xmrig | e391038b70715535d2f2a1f0de3b8dec11f92597c26b0f8d0c44bf2ae1754e2d

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
Size

1.3MB
MD5

2c95636993042efbbb87115fd49c8930
SHA1

c22cd1c656d6ccd2a99bcf30213a26c6fe9a1f35
SHA256

e391038b70715535d2f2a1f0de3b8dec11f92597c26b0f8d0c44bf2ae1754e2d
SHA512

c748e279fb63eefcf9cf8c54400fdbb649620c578f6e15cb2524647ef73fa06e4a3d11898c407c28937e05d8fc0bbb9a1941f4594453928a58fadc819f425db6
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pY4p9XvOjeUlV/oPVHsv4Tub:ROdWCCi7/rahoyS6SHbA

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral2/memory/756-655-0x00007FF6A8680000-0x00007FF6A89D1000-memory.dmp	xmrig
behavioral2/memory/4568-883-0x00007FF6B4E90000-0x00007FF6B51E1000-memory.dmp	xmrig
behavioral2/memory/4004-925-0x00007FF6CBF50000-0x00007FF6CC2A1000-memory.dmp	xmrig
behavioral2/memory/1312-929-0x00007FF710550000-0x00007FF7108A1000-memory.dmp	xmrig
behavioral2/memory/4420-931-0x00007FF623890000-0x00007FF623BE1000-memory.dmp	xmrig
behavioral2/memory/2120-930-0x00007FF623ED0000-0x00007FF624221000-memory.dmp	xmrig
behavioral2/memory/1800-928-0x00007FF69C060000-0x00007FF69C3B1000-memory.dmp	xmrig
behavioral2/memory/4468-927-0x00007FF6B3F40000-0x00007FF6B4291000-memory.dmp	xmrig
behavioral2/memory/2804-926-0x00007FF6DCED0000-0x00007FF6DD221000-memory.dmp	xmrig
behavioral2/memory/4536-924-0x00007FF6B8230000-0x00007FF6B8581000-memory.dmp	xmrig
behavioral2/memory/4744-923-0x00007FF615910000-0x00007FF615C61000-memory.dmp	xmrig
behavioral2/memory/3208-922-0x00007FF6CD080000-0x00007FF6CD3D1000-memory.dmp	xmrig
behavioral2/memory/3652-921-0x00007FF62C230000-0x00007FF62C581000-memory.dmp	xmrig
behavioral2/memory/3028-920-0x00007FF60AE40000-0x00007FF60B191000-memory.dmp	xmrig
behavioral2/memory/2148-650-0x00007FF6A68C0000-0x00007FF6A6C11000-memory.dmp	xmrig
behavioral2/memory/4016-501-0x00007FF620010000-0x00007FF620361000-memory.dmp	xmrig
behavioral2/memory/2528-499-0x00007FF74F590000-0x00007FF74F8E1000-memory.dmp	xmrig
behavioral2/memory/3940-379-0x00007FF63AE20000-0x00007FF63B171000-memory.dmp	xmrig
behavioral2/memory/1248-376-0x00007FF70A370000-0x00007FF70A6C1000-memory.dmp	xmrig
behavioral2/memory/3284-270-0x00007FF681D20000-0x00007FF682071000-memory.dmp	xmrig
behavioral2/memory/1020-279-0x00007FF6DFEC0000-0x00007FF6E0211000-memory.dmp	xmrig
behavioral2/memory/4460-135-0x00007FF688890000-0x00007FF688BE1000-memory.dmp	xmrig
behavioral2/memory/2720-145-0x00007FF702F80000-0x00007FF7032D1000-memory.dmp	xmrig
behavioral2/memory/3824-23-0x00007FF6CACA0000-0x00007FF6CAFF1000-memory.dmp	xmrig
behavioral2/memory/4416-18-0x00007FF717190000-0x00007FF7174E1000-memory.dmp	xmrig
behavioral2/memory/3216-2092-0x00007FF6E8130000-0x00007FF6E8481000-memory.dmp	xmrig
behavioral2/memory/3824-2190-0x00007FF6CACA0000-0x00007FF6CAFF1000-memory.dmp	xmrig
behavioral2/memory/3696-2191-0x00007FF68B840000-0x00007FF68BB91000-memory.dmp	xmrig
behavioral2/memory/4888-2192-0x00007FF753360000-0x00007FF7536B1000-memory.dmp	xmrig
behavioral2/memory/2116-2193-0x00007FF7EC160000-0x00007FF7EC4B1000-memory.dmp	xmrig
behavioral2/memory/1156-2194-0x00007FF70BEE0000-0x00007FF70C231000-memory.dmp	xmrig
behavioral2/memory/4416-2196-0x00007FF717190000-0x00007FF7174E1000-memory.dmp	xmrig
behavioral2/memory/3824-2198-0x00007FF6CACA0000-0x00007FF6CAFF1000-memory.dmp	xmrig
behavioral2/memory/1312-2200-0x00007FF710550000-0x00007FF7108A1000-memory.dmp	xmrig
behavioral2/memory/3696-2202-0x00007FF68B840000-0x00007FF68BB91000-memory.dmp	xmrig
behavioral2/memory/4460-2204-0x00007FF688890000-0x00007FF688BE1000-memory.dmp	xmrig
behavioral2/memory/4888-2206-0x00007FF753360000-0x00007FF7536B1000-memory.dmp	xmrig
behavioral2/memory/2720-2209-0x00007FF702F80000-0x00007FF7032D1000-memory.dmp	xmrig
behavioral2/memory/1020-2219-0x00007FF6DFEC0000-0x00007FF6E0211000-memory.dmp	xmrig
behavioral2/memory/2120-2215-0x00007FF623ED0000-0x00007FF624221000-memory.dmp	xmrig
behavioral2/memory/4420-2213-0x00007FF623890000-0x00007FF623BE1000-memory.dmp	xmrig
behavioral2/memory/1248-2211-0x00007FF70A370000-0x00007FF70A6C1000-memory.dmp	xmrig
behavioral2/memory/2116-2217-0x00007FF7EC160000-0x00007FF7EC4B1000-memory.dmp	xmrig
behavioral2/memory/756-2236-0x00007FF6A8680000-0x00007FF6A89D1000-memory.dmp	xmrig
behavioral2/memory/4536-2240-0x00007FF6B8230000-0x00007FF6B8581000-memory.dmp	xmrig
behavioral2/memory/3028-2248-0x00007FF60AE40000-0x00007FF60B191000-memory.dmp	xmrig
behavioral2/memory/4744-2252-0x00007FF615910000-0x00007FF615C61000-memory.dmp	xmrig
behavioral2/memory/4016-2250-0x00007FF620010000-0x00007FF620361000-memory.dmp	xmrig
behavioral2/memory/4568-2246-0x00007FF6B4E90000-0x00007FF6B51E1000-memory.dmp	xmrig
behavioral2/memory/3208-2244-0x00007FF6CD080000-0x00007FF6CD3D1000-memory.dmp	xmrig
behavioral2/memory/4004-2243-0x00007FF6CBF50000-0x00007FF6CC2A1000-memory.dmp	xmrig
behavioral2/memory/4468-2241-0x00007FF6B3F40000-0x00007FF6B4291000-memory.dmp	xmrig
behavioral2/memory/3284-2237-0x00007FF681D20000-0x00007FF682071000-memory.dmp	xmrig
behavioral2/memory/2528-2233-0x00007FF74F590000-0x00007FF74F8E1000-memory.dmp	xmrig
behavioral2/memory/1156-2229-0x00007FF70BEE0000-0x00007FF70C231000-memory.dmp	xmrig
behavioral2/memory/3940-2232-0x00007FF63AE20000-0x00007FF63B171000-memory.dmp	xmrig
behavioral2/memory/3652-2254-0x00007FF62C230000-0x00007FF62C581000-memory.dmp	xmrig
behavioral2/memory/2148-2257-0x00007FF6A68C0000-0x00007FF6A6C11000-memory.dmp	xmrig
behavioral2/memory/1800-2311-0x00007FF69C060000-0x00007FF69C3B1000-memory.dmp	xmrig
behavioral2/memory/2804-2281-0x00007FF6DCED0000-0x00007FF6DD221000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4416	nzFXCvg.exe
3824	ILHDaxf.exe
3696	ZqAFoDI.exe
1312	ZEjoxVm.exe
2116	rtpKZMn.exe
4888	nbnJojf.exe
4460	nPYHTez.exe
2120	bbaJlUv.exe
2720	pyVVwjU.exe
1156	FWbCzUA.exe
3284	xvRXrBX.exe
1020	GCTAlWW.exe
1248	KOhAGFG.exe
3940	sCvERVz.exe
2528	xCyAWqK.exe
4016	VSyNtnx.exe
2148	bzgGhrJ.exe
4420	HeMHEDT.exe
756	sPwktJF.exe
4568	diZFIec.exe
3028	JZafTeF.exe
3652	NBoNMMJ.exe
3208	AQHeLFD.exe
4744	WvShCAz.exe
4536	WjQWAuQ.exe
4004	ZQYRqRM.exe
2804	htPjmqM.exe
4468	SJcCdEu.exe
1800	bcfoViz.exe
3540	kRrpnMV.exe
1732	yolEQzz.exe
4648	ykuVJDm.exe
3836	hyxdVlI.exe
4088	fqQNggS.exe
3384	QIbhmjm.exe
1260	dWVJPTU.exe
3212	mGiRJzo.exe
4636	aXGBUdA.exe
3916	ctXerXx.exe
872	lstBguC.exe
