xmrig | 580c0cb5274042ba3d75b85afcbbcbc3d59e45263044376d012b0cef32eae971

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
Size

1.5MB
MD5

b9c002da54d5fb8d7b77303a6bb7d810
SHA1

29a1874f34416ef32e0a2fa744f4077bf3e57841
SHA256

580c0cb5274042ba3d75b85afcbbcbc3d59e45263044376d012b0cef32eae971
SHA512

3c71982cf03dddc8fc8e91a11258595e5c60896163e219cf4159848cb6acab70e3b23d9400c6a49a9221b2e0ecb757bb6f3a9ba5d43516b0ad096a5a087862d3
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAW:ROdWCCi7/rahOYFoIBmCG5

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 55 IoCs

miner

resource	yara_rule
behavioral2/memory/3224-133-0x00007FF688DA0000-0x00007FF6890F1000-memory.dmp	xmrig
behavioral2/memory/3440-367-0x00007FF7A9E20000-0x00007FF7AA171000-memory.dmp	xmrig
behavioral2/memory/4792-431-0x00007FF631AA0000-0x00007FF631DF1000-memory.dmp	xmrig
behavioral2/memory/4108-537-0x00007FF6283E0000-0x00007FF628731000-memory.dmp	xmrig
behavioral2/memory/1288-550-0x00007FF742580000-0x00007FF7428D1000-memory.dmp	xmrig
behavioral2/memory/4024-549-0x00007FF634470000-0x00007FF6347C1000-memory.dmp	xmrig
behavioral2/memory/2524-548-0x00007FF78F1D0000-0x00007FF78F521000-memory.dmp	xmrig
behavioral2/memory/3172-547-0x00007FF7930D0000-0x00007FF793421000-memory.dmp	xmrig
behavioral2/memory/532-546-0x00007FF788E40000-0x00007FF789191000-memory.dmp	xmrig
behavioral2/memory/3512-545-0x00007FF6EB110000-0x00007FF6EB461000-memory.dmp	xmrig
behavioral2/memory/3476-544-0x00007FF7325B0000-0x00007FF732901000-memory.dmp	xmrig
behavioral2/memory/5056-543-0x00007FF7B1540000-0x00007FF7B1891000-memory.dmp	xmrig
behavioral2/memory/3032-542-0x00007FF714830000-0x00007FF714B81000-memory.dmp	xmrig
behavioral2/memory/1940-534-0x00007FF69EA30000-0x00007FF69ED81000-memory.dmp	xmrig
behavioral2/memory/3964-533-0x00007FF7814C0000-0x00007FF781811000-memory.dmp	xmrig
behavioral2/memory/2776-430-0x00007FF6D77F0000-0x00007FF6D7B41000-memory.dmp	xmrig
behavioral2/memory/4340-328-0x00007FF76C150000-0x00007FF76C4A1000-memory.dmp	xmrig
behavioral2/memory/4744-326-0x00007FF7799B0000-0x00007FF779D01000-memory.dmp	xmrig
behavioral2/memory/2756-269-0x00007FF634E00000-0x00007FF635151000-memory.dmp	xmrig
behavioral2/memory/1516-266-0x00007FF6FC290000-0x00007FF6FC5E1000-memory.dmp	xmrig
behavioral2/memory/2256-207-0x00007FF7E02B0000-0x00007FF7E0601000-memory.dmp	xmrig
behavioral2/memory/3456-175-0x00007FF74A880000-0x00007FF74ABD1000-memory.dmp	xmrig
behavioral2/memory/4796-172-0x00007FF728C90000-0x00007FF728FE1000-memory.dmp	xmrig
behavioral2/memory/2648-102-0x00007FF622F80000-0x00007FF6232D1000-memory.dmp	xmrig
behavioral2/memory/3700-16-0x00007FF707640000-0x00007FF707991000-memory.dmp	xmrig
behavioral2/memory/1532-2101-0x00007FF6FA020000-0x00007FF6FA371000-memory.dmp	xmrig
behavioral2/memory/3700-2199-0x00007FF707640000-0x00007FF707991000-memory.dmp	xmrig
behavioral2/memory/3172-2201-0x00007FF7930D0000-0x00007FF793421000-memory.dmp	xmrig
behavioral2/memory/2400-2203-0x00007FF76B9C0000-0x00007FF76BD11000-memory.dmp	xmrig
behavioral2/memory/2456-2205-0x00007FF6FFAD0000-0x00007FF6FFE21000-memory.dmp	xmrig
behavioral2/memory/1232-2215-0x00007FF688680000-0x00007FF6889D1000-memory.dmp	xmrig
behavioral2/memory/4796-2219-0x00007FF728C90000-0x00007FF728FE1000-memory.dmp	xmrig
behavioral2/memory/4024-2221-0x00007FF634470000-0x00007FF6347C1000-memory.dmp	xmrig
behavioral2/memory/3456-2223-0x00007FF74A880000-0x00007FF74ABD1000-memory.dmp	xmrig
behavioral2/memory/1888-2217-0x00007FF601260000-0x00007FF6015B1000-memory.dmp	xmrig
behavioral2/memory/3224-2214-0x00007FF688DA0000-0x00007FF6890F1000-memory.dmp	xmrig
behavioral2/memory/532-2209-0x00007FF788E40000-0x00007FF789191000-memory.dmp	xmrig
behavioral2/memory/2648-2208-0x00007FF622F80000-0x00007FF6232D1000-memory.dmp	xmrig
behavioral2/memory/2524-2212-0x00007FF78F1D0000-0x00007FF78F521000-memory.dmp	xmrig
behavioral2/memory/2256-2225-0x00007FF7E02B0000-0x00007FF7E0601000-memory.dmp	xmrig
behavioral2/memory/3964-2254-0x00007FF7814C0000-0x00007FF781811000-memory.dmp	xmrig
behavioral2/memory/1516-2251-0x00007FF6FC290000-0x00007FF6FC5E1000-memory.dmp	xmrig
behavioral2/memory/1288-2250-0x00007FF742580000-0x00007FF7428D1000-memory.dmp	xmrig
behavioral2/memory/5056-2247-0x00007FF7B1540000-0x00007FF7B1891000-memory.dmp	xmrig
behavioral2/memory/2756-2243-0x00007FF634E00000-0x00007FF635151000-memory.dmp	xmrig
behavioral2/memory/2776-2242-0x00007FF6D77F0000-0x00007FF6D7B41000-memory.dmp	xmrig
behavioral2/memory/3476-2240-0x00007FF7325B0000-0x00007FF732901000-memory.dmp	xmrig
behavioral2/memory/4744-2236-0x00007FF7799B0000-0x00007FF779D01000-memory.dmp	xmrig
behavioral2/memory/3512-2234-0x00007FF6EB110000-0x00007FF6EB461000-memory.dmp	xmrig
behavioral2/memory/3440-2229-0x00007FF7A9E20000-0x00007FF7AA171000-memory.dmp	xmrig
behavioral2/memory/4340-2228-0x00007FF76C150000-0x00007FF76C4A1000-memory.dmp	xmrig
behavioral2/memory/1940-2272-0x00007FF69EA30000-0x00007FF69ED81000-memory.dmp	xmrig
behavioral2/memory/4108-2264-0x00007FF6283E0000-0x00007FF628731000-memory.dmp	xmrig
behavioral2/memory/4792-2246-0x00007FF631AA0000-0x00007FF631DF1000-memory.dmp	xmrig
behavioral2/memory/3032-2238-0x00007FF714830000-0x00007FF714B81000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3700	TiyBiRf.exe
2400	fOBmZOq.exe
532	BOOcXHA.exe
1888	KzFtaPt.exe
2456	NPDyRoR.exe
1232	COnWFTU.exe
3172	PSYQpKv.exe
2524	uOfzBfL.exe
2648	EaVWKnL.exe
3224	KUnLvmd.exe
4796	RRkBDoz.exe
3456	ykkwnpm.exe
4024	ZxTGvzf.exe
2256	wlxddLL.exe
1516	erxKGEn.exe
1288	kKIjQhu.exe
2756	RcnnBqb.exe
4744	DgSqhRw.exe
4340	uKykgno.exe
3440	WEpYJyU.exe
2776	hFWVRVb.exe
4792	scGKkwO.exe
3964	PxDMHpu.exe
1940	XOOmDrF.exe
4108	WOHBgSY.exe
3032	nmUSSrs.exe
5056	HKGMlAa.exe
3476	nLmfgtE.exe
3512	LLyyMOu.exe
4624	bBETmfa.exe
668	uDbwBOH.exe
8	VPCOuXZ.exe
2288	QOveFwk.exe
1160	qCaAWSZ.exe
1036	njHHPXU.exe
1068	KlGeEIr.exe
1524	mJHVivs.exe
4248	ixGWYde.exe
2064	hxafELk.exe
4364	rQnIfWK.exe
4036	wpCOSvX.exe
2860	fBfenTV.exe
1324	bKdSJMY.exe
1772	TLcTVrr.exe
4440	iZjbvwc.exe
1124	ebWBfuC.exe
4320	ElPtOXd.exe
5064	AuDRgAO.exe
2896	ityjDXI.exe
1204	NYTQpBK.exe
3520	tvscsFz.exe
4788	QuPndna.exe
1864	GUdNTNJ.exe
1860	tcDeBjJ.exe
856	LFiAnQy.exe
3492	PpLrzEw.exe
392	pojoPLS.exe
644	Mgqnxem.exe
1596	ZfjPIRV.exe
1528	vsSWojQ.exe
4512	wLDljgX.exe
3480	IvVdfWK.exe
3240	BBhWAnd.exe
2356	ivROwMW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1532-0-0x00007FF6FA020000-0x00007FF6FA371000-memory.dmp	upx
behavioral2/files/0x000800000002349f-5.dat	upx
behavioral2/files/0x00070000000234a3-8.dat	upx
behavioral2/files/0x00070000000234a4-7.dat	upx
behavioral2/files/0x00070000000234a5-70.dat	upx
behavioral2/files/0x00070000000234b5-106.dat	upx
behavioral2/memory/3224-133-0x00007FF688DA0000-0x00007FF6890F1000-memory.dmp	upx
behavioral2/memory/3440-367-0x00007FF7A9E20000-0x00007FF7AA171000-memory.dmp	upx
behavioral2/memory/4792-431-0x00007FF631AA0000-0x00007FF631DF1000-memory.dmp	upx
behavioral2/memory/4108-537-0x00007FF6283E0000-0x00007FF628731000-memory.dmp	upx
behavioral2/memory/1288-550-0x00007FF742580000-0x00007FF7428D1000-memory.dmp	upx
behavioral2/memory/4024-549-0x00007FF634470000-0x00007FF6347C1000-memory.dmp	upx
behavioral2/memory/2524-548-0x00007FF78F1D0000-0x00007FF78F521000-memory.dmp	upx
behavioral2/memory/3172-547-0x00007FF7930D0000-0x00007FF793421000-memory.dmp	upx
behavioral2/memory/532-546-0x00007FF788E40000-0x00007FF789191000-memory.dmp	upx
behavioral2/memory/3512-545-0x00007FF6EB110000-0x00007FF6EB461000-memory.dmp	upx
behavioral2/memory/3476-544-0x00007FF7325B0000-0x00007FF732901000-memory.dmp	upx
behavioral2/memory/5056-543-0x00007FF7B1540000-0x00007FF7B1891000-memory.dmp	upx
behavioral2/memory/3032-542-0x00007FF714830000-0x00007FF714B81000-memory.dmp	upx
behavioral2/memory/1940-534-0x00007FF69EA30000-0x00007FF69ED81000-memory.dmp	upx
behavioral2/memory/3964-533-0x00007FF7814C0000-0x00007FF781811000-memory.dmp	upx
behavioral2/memory/2776-430-0x00007FF6D77F0000-0x00007FF6D7B41000-memory.dmp	upx
behavioral2/memory/4340-328-0x00007FF76C150000-0x00007FF76C4A1000-memory.dmp	upx
behavioral2/memory/4744-326-0x00007FF7799B0000-0x00007FF779D01000-memory.dmp	upx
behavioral2/memory/2756-269-0x00007FF634E00000-0x00007FF635151000-memory.dmp	upx
behavioral2/memory/1516-266-0x00007FF6FC290000-0x00007FF6FC5E1000-memory.dmp	upx
behavioral2/memory/2256-207-0x00007FF7E02B0000-0x00007FF7E0601000-memory.dmp	upx
behavioral2/files/0x00070000000234c8-202.dat	upx
behavioral2/files/0x00070000000234c7-201.dat	upx
behavioral2/files/0x00080000000234a0-200.dat	upx
behavioral2/files/0x00070000000234bb-197.dat	upx
behavioral2/files/0x00070000000234b9-189.dat	upx
behavioral2/files/0x00070000000234b7-180.dat	upx
behavioral2/files/0x00070000000234af-179.dat	upx
behavioral2/files/0x00070000000234c5-176.dat	upx
behavioral2/memory/3456-175-0x00007FF74A880000-0x00007FF74ABD1000-memory.dmp	upx
behavioral2/memory/4796-172-0x00007FF728C90000-0x00007FF728FE1000-memory.dmp	upx
behavioral2/files/0x00070000000234c4-171.dat	upx
behavioral2/files/0x00070000000234c3-168.dat	upx
behavioral2/files/0x00070000000234c2-163.dat	upx
behavioral2/files/0x00070000000234c1-162.dat	upx
behavioral2/files/0x00070000000234c0-161.dat	upx
behavioral2/files/0x00070000000234bc-146.dat	upx
behavioral2/files/0x00070000000234b3-142.dat	upx
behavioral2/files/0x00070000000234c6-194.dat	upx
behavioral2/files/0x00070000000234ba-191.dat	upx
behavioral2/files/0x00070000000234b8-181.dat	upx
behavioral2/files/0x00070000000234b4-132.dat	upx
behavioral2/files/0x00070000000234be-127.dat	upx
behavioral2/files/0x00070000000234bd-124.dat	upx
behavioral2/files/0x00070000000234b2-117.dat	upx
behavioral2/files/0x00070000000234b1-115.dat	upx
behavioral2/files/0x00070000000234bf-144.dat	upx
behavioral2/files/0x00070000000234b6-110.dat	upx
behavioral2/files/0x00070000000234b0-108.dat	upx
behavioral2/files/0x00070000000234ae-140.dat	upx
behavioral2/files/0x00070000000234ad-92.dat	upx
behavioral2/files/0x00070000000234ab-85.dat	upx
behavioral2/files/0x00070000000234a9-73.dat	upx
behavioral2/memory/2648-102-0x00007FF622F80000-0x00007FF6232D1000-memory.dmp	upx
behavioral2/memory/2456-64-0x00007FF6FFAD0000-0x00007FF6FFE21000-memory.dmp	upx
behavioral2/files/0x00070000000234aa-59.dat	upx
behavioral2/files/0x00070000000234ac-57.dat	upx
behavioral2/files/0x00070000000234a7-47.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XlIANLm.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\VWdJBqH.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\OuRfbuU.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\jkXwzPs.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\hxafELk.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\AdGShuP.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\pvybOVW.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\STFvZgs.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\ToyAIjs.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\IPYmsso.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\yyzfHtX.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\HQaIPRp.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\nxeQqzE.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\WedGEvV.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\apglAOH.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\nNgXKxx.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\OpnTuLC.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\czvYACP.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\qofMWtJ.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\YKIIzYY.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\ZucxOFd.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\SxfDRYm.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\YikbiPQ.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\eQGrXvP.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\ZxTGvzf.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\MvIwcGz.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\xnWZyPn.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\IKIPXdr.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\QqgbHxO.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\DOspqdK.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\fBpFjCb.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\HvBRJfD.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\TapXCwD.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\BvHngiM.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\fOBmZOq.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\aIqdDHE.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\ggfjomb.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\ShmpehQ.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\zKidudc.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\cmBPYhB.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\XeQGUwx.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\uLjFIzi.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\gDFbTlO.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\jRtQRpg.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\VPCOuXZ.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\ozFybZD.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\ThQwmEl.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\hMhkrLD.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\evieSDw.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\vwTwIBd.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\GfupylX.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\AkBrzCg.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\mWsECSP.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\PLfYxEv.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\GDKfWOB.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\QapSmXK.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\eahWSXx.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\EJqUKqX.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\QOveFwk.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\LQhLHWt.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\EHjLYvb.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\btINjsN.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\kBCQiOV.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
