xmrig | 5b2e01e6abc7b2f78571a66294849f353379c106638fc87fe12c3144306862ff

Analysis

max time kernel
124s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
Size

2.8MB
MD5

a25c5d328829a1d0db2d3c7dda8e3880
SHA1

427af0eca085b4c65c6cb183c05c38cf2165cc33
SHA256

5b2e01e6abc7b2f78571a66294849f353379c106638fc87fe12c3144306862ff
SHA512

fa97c686a27a47617759b6c74dd4466105df823bc0829813f890b95904c4ce2ca641a0b420f33712fb90541ff5147d2409e53841de25c22edced57e770a2fdb8
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHY:BemTLkNdfE0pZrJ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2692-0-0x00007FF7EA3C0000-0x00007FF7EA714000-memory.dmp	xmrig
behavioral2/files/0x00090000000235bb-5.dat	xmrig
behavioral2/files/0x00070000000235c3-7.dat	xmrig
behavioral2/files/0x00070000000235c2-11.dat	xmrig
behavioral2/memory/2252-10-0x00007FF754670000-0x00007FF7549C4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235c4-21.dat	xmrig
behavioral2/files/0x00070000000235ca-56.dat	xmrig
behavioral2/files/0x00070000000235d4-92.dat	xmrig
behavioral2/memory/4996-110-0x00007FF66E6A0000-0x00007FF66E9F4000-memory.dmp	xmrig
behavioral2/memory/2956-126-0x00007FF60C1C0000-0x00007FF60C514000-memory.dmp	xmrig
behavioral2/files/0x00070000000235d9-144.dat	xmrig
behavioral2/memory/380-152-0x00007FF63EF50000-0x00007FF63F2A4000-memory.dmp	xmrig
behavioral2/memory/1000-157-0x00007FF7D8E00000-0x00007FF7D9154000-memory.dmp	xmrig
behavioral2/memory/3312-164-0x00007FF778220000-0x00007FF778574000-memory.dmp	xmrig
behavioral2/memory/4364-163-0x00007FF764870000-0x00007FF764BC4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235db-183.dat	xmrig
behavioral2/memory/1548-213-0x00007FF73D0E0000-0x00007FF73D434000-memory.dmp	xmrig
behavioral2/memory/532-212-0x00007FF6E2D40000-0x00007FF6E3094000-memory.dmp	xmrig
behavioral2/files/0x00070000000235e3-208.dat	xmrig
behavioral2/files/0x00070000000235e2-207.dat	xmrig
behavioral2/files/0x00070000000235dd-205.dat	xmrig
behavioral2/files/0x00070000000235e1-204.dat	xmrig
behavioral2/files/0x00070000000235e0-190.dat	xmrig
behavioral2/files/0x00070000000235df-182.dat	xmrig
behavioral2/files/0x00070000000235de-177.dat	xmrig
behavioral2/memory/1608-162-0x00007FF6B2810000-0x00007FF6B2B64000-memory.dmp	xmrig
behavioral2/memory/2756-161-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	xmrig
behavioral2/memory/4720-160-0x00007FF6926F0000-0x00007FF692A44000-memory.dmp	xmrig
behavioral2/memory/4148-159-0x00007FF6261D0000-0x00007FF626524000-memory.dmp	xmrig
behavioral2/memory/1040-158-0x00007FF647DA0000-0x00007FF6480F4000-memory.dmp	xmrig
behavioral2/memory/3516-156-0x00007FF7DFD50000-0x00007FF7E00A4000-memory.dmp	xmrig
behavioral2/memory/3380-155-0x00007FF6A8210000-0x00007FF6A8564000-memory.dmp	xmrig
behavioral2/memory/4336-154-0x00007FF76FFE0000-0x00007FF770334000-memory.dmp	xmrig
behavioral2/memory/1628-153-0x00007FF712C80000-0x00007FF712FD4000-memory.dmp	xmrig
behavioral2/memory/2740-151-0x00007FF639320000-0x00007FF639674000-memory.dmp	xmrig
behavioral2/memory/4252-150-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235da-148.dat	xmrig
behavioral2/memory/1616-147-0x00007FF6CFF40000-0x00007FF6D0294000-memory.dmp	xmrig
behavioral2/memory/2328-146-0x00007FF6F9950000-0x00007FF6F9CA4000-memory.dmp	xmrig
behavioral2/memory/1064-143-0x00007FF6B6DB0000-0x00007FF6B7104000-memory.dmp	xmrig
behavioral2/memory/3708-141-0x00007FF635D60000-0x00007FF6360B4000-memory.dmp	xmrig
behavioral2/memory/3884-140-0x00007FF7322E0000-0x00007FF732634000-memory.dmp	xmrig
behavioral2/files/0x00080000000235bf-138.dat	xmrig
behavioral2/files/0x00070000000235d7-134.dat	xmrig
behavioral2/files/0x00070000000235d2-132.dat	xmrig
behavioral2/files/0x00070000000235d6-130.dat	xmrig
behavioral2/files/0x00070000000235d8-127.dat	xmrig
behavioral2/files/0x00070000000235cf-122.dat	xmrig
behavioral2/files/0x00070000000235d3-120.dat	xmrig
behavioral2/files/0x00070000000235d1-116.dat	xmrig
behavioral2/files/0x00070000000235d5-113.dat	xmrig
behavioral2/files/0x00070000000235d0-111.dat	xmrig
behavioral2/files/0x00070000000235cd-105.dat	xmrig
behavioral2/files/0x00070000000235cb-99.dat	xmrig
behavioral2/files/0x00070000000235ce-94.dat	xmrig
behavioral2/memory/3260-93-0x00007FF6A6C40000-0x00007FF6A6F94000-memory.dmp	xmrig
behavioral2/files/0x00070000000235cc-83.dat	xmrig
behavioral2/memory/1652-70-0x00007FF70D720000-0x00007FF70DA74000-memory.dmp	xmrig
behavioral2/files/0x00070000000235c9-65.dat	xmrig
behavioral2/files/0x00070000000235c8-80.dat	xmrig
behavioral2/files/0x00070000000235c7-58.dat	xmrig
behavioral2/files/0x00070000000235c6-50.dat	xmrig
behavioral2/memory/4228-37-0x00007FF635FB0000-0x00007FF636304000-memory.dmp	xmrig
behavioral2/files/0x00070000000235c5-28.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2252	lFICjin.exe
2784	dPPEsnG.exe
4228	XKdvRNs.exe
1652	NgHXRoK.exe
1040	uBvMcuW.exe
3260	twNRaBM.exe
4996	fqnxaRt.exe
2956	elOsWXt.exe
3884	tDcBKtN.exe
4148	SJwTbnC.exe
3708	NYevfIE.exe
1064	rpdyEfP.exe
2328	RZuXRNS.exe
4720	cHLgKds.exe
1616	cqLLlul.exe
4252	uMjWEyc.exe
2740	sCJfuho.exe
380	ZCRcDZN.exe
1628	raeJsuf.exe
2756	yGrbRlt.exe
4336	dWhLlwy.exe
3380	aTrTTZO.exe
3516	AZXYGaL.exe
1000	SEglfts.exe
1608	OsvuZnl.exe
4364	ZveLheK.exe
3312	RldKSCG.exe
532	eGWdPVo.exe
1548	ffdCtxp.exe
4588	hTcPHyG.exe
3740	OjPLzKo.exe
232	AuNinwI.exe
388	fRNcSCX.exe
4828	mrTmRcI.exe
2012	bVEQCCN.exe
3184	sMMuZYe.exe
3832	yHHaYHR.exe
3848	MJLNlfq.exe
804	SzKaBMv.exe
4536	YdANDql.exe
1996	BgrPOSt.exe
60	KyIHVUl.exe
3836	ePlfQXm.exe
5164	NAEXwvK.exe
5180	NRaTtra.exe
5196	tfnLBsY.exe
5212	HKlXrzm.exe
5228	TRChjfN.exe
5244	YyWWDmj.exe
5260	XUKGCET.exe
5280	vxCtZJR.exe
5296	xfPqgoJ.exe
5312	jkeBxbU.exe
5328	paVAEvu.exe
5344	TCrekWG.exe
5360	fpwXSim.exe
5376	niaUyyk.exe
5396	NTiXqHM.exe
5412	WvbWJlP.exe
5768	LjVODoj.exe
5788	UIovTRz.exe
5804	iEDxguG.exe
5828	RmscWBw.exe
5868	djhsfPC.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2692-0-0x00007FF7EA3C0000-0x00007FF7EA714000-memory.dmp	upx
behavioral2/files/0x00090000000235bb-5.dat	upx
behavioral2/files/0x00070000000235c3-7.dat	upx
behavioral2/files/0x00070000000235c2-11.dat	upx
behavioral2/memory/2252-10-0x00007FF754670000-0x00007FF7549C4000-memory.dmp	upx
behavioral2/files/0x00070000000235c4-21.dat	upx
behavioral2/files/0x00070000000235ca-56.dat	upx
behavioral2/files/0x00070000000235d4-92.dat	upx
behavioral2/memory/4996-110-0x00007FF66E6A0000-0x00007FF66E9F4000-memory.dmp	upx
behavioral2/memory/2956-126-0x00007FF60C1C0000-0x00007FF60C514000-memory.dmp	upx
behavioral2/files/0x00070000000235d9-144.dat	upx
behavioral2/memory/380-152-0x00007FF63EF50000-0x00007FF63F2A4000-memory.dmp	upx
behavioral2/memory/1000-157-0x00007FF7D8E00000-0x00007FF7D9154000-memory.dmp	upx
behavioral2/memory/3312-164-0x00007FF778220000-0x00007FF778574000-memory.dmp	upx
behavioral2/memory/4364-163-0x00007FF764870000-0x00007FF764BC4000-memory.dmp	upx
behavioral2/files/0x00070000000235db-183.dat	upx
behavioral2/memory/1548-213-0x00007FF73D0E0000-0x00007FF73D434000-memory.dmp	upx
behavioral2/memory/532-212-0x00007FF6E2D40000-0x00007FF6E3094000-memory.dmp	upx
behavioral2/files/0x00070000000235e3-208.dat	upx
behavioral2/files/0x00070000000235e2-207.dat	upx
behavioral2/files/0x00070000000235dd-205.dat	upx
behavioral2/files/0x00070000000235e1-204.dat	upx
behavioral2/files/0x00070000000235e0-190.dat	upx
behavioral2/files/0x00070000000235df-182.dat	upx
behavioral2/files/0x00070000000235de-177.dat	upx
behavioral2/memory/1608-162-0x00007FF6B2810000-0x00007FF6B2B64000-memory.dmp	upx
behavioral2/memory/2756-161-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	upx
behavioral2/memory/4720-160-0x00007FF6926F0000-0x00007FF692A44000-memory.dmp	upx
behavioral2/memory/4148-159-0x00007FF6261D0000-0x00007FF626524000-memory.dmp	upx
behavioral2/memory/1040-158-0x00007FF647DA0000-0x00007FF6480F4000-memory.dmp	upx
behavioral2/memory/3516-156-0x00007FF7DFD50000-0x00007FF7E00A4000-memory.dmp	upx
behavioral2/memory/3380-155-0x00007FF6A8210000-0x00007FF6A8564000-memory.dmp	upx
behavioral2/memory/4336-154-0x00007FF76FFE0000-0x00007FF770334000-memory.dmp	upx
behavioral2/memory/1628-153-0x00007FF712C80000-0x00007FF712FD4000-memory.dmp	upx
behavioral2/memory/2740-151-0x00007FF639320000-0x00007FF639674000-memory.dmp	upx
behavioral2/memory/4252-150-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	upx
behavioral2/files/0x00070000000235da-148.dat	upx
behavioral2/memory/1616-147-0x00007FF6CFF40000-0x00007FF6D0294000-memory.dmp	upx
behavioral2/memory/2328-146-0x00007FF6F9950000-0x00007FF6F9CA4000-memory.dmp	upx
behavioral2/memory/1064-143-0x00007FF6B6DB0000-0x00007FF6B7104000-memory.dmp	upx
behavioral2/memory/3708-141-0x00007FF635D60000-0x00007FF6360B4000-memory.dmp	upx
behavioral2/memory/3884-140-0x00007FF7322E0000-0x00007FF732634000-memory.dmp	upx
behavioral2/files/0x00080000000235bf-138.dat	upx
behavioral2/files/0x00070000000235d7-134.dat	upx
behavioral2/files/0x00070000000235d2-132.dat	upx
behavioral2/files/0x00070000000235d6-130.dat	upx
behavioral2/files/0x00070000000235d8-127.dat	upx
behavioral2/files/0x00070000000235cf-122.dat	upx
behavioral2/files/0x00070000000235d3-120.dat	upx
behavioral2/files/0x00070000000235d1-116.dat	upx
behavioral2/files/0x00070000000235d5-113.dat	upx
behavioral2/files/0x00070000000235d0-111.dat	upx
behavioral2/files/0x00070000000235cd-105.dat	upx
behavioral2/files/0x00070000000235cb-99.dat	upx
behavioral2/files/0x00070000000235ce-94.dat	upx
behavioral2/memory/3260-93-0x00007FF6A6C40000-0x00007FF6A6F94000-memory.dmp	upx
behavioral2/files/0x00070000000235cc-83.dat	upx
behavioral2/memory/1652-70-0x00007FF70D720000-0x00007FF70DA74000-memory.dmp	upx
behavioral2/files/0x00070000000235c9-65.dat	upx
behavioral2/files/0x00070000000235c8-80.dat	upx
behavioral2/files/0x00070000000235c7-58.dat	upx
behavioral2/files/0x00070000000235c6-50.dat	upx
behavioral2/memory/4228-37-0x00007FF635FB0000-0x00007FF636304000-memory.dmp	upx
behavioral2/files/0x00070000000235c5-28.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jhcIPal.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\ZRbTtzw.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\XgpvpKT.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\gpluWyb.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\BnoIzvw.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\nlWKGnJ.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\DkzaqOo.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\KlWSKhm.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\MPSUdOg.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\lCTrvEp.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\tlAloZY.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\aAKSwjx.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\NqCCJUa.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\zvrymhP.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\SxGUWRQ.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\KXutTaW.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\AQyHmFd.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\xfPqgoJ.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\VJuTXMk.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\zGTdeaW.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\RutFNxz.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\rYOWHSg.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\bgDqSDa.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\ffgdDEE.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\szaCbNg.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\agVUvqF.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\OaPxqXP.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\yOLcEOm.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\ePlfQXm.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\dMWxCAD.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\xJaBrVH.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\PMLxkEC.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\PArwdhR.