1944	LbUnfSE.exe
4080	bhmYMoF.exe
2016	zPvpisp.exe
3180	RMBdQqU.exe
468	vnfcKEn.exe
3256	scpdCBx.exe
1676	lIUrzxB.exe
5088	tRhgGYh.exe
4404	FCkBCuR.exe
3396	VBlRQnS.exe
1516	TljlbXI.exe
4972	CsngXIs.exe
2384	bYQtpIb.exe
3768	IzWiZiW.exe
3744	HwYLQyA.exe
4288	VVvpZHh.exe
3760	jLAvNlE.exe
540	rrFVOpi.exe
4084	aGpmdVx.exe
2976	xlsurMp.exe
2556	cMqztnz.exe
1168	GGvUCMR.exe
2472	oUsFpOZ.exe
1476	DXUzTGP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3216-0-0x00007FF6E8130000-0x00007FF6E8481000-memory.dmp	upx
behavioral2/files/0x0005000000022f40-7.dat	upx
behavioral2/files/0x0007000000023417-19.dat	upx
behavioral2/files/0x000700000002341b-31.dat	upx
behavioral2/files/0x000700000002342a-115.dat	upx
behavioral2/files/0x0007000000023437-164.dat	upx
behavioral2/memory/756-655-0x00007FF6A8680000-0x00007FF6A89D1000-memory.dmp	upx
behavioral2/memory/4568-883-0x00007FF6B4E90000-0x00007FF6B51E1000-memory.dmp	upx
behavioral2/memory/4004-925-0x00007FF6CBF50000-0x00007FF6CC2A1000-memory.dmp	upx
behavioral2/memory/1312-929-0x00007FF710550000-0x00007FF7108A1000-memory.dmp	upx
behavioral2/memory/4420-931-0x00007FF623890000-0x00007FF623BE1000-memory.dmp	upx
behavioral2/memory/2120-930-0x00007FF623ED0000-0x00007FF624221000-memory.dmp	upx
behavioral2/memory/1800-928-0x00007FF69C060000-0x00007FF69C3B1000-memory.dmp	upx
behavioral2/memory/4468-927-0x00007FF6B3F40000-0x00007FF6B4291000-memory.dmp	upx
behavioral2/memory/2804-926-0x00007FF6DCED0000-0x00007FF6DD221000-memory.dmp	upx
behavioral2/memory/4536-924-0x00007FF6B8230000-0x00007FF6B8581000-memory.dmp	upx
behavioral2/memory/4744-923-0x00007FF615910000-0x00007FF615C61000-memory.dmp	upx
behavioral2/memory/3208-922-0x00007FF6CD080000-0x00007FF6CD3D1000-memory.dmp	upx
behavioral2/memory/3652-921-0x00007FF62C230000-0x00007FF62C581000-memory.dmp	upx
behavioral2/memory/3028-920-0x00007FF60AE40000-0x00007FF60B191000-memory.dmp	upx
behavioral2/memory/2148-650-0x00007FF6A68C0000-0x00007FF6A6C11000-memory.dmp	upx
behavioral2/memory/4016-501-0x00007FF620010000-0x00007FF620361000-memory.dmp	upx
behavioral2/memory/2528-499-0x00007FF74F590000-0x00007FF74F8E1000-memory.dmp	upx
behavioral2/memory/3940-379-0x00007FF63AE20000-0x00007FF63B171000-memory.dmp	upx
behavioral2/memory/1248-376-0x00007FF70A370000-0x00007FF70A6C1000-memory.dmp	upx
behavioral2/memory/3284-270-0x00007FF681D20000-0x00007FF682071000-memory.dmp	upx
behavioral2/memory/1020-279-0x00007FF6DFEC0000-0x00007FF6E0211000-memory.dmp	upx
behavioral2/files/0x0007000000023440-210.dat	upx
behavioral2/memory/1156-207-0x00007FF70BEE0000-0x00007FF70C231000-memory.dmp	upx
behavioral2/files/0x000700000002343f-206.dat	upx
behavioral2/files/0x000700000002343e-199.dat	upx
behavioral2/files/0x000700000002343d-198.dat	upx
behavioral2/files/0x000700000002343c-195.dat	upx
behavioral2/files/0x000700000002343b-187.dat	upx
behavioral2/files/0x0007000000023432-186.dat	upx
behavioral2/files/0x0007000000023430-182.dat	upx
behavioral2/files/0x0007000000023426-176.dat	upx
behavioral2/files/0x0007000000023439-175.dat	upx
behavioral2/files/0x0007000000023438-168.dat	upx
behavioral2/files/0x0007000000023423-160.dat	upx
behavioral2/files/0x0007000000023429-214.dat	upx
behavioral2/files/0x0007000000023435-154.dat	upx
behavioral2/files/0x0007000000023421-149.dat	upx
behavioral2/files/0x0007000000023428-139.dat	upx
behavioral2/memory/4460-135-0x00007FF688890000-0x00007FF688BE1000-memory.dmp	upx
behavioral2/files/0x0007000000023433-134.dat	upx
behavioral2/files/0x0007000000023431-133.dat	upx
behavioral2/files/0x000700000002341f-185.dat	upx
behavioral2/files/0x000700000002342f-128.dat	upx
behavioral2/files/0x0007000000023427-126.dat	upx
behavioral2/files/0x000700000002341d-121.dat	upx
behavioral2/files/0x000700000002342e-120.dat	upx
behavioral2/files/0x000700000002342d-119.dat	upx
behavioral2/files/0x000700000002342c-117.dat	upx
behavioral2/files/0x0007000000023424-167.dat	upx
behavioral2/files/0x0007000000023422-110.dat	upx
behavioral2/files/0x0007000000023436-158.dat	upx
behavioral2/files/0x0007000000023420-103.dat	upx
behavioral2/files/0x0007000000023434-148.dat	upx
behavioral2/memory/2720-145-0x00007FF702F80000-0x00007FF7032D1000-memory.dmp	upx
behavioral2/files/0x000700000002341c-138.dat	upx
behavioral2/memory/4888-93-0x00007FF753360000-0x00007FF7536B1000-memory.dmp	upx
behavioral2/files/0x000700000002341a-84.dat	upx
behavioral2/files/0x0007000000023419-81.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dsHRtaT.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\IjmcQVq.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\QbEOeOB.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\nzFXCvg.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\tjAkyfW.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\HjPDNrC.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\TVImFdY.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\qDzYDDT.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\MsBYpwE.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\TUQxmtA.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\ATfVXet.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\OlBzWvU.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\FlUYilp.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\DSIbMPD.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\FWWJXxp.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\tejDzRP.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\ZGmuJkd.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\TAmyqkY.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\nDegZTJ.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\SLRsDXO.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\WUIpHbV.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\cozSnkx.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\ttfJtko.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\mGiRJzo.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\rSbySDi.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\qaKfKyy.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\nMxyyoZ.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\ciahTEc.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\VaauKiK.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\rrFVOpi.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\tzdUxVj.