xmrig | 50ba3e44d1afd879e9cbfdc00383e93c255ad0f6ab24d56787a5c7f9b2007bf7

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
Size

1.9MB
MD5

8b8c8dce7d6bce8b351a670fa96aac80
SHA1

2d6a404caa74f85ae4ef9f884fb136cf817d1b84
SHA256

50ba3e44d1afd879e9cbfdc00383e93c255ad0f6ab24d56787a5c7f9b2007bf7
SHA512

94e044de545960d8928887ec30f4507a1f6c2dee31d0260d8c6ef1e4586f6034378795e0ddd8490ca748c55053859cd77052eed952f14fb39569850afb54e546
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxxdcvou25dwmTL:BemTLkNdfE0pZrQf

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4504-0-0x00007FF7832C0000-0x00007FF783614000-memory.dmp	xmrig
behavioral2/files/0x0009000000023285-4.dat	xmrig
behavioral2/memory/4428-8-0x00007FF7126F0000-0x00007FF712A44000-memory.dmp	xmrig
behavioral2/files/0x0008000000023288-10.dat	xmrig
behavioral2/files/0x000800000002328a-11.dat	xmrig
behavioral2/memory/2876-16-0x00007FF620F40000-0x00007FF621294000-memory.dmp	xmrig
behavioral2/memory/1284-20-0x00007FF7A51D0000-0x00007FF7A5524000-memory.dmp	xmrig
behavioral2/files/0x000800000002328c-23.dat	xmrig
behavioral2/memory/1636-26-0x00007FF77D9B0000-0x00007FF77DD04000-memory.dmp	xmrig
behavioral2/files/0x000800000002328d-29.dat	xmrig
behavioral2/files/0x000700000002328f-38.dat	xmrig
behavioral2/files/0x0007000000023290-45.dat	xmrig
behavioral2/files/0x0007000000023291-50.dat	xmrig
behavioral2/files/0x0007000000023292-55.dat	xmrig
behavioral2/files/0x0007000000023294-64.dat	xmrig
behavioral2/files/0x0007000000023296-75.dat	xmrig
behavioral2/files/0x0007000000023298-84.dat	xmrig
behavioral2/files/0x0007000000023299-90.dat	xmrig
behavioral2/files/0x000700000002329a-95.dat	xmrig
behavioral2/files/0x000700000002329e-115.dat	xmrig
behavioral2/files/0x000700000002329f-120.dat	xmrig
behavioral2/files/0x00070000000232a0-125.dat	xmrig
behavioral2/files/0x00070000000232a1-130.dat	xmrig
behavioral2/files/0x00070000000232a3-139.dat	xmrig
behavioral2/files/0x00070000000232a6-158.dat	xmrig
behavioral2/files/0x00070000000232a9-167.dat	xmrig
behavioral2/files/0x00070000000232a7-163.dat	xmrig
behavioral2/memory/1324-281-0x00007FF7F8DD0000-0x00007FF7F9124000-memory.dmp	xmrig
behavioral2/files/0x00070000000232a8-162.dat	xmrig
behavioral2/files/0x00070000000232a5-153.dat	xmrig
behavioral2/files/0x00070000000232a4-150.dat	xmrig
behavioral2/memory/2780-287-0x00007FF6B4AB0000-0x00007FF6B4E04000-memory.dmp	xmrig
behavioral2/memory/2796-283-0x00007FF663F10000-0x00007FF664264000-memory.dmp	xmrig
behavioral2/memory/3524-289-0x00007FF686FA0000-0x00007FF6872F4000-memory.dmp	xmrig
behavioral2/memory/4612-291-0x00007FF7924D0000-0x00007FF792824000-memory.dmp	xmrig
behavioral2/memory/1672-294-0x00007FF638F40000-0x00007FF639294000-memory.dmp	xmrig
behavioral2/memory/1812-295-0x00007FF68F610000-0x00007FF68F964000-memory.dmp	xmrig
behavioral2/memory/2556-297-0x00007FF774DD0000-0x00007FF775124000-memory.dmp	xmrig
behavioral2/memory/4952-296-0x00007FF66C690000-0x00007FF66C9E4000-memory.dmp	xmrig
behavioral2/memory/5040-292-0x00007FF74E300000-0x00007FF74E654000-memory.dmp	xmrig
behavioral2/memory/4628-290-0x00007FF7D53D0000-0x00007FF7D5724000-memory.dmp	xmrig
behavioral2/files/0x00070000000232a2-135.dat	xmrig
behavioral2/memory/4912-298-0x00007FF62F2F0000-0x00007FF62F644000-memory.dmp	xmrig
behavioral2/memory/3940-301-0x00007FF7684E0000-0x00007FF768834000-memory.dmp	xmrig
behavioral2/memory/3336-302-0x00007FF7633F0000-0x00007FF763744000-memory.dmp	xmrig
behavioral2/memory/4152-306-0x00007FF787A20000-0x00007FF787D74000-memory.dmp	xmrig
behavioral2/files/0x000700000002329d-110.dat	xmrig
behavioral2/files/0x000700000002329c-105.dat	xmrig
behavioral2/files/0x000700000002329b-100.dat	xmrig
behavioral2/files/0x0007000000023297-80.dat	xmrig
behavioral2/memory/2148-311-0x00007FF74C1E0000-0x00007FF74C534000-memory.dmp	xmrig
behavioral2/memory/1560-310-0x00007FF61CD40000-0x00007FF61D094000-memory.dmp	xmrig
behavioral2/memory/3948-312-0x00007FF7FC550000-0x00007FF7FC8A4000-memory.dmp	xmrig
behavioral2/memory/1000-316-0x00007FF60B4D0000-0x00007FF60B824000-memory.dmp	xmrig
behavioral2/memory/3372-315-0x00007FF7C81E0000-0x00007FF7C8534000-memory.dmp	xmrig
behavioral2/memory/2264-314-0x00007FF6F9030000-0x00007FF6F9384000-memory.dmp	xmrig
behavioral2/files/0x0007000000023295-70.dat	xmrig
behavioral2/memory/3656-317-0x00007FF724BD0000-0x00007FF724F24000-memory.dmp	xmrig
behavioral2/memory/4468-318-0x00007FF7071F0000-0x00007FF707544000-memory.dmp	xmrig
behavioral2/memory/3744-319-0x00007FF732750000-0x00007FF732AA4000-memory.dmp	xmrig
behavioral2/memory/3364-320-0x00007FF7282B0000-0x00007FF728604000-memory.dmp	xmrig
behavioral2/files/0x0007000000023293-60.dat	xmrig
behavioral2/files/0x000700000002328e-35.dat	xmrig
behavioral2/memory/4428-2029-0x00007FF7126F0000-0x00007FF712A44000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4428	JDsFChv.exe
2876	DeuUGYM.exe
1284	yJBUUAj.exe
1636	tSlKIgB.exe
3364	XqKUiux.exe
1324	OMojCBc.exe
2796	xWVHjJu.exe
2780	WOOqmze.exe
3524	ITtiysw.exe
4628	tVFZmBg.exe
4612	YFtCZvI.exe
5040	ILMkldi.exe
1672	YEFokDH.exe
1812	vlOGlGQ.exe
4952	ChtdOir.exe
2556	dnmqTbW.exe
4912	LcANKNP.exe
3940	TLEEGQo.exe
3336	couvsQE.exe
4152	SYTXXhs.exe
1560	YYIWNWo.exe
2148	BgIYZtE.exe
3948	jakJvpy.exe
2264	SQoeMRj.exe
3372	reFdPjH.exe
1000	chWSayU.exe
3656	HDBTpfu.exe
4468	vYcsRRA.exe
3744	SYiXwlz.exe
3144	FXShQJj.exe
4108	txPyUDC.exe
3088	xlzUmlv.exe
4608	GDhnCDo.exe
3748	JXgAJNV.exe
4664	NJfBxsv.exe
4620	bGBFuHI.exe
3640	vhtQjld.exe
4652	BwLfRLs.exe
3060	SAdALVO.exe
4460	EkstaMw.exe
728	WUnDwad.exe
2004	eeSBcve.exe
2608	HCeCYWg.exe
4556	sxgCLdg.exe
1368	KKNIyZI.exe
2156	SMnKqFt.exe
3044	enBTrYl.exe
3400	TwQRLQI.exe
4440	ndjOiOO.exe
3836	LfUofiG.exe
4324	ysgQSOR.exe
1944	sBtbkjf.exe
5024	tMBPuba.exe
1492	GFNDOyA.exe
2356	LEvANTu.exe
4564	mJlUlIg.exe
4516	iYgCtcV.exe
2840	sOBPnOJ.exe
2272	lfbDDnN.exe
1076	vfESjMQ.exe
1712	yFtSioJ.exe
3064	CBcHPrX.exe
3872	cTtfLMD.exe
4316	BaMcaBZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4504-0-0x00007FF7832C0000-0x00007FF783614000-memory.dmp	upx
behavioral2/files/0x0009000000023285-4.dat	upx
behavioral2/memory/4428-8-0x00007FF7126F0000-0x00007FF712A44000-memory.dmp	upx
behavioral2/files/0x0008000000023288-10.dat	upx
behavioral2/files/0x000800000002328a-11.dat	upx
behavioral2/memory/2876-16-0x00007FF620F40000-0x00007FF621294000-memory.dmp	upx
behavioral2/memory/1284-20-0x00007FF7A51D0000-0x00007FF7A5524000-memory.dmp	upx
behavioral2/files/0x000800000002328c-23.dat	upx
behavioral2/memory/1636-26-0x00007FF77D9B0000-0x00007FF77DD04000-memory.dmp	upx
behavioral2/files/0x000800000002328d-29.dat	upx
behavioral2/files/0x000700000002328f-38.dat	upx
behavioral2/files/0x0007000000023290-45.dat	upx
behavioral2/files/0x0007000000023291-50.dat	upx
behavioral2/files/0x0007000000023292-55.dat	upx
behavioral2/files/0x0007000000023294-64.dat	upx
behavioral2/files/0x0007000000023296-75.dat	upx
behavioral2/files/0x0007000000023298-84.dat	upx
behavioral2/files/0x0007000000023299-90.dat	upx
behavioral2/files/0x000700000002329a-95.dat	upx
behavioral2/files/0x000700000002329e-115.dat	upx
behavioral2/files/0x000700000002329f-120.dat	upx
behavioral2/files/0x00070000000232a0-125.dat	upx
behavioral2/files/0x00070000000232a1-130.dat	upx
behavioral2/files/0x00070000000232a3-139.dat	upx
behavioral2/files/0x00070000000232a6-158.dat	upx
behavioral2/files/0x00070000000232a9-167.dat	upx
behavioral2/files/0x00070000000232a7-163.dat	upx
behavioral2/memory/1324-281-0x00007FF7F8DD0000-0x00007FF7F9124000-memory.dmp	upx
behavioral2/files/0x00070000000232a8-162.dat	upx
behavioral2/files/0x00070000000232a5-153.dat	upx
behavioral2/files/0x00070000000232a4-150.dat	upx
behavioral2/memory/2780-287-0x00007FF6B4AB0000-0x00007FF6B4E04000-memory.dmp	upx
behavioral2/memory/2796-283-0x00007FF663F10000-0x00007FF664264000-memory.dmp	upx
behavioral2/memory/3524-289-0x00007FF686FA0000-0x00007FF6872F4000-memory.dmp	upx
behavioral2/memory/4612-291-0x00007FF7924D0000-0x00007FF792824000-memory.dmp	upx
behavioral2/memory/1672-294-0x00007FF638F40000-0x00007FF639294000-memory.dmp	upx
behavioral2/memory/1812-295-0x00007FF68F610000-0x00007FF68F964000-memory.dmp	upx
behavioral2/memory/2556-297-0x00007FF774DD0000-0x00007FF775124000-memory.dmp	upx
behavioral2/memory/4952-296-0x00007FF66C690000-0x00007FF66C9E4000-memory.dmp	upx
behavioral2/memory/5040-292-0x00007FF74E300000-0x00007FF74E654000-memory.dmp	upx
behavioral2/memory/4628-290-0x00007FF7D53D0000-0x00007FF7D5724000-memory.dmp	upx
behavioral2/files/0x00070000000232a2-135.dat	upx
behavioral2/memory/4912-298-0x00007FF62F2F0000-0x00007FF62F644000-memory.dmp	upx
behavioral2/memory/3940-301-0x00007FF7684E0000-0x00007FF768834000-memory.dmp	upx
behavioral2/memory/3336-302-0x00007FF7633F0000-0x00007FF763744000-memory.dmp	upx
behavioral2/memory/4152-306-0x00007FF787A20000-0x00007FF787D74000-memory.dmp	upx
behavioral2/files/0x000700000002329d-110.dat	upx
behavioral2/files/0x000700000002329c-105.dat	upx
behavioral2/files/0x000700000002329b-100.dat	upx
behavioral2/files/0x0007000000023297-80.dat	upx
behavioral2/memory/2148-311-0x00007FF74C1E0000-0x00007FF74C534000-memory.dmp	upx
behavioral2/memory/1560-310-0x00007FF61CD40000-0x00007FF61D094000-memory.dmp	upx
behavioral2/memory/3948-312-0x00007FF7FC550000-0x00007FF7FC8A4000-memory.dmp	upx
behavioral2/memory/1000-316-0x00007FF60B4D0000-0x00007FF60B824000-memory.dmp	upx
behavioral2/memory/3372-315-0x00007FF7C81E0000-0x00007FF7C8534000-memory.dmp	upx
behavioral2/memory/2264-314-0x00007FF6F9030000-0x00007FF6F9384000-memory.dmp	upx
behavioral2/files/0x0007000000023295-70.dat	upx
behavioral2/memory/3656-317-0x00007FF724BD0000-0x00007FF724F24000-memory.dmp	upx
behavioral2/memory/4468-318-0x00007FF7071F0000-0x00007FF707544000-memory.dmp	upx
behavioral2/memory/3744-319-0x00007FF732750000-0x00007FF732AA4000-memory.dmp	upx
behavioral2/memory/3364-320-0x00007FF7282B0000-0x00007FF728604000-memory.dmp	upx
behavioral2/files/0x0007000000023293-60.dat	upx
behavioral2/files/0x000700000002328e-35.dat	upx
behavioral2/memory/4428-2029-0x00007FF7126F0000-0x00007FF712A44000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cpXHSLY.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\sChBXUu.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\gzydpOS.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\BuwdICp.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\ZoTWScS.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\JXgAJNV.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\vhGeOQe.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\AeRnUKx.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\TaBjYSO.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\BZrEmns.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\kaWuxyI.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\FwJrzRv.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\ChtdOir.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\MaiqrTW.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\MiQDXtP.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\smIyKZG.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\MnURYEu.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\ruUGYzY.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\IneBFqC.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\caafKbi.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\uPAMnQf.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\eEuXGML.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\TMEYNkq.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\oZsQwYa.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\xUJvUNa.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\lgFSabC.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\jhwBcMJ.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\ZfcwzCd.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\HhlKaMj.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\AOxiZnG.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\mnHAFFw.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\LthmzlQ.