xmrig | 34a0f0e58b3337ddf7a644e0509f10b4012643494aab348b59c715e85024e914

Analysis

max time kernel
114s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
Size

1.9MB
MD5

08819bfb558eb2fc6ec26c659ea90c50
SHA1

2efc7cbe34a813594e7e74addb5ab0d8721797e8
SHA256

34a0f0e58b3337ddf7a644e0509f10b4012643494aab348b59c715e85024e914
SHA512

b16f13879d57250e8904cdc1de598df8da982e2792a140c7a7b7cac9e083d90dc91bd020639d16ba07f9e89d4a8dd0e3332a5f13e41578654d2454baf6770a1f
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIlZtku+FX/O29:BemTLkNdfE0pZrS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3968-0-0x00007FF6A8510000-0x00007FF6A8864000-memory.dmp	xmrig
behavioral2/files/0x0008000000023244-5.dat	xmrig
behavioral2/memory/3424-8-0x00007FF7CC220000-0x00007FF7CC574000-memory.dmp	xmrig
behavioral2/files/0x0008000000023247-11.dat	xmrig
behavioral2/files/0x000800000002324a-16.dat	xmrig
behavioral2/memory/2940-20-0x00007FF7CE800000-0x00007FF7CEB54000-memory.dmp	xmrig
behavioral2/files/0x000800000002324c-22.dat	xmrig
behavioral2/files/0x000700000002324e-31.dat	xmrig
behavioral2/files/0x0007000000023250-49.dat	xmrig
behavioral2/files/0x0007000000023251-56.dat	xmrig
behavioral2/memory/2384-62-0x00007FF78E1B0000-0x00007FF78E504000-memory.dmp	xmrig
behavioral2/memory/3704-63-0x00007FF739010000-0x00007FF739364000-memory.dmp	xmrig
behavioral2/memory/1912-65-0x00007FF7E6930000-0x00007FF7E6C84000-memory.dmp	xmrig
behavioral2/memory/4004-64-0x00007FF7F76F0000-0x00007FF7F7A44000-memory.dmp	xmrig
behavioral2/files/0x000700000002324f-61.dat	xmrig
behavioral2/files/0x0007000000023252-58.dat	xmrig
behavioral2/memory/1352-54-0x00007FF7D1C50000-0x00007FF7D1FA4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023248-52.dat	xmrig
behavioral2/files/0x0007000000023255-77.dat	xmrig
behavioral2/files/0x0007000000023256-87.dat	xmrig
behavioral2/files/0x000700000002325a-98.dat	xmrig
behavioral2/memory/1032-104-0x00007FF628FB0000-0x00007FF629304000-memory.dmp	xmrig
behavioral2/memory/3720-107-0x00007FF701120000-0x00007FF701474000-memory.dmp	xmrig
behavioral2/files/0x0007000000023258-121.dat	xmrig
behavioral2/files/0x000700000002325b-119.dat	xmrig
behavioral2/files/0x0007000000023259-115.dat	xmrig
behavioral2/files/0x0007000000023257-113.dat	xmrig
behavioral2/memory/3420-110-0x00007FF7DE140000-0x00007FF7DE494000-memory.dmp	xmrig
behavioral2/memory/1620-109-0x00007FF6BC1A0000-0x00007FF6BC4F4000-memory.dmp	xmrig
behavioral2/memory/4480-108-0x00007FF640320000-0x00007FF640674000-memory.dmp	xmrig
behavioral2/memory/2848-106-0x00007FF625170000-0x00007FF6254C4000-memory.dmp	xmrig
behavioral2/memory/3580-105-0x00007FF6070C0000-0x00007FF607414000-memory.dmp	xmrig
behavioral2/memory/2880-103-0x00007FF6116B0000-0x00007FF611A04000-memory.dmp	xmrig
behavioral2/memory/4404-99-0x00007FF6809B0000-0x00007FF680D04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023254-82.dat	xmrig
behavioral2/files/0x0007000000023253-78.dat	xmrig
behavioral2/memory/4316-45-0x00007FF7AA500000-0x00007FF7AA854000-memory.dmp	xmrig
behavioral2/memory/5108-38-0x00007FF6AF020000-0x00007FF6AF374000-memory.dmp	xmrig
behavioral2/memory/2740-35-0x00007FF6F38A0000-0x00007FF6F3BF4000-memory.dmp	xmrig
behavioral2/files/0x000700000002325d-128.dat	xmrig
behavioral2/memory/2964-145-0x00007FF667A50000-0x00007FF667DA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023263-159.dat	xmrig
behavioral2/files/0x0007000000023265-171.dat	xmrig
behavioral2/memory/1696-175-0x00007FF65EC50000-0x00007FF65EFA4000-memory.dmp	xmrig
behavioral2/memory/1324-177-0x00007FF7FA780000-0x00007FF7FAAD4000-memory.dmp	xmrig
behavioral2/memory/1796-179-0x00007FF60F1A0000-0x00007FF60F4F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023261-181.dat	xmrig
behavioral2/files/0x0007000000023266-183.dat	xmrig
behavioral2/memory/1664-178-0x00007FF7909D0000-0x00007FF790D24000-memory.dmp	xmrig
behavioral2/memory/1964-176-0x00007FF7C96A0000-0x00007FF7C99F4000-memory.dmp	xmrig
behavioral2/memory/3968-174-0x00007FF6A8510000-0x00007FF6A8864000-memory.dmp	xmrig
behavioral2/memory/4128-173-0x00007FF61ADD0000-0x00007FF61B124000-memory.dmp	xmrig
behavioral2/memory/4700-169-0x00007FF7A6540000-0x00007FF7A6894000-memory.dmp	xmrig
behavioral2/files/0x0007000000023264-164.dat	xmrig
behavioral2/files/0x000700000002325e-163.dat	xmrig
behavioral2/files/0x0007000000023262-158.dat	xmrig
behavioral2/memory/4872-156-0x00007FF7A3360000-0x00007FF7A36B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002325f-152.dat	xmrig
behavioral2/files/0x0007000000023260-147.dat	xmrig
behavioral2/files/0x000700000002325c-131.dat	xmrig
behavioral2/files/0x000700000002324d-34.dat	xmrig
behavioral2/memory/4268-26-0x00007FF78BBA0000-0x00007FF78BEF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023267-190.dat	xmrig
behavioral2/memory/3424-697-0x00007FF7CC220000-0x00007FF7CC574000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3424	sqrmVvM.exe
2940	zerddoZ.exe
4268	lJaLzwd.exe
2740	XoVnmlv.exe
4316	gmDbgIP.exe
5108	lspTfxe.exe
3704	kEACDwT.exe
1352	DszbmFQ.exe
4004	yYFCMVA.exe
1912	ZWZqqPf.exe
2384	fEreYhE.exe
4404	PIIHJDl.exe
2880	ICTYyQg.exe
1032	kXjVFON.exe
3580	iFYqFkd.exe
2848	PfteLho.exe
3720	VOMXEGv.exe
1620	CfapOQP.exe
4480	SAvEZUu.exe
3420	wHjxXqT.exe
2964	JiUSoGS.exe
1696	TLTjKgs.exe
1964	hGyrhIf.exe
1324	BtmRVIp.exe
4872	axwXNFt.exe
1664	ZsGovbF.exe
4700	okVWkpe.exe
1796	eygVXCn.exe
4128	uiydrgN.exe
3192	izFNvOo.exe
3928	ANgDumQ.exe
4012	MZkfWoK.exe
4728	ajrsDPk.exe
3508	ZyggIYa.exe
2948	nRENboa.exe
5100	LWpFzFJ.exe
4236	rDGblHZ.exe
4580	byiGHjM.exe
4648	tjBZPcb.exe
2896	IALGBEN.exe
3980	vmnFIsZ.exe
4124	IifRVnp.exe
4924	HZkcfkE.exe
3152	TEGZRpj.exe
1076	AJYyyep.exe
1580	eXWiLGz.exe
3384	GDeqJYU.exe
5116	itgHXgj.exe
1564	zHjASEM.exe
4140	QxPfjUB.exe
3976	tHOSJKF.exe
4052	IiHfVqb.exe
2444	rgDbijm.exe
2016	NFAlRAa.exe
3124	VbemddK.exe
1400	dMUWVwX.exe
180	xfSkjqR.exe
4780	nabHgZI.exe
3292	aEdYbcf.exe
752	JjfTcKM.exe
860	xbYWKng.exe
2144	EaoonyH.exe
4456	kbOTRty.exe
220	TzHgQtu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3968-0-0x00007FF6A8510000-0x00007FF6A8864000-memory.dmp	upx
behavioral2/files/0x0008000000023244-5.dat	upx
behavioral2/memory/3424-8-0x00007FF7CC220000-0x00007FF7CC574000-memory.dmp	upx
behavioral2/files/0x0008000000023247-11.dat	upx
behavioral2/files/0x000800000002324a-16.dat	upx
behavioral2/memory/2940-20-0x00007FF7CE800000-0x00007FF7CEB54000-memory.dmp	upx
behavioral2/files/0x000800000002324c-22.dat	upx
behavioral2/files/0x000700000002324e-31.dat	upx
behavioral2/files/0x0007000000023250-49.dat	upx
behavioral2/files/0x0007000000023251-56.dat	upx
behavioral2/memory/2384-62-0x00007FF78E1B0000-0x00007FF78E504000-memory.dmp	upx
behavioral2/memory/3704-63-0x00007FF739010000-0x00007FF739364000-memory.dmp	upx
behavioral2/memory/1912-65-0x00007FF7E6930000-0x00007FF7E6C84000-memory.dmp	upx
behavioral2/memory/4004-64-0x00007FF7F76F0000-0x00007FF7F7A44000-memory.dmp	upx
behavioral2/files/0x000700000002324f-61.dat	upx
behavioral2/files/0x0007000000023252-58.dat	upx
behavioral2/memory/1352-54-0x00007FF7D1C50000-0x00007FF7D1FA4000-memory.dmp	upx
behavioral2/files/0x0008000000023248-52.dat	upx
behavioral2/files/0x0007000000023255-77.dat	upx
behavioral2/files/0x0007000000023256-87.dat	upx
behavioral2/files/0x000700000002325a-98.dat	upx
behavioral2/memory/1032-104-0x00007FF628FB0000-0x00007FF629304000-memory.dmp	upx
behavioral2/memory/3720-107-0x00007FF701120000-0x00007FF701474000-memory.dmp	upx
behavioral2/files/0x0007000000023258-121.dat	upx
behavioral2/files/0x000700000002325b-119.dat	upx
behavioral2/files/0x0007000000023259-115.dat	upx
behavioral2/files/0x0007000000023257-113.dat	upx
behavioral2/memory/3420-110-0x00007FF7DE140000-0x00007FF7DE494000-memory.dmp	upx
behavioral2/memory/1620-109-0x00007FF6BC1A0000-0x00007FF6BC4F4000-memory.dmp	upx
behavioral2/memory/4480-108-0x00007FF640320000-0x00007FF640674000-memory.dmp	upx
behavioral2/memory/2848-106-0x00007FF625170000-0x00007FF6254C4000-memory.dmp	upx
behavioral2/memory/3580-105-0x00007FF6070C0000-0x00007FF607414000-memory.dmp	upx
behavioral2/memory/2880-103-0x00007FF6116B0000-0x00007FF611A04000-memory.dmp	upx
behavioral2/memory/4404-99-0x00007FF6809B0000-0x00007FF680D04000-memory.dmp	upx
behavioral2/files/0x0007000000023254-82.dat	upx
behavioral2/files/0x0007000000023253-78.dat	upx
behavioral2/memory/4316-45-0x00007FF7AA500000-0x00007FF7AA854000-memory.dmp	upx
behavioral2/memory/5108-38-0x00007FF6AF020000-0x00007FF6AF374000-memory.dmp	upx
behavioral2/memory/2740-35-0x00007FF6F38A0000-0x00007FF6F3BF4000-memory.dmp	upx
behavioral2/files/0x000700000002325d-128.dat	upx
behavioral2/memory/2964-145-0x00007FF667A50000-0x00007FF667DA4000-memory.dmp	upx
behavioral2/files/0x0007000000023263-159.dat	upx
behavioral2/files/0x0007000000023265-171.dat	upx
behavioral2/memory/1696-175-0x00007FF65EC50000-0x00007FF65EFA4000-memory.dmp	upx
behavioral2/memory/1324-177-0x00007FF7FA780000-0x00007FF7FAAD4000-memory.dmp	upx
behavioral2/memory/1796-179-0x00007FF60F1A0000-0x00007FF60F4F4000-memory.dmp	upx
behavioral2/files/0x0007000000023261-181.dat	upx
behavioral2/files/0x0007000000023266-183.dat	upx
behavioral2/memory/1664-178-0x00007FF7909D0000-0x00007FF790D24000-memory.dmp	upx
behavioral2/memory/1964-176-0x00007FF7C96A0000-0x00007FF7C99F4000-memory.dmp	upx
behavioral2/memory/3968-174-0x00007FF6A8510000-0x00007FF6A8864000-memory.dmp	upx
behavioral2/memory/4128-173-0x00007FF61ADD0000-0x00007FF61B124000-memory.dmp	upx
behavioral2/memory/4700-169-0x00007FF7A6540000-0x00007FF7A6894000-memory.dmp	upx
behavioral2/files/0x0007000000023264-164.dat	upx
behavioral2/files/0x000700000002325e-163.dat	upx
behavioral2/files/0x0007000000023262-158.dat	upx
behavioral2/memory/4872-156-0x00007FF7A3360000-0x00007FF7A36B4000-memory.dmp	upx
behavioral2/files/0x000700000002325f-152.dat	upx
behavioral2/files/0x0007000000023260-147.dat	upx
behavioral2/files/0x000700000002325c-131.dat	upx
behavioral2/files/0x000700000002324d-34.dat	upx
behavioral2/memory/4268-26-0x00007FF78BBA0000-0x00007FF78BEF4000-memory.dmp	upx
behavioral2/files/0x0007000000023267-190.dat	upx
behavioral2/memory/3424-697-0x00007FF7CC220000-0x00007FF7CC574000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tfgqOyn.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\gbnTOik.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\KJgWhql.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\dtitcpX.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\UCfFxmz.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\OtkgpvV.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\ugkeZfb.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\URnQgTQ.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\almFBes.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\RNiJGPg.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\qMTlbmF.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\dZIAOlb.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\rcsBaks.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\qxRwppU.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\TFGQUtd.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\itgHXgj.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\YNJiwaC.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\fpkJkBB.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\EcYmxkN.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\svxarIx.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\YSGDyGc.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\rDGblHZ.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\QzTtMkB.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\DJYuTvW.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\HAgGHfw.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\wpuCMjH.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\uBzpUhh.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\jPiRfZQ.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\fDvPeqP.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\GDeqJYU.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\ecxuVOx.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\sQKdBaS.