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\huByPEH.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\pbnKyrW.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\MZoFqOo.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\LhExifW.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\cmAwSdN.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\FomWzOr.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\FCkBCuR.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\goEfUNu.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\Wrgpfhr.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\mhZBdwM.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\mDQxZEg.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\ZqAFoDI.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\ogxnAEM.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\UZlpKCr.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\BowQijp.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\sxnmMGC.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\euQaBFP.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\MLgbSuv.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\ibxFsEy.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\ymrZWDJ.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\VQvMpTf.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\nZNSKWY.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\JazsqiT.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\CPrBtbt.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\cWJcyFj.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\WrFYRPM.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\GCanrxZ.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\ilVincn.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\jIVXJhv.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\gZoxYti.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\oTktFhI.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\aVSERls.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
File created	C:\Windows\System\wkFyaqi.exe	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4416	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	85
PID 3216 wrote to memory of 4416	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	85
PID 3216 wrote to memory of 3824	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	86
PID 3216 wrote to memory of 3824	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	86
PID 3216 wrote to memory of 3696	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	87
PID 3216 wrote to memory of 3696	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	87
PID 3216 wrote to memory of 1312	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	88
PID 3216 wrote to memory of 1312	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	88
PID 3216 wrote to memory of 2116	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	89
PID 3216 wrote to memory of 2116	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	89
PID 3216 wrote to memory of 4888	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	90
PID 3216 wrote to memory of 4888	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	90
PID 3216 wrote to memory of 4460	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	91
PID 3216 wrote to memory of 4460	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	91
PID 3216 wrote to memory of 3284	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	92
PID 3216 wrote to memory of 3284	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	92
PID 3216 wrote to memory of 2120	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	93
PID 3216 wrote to memory of 2120	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	93
PID 3216 wrote to memory of 2720	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	94
PID 3216 wrote to memory of 2720	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	94
PID 3216 wrote to memory of 1156	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	95
PID 3216 wrote to memory of 1156	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	95
PID 3216 wrote to memory of 1020	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	96
PID 3216 wrote to memory of 1020	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	96
PID 3216 wrote to memory of 1248	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	97
PID 3216 wrote to memory of 1248	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	97
PID 3216 wrote to memory of 3940	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	98
PID 3216 wrote to memory of 3940	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	98
PID 3216 wrote to memory of 2528	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	99
PID 3216 wrote to memory of 2528	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	99
PID 3216 wrote to memory of 4016	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	100
PID 3216 wrote to memory of 4016	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	100
PID 3216 wrote to memory of 2148	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	101
PID 3216 wrote to memory of 2148	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	101
PID 3216 wrote to memory of 4536	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	102
PID 3216 wrote to memory of 4536	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	102
PID 3216 wrote to memory of 4004	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	103
PID 3216 wrote to memory of 4004	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	103
PID 3216 wrote to memory of 4420	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	104
PID 3216 wrote to memory of 4420	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	104
PID 3216 wrote to memory of 756	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	105
PID 3216 wrote to memory of 756	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	105
PID 3216 wrote to memory of 4568	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	106
PID 3216 wrote to memory of 4568	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	106
PID 3216 wrote to memory of 3028	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	107
PID 3216 wrote to memory of 3028	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	107