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\WJAeRyO.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\mCUqUIk.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\AZGZtjx.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\ndjOiOO.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\qZeaQmk.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\cuoHqLE.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\liLzons.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\NCfOGRI.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\VIFbpJZ.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\GZXkSWc.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\SypErwN.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\QdDELUb.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\WoiNMTh.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\GFNDOyA.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\jKMZuvY.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\dziykzk.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\sKeYgJQ.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\TVtXEDL.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\SYiXwlz.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\zCIMNZu.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\IoFNgBx.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\izJICgC.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\IrLFDbK.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\PVYtIiw.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\yqfNXMZ.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\xelxOGo.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\DHHkdhn.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\jXQRHDW.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\SuIgwxP.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\bKpqOwD.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\CuvEqUK.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\mJlUlIg.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4428	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	92
PID 4504 wrote to memory of 4428	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	92
PID 4504 wrote to memory of 2876	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	93
PID 4504 wrote to memory of 2876	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	93
PID 4504 wrote to memory of 1284	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	94
PID 4504 wrote to memory of 1284	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	94
PID 4504 wrote to memory of 1636	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	95
PID 4504 wrote to memory of 1636	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	95
PID 4504 wrote to memory of 3364	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	96
PID 4504 wrote to memory of 3364	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	96
PID 4504 wrote to memory of 1324	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	97
PID 4504 wrote to memory of 1324	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	97
PID 4504 wrote to memory of 2796	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	98
PID 4504 wrote to memory of 2796	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	98
PID 4504 wrote to memory of 2780	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	99
PID 4504 wrote to memory of 2780	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	99
PID 4504 wrote to memory of 3524	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	100
PID 4504 wrote to memory of 3524	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	100
PID 4504 wrote to memory of 4628	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	101
PID 4504 wrote to memory of 4628	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	101
PID 4504 wrote to memory of 4612	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	102
PID 4504 wrote to memory of 4612	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	102
PID 4504 wrote to memory of 5040	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	103
PID 4504 wrote to memory of 5040	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	103
PID 4504 wrote to memory of 1672	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	104
PID 4504 wrote to memory of 1672	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	104
PID 4504 wrote to memory of 1812	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	105
PID 4504 wrote to memory of 1812	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	105
PID 4504 wrote to memory of 4952	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	106
PID 4504 wrote to memory of 4952	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	106
PID 4504 wrote to memory of 2556	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	107
PID 4504 wrote to memory of 2556	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	107
PID 4504 wrote to memory of 4912	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	108
PID 4504 wrote to memory of 4912	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	108
PID 4504 wrote to memory of 3940	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	109
PID 4504 wrote to memory of 3940	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	109
PID 4504 wrote to memory of 3336	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	110
PID 4504 wrote to memory of 3336	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	110
PID 4504 wrote to memory of 4152	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	111
PID 4504 wrote to memory of 4152	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	111
PID 4504 wrote to memory of 1560	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	112
PID 4504 wrote to memory of 1560	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	112
PID 4504 wrote to memory of 2148	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	113
PID 4504 wrote to memory of 2148	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	113
PID 4504 wrote to memory of 3948	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	114
PID 4504 wrote to memory of 3948	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	114
PID 4504 wrote to memory of 2264	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	115
PID 4504 wrote to memory of 2264	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	115
PID 4504 wrote to memory of 3372	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	116
PID 4504 wrote to memory of 3372	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	116
PID 4504 wrote to memory of 1000	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	117
PID 4504 wrote to memory of 1000	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	117
PID 4504 wrote to memory of 3656	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	118
PID 4504 wrote to memory of 3656	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	118
PID 4504 wrote to memory of 4468	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	119
PID 4504 wrote to memory of 4468	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	119
PID 4504 wrote to memory of 3744	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	120
PID 4504 wrote to memory of 3744	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	120
PID 4504 wrote to memory of 3144	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	121
PID 4504 wrote to memory of 3144	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	121
PID 4504 wrote to memory of 4108	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	122
PID 4504 wrote to memory of 4108	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	122
PID 4504 wrote to memory of 3088	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	123
PID 4504 wrote to memory of 3088	4504	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\System\JDsFChv.exe
  C:\Windows\System\JDsFChv.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\DeuUGYM.exe
  C:\Windows\System\DeuUGYM.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\yJBUUAj.exe
  C:\Windows\System\yJBUUAj.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\tSlKIgB.exe
  C:\Windows\System\tSlKIgB.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\XqKUiux.exe
  C:\Windows\System\XqKUiux.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\OMojCBc.exe
  C:\Windows\System\OMojCBc.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\xWVHjJu.exe
  C:\Windows\System\xWVHjJu.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\WOOqmze.exe
  C:\Windows\System\WOOqmze.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\ITtiysw.exe
  C:\Windows\System\ITtiysw.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\tVFZmBg.exe
  C:\Windows\System\tVFZmBg.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\YFtCZvI.exe
  C:\Windows\System\YFtCZvI.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\ILMkldi.exe
  C:\Windows\System\ILMkldi.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\YEFokDH.exe
  C:\Windows\System\YEFokDH.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\vlOGlGQ.exe
  C:\Windows\System\vlOGlGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\ChtdOir.exe
  C:\Windows\System\ChtdOir.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\dnmqTbW.exe
  C:\Windows\System\dnmqTbW.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\LcANKNP.exe
  C:\Windows\System\LcANKNP.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\TLEEGQo.exe
  C:\Windows\System\TLEEGQo.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\couvsQE.exe
  C:\Windows\System\couvsQE.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\SYTXXhs.exe
  C:\Windows\System\SYTXXhs.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\YYIWNWo.exe
  C:\Windows\System\YYIWNWo.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\BgIYZtE.exe
  C:\Windows\System\BgIYZtE.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\jakJvpy.exe
  C:\Windows\System\jakJvpy.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\SQoeMRj.exe
  C:\Windows\System\SQoeMRj.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\reFdPjH.exe
  C:\Windows\System\reFdPjH.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\chWSayU.exe
  C:\Windows\System\chWSayU.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\HDBTpfu.exe
  C:\Windows\System\HDBTpfu.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\vYcsRRA.exe
  C:\Windows\System\vYcsRRA.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\SYiXwlz.exe
  C:\Windows\System\SYiXwlz.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\FXShQJj.exe
  C:\Windows\System\FXShQJj.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\txPyUDC.exe
  C:\Windows\System\txPyUDC.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\xlzUmlv.exe
  C:\Windows\System\xlzUmlv.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\GDhnCDo.exe
  C:\Windows\System\GDhnCDo.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\JXgAJNV.exe
  C:\Windows\System\JXgAJNV.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\NJfBxsv.exe
  C:\Windows\System\NJfBxsv.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\bGBFuHI.exe
  C:\Windows\System\bGBFuHI.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\vhtQjld.exe
  C:\Windows\System\vhtQjld.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\BwLfRLs.exe
  C:\Windows\System\BwLfRLs.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\SAdALVO.exe
  C:\Windows\System\SAdALVO.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\EkstaMw.exe
  C:\Windows\System\EkstaMw.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\WUnDwad.exe
  C:\Windows\System\WUnDwad.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\eeSBcve.exe
  C:\Windows\System\eeSBcve.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\HCeCYWg.exe
  C:\Windows\System\HCeCYWg.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\sxgCLdg.exe
  C:\Windows\System\sxgCLdg.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\KKNIyZI.exe
