xmrig | 642c253ee2ec8b680a63d22a3a175aa12d431518178b859b5819ff186899ad78

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 04:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
Size

2.1MB
MD5

8e5386bd0551d2f4cb975666f7784350
SHA1

320309311dc2cd844987ce4ee23a696a8bc087da
SHA256

642c253ee2ec8b680a63d22a3a175aa12d431518178b859b5819ff186899ad78
SHA512

0b2c6d62cb51ffe47eeb9bc0f9f66c424872a4aeb33c0613f2ac7b1b3add05d1d73d73d4de5bb23a108c945c1b6a3663d1f5b078a069dc276b844df9d734b680
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+AjE6p6hzuukWI:BemTLkNdfE0pZr4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4412-0-0x00007FF694260000-0x00007FF6945B4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023260-4.dat	xmrig
behavioral2/memory/2836-8-0x00007FF7FD290000-0x00007FF7FD5E4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023266-11.dat	xmrig
behavioral2/files/0x0007000000023267-10.dat	xmrig
behavioral2/memory/2292-14-0x00007FF77A190000-0x00007FF77A4E4000-memory.dmp	xmrig
behavioral2/memory/2644-20-0x00007FF783CC0000-0x00007FF784014000-memory.dmp	xmrig
behavioral2/files/0x0008000000023265-22.dat	xmrig
behavioral2/memory/2496-26-0x00007FF607520000-0x00007FF607874000-memory.dmp	xmrig
behavioral2/files/0x0007000000023268-28.dat	xmrig
behavioral2/files/0x0007000000023269-36.dat	xmrig
behavioral2/memory/3656-38-0x00007FF68A3A0000-0x00007FF68A6F4000-memory.dmp	xmrig
behavioral2/memory/4548-34-0x00007FF778D60000-0x00007FF7790B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002326b-40.dat	xmrig
behavioral2/memory/3724-43-0x00007FF67C7F0000-0x00007FF67CB44000-memory.dmp	xmrig
behavioral2/files/0x000700000002326d-49.dat	xmrig
behavioral2/files/0x000700000002326c-54.dat	xmrig
behavioral2/files/0x000700000002326e-55.dat	xmrig
behavioral2/memory/5000-61-0x00007FF794410000-0x00007FF794764000-memory.dmp	xmrig
behavioral2/files/0x000700000002326f-64.dat	xmrig
behavioral2/memory/4412-65-0x00007FF694260000-0x00007FF6945B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023270-73.dat	xmrig
behavioral2/files/0x0007000000023271-77.dat	xmrig
behavioral2/files/0x0007000000023272-82.dat	xmrig
behavioral2/files/0x0007000000023274-93.dat	xmrig
behavioral2/files/0x0007000000023276-103.dat	xmrig
behavioral2/files/0x0007000000023279-121.dat	xmrig
behavioral2/files/0x000700000002327c-130.dat	xmrig
behavioral2/files/0x000700000002327b-131.dat	xmrig
behavioral2/files/0x000700000002327e-142.dat	xmrig
behavioral2/files/0x0007000000023281-163.dat	xmrig
behavioral2/files/0x0007000000023284-176.dat	xmrig
behavioral2/memory/2836-534-0x00007FF7FD290000-0x00007FF7FD5E4000-memory.dmp	xmrig
behavioral2/memory/3680-547-0x00007FF61A560000-0x00007FF61A8B4000-memory.dmp	xmrig
behavioral2/memory/1852-551-0x00007FF64F480000-0x00007FF64F7D4000-memory.dmp	xmrig
behavioral2/memory/3456-578-0x00007FF7F0420000-0x00007FF7F0774000-memory.dmp	xmrig
behavioral2/memory/5024-566-0x00007FF7745C0000-0x00007FF774914000-memory.dmp	xmrig
behavioral2/memory/2280-560-0x00007FF7360F0000-0x00007FF736444000-memory.dmp	xmrig
behavioral2/memory/3668-584-0x00007FF789AC0000-0x00007FF789E14000-memory.dmp	xmrig
behavioral2/memory/4224-597-0x00007FF7715D0000-0x00007FF771924000-memory.dmp	xmrig
behavioral2/memory/3944-620-0x00007FF73E370000-0x00007FF73E6C4000-memory.dmp	xmrig
behavioral2/memory/1888-625-0x00007FF6EF7D0000-0x00007FF6EFB24000-memory.dmp	xmrig
behavioral2/memory/4684-628-0x00007FF6A8B70000-0x00007FF6A8EC4000-memory.dmp	xmrig
behavioral2/memory/2040-632-0x00007FF7CBC50000-0x00007FF7CBFA4000-memory.dmp	xmrig
behavioral2/memory/1864-631-0x00007FF68BBD0000-0x00007FF68BF24000-memory.dmp	xmrig
behavioral2/memory/2240-637-0x00007FF6B7090000-0x00007FF6B73E4000-memory.dmp	xmrig
behavioral2/memory/2472-639-0x00007FF725130000-0x00007FF725484000-memory.dmp	xmrig
behavioral2/memory/2464-614-0x00007FF6D5730000-0x00007FF6D5A84000-memory.dmp	xmrig
behavioral2/memory/3328-612-0x00007FF7DFC50000-0x00007FF7DFFA4000-memory.dmp	xmrig
behavioral2/memory/2172-601-0x00007FF7FE2B0000-0x00007FF7FE604000-memory.dmp	xmrig
behavioral2/memory/3216-593-0x00007FF78CB20000-0x00007FF78CE74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023285-173.dat	xmrig
behavioral2/files/0x0007000000023282-168.dat	xmrig
behavioral2/files/0x0007000000023283-165.dat	xmrig
behavioral2/files/0x0007000000023280-158.dat	xmrig
behavioral2/files/0x000700000002327f-153.dat	xmrig
behavioral2/files/0x000700000002327d-138.dat	xmrig
behavioral2/files/0x000700000002327a-126.dat	xmrig
behavioral2/files/0x0007000000023278-116.dat	xmrig
behavioral2/files/0x0007000000023277-111.dat	xmrig
behavioral2/files/0x0007000000023275-98.dat	xmrig
behavioral2/files/0x0007000000023273-91.dat	xmrig
behavioral2/memory/2928-67-0x00007FF766DE0000-0x00007FF767134000-memory.dmp	xmrig
behavioral2/memory/4400-57-0x00007FF7FF2F0000-0x00007FF7FF644000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2836	jNeBwWg.exe
2292	CHEoFKQ.exe
2644	SJaTYVp.exe
2496	fturyXN.exe
4548	IHVPwIr.exe
3656	pPEakvp.exe
3724	HyHERvA.exe
2932	yNKnxWr.exe
5000	nkPgOGo.exe
4400	XVrIoJF.exe
2928	ftsJPJz.exe
3680	KQAYaHX.exe
1852	kksyZYN.exe
2280	bjyQkVB.exe
5024	CFioFyw.exe
3456	GntaZxO.exe
3668	XCiuKYP.exe
3216	jLLrdgC.exe
4224	AHdjYrJ.exe
2172	JycpLzv.exe
3328	IHOibKL.exe
2464	rmLcECb.exe
3944	fwUTXuy.exe
1888	tLzNkqz.exe
4684	sjaneNR.exe
1864	ridecQe.exe
2040	FnFRrRr.exe
2240	lLDDgif.exe
2472	xLsuUSk.exe
2452	igNWfvr.exe
2252	LsQYQli.exe
4304	RaDmqOA.exe
4228	ooZoVDG.exe
4588	CntkvJq.exe
3580	yQyxUHJ.exe
1208	UBJDdGo.exe
1220	UDHsLBk.exe
1388	WvQjdoQ.exe
732	YtkwPvD.exe
4212	vSBMVkd.exe
3176	FSxDREa.exe
2028	CLRxPxk.exe
1876	oVuBEYx.exe
2876	PDLKSKc.exe
764	wGXNWnW.exe
1952	EvYPLls.exe
3208	GxZPIlW.exe
3280	hvOEAht.exe
2924	FYcqmwE.exe
4560	eyDenOE.exe
1708	UPAShFk.exe
4324	JysqqVH.exe
3556	LwXDGMW.exe
3068	pcGJBqB.exe
2064	ygOPVLQ.exe
4540	poIwDXS.exe
880	SUPkjup.exe
3292	fyhaWbP.exe
3952	AfokSUF.exe
3696	vlRKpNm.exe
4816	kDdIVro.exe
5136	SFQYxwv.exe
5168	FrHkGHv.exe
5196	GWbYFTa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4412-0-0x00007FF694260000-0x00007FF6945B4000-memory.dmp	upx
behavioral2/files/0x0008000000023260-4.dat	upx
behavioral2/memory/2836-8-0x00007FF7FD290000-0x00007FF7FD5E4000-memory.dmp	upx
behavioral2/files/0x0009000000023266-11.dat	upx
behavioral2/files/0x0007000000023267-10.dat	upx
behavioral2/memory/2292-14-0x00007FF77A190000-0x00007FF77A4E4000-memory.dmp	upx
behavioral2/memory/2644-20-0x00007FF783CC0000-0x00007FF784014000-memory.dmp	upx
behavioral2/files/0x0008000000023265-22.dat	upx
behavioral2/memory/2496-26-0x00007FF607520000-0x00007FF607874000-memory.dmp	upx
behavioral2/files/0x0007000000023268-28.dat	upx
behavioral2/files/0x0007000000023269-36.dat	upx
behavioral2/memory/3656-38-0x00007FF68A3A0000-0x00007FF68A6F4000-memory.dmp	upx
behavioral2/memory/4548-34-0x00007FF778D60000-0x00007FF7790B4000-memory.dmp	upx
behavioral2/files/0x000700000002326b-40.dat	upx
behavioral2/memory/3724-43-0x00007FF67C7F0000-0x00007FF67CB44000-memory.dmp	upx
behavioral2/files/0x000700000002326d-49.dat	upx
behavioral2/files/0x000700000002326c-54.dat	upx
behavioral2/files/0x000700000002326e-55.dat	upx
behavioral2/memory/5000-61-0x00007FF794410000-0x00007FF794764000-memory.dmp	upx
behavioral2/files/0x000700000002326f-64.dat	upx
behavioral2/memory/4412-65-0x00007FF694260000-0x00007FF6945B4000-memory.dmp	upx
behavioral2/files/0x0007000000023270-73.dat	upx
behavioral2/files/0x0007000000023271-77.dat	upx
behavioral2/files/0x0007000000023272-82.dat	upx
behavioral2/files/0x0007000000023274-93.dat	upx
behavioral2/files/0x0007000000023276-103.dat	upx
behavioral2/files/0x0007000000023279-121.dat	upx
behavioral2/files/0x000700000002327c-130.dat	upx
behavioral2/files/0x000700000002327b-131.dat	upx
behavioral2/files/0x000700000002327e-142.dat	upx
behavioral2/files/0x0007000000023281-163.dat	upx
behavioral2/files/0x0007000000023284-176.dat	upx
behavioral2/memory/2836-534-0x00007FF7FD290000-0x00007FF7FD5E4000-memory.dmp	upx
behavioral2/memory/3680-547-0x00007FF61A560000-0x00007FF61A8B4000-memory.dmp	upx
behavioral2/memory/1852-551-0x00007FF64F480000-0x00007FF64F7D4000-memory.dmp	upx
behavioral2/memory/3456-578-0x00007FF7F0420000-0x00007FF7F0774000-memory.dmp	upx
behavioral2/memory/5024-566-0x00007FF7745C0000-0x00007FF774914000-memory.dmp	upx
behavioral2/memory/2280-560-0x00007FF7360F0000-0x00007FF736444000-memory.dmp	upx
behavioral2/memory/3668-584-0x00007FF789AC0000-0x00007FF789E14000-memory.dmp	upx
behavioral2/memory/4224-597-0x00007FF7715D0000-0x00007FF771924000-memory.dmp	upx
behavioral2/memory/3944-620-0x00007FF73E370000-0x00007FF73E6C4000-memory.dmp	upx
behavioral2/memory/1888-625-0x00007FF6EF7D0000-0x00007FF6EFB24000-memory.dmp	upx
behavioral2/memory/4684-628-0x00007FF6A8B70000-0x00007FF6A8EC4000-memory.dmp	upx
behavioral2/memory/2040-632-0x00007FF7CBC50000-0x00007FF7CBFA4000-memory.dmp	upx
behavioral2/memory/1864-631-0x00007FF68BBD0000-0x00007FF68BF24000-memory.dmp	upx
behavioral2/memory/2240-637-0x00007FF6B7090000-0x00007FF6B73E4000-memory.dmp	upx
behavioral2/memory/2472-639-0x00007FF725130000-0x00007FF725484000-memory.dmp	upx
behavioral2/memory/2464-614-0x00007FF6D5730000-0x00007FF6D5A84000-memory.dmp	upx
behavioral2/memory/3328-612-0x00007FF7DFC50000-0x00007FF7DFFA4000-memory.dmp	upx
behavioral2/memory/2172-601-0x00007FF7FE2B0000-0x00007FF7FE604000-memory.dmp	upx
behavioral2/memory/3216-593-0x00007FF78CB20000-0x00007FF78CE74000-memory.dmp	upx
behavioral2/files/0x0007000000023285-173.dat	upx
behavioral2/files/0x0007000000023282-168.dat	upx
behavioral2/files/0x0007000000023283-165.dat	upx
behavioral2/files/0x0007000000023280-158.dat	upx
behavioral2/files/0x000700000002327f-153.dat	upx
behavioral2/files/0x000700000002327d-138.dat	upx
behavioral2/files/0x000700000002327a-126.dat	upx
behavioral2/files/0x0007000000023278-116.dat	upx
behavioral2/files/0x0007000000023277-111.dat	upx
behavioral2/files/0x0007000000023275-98.dat	upx
behavioral2/files/0x0007000000023273-91.dat	upx
behavioral2/memory/2928-67-0x00007FF766DE0000-0x00007FF767134000-memory.dmp	upx
behavioral2/memory/4400-57-0x00007FF7FF2F0000-0x00007FF7FF644000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jmOnGGs.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\CgBXLpp.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\WcccAsZ.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\ASxMPwi.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\oxEqmKl.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\UnxQJgt.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\PSrudlw.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\QOdRHob.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\IRWHKZR.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\DMSOZog.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\lDDVdOn.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\JyORlbi.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\irPmmch.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\ubUixZZ.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\kYVqxzv.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\zQZkPRR.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\ftsJPJz.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\FrHkGHv.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\wzLdUYT.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\TtLXkDd.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\UGiPrHu.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\xrKINLE.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\iwTPAHv.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\NzRUakK.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\MEfKrQA.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\zuyKHMM.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\AbTlzrb.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\zEyNQqm.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\wQUrXvU.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\VAQQWzy.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\GELjVgz.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\WQhmNnh.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\fybqDAp.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\JvdMayb.