File created	C:\Windows\System\YwuNTVz.exe	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 3700	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	84
PID 1532 wrote to memory of 3700	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	84
PID 1532 wrote to memory of 2400	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	85
PID 1532 wrote to memory of 2400	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	85
PID 1532 wrote to memory of 532	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	86
PID 1532 wrote to memory of 532	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	86
PID 1532 wrote to memory of 1888	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	87
PID 1532 wrote to memory of 1888	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	87
PID 1532 wrote to memory of 2456	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	88
PID 1532 wrote to memory of 2456	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	88
PID 1532 wrote to memory of 1232	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	89
PID 1532 wrote to memory of 1232	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	89
PID 1532 wrote to memory of 3172	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	90
PID 1532 wrote to memory of 3172	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	90
PID 1532 wrote to memory of 2524	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	91
PID 1532 wrote to memory of 2524	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	91
PID 1532 wrote to memory of 2648	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	92
PID 1532 wrote to memory of 2648	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	92
PID 1532 wrote to memory of 3224	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	93
PID 1532 wrote to memory of 3224	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	93
PID 1532 wrote to memory of 4796	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	94
PID 1532 wrote to memory of 4796	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	94
PID 1532 wrote to memory of 3456	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	95
PID 1532 wrote to memory of 3456	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	95
PID 1532 wrote to memory of 2756	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	96
PID 1532 wrote to memory of 2756	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	96
PID 1532 wrote to memory of 4340	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	97
PID 1532 wrote to memory of 4340	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	97
PID 1532 wrote to memory of 4024	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	98
PID 1532 wrote to memory of 4024	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	98
PID 1532 wrote to memory of 4108	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	99
PID 1532 wrote to memory of 4108	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	99
PID 1532 wrote to memory of 2256	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	100
PID 1532 wrote to memory of 2256	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	100
PID 1532 wrote to memory of 1516	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	101
PID 1532 wrote to memory of 1516	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	101
PID 1532 wrote to memory of 1288	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	102
PID 1532 wrote to memory of 1288	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	102
PID 1532 wrote to memory of 4744	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	103
PID 1532 wrote to memory of 4744	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	103
PID 1532 wrote to memory of 3440	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	104
PID 1532 wrote to memory of 3440	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	104
PID 1532 wrote to memory of 2776	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	105
PID 1532 wrote to memory of 2776	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	105
PID 1532 wrote to memory of 4792	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	106
PID 1532 wrote to memory of 4792	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	106
PID 1532 wrote to memory of 3964	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	107
PID 1532 wrote to memory of 3964	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	107
PID 1532 wrote to memory of 1940	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	108
PID 1532 wrote to memory of 1940	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	108
PID 1532 wrote to memory of 3032	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	109
PID 1532 wrote to memory of 3032	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	109
PID 1532 wrote to memory of 5056	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	110
PID 1532 wrote to memory of 5056	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	110
PID 1532 wrote to memory of 3476	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	111
PID 1532 wrote to memory of 3476	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	111
PID 1532 wrote to memory of 3512	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	112
PID 1532 wrote to memory of 3512	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	112
PID 1532 wrote to memory of 4624	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	113
PID 1532 wrote to memory of 4624	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	113
PID 1532 wrote to memory of 668	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	114
PID 1532 wrote to memory of 668	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	114
PID 1532 wrote to memory of 8	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	115
PID 1532 wrote to memory of 8	1532	b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b9c002da54d5fb8d7b77303a6bb7d810_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\System\TiyBiRf.exe
  C:\Windows\System\TiyBiRf.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\fOBmZOq.exe
  C:\Windows\System\fOBmZOq.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\BOOcXHA.exe
  C:\Windows\System\BOOcXHA.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\KzFtaPt.exe
  C:\Windows\System\KzFtaPt.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\NPDyRoR.exe
  C:\Windows\System\NPDyRoR.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\COnWFTU.exe
  C:\Windows\System\COnWFTU.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\PSYQpKv.exe
  C:\Windows\System\PSYQpKv.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\uOfzBfL.exe
  C:\Windows\System\uOfzBfL.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\EaVWKnL.exe
  C:\Windows\System\EaVWKnL.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\KUnLvmd.exe
  C:\Windows\System\KUnLvmd.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\RRkBDoz.exe
  C:\Windows\System\RRkBDoz.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\ykkwnpm.exe
  C:\Windows\System\ykkwnpm.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\RcnnBqb.exe
  C:\Windows\System\RcnnBqb.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\uKykgno.exe
  C:\Windows\System\uKykgno.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\ZxTGvzf.exe
  C:\Windows\System\ZxTGvzf.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\WOHBgSY.exe
  C:\Windows\System\WOHBgSY.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\wlxddLL.exe
  C:\Windows\System\wlxddLL.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\erxKGEn.exe
  C:\Windows\System\erxKGEn.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\kKIjQhu.exe
  C:\Windows\System\kKIjQhu.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\DgSqhRw.exe
  C:\Windows\System\DgSqhRw.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\WEpYJyU.exe
  C:\Windows\System\WEpYJyU.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\hFWVRVb.exe
  C:\Windows\System\hFWVRVb.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\scGKkwO.exe
  C:\Windows\System\scGKkwO.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\PxDMHpu.exe
  C:\Windows\System\PxDMHpu.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\XOOmDrF.exe
  C:\Windows\System\XOOmDrF.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\nmUSSrs.exe
  C:\Windows\System\nmUSSrs.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\HKGMlAa.exe
  C:\Windows\System\HKGMlAa.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\nLmfgtE.exe
  C:\Windows\System\nLmfgtE.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\LLyyMOu.exe
  C:\Windows\System\LLyyMOu.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\bBETmfa.exe
  C:\Windows\System\bBETmfa.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\uDbwBOH.exe
  C:\Windows\System\uDbwBOH.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\VPCOuXZ.exe
  C:\Windows\System\VPCOuXZ.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\QOveFwk.exe
  C:\Windows\System\QOveFwk.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\qCaAWSZ.exe
  C:\Windows\System\qCaAWSZ.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\njHHPXU.exe
  C:\Windows\System\njHHPXU.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\KlGeEIr.exe
  C:\Windows\System\KlGeEIr.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\mJHVivs.exe
  C:\Windows\System\mJHVivs.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\ixGWYde.exe
  C:\Windows\System\ixGWYde.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\hxafELk.exe
  C:\Windows\System\hxafELk.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\rQnIfWK.exe
  C:\Windows\System\rQnIfWK.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\wpCOSvX.exe
  C:\Windows\System\wpCOSvX.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\fBfenTV.exe
  C:\Windows\System\fBfenTV.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\bKdSJMY.exe
  C:\Windows\System\bKdSJMY.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\TLcTVrr.exe
  C:\Windows\System\TLcTVrr.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\iZjbvwc.exe
  C:\Windows\System\iZjbvwc.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\ebWBfuC.exe
  C:\Windows\System\ebWBfuC.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\ElPtOXd.exe
  C:\Windows\System\ElPtOXd.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\AuDRgAO.exe
  C:\Windows\System\AuDRgAO.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\ityjDXI.exe
  C:\Windows\System\ityjDXI.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\NYTQpBK.exe
  C:\Windows\System\NYTQpBK.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\PpLrzEw.exe
  C:\Windows\System\PpLrzEw.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\tvscsFz.exe
  C:\Windows\System\tvscsFz.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\QuPndna.exe
  C:\Windows\System\QuPndna.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\GUdNTNJ.exe
  C:\Windows\System\GUdNTNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\tcDeBjJ.exe
  C:\Windows\System\tcDeBjJ.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\LFiAnQy.exe
  C:\Windows\System\LFiAnQy.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\pojoPLS.exe
  C:\Windows\System\pojoPLS.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\Mgqnxem.exe
