xmrig | 629b35518331862d32b70e2dbcc872e501e0bece6523afd16aa48ba556ca3d55

Analysis

max time kernel
123s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
Size

1.7MB
MD5

21c127ad134c984c089a66e809f05f80
SHA1

4df70a10405db57dee6cd8d9bb47973110e10a0e
SHA256

629b35518331862d32b70e2dbcc872e501e0bece6523afd16aa48ba556ca3d55
SHA512

8c65f7366720eae7c253458a61f5e529e88cf9a97047f06570a12db6ff5aef819f1cd67e815405d8858b72c57e14364b5e2682377eb5f73b786ed2194c623163
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727ZvhwoONE6phFrMiBsQVWGoPN966xy5eAOkzJsfEFj:ROdWCCi7/rahFD2P6QV8NcxeLkOP2JV1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 55 IoCs

miner

resource	yara_rule
behavioral2/memory/3916-38-0x00007FF6858B0000-0x00007FF685C01000-memory.dmp	xmrig
behavioral2/memory/4388-21-0x00007FF62D050000-0x00007FF62D3A1000-memory.dmp	xmrig
behavioral2/memory/4744-205-0x00007FF680B30000-0x00007FF680E81000-memory.dmp	xmrig
behavioral2/memory/4220-209-0x00007FF6C67A0000-0x00007FF6C6AF1000-memory.dmp	xmrig
behavioral2/memory/4720-221-0x00007FF6F0A50000-0x00007FF6F0DA1000-memory.dmp	xmrig
behavioral2/memory/640-223-0x00007FF65AA90000-0x00007FF65ADE1000-memory.dmp	xmrig
behavioral2/memory/2716-222-0x00007FF7ECD70000-0x00007FF7ED0C1000-memory.dmp	xmrig
behavioral2/memory/216-220-0x00007FF684BC0000-0x00007FF684F11000-memory.dmp	xmrig
behavioral2/memory/3296-218-0x00007FF63AF20000-0x00007FF63B271000-memory.dmp	xmrig
behavioral2/memory/404-212-0x00007FF759BB0000-0x00007FF759F01000-memory.dmp	xmrig
behavioral2/memory/2640-207-0x00007FF776CD0000-0x00007FF777021000-memory.dmp	xmrig
behavioral2/memory/4120-206-0x00007FF6639E0000-0x00007FF663D31000-memory.dmp	xmrig
behavioral2/memory/2368-181-0x00007FF680F90000-0x00007FF6812E1000-memory.dmp	xmrig
behavioral2/memory/5008-61-0x00007FF65E360000-0x00007FF65E6B1000-memory.dmp	xmrig
behavioral2/memory/936-2166-0x00007FF607AB0000-0x00007FF607E01000-memory.dmp	xmrig
behavioral2/memory/4388-2265-0x00007FF62D050000-0x00007FF62D3A1000-memory.dmp	xmrig
behavioral2/memory/216-2267-0x00007FF684BC0000-0x00007FF684F11000-memory.dmp	xmrig
behavioral2/memory/4720-2270-0x00007FF6F0A50000-0x00007FF6F0DA1000-memory.dmp	xmrig
behavioral2/memory/2368-2271-0x00007FF680F90000-0x00007FF6812E1000-memory.dmp	xmrig
behavioral2/memory/3916-2275-0x00007FF6858B0000-0x00007FF685C01000-memory.dmp	xmrig
behavioral2/memory/5008-2277-0x00007FF65E360000-0x00007FF65E6B1000-memory.dmp	xmrig
behavioral2/memory/2956-2274-0x00007FF702640000-0x00007FF702991000-memory.dmp	xmrig
behavioral2/memory/2640-2282-0x00007FF776CD0000-0x00007FF777021000-memory.dmp	xmrig
behavioral2/memory/4120-2280-0x00007FF6639E0000-0x00007FF663D31000-memory.dmp	xmrig
behavioral2/memory/632-2283-0x00007FF683020000-0x00007FF683371000-memory.dmp	xmrig
behavioral2/memory/2716-2296-0x00007FF7ECD70000-0x00007FF7ED0C1000-memory.dmp	xmrig
behavioral2/memory/4844-2297-0x00007FF6B9890000-0x00007FF6B9BE1000-memory.dmp	xmrig
behavioral2/memory/640-2299-0x00007FF65AA90000-0x00007FF65ADE1000-memory.dmp	xmrig
behavioral2/memory/4220-2294-0x00007FF6C67A0000-0x00007FF6C6AF1000-memory.dmp	xmrig
behavioral2/memory/3296-2292-0x00007FF63AF20000-0x00007FF63B271000-memory.dmp	xmrig
behavioral2/memory/404-2290-0x00007FF759BB0000-0x00007FF759F01000-memory.dmp	xmrig
behavioral2/memory/980-2288-0x00007FF60CD80000-0x00007FF60D0D1000-memory.dmp	xmrig
behavioral2/memory/4744-2286-0x00007FF680B30000-0x00007FF680E81000-memory.dmp	xmrig
behavioral2/memory/3620-2386-0x00007FF711E00000-0x00007FF712151000-memory.dmp	xmrig
behavioral2/memory/4456-2388-0x00007FF658EC0000-0x00007FF659211000-memory.dmp	xmrig
behavioral2/memory/1524-2391-0x00007FF63CBB0000-0x00007FF63CF01000-memory.dmp	xmrig
behavioral2/memory/2416-2394-0x00007FF6F4B50000-0x00007FF6F4EA1000-memory.dmp	xmrig
behavioral2/memory/1960-2393-0x00007FF7401C0000-0x00007FF740511000-memory.dmp	xmrig
behavioral2/memory/4832-2392-0x00007FF711B50000-0x00007FF711EA1000-memory.dmp	xmrig
behavioral2/memory/4800-2390-0x00007FF7BDCB0000-0x00007FF7BE001000-memory.dmp	xmrig
behavioral2/memory/1220-2389-0x00007FF6DDBA0000-0x00007FF6DDEF1000-memory.dmp	xmrig
behavioral2/memory/4136-2387-0x00007FF61D290000-0x00007FF61D5E1000-memory.dmp	xmrig
behavioral2/memory/2496-2395-0x00007FF6056D0000-0x00007FF605A21000-memory.dmp	xmrig
behavioral2/memory/560-2396-0x00007FF6D1180000-0x00007FF6D14D1000-memory.dmp	xmrig
behavioral2/memory/4136-2400-0x00007FF61D290000-0x00007FF61D5E1000-memory.dmp	xmrig
behavioral2/memory/3620-2399-0x00007FF711E00000-0x00007FF712151000-memory.dmp	xmrig
behavioral2/memory/4832-2414-0x00007FF711B50000-0x00007FF711EA1000-memory.dmp	xmrig
behavioral2/memory/4456-2418-0x00007FF658EC0000-0x00007FF659211000-memory.dmp	xmrig
behavioral2/memory/2496-2421-0x00007FF6056D0000-0x00007FF605A21000-memory.dmp	xmrig
behavioral2/memory/560-2425-0x00007FF6D1180000-0x00007FF6D14D1000-memory.dmp	xmrig
behavioral2/memory/1220-2430-0x00007FF6DDBA0000-0x00007FF6DDEF1000-memory.dmp	xmrig
behavioral2/memory/4800-2429-0x00007FF7BDCB0000-0x00007FF7BE001000-memory.dmp	xmrig
behavioral2/memory/1524-2447-0x00007FF63CBB0000-0x00007FF63CF01000-memory.dmp	xmrig
behavioral2/memory/1960-2458-0x00007FF7401C0000-0x00007FF740511000-memory.dmp	xmrig
behavioral2/memory/2416-2449-0x00007FF6F4B50000-0x00007FF6F4EA1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4388	kqBpMCO.exe
216	lEaqhJt.exe
2956	tsGudHr.exe
3916	sHZZMiG.exe
4720	GPzYchw.exe
632	XjWGqSZ.exe
5008	dpIkjMp.exe
2716	skNryex.exe
980	fDxUqnN.exe
4844	cNTXTEH.exe
2368	fEdoYqz.exe
640	IWkwmvY.exe
4744	YgPyluI.exe
4120	PDQSikm.exe
2640	OqsQvYx.exe
3620	wsPzxck.exe
2496	pdMTGbY.exe
4220	bMsOgDf.exe
4136	cbCVpAP.exe
4456	sbXTPAC.exe
404	SaSCxOd.exe
1220	nLeBzsQ.exe
4800	MzBnjaV.exe
1524	YHSYIqL.exe
4832	fjeZChG.exe
560	fErfphq.exe
1960	nRNocKM.exe
3296	gEPLHWJ.exe
2416	mwUzjav.exe
1124	nXROwgq.exe
3680	GQnqjNC.exe
3760	LHpyPYV.exe
2932	EEpXRNI.exe
1592	VktOvcB.exe
1324	glGayUa.exe
2120	ovDFqZD.exe
4860	zelhbIV.exe
1164	sYDCRAk.exe
3476	JAFoevv.exe
3644	MCUixYR.exe
3840	WbgLpHO.exe
3596	CepymLM.exe
460	SQUGhxX.exe
4532	IVxuuiO.exe
3208	MXxJUPT.exe
548	FIczapu.exe
1800	pKBqyZR.exe
916	IisiHou.exe
4320	UibAslJ.exe
1328	YkZoFAM.exe
4980	NuywVQY.exe
3484	aIwPllC.exe
5024	RUJJdSN.exe
1948	ZhgBiRa.exe
4376	rGoVBLV.exe
744	xoXYyQY.exe
5032	POlRycv.exe
2732	BOoOhZc.exe
2044	aLvkHNv.exe
4192	QvuYjtg.exe
1888	fFWpKGE.exe
1696	ZClvGGK.exe
3104	cjShSss.exe
3560	cyxaFDv.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/936-0-0x00007FF607AB0000-0x00007FF607E01000-memory.dmp	upx
behavioral2/files/0x00080000000233e8-6.dat	upx
behavioral2/files/0x00070000000233ed-8.dat	upx
behavioral2/memory/3916-38-0x00007FF6858B0000-0x00007FF685C01000-memory.dmp	upx
behavioral2/files/0x00070000000233ef-26.dat	upx
behavioral2/memory/4388-21-0x00007FF62D050000-0x00007FF62D3A1000-memory.dmp	upx
behavioral2/files/0x00070000000233ee-20.dat	upx
behavioral2/files/0x00070000000233f3-44.dat	upx
behavioral2/files/0x00070000000233f7-65.dat	upx
behavioral2/files/0x00070000000233fc-87.dat	upx
behavioral2/files/0x0007000000023401-117.dat	upx
behavioral2/files/0x000700000002340b-168.dat	upx
behavioral2/memory/4744-205-0x00007FF680B30000-0x00007FF680E81000-memory.dmp	upx
behavioral2/memory/4220-209-0x00007FF6C67A0000-0x00007FF6C6AF1000-memory.dmp	upx
behavioral2/memory/4800-214-0x00007FF7BDCB0000-0x00007FF7BE001000-memory.dmp	upx
behavioral2/memory/4720-221-0x00007FF6F0A50000-0x00007FF6F0DA1000-memory.dmp	upx
behavioral2/memory/560-225-0x00007FF6D1180000-0x00007FF6D14D1000-memory.dmp	upx
behavioral2/memory/2496-224-0x00007FF6056D0000-0x00007FF605A21000-memory.dmp	upx
behavioral2/memory/640-223-0x00007FF65AA90000-0x00007FF65ADE1000-memory.dmp	upx
behavioral2/memory/2716-222-0x00007FF7ECD70000-0x00007FF7ED0C1000-memory.dmp	upx
behavioral2/memory/216-220-0x00007FF684BC0000-0x00007FF684F11000-memory.dmp	upx
behavioral2/memory/2416-219-0x00007FF6F4B50000-0x00007FF6F4EA1000-memory.dmp	upx
behavioral2/memory/3296-218-0x00007FF63AF20000-0x00007FF63B271000-memory.dmp	upx
behavioral2/memory/1960-217-0x00007FF7401C0000-0x00007FF740511000-memory.dmp	upx
behavioral2/memory/4832-216-0x00007FF711B50000-0x00007FF711EA1000-memory.dmp	upx
behavioral2/memory/1524-215-0x00007FF63CBB0000-0x00007FF63CF01000-memory.dmp	upx
behavioral2/memory/1220-213-0x00007FF6DDBA0000-0x00007FF6DDEF1000-memory.dmp	upx
behavioral2/memory/404-212-0x00007FF759BB0000-0x00007FF759F01000-memory.dmp	upx
behavioral2/memory/4456-211-0x00007FF658EC0000-0x00007FF659211000-memory.dmp	upx
behavioral2/memory/4136-210-0x00007FF61D290000-0x00007FF61D5E1000-memory.dmp	upx
behavioral2/memory/3620-208-0x00007FF711E00000-0x00007FF712151000-memory.dmp	upx
behavioral2/memory/2640-207-0x00007FF776CD0000-0x00007FF777021000-memory.dmp	upx
behavioral2/memory/4120-206-0x00007FF6639E0000-0x00007FF663D31000-memory.dmp	upx
behavioral2/files/0x0007000000023408-204.dat	upx
behavioral2/files/0x00070000000233fe-203.dat	upx
behavioral2/files/0x0007000000023416-202.dat	upx
behavioral2/files/0x0007000000023415-201.dat	upx
behavioral2/files/0x0007000000023406-195.dat	upx
behavioral2/files/0x0007000000023414-194.dat	upx
behavioral2/files/0x0007000000023413-193.dat	upx
behavioral2/files/0x0007000000023412-190.dat	upx
behavioral2/files/0x0007000000023411-189.dat	upx
behavioral2/files/0x0007000000023410-187.dat	upx
behavioral2/files/0x00070000000233f6-184.dat	upx
behavioral2/memory/2368-181-0x00007FF680F90000-0x00007FF6812E1000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-180.dat	upx
behavioral2/files/0x000700000002340f-177.dat	upx
behavioral2/files/0x000700000002340e-176.dat	upx
behavioral2/files/0x000700000002340c-171.dat	upx
behavioral2/files/0x000700000002340a-160.dat	upx
behavioral2/files/0x0007000000023409-156.dat	upx
behavioral2/files/0x00070000000233ff-155.dat	upx
behavioral2/files/0x00070000000233fa-154.dat	upx
behavioral2/files/0x0007000000023407-147.dat	upx
behavioral2/files/0x0007000000023405-132.dat	upx
behavioral2/memory/4844-124-0x00007FF6B9890000-0x00007FF6B9BE1000-memory.dmp	upx
behavioral2/files/0x0007000000023403-119.dat	upx
behavioral2/files/0x0007000000023402-118.dat	upx
behavioral2/files/0x0007000000023400-116.dat	upx
behavioral2/files/0x00070000000233f2-138.dat	upx
behavioral2/files/0x0007000000023404-131.dat	upx
behavioral2/files/0x00070000000233f0-92.dat	upx
behavioral2/files/0x00070000000233f4-83.dat	upx
behavioral2/memory/980-81-0x00007FF60CD80000-0x00007FF60D0D1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LhMHSNl.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\fEdoYqz.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\hSzpmQw.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\txTZWny.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\MbIZPPh.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\dhbFwPH.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\JrDkHxg.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\FbyGWbp.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\SlJtxEe.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\YPuVGcr.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\OqsQvYx.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\xkdYsVk.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\RWxOAdU.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\GihyJnr.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\OQyMoCJ.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\GmpAVgq.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\SpWsLxZ.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\sDQhwLc.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\ufOwHRg.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\HeNMdHC.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\qXPpTLI.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\yyNsLiF.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\dJRsmKw.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\LgxVJaj.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\MXxJUPT.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\bWxdiVQ.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\GEfWvaN.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\lEQkxpi.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\PcRSGZR.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\tsGudHr.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\FkisUFt.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\dyTTpNF.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\rIGetYi.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\tWAELPE.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\GpBeDXg.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\MNGmFcB.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\skNryex.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\uGGBFQl.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\DQvyuiS.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\bajtfCK.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\OalyMNV.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\pdjZFlt.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\DSEdlNP.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\WQmXkMT.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\xgMDbRv.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\hkyCtrF.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\MjrEnJR.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\zTJzOyn.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\MXVBPxq.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\qzPYgTc.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\qKMCkYO.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\NpWnFRe.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\ezenOFD.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\FftwfHu.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\VmLxRSk.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\qKfMFDY.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\xoXYyQY.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\oqowClR.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\oAvUGlj.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\xOpOVoY.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\euMgSkt.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\adJJHnM.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\ojrMipL.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
