xmrig | 74a495b1e42539f4fc199507e4aba19fbc61c80e1931ad4699646be06fee9596

Analysis

max time kernel
125s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
Size

2.1MB
MD5

77376d0145b2ba5a4a30bdaeedd82640
SHA1

0668d403116a67cef96503c8c690df5173a65e8e
SHA256

74a495b1e42539f4fc199507e4aba19fbc61c80e1931ad4699646be06fee9596
SHA512

8a4c2360f560ab79aeddb50973353c065bcb78b5fac99a23fc067d1f0f7b2982381fb49747c37c9f9ecc3543ba6495e76231bba5e2c5655408253f9ae9460da0
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNU6ff91f2x:oemTLkNdfE0pZrQH

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2132-0-0x00007FF7DE4A0000-0x00007FF7DE7F4000-memory.dmp	xmrig
behavioral2/files/0x00090000000235b7-5.dat	xmrig
behavioral2/files/0x00070000000235bf-7.dat	xmrig
behavioral2/files/0x00070000000235be-13.dat	xmrig
behavioral2/memory/2112-21-0x00007FF793150000-0x00007FF7934A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235c2-31.dat	xmrig
behavioral2/files/0x00070000000235c0-26.dat	xmrig
behavioral2/memory/4596-36-0x00007FF7A2E90000-0x00007FF7A31E4000-memory.dmp	xmrig
behavioral2/memory/2528-42-0x00007FF763970000-0x00007FF763CC4000-memory.dmp	xmrig
behavioral2/memory/3216-48-0x00007FF7DD650000-0x00007FF7DD9A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235c4-53.dat	xmrig
behavioral2/files/0x00070000000235c6-59.dat	xmrig
behavioral2/files/0x00070000000235ca-76.dat	xmrig
behavioral2/files/0x00070000000235cf-99.dat	xmrig
behavioral2/files/0x00070000000235d1-117.dat	xmrig
behavioral2/files/0x00070000000235d4-132.dat	xmrig
behavioral2/files/0x00070000000235d9-149.dat	xmrig
behavioral2/memory/3444-710-0x00007FF760370000-0x00007FF7606C4000-memory.dmp	xmrig
behavioral2/memory/2796-711-0x00007FF7A1350000-0x00007FF7A16A4000-memory.dmp	xmrig
behavioral2/memory/2388-713-0x00007FF67C410000-0x00007FF67C764000-memory.dmp	xmrig
behavioral2/memory/3688-712-0x00007FF7D31F0000-0x00007FF7D3544000-memory.dmp	xmrig
behavioral2/memory/4516-714-0x00007FF7DE4B0000-0x00007FF7DE804000-memory.dmp	xmrig
behavioral2/files/0x00070000000235dd-169.dat	xmrig
behavioral2/files/0x00070000000235db-167.dat	xmrig
behavioral2/memory/1644-716-0x00007FF6C8850000-0x00007FF6C8BA4000-memory.dmp	xmrig
behavioral2/memory/1312-717-0x00007FF6B0390000-0x00007FF6B06E4000-memory.dmp	xmrig
behavioral2/memory/3272-715-0x00007FF614A40000-0x00007FF614D94000-memory.dmp	xmrig
behavioral2/memory/4900-718-0x00007FF7FC9E0000-0x00007FF7FCD34000-memory.dmp	xmrig
behavioral2/memory/4984-720-0x00007FF7A10F0000-0x00007FF7A1444000-memory.dmp	xmrig
behavioral2/memory/4676-721-0x00007FF700FE0000-0x00007FF701334000-memory.dmp	xmrig
behavioral2/memory/1016-719-0x00007FF64EA20000-0x00007FF64ED74000-memory.dmp	xmrig
behavioral2/files/0x00070000000235dc-163.dat	xmrig
behavioral2/files/0x00070000000235da-162.dat	xmrig
behavioral2/files/0x00070000000235d8-152.dat	xmrig
behavioral2/files/0x00070000000235d7-147.dat	xmrig
behavioral2/files/0x00070000000235d6-142.dat	xmrig
behavioral2/files/0x00070000000235d5-137.dat	xmrig
behavioral2/files/0x00070000000235d3-127.dat	xmrig
behavioral2/files/0x00070000000235d2-122.dat	xmrig
behavioral2/memory/2172-754-0x00007FF62B1D0000-0x00007FF62B524000-memory.dmp	xmrig
behavioral2/memory/924-763-0x00007FF6C1F20000-0x00007FF6C2274000-memory.dmp	xmrig
behavioral2/memory/3192-759-0x00007FF75AD30000-0x00007FF75B084000-memory.dmp	xmrig
behavioral2/memory/4724-771-0x00007FF605B70000-0x00007FF605EC4000-memory.dmp	xmrig
behavioral2/memory/384-745-0x00007FF7F4240000-0x00007FF7F4594000-memory.dmp	xmrig
behavioral2/memory/1624-740-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp	xmrig
behavioral2/memory/556-726-0x00007FF780A50000-0x00007FF780DA4000-memory.dmp	xmrig
behavioral2/memory/1124-729-0x00007FF6374D0000-0x00007FF637824000-memory.dmp	xmrig
behavioral2/files/0x00070000000235d0-112.dat	xmrig
behavioral2/files/0x00070000000235ce-102.dat	xmrig
behavioral2/files/0x00070000000235cd-97.dat	xmrig
behavioral2/files/0x00070000000235cc-92.dat	xmrig
behavioral2/files/0x00070000000235cb-85.dat	xmrig
behavioral2/files/0x00070000000235c9-72.dat	xmrig
behavioral2/files/0x00070000000235c8-67.dat	xmrig
behavioral2/files/0x00070000000235c7-65.dat	xmrig
behavioral2/files/0x00070000000235c5-57.dat	xmrig
behavioral2/files/0x00070000000235c3-46.dat	xmrig
behavioral2/files/0x00070000000235c1-32.dat	xmrig
behavioral2/memory/2996-23-0x00007FF7861F0000-0x00007FF786544000-memory.dmp	xmrig
behavioral2/memory/4400-10-0x00007FF748180000-0x00007FF7484D4000-memory.dmp	xmrig
behavioral2/memory/4556-779-0x00007FF658740000-0x00007FF658A94000-memory.dmp	xmrig
behavioral2/memory/1260-775-0x00007FF65D6E0000-0x00007FF65DA34000-memory.dmp	xmrig
behavioral2/memory/644-782-0x00007FF67FB80000-0x00007FF67FED4000-memory.dmp	xmrig
behavioral2/memory/4400-2084-0x00007FF748180000-0x00007FF7484D4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4400	VqZagzd.exe
2112	DEvNKGx.exe
2996	GgTFujT.exe
4596	lhHWgnd.exe
3216	zpqBkEE.exe
2528	ZpJhkTf.exe
3444	DdzGKsY.exe
4556	CrYACsw.exe
644	WILCJmo.exe
2796	AcxQbTn.exe
3688	amTBixQ.exe
2388	yhMimWt.exe
4516	OYuNVuT.exe
3272	eGGfuJr.exe
1644	AMyvMqq.exe
1312	WZzxICG.exe
4900	yGfbLPa.exe
1016	IEKRKZw.exe
4984	VFbWAPm.exe
4676	byBpFBv.exe
556	EHddIgU.exe
1124	WVuGRmI.exe
1624	XMYjjar.exe
384	jtNLtvo.exe
2172	eCAxNEq.exe
3192	yqtVOMK.exe
924	NFRvmJH.exe
4724	BaUboxg.exe
1260	SkyGNHB.exe
3596	XUoPMWg.exe
3288	tGaDklW.exe
2380	UCfdMwJ.exe
4076	LvTGTFb.exe
1912	SPFuriP.exe
3572	JnNOXnp.exe
1652	tjYpvsv.exe
2356	opkpXoD.exe
3124	fuTwXvY.exe
3176	tXOejNC.exe
1304	BYGYosb.exe
4332	owXucJZ.exe
448	bspwBpp.exe
2444	yKLfOOH.exe
2844	ssMzSiJ.exe
3644	IzqETqE.exe
544	iOQNaal.exe
3740	MUmlDDI.exe
3716	DEeKWEr.exe
1288	DXHHsSS.exe
1996	xMbiwAs.exe
2456	vrQxjrU.exe
1548	UdGiIsI.exe
4408	YszslPn.exe
5036	MSWdGAT.exe
4300	zcIcdlu.exe
5128	kdKnXVW.exe
5156	weXNaXq.exe
5184	TOVvhUo.exe
5212	sJcgKwl.exe
5240	XsHObOk.exe
5268	WxJpXms.exe
5296	BNrnYJG.exe
5324	FGZWkfb.exe
5352	MKGmotS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2132-0-0x00007FF7DE4A0000-0x00007FF7DE7F4000-memory.dmp	upx
behavioral2/files/0x00090000000235b7-5.dat	upx
behavioral2/files/0x00070000000235bf-7.dat	upx
behavioral2/files/0x00070000000235be-13.dat	upx
behavioral2/memory/2112-21-0x00007FF793150000-0x00007FF7934A4000-memory.dmp	upx
behavioral2/files/0x00070000000235c2-31.dat	upx
behavioral2/files/0x00070000000235c0-26.dat	upx
behavioral2/memory/4596-36-0x00007FF7A2E90000-0x00007FF7A31E4000-memory.dmp	upx
behavioral2/memory/2528-42-0x00007FF763970000-0x00007FF763CC4000-memory.dmp	upx
behavioral2/memory/3216-48-0x00007FF7DD650000-0x00007FF7DD9A4000-memory.dmp	upx
behavioral2/files/0x00070000000235c4-53.dat	upx
behavioral2/files/0x00070000000235c6-59.dat	upx
behavioral2/files/0x00070000000235ca-76.dat	upx
behavioral2/files/0x00070000000235cf-99.dat	upx
behavioral2/files/0x00070000000235d1-117.dat	upx
behavioral2/files/0x00070000000235d4-132.dat	upx
behavioral2/files/0x00070000000235d9-149.dat	upx
behavioral2/memory/3444-710-0x00007FF760370000-0x00007FF7606C4000-memory.dmp	upx
behavioral2/memory/2796-711-0x00007FF7A1350000-0x00007FF7A16A4000-memory.dmp	upx
behavioral2/memory/2388-713-0x00007FF67C410000-0x00007FF67C764000-memory.dmp	upx
behavioral2/memory/3688-712-0x00007FF7D31F0000-0x00007FF7D3544000-memory.dmp	upx
behavioral2/memory/4516-714-0x00007FF7DE4B0000-0x00007FF7DE804000-memory.dmp	upx
behavioral2/files/0x00070000000235dd-169.dat	upx
behavioral2/files/0x00070000000235db-167.dat	upx
behavioral2/memory/1644-716-0x00007FF6C8850000-0x00007FF6C8BA4000-memory.dmp	upx
behavioral2/memory/1312-717-0x00007FF6B0390000-0x00007FF6B06E4000-memory.dmp	upx
behavioral2/memory/3272-715-0x00007FF614A40000-0x00007FF614D94000-memory.dmp	upx
behavioral2/memory/4900-718-0x00007FF7FC9E0000-0x00007FF7FCD34000-memory.dmp	upx
behavioral2/memory/4984-720-0x00007FF7A10F0000-0x00007FF7A1444000-memory.dmp	upx
behavioral2/memory/4676-721-0x00007FF700FE0000-0x00007FF701334000-memory.dmp	upx
behavioral2/memory/1016-719-0x00007FF64EA20000-0x00007FF64ED74000-memory.dmp	upx
behavioral2/files/0x00070000000235dc-163.dat	upx
behavioral2/files/0x00070000000235da-162.dat	upx
behavioral2/files/0x00070000000235d8-152.dat	upx
behavioral2/files/0x00070000000235d7-147.dat	upx
behavioral2/files/0x00070000000235d6-142.dat	upx
behavioral2/files/0x00070000000235d5-137.dat	upx
behavioral2/files/0x00070000000235d3-127.dat	upx
behavioral2/files/0x00070000000235d2-122.dat	upx
behavioral2/memory/2172-754-0x00007FF62B1D0000-0x00007FF62B524000-memory.dmp	upx
behavioral2/memory/924-763-0x00007FF6C1F20000-0x00007FF6C2274000-memory.dmp	upx
behavioral2/memory/3192-759-0x00007FF75AD30000-0x00007FF75B084000-memory.dmp	upx
behavioral2/memory/4724-771-0x00007FF605B70000-0x00007FF605EC4000-memory.dmp	upx
behavioral2/memory/384-745-0x00007FF7F4240000-0x00007FF7F4594000-memory.dmp	upx
behavioral2/memory/1624-740-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp	upx
behavioral2/memory/556-726-0x00007FF780A50000-0x00007FF780DA4000-memory.dmp	upx
behavioral2/memory/1124-729-0x00007FF6374D0000-0x00007FF637824000-memory.dmp	upx
behavioral2/files/0x00070000000235d0-112.dat	upx
behavioral2/files/0x00070000000235ce-102.dat	upx
behavioral2/files/0x00070000000235cd-97.dat	upx
behavioral2/files/0x00070000000235cc-92.dat	upx
behavioral2/files/0x00070000000235cb-85.dat	upx
behavioral2/files/0x00070000000235c9-72.dat	upx
behavioral2/files/0x00070000000235c8-67.dat	upx
behavioral2/files/0x00070000000235c7-65.dat	upx
behavioral2/files/0x00070000000235c5-57.dat	upx
behavioral2/files/0x00070000000235c3-46.dat	upx
behavioral2/files/0x00070000000235c1-32.dat	upx
behavioral2/memory/2996-23-0x00007FF7861F0000-0x00007FF786544000-memory.dmp	upx
behavioral2/memory/4400-10-0x00007FF748180000-0x00007FF7484D4000-memory.dmp	upx
behavioral2/memory/4556-779-0x00007FF658740000-0x00007FF658A94000-memory.dmp	upx
behavioral2/memory/1260-775-0x00007FF65D6E0000-0x00007FF65DA34000-memory.dmp	upx
behavioral2/memory/644-782-0x00007FF67FB80000-0x00007FF67FED4000-memory.dmp	upx
behavioral2/memory/4400-2084-0x00007FF748180000-0x00007FF7484D4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DdzGKsY.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\weXNaXq.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\EYWxngD.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\eEXJQUs.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\iAZPOYX.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\SxWOXnT.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\VqZagzd.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\RewNOiz.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\zNkYFfW.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\QXfqwBH.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\sJcgKwl.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\xQuNWnH.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\xXJLsni.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\LvfWcZW.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\DnXLKiT.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\zmPRiuE.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\wIaObpu.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\TZlZwea.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\SLlhtSb.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\MKNWDbQ.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\TMkQXFp.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\IZeemUf.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\Zqefvcl.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\okmszVF.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\yuevnVe.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\xrbOgOT.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\NyERpRt.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\plwRlDM.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\XSysXSr.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\YqcvQhr.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\TnvyxmL.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\tpJzLOC.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\ahUmGhu.