  C:\Windows\System\KKNIyZI.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\SMnKqFt.exe
  C:\Windows\System\SMnKqFt.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\enBTrYl.exe
  C:\Windows\System\enBTrYl.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\TwQRLQI.exe
  C:\Windows\System\TwQRLQI.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\ndjOiOO.exe
  C:\Windows\System\ndjOiOO.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\LfUofiG.exe
  C:\Windows\System\LfUofiG.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\ysgQSOR.exe
  C:\Windows\System\ysgQSOR.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\sBtbkjf.exe
  C:\Windows\System\sBtbkjf.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\tMBPuba.exe
  C:\Windows\System\tMBPuba.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\GFNDOyA.exe
  C:\Windows\System\GFNDOyA.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\LEvANTu.exe
  C:\Windows\System\LEvANTu.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\mJlUlIg.exe
  C:\Windows\System\mJlUlIg.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\iYgCtcV.exe
  C:\Windows\System\iYgCtcV.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\sOBPnOJ.exe
  C:\Windows\System\sOBPnOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\lfbDDnN.exe
  C:\Windows\System\lfbDDnN.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\vfESjMQ.exe
  C:\Windows\System\vfESjMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\yFtSioJ.exe
  C:\Windows\System\yFtSioJ.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\CBcHPrX.exe
  C:\Windows\System\CBcHPrX.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\cTtfLMD.exe
  C:\Windows\System\cTtfLMD.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\BaMcaBZ.exe
  C:\Windows\System\BaMcaBZ.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\heypJwn.exe
  C:\Windows\System\heypJwn.exe
  2⤵
  PID:5164
- C:\Windows\System\bzryjVz.exe
  C:\Windows\System\bzryjVz.exe
  2⤵
  PID:5192
- C:\Windows\System\VPwGYEt.exe
  C:\Windows\System\VPwGYEt.exe
  2⤵
  PID:5220
- C:\Windows\System\bQEcFYC.exe
  C:\Windows\System\bQEcFYC.exe
  2⤵
  PID:5240
- C:\Windows\System\aTqXdqw.exe
  C:\Windows\System\aTqXdqw.exe
  2⤵
  PID:5264
- C:\Windows\System\RDOqsYA.exe
  C:\Windows\System\RDOqsYA.exe
  2⤵
  PID:5280
- C:\Windows\System\EURnDDE.exe
  C:\Windows\System\EURnDDE.exe
  2⤵
  PID:5308
- C:\Windows\System\IIAqqXh.exe
  C:\Windows\System\IIAqqXh.exe
  2⤵
  PID:5368
- C:\Windows\System\XFrdXAl.exe
  C:\Windows\System\XFrdXAl.exe
  2⤵
  PID:5448
- C:\Windows\System\MHbmtFy.exe
  C:\Windows\System\MHbmtFy.exe
  2⤵
  PID:5488
- C:\Windows\System\RxFFqTA.exe
  C:\Windows\System\RxFFqTA.exe
  2⤵
  PID:5524
- C:\Windows\System\gwPPwXQ.exe
  C:\Windows\System\gwPPwXQ.exe
  2⤵
  PID:5596
- C:\Windows\System\MPoQTif.exe
  C:\Windows\System\MPoQTif.exe
  2⤵
  PID:5612
- C:\Windows\System\oiwUghN.exe
  C:\Windows\System\oiwUghN.exe
  2⤵
  PID:5628
- C:\Windows\System\RlEOKnc.exe
  C:\Windows\System\RlEOKnc.exe
  2⤵
  PID:5680
- C:\Windows\System\DyTNTqx.exe
  C:\Windows\System\DyTNTqx.exe
  2⤵
  PID:5736
- C:\Windows\System\yzDVRcG.exe
  C:\Windows\System\yzDVRcG.exe
  2⤵
  PID:5768
- C:\Windows\System\xUJvUNa.exe
  C:\Windows\System\xUJvUNa.exe
  2⤵
  PID:5800
- C:\Windows\System\asiQauC.exe
  C:\Windows\System\asiQauC.exe
  2⤵
  PID:5828
- C:\Windows\System\RTmkvrf.exe
  C:\Windows\System\RTmkvrf.exe
  2⤵
  PID:5868
- C:\Windows\System\rIeiGJn.exe
  C:\Windows\System\rIeiGJn.exe
  2⤵
  PID:5900
- C:\Windows\System\mnHAFFw.exe
  C:\Windows\System\mnHAFFw.exe
  2⤵
  PID:5924
- C:\Windows\System\OdDnxEZ.exe
  C:\Windows\System\OdDnxEZ.exe
  2⤵
  PID:5948
- C:\Windows\System\CKRroiz.exe
  C:\Windows\System\CKRroiz.exe
  2⤵
  PID:5988
- C:\Windows\System\ywCWCMB.exe
  C:\Windows\System\ywCWCMB.exe
  2⤵
  PID:6008
- C:\Windows\System\doNGSoi.exe
  C:\Windows\System\doNGSoi.exe
  2⤵
  PID:6044
- C:\Windows\System\usFIioC.exe
  C:\Windows\System\usFIioC.exe
  2⤵
  PID:6072
- C:\Windows\System\DWJpGEX.exe
  C:\Windows\System\DWJpGEX.exe
  2⤵
  PID:6096
- C:\Windows\System\THlYyoB.exe
  C:\Windows\System\THlYyoB.exe
  2⤵
  PID:6120
- C:\Windows\System\lQBUdOB.exe
  C:\Windows\System\lQBUdOB.exe
  2⤵
  PID:3856
- C:\Windows\System\ckrguUP.exe
  C:\Windows\System\ckrguUP.exe
  2⤵
  PID:3056
- C:\Windows\System\ESaXYfT.exe
  C:\Windows\System\ESaXYfT.exe
  2⤵
  PID:4184
- C:\Windows\System\aknuVwM.exe
  C:\Windows\System\aknuVwM.exe
  2⤵
  PID:5172
- C:\Windows\System\eOmLYRr.exe
  C:\Windows\System\eOmLYRr.exe
  2⤵
  PID:2188
- C:\Windows\System\cpXHSLY.exe
  C:\Windows\System\cpXHSLY.exe
  2⤵
  PID:5256
- C:\Windows\System\QQQbLQq.exe
  C:\Windows\System\QQQbLQq.exe
  2⤵
  PID:4972
- C:\Windows\System\AnQysJL.exe
  C:\Windows\System\AnQysJL.exe
  2⤵
  PID:5292
- C:\Windows\System\eZiWPJu.exe
  C:\Windows\System\eZiWPJu.exe
  2⤵
  PID:4520
- C:\Windows\System\WqAKyvn.exe
  C:\Windows\System\WqAKyvn.exe
  2⤵
  PID:5380
- C:\Windows\System\PMbGQUN.exe
  C:\Windows\System\PMbGQUN.exe
  2⤵
  PID:3720
- C:\Windows\System\XhULvqZ.exe
  C:\Windows\System\XhULvqZ.exe
  2⤵
  PID:2256
- C:\Windows\System\zcklKIs.exe
  C:\Windows\System\zcklKIs.exe
  2⤵
  PID:3244
- C:\Windows\System\KepzpHR.exe
  C:\Windows\System\KepzpHR.exe
  2⤵
  PID:5460
- C:\Windows\System\WFFTwDR.exe
  C:\Windows\System\WFFTwDR.exe
  2⤵
  PID:5348
- C:\Windows\System\akOwuPa.exe
  C:\Windows\System\akOwuPa.exe
  2⤵
  PID:5672
- C:\Windows\System\csOmwlx.exe
  C:\Windows\System\csOmwlx.exe
  2⤵
  PID:5648
- C:\Windows\System\lPpEwLI.exe
  C:\Windows\System\lPpEwLI.exe
  2⤵
  PID:5440
- C:\Windows\System\YbAaywr.exe
  C:\Windows\System\YbAaywr.exe
  2⤵
  PID:5760
- C:\Windows\System\VmuCvLu.exe
  C:\Windows\System\VmuCvLu.exe
  2⤵
  PID:5720
- C:\Windows\System\BiWohPS.exe
  C:\Windows\System\BiWohPS.exe
  2⤵
  PID:5812
- C:\Windows\System\AOxiZnG.exe
  C:\Windows\System\AOxiZnG.exe
  2⤵
  PID:5876
- C:\Windows\System\dNwgNbX.exe
  C:\Windows\System\dNwgNbX.exe
  2⤵
  PID:5912
- C:\Windows\System\vhGeOQe.exe
  C:\Windows\System\vhGeOQe.exe
  2⤵
  PID:5968
- C:\Windows\System\LpULKNV.exe
  C:\Windows\System\LpULKNV.exe
  2⤵
  PID:6036
- C:\Windows\System\baMDGmn.exe
  C:\Windows\System\baMDGmn.exe
  2⤵
  PID:5552
- C:\Windows\System\CeMiiMn.exe
  C:\Windows\System\CeMiiMn.exe
  2⤵
  PID:6140
- C:\Windows\System\ayfIbKO.exe
  C:\Windows\System\ayfIbKO.exe
  2⤵
  PID:4720
- C:\Windows\System\wVPFXpf.exe
  C:\Windows\System\wVPFXpf.exe
  2⤵
  PID:5228
- C:\Windows\System\rtrbRmJ.exe
  C:\Windows\System\rtrbRmJ.exe
  2⤵
  PID:5276
- C:\Windows\System\RgfAWnR.exe
  C:\Windows\System\RgfAWnR.exe
  2⤵
  PID:4568
- C:\Windows\System\XWJAuXs.exe
  C:\Windows\System\XWJAuXs.exe
  2⤵
  PID:2684
- C:\Windows\System\YtxEDoM.exe
  C:\Windows\System\YtxEDoM.exe
  2⤵
  PID:5424
- C:\Windows\System\GzddBnF.exe
  C:\Windows\System\GzddBnF.exe
  2⤵
  PID:5500
- C:\Windows\System\igCCsBZ.exe
  C:\Windows\System\igCCsBZ.exe
  2⤵
  PID:5412
- C:\Windows\System\AotQBgw.exe
  C:\Windows\System\AotQBgw.exe
  2⤵
  PID:5732
- C:\Windows\System\ksrxoVT.exe
  C:\Windows\System\ksrxoVT.exe
  2⤵
  PID:5820
- C:\Windows\System\RKdlTuc.exe
  C:\Windows\System\RKdlTuc.exe
  2⤵
  PID:5972
- C:\Windows\System\bbUWqQR.exe
  C:\Windows\System\bbUWqQR.exe
  2⤵
  PID:6028
- C:\Windows\System\CuvEqUK.exe
  C:\Windows\System\CuvEqUK.exe
  2⤵
  PID:6092
- C:\Windows\System\aZdtTpC.exe
  C:\Windows\System\aZdtTpC.exe
  2⤵
  PID:5212
- C:\Windows\System\maCTwCw.exe
  C:\Windows\System\maCTwCw.exe
  2⤵
  PID:5296
- C:\Windows\System\MiIHCqw.exe
  C:\Windows\System\MiIHCqw.exe
  2⤵
  PID:5400
- C:\Windows\System\RxWvdhw.exe
  C:\Windows\System\RxWvdhw.exe
  2⤵
  PID:5624
- C:\Windows\System\UNQVzQN.exe
  C:\Windows\System\UNQVzQN.exe
  2⤵
  PID:4300
- C:\Windows\System\nKnVKSN.exe
  C:\Windows\System\nKnVKSN.exe
  2⤵
  PID:5384
- C:\Windows\System\cYnKTiI.exe
  C:\Windows\System\cYnKTiI.exe
  2⤵
  PID:4328
- C:\Windows\System\VXyZwUy.exe
  C:\Windows\System\VXyZwUy.exe
  2⤵
  PID:5248
- C:\Windows\System\jBZJFdI.exe
  C:\Windows\System\jBZJFdI.exe
  2⤵
  PID:6088
- C:\Windows\System\suvHYgE.exe
  C:\Windows\System\suvHYgE.exe
  2⤵
  PID:6168
- C:\Windows\System\bgKNanE.exe
  C:\Windows\System\bgKNanE.exe
  2⤵
  PID:6196
- C:\Windows\System\DVjpWoT.exe
  C:\Windows\System\DVjpWoT.exe
  2⤵
  PID:6216
- C:\Windows\System\wGEYYuA.exe
  C:\Windows\System\wGEYYuA.exe
  2⤵
  PID:6244
- C:\Windows\System\NdFWCjp.exe
  C:\Windows\System\NdFWCjp.exe
  2⤵
  PID:6272
- C:\Windows\System\eExlQtv.exe
  C:\Windows\System\eExlQtv.exe
  2⤵
  PID:6324
- C:\Windows\System\caafKbi.exe
  C:\Windows\System\caafKbi.exe
  2⤵
  PID:6344
- C:\Windows\System\aMGYRZa.exe
  C:\Windows\System\aMGYRZa.exe
  2⤵
  PID:6380
- C:\Windows\System\HXWFhQt.exe
  C:\Windows\System\HXWFhQt.exe
  2⤵
  PID:6408
- C:\Windows\System\LthmzlQ.exe
  C:\Windows\System\LthmzlQ.exe
  2⤵
  PID:6428
- C:\Windows\System\PqDGuiA.exe
  C:\Windows\System\PqDGuiA.exe
  2⤵
  PID:6452
- C:\Windows\System\DHHkdhn.exe
  C:\Windows\System\DHHkdhn.exe
  2⤵
  PID:6480
- C:\Windows\System\umUvDFW.exe
  C:\Windows\System\umUvDFW.exe
  2⤵
  PID:6524
- C:\Windows\System\CCPlUDf.exe
  C:\Windows\System\CCPlUDf.exe
  2⤵
  PID:6552
- C:\Windows\System\mKiaHje.exe
  C:\Windows\System\mKiaHje.exe
  2⤵
  PID:6572
- C:\Windows\System\IYoncbo.exe
  C:\Windows\System\IYoncbo.exe
  2⤵
  PID:6604
- C:\Windows\System\uxrChKt.exe
  C:\Windows\System\uxrChKt.exe
  2⤵
  PID:6624
- C:\Windows\System\TgoIBRT.exe
  C:\Windows\System\TgoIBRT.exe
  2⤵
  PID:6656
- C:\Windows\System\IneBFqC.exe
  C:\Windows\System\IneBFqC.exe
  2⤵
  PID:6680
- C:\Windows\System\vuSwqcx.exe
  C:\Windows\System\vuSwqcx.exe
  2⤵
  PID:6728
- C:\Windows\System\JttjLwc.exe
  C:\Windows\System\JttjLwc.exe
  2⤵
  PID:6756
- C:\Windows\System\EFkxOLa.exe
  C:\Windows\System\EFkxOLa.exe
  2⤵
  PID:6784
- C:\Windows\System\jiZyRNZ.exe
  C:\Windows\System\jiZyRNZ.exe
  2⤵
  PID:6804
- C:\Windows\System\rMMsbQx.exe
  C:\Windows\System\rMMsbQx.exe
  2⤵
  PID:6840
- C:\Windows\System\SXXniei.exe
  C:\Windows\System\SXXniei.exe
  2⤵
  PID:6868
- C:\Windows\System\TVcsBma.exe
  C:\Windows\System\TVcsBma.exe
  2⤵
  PID:6888
- C:\Windows\System\SBpHMHf.exe
  C:\Windows\System\SBpHMHf.exe
  2⤵
  PID:6916
- C:\Windows\System\RagzIFL.exe
  C:\Windows\System\RagzIFL.exe
  2⤵
  PID:6940
- C:\Windows\System\jDWywze.exe
  C:\Windows\System\jDWywze.exe
  2⤵
  PID:6972
- C:\Windows\System\GZXkSWc.exe
  C:\Windows\System\GZXkSWc.exe
  2⤵
  PID:6988
- C:\Windows\System\wdpmZYP.exe
  C:\Windows\System\wdpmZYP.exe
  2⤵
  PID:7016
- C:\Windows\System\JiacDGP.exe
  C:\Windows\System\JiacDGP.exe
  2⤵
  PID:7068
- C:\Windows\System\jKMZuvY.exe
  C:\Windows\System\jKMZuvY.exe
  2⤵
  PID:7096
- C:\Windows\System\CqGhRve.exe
  C:\Windows\System\CqGhRve.exe
  2⤵
  PID:7112
- C:\Windows\System\qZeaQmk.exe
  C:\Windows\System\qZeaQmk.exe
  2⤵
  PID:7128
- C:\Windows\System\MaiqrTW.exe
  C:\Windows\System\MaiqrTW.exe
  2⤵
  PID:5504
- C:\Windows\System\Eddhkja.exe
  C:\Windows\System\Eddhkja.exe
  2⤵
  PID:6212
- C:\Windows\System\uYbEysI.exe
  C:\Windows\System\uYbEysI.exe
  2⤵
  PID:6260
- C:\Windows\System\ejGeiPx.exe
  C:\Windows\System\ejGeiPx.exe
  2⤵
  PID:6268
- C:\Windows\System\awTTnDw.exe
  C:\Windows\System\awTTnDw.exe
  2⤵
  PID:6368
- C:\Windows\System\OExrgzn.exe
  C:\Windows\System\OExrgzn.exe
  2⤵
  PID:6424
- C:\Windows\System\jXQRHDW.exe
  C:\Windows\System\jXQRHDW.exe
  2⤵
  PID:6460
- C:\Windows\System\iHlmhYU.exe
  C:\Windows\System\iHlmhYU.exe
  2⤵
  PID:6516
- C:\Windows\System\pEEGxDU.exe
  C:\Windows\System\pEEGxDU.exe
  2⤵
  PID:6600
- C:\Windows\System\KXJUdEl.exe
  C:\Windows\System\KXJUdEl.exe
  2⤵
  PID:6672
- C:\Windows\System\BcbTanp.exe
  C:\Windows\System\BcbTanp.exe
  2⤵
  PID:6700
- C:\Windows\System\yQIzpUI.exe
  C:\Windows\System\yQIzpUI.exe
  2⤵
  PID:6712
- C:\Windows\System\xVDpcxe.exe
  C:\Windows\System\xVDpcxe.exe
  2⤵
  PID:6792
- C:\Windows\System\HymLFrt.exe
  C:\Windows\System\HymLFrt.exe
  2⤵
  PID:6856
- C:\Windows\System\cmXxhDO.exe