  C:\Windows\System\Mgqnxem.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\ZfjPIRV.exe
  C:\Windows\System\ZfjPIRV.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\OdDtHea.exe
  C:\Windows\System\OdDtHea.exe
  2⤵
  PID:2348
- C:\Windows\System\vsSWojQ.exe
  C:\Windows\System\vsSWojQ.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\wLDljgX.exe
  C:\Windows\System\wLDljgX.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\aLfXkYR.exe
  C:\Windows\System\aLfXkYR.exe
  2⤵
  PID:1340
- C:\Windows\System\gcDVNvd.exe
  C:\Windows\System\gcDVNvd.exe
  2⤵
  PID:4988
- C:\Windows\System\IvVdfWK.exe
  C:\Windows\System\IvVdfWK.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\BBhWAnd.exe
  C:\Windows\System\BBhWAnd.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\ivROwMW.exe
  C:\Windows\System\ivROwMW.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\yoXHTmK.exe
  C:\Windows\System\yoXHTmK.exe
  2⤵
  PID:3244
- C:\Windows\System\NpMvrjt.exe
  C:\Windows\System\NpMvrjt.exe
  2⤵
  PID:4924
- C:\Windows\System\qRWjnvp.exe
  C:\Windows\System\qRWjnvp.exe
  2⤵
  PID:1016
- C:\Windows\System\RlwrJSB.exe
  C:\Windows\System\RlwrJSB.exe
  2⤵
  PID:4528
- C:\Windows\System\LIqjMOB.exe
  C:\Windows\System\LIqjMOB.exe
  2⤵
  PID:2440
- C:\Windows\System\sesXkEG.exe
  C:\Windows\System\sesXkEG.exe
  2⤵
  PID:1372
- C:\Windows\System\FrvuSAh.exe
  C:\Windows\System\FrvuSAh.exe
  2⤵
  PID:824
- C:\Windows\System\JFNSlSe.exe
  C:\Windows\System\JFNSlSe.exe
  2⤵
  PID:4916
- C:\Windows\System\ivcnrjt.exe
  C:\Windows\System\ivcnrjt.exe
  2⤵
  PID:1540
- C:\Windows\System\XhQHTJH.exe
  C:\Windows\System\XhQHTJH.exe
  2⤵
  PID:2660
- C:\Windows\System\gHcxreL.exe
  C:\Windows\System\gHcxreL.exe
  2⤵
  PID:2700
- C:\Windows\System\AklYfJz.exe
  C:\Windows\System\AklYfJz.exe
  2⤵
  PID:3132
- C:\Windows\System\nGGupBq.exe
  C:\Windows\System\nGGupBq.exe
  2⤵
  PID:1816
- C:\Windows\System\hEOUfBc.exe
  C:\Windows\System\hEOUfBc.exe
  2⤵
  PID:4396
- C:\Windows\System\xigufTp.exe
  C:\Windows\System\xigufTp.exe
  2⤵
  PID:5096
- C:\Windows\System\xNwwprR.exe
  C:\Windows\System\xNwwprR.exe
  2⤵
  PID:4524
- C:\Windows\System\pxNRmGx.exe
  C:\Windows\System\pxNRmGx.exe
  2⤵
  PID:5124
- C:\Windows\System\ixPuPfy.exe
  C:\Windows\System\ixPuPfy.exe
  2⤵
  PID:5144
- C:\Windows\System\OuTYQqW.exe
  C:\Windows\System\OuTYQqW.exe
  2⤵
  PID:5160
- C:\Windows\System\HBlYeSr.exe
  C:\Windows\System\HBlYeSr.exe
  2⤵
  PID:5220
- C:\Windows\System\MwENTYj.exe
  C:\Windows\System\MwENTYj.exe
  2⤵
  PID:5248
- C:\Windows\System\VFPXvWP.exe
  C:\Windows\System\VFPXvWP.exe
  2⤵
  PID:5264
- C:\Windows\System\QHMvgpo.exe
  C:\Windows\System\QHMvgpo.exe
  2⤵
  PID:5284
- C:\Windows\System\tUqPRuy.exe
  C:\Windows\System\tUqPRuy.exe
  2⤵
  PID:5312
- C:\Windows\System\JpqdvRC.exe
  C:\Windows\System\JpqdvRC.exe
  2⤵
  PID:5332
- C:\Windows\System\FUGHvky.exe
  C:\Windows\System\FUGHvky.exe
  2⤵
  PID:5356
- C:\Windows\System\LtBbDnt.exe
  C:\Windows\System\LtBbDnt.exe
  2⤵
  PID:5372
- C:\Windows\System\qofMWtJ.exe
  C:\Windows\System\qofMWtJ.exe
  2⤵
  PID:5392
- C:\Windows\System\aLZzgEV.exe
  C:\Windows\System\aLZzgEV.exe
  2⤵
  PID:5408
- C:\Windows\System\AlXhSYB.exe
  C:\Windows\System\AlXhSYB.exe
  2⤵
  PID:5424
- C:\Windows\System\AkBrzCg.exe
  C:\Windows\System\AkBrzCg.exe
  2⤵
  PID:5444
- C:\Windows\System\BbtNSkG.exe
  C:\Windows\System\BbtNSkG.exe
  2⤵
  PID:5460
- C:\Windows\System\hgeDeKr.exe
  C:\Windows\System\hgeDeKr.exe
  2⤵
  PID:5476
- C:\Windows\System\rMpsHtW.exe
  C:\Windows\System\rMpsHtW.exe
  2⤵
  PID:5504
- C:\Windows\System\eqDijJl.exe
  C:\Windows\System\eqDijJl.exe
  2⤵
  PID:5524
- C:\Windows\System\AYazioq.exe
  C:\Windows\System\AYazioq.exe
  2⤵
  PID:5552
- C:\Windows\System\MugbXSQ.exe
  C:\Windows\System\MugbXSQ.exe
  2⤵
  PID:5568
- C:\Windows\System\RtEYTGr.exe
  C:\Windows\System\RtEYTGr.exe
  2⤵
  PID:5588
- C:\Windows\System\IJgnmbj.exe
  C:\Windows\System\IJgnmbj.exe
  2⤵
  PID:5604
- C:\Windows\System\ODGdOxZ.exe
  C:\Windows\System\ODGdOxZ.exe
  2⤵
  PID:5668
- C:\Windows\System\MrYvkan.exe
  C:\Windows\System\MrYvkan.exe
  2⤵
  PID:5684
- C:\Windows\System\wcnHeQM.exe
  C:\Windows\System\wcnHeQM.exe
  2⤵
  PID:5712
- C:\Windows\System\KFYXAGy.exe
  C:\Windows\System\KFYXAGy.exe
  2⤵
  PID:5772
- C:\Windows\System\eSLmGgf.exe
  C:\Windows\System\eSLmGgf.exe
  2⤵
  PID:5788
- C:\Windows\System\XLWwxtB.exe
  C:\Windows\System\XLWwxtB.exe
  2⤵
  PID:5820
- C:\Windows\System\zmYFikk.exe
  C:\Windows\System\zmYFikk.exe
  2⤵
  PID:5836
- C:\Windows\System\jPEvYRh.exe
  C:\Windows\System\jPEvYRh.exe
  2⤵
  PID:5852
- C:\Windows\System\UvlLNvS.exe
  C:\Windows\System\UvlLNvS.exe
  2⤵
  PID:5880
- C:\Windows\System\bWtNhVz.exe
  C:\Windows\System\bWtNhVz.exe
  2⤵
  PID:5904
- C:\Windows\System\aVmBHGt.exe
  C:\Windows\System\aVmBHGt.exe
  2⤵
  PID:5920
- C:\Windows\System\aMoKDNT.exe
  C:\Windows\System\aMoKDNT.exe
  2⤵
  PID:5936
- C:\Windows\System\uVyxJin.exe
  C:\Windows\System\uVyxJin.exe
  2⤵
  PID:5960
- C:\Windows\System\lDekEbn.exe
  C:\Windows\System\lDekEbn.exe
  2⤵
  PID:5980
- C:\Windows\System\EHISuPs.exe
  C:\Windows\System\EHISuPs.exe
  2⤵
  PID:6000
- C:\Windows\System\TJWCWSs.exe
  C:\Windows\System\TJWCWSs.exe
  2⤵
  PID:6016
- C:\Windows\System\yGwosiO.exe
  C:\Windows\System\yGwosiO.exe
  2⤵
  PID:6040
- C:\Windows\System\xfWgMzt.exe
  C:\Windows\System\xfWgMzt.exe
  2⤵
  PID:6060
- C:\Windows\System\yUtSBBE.exe
  C:\Windows\System\yUtSBBE.exe
  2⤵
  PID:6084
- C:\Windows\System\JbYyOiX.exe
  C:\Windows\System\JbYyOiX.exe
  2⤵
  PID:6100
- C:\Windows\System\VSknhpS.exe
  C:\Windows\System\VSknhpS.exe
  2⤵
  PID:6120
- C:\Windows\System\XsknruC.exe
  C:\Windows\System\XsknruC.exe
  2⤵
  PID:6140
- C:\Windows\System\MMfblRm.exe
  C:\Windows\System\MMfblRm.exe
  2⤵
  PID:1884
- C:\Windows\System\HrDgPsl.exe
  C:\Windows\System\HrDgPsl.exe
  2⤵
  PID:1560
- C:\Windows\System\oWanIOT.exe
  C:\Windows\System\oWanIOT.exe
  2⤵
  PID:820
- C:\Windows\System\UpqzpLR.exe
  C:\Windows\System\UpqzpLR.exe
  2⤵
  PID:1760
- C:\Windows\System\JNfEXfE.exe
  C:\Windows\System\JNfEXfE.exe
  2⤵
  PID:4720
- C:\Windows\System\dRWxKeb.exe
  C:\Windows\System\dRWxKeb.exe
  2⤵
  PID:5388
- C:\Windows\System\afEwCtA.exe
  C:\Windows\System\afEwCtA.exe
  2⤵
  PID:4956
- C:\Windows\System\AdGShuP.exe
  C:\Windows\System\AdGShuP.exe
  2⤵
  PID:536
- C:\Windows\System\TOuezci.exe
  C:\Windows\System\TOuezci.exe
  2⤵
  PID:4144
- C:\Windows\System\wEcpQSY.exe
  C:\Windows\System\wEcpQSY.exe
  2⤵
  PID:3292
- C:\Windows\System\mMsnihF.exe
  C:\Windows\System\mMsnihF.exe
  2⤵
  PID:2248
- C:\Windows\System\degTQwJ.exe
  C:\Windows\System\degTQwJ.exe
  2⤵
  PID:4940
- C:\Windows\System\FjzDjkc.exe
  C:\Windows\System\FjzDjkc.exe
  2⤵
  PID:3828
- C:\Windows\System\EUWPKzM.exe
  C:\Windows\System\EUWPKzM.exe
  2⤵
  PID:1956
- C:\Windows\System\KvnzTJg.exe
  C:\Windows\System\KvnzTJg.exe
  2⤵
  PID:1944
- C:\Windows\System\tgFPSYf.exe
  C:\Windows\System\tgFPSYf.exe
  2⤵
  PID:6028
- C:\Windows\System\OkWEKBL.exe
  C:\Windows\System\OkWEKBL.exe
  2⤵
  PID:6148
- C:\Windows\System\kAkavfA.exe
  C:\Windows\System\kAkavfA.exe
  2⤵
  PID:6164
- C:\Windows\System\BnGEwyz.exe
  C:\Windows\System\BnGEwyz.exe
  2⤵
  PID:6192
- C:\Windows\System\mqsxXel.exe
  C:\Windows\System\mqsxXel.exe
  2⤵
  PID:6212
- C:\Windows\System\mBjyINT.exe
  C:\Windows\System\mBjyINT.exe
  2⤵
  PID:6252
- C:\Windows\System\hIcItFL.exe
  C:\Windows\System\hIcItFL.exe
  2⤵
  PID:6268
- C:\Windows\System\WbMUhSZ.exe
  C:\Windows\System\WbMUhSZ.exe
  2⤵
  PID:6284
- C:\Windows\System\nxeQqzE.exe
  C:\Windows\System\nxeQqzE.exe
  2⤵
  PID:6300
- C:\Windows\System\BFAdkjq.exe
  C:\Windows\System\BFAdkjq.exe
  2⤵
  PID:6320
- C:\Windows\System\CmhQUjA.exe
  C:\Windows\System\CmhQUjA.exe
  2⤵
  PID:6336
- C:\Windows\System\gFMiZxV.exe
  C:\Windows\System\gFMiZxV.exe
  2⤵
  PID:6372
- C:\Windows\System\FDEcybK.exe
  C:\Windows\System\FDEcybK.exe
  2⤵
  PID:6396
- C:\Windows\System\EnTLpHR.exe
  C:\Windows\System\EnTLpHR.exe
  2⤵
  PID:6420
- C:\Windows\System\lamsJyy.exe
  C:\Windows\System\lamsJyy.exe
  2⤵
  PID:6440
- C:\Windows\System\YJnSTCw.exe
  C:\Windows\System\YJnSTCw.exe
  2⤵
  PID:6460
- C:\Windows\System\IYmbdVI.exe
  C:\Windows\System\IYmbdVI.exe
  2⤵
  PID:6488
- C:\Windows\System\vlrFEuU.exe
  C:\Windows\System\vlrFEuU.exe
  2⤵
  PID:6508
- C:\Windows\System\aIqdDHE.exe
  C:\Windows\System\aIqdDHE.exe
  2⤵
  PID:6528
- C:\Windows\System\fBpFjCb.exe
  C:\Windows\System\fBpFjCb.exe
  2⤵
  PID:6552
- C:\Windows\System\zPzddWo.exe
  C:\Windows\System\zPzddWo.exe
  2⤵
  PID:6572
- C:\Windows\System\GJRmWSH.exe
  C:\Windows\System\GJRmWSH.exe
  2⤵
  PID:6592
- C:\Windows\System\kQQqiqy.exe
  C:\Windows\System\kQQqiqy.exe
  2⤵
  PID:6612
- C:\Windows\System\emGMxUq.exe
  C:\Windows\System\emGMxUq.exe
  2⤵
  PID:6636
- C:\Windows\System\ZJPCqqV.exe
  C:\Windows\System\ZJPCqqV.exe
  2⤵
  PID:6664
- C:\Windows\System\xCafoSw.exe
  C:\Windows\System\xCafoSw.exe
  2⤵
  PID:6688
- C:\Windows\System\ioXfrXl.exe
  C:\Windows\System\ioXfrXl.exe
  2⤵
  PID:6704
- C:\Windows\System\pvybOVW.exe
  C:\Windows\System\pvybOVW.exe
  2⤵
  PID:6724
- C:\Windows\System\YKIIzYY.exe
  C:\Windows\System\YKIIzYY.exe
  2⤵
  PID:6744
- C:\Windows\System\WedGEvV.exe
  C:\Windows\System\WedGEvV.exe
  2⤵
  PID:6760
- C:\Windows\System\cCiZexk.exe
  C:\Windows\System\cCiZexk.exe
  2⤵
  PID:6780
- C:\Windows\System\HbyciAf.exe
  C:\Windows\System\HbyciAf.exe
  2⤵
  PID:6820
- C:\Windows\System\sKnqkKw.exe
  C:\Windows\System\sKnqkKw.exe
  2⤵
  PID:6836
- C:\Windows\System\iIerZTZ.exe
  C:\Windows\System\iIerZTZ.exe
  2⤵
  PID:7108
- C:\Windows\System\vvXOVBb.exe
  C:\Windows\System\vvXOVBb.exe
  2⤵
  PID:7124
- C:\Windows\System\lcqGmGs.exe
  C:\Windows\System\lcqGmGs.exe
  2⤵
  PID:7140
- C:\Windows\System\TxtkvMx.exe
  C:\Windows\System\TxtkvMx.exe
  2⤵
  PID:7156
- C:\Windows\System\IljYLaA.exe
  C:\Windows\System\IljYLaA.exe
  2⤵
  PID:1796
- C:\Windows\System\djrlUvu.exe
  C:\Windows\System\djrlUvu.exe
  2⤵
  PID:5136
- C:\Windows\System\GSgCaPG.exe
  C:\Windows\System\GSgCaPG.exe
  2⤵
  PID:5172
- C:\Windows\System\MvIwcGz.exe
  C:\Windows\System\MvIwcGz.exe
  2⤵
  PID:5212
- C:\Windows\System\OOxMGVJ.exe
  C:\Windows\System\OOxMGVJ.exe
  2⤵
  PID:5256
- C:\Windows\System\nxkcmaF.exe
  C:\Windows\System\nxkcmaF.exe
  2⤵
  PID:5292
- C:\Windows\System\HzvYbOS.exe
  C:\Windows\System\HzvYbOS.exe
  2⤵
  PID:5324
- C:\Windows\System\aFEwpyl.exe
  C:\Windows\System\aFEwpyl.exe
  2⤵
  PID:5352
- C:\Windows\System\dedSUkO.exe
  C:\Windows\System\dedSUkO.exe
  2⤵
  PID:3708
- C:\Windows\System\NUMsKGE.exe
  C:\Windows\System\NUMsKGE.exe
  2⤵
  PID:5420
- C:\Windows\System\XVaPaNA.exe
  C:\Windows\System\XVaPaNA.exe
  2⤵
  PID:5456
- C:\Windows\System\cbqFvlj.exe
  C:\Windows\System\cbqFvlj.exe
  2⤵
  PID:5492
- C:\Windows\System\uSptvDQ.exe
  C:\Windows\System\uSptvDQ.exe
  2⤵
  PID:5512
- C:\Windows\System\CSCBUgg.exe
  C:\Windows\System\CSCBUgg.exe
  2⤵
  PID:5564
- C:\Windows\System\KThnmEU.exe
  C:\Windows\System\KThnmEU.exe
  2⤵
  PID:5628
- C:\Windows\System\dOUYgCh.exe
  C:\Windows\System\dOUYgCh.exe
  2⤵
  PID:5676
- C:\Windows\System\GnDMeDj.exe
  C:\Windows\System\GnDMeDj.exe
  2⤵
  PID:5700
- C:\Windows\System\CscVOqj.exe
  C:\Windows\System\CscVOqj.exe
  2⤵
  PID:5780
- C:\Windows\System\pVfdvVF.exe
  C:\Windows\System\pVfdvVF.exe
  2⤵
  PID:1592
- C:\Windows\System\pzYjBOI.exe
  C:\Windows\System\pzYjBOI.exe
  2⤵
  PID:5024
- C:\Windows\System\MTPKztY.exe
  C:\Windows\System\MTPKztY.exe
  2⤵
  PID:952
- C:\Windows\System\IPYmsso.exe
  C:\Windows\System\IPYmsso.exe
  2⤵
  PID:5600
- C:\Windows\System\LZIntzs.exe
  C:\Windows\System\LZIntzs.exe
  2⤵
  PID:456
- C:\Windows\System\mWsECSP.exe
  C:\Windows\System\mWsECSP.exe
  2⤵
  PID:5364
- C:\Windows\System\TYQJKcv.exe
  C:\Windows\System\TYQJKcv.exe
  2⤵
  PID:4484
- C:\Windows\System\MOveKTH.exe
  C:\Windows\System\MOveKTH.exe
  2⤵
  PID:5996
- C:\Windows\System\CCkILgL.exe
  C:\Windows\System\CCkILgL.exe
  2⤵
  PID:6156
- C:\Windows\System\XoreIXE.exe
  C:\Windows\System\XoreIXE.exe
  2⤵
  PID:6220
- C:\Windows\System\xnWZyPn.exe
  C:\Windows\System\xnWZyPn.exe
  2⤵
  PID:6280
- C:\Windows\System\ksOUyzG.exe
  C:\Windows\System\ksOUyzG.exe
  2⤵
  PID:6380
- C:\Windows\System\reRDydt.exe
  C:\Windows\System\reRDydt.exe
  2⤵
  PID:6516
- C:\Windows\System\mLmilzp.exe
  C:\Windows\System\mLmilzp.exe
  2⤵
  PID:6768
- C:\Windows\System\HyZiTPA.exe
  C:\Windows\System\HyZiTPA.exe
  2⤵
  PID:6332
- C:\Windows\System\zZVWVqF.exe
  C:\Windows\System\zZVWVqF.exe
  2⤵
  PID:6416
- C:\Windows\System\LsHlRYa.exe
  C:\Windows\System\LsHlRYa.exe
  2⤵
  PID:6500
- C:\Windows\System\dATbjWE.exe
  C:\Windows\System\dATbjWE.exe