PID 3216 wrote to memory of 3652	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	108
PID 3216 wrote to memory of 3652	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	108
PID 3216 wrote to memory of 3208	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	109
PID 3216 wrote to memory of 3208	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	109
PID 3216 wrote to memory of 4744	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	110
PID 3216 wrote to memory of 4744	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	110
PID 3216 wrote to memory of 2804	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	111
PID 3216 wrote to memory of 2804	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	111
PID 3216 wrote to memory of 4468	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	112
PID 3216 wrote to memory of 4468	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	112
PID 3216 wrote to memory of 1800	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	113
PID 3216 wrote to memory of 1800	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	113
PID 3216 wrote to memory of 3212	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	114
PID 3216 wrote to memory of 3212	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	114
PID 3216 wrote to memory of 3540	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	115
PID 3216 wrote to memory of 3540	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	115
PID 3216 wrote to memory of 1732	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	116
PID 3216 wrote to memory of 1732	3216	2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2c95636993042efbbb87115fd49c8930_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\System\nzFXCvg.exe
  C:\Windows\System\nzFXCvg.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\ILHDaxf.exe
  C:\Windows\System\ILHDaxf.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\ZqAFoDI.exe
  C:\Windows\System\ZqAFoDI.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\ZEjoxVm.exe
  C:\Windows\System\ZEjoxVm.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\rtpKZMn.exe
  C:\Windows\System\rtpKZMn.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\nbnJojf.exe
  C:\Windows\System\nbnJojf.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\nPYHTez.exe
  C:\Windows\System\nPYHTez.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\xvRXrBX.exe
  C:\Windows\System\xvRXrBX.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\bbaJlUv.exe
  C:\Windows\System\bbaJlUv.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\pyVVwjU.exe
  C:\Windows\System\pyVVwjU.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\FWbCzUA.exe
  C:\Windows\System\FWbCzUA.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\GCTAlWW.exe
  C:\Windows\System\GCTAlWW.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\KOhAGFG.exe
  C:\Windows\System\KOhAGFG.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\sCvERVz.exe
  C:\Windows\System\sCvERVz.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\xCyAWqK.exe
  C:\Windows\System\xCyAWqK.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\VSyNtnx.exe
  C:\Windows\System\VSyNtnx.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\bzgGhrJ.exe
  C:\Windows\System\bzgGhrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\WjQWAuQ.exe
  C:\Windows\System\WjQWAuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\ZQYRqRM.exe
  C:\Windows\System\ZQYRqRM.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\HeMHEDT.exe
  C:\Windows\System\HeMHEDT.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\sPwktJF.exe
  C:\Windows\System\sPwktJF.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\diZFIec.exe
  C:\Windows\System\diZFIec.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\JZafTeF.exe
  C:\Windows\System\JZafTeF.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\NBoNMMJ.exe
  C:\Windows\System\NBoNMMJ.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\AQHeLFD.exe
  C:\Windows\System\AQHeLFD.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\WvShCAz.exe
  C:\Windows\System\WvShCAz.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\htPjmqM.exe
  C:\Windows\System\htPjmqM.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\SJcCdEu.exe
  C:\Windows\System\SJcCdEu.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\bcfoViz.exe
  C:\Windows\System\bcfoViz.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\mGiRJzo.exe
  C:\Windows\System\mGiRJzo.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\kRrpnMV.exe
  C:\Windows\System\kRrpnMV.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\yolEQzz.exe
  C:\Windows\System\yolEQzz.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\ykuVJDm.exe
  C:\Windows\System\ykuVJDm.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\hyxdVlI.exe
  C:\Windows\System\hyxdVlI.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\fqQNggS.exe
  C:\Windows\System\fqQNggS.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\QIbhmjm.exe
  C:\Windows\System\QIbhmjm.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\dWVJPTU.exe
  C:\Windows\System\dWVJPTU.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\CsngXIs.exe
  C:\Windows\System\CsngXIs.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\aXGBUdA.exe
  C:\Windows\System\aXGBUdA.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\ctXerXx.exe
  C:\Windows\System\ctXerXx.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\lstBguC.exe
  C:\Windows\System\lstBguC.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\LbUnfSE.exe
  C:\Windows\System\LbUnfSE.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\bhmYMoF.exe
  C:\Windows\System\bhmYMoF.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\zPvpisp.exe
  C:\Windows\System\zPvpisp.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\RMBdQqU.exe
  C:\Windows\System\RMBdQqU.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\vnfcKEn.exe
  C:\Windows\System\vnfcKEn.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\scpdCBx.exe
  C:\Windows\System\scpdCBx.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\lIUrzxB.exe
  C:\Windows\System\lIUrzxB.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\tRhgGYh.exe
  C:\Windows\System\tRhgGYh.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\FCkBCuR.exe