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\SjYgNxW.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\UBlNCjm.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\jQVNCLk.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\pUIOMyx.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\SvHQCpQ.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\WhLhePs.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\etFPgzK.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\ajxUmCk.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\YApjGMk.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\zegreCJ.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\opAEoYi.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\GAUiBnT.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\TsKwOhs.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\QqGAAcr.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\cBBveFu.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\ypjIdcG.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\iuwvKfR.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\DziERZE.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\miWLsZB.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\eLsQDaQ.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\CBZnMpM.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\rpdyEfP.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\RLlTZrp.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\VVjuTlM.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\nSewlYl.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\OLpEWTI.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\hYMaOjO.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\ROBhdPj.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\UmZmnBA.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\Yfxtuqg.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
File created	C:\Windows\System\joQHpvP.exe	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2252	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	91
PID 2692 wrote to memory of 2252	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	91
PID 2692 wrote to memory of 2784	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	92
PID 2692 wrote to memory of 2784	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	92
PID 2692 wrote to memory of 4228	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	93
PID 2692 wrote to memory of 4228	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	93
PID 2692 wrote to memory of 1652	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	94
PID 2692 wrote to memory of 1652	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	94
PID 2692 wrote to memory of 1040	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	95
PID 2692 wrote to memory of 1040	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	95
PID 2692 wrote to memory of 3260	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	96
PID 2692 wrote to memory of 3260	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	96
PID 2692 wrote to memory of 4996	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	97
PID 2692 wrote to memory of 4996	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	97
PID 2692 wrote to memory of 2956	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	98
PID 2692 wrote to memory of 2956	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	98
PID 2692 wrote to memory of 3884	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	99
PID 2692 wrote to memory of 3884	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	99
PID 2692 wrote to memory of 4148	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	100
PID 2692 wrote to memory of 4148	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	100
PID 2692 wrote to memory of 3708	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	101
PID 2692 wrote to memory of 3708	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	101
PID 2692 wrote to memory of 1064	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	102
PID 2692 wrote to memory of 1064	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	102
PID 2692 wrote to memory of 2328	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	103
PID 2692 wrote to memory of 2328	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	103
PID 2692 wrote to memory of 2740	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	104
PID 2692 wrote to memory of 2740	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	104
PID 2692 wrote to memory of 380	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	105
PID 2692 wrote to memory of 380	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	105
PID 2692 wrote to memory of 4720	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	106
PID 2692 wrote to memory of 4720	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	106
PID 2692 wrote to memory of 1616	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	107
PID 2692 wrote to memory of 1616	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	107
PID 2692 wrote to memory of 3380	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	108
PID 2692 wrote to memory of 3380	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	108
PID 2692 wrote to memory of 4252	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	109
PID 2692 wrote to memory of 4252	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	109
PID 2692 wrote to memory of 1628	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	110
PID 2692 wrote to memory of 1628	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	110
PID 2692 wrote to memory of 2756	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	111
PID 2692 wrote to memory of 2756	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	111
PID 2692 wrote to memory of 4336	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	112
PID 2692 wrote to memory of 4336	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	112
PID 2692 wrote to memory of 3516	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	113
PID 2692 wrote to memory of 3516	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	113
PID 2692 wrote to memory of 1000	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	114
PID 2692 wrote to memory of 1000	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	114
PID 2692 wrote to memory of 1608	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	115
PID 2692 wrote to memory of 1608	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	115
PID 2692 wrote to memory of 4364	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	116
PID 2692 wrote to memory of 4364	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	116
PID 2692 wrote to memory of 3312	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	117
PID 2692 wrote to memory of 3312	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	117
PID 2692 wrote to memory of 532	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	118
PID 2692 wrote to memory of 532	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	118
PID 2692 wrote to memory of 1548	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	119
PID 2692 wrote to memory of 1548	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	119
PID 2692 wrote to memory of 4588	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	120
PID 2692 wrote to memory of 4588	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	120
PID 2692 wrote to memory of 3740	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	121
PID 2692 wrote to memory of 3740	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	121
PID 2692 wrote to memory of 232	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	122
PID 2692 wrote to memory of 232	2692	a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a25c5d328829a1d0db2d3c7dda8e3880_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System\lFICjin.exe
  C:\Windows\System\lFICjin.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\dPPEsnG.exe
  C:\Windows\System\dPPEsnG.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\XKdvRNs.exe
  C:\Windows\System\XKdvRNs.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\NgHXRoK.exe
  C:\Windows\System\NgHXRoK.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\uBvMcuW.exe
  C:\Windows\System\uBvMcuW.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\twNRaBM.exe
  C:\Windows\System\twNRaBM.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\fqnxaRt.exe
  C:\Windows\System\fqnxaRt.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\elOsWXt.exe
  C:\Windows\System\elOsWXt.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\tDcBKtN.exe
  C:\Windows\System\tDcBKtN.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\SJwTbnC.exe
  C:\Windows\System\SJwTbnC.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\NYevfIE.exe
  C:\Windows\System\NYevfIE.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\rpdyEfP.exe
  C:\Windows\System\rpdyEfP.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\RZuXRNS.exe
  C:\Windows\System\RZuXRNS.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\sCJfuho.exe
  C:\Windows\System\sCJfuho.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\ZCRcDZN.exe
  C:\Windows\System\ZCRcDZN.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\cHLgKds.exe
  C:\Windows\System\cHLgKds.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\cqLLlul.exe
  C:\Windows\System\cqLLlul.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\aTrTTZO.exe
  C:\Windows\System\aTrTTZO.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\uMjWEyc.exe
  C:\Windows\System\uMjWEyc.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\raeJsuf.exe
  C:\Windows\System\raeJsuf.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\yGrbRlt.exe
  C:\Windows\System\yGrbRlt.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\dWhLlwy.exe
  C:\Windows\System\dWhLlwy.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\AZXYGaL.exe
  C:\Windows\System\AZXYGaL.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\SEglfts.exe
  C:\Windows\System\SEglfts.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\OsvuZnl.exe
  C:\Windows\System\OsvuZnl.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\ZveLheK.exe
  C:\Windows\System\ZveLheK.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\RldKSCG.exe
  C:\Windows\System\RldKSCG.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\eGWdPVo.exe
  C:\Windows\System\eGWdPVo.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\ffdCtxp.exe
  C:\Windows\System\ffdCtxp.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\hTcPHyG.exe
  C:\Windows\System\hTcPHyG.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\OjPLzKo.exe
  C:\Windows\System\OjPLzKo.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\AuNinwI.exe
  C:\Windows\System\AuNinwI.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\fRNcSCX.exe
  C:\Windows\System\fRNcSCX.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\mrTmRcI.exe
  C:\Windows\System\mrTmRcI.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\bVEQCCN.exe
  C:\Windows\System\bVEQCCN.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\sMMuZYe.exe
  C:\Windows\System\sMMuZYe.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\yHHaYHR.exe
  C:\Windows\System\yHHaYHR.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\MJLNlfq.exe
  C:\Windows\System\MJLNlfq.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\SzKaBMv.exe
  C:\Windows\System\SzKaBMv.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\YdANDql.exe
  C:\Windows\System\YdANDql.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\BgrPOSt.exe
  C:\Windows\System\BgrPOSt.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\KyIHVUl.exe
  C:\Windows\System\KyIHVUl.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\ePlfQXm.exe
  C:\Windows\System\ePlfQXm.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\NAEXwvK.exe
  C:\Windows\System\NAEXwvK.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\NRaTtra.exe