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\vzkhyUK.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\iyosidd.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\nPbGeAj.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\cnrRmeN.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\qDVaZaK.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\qlsWlje.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\yGfbLPa.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\bspwBpp.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\xMbiwAs.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\YtnNXDJ.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\zpqBkEE.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\lpkMMej.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\BHjijCF.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\QeQWdTU.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\wVLqYAV.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\lhHWgnd.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\XsHObOk.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\SAWueOt.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\YUhKfXt.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\kExTNlc.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\ucRyqYH.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\GOvyOdc.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\azGmcSy.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\opkpXoD.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\MvWKJlj.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\MgfXxdC.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\wRLkpwk.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\OWxBYit.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\sECUQpo.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\OZuEOsA.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\KVCOkfq.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4400	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	90
PID 2132 wrote to memory of 4400	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	90
PID 2132 wrote to memory of 2112	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	91
PID 2132 wrote to memory of 2112	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	91
PID 2132 wrote to memory of 2996	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	94
PID 2132 wrote to memory of 2996	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	94
PID 2132 wrote to memory of 4596	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	95
PID 2132 wrote to memory of 4596	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	95
PID 2132 wrote to memory of 3216	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	96
PID 2132 wrote to memory of 3216	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	96
PID 2132 wrote to memory of 2528	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	97
PID 2132 wrote to memory of 2528	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	97
PID 2132 wrote to memory of 3444	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	98
PID 2132 wrote to memory of 3444	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	98
PID 2132 wrote to memory of 4556	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	99
PID 2132 wrote to memory of 4556	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	99
PID 2132 wrote to memory of 644	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	100
PID 2132 wrote to memory of 644	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	100
PID 2132 wrote to memory of 2796	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	101
PID 2132 wrote to memory of 2796	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	101
PID 2132 wrote to memory of 3688	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	102
PID 2132 wrote to memory of 3688	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	102
PID 2132 wrote to memory of 2388	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	103
PID 2132 wrote to memory of 2388	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	103
PID 2132 wrote to memory of 4516	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	104
PID 2132 wrote to memory of 4516	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	104
PID 2132 wrote to memory of 3272	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	105
PID 2132 wrote to memory of 3272	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	105
PID 2132 wrote to memory of 1644	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	106
PID 2132 wrote to memory of 1644	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	106
PID 2132 wrote to memory of 1312	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	107
PID 2132 wrote to memory of 1312	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	107
PID 2132 wrote to memory of 4900	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	108
PID 2132 wrote to memory of 4900	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	108
PID 2132 wrote to memory of 1016	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	109
PID 2132 wrote to memory of 1016	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	109
PID 2132 wrote to memory of 4984	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	110
PID 2132 wrote to memory of 4984	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	110
PID 2132 wrote to memory of 4676	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	111
PID 2132 wrote to memory of 4676	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	111
PID 2132 wrote to memory of 556	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	112
PID 2132 wrote to memory of 556	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	112
PID 2132 wrote to memory of 1124	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	113
PID 2132 wrote to memory of 1124	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	113
PID 2132 wrote to memory of 1624	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	114
PID 2132 wrote to memory of 1624	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	114
PID 2132 wrote to memory of 384	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	115
PID 2132 wrote to memory of 384	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	115
PID 2132 wrote to memory of 2172	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	116
PID 2132 wrote to memory of 2172	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	116
PID 2132 wrote to memory of 3192	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	117
PID 2132 wrote to memory of 3192	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	117
PID 2132 wrote to memory of 924	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	118
PID 2132 wrote to memory of 924	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	118
PID 2132 wrote to memory of 4724	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	119
PID 2132 wrote to memory of 4724	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	119
PID 2132 wrote to memory of 1260	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	120
PID 2132 wrote to memory of 1260	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	120
PID 2132 wrote to memory of 3596	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	121
PID 2132 wrote to memory of 3596	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	121
PID 2132 wrote to memory of 3288	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	122
PID 2132 wrote to memory of 3288	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	122
PID 2132 wrote to memory of 2380	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	123
PID 2132 wrote to memory of 2380	2132	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\System\VqZagzd.exe
  C:\Windows\System\VqZagzd.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\DEvNKGx.exe
  C:\Windows\System\DEvNKGx.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\GgTFujT.exe
  C:\Windows\System\GgTFujT.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\lhHWgnd.exe
  C:\Windows\System\lhHWgnd.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\zpqBkEE.exe
  C:\Windows\System\zpqBkEE.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\ZpJhkTf.exe
  C:\Windows\System\ZpJhkTf.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\DdzGKsY.exe
  C:\Windows\System\DdzGKsY.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\CrYACsw.exe
  C:\Windows\System\CrYACsw.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\WILCJmo.exe
  C:\Windows\System\WILCJmo.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\AcxQbTn.exe
  C:\Windows\System\AcxQbTn.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\amTBixQ.exe
  C:\Windows\System\amTBixQ.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\yhMimWt.exe
  C:\Windows\System\yhMimWt.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\OYuNVuT.exe
  C:\Windows\System\OYuNVuT.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\eGGfuJr.exe
  C:\Windows\System\eGGfuJr.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\AMyvMqq.exe
  C:\Windows\System\AMyvMqq.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\WZzxICG.exe
  C:\Windows\System\WZzxICG.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\yGfbLPa.exe
  C:\Windows\System\yGfbLPa.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\IEKRKZw.exe
  C:\Windows\System\IEKRKZw.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\VFbWAPm.exe
  C:\Windows\System\VFbWAPm.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\byBpFBv.exe
  C:\Windows\System\byBpFBv.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\EHddIgU.exe
  C:\Windows\System\EHddIgU.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\WVuGRmI.exe
  C:\Windows\System\WVuGRmI.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\XMYjjar.exe
  C:\Windows\System\XMYjjar.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\jtNLtvo.exe
  C:\Windows\System\jtNLtvo.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\eCAxNEq.exe
  C:\Windows\System\eCAxNEq.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\yqtVOMK.exe
  C:\Windows\System\yqtVOMK.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\NFRvmJH.exe
  C:\Windows\System\NFRvmJH.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\BaUboxg.exe
  C:\Windows\System\BaUboxg.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\SkyGNHB.exe
  C:\Windows\System\SkyGNHB.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\XUoPMWg.exe
  C:\Windows\System\XUoPMWg.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\tGaDklW.exe
  C:\Windows\System\tGaDklW.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\UCfdMwJ.exe
  C:\Windows\System\UCfdMwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\LvTGTFb.exe
  C:\Windows\System\LvTGTFb.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\SPFuriP.exe
  C:\Windows\System\SPFuriP.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\JnNOXnp.exe
  C:\Windows\System\JnNOXnp.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\tjYpvsv.exe
  C:\Windows\System\tjYpvsv.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\opkpXoD.exe
  C:\Windows\System\opkpXoD.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\fuTwXvY.exe
  C:\Windows\System\fuTwXvY.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\tXOejNC.exe
  C:\Windows\System\tXOejNC.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\BYGYosb.exe
  C:\Windows\System\BYGYosb.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\owXucJZ.exe
  C:\Windows\System\owXucJZ.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\bspwBpp.exe
  C:\Windows\System\bspwBpp.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\yKLfOOH.exe
  C:\Windows\System\yKLfOOH.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\ssMzSiJ.exe
  C:\Windows\System\ssMzSiJ.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\IzqETqE.exe
  C:\Windows\System\IzqETqE.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\iOQNaal.exe
  C:\Windows\System\iOQNaal.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\MUmlDDI.exe
