xmrig | 409fceb6e1f5a8261047b6b1fc5098301da6fc8dcbbfaafbcf78f729397d5caf

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
Size

2.3MB
MD5

231b1b76a5cf9df438ee7c40421f5ba0
SHA1

57669cb12bc457f6458b1a036e146a49da387add
SHA256

409fceb6e1f5a8261047b6b1fc5098301da6fc8dcbbfaafbcf78f729397d5caf
SHA512

fbc8dfd326a42211f83fdaed3bf11ed9d83bd5512febb95d734897299781e018a4ffabaa1a9b321b99190dfa2ddaa38b943da0c1367c18919b9b40d090847896
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQFHKsUKC6PeOwctWO:BemTLkNdfE0pZrQ9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4964-0-0x00007FF62BE80000-0x00007FF62C1D4000-memory.dmp	xmrig
behavioral2/files/0x000b000000023242-5.dat	xmrig
behavioral2/memory/4208-8-0x00007FF6DA940000-0x00007FF6DAC94000-memory.dmp	xmrig
behavioral2/files/0x0008000000023272-11.dat	xmrig
behavioral2/files/0x0007000000023273-10.dat	xmrig
behavioral2/files/0x0007000000023274-22.dat	xmrig
behavioral2/memory/3400-21-0x00007FF721AC0000-0x00007FF721E14000-memory.dmp	xmrig
behavioral2/memory/3280-23-0x00007FF7A5DA0000-0x00007FF7A60F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023275-28.dat	xmrig
behavioral2/files/0x0007000000023276-36.dat	xmrig
behavioral2/files/0x0007000000023277-41.dat	xmrig
behavioral2/files/0x0007000000023278-45.dat	xmrig
behavioral2/files/0x0007000000023279-51.dat	xmrig
behavioral2/files/0x000700000002327a-56.dat	xmrig
behavioral2/files/0x000700000002327b-61.dat	xmrig
behavioral2/files/0x000700000002327c-66.dat	xmrig
behavioral2/files/0x000700000002327e-76.dat	xmrig
behavioral2/files/0x0007000000023282-95.dat	xmrig
behavioral2/files/0x0007000000023286-114.dat	xmrig
behavioral2/files/0x0007000000023287-124.dat	xmrig
behavioral2/files/0x000700000002328a-135.dat	xmrig
behavioral2/files/0x000700000002328f-160.dat	xmrig
behavioral2/files/0x0007000000023290-168.dat	xmrig
behavioral2/files/0x000700000002328e-156.dat	xmrig
behavioral2/files/0x000700000002328d-151.dat	xmrig
behavioral2/files/0x000700000002328c-146.dat	xmrig
behavioral2/files/0x000700000002328b-141.dat	xmrig
behavioral2/files/0x0007000000023289-133.dat	xmrig
behavioral2/files/0x0007000000023288-129.dat	xmrig
behavioral2/memory/2592-443-0x00007FF6A0610000-0x00007FF6A0964000-memory.dmp	xmrig
behavioral2/memory/1116-456-0x00007FF6825A0000-0x00007FF6828F4000-memory.dmp	xmrig
behavioral2/memory/2200-468-0x00007FF681140000-0x00007FF681494000-memory.dmp	xmrig
behavioral2/memory/4372-488-0x00007FF77D4B0000-0x00007FF77D804000-memory.dmp	xmrig
behavioral2/memory/1616-497-0x00007FF6402F0000-0x00007FF640644000-memory.dmp	xmrig
behavioral2/memory/1808-508-0x00007FF719150000-0x00007FF7194A4000-memory.dmp	xmrig
behavioral2/memory/2656-531-0x00007FF77F450000-0x00007FF77F7A4000-memory.dmp	xmrig
behavioral2/memory/4136-540-0x00007FF66A9C0000-0x00007FF66AD14000-memory.dmp	xmrig
behavioral2/memory/3120-550-0x00007FF717FC0000-0x00007FF718314000-memory.dmp	xmrig
behavioral2/memory/1732-553-0x00007FF775860000-0x00007FF775BB4000-memory.dmp	xmrig
behavioral2/memory/1012-548-0x00007FF7613F0000-0x00007FF761744000-memory.dmp	xmrig
behavioral2/memory/3276-534-0x00007FF7FBA50000-0x00007FF7FBDA4000-memory.dmp	xmrig
behavioral2/memory/2620-530-0x00007FF758660000-0x00007FF7589B4000-memory.dmp	xmrig
behavioral2/memory/1728-523-0x00007FF691EB0000-0x00007FF692204000-memory.dmp	xmrig
behavioral2/memory/4444-520-0x00007FF7E8080000-0x00007FF7E83D4000-memory.dmp	xmrig
behavioral2/memory/216-518-0x00007FF6220D0000-0x00007FF622424000-memory.dmp	xmrig
behavioral2/memory/1296-514-0x00007FF731960000-0x00007FF731CB4000-memory.dmp	xmrig
behavioral2/memory/1652-506-0x00007FF764300000-0x00007FF764654000-memory.dmp	xmrig
behavioral2/memory/1628-501-0x00007FF69A700000-0x00007FF69AA54000-memory.dmp	xmrig
behavioral2/memory/3700-481-0x00007FF797E60000-0x00007FF7981B4000-memory.dmp	xmrig
behavioral2/memory/4892-475-0x00007FF7970F0000-0x00007FF797444000-memory.dmp	xmrig
behavioral2/memory/1768-452-0x00007FF6B0570000-0x00007FF6B08C4000-memory.dmp	xmrig
behavioral2/memory/864-446-0x00007FF7C33A0000-0x00007FF7C36F4000-memory.dmp	xmrig
behavioral2/memory/3112-439-0x00007FF6FE220000-0x00007FF6FE574000-memory.dmp	xmrig
behavioral2/files/0x0007000000023285-111.dat	xmrig
behavioral2/files/0x0007000000023284-108.dat	xmrig
behavioral2/files/0x0007000000023283-104.dat	xmrig
behavioral2/files/0x0007000000023281-93.dat	xmrig
behavioral2/files/0x0007000000023280-86.dat	xmrig
behavioral2/files/0x000700000002327f-81.dat	xmrig
behavioral2/files/0x000700000002327d-71.dat	xmrig
behavioral2/memory/3164-30-0x00007FF769480000-0x00007FF7697D4000-memory.dmp	xmrig
behavioral2/memory/724-25-0x00007FF60DE30000-0x00007FF60E184000-memory.dmp	xmrig
behavioral2/memory/4208-1991-0x00007FF6DA940000-0x00007FF6DAC94000-memory.dmp	xmrig
behavioral2/memory/3400-1992-0x00007FF721AC0000-0x00007FF721E14000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4208	AgAArKq.exe
3400	yUVdpDz.exe
724	KHbnHcw.exe
3280	ruAVUEE.exe
3164	xrXkqWf.exe
3112	HnCFfQo.exe
2592	bVMLiMu.exe
864	MbYpxLM.exe
1768	ZpDcZcF.exe
1116	wdfcVux.exe
2200	sYZnVtp.exe
4892	HPxVbWy.exe
3700	pYodYZO.exe
4372	ovzcVFq.exe
1616	yYIxVKJ.exe
1628	OMwXQYy.exe
1652	bKxWKFq.exe
1808	BsIIeWD.exe
1296	JpZBFde.exe
216	BrUgIKG.exe
4444	XfQiKiH.exe
1728	fXxeKxX.exe
2620	RevBSMK.exe
2656	eObvJaj.exe
3276	HCOJLMz.exe
4136	aqsgvwW.exe
1012	jAfYaPP.exe
3120	TsAnaXh.exe
1732	yLAJCUh.exe
824	pWUPRgs.exe
2972	EnCJckl.exe
912	cpbIDdF.exe
324	nSLlJqo.exe
4524	VeKZjZs.exe
2492	ckFFJHf.exe
4360	oYgSGuC.exe
4272	QgWAbax.exe
4296	wcnbkjV.exe
3656	JgektCC.exe
4544	zdFwQWG.exe
1780	nfnIajG.exe
2128	tKvndUM.exe
448	olXnkNn.exe
2132	GAFgfUB.exe
2992	LTpqGBc.exe
956	JWXUCqw.exe
1924	OIGAFlt.exe
4016	tnixpWp.exe
1332	dEzDLnE.exe
5068	ngKVkGr.exe
4424	LVFBnnx.exe
3020	utgvKsy.exe
3452	erqXMgF.exe
4396	yLIEuqq.exe
2028	hACDLVB.exe
4692	AfFHLYQ.exe
4980	UCCopNw.exe
4800	PIKjDzE.exe
4700	DlrwJUB.exe
3204	FXKxDaZ.exe
3960	SdCwMCC.exe
2924	wyZEkht.exe
3900	LyvLDym.exe
5124	gDsPRsR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4964-0-0x00007FF62BE80000-0x00007FF62C1D4000-memory.dmp	upx
behavioral2/files/0x000b000000023242-5.dat	upx
behavioral2/memory/4208-8-0x00007FF6DA940000-0x00007FF6DAC94000-memory.dmp	upx
behavioral2/files/0x0008000000023272-11.dat	upx
behavioral2/files/0x0007000000023273-10.dat	upx
behavioral2/files/0x0007000000023274-22.dat	upx
behavioral2/memory/3400-21-0x00007FF721AC0000-0x00007FF721E14000-memory.dmp	upx
behavioral2/memory/3280-23-0x00007FF7A5DA0000-0x00007FF7A60F4000-memory.dmp	upx
behavioral2/files/0x0007000000023275-28.dat	upx
behavioral2/files/0x0007000000023276-36.dat	upx
behavioral2/files/0x0007000000023277-41.dat	upx
behavioral2/files/0x0007000000023278-45.dat	upx
behavioral2/files/0x0007000000023279-51.dat	upx
behavioral2/files/0x000700000002327a-56.dat	upx
behavioral2/files/0x000700000002327b-61.dat	upx
behavioral2/files/0x000700000002327c-66.dat	upx
behavioral2/files/0x000700000002327e-76.dat	upx
behavioral2/files/0x0007000000023282-95.dat	upx
behavioral2/files/0x0007000000023286-114.dat	upx
behavioral2/files/0x0007000000023287-124.dat	upx
behavioral2/files/0x000700000002328a-135.dat	upx
behavioral2/files/0x000700000002328f-160.dat	upx
behavioral2/files/0x0007000000023290-168.dat	upx
behavioral2/files/0x000700000002328e-156.dat	upx
behavioral2/files/0x000700000002328d-151.dat	upx
behavioral2/files/0x000700000002328c-146.dat	upx
behavioral2/files/0x000700000002328b-141.dat	upx
behavioral2/files/0x0007000000023289-133.dat	upx
behavioral2/files/0x0007000000023288-129.dat	upx
behavioral2/memory/2592-443-0x00007FF6A0610000-0x00007FF6A0964000-memory.dmp	upx
behavioral2/memory/1116-456-0x00007FF6825A0000-0x00007FF6828F4000-memory.dmp	upx
behavioral2/memory/2200-468-0x00007FF681140000-0x00007FF681494000-memory.dmp	upx
behavioral2/memory/4372-488-0x00007FF77D4B0000-0x00007FF77D804000-memory.dmp	upx
behavioral2/memory/1616-497-0x00007FF6402F0000-0x00007FF640644000-memory.dmp	upx
behavioral2/memory/1808-508-0x00007FF719150000-0x00007FF7194A4000-memory.dmp	upx
behavioral2/memory/2656-531-0x00007FF77F450000-0x00007FF77F7A4000-memory.dmp	upx
behavioral2/memory/4136-540-0x00007FF66A9C0000-0x00007FF66AD14000-memory.dmp	upx
behavioral2/memory/3120-550-0x00007FF717FC0000-0x00007FF718314000-memory.dmp	upx
behavioral2/memory/1732-553-0x00007FF775860000-0x00007FF775BB4000-memory.dmp	upx
behavioral2/memory/1012-548-0x00007FF7613F0000-0x00007FF761744000-memory.dmp	upx
behavioral2/memory/3276-534-0x00007FF7FBA50000-0x00007FF7FBDA4000-memory.dmp	upx
behavioral2/memory/2620-530-0x00007FF758660000-0x00007FF7589B4000-memory.dmp	upx
behavioral2/memory/1728-523-0x00007FF691EB0000-0x00007FF692204000-memory.dmp	upx
behavioral2/memory/4444-520-0x00007FF7E8080000-0x00007FF7E83D4000-memory.dmp	upx
behavioral2/memory/216-518-0x00007FF6220D0000-0x00007FF622424000-memory.dmp	upx
behavioral2/memory/1296-514-0x00007FF731960000-0x00007FF731CB4000-memory.dmp	upx
behavioral2/memory/1652-506-0x00007FF764300000-0x00007FF764654000-memory.dmp	upx
behavioral2/memory/1628-501-0x00007FF69A700000-0x00007FF69AA54000-memory.dmp	upx
behavioral2/memory/3700-481-0x00007FF797E60000-0x00007FF7981B4000-memory.dmp	upx
behavioral2/memory/4892-475-0x00007FF7970F0000-0x00007FF797444000-memory.dmp	upx
behavioral2/memory/1768-452-0x00007FF6B0570000-0x00007FF6B08C4000-memory.dmp	upx
behavioral2/memory/864-446-0x00007FF7C33A0000-0x00007FF7C36F4000-memory.dmp	upx
behavioral2/memory/3112-439-0x00007FF6FE220000-0x00007FF6FE574000-memory.dmp	upx
behavioral2/files/0x0007000000023285-111.dat	upx
behavioral2/files/0x0007000000023284-108.dat	upx
behavioral2/files/0x0007000000023283-104.dat	upx
behavioral2/files/0x0007000000023281-93.dat	upx
behavioral2/files/0x0007000000023280-86.dat	upx
behavioral2/files/0x000700000002327f-81.dat	upx
behavioral2/files/0x000700000002327d-71.dat	upx
behavioral2/memory/3164-30-0x00007FF769480000-0x00007FF7697D4000-memory.dmp	upx
behavioral2/memory/724-25-0x00007FF60DE30000-0x00007FF60E184000-memory.dmp	upx
behavioral2/memory/4208-1991-0x00007FF6DA940000-0x00007FF6DAC94000-memory.dmp	upx
behavioral2/memory/3400-1992-0x00007FF721AC0000-0x00007FF721E14000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aNuLemW.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\GdKDuED.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\WHqBlGk.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\Sroktqo.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\LVFBnnx.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\uHPRQrz.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\JcRjDnQ.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\SWGcAph.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\WkpkyTz.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\uILPhJl.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\Rosoaro.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\jdcIMtO.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\sphnzcC.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\qINmWnw.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\bsUdwgk.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\yDIitWQ.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\yeYreEo.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\dAxLCDZ.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\DuwCdjy.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\TyefAqw.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\sJKotBq.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\SGDmbyw.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\OMmnEcO.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\IqewXqa.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\UGCDNXh.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\RJsKWQt.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\yTsiKFc.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\PqcOhEv.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\hACDLVB.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\WZtjlRR.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\zkWZWAD.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\jodsazt.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\byWSJVt.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\vcSTYiF.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\emmuCwL.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\KbZzXcb.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\zBYtTvm.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\dgFGgYb.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\MCguzRr.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\TGkAQsh.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\hsKPadw.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\JzBlLUU.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\VGdTcPR.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\jMWRYIM.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\IFSSGzH.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\yUVdpDz.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\sIWgTTu.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\MlEJFVl.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\KUMdKhb.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\gDsPRsR.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\zHHNOmC.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\MZQIJZp.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\mHwvFbF.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\qehnCWg.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\LTpqGBc.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\QAByKPl.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\wTXVqaW.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\DQwdlzV.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\pUrARHv.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\TvvDaxM.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\xnOciel.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\JvHRRNw.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\GyEDOiW.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
File created	C:\Windows\System\tSGtisM.exe	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4208	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	90
PID 4964 wrote to memory of 4208	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	90
PID 4964 wrote to memory of 3400	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	91
PID 4964 wrote to memory of 3400	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	91
PID 4964 wrote to memory of 724	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	92
PID 4964 wrote to memory of 724	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	92
PID 4964 wrote to memory of 3280	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	93
PID 4964 wrote to memory of 3280	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	93
PID 4964 wrote to memory of 3164	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	94
PID 4964 wrote to memory of 3164	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	94
PID 4964 wrote to memory of 3112	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	95
PID 4964 wrote to memory of 3112	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	95
PID 4964 wrote to memory of 2592	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	96
PID 4964 wrote to memory of 2592	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	96
PID 4964 wrote to memory of 864	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	97
PID 4964 wrote to memory of 864	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	97
PID 4964 wrote to memory of 1768	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	98
PID 4964 wrote to memory of 1768	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	98
PID 4964 wrote to memory of 1116	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	99
PID 4964 wrote to memory of 1116	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	99
PID 4964 wrote to memory of 2200	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	100
PID 4964 wrote to memory of 2200	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	100
PID 4964 wrote to memory of 4892	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	101
PID 4964 wrote to memory of 4892	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	101
PID 4964 wrote to memory of 3700	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	102
PID 4964 wrote to memory of 3700	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	102
PID 4964 wrote to memory of 4372	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	103
PID 4964 wrote to memory of 4372	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	103
PID 4964 wrote to memory of 1616	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	104
PID 4964 wrote to memory of 1616	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	104
PID 4964 wrote to memory of 1628	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	105
PID 4964 wrote to memory of 1628	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	105
PID 4964 wrote to memory of 1652	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	106
PID 4964 wrote to memory of 1652	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	106
PID 4964 wrote to memory of 1808	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	107
PID 4964 wrote to memory of 1808	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	107
PID 4964 wrote to memory of 1296	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	108
PID 4964 wrote to memory of 1296	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	108
PID 4964 wrote to memory of 216	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	109
PID 4964 wrote to memory of 216	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	109
PID 4964 wrote to memory of 4444	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	110
PID 4964 wrote to memory of 4444	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	110
PID 4964 wrote to memory of 1728	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	111
PID 4964 wrote to memory of 1728	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	111
PID 4964 wrote to memory of 2620	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	112
PID 4964 wrote to memory of 2620	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	112
PID 4964 wrote to memory of 2656	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	113
PID 4964 wrote to memory of 2656	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	113
PID 4964 wrote to memory of 3276	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	114
PID 4964 wrote to memory of 3276	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	114
PID 4964 wrote to memory of 4136	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	115
PID 4964 wrote to memory of 4136	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	115
PID 4964 wrote to memory of 1012	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	116
PID 4964 wrote to memory of 1012	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	116
PID 4964 wrote to memory of 3120	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	117
PID 4964 wrote to memory of 3120	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	117
PID 4964 wrote to memory of 1732	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	118
PID 4964 wrote to memory of 1732	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	118
PID 4964 wrote to memory of 824	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	119
PID 4964 wrote to memory of 824	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	119
PID 4964 wrote to memory of 2972	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	120
PID 4964 wrote to memory of 2972	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	120
PID 4964 wrote to memory of 912	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	121
PID 4964 wrote to memory of 912	4964	231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe	121