  C:\Windows\System\cmXxhDO.exe
  2⤵
  PID:6932
- C:\Windows\System\eVnGtYL.exe
  C:\Windows\System\eVnGtYL.exe
  2⤵
  PID:7092
- C:\Windows\System\vmAPHXr.exe
  C:\Windows\System\vmAPHXr.exe
  2⤵
  PID:7104
- C:\Windows\System\WJAeRyO.exe
  C:\Windows\System\WJAeRyO.exe
  2⤵
  PID:6360
- C:\Windows\System\zCIMNZu.exe
  C:\Windows\System\zCIMNZu.exe
  2⤵
  PID:6508
- C:\Windows\System\TMPHjMM.exe
  C:\Windows\System\TMPHjMM.exe
  2⤵
  PID:6596
- C:\Windows\System\WyLIvuX.exe
  C:\Windows\System\WyLIvuX.exe
  2⤵
  PID:6780
- C:\Windows\System\fBrTzlS.exe
  C:\Windows\System\fBrTzlS.exe
  2⤵
  PID:6880
- C:\Windows\System\hhKOMLz.exe
  C:\Windows\System\hhKOMLz.exe
  2⤵
  PID:7084
- C:\Windows\System\SJdRIyF.exe
  C:\Windows\System\SJdRIyF.exe
  2⤵
  PID:7064
- C:\Windows\System\NcHCJik.exe
  C:\Windows\System\NcHCJik.exe
  2⤵
  PID:6392
- C:\Windows\System\OTfrxbK.exe
  C:\Windows\System\OTfrxbK.exe
  2⤵
  PID:6448
- C:\Windows\System\GvSUUxu.exe
  C:\Windows\System\GvSUUxu.exe
  2⤵
  PID:6832
- C:\Windows\System\nDuftAG.exe
  C:\Windows\System\nDuftAG.exe
  2⤵
  PID:7172
- C:\Windows\System\lLHVeCp.exe
  C:\Windows\System\lLHVeCp.exe
  2⤵
  PID:7200
- C:\Windows\System\GHmcOHJ.exe
  C:\Windows\System\GHmcOHJ.exe
  2⤵
  PID:7216
- C:\Windows\System\jsXznYL.exe
  C:\Windows\System\jsXznYL.exe
  2⤵
  PID:7240
- C:\Windows\System\ghjlMIy.exe
  C:\Windows\System\ghjlMIy.exe
  2⤵
  PID:7272
- C:\Windows\System\TAFvfxG.exe
  C:\Windows\System\TAFvfxG.exe
  2⤵
  PID:7300
- C:\Windows\System\RimqeiT.exe
  C:\Windows\System\RimqeiT.exe
  2⤵
  PID:7320
- C:\Windows\System\KMUFWIe.exe
  C:\Windows\System\KMUFWIe.exe
  2⤵
  PID:7388
- C:\Windows\System\lgFSabC.exe
  C:\Windows\System\lgFSabC.exe
  2⤵
  PID:7412
- C:\Windows\System\yVaraLa.exe
  C:\Windows\System\yVaraLa.exe
  2⤵
  PID:7444
- C:\Windows\System\ooheZdo.exe
  C:\Windows\System\ooheZdo.exe
  2⤵
  PID:7460
- C:\Windows\System\FYuyich.exe
  C:\Windows\System\FYuyich.exe
  2⤵
  PID:7484
- C:\Windows\System\AZbpQIJ.exe
  C:\Windows\System\AZbpQIJ.exe
  2⤵
  PID:7504
- C:\Windows\System\isOPPEh.exe
  C:\Windows\System\isOPPEh.exe
  2⤵
  PID:7524
- C:\Windows\System\nUpfbDB.exe
  C:\Windows\System\nUpfbDB.exe
  2⤵
  PID:7552
- C:\Windows\System\sChBXUu.exe
  C:\Windows\System\sChBXUu.exe
  2⤵
  PID:7584
- C:\Windows\System\dziykzk.exe
  C:\Windows\System\dziykzk.exe
  2⤵
  PID:7612
- C:\Windows\System\iPAqkVa.exe
  C:\Windows\System\iPAqkVa.exe
  2⤵
  PID:7644
- C:\Windows\System\WZozdcn.exe
  C:\Windows\System\WZozdcn.exe
  2⤵
  PID:7660
- C:\Windows\System\YTACKEw.exe
  C:\Windows\System\YTACKEw.exe
  2⤵
  PID:7692
- C:\Windows\System\ZFpTONT.exe
  C:\Windows\System\ZFpTONT.exe
  2⤵
  PID:7716
- C:\Windows\System\rSFebSP.exe
  C:\Windows\System\rSFebSP.exe
  2⤵
  PID:7744
- C:\Windows\System\XfFVmgt.exe
  C:\Windows\System\XfFVmgt.exe
  2⤵
  PID:7764
- C:\Windows\System\YlIiNGQ.exe
  C:\Windows\System\YlIiNGQ.exe
  2⤵
  PID:7792
- C:\Windows\System\btgPWLE.exe
  C:\Windows\System\btgPWLE.exe
  2⤵
  PID:7816
- C:\Windows\System\PymTnnj.exe
  C:\Windows\System\PymTnnj.exe
  2⤵
  PID:7832
- C:\Windows\System\wCmJLyH.exe
  C:\Windows\System\wCmJLyH.exe
  2⤵
  PID:7860
- C:\Windows\System\BmYXVLT.exe
  C:\Windows\System\BmYXVLT.exe
  2⤵
  PID:7880
- C:\Windows\System\VUWPxxf.exe
  C:\Windows\System\VUWPxxf.exe
  2⤵
  PID:7904
- C:\Windows\System\NaeqVrC.exe
  C:\Windows\System\NaeqVrC.exe
  2⤵
  PID:7928
- C:\Windows\System\gFZHrOi.exe
  C:\Windows\System\gFZHrOi.exe
  2⤵
  PID:7948
- C:\Windows\System\SexMBiF.exe
  C:\Windows\System\SexMBiF.exe
  2⤵
  PID:7976
- C:\Windows\System\WoiNMTh.exe
  C:\Windows\System\WoiNMTh.exe
  2⤵
  PID:8000
- C:\Windows\System\hYNrvTz.exe
  C:\Windows\System\hYNrvTz.exe
  2⤵
  PID:8016
- C:\Windows\System\NsbVNob.exe
  C:\Windows\System\NsbVNob.exe
  2⤵
  PID:8032
- C:\Windows\System\xafSilm.exe
  C:\Windows\System\xafSilm.exe
  2⤵
  PID:8052
- C:\Windows\System\OCudrYs.exe
  C:\Windows\System\OCudrYs.exe
  2⤵
  PID:8072
- C:\Windows\System\VvgWoVG.exe
  C:\Windows\System\VvgWoVG.exe
  2⤵
  PID:8096
- C:\Windows\System\JoPaNqL.exe
  C:\Windows\System\JoPaNqL.exe
  2⤵
  PID:8120
- C:\Windows\System\yuCApRc.exe
  C:\Windows\System\yuCApRc.exe
  2⤵
  PID:8148
- C:\Windows\System\axXsdEM.exe
  C:\Windows\System\axXsdEM.exe
  2⤵
  PID:8172
- C:\Windows\System\lyTSFrh.exe
  C:\Windows\System\lyTSFrh.exe
  2⤵
  PID:8188
- C:\Windows\System\NTWekIg.exe
  C:\Windows\System\NTWekIg.exe
  2⤵
  PID:7184
- C:\Windows\System\yYHrDEZ.exe
  C:\Windows\System\yYHrDEZ.exe
  2⤵
  PID:7212
- C:\Windows\System\wGggRGJ.exe
  C:\Windows\System\wGggRGJ.exe
  2⤵
  PID:7252
- C:\Windows\System\mJyzDni.exe
  C:\Windows\System\mJyzDni.exe
  2⤵
  PID:6876
- C:\Windows\System\GGMbEQI.exe
  C:\Windows\System\GGMbEQI.exe
  2⤵
  PID:7396
- C:\Windows\System\BTXRYMT.exe
  C:\Windows\System\BTXRYMT.exe
  2⤵
  PID:8184
- C:\Windows\System\uPAMnQf.exe
  C:\Windows\System\uPAMnQf.exe
  2⤵
  PID:7972
- C:\Windows\System\sTddXrb.exe
  C:\Windows\System\sTddXrb.exe
  2⤵
  PID:8012
- C:\Windows\System\zLeYRMz.exe
  C:\Windows\System\zLeYRMz.exe
  2⤵
  PID:8144
- C:\Windows\System\EJmGJou.exe
  C:\Windows\System\EJmGJou.exe
  2⤵
  PID:7228
- C:\Windows\System\jsiMfJR.exe
  C:\Windows\System\jsiMfJR.exe
  2⤵
  PID:6472
- C:\Windows\System\qVQxyVP.exe
  C:\Windows\System\qVQxyVP.exe
  2⤵
  PID:7828
- C:\Windows\System\EcBQOJB.exe
  C:\Windows\System\EcBQOJB.exe
  2⤵
  PID:7328
- C:\Windows\System\WXkBxOJ.exe
  C:\Windows\System\WXkBxOJ.exe
  2⤵
  PID:8112
- C:\Windows\System\eEuXGML.exe
  C:\Windows\System\eEuXGML.exe
  2⤵
  PID:7812
- C:\Windows\System\uBFGMny.exe
  C:\Windows\System\uBFGMny.exe
  2⤵
  PID:7956
- C:\Windows\System\rsUyKxW.exe
  C:\Windows\System\rsUyKxW.exe
  2⤵
  PID:8136
- C:\Windows\System\PRWXaEC.exe
  C:\Windows\System\PRWXaEC.exe
  2⤵
  PID:7736
- C:\Windows\System\mCUqUIk.exe
  C:\Windows\System\mCUqUIk.exe
  2⤵
  PID:8208
- C:\Windows\System\fnsEBeG.exe
  C:\Windows\System\fnsEBeG.exe
  2⤵
  PID:8244
- C:\Windows\System\iJlqbvf.exe
  C:\Windows\System\iJlqbvf.exe
  2⤵
  PID:8268
- C:\Windows\System\DoiyeUy.exe
  C:\Windows\System\DoiyeUy.exe
  2⤵
  PID:8288
- C:\Windows\System\GwgnVjG.exe
  C:\Windows\System\GwgnVjG.exe
  2⤵
  PID:8312
- C:\Windows\System\HMdKBgB.exe
  C:\Windows\System\HMdKBgB.exe
  2⤵
  PID:8332
- C:\Windows\System\XyaAaKV.exe
  C:\Windows\System\XyaAaKV.exe
  2⤵
  PID:8348
- C:\Windows\System\dgKDYKW.exe
  C:\Windows\System\dgKDYKW.exe
  2⤵
  PID:8380
- C:\Windows\System\AIqIbuv.exe
  C:\Windows\System\AIqIbuv.exe
  2⤵
  PID:8408
- C:\Windows\System\ojMfGLc.exe
  C:\Windows\System\ojMfGLc.exe
  2⤵
  PID:8432
- C:\Windows\System\rwMMxEm.exe
  C:\Windows\System\rwMMxEm.exe
  2⤵
  PID:8452
- C:\Windows\System\WPDdurn.exe
  C:\Windows\System\WPDdurn.exe
  2⤵
  PID:8476
- C:\Windows\System\AeRnUKx.exe
  C:\Windows\System\AeRnUKx.exe
  2⤵
  PID:8492
- C:\Windows\System\AHlGhYc.exe
  C:\Windows\System\AHlGhYc.exe
  2⤵
  PID:8516
- C:\Windows\System\wTQfruc.exe
  C:\Windows\System\wTQfruc.exe
  2⤵
  PID:8556
- C:\Windows\System\kkKkHgq.exe
  C:\Windows\System\kkKkHgq.exe
  2⤵
  PID:8592
- C:\Windows\System\gYxtqDB.exe
  C:\Windows\System\gYxtqDB.exe
  2⤵
  PID:8612
- C:\Windows\System\uYAMwaz.exe
  C:\Windows\System\uYAMwaz.exe
  2⤵
  PID:8644
- C:\Windows\System\ykcNqxC.exe
  C:\Windows\System\ykcNqxC.exe
  2⤵
  PID:8672
- C:\Windows\System\RUuBnxf.exe
  C:\Windows\System\RUuBnxf.exe
  2⤵
  PID:8688
- C:\Windows\System\ZUsIfvu.exe
  C:\Windows\System\ZUsIfvu.exe
  2⤵
  PID:8712
- C:\Windows\System\TMEYNkq.exe
  C:\Windows\System\TMEYNkq.exe
  2⤵
  PID:8736
- C:\Windows\System\akQUuXu.exe
  C:\Windows\System\akQUuXu.exe
  2⤵
  PID:8768
- C:\Windows\System\TiZOyTQ.exe
  C:\Windows\System\TiZOyTQ.exe
  2⤵
  PID:8784
- C:\Windows\System\WarVEom.exe
  C:\Windows\System\WarVEom.exe
  2⤵
  PID:8800
- C:\Windows\System\nvtmYTt.exe
  C:\Windows\System\nvtmYTt.exe
  2⤵
  PID:8820
- C:\Windows\System\aVMQVve.exe
  C:\Windows\System\aVMQVve.exe
  2⤵
  PID:8848
- C:\Windows\System\OARTeaV.exe
  C:\Windows\System\OARTeaV.exe
  2⤵
  PID:8872
- C:\Windows\System\UxBypXm.exe
  C:\Windows\System\UxBypXm.exe
  2⤵
  PID:8896
- C:\Windows\System\OqxNpnb.exe
  C:\Windows\System\OqxNpnb.exe
  2⤵
  PID:8912
- C:\Windows\System\qkOdtDe.exe
  C:\Windows\System\qkOdtDe.exe
  2⤵
  PID:8932
- C:\Windows\System\TIZdMyE.exe
  C:\Windows\System\TIZdMyE.exe
  2⤵
  PID:8960
- C:\Windows\System\PBzCIXl.exe
  C:\Windows\System\PBzCIXl.exe
  2⤵
  PID:8992
- C:\Windows\System\BtqQRVR.exe
  C:\Windows\System\BtqQRVR.exe
  2⤵
  PID:9016
- C:\Windows\System\rPPddTc.exe
  C:\Windows\System\rPPddTc.exe
  2⤵
  PID:9040
- C:\Windows\System\hrbDCCV.exe
  C:\Windows\System\hrbDCCV.exe
  2⤵
  PID:9064
- C:\Windows\System\OLJaNGL.exe
  C:\Windows\System\OLJaNGL.exe
  2⤵
  PID:9092
- C:\Windows\System\IoFNgBx.exe
  C:\Windows\System\IoFNgBx.exe
  2⤵
  PID:9116
- C:\Windows\System\iUDxCFr.exe
  C:\Windows\System\iUDxCFr.exe
  2⤵
  PID:9148
- C:\Windows\System\KihErZx.exe
  C:\Windows\System\KihErZx.exe
  2⤵
  PID:9172
- C:\Windows\System\izJICgC.exe
  C:\Windows\System\izJICgC.exe
  2⤵
  PID:9196
- C:\Windows\System\eIMTgGi.exe
  C:\Windows\System\eIMTgGi.exe
  2⤵
  PID:7656
- C:\Windows\System\XdzFBXk.exe
  C:\Windows\System\XdzFBXk.exe
  2⤵
  PID:8064
- C:\Windows\System\paVsRXq.exe
  C:\Windows\System\paVsRXq.exe
  2⤵
  PID:8224
- C:\Windows\System\vIHDndQ.exe
  C:\Windows\System\vIHDndQ.exe
  2⤵
  PID:8328
- C:\Windows\System\remBsHQ.exe
  C:\Windows\System\remBsHQ.exe
  2⤵
  PID:8296
- C:\Windows\System\KKHhkFk.exe
  C:\Windows\System\KKHhkFk.exe
  2⤵
  PID:8400
- C:\Windows\System\uSIJeYx.exe
  C:\Windows\System\uSIJeYx.exe
  2⤵
  PID:8340
- C:\Windows\System\CIsliWb.exe
  C:\Windows\System\CIsliWb.exe
  2⤵
  PID:8416
- C:\Windows\System\BKLjwHE.exe
  C:\Windows\System\BKLjwHE.exe
  2⤵
  PID:8508
- C:\Windows\System\XBikXTl.exe
  C:\Windows\System\XBikXTl.exe
  2⤵
  PID:8636
- C:\Windows\System\YMPSLhz.exe
  C:\Windows\System\YMPSLhz.exe
  2⤵
  PID:8564
- C:\Windows\System\jejyUjT.exe
  C:\Windows\System\jejyUjT.exe
  2⤵
  PID:4320
- C:\Windows\System\jnuFCGm.exe
  C:\Windows\System\jnuFCGm.exe
  2⤵
  PID:8684
- C:\Windows\System\nfXFXKH.exe
  C:\Windows\System\nfXFXKH.exe
  2⤵
  PID:8792
- C:\Windows\System\Vpjtcoe.exe
  C:\Windows\System\Vpjtcoe.exe
  2⤵
  PID:8952
- C:\Windows\System\HyZuiPB.exe
  C:\Windows\System\HyZuiPB.exe
  2⤵
  PID:8864
- C:\Windows\System\TMZmggA.exe
  C:\Windows\System\TMZmggA.exe
  2⤵
  PID:9036
- C:\Windows\System\DZZQKDI.exe
  C:\Windows\System\DZZQKDI.exe
  2⤵
  PID:8836
- C:\Windows\System\YjNGqov.exe
  C:\Windows\System\YjNGqov.exe
  2⤵
  PID:8892
- C:\Windows\System\pEyZNmN.exe
  C:\Windows\System\pEyZNmN.exe
  2⤵
  PID:9192
- C:\Windows\System\MiQDXtP.exe
  C:\Windows\System\MiQDXtP.exe
  2⤵
  PID:9108
- C:\Windows\System\KpSUDaA.exe
  C:\Windows\System\KpSUDaA.exe
  2⤵
  PID:7724
- C:\Windows\System\uZJtbWp.exe
  C:\Windows\System\uZJtbWp.exe
  2⤵
  PID:8504
- C:\Windows\System\unrfOSx.exe
  C:\Windows\System\unrfOSx.exe
  2⤵
  PID:8620
- C:\Windows\System\ycXwthl.exe
  C:\Windows\System\ycXwthl.exe
  2⤵
  PID:8668
- C:\Windows\System\LAivQuM.exe
  C:\Windows\System\LAivQuM.exe
  2⤵
  PID:8468
- C:\Windows\System\ooGUxlF.exe
  C:\Windows\System\ooGUxlF.exe
  2⤵
  PID:9232
- C:\Windows\System\jhwBcMJ.exe
  C:\Windows\System\jhwBcMJ.exe
  2⤵
  PID:9264
- C:\Windows\System\gzydpOS.exe
  C:\Windows\System\gzydpOS.exe
  2⤵
  PID:9288
- C:\Windows\System\QHZoHJz.exe
  C:\Windows\System\QHZoHJz.exe
  2⤵
  PID:9316
- C:\Windows\System\wpkwIka.exe
  C:\Windows\System\wpkwIka.exe
  2⤵
  PID:9340
- C:\Windows\System\PmqugbG.exe
  C:\Windows\System\PmqugbG.exe
  2⤵
  PID:9372
- C:\Windows\System\yeFdAHv.exe
  C:\Windows\System\yeFdAHv.exe
  2⤵
  PID:9392
- C:\Windows\System\SypErwN.exe
  C:\Windows\System\SypErwN.exe
  2⤵
  PID:9424
- C:\Windows\System\RJCBWMm.exe
  C:\Windows\System\RJCBWMm.exe
  2⤵
  PID:9452
- C:\Windows\System\UKcZCUh.exe
  C:\Windows\System\UKcZCUh.exe
  2⤵
  PID:9484
- C:\Windows\System\JYFBRHx.exe