  C:\Windows\System\MUmlDDI.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\DEeKWEr.exe
  C:\Windows\System\DEeKWEr.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\DXHHsSS.exe
  C:\Windows\System\DXHHsSS.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\xMbiwAs.exe
  C:\Windows\System\xMbiwAs.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\vrQxjrU.exe
  C:\Windows\System\vrQxjrU.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\UdGiIsI.exe
  C:\Windows\System\UdGiIsI.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\YszslPn.exe
  C:\Windows\System\YszslPn.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\MSWdGAT.exe
  C:\Windows\System\MSWdGAT.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\zcIcdlu.exe
  C:\Windows\System\zcIcdlu.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\kdKnXVW.exe
  C:\Windows\System\kdKnXVW.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\weXNaXq.exe
  C:\Windows\System\weXNaXq.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\TOVvhUo.exe
  C:\Windows\System\TOVvhUo.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\sJcgKwl.exe
  C:\Windows\System\sJcgKwl.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\XsHObOk.exe
  C:\Windows\System\XsHObOk.exe
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Windows\System\WxJpXms.exe
  C:\Windows\System\WxJpXms.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\BNrnYJG.exe
  C:\Windows\System\BNrnYJG.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\FGZWkfb.exe
  C:\Windows\System\FGZWkfb.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\MKGmotS.exe
  C:\Windows\System\MKGmotS.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\xCSIHWn.exe
  C:\Windows\System\xCSIHWn.exe
  2⤵
  PID:5380
- C:\Windows\System\qBVriZH.exe
  C:\Windows\System\qBVriZH.exe
  2⤵
  PID:5412
- C:\Windows\System\ZzxBKra.exe
  C:\Windows\System\ZzxBKra.exe
  2⤵
  PID:5436
- C:\Windows\System\mrkWIlD.exe
  C:\Windows\System\mrkWIlD.exe
  2⤵
  PID:5464
- C:\Windows\System\lZGVPTE.exe
  C:\Windows\System\lZGVPTE.exe
  2⤵
  PID:5480
- C:\Windows\System\eRcNfLP.exe
  C:\Windows\System\eRcNfLP.exe
  2⤵
  PID:5512
- C:\Windows\System\ePCvJxU.exe
  C:\Windows\System\ePCvJxU.exe
  2⤵
  PID:5540
- C:\Windows\System\vshqKBc.exe
  C:\Windows\System\vshqKBc.exe
  2⤵
  PID:5564
- C:\Windows\System\YcSKEWM.exe
  C:\Windows\System\YcSKEWM.exe
  2⤵
  PID:5592
- C:\Windows\System\gZxadfk.exe
  C:\Windows\System\gZxadfk.exe
  2⤵
  PID:5620
- C:\Windows\System\mhZdeGv.exe
  C:\Windows\System\mhZdeGv.exe
  2⤵
  PID:5648
- C:\Windows\System\hFkofrG.exe
  C:\Windows\System\hFkofrG.exe
  2⤵
  PID:5676
- C:\Windows\System\ULNoKtn.exe
  C:\Windows\System\ULNoKtn.exe
  2⤵
  PID:5704
- C:\Windows\System\UIWzndt.exe
  C:\Windows\System\UIWzndt.exe
  2⤵
  PID:5728
- C:\Windows\System\XgOzMOS.exe
  C:\Windows\System\XgOzMOS.exe
  2⤵
  PID:5760
- C:\Windows\System\mNrFaWo.exe
  C:\Windows\System\mNrFaWo.exe
  2⤵
  PID:5788
- C:\Windows\System\TFXQEvr.exe
  C:\Windows\System\TFXQEvr.exe
  2⤵
  PID:5816
- C:\Windows\System\pPkRxAu.exe
  C:\Windows\System\pPkRxAu.exe
  2⤵
  PID:5844
- C:\Windows\System\MvWKJlj.exe
  C:\Windows\System\MvWKJlj.exe
  2⤵
  PID:5872
- C:\Windows\System\MgfXxdC.exe
  C:\Windows\System\MgfXxdC.exe
  2⤵
  PID:5900
- C:\Windows\System\nvgORCX.exe
  C:\Windows\System\nvgORCX.exe
  2⤵
  PID:5928
- C:\Windows\System\dMDdmAT.exe
  C:\Windows\System\dMDdmAT.exe
  2⤵
  PID:5956
- C:\Windows\System\NSIohWA.exe
  C:\Windows\System\NSIohWA.exe
  2⤵
  PID:5984
- C:\Windows\System\yomHLzY.exe
  C:\Windows\System\yomHLzY.exe
  2⤵
  PID:6012
- C:\Windows\System\KuTtLKT.exe
  C:\Windows\System\KuTtLKT.exe
  2⤵
  PID:6040
- C:\Windows\System\kamewVI.exe
  C:\Windows\System\kamewVI.exe
  2⤵
  PID:6068
- C:\Windows\System\RefeZTf.exe
  C:\Windows\System\RefeZTf.exe
  2⤵
  PID:6096
- C:\Windows\System\TGJMcUi.exe
  C:\Windows\System\TGJMcUi.exe
  2⤵
  PID:6124
- C:\Windows\System\iAovBWo.exe
  C:\Windows\System\iAovBWo.exe
  2⤵
  PID:844
- C:\Windows\System\TGkYEQe.exe
  C:\Windows\System\TGkYEQe.exe
  2⤵
  PID:4428
- C:\Windows\System\Vopbiuq.exe
  C:\Windows\System\Vopbiuq.exe
  2⤵
  PID:1784
- C:\Windows\System\hWyWvLK.exe
  C:\Windows\System\hWyWvLK.exe
  2⤵
  PID:3096
- C:\Windows\System\gsDhBtJ.exe
  C:\Windows\System\gsDhBtJ.exe
  2⤵
  PID:2336
- C:\Windows\System\wxwRfSv.exe
  C:\Windows\System\wxwRfSv.exe
  2⤵
  PID:2320
- C:\Windows\System\Wrkzjhu.exe
  C:\Windows\System\Wrkzjhu.exe
  2⤵
  PID:5176
- C:\Windows\System\jJdmJWS.exe
  C:\Windows\System\jJdmJWS.exe
  2⤵
  PID:5252
- C:\Windows\System\eEXJQUs.exe
  C:\Windows\System\eEXJQUs.exe
  2⤵
  PID:5312
- C:\Windows\System\SpGkssR.exe
  C:\Windows\System\SpGkssR.exe
  2⤵
  PID:5372
- C:\Windows\System\DMwiSZZ.exe
  C:\Windows\System\DMwiSZZ.exe
  2⤵
  PID:5448
- C:\Windows\System\IHxDjmp.exe
  C:\Windows\System\IHxDjmp.exe
  2⤵
  PID:5500
- C:\Windows\System\hOEpDYw.exe
  C:\Windows\System\hOEpDYw.exe
  2⤵
  PID:5560
- C:\Windows\System\TNlKYZL.exe
  C:\Windows\System\TNlKYZL.exe
  2⤵
  PID:5632
- C:\Windows\System\foIejbi.exe
  C:\Windows\System\foIejbi.exe
  2⤵
  PID:5692
- C:\Windows\System\TravTfd.exe
  C:\Windows\System\TravTfd.exe
  2⤵
  PID:5748
- C:\Windows\System\FTqEAgl.exe
  C:\Windows\System\FTqEAgl.exe
  2⤵
  PID:5828
- C:\Windows\System\fmWYvlJ.exe
  C:\Windows\System\fmWYvlJ.exe
  2⤵
  PID:5888
- C:\Windows\System\wEeOhzd.exe
  C:\Windows\System\wEeOhzd.exe
  2⤵
  PID:5948
- C:\Windows\System\zXsGkPB.exe
  C:\Windows\System\zXsGkPB.exe
  2⤵
  PID:6024
- C:\Windows\System\KjGCEvg.exe
  C:\Windows\System\KjGCEvg.exe
  2⤵
  PID:6088
- C:\Windows\System\VkJLSUN.exe
  C:\Windows\System\VkJLSUN.exe
  2⤵
  PID:2572
- C:\Windows\System\dKgtzXH.exe
  C:\Windows\System\dKgtzXH.exe
  2⤵
  PID:4668
- C:\Windows\System\yskYVaM.exe
  C:\Windows\System\yskYVaM.exe
  2⤵
  PID:3828
- C:\Windows\System\XPEhXGv.exe
  C:\Windows\System\XPEhXGv.exe
  2⤵
  PID:5228
- C:\Windows\System\plwRlDM.exe
  C:\Windows\System\plwRlDM.exe
  2⤵
  PID:1108
- C:\Windows\System\hgqYvIF.exe
  C:\Windows\System\hgqYvIF.exe
  2⤵
  PID:5492
- C:\Windows\System\BslcRkk.exe
  C:\Windows\System\BslcRkk.exe
  2⤵
  PID:6164
- C:\Windows\System\gooLgMB.exe
  C:\Windows\System\gooLgMB.exe
  2⤵
  PID:6192
- C:\Windows\System\iRsUwJK.exe
  C:\Windows\System\iRsUwJK.exe
  2⤵
  PID:6220
- C:\Windows\System\sBhCfSJ.exe
  C:\Windows\System\sBhCfSJ.exe
  2⤵
  PID:6248
- C:\Windows\System\RXOKjll.exe
  C:\Windows\System\RXOKjll.exe
  2⤵
  PID:6276
- C:\Windows\System\BmwXnsS.exe
  C:\Windows\System\BmwXnsS.exe
  2⤵
  PID:6304
- C:\Windows\System\FhBONDv.exe
  C:\Windows\System\FhBONDv.exe
  2⤵
  PID:6332
- C:\Windows\System\bYnihZE.exe
  C:\Windows\System\bYnihZE.exe
  2⤵
  PID:6360
- C:\Windows\System\WJfKssP.exe
  C:\Windows\System\WJfKssP.exe
  2⤵
  PID:6388
- C:\Windows\System\YHeEXvG.exe
  C:\Windows\System\YHeEXvG.exe
  2⤵
  PID:6416
- C:\Windows\System\mRtolLC.exe
  C:\Windows\System\mRtolLC.exe
  2⤵
  PID:6444
- C:\Windows\System\hMsHFLd.exe
  C:\Windows\System\hMsHFLd.exe
  2⤵
  PID:6472
- C:\Windows\System\VlEYYYP.exe
  C:\Windows\System\VlEYYYP.exe
  2⤵
  PID:6500
- C:\Windows\System\XKQgNzM.exe
  C:\Windows\System\XKQgNzM.exe
  2⤵
  PID:6528
- C:\Windows\System\SAWueOt.exe
  C:\Windows\System\SAWueOt.exe
  2⤵
  PID:6556
- C:\Windows\System\MNOJEAe.exe
  C:\Windows\System\MNOJEAe.exe
  2⤵
  PID:6584
- C:\Windows\System\pvpvwFT.exe
  C:\Windows\System\pvpvwFT.exe
  2⤵
  PID:6612
- C:\Windows\System\gEZjMze.exe
  C:\Windows\System\gEZjMze.exe
  2⤵
  PID:6640
- C:\Windows\System\oFjgqjl.exe
  C:\Windows\System\oFjgqjl.exe
  2⤵
  PID:6668
- C:\Windows\System\LewLYfK.exe
  C:\Windows\System\LewLYfK.exe
  2⤵
  PID:6696
- C:\Windows\System\shRzQGG.exe
  C:\Windows\System\shRzQGG.exe
  2⤵
  PID:6724
- C:\Windows\System\yXSyOJy.exe
  C:\Windows\System\yXSyOJy.exe
  2⤵
  PID:6752
- C:\Windows\System\AOpYlHB.exe
  C:\Windows\System\AOpYlHB.exe
  2⤵
  PID:6780
- C:\Windows\System\EsKZpPl.exe
  C:\Windows\System\EsKZpPl.exe
  2⤵
  PID:6808
- C:\Windows\System\XuFpdFt.exe
  C:\Windows\System\XuFpdFt.exe
  2⤵
  PID:6836
- C:\Windows\System\opyzeuK.exe
  C:\Windows\System\opyzeuK.exe
  2⤵
  PID:6864
- C:\Windows\System\TQjkTaA.exe
  C:\Windows\System\TQjkTaA.exe
  2⤵
  PID:6892
- C:\Windows\System\QYPQVXw.exe
  C:\Windows\System\QYPQVXw.exe
  2⤵
  PID:6920
- C:\Windows\System\vfEiFAH.exe
  C:\Windows\System\vfEiFAH.exe
  2⤵
  PID:6948
- C:\Windows\System\WpspMFy.exe
  C:\Windows\System\WpspMFy.exe
  2⤵
  PID:6976
- C:\Windows\System\PKUdPgd.exe
  C:\Windows\System\PKUdPgd.exe
  2⤵
  PID:7004
- C:\Windows\System\WRrzfvO.exe
  C:\Windows\System\WRrzfvO.exe
  2⤵
  PID:7036
- C:\Windows\System\mJpOsEL.exe
  C:\Windows\System\mJpOsEL.exe
  2⤵
  PID:7064
- C:\Windows\System\ZqSTyip.exe
  C:\Windows\System\ZqSTyip.exe
  2⤵
  PID:7092
- C:\Windows\System\bwgSdjm.exe
  C:\Windows\System\bwgSdjm.exe
  2⤵
  PID:7120
- C:\Windows\System\BGaDMhb.exe
  C:\Windows\System\BGaDMhb.exe
  2⤵
  PID:7148
- C:\Windows\System\ASZnkmK.exe
  C:\Windows\System\ASZnkmK.exe
  2⤵
  PID:5604
- C:\Windows\System\baZOsmM.exe
  C:\Windows\System\baZOsmM.exe
  2⤵
  PID:5744
- C:\Windows\System\agXhxty.exe
  C:\Windows\System\agXhxty.exe
  2⤵
  PID:4212
- C:\Windows\System\ZHgoJNI.exe
  C:\Windows\System\ZHgoJNI.exe
  2⤵
  PID:6052
- C:\Windows\System\TMFyZqz.exe
  C:\Windows\System\TMFyZqz.exe
  2⤵
  PID:452
- C:\Windows\System\YtnNXDJ.exe
  C:\Windows\System\YtnNXDJ.exe
  2⤵
  PID:5204
- C:\Windows\System\WFIjVHj.exe
  C:\Windows\System\WFIjVHj.exe
  2⤵
  PID:6148
- C:\Windows\System\cyQkVLe.exe
  C:\Windows\System\cyQkVLe.exe
  2⤵
  PID:6208
- C:\Windows\System\Ymhsjma.exe
  C:\Windows\System\Ymhsjma.exe
  2⤵
  PID:6268
- C:\Windows\System\JcTTPff.exe
  C:\Windows\System\JcTTPff.exe
  2⤵
  PID:6344
- C:\Windows\System\XlolRYo.exe
  C:\Windows\System\XlolRYo.exe
  2⤵
  PID:6404
- C:\Windows\System\psJDqLB.exe
  C:\Windows\System\psJDqLB.exe
  2⤵
  PID:6464
- C:\Windows\System\cXhOhJr.exe
  C:\Windows\System\cXhOhJr.exe
  2⤵
  PID:6544
- C:\Windows\System\FAwUXdI.exe
  C:\Windows\System\FAwUXdI.exe
  2⤵
  PID:6600
- C:\Windows\System\vDZXzFv.exe
  C:\Windows\System\vDZXzFv.exe
  2⤵
  PID:6656
- C:\Windows\System\AQOofFw.exe
  C:\Windows\System\AQOofFw.exe
  2⤵
  PID:6716
- C:\Windows\System\VRYoZhE.exe
  C:\Windows\System\VRYoZhE.exe
  2⤵
  PID:6772
- C:\Windows\System\ZYwMvWi.exe
  C:\Windows\System\ZYwMvWi.exe
  2⤵
  PID:6848
- C:\Windows\System\jebEVeQ.exe
  C:\Windows\System\jebEVeQ.exe
  2⤵
  PID:6880
- C:\Windows\System\vHNhlRt.exe
  C:\Windows\System\vHNhlRt.exe
  2⤵
  PID:6944
- C:\Windows\System\dvZdBbG.exe
  C:\Windows\System\dvZdBbG.exe
  2⤵
  PID:7020
- C:\Windows\System\AvhRULI.exe
  C:\Windows\System\AvhRULI.exe
  2⤵
  PID:7080
- C:\Windows\System\BSFbrVR.exe
  C:\Windows\System\BSFbrVR.exe
  2⤵
  PID:212
- C:\Windows\System\rQhxqTG.exe
  C:\Windows\System\rQhxqTG.exe
  2⤵
  PID:5668
- C:\Windows\System\mGNEMCK.exe
  C:\Windows\System\mGNEMCK.exe
  2⤵
  PID:5996
- C:\Windows\System\HMHQosp.exe
  C:\Windows\System\HMHQosp.exe
  2⤵
  PID:5344
- C:\Windows\System\IEFxgoi.exe
  C:\Windows\System\IEFxgoi.exe
  2⤵
  PID:6184
- C:\Windows\System\ddLpewq.exe
  C:\Windows\System\ddLpewq.exe
  2⤵
  PID:6372
- C:\Windows\System\rWsdlDd.exe
  C:\Windows\System\rWsdlDd.exe
  2⤵
  PID:6512
- C:\Windows\System\aGAvnXq.exe
  C:\Windows\System\aGAvnXq.exe
  2⤵
  PID:6628
- C:\Windows\System\ZraYOWc.exe
  C:\Windows\System\ZraYOWc.exe
  2⤵
  PID:6764
- C:\Windows\System\RgjPfJF.exe
  C:\Windows\System\RgjPfJF.exe
  2⤵
  PID:4992
- C:\Windows\System\lpkMMej.exe
  C:\Windows\System\lpkMMej.exe
  2⤵
  PID:6996
- C:\Windows\System\wpNtVGS.exe
  C:\Windows\System\wpNtVGS.exe
  2⤵
  PID:7160
- C:\Windows\System\LBWWqqK.exe
  C:\Windows\System\LBWWqqK.exe
  2⤵
  PID:6136
- C:\Windows\System\DvqYDNe.exe
  C:\Windows\System\DvqYDNe.exe
  2⤵
  PID:7172
- C:\Windows\System\MKNWDbQ.exe
  C:\Windows\System\MKNWDbQ.exe
  2⤵
  PID:7200
- C:\Windows\System\lMWkQHr.exe
  C:\Windows\System\lMWkQHr.exe
  2⤵
  PID:7228
- C:\Windows\System\XSysXSr.exe
