xmrig | 58c8ae629239681a3ea20bd7b6124f49074d0efe8880911f240e897fbec7c883

Analysis

max time kernel
134s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
Size

1.5MB
MD5

c06e411a692eeba4ca84419cf7018880
SHA1

bfa36e049acb588f7b3a35b0eb3c9ef2a68d4258
SHA256

58c8ae629239681a3ea20bd7b6124f49074d0efe8880911f240e897fbec7c883
SHA512

fc8353aca94f79b432e5c369c3672d551f3fd7443c7a42a3ebd54ac2ac2a2f1d9b85ff71b1547ff1fb983802dd85bbbaf36255a47a9d4e2ebbd9b55dce6afefe
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727XL1+Ki+4ini/T9UDAmSM5TzUMhPdv:ROdWCCi7/rahHxH4T9eSMVZB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/4208-479-0x00007FF7E4C50000-0x00007FF7E4FA1000-memory.dmp	xmrig
behavioral2/memory/4448-598-0x00007FF6C8A80000-0x00007FF6C8DD1000-memory.dmp	xmrig
behavioral2/memory/3680-685-0x00007FF6E51A0000-0x00007FF6E54F1000-memory.dmp	xmrig
behavioral2/memory/940-692-0x00007FF70B110000-0x00007FF70B461000-memory.dmp	xmrig
behavioral2/memory/2332-2312-0x00007FF601640000-0x00007FF601991000-memory.dmp	xmrig
behavioral2/memory/408-693-0x00007FF6049F0000-0x00007FF604D41000-memory.dmp	xmrig
behavioral2/memory/2984-691-0x00007FF643D90000-0x00007FF6440E1000-memory.dmp	xmrig
behavioral2/memory/3388-690-0x00007FF69FCB0000-0x00007FF6A0001000-memory.dmp	xmrig
behavioral2/memory/3684-689-0x00007FF7BE7A0000-0x00007FF7BEAF1000-memory.dmp	xmrig
behavioral2/memory/2592-688-0x00007FF6650E0000-0x00007FF665431000-memory.dmp	xmrig
behavioral2/memory/3372-687-0x00007FF75F300000-0x00007FF75F651000-memory.dmp	xmrig
behavioral2/memory/2476-686-0x00007FF6ED580000-0x00007FF6ED8D1000-memory.dmp	xmrig
behavioral2/memory/5076-672-0x00007FF7CEFC0000-0x00007FF7CF311000-memory.dmp	xmrig
behavioral2/memory/1728-670-0x00007FF798420000-0x00007FF798771000-memory.dmp	xmrig
behavioral2/memory/1840-594-0x00007FF624650000-0x00007FF6249A1000-memory.dmp	xmrig
behavioral2/memory/3396-474-0x00007FF658C20000-0x00007FF658F71000-memory.dmp	xmrig
behavioral2/memory/1432-394-0x00007FF64A020000-0x00007FF64A371000-memory.dmp	xmrig
behavioral2/memory/2076-391-0x00007FF65C550000-0x00007FF65C8A1000-memory.dmp	xmrig
behavioral2/memory/1328-336-0x00007FF7B27F0000-0x00007FF7B2B41000-memory.dmp	xmrig
behavioral2/memory/660-284-0x00007FF79E5C0000-0x00007FF79E911000-memory.dmp	xmrig
behavioral2/memory/3412-279-0x00007FF62C900000-0x00007FF62CC51000-memory.dmp	xmrig
behavioral2/memory/4044-230-0x00007FF773AD0000-0x00007FF773E21000-memory.dmp	xmrig
behavioral2/memory/3468-175-0x00007FF7E6250000-0x00007FF7E65A1000-memory.dmp	xmrig
behavioral2/memory/5096-78-0x00007FF6611C0000-0x00007FF661511000-memory.dmp	xmrig
behavioral2/memory/2248-2412-0x00007FF734900000-0x00007FF734C51000-memory.dmp	xmrig
behavioral2/memory/1376-2413-0x00007FF78FD50000-0x00007FF7900A1000-memory.dmp	xmrig
behavioral2/memory/1836-2415-0x00007FF6786D0000-0x00007FF678A21000-memory.dmp	xmrig
behavioral2/memory/3620-2414-0x00007FF787030000-0x00007FF787381000-memory.dmp	xmrig
behavioral2/memory/2184-2416-0x00007FF7EFAF0000-0x00007FF7EFE41000-memory.dmp	xmrig
behavioral2/memory/732-2417-0x00007FF6FBF50000-0x00007FF6FC2A1000-memory.dmp	xmrig
behavioral2/memory/2248-2419-0x00007FF734900000-0x00007FF734C51000-memory.dmp	xmrig
behavioral2/memory/2476-2421-0x00007FF6ED580000-0x00007FF6ED8D1000-memory.dmp	xmrig
behavioral2/memory/1376-2423-0x00007FF78FD50000-0x00007FF7900A1000-memory.dmp	xmrig
behavioral2/memory/3620-2425-0x00007FF787030000-0x00007FF787381000-memory.dmp	xmrig
behavioral2/memory/5096-2427-0x00007FF6611C0000-0x00007FF661511000-memory.dmp	xmrig
behavioral2/memory/2184-2431-0x00007FF7EFAF0000-0x00007FF7EFE41000-memory.dmp	xmrig
behavioral2/memory/2592-2430-0x00007FF6650E0000-0x00007FF665431000-memory.dmp	xmrig
behavioral2/memory/660-2437-0x00007FF79E5C0000-0x00007FF79E911000-memory.dmp	xmrig
behavioral2/memory/1836-2435-0x00007FF6786D0000-0x00007FF678A21000-memory.dmp	xmrig
behavioral2/memory/3468-2433-0x00007FF7E6250000-0x00007FF7E65A1000-memory.dmp	xmrig
behavioral2/memory/3684-2441-0x00007FF7BE7A0000-0x00007FF7BEAF1000-memory.dmp	xmrig
behavioral2/memory/3372-2440-0x00007FF75F300000-0x00007FF75F651000-memory.dmp	xmrig
behavioral2/memory/3396-2444-0x00007FF658C20000-0x00007FF658F71000-memory.dmp	xmrig
behavioral2/memory/732-2446-0x00007FF6FBF50000-0x00007FF6FC2A1000-memory.dmp	xmrig
behavioral2/memory/3388-2447-0x00007FF69FCB0000-0x00007FF6A0001000-memory.dmp	xmrig
behavioral2/memory/940-2454-0x00007FF70B110000-0x00007FF70B461000-memory.dmp	xmrig
behavioral2/memory/1328-2456-0x00007FF7B27F0000-0x00007FF7B2B41000-memory.dmp	xmrig
behavioral2/memory/4208-2459-0x00007FF7E4C50000-0x00007FF7E4FA1000-memory.dmp	xmrig
behavioral2/memory/4448-2462-0x00007FF6C8A80000-0x00007FF6C8DD1000-memory.dmp	xmrig
behavioral2/memory/1432-2467-0x00007FF64A020000-0x00007FF64A371000-memory.dmp	xmrig
behavioral2/memory/5076-2465-0x00007FF7CEFC0000-0x00007FF7CF311000-memory.dmp	xmrig
behavioral2/memory/3412-2469-0x00007FF62C900000-0x00007FF62CC51000-memory.dmp	xmrig
behavioral2/memory/2076-2464-0x00007FF65C550000-0x00007FF65C8A1000-memory.dmp	xmrig
behavioral2/memory/4044-2453-0x00007FF773AD0000-0x00007FF773E21000-memory.dmp	xmrig
behavioral2/memory/408-2451-0x00007FF6049F0000-0x00007FF604D41000-memory.dmp	xmrig
behavioral2/memory/1728-2475-0x00007FF798420000-0x00007FF798771000-memory.dmp	xmrig
behavioral2/memory/1840-2487-0x00007FF624650000-0x00007FF6249A1000-memory.dmp	xmrig
behavioral2/memory/2984-2478-0x00007FF643D90000-0x00007FF6440E1000-memory.dmp	xmrig
behavioral2/memory/3680-2482-0x00007FF6E51A0000-0x00007FF6E54F1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2248	fiYPqvw.exe
2476	UZiUjDr.exe
1376	IXgWMhH.exe
3620	uitBEoL.exe
1836	RLzTvXv.exe
3372	PPiAqPY.exe
5096	QhVZsuO.exe
2184	ofpGDjL.exe
2592	xjLRoXI.exe
732	SHMOXqX.exe
3468	yIotTtk.exe
3684	NGejhhC.exe
3388	cQAEzyF.exe
2984	ZZkOAbo.exe
4044	DzqwXwG.exe
940	znsJOSt.exe
3412	WwHFdoy.exe
660	RvmokzL.exe
1328	NsQidIZ.exe
2076	zsufFGQ.exe
1432	FiiHBMb.exe
3396	ePkclld.exe
408	yKFWlGd.exe
4208	TMDDWmd.exe
1840	TCFfjEa.exe
4448	GVmkbrm.exe
1728	gWWWfmm.exe
5076	wKoPXeg.exe
3680	SZiRmFQ.exe
2272	UJIsxjB.exe
4824	brujOlR.exe
4692	wswDyXx.exe
5084	kjffjHs.exe
744	ZKOryse.exe
2312	UhFuyiE.exe
380	lKZvtIj.exe
2824	FJnDwco.exe
3840	AhZOAeI.exe
4884	yvNFzvg.exe
2768	kccvCeP.exe
440	yOpolsD.exe
4052	CqvTnnb.exe
4552	BhLtDnK.exe
208	QHTpMBp.exe
2692	FSeuqdp.exe
4496	EZZqmNE.exe
1664	otdUXEo.exe
3048	RwfXfXn.exe
5104	gUoqQnf.exe
3504	zsRQRlz.exe
3052	KTyNzkD.exe
1496	XMWXXES.exe
4020	udqEOQN.exe
3940	urRtjnd.exe
4740	TNJEdGY.exe
3212	MleuMxt.exe
3896	ilPrydC.exe
4852	VvydjqM.exe
4388	RRCofQW.exe
1612	BkmogBz.exe
1316	NLpQseB.exe
3500	GAARPrK.exe
4992	oeXiNgM.exe
1684	jzjQPzf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2332-0-0x00007FF601640000-0x00007FF601991000-memory.dmp	upx
behavioral2/files/0x000800000002344d-5.dat	upx
behavioral2/files/0x0007000000023453-19.dat	upx
behavioral2/files/0x000700000002345b-54.dat	upx
behavioral2/files/0x000700000002345d-68.dat	upx
behavioral2/files/0x000700000002346c-150.dat	upx
behavioral2/memory/4208-479-0x00007FF7E4C50000-0x00007FF7E4FA1000-memory.dmp	upx
behavioral2/memory/4448-598-0x00007FF6C8A80000-0x00007FF6C8DD1000-memory.dmp	upx
behavioral2/memory/3680-685-0x00007FF6E51A0000-0x00007FF6E54F1000-memory.dmp	upx
behavioral2/memory/940-692-0x00007FF70B110000-0x00007FF70B461000-memory.dmp	upx
behavioral2/memory/2332-2312-0x00007FF601640000-0x00007FF601991000-memory.dmp	upx
behavioral2/memory/408-693-0x00007FF6049F0000-0x00007FF604D41000-memory.dmp	upx
behavioral2/memory/2984-691-0x00007FF643D90000-0x00007FF6440E1000-memory.dmp	upx
behavioral2/memory/3388-690-0x00007FF69FCB0000-0x00007FF6A0001000-memory.dmp	upx
behavioral2/memory/3684-689-0x00007FF7BE7A0000-0x00007FF7BEAF1000-memory.dmp	upx
behavioral2/memory/2592-688-0x00007FF6650E0000-0x00007FF665431000-memory.dmp	upx
behavioral2/memory/3372-687-0x00007FF75F300000-0x00007FF75F651000-memory.dmp	upx
behavioral2/memory/2476-686-0x00007FF6ED580000-0x00007FF6ED8D1000-memory.dmp	upx
behavioral2/memory/5076-672-0x00007FF7CEFC0000-0x00007FF7CF311000-memory.dmp	upx
behavioral2/memory/1728-670-0x00007FF798420000-0x00007FF798771000-memory.dmp	upx
behavioral2/memory/1840-594-0x00007FF624650000-0x00007FF6249A1000-memory.dmp	upx
behavioral2/memory/3396-474-0x00007FF658C20000-0x00007FF658F71000-memory.dmp	upx
behavioral2/memory/1432-394-0x00007FF64A020000-0x00007FF64A371000-memory.dmp	upx
behavioral2/memory/2076-391-0x00007FF65C550000-0x00007FF65C8A1000-memory.dmp	upx
behavioral2/memory/1328-336-0x00007FF7B27F0000-0x00007FF7B2B41000-memory.dmp	upx
behavioral2/memory/660-284-0x00007FF79E5C0000-0x00007FF79E911000-memory.dmp	upx
behavioral2/memory/3412-279-0x00007FF62C900000-0x00007FF62CC51000-memory.dmp	upx
behavioral2/memory/4044-230-0x00007FF773AD0000-0x00007FF773E21000-memory.dmp	upx
behavioral2/files/0x0007000000023477-207.dat	upx
behavioral2/files/0x000700000002346b-206.dat	upx
behavioral2/files/0x0007000000023475-198.dat	upx
behavioral2/files/0x0007000000023469-194.dat	upx
behavioral2/files/0x0007000000023462-186.dat	upx
behavioral2/files/0x0007000000023474-185.dat	upx
behavioral2/files/0x0007000000023461-184.dat	upx
behavioral2/files/0x0007000000023467-182.dat	upx
behavioral2/files/0x0007000000023473-179.dat	upx
behavioral2/files/0x0007000000023460-176.dat	upx
behavioral2/memory/3468-175-0x00007FF7E6250000-0x00007FF7E65A1000-memory.dmp	upx
behavioral2/files/0x0007000000023472-168.dat	upx
behavioral2/files/0x0007000000023470-164.dat	upx
behavioral2/files/0x000700000002345c-157.dat	upx
behavioral2/files/0x0007000000023465-156.dat	upx
behavioral2/files/0x0007000000023478-210.dat	upx
behavioral2/files/0x000700000002345e-144.dat	upx
behavioral2/files/0x0007000000023476-205.dat	upx
behavioral2/files/0x000700000002346a-140.dat	upx
behavioral2/files/0x0007000000023468-132.dat	upx
behavioral2/files/0x0007000000023459-128.dat	upx
behavioral2/memory/732-171-0x00007FF6FBF50000-0x00007FF6FC2A1000-memory.dmp	upx
behavioral2/memory/2184-124-0x00007FF7EFAF0000-0x00007FF7EFE41000-memory.dmp	upx
behavioral2/files/0x0007000000023471-167.dat	upx
behavioral2/files/0x0007000000023466-118.dat	upx
behavioral2/files/0x000700000002346d-151.dat	upx
behavioral2/files/0x0007000000023463-96.dat	upx
behavioral2/files/0x000700000002345a-91.dat	upx
behavioral2/files/0x0007000000023457-86.dat	upx
behavioral2/files/0x0007000000023458-83.dat	upx
behavioral2/files/0x000700000002345f-74.dat	upx
behavioral2/files/0x0007000000023464-106.dat	upx
behavioral2/files/0x0007000000023455-71.dat	upx
behavioral2/files/0x0007000000023456-59.dat	upx
behavioral2/memory/5096-78-0x00007FF6611C0000-0x00007FF661511000-memory.dmp	upx
behavioral2/memory/1836-55-0x00007FF6786D0000-0x00007FF678A21000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DmxFdDG.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\RCCdpcJ.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\ZEAFDCo.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\otdUXEo.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\PjcbSuR.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\bqeZPVG.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\iPadseq.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\tEqtOpM.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\OBcMGBr.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\narrtqX.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\qtbpdGo.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\pzfwHrW.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\IYlOsja.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\RLyWcRG.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\iFWgtPH.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\ixRmAfi.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\GZwfhif.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\wkDipZg.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\wtDmgSK.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\ggswMbR.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\lAvTHPP.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\eSzkeEU.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\EFtsIan.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\gLqNmQj.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\xhqNLUG.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\BqxmQbf.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\kPKpIYC.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\vrGQYBC.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\TNJEdGY.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\icjGoXs.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\iEaiPyb.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\yiJcEZB.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\csvqjLd.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\BMweRQs.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\vGWkHrT.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\hprVPco.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\YYOEgNf.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\SDiLkfj.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\clZrxAy.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\tyfjAhc.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\hKyFdhc.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\twsKywW.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\vqvTBZp.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\YMgGNOZ.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\wOGUkxh.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\GYCHhTi.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\zqJzhws.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\zsufFGQ.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\HNdoWbY.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\EfnDEOD.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\wkJAoUM.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\akJmGeF.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\qrpwbqt.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\gWWWfmm.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\hkqWHdN.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\xQhjXQw.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\RhxAwyu.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\CWwoSJB.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\ymnbtiv.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\vVwagbm.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\IIAZYPn.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\lZDkecz.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\QPlcosC.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