  2⤵
  PID:6548
- C:\Windows\System\AERkWqr.exe
  C:\Windows\System\AERkWqr.exe
  2⤵
  PID:6604
- C:\Windows\System\gDAvERj.exe
  C:\Windows\System\gDAvERj.exe
  2⤵
  PID:6652
- C:\Windows\System\TXsTvHr.exe
  C:\Windows\System\TXsTvHr.exe
  2⤵
  PID:6752
- C:\Windows\System\QObZCLz.exe
  C:\Windows\System\QObZCLz.exe
  2⤵
  PID:6812
- C:\Windows\System\QEWnCNM.exe
  C:\Windows\System\QEWnCNM.exe
  2⤵
  PID:7176
- C:\Windows\System\CSHHvYU.exe
  C:\Windows\System\CSHHvYU.exe
  2⤵
  PID:7196
- C:\Windows\System\peaZRhq.exe
  C:\Windows\System\peaZRhq.exe
  2⤵
  PID:7220
- C:\Windows\System\DsFOsZr.exe
  C:\Windows\System\DsFOsZr.exe
  2⤵
  PID:7248
- C:\Windows\System\NkvPrLV.exe
  C:\Windows\System\NkvPrLV.exe
  2⤵
  PID:7264
- C:\Windows\System\dXIuZoT.exe
  C:\Windows\System\dXIuZoT.exe
  2⤵
  PID:7288
- C:\Windows\System\ilHBqsY.exe
  C:\Windows\System\ilHBqsY.exe
  2⤵
  PID:7308
- C:\Windows\System\TOrgAsf.exe
  C:\Windows\System\TOrgAsf.exe
  2⤵
  PID:7332
- C:\Windows\System\VEGExAY.exe
  C:\Windows\System\VEGExAY.exe
  2⤵
  PID:7352
- C:\Windows\System\wplMySZ.exe
  C:\Windows\System\wplMySZ.exe
  2⤵
  PID:7376
- C:\Windows\System\DIxrhZo.exe
  C:\Windows\System\DIxrhZo.exe
  2⤵
  PID:7396
- C:\Windows\System\rboHDbG.exe
  C:\Windows\System\rboHDbG.exe
  2⤵
  PID:7424
- C:\Windows\System\wuDPCdy.exe
  C:\Windows\System\wuDPCdy.exe
  2⤵
  PID:7448
- C:\Windows\System\YoHGjbm.exe
  C:\Windows\System\YoHGjbm.exe
  2⤵
  PID:7468
- C:\Windows\System\otvFJKa.exe
  C:\Windows\System\otvFJKa.exe
  2⤵
  PID:7488
- C:\Windows\System\XlDtTjT.exe
  C:\Windows\System\XlDtTjT.exe
  2⤵
  PID:7512
- C:\Windows\System\xVlIcfU.exe
  C:\Windows\System\xVlIcfU.exe
  2⤵
  PID:7532
- C:\Windows\System\xLDNsSw.exe
  C:\Windows\System\xLDNsSw.exe
  2⤵
  PID:7552
- C:\Windows\System\LQhLHWt.exe
  C:\Windows\System\LQhLHWt.exe
  2⤵
  PID:7572
- C:\Windows\System\ojlXizX.exe
  C:\Windows\System\ojlXizX.exe
  2⤵
  PID:7588
- C:\Windows\System\pZEfhUo.exe
  C:\Windows\System\pZEfhUo.exe
  2⤵
  PID:7608
- C:\Windows\System\nywAJNF.exe
  C:\Windows\System\nywAJNF.exe
  2⤵
  PID:7624
- C:\Windows\System\zngtlJK.exe
  C:\Windows\System\zngtlJK.exe
  2⤵
  PID:7644
- C:\Windows\System\qYNTVUJ.exe
  C:\Windows\System\qYNTVUJ.exe
  2⤵
  PID:7664
- C:\Windows\System\jkxhOST.exe
  C:\Windows\System\jkxhOST.exe
  2⤵
  PID:7684
- C:\Windows\System\yzJmlfn.exe
  C:\Windows\System\yzJmlfn.exe
  2⤵
  PID:7704
- C:\Windows\System\ggfjomb.exe
  C:\Windows\System\ggfjomb.exe
  2⤵
  PID:7728
- C:\Windows\System\DNLiXZH.exe
  C:\Windows\System\DNLiXZH.exe
  2⤵
  PID:7756
- C:\Windows\System\SuhPSOK.exe
  C:\Windows\System\SuhPSOK.exe
  2⤵
  PID:7776
- C:\Windows\System\AjgtpKm.exe
  C:\Windows\System\AjgtpKm.exe
  2⤵
  PID:7792
- C:\Windows\System\EHjLYvb.exe
  C:\Windows\System\EHjLYvb.exe
  2⤵
  PID:7808
- C:\Windows\System\DkjhXPr.exe
  C:\Windows\System\DkjhXPr.exe
  2⤵
  PID:7836
- C:\Windows\System\JPLxaTt.exe
  C:\Windows\System\JPLxaTt.exe
  2⤵
  PID:7852
- C:\Windows\System\rwlTHAr.exe
  C:\Windows\System\rwlTHAr.exe
  2⤵
  PID:7872
- C:\Windows\System\bYjgswo.exe
  C:\Windows\System\bYjgswo.exe
  2⤵
  PID:7896
- C:\Windows\System\JztaSbY.exe
  C:\Windows\System\JztaSbY.exe
  2⤵
  PID:7924
- C:\Windows\System\ncmpuHL.exe
  C:\Windows\System\ncmpuHL.exe
  2⤵
  PID:7944
- C:\Windows\System\VnXuDhz.exe
  C:\Windows\System\VnXuDhz.exe
  2⤵
  PID:7964
- C:\Windows\System\FfayHWp.exe
  C:\Windows\System\FfayHWp.exe
  2⤵
  PID:7980
- C:\Windows\System\cECyIPP.exe
  C:\Windows\System\cECyIPP.exe
  2⤵
  PID:8000
- C:\Windows\System\TMtTHnu.exe
  C:\Windows\System\TMtTHnu.exe
  2⤵
  PID:8016
- C:\Windows\System\SMzJCJY.exe
  C:\Windows\System\SMzJCJY.exe
  2⤵
  PID:8032
- C:\Windows\System\PLfYxEv.exe
  C:\Windows\System\PLfYxEv.exe
  2⤵
  PID:8048
- C:\Windows\System\UQvYTXd.exe
  C:\Windows\System\UQvYTXd.exe
  2⤵
  PID:8064
- C:\Windows\System\ozFybZD.exe
  C:\Windows\System\ozFybZD.exe
  2⤵
  PID:8080
- C:\Windows\System\NdQjfiP.exe
  C:\Windows\System\NdQjfiP.exe
  2⤵
  PID:8356
- C:\Windows\System\lMayjye.exe
  C:\Windows\System\lMayjye.exe
  2⤵
  PID:8376
- C:\Windows\System\KtDfQXL.exe
  C:\Windows\System\KtDfQXL.exe
  2⤵
  PID:8392
- C:\Windows\System\mmGrjcP.exe
  C:\Windows\System\mmGrjcP.exe
  2⤵
  PID:8408
- C:\Windows\System\OrsqrZn.exe
  C:\Windows\System\OrsqrZn.exe
  2⤵
  PID:8424
- C:\Windows\System\RpRKolz.exe
  C:\Windows\System\RpRKolz.exe
  2⤵
  PID:8440
- C:\Windows\System\DeVJuCR.exe
  C:\Windows\System\DeVJuCR.exe
  2⤵
  PID:8460
- C:\Windows\System\OnhHGfw.exe
  C:\Windows\System\OnhHGfw.exe
  2⤵
  PID:8476
- C:\Windows\System\ZGJlruA.exe
  C:\Windows\System\ZGJlruA.exe
  2⤵
  PID:8492
- C:\Windows\System\lICleIK.exe
  C:\Windows\System\lICleIK.exe
  2⤵
  PID:8508
- C:\Windows\System\UYTAAvo.exe
  C:\Windows\System\UYTAAvo.exe
  2⤵
  PID:8524
- C:\Windows\System\ZucxOFd.exe
  C:\Windows\System\ZucxOFd.exe
  2⤵
  PID:8540
- C:\Windows\System\XfFJvuJ.exe
  C:\Windows\System\XfFJvuJ.exe
  2⤵
  PID:8560
- C:\Windows\System\bNtbVYc.exe
  C:\Windows\System\bNtbVYc.exe
  2⤵
  PID:8576
- C:\Windows\System\lZgZTKA.exe
  C:\Windows\System\lZgZTKA.exe
  2⤵
  PID:8592
- C:\Windows\System\qflItzK.exe
  C:\Windows\System\qflItzK.exe
  2⤵
  PID:8608
- C:\Windows\System\HGoylTm.exe
  C:\Windows\System\HGoylTm.exe
  2⤵
  PID:8624
- C:\Windows\System\zftwDqp.exe
  C:\Windows\System\zftwDqp.exe
  2⤵
  PID:8640
- C:\Windows\System\SEcriZO.exe
  C:\Windows\System\SEcriZO.exe
  2⤵
  PID:8664
- C:\Windows\System\xzPdtYu.exe
  C:\Windows\System\xzPdtYu.exe
  2⤵
  PID:8684
- C:\Windows\System\yGHOmrn.exe
  C:\Windows\System\yGHOmrn.exe
  2⤵
  PID:8700
- C:\Windows\System\tDNRvWI.exe
  C:\Windows\System\tDNRvWI.exe
  2⤵
  PID:8716
- C:\Windows\System\WiBNbGp.exe
  C:\Windows\System\WiBNbGp.exe
  2⤵
  PID:8732
- C:\Windows\System\tQDtWmb.exe
  C:\Windows\System\tQDtWmb.exe
  2⤵
  PID:8756
- C:\Windows\System\drQGWlN.exe
  C:\Windows\System\drQGWlN.exe
  2⤵
  PID:8776
- C:\Windows\System\JYuLQqk.exe
  C:\Windows\System\JYuLQqk.exe
  2⤵
  PID:8804
- C:\Windows\System\WmCJcpQ.exe
  C:\Windows\System\WmCJcpQ.exe
  2⤵
  PID:8820
- C:\Windows\System\ptsUxOR.exe
  C:\Windows\System\ptsUxOR.exe
  2⤵
  PID:8904
- C:\Windows\System\HvFTnAV.exe
  C:\Windows\System\HvFTnAV.exe
  2⤵
  PID:8920
- C:\Windows\System\uLIGhhX.exe
  C:\Windows\System\uLIGhhX.exe
  2⤵
  PID:8936
- C:\Windows\System\erSojPD.exe
  C:\Windows\System\erSojPD.exe
  2⤵
  PID:8956
- C:\Windows\System\JiQAxWW.exe
  C:\Windows\System\JiQAxWW.exe
  2⤵
  PID:8972
- C:\Windows\System\HvBRJfD.exe
  C:\Windows\System\HvBRJfD.exe
  2⤵
  PID:8988
- C:\Windows\System\UFKZGPC.exe
  C:\Windows\System\UFKZGPC.exe
  2⤵
  PID:9012
- C:\Windows\System\QNmIkdv.exe
  C:\Windows\System\QNmIkdv.exe
  2⤵
  PID:9032
- C:\Windows\System\QvGZTiT.exe
  C:\Windows\System\QvGZTiT.exe
  2⤵
  PID:9052
- C:\Windows\System\Idoqrsx.exe
  C:\Windows\System\Idoqrsx.exe
  2⤵
  PID:9072
- C:\Windows\System\tCskANc.exe
  C:\Windows\System\tCskANc.exe
  2⤵
  PID:9096
- C:\Windows\System\WyhDjwl.exe
  C:\Windows\System\WyhDjwl.exe
  2⤵
  PID:9116
- C:\Windows\System\STFvZgs.exe
  C:\Windows\System\STFvZgs.exe
  2⤵
  PID:9140
- C:\Windows\System\oUuFvgj.exe
  C:\Windows\System\oUuFvgj.exe
  2⤵
  PID:9164
- C:\Windows\System\ewrObAn.exe
  C:\Windows\System\ewrObAn.exe
  2⤵
  PID:9188
- C:\Windows\System\bLZAMzu.exe
  C:\Windows\System\bLZAMzu.exe
  2⤵
  PID:9208
- C:\Windows\System\PNtFfyC.exe
  C:\Windows\System\PNtFfyC.exe
  2⤵
  PID:7736
- C:\Windows\System\SfAPbGy.exe
  C:\Windows\System\SfAPbGy.exe
  2⤵
  PID:7888
- C:\Windows\System\xVNCSja.exe
  C:\Windows\System\xVNCSja.exe
  2⤵
  PID:7692
- C:\Windows\System\DdMbYsK.exe
  C:\Windows\System\DdMbYsK.exe
  2⤵
  PID:7120
- C:\Windows\System\FddoWgO.exe
  C:\Windows\System\FddoWgO.exe
  2⤵
  PID:7152
- C:\Windows\System\FPpVyCT.exe
  C:\Windows\System\FPpVyCT.exe
  2⤵
  PID:5180
- C:\Windows\System\fEhxgYv.exe
  C:\Windows\System\fEhxgYv.exe
  2⤵
  PID:5308
- C:\Windows\System\OWQnqzr.exe
  C:\Windows\System\OWQnqzr.exe
  2⤵
  PID:5436
- C:\Windows\System\KJvDrNj.exe
  C:\Windows\System\KJvDrNj.exe
  2⤵
  PID:5532
- C:\Windows\System\oVMrQcA.exe
  C:\Windows\System\oVMrQcA.exe
  2⤵
  PID:5656
- C:\Windows\System\ijffHca.exe
  C:\Windows\System\ijffHca.exe
  2⤵
  PID:5756
- C:\Windows\System\ieaCjDQ.exe
  C:\Windows\System\ieaCjDQ.exe
  2⤵
  PID:1768
- C:\Windows\System\XRYeqVY.exe
  C:\Windows\System\XRYeqVY.exe
  2⤵
  PID:4644
- C:\Windows\System\BbWaNWu.exe
  C:\Windows\System\BbWaNWu.exe
  2⤵
  PID:4672
- C:\Windows\System\ZwYpqMp.exe
  C:\Windows\System\ZwYpqMp.exe
  2⤵
  PID:3120
- C:\Windows\System\apglAOH.exe
  C:\Windows\System\apglAOH.exe
  2⤵
  PID:1424
- C:\Windows\System\hOIxPnA.exe
  C:\Windows\System\hOIxPnA.exe
  2⤵
  PID:6024
- C:\Windows\System\pcFCvmj.exe
  C:\Windows\System\pcFCvmj.exe
  2⤵
  PID:6200
- C:\Windows\System\AKVocRb.exe
  C:\Windows\System\AKVocRb.exe
  2⤵
  PID:6312
- C:\Windows\System\vvsNEvN.exe
  C:\Windows\System\vvsNEvN.exe
  2⤵
  PID:6800
- C:\Windows\System\ToyAIjs.exe
  C:\Windows\System\ToyAIjs.exe
  2⤵
  PID:6412
- C:\Windows\System\SxfDRYm.exe
  C:\Windows\System\SxfDRYm.exe
  2⤵
  PID:8832
- C:\Windows\System\jtOLEtA.exe
  C:\Windows\System\jtOLEtA.exe
  2⤵
  PID:6628
- C:\Windows\System\NhpeLCI.exe
  C:\Windows\System\NhpeLCI.exe
  2⤵
  PID:6828
- C:\Windows\System\uzmUIrq.exe
  C:\Windows\System\uzmUIrq.exe
  2⤵
  PID:7596
- C:\Windows\System\ztNYkZp.exe
  C:\Windows\System\ztNYkZp.exe
  2⤵
  PID:7548
- C:\Windows\System\fFmRujt.exe
  C:\Windows\System\fFmRujt.exe
  2⤵
  PID:7508
- C:\Windows\System\OnCOCBR.exe
  C:\Windows\System\OnCOCBR.exe
  2⤵
  PID:7440
- C:\Windows\System\TXIfKKE.exe
  C:\Windows\System\TXIfKKE.exe
  2⤵
  PID:7392
- C:\Windows\System\uuKSzLN.exe
  C:\Windows\System\uuKSzLN.exe
  2⤵
  PID:7340
- C:\Windows\System\EIkCJnr.exe
  C:\Windows\System\EIkCJnr.exe
  2⤵
  PID:7284
- C:\Windows\System\QOtkzpk.exe
  C:\Windows\System\QOtkzpk.exe
  2⤵
  PID:7236
- C:\Windows\System\HIhmSLR.exe
  C:\Windows\System\HIhmSLR.exe
  2⤵
  PID:7204
- C:\Windows\System\jtxgJvK.exe
  C:\Windows\System\jtxgJvK.exe
  2⤵
  PID:7660
- C:\Windows\System\lTWvtrb.exe
  C:\Windows\System\lTWvtrb.exe
  2⤵
  PID:7724
- C:\Windows\System\lxwWmZP.exe
  C:\Windows\System\lxwWmZP.exe
  2⤵
  PID:7764
- C:\Windows\System\ubRdwHi.exe
  C:\Windows\System\ubRdwHi.exe
  2⤵
  PID:7820
- C:\Windows\System\GDKfWOB.exe
  C:\Windows\System\GDKfWOB.exe
  2⤵
  PID:7904
- C:\Windows\System\IKIPXdr.exe
  C:\Windows\System\IKIPXdr.exe
  2⤵
  PID:7956
- C:\Windows\System\ufCirxG.exe
  C:\Windows\System\ufCirxG.exe
  2⤵
  PID:8008
- C:\Windows\System\mwFvbXI.exe
  C:\Windows\System\mwFvbXI.exe
  2⤵
  PID:8040
- C:\Windows\System\IniztwF.exe
  C:\Windows\System\IniztwF.exe
  2⤵
  PID:7052
- C:\Windows\System\XATmOlp.exe
  C:\Windows\System\XATmOlp.exe
  2⤵
  PID:8208
- C:\Windows\System\mRnSXMw.exe
  C:\Windows\System\mRnSXMw.exe
  2⤵
  PID:9220
- C:\Windows\System\oUmRuHy.exe
  C:\Windows\System\oUmRuHy.exe
  2⤵
  PID:9236
- C:\Windows\System\VGxlNes.exe
  C:\Windows\System\VGxlNes.exe
  2⤵
  PID:9256
- C:\Windows\System\JkPpVwM.exe
  C:\Windows\System\JkPpVwM.exe
  2⤵
  PID:9280
- C:\Windows\System\vByXwDP.exe
  C:\Windows\System\vByXwDP.exe
  2⤵
  PID:9304
- C:\Windows\System\lJVUZQx.exe
  C:\Windows\System\lJVUZQx.exe
  2⤵
  PID:9324
- C:\Windows\System\pxJHEkf.exe
  C:\Windows\System\pxJHEkf.exe
  2⤵
  PID:9344
- C:\Windows\System\QlDbaDo.exe
  C:\Windows\System\QlDbaDo.exe
  2⤵
  PID:9368
- C:\Windows\System\dMavxbn.exe
  C:\Windows\System\dMavxbn.exe
  2⤵
  PID:9384
- C:\Windows\System\FjhCUss.exe
  C:\Windows\System\FjhCUss.exe
  2⤵
  PID:9408
- C:\Windows\System\nfAOqQX.exe
  C:\Windows\System\nfAOqQX.exe
  2⤵
  PID:9436
- C:\Windows\System\RTKhGkO.exe
  C:\Windows\System\RTKhGkO.exe
  2⤵
  PID:9452
- C:\Windows\System\MAUYhpF.exe
  C:\Windows\System\MAUYhpF.exe
  2⤵
  PID:9472
- C:\Windows\System\VXQiByi.exe
  C:\Windows\System\VXQiByi.exe
  2⤵
  PID:9496
- C:\Windows\System\SaUAnNI.exe
  C:\Windows\System\SaUAnNI.exe
  2⤵
  PID:9524
- C:\Windows\System\HbrxLzp.exe
  C:\Windows\System\HbrxLzp.exe
  2⤵
  PID:9544
- C:\Windows\System\AYGHXlz.exe
  C:\Windows\System\AYGHXlz.exe
  2⤵
  PID:9564
- C:\Windows\System\RhKBmhn.exe
  C:\Windows\System\RhKBmhn.exe
  2⤵
  PID:9588
- C:\Windows\System\hbRNAFI.exe
  C:\Windows\System\hbRNAFI.exe
  2⤵
  PID:9612
- C:\Windows\System\tDhnfjs.exe
  C:\Windows\System\tDhnfjs.exe
  2⤵
  PID:9628
- C:\Windows\System\bDIGocB.exe
  C:\Windows\System\bDIGocB.exe
  2⤵
  PID:9652
- C:\Windows\System\AovlziE.exe
  C:\Windows\System\AovlziE.exe
  2⤵
  PID:9676
- C:\Windows\System\pTdxJOS.exe
  C:\Windows\System\pTdxJOS.exe
  2⤵
  PID:9704
- C:\Windows\System\lvaelvG.exe
  C:\Windows\System\lvaelvG.exe
  2⤵
  PID:9720
- C:\Windows\System\fIGMcIO.exe