  C:\Windows\System\NRaTtra.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\tfnLBsY.exe
  C:\Windows\System\tfnLBsY.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\HKlXrzm.exe
  C:\Windows\System\HKlXrzm.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\TRChjfN.exe
  C:\Windows\System\TRChjfN.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\YyWWDmj.exe
  C:\Windows\System\YyWWDmj.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\XUKGCET.exe
  C:\Windows\System\XUKGCET.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\vxCtZJR.exe
  C:\Windows\System\vxCtZJR.exe
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Windows\System\xfPqgoJ.exe
  C:\Windows\System\xfPqgoJ.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\jkeBxbU.exe
  C:\Windows\System\jkeBxbU.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\paVAEvu.exe
  C:\Windows\System\paVAEvu.exe
  2⤵
  - Executes dropped EXE
  PID:5328
- C:\Windows\System\TCrekWG.exe
  C:\Windows\System\TCrekWG.exe
  2⤵
  - Executes dropped EXE
  PID:5344
- C:\Windows\System\fpwXSim.exe
  C:\Windows\System\fpwXSim.exe
  2⤵
  - Executes dropped EXE
  PID:5360
- C:\Windows\System\niaUyyk.exe
  C:\Windows\System\niaUyyk.exe
  2⤵
  - Executes dropped EXE
  PID:5376
- C:\Windows\System\NTiXqHM.exe
  C:\Windows\System\NTiXqHM.exe
  2⤵
  - Executes dropped EXE
  PID:5396
- C:\Windows\System\WvbWJlP.exe
  C:\Windows\System\WvbWJlP.exe
  2⤵
  - Executes dropped EXE
  PID:5412
- C:\Windows\System\LjVODoj.exe
  C:\Windows\System\LjVODoj.exe
  2⤵
  - Executes dropped EXE
  PID:5768
- C:\Windows\System\UIovTRz.exe
  C:\Windows\System\UIovTRz.exe
  2⤵
  - Executes dropped EXE
  PID:5788
- C:\Windows\System\iEDxguG.exe
  C:\Windows\System\iEDxguG.exe
  2⤵
  - Executes dropped EXE
  PID:5804
- C:\Windows\System\RmscWBw.exe
  C:\Windows\System\RmscWBw.exe
  2⤵
  - Executes dropped EXE
  PID:5828
- C:\Windows\System\djhsfPC.exe
  C:\Windows\System\djhsfPC.exe
  2⤵
  - Executes dropped EXE
  PID:5868
- C:\Windows\System\ppzBBjc.exe
  C:\Windows\System\ppzBBjc.exe
  2⤵
  PID:5900
- C:\Windows\System\UmZmnBA.exe
  C:\Windows\System\UmZmnBA.exe
  2⤵
  PID:5932
- C:\Windows\System\QehMJvp.exe
  C:\Windows\System\QehMJvp.exe
  2⤵
  PID:5956
- C:\Windows\System\LUrlpav.exe
  C:\Windows\System\LUrlpav.exe
  2⤵
  PID:5996
- C:\Windows\System\WuHGFMN.exe
  C:\Windows\System\WuHGFMN.exe
  2⤵
  PID:6036
- C:\Windows\System\ypjIdcG.exe
  C:\Windows\System\ypjIdcG.exe
  2⤵
  PID:6068
- C:\Windows\System\HjtKAUG.exe
  C:\Windows\System\HjtKAUG.exe
  2⤵
  PID:6096
- C:\Windows\System\UxmezLt.exe
  C:\Windows\System\UxmezLt.exe
  2⤵
  PID:6124
- C:\Windows\System\lNRiMNp.exe
  C:\Windows\System\lNRiMNp.exe
  2⤵
  PID:4788
- C:\Windows\System\jyUmaqH.exe
  C:\Windows\System\jyUmaqH.exe
  2⤵
  PID:5080
- C:\Windows\System\CGZlEed.exe
  C:\Windows\System\CGZlEed.exe
  2⤵
  PID:1392
- C:\Windows\System\uSEqbof.exe
  C:\Windows\System\uSEqbof.exe
  2⤵
  PID:2160
- C:\Windows\System\TswlfZI.exe
  C:\Windows\System\TswlfZI.exe
  2⤵
  PID:5112
- C:\Windows\System\fAXMeyi.exe
  C:\Windows\System\fAXMeyi.exe
  2⤵
  PID:5176
- C:\Windows\System\SjYgNxW.exe
  C:\Windows\System\SjYgNxW.exe
  2⤵
  PID:5240
- C:\Windows\System\EtFGjeS.exe
  C:\Windows\System\EtFGjeS.exe
  2⤵
  PID:5288
- C:\Windows\System\NHQbYZJ.exe
  C:\Windows\System\NHQbYZJ.exe
  2⤵
  PID:5356
- C:\Windows\System\bZUtwVg.exe
  C:\Windows\System\bZUtwVg.exe
  2⤵
  PID:5392
- C:\Windows\System\PhAEwbO.exe
  C:\Windows\System\PhAEwbO.exe
  2⤵
  PID:5512
- C:\Windows\System\VVjuTlM.exe
  C:\Windows\System\VVjuTlM.exe
  2⤵
  PID:536
- C:\Windows\System\etFPgzK.exe
  C:\Windows\System\etFPgzK.exe
  2⤵
  PID:3264
- C:\Windows\System\vIVrZqe.exe
  C:\Windows\System\vIVrZqe.exe
  2⤵
  PID:2792
- C:\Windows\System\uIByfZw.exe
  C:\Windows\System\uIByfZw.exe
  2⤵
  PID:4836
- C:\Windows\System\OHrTuOj.exe
  C:\Windows\System\OHrTuOj.exe
  2⤵
  PID:2336
- C:\Windows\System\AbUxnDM.exe
  C:\Windows\System\AbUxnDM.exe
  2⤵
  PID:1516
- C:\Windows\System\VJuTXMk.exe
  C:\Windows\System\VJuTXMk.exe
  2⤵
  PID:2356
- C:\Windows\System\EYIQGir.exe
  C:\Windows\System\EYIQGir.exe
  2⤵
  PID:4604
- C:\Windows\System\wpBPACY.exe
  C:\Windows\System\wpBPACY.exe
  2⤵
  PID:4140
- C:\Windows\System\LVnbYnq.exe
  C:\Windows\System\LVnbYnq.exe
  2⤵
  PID:3416
- C:\Windows\System\PrOKRfc.exe
  C:\Windows\System\PrOKRfc.exe
  2⤵
  PID:2264
- C:\Windows\System\UBoJyhB.exe
  C:\Windows\System\UBoJyhB.exe
  2⤵
  PID:1380
- C:\Windows\System\BedmwmU.exe
  C:\Windows\System\BedmwmU.exe
  2⤵
  PID:2320
- C:\Windows\System\rMrXsOv.exe
  C:\Windows\System\rMrXsOv.exe
  2⤵
  PID:5088
- C:\Windows\System\rCNdjHX.exe
  C:\Windows\System\rCNdjHX.exe
  2⤵
  PID:5744
- C:\Windows\System\ahsCkVT.exe
  C:\Windows\System\ahsCkVT.exe
  2⤵
  PID:5756
- C:\Windows\System\zgoMJle.exe
  C:\Windows\System\zgoMJle.exe
  2⤵
  PID:5708
- C:\Windows\System\hagHWYK.exe
  C:\Windows\System\hagHWYK.exe
  2⤵
  PID:5908
- C:\Windows\System\hFAwhen.exe
  C:\Windows\System\hFAwhen.exe
  2⤵
  PID:5952
- C:\Windows\System\IKBwDBe.exe
  C:\Windows\System\IKBwDBe.exe
  2⤵
  PID:6024
- C:\Windows\System\jhcIPal.exe
  C:\Windows\System\jhcIPal.exe
  2⤵
  PID:6064
- C:\Windows\System\HbZBogL.exe
  C:\Windows\System\HbZBogL.exe
  2⤵
  PID:4980
- C:\Windows\System\CyCFted.exe
  C:\Windows\System\CyCFted.exe
  2⤵
  PID:1292
- C:\Windows\System\WTecFsK.exe
  C:\Windows\System\WTecFsK.exe
  2⤵
  PID:3008
- C:\Windows\System\ajxUmCk.exe
  C:\Windows\System\ajxUmCk.exe
  2⤵
  PID:5308
- C:\Windows\System\ZYQxhYk.exe
  C:\Windows\System\ZYQxhYk.exe
  2⤵
  PID:5384
- C:\Windows\System\CGKtcnU.exe
  C:\Windows\System\CGKtcnU.exe
  2⤵
  PID:5568
- C:\Windows\System\UOvfKLH.exe
  C:\Windows\System\UOvfKLH.exe
  2⤵
  PID:4908
- C:\Windows\System\aAKSwjx.exe
  C:\Windows\System\aAKSwjx.exe
  2⤵
  PID:1604
- C:\Windows\System\ltWBwpT.exe
  C:\Windows\System\ltWBwpT.exe
  2⤵
  PID:436
- C:\Windows\System\ZKOQKJd.exe
  C:\Windows\System\ZKOQKJd.exe
  2⤵
  PID:3296
- C:\Windows\System\eBOczvc.exe
  C:\Windows\System\eBOczvc.exe
  2⤵
  PID:5144
- C:\Windows\System\HBazpqX.exe
  C:\Windows\System\HBazpqX.exe
  2⤵
  PID:5820
- C:\Windows\System\TZqEAsz.exe
  C:\Windows\System\TZqEAsz.exe
  2⤵
  PID:5912
- C:\Windows\System\rbIUqNy.exe
  C:\Windows\System\rbIUqNy.exe
  2⤵
  PID:6056
- C:\Windows\System\fSqWLnV.exe
  C:\Windows\System\fSqWLnV.exe
  2⤵
  PID:6140
- C:\Windows\System\JEbOgoC.exe
  C:\Windows\System\JEbOgoC.exe
  2⤵
  PID:5224
- C:\Windows\System\PHLEXkR.exe
  C:\Windows\System\PHLEXkR.exe
  2⤵
  PID:4972
- C:\Windows\System\UDvJcwh.exe
  C:\Windows\System\UDvJcwh.exe
  2⤵
  PID:3864
- C:\Windows\System\ILsiiwv.exe
  C:\Windows\System\ILsiiwv.exe
  2⤵
  PID:5928
- C:\Windows\System\CAVBnrd.exe
  C:\Windows\System\CAVBnrd.exe
  2⤵
  PID:5720
- C:\Windows\System\RtVgVcx.exe
  C:\Windows\System\RtVgVcx.exe
  2⤵
  PID:4508
- C:\Windows\System\OVdpGZH.exe
  C:\Windows\System\OVdpGZH.exe
  2⤵
  PID:6020
- C:\Windows\System\ffgdDEE.exe
  C:\Windows\System\ffgdDEE.exe
  2⤵
  PID:6156
- C:\Windows\System\MpWymok.exe
  C:\Windows\System\MpWymok.exe
  2⤵
  PID:6192
- C:\Windows\System\iTQstLp.exe
  C:\Windows\System\iTQstLp.exe
  2⤵
  PID:6216
- C:\Windows\System\GIGerCt.exe
  C:\Windows\System\GIGerCt.exe
  2⤵
  PID:6252
- C:\Windows\System\RasqBfA.exe
  C:\Windows\System\RasqBfA.exe
  2⤵
  PID:6292
- C:\Windows\System\CjduTbP.exe
  C:\Windows\System\CjduTbP.exe
  2⤵
  PID:6328
- C:\Windows\System\MTGBjHR.exe
  C:\Windows\System\MTGBjHR.exe
  2⤵
  PID:6356
- C:\Windows\System\jZGHyGu.exe
  C:\Windows\System\jZGHyGu.exe
  2⤵
  PID:6400
- C:\Windows\System\vTeNJTr.exe
  C:\Windows\System\vTeNJTr.exe
  2⤵
  PID:6428
- C:\Windows\System\NqCCJUa.exe
  C:\Windows\System\NqCCJUa.exe
  2⤵
  PID:6444
- C:\Windows\System\NNUeitb.exe
  C:\Windows\System\NNUeitb.exe
  2⤵
  PID:6472
- C:\Windows\System\ycHLtHO.exe
  C:\Windows\System\ycHLtHO.exe
  2⤵
  PID:6512
- C:\Windows\System\FFUsyWw.exe
  C:\Windows\System\FFUsyWw.exe
  2⤵
  PID:6544
- C:\Windows\System\CiOhssL.exe
  C:\Windows\System\CiOhssL.exe
  2⤵
  PID:6576
- C:\Windows\System\bTCMVIX.exe
  C:\Windows\System\bTCMVIX.exe
  2⤵
  PID:6612
- C:\Windows\System\fJvwgEI.exe
  C:\Windows\System\fJvwgEI.exe
  2⤵
  PID:6632
- C:\Windows\System\sWFYVdH.exe
  C:\Windows\System\sWFYVdH.exe
  2⤵
  PID:6664
- C:\Windows\System\yyuxgyh.exe
  C:\Windows\System\yyuxgyh.exe
  2⤵
  PID:6700
- C:\Windows\System\TdHmWVs.exe
  C:\Windows\System\TdHmWVs.exe
  2⤵
  PID:6732
- C:\Windows\System\izoXWXT.exe
  C:\Windows\System\izoXWXT.exe
  2⤵
  PID:6764
- C:\Windows\System\LmAjMCf.exe
  C:\Windows\System\LmAjMCf.exe
  2⤵
  PID:6800
- C:\Windows\System\napGhER.exe
  C:\Windows\System\napGhER.exe
  2⤵
  PID:6824
- C:\Windows\System\dlKkCfQ.exe
  C:\Windows\System\dlKkCfQ.exe
  2⤵
  PID:6844
- C:\Windows\System\Vwqzlgi.exe
  C:\Windows\System\Vwqzlgi.exe
  2⤵
  PID:6872
- C:\Windows\System\pxdfmcw.exe
  C:\Windows\System\pxdfmcw.exe
  2⤵
  PID:6900
- C:\Windows\System\szaCbNg.exe
  C:\Windows\System\szaCbNg.exe
  2⤵
  PID:6944
- C:\Windows\System\OlqPbrH.exe
  C:\Windows\System\OlqPbrH.exe
  2⤵
  PID:6980
- C:\Windows\System\LXlwiLf.exe
  C:\Windows\System\LXlwiLf.exe
  2⤵
  PID:7004
- C:\Windows\System\mWXoTcu.exe
  C:\Windows\System\mWXoTcu.exe
  2⤵
  PID:7040
- C:\Windows\System\KPGMwGg.exe
  C:\Windows\System\KPGMwGg.exe
  2⤵
  PID:7088
- C:\Windows\System\VODxxHY.exe
  C:\Windows\System\VODxxHY.exe
  2⤵
  PID:7108
- C:\Windows\System\YtBPSAa.exe
  C:\Windows\System\YtBPSAa.exe
  2⤵
  PID:7140
- C:\Windows\System\PhOhwlp.exe
  C:\Windows\System\PhOhwlp.exe
  2⤵
  PID:6168
- C:\Windows\System\nlxzTKm.exe
  C:\Windows\System\nlxzTKm.exe
  2⤵
  PID:6228
- C:\Windows\System\ARfsmvc.exe
  C:\Windows\System\ARfsmvc.exe
  2⤵
  PID:6320
- C:\Windows\System\pFGlZhc.exe
  C:\Windows\System\pFGlZhc.exe
  2⤵
  PID:6368
- C:\Windows\System\ohzoLyb.exe
  C:\Windows\System\ohzoLyb.exe
  2⤵
  PID:6416
- C:\Windows\System\KlsEFja.exe
  C:\Windows\System\KlsEFja.exe
  2⤵
  PID:6456
- C:\Windows\System\PlVkouG.exe
  C:\Windows\System\PlVkouG.exe
  2⤵
  PID:6540
- C:\Windows\System\yQhqwlA.exe
  C:\Windows\System\yQhqwlA.exe
  2⤵
  PID:6624
- C:\Windows\System\SOXVqGt.exe
  C:\Windows\System\SOXVqGt.exe
  2⤵
  PID:6724
- C:\Windows\System\uaQcbJH.exe
  C:\Windows\System\uaQcbJH.exe
  2⤵
  PID:6780
- C:\Windows\System\ZItPRhD.exe
  C:\Windows\System\ZItPRhD.exe
  2⤵
  PID:6916
- C:\Windows\System\EeMswGi.exe
  C:\Windows\System\EeMswGi.exe
  2⤵
  PID:7024
- C:\Windows\System\cjflPPH.exe
  C:\Windows\System\cjflPPH.exe
  2⤵
  PID:7056
- C:\Windows\System\AsbYSUO.exe
  C:\Windows\System\AsbYSUO.exe
  2⤵
  PID:7128
- C:\Windows\System\vfugpAM.exe
  C:\Windows\System\vfugpAM.exe
  2⤵
  PID:6264
- C:\Windows\System\AgDzBbI.exe
  C:\Windows\System\AgDzBbI.exe
  2⤵
  PID:3804
- C:\Windows\System\uACSPwz.exe
  C:\Windows\System\uACSPwz.exe
  2⤵
  PID:6340
- C:\Windows\System\DTBXeeL.exe
  C:\Windows\System\DTBXeeL.exe
  2⤵
  PID:6484
- C:\Windows\System\wasQfha.exe
  C:\Windows\System\wasQfha.exe
  2⤵
  PID:6688
- C:\Windows\System\afWveUu.exe
  C:\Windows\System\afWveUu.exe
  2⤵
  PID:6864
- C:\Windows\System\nSewlYl.exe
  C:\Windows\System\nSewlYl.exe
  2⤵
  PID:7136
- C:\Windows\System\FdcecNj.exe
  C:\Windows\System\FdcecNj.exe
  2⤵
  PID:6620
- C:\Windows\System\hnBsbzR.exe
  C:\Windows\System\hnBsbzR.exe
  2⤵
  PID:6888
- C:\Windows\System\iuwvKfR.exe
  C:\Windows\System\iuwvKfR.exe
  2⤵
  PID:7212
- C:\Windows\System\oMWVuwf.exe
  C:\Windows\System\oMWVuwf.exe
  2⤵
  PID:7240
- C:\Windows\System\dMWxCAD.exe
  C:\Windows\System\dMWxCAD.exe
  2⤵
  PID:7272
- C:\Windows\System\IxKkDyu.exe
  C:\Windows\System\IxKkDyu.exe
  2⤵
  PID:7308
- C:\Windows\System\BTxUTCX.exe
  C:\Windows\System\BTxUTCX.exe
  2⤵
  PID:7328
- C:\Windows\System\agVUvqF.exe
  C:\Windows\System\agVUvqF.exe
  2⤵
  PID:7376
- C:\Windows\System\vaarSJW.exe
  C:\Windows\System\vaarSJW.exe
  2⤵
  PID:7404
- C:\Windows\System\AXaLvxU.exe