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\ehEmwkz.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\qarZrab.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\aZEqFTv.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\ZEoNLMl.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\TpKoiND.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\aqNDYoa.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\ESNHBlv.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\KRivpFc.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\zxhywxA.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\IRosgku.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\fYwUYEs.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\XvSieLQ.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\YLRXvdT.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\KagFomp.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\ZBbCMzw.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\BfQeUKX.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\xWOXvJc.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\rgESHBB.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\KQAYaHX.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\AlBlBDP.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\aBAopCq.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\aeYCBHP.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\lNAGoTd.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\oKglEWA.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\ihRPlsZ.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\oapuAVF.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\ryGFcPh.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\dxfcmsv.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\fPVtvHG.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
File created	C:\Windows\System\NLJEsfi.exe	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2836	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	92
PID 4412 wrote to memory of 2836	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	92
PID 4412 wrote to memory of 2292	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	93
PID 4412 wrote to memory of 2292	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	93
PID 4412 wrote to memory of 2644	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	94
PID 4412 wrote to memory of 2644	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	94
PID 4412 wrote to memory of 2496	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	95
PID 4412 wrote to memory of 2496	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	95
PID 4412 wrote to memory of 4548	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	96
PID 4412 wrote to memory of 4548	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	96
PID 4412 wrote to memory of 3656	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	97
PID 4412 wrote to memory of 3656	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	97
PID 4412 wrote to memory of 3724	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	98
PID 4412 wrote to memory of 3724	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	98
PID 4412 wrote to memory of 5000	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	99
PID 4412 wrote to memory of 5000	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	99
PID 4412 wrote to memory of 2932	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	100
PID 4412 wrote to memory of 2932	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	100
PID 4412 wrote to memory of 4400	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	101
PID 4412 wrote to memory of 4400	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	101
PID 4412 wrote to memory of 2928	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	102
PID 4412 wrote to memory of 2928	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	102
PID 4412 wrote to memory of 3680	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	103
PID 4412 wrote to memory of 3680	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	103
PID 4412 wrote to memory of 1852	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	104
PID 4412 wrote to memory of 1852	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	104
PID 4412 wrote to memory of 2280	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	105
PID 4412 wrote to memory of 2280	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	105
PID 4412 wrote to memory of 5024	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	106
PID 4412 wrote to memory of 5024	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	106
PID 4412 wrote to memory of 3456	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	107
PID 4412 wrote to memory of 3456	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	107
PID 4412 wrote to memory of 3668	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	108
PID 4412 wrote to memory of 3668	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	108
PID 4412 wrote to memory of 3216	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	109
PID 4412 wrote to memory of 3216	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	109
PID 4412 wrote to memory of 4224	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	110
PID 4412 wrote to memory of 4224	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	110
PID 4412 wrote to memory of 2172	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	111
PID 4412 wrote to memory of 2172	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	111
PID 4412 wrote to memory of 3328	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	112
PID 4412 wrote to memory of 3328	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	112
PID 4412 wrote to memory of 2464	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	113
PID 4412 wrote to memory of 2464	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	113
PID 4412 wrote to memory of 3944	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	114
PID 4412 wrote to memory of 3944	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	114
PID 4412 wrote to memory of 1888	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	115
PID 4412 wrote to memory of 1888	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	115
PID 4412 wrote to memory of 4684	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	116
PID 4412 wrote to memory of 4684	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	116
PID 4412 wrote to memory of 1864	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	117
PID 4412 wrote to memory of 1864	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	117
PID 4412 wrote to memory of 2040	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	118
PID 4412 wrote to memory of 2040	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	118
PID 4412 wrote to memory of 2240	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	119
PID 4412 wrote to memory of 2240	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	119
PID 4412 wrote to memory of 2472	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	120
PID 4412 wrote to memory of 2472	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	120
PID 4412 wrote to memory of 2452	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	121
PID 4412 wrote to memory of 2452	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	121
PID 4412 wrote to memory of 2252	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	122
PID 4412 wrote to memory of 2252	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	122
PID 4412 wrote to memory of 4304	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	123
PID 4412 wrote to memory of 4304	4412	8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8e5386bd0551d2f4cb975666f7784350_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\System\jNeBwWg.exe
  C:\Windows\System\jNeBwWg.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\CHEoFKQ.exe
  C:\Windows\System\CHEoFKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\SJaTYVp.exe
  C:\Windows\System\SJaTYVp.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\fturyXN.exe
  C:\Windows\System\fturyXN.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\IHVPwIr.exe
  C:\Windows\System\IHVPwIr.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\pPEakvp.exe
  C:\Windows\System\pPEakvp.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\HyHERvA.exe
  C:\Windows\System\HyHERvA.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\nkPgOGo.exe
  C:\Windows\System\nkPgOGo.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\yNKnxWr.exe
  C:\Windows\System\yNKnxWr.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\XVrIoJF.exe
  C:\Windows\System\XVrIoJF.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\ftsJPJz.exe
  C:\Windows\System\ftsJPJz.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\KQAYaHX.exe
  C:\Windows\System\KQAYaHX.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\kksyZYN.exe
  C:\Windows\System\kksyZYN.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\bjyQkVB.exe
  C:\Windows\System\bjyQkVB.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\CFioFyw.exe
  C:\Windows\System\CFioFyw.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\GntaZxO.exe
  C:\Windows\System\GntaZxO.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\XCiuKYP.exe
  C:\Windows\System\XCiuKYP.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\jLLrdgC.exe
  C:\Windows\System\jLLrdgC.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\AHdjYrJ.exe
  C:\Windows\System\AHdjYrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\JycpLzv.exe
  C:\Windows\System\JycpLzv.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\IHOibKL.exe
  C:\Windows\System\IHOibKL.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\rmLcECb.exe
  C:\Windows\System\rmLcECb.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\fwUTXuy.exe
  C:\Windows\System\fwUTXuy.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\tLzNkqz.exe
  C:\Windows\System\tLzNkqz.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\sjaneNR.exe
  C:\Windows\System\sjaneNR.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\ridecQe.exe
  C:\Windows\System\ridecQe.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\FnFRrRr.exe
  C:\Windows\System\FnFRrRr.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\lLDDgif.exe
  C:\Windows\System\lLDDgif.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\xLsuUSk.exe
  C:\Windows\System\xLsuUSk.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\igNWfvr.exe
  C:\Windows\System\igNWfvr.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\LsQYQli.exe
  C:\Windows\System\LsQYQli.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\RaDmqOA.exe
  C:\Windows\System\RaDmqOA.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\ooZoVDG.exe
  C:\Windows\System\ooZoVDG.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\CntkvJq.exe
  C:\Windows\System\CntkvJq.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\yQyxUHJ.exe
  C:\Windows\System\yQyxUHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\UBJDdGo.exe
  C:\Windows\System\UBJDdGo.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\UDHsLBk.exe
  C:\Windows\System\UDHsLBk.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\WvQjdoQ.exe
  C:\Windows\System\WvQjdoQ.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\YtkwPvD.exe
  C:\Windows\System\YtkwPvD.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\vSBMVkd.exe
  C:\Windows\System\vSBMVkd.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\FSxDREa.exe
  C:\Windows\System\FSxDREa.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\CLRxPxk.exe
  C:\Windows\System\CLRxPxk.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\oVuBEYx.exe
  C:\Windows\System\oVuBEYx.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\PDLKSKc.exe
  C:\Windows\System\PDLKSKc.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\wGXNWnW.exe
  C:\Windows\System\wGXNWnW.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\EvYPLls.exe
  C:\Windows\System\EvYPLls.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\GxZPIlW.exe