C:\Users\Admin\AppData\Local\Temp\231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231b1b76a5cf9df438ee7c40421f5ba0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\System\AgAArKq.exe
  C:\Windows\System\AgAArKq.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\yUVdpDz.exe
  C:\Windows\System\yUVdpDz.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\KHbnHcw.exe
  C:\Windows\System\KHbnHcw.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\ruAVUEE.exe
  C:\Windows\System\ruAVUEE.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\xrXkqWf.exe
  C:\Windows\System\xrXkqWf.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\HnCFfQo.exe
  C:\Windows\System\HnCFfQo.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\bVMLiMu.exe
  C:\Windows\System\bVMLiMu.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\MbYpxLM.exe
  C:\Windows\System\MbYpxLM.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\ZpDcZcF.exe
  C:\Windows\System\ZpDcZcF.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\wdfcVux.exe
  C:\Windows\System\wdfcVux.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\sYZnVtp.exe
  C:\Windows\System\sYZnVtp.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\HPxVbWy.exe
  C:\Windows\System\HPxVbWy.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\pYodYZO.exe
  C:\Windows\System\pYodYZO.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\ovzcVFq.exe
  C:\Windows\System\ovzcVFq.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\yYIxVKJ.exe
  C:\Windows\System\yYIxVKJ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\OMwXQYy.exe
  C:\Windows\System\OMwXQYy.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\bKxWKFq.exe
  C:\Windows\System\bKxWKFq.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\BsIIeWD.exe
  C:\Windows\System\BsIIeWD.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\JpZBFde.exe
  C:\Windows\System\JpZBFde.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\BrUgIKG.exe
  C:\Windows\System\BrUgIKG.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\XfQiKiH.exe
  C:\Windows\System\XfQiKiH.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\fXxeKxX.exe
  C:\Windows\System\fXxeKxX.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\RevBSMK.exe
  C:\Windows\System\RevBSMK.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\eObvJaj.exe
  C:\Windows\System\eObvJaj.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\HCOJLMz.exe
  C:\Windows\System\HCOJLMz.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\aqsgvwW.exe
  C:\Windows\System\aqsgvwW.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\jAfYaPP.exe
  C:\Windows\System\jAfYaPP.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\TsAnaXh.exe
  C:\Windows\System\TsAnaXh.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\yLAJCUh.exe
  C:\Windows\System\yLAJCUh.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\pWUPRgs.exe
  C:\Windows\System\pWUPRgs.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\EnCJckl.exe
  C:\Windows\System\EnCJckl.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\cpbIDdF.exe
  C:\Windows\System\cpbIDdF.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\nSLlJqo.exe
  C:\Windows\System\nSLlJqo.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\VeKZjZs.exe
  C:\Windows\System\VeKZjZs.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\ckFFJHf.exe
  C:\Windows\System\ckFFJHf.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\oYgSGuC.exe
  C:\Windows\System\oYgSGuC.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\QgWAbax.exe
  C:\Windows\System\QgWAbax.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\wcnbkjV.exe
  C:\Windows\System\wcnbkjV.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\JgektCC.exe
  C:\Windows\System\JgektCC.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\zdFwQWG.exe
  C:\Windows\System\zdFwQWG.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\nfnIajG.exe
  C:\Windows\System\nfnIajG.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\tKvndUM.exe
  C:\Windows\System\tKvndUM.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\olXnkNn.exe
  C:\Windows\System\olXnkNn.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\GAFgfUB.exe
  C:\Windows\System\GAFgfUB.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\LTpqGBc.exe
  C:\Windows\System\LTpqGBc.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\JWXUCqw.exe
  C:\Windows\System\JWXUCqw.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\OIGAFlt.exe
  C:\Windows\System\OIGAFlt.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\tnixpWp.exe
  C:\Windows\System\tnixpWp.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\dEzDLnE.exe
  C:\Windows\System\dEzDLnE.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\ngKVkGr.exe
  C:\Windows\System\ngKVkGr.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\LVFBnnx.exe
  C:\Windows\System\LVFBnnx.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\utgvKsy.exe
  C:\Windows\System\utgvKsy.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\erqXMgF.exe
  C:\Windows\System\erqXMgF.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\yLIEuqq.exe
  C:\Windows\System\yLIEuqq.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\hACDLVB.exe
  C:\Windows\System\hACDLVB.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\AfFHLYQ.exe
  C:\Windows\System\AfFHLYQ.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\UCCopNw.exe
  C:\Windows\System\UCCopNw.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\PIKjDzE.exe
  C:\Windows\System\PIKjDzE.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\DlrwJUB.exe
  C:\Windows\System\DlrwJUB.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\FXKxDaZ.exe
  C:\Windows\System\FXKxDaZ.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\SdCwMCC.exe
  C:\Windows\System\SdCwMCC.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\wyZEkht.exe
  C:\Windows\System\wyZEkht.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\LyvLDym.exe
  C:\Windows\System\LyvLDym.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\gDsPRsR.exe
  C:\Windows\System\gDsPRsR.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\tEsDPlA.exe
  C:\Windows\System\tEsDPlA.exe
  2⤵
  PID:5156
- C:\Windows\System\DtasyrU.exe
  C:\Windows\System\DtasyrU.exe
  2⤵
  PID:5180
- C:\Windows\System\FDeKIbC.exe
  C:\Windows\System\FDeKIbC.exe
  2⤵
  PID:5208
- C:\Windows\System\sZCVIir.exe
  C:\Windows\System\sZCVIir.exe
  2⤵
  PID:5236
- C:\Windows\System\FOnXDyN.exe
  C:\Windows\System\FOnXDyN.exe
  2⤵
  PID:5312
- C:\Windows\System\bAWFJIV.exe
  C:\Windows\System\bAWFJIV.exe
  2⤵
  PID:5328
- C:\Windows\System\ygSaKhq.exe
  C:\Windows\System\ygSaKhq.exe
  2⤵
  PID:5344
- C:\Windows\System\IoCtFop.exe
  C:\Windows\System\IoCtFop.exe
  2⤵
  PID:5360
- C:\Windows\System\BSfysKG.exe
  C:\Windows\System\BSfysKG.exe
  2⤵
  PID:5384
- C:\Windows\System\rpnXmUr.exe
  C:\Windows\System\rpnXmUr.exe
  2⤵
  PID:5412
- C:\Windows\System\TuMaWSM.exe
  C:\Windows\System\TuMaWSM.exe
  2⤵
  PID:5440
- C:\Windows\System\jodsazt.exe
  C:\Windows\System\jodsazt.exe
  2⤵
  PID:5468
- C:\Windows\System\AhwvJKC.exe
  C:\Windows\System\AhwvJKC.exe
  2⤵
  PID:5496
- C:\Windows\System\OiSGMjJ.exe
  C:\Windows\System\OiSGMjJ.exe
  2⤵
  PID:5524
- C:\Windows\System\yhcqeUS.exe
  C:\Windows\System\yhcqeUS.exe
  2⤵
  PID:5552
- C:\Windows\System\kphJedk.exe
  C:\Windows\System\kphJedk.exe
  2⤵
  PID:5580
- C:\Windows\System\gnlUbyb.exe
  C:\Windows\System\gnlUbyb.exe
  2⤵
  PID:5608
- C:\Windows\System\eQVsIol.exe
  C:\Windows\System\eQVsIol.exe
  2⤵
  PID:5636
- C:\Windows\System\jOOIMHm.exe
  C:\Windows\System\jOOIMHm.exe
  2⤵
  PID:5664
- C:\Windows\System\zobhhxS.exe
  C:\Windows\System\zobhhxS.exe
  2⤵
  PID:5704
- C:\Windows\System\hBnlUno.exe
  C:\Windows\System\hBnlUno.exe
  2⤵
  PID:5728
- C:\Windows\System\bsUdwgk.exe
  C:\Windows\System\bsUdwgk.exe
  2⤵
  PID:5752
- C:\Windows\System\VSFIfEP.exe
  C:\Windows\System\VSFIfEP.exe
  2⤵
  PID:5776
- C:\Windows\System\WZtjlRR.exe
  C:\Windows\System\WZtjlRR.exe
  2⤵
  PID:5804
- C:\Windows\System\UQjXoyg.exe
  C:\Windows\System\UQjXoyg.exe
  2⤵
  PID:5832
- C:\Windows\System\bqlRdJt.exe
  C:\Windows\System\bqlRdJt.exe
  2⤵
  PID:5860
- C:\Windows\System\kiblZev.exe
  C:\Windows\System\kiblZev.exe
  2⤵
  PID:5888
- C:\Windows\System\gjYajTg.exe
  C:\Windows\System\gjYajTg.exe
  2⤵
  PID:5916
- C:\Windows\System\UDMQkGw.exe
  C:\Windows\System\UDMQkGw.exe
  2⤵
  PID:5952
- C:\Windows\System\ErrZyuM.exe
  C:\Windows\System\ErrZyuM.exe
  2⤵
  PID:5984
- C:\Windows\System\swNMxdJ.exe
  C:\Windows\System\swNMxdJ.exe
  2⤵
  PID:6004
- C:\Windows\System\yxjxBLO.exe
  C:\Windows\System\yxjxBLO.exe
  2⤵
  PID:6032
- C:\Windows\System\iOobItz.exe
  C:\Windows\System\iOobItz.exe
  2⤵
  PID:6056
- C:\Windows\System\crpcgJn.exe
  C:\Windows\System\crpcgJn.exe
  2⤵
  PID:6084
- C:\Windows\System\WkpkyTz.exe
  C:\Windows\System\WkpkyTz.exe
  2⤵
  PID:6112
- C:\Windows\System\eluSkgq.exe
  C:\Windows\System\eluSkgq.exe
  2⤵
  PID:6140
- C:\Windows\System\kByRaBX.exe
  C:\Windows\System\kByRaBX.exe
  2⤵
  PID:3496
- C:\Windows\System\xHTWwTo.exe
  C:\Windows\System\xHTWwTo.exe
  2⤵
  PID:2644
- C:\Windows\System\oDahCoN.exe
  C:\Windows\System\oDahCoN.exe
  2⤵
  PID:3180
- C:\Windows\System\SKdwfAq.exe
  C:\Windows\System\SKdwfAq.exe
  2⤵
  PID:5176
- C:\Windows\System\nNmLPvK.exe
  C:\Windows\System\nNmLPvK.exe
  2⤵
  PID:5252
- C:\Windows\System\GwaIbJL.exe
  C:\Windows\System\GwaIbJL.exe
  2⤵
  PID:892
- C:\Windows\System\kVyorBw.exe
  C:\Windows\System\kVyorBw.exe
  2⤵
  PID:5372
- C:\Windows\System\uHPRQrz.exe
  C:\Windows\System\uHPRQrz.exe
  2⤵
  PID:3288
- C:\Windows\System\sIWgTTu.exe
  C:\Windows\System\sIWgTTu.exe
  2⤵
  PID:5488
- C:\Windows\System\GyEDOiW.exe
  C:\Windows\System\GyEDOiW.exe
  2⤵
  PID:5568
- C:\Windows\System\rDODtGz.exe
  C:\Windows\System\rDODtGz.exe
  2⤵
  PID:5632
- C:\Windows\System\cKrpRGj.exe
  C:\Windows\System\cKrpRGj.exe
  2⤵
  PID:5692
- C:\Windows\System\MQvMXNb.exe
  C:\Windows\System\MQvMXNb.exe
  2⤵
  PID:5748
- C:\Windows\System\fHpYWkX.exe
  C:\Windows\System\fHpYWkX.exe
  2⤵
  PID:5796
- C:\Windows\System\vuHwvmz.exe
  C:\Windows\System\vuHwvmz.exe
  2⤵
  PID:5852
- C:\Windows\System\uwjPmaP.exe
  C:\Windows\System\uwjPmaP.exe
  2⤵
  PID:5908
- C:\Windows\System\ZdkkInv.exe
  C:\Windows\System\ZdkkInv.exe
  2⤵
  PID:5976
- C:\Windows\System\MSTWnFY.exe
  C:\Windows\System\MSTWnFY.exe
  2⤵
  PID:6072
- C:\Windows\System\tZazNTd.exe
  C:\Windows\System\tZazNTd.exe
  2⤵
  PID:6128
- C:\Windows\System\TKYXLHM.exe
  C:\Windows\System\TKYXLHM.exe
  2⤵
  PID:740
- C:\Windows\System\pQZrWAB.exe
  C:\Windows\System\pQZrWAB.exe
  2⤵
  PID:1900
- C:\Windows\System\BSKaHuM.exe
  C:\Windows\System\BSKaHuM.exe
  2⤵
  PID:5168
- C:\Windows\System\VdyLaWW.exe
  C:\Windows\System\VdyLaWW.exe
  2⤵
  PID:5300
- C:\Windows\System\HvpFAAb.exe
  C:\Windows\System\HvpFAAb.exe
  2⤵
  PID:5404
- C:\Windows\System\oVGHWQc.exe
  C:\Windows\System\oVGHWQc.exe
  2⤵
  PID:5516
- C:\Windows\System\WDCHugU.exe
  C:\Windows\System\WDCHugU.exe
  2⤵
  PID:5624
- C:\Windows\System\suSKHSc.exe
  C:\Windows\System\suSKHSc.exe
  2⤵
  PID:5724
- C:\Windows\System\KjDGQMC.exe
  C:\Windows\System\KjDGQMC.exe
  2⤵
  PID:5792
- C:\Windows\System\eadlNPp.exe
  C:\Windows\System\eadlNPp.exe
  2⤵
  PID:5828
- C:\Windows\System\JafTHMq.exe
  C:\Windows\System\JafTHMq.exe
  2⤵
  PID:4156
- C:\Windows\System\GuUuMrM.exe
  C:\Windows\System\GuUuMrM.exe
  2⤵
  PID:5948
- C:\Windows\System\kkNMYss.exe
  C:\Windows\System\kkNMYss.exe
  2⤵
  PID:4316
- C:\Windows\System\NkqTIHE.exe
  C:\Windows\System\NkqTIHE.exe
  2⤵
  PID:6052
- C:\Windows\System\uNaEPLV.exe
  C:\Windows\System\uNaEPLV.exe
  2⤵
  PID:4476
- C:\Windows\System\pUIgkFF.exe
  C:\Windows\System\pUIgkFF.exe
  2⤵
  PID:4420
- C:\Windows\System\loQMwTn.exe
  C:\Windows\System\loQMwTn.exe
  2⤵
  PID:4828
- C:\Windows\System\lwlzlzh.exe
  C:\Windows\System\lwlzlzh.exe
  2⤵
  PID:4564
- C:\Windows\System\RhiKSsq.exe
  C:\Windows\System\RhiKSsq.exe
  2⤵
  PID:672
- C:\Windows\System\sMFBfkZ.exe
  C:\Windows\System\sMFBfkZ.exe
  2⤵
  PID:2556
- C:\Windows\System\bXKaHTi.exe
  C:\Windows\System\bXKaHTi.exe
  2⤵
  PID:1008
- C:\Windows\System\ARywKcC.exe
  C:\Windows\System\ARywKcC.exe
  2⤵
  PID:4488
- C:\Windows\System\rjiOVcv.exe
  C:\Windows\System\rjiOVcv.exe
  2⤵
  PID:2240
- C:\Windows\System\KjZUpNh.exe
  C:\Windows\System\KjZUpNh.exe
  2⤵
  PID:2436
- C:\Windows\System\AiYeAIa.exe
  C:\Windows\System\AiYeAIa.exe
  2⤵
  PID:3976
- C:\Windows\System\JhhktDY.exe
  C:\Windows\System\JhhktDY.exe
  2⤵
  PID:6148
- C:\Windows\System\NrNDGOe.exe
  C:\Windows\System\NrNDGOe.exe
  2⤵
  PID:6172
- C:\Windows\System\mdhejKS.exe
  C:\Windows\System\mdhejKS.exe
  2⤵
  PID:6196
- C:\Windows\System\NWnRgTV.exe
  C:\Windows\System\NWnRgTV.exe
  2⤵
  PID:6240
- C:\Windows\System\thtMJkW.exe
  C:\Windows\System\thtMJkW.exe
  2⤵
  PID:6268
- C:\Windows\System\SGDmbyw.exe
  C:\Windows\System\SGDmbyw.exe
  2⤵
  PID:6300
- C:\Windows\System\RAvxqgS.exe
  C:\Windows\System\RAvxqgS.exe
  2⤵
  PID:6328
- C:\Windows\System\gAuoFtX.exe
  C:\Windows\System\gAuoFtX.exe
  2⤵
  PID:6356
- C:\Windows\System\kbsHrLk.exe
  C:\Windows\System\kbsHrLk.exe
  2⤵
  PID:6396