File created	C:\Windows\System\JRqnlrr.exe	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 4388	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	84
PID 936 wrote to memory of 4388	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	84
PID 936 wrote to memory of 216	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	85
PID 936 wrote to memory of 216	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	85
PID 936 wrote to memory of 2956	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	86
PID 936 wrote to memory of 2956	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	86
PID 936 wrote to memory of 3916	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	87
PID 936 wrote to memory of 3916	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	87
PID 936 wrote to memory of 4720	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	88
PID 936 wrote to memory of 4720	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	88
PID 936 wrote to memory of 632	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	89
PID 936 wrote to memory of 632	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	89
PID 936 wrote to memory of 5008	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	90
PID 936 wrote to memory of 5008	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	90
PID 936 wrote to memory of 4844	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	91
PID 936 wrote to memory of 4844	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	91
PID 936 wrote to memory of 2716	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	92
PID 936 wrote to memory of 2716	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	92
PID 936 wrote to memory of 980	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	93
PID 936 wrote to memory of 980	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	93
PID 936 wrote to memory of 2368	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	94
PID 936 wrote to memory of 2368	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	94
PID 936 wrote to memory of 640	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	95
PID 936 wrote to memory of 640	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	95
PID 936 wrote to memory of 4744	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	96
PID 936 wrote to memory of 4744	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	96
PID 936 wrote to memory of 4120	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	97
PID 936 wrote to memory of 4120	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	97
PID 936 wrote to memory of 2640	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	98
PID 936 wrote to memory of 2640	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	98
PID 936 wrote to memory of 3620	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	99
PID 936 wrote to memory of 3620	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	99
PID 936 wrote to memory of 2496	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	100
PID 936 wrote to memory of 2496	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	100
PID 936 wrote to memory of 4220	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	101
PID 936 wrote to memory of 4220	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	101
PID 936 wrote to memory of 4136	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	102
PID 936 wrote to memory of 4136	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	102
PID 936 wrote to memory of 4456	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	103
PID 936 wrote to memory of 4456	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	103
PID 936 wrote to memory of 404	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	104
PID 936 wrote to memory of 404	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	104
PID 936 wrote to memory of 1220	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	105
PID 936 wrote to memory of 1220	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	105
PID 936 wrote to memory of 4800	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	106
PID 936 wrote to memory of 4800	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	106
PID 936 wrote to memory of 1524	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	107
PID 936 wrote to memory of 1524	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	107
PID 936 wrote to memory of 4832	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	108
PID 936 wrote to memory of 4832	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	108
PID 936 wrote to memory of 560	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	109
PID 936 wrote to memory of 560	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	109
PID 936 wrote to memory of 1960	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	110
PID 936 wrote to memory of 1960	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	110
PID 936 wrote to memory of 3296	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	111
PID 936 wrote to memory of 3296	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	111
PID 936 wrote to memory of 2416	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	112
PID 936 wrote to memory of 2416	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	112
PID 936 wrote to memory of 460	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	113
PID 936 wrote to memory of 460	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	113
PID 936 wrote to memory of 1124	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	114
PID 936 wrote to memory of 1124	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	114
PID 936 wrote to memory of 3680	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	115
PID 936 wrote to memory of 3680	936	21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\21c127ad134c984c089a66e809f05f80_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\System\kqBpMCO.exe
  C:\Windows\System\kqBpMCO.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\lEaqhJt.exe
  C:\Windows\System\lEaqhJt.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\tsGudHr.exe
  C:\Windows\System\tsGudHr.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\sHZZMiG.exe
  C:\Windows\System\sHZZMiG.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\GPzYchw.exe
  C:\Windows\System\GPzYchw.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\XjWGqSZ.exe
  C:\Windows\System\XjWGqSZ.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\dpIkjMp.exe
  C:\Windows\System\dpIkjMp.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\cNTXTEH.exe
  C:\Windows\System\cNTXTEH.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\skNryex.exe
  C:\Windows\System\skNryex.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\fDxUqnN.exe
  C:\Windows\System\fDxUqnN.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\fEdoYqz.exe
  C:\Windows\System\fEdoYqz.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\IWkwmvY.exe
  C:\Windows\System\IWkwmvY.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\YgPyluI.exe
  C:\Windows\System\YgPyluI.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\PDQSikm.exe
  C:\Windows\System\PDQSikm.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\OqsQvYx.exe
  C:\Windows\System\OqsQvYx.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\wsPzxck.exe
  C:\Windows\System\wsPzxck.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\pdMTGbY.exe
  C:\Windows\System\pdMTGbY.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\bMsOgDf.exe
  C:\Windows\System\bMsOgDf.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\cbCVpAP.exe
  C:\Windows\System\cbCVpAP.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\sbXTPAC.exe
  C:\Windows\System\sbXTPAC.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\SaSCxOd.exe
  C:\Windows\System\SaSCxOd.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\nLeBzsQ.exe
  C:\Windows\System\nLeBzsQ.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\MzBnjaV.exe
  C:\Windows\System\MzBnjaV.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\YHSYIqL.exe
  C:\Windows\System\YHSYIqL.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\fjeZChG.exe
  C:\Windows\System\fjeZChG.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\fErfphq.exe
  C:\Windows\System\fErfphq.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\nRNocKM.exe
  C:\Windows\System\nRNocKM.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\gEPLHWJ.exe
  C:\Windows\System\gEPLHWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\mwUzjav.exe
  C:\Windows\System\mwUzjav.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\SQUGhxX.exe
  C:\Windows\System\SQUGhxX.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\nXROwgq.exe
  C:\Windows\System\nXROwgq.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\GQnqjNC.exe
  C:\Windows\System\GQnqjNC.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\LHpyPYV.exe
  C:\Windows\System\LHpyPYV.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\EEpXRNI.exe
  C:\Windows\System\EEpXRNI.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\YkZoFAM.exe
  C:\Windows\System\YkZoFAM.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\VktOvcB.exe
  C:\Windows\System\VktOvcB.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\glGayUa.exe
  C:\Windows\System\glGayUa.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\ovDFqZD.exe
  C:\Windows\System\ovDFqZD.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\zelhbIV.exe
  C:\Windows\System\zelhbIV.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\sYDCRAk.exe
  C:\Windows\System\sYDCRAk.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\JAFoevv.exe
  C:\Windows\System\JAFoevv.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\MCUixYR.exe
  C:\Windows\System\MCUixYR.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\WbgLpHO.exe
  C:\Windows\System\WbgLpHO.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\CepymLM.exe
  C:\Windows\System\CepymLM.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\IVxuuiO.exe
  C:\Windows\System\IVxuuiO.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\MXxJUPT.exe
  C:\Windows\System\MXxJUPT.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\FIczapu.exe
  C:\Windows\System\FIczapu.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\pKBqyZR.exe
  C:\Windows\System\pKBqyZR.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\IisiHou.exe
  C:\Windows\System\IisiHou.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\UibAslJ.exe
  C:\Windows\System\UibAslJ.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\NuywVQY.exe
  C:\Windows\System\NuywVQY.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\aIwPllC.exe
  C:\Windows\System\aIwPllC.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\RUJJdSN.exe
  C:\Windows\System\RUJJdSN.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\ZhgBiRa.exe
  C:\Windows\System\ZhgBiRa.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\rGoVBLV.exe
  C:\Windows\System\rGoVBLV.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\xoXYyQY.exe
  C:\Windows\System\xoXYyQY.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\POlRycv.exe
  C:\Windows\System\POlRycv.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\BOoOhZc.exe
  C:\Windows\System\BOoOhZc.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\DrrwqSF.exe
  C:\Windows\System\DrrwqSF.exe
  2⤵
  PID:3320
- C:\Windows\System\aLvkHNv.exe
  C:\Windows\System\aLvkHNv.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\QvuYjtg.exe