File created	C:\Windows\System\NvoCtiP.exe	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2248	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	86
PID 2332 wrote to memory of 2248	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	86
PID 2332 wrote to memory of 2476	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	87
PID 2332 wrote to memory of 2476	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	87
PID 2332 wrote to memory of 1376	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	88
PID 2332 wrote to memory of 1376	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	88
PID 2332 wrote to memory of 3620	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	89
PID 2332 wrote to memory of 3620	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	89
PID 2332 wrote to memory of 1836	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	90
PID 2332 wrote to memory of 1836	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	90
PID 2332 wrote to memory of 3372	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	91
PID 2332 wrote to memory of 3372	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	91
PID 2332 wrote to memory of 5096	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	92
PID 2332 wrote to memory of 5096	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	92
PID 2332 wrote to memory of 2184	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	93
PID 2332 wrote to memory of 2184	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	93
PID 2332 wrote to memory of 2592	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	94
PID 2332 wrote to memory of 2592	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	94
PID 2332 wrote to memory of 732	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	95
PID 2332 wrote to memory of 732	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	95
PID 2332 wrote to memory of 3468	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	96
PID 2332 wrote to memory of 3468	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	96
PID 2332 wrote to memory of 3684	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	97
PID 2332 wrote to memory of 3684	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	97
PID 2332 wrote to memory of 4044	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	98
PID 2332 wrote to memory of 4044	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	98
PID 2332 wrote to memory of 3388	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	99
PID 2332 wrote to memory of 3388	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	99
PID 2332 wrote to memory of 1328	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	100
PID 2332 wrote to memory of 1328	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	100
PID 2332 wrote to memory of 2984	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	101
PID 2332 wrote to memory of 2984	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	101
PID 2332 wrote to memory of 940	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	102
PID 2332 wrote to memory of 940	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	102
PID 2332 wrote to memory of 3412	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	103
PID 2332 wrote to memory of 3412	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	103
PID 2332 wrote to memory of 4208	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	104
PID 2332 wrote to memory of 4208	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	104
PID 2332 wrote to memory of 660	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	105
PID 2332 wrote to memory of 660	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	105
PID 2332 wrote to memory of 2076	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	106
PID 2332 wrote to memory of 2076	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	106
PID 2332 wrote to memory of 1432	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	107
PID 2332 wrote to memory of 1432	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	107
PID 2332 wrote to memory of 3396	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	108
PID 2332 wrote to memory of 3396	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	108
PID 2332 wrote to memory of 408	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	109
PID 2332 wrote to memory of 408	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	109
PID 2332 wrote to memory of 1840	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	110
PID 2332 wrote to memory of 1840	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	110
PID 2332 wrote to memory of 4448	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	111
PID 2332 wrote to memory of 4448	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	111
PID 2332 wrote to memory of 1728	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	112
PID 2332 wrote to memory of 1728	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	112
PID 2332 wrote to memory of 2824	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	113
PID 2332 wrote to memory of 2824	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	113
PID 2332 wrote to memory of 5076	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	114
PID 2332 wrote to memory of 5076	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	114
PID 2332 wrote to memory of 3680	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	115
PID 2332 wrote to memory of 3680	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	115
PID 2332 wrote to memory of 440	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	116
PID 2332 wrote to memory of 440	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	116
PID 2332 wrote to memory of 4552	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	117
PID 2332 wrote to memory of 4552	2332	c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c06e411a692eeba4ca84419cf7018880_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\System\fiYPqvw.exe
  C:\Windows\System\fiYPqvw.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\UZiUjDr.exe
  C:\Windows\System\UZiUjDr.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\IXgWMhH.exe
  C:\Windows\System\IXgWMhH.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\uitBEoL.exe
  C:\Windows\System\uitBEoL.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\RLzTvXv.exe
  C:\Windows\System\RLzTvXv.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\PPiAqPY.exe
  C:\Windows\System\PPiAqPY.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\QhVZsuO.exe
  C:\Windows\System\QhVZsuO.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\ofpGDjL.exe
  C:\Windows\System\ofpGDjL.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\xjLRoXI.exe
  C:\Windows\System\xjLRoXI.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\SHMOXqX.exe
  C:\Windows\System\SHMOXqX.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\yIotTtk.exe
  C:\Windows\System\yIotTtk.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\NGejhhC.exe
  C:\Windows\System\NGejhhC.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\DzqwXwG.exe
  C:\Windows\System\DzqwXwG.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\cQAEzyF.exe
  C:\Windows\System\cQAEzyF.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\NsQidIZ.exe
  C:\Windows\System\NsQidIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\ZZkOAbo.exe
  C:\Windows\System\ZZkOAbo.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\znsJOSt.exe
  C:\Windows\System\znsJOSt.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\WwHFdoy.exe
  C:\Windows\System\WwHFdoy.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\TMDDWmd.exe
  C:\Windows\System\TMDDWmd.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\RvmokzL.exe
  C:\Windows\System\RvmokzL.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\zsufFGQ.exe
  C:\Windows\System\zsufFGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\FiiHBMb.exe
  C:\Windows\System\FiiHBMb.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\ePkclld.exe
  C:\Windows\System\ePkclld.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\yKFWlGd.exe
  C:\Windows\System\yKFWlGd.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\TCFfjEa.exe
  C:\Windows\System\TCFfjEa.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\GVmkbrm.exe
  C:\Windows\System\GVmkbrm.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\gWWWfmm.exe
  C:\Windows\System\gWWWfmm.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\FJnDwco.exe
  C:\Windows\System\FJnDwco.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\wKoPXeg.exe
  C:\Windows\System\wKoPXeg.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\SZiRmFQ.exe
  C:\Windows\System\SZiRmFQ.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\yOpolsD.exe
  C:\Windows\System\yOpolsD.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\BhLtDnK.exe
  C:\Windows\System\BhLtDnK.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\UJIsxjB.exe
  C:\Windows\System\UJIsxjB.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\brujOlR.exe
  C:\Windows\System\brujOlR.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\wswDyXx.exe
  C:\Windows\System\wswDyXx.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\kjffjHs.exe
  C:\Windows\System\kjffjHs.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\ZKOryse.exe
  C:\Windows\System\ZKOryse.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\UhFuyiE.exe
  C:\Windows\System\UhFuyiE.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\lKZvtIj.exe
  C:\Windows\System\lKZvtIj.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\AhZOAeI.exe
  C:\Windows\System\AhZOAeI.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\yvNFzvg.exe
  C:\Windows\System\yvNFzvg.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\kccvCeP.exe
  C:\Windows\System\kccvCeP.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\CqvTnnb.exe
  C:\Windows\System\CqvTnnb.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\QHTpMBp.exe
  C:\Windows\System\QHTpMBp.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\FSeuqdp.exe
  C:\Windows\System\FSeuqdp.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\EZZqmNE.exe
  C:\Windows\System\EZZqmNE.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\otdUXEo.exe
  C:\Windows\System\otdUXEo.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\RwfXfXn.exe
  C:\Windows\System\RwfXfXn.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\gUoqQnf.exe
  C:\Windows\System\gUoqQnf.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\zsRQRlz.exe
  C:\Windows\System\zsRQRlz.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\KTyNzkD.exe
  C:\Windows\System\KTyNzkD.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\XMWXXES.exe
  C:\Windows\System\XMWXXES.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\udqEOQN.exe
  C:\Windows\System\udqEOQN.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\urRtjnd.exe
  C:\Windows\System\urRtjnd.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\TNJEdGY.exe
  C:\Windows\System\TNJEdGY.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\MleuMxt.exe
  C:\Windows\System\MleuMxt.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\ilPrydC.exe
  C:\Windows\System\ilPrydC.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\VvydjqM.exe