- C:\Windows\System\eWwuLzw.exe
  C:\Windows\System\eWwuLzw.exe
  2⤵
  PID:6420
- C:\Windows\System\CTxOgSh.exe
  C:\Windows\System\CTxOgSh.exe
  2⤵
  PID:6464
- C:\Windows\System\NTZfOvy.exe
  C:\Windows\System\NTZfOvy.exe
  2⤵
  PID:6572
- C:\Windows\System\FySjmtB.exe
  C:\Windows\System\FySjmtB.exe
  2⤵
  PID:6592
- C:\Windows\System\OhrZELu.exe
  C:\Windows\System\OhrZELu.exe
  2⤵
  PID:6620
- C:\Windows\System\jfNNIJQ.exe
  C:\Windows\System\jfNNIJQ.exe
  2⤵
  PID:6648
- C:\Windows\System\xjFyTZz.exe
  C:\Windows\System\xjFyTZz.exe
  2⤵
  PID:6676
- C:\Windows\System\JeNUZSR.exe
  C:\Windows\System\JeNUZSR.exe
  2⤵
  PID:6704
- C:\Windows\System\NHbmhXX.exe
  C:\Windows\System\NHbmhXX.exe
  2⤵
  PID:6732
- C:\Windows\System\lKckyLT.exe
  C:\Windows\System\lKckyLT.exe
  2⤵
  PID:6760
- C:\Windows\System\AnFMEBU.exe
  C:\Windows\System\AnFMEBU.exe
  2⤵
  PID:6788
- C:\Windows\System\BNgnpJi.exe
  C:\Windows\System\BNgnpJi.exe
  2⤵
  PID:6816
- C:\Windows\System\mXcXaWp.exe
  C:\Windows\System\mXcXaWp.exe
  2⤵
  PID:6832
- C:\Windows\System\LoPQYOz.exe
  C:\Windows\System\LoPQYOz.exe
  2⤵
  PID:6860
- C:\Windows\System\GdDnObC.exe
  C:\Windows\System\GdDnObC.exe
  2⤵
  PID:6908
- C:\Windows\System\WHqBlGk.exe
  C:\Windows\System\WHqBlGk.exe
  2⤵
  PID:6936
- C:\Windows\System\gNJeFfh.exe
  C:\Windows\System\gNJeFfh.exe
  2⤵
  PID:6964
- C:\Windows\System\SQPFWiY.exe
  C:\Windows\System\SQPFWiY.exe
  2⤵
  PID:6992
- C:\Windows\System\GCebGEo.exe
  C:\Windows\System\GCebGEo.exe
  2⤵
  PID:7020
- C:\Windows\System\HTFBUah.exe
  C:\Windows\System\HTFBUah.exe
  2⤵
  PID:7048
- C:\Windows\System\zMyIcpv.exe
  C:\Windows\System\zMyIcpv.exe
  2⤵
  PID:7076
- C:\Windows\System\hwzhGLg.exe
  C:\Windows\System\hwzhGLg.exe
  2⤵
  PID:7104
- C:\Windows\System\ssNkYTB.exe
  C:\Windows\System\ssNkYTB.exe
  2⤵
  PID:7136
- C:\Windows\System\uILPhJl.exe
  C:\Windows\System\uILPhJl.exe
  2⤵
  PID:7164
- C:\Windows\System\QueQfzX.exe
  C:\Windows\System\QueQfzX.exe
  2⤵
  PID:6184
- C:\Windows\System\ZRAKVtO.exe
  C:\Windows\System\ZRAKVtO.exe
  2⤵
  PID:6168
- C:\Windows\System\doICIYc.exe
  C:\Windows\System\doICIYc.exe
  2⤵
  PID:6288
- C:\Windows\System\KHFlizF.exe
  C:\Windows\System\KHFlizF.exe
  2⤵
  PID:6372
- C:\Windows\System\JzDCBiJ.exe
  C:\Windows\System\JzDCBiJ.exe
  2⤵
  PID:6440
- C:\Windows\System\ljnhQUr.exe
  C:\Windows\System\ljnhQUr.exe
  2⤵
  PID:552
- C:\Windows\System\TQnoPng.exe
  C:\Windows\System\TQnoPng.exe
  2⤵
  PID:1472
- C:\Windows\System\NYFYSDQ.exe
  C:\Windows\System\NYFYSDQ.exe
  2⤵
  PID:3592
- C:\Windows\System\JmZROTg.exe
  C:\Windows\System\JmZROTg.exe
  2⤵
  PID:3316
- C:\Windows\System\AMMKCUU.exe
  C:\Windows\System\AMMKCUU.exe
  2⤵
  PID:6616
- C:\Windows\System\QsAnstl.exe
  C:\Windows\System\QsAnstl.exe
  2⤵
  PID:6228
- C:\Windows\System\HnFqUwz.exe
  C:\Windows\System\HnFqUwz.exe
  2⤵
  PID:6688
- C:\Windows\System\TZhItjG.exe
  C:\Windows\System\TZhItjG.exe
  2⤵
  PID:6748
- C:\Windows\System\dzOOhxI.exe
  C:\Windows\System\dzOOhxI.exe
  2⤵
  PID:6780
- C:\Windows\System\qzINICT.exe
  C:\Windows\System\qzINICT.exe
  2⤵
  PID:6824
- C:\Windows\System\vxrUZwo.exe
  C:\Windows\System\vxrUZwo.exe
  2⤵
  PID:6876
- C:\Windows\System\FlRaLHs.exe
  C:\Windows\System\FlRaLHs.exe
  2⤵
  PID:6956
- C:\Windows\System\cQEiwwO.exe
  C:\Windows\System\cQEiwwO.exe
  2⤵
  PID:7012
- C:\Windows\System\XtstPQo.exe
  C:\Windows\System\XtstPQo.exe
  2⤵
  PID:5224
- C:\Windows\System\bOUuZpr.exe
  C:\Windows\System\bOUuZpr.exe
  2⤵
  PID:7072
- C:\Windows\System\FwTwMaw.exe
  C:\Windows\System\FwTwMaw.exe
  2⤵
  PID:7132
- C:\Windows\System\PqDsrwb.exe
  C:\Windows\System\PqDsrwb.exe
  2⤵
  PID:6160
- C:\Windows\System\QfsoKee.exe
  C:\Windows\System\QfsoKee.exe
  2⤵
  PID:6348
- C:\Windows\System\EazVArv.exe
  C:\Windows\System\EazVArv.exe
  2⤵
  PID:6492
- C:\Windows\System\EXvWdkR.exe
  C:\Windows\System\EXvWdkR.exe
  2⤵
  PID:5768
- C:\Windows\System\TcWhHna.exe
  C:\Windows\System\TcWhHna.exe
  2⤵
  PID:6644
- C:\Windows\System\zHHNOmC.exe
  C:\Windows\System\zHHNOmC.exe
  2⤵
  PID:6752
- C:\Windows\System\OUXLWjj.exe
  C:\Windows\System\OUXLWjj.exe
  2⤵
  PID:6880
- C:\Windows\System\zFixPsv.exe
  C:\Windows\System\zFixPsv.exe
  2⤵
  PID:1644
- C:\Windows\System\lyuFVNX.exe
  C:\Windows\System\lyuFVNX.exe
  2⤵
  PID:7116
- C:\Windows\System\tSqzJDh.exe
  C:\Windows\System\tSqzJDh.exe
  2⤵
  PID:6284
- C:\Windows\System\tFyuhfO.exe
  C:\Windows\System\tFyuhfO.exe
  2⤵
  PID:6568
- C:\Windows\System\ZdTwDet.exe
  C:\Windows\System\ZdTwDet.exe
  2⤵
  PID:6812
- C:\Windows\System\ukjNuLz.exe
  C:\Windows\System\ukjNuLz.exe
  2⤵
  PID:1880
- C:\Windows\System\vtwqtJD.exe
  C:\Windows\System\vtwqtJD.exe
  2⤵
  PID:3060
- C:\Windows\System\rUxTFDh.exe
  C:\Windows\System\rUxTFDh.exe
  2⤵
  PID:6484
- C:\Windows\System\lVLFMzH.exe
  C:\Windows\System\lVLFMzH.exe
  2⤵
  PID:7180
- C:\Windows\System\hiqoPfo.exe
  C:\Windows\System\hiqoPfo.exe
  2⤵
  PID:7204
- C:\Windows\System\jOGkoyx.exe
  C:\Windows\System\jOGkoyx.exe
  2⤵
  PID:7220
- C:\Windows\System\EPalHju.exe
  C:\Windows\System\EPalHju.exe
  2⤵
  PID:7236
- C:\Windows\System\iYOTgKx.exe
  C:\Windows\System\iYOTgKx.exe
  2⤵
  PID:7256
- C:\Windows\System\eEGEWsn.exe
  C:\Windows\System\eEGEWsn.exe
  2⤵
  PID:7276
- C:\Windows\System\mleWyaH.exe
  C:\Windows\System\mleWyaH.exe
  2⤵
  PID:7296
- C:\Windows\System\rEaaIum.exe
  C:\Windows\System\rEaaIum.exe
  2⤵
  PID:7328
- C:\Windows\System\rwDvccf.exe
  C:\Windows\System\rwDvccf.exe
  2⤵
  PID:7360
- C:\Windows\System\OWxIxsK.exe
  C:\Windows\System\OWxIxsK.exe
  2⤵
  PID:7380
- C:\Windows\System\aNmjIpN.exe
  C:\Windows\System\aNmjIpN.exe
  2⤵
  PID:7412
- C:\Windows\System\jsTyova.exe
  C:\Windows\System\jsTyova.exe
  2⤵
  PID:7440
- C:\Windows\System\MqzOZWs.exe
  C:\Windows\System\MqzOZWs.exe
  2⤵
  PID:7500
- C:\Windows\System\OAOPRJk.exe
  C:\Windows\System\OAOPRJk.exe
  2⤵
  PID:7528
- C:\Windows\System\JuRcBtq.exe
  C:\Windows\System\JuRcBtq.exe
  2⤵
  PID:7552
- C:\Windows\System\sAlYspG.exe
  C:\Windows\System\sAlYspG.exe
  2⤵
  PID:7576
- C:\Windows\System\fQVCtLF.exe
  C:\Windows\System\fQVCtLF.exe
  2⤵
  PID:7596
- C:\Windows\System\dmoZIrc.exe
  C:\Windows\System\dmoZIrc.exe
  2⤵
  PID:7624
- C:\Windows\System\LEVfsHr.exe
  C:\Windows\System\LEVfsHr.exe
  2⤵
  PID:7656
- C:\Windows\System\dKqkYbB.exe
  C:\Windows\System\dKqkYbB.exe
  2⤵
  PID:7684
- C:\Windows\System\EpRDOHx.exe
  C:\Windows\System\EpRDOHx.exe
  2⤵
  PID:7716
- C:\Windows\System\VODTUrq.exe
  C:\Windows\System\VODTUrq.exe
  2⤵
  PID:7736
- C:\Windows\System\qjaYRRD.exe
  C:\Windows\System\qjaYRRD.exe
  2⤵
  PID:7760
- C:\Windows\System\wargoFs.exe
  C:\Windows\System\wargoFs.exe
  2⤵
  PID:7792
- C:\Windows\System\fKRMvjb.exe
  C:\Windows\System\fKRMvjb.exe
  2⤵
  PID:7820
- C:\Windows\System\mFtxBbv.exe
  C:\Windows\System\mFtxBbv.exe
  2⤵
  PID:7848
- C:\Windows\System\aSjvTZA.exe
  C:\Windows\System\aSjvTZA.exe
  2⤵
  PID:7876
- C:\Windows\System\BGYBUcV.exe
  C:\Windows\System\BGYBUcV.exe
  2⤵
  PID:7900
- C:\Windows\System\McuNQTs.exe
  C:\Windows\System\McuNQTs.exe
  2⤵
  PID:7932
- C:\Windows\System\JzbZczJ.exe
  C:\Windows\System\JzbZczJ.exe
  2⤵
  PID:7972
- C:\Windows\System\ZCJqDRa.exe
  C:\Windows\System\ZCJqDRa.exe
  2⤵
  PID:7996
- C:\Windows\System\kcduNQI.exe
  C:\Windows\System\kcduNQI.exe
  2⤵
  PID:8028
- C:\Windows\System\VVsnsnp.exe
  C:\Windows\System\VVsnsnp.exe
  2⤵
  PID:8052
- C:\Windows\System\IqEauch.exe
  C:\Windows\System\IqEauch.exe
  2⤵
  PID:8072
- C:\Windows\System\FKExSVx.exe
  C:\Windows\System\FKExSVx.exe
  2⤵
  PID:8100
- C:\Windows\System\ZZFfvoq.exe
  C:\Windows\System\ZZFfvoq.exe
  2⤵
  PID:8132
- C:\Windows\System\SzyNSww.exe
  C:\Windows\System\SzyNSww.exe
  2⤵
  PID:8156
- C:\Windows\System\tWsqWwH.exe
  C:\Windows\System\tWsqWwH.exe
  2⤵
  PID:6928
- C:\Windows\System\gGPfReJ.exe
  C:\Windows\System\gGPfReJ.exe
  2⤵
  PID:7212
- C:\Windows\System\IFvtdpO.exe
  C:\Windows\System\IFvtdpO.exe
  2⤵
  PID:7320
- C:\Windows\System\tdDSZBi.exe
  C:\Windows\System\tdDSZBi.exe
  2⤵
  PID:7376
- C:\Windows\System\mNHwAQr.exe
  C:\Windows\System\mNHwAQr.exe
  2⤵
  PID:7408
- C:\Windows\System\nTwxjYm.exe
  C:\Windows\System\nTwxjYm.exe
  2⤵
  PID:7496
- C:\Windows\System\PxFaqQm.exe
  C:\Windows\System\PxFaqQm.exe
  2⤵
  PID:7548
- C:\Windows\System\nIPZneP.exe
  C:\Windows\System\nIPZneP.exe
  2⤵
  PID:7544
- C:\Windows\System\YxTFHbG.exe
  C:\Windows\System\YxTFHbG.exe
  2⤵
  PID:7728
- C:\Windows\System\KPcVqwi.exe
  C:\Windows\System\KPcVqwi.exe
  2⤵
  PID:7784
- C:\Windows\System\fjYttlT.exe
  C:\Windows\System\fjYttlT.exe
  2⤵
  PID:7756
- C:\Windows\System\QAByKPl.exe
  C:\Windows\System\QAByKPl.exe
  2⤵
  PID:7872
- C:\Windows\System\hoSOomL.exe
  C:\Windows\System\hoSOomL.exe
  2⤵
  PID:7868
- C:\Windows\System\wNaEorh.exe
  C:\Windows\System\wNaEorh.exe
  2⤵
  PID:7984
- C:\Windows\System\DqhWBaz.exe
  C:\Windows\System\DqhWBaz.exe
  2⤵
  PID:7928
- C:\Windows\System\wprBEyl.exe
  C:\Windows\System\wprBEyl.exe
  2⤵
  PID:8048
- C:\Windows\System\nQpobvg.exe
  C:\Windows\System\nQpobvg.exe
  2⤵
  PID:8096
- C:\Windows\System\PdZjfFB.exe
  C:\Windows\System\PdZjfFB.exe
  2⤵
  PID:8184
- C:\Windows\System\tSGtisM.exe
  C:\Windows\System\tSGtisM.exe
  2⤵
  PID:7292
- C:\Windows\System\rbTVjcm.exe
  C:\Windows\System\rbTVjcm.exe
  2⤵
  PID:7616
- C:\Windows\System\QmgsSsE.exe
  C:\Windows\System\QmgsSsE.exe
  2⤵
  PID:7608
- C:\Windows\System\QBLlaQI.exe
  C:\Windows\System\QBLlaQI.exe
  2⤵
  PID:8140
- C:\Windows\System\pdrWHCs.exe
  C:\Windows\System\pdrWHCs.exe
  2⤵
  PID:7512
- C:\Windows\System\rvtwMTc.exe
  C:\Windows\System\rvtwMTc.exe
  2⤵
  PID:7648
- C:\Windows\System\gWzrclc.exe
  C:\Windows\System\gWzrclc.exe
  2⤵
  PID:7520
- C:\Windows\System\UVJabtT.exe
  C:\Windows\System\UVJabtT.exe
  2⤵
  PID:8212
- C:\Windows\System\qbUPBOA.exe
  C:\Windows\System\qbUPBOA.exe
  2⤵
  PID:8240
- C:\Windows\System\LZASWzo.exe
  C:\Windows\System\LZASWzo.exe
  2⤵
  PID:8260
- C:\Windows\System\byWSJVt.exe
  C:\Windows\System\byWSJVt.exe
  2⤵
  PID:8288
- C:\Windows\System\fXYJHMt.exe
  C:\Windows\System\fXYJHMt.exe
  2⤵
  PID:8336
- C:\Windows\System\YcxVBWT.exe
  C:\Windows\System\YcxVBWT.exe
  2⤵
  PID:8364
- C:\Windows\System\ACrZCKC.exe
  C:\Windows\System\ACrZCKC.exe
  2⤵
  PID:8388
- C:\Windows\System\oTGJMqW.exe
  C:\Windows\System\oTGJMqW.exe
  2⤵
  PID:8420
- C:\Windows\System\mXgHAgW.exe
  C:\Windows\System\mXgHAgW.exe
  2⤵
  PID:8436
- C:\Windows\System\bJlBUfb.exe
  C:\Windows\System\bJlBUfb.exe
  2⤵
  PID:8456
- C:\Windows\System\oARDtbT.exe
  C:\Windows\System\oARDtbT.exe
  2⤵
  PID:8484
- C:\Windows\System\tfSOray.exe
  C:\Windows\System\tfSOray.exe
  2⤵
  PID:8512
- C:\Windows\System\EVZVpyo.exe
  C:\Windows\System\EVZVpyo.exe
  2⤵
  PID:8540
- C:\Windows\System\VGdTcPR.exe
  C:\Windows\System\VGdTcPR.exe
  2⤵
  PID:8560
- C:\Windows\System\VshBZGO.exe
  C:\Windows\System\VshBZGO.exe
  2⤵
  PID:8584
- C:\Windows\System\NdmDgIW.exe
  C:\Windows\System\NdmDgIW.exe
  2⤵
  PID:8604
- C:\Windows\System\aHlCQoB.exe
  C:\Windows\System\aHlCQoB.exe
  2⤵
  PID:8632
- C:\Windows\System\tKFVmXP.exe
  C:\Windows\System\tKFVmXP.exe
  2⤵
  PID:8664
- C:\Windows\System\LnbEuIE.exe
  C:\Windows\System\LnbEuIE.exe
  2⤵
  PID:8696
- C:\Windows\System\LVePqaP.exe
  C:\Windows\System\LVePqaP.exe
  2⤵
  PID:8808
- C:\Windows\System\vSZXCZs.exe
  C:\Windows\System\vSZXCZs.exe
  2⤵
  PID:8824
- C:\Windows\System\wfLSxgt.exe
  C:\Windows\System\wfLSxgt.exe
  2⤵
  PID:8852
- C:\Windows\System\dMJMrHR.exe
  C:\Windows\System\dMJMrHR.exe
  2⤵
  PID:8868
- C:\Windows\System\ubdAGaA.exe
  C:\Windows\System\ubdAGaA.exe
  2⤵
  PID:8888
- C:\Windows\System\thuHWVB.exe
  C:\Windows\System\thuHWVB.exe
  2⤵
  PID:8916
- C:\Windows\System\aMIKoyU.exe
  C:\Windows\System\aMIKoyU.exe
  2⤵
  PID:8948
- C:\Windows\System\zNoZYcZ.exe
  C:\Windows\System\zNoZYcZ.exe
  2⤵
  PID:8980
- C:\Windows\System\mIjfleJ.exe
  C:\Windows\System\mIjfleJ.exe
  2⤵
  PID:9000
- C:\Windows\System\qazzKEI.exe
  C:\Windows\System\qazzKEI.exe
  2⤵
  PID:9040
- C:\Windows\System\WFqUkvk.exe
  C:\Windows\System\WFqUkvk.exe
  2⤵
  PID:9056
- C:\Windows\System\FZQBNRi.exe
  C:\Windows\System\FZQBNRi.exe
  2⤵
  PID:9084
- C:\Windows\System\aplEyRh.exe
  C:\Windows\System\aplEyRh.exe
  2⤵
  PID:9120
- C:\Windows\System\IJKlBdk.exe
  C:\Windows\System\IJKlBdk.exe
  2⤵
  PID:9144
- C:\Windows\System\YsHsHaI.exe
  C:\Windows\System\YsHsHaI.exe
  2⤵
  PID:9172
- C:\Windows\System\WbdANKb.exe
  C:\Windows\System\WbdANKb.exe
  2⤵
  PID:9196
- C:\Windows\System\TWKcFMp.exe
  C:\Windows\System\TWKcFMp.exe
  2⤵
  PID:8204
- C:\Windows\System\pzjahDD.exe
  C:\Windows\System\pzjahDD.exe
  2⤵
  PID:8208
- C:\Windows\System\xeugBdi.exe
  C:\Windows\System\xeugBdi.exe
  2⤵
  PID:6728
- C:\Windows\System\xeeEdjy.exe
  C:\Windows\System\xeeEdjy.exe
  2⤵
  PID:8296
- C:\Windows\System\wTXVqaW.exe
  C:\Windows\System\wTXVqaW.exe
  2⤵
  PID:8384
- C:\Windows\System\oFwNHej.exe
  C:\Windows\System\oFwNHej.exe
  2⤵
  PID:8496
- C:\Windows\System\PhskWgu.exe
  C:\Windows\System\PhskWgu.exe
  2⤵
  PID:8532
- C:\Windows\System\qinAAKF.exe
  C:\Windows\System\qinAAKF.exe
  2⤵
  PID:8548
- C:\Windows\System\XsAJxFB.exe
  C:\Windows\System\XsAJxFB.exe
  2⤵
  PID:8676
- C:\Windows\System\jRjUZQE.exe