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\ezotDRF.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\izeGJKa.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\XZioVwG.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\VOMXEGv.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\hGyrhIf.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\dXilkzP.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\vvbdzzG.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\UoceTvo.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\VABUQmv.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\JJysQpn.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\aIETRqt.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\GshkbWr.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\fsvKMHA.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\URfaNML.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\mDccNDG.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\epBJmjn.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\LlqSusH.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\NXtFmiY.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\GsynCQj.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\hTRFNHP.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\UJrbrdK.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\rdPAjsG.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\kBuEmrA.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\jPSfEfT.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\VHlZQNj.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\FcQziVY.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\wlFueSC.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\WIOetQS.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\oOYJuVt.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\MUTtxGA.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\SUDVENo.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
File created	C:\Windows\System\TXGCsPg.exe	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 3424	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	91
PID 3968 wrote to memory of 3424	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	91
PID 3968 wrote to memory of 2940	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	92
PID 3968 wrote to memory of 2940	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	92
PID 3968 wrote to memory of 4268	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	93
PID 3968 wrote to memory of 4268	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	93
PID 3968 wrote to memory of 2740	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	94
PID 3968 wrote to memory of 2740	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	94
PID 3968 wrote to memory of 4316	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	95
PID 3968 wrote to memory of 4316	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	95
PID 3968 wrote to memory of 5108	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	96
PID 3968 wrote to memory of 5108	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	96
PID 3968 wrote to memory of 1352	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	97
PID 3968 wrote to memory of 1352	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	97
PID 3968 wrote to memory of 3704	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	98
PID 3968 wrote to memory of 3704	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	98
PID 3968 wrote to memory of 4004	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	99
PID 3968 wrote to memory of 4004	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	99
PID 3968 wrote to memory of 1912	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	100
PID 3968 wrote to memory of 1912	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	100
PID 3968 wrote to memory of 2384	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	101
PID 3968 wrote to memory of 2384	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	101
PID 3968 wrote to memory of 4404	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	102
PID 3968 wrote to memory of 4404	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	102
PID 3968 wrote to memory of 2880	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	103
PID 3968 wrote to memory of 2880	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	103
PID 3968 wrote to memory of 1032	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	104
PID 3968 wrote to memory of 1032	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	104
PID 3968 wrote to memory of 3580	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	105
PID 3968 wrote to memory of 3580	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	105
PID 3968 wrote to memory of 2848	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	106
PID 3968 wrote to memory of 2848	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	106
PID 3968 wrote to memory of 3720	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	107
PID 3968 wrote to memory of 3720	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	107
PID 3968 wrote to memory of 1620	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	108
PID 3968 wrote to memory of 1620	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	108
PID 3968 wrote to memory of 4480	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	109
PID 3968 wrote to memory of 4480	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	109
PID 3968 wrote to memory of 3420	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	110
PID 3968 wrote to memory of 3420	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	110
PID 3968 wrote to memory of 2964	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	111
PID 3968 wrote to memory of 2964	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	111
PID 3968 wrote to memory of 1696	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	112
PID 3968 wrote to memory of 1696	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	112
PID 3968 wrote to memory of 4872	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	113
PID 3968 wrote to memory of 4872	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	113
PID 3968 wrote to memory of 1964	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	114
PID 3968 wrote to memory of 1964	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	114
PID 3968 wrote to memory of 1324	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	115
PID 3968 wrote to memory of 1324	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	115
PID 3968 wrote to memory of 1664	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	116
PID 3968 wrote to memory of 1664	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	116
PID 3968 wrote to memory of 4700	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	117
PID 3968 wrote to memory of 4700	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	117
PID 3968 wrote to memory of 1796	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	118
PID 3968 wrote to memory of 1796	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	118
PID 3968 wrote to memory of 4128	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	119
PID 3968 wrote to memory of 4128	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	119
PID 3968 wrote to memory of 3192	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	120
PID 3968 wrote to memory of 3192	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	120
PID 3968 wrote to memory of 3928	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	121
PID 3968 wrote to memory of 3928	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	121
PID 3968 wrote to memory of 4012	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	122
PID 3968 wrote to memory of 4012	3968	08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\08819bfb558eb2fc6ec26c659ea90c50_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\System\sqrmVvM.exe
  C:\Windows\System\sqrmVvM.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\zerddoZ.exe
  C:\Windows\System\zerddoZ.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\lJaLzwd.exe
  C:\Windows\System\lJaLzwd.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\XoVnmlv.exe
  C:\Windows\System\XoVnmlv.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\gmDbgIP.exe
  C:\Windows\System\gmDbgIP.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\lspTfxe.exe
  C:\Windows\System\lspTfxe.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\DszbmFQ.exe
  C:\Windows\System\DszbmFQ.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\kEACDwT.exe
  C:\Windows\System\kEACDwT.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\yYFCMVA.exe
  C:\Windows\System\yYFCMVA.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\ZWZqqPf.exe
  C:\Windows\System\ZWZqqPf.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\fEreYhE.exe
  C:\Windows\System\fEreYhE.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\PIIHJDl.exe
  C:\Windows\System\PIIHJDl.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\ICTYyQg.exe
  C:\Windows\System\ICTYyQg.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\kXjVFON.exe
  C:\Windows\System\kXjVFON.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\iFYqFkd.exe
  C:\Windows\System\iFYqFkd.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\PfteLho.exe
  C:\Windows\System\PfteLho.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\VOMXEGv.exe
  C:\Windows\System\VOMXEGv.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\CfapOQP.exe
  C:\Windows\System\CfapOQP.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\SAvEZUu.exe
  C:\Windows\System\SAvEZUu.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\wHjxXqT.exe
  C:\Windows\System\wHjxXqT.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\JiUSoGS.exe
  C:\Windows\System\JiUSoGS.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\TLTjKgs.exe
  C:\Windows\System\TLTjKgs.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\axwXNFt.exe
  C:\Windows\System\axwXNFt.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\hGyrhIf.exe
  C:\Windows\System\hGyrhIf.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\BtmRVIp.exe
  C:\Windows\System\BtmRVIp.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\ZsGovbF.exe
  C:\Windows\System\ZsGovbF.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\okVWkpe.exe
  C:\Windows\System\okVWkpe.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\eygVXCn.exe
  C:\Windows\System\eygVXCn.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\uiydrgN.exe
  C:\Windows\System\uiydrgN.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\izFNvOo.exe
  C:\Windows\System\izFNvOo.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\ANgDumQ.exe
  C:\Windows\System\ANgDumQ.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\MZkfWoK.exe
  C:\Windows\System\MZkfWoK.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\ajrsDPk.exe
  C:\Windows\System\ajrsDPk.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\ZyggIYa.exe
  C:\Windows\System\ZyggIYa.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\nRENboa.exe
  C:\Windows\System\nRENboa.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\LWpFzFJ.exe
  C:\Windows\System\LWpFzFJ.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\rDGblHZ.exe
  C:\Windows\System\rDGblHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\byiGHjM.exe
  C:\Windows\System\byiGHjM.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\tjBZPcb.exe
  C:\Windows\System\tjBZPcb.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\IALGBEN.exe
  C:\Windows\System\IALGBEN.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\vmnFIsZ.exe
  C:\Windows\System\vmnFIsZ.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\IifRVnp.exe
  C:\Windows\System\IifRVnp.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\HZkcfkE.exe
  C:\Windows\System\HZkcfkE.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\TEGZRpj.exe
  C:\Windows\System\TEGZRpj.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\AJYyyep.exe
  C:\Windows\System\AJYyyep.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\eXWiLGz.exe