  C:\Windows\System\fIGMcIO.exe
  2⤵
  PID:9740
- C:\Windows\System\HlNuUkD.exe
  C:\Windows\System\HlNuUkD.exe
  2⤵
  PID:9768
- C:\Windows\System\SSDMJiM.exe
  C:\Windows\System\SSDMJiM.exe
  2⤵
  PID:9792
- C:\Windows\System\OkVXHdC.exe
  C:\Windows\System\OkVXHdC.exe
  2⤵
  PID:9812
- C:\Windows\System\rheiGgc.exe
  C:\Windows\System\rheiGgc.exe
  2⤵
  PID:9844
- C:\Windows\System\ThQwmEl.exe
  C:\Windows\System\ThQwmEl.exe
  2⤵
  PID:9860
- C:\Windows\System\XlIANLm.exe
  C:\Windows\System\XlIANLm.exe
  2⤵
  PID:9876
- C:\Windows\System\gecTeGh.exe
  C:\Windows\System\gecTeGh.exe
  2⤵
  PID:9892
- C:\Windows\System\ofxZjyA.exe
  C:\Windows\System\ofxZjyA.exe
  2⤵
  PID:9916
- C:\Windows\System\RfIoqpG.exe
  C:\Windows\System\RfIoqpG.exe
  2⤵
  PID:9932
- C:\Windows\System\NlqdWzA.exe
  C:\Windows\System\NlqdWzA.exe
  2⤵
  PID:9956
- C:\Windows\System\RAzawmd.exe
  C:\Windows\System\RAzawmd.exe
  2⤵
  PID:9976
- C:\Windows\System\HWBaUfM.exe
  C:\Windows\System\HWBaUfM.exe
  2⤵
  PID:10000
- C:\Windows\System\QapSmXK.exe
  C:\Windows\System\QapSmXK.exe
  2⤵
  PID:10020
- C:\Windows\System\OkmVZhU.exe
  C:\Windows\System\OkmVZhU.exe
  2⤵
  PID:10048
- C:\Windows\System\btINjsN.exe
  C:\Windows\System\btINjsN.exe
  2⤵
  PID:10068
- C:\Windows\System\uIPIEMp.exe
  C:\Windows\System\uIPIEMp.exe
  2⤵
  PID:10084
- C:\Windows\System\UcijZjG.exe
  C:\Windows\System\UcijZjG.exe
  2⤵
  PID:10108
- C:\Windows\System\wyruJKU.exe
  C:\Windows\System\wyruJKU.exe
  2⤵
  PID:10132
- C:\Windows\System\CUfxnsl.exe
  C:\Windows\System\CUfxnsl.exe
  2⤵
  PID:10152
- C:\Windows\System\KAjfqXu.exe
  C:\Windows\System\KAjfqXu.exe
  2⤵
  PID:10172
- C:\Windows\System\LyoIrPx.exe
  C:\Windows\System\LyoIrPx.exe
  2⤵
  PID:10196
- C:\Windows\System\eahWSXx.exe
  C:\Windows\System\eahWSXx.exe
  2⤵
  PID:10224
- C:\Windows\System\YcaltcF.exe
  C:\Windows\System\YcaltcF.exe
  2⤵
  PID:8928
- C:\Windows\System\PNoHtsp.exe
  C:\Windows\System\PNoHtsp.exe
  2⤵
  PID:9008
- C:\Windows\System\VzzLUCl.exe
  C:\Windows\System\VzzLUCl.exe
  2⤵
  PID:9068
- C:\Windows\System\XdBSRvO.exe
  C:\Windows\System\XdBSRvO.exe
  2⤵
  PID:8400
- C:\Windows\System\YmAajic.exe
  C:\Windows\System\YmAajic.exe
  2⤵
  PID:8436
- C:\Windows\System\EDGEvdK.exe
  C:\Windows\System\EDGEvdK.exe
  2⤵
  PID:8484
- C:\Windows\System\KsMXelZ.exe
  C:\Windows\System\KsMXelZ.exe
  2⤵
  PID:8532
- C:\Windows\System\hvwpzPF.exe
  C:\Windows\System\hvwpzPF.exe
  2⤵
  PID:9148
- C:\Windows\System\qtAjbvk.exe
  C:\Windows\System\qtAjbvk.exe
  2⤵
  PID:8552
- C:\Windows\System\aeNSnMK.exe
  C:\Windows\System\aeNSnMK.exe
  2⤵
  PID:8600
- C:\Windows\System\ZnEvzEs.exe
  C:\Windows\System\ZnEvzEs.exe
  2⤵
  PID:8636
- C:\Windows\System\aSNUNMH.exe
  C:\Windows\System\aSNUNMH.exe
  2⤵
  PID:8692
- C:\Windows\System\lGpeYgA.exe
  C:\Windows\System\lGpeYgA.exe
  2⤵
  PID:8744
- C:\Windows\System\FCvWlcR.exe
  C:\Windows\System\FCvWlcR.exe
  2⤵
  PID:7712
- C:\Windows\System\XUhnHGK.exe
  C:\Windows\System\XUhnHGK.exe
  2⤵
  PID:10244
- C:\Windows\System\xsRFhAc.exe
  C:\Windows\System\xsRFhAc.exe
  2⤵
  PID:10268
- C:\Windows\System\gWxQKLn.exe
  C:\Windows\System\gWxQKLn.exe
  2⤵
  PID:10288
- C:\Windows\System\GDjfPFR.exe
  C:\Windows\System\GDjfPFR.exe
  2⤵
  PID:10308
- C:\Windows\System\VcUByms.exe
  C:\Windows\System\VcUByms.exe
  2⤵
  PID:10324
- C:\Windows\System\SDIwknW.exe
  C:\Windows\System\SDIwknW.exe
  2⤵
  PID:10352
- C:\Windows\System\RDJCQrT.exe
  C:\Windows\System\RDJCQrT.exe
  2⤵
  PID:10488
- C:\Windows\System\LJVSNrf.exe
  C:\Windows\System\LJVSNrf.exe
  2⤵
  PID:10512
- C:\Windows\System\uODznHt.exe
  C:\Windows\System\uODznHt.exe
  2⤵
  PID:10532
- C:\Windows\System\WHYEyOm.exe
  C:\Windows\System\WHYEyOm.exe
  2⤵
  PID:10548
- C:\Windows\System\hMhkrLD.exe
  C:\Windows\System\hMhkrLD.exe
  2⤵
  PID:10564
- C:\Windows\System\JUYSWwX.exe
  C:\Windows\System\JUYSWwX.exe
  2⤵
  PID:10596
- C:\Windows\System\UIpeEWn.exe
  C:\Windows\System\UIpeEWn.exe
  2⤵
  PID:10612
- C:\Windows\System\TapXCwD.exe
  C:\Windows\System\TapXCwD.exe
  2⤵
  PID:10644
- C:\Windows\System\HvsbkRJ.exe
  C:\Windows\System\HvsbkRJ.exe
  2⤵
  PID:10668
- C:\Windows\System\HsaWzXg.exe
  C:\Windows\System\HsaWzXg.exe
  2⤵
  PID:10684
- C:\Windows\System\pdBVpCJ.exe
  C:\Windows\System\pdBVpCJ.exe
  2⤵
  PID:10700
- C:\Windows\System\ywkjXUU.exe
  C:\Windows\System\ywkjXUU.exe
  2⤵
  PID:10716
- C:\Windows\System\KltktvQ.exe
  C:\Windows\System\KltktvQ.exe
  2⤵
  PID:10768
- C:\Windows\System\XHFVdCJ.exe
  C:\Windows\System\XHFVdCJ.exe
  2⤵
  PID:10784
- C:\Windows\System\bPPYcRa.exe
  C:\Windows\System\bPPYcRa.exe
  2⤵
  PID:10804
- C:\Windows\System\vwTwIBd.exe
  C:\Windows\System\vwTwIBd.exe
  2⤵
  PID:10820
- C:\Windows\System\MYEnGuA.exe
  C:\Windows\System\MYEnGuA.exe
  2⤵
  PID:10840
- C:\Windows\System\ynbNsje.exe
  C:\Windows\System\ynbNsje.exe
  2⤵
  PID:10868
- C:\Windows\System\hBGzSXR.exe
  C:\Windows\System\hBGzSXR.exe
  2⤵
  PID:10888
- C:\Windows\System\ezvlsZo.exe
  C:\Windows\System\ezvlsZo.exe
  2⤵
  PID:10916
- C:\Windows\System\XpfTxsQ.exe
  C:\Windows\System\XpfTxsQ.exe
  2⤵
  PID:10932
- C:\Windows\System\IgqTzPU.exe
  C:\Windows\System\IgqTzPU.exe
  2⤵
  PID:10952
- C:\Windows\System\roolGHi.exe
  C:\Windows\System\roolGHi.exe
  2⤵
  PID:10968
- C:\Windows\System\xawjcfQ.exe
  C:\Windows\System\xawjcfQ.exe
  2⤵
  PID:10992
- C:\Windows\System\lOKTQWN.exe
  C:\Windows\System\lOKTQWN.exe
  2⤵
  PID:11008
- C:\Windows\System\cULDewL.exe
  C:\Windows\System\cULDewL.exe
  2⤵
  PID:11036
- C:\Windows\System\tEGAAnG.exe
  C:\Windows\System\tEGAAnG.exe
  2⤵
  PID:11056
- C:\Windows\System\embywzK.exe
  C:\Windows\System\embywzK.exe
  2⤵
  PID:11072
- C:\Windows\System\MGcbaDm.exe
  C:\Windows\System\MGcbaDm.exe
  2⤵
  PID:11088
- C:\Windows\System\XKtnSpD.exe
  C:\Windows\System\XKtnSpD.exe
  2⤵
  PID:11112
- C:\Windows\System\GlhMrPz.exe
  C:\Windows\System\GlhMrPz.exe
  2⤵
  PID:11136
- C:\Windows\System\nNgXKxx.exe
  C:\Windows\System\nNgXKxx.exe
  2⤵
  PID:11160
- C:\Windows\System\ClhXZZI.exe
  C:\Windows\System\ClhXZZI.exe
  2⤵
  PID:11180
- C:\Windows\System\KIlTWXT.exe
  C:\Windows\System\KIlTWXT.exe
  2⤵
  PID:11196
- C:\Windows\System\bdcDMvc.exe
  C:\Windows\System\bdcDMvc.exe
  2⤵
  PID:11220
- C:\Windows\System\pAPZPCK.exe
  C:\Windows\System\pAPZPCK.exe
  2⤵
  PID:11248
- C:\Windows\System\dXuAHlA.exe
  C:\Windows\System\dXuAHlA.exe
  2⤵
  PID:5344
- C:\Windows\System\WPTmagt.exe
  C:\Windows\System\WPTmagt.exe
  2⤵
  PID:3412
- C:\Windows\System\UxiLIRD.exe
  C:\Windows\System\UxiLIRD.exe
  2⤵
  PID:6740
- C:\Windows\System\jSJMwhq.exe
  C:\Windows\System\jSJMwhq.exe
  2⤵
  PID:7188
- C:\Windows\System\WFdBdzO.exe
  C:\Windows\System\WFdBdzO.exe
  2⤵
  PID:8856
- C:\Windows\System\ycJRjCf.exe
  C:\Windows\System\ycJRjCf.exe
  2⤵
  PID:9404
- C:\Windows\System\IjzvoPn.exe
  C:\Windows\System\IjzvoPn.exe
  2⤵
  PID:9416
- C:\Windows\System\EIlqNXu.exe
  C:\Windows\System\EIlqNXu.exe
  2⤵
  PID:9448
- C:\Windows\System\PsOScQO.exe
  C:\Windows\System\PsOScQO.exe
  2⤵
  PID:9552
- C:\Windows\System\YikbiPQ.exe
  C:\Windows\System\YikbiPQ.exe
  2⤵
  PID:9668
- C:\Windows\System\HzhEiNf.exe
  C:\Windows\System\HzhEiNf.exe
  2⤵
  PID:8952
- C:\Windows\System\WxFICnb.exe
  C:\Windows\System\WxFICnb.exe
  2⤵
  PID:11288
- C:\Windows\System\oTmlQqQ.exe
  C:\Windows\System\oTmlQqQ.exe
  2⤵
  PID:11316
- C:\Windows\System\uFeWnTF.exe
  C:\Windows\System\uFeWnTF.exe
  2⤵
  PID:11336
- C:\Windows\System\pmcsMbF.exe
  C:\Windows\System\pmcsMbF.exe
  2⤵
  PID:11364
- C:\Windows\System\plMbDUi.exe
  C:\Windows\System\plMbDUi.exe
  2⤵
  PID:11380
- C:\Windows\System\VWdJBqH.exe
  C:\Windows\System\VWdJBqH.exe
  2⤵
  PID:11400
- C:\Windows\System\TywRLUp.exe
  C:\Windows\System\TywRLUp.exe
  2⤵
  PID:11420
- C:\Windows\System\rGvSooI.exe
  C:\Windows\System\rGvSooI.exe
  2⤵
  PID:11448
- C:\Windows\System\TMvcyrp.exe
  C:\Windows\System\TMvcyrp.exe
  2⤵
  PID:11464
- C:\Windows\System\LFfUBDt.exe
  C:\Windows\System\LFfUBDt.exe
  2⤵
  PID:11488
- C:\Windows\System\XIEfvMU.exe
  C:\Windows\System\XIEfvMU.exe
  2⤵
  PID:11512
- C:\Windows\System\yyzfHtX.exe
  C:\Windows\System\yyzfHtX.exe
  2⤵
  PID:11528
- C:\Windows\System\tFowOhM.exe
  C:\Windows\System\tFowOhM.exe
  2⤵
  PID:11556
- C:\Windows\System\czLkKqH.exe
  C:\Windows\System\czLkKqH.exe
  2⤵
  PID:11584
- C:\Windows\System\rrYXlab.exe
  C:\Windows\System\rrYXlab.exe
  2⤵
  PID:11600
- C:\Windows\System\eQGrXvP.exe
  C:\Windows\System\eQGrXvP.exe
  2⤵
  PID:11620
- C:\Windows\System\zShiMwv.exe
  C:\Windows\System\zShiMwv.exe
  2⤵
  PID:11640
- C:\Windows\System\ToZbzNj.exe
  C:\Windows\System\ToZbzNj.exe
  2⤵
  PID:11664
- C:\Windows\System\uMHaLaN.exe
  C:\Windows\System\uMHaLaN.exe
  2⤵
  PID:11688
- C:\Windows\System\cyuJcBE.exe
  C:\Windows\System\cyuJcBE.exe
  2⤵
  PID:11708
- C:\Windows\System\RdTnQOT.exe
  C:\Windows\System\RdTnQOT.exe
  2⤵
  PID:11724
- C:\Windows\System\ELvzuxv.exe
  C:\Windows\System\ELvzuxv.exe
  2⤵
  PID:11740
- C:\Windows\System\tPfoukH.exe
  C:\Windows\System\tPfoukH.exe
  2⤵
  PID:11756
- C:\Windows\System\lxZfclg.exe
  C:\Windows\System\lxZfclg.exe
  2⤵
  PID:11776
- C:\Windows\System\wrzrABb.exe
  C:\Windows\System\wrzrABb.exe
  2⤵
  PID:11796
- C:\Windows\System\RFbdlyk.exe
  C:\Windows\System\RFbdlyk.exe
  2⤵
  PID:11816
- C:\Windows\System\wMEYJDy.exe
  C:\Windows\System\wMEYJDy.exe
  2⤵
  PID:11832
- C:\Windows\System\rRbIEmz.exe
  C:\Windows\System\rRbIEmz.exe
  2⤵
  PID:11852
- C:\Windows\System\uuIXsGK.exe
  C:\Windows\System\uuIXsGK.exe
  2⤵
  PID:11872
- C:\Windows\System\gCmbhFM.exe
  C:\Windows\System\gCmbhFM.exe
  2⤵
  PID:11892
- C:\Windows\System\uVqvRYG.exe
  C:\Windows\System\uVqvRYG.exe
  2⤵
  PID:11908
- C:\Windows\System\strQSqw.exe
  C:\Windows\System\strQSqw.exe
  2⤵
  PID:11928
- C:\Windows\System\qgyfnNh.exe
  C:\Windows\System\qgyfnNh.exe
  2⤵
  PID:11956
- C:\Windows\System\hvQWESM.exe
  C:\Windows\System\hvQWESM.exe
  2⤵
  PID:11976
- C:\Windows\System\vGhihEU.exe
  C:\Windows\System\vGhihEU.exe
  2⤵
  PID:11992
- C:\Windows\System\HMnpbPz.exe
  C:\Windows\System\HMnpbPz.exe
  2⤵
  PID:12012
- C:\Windows\System\qnjtgpn.exe
  C:\Windows\System\qnjtgpn.exe
  2⤵
  PID:12036
- C:\Windows\System\QyQpJMQ.exe
  C:\Windows\System\QyQpJMQ.exe
  2⤵
  PID:12052
- C:\Windows\System\erzSYLP.exe
  C:\Windows\System\erzSYLP.exe
  2⤵
  PID:12068
- C:\Windows\System\esHZUkS.exe
  C:\Windows\System\esHZUkS.exe
  2⤵
  PID:12084
- C:\Windows\System\kMmchcr.exe
  C:\Windows\System\kMmchcr.exe
  2⤵
  PID:12252
- C:\Windows\System\mNRPPvo.exe
  C:\Windows\System\mNRPPvo.exe
  2⤵
  PID:12268
- C:\Windows\System\abTRKJY.exe
  C:\Windows\System\abTRKJY.exe
  2⤵
  PID:12284
- C:\Windows\System\UljcMar.exe
  C:\Windows\System\UljcMar.exe
  2⤵
  PID:9872
- C:\Windows\System\DPRGjWb.exe
  C:\Windows\System\DPRGjWb.exe
  2⤵
  PID:9908
- C:\Windows\System\zebJzyg.exe
  C:\Windows\System\zebJzyg.exe
  2⤵
  PID:9952
- C:\Windows\System\bbHZbFv.exe
  C:\Windows\System\bbHZbFv.exe
  2⤵
  PID:10016
- C:\Windows\System\pbJgoLl.exe
  C:\Windows\System\pbJgoLl.exe
  2⤵
  PID:10060
- C:\Windows\System\czvYACP.exe
  C:\Windows\System\czvYACP.exe
  2⤵
  PID:10104
- C:\Windows\System\QRcipfX.exe
  C:\Windows\System\QRcipfX.exe
  2⤵
  PID:10220
- C:\Windows\System\YiWxwNM.exe
  C:\Windows\System\YiWxwNM.exe
  2⤵
  PID:9088
- C:\Windows\System\XeQGUwx.exe
  C:\Windows\System\XeQGUwx.exe
  2⤵
  PID:9132
- C:\Windows\System\QsIWSle.exe
  C:\Windows\System\QsIWSle.exe
  2⤵
  PID:9112
- C:\Windows\System\tOULDkx.exe
  C:\Windows\System\tOULDkx.exe
  2⤵
  PID:8588
- C:\Windows\System\bclAvpo.exe
  C:\Windows\System\bclAvpo.exe
  2⤵
  PID:7864
- C:\Windows\System\zKidudc.exe
  C:\Windows\System\zKidudc.exe
  2⤵
  PID:7880
- C:\Windows\System\ekkmesH.exe
  C:\Windows\System\ekkmesH.exe
  2⤵
  PID:6076
- C:\Windows\System\zgSYBaH.exe
  C:\Windows\System\zgSYBaH.exe
  2⤵
  PID:6392
- C:\Windows\System\owjsnrZ.exe
  C:\Windows\System\owjsnrZ.exe
  2⤵
  PID:2160
- C:\Windows\System\eXwxskZ.exe
  C:\Windows\System\eXwxskZ.exe
  2⤵
  PID:9444
- C:\Windows\System\cmBPYhB.exe
  C:\Windows\System\cmBPYhB.exe
  2⤵
  PID:9516
- C:\Windows\System\UMZswtZ.exe
  C:\Windows\System\UMZswtZ.exe
  2⤵
  PID:12304
- C:\Windows\System\dYJrWjr.exe
  C:\Windows\System\dYJrWjr.exe
  2⤵
  PID:12324
- C:\Windows\System\rHTXEpM.exe
  C:\Windows\System\rHTXEpM.exe
  2⤵
  PID:12344
- C:\Windows\System\JMrqejD.exe
  C:\Windows\System\JMrqejD.exe
  2⤵
  PID:12360
- C:\Windows\System\MxOUHFY.exe
  C:\Windows\System\MxOUHFY.exe
  2⤵
  PID:12376
- C:\Windows\System\uLjFIzi.exe
  C:\Windows\System\uLjFIzi.exe
  2⤵
  PID:12392
- C:\Windows\System\xuFXJmU.exe
  C:\Windows\System\xuFXJmU.exe
  2⤵
  PID:12408
- C:\Windows\System\srSfjkQ.exe
  C:\Windows\System\srSfjkQ.exe