  C:\Windows\System\JYFBRHx.exe
  2⤵
  PID:9504
- C:\Windows\System\rlnDWwH.exe
  C:\Windows\System\rlnDWwH.exe
  2⤵
  PID:9532
- C:\Windows\System\EYETEYs.exe
  C:\Windows\System\EYETEYs.exe
  2⤵
  PID:9556
- C:\Windows\System\rpCwmTf.exe
  C:\Windows\System\rpCwmTf.exe
  2⤵
  PID:9584
- C:\Windows\System\HZPOlWJ.exe
  C:\Windows\System\HZPOlWJ.exe
  2⤵
  PID:9608
- C:\Windows\System\drBEUpK.exe
  C:\Windows\System\drBEUpK.exe
  2⤵
  PID:9624
- C:\Windows\System\hkAAIWG.exe
  C:\Windows\System\hkAAIWG.exe
  2⤵
  PID:9652
- C:\Windows\System\bJvDihI.exe
  C:\Windows\System\bJvDihI.exe
  2⤵
  PID:9684
- C:\Windows\System\YUAiPTI.exe
  C:\Windows\System\YUAiPTI.exe
  2⤵
  PID:9708
- C:\Windows\System\dtdBYjj.exe
  C:\Windows\System\dtdBYjj.exe
  2⤵
  PID:9728
- C:\Windows\System\KGlYxQN.exe
  C:\Windows\System\KGlYxQN.exe
  2⤵
  PID:9748
- C:\Windows\System\SdGHcMq.exe
  C:\Windows\System\SdGHcMq.exe
  2⤵
  PID:9780
- C:\Windows\System\MZgbrSX.exe
  C:\Windows\System\MZgbrSX.exe
  2⤵
  PID:9804
- C:\Windows\System\VIMBuUP.exe
  C:\Windows\System\VIMBuUP.exe
  2⤵
  PID:9828
- C:\Windows\System\bxBAzWb.exe
  C:\Windows\System\bxBAzWb.exe
  2⤵
  PID:9856
- C:\Windows\System\eBInnDB.exe
  C:\Windows\System\eBInnDB.exe
  2⤵
  PID:9880
- C:\Windows\System\EVjqsft.exe
  C:\Windows\System\EVjqsft.exe
  2⤵
  PID:9908
- C:\Windows\System\eohGYEX.exe
  C:\Windows\System\eohGYEX.exe
  2⤵
  PID:9936
- C:\Windows\System\rHloHkt.exe
  C:\Windows\System\rHloHkt.exe
  2⤵
  PID:9956
- C:\Windows\System\nVgpYmh.exe
  C:\Windows\System\nVgpYmh.exe
  2⤵
  PID:9984
- C:\Windows\System\DScychk.exe
  C:\Windows\System\DScychk.exe
  2⤵
  PID:10004
- C:\Windows\System\jGWNOzd.exe
  C:\Windows\System\jGWNOzd.exe
  2⤵
  PID:10028
- C:\Windows\System\TaBjYSO.exe
  C:\Windows\System\TaBjYSO.exe
  2⤵
  PID:10064
- C:\Windows\System\XvuxmrF.exe
  C:\Windows\System\XvuxmrF.exe
  2⤵
  PID:10088
- C:\Windows\System\mmRzTrC.exe
  C:\Windows\System\mmRzTrC.exe
  2⤵
  PID:10116
- C:\Windows\System\mnCZbja.exe
  C:\Windows\System\mnCZbja.exe
  2⤵
  PID:10144
- C:\Windows\System\PXawufV.exe
  C:\Windows\System\PXawufV.exe
  2⤵
  PID:10168
- C:\Windows\System\MNJjXwW.exe
  C:\Windows\System\MNJjXwW.exe
  2⤵
  PID:10184
- C:\Windows\System\luGCwCm.exe
  C:\Windows\System\luGCwCm.exe
  2⤵
  PID:10216
- C:\Windows\System\qRxhNTd.exe
  C:\Windows\System\qRxhNTd.exe
  2⤵
  PID:9968
- C:\Windows\System\cQlYChy.exe
  C:\Windows\System\cQlYChy.exe
  2⤵
  PID:9800
- C:\Windows\System\OrBMwvY.exe
  C:\Windows\System\OrBMwvY.exe
  2⤵
  PID:9600
- C:\Windows\System\gMGDoUa.exe
  C:\Windows\System\gMGDoUa.exe
  2⤵
  PID:9952
- C:\Windows\System\irEHhfi.exe
  C:\Windows\System\irEHhfi.exe
  2⤵
  PID:10040
- C:\Windows\System\nVTOZXg.exe
  C:\Windows\System\nVTOZXg.exe
  2⤵
  PID:10056
- C:\Windows\System\isPaNms.exe
  C:\Windows\System\isPaNms.exe
  2⤵
  PID:10180
- C:\Windows\System\djKUDka.exe
  C:\Windows\System\djKUDka.exe
  2⤵
  PID:10084
- C:\Windows\System\VyKmtYN.exe
  C:\Windows\System\VyKmtYN.exe
  2⤵
  PID:9004
- C:\Windows\System\uoLsHfJ.exe
  C:\Windows\System\uoLsHfJ.exe
  2⤵
  PID:10232
- C:\Windows\System\NSoexpr.exe
  C:\Windows\System\NSoexpr.exe
  2⤵
  PID:9224
- C:\Windows\System\VCMNrGz.exe
  C:\Windows\System\VCMNrGz.exe
  2⤵
  PID:9012
- C:\Windows\System\OCztOAe.exe
  C:\Windows\System\OCztOAe.exe
  2⤵
  PID:9824
- C:\Windows\System\WpmpLmz.exe
  C:\Windows\System\WpmpLmz.exe
  2⤵
  PID:9692
- C:\Windows\System\OewAuxi.exe
  C:\Windows\System\OewAuxi.exe
  2⤵
  PID:9528
- C:\Windows\System\BsFYBjo.exe
  C:\Windows\System\BsFYBjo.exe
  2⤵
  PID:10128
- C:\Windows\System\EySWqAT.exe
  C:\Windows\System\EySWqAT.exe
  2⤵
  PID:10052
- C:\Windows\System\JFxKpvS.exe
  C:\Windows\System\JFxKpvS.exe
  2⤵
  PID:10164
- C:\Windows\System\GZABfac.exe
  C:\Windows\System\GZABfac.exe
  2⤵
  PID:7868
- C:\Windows\System\uGnRCwZ.exe
  C:\Windows\System\uGnRCwZ.exe
  2⤵
  PID:9312
- C:\Windows\System\QdPmgfg.exe
  C:\Windows\System\QdPmgfg.exe
  2⤵
  PID:8608
- C:\Windows\System\SqVlfYZ.exe
  C:\Windows\System\SqVlfYZ.exe
  2⤵
  PID:10244
- C:\Windows\System\sKeYgJQ.exe
  C:\Windows\System\sKeYgJQ.exe
  2⤵
  PID:10272
- C:\Windows\System\WQsunqN.exe
  C:\Windows\System\WQsunqN.exe
  2⤵
  PID:10296
- C:\Windows\System\KbEexHh.exe
  C:\Windows\System\KbEexHh.exe
  2⤵
  PID:10320
- C:\Windows\System\YKGFZed.exe
  C:\Windows\System\YKGFZed.exe
  2⤵
  PID:10348
- C:\Windows\System\MnnFaQm.exe
  C:\Windows\System\MnnFaQm.exe
  2⤵
  PID:10380
- C:\Windows\System\AZcRGMV.exe
  C:\Windows\System\AZcRGMV.exe
  2⤵
  PID:10396
- C:\Windows\System\XENvplT.exe
  C:\Windows\System\XENvplT.exe
  2⤵
  PID:10424
- C:\Windows\System\QWjOIsZ.exe
  C:\Windows\System\QWjOIsZ.exe
  2⤵
  PID:10452
- C:\Windows\System\VeytFeP.exe
  C:\Windows\System\VeytFeP.exe
  2⤵
  PID:10468
- C:\Windows\System\BuwdICp.exe
  C:\Windows\System\BuwdICp.exe
  2⤵
  PID:10492
- C:\Windows\System\VOBxsPo.exe
  C:\Windows\System\VOBxsPo.exe
  2⤵
  PID:10572
- C:\Windows\System\adBUEMb.exe
  C:\Windows\System\adBUEMb.exe
  2⤵
  PID:10612
- C:\Windows\System\ZVdBbIt.exe
  C:\Windows\System\ZVdBbIt.exe
  2⤵
  PID:10648
- C:\Windows\System\CYBDyqD.exe
  C:\Windows\System\CYBDyqD.exe
  2⤵
  PID:10676
- C:\Windows\System\BZrEmns.exe
  C:\Windows\System\BZrEmns.exe
  2⤵
  PID:10700
- C:\Windows\System\OxQFkKN.exe
  C:\Windows\System\OxQFkKN.exe
  2⤵
  PID:10728
- C:\Windows\System\alHynrf.exe
  C:\Windows\System\alHynrf.exe
  2⤵
  PID:10752
- C:\Windows\System\ubFWYFr.exe
  C:\Windows\System\ubFWYFr.exe
  2⤵
  PID:10776
- C:\Windows\System\qMcVpkO.exe
  C:\Windows\System\qMcVpkO.exe
  2⤵
  PID:10808
- C:\Windows\System\RfbEzAf.exe
  C:\Windows\System\RfbEzAf.exe
  2⤵
  PID:10824
- C:\Windows\System\GkdgcGC.exe
  C:\Windows\System\GkdgcGC.exe
  2⤵
  PID:10848
- C:\Windows\System\cuoHqLE.exe
  C:\Windows\System\cuoHqLE.exe
  2⤵
  PID:10864
- C:\Windows\System\kFyiQLD.exe
  C:\Windows\System\kFyiQLD.exe
  2⤵
  PID:10884
- C:\Windows\System\SeYLjPd.exe
  C:\Windows\System\SeYLjPd.exe
  2⤵
  PID:10908
- C:\Windows\System\lihMhFl.exe
  C:\Windows\System\lihMhFl.exe
  2⤵
  PID:10928
- C:\Windows\System\ijRCyfa.exe
  C:\Windows\System\ijRCyfa.exe
  2⤵
  PID:10952
- C:\Windows\System\HzHEXUw.exe
  C:\Windows\System\HzHEXUw.exe
  2⤵
  PID:10976
- C:\Windows\System\MAlAWPk.exe
  C:\Windows\System\MAlAWPk.exe
  2⤵
  PID:10996
- C:\Windows\System\ZGZVdZc.exe
  C:\Windows\System\ZGZVdZc.exe
  2⤵
  PID:11024
- C:\Windows\System\aHSDgUZ.exe
  C:\Windows\System\aHSDgUZ.exe
  2⤵
  PID:11048
- C:\Windows\System\STsqslT.exe
  C:\Windows\System\STsqslT.exe
  2⤵
  PID:11076
- C:\Windows\System\bCKskJH.exe
  C:\Windows\System\bCKskJH.exe
  2⤵
  PID:11092
- C:\Windows\System\wPVjxpr.exe
  C:\Windows\System\wPVjxpr.exe
  2⤵
  PID:11116
- C:\Windows\System\GPYXCcn.exe
  C:\Windows\System\GPYXCcn.exe
  2⤵
  PID:11140
- C:\Windows\System\smIyKZG.exe
  C:\Windows\System\smIyKZG.exe
  2⤵
  PID:11164
- C:\Windows\System\ZoTWScS.exe
  C:\Windows\System\ZoTWScS.exe
  2⤵
  PID:11180
- C:\Windows\System\dDiZRCL.exe
  C:\Windows\System\dDiZRCL.exe
  2⤵
  PID:11204
- C:\Windows\System\cDVcKSo.exe
  C:\Windows\System\cDVcKSo.exe
  2⤵
  PID:11228
- C:\Windows\System\QFaESpT.exe
  C:\Windows\System\QFaESpT.exe
  2⤵
  PID:11256
- C:\Windows\System\GlgOVlg.exe
  C:\Windows\System\GlgOVlg.exe
  2⤵
  PID:9432
- C:\Windows\System\mTFhRRF.exe
  C:\Windows\System\mTFhRRF.exe
  2⤵
  PID:10268
- C:\Windows\System\QMbCeUD.exe
  C:\Windows\System\QMbCeUD.exe
  2⤵
  PID:10364
- C:\Windows\System\nfpjcme.exe
  C:\Windows\System\nfpjcme.exe
  2⤵
  PID:8844
- C:\Windows\System\lOMLMJE.exe
  C:\Windows\System\lOMLMJE.exe
  2⤵
  PID:10328
- C:\Windows\System\RoFHVNU.exe
  C:\Windows\System\RoFHVNU.exe
  2⤵
  PID:10420
- C:\Windows\System\kJyJFtl.exe
  C:\Windows\System\kJyJFtl.exe
  2⤵
  PID:10516
- C:\Windows\System\KvipMaW.exe
  C:\Windows\System\KvipMaW.exe
  2⤵
  PID:10632
- C:\Windows\System\phoEWEv.exe
  C:\Windows\System\phoEWEv.exe
  2⤵
  PID:10520
- C:\Windows\System\SLuaIuf.exe
  C:\Windows\System\SLuaIuf.exe
  2⤵
  PID:10764
- C:\Windows\System\iBufedV.exe
  C:\Windows\System\iBufedV.exe
  2⤵
  PID:10816
- C:\Windows\System\gCpyRcB.exe
  C:\Windows\System\gCpyRcB.exe
  2⤵
  PID:10856
- C:\Windows\System\zKXsAZd.exe
  C:\Windows\System\zKXsAZd.exe
  2⤵
  PID:10860
- C:\Windows\System\FeLMcBk.exe
  C:\Windows\System\FeLMcBk.exe
  2⤵
  PID:10876
- C:\Windows\System\PoyslCe.exe
  C:\Windows\System\PoyslCe.exe
  2⤵
  PID:11124
- C:\Windows\System\bvQOGuu.exe
  C:\Windows\System\bvQOGuu.exe
  2⤵
  PID:10988
- C:\Windows\System\liLzons.exe
  C:\Windows\System\liLzons.exe
  2⤵
  PID:11196
- C:\Windows\System\hRnVzwe.exe
  C:\Windows\System\hRnVzwe.exe
  2⤵
  PID:8920
- C:\Windows\System\gBzgJoR.exe
  C:\Windows\System\gBzgJoR.exe
  2⤵
  PID:11172
- C:\Windows\System\irqlALq.exe
  C:\Windows\System\irqlALq.exe
  2⤵
  PID:11240
- C:\Windows\System\ZWmSgSg.exe
  C:\Windows\System\ZWmSgSg.exe
  2⤵
  PID:10488
- C:\Windows\System\DmYyEOv.exe
  C:\Windows\System\DmYyEOv.exe
  2⤵
  PID:11272
- C:\Windows\System\HVGuvcT.exe
  C:\Windows\System\HVGuvcT.exe
  2⤵
  PID:11296
- C:\Windows\System\tzpwjtL.exe
  C:\Windows\System\tzpwjtL.exe
  2⤵
  PID:11316
- C:\Windows\System\LsIqeks.exe
  C:\Windows\System\LsIqeks.exe
  2⤵
  PID:11348
- C:\Windows\System\WQWkAVm.exe
  C:\Windows\System\WQWkAVm.exe
  2⤵
  PID:11368
- C:\Windows\System\vWAlhqQ.exe
  C:\Windows\System\vWAlhqQ.exe
  2⤵
  PID:11388
- C:\Windows\System\pjZKsKb.exe
  C:\Windows\System\pjZKsKb.exe
  2⤵
  PID:11412
- C:\Windows\System\SjztDPg.exe
  C:\Windows\System\SjztDPg.exe
  2⤵
  PID:11440
- C:\Windows\System\rijOHTa.exe
  C:\Windows\System\rijOHTa.exe
  2⤵
  PID:11468
- C:\Windows\System\DRHwYcT.exe
  C:\Windows\System\DRHwYcT.exe
  2⤵
  PID:11488
- C:\Windows\System\yLlqVKd.exe
  C:\Windows\System\yLlqVKd.exe
  2⤵
  PID:11516
- C:\Windows\System\ZkFTiGt.exe
  C:\Windows\System\ZkFTiGt.exe
  2⤵
  PID:11532
- C:\Windows\System\yNrnINv.exe
  C:\Windows\System\yNrnINv.exe
  2⤵
  PID:11556
- C:\Windows\System\mvyWcUY.exe
  C:\Windows\System\mvyWcUY.exe
  2⤵
  PID:11576
- C:\Windows\System\eFqoYVf.exe
  C:\Windows\System\eFqoYVf.exe
  2⤵
  PID:11600
- C:\Windows\System\vzhTWGW.exe
  C:\Windows\System\vzhTWGW.exe
  2⤵
  PID:11628
- C:\Windows\System\rqwGajl.exe
  C:\Windows\System\rqwGajl.exe
  2⤵
  PID:11672
- C:\Windows\System\dbNpnZA.exe
  C:\Windows\System\dbNpnZA.exe
  2⤵
  PID:11688
- C:\Windows\System\KkOjXab.exe
  C:\Windows\System\KkOjXab.exe
  2⤵
  PID:11712
- C:\Windows\System\AHzozSf.exe
  C:\Windows\System\AHzozSf.exe
  2⤵
  PID:11736
- C:\Windows\System\jDscNkx.exe
  C:\Windows\System\jDscNkx.exe
  2⤵
  PID:11764
- C:\Windows\System\ymZgvnG.exe
  C:\Windows\System\ymZgvnG.exe
  2⤵
  PID:11792
- C:\Windows\System\kNFIGdq.exe
  C:\Windows\System\kNFIGdq.exe
  2⤵
  PID:11812
- C:\Windows\System\DRlGuri.exe
  C:\Windows\System\DRlGuri.exe
  2⤵
  PID:11848
- C:\Windows\System\yOhDtZw.exe
  C:\Windows\System\yOhDtZw.exe
  2⤵
  PID:11872
- C:\Windows\System\ijYciva.exe
  C:\Windows\System\ijYciva.exe
  2⤵
  PID:11892
- C:\Windows\System\NbSmAMY.exe
  C:\Windows\System\NbSmAMY.exe
  2⤵
  PID:11920
- C:\Windows\System\QPcoQFy.exe
  C:\Windows\System\QPcoQFy.exe
  2⤵
  PID:11948
- C:\Windows\System\nbpBuGO.exe
  C:\Windows\System\nbpBuGO.exe
  2⤵
  PID:11972
- C:\Windows\System\SOkWAIU.exe
  C:\Windows\System\SOkWAIU.exe
  2⤵
  PID:11992
- C:\Windows\System\ZfcwzCd.exe
  C:\Windows\System\ZfcwzCd.exe
  2⤵
  PID:12020
- C:\Windows\System\wHqEaFi.exe
  C:\Windows\System\wHqEaFi.exe
  2⤵
  PID:12048
- C:\Windows\System\dYRRKVL.exe
  C:\Windows\System\dYRRKVL.exe
  2⤵
  PID:12072
- C:\Windows\System\mfdAOqj.exe
  C:\Windows\System\mfdAOqj.exe
  2⤵
  PID:12096
- C:\Windows\System\hlIaZEd.exe
  C:\Windows\System\hlIaZEd.exe
  2⤵
  PID:12128
- C:\Windows\System\NGmTFso.exe
  C:\Windows\System\NGmTFso.exe
  2⤵
  PID:12148
- C:\Windows\System\rMjmvpI.exe
  C:\Windows\System\rMjmvpI.exe
  2⤵
  PID:12176
- C:\Windows\System\axDVcRf.exe
  C:\Windows\System\axDVcRf.exe
  2⤵
  PID:12200