  C:\Windows\System\XSysXSr.exe
  2⤵
  PID:7256
- C:\Windows\System\ZDlBmTD.exe
  C:\Windows\System\ZDlBmTD.exe
  2⤵
  PID:7284
- C:\Windows\System\veMnchw.exe
  C:\Windows\System\veMnchw.exe
  2⤵
  PID:7312
- C:\Windows\System\OOsaJuM.exe
  C:\Windows\System\OOsaJuM.exe
  2⤵
  PID:7340
- C:\Windows\System\VAUgdOB.exe
  C:\Windows\System\VAUgdOB.exe
  2⤵
  PID:7368
- C:\Windows\System\VklNopm.exe
  C:\Windows\System\VklNopm.exe
  2⤵
  PID:7396
- C:\Windows\System\PBSvBKj.exe
  C:\Windows\System\PBSvBKj.exe
  2⤵
  PID:7424
- C:\Windows\System\LAntYHe.exe
  C:\Windows\System\LAntYHe.exe
  2⤵
  PID:7456
- C:\Windows\System\snjECzK.exe
  C:\Windows\System\snjECzK.exe
  2⤵
  PID:7480
- C:\Windows\System\Bulldkt.exe
  C:\Windows\System\Bulldkt.exe
  2⤵
  PID:7508
- C:\Windows\System\tuxTuQv.exe
  C:\Windows\System\tuxTuQv.exe
  2⤵
  PID:7536
- C:\Windows\System\aewrpNt.exe
  C:\Windows\System\aewrpNt.exe
  2⤵
  PID:7564
- C:\Windows\System\ocYKIzW.exe
  C:\Windows\System\ocYKIzW.exe
  2⤵
  PID:7592
- C:\Windows\System\lvtIXaV.exe
  C:\Windows\System\lvtIXaV.exe
  2⤵
  PID:7620
- C:\Windows\System\YqcvQhr.exe
  C:\Windows\System\YqcvQhr.exe
  2⤵
  PID:7648
- C:\Windows\System\qFFXpiy.exe
  C:\Windows\System\qFFXpiy.exe
  2⤵
  PID:7676
- C:\Windows\System\SLThXhG.exe
  C:\Windows\System\SLThXhG.exe
  2⤵
  PID:7704
- C:\Windows\System\dDRNrBs.exe
  C:\Windows\System\dDRNrBs.exe
  2⤵
  PID:7732
- C:\Windows\System\YuBCmBZ.exe
  C:\Windows\System\YuBCmBZ.exe
  2⤵
  PID:7760
- C:\Windows\System\OZuEOsA.exe
  C:\Windows\System\OZuEOsA.exe
  2⤵
  PID:7788
- C:\Windows\System\DlFmRqY.exe
  C:\Windows\System\DlFmRqY.exe
  2⤵
  PID:7816
- C:\Windows\System\hLCXOrS.exe
  C:\Windows\System\hLCXOrS.exe
  2⤵
  PID:7944
- C:\Windows\System\KQqskNm.exe
  C:\Windows\System\KQqskNm.exe
  2⤵
  PID:7996
- C:\Windows\System\SSgphsx.exe
  C:\Windows\System\SSgphsx.exe
  2⤵
  PID:8016
- C:\Windows\System\jpIpYML.exe
  C:\Windows\System\jpIpYML.exe
  2⤵
  PID:8032
- C:\Windows\System\eQwkUci.exe
  C:\Windows\System\eQwkUci.exe
  2⤵
  PID:8048
- C:\Windows\System\IHlIVSk.exe
  C:\Windows\System\IHlIVSk.exe
  2⤵
  PID:8064
- C:\Windows\System\IiuBlSS.exe
  C:\Windows\System\IiuBlSS.exe
  2⤵
  PID:8080
- C:\Windows\System\QDWALvf.exe
  C:\Windows\System\QDWALvf.exe
  2⤵
  PID:8100
- C:\Windows\System\LGqeBuD.exe
  C:\Windows\System\LGqeBuD.exe
  2⤵
  PID:8120
- C:\Windows\System\FUjJJZr.exe
  C:\Windows\System\FUjJJZr.exe
  2⤵
  PID:8136
- C:\Windows\System\fCHGOLL.exe
  C:\Windows\System\fCHGOLL.exe
  2⤵
  PID:8172
- C:\Windows\System\xQuNWnH.exe
  C:\Windows\System\xQuNWnH.exe
  2⤵
  PID:6316
- C:\Windows\System\zGlPlFm.exe
  C:\Windows\System\zGlPlFm.exe
  2⤵
  PID:5860
- C:\Windows\System\nYlMCpw.exe
  C:\Windows\System\nYlMCpw.exe
  2⤵
  PID:7192
- C:\Windows\System\cjOhsTf.exe
  C:\Windows\System\cjOhsTf.exe
  2⤵
  PID:7324
- C:\Windows\System\zVlwjJU.exe
  C:\Windows\System\zVlwjJU.exe
  2⤵
  PID:1892
- C:\Windows\System\pdBBCHT.exe
  C:\Windows\System\pdBBCHT.exe
  2⤵
  PID:7408
- C:\Windows\System\wRLkpwk.exe
  C:\Windows\System\wRLkpwk.exe
  2⤵
  PID:7444
- C:\Windows\System\nusJEHX.exe
  C:\Windows\System\nusJEHX.exe
  2⤵
  PID:7472
- C:\Windows\System\QNsngZs.exe
  C:\Windows\System\QNsngZs.exe
  2⤵
  PID:7500
- C:\Windows\System\uaRaVWv.exe
  C:\Windows\System\uaRaVWv.exe
  2⤵
  PID:7556
- C:\Windows\System\tUGmDGc.exe
  C:\Windows\System\tUGmDGc.exe
  2⤵
  PID:4492
- C:\Windows\System\jgPrdcn.exe
  C:\Windows\System\jgPrdcn.exe
  2⤵
  PID:896
- C:\Windows\System\uGoQIGD.exe
  C:\Windows\System\uGoQIGD.exe
  2⤵
  PID:1240
- C:\Windows\System\lvwsZmp.exe
  C:\Windows\System\lvwsZmp.exe
  2⤵
  PID:7856
- C:\Windows\System\OCaHJwX.exe
  C:\Windows\System\OCaHJwX.exe
  2⤵
  PID:7988
- C:\Windows\System\ETcqJpB.exe
  C:\Windows\System\ETcqJpB.exe
  2⤵
  PID:8012
- C:\Windows\System\GmmKfmE.exe
  C:\Windows\System\GmmKfmE.exe
  2⤵
  PID:3256
- C:\Windows\System\GoBYDLI.exe
  C:\Windows\System\GoBYDLI.exe
  2⤵
  PID:7892
- C:\Windows\System\dJOFfct.exe
  C:\Windows\System\dJOFfct.exe
  2⤵
  PID:8108
- C:\Windows\System\XbYSPTo.exe
  C:\Windows\System\XbYSPTo.exe
  2⤵
  PID:6856
- C:\Windows\System\xXJLsni.exe
  C:\Windows\System\xXJLsni.exe
  2⤵
  PID:7276
- C:\Windows\System\rxAodTF.exe
  C:\Windows\System\rxAodTF.exe
  2⤵
  PID:3076
- C:\Windows\System\KOOYQmW.exe
  C:\Windows\System\KOOYQmW.exe
  2⤵
  PID:7528
- C:\Windows\System\TMkQXFp.exe
  C:\Windows\System\TMkQXFp.exe
  2⤵
  PID:7608
- C:\Windows\System\BSkrzkp.exe
  C:\Windows\System\BSkrzkp.exe
  2⤵
  PID:7664
- C:\Windows\System\eZrXxDY.exe
  C:\Windows\System\eZrXxDY.exe
  2⤵
  PID:7984
- C:\Windows\System\kExTNlc.exe
  C:\Windows\System\kExTNlc.exe
  2⤵
  PID:7304
- C:\Windows\System\niEVCAb.exe
  C:\Windows\System\niEVCAb.exe
  2⤵
  PID:7808
- C:\Windows\System\dNbnkMS.exe
  C:\Windows\System\dNbnkMS.exe
  2⤵
  PID:1752
- C:\Windows\System\Taofdru.exe
  C:\Windows\System\Taofdru.exe
  2⤵
  PID:8024
- C:\Windows\System\rJuNAmw.exe
  C:\Windows\System\rJuNAmw.exe
  2⤵
  PID:8188
- C:\Windows\System\hdSKhAO.exe
  C:\Windows\System\hdSKhAO.exe
  2⤵
  PID:7184
- C:\Windows\System\syBTbkN.exe
  C:\Windows\System\syBTbkN.exe
  2⤵
  PID:4148
- C:\Windows\System\aZkyGzZ.exe
  C:\Windows\System\aZkyGzZ.exe
  2⤵
  PID:7908
- C:\Windows\System\YkgLihj.exe
  C:\Windows\System\YkgLihj.exe
  2⤵
  PID:7360
- C:\Windows\System\iQNTwyb.exe
  C:\Windows\System\iQNTwyb.exe
  2⤵
  PID:7956
- C:\Windows\System\Gkxrmde.exe
  C:\Windows\System\Gkxrmde.exe
  2⤵
  PID:8132
- C:\Windows\System\cinWkIj.exe
  C:\Windows\System\cinWkIj.exe
  2⤵
  PID:2236
- C:\Windows\System\ddVDFDZ.exe
  C:\Windows\System\ddVDFDZ.exe
  2⤵
  PID:7416
- C:\Windows\System\AgtsdRb.exe
  C:\Windows\System\AgtsdRb.exe
  2⤵
  PID:7904
- C:\Windows\System\VXooIkG.exe
  C:\Windows\System\VXooIkG.exe
  2⤵
  PID:8196
- C:\Windows\System\TnvyxmL.exe
  C:\Windows\System\TnvyxmL.exe
  2⤵
  PID:8232
- C:\Windows\System\YLUIFjG.exe
  C:\Windows\System\YLUIFjG.exe
  2⤵
  PID:8264
- C:\Windows\System\WfpHHFQ.exe
  C:\Windows\System\WfpHHFQ.exe
  2⤵
  PID:8280
- C:\Windows\System\BHjijCF.exe
  C:\Windows\System\BHjijCF.exe
  2⤵
  PID:8320
- C:\Windows\System\kDoUFEO.exe
  C:\Windows\System\kDoUFEO.exe
  2⤵
  PID:8348
- C:\Windows\System\yjsYlWI.exe
  C:\Windows\System\yjsYlWI.exe
  2⤵
  PID:8396
- C:\Windows\System\clfQUBg.exe
  C:\Windows\System\clfQUBg.exe
  2⤵
  PID:8416
- C:\Windows\System\ucRyqYH.exe
  C:\Windows\System\ucRyqYH.exe
  2⤵
  PID:8444
- C:\Windows\System\KQdCQPY.exe
  C:\Windows\System\KQdCQPY.exe
  2⤵
  PID:8464
- C:\Windows\System\tNqLPcO.exe
  C:\Windows\System\tNqLPcO.exe
  2⤵
  PID:8492
- C:\Windows\System\bzJynuH.exe
  C:\Windows\System\bzJynuH.exe
  2⤵
  PID:8528
- C:\Windows\System\GoxBDmA.exe
  C:\Windows\System\GoxBDmA.exe
  2⤵
  PID:8544
- C:\Windows\System\TCcoyoA.exe
  C:\Windows\System\TCcoyoA.exe
  2⤵
  PID:8576
- C:\Windows\System\jZMtCJB.exe
  C:\Windows\System\jZMtCJB.exe
  2⤵
  PID:8612
- C:\Windows\System\CrFVtNm.exe
  C:\Windows\System\CrFVtNm.exe
  2⤵
  PID:8640
- C:\Windows\System\bESsqaI.exe
  C:\Windows\System\bESsqaI.exe
  2⤵
  PID:8660
- C:\Windows\System\EMfPwaV.exe
  C:\Windows\System\EMfPwaV.exe
  2⤵
  PID:8684
- C:\Windows\System\KAMZXUD.exe
  C:\Windows\System\KAMZXUD.exe
  2⤵
  PID:8716
- C:\Windows\System\CVCcmCx.exe
  C:\Windows\System\CVCcmCx.exe
  2⤵
  PID:8744
- C:\Windows\System\ZFlABsD.exe
  C:\Windows\System\ZFlABsD.exe
  2⤵
  PID:8772
- C:\Windows\System\PdDWCVQ.exe
  C:\Windows\System\PdDWCVQ.exe
  2⤵
  PID:8788
- C:\Windows\System\oGegQMj.exe
  C:\Windows\System\oGegQMj.exe
  2⤵
  PID:8828
- C:\Windows\System\QvfktZb.exe
  C:\Windows\System\QvfktZb.exe
  2⤵
  PID:8848
- C:\Windows\System\hcGRyge.exe
  C:\Windows\System\hcGRyge.exe
  2⤵
  PID:8880
- C:\Windows\System\agBNVUW.exe
  C:\Windows\System\agBNVUW.exe
  2⤵
  PID:8896
- C:\Windows\System\BuVpSis.exe
  C:\Windows\System\BuVpSis.exe
  2⤵
  PID:8952
- C:\Windows\System\ooaGcXa.exe
  C:\Windows\System\ooaGcXa.exe
  2⤵
  PID:8984
- C:\Windows\System\xBbsGtG.exe
  C:\Windows\System\xBbsGtG.exe
  2⤵
  PID:9012
- C:\Windows\System\DFiUPlT.exe
  C:\Windows\System\DFiUPlT.exe
  2⤵
  PID:9032
- C:\Windows\System\tOTBonM.exe
  C:\Windows\System\tOTBonM.exe
  2⤵
  PID:9060
- C:\Windows\System\chEyZoi.exe
  C:\Windows\System\chEyZoi.exe
  2⤵
  PID:9088
- C:\Windows\System\BsMnkic.exe
  C:\Windows\System\BsMnkic.exe
  2⤵
  PID:9116
- C:\Windows\System\VbfmuIN.exe
  C:\Windows\System\VbfmuIN.exe
  2⤵
  PID:9136
- C:\Windows\System\cmbqiwJ.exe
  C:\Windows\System\cmbqiwJ.exe
  2⤵
  PID:9164
- C:\Windows\System\RewNOiz.exe
  C:\Windows\System\RewNOiz.exe
  2⤵
  PID:9204
- C:\Windows\System\jSRvwTp.exe
  C:\Windows\System\jSRvwTp.exe
  2⤵
  PID:8208
- C:\Windows\System\BLvJFlc.exe
  C:\Windows\System\BLvJFlc.exe
  2⤵
  PID:8308
- C:\Windows\System\EKiMAMw.exe
  C:\Windows\System\EKiMAMw.exe
  2⤵
  PID:8384
- C:\Windows\System\zbeDONU.exe
  C:\Windows\System\zbeDONU.exe
  2⤵
  PID:8440
- C:\Windows\System\sEJttqn.exe
  C:\Windows\System\sEJttqn.exe
  2⤵
  PID:8504
- C:\Windows\System\JSFOkUt.exe
  C:\Windows\System\JSFOkUt.exe
  2⤵
  PID:8584
- C:\Windows\System\fMeGHYG.exe
  C:\Windows\System\fMeGHYG.exe
  2⤵
  PID:8636
- C:\Windows\System\dtOAJaO.exe
  C:\Windows\System\dtOAJaO.exe
  2⤵
  PID:8736
- C:\Windows\System\BexKtAf.exe
  C:\Windows\System\BexKtAf.exe
  2⤵
  PID:8756
- C:\Windows\System\gqADZzR.exe
  C:\Windows\System\gqADZzR.exe
  2⤵
  PID:8868
- C:\Windows\System\FpRXCMv.exe
  C:\Windows\System\FpRXCMv.exe
  2⤵
  PID:8820
- C:\Windows\System\uGPWLgR.exe
  C:\Windows\System\uGPWLgR.exe
  2⤵
  PID:8928
- C:\Windows\System\uQpBCpu.exe
  C:\Windows\System\uQpBCpu.exe
  2⤵
  PID:9024
- C:\Windows\System\IEZGVib.exe
  C:\Windows\System\IEZGVib.exe
  2⤵
  PID:9080
- C:\Windows\System\yaaunmG.exe
  C:\Windows\System\yaaunmG.exe
  2⤵
  PID:9144
- C:\Windows\System\kCgxRyX.exe
  C:\Windows\System\kCgxRyX.exe
  2⤵
  PID:9180
- C:\Windows\System\seHxTQM.exe
  C:\Windows\System\seHxTQM.exe
  2⤵
  PID:8368
- C:\Windows\System\URJrEEU.exe
  C:\Windows\System\URJrEEU.exe
  2⤵
  PID:8476
- C:\Windows\System\CKMOIlQ.exe
  C:\Windows\System\CKMOIlQ.exe
  2⤵
  PID:8672
- C:\Windows\System\XGZBGLK.exe
  C:\Windows\System\XGZBGLK.exe
  2⤵
  PID:8836
- C:\Windows\System\WPttunK.exe
  C:\Windows\System\WPttunK.exe
  2⤵
  PID:8968
- C:\Windows\System\QwwGFbC.exe
  C:\Windows\System\QwwGFbC.exe
  2⤵
  PID:9076
- C:\Windows\System\PKgwsDP.exe
  C:\Windows\System\PKgwsDP.exe
  2⤵
  PID:8276
- C:\Windows\System\eIgMKum.exe
  C:\Windows\System\eIgMKum.exe
  2⤵
  PID:8732
- C:\Windows\System\yAiLrKV.exe
  C:\Windows\System\yAiLrKV.exe
  2⤵
  PID:8892
- C:\Windows\System\uZRfVpp.exe
  C:\Windows\System\uZRfVpp.exe
  2⤵
  PID:8436
- C:\Windows\System\JSJJjYA.exe
  C:\Windows\System\JSJJjYA.exe
  2⤵
  PID:9156
- C:\Windows\System\okmszVF.exe
  C:\Windows\System\okmszVF.exe
  2⤵
  PID:9248
- C:\Windows\System\bivfhol.exe
  C:\Windows\System\bivfhol.exe
  2⤵
  PID:9276
- C:\Windows\System\uWbWjnh.exe
  C:\Windows\System\uWbWjnh.exe
  2⤵
  PID:9308
- C:\Windows\System\LvfWcZW.exe
  C:\Windows\System\LvfWcZW.exe
  2⤵
  PID:9336
- C:\Windows\System\yuevnVe.exe
  C:\Windows\System\yuevnVe.exe
  2⤵
  PID:9352
- C:\Windows\System\ytRmbGB.exe
  C:\Windows\System\ytRmbGB.exe
  2⤵
  PID:9392
- C:\Windows\System\pvKWAkV.exe
  C:\Windows\System\pvKWAkV.exe
  2⤵
  PID:9420
- C:\Windows\System\RnfVZqs.exe
  C:\Windows\System\RnfVZqs.exe
  2⤵
  PID:9448
- C:\Windows\System\cVtaUGg.exe
  C:\Windows\System\cVtaUGg.exe
  2⤵
  PID:9480
- C:\Windows\System\yrZaYiQ.exe
  C:\Windows\System\yrZaYiQ.exe
  2⤵
  PID:9508
- C:\Windows\System\QPmKrlr.exe
  C:\Windows\System\QPmKrlr.exe
  2⤵
  PID:9536
- C:\Windows\System\PkvaWqL.exe
  C:\Windows\System\PkvaWqL.exe
  2⤵
  PID:9568
- C:\Windows\System\EsyDKJA.exe
  C:\Windows\System\EsyDKJA.exe
  2⤵
  PID:9596
- C:\Windows\System\fTJoaVj.exe
  C:\Windows\System\fTJoaVj.exe
  2⤵
  PID:9620
- C:\Windows\System\IZeemUf.exe
  C:\Windows\System\IZeemUf.exe
  2⤵
  PID:9640
- C:\Windows\System\IYExPrT.exe
  C:\Windows\System\IYExPrT.exe
  2⤵
  PID:9680
- C:\Windows\System\FXHxWnZ.exe