  C:\Windows\System\AXaLvxU.exe
  2⤵
  PID:7432
- C:\Windows\System\egBQeRS.exe
  C:\Windows\System\egBQeRS.exe
  2⤵
  PID:7460
- C:\Windows\System\mWGhyQz.exe
  C:\Windows\System\mWGhyQz.exe
  2⤵
  PID:7476
- C:\Windows\System\iqcyEHV.exe
  C:\Windows\System\iqcyEHV.exe
  2⤵
  PID:7504
- C:\Windows\System\XPPFPwJ.exe
  C:\Windows\System\XPPFPwJ.exe
  2⤵
  PID:7532
- C:\Windows\System\eHkKXYq.exe
  C:\Windows\System\eHkKXYq.exe
  2⤵
  PID:7560
- C:\Windows\System\zxERSlo.exe
  C:\Windows\System\zxERSlo.exe
  2⤵
  PID:7592
- C:\Windows\System\CnBfnlH.exe
  C:\Windows\System\CnBfnlH.exe
  2⤵
  PID:7620
- C:\Windows\System\BkdpxVv.exe
  C:\Windows\System\BkdpxVv.exe
  2⤵
  PID:7644
- C:\Windows\System\BqGxrNX.exe
  C:\Windows\System\BqGxrNX.exe
  2⤵
  PID:7672
- C:\Windows\System\IQYroLv.exe
  C:\Windows\System\IQYroLv.exe
  2⤵
  PID:7708
- C:\Windows\System\RSKLgUp.exe
  C:\Windows\System\RSKLgUp.exe
  2⤵
  PID:7728
- C:\Windows\System\GzEJuVq.exe
  C:\Windows\System\GzEJuVq.exe
  2⤵
  PID:7756
- C:\Windows\System\UWXNieG.exe
  C:\Windows\System\UWXNieG.exe
  2⤵
  PID:7796
- C:\Windows\System\bXLQskk.exe
  C:\Windows\System\bXLQskk.exe
  2⤵
  PID:7824
- C:\Windows\System\KVZfvBG.exe
  C:\Windows\System\KVZfvBG.exe
  2⤵
  PID:7840
- C:\Windows\System\imvMjcg.exe
  C:\Windows\System\imvMjcg.exe
  2⤵
  PID:7868
- C:\Windows\System\LgBfoBy.exe
  C:\Windows\System\LgBfoBy.exe
  2⤵
  PID:7896
- C:\Windows\System\iwWaTuc.exe
  C:\Windows\System\iwWaTuc.exe
  2⤵
  PID:7932
- C:\Windows\System\zXboaLJ.exe
  C:\Windows\System\zXboaLJ.exe
  2⤵
  PID:7952
- C:\Windows\System\uyoAeBg.exe
  C:\Windows\System\uyoAeBg.exe
  2⤵
  PID:7980
- C:\Windows\System\EMQjoXx.exe
  C:\Windows\System\EMQjoXx.exe
  2⤵
  PID:8008
- C:\Windows\System\GuoAFMw.exe
  C:\Windows\System\GuoAFMw.exe
  2⤵
  PID:8040
- C:\Windows\System\yFKJFrq.exe
  C:\Windows\System\yFKJFrq.exe
  2⤵
  PID:8064
- C:\Windows\System\rEizelR.exe
  C:\Windows\System\rEizelR.exe
  2⤵
  PID:8080
- C:\Windows\System\VaVRWuB.exe
  C:\Windows\System\VaVRWuB.exe
  2⤵
  PID:8112
- C:\Windows\System\kQOLfzB.exe
  C:\Windows\System\kQOLfzB.exe
  2⤵
  PID:8144
- C:\Windows\System\inQzDym.exe
  C:\Windows\System\inQzDym.exe
  2⤵
  PID:8164
- C:\Windows\System\xMuYufe.exe
  C:\Windows\System\xMuYufe.exe
  2⤵
  PID:6676
- C:\Windows\System\LRRuFBo.exe
  C:\Windows\System\LRRuFBo.exe
  2⤵
  PID:7192
- C:\Windows\System\jZSgUBr.exe
  C:\Windows\System\jZSgUBr.exe
  2⤵
  PID:7264
- C:\Windows\System\MmpPirP.exe
  C:\Windows\System\MmpPirP.exe
  2⤵
  PID:7340
- C:\Windows\System\aAEhhhU.exe
  C:\Windows\System\aAEhhhU.exe
  2⤵
  PID:7388
- C:\Windows\System\nFeYNyA.exe
  C:\Windows\System\nFeYNyA.exe
  2⤵
  PID:7456
- C:\Windows\System\qrfccNQ.exe
  C:\Windows\System\qrfccNQ.exe
  2⤵
  PID:7516
- C:\Windows\System\NkYxOEJ.exe
  C:\Windows\System\NkYxOEJ.exe
  2⤵
  PID:7548
- C:\Windows\System\eokhyAg.exe
  C:\Windows\System\eokhyAg.exe
  2⤵
  PID:7636
- C:\Windows\System\DYnuHYr.exe
  C:\Windows\System\DYnuHYr.exe
  2⤵
  PID:7724
- C:\Windows\System\QYeUeFc.exe
  C:\Windows\System\QYeUeFc.exe
  2⤵
  PID:7784
- C:\Windows\System\GNvAWhO.exe
  C:\Windows\System\GNvAWhO.exe
  2⤵
  PID:7880
- C:\Windows\System\foGviLG.exe
  C:\Windows\System\foGviLG.exe
  2⤵
  PID:8136
- C:\Windows\System\YApjGMk.exe
  C:\Windows\System\YApjGMk.exe
  2⤵
  PID:8152
- C:\Windows\System\iRtpZgf.exe
  C:\Windows\System\iRtpZgf.exe
  2⤵
  PID:7232
- C:\Windows\System\zfgagFK.exe
  C:\Windows\System\zfgagFK.exe
  2⤵
  PID:7424
- C:\Windows\System\ofWItco.exe
  C:\Windows\System\ofWItco.exe
  2⤵
  PID:7396
- C:\Windows\System\JaBtVUB.exe
  C:\Windows\System\JaBtVUB.exe
  2⤵
  PID:7768
- C:\Windows\System\CowslQe.exe
  C:\Windows\System\CowslQe.exe
  2⤵
  PID:7924
- C:\Windows\System\nbzchTz.exe
  C:\Windows\System\nbzchTz.exe
  2⤵
  PID:8056
- C:\Windows\System\zGTdeaW.exe
  C:\Windows\System\zGTdeaW.exe
  2⤵
  PID:7296
- C:\Windows\System\XgpvpKT.exe
  C:\Windows\System\XgpvpKT.exe
  2⤵
  PID:7576
- C:\Windows\System\dlPsnoY.exe
  C:\Windows\System\dlPsnoY.exe
  2⤵
  PID:8160
- C:\Windows\System\TLUdkKb.exe
  C:\Windows\System\TLUdkKb.exe
  2⤵
  PID:7860
- C:\Windows\System\DGsKgVN.exe
  C:\Windows\System\DGsKgVN.exe
  2⤵
  PID:8196
- C:\Windows\System\dVqDyNU.exe
  C:\Windows\System\dVqDyNU.exe
  2⤵
  PID:8216
- C:\Windows\System\jvalAjs.exe
  C:\Windows\System\jvalAjs.exe
  2⤵
  PID:8244
- C:\Windows\System\MfHJdMM.exe
  C:\Windows\System\MfHJdMM.exe
  2⤵
  PID:8272
- C:\Windows\System\yIjlfUg.exe
  C:\Windows\System\yIjlfUg.exe
  2⤵
  PID:8308
- C:\Windows\System\NUSZpFl.exe
  C:\Windows\System\NUSZpFl.exe
  2⤵
  PID:8332
- C:\Windows\System\Ropqnyl.exe
  C:\Windows\System\Ropqnyl.exe
  2⤵
  PID:8356
- C:\Windows\System\fUQyyGW.exe
  C:\Windows\System\fUQyyGW.exe
  2⤵
  PID:8376
- C:\Windows\System\pGOvBAK.exe
  C:\Windows\System\pGOvBAK.exe
  2⤵
  PID:8408
- C:\Windows\System\pDSpTnK.exe
  C:\Windows\System\pDSpTnK.exe
  2⤵
  PID:8444
- C:\Windows\System\ixqTYmk.exe
  C:\Windows\System\ixqTYmk.exe
  2⤵
  PID:8472
- C:\Windows\System\zzOIYcM.exe
  C:\Windows\System\zzOIYcM.exe
  2⤵
  PID:8504
- C:\Windows\System\KqeLWcJ.exe
  C:\Windows\System\KqeLWcJ.exe
  2⤵
  PID:8540
- C:\Windows\System\vhDThkm.exe
  C:\Windows\System\vhDThkm.exe
  2⤵
  PID:8568
- C:\Windows\System\GTJoPvv.exe
  C:\Windows\System\GTJoPvv.exe
  2⤵
  PID:8596
- C:\Windows\System\jcxycAX.exe
  C:\Windows\System\jcxycAX.exe
  2⤵
  PID:8612
- C:\Windows\System\NFvBsZp.exe
  C:\Windows\System\NFvBsZp.exe
  2⤵
  PID:8640
- C:\Windows\System\NuUMApy.exe
  C:\Windows\System\NuUMApy.exe
  2⤵
  PID:8656
- C:\Windows\System\NNqFHha.exe
  C:\Windows\System\NNqFHha.exe
  2⤵
  PID:8696
- C:\Windows\System\WeeOery.exe
  C:\Windows\System\WeeOery.exe
  2⤵
  PID:8712
- C:\Windows\System\lJHWAEb.exe
  C:\Windows\System\lJHWAEb.exe
  2⤵
  PID:8748
- C:\Windows\System\MWoOFFD.exe
  C:\Windows\System\MWoOFFD.exe
  2⤵
  PID:8784
- C:\Windows\System\CcYxhaz.exe
  C:\Windows\System\CcYxhaz.exe
  2⤵
  PID:8808
- C:\Windows\System\fvZtbVJ.exe
  C:\Windows\System\fvZtbVJ.exe
  2⤵
  PID:8836
- C:\Windows\System\DziERZE.exe
  C:\Windows\System\DziERZE.exe
  2⤵
  PID:8864
- C:\Windows\System\whOAanQ.exe
  C:\Windows\System\whOAanQ.exe
  2⤵
  PID:8908
- C:\Windows\System\wmZJLIa.exe
  C:\Windows\System\wmZJLIa.exe
  2⤵
  PID:8936
- C:\Windows\System\PBicCCF.exe
  C:\Windows\System\PBicCCF.exe
  2⤵
  PID:8964
- C:\Windows\System\UBlNCjm.exe
  C:\Windows\System\UBlNCjm.exe
  2⤵
  PID:8980
- C:\Windows\System\IswpECv.exe
  C:\Windows\System\IswpECv.exe
  2⤵
  PID:9012
- C:\Windows\System\dneIdTI.exe
  C:\Windows\System\dneIdTI.exe
  2⤵
  PID:9036
- C:\Windows\System\WtollPo.exe
  C:\Windows\System\WtollPo.exe
  2⤵
  PID:9064
- C:\Windows\System\NEvJdxC.exe
  C:\Windows\System\NEvJdxC.exe
  2⤵
  PID:9096
- C:\Windows\System\pywwQFY.exe
  C:\Windows\System\pywwQFY.exe
  2⤵
  PID:9120
- C:\Windows\System\HLAqrUs.exe
  C:\Windows\System\HLAqrUs.exe
  2⤵
  PID:9156
- C:\Windows\System\lGHzMOW.exe
  C:\Windows\System\lGHzMOW.exe
  2⤵
  PID:9176
- C:\Windows\System\zvrymhP.exe
  C:\Windows\System\zvrymhP.exe
  2⤵
  PID:9212
- C:\Windows\System\ECeDLME.exe
  C:\Windows\System\ECeDLME.exe
  2⤵
  PID:8228
- C:\Windows\System\MxNmUrE.exe
  C:\Windows\System\MxNmUrE.exe
  2⤵
  PID:8304
- C:\Windows\System\GXGIVml.exe
  C:\Windows\System\GXGIVml.exe
  2⤵
  PID:8368
- C:\Windows\System\dWTkjfw.exe
  C:\Windows\System\dWTkjfw.exe
  2⤵
  PID:8428
- C:\Windows\System\uPrpppC.exe
  C:\Windows\System\uPrpppC.exe
  2⤵
  PID:8512
- C:\Windows\System\OXcaicx.exe
  C:\Windows\System\OXcaicx.exe
  2⤵
  PID:8556
- C:\Windows\System\UchSrcr.exe
  C:\Windows\System\UchSrcr.exe
  2⤵
  PID:8628
- C:\Windows\System\JbQhjRC.exe
  C:\Windows\System\JbQhjRC.exe
  2⤵
  PID:8684
- C:\Windows\System\CUccDnV.exe
  C:\Windows\System\CUccDnV.exe
  2⤵
  PID:8776
- C:\Windows\System\mfpjnEH.exe
  C:\Windows\System\mfpjnEH.exe
  2⤵
  PID:8832
- C:\Windows\System\tUDMOcK.exe
  C:\Windows\System\tUDMOcK.exe
  2⤵
  PID:8888
- C:\Windows\System\pJThYcA.exe
  C:\Windows\System\pJThYcA.exe
  2⤵
  PID:8952
- C:\Windows\System\jvHsnqD.exe
  C:\Windows\System\jvHsnqD.exe
  2⤵
  PID:9032
- C:\Windows\System\PckFFiS.exe
  C:\Windows\System\PckFFiS.exe
  2⤵
  PID:9092
- C:\Windows\System\zbzTnjp.exe
  C:\Windows\System\zbzTnjp.exe
  2⤵
  PID:9164
- C:\Windows\System\KEybqBM.exe
  C:\Windows\System\KEybqBM.exe
  2⤵
  PID:7492
- C:\Windows\System\vrmgivs.exe
  C:\Windows\System\vrmgivs.exe
  2⤵
  PID:8324
- C:\Windows\System\SxGUWRQ.exe
  C:\Windows\System\SxGUWRQ.exe
  2⤵
  PID:8484
- C:\Windows\System\ucuZyQY.exe
  C:\Windows\System\ucuZyQY.exe
  2⤵
  PID:8708
- C:\Windows\System\sAtNnWQ.exe
  C:\Windows\System\sAtNnWQ.exe
  2⤵
  PID:8796
- C:\Windows\System\ZCpySEu.exe
  C:\Windows\System\ZCpySEu.exe
  2⤵
  PID:8920
- C:\Windows\System\aBgsgYf.exe
  C:\Windows\System\aBgsgYf.exe
  2⤵
  PID:9060
- C:\Windows\System\uhdXaOg.exe
  C:\Windows\System\uhdXaOg.exe
  2⤵
  PID:8208
- C:\Windows\System\ONgHABt.exe
  C:\Windows\System\ONgHABt.exe
  2⤵
  PID:8188
- C:\Windows\System\iWNDwdq.exe
  C:\Windows\System\iWNDwdq.exe
  2⤵
  PID:8852
- C:\Windows\System\kkRGNRE.exe
  C:\Windows\System\kkRGNRE.exe
  2⤵
  PID:8436
- C:\Windows\System\WqPpfhE.exe
  C:\Windows\System\WqPpfhE.exe
  2⤵
  PID:8928
- C:\Windows\System\CsFeUBQ.exe
  C:\Windows\System\CsFeUBQ.exe
  2⤵
  PID:9244
- C:\Windows\System\nLNgIEg.exe
  C:\Windows\System\nLNgIEg.exe
  2⤵
  PID:9260
- C:\Windows\System\WQKHgzs.exe
  C:\Windows\System\WQKHgzs.exe
  2⤵
  PID:9300
- C:\Windows\System\UvPPFTQ.exe
  C:\Windows\System\UvPPFTQ.exe
  2⤵
  PID:9328
- C:\Windows\System\alRXzMx.exe
  C:\Windows\System\alRXzMx.exe
  2⤵
  PID:9356
- C:\Windows\System\NjdSnIX.exe
  C:\Windows\System\NjdSnIX.exe
  2⤵
  PID:9384
- C:\Windows\System\LOxXubz.exe
  C:\Windows\System\LOxXubz.exe
  2⤵
  PID:9412
- C:\Windows\System\kUSstif.exe
  C:\Windows\System\kUSstif.exe
  2⤵
  PID:9432
- C:\Windows\System\PNRpSya.exe
  C:\Windows\System\PNRpSya.exe
  2⤵
  PID:9468
- C:\Windows\System\zgyfzuj.exe
  C:\Windows\System\zgyfzuj.exe
  2⤵
  PID:9500
- C:\Windows\System\AhyvubJ.exe
  C:\Windows\System\AhyvubJ.exe
  2⤵
  PID:9544
- C:\Windows\System\lGDZYTo.exe
  C:\Windows\System\lGDZYTo.exe
  2⤵
  PID:9560
- C:\Windows\System\TsKwOhs.exe
  C:\Windows\System\TsKwOhs.exe
  2⤵
  PID:9588
- C:\Windows\System\YxOwind.exe
  C:\Windows\System\YxOwind.exe
  2⤵
  PID:9612
- C:\Windows\System\viyGfDB.exe
  C:\Windows\System\viyGfDB.exe
  2⤵
  PID:9644
- C:\Windows\System\aVxgIAe.exe
  C:\Windows\System\aVxgIAe.exe
  2⤵
  PID:9672
- C:\Windows\System\QxENMaF.exe
  C:\Windows\System\QxENMaF.exe
  2⤵
  PID:9700
- C:\Windows\System\qdMCeoP.exe
  C:\Windows\System\qdMCeoP.exe
  2⤵
  PID:9732
- C:\Windows\System\ZBxHVbZ.exe
  C:\Windows\System\ZBxHVbZ.exe
  2⤵
  PID:9764
- C:\Windows\System\fjldYdJ.exe
  C:\Windows\System\fjldYdJ.exe
  2⤵
  PID:9796
- C:\Windows\System\vXRRXiY.exe
  C:\Windows\System\vXRRXiY.exe
  2⤵
  PID:9828
- C:\Windows\System\HgYuvAX.exe
  C:\Windows\System\HgYuvAX.exe
  2⤵
  PID:9856
- C:\Windows\System\gpluWyb.exe
  C:\Windows\System\gpluWyb.exe
  2⤵
  PID:9900
- C:\Windows\System\IwkkHdX.exe
  C:\Windows\System\IwkkHdX.exe
  2⤵
  PID:9940
- C:\Windows\System\KlWSKhm.exe
  C:\Windows\System\KlWSKhm.exe
  2⤵
  PID:9968
- C:\Windows\System\ffcAIeE.exe
  C:\Windows\System\ffcAIeE.exe
  2⤵
  PID:10004
- C:\Windows\System\TpsEiPd.exe
  C:\Windows\System\TpsEiPd.exe
  2⤵
  PID:10032
- C:\Windows\System\BnoIzvw.exe
  C:\Windows\System\BnoIzvw.exe
  2⤵
  PID:10052
- C:\Windows\System\BYdDqkO.exe
  C:\Windows\System\BYdDqkO.exe
  2⤵
  PID:10080
- C:\Windows\System\hXpKysc.exe
  C:\Windows\System\hXpKysc.exe
  2⤵
  PID:10120
- C:\Windows\System\pZXRpYs.exe
  C:\Windows\System\pZXRpYs.exe
  2⤵
  PID:10148
- C:\Windows\System\cnRIYFo.exe
  C:\Windows\System\cnRIYFo.exe
  2⤵
  PID:10188
- C:\Windows\System\NRDhGNh.exe
  C:\Windows\System\NRDhGNh.exe
  2⤵
  PID:10216
- C:\Windows\System\wIPavmI.exe
  C:\Windows\System\wIPavmI.exe