  2⤵
  PID:12424
- C:\Windows\System\bkxbzzf.exe
  C:\Windows\System\bkxbzzf.exe
  2⤵
  PID:12440
- C:\Windows\System\BrkLmcv.exe
  C:\Windows\System\BrkLmcv.exe
  2⤵
  PID:12468
- C:\Windows\System\nOqnUmx.exe
  C:\Windows\System\nOqnUmx.exe
  2⤵
  PID:12484
- C:\Windows\System\gDFbTlO.exe
  C:\Windows\System\gDFbTlO.exe
  2⤵
  PID:12504
- C:\Windows\System\taKucCC.exe
  C:\Windows\System\taKucCC.exe
  2⤵
  PID:12528
- C:\Windows\System\rMwRiHC.exe
  C:\Windows\System\rMwRiHC.exe
  2⤵
  PID:12556
- C:\Windows\System\ZZiekgA.exe
  C:\Windows\System\ZZiekgA.exe
  2⤵
  PID:12572
- C:\Windows\System\LmPMfBL.exe
  C:\Windows\System\LmPMfBL.exe
  2⤵
  PID:12588
- C:\Windows\System\GhEMvIU.exe
  C:\Windows\System\GhEMvIU.exe
  2⤵
  PID:12604
- C:\Windows\System\RqHmpob.exe
  C:\Windows\System\RqHmpob.exe
  2⤵
  PID:12628
- C:\Windows\System\YAAWdaA.exe
  C:\Windows\System\YAAWdaA.exe
  2⤵
  PID:12644
- C:\Windows\System\OjjKAyY.exe
  C:\Windows\System\OjjKAyY.exe
  2⤵
  PID:12660
- C:\Windows\System\hCfWXgN.exe
  C:\Windows\System\hCfWXgN.exe
  2⤵
  PID:12684
- C:\Windows\System\LEprpLw.exe
  C:\Windows\System\LEprpLw.exe
  2⤵
  PID:12708
- C:\Windows\System\OUjejjn.exe
  C:\Windows\System\OUjejjn.exe
  2⤵
  PID:12728
- C:\Windows\System\DUOOrgS.exe
  C:\Windows\System\DUOOrgS.exe
  2⤵
  PID:12748
- C:\Windows\System\SqkrERg.exe
  C:\Windows\System\SqkrERg.exe
  2⤵
  PID:12768
- C:\Windows\System\jvoxgFW.exe
  C:\Windows\System\jvoxgFW.exe
  2⤵
  PID:12792
- C:\Windows\System\lGFFNqP.exe
  C:\Windows\System\lGFFNqP.exe
  2⤵
  PID:12812
- C:\Windows\System\ZGYqBhr.exe
  C:\Windows\System\ZGYqBhr.exe
  2⤵
  PID:12832
- C:\Windows\System\PylalPr.exe
  C:\Windows\System\PylalPr.exe
  2⤵
  PID:12860
- C:\Windows\System\IsCnYdU.exe
  C:\Windows\System\IsCnYdU.exe
  2⤵
  PID:12884
- C:\Windows\System\JAGShXZ.exe
  C:\Windows\System\JAGShXZ.exe
  2⤵
  PID:12904
- C:\Windows\System\TsLphBq.exe
  C:\Windows\System\TsLphBq.exe
  2⤵
  PID:12924
- C:\Windows\System\ZkfEhSF.exe
  C:\Windows\System\ZkfEhSF.exe
  2⤵
  PID:12944
- C:\Windows\System\ehUbRBj.exe
  C:\Windows\System\ehUbRBj.exe
  2⤵
  PID:12964
- C:\Windows\System\MLKhNiz.exe
  C:\Windows\System\MLKhNiz.exe
  2⤵
  PID:12984
- C:\Windows\System\VtDoIqx.exe
  C:\Windows\System\VtDoIqx.exe
  2⤵
  PID:13004
- C:\Windows\System\GJyAIhg.exe
  C:\Windows\System\GJyAIhg.exe
  2⤵
  PID:13024
- C:\Windows\System\XqjLevL.exe
  C:\Windows\System\XqjLevL.exe
  2⤵
  PID:13052
- C:\Windows\System\xlauDLI.exe
  C:\Windows\System\xlauDLI.exe
  2⤵
  PID:13076
- C:\Windows\System\gzwLQMs.exe
  C:\Windows\System\gzwLQMs.exe
  2⤵
  PID:13096
- C:\Windows\System\kEdMSql.exe
  C:\Windows\System\kEdMSql.exe
  2⤵
  PID:13120
- C:\Windows\System\MwTYMbh.exe
  C:\Windows\System\MwTYMbh.exe
  2⤵
  PID:13140
- C:\Windows\System\TMRyYqA.exe
  C:\Windows\System\TMRyYqA.exe
  2⤵
  PID:13156
- C:\Windows\System\PtppMQa.exe
  C:\Windows\System\PtppMQa.exe
  2⤵
  PID:13180
- C:\Windows\System\GfupylX.exe
  C:\Windows\System\GfupylX.exe
  2⤵
  PID:13196
- C:\Windows\System\QqgbHxO.exe
  C:\Windows\System\QqgbHxO.exe
  2⤵
  PID:13212
- C:\Windows\System\rwdizOo.exe
  C:\Windows\System\rwdizOo.exe
  2⤵
  PID:13232
- C:\Windows\System\mAkfyzO.exe
  C:\Windows\System\mAkfyzO.exe
  2⤵
  PID:13252
- C:\Windows\System\FpelAyJ.exe
  C:\Windows\System\FpelAyJ.exe
  2⤵
  PID:13276
- C:\Windows\System\TPLNjwx.exe
  C:\Windows\System\TPLNjwx.exe
  2⤵
  PID:13300
- C:\Windows\System\jyJZKVA.exe
  C:\Windows\System\jyJZKVA.exe
  2⤵
  PID:11120
- C:\Windows\System\HnAgAcQ.exe
  C:\Windows\System\HnAgAcQ.exe
  2⤵
  PID:11148
- C:\Windows\System\qbwpSmC.exe
  C:\Windows\System\qbwpSmC.exe
  2⤵
  PID:9648
- C:\Windows\System\BMKtSsK.exe
  C:\Windows\System\BMKtSsK.exe
  2⤵
  PID:11212
- C:\Windows\System\QASlucy.exe
  C:\Windows\System\QASlucy.exe
  2⤵
  PID:5696
- C:\Windows\System\ZQdcBWz.exe
  C:\Windows\System\ZQdcBWz.exe
  2⤵
  PID:6756
- C:\Windows\System\ltVnEhM.exe
  C:\Windows\System\ltVnEhM.exe
  2⤵
  PID:8948
- C:\Windows\System\IrVALar.exe
  C:\Windows\System\IrVALar.exe
  2⤵
  PID:4872
- C:\Windows\System\QndXWLU.exe
  C:\Windows\System\QndXWLU.exe
  2⤵
  PID:9480
- C:\Windows\System\aZVSWah.exe
  C:\Windows\System\aZVSWah.exe
  2⤵
  PID:9700
- C:\Windows\System\QCcrcqT.exe
  C:\Windows\System\QCcrcqT.exe
  2⤵
  PID:11324
- C:\Windows\System\ZkMkNCY.exe
  C:\Windows\System\ZkMkNCY.exe
  2⤵
  PID:11432
- C:\Windows\System\kcOunsy.exe
  C:\Windows\System\kcOunsy.exe
  2⤵
  PID:11536
- C:\Windows\System\HUgdHdl.exe
  C:\Windows\System\HUgdHdl.exe
  2⤵
  PID:9968
- C:\Windows\System\AHgzEsJ.exe
  C:\Windows\System\AHgzEsJ.exe
  2⤵
  PID:11580
- C:\Windows\System\DpNBdGe.exe
  C:\Windows\System\DpNBdGe.exe
  2⤵
  PID:11652
- C:\Windows\System\qLZLYIN.exe
  C:\Windows\System\qLZLYIN.exe
  2⤵
  PID:10124
- C:\Windows\System\oASTMoD.exe
  C:\Windows\System\oASTMoD.exe
  2⤵
  PID:10168
- C:\Windows\System\ieuOoNk.exe
  C:\Windows\System\ieuOoNk.exe
  2⤵
  PID:9044
- C:\Windows\System\WoOJmVg.exe
  C:\Windows\System\WoOJmVg.exe
  2⤵
  PID:10236
- C:\Windows\System\exxNQwD.exe
  C:\Windows\System\exxNQwD.exe
  2⤵
  PID:8372
- C:\Windows\System\OuRfbuU.exe
  C:\Windows\System\OuRfbuU.exe
  2⤵
  PID:13324
- C:\Windows\System\wiurqFl.exe
  C:\Windows\System\wiurqFl.exe
  2⤵
  PID:13344
- C:\Windows\System\LXihHQt.exe
  C:\Windows\System\LXihHQt.exe
  2⤵
  PID:13360
- C:\Windows\System\WmsNaWc.exe
  C:\Windows\System\WmsNaWc.exe
  2⤵
  PID:13380
- C:\Windows\System\CViBCMH.exe
  C:\Windows\System\CViBCMH.exe
  2⤵
  PID:13400
- C:\Windows\System\FxAGmmK.exe
  C:\Windows\System\FxAGmmK.exe
  2⤵
  PID:13424
- C:\Windows\System\abJESwl.exe
  C:\Windows\System\abJESwl.exe
  2⤵
  PID:13440
- C:\Windows\System\oHTsJPE.exe
  C:\Windows\System\oHTsJPE.exe
  2⤵
  PID:13460
- C:\Windows\System\ETZFdbH.exe
  C:\Windows\System\ETZFdbH.exe
  2⤵
  PID:13480
- C:\Windows\System\LzRKlEX.exe
  C:\Windows\System\LzRKlEX.exe
  2⤵
  PID:13496
- C:\Windows\System\waYwZtY.exe
  C:\Windows\System\waYwZtY.exe
  2⤵
  PID:13516
- C:\Windows\System\qICKzgK.exe
  C:\Windows\System\qICKzgK.exe
  2⤵
  PID:13532
- C:\Windows\System\gSHySXd.exe
  C:\Windows\System\gSHySXd.exe
  2⤵
  PID:13548
- C:\Windows\System\jwPoaOc.exe
  C:\Windows\System\jwPoaOc.exe
  2⤵
  PID:13564
- C:\Windows\System\bQDpIud.exe
  C:\Windows\System\bQDpIud.exe
  2⤵
  PID:13876
- C:\Windows\System\xcyWtyq.exe
  C:\Windows\System\xcyWtyq.exe
  2⤵
  PID:13892
- C:\Windows\System\XGMHzYm.exe
  C:\Windows\System\XGMHzYm.exe
  2⤵
  PID:13908
- C:\Windows\System\adeYUIc.exe
  C:\Windows\System\adeYUIc.exe
  2⤵
  PID:13924
- C:\Windows\System\wNGFZKx.exe
  C:\Windows\System\wNGFZKx.exe
  2⤵
  PID:13940
- C:\Windows\System\zLcnjBH.exe
  C:\Windows\System\zLcnjBH.exe
  2⤵
  PID:13956
- C:\Windows\System\bvhkNiG.exe
  C:\Windows\System\bvhkNiG.exe
  2⤵
  PID:13976
- C:\Windows\System\Pgfqvtt.exe
  C:\Windows\System\Pgfqvtt.exe
  2⤵
  PID:13992
- C:\Windows\System\iIPYMJZ.exe
  C:\Windows\System\iIPYMJZ.exe
  2⤵
  PID:14008
- C:\Windows\System\ogwKpba.exe
  C:\Windows\System\ogwKpba.exe
  2⤵
  PID:7524
- C:\Windows\System\sqKDPWf.exe
  C:\Windows\System\sqKDPWf.exe
  2⤵
  PID:7460
- C:\Windows\System\BmEeCEZ.exe
  C:\Windows\System\BmEeCEZ.exe
  2⤵
  PID:1800
- C:\Windows\System\mKUzXHX.exe
  C:\Windows\System\mKUzXHX.exe
  2⤵
  PID:7972
- C:\Windows\System\qWaUQAw.exe
  C:\Windows\System\qWaUQAw.exe
  2⤵
  PID:8072
- C:\Windows\System\xpJNXGF.exe
  C:\Windows\System\xpJNXGF.exe
  2⤵
  PID:9276
- C:\Windows\System\YwuNTVz.exe
  C:\Windows\System\YwuNTVz.exe
  2⤵
  PID:9316
- C:\Windows\System\yCRRoVV.exe
  C:\Windows\System\yCRRoVV.exe
  2⤵
  PID:1392
- C:\Windows\System\wdaGmoo.exe
  C:\Windows\System\wdaGmoo.exe
  2⤵
  PID:11144
- C:\Windows\System\hEQitRP.exe
  C:\Windows\System\hEQitRP.exe
  2⤵
  PID:9716
- C:\Windows\System\WjxAYaI.exe
  C:\Windows\System\WjxAYaI.exe
  2⤵
  PID:11612
- C:\Windows\System\vmTxfru.exe
  C:\Windows\System\vmTxfru.exe
  2⤵
  PID:516
- C:\Windows\System\jkXwzPs.exe
  C:\Windows\System\jkXwzPs.exe
  2⤵
  PID:3216
- C:\Windows\System\oQbBrVN.exe
  C:\Windows\System\oQbBrVN.exe
  2⤵
  PID:12044
- C:\Windows\System\krsnXWJ.exe
  C:\Windows\System\krsnXWJ.exe
  2⤵
  PID:10428
- C:\Windows\System\AFHvBLu.exe
  C:\Windows\System\AFHvBLu.exe
  2⤵
  PID:10520
- C:\Windows\System\jRtQRpg.exe
  C:\Windows\System\jRtQRpg.exe
  2⤵
  PID:10588
- C:\Windows\System\EJqUKqX.exe
  C:\Windows\System\EJqUKqX.exe
  2⤵
  PID:10660
- C:\Windows\System\JtZZahu.exe
  C:\Windows\System\JtZZahu.exe
  2⤵
  PID:10712
- C:\Windows\System\nQkNekc.exe
  C:\Windows\System\nQkNekc.exe
  2⤵
  PID:10776
- C:\Windows\System\ccUEFSR.exe
  C:\Windows\System\ccUEFSR.exe
  2⤵
  PID:10832
- C:\Windows\System\GBbIMxM.exe
  C:\Windows\System\GBbIMxM.exe
  2⤵
  PID:10884
- C:\Windows\System\ZPaPLRo.exe
  C:\Windows\System\ZPaPLRo.exe
  2⤵
  PID:10964
- C:\Windows\System\sqhelOu.exe
  C:\Windows\System\sqhelOu.exe
  2⤵
  PID:11044
- C:\Windows\System\dlKukNf.exe
  C:\Windows\System\dlKukNf.exe
  2⤵
  PID:11172
- C:\Windows\System\pVlPZCD.exe
  C:\Windows\System\pVlPZCD.exe
  2⤵
  PID:9492
- C:\Windows\System\ShmpehQ.exe
  C:\Windows\System\ShmpehQ.exe
  2⤵
  PID:11332
- C:\Windows\System\GFqgtzG.exe
  C:\Windows\System\GFqgtzG.exe
  2⤵
  PID:11392
- C:\Windows\System\gssiOEl.exe
  C:\Windows\System\gssiOEl.exe
  2⤵
  PID:11484
- C:\Windows\System\GvUaJpx.exe
  C:\Windows\System\GvUaJpx.exe
  2⤵
  PID:11752
- C:\Windows\System\dmAAiBz.exe
  C:\Windows\System\dmAAiBz.exe
  2⤵
  PID:11828
- C:\Windows\System\FVthDTC.exe
  C:\Windows\System\FVthDTC.exe
  2⤵
  PID:3144
- C:\Windows\System\XjCWMAE.exe
  C:\Windows\System\XjCWMAE.exe
  2⤵
  PID:11972
- C:\Windows\System\ZrLUcID.exe
  C:\Windows\System\ZrLUcID.exe
  2⤵
  PID:12064
- C:\Windows\System\rfjQZxr.exe
  C:\Windows\System\rfjQZxr.exe
  2⤵
  PID:12164
- C:\Windows\System\KIRaSyo.exe
  C:\Windows\System\KIRaSyo.exe
  2⤵
  PID:12240
- C:\Windows\System\HQaIPRp.exe
  C:\Windows\System\HQaIPRp.exe
  2⤵
  PID:12280
- C:\Windows\System\JTvgBtW.exe
  C:\Windows\System\JTvgBtW.exe
  2⤵
  PID:9940
- C:\Windows\System\wElGIFP.exe
  C:\Windows\System\wElGIFP.exe
  2⤵
  PID:10076
- C:\Windows\System\LiumdOl.exe
  C:\Windows\System\LiumdOl.exe
  2⤵
  PID:9064
- C:\Windows\System\PRCrGDp.exe
  C:\Windows\System\PRCrGDp.exe
  2⤵
  PID:8500
- C:\Windows\System\OAjwYSS.exe
  C:\Windows\System\OAjwYSS.exe
  2⤵
  PID:8632
- C:\Windows\System\kBCQiOV.exe
  C:\Windows\System\kBCQiOV.exe
  2⤵
  PID:3732
- C:\Windows\System\eVSVTYy.exe
  C:\Windows\System\eVSVTYy.exe
  2⤵
  PID:8912
- C:\Windows\System\PzOLsMw.exe
  C:\Windows\System\PzOLsMw.exe
  2⤵
  PID:12300
- C:\Windows\System\FlEPPzU.exe
  C:\Windows\System\FlEPPzU.exe
  2⤵
  PID:12356
- C:\Windows\System\wefBeVS.exe
  C:\Windows\System\wefBeVS.exe
  2⤵
  PID:12400
- C:\Windows\System\HOElaLV.exe
  C:\Windows\System\HOElaLV.exe
  2⤵
  PID:12456
- C:\Windows\System\knNxMjM.exe
  C:\Windows\System\knNxMjM.exe
  2⤵
  PID:12512
- C:\Windows\System\fsSorvc.exe
  C:\Windows\System\fsSorvc.exe
  2⤵
  PID:12552
- C:\Windows\System\ndmlvaP.exe
  C:\Windows\System\ndmlvaP.exe
  2⤵
  PID:12600
- C:\Windows\System\zwKFfHI.exe
  C:\Windows\System\zwKFfHI.exe
  2⤵
  PID:12672
- C:\Windows\System\OpnTuLC.exe
  C:\Windows\System\OpnTuLC.exe
  2⤵
  PID:12720
- C:\Windows\System\ckIJaJK.exe
  C:\Windows\System\ckIJaJK.exe
  2⤵
  PID:12764
- C:\Windows\System\DOspqdK.exe
  C:\Windows\System\DOspqdK.exe
  2⤵
  PID:2508
- C:\Windows\System\ccrgPzF.exe
  C:\Windows\System\ccrgPzF.exe
  2⤵
  PID:14236
- C:\Windows\System\FjcOxen.exe
  C:\Windows\System\FjcOxen.exe
  2⤵
  PID:11900
- C:\Windows\System\rcZUUes.exe
  C:\Windows\System\rcZUUes.exe
  2⤵
  PID:13868
- C:\Windows\System\SLnCsyZ.exe
  C:\Windows\System\SLnCsyZ.exe
  2⤵
  PID:13904
- C:\Windows\System\ccenvls.exe
  C:\Windows\System\ccenvls.exe
  2⤵
  PID:14248
- C:\Windows\System\CGoCitQ.exe
  C:\Windows\System\CGoCitQ.exe
  2⤵
  PID:10540
- C:\Windows\System\nqIjyGO.exe
  C:\Windows\System\nqIjyGO.exe
  2⤵
  PID:10696
- C:\Windows\System\oAWSCbu.exe
  C:\Windows\System\oAWSCbu.exe
  2⤵
  PID:10880
- C:\Windows\System\JCnarpy.exe
  C:\Windows\System\JCnarpy.exe
  2⤵
  PID:11080
- C:\Windows\System\JNjheLV.exe
  C:\Windows\System\JNjheLV.exe
  2⤵
  PID:11328
- C:\Windows\System\afQFFdq.exe
  C:\Windows\System\afQFFdq.exe
  2⤵
  PID:11736
- C:\Windows\System\xELnDFy.exe
  C:\Windows\System\xELnDFy.exe
  2⤵
  PID:11924
- C:\Windows\System\RhcpvIZ.exe
  C:\Windows\System\RhcpvIZ.exe
  2⤵
  PID:5068
- C:\Windows\System\zROkndA.exe
  C:\Windows\System\zROkndA.exe
  2⤵
  PID:12204
- C:\Windows\System\evieSDw.exe
  C:\Windows\System\evieSDw.exe
  2⤵
  PID:5304
- C:\Windows\System\yTWAMWY.exe
  C:\Windows\System\yTWAMWY.exe
  2⤵
  PID:5472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BOOcXHA.exe