- C:\Windows\System\iekddWL.exe
  C:\Windows\System\iekddWL.exe
  2⤵
  PID:12224
- C:\Windows\System\ZUFUaNg.exe
  C:\Windows\System\ZUFUaNg.exe
  2⤵
  PID:12256
- C:\Windows\System\ooHbUIh.exe
  C:\Windows\System\ooHbUIh.exe
  2⤵
  PID:12280
- C:\Windows\System\AnlhLuF.exe
  C:\Windows\System\AnlhLuF.exe
  2⤵
  PID:10924
- C:\Windows\System\DBWjmwO.exe
  C:\Windows\System\DBWjmwO.exe
  2⤵
  PID:11108
- C:\Windows\System\eTFxHwg.exe
  C:\Windows\System\eTFxHwg.exe
  2⤵
  PID:11220
- C:\Windows\System\zvibsuJ.exe
  C:\Windows\System\zvibsuJ.exe
  2⤵
  PID:10392
- C:\Windows\System\xTxYoVE.exe
  C:\Windows\System\xTxYoVE.exe
  2⤵
  PID:10744
- C:\Windows\System\UZvHdrX.exe
  C:\Windows\System\UZvHdrX.exe
  2⤵
  PID:2260
- C:\Windows\System\RyMWvwI.exe
  C:\Windows\System\RyMWvwI.exe
  2⤵
  PID:11956
- C:\Windows\System\OwDTUNE.exe
  C:\Windows\System\OwDTUNE.exe
  2⤵
  PID:12088
- C:\Windows\System\fVavcjP.exe
  C:\Windows\System\fVavcjP.exe
  2⤵
  PID:12184
- C:\Windows\System\xVgfMOY.exe
  C:\Windows\System\xVgfMOY.exe
  2⤵
  PID:12220
- C:\Windows\System\QdDELUb.exe
  C:\Windows\System\QdDELUb.exe
  2⤵
  PID:11088
- C:\Windows\System\RxOGcTs.exe
  C:\Windows\System\RxOGcTs.exe
  2⤵
  PID:11732
- C:\Windows\System\sYachwb.exe
  C:\Windows\System\sYachwb.exe
  2⤵
  PID:11524
- C:\Windows\System\wQNwtbe.exe
  C:\Windows\System\wQNwtbe.exe
  2⤵
  PID:11728
- C:\Windows\System\PXkBmlb.exe
  C:\Windows\System\PXkBmlb.exe
  2⤵
  PID:3672
- C:\Windows\System\pUYDXQI.exe
  C:\Windows\System\pUYDXQI.exe
  2⤵
  PID:11884
- C:\Windows\System\TVtXEDL.exe
  C:\Windows\System\TVtXEDL.exe
  2⤵
  PID:12160
- C:\Windows\System\QrJlfmx.exe
  C:\Windows\System\QrJlfmx.exe
  2⤵
  PID:3708
- C:\Windows\System\RbWjNHx.exe
  C:\Windows\System\RbWjNHx.exe
  2⤵
  PID:3420
- C:\Windows\System\CzaaizB.exe
  C:\Windows\System\CzaaizB.exe
  2⤵
  PID:11572
- C:\Windows\System\ESPlxPN.exe
  C:\Windows\System\ESPlxPN.exe
  2⤵
  PID:2440
- C:\Windows\System\UpYSqFx.exe
  C:\Windows\System\UpYSqFx.exe
  2⤵
  PID:10684
- C:\Windows\System\kaWuxyI.exe
  C:\Windows\System\kaWuxyI.exe
  2⤵
  PID:10340
- C:\Windows\System\eATBxju.exe
  C:\Windows\System\eATBxju.exe
  2⤵
  PID:12068
- C:\Windows\System\zXpeBwm.exe
  C:\Windows\System\zXpeBwm.exe
  2⤵
  PID:4260
- C:\Windows\System\GICmLUE.exe
  C:\Windows\System\GICmLUE.exe
  2⤵
  PID:4088
- C:\Windows\System\iKFpZSI.exe
  C:\Windows\System\iKFpZSI.exe
  2⤵
  PID:12032
- C:\Windows\System\aodcEdK.exe
  C:\Windows\System\aodcEdK.exe
  2⤵
  PID:11060
- C:\Windows\System\yAxmaJX.exe
  C:\Windows\System\yAxmaJX.exe
  2⤵
  PID:12232
- C:\Windows\System\KrYgPJI.exe
  C:\Windows\System\KrYgPJI.exe
  2⤵
  PID:12316
- C:\Windows\System\MPfyhaV.exe
  C:\Windows\System\MPfyhaV.exe
  2⤵
  PID:12340
- C:\Windows\System\qZKcENe.exe
  C:\Windows\System\qZKcENe.exe
  2⤵
  PID:12364
- C:\Windows\System\NUFHzwn.exe
  C:\Windows\System\NUFHzwn.exe
  2⤵
  PID:12388
- C:\Windows\System\jgRFBoh.exe
  C:\Windows\System\jgRFBoh.exe
  2⤵
  PID:12412
- C:\Windows\System\keVZjbN.exe
  C:\Windows\System\keVZjbN.exe
  2⤵
  PID:12432
- C:\Windows\System\DmboDEQ.exe
  C:\Windows\System\DmboDEQ.exe
  2⤵
  PID:12460
- C:\Windows\System\DwBFkIO.exe
  C:\Windows\System\DwBFkIO.exe
  2⤵
  PID:12480
- C:\Windows\System\QyNsDiK.exe
  C:\Windows\System\QyNsDiK.exe
  2⤵
  PID:12504
- C:\Windows\System\HhlKaMj.exe
  C:\Windows\System\HhlKaMj.exe
  2⤵
  PID:12528
- C:\Windows\System\uzZupop.exe
  C:\Windows\System\uzZupop.exe
  2⤵
  PID:12556
- C:\Windows\System\ccFmfiC.exe
  C:\Windows\System\ccFmfiC.exe
  2⤵
  PID:12580
- C:\Windows\System\qlubFOF.exe
  C:\Windows\System\qlubFOF.exe
  2⤵
  PID:12608
- C:\Windows\System\sqrcRuc.exe
  C:\Windows\System\sqrcRuc.exe
  2⤵
  PID:12628
- C:\Windows\System\wAueEJZ.exe
  C:\Windows\System\wAueEJZ.exe
  2⤵
  PID:12660
- C:\Windows\System\mVjbEXE.exe
  C:\Windows\System\mVjbEXE.exe
  2⤵
  PID:12688
- C:\Windows\System\DjgIptb.exe
  C:\Windows\System\DjgIptb.exe
  2⤵
  PID:12708
- C:\Windows\System\NdrAniQ.exe
  C:\Windows\System\NdrAniQ.exe
  2⤵
  PID:12732
- C:\Windows\System\LmbnJXK.exe
  C:\Windows\System\LmbnJXK.exe
  2⤵
  PID:12752
- C:\Windows\System\MnURYEu.exe
  C:\Windows\System\MnURYEu.exe
  2⤵
  PID:12780
- C:\Windows\System\hFrdKWI.exe
  C:\Windows\System\hFrdKWI.exe
  2⤵
  PID:12800
- C:\Windows\System\GlWqcuz.exe
  C:\Windows\System\GlWqcuz.exe
  2⤵
  PID:12820
- C:\Windows\System\wyUyJMx.exe
  C:\Windows\System\wyUyJMx.exe
  2⤵
  PID:13108
- C:\Windows\System\zlRhBXr.exe
  C:\Windows\System\zlRhBXr.exe
  2⤵
  PID:13124
- C:\Windows\System\IrLFDbK.exe
  C:\Windows\System\IrLFDbK.exe
  2⤵
  PID:13144
- C:\Windows\System\HcfQHjr.exe
  C:\Windows\System\HcfQHjr.exe
  2⤵
  PID:13160
- C:\Windows\System\fibLloq.exe
  C:\Windows\System\fibLloq.exe
  2⤵
  PID:13188
- C:\Windows\System\SuIgwxP.exe
  C:\Windows\System\SuIgwxP.exe
  2⤵
  PID:13212
- C:\Windows\System\PVYtIiw.exe
  C:\Windows\System\PVYtIiw.exe
  2⤵
  PID:13236
- C:\Windows\System\AjMzFOm.exe
  C:\Windows\System\AjMzFOm.exe
  2⤵
  PID:13256
- C:\Windows\System\FwJrzRv.exe
  C:\Windows\System\FwJrzRv.exe
  2⤵
  PID:13284
- C:\Windows\System\vboRglm.exe
  C:\Windows\System\vboRglm.exe
  2⤵
  PID:13304
- C:\Windows\System\NbuaTuR.exe
  C:\Windows\System\NbuaTuR.exe
  2⤵
  PID:3320
- C:\Windows\System\AnsKjET.exe
  C:\Windows\System\AnsKjET.exe
  2⤵
  PID:12336
- C:\Windows\System\NCfOGRI.exe
  C:\Windows\System\NCfOGRI.exe
  2⤵
  PID:12408
- C:\Windows\System\ctBqNqA.exe
  C:\Windows\System\ctBqNqA.exe
  2⤵
  PID:12300
- C:\Windows\System\cEeBvwI.exe
  C:\Windows\System\cEeBvwI.exe
  2⤵
  PID:12624
- C:\Windows\System\ruUGYzY.exe
  C:\Windows\System\ruUGYzY.exe
  2⤵
  PID:12672
- C:\Windows\System\byeIQgg.exe
  C:\Windows\System\byeIQgg.exe
  2⤵
  PID:12576
- C:\Windows\System\DPWQARU.exe
  C:\Windows\System\DPWQARU.exe
  2⤵
  PID:12644
- C:\Windows\System\zYccuis.exe
  C:\Windows\System\zYccuis.exe
  2⤵
  PID:12540
- C:\Windows\System\hwjUcFz.exe
  C:\Windows\System\hwjUcFz.exe
  2⤵
  PID:12768
- C:\Windows\System\rCPZLYE.exe
  C:\Windows\System\rCPZLYE.exe
  2⤵
  PID:12668
- C:\Windows\System\BIiQEpL.exe
  C:\Windows\System\BIiQEpL.exe
  2⤵
  PID:12772
- C:\Windows\System\TqpUMGQ.exe
  C:\Windows\System\TqpUMGQ.exe
  2⤵
  PID:12764
- C:\Windows\System\MxFBCvr.exe
  C:\Windows\System\MxFBCvr.exe
  2⤵
  PID:13012
- C:\Windows\System\rJhqShv.exe
  C:\Windows\System\rJhqShv.exe
  2⤵
  PID:13040
- C:\Windows\System\wEfKulx.exe
  C:\Windows\System\wEfKulx.exe
  2⤵
  PID:13092
- C:\Windows\System\uCXvUsm.exe
  C:\Windows\System\uCXvUsm.exe
  2⤵
  PID:13120
- C:\Windows\System\SjktxMc.exe
  C:\Windows\System\SjktxMc.exe
  2⤵
  PID:13204
- C:\Windows\System\LRzsJpo.exe
  C:\Windows\System\LRzsJpo.exe
  2⤵
  PID:13200
- C:\Windows\System\DILWYEr.exe
  C:\Windows\System\DILWYEr.exe
  2⤵
  PID:13272
- C:\Windows\System\MRWlhly.exe
  C:\Windows\System\MRWlhly.exe
  2⤵
  PID:12008
- C:\Windows\System\aZMkVte.exe
  C:\Windows\System\aZMkVte.exe
  2⤵
  PID:920
- C:\Windows\System\LoSKlTN.exe
  C:\Windows\System\LoSKlTN.exe
  2⤵
  PID:12748
- C:\Windows\System\tQhMLKS.exe
  C:\Windows\System\tQhMLKS.exe
  2⤵
  PID:12744
- C:\Windows\System\gkkxKVk.exe
  C:\Windows\System\gkkxKVk.exe
  2⤵
  PID:2316
- C:\Windows\System\fwrhaTu.exe
  C:\Windows\System\fwrhaTu.exe
  2⤵
  PID:12704
- C:\Windows\System\CbkBocR.exe
  C:\Windows\System\CbkBocR.exe
  2⤵
  PID:13172
- C:\Windows\System\aDkOIVr.exe
  C:\Windows\System\aDkOIVr.exe
  2⤵
  PID:13032
- C:\Windows\System\awMvwfW.exe
  C:\Windows\System\awMvwfW.exe
  2⤵
  PID:4984
- C:\Windows\System\BJwuagH.exe
  C:\Windows\System\BJwuagH.exe
  2⤵
  PID:12440
- C:\Windows\System\uXhwGKf.exe
  C:\Windows\System\uXhwGKf.exe
  2⤵
  PID:13320
- C:\Windows\System\FSlUKGT.exe
  C:\Windows\System\FSlUKGT.exe
  2⤵
  PID:13344
- C:\Windows\System\wppEhGC.exe
  C:\Windows\System\wppEhGC.exe
  2⤵
  PID:13376
- C:\Windows\System\JxAKxNs.exe
  C:\Windows\System\JxAKxNs.exe
  2⤵
  PID:13396
- C:\Windows\System\LNvBHtW.exe
  C:\Windows\System\LNvBHtW.exe
  2⤵
  PID:13416
- C:\Windows\System\yqfNXMZ.exe
  C:\Windows\System\yqfNXMZ.exe
  2⤵
  PID:13440
- C:\Windows\System\YQxbaiT.exe
  C:\Windows\System\YQxbaiT.exe
  2⤵
  PID:13464
- C:\Windows\System\LKbhIzN.exe
  C:\Windows\System\LKbhIzN.exe
  2⤵
  PID:13488
- C:\Windows\System\qKPmkxI.exe
  C:\Windows\System\qKPmkxI.exe
  2⤵
  PID:13512
- C:\Windows\System\OaPpGjF.exe
  C:\Windows\System\OaPpGjF.exe
  2⤵
  PID:13572
- C:\Windows\System\YrTOuxi.exe
  C:\Windows\System\YrTOuxi.exe
  2⤵
  PID:13600
- C:\Windows\System\jFcgPfn.exe
  C:\Windows\System\jFcgPfn.exe
  2⤵
  PID:13616
- C:\Windows\System\mNgaMct.exe
  C:\Windows\System\mNgaMct.exe
  2⤵
  PID:13644
- C:\Windows\System\eoxIfqf.exe
  C:\Windows\System\eoxIfqf.exe
  2⤵
  PID:13672
- C:\Windows\System\amCKtms.exe
  C:\Windows\System\amCKtms.exe
  2⤵
  PID:13708
- C:\Windows\System\VdRyOwC.exe
  C:\Windows\System\VdRyOwC.exe
  2⤵
  PID:13740
- C:\Windows\System\PkIEYHj.exe
  C:\Windows\System\PkIEYHj.exe
  2⤵
  PID:13768
- C:\Windows\System\kdkYZqz.exe
  C:\Windows\System\kdkYZqz.exe
  2⤵
  PID:13792
- C:\Windows\System\rtKKkcc.exe
  C:\Windows\System\rtKKkcc.exe
  2⤵
  PID:13812
- C:\Windows\System\OISONeX.exe
  C:\Windows\System\OISONeX.exe
  2⤵
  PID:13836
- C:\Windows\System\VKgcxoF.exe
  C:\Windows\System\VKgcxoF.exe
  2⤵
  PID:13864
- C:\Windows\System\xelxOGo.exe
  C:\Windows\System\xelxOGo.exe
  2⤵
  PID:13888
- C:\Windows\System\JgIQVMa.exe
  C:\Windows\System\JgIQVMa.exe
  2⤵
  PID:14124
- C:\Windows\System\izzKLCA.exe
  C:\Windows\System\izzKLCA.exe
  2⤵
  PID:14140
- C:\Windows\System\kgLOtOf.exe
  C:\Windows\System\kgLOtOf.exe
  2⤵
  PID:14156
- C:\Windows\System\oZsQwYa.exe
  C:\Windows\System\oZsQwYa.exe
  2⤵
  PID:14184
- C:\Windows\System\hEcpJrc.exe
  C:\Windows\System\hEcpJrc.exe
  2⤵
  PID:14200
- C:\Windows\System\dvHPaii.exe
  C:\Windows\System\dvHPaii.exe
  2⤵
  PID:14228
- C:\Windows\System\tlSCASp.exe
  C:\Windows\System\tlSCASp.exe
  2⤵
  PID:14244
- C:\Windows\System\QXzgcIG.exe
  C:\Windows\System\QXzgcIG.exe
  2⤵
  PID:14264
- C:\Windows\System\ZkwgoOy.exe
  C:\Windows\System\ZkwgoOy.exe
  2⤵
  PID:14288
- C:\Windows\System\UcIsMjg.exe
  C:\Windows\System\UcIsMjg.exe
  2⤵
  PID:14308
- C:\Windows\System\aSmpfDH.exe
  C:\Windows\System\aSmpfDH.exe
  2⤵
  PID:14328
- C:\Windows\System\NySGoEK.exe
  C:\Windows\System\NySGoEK.exe
  2⤵
  PID:996
- C:\Windows\System\ucCJQEv.exe
  C:\Windows\System\ucCJQEv.exe
  2⤵
  PID:12496
- C:\Windows\System\rNqcZPJ.exe
  C:\Windows\System\rNqcZPJ.exe
  2⤵
  PID:12724
- C:\Windows\System\qcdwTMa.exe
  C:\Windows\System\qcdwTMa.exe
  2⤵
  PID:13472
- C:\Windows\System\LOaGrHJ.exe
  C:\Windows\System\LOaGrHJ.exe
  2⤵
  PID:13520
- C:\Windows\System\ABWDlUH.exe
  C:\Windows\System\ABWDlUH.exe
  2⤵
  PID:12348
- C:\Windows\System\RVxMAYs.exe
  C:\Windows\System\RVxMAYs.exe
  2⤵
  PID:13408
- C:\Windows\System\CLPFeax.exe
  C:\Windows\System\CLPFeax.exe
  2⤵
  PID:13336
- C:\Windows\System\qrNpcDx.exe
  C:\Windows\System\qrNpcDx.exe
  2⤵
  PID:13584
- C:\Windows\System\zTqDGNq.exe
  C:\Windows\System\zTqDGNq.exe
  2⤵
  PID:13568
- C:\Windows\System\ItTCpaT.exe
  C:\Windows\System\ItTCpaT.exe
  2⤵
  PID:13720
- C:\Windows\System\mcZJwpw.exe
  C:\Windows\System\mcZJwpw.exe
  2⤵
  PID:13808
- C:\Windows\System\rVuhAJJ.exe
  C:\Windows\System\rVuhAJJ.exe
  2⤵
  PID:13728
- C:\Windows\System\MpDdqiT.exe
  C:\Windows\System\MpDdqiT.exe
  2⤵
  PID:13884
- C:\Windows\System\ujcQlcu.exe
  C:\Windows\System\ujcQlcu.exe
  2⤵
  PID:13904
- C:\Windows\System\EslVVnl.exe
  C:\Windows\System\EslVVnl.exe
  2⤵
  PID:13848
- C:\Windows\System\YwOhWuE.exe
  C:\Windows\System\YwOhWuE.exe
  2⤵
  PID:13780
- C:\Windows\System\pwUzbIr.exe
  C:\Windows\System\pwUzbIr.exe
  2⤵
  PID:14044
- C:\Windows\System\UtJhONS.exe
  C:\Windows\System\UtJhONS.exe
  2⤵
  PID:14064
- C:\Windows\System\VIFbpJZ.exe
  C:\Windows\System\VIFbpJZ.exe
  2⤵
  PID:14020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:5152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BgIYZtE.exe