  2⤵
  PID:10232
- C:\Windows\System\PkfoJph.exe
  C:\Windows\System\PkfoJph.exe
  2⤵
  PID:9240
- C:\Windows\System\BurchpK.exe
  C:\Windows\System\BurchpK.exe
  2⤵
  PID:9316
- C:\Windows\System\mjjnDju.exe
  C:\Windows\System\mjjnDju.exe
  2⤵
  PID:9396
- C:\Windows\System\hFEgqzL.exe
  C:\Windows\System\hFEgqzL.exe
  2⤵
  PID:9464
- C:\Windows\System\UYmNrzY.exe
  C:\Windows\System\UYmNrzY.exe
  2⤵
  PID:9552
- C:\Windows\System\UvcbvbH.exe
  C:\Windows\System\UvcbvbH.exe
  2⤵
  PID:9600
- C:\Windows\System\daWUELx.exe
  C:\Windows\System\daWUELx.exe
  2⤵
  PID:9656
- C:\Windows\System\sFaWWuy.exe
  C:\Windows\System\sFaWWuy.exe
  2⤵
  PID:9720
- C:\Windows\System\gyyMpRJ.exe
  C:\Windows\System\gyyMpRJ.exe
  2⤵
  PID:9820
- C:\Windows\System\UUjIHNB.exe
  C:\Windows\System\UUjIHNB.exe
  2⤵
  PID:9932
- C:\Windows\System\bVnrRIa.exe
  C:\Windows\System\bVnrRIa.exe
  2⤵
  PID:9988
- C:\Windows\System\CgdHchW.exe
  C:\Windows\System\CgdHchW.exe
  2⤵
  PID:10064
- C:\Windows\System\ndokUIK.exe
  C:\Windows\System\ndokUIK.exe
  2⤵
  PID:10100
- C:\Windows\System\jQVNCLk.exe
  C:\Windows\System\jQVNCLk.exe
  2⤵
  PID:10180
- C:\Windows\System\scTUBin.exe
  C:\Windows\System\scTUBin.exe
  2⤵
  PID:10228
- C:\Windows\System\eiXvKeZ.exe
  C:\Windows\System\eiXvKeZ.exe
  2⤵
  PID:9312
- C:\Windows\System\ABPjahT.exe
  C:\Windows\System\ABPjahT.exe
  2⤵
  PID:9440
- C:\Windows\System\Yfxtuqg.exe
  C:\Windows\System\Yfxtuqg.exe
  2⤵
  PID:9576
- C:\Windows\System\MPSUdOg.exe
  C:\Windows\System\MPSUdOg.exe
  2⤵
  PID:9664
- C:\Windows\System\joQHpvP.exe
  C:\Windows\System\joQHpvP.exe
  2⤵
  PID:9872
- C:\Windows\System\qAgqxze.exe
  C:\Windows\System\qAgqxze.exe
  2⤵
  PID:10092
- C:\Windows\System\IZFUIpu.exe
  C:\Windows\System\IZFUIpu.exe
  2⤵
  PID:9348
- C:\Windows\System\IPNYcMX.exe
  C:\Windows\System\IPNYcMX.exe
  2⤵
  PID:9716
- C:\Windows\System\jbCNECE.exe
  C:\Windows\System\jbCNECE.exe
  2⤵
  PID:10016
- C:\Windows\System\keclMtB.exe
  C:\Windows\System\keclMtB.exe
  2⤵
  PID:9780
- C:\Windows\System\SkIsmZh.exe
  C:\Windows\System\SkIsmZh.exe
  2⤵
  PID:10244
- C:\Windows\System\cFdRCjy.exe
  C:\Windows\System\cFdRCjy.exe
  2⤵
  PID:10276
- C:\Windows\System\uJfWdJp.exe
  C:\Windows\System\uJfWdJp.exe
  2⤵
  PID:10304
- C:\Windows\System\EIJeGSb.exe
  C:\Windows\System\EIJeGSb.exe
  2⤵
  PID:10320
- C:\Windows\System\HyZVHiz.exe
  C:\Windows\System\HyZVHiz.exe
  2⤵
  PID:10360
- C:\Windows\System\iYAyTte.exe
  C:\Windows\System\iYAyTte.exe
  2⤵
  PID:10388
- C:\Windows\System\zegreCJ.exe
  C:\Windows\System\zegreCJ.exe
  2⤵
  PID:10416
- C:\Windows\System\LZtiBKe.exe
  C:\Windows\System\LZtiBKe.exe
  2⤵
  PID:10448
- C:\Windows\System\kCtIgbc.exe
  C:\Windows\System\kCtIgbc.exe
  2⤵
  PID:10464
- C:\Windows\System\wbTycZP.exe
  C:\Windows\System\wbTycZP.exe
  2⤵
  PID:10492
- C:\Windows\System\SImDzqy.exe
  C:\Windows\System\SImDzqy.exe
  2⤵
  PID:10520
- C:\Windows\System\mPyjxNM.exe
  C:\Windows\System\mPyjxNM.exe
  2⤵
  PID:10548
- C:\Windows\System\gwPnmdp.exe
  C:\Windows\System\gwPnmdp.exe
  2⤵
  PID:10576
- C:\Windows\System\KSEmZNO.exe
  C:\Windows\System\KSEmZNO.exe
  2⤵
  PID:10604
- C:\Windows\System\oUOGIXe.exe
  C:\Windows\System\oUOGIXe.exe
  2⤵
  PID:10632
- C:\Windows\System\pCKVVLU.exe
  C:\Windows\System\pCKVVLU.exe
  2⤵
  PID:10660
- C:\Windows\System\nLSofKp.exe
  C:\Windows\System\nLSofKp.exe
  2⤵
  PID:10696
- C:\Windows\System\SuxunNc.exe
  C:\Windows\System\SuxunNc.exe
  2⤵
  PID:10728
- C:\Windows\System\OaPxqXP.exe
  C:\Windows\System\OaPxqXP.exe
  2⤵
  PID:10756
- C:\Windows\System\IMIPuPY.exe
  C:\Windows\System\IMIPuPY.exe
  2⤵
  PID:10784
- C:\Windows\System\YnJDdNX.exe
  C:\Windows\System\YnJDdNX.exe
  2⤵
  PID:10808
- C:\Windows\System\HDXMnTg.exe
  C:\Windows\System\HDXMnTg.exe
  2⤵
  PID:10840
- C:\Windows\System\WYImEJe.exe
  C:\Windows\System\WYImEJe.exe
  2⤵
  PID:10868
- C:\Windows\System\YSTxIcT.exe
  C:\Windows\System\YSTxIcT.exe
  2⤵
  PID:10896
- C:\Windows\System\NGOepEM.exe
  C:\Windows\System\NGOepEM.exe
  2⤵
  PID:10916
- C:\Windows\System\YFfYsmm.exe
  C:\Windows\System\YFfYsmm.exe
  2⤵
  PID:10956
- C:\Windows\System\bMWNfXe.exe
  C:\Windows\System\bMWNfXe.exe
  2⤵
  PID:10984
- C:\Windows\System\XtAmEqG.exe
  C:\Windows\System\XtAmEqG.exe
  2⤵
  PID:11008
- C:\Windows\System\nlCJgny.exe
  C:\Windows\System\nlCJgny.exe
  2⤵
  PID:11032
- C:\Windows\System\AuLfiKb.exe
  C:\Windows\System\AuLfiKb.exe
  2⤵
  PID:11056
- C:\Windows\System\xFqlWIB.exe
  C:\Windows\System\xFqlWIB.exe
  2⤵
  PID:11080
- C:\Windows\System\JoRjKfL.exe
  C:\Windows\System\JoRjKfL.exe
  2⤵
  PID:11112
- C:\Windows\System\LgEzyMP.exe
  C:\Windows\System\LgEzyMP.exe
  2⤵
  PID:11156
- C:\Windows\System\UPeKDfE.exe
  C:\Windows\System\UPeKDfE.exe
  2⤵
  PID:11176
- C:\Windows\System\LIPyyNN.exe
  C:\Windows\System\LIPyyNN.exe
  2⤵
  PID:11212
- C:\Windows\System\xJaBrVH.exe
  C:\Windows\System\xJaBrVH.exe
  2⤵
  PID:11232
- C:\Windows\System\MYtjMVd.exe
  C:\Windows\System\MYtjMVd.exe
  2⤵
  PID:11248
- C:\Windows\System\GAANrFD.exe
  C:\Windows\System\GAANrFD.exe
  2⤵
  PID:10272
- C:\Windows\System\KPSNEwS.exe
  C:\Windows\System\KPSNEwS.exe
  2⤵
  PID:10332
- C:\Windows\System\dKGAQlj.exe
  C:\Windows\System\dKGAQlj.exe
  2⤵
  PID:10412
- C:\Windows\System\KHQJBci.exe
  C:\Windows\System\KHQJBci.exe
  2⤵
  PID:10512
- C:\Windows\System\QqGAAcr.exe
  C:\Windows\System\QqGAAcr.exe
  2⤵
  PID:10572
- C:\Windows\System\ytYoYph.exe
  C:\Windows\System\ytYoYph.exe
  2⤵
  PID:10616
- C:\Windows\System\RiQrEKf.exe
  C:\Windows\System\RiQrEKf.exe
  2⤵
  PID:10720
- C:\Windows\System\lrBmKLe.exe
  C:\Windows\System\lrBmKLe.exe
  2⤵
  PID:10796
- C:\Windows\System\mYnnSLz.exe
  C:\Windows\System\mYnnSLz.exe
  2⤵
  PID:10828
- C:\Windows\System\wYAnTWT.exe
  C:\Windows\System\wYAnTWT.exe
  2⤵
  PID:10848
- C:\Windows\System\opAEoYi.exe
  C:\Windows\System\opAEoYi.exe
  2⤵
  PID:10944
- C:\Windows\System\ASHVxmP.exe
  C:\Windows\System\ASHVxmP.exe
  2⤵
  PID:10996
- C:\Windows\System\IHvpHAH.exe
  C:\Windows\System\IHvpHAH.exe
  2⤵
  PID:11044
- C:\Windows\System\KXutTaW.exe
  C:\Windows\System\KXutTaW.exe
  2⤵
  PID:11104
- C:\Windows\System\YaSRpoc.exe
  C:\Windows\System\YaSRpoc.exe
  2⤵
  PID:11228
- C:\Windows\System\ccTGrTo.exe
  C:\Windows\System\ccTGrTo.exe
  2⤵
  PID:10316
- C:\Windows\System\fSJfRzS.exe
  C:\Windows\System\fSJfRzS.exe
  2⤵
  PID:10476
- C:\Windows\System\bFTvfIV.exe
  C:\Windows\System\bFTvfIV.exe
  2⤵
  PID:10624
- C:\Windows\System\QtMGnjB.exe
  C:\Windows\System\QtMGnjB.exe
  2⤵
  PID:10684
- C:\Windows\System\epgPYwG.exe
  C:\Windows\System\epgPYwG.exe
  2⤵
  PID:9232
- C:\Windows\System\MjFqOFm.exe
  C:\Windows\System\MjFqOFm.exe
  2⤵
  PID:10972
- C:\Windows\System\nDtOiOn.exe
  C:\Windows\System\nDtOiOn.exe
  2⤵
  PID:11128
- C:\Windows\System\TVcArRn.exe
  C:\Windows\System\TVcArRn.exe
  2⤵
  PID:10656
- C:\Windows\System\JmfVLcz.exe
  C:\Windows\System\JmfVLcz.exe
  2⤵
  PID:11100
- C:\Windows\System\JZveTiO.exe
  C:\Windows\System\JZveTiO.exe
  2⤵
  PID:10404
- C:\Windows\System\YzqBSvM.exe
  C:\Windows\System\YzqBSvM.exe
  2⤵
  PID:11280
- C:\Windows\System\xnXPwtZ.exe
  C:\Windows\System\xnXPwtZ.exe
  2⤵
  PID:11308
- C:\Windows\System\LapRdAV.exe
  C:\Windows\System\LapRdAV.exe
  2⤵
  PID:11340
- C:\Windows\System\UkFNZLF.exe
  C:\Windows\System\UkFNZLF.exe
  2⤵
  PID:11384
- C:\Windows\System\eQifhNf.exe
  C:\Windows\System\eQifhNf.exe
  2⤵
  PID:11408
- C:\Windows\System\NDjKeHL.exe
  C:\Windows\System\NDjKeHL.exe
  2⤵
  PID:11428
- C:\Windows\System\PqLDLBb.exe
  C:\Windows\System\PqLDLBb.exe
  2⤵
  PID:11460
- C:\Windows\System\XqAptdU.exe
  C:\Windows\System\XqAptdU.exe
  2⤵
  PID:11488
- C:\Windows\System\CAXHdBo.exe
  C:\Windows\System\CAXHdBo.exe
  2⤵
  PID:11520
- C:\Windows\System\iqbHSLp.exe
  C:\Windows\System\iqbHSLp.exe
  2⤵
  PID:11560
- C:\Windows\System\hGhAVWD.exe
  C:\Windows\System\hGhAVWD.exe
  2⤵
  PID:11588
- C:\Windows\System\BFpuqQr.exe
  C:\Windows\System\BFpuqQr.exe
  2⤵
  PID:11616
- C:\Windows\System\rYlmaMY.exe
  C:\Windows\System\rYlmaMY.exe
  2⤵
  PID:11644
- C:\Windows\System\xJhDFXl.exe
  C:\Windows\System\xJhDFXl.exe
  2⤵
  PID:11684
- C:\Windows\System\TAwLHVV.exe
  C:\Windows\System\TAwLHVV.exe
  2⤵
  PID:11700
- C:\Windows\System\RlCyvjR.exe
  C:\Windows\System\RlCyvjR.exe
  2⤵
  PID:11736
- C:\Windows\System\YxaSCCS.exe
  C:\Windows\System\YxaSCCS.exe
  2⤵
  PID:11756
- C:\Windows\System\pLdDFVY.exe
  C:\Windows\System\pLdDFVY.exe
  2⤵
  PID:11784
- C:\Windows\System\miWLsZB.exe
  C:\Windows\System\miWLsZB.exe
  2⤵
  PID:11804
- C:\Windows\System\MdIFEuC.exe
  C:\Windows\System\MdIFEuC.exe
  2⤵
  PID:11820
- C:\Windows\System\FWWARTW.exe
  C:\Windows\System\FWWARTW.exe
  2⤵
  PID:11848
- C:\Windows\System\tDYbErO.exe
  C:\Windows\System\tDYbErO.exe
  2⤵
  PID:11880
- C:\Windows\System\cBBveFu.exe
  C:\Windows\System\cBBveFu.exe
  2⤵
  PID:11908
- C:\Windows\System\ngkdsMv.exe
  C:\Windows\System\ngkdsMv.exe
  2⤵
  PID:11932
- C:\Windows\System\hUQfPci.exe
  C:\Windows\System\hUQfPci.exe
  2⤵
  PID:11956
- C:\Windows\System\FeoJDWV.exe
  C:\Windows\System\FeoJDWV.exe
  2⤵
  PID:11992
- C:\Windows\System\bPgbECG.exe
  C:\Windows\System\bPgbECG.exe
  2⤵
  PID:12024
- C:\Windows\System\gOIgcoP.exe
  C:\Windows\System\gOIgcoP.exe
  2⤵
  PID:12056
- C:\Windows\System\vKNfOvB.exe
  C:\Windows\System\vKNfOvB.exe
  2⤵
  PID:12088
- C:\Windows\System\XnYViZx.exe
  C:\Windows\System\XnYViZx.exe
  2⤵
  PID:12120
- C:\Windows\System\GWwixnI.exe
  C:\Windows\System\GWwixnI.exe
  2⤵
  PID:12148
- C:\Windows\System\UYGPlao.exe
  C:\Windows\System\UYGPlao.exe
  2⤵
  PID:12196
- C:\Windows\System\hMsncHL.exe
  C:\Windows\System\hMsncHL.exe
  2⤵
  PID:12228
- C:\Windows\System\pHOcHqZ.exe
  C:\Windows\System\pHOcHqZ.exe
  2⤵
  PID:12260
- C:\Windows\System\SyimUdV.exe
  C:\Windows\System\SyimUdV.exe
  2⤵
  PID:12280
- C:\Windows\System\NHqHcoD.exe
  C:\Windows\System\NHqHcoD.exe
  2⤵
  PID:11048
- C:\Windows\System\ajfuODN.exe
  C:\Windows\System\ajfuODN.exe
  2⤵
  PID:11400
- C:\Windows\System\qXrMUGW.exe
  C:\Windows\System\qXrMUGW.exe
  2⤵
  PID:11436
- C:\Windows\System\AOdrcrQ.exe
  C:\Windows\System\AOdrcrQ.exe
  2⤵
  PID:11516
- C:\Windows\System\bZETJVF.exe
  C:\Windows\System\bZETJVF.exe
  2⤵
  PID:11548
- C:\Windows\System\WNgVpxi.exe
  C:\Windows\System\WNgVpxi.exe
  2⤵
  PID:11636
- C:\Windows\System\qXsNjMH.exe
  C:\Windows\System\qXsNjMH.exe
  2⤵
  PID:11672
- C:\Windows\System\znKIogd.exe
  C:\Windows\System\znKIogd.exe
  2⤵
  PID:11732
- C:\Windows\System\QaOTmTm.exe
  C:\Windows\System\QaOTmTm.exe
  2⤵
  PID:11864
- C:\Windows\System\DcRvogf.exe
  C:\Windows\System\DcRvogf.exe
  2⤵
  PID:11920
- C:\Windows\System\vBofYKq.exe
  C:\Windows\System\vBofYKq.exe
  2⤵
  PID:11984
- C:\Windows\System\BDqfNoi.exe
  C:\Windows\System\BDqfNoi.exe
  2⤵
  PID:12016
- C:\Windows\System\jUNsYIc.exe
  C:\Windows\System\jUNsYIc.exe
  2⤵
  PID:12072
- C:\Windows\System\XmNSJFL.exe
  C:\Windows\System\XmNSJFL.exe
  2⤵
  PID:12116
- C:\Windows\System\kINpohC.exe
  C:\Windows\System\kINpohC.exe
  2⤵
  PID:12168
- C:\Windows\System\xGoOWrx.exe
  C:\Windows\System\xGoOWrx.exe
  2⤵
  PID:11272
- C:\Windows\System\nKiVbbZ.exe
  C:\Windows\System\nKiVbbZ.exe
  2⤵
  PID:11444
- C:\Windows\System\nruqRka.exe
  C:\Windows\System\nruqRka.exe
  2⤵
  PID:11508
- C:\Windows\System\OwxlXYy.exe
  C:\Windows\System\OwxlXYy.exe
  2⤵
  PID:11692
- C:\Windows\System\YfFxNKF.exe
  C:\Windows\System\YfFxNKF.exe
  2⤵
  PID:11844
- C:\Windows\System\UyBYvYp.exe
  C:\Windows\System\UyBYvYp.exe
  2⤵
  PID:11904
- C:\Windows\System\PMLxkEC.exe
  C:\Windows\System\PMLxkEC.exe
  2⤵
  PID:12044
- C:\Windows\System\vluyUas.exe
  C:\Windows\System\vluyUas.exe
  2⤵
  PID:12256
- C:\Windows\System\YJxzMCw.exe
  C:\Windows\System\YJxzMCw.exe
  2⤵
  PID:12248
- C:\Windows\System\PfUJnGh.exe
  C:\Windows\System\PfUJnGh.exe
  2⤵
  PID:11816
- C:\Windows\System\URCYaOt.exe
  C:\Windows\System\URCYaOt.exe