  C:\Windows\System\jRjUZQE.exe
  2⤵
  PID:8620
- C:\Windows\System\HWsKGHv.exe
  C:\Windows\System\HWsKGHv.exe
  2⤵
  PID:8728
- C:\Windows\System\euzQLDf.exe
  C:\Windows\System\euzQLDf.exe
  2⤵
  PID:8320
- C:\Windows\System\lqwBeaS.exe
  C:\Windows\System\lqwBeaS.exe
  2⤵
  PID:8848
- C:\Windows\System\ZiRywDL.exe
  C:\Windows\System\ZiRywDL.exe
  2⤵
  PID:8908
- C:\Windows\System\JvHRRNw.exe
  C:\Windows\System\JvHRRNw.exe
  2⤵
  PID:8932
- C:\Windows\System\KNDnNbZ.exe
  C:\Windows\System\KNDnNbZ.exe
  2⤵
  PID:9024
- C:\Windows\System\HHHyunx.exe
  C:\Windows\System\HHHyunx.exe
  2⤵
  PID:9096
- C:\Windows\System\CjjsKVR.exe
  C:\Windows\System\CjjsKVR.exe
  2⤵
  PID:9136
- C:\Windows\System\hwEtfxK.exe
  C:\Windows\System\hwEtfxK.exe
  2⤵
  PID:9184
- C:\Windows\System\OGeFvti.exe
  C:\Windows\System\OGeFvti.exe
  2⤵
  PID:8276
- C:\Windows\System\hTikjoq.exe
  C:\Windows\System\hTikjoq.exe
  2⤵
  PID:8452
- C:\Windows\System\STQDVGm.exe
  C:\Windows\System\STQDVGm.exe
  2⤵
  PID:8476
- C:\Windows\System\KoIzGBe.exe
  C:\Windows\System\KoIzGBe.exe
  2⤵
  PID:8740
- C:\Windows\System\HLdcpjA.exe
  C:\Windows\System\HLdcpjA.exe
  2⤵
  PID:8648
- C:\Windows\System\eryNuzP.exe
  C:\Windows\System\eryNuzP.exe
  2⤵
  PID:8968
- C:\Windows\System\ZnOCbWw.exe
  C:\Windows\System\ZnOCbWw.exe
  2⤵
  PID:8844
- C:\Windows\System\NrVlLAg.exe
  C:\Windows\System\NrVlLAg.exe
  2⤵
  PID:8008
- C:\Windows\System\vncwwRg.exe
  C:\Windows\System\vncwwRg.exe
  2⤵
  PID:9072
- C:\Windows\System\AbbCqfe.exe
  C:\Windows\System\AbbCqfe.exe
  2⤵
  PID:8792
- C:\Windows\System\diPczJm.exe
  C:\Windows\System\diPczJm.exe
  2⤵
  PID:8652
- C:\Windows\System\HoaqFfk.exe
  C:\Windows\System\HoaqFfk.exe
  2⤵
  PID:9236
- C:\Windows\System\tPSVuuL.exe
  C:\Windows\System\tPSVuuL.exe
  2⤵
  PID:9256
- C:\Windows\System\yKeFpmU.exe
  C:\Windows\System\yKeFpmU.exe
  2⤵
  PID:9272
- C:\Windows\System\CrpmeTl.exe
  C:\Windows\System\CrpmeTl.exe
  2⤵
  PID:9304
- C:\Windows\System\XPpMskf.exe
  C:\Windows\System\XPpMskf.exe
  2⤵
  PID:9336
- C:\Windows\System\QOKuCfM.exe
  C:\Windows\System\QOKuCfM.exe
  2⤵
  PID:9356
- C:\Windows\System\ziUHdOa.exe
  C:\Windows\System\ziUHdOa.exe
  2⤵
  PID:9376
- C:\Windows\System\aDDGjmw.exe
  C:\Windows\System\aDDGjmw.exe
  2⤵
  PID:9400
- C:\Windows\System\sxfJVWt.exe
  C:\Windows\System\sxfJVWt.exe
  2⤵
  PID:9436
- C:\Windows\System\xdyRQdx.exe
  C:\Windows\System\xdyRQdx.exe
  2⤵
  PID:9464
- C:\Windows\System\jMMNfnN.exe
  C:\Windows\System\jMMNfnN.exe
  2⤵
  PID:9484
- C:\Windows\System\oVDPpEf.exe
  C:\Windows\System\oVDPpEf.exe
  2⤵
  PID:9516
- C:\Windows\System\TaxyCxP.exe
  C:\Windows\System\TaxyCxP.exe
  2⤵
  PID:9548
- C:\Windows\System\PajoknH.exe
  C:\Windows\System\PajoknH.exe
  2⤵
  PID:9568
- C:\Windows\System\RllzbkQ.exe
  C:\Windows\System\RllzbkQ.exe
  2⤵
  PID:9600
- C:\Windows\System\fYPHYLs.exe
  C:\Windows\System\fYPHYLs.exe
  2⤵
  PID:9624
- C:\Windows\System\DcjbsrQ.exe
  C:\Windows\System\DcjbsrQ.exe
  2⤵
  PID:9648
- C:\Windows\System\fbJEsMl.exe
  C:\Windows\System\fbJEsMl.exe
  2⤵
  PID:9684
- C:\Windows\System\MlEJFVl.exe
  C:\Windows\System\MlEJFVl.exe
  2⤵
  PID:9708
- C:\Windows\System\bfHXsTe.exe
  C:\Windows\System\bfHXsTe.exe
  2⤵
  PID:9732
- C:\Windows\System\SEhqQQL.exe
  C:\Windows\System\SEhqQQL.exe
  2⤵
  PID:9756
- C:\Windows\System\IHHyYlu.exe
  C:\Windows\System\IHHyYlu.exe
  2⤵
  PID:9784
- C:\Windows\System\JcyWTyq.exe
  C:\Windows\System\JcyWTyq.exe
  2⤵
  PID:9816
- C:\Windows\System\oTLQZQF.exe
  C:\Windows\System\oTLQZQF.exe
  2⤵
  PID:9848
- C:\Windows\System\KtrIwYE.exe
  C:\Windows\System\KtrIwYE.exe
  2⤵
  PID:9876
- C:\Windows\System\PCUxGoi.exe
  C:\Windows\System\PCUxGoi.exe
  2⤵
  PID:9904
- C:\Windows\System\OMmnEcO.exe
  C:\Windows\System\OMmnEcO.exe
  2⤵
  PID:9928
- C:\Windows\System\LGZrABN.exe
  C:\Windows\System\LGZrABN.exe
  2⤵
  PID:9948
- C:\Windows\System\UVVZXpN.exe
  C:\Windows\System\UVVZXpN.exe
  2⤵
  PID:9976
- C:\Windows\System\fJJtJHk.exe
  C:\Windows\System\fJJtJHk.exe
  2⤵
  PID:10008
- C:\Windows\System\ElxLogt.exe
  C:\Windows\System\ElxLogt.exe
  2⤵
  PID:10036
- C:\Windows\System\Cosybwk.exe
  C:\Windows\System\Cosybwk.exe
  2⤵
  PID:10060
- C:\Windows\System\yDIitWQ.exe
  C:\Windows\System\yDIitWQ.exe
  2⤵
  PID:10092
- C:\Windows\System\JfTSMlE.exe
  C:\Windows\System\JfTSMlE.exe
  2⤵
  PID:10120
- C:\Windows\System\ZTxJpPg.exe
  C:\Windows\System\ZTxJpPg.exe
  2⤵
  PID:10144
- C:\Windows\System\ymZrzrB.exe
  C:\Windows\System\ymZrzrB.exe
  2⤵
  PID:10164
- C:\Windows\System\MZQIJZp.exe
  C:\Windows\System\MZQIJZp.exe
  2⤵
  PID:10188
- C:\Windows\System\VohsfDE.exe
  C:\Windows\System\VohsfDE.exe
  2⤵
  PID:10216
- C:\Windows\System\IMxBqwa.exe
  C:\Windows\System\IMxBqwa.exe
  2⤵
  PID:10236
- C:\Windows\System\UhVecAg.exe
  C:\Windows\System\UhVecAg.exe
  2⤵
  PID:8880
- C:\Windows\System\zVfLSHy.exe
  C:\Windows\System\zVfLSHy.exe
  2⤵
  PID:9228
- C:\Windows\System\OrLvDCn.exe
  C:\Windows\System\OrLvDCn.exe
  2⤵
  PID:8236
- C:\Windows\System\vcSTYiF.exe
  C:\Windows\System\vcSTYiF.exe
  2⤵
  PID:9420
- C:\Windows\System\fGEkUEI.exe
  C:\Windows\System\fGEkUEI.exe
  2⤵
  PID:9448
- C:\Windows\System\ahHcqiq.exe
  C:\Windows\System\ahHcqiq.exe
  2⤵
  PID:9364
- C:\Windows\System\THSIGcv.exe
  C:\Windows\System\THSIGcv.exe
  2⤵
  PID:9512
- C:\Windows\System\UNhRdjW.exe
  C:\Windows\System\UNhRdjW.exe
  2⤵
  PID:9412
- C:\Windows\System\AyiJPMz.exe
  C:\Windows\System\AyiJPMz.exe
  2⤵
  PID:9728
- C:\Windows\System\sBZEhvV.exe
  C:\Windows\System\sBZEhvV.exe
  2⤵
  PID:9780
- C:\Windows\System\gzKSTPA.exe
  C:\Windows\System\gzKSTPA.exe
  2⤵
  PID:9840
- C:\Windows\System\gwTwmMf.exe
  C:\Windows\System\gwTwmMf.exe
  2⤵
  PID:9884
- C:\Windows\System\WbzMEcF.exe
  C:\Windows\System\WbzMEcF.exe
  2⤵
  PID:9660
- C:\Windows\System\TaYmymk.exe
  C:\Windows\System\TaYmymk.exe
  2⤵
  PID:9940
- C:\Windows\System\OWPYOBf.exe
  C:\Windows\System\OWPYOBf.exe
  2⤵
  PID:10136
- C:\Windows\System\cxDPebp.exe
  C:\Windows\System\cxDPebp.exe
  2⤵
  PID:10080
- C:\Windows\System\QGHpAzG.exe
  C:\Windows\System\QGHpAzG.exe
  2⤵
  PID:10180
- C:\Windows\System\pkpNZIx.exe
  C:\Windows\System\pkpNZIx.exe
  2⤵
  PID:10108
- C:\Windows\System\HdvNUwE.exe
  C:\Windows\System\HdvNUwE.exe
  2⤵
  PID:10204
- C:\Windows\System\QeZkvQV.exe
  C:\Windows\System\QeZkvQV.exe
  2⤵
  PID:10212
- C:\Windows\System\zcAsDdh.exe
  C:\Windows\System\zcAsDdh.exe
  2⤵
  PID:9508
- C:\Windows\System\URAJwpD.exe
  C:\Windows\System\URAJwpD.exe
  2⤵
  PID:9396
- C:\Windows\System\YXTdMEE.exe
  C:\Windows\System\YXTdMEE.exe
  2⤵
  PID:9232
- C:\Windows\System\CbkRDTl.exe
  C:\Windows\System\CbkRDTl.exe
  2⤵
  PID:9320
- C:\Windows\System\hoCARPP.exe
  C:\Windows\System\hoCARPP.exe
  2⤵
  PID:10504
- C:\Windows\System\uVmqFJU.exe
  C:\Windows\System\uVmqFJU.exe
  2⤵
  PID:10528
- C:\Windows\System\PJMekwy.exe
  C:\Windows\System\PJMekwy.exe
  2⤵
  PID:10552
- C:\Windows\System\AoDDyWi.exe
  C:\Windows\System\AoDDyWi.exe
  2⤵
  PID:10572
- C:\Windows\System\mHwvFbF.exe
  C:\Windows\System\mHwvFbF.exe
  2⤵
  PID:10604
- C:\Windows\System\uGFMteZ.exe
  C:\Windows\System\uGFMteZ.exe
  2⤵
  PID:10632
- C:\Windows\System\ZSAoDWa.exe
  C:\Windows\System\ZSAoDWa.exe
  2⤵
  PID:10656
- C:\Windows\System\kQtwXXy.exe
  C:\Windows\System\kQtwXXy.exe
  2⤵
  PID:10680
- C:\Windows\System\SzSMIys.exe
  C:\Windows\System\SzSMIys.exe
  2⤵
  PID:10708
- C:\Windows\System\TtfAlSI.exe
  C:\Windows\System\TtfAlSI.exe
  2⤵
  PID:10744
- C:\Windows\System\JcZhVze.exe
  C:\Windows\System\JcZhVze.exe
  2⤵
  PID:10760
- C:\Windows\System\pHGDIXv.exe
  C:\Windows\System\pHGDIXv.exe
  2⤵
  PID:10780
- C:\Windows\System\pUrARHv.exe
  C:\Windows\System\pUrARHv.exe
  2⤵
  PID:10812
- C:\Windows\System\cnULuUP.exe
  C:\Windows\System\cnULuUP.exe
  2⤵
  PID:10836
- C:\Windows\System\SKbEbiq.exe
  C:\Windows\System\SKbEbiq.exe
  2⤵
  PID:10860
- C:\Windows\System\jcjbOJr.exe
  C:\Windows\System\jcjbOJr.exe
  2⤵
  PID:10888
- C:\Windows\System\XXopCYJ.exe
  C:\Windows\System\XXopCYJ.exe
  2⤵
  PID:10908
- C:\Windows\System\DQwdlzV.exe
  C:\Windows\System\DQwdlzV.exe
  2⤵
  PID:10932
- C:\Windows\System\HbRhYoN.exe
  C:\Windows\System\HbRhYoN.exe
  2⤵
  PID:10956
- C:\Windows\System\WunsOLu.exe
  C:\Windows\System\WunsOLu.exe
  2⤵
  PID:10984
- C:\Windows\System\GzwPlXZ.exe
  C:\Windows\System\GzwPlXZ.exe
  2⤵
  PID:11012
- C:\Windows\System\wzPcVvc.exe
  C:\Windows\System\wzPcVvc.exe
  2⤵
  PID:11036
- C:\Windows\System\pxDooPL.exe
  C:\Windows\System\pxDooPL.exe
  2⤵
  PID:11056
- C:\Windows\System\FHlIcvJ.exe
  C:\Windows\System\FHlIcvJ.exe
  2⤵
  PID:11108
- C:\Windows\System\SbMrOeU.exe
  C:\Windows\System\SbMrOeU.exe
  2⤵
  PID:11132
- C:\Windows\System\DpJnvEl.exe
  C:\Windows\System\DpJnvEl.exe
  2⤵
  PID:11184
- C:\Windows\System\KHRfanq.exe
  C:\Windows\System\KHRfanq.exe
  2⤵
  PID:11212
- C:\Windows\System\yZhhvJR.exe
  C:\Windows\System\yZhhvJR.exe
  2⤵
  PID:11232
- C:\Windows\System\aNuLemW.exe
  C:\Windows\System\aNuLemW.exe
  2⤵
  PID:10228
- C:\Windows\System\JqItCdh.exe
  C:\Windows\System\JqItCdh.exe
  2⤵
  PID:9800
- C:\Windows\System\jhZChDy.exe
  C:\Windows\System\jhZChDy.exe
  2⤵
  PID:9668
- C:\Windows\System\gRwWJpy.exe
  C:\Windows\System\gRwWJpy.exe
  2⤵
  PID:4160
- C:\Windows\System\tBTRwWf.exe
  C:\Windows\System\tBTRwWf.exe
  2⤵
  PID:10460
- C:\Windows\System\eqYvGSZ.exe
  C:\Windows\System\eqYvGSZ.exe
  2⤵
  PID:3764
- C:\Windows\System\JAhqpvc.exe
  C:\Windows\System\JAhqpvc.exe
  2⤵
  PID:10440
- C:\Windows\System\TGkAQsh.exe
  C:\Windows\System\TGkAQsh.exe
  2⤵
  PID:1928
- C:\Windows\System\hRqIOUI.exe
  C:\Windows\System\hRqIOUI.exe
  2⤵
  PID:10548
- C:\Windows\System\fFatvQz.exe
  C:\Windows\System\fFatvQz.exe
  2⤵
  PID:10596
- C:\Windows\System\rJCsNYm.exe
  C:\Windows\System\rJCsNYm.exe
  2⤵
  PID:10644
- C:\Windows\System\JrxZFzy.exe
  C:\Windows\System\JrxZFzy.exe
  2⤵
  PID:10756
- C:\Windows\System\oyXsOKM.exe
  C:\Windows\System\oyXsOKM.exe
  2⤵
  PID:10872
- C:\Windows\System\JYEDevf.exe
  C:\Windows\System\JYEDevf.exe
  2⤵
  PID:10924
- C:\Windows\System\uykwhtT.exe
  C:\Windows\System\uykwhtT.exe
  2⤵
  PID:10980
- C:\Windows\System\DFNIUeE.exe
  C:\Windows\System\DFNIUeE.exe
  2⤵
  PID:11020
- C:\Windows\System\OzMomyA.exe
  C:\Windows\System\OzMomyA.exe
  2⤵
  PID:3024
- C:\Windows\System\tIUUdTP.exe
  C:\Windows\System\tIUUdTP.exe
  2⤵
  PID:11120
- C:\Windows\System\FLnfhHk.exe
  C:\Windows\System\FLnfhHk.exe
  2⤵
  PID:11192
- C:\Windows\System\BUrtnkj.exe
  C:\Windows\System\BUrtnkj.exe
  2⤵
  PID:5044
- C:\Windows\System\SvIvseG.exe
  C:\Windows\System\SvIvseG.exe
  2⤵
  PID:9536
- C:\Windows\System\NMRkUKj.exe
  C:\Windows\System\NMRkUKj.exe
  2⤵
  PID:10540
- C:\Windows\System\FnCDOyp.exe
  C:\Windows\System\FnCDOyp.exe
  2⤵
  PID:10520
- C:\Windows\System\xelkszf.exe
  C:\Windows\System\xelkszf.exe
  2⤵
  PID:10740
- C:\Windows\System\HXeoBMi.exe
  C:\Windows\System\HXeoBMi.exe
  2⤵
  PID:3484
- C:\Windows\System\RpxNYDw.exe
  C:\Windows\System\RpxNYDw.exe
  2⤵
  PID:1712
- C:\Windows\System\bxPAAfw.exe
  C:\Windows\System\bxPAAfw.exe
  2⤵
  PID:3856
- C:\Windows\System\xqOnJbc.exe
  C:\Windows\System\xqOnJbc.exe
  2⤵
  PID:10976
- C:\Windows\System\nvztxuN.exe
  C:\Windows\System\nvztxuN.exe
  2⤵
  PID:804
- C:\Windows\System\FkUwEEE.exe
  C:\Windows\System\FkUwEEE.exe
  2⤵
  PID:11128
- C:\Windows\System\GTmsFJz.exe
  C:\Windows\System\GTmsFJz.exe
  2⤵
  PID:320
- C:\Windows\System\yVZetFC.exe
  C:\Windows\System\yVZetFC.exe
  2⤵
  PID:1640
- C:\Windows\System\CQgyXhC.exe
  C:\Windows\System\CQgyXhC.exe
  2⤵
  PID:10824
- C:\Windows\System\HNrwuBU.exe
  C:\Windows\System\HNrwuBU.exe
  2⤵
  PID:4224
- C:\Windows\System\HiUFAgS.exe
  C:\Windows\System\HiUFAgS.exe
  2⤵
  PID:11272
- C:\Windows\System\pjBIJcs.exe
  C:\Windows\System\pjBIJcs.exe
  2⤵
  PID:11300
- C:\Windows\System\NMFmcZD.exe
  C:\Windows\System\NMFmcZD.exe
  2⤵
  PID:11356
- C:\Windows\System\OVRqoMt.exe
  C:\Windows\System\OVRqoMt.exe
  2⤵
  PID:11376
- C:\Windows\System\ItPufiL.exe
  C:\Windows\System\ItPufiL.exe
  2⤵
  PID:11404
- C:\Windows\System\WDVftxH.exe
  C:\Windows\System\WDVftxH.exe
  2⤵
  PID:11432
- C:\Windows\System\oZjgjxS.exe
  C:\Windows\System\oZjgjxS.exe
  2⤵
  PID:11452
- C:\Windows\System\JTFPUyG.exe
  C:\Windows\System\JTFPUyG.exe
  2⤵
  PID:11480
- C:\Windows\System\oJluLBd.exe
  C:\Windows\System\oJluLBd.exe
  2⤵
  PID:11500
- C:\Windows\System\rhJuENS.exe
  C:\Windows\System\rhJuENS.exe
  2⤵
  PID:11528
- C:\Windows\System\VleMjRv.exe
  C:\Windows\System\VleMjRv.exe
  2⤵
  PID:11548
- C:\Windows\System\UPeAlXY.exe
  C:\Windows\System\UPeAlXY.exe
  2⤵
  PID:11580
- C:\Windows\System\JjwYDTC.exe
  C:\Windows\System\JjwYDTC.exe
  2⤵
  PID:11600
- C:\Windows\System\HrhPHPL.exe
  C:\Windows\System\HrhPHPL.exe
  2⤵
  PID:11628
- C:\Windows\System\kefmlwj.exe
  C:\Windows\System\kefmlwj.exe
  2⤵
  PID:11660
- C:\Windows\System\tFZiDtO.exe
  C:\Windows\System\tFZiDtO.exe
  2⤵
  PID:11684
- C:\Windows\System\sGCfCxd.exe
  C:\Windows\System\sGCfCxd.exe
  2⤵
  PID:11712
- C:\Windows\System\aiDHcwP.exe
  C:\Windows\System\aiDHcwP.exe
  2⤵
  PID:11732
- C:\Windows\System\XCqWSBd.exe
  C:\Windows\System\XCqWSBd.exe
  2⤵
  PID:11760
- C:\Windows\System\pMcHagU.exe