  C:\Windows\System\QvuYjtg.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\fFWpKGE.exe
  C:\Windows\System\fFWpKGE.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\GMpTdvf.exe
  C:\Windows\System\GMpTdvf.exe
  2⤵
  PID:5044
- C:\Windows\System\ZClvGGK.exe
  C:\Windows\System\ZClvGGK.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\cjShSss.exe
  C:\Windows\System\cjShSss.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\cyxaFDv.exe
  C:\Windows\System\cyxaFDv.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\PvkbQbt.exe
  C:\Windows\System\PvkbQbt.exe
  2⤵
  PID:520
- C:\Windows\System\XjbofMl.exe
  C:\Windows\System\XjbofMl.exe
  2⤵
  PID:2680
- C:\Windows\System\gINkVtm.exe
  C:\Windows\System\gINkVtm.exe
  2⤵
  PID:2748
- C:\Windows\System\IlngIGl.exe
  C:\Windows\System\IlngIGl.exe
  2⤵
  PID:3064
- C:\Windows\System\qRUfuJE.exe
  C:\Windows\System\qRUfuJE.exe
  2⤵
  PID:3448
- C:\Windows\System\WfyqFkI.exe
  C:\Windows\System\WfyqFkI.exe
  2⤵
  PID:1816
- C:\Windows\System\qncewfz.exe
  C:\Windows\System\qncewfz.exe
  2⤵
  PID:3216
- C:\Windows\System\WndGkky.exe
  C:\Windows\System\WndGkky.exe
  2⤵
  PID:1564
- C:\Windows\System\dPTEEug.exe
  C:\Windows\System\dPTEEug.exe
  2⤵
  PID:1140
- C:\Windows\System\amrtpUj.exe
  C:\Windows\System\amrtpUj.exe
  2⤵
  PID:1824
- C:\Windows\System\tcQIfus.exe
  C:\Windows\System\tcQIfus.exe
  2⤵
  PID:1720
- C:\Windows\System\zGOzkNJ.exe
  C:\Windows\System\zGOzkNJ.exe
  2⤵
  PID:4944
- C:\Windows\System\QCLVNpy.exe
  C:\Windows\System\QCLVNpy.exe
  2⤵
  PID:4448
- C:\Windows\System\tQNEupq.exe
  C:\Windows\System\tQNEupq.exe
  2⤵
  PID:2872
- C:\Windows\System\DSEdlNP.exe
  C:\Windows\System\DSEdlNP.exe
  2⤵
  PID:3344
- C:\Windows\System\AhZpwZp.exe
  C:\Windows\System\AhZpwZp.exe
  2⤵
  PID:3172
- C:\Windows\System\BCUyltj.exe
  C:\Windows\System\BCUyltj.exe
  2⤵
  PID:4616
- C:\Windows\System\sgiSpWh.exe
  C:\Windows\System\sgiSpWh.exe
  2⤵
  PID:1892
- C:\Windows\System\JVJHNKW.exe
  C:\Windows\System\JVJHNKW.exe
  2⤵
  PID:3188
- C:\Windows\System\jcrNfXu.exe
  C:\Windows\System\jcrNfXu.exe
  2⤵
  PID:2224
- C:\Windows\System\ZHeFAfT.exe
  C:\Windows\System\ZHeFAfT.exe
  2⤵
  PID:3920
- C:\Windows\System\wsIiiht.exe
  C:\Windows\System\wsIiiht.exe
  2⤵
  PID:1504
- C:\Windows\System\hqZomiQ.exe
  C:\Windows\System\hqZomiQ.exe
  2⤵
  PID:444
- C:\Windows\System\pdqxHzI.exe
  C:\Windows\System\pdqxHzI.exe
  2⤵
  PID:4504
- C:\Windows\System\fUOslOO.exe
  C:\Windows\System\fUOslOO.exe
  2⤵
  PID:4112
- C:\Windows\System\WQmXkMT.exe
  C:\Windows\System\WQmXkMT.exe
  2⤵
  PID:3204
- C:\Windows\System\YbzENaT.exe
  C:\Windows\System\YbzENaT.exe
  2⤵
  PID:4188
- C:\Windows\System\lPKZtTh.exe
  C:\Windows\System\lPKZtTh.exe
  2⤵
  PID:4348
- C:\Windows\System\wqgVngt.exe
  C:\Windows\System\wqgVngt.exe
  2⤵
  PID:1632
- C:\Windows\System\bWOdnSQ.exe
  C:\Windows\System\bWOdnSQ.exe
  2⤵
  PID:5136
- C:\Windows\System\SkSktzc.exe
  C:\Windows\System\SkSktzc.exe
  2⤵
  PID:5152
- C:\Windows\System\oSGPndM.exe
  C:\Windows\System\oSGPndM.exe
  2⤵
  PID:5192
- C:\Windows\System\GTUkllp.exe
  C:\Windows\System\GTUkllp.exe
  2⤵
  PID:5208
- C:\Windows\System\YAgPfiC.exe
  C:\Windows\System\YAgPfiC.exe
  2⤵
  PID:5228
- C:\Windows\System\FsUKzts.exe
  C:\Windows\System\FsUKzts.exe
  2⤵
  PID:5248
- C:\Windows\System\GRdJBNc.exe
  C:\Windows\System\GRdJBNc.exe
  2⤵
  PID:5268
- C:\Windows\System\acHxhHb.exe
  C:\Windows\System\acHxhHb.exe
  2⤵
  PID:5284
- C:\Windows\System\nysBZVo.exe
  C:\Windows\System\nysBZVo.exe
  2⤵
  PID:5308
- C:\Windows\System\ihKDLjh.exe
  C:\Windows\System\ihKDLjh.exe
  2⤵
  PID:5328
- C:\Windows\System\eUDxrNL.exe
  C:\Windows\System\eUDxrNL.exe
  2⤵
  PID:5352
- C:\Windows\System\DsZlpSI.exe
  C:\Windows\System\DsZlpSI.exe
  2⤵
  PID:5376
- C:\Windows\System\SXfrQXf.exe
  C:\Windows\System\SXfrQXf.exe
  2⤵
  PID:5396
- C:\Windows\System\ClIQvgF.exe
  C:\Windows\System\ClIQvgF.exe
  2⤵
  PID:5420
- C:\Windows\System\JUhWZvC.exe
  C:\Windows\System\JUhWZvC.exe
  2⤵
  PID:5436
- C:\Windows\System\bsfaxfd.exe
  C:\Windows\System\bsfaxfd.exe
  2⤵
  PID:5460
- C:\Windows\System\VseAPiU.exe
  C:\Windows\System\VseAPiU.exe
  2⤵
  PID:5484
- C:\Windows\System\KxpSnSL.exe
  C:\Windows\System\KxpSnSL.exe
  2⤵
  PID:5504
- C:\Windows\System\CQieedV.exe
  C:\Windows\System\CQieedV.exe
  2⤵
  PID:5528
- C:\Windows\System\LvVJvjj.exe
  C:\Windows\System\LvVJvjj.exe
  2⤵
  PID:5548
- C:\Windows\System\ahAREIr.exe
  C:\Windows\System\ahAREIr.exe
  2⤵
  PID:5568
- C:\Windows\System\CyvHymP.exe
  C:\Windows\System\CyvHymP.exe
  2⤵
  PID:5592
- C:\Windows\System\JCdQiBd.exe
  C:\Windows\System\JCdQiBd.exe
  2⤵
  PID:5612
- C:\Windows\System\mILMyHO.exe
  C:\Windows\System\mILMyHO.exe
  2⤵
  PID:5632
- C:\Windows\System\bWxdiVQ.exe
  C:\Windows\System\bWxdiVQ.exe
  2⤵
  PID:5656
- C:\Windows\System\IHaUKkY.exe
  C:\Windows\System\IHaUKkY.exe
  2⤵
  PID:5676
- C:\Windows\System\NpjNvTT.exe
  C:\Windows\System\NpjNvTT.exe
  2⤵
  PID:5696
- C:\Windows\System\SQfifjI.exe
  C:\Windows\System\SQfifjI.exe
  2⤵
  PID:5716
- C:\Windows\System\GthMfqp.exe
  C:\Windows\System\GthMfqp.exe
  2⤵
  PID:5736
- C:\Windows\System\vHnMvvE.exe
  C:\Windows\System\vHnMvvE.exe
  2⤵
  PID:5760
- C:\Windows\System\JCLyRuK.exe
  C:\Windows\System\JCLyRuK.exe
  2⤵
  PID:5788
- C:\Windows\System\bfcclwE.exe
  C:\Windows\System\bfcclwE.exe
  2⤵
  PID:5808
- C:\Windows\System\tHzXfnE.exe
  C:\Windows\System\tHzXfnE.exe
  2⤵
  PID:5824
- C:\Windows\System\PkotJsR.exe
  C:\Windows\System\PkotJsR.exe
  2⤵
  PID:5848
- C:\Windows\System\lhQltBV.exe
  C:\Windows\System\lhQltBV.exe
  2⤵
  PID:5868
- C:\Windows\System\eGJiCSs.exe
  C:\Windows\System\eGJiCSs.exe
  2⤵
  PID:5896
- C:\Windows\System\qzPYgTc.exe
  C:\Windows\System\qzPYgTc.exe
  2⤵
  PID:5920
- C:\Windows\System\YOCebux.exe
  C:\Windows\System\YOCebux.exe
  2⤵
  PID:5940
- C:\Windows\System\JzJngrE.exe
  C:\Windows\System\JzJngrE.exe
  2⤵
  PID:5968
- C:\Windows\System\btUXUnd.exe
  C:\Windows\System\btUXUnd.exe
  2⤵
  PID:5988
- C:\Windows\System\neNMDXO.exe
  C:\Windows\System\neNMDXO.exe
  2⤵
  PID:6012
- C:\Windows\System\kKrzYVR.exe
  C:\Windows\System\kKrzYVR.exe
  2⤵
  PID:6036
- C:\Windows\System\fFYnCBY.exe
  C:\Windows\System\fFYnCBY.exe
  2⤵
  PID:6056
- C:\Windows\System\sCQbLVW.exe
  C:\Windows\System\sCQbLVW.exe
  2⤵
  PID:6080
- C:\Windows\System\IuMiSzu.exe
  C:\Windows\System\IuMiSzu.exe
  2⤵
  PID:6100
- C:\Windows\System\UVhhpSd.exe
  C:\Windows\System\UVhhpSd.exe
  2⤵
  PID:6116
- C:\Windows\System\qpkEfks.exe
  C:\Windows\System\qpkEfks.exe
  2⤵
  PID:2476
- C:\Windows\System\qKMCkYO.exe
  C:\Windows\System\qKMCkYO.exe
  2⤵
  PID:884
- C:\Windows\System\HsBrkvu.exe
  C:\Windows\System\HsBrkvu.exe
  2⤵
  PID:5004
- C:\Windows\System\hxBTKUu.exe
  C:\Windows\System\hxBTKUu.exe
  2⤵
  PID:4668
- C:\Windows\System\qLlOcOj.exe
  C:\Windows\System\qLlOcOj.exe
  2⤵
  PID:2616
- C:\Windows\System\cINGCKw.exe
  C:\Windows\System\cINGCKw.exe
  2⤵
  PID:2760
- C:\Windows\System\ktfuaXv.exe
  C:\Windows\System\ktfuaXv.exe
  2⤵
  PID:4176
- C:\Windows\System\xODzymM.exe
  C:\Windows\System\xODzymM.exe
  2⤵
  PID:3964
- C:\Windows\System\oFwCIYP.exe
  C:\Windows\System\oFwCIYP.exe
  2⤵
  PID:4040
- C:\Windows\System\eDrEsqf.exe
  C:\Windows\System\eDrEsqf.exe
  2⤵
  PID:3744
- C:\Windows\System\uGITpEz.exe
  C:\Windows\System\uGITpEz.exe
  2⤵
  PID:1604
- C:\Windows\System\MpBnBsk.exe
  C:\Windows\System\MpBnBsk.exe
  2⤵
  PID:5128
- C:\Windows\System\hSzpmQw.exe
  C:\Windows\System\hSzpmQw.exe
  2⤵
  PID:3128
- C:\Windows\System\xwWaRve.exe
  C:\Windows\System\xwWaRve.exe
  2⤵
  PID:5216
- C:\Windows\System\scXbfbV.exe
  C:\Windows\System\scXbfbV.exe
  2⤵
  PID:628
- C:\Windows\System\toRwvBl.exe
  C:\Windows\System\toRwvBl.exe
  2⤵
  PID:3500
- C:\Windows\System\JKxyrjO.exe
  C:\Windows\System\JKxyrjO.exe
  2⤵
  PID:2884
- C:\Windows\System\BZjkgmb.exe
  C:\Windows\System\BZjkgmb.exe
  2⤵
  PID:5628
- C:\Windows\System\WZTWICb.exe
  C:\Windows\System\WZTWICb.exe
  2⤵
  PID:1988
- C:\Windows\System\tpZfqwz.exe
  C:\Windows\System\tpZfqwz.exe
  2⤵
  PID:5744
- C:\Windows\System\uGGBFQl.exe
  C:\Windows\System\uGGBFQl.exe
  2⤵
  PID:5220
- C:\Windows\System\DQvyuiS.exe
  C:\Windows\System\DQvyuiS.exe
  2⤵
  PID:5860
- C:\Windows\System\vAANpeq.exe
  C:\Windows\System\vAANpeq.exe
  2⤵
  PID:5408
- C:\Windows\System\AhdWZBH.exe
  C:\Windows\System\AhdWZBH.exe
  2⤵
  PID:5444
- C:\Windows\System\bXkymoN.exe
  C:\Windows\System\bXkymoN.exe
  2⤵
  PID:5276
- C:\Windows\System\ZurxicQ.exe
  C:\Windows\System\ZurxicQ.exe
  2⤵
  PID:5544
- C:\Windows\System\xGUuleZ.exe
  C:\Windows\System\xGUuleZ.exe
  2⤵
  PID:6048
- C:\Windows\System\iqgkGwi.exe
  C:\Windows\System\iqgkGwi.exe
  2⤵
  PID:5668
- C:\Windows\System\ORCDJdK.exe
  C:\Windows\System\ORCDJdK.exe
  2⤵
  PID:5704
- C:\Windows\System\lyaNMuP.exe
  C:\Windows\System\lyaNMuP.exe
  2⤵
  PID:6152
- C:\Windows\System\SpWsLxZ.exe
  C:\Windows\System\SpWsLxZ.exe
  2⤵
  PID:6180
- C:\Windows\System\KXuorGJ.exe
  C:\Windows\System\KXuorGJ.exe
  2⤵
  PID:6196
- C:\Windows\System\LpLErBk.exe
  C:\Windows\System\LpLErBk.exe
  2⤵
  PID:6216
- C:\Windows\System\tgweGmH.exe
  C:\Windows\System\tgweGmH.exe
  2⤵
  PID:6236
- C:\Windows\System\jgKFEDA.exe
  C:\Windows\System\jgKFEDA.exe
  2⤵
  PID:6260
- C:\Windows\System\gBXTVqg.exe
  C:\Windows\System\gBXTVqg.exe
  2⤵
  PID:6276
- C:\Windows\System\RrbmAxj.exe
  C:\Windows\System\RrbmAxj.exe
  2⤵
  PID:6300
- C:\Windows\System\PRDUuSj.exe
  C:\Windows\System\PRDUuSj.exe
  2⤵
  PID:6324
- C:\Windows\System\OOOnuCz.exe
  C:\Windows\System\OOOnuCz.exe
  2⤵
  PID:6348
- C:\Windows\System\uRtYrFh.exe
  C:\Windows\System\uRtYrFh.exe
  2⤵
  PID:6368
- C:\Windows\System\aXfLlzP.exe
  C:\Windows\System\aXfLlzP.exe
  2⤵
  PID:6392
- C:\Windows\System\NpWnFRe.exe
  C:\Windows\System\NpWnFRe.exe
  2⤵
  PID:6416
- C:\Windows\System\WZPJOWx.exe
  C:\Windows\System\WZPJOWx.exe
  2⤵
  PID:6436
- C:\Windows\System\VMBfIqI.exe
  C:\Windows\System\VMBfIqI.exe
  2⤵
  PID:6452
- C:\Windows\System\EmAeuoj.exe
  C:\Windows\System\EmAeuoj.exe
  2⤵
  PID:6476
- C:\Windows\System\vjfqMfQ.exe
  C:\Windows\System\vjfqMfQ.exe
  2⤵
  PID:6500
- C:\Windows\System\GSscRMe.exe
  C:\Windows\System\GSscRMe.exe
  2⤵
  PID:6520
- C:\Windows\System\RRfrgUM.exe
  C:\Windows\System\RRfrgUM.exe
  2⤵
  PID:6544
- C:\Windows\System\qbomaUz.exe
  C:\Windows\System\qbomaUz.exe
  2⤵
  PID:6564
- C:\Windows\System\tmgusHb.exe
  C:\Windows\System\tmgusHb.exe
  2⤵
  PID:6592
- C:\Windows\System\XpANzLs.exe
  C:\Windows\System\XpANzLs.exe
  2⤵
  PID:6612
- C:\Windows\System\GEfWvaN.exe
  C:\Windows\System\GEfWvaN.exe
  2⤵
  PID:6632
- C:\Windows\System\YGhqpOZ.exe
  C:\Windows\System\YGhqpOZ.exe
  2⤵
  PID:6656
- C:\Windows\System\QgpgZJQ.exe
  C:\Windows\System\QgpgZJQ.exe
  2⤵
  PID:6672
- C:\Windows\System\NjzkvLx.exe
  C:\Windows\System\NjzkvLx.exe
  2⤵
  PID:6700
- C:\Windows\System\zGbXKad.exe
  C:\Windows\System\zGbXKad.exe
  2⤵
  PID:6732
- C:\Windows\System\TBRmGaC.exe
  C:\Windows\System\TBRmGaC.exe
  2⤵
  PID:6752
- C:\Windows\System\MwDnfrC.exe
  C:\Windows\System\MwDnfrC.exe
  2⤵
  PID:6776
- C:\Windows\System\aiagJdV.exe
  C:\Windows\System\aiagJdV.exe
  2⤵
  PID:6800
- C:\Windows\System\DRMrOpZ.exe
  C:\Windows\System\DRMrOpZ.exe
  2⤵
  PID:6824
- C:\Windows\System\jQGSLxD.exe
  C:\Windows\System\jQGSLxD.exe
  2⤵
  PID:6844
- C:\Windows\System\iswYvEi.exe
  C:\Windows\System\iswYvEi.exe
  2⤵
  PID:6868
- C:\Windows\System\CJpXhok.exe
  C:\Windows\System\CJpXhok.exe
  2⤵
  PID:6888
- C:\Windows\System\JsVkgpM.exe
  C:\Windows\System\JsVkgpM.exe
  2⤵
  PID:6916
- C:\Windows\System\WHEKhJq.exe
  C:\Windows\System\WHEKhJq.exe
  2⤵
  PID:6936
- C:\Windows\System\oOpEmJq.exe
  C:\Windows\System\oOpEmJq.exe
  2⤵
  PID:6964
- C:\Windows\System\Yvlttwf.exe
  C:\Windows\System\Yvlttwf.exe
  2⤵
  PID:6980
- C:\Windows\System\QhIKuhw.exe
  C:\Windows\System\QhIKuhw.exe
  2⤵
  PID:7000
- C:\Windows\System\uDoKEIT.exe
  C:\Windows\System\uDoKEIT.exe
  2⤵
  PID:7024
- C:\Windows\System\lKFtfvC.exe
  C:\Windows\System\lKFtfvC.exe
  2⤵
  PID:7044
- C:\Windows\System\MyBGMZZ.exe
  C:\Windows\System\MyBGMZZ.exe
  2⤵
  PID:7064
- C:\Windows\System\MsFhkFf.exe
  C:\Windows\System\MsFhkFf.exe
  2⤵
  PID:7092
- C:\Windows\System\oNbTgyn.exe
  C:\Windows\System\oNbTgyn.exe
  2⤵
  PID:7112
- C:\Windows\System\Hihwejy.exe
  C:\Windows\System\Hihwejy.exe
  2⤵
  PID:7132
- C:\Windows\System\XiHKDjr.exe
  C:\Windows\System\XiHKDjr.exe
  2⤵
  PID:7152
- C:\Windows\System\ezenOFD.exe
  C:\Windows\System\ezenOFD.exe
  2⤵
  PID:5148
- C:\Windows\System\POEAplA.exe
  C:\Windows\System\POEAplA.exe
  2⤵
  PID:5388
- C:\Windows\System\uqJbOzj.exe
  C:\Windows\System\uqJbOzj.exe
  2⤵
  PID:5344
- C:\Windows\System\aPYnlgN.exe
  C:\Windows\System\aPYnlgN.exe
  2⤵
  PID:5432
- C:\Windows\System\cKLKVUg.exe
  C:\Windows\System\cKLKVUg.exe
  2⤵
  PID:4676
- C:\Windows\System\tMpnjkP.exe
  C:\Windows\System\tMpnjkP.exe
  2⤵
  PID:6112