  C:\Windows\System\eXWiLGz.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\GDeqJYU.exe
  C:\Windows\System\GDeqJYU.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\itgHXgj.exe
  C:\Windows\System\itgHXgj.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\zHjASEM.exe
  C:\Windows\System\zHjASEM.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\QxPfjUB.exe
  C:\Windows\System\QxPfjUB.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\tHOSJKF.exe
  C:\Windows\System\tHOSJKF.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\IiHfVqb.exe
  C:\Windows\System\IiHfVqb.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\rgDbijm.exe
  C:\Windows\System\rgDbijm.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\NFAlRAa.exe
  C:\Windows\System\NFAlRAa.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\VbemddK.exe
  C:\Windows\System\VbemddK.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\dMUWVwX.exe
  C:\Windows\System\dMUWVwX.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\xfSkjqR.exe
  C:\Windows\System\xfSkjqR.exe
  2⤵
  - Executes dropped EXE
  PID:180
- C:\Windows\System\nabHgZI.exe
  C:\Windows\System\nabHgZI.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\aEdYbcf.exe
  C:\Windows\System\aEdYbcf.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\JjfTcKM.exe
  C:\Windows\System\JjfTcKM.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\xbYWKng.exe
  C:\Windows\System\xbYWKng.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\EaoonyH.exe
  C:\Windows\System\EaoonyH.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\kbOTRty.exe
  C:\Windows\System\kbOTRty.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\TzHgQtu.exe
  C:\Windows\System\TzHgQtu.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\BaxZFMG.exe
  C:\Windows\System\BaxZFMG.exe
  2⤵
  PID:2992
- C:\Windows\System\rEWewvu.exe
  C:\Windows\System\rEWewvu.exe
  2⤵
  PID:4720
- C:\Windows\System\gSLvxDC.exe
  C:\Windows\System\gSLvxDC.exe
  2⤵
  PID:4600
- C:\Windows\System\bdlGovh.exe
  C:\Windows\System\bdlGovh.exe
  2⤵
  PID:3256
- C:\Windows\System\tdpKufr.exe
  C:\Windows\System\tdpKufr.exe
  2⤵
  PID:3016
- C:\Windows\System\rdPAjsG.exe
  C:\Windows\System\rdPAjsG.exe
  2⤵
  PID:1848
- C:\Windows\System\HoQpeEz.exe
  C:\Windows\System\HoQpeEz.exe
  2⤵
  PID:4000
- C:\Windows\System\KolrnZp.exe
  C:\Windows\System\KolrnZp.exe
  2⤵
  PID:3312
- C:\Windows\System\rGBoJGl.exe
  C:\Windows\System\rGBoJGl.exe
  2⤵
  PID:3464
- C:\Windows\System\goTFDYA.exe
  C:\Windows\System\goTFDYA.exe
  2⤵
  PID:2904
- C:\Windows\System\NLShCIY.exe
  C:\Windows\System\NLShCIY.exe
  2⤵
  PID:1132
- C:\Windows\System\DRZqjzq.exe
  C:\Windows\System\DRZqjzq.exe
  2⤵
  PID:4328
- C:\Windows\System\nqDWhSi.exe
  C:\Windows\System\nqDWhSi.exe
  2⤵
  PID:3852
- C:\Windows\System\iJaPkon.exe
  C:\Windows\System\iJaPkon.exe
  2⤵
  PID:4888
- C:\Windows\System\kNxcjpZ.exe
  C:\Windows\System\kNxcjpZ.exe
  2⤵
  PID:664
- C:\Windows\System\iGidDfI.exe
  C:\Windows\System\iGidDfI.exe
  2⤵
  PID:964
- C:\Windows\System\MUTtxGA.exe
  C:\Windows\System\MUTtxGA.exe
  2⤵
  PID:5136
- C:\Windows\System\XsYqHOx.exe
  C:\Windows\System\XsYqHOx.exe
  2⤵
  PID:5156
- C:\Windows\System\InEFssy.exe
  C:\Windows\System\InEFssy.exe
  2⤵
  PID:5192
- C:\Windows\System\YNJiwaC.exe
  C:\Windows\System\YNJiwaC.exe
  2⤵
  PID:5216
- C:\Windows\System\eUgEfju.exe
  C:\Windows\System\eUgEfju.exe
  2⤵
  PID:5256
- C:\Windows\System\DzeQKdH.exe
  C:\Windows\System\DzeQKdH.exe
  2⤵
  PID:5272
- C:\Windows\System\hQfJGgg.exe
  C:\Windows\System\hQfJGgg.exe
  2⤵
  PID:5300
- C:\Windows\System\QsJgjoj.exe
  C:\Windows\System\QsJgjoj.exe
  2⤵
  PID:5328
- C:\Windows\System\WuEknGa.exe
  C:\Windows\System\WuEknGa.exe
  2⤵
  PID:5352
- C:\Windows\System\OeslZNl.exe
  C:\Windows\System\OeslZNl.exe
  2⤵
  PID:5380
- C:\Windows\System\oPgnhkN.exe
  C:\Windows\System\oPgnhkN.exe
  2⤵
  PID:5400
- C:\Windows\System\Jjaliyf.exe
  C:\Windows\System\Jjaliyf.exe
  2⤵
  PID:5424
- C:\Windows\System\RhNcZWZ.exe
  C:\Windows\System\RhNcZWZ.exe
  2⤵
  PID:5460
- C:\Windows\System\PBSpbce.exe
  C:\Windows\System\PBSpbce.exe
  2⤵
  PID:5492
- C:\Windows\System\dXilkzP.exe
  C:\Windows\System\dXilkzP.exe
  2⤵
  PID:5512
- C:\Windows\System\DmqNUhe.exe
  C:\Windows\System\DmqNUhe.exe
  2⤵
  PID:5540
- C:\Windows\System\FCXcDcS.exe
  C:\Windows\System\FCXcDcS.exe
  2⤵
  PID:5564
- C:\Windows\System\gsufWMX.exe
  C:\Windows\System\gsufWMX.exe
  2⤵
  PID:5592
- C:\Windows\System\wiMHlob.exe
  C:\Windows\System\wiMHlob.exe
  2⤵
  PID:5620
- C:\Windows\System\VLnSUrS.exe
  C:\Windows\System\VLnSUrS.exe
  2⤵
  PID:5648
- C:\Windows\System\hkRGDFH.exe
  C:\Windows\System\hkRGDFH.exe
  2⤵
  PID:5672
- C:\Windows\System\UCfFxmz.exe
  C:\Windows\System\UCfFxmz.exe
  2⤵
  PID:5700
- C:\Windows\System\oMWPPZX.exe
  C:\Windows\System\oMWPPZX.exe
  2⤵
  PID:5728
- C:\Windows\System\YUClUqo.exe
  C:\Windows\System\YUClUqo.exe
  2⤵
  PID:5760
- C:\Windows\System\lUreRfD.exe
  C:\Windows\System\lUreRfD.exe
  2⤵
  PID:5784
- C:\Windows\System\hyeFgDt.exe
  C:\Windows\System\hyeFgDt.exe
  2⤵
  PID:5808
- C:\Windows\System\OWRBSqA.exe
  C:\Windows\System\OWRBSqA.exe
  2⤵
  PID:5832
- C:\Windows\System\feqYIPV.exe
  C:\Windows\System\feqYIPV.exe
  2⤵
  PID:5860
- C:\Windows\System\eRQulpQ.exe
  C:\Windows\System\eRQulpQ.exe
  2⤵
  PID:5892
- C:\Windows\System\kbSdaWC.exe
  C:\Windows\System\kbSdaWC.exe
  2⤵
  PID:5912
- C:\Windows\System\yKdiFWb.exe
  C:\Windows\System\yKdiFWb.exe
  2⤵
  PID:5944
- C:\Windows\System\irSXlaW.exe
  C:\Windows\System\irSXlaW.exe
  2⤵
  PID:5972
- C:\Windows\System\stEkesc.exe
  C:\Windows\System\stEkesc.exe
  2⤵
  PID:6000
- C:\Windows\System\LKAjbzn.exe
  C:\Windows\System\LKAjbzn.exe
  2⤵
  PID:6020
- C:\Windows\System\siKmInR.exe
  C:\Windows\System\siKmInR.exe
  2⤵
  PID:6048
- C:\Windows\System\SUDVENo.exe
  C:\Windows\System\SUDVENo.exe
  2⤵
  PID:6072
- C:\Windows\System\QTkZywQ.exe
  C:\Windows\System\QTkZywQ.exe
  2⤵
  PID:6104
- C:\Windows\System\jEBcQGo.exe
  C:\Windows\System\jEBcQGo.exe
  2⤵
  PID:6132
- C:\Windows\System\PcAkvWW.exe
  C:\Windows\System\PcAkvWW.exe
  2⤵
  PID:5148
- C:\Windows\System\SDyhiGW.exe
  C:\Windows\System\SDyhiGW.exe
  2⤵
  PID:5232
- C:\Windows\System\FuAuBGr.exe
  C:\Windows\System\FuAuBGr.exe
  2⤵
  PID:5284
- C:\Windows\System\gqtFnil.exe
  C:\Windows\System\gqtFnil.exe
  2⤵
  PID:5340
- C:\Windows\System\XRByivs.exe
  C:\Windows\System\XRByivs.exe
  2⤵
  PID:5436
- C:\Windows\System\gxhPEMV.exe
  C:\Windows\System\gxhPEMV.exe
  2⤵
  PID:5480
- C:\Windows\System\vrSbfCs.exe
  C:\Windows\System\vrSbfCs.exe
  2⤵
  PID:5504
- C:\Windows\System\NxpUgGm.exe
  C:\Windows\System\NxpUgGm.exe
  2⤵
  PID:5600
- C:\Windows\System\CRJfqyc.exe
  C:\Windows\System\CRJfqyc.exe
  2⤵
  PID:5668
- C:\Windows\System\uLWjIyN.exe
  C:\Windows\System\uLWjIyN.exe
  2⤵
  PID:5724
- C:\Windows\System\tbkjnFj.exe
  C:\Windows\System\tbkjnFj.exe
  2⤵
  PID:5696
- C:\Windows\System\MeXEtrP.exe
  C:\Windows\System\MeXEtrP.exe
  2⤵
  PID:5856
- C:\Windows\System\UsOErsY.exe
  C:\Windows\System\UsOErsY.exe
  2⤵
  PID:5840
- C:\Windows\System\fpkJkBB.exe
  C:\Windows\System\fpkJkBB.exe
  2⤵
  PID:5928
- C:\Windows\System\LlqSusH.exe
  C:\Windows\System\LlqSusH.exe
  2⤵
  PID:5984
- C:\Windows\System\lpSNrXp.exe
  C:\Windows\System\lpSNrXp.exe
  2⤵
  PID:6064
- C:\Windows\System\myKCPzE.exe
  C:\Windows\System\myKCPzE.exe
  2⤵
  PID:5124
- C:\Windows\System\hkbAxDM.exe
  C:\Windows\System\hkbAxDM.exe
  2⤵
  PID:5180
- C:\Windows\System\EKpxiEo.exe
  C:\Windows\System\EKpxiEo.exe
  2⤵
  PID:5416
- C:\Windows\System\ZDTqoLu.exe
  C:\Windows\System\ZDTqoLu.exe
  2⤵
  PID:5268
- C:\Windows\System\piYHOtG.exe
  C:\Windows\System\piYHOtG.exe
  2⤵
  PID:5576
- C:\Windows\System\rMqVaHs.exe
  C:\Windows\System\rMqVaHs.exe
  2⤵
  PID:5824
- C:\Windows\System\gjqWPvt.exe
  C:\Windows\System\gjqWPvt.exe
  2⤵
  PID:5900
- C:\Windows\System\kHaSESD.exe
  C:\Windows\System\kHaSESD.exe
  2⤵
  PID:6096
- C:\Windows\System\ifTKuXg.exe
  C:\Windows\System\ifTKuXg.exe
  2⤵
  PID:6168
- C:\Windows\System\zqhhigI.exe
  C:\Windows\System\zqhhigI.exe
  2⤵
  PID:6196
- C:\Windows\System\SVKEjmL.exe
  C:\Windows\System\SVKEjmL.exe
  2⤵
  PID:6224
- C:\Windows\System\cJkwwOv.exe
  C:\Windows\System\cJkwwOv.exe
  2⤵
  PID:6248
- C:\Windows\System\yWwlzDu.exe
  C:\Windows\System\yWwlzDu.exe
  2⤵
  PID:6272
- C:\Windows\System\reKaGNn.exe
  C:\Windows\System\reKaGNn.exe
  2⤵
  PID:6296
- C:\Windows\System\XWqPNcG.exe
  C:\Windows\System\XWqPNcG.exe
  2⤵
  PID:6324
- C:\Windows\System\nyZprsM.exe
  C:\Windows\System\nyZprsM.exe
  2⤵
  PID:6384
- C:\Windows\System\KaSXkAp.exe
  C:\Windows\System\KaSXkAp.exe
  2⤵
  PID:6412
- C:\Windows\System\fMaeseC.exe
  C:\Windows\System\fMaeseC.exe
  2⤵
  PID:6448
- C:\Windows\System\dOJCeTY.exe
  C:\Windows\System\dOJCeTY.exe
  2⤵
  PID:6476
- C:\Windows\System\ZQsHpds.exe
  C:\Windows\System\ZQsHpds.exe
  2⤵
  PID:6504
- C:\Windows\System\NXtFmiY.exe
  C:\Windows\System\NXtFmiY.exe
  2⤵
  PID:6532
- C:\Windows\System\ASgduqR.exe
  C:\Windows\System\ASgduqR.exe
  2⤵
  PID:6556
- C:\Windows\System\mteEWmF.exe
  C:\Windows\System\mteEWmF.exe
  2⤵
  PID:6592
- C:\Windows\System\nWCEAiy.exe
  C:\Windows\System\nWCEAiy.exe
  2⤵
  PID:6628
- C:\Windows\System\ggXPLgw.exe
  C:\Windows\System\ggXPLgw.exe
  2⤵
  PID:6652
- C:\Windows\System\PFfcUhS.exe
  C:\Windows\System\PFfcUhS.exe
  2⤵
  PID:6668
- C:\Windows\System\ezotDRF.exe
  C:\Windows\System\ezotDRF.exe
  2⤵
  PID:6692
- C:\Windows\System\YmmkrKg.exe
  C:\Windows\System\YmmkrKg.exe
  2⤵
  PID:6720
- C:\Windows\System\jwGXjSZ.exe
  C:\Windows\System\jwGXjSZ.exe
  2⤵
  PID:6748
- C:\Windows\System\lChyTuF.exe
  C:\Windows\System\lChyTuF.exe
  2⤵
  PID:6776
- C:\Windows\System\orPXNud.exe
  C:\Windows\System\orPXNud.exe
  2⤵
  PID:6800
- C:\Windows\System\PiYExZE.exe
  C:\Windows\System\PiYExZE.exe
  2⤵
  PID:6828
- C:\Windows\System\zAsLhLS.exe
  C:\Windows\System\zAsLhLS.exe
  2⤵
  PID:6856
- C:\Windows\System\eFAhtau.exe
  C:\Windows\System\eFAhtau.exe
  2⤵
  PID:6880
- C:\Windows\System\FuQHXTY.exe
  C:\Windows\System\FuQHXTY.exe
  2⤵
  PID:6904
- C:\Windows\System\SKPLfSA.exe
  C:\Windows\System\SKPLfSA.exe
  2⤵
  PID:6936
- C:\Windows\System\OUUPEmb.exe
  C:\Windows\System\OUUPEmb.exe
  2⤵
  PID:6960
- C:\Windows\System\yrzPnlE.exe
  C:\Windows\System\yrzPnlE.exe
  2⤵
  PID:6984
- C:\Windows\System\BqhterG.exe
  C:\Windows\System\BqhterG.exe
  2⤵
  PID:7008
- C:\Windows\System\RJiHmWj.exe
  C:\Windows\System\RJiHmWj.exe
  2⤵
  PID:7036
- C:\Windows\System\pwFGbgd.exe
  C:\Windows\System\pwFGbgd.exe
  2⤵
  PID:7060
- C:\Windows\System\HdGQFew.exe
  C:\Windows\System\HdGQFew.exe
  2⤵
  PID:7080
- C:\Windows\System\rIkEqVi.exe
  C:\Windows\System\rIkEqVi.exe
  2⤵
  PID:7112
- C:\Windows\System\bcDAnZZ.exe
  C:\Windows\System\bcDAnZZ.exe
  2⤵
  PID:7144
- C:\Windows\System\WtVwWDS.exe
  C:\Windows\System\WtVwWDS.exe
  2⤵
  PID:7164
- C:\Windows\System\anPsVBo.exe
  C:\Windows\System\anPsVBo.exe
  2⤵
  PID:5920
- C:\Windows\System\KEjKiPy.exe
  C:\Windows\System\KEjKiPy.exe
  2⤵
  PID:6060
- C:\Windows\System\ZvSPvFI.exe
  C:\Windows\System\ZvSPvFI.exe
  2⤵
  PID:6192
- C:\Windows\System\cTfKWsE.exe
  C:\Windows\System\cTfKWsE.exe
  2⤵
  PID:6152
- C:\Windows\System\MnLSTya.exe
  C:\Windows\System\MnLSTya.exe
  2⤵
  PID:6264
- C:\Windows\System\ZLlPUSn.exe
  C:\Windows\System\ZLlPUSn.exe
  2⤵
  PID:6292
- C:\Windows\System\DHWgltG.exe
  C:\Windows\System\DHWgltG.exe
  2⤵
  PID:6420
- C:\Windows\System\QzTtMkB.exe
  C:\Windows\System\QzTtMkB.exe
  2⤵
  PID:6496
- C:\Windows\System\pRDHxDI.exe
  C:\Windows\System\pRDHxDI.exe
  2⤵
  PID:6540
- C:\Windows\System\TXGCsPg.exe
  C:\Windows\System\TXGCsPg.exe
  2⤵
  PID:6600
- C:\Windows\System\RUyXZfP.exe
  C:\Windows\System\RUyXZfP.exe
  2⤵
  PID:6640
- C:\Windows\System\uddGXkk.exe
  C:\Windows\System\uddGXkk.exe
  2⤵
  PID:6792
- C:\Windows\System\SQkUSZr.exe
  C:\Windows\System\SQkUSZr.exe
  2⤵
  PID:6664
- C:\Windows\System\QQblKAh.exe
  C:\Windows\System\QQblKAh.exe
  2⤵
  PID:6916