  C:\Windows\System\pMcHagU.exe
  2⤵
  PID:11788
- C:\Windows\System\iBxxmSc.exe
  C:\Windows\System\iBxxmSc.exe
  2⤵
  PID:11816
- C:\Windows\System\iQrhkop.exe
  C:\Windows\System\iQrhkop.exe
  2⤵
  PID:11840
- C:\Windows\System\yeYreEo.exe
  C:\Windows\System\yeYreEo.exe
  2⤵
  PID:11868
- C:\Windows\System\WHWcfuo.exe
  C:\Windows\System\WHWcfuo.exe
  2⤵
  PID:11896
- C:\Windows\System\TpGqAfV.exe
  C:\Windows\System\TpGqAfV.exe
  2⤵
  PID:11912
- C:\Windows\System\fCcuxlt.exe
  C:\Windows\System\fCcuxlt.exe
  2⤵
  PID:11936
- C:\Windows\System\BFKIEny.exe
  C:\Windows\System\BFKIEny.exe
  2⤵
  PID:11960
- C:\Windows\System\StehRse.exe
  C:\Windows\System\StehRse.exe
  2⤵
  PID:11984
- C:\Windows\System\NaSbUyg.exe
  C:\Windows\System\NaSbUyg.exe
  2⤵
  PID:12000
- C:\Windows\System\OjNKFFf.exe
  C:\Windows\System\OjNKFFf.exe
  2⤵
  PID:12028
- C:\Windows\System\vTOLoxb.exe
  C:\Windows\System\vTOLoxb.exe
  2⤵
  PID:12052
- C:\Windows\System\qJHGIZQ.exe
  C:\Windows\System\qJHGIZQ.exe
  2⤵
  PID:12076
- C:\Windows\System\tDTapru.exe
  C:\Windows\System\tDTapru.exe
  2⤵
  PID:12092
- C:\Windows\System\OUuVGWU.exe
  C:\Windows\System\OUuVGWU.exe
  2⤵
  PID:12120
- C:\Windows\System\yvXCKUo.exe
  C:\Windows\System\yvXCKUo.exe
  2⤵
  PID:12148
- C:\Windows\System\bnONvAi.exe
  C:\Windows\System\bnONvAi.exe
  2⤵
  PID:12164
- C:\Windows\System\UukpfcO.exe
  C:\Windows\System\UukpfcO.exe
  2⤵
  PID:12196
- C:\Windows\System\lNQJAlB.exe
  C:\Windows\System\lNQJAlB.exe
  2⤵
  PID:12220
- C:\Windows\System\WjStEin.exe
  C:\Windows\System\WjStEin.exe
  2⤵
  PID:12248
- C:\Windows\System\FzFpPOn.exe
  C:\Windows\System\FzFpPOn.exe
  2⤵
  PID:12268
- C:\Windows\System\DayzTGt.exe
  C:\Windows\System\DayzTGt.exe
  2⤵
  PID:11000
- C:\Windows\System\leoNPQX.exe
  C:\Windows\System\leoNPQX.exe
  2⤵
  PID:11284
- C:\Windows\System\XRZZJHa.exe
  C:\Windows\System\XRZZJHa.exe
  2⤵
  PID:11084
- C:\Windows\System\VixPydV.exe
  C:\Windows\System\VixPydV.exe
  2⤵
  PID:11168
- C:\Windows\System\WCdAofG.exe
  C:\Windows\System\WCdAofG.exe
  2⤵
  PID:10476
- C:\Windows\System\yocrWFt.exe
  C:\Windows\System\yocrWFt.exe
  2⤵
  PID:11428
- C:\Windows\System\JjXUDJF.exe
  C:\Windows\System\JjXUDJF.exe
  2⤵
  PID:11448
- C:\Windows\System\oFMicUs.exe
  C:\Windows\System\oFMicUs.exe
  2⤵
  PID:2260
- C:\Windows\System\laHXrfG.exe
  C:\Windows\System\laHXrfG.exe
  2⤵
  PID:11544
- C:\Windows\System\LSpRBrd.exe
  C:\Windows\System\LSpRBrd.exe
  2⤵
  PID:2280
- C:\Windows\System\cJDmnOL.exe
  C:\Windows\System\cJDmnOL.exe
  2⤵
  PID:11472
- C:\Windows\System\PFMAHyG.exe
  C:\Windows\System\PFMAHyG.exe
  2⤵
  PID:12160
- C:\Windows\System\KvyumcJ.exe
  C:\Windows\System\KvyumcJ.exe
  2⤵
  PID:12072
- C:\Windows\System\ycrLPSZ.exe
  C:\Windows\System\ycrLPSZ.exe
  2⤵
  PID:12244
- C:\Windows\System\eGzQqNU.exe
  C:\Windows\System\eGzQqNU.exe
  2⤵
  PID:12264
- C:\Windows\System\auGWKTz.exe
  C:\Windows\System\auGWKTz.exe
  2⤵
  PID:12192
- C:\Windows\System\vgxAKxr.exe
  C:\Windows\System\vgxAKxr.exe
  2⤵
  PID:12084
- C:\Windows\System\MzHnQTZ.exe
  C:\Windows\System\MzHnQTZ.exe
  2⤵
  PID:11096
- C:\Windows\System\VFHjsdi.exe
  C:\Windows\System\VFHjsdi.exe
  2⤵
  PID:720
- C:\Windows\System\HbqTLcs.exe
  C:\Windows\System\HbqTLcs.exe
  2⤵
  PID:11340
- C:\Windows\System\tqlZbdE.exe
  C:\Windows\System\tqlZbdE.exe
  2⤵
  PID:624
- C:\Windows\System\rGJBmpt.exe
  C:\Windows\System\rGJBmpt.exe
  2⤵
  PID:11416
- C:\Windows\System\wwwMeag.exe
  C:\Windows\System\wwwMeag.exe
  2⤵
  PID:11836
- C:\Windows\System\OCHpHls.exe
  C:\Windows\System\OCHpHls.exe
  2⤵
  PID:11796
- C:\Windows\System\kQryIZD.exe
  C:\Windows\System\kQryIZD.exe
  2⤵
  PID:12020
- C:\Windows\System\xVwgZKw.exe
  C:\Windows\System\xVwgZKw.exe
  2⤵
  PID:112
- C:\Windows\System\VAtiZyy.exe
  C:\Windows\System\VAtiZyy.exe
  2⤵
  PID:4688
- C:\Windows\System\AADajRf.exe
  C:\Windows\System\AADajRf.exe
  2⤵
  PID:3808
- C:\Windows\System\phKLULy.exe
  C:\Windows\System\phKLULy.exe
  2⤵
  PID:11296
- C:\Windows\System\AvnRuEq.exe
  C:\Windows\System\AvnRuEq.exe
  2⤵
  PID:11520
- C:\Windows\System\zXPOEDI.exe
  C:\Windows\System\zXPOEDI.exe
  2⤵
  PID:11856
- C:\Windows\System\nliQwqK.exe
  C:\Windows\System\nliQwqK.exe
  2⤵
  PID:12048
- C:\Windows\System\ETgAeKM.exe
  C:\Windows\System\ETgAeKM.exe
  2⤵
  PID:11728
- C:\Windows\System\bZfgYsU.exe
  C:\Windows\System\bZfgYsU.exe
  2⤵
  PID:12300
- C:\Windows\System\oMHNzAF.exe
  C:\Windows\System\oMHNzAF.exe
  2⤵
  PID:12328
- C:\Windows\System\adgDVdM.exe
  C:\Windows\System\adgDVdM.exe
  2⤵
  PID:12356
- C:\Windows\System\ZMfITbc.exe
  C:\Windows\System\ZMfITbc.exe
  2⤵
  PID:12380
- C:\Windows\System\YcJZQVu.exe
  C:\Windows\System\YcJZQVu.exe
  2⤵
  PID:12400
- C:\Windows\System\ZsYIkxB.exe
  C:\Windows\System\ZsYIkxB.exe
  2⤵
  PID:12432
- C:\Windows\System\hsKPadw.exe
  C:\Windows\System\hsKPadw.exe
  2⤵
  PID:12464
- C:\Windows\System\CYTbguF.exe
  C:\Windows\System\CYTbguF.exe
  2⤵
  PID:12484
- C:\Windows\System\rvJTxvr.exe
  C:\Windows\System\rvJTxvr.exe
  2⤵
  PID:12504
- C:\Windows\System\bjFtTcb.exe
  C:\Windows\System\bjFtTcb.exe
  2⤵
  PID:12524
- C:\Windows\System\IPutjLS.exe
  C:\Windows\System\IPutjLS.exe
  2⤵
  PID:12544
- C:\Windows\System\dAxLCDZ.exe
  C:\Windows\System\dAxLCDZ.exe
  2⤵
  PID:12568
- C:\Windows\System\fHfNokb.exe
  C:\Windows\System\fHfNokb.exe
  2⤵
  PID:12588
- C:\Windows\System\sduXbmk.exe
  C:\Windows\System\sduXbmk.exe
  2⤵
  PID:12616
- C:\Windows\System\jAJySTq.exe
  C:\Windows\System\jAJySTq.exe
  2⤵
  PID:12644
- C:\Windows\System\TpssgcE.exe
  C:\Windows\System\TpssgcE.exe
  2⤵
  PID:12668
- C:\Windows\System\jckMhdS.exe
  C:\Windows\System\jckMhdS.exe
  2⤵
  PID:12700
- C:\Windows\System\KbZzXcb.exe
  C:\Windows\System\KbZzXcb.exe
  2⤵
  PID:12720
- C:\Windows\System\vXNYcxV.exe
  C:\Windows\System\vXNYcxV.exe
  2⤵
  PID:12748
- C:\Windows\System\IaYJDjl.exe
  C:\Windows\System\IaYJDjl.exe
  2⤵
  PID:12776
- C:\Windows\System\ZKKUAsb.exe
  C:\Windows\System\ZKKUAsb.exe
  2⤵
  PID:12804
- C:\Windows\System\FkpXVgJ.exe
  C:\Windows\System\FkpXVgJ.exe
  2⤵
  PID:12832
- C:\Windows\System\iwvizgt.exe
  C:\Windows\System\iwvizgt.exe
  2⤵
  PID:12856
- C:\Windows\System\YEsnIpG.exe
  C:\Windows\System\YEsnIpG.exe
  2⤵
  PID:12880
- C:\Windows\System\WSTYrFu.exe
  C:\Windows\System\WSTYrFu.exe
  2⤵
  PID:12900
- C:\Windows\System\AmnOmoM.exe
  C:\Windows\System\AmnOmoM.exe
  2⤵
  PID:12920
- C:\Windows\System\hLvPzjY.exe
  C:\Windows\System\hLvPzjY.exe
  2⤵
  PID:12948
- C:\Windows\System\bOYJLlD.exe
  C:\Windows\System\bOYJLlD.exe
  2⤵
  PID:12976
- C:\Windows\System\Smlwthr.exe
  C:\Windows\System\Smlwthr.exe
  2⤵
  PID:12996
- C:\Windows\System\oQsuJBg.exe
  C:\Windows\System\oQsuJBg.exe
  2⤵
  PID:13028
- C:\Windows\System\DltXorq.exe
  C:\Windows\System\DltXorq.exe
  2⤵
  PID:13052
- C:\Windows\System\QqkTMZN.exe
  C:\Windows\System\QqkTMZN.exe
  2⤵
  PID:13072
- C:\Windows\System\KnBVqld.exe
  C:\Windows\System\KnBVqld.exe
  2⤵
  PID:13100
- C:\Windows\System\Rosoaro.exe
  C:\Windows\System\Rosoaro.exe
  2⤵
  PID:13124
- C:\Windows\System\anAKxQk.exe
  C:\Windows\System\anAKxQk.exe
  2⤵
  PID:13148
- C:\Windows\System\KkXVlQn.exe
  C:\Windows\System\KkXVlQn.exe
  2⤵
  PID:13172
- C:\Windows\System\NjIoFPh.exe
  C:\Windows\System\NjIoFPh.exe
  2⤵
  PID:13204
- C:\Windows\System\jdcIMtO.exe
  C:\Windows\System\jdcIMtO.exe
  2⤵
  PID:13220
- C:\Windows\System\emmuCwL.exe
  C:\Windows\System\emmuCwL.exe
  2⤵
  PID:13244
- C:\Windows\System\fMdTlEs.exe
  C:\Windows\System\fMdTlEs.exe
  2⤵
  PID:13268
- C:\Windows\System\jatKmrE.exe
  C:\Windows\System\jatKmrE.exe
  2⤵
  PID:13292
- C:\Windows\System\VJuwjVK.exe
  C:\Windows\System\VJuwjVK.exe
  2⤵
  PID:12104
- C:\Windows\System\TZGUNfp.exe
  C:\Windows\System\TZGUNfp.exe
  2⤵
  PID:4140
- C:\Windows\System\PRHncJU.exe
  C:\Windows\System\PRHncJU.exe
  2⤵
  PID:12336
- C:\Windows\System\SUZnYoe.exe
  C:\Windows\System\SUZnYoe.exe
  2⤵
  PID:12392
- C:\Windows\System\vkrUGgm.exe
  C:\Windows\System\vkrUGgm.exe
  2⤵
  PID:12372
- C:\Windows\System\vbEJHyN.exe
  C:\Windows\System\vbEJHyN.exe
  2⤵
  PID:12520
- C:\Windows\System\zNXcLBa.exe
  C:\Windows\System\zNXcLBa.exe
  2⤵
  PID:12564
- C:\Windows\System\kibDWVV.exe
  C:\Windows\System\kibDWVV.exe
  2⤵
  PID:12480
- C:\Windows\System\uvMvBbt.exe
  C:\Windows\System\uvMvBbt.exe
  2⤵
  PID:12740
- C:\Windows\System\HVvRhyp.exe
  C:\Windows\System\HVvRhyp.exe
  2⤵
  PID:12820
- C:\Windows\System\zbCwAAM.exe
  C:\Windows\System\zbCwAAM.exe
  2⤵
  PID:12608
- C:\Windows\System\EUWLvkr.exe
  C:\Windows\System\EUWLvkr.exe
  2⤵
  PID:12772
- C:\Windows\System\fqBSNMv.exe
  C:\Windows\System\fqBSNMv.exe
  2⤵
  PID:12816
- C:\Windows\System\gkortAP.exe
  C:\Windows\System\gkortAP.exe
  2⤵
  PID:13020
- C:\Windows\System\qlZLbgq.exe
  C:\Windows\System\qlZLbgq.exe
  2⤵
  PID:12916
- C:\Windows\System\QDWDWyV.exe
  C:\Windows\System\QDWDWyV.exe
  2⤵
  PID:13116
- C:\Windows\System\QGhQDiv.exe
  C:\Windows\System\QGhQDiv.exe
  2⤵
  PID:13044
- C:\Windows\System\vKLOZay.exe
  C:\Windows\System\vKLOZay.exe
  2⤵
  PID:13252
- C:\Windows\System\mjeDbmQ.exe
  C:\Windows\System\mjeDbmQ.exe
  2⤵
  PID:13216
- C:\Windows\System\RpidktI.exe
  C:\Windows\System\RpidktI.exe
  2⤵
  PID:13228
- C:\Windows\System\MkbnWjG.exe
  C:\Windows\System\MkbnWjG.exe
  2⤵
  PID:13288
- C:\Windows\System\pXwiudk.exe
  C:\Windows\System\pXwiudk.exe
  2⤵
  PID:13192
- C:\Windows\System\axuiKwE.exe
  C:\Windows\System\axuiKwE.exe
  2⤵
  PID:12312
- C:\Windows\System\tMYKMYe.exe
  C:\Windows\System\tMYKMYe.exe
  2⤵
  PID:13168
- C:\Windows\System\CkshxqK.exe
  C:\Windows\System\CkshxqK.exe
  2⤵
  PID:12912
- C:\Windows\System\qCAjUgs.exe
  C:\Windows\System\qCAjUgs.exe
  2⤵
  PID:13332
- C:\Windows\System\guQrNiV.exe
  C:\Windows\System\guQrNiV.exe
  2⤵
  PID:13352
- C:\Windows\System\lGBJGXD.exe
  C:\Windows\System\lGBJGXD.exe
  2⤵
  PID:13380
- C:\Windows\System\fEtrbkK.exe
  C:\Windows\System\fEtrbkK.exe
  2⤵
  PID:13404
- C:\Windows\System\mosbGYw.exe
  C:\Windows\System\mosbGYw.exe
  2⤵
  PID:13444
- C:\Windows\System\DCLXuLm.exe
  C:\Windows\System\DCLXuLm.exe
  2⤵
  PID:13480
- C:\Windows\System\ejLQLcg.exe
  C:\Windows\System\ejLQLcg.exe
  2⤵
  PID:13524
- C:\Windows\System\ylJKqLM.exe
  C:\Windows\System\ylJKqLM.exe
  2⤵
  PID:13548
- C:\Windows\System\JsHvHWC.exe
  C:\Windows\System\JsHvHWC.exe
  2⤵
  PID:13572
- C:\Windows\System\DQCcvYp.exe
  C:\Windows\System\DQCcvYp.exe
  2⤵
  PID:13588
- C:\Windows\System\rcseego.exe
  C:\Windows\System\rcseego.exe
  2⤵
  PID:13620
- C:\Windows\System\javALoN.exe
  C:\Windows\System\javALoN.exe
  2⤵
  PID:13660
- C:\Windows\System\MGdTksb.exe
  C:\Windows\System\MGdTksb.exe
  2⤵
  PID:13680
- C:\Windows\System\kIFqjub.exe
  C:\Windows\System\kIFqjub.exe
  2⤵
  PID:13704
- C:\Windows\System\gxgahdD.exe
  C:\Windows\System\gxgahdD.exe
  2⤵
  PID:13724
- C:\Windows\System\wiwgBHS.exe
  C:\Windows\System\wiwgBHS.exe
  2⤵
  PID:13748
- C:\Windows\System\VFTfmYM.exe
  C:\Windows\System\VFTfmYM.exe
  2⤵
  PID:13768
- C:\Windows\System\OrWdQsY.exe
  C:\Windows\System\OrWdQsY.exe
  2⤵
  PID:13792
- C:\Windows\System\oHrxIzv.exe
  C:\Windows\System\oHrxIzv.exe
  2⤵
  PID:13904
- C:\Windows\System\pMmjaRA.exe
  C:\Windows\System\pMmjaRA.exe
  2⤵
  PID:13920
- C:\Windows\System\KFYwwLF.exe
  C:\Windows\System\KFYwwLF.exe
  2⤵
  PID:13948
- C:\Windows\System\lBYwnQC.exe
  C:\Windows\System\lBYwnQC.exe
  2⤵
  PID:13968
- C:\Windows\System\DfOEfJN.exe
  C:\Windows\System\DfOEfJN.exe
  2⤵
  PID:13996
- C:\Windows\System\NLnLHgH.exe
  C:\Windows\System\NLnLHgH.exe
  2⤵
  PID:14024
- C:\Windows\System\GvSRQXT.exe
  C:\Windows\System\GvSRQXT.exe
  2⤵
  PID:14044
- C:\Windows\System\VCwIIwG.exe
  C:\Windows\System\VCwIIwG.exe
  2⤵
  PID:14072
- C:\Windows\System\jMWRYIM.exe
  C:\Windows\System\jMWRYIM.exe
  2⤵
  PID:14100
- C:\Windows\System\LtoQiFo.exe
  C:\Windows\System\LtoQiFo.exe
  2⤵
  PID:14120
- C:\Windows\System\JcRjDnQ.exe
  C:\Windows\System\JcRjDnQ.exe
  2⤵
  PID:13108
- C:\Windows\System\PIVcWVC.exe
  C:\Windows\System\PIVcWVC.exe
  2⤵
  PID:13440
- C:\Windows\System\AUtBgQn.exe
  C:\Windows\System\AUtBgQn.exe
  2⤵
  PID:13324
- C:\Windows\System\vdnZJrX.exe
  C:\Windows\System\vdnZJrX.exe
  2⤵
  PID:13564
- C:\Windows\System\QQJWAPT.exe
  C:\Windows\System\QQJWAPT.exe
  2⤵
  PID:13616
- C:\Windows\System\pimtLFr.exe
  C:\Windows\System\pimtLFr.exe
  2⤵
  PID:13648
- C:\Windows\System\kcoviAk.exe
  C:\Windows\System\kcoviAk.exe
  2⤵
  PID:13544
- C:\Windows\System\Sroktqo.exe
  C:\Windows\System\Sroktqo.exe
  2⤵
  PID:13672
- C:\Windows\System\olYlJvQ.exe
  C:\Windows\System\olYlJvQ.exe
  2⤵
  PID:13516
- C:\Windows\System\aubnDbv.exe
  C:\Windows\System\aubnDbv.exe
  2⤵
  PID:13744
- C:\Windows\System\UyHCvcL.exe
  C:\Windows\System\UyHCvcL.exe
  2⤵
  PID:13848
- C:\Windows\System\WVawkvY.exe
  C:\Windows\System\WVawkvY.exe
  2⤵
  PID:14084
- C:\Windows\System\ZtGEvpl.exe
  C:\Windows\System\ZtGEvpl.exe
  2⤵
  PID:14116
- C:\Windows\System\fPwOsZd.exe
  C:\Windows\System\fPwOsZd.exe
  2⤵
  PID:13944
- C:\Windows\System\SRFCOIO.exe
  C:\Windows\System\SRFCOIO.exe
  2⤵
  PID:13988
- C:\Windows\System\xlNNiDl.exe
  C:\Windows\System\xlNNiDl.exe
  2⤵
  PID:14080
- C:\Windows\System\YyKTJAV.exe
  C:\Windows\System\YyKTJAV.exe
  2⤵