- C:\Windows\System\qIsFomY.exe
  C:\Windows\System\qIsFomY.exe
  2⤵
  PID:5132
- C:\Windows\System\EeEpgan.exe
  C:\Windows\System\EeEpgan.exe
  2⤵
  PID:5364
- C:\Windows\System\dNpmhGp.exe
  C:\Windows\System\dNpmhGp.exe
  2⤵
  PID:5576
- C:\Windows\System\ygxFPTH.exe
  C:\Windows\System\ygxFPTH.exe
  2⤵
  PID:5608
- C:\Windows\System\yyNsLiF.exe
  C:\Windows\System\yyNsLiF.exe
  2⤵
  PID:536
- C:\Windows\System\akdopzp.exe
  C:\Windows\System\akdopzp.exe
  2⤵
  PID:5320
- C:\Windows\System\xkdYsVk.exe
  C:\Windows\System\xkdYsVk.exe
  2⤵
  PID:1404
- C:\Windows\System\ogALmgU.exe
  C:\Windows\System\ogALmgU.exe
  2⤵
  PID:6248
- C:\Windows\System\sDQhwLc.exe
  C:\Windows\System\sDQhwLc.exe
  2⤵
  PID:3376
- C:\Windows\System\BfYKaeH.exe
  C:\Windows\System\BfYKaeH.exe
  2⤵
  PID:5820
- C:\Windows\System\bajtfCK.exe
  C:\Windows\System\bajtfCK.exe
  2⤵
  PID:6052
- C:\Windows\System\pjcEyRG.exe
  C:\Windows\System\pjcEyRG.exe
  2⤵
  PID:3660
- C:\Windows\System\OLGoYwv.exe
  C:\Windows\System\OLGoYwv.exe
  2⤵
  PID:5240
- C:\Windows\System\SmNGxsq.exe
  C:\Windows\System\SmNGxsq.exe
  2⤵
  PID:7180
- C:\Windows\System\cXwTjPq.exe
  C:\Windows\System\cXwTjPq.exe
  2⤵
  PID:7200
- C:\Windows\System\opBeYgJ.exe
  C:\Windows\System\opBeYgJ.exe
  2⤵
  PID:7220
- C:\Windows\System\YfOepHg.exe
  C:\Windows\System\YfOepHg.exe
  2⤵
  PID:7244
- C:\Windows\System\PlSsqAy.exe
  C:\Windows\System\PlSsqAy.exe
  2⤵
  PID:7268
- C:\Windows\System\HcWFxEb.exe
  C:\Windows\System\HcWFxEb.exe
  2⤵
  PID:7284
- C:\Windows\System\ikElOIZ.exe
  C:\Windows\System\ikElOIZ.exe
  2⤵
  PID:7304
- C:\Windows\System\NgViMBM.exe
  C:\Windows\System\NgViMBM.exe
  2⤵
  PID:7328
- C:\Windows\System\PqIBJZC.exe
  C:\Windows\System\PqIBJZC.exe
  2⤵
  PID:7352
- C:\Windows\System\ArioAgN.exe
  C:\Windows\System\ArioAgN.exe
  2⤵
  PID:7372
- C:\Windows\System\WvjWVCJ.exe
  C:\Windows\System\WvjWVCJ.exe
  2⤵
  PID:7396
- C:\Windows\System\IuzzWIx.exe
  C:\Windows\System\IuzzWIx.exe
  2⤵
  PID:7416
- C:\Windows\System\UKAATDk.exe
  C:\Windows\System\UKAATDk.exe
  2⤵
  PID:7440
- C:\Windows\System\xgMDbRv.exe
  C:\Windows\System\xgMDbRv.exe
  2⤵
  PID:7460
- C:\Windows\System\NoYfxBg.exe
  C:\Windows\System\NoYfxBg.exe
  2⤵
  PID:7488
- C:\Windows\System\WEuIlWy.exe
  C:\Windows\System\WEuIlWy.exe
  2⤵
  PID:7504
- C:\Windows\System\GDkBuQO.exe
  C:\Windows\System\GDkBuQO.exe
  2⤵
  PID:7528
- C:\Windows\System\FkisUFt.exe
  C:\Windows\System\FkisUFt.exe
  2⤵
  PID:7556
- C:\Windows\System\kTTkZYj.exe
  C:\Windows\System\kTTkZYj.exe
  2⤵
  PID:7572
- C:\Windows\System\iQqtcEa.exe
  C:\Windows\System\iQqtcEa.exe
  2⤵
  PID:7596
- C:\Windows\System\QhgWsKk.exe
  C:\Windows\System\QhgWsKk.exe
  2⤵
  PID:7616
- C:\Windows\System\OQIUHlo.exe
  C:\Windows\System\OQIUHlo.exe
  2⤵
  PID:7644
- C:\Windows\System\hkyCtrF.exe
  C:\Windows\System\hkyCtrF.exe
  2⤵
  PID:7676
- C:\Windows\System\gDRVHPt.exe
  C:\Windows\System\gDRVHPt.exe
  2⤵
  PID:7700
- C:\Windows\System\JKldISq.exe
  C:\Windows\System\JKldISq.exe
  2⤵
  PID:7720
- C:\Windows\System\XEzmwKq.exe
  C:\Windows\System\XEzmwKq.exe
  2⤵
  PID:7748
- C:\Windows\System\UZtdibL.exe
  C:\Windows\System\UZtdibL.exe
  2⤵
  PID:7764
- C:\Windows\System\lPyYlwW.exe
  C:\Windows\System\lPyYlwW.exe
  2⤵
  PID:7792
- C:\Windows\System\TozXbQG.exe
  C:\Windows\System\TozXbQG.exe
  2⤵
  PID:7808
- C:\Windows\System\mrFxqvB.exe
  C:\Windows\System\mrFxqvB.exe
  2⤵
  PID:7832
- C:\Windows\System\ZlLcNgI.exe
  C:\Windows\System\ZlLcNgI.exe
  2⤵
  PID:7864
- C:\Windows\System\KPQBfLv.exe
  C:\Windows\System\KPQBfLv.exe
  2⤵
  PID:7880
- C:\Windows\System\EQndWSN.exe
  C:\Windows\System\EQndWSN.exe
  2⤵
  PID:7904
- C:\Windows\System\ghTWuUz.exe
  C:\Windows\System\ghTWuUz.exe
  2⤵
  PID:7928
- C:\Windows\System\Oedwdrv.exe
  C:\Windows\System\Oedwdrv.exe
  2⤵
  PID:7948
- C:\Windows\System\PtAHjfo.exe
  C:\Windows\System\PtAHjfo.exe
  2⤵
  PID:7968
- C:\Windows\System\cTQazkZ.exe
  C:\Windows\System\cTQazkZ.exe
  2⤵
  PID:7992
- C:\Windows\System\ukwebXN.exe
  C:\Windows\System\ukwebXN.exe
  2⤵
  PID:8016
- C:\Windows\System\hlPsokc.exe
  C:\Windows\System\hlPsokc.exe
  2⤵
  PID:8040
- C:\Windows\System\AvESLXm.exe
  C:\Windows\System\AvESLXm.exe
  2⤵
  PID:8060
- C:\Windows\System\dyTTpNF.exe
  C:\Windows\System\dyTTpNF.exe
  2⤵
  PID:8080
- C:\Windows\System\BgFWZjU.exe
  C:\Windows\System\BgFWZjU.exe
  2⤵
  PID:8104
- C:\Windows\System\txTZWny.exe
  C:\Windows\System\txTZWny.exe
  2⤵
  PID:8124
- C:\Windows\System\gJxUPxF.exe
  C:\Windows\System\gJxUPxF.exe
  2⤵
  PID:8152
- C:\Windows\System\BgyXtlE.exe
  C:\Windows\System\BgyXtlE.exe
  2⤵
  PID:8172
- C:\Windows\System\RSMEpXi.exe
  C:\Windows\System\RSMEpXi.exe
  2⤵
  PID:5884
- C:\Windows\System\XHUCcGy.exe
  C:\Windows\System\XHUCcGy.exe
  2⤵
  PID:5204
- C:\Windows\System\IhUbjCp.exe
  C:\Windows\System\IhUbjCp.exe
  2⤵
  PID:6680
- C:\Windows\System\MqDhsfp.exe
  C:\Windows\System\MqDhsfp.exe
  2⤵
  PID:6192
- C:\Windows\System\FyHGMLE.exe
  C:\Windows\System\FyHGMLE.exe
  2⤵
  PID:4008
- C:\Windows\System\giatiqn.exe
  C:\Windows\System\giatiqn.exe
  2⤵
  PID:2328
- C:\Windows\System\IquOqwY.exe
  C:\Windows\System\IquOqwY.exe
  2⤵
  PID:6876
- C:\Windows\System\cJosZZs.exe
  C:\Windows\System\cJosZZs.exe
  2⤵
  PID:6320
- C:\Windows\System\wZVSiad.exe
  C:\Windows\System\wZVSiad.exe
  2⤵
  PID:5244
- C:\Windows\System\IjnkduG.exe
  C:\Windows\System\IjnkduG.exe
  2⤵
  PID:6432
- C:\Windows\System\GmOMfbN.exe
  C:\Windows\System\GmOMfbN.exe
  2⤵
  PID:6468
- C:\Windows\System\qrvvbHf.exe
  C:\Windows\System\qrvvbHf.exe
  2⤵
  PID:5604
- C:\Windows\System\odkBaVK.exe
  C:\Windows\System\odkBaVK.exe
  2⤵
  PID:6404
- C:\Windows\System\CdtZbdz.exe
  C:\Windows\System\CdtZbdz.exe
  2⤵
  PID:7256
- C:\Windows\System\LwFPFrz.exe
  C:\Windows\System\LwFPFrz.exe
  2⤵
  PID:5980
- C:\Windows\System\oeeImOq.exe
  C:\Windows\System\oeeImOq.exe
  2⤵
  PID:7324
- C:\Windows\System\EGTPfHq.exe
  C:\Windows\System\EGTPfHq.exe
  2⤵
  PID:7364
- C:\Windows\System\iCAPEED.exe
  C:\Windows\System\iCAPEED.exe
  2⤵
  PID:6772
- C:\Windows\System\BEBSUDI.exe
  C:\Windows\System\BEBSUDI.exe
  2⤵
  PID:8204
- C:\Windows\System\GbXZyFf.exe
  C:\Windows\System\GbXZyFf.exe
  2⤵
  PID:8224
- C:\Windows\System\lsYogIk.exe
  C:\Windows\System\lsYogIk.exe
  2⤵
  PID:8248
- C:\Windows\System\ClpVnBC.exe
  C:\Windows\System\ClpVnBC.exe
  2⤵
  PID:8268
- C:\Windows\System\OHBTjGf.exe
  C:\Windows\System\OHBTjGf.exe
  2⤵
  PID:8288
- C:\Windows\System\psMGwUw.exe
  C:\Windows\System\psMGwUw.exe
  2⤵
  PID:8312
- C:\Windows\System\tnaLjnu.exe
  C:\Windows\System\tnaLjnu.exe
  2⤵
  PID:8336
- C:\Windows\System\mroncOR.exe
  C:\Windows\System\mroncOR.exe
  2⤵
  PID:8360
- C:\Windows\System\uKymDXa.exe
  C:\Windows\System\uKymDXa.exe
  2⤵
  PID:8376
- C:\Windows\System\nqPhHlU.exe
  C:\Windows\System\nqPhHlU.exe
  2⤵
  PID:8404
- C:\Windows\System\gpSTSuW.exe
  C:\Windows\System\gpSTSuW.exe
  2⤵
  PID:8428
- C:\Windows\System\fSbnEnF.exe
  C:\Windows\System\fSbnEnF.exe
  2⤵
  PID:8452
- C:\Windows\System\PvVbpdr.exe
  C:\Windows\System\PvVbpdr.exe
  2⤵
  PID:8480
- C:\Windows\System\Dgcxrfn.exe
  C:\Windows\System\Dgcxrfn.exe
  2⤵
  PID:8500
- C:\Windows\System\awRoNqZ.exe
  C:\Windows\System\awRoNqZ.exe
  2⤵
  PID:8520
- C:\Windows\System\swoVode.exe
  C:\Windows\System\swoVode.exe
  2⤵
  PID:8540
- C:\Windows\System\cmvRaGs.exe
  C:\Windows\System\cmvRaGs.exe
  2⤵
  PID:8564
- C:\Windows\System\ugZKJBd.exe
  C:\Windows\System\ugZKJBd.exe
  2⤵
  PID:8584
- C:\Windows\System\vYwIVaz.exe
  C:\Windows\System\vYwIVaz.exe
  2⤵
  PID:8608
- C:\Windows\System\KnzmWSa.exe
  C:\Windows\System\KnzmWSa.exe
  2⤵
  PID:8632
- C:\Windows\System\jCskHWT.exe
  C:\Windows\System\jCskHWT.exe
  2⤵
  PID:8656
- C:\Windows\System\LuHqcWO.exe
  C:\Windows\System\LuHqcWO.exe
  2⤵
  PID:8676
- C:\Windows\System\lUlqtmP.exe
  C:\Windows\System\lUlqtmP.exe
  2⤵
  PID:8700
- C:\Windows\System\cMywVQr.exe
  C:\Windows\System\cMywVQr.exe
  2⤵
  PID:8724
- C:\Windows\System\yMnsaFc.exe
  C:\Windows\System\yMnsaFc.exe
  2⤵
  PID:8748
- C:\Windows\System\UNTGbSa.exe
  C:\Windows\System\UNTGbSa.exe
  2⤵
  PID:8768
- C:\Windows\System\BTFkudM.exe
  C:\Windows\System\BTFkudM.exe
  2⤵
  PID:8792
- C:\Windows\System\KqLuguk.exe
  C:\Windows\System\KqLuguk.exe
  2⤵
  PID:8816
- C:\Windows\System\OSupUgh.exe
  C:\Windows\System\OSupUgh.exe
  2⤵
  PID:8836
- C:\Windows\System\uQjVmaA.exe
  C:\Windows\System\uQjVmaA.exe
  2⤵
  PID:8860
- C:\Windows\System\pZUvxOA.exe
  C:\Windows\System\pZUvxOA.exe
  2⤵
  PID:8876
- C:\Windows\System\QDHwYIq.exe
  C:\Windows\System\QDHwYIq.exe
  2⤵
  PID:8900
- C:\Windows\System\ATeTbBY.exe
  C:\Windows\System\ATeTbBY.exe
  2⤵
  PID:8916
- C:\Windows\System\CLLwFWB.exe
  C:\Windows\System\CLLwFWB.exe
  2⤵
  PID:8940
- C:\Windows\System\OfFfZXg.exe
  C:\Windows\System\OfFfZXg.exe
  2⤵
  PID:8960
- C:\Windows\System\CHLMDrz.exe
  C:\Windows\System\CHLMDrz.exe
  2⤵
  PID:8988
- C:\Windows\System\FITntym.exe
  C:\Windows\System\FITntym.exe
  2⤵
  PID:9008
- C:\Windows\System\dNeNNMM.exe
  C:\Windows\System\dNeNNMM.exe
  2⤵
  PID:9028
- C:\Windows\System\RyMaWIV.exe
  C:\Windows\System\RyMaWIV.exe
  2⤵
  PID:9052
- C:\Windows\System\CNEVJZu.exe
  C:\Windows\System\CNEVJZu.exe
  2⤵
  PID:9084
- C:\Windows\System\SJWeUvn.exe
  C:\Windows\System\SJWeUvn.exe
  2⤵
  PID:9108
- C:\Windows\System\hiHVrGx.exe
  C:\Windows\System\hiHVrGx.exe
  2⤵
  PID:9128
- C:\Windows\System\satKGKB.exe
  C:\Windows\System\satKGKB.exe
  2⤵
  PID:9156
- C:\Windows\System\JEAjNMU.exe
  C:\Windows\System\JEAjNMU.exe
  2⤵
  PID:9176
- C:\Windows\System\esRVNAm.exe
  C:\Windows\System\esRVNAm.exe
  2⤵
  PID:9196
- C:\Windows\System\OHksILa.exe
  C:\Windows\System\OHksILa.exe
  2⤵
  PID:6840
- C:\Windows\System\cPDpxKo.exe
  C:\Windows\System\cPDpxKo.exe
  2⤵
  PID:6340
- C:\Windows\System\tevuHyB.exe
  C:\Windows\System\tevuHyB.exe
  2⤵
  PID:7660
- C:\Windows\System\RWxOAdU.exe
  C:\Windows\System\RWxOAdU.exe
  2⤵
  PID:7692
- C:\Windows\System\bFPDOLA.exe
  C:\Windows\System\bFPDOLA.exe
  2⤵
  PID:7144
- C:\Windows\System\zrfSbWB.exe
  C:\Windows\System\zrfSbWB.exe
  2⤵
  PID:5804
- C:\Windows\System\EUtjqmJ.exe
  C:\Windows\System\EUtjqmJ.exe
  2⤵
  PID:7756
- C:\Windows\System\dsBzVvz.exe
  C:\Windows\System\dsBzVvz.exe
  2⤵
  PID:5960
- C:\Windows\System\dxXsKMX.exe
  C:\Windows\System\dxXsKMX.exe
  2⤵
  PID:7852
- C:\Windows\System\YEbzxkx.exe
  C:\Windows\System\YEbzxkx.exe
  2⤵
  PID:6484
- C:\Windows\System\gLxGYEH.exe
  C:\Windows\System\gLxGYEH.exe
  2⤵
  PID:7920
- C:\Windows\System\BYGuoDe.exe
  C:\Windows\System\BYGuoDe.exe
  2⤵
  PID:7944
- C:\Windows\System\VuODjXl.exe
  C:\Windows\System\VuODjXl.exe
  2⤵
  PID:6532
- C:\Windows\System\ynmQMkh.exe
  C:\Windows\System\ynmQMkh.exe
  2⤵
  PID:5296
- C:\Windows\System\ARHoKMZ.exe
  C:\Windows\System\ARHoKMZ.exe
  2⤵
  PID:6572
- C:\Windows\System\nhEkYxK.exe
  C:\Windows\System\nhEkYxK.exe
  2⤵
  PID:8072
- C:\Windows\System\YTTFLaS.exe
  C:\Windows\System\YTTFLaS.exe
  2⤵
  PID:8092
- C:\Windows\System\hOlxEZU.exe
  C:\Windows\System\hOlxEZU.exe
  2⤵
  PID:8100
- C:\Windows\System\MbIZPPh.exe
  C:\Windows\System\MbIZPPh.exe
  2⤵
  PID:8136
- C:\Windows\System\OwzKoRD.exe
  C:\Windows\System\OwzKoRD.exe
  2⤵
  PID:7280
- C:\Windows\System\TopEUgO.exe
  C:\Windows\System\TopEUgO.exe
  2⤵
  PID:6268
- C:\Windows\System\zPjcJQr.exe
  C:\Windows\System\zPjcJQr.exe
  2⤵
  PID:7336
- C:\Windows\System\MNZlQEd.exe
  C:\Windows\System\MNZlQEd.exe
  2⤵
  PID:2152
- C:\Windows\System\tJuJqHv.exe
  C:\Windows\System\tJuJqHv.exe
  2⤵
  PID:6760
- C:\Windows\System\elareQE.exe
  C:\Windows\System\elareQE.exe
  2⤵
  PID:6768
- C:\Windows\System\wFXRIcH.exe
  C:\Windows\System\wFXRIcH.exe
  2⤵
  PID:8200
- C:\Windows\System\MjrEnJR.exe
  C:\Windows\System\MjrEnJR.exe
  2⤵
  PID:8256
- C:\Windows\System\MZxeuBB.exe
  C:\Windows\System\MZxeuBB.exe
  2⤵
  PID:8308
- C:\Windows\System\IiIgzzd.exe
  C:\Windows\System\IiIgzzd.exe
  2⤵
  PID:7584
- C:\Windows\System\mCNQjBN.exe
  C:\Windows\System\mCNQjBN.exe
  2⤵
  PID:6928
- C:\Windows\System\oeBjxqh.exe
  C:\Windows\System\oeBjxqh.exe
  2⤵
  PID:6952
- C:\Windows\System\DksMGnI.exe
  C:\Windows\System\DksMGnI.exe
  2⤵
  PID:6988
- C:\Windows\System\tQIIEig.exe
  C:\Windows\System\tQIIEig.exe
  2⤵
  PID:8420
- C:\Windows\System\rIGetYi.exe
  C:\Windows\System\rIGetYi.exe
  2⤵
  PID:8488
- C:\Windows\System\uNTvTNi.exe
  C:\Windows\System\uNTvTNi.exe
  2⤵
  PID:7084
- C:\Windows\System\jqcpvhI.exe
  C:\Windows\System\jqcpvhI.exe
  2⤵
  PID:9232
- C:\Windows\System\mswddxI.exe
  C:\Windows\System\mswddxI.exe
  2⤵
  PID:9252
- C:\Windows\System\zTJzOyn.exe
  C:\Windows\System\zTJzOyn.exe
  2⤵
  PID:9276
- C:\Windows\System\oqowClR.exe
  C:\Windows\System\oqowClR.exe
  2⤵
  PID:9296
- C:\Windows\System\FgAcAWA.exe
  C:\Windows\System\FgAcAWA.exe
  2⤵
  PID:9320
- C:\Windows\System\LpOURIR.exe
  C:\Windows\System\LpOURIR.exe