  C:\Windows\System\VvydjqM.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\RRCofQW.exe
  C:\Windows\System\RRCofQW.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\BkmogBz.exe
  C:\Windows\System\BkmogBz.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\NLpQseB.exe
  C:\Windows\System\NLpQseB.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\GAARPrK.exe
  C:\Windows\System\GAARPrK.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\oeXiNgM.exe
  C:\Windows\System\oeXiNgM.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\jzjQPzf.exe
  C:\Windows\System\jzjQPzf.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\xZRNGrx.exe
  C:\Windows\System\xZRNGrx.exe
  2⤵
  PID:5044
- C:\Windows\System\sgCntrN.exe
  C:\Windows\System\sgCntrN.exe
  2⤵
  PID:4636
- C:\Windows\System\dEhIlod.exe
  C:\Windows\System\dEhIlod.exe
  2⤵
  PID:3136
- C:\Windows\System\mCHmIdJ.exe
  C:\Windows\System\mCHmIdJ.exe
  2⤵
  PID:2800
- C:\Windows\System\OKIeRfj.exe
  C:\Windows\System\OKIeRfj.exe
  2⤵
  PID:5008
- C:\Windows\System\BNYPUTd.exe
  C:\Windows\System\BNYPUTd.exe
  2⤵
  PID:2212
- C:\Windows\System\VQOHPwg.exe
  C:\Windows\System\VQOHPwg.exe
  2⤵
  PID:3148
- C:\Windows\System\vraseSp.exe
  C:\Windows\System\vraseSp.exe
  2⤵
  PID:1444
- C:\Windows\System\sCLSwiN.exe
  C:\Windows\System\sCLSwiN.exe
  2⤵
  PID:3284
- C:\Windows\System\UpVRTaW.exe
  C:\Windows\System\UpVRTaW.exe
  2⤵
  PID:3092
- C:\Windows\System\HNdoWbY.exe
  C:\Windows\System\HNdoWbY.exe
  2⤵
  PID:3708
- C:\Windows\System\BoUdwCD.exe
  C:\Windows\System\BoUdwCD.exe
  2⤵
  PID:5132
- C:\Windows\System\aAucyGm.exe
  C:\Windows\System\aAucyGm.exe
  2⤵
  PID:5164
- C:\Windows\System\VtkNzzd.exe
  C:\Windows\System\VtkNzzd.exe
  2⤵
  PID:5192
- C:\Windows\System\YCCYBXF.exe
  C:\Windows\System\YCCYBXF.exe
  2⤵
  PID:5224
- C:\Windows\System\csvqjLd.exe
  C:\Windows\System\csvqjLd.exe
  2⤵
  PID:5244
- C:\Windows\System\OBcMGBr.exe
  C:\Windows\System\OBcMGBr.exe
  2⤵
  PID:5272
- C:\Windows\System\IfEtosM.exe
  C:\Windows\System\IfEtosM.exe
  2⤵
  PID:5288
- C:\Windows\System\tbQQKMp.exe
  C:\Windows\System\tbQQKMp.exe
  2⤵
  PID:5308
- C:\Windows\System\vZiApRk.exe
  C:\Windows\System\vZiApRk.exe
  2⤵
  PID:5332
- C:\Windows\System\qBHWHCO.exe
  C:\Windows\System\qBHWHCO.exe
  2⤵
  PID:5356
- C:\Windows\System\ALTjuPd.exe
  C:\Windows\System\ALTjuPd.exe
  2⤵
  PID:5372
- C:\Windows\System\UzpTMUN.exe
  C:\Windows\System\UzpTMUN.exe
  2⤵
  PID:5432
- C:\Windows\System\ITPRmmL.exe
  C:\Windows\System\ITPRmmL.exe
  2⤵
  PID:5448
- C:\Windows\System\XJBWaUN.exe
  C:\Windows\System\XJBWaUN.exe
  2⤵
  PID:5472
- C:\Windows\System\UcJJiMP.exe
  C:\Windows\System\UcJJiMP.exe
  2⤵
  PID:5496
- C:\Windows\System\UEGfApS.exe
  C:\Windows\System\UEGfApS.exe
  2⤵
  PID:5516
- C:\Windows\System\ejziPlY.exe
  C:\Windows\System\ejziPlY.exe
  2⤵
  PID:5544
- C:\Windows\System\SjprXUj.exe
  C:\Windows\System\SjprXUj.exe
  2⤵
  PID:5560
- C:\Windows\System\xzOsprf.exe
  C:\Windows\System\xzOsprf.exe
  2⤵
  PID:5580
- C:\Windows\System\VDePDep.exe
  C:\Windows\System\VDePDep.exe
  2⤵
  PID:5608
- C:\Windows\System\ieSdfde.exe
  C:\Windows\System\ieSdfde.exe
  2⤵
  PID:5628
- C:\Windows\System\ibMVmlx.exe
  C:\Windows\System\ibMVmlx.exe
  2⤵
  PID:5652
- C:\Windows\System\icjGoXs.exe
  C:\Windows\System\icjGoXs.exe
  2⤵
  PID:5676
- C:\Windows\System\RSemvJc.exe
  C:\Windows\System\RSemvJc.exe
  2⤵
  PID:5692
- C:\Windows\System\rQJTrJO.exe
  C:\Windows\System\rQJTrJO.exe
  2⤵
  PID:5716
- C:\Windows\System\szBYHlh.exe
  C:\Windows\System\szBYHlh.exe
  2⤵
  PID:5760
- C:\Windows\System\NjGgXbp.exe
  C:\Windows\System\NjGgXbp.exe
  2⤵
  PID:5788
- C:\Windows\System\LMApGGD.exe
  C:\Windows\System\LMApGGD.exe
  2⤵
  PID:5804
- C:\Windows\System\SDiLkfj.exe
  C:\Windows\System\SDiLkfj.exe
  2⤵
  PID:5820
- C:\Windows\System\RAbwUtf.exe
  C:\Windows\System\RAbwUtf.exe
  2⤵
  PID:5840
- C:\Windows\System\gaXLpGd.exe
  C:\Windows\System\gaXLpGd.exe
  2⤵
  PID:5860
- C:\Windows\System\wOGUkxh.exe
  C:\Windows\System\wOGUkxh.exe
  2⤵
  PID:5884
- C:\Windows\System\svFrlVs.exe
  C:\Windows\System\svFrlVs.exe
  2⤵
  PID:5904
- C:\Windows\System\MNmJCpa.exe
  C:\Windows\System\MNmJCpa.exe
  2⤵
  PID:5932
- C:\Windows\System\ihKwUFm.exe
  C:\Windows\System\ihKwUFm.exe
  2⤵
  PID:5952
- C:\Windows\System\VonyGYQ.exe
  C:\Windows\System\VonyGYQ.exe
  2⤵
  PID:5968
- C:\Windows\System\aPtBlvv.exe
  C:\Windows\System\aPtBlvv.exe
  2⤵
  PID:5992
- C:\Windows\System\VCDwfQR.exe
  C:\Windows\System\VCDwfQR.exe
  2⤵
  PID:6016
- C:\Windows\System\hAKYxzd.exe
  C:\Windows\System\hAKYxzd.exe
  2⤵
  PID:6044
- C:\Windows\System\sDbmQYj.exe
  C:\Windows\System\sDbmQYj.exe
  2⤵
  PID:6064
- C:\Windows\System\BqxmQbf.exe
  C:\Windows\System\BqxmQbf.exe
  2⤵
  PID:6084
- C:\Windows\System\WtRNKIX.exe
  C:\Windows\System\WtRNKIX.exe
  2⤵
  PID:6112
- C:\Windows\System\MMojAbT.exe
  C:\Windows\System\MMojAbT.exe
  2⤵
  PID:6128
- C:\Windows\System\OrrMdxu.exe
  C:\Windows\System\OrrMdxu.exe
  2⤵
  PID:884
- C:\Windows\System\tPxcZOj.exe
  C:\Windows\System\tPxcZOj.exe
  2⤵
  PID:1764
- C:\Windows\System\vGALHwH.exe
  C:\Windows\System\vGALHwH.exe
  2⤵
  PID:412
- C:\Windows\System\IpbPNoX.exe
  C:\Windows\System\IpbPNoX.exe
  2⤵
  PID:5128
- C:\Windows\System\jujDfDF.exe
  C:\Windows\System\jujDfDF.exe
  2⤵
  PID:5024
- C:\Windows\System\ThIcpxV.exe
  C:\Windows\System\ThIcpxV.exe
  2⤵
  PID:5260
- C:\Windows\System\jlOgdGl.exe
  C:\Windows\System\jlOgdGl.exe
  2⤵
  PID:3676
- C:\Windows\System\lzIsdYG.exe
  C:\Windows\System\lzIsdYG.exe
  2⤵
  PID:3804
- C:\Windows\System\efXoLvN.exe
  C:\Windows\System\efXoLvN.exe
  2⤵
  PID:648
- C:\Windows\System\GYABSKh.exe
  C:\Windows\System\GYABSKh.exe
  2⤵
  PID:4532
- C:\Windows\System\RsVtiZe.exe
  C:\Windows\System\RsVtiZe.exe
  2⤵
  PID:3852
- C:\Windows\System\GCDtQSV.exe
  C:\Windows\System\GCDtQSV.exe
  2⤵
  PID:5572
- C:\Windows\System\uvqXrga.exe
  C:\Windows\System\uvqXrga.exe
  2⤵
  PID:5176
- C:\Windows\System\XXsArwz.exe
  C:\Windows\System\XXsArwz.exe
  2⤵
  PID:5684
- C:\Windows\System\zPpBowd.exe
  C:\Windows\System\zPpBowd.exe
  2⤵
  PID:2732
- C:\Windows\System\BntsBFC.exe
  C:\Windows\System\BntsBFC.exe
  2⤵
  PID:5836
- C:\Windows\System\bZqqlVS.exe
  C:\Windows\System\bZqqlVS.exe
  2⤵
  PID:2892
- C:\Windows\System\ZDQdfKZ.exe
  C:\Windows\System\ZDQdfKZ.exe
  2⤵
  PID:6176
- C:\Windows\System\bdRxPnS.exe
  C:\Windows\System\bdRxPnS.exe
  2⤵
  PID:6196
- C:\Windows\System\qmmDhHQ.exe
  C:\Windows\System\qmmDhHQ.exe
  2⤵
  PID:6220
- C:\Windows\System\yVObmpx.exe
  C:\Windows\System\yVObmpx.exe
  2⤵
  PID:6236
- C:\Windows\System\WDDAytF.exe
  C:\Windows\System\WDDAytF.exe
  2⤵
  PID:6260
- C:\Windows\System\YUmCWgk.exe
  C:\Windows\System\YUmCWgk.exe
  2⤵
  PID:6276
- C:\Windows\System\krrsvnl.exe
  C:\Windows\System\krrsvnl.exe
  2⤵
  PID:6296
- C:\Windows\System\EpzZIJd.exe
  C:\Windows\System\EpzZIJd.exe
  2⤵
  PID:6320
- C:\Windows\System\rdztbbo.exe
  C:\Windows\System\rdztbbo.exe
  2⤵
  PID:6344
- C:\Windows\System\ePKhQDE.exe
  C:\Windows\System\ePKhQDE.exe
  2⤵
  PID:6364
- C:\Windows\System\hJihhov.exe
  C:\Windows\System\hJihhov.exe
  2⤵
  PID:6384
- C:\Windows\System\TswRwGb.exe
  C:\Windows\System\TswRwGb.exe
  2⤵
  PID:6416
- C:\Windows\System\vHjlWiR.exe
  C:\Windows\System\vHjlWiR.exe
  2⤵
  PID:6440
- C:\Windows\System\pVAVXqb.exe
  C:\Windows\System\pVAVXqb.exe
  2⤵
  PID:6464
- C:\Windows\System\IBlEFoT.exe
  C:\Windows\System\IBlEFoT.exe
  2⤵
  PID:6484
- C:\Windows\System\kTwUCVJ.exe
  C:\Windows\System\kTwUCVJ.exe
  2⤵
  PID:6520
- C:\Windows\System\YqCbwme.exe
  C:\Windows\System\YqCbwme.exe
  2⤵
  PID:6540
- C:\Windows\System\wkDipZg.exe
  C:\Windows\System\wkDipZg.exe
  2⤵
  PID:6556
- C:\Windows\System\JFgIuGx.exe
  C:\Windows\System\JFgIuGx.exe
  2⤵
  PID:6572
- C:\Windows\System\IgFYWpo.exe
  C:\Windows\System\IgFYWpo.exe
  2⤵
  PID:6588
- C:\Windows\System\MaOntpL.exe
  C:\Windows\System\MaOntpL.exe
  2⤵
  PID:6604
- C:\Windows\System\rTyKhus.exe
  C:\Windows\System\rTyKhus.exe
  2⤵
  PID:6628
- C:\Windows\System\UpMwtLN.exe
  C:\Windows\System\UpMwtLN.exe
  2⤵
  PID:6644
- C:\Windows\System\dZxQJXu.exe
  C:\Windows\System\dZxQJXu.exe
  2⤵
  PID:6664
- C:\Windows\System\jvtZAZn.exe
  C:\Windows\System\jvtZAZn.exe
  2⤵
  PID:6692
- C:\Windows\System\sbrYxJO.exe
  C:\Windows\System\sbrYxJO.exe
  2⤵
  PID:6712
- C:\Windows\System\krkFIlN.exe
  C:\Windows\System\krkFIlN.exe
  2⤵
  PID:6736
- C:\Windows\System\FLjLijq.exe
  C:\Windows\System\FLjLijq.exe
  2⤵
  PID:6756
- C:\Windows\System\HdNhiSk.exe
  C:\Windows\System\HdNhiSk.exe
  2⤵
  PID:6772
- C:\Windows\System\qQIxJOy.exe
  C:\Windows\System\qQIxJOy.exe
  2⤵
  PID:6800
- C:\Windows\System\EFtsIan.exe
  C:\Windows\System\EFtsIan.exe
  2⤵
  PID:6828
- C:\Windows\System\NvoCtiP.exe
  C:\Windows\System\NvoCtiP.exe
  2⤵
  PID:6844
- C:\Windows\System\QbgQpGY.exe
  C:\Windows\System\QbgQpGY.exe
  2⤵
  PID:6868
- C:\Windows\System\OySflZe.exe
  C:\Windows\System\OySflZe.exe
  2⤵
  PID:6892
- C:\Windows\System\Lmirtza.exe
  C:\Windows\System\Lmirtza.exe
  2⤵
  PID:6916
- C:\Windows\System\xhqNLUG.exe
  C:\Windows\System\xhqNLUG.exe
  2⤵
  PID:6936
- C:\Windows\System\qMKDEjs.exe
  C:\Windows\System\qMKDEjs.exe
  2⤵
  PID:6984
- C:\Windows\System\iKWsjaR.exe
  C:\Windows\System\iKWsjaR.exe
  2⤵
  PID:7004
- C:\Windows\System\ehCANQp.exe
  C:\Windows\System\ehCANQp.exe
  2⤵
  PID:7028
- C:\Windows\System\cLDBZis.exe
  C:\Windows\System\cLDBZis.exe
  2⤵
  PID:7048
- C:\Windows\System\qPaforp.exe
  C:\Windows\System\qPaforp.exe
  2⤵
  PID:7072
- C:\Windows\System\EhkzZoq.exe
  C:\Windows\System\EhkzZoq.exe
  2⤵
  PID:7096
- C:\Windows\System\abEkmVa.exe
  C:\Windows\System\abEkmVa.exe
  2⤵
  PID:7132
- C:\Windows\System\RubLOVe.exe
  C:\Windows\System\RubLOVe.exe
  2⤵
  PID:7152
- C:\Windows\System\ngNtXJc.exe
  C:\Windows\System\ngNtXJc.exe
  2⤵
  PID:4604
- C:\Windows\System\mwweZUa.exe
  C:\Windows\System\mwweZUa.exe
  2⤵
  PID:756
- C:\Windows\System\eqGnXSu.exe
  C:\Windows\System\eqGnXSu.exe
  2⤵
  PID:2912
- C:\Windows\System\KqoiVlI.exe
  C:\Windows\System\KqoiVlI.exe
  2⤵
  PID:5528
- C:\Windows\System\mvjlrtY.exe
  C:\Windows\System\mvjlrtY.exe
  2⤵
  PID:6096
- C:\Windows\System\YYjwkBY.exe
  C:\Windows\System\YYjwkBY.exe
  2⤵
  PID:6136
- C:\Windows\System\DSMZnqE.exe
  C:\Windows\System\DSMZnqE.exe
  2⤵
  PID:5200
- C:\Windows\System\nyQxwDW.exe
  C:\Windows\System\nyQxwDW.exe
  2⤵
  PID:5620
- C:\Windows\System\aqoWMFG.exe
  C:\Windows\System\aqoWMFG.exe
  2⤵
  PID:5232
- C:\Windows\System\fWXPDLM.exe
  C:\Windows\System\fWXPDLM.exe
  2⤵
  PID:5664
- C:\Windows\System\ynzNpcz.exe
  C:\Windows\System\ynzNpcz.exe
  2⤵
  PID:5304
- C:\Windows\System\wpJYNSv.exe
  C:\Windows\System\wpJYNSv.exe
  2⤵
  PID:5340
- C:\Windows\System\QLiztuy.exe
  C:\Windows\System\QLiztuy.exe
  2⤵
  PID:5368
- C:\Windows\System\WfWnxje.exe
  C:\Windows\System\WfWnxje.exe
  2⤵
  PID:5768
- C:\Windows\System\QXgMUXr.exe
  C:\Windows\System\QXgMUXr.exe
  2⤵
  PID:5852
- C:\Windows\System\ayYwCNI.exe
  C:\Windows\System\ayYwCNI.exe
  2⤵
  PID:5160
- C:\Windows\System\qxzxiiZ.exe
  C:\Windows\System\qxzxiiZ.exe
  2⤵
  PID:5940
- C:\Windows\System\uGuUFld.exe
  C:\Windows\System\uGuUFld.exe
  2⤵
  PID:5456
- C:\Windows\System\ymnbtiv.exe
  C:\Windows\System\ymnbtiv.exe
  2⤵
  PID:4004
- C:\Windows\System\WqsTOUU.exe
  C:\Windows\System\WqsTOUU.exe
  2⤵
  PID:6360
- C:\Windows\System\vkqZdiD.exe
  C:\Windows\System\vkqZdiD.exe
  2⤵
  PID:4240
- C:\Windows\System\UBeuijD.exe
  C:\Windows\System\UBeuijD.exe
  2⤵
  PID:6448
- C:\Windows\System\PFjEjAI.exe
  C:\Windows\System\PFjEjAI.exe
  2⤵
  PID:6496
- C:\Windows\System\lbMKPcc.exe
  C:\Windows\System\lbMKPcc.exe
  2⤵
  PID:6532
- C:\Windows\System\ImdIvTa.exe
  C:\Windows\System\ImdIvTa.exe
  2⤵
  PID:5816
- C:\Windows\System\pbKNPTo.exe
  C:\Windows\System\pbKNPTo.exe
  2⤵
  PID:6620
- C:\Windows\System\sdzEZJm.exe
  C:\Windows\System\sdzEZJm.exe
  2⤵
  PID:6640
- C:\Windows\System\JkivOlm.exe
  C:\Windows\System\JkivOlm.exe
  2⤵
  PID:2872
- C:\Windows\System\lJSVpQp.exe
  C:\Windows\System\lJSVpQp.exe
  2⤵
  PID:7172
- C:\Windows\System\bySPiYC.exe
  C:\Windows\System\bySPiYC.exe
  2⤵
  PID:7196
- C:\Windows\System\SCwkWsd.exe
  C:\Windows\System\SCwkWsd.exe
  2⤵
  PID:7216
- C:\Windows\System\UstuCZe.exe
  C:\Windows\System\UstuCZe.exe
  2⤵
  PID:7236
- C:\Windows\System\oNHkVmZ.exe
  C:\Windows\System\oNHkVmZ.exe
  2⤵
  PID:7260
- C:\Windows\System\qrpwbqt.exe
  C:\Windows\System\qrpwbqt.exe
  2⤵
  PID:7288
- C:\Windows\System\trKfsNC.exe
  C:\Windows\System\trKfsNC.exe
  2⤵
  PID:7320
- C:\Windows\System\QQyfbBZ.exe
  C:\Windows\System\QQyfbBZ.exe
  2⤵
  PID:7344
- C:\Windows\System\cfkoHuk.exe
  C:\Windows\System\cfkoHuk.exe
  2⤵
  PID:7368
- C:\Windows\System\WgjMDGL.exe
  C:\Windows\System\WgjMDGL.exe
  2⤵
  PID:7396
- C:\Windows\System\KRIQvgx.exe
  C:\Windows\System\KRIQvgx.exe
  2⤵
  PID:7420
- C:\Windows\System\qHgUGtU.exe
  C:\Windows\System\qHgUGtU.exe
  2⤵
  PID:7436
