934e0c49c3f85e93ebc5acb958041f8b3896003c0740477096c1fcdd33d4

SHA512
1c56909254e66d77e39f8d0098409be9d869e63bcb799b266641893fb77d98b1c408598ad816083ec927b970471df2c79884e6b209faac258958a6b5a7800959

Download Submit
C:\Windows\System\qMaMgBP.exe

Filesize
1.4MB

MD5
5676c853146a993753cf7eb28c743a24

SHA1
bcc1bf0c4c1d5596e445f69060099ced5eca9b31

SHA256
743db1f7acd4b298e77e0217881d10875e7010be21c0f6b19ac528265ac8c292

SHA512
c351c334040da2b227d60bafc0bff8f8897f3e1b7925c99de2be60ca011bd7e9107eecd4b0af72a78b941a3abef58c5f01118e68f669df10a8ddc8c19b966d9b

Download Submit
C:\Windows\System\qttfZHS.exe

Filesize
1.4MB

MD5
604a5e48a2b1d5803113e2ed968e706b

SHA1
dfe28881afe6b092ba2cb08c8347bd07754f6b15

SHA256
036433fac5fa959f0bb9c62afde4e504a0a95ae7894181ce4dd5b120c91ab8f0

SHA512
9c62fdca5aac1c439bec7d1f009e295acf862769a14a4382d848b8f2d7a94f4e2ea154c7a1df84df02390dbf5d5bae85d881012321121c91d3c7c26d6cad0c21

Download Submit
C:\Windows\System\rHPxBcU.exe

Filesize
1.4MB

MD5
ac4a0d54ff0b02c3ae73b77e21612600

SHA1
11874d2e6bf3508680a1cb946801f7855c6c2d07

SHA256
7f650ff4e479472557ce2655621b7b9cbea62710093c8fbbab82edec8b842155

SHA512
155978e169a2325e1fac04478c530d62c8d1d8ac3887f360103fc591651ec5b2ff642cc5c577d03508ed9fdfe833c9dd3d42f6107dc2ed8888d1d12eb439929d

Download Submit
C:\Windows\System\sVzyyQz.exe

Filesize
1.4MB

MD5
30d8f7c8b4f4a9cef9abc402a6d1e323

SHA1
96e5a68625b7c6a80985cf45fa7efe40d9745458

SHA256
22d44713fcbabf441a15170df408f5936ac0fc43580f10938a64312ce7f533ec

SHA512
0f0080488241be2688e0bfd6155a7dd0edb415f413c09969ce48cb84bd031f43e0db9718d3fe5ea2e7adc33f322a15061147634ca66a26fcc1188744f6be5b93

Download Submit
C:\Windows\System\srhcwhc.exe

Filesize
1.4MB

MD5
9cd5ada9933e8db2f51b9676615fb021

SHA1
fe4c1fe7dcf5dd83fd64aec442c5237254678209

SHA256
ac8462b9094d5ec3a888d9564f669118ffcbe2f1d78e18cfc02ad94d6567d815

SHA512
e83d67cf1cb676bfdf881637cfccbfcaa0312343f5829214f80e1ff4f8eec7fe3db6cb6edc3486212a67bb50bd1aca6b50a30c059577a400afda1620036334a9

Download Submit
C:\Windows\System\tAEctYu.exe

Filesize
1.4MB

MD5
b10e649dc55ed112c6f3eb0a9b04d97b

SHA1
38004e675e6f08904ab12e1ab8af76a059ddb8a8

SHA256
865bbcd9100bfc70bb650e2b871a5802dcee783145b1608022e7939d4234049f

SHA512
35dcd8f73e87006b4b2f4a8d6431387537f8b3f6e5efb987e040aab1865f1e44f85c15f87ebbd12b30e26f48fe09d26f1b9f3e091f264764499101a75153f990

Download Submit
C:\Windows\System\tojzQXO.exe

Filesize
1.4MB

MD5
4350cfdc5b308c0d58b16b467f19bff0

SHA1
432566614e27d5c91d002076080aa1476f816b8f

SHA256
8034c1cdaeb23af5ed82f9a461adfef745849154594d63ada1971249ecca527b

SHA512
bd8572245616d1734e9d6006ea510fc1a5a2eaba5351cf357c01668c2047caf8453f7069a1c133f86318440d4a3aee61b86a91ad870815de64008bfed466e2fe

Download Submit
C:\Windows\System\xqqKlcq.exe

Filesize
1.4MB

MD5
d1dbe71daff98606ce271f873c411658

SHA1
eaa3f795d7175aa01d47454f126eab0798865346

SHA256
d1061f12cf18b98b6a06956a26fc8b7a8990e66eba934bc582a49171e65ee2be

SHA512
2f85ba330d1a4fc9132de36cf5c9be21e7d0ed8f8bdfb3d78902c862edef4ad7457aeb87e93fc600cc11ac51691f1a18984fb0f14a4739652f1e456ac7fc1164