- C:\Windows\System\uViPGnd.exe
  C:\Windows\System\uViPGnd.exe
  2⤵
  PID:6948
- C:\Windows\System\ZmQmMkR.exe
  C:\Windows\System\ZmQmMkR.exe
  2⤵
  PID:6928
- C:\Windows\System\VQkLJtn.exe
  C:\Windows\System\VQkLJtn.exe
  2⤵
  PID:7088
- C:\Windows\System\KxxblZj.exe
  C:\Windows\System\KxxblZj.exe
  2⤵
  PID:7056
- C:\Windows\System\ecxuVOx.exe
  C:\Windows\System\ecxuVOx.exe
  2⤵
  PID:6164
- C:\Windows\System\LjAzJgI.exe
  C:\Windows\System\LjAzJgI.exe
  2⤵
  PID:6244
- C:\Windows\System\dZIAOlb.exe
  C:\Windows\System\dZIAOlb.exe
  2⤵
  PID:5364
- C:\Windows\System\sQKdBaS.exe
  C:\Windows\System\sQKdBaS.exe
  2⤵
  PID:7156
- C:\Windows\System\IuZMMhP.exe
  C:\Windows\System\IuZMMhP.exe
  2⤵
  PID:5956
- C:\Windows\System\ySESypr.exe
  C:\Windows\System\ySESypr.exe
  2⤵
  PID:6320
- C:\Windows\System\FyPfLMB.exe
  C:\Windows\System\FyPfLMB.exe
  2⤵
  PID:6336
- C:\Windows\System\toqLcqc.exe
  C:\Windows\System\toqLcqc.exe
  2⤵
  PID:5988
- C:\Windows\System\wSpwZde.exe
  C:\Windows\System\wSpwZde.exe
  2⤵
  PID:2104
- C:\Windows\System\aIETRqt.exe
  C:\Windows\System\aIETRqt.exe
  2⤵
  PID:7176
- C:\Windows\System\QzCDnoh.exe
  C:\Windows\System\QzCDnoh.exe
  2⤵
  PID:7204
- C:\Windows\System\rcsBaks.exe
  C:\Windows\System\rcsBaks.exe
  2⤵
  PID:7232
- C:\Windows\System\njGUTJu.exe
  C:\Windows\System\njGUTJu.exe
  2⤵
  PID:7248
- C:\Windows\System\uZCipgP.exe
  C:\Windows\System\uZCipgP.exe
  2⤵
  PID:7276
- C:\Windows\System\lBAWhhh.exe
  C:\Windows\System\lBAWhhh.exe
  2⤵
  PID:7300
- C:\Windows\System\iNXRGGb.exe
  C:\Windows\System\iNXRGGb.exe
  2⤵
  PID:7320
- C:\Windows\System\lvgaJyn.exe
  C:\Windows\System\lvgaJyn.exe
  2⤵
  PID:7352
- C:\Windows\System\PPRBcoh.exe
  C:\Windows\System\PPRBcoh.exe
  2⤵
  PID:7376
- C:\Windows\System\LUhiwUW.exe
  C:\Windows\System\LUhiwUW.exe
  2⤵
  PID:7400
- C:\Windows\System\YQnrGyZ.exe
  C:\Windows\System\YQnrGyZ.exe
  2⤵
  PID:7436
- C:\Windows\System\IgRzJHD.exe
  C:\Windows\System\IgRzJHD.exe
  2⤵
  PID:7460
- C:\Windows\System\rzQuxej.exe
  C:\Windows\System\rzQuxej.exe
  2⤵
  PID:7496
- C:\Windows\System\FYaZYrm.exe
  C:\Windows\System\FYaZYrm.exe
  2⤵
  PID:7516
- C:\Windows\System\sNBNGRx.exe
  C:\Windows\System\sNBNGRx.exe
  2⤵
  PID:7536
- C:\Windows\System\KGTwKFA.exe
  C:\Windows\System\KGTwKFA.exe
  2⤵
  PID:7560
- C:\Windows\System\GshkbWr.exe
  C:\Windows\System\GshkbWr.exe
  2⤵
  PID:7580
- C:\Windows\System\MUeBcbj.exe
  C:\Windows\System\MUeBcbj.exe
  2⤵
  PID:7604
- C:\Windows\System\rHdggYX.exe
  C:\Windows\System\rHdggYX.exe
  2⤵
  PID:7632
- C:\Windows\System\gNwaHPh.exe
  C:\Windows\System\gNwaHPh.exe
  2⤵
  PID:7660
- C:\Windows\System\vvbdzzG.exe
  C:\Windows\System\vvbdzzG.exe
  2⤵
  PID:7692
- C:\Windows\System\tACDuBi.exe
  C:\Windows\System\tACDuBi.exe
  2⤵
  PID:7720
- C:\Windows\System\vxzKmFP.exe
  C:\Windows\System\vxzKmFP.exe
  2⤵
  PID:7744
- C:\Windows\System\lwljdlg.exe
  C:\Windows\System\lwljdlg.exe
  2⤵
  PID:7780
- C:\Windows\System\AmKwjGj.exe
  C:\Windows\System\AmKwjGj.exe
  2⤵
  PID:7808
- C:\Windows\System\tWrMmpB.exe
  C:\Windows\System\tWrMmpB.exe
  2⤵
  PID:7836
- C:\Windows\System\VZQPngG.exe
  C:\Windows\System\VZQPngG.exe
  2⤵
  PID:7864
- C:\Windows\System\NwOOkrP.exe
  C:\Windows\System\NwOOkrP.exe
  2⤵
  PID:7880
- C:\Windows\System\IKtfBZi.exe
  C:\Windows\System\IKtfBZi.exe
  2⤵
  PID:7912
- C:\Windows\System\QTZRYBK.exe
  C:\Windows\System\QTZRYBK.exe
  2⤵
  PID:7944
- C:\Windows\System\BsJRrIV.exe
  C:\Windows\System\BsJRrIV.exe
  2⤵
  PID:7972
- C:\Windows\System\xCtBDIb.exe
  C:\Windows\System\xCtBDIb.exe
  2⤵
  PID:7996
- C:\Windows\System\zAtpJnw.exe
  C:\Windows\System\zAtpJnw.exe
  2⤵
  PID:8016
- C:\Windows\System\pAcOFxr.exe
  C:\Windows\System\pAcOFxr.exe
  2⤵
  PID:8048
- C:\Windows\System\irtwICO.exe
  C:\Windows\System\irtwICO.exe
  2⤵
  PID:8076
- C:\Windows\System\MCcLaaA.exe
  C:\Windows\System\MCcLaaA.exe
  2⤵
  PID:8092
- C:\Windows\System\ENqwnaG.exe
  C:\Windows\System\ENqwnaG.exe
  2⤵
  PID:8120
- C:\Windows\System\OWrqLaC.exe
  C:\Windows\System\OWrqLaC.exe
  2⤵
  PID:8148
- C:\Windows\System\qxRwppU.exe
  C:\Windows\System\qxRwppU.exe
  2⤵
  PID:8176
- C:\Windows\System\JDXJEAG.exe
  C:\Windows\System\JDXJEAG.exe
  2⤵
  PID:7004
- C:\Windows\System\kBuEmrA.exe
  C:\Windows\System\kBuEmrA.exe
  2⤵
  PID:7184
- C:\Windows\System\nHllPQC.exe
  C:\Windows\System\nHllPQC.exe
  2⤵
  PID:7268
- C:\Windows\System\vmDphLh.exe
  C:\Windows\System\vmDphLh.exe
  2⤵
  PID:7316
- C:\Windows\System\zNZROTM.exe
  C:\Windows\System\zNZROTM.exe
  2⤵
  PID:7344
- C:\Windows\System\XqALZUO.exe
  C:\Windows\System\XqALZUO.exe
  2⤵
  PID:7408
- C:\Windows\System\ixRWbqm.exe
  C:\Windows\System\ixRWbqm.exe
  2⤵
  PID:7392
- C:\Windows\System\HAgGHfw.exe
  C:\Windows\System\HAgGHfw.exe
  2⤵
  PID:7556
- C:\Windows\System\YpPiYRq.exe
  C:\Windows\System\YpPiYRq.exe
  2⤵
  PID:7620
- C:\Windows\System\egEtaSf.exe
  C:\Windows\System\egEtaSf.exe
  2⤵
  PID:7700
- C:\Windows\System\DJYuTvW.exe
  C:\Windows\System\DJYuTvW.exe
  2⤵
  PID:7740
- C:\Windows\System\HLSSOSm.exe
  C:\Windows\System\HLSSOSm.exe
  2⤵
  PID:7764
- C:\Windows\System\KAUgyha.exe
  C:\Windows\System\KAUgyha.exe
  2⤵
  PID:7644
- C:\Windows\System\oxbCoqj.exe
  C:\Windows\System\oxbCoqj.exe
  2⤵
  PID:7984
- C:\Windows\System\eNMtuYH.exe
  C:\Windows\System\eNMtuYH.exe
  2⤵
  PID:8032
- C:\Windows\System\jPSfEfT.exe
  C:\Windows\System\jPSfEfT.exe
  2⤵
  PID:8128
- C:\Windows\System\yeASsjU.exe
  C:\Windows\System\yeASsjU.exe
  2⤵
  PID:8008
- C:\Windows\System\gaiXIxO.exe
  C:\Windows\System\gaiXIxO.exe
  2⤵
  PID:8084
- C:\Windows\System\mXHBWxK.exe
  C:\Windows\System\mXHBWxK.exe
  2⤵
  PID:8136
- C:\Windows\System\vFnlNFJ.exe
  C:\Windows\System\vFnlNFJ.exe
  2⤵
  PID:7372
- C:\Windows\System\DtStHah.exe
  C:\Windows\System\DtStHah.exe
  2⤵
  PID:7532
- C:\Windows\System\ILuqwDg.exe
  C:\Windows\System\ILuqwDg.exe
  2⤵
  PID:7328
- C:\Windows\System\XbkRAuM.exe
  C:\Windows\System\XbkRAuM.exe
  2⤵
  PID:7656
- C:\Windows\System\gmliwQr.exe
  C:\Windows\System\gmliwQr.exe
  2⤵
  PID:7940
- C:\Windows\System\sRhuilD.exe
  C:\Windows\System\sRhuilD.exe
  2⤵
  PID:7992
- C:\Windows\System\eQeUHNj.exe
  C:\Windows\System\eQeUHNj.exe
  2⤵
  PID:8204
- C:\Windows\System\HZZKNGF.exe
  C:\Windows\System\HZZKNGF.exe
  2⤵
  PID:8236
- C:\Windows\System\HiHfjVr.exe
  C:\Windows\System\HiHfjVr.exe
  2⤵
  PID:8260
- C:\Windows\System\GFFuKzA.exe
  C:\Windows\System\GFFuKzA.exe
  2⤵
  PID:8292
- C:\Windows\System\TdCwJcM.exe
  C:\Windows\System\TdCwJcM.exe
  2⤵
  PID:8316
- C:\Windows\System\izeGJKa.exe
  C:\Windows\System\izeGJKa.exe
  2⤵
  PID:8344
- C:\Windows\System\GsynCQj.exe
  C:\Windows\System\GsynCQj.exe
  2⤵
  PID:8376
- C:\Windows\System\nbLCQCA.exe
  C:\Windows\System\nbLCQCA.exe
  2⤵
  PID:8400
- C:\Windows\System\XKQSYVu.exe
  C:\Windows\System\XKQSYVu.exe
  2⤵
  PID:8424
- C:\Windows\System\NtqrzPW.exe
  C:\Windows\System\NtqrzPW.exe
  2⤵
  PID:8452
- C:\Windows\System\qJlQXhV.exe
  C:\Windows\System\qJlQXhV.exe
  2⤵
  PID:8488
- C:\Windows\System\VHlZQNj.exe
  C:\Windows\System\VHlZQNj.exe
  2⤵
  PID:8520
- C:\Windows\System\iEuwfhj.exe
  C:\Windows\System\iEuwfhj.exe
  2⤵
  PID:8540
- C:\Windows\System\FcQziVY.exe
  C:\Windows\System\FcQziVY.exe
  2⤵
  PID:8560
- C:\Windows\System\fPSwxSV.exe
  C:\Windows\System\fPSwxSV.exe
  2⤵
  PID:8584
- C:\Windows\System\hIQCdpg.exe
  C:\Windows\System\hIQCdpg.exe
  2⤵
  PID:8608
- C:\Windows\System\XGrlIYs.exe
  C:\Windows\System\XGrlIYs.exe
  2⤵
  PID:8636
- C:\Windows\System\SXzszQD.exe
  C:\Windows\System\SXzszQD.exe
  2⤵
  PID:8660
- C:\Windows\System\jFCUfrW.exe
  C:\Windows\System\jFCUfrW.exe
  2⤵
  PID:8684
- C:\Windows\System\itVqqeu.exe
  C:\Windows\System\itVqqeu.exe
  2⤵
  PID:8716
- C:\Windows\System\EipXjrU.exe
  C:\Windows\System\EipXjrU.exe
  2⤵
  PID:8736
- C:\Windows\System\UQsiShm.exe
  C:\Windows\System\UQsiShm.exe
  2⤵
  PID:8764
- C:\Windows\System\MdNiuvK.exe
  C:\Windows\System\MdNiuvK.exe
  2⤵
  PID:8792
- C:\Windows\System\fVKQPWJ.exe
  C:\Windows\System\fVKQPWJ.exe
  2⤵
  PID:8820
- C:\Windows\System\BPwQXBq.exe
  C:\Windows\System\BPwQXBq.exe
  2⤵
  PID:8840
- C:\Windows\System\JMBDyqs.exe
  C:\Windows\System\JMBDyqs.exe
  2⤵
  PID:8864
- C:\Windows\System\vgxHPVf.exe
  C:\Windows\System\vgxHPVf.exe
  2⤵
  PID:8880
- C:\Windows\System\hywLEzP.exe
  C:\Windows\System\hywLEzP.exe
  2⤵
  PID:8908
- C:\Windows\System\OtkgpvV.exe
  C:\Windows\System\OtkgpvV.exe
  2⤵
  PID:8928
- C:\Windows\System\lBmDmsO.exe
  C:\Windows\System\lBmDmsO.exe
  2⤵
  PID:8960
- C:\Windows\System\DKumPnY.exe
  C:\Windows\System\DKumPnY.exe
  2⤵
  PID:8984
- C:\Windows\System\YaVrySh.exe
  C:\Windows\System\YaVrySh.exe
  2⤵
  PID:9012
- C:\Windows\System\gHNsJny.exe
  C:\Windows\System\gHNsJny.exe
  2⤵
  PID:9036
- C:\Windows\System\FYdnvvJ.exe
  C:\Windows\System\FYdnvvJ.exe
  2⤵
  PID:9064
- C:\Windows\System\AgjbzNs.exe
  C:\Windows\System\AgjbzNs.exe
  2⤵
  PID:9088
- C:\Windows\System\SZrbhVa.exe
  C:\Windows\System\SZrbhVa.exe
  2⤵
  PID:9120
- C:\Windows\System\DOtOgPj.exe
  C:\Windows\System\DOtOgPj.exe
  2⤵
  PID:9140
- C:\Windows\System\NbrLpzm.exe
  C:\Windows\System\NbrLpzm.exe
  2⤵
  PID:9164
- C:\Windows\System\KOFffGP.exe
  C:\Windows\System\KOFffGP.exe
  2⤵
  PID:9188
- C:\Windows\System\gfszKAi.exe
  C:\Windows\System\gfszKAi.exe
  2⤵
  PID:7804
- C:\Windows\System\ztZBvHu.exe
  C:\Windows\System\ztZBvHu.exe
  2⤵
  PID:7592
- C:\Windows\System\vQphNxq.exe
  C:\Windows\System\vQphNxq.exe
  2⤵
  PID:8140
- C:\Windows\System\UFJuDUZ.exe
  C:\Windows\System\UFJuDUZ.exe
  2⤵
  PID:7860
- C:\Windows\System\IPibmkB.exe
  C:\Windows\System\IPibmkB.exe
  2⤵
  PID:8164
- C:\Windows\System\almFBes.exe
  C:\Windows\System\almFBes.exe
  2⤵
  PID:8340
- C:\Windows\System\yGIxmOd.exe
  C:\Windows\System\yGIxmOd.exe
  2⤵
  PID:8200
- C:\Windows\System\lhkAmCQ.exe
  C:\Windows\System\lhkAmCQ.exe
  2⤵
  PID:8468
- C:\Windows\System\iwQVwrb.exe
  C:\Windows\System\iwQVwrb.exe
  2⤵
  PID:8300
- C:\Windows\System\dqkgqkf.exe
  C:\Windows\System\dqkgqkf.exe
  2⤵
  PID:8336
- C:\Windows\System\OriJfDo.exe
  C:\Windows\System\OriJfDo.exe
  2⤵
  PID:8556
- C:\Windows\System\EdBoTds.exe
  C:\Windows\System\EdBoTds.exe
  2⤵
  PID:8436
- C:\Windows\System\OkHrdKf.exe
  C:\Windows\System\OkHrdKf.exe
  2⤵
  PID:8756
- C:\Windows\System\sNhsjfh.exe
  C:\Windows\System\sNhsjfh.exe
  2⤵
  PID:8596
- C:\Windows\System\XNQKGNC.exe
  C:\Windows\System\XNQKGNC.exe
  2⤵
  PID:8856
- C:\Windows\System\cEtYmNc.exe
  C:\Windows\System\cEtYmNc.exe
  2⤵
  PID:8708
- C:\Windows\System\JmQqFAN.exe
  C:\Windows\System\JmQqFAN.exe
  2⤵
  PID:8944
- C:\Windows\System\FsQHIGW.exe
  C:\Windows\System\FsQHIGW.exe
  2⤵
  PID:8972
- C:\Windows\System\lFkLecx.exe
  C:\Windows\System\lFkLecx.exe
  2⤵
  PID:8576
- C:\Windows\System\NxERaBf.exe
  C:\Windows\System\NxERaBf.exe
  2⤵
  PID:8876
- C:\Windows\System\LSkalde.exe
  C:\Windows\System\LSkalde.exe
  2⤵
  PID:9204
- C:\Windows\System\fluluMq.exe
  C:\Windows\System\fluluMq.exe
  2⤵
  PID:7684
- C:\Windows\System\DfJnqkh.exe
  C:\Windows\System\DfJnqkh.exe
  2⤵
  PID:9024
- C:\Windows\System\cRVWvIu.exe
  C:\Windows\System\cRVWvIu.exe
  2⤵
  PID:8196
- C:\Windows\System\jyxoiJp.exe
  C:\Windows\System\jyxoiJp.exe
  2⤵
  PID:9072
- C:\Windows\System\RCkVhpE.exe
  C:\Windows\System\RCkVhpE.exe
  2⤵
  PID:9148
- C:\Windows\System\DLDodjW.exe
  C:\Windows\System\DLDodjW.exe
  2⤵
  PID:9240
- C:\Windows\System\LmXUMcI.exe
  C:\Windows\System\LmXUMcI.exe
  2⤵
  PID:9260
- C:\Windows\System\PVcZDre.exe
  C:\Windows\System\PVcZDre.exe
  2⤵
  PID:9284
- C:\Windows\System\NqAAlPw.exe
  C:\Windows\System\NqAAlPw.exe
  2⤵
  PID:9312
- C:\Windows\System\SPkxvEt.exe
  C:\Windows\System\SPkxvEt.exe
  2⤵
  PID:9344
- C:\Windows\System\KQicyAL.exe
  C:\Windows\System\KQicyAL.exe
  2⤵
  PID:9364
- C:\Windows\System\EOfhZGL.exe
  C:\Windows\System\EOfhZGL.exe
  2⤵
  PID:9388
- C:\Windows\System\SjvbaHt.exe
  C:\Windows\System\SjvbaHt.exe
  2⤵
  PID:9412
- C:\Windows\System\MeeiJKW.exe
  C:\Windows\System\MeeiJKW.exe
  2⤵
  PID:9440
- C:\Windows\System\fpftZpq.exe