  PID:13980
- C:\Windows\System\SWGcAph.exe
  C:\Windows\System\SWGcAph.exe
  2⤵
  PID:14196
- C:\Windows\System\OpOQEIP.exe
  C:\Windows\System\OpOQEIP.exe
  2⤵
  PID:14304
- C:\Windows\System\fHSazkU.exe
  C:\Windows\System\fHSazkU.exe
  2⤵
  PID:12368
- C:\Windows\System\IqewXqa.exe
  C:\Windows\System\IqewXqa.exe
  2⤵
  PID:12908
- C:\Windows\System\hUmFxXL.exe
  C:\Windows\System\hUmFxXL.exe
  2⤵
  PID:4064
- C:\Windows\System\sfYCnmz.exe
  C:\Windows\System\sfYCnmz.exe
  2⤵
  PID:13412
- C:\Windows\System\vcasIMy.exe
  C:\Windows\System\vcasIMy.exe
  2⤵
  PID:13600
- C:\Windows\System\lDVokdA.exe
  C:\Windows\System\lDVokdA.exe
  2⤵
  PID:13560
- C:\Windows\System\elyAVHw.exe
  C:\Windows\System\elyAVHw.exe
  2⤵
  PID:13540
- C:\Windows\System\UciLCiu.exe
  C:\Windows\System\UciLCiu.exe
  2⤵
  PID:13736
- C:\Windows\System\gfZSTRJ.exe
  C:\Windows\System\gfZSTRJ.exe
  2⤵
  PID:4924
- C:\Windows\System\kpelzfu.exe
  C:\Windows\System\kpelzfu.exe
  2⤵
  PID:14420
- C:\Windows\System\ZtgizMb.exe
  C:\Windows\System\ZtgizMb.exe
  2⤵
  PID:14496
- C:\Windows\System\ENKViYo.exe
  C:\Windows\System\ENKViYo.exe
  2⤵
  PID:14560
- C:\Windows\System\OMjHbyh.exe
  C:\Windows\System\OMjHbyh.exe
  2⤵
  PID:14576
- C:\Windows\System\qINmWnw.exe
  C:\Windows\System\qINmWnw.exe
  2⤵
  PID:14604
- C:\Windows\System\vJdrQbz.exe
  C:\Windows\System\vJdrQbz.exe
  2⤵
  PID:14724
- C:\Windows\System\LzKqQVd.exe
  C:\Windows\System\LzKqQVd.exe
  2⤵
  PID:14744
- C:\Windows\System\gvwQdZd.exe
  C:\Windows\System\gvwQdZd.exe
  2⤵
  PID:14768
- C:\Windows\System\TfSHGcp.exe
  C:\Windows\System\TfSHGcp.exe
  2⤵
  PID:14792
- C:\Windows\System\fEbypUk.exe
  C:\Windows\System\fEbypUk.exe
  2⤵
  PID:14940
- C:\Windows\System\SEaWFFy.exe
  C:\Windows\System\SEaWFFy.exe
  2⤵
  PID:15000
- C:\Windows\System\RCLjfEa.exe
  C:\Windows\System\RCLjfEa.exe
  2⤵
  PID:15028
- C:\Windows\System\FSqbIwU.exe
  C:\Windows\System\FSqbIwU.exe
  2⤵
  PID:15048
- C:\Windows\System\VkBAXZl.exe
  C:\Windows\System\VkBAXZl.exe
  2⤵
  PID:15068
- C:\Windows\System\NbCrtis.exe
  C:\Windows\System\NbCrtis.exe
  2⤵
  PID:15096
- C:\Windows\System\QKFdssP.exe
  C:\Windows\System\QKFdssP.exe
  2⤵
  PID:15144
- C:\Windows\System\LVWuIKK.exe
  C:\Windows\System\LVWuIKK.exe
  2⤵
  PID:15184
- C:\Windows\System\AKIXuFj.exe
  C:\Windows\System\AKIXuFj.exe
  2⤵
  PID:15212
- C:\Windows\System\TMeyRqU.exe
  C:\Windows\System\TMeyRqU.exe
  2⤵
  PID:15228
- C:\Windows\System\uccweAI.exe
  C:\Windows\System\uccweAI.exe
  2⤵
  PID:15244
- C:\Windows\System\jTBJKmA.exe
  C:\Windows\System\jTBJKmA.exe
  2⤵
  PID:15260
- C:\Windows\System\wGzeTyZ.exe
  C:\Windows\System\wGzeTyZ.exe
  2⤵
  PID:15280
- C:\Windows\System\YEFuMGo.exe
  C:\Windows\System\YEFuMGo.exe
  2⤵
  PID:15320
- C:\Windows\System\TNnfohX.exe
  C:\Windows\System\TNnfohX.exe
  2⤵
  PID:13700
- C:\Windows\System\BotCwHE.exe
  C:\Windows\System\BotCwHE.exe
  2⤵
  PID:13604
- C:\Windows\System\vJDVZsz.exe
  C:\Windows\System\vJDVZsz.exe
  2⤵
  PID:14036
- C:\Windows\System\xtlUTfr.exe
  C:\Windows\System\xtlUTfr.exe
  2⤵
  PID:12452
- C:\Windows\System\MHHcbpl.exe
  C:\Windows\System\MHHcbpl.exe
  2⤵
  PID:14400
- C:\Windows\System\VlswXmA.exe
  C:\Windows\System\VlswXmA.exe
  2⤵
  PID:13196
- C:\Windows\System\RJsKWQt.exe
  C:\Windows\System\RJsKWQt.exe
  2⤵
  PID:4640
- C:\Windows\System\YUOWsVi.exe
  C:\Windows\System\YUOWsVi.exe
  2⤵
  PID:14508
- C:\Windows\System\CbTLmYZ.exe
  C:\Windows\System\CbTLmYZ.exe
  2⤵
  PID:11248
- C:\Windows\System\ePzwOls.exe
  C:\Windows\System\ePzwOls.exe
  2⤵
  PID:1552
- C:\Windows\System\XItCHGC.exe
  C:\Windows\System\XItCHGC.exe
  2⤵
  PID:14620
- C:\Windows\System\NWOMYsd.exe
  C:\Windows\System\NWOMYsd.exe
  2⤵
  PID:14340
- C:\Windows\System\EDqhDYH.exe
  C:\Windows\System\EDqhDYH.exe
  2⤵
  PID:14376
- C:\Windows\System\IPGvjNk.exe
  C:\Windows\System\IPGvjNk.exe
  2⤵
  PID:3464
- C:\Windows\System\jHPZJNb.exe
  C:\Windows\System\jHPZJNb.exe
  2⤵
  PID:14688
- C:\Windows\System\iTvISNE.exe
  C:\Windows\System\iTvISNE.exe
  2⤵
  PID:14716
- C:\Windows\System\SXqmWtJ.exe
  C:\Windows\System\SXqmWtJ.exe
  2⤵
  PID:14780
- C:\Windows\System\zBYtTvm.exe
  C:\Windows\System\zBYtTvm.exe
  2⤵
  PID:14808
- C:\Windows\System\LSEmZOW.exe
  C:\Windows\System\LSEmZOW.exe
  2⤵
  PID:6504
- C:\Windows\System\qyxfVfL.exe
  C:\Windows\System\qyxfVfL.exe
  2⤵
  PID:4268
- C:\Windows\System\UlPoNwF.exe
  C:\Windows\System\UlPoNwF.exe
  2⤵
  PID:3920
- C:\Windows\System\GQbpGwy.exe
  C:\Windows\System\GQbpGwy.exe
  2⤵
  PID:4084
- C:\Windows\System\nSSkseE.exe
  C:\Windows\System\nSSkseE.exe
  2⤵
  PID:14904
- C:\Windows\System\WKtzmmC.exe
  C:\Windows\System\WKtzmmC.exe
  2⤵
  PID:14924
- C:\Windows\System\EsBDoSD.exe
  C:\Windows\System\EsBDoSD.exe
  2⤵
  PID:15180
- C:\Windows\System\PGYuJqh.exe
  C:\Windows\System\PGYuJqh.exe
  2⤵
  PID:14936
- C:\Windows\System\VpaJyRP.exe
  C:\Windows\System\VpaJyRP.exe
  2⤵
  PID:14968
- C:\Windows\System\jDjEGuj.exe
  C:\Windows\System\jDjEGuj.exe
  2⤵
  PID:15008
- C:\Windows\System\woxBseX.exe
  C:\Windows\System\woxBseX.exe
  2⤵
  PID:15092
- C:\Windows\System\yTsiKFc.exe
  C:\Windows\System\yTsiKFc.exe
  2⤵
  PID:15316
- C:\Windows\System\IWLyxer.exe
  C:\Windows\System\IWLyxer.exe
  2⤵
  PID:15348
- C:\Windows\System\DaakBtP.exe
  C:\Windows\System\DaakBtP.exe
  2⤵
  PID:6536
- C:\Windows\System\TvvDaxM.exe
  C:\Windows\System\TvvDaxM.exe
  2⤵
  PID:13316
- C:\Windows\System\dgFGgYb.exe
  C:\Windows\System\dgFGgYb.exe
  2⤵
  PID:2964
- C:\Windows\System\WHayBBF.exe
  C:\Windows\System\WHayBBF.exe
  2⤵
  PID:13284
- C:\Windows\System\UQwQbNt.exe
  C:\Windows\System\UQwQbNt.exe
  2⤵
  PID:13956
- C:\Windows\System\FLWQCwP.exe
  C:\Windows\System\FLWQCwP.exe
  2⤵
  PID:14680
- C:\Windows\System\abvZZAs.exe
  C:\Windows\System\abvZZAs.exe
  2⤵
  PID:5048
- C:\Windows\System\IFSSGzH.exe
  C:\Windows\System\IFSSGzH.exe
  2⤵
  PID:15172
- C:\Windows\System\MrbZlKy.exe
  C:\Windows\System\MrbZlKy.exe
  2⤵
  PID:5244
- C:\Windows\System\UPEPbRy.exe
  C:\Windows\System\UPEPbRy.exe
  2⤵
  PID:768
- C:\Windows\System\MuQIHme.exe
  C:\Windows\System\MuQIHme.exe
  2⤵
  PID:3916
- C:\Windows\System\hnRunnz.exe
  C:\Windows\System\hnRunnz.exe
  2⤵
  PID:5588
- C:\Windows\System\EMSSGqL.exe
  C:\Windows\System\EMSSGqL.exe
  2⤵
  PID:6632
- C:\Windows\System\QIBuJxR.exe
  C:\Windows\System\QIBuJxR.exe
  2⤵
  PID:15084
- C:\Windows\System\CnOTyDX.exe
  C:\Windows\System\CnOTyDX.exe
  2⤵
  PID:14972
- C:\Windows\System\Yfjigwu.exe
  C:\Windows\System\Yfjigwu.exe
  2⤵
  PID:6720
- C:\Windows\System\FSrdovf.exe
  C:\Windows\System\FSrdovf.exe
  2⤵
  PID:6744
- C:\Windows\System\llxymog.exe
  C:\Windows\System\llxymog.exe
  2⤵
  PID:6776
- C:\Windows\System\JzBlLUU.exe
  C:\Windows\System\JzBlLUU.exe
  2⤵
  PID:5736
- C:\Windows\System\AgXsZsR.exe
  C:\Windows\System\AgXsZsR.exe
  2⤵
  PID:6884
- C:\Windows\System\jNGOVkW.exe
  C:\Windows\System\jNGOVkW.exe
  2⤵
  PID:5896
- C:\Windows\System\wwZZiQq.exe
  C:\Windows\System\wwZZiQq.exe
  2⤵
  PID:5648
- C:\Windows\System\KEatizB.exe
  C:\Windows\System\KEatizB.exe
  2⤵
  PID:5868
- C:\Windows\System\BLuhDRO.exe
  C:\Windows\System\BLuhDRO.exe
  2⤵
  PID:5760
- C:\Windows\System\KHutnky.exe
  C:\Windows\System\KHutnky.exe
  2⤵
  PID:15200
- C:\Windows\System\ugRoCCs.exe
  C:\Windows\System\ugRoCCs.exe
  2⤵
  PID:7084
- C:\Windows\System\qpBeRtq.exe
  C:\Windows\System\qpBeRtq.exe
  2⤵
  PID:7148
- C:\Windows\System\NzDfslY.exe
  C:\Windows\System\NzDfslY.exe
  2⤵
  PID:3568
- C:\Windows\System\CHpkmLt.exe
  C:\Windows\System\CHpkmLt.exe
  2⤵
  PID:11252
- C:\Windows\System\wRTPwUN.exe
  C:\Windows\System\wRTPwUN.exe
  2⤵
  PID:14652
- C:\Windows\System\muWrFsY.exe
  C:\Windows\System\muWrFsY.exe
  2⤵
  PID:6316
- C:\Windows\System\AaWjJvy.exe
  C:\Windows\System\AaWjJvy.exe
  2⤵
  PID:5968
- C:\Windows\System\eyZQQKq.exe
  C:\Windows\System\eyZQQKq.exe
  2⤵
  PID:14920
- C:\Windows\System\QpksKhT.exe
  C:\Windows\System\QpksKhT.exe
  2⤵
  PID:5944
- C:\Windows\System\yGRdGRB.exe
  C:\Windows\System\yGRdGRB.exe
  2⤵
  PID:13144
- C:\Windows\System\QQJJbAw.exe
  C:\Windows\System\QQJJbAw.exe
  2⤵
  PID:6068
- C:\Windows\System\okKhblm.exe
  C:\Windows\System\okKhblm.exe
  2⤵
  PID:5264
- C:\Windows\System\UFFjZXE.exe
  C:\Windows\System\UFFjZXE.exe
  2⤵
  PID:6804
- C:\Windows\System\KUMdKhb.exe
  C:\Windows\System\KUMdKhb.exe
  2⤵
  PID:6976
- C:\Windows\System\yheOLLl.exe
  C:\Windows\System\yheOLLl.exe
  2⤵
  PID:5368
- C:\Windows\System\IFOsLve.exe
  C:\Windows\System\IFOsLve.exe
  2⤵
  PID:5200
- C:\Windows\System\OktPGCT.exe
  C:\Windows\System\OktPGCT.exe
  2⤵
  PID:4248
- C:\Windows\System\czxRIxL.exe
  C:\Windows\System\czxRIxL.exe
  2⤵
  PID:5380
- C:\Windows\System\dJBNHjA.exe
  C:\Windows\System\dJBNHjA.exe
  2⤵
  PID:2392
- C:\Windows\System\OYPiRUu.exe
  C:\Windows\System\OYPiRUu.exe
  2⤵
  PID:4844
- C:\Windows\System\TJONwal.exe
  C:\Windows\System\TJONwal.exe
  2⤵
  PID:5432
- C:\Windows\System\GdKDuED.exe
  C:\Windows\System\GdKDuED.exe
  2⤵
  PID:3880
- C:\Windows\System\ztPgwDQ.exe
  C:\Windows\System\ztPgwDQ.exe
  2⤵
  PID:6548
- C:\Windows\System\XuhxbNz.exe
  C:\Windows\System\XuhxbNz.exe
  2⤵
  PID:5352
- C:\Windows\System\wmGdDzA.exe
  C:\Windows\System\wmGdDzA.exe
  2⤵
  PID:6636
- C:\Windows\System\aSMANoU.exe
  C:\Windows\System\aSMANoU.exe
  2⤵
  PID:6952
- C:\Windows\System\PPCSgua.exe
  C:\Windows\System\PPCSgua.exe
  2⤵
  PID:14060
- C:\Windows\System\FSwbUhZ.exe
  C:\Windows\System\FSwbUhZ.exe
  2⤵
  PID:1568
- C:\Windows\System\ndVUdZx.exe
  C:\Windows\System\ndVUdZx.exe
  2⤵
  PID:13504
- C:\Windows\System\WWJGUSE.exe
  C:\Windows\System\WWJGUSE.exe
  2⤵
  PID:13456
- C:\Windows\System\ybGRvsL.exe
  C:\Windows\System\ybGRvsL.exe
  2⤵
  PID:13584
- C:\Windows\System\FmTyPaO.exe
  C:\Windows\System\FmTyPaO.exe
  2⤵
  PID:7484
- C:\Windows\System\NgcqCyJ.exe
  C:\Windows\System\NgcqCyJ.exe
  2⤵
  PID:6000
- C:\Windows\System\pQINAgz.exe
  C:\Windows\System\pQINAgz.exe
  2⤵
  PID:14668
- C:\Windows\System\EyomHaQ.exe
  C:\Windows\System\EyomHaQ.exe
  2⤵
  PID:6232
- C:\Windows\System\bAfQuBP.exe
  C:\Windows\System\bAfQuBP.exe
  2⤵
  PID:6012
- C:\Windows\System\lTcIRNY.exe
  C:\Windows\System\lTcIRNY.exe
  2⤵
  PID:6556
- C:\Windows\System\fZJLfwJ.exe
  C:\Windows\System\fZJLfwJ.exe
  2⤵
  PID:14704
- C:\Windows\System\dVDqMem.exe
  C:\Windows\System\dVDqMem.exe
  2⤵
  PID:6124
- C:\Windows\System\WUDrDFG.exe
  C:\Windows\System\WUDrDFG.exe
  2⤵
  PID:6696
- C:\Windows\System\MCguzRr.exe
  C:\Windows\System\MCguzRr.exe
  2⤵
  PID:5520
- C:\Windows\System\pNxhTCn.exe
  C:\Windows\System\pNxhTCn.exe
  2⤵
  PID:14756
- C:\Windows\System\ellVUlc.exe
  C:\Windows\System\ellVUlc.exe
  2⤵
  PID:5700
- C:\Windows\System\lxAnKJe.exe
  C:\Windows\System\lxAnKJe.exe
  2⤵
  PID:15268
- C:\Windows\System\RIbPIdh.exe
  C:\Windows\System\RIbPIdh.exe
  2⤵
  PID:14528
- C:\Windows\System\zRpGeKu.exe
  C:\Windows\System\zRpGeKu.exe
  2⤵
  PID:15312
- C:\Windows\System\VzgMwsy.exe
  C:\Windows\System\VzgMwsy.exe
  2⤵
  PID:6384
- C:\Windows\System\nMekvYl.exe
  C:\Windows\System\nMekvYl.exe
  2⤵
  PID:15056
- C:\Windows\System\DjovPSa.exe
  C:\Windows\System\DjovPSa.exe
  2⤵
  PID:3756
- C:\Windows\System\pHAiALI.exe
  C:\Windows\System\pHAiALI.exe
  2⤵
  PID:5548
- C:\Windows\System\yuQBbdR.exe
  C:\Windows\System\yuQBbdR.exe
  2⤵
  PID:5456
- C:\Windows\System\nyZKFef.exe
  C:\Windows\System\nyZKFef.exe
  2⤵
  PID:15044
- C:\Windows\System\MMGYuaN.exe
  C:\Windows\System\MMGYuaN.exe
  2⤵
  PID:14056
- C:\Windows\System\YDuUzvk.exe
  C:\Windows\System\YDuUzvk.exe
  2⤵
  PID:2300
- C:\Windows\System\XlsZQQx.exe
  C:\Windows\System\XlsZQQx.exe
  2⤵
  PID:4000
- C:\Windows\System\Ovsprcc.exe
  C:\Windows\System\Ovsprcc.exe
  2⤵
  PID:5188
- C:\Windows\System\ECYWkhn.exe
  C:\Windows\System\ECYWkhn.exe
  2⤵
  PID:13868
- C:\Windows\System\kBIYQpU.exe
  C:\Windows\System\kBIYQpU.exe
  2⤵
  PID:7068
- C:\Windows\System\ptMWlro.exe
  C:\Windows\System\ptMWlro.exe
  2⤵
  PID:5436
- C:\Windows\System\ecmieAw.exe
  C:\Windows\System\ecmieAw.exe
  2⤵
  PID:5544
- C:\Windows\System\YGrJsQX.exe
  C:\Windows\System\YGrJsQX.exe
  2⤵
  PID:3248
- C:\Windows\System\HXyWpDK.exe
  C:\Windows\System\HXyWpDK.exe
  2⤵
  PID:15036
- C:\Windows\System\byYGpfM.exe
  C:\Windows\System\byYGpfM.exe
  2⤵
  PID:60
- C:\Windows\System\MMcqDvH.exe
  C:\Windows\System\MMcqDvH.exe
  2⤵
  PID:5340
- C:\Windows\System\igTiAuJ.exe
  C:\Windows\System\igTiAuJ.exe
  2⤵
  PID:5884
- C:\Windows\System\xihejgA.exe
  C:\Windows\System\xihejgA.exe
  2⤵
  PID:2124
- C:\Windows\System\bhcviPw.exe
  C:\Windows\System\bhcviPw.exe
  2⤵
  PID:4344
- C:\Windows\System\cPCrLYu.exe
  C:\Windows\System\cPCrLYu.exe
  2⤵
  PID:376
- C:\Windows\System\NWmmSGh.exe
  C:\Windows\System\NWmmSGh.exe
  2⤵
  PID:6224
- C:\Windows\System\dIdoCdG.exe
  C:\Windows\System\dIdoCdG.exe
  2⤵
  PID:6336
- C:\Windows\System\EYKSCpS.exe
  C:\Windows\System\EYKSCpS.exe
  2⤵
  PID:8736
- C:\Windows\System\BYtwLlN.exe
  C:\Windows\System\BYtwLlN.exe
  2⤵
  PID:7400
- C:\Windows\System\zAglgwC.exe
  C:\Windows\System\zAglgwC.exe
  2⤵
  PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3784 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:14700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AgAArKq.exe