  C:\Windows\System\FXHxWnZ.exe
  2⤵
  PID:9708
- C:\Windows\System\YUhKfXt.exe
  C:\Windows\System\YUhKfXt.exe
  2⤵
  PID:9724
- C:\Windows\System\GOvyOdc.exe
  C:\Windows\System\GOvyOdc.exe
  2⤵
  PID:9740
- C:\Windows\System\rkDrmxU.exe
  C:\Windows\System\rkDrmxU.exe
  2⤵
  PID:9756
- C:\Windows\System\lJbdYqv.exe
  C:\Windows\System\lJbdYqv.exe
  2⤵
  PID:9772
- C:\Windows\System\QjTkYvr.exe
  C:\Windows\System\QjTkYvr.exe
  2⤵
  PID:9796
- C:\Windows\System\mANaHjL.exe
  C:\Windows\System\mANaHjL.exe
  2⤵
  PID:9824
- C:\Windows\System\ASLxBsO.exe
  C:\Windows\System\ASLxBsO.exe
  2⤵
  PID:9860
- C:\Windows\System\voesxOU.exe
  C:\Windows\System\voesxOU.exe
  2⤵
  PID:9920
- C:\Windows\System\dHntIVN.exe
  C:\Windows\System\dHntIVN.exe
  2⤵
  PID:9960
- C:\Windows\System\exKPTWK.exe
  C:\Windows\System\exKPTWK.exe
  2⤵
  PID:9988
- C:\Windows\System\dYQWyAB.exe
  C:\Windows\System\dYQWyAB.exe
  2⤵
  PID:10016
- C:\Windows\System\gjndffJ.exe
  C:\Windows\System\gjndffJ.exe
  2⤵
  PID:10044
- C:\Windows\System\zNkYFfW.exe
  C:\Windows\System\zNkYFfW.exe
  2⤵
  PID:10060
- C:\Windows\System\MSKsUNV.exe
  C:\Windows\System\MSKsUNV.exe
  2⤵
  PID:10088
- C:\Windows\System\XBAtZeY.exe
  C:\Windows\System\XBAtZeY.exe
  2⤵
  PID:10116
- C:\Windows\System\bbTFbzQ.exe
  C:\Windows\System\bbTFbzQ.exe
  2⤵
  PID:10144
- C:\Windows\System\DduxqLP.exe
  C:\Windows\System\DduxqLP.exe
  2⤵
  PID:10172
- C:\Windows\System\UFayVZu.exe
  C:\Windows\System\UFayVZu.exe
  2⤵
  PID:10204
- C:\Windows\System\pVQPepY.exe
  C:\Windows\System\pVQPepY.exe
  2⤵
  PID:10232
- C:\Windows\System\kqfiOoz.exe
  C:\Windows\System\kqfiOoz.exe
  2⤵
  PID:9256
- C:\Windows\System\erJykOQ.exe
  C:\Windows\System\erJykOQ.exe
  2⤵
  PID:9304
- C:\Windows\System\ofRHKqs.exe
  C:\Windows\System\ofRHKqs.exe
  2⤵
  PID:9376
- C:\Windows\System\HxnIlYp.exe
  C:\Windows\System\HxnIlYp.exe
  2⤵
  PID:9472
- C:\Windows\System\wXkuArU.exe
  C:\Windows\System\wXkuArU.exe
  2⤵
  PID:9532
- C:\Windows\System\LcemmXS.exe
  C:\Windows\System\LcemmXS.exe
  2⤵
  PID:9612
- C:\Windows\System\NOMIWEi.exe
  C:\Windows\System\NOMIWEi.exe
  2⤵
  PID:9660
- C:\Windows\System\PXfZveV.exe
  C:\Windows\System\PXfZveV.exe
  2⤵
  PID:9704
- C:\Windows\System\qwiUqxL.exe
  C:\Windows\System\qwiUqxL.exe
  2⤵
  PID:9788
- C:\Windows\System\AxRWLET.exe
  C:\Windows\System\AxRWLET.exe
  2⤵
  PID:9784
- C:\Windows\System\sbEICmP.exe
  C:\Windows\System\sbEICmP.exe
  2⤵
  PID:9912
- C:\Windows\System\FZVtukP.exe
  C:\Windows\System\FZVtukP.exe
  2⤵
  PID:9984
- C:\Windows\System\gNzdUCj.exe
  C:\Windows\System\gNzdUCj.exe
  2⤵
  PID:10056
- C:\Windows\System\nMjiofK.exe
  C:\Windows\System\nMjiofK.exe
  2⤵
  PID:10096
- C:\Windows\System\CtgsRUN.exe
  C:\Windows\System\CtgsRUN.exe
  2⤵
  PID:10164
- C:\Windows\System\SxTbuJp.exe
  C:\Windows\System\SxTbuJp.exe
  2⤵
  PID:8932
- C:\Windows\System\NXecjYb.exe
  C:\Windows\System\NXecjYb.exe
  2⤵
  PID:9292
- C:\Windows\System\zmPRiuE.exe
  C:\Windows\System\zmPRiuE.exe
  2⤵
  PID:9460
- C:\Windows\System\hceUDqY.exe
  C:\Windows\System\hceUDqY.exe
  2⤵
  PID:9672
- C:\Windows\System\yBPDvcX.exe
  C:\Windows\System\yBPDvcX.exe
  2⤵
  PID:9808
- C:\Windows\System\ArEtRdo.exe
  C:\Windows\System\ArEtRdo.exe
  2⤵
  PID:9952
- C:\Windows\System\xrbOgOT.exe
  C:\Windows\System\xrbOgOT.exe
  2⤵
  PID:10168
- C:\Windows\System\SKWtaQE.exe
  C:\Windows\System\SKWtaQE.exe
  2⤵
  PID:10220
- C:\Windows\System\xAXbaqx.exe
  C:\Windows\System\xAXbaqx.exe
  2⤵
  PID:9416
- C:\Windows\System\fGwDeaF.exe
  C:\Windows\System\fGwDeaF.exe
  2⤵
  PID:9580
- C:\Windows\System\QFnwkNl.exe
  C:\Windows\System\QFnwkNl.exe
  2⤵
  PID:10076
- C:\Windows\System\fsTCTZq.exe
  C:\Windows\System\fsTCTZq.exe
  2⤵
  PID:10140
- C:\Windows\System\siTTztK.exe
  C:\Windows\System\siTTztK.exe
  2⤵
  PID:10272
- C:\Windows\System\DVjiNTy.exe
  C:\Windows\System\DVjiNTy.exe
  2⤵
  PID:10308
- C:\Windows\System\NyERpRt.exe
  C:\Windows\System\NyERpRt.exe
  2⤵
  PID:10328
- C:\Windows\System\aoRhstG.exe
  C:\Windows\System\aoRhstG.exe
  2⤵
  PID:10348
- C:\Windows\System\YMCFoJU.exe
  C:\Windows\System\YMCFoJU.exe
  2⤵
  PID:10384
- C:\Windows\System\DzClyBn.exe
  C:\Windows\System\DzClyBn.exe
  2⤵
  PID:10416
- C:\Windows\System\ZcbszYL.exe
  C:\Windows\System\ZcbszYL.exe
  2⤵
  PID:10440
- C:\Windows\System\FPsUgya.exe
  C:\Windows\System\FPsUgya.exe
  2⤵
  PID:10480
- C:\Windows\System\gdvVTKV.exe
  C:\Windows\System\gdvVTKV.exe
  2⤵
  PID:10508
- C:\Windows\System\XtPSMdJ.exe
  C:\Windows\System\XtPSMdJ.exe
  2⤵
  PID:10536
- C:\Windows\System\nMLZcFF.exe
  C:\Windows\System\nMLZcFF.exe
  2⤵
  PID:10552
- C:\Windows\System\iUuRVwy.exe
  C:\Windows\System\iUuRVwy.exe
  2⤵
  PID:10584
- C:\Windows\System\prHJYdP.exe
  C:\Windows\System\prHJYdP.exe
  2⤵
  PID:10608
- C:\Windows\System\yehLAQq.exe
  C:\Windows\System\yehLAQq.exe
  2⤵
  PID:10624
- C:\Windows\System\fPFlmBD.exe
  C:\Windows\System\fPFlmBD.exe
  2⤵
  PID:10640
- C:\Windows\System\PoMVvSv.exe
  C:\Windows\System\PoMVvSv.exe
  2⤵
  PID:10660
- C:\Windows\System\meNpaUt.exe
  C:\Windows\System\meNpaUt.exe
  2⤵
  PID:10692
- C:\Windows\System\TUTjzkK.exe
  C:\Windows\System\TUTjzkK.exe
  2⤵
  PID:10756
- C:\Windows\System\OLuKidV.exe
  C:\Windows\System\OLuKidV.exe
  2⤵
  PID:10788
- C:\Windows\System\hWpYeEO.exe
  C:\Windows\System\hWpYeEO.exe
  2⤵
  PID:10824
- C:\Windows\System\TZCHhHi.exe
  C:\Windows\System\TZCHhHi.exe
  2⤵
  PID:10840
- C:\Windows\System\kIORqzg.exe
  C:\Windows\System\kIORqzg.exe
  2⤵
  PID:10888
- C:\Windows\System\lGRiUwS.exe
  C:\Windows\System\lGRiUwS.exe
  2⤵
  PID:10908
- C:\Windows\System\YTeMcmv.exe
  C:\Windows\System\YTeMcmv.exe
  2⤵
  PID:10936
- C:\Windows\System\QkNNVHR.exe
  C:\Windows\System\QkNNVHR.exe
  2⤵
  PID:10988
- C:\Windows\System\aBEtKMq.exe
  C:\Windows\System\aBEtKMq.exe
  2⤵
  PID:11020
- C:\Windows\System\mAigBqP.exe
  C:\Windows\System\mAigBqP.exe
  2⤵
  PID:11048
- C:\Windows\System\TPIXUEx.exe
  C:\Windows\System\TPIXUEx.exe
  2⤵
  PID:11088
- C:\Windows\System\JnzxfhA.exe
  C:\Windows\System\JnzxfhA.exe
  2⤵
  PID:11116
- C:\Windows\System\xkCAhPn.exe
  C:\Windows\System\xkCAhPn.exe
  2⤵
  PID:11144
- C:\Windows\System\uuQGlrv.exe
  C:\Windows\System\uuQGlrv.exe
  2⤵
  PID:11160
- C:\Windows\System\sjSKOQA.exe
  C:\Windows\System\sjSKOQA.exe
  2⤵
  PID:11176
- C:\Windows\System\defgRdc.exe
  C:\Windows\System\defgRdc.exe
  2⤵
  PID:11192
- C:\Windows\System\NymFxkn.exe
  C:\Windows\System\NymFxkn.exe
  2⤵
  PID:11252
- C:\Windows\System\eEVvXDq.exe
  C:\Windows\System\eEVvXDq.exe
  2⤵
  PID:10244
- C:\Windows\System\cCGFYrT.exe
  C:\Windows\System\cCGFYrT.exe
  2⤵
  PID:10320
- C:\Windows\System\hspkGQV.exe
  C:\Windows\System\hspkGQV.exe
  2⤵
  PID:10412
- C:\Windows\System\UgLOIej.exe
  C:\Windows\System\UgLOIej.exe
  2⤵
  PID:10460
- C:\Windows\System\VHIGwkZ.exe
  C:\Windows\System\VHIGwkZ.exe
  2⤵
  PID:10496
- C:\Windows\System\xkDBwRl.exe
  C:\Windows\System\xkDBwRl.exe
  2⤵
  PID:10592
- C:\Windows\System\zSyzopd.exe
  C:\Windows\System\zSyzopd.exe
  2⤵
  PID:10636
- C:\Windows\System\MPWmzzG.exe
  C:\Windows\System\MPWmzzG.exe
  2⤵
  PID:10748
- C:\Windows\System\CXsLNUZ.exe
  C:\Windows\System\CXsLNUZ.exe
  2⤵
  PID:10816
- C:\Windows\System\qMYsMRz.exe
  C:\Windows\System\qMYsMRz.exe
  2⤵
  PID:10884
- C:\Windows\System\lDmKQuR.exe
  C:\Windows\System\lDmKQuR.exe
  2⤵
  PID:10968
- C:\Windows\System\IyIgFEI.exe
  C:\Windows\System\IyIgFEI.exe
  2⤵
  PID:11076
- C:\Windows\System\xUxnZBH.exe
  C:\Windows\System\xUxnZBH.exe
  2⤵
  PID:11104
- C:\Windows\System\DkTCrLv.exe
  C:\Windows\System\DkTCrLv.exe
  2⤵
  PID:11184
- C:\Windows\System\Fnresrr.exe
  C:\Windows\System\Fnresrr.exe
  2⤵
  PID:11236
- C:\Windows\System\tXxOOhP.exe
  C:\Windows\System\tXxOOhP.exe
  2⤵
  PID:10424
- C:\Windows\System\xGTmdli.exe
  C:\Windows\System\xGTmdli.exe
  2⤵
  PID:10532
- C:\Windows\System\xEJCybX.exe
  C:\Windows\System\xEJCybX.exe
  2⤵
  PID:10772
- C:\Windows\System\ZYwVFbi.exe
  C:\Windows\System\ZYwVFbi.exe
  2⤵
  PID:10920
- C:\Windows\System\azGmcSy.exe
  C:\Windows\System\azGmcSy.exe
  2⤵
  PID:11108
- C:\Windows\System\cnrRmeN.exe
  C:\Windows\System\cnrRmeN.exe
  2⤵
  PID:11172
- C:\Windows\System\gTTyXrJ.exe
  C:\Windows\System\gTTyXrJ.exe
  2⤵
  PID:9888
- C:\Windows\System\nPgnYgG.exe
  C:\Windows\System\nPgnYgG.exe
  2⤵
  PID:10932
- C:\Windows\System\IdmCcNb.exe
  C:\Windows\System\IdmCcNb.exe
  2⤵
  PID:11240
- C:\Windows\System\UZbDwZT.exe
  C:\Windows\System\UZbDwZT.exe
  2⤵
  PID:10260
- C:\Windows\System\xhRHKcY.exe
  C:\Windows\System\xhRHKcY.exe
  2⤵
  PID:11268
- C:\Windows\System\dHdmpUZ.exe
  C:\Windows\System\dHdmpUZ.exe
  2⤵
  PID:11292
- C:\Windows\System\AuiWNSz.exe
  C:\Windows\System\AuiWNSz.exe
  2⤵
  PID:11332
- C:\Windows\System\JhXXqCv.exe
  C:\Windows\System\JhXXqCv.exe
  2⤵
  PID:11360
- C:\Windows\System\WjpGpaE.exe
  C:\Windows\System\WjpGpaE.exe
  2⤵
  PID:11388
- C:\Windows\System\psHYbCs.exe
  C:\Windows\System\psHYbCs.exe
  2⤵
  PID:11404
- C:\Windows\System\URcAofc.exe
  C:\Windows\System\URcAofc.exe
  2⤵
  PID:11440
- C:\Windows\System\kYmiDGY.exe
  C:\Windows\System\kYmiDGY.exe
  2⤵
  PID:11460
- C:\Windows\System\iolkwDv.exe
  C:\Windows\System\iolkwDv.exe
  2⤵
  PID:11488
- C:\Windows\System\LZMxIrg.exe
  C:\Windows\System\LZMxIrg.exe
  2⤵
  PID:11516
- C:\Windows\System\BqOrzap.exe
  C:\Windows\System\BqOrzap.exe
  2⤵
  PID:11556
- C:\Windows\System\WetTIJa.exe
  C:\Windows\System\WetTIJa.exe
  2⤵
  PID:11572
- C:\Windows\System\wouHISh.exe
  C:\Windows\System\wouHISh.exe
  2⤵
  PID:11600
- C:\Windows\System\AJEnsTd.exe
  C:\Windows\System\AJEnsTd.exe
  2⤵
  PID:11640
- C:\Windows\System\QeQWdTU.exe
  C:\Windows\System\QeQWdTU.exe
  2⤵
  PID:11660
- C:\Windows\System\wUyjDot.exe
  C:\Windows\System\wUyjDot.exe
  2⤵
  PID:11696
- C:\Windows\System\tXOfOzh.exe
  C:\Windows\System\tXOfOzh.exe
  2⤵
  PID:11724
- C:\Windows\System\JKuOsCI.exe
  C:\Windows\System\JKuOsCI.exe
  2⤵
  PID:11752
- C:\Windows\System\tXuvYfz.exe
  C:\Windows\System\tXuvYfz.exe
  2⤵
  PID:11780
- C:\Windows\System\iOoiWwQ.exe
  C:\Windows\System\iOoiWwQ.exe
  2⤵
  PID:11804
- C:\Windows\System\BDqyVWu.exe
  C:\Windows\System\BDqyVWu.exe
  2⤵
  PID:11836
- C:\Windows\System\txAzIhf.exe
  C:\Windows\System\txAzIhf.exe
  2⤵
  PID:11852
- C:\Windows\System\WcwCpyF.exe
  C:\Windows\System\WcwCpyF.exe
  2⤵
  PID:11880
- C:\Windows\System\AENqAHh.exe
  C:\Windows\System\AENqAHh.exe
  2⤵
  PID:11920
- C:\Windows\System\EsJRRqE.exe
  C:\Windows\System\EsJRRqE.exe
  2⤵
  PID:11944
- C:\Windows\System\ViMzkgO.exe
  C:\Windows\System\ViMzkgO.exe
  2⤵
  PID:11964
- C:\Windows\System\YoaByri.exe
  C:\Windows\System\YoaByri.exe
  2⤵
  PID:12004
- C:\Windows\System\KVCOkfq.exe
  C:\Windows\System\KVCOkfq.exe
  2⤵
  PID:12036
- C:\Windows\System\Zqefvcl.exe
  C:\Windows\System\Zqefvcl.exe
  2⤵
  PID:12052
- C:\Windows\System\xxlVMXk.exe
  C:\Windows\System\xxlVMXk.exe
  2⤵
  PID:12080
- C:\Windows\System\HqaWLhn.exe
  C:\Windows\System\HqaWLhn.exe
  2⤵
  PID:12108
- C:\Windows\System\nDPecPq.exe
  C:\Windows\System\nDPecPq.exe
  2⤵
  PID:12136
- C:\Windows\System\QwFDLTv.exe
  C:\Windows\System\QwFDLTv.exe
  2⤵
  PID:12152
- C:\Windows\System\KtqpVEQ.exe
  C:\Windows\System\KtqpVEQ.exe
  2⤵
  PID:12192
- C:\Windows\System\PbrDJHB.exe
  C:\Windows\System\PbrDJHB.exe
  2⤵
  PID:12220
- C:\Windows\System\JKYVxde.exe
  C:\Windows\System\JKYVxde.exe
  2⤵
  PID:12256
- C:\Windows\System\DAxshwV.exe
  C:\Windows\System\DAxshwV.exe
  2⤵
  PID:10672
- C:\Windows\System\gdrWkYk.exe
  C:\Windows\System\gdrWkYk.exe
  2⤵
  PID:11280
- C:\Windows\System\dEcqUoM.exe
  C:\Windows\System\dEcqUoM.exe
  2⤵
  PID:11348
- C:\Windows\System\NueneYx.exe
  C:\Windows\System\NueneYx.exe
  2⤵
  PID:11424
- C:\Windows\System\NlobFtI.exe
  C:\Windows\System\NlobFtI.exe
  2⤵
  PID:11532
- C:\Windows\System\MnRvLJU.exe
  C:\Windows\System\MnRvLJU.exe
  2⤵
  PID:11592
- C:\Windows\System\UIBxUZe.exe
  C:\Windows\System\UIBxUZe.exe
  2⤵
  PID:11652
- C:\Windows\System\CQsrKIr.exe
  C:\Windows\System\CQsrKIr.exe