  C:\Windows\System\GxZPIlW.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\hvOEAht.exe
  C:\Windows\System\hvOEAht.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\FYcqmwE.exe
  C:\Windows\System\FYcqmwE.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\eyDenOE.exe
  C:\Windows\System\eyDenOE.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\UPAShFk.exe
  C:\Windows\System\UPAShFk.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\JysqqVH.exe
  C:\Windows\System\JysqqVH.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\LwXDGMW.exe
  C:\Windows\System\LwXDGMW.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\pcGJBqB.exe
  C:\Windows\System\pcGJBqB.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\ygOPVLQ.exe
  C:\Windows\System\ygOPVLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\poIwDXS.exe
  C:\Windows\System\poIwDXS.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\SUPkjup.exe
  C:\Windows\System\SUPkjup.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\fyhaWbP.exe
  C:\Windows\System\fyhaWbP.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\AfokSUF.exe
  C:\Windows\System\AfokSUF.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\vlRKpNm.exe
  C:\Windows\System\vlRKpNm.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\kDdIVro.exe
  C:\Windows\System\kDdIVro.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\SFQYxwv.exe
  C:\Windows\System\SFQYxwv.exe
  2⤵
  - Executes dropped EXE
  PID:5136
- C:\Windows\System\FrHkGHv.exe
  C:\Windows\System\FrHkGHv.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\GWbYFTa.exe
  C:\Windows\System\GWbYFTa.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\ZqRRGLq.exe
  C:\Windows\System\ZqRRGLq.exe
  2⤵
  PID:5236
- C:\Windows\System\tahDqPb.exe
  C:\Windows\System\tahDqPb.exe
  2⤵
  PID:5260
- C:\Windows\System\ZXFeicj.exe
  C:\Windows\System\ZXFeicj.exe
  2⤵
  PID:5276
- C:\Windows\System\eQYMyXS.exe
  C:\Windows\System\eQYMyXS.exe
  2⤵
  PID:5304
- C:\Windows\System\rOMTupS.exe
  C:\Windows\System\rOMTupS.exe
  2⤵
  PID:5332
- C:\Windows\System\rZUFpQq.exe
  C:\Windows\System\rZUFpQq.exe
  2⤵
  PID:5360
- C:\Windows\System\zxhywxA.exe
  C:\Windows\System\zxhywxA.exe
  2⤵
  PID:5388
- C:\Windows\System\IRosgku.exe
  C:\Windows\System\IRosgku.exe
  2⤵
  PID:5440
- C:\Windows\System\BEVFpeR.exe
  C:\Windows\System\BEVFpeR.exe
  2⤵
  PID:5460
- C:\Windows\System\IYYMNcn.exe
  C:\Windows\System\IYYMNcn.exe
  2⤵
  PID:5496
- C:\Windows\System\jUyXYNI.exe
  C:\Windows\System\jUyXYNI.exe
  2⤵
  PID:5512
- C:\Windows\System\wzLdUYT.exe
  C:\Windows\System\wzLdUYT.exe
  2⤵
  PID:5548
- C:\Windows\System\bbdeJcN.exe
  C:\Windows\System\bbdeJcN.exe
  2⤵
  PID:5572
- C:\Windows\System\YCNIrAQ.exe
  C:\Windows\System\YCNIrAQ.exe
  2⤵
  PID:5588
- C:\Windows\System\BVvqgRh.exe
  C:\Windows\System\BVvqgRh.exe
  2⤵
  PID:5604
- C:\Windows\System\fnDVWBU.exe
  C:\Windows\System\fnDVWBU.exe
  2⤵
  PID:5632
- C:\Windows\System\yzWccNZ.exe
  C:\Windows\System\yzWccNZ.exe
  2⤵
  PID:5660
- C:\Windows\System\qacNdBM.exe
  C:\Windows\System\qacNdBM.exe
  2⤵
  PID:5688
- C:\Windows\System\BLtAyVY.exe
  C:\Windows\System\BLtAyVY.exe
  2⤵
  PID:5716
- C:\Windows\System\LiKjdRf.exe
  C:\Windows\System\LiKjdRf.exe
  2⤵
  PID:5744
- C:\Windows\System\ulMUnez.exe
  C:\Windows\System\ulMUnez.exe
  2⤵
  PID:5768
- C:\Windows\System\tWQuubA.exe
  C:\Windows\System\tWQuubA.exe
  2⤵
  PID:5796
- C:\Windows\System\SQlRmIf.exe
  C:\Windows\System\SQlRmIf.exe
  2⤵
  PID:5828
- C:\Windows\System\fYwUYEs.exe
  C:\Windows\System\fYwUYEs.exe
  2⤵
  PID:5856
- C:\Windows\System\dnIFjpA.exe
  C:\Windows\System\dnIFjpA.exe
  2⤵
  PID:5880
- C:\Windows\System\tFjKFst.exe
  C:\Windows\System\tFjKFst.exe
  2⤵
  PID:5912
- C:\Windows\System\ayEKbXj.exe
  C:\Windows\System\ayEKbXj.exe
  2⤵
  PID:5936
- C:\Windows\System\SOtnKot.exe
  C:\Windows\System\SOtnKot.exe
  2⤵
  PID:5968
- C:\Windows\System\IhZBWSj.exe
  C:\Windows\System\IhZBWSj.exe
  2⤵
  PID:5996
- C:\Windows\System\BQfKCqc.exe
  C:\Windows\System\BQfKCqc.exe
  2⤵
  PID:6024
- C:\Windows\System\rXfBfDf.exe
  C:\Windows\System\rXfBfDf.exe
  2⤵
  PID:6052
- C:\Windows\System\xAJvluF.exe
  C:\Windows\System\xAJvluF.exe
  2⤵
  PID:6080
- C:\Windows\System\PSBXlFi.exe
  C:\Windows\System\PSBXlFi.exe
  2⤵
  PID:6108
- C:\Windows\System\TMlwUIZ.exe
  C:\Windows\System\TMlwUIZ.exe
  2⤵
  PID:6136
- C:\Windows\System\nQzhyBK.exe
  C:\Windows\System\nQzhyBK.exe
  2⤵
  PID:1012
- C:\Windows\System\XlxvbEA.exe
  C:\Windows\System\XlxvbEA.exe
  2⤵
  PID:3900
- C:\Windows\System\XvSieLQ.exe
  C:\Windows\System\XvSieLQ.exe
  2⤵
  PID:2776
- C:\Windows\System\AlBlBDP.exe
  C:\Windows\System\AlBlBDP.exe
  2⤵
  PID:2792
- C:\Windows\System\abnUaRb.exe
  C:\Windows\System\abnUaRb.exe
  2⤵
  PID:5124
- C:\Windows\System\mlEshFK.exe
  C:\Windows\System\mlEshFK.exe
  2⤵
  PID:5204
- C:\Windows\System\aAwCxfs.exe
  C:\Windows\System\aAwCxfs.exe
  2⤵
  PID:5268
- C:\Windows\System\PdnPxsE.exe
  C:\Windows\System\PdnPxsE.exe
  2⤵
  PID:5324
- C:\Windows\System\wIURqlb.exe
  C:\Windows\System\wIURqlb.exe
  2⤵
  PID:5380
- C:\Windows\System\oIuAYHl.exe
  C:\Windows\System\oIuAYHl.exe
  2⤵
  PID:5452
- C:\Windows\System\prCqFNZ.exe
  C:\Windows\System\prCqFNZ.exe
  2⤵
  PID:5508
- C:\Windows\System\gMnFunY.exe
  C:\Windows\System\gMnFunY.exe
  2⤵
  PID:5568
- C:\Windows\System\aBAopCq.exe
  C:\Windows\System\aBAopCq.exe
  2⤵
  PID:5620
- C:\Windows\System\aOlmHOB.exe
  C:\Windows\System\aOlmHOB.exe
  2⤵
  PID:5680
- C:\Windows\System\dJKjaHA.exe
  C:\Windows\System\dJKjaHA.exe
  2⤵
  PID:5756
- C:\Windows\System\MzbZGRx.exe
  C:\Windows\System\MzbZGRx.exe
  2⤵
  PID:5820
- C:\Windows\System\LIMqPCL.exe
  C:\Windows\System\LIMqPCL.exe
  2⤵
  PID:5872
- C:\Windows\System\HnEraOZ.exe
  C:\Windows\System\HnEraOZ.exe
  2⤵
  PID:5932
- C:\Windows\System\sWRDuAT.exe
  C:\Windows\System\sWRDuAT.exe
  2⤵
  PID:6008
- C:\Windows\System\txRPQVc.exe
  C:\Windows\System\txRPQVc.exe
  2⤵
  PID:6064
- C:\Windows\System\znHOBOx.exe
  C:\Windows\System\znHOBOx.exe
  2⤵
  PID:6120
- C:\Windows\System\oTEfysj.exe
  C:\Windows\System\oTEfysj.exe
  2⤵
  PID:2628
- C:\Windows\System\yXpmkiZ.exe
  C:\Windows\System\yXpmkiZ.exe
  2⤵
  PID:4852
- C:\Windows\System\FJbkAMP.exe
  C:\Windows\System\FJbkAMP.exe
  2⤵
  PID:5176
- C:\Windows\System\thUoXir.exe
  C:\Windows\System\thUoXir.exe
  2⤵
  PID:5316
- C:\Windows\System\PXmsLTs.exe
  C:\Windows\System\PXmsLTs.exe
  2⤵
  PID:5488
- C:\Windows\System\MQVTuve.exe
  C:\Windows\System\MQVTuve.exe
  2⤵
  PID:5596
- C:\Windows\System\wDyhhrM.exe
  C:\Windows\System\wDyhhrM.exe
  2⤵
  PID:5788
- C:\Windows\System\CDcsHbj.exe
  C:\Windows\System\CDcsHbj.exe
  2⤵
  PID:5904
- C:\Windows\System\SEFYRoc.exe
  C:\Windows\System\SEFYRoc.exe
  2⤵
  PID:4908
- C:\Windows\System\JkOTwft.exe
  C:\Windows\System\JkOTwft.exe
  2⤵
  PID:6100
- C:\Windows\System\gujXCUB.exe
  C:\Windows\System\gujXCUB.exe
  2⤵
  PID:4832
- C:\Windows\System\wxgCzBs.exe
  C:\Windows\System\wxgCzBs.exe
  2⤵
  PID:5244
- C:\Windows\System\SJWIbQF.exe
  C:\Windows\System\SJWIbQF.exe
  2⤵
  PID:216
- C:\Windows\System\lxTTqvP.exe
  C:\Windows\System\lxTTqvP.exe
  2⤵
  PID:5676
- C:\Windows\System\KUaHzJb.exe
  C:\Windows\System\KUaHzJb.exe
  2⤵
  PID:6176
- C:\Windows\System\BeDuHCo.exe
  C:\Windows\System\BeDuHCo.exe
  2⤵
  PID:6200
- C:\Windows\System\yWtwnvi.exe
  C:\Windows\System\yWtwnvi.exe
  2⤵
  PID:6232
- C:\Windows\System\VNYpZxL.exe
  C:\Windows\System\VNYpZxL.exe
  2⤵
  PID:6256
- C:\Windows\System\NSisoRI.exe
  C:\Windows\System\NSisoRI.exe
  2⤵
  PID:6288
- C:\Windows\System\zNRhDfb.exe
  C:\Windows\System\zNRhDfb.exe
  2⤵
  PID:6312
- C:\Windows\System\UnxQJgt.exe
  C:\Windows\System\UnxQJgt.exe
  2⤵
  PID:6340
- C:\Windows\System\JRDHWaE.exe
  C:\Windows\System\JRDHWaE.exe
  2⤵
  PID:6372
- C:\Windows\System\LqrDlGh.exe
  C:\Windows\System\LqrDlGh.exe
  2⤵
  PID:6400
- C:\Windows\System\ROYLfjv.exe
  C:\Windows\System\ROYLfjv.exe
  2⤵
  PID:6428
- C:\Windows\System\EpeRCvy.exe
  C:\Windows\System\EpeRCvy.exe
  2⤵
  PID:6456
- C:\Windows\System\wspJSxF.exe
  C:\Windows\System\wspJSxF.exe
  2⤵
  PID:6484
- C:\Windows\System\GRGcbva.exe
  C:\Windows\System\GRGcbva.exe
  2⤵
  PID:6508
- C:\Windows\System\arbZXVy.exe
  C:\Windows\System\arbZXVy.exe
  2⤵
  PID:6536
- C:\Windows\System\DUoPsnY.exe
  C:\Windows\System\DUoPsnY.exe
  2⤵
  PID:6568
- C:\Windows\System\DTnioUH.exe
  C:\Windows\System\DTnioUH.exe
  2⤵
  PID:6596
- C:\Windows\System\SBAHYXW.exe
  C:\Windows\System\SBAHYXW.exe
  2⤵
  PID:6624
- C:\Windows\System\OVSNjHI.exe
  C:\Windows\System\OVSNjHI.exe
  2⤵
  PID:6652
- C:\Windows\System\dFaHSAX.exe
  C:\Windows\System\dFaHSAX.exe
  2⤵
  PID:6688
- C:\Windows\System\AMhVjxg.exe
  C:\Windows\System\AMhVjxg.exe
  2⤵
  PID:6728
- C:\Windows\System\nkaqXmy.exe
  C:\Windows\System\nkaqXmy.exe
  2⤵
  PID:6748
- C:\Windows\System\bNAciCP.exe
  C:\Windows\System\bNAciCP.exe
  2⤵
  PID:6768
- C:\Windows\System\ZXhaZRg.exe
  C:\Windows\System\ZXhaZRg.exe
  2⤵
  PID:6788
- C:\Windows\System\irPmmch.exe
  C:\Windows\System\irPmmch.exe
  2⤵
  PID:6848
- C:\Windows\System\XFANVGu.exe
  C:\Windows\System\XFANVGu.exe
  2⤵
  PID:6864
- C:\Windows\System\pAqEahJ.exe
  C:\Windows\System\pAqEahJ.exe
  2⤵
  PID:6888
- C:\Windows\System\pybNeoc.exe
  C:\Windows\System\pybNeoc.exe
  2⤵
  PID:6924
- C:\Windows\System\UFchFYj.exe
  C:\Windows\System\UFchFYj.exe
  2⤵
  PID:6952
- C:\Windows\System\JBtwvQD.exe
  C:\Windows\System\JBtwvQD.exe
  2⤵
  PID:6980
- C:\Windows\System\gwphRhH.exe
  C:\Windows\System\gwphRhH.exe
  2⤵
  PID:7008
- C:\Windows\System\NysilCZ.exe
  C:\Windows\System\NysilCZ.exe
  2⤵
  PID:7024
- C:\Windows\System\llSNLqr.exe
  C:\Windows\System\llSNLqr.exe
  2⤵
  PID:7048
- C:\Windows\System\dxNfQln.exe
  C:\Windows\System\dxNfQln.exe
  2⤵
  PID:7072
- C:\Windows\System\fjMNFWr.exe
  C:\Windows\System\fjMNFWr.exe
  2⤵
  PID:7092
- C:\Windows\System\ODEIAbv.exe
  C:\Windows\System\ODEIAbv.exe
  2⤵
  PID:7144
- C:\Windows\System\CgZrRKT.exe
  C:\Windows\System\CgZrRKT.exe
  2⤵
  PID:5848
- C:\Windows\System\YGxdhiL.exe
  C:\Windows\System\YGxdhiL.exe
  2⤵
  PID:5984
- C:\Windows\System\IRglGbE.exe
  C:\Windows\System\IRglGbE.exe
  2⤵
  PID:4176
- C:\Windows\System\EgHMdXU.exe
  C:\Windows\System\EgHMdXU.exe
  2⤵
  PID:3832
- C:\Windows\System\BHfnJaM.exe
  C:\Windows\System\BHfnJaM.exe
  2⤵
  PID:6164
- C:\Windows\System\WjRlEdZ.exe
  C:\Windows\System\WjRlEdZ.exe
  2⤵
  PID:1576
- C:\Windows\System\TvTYGiu.exe
  C:\Windows\System\TvTYGiu.exe
  2⤵
  PID:6280
- C:\Windows\System\vRYgoZp.exe
  C:\Windows\System\vRYgoZp.exe
  2⤵
  PID:6332
- C:\Windows\System\sEbvSlK.exe
  C:\Windows\System\sEbvSlK.exe
  2⤵
  PID:6364
- C:\Windows\System\hgPwwem.exe
  C:\Windows\System\hgPwwem.exe
  2⤵
  PID:6504
- C:\Windows\System\iaYAHoE.exe
  C:\Windows\System\iaYAHoE.exe
  2⤵
  PID:6532
- C:\Windows\System\EKjrTqM.exe
  C:\Windows\System\EKjrTqM.exe
  2⤵
  PID:6588
- C:\Windows\System\yYwwFro.exe
  C:\Windows\System\yYwwFro.exe
  2⤵
  PID:1772
- C:\Windows\System\TtLXkDd.exe
  C:\Windows\System\TtLXkDd.exe
  2⤵
  PID:4928
- C:\Windows\System\zrrjhYf.exe
  C:\Windows\System\zrrjhYf.exe
  2⤵
  PID:6668
- C:\Windows\System\MdkeHbK.exe
  C:\Windows\System\MdkeHbK.exe
  2⤵
  PID:6940
- C:\Windows\System\dfNsxaB.exe
  C:\Windows\System\dfNsxaB.exe
  2⤵
  PID:7088
- C:\Windows\System\sIHmrXm.exe
  C:\Windows\System\sIHmrXm.exe
  2⤵
  PID:7036
- C:\Windows\System\qgkgzWM.exe
  C:\Windows\System\qgkgzWM.exe
  2⤵
  PID:7068
- C:\Windows\System\kvOQiEE.exe
  C:\Windows\System\kvOQiEE.exe
  2⤵
  PID:5980
- C:\Windows\System\VQaomkY.exe
  C:\Windows\System\VQaomkY.exe
  2⤵
  PID:2880
- C:\Windows\System\xnGxQCu.exe
  C:\Windows\System\xnGxQCu.exe
  2⤵
  PID:212
- C:\Windows\System\tUoWwzP.exe
  C:\Windows\System\tUoWwzP.exe
  2⤵
  PID:6360
- C:\Windows\System\KhgIQSd.exe
  C:\Windows\System\KhgIQSd.exe
  2⤵
  PID:6524
- C:\Windows\System\ooXYeTl.exe
  C:\Windows\System\ooXYeTl.exe
  2⤵
  PID:6636
- C:\Windows\System\sQyHAkz.exe
  C:\Windows\System\sQyHAkz.exe
  2⤵
  PID:4300
- C:\Windows\System\TChvNIA.exe
  C:\Windows\System\TChvNIA.exe
  2⤵
  PID:6388
- C:\Windows\System\UXnyHkc.exe
  C:\Windows\System\UXnyHkc.exe