Filesize
1.9MB

MD5
3d9f1c8a0f5f6f4d3f7caf203e41d370

SHA1
0f8c38e3d532224e7003653b6edca85c02a88ad0

SHA256
351fd8a985e3348fe0e6ad866f3db186ad61dfa5e8692fcb8fdd3114e3cb9ff0

SHA512
e4f46704e94d86594fc0f5b0165732e2a11785e75ae24a0875473e7e6734dbc1c01d83e9a7b31889a19c8041c198c6751c6df0d87e2a8e1ce1eee7457593f265

Download Submit
C:\Windows\System\ChtdOir.exe

Filesize
1.9MB

MD5
e74c9855b6b3b0c617a0a74bfddf91f5

SHA1
2090bb2842f4b06a636b5b4742a1b8016c3ab5e9

SHA256
1ac853ac2274a0ce1277f6a58604737a922825c4b94669151d21c98f821488a3

SHA512
4eb0ea0a778bc27fae13015468c42e1361b9ee4cf86c390a12099756876a9f9db5b4ce8516e71a9c30c573864e3d51f19ea56255dced25be777f9a6db6e0fb1c

Download Submit
C:\Windows\System\DeuUGYM.exe

Filesize
1.9MB

MD5
376bfdd45d6fbdb98ca2151036c6c93b

SHA1
ba49425d223ff09a7a03d3afe32f421e343fdf57

SHA256
8370aac52c63dc134ea7541bb79c37b6230952c8b488d6c5bb37f84dea408311

SHA512
8b10c48f327d2110ab8b80fc1c0f860d766002dc949dbe0fca86378d3f7aa3ff86885ecc26b3b6912ffc320767b39aab04a02ecc29b5df4bc51098a02aed7edc

Download Submit
C:\Windows\System\FXShQJj.exe

Filesize
2.0MB

MD5
302600c53e461a4d9c219b4ef4446536

SHA1
7262d387f8face08bd087b393e66dce6e18cb488

SHA256
dcfaab9b05c5f25ef88156a9c8e0922469b2406b93b22ea232e89fabaea60bf9

SHA512
70d479bcdce55247cd363f76ae4355a8ce44212f7b9f0c187379be2e41f09129593e012e9b03acd0477d3d9170e2d7ebb22ee7a50ee91f03f69d555114f8ca36

Download Submit
C:\Windows\System\GDhnCDo.exe

Filesize
2.0MB

MD5
052d6133cac21cc7b28f042b7e224bc1

SHA1
8ca5e47c6b7175c55c8f5c4b006e742a3c165aaa

SHA256
0ae666ad8338afe93079d04d1f5f0967807294fc9eab7a507317c9ec61a31916

SHA512
ac028ffea9b3fdd75d963e1087e947e7395e89b83848797597be94f2c45b38bd3679479cd0c08050d963d9170687887407e6794da65765c9e5a4ed8dfdbe5250

Download Submit
C:\Windows\System\HDBTpfu.exe

Filesize
1.9MB

MD5
af7f50e6cf773b65b4799df78bb3ac64

SHA1
45ae0d4d89a368cebd8c67d4f7e7c4928904330c

SHA256
9a1a4118b370b3474cd22e67153036420b0387c806858e298a25f640c11d23fd

SHA512
148f4caaa8b42405e9901d2e0953c9d982b248b35ceb0eb07c65be0ea6e7453370de70ef93079d00dfa51ce6b828625bc94091ea76dccf1b0bc652cb57584518

Download Submit
C:\Windows\System\ILMkldi.exe

Filesize
1.9MB

MD5
c37ef8f1c2331e1811291ab85488ea81

SHA1
fcae5a191e4e9192e90377e5651a60bf8671c652

SHA256
216a73110d277b656035378c13ce06ae60ca11d3deeec5b4f2013de0a66b96d3

SHA512
6f8ad7f884b40c2baf9b7b9497a393f3bb4d6b6f48341aadcd1a56e4e056576256c3a905576ab6fa4556b966058e271720056d6594b0e1bef494fbfd0f4a3e3b

Download Submit
C:\Windows\System\ITtiysw.exe

Filesize
1.9MB

MD5
d8457d6640050c74b2ad6f86a4231a4c

SHA1
c9721bc2c15ca410274098b18ef77e07a07ef326

SHA256
1ce3629e8c6b412a90bafeb2117856550a30ba6d127bd79d99960e9e045a453e

SHA512
46b7e90c2d4a415193cd123cdd0140f9d8c684b4abf8ba8c34532057be0463bb62583d5e84f03e2709f08cb49d9c01a7477241662bbea574b7cca8c89b7715af

Download Submit
C:\Windows\System\JDsFChv.exe

Filesize
1.9MB

MD5
4ee8fb6277db3139bf3e9bee5e428fe0

SHA1
81d78971ca7ac8694f61b90ab826077c4b8f19d9

SHA256
c3e4c741c0f79d94d4e1f6565d3d82088592109cbc0a5183af4bcb8b823f4a44

SHA512
a027a4a745b428ac6f7bb612a90ec54407d858136c4581f3bada394d9a7650578a8240a107ab83365194e1af3c2f129d5b49b02408f6b34d706a647db6fef39e

Download Submit
C:\Windows\System\LcANKNP.exe

Filesize
1.9MB

MD5
92a27fbdbebaaa01f96361e1f0d0280c

SHA1
3487fb0b2369f39ff2e60d38a32c38ce1115c3bd

SHA256
c4e3d14f2821461538c3ee5d03f8a7aa7abbf524893ecb85228d7ce163379cff

SHA512
f00aa981e05bcac05b3ccf46051eb8e49568ea53f28594d3665ecd849ecd474663376c2fc9cd95cfc25bb603c3d9140ef17d975c78f5fe7c88a19d8559dede0b

Download Submit
C:\Windows\System\OMojCBc.exe

Filesize
1.9MB

MD5
d32624dc30fd9b348bb36dc9fb7d58ec

SHA1
ca3399103b8b48d198bc587ac429f3374ee8e41a

SHA256
61be6cabe70b19f60e1d9991c5ba3aba75903a664995e3a6a5746bcad6452989

SHA512
54e1831e32d78a28b316368f152f109bfc5bc6092d974e912e04a8cb2c06c9b55e10830cd9086b5a825da3e45efbd9a28ffa99c2fd95939bea1b764e0c6cedb0

Download Submit
C:\Windows\System\SQoeMRj.exe

Filesize
1.9MB

MD5
ca134a64e0f236d9485c4427b0c0fe22

SHA1
0c3cc51a1deb0f45286fc68cd2ff13bac6b7e877

SHA256
e6d4a6bf599ac67d040e7aaf63710a9b178779e1fb20ca49135592e9448e7d00

SHA512
667807079edfe8e588dd4ef5e4b86ff16afa984b524d8fab091012ffaed46895145e9dad9a8cd687a5688f2cda7f40a45a4cd6dbfe5da80a016269f0aa4483db

Download Submit
C:\Windows\System\SYTXXhs.exe

Filesize
1.9MB

MD5
6d609c9f43b902ed8b28ead7bf084a9f

SHA1
fc771948ce850f1c498d5b8e400e329ed2f7f006

SHA256
be9019715427c12c8febdac356079ecabadff2eead4080e8f45008677c0b89d5

SHA512
ac67956ee3ed2abcc09551fc2bd9bf3c04511fc3386e24a319584ab23aa5be575778bb1c2502a3057a2ace8d870f18ffa68cb302af0a7dd03ca38912395c57ca

Download Submit
C:\Windows\System\SYiXwlz.exe

Filesize
2.0MB

MD5
964f9ec8e01a00fed70605f0fdefec36

SHA1
f059b2ab11e568a75ff3775c041015dcf8ae9b16

SHA256
5bdd5c25fb2706d530573ef5650a159948ecf0bb6166ff46dc519ec8e502f3b4

SHA512
9e2524ae83651cc0d328d8631c43a2759fc185fb9797f26ce8456ab167cd4a392b4b10514fba0078a8bf07fd64100c8665a1fc27a9e1e32d53a12c249d8515fd

Download Submit
C:\Windows\System\TLEEGQo.exe

Filesize
1.9MB

MD5
3cbabeb7f60039e1784c8c34c332661f

SHA1
58170f3abe1cfb369e01d32ad2ce7c12837b891c

SHA256
a924ba6d675ff93edec3f5d90489f42e45bdcc4f35e12007fbd03018d10e3c54

SHA512
3ff39d1c150816d9c88de9293d19908eafdf179f10c99a2263a77f09915311f04f08976e37ce6858d6686da897dfe3ba84ac447ba5422c9b48e53237ded4da7a

Download Submit
C:\Windows\System\WOOqmze.exe

Filesize
1.9MB

MD5
2f74eefa243da231598696a0c4c732fc

SHA1
ab003e64012873a43079d45fb73f6e295eea9bcb

SHA256
dddc2bb3bca0474868d3e668683b489475360c62b2be78d37c2ec123eafd3308

SHA512
5427560e4cc208a13354693eed9ad17752c080aa95c7d4461878654aa76b0d5e09cdc01e4e0f4ded1f3ff1b1666eee81dd8b71e103e2d0b741b62248e08c6a00

Download Submit
C:\Windows\System\XqKUiux.exe

Filesize
1.9MB

MD5
55f2c5b2471160c6ef383687376e4d05

SHA1
0cac2d27579e2a1be0ebc7ba784b123c6b7d71b3

SHA256
03d961340c49db311ecac16ecb6035c4270ed892ccb6a167ea434d292b1bf529

SHA512
336cbc35c461ae0f8f13dadf81ab18fdfc3dccb913cdde0b1603fa8b20ee4687b3636073519a50e94dc152e878099542100474b8df80946f86678aacb01a7379

Download Submit
C:\Windows\System\YEFokDH.exe

Filesize
1.9MB

MD5
e666719625735b7237aba19d5062a3cc

SHA1
a343c7c11c45ffedae9192fa1da51d846cafc4ae

SHA256
f7d0ea0f2cf8e346faa28588a31fefb93e21035f674d4b7419b553eba28c133f

SHA512
ee057190c28b76ac4a1da5dc9050512005021c1c2a29c7af00bcc8aa3fcf33aab8ab0d3af3fe6c63aeecfa7e6d4e8e02ad283e94a8eaf352f43251bc5273d69e

Download Submit
C:\Windows\System\YFtCZvI.exe

Filesize
1.9MB

MD5
b4e6f43be92dfd43e982d4f670832b06

SHA1
a3d7c48a904f84e5b6a8a123b0f2a731e9fe396d

SHA256
eabcd0c467f585b0a28fc148ac7ccf1701a49417eea7e6aa53476953e2ee5eb5

SHA512
bbc6026691bc03123d7f54f566c649998c804bc5ff471e79847ff744b46f05091f8ca19dea63f6378d9e3c6617482e70e8e153f4448bea0354fcf83d0e99bc95