  2⤵
  PID:11716
- C:\Windows\System\BYERnOY.exe
  C:\Windows\System\BYERnOY.exe
  2⤵
  PID:11772
- C:\Windows\System\bhKmTRE.exe
  C:\Windows\System\bhKmTRE.exe
  2⤵
  PID:11828
- C:\Windows\System\DAznzpK.exe
  C:\Windows\System\DAznzpK.exe
  2⤵
  PID:11892
- C:\Windows\System\BTIXMJH.exe
  C:\Windows\System\BTIXMJH.exe
  2⤵
  PID:11992
- C:\Windows\System\oMGwTNE.exe
  C:\Windows\System\oMGwTNE.exe
  2⤵
  PID:12048
- C:\Windows\System\HKubuRP.exe
  C:\Windows\System\HKubuRP.exe
  2⤵
  PID:12092
- C:\Windows\System\nSDjDXp.exe
  C:\Windows\System\nSDjDXp.exe
  2⤵
  PID:12172
- C:\Windows\System\ZAcSflS.exe
  C:\Windows\System\ZAcSflS.exe
  2⤵
  PID:12240
- C:\Windows\System\ARXxFyE.exe
  C:\Windows\System\ARXxFyE.exe
  2⤵
  PID:11284
- C:\Windows\System\Okfqmmm.exe
  C:\Windows\System\Okfqmmm.exe
  2⤵
  PID:11416
- C:\Windows\System\MuALwrI.exe
  C:\Windows\System\MuALwrI.exe
  2⤵
  PID:11596
- C:\Windows\System\HewiUvS.exe
  C:\Windows\System\HewiUvS.exe
  2⤵
  PID:11868
- C:\Windows\System\NFsXbOp.exe
  C:\Windows\System\NFsXbOp.exe
  2⤵
  PID:12028
- C:\Windows\System\ygEwRqd.exe
  C:\Windows\System\ygEwRqd.exe
  2⤵
  PID:12180
- C:\Windows\System\hsbXDpy.exe
  C:\Windows\System\hsbXDpy.exe
  2⤵
  PID:11316
- C:\Windows\System\LPOvqss.exe
  C:\Windows\System\LPOvqss.exe
  2⤵
  PID:11568
- C:\Windows\System\qvDlEVv.exe
  C:\Windows\System\qvDlEVv.exe
  2⤵
  PID:11984
- C:\Windows\System\cmbfskV.exe
  C:\Windows\System\cmbfskV.exe
  2⤵
  PID:11788
- C:\Windows\System\amYNTCM.exe
  C:\Windows\System\amYNTCM.exe
  2⤵
  PID:12308
- C:\Windows\System\EhkCPof.exe
  C:\Windows\System\EhkCPof.exe
  2⤵
  PID:12336
- C:\Windows\System\xjCEVZN.exe
  C:\Windows\System\xjCEVZN.exe
  2⤵
  PID:12364
- C:\Windows\System\gBsDBci.exe
  C:\Windows\System\gBsDBci.exe
  2⤵
  PID:12392
- C:\Windows\System\GQGXmaF.exe
  C:\Windows\System\GQGXmaF.exe
  2⤵
  PID:12408
- C:\Windows\System\hejadpb.exe
  C:\Windows\System\hejadpb.exe
  2⤵
  PID:12448
- C:\Windows\System\MeKAsOb.exe
  C:\Windows\System\MeKAsOb.exe
  2⤵
  PID:12464
- C:\Windows\System\qQoDNAl.exe
  C:\Windows\System\qQoDNAl.exe
  2⤵
  PID:12504
- C:\Windows\System\MKUsbFj.exe
  C:\Windows\System\MKUsbFj.exe
  2⤵
  PID:12532
- C:\Windows\System\gtmygjv.exe
  C:\Windows\System\gtmygjv.exe
  2⤵
  PID:12548
- C:\Windows\System\HJeBqBs.exe
  C:\Windows\System\HJeBqBs.exe
  2⤵
  PID:12588
- C:\Windows\System\pOOfmXp.exe
  C:\Windows\System\pOOfmXp.exe
  2⤵
  PID:12616
- C:\Windows\System\TvpsvSC.exe
  C:\Windows\System\TvpsvSC.exe
  2⤵
  PID:12644
- C:\Windows\System\fBGXtwQ.exe
  C:\Windows\System\fBGXtwQ.exe
  2⤵
  PID:12660
- C:\Windows\System\Rwzoxcl.exe
  C:\Windows\System\Rwzoxcl.exe
  2⤵
  PID:12692
- C:\Windows\System\IjLJgUU.exe
  C:\Windows\System\IjLJgUU.exe
  2⤵
  PID:12716
- C:\Windows\System\AuxonyU.exe
  C:\Windows\System\AuxonyU.exe
  2⤵
  PID:12744
- C:\Windows\System\KRGFcYh.exe
  C:\Windows\System\KRGFcYh.exe
  2⤵
  PID:12772
- C:\Windows\System\tghcNVT.exe
  C:\Windows\System\tghcNVT.exe
  2⤵
  PID:12804
- C:\Windows\System\UOhEceT.exe
  C:\Windows\System\UOhEceT.exe
  2⤵
  PID:12840
- C:\Windows\System\syIRfjo.exe
  C:\Windows\System\syIRfjo.exe
  2⤵
  PID:12868
- C:\Windows\System\jujNTNv.exe
  C:\Windows\System\jujNTNv.exe
  2⤵
  PID:12896
- C:\Windows\System\ZSTLvUG.exe
  C:\Windows\System\ZSTLvUG.exe
  2⤵
  PID:12924
- C:\Windows\System\kDtFpaw.exe
  C:\Windows\System\kDtFpaw.exe
  2⤵
  PID:12940
- C:\Windows\System\xpUqPXY.exe
  C:\Windows\System\xpUqPXY.exe
  2⤵
  PID:12956
- C:\Windows\System\XTFJBdp.exe
  C:\Windows\System\XTFJBdp.exe
  2⤵
  PID:12972
- C:\Windows\System\wIaObpu.exe
  C:\Windows\System\wIaObpu.exe
  2⤵
  PID:12996
- C:\Windows\System\ugyRNCI.exe
  C:\Windows\System\ugyRNCI.exe
  2⤵
  PID:13044
- C:\Windows\System\ADorsMO.exe
  C:\Windows\System\ADorsMO.exe
  2⤵
  PID:13068
- C:\Windows\System\QXfqwBH.exe
  C:\Windows\System\QXfqwBH.exe
  2⤵
  PID:13120
- C:\Windows\System\stbemfo.exe
  C:\Windows\System\stbemfo.exe
  2⤵
  PID:13148
- C:\Windows\System\TUDsZOb.exe
  C:\Windows\System\TUDsZOb.exe
  2⤵
  PID:13164
- C:\Windows\System\jcoNhIF.exe
  C:\Windows\System\jcoNhIF.exe
  2⤵
  PID:13196
- C:\Windows\System\iAZPOYX.exe
  C:\Windows\System\iAZPOYX.exe
  2⤵
  PID:13220
- C:\Windows\System\WjXOJKd.exe
  C:\Windows\System\WjXOJKd.exe
  2⤵
  PID:13236
- C:\Windows\System\DLEezhe.exe
  C:\Windows\System\DLEezhe.exe
  2⤵
  PID:13288
- C:\Windows\System\NtBUgPu.exe
  C:\Windows\System\NtBUgPu.exe
  2⤵
  PID:13304
- C:\Windows\System\avUNmCD.exe
  C:\Windows\System\avUNmCD.exe
  2⤵
  PID:12276
- C:\Windows\System\cRcMwzb.exe
  C:\Windows\System\cRcMwzb.exe
  2⤵
  PID:12328
- C:\Windows\System\XqxjJQb.exe
  C:\Windows\System\XqxjJQb.exe
  2⤵
  PID:12400
- C:\Windows\System\FrnFwRC.exe
  C:\Windows\System\FrnFwRC.exe
  2⤵
  PID:12496
- C:\Windows\System\NdlzkxE.exe
  C:\Windows\System\NdlzkxE.exe
  2⤵
  PID:12580
- C:\Windows\System\CiMYgDh.exe
  C:\Windows\System\CiMYgDh.exe
  2⤵
  PID:12640
- C:\Windows\System\uPdXosI.exe
  C:\Windows\System\uPdXosI.exe
  2⤵
  PID:12684
- C:\Windows\System\onkXUzE.exe
  C:\Windows\System\onkXUzE.exe
  2⤵
  PID:12736
- C:\Windows\System\ptDaveL.exe
  C:\Windows\System\ptDaveL.exe
  2⤵
  PID:12836
- C:\Windows\System\kQGjKBx.exe
  C:\Windows\System\kQGjKBx.exe
  2⤵
  PID:12880
- C:\Windows\System\MmUHkys.exe
  C:\Windows\System\MmUHkys.exe
  2⤵
  PID:12948
- C:\Windows\System\IMAVTNX.exe
  C:\Windows\System\IMAVTNX.exe
  2⤵
  PID:12968
- C:\Windows\System\CexOUrg.exe
  C:\Windows\System\CexOUrg.exe
  2⤵
  PID:13060
- C:\Windows\System\eXFeiqw.exe
  C:\Windows\System\eXFeiqw.exe
  2⤵
  PID:13132
- C:\Windows\System\TZlZwea.exe
  C:\Windows\System\TZlZwea.exe
  2⤵
  PID:13228
- C:\Windows\System\HQkRbWG.exe
  C:\Windows\System\HQkRbWG.exe
  2⤵
  PID:11512
- C:\Windows\System\kLWxuHC.exe
  C:\Windows\System\kLWxuHC.exe
  2⤵
  PID:12424
- C:\Windows\System\MOxxXEH.exe
  C:\Windows\System\MOxxXEH.exe
  2⤵
  PID:12512
- C:\Windows\System\PbZVGCt.exe
  C:\Windows\System\PbZVGCt.exe
  2⤵
  PID:12656
- C:\Windows\System\SxWOXnT.exe
  C:\Windows\System\SxWOXnT.exe
  2⤵
  PID:12824
- C:\Windows\System\SEvQqdC.exe
  C:\Windows\System\SEvQqdC.exe
  2⤵
  PID:12920
- C:\Windows\System\ahUmGhu.exe
  C:\Windows\System\ahUmGhu.exe
  2⤵
  PID:13108
- C:\Windows\System\vzkhyUK.exe
  C:\Windows\System\vzkhyUK.exe
  2⤵
  PID:13212
- C:\Windows\System\HQuLZng.exe
  C:\Windows\System\HQuLZng.exe
  2⤵
  PID:12432
- C:\Windows\System\JsZWLNw.exe
  C:\Windows\System\JsZWLNw.exe
  2⤵
  PID:12728
- C:\Windows\System\OWoylOX.exe
  C:\Windows\System\OWoylOX.exe
  2⤵
  PID:13020
- C:\Windows\System\OsntDrj.exe
  C:\Windows\System\OsntDrj.exe
  2⤵
  PID:12788
- C:\Windows\System\rEqAXuT.exe
  C:\Windows\System\rEqAXuT.exe
  2⤵
  PID:13320
- C:\Windows\System\QzHBgzL.exe
  C:\Windows\System\QzHBgzL.exe
  2⤵
  PID:13368
- C:\Windows\System\pPlwqyR.exe
  C:\Windows\System\pPlwqyR.exe
  2⤵
  PID:13384
- C:\Windows\System\mUaMyPp.exe
  C:\Windows\System\mUaMyPp.exe
  2⤵
  PID:13408
- C:\Windows\System\RNTEybu.exe
  C:\Windows\System\RNTEybu.exe
  2⤵
  PID:13460
- C:\Windows\System\bKbLcnZ.exe
  C:\Windows\System\bKbLcnZ.exe
  2⤵
  PID:13480
- C:\Windows\System\wVLqYAV.exe
  C:\Windows\System\wVLqYAV.exe
  2⤵
  PID:13508
- C:\Windows\System\kqLuOBS.exe
  C:\Windows\System\kqLuOBS.exe
  2⤵
  PID:13536
- C:\Windows\System\nPcZryQ.exe
  C:\Windows\System\nPcZryQ.exe
  2⤵
  PID:13564
- C:\Windows\System\gsTuYsx.exe
  C:\Windows\System\gsTuYsx.exe
  2⤵
  PID:13584
- C:\Windows\System\xZsarLs.exe
  C:\Windows\System\xZsarLs.exe
  2⤵
  PID:13624
- C:\Windows\System\GgwhDpo.exe
  C:\Windows\System\GgwhDpo.exe
  2⤵
  PID:13660
- C:\Windows\System\KLhIuzi.exe
  C:\Windows\System\KLhIuzi.exe
  2⤵
  PID:13688
- C:\Windows\System\ZovUMlG.exe
  C:\Windows\System\ZovUMlG.exe
  2⤵
  PID:13704
- C:\Windows\System\ZxAueQq.exe
  C:\Windows\System\ZxAueQq.exe
  2⤵
  PID:13744
- C:\Windows\System\BzcreIf.exe
  C:\Windows\System\BzcreIf.exe
  2⤵
  PID:13772
- C:\Windows\System\LHOzJnv.exe
  C:\Windows\System\LHOzJnv.exe
  2⤵
  PID:13788
- C:\Windows\System\EBlNkLh.exe
  C:\Windows\System\EBlNkLh.exe
  2⤵
  PID:13816
- C:\Windows\System\xUNwXwp.exe
  C:\Windows\System\xUNwXwp.exe
  2⤵
  PID:13856
- C:\Windows\System\BdkPsMT.exe
  C:\Windows\System\BdkPsMT.exe
  2⤵
  PID:13884
- C:\Windows\System\oDDrhaM.exe
  C:\Windows\System\oDDrhaM.exe
  2⤵
  PID:13912
- C:\Windows\System\LRyVxEs.exe
  C:\Windows\System\LRyVxEs.exe
  2⤵
  PID:13928
- C:\Windows\System\QlTiZoD.exe
  C:\Windows\System\QlTiZoD.exe
  2⤵
  PID:13956
- C:\Windows\System\YfbGgoB.exe
  C:\Windows\System\YfbGgoB.exe
  2⤵
  PID:13984
- C:\Windows\System\qCQfjeS.exe
  C:\Windows\System\qCQfjeS.exe
  2⤵
  PID:14012
- C:\Windows\System\SMnbUDU.exe
  C:\Windows\System\SMnbUDU.exe
  2⤵
  PID:14056
- C:\Windows\System\ZPulItr.exe
  C:\Windows\System\ZPulItr.exe
  2⤵
  PID:14072
- C:\Windows\System\tJMQeTf.exe
  C:\Windows\System\tJMQeTf.exe
  2⤵
  PID:14100
- C:\Windows\System\eAEpSsz.exe
  C:\Windows\System\eAEpSsz.exe
  2⤵
  PID:14128
- C:\Windows\System\GuIvuQW.exe
  C:\Windows\System\GuIvuQW.exe
  2⤵
  PID:14156
- C:\Windows\System\pZWztpp.exe
  C:\Windows\System\pZWztpp.exe
  2⤵
  PID:14172
- C:\Windows\System\VoKOdyd.exe
  C:\Windows\System\VoKOdyd.exe
  2⤵
  PID:14224
- C:\Windows\System\xmmJjdk.exe
  C:\Windows\System\xmmJjdk.exe
  2⤵
  PID:14252
- C:\Windows\System\UbUbDeJ.exe
  C:\Windows\System\UbUbDeJ.exe
  2⤵
  PID:14268
- C:\Windows\System\dcuslBH.exe
  C:\Windows\System\dcuslBH.exe
  2⤵
  PID:14296
- C:\Windows\System\CiqpGtq.exe
  C:\Windows\System\CiqpGtq.exe
  2⤵
  PID:12652
- C:\Windows\System\IUdYdEw.exe
  C:\Windows\System\IUdYdEw.exe
  2⤵
  PID:13316
- C:\Windows\System\tMjLwkJ.exe
  C:\Windows\System\tMjLwkJ.exe
  2⤵
  PID:7720
- C:\Windows\System\QLqlcgn.exe
  C:\Windows\System\QLqlcgn.exe
  2⤵
  PID:13352
- C:\Windows\System\TZFEpcC.exe
  C:\Windows\System\TZFEpcC.exe
  2⤵
  PID:13448
- C:\Windows\System\HaQIEEu.exe
  C:\Windows\System\HaQIEEu.exe
  2⤵
  PID:13504
- C:\Windows\System\qDVaZaK.exe
  C:\Windows\System\qDVaZaK.exe
  2⤵
  PID:13572
- C:\Windows\System\QBScatF.exe
  C:\Windows\System\QBScatF.exe
  2⤵
  PID:13616
- C:\Windows\System\iyosidd.exe
  C:\Windows\System\iyosidd.exe
  2⤵
  PID:13724
- C:\Windows\System\SLlhtSb.exe
  C:\Windows\System\SLlhtSb.exe
  2⤵
  PID:13780
- C:\Windows\System\neJqaxl.exe
  C:\Windows\System\neJqaxl.exe
  2⤵
  PID:13852
- C:\Windows\System\FJaNuSQ.exe
  C:\Windows\System\FJaNuSQ.exe
  2⤵
  PID:13924
- C:\Windows\System\pdwEjTf.exe
  C:\Windows\System\pdwEjTf.exe
  2⤵
  PID:13980
- C:\Windows\System\opgkrQG.exe
  C:\Windows\System\opgkrQG.exe
  2⤵
  PID:14008
- C:\Windows\System\fXFoUQi.exe
  C:\Windows\System\fXFoUQi.exe
  2⤵
  PID:14112
- C:\Windows\System\kvygDfY.exe
  C:\Windows\System\kvygDfY.exe
  2⤵
  PID:14168
- C:\Windows\System\dpjpvwI.exe
  C:\Windows\System\dpjpvwI.exe
  2⤵
  PID:14220
- C:\Windows\System\bEiOGyu.exe
  C:\Windows\System\bEiOGyu.exe
  2⤵
  PID:14292
- C:\Windows\System\dvxaOvX.exe
  C:\Windows\System\dvxaOvX.exe
  2⤵
  PID:13296
- C:\Windows\System\CzIeiPr.exe
  C:\Windows\System\CzIeiPr.exe
  2⤵
  PID:13428
- C:\Windows\System\OHsHsZM.exe
  C:\Windows\System\OHsHsZM.exe
  2⤵
  PID:13592
- C:\Windows\System\eofhipb.exe
  C:\Windows\System\eofhipb.exe
  2⤵
  PID:13756
- C:\Windows\System\qsEuKDh.exe
  C:\Windows\System\qsEuKDh.exe
  2⤵
  PID:13896
- C:\Windows\System\vyShggH.exe
  C:\Windows\System\vyShggH.exe
  2⤵
  PID:14028
- C:\Windows\System\pOfSbQg.exe
  C:\Windows\System\pOfSbQg.exe
  2⤵
  PID:14260
- C:\Windows\System\HGGSeqn.exe
  C:\Windows\System\HGGSeqn.exe
  2⤵
  PID:3204
- C:\Windows\System\qlsWlje.exe
  C:\Windows\System\qlsWlje.exe
  2⤵
  PID:13836
- C:\Windows\System\RibXDZl.exe
  C:\Windows\System\RibXDZl.exe
  2⤵
  PID:14204
- C:\Windows\System\loOSAbp.exe
  C:\Windows\System\loOSAbp.exe
  2⤵
  PID:13684
- C:\Windows\System\TmjJYwX.exe
  C:\Windows\System\TmjJYwX.exe
  2⤵
  PID:14368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:8
1⤵
PID:7928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AMyvMqq.exe