- C:\Windows\System\HBstWgX.exe
  C:\Windows\System\HBstWgX.exe
  2⤵
  PID:7484
- C:\Windows\System\TezWjhA.exe
  C:\Windows\System\TezWjhA.exe
  2⤵
  PID:7508
- C:\Windows\System\xfQNruc.exe
  C:\Windows\System\xfQNruc.exe
  2⤵
  PID:7540
- C:\Windows\System\XPyTSbH.exe
  C:\Windows\System\XPyTSbH.exe
  2⤵
  PID:7560
- C:\Windows\System\epNMpxr.exe
  C:\Windows\System\epNMpxr.exe
  2⤵
  PID:7584
- C:\Windows\System\UzDREfD.exe
  C:\Windows\System\UzDREfD.exe
  2⤵
  PID:7620
- C:\Windows\System\FCVjlQk.exe
  C:\Windows\System\FCVjlQk.exe
  2⤵
  PID:7644
- C:\Windows\System\JThlGmF.exe
  C:\Windows\System\JThlGmF.exe
  2⤵
  PID:7664
- C:\Windows\System\Ejjgohm.exe
  C:\Windows\System\Ejjgohm.exe
  2⤵
  PID:7700
- C:\Windows\System\TXfuMnm.exe
  C:\Windows\System\TXfuMnm.exe
  2⤵
  PID:7720
- C:\Windows\System\rxqlYwk.exe
  C:\Windows\System\rxqlYwk.exe
  2⤵
  PID:7740
- C:\Windows\System\JunYoUs.exe
  C:\Windows\System\JunYoUs.exe
  2⤵
  PID:8088
- C:\Windows\System\VOphPET.exe
  C:\Windows\System\VOphPET.exe
  2⤵
  PID:8104
- C:\Windows\System\jggltQl.exe
  C:\Windows\System\jggltQl.exe
  2⤵
  PID:8120
- C:\Windows\System\hkqWHdN.exe
  C:\Windows\System\hkqWHdN.exe
  2⤵
  PID:8136
- C:\Windows\System\qrVtbXE.exe
  C:\Windows\System\qrVtbXE.exe
  2⤵
  PID:8152
- C:\Windows\System\gGkoTlU.exe
  C:\Windows\System\gGkoTlU.exe
  2⤵
  PID:8168
- C:\Windows\System\yjiaMHi.exe
  C:\Windows\System\yjiaMHi.exe
  2⤵
  PID:8184
- C:\Windows\System\SJTVoKf.exe
  C:\Windows\System\SJTVoKf.exe
  2⤵
  PID:5900
- C:\Windows\System\LSsmnkR.exe
  C:\Windows\System\LSsmnkR.exe
  2⤵
  PID:5924
- C:\Windows\System\KbngEMp.exe
  C:\Windows\System\KbngEMp.exe
  2⤵
  PID:6792
- C:\Windows\System\UAvgrKw.exe
  C:\Windows\System\UAvgrKw.exe
  2⤵
  PID:6888
- C:\Windows\System\GBHvxAJ.exe
  C:\Windows\System\GBHvxAJ.exe
  2⤵
  PID:696
- C:\Windows\System\CjgnhWD.exe
  C:\Windows\System\CjgnhWD.exe
  2⤵
  PID:5980
- C:\Windows\System\PjcbSuR.exe
  C:\Windows\System\PjcbSuR.exe
  2⤵
  PID:6052
- C:\Windows\System\xWbiMBs.exe
  C:\Windows\System\xWbiMBs.exe
  2⤵
  PID:6080
- C:\Windows\System\GQKVWUY.exe
  C:\Windows\System\GQKVWUY.exe
  2⤵
  PID:1464
- C:\Windows\System\bqeZPVG.exe
  C:\Windows\System\bqeZPVG.exe
  2⤵
  PID:7444
- C:\Windows\System\RmKbrPy.exe
  C:\Windows\System\RmKbrPy.exe
  2⤵
  PID:6204
- C:\Windows\System\LGcLrVJ.exe
  C:\Windows\System\LGcLrVJ.exe
  2⤵
  PID:6288
- C:\Windows\System\lSSGnZP.exe
  C:\Windows\System\lSSGnZP.exe
  2⤵
  PID:7840
- C:\Windows\System\YYdTKbB.exe
  C:\Windows\System\YYdTKbB.exe
  2⤵
  PID:7920
- C:\Windows\System\OIOtXDE.exe
  C:\Windows\System\OIOtXDE.exe
  2⤵
  PID:7992
- C:\Windows\System\TGMaywB.exe
  C:\Windows\System\TGMaywB.exe
  2⤵
  PID:7712
- C:\Windows\System\XQkMNar.exe
  C:\Windows\System\XQkMNar.exe
  2⤵
  PID:7660
- C:\Windows\System\AoFttHk.exe
  C:\Windows\System\AoFttHk.exe
  2⤵
  PID:7596
- C:\Windows\System\JtHIdGp.exe
  C:\Windows\System\JtHIdGp.exe
  2⤵
  PID:7548
- C:\Windows\System\QESnsGT.exe
  C:\Windows\System\QESnsGT.exe
  2⤵
  PID:7504
- C:\Windows\System\MTOiicA.exe
  C:\Windows\System\MTOiicA.exe
  2⤵
  PID:4896
- C:\Windows\System\KnueKON.exe
  C:\Windows\System\KnueKON.exe
  2⤵
  PID:4372
- C:\Windows\System\aTwXgjf.exe
  C:\Windows\System\aTwXgjf.exe
  2⤵
  PID:3384
- C:\Windows\System\VloSCIP.exe
  C:\Windows\System\VloSCIP.exe
  2⤵
  PID:8204
- C:\Windows\System\sKXDUpd.exe
  C:\Windows\System\sKXDUpd.exe
  2⤵
  PID:8224
- C:\Windows\System\aHwauCm.exe
  C:\Windows\System\aHwauCm.exe
  2⤵
  PID:8244
- C:\Windows\System\zxzCrHX.exe
  C:\Windows\System\zxzCrHX.exe
  2⤵
  PID:8264
- C:\Windows\System\OqFgnxE.exe
  C:\Windows\System\OqFgnxE.exe
  2⤵
  PID:8284
- C:\Windows\System\DbJxbOC.exe
  C:\Windows\System\DbJxbOC.exe
  2⤵
  PID:8300
- C:\Windows\System\rEtESMy.exe
  C:\Windows\System\rEtESMy.exe
  2⤵
  PID:8320
- C:\Windows\System\LWMPosI.exe
  C:\Windows\System\LWMPosI.exe
  2⤵
  PID:8340
- C:\Windows\System\mtyvaqe.exe
  C:\Windows\System\mtyvaqe.exe
  2⤵
  PID:8360
- C:\Windows\System\YgiCLqS.exe
  C:\Windows\System\YgiCLqS.exe
  2⤵
  PID:8380
- C:\Windows\System\HoPrrDG.exe
  C:\Windows\System\HoPrrDG.exe
  2⤵
  PID:8400
- C:\Windows\System\awKgwtg.exe
  C:\Windows\System\awKgwtg.exe
  2⤵
  PID:8420
- C:\Windows\System\Klgjnwk.exe
  C:\Windows\System\Klgjnwk.exe
  2⤵
  PID:8440
- C:\Windows\System\ZtfnZNt.exe
  C:\Windows\System\ZtfnZNt.exe
  2⤵
  PID:8456
- C:\Windows\System\InpKGAQ.exe
  C:\Windows\System\InpKGAQ.exe
  2⤵
  PID:8488
- C:\Windows\System\WYcMHoq.exe
  C:\Windows\System\WYcMHoq.exe
  2⤵
  PID:8508
- C:\Windows\System\HsTytku.exe
  C:\Windows\System\HsTytku.exe
  2⤵
  PID:8528
- C:\Windows\System\nOBgfYc.exe
  C:\Windows\System\nOBgfYc.exe
  2⤵
  PID:8544
- C:\Windows\System\uuNPeUl.exe
  C:\Windows\System\uuNPeUl.exe
  2⤵
  PID:8564
- C:\Windows\System\UbPBzMD.exe
  C:\Windows\System\UbPBzMD.exe
  2⤵
  PID:8584
- C:\Windows\System\mFqQkNC.exe
  C:\Windows\System\mFqQkNC.exe
  2⤵
  PID:8604
- C:\Windows\System\iAPHFDT.exe
  C:\Windows\System\iAPHFDT.exe
  2⤵
  PID:8624
- C:\Windows\System\sdYsaSC.exe
  C:\Windows\System\sdYsaSC.exe
  2⤵
  PID:8668
- C:\Windows\System\gWHNexf.exe
  C:\Windows\System\gWHNexf.exe
  2⤵
  PID:8684
- C:\Windows\System\mjgFvVa.exe
  C:\Windows\System\mjgFvVa.exe
  2⤵
  PID:8700
- C:\Windows\System\YKqdMsm.exe
  C:\Windows\System\YKqdMsm.exe
  2⤵
  PID:8716
- C:\Windows\System\tiiTKZt.exe
  C:\Windows\System\tiiTKZt.exe
  2⤵
  PID:8732
- C:\Windows\System\tDoTAZs.exe
  C:\Windows\System\tDoTAZs.exe
  2⤵
  PID:8748
- C:\Windows\System\QberBAI.exe
  C:\Windows\System\QberBAI.exe
  2⤵
  PID:8764
- C:\Windows\System\lmOtPrS.exe
  C:\Windows\System\lmOtPrS.exe
  2⤵
  PID:8784
- C:\Windows\System\AdrevOP.exe
  C:\Windows\System\AdrevOP.exe
  2⤵
  PID:8800
- C:\Windows\System\TZnxxDg.exe
  C:\Windows\System\TZnxxDg.exe
  2⤵
  PID:8828
- C:\Windows\System\IFfCcqv.exe
  C:\Windows\System\IFfCcqv.exe
  2⤵
  PID:8844
- C:\Windows\System\ktGcvRZ.exe
  C:\Windows\System\ktGcvRZ.exe
  2⤵
  PID:8860
- C:\Windows\System\Gywvlmc.exe
  C:\Windows\System\Gywvlmc.exe
  2⤵
  PID:8876
- C:\Windows\System\FwLJyoE.exe
  C:\Windows\System\FwLJyoE.exe
  2⤵
  PID:8892
- C:\Windows\System\KXcQwuw.exe
  C:\Windows\System\KXcQwuw.exe
  2⤵
  PID:8908
- C:\Windows\System\DmxFdDG.exe
  C:\Windows\System\DmxFdDG.exe
  2⤵
  PID:8924
- C:\Windows\System\tzlFkDh.exe
  C:\Windows\System\tzlFkDh.exe
  2⤵
  PID:8940
- C:\Windows\System\UMZQVoj.exe
  C:\Windows\System\UMZQVoj.exe
  2⤵
  PID:8956
- C:\Windows\System\mBGUTJJ.exe
  C:\Windows\System\mBGUTJJ.exe
  2⤵
  PID:8972
- C:\Windows\System\zPfwMSO.exe
  C:\Windows\System\zPfwMSO.exe
  2⤵
  PID:8988
- C:\Windows\System\QWgNoIW.exe
  C:\Windows\System\QWgNoIW.exe
  2⤵
  PID:9008
- C:\Windows\System\ABtENav.exe
  C:\Windows\System\ABtENav.exe
  2⤵
  PID:9028
- C:\Windows\System\FzUzrTO.exe
  C:\Windows\System\FzUzrTO.exe
  2⤵
  PID:9044
- C:\Windows\System\tpFpQwe.exe
  C:\Windows\System\tpFpQwe.exe
  2⤵
  PID:9060
- C:\Windows\System\lPNLlEe.exe
  C:\Windows\System\lPNLlEe.exe
  2⤵
  PID:9076
- C:\Windows\System\LOVSgyu.exe
  C:\Windows\System\LOVSgyu.exe
  2⤵
  PID:9096
- C:\Windows\System\zWLWUnA.exe
  C:\Windows\System\zWLWUnA.exe
  2⤵
  PID:9112
- C:\Windows\System\nXUgXsC.exe
  C:\Windows\System\nXUgXsC.exe
  2⤵
  PID:9132
- C:\Windows\System\pKPuhbB.exe
  C:\Windows\System\pKPuhbB.exe
  2⤵
  PID:9152
- C:\Windows\System\sPRAHHr.exe
  C:\Windows\System\sPRAHHr.exe
  2⤵
  PID:9172
- C:\Windows\System\jRAIyja.exe
  C:\Windows\System\jRAIyja.exe
  2⤵
  PID:9188
- C:\Windows\System\qcTXXst.exe
  C:\Windows\System\qcTXXst.exe
  2⤵
  PID:9208
- C:\Windows\System\bRHJBdq.exe
  C:\Windows\System\bRHJBdq.exe
  2⤵
  PID:6580
- C:\Windows\System\bWOdkPO.exe
  C:\Windows\System\bWOdkPO.exe
  2⤵
  PID:4996
- C:\Windows\System\BUuJWCj.exe
  C:\Windows\System\BUuJWCj.exe
  2⤵
  PID:6840
- C:\Windows\System\OeTQQvk.exe
  C:\Windows\System\OeTQQvk.exe
  2⤵
  PID:6900
- C:\Windows\System\hfUAxme.exe
  C:\Windows\System\hfUAxme.exe
  2⤵
  PID:448
- C:\Windows\System\tmdILTJ.exe
  C:\Windows\System\tmdILTJ.exe
  2⤵
  PID:4036
- C:\Windows\System\MBYkBxc.exe
  C:\Windows\System\MBYkBxc.exe
  2⤵
  PID:2932
- C:\Windows\System\gJzfMOS.exe
  C:\Windows\System\gJzfMOS.exe
  2⤵
  PID:2284
- C:\Windows\System\MOjnUYv.exe
  C:\Windows\System\MOjnUYv.exe
  2⤵
  PID:4480
- C:\Windows\System\bmUawSJ.exe
  C:\Windows\System\bmUawSJ.exe
  2⤵
  PID:8232
- C:\Windows\System\jWFwBeY.exe
  C:\Windows\System\jWFwBeY.exe
  2⤵
  PID:8272
- C:\Windows\System\HuikvLe.exe
  C:\Windows\System\HuikvLe.exe
  2⤵
  PID:8368
- C:\Windows\System\Qdqvhzh.exe
  C:\Windows\System\Qdqvhzh.exe
  2⤵
  PID:8396
- C:\Windows\System\qstKDJO.exe
  C:\Windows\System\qstKDJO.exe
  2⤵
  PID:428
- C:\Windows\System\dHdATWd.exe
  C:\Windows\System\dHdATWd.exe
  2⤵
  PID:8448
- C:\Windows\System\mIOaUMq.exe
  C:\Windows\System\mIOaUMq.exe
  2⤵
  PID:8504
- C:\Windows\System\IMXNhkB.exe
  C:\Windows\System\IMXNhkB.exe
  2⤵
  PID:6584
- C:\Windows\System\rTePLXG.exe
  C:\Windows\System\rTePLXG.exe
  2⤵
  PID:8636
- C:\Windows\System\NBWdByX.exe
  C:\Windows\System\NBWdByX.exe
  2⤵
  PID:6744
- C:\Windows\System\iEaiPyb.exe
  C:\Windows\System\iEaiPyb.exe
  2⤵
  PID:6864
- C:\Windows\System\yJCIEhL.exe
  C:\Windows\System\yJCIEhL.exe
  2⤵
  PID:6912
- C:\Windows\System\OlhuQjh.exe
  C:\Windows\System\OlhuQjh.exe
  2⤵
  PID:7080
- C:\Windows\System\tBUobeW.exe
  C:\Windows\System\tBUobeW.exe
  2⤵
  PID:8744
- C:\Windows\System\QDhitjH.exe
  C:\Windows\System\QDhitjH.exe
  2⤵
  PID:8128
- C:\Windows\System\zsmmvQR.exe
  C:\Windows\System\zsmmvQR.exe
  2⤵
  PID:8164
- C:\Windows\System\BMweRQs.exe
  C:\Windows\System\BMweRQs.exe
  2⤵
  PID:9240
- C:\Windows\System\awkksux.exe
  C:\Windows\System\awkksux.exe
  2⤵
  PID:9260
- C:\Windows\System\fxWCMyf.exe
  C:\Windows\System\fxWCMyf.exe
  2⤵
  PID:9280
- C:\Windows\System\AwXpxla.exe
  C:\Windows\System\AwXpxla.exe
  2⤵
  PID:9296
- C:\Windows\System\WCCGAGV.exe
  C:\Windows\System\WCCGAGV.exe
  2⤵
  PID:9312
- C:\Windows\System\ymudpbe.exe
  C:\Windows\System\ymudpbe.exe
  2⤵
  PID:9340
- C:\Windows\System\slDGFPU.exe
  C:\Windows\System\slDGFPU.exe
  2⤵
  PID:9364
- C:\Windows\System\wpXTove.exe
  C:\Windows\System\wpXTove.exe
  2⤵
  PID:9392
- C:\Windows\System\eyEaZlf.exe
  C:\Windows\System\eyEaZlf.exe
  2⤵
  PID:9412
- C:\Windows\System\oDNHURe.exe
  C:\Windows\System\oDNHURe.exe
  2⤵
  PID:9432
- C:\Windows\System\vyGCost.exe
  C:\Windows\System\vyGCost.exe
  2⤵
  PID:9452
- C:\Windows\System\JSzNhWn.exe
  C:\Windows\System\JSzNhWn.exe
  2⤵
  PID:9472
- C:\Windows\System\nSYNduE.exe
  C:\Windows\System\nSYNduE.exe
  2⤵
  PID:9488
- C:\Windows\System\movDGsh.exe
  C:\Windows\System\movDGsh.exe
  2⤵
  PID:9504
- C:\Windows\System\xGceGfN.exe
  C:\Windows\System\xGceGfN.exe
  2⤵
  PID:9524
- C:\Windows\System\GeUjlei.exe
  C:\Windows\System\GeUjlei.exe
  2⤵
  PID:9544
- C:\Windows\System\GYCHhTi.exe
  C:\Windows\System\GYCHhTi.exe
  2⤵
  PID:9560
- C:\Windows\System\zJmxNNq.exe
  C:\Windows\System\zJmxNNq.exe
  2⤵
  PID:9580
- C:\Windows\System\FBsIRsj.exe
  C:\Windows\System\FBsIRsj.exe
  2⤵
  PID:9596
- C:\Windows\System\AirwiyR.exe
  C:\Windows\System\AirwiyR.exe
  2⤵
  PID:9612
- C:\Windows\System\gZtobMY.exe
  C:\Windows\System\gZtobMY.exe
  2⤵
  PID:9628
- C:\Windows\System\xKyBKKo.exe
  C:\Windows\System\xKyBKKo.exe
  2⤵
  PID:9648
- C:\Windows\System\rGpMpOJ.exe
  C:\Windows\System\rGpMpOJ.exe
  2⤵
  PID:9696
- C:\Windows\System\YWwNCIj.exe
  C:\Windows\System\YWwNCIj.exe
  2⤵
  PID:9720
- C:\Windows\System\NDQsCTb.exe
  C:\Windows\System\NDQsCTb.exe
  2⤵
  PID:9744
- C:\Windows\System\VvulXzP.exe
  C:\Windows\System\VvulXzP.exe
  2⤵
  PID:9772
- C:\Windows\System\aZkYqFh.exe
  C:\Windows\System\aZkYqFh.exe
  2⤵
  PID:9788
- C:\Windows\System\iPadseq.exe
  C:\Windows\System\iPadseq.exe
  2⤵
  PID:9808
- C:\Windows\System\upvxHUb.exe
  C:\Windows\System\upvxHUb.exe
  2⤵
  PID:9836
- C:\Windows\System\jMEfTGU.exe
  C:\Windows\System\jMEfTGU.exe
  2⤵
  PID:9860
- C:\Windows\System\TQTQksB.exe
  C:\Windows\System\TQTQksB.exe
  2⤵
  PID:9888
- C:\Windows\System\UWiTKOn.exe
  C:\Windows\System\UWiTKOn.exe
  2⤵
  PID:9904
- C:\Windows\System\tbUflIL.exe
  C:\Windows\System\tbUflIL.exe
  2⤵
  PID:9932
- C:\Windows\System\cxueZBi.exe
  C:\Windows\System\cxueZBi.exe
  2⤵
  PID:9952
- C:\Windows\System\cbQdcfF.exe
  C:\Windows\System\cbQdcfF.exe
  2⤵
  PID:9976
- C:\Windows\System\sGFJVsz.exe
  C:\Windows\System\sGFJVsz.exe
  2⤵
  PID:10000
- C:\Windows\System\CUQABfy.exe
  C:\Windows\System\CUQABfy.exe
  2⤵
  PID:10024
- C:\Windows\System\ExpKAQY.exe
  C:\Windows\System\ExpKAQY.exe
  2⤵
  PID:10040
- C:\Windows\System\XcZIBkl.exe
  C:\Windows\System\XcZIBkl.exe
  2⤵
  PID:10064
- C:\Windows\System\lRlHpCB.exe
  C:\Windows\System\lRlHpCB.exe
  2⤵
  PID:10088
- C:\Windows\System\ZRhDZKA.exe
  C:\Windows\System\ZRhDZKA.exe
  2⤵
  PID:10108
- C:\Windows\System\DhPLvFU.exe
  C:\Windows\System\DhPLvFU.exe
  2⤵
  PID:10128
- C:\Windows\System\akJmGeF.exe