  2⤵
  PID:6968
- C:\Windows\System\cQIQwPc.exe
  C:\Windows\System\cQIQwPc.exe
  2⤵
  PID:1296
- C:\Windows\System\csgctJC.exe
  C:\Windows\System\csgctJC.exe
  2⤵
  PID:6676
- C:\Windows\System\ZdRZWjB.exe
  C:\Windows\System\ZdRZWjB.exe
  2⤵
  PID:6948
- C:\Windows\System\ouMlIEr.exe
  C:\Windows\System\ouMlIEr.exe
  2⤵
  PID:7120
- C:\Windows\System\sbVEdYv.exe
  C:\Windows\System\sbVEdYv.exe
  2⤵
  PID:4500
- C:\Windows\System\XXcNFfl.exe
  C:\Windows\System\XXcNFfl.exe
  2⤵
  PID:6328
- C:\Windows\System\cDJnMKy.exe
  C:\Windows\System\cDJnMKy.exe
  2⤵
  PID:6444
- C:\Windows\System\zuyKHMM.exe
  C:\Windows\System\zuyKHMM.exe
  2⤵
  PID:3640
- C:\Windows\System\kHeNGZe.exe
  C:\Windows\System\kHeNGZe.exe
  2⤵
  PID:3812
- C:\Windows\System\sIEJnsS.exe
  C:\Windows\System\sIEJnsS.exe
  2⤵
  PID:4156
- C:\Windows\System\EdEuidG.exe
  C:\Windows\System\EdEuidG.exe
  2⤵
  PID:6796
- C:\Windows\System\NYfqAPy.exe
  C:\Windows\System\NYfqAPy.exe
  2⤵
  PID:6720
- C:\Windows\System\fwfFcZV.exe
  C:\Windows\System\fwfFcZV.exe
  2⤵
  PID:7184
- C:\Windows\System\RUmsQHa.exe
  C:\Windows\System\RUmsQHa.exe
  2⤵
  PID:7224
- C:\Windows\System\HKSrHaz.exe
  C:\Windows\System\HKSrHaz.exe
  2⤵
  PID:7256
- C:\Windows\System\VYdimZd.exe
  C:\Windows\System\VYdimZd.exe
  2⤵
  PID:7288
- C:\Windows\System\ZRWRsrZ.exe
  C:\Windows\System\ZRWRsrZ.exe
  2⤵
  PID:7316
- C:\Windows\System\aVsydIp.exe
  C:\Windows\System\aVsydIp.exe
  2⤵
  PID:7344
- C:\Windows\System\xYeszhX.exe
  C:\Windows\System\xYeszhX.exe
  2⤵
  PID:7372
- C:\Windows\System\yhavqmK.exe
  C:\Windows\System\yhavqmK.exe
  2⤵
  PID:7392
- C:\Windows\System\trtfshh.exe
  C:\Windows\System\trtfshh.exe
  2⤵
  PID:7424
- C:\Windows\System\mKiToaO.exe
  C:\Windows\System\mKiToaO.exe
  2⤵
  PID:7448
- C:\Windows\System\BLVfGWt.exe
  C:\Windows\System\BLVfGWt.exe
  2⤵
  PID:7476
- C:\Windows\System\SudAoew.exe
  C:\Windows\System\SudAoew.exe
  2⤵
  PID:7516
- C:\Windows\System\hxyqAcG.exe
  C:\Windows\System\hxyqAcG.exe
  2⤵
  PID:7532
- C:\Windows\System\ubUixZZ.exe
  C:\Windows\System\ubUixZZ.exe
  2⤵
  PID:7560
- C:\Windows\System\BGDalPV.exe
  C:\Windows\System\BGDalPV.exe
  2⤵
  PID:7592
- C:\Windows\System\RbvsKTC.exe
  C:\Windows\System\RbvsKTC.exe
  2⤵
  PID:7612
- C:\Windows\System\QCyBNKq.exe
  C:\Windows\System\QCyBNKq.exe
  2⤵
  PID:7644
- C:\Windows\System\KqfFAKc.exe
  C:\Windows\System\KqfFAKc.exe
  2⤵
  PID:7684
- C:\Windows\System\BPkGjHT.exe
  C:\Windows\System\BPkGjHT.exe
  2⤵
  PID:7712
- C:\Windows\System\wZjQAYj.exe
  C:\Windows\System\wZjQAYj.exe
  2⤵
  PID:7740
- C:\Windows\System\QYvouXi.exe
  C:\Windows\System\QYvouXi.exe
  2⤵
  PID:7768
- C:\Windows\System\DSkikHg.exe
  C:\Windows\System\DSkikHg.exe
  2⤵
  PID:7784
- C:\Windows\System\WQhmNnh.exe
  C:\Windows\System\WQhmNnh.exe
  2⤵
  PID:7800
- C:\Windows\System\WRaNITa.exe
  C:\Windows\System\WRaNITa.exe
  2⤵
  PID:7816
- C:\Windows\System\slmXVpc.exe
  C:\Windows\System\slmXVpc.exe
  2⤵
  PID:7868
- C:\Windows\System\xUgcjdF.exe
  C:\Windows\System\xUgcjdF.exe
  2⤵
  PID:7904
- C:\Windows\System\pnAOUwp.exe
  C:\Windows\System\pnAOUwp.exe
  2⤵
  PID:7928
- C:\Windows\System\RlQEfPn.exe
  C:\Windows\System\RlQEfPn.exe
  2⤵
  PID:7960
- C:\Windows\System\iWkVQki.exe
  C:\Windows\System\iWkVQki.exe
  2⤵
  PID:7984
- C:\Windows\System\TUtsfzA.exe
  C:\Windows\System\TUtsfzA.exe
  2⤵
  PID:8000
- C:\Windows\System\DTsDnxU.exe
  C:\Windows\System\DTsDnxU.exe
  2⤵
  PID:8036
- C:\Windows\System\YLRXvdT.exe
  C:\Windows\System\YLRXvdT.exe
  2⤵
  PID:8068
- C:\Windows\System\RUfCGLh.exe
  C:\Windows\System\RUfCGLh.exe
  2⤵
  PID:8096
- C:\Windows\System\jZpoIVy.exe
  C:\Windows\System\jZpoIVy.exe
  2⤵
  PID:8112
- C:\Windows\System\RHZOVkZ.exe
  C:\Windows\System\RHZOVkZ.exe
  2⤵
  PID:8132
- C:\Windows\System\vWBBHCI.exe
  C:\Windows\System\vWBBHCI.exe
  2⤵
  PID:8156
- C:\Windows\System\kBZpODQ.exe
  C:\Windows\System\kBZpODQ.exe
  2⤵
  PID:8180
- C:\Windows\System\LFMpUxu.exe
  C:\Windows\System\LFMpUxu.exe
  2⤵
  PID:7176
- C:\Windows\System\wFrvluq.exe
  C:\Windows\System\wFrvluq.exe
  2⤵
  PID:7272
- C:\Windows\System\ULKqiIw.exe
  C:\Windows\System\ULKqiIw.exe
  2⤵
  PID:7312
- C:\Windows\System\xAZveij.exe
  C:\Windows\System\xAZveij.exe
  2⤵
  PID:7384
- C:\Windows\System\aeYCBHP.exe
  C:\Windows\System\aeYCBHP.exe
  2⤵
  PID:7440
- C:\Windows\System\ryGFcPh.exe
  C:\Windows\System\ryGFcPh.exe
  2⤵
  PID:7544
- C:\Windows\System\tUqnptB.exe
  C:\Windows\System\tUqnptB.exe
  2⤵
  PID:7624
- C:\Windows\System\SbftreM.exe
  C:\Windows\System\SbftreM.exe
  2⤵
  PID:7604
- C:\Windows\System\zIuIMZe.exe
  C:\Windows\System\zIuIMZe.exe
  2⤵
  PID:7664
- C:\Windows\System\SLvoNii.exe
  C:\Windows\System\SLvoNii.exe
  2⤵
  PID:7792
- C:\Windows\System\KagFomp.exe
  C:\Windows\System\KagFomp.exe
  2⤵
  PID:7856
- C:\Windows\System\AWaDEvG.exe
  C:\Windows\System\AWaDEvG.exe
  2⤵
  PID:7920
- C:\Windows\System\kjqscpD.exe
  C:\Windows\System\kjqscpD.exe
  2⤵
  PID:7992
- C:\Windows\System\qLWIapb.exe
  C:\Windows\System\qLWIapb.exe
  2⤵
  PID:8048
- C:\Windows\System\drsXArB.exe
  C:\Windows\System\drsXArB.exe
  2⤵
  PID:8128
- C:\Windows\System\WihpJts.exe
  C:\Windows\System\WihpJts.exe
  2⤵
  PID:6472
- C:\Windows\System\znRHnlu.exe
  C:\Windows\System\znRHnlu.exe
  2⤵
  PID:7464
- C:\Windows\System\vtJPZoQ.exe
  C:\Windows\System\vtJPZoQ.exe
  2⤵
  PID:7556
- C:\Windows\System\hWkeQjy.exe
  C:\Windows\System\hWkeQjy.exe
  2⤵
  PID:7700
- C:\Windows\System\FDFGhOQ.exe
  C:\Windows\System\FDFGhOQ.exe
  2⤵
  PID:7952
- C:\Windows\System\kgcOoLB.exe
  C:\Windows\System\kgcOoLB.exe
  2⤵
  PID:7220
- C:\Windows\System\wUOiYvM.exe
  C:\Windows\System\wUOiYvM.exe
  2⤵
  PID:7252
- C:\Windows\System\PpmiNYo.exe
  C:\Windows\System\PpmiNYo.exe
  2⤵
  PID:7844
- C:\Windows\System\LYqDMGw.exe
  C:\Windows\System\LYqDMGw.exe
  2⤵
  PID:7996
- C:\Windows\System\zUldyaF.exe
  C:\Windows\System\zUldyaF.exe
  2⤵
  PID:7512
- C:\Windows\System\EyHQtSP.exe
  C:\Windows\System\EyHQtSP.exe
  2⤵
  PID:8060
- C:\Windows\System\aOIPQwu.exe
  C:\Windows\System\aOIPQwu.exe
  2⤵
  PID:8224
- C:\Windows\System\xFtDyhu.exe
  C:\Windows\System\xFtDyhu.exe
  2⤵
  PID:8248
- C:\Windows\System\lOKsLwJ.exe
  C:\Windows\System\lOKsLwJ.exe
  2⤵
  PID:8284
- C:\Windows\System\ohCVshD.exe
  C:\Windows\System\ohCVshD.exe
  2⤵
  PID:8316
- C:\Windows\System\JlRMhvA.exe
  C:\Windows\System\JlRMhvA.exe
  2⤵
  PID:8336
- C:\Windows\System\LyPAagP.exe
  C:\Windows\System\LyPAagP.exe
  2⤵
  PID:8356
- C:\Windows\System\XSiILXx.exe
  C:\Windows\System\XSiILXx.exe
  2⤵
  PID:8392
- C:\Windows\System\VsdtbSK.exe
  C:\Windows\System\VsdtbSK.exe
  2⤵
  PID:8424
- C:\Windows\System\UEmAIBU.exe
  C:\Windows\System\UEmAIBU.exe
  2⤵
  PID:8452
- C:\Windows\System\QXEUlxw.exe
  C:\Windows\System\QXEUlxw.exe
  2⤵
  PID:8492
- C:\Windows\System\IkrJanO.exe
  C:\Windows\System\IkrJanO.exe
  2⤵
  PID:8512
- C:\Windows\System\OtUipdj.exe
  C:\Windows\System\OtUipdj.exe
  2⤵
  PID:8544
- C:\Windows\System\FqYkPTC.exe
  C:\Windows\System\FqYkPTC.exe
  2⤵
  PID:8564
- C:\Windows\System\AmisVaO.exe
  C:\Windows\System\AmisVaO.exe
  2⤵
  PID:8592
- C:\Windows\System\wPHKkXl.exe
  C:\Windows\System\wPHKkXl.exe
  2⤵
  PID:8632
- C:\Windows\System\zWkLoAB.exe
  C:\Windows\System\zWkLoAB.exe
  2⤵
  PID:8652
- C:\Windows\System\BoHPkDs.exe
  C:\Windows\System\BoHPkDs.exe
  2⤵
  PID:8688
- C:\Windows\System\ZEnzinq.exe
  C:\Windows\System\ZEnzinq.exe
  2⤵
  PID:8712
- C:\Windows\System\kexijiI.exe
  C:\Windows\System\kexijiI.exe
  2⤵
  PID:8748
- C:\Windows\System\CSowOOi.exe
  C:\Windows\System\CSowOOi.exe
  2⤵
  PID:8776
- C:\Windows\System\OilQHKS.exe
  C:\Windows\System\OilQHKS.exe
  2⤵
  PID:8804
- C:\Windows\System\HqWMkZD.exe
  C:\Windows\System\HqWMkZD.exe
  2⤵
  PID:8836
- C:\Windows\System\ctuNMBn.exe
  C:\Windows\System\ctuNMBn.exe
  2⤵
  PID:8852
- C:\Windows\System\YrJlQHs.exe
  C:\Windows\System\YrJlQHs.exe
  2⤵
  PID:8880
- C:\Windows\System\yjMDrJx.exe
  C:\Windows\System\yjMDrJx.exe
  2⤵
  PID:8900
- C:\Windows\System\AcKWZDJ.exe
  C:\Windows\System\AcKWZDJ.exe
  2⤵
  PID:8936
- C:\Windows\System\LJBUsCH.exe
  C:\Windows\System\LJBUsCH.exe
  2⤵
  PID:8968
- C:\Windows\System\lbanghY.exe
  C:\Windows\System\lbanghY.exe
  2⤵
  PID:8992
- C:\Windows\System\RLsmpLM.exe
  C:\Windows\System\RLsmpLM.exe
  2⤵
  PID:9020
- C:\Windows\System\jSfPVcr.exe
  C:\Windows\System\jSfPVcr.exe
  2⤵
  PID:9052
- C:\Windows\System\hTFyVVT.exe
  C:\Windows\System\hTFyVVT.exe
  2⤵
  PID:9072
- C:\Windows\System\clgQIQf.exe
  C:\Windows\System\clgQIQf.exe
  2⤵
  PID:9100
- C:\Windows\System\ZBbCMzw.exe
  C:\Windows\System\ZBbCMzw.exe
  2⤵
  PID:9132
- C:\Windows\System\oGKvjIx.exe
  C:\Windows\System\oGKvjIx.exe
  2⤵
  PID:9160
- C:\Windows\System\pJwlNNE.exe
  C:\Windows\System\pJwlNNE.exe
  2⤵
  PID:8012
- C:\Windows\System\QjotOOQ.exe
  C:\Windows\System\QjotOOQ.exe
  2⤵
  PID:8236
- C:\Windows\System\NIzywhi.exe
  C:\Windows\System\NIzywhi.exe
  2⤵
  PID:8300
- C:\Windows\System\muOLhlQ.exe
  C:\Windows\System\muOLhlQ.exe
  2⤵
  PID:8344
- C:\Windows\System\VcYmAvt.exe
  C:\Windows\System\VcYmAvt.exe
  2⤵
  PID:8416
- C:\Windows\System\kYVqxzv.exe
  C:\Windows\System\kYVqxzv.exe
  2⤵
  PID:8464
- C:\Windows\System\YRFXLWa.exe
  C:\Windows\System\YRFXLWa.exe
  2⤵
  PID:8528
- C:\Windows\System\vsTyHFa.exe
  C:\Windows\System\vsTyHFa.exe
  2⤵
  PID:8576
- C:\Windows\System\hcBONWM.exe
  C:\Windows\System\hcBONWM.exe
  2⤵
  PID:8664
- C:\Windows\System\FgdvEyc.exe
  C:\Windows\System\FgdvEyc.exe
  2⤵
  PID:8740
- C:\Windows\System\TLRgUtb.exe
  C:\Windows\System\TLRgUtb.exe
  2⤵
  PID:8800
- C:\Windows\System\jmOnGGs.exe
  C:\Windows\System\jmOnGGs.exe
  2⤵
  PID:8864
- C:\Windows\System\UThxzfC.exe
  C:\Windows\System\UThxzfC.exe
  2⤵
  PID:8948
- C:\Windows\System\pUZDGFp.exe
  C:\Windows\System\pUZDGFp.exe
  2⤵
  PID:8988
- C:\Windows\System\njFjfHs.exe
  C:\Windows\System\njFjfHs.exe
  2⤵
  PID:9060
- C:\Windows\System\edBVael.exe
  C:\Windows\System\edBVael.exe
  2⤵
  PID:9084
- C:\Windows\System\XlgirTT.exe
  C:\Windows\System\XlgirTT.exe
  2⤵
  PID:9208
- C:\Windows\System\GrRqRLC.exe
  C:\Windows\System\GrRqRLC.exe
  2⤵
  PID:8332
- C:\Windows\System\sELPRLP.exe
  C:\Windows\System\sELPRLP.exe
  2⤵
  PID:8448
- C:\Windows\System\xgUfXAD.exe
  C:\Windows\System\xgUfXAD.exe
  2⤵
  PID:8584
- C:\Windows\System\FeBtRQD.exe
  C:\Windows\System\FeBtRQD.exe
  2⤵
  PID:8728
- C:\Windows\System\QvcXVEv.exe
  C:\Windows\System\QvcXVEv.exe
  2⤵
  PID:8844
- C:\Windows\System\TdWsqfI.exe
  C:\Windows\System\TdWsqfI.exe
  2⤵
  PID:8956
- C:\Windows\System\UlZeFEb.exe
  C:\Windows\System\UlZeFEb.exe
  2⤵
  PID:9044
- C:\Windows\System\SNmRiZL.exe
  C:\Windows\System\SNmRiZL.exe
  2⤵
  PID:8272
- C:\Windows\System\xZoCpGp.exe
  C:\Windows\System\xZoCpGp.exe
  2⤵
  PID:8412
- C:\Windows\System\eTWpXMh.exe
  C:\Windows\System\eTWpXMh.exe
  2⤵
  PID:8720
- C:\Windows\System\fGrqQBw.exe
  C:\Windows\System\fGrqQBw.exe
  2⤵
  PID:9016
- C:\Windows\System\oRUUhjR.exe
  C:\Windows\System\oRUUhjR.exe
  2⤵
  PID:9212
- C:\Windows\System\DkRUYPk.exe
  C:\Windows\System\DkRUYPk.exe
  2⤵
  PID:9240
- C:\Windows\System\MDXNqPd.exe
  C:\Windows\System\MDXNqPd.exe
  2⤵
  PID:9260
- C:\Windows\System\xTxINMd.exe
  C:\Windows\System\xTxINMd.exe
  2⤵
  PID:9280
- C:\Windows\System\ZkEdAzA.exe
  C:\Windows\System\ZkEdAzA.exe
  2⤵
  PID:9312
- C:\Windows\System\uvbgnhG.exe
  C:\Windows\System\uvbgnhG.exe
  2⤵
  PID:9352
- C:\Windows\System\vMUgUst.exe
  C:\Windows\System\vMUgUst.exe
  2⤵
  PID:9384
- C:\Windows\System\tHaBOmb.exe
  C:\Windows\System\tHaBOmb.exe
  2⤵
  PID:9416
- C:\Windows\System\CSYwhDa.exe
  C:\Windows\System\CSYwhDa.exe
  2⤵
  PID:9448
- C:\Windows\System\AbTlzrb.exe
  C:\Windows\System\AbTlzrb.exe
  2⤵
  PID:9480
- C:\Windows\System\mwAVsax.exe
  C:\Windows\System\mwAVsax.exe
  2⤵
  PID:9508
- C:\Windows\System\emeILUn.exe
  C:\Windows\System\emeILUn.exe
  2⤵
  PID:9540
- C:\Windows\System\LiOjfmo.exe
  C:\Windows\System\LiOjfmo.exe
  2⤵
  PID:9576
- C:\Windows\System\gTTqiUk.exe
  C:\Windows\System\gTTqiUk.exe
  2⤵
  PID:9604
- C:\Windows\System\yALLCcI.exe
  C:\Windows\System\yALLCcI.exe
  2⤵
  PID:9636