  C:\Windows\System\fpftZpq.exe
  2⤵
  PID:9464
- C:\Windows\System\KQHMxFj.exe
  C:\Windows\System\KQHMxFj.exe
  2⤵
  PID:9488
- C:\Windows\System\HyKXhHS.exe
  C:\Windows\System\HyKXhHS.exe
  2⤵
  PID:9508
- C:\Windows\System\FHPeKLJ.exe
  C:\Windows\System\FHPeKLJ.exe
  2⤵
  PID:9532
- C:\Windows\System\QoJpvSR.exe
  C:\Windows\System\QoJpvSR.exe
  2⤵
  PID:9560
- C:\Windows\System\qJxhdma.exe
  C:\Windows\System\qJxhdma.exe
  2⤵
  PID:9584
- C:\Windows\System\QvtGzLE.exe
  C:\Windows\System\QvtGzLE.exe
  2⤵
  PID:9616
- C:\Windows\System\RvCJRTM.exe
  C:\Windows\System\RvCJRTM.exe
  2⤵
  PID:9648
- C:\Windows\System\aWzvaaM.exe
  C:\Windows\System\aWzvaaM.exe
  2⤵
  PID:9676
- C:\Windows\System\NdUMdsg.exe
  C:\Windows\System\NdUMdsg.exe
  2⤵
  PID:9696
- C:\Windows\System\eyiwqJp.exe
  C:\Windows\System\eyiwqJp.exe
  2⤵
  PID:9724
- C:\Windows\System\azipAWb.exe
  C:\Windows\System\azipAWb.exe
  2⤵
  PID:9744
- C:\Windows\System\HxGgusQ.exe
  C:\Windows\System\HxGgusQ.exe
  2⤵
  PID:9772
- C:\Windows\System\AUAKaTZ.exe
  C:\Windows\System\AUAKaTZ.exe
  2⤵
  PID:10036
- C:\Windows\System\YWCkURr.exe
  C:\Windows\System\YWCkURr.exe
  2⤵
  PID:10068
- C:\Windows\System\WmdNJOv.exe
  C:\Windows\System\WmdNJOv.exe
  2⤵
  PID:10100
- C:\Windows\System\xRCrBjK.exe
  C:\Windows\System\xRCrBjK.exe
  2⤵
  PID:10128
- C:\Windows\System\mMUSYuz.exe
  C:\Windows\System\mMUSYuz.exe
  2⤵
  PID:10168
- C:\Windows\System\WpFrcjd.exe
  C:\Windows\System\WpFrcjd.exe
  2⤵
  PID:10204
- C:\Windows\System\dFzYNFo.exe
  C:\Windows\System\dFzYNFo.exe
  2⤵
  PID:9200
- C:\Windows\System\RJaZuBI.exe
  C:\Windows\System\RJaZuBI.exe
  2⤵
  PID:9008
- C:\Windows\System\rZVkKkE.exe
  C:\Windows\System\rZVkKkE.exe
  2⤵
  PID:9096
- C:\Windows\System\AZsfKrK.exe
  C:\Windows\System\AZsfKrK.exe
  2⤵
  PID:6524
- C:\Windows\System\VwvlVXI.exe
  C:\Windows\System\VwvlVXI.exe
  2⤵
  PID:9160
- C:\Windows\System\UoceTvo.exe
  C:\Windows\System\UoceTvo.exe
  2⤵
  PID:9256
- C:\Windows\System\hYwdKil.exe
  C:\Windows\System\hYwdKil.exe
  2⤵
  PID:9028
- C:\Windows\System\ILOxbjo.exe
  C:\Windows\System\ILOxbjo.exe
  2⤵
  PID:8304
- C:\Windows\System\fHrEtRo.exe
  C:\Windows\System\fHrEtRo.exe
  2⤵
  PID:8112
- C:\Windows\System\TFGQUtd.exe
  C:\Windows\System\TFGQUtd.exe
  2⤵
  PID:9556
- C:\Windows\System\PVqhpIk.exe
  C:\Windows\System\PVqhpIk.exe
  2⤵
  PID:9232
- C:\Windows\System\ugkeZfb.exe
  C:\Windows\System\ugkeZfb.exe
  2⤵
  PID:9280
- C:\Windows\System\EuwTfZu.exe
  C:\Windows\System\EuwTfZu.exe
  2⤵
  PID:9320
- C:\Windows\System\ZBHKRab.exe
  C:\Windows\System\ZBHKRab.exe
  2⤵
  PID:9752
- C:\Windows\System\PuBjpnH.exe
  C:\Windows\System\PuBjpnH.exe
  2⤵
  PID:9504
- C:\Windows\System\nBvOcPh.exe
  C:\Windows\System\nBvOcPh.exe
  2⤵
  PID:9572
- C:\Windows\System\ZnOPzLX.exe
  C:\Windows\System\ZnOPzLX.exe
  2⤵
  PID:9928
- C:\Windows\System\ovmQjXQ.exe
  C:\Windows\System\ovmQjXQ.exe
  2⤵
  PID:9940
- C:\Windows\System\HiFLtWS.exe
  C:\Windows\System\HiFLtWS.exe
  2⤵
  PID:9720
- C:\Windows\System\DaAzTQq.exe
  C:\Windows\System\DaAzTQq.exe
  2⤵
  PID:9408
- C:\Windows\System\GFiDLub.exe
  C:\Windows\System\GFiDLub.exe
  2⤵
  PID:9848
- C:\Windows\System\ZZgIJtV.exe
  C:\Windows\System\ZZgIJtV.exe
  2⤵
  PID:9880
- C:\Windows\System\gpBoXVR.exe
  C:\Windows\System\gpBoXVR.exe
  2⤵
  PID:9644
- C:\Windows\System\YdJXCGy.exe
  C:\Windows\System\YdJXCGy.exe
  2⤵
  PID:8996
- C:\Windows\System\WTAPaSW.exe
  C:\Windows\System\WTAPaSW.exe
  2⤵
  PID:9084
- C:\Windows\System\THDWTZQ.exe
  C:\Windows\System\THDWTZQ.exe
  2⤵
  PID:9840
- C:\Windows\System\bxjtadv.exe
  C:\Windows\System\bxjtadv.exe
  2⤵
  PID:8168
- C:\Windows\System\MdTPCAg.exe
  C:\Windows\System\MdTPCAg.exe
  2⤵
  PID:9636
- C:\Windows\System\gUDYNiA.exe
  C:\Windows\System\gUDYNiA.exe
  2⤵
  PID:9296
- C:\Windows\System\LUVVgVD.exe
  C:\Windows\System\LUVVgVD.exe
  2⤵
  PID:7044
- C:\Windows\System\tXZaGXQ.exe
  C:\Windows\System\tXZaGXQ.exe
  2⤵
  PID:10248
- C:\Windows\System\vfMwHQX.exe
  C:\Windows\System\vfMwHQX.exe
  2⤵
  PID:10284
- C:\Windows\System\Lxbkufs.exe
  C:\Windows\System\Lxbkufs.exe
  2⤵
  PID:10308
- C:\Windows\System\VMMkuLV.exe
  C:\Windows\System\VMMkuLV.exe
  2⤵
  PID:10348
- C:\Windows\System\pGBhGyK.exe
  C:\Windows\System\pGBhGyK.exe
  2⤵
  PID:10372
- C:\Windows\System\rPqdMRz.exe
  C:\Windows\System\rPqdMRz.exe
  2⤵
  PID:10408
- C:\Windows\System\wpuCMjH.exe
  C:\Windows\System\wpuCMjH.exe
  2⤵
  PID:10424
- C:\Windows\System\RNiJGPg.exe
  C:\Windows\System\RNiJGPg.exe
  2⤵
  PID:10444
- C:\Windows\System\xIMugGV.exe
  C:\Windows\System\xIMugGV.exe
  2⤵
  PID:10472
- C:\Windows\System\EcYmxkN.exe
  C:\Windows\System\EcYmxkN.exe
  2⤵
  PID:10496
- C:\Windows\System\uqKkhua.exe
  C:\Windows\System\uqKkhua.exe
  2⤵
  PID:10516
- C:\Windows\System\cMBStGI.exe
  C:\Windows\System\cMBStGI.exe
  2⤵
  PID:10532
- C:\Windows\System\MjWhrrZ.exe
  C:\Windows\System\MjWhrrZ.exe
  2⤵
  PID:10560
- C:\Windows\System\QIyckFr.exe
  C:\Windows\System\QIyckFr.exe
  2⤵
  PID:10584
- C:\Windows\System\wsHnPzC.exe
  C:\Windows\System\wsHnPzC.exe
  2⤵
  PID:10612
- C:\Windows\System\LTthIhN.exe
  C:\Windows\System\LTthIhN.exe
  2⤵
  PID:10632
- C:\Windows\System\NBgJWvz.exe
  C:\Windows\System\NBgJWvz.exe
  2⤵
  PID:10656
- C:\Windows\System\IYDBibG.exe
  C:\Windows\System\IYDBibG.exe
  2⤵
  PID:10680
- C:\Windows\System\jFFMTWb.exe
  C:\Windows\System\jFFMTWb.exe
  2⤵
  PID:10708
- C:\Windows\System\djPPMxx.exe
  C:\Windows\System\djPPMxx.exe
  2⤵
  PID:10732
- C:\Windows\System\TwCPPzT.exe
  C:\Windows\System\TwCPPzT.exe
  2⤵
  PID:10760
- C:\Windows\System\sLjaOnx.exe
  C:\Windows\System\sLjaOnx.exe
  2⤵
  PID:10780
- C:\Windows\System\FUzvWal.exe
  C:\Windows\System\FUzvWal.exe
  2⤵
  PID:10804
- C:\Windows\System\taRRvKw.exe
  C:\Windows\System\taRRvKw.exe
  2⤵
  PID:10836
- C:\Windows\System\mikTWly.exe
  C:\Windows\System\mikTWly.exe
  2⤵
  PID:10860
- C:\Windows\System\yfNyPuT.exe
  C:\Windows\System\yfNyPuT.exe
  2⤵
  PID:10888
- C:\Windows\System\fJBIbbf.exe
  C:\Windows\System\fJBIbbf.exe
  2⤵
  PID:10912
- C:\Windows\System\uSwrYrD.exe
  C:\Windows\System\uSwrYrD.exe
  2⤵
  PID:10940
- C:\Windows\System\oytXdxf.exe
  C:\Windows\System\oytXdxf.exe
  2⤵
  PID:10960
- C:\Windows\System\rsZkGdC.exe
  C:\Windows\System\rsZkGdC.exe
  2⤵
  PID:10980
- C:\Windows\System\gewIUpf.exe
  C:\Windows\System\gewIUpf.exe
  2⤵
  PID:10996
- C:\Windows\System\ahLKjGP.exe
  C:\Windows\System\ahLKjGP.exe
  2⤵
  PID:11024
- C:\Windows\System\gIpWLjj.exe
  C:\Windows\System\gIpWLjj.exe
  2⤵
  PID:11044
- C:\Windows\System\uiYwjiR.exe
  C:\Windows\System\uiYwjiR.exe
  2⤵
  PID:11064
- C:\Windows\System\xxdyJuw.exe
  C:\Windows\System\xxdyJuw.exe
  2⤵
  PID:11092
- C:\Windows\System\JBMqYdX.exe
  C:\Windows\System\JBMqYdX.exe
  2⤵
  PID:11112
- C:\Windows\System\kCKNirC.exe
  C:\Windows\System\kCKNirC.exe
  2⤵
  PID:11140
- C:\Windows\System\AdVBoYU.exe
  C:\Windows\System\AdVBoYU.exe
  2⤵
  PID:11212
- C:\Windows\System\DZwgiib.exe
  C:\Windows\System\DZwgiib.exe
  2⤵
  PID:11240
- C:\Windows\System\dONIwPT.exe
  C:\Windows\System\dONIwPT.exe
  2⤵
  PID:11260
- C:\Windows\System\CoHNaLX.exe
  C:\Windows\System\CoHNaLX.exe
  2⤵
  PID:9496
- C:\Windows\System\BxetWeJ.exe
  C:\Windows\System\BxetWeJ.exe
  2⤵
  PID:9604
- C:\Windows\System\oZrhOXY.exe
  C:\Windows\System\oZrhOXY.exe
  2⤵
  PID:9436
- C:\Windows\System\WvufkTw.exe
  C:\Windows\System\WvufkTw.exe
  2⤵
  PID:9180
- C:\Windows\System\wKfeBBt.exe
  C:\Windows\System\wKfeBBt.exe
  2⤵
  PID:10280
- C:\Windows\System\TSMyIjC.exe
  C:\Windows\System\TSMyIjC.exe
  2⤵
  PID:10404
- C:\Windows\System\OsxOkYC.exe
  C:\Windows\System\OsxOkYC.exe
  2⤵
  PID:10552
- C:\Windows\System\tFFmJto.exe
  C:\Windows\System\tFFmJto.exe
  2⤵
  PID:10484
- C:\Windows\System\uBzpUhh.exe
  C:\Windows\System\uBzpUhh.exe
  2⤵
  PID:10504
- C:\Windows\System\pSGkWzb.exe
  C:\Windows\System\pSGkWzb.exe
  2⤵
  PID:10648
- C:\Windows\System\ryEBsIi.exe
  C:\Windows\System\ryEBsIi.exe
  2⤵
  PID:10716
- C:\Windows\System\gWXtMrB.exe
  C:\Windows\System\gWXtMrB.exe
  2⤵
  PID:10652
- C:\Windows\System\jPiRfZQ.exe
  C:\Windows\System\jPiRfZQ.exe
  2⤵
  PID:10976
- C:\Windows\System\JltdpES.exe
  C:\Windows\System\JltdpES.exe
  2⤵
  PID:1276
- C:\Windows\System\iwcOmPq.exe
  C:\Windows\System\iwcOmPq.exe
  2⤵
  PID:10816
- C:\Windows\System\xokpEWA.exe
  C:\Windows\System\xokpEWA.exe
  2⤵
  PID:10988
- C:\Windows\System\HGRWMzC.exe
  C:\Windows\System\HGRWMzC.exe
  2⤵
  PID:10932
- C:\Windows\System\aKWwPZg.exe
  C:\Windows\System\aKWwPZg.exe
  2⤵
  PID:10196
- C:\Windows\System\ltIYzvd.exe
  C:\Windows\System\ltIYzvd.exe
  2⤵
  PID:3748
- C:\Windows\System\DWmCXDB.exe
  C:\Windows\System\DWmCXDB.exe
  2⤵
  PID:10460
- C:\Windows\System\xmSMYHY.exe
  C:\Windows\System\xmSMYHY.exe
  2⤵
  PID:10548
- C:\Windows\System\yAdWRfY.exe
  C:\Windows\System\yAdWRfY.exe
  2⤵
  PID:9916
- C:\Windows\System\tfgqOyn.exe
  C:\Windows\System\tfgqOyn.exe
  2⤵
  PID:10256
- C:\Windows\System\nNuIPCV.exe
  C:\Windows\System\nNuIPCV.exe
  2⤵
  PID:11224
- C:\Windows\System\XgcbanO.exe
  C:\Windows\System\XgcbanO.exe
  2⤵
  PID:11008
- C:\Windows\System\gSkiHqp.exe
  C:\Windows\System\gSkiHqp.exe
  2⤵
  PID:9712
- C:\Windows\System\qBMFrGd.exe
  C:\Windows\System\qBMFrGd.exe
  2⤵
  PID:10524
- C:\Windows\System\EcFEABd.exe
  C:\Windows\System\EcFEABd.exe
  2⤵
  PID:11288
- C:\Windows\System\msetTIZ.exe
  C:\Windows\System\msetTIZ.exe
  2⤵
  PID:11320
- C:\Windows\System\gekuFeR.exe
  C:\Windows\System\gekuFeR.exe
  2⤵
  PID:11340
- C:\Windows\System\qEwTmRg.exe
  C:\Windows\System\qEwTmRg.exe
  2⤵
  PID:11360
- C:\Windows\System\zPBRWvl.exe
  C:\Windows\System\zPBRWvl.exe
  2⤵
  PID:11380
- C:\Windows\System\ItqtAcs.exe
  C:\Windows\System\ItqtAcs.exe
  2⤵
  PID:11408
- C:\Windows\System\QmPOXES.exe
  C:\Windows\System\QmPOXES.exe
  2⤵
  PID:11428
- C:\Windows\System\QIlbxVh.exe
  C:\Windows\System\QIlbxVh.exe
  2⤵
  PID:11452
- C:\Windows\System\UimdKUg.exe
  C:\Windows\System\UimdKUg.exe
  2⤵
  PID:11484
- C:\Windows\System\vvpoZUw.exe
  C:\Windows\System\vvpoZUw.exe
  2⤵
  PID:11508
- C:\Windows\System\xDmAkUz.exe
  C:\Windows\System\xDmAkUz.exe
  2⤵
  PID:11536
- C:\Windows\System\dLflYHK.exe
  C:\Windows\System\dLflYHK.exe
  2⤵
  PID:11564
- C:\Windows\System\KILZFKD.exe
  C:\Windows\System\KILZFKD.exe
  2⤵
  PID:11584
- C:\Windows\System\hrmfOQj.exe
  C:\Windows\System\hrmfOQj.exe
  2⤵
  PID:11604
- C:\Windows\System\nzvMqaq.exe
  C:\Windows\System\nzvMqaq.exe
  2⤵
  PID:11624
- C:\Windows\System\RBAiBis.exe
  C:\Windows\System\RBAiBis.exe
  2⤵
  PID:11640
- C:\Windows\System\beqDoma.exe
  C:\Windows\System\beqDoma.exe
  2⤵
  PID:11660
- C:\Windows\System\zeQsNEx.exe
  C:\Windows\System\zeQsNEx.exe
  2⤵
  PID:11680
- C:\Windows\System\iJBKjDh.exe
  C:\Windows\System\iJBKjDh.exe
  2⤵
  PID:11700
- C:\Windows\System\eVePuOm.exe
  C:\Windows\System\eVePuOm.exe
  2⤵
  PID:11720
- C:\Windows\System\GIaLtLS.exe
  C:\Windows\System\GIaLtLS.exe
  2⤵
  PID:11748
- C:\Windows\System\LIDEvwD.exe
  C:\Windows\System\LIDEvwD.exe
  2⤵
  PID:11764
- C:\Windows\System\akuKAGN.exe
  C:\Windows\System\akuKAGN.exe
  2⤵
  PID:11788
- C:\Windows\System\wKDjrVl.exe
  C:\Windows\System\wKDjrVl.exe
  2⤵
  PID:11808
- C:\Windows\System\ejdsqJi.exe
  C:\Windows\System\ejdsqJi.exe
  2⤵
  PID:11836
- C:\Windows\System\nHrUSoX.exe
  C:\Windows\System\nHrUSoX.exe
  2⤵
  PID:11860
- C:\Windows\System\hBrftiH.exe
  C:\Windows\System\hBrftiH.exe
  2⤵
  PID:11888
- C:\Windows\System\LlEhtjG.exe
  C:\Windows\System\LlEhtjG.exe
  2⤵
  PID:11912
- C:\Windows\System\mTYZvlm.exe
  C:\Windows\System\mTYZvlm.exe
  2⤵
  PID:11928
- C:\Windows\System\foFQpHz.exe
  C:\Windows\System\foFQpHz.exe
  2⤵
  PID:11948
- C:\Windows\System\EbhCFMo.exe
  C:\Windows\System\EbhCFMo.exe
  2⤵
  PID:11968
- C:\Windows\System\DvSGCse.exe
  C:\Windows\System\DvSGCse.exe
  2⤵
  PID:11992
- C:\Windows\System\ShoVhcv.exe
  C:\Windows\System\ShoVhcv.exe
  2⤵
  PID:12008
- C:\Windows\System\xSqSMPK.exe
  C:\Windows\System\xSqSMPK.exe
  2⤵
  PID:12036
- C:\Windows\System\KkdzTtB.exe
  C:\Windows\System\KkdzTtB.exe