Filesize
2.3MB

MD5
40507b2f67cc28c10155974870b862fd

SHA1
c0436031cd32c7a8b69620643487ca657c03521b

SHA256
0591471c879b815bc1ebd2ab6ab98a7002ccbce022e04c3eeff06f9e5cae1c3f

SHA512
1f16b81c96a785d1d5df2d8a911807fe1d285abb523b3346a20697bfcb7758b640a478fb47200b7392d28cb322b063e63f51b9a5eb28be32ff76afe540b308e9

Download Submit
C:\Windows\System\BrUgIKG.exe

Filesize
2.3MB

MD5
ae7ca3e234fa58104f79d30425c4eeb3

SHA1
6f0c1578d02453f06e60f09e160fb7f66cec31b6

SHA256
514317eab5b0b662090b5b786ed8e59ac5ab15221ac935c90d5cfab0412cfdd2

SHA512
435fc86d4dfc597fc6ead652e1d760adcf0550e654211dc68b38a758e94e83d6e5af753dcc62ac8a497e15174c373b7b5293f448e70ce1e624a4488f8333176d

Download Submit
C:\Windows\System\BsIIeWD.exe

Filesize
2.3MB

MD5
4e5d5d456b1e4741f33be1c7dfde9623

SHA1
64a30fde28cb96c8b5c73adb3eb71ae4ed2ccfda

SHA256
7e68cda32ca19670dfca08f2b4b6117fc641c694d7167dbbe7138376484bda42

SHA512
dc079129a4fb4c1b5f5193de49410fbf67306c3b3bb13b5df0cdb74bcb3cd69408e8672d90e64a4ec589f4d1e666073b3fe788a3b1628c40f373b9197506da73

Download Submit
C:\Windows\System\EnCJckl.exe

Filesize
2.3MB

MD5
ba31a0d2463282bb1b0b76b86c221e60

SHA1
c58a166f40ea1f89800de6ec750b830041a859ca

SHA256
5ecf49d633098e266be483399c35b37a2e97b6fb14dc0cc702da7176c1549284

SHA512
e717058f5b96eb8343e317cdeb88b9f3d7c7a45a07a48084570f0342efa9d85aaab77b56f799ad4045e4a122126d8b8468fb88f81b60363b733c25be684ca938

Download Submit
C:\Windows\System\HCOJLMz.exe

Filesize
2.3MB

MD5
e5a3d279b64c82b1dc84fa9ed544778d

SHA1
148877cac090af2c1e9b172b485e63380f38e8d4

SHA256
119ee51f20ee7182446a0585d88ebaac8fc42748e0229d1bc57db1a0fedc640e

SHA512
e20ccc873589452be34d34eec172ffcc52339a500d266942ab742c1b62d2bc9ae6a850c666608fab2d6dc18d3d84768d4ba41b409fbaadec0cc74b3b2ce422b2

Download Submit
C:\Windows\System\HPxVbWy.exe

Filesize
2.3MB

MD5
e413b93e6125c9df11698bb2df3c9bec

SHA1
c214c131788804cfc5266b0be459bec96a2b9e36

SHA256
9a1fe956a23a0ecc52087bbd96fb874f5b87a35971d964bc69c261e88afddae7

SHA512
ed8147ca077692e4a4b42389c9222c324b7f480d90802f3e5b684bc7f5f03bd25bf50d7524b2e6472f1ac82db3cb0ea5b077be46adb7c4a2e708b4665ffa3bb7

Download Submit
C:\Windows\System\HnCFfQo.exe

Filesize
2.3MB

MD5
066a7408dabfa0d52cb26b2f25b22a0b

SHA1
46ff9ca174b92b7f37ae942848b9d93ca8911611

SHA256
0c5aa306c3e5e5e311703159fa228e41f7a5a396325bc471faa7cf2e79415cc7

SHA512
e0ca3df3b2dad517f2603527e060681d56200f42830452bd54dffa2ad04eade25ca17d70b0f17bd858087ef7fab28c392a580ed289934503a8627ee3c9211e83

Download Submit
C:\Windows\System\JpZBFde.exe

Filesize
2.3MB

MD5
e30529a55f7db7b182c834983d30822a

SHA1
9a86763dde548863e8dbdb4e0ad420c61a640569

SHA256
28ea58a7a499cdc1f00d8f344710b5b50f9b797656345f7e69556b2837980e61

SHA512
223ff5dc1f8c27c717ad9176aa7a4b01a33e29f5f0b70655b72e81ec2417d270d2483742d91fb579a2c9a13b205f4941c36efee550ca52a95f102837688fe11b

Download Submit
C:\Windows\System\KHbnHcw.exe

Filesize
2.3MB

MD5
9be723ec9d600e57e9b23bdf494381c7

SHA1
80fe1985cb5d53aa016b414fcfae04394dd7c963

SHA256
24203cf794ca0aa9eb0b5fd601890601fd50f0b74b1d758cfaf57aab60f11bf2

SHA512
cbabb9a6246e8feda64e95d3f1465165cd684c99112b714776837a030bb6101b49ee623b9b918bcc97f7ec489bbe2313a8d1f7fcadacc6cd6a6c730cc0697935

Download Submit
C:\Windows\System\MbYpxLM.exe

Filesize
2.3MB

MD5
b8f127c714c19c071c045f4ab49a0276

SHA1
5ce46d3d2d7fbf5fb584b779cdb65ea475cd63ad

SHA256
0cfdeea687aee2085a65984d19730a6df2dfdeb5fd6ce9577f0e6e4281a4a504

SHA512
beb8cbb3a4fbadd74a6187007aebc5526c89a84e725d427e8fa924855ccaf7cbc5ec8a9496250bbb5056183da94b62fa92e9593cb2d67b68b10c37bbac17ffb2

Download Submit
C:\Windows\System\OMwXQYy.exe

Filesize
2.3MB

MD5
4e8e6b799b5b34912f44cb2027d9f26e

SHA1
6b4776f82ef6228b6b7a16fe1b28c9bd8ccdb267

SHA256
35deda78a71ddb10e13976d5e62f408bc110a172512a6fd9d58e87a02f23beb8

SHA512
bbc14cd069a0c0c5bc266cd55d2dc3dab9ab6c73a1dc1f6ad31cf3c597e622e5602b1a995092a3dd6c88f597b4b82834e5011dbdcbf247adda3fec43c0dcb46e

Download Submit
C:\Windows\System\RevBSMK.exe

Filesize
2.3MB

MD5
54d45f6429b72d435f29718236a75000

SHA1
44c4ec626089d3293a19f2f5d920068623fb331c

SHA256
cded01e72901b16f05eeac841aca37b4ff2626b0e3266b52c773470f2d8697d1

SHA512
aa03113168c47f0ab8d71df806b3185ecdeceb9f8efc6a7c76d5e44b762cf846f14a19fb33dfb49f31d00131ef21108f9de14c9ae807f837b4235a7e1b47c98f