  2⤵
  PID:9340
- C:\Windows\System\VjQtdUY.exe
  C:\Windows\System\VjQtdUY.exe
  2⤵
  PID:9364
- C:\Windows\System\hlcFKcm.exe
  C:\Windows\System\hlcFKcm.exe
  2⤵
  PID:9384
- C:\Windows\System\GihyJnr.exe
  C:\Windows\System\GihyJnr.exe
  2⤵
  PID:9404
- C:\Windows\System\AwnwUjV.exe
  C:\Windows\System\AwnwUjV.exe
  2⤵
  PID:9424
- C:\Windows\System\uITFZso.exe
  C:\Windows\System\uITFZso.exe
  2⤵
  PID:9452
- C:\Windows\System\oKijFqr.exe
  C:\Windows\System\oKijFqr.exe
  2⤵
  PID:9472
- C:\Windows\System\oAvUGlj.exe
  C:\Windows\System\oAvUGlj.exe
  2⤵
  PID:9492
- C:\Windows\System\QqidVfH.exe
  C:\Windows\System\QqidVfH.exe
  2⤵
  PID:9516
- C:\Windows\System\UmAxhzq.exe
  C:\Windows\System\UmAxhzq.exe
  2⤵
  PID:9540
- C:\Windows\System\OLLrejA.exe
  C:\Windows\System\OLLrejA.exe
  2⤵
  PID:9560
- C:\Windows\System\YCgJgjn.exe
  C:\Windows\System\YCgJgjn.exe
  2⤵
  PID:9580
- C:\Windows\System\BJEviTQ.exe
  C:\Windows\System\BJEviTQ.exe
  2⤵
  PID:9608
- C:\Windows\System\hGiaMly.exe
  C:\Windows\System\hGiaMly.exe
  2⤵
  PID:9628
- C:\Windows\System\ihPkrkS.exe
  C:\Windows\System\ihPkrkS.exe
  2⤵
  PID:9652
- C:\Windows\System\MzwTVsy.exe
  C:\Windows\System\MzwTVsy.exe
  2⤵
  PID:9676
- C:\Windows\System\wULvDkw.exe
  C:\Windows\System\wULvDkw.exe
  2⤵
  PID:9700
- C:\Windows\System\zUeXUFE.exe
  C:\Windows\System\zUeXUFE.exe
  2⤵
  PID:9724
- C:\Windows\System\xtdtxxt.exe
  C:\Windows\System\xtdtxxt.exe
  2⤵
  PID:9748
- C:\Windows\System\VBvFdzU.exe
  C:\Windows\System\VBvFdzU.exe
  2⤵
  PID:9768
- C:\Windows\System\ydgXkVY.exe
  C:\Windows\System\ydgXkVY.exe
  2⤵
  PID:9792
- C:\Windows\System\NRvAMDE.exe
  C:\Windows\System\NRvAMDE.exe
  2⤵
  PID:9816
- C:\Windows\System\SXyfbwJ.exe
  C:\Windows\System\SXyfbwJ.exe
  2⤵
  PID:9840
- C:\Windows\System\DWLGBhz.exe
  C:\Windows\System\DWLGBhz.exe
  2⤵
  PID:9864
- C:\Windows\System\hIBHPUZ.exe
  C:\Windows\System\hIBHPUZ.exe
  2⤵
  PID:9888
- C:\Windows\System\bVrHZMZ.exe
  C:\Windows\System\bVrHZMZ.exe
  2⤵
  PID:9908
- C:\Windows\System\KGKNuax.exe
  C:\Windows\System\KGKNuax.exe
  2⤵
  PID:9932
- C:\Windows\System\TJpnKwI.exe
  C:\Windows\System\TJpnKwI.exe
  2⤵
  PID:9960
- C:\Windows\System\lzodyhV.exe
  C:\Windows\System\lzodyhV.exe
  2⤵
  PID:9984
- C:\Windows\System\tXyrdMn.exe
  C:\Windows\System\tXyrdMn.exe
  2⤵
  PID:10004
- C:\Windows\System\ARUuJcn.exe
  C:\Windows\System\ARUuJcn.exe
  2⤵
  PID:10036
- C:\Windows\System\zFZxzzO.exe
  C:\Windows\System\zFZxzzO.exe
  2⤵
  PID:10052
- C:\Windows\System\FftwfHu.exe
  C:\Windows\System\FftwfHu.exe
  2⤵
  PID:10080
- C:\Windows\System\cEOgibc.exe
  C:\Windows\System\cEOgibc.exe
  2⤵
  PID:10104
- C:\Windows\System\POxKqGk.exe
  C:\Windows\System\POxKqGk.exe
  2⤵
  PID:10132
- C:\Windows\System\DLlvVuM.exe
  C:\Windows\System\DLlvVuM.exe
  2⤵
  PID:10156
- C:\Windows\System\tcHvKqV.exe
  C:\Windows\System\tcHvKqV.exe
  2⤵
  PID:10172
- C:\Windows\System\JOkijvV.exe
  C:\Windows\System\JOkijvV.exe
  2⤵
  PID:10212
- C:\Windows\System\VZHXcFC.exe
  C:\Windows\System\VZHXcFC.exe
  2⤵
  PID:10236
- C:\Windows\System\qBsrlxH.exe
  C:\Windows\System\qBsrlxH.exe
  2⤵
  PID:8580
- C:\Windows\System\mtEBTlc.exe
  C:\Windows\System\mtEBTlc.exe
  2⤵
  PID:7804
- C:\Windows\System\WxbIkYS.exe
  C:\Windows\System\WxbIkYS.exe
  2⤵
  PID:8688
- C:\Windows\System\VmLxRSk.exe
  C:\Windows\System\VmLxRSk.exe
  2⤵
  PID:8744
- C:\Windows\System\NxYFRGi.exe
  C:\Windows\System\NxYFRGi.exe
  2⤵
  PID:8800
- C:\Windows\System\rgILkEt.exe
  C:\Windows\System\rgILkEt.exe
  2⤵
  PID:8000
- C:\Windows\System\AsaWKkY.exe
  C:\Windows\System\AsaWKkY.exe
  2⤵
  PID:5160
- C:\Windows\System\GcfpHoU.exe
  C:\Windows\System\GcfpHoU.exe
  2⤵
  PID:7196
- C:\Windows\System\bErbHZl.exe
  C:\Windows\System\bErbHZl.exe
  2⤵
  PID:9000
- C:\Windows\System\kfvuwQp.exe
  C:\Windows\System\kfvuwQp.exe
  2⤵
  PID:4140
- C:\Windows\System\fPdhajw.exe
  C:\Windows\System\fPdhajw.exe
  2⤵
  PID:9076
- C:\Windows\System\gBZWZeL.exe
  C:\Windows\System\gBZWZeL.exe
  2⤵
  PID:4548
- C:\Windows\System\BdsvdCB.exe
  C:\Windows\System\BdsvdCB.exe
  2⤵
  PID:9164
- C:\Windows\System\cxdVdPp.exe
  C:\Windows\System\cxdVdPp.exe
  2⤵
  PID:7340
- C:\Windows\System\eUXrNSc.exe
  C:\Windows\System\eUXrNSc.exe
  2⤵
  PID:7016
- C:\Windows\System\YRrVweY.exe
  C:\Windows\System\YRrVweY.exe
  2⤵
  PID:5588
- C:\Windows\System\KwxeeTg.exe
  C:\Windows\System\KwxeeTg.exe
  2⤵
  PID:7424
- C:\Windows\System\JGqbBSt.exe
  C:\Windows\System\JGqbBSt.exe
  2⤵
  PID:7844
- C:\Windows\System\QjpMzwD.exe
  C:\Windows\System\QjpMzwD.exe
  2⤵
  PID:7496
- C:\Windows\System\BxMvblG.exe
  C:\Windows\System\BxMvblG.exe
  2⤵
  PID:10256
- C:\Windows\System\pDIjQnV.exe
  C:\Windows\System\pDIjQnV.exe
  2⤵
  PID:10280
- C:\Windows\System\PYzUUht.exe
  C:\Windows\System\PYzUUht.exe
  2⤵
  PID:10304
- C:\Windows\System\lTWEyus.exe
  C:\Windows\System\lTWEyus.exe
  2⤵
  PID:10328
- C:\Windows\System\eFKEvhO.exe
  C:\Windows\System\eFKEvhO.exe
  2⤵
  PID:10348
- C:\Windows\System\PVEYDPA.exe
  C:\Windows\System\PVEYDPA.exe
  2⤵
  PID:10368
- C:\Windows\System\GiXpOTJ.exe
  C:\Windows\System\GiXpOTJ.exe
  2⤵
  PID:10392
- C:\Windows\System\JqncnUl.exe
  C:\Windows\System\JqncnUl.exe
  2⤵
  PID:10428
- C:\Windows\System\tdCpeIG.exe
  C:\Windows\System\tdCpeIG.exe
  2⤵
  PID:10444
- C:\Windows\System\QiVGwYc.exe
  C:\Windows\System\QiVGwYc.exe
  2⤵
  PID:10464
- C:\Windows\System\Aigzwmf.exe
  C:\Windows\System\Aigzwmf.exe
  2⤵
  PID:10488
- C:\Windows\System\tWAELPE.exe
  C:\Windows\System\tWAELPE.exe
  2⤵
  PID:10512
- C:\Windows\System\xCiUvzi.exe
  C:\Windows\System\xCiUvzi.exe
  2⤵
  PID:10532
- C:\Windows\System\NumOaHE.exe
  C:\Windows\System\NumOaHE.exe
  2⤵
  PID:10556
- C:\Windows\System\PdZczEG.exe
  C:\Windows\System\PdZczEG.exe
  2⤵
  PID:10580
- C:\Windows\System\rXtxYRU.exe
  C:\Windows\System\rXtxYRU.exe
  2⤵
  PID:10604
- C:\Windows\System\GpNdcZY.exe
  C:\Windows\System\GpNdcZY.exe
  2⤵
  PID:10624
- C:\Windows\System\uqRZkUb.exe
  C:\Windows\System\uqRZkUb.exe
  2⤵
  PID:10644
- C:\Windows\System\HDNDSyG.exe
  C:\Windows\System\HDNDSyG.exe
  2⤵
  PID:10668
- C:\Windows\System\rkPMqPR.exe
  C:\Windows\System\rkPMqPR.exe
  2⤵
  PID:10688
- C:\Windows\System\WiXMRgw.exe
  C:\Windows\System\WiXMRgw.exe
  2⤵
  PID:10712
- C:\Windows\System\nZivgWa.exe
  C:\Windows\System\nZivgWa.exe
  2⤵
  PID:10740
- C:\Windows\System\uekERzF.exe
  C:\Windows\System\uekERzF.exe
  2⤵
  PID:10760
- C:\Windows\System\SuNJwNj.exe
  C:\Windows\System\SuNJwNj.exe
  2⤵
  PID:10784
- C:\Windows\System\GMRLeRy.exe
  C:\Windows\System\GMRLeRy.exe
  2⤵
  PID:10808
- C:\Windows\System\vmkmyWT.exe
  C:\Windows\System\vmkmyWT.exe
  2⤵
  PID:10836
- C:\Windows\System\DVrKvVx.exe
  C:\Windows\System\DVrKvVx.exe
  2⤵
  PID:10860
- C:\Windows\System\gitZFZA.exe
  C:\Windows\System\gitZFZA.exe
  2⤵
  PID:10884
- C:\Windows\System\HaVSkNe.exe
  C:\Windows\System\HaVSkNe.exe
  2⤵
  PID:10900
- C:\Windows\System\dkOgAoj.exe
  C:\Windows\System\dkOgAoj.exe
  2⤵
  PID:10924
- C:\Windows\System\WmFwBKp.exe
  C:\Windows\System\WmFwBKp.exe
  2⤵
  PID:10948
- C:\Windows\System\uuYxeep.exe
  C:\Windows\System\uuYxeep.exe
  2⤵
  PID:10972
- C:\Windows\System\gMrGNdW.exe
  C:\Windows\System\gMrGNdW.exe
  2⤵
  PID:10992
- C:\Windows\System\QdZXXfR.exe
  C:\Windows\System\QdZXXfR.exe
  2⤵
  PID:11012
- C:\Windows\System\QdekcVW.exe
  C:\Windows\System\QdekcVW.exe
  2⤵
  PID:11032
- C:\Windows\System\kIckcau.exe
  C:\Windows\System\kIckcau.exe
  2⤵
  PID:11060
- C:\Windows\System\xOpOVoY.exe
  C:\Windows\System\xOpOVoY.exe
  2⤵
  PID:11084
- C:\Windows\System\dbOYzKr.exe
  C:\Windows\System\dbOYzKr.exe
  2⤵
  PID:11104
- C:\Windows\System\fqCaIBz.exe
  C:\Windows\System\fqCaIBz.exe
  2⤵
  PID:11128
- C:\Windows\System\QiLmdEa.exe
  C:\Windows\System\QiLmdEa.exe
  2⤵
  PID:11148
- C:\Windows\System\LGoxFMv.exe
  C:\Windows\System\LGoxFMv.exe
  2⤵
  PID:11172
- C:\Windows\System\GzbXadn.exe
  C:\Windows\System\GzbXadn.exe
  2⤵
  PID:11196
- C:\Windows\System\JCMgOel.exe
  C:\Windows\System\JCMgOel.exe
  2⤵
  PID:11220
- C:\Windows\System\foJvORi.exe
  C:\Windows\System\foJvORi.exe
  2⤵
  PID:11244
- C:\Windows\System\nxfTMYC.exe
  C:\Windows\System\nxfTMYC.exe
  2⤵
  PID:5200
- C:\Windows\System\CpBSYCk.exe
  C:\Windows\System\CpBSYCk.exe
  2⤵
  PID:8068
- C:\Windows\System\nZIzksK.exe
  C:\Windows\System\nZIzksK.exe
  2⤵
  PID:7548
- C:\Windows\System\ncrsOSX.exe
  C:\Windows\System\ncrsOSX.exe
  2⤵
  PID:7228
- C:\Windows\System\YfxsPUh.exe
  C:\Windows\System\YfxsPUh.exe
  2⤵
  PID:7436
- C:\Windows\System\KQRilwf.exe
  C:\Windows\System\KQRilwf.exe
  2⤵
  PID:7568
- C:\Windows\System\wXUkfuj.exe
  C:\Windows\System\wXUkfuj.exe
  2⤵
  PID:6932
- C:\Windows\System\euMgSkt.exe
  C:\Windows\System\euMgSkt.exe
  2⤵
  PID:7684
- C:\Windows\System\kzCZgaG.exe
  C:\Windows\System\kzCZgaG.exe
  2⤵
  PID:7716
- C:\Windows\System\WSSKLIe.exe
  C:\Windows\System\WSSKLIe.exe
  2⤵
  PID:8576
- C:\Windows\System\VXnQybK.exe
  C:\Windows\System\VXnQybK.exe
  2⤵
  PID:9372
- C:\Windows\System\adJJHnM.exe
  C:\Windows\System\adJJHnM.exe
  2⤵
  PID:9464
- C:\Windows\System\aALwgce.exe
  C:\Windows\System\aALwgce.exe
  2⤵
  PID:9488
- C:\Windows\System\UnKUMnb.exe
  C:\Windows\System\UnKUMnb.exe
  2⤵
  PID:9532
- C:\Windows\System\pcsiZQI.exe
  C:\Windows\System\pcsiZQI.exe
  2⤵
  PID:8764
- C:\Windows\System\cApqmgE.exe
  C:\Windows\System\cApqmgE.exe
  2⤵
  PID:8804
- C:\Windows\System\xTPXSQW.exe
  C:\Windows\System\xTPXSQW.exe
  2⤵
  PID:8828
- C:\Windows\System\ufOwHRg.exe
  C:\Windows\System\ufOwHRg.exe
  2⤵
  PID:8004
- C:\Windows\System\LhgvVsk.exe
  C:\Windows\System\LhgvVsk.exe
  2⤵
  PID:9720
- C:\Windows\System\VWtbsmy.exe
  C:\Windows\System\VWtbsmy.exe
  2⤵
  PID:9788
- C:\Windows\System\vmxOqYU.exe
  C:\Windows\System\vmxOqYU.exe
  2⤵
  PID:9860
- C:\Windows\System\VSLYyaa.exe
  C:\Windows\System\VSLYyaa.exe
  2⤵
  PID:9900
- C:\Windows\System\TwUfBQG.exe
  C:\Windows\System\TwUfBQG.exe
  2⤵
  PID:8928
- C:\Windows\System\ZxNIbON.exe
  C:\Windows\System\ZxNIbON.exe
  2⤵
  PID:8956
- C:\Windows\System\AYREbcr.exe
  C:\Windows\System\AYREbcr.exe
  2⤵
  PID:9020
- C:\Windows\System\RqyRoOr.exe
  C:\Windows\System\RqyRoOr.exe
  2⤵
  PID:10076
- C:\Windows\System\LYgYXpW.exe
  C:\Windows\System\LYgYXpW.exe
  2⤵
  PID:11288
- C:\Windows\System\ZxEQfaN.exe
  C:\Windows\System\ZxEQfaN.exe
  2⤵
  PID:11308
- C:\Windows\System\elXnrTb.exe
  C:\Windows\System\elXnrTb.exe
  2⤵
  PID:11328
- C:\Windows\System\MXVBPxq.exe
  C:\Windows\System\MXVBPxq.exe
  2⤵
  PID:11348
- C:\Windows\System\sIWmJfQ.exe
  C:\Windows\System\sIWmJfQ.exe
  2⤵
  PID:11368
- C:\Windows\System\pyBSali.exe
  C:\Windows\System\pyBSali.exe
  2⤵
  PID:11392
- C:\Windows\System\bOHfwSA.exe
  C:\Windows\System\bOHfwSA.exe
  2⤵
  PID:11424
- C:\Windows\System\DoSixPg.exe
  C:\Windows\System\DoSixPg.exe
  2⤵
  PID:11448
- C:\Windows\System\hmKRito.exe
  C:\Windows\System\hmKRito.exe
  2⤵
  PID:11468
- C:\Windows\System\GcXdFJg.exe
  C:\Windows\System\GcXdFJg.exe
  2⤵
  PID:11484
- C:\Windows\System\UgrVunN.exe
  C:\Windows\System\UgrVunN.exe
  2⤵
  PID:11508
- C:\Windows\System\uHRooBM.exe
  C:\Windows\System\uHRooBM.exe
  2⤵
  PID:11536
- C:\Windows\System\KpEUPDX.exe
  C:\Windows\System\KpEUPDX.exe
  2⤵
  PID:11556
- C:\Windows\System\LnWBhkd.exe
  C:\Windows\System\LnWBhkd.exe
  2⤵
  PID:11576
- C:\Windows\System\SPkttoh.exe
  C:\Windows\System\SPkttoh.exe
  2⤵
  PID:11596
- C:\Windows\System\mLRttbd.exe
  C:\Windows\System\mLRttbd.exe
  2⤵
  PID:11624
- C:\Windows\System\ZUjPzKM.exe
  C:\Windows\System\ZUjPzKM.exe
  2⤵
  PID:11644
- C:\Windows\System\FAlnhuM.exe
  C:\Windows\System\FAlnhuM.exe
  2⤵
  PID:11672
- C:\Windows\System\ZcbITob.exe
  C:\Windows\System\ZcbITob.exe
  2⤵
  PID:11696
- C:\Windows\System\rJPuHFn.exe
  C:\Windows\System\rJPuHFn.exe
  2⤵
  PID:11720
- C:\Windows\System\cfCRYEO.exe
  C:\Windows\System\cfCRYEO.exe
  2⤵
  PID:11740
- C:\Windows\System\KpGRDit.exe
  C:\Windows\System\KpGRDit.exe
  2⤵
  PID:11764
- C:\Windows\System\EApPebp.exe
  C:\Windows\System\EApPebp.exe
  2⤵
  PID:11784
- C:\Windows\System\uGinRJa.exe
  C:\Windows\System\uGinRJa.exe
  2⤵
  PID:11808
- C:\Windows\System\peowIOa.exe
  C:\Windows\System\peowIOa.exe
  2⤵
  PID:11832
- C:\Windows\System\qKfMFDY.exe
  C:\Windows\System\qKfMFDY.exe
  2⤵
  PID:11852
- C:\Windows\System\lQHKZNA.exe
  C:\Windows\System\lQHKZNA.exe
  2⤵
  PID:11876
- C:\Windows\System\nncZQhc.exe
  C:\Windows\System\nncZQhc.exe
  2⤵
  PID:11904
- C:\Windows\System\KOJgAGv.exe
  C:\Windows\System\KOJgAGv.exe
  2⤵
  PID:11924
- C:\Windows\System\haNjXTG.exe
  C:\Windows\System\haNjXTG.exe
  2⤵
  PID:11948
- C:\Windows\System\xrDigRV.exe
  C:\Windows\System\xrDigRV.exe
  2⤵
  PID:11968
- C:\Windows\System\rncEeqc.exe
  C:\Windows\System\rncEeqc.exe
  2⤵
  PID:11992
- C:\Windows\System\jbWDVLo.exe
  C:\Windows\System\jbWDVLo.exe
  2⤵
  PID:12012
- C:\Windows\System\ApYoiGI.exe