- C:\Windows\System\nzQeXZS.exe
  C:\Windows\System\nzQeXZS.exe
  2⤵
  PID:9668
- C:\Windows\System\QxawkVO.exe
  C:\Windows\System\QxawkVO.exe
  2⤵
  PID:9704
- C:\Windows\System\sUYCfRr.exe
  C:\Windows\System\sUYCfRr.exe
  2⤵
  PID:9732
- C:\Windows\System\CgBXLpp.exe
  C:\Windows\System\CgBXLpp.exe
  2⤵
  PID:9764
- C:\Windows\System\AksJqsP.exe
  C:\Windows\System\AksJqsP.exe
  2⤵
  PID:9788
- C:\Windows\System\KCNIMEr.exe
  C:\Windows\System\KCNIMEr.exe
  2⤵
  PID:9816
- C:\Windows\System\MoyuoLg.exe
  C:\Windows\System\MoyuoLg.exe
  2⤵
  PID:9852
- C:\Windows\System\GoeXZPz.exe
  C:\Windows\System\GoeXZPz.exe
  2⤵
  PID:9872
- C:\Windows\System\iYJcThY.exe
  C:\Windows\System\iYJcThY.exe
  2⤵
  PID:9888
- C:\Windows\System\LqYmEXO.exe
  C:\Windows\System\LqYmEXO.exe
  2⤵
  PID:9920
- C:\Windows\System\zDUfLHk.exe
  C:\Windows\System\zDUfLHk.exe
  2⤵
  PID:9952
- C:\Windows\System\igQBwMT.exe
  C:\Windows\System\igQBwMT.exe
  2⤵
  PID:9984
- C:\Windows\System\axFcJdY.exe
  C:\Windows\System\axFcJdY.exe
  2⤵
  PID:10024
- C:\Windows\System\dxfcmsv.exe
  C:\Windows\System\dxfcmsv.exe
  2⤵
  PID:10048
- C:\Windows\System\CIhpiML.exe
  C:\Windows\System\CIhpiML.exe
  2⤵
  PID:10072
- C:\Windows\System\vvDyfWe.exe
  C:\Windows\System\vvDyfWe.exe
  2⤵
  PID:10096
- C:\Windows\System\FJvyMCX.exe
  C:\Windows\System\FJvyMCX.exe
  2⤵
  PID:10124
- C:\Windows\System\BfQeUKX.exe
  C:\Windows\System\BfQeUKX.exe
  2⤵
  PID:10160
- C:\Windows\System\EUoYtrr.exe
  C:\Windows\System\EUoYtrr.exe
  2⤵
  PID:10192
- C:\Windows\System\Oyiufzd.exe
  C:\Windows\System\Oyiufzd.exe
  2⤵
  PID:10208
- C:\Windows\System\VdYrLJq.exe
  C:\Windows\System\VdYrLJq.exe
  2⤵
  PID:10236
- C:\Windows\System\eJkmJbO.exe
  C:\Windows\System\eJkmJbO.exe
  2⤵
  PID:8788
- C:\Windows\System\QksAsVT.exe
  C:\Windows\System\QksAsVT.exe
  2⤵
  PID:9252
- C:\Windows\System\ssgaRkY.exe
  C:\Windows\System\ssgaRkY.exe
  2⤵
  PID:9376
- C:\Windows\System\wzFxeoG.exe
  C:\Windows\System\wzFxeoG.exe
  2⤵
  PID:9408
- C:\Windows\System\aUHykYF.exe
  C:\Windows\System\aUHykYF.exe
  2⤵
  PID:9472
- C:\Windows\System\KRzfeUI.exe
  C:\Windows\System\KRzfeUI.exe
  2⤵
  PID:9560
- C:\Windows\System\kyVICRe.exe
  C:\Windows\System\kyVICRe.exe
  2⤵
  PID:9676
- C:\Windows\System\IldbgkO.exe
  C:\Windows\System\IldbgkO.exe
  2⤵
  PID:9688
- C:\Windows\System\TeoajpZ.exe
  C:\Windows\System\TeoajpZ.exe
  2⤵
  PID:9776
- C:\Windows\System\TetliXm.exe
  C:\Windows\System\TetliXm.exe
  2⤵
  PID:9844
- C:\Windows\System\ngakrKm.exe
  C:\Windows\System\ngakrKm.exe
  2⤵
  PID:9904
- C:\Windows\System\lRGJwoj.exe
  C:\Windows\System\lRGJwoj.exe
  2⤵
  PID:10016
- C:\Windows\System\jMDVPdE.exe
  C:\Windows\System\jMDVPdE.exe
  2⤵
  PID:10092
- C:\Windows\System\fybqDAp.exe
  C:\Windows\System\fybqDAp.exe
  2⤵
  PID:10148
- C:\Windows\System\DQYhMGy.exe
  C:\Windows\System\DQYhMGy.exe
  2⤵
  PID:10188
- C:\Windows\System\PSrudlw.exe
  C:\Windows\System\PSrudlw.exe
  2⤵
  PID:9248
- C:\Windows\System\DHWpHvK.exe
  C:\Windows\System\DHWpHvK.exe
  2⤵
  PID:9304
- C:\Windows\System\JvdMayb.exe
  C:\Windows\System\JvdMayb.exe
  2⤵
  PID:9464
- C:\Windows\System\oTVpNiS.exe
  C:\Windows\System\oTVpNiS.exe
  2⤵
  PID:9652
- C:\Windows\System\oVYOclh.exe
  C:\Windows\System\oVYOclh.exe
  2⤵
  PID:9752
- C:\Windows\System\ZEoNLMl.exe
  C:\Windows\System\ZEoNLMl.exe
  2⤵
  PID:9828
- C:\Windows\System\GKXCwwI.exe
  C:\Windows\System\GKXCwwI.exe
  2⤵
  PID:2944
- C:\Windows\System\WoEapxB.exe
  C:\Windows\System\WoEapxB.exe
  2⤵
  PID:10064
- C:\Windows\System\RMvcNGW.exe
  C:\Windows\System\RMvcNGW.exe
  2⤵
  PID:10228
- C:\Windows\System\zJwflMd.exe
  C:\Windows\System\zJwflMd.exe
  2⤵
  PID:9716
- C:\Windows\System\xREWgGZ.exe
  C:\Windows\System\xREWgGZ.exe
  2⤵
  PID:9800
- C:\Windows\System\PyIzNfc.exe
  C:\Windows\System\PyIzNfc.exe
  2⤵
  PID:9936
- C:\Windows\System\aiaVCVw.exe
  C:\Windows\System\aiaVCVw.exe
  2⤵
  PID:10264
- C:\Windows\System\YAnmksy.exe
  C:\Windows\System\YAnmksy.exe
  2⤵
  PID:10300
- C:\Windows\System\oIazngH.exe
  C:\Windows\System\oIazngH.exe
  2⤵
  PID:10336
- C:\Windows\System\RhCvDnf.exe
  C:\Windows\System\RhCvDnf.exe
  2⤵
  PID:10364
- C:\Windows\System\bQdvvjV.exe
  C:\Windows\System\bQdvvjV.exe
  2⤵
  PID:10400
- C:\Windows\System\pyObvEh.exe
  C:\Windows\System\pyObvEh.exe
  2⤵
  PID:10432
- C:\Windows\System\vJyUBrY.exe
  C:\Windows\System\vJyUBrY.exe
  2⤵
  PID:10476
- C:\Windows\System\DgCDfZC.exe
  C:\Windows\System\DgCDfZC.exe
  2⤵
  PID:10500
- C:\Windows\System\DztBEjr.exe
  C:\Windows\System\DztBEjr.exe
  2⤵
  PID:10528
- C:\Windows\System\crlEnyV.exe
  C:\Windows\System\crlEnyV.exe
  2⤵
  PID:10552
- C:\Windows\System\NSEAAYF.exe
  C:\Windows\System\NSEAAYF.exe
  2⤵
  PID:10568
- C:\Windows\System\NDyKKkJ.exe
  C:\Windows\System\NDyKKkJ.exe
  2⤵
  PID:10596
- C:\Windows\System\hJQacic.exe
  C:\Windows\System\hJQacic.exe
  2⤵
  PID:10644
- C:\Windows\System\uPdKGfK.exe
  C:\Windows\System\uPdKGfK.exe
  2⤵
  PID:10672
- C:\Windows\System\qMMTBmY.exe
  C:\Windows\System\qMMTBmY.exe
  2⤵
  PID:10708
- C:\Windows\System\xfYQFHM.exe
  C:\Windows\System\xfYQFHM.exe
  2⤵
  PID:10744
- C:\Windows\System\LUCIcBQ.exe
  C:\Windows\System\LUCIcBQ.exe
  2⤵
  PID:10780
- C:\Windows\System\ScnKYnQ.exe
  C:\Windows\System\ScnKYnQ.exe
  2⤵
  PID:10804
- C:\Windows\System\aHXfKGC.exe
  C:\Windows\System\aHXfKGC.exe
  2⤵
  PID:10832
- C:\Windows\System\ihEsFlR.exe
  C:\Windows\System\ihEsFlR.exe
  2⤵
  PID:10852
- C:\Windows\System\ueTBnld.exe
  C:\Windows\System\ueTBnld.exe
  2⤵
  PID:10880
- C:\Windows\System\kuubYXm.exe
  C:\Windows\System\kuubYXm.exe
  2⤵
  PID:10916
- C:\Windows\System\NSUdMdh.exe
  C:\Windows\System\NSUdMdh.exe
  2⤵
  PID:10940
- C:\Windows\System\Msexkbc.exe
  C:\Windows\System\Msexkbc.exe
  2⤵
  PID:10972
- C:\Windows\System\ZtOBdnb.exe
  C:\Windows\System\ZtOBdnb.exe
  2⤵
  PID:11004
- C:\Windows\System\MokGwnb.exe
  C:\Windows\System\MokGwnb.exe
  2⤵
  PID:11036
- C:\Windows\System\UGiPrHu.exe
  C:\Windows\System\UGiPrHu.exe
  2⤵
  PID:11060
- C:\Windows\System\yxRczlM.exe
  C:\Windows\System\yxRczlM.exe
  2⤵
  PID:11084
- C:\Windows\System\ynbMRvw.exe
  C:\Windows\System\ynbMRvw.exe
  2⤵
  PID:11112
- C:\Windows\System\CxRJvIv.exe
  C:\Windows\System\CxRJvIv.exe
  2⤵
  PID:11136
- C:\Windows\System\zQZkPRR.exe
  C:\Windows\System\zQZkPRR.exe
  2⤵
  PID:11164
- C:\Windows\System\rpppFFs.exe
  C:\Windows\System\rpppFFs.exe
  2⤵
  PID:11200
- C:\Windows\System\GzkWxhf.exe
  C:\Windows\System\GzkWxhf.exe
  2⤵
  PID:11224
- C:\Windows\System\cprBHmF.exe
  C:\Windows\System\cprBHmF.exe
  2⤵
  PID:11252
- C:\Windows\System\ykbyqmA.exe
  C:\Windows\System\ykbyqmA.exe
  2⤵
  PID:10256
- C:\Windows\System\APrPNgM.exe
  C:\Windows\System\APrPNgM.exe
  2⤵
  PID:10312
- C:\Windows\System\kaReoGN.exe
  C:\Windows\System\kaReoGN.exe
  2⤵
  PID:4820
- C:\Windows\System\IoaMPKw.exe
  C:\Windows\System\IoaMPKw.exe
  2⤵
  PID:984
- C:\Windows\System\zPZExOh.exe
  C:\Windows\System\zPZExOh.exe
  2⤵
  PID:10524
- C:\Windows\System\dFPoerM.exe
  C:\Windows\System\dFPoerM.exe
  2⤵
  PID:3352
- C:\Windows\System\arNhRtL.exe
  C:\Windows\System\arNhRtL.exe
  2⤵
  PID:10640
- C:\Windows\System\UaFdAhq.exe
  C:\Windows\System\UaFdAhq.exe
  2⤵
  PID:10692
- C:\Windows\System\mHgrCdT.exe
  C:\Windows\System\mHgrCdT.exe
  2⤵
  PID:10776
- C:\Windows\System\AnKmMaS.exe
  C:\Windows\System\AnKmMaS.exe
  2⤵
  PID:10828
- C:\Windows\System\GTaLyiv.exe
  C:\Windows\System\GTaLyiv.exe
  2⤵
  PID:10888
- C:\Windows\System\CXtzfLc.exe
  C:\Windows\System\CXtzfLc.exe
  2⤵
  PID:11016
- C:\Windows\System\lnvwqNk.exe
  C:\Windows\System\lnvwqNk.exe
  2⤵
  PID:11048
- C:\Windows\System\havDmla.exe
  C:\Windows\System\havDmla.exe
  2⤵
  PID:11100
- C:\Windows\System\WcccAsZ.exe
  C:\Windows\System\WcccAsZ.exe
  2⤵
  PID:11176
- C:\Windows\System\gqQvbrv.exe
  C:\Windows\System\gqQvbrv.exe
  2⤵
  PID:10352
- C:\Windows\System\iSHntDu.exe
  C:\Windows\System\iSHntDu.exe
  2⤵
  PID:10396
- C:\Windows\System\LQbkjjQ.exe
  C:\Windows\System\LQbkjjQ.exe
  2⤵
  PID:10444
- C:\Windows\System\aIABzIF.exe
  C:\Windows\System\aIABzIF.exe
  2⤵
  PID:10612
- C:\Windows\System\XcVPepT.exe
  C:\Windows\System\XcVPepT.exe
  2⤵
  PID:10752
- C:\Windows\System\xrKINLE.exe
  C:\Windows\System\xrKINLE.exe
  2⤵
  PID:10964
- C:\Windows\System\LUTyWUq.exe
  C:\Windows\System\LUTyWUq.exe
  2⤵
  PID:11056
- C:\Windows\System\fPVtvHG.exe
  C:\Windows\System\fPVtvHG.exe
  2⤵
  PID:10408
- C:\Windows\System\ffeEtag.exe
  C:\Windows\System\ffeEtag.exe
  2⤵
  PID:10560
- C:\Windows\System\qHkUggG.exe
  C:\Windows\System\qHkUggG.exe
  2⤵
  PID:11032
- C:\Windows\System\MbjyPdi.exe
  C:\Windows\System\MbjyPdi.exe
  2⤵
  PID:10688
- C:\Windows\System\ApRiRji.exe
  C:\Windows\System\ApRiRji.exe
  2⤵
  PID:11268
- C:\Windows\System\lBHDfhH.exe
  C:\Windows\System\lBHDfhH.exe
  2⤵
  PID:11292
- C:\Windows\System\iJwTSbV.exe
  C:\Windows\System\iJwTSbV.exe
  2⤵
  PID:11316
- C:\Windows\System\aCWEnVf.exe
  C:\Windows\System\aCWEnVf.exe
  2⤵
  PID:11336
- C:\Windows\System\ZTFJqHr.exe
  C:\Windows\System\ZTFJqHr.exe
  2⤵
  PID:11356
- C:\Windows\System\qFcyvAM.exe
  C:\Windows\System\qFcyvAM.exe
  2⤵
  PID:11380
- C:\Windows\System\jlOBPEj.exe
  C:\Windows\System\jlOBPEj.exe
  2⤵
  PID:11416
- C:\Windows\System\TNjCdtE.exe
  C:\Windows\System\TNjCdtE.exe
  2⤵
  PID:11440
- C:\Windows\System\TqwJOuO.exe
  C:\Windows\System\TqwJOuO.exe
  2⤵
  PID:11456
- C:\Windows\System\hXiNACS.exe
  C:\Windows\System\hXiNACS.exe
  2⤵
  PID:11484
- C:\Windows\System\NLJEsfi.exe
  C:\Windows\System\NLJEsfi.exe
  2⤵
  PID:11512
- C:\Windows\System\CunoydA.exe
  C:\Windows\System\CunoydA.exe
  2⤵
  PID:11548
- C:\Windows\System\NrdrIAC.exe
  C:\Windows\System\NrdrIAC.exe
  2⤵
  PID:11580
- C:\Windows\System\cVZpeds.exe
  C:\Windows\System\cVZpeds.exe
  2⤵
  PID:11616
- C:\Windows\System\UQVpJpw.exe
  C:\Windows\System\UQVpJpw.exe
  2⤵
  PID:11632
- C:\Windows\System\rdqRTYd.exe
  C:\Windows\System\rdqRTYd.exe
  2⤵
  PID:11652
- C:\Windows\System\fTcfZcW.exe
  C:\Windows\System\fTcfZcW.exe
  2⤵
  PID:11680
- C:\Windows\System\EQeuvlP.exe
  C:\Windows\System\EQeuvlP.exe
  2⤵
  PID:11704
- C:\Windows\System\TpKoiND.exe
  C:\Windows\System\TpKoiND.exe
  2⤵
  PID:11732
- C:\Windows\System\jAhkYTs.exe
  C:\Windows\System\jAhkYTs.exe
  2⤵
  PID:11756
- C:\Windows\System\aIaITcO.exe
  C:\Windows\System\aIaITcO.exe
  2⤵
  PID:11792
- C:\Windows\System\ehEmwkz.exe
  C:\Windows\System\ehEmwkz.exe
  2⤵
  PID:11828
- C:\Windows\System\vAJIyWS.exe
  C:\Windows\System\vAJIyWS.exe
  2⤵
  PID:11864
- C:\Windows\System\vggpJrY.exe
  C:\Windows\System\vggpJrY.exe
  2⤵
  PID:11896
- C:\Windows\System\SNyXryE.exe
  C:\Windows\System\SNyXryE.exe
  2⤵
  PID:11936
- C:\Windows\System\aZEqFTv.exe
  C:\Windows\System\aZEqFTv.exe
  2⤵
  PID:11964
- C:\Windows\System\HQYQDBp.exe
  C:\Windows\System\HQYQDBp.exe
  2⤵
  PID:12008
- C:\Windows\System\QOdRHob.exe
  C:\Windows\System\QOdRHob.exe
  2⤵
  PID:12036
- C:\Windows\System\MiriBOS.exe
  C:\Windows\System\MiriBOS.exe
  2⤵
  PID:12076
- C:\Windows\System\vMsYlwd.exe
  C:\Windows\System\vMsYlwd.exe
  2⤵
  PID:12096
- C:\Windows\System\wRfCHTk.exe
  C:\Windows\System\wRfCHTk.exe
  2⤵
  PID:12120
- C:\Windows\System\LOzjobM.exe
  C:\Windows\System\LOzjobM.exe
  2⤵
  PID:12152
- C:\Windows\System\EvUmmMV.exe
  C:\Windows\System\EvUmmMV.exe
  2⤵
  PID:12200
- C:\Windows\System\gRZfBmZ.exe
  C:\Windows\System\gRZfBmZ.exe
  2⤵
  PID:12228
- C:\Windows\System\kYqDyQq.exe
  C:\Windows\System\kYqDyQq.exe
  2⤵
  PID:12260
- C:\Windows\System\ZFbDYMs.exe
  C:\Windows\System\ZFbDYMs.exe
  2⤵
  PID:10492
- C:\Windows\System\nBqrQFh.exe
  C:\Windows\System\nBqrQFh.exe
  2⤵
  PID:11304
- C:\Windows\System\dwkiyPL.exe
  C:\Windows\System\dwkiyPL.exe
  2⤵
  PID:11352
- C:\Windows\System\aqNDYoa.exe
  C:\Windows\System\aqNDYoa.exe
  2⤵
  PID:11448
- C:\Windows\System\hQYgAvv.exe
  C:\Windows\System\hQYgAvv.exe
  2⤵
  PID:11524
- C:\Windows\System\VlqDNiE.exe
  C:\Windows\System\VlqDNiE.exe
  2⤵
  PID:11424
- C:\Windows\System\vHEmPbw.exe
  C:\Windows\System\vHEmPbw.exe
  2⤵
  PID:11560
- C:\Windows\System\rnHlXZS.exe
  C:\Windows\System\rnHlXZS.exe
  2⤵