Download Submit
C:\Windows\System\TsAnaXh.exe

Filesize
2.3MB

MD5
1a2bd499b0c41e997bd18f2f9319c76b

SHA1
566f892e100dc9a95de75960e491e6009ffe02ce

SHA256
a0afa7a20bcd45ed2633d23ae86fbbe063cd0078f1078638d609fdb5f3d1afe3

SHA512
c7e7ca8c24412f84796649c0596357fd1d9f0fed8244d748eace13c9166320df8c66671d322b78acde8ae808c94521d00155d875afd4e4809ab5ba5a07a7c01a

Download Submit
C:\Windows\System\XfQiKiH.exe

Filesize
2.3MB

MD5
addcb2be302cc1307716fd9c1769ccad

SHA1
a62380c1199c19c1e63b59ac2884b66a309b5371

SHA256
83bbb835db85a03f93c19ec58eeeefeab10070ed4e3f1c031fba1e49b6657706

SHA512
b429ec62fffef48d0c6ef4cde09b067bb01eb91070cdfa3c8ba9b6f98ecdde6afdb44e01e0f269b6625373b11df3e610489039d16201152db47054fea12de632

Download Submit
C:\Windows\System\ZpDcZcF.exe

Filesize
2.3MB

MD5
dcb8cf75ee31453e528b9de50a50e4d8

SHA1
3ac21533bbbbe7346fc5d66ee57fa709be021e36

SHA256
cfdcca9edcd325fd1f966e01d79386461dd359fe274accb33289976333d5d803

SHA512
bcc288068506d99810cc252870d0d3c18b3da3f225b6e1ebe772acaede16e173105d9b340429fb9a98af769a10a881d8795a39bef8a441fb04551102cb10a9c3

Download Submit
C:\Windows\System\aqsgvwW.exe

Filesize
2.3MB

MD5
b591be10d541d9b79d80d380bd396381

SHA1
a17d54fbf6822cfd1b14f8161661b1cfc544b17d

SHA256
dabb25ea2e4c7a6802489021481877bb719468a652f3716ff65421670d9bde0b

SHA512
d428d4a7c2330695585691d970e70981916ab2bbcf241d626954c6791a0172969293f1bd4a9b6c53ec2e8e3618a83e5a94cc94b1a49b8ccb5cfee104ee49442e

Download Submit
C:\Windows\System\bKxWKFq.exe

Filesize
2.3MB

MD5
e46143130ec26cb66fa1f39d2bff2864

SHA1
db0376ca88863dd04758f8431167fe5a9fa702e5

SHA256
0fa9bf79bf89c2796312d287602f3514330fe49499fbbb9f3a2d8e17327485f1

SHA512
cd674efe7104446b30e4b1a003fbdc39d58c871c13ecc66a2be6e08c5f6cfcfdc6767cb31aa3b3040b12797152950e721b49ee21ebde04ddbc2181b0eb46d263

Download Submit
C:\Windows\System\bVMLiMu.exe

Filesize
2.3MB

MD5
05e15458045de6f47161f0c83a5542c2

SHA1
51d28931a60c0106dd71a0349f95d57e6ef5c2c3

SHA256
55b6513734dc2da0330c9752ade0b7b340bba1c2b04024becd1a6f2cb0b327c2

SHA512
c7f137bf5b1e7fa9974506a80757fba8c3066166163929120a90e06aaa40fe98718a50477d58de71e4675ebcfc745155a37e34b028ce7abb5ce4bae031a453d0

Download Submit
C:\Windows\System\cpbIDdF.exe

Filesize
2.3MB

MD5
852e47d123e9ebe4699bdea4cd4c0fc8

SHA1
a0a6609a8577034cf630bca8b2f78082b35dc565

SHA256
2ec974fd5e0293026cb8542886be9b50882488da6636f45218940f4140f35dda

SHA512
8b6f1b02ec95d2eaf955eeb45acb5f5e6a69ab3dfa90f9f52fb50b11fd4f9719e1c2eef9134e4a53f05b1371075710776bc5c241ccca285ada9e3577a296209e

Download Submit
C:\Windows\System\eObvJaj.exe

Filesize
2.3MB

MD5
e543fd3b8657d7829d00382e4db1da8c

SHA1
e082450cc0abbdd894cdf8e4ff832386f385224d

SHA256
5cbcd89dd90c50e7ba196767b7c8c099a838eb77ae49942d4bca348de032c5e8

SHA512
c074e9c6d7bc3cf5f298bd817080213fbbcf2f749d0b55a48070ea1a954849c5b89851fa59a55b516c11ddaa775058934ad929b9b6e132488798d90a8ea65550

Download Submit
C:\Windows\System\fXxeKxX.exe

Filesize
2.3MB

MD5
c2507573ad78ecc61cd684c9c9dd6ad1

SHA1
12f8e78c59d4ab0cb21102d639022be73cf2f6c6

SHA256
360291834c3d0ff43d18f9d56e66fe600fead02c06bfaf93a658df132406db05

SHA512
6b7be75a02d660ed5816928c7997ae78e9c475bfbb981265b36901b8c4a94bf02d0c29cfa7082e5253d6ef2f79734d4f10584f7cca8f3300101afbfb08b7809c

Download Submit
C:\Windows\System\jAfYaPP.exe

Filesize
2.3MB

MD5
19c826fea87fe08ea2d191f93b799eb4

SHA1
489f412b2677c288e9204ec2b4ed29c1badd1962

SHA256
b630beaf54f99c1cf03748fb481f5f44c3d23741a3d73de8cb64c016c71a39b2

SHA512
f8c448c6e3ca339c83a75f1c0b413c932b263ef6d97ada38e6cffac02f91d3253944ea2263dc530a73bade2961fde95f86d0360c23b01c62b26a7ebdf3f1f974

Download Submit
C:\Windows\System\ovzcVFq.exe

Filesize
2.3MB

MD5
387afddaa0c954c37507cc5230a6ed8f

SHA1
35b80170a1537a9b5a152e2dfbb8b3ca40191ff7

SHA256
57c8eb1ced8c510a688d667b955f2960934085e031eb9f5ba6619c3edbe94dce

SHA512
64567a673727c382873ec3b837caf0657cb1b2c46c105ca8e02361e2eb9fb0398a535b8becd1e33a69544a6174608b4f5a3b53a28bc43150b83c5fafe97c11c7

Download Submit
C:\Windows\System\pWUPRgs.exe

Filesize
2.3MB

MD5
c0044dde8efefaa63a894d21a5714c4a

SHA1
9921537d0dda4aa174f285b1fddb341d324f9f0a

SHA256
e1a566d01a164176428039028d56cdf065cf64f4bad47bf8232d2f086d6c5af5

SHA512
c6d3d28ac3a652f2ac6e7e8455c636d926bf3b59ee5910aad33c9e82702804454f3138f8c9ce725cb4047e963563638cdc53de05279625018659f790a1fe5f0e

Download Submit
C:\Windows\System\pYodYZO.exe

Filesize
2.3MB

MD5
48d5f03b4cf2aef5a9b87c4034773dd6

SHA1
e8ac50dce5fa2d753d32d40f7ba9eb51c464aea5

SHA256
1b9b69babfdf90863e5d7e04667107eb62004dc70fd2f79d599a96c5ca34cd61

SHA512
ae699c360d1e66f766331ca6fc8507c5faaa2912b3af2096a67765d10c40fb83d1aea99b95199c92bac20c79d47e1b6557cb19f34ca571364193934ef1b59ad9

Download Submit
C:\Windows\System\ruAVUEE.exe

Filesize
2.3MB

MD5
e6b036cdc4ef735562ede7c955a1c0c1

SHA1
1f6a9d4f06eaf8c887b5ffdf98b310bd27f95de9

SHA256
5f4f6eee4eb9db99edb5e81fdd9fa2bb22c5cba124b1cfbda31f3aab620594f6

SHA512
9b7662a4047532e38d037e364fd6668ec48400db088c3c32170d0b7687ae069e0182249a6e619f65f014149dc14147f901d593c1d9de96631d94ecfc79262635

Download Submit
C:\Windows\System\sYZnVtp.exe

Filesize
2.3MB

MD5
05134f578fe27b0fa78b66aaf5ca05a6

SHA1
56a97c3b1298affed4851117f812748a647edffb

SHA256
70e8688253b137c66a9aa7a62732af77f1f0b8d0b19cc0ef0d597aea98cef85f

SHA512
19823895d991fcf306e326a1c72835c22b788ae0b8fd92206dc70e2c10dc0e4b8667845531e414c233a3e051c43a66aab37230fbf7ef525a0a8bfe6e514c422b

Download Submit
C:\Windows\System\wdfcVux.exe

Filesize
2.3MB

MD5
1ba2309cab48e855f9a9130adef2cf60

SHA1
a57d9547934dfe79cf95c05c50a7e1623ca19b98

SHA256
a4c99c52d689d1033a4d44c7b63c115bc1a05e20918803ccaa20b4e3315f89c8

SHA512
6d6c495fef4fa502328a03a60f2e83193d58008a8482ec0cd3525907c9da047d42d9cae47cd4dae73453fce7edeef2d441314e47e1bb0b5291160441f534148c

Download Submit
C:\Windows\System\xrXkqWf.exe

Filesize
2.3MB

MD5
7907f9dab72391c458e59a1e7fc3886b

SHA1
479ea9d3e6cb841137d64ce135def28388d45b2f

SHA256
b20722511f304cf43598d33715749d81ceffd252f5b30085236994c14d8e816d

SHA512
5e55e34569304fde7245d097c5d5a2acfcc933609b28b270aa085a9e9105aee867bed03de378c00265fcc46c2b2168357a49b2b7b7a1c1a5dcba81772c7f0a63

Download Submit
C:\Windows\System\yLAJCUh.exe

Filesize
2.3MB

MD5
675327b952542719cecf9924d8c01692

SHA1
f95f48eced821ea9a2840725d6fe92421dbdbce9

SHA256
10fbc860b940b248a3ed40da6685b1c41c533fc623313b8389315f0088141492

SHA512
306f45b599b6b7fbb0527da5bc4b4fe720659aaba5d908768f67104532be3b1a50923b459e871fd5ec3d8a32ef2eb80b7c142feddc2cbfa4f1aa397a9e52ab65

Download Submit
C:\Windows\System\yUVdpDz.exe

Filesize
2.3MB

MD5
b67df15d675c6392f70b274f32e20f95

SHA1
f1e81e8183bae82e1d5d72b2adf72bd33f06700f

SHA256
8b77d5445f735f0f2021a2fa7e649535c817b0df2516078b596621f555aa135e

SHA512
951a34114a234d36d6478ad21f62e2e94db02ab55528fa8c079cdb9d4fea019182e7e680415b988b6bd5fc2427337bc5175bf9e6360e188c4f6e1474676d9b45

Download Submit
C:\Windows\System\yYIxVKJ.exe

Filesize
2.3MB

MD5
b97db23f7ce2a531fe45dbefa08cfc02

SHA1
657d08a958156fc86a5a9de54c394e0e48e4bea6

SHA256
0df492b955c369bf1c23ef20a308d2bc53eb751cde9f3ed543aec0f6488d6793

SHA512
eec43b0ea6e03e62e6ea0289853e4d2c2d6c1930078a8db20c4879dc43d5fae135db3c10b3d9a0aa63037bb727f043763b667630f969e5a03875a926416aea30

Download Submit
memory/216-518-0x00007FF6220D0000-0x00007FF622424000-memory.dmp

Filesize
3.3MB

Download
memory/216-2087-0x00007FF6220D0000-0x00007FF622424000-memory.dmp

Filesize
3.3MB

Download
memory/724-25-0x00007FF60DE30000-0x00007FF60E184000-memory.dmp

Filesize
3.3MB

Download
memory/724-1993-0x00007FF60DE30000-0x00007FF60E184000-memory.dmp

Filesize
3.3MB

Download
memory/864-446-0x00007FF7C33A0000-0x00007FF7C36F4000-memory.dmp

Filesize
3.3MB

Download
memory/864-2003-0x00007FF7C33A0000-0x00007FF7C36F4000-memory.dmp

Filesize
3.3MB

Download
memory/1012-548-0x00007FF7613F0000-0x00007FF761744000-memory.dmp

Filesize
3.3MB

Download
memory/1012-2110-0x00007FF7613F0000-0x00007FF761744000-memory.dmp

Filesize
3.3MB

Download
memory/1116-456-0x00007FF6825A0000-0x00007FF6828F4000-memory.dmp

Filesize
3.3MB

Download
memory/1116-2010-0x00007FF6825A0000-0x00007FF6828F4000-memory.dmp

Filesize
3.3MB

Download
memory/1296-514-0x00007FF731960000-0x00007FF731CB4000-memory.dmp

Filesize
3.3MB

Download
memory/1616-497-0x00007FF6402F0000-0x00007FF640644000-memory.dmp

Filesize
3.3MB

Download
memory/1616-2033-0x00007FF6402F0000-0x00007FF640644000-memory.dmp

Filesize
3.3MB

Download
memory/1628-2041-0x00007FF69A700000-0x00007FF69AA54000-memory.dmp

Filesize
3.3MB

Download
memory/1628-501-0x00007FF69A700000-0x00007FF69AA54000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2072-0x00007FF764300000-0x00007FF764654000-memory.dmp

Filesize
3.3MB

Download
memory/1652-506-0x00007FF764300000-0x00007FF764654000-memory.dmp

Filesize
3.3MB

Download
memory/1728-523-0x00007FF691EB0000-0x00007FF692204000-memory.dmp

Filesize
3.3MB

Download
memory/1728-2117-0x00007FF691EB0000-0x00007FF692204000-memory.dmp

Filesize
3.3MB

Download
memory/1732-2206-0x00007FF775860000-0x00007FF775BB4000-memory.dmp

Filesize
3.3MB

Download
memory/1732-553-0x00007FF775860000-0x00007FF775BB4000-memory.dmp

Filesize
3.3MB

Download
memory/1768-2005-0x00007FF6B0570000-0x00007FF6B08C4000-memory.dmp

Filesize
3.3MB

Download
memory/1768-452-0x00007FF6B0570000-0x00007FF6B08C4000-memory.dmp

Filesize
3.3MB

Download
memory/1808-508-0x00007FF719150000-0x00007FF7194A4000-memory.dmp

Filesize
3.3MB

Download
memory/2200-2017-0x00007FF681140000-0x00007FF681494000-memory.dmp

Filesize
3.3MB

Download
memory/2200-468-0x00007FF681140000-0x00007FF681494000-memory.dmp

Filesize
3.3MB

Download
memory/2592-1999-0x00007FF6A0610000-0x00007FF6A0964000-memory.dmp

Filesize
3.3MB

Download
memory/2592-443-0x00007FF6A0610000-0x00007FF6A0964000-memory.dmp

Filesize
3.3MB

Download
memory/2620-530-0x00007FF758660000-0x00007FF7589B4000-memory.dmp

Filesize
3.3MB

Download
memory/2620-2199-0x00007FF758660000-0x00007FF7589B4000-memory.dmp

Filesize
3.3MB

Download
memory/2656-531-0x00007FF77F450000-0x00007FF77F7A4000-memory.dmp

Filesize
3.3MB

Download
memory/2656-2121-0x00007FF77F450000-0x00007FF77F7A4000-memory.dmp

Filesize
3.3MB

Download
memory/3112-1996-0x00007FF6FE220000-0x00007FF6FE574000-memory.dmp

Filesize
3.3MB

Download
memory/3112-439-0x00007FF6FE220000-0x00007FF6FE574000-memory.dmp

Filesize
3.3MB

Download
memory/3120-2145-0x00007FF717FC0000-0x00007FF718314000-memory.dmp

Filesize
3.3MB

Download
memory/3120-550-0x00007FF717FC0000-0x00007FF718314000-memory.dmp

Filesize
3.3MB

Download
memory/3164-30-0x00007FF769480000-0x00007FF7697D4000-memory.dmp

Filesize
3.3MB

Download
memory/3164-1995-0x00007FF769480000-0x00007FF7697D4000-memory.dmp

Filesize
3.3MB

Download
memory/3276-534-0x00007FF7FBA50000-0x00007FF7FBDA4000-memory.dmp

Filesize
3.3MB

Download
memory/3276-2205-0x00007FF7FBA50000-0x00007FF7FBDA4000-memory.dmp

Filesize
3.3MB

Download
memory/3280-23-0x00007FF7A5DA0000-0x00007FF7A60F4000-memory.dmp

Filesize
3.3MB

Download
memory/3280-1994-0x00007FF7A5DA0000-0x00007FF7A60F4000-memory.dmp

Filesize
3.3MB

Download
memory/3400-1992-0x00007FF721AC0000-0x00007FF721E14000-memory.dmp

Filesize
3.3MB

Download
memory/3400-21-0x00007FF721AC0000-0x00007FF721E14000-memory.dmp

Filesize
3.3MB

Download
memory/3700-2037-0x00007FF797E60000-0x00007FF7981B4000-memory.dmp

Filesize
3.3MB

Download
memory/3700-481-0x00007FF797E60000-0x00007FF7981B4000-memory.dmp

Filesize
3.3MB

Download
memory/4136-540-0x00007FF66A9C0000-0x00007FF66AD14000-memory.dmp

Filesize
3.3MB

Download
memory/4136-2202-0x00007FF66A9C0000-0x00007FF66AD14000-memory.dmp

Filesize
3.3MB

Download
memory/4208-1991-0x00007FF6DA940000-0x00007FF6DAC94000-memory.dmp

Filesize
3.3MB

Download
memory/4208-8-0x00007FF6DA940000-0x00007FF6DAC94000-memory.dmp

Filesize
3.3MB

Download
memory/4372-488-0x00007FF77D4B0000-0x00007FF77D804000-memory.dmp

Filesize
3.3MB

Download
memory/4372-2026-0x00007FF77D4B0000-0x00007FF77D804000-memory.dmp

Filesize
3.3MB

Download
memory/4444-520-0x00007FF7E8080000-0x00007FF7E83D4000-memory.dmp

Filesize
3.3MB

Download
memory/4892-2025-0x00007FF7970F0000-0x00007FF797444000-memory.dmp

Filesize
3.3MB

Download
memory/4892-475-0x00007FF7970F0000-0x00007FF797444000-memory.dmp

Filesize
3.3MB

Download
memory/4964-1-0x000001D2D0800000-0x000001D2D0810000-memory.dmp

Filesize
64KB

Download
memory/4964-0-0x00007FF62BE80000-0x00007FF62C1D4000-memory.dmp

Filesize
3.3MB

Download
memory/4964-2825-0x00007FF62BE80000-0x00007FF62C1D4000-memory.dmp

Filesize
3.3MB

Download