  2⤵
  PID:1476
- C:\Windows\System\NEJQUjE.exe
  C:\Windows\System\NEJQUjE.exe
  2⤵
  PID:12292
- C:\Windows\System\dfNPiNZ.exe
  C:\Windows\System\dfNPiNZ.exe
  2⤵
  PID:12312
- C:\Windows\System\PArwdhR.exe
  C:\Windows\System\PArwdhR.exe
  2⤵
  PID:12336
- C:\Windows\System\UsNNRNK.exe
  C:\Windows\System\UsNNRNK.exe
  2⤵
  PID:12360
- C:\Windows\System\BQCSpSj.exe
  C:\Windows\System\BQCSpSj.exe
  2⤵
  PID:12388
- C:\Windows\System\AdAVjDt.exe
  C:\Windows\System\AdAVjDt.exe
  2⤵
  PID:12416
- C:\Windows\System\LAheoVx.exe
  C:\Windows\System\LAheoVx.exe
  2⤵
  PID:12444
- C:\Windows\System\rcHEAdl.exe
  C:\Windows\System\rcHEAdl.exe
  2⤵
  PID:12480
- C:\Windows\System\GUCQpFa.exe
  C:\Windows\System\GUCQpFa.exe
  2⤵
  PID:12516
- C:\Windows\System\miduQaV.exe
  C:\Windows\System\miduQaV.exe
  2⤵
  PID:12560
- C:\Windows\System\Nqrjppd.exe
  C:\Windows\System\Nqrjppd.exe
  2⤵
  PID:12584
- C:\Windows\System\kSdbcXc.exe
  C:\Windows\System\kSdbcXc.exe
  2⤵
  PID:12608
- C:\Windows\System\tsywwmu.exe
  C:\Windows\System\tsywwmu.exe
  2⤵
  PID:12632
- C:\Windows\System\PlDnVRW.exe
  C:\Windows\System\PlDnVRW.exe
  2⤵
  PID:12668
- C:\Windows\System\FruAMOs.exe
  C:\Windows\System\FruAMOs.exe
  2⤵
  PID:12704
- C:\Windows\System\xmRtEHC.exe
  C:\Windows\System\xmRtEHC.exe
  2⤵
  PID:12720
- C:\Windows\System\dGWVdpS.exe
  C:\Windows\System\dGWVdpS.exe
  2⤵
  PID:12752
- C:\Windows\System\gAhxoAO.exe
  C:\Windows\System\gAhxoAO.exe
  2⤵
  PID:12772
- C:\Windows\System\tCdVsSv.exe
  C:\Windows\System\tCdVsSv.exe
  2⤵
  PID:12800
- C:\Windows\System\KxGTMfU.exe
  C:\Windows\System\KxGTMfU.exe
  2⤵
  PID:12824
- C:\Windows\System\ElouJCy.exe
  C:\Windows\System\ElouJCy.exe
  2⤵
  PID:12860
- C:\Windows\System\pnMhdYx.exe
  C:\Windows\System\pnMhdYx.exe
  2⤵
  PID:12892
- C:\Windows\System\pPnpJON.exe
  C:\Windows\System\pPnpJON.exe
  2⤵
  PID:12928
- C:\Windows\System\EPibSbM.exe
  C:\Windows\System\EPibSbM.exe
  2⤵
  PID:12956
- C:\Windows\System\slODAsw.exe
  C:\Windows\System\slODAsw.exe
  2⤵
  PID:12984
- C:\Windows\System\ITtcoaW.exe
  C:\Windows\System\ITtcoaW.exe
  2⤵
  PID:13016
- C:\Windows\System\YTDegSV.exe
  C:\Windows\System\YTDegSV.exe
  2⤵
  PID:13048
- C:\Windows\System\OLPZGlA.exe
  C:\Windows\System\OLPZGlA.exe
  2⤵
  PID:13068
- C:\Windows\System\RepGrPW.exe
  C:\Windows\System\RepGrPW.exe
  2⤵
  PID:13096
- C:\Windows\System\uaUbJhE.exe
  C:\Windows\System\uaUbJhE.exe
  2⤵
  PID:13124
- C:\Windows\System\yYNyCwJ.exe
  C:\Windows\System\yYNyCwJ.exe
  2⤵
  PID:13144
- C:\Windows\System\wiCYzeY.exe
  C:\Windows\System\wiCYzeY.exe
  2⤵
  PID:13176
- C:\Windows\System\zbGfqBP.exe
  C:\Windows\System\zbGfqBP.exe
  2⤵
  PID:13208
- C:\Windows\System\mEShvSr.exe
  C:\Windows\System\mEShvSr.exe
  2⤵
  PID:13240
- C:\Windows\System\nlWKGnJ.exe
  C:\Windows\System\nlWKGnJ.exe
  2⤵
  PID:13268
- C:\Windows\System\UbBTwdk.exe
  C:\Windows\System\UbBTwdk.exe
  2⤵
  PID:13296
- C:\Windows\System\sGDFQem.exe
  C:\Windows\System\sGDFQem.exe
  2⤵
  PID:5096
- C:\Windows\System\CbhgxiC.exe
  C:\Windows\System\CbhgxiC.exe
  2⤵
  PID:11368
- C:\Windows\System\OLpEWTI.exe
  C:\Windows\System\OLpEWTI.exe
  2⤵
  PID:12384
- C:\Windows\System\SlFcUdh.exe
  C:\Windows\System\SlFcUdh.exe
  2⤵
  PID:12432
- C:\Windows\System\jzdWMvx.exe
  C:\Windows\System\jzdWMvx.exe
  2⤵
  PID:12436
- C:\Windows\System\JUIphzR.exe
  C:\Windows\System\JUIphzR.exe
  2⤵
  PID:12604
- C:\Windows\System\RwpNLKS.exe
  C:\Windows\System\RwpNLKS.exe
  2⤵
  PID:12648
- C:\Windows\System\RrWearD.exe
  C:\Windows\System\RrWearD.exe
  2⤵
  PID:12688
- C:\Windows\System\mMTbHAx.exe
  C:\Windows\System\mMTbHAx.exe
  2⤵
  PID:12844
- C:\Windows\System\ZRbTtzw.exe
  C:\Windows\System\ZRbTtzw.exe
  2⤵
  PID:12848
- C:\Windows\System\fCgbprC.exe
  C:\Windows\System\fCgbprC.exe
  2⤵
  PID:12980
- C:\Windows\System\lxYVjeI.exe
  C:\Windows\System\lxYVjeI.exe
  2⤵
  PID:13032
- C:\Windows\System\xruXrKE.exe
  C:\Windows\System\xruXrKE.exe
  2⤵
  PID:13060
- C:\Windows\System\XrWRpYJ.exe
  C:\Windows\System\XrWRpYJ.exe
  2⤵
  PID:13168
- C:\Windows\System\FOVZfRk.exe
  C:\Windows\System\FOVZfRk.exe
  2⤵
  PID:13216
- C:\Windows\System\VNHNDBH.exe
  C:\Windows\System\VNHNDBH.exe
  2⤵
  PID:13292
- C:\Windows\System\FYGLgIO.exe
  C:\Windows\System\FYGLgIO.exe
  2⤵
  PID:13304
- C:\Windows\System\nZWVJYH.exe
  C:\Windows\System\nZWVJYH.exe
  2⤵
  PID:12408
- C:\Windows\System\tkwyfgC.exe
  C:\Windows\System\tkwyfgC.exe
  2⤵
  PID:12576
- C:\Windows\System\AuriqmC.exe
  C:\Windows\System\AuriqmC.exe
  2⤵
  PID:12696
- C:\Windows\System\JNJQlhc.exe
  C:\Windows\System\JNJQlhc.exe
  2⤵
  PID:12908
- C:\Windows\System\LYatXbd.exe
  C:\Windows\System\LYatXbd.exe
  2⤵
  PID:13084
- C:\Windows\System\ZzqUwZH.exe
  C:\Windows\System\ZzqUwZH.exe
  2⤵
  PID:13232
- C:\Windows\System\aUBPOSU.exe
  C:\Windows\System\aUBPOSU.exe
  2⤵
  PID:12328
- C:\Windows\System\giXAPcC.exe
  C:\Windows\System\giXAPcC.exe
  2⤵
  PID:12496
- C:\Windows\System\vfMvzhC.exe
  C:\Windows\System\vfMvzhC.exe
  2⤵
  PID:12552
- C:\Windows\System\dHzhVSe.exe
  C:\Windows\System\dHzhVSe.exe
  2⤵
  PID:13044
- C:\Windows\System\dsmJIlE.exe
  C:\Windows\System\dsmJIlE.exe
  2⤵
  PID:1336
- C:\Windows\System\YBkgEdg.exe
  C:\Windows\System\YBkgEdg.exe
  2⤵
  PID:12396
- C:\Windows\System\XovuGgR.exe
  C:\Windows\System\XovuGgR.exe
  2⤵
  PID:12884
- C:\Windows\System\tmEEKcA.exe
  C:\Windows\System\tmEEKcA.exe
  2⤵
  PID:13352
- C:\Windows\System\qpALhSN.exe
  C:\Windows\System\qpALhSN.exe
  2⤵
  PID:13384
- C:\Windows\System\whxKfOu.exe
  C:\Windows\System\whxKfOu.exe
  2⤵
  PID:13412
- C:\Windows\System\eLsQDaQ.exe
  C:\Windows\System\eLsQDaQ.exe
  2⤵
  PID:13436
- C:\Windows\System\VfAUwuq.exe
  C:\Windows\System\VfAUwuq.exe
  2⤵
  PID:13460
- C:\Windows\System\RutFNxz.exe
  C:\Windows\System\RutFNxz.exe
  2⤵
  PID:13484
- C:\Windows\System\DkzaqOo.exe
  C:\Windows\System\DkzaqOo.exe
  2⤵
  PID:13532
- C:\Windows\System\jaSaNWV.exe
  C:\Windows\System\jaSaNWV.exe
  2⤵
  PID:13560
- C:\Windows\System\vsqhTeD.exe
  C:\Windows\System\vsqhTeD.exe
  2⤵
  PID:13580
- C:\Windows\System\MFnNUju.exe
  C:\Windows\System\MFnNUju.exe
  2⤵
  PID:13616
- C:\Windows\System\GtIjegZ.exe
  C:\Windows\System\GtIjegZ.exe
  2⤵
  PID:13652
- C:\Windows\System\laaZkBV.exe
  C:\Windows\System\laaZkBV.exe
  2⤵
  PID:13680
- C:\Windows\System\rYOWHSg.exe
  C:\Windows\System\rYOWHSg.exe
  2⤵
  PID:13700
- C:\Windows\System\IKfDMWX.exe
  C:\Windows\System\IKfDMWX.exe
  2⤵
  PID:13736
- C:\Windows\System\KEMKLDi.exe
  C:\Windows\System\KEMKLDi.exe
  2⤵
  PID:13764
- C:\Windows\System\AQyHmFd.exe
  C:\Windows\System\AQyHmFd.exe
  2⤵
  PID:13800
- C:\Windows\System\NZukTxq.exe
  C:\Windows\System\NZukTxq.exe
  2⤵
  PID:13824
- C:\Windows\System\juJxvSA.exe
  C:\Windows\System\juJxvSA.exe
  2⤵
  PID:13852
- C:\Windows\System\NKvvOIu.exe
  C:\Windows\System\NKvvOIu.exe
  2⤵
  PID:13876
- C:\Windows\System\JezuPQE.exe
  C:\Windows\System\JezuPQE.exe
  2⤵
  PID:13908
- C:\Windows\System\kGVzDMX.exe
  C:\Windows\System\kGVzDMX.exe
  2⤵
  PID:13936
- C:\Windows\System\kHYRaHV.exe
  C:\Windows\System\kHYRaHV.exe
  2⤵
  PID:13964
- C:\Windows\System\uFNVeQZ.exe
  C:\Windows\System\uFNVeQZ.exe
  2⤵
  PID:14000
- C:\Windows\System\tpUfeaE.exe
  C:\Windows\System\tpUfeaE.exe
  2⤵
  PID:14024
- C:\Windows\System\BHHeWjz.exe
  C:\Windows\System\BHHeWjz.exe
  2⤵
  PID:14056
- C:\Windows\System\uTqYKsP.exe
  C:\Windows\System\uTqYKsP.exe
  2⤵
  PID:14080
- C:\Windows\System\YbyAsio.exe
  C:\Windows\System\YbyAsio.exe
  2⤵
  PID:14108
- C:\Windows\System\VQVOWvC.exe
  C:\Windows\System\VQVOWvC.exe
  2⤵
  PID:14136
- C:\Windows\System\TamxQbo.exe
  C:\Windows\System\TamxQbo.exe
  2⤵
  PID:14160
- C:\Windows\System\GpUdbWG.exe
  C:\Windows\System\GpUdbWG.exe
  2⤵
  PID:14192
- C:\Windows\System\jyGIlqB.exe
  C:\Windows\System\jyGIlqB.exe
  2⤵
  PID:14224
- C:\Windows\System\OZfINyf.exe
  C:\Windows\System\OZfINyf.exe
  2⤵
  PID:14244
- C:\Windows\System\ooYQykh.exe
  C:\Windows\System\ooYQykh.exe
  2⤵
  PID:14280
- C:\Windows\System\Oqifola.exe
  C:\Windows\System\Oqifola.exe
  2⤵
  PID:14300
- C:\Windows\System\SpMceVc.exe
  C:\Windows\System\SpMceVc.exe
  2⤵
  PID:13288
- C:\Windows\System\KKWAEYD.exe
  C:\Windows\System\KKWAEYD.exe
  2⤵
  PID:13376
- C:\Windows\System\xqdLMgn.exe
  C:\Windows\System\xqdLMgn.exe
  2⤵
  PID:13364
- C:\Windows\System\mAYaQXg.exe
  C:\Windows\System\mAYaQXg.exe
  2⤵
  PID:13428
- C:\Windows\System\aCIUeRn.exe
  C:\Windows\System\aCIUeRn.exe
  2⤵
  PID:13476
- C:\Windows\System\unfnHSU.exe
  C:\Windows\System\unfnHSU.exe
  2⤵
  PID:13628
- C:\Windows\System\rWvGTCb.exe
  C:\Windows\System\rWvGTCb.exe
  2⤵
  PID:13604
- C:\Windows\System\HCQpUgC.exe
  C:\Windows\System\HCQpUgC.exe
  2⤵
  PID:13724
- C:\Windows\System\sqoDsCx.exe
  C:\Windows\System\sqoDsCx.exe
  2⤵
  PID:3500
- C:\Windows\System\EUohxXO.exe
  C:\Windows\System\EUohxXO.exe
  2⤵
  PID:13816
- C:\Windows\System\dOvogaI.exe
  C:\Windows\System\dOvogaI.exe
  2⤵
  PID:13848
- C:\Windows\System\YIpOgdF.exe
  C:\Windows\System\YIpOgdF.exe
  2⤵
  PID:13868
- C:\Windows\System\AbFGhGm.exe
  C:\Windows\System\AbFGhGm.exe
  2⤵
  PID:13972
- C:\Windows\System\csnkdOp.exe
  C:\Windows\System\csnkdOp.exe
  2⤵
  PID:13996
- C:\Windows\System\cnvdSpg.exe
  C:\Windows\System\cnvdSpg.exe
  2⤵
  PID:14052
- C:\Windows\System\hYMaOjO.exe
  C:\Windows\System\hYMaOjO.exe
  2⤵
  PID:14144
- C:\Windows\System\yremZRB.exe
  C:\Windows\System\yremZRB.exe
  2⤵
  PID:14240
- C:\Windows\System\lxrrruM.exe
  C:\Windows\System\lxrrruM.exe
  2⤵
  PID:14264
- C:\Windows\System\qzWITWw.exe
  C:\Windows\System\qzWITWw.exe
  2⤵
  PID:14312
- C:\Windows\System\DbeGxsp.exe
  C:\Windows\System\DbeGxsp.exe
  2⤵
  PID:13408
- C:\Windows\System\koTSpVd.exe
  C:\Windows\System\koTSpVd.exe
  2⤵
  PID:13556
- C:\Windows\System\EIbiqRd.exe
  C:\Windows\System\EIbiqRd.exe
  2⤵
  PID:13640
- C:\Windows\System\GjtgAjB.exe
  C:\Windows\System\GjtgAjB.exe
  2⤵
  PID:13676
- C:\Windows\System\XIsrgPN.exe
  C:\Windows\System\XIsrgPN.exe
  2⤵
  PID:13928
- C:\Windows\System\kufKiQZ.exe
  C:\Windows\System\kufKiQZ.exe
  2⤵
  PID:13960
- C:\Windows\System\zkQhdMs.exe
  C:\Windows\System\zkQhdMs.exe
  2⤵
  PID:14132
- C:\Windows\System\lTierDM.exe
  C:\Windows\System\lTierDM.exe
  2⤵
  PID:14324
- C:\Windows\System\DBfhWJu.exe
  C:\Windows\System\DBfhWJu.exe
  2⤵
  PID:13776
- C:\Windows\System\nJxveLY.exe
  C:\Windows\System\nJxveLY.exe
  2⤵
  PID:12712
- C:\Windows\System\vGIjvCK.exe
  C:\Windows\System\vGIjvCK.exe
  2⤵
  PID:13892
- C:\Windows\System\oGPEJqu.exe
  C:\Windows\System\oGPEJqu.exe
  2⤵
  PID:14368
- C:\Windows\System\PiLaFty.exe
  C:\Windows\System\PiLaFty.exe
  2⤵
  PID:14396
- C:\Windows\System\pyksNgb.exe
  C:\Windows\System\pyksNgb.exe
  2⤵
  PID:14416
- C:\Windows\System\NbRPJGf.exe
  C:\Windows\System\NbRPJGf.exe
  2⤵
  PID:14440
- C:\Windows\System\NHDwBEa.exe
  C:\Windows\System\NHDwBEa.exe
  2⤵
  PID:14460
- C:\Windows\System\HvFIxpk.exe
  C:\Windows\System\HvFIxpk.exe
  2⤵
  PID:14492
- C:\Windows\System\WtlvZzq.exe
  C:\Windows\System\WtlvZzq.exe
  2⤵
  PID:14512
- C:\Windows\System\vSnfXDW.exe
  C:\Windows\System\vSnfXDW.exe
  2⤵
  PID:14536
- C:\Windows\System\JVgxJGX.exe
  C:\Windows\System\JVgxJGX.exe
  2⤵
  PID:14564
- C:\Windows\System\XrJEUsy.exe
  C:\Windows\System\XrJEUsy.exe
  2⤵
  PID:14596
- C:\Windows\System\RLlTZrp.exe
  C:\Windows\System\RLlTZrp.exe
  2⤵
  PID:14632
- C:\Windows\System\wlTzpVP.exe
  C:\Windows\System\wlTzpVP.exe
  2⤵
  PID:14672
- C:\Windows\System\AHuGvoB.exe
  C:\Windows\System\AHuGvoB.exe
  2⤵
  PID:14748
- C:\Windows\System\Twvcnlo.exe
  C:\Windows\System\Twvcnlo.exe
  2⤵
  PID:14772
- C:\Windows\System\IZUIMxR.exe
  C:\Windows\System\IZUIMxR.exe
  2⤵
  PID:14940
- C:\Windows\System\OIZmpQY.exe
  C:\Windows\System\OIZmpQY.exe
  2⤵
  PID:14960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:5760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AZXYGaL.exe