  C:\Windows\System\akJmGeF.exe
  2⤵
  PID:10144
- C:\Windows\System\ofMlgdj.exe
  C:\Windows\System\ofMlgdj.exe
  2⤵
  PID:10160
- C:\Windows\System\BhqxBAE.exe
  C:\Windows\System\BhqxBAE.exe
  2⤵
  PID:10176
- C:\Windows\System\MKsSByB.exe
  C:\Windows\System\MKsSByB.exe
  2⤵
  PID:10192
- C:\Windows\System\TxoZQwj.exe
  C:\Windows\System\TxoZQwj.exe
  2⤵
  PID:10208
- C:\Windows\System\lEVLuXY.exe
  C:\Windows\System\lEVLuXY.exe
  2⤵
  PID:10232
- C:\Windows\System\BJNzIkb.exe
  C:\Windows\System\BJNzIkb.exe
  2⤵
  PID:6732
- C:\Windows\System\wtDmgSK.exe
  C:\Windows\System\wtDmgSK.exe
  2⤵
  PID:4912
- C:\Windows\System\XbXUFkQ.exe
  C:\Windows\System\XbXUFkQ.exe
  2⤵
  PID:6820
- C:\Windows\System\yUqFguH.exe
  C:\Windows\System\yUqFguH.exe
  2⤵
  PID:6432
- C:\Windows\System\xKXNAoG.exe
  C:\Windows\System\xKXNAoG.exe
  2⤵
  PID:636
- C:\Windows\System\iJIOPWv.exe
  C:\Windows\System\iJIOPWv.exe
  2⤵
  PID:1640
- C:\Windows\System\QzsHuog.exe
  C:\Windows\System\QzsHuog.exe
  2⤵
  PID:9000
- C:\Windows\System\wOtvBxL.exe
  C:\Windows\System\wOtvBxL.exe
  2⤵
  PID:8336
- C:\Windows\System\tEqtOpM.exe
  C:\Windows\System\tEqtOpM.exe
  2⤵
  PID:8496
- C:\Windows\System\ADOeGvp.exe
  C:\Windows\System\ADOeGvp.exe
  2⤵
  PID:9104
- C:\Windows\System\xQhjXQw.exe
  C:\Windows\System\xQhjXQw.exe
  2⤵
  PID:9140
- C:\Windows\System\refzLMQ.exe
  C:\Windows\System\refzLMQ.exe
  2⤵
  PID:8620
- C:\Windows\System\BVlUEGV.exe
  C:\Windows\System\BVlUEGV.exe
  2⤵
  PID:1720
- C:\Windows\System\KKzTybE.exe
  C:\Windows\System\KKzTybE.exe
  2⤵
  PID:4792
- C:\Windows\System\ibLoaOr.exe
  C:\Windows\System\ibLoaOr.exe
  2⤵
  PID:4648
- C:\Windows\System\lwrmtpr.exe
  C:\Windows\System\lwrmtpr.exe
  2⤵
  PID:4916
- C:\Windows\System\CZShSMl.exe
  C:\Windows\System\CZShSMl.exe
  2⤵
  PID:7184
- C:\Windows\System\BSatYom.exe
  C:\Windows\System\BSatYom.exe
  2⤵
  PID:9228
- C:\Windows\System\DtmpsuN.exe
  C:\Windows\System\DtmpsuN.exe
  2⤵
  PID:7788
- C:\Windows\System\onaogty.exe
  C:\Windows\System\onaogty.exe
  2⤵
  PID:7928
- C:\Windows\System\LcRWSYd.exe
  C:\Windows\System\LcRWSYd.exe
  2⤵
  PID:7680
- C:\Windows\System\ggswMbR.exe
  C:\Windows\System\ggswMbR.exe
  2⤵
  PID:7552
- C:\Windows\System\iFWgtPH.exe
  C:\Windows\System\iFWgtPH.exe
  2⤵
  PID:9332
- C:\Windows\System\IYPHPdY.exe
  C:\Windows\System\IYPHPdY.exe
  2⤵
  PID:9372
- C:\Windows\System\IIAZYPn.exe
  C:\Windows\System\IIAZYPn.exe
  2⤵
  PID:8328
- C:\Windows\System\qtbpdGo.exe
  C:\Windows\System\qtbpdGo.exe
  2⤵
  PID:9040
- C:\Windows\System\LTAxgXA.exe
  C:\Windows\System\LTAxgXA.exe
  2⤵
  PID:9160
- C:\Windows\System\WmnwcmU.exe
  C:\Windows\System\WmnwcmU.exe
  2⤵
  PID:9532
- C:\Windows\System\kNYLWoO.exe
  C:\Windows\System\kNYLWoO.exe
  2⤵
  PID:9556
- C:\Windows\System\dqipqDC.exe
  C:\Windows\System\dqipqDC.exe
  2⤵
  PID:8116
- C:\Windows\System\DYVrqwL.exe
  C:\Windows\System\DYVrqwL.exe
  2⤵
  PID:10256
- C:\Windows\System\DlqDoPs.exe
  C:\Windows\System\DlqDoPs.exe
  2⤵
  PID:10276
- C:\Windows\System\DEinBSg.exe
  C:\Windows\System\DEinBSg.exe
  2⤵
  PID:10300
- C:\Windows\System\KIGJrpA.exe
  C:\Windows\System\KIGJrpA.exe
  2⤵
  PID:10328
- C:\Windows\System\QbnWCWA.exe
  C:\Windows\System\QbnWCWA.exe
  2⤵
  PID:10344
- C:\Windows\System\LXNDWIp.exe
  C:\Windows\System\LXNDWIp.exe
  2⤵
  PID:10368
- C:\Windows\System\OYfEkYl.exe
  C:\Windows\System\OYfEkYl.exe
  2⤵
  PID:10388
- C:\Windows\System\WiScXlP.exe
  C:\Windows\System\WiScXlP.exe
  2⤵
  PID:10412
- C:\Windows\System\PkkeVNi.exe
  C:\Windows\System\PkkeVNi.exe
  2⤵
  PID:10428
- C:\Windows\System\tQYsdZw.exe
  C:\Windows\System\tQYsdZw.exe
  2⤵
  PID:10452
- C:\Windows\System\raRLGMr.exe
  C:\Windows\System\raRLGMr.exe
  2⤵
  PID:10480
- C:\Windows\System\EnjqFaC.exe
  C:\Windows\System\EnjqFaC.exe
  2⤵
  PID:10524
- C:\Windows\System\hnkyLLc.exe
  C:\Windows\System\hnkyLLc.exe
  2⤵
  PID:10548
- C:\Windows\System\lAvTHPP.exe
  C:\Windows\System\lAvTHPP.exe
  2⤵
  PID:10564
- C:\Windows\System\bsoVTTu.exe
  C:\Windows\System\bsoVTTu.exe
  2⤵
  PID:10588
- C:\Windows\System\eZxViAv.exe
  C:\Windows\System\eZxViAv.exe
  2⤵
  PID:10608
- C:\Windows\System\QeKqqhO.exe
  C:\Windows\System\QeKqqhO.exe
  2⤵
  PID:10628
- C:\Windows\System\eXLCtxH.exe
  C:\Windows\System\eXLCtxH.exe
  2⤵
  PID:10652
- C:\Windows\System\kXxtGdx.exe
  C:\Windows\System\kXxtGdx.exe
  2⤵
  PID:10672
- C:\Windows\System\kPKpIYC.exe
  C:\Windows\System\kPKpIYC.exe
  2⤵
  PID:10696
- C:\Windows\System\TwzDQVA.exe
  C:\Windows\System\TwzDQVA.exe
  2⤵
  PID:10720
- C:\Windows\System\tjytZXC.exe
  C:\Windows\System\tjytZXC.exe
  2⤵
  PID:10736
- C:\Windows\System\CObkIIj.exe
  C:\Windows\System\CObkIIj.exe
  2⤵
  PID:10752
- C:\Windows\System\yFJmBUx.exe
  C:\Windows\System\yFJmBUx.exe
  2⤵
  PID:10776
- C:\Windows\System\uHHIIMC.exe
  C:\Windows\System\uHHIIMC.exe
  2⤵
  PID:10800
- C:\Windows\System\WDPEuhL.exe
  C:\Windows\System\WDPEuhL.exe
  2⤵
  PID:10816
- C:\Windows\System\clZrxAy.exe
  C:\Windows\System\clZrxAy.exe
  2⤵
  PID:10836
- C:\Windows\System\MxVJOgX.exe
  C:\Windows\System\MxVJOgX.exe
  2⤵
  PID:10860
- C:\Windows\System\HWgtrpG.exe
  C:\Windows\System\HWgtrpG.exe
  2⤵
  PID:10880
- C:\Windows\System\HsPridt.exe
  C:\Windows\System\HsPridt.exe
  2⤵
  PID:10900
- C:\Windows\System\PbIdROd.exe
  C:\Windows\System\PbIdROd.exe
  2⤵
  PID:10916
- C:\Windows\System\xAanxmH.exe
  C:\Windows\System\xAanxmH.exe
  2⤵
  PID:10944
- C:\Windows\System\hNOWpra.exe
  C:\Windows\System\hNOWpra.exe
  2⤵
  PID:10960
- C:\Windows\System\mdQMmSr.exe
  C:\Windows\System\mdQMmSr.exe
  2⤵
  PID:10984
- C:\Windows\System\kpNibkR.exe
  C:\Windows\System\kpNibkR.exe
  2⤵
  PID:11012
- C:\Windows\System\sEIjFuD.exe
  C:\Windows\System\sEIjFuD.exe
  2⤵
  PID:11036
- C:\Windows\System\AdyBtfF.exe
  C:\Windows\System\AdyBtfF.exe
  2⤵
  PID:11052
- C:\Windows\System\qDIgxkW.exe
  C:\Windows\System\qDIgxkW.exe
  2⤵
  PID:11068
- C:\Windows\System\yHVsHLZ.exe
  C:\Windows\System\yHVsHLZ.exe
  2⤵
  PID:11088
- C:\Windows\System\nvFdicE.exe
  C:\Windows\System\nvFdicE.exe
  2⤵
  PID:11104
- C:\Windows\System\BJmrSjw.exe
  C:\Windows\System\BJmrSjw.exe
  2⤵
  PID:11124
- C:\Windows\System\vLOovbP.exe
  C:\Windows\System\vLOovbP.exe
  2⤵
  PID:11148
- C:\Windows\System\TmMsXNO.exe
  C:\Windows\System\TmMsXNO.exe
  2⤵
  PID:11172
- C:\Windows\System\xNfPQUa.exe
  C:\Windows\System\xNfPQUa.exe
  2⤵
  PID:11196
- C:\Windows\System\Kxaualp.exe
  C:\Windows\System\Kxaualp.exe
  2⤵
  PID:11212
- C:\Windows\System\BHKEqjx.exe
  C:\Windows\System\BHKEqjx.exe
  2⤵
  PID:11232
- C:\Windows\System\jUNOTNy.exe
  C:\Windows\System\jUNOTNy.exe
  2⤵
  PID:11252
- C:\Windows\System\XPPUlSX.exe
  C:\Windows\System\XPPUlSX.exe
  2⤵
  PID:8712
- C:\Windows\System\SqyyUdm.exe
  C:\Windows\System\SqyyUdm.exe
  2⤵
  PID:1364
- C:\Windows\System\WecJkDL.exe
  C:\Windows\System\WecJkDL.exe
  2⤵
  PID:8796
- C:\Windows\System\nmqnNqy.exe
  C:\Windows\System\nmqnNqy.exe
  2⤵
  PID:8480
- C:\Windows\System\zToWpPR.exe
  C:\Windows\System\zToWpPR.exe
  2⤵
  PID:8600
- C:\Windows\System\tyfjAhc.exe
  C:\Windows\System\tyfjAhc.exe
  2⤵
  PID:9912
- C:\Windows\System\lTkeJor.exe
  C:\Windows\System\lTkeJor.exe
  2⤵
  PID:7408
- C:\Windows\System\Ewcmmff.exe
  C:\Windows\System\Ewcmmff.exe
  2⤵
  PID:9984
- C:\Windows\System\yzdlOih.exe
  C:\Windows\System\yzdlOih.exe
  2⤵
  PID:8112
- C:\Windows\System\HoCqrEw.exe
  C:\Windows\System\HoCqrEw.exe
  2⤵
  PID:10036
- C:\Windows\System\HKXKjIg.exe
  C:\Windows\System\HKXKjIg.exe
  2⤵
  PID:10156
- C:\Windows\System\sCZmhNr.exe
  C:\Windows\System\sCZmhNr.exe
  2⤵
  PID:8856
- C:\Windows\System\SqQnUjs.exe
  C:\Windows\System\SqQnUjs.exe
  2⤵
  PID:8904
- C:\Windows\System\BgwhLwD.exe
  C:\Windows\System\BgwhLwD.exe
  2⤵
  PID:8920
- C:\Windows\System\jfdJNQW.exe
  C:\Windows\System\jfdJNQW.exe
  2⤵
  PID:4368
- C:\Windows\System\oaYlUrK.exe
  C:\Windows\System\oaYlUrK.exe
  2⤵
  PID:8984
- C:\Windows\System\lZDkecz.exe
  C:\Windows\System\lZDkecz.exe
  2⤵
  PID:9408
- C:\Windows\System\NwfEMFv.exe
  C:\Windows\System\NwfEMFv.exe
  2⤵
  PID:8100
- C:\Windows\System\zodYdkE.exe
  C:\Windows\System\zodYdkE.exe
  2⤵
  PID:8676
- C:\Windows\System\tEtNUkb.exe
  C:\Windows\System\tEtNUkb.exe
  2⤵
  PID:7856
- C:\Windows\System\XtCsXBP.exe
  C:\Windows\System\XtCsXBP.exe
  2⤵
  PID:7616
- C:\Windows\System\cJBSqDq.exe
  C:\Windows\System\cJBSqDq.exe
  2⤵
  PID:11288
- C:\Windows\System\HNgUBaq.exe
  C:\Windows\System\HNgUBaq.exe
  2⤵
  PID:11308
- C:\Windows\System\zaxrDCV.exe
  C:\Windows\System\zaxrDCV.exe
  2⤵
  PID:11352
- C:\Windows\System\ojcErTv.exe
  C:\Windows\System\ojcErTv.exe
  2⤵
  PID:11380
- C:\Windows\System\mhQcPpG.exe
  C:\Windows\System\mhQcPpG.exe
  2⤵
  PID:11404
- C:\Windows\System\KoQDBzT.exe
  C:\Windows\System\KoQDBzT.exe
  2⤵
  PID:11424
- C:\Windows\System\WasjBoE.exe
  C:\Windows\System\WasjBoE.exe
  2⤵
  PID:11448
- C:\Windows\System\BxjbTKc.exe
  C:\Windows\System\BxjbTKc.exe
  2⤵
  PID:11476
- C:\Windows\System\iCamgLv.exe
  C:\Windows\System\iCamgLv.exe
  2⤵
  PID:11496
- C:\Windows\System\FHVatjA.exe
  C:\Windows\System\FHVatjA.exe
  2⤵
  PID:11520
- C:\Windows\System\vGWkHrT.exe
  C:\Windows\System\vGWkHrT.exe
  2⤵
  PID:11540
- C:\Windows\System\yiJcEZB.exe
  C:\Windows\System\yiJcEZB.exe
  2⤵
  PID:11556
- C:\Windows\System\UeUfFyW.exe
  C:\Windows\System\UeUfFyW.exe
  2⤵
  PID:11576
- C:\Windows\System\TuoVRtE.exe
  C:\Windows\System\TuoVRtE.exe
  2⤵
  PID:11592
- C:\Windows\System\chgBhkm.exe
  C:\Windows\System\chgBhkm.exe
  2⤵
  PID:11612
- C:\Windows\System\ADuMwPM.exe
  C:\Windows\System\ADuMwPM.exe
  2⤵
  PID:11640
- C:\Windows\System\ohDrTpy.exe
  C:\Windows\System\ohDrTpy.exe
  2⤵
  PID:12104
- C:\Windows\System\uBdHohd.exe
  C:\Windows\System\uBdHohd.exe
  2⤵
  PID:12128
- C:\Windows\System\qcKUQqG.exe
  C:\Windows\System\qcKUQqG.exe
  2⤵
  PID:12156
- C:\Windows\System\NWezpGj.exe
  C:\Windows\System\NWezpGj.exe
  2⤵
  PID:12180
- C:\Windows\System\RhxAwyu.exe
  C:\Windows\System\RhxAwyu.exe
  2⤵
  PID:12200
- C:\Windows\System\DIYQhMa.exe
  C:\Windows\System\DIYQhMa.exe
  2⤵
  PID:12220
- C:\Windows\System\MlUlEtY.exe
  C:\Windows\System\MlUlEtY.exe
  2⤵
  PID:12236
- C:\Windows\System\UDqvhMt.exe
  C:\Windows\System\UDqvhMt.exe
  2⤵
  PID:12260
- C:\Windows\System\JSpjLRv.exe
  C:\Windows\System\JSpjLRv.exe
  2⤵
  PID:12280
- C:\Windows\System\PRADzlv.exe
  C:\Windows\System\PRADzlv.exe
  2⤵
  PID:8312
- C:\Windows\System\RrCkaZx.exe
  C:\Windows\System\RrCkaZx.exe
  2⤵
  PID:9144
- C:\Windows\System\QHKcIAw.exe
  C:\Windows\System\QHKcIAw.exe
  2⤵
  PID:9424
- C:\Windows\System\OjcanqT.exe
  C:\Windows\System\OjcanqT.exe
  2⤵
  PID:9608
- C:\Windows\System\WNSDHaM.exe
  C:\Windows\System\WNSDHaM.exe
  2⤵
  PID:10284
- C:\Windows\System\wayjGzw.exe
  C:\Windows\System\wayjGzw.exe
  2⤵
  PID:10324
- C:\Windows\System\jtyAfWB.exe
  C:\Windows\System\jtyAfWB.exe
  2⤵
  PID:8276
- C:\Windows\System\bTDTdVv.exe
  C:\Windows\System\bTDTdVv.exe
  2⤵
  PID:8372
- C:\Windows\System\XPweiZt.exe
  C:\Windows\System\XPweiZt.exe
  2⤵
  PID:4172
- C:\Windows\System\nCYvuWZ.exe
  C:\Windows\System\nCYvuWZ.exe
  2⤵
  PID:9824
- C:\Windows\System\FOVKEtS.exe
  C:\Windows\System\FOVKEtS.exe
  2⤵
  PID:10680
- C:\Windows\System\heUTyka.exe
  C:\Windows\System\heUTyka.exe
  2⤵
  PID:10716
- C:\Windows\System\yTUcSNR.exe
  C:\Windows\System\yTUcSNR.exe
  2⤵
  PID:10076
- C:\Windows\System\nQwtIEg.exe
  C:\Windows\System\nQwtIEg.exe
  2⤵
  PID:9304
- C:\Windows\System\WdozaOl.exe
  C:\Windows\System\WdozaOl.exe
  2⤵
  PID:9324
- C:\Windows\System\Tbpvgcu.exe
  C:\Windows\System\Tbpvgcu.exe
  2⤵
  PID:8220
- C:\Windows\System\nOAuIou.exe
  C:\Windows\System\nOAuIou.exe
  2⤵
  PID:9428
- C:\Windows\System\xNNQqFm.exe
  C:\Windows\System\xNNQqFm.exe
  2⤵
  PID:8616
- C:\Windows\System\qlaqmoZ.exe
  C:\Windows\System\qlaqmoZ.exe
  2⤵
  PID:8252
- C:\Windows\System\acFzvEK.exe
  C:\Windows\System\acFzvEK.exe
  2⤵
  PID:11492
- C:\Windows\System\vrGQYBC.exe
  C:\Windows\System\vrGQYBC.exe
  2⤵
  PID:11536
- C:\Windows\System\CcFeQjQ.exe
  C:\Windows\System\CcFeQjQ.exe
  2⤵
  PID:11624
- C:\Windows\System\Qvlfrfq.exe
  C:\Windows\System\Qvlfrfq.exe
  2⤵
  PID:10436
- C:\Windows\System\AfHWyKP.exe
  C:\Windows\System\AfHWyKP.exe
  2⤵
  PID:9736
- C:\Windows\System\jvwUFxk.exe
  C:\Windows\System\jvwUFxk.exe
  2⤵
  PID:9784
- C:\Windows\System\LboKqnw.exe
  C:\Windows\System\LboKqnw.exe
  2⤵
  PID:10420
- C:\Windows\System\KioncYs.exe
  C:\Windows\System\KioncYs.exe
  2⤵
  PID:10580
- C:\Windows\System\vtGgtKz.exe
  C:\Windows\System\vtGgtKz.exe
  2⤵
  PID:9440
- C:\Windows\System\VWjMUEX.exe
  C:\Windows\System\VWjMUEX.exe
  2⤵
  PID:11300
- C:\Windows\System\xAdcukj.exe
  C:\Windows\System\xAdcukj.exe
  2⤵
  PID:10096
- C:\Windows\System\eyOJdZK.exe
  C:\Windows\System\eyOJdZK.exe
  2⤵
  PID:10140
- C:\Windows\System\jlfDYsm.exe
  C:\Windows\System\jlfDYsm.exe
  2⤵
  PID:852
- C:\Windows\System\SRFgONU.exe