  2⤵
  PID:12052
- C:\Windows\System\FXLFaHe.exe
  C:\Windows\System\FXLFaHe.exe
  2⤵
  PID:12084
- C:\Windows\System\crbemDT.exe
  C:\Windows\System\crbemDT.exe
  2⤵
  PID:12104
- C:\Windows\System\wlFueSC.exe
  C:\Windows\System\wlFueSC.exe
  2⤵
  PID:12128
- C:\Windows\System\MnnLovO.exe
  C:\Windows\System\MnnLovO.exe
  2⤵
  PID:12160
- C:\Windows\System\gODqkOW.exe
  C:\Windows\System\gODqkOW.exe
  2⤵
  PID:12184
- C:\Windows\System\uDEgTYG.exe
  C:\Windows\System\uDEgTYG.exe
  2⤵
  PID:12204
- C:\Windows\System\hBFOTbH.exe
  C:\Windows\System\hBFOTbH.exe
  2⤵
  PID:12224
- C:\Windows\System\cWbmFwy.exe
  C:\Windows\System\cWbmFwy.exe
  2⤵
  PID:12256
- C:\Windows\System\OfHUJxD.exe
  C:\Windows\System\OfHUJxD.exe
  2⤵
  PID:12276
- C:\Windows\System\nzbuWsq.exe
  C:\Windows\System\nzbuWsq.exe
  2⤵
  PID:11032
- C:\Windows\System\OtSIqOf.exe
  C:\Windows\System\OtSIqOf.exe
  2⤵
  PID:2864
- C:\Windows\System\QrHYQJZ.exe
  C:\Windows\System\QrHYQJZ.exe
  2⤵
  PID:11276
- C:\Windows\System\gbnTOik.exe
  C:\Windows\System\gbnTOik.exe
  2⤵
  PID:10420
- C:\Windows\System\ZZJckix.exe
  C:\Windows\System\ZZJckix.exe
  2⤵
  PID:10852
- C:\Windows\System\yabqeBn.exe
  C:\Windows\System\yabqeBn.exe
  2⤵
  PID:11420
- C:\Windows\System\dKRjtEh.exe
  C:\Windows\System\dKRjtEh.exe
  2⤵
  PID:10640
- C:\Windows\System\ggwKrrF.exe
  C:\Windows\System\ggwKrrF.exe
  2⤵
  PID:11356
- C:\Windows\System\gqrhRLl.exe
  C:\Windows\System\gqrhRLl.exe
  2⤵
  PID:11600
- C:\Windows\System\fsvKMHA.exe
  C:\Windows\System\fsvKMHA.exe
  2⤵
  PID:11448
- C:\Windows\System\toSPANy.exe
  C:\Windows\System\toSPANy.exe
  2⤵
  PID:11528
- C:\Windows\System\XclNxde.exe
  C:\Windows\System\XclNxde.exe
  2⤵
  PID:11560
- C:\Windows\System\shQcCtx.exe
  C:\Windows\System\shQcCtx.exe
  2⤵
  PID:11392
- C:\Windows\System\ROyLImE.exe
  C:\Windows\System\ROyLImE.exe
  2⤵
  PID:11868
- C:\Windows\System\AuTxYPu.exe
  C:\Windows\System\AuTxYPu.exe
  2⤵
  PID:11956
- C:\Windows\System\fPHtvMX.exe
  C:\Windows\System\fPHtvMX.exe
  2⤵
  PID:11524
- C:\Windows\System\ntfjDXF.exe
  C:\Windows\System\ntfjDXF.exe
  2⤵
  PID:11760
- C:\Windows\System\zmdWyic.exe
  C:\Windows\System\zmdWyic.exe
  2⤵
  PID:12124
- C:\Windows\System\PFTZPHL.exe
  C:\Windows\System\PFTZPHL.exe
  2⤵
  PID:11880
- C:\Windows\System\EFyeVGU.exe
  C:\Windows\System\EFyeVGU.exe
  2⤵
  PID:12272
- C:\Windows\System\jsshQRk.exe
  C:\Windows\System\jsshQRk.exe
  2⤵
  PID:12292
- C:\Windows\System\idKmSei.exe
  C:\Windows\System\idKmSei.exe
  2⤵
  PID:12308
- C:\Windows\System\UsCRqYo.exe
  C:\Windows\System\UsCRqYo.exe
  2⤵
  PID:12424
- C:\Windows\System\xIQxQqx.exe
  C:\Windows\System\xIQxQqx.exe
  2⤵
  PID:12456
- C:\Windows\System\PntFfbF.exe
  C:\Windows\System\PntFfbF.exe
  2⤵
  PID:12484
- C:\Windows\System\UqDhnoO.exe
  C:\Windows\System\UqDhnoO.exe
  2⤵
  PID:12504
- C:\Windows\System\xMnHMyj.exe
  C:\Windows\System\xMnHMyj.exe
  2⤵
  PID:12536
- C:\Windows\System\uEvphsf.exe
  C:\Windows\System\uEvphsf.exe
  2⤵
  PID:12592
- C:\Windows\System\svxarIx.exe
  C:\Windows\System\svxarIx.exe
  2⤵
  PID:12624
- C:\Windows\System\eSZixyG.exe
  C:\Windows\System\eSZixyG.exe
  2⤵
  PID:12652
- C:\Windows\System\JQhwtsI.exe
  C:\Windows\System\JQhwtsI.exe
  2⤵
  PID:12688
- C:\Windows\System\nethHRb.exe
  C:\Windows\System\nethHRb.exe
  2⤵
  PID:12708
- C:\Windows\System\EPhZuge.exe
  C:\Windows\System\EPhZuge.exe
  2⤵
  PID:12736
- C:\Windows\System\aZmXucH.exe
  C:\Windows\System\aZmXucH.exe
  2⤵
  PID:12764
- C:\Windows\System\meJwRTl.exe
  C:\Windows\System\meJwRTl.exe
  2⤵
  PID:12800
- C:\Windows\System\SkiIcqb.exe
  C:\Windows\System\SkiIcqb.exe
  2⤵
  PID:12836
- C:\Windows\System\jZERYGK.exe
  C:\Windows\System\jZERYGK.exe
  2⤵
  PID:12860
- C:\Windows\System\KLFiRrO.exe
  C:\Windows\System\KLFiRrO.exe
  2⤵
  PID:12896
- C:\Windows\System\URfaNML.exe
  C:\Windows\System\URfaNML.exe
  2⤵
  PID:12928
- C:\Windows\System\dEvcFqj.exe
  C:\Windows\System\dEvcFqj.exe
  2⤵
  PID:12956
- C:\Windows\System\btQhwtG.exe
  C:\Windows\System\btQhwtG.exe
  2⤵
  PID:12976
- C:\Windows\System\FeMPzqd.exe
  C:\Windows\System\FeMPzqd.exe
  2⤵
  PID:13004
- C:\Windows\System\MCZARcE.exe
  C:\Windows\System\MCZARcE.exe
  2⤵
  PID:13092
- C:\Windows\System\LNJhAsM.exe
  C:\Windows\System\LNJhAsM.exe
  2⤵
  PID:13112
- C:\Windows\System\wNLLieA.exe
  C:\Windows\System\wNLLieA.exe
  2⤵
  PID:13136
- C:\Windows\System\ViElBDd.exe
  C:\Windows\System\ViElBDd.exe
  2⤵
  PID:13172
- C:\Windows\System\WIOetQS.exe
  C:\Windows\System\WIOetQS.exe
  2⤵
  PID:13200
- C:\Windows\System\vWuzSnV.exe
  C:\Windows\System\vWuzSnV.exe
  2⤵
  PID:13228
- C:\Windows\System\JJysQpn.exe
  C:\Windows\System\JJysQpn.exe
  2⤵
  PID:13244
- C:\Windows\System\UALvCVH.exe
  C:\Windows\System\UALvCVH.exe
  2⤵
  PID:13264
- C:\Windows\System\vwpuFww.exe
  C:\Windows\System\vwpuFww.exe
  2⤵
  PID:13292
- C:\Windows\System\VvcPlKH.exe
  C:\Windows\System\VvcPlKH.exe
  2⤵
  PID:11348
- C:\Windows\System\ASKVxSS.exe
  C:\Windows\System\ASKVxSS.exe
  2⤵
  PID:12180
- C:\Windows\System\BoCOXMh.exe
  C:\Windows\System\BoCOXMh.exe
  2⤵
  PID:12268
- C:\Windows\System\shxQfLX.exe
  C:\Windows\System\shxQfLX.exe
  2⤵
  PID:10544
- C:\Windows\System\lxwMdfR.exe
  C:\Windows\System\lxwMdfR.exe
  2⤵
  PID:1332
- C:\Windows\System\mDccNDG.exe
  C:\Windows\System\mDccNDG.exe
  2⤵
  PID:11500
- C:\Windows\System\yekNYjd.exe
  C:\Windows\System\yekNYjd.exe
  2⤵
  PID:11856
- C:\Windows\System\cKPXMfv.exe
  C:\Windows\System\cKPXMfv.exe
  2⤵
  PID:11716
- C:\Windows\System\XSUmkaT.exe
  C:\Windows\System\XSUmkaT.exe
  2⤵
  PID:12148
- C:\Windows\System\ajciivN.exe
  C:\Windows\System\ajciivN.exe
  2⤵
  PID:12248
- C:\Windows\System\pHiTlBo.exe
  C:\Windows\System\pHiTlBo.exe
  2⤵
  PID:12348
- C:\Windows\System\QhTquiN.exe
  C:\Windows\System\QhTquiN.exe
  2⤵
  PID:12544
- C:\Windows\System\DfUqwcT.exe
  C:\Windows\System\DfUqwcT.exe
  2⤵
  PID:12616
- C:\Windows\System\lkdmhsb.exe
  C:\Windows\System\lkdmhsb.exe
  2⤵
  PID:12816
- C:\Windows\System\oOYJuVt.exe
  C:\Windows\System\oOYJuVt.exe
  2⤵
  PID:12988
- C:\Windows\System\lFSlQKj.exe
  C:\Windows\System\lFSlQKj.exe
  2⤵
  PID:12476
- C:\Windows\System\BMageBc.exe
  C:\Windows\System\BMageBc.exe
  2⤵
  PID:12852
- C:\Windows\System\jpCQXbC.exe
  C:\Windows\System\jpCQXbC.exe
  2⤵
  PID:12872
- C:\Windows\System\lgFfuVZ.exe
  C:\Windows\System\lgFfuVZ.exe
  2⤵
  PID:13080
- C:\Windows\System\VqBghxu.exe
  C:\Windows\System\VqBghxu.exe
  2⤵
  PID:13236
- C:\Windows\System\DAvcYCd.exe
  C:\Windows\System\DAvcYCd.exe
  2⤵
  PID:13260
- C:\Windows\System\iqXUyBk.exe
  C:\Windows\System\iqXUyBk.exe
  2⤵
  PID:13308
- C:\Windows\System\QabTsfC.exe
  C:\Windows\System\QabTsfC.exe
  2⤵
  PID:13184
- C:\Windows\System\JeknTdB.exe
  C:\Windows\System\JeknTdB.exe
  2⤵
  PID:8388
- C:\Windows\System\YXRdRMd.exe
  C:\Windows\System\YXRdRMd.exe
  2⤵
  PID:12244
- C:\Windows\System\SeHMgUi.exe
  C:\Windows\System\SeHMgUi.exe
  2⤵
  PID:2392
- C:\Windows\System\dEqhJNV.exe
  C:\Windows\System\dEqhJNV.exe
  2⤵
  PID:13284
- C:\Windows\System\czagxLH.exe
  C:\Windows\System\czagxLH.exe
  2⤵
  PID:12120
- C:\Windows\System\ecdCzyq.exe
  C:\Windows\System\ecdCzyq.exe
  2⤵
  PID:12644
- C:\Windows\System\trdpZlj.exe
  C:\Windows\System\trdpZlj.exe
  2⤵
  PID:572
- C:\Windows\System\ApsmEgK.exe
  C:\Windows\System\ApsmEgK.exe
  2⤵
  PID:12420
- C:\Windows\System\KJgWhql.exe
  C:\Windows\System\KJgWhql.exe
  2⤵
  PID:12064
- C:\Windows\System\prEiTnm.exe
  C:\Windows\System\prEiTnm.exe
  2⤵
  PID:11708
- C:\Windows\System\nJFgsIc.exe
  C:\Windows\System\nJFgsIc.exe
  2⤵
  PID:12848
- C:\Windows\System\JtjypJe.exe
  C:\Windows\System\JtjypJe.exe
  2⤵
  PID:11872
- C:\Windows\System\XZlQJKt.exe
  C:\Windows\System\XZlQJKt.exe
  2⤵
  PID:12432
- C:\Windows\System\xpKsFhb.exe
  C:\Windows\System\xpKsFhb.exe
  2⤵
  PID:13348
- C:\Windows\System\faUwVAy.exe
  C:\Windows\System\faUwVAy.exe
  2⤵
  PID:13380
- C:\Windows\System\qXJjhDl.exe
  C:\Windows\System\qXJjhDl.exe
  2⤵
  PID:13396
- C:\Windows\System\cwKZtEI.exe
  C:\Windows\System\cwKZtEI.exe
  2⤵
  PID:13512
- C:\Windows\System\bjpXzoe.exe
  C:\Windows\System\bjpXzoe.exe
  2⤵
  PID:13540
- C:\Windows\System\RiixvKy.exe
  C:\Windows\System\RiixvKy.exe
  2⤵
  PID:13564
- C:\Windows\System\rjJQeQG.exe
  C:\Windows\System\rjJQeQG.exe
  2⤵
  PID:13604
- C:\Windows\System\NFtfLUU.exe
  C:\Windows\System\NFtfLUU.exe
  2⤵
  PID:13632
- C:\Windows\System\WelDKyP.exe
  C:\Windows\System\WelDKyP.exe
  2⤵
  PID:13660
- C:\Windows\System\yxcUBis.exe
  C:\Windows\System\yxcUBis.exe
  2⤵
  PID:13680
- C:\Windows\System\cotdcLT.exe
  C:\Windows\System\cotdcLT.exe
  2⤵
  PID:13716
- C:\Windows\System\viROrkJ.exe
  C:\Windows\System\viROrkJ.exe
  2⤵
  PID:13748
- C:\Windows\System\SuVRoHc.exe
  C:\Windows\System\SuVRoHc.exe
  2⤵
  PID:13764
- C:\Windows\System\kibQiJH.exe
  C:\Windows\System\kibQiJH.exe
  2⤵
  PID:13796
- C:\Windows\System\ASDiSdt.exe
  C:\Windows\System\ASDiSdt.exe
  2⤵
  PID:13816
- C:\Windows\System\dtitcpX.exe
  C:\Windows\System\dtitcpX.exe
  2⤵
  PID:13844
- C:\Windows\System\EqPjcYZ.exe
  C:\Windows\System\EqPjcYZ.exe
  2⤵
  PID:13868
- C:\Windows\System\GVlvknE.exe
  C:\Windows\System\GVlvknE.exe
  2⤵
  PID:13892
- C:\Windows\System\JFzTeib.exe
  C:\Windows\System\JFzTeib.exe
  2⤵
  PID:13936
- C:\Windows\System\CgGrAAe.exe
  C:\Windows\System\CgGrAAe.exe
  2⤵
  PID:13952
- C:\Windows\System\mWcnyvi.exe
  C:\Windows\System\mWcnyvi.exe
  2⤵
  PID:13972
- C:\Windows\System\yYITeFv.exe
  C:\Windows\System\yYITeFv.exe
  2⤵
  PID:13988
- C:\Windows\System\ScWNIOa.exe
  C:\Windows\System\ScWNIOa.exe
  2⤵
  PID:14012
- C:\Windows\System\uWtgzqA.exe
  C:\Windows\System\uWtgzqA.exe
  2⤵
  PID:14040
- C:\Windows\System\BfTbxpV.exe
  C:\Windows\System\BfTbxpV.exe
  2⤵
  PID:14068
- C:\Windows\System\jELWSFC.exe
  C:\Windows\System\jELWSFC.exe
  2⤵
  PID:14112
- C:\Windows\System\BxjhKrb.exe
  C:\Windows\System\BxjhKrb.exe
  2⤵
  PID:14140
- C:\Windows\System\rzrIxzo.exe
  C:\Windows\System\rzrIxzo.exe
  2⤵
  PID:14172
- C:\Windows\System\KzuzsBN.exe
  C:\Windows\System\KzuzsBN.exe
  2⤵
  PID:14192
- C:\Windows\System\nruelCS.exe
  C:\Windows\System\nruelCS.exe
  2⤵
  PID:14212
- C:\Windows\System\TRnmvBh.exe
  C:\Windows\System\TRnmvBh.exe
  2⤵
  PID:14244
- C:\Windows\System\BlmlcWv.exe
  C:\Windows\System\BlmlcWv.exe
  2⤵
  PID:14264
- C:\Windows\System\qMTlbmF.exe
  C:\Windows\System\qMTlbmF.exe
  2⤵
  PID:14280
- C:\Windows\System\vdWWOwK.exe
  C:\Windows\System\vdWWOwK.exe
  2⤵
  PID:13856
- C:\Windows\System\SkaCiTo.exe
  C:\Windows\System\SkaCiTo.exe
  2⤵
  PID:14168
- C:\Windows\System\pNwNFxw.exe
  C:\Windows\System\pNwNFxw.exe
  2⤵
  PID:13876
- C:\Windows\System\xQcxgaB.exe
  C:\Windows\System\xQcxgaB.exe
  2⤵
  PID:13916
- C:\Windows\System\sQXJLJE.exe
  C:\Windows\System\sQXJLJE.exe
  2⤵
  PID:13960
- C:\Windows\System\MPgHAIT.exe
  C:\Windows\System\MPgHAIT.exe
  2⤵
  PID:14128
- C:\Windows\System\TTHNRFK.exe
  C:\Windows\System\TTHNRFK.exe
  2⤵
  PID:14256
- C:\Windows\System\wHbTGHg.exe
  C:\Windows\System\wHbTGHg.exe
  2⤵
  PID:14076
- C:\Windows\System\ijcNAVS.exe
  C:\Windows\System\ijcNAVS.exe
  2⤵
  PID:14316
- C:\Windows\System\fDvPeqP.exe
  C:\Windows\System\fDvPeqP.exe
  2⤵
  PID:13016
- C:\Windows\System\ezfUsdB.exe
  C:\Windows\System\ezfUsdB.exe
  2⤵
  PID:10728
- C:\Windows\System\IOhhjUq.exe
  C:\Windows\System\IOhhjUq.exe
  2⤵
  PID:11176
- C:\Windows\System\yGNGZzL.exe
  C:\Windows\System\yGNGZzL.exe
  2⤵
  PID:13828
- C:\Windows\System\btaooTx.exe
  C:\Windows\System\btaooTx.exe
  2⤵
  PID:13168
- C:\Windows\System\HRyVznV.exe
  C:\Windows\System\HRyVznV.exe
  2⤵
  PID:13732
- C:\Windows\System\URnQgTQ.exe
  C:\Windows\System\URnQgTQ.exe
  2⤵
  PID:13904
- C:\Windows\System\TpHIFfS.exe
  C:\Windows\System\TpHIFfS.exe
  2⤵
  PID:14148
- C:\Windows\System\lutQfjT.exe
  C:\Windows\System\lutQfjT.exe
  2⤵
  PID:14208
- C:\Windows\System\hqXyqHc.exe
  C:\Windows\System\hqXyqHc.exe
  2⤵
  PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1948 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ANgDumQ.exe