  PID:11716
- C:\Windows\System\ZYydbdt.exe
  C:\Windows\System\ZYydbdt.exe
  2⤵
  PID:11720
- C:\Windows\System\IzCgqwU.exe
  C:\Windows\System\IzCgqwU.exe
  2⤵
  PID:11752
- C:\Windows\System\FxTCcpM.exe
  C:\Windows\System\FxTCcpM.exe
  2⤵
  PID:11844
- C:\Windows\System\QzQWTZm.exe
  C:\Windows\System\QzQWTZm.exe
  2⤵
  PID:11916
- C:\Windows\System\RDRZrBJ.exe
  C:\Windows\System\RDRZrBJ.exe
  2⤵
  PID:11876
- C:\Windows\System\TjypzIC.exe
  C:\Windows\System\TjypzIC.exe
  2⤵
  PID:12060
- C:\Windows\System\lLGxxKG.exe
  C:\Windows\System\lLGxxKG.exe
  2⤵
  PID:12112
- C:\Windows\System\ajNncVx.exe
  C:\Windows\System\ajNncVx.exe
  2⤵
  PID:12180
- C:\Windows\System\yuDcShb.exe
  C:\Windows\System\yuDcShb.exe
  2⤵
  PID:12220
- C:\Windows\System\HSiThFS.exe
  C:\Windows\System\HSiThFS.exe
  2⤵
  PID:12284
- C:\Windows\System\kSAwPUC.exe
  C:\Windows\System\kSAwPUC.exe
  2⤵
  PID:11344
- C:\Windows\System\QYHuqQN.exe
  C:\Windows\System\QYHuqQN.exe
  2⤵
  PID:11572
- C:\Windows\System\IXMTgFo.exe
  C:\Windows\System\IXMTgFo.exe
  2⤵
  PID:1768
- C:\Windows\System\aEEHaWi.exe
  C:\Windows\System\aEEHaWi.exe
  2⤵
  PID:11676
- C:\Windows\System\IRWHKZR.exe
  C:\Windows\System\IRWHKZR.exe
  2⤵
  PID:12092
- C:\Windows\System\gPNDWug.exe
  C:\Windows\System\gPNDWug.exe
  2⤵
  PID:12088
- C:\Windows\System\duQdACj.exe
  C:\Windows\System\duQdACj.exe
  2⤵
  PID:12216
- C:\Windows\System\jTjBHnz.exe
  C:\Windows\System\jTjBHnz.exe
  2⤵
  PID:11284
- C:\Windows\System\kMfmzxs.exe
  C:\Windows\System\kMfmzxs.exe
  2⤵
  PID:11612
- C:\Windows\System\pphEsfB.exe
  C:\Windows\System\pphEsfB.exe
  2⤵
  PID:11912
- C:\Windows\System\OtYhXGm.exe
  C:\Windows\System\OtYhXGm.exe
  2⤵
  PID:12188
- C:\Windows\System\dUaOaYA.exe
  C:\Windows\System\dUaOaYA.exe
  2⤵
  PID:1760
- C:\Windows\System\vhQCSDD.exe
  C:\Windows\System\vhQCSDD.exe
  2⤵
  PID:620
- C:\Windows\System\vtqxOTz.exe
  C:\Windows\System\vtqxOTz.exe
  2⤵
  PID:2520
- C:\Windows\System\DwnLCEc.exe
  C:\Windows\System\DwnLCEc.exe
  2⤵
  PID:12316
- C:\Windows\System\NXKSAvp.exe
  C:\Windows\System\NXKSAvp.exe
  2⤵
  PID:12340
- C:\Windows\System\xPlJGRz.exe
  C:\Windows\System\xPlJGRz.exe
  2⤵
  PID:12360
- C:\Windows\System\QIWBGgj.exe
  C:\Windows\System\QIWBGgj.exe
  2⤵
  PID:12388
- C:\Windows\System\wSNGWZR.exe
  C:\Windows\System\wSNGWZR.exe
  2⤵
  PID:12428
- C:\Windows\System\yBOFAkk.exe
  C:\Windows\System\yBOFAkk.exe
  2⤵
  PID:12452
- C:\Windows\System\xADAXCe.exe
  C:\Windows\System\xADAXCe.exe
  2⤵
  PID:12472
- C:\Windows\System\yUxRKcC.exe
  C:\Windows\System\yUxRKcC.exe
  2⤵
  PID:12504
- C:\Windows\System\yOMoxtb.exe
  C:\Windows\System\yOMoxtb.exe
  2⤵
  PID:12528
- C:\Windows\System\vDrBXAo.exe
  C:\Windows\System\vDrBXAo.exe
  2⤵
  PID:12564
- C:\Windows\System\lNAGoTd.exe
  C:\Windows\System\lNAGoTd.exe
  2⤵
  PID:12588
- C:\Windows\System\lrQFltY.exe
  C:\Windows\System\lrQFltY.exe
  2⤵
  PID:12616
- C:\Windows\System\VIDgBiL.exe
  C:\Windows\System\VIDgBiL.exe
  2⤵
  PID:12648
- C:\Windows\System\PWobHCg.exe
  C:\Windows\System\PWobHCg.exe
  2⤵
  PID:12672
- C:\Windows\System\npsezpv.exe
  C:\Windows\System\npsezpv.exe
  2⤵
  PID:12708
- C:\Windows\System\lOlSxex.exe
  C:\Windows\System\lOlSxex.exe
  2⤵
  PID:12736
- C:\Windows\System\zPMvnKy.exe
  C:\Windows\System\zPMvnKy.exe
  2⤵
  PID:12756
- C:\Windows\System\iwTPAHv.exe
  C:\Windows\System\iwTPAHv.exe
  2⤵
  PID:12788
- C:\Windows\System\FADkcJU.exe
  C:\Windows\System\FADkcJU.exe
  2⤵
  PID:12820
- C:\Windows\System\lyaXxqv.exe
  C:\Windows\System\lyaXxqv.exe
  2⤵
  PID:12856
- C:\Windows\System\foKfPeS.exe
  C:\Windows\System\foKfPeS.exe
  2⤵
  PID:12888
- C:\Windows\System\oKglEWA.exe
  C:\Windows\System\oKglEWA.exe
  2⤵
  PID:12920
- C:\Windows\System\Uczitmg.exe
  C:\Windows\System\Uczitmg.exe
  2⤵
  PID:12944
- C:\Windows\System\pFxsLTU.exe
  C:\Windows\System\pFxsLTU.exe
  2⤵
  PID:12972
- C:\Windows\System\aZrYHMu.exe
  C:\Windows\System\aZrYHMu.exe
  2⤵
  PID:13000
- C:\Windows\System\Lnqlvrg.exe
  C:\Windows\System\Lnqlvrg.exe
  2⤵
  PID:13028
- C:\Windows\System\JKzpdkX.exe
  C:\Windows\System\JKzpdkX.exe
  2⤵
  PID:13060
- C:\Windows\System\ezbXuKX.exe
  C:\Windows\System\ezbXuKX.exe
  2⤵
  PID:13084
- C:\Windows\System\riCvbvj.exe
  C:\Windows\System\riCvbvj.exe
  2⤵
  PID:13112
- C:\Windows\System\YAZgmFX.exe
  C:\Windows\System\YAZgmFX.exe
  2⤵
  PID:13140
- C:\Windows\System\OZqhOVX.exe
  C:\Windows\System\OZqhOVX.exe
  2⤵
  PID:13168
- C:\Windows\System\BHYDSYm.exe
  C:\Windows\System\BHYDSYm.exe
  2⤵
  PID:13196
- C:\Windows\System\ZenveeS.exe
  C:\Windows\System\ZenveeS.exe
  2⤵
  PID:13216
- C:\Windows\System\NzRUakK.exe
  C:\Windows\System\NzRUakK.exe
  2⤵
  PID:13244
- C:\Windows\System\ANQidnX.exe
  C:\Windows\System\ANQidnX.exe
  2⤵
  PID:13272
- C:\Windows\System\pmNnRlm.exe
  C:\Windows\System\pmNnRlm.exe
  2⤵
  PID:13292
- C:\Windows\System\DIbqqkx.exe
  C:\Windows\System\DIbqqkx.exe
  2⤵
  PID:3508
- C:\Windows\System\BBJrROt.exe
  C:\Windows\System\BBJrROt.exe
  2⤵
  PID:12396
- C:\Windows\System\ZmDZCaX.exe
  C:\Windows\System\ZmDZCaX.exe
  2⤵
  PID:12380
- C:\Windows\System\XKaywJe.exe
  C:\Windows\System\XKaywJe.exe
  2⤵
  PID:12460
- C:\Windows\System\GAAwEzj.exe
  C:\Windows\System\GAAwEzj.exe
  2⤵
  PID:12520
- C:\Windows\System\GfgBqYE.exe
  C:\Windows\System\GfgBqYE.exe
  2⤵
  PID:11436
- C:\Windows\System\YqTJpRL.exe
  C:\Windows\System\YqTJpRL.exe
  2⤵
  PID:12680
- C:\Windows\System\kRDnghr.exe
  C:\Windows\System\kRDnghr.exe
  2⤵
  PID:12796
- C:\Windows\System\VvcMpqT.exe
  C:\Windows\System\VvcMpqT.exe
  2⤵
  PID:12800
- C:\Windows\System\mtpCRSF.exe
  C:\Windows\System\mtpCRSF.exe
  2⤵
  PID:12880
- C:\Windows\System\QcQHxuA.exe
  C:\Windows\System\QcQHxuA.exe
  2⤵
  PID:12904
- C:\Windows\System\gIMnZrc.exe
  C:\Windows\System\gIMnZrc.exe
  2⤵
  PID:13016
- C:\Windows\System\JfLkxAh.exe
  C:\Windows\System\JfLkxAh.exe
  2⤵
  PID:13076
- C:\Windows\System\VLtQBEf.exe
  C:\Windows\System\VLtQBEf.exe
  2⤵
  PID:13136
- C:\Windows\System\VnDkYVk.exe
  C:\Windows\System\VnDkYVk.exe
  2⤵
  PID:13188
- C:\Windows\System\TTeJQSt.exe
  C:\Windows\System\TTeJQSt.exe
  2⤵
  PID:13236
- C:\Windows\System\xWOXvJc.exe
  C:\Windows\System\xWOXvJc.exe
  2⤵
  PID:13288
- C:\Windows\System\tOIsVsh.exe
  C:\Windows\System\tOIsVsh.exe
  2⤵
  PID:12352
- C:\Windows\System\IxcDlCJ.exe
  C:\Windows\System\IxcDlCJ.exe
  2⤵
  PID:12448
- C:\Windows\System\EKMMtPP.exe
  C:\Windows\System\EKMMtPP.exe
  2⤵
  PID:1884
- C:\Windows\System\QaHzNop.exe
  C:\Windows\System\QaHzNop.exe
  2⤵
  PID:752
- C:\Windows\System\KkjlWZO.exe
  C:\Windows\System\KkjlWZO.exe
  2⤵
  PID:1764
- C:\Windows\System\yKPaana.exe
  C:\Windows\System\yKPaana.exe
  2⤵
  PID:13232
- C:\Windows\System\OWBHTud.exe
  C:\Windows\System\OWBHTud.exe
  2⤵
  PID:4988
- C:\Windows\System\tDOuGVg.exe
  C:\Windows\System\tDOuGVg.exe
  2⤵
  PID:12696
- C:\Windows\System\pwawjtv.exe
  C:\Windows\System\pwawjtv.exe
  2⤵
  PID:12816
- C:\Windows\System\dYdTwbC.exe
  C:\Windows\System\dYdTwbC.exe
  2⤵
  PID:12968
- C:\Windows\System\QINbkMF.exe
  C:\Windows\System\QINbkMF.exe
  2⤵
  PID:5340
- C:\Windows\System\Cszssau.exe
  C:\Windows\System\Cszssau.exe
  2⤵
  PID:5396
- C:\Windows\System\ACTHBQC.exe
  C:\Windows\System\ACTHBQC.exe
  2⤵
  PID:2136
- C:\Windows\System\XzputwL.exe
  C:\Windows\System\XzputwL.exe
  2⤵
  PID:544
- C:\Windows\System\ndsYmAB.exe
  C:\Windows\System\ndsYmAB.exe
  2⤵
  PID:4948
- C:\Windows\System\yWAaRuk.exe
  C:\Windows\System\yWAaRuk.exe
  2⤵
  PID:12664
- C:\Windows\System\qarZrab.exe
  C:\Windows\System\qarZrab.exe
  2⤵
  PID:1940
- C:\Windows\System\SBFPUoB.exe
  C:\Windows\System\SBFPUoB.exe
  2⤵
  PID:3060
- C:\Windows\System\MhvDunq.exe
  C:\Windows\System\MhvDunq.exe
  2⤵
  PID:12864
- C:\Windows\System\FbYDEFw.exe
  C:\Windows\System\FbYDEFw.exe
  2⤵
  PID:13052
- C:\Windows\System\JepAjJO.exe
  C:\Windows\System\JepAjJO.exe
  2⤵
  PID:5528
- C:\Windows\System\hTyFHhS.exe
  C:\Windows\System\hTyFHhS.exe
  2⤵
  PID:9932
- C:\Windows\System\FjrQmpK.exe
  C:\Windows\System\FjrQmpK.exe
  2⤵
  PID:12876
- C:\Windows\System\QZtPKlZ.exe
  C:\Windows\System\QZtPKlZ.exe
  2⤵
  PID:13336
- C:\Windows\System\JaGRgsk.exe
  C:\Windows\System\JaGRgsk.exe
  2⤵
  PID:13376
- C:\Windows\System\PdzGgue.exe
  C:\Windows\System\PdzGgue.exe
  2⤵
  PID:13404
- C:\Windows\System\ASxMPwi.exe
  C:\Windows\System\ASxMPwi.exe
  2⤵
  PID:13444
- C:\Windows\System\YPjEblJ.exe
  C:\Windows\System\YPjEblJ.exe
  2⤵
  PID:13464
- C:\Windows\System\RkVwzZr.exe
  C:\Windows\System\RkVwzZr.exe
  2⤵
  PID:13492
- C:\Windows\System\BsyltOd.exe
  C:\Windows\System\BsyltOd.exe
  2⤵
  PID:13520
- C:\Windows\System\aumUZRt.exe
  C:\Windows\System\aumUZRt.exe
  2⤵
  PID:13560
- C:\Windows\System\ojohAnT.exe
  C:\Windows\System\ojohAnT.exe
  2⤵
  PID:13588
- C:\Windows\System\EMYgNhK.exe
  C:\Windows\System\EMYgNhK.exe
  2⤵
  PID:13620
- C:\Windows\System\XigHXGA.exe
  C:\Windows\System\XigHXGA.exe
  2⤵
  PID:13652
- C:\Windows\System\rGXVtiX.exe
  C:\Windows\System\rGXVtiX.exe
  2⤵
  PID:13680
- C:\Windows\System\SZMhejb.exe
  C:\Windows\System\SZMhejb.exe
  2⤵
  PID:13708
- C:\Windows\System\XjCXjpF.exe
  C:\Windows\System\XjCXjpF.exe
  2⤵
  PID:13744
- C:\Windows\System\opNdaQn.exe
  C:\Windows\System\opNdaQn.exe
  2⤵
  PID:13784
- C:\Windows\System\CyTgOkw.exe
  C:\Windows\System\CyTgOkw.exe
  2⤵
  PID:13808
- C:\Windows\System\ApmgsVy.exe
  C:\Windows\System\ApmgsVy.exe
  2⤵
  PID:13828
- C:\Windows\System\TXccjNX.exe
  C:\Windows\System\TXccjNX.exe
  2⤵
  PID:13852
- C:\Windows\System\kMRIFaM.exe
  C:\Windows\System\kMRIFaM.exe
  2⤵
  PID:13876
- C:\Windows\System\uTjstul.exe
  C:\Windows\System\uTjstul.exe
  2⤵
  PID:13912
- C:\Windows\System\DMSOZog.exe
  C:\Windows\System\DMSOZog.exe
  2⤵
  PID:13932
- C:\Windows\System\rAFlhoj.exe
  C:\Windows\System\rAFlhoj.exe
  2⤵
  PID:13964
- C:\Windows\System\tYEpJCA.exe
  C:\Windows\System\tYEpJCA.exe
  2⤵
  PID:13984
- C:\Windows\System\dIWFrTy.exe
  C:\Windows\System\dIWFrTy.exe
  2⤵
  PID:14012
- C:\Windows\System\FgqRCeG.exe
  C:\Windows\System\FgqRCeG.exe
  2⤵
  PID:14048
- C:\Windows\System\GzYmiWO.exe
  C:\Windows\System\GzYmiWO.exe
  2⤵
  PID:14080
- C:\Windows\System\TwklymC.exe
  C:\Windows\System\TwklymC.exe
  2⤵
  PID:14104
- C:\Windows\System\fligDaJ.exe
  C:\Windows\System\fligDaJ.exe
  2⤵
  PID:14132
- C:\Windows\System\yutOVsG.exe
  C:\Windows\System\yutOVsG.exe
  2⤵
  PID:14172
- C:\Windows\System\ZOzOTCm.exe
  C:\Windows\System\ZOzOTCm.exe
  2⤵
  PID:14200
- C:\Windows\System\VRvUFZD.exe
  C:\Windows\System\VRvUFZD.exe
  2⤵
  PID:14228
- C:\Windows\System\ihRPlsZ.exe
  C:\Windows\System\ihRPlsZ.exe
  2⤵
  PID:14256
- C:\Windows\System\mHdEtks.exe
  C:\Windows\System\mHdEtks.exe
  2⤵
  PID:14284
- C:\Windows\System\ndgqyHW.exe
  C:\Windows\System\ndgqyHW.exe
  2⤵
  PID:14300
- C:\Windows\System\rgESHBB.exe
  C:\Windows\System\rgESHBB.exe
  2⤵
  PID:13104
- C:\Windows\System\Tcdsvaz.exe
  C:\Windows\System\Tcdsvaz.exe
  2⤵
  PID:12404
- C:\Windows\System\CWlPRCF.exe
  C:\Windows\System\CWlPRCF.exe
  2⤵
  PID:13332
- C:\Windows\System\LhuAPIO.exe
  C:\Windows\System\LhuAPIO.exe
  2⤵
  PID:13356
- C:\Windows\System\kyVjUdy.exe
  C:\Windows\System\kyVjUdy.exe
  2⤵
  PID:13456
- C:\Windows\System\pAsGWDR.exe
  C:\Windows\System\pAsGWDR.exe
  2⤵
  PID:13516
- C:\Windows\System\KxVwMjL.exe
  C:\Windows\System\KxVwMjL.exe
  2⤵
  PID:13576
- C:\Windows\System\ONOnEeB.exe
  C:\Windows\System\ONOnEeB.exe
  2⤵
  PID:13604
- C:\Windows\System\oaLsGRE.exe
  C:\Windows\System\oaLsGRE.exe
  2⤵
  PID:13692
- C:\Windows\System\QEFBDtR.exe
  C:\Windows\System\QEFBDtR.exe
  2⤵
  PID:13796
- C:\Windows\System\dniYCpJ.exe
  C:\Windows\System\dniYCpJ.exe
  2⤵
  PID:13824
- C:\Windows\System\WsbvTcB.exe
  C:\Windows\System\WsbvTcB.exe
  2⤵
  PID:13952
- C:\Windows\System\TfnvunJ.exe
  C:\Windows\System\TfnvunJ.exe
  2⤵
  PID:4552
- C:\Windows\System\QVunuaE.exe
  C:\Windows\System\QVunuaE.exe
  2⤵
  PID:13948
- C:\Windows\System\wQUrXvU.exe
  C:\Windows\System\wQUrXvU.exe
  2⤵
  PID:14036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:14116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AHdjYrJ.exe