Filesize
2.1MB

MD5
2c466bcf89ad5468176c555ec1f42cd5

SHA1
f12945d309ef8a9cdc2b8698a664a1337401ab86

SHA256
844412f2a891519285f908a31e319112591952bccab97e186e57db71e068f7aa

SHA512
a2f8aca0996d2345a5607cec8cf2f49e3175bfcdec2d6ca1d974efef582f907d8870d8ba171dafaf1872df07bb865b11ba4c86748e7f6c2ef478222c7e4f518c

Download Submit
C:\Windows\System\AcxQbTn.exe

Filesize
2.1MB

MD5
9a0497731445582fbf8c00f875aeb6cc

SHA1
7f8c3e4dc02f5bde63e39cf8e15284021ed57dab

SHA256
cf0a822b1becdbacc562515432927dea47c576b953f93bd52e3d85645cc5f9b2

SHA512
a5f5bffe5c40f298d7bf5a67869ad9dde8fc938b7e7bf696cf21e7b25846fa0b8d59dac6f1bf31d9821fe67ebdb9d35afbbeae628178ffd571ad1177c401a9fb

Download Submit
C:\Windows\System\BaUboxg.exe

Filesize
2.1MB

MD5
39e2a867f7400e3cd8ddfba338c74365

SHA1
26e21eb0063753a71a6bc734622ddf5f98afd65d

SHA256
c8bc9c4f6a56be720128c860e2b21e56152a26a029e554c21f114ada3d647c54

SHA512
df5e5f7f3d5877eda5c55aa6f11f94228d1a4d98e4fd31be2f57e97bfe2089592da60b96e42b04996659332f056ad7d13bbc55681444167ed7560c03a042581a

Download Submit
C:\Windows\System\CrYACsw.exe

Filesize
2.1MB

MD5
5048f8f1607b18478691a9b6d28e8fc0

SHA1
4a4aa5b443fbe57af3f9a34c00b1824a92b1ee43

SHA256
71ccdecaf7215e8226c2abbc1444525bfcc6f33f208ac4397f450e7d62b2ed3b

SHA512
20079cd4b66438a786f2bc9e2d88de7a779485f17537176b83fd90e851fea4eccf1ec65555700ec06efa533ac3339d2b2424a197d9bbbf5deadcc81aa02fce68

Download Submit
C:\Windows\System\DEvNKGx.exe

Filesize
2.1MB

MD5
ce3e153b5789df34fd4d86aa6e2f83fb

SHA1
2afcf6ebdba9ab64371890ac50913311de17c09f

SHA256
c7bfe53f6a34c4b336d373caa25878d830d8044197ceb2d06da83cc241ed8396

SHA512
4fcaf2b6b163f711628b49afeb51f02734f70aa009f61a79fff94859bb1bc0c7a3d82adeae7276b63deaa14fed06275928806f8758179716cdf3496bf0948703

Download Submit
C:\Windows\System\DdzGKsY.exe

Filesize
2.1MB

MD5
5151d8fd5a9f73191bc0fd42784e7c07

SHA1
fa88f208be3ab779b219edabd137dc400cf75e67

SHA256
81399dbd68051a38160f15037aa81471f744477a299154e73be5dd6d6b83e286

SHA512
e5d99fd9cdc47d3aa1d3675c53ed83fecc6eb4c55d2803047ae672909932bdf4db77b837e04f5bc62b1f3cae3dec7bd79323396d11e8b8be8370a1cbf28295a0

Download Submit
C:\Windows\System\EHddIgU.exe

Filesize
2.1MB

MD5
e9ac3180861ffa130267ab8dc5063f28

SHA1
a7f333e4593a8128021675aa89662ebd6cd9ef34

SHA256
d2c810c5928d7ddcdea3627636527c12bd78d54bef967cb05de13dcf8cb28367

SHA512
9267fb04a8175dfe3886dfea39f9fe8b1f26514a8ebe68a308af2e1fc0b96a753a7bc4dfe81252cd8012c4cb89fc3cec8edecd59bf00fb31a2c19851ca052f01

Download Submit
C:\Windows\System\GgTFujT.exe

Filesize
2.1MB

MD5
41e9c38790a82b541232c56fc7947e3c

SHA1
238b74f41ce176ab5737f8bb8a40f3bd1159023a

SHA256
e0df4c434c17cc1fae6ab378d6e3ad76ff8a62cc797c4b7a2631791287ba9481

SHA512
06be43e7a104b34979424632cf72214c18c8d95a63d94681ba85f50d1c42d9e9b2b862cd6c42970ce75cf6d8f59e5e17c949ee1db63761b43d0ea2bc36993b87

Download Submit
C:\Windows\System\IEKRKZw.exe

Filesize
2.1MB

MD5
4baa20cdd2b2e14dcc395c452078e69e

SHA1
0d24100b1ff0e305dc6a547ae3c4f0e7dff60b53

SHA256
ba74624938a61686e1cdcb36af15975856b21057aa264cda81ae767d7578546b

SHA512
80cfd0ed2dc9fdc62cdf074fb0b452e77f1f7dad02ecf1bb53a828c4eb938d850840cdb08da28fd4349218fb07e33eb0b3e15319243a519f9d5e62c91f0e9b55

Download Submit
C:\Windows\System\LvTGTFb.exe

Filesize
2.1MB

MD5
15232f521ded9ce2c523cf196f846df0

SHA1
17c30e49665141354e03b6d2a3f597c993d8c4c2

SHA256
0b41310d59883985e8b9d7b7fafa10673f4d059fdb934c205cf99837f28a8e64

SHA512
44bbaf102051b030a65172cba0669610717a3077350557b0655a0477f854cdc658c34c710b8214a459105e3fdda95914812236d17e77a12b42afedb069135331

Download Submit
C:\Windows\System\NFRvmJH.exe

Filesize
2.1MB

MD5
3edc9e2d05d7c69e61300fa84f81e64c

SHA1
fb924b86ddd9f5ae3d6bee97afcaa460d2175fc2

SHA256
be246bc521118d2233fb13af4599ae94540794d006c4e7c2a184ce9a3fe02380

SHA512
4c5c5976c912e902a3c8951788a4838e14f22fdd5ec12900dfaf4c16c3ece2c38cb243d303de6a461e61b5554755c45e8c8fbeae96fad87291e71a07c78e067d

Download Submit
C:\Windows\System\OYuNVuT.exe

Filesize
2.1MB

MD5
e22658093e3ea16e10503d5a68b36591

SHA1
a503471425f0d526a36056014558d664ac7b3da5

SHA256
db81c69b29aa0c12a72527e55e11f5da998a13ce7357729212e6049c4806543b

SHA512
d770379a62bd52cf465e94500ba3f424e4f9e44b14b5328f0784dc415c78944dc3e0bd46cc245f010cd86473235ebaac7e5a4c07b29cc6ff8aa3ed2ab4eacdcc

Download Submit
C:\Windows\System\SkyGNHB.exe

Filesize
2.1MB

MD5
ec4a37d4f953a355584ad13b57b63733

SHA1
78a2f1c9517057163135efcc3de76cfbb106edd4

SHA256
576a03d332bb1259cd9c5aac245e15f0f41153b7ed635493140731b900210737

SHA512
0719331b98f48c4d0513370c803d835dfcbf7ae65b8b82827823bd0bb6f65bc4fe9425bde160464eb4a80a8986bc0c042a759d9a9a25b5fea1fa909981d3bb75

Download Submit
C:\Windows\System\UCfdMwJ.exe

Filesize
2.1MB

MD5
4df032f915acb52a6e47a2dc3d7c2b73

SHA1
837d7a226a9818ffccdc9b12cc006c0b14b342db

SHA256
9557ab76800fdcbbae34f768722d7851254a7c4282386170f385a5eac7c90def

SHA512
c7a111ff51d54fa61f11f55143645ed4e083f15fed09ddbe5b9a407898f94c27d44e27ba1b33ff3319e2322fd3aba3d82bf3643a6d1361daf166ee3ef4364b6c

Download Submit
C:\Windows\System\VFbWAPm.exe

Filesize
2.1MB

MD5
ec1bccd22c2fa0931e5fedb53c3dfb3f

SHA1
13bbac00ff1397fcbaa6dff1336fd37f90c0e15a

SHA256
fb60004742c6c86242c5162a90b5d0a4024de6ee344bd3662451c987ebe5649e

SHA512
538d494fb6a9a556203227e15d85d18b4b3a728645581d0e612488c7236382ee5b11e87809ddb85418f0d206619d543c6394077e4123001848bd4aaa1d512a20

Download Submit
C:\Windows\System\VqZagzd.exe

Filesize
2.1MB

MD5
25983fd9f6b7386e56184f13cce9ef46

SHA1
38da8fb2ffa746539a2fe649a1cc694d572cc19c

SHA256
110940f687914e2daa174e31f4fa992dddeb9197a7e5579cf360f1e7ac47d02f

SHA512
9760c20ca4b30bcec4475ae608d7b436802d3158057dea495a64bc21613970cabaf3af26ac3a0f9c655061f6ddb67bf410c243175420db9397a3d260727a6c12

Download Submit
C:\Windows\System\WILCJmo.exe

Filesize
2.1MB

MD5
bdb7a6981bc4a7fcbb9ce3057acf59bd

SHA1
307c0f69fb354b8306f36e412466e30636a0bb2e

SHA256
420569652f6df7e3f190148bae13c52e77cb6049c8e105234158f6faa8973d3f

SHA512
7fe54030b0859701074f4b4f4bbeb7c56a8aaf7e5c482089c208976466e0225eef5b3bca0418919e1c1a829c86fdc2a5c861a2391b54eba1d382fcbe05d8c973

Download Submit
C:\Windows\System\WVuGRmI.exe

Filesize
2.1MB

MD5
089f8d08146b35de0d0a3c094d1b140b

SHA1
77a34e073693ce265caaf4268f2bd7df3de84370

SHA256
834597e08f5d30396c730cf70136ce428a96bfcd0c0a9d007aad906c17d09992

SHA512
89184834baf72b81c0cb17dc0d9e40b4d22d4a309cf6d4e8ac6a4366eb3cb2686834a76fa9b709ae8d1c9f13b4b67902131ca46f8bdd6f6f71db628ec00c704e

Download Submit
C:\Windows\System\WZzxICG.exe

Filesize
2.1MB

MD5
85fd7f8270a60bf540e824ba2de87131

SHA1
26f4b6dbb210e4d02783727844a93333a640ccee

SHA256
6d6fc9b0db69b4c5692f12fdf41d797ea0ce26262003d6f3cb350930ac349d4d

SHA512
62d327021db1cdd1facb2b91ac714c28adc5e1750a5a6bf48e470401bd748ed64827bf516f7ac8c96b272408f2ce7bf15cc43f431ea873f49ec7e2b2c39ebce8