Download Submit
C:\Windows\System\YYIWNWo.exe

Filesize
1.9MB

MD5
ab3b73766522b093eeeee8b034e08c8f

SHA1
85445417551144c33e03b6814bc9c929178eebde

SHA256
6c3f864a7fb132c1588185ac979a40e356f69871bf6cb52c9894c77476743121

SHA512
bd7df857e5442831ca4e39359bf287c14d5b22ea717c570f60a5d647a2dba4c6fd9ab1838a366d07333df75bae899fc682d69d7cde3cd7bd6b56664f4d5baec6

Download Submit
C:\Windows\System\chWSayU.exe

Filesize
1.9MB

MD5
cd6df5dc973d05f0fdbc403d1ce2b594

SHA1
73b12462b92f05cbd4a3470b5d6d2c25abda2ee7

SHA256
1cd9c0ab9ff916f453d8b74d2270375f90e0a297bd03c02ebc791b636a5cce0b

SHA512
b46932a6f10d37006e66d6a9fcf9695a31c4dd8cb2f84b00cfbb3a9f1619d62fc136c4e6a227bc2d5d8873f42e7b8fb0a8c58faf4aa995d5e3c65507691851a3

Download Submit
C:\Windows\System\couvsQE.exe

Filesize
1.9MB

MD5
ab6c0a56b2069c4a65b47454e12085d8

SHA1
11705dbc8f4306068cfdeb8f7fe0460898916713

SHA256
ff8de9c569f20becab4c876db2e9032a9bb886c2cf91c547894de986d3f1f164

SHA512
0e53b61aca78e3c826e747039f19467428fd31627f97665a6d3d37e8d5f1fb7055ea5df59ec9856051f303ba814c6393187823f055e2ae971a66313e0c0658b0

Download Submit
C:\Windows\System\dnmqTbW.exe

Filesize
1.9MB

MD5
c344d51272dd13ab0cb0a1b534190706

SHA1
d7e22fca54f28f3b05ecd4c7f9ba8b17a439da85

SHA256
2d7013548883cb4fb85f807ffecd79b7596ed4f286eed2191fa63c18140cef45

SHA512
5171091c1aa97eb9e3bc2104619caadc9d86b1e14dfb7a9069010833f1e5e400226ec097a973be96a53a99773937db34102054aedc5d351fe25b666fc9fc4b0e

Download Submit
C:\Windows\System\jakJvpy.exe

Filesize
1.9MB

MD5
45f2b867456a481616f80626b8b60c0a

SHA1
b45d3f12f1b867d4f09fdc954df96ba6fd63aec3

SHA256
806c16b794a4f713dd83510e9dee7d7fe671f87595fefb6ae87800ddcd5e399b

SHA512
ea8c0d9b9fa13b956963250035f41535a9eb5cd2195aaeaa18c7077bc928afa74c6b3d75a6b55d244934816dcb526bf8dc25025169629a05e96723d7587439e9

Download Submit
C:\Windows\System\reFdPjH.exe

Filesize
1.9MB

MD5
552c470b4c31c9cd681ec84801af60de

SHA1
0cff0fb66633c3dc4b9f09886d9a2d4f272e5eb7

SHA256
dd49c7e5d97715fba18b2c53b8a2ba0ae5239775813aae8e98be7c1bc65b398e

SHA512
240897c76ea19a59352f5dd675c5ef20390b5da6d246bb9abd513811176202ae478f04d6e820f6eb2656951a9ac6482056b9a5c3582f8d2c28cc90386a70af48

Download Submit
C:\Windows\System\tSlKIgB.exe

Filesize
1.9MB

MD5
12dfb47bc0c53f47798290152f0eda92

SHA1
e66375b343f9bed21b58ac546f71e6d66401dbed

SHA256
995c6ae5af4db6691048d9b72d9422ef958c1e796765870a3bc17a44c801bd97

SHA512
a5c36a10af4b650e3a1d527d4ca3b1b5048647d4c11fddd0a1258d4ea55ecbadb255d5fc42355032547524b95ada6e6553aebe139e82059e55addf02186239c8

Download Submit
C:\Windows\System\tVFZmBg.exe

Filesize
1.9MB

MD5
6c46ded51bd313219df593e469aeba1f

SHA1
b1351e49083967d9bdbdc6a7014fbdb702e85d7c

SHA256
fb934efa0ac1d0d500ed13a3564a9eba609f9721e61120c355e4cf1d07926ec9

SHA512
07520c826060a198a686c0e48acdc5c73283f296487fbc6890dec75d76431eb7ed6e685cef525e7d56a05a3eed6da39a3ab0d025767a48b836e26c93175aec5e

Download Submit
C:\Windows\System\txPyUDC.exe

Filesize
2.0MB

MD5
6928c6be3c7e71504cb988372c50bb68

SHA1
9e5e611302b064cc7c0263d0b1d5b6401fae5b4b

SHA256
a020e2f48db3959e2bdb2f1d1b5462ee403d678d2bd652c488fb3fd5c1c72c58

SHA512
024fccbedcdbed4f1a6a0782255a4b31babc16d285eaf72d46ae48e2396a037e9c4ef887a1bd5f95782a4484ccb132cee1ff3500e046102aa8d70e7fe5f6a7a6

Download Submit
C:\Windows\System\vYcsRRA.exe

Filesize
2.0MB

MD5
99f09259357c3dc0f64c5fa2cf994f65

SHA1
22ba6d443115a23872932c745425220a6a777961

SHA256
fc1cecd4fdbf3de010594f75785c6d0ddac08148ed7a9cf079d8cfd57ca3ef9c

SHA512
5fd6075592b209aef8291c4cc3405a8660681af0fe42b01e46c4726ab886d9d09c93d4f439f6ce4194dfc71d0c045aa26057c8269679b7b5021f9a013cadc2e5

Download Submit
C:\Windows\System\vlOGlGQ.exe

Filesize
1.9MB

MD5
e43c0683005dcd31e5b2c5e136305ac1

SHA1
04102d84350a2e312a87fbe09c581ba333b05569

SHA256
3c68131a6adc9a39638660f3e855aa8e09bed5c3f48d18154d399a9ca6dd8c37

SHA512
2fb2465abdc902e1988cb5b4f61c0defc12be07d5bad6b397603b89f26b0bf8da0426a9d4b02e8765fb7c36a3b0f3d4eb184e57847c01241660780cec1186d45

Download Submit
C:\Windows\System\xWVHjJu.exe

Filesize
1.9MB

MD5
5e132cfb3881808be1e8a416bdfc4c80

SHA1
527f361d929a15bd47eecb79d089e512cac93ca2

SHA256
ae4a5a724a8f7c45f966b286b7f1d5a5f40901f11374dc2621e13d5faad8f605

SHA512
4462918118002f84013a82f00a9bd78297d128d9fd71b97962b3e5c54bb400c3caf4ecf7c4511169db1100d054c6f4a86790f76f524292564bb87bfb98ce0538

Download Submit
C:\Windows\System\xlzUmlv.exe

Filesize
2.0MB

MD5
7e36a025fac51d95f8d446576613b449

SHA1
a6da462f74b75e59a5699faf38cdc3d6ce2f11fb

SHA256
bede24944aad5b0d0359a2f4dff3b55c764624c0a85b45fb9f702bb42d8a9caf

SHA512
cce12d246493f957ee762313a540faef4708c1ac1013832ce20ba155dcdcbd9cc1df1a197fecf064f2a72df6f0455b2a0af5cc8e5f3d64f97150ac4bd95c0f8f

Download Submit
C:\Windows\System\yJBUUAj.exe

Filesize
1.9MB

MD5
03df03cae2b567b801d02790148093cd

SHA1
eed1c6554cdc5eea9164e148c887bdf9d1065a2c

SHA256
1731bada9bd9faec4567f289ccb85b912d40fb23982d1f38026d406e70b0a2a9

SHA512
d885a7d77ce9bf096c482102113eb5e093ab9f4b476a3f03507456820cb909e7d330cd3217da411703ec95e714798300fc4bdb18f905858f011f99cecb8cc708

Download Submit
memory/1000-316-0x00007FF60B4D0000-0x00007FF60B824000-memory.dmp

Filesize
3.3MB

Download
memory/1000-2054-0x00007FF60B4D0000-0x00007FF60B824000-memory.dmp

Filesize
3.3MB

Download
memory/1284-20-0x00007FF7A51D0000-0x00007FF7A5524000-memory.dmp

Filesize
3.3MB

Download
memory/1284-2031-0x00007FF7A51D0000-0x00007FF7A5524000-memory.dmp

Filesize
3.3MB

Download
memory/1324-2035-0x00007FF7F8DD0000-0x00007FF7F9124000-memory.dmp

Filesize
3.3MB

Download
memory/1324-281-0x00007FF7F8DD0000-0x00007FF7F9124000-memory.dmp

Filesize
3.3MB

Download
memory/1560-310-0x00007FF61CD40000-0x00007FF61D094000-memory.dmp

Filesize
3.3MB

Download
memory/1560-2052-0x00007FF61CD40000-0x00007FF61D094000-memory.dmp

Filesize
3.3MB

Download
memory/1636-26-0x00007FF77D9B0000-0x00007FF77DD04000-memory.dmp

Filesize
3.3MB

Download
memory/1636-2032-0x00007FF77D9B0000-0x00007FF77DD04000-memory.dmp

Filesize
3.3MB

Download
memory/1672-294-0x00007FF638F40000-0x00007FF639294000-memory.dmp

Filesize
3.3MB

Download
memory/1672-2042-0x00007FF638F40000-0x00007FF639294000-memory.dmp

Filesize
3.3MB

Download
memory/1812-2043-0x00007FF68F610000-0x00007FF68F964000-memory.dmp

Filesize
3.3MB

Download
memory/1812-295-0x00007FF68F610000-0x00007FF68F964000-memory.dmp

Filesize
3.3MB

Download
memory/2148-311-0x00007FF74C1E0000-0x00007FF74C534000-memory.dmp

Filesize
3.3MB

Download
memory/2148-2051-0x00007FF74C1E0000-0x00007FF74C534000-memory.dmp

Filesize
3.3MB

Download
memory/2264-314-0x00007FF6F9030000-0x00007FF6F9384000-memory.dmp

Filesize
3.3MB

Download
memory/2264-2050-0x00007FF6F9030000-0x00007FF6F9384000-memory.dmp

Filesize
3.3MB

Download
memory/2556-297-0x00007FF774DD0000-0x00007FF775124000-memory.dmp

Filesize
3.3MB

Download
memory/2556-2045-0x00007FF774DD0000-0x00007FF775124000-memory.dmp

Filesize
3.3MB

Download
memory/2780-2037-0x00007FF6B4AB0000-0x00007FF6B4E04000-memory.dmp

Filesize
3.3MB

Download
memory/2780-287-0x00007FF6B4AB0000-0x00007FF6B4E04000-memory.dmp

Filesize
3.3MB

Download
memory/2796-2036-0x00007FF663F10000-0x00007FF664264000-memory.dmp

Filesize
3.3MB

Download
memory/2796-283-0x00007FF663F10000-0x00007FF664264000-memory.dmp

Filesize
3.3MB

Download
memory/2876-16-0x00007FF620F40000-0x00007FF621294000-memory.dmp

Filesize
3.3MB

Download
memory/2876-2030-0x00007FF620F40000-0x00007FF621294000-memory.dmp

Filesize
3.3MB

Download
memory/3336-302-0x00007FF7633F0000-0x00007FF763744000-memory.dmp

Filesize
3.3MB

Download
memory/3336-2048-0x00007FF7633F0000-0x00007FF763744000-memory.dmp

Filesize
3.3MB

Download
memory/3364-320-0x00007FF7282B0000-0x00007FF728604000-memory.dmp

Filesize
3.3MB

Download
memory/3364-2034-0x00007FF7282B0000-0x00007FF728604000-memory.dmp

Filesize
3.3MB

Download
memory/3372-2049-0x00007FF7C81E0000-0x00007FF7C8534000-memory.dmp

Filesize
3.3MB

Download
memory/3372-315-0x00007FF7C81E0000-0x00007FF7C8534000-memory.dmp

Filesize
3.3MB

Download
memory/3524-2038-0x00007FF686FA0000-0x00007FF6872F4000-memory.dmp

Filesize
3.3MB

Download
memory/3524-289-0x00007FF686FA0000-0x00007FF6872F4000-memory.dmp

Filesize
3.3MB

Download
memory/3656-317-0x00007FF724BD0000-0x00007FF724F24000-memory.dmp

Filesize
3.3MB

Download
memory/3656-2053-0x00007FF724BD0000-0x00007FF724F24000-memory.dmp

Filesize
3.3MB

Download
memory/3744-319-0x00007FF732750000-0x00007FF732AA4000-memory.dmp

Filesize
3.3MB

Download
memory/3744-2058-0x00007FF732750000-0x00007FF732AA4000-memory.dmp

Filesize
3.3MB

Download
memory/3940-2047-0x00007FF7684E0000-0x00007FF768834000-memory.dmp

Filesize
3.3MB

Download
memory/3940-301-0x00007FF7684E0000-0x00007FF768834000-memory.dmp

Filesize
3.3MB

Download
memory/3948-312-0x00007FF7FC550000-0x00007FF7FC8A4000-memory.dmp

Filesize
3.3MB

Download
memory/3948-2055-0x00007FF7FC550000-0x00007FF7FC8A4000-memory.dmp

Filesize
3.3MB

Download
memory/4152-2056-0x00007FF787A20000-0x00007FF787D74000-memory.dmp

Filesize
3.3MB

Download
memory/4152-306-0x00007FF787A20000-0x00007FF787D74000-memory.dmp

Filesize
3.3MB

Download
memory/4428-8-0x00007FF7126F0000-0x00007FF712A44000-memory.dmp

Filesize
3.3MB

Download
memory/4428-2029-0x00007FF7126F0000-0x00007FF712A44000-memory.dmp

Filesize
3.3MB

Download
memory/4468-2057-0x00007FF7071F0000-0x00007FF707544000-memory.dmp

Filesize
3.3MB

Download
memory/4468-318-0x00007FF7071F0000-0x00007FF707544000-memory.dmp

Filesize
3.3MB

Download
memory/4504-1-0x0000023FB7990000-0x0000023FB79A0000-memory.dmp

Filesize
64KB

Download
memory/4504-0-0x00007FF7832C0000-0x00007FF783614000-memory.dmp

Filesize
3.3MB

Download
memory/4504-2033-0x00007FF7832C0000-0x00007FF783614000-memory.dmp

Filesize
3.3MB

Download
memory/4612-291-0x00007FF7924D0000-0x00007FF792824000-memory.dmp

Filesize
3.3MB

Download
memory/4612-2040-0x00007FF7924D0000-0x00007FF792824000-memory.dmp

Filesize
3.3MB

Download
memory/4628-290-0x00007FF7D53D0000-0x00007FF7D5724000-memory.dmp

Filesize
3.3MB

Download
memory/4628-2039-0x00007FF7D53D0000-0x00007FF7D5724000-memory.dmp

Filesize
3.3MB

Download
memory/4912-2046-0x00007FF62F2F0000-0x00007FF62F644000-memory.dmp

Filesize
3.3MB

Download
memory/4912-298-0x00007FF62F2F0000-0x00007FF62F644000-memory.dmp

Filesize
3.3MB

Download
memory/4952-296-0x00007FF66C690000-0x00007FF66C9E4000-memory.dmp

Filesize
3.3MB

Download
memory/4952-2044-0x00007FF66C690000-0x00007FF66C9E4000-memory.dmp

Filesize
3.3MB

Download
memory/5040-292-0x00007FF74E300000-0x00007FF74E654000-memory.dmp

Filesize
3.3MB

Download
memory/5040-2041-0x00007FF74E300000-0x00007FF74E654000-memory.dmp

Filesize
3.3MB

Download