  C:\Windows\System\FCkBCuR.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\iOkfyHb.exe
  C:\Windows\System\iOkfyHb.exe
  2⤵
  PID:2208
- C:\Windows\System\VBlRQnS.exe
  C:\Windows\System\VBlRQnS.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\TljlbXI.exe
  C:\Windows\System\TljlbXI.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\bYQtpIb.exe
  C:\Windows\System\bYQtpIb.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\IzWiZiW.exe
  C:\Windows\System\IzWiZiW.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\HwYLQyA.exe
  C:\Windows\System\HwYLQyA.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\VVvpZHh.exe
  C:\Windows\System\VVvpZHh.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\jLAvNlE.exe
  C:\Windows\System\jLAvNlE.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\rrFVOpi.exe
  C:\Windows\System\rrFVOpi.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\aGpmdVx.exe
  C:\Windows\System\aGpmdVx.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\tAIefCp.exe
  C:\Windows\System\tAIefCp.exe
  2⤵
  PID:2104
- C:\Windows\System\xlsurMp.exe
  C:\Windows\System\xlsurMp.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\cMqztnz.exe
  C:\Windows\System\cMqztnz.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\GGvUCMR.exe
  C:\Windows\System\GGvUCMR.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\oUsFpOZ.exe
  C:\Windows\System\oUsFpOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\DXUzTGP.exe
  C:\Windows\System\DXUzTGP.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\rldlTOR.exe
  C:\Windows\System\rldlTOR.exe
  2⤵
  PID:1148
- C:\Windows\System\MgQAUxk.exe
  C:\Windows\System\MgQAUxk.exe
  2⤵
  PID:636
- C:\Windows\System\lhxtmvN.exe
  C:\Windows\System\lhxtmvN.exe
  2⤵
  PID:3252
- C:\Windows\System\jwoajRr.exe
  C:\Windows\System\jwoajRr.exe
  2⤵
  PID:4424
- C:\Windows\System\ECUUCFc.exe
  C:\Windows\System\ECUUCFc.exe
  2⤵
  PID:4824
- C:\Windows\System\TnAQcMn.exe
  C:\Windows\System\TnAQcMn.exe
  2⤵
  PID:2784
- C:\Windows\System\KaKrCsP.exe
  C:\Windows\System\KaKrCsP.exe
  2⤵
  PID:5048
- C:\Windows\System\jkeCfeG.exe
  C:\Windows\System\jkeCfeG.exe
  2⤵
  PID:3240
- C:\Windows\System\KWeWOco.exe
  C:\Windows\System\KWeWOco.exe
  2⤵
  PID:1172
- C:\Windows\System\oDTSrzp.exe
  C:\Windows\System\oDTSrzp.exe
  2⤵
  PID:2448
- C:\Windows\System\zxRSJbr.exe
  C:\Windows\System\zxRSJbr.exe
  2⤵
  PID:4968
- C:\Windows\System\toYnZHS.exe
  C:\Windows\System\toYnZHS.exe
  2⤵
  PID:4436
- C:\Windows\System\SwKjNMM.exe
  C:\Windows\System\SwKjNMM.exe
  2⤵
  PID:1816
- C:\Windows\System\lFNoFxL.exe
  C:\Windows\System\lFNoFxL.exe
  2⤵
  PID:4884
- C:\Windows\System\qlprLeI.exe
  C:\Windows\System\qlprLeI.exe
  2⤵
  PID:856
- C:\Windows\System\lWXDgKK.exe
  C:\Windows\System\lWXDgKK.exe
  2⤵
  PID:620
- C:\Windows\System\gxKguwV.exe
  C:\Windows\System\gxKguwV.exe
  2⤵
  PID:2184
- C:\Windows\System\qNBYQct.exe
  C:\Windows\System\qNBYQct.exe
  2⤵
  PID:4828
- C:\Windows\System\kZRccUF.exe
  C:\Windows\System\kZRccUF.exe
  2⤵
  PID:3372
- C:\Windows\System\rkDViDK.exe
  C:\Windows\System\rkDViDK.exe
  2⤵
  PID:4324
- C:\Windows\System\FlUYilp.exe
  C:\Windows\System\FlUYilp.exe
  2⤵
  PID:3792
- C:\Windows\System\aVSERls.exe
  C:\Windows\System\aVSERls.exe
  2⤵
  PID:3796
- C:\Windows\System\jNKIsef.exe
  C:\Windows\System\jNKIsef.exe
  2⤵
  PID:2412
- C:\Windows\System\gZWQeFN.exe
  C:\Windows\System\gZWQeFN.exe
  2⤵
  PID:4580
- C:\Windows\System\rJxphhj.exe
  C:\Windows\System\rJxphhj.exe
  2⤵
  PID:2852
- C:\Windows\System\QVvpfld.exe
  C:\Windows\System\QVvpfld.exe
  2⤵
  PID:2996
- C:\Windows\System\Pzcwsmr.exe
  C:\Windows\System\Pzcwsmr.exe
  2⤵
  PID:4584
- C:\Windows\System\dXiMNBG.exe
  C:\Windows\System\dXiMNBG.exe
  2⤵
  PID:5128
- C:\Windows\System\bQYOlCK.exe
  C:\Windows\System\bQYOlCK.exe
  2⤵
  PID:5144
- C:\Windows\System\cWJcyFj.exe
  C:\Windows\System\cWJcyFj.exe
  2⤵
  PID:5160
- C:\Windows\System\KgzzcHV.exe
  C:\Windows\System\KgzzcHV.exe
  2⤵
  PID:5188
- C:\Windows\System\ALEmmMj.exe
  C:\Windows\System\ALEmmMj.exe
  2⤵
  PID:5204
- C:\Windows\System\NGIiItG.exe
  C:\Windows\System\NGIiItG.exe
  2⤵
  PID:5228
- C:\Windows\System\RceNMgH.exe
  C:\Windows\System\RceNMgH.exe
  2⤵
  PID:5248
- C:\Windows\System\tZogCeH.exe
  C:\Windows\System\tZogCeH.exe
  2⤵
  PID:5276
- C:\Windows\System\olqFuXu.exe
  C:\Windows\System\olqFuXu.exe
  2⤵
  PID:5292
- C:\Windows\System\jTGEZXN.exe
  C:\Windows\System\jTGEZXN.exe
  2⤵
  PID:5320
- C:\Windows\System\mqJVmcB.exe
  C:\Windows\System\mqJVmcB.exe
  2⤵
  PID:5336
- C:\Windows\System\JJhtzuq.exe
  C:\Windows\System\JJhtzuq.exe
  2⤵
  PID:5356
- C:\Windows\System\vPqvdsr.exe
  C:\Windows\System\vPqvdsr.exe
  2⤵
  PID:5380
- C:\Windows\System\uIFPyfz.exe
  C:\Windows\System\uIFPyfz.exe
  2⤵
  PID:5396
- C:\Windows\System\ymrZWDJ.exe
  C:\Windows\System\ymrZWDJ.exe
  2⤵
  PID:5424
- C:\Windows\System\SNSUlNM.exe
  C:\Windows\System\SNSUlNM.exe
  2⤵
  PID:5444
- C:\Windows\System\IfXxgRa.exe
  C:\Windows\System\IfXxgRa.exe
  2⤵
  PID:5460
- C:\Windows\System\zKFEpIf.exe
  C:\Windows\System\zKFEpIf.exe
  2⤵
  PID:5480
- C:\Windows\System\rWLGpSE.exe
  C:\Windows\System\rWLGpSE.exe
  2⤵
  PID:5500
- C:\Windows\System\fvrWgLO.exe
  C:\Windows\System\fvrWgLO.exe
  2⤵
  PID:5520
- C:\Windows\System\oeaALUP.exe
  C:\Windows\System\oeaALUP.exe
  2⤵
  PID:5536
- C:\Windows\System\NjoMbwo.exe
  C:\Windows\System\NjoMbwo.exe
  2⤵
  PID:5560
- C:\Windows\System\mrLqblX.exe
  C:\Windows\System\mrLqblX.exe
  2⤵
  PID:5584
- C:\Windows\System\UhossaJ.exe
  C:\Windows\System\UhossaJ.exe
  2⤵
  PID:5604
- C:\Windows\System\HGoVfak.exe
  C:\Windows\System\HGoVfak.exe
  2⤵
  PID:5624
- C:\Windows\System\dgsJlsC.exe
  C:\Windows\System\dgsJlsC.exe
  2⤵
  PID:5648
- C:\Windows\System\cQIqhdu.exe
  C:\Windows\System\cQIqhdu.exe
  2⤵
  PID:5668
- C:\Windows\System\QAeBUzZ.exe
  C:\Windows\System\QAeBUzZ.exe
  2⤵
  PID:5688
- C:\Windows\System\ygsRPND.exe
  C:\Windows\System\ygsRPND.exe
  2⤵
  PID:5704
- C:\Windows\System\ymLjgOv.exe
  C:\Windows\System\ymLjgOv.exe
  2⤵
  PID:5728
- C:\Windows\System\wgfDBUX.exe
  C:\Windows\System\wgfDBUX.exe
  2⤵
  PID:5744
- C:\Windows\System\wnoHqcw.exe
  C:\Windows\System\wnoHqcw.exe
  2⤵
  PID:5768
- C:\Windows\System\ePsrhtb.exe