  C:\Windows\System\ApYoiGI.exe
  2⤵
  PID:12032
- C:\Windows\System\qfzDExK.exe
  C:\Windows\System\qfzDExK.exe
  2⤵
  PID:12056
- C:\Windows\System\TOUWscv.exe
  C:\Windows\System\TOUWscv.exe
  2⤵
  PID:12076
- C:\Windows\System\tkDqlbo.exe
  C:\Windows\System\tkDqlbo.exe
  2⤵
  PID:12096
- C:\Windows\System\nrsWYLA.exe
  C:\Windows\System\nrsWYLA.exe
  2⤵
  PID:12124
- C:\Windows\System\dwZgZgm.exe
  C:\Windows\System\dwZgZgm.exe
  2⤵
  PID:12164
- C:\Windows\System\dgzmBRY.exe
  C:\Windows\System\dgzmBRY.exe
  2⤵
  PID:12180
- C:\Windows\System\hnbYRri.exe
  C:\Windows\System\hnbYRri.exe
  2⤵
  PID:12208
- C:\Windows\System\szrMNVf.exe
  C:\Windows\System\szrMNVf.exe
  2⤵
  PID:12228
- C:\Windows\System\JFLSKaC.exe
  C:\Windows\System\JFLSKaC.exe
  2⤵
  PID:12248
- C:\Windows\System\awgaONc.exe
  C:\Windows\System\awgaONc.exe
  2⤵
  PID:12268
- C:\Windows\System\FDClTxL.exe
  C:\Windows\System\FDClTxL.exe
  2⤵
  PID:9060
- C:\Windows\System\DqRfwrk.exe
  C:\Windows\System\DqRfwrk.exe
  2⤵
  PID:10144
- C:\Windows\System\bduzryP.exe
  C:\Windows\System\bduzryP.exe
  2⤵
  PID:10204
- C:\Windows\System\FrJmdSj.exe
  C:\Windows\System\FrJmdSj.exe
  2⤵
  PID:7072
- C:\Windows\System\fBiQkyW.exe
  C:\Windows\System\fBiQkyW.exe
  2⤵
  PID:8740
- C:\Windows\System\pimRmhb.exe
  C:\Windows\System\pimRmhb.exe
  2⤵
  PID:7236
- C:\Windows\System\GFbIqZm.exe
  C:\Windows\System\GFbIqZm.exe
  2⤵
  PID:5840
- C:\Windows\System\ZjTPsIZ.exe
  C:\Windows\System\ZjTPsIZ.exe
  2⤵
  PID:6172
- C:\Windows\System\yzAcnHn.exe
  C:\Windows\System\yzAcnHn.exe
  2⤵
  PID:7824
- C:\Windows\System\kJJCMpe.exe
  C:\Windows\System\kJJCMpe.exe
  2⤵
  PID:10276
- C:\Windows\System\itAqlLP.exe
  C:\Windows\System\itAqlLP.exe
  2⤵
  PID:8284
- C:\Windows\System\SzVfDMe.exe
  C:\Windows\System\SzVfDMe.exe
  2⤵
  PID:8332
- C:\Windows\System\DaUrKLk.exe
  C:\Windows\System\DaUrKLk.exe
  2⤵
  PID:10480
- C:\Windows\System\bUmiuVd.exe
  C:\Windows\System\bUmiuVd.exe
  2⤵
  PID:7472
- C:\Windows\System\GQNbijj.exe
  C:\Windows\System\GQNbijj.exe
  2⤵
  PID:10616
- C:\Windows\System\KPeArzZ.exe
  C:\Windows\System\KPeArzZ.exe
  2⤵
  PID:10656
- C:\Windows\System\gjifpfF.exe
  C:\Windows\System\gjifpfF.exe
  2⤵
  PID:8496
- C:\Windows\System\EsMuoVM.exe
  C:\Windows\System\EsMuoVM.exe
  2⤵
  PID:10756
- C:\Windows\System\HeNMdHC.exe
  C:\Windows\System\HeNMdHC.exe
  2⤵
  PID:9316
- C:\Windows\System\TuFvjHm.exe
  C:\Windows\System\TuFvjHm.exe
  2⤵
  PID:12300
- C:\Windows\System\HswOhzF.exe
  C:\Windows\System\HswOhzF.exe
  2⤵
  PID:12324
- C:\Windows\System\BPqNqBP.exe
  C:\Windows\System\BPqNqBP.exe
  2⤵
  PID:12344
- C:\Windows\System\SIcowaJ.exe
  C:\Windows\System\SIcowaJ.exe
  2⤵
  PID:12368
- C:\Windows\System\fTILzOI.exe
  C:\Windows\System\fTILzOI.exe
  2⤵
  PID:12388
- C:\Windows\System\UpZqtmY.exe
  C:\Windows\System\UpZqtmY.exe
  2⤵
  PID:12408
- C:\Windows\System\Mkgblfl.exe
  C:\Windows\System\Mkgblfl.exe
  2⤵
  PID:12436
- C:\Windows\System\GpBeDXg.exe
  C:\Windows\System\GpBeDXg.exe
  2⤵
  PID:12456
- C:\Windows\System\BFDmZNv.exe
  C:\Windows\System\BFDmZNv.exe
  2⤵
  PID:12480
- C:\Windows\System\lMKCBKC.exe
  C:\Windows\System\lMKCBKC.exe
  2⤵
  PID:12504
- C:\Windows\System\dhbFwPH.exe
  C:\Windows\System\dhbFwPH.exe
  2⤵
  PID:12528
- C:\Windows\System\wtMMZpj.exe
  C:\Windows\System\wtMMZpj.exe
  2⤵
  PID:12548
- C:\Windows\System\FeQZRSH.exe
  C:\Windows\System\FeQZRSH.exe
  2⤵
  PID:12568
- C:\Windows\System\ByZRHBA.exe
  C:\Windows\System\ByZRHBA.exe
  2⤵
  PID:12596
- C:\Windows\System\lEQkxpi.exe
  C:\Windows\System\lEQkxpi.exe
  2⤵
  PID:12620
- C:\Windows\System\bjTTzDu.exe
  C:\Windows\System\bjTTzDu.exe
  2⤵
  PID:12644
- C:\Windows\System\JAtyTRv.exe
  C:\Windows\System\JAtyTRv.exe
  2⤵
  PID:12660
- C:\Windows\System\bMSYxBH.exe
  C:\Windows\System\bMSYxBH.exe
  2⤵
  PID:12684
- C:\Windows\System\MNGmFcB.exe
  C:\Windows\System\MNGmFcB.exe
  2⤵
  PID:12708
- C:\Windows\System\yGdcjLa.exe
  C:\Windows\System\yGdcjLa.exe
  2⤵
  PID:12732
- C:\Windows\System\xSawhXk.exe
  C:\Windows\System\xSawhXk.exe
  2⤵
  PID:12760
- C:\Windows\System\hCqKgPW.exe
  C:\Windows\System\hCqKgPW.exe
  2⤵
  PID:12780
- C:\Windows\System\JRqnlrr.exe
  C:\Windows\System\JRqnlrr.exe
  2⤵
  PID:12808
- C:\Windows\System\lWvUeoM.exe
  C:\Windows\System\lWvUeoM.exe
  2⤵
  PID:12828
- C:\Windows\System\AfjGzzw.exe
  C:\Windows\System\AfjGzzw.exe
  2⤵
  PID:12848
- C:\Windows\System\eUCvPbx.exe
  C:\Windows\System\eUCvPbx.exe
  2⤵
  PID:12872
- C:\Windows\System\tDaYbRi.exe
  C:\Windows\System\tDaYbRi.exe
  2⤵
  PID:12896
- C:\Windows\System\YRTlwDQ.exe
  C:\Windows\System\YRTlwDQ.exe
  2⤵
  PID:12916
- C:\Windows\System\oreuquf.exe
  C:\Windows\System\oreuquf.exe
  2⤵
  PID:12940
- C:\Windows\System\tzCwyVe.exe
  C:\Windows\System\tzCwyVe.exe
  2⤵
  PID:12964
- C:\Windows\System\tiNxzIE.exe
  C:\Windows\System\tiNxzIE.exe
  2⤵
  PID:12984
- C:\Windows\System\hXqbFIQ.exe
  C:\Windows\System\hXqbFIQ.exe
  2⤵
  PID:13008
- C:\Windows\System\towoyTc.exe
  C:\Windows\System\towoyTc.exe
  2⤵
  PID:13028
- C:\Windows\System\iKliSIX.exe
  C:\Windows\System\iKliSIX.exe
  2⤵
  PID:13052
- C:\Windows\System\QXXHWag.exe
  C:\Windows\System\QXXHWag.exe
  2⤵
  PID:13072
- C:\Windows\System\DvRTjKH.exe
  C:\Windows\System\DvRTjKH.exe
  2⤵
  PID:13096
- C:\Windows\System\rmdrJuB.exe
  C:\Windows\System\rmdrJuB.exe
  2⤵
  PID:13224
- C:\Windows\System\hZDMmaV.exe
  C:\Windows\System\hZDMmaV.exe
  2⤵
  PID:13244
- C:\Windows\System\JrDkHxg.exe
  C:\Windows\System\JrDkHxg.exe
  2⤵
  PID:13260
- C:\Windows\System\wvItFdw.exe
  C:\Windows\System\wvItFdw.exe
  2⤵
  PID:13296
- C:\Windows\System\xDzaMuj.exe
  C:\Windows\System\xDzaMuj.exe
  2⤵
  PID:10856
- C:\Windows\System\WiZfWRX.exe
  C:\Windows\System\WiZfWRX.exe
  2⤵
  PID:10944
- C:\Windows\System\OVNdDZe.exe
  C:\Windows\System\OVNdDZe.exe
  2⤵
  PID:9504
- C:\Windows\System\ZILWkAx.exe
  C:\Windows\System\ZILWkAx.exe
  2⤵
  PID:11076
- C:\Windows\System\farEeND.exe
  C:\Windows\System\farEeND.exe
  2⤵
  PID:11140
- C:\Windows\System\lmYqezT.exe
  C:\Windows\System\lmYqezT.exe
  2⤵
  PID:11232
- C:\Windows\System\WEpKNOo.exe
  C:\Windows\System\WEpKNOo.exe
  2⤵
  PID:7564
- C:\Windows\System\RTrhpbf.exe
  C:\Windows\System\RTrhpbf.exe
  2⤵
  PID:7628
- C:\Windows\System\QFemwlG.exe
  C:\Windows\System\QFemwlG.exe
  2⤵
  PID:8556
- C:\Windows\System\UsYjykO.exe
  C:\Windows\System\UsYjykO.exe
  2⤵
  PID:9980
- C:\Windows\System\wXDyTcp.exe
  C:\Windows\System\wXDyTcp.exe
  2⤵
  PID:8976
- C:\Windows\System\sArnFyT.exe
  C:\Windows\System\sArnFyT.exe
  2⤵
  PID:9204
- C:\Windows\System\EJAFHYl.exe
  C:\Windows\System\EJAFHYl.exe
  2⤵
  PID:10228
- C:\Windows\System\vttabEJ.exe
  C:\Windows\System\vttabEJ.exe
  2⤵
  PID:11548
- C:\Windows\System\PcRSGZR.exe
  C:\Windows\System\PcRSGZR.exe
  2⤵
  PID:11592
- C:\Windows\System\YPuVGcr.exe
  C:\Windows\System\YPuVGcr.exe
  2⤵
  PID:3372
- C:\Windows\System\ZmkrZdA.exe
  C:\Windows\System\ZmkrZdA.exe
  2⤵
  PID:11620
- C:\Windows\System\ihwFrNd.exe
  C:\Windows\System\ihwFrNd.exe
  2⤵
  PID:4740
- C:\Windows\System\gOMSDWX.exe
  C:\Windows\System\gOMSDWX.exe
  2⤵
  PID:9140
- C:\Windows\System\oQRDVdP.exe
  C:\Windows\System\oQRDVdP.exe
  2⤵
  PID:6332
- C:\Windows\System\bevOxFR.exe
  C:\Windows\System\bevOxFR.exe
  2⤵
  PID:11848
- C:\Windows\System\VyJEWZM.exe
  C:\Windows\System\VyJEWZM.exe
  2⤵
  PID:11916
- C:\Windows\System\UZqnmoo.exe
  C:\Windows\System\UZqnmoo.exe
  2⤵
  PID:11956
- C:\Windows\System\pdjZFlt.exe
  C:\Windows\System\pdjZFlt.exe
  2⤵
  PID:11988
- C:\Windows\System\FnNtBqv.exe
  C:\Windows\System\FnNtBqv.exe
  2⤵
  PID:12008
- C:\Windows\System\AtXHeog.exe
  C:\Windows\System\AtXHeog.exe
  2⤵
  PID:13324
- C:\Windows\System\FpZeCqx.exe
  C:\Windows\System\FpZeCqx.exe
  2⤵
  PID:13344
- C:\Windows\System\QAvPIxV.exe
  C:\Windows\System\QAvPIxV.exe
  2⤵
  PID:13368
- C:\Windows\System\rPeoGyk.exe
  C:\Windows\System\rPeoGyk.exe
  2⤵
  PID:13388
- C:\Windows\System\EuWHvis.exe
  C:\Windows\System\EuWHvis.exe
  2⤵
  PID:13408
- C:\Windows\System\tziKoNd.exe
  C:\Windows\System\tziKoNd.exe
  2⤵
  PID:13436
- C:\Windows\System\ETJdYCY.exe
  C:\Windows\System\ETJdYCY.exe
  2⤵
  PID:13460
- C:\Windows\System\TigDPEu.exe
  C:\Windows\System\TigDPEu.exe
  2⤵
  PID:13484
- C:\Windows\System\OQyMoCJ.exe
  C:\Windows\System\OQyMoCJ.exe
  2⤵
  PID:13504
- C:\Windows\System\ldbahGm.exe
  C:\Windows\System\ldbahGm.exe
  2⤵
  PID:13524
- C:\Windows\System\DvoSQyX.exe
  C:\Windows\System\DvoSQyX.exe
  2⤵
  PID:13548
- C:\Windows\System\tPaNyCe.exe
  C:\Windows\System\tPaNyCe.exe
  2⤵
  PID:13564
- C:\Windows\System\jembtpf.exe
  C:\Windows\System\jembtpf.exe
  2⤵
  PID:13600
- C:\Windows\System\FCGGMCJ.exe
  C:\Windows\System\FCGGMCJ.exe
  2⤵
  PID:13620
- C:\Windows\System\bfTdYjq.exe
  C:\Windows\System\bfTdYjq.exe
  2⤵
  PID:13656
- C:\Windows\System\YVrNQhU.exe
  C:\Windows\System\YVrNQhU.exe
  2⤵
  PID:13680
- C:\Windows\System\ninNzHA.exe
  C:\Windows\System\ninNzHA.exe
  2⤵
  PID:13700
- C:\Windows\System\AFRynJx.exe
  C:\Windows\System\AFRynJx.exe
  2⤵
  PID:13728
- C:\Windows\System\duSmYqJ.exe
  C:\Windows\System\duSmYqJ.exe
  2⤵
  PID:13752
- C:\Windows\System\BooNutL.exe
  C:\Windows\System\BooNutL.exe
  2⤵
  PID:13780
- C:\Windows\System\icQiJFO.exe
  C:\Windows\System\icQiJFO.exe
  2⤵
  PID:13804
- C:\Windows\System\bKKknji.exe
  C:\Windows\System\bKKknji.exe
  2⤵
  PID:13836
- C:\Windows\System\SoqpJyK.exe
  C:\Windows\System\SoqpJyK.exe
  2⤵
  PID:13860
- C:\Windows\System\iQFOwHm.exe
  C:\Windows\System\iQFOwHm.exe
  2⤵
  PID:13888
- C:\Windows\System\qXPpTLI.exe
  C:\Windows\System\qXPpTLI.exe
  2⤵
  PID:13908
- C:\Windows\System\ojrMipL.exe
  C:\Windows\System\ojrMipL.exe
  2⤵
  PID:13924
- C:\Windows\System\IcWSQiY.exe
  C:\Windows\System\IcWSQiY.exe
  2⤵
  PID:13944
- C:\Windows\System\foXRUXE.exe
  C:\Windows\System\foXRUXE.exe
  2⤵
  PID:13968
- C:\Windows\System\wwnNbhI.exe
  C:\Windows\System\wwnNbhI.exe
  2⤵
  PID:13988
- C:\Windows\System\CwZlypO.exe
  C:\Windows\System\CwZlypO.exe
  2⤵
  PID:14008
- C:\Windows\System\ufqUUIu.exe
  C:\Windows\System\ufqUUIu.exe
  2⤵
  PID:14028
- C:\Windows\System\rgZwwCf.exe
  C:\Windows\System\rgZwwCf.exe
  2⤵
  PID:14044
- C:\Windows\System\yKUEkyT.exe
  C:\Windows\System\yKUEkyT.exe
  2⤵
  PID:14064
- C:\Windows\System\IAiLjgn.exe
  C:\Windows\System\IAiLjgn.exe
  2⤵
  PID:14088
- C:\Windows\System\FbyGWbp.exe
  C:\Windows\System\FbyGWbp.exe
  2⤵
  PID:14112
- C:\Windows\System\orYGnof.exe
  C:\Windows\System\orYGnof.exe
  2⤵
  PID:14132
- C:\Windows\System\liLHRva.exe
  C:\Windows\System\liLHRva.exe
  2⤵
  PID:14156
- C:\Windows\System\dJRsmKw.exe
  C:\Windows\System\dJRsmKw.exe
  2⤵
  PID:14176
- C:\Windows\System\GyYnDRi.exe
  C:\Windows\System\GyYnDRi.exe
  2⤵
  PID:14208
- C:\Windows\System\FSrHuoN.exe
  C:\Windows\System\FSrHuoN.exe
  2⤵
  PID:14228
- C:\Windows\System\pjihILt.exe
  C:\Windows\System\pjihILt.exe
  2⤵
  PID:14256
- C:\Windows\System\LTYGAbk.exe
  C:\Windows\System\LTYGAbk.exe
  2⤵
  PID:14272
- C:\Windows\System\uivFPRB.exe
  C:\Windows\System\uivFPRB.exe
  2⤵
  PID:14292
- C:\Windows\System\jyxufBn.exe
  C:\Windows\System\jyxufBn.exe
  2⤵
  PID:14312
- C:\Windows\System\qkEIDhz.exe
  C:\Windows\System\qkEIDhz.exe
  2⤵
  PID:12052
- C:\Windows\System\bzErWZt.exe
  C:\Windows\System\bzErWZt.exe
  2⤵
  PID:12064
- C:\Windows\System\gxmfAmC.exe
  C:\Windows\System\gxmfAmC.exe
  2⤵
  PID:10436
- C:\Windows\System\LhMHSNl.exe
  C:\Windows\System\LhMHSNl.exe
  2⤵
  PID:7216
- C:\Windows\System\LgxVJaj.exe
  C:\Windows\System\LgxVJaj.exe
  2⤵
  PID:6784
- C:\Windows\System\PQaouNv.exe
  C:\Windows\System\PQaouNv.exe
  2⤵
  PID:10524
- C:\Windows\System\dQVJMGN.exe
  C:\Windows\System\dQVJMGN.exe
  2⤵
  PID:9104
- C:\Windows\System\NIvxjUG.exe
  C:\Windows\System\NIvxjUG.exe
  2⤵
  PID:8304
- C:\Windows\System\xKzRZqZ.exe
  C:\Windows\System\xKzRZqZ.exe
  2⤵
  PID:6996
- C:\Windows\System\UYcAIhI.exe
  C:\Windows\System\UYcAIhI.exe
  2⤵
  PID:7040
- C:\Windows\System\lpZFuvH.exe
  C:\Windows\System\lpZFuvH.exe
  2⤵
  PID:2428
- C:\Windows\System\pERfVoZ.exe
  C:\Windows\System\pERfVoZ.exe
  2⤵
  PID:7388
- C:\Windows\System\mlfixfv.exe
  C:\Windows\System\mlfixfv.exe
  2⤵
  PID:10796
- C:\Windows\System\ykPXRpQ.exe
  C:\Windows\System\ykPXRpQ.exe
  2⤵
  PID:9260
- C:\Windows\System\UOjNNIE.exe
  C:\Windows\System\UOjNNIE.exe
  2⤵
  PID:7100
- C:\Windows\System\pikHvqr.exe
  C:\Windows\System\pikHvqr.exe
  2⤵
  PID:10872
- C:\Windows\System\SlJtxEe.exe
  C:\Windows\System\SlJtxEe.exe
  2⤵
  PID:10932
- C:\Windows\System\jLCDvmy.exe
  C:\Windows\System\jLCDvmy.exe
  2⤵
  PID:12400
- C:\Windows\System\kCtjPkP.exe
  C:\Windows\System\kCtjPkP.exe
  2⤵
  PID:11004
- C:\Windows\System\XWikwCL.exe
  C:\Windows\System\XWikwCL.exe
  2⤵
  PID:9528
- C:\Windows\System\XxBawJV.exe
  C:\Windows\System\XxBawJV.exe
  2⤵
  PID:11092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CepymLM.exe