Filesize
2.1MB

MD5
50c8b673140560eb5a3a918a71b0d98b

SHA1
ecc7cb0e702b91000e75c4414ec0c15394291d7b

SHA256
6d8f7ea0ba3b2cfe7af04ec99d83ac17254ee1d9f3b92410c238a63306f5c894

SHA512
44068c2b94b5fa41b5a458f90e3d2457eee550ef9955fc3a66946ae7832b88486a1621d111c382e2d7640b2f8afd918afbb3767a35ee616d6765d6578813bac7

Download Submit
C:\Windows\System\CFioFyw.exe

Filesize
2.1MB

MD5
c8e2db4eded8b6df0da2c78f69d64794

SHA1
729add6da6c01d1215b93cfb271b1f2290bc398c

SHA256
ebf6ecc0f082dfc730e1d0015db17a6ad65701d7a18edcd70abc924bb2f7f921

SHA512
1880b7f4ae3263cc4b9dbc0df2aa70826ce831a08e374b038fedbc7d033e1f389943372f3cb04f2e89fd999801758d9e2b04b9ea632875551d0f56a676221a2b

Download Submit
C:\Windows\System\CHEoFKQ.exe

Filesize
2.1MB

MD5
1731f00329267a5129c537a7379d502e

SHA1
585499db9ce8fb81f589b768be2b3efd3ad1f6d8

SHA256
655a135490c9333aca863ef6f38ad49d0ee648c8ef16685d3af1236823d88e37

SHA512
3f11ebf055c251513a05fa3b16b2492d2d3bf3636bd71b969e67f56d40165b71da28d7ae8b1c5ccba4ba568515326884dfeb08a49c50105ebf803a204735160e

Download Submit
C:\Windows\System\FnFRrRr.exe

Filesize
2.1MB

MD5
2e1f451067c3be8a18c7626f4a26863d

SHA1
00c44a6d21bc3daa3bc4fff8544b29810f425139

SHA256
de6f41783fd71c776a825ca37ada8b46341c6807353e3632713c8dd0093b2077

SHA512
04a844e717d9bad4d0f6ef44f28ac3a8194b87666858267d6a5e0b6d0f048f029152515235693ad5a4c51a0dd1b38c6334170d10f19e01e0445ad5194666aaa0

Download Submit
C:\Windows\System\GntaZxO.exe

Filesize
2.1MB

MD5
9d277d227bee96ba39d4ba964bc5e8ec

SHA1
fd60fdbd3bca12506730bacf9b445bb8904cd1bd

SHA256
d1a0f31bcc58bc57f81bce7df147de0e72502f820625b4a07af8a3777c84597e

SHA512
09401e03844cab9cb5cc4fa440092da0971827a3fac817753d9c9d1cdc5047c8d05567cb2ed3ba99a0e3866fc07425d3b9377768b3abf700027d927e014cb357

Download Submit
C:\Windows\System\HyHERvA.exe

Filesize
2.1MB

MD5
4a1b2c5a75ed9aa15595a2a4634b91a5

SHA1
ba710a8415d68d8d11ff582634bcaf554b0215c4

SHA256
ab13c964dce8a9854d4b0234cce3b38e753a1bfa7c48ff168c6ee870944aa51b

SHA512
f4f2212684e5516c42a7c5d576d7b3b288a07a47d8e51adc5972f7522518699a0b5615acc68f48d5290a8fd76a17487ef90fddbd4c2a1c4ffb13e1f7288133c5

Download Submit
C:\Windows\System\IHOibKL.exe

Filesize
2.1MB

MD5
9d16c2bc0a3f81f7e34f7bf7477e49f2

SHA1
f0f9a53151ca306c3b22d311098719853a5f7fff

SHA256
76d137b75bc93cd1d929f7ee5fa1c8c14813c54771ea48a22e8611ab07333200

SHA512
dbaf02f0cc7d5706fdeec3afcb08945ceb2a70702125ca336b251590e3c3f79dd6e083458f703539cd6db40438585fc51b875de568e504096e3e51ca66c9ffdf

Download Submit
C:\Windows\System\IHVPwIr.exe

Filesize
2.1MB

MD5
ee9b151f0b16a079f684bc0d798a419d

SHA1
0eb1c1d83c5959dcb3a0bb3e7e61d96ac1c97b1e

SHA256
bad9f64e6c4051049ef5e9eaee91618bb3bbb7d31b14495c6fb6154b79d4e7b4

SHA512
e1dffc438a249233180a12db5342e8c11475d5d49d9a5db20b30be17fc6eafc36e1bba0dd626a12eae7b2a383a82e69f9f59971b4a46ed5deeef347643c4ead6

Download Submit
C:\Windows\System\JycpLzv.exe

Filesize
2.1MB

MD5
c7dd49b2c1f0bb21f7f1a4fd1fe1ed30

SHA1
d8f4d61b8c2785577a9a9fc020aab43f97eaf273

SHA256
fb76683a204d14b55d17fac6e4bd0af0cf31418dc3200ab6febc5eb612a3c732

SHA512
c94da42f0852c1d88a8f8d9b9eddc4b7bb6f061c8c6ac931368803b088ee75ae77c897c569b33402516a9b89a3b6e82f418ac954e1f30d3af8c2cb25ced4f993

Download Submit
C:\Windows\System\KQAYaHX.exe

Filesize
2.1MB

MD5
0ea1063d531a2b9127869c7ca0b40bf2

SHA1
934918cae890caeaae12936b067d192d6005ed6a

SHA256
0d5b2368bf545b5dfc2fce4b9441d831ccb0b2d1d27233adbf4f163e9922ac5a

SHA512
23e637e1473e2097e49a23ae28bfb988ce4567fa27bda7ab7e958dcbdcbf4cdbd55382b1bd0b01d3cb81302a46d0a421926adff08d2c24e6eaefdbe6cc0dc14d

Download Submit
C:\Windows\System\LsQYQli.exe

Filesize
2.1MB

MD5
188cc06787d95ca26febaf84bb979026

SHA1
716053d302efdeff44c80ae1f8220da569934325

SHA256
3d703ad34a0a81af51fe621f67f2ed4ef9377d1f133c9fb6b6acdb56f57c30c3

SHA512
2559eb5075d31eefe0296454602d00367e44fa6e4f50104f31e3b5ba7d54a8d28ee9c89478f8ad44204ead091e32cc07c52fb439896d9544214456d7e6fc0e64

Download Submit
C:\Windows\System\RaDmqOA.exe

Filesize
2.1MB

MD5
2f81dd03c0a69441b32c7d969d761f50

SHA1
85ed91be021defa5c72f6be2b226cd7ea36096b7

SHA256
c3c1e4ddba1f79b9af19741275b1fde8e698ceb5291a0d8e623055428d4abce0

SHA512
65dbe30ae4aae6dd0f9a10d249d14d42e46d508a0a8374d4eac4c9f107208e19a9ab6c1478d7dd02dcd9540f9431fd94d6a8f8203396fa3526c888c0ab48b7c3

Download Submit
C:\Windows\System\SJaTYVp.exe

Filesize
2.1MB

MD5
e29f23c754292801796929db2d0410cd

SHA1
e6c8ba5af49ecf67fbbbd46bb97515965cbb2d15

SHA256
ae3e017a4734a9e2df6fe084ade814981000b2aedc628bdd61e10274d1085ee4

SHA512
8f6984b43a97eec6c6a28a53b8c56fdb0f134b608dca8754668380cb7ea35db6e7e10ab0782aef4d04092c59d4b06bb8e33998aabad594c57c5f0b086cf35aaf

Download Submit
C:\Windows\System\XCiuKYP.exe

Filesize
2.1MB

MD5
bd05abf50ce7d896d87ed70718ee5ec1

SHA1
c333a0a75e039aadea41e4f2bf840eea82b22616

SHA256
04af30741fe555f5090d4b8ca4b719450e33cf8b04efabb1f272f1e2876748aa

SHA512
06fa4af22bb38677e0c787b8b43b7260ec4b106ce12005576387fb68e0032501053e4f674ed918cc347f89245523b8cbacc719aa079b5a2f1b2492a799729612

Download Submit
C:\Windows\System\XVrIoJF.exe

Filesize
2.1MB

MD5
e5613bb8717c6d30a135030dd7919c9a

SHA1
013a0df8166ec01545c5820eb48ee302d83d1404

SHA256
cc503f3d4e4ae62ab1212437fcd9908a70cd867333134a4560ab6718f64dbe40

SHA512
3628c0db69bf600f7f41964824366bc7351d211d3f8e54d732f29bdbe2670b5f1122729aca635986c17342c7106762ca4973e0202e6ecb652c41309e4f59ced0

Download Submit
C:\Windows\System\bjyQkVB.exe

Filesize
2.1MB

MD5
c308b746691423f8294ee6e0b22fc77e

SHA1
1c9e3818b267180aca89de60d4aa0b140c89c173

SHA256
81cd6eebd306d790f58d4926c4a8401cdff9d44c0ee005463891b68ff9f63631

SHA512
7821d7e8802bc4614b12d3e7c03c3762d4bca0b7a53d63e016d3b7b93fd72e6268ede5c3dc142f2fc5256aa90d48a93ac72c1845f99852ff49b2cc1890c347a5

Download Submit
C:\Windows\System\ftsJPJz.exe

Filesize
2.1MB

MD5
51bf9d874d34b98b58bd792ea33c7a68

SHA1
684907f93a19f326a21960aa33e433447b56077e

SHA256
b13eb9dd85cb0395ae753f17b51a6ac3ed86af5c6bed5e97aecfb8a37601d7e4

SHA512
2264bbcc78c034911544acccdf48e5fe98feab9a9f47f7b5ba2fc0f947ee78dd28ed3e87aa66bc08480f1dcc1477ad59029d63f87d11f9eccc5d80bb244b01d6

Download Submit
C:\Windows\System\fturyXN.exe

Filesize
2.1MB

MD5
2f53c31ba30eac0333e84b35e163a6f4

SHA1
a8f177a506cdc6e87a62e1be50a441009b41e9e2

SHA256
b21cdbb5b16b35e24a9088c493ef361f6bfd2cb83b957efdc1f43676270f289b

SHA512
e7ad43b94ea386d6438c2556227b03d4c66d5da80f6eb52ffcac31de6185922c3e9de41cd2ddaf9f4b8704d73924475f48cdee719056c6663409fac78f4c1d8f

Download Submit
C:\Windows\System\fwUTXuy.exe

Filesize
2.1MB

MD5
2aba4e56e7c90f8ab65a8b7e0bfcb5b5

SHA1
c8bc13c25f693f51bd8ae991421a7c2c38e5cf64

SHA256
90b9c2313dbc55b9276e20ad79d8230d7b045ec17eb835b5487e22d0c9d98508

SHA512
ebeeab50a6874e22c2e1531a42902b64034a7f860d067fc14a51d7034478501ee9762d7f71426f223fac47053234bf4514aefd276875b793bda163c67dd88347