  C:\Windows\System\ePsrhtb.exe
  2⤵
  PID:5788
- C:\Windows\System\GvMgbCe.exe
  C:\Windows\System\GvMgbCe.exe
  2⤵
  PID:5808
- C:\Windows\System\aTPzntG.exe
  C:\Windows\System\aTPzntG.exe
  2⤵
  PID:5828
- C:\Windows\System\LkWccaG.exe
  C:\Windows\System\LkWccaG.exe
  2⤵
  PID:5860
- C:\Windows\System\zleatjx.exe
  C:\Windows\System\zleatjx.exe
  2⤵
  PID:5876
- C:\Windows\System\VtvbwEk.exe
  C:\Windows\System\VtvbwEk.exe
  2⤵
  PID:5912
- C:\Windows\System\wXEECJD.exe
  C:\Windows\System\wXEECJD.exe
  2⤵
  PID:5936
- C:\Windows\System\qaoKAJa.exe
  C:\Windows\System\qaoKAJa.exe
  2⤵
  PID:5960
- C:\Windows\System\cdYXeIH.exe
  C:\Windows\System\cdYXeIH.exe
  2⤵
  PID:5976
- C:\Windows\System\znDthqu.exe
  C:\Windows\System\znDthqu.exe
  2⤵
  PID:6000
- C:\Windows\System\BBMgEOi.exe
  C:\Windows\System\BBMgEOi.exe
  2⤵
  PID:6016
- C:\Windows\System\zFSRvKI.exe
  C:\Windows\System\zFSRvKI.exe
  2⤵
  PID:6040
- C:\Windows\System\RWjtTXP.exe
  C:\Windows\System\RWjtTXP.exe
  2⤵
  PID:6060
- C:\Windows\System\vjtQTeD.exe
  C:\Windows\System\vjtQTeD.exe
  2⤵
  PID:6080
- C:\Windows\System\EcaFttt.exe
  C:\Windows\System\EcaFttt.exe
  2⤵
  PID:6096
- C:\Windows\System\CuBPeYX.exe
  C:\Windows\System\CuBPeYX.exe
  2⤵
  PID:6128
- C:\Windows\System\KuYilyZ.exe
  C:\Windows\System\KuYilyZ.exe
  2⤵
  PID:3524
- C:\Windows\System\QpUJAko.exe
  C:\Windows\System\QpUJAko.exe
  2⤵
  PID:264
- C:\Windows\System\cqctulr.exe
  C:\Windows\System\cqctulr.exe
  2⤵
  PID:3492
- C:\Windows\System\vmJVlxH.exe
  C:\Windows\System\vmJVlxH.exe
  2⤵
  PID:1700
- C:\Windows\System\bHzrSIs.exe
  C:\Windows\System\bHzrSIs.exe
  2⤵
  PID:4628
- C:\Windows\System\qCYCMyd.exe
  C:\Windows\System\qCYCMyd.exe
  2⤵
  PID:3756
- C:\Windows\System\WjBJDGE.exe
  C:\Windows\System\WjBJDGE.exe
  2⤵
  PID:2332
- C:\Windows\System\jNmiwjs.exe
  C:\Windows\System\jNmiwjs.exe
  2⤵
  PID:2856
- C:\Windows\System\jhMRIlJ.exe
  C:\Windows\System\jhMRIlJ.exe
  2⤵
  PID:1572
- C:\Windows\System\zMBBsiW.exe
  C:\Windows\System\zMBBsiW.exe
  2⤵
  PID:5268
- C:\Windows\System\nikZMNK.exe
  C:\Windows\System\nikZMNK.exe
  2⤵
  PID:6148
- C:\Windows\System\HZlaRND.exe
  C:\Windows\System\HZlaRND.exe
  2⤵
  PID:6172
- C:\Windows\System\hEeWfyS.exe
  C:\Windows\System\hEeWfyS.exe
  2⤵
  PID:6188
- C:\Windows\System\ImgOqqK.exe
  C:\Windows\System\ImgOqqK.exe
  2⤵
  PID:6212
- C:\Windows\System\nPlXdPs.exe
  C:\Windows\System\nPlXdPs.exe
  2⤵
  PID:6240
- C:\Windows\System\lUqqxwV.exe
  C:\Windows\System\lUqqxwV.exe
  2⤵
  PID:6264
- C:\Windows\System\PWlTRhV.exe
  C:\Windows\System\PWlTRhV.exe
  2⤵
  PID:6284
- C:\Windows\System\PCMofhP.exe
  C:\Windows\System\PCMofhP.exe
  2⤵
  PID:6300
- C:\Windows\System\pJmmpKd.exe
  C:\Windows\System\pJmmpKd.exe
  2⤵
  PID:6324
- C:\Windows\System\kQWaOEw.exe
  C:\Windows\System\kQWaOEw.exe
  2⤵
  PID:6340
- C:\Windows\System\npYqVzB.exe
  C:\Windows\System\npYqVzB.exe
  2⤵
  PID:6364
- C:\Windows\System\qGQVmBo.exe
  C:\Windows\System\qGQVmBo.exe
  2⤵
  PID:6384
- C:\Windows\System\AqrxCFQ.exe
  C:\Windows\System\AqrxCFQ.exe
  2⤵
  PID:6408
- C:\Windows\System\wMEwXnC.exe
  C:\Windows\System\wMEwXnC.exe
  2⤵
  PID:6436
- C:\Windows\System\QtTOIuh.exe
  C:\Windows\System\QtTOIuh.exe
  2⤵
  PID:6464
- C:\Windows\System\GivLqyr.exe
  C:\Windows\System\GivLqyr.exe
  2⤵
  PID:6480
- C:\Windows\System\cojRuEP.exe
  C:\Windows\System\cojRuEP.exe
  2⤵
  PID:6508
- C:\Windows\System\bRcxSWM.exe
  C:\Windows\System\bRcxSWM.exe
  2⤵
  PID:6528
- C:\Windows\System\ChThldV.exe
  C:\Windows\System\ChThldV.exe
  2⤵
  PID:6544
- C:\Windows\System\tzdUxVj.exe
  C:\Windows\System\tzdUxVj.exe
  2⤵
  PID:6564
- C:\Windows\System\iZhmVIG.exe
  C:\Windows\System\iZhmVIG.exe
  2⤵
  PID:6588
- C:\Windows\System\huByPEH.exe
  C:\Windows\System\huByPEH.exe
  2⤵
  PID:6612
- C:\Windows\System\rSbySDi.exe
  C:\Windows\System\rSbySDi.exe
  2⤵
  PID:6628
- C:\Windows\System\szZOcAg.exe
  C:\Windows\System\szZOcAg.exe
  2⤵
  PID:6648
- C:\Windows\System\ptHGxGS.exe
  C:\Windows\System\ptHGxGS.exe
  2⤵
  PID:6668
- C:\Windows\System\TjIsyQv.exe
  C:\Windows\System\TjIsyQv.exe
  2⤵
  PID:6696
- C:\Windows\System\mDQxZEg.exe
  C:\Windows\System\mDQxZEg.exe
  2⤵
  PID:6716
- C:\Windows\System\fhUamnD.exe
  C:\Windows\System\fhUamnD.exe
  2⤵
  PID:6736
- C:\Windows\System\qRoLWrw.exe
  C:\Windows\System\qRoLWrw.exe
  2⤵
  PID:6764
- C:\Windows\System\lvtBsFh.exe
  C:\Windows\System\lvtBsFh.exe
  2⤵
  PID:6784
- C:\Windows\System\tzLZFdx.exe
  C:\Windows\System\tzLZFdx.exe
  2⤵
  PID:6804
- C:\Windows\System\YloJSvY.exe
  C:\Windows\System\YloJSvY.exe
  2⤵
  PID:6828
- C:\Windows\System\YWhVliT.exe
  C:\Windows\System\YWhVliT.exe
  2⤵
  PID:6844
- C:\Windows\System\JhXNqIt.exe
  C:\Windows\System\JhXNqIt.exe
  2⤵
  PID:6868
- C:\Windows\System\SVZuTdJ.exe
  C:\Windows\System\SVZuTdJ.exe
  2⤵
  PID:6884
- C:\Windows\System\puqiYrn.exe
  C:\Windows\System\puqiYrn.exe
  2⤵
  PID:6912
- C:\Windows\System\QQcPoZD.exe
  C:\Windows\System\QQcPoZD.exe
  2⤵
  PID:6928
- C:\Windows\System\rEYCkcO.exe
  C:\Windows\System\rEYCkcO.exe
  2⤵
  PID:6960
- C:\Windows\System\AkCgPLO.exe
  C:\Windows\System\AkCgPLO.exe
  2⤵
  PID:6984
- C:\Windows\System\StFORZW.exe
  C:\Windows\System\StFORZW.exe
  2⤵
  PID:7004
- C:\Windows\System\hMgcVqB.exe
  C:\Windows\System\hMgcVqB.exe
  2⤵
  PID:7024
- C:\Windows\System\TAmyqkY.exe
  C:\Windows\System\TAmyqkY.exe
  2⤵
  PID:7040
- C:\Windows\System\CfEWZHn.exe
  C:\Windows\System\CfEWZHn.exe
  2⤵
  PID:7056
- C:\Windows\System\qaKfKyy.exe
  C:\Windows\System\qaKfKyy.exe
  2⤵
  PID:7076
- C:\Windows\System\dJqAcoy.exe
  C:\Windows\System\dJqAcoy.exe
  2⤵
  PID:7096
- C:\Windows\System\jkBGkJu.exe
  C:\Windows\System\jkBGkJu.exe
  2⤵
  PID:7116
- C:\Windows\System\mVegpcM.exe
  C:\Windows\System\mVegpcM.exe
  2⤵
  PID:7144
- C:\Windows\System\vPMzwDM.exe
  C:\Windows\System\vPMzwDM.exe
  2⤵
  PID:7164
- C:\Windows\System\vsJtEsw.exe
  C:\Windows\System\vsJtEsw.exe
  2⤵
  PID:5368
- C:\Windows\System\dacDwVO.exe
  C:\Windows\System\dacDwVO.exe
  2⤵
  PID:2436
- C:\Windows\System\yStChEG.exe
  C:\Windows\System\yStChEG.exe
  2⤵
  PID:5544
- C:\Windows\System\sBlkhoY.exe
  C:\Windows\System\sBlkhoY.exe
  2⤵
  PID:5644
- C:\Windows\System\VQQUbAK.exe
  C:\Windows\System\VQQUbAK.exe
  2⤵
  PID:4816