Filesize
1.7MB

MD5
2596434c26fec8f3d1b111679516f90e

SHA1
fa8f52c4bdb436d550ed5583c1f4aa11d0028de7

SHA256
e17ca6b9859c520cb369c92b779192ed032dae7dba0f19681a13c65f9d79dcac

SHA512
9030bca5d1ebaf3fc780c14b6b9fb3dcda29a74949c959d3582acd8576defcdfed4e3f6d7ce0d4d5502504c708428bcb4cb9faf9d26858ae328fec613cf34f3f

Download Submit
C:\Windows\System\EEpXRNI.exe

Filesize
1.7MB

MD5
08bda19d0784d2e410dbfe5160f259db

SHA1
3704d23c142c3a42315f2addec315fa1242823d1

SHA256
e1f1c0c14c34426e86f2cde72ca51cc779780179387c2d3e488ea1f739a93ef2

SHA512
95b8f5354159f8295129021216f88c6c825e87d560eb113220d436cc1521b88d73f8f3f6ecac3fbcc754c2eeb4074ffa3abc38b646822aedfa45aab985ff0fa0

Download Submit
C:\Windows\System\GPzYchw.exe

Filesize
1.7MB

MD5
7702ad7f3fce83458fb35f3b69558238

SHA1
30e6de8e32b46ca9f2bdb103b54d317e254a8034

SHA256
1507a8e938799e3b3a1e2ca005f6f2f9e19667293a8b072ee98882cd7e25cee8

SHA512
ab0ccbd59839eba3eba9e30de8a08cb138e54c798e82c166da0cfa8cdccf8398234c0a2695d282cc2cc4cd20a1c0343847ef24a8f8e6e022d1eeec3ee5c4c862

Download Submit
C:\Windows\System\GQnqjNC.exe

Filesize
1.7MB

MD5
b6de780225c3c62109e8a66ef67a06a0

SHA1
e2d08a353d67b02514d5d4d80ef0446eb7b0226d

SHA256
20ac48992c471ecde8cf229babec2bb2ac6b2af641c1eaac7e28266b727efed7

SHA512
f017ae93fd74da6ea8f2cd01b05ac7d7afe7eb589d16c21da534eb68d258b22298482810040f3eda3d079e53c111a635db7853dd9955b27fb424337ceff7be7c

Download Submit
C:\Windows\System\IWkwmvY.exe

Filesize
1.7MB

MD5
8782150574d8770c21114bb5c5947c2a

SHA1
05bbf05d7cd28b02f16eb31c28549252215872c4

SHA256
23c02cea3a2f9f2fdda5c52b15b782ff4f8660e5ed26a17fcfba5a427179f6da

SHA512
8b57d6daf8ec768d71e54caeb2b3194448519c6c2391316e7b757be4d9c18e3208cca60109e5a43c5c0513f60c835c2c85a7a13b05e6a5610356c3d457f2b29e

Download Submit
C:\Windows\System\JAFoevv.exe

Filesize
1.7MB

MD5
0e7228b5bf78e0219584bdf18fe64a68

SHA1
679bee0a4a5fb0254b2db226c5262caf872a5920

SHA256
d4f7aa0a3e497f1c35d957944a1840e557c0e9be879a6a29c8a8243a49c0d605

SHA512
956d139462872852b0a4c39d5c2c1388a751ebf131bacdcea78393468966d6d477ba611aef4a68bddb5a6ca2ce238ff2c4f2eaf178012257b2cb1e6da3302e9a

Download Submit
C:\Windows\System\LHpyPYV.exe

Filesize
1.7MB

MD5
7914e6a9dd0018c4d69d083037ea7844

SHA1
4272044e13cdb4004bbe4fcd5c01aa80ca61f499

SHA256
efeff93635765a2d3db44f61376b44396adb5cccb8488feae89bf25edb4b0f15

SHA512
16cc6a9ce829618e4bc628c158c2f269d9b861468be790285b32c877c7a363b3458830166034c0b47420e82d4aec784d1e8ffbcdd8a71d7fdf60887cbbcb48d9

Download Submit
C:\Windows\System\MCUixYR.exe

Filesize
1.7MB

MD5
0616d3afd0c99d6523469ba169eb1cb2

SHA1
21184de1e32f08966e27bd293f37be2cdd02e302

SHA256
1116597f0a48b718ff2500728bb01bfc59c79bba64bba9a15db2cac8d3b2b5ed

SHA512
479e438c68521d7cb2141072733107d7482604baa3d661a546e1a13b868351a89752c09ba4d83b72a4a9b3bd05d2f36e08b37c78e594815ea01ebfb464cc8549

Download Submit
C:\Windows\System\MzBnjaV.exe

Filesize
1.7MB

MD5
ce5124e6beaaed30b0c0c44cff8fe0de

SHA1
4314c78969ec737bcf04f4f269e870a68bf4cc04

SHA256
2c6859d75c0700f2e0adc2102846bbe898de6b7fc1c4fd3630d6cc383452cdb3

SHA512
f7dd76e1ef9b17f2680fa3619501c476caee53d09a8bb7d335c40be23e5980fbf0eb0b5c82f3097c83d4db025321e939e4c1f0ce3a748cd29bd36999e1bb1ac7

Download Submit
C:\Windows\System\OqsQvYx.exe

Filesize
1.7MB

MD5
5de07583e7614c3a5fb2d499ddb32a0d

SHA1
979016bee617ab56ec2b87d5c42d99821793f421

SHA256
593949f2cd58dd5ba7a476e1f0d7c7b14a6a8b8460f0b9696e9e112ca08edbd6

SHA512
e5cbc79e49d7668451455c1ab57ae4fdbfff8bc2d95ec6e9aff0f6ec0230b974a0b1237e563a4f2da2a27bad010640fa32cb6f6525487f422bdc41a74e6f7304

Download Submit
C:\Windows\System\PDQSikm.exe

Filesize
1.7MB

MD5
ca56ddfe25277b3dc15cad65ea4b8d88

SHA1
4ea908f5b02afa3dce1aa965ed70436fbdce662e

SHA256
79792fc08f753c02e1f9e342c321a94f84757d43e390074a8a97857a5bf0d1cd

SHA512
a0f9d5ef172ef4e528cb0fa19caeaa15c6715b214d7fc386b766095da375de3f1948a765299332f02dba1a84d6075c40f810f31c8728f7cf14c3837e3daf2a43

Download Submit
C:\Windows\System\SQUGhxX.exe

Filesize
1.7MB

MD5
4d7194f6b5c2565f9849b6056bf12ff5

SHA1
57075863425da83d3f0e5c93c0ab33ed1cfdbc02

SHA256
2df008ab23d2b9daa6ee20178b9be624fdc08db6b7e15fcb35c39abd03cea043

SHA512
663d693cd7e0e8f7459e5f48a0defd54365626be828571a0b0f1e585aab2adb2c42c34cede3ba5eaea1e953dcff38c4f3afbfc445e19d72fe08003cd41e3eb8c

Download Submit
C:\Windows\System\SaSCxOd.exe

Filesize
1.7MB

MD5
d26440f4c32eaa1e1ed311a9ef1c5a56

SHA1
517f45c31b68ed00453d5b39dca8bf6705eb1be0

SHA256
95108e654c8844515bb6be9be3c31dc7a19f047881fef4b36127235dba062b13

SHA512
cafc08b8b87dc034fb3223324fec5c7f95ec97a44349fc755d116b0bc5abaf20a33baf994f1b6fca3093f9861aff055be874374e817af2bb72072afe7b2a5c5e

Download Submit
C:\Windows\System\VktOvcB.exe

Filesize
1.7MB

MD5
fa2f7a3d83fc71af021d2a935127b0bf

SHA1
c28b8d5f666da194764189a4d5aa1c677f433888

SHA256
96c4d5f628d21c863b81f4e562ce653061897c0fe43a4b68fd1cd09669f5ac0e

SHA512
06296edc71f3b856b9fe7d2a08387984e599916cf4e9e080108df49306b03029cd313ebd62e5ded03cd27948616da30e6883136f7ebcb391cc0e19f05cdc3e7e

Download Submit
C:\Windows\System\WbgLpHO.exe

Filesize
1.7MB

MD5
04181d577c181d5677567d8140c2ebbe

SHA1
a6ec2adb2d45f14af0a64fa4f81ef740ae75a38c

SHA256
098aea47b79376cbc8c0556b2f6653c4ec439e14460e127e09bf70456e6e6921

SHA512
60801dcd47f8f80282a8066b59d2d475f34a247c99e4aedd3ebc231b4fe24c43f990609a0caae13530e7338d4026fde0586740fcf0c7e38a2d9520389d988160

Download Submit
C:\Windows\System\XjWGqSZ.exe

Filesize
1.7MB

MD5
076b085bba6b7f6349979ad16ad23b86

SHA1
a2e5864d7f2fb6f291c2a98b589f877c993cd80b

SHA256
5f04621624658391ef2d9a47e213a9be383a5d564e89602a48193fe25542f26a

SHA512
a91af82c9187f8d6e4f56ccfb99fd76013ccb21baaa2fa6128d59ab64eb3013e49a6298044adea8a92f3b7aea8ee5ef3bab584a4e5ba40b645eccc9fe1462786

Download Submit
C:\Windows\System\YHSYIqL.exe

Filesize
1.7MB

MD5
3fac7d5db5b137e6a2976bfeee2d443d

SHA1
fd83fb42f3777d09a9807c14aea7a28e77659bf0

SHA256
f54c0526007279c353ac9a8a011b324e815a59766cc6d17dd65b6031fc1544b4

SHA512
71b9efa7669437b637a41818c1d444688160536e28303c87cc4241f545867896d59af4cdac10d262b9029c7b883adc9b28b9259510954dac07da7356dc339c75

Download Submit
C:\Windows\System\YgPyluI.exe

Filesize
1.7MB

MD5
1379e1698372cde1114ac4781073cd51

SHA1
ce9fee0996af0a688bd610ed4bc5219ef9efd828

SHA256
7a32d6041eaea6e4291533d2a20c5ca7e61158ebb6bcab84b221c7b1d61a90b5

SHA512
158dc49b4047ca658652616f2bbe6731d1477bdd975f3e4567898b33b2f55342d3c3b36af352ad695ec6115c2bb73603c59f2cdd908cfc0d1ecf9066e1389954

Download Submit
C:\Windows\System\bMsOgDf.exe

Filesize
1.7MB

MD5
59aa1da87b253530483a1febc05b88d0

SHA1
e32cf8a9c026e31c0d493b81d65f95b69e27dfb3

SHA256
b0127ad3cfbd1e240c786a90257d0c8bce6fbcdd255502b31682126875a70e23

SHA512
5e3b9bb6daa81ae7c9f20b2359dfb39a67a35cef034dfa44ab8aa094cf5d2b55f85e4718cbf07f2810feb490db6cc913dbbdc357a0001495a372896acc7cc1f2

Download Submit
C:\Windows\System\cNTXTEH.exe

Filesize
1.7MB

MD5
435dd115559631072d55d786b9bc0756

SHA1
a79ed6d6a332814907a942a0379e350503387a68

SHA256
4a18c88ce36b1c22984ba3755ddb9bedae2a1375aaf96ce8c09d92dff7c2c972

SHA512
8ccb8408363c07f3a7e768f81bbe62f888ce7841ca90b0f8c19d5d3c1ba6cb9cb7882fc5e71d927966d3d49f42cc60ac0af3ef0c91b06f288fae725c8cf9c74c

Download Submit
C:\Windows\System\cbCVpAP.exe

Filesize
1.7MB

MD5
b8c04c53c70ce76e46bbe522cfe28b29

SHA1
dd3ff51272ee905d1adbb0d8ba236e6ec822ad39

SHA256
912397dcfbaa302d42b0fd500e367fee37fcc5d8b93b9ee3d538f7fed7853280

SHA512
418f562d9bb801b1a9bee3aae48553c0e90668559f8df66828cf431f5c74725ae1a7e30d1b1d50acbbf40d1cfb6ccccc5a1dfffb6a765917e755d9c7cb5d7d78

Download Submit
C:\Windows\System\dpIkjMp.exe

Filesize
1.7MB

MD5
7b69ba0c7b391d370482f85d1d9d0cfc

SHA1
1d9de63e54d945fa8bab6f0f3b097db45ae7c84a

SHA256
7b6fc830e8b6ba5898db3ea8943aeebb0638721a1de2c9990fb9a681b0c29f50

SHA512
747d817fcb68d4d83e89866617c478f868eb663ca69b8da1327846909662c3d04c7257ecd5aa9d7b0b325f145943d6e8bec8989328d116c916eaaad15b700fba

Download Submit
C:\Windows\System\fDxUqnN.exe

Filesize
1.7MB

MD5
c3148e17d9b12b5e734a89e03a73d528

SHA1
b8318c8d16a4c1de973ccc18cb1fc445cff73af4

SHA256
38bdbb18a4f64c49ce8f4663b984347e6902a6fec9b942bf930f31c77276ebb9

SHA512
4380ba152ef7fc44050db00ffaae6e2b1740a16cf99c33f2f19731dca1e90e2e2cef259ab95213e7944ad790d0e0f3fad387f015822dff84342bf14f766bfcda

Download Submit
C:\Windows\System\fEdoYqz.exe

Filesize
1.7MB

MD5
26a6af2762d2fecf8568e435057b3bff

SHA1
0d335c7a7f3a4f449ead08c82e74b2fa8ee05760

SHA256
b6b035f1288781fd5cee249b89eccf7fc96bd7aa13bef4e055867de422530227

SHA512
2d773528381e6f61af5998abd5260908bdcebfb265e583cb408d2200ff5ce3acaa025f88d27bd4a8fe3da07ca1c6ca4eb2a289c3d8b215195120401340647f04

Download Submit
C:\Windows\System\fErfphq.exe

Filesize
1.7MB

MD5
98bcf30d4e99073d862a04d1ea17cdef

SHA1
2e7048734505a5904b703764240d215e3930b93b

SHA256
5325795eaa7e4d0b5d6905f29d685c25e1098faf5c192e462211ba8c1bd73697

SHA512
83484e5e9bce6d1881da9047fa0a91f47ffdc1b1f0d20839c5fd1d0cdc4f02fdef07a938494a2596061c612fc3a68db051874930554aa56dba9691036276bd47

Download Submit
C:\Windows\System\fjeZChG.exe

Filesize
1.7MB

MD5
7a042d802674a6d4e2732dda6ebc6cc5

SHA1
55809a0078485171da22d8fb0ad4863e63fe723c

SHA256
06f5cec07f30ea4aa8cc98b50b98362501a6e5185d06f87922dac80e693a6ffc

SHA512
9c5f1f2e49a6d8717e1dc7e5bdda39c578b6971c01c2381a8f05fb3a68e93acc4ba9c70fcb299e2a6710661f035324466451b34d175335f8c12578f164965e24

Download Submit
C:\Windows\System\gEPLHWJ.exe

Filesize
1.7MB

MD5
06b956ac3f81dfe33a6774cbfbe082df

SHA1
d87e5a98f332641ef7a8a2ff9d7b1582901b5090

SHA256
557fd00da67fd706b61da32ba692aa67c171363413b8e60c96b0a9317149e014

SHA512
fbd6d909b561386e0b0d5d106411984ac44f539dce4468a54e770efd1afed98a3c5615547fb97a10ce74e3809954482e7e1058e64895e018a04574b6df15953d

Download Submit
C:\Windows\System\glGayUa.exe

Filesize
1.7MB

MD5
ed8aefbd94eef34c05c4ea30eecd1621

SHA1
af55da9c26c8bec9f232735cdf3dcc1f1ba672b3

SHA256
4d30331f873abdf32d3d1ef855c500812a14e3a9287ea00b8cb66440b5b55c8b

SHA512
17da7c17373321a4c10697218133e039e12c84adb3c0d84aa06e2197d7e96ecc60ee7e0fd99997e359132554f0f7677d1944f983232639ccbaa984e4b8e707bd