Filesize
1.5MB

MD5
405be740343c62ec64c7290b02bda26b

SHA1
1b3ce4fda82c69c65293d077508b7f213b6bfc22

SHA256
3166fa8ef9af72fca1b2ae2c2b7ddf3a6dd82a304f8a6e00d60e75468574a747

SHA512
9777ac561b2e1608b688b4c3471b6827ae5db400dfcbc239d14cb9f5ec41a2035fabbda33c3e44178240015af41d2a351e8008a49ab3deaa42c9e069330db5fb

Download Submit
C:\Windows\System\COnWFTU.exe

Filesize
1.5MB

MD5
2e3e2dd2eca75d8c812f3792ca7252b7

SHA1
1d99ae10615a5915da30264a842ef7265b48cc45

SHA256
77a248fbf22c7c012d4e44e01af4a9cee3f613e5d13ec3a97f15cfbe37d2c0f4

SHA512
da8eb6e2c88a5406c353c83ca076d92d6b67df9c84623257a4101aa0be44be5ee7dc0f59b86f689bc51c3aa8221666b7f2d1e3f6c9809605157604147ac5a5c5

Download Submit
C:\Windows\System\DgSqhRw.exe

Filesize
1.5MB

MD5
59f9b039d829d429c29d2f0e29f8dbbc

SHA1
078998ca737403a0ea749964996b8486037432d8

SHA256
37f160588fa2a45283ee06fd8cc8c9475b4dc6bdaf1913a71a88076e2a726b6b

SHA512
2c128435e09b07e03c99d4956d1fb5f2e38f6ebca76da9293e855a36fa93c0bf1df971ddcfc8e6402a9099a5433e90efd6900831d1050aa30b802e55fcd30136

Download Submit
C:\Windows\System\EaVWKnL.exe

Filesize
1.5MB

MD5
7a63cf472c311c7f4b96439310bcf0c9

SHA1
2a9a4ffbffcefa7772ff0ceb1a643e970c18bc47

SHA256
bb268348739fc55fdc1835f974d63ae6e77f29ba73b2897f5b0c1ac5141a1846

SHA512
7a863e9bd807c535014cfcfe81e2d377b06c59e40e200b711fb38b2f88833895f85fb4123c351fc81f666399a51aed90a71ca43176e08132723fb7fd6c133add

Download Submit
C:\Windows\System\HKGMlAa.exe

Filesize
1.5MB

MD5
460a72283bf6eeaa3b858979fbaa5873

SHA1
c2df59914c9a5ae41984b712b9665d97b5aa18c1

SHA256
c07e50bb2cafc66f0cadda15d868d5a2fdb24f69be52f5707ef4c6cf32f22e63

SHA512
84a07f22ed8b91d270203b69c05ba7ff6d0cb9d1ecc750f5de183cdfdc4f3b2752f99662e1b44bd558bdedfb6656938bd5dc5051438bf529552f300e76d2b3ae

Download Submit
C:\Windows\System\KUnLvmd.exe

Filesize
1.5MB

MD5
1ddece696713c7b3062015009ecc2cfa

SHA1
1cb641f10b66de9bb84189c4f442e9e3ad13c8a3

SHA256
3711c4e0a38975e232feedbb3171d2c79d54bac4ab2f9d874360faf7c9369bf9

SHA512
577fe1798857d5fa5c233e254e086d0e41c4dd5e692047adda71334be05bea15233fc2bd8808d87e9e4a12b27c916071908249db8ea4cd5eb4bb8ec35c9cb423

Download Submit
C:\Windows\System\KlGeEIr.exe

Filesize
1.5MB

MD5
ad394b57cc4d559d36951d7fcb1bee8c

SHA1
8124d560adbf81e784d1245ffa05553137c5cf06

SHA256
1fe8c28b351a65a1ad3445baf7e041fc58d8afadab27dbf3f18b9fa2ca4d94bd

SHA512
d99acf6e577bc1335c3e7dc496193ca38254640657d2f75be3b00c1ec0e0d9d15a4e7a8bcc6baeb1973957a705b39bf962d04488920fdd08a56ebd75a3d50e11

Download Submit
C:\Windows\System\KzFtaPt.exe

Filesize
1.5MB

MD5
3a4365250811b3d0dc76839bbcbe3c6a

SHA1
02311ec67fa1a861d96a353feb68a0209dc9a14d

SHA256
a01534d815b36255256657cbcf94dd0cc3df2afddd260e47e419379393ea818c

SHA512
a361f4c2067ac893ac99c692cd7bffca8d7c263aa1512673e9c089b72d68b0128a29640917222f06e1ad3d980459feffb2710dbb3d8024ac359e5a8f315a79e3

Download Submit
C:\Windows\System\LLyyMOu.exe

Filesize
1.5MB

MD5
fd4b512c5017e389a59ee1d498c5d745

SHA1
7ebb05f1b40ce256596da7e4f90a883bf13027ba

SHA256
5c54c0c5c604abeea7bd2cd31ffca533721041e9bf764388814b95998ef7dd17

SHA512
25e1b3818cc71a46ea13b7c8086f1beb11870945c1ad7316b6b7bc0916ce468d772e8a5680f9edcee031158836dc88d76a3b62254268b3752137dfb420a479ba

Download Submit
C:\Windows\System\NPDyRoR.exe

Filesize
1.5MB

MD5
88f704271f4a3703f1e1bf839a63d890

SHA1
27bfec38f870152832fe261f2b08bd179fc8062f

SHA256
e56e75046e7cb64df5e158770fc8ad8070bb00f0579598cbbdc89904b59e782b

SHA512
9d6be16fd4794406cae556e64dc096f8e5fe8e444aa61960e24a0a1b062346c8cbdc13b7dfdfc2fb50d56b4d29a1c81c179cfeca7cd540eb62bd3756b835ac60

Download Submit
C:\Windows\System\PSYQpKv.exe

Filesize
1.5MB

MD5
56863b7251c74970f90aef3be391f827

SHA1
960e1e1f9a502c8112fcd05952f235920e0fecb5

SHA256
0b4726a34d5f66315c64b7ff57aa7624e5e19d1d7f90a2fa0f5180aba6ef061b

SHA512
37ca7ef472636c1743b6c84f36a2193c01326cca3c343c77457a0a689181b4d31a5f6785b69dd0d08eade314bcfb59aa1726096d24b40ea5fbef14c5b41a5c7f

Download Submit
C:\Windows\System\PxDMHpu.exe

Filesize
1.5MB

MD5
b765b4cc96768dcb0fa198ee5bd12452

SHA1
dcdba60f067d3ad34220d0d83eca9b66f337aba6

SHA256
840f2a53f5897a5fa5dfedb4f5270921d9f8c3bdc2daf4a6fbdc94ada87aedcd

SHA512
577b37d6ae7cc4c19e5609931c3312207a6c44fd177f96e97dcbdff01ed63b7fe18e232fd51bfc8b313b3ded2a9256964cfcabb2fec64ca0d50bf331044d2e98

Download Submit
C:\Windows\System\QOveFwk.exe

Filesize
1.5MB

MD5
4253cfd4dd19012111142d02037fd80f

SHA1
f809d4dbcd7c0234aec27a5ad7eac257eab8198c

SHA256
eea5bfe0722c1ae40e924fb9a580c0c8bc0d03c1b275f25067d60a2790522a75

SHA512
b21dca199f13599cc4ded712813a80daba8502669ec26bbe91e3fea29ddbba6b764c5acbf0d89eb210d4dadad6a1ddec6987ad7af88bcc9b63494707e5db4c3a

Download Submit
C:\Windows\System\RRkBDoz.exe

Filesize
1.5MB

MD5
87a4be6986f23696586c3a05b0bca41b

SHA1
fafe709dac6e39dda11c4fa05b2bcc4eb962216a

SHA256
b67522476dbe02abf57943a269af31abbb317b06ece9aea2e277d30095f52a78

SHA512
332761b961863c291100062fc0e6073b8c60171773ba2c397afba9194eecd93b04cefe4b54dfc9da53dcc957679c681308332a7bd686a3291b437b8fbdf2a0cc

Download Submit
C:\Windows\System\RcnnBqb.exe

Filesize
1.5MB

MD5
282552e5213eb329b218f73cd64728c0

SHA1
99ea7f3cbb26f85b3e663e712613744d3a661bde

SHA256
a0b66acc9af04634f921335582d7ea8ffa7fc91d782e58acc9f5ee38ba738c03

SHA512
a3c56eaf6b0f9af7ba5fe8371a5d25619111135c314f46482efe1e3a1f5bcfa7eaf294a373b806fa8450e970c7d2db2ba2ffd9791d0ab8db811fceb5e9c6c00b

Download Submit
C:\Windows\System\TiyBiRf.exe

Filesize
1.5MB

MD5
5cd7b7754c29da34304a2a7a39fb0e9b

SHA1
1f4aece914b901512740a676e0621bd13020d309

SHA256
eda5dc457358dfc228b324d031d5d2d0c2ce6cf816d1a2c91cf7d290bf13432e

SHA512
85a7cf1238b7caf46f6789c7dc1485541cd6ae8d7c197754a86778b814d7556a90756f844832a40a8ec5aeeb539374757d97bd84123d6267b4aa57044434ca95

Download Submit
C:\Windows\System\VPCOuXZ.exe

Filesize
1.5MB

MD5
a618181960efc406588f0be3ec463b01

SHA1
a6fc1a0c761fa4e1babd0365b12f593ef051cd3d

SHA256
acd8dfda733fcc57479aea959f4f6040420ada27ed299a4639109ba3bdf7a6a5

SHA512
5a29ff02b1ee54f7893fc710a305eb36ed24e43355ba5ffe57ed122f4e1d935a8a23fad05322ac258c5c89e22f45b21e429dcf792e2e2b180946541d659b77a4

Download Submit
C:\Windows\System\WEpYJyU.exe

Filesize
1.5MB

MD5
c312e54291cf213f3098d4e38b46ce9f

SHA1
806f2146242a7d96e66809338fcc20c87bd4555e

SHA256
596e755cf01288b3bc431d00f1986f2d16aab3968bc4287d1f3d029478067552

SHA512
6001e53091c568399164ae0ee2bfb6b2a6be9809f800f31f90cf41aeb2f319e116ed034d2ca27fa156406de15940d8e03bd8493de098aa9389ffb9aa9d69eea8

Download Submit
C:\Windows\System\WOHBgSY.exe

Filesize
1.5MB

MD5
40fb060f33afe13d24c7e2f71ebd1f8d

SHA1
ac2417204095a23f3f832d9698ad2e3212ce5cda

SHA256
250b58be83b68f74a1f95da6c199354448ac3cb32b0956abba922696d381220e

SHA512
a1ea131ee35a720d5e1525cc1bc4657f08c36d244030766445c5de9f29263cc703f4d6c46a26eed864c7ccbb239baf9a3e9699f0e59a06ed0bd4b941fdd518d4

Download Submit
C:\Windows\System\XOOmDrF.exe

Filesize
1.5MB

MD5
e6d943b4cf8950975d827c31fb4c00d1

SHA1
8f11b5d37280bcffaceff77daa837d013f0d531f

SHA256
476253568f95395ed9aa7202de8e082b02251a1416895a80cbbbd1226a55a07f

SHA512
33568e3f01fe6515df7b1061538602c9093428e7f27bf655ed0a5d2f95f4f8bc599796f77fca939ba6d605d672c00f6cde7e387bf0aa7965958e63ee75ff529f

Download Submit
C:\Windows\System\ZxTGvzf.exe

Filesize
1.5MB

MD5
916bd5321b431e2804e2340501eafc1b

SHA1
17d7a0c1a225bc0f926deb3c586bf4694c1550b7

SHA256
b9dcd6fd48066b6edf40d9d8aea552dfac5e36f3909950ff9cf385b4ad4b454f

SHA512
9e4ecedcaa0caa2b448bf22b09f92670f35c534a450819160fa1cbf051822d884c0d8ef553d3b1e717c2427b3eb5e66abd9cb9a69eafd0afe4d7a13a1ee5d063

Download Submit
C:\Windows\System\bBETmfa.exe

Filesize
1.5MB

MD5
d07d9a71f1f1b00896c0d43235861103

SHA1
4a3f35ac3ce4147997552e8c04050dbd49dd9924

SHA256
4a63cc46bd9a9b1b3661fddd2ea99172d321c537091bf53535ba6a294f569bfb

SHA512
fc213f6101e11f92dc41d18a883a98e7a6932b45dd064eca2f0b14d069f8b89cc9cf847f69cc4c3a1cb012418e73827c82613df261425bb9c042def852aecb69

Download Submit
C:\Windows\System\erxKGEn.exe

Filesize
1.5MB

MD5
1085d6570322fd8f366fd61701eeb756

SHA1
cefbed9a5e3bc41aaa5140a0ce5898e328a7d5c8

SHA256
98a3174348a68f1ad84953c38a55c883f2aa95110c40fe3af971b0c4c5c80c47

SHA512
d1cbf8a0f14d790580ac99326f914afb805eae9310d52a49eb4a16fc6efd62171cb13014a26ae92f37e9fb43c49de76bd27bff85f466453362f51d3b431437c9