- C:\Windows\System\OkyplUV.exe
  C:\Windows\System\OkyplUV.exe
  2⤵
  PID:2292
- C:\Windows\System\CPrBtbt.exe
  C:\Windows\System\CPrBtbt.exe
  2⤵
  PID:2400
- C:\Windows\System\wWkorBI.exe
  C:\Windows\System\wWkorBI.exe
  2⤵
  PID:4216
- C:\Windows\System\UYYpksr.exe
  C:\Windows\System\UYYpksr.exe
  2⤵
  PID:5968
- C:\Windows\System\WCvLSSz.exe
  C:\Windows\System\WCvLSSz.exe
  2⤵
  PID:1508
- C:\Windows\System\lQsmliI.exe
  C:\Windows\System\lQsmliI.exe
  2⤵
  PID:5136
- C:\Windows\System\ItfFoPc.exe
  C:\Windows\System\ItfFoPc.exe
  2⤵
  PID:6088
- C:\Windows\System\MYLilxb.exe
  C:\Windows\System\MYLilxb.exe
  2⤵
  PID:3988
- C:\Windows\System\iZnKzcl.exe
  C:\Windows\System\iZnKzcl.exe
  2⤵
  PID:4800
- C:\Windows\System\fCExRhU.exe
  C:\Windows\System\fCExRhU.exe
  2⤵
  PID:2748
- C:\Windows\System\vThfeEn.exe
  C:\Windows\System\vThfeEn.exe
  2⤵
  PID:784
- C:\Windows\System\TAngQIS.exe
  C:\Windows\System\TAngQIS.exe
  2⤵
  PID:2032
- C:\Windows\System\MsBYpwE.exe
  C:\Windows\System\MsBYpwE.exe
  2⤵
  PID:5456
- C:\Windows\System\vIkOhFJ.exe
  C:\Windows\System\vIkOhFJ.exe
  2⤵
  PID:6280
- C:\Windows\System\VQvMpTf.exe
  C:\Windows\System\VQvMpTf.exe
  2⤵
  PID:5516
- C:\Windows\System\nZNSKWY.exe
  C:\Windows\System\nZNSKWY.exe
  2⤵
  PID:6432
- C:\Windows\System\MtFqHaC.exe
  C:\Windows\System\MtFqHaC.exe
  2⤵
  PID:516
- C:\Windows\System\ihujNeg.exe
  C:\Windows\System\ihujNeg.exe
  2⤵
  PID:7180
- C:\Windows\System\qYyWplK.exe
  C:\Windows\System\qYyWplK.exe
  2⤵
  PID:7200
- C:\Windows\System\bVXGiOW.exe
  C:\Windows\System\bVXGiOW.exe
  2⤵
  PID:7220
- C:\Windows\System\PnktAqc.exe
  C:\Windows\System\PnktAqc.exe
  2⤵
  PID:7240
- C:\Windows\System\iwJLWty.exe
  C:\Windows\System\iwJLWty.exe
  2⤵
  PID:7260
- C:\Windows\System\vsxeJcp.exe
  C:\Windows\System\vsxeJcp.exe
  2⤵
  PID:7280
- C:\Windows\System\cUjJUgd.exe
  C:\Windows\System\cUjJUgd.exe
  2⤵
  PID:7304
- C:\Windows\System\SVhLCQj.exe
  C:\Windows\System\SVhLCQj.exe
  2⤵
  PID:7320
- C:\Windows\System\OUybPTB.exe
  C:\Windows\System\OUybPTB.exe
  2⤵
  PID:7344
- C:\Windows\System\fIsDCmN.exe
  C:\Windows\System\fIsDCmN.exe
  2⤵
  PID:7368
- C:\Windows\System\NQicbaI.exe
  C:\Windows\System\NQicbaI.exe
  2⤵
  PID:7388
- C:\Windows\System\mEiZsQy.exe
  C:\Windows\System\mEiZsQy.exe
  2⤵
  PID:7404
- C:\Windows\System\NHKBCtu.exe
  C:\Windows\System\NHKBCtu.exe
  2⤵
  PID:7432
- C:\Windows\System\YUqrSvy.exe
  C:\Windows\System\YUqrSvy.exe
  2⤵
  PID:7452
- C:\Windows\System\EaiCJFi.exe
  C:\Windows\System\EaiCJFi.exe
  2⤵
  PID:7472
- C:\Windows\System\Fogpatt.exe
  C:\Windows\System\Fogpatt.exe
  2⤵
  PID:7488
- C:\Windows\System\DFFTzWi.exe
  C:\Windows\System\DFFTzWi.exe
  2⤵
  PID:7512
- C:\Windows\System\fXLJGSb.exe
  C:\Windows\System\fXLJGSb.exe
  2⤵
  PID:7532
- C:\Windows\System\eOLxDdO.exe
  C:\Windows\System\eOLxDdO.exe
  2⤵
  PID:7552
- C:\Windows\System\xHkeXNO.exe
  C:\Windows\System\xHkeXNO.exe
  2⤵
  PID:7572
- C:\Windows\System\gynkpTP.exe
  C:\Windows\System\gynkpTP.exe
  2⤵
  PID:7596
- C:\Windows\System\hkifuKJ.exe
  C:\Windows\System\hkifuKJ.exe
  2⤵
  PID:7616
- C:\Windows\System\LJYctHa.exe
  C:\Windows\System\LJYctHa.exe
  2⤵
  PID:7636
- C:\Windows\System\FSTcdOE.exe
  C:\Windows\System\FSTcdOE.exe
  2⤵
  PID:7668
- C:\Windows\System\BPANqdX.exe
  C:\Windows\System\BPANqdX.exe
  2⤵
  PID:7688
- C:\Windows\System\EdrYKfB.exe
  C:\Windows\System\EdrYKfB.exe
  2⤵
  PID:7712
- C:\Windows\System\xlSJybS.exe
  C:\Windows\System\xlSJybS.exe
  2⤵
  PID:7728
- C:\Windows\System\QKDlRda.exe
  C:\Windows\System\QKDlRda.exe
  2⤵
  PID:7752
- C:\Windows\System\lIrNhER.exe
  C:\Windows\System\lIrNhER.exe
  2⤵
  PID:7768
- C:\Windows\System\nDegZTJ.exe
  C:\Windows\System\nDegZTJ.exe
  2⤵
  PID:7792
- C:\Windows\System\JHMsnLz.exe
  C:\Windows\System\JHMsnLz.exe
  2⤵
  PID:7808
- C:\Windows\System\xapHnvu.exe
  C:\Windows\System\xapHnvu.exe
  2⤵
  PID:7836
- C:\Windows\System\sxnmMGC.exe
  C:\Windows\System\sxnmMGC.exe
  2⤵
  PID:7860
- C:\Windows\System\LGccayS.exe
  C:\Windows\System\LGccayS.exe
  2⤵
  PID:7876
- C:\Windows\System\cndjJyb.exe
  C:\Windows\System\cndjJyb.exe
  2⤵
  PID:7900
- C:\Windows\System\pCShkfa.exe
  C:\Windows\System\pCShkfa.exe
  2⤵
  PID:7924
- C:\Windows\System\gfzVGzS.exe
  C:\Windows\System\gfzVGzS.exe
  2⤵
  PID:7944
- C:\Windows\System\zMmhOLb.exe
  C:\Windows\System\zMmhOLb.exe
  2⤵
  PID:7972
- C:\Windows\System\xPQMVPW.exe
  C:\Windows\System\xPQMVPW.exe
  2⤵
  PID:7988
- C:\Windows\System\PrdTZSs.exe
  C:\Windows\System\PrdTZSs.exe
  2⤵
  PID:8012
- C:\Windows\System\iIXtXZm.exe
  C:\Windows\System\iIXtXZm.exe
  2⤵
  PID:8036
- C:\Windows\System\ojvsamn.exe
  C:\Windows\System\ojvsamn.exe
  2⤵
  PID:8052
- C:\Windows\System\QsSJDkU.exe
  C:\Windows\System\QsSJDkU.exe
  2⤵
  PID:8076
- C:\Windows\System\ljBFMtU.exe
  C:\Windows\System\ljBFMtU.exe
  2⤵
  PID:8092
- C:\Windows\System\fvkBBoI.exe
  C:\Windows\System\fvkBBoI.exe
  2⤵
  PID:8116
- C:\Windows\System\dcuCtVw.exe
  C:\Windows\System\dcuCtVw.exe
  2⤵
  PID:8132
- C:\Windows\System\cTcOkAv.exe
  C:\Windows\System\cTcOkAv.exe
  2⤵
  PID:8156
- C:\Windows\System\pbnKyrW.exe
  C:\Windows\System\pbnKyrW.exe
  2⤵
  PID:8184
- C:\Windows\System\bbUxQlG.exe
  C:\Windows\System\bbUxQlG.exe
  2⤵
  PID:4128
- C:\Windows\System\NmLSVPN.exe
  C:\Windows\System\NmLSVPN.exe
  2⤵
  PID:3928
- C:\Windows\System\ezdXhXI.exe
  C:\Windows\System\ezdXhXI.exe
  2⤵
  PID:3264
- C:\Windows\System\bRgtLQk.exe
  C:\Windows\System\bRgtLQk.exe
  2⤵
  PID:5844
- C:\Windows\System\TLpGCfC.exe
  C:\Windows\System\TLpGCfC.exe
  2⤵
  PID:6744
- C:\Windows\System\SsbzdYd.exe
  C:\Windows\System\SsbzdYd.exe
  2⤵
  PID:4948
- C:\Windows\System\kwETEKD.exe
  C:\Windows\System\kwETEKD.exe
  2⤵
  PID:6812
- C:\Windows\System\YKFovZp.exe
  C:\Windows\System\YKFovZp.exe
  2⤵
  PID:5948
- C:\Windows\System\mKHZWRk.exe
  C:\Windows\System\mKHZWRk.exe
  2⤵
  PID:5152
- C:\Windows\System\McLAgGp.exe
  C:\Windows\System\McLAgGp.exe
  2⤵
  PID:5200
- C:\Windows\System\TIKyGHB.exe
  C:\Windows\System\TIKyGHB.exe
  2⤵
  PID:6108
- C:\Windows\System\YfBGZQd.exe
  C:\Windows\System\YfBGZQd.exe
  2⤵
  PID:5260
- C:\Windows\System\bheXugC.exe
  C:\Windows\System\bheXugC.exe
  2⤵
  PID:7092
- C:\Windows\System\dsHRtaT.exe
  C:\Windows\System\dsHRtaT.exe