Download Submit
C:\Windows\System\igNWfvr.exe

Filesize
2.1MB

MD5
0c62c0d4bfe1e76c6c51d208c334e6e2

SHA1
ef24017f068e7949519a4d8d1ec139f65e7f5676

SHA256
5929ffe9324dbf1afadc8c047731696e6d8851671206c282da2131e60b1b6a98

SHA512
b33545acfc76356622dcde8a6d1ec0f9f7053abe507742436a13ae99af7bcde593f2e8589d8186ac0fe9a0471eb588a329cb6559041f6b0e45ad90231b118812

Download Submit
C:\Windows\System\jLLrdgC.exe

Filesize
2.1MB

MD5
30af5b42c7143fed43f60f93971bc5b1

SHA1
945faafff01f2a443e479f42e651e941fb2d7b7e

SHA256
b39cf0aa6ab36e4779655305c8a5a4796888e945de021b0c86f4d2d07cfe8cb9

SHA512
8a08da57013efb2c0dae74202e91bb9b4203e5006a96a3e537842727909213f86c45bfa88b5cc588ff8f526a0314792f06cc4272b54603b7991eff41c193ab1e

Download Submit
C:\Windows\System\jNeBwWg.exe

Filesize
2.1MB

MD5
3002c472fa05d9b4e731b0fdf6b4d1f4

SHA1
fdad4c8d1555067ea8cc630f13a851ca3c1243e3

SHA256
c4e06875a1c335ea3398725f22f806d8d65f09180d04f6fe10d49d6c27123e64

SHA512
88d7c6a847d7e2e134c13d0f7efe33279a184aa87de7232fc6734dc771e4295f23c2b41fd80cf9d2e70a171f0c2460d30f5985312efc0f542f49e406aa096cff

Download Submit
C:\Windows\System\kksyZYN.exe

Filesize
2.1MB

MD5
753ad655f2b227f3fb14ea95c89192ad

SHA1
25d5caeaaead1066c23388b6cfaed9ebc333e0a1

SHA256
92ae26a66c8fbcef7a9901e6da16e0e8081167c9d7d63ae5c9809bbf4f2def59

SHA512
067aa68571f67f44ad1d47d2e082560f5962b60ab10543fcb435820e84c462fc3d5ca38d36b1407c4a8d9f67d348fcc92bae1cadb770c1cf9c939f9145d1c7d3

Download Submit
C:\Windows\System\lLDDgif.exe

Filesize
2.1MB

MD5
084c38130fba63defa0fcd41cedb64b2

SHA1
3ca8bed2d086f4abfb06756775a0f6a11d644664

SHA256
874ac725e12ed3fe6733cea8c00b5c013f925eff0d44588419a13006747d32da

SHA512
2c892d7389e122aaad645a4da2a735f4b0128198ead8465d0d514ea433fa125c46288f32e469173a7d4a47de870bcea0f4f3fab6471bc6b19f17f6b89c098d05

Download Submit
C:\Windows\System\nkPgOGo.exe

Filesize
2.1MB

MD5
d40618fa78fd131a205be9a66fa53e98

SHA1
98a04f18ac03c9e95edc808214ac766744d9342c

SHA256
79c6d9af6e3a9e25b528658294fa7798d44e497868151efc390eda800e90744a

SHA512
5a57f25d23027d2240bd02917958b72da62b9edccff7f1974c36d4fa973ab20254a85072cb5f092c4cf2c9f9f3e7e20a88ed2725626685ef62c7db9833ce6c1a

Download Submit
C:\Windows\System\ooZoVDG.exe

Filesize
2.1MB

MD5
5c832ffd5be15e7cd85c5104008c346e

SHA1
1310f558bb2089063fbac3931dfe45498529e660

SHA256
063a31abe6ebd03257a88353096509673a98f3377a5b9eef3d354a03685cd73f

SHA512
8048fa5b21ebb955912ea1d5be00b18ef97afb5af92d0d8186e5c80137c258ca755ae4ff13adb07880379313b7c83788b87c50de53e2781d29573ecb8562db54

Download Submit
C:\Windows\System\pPEakvp.exe

Filesize
2.1MB

MD5
f101251dddc7373485d06d266a8aac16

SHA1
bdf3ce1f3b70daabf345980f1472c84b27b4b73d

SHA256
2f51be88137cb67637fb54bd5088f8a6f0c7eed6e23c83d9d58c25d0a9bee493

SHA512
f027fd4feac2592548d545faa5890cefdb691a89fb6488c43b4658e51e2e399f6c9d4c93d1b144897d97bcced30d2b906cd104023eddbb9bb4f0d23fb48547e4

Download Submit
C:\Windows\System\ridecQe.exe

Filesize
2.1MB

MD5
2554cd5bda2a6106b857a0117386a352

SHA1
5f661b898efe9be6ad60e7948e0d45424793950c

SHA256
b6fda3c845f912cf055c3e8c1aafc4b3cbdccfd229d20c3d81de60eff0cdb0ab

SHA512
09fa93480c79b49e2348048f4e834809adc64b6f9b9d6e0bfe4595b5964d491f981a0f97b0bc342eabeb793dbdf2f3beb288bd4a5742e71d71f7154755da762d

Download Submit
C:\Windows\System\rmLcECb.exe

Filesize
2.1MB

MD5
35cc47d23268dc4164aae806605ea5b8

SHA1
5fa37dd73854c1394fbbd804f98c37493441b58a

SHA256
b281a004b5ddde88ce92e09ad6a63beca7de410cf5a59a2c71d5412775d0aa6a

SHA512
e68acd5352d7af76e0ec9a468e037253775198e19fa0fca565ad84e69bf55924e1f29478fcbe3a6f2a8efa72baa7473a215d9d4e4a6f7d3f1cda8ba69395c265

Download Submit
C:\Windows\System\sjaneNR.exe

Filesize
2.1MB

MD5
a49289d59c2d5ec2286331b531efa98c

SHA1
008f5bfd010b40fb4386980aad7016c52e2268bc

SHA256
f0373f809a420bed50d0399102b115bdb7660fc37d2c50f505e7ef0f3232ab41

SHA512
959b3af9b2e7ef4fbcbaaa671cde70dea0b61a2c947c0a39a66e96c2c1bf24d7583612451fc760dc6cfed726e0bdda4da13262417e97223b7214693aed9b1910

Download Submit
C:\Windows\System\tLzNkqz.exe

Filesize
2.1MB

MD5
c77e83ca8c46c1d905a1ce12d731c8d0

SHA1
a8dee231d8e74979bc8b1c671bbc42ee775aa3cd

SHA256
cdc19736e8847958d3b36af80c9e600b65f852a354ab851e94d121cab6d3394a

SHA512
c47d72459636bdf669678c3ed7ee33fbc289d7e092a3bb51fe370325efe3465c62919722f27da2e241ffdea7510b1337d6de09e2bb4f53d38eb3caf22c52b4d6

Download Submit
C:\Windows\System\xLsuUSk.exe

Filesize
2.1MB

MD5
9cab99bd816466b36ba0fe83649268ca

SHA1
1c67a156e377e56b96b8f7de59c6062d5397c638

SHA256
fcab9ce453a6bb5d7faf8889e6326c4865e56a9ace30eda4e61311f1caf2a466

SHA512
1cace75e4f0bdf58467a2d4c949d467cbf0dbead3a3a17bf995346943c15ff39fa0d247f7358340932b95599d9e547c7a25000f3400db2c90b710951efe7b16b

Download Submit
C:\Windows\System\yNKnxWr.exe

Filesize
2.1MB

MD5
70f1059cba6401d221a5017caad7293f

SHA1
5028fa8cd77d76fd6eaecfb44d34261c26711262

SHA256
706612b9fa22c1689d18f538f563083fe324ee090856f32318f4d241bb33c991

SHA512
aeba7ba5bb5147a056645bd4f021d74e2ad2e6403dc209e42659e56e692d8d8b5efadc1deab780ee0aaca5f2a21c3a2234ec9879612b6d412a53b7c46ab9fa53

Download Submit
memory/1852-2136-0x00007FF64F480000-0x00007FF64F7D4000-memory.dmp

Filesize
3.3MB

Download
memory/1852-551-0x00007FF64F480000-0x00007FF64F7D4000-memory.dmp

Filesize
3.3MB

Download
memory/1864-2148-0x00007FF68BBD0000-0x00007FF68BF24000-memory.dmp

Filesize
3.3MB

Download
memory/1864-631-0x00007FF68BBD0000-0x00007FF68BF24000-memory.dmp

Filesize
3.3MB

Download
memory/1888-2147-0x00007FF6EF7D0000-0x00007FF6EFB24000-memory.dmp

Filesize
3.3MB

Download
memory/1888-625-0x00007FF6EF7D0000-0x00007FF6EFB24000-memory.dmp

Filesize
3.3MB

Download
memory/2040-632-0x00007FF7CBC50000-0x00007FF7CBFA4000-memory.dmp

Filesize
3.3MB

Download
memory/2040-2150-0x00007FF7CBC50000-0x00007FF7CBFA4000-memory.dmp

Filesize
3.3MB

Download
memory/2172-2137-0x00007FF7FE2B0000-0x00007FF7FE604000-memory.dmp

Filesize
3.3MB

Download
memory/2172-601-0x00007FF7FE2B0000-0x00007FF7FE604000-memory.dmp

Filesize
3.3MB

Download
memory/2240-637-0x00007FF6B7090000-0x00007FF6B73E4000-memory.dmp

Filesize
3.3MB

Download
memory/2240-2151-0x00007FF6B7090000-0x00007FF6B73E4000-memory.dmp

Filesize
3.3MB

Download
memory/2280-2143-0x00007FF7360F0000-0x00007FF736444000-memory.dmp

Filesize
3.3MB

Download
memory/2280-560-0x00007FF7360F0000-0x00007FF736444000-memory.dmp

Filesize
3.3MB

Download
memory/2292-14-0x00007FF77A190000-0x00007FF77A4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2292-820-0x00007FF77A190000-0x00007FF77A4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2464-2145-0x00007FF6D5730000-0x00007FF6D5A84000-memory.dmp

Filesize
3.3MB

Download
memory/2464-614-0x00007FF6D5730000-0x00007FF6D5A84000-memory.dmp

Filesize
3.3MB

Download
memory/2472-639-0x00007FF725130000-0x00007FF725484000-memory.dmp

Filesize
3.3MB

Download
memory/2472-2152-0x00007FF725130000-0x00007FF725484000-memory.dmp

Filesize
3.3MB

Download
memory/2496-1508-0x00007FF607520000-0x00007FF607874000-memory.dmp

Filesize
3.3MB

Download
memory/2496-2091-0x00007FF607520000-0x00007FF607874000-memory.dmp

Filesize
3.3MB

Download
memory/2496-26-0x00007FF607520000-0x00007FF607874000-memory.dmp

Filesize
3.3MB

Download
memory/2644-20-0x00007FF783CC0000-0x00007FF784014000-memory.dmp

Filesize
3.3MB

Download
memory/2644-2090-0x00007FF783CC0000-0x00007FF784014000-memory.dmp

Filesize
3.3MB

Download
memory/2836-534-0x00007FF7FD290000-0x00007FF7FD5E4000-memory.dmp

Filesize
3.3MB

Download
memory/2836-8-0x00007FF7FD290000-0x00007FF7FD5E4000-memory.dmp

Filesize
3.3MB

Download
memory/2928-2135-0x00007FF766DE0000-0x00007FF767134000-memory.dmp

Filesize
3.3MB

Download
memory/2928-67-0x00007FF766DE0000-0x00007FF767134000-memory.dmp

Filesize
3.3MB

Download
memory/2932-2128-0x00007FF74D370000-0x00007FF74D6C4000-memory.dmp

Filesize
3.3MB

Download
memory/2932-56-0x00007FF74D370000-0x00007FF74D6C4000-memory.dmp

Filesize
3.3MB

Download
memory/3216-2139-0x00007FF78CB20000-0x00007FF78CE74000-memory.dmp

Filesize
3.3MB

Download
memory/3216-593-0x00007FF78CB20000-0x00007FF78CE74000-memory.dmp

Filesize
3.3MB

Download
memory/3328-2144-0x00007FF7DFC50000-0x00007FF7DFFA4000-memory.dmp

Filesize
3.3MB

Download
memory/3328-612-0x00007FF7DFC50000-0x00007FF7DFFA4000-memory.dmp

Filesize
3.3MB

Download
memory/3456-2140-0x00007FF7F0420000-0x00007FF7F0774000-memory.dmp

Filesize
3.3MB

Download
memory/3456-578-0x00007FF7F0420000-0x00007FF7F0774000-memory.dmp

Filesize
3.3MB

Download
memory/3656-38-0x00007FF68A3A0000-0x00007FF68A6F4000-memory.dmp

Filesize
3.3MB

Download
memory/3656-2092-0x00007FF68A3A0000-0x00007FF68A6F4000-memory.dmp

Filesize
3.3MB

Download
memory/3668-584-0x00007FF789AC0000-0x00007FF789E14000-memory.dmp

Filesize
3.3MB

Download
memory/3668-2141-0x00007FF789AC0000-0x00007FF789E14000-memory.dmp

Filesize
3.3MB

Download
memory/3680-547-0x00007FF61A560000-0x00007FF61A8B4000-memory.dmp

Filesize
3.3MB

Download
memory/3680-2134-0x00007FF61A560000-0x00007FF61A8B4000-memory.dmp

Filesize
3.3MB

Download
memory/3724-2132-0x00007FF67C7F0000-0x00007FF67CB44000-memory.dmp

Filesize
3.3MB

Download
memory/3724-43-0x00007FF67C7F0000-0x00007FF67CB44000-memory.dmp

Filesize
3.3MB

Download
memory/3944-2146-0x00007FF73E370000-0x00007FF73E6C4000-memory.dmp

Filesize
3.3MB

Download
memory/3944-620-0x00007FF73E370000-0x00007FF73E6C4000-memory.dmp

Filesize
3.3MB

Download
memory/4224-2138-0x00007FF7715D0000-0x00007FF771924000-memory.dmp

Filesize
3.3MB

Download
memory/4224-597-0x00007FF7715D0000-0x00007FF771924000-memory.dmp

Filesize
3.3MB

Download
memory/4400-2133-0x00007FF7FF2F0000-0x00007FF7FF644000-memory.dmp

Filesize
3.3MB

Download
memory/4400-57-0x00007FF7FF2F0000-0x00007FF7FF644000-memory.dmp

Filesize
3.3MB

Download
memory/4412-65-0x00007FF694260000-0x00007FF6945B4000-memory.dmp

Filesize
3.3MB

Download
memory/4412-1-0x000002730EC20000-0x000002730EC30000-memory.dmp

Filesize
64KB

Download
memory/4412-0-0x00007FF694260000-0x00007FF6945B4000-memory.dmp

Filesize
3.3MB

Download
memory/4548-1510-0x00007FF778D60000-0x00007FF7790B4000-memory.dmp

Filesize
3.3MB

Download
memory/4548-34-0x00007FF778D60000-0x00007FF7790B4000-memory.dmp

Filesize
3.3MB

Download
memory/4684-628-0x00007FF6A8B70000-0x00007FF6A8EC4000-memory.dmp

Filesize
3.3MB

Download
memory/4684-2149-0x00007FF6A8B70000-0x00007FF6A8EC4000-memory.dmp

Filesize
3.3MB

Download
memory/5000-2131-0x00007FF794410000-0x00007FF794764000-memory.dmp

Filesize
3.3MB

Download
memory/5000-61-0x00007FF794410000-0x00007FF794764000-memory.dmp

Filesize
3.3MB

Download
memory/5024-2142-0x00007FF7745C0000-0x00007FF774914000-memory.dmp

Filesize
3.3MB

Download
memory/5024-566-0x00007FF7745C0000-0x00007FF774914000-memory.dmp

Filesize
3.3MB

Download