Filesize
1.9MB

MD5
5e3a5b6764c796914e64f51afa451b16

SHA1
1a57199371bb7ab7a4846fa0d2f77329e3268c12

SHA256
e397ba4ecc17d0af26af224a78cf26bcbc2ee15dd89d93da5d09f31728666326

SHA512
8a20c43bc9be0eaa1085de5167d44ad16c4f68d23c5c438949709c1ba355681cb95cc6e31cda3fa5b7d0c470c44bda97dc90acbc2a4d4e42ac93594aa5d81239

Download Submit
C:\Windows\System\BtmRVIp.exe

Filesize
1.9MB

MD5
0139736117e6099a1c66280f1ae89c4b

SHA1
c92fa9ea973650dc475eb7d8b7af44933ef75b10

SHA256
927d86b22b70b0d0d2428237022479c04e16bd3cd9cd51e8eff8501e90ecf083

SHA512
44b03540de5d40cc44961ede12245129403ccb1af6d6c2824d8ccbbe0cf8ff0299ac34060dcf84f49bdfbfbafac577e0a072ba8ed839493190652a79ab7be835

Download Submit
C:\Windows\System\CfapOQP.exe

Filesize
1.9MB

MD5
76ccb4468f5ff428143f4e956e13661f

SHA1
6df6079cb95f6827bbff69f01d055127d3079d9a

SHA256
d02afe474b0df1f04bc7c9ce59a2121527af474e577f6a0fd456c59cbc3c0f98

SHA512
e145392b5059809796c0ecc6c41879a1b657b4551d78f2cdc2369024537bca31dce75276c38184f725274f0ac62d0bb01cca91d7b5ae3528c507c1e3f712109d

Download Submit
C:\Windows\System\DszbmFQ.exe

Filesize
1.9MB

MD5
6692037144a05e2800369a6569191768

SHA1
b2992b4370063d088af5d9f40fb0720454ba6434

SHA256
5a7fb3289c418fc55526658eeb88824b19ed8aaceb761c64237fae60b8d1bf0a

SHA512
f9da8738e941cb08701d572219561594a3862ba5400bb694c50c3143852907ef2d83d56c6c6325a936c49f10f7a680910594239296bd3a6899b430b3866ee60b

Download Submit
C:\Windows\System\ICTYyQg.exe

Filesize
1.9MB

MD5
1adf0596dc7365975af848ccd8c3555e

SHA1
3fc89bd75b32becd75fcb75f8d8495b74709afcb

SHA256
48336294171bd13d1371f8d5bf5089c30f09bc6d5da6f48c6da0850436c9a894

SHA512
ff4fc14b37ee30afc90f657c25fb6694d7ff87db57aae92a9df1eff1f49c4faddfd10ca9ffd934b6937293b80cd47d87224221e15779d1e389cec371ad6f6d25

Download Submit
C:\Windows\System\JiUSoGS.exe

Filesize
1.9MB

MD5
502d35e79b61a3aef6553a67d0174adf

SHA1
f20c369ea5460d46dfcaae6dcdc1f567658a6373

SHA256
3ff332663b50f33c12ca060e1532f2c6499e00ee97ae050caf988ec8d40def87

SHA512
e93ec795cb0ee584a017b1bfbf4beb78ce522bd7c606de8ae1b95919bfe31ff8070f9ca9c5c086e65744dda0b6bc5c78ed117e950158e81ba8079e95cef1ee0b

Download Submit
C:\Windows\System\MZkfWoK.exe

Filesize
1.9MB

MD5
f7a5fe19ea1e19f3d1804d07267dc5b5

SHA1
3ca5d8da81c2a6f15c32d2d586771591a91363ab

SHA256
06aee659205de617aa66f5178895aae71587384dd73e502db4120a9f1837a22e

SHA512
c4aaaa39c8c2823aa12f6d75383f408862b5c7ed293cc023dbc765bde17c974c1abdb1f618d47d5f087849858ea5c803aca4d4e1ac5576098809ef3e4d8ffcb8

Download Submit
C:\Windows\System\PIIHJDl.exe

Filesize
1.9MB

MD5
b78c9a003567ec07a30e07b5cb317666

SHA1
efd5d4916e5abf146516f491078d963067db31b9

SHA256
60f1003295c5778c0e88e74a4d9baa40703c426bb67e470e9bcdfacbdad24174

SHA512
b4cd1e854d4134a9466d0b43fb424f097af7d53d9260c9b0292a83ff702b95ec17a67ee80867b451a211260dab507cd4a38854cb8cd8693633a45113b0b4cbba

Download Submit
C:\Windows\System\PfteLho.exe

Filesize
1.9MB

MD5
0bbae2939f6d39fb445899e36962a0f8

SHA1
159e20c868b0f10b2acba33e645f3ab24db3536b

SHA256
4b8e00020bee668951abba26d3fbab1743f56cb2bdcbfc81aaabc3149d0c2eac

SHA512
f51b19ecd0f44c3c7491b9c5a81607b573c5479defb8bca7c0d64b662132471bf58eefa224753d0221c9f00127f1e6dfcd4907ba59bcde378c6a3c2a68c38ed7

Download Submit
C:\Windows\System\SAvEZUu.exe

Filesize
1.9MB

MD5
9f0727006b812fb250ecfb8fa75cf89e

SHA1
ff30fcda15d6f4dc76c7a288de701618dac3f51d

SHA256
34de5b142825385023d8f0e57c2f06ba73fda2f2b2739c7f88a35e8b011742c6

SHA512
4e33d3ea89e595dfb5096136f0a88c4bde0bef248a880a5217da05c8642cc869111003fb1484363b28d30737245ece7075a04c11f2520aaf479da41f58295e16

Download Submit
C:\Windows\System\TLTjKgs.exe

Filesize
1.9MB

MD5
9247ab92b1ec978f75b0137f01fd6d11

SHA1
46e707997b04145eb301a4c4c9dbba61ada74017

SHA256
bd0fbb1635fd70aa7777eb39f8092c99436542cb941872cfd2dd394b45c993f1

SHA512
e3c8c7609c4ab8b499fd5d3410ccf6764c5f97cd64edb61861168cc4eb056384fa02b90bb102dfad20e37d196f1b976428b472feedacd1a1e8f73d1edb9d853d

Download Submit
C:\Windows\System\VOMXEGv.exe

Filesize
1.9MB

MD5
41771346a4d29e31da493b9fb20b2172

SHA1
a4e2e0f3df709fdaef42f2ff2f6a15625d1a83e5

SHA256
d627f7785d3a737eb86a17e1f4592aee58876463ac1582013e99ba2e4c95ce92

SHA512
079b104fd84da83c169d1535907aec73dd5b28212102d425dde5115ef1e3c4ad5992af1912bb328195c7fb4373b82caeb1ad44c51ba9de38b1a4702cda3ac28d

Download Submit
C:\Windows\System\XoVnmlv.exe

Filesize
1.9MB

MD5
09d6a1192dc197d4e881dc7836571b02

SHA1
3e5adaf97579bab467050c84ea28f55343d5f2be

SHA256
11d5893c2277674126f0dd9562c0dca3d4e120de580f61c090ebd871d9733acf

SHA512
71ca0108796ffcee554a8feec23214ba3a2b962474e3a5b6266c65289d66bfc091f347a504edca4a2333e0ab185d4601660f220e7a8a37a8b8d48eff47a3c97e

Download Submit
C:\Windows\System\ZWZqqPf.exe

Filesize
1.9MB

MD5
bcc1292ff2ffe2cd2ad48e99e1d32843

SHA1
1fc110751f548cf72d08dfa3ad3ccc9476530edc

SHA256
f0e4898e1e48d5013628bd9f8e49c249dd5291ca87fe89bbadde58a7a2678ddc

SHA512
d08cb747967cc7d01182a729cc4581584009f63dca6438fb5e6f92d5f03c4323bcb7a9b8b78faec1ca2aa9e3d9e0113e182bf7258e9a4f94ae9ce67a45c9526a

Download Submit
C:\Windows\System\ZsGovbF.exe

Filesize
1.9MB

MD5
cc058074dbd403d37d7fa8546346543f

SHA1
5bff5e77524eaa368ea7eb677996808d10ce4716

SHA256
44b732d0b61d8f0d29fb505e9009b2e9e51f81bef85f33ef5b2721e7a0896eff

SHA512
b088ae4a8f588421db23db8a759e557198d7788ae296e663273e9264011e82e90c871237837cd3a37def6eb009b24b58c2f9891f2f0c7f18290bb5fa00ef688f

Download Submit
C:\Windows\System\axwXNFt.exe

Filesize
1.9MB

MD5
7c01b76773bfeed66e32953ab43fe597

SHA1
3393537e0b718943ce23722203e625821c1d4b11

SHA256
92d626da05230bb1ca73f49fe569215950d026c8e3397ea5cb098a1838e669b2

SHA512
bdda75656626501d0becd74a5721afa5dc9b1748a4328ef8a11e85881d973d72ba74b1bd6821f079f2cf81056d9aa25d6bb0cd702dfca0fa01edec6e33d238b5

Download Submit
C:\Windows\System\eygVXCn.exe

Filesize
1.9MB

MD5
48dd6c141be04ba1a1943bf410a12bb9

SHA1
7670470910d255241d8edb61b26fc9a713acc105

SHA256
001dd979111e5e4905792b559e729afede6de995bd82cc29da98847e27e79c69

SHA512
3a6bf370fb139445e67fb6b1029ac474c8992e484d0c2620c6322173fa400b38c940baaa75a8b7cc6e6db6aad598e1c1139f89c6900053f68c5acb5342d4db70

Download Submit
C:\Windows\System\fEreYhE.exe

Filesize
1.9MB

MD5
fa12f39709cf922556bc0230b25e4f19

SHA1
7e9369b9f422922976560a0fceef2505586ef0f3

SHA256
c5f89da8370fb4fc446e9c09cf3c6fb1f5a9e95dc0bd6a8b89e9a7b6a2c9f3a8

SHA512
43d110cab41c00b982ac5f1f2959f9c0c2fb5d2684ee650c7bb81f46bc6642adf14a6ca2de0d01e18601ddc199a9b6372e52c11024591c0355f01f88996212b3