  2⤵
  PID:3472
- C:\Windows\System\pGgdHvc.exe
  C:\Windows\System\pGgdHvc.exe
  2⤵
  PID:5392
- C:\Windows\System\SLRsDXO.exe
  C:\Windows\System\SLRsDXO.exe
  2⤵
  PID:5284
- C:\Windows\System\eDDGkoc.exe
  C:\Windows\System\eDDGkoc.exe
  2⤵
  PID:6196
- C:\Windows\System\GYXnaeE.exe
  C:\Windows\System\GYXnaeE.exe
  2⤵
  PID:5620
- C:\Windows\System\nmoQtxN.exe
  C:\Windows\System\nmoQtxN.exe
  2⤵
  PID:2368
- C:\Windows\System\UZMUWFF.exe
  C:\Windows\System\UZMUWFF.exe
  2⤵
  PID:6256
- C:\Windows\System\lsWHEZV.exe
  C:\Windows\System\lsWHEZV.exe
  2⤵
  PID:8196
- C:\Windows\System\MTTRGGh.exe
  C:\Windows\System\MTTRGGh.exe
  2⤵
  PID:8212
- C:\Windows\System\mhZBdwM.exe
  C:\Windows\System\mhZBdwM.exe
  2⤵
  PID:8228
- C:\Windows\System\VvOMiHa.exe
  C:\Windows\System\VvOMiHa.exe
  2⤵
  PID:8248
- C:\Windows\System\hLwYFtB.exe
  C:\Windows\System\hLwYFtB.exe
  2⤵
  PID:8264
- C:\Windows\System\mJHmerQ.exe
  C:\Windows\System\mJHmerQ.exe
  2⤵
  PID:8292
- C:\Windows\System\SdaBSwM.exe
  C:\Windows\System\SdaBSwM.exe
  2⤵
  PID:8316
- C:\Windows\System\raKZaGI.exe
  C:\Windows\System\raKZaGI.exe
  2⤵
  PID:8348
- C:\Windows\System\ETBvoAR.exe
  C:\Windows\System\ETBvoAR.exe
  2⤵
  PID:8364
- C:\Windows\System\mOLgVHX.exe
  C:\Windows\System\mOLgVHX.exe
  2⤵
  PID:8392
- C:\Windows\System\gjCvQYw.exe
  C:\Windows\System\gjCvQYw.exe
  2⤵
  PID:8412
- C:\Windows\System\zAnbziJ.exe
  C:\Windows\System\zAnbziJ.exe
  2⤵
  PID:8440
- C:\Windows\System\JSGpAOv.exe
  C:\Windows\System\JSGpAOv.exe
  2⤵
  PID:8460
- C:\Windows\System\TCPYMwy.exe
  C:\Windows\System\TCPYMwy.exe
  2⤵
  PID:8480
- C:\Windows\System\aTgaSPx.exe
  C:\Windows\System\aTgaSPx.exe
  2⤵
  PID:8508
- C:\Windows\System\kaekfzp.exe
  C:\Windows\System\kaekfzp.exe
  2⤵
  PID:8524
- C:\Windows\System\hNeWjuJ.exe
  C:\Windows\System\hNeWjuJ.exe
  2⤵
  PID:8548
- C:\Windows\System\GMkqwgV.exe
  C:\Windows\System\GMkqwgV.exe
  2⤵
  PID:8568
- C:\Windows\System\NhGlToQ.exe
  C:\Windows\System\NhGlToQ.exe
  2⤵
  PID:8588
- C:\Windows\System\iGtVUeh.exe
  C:\Windows\System\iGtVUeh.exe
  2⤵
  PID:8616
- C:\Windows\System\mGQNfCN.exe
  C:\Windows\System\mGQNfCN.exe
  2⤵
  PID:8644
- C:\Windows\System\SEdoqJD.exe
  C:\Windows\System\SEdoqJD.exe
  2⤵
  PID:8664
- C:\Windows\System\EdkLsrQ.exe
  C:\Windows\System\EdkLsrQ.exe
  2⤵
  PID:8688
- C:\Windows\System\MmGlGkc.exe
  C:\Windows\System\MmGlGkc.exe
  2⤵
  PID:8708
- C:\Windows\System\fEZFUbI.exe
  C:\Windows\System\fEZFUbI.exe
  2⤵
  PID:8728
- C:\Windows\System\xdeURfT.exe
  C:\Windows\System\xdeURfT.exe
  2⤵
  PID:8752
- C:\Windows\System\ExuhGOI.exe
  C:\Windows\System\ExuhGOI.exe
  2⤵
  PID:8776
- C:\Windows\System\PhTnTyp.exe
  C:\Windows\System\PhTnTyp.exe
  2⤵
  PID:8800
- C:\Windows\System\BAirFvK.exe
  C:\Windows\System\BAirFvK.exe
  2⤵
  PID:8824
- C:\Windows\System\WyHBPMI.exe
  C:\Windows\System\WyHBPMI.exe
  2⤵
  PID:8840
- C:\Windows\System\TrUtzhI.exe
  C:\Windows\System\TrUtzhI.exe
  2⤵
  PID:8856
- C:\Windows\System\BowQijp.exe
  C:\Windows\System\BowQijp.exe
  2⤵
  PID:8880
- C:\Windows\System\vDjuxZZ.exe
  C:\Windows\System\vDjuxZZ.exe
  2⤵
  PID:8904
- C:\Windows\System\vEShQKC.exe
  C:\Windows\System\vEShQKC.exe
  2⤵
  PID:8924
- C:\Windows\System\qDzYDDT.exe
  C:\Windows\System\qDzYDDT.exe
  2⤵
  PID:8944
- C:\Windows\System\jrDXMZF.exe
  C:\Windows\System\jrDXMZF.exe
  2⤵
  PID:8964
- C:\Windows\System\UGqeUrl.exe
  C:\Windows\System\UGqeUrl.exe
  2⤵
  PID:8980
- C:\Windows\System\DSuaHVS.exe
  C:\Windows\System\DSuaHVS.exe
  2⤵
  PID:9000
- C:\Windows\System\JtkfvMH.exe
  C:\Windows\System\JtkfvMH.exe
  2⤵
  PID:9024
- C:\Windows\System\DSIbMPD.exe
  C:\Windows\System\DSIbMPD.exe
  2⤵
  PID:9040
- C:\Windows\System\sRIXLLJ.exe
  C:\Windows\System\sRIXLLJ.exe
  2⤵
  PID:9060
- C:\Windows\System\pkjOOhv.exe
  C:\Windows\System\pkjOOhv.exe
  2⤵
  PID:9076
- C:\Windows\System\QNrRBJR.exe
  C:\Windows\System\QNrRBJR.exe
  2⤵
  PID:9100
- C:\Windows\System\wzNZIpu.exe
  C:\Windows\System\wzNZIpu.exe
  2⤵
  PID:9120
- C:\Windows\System\yOoMvLL.exe
  C:\Windows\System\yOoMvLL.exe
  2⤵
  PID:9144
- C:\Windows\System\xFxpXGO.exe
  C:\Windows\System\xFxpXGO.exe
  2⤵
  PID:9168
- C:\Windows\System\NnmvnFh.exe
  C:\Windows\System\NnmvnFh.exe
  2⤵
  PID:9184
- C:\Windows\System\dYLXgft.exe
  C:\Windows\System\dYLXgft.exe
  2⤵
  PID:9208
- C:\Windows\System\IPWodXz.exe
  C:\Windows\System\IPWodXz.exe
  2⤵
  PID:6360
- C:\Windows\System\XlbXUUR.exe
  C:\Windows\System\XlbXUUR.exe
  2⤵
  PID:6424
- C:\Windows\System\akjcybA.exe
  C:\Windows\System\akjcybA.exe
  2⤵
  PID:6272
- C:\Windows\System\ehQMUlL.exe
  C:\Windows\System\ehQMUlL.exe
  2⤵
  PID:5664
- C:\Windows\System\WUIpHbV.exe
  C:\Windows\System\WUIpHbV.exe
  2⤵
  PID:5700
- C:\Windows\System\mksKWGQ.exe
  C:\Windows\System\mksKWGQ.exe
  2⤵
  PID:7256
- C:\Windows\System\TYWRRIO.exe
  C:\Windows\System\TYWRRIO.exe
  2⤵
  PID:7292
- C:\Windows\System\VEbJRGD.exe
  C:\Windows\System\VEbJRGD.exe
  2⤵
  PID:7956
- C:\Windows\System\goEfUNu.exe
  C:\Windows\System\goEfUNu.exe
  2⤵
  PID:6904
- C:\Windows\System\NBggrtR.exe
  C:\Windows\System\NBggrtR.exe
  2⤵
  PID:6924
- C:\Windows\System\taCUUId.exe
  C:\Windows\System\taCUUId.exe
  2⤵
  PID:4620
- C:\Windows\System\DfpIYjQ.exe
  C:\Windows\System\DfpIYjQ.exe
  2⤵
  PID:5348
- C:\Windows\System\MQxWDvk.exe
  C:\Windows\System\MQxWDvk.exe
  2⤵
  PID:6204
- C:\Windows\System\HYTtyAY.exe
  C:\Windows\System\HYTtyAY.exe
  2⤵
  PID:6248
- C:\Windows\System\EVXphgP.exe
  C:\Windows\System\EVXphgP.exe
  2⤵
  PID:6008
- C:\Windows\System\nSHrfee.exe
  C:\Windows\System\nSHrfee.exe
  2⤵
  PID:6356
- C:\Windows\System\DdQhwdz.exe
  C:\Windows\System\DdQhwdz.exe
  2⤵
  PID:5308
- C:\Windows\System\MneaUHo.exe
  C:\Windows\System\MneaUHo.exe
  2⤵
  PID:6448
- C:\Windows\System\CNeheRb.exe
  C:\Windows\System\CNeheRb.exe
  2⤵
  PID:6380
- C:\Windows\System\PFwWYiE.exe
  C:\Windows\System\PFwWYiE.exe
  2⤵
  PID:6500
- C:\Windows\System\tBpGmkW.exe
  C:\Windows\System\tBpGmkW.exe
  2⤵
  PID:6524
- C:\Windows\System\yRMqFxM.exe
  C:\Windows\System\yRMqFxM.exe
  2⤵
  PID:7316
- C:\Windows\System\veqnTKK.exe
  C:\Windows\System\veqnTKK.exe
  2⤵
  PID:7484
- C:\Windows\System\dTltUSY.exe
  C:\Windows\System\dTltUSY.exe
  2⤵
  PID:7412
- C:\Windows\System\ibRIhHr.exe
  C:\Windows