Download Submit
C:\Windows\System\kqBpMCO.exe

Filesize
1.7MB

MD5
d9bb1f26d79a15e8becee5c712c711f3

SHA1
4138fcce5625eb182e3717062608bc8dccfadfd5

SHA256
6661147033b74754b00c63d21d600917fd114df39086a10940dbc348f8327b0e

SHA512
3beb6a208f585524e7875b21758494f49edce90f0a60289f09d3ef44093b689b42a48851e3584c25935ca0867b54f3aa29d33dade61a00752ed50809ce68a011

Download Submit
C:\Windows\System\lEaqhJt.exe

Filesize
1.7MB

MD5
3b5a06cda4a8d05f5b0b6af5812fb0fa

SHA1
3d6d808ec5780e75335dfcaabcfe96ff29e93130

SHA256
79ed1a6ef8b77a69b570b93ef866dd05996ecf3887e1dd099e8906eaa36ec503

SHA512
d4edd9e64be4d1918773a897328be858909c7e370fecb7d7a0a9503267356d1880442daf838d8a794c4be49de08306ba35a73c587fcc679023d9985c1e4a4ec8

Download Submit
C:\Windows\System\mwUzjav.exe

Filesize
1.7MB

MD5
b2d6115b13c3f55bfa7ecda3e48ab224

SHA1
254478954cf1ffb3ae33719b6b759454782ba8b2

SHA256
f8543b85fdbec105bf625b31863a6f4447e8dea62e38a8809611ae1295921a38

SHA512
3bac92ea289865a191c663d1769c996b4d804061a2bbc64397f15065ebc3d55bcccd8bcf565e6359e818ca2fe844f43e502bcd2335a36a68522c0325dc14f1c8

Download Submit
C:\Windows\System\nLeBzsQ.exe

Filesize
1.7MB

MD5
c5737336fb799f4131f9e2f37fa30611

SHA1
45aba5e098566c2165f396bcae7777a562bde251

SHA256
308dd821956a5899c180eb8ccfa7748d4ae591d19ac4e70b51e0179305cf1e2a

SHA512
a5695cd4bde8dde29d75911888e6adecfd4045714f2d77723f31dbfc51d0bab7d6a62b324c1e2c58da6e6a2c05b4b882f07a3b2a17bba87b5786b6d6993fe070

Download Submit
C:\Windows\System\nRNocKM.exe

Filesize
1.7MB

MD5
3fe5d46756fa2662da5da57a621a9cef

SHA1
ac04d15ba54cde717b706b30f4bb8f4aa5d03476

SHA256
2a908892ff0d08aadced15372c41e4ec55b1dea44ed44c313dfb22ec2f47d72a

SHA512
f9d2398ab9982cbe38dea9c0e28732d62484ad99d5f88b49256dfb30a807cc17945e3cd8a415ede487bec36c667faf655e53feb1f011d5413090e40ff2808a8a

Download Submit
C:\Windows\System\nXROwgq.exe

Filesize
1.7MB

MD5
d8c2b353d81cbb3a524cca304c2d6c5c

SHA1
cb4070b5ccb86db19c50a7ae89d559797db48efa

SHA256
af06d071dd2c47c7bd60504ecbdfbaf049d196bc5658df37e9efa1516b23f821

SHA512
078cec8af8880caa0e6346ba0e29d18ea908779e3a17c46902e50e0ef55e193091d7152afdafca06b9462fe3a73acc97986fd68863397fe31e7c77c073ac9e43

Download Submit
C:\Windows\System\ovDFqZD.exe

Filesize
1.7MB

MD5
e4607bb349fd9f8405a73a1523890521

SHA1
57e727f40384a4d46997f81fdf3a483e297d3a2c

SHA256
ea485d320fc07a0ad3b22bbec0219c75ec4fafc23258708317a28a213d9cc828

SHA512
4ab42024c3a92a66e35aaa371ba905ee68974f48f70400ad4d054d4763c2ffcc7f4270f7ae7f5a713c3f2734b61927f488a152ba377ed0957885d5fb5357c26d

Download Submit
C:\Windows\System\pdMTGbY.exe

Filesize
1.7MB

MD5
72ec1f62ba749330da34c4179dd99461

SHA1
c1407ad59fe7fd1b125851048944e87c84920898

SHA256
8203cb0a74679d78fe50715df75eb58e04e30115c5cf315c9dcadc88d8026075

SHA512
0cfffad34931a86a94fa080b060662adedde2dcfd3764dfe57e32e11593fa1422e5f7bfeff3c8f977d96f898b617fa565e0a20d08918be2967ebe23a237c4648

Download Submit
C:\Windows\System\sHZZMiG.exe

Filesize
1.7MB

MD5
c96c4a852f58f67b810c50270e4e84a1

SHA1
1ff1a0cd49a840aed8ed95f6e41e2777e743b613

SHA256
347f644ec34a9fff115b92db334c45f21cb28c2e4c4bb7f01320d0e5151de373

SHA512
57e6eae3e10566c4a77c1b97ca05c08ab198c54a29b99a269b64fa67f568a5d39d52ba41dedf860740aadeb501ef5c06ef8c1510ec918bfd1621a6eab69463dd

Download Submit
C:\Windows\System\sYDCRAk.exe

Filesize
1.7MB

MD5
6e7c79cb534dbd0a132d29d1da180966

SHA1
a346ecebd880356590d59876a214d3ba70571a27

SHA256
ee4657a84555fde1f498b4b4c3c37d368053f41a51759e438690ff7b56eb64e7

SHA512
8ed09d155339ceb029a5d5d59e9add10f95392f34973a5c49eab546233404ca8c8049b774a7095cbf9ce5ec1bc20cd2fb861d4f23774652c1a46fb111fcd8dad

Download Submit
C:\Windows\System\sbXTPAC.exe

Filesize
1.7MB

MD5
61da5d481fe7f063c1a31ccfe1aef3b9

SHA1
6abb903f3171a8aaa4c2b4f4755a2d3deff93bff

SHA256
d8c04724e6b60906ef08d8e3dc4e6ceb2a2c60d6e566e86f847ba41fd1f78c80

SHA512
be4a754dac511dba8335336805b3f88815b8ec4f2b59efffb2aa1c6455ee27735f80fb06b2982b5bc2654ab8c3cc7456e27343e0a055d196afacc1caaca878d0

Download Submit
C:\Windows\System\skNryex.exe

Filesize
1.7MB

MD5
1c2ffc2a4e2d8c6ed945f00a47361d6b

SHA1
2ba40ba6dec93093c874bebacf0e26a33f40ab36

SHA256
a63954b53a41d9992ef664c38a24740e9fd9d693116c037a7d22ab2723420364

SHA512
99fe0828586757f3a92993a16c4f07a263ef4b53d1c5a1db943ec97b86e78592aa9eb1808885fb573b06a425e1b57628a8dab629eda286727acb9d095a4bc4c9

Download Submit
C:\Windows\System\tsGudHr.exe

Filesize
1.7MB

MD5
d1bf176ac1c7d1946d8023aa069c20a1

SHA1
11ed85f60eb64d51f7d278420158ab04593f7bc1

SHA256
74a96d6b4e8a260006ed4fba3c03290740593c086a6bf6ba194f7f6d9ffdf3f5

SHA512
ab3a512876daf3ee7bb74d67b75c5317c31f87c32e6d0119ece87d063144315e8ce5015369757d7d6f57aeb1d8c545a901fcb80bb9cb50d2a821a3d349948997

Download Submit
C:\Windows\System\wsPzxck.exe

Filesize
1.7MB

MD5
c430d381a4a6d24a9ce112cdd9256f1a

SHA1
260a5aa26b53c1e3173ce4ec28034a8ad2afb9bd

SHA256
4264399265696370a90b5391f3c6bbe6489f4cffbe45da5fd72539fced3a082f

SHA512
f480d460f04c9d5035c555172983c12cee2efd75ce1591f6e0137a38780096d50a04b5ec8e72de71d234221db1832468774b3873039ad663619700673f835e17

Download Submit
C:\Windows\System\zelhbIV.exe

Filesize
1.7MB

MD5
8d1eb3d80564a430eeca312b686f98b1

SHA1
f1e2cad8b96f999efa443a7f96f71d674769eb84

SHA256
15e32e3b7af998b062c432675b833321bdb2b400c1f920cd2b7d94c4b0ca807d

SHA512
24450c919992621278646b8c77ea2d41b437c13edfd738ca54cd49c5d803c68636ef98fe2a19e96f442e9aae15b25d6052e01d65e9b46cedf29e16cbf2bc27d5

Download Submit
memory/216-2267-0x00007FF684BC0000-0x00007FF684F11000-memory.dmp

Filesize
3.3MB

Download
memory/216-220-0x00007FF684BC0000-0x00007FF684F11000-memory.dmp

Filesize
3.3MB

Download
memory/404-212-0x00007FF759BB0000-0x00007FF759F01000-memory.dmp

Filesize
3.3MB

Download
memory/404-2290-0x00007FF759BB0000-0x00007FF759F01000-memory.dmp

Filesize
3.3MB

Download
memory/560-2425-0x00007FF6D1180000-0x00007FF6D14D1000-memory.dmp

Filesize
3.3MB

Download
memory/560-2396-0x00007FF6D1180000-0x00007FF6D14D1000-memory.dmp

Filesize
3.3MB

Download
memory/560-225-0x00007FF6D1180000-0x00007FF6D14D1000-memory.dmp

Filesize
3.3MB

Download
memory/632-54-0x00007FF683020000-0x00007FF683371000-memory.dmp

Filesize
3.3MB

Download
memory/632-2283-0x00007FF683020000-0x00007FF683371000-memory.dmp

Filesize
3.3MB

Download
memory/640-223-0x00007FF65AA90000-0x00007FF65ADE1000-memory.dmp

Filesize
3.3MB

Download
memory/640-2299-0x00007FF65AA90000-0x00007FF65ADE1000-memory.dmp

Filesize
3.3MB

Download
memory/936-2166-0x00007FF607AB0000-0x00007FF607E01000-memory.dmp

Filesize
3.3MB

Download
memory/936-0-0x00007FF607AB0000-0x00007FF607E01000-memory.dmp

Filesize
3.3MB

Download
memory/936-1-0x0000023F01730000-0x0000023F01740000-memory.dmp

Filesize
64KB

Download
memory/980-2288-0x00007FF60CD80000-0x00007FF60D0D1000-memory.dmp

Filesize
3.3MB

Download
memory/980-81-0x00007FF60CD80000-0x00007FF60D0D1000-memory.dmp

Filesize
3.3MB

Download
memory/1220-213-0x00007FF6DDBA0000-0x00007FF6DDEF1000-memory.dmp

Filesize
3.3MB

Download
memory/1220-2430-0x00007FF6DDBA0000-0x00007FF6DDEF1000-memory.dmp

Filesize
3.3MB

Download
memory/1220-2389-0x00007FF6DDBA0000-0x00007FF6DDEF1000-memory.dmp

Filesize
3.3MB

Download
memory/1524-215-0x00007FF63CBB0000-0x00007FF63CF01000-memory.dmp

Filesize
3.3MB

Download
memory/1524-2391-0x00007FF63CBB0000-0x00007FF63CF01000-memory.dmp

Filesize
3.3MB

Download
memory/1524-2447-0x00007FF63CBB0000-0x00007FF63CF01000-memory.dmp

Filesize
3.3MB

Download
memory/1960-217-0x00007FF7401C0000-0x00007FF740511000-memory.dmp

Filesize
3.3MB

Download
memory/1960-2458-0x00007FF7401C0000-0x00007FF740511000-memory.dmp

Filesize
3.3MB

Download
memory/1960-2393-0x00007FF7401C0000-0x00007FF740511000-memory.dmp

Filesize
3.3MB

Download
memory/2368-181-0x00007FF680F90000-0x00007FF6812E1000-memory.dmp

Filesize
3.3MB

Download
memory/2368-2271-0x00007FF680F90000-0x00007FF6812E1000-memory.dmp

Filesize
3.3MB

Download
memory/2416-2449-0x00007FF6F4B50000-0x00007FF6F4EA1000-memory.dmp

Filesize
3.3MB

Download
memory/2416-2394-0x00007FF6F4B50000-0x00007FF6F4EA1000-memory.dmp

Filesize
3.3MB

Download
memory/2416-219-0x00007FF6F4B50000-0x00007FF6F4EA1000-memory.dmp

Filesize
3.3MB

Download
memory/2496-2395-0x00007FF6056D0000-0x00007FF605A21000-memory.dmp

Filesize
3.3MB

Download
memory/2496-2421-0x00007FF6056D0000-0x00007FF605A21000-memory.dmp

Filesize
3.3MB

Download
memory/2496-224-0x00007FF6056D0000-0x00007FF605A21000-memory.dmp

Filesize
3.3MB

Download
memory/2640-207-0x00007FF776CD0000-0x00007FF777021000-memory.dmp

Filesize
3.3MB

Download
memory/2640-2282-0x00007FF776CD0000-0x00007FF777021000-memory.dmp

Filesize
3.3MB

Download
memory/2716-222-0x00007FF7ECD70000-0x00007FF7ED0C1000-memory.dmp

Filesize
3.3MB

Download
memory/2716-2296-0x00007FF7ECD70000-0x00007FF7ED0C1000-memory.dmp

Filesize
3.3MB

Download
memory/2956-34-0x00007FF702640000-0x00007FF702991000-memory.dmp

Filesize
3.3MB

Download
memory/2956-2274-0x00007FF702640000-0x00007FF702991000-memory.dmp

Filesize
3.3MB

Download
memory/3296-218-0x00007FF63AF20000-0x00007FF63B271000-memory.dmp

Filesize
3.3MB

Download
memory/3296-2292-0x00007FF63AF20000-0x00007FF63B271000-memory.dmp

Filesize
3.3MB

Download
memory/3620-208-0x00007FF711E00000-0x00007FF712151000-memory.dmp

Filesize
3.3MB

Download
memory/3620-2399-0x00007FF711E00000-0x00007FF712151000-memory.dmp

Filesize
3.3MB

Download
memory/3620-2386-0x00007FF711E00000-0x00007FF712151000-memory.dmp

Filesize
3.3MB

Download
memory/3916-38-0x00007FF6858B0000-0x00007FF685C01000-memory.dmp

Filesize
3.3MB

Download
memory/3916-2275-0x00007FF6858B0000-0x00007FF685C01000-memory.dmp

Filesize
3.3MB

Download
memory/4120-2280-0x00007FF6639E0000-0x00007FF663D31000-memory.dmp

Filesize
3.3MB

Download
memory/4120-206-0x00007FF6639E0000-0x00007FF663D31000-memory.dmp

Filesize
3.3MB

Download
memory/4136-2400-0x00007FF61D290000-0x00007FF61D5E1000-memory.dmp

Filesize
3.3MB

Download
memory/4136-2387-0x00007FF61D290000-0x00007FF61D5E1000-memory.dmp

Filesize
3.3MB

Download
memory/4136-210-0x00007FF61D290000-0x00007FF61D5E1000-memory.dmp

Filesize
3.3MB

Download
memory/4220-2294-0x00007FF6C67A0000-0x00007FF6C6AF1000-memory.dmp

Filesize
3.3MB

Download
memory/4220-209-0x00007FF6C67A0000-0x00007FF6C6AF1000-memory.dmp

Filesize
3.3MB

Download
memory/4388-21-0x00007FF62D050000-0x00007FF62D3A1000-memory.dmp

Filesize
3.3MB

Download
memory/4388-2265-0x00007FF62D050000-0x00007FF62D3A1000-memory.dmp

Filesize
3.3MB

Download
memory/4456-2418-0x00007FF658EC0000-0x00007FF659211000-memory.dmp

Filesize
3.3MB

Download
memory/4456-211-0x00007FF658EC0000-0x00007FF659211000-memory.dmp

Filesize
3.3MB

Download
memory/4456-2388-0x00007FF658EC0000-0x00007FF659211000-memory.dmp

Filesize
3.3MB

Download
memory/4720-221-0x00007FF6F0A50000-0x00007FF6F0DA1000-memory.dmp

Filesize
3.3MB

Download
memory/4720-2270-0x00007FF6F0A50000-0x00007FF6F0DA1000-memory.dmp

Filesize
3.3MB

Download
memory/4744-2286-0x00007FF680B30000-0x00007FF680E81000-memory.dmp

Filesize
3.3MB

Download
memory/4744-205-0x00007FF680B30000-0x00007FF680E81000-memory.dmp

Filesize
3.3MB

Download
memory/4800-214-0x00007FF7BDCB0000-0x00007FF7BE001000-memory.dmp

Filesize
3.3MB

Download
memory/4800-2390-0x00007FF7BDCB0000-0x00007FF7BE001000-memory.dmp

Filesize
3.3MB

Download
memory/4800-2429-0x00007FF7BDCB0000-0x00007FF7BE001000-memory.dmp

Filesize
3.3MB

Download
memory/4832-2414-0x00007FF711B50000-0x00007FF711EA1000-memory.dmp

Filesize
3.3MB

Download
memory/4832-2392-0x00007FF711B50000-0x00007FF711EA1000-memory.dmp

Filesize
3.3MB

Download
memory/4832-216-0x00007FF711B50000-0x00007FF711EA1000-memory.dmp

Filesize
3.3MB

Download
memory/4844-124-0x00007FF6B9890000-0x00007FF6B9BE1000-memory.dmp

Filesize
3.3MB

Download
memory/4844-2297-0x00007FF6B9890000-0x00007FF6B9BE1000-memory.dmp

Filesize
3.3MB

Download
memory/5008-2277-0x00007FF65E360000-0x00007FF65E6B1000-memory.dmp

Filesize
3.3MB

Download
memory/5008-61-0x00007FF65E360000-0x00007FF65E6B1000-memory.dmp

Filesize
3.3MB

Download