Filesize
2.8MB

MD5
37d1bb7160e1e48d8d8fb745e0ec61e2

SHA1
aa9c1de5a6bf7d2e94557760133527ef8ced4d57

SHA256
0eaef671799a154f2aef40184cfd4ec856ddad27a945dec34443c96cc08e0141

SHA512
b1f56b7bdf82d0018c9fcb4b9f8a8479f2853b425e30eed8ffd29c4f319082df2b2eedf11c75489870475d8aaa39ba47184babc52bda4f94aeb68189781fade9

Download Submit
C:\Windows\System\AuNinwI.exe

Filesize
2.8MB

MD5
5252d65628b66af135389162f11af6fb

SHA1
b9d00c431e35bb5f78683cd8b51ffe5ce772dc29

SHA256
88abbdafb867d6590eaa2c9863cdf034e58be2e9a4e9a47c36921d67aac5a57e

SHA512
577107d0be8f6ed5f88c81ac69a7352d57bf0d649f5c90f042ab01fdc3b5d9af8d70fcdabc5291974a108f7814c747d2887418b62739d35b1533d8f6cf0883dc

Download Submit
C:\Windows\System\NYevfIE.exe

Filesize
2.8MB

MD5
4c94a0e7c968d7e26c7cf9a16ba69f2e

SHA1
4590310b120f6483f4344f595c455f67c941bb4c

SHA256
4bc12f2f48e894a6b3dc604fd3730dc59fa400fe786fa95a6401bef98c53f0dd

SHA512
449088769aeee6f2d8a2e769f0875574cb75242345d4f2d9924c229e51fa3a9642d96ff3eaab772e9d3cbefe7af00e846099b909b4715b1db6e07b7c75c3ae1d

Download Submit
C:\Windows\System\NgHXRoK.exe

Filesize
2.8MB

MD5
9a93963f4d0bddeae50855af5b3fb99b

SHA1
1f5025d797391fbbaae73857e0fc7f1202b33af8

SHA256
2d4763fa3fb2030887e52cce62fb74de95a158dfa89e6cb525859f2a616a2843

SHA512
22711d49f25f8c7ad0632ac330d4116b8e2ca0e5afb0d1fb3f6d7562f7b7c24b5130f3c66cdf4fcad181f7ce1c372d87eca296cc2d561f29dfb56489b303d2f5

Download Submit
C:\Windows\System\OjPLzKo.exe

Filesize
2.8MB

MD5
64ec53caccb80988ebc0c24dda0ed681

SHA1
4256ee4c92b9e976e4f52a5d861f8f2200f8d46e

SHA256
a9b46a344a7969a68b651036bb69e14cb1d2fe9eaf5200694bafb725bb1ac7a7

SHA512
90d69c96a114309f89ead25469637a914acb8a875fbab42b8d6c3fc99ee1d7d14666c889448f8323b827b1ae888288c6e1d69db86e2bf65bb15b92c72cd4ea9a

Download Submit
C:\Windows\System\OsvuZnl.exe

Filesize
2.8MB

MD5
aac2ce5958c8f636e9ec03d6c7fcdf33

SHA1
8c75139130bc7b4cd022d80c35e25b9554fd33e0

SHA256
02a9b89bc367ea295be37fe8482ff461d8a730e6d144cb19ea7d01bc6b6a027a

SHA512
a2241003b1e0adaac420d20ca67f86fc22c95d78550edcb79d841d3e172494592a2b8d631fcec04bf08ecb4487d71668fc560d7c3dd4841efdc49339871bc376

Download Submit
C:\Windows\System\RZuXRNS.exe

Filesize
2.8MB

MD5
7b1aa76dc633ca7be4db24d851142872

SHA1
04ecf96f4a337f247e0ac28e13176a588620eaa8

SHA256
405dfefd031d0a6b2a4cc6f2cd7a240cf2b2b0a78a884b4cdc2cb69f82ecfd4e

SHA512
47a9a2badeacd1332ba7c63420bab7ebf89dd8896fb6789e37b71f1eecce9270785d11eff02991b288a2619f17050773082835f165b6817d9564cd23f641647e

Download Submit
C:\Windows\System\RldKSCG.exe

Filesize
2.8MB

MD5
71fa5adabf65c786a742a94c454fa1dc

SHA1
872bb85bf3e2a56010590f934249c29a3f7795bd

SHA256
3e9fe65c742357c4dca53f1e46e1b4e780985273fcf3a8fb67f738031e804bba

SHA512
e64978526e39a22c44db93f03751528dec70a432855d1a7ffa3a461db81d578e630589148b8dcc46de1a92e25be1503207eb574bc6e4181c28d620eb9af17734

Download Submit
C:\Windows\System\SEglfts.exe

Filesize
2.8MB

MD5
6419af75de909ab2c31e848673624351

SHA1
2f8479b40af6ade87f19a56b28e9f60b028206ab

SHA256
d9ebcd81fd7683477ed197e4446136ae0a00dd2829ae37465d77ab872203b542

SHA512
56022d8be5d474c0311b3e8614e08a306d1ede90804fcda8a3e4298447735bfd13d1bdb90345eea2cb412891d21547bc5ba9290634a852b7a37f48838d0fc484

Download Submit
C:\Windows\System\SJwTbnC.exe

Filesize
2.8MB

MD5
3a3b418409fb1aefbc714d364dea0bad

SHA1
59d16b2bc5d12b4550e5d146c6e1e3e05efd1f00

SHA256
d6204c33468626d5fca2c026e71ba2c6f5cb022d05ab4e7369c6b388ee6c72ec

SHA512
8e07b7d1aba5d9b9809afb5388fdf836d25194648904f3a0afca2b0e239ed03eaba59f799b720272392a481d7694126ecc713554731021942a9fb6b425844b37

Download Submit
C:\Windows\System\XKdvRNs.exe

Filesize
2.8MB

MD5
712021dcd920d688374a004504644eb8

SHA1
6e96aa9850c5cd342a14b034cde0928ed5137b56

SHA256
d8fb9ca6b9c4d1116280c2f48474c188f9636be69f9d0de596103c939cb8b01a

SHA512
545d1bdb66d81b433c60e8d8b387df369e9dcf51444d9bd7394f118a50bce7e06a3773b47f9454b4b25b1a8dfb5ae98bd05a94cf8c77fbabf82d2b192b9d5d9e

Download Submit
C:\Windows\System\ZCRcDZN.exe

Filesize
2.8MB

MD5
0b930874dc03024d1855f906c750615c

SHA1
8baf2401282d151d688feb1104b63a9b83221208

SHA256
bfde65dd49cf5294378b01621dd89963a56c64af491dce2529c67b927e277a31

SHA512
9ab3f30ad5debc7cc49cca93faa55fa249ee8d78f48089899860caf2cef4601bb42f164f300aecbec7165f4d04e0f0d3c9a639e53173fd86dd2d3162faaa9786

Download Submit
C:\Windows\System\ZveLheK.exe

Filesize
2.8MB

MD5
8759458560a936eef5dd9391c9cc99db

SHA1
541b6e1829c3361ac43f43706a8c41625873cbf2

SHA256
d65cfef38dbcdab415a5a9044f42a4828f86a7b22af75532cbce072eccc11044

SHA512
e94420cf688f1d0cde05cd0e4b6e74b462ad79c74f86712e235ad9be35b299f47fcf6ce7000540daaa3f91bb3093766485f2da58e375b76924a969e6aabcff08

Download Submit
C:\Windows\System\aTrTTZO.exe

Filesize
2.8MB

MD5
d1381741f351118ff16d28a733379cdc

SHA1
3bfb7bf3bf921a01c3339bc202338c631838f4b1

SHA256
39d16e0818b095d99cd9d9f0c3c6bd754b035b267d88e0717bd59122fe943ef8

SHA512
b0a5311fc812802c1b0fa489d410e980a8a0fe5c5a613ca1cebdec25b959a40ff2e0afee47ae73d45d283aeb3238feddf57bfc2ba0b54046c524b90002e69da5

Download Submit
C:\Windows\System\bVEQCCN.exe

Filesize
2.8MB

MD5
da50ed01388d6d4b0f29bac63d65cb83

SHA1
4532ac76ec633a98734b7f412a45d56b68a53913

SHA256
e6ad1813b632b5f318a6a05cd7160e17d012341ec0ff4db32b06a16a9fe9e044

SHA512
3853639e04e6527440e76c3e201b6e736ed3d276b7dd674a88205056f68d8c977b264846e9766520cab1fd15d0925d3e93cb55d2f08a3a5335ef95ad8d39ddaa

Download Submit
C:\Windows\System\cHLgKds.exe

Filesize
2.8MB

MD5
9aa53ba2c83f7e64a2f492b32aee6516

SHA1
7eb79a213ef30f3ce038ec86d4eeabeac583692d

SHA256
a08083ed0db755ed2bd5feb59616f891bb44e950d440dc1739c882bd20cf27ce

SHA512
50a82fa5cc48ce86c23cea8b5ce6df9ea49d83c3fcc0c044f3ae25b716698ab4a38876016abe12fb384f8b40d4e90ebd849d0342605adfe2889eadaae2a2481d

Download Submit
C:\Windows\System\cqLLlul.exe

Filesize
2.8MB

MD5
e92e1b78fd319aa1a3e55d5aad178d1a

SHA1
48979eff7264c83d5751f2185edaee411fb6bb11

SHA256
e498e6e05881ab3aa1c54ac110e148cb28c3f4f52b1515ef7df2347324ed1571

SHA512
d37ae738441976387b31fc3cb83d736800f9e692c7d405a890188923d59836256306724f2c2f66401ecf9b529fc51bf0e5abfa0fab2c8fceb02e267050449812

Download Submit
C:\Windows\System\dPPEsnG.exe

Filesize
2.8MB

MD5
684c3fece53f69844da1cd7a7e1b8d17

SHA1
f0a195f9340d654729ef66c588f60f864c0d13b9

SHA256
99db04569765f69d55f1c8bd09423739b55851b508c6c269a437cc5a7b22e81e

SHA512
f7f4c34afaf7d887647b8181f56515ae577a81fa26001659d7f2c671266a879102ebebee721dc5d8d3e4ec236a195720cbb6cba6e0fbe83b49bce798627127ce

Download Submit
C:\Windows\System\dWhLlwy.exe

Filesize
2.8MB

MD5
05deccfadf6b95c24eb2c205c89a2432

SHA1
f331a46e59a50659390eeffb5beff69eaa818426

SHA256
1b90c739bf8c8918b8e663a1bf4fe5d92a360e42bb0a40aef59a7550e6304373

SHA512
7401ee722497b7bc06aa926b517f0159cabac3c23e6e8a14976538c2360cd621ec438651044b099f58d00f8e0998240c632b7726c1d3acb75f0e8bae27ca10fb

Download Submit
C:\Windows\System\eGWdPVo.exe

Filesize
2.8MB

MD5
fa8ad42be31d1a6f0d9227153dd3b9f0

SHA1
62e656d9ec779387ce9f093d935f7b79ec809cb9

SHA256
91ee8494ddce5df005226d64eb3c65729da48710b02eddac692c8a302c6d5287

SHA512
82a95bd08d9ec8d4d237a885d486c433e1cede814529542e3446fe205e24e1d808b2e8523e38bd50c2da98fecbb97e4b67aff42ada83f1186a7271bf366b2149