Download Submit
C:\Windows\System\gmDbgIP.exe

Filesize
1.9MB

MD5
bf68185f9bff3a706c455f67c1d6a719

SHA1
f3cc934ff3e261a7ba17eeca0865e4e65902c7cd

SHA256
2380a2adac735404237da309b16af0cd6b187a4f12269e83643de6688577ec4d

SHA512
a383e419ac059eb4ed8b4d27152bf7fecfbe363b07c3692db6b00622611a6f7efc62e9221126ce378068d8f87dc11c4dd35d6277aad4ce77a195a26f13730a00

Download Submit
C:\Windows\System\hGyrhIf.exe

Filesize
1.9MB

MD5
77138ff28d85f15065c7ae68636f1f29

SHA1
6bd7d12bda272f0d51e1bd0e2103b162c7a7c636

SHA256
96bf6938803a4651bfbd91433f0957631c1ef4af92937a339c41ae41208892d8

SHA512
82231fd453a62d7c96d4d96920254878681634af4b3c1a38f07014b7188d79d5412f0bf6bf2fc5d75a701099f9f50104b39f072b641070e7799e4e31e5cb99f2

Download Submit
C:\Windows\System\iFYqFkd.exe

Filesize
1.9MB

MD5
f4d9c1ad3dcb5c33c1c02ddf31d8d63e

SHA1
4119763f71bff7314ae520d8d58c38afbba1d719

SHA256
05ee969049f2336e18ce52549dbd1cf97a33d6716643051a8b3d30d5c2d4d6e9

SHA512
8e4b97aa48a8a06bc6be694683cc5e9f98f8ea55bc93ca8cdb9225d1b51b1e85accc02a0dc9eb36ecb35cc8ad2e47f57086975feef9d1e4b03eeabbd31774cb8

Download Submit
C:\Windows\System\izFNvOo.exe

Filesize
1.9MB

MD5
25ac37c46605042ffc41e8a8704c71f4

SHA1
ad40cc44bde7190f2057fcde864e67f842ed049c

SHA256
b7d046bd6fafea3d4de7300c16092e86ee5d4b84cc857a3b88118361555b6e3d

SHA512
62562e655c4a9a8e8912a9b9f0814bb32b5308dc6116ff07ca4d76b12fc9eeb61817a0261642580c007d1b1f428eddf18c5ce55aac79602e009372c6cd79797b

Download Submit
C:\Windows\System\kEACDwT.exe

Filesize
1.9MB

MD5
0569cf261c251f2274800cc5f6e43910

SHA1
945b0a8a951a0a8ab49c0b24f584fb290a28404c

SHA256
a452aa72b810c5924e8be39df5f2f2194a1edac60d0b6bb7947b9d1dd49df15b

SHA512
cc60b579f72d57c1b666670dbe27f62c8e7f6dec4f1edf6747d805898e34f80244b4ffacf794d5356e4fbf35c58a3aeabd12c9601d95b2d923e6c5d1e65b8d86

Download Submit
C:\Windows\System\kXjVFON.exe

Filesize
1.9MB

MD5
c816d18f9e92db69b2b9310135d887b0

SHA1
09e8f9e04edc83d9295dec514484de63883d4d80

SHA256
9be5b8eaa77d1ccd16cf174513a24b2f869b0a51bb2e4d297ce31e4a3a948862

SHA512
9eb8a7ae6b4bf35e6e2f546d0520eee2381dcd140a84f9eee00bb5d4932b7c8e10270522cbb136ae1336ad384e6cb7e9f7b5bfc568719fb54da020875fae15b6

Download Submit
C:\Windows\System\lJaLzwd.exe

Filesize
1.9MB

MD5
99f2ba63571ab84b914f2e8e24f0b882

SHA1
3d9f900196153f83a5b340dfd4061b09cfb2aa41

SHA256
6236f42ff43a85baed2644cccfc073cceb6608cc2a1243977e964f8e3862d3a2

SHA512
8a6ab83f0601a76e815c43155811508d0e66802f2d7e198007a9c54f53b1ffac9ffe6670ae9bd97a15f7580dfa7681848e4755b3f1572712ee0bd8b97ab1eb7d

Download Submit
C:\Windows\System\lspTfxe.exe

Filesize
1.9MB

MD5
0b9d0081367a63dec6f38e4d7488c356

SHA1
60d70aaf122092790cc6bdf73073a6130495f6c9

SHA256
4970bf66d1c82522b55d8937c769cb3917a2fc5b53c00a40986c2eb50bb4ac8c

SHA512
03fe94577aa8ee516569189cddc2bcca81f085a76e1ef9fba6ce98c0d15a5cee0ecdd9b485e532c04a7f98fe2e1c219edfc0c253ca27f822374d50f67f880209

Download Submit
C:\Windows\System\okVWkpe.exe

Filesize
1.9MB

MD5
b061fa1fa9028313e066c8ebdf452a39

SHA1
738c7db15fb08d26f20780c9654c7d2af38bacb0

SHA256
a2256ee21fce87710c7dd53b74c48f49fc5252946f90935d46f659050661d97e

SHA512
2dff64f4fc2b9b2a794cb70855337a3ea58dd8de280d5803f5d9e08160412b6da5bfc817ff39a16fc5ef874d9b7c0e6d72a4dfc99c097bd1245477dd5287056a

Download Submit
C:\Windows\System\sqrmVvM.exe

Filesize
1.9MB

MD5
f11903cc6674bdc4e8a953a331f1c906

SHA1
f011da9836781590a9944427a1e6782052f2d9a1

SHA256
8a8fa94d2cb65dd9a67c63d8bea1656298976374adf01bfe6dedd044a87fc65e

SHA512
291035548b3294820f40855e990539c4770aff43851ffae2bc82ae482220f1990ae42b7b0b6d1d8306c5f7fd11cb7a8137cbdc2493ac230d3a67855f743e26da

Download Submit
C:\Windows\System\uiydrgN.exe

Filesize
1.9MB

MD5
7005ba5cba906b52e743b9da48dbae88

SHA1
884c113c91ab5b49c21b53a581486d277cbc871a

SHA256
d46c9aea5263989c416b4fa348a41d8a9ccf7b7e6673ff2806291690e1756e1c

SHA512
491bf1fdce0f646ae24153f22fe5131356f5050760e9c4a6686ac69bc79ef6ae12eb78eeb47e41820cdde98bfd0fdfe195fb836ca9d5905c6177c87f46cf1c20

Download Submit
C:\Windows\System\wHjxXqT.exe

Filesize
1.9MB

MD5
17eae97a27e8653fdbfee065f76af101

SHA1
0a89c6ceed51e6145a62121350e97d1615f18395

SHA256
fa329045fb9fe570f3ae26bc28220e1b2dc19f01d7ca4a7d99323670d88a9452

SHA512
c207e412344066d73a026d1b5be4ffd25947e24d6ae8c53d9ebc6a698b00b88422fcbb3d74e6afbf70dd6672690b81835382a4a24af9bf9b812a25305d5e9798

Download Submit
C:\Windows\System\yYFCMVA.exe

Filesize
1.9MB

MD5
bb1cd55d1f9c8ba23fc7733ce617565d

SHA1
65e74d7228200443a465ca2be76ca665d1c4bd38

SHA256
26b456dc3903c267ad059d0dcb52f4b5ddca0abcec954c6651a45572574acc22

SHA512
df8c9973ca39385f925af698793a45ae28e99fdcf0b12c4cdaed64c6464e4940fd2798791b6a691fc40c250b7ee5332d9422ed2a5abcda0e19d5c7b3d6bcc61e

Download Submit
C:\Windows\System\zerddoZ.exe

Filesize
1.9MB

MD5
36cf62d00c6284c88325045f83efadd4

SHA1
7bf41320a29db4389774c90952932c0f0f1f268d

SHA256
c261ec5aaafd5cbe7af384878144f5ce6c993449f86c5a85f7b81cb258243cb6

SHA512
15c9f404b1cac317cd01264f5b7f518163b68462adbe830250ff2dd4826c05b9b3c0913d08a6a620b772a6b3d1196b25a30f6140070eaf23244af19eb3740b1d

Download Submit
memory/1032-104-0x00007FF628FB0000-0x00007FF629304000-memory.dmp

Filesize
3.3MB

Download
memory/1032-2094-0x00007FF628FB0000-0x00007FF629304000-memory.dmp

Filesize
3.3MB

Download
memory/1324-177-0x00007FF7FA780000-0x00007FF7FAAD4000-memory.dmp

Filesize
3.3MB

Download
memory/1324-2104-0x00007FF7FA780000-0x00007FF7FAAD4000-memory.dmp

Filesize
3.3MB

Download
memory/1352-2087-0x00007FF7D1C50000-0x00007FF7D1FA4000-memory.dmp

Filesize
3.3MB

Download
memory/1352-54-0x00007FF7D1C50000-0x00007FF7D1FA4000-memory.dmp

Filesize
3.3MB

Download
memory/1352-2088-0x00007FF7D1C50000-0x00007FF7D1FA4000-memory.dmp

Filesize
3.3MB

Download
memory/1620-109-0x00007FF6BC1A0000-0x00007FF6BC4F4000-memory.dmp

Filesize
3.3MB

Download
memory/1620-2095-0x00007FF6BC1A0000-0x00007FF6BC4F4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-2108-0x00007FF7909D0000-0x00007FF790D24000-memory.dmp

Filesize
3.3MB

Download
memory/1664-178-0x00007FF7909D0000-0x00007FF790D24000-memory.dmp

Filesize
3.3MB

Download
memory/1696-175-0x00007FF65EC50000-0x00007FF65EFA4000-memory.dmp

Filesize
3.3MB

Download
memory/1696-2101-0x00007FF65EC50000-0x00007FF65EFA4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-2109-0x00007FF60F1A0000-0x00007FF60F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-179-0x00007FF60F1A0000-0x00007FF60F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/1912-65-0x00007FF7E6930000-0x00007FF7E6C84000-memory.dmp

Filesize
3.3MB

Download
memory/1912-2090-0x00007FF7E6930000-0x00007FF7E6C84000-memory.dmp

Filesize
3.3MB

Download
memory/1964-2103-0x00007FF7C96A0000-0x00007FF7C99F4000-memory.dmp

Filesize
3.3MB

Download
memory/1964-176-0x00007FF7C96A0000-0x00007FF7C99F4000-memory.dmp

Filesize
3.3MB

Download
memory/2384-2091-0x00007FF78E1B0000-0x00007FF78E504000-memory.dmp

Filesize
3.3MB

Download
memory/2384-62-0x00007FF78E1B0000-0x00007FF78E504000-memory.dmp

Filesize
3.3MB

Download
memory/2740-2083-0x00007FF6F38A0000-0x00007FF6F3BF4000-memory.dmp

Filesize
3.3MB

Download
memory/2740-35-0x00007FF6F38A0000-0x00007FF6F3BF4000-memory.dmp

Filesize
3.3MB

Download
memory/2848-2098-0x00007FF625170000-0x00007FF6254C4000-memory.dmp

Filesize
3.3MB

Download
memory/2848-106-0x00007FF625170000-0x00007FF6254C4000-memory.dmp

Filesize
3.3MB

Download
memory/2880-2093-0x00007FF6116B0000-0x00007FF611A04000-memory.dmp

Filesize
3.3MB

Download
memory/2880-103-0x00007FF6116B0000-0x00007FF611A04000-memory.dmp

Filesize
3.3MB

Download
memory/2940-20-0x00007FF7CE800000-0x00007FF7CEB54000-memory.dmp

Filesize
3.3MB

Download
memory/2964-2102-0x00007FF667A50000-0x00007FF667DA4000-memory.dmp

Filesize
3.3MB

Download
memory/2964-145-0x00007FF667A50000-0x00007FF667DA4000-memory.dmp

Filesize
3.3MB

Download
memory/3420-2096-0x00007FF7DE140000-0x00007FF7DE494000-memory.dmp

Filesize
3.3MB

Download
memory/3420-110-0x00007FF7DE140000-0x00007FF7DE494000-memory.dmp

Filesize
3.3MB

Download
memory/3424-8-0x00007FF7CC220000-0x00007FF7CC574000-memory.dmp

Filesize
3.3MB

Download
memory/3424-697-0x00007FF7CC220000-0x00007FF7CC574000-memory.dmp

Filesize
3.3MB

Download
memory/3580-105-0x00007FF6070C0000-0x00007FF607414000-memory.dmp

Filesize
3.3MB

Download
memory/3580-2099-0x00007FF6070C0000-0x00007FF607414000-memory.dmp

Filesize
3.3MB

Download
memory/3704-63-0x00007FF739010000-0x00007FF739364000-memory.dmp

Filesize
3.3MB

Download
memory/3704-2086-0x00007FF739010000-0x00007FF739364000-memory.dmp

Filesize
3.3MB

Download
memory/3720-107-0x00007FF701120000-0x00007FF701474000-memory.dmp

Filesize
3.3MB

Download
memory/3720-2100-0x00007FF701120000-0x00007FF701474000-memory.dmp

Filesize
3.3MB

Download
memory/3968-0-0x00007FF6A8510000-0x00007FF6A8864000-memory.dmp

Filesize
3.3MB

Download
memory/3968-174-0x00007FF6A8510000-0x00007FF6A8864000-memory.dmp

Filesize
3.3MB

Download
memory/3968-1-0x000001EEC21C0000-0x000001EEC21D0000-memory.dmp

Filesize
64KB

Download
memory/4004-2089-0x00007FF7F76F0000-0x00007FF7F7A44000-memory.dmp

Filesize
3.3MB

Download
memory/4004-64-0x00007FF7F76F0000-0x00007FF7F7A44000-memory.dmp

Filesize
3.3MB

Download
memory/4128-173-0x00007FF61ADD0000-0x00007FF61B124000-memory.dmp

Filesize
3.3MB

Download
memory/4128-2107-0x00007FF61ADD0000-0x00007FF61B124000-memory.dmp

Filesize
3.3MB

Download
memory/4268-2081-0x00007FF78BBA0000-0x00007FF78BEF4000-memory.dmp

Filesize
3.3MB

Download
memory/4268-26-0x00007FF78BBA0000-0x00007FF78BEF4000-memory.dmp

Filesize
3.3MB

Download
memory/4316-45-0x00007FF7AA500000-0x00007FF7AA854000-memory.dmp

Filesize
3.3MB

Download
memory/4316-2084-0x00007FF7AA500000-0x00007FF7AA854000-memory.dmp

Filesize
3.3MB

Download
memory/4404-99-0x00007FF6809B0000-0x00007FF680D04000-memory.dmp

Filesize
3.3MB

Download
memory/4404-2092-0x00007FF6809B0000-0x00007FF680D04000-memory.dmp

Filesize
3.3MB

Download
memory/4480-2097-0x00007FF640320000-0x00007FF640674000-memory.dmp

Filesize
3.3MB

Download
memory/4480-108-0x00007FF640320000-0x00007FF640674000-memory.dmp

Filesize
3.3MB

Download
memory/4700-169-0x00007FF7A6540000-0x00007FF7A6894000-memory.dmp

Filesize
3.3MB

Download
memory/4700-2106-0x00007FF7A6540000-0x00007FF7A6894000-memory.dmp

Filesize
3.3MB

Download
memory/4872-2105-0x00007FF7A3360000-0x00007FF7A36B4000-memory.dmp

Filesize
3.3MB

Download
memory/4872-156-0x00007FF7A3360000-0x00007FF7A36B4000-memory.dmp

Filesize
3.3MB

Download
memory/5108-2085-0x00007FF6AF020000-0x00007FF6AF374000-memory.dmp

Filesize
3.3MB

Download
memory/5108-38-0x00007FF6AF020000-0x00007FF6AF374000-memory.dmp

Filesize
3.3MB

Download