Download Submit
C:\Windows\System\zFkCIeF.exe

Filesize
1.4MB

MD5
ebdf7207c82a920a1454e5bf59f075cd

SHA1
e450518a5644a55efa7a7490035a446be446f586

SHA256
bfd139d3848b391162c7fb46fe69a7c6a788377eac4a2e3bc71d95c3781f0e0c

SHA512
e0fc865bb2bc3eb573abd80ec451a8e458e8877f64e6ad0b45b164c2d9295ee509eff22ba8962c08c070ad996dbc04f17f95e7b36a5d6ad42663e978e7873f06

Download Submit
memory/236-242-0x00007FF7D1550000-0x00007FF7D18A1000-memory.dmp

Filesize
3.3MB

Download
memory/236-2232-0x00007FF7D1550000-0x00007FF7D18A1000-memory.dmp

Filesize
3.3MB

Download
memory/648-2175-0x00007FF74BE50000-0x00007FF74C1A1000-memory.dmp

Filesize
3.3MB

Download
memory/648-33-0x00007FF74BE50000-0x00007FF74C1A1000-memory.dmp

Filesize
3.3MB

Download
memory/744-267-0x00007FF6698B0000-0x00007FF669C01000-memory.dmp

Filesize
3.3MB

Download
memory/744-13-0x00007FF6698B0000-0x00007FF669C01000-memory.dmp

Filesize
3.3MB

Download
memory/744-2173-0x00007FF6698B0000-0x00007FF669C01000-memory.dmp

Filesize
3.3MB

Download
memory/780-2221-0x00007FF6409E0000-0x00007FF640D31000-memory.dmp

Filesize
3.3MB

Download
memory/780-236-0x00007FF6409E0000-0x00007FF640D31000-memory.dmp

Filesize
3.3MB

Download
memory/868-280-0x00007FF612E20000-0x00007FF613171000-memory.dmp

Filesize
3.3MB

Download
memory/868-2245-0x00007FF612E20000-0x00007FF613171000-memory.dmp

Filesize
3.3MB

Download
memory/880-50-0x00007FF6B36E0000-0x00007FF6B3A31000-memory.dmp

Filesize
3.3MB

Download
memory/880-2205-0x00007FF6B36E0000-0x00007FF6B3A31000-memory.dmp

Filesize
3.3MB

Download
memory/928-224-0x00007FF6C6290000-0x00007FF6C65E1000-memory.dmp

Filesize
3.3MB

Download
memory/928-2218-0x00007FF6C6290000-0x00007FF6C65E1000-memory.dmp

Filesize
3.3MB

Download
memory/1548-2209-0x00007FF776D20000-0x00007FF777071000-memory.dmp

Filesize
3.3MB

Download
memory/1548-64-0x00007FF776D20000-0x00007FF777071000-memory.dmp

Filesize
3.3MB

Download
memory/1696-226-0x00007FF624A80000-0x00007FF624DD1000-memory.dmp

Filesize
3.3MB

Download
memory/1696-2217-0x00007FF624A80000-0x00007FF624DD1000-memory.dmp

Filesize
3.3MB

Download
memory/1792-2213-0x00007FF77D100000-0x00007FF77D451000-memory.dmp

Filesize
3.3MB

Download
memory/1792-74-0x00007FF77D100000-0x00007FF77D451000-memory.dmp

Filesize
3.3MB

Download
memory/2172-245-0x00007FF7E9110000-0x00007FF7E9461000-memory.dmp

Filesize
3.3MB

Download
memory/2172-2230-0x00007FF7E9110000-0x00007FF7E9461000-memory.dmp

Filesize
3.3MB

Download
memory/2728-21-0x00007FF65F120000-0x00007FF65F471000-memory.dmp

Filesize
3.3MB

Download
memory/2728-269-0x00007FF65F120000-0x00007FF65F471000-memory.dmp

Filesize
3.3MB

Download
memory/2728-2177-0x00007FF65F120000-0x00007FF65F471000-memory.dmp

Filesize
3.3MB

Download
memory/2836-2170-0x00007FF65E430000-0x00007FF65E781000-memory.dmp

Filesize
3.3MB

Download
memory/2836-221-0x00007FF65E430000-0x00007FF65E781000-memory.dmp

Filesize
3.3MB

Download
memory/2836-8-0x00007FF65E430000-0x00007FF65E781000-memory.dmp

Filesize
3.3MB

Download
memory/2880-2224-0x00007FF69AA40000-0x00007FF69AD91000-memory.dmp

Filesize
3.3MB

Download