Download Submit
C:\Windows\System\elOsWXt.exe

Filesize
2.8MB

MD5
b5185238057c2f79ac05d9d9eb4d0a8b

SHA1
7bb9ffebc52222361d6dbf52af2eb4d65197eab7

SHA256
ebe84f14c4b4a14db8f67214b695f692e9687d879f14a35236a825e265287b66

SHA512
3e5df905b4a9f9f6157fcf0d94cada3eac37912a60bffe1aa8ee017406357f03c3083d448763eaacc4ded675cd64e9c2c8e4109ea4773e42cb7b44e8d627d1f9

Download Submit
C:\Windows\System\fRNcSCX.exe

Filesize
2.8MB

MD5
761271ea85814de90dacdbb429f343f8

SHA1
880689878234dba87523c952b4498872bbce0775

SHA256
4ecb4c97a7c775bd54f447379185dd9b017cef85dbd3bc16b193ab408badd756

SHA512
0ae94b981ae67bab6e0006c6f75266326d6708fc422fead015d201fd0dcdaffd3511d782d5bdb4e6fcb988066fb059e7267bddc87b7b6cd09214fada0b939508

Download Submit
C:\Windows\System\ffdCtxp.exe

Filesize
2.8MB

MD5
9ab96c22f5cb02fa7d668b52091d6fbe

SHA1
9086816a6a35f605dee6382f059d4024a3d59214

SHA256
2b28b4144ffceb6b7476bb9e36e8b1f64a4566d76b5c4aad0407bb2c9c5d70ff

SHA512
99d7808381d868226f5ba2f3d9be60b0d94d66e30b1343cd15a1cee2ce5b73f6c9edcb4474a4fead53988de4054aab26fba2c8a9264c836521a9ad695a428aa5

Download Submit
C:\Windows\System\fqnxaRt.exe

Filesize
2.8MB

MD5
05ef871ffb85534be8fb2ecff6000ab6

SHA1
6b84926164aca34568f18593f896c0366537fea0

SHA256
fb0a3240ee54a5ab9b10282bf67cb498e0d277909c483b363941ad4eebf6e680

SHA512
8cfe5a29dece11895402f27983ac7173efb6e2d385ba58ddda07ac83df713c08cded3f9feac53ffee6b812d9f71241d3b75e97267691a93b8fdfb5e55f5a93d6

Download Submit
C:\Windows\System\hTcPHyG.exe

Filesize
2.8MB

MD5
7e6599238409973370f3271e4cc4724f

SHA1
17047dd6f2bfdf0e7922a2c7def0d2b3cad10154

SHA256
30d6642de6565400bd87a242314cf865a8d55489184b89c57756ab02db797821

SHA512
d18133b1b59d6ba3672da1f5979c9813bcd19ac96ae9f0a5e408a26a6607f6e30125a34b6321b4564a4de75ee437b17998747ab8ab089b61857415e175eb5d10

Download Submit
C:\Windows\System\lFICjin.exe

Filesize
2.8MB

MD5
cc36bdc1c00d38fe064cd730eaa845a1

SHA1
4a1185eab6e830a44b9238269c6bacf674fc426d

SHA256
4f8453c58a473ba80820e8a0fc95978fdf123d2dd1be8887422beb0b5d01bb45

SHA512
738320bf0124b8446589706185864a325de90a418206dce6bbf30812f36a3686d8b73cbeb8e78d0069431890fbd0ad3631ae8cd73100b5c4a8791c1b010b6fc7

Download Submit
C:\Windows\System\mrTmRcI.exe

Filesize
2.8MB

MD5
1d85423f8750a85bad4cbbcb17971ebf

SHA1
a8378f0003f18817a79fa73e7119e24d358c6af3

SHA256
77cc55abea22a7cf2652a2b114e13b88c6c842320816948351d6e72ff4fcb7c1

SHA512
3d81942b1b9ff2e4c8a5c191c5daa4f51136760589a171017d6cb0311eeb5e500d38df7e75558204723b00e6d9d4624d5d8b2d09adab3fc51b864c56bed9a3e6

Download Submit
C:\Windows\System\raeJsuf.exe

Filesize
2.8MB

MD5
fe46a76fca1fa2a2f9eb7ce6be7e9995

SHA1
7d25e364f535dcd79c60d53c2acfabf914a29e3d

SHA256
aa6a90948f04d38a03801d919603838e2299f250325b05a83910a180b08e16bb

SHA512
cbf100766e602af3d632375c2da2141cf175f3139f41b73b97be3dfc31435c85e342bd6350701ade16e6e4a9ef3daaec527ce7356af7c5a1ed862e648a64a46c

Download Submit
C:\Windows\System\rpdyEfP.exe

Filesize
2.8MB

MD5
79fa0b764fd6b8cab1ce1f10c9827bc7

SHA1
006d45e6c577b74570c81e18f711fd747e199e42

SHA256
142fc0960aed46544cbbeaa518a5f259b4722bd26fcef0b306dd053b84401712

SHA512
42cdcc6eccfb3a3b7ca14e721a823eb1ad03b5f5f824c9382e8a607b0a3446849cbf72ff02d4c665d4bf2434b94214aa8b7d5ee417483ac3dcf58138b57c4ae2

Download Submit
C:\Windows\System\sCJfuho.exe

Filesize
2.8MB

MD5
df74d1252a81abd6c8a9ad40b8a86853

SHA1
948369394ba0e26c9ab43b3f26cf530288f609b9

SHA256
0f0d16775f8b08bc84bf5d087509926557bd06ba7c5fa4ebaa010de12a42d89f

SHA512
690aab23223502e2268e3d199bda83ddecb82b0519fa54e8a3a1745974f109ee865390a627ecc16a26351e5d1931af1c033bf7e26c3e9da56246d15550a95065

Download Submit
C:\Windows\System\tDcBKtN.exe

Filesize
2.8MB

MD5
25dd06831dc4b5ded2a01def4380e351

SHA1
368e0b2443e0013a52e2bb2b6bb6a614430343f5

SHA256
fc17642091323798c4be6702f60fa8e118daf518b905f7b145e207f7ea191930

SHA512
0d4030f48ee8da65865273f417de69f5da9e0e2724c72968e7bc6fb9364fa32e39c122b218ca48c40f01f10fb8ad45c2a6b4f71be02147db8e555bcc8f5fcccf

Download Submit
C:\Windows\System\twNRaBM.exe

Filesize
2.8MB

MD5
2714c0caf59e13308fbe2ed39eda6680

SHA1
3de3dbeac0eb9d96306ab77cbccbe56d5436a013

SHA256
336b915a31354a490b8e1e624b482fa13513e75e43f8133ebe2901e4037a5b23

SHA512
29e3abbfae0221fd695b0589272f58c589fe863c6aaa48ee0b07cc2b609e8d99587e256bcfacf805f20d213fa160019510cd282e9b9a6d6fb7781f2a9a18b8e9

Download Submit
C:\Windows\System\uBvMcuW.exe

Filesize
2.8MB

MD5
38b10cb2edde19bac5cc93bdddc9d6f2

SHA1
e9a85fc34a47aec6a509404273e7f8362d17e94b

SHA256
9a6147fd10725d790a7d9dc4f3f4490201f6a42b9b7c97f885c98fb7d357483c

SHA512
89023325c74b256a7bf1a595cfd112c4a260607005466bab4c0422fc1c78d7233154368732d89c2436600d7a01846296d375026419a26f481752c543e2b00cdd

Download Submit
C:\Windows\System\uMjWEyc.exe

Filesize
2.8MB

MD5
889d1226a98f9cefde2e23992f92e151

SHA1
b1dc4f8a5cf126314051b8452b09b6ec249ef934

SHA256
f6e1a946e0dfd1ff8b2f027f77d452d1ca13092cf640598e6f37737baa55dc46

SHA512
2cb48b40015c17c037cc86ec86d279563ec672526a2515cbf29a3af64ca32030bfd1ba2bc23b0c1795541effdc49ab3e2ca460cffc487ac686db503c52abff1e

Download Submit
C:\Windows\System\yGrbRlt.exe

Filesize
2.8MB

MD5
89a3e090812bee5afe3e739acb37818c

SHA1
b5ad891a1132298530b75993bc63e10790fbc88f

SHA256
9ba5a2c4ffcc3b857e72f02f75a0576c293ed8635a93f95dd346327d2d63a3bd

SHA512
9ed6cc240b5de5628ebc780b60024bb800a871b512ab6dfeaa40591e8c66ee99a033f8237a62bd3a36d42db754e5370747a47c9d24ba35d393a88b1f3854a197

Download Submit
memory/380-152-0x00007FF63EF50000-0x00007FF63F2A4000-memory.dmp

Filesize
3.3MB

Download
memory/380-2105-0x00007FF63EF50000-0x00007FF63F2A4000-memory.dmp

Filesize
3.3MB

Download
memory/532-2115-0x00007FF6E2D40000-0x00007FF6E3094000-memory.dmp

Filesize
3.3MB

Download
memory/532-212-0x00007FF6E2D40000-0x00007FF6E3094000-memory.dmp

Filesize
3.3MB

Download
memory/1000-2111-0x00007FF7D8E00000-0x00007FF7D9154000-memory.dmp

Filesize
3.3MB

Download
memory/1000-157-0x00007FF7D8E00000-0x00007FF7D9154000-memory.dmp

Filesize
3.3MB

Download
memory/1040-2090-0x00007FF647DA0000-0x00007FF6480F4000-memory.dmp

Filesize
3.3MB

Download
memory/1040-158-0x00007FF647DA0000-0x00007FF6480F4000-memory.dmp

Filesize
3.3MB

Download
memory/1064-143-0x00007FF6B6DB0000-0x00007FF6B7104000-memory.dmp

Filesize
3.3MB

Download
memory/1064-2100-0x00007FF6B6DB0000-0x00007FF6B7104000-memory.dmp

Filesize
3.3MB

Download
memory/1548-213-0x00007FF73D0E0000-0x00007FF73D434000-memory.dmp

Filesize
3.3MB

Download
memory/1548-2113-0x00007FF73D0E0000-0x00007FF73D434000-memory.dmp

Filesize
3.3MB

Download
memory/1608-2107-0x00007FF6B2810000-0x00007FF6B2B64000-memory.dmp

Filesize
3.3MB

Download
memory/1608-162-0x00007FF6B2810000-0x00007FF6B2B64000-memory.dmp

Filesize
3.3MB

Download
memory/1616-2102-0x00007FF6CFF40000-0x00007FF6D0294000-memory.dmp

Filesize
3.3MB

Download
memory/1616-147-0x00007FF6CFF40000-0x00007FF6D0294000-memory.dmp

Filesize
3.3MB

Download
memory/1628-2106-0x00007FF712C80000-0x00007FF712FD4000-memory.dmp

Filesize
3.3MB

Download
memory/1628-153-0x00007FF712C80000-0x00007FF712FD4000-memory.dmp

Filesize
3.3MB

Download
memory/1652-70-0x00007FF70D720000-0x00007FF70DA74000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2093-0x00007FF70D720000-0x00007FF70DA74000-memory.dmp

Filesize
3.3MB

Download
memory/2252-10-0x00007FF754670000-0x00007FF7549C4000-memory.dmp

Filesize
3.3MB

Download
memory/2252-2085-0x00007FF754670000-0x00007FF7549C4000-memory.dmp

Filesize
3.3MB

Download
memory/2252-2088-0x00007FF754670000-0x00007FF7549C4000-memory.dmp

Filesize
3.3MB

Download
memory/2328-146-0x00007FF6F9950000-0x00007FF6F9CA4000-memory.dmp

Filesize
3.3MB

Download
memory/2328-2096-0x00007FF6F9950000-0x00007FF6F9CA4000-memory.dmp

Filesize
3.3MB

Download
memory/2692-0-0x00007FF7EA3C0000-0x00007FF7EA714000-memory.dmp

Filesize
3.3MB

Download
memory/2692-1-0x00000228A9E70000-0x00000228A9E80000-memory.dmp

Filesize
64KB

Download
memory/2740-2099-0x00007FF639320000-0x00007FF639674000-memory.dmp

Filesize
3.3MB

Download
memory/2740-151-0x00007FF639320000-0x00007FF639674000-memory.dmp

Filesize
3.3MB

Download
memory/2756-2103-0x00007FF775480000-0x00007FF7757D4000-memory.dmp

Filesize
3.3MB

Download
memory/2756-161-0x00007FF775480000-0x00007FF7757D4000-memory.dmp

Filesize
3.3MB

Download
memory/2784-2089-0x00007FF63A340000-0x00007FF63A694000-memory.dmp

Filesize
3.3MB

Download
memory/2784-26-0x00007FF63A340000-0x00007FF63A694000-memory.dmp

Filesize
3.3MB

Download
memory/2956-2097-0x00007FF60C1C0000-0x00007FF60C514000-memory.dmp

Filesize
3.3MB

Download
memory/2956-126-0x00007FF60C1C0000-0x00007FF60C514000-memory.dmp

Filesize
3.3MB

Download
memory/3260-2092-0x00007FF6A6C40000-0x00007FF6A6F94000-memory.dmp

Filesize
3.3MB

Download
memory/3260-93-0x00007FF6A6C40000-0x00007FF6A6F94000-memory.dmp

Filesize
3.3MB

Download
memory/3312-164-0x00007FF778220000-0x00007FF778574000-memory.dmp

Filesize
3.3MB

Download
memory/3312-2112-0x00007FF778220000-0x00007FF778574000-memory.dmp

Filesize
3.3MB

Download
memory/3380-2108-0x00007FF6A8210000-0x00007FF6A8564000-memory.dmp

Filesize
3.3MB

Download
memory/3380-155-0x00007FF6A8210000-0x00007FF6A8564000-memory.dmp

Filesize
3.3MB

Download
memory/3516-156-0x00007FF7DFD50000-0x00007FF7E00A4000-memory.dmp

Filesize
3.3MB

Download
memory/3516-2109-0x00007FF7DFD50000-0x00007FF7E00A4000-memory.dmp

Filesize
3.3MB

Download
memory/3708-2098-0x00007FF635D60000-0x00007FF6360B4000-memory.dmp

Filesize
3.3MB

Download
memory/3708-141-0x00007FF635D60000-0x00007FF6360B4000-memory.dmp

Filesize
3.3MB

Download
memory/3884-2101-0x00007FF7322E0000-0x00007FF732634000-memory.dmp

Filesize
3.3MB

Download
memory/3884-140-0x00007FF7322E0000-0x00007FF732634000-memory.dmp

Filesize
3.3MB

Download
memory/4148-159-0x00007FF6261D0000-0x00007FF626524000-memory.dmp

Filesize
3.3MB

Download
memory/4148-2094-0x00007FF6261D0000-0x00007FF626524000-memory.dmp

Filesize
3.3MB

Download
memory/4228-37-0x00007FF635FB0000-0x00007FF636304000-memory.dmp

Filesize
3.3MB

Download
memory/4228-2087-0x00007FF635FB0000-0x00007FF636304000-memory.dmp

Filesize
3.3MB

Download
memory/4252-150-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp

Filesize
3.3MB

Download
memory/4252-2104-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp

Filesize
3.3MB

Download
memory/4336-154-0x00007FF76FFE0000-0x00007FF770334000-memory.dmp

Filesize
3.3MB

Download
memory/4336-2110-0x00007FF76FFE0000-0x00007FF770334000-memory.dmp

Filesize
3.3MB

Download
memory/4364-163-0x00007FF764870000-0x00007FF764BC4000-memory.dmp

Filesize
3.3MB

Download
memory/4364-2114-0x00007FF764870000-0x00007FF764BC4000-memory.dmp

Filesize
3.3MB

Download
memory/4720-2095-0x00007FF6926F0000-0x00007FF692A44000-memory.dmp

Filesize
3.3MB

Download
memory/4720-160-0x00007FF6926F0000-0x00007FF692A44000-memory.dmp

Filesize
3.3MB

Download
memory/4996-2091-0x00007FF66E6A0000-0x00007FF66E9F4000-memory.dmp

Filesize
3.3MB

Download
memory/4996-110-0x00007FF66E6A0000-0x00007FF66E9F4000-memory.dmp

Filesize
3.3MB

Download