Download Submit
C:\Windows\System\XMYjjar.exe

Filesize
2.1MB

MD5
14e7d1c9db332f72cf96016325f4b0ca

SHA1
23723b413f5ae72eaf48a4739e67bc28e51a9696

SHA256
f027dae97c5db19320112a9f45cecdf1302022d00382c1ff969c0072e2b9575a

SHA512
c2795742c46dcedfa3075966288774e2bc8b19ac7460c1f66560da9ff92fa118b67ddd7f911f4c6a51e08d181313a9f0f4c09af7720ea48a4d05664e2fcf7da1

Download Submit
C:\Windows\System\XUoPMWg.exe

Filesize
2.1MB

MD5
b0515034414a9d0caff5e446fc0e727b

SHA1
423cd15574b5c15adbe29cee7d201f559cb1a6a9

SHA256
8719ff276c936e5e71c7fa17304740c2386ca35c0f0c7374de5957efbf38a57c

SHA512
503b403aad8340e03d9a303ac8d08726ed36850ccf89dd25e8600414d2d8fd88db83a0b93e53b99465da3bdbdb62b4a8daa6b7c64149d25cfbac14fd9c3e8c25

Download Submit
C:\Windows\System\ZpJhkTf.exe

Filesize
2.1MB

MD5
0d4fa0f783f19e6216d13c5e434de40b

SHA1
223b8cb4b256eb39e824d5dae5e642b91cf6e0ca

SHA256
7f509f9833b87381b9412ba8ab9332eba02efc850f54086702c4852524b386c9

SHA512
ae75b6a997c402b5ca990bd4bb05c5d144cf16da4ceb5964d6b0157de2aa5d3762efe4f0a0f518ff659dc2231237d1fc269d6fb1ec1296d790a141b4b6bbcdd5

Download Submit
C:\Windows\System\amTBixQ.exe

Filesize
2.1MB

MD5
5d350b85afe3828be29fedf38d317c64

SHA1
656001d92379c6146bc0b00b99ec438df2b8bf73

SHA256
952ffb892336998b512a00ef137e8d709e0ee36fe8ccf445f78433f2041608b9

SHA512
a9919468585dfdb0ea47965d402a1d989a1eb78fa1edb2f80bd333006261e363fd36a464ca0603f0d268d5e79395f6754f19f6dc46453d71edc3f78888dcded7

Download Submit
C:\Windows\System\byBpFBv.exe

Filesize
2.1MB

MD5
7f060750268bd5e2b720c2dfc5883128

SHA1
1031409d09e025a33469684cc9fd78fa4662d662

SHA256
fed67bfd081e0f787ebda9576a9e6b921b7d116bf8e895bac12548ed86bd0610

SHA512
0a21a639f7e99fe53260dc4e3aeb322de523b35d09e267d9525052a2712374a1df84899fa573a0523c1870ad12c99845d4b9f66fd0249fcda82392dba4b49037

Download Submit
C:\Windows\System\eCAxNEq.exe

Filesize
2.1MB

MD5
b26468b22a6aa5b1710c9c0eb6d599a4

SHA1
6fd4106dd497961ce9d7c89b38420af837332758

SHA256
7d915b483a250e7e8228e87f1d82c1438d729c1cff144153edea2cd8533384e5

SHA512
f9467f77f3a4586e85153e44e00fb8c1f44b401312f135b9898a9d7b282b78edf1f8d25bd1f2c4dc3d6906ac619632660275cef55fe0c48f8870512a5810cc8d

Download Submit
C:\Windows\System\eGGfuJr.exe

Filesize
2.1MB

MD5
ffb8827ca2c64eaa71f0eb086faddff9

SHA1
177a289588c6cd4636d19d8311d4791e249f477a

SHA256
cf6566a3e44f03e446727526aba9280cc598639bb481e388ebde3a1b33109f52

SHA512
f83d872a26bf78afce7aecc0ebb1af9b4e346215205309bdae797390ad11a79a0734960bf517463be5d0b209bdae65796cd94bbf64ee27cb8e77d89393881763

Download Submit
C:\Windows\System\jtNLtvo.exe

Filesize
2.1MB

MD5
7d1ac999ae6697caa850ecb677025ed7

SHA1
24bad94ce40ed81a69edeba20a0b2303238e2ac1

SHA256
542e4d0b17fe4d8a0b1ce22cb2fe56cf823dd731ae9f4b3c8a5ae0feb224d416

SHA512
693d9099074afa36e9f5f1d9685e3951d1638aa2d24d20f54aee3ef1c5976cbe74f328f71dd8f795df92754fc72f6a61ef804e6cda8009125a36215cc7bacfd5

Download Submit
C:\Windows\System\lhHWgnd.exe

Filesize
2.1MB

MD5
5f981ec0f0ba5ac6a4ff09d4c8f4b88c

SHA1
06cd1c72c7f027861a8f6e1e45ff087ab59b90b7

SHA256
5ad8b74da92cc4545579060936335387861bf3214637c5cf97c56363b94d1da7

SHA512
cdb7a91e3fe1e6d18b91b5a0f1486fc0446f1afcca3bdb5a35a57598ce6da1e5391a90d53ea73f37fdf527f9a91fc456b382227d527862ebb995277fc01cd82d

Download Submit
C:\Windows\System\tGaDklW.exe

Filesize
2.1MB

MD5
2a84a0d876c814315345f6523ce04d6f

SHA1
5b28a14d6fa9eea548bf93e8723068cb0f451124

SHA256
b9dc5fac38079d1a6efd9b0ee41e0fea9bab1cd62035fd17e031de6b0d55714d

SHA512
1146bc727652a9c4e11900ace48a00d9f42a05696aeda90b9b17742ba4359b1c63a6c29ca9aac194601e763e6cb01a305a63e99c43d6988644bc01b427b8dab0

Download Submit
C:\Windows\System\yGfbLPa.exe

Filesize
2.1MB

MD5
9d956aac3a13a87b9f441f114d859f0b

SHA1
ddbd370c8216fcdf1d4d5b0e1f6f2464b2679ca3

SHA256
c8f768b61133c84c204d26519995c61a2c181e7926b09f552ee9413f04a31df4

SHA512
0759287ea7d4c5576b8c1d6da5063350ec4ff9e3773ee0eb329d8963478dfbde63dc38b93e7d34a99f86c42996f556ee2da111b04256442a8c959716e2f5934a

Download Submit
C:\Windows\System\yhMimWt.exe

Filesize
2.1MB

MD5
52d89cc958eb9640bd4416c24eb7249e

SHA1
9c0619ec79b4d24a970b97a9486a84c78c927591

SHA256
d32538919274471edd7512a52f060daaeeb4e40478acdc340268d8af45644821

SHA512
6cf73df4e9ae3e481e62fbc01ffd7e24c7bd8eefaadadd6392d1449cffeabb16339f6d12ea2dad62ba37af291d1b9058d58b6319e1ac10487bccb7be52d01046

Download Submit
C:\Windows\System\yqtVOMK.exe

Filesize
2.1MB

MD5
35ae1917b0ee93951dcdaae158be8788

SHA1
ccc44fedb28c84f182f567cc79a99bfbf2cb9da8

SHA256
5e4e50c7918da47a3a4b76a7c4d00c63c6bfcc3d29556b1eb414f2d012f6e7c3

SHA512
004e668382eecf6a4ff6d21bc4b4583121fd06c65c49492c664fe77f08c01a0989076835a00177cea4f82be555ff6c22ab44fabbbebbbbb8183e73c3fe710bae

Download Submit
C:\Windows\System\zpqBkEE.exe

Filesize
2.1MB

MD5
715ab0efac9ee99d2402749cdb412670

SHA1
e63d7b7a9db62c45c65a157c2f7bfd18cc13c919

SHA256
6ac7523577770ec8e89518f5c4b3037708c1edb59b65495cc2bfc8dcd01f8f65

SHA512
1eca7de9c39bc63d7fd682a9f9ed06fc9cd04787ed87320e920f91662be048f49d394553fd51d885125253f0ddd711737011c8356ca4925721b17724a8d370af

Download Submit
memory/384-745-0x00007FF7F4240000-0x00007FF7F4594000-memory.dmp

Filesize
3.3MB

Download
memory/384-2111-0x00007FF7F4240000-0x00007FF7F4594000-memory.dmp

Filesize
3.3MB

Download
memory/556-2108-0x00007FF780A50000-0x00007FF780DA4000-memory.dmp

Filesize
3.3MB

Download
memory/556-726-0x00007FF780A50000-0x00007FF780DA4000-memory.dmp

Filesize
3.3MB

Download
memory/644-2096-0x00007FF67FB80000-0x00007FF67FED4000-memory.dmp

Filesize
3.3MB

Download
memory/644-782-0x00007FF67FB80000-0x00007FF67FED4000-memory.dmp

Filesize
3.3MB

Download
memory/924-763-0x00007FF6C1F20000-0x00007FF6C2274000-memory.dmp

Filesize
3.3MB

Download
memory/924-2115-0x00007FF6C1F20000-0x00007FF6C2274000-memory.dmp

Filesize
3.3MB

Download
memory/1016-2100-0x00007FF64EA20000-0x00007FF64ED74000-memory.dmp

Filesize
3.3MB

Download
memory/1016-719-0x00007FF64EA20000-0x00007FF64ED74000-memory.dmp

Filesize
3.3MB

Download
memory/1124-2109-0x00007FF6374D0000-0x00007FF637824000-memory.dmp

Filesize
3.3MB

Download
memory/1124-729-0x00007FF6374D0000-0x00007FF637824000-memory.dmp

Filesize
3.3MB

Download
memory/1260-775-0x00007FF65D6E0000-0x00007FF65DA34000-memory.dmp

Filesize
3.3MB

Download
memory/1260-2112-0x00007FF65D6E0000-0x00007FF65DA34000-memory.dmp

Filesize
3.3MB

Download
memory/1312-717-0x00007FF6B0390000-0x00007FF6B06E4000-memory.dmp

Filesize
3.3MB

Download
memory/1312-2101-0x00007FF6B0390000-0x00007FF6B06E4000-memory.dmp

Filesize
3.3MB

Download
memory/1624-740-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp

Filesize
3.3MB

Download
memory/1624-2110-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp

Filesize
3.3MB

Download
memory/1644-716-0x00007FF6C8850000-0x00007FF6C8BA4000-memory.dmp

Filesize
3.3MB

Download
memory/1644-2103-0x00007FF6C8850000-0x00007FF6C8BA4000-memory.dmp

Filesize
3.3MB

Download
memory/2112-21-0x00007FF793150000-0x00007FF7934A4000-memory.dmp

Filesize
3.3MB

Download
memory/2112-2085-0x00007FF793150000-0x00007FF7934A4000-memory.dmp

Filesize
3.3MB

Download
memory/2112-2089-0x00007FF793150000-0x00007FF7934A4000-memory.dmp

Filesize
3.3MB

Download
memory/2132-0-0x00007FF7DE4A0000-0x00007FF7DE7F4000-memory.dmp

Filesize
3.3MB

Download
memory/2132-1-0x000001E87CDB0000-0x000001E87CDC0000-memory.dmp

Filesize
64KB

Download
memory/2172-2116-0x00007FF62B1D0000-0x00007FF62B524000-memory.dmp

Filesize
3.3MB

Download
memory/2172-754-0x00007FF62B1D0000-0x00007FF62B524000-memory.dmp

Filesize
3.3MB

Download
memory/2388-713-0x00007FF67C410000-0x00007FF67C764000-memory.dmp

Filesize
3.3MB

Download
memory/2388-2098-0x00007FF67C410000-0x00007FF67C764000-memory.dmp

Filesize
3.3MB

Download
memory/2528-2094-0x00007FF763970000-0x00007FF763CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2528-2087-0x00007FF763970000-0x00007FF763CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2528-42-0x00007FF763970000-0x00007FF763CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2796-711-0x00007FF7A1350000-0x00007FF7A16A4000-memory.dmp

Filesize
3.3MB

Download
memory/2796-2093-0x00007FF7A1350000-0x00007FF7A16A4000-memory.dmp

Filesize
3.3MB

Download
memory/2996-23-0x00007FF7861F0000-0x00007FF786544000-memory.dmp

Filesize
3.3MB

Download
memory/2996-2090-0x00007FF7861F0000-0x00007FF786544000-memory.dmp

Filesize
3.3MB

Download
memory/3192-2114-0x00007FF75AD30000-0x00007FF75B084000-memory.dmp

Filesize
3.3MB

Download
memory/3192-759-0x00007FF75AD30000-0x00007FF75B084000-memory.dmp

Filesize
3.3MB

Download
memory/3216-2092-0x00007FF7DD650000-0x00007FF7DD9A4000-memory.dmp

Filesize
3.3MB

Download
memory/3216-48-0x00007FF7DD650000-0x00007FF7DD9A4000-memory.dmp

Filesize
3.3MB

Download
memory/3272-2107-0x00007FF614A40000-0x00007FF614D94000-memory.dmp

Filesize
3.3MB

Download
memory/3272-715-0x00007FF614A40000-0x00007FF614D94000-memory.dmp

Filesize
3.3MB

Download
memory/3444-2095-0x00007FF760370000-0x00007FF7606C4000-memory.dmp

Filesize
3.3MB

Download
memory/3444-710-0x00007FF760370000-0x00007FF7606C4000-memory.dmp

Filesize
3.3MB

Download
memory/3688-2099-0x00007FF7D31F0000-0x00007FF7D3544000-memory.dmp

Filesize
3.3MB

Download
memory/3688-712-0x00007FF7D31F0000-0x00007FF7D3544000-memory.dmp

Filesize
3.3MB

Download
memory/4400-2084-0x00007FF748180000-0x00007FF7484D4000-memory.dmp

Filesize
3.3MB

Download
memory/4400-10-0x00007FF748180000-0x00007FF7484D4000-memory.dmp

Filesize
3.3MB

Download
memory/4400-2088-0x00007FF748180000-0x00007FF7484D4000-memory.dmp

Filesize
3.3MB

Download
memory/4516-714-0x00007FF7DE4B0000-0x00007FF7DE804000-memory.dmp

Filesize
3.3MB

Download
memory/4516-2105-0x00007FF7DE4B0000-0x00007FF7DE804000-memory.dmp

Filesize
3.3MB

Download
memory/4556-779-0x00007FF658740000-0x00007FF658A94000-memory.dmp

Filesize
3.3MB

Download
memory/4556-2097-0x00007FF658740000-0x00007FF658A94000-memory.dmp

Filesize
3.3MB

Download
memory/4596-2091-0x00007FF7A2E90000-0x00007FF7A31E4000-memory.dmp

Filesize
3.3MB

Download
memory/4596-36-0x00007FF7A2E90000-0x00007FF7A31E4000-memory.dmp

Filesize
3.3MB

Download
memory/4596-2086-0x00007FF7A2E90000-0x00007FF7A31E4000-memory.dmp

Filesize
3.3MB

Download
memory/4676-2106-0x00007FF700FE0000-0x00007FF701334000-memory.dmp

Filesize
3.3MB

Download
memory/4676-721-0x00007FF700FE0000-0x00007FF701334000-memory.dmp

Filesize
3.3MB

Download
memory/4724-2113-0x00007FF605B70000-0x00007FF605EC4000-memory.dmp

Filesize
3.3MB

Download
memory/4724-771-0x00007FF605B70000-0x00007FF605EC4000-memory.dmp

Filesize
3.3MB

Download
memory/4900-718-0x00007FF7FC9E0000-0x00007FF7FCD34000-memory.dmp

Filesize
3.3MB

Download
memory/4900-2104-0x00007FF7FC9E0000-0x00007FF7FCD34000-memory.dmp

Filesize
3.3MB

Download
memory/4984-720-0x00007FF7A10F0000-0x00007FF7A1444000-memory.dmp

Filesize
3.3MB

Download
memory/4984-2102-0x00007FF7A10F0000-0x00007FF7A1444000-memory.dmp

Filesize
3.3MB

Download