memory/2880-229-0x00007FF69AA40000-0x00007FF69AD91000-memory.dmp

Filesize
3.3MB

Download
memory/3280-2236-0x00007FF77BCD0000-0x00007FF77C021000-memory.dmp

Filesize
3.3MB

Download
memory/3280-250-0x00007FF77BCD0000-0x00007FF77C021000-memory.dmp

Filesize
3.3MB

Download
memory/3292-2214-0x00007FF654230000-0x00007FF654581000-memory.dmp

Filesize
3.3MB

Download
memory/3292-222-0x00007FF654230000-0x00007FF654581000-memory.dmp

Filesize
3.3MB

Download
memory/3308-230-0x00007FF636C40000-0x00007FF636F91000-memory.dmp

Filesize
3.3MB

Download
memory/3308-2223-0x00007FF636C40000-0x00007FF636F91000-memory.dmp

Filesize
3.3MB

Download
memory/3608-2226-0x00007FF61D0C0000-0x00007FF61D411000-memory.dmp

Filesize
3.3MB

Download
memory/3608-240-0x00007FF61D0C0000-0x00007FF61D411000-memory.dmp

Filesize
3.3MB

Download
memory/3672-2253-0x00007FF6670F0000-0x00007FF667441000-memory.dmp

Filesize
3.3MB

Download
memory/3672-290-0x00007FF6670F0000-0x00007FF667441000-memory.dmp

Filesize
3.3MB

Download
memory/3684-67-0x00007FF662AE0000-0x00007FF662E31000-memory.dmp

Filesize
3.3MB

Download
memory/3684-2265-0x00007FF662AE0000-0x00007FF662E31000-memory.dmp

Filesize
3.3MB

Download
memory/3856-284-0x00007FF681AD0000-0x00007FF681E21000-memory.dmp

Filesize
3.3MB

Download
memory/3856-2241-0x00007FF681AD0000-0x00007FF681E21000-memory.dmp

Filesize
3.3MB

Download
memory/3872-2207-0x00007FF6D6F60000-0x00007FF6D72B1000-memory.dmp

Filesize
3.3MB

Download
memory/3872-56-0x00007FF6D6F60000-0x00007FF6D72B1000-memory.dmp

Filesize
3.3MB

Download
memory/4016-254-0x00007FF644360000-0x00007FF6446B1000-memory.dmp

Filesize
3.3MB

Download
memory/4016-2238-0x00007FF644360000-0x00007FF6446B1000-memory.dmp

Filesize
3.3MB

Download
memory/4060-73-0x00007FF706640000-0x00007FF706991000-memory.dmp

Filesize
3.3MB

Download
memory/4060-1-0x000001A25A4F0000-0x000001A25A500000-memory.dmp

Filesize
64KB

Download
memory/4060-0-0x00007FF706640000-0x00007FF706991000-memory.dmp

Filesize
3.3MB

Download
memory/4168-34-0x00007FF6A7B00000-0x00007FF6A7E51000-memory.dmp

Filesize
3.3MB

Download
memory/4168-2179-0x00007FF6A7B00000-0x00007FF6A7E51000-memory.dmp

Filesize
3.3MB

Download
memory/4464-43-0x00007FF6A22C0000-0x00007FF6A2611000-memory.dmp

Filesize
3.3MB

Download
memory/4464-2202-0x00007FF6A22C0000-0x00007FF6A2611000-memory.dmp

Filesize
3.3MB

Download
memory/4552-2203-0x00007FF6ECD90000-0x00007FF6ED0E1000-memory.dmp

Filesize
3.3MB

Download
memory/4552-47-0x00007FF6ECD90000-0x00007FF6ED0E1000-memory.dmp

Filesize
3.3MB

Download
memory/4580-2235-0x00007FF76B5C0000-0x00007FF76B911000-memory.dmp

Filesize
3.3MB

Download
memory/4580-249-0x00007FF76B5C0000-0x00007FF76B911000-memory.dmp

Filesize
3.3MB

Download
memory/4764-2228-0x00007FF66FB30000-0x00007FF66FE81000-memory.dmp

Filesize
3.3MB

Download
memory/4764-241-0x00007FF66FB30000-0x00007FF66FE81000-memory.dmp

Filesize
3.3MB

Download
memory/4864-2244-0x00007FF694BC0000-0x00007FF694F11000-memory.dmp

Filesize
3.3MB

Download
memory/4864-265-0x00007FF694BC0000-0x00007FF694F11000-memory.dmp

Filesize
3.3MB

Download