  C:\Windows\System\SRFgONU.exe
  2⤵
  PID:8560
- C:\Windows\System\ryQKAGh.exe
  C:\Windows\System\ryQKAGh.exe
  2⤵
  PID:10356
- C:\Windows\System\qgeBUrt.exe
  C:\Windows\System\qgeBUrt.exe
  2⤵
  PID:1680
- C:\Windows\System\tUUsmzJ.exe
  C:\Windows\System\tUUsmzJ.exe
  2⤵
  PID:10584
- C:\Windows\System\CkjfCHO.exe
  C:\Windows\System\CkjfCHO.exe
  2⤵
  PID:12140
- C:\Windows\System\LJiYtwN.exe
  C:\Windows\System\LJiYtwN.exe
  2⤵
  PID:12308
- C:\Windows\System\oWOXbyV.exe
  C:\Windows\System\oWOXbyV.exe
  2⤵
  PID:12344
- C:\Windows\System\ZDBXmiQ.exe
  C:\Windows\System\ZDBXmiQ.exe
  2⤵
  PID:12364
- C:\Windows\System\pbJWnun.exe
  C:\Windows\System\pbJWnun.exe
  2⤵
  PID:12384
- C:\Windows\System\DmwNnsm.exe
  C:\Windows\System\DmwNnsm.exe
  2⤵
  PID:12412
- C:\Windows\System\HxsNzTC.exe
  C:\Windows\System\HxsNzTC.exe
  2⤵
  PID:12428
- C:\Windows\System\ThwOKar.exe
  C:\Windows\System\ThwOKar.exe
  2⤵
  PID:12444
- C:\Windows\System\KjoNCFI.exe
  C:\Windows\System\KjoNCFI.exe
  2⤵
  PID:12460
- C:\Windows\System\CfVhQiI.exe
  C:\Windows\System\CfVhQiI.exe
  2⤵
  PID:12480
- C:\Windows\System\JfAgWWk.exe
  C:\Windows\System\JfAgWWk.exe
  2⤵
  PID:12496
- C:\Windows\System\gCmjXeu.exe
  C:\Windows\System\gCmjXeu.exe
  2⤵
  PID:12512
- C:\Windows\System\LVSTOmZ.exe
  C:\Windows\System\LVSTOmZ.exe
  2⤵
  PID:12528
- C:\Windows\System\WvYANrB.exe
  C:\Windows\System\WvYANrB.exe
  2⤵
  PID:12544
- C:\Windows\System\IZXedAn.exe
  C:\Windows\System\IZXedAn.exe
  2⤵
  PID:12560
- C:\Windows\System\wZXEtUr.exe
  C:\Windows\System\wZXEtUr.exe
  2⤵
  PID:12576
- C:\Windows\System\nBZQVho.exe
  C:\Windows\System\nBZQVho.exe
  2⤵
  PID:12592
- C:\Windows\System\lvdXoOM.exe
  C:\Windows\System\lvdXoOM.exe
  2⤵
  PID:12612
- C:\Windows\System\mKOTwng.exe
  C:\Windows\System\mKOTwng.exe
  2⤵
  PID:12628
- C:\Windows\System\RCCdpcJ.exe
  C:\Windows\System\RCCdpcJ.exe
  2⤵
  PID:12644
- C:\Windows\System\doeSCps.exe
  C:\Windows\System\doeSCps.exe
  2⤵
  PID:12660
- C:\Windows\System\mEVkBgn.exe
  C:\Windows\System\mEVkBgn.exe
  2⤵
  PID:12676
- C:\Windows\System\tsOOUjV.exe
  C:\Windows\System\tsOOUjV.exe
  2⤵
  PID:12692
- C:\Windows\System\iKHHqgE.exe
  C:\Windows\System\iKHHqgE.exe
  2⤵
  PID:12708
- C:\Windows\System\LnLVsHM.exe
  C:\Windows\System\LnLVsHM.exe
  2⤵
  PID:12724
- C:\Windows\System\SyZMmwn.exe
  C:\Windows\System\SyZMmwn.exe
  2⤵
  PID:12740
- C:\Windows\System\XUIceoY.exe
  C:\Windows\System\XUIceoY.exe
  2⤵
  PID:12756
- C:\Windows\System\MCBJatI.exe
  C:\Windows\System\MCBJatI.exe
  2⤵
  PID:12776
- C:\Windows\System\pzfwHrW.exe
  C:\Windows\System\pzfwHrW.exe
  2⤵
  PID:12796
- C:\Windows\System\SGULchG.exe
  C:\Windows\System\SGULchG.exe
  2⤵
  PID:12812
- C:\Windows\System\EuYsmFV.exe
  C:\Windows\System\EuYsmFV.exe
  2⤵
  PID:12832
- C:\Windows\System\TPpumKW.exe
  C:\Windows\System\TPpumKW.exe
  2⤵
  PID:12852
- C:\Windows\System\QLsrlKL.exe
  C:\Windows\System\QLsrlKL.exe
  2⤵
  PID:12876
- C:\Windows\System\WritHZa.exe
  C:\Windows\System\WritHZa.exe
  2⤵
  PID:12892
- C:\Windows\System\ikAMSDS.exe
  C:\Windows\System\ikAMSDS.exe
  2⤵
  PID:12916
- C:\Windows\System\aWynQRl.exe
  C:\Windows\System\aWynQRl.exe
  2⤵
  PID:12932
- C:\Windows\System\VAXJSAc.exe
  C:\Windows\System\VAXJSAc.exe
  2⤵
  PID:12960
- C:\Windows\System\XrOxWKg.exe
  C:\Windows\System\XrOxWKg.exe
  2⤵
  PID:12984
- C:\Windows\System\hKyFdhc.exe
  C:\Windows\System\hKyFdhc.exe
  2⤵
  PID:13012
- C:\Windows\System\RtWOcZn.exe
  C:\Windows\System\RtWOcZn.exe
  2⤵
  PID:13032
- C:\Windows\System\fFytSct.exe
  C:\Windows\System\fFytSct.exe
  2⤵
  PID:13056
- C:\Windows\System\EfnDEOD.exe
  C:\Windows\System\EfnDEOD.exe
  2⤵
  PID:13080
- C:\Windows\System\yrkgyFV.exe
  C:\Windows\System\yrkgyFV.exe
  2⤵
  PID:13104
- C:\Windows\System\NBmBlqL.exe
  C:\Windows\System\NBmBlqL.exe
  2⤵
  PID:13136
- C:\Windows\System\PpHClsP.exe
  C:\Windows\System\PpHClsP.exe
  2⤵
  PID:13152
- C:\Windows\System\dQNdSao.exe
  C:\Windows\System\dQNdSao.exe
  2⤵
  PID:13176
- C:\Windows\System\WIjeLZc.exe
  C:\Windows\System\WIjeLZc.exe
  2⤵
  PID:13200
- C:\Windows\System\VoskIVp.exe
  C:\Windows\System\VoskIVp.exe
  2⤵
  PID:13224
- C:\Windows\System\qHnipHm.exe
  C:\Windows\System\qHnipHm.exe
  2⤵
  PID:13248
- C:\Windows\System\JClCfmx.exe
  C:\Windows\System\JClCfmx.exe
  2⤵
  PID:13272
- C:\Windows\System\INoLLbO.exe
  C:\Windows\System\INoLLbO.exe
  2⤵
  PID:13296
- C:\Windows\System\vVwagbm.exe
  C:\Windows\System\vVwagbm.exe
  2⤵
  PID:12244
- C:\Windows\System\rgKNpJJ.exe
  C:\Windows\System\rgKNpJJ.exe
  2⤵
  PID:11548
- C:\Windows\System\qAvBAHe.exe
  C:\Windows\System\qAvBAHe.exe
  2⤵
  PID:11440
- C:\Windows\System\zqJzhws.exe
  C:\Windows\System\zqJzhws.exe
  2⤵
  PID:9520
- C:\Windows\System\ylmRtIU.exe
  C:\Windows\System\ylmRtIU.exe
  2⤵
  PID:8196
- C:\Windows\System\bRvairQ.exe
  C:\Windows\System\bRvairQ.exe
  2⤵
  PID:6528
- C:\Windows\System\PvrMBHD.exe
  C:\Windows\System\PvrMBHD.exe
  2⤵
  PID:9276
- C:\Windows\System\twsKywW.exe
  C:\Windows\System\twsKywW.exe
  2⤵
  PID:10084
- C:\Windows\System\vnwGpLl.exe
  C:\Windows\System\vnwGpLl.exe
  2⤵
  PID:11528
- C:\Windows\System\XDncBIb.exe
  C:\Windows\System\XDncBIb.exe
  2⤵
  PID:9236
- C:\Windows\System\hQcLkGt.exe
  C:\Windows\System\hQcLkGt.exe
  2⤵
  PID:10204
- C:\Windows\System\QTIbNqO.exe
  C:\Windows\System\QTIbNqO.exe
  2⤵
  PID:10832
- C:\Windows\System\diOwGdR.exe
  C:\Windows\System\diOwGdR.exe
  2⤵
  PID:10936
- C:\Windows\System\QsBLZVe.exe
  C:\Windows\System\QsBLZVe.exe
  2⤵
  PID:11024
- C:\Windows\System\TfoFSLc.exe
  C:\Windows\System\TfoFSLc.exe
  2⤵
  PID:11080
- C:\Windows\System\cUGthPl.exe
  C:\Windows\System\cUGthPl.exe
  2⤵
  PID:11144
- C:\Windows\System\HukGIom.exe
  C:\Windows\System\HukGIom.exe
  2⤵
  PID:13316
- C:\Windows\System\XCJGVsE.exe
  C:\Windows\System\XCJGVsE.exe
  2⤵
  PID:13340
- C:\Windows\System\zleDAKq.exe
  C:\Windows\System\zleDAKq.exe
  2⤵
  PID:13364
- C:\Windows\System\LnqxlGy.exe
  C:\Windows\System\LnqxlGy.exe
  2⤵
  PID:13388
- C:\Windows\System\IcgzmrH.exe
  C:\Windows\System\IcgzmrH.exe
  2⤵
  PID:13416
- C:\Windows\System\tkQXhID.exe
  C:\Windows\System\tkQXhID.exe
  2⤵
  PID:13436
- C:\Windows\System\AoRsRvw.exe
  C:\Windows\System\AoRsRvw.exe
  2⤵
  PID:13460
- C:\Windows\System\dHlHLfe.exe
  C:\Windows\System\dHlHLfe.exe
  2⤵
  PID:13484
- C:\Windows\System\TjUqizh.exe
  C:\Windows\System\TjUqizh.exe
  2⤵
  PID:13500
- C:\Windows\System\NMMivjb.exe
  C:\Windows\System\NMMivjb.exe
  2⤵
  PID:13524
- C:\Windows\System\MSTPYki.exe
  C:\Windows\System\MSTPYki.exe
  2⤵
  PID:13548
- C:\Windows\System\GnDcRiS.exe
  C:\Windows\System\GnDcRiS.exe
  2⤵
  PID:13572
- C:\Windows\System\LzqVpHb.exe
  C:\Windows\System\LzqVpHb.exe
  2⤵
  PID:13596
- C:\Windows\System\OmrmDCR.exe
  C:\Windows\System\OmrmDCR.exe
  2⤵
  PID:13620
- C:\Windows\System\vesuBWh.exe
  C:\Windows\System\vesuBWh.exe
  2⤵
  PID:13648
- C:\Windows\System\gLqNmQj.exe
  C:\Windows\System\gLqNmQj.exe
  2⤵
  PID:13664
- C:\Windows\System\jtSZPmg.exe
  C:\Windows\System\jtSZPmg.exe
  2⤵
  PID:13684
- C:\Windows\System\dvpTjgD.exe
  C:\Windows\System\dvpTjgD.exe
  2⤵
  PID:13700
- C:\Windows\System\UTFHvSf.exe
  C:\Windows\System\UTFHvSf.exe
  2⤵
  PID:13716
- C:\Windows\System\DeEXGvj.exe
  C:\Windows\System\DeEXGvj.exe
  2⤵
  PID:13732
- C:\Windows\System\rFNGoac.exe
  C:\Windows\System\rFNGoac.exe
  2⤵
  PID:13748
- C:\Windows\System\lKdZhsP.exe
  C:\Windows\System\lKdZhsP.exe
  2⤵
  PID:13764
- C:\Windows\System\NUsJnhx.exe
  C:\Windows\System\NUsJnhx.exe
  2⤵
  PID:13780
- C:\Windows\System\iQuBMpN.exe
  C:\Windows\System\iQuBMpN.exe
  2⤵
  PID:13800
- C:\Windows\System\wCrKxLG.exe
  C:\Windows\System\wCrKxLG.exe
  2⤵
  PID:13816
- C:\Windows\System\oZsrasw.exe
  C:\Windows\System\oZsrasw.exe
  2⤵
  PID:13836
- C:\Windows\System\qobmLpV.exe
  C:\Windows\System\qobmLpV.exe
  2⤵
  PID:13852
- C:\Windows\System\UeFxnVD.exe
  C:\Windows\System\UeFxnVD.exe
  2⤵
  PID:13868
- C:\Windows\System\Cunaerz.exe
  C:\Windows\System\Cunaerz.exe
  2⤵
  PID:13884
- C:\Windows\System\arfagXg.exe
  C:\Windows\System\arfagXg.exe
  2⤵
  PID:13900
- C:\Windows\System\cxwITVF.exe
  C:\Windows\System\cxwITVF.exe
  2⤵
  PID:13924
- C:\Windows\System\rCbkChd.exe
  C:\Windows\System\rCbkChd.exe
  2⤵
  PID:13948
- C:\Windows\System\npHxedb.exe
  C:\Windows\System\npHxedb.exe
  2⤵
  PID:13968
- C:\Windows\System\oNMRxKn.exe
  C:\Windows\System\oNMRxKn.exe
  2⤵
  PID:13992
- C:\Windows\System\OcEbUTl.exe
  C:\Windows\System\OcEbUTl.exe
  2⤵
  PID:14016
- C:\Windows\System\GKhJNbG.exe
  C:\Windows\System\GKhJNbG.exe
  2⤵
  PID:14040
- C:\Windows\System\XmMZSOC.exe
  C:\Windows\System\XmMZSOC.exe
  2⤵
  PID:14072
- C:\Windows\System\YepMXff.exe
  C:\Windows\System\YepMXff.exe
  2⤵
  PID:14092
- C:\Windows\System\OrfHHyh.exe
  C:\Windows\System\OrfHHyh.exe
  2⤵
  PID:14116
- C:\Windows\System\BIZLIQQ.exe
  C:\Windows\System\BIZLIQQ.exe
  2⤵
  PID:14136
- C:\Windows\System\prxcdPJ.exe
  C:\Windows\System\prxcdPJ.exe
  2⤵
  PID:14164
- C:\Windows\System\IolrNms.exe
  C:\Windows\System\IolrNms.exe
  2⤵
  PID:14188
- C:\Windows\System\prZdjbs.exe
  C:\Windows\System\prZdjbs.exe
  2⤵
  PID:14212
- C:\Windows\System\XXSgHgW.exe
  C:\Windows\System\XXSgHgW.exe
  2⤵
  PID:14240
- C:\Windows\System\oHSlFup.exe
  C:\Windows\System\oHSlFup.exe
  2⤵
  PID:14260
- C:\Windows\System\lZYILup.exe
  C:\Windows\System\lZYILup.exe
  2⤵
  PID:14284
- C:\Windows\System\mtPgkcX.exe
  C:\Windows\System\mtPgkcX.exe
  2⤵
  PID:14312
- C:\Windows\System\HqeXfIf.exe
  C:\Windows\System\HqeXfIf.exe
  2⤵
  PID:14332
- C:\Windows\System\cokcJdJ.exe
  C:\Windows\System\cokcJdJ.exe
  2⤵
  PID:11228
- C:\Windows\System\vxKaYkq.exe
  C:\Windows\System\vxKaYkq.exe
  2⤵
  PID:6860
- C:\Windows\System\oQDgzEq.exe
  C:\Windows\System\oQDgzEq.exe
  2⤵
  PID:8160
- C:\Windows\System\RvEJRTk.exe
  C:\Windows\System\RvEJRTk.exe
  2⤵
  PID:8884
- C:\Windows\System\dPeWiaH.exe
  C:\Windows\System\dPeWiaH.exe
  2⤵
  PID:9092
- C:\Windows\System\vKTUVsC.exe
  C:\Windows\System\vKTUVsC.exe
  2⤵
  PID:9484
- C:\Windows\System\CDjCEQc.exe
  C:\Windows\System\CDjCEQc.exe
  2⤵
  PID:11372
- C:\Windows\System\mjFxIjp.exe
  C:\Windows\System\mjFxIjp.exe
  2⤵
  PID:10200
- C:\Windows\System\lnSWTKe.exe
  C:\Windows\System\lnSWTKe.exe
  2⤵
  PID:11064
- C:\Windows\System\icXYTsv.exe
  C:\Windows\System\icXYTsv.exe
  2⤵
  PID:12940
- C:\Windows\System\jIMIkPq.exe
  C:\Windows\System\jIMIkPq.exe
  2⤵
  PID:9052
- C:\Windows\System\hVJkUdH.exe
  C:\Windows\System\hVJkUdH.exe
  2⤵
  PID:13220
- C:\Windows\System\CHPUzHl.exe
  C:\Windows\System\CHPUzHl.exe
  2⤵
  PID:3496
- C:\Windows\System\QwdtgFq.exe
  C:\Windows\System\QwdtgFq.exe
  2⤵
  PID:11140
- C:\Windows\System\PnZBxxD.exe
  C:\Windows\System\PnZBxxD.exe
  2⤵
  PID:12604
- C:\Windows\System\UjkCXYw.exe
  C:\Windows\System\UjkCXYw.exe
  2⤵
  PID:9496
- C:\Windows\System\QPlcosC.exe
  C:\Windows\System\QPlcosC.exe
  2⤵
  PID:12492
- C:\Windows\System\VZWEgyx.exe
  C:\Windows\System\VZWEgyx.exe
  2⤵
  PID:12588
- C:\Windows\System\sbaHbKK.exe
  C:\Windows\System\sbaHbKK.exe
  2⤵
  PID:12400
- C:\Windows\System\crHNPZw.exe
  C:\Windows\System\crHNPZw.exe
  2⤵
  PID:12468
- C:\Windows\System\YrvHIsE.exe
  C:\Windows\System\YrvHIsE.exe
  2⤵
  PID:1356
- C:\Windows\System\WTHDSiJ.exe
  C:\Windows\System\WTHDSiJ.exe
  2⤵
  PID:11004
- C:\Windows\System\hMSVgXM.exe
  C:\Windows\System\hMSVgXM.exe
  2⤵
  PID:4720
- C:\Windows\System\cpMskol.exe
  C:\Windows\System\cpMskol.exe
  2⤵
  PID:6392
- C:\Windows\System\rBBkJXo.exe
  C:\Windows\System\rBBkJXo.exe
  2⤵
  PID:4596
- C:\Windows\System\qRaAyhe.exe
  C:\Windows\System\qRaAyhe.exe
  2⤵
  PID:10056
- C:\Windows\System\ZWLWLKs.exe
  C:\Windows\System\ZWLWLKs.exe
  2⤵
  PID:12096
- C:\Windows\System\LWkNYlV.exe
  C:\Windows\System\LWkNYlV.exe
  2⤵
  PID:2176
- C:\Windows\System\qUUBUmn.exe
  C:\Windows\System\qUUBUmn.exe
  2⤵
  PID:3140
- C:\Windows\System\iyLgBlB.exe
  C:\Windows\System\iyLgBlB.exe
  2⤵
  PID:9988
- C:\Windows\System\jtBDpdy.exe
  C:\Windows\System\jtBDpdy.exe
  2⤵
  PID:14252
- C:\Windows\System\eGFvyBH.exe
  C:\Windows\System\eGFvyBH.exe
  2⤵
  PID:13372
- C:\Windows\System\rMxrrbB.exe
  C:\Windows\System\rMxrrbB.exe
  2⤵
  PID:10460
- C:\Windows\System\hprVPco.exe
  C:\Windows\System\hprVPco.exe
  2⤵
  PID:700
- C:\Windows\System\eSzkeEU.exe
  C:\Windows\System\eSzkeEU.exe
  2⤵
  PID:9376
- C:\Windows\System\adrufvo.exe
  C:\Windows\System\adrufvo.exe
  2⤵
  PID:12736
- C:\Windows\System\MwxMlgp.exe
  C:\Windows\System\MwxMlgp.exe
  2⤵
  PID:12556
- C:\Windows\System\YNDgart.exe
  C:\Windows\System\YNDgart.exe
  2⤵
  PID:4808
- C:\Windows\System\uTAnOLO.exe
  C:\Windows\System\uTAnOLO.exe
  2⤵
  PID:14036
- C:\Windows\System\TeWthvU.exe
  C:\Windows\System\TeWthvU.exe
  2⤵
  PID:14196
- C:\Windows\System\CswfHot.exe
  C:\Windows\System\CswfHot.exe
  2⤵
  PID:13680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 704 -p 13248 -ip 13248
1⤵
PID:9376