Download Submit
C:\Windows\System\fOBmZOq.exe

Filesize
1.5MB

MD5
60a3f53c177637f0f56e57369dff1801

SHA1
e02818678179cca8887f9cdc86d882023d55ebfb

SHA256
74df629dab4c159a5ca6923f1a600651737c8c1c6a872659a1743606579eaf3d

SHA512
3894b8a63fc059e98f7366cb2576838c4be761a1a163d5b4ac2312c2bbcdc5551c3e7ceb14d477474fc5ad232447335b47ef292c5ce323dccfa93f0832e7d810

Download Submit
C:\Windows\System\hFWVRVb.exe

Filesize
1.5MB

MD5
ab216f1da72a2cb1215ca31682c4d08b

SHA1
779f02d3f950bd2d146594ec21e3c99dfe0e989b

SHA256
a174b155dd23b8e880e6c2c0a0f5a8cb1a7096e8c0b97244aaea8e30a85da088

SHA512
e94586f101bbd49d7f678bacb2d4815e250304d2c369165952aff76241a74e5dcec500011cb0a6fb14717a247e7f6dda400d6822b357bd52e55f1f5731a3555a

Download Submit
C:\Windows\System\hxafELk.exe

Filesize
1.5MB

MD5
7cb363266c8b75da3ade6b0708b18ce8

SHA1
c8eeee8fe7e6ccc928f10d45273565064dc9a13b

SHA256
b8253aab4bcfec6c460bb6fcab3b9e5cf1a70dc7b424caf07acb357cf2350b75

SHA512
a5218e0c5d79257fa5df74a2b8890fb2f66ca2be362edf7a10bb9a607a52e90da7db17bd59763790d372089950ad935c2dbd208fb63f66b3e6f320f550d2823c

Download Submit
C:\Windows\System\ixGWYde.exe

Filesize
1.5MB

MD5
405e635b7a1419f3b2bdc5d50ae3c98e

SHA1
bd846e7f169ed1b1fc6b0761df95692ad906b49b

SHA256
9f9deb17d38084fd474cb987b6448ae4be32db2d85dbf14fabcfa7bc712212fa

SHA512
d823ab105ff07efa0678d4127faccbd61e8e74e28e271945d4f02de276e21ada0fa9de1be88c7b8137f0545daef273c0b8df20e256dfc81cd71f2793ac54b91b

Download Submit
C:\Windows\System\kKIjQhu.exe

Filesize
1.5MB

MD5
15a3d096b8fe818e902ecf0fe95b27b9

SHA1
c5f0d63cee55b5e92f94f2c20be84c696f18d768

SHA256
ad72bb18fa137358e248ab37afc65c12884dc10d0d67088a65d68094b8e34513

SHA512
f24d3e5333b68161c2130cfe87684a85075751907371522ed95854fc83e6092a687584e761657a69745d9374b370e22c90708b6618fc1b9c4d0170b70451fda6

Download Submit
C:\Windows\System\mJHVivs.exe

Filesize
1.5MB

MD5
919380ef2e2e0147a2e05de597da8b27

SHA1
0b5d60aa73e01a845a5e58f9886f29ccf846457b

SHA256
5cc0b7f48025a4561fae60a81655f825117e647642513eb71f71da3c5effed68

SHA512
4d501908f09767fbf096caed689727b93da8c18b722558e0fbab0cee0b94131378d092e3fab7037dbbf0d74e7a4b3a5f4ac775b64c7e46d977f2731c88d761b3

Download Submit
C:\Windows\System\nLmfgtE.exe

Filesize
1.5MB

MD5
1703591fe5d7f3c0bd77646949d58610

SHA1
82489b511c7240eafd340a4607d0be1b68d94cf4

SHA256
12876ced402bf7d6ec62327a72663388f576075f92cade672c2a22981258aed3

SHA512
2f9a4cf02d1a10cf395fb71163368e4f5eca9dcd764d1055055ce7a09b77d7694b0f4379c283987cf88ba2b587f0e33b5863c0de726d12a3a9f732703e7571cd

Download Submit
C:\Windows\System\njHHPXU.exe

Filesize
1.5MB

MD5
264bf5e6241a907317d40134f9538c89

SHA1
9f07d51396f14d611021b1e1abe89be70a80da31

SHA256
de15d28bd8bc8fb0518aa9b01764c925e5d294bbb515a26eac19b5bae9dde473

SHA512
54dfc580b18924a5f2e021f4ebd256362e1f5bfc83c7faf4d9d4e2e89fc14c2562da9f3a5e1693b99cd6dba5739aaecafea3aba704bc7b69485c5e2bfbc66ee3

Download Submit
C:\Windows\System\nmUSSrs.exe

Filesize
1.5MB

MD5
5778b300e22ebabc330548f676f1974e

SHA1
d4872ca07c18e717076399dd653cb4d580978aa3

SHA256
673ccd329372027ecfec1c0006fc36f36f8b6ac4a373316c3006b11f2559429b

SHA512
78e2bbc763739b3ac993282960adeba1a9b85bdf989f5d96b0b2fdc481b12a8e87503d4e683e0c0fea2aaaf838285a6552205bd7889931993da1ff37b37055c7

Download Submit
C:\Windows\System\qCaAWSZ.exe

Filesize
1.5MB

MD5
98011ee6419081fdaea87814e4155473

SHA1
0790e08289c63a36cdda54c9de99962f84f9288d

SHA256
f9289897ac2a937d8ad107e0ccb874ffd7b55224631e33f0270595b5c818ab6b

SHA512
b22e6b37a7011ee463061587658bd9a2cad94f20aad6a1c8c869f485be89cf580c3cb907a96a41f34d33f3726eb55f027278b8a6fe5bb12ed6d35b38bba2fbdb

Download Submit
C:\Windows\System\rQnIfWK.exe

Filesize
1.5MB

MD5
d4b257ae76765da987740fe44bfec1a9

SHA1
c25dd43df3303655e51575e10896d7b66493cb74

SHA256
85c43c3b8aecbe7493395dfca68a422a95de664ba984d8ba7616436dc0c6397a

SHA512
e6bc3ae3d3eb509462a62f29b7d4df9913b399f5f21b093373d2674d422d188cd6229dba56e5919c5d1f3debb1e469607bcd396d607ce5c9cd46af265c6ceb7f

Download Submit
C:\Windows\System\scGKkwO.exe

Filesize
1.5MB

MD5
5f58fcde7420259160fce4e838c401d5

SHA1
03769017cec9e8dca54e63b68f29320cf65477e4

SHA256
75ee5cc00b8724c15b86e04b30e191bacff769e675e2e81d00ac27606d2568b6

SHA512
ceaf601d2197f5413f100b1e7405c333d884ebe1681f375bd6823aa3230a7be607cba53260cd00bc17211a7a955ad309221a79770449cad47dfcde909700dfef

Download Submit
C:\Windows\System\uDbwBOH.exe

Filesize
1.5MB

MD5
04fbfdb6e67af90b2726b666a11a22a0

SHA1
757648f228e8b38f7b84c077f1a88dcc5c248b5d

SHA256
bd4a0b86128396f31ad8623c24486bdcd7cc721899a60ab45cc8c629bb32f004

SHA512
1bd4b61ab6a335ecc89cff57adebdb7d9bc234417ce6066e3f098393043b1bb8da1f84cdd03ce55d0f46fd0ab8a9a44b7a912421e4d00761065c15ba8779ab87

Download Submit
C:\Windows\System\uKykgno.exe

Filesize
1.5MB

MD5
68995cda2272f8deeaeb2caaf7c0cf70

SHA1
4b218e34173cf3ad0e7db783f72868ed2ef9807f

SHA256
71d0b1ad5a40a3dcd46f0e976fba092cf67d73354c4f67cb73bded669143d91a

SHA512
b22a14260fb07c31217dc06b8d9964cf17ee3d3c45a9a8ccaf74c8114847449250563bb0a1ebcdd0902f69faed4aadf4a7ae4e65c8aa95df492f21bae7ec9f4f

Download Submit
C:\Windows\System\uOfzBfL.exe

Filesize
1.5MB

MD5
4fe7de15eb50dd6fd8018f52d7cf89f1

SHA1
ee3e679da3ad90caa25b651d59a0541599c3e002

SHA256
b1a66f851d87495f4fa2b2d8e8ac5f468980205b9c2373e69b2d1a607d34b909

SHA512
ccd69e4bc74bd72116c03571e90523c173aa59eb0d556a1143b18b28c706ce3d1ed5151d2b80a12685f12ad17702c215bca96cf9a0803b0544cd17f0963e2268

Download Submit
C:\Windows\System\wlxddLL.exe

Filesize
1.5MB

MD5
3cb4a831e99c24d85a8217bdb94fa573

SHA1
96593e9e9274952f071bc46ced6dcf516f802408

SHA256
dc1f95bdc76dd19447e3c5dd20e061b4c7eac0f7ab5cd19af186543be2059a23

SHA512
c357368f4b41e68a01ddd8f641a3033e84f705545e0b94aca6f0a3365de51d37aec9c80778d7e10f29725a37f31f5bc3390713ab62c085cd3d2efad64a78fe77

Download Submit
C:\Windows\System\ykkwnpm.exe

Filesize
1.5MB

MD5
324226f898088844349146223811cdd3

SHA1
553273190af6c51ce3b752db8880d63843443ef5

SHA256
b7f1a41e1ddf6018a9c987ba1ca27c01f2edf627ac2d5b25ae32db44c4950cff

SHA512
0052e4910bdec361650210113663c6705c2bb3c4972a29404629b99a340c234737a5b81ef831dd702d723c7f0a3be4881124aefd7ef60810f374e0c3f04a5e2b

Download Submit
memory/532-2209-0x00007FF788E40000-0x00007FF789191000-memory.dmp

Filesize
3.3MB

Download
memory/532-546-0x00007FF788E40000-0x00007FF789191000-memory.dmp

Filesize
3.3MB

Download
memory/1232-68-0x00007FF688680000-0x00007FF6889D1000-memory.dmp

Filesize
3.3MB

Download
memory/1232-2215-0x00007FF688680000-0x00007FF6889D1000-memory.dmp

Filesize
3.3MB

Download
memory/1288-2250-0x00007FF742580000-0x00007FF7428D1000-memory.dmp

Filesize
3.3MB

Download
memory/1288-550-0x00007FF742580000-0x00007FF7428D1000-memory.dmp

Filesize
3.3MB

Download
memory/1516-266-0x00007FF6FC290000-0x00007FF6FC5E1000-memory.dmp

Filesize
3.3MB

Download
memory/1516-2251-0x00007FF6FC290000-0x00007FF6FC5E1000-memory.dmp

Filesize
3.3MB

Download
memory/1532-2101-0x00007FF6FA020000-0x00007FF6FA371000-memory.dmp

Filesize
3.3MB

Download
memory/1532-0-0x00007FF6FA020000-0x00007FF6FA371000-memory.dmp

Filesize
3.3MB

Download
memory/1532-1-0x0000027C00B20000-0x0000027C00B30000-memory.dmp

Filesize
64KB

Download
memory/1888-2217-0x00007FF601260000-0x00007FF6015B1000-memory.dmp

Filesize
3.3MB

Download
memory/1888-38-0x00007FF601260000-0x00007FF6015B1000-memory.dmp

Filesize
3.3MB

Download
memory/1940-534-0x00007FF69EA30000-0x00007FF69ED81000-memory.dmp

Filesize
3.3MB

Download
memory/1940-2272-0x00007FF69EA30000-0x00007FF69ED81000-memory.dmp

Filesize
3.3MB

Download
memory/2256-207-0x00007FF7E02B0000-0x00007FF7E0601000-memory.dmp

Filesize
3.3MB

Download
memory/2256-2225-0x00007FF7E02B0000-0x00007FF7E0601000-memory.dmp

Filesize
3.3MB

Download
memory/2400-2203-0x00007FF76B9C0000-0x00007FF76BD11000-memory.dmp

Filesize
3.3MB

Download
memory/2400-18-0x00007FF76B9C0000-0x00007FF76BD11000-memory.dmp

Filesize
3.3MB

Download
memory/2456-2205-0x00007FF6FFAD0000-0x00007FF6FFE21000-memory.dmp

Filesize
3.3MB

Download
memory/2456-64-0x00007FF6FFAD0000-0x00007FF6FFE21000-memory.dmp

Filesize
3.3MB

Download
memory/2524-2212-0x00007FF78F1D0000-0x00007FF78F521000-memory.dmp

Filesize
3.3MB

Download
memory/2524-548-0x00007FF78F1D0000-0x00007FF78F521000-memory.dmp

Filesize
3.3MB

Download
memory/2648-2208-0x00007FF622F80000-0x00007FF6232D1000-memory.dmp

Filesize
3.3MB

Download
memory/2648-102-0x00007FF622F80000-0x00007FF6232D1000-memory.dmp

Filesize
3.3MB

Download
memory/2756-2243-0x00007FF634E00000-0x00007FF635151000-memory.dmp

Filesize
3.3MB

Download
memory/2756-269-0x00007FF634E00000-0x00007FF635151000-memory.dmp

Filesize
3.3MB

Download
memory/2776-2242-0x00007FF6D77F0000-0x00007FF6D7B41000-memory.dmp

Filesize
3.3MB

Download
memory/2776-430-0x00007FF6D77F0000-0x00007FF6D7B41000-memory.dmp

Filesize
3.3MB

Download
memory/3032-2238-0x00007FF714830000-0x00007FF714B81000-memory.dmp

Filesize
3.3MB

Download
memory/3032-542-0x00007FF714830000-0x00007FF714B81000-memory.dmp

Filesize
3.3MB

Download
memory/3172-2201-0x00007FF7930D0000-0x00007FF793421000-memory.dmp

Filesize
3.3MB

Download
memory/3172-547-0x00007FF7930D0000-0x00007FF793421000-memory.dmp

Filesize
3.3MB

Download
memory/3224-2214-0x00007FF688DA0000-0x00007FF6890F1000-memory.dmp

Filesize
3.3MB

Download
memory/3224-133-0x00007FF688DA0000-0x00007FF6890F1000-memory.dmp

Filesize
3.3MB

Download
memory/3440-367-0x00007FF7A9E20000-0x00007FF7AA171000-memory.dmp

Filesize
3.3MB

Download
memory/3440-2229-0x00007FF7A9E20000-0x00007FF7AA171000-memory.dmp

Filesize
3.3MB

Download
memory/3456-2223-0x00007FF74A880000-0x00007FF74ABD1000-memory.dmp

Filesize
3.3MB

Download
memory/3456-175-0x00007FF74A880000-0x00007FF74ABD1000-memory.dmp

Filesize
3.3MB

Download
memory/3476-2240-0x00007FF7325B0000-0x00007FF732901000-memory.dmp

Filesize
3.3MB

Download
memory/3476-544-0x00007FF7325B0000-0x00007FF732901000-memory.dmp

Filesize
3.3MB

Download
memory/3512-2234-0x00007FF6EB110000-0x00007FF6EB461000-memory.dmp

Filesize
3.3MB

Download
memory/3512-545-0x00007FF6EB110000-0x00007FF6EB461000-memory.dmp

Filesize
3.3MB

Download
memory/3700-2199-0x00007FF707640000-0x00007FF707991000-memory.dmp

Filesize
3.3MB

Download
memory/3700-16-0x00007FF707640000-0x00007FF707991000-memory.dmp

Filesize
3.3MB

Download
memory/3964-533-0x00007FF7814C0000-0x00007FF781811000-memory.dmp

Filesize
3.3MB

Download
memory/3964-2254-0x00007FF7814C0000-0x00007FF781811000-memory.dmp

Filesize
3.3MB

Download
memory/4024-2221-0x00007FF634470000-0x00007FF6347C1000-memory.dmp

Filesize
3.3MB

Download
memory/4024-549-0x00007FF634470000-0x00007FF6347C1000-memory.dmp

Filesize
3.3MB

Download
memory/4108-2264-0x00007FF6283E0000-0x00007FF628731000-memory.dmp

Filesize
3.3MB

Download
memory/4108-537-0x00007FF6283E0000-0x00007FF628731000-memory.dmp

Filesize
3.3MB

Download
memory/4340-328-0x00007FF76C150000-0x00007FF76C4A1000-memory.dmp

Filesize
3.3MB

Download
memory/4340-2228-0x00007FF76C150000-0x00007FF76C4A1000-memory.dmp

Filesize
3.3MB

Download
memory/4744-2236-0x00007FF7799B0000-0x00007FF779D01000-memory.dmp

Filesize
3.3MB

Download
memory/4744-326-0x00007FF7799B0000-0x00007FF779D01000-memory.dmp

Filesize
3.3MB

Download
memory/4792-431-0x00007FF631AA0000-0x00007FF631DF1000-memory.dmp

Filesize
3.3MB

Download
memory/4792-2246-0x00007FF631AA0000-0x00007FF631DF1000-memory.dmp

Filesize
3.3MB

Download
memory/4796-172-0x00007FF728C90000-0x00007FF728FE1000-memory.dmp

Filesize
3.3MB

Download
memory/4796-2219-0x00007FF728C90000-0x00007FF728FE1000-memory.dmp

Filesize
3.3MB

Download
memory/5056-543-0x00007FF7B1540000-0x00007FF7B1891000-memory.dmp

Filesize
3.3MB

Download
memory/5056-2247-0x00007FF7B1540000-0x00007FF7B1891000-memory.dmp

Filesize
3.3MB

Download