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 752 -p 12692 -ip 12692
1⤵
PID:14196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AhZOAeI.exe

Filesize
1.5MB

MD5
78e3d45c57ddfe5c0d2190e31854ff2c

SHA1
9f7932c40bc6aa70457a647db0539722f6d5e85a

SHA256
d85d970d81e151fbb99e7f17508013e5f1aadc5c8ca311e03e05cbd9db7fadcb

SHA512
df0db34adfe45d04834e9a33dc028c832641c8f51eb65a96eb799d47cbc9b99ccd1307460feaf6374f79bd4abe8f95fdf2eb9d0a42684de69f8d0700aae1770d

Download Submit
C:\Windows\System\DzqwXwG.exe

Filesize
1.5MB

MD5
1744a0fdea35215416bd048799f7c6af

SHA1
c80ab4aae300c8af6bcfc8d315bbbdec39bf6e4f

SHA256
bba660c0439da91c8271280de701026404e928599867ba67cc7172cd3b3a9adf

SHA512
a54c64faa5ee0ca8a036b135ff539b60d7059670083a18b6dfddea7fc0c6ba1cc50838f7e00bc4f1586f59e53d949e2ecaf85a39e2d29353498826b151b9b377

Download Submit
C:\Windows\System\FJnDwco.exe

Filesize
1.5MB

MD5
ab0d805a403ffda80d4ce7b12d63a577

SHA1
538ee1cade4422850d81b48527725886036ef43d

SHA256
1efe68fa5dcb315ad51bcc7cd61c651cfbd5a8fb131a4789af26973e2aa1bc4f

SHA512
de242d3c4470fa3d1d4a60d76dd0dc021c06e479b33b3afb87a571486d85e8d5c94899acec08fce40b104859c4b7f1a318b381bf12d87bf21ebfa416abaa0668

Download Submit
C:\Windows\System\FiiHBMb.exe

Filesize
1.5MB

MD5
b7f93a94368d648315a88786a8a83b68

SHA1
7e6123660e5ae47ef2397193f421bdcce381a848

SHA256
ef081883dcff90ce7816e3083ea29414aa124f96d43dc30ae07dfe20ab7109a4

SHA512
6a7bbb3847bd7bc58e5c8b10652912877726ea4eb6048fc4e841e766c7a40769c39293e1f1c6baa2ea20a5330875c4ee8152b5b98bf8ee89cc3988fb8a12d060

Download Submit
C:\Windows\System\GVmkbrm.exe

Filesize
1.5MB

MD5
707aa8a26f3e2f9f3c2cd23cb275bbf6

SHA1
22a4ce7bf7b19563f4ae29dc505007587b545550

SHA256
cc1242d25e9429c277154f17f9a67b141ae7a94dbba95a5c94894e7f244ba715

SHA512
c69875497c02778939a68fb6528e64009fbb612784c65cab277867c7132fc486bea1425f30722de66e57f326863fd71fc13fe2c9475326265af8be4edb636386

Download Submit
C:\Windows\System\IXgWMhH.exe

Filesize
1.5MB

MD5
95bfeb2011af1798db650e298c9c527c

SHA1
8f3e3fd73c81d4195cc41f7fede3ffb77c1efca5

SHA256
a2986350d174c5e0be5a7fabfd77f35e5855f821e6036adf8f488c1814331147

SHA512
23c817392bf0c1ea681f00b82a49058ee3b069e39248404d21145c0fdefad1c393e39f71c30b2ef9da42cf25b4470ae564558a3605bfef016c936a41b0eebf7b

Download Submit
C:\Windows\System\NGejhhC.exe

Filesize
1.5MB

MD5
f6db845bb20f51d4e1e841859f40919b

SHA1
aaf556ed683160e57d4a449cec1f3ee829e36766

SHA256
e9151f4492297ff92820408161b81270a32d6298d54f5125b6ed1ace46b1f099

SHA512
1921664037266d011bc5763bb55d97846a21ef1919e67617dc8e1ea661d029f9033de7c3b9a531efb09a41a1f6a9868333bb6ea83e8769c49f05126fb077f43d

Download Submit
C:\Windows\System\NsQidIZ.exe

Filesize
1.5MB

MD5
5962fbc3f6a227e0a53b1bb9e2870aba

SHA1
423e8faa7a4eff990608b7369e8a5052121442ad

SHA256
174a0acb2d56bb6c6d8b765e1c2d23a33b12e59a512ba8b6d5583448119ba789

SHA512
17c565736d6e6b3193de42298c1d44878c126fe2c5aee82122dfa6559a43b358571036a1118b35575406fa70567260e59b1a6e265073067f07ffdcd02fb63b4d

Download Submit
C:\Windows\System\PPiAqPY.exe

Filesize
1.5MB

MD5
aadb46b78897639d6a2225b8821da905

SHA1
627aa1643b95438649317d152e9b028e4fdc5b14

SHA256
1f354a2d152286c6d013514ee67cc5a0df1be04e8a5414c8528931c51df3fc27

SHA512
3e106138eb3e8f850fdacf4a86de0945a6131c95085e86691f59a66f3c42d6d98d78ce5311535803082ecd157e5467d478998bfff84848177ab44c24966428a9

Download Submit
C:\Windows\System\QhVZsuO.exe

Filesize
1.5MB

MD5
1e8cf111274f844439028db23dd142e4

SHA1
7c1930baaa203826b8f812566a8955e3a6b50a5f

SHA256
bec48ecb10af0673ba2ecbe0103ba6446a4d1201e411736e50f30c5ea79c8688

SHA512
86bcd0c4472927d1c215f484365f7409ee7193b90057d16f280feb96e9bdcb7031b73b21cf90a1f313276179ca87a987a181b302e0ce4009edcf22da0d2782ac

Download Submit
C:\Windows\System\RLzTvXv.exe

Filesize
1.5MB

MD5
0fa051cc87f8da5cd124236ecb75765a

SHA1
bb6d57b16b7749ef3cc561d238473a11d3705b48

SHA256
2d3e2f43621287e6b20d2628b5636440c66df2e33ee78f8493ab33a7b081fdc8

SHA512
ce7ba3d10d8151e89ab57e4edbb794bb1ec0bd5f703c4240bd794f1781738cc8dcf3c597a9799f4e57fbfe04abbad6b4b9c248689354c621950521b2cd752670

Download Submit
C:\Windows\System\RvmokzL.exe

Filesize
1.5MB

MD5
28016c7b53da8521315229c8f0a1a765

SHA1
b809bceb19cbe920c0074b4738eb9bd040567941

SHA256
72747c10cbd9c2de130689084c6711fdb6c484ae2606d1ab47f9a32b620a628c

SHA512
03052a2306dd6e3869f7cfa8b6eaa1b0653a9f6cabdd6a83e8dc6e3f8edc00687c15d05f5c52b15d4d0aea452f935f31c5b1b386a6cf6dfcea894424287defa2

Download Submit
C:\Windows\System\SHMOXqX.exe

Filesize
1.5MB

MD5
ef68836418f864b074e0593f0417b2dc

SHA1
553cd22358e6015b81e17b6ff6e0d46caea22095

SHA256
3f7cdffe16d665851d4a822c33c26631b6ed22dee1e29981fa1d883ddf60fcb3

SHA512
8eabfc5d13c6b55e57919e144a7a3730397365d3d60b15ba13a5c2e9514cf02f67dab83e1076902a3944f7e6acfaf742779c9d0bd1728b0a5d504f7efbeb11f2

Download Submit
C:\Windows\System\SZiRmFQ.exe

Filesize
1.5MB

MD5
35832f88b307d5d6dbf343461b14013b

SHA1
2325cb139977900044f42fcd556b89c8ed9ed8b7

SHA256
a78459b54dac08b910073e09bbbc1f40b7d81dc692376cd0080ae02101f9cdac

SHA512
812491394f3cc6eb5ff2a87ec8e2c20ab841132c8c3578c3c874ec95c791dd777cbe0997215664ea3f605ff9c8502e49b7cf671d1d0ceffe7a5466106cb86eaa

Download Submit
C:\Windows\System\TCFfjEa.exe

Filesize
1.5MB

MD5
f81f176fbff56ec771ab1fa0837de96f

SHA1
d414397faf7b6314575386ea74d6b97832be4029

SHA256
598e45151269f07260f7c841d9457a016a2eb16dd291e88f8887768c66afce51

SHA512
bfb70310958dc6f77d5ccec174f924fe7111c47c267ca17aa3afae0e402800ffeaa616fbf84fa548e9a1179dc5e50ecd6218bcb9fcef19bbb613754d7d4b444b

Download Submit
C:\Windows\System\TMDDWmd.exe

Filesize
1.5MB

MD5
be0bc5088184867e47881e8b89be4f8c

SHA1
5ecaf78baf7e2b953c71ad60c2478bbf8eadc8b0

SHA256
716689887f3278a3e1f8be243af7eae0cabc147c5aaa12b9184db12412ed496a

SHA512
d048ba405b78d9b2e3f7ce9c394fa4f563eaad5e696d636e086b9d8bd0b479a619e4c6b744c9f222b29effd16a19707d2a9a517dc0b1f0f6708fdd6f7b3b8dfd

Download Submit
C:\Windows\System\UJIsxjB.exe

Filesize
1.5MB

MD5
0b8beaba18a463a2706c3aff8b573038

SHA1
8eff9b6f02079fd0528d077fab43a3af13b71963

SHA256
364940c4cc69b959122e1028de9872d1f5e0568f3c5b131fd1b15a93cdce221b

SHA512
d19f418da6138026e965475de1cca1bede8ff65a6e6183bb188c0d1fbdda7ddc7e295bf88c0e58a03a430af99848aa2cb0f4d105650b865d492244c2ba517708

Download Submit
C:\Windows\System\UZiUjDr.exe

Filesize
1.5MB

MD5
4c3a3fc4750a34f0c6460904c9249a65

SHA1
7f5c0a27acd8e44433bed94f91b75084b67093de

SHA256
74297fd7226e9cbfb64562fa4b663e5f11bc09fb79c57ec326a6fca087920435

SHA512
a80aa283e760240d58394fea735219d225197764dfe56213f7cf6b086f89fa585a8d62ed9943fa83d4016bbe9e6cddc118be6ad90e341cd185592acbf73ecb96

Download Submit
C:\Windows\System\UhFuyiE.exe

Filesize
1.5MB

MD5
8ee4fbc2ab521b605447dc00ba723da1

SHA1
dab45489a070d9cc256a0e579fcc6e497c04bec7

SHA256
005ba658e888e4c2f837cb83b0ab22857afe3a601c482bb5435a442aede45525

SHA512
03cfe75a097e6f3dfd2488bc1e5ef6daf09b0204a282270b5987a78eec7ad87028e0f38eec678787d43b1d62c4fc1303f47b922fea48cca867b91f97d5af01cb

Download Submit
C:\Windows\System\WwHFdoy.exe

Filesize
1.5MB

MD5
3702741a9d50ec8deb2dce803ffeecaa

SHA1
4fac3753664307e1de8d2229e59f647ff645ca8f

SHA256
c2d62802eac9b898bcc21563ef5f180425eb5cf78dd66b538a8e5bbc098bf61d

SHA512
85ceb74891a6bcb3f9dc0c3d6098c921e0b08c82e7f585da3523dbe6aed405f2d25721ff572d9b65143ae064ed92af04c7ef007c86eae6994fa42450110fc04d

Download Submit
C:\Windows\System\ZKOryse.exe

Filesize
1.5MB

MD5
41b42831eb9d1b4e66a07cf125eb3221

SHA1
56c2fbeb4cfee58e22da2655737bab54eff1e657

SHA256
8f6641f9b9ee66aa0a2132f21b27825c15318f7abd14213e2d0bf00eb8899b88

SHA512
6bc77bdd3aeec519d48d8224f2f71e50c90b7ed7c9a90b9efc6f521e7276716c2eaf01d67724def517624782c51b3e4238f53c28d284c704e7ac48f42ab5d720

Download Submit
C:\Windows\System\ZZkOAbo.exe

Filesize
1.5MB

MD5
948974ce79c45442924dc3e1bbbc13e4

SHA1
e20336773bfd64667ddb99cb8a51c8f365fd0074

SHA256
5afabae6dd1ed535aa4c3646b552cf3e46d170d457413c0c699403852f197703

SHA512
518b8d221ce0c96bd34ec6a20cf2bb567e27598637a1d58aa49d5a41039d2a7d38a839bd1ebb337aec69657eba8a528d0f43bded6bbd5c88d942ae558a8aca5f

Download Submit
C:\Windows\System\brujOlR.exe

Filesize
1.5MB

MD5
5c9c9c512b582978abb3546a7928f310

SHA1
a6b79ac3416ab2b7d6e3611797e8b0fafdb53e7e

SHA256
f39d42f1024f92e5bf1ef3b622b0d667fe958776870addbb9855f8fdade3a9a4

SHA512
fb66eabc954cdabbe2b0f5b67354c05c1e6f5a9f6c10ff254f4ae3cc7a407ef52eae44527bb092d517f347033890300b7676acaacd6a433ace37dba61c94204c

Download Submit
C:\Windows\System\cQAEzyF.exe

Filesize
1.5MB

MD5
ac7b24baa08b4be0924814590bbcc2d2

SHA1
55216cfbff65e3605fb267e1611b371d276a557d

SHA256
cfeb58bf3fcaf96dbf463b30bf682e07eff7f3b6a0e4e9dbb276246fcc461838

SHA512
55c4c910cbef144e495848d2d00f46a8b48f4773ce4eaa492974efff8e4e036ed08d671f0d6f4dc64ad7b5e8de0ed432eb56b82cc33d192e1418ddfb3ad00dad

Download Submit
C:\Windows\System\ePkclld.exe

Filesize
1.5MB

MD5
913e965b9c78171fbb42e092c94d549e

SHA1
43664549cb84bbd219e9240f298f58de933ad14d

SHA256
98c3b126624c0da9380ea4a6a5c95bda5a8dd2c2ef928fe8e7042f43a778dc62

SHA512
d50cac5c1f6456fc8bf1666695df9bc15ab2dc614ac928b78c9dff46ce240be16a63c2ca06da69afab54dbd07212aee9084723a971c06766609660c9fa460a1f

Download Submit
C:\Windows\System\fiYPqvw.exe

Filesize
1.5MB

MD5
a4de42923ca71f6afd52fa439a9f4afa

SHA1
28cbbb227176e949f579a7c0023a11041f2a83e4

SHA256
64cafbe3fa18d040d72f9c68a14424efa837bed1148b6caf32f0df974cb5d88b

SHA512
ef4dfbf5791f95bbe773c80010cef5925ce426d7cca5fa397825c64118132b20cc1f8a23314fa024dc01f5d83c4eedf5541929d6d628010610abd46749f6d47c

Download Submit
C:\Windows\System\gWWWfmm.exe

Filesize
1.5MB

MD5
2cc4d318cb0ff9cc0f6c5ad14abbb659

SHA1
a2e02ccdff2bbc1d0e1bee8bdd28ef870ed7365c

SHA256
c3412f255f021cf303768e6f3a73bfa78497804f0ffc87fa552248df5fb343ce

SHA512
2b2cd8bf8066e84f2ac59590bcc09d4d29c753e65b50592ee83adaf859e7ecab31551da3778680288bd0c009036aa377eafefd751e322432325dc2283d550ed8

Download Submit
C:\Windows\System\kjffjHs.exe

Filesize
1.5MB

MD5
b65fd42d4209d20d98b6ba1ccf585d7c

SHA1
ad4d9ddae8120cb4975ec38a222a5f7ba4194076

SHA256
172f078850440a6e21fb3342f9cb10a0de37a879c7ac7a404d4de950b81eb6fe

SHA512
fece4549286973a6e706862bccb48bc414a550255cd4e2845ef60cee386c67ba4508497005b665bd83f4cc8c8140112642bf66021c6d7f25f6bf5368ab887fa1

Download Submit
C:\Windows\System\lKZvtIj.exe

Filesize
1.5MB

MD5
47b755f524efa10d2d1c40c7f663c307

SHA1
63962d1dd3288fa9cc2123bf93bcd8f11c6a8adc

SHA256
ee1790b2e0364afa0af90e613438c07a9dfce335c21293747aab0148994aa8bb

SHA512
8449c628be618f6b4202bdbabc9f814565e02991028a09860e0bbe09fe36299c531aae16bda22e676c8a827c6604aa5738fa63178d98982c74ba7746b010df9f

Download Submit
C:\Windows\System\ofpGDjL.exe

Filesize
1.5MB

MD5
56469866c0413a9e689f513a3565c866

SHA1
2e221f44b657f7ced6f3477608b486950234ed66

SHA256
25c3e9b6efcbc6ef50fa23cfc02ae8272a0b34bd00798bc018a8c4dd9ac77439

SHA512
29ec1dbbe3b90ea286c7c414e691d3fe4d5d5da2ff961aee85fa60c58f506669708b70af03f7b765f5a0df60cc7189fbdc41f4e3850593a4b34e7ae3a82bdc14

Download Submit
C:\Windows\System\uitBEoL.exe

Filesize
1.5MB

MD5
06305ee6374533ba285b37720d204c8c

SHA1
5460cecf58f723facad4983019a719a86c0c4459

SHA256
7b312bc3ee54d0a4027dc9f008c0fa79b0ffba6c9ffcbcaee7b9804a724bb0a9

SHA512
3b5c38f787cd8ababa6a0fe0b61364f6571997ceffdb6d8361a2ed6950779a80d36a9d970deefc6a86095e1c421c76fb4ee7f644500aae963c232ae7d75b8919

Download Submit
C:\Windows\System\wKoPXeg.exe

Filesize
1.5MB

MD5
1a5e774c4525f0e20dd2f50f13c6daa3

SHA1
4441b7d25a603b03cb29d8ece25e4d7f321b64e3

SHA256
b062d86164a84fb4f84d349a3d1db1427cc5d47da5b28e9b453ddbf0c8a892d9

SHA512
a735200b41f84bd26382f09d65e0fca0284808fbe863538c21b75d6863f6106d97f668b8a5feccd6a346928106cbb13810db30ec25b74d6e586df71c7e2f8a52

Download Submit
C:\Windows\System\wswDyXx.exe

Filesize
1.5MB

MD5
8a8ee5f70f0c523ae8fa615a3a988322

SHA1
113cb358460d8d62b351711dd020498747094f1e

SHA256
e549017ae4c12b68bcc3ee84577a40e03f09b24fc774a4bd2598dc89e23b4995

SHA512
a69c4458072b910317cca24249fd20e0a5497a69daabc6e05d0fedf8552cc6239d14fcbc70f16189be312d389b36692e18722562aa23d1d7fac6bfc733af7807

Download Submit
C:\Windows\System\xjLRoXI.exe

Filesize
1.5MB

MD5
ff7c9d8540d18470a4dc3189266f9457

SHA1
6e7b8a2bd19a8996f547592635e59bb4d84e5534

SHA256
a8168a6b66f8bc6821d76a143611d13d4733ceb044a680583ea8ab8aa72223d5

SHA512
c8cc50d834712da7091ad312fbc822b78e1d1b73abc98689fd74430f723cebe187ff4417d2ed37a4511bfb580bdf036c1015aa87a25249f31bbef60fd9a86684

Download Submit
C:\Windows\System\yIotTtk.exe

Filesize
1.5MB

MD5
fd6056fc75ba579a8b032619c3537065

SHA1
93e6649cd294d64306aaadda2cbe55f640c03097

SHA256
659ad11da83458e705d095d9b3ccc2d13e4f504c0a7fe282c8377545bf859837

SHA512
68cfe30ce988d8e3ae2272fc9237f99564cd084b8dc00bcf6b9bc64e3e627140ff31be4b603224c6b70f765ee59de70e2bb803cb733ba071f63a71640f58c4de

Download Submit
C:\Windows\System\yKFWlGd.exe

Filesize
1.5MB

MD5
edadc5fcd51c46567e56f5eb7294c935

SHA1
10d4d237c993b33bf74f553c64554df60261fcc2

SHA256
51b945845637f611d262f487d3f3d0145f16064c01ccbe72c0cce65b492fac3c

SHA512
5be89e14ae947004653ffb956fca286b6b809ff2cfbd4bb30b606b4a681fbbb02ea3a1af874517ba3392be1637ed830150a89bbe3cdd7e93b918f735daf0762f

Download Submit
C:\Windows\System\yvNFzvg.exe

Filesize
1.5MB

MD5
91c304f61af4278a903d47d440af2537

SHA1
fd52eb6992cc2d708f141c47605e16b549b018e8

SHA256
d0489451c9dd22f147b4318f585e0314b4c29c035b0121b0470e847c8407b1eb

SHA512
f64960c31976edd41e8ab250d754386856bede55c582d9cb90a51f2c6011d6f29cd9a65f462f0211e955c8f1070480abe9b098c960e7e26cdbdc43c316b18b85

Download Submit
C:\Windows\System\znsJOSt.exe

Filesize
1.5MB

MD5
a4e566fa379a6ec651a7daf1a6927bb4

SHA1
e5197a54704dc720f34c9f859190e46358ffa2fd

SHA256
3b2e0694e0424904a928271ab530ef5e8e0eb290f8bb633d1baa92e5b045a89f

SHA512
13afde96569fc764a21a2358c9f17c69c3dcfba7db45e54ff77e3f21fdeed8a84b924face705fc07eee71c95b05b25f09e8a1b99531638681edb220f73ba11b4

Download Submit
C:\Windows\System\zsufFGQ.exe

Filesize
1.5MB

MD5
0e5cdf4eba4e2b4cd64c000e9fe5800f

SHA1
01c0fde54d94fea3b228f2941d9a29fec993bc72

SHA256
e89dbd7ec70d0a05adbf41d179ac8d9b3f07d14dfdf9b5121c27d784078439ed

SHA512
f3c14ae01952bf2a27a18980c7116785662ec43084b3c8d1eb555235158270b3db54a38a3f84b8e39f961673c53bce47174f245c392f085e2b31451d4f7b91f9

Download Submit
memory/408-693-0x00007FF6049F0000-0x00007FF604D41000-memory.dmp

Filesize
3.3MB

Download
memory/408-2451-0x00007FF6049F0000-0x00007FF604D41000-memory.dmp

Filesize
3.3MB

Download
memory/660-284-0x00007FF79E5C0000-0x00007FF79E911000-memory.dmp

Filesize
3.3MB

Download
memory/660-2437-0x00007FF79E5C0000-0x00007FF79E911000-memory.dmp

Filesize
3.3MB

Download
memory/732-171-0x00007FF6FBF50000-0x00007FF6FC2A1000-memory.dmp

Filesize
3.3MB

Download
memory/732-2417-0x00007FF6FBF50000-0x00007FF6FC2A1000-memory.dmp

Filesize
3.3MB

Download
memory/732-2446-0x00007FF6FBF50000-0x00007FF6FC2A1000-memory.dmp

Filesize
3.3MB

Download
memory/940-692-0x00007FF70B110000-0x00007FF70B461000-memory.dmp

Filesize
3.3MB

Download
memory/940-2454-0x00007FF70B110000-0x00007FF70B461000-memory.dmp

Filesize
3.3MB

Download
memory/1328-336-0x00007FF7B27F0000-0x00007FF7B2B41000-memory.dmp

Filesize
3.3MB

Download
memory/1328-2456-0x00007FF7B27F0000-0x00007FF7B2B41000-memory.dmp

Filesize
3.3MB

Download
memory/1376-2413-0x00007FF78FD50000-0x00007FF7900A1000-memory.dmp

Filesize
3.3MB

Download
memory/1376-34-0x00007FF78FD50000-0x00007FF7900A1000-memory.dmp

Filesize
3.3MB

Download
memory/1376-2423-0x00007FF78FD50000-0x00007FF7900A1000-memory.dmp

Filesize
3.3MB

Download
memory/1432-394-0x00007FF64A020000-0x00007FF64A371000-memory.dmp

Filesize
3.3MB

Download
memory/1432-2467-0x00007FF64A020000-0x00007FF64A371000-memory.dmp

Filesize
3.3MB

Download
memory/1728-670-0x00007FF798420000-0x00007FF798771000-memory.dmp

Filesize
3.3MB

Download
memory/1728-2475-0x00007FF798420000-0x00007FF798771000-memory.dmp

Filesize
3.3MB

Download
memory/1836-2435-0x00007FF6786D0000-0x00007FF678A21000-memory.dmp

Filesize
3.3MB

Download
memory/1836-2415-0x00007FF6786D0000-0x00007FF678A21000-memory.dmp

Filesize
3.3MB

Download
memory/1836-55-0x00007FF6786D0000-0x00007FF678A21000-memory.dmp

Filesize
3.3MB

Download
memory/1840-2487-0x00007FF624650000-0x00007FF6249A1000-memory.dmp

Filesize
3.3MB

Download
memory/1840-594-0x00007FF624650000-0x00007FF6249A1000-memory.dmp

Filesize
3.3MB

Download
memory/2076-2464-0x00007FF65C550000-0x00007FF65C8A1000-memory.dmp

Filesize
3.3MB

Download
memory/2076-391-0x00007FF65C550000-0x00007FF65C8A1000-memory.dmp

Filesize
3.3MB

Download
memory/2184-2431-0x00007FF7EFAF0000-0x00007FF7EFE41000-memory.dmp

Filesize
3.3MB

Download
memory/2184-124-0x00007FF7EFAF0000-0x00007FF7EFE41000-memory.dmp

Filesize
3.3MB

Download
memory/2184-2416-0x00007FF7EFAF0000-0x00007FF7EFE41000-memory.dmp

Filesize
3.3MB

Download
memory/2248-25-0x00007FF734900000-0x00007FF734C51000-memory.dmp

Filesize
3.3MB

Download
memory/2248-2419-0x00007FF734900000-0x00007FF734C51000-memory.dmp

Filesize
3.3MB

Download
memory/2248-2412-0x00007FF734900000-0x00007FF734C51000-memory.dmp

Filesize
3.3MB

Download
memory/2332-0-0x00007FF601640000-0x00007FF601991000-memory.dmp

Filesize
3.3MB

Download
memory/2332-1-0x00000209F6490000-0x00000209F64A0000-memory.dmp

Filesize
64KB

Download
memory/2332-2312-0x00007FF601640000-0x00007FF601991000-memory.dmp

Filesize
3.3MB

Download
memory/2476-686-0x00007FF6ED580000-0x00007FF6ED8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2476-2421-0x00007FF6ED580000-0x00007FF6ED8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2592-688-0x00007FF6650E0000-0x00007FF665431000-memory.dmp

Filesize
3.3MB

Download
memory/2592-2430-0x00007FF6650E0000-0x00007FF665431000-memory.dmp

Filesize
3.3MB

Download
memory/2984-691-0x00007FF643D90000-0x00007FF6440E1000-memory.dmp

Filesize
3.3MB

Download
memory/2984-2478-0x00007FF643D90000-0x00007FF6440E1000-memory.dmp

Filesize
3.3MB

Download
memory/3372-687-0x00007FF75F300000-0x00007FF75F651000-memory.dmp

Filesize
3.3MB

Download
memory/3372-2440-0x00007FF75F300000-0x00007FF75F651000-memory.dmp

Filesize
3.3MB

Download
memory/3388-690-0x00007FF69FCB0000-0x00007FF6A0001000-memory.dmp

Filesize
3.3MB

Download
memory/3388-2447-0x00007FF69FCB0000-0x00007FF6A0001000-memory.dmp

Filesize
3.3MB

Download
memory/3396-2444-0x00007FF658C20000-0x00007FF658F71000-memory.dmp

Filesize
3.3MB

Download
memory/3396-474-0x00007FF658C20000-0x00007FF658F71000-memory.dmp

Filesize
3.3MB

Download
memory/3412-2469-0x00007FF62C900000-0x00007FF62CC51000-memory.dmp

Filesize
3.3MB

Download
memory/3412-279-0x00007FF62C900000-0x00007FF62CC51000-memory.dmp

Filesize
3.3MB

Download
memory/3468-175-0x00007FF7E6250000-0x00007FF7E65A1000-memory.dmp

Filesize
3.3MB

Download
memory/3468-2433-0x00007FF7E6250000-0x00007FF7E65A1000-memory.dmp

Filesize
3.3MB

Download
memory/3620-51-0x00007FF787030000-0x00007FF787381000-memory.dmp

Filesize
3.3MB

Download
memory/3620-2414-0x00007FF787030000-0x00007FF787381000-memory.dmp

Filesize
3.3MB

Download
memory/3620-2425-0x00007FF787030000-0x00007FF787381000-memory.dmp

Filesize
3.3MB

Download
memory/3680-685-0x00007FF6E51A0000-0x00007FF6E54F1000-memory.dmp

Filesize
3.3MB

Download
memory/3680-2482-0x00007FF6E51A0000-0x00007FF6E54F1000-memory.dmp

Filesize
3.3MB

Download
memory/3684-2441-0x00007FF7BE7A0000-0x00007FF7BEAF1000-memory.dmp

Filesize
3.3MB

Download
memory/3684-689-0x00007FF7BE7A0000-0x00007FF7BEAF1000-memory.dmp

Filesize
3.3MB

Download
memory/4044-230-0x00007FF773AD0000-0x00007FF773E21000-memory.dmp

Filesize
3.3MB

Download
memory/4044-2453-0x00007FF773AD0000-0x00007FF773E21000-memory.dmp

Filesize
3.3MB

Download
memory/4208-479-0x00007FF7E4C50000-0x00007FF7E4FA1000-memory.dmp

Filesize
3.3MB

Download
memory/4208-2459-0x00007FF7E4C50000-0x00007FF7E4FA1000-memory.dmp

Filesize
3.3MB

Download
memory/4448-598-0x00007FF6C8A80000-0x00007FF6C8DD1000-memory.dmp

Filesize
3.3MB

Download
memory/4448-2462-0x00007FF6C8A80000-0x00007FF6C8DD1000-memory.dmp

Filesize
3.3MB

Download
memory/5076-672-0x00007FF7CEFC0000-0x00007FF7CF311000-memory.dmp

Filesize
3.3MB

Download
memory/5076-2465-0x00007FF7CEFC0000-0x00007FF7CF311000-memory.dmp

Filesize
3.3MB

Download
memory/5096-78-0x00007FF6611C0000-0x00007FF661511000-memory.dmp

Filesize
3.3MB

Download
memory/5096-2427-0x00007FF6611C0000-0x00007FF661511000-memory.dmp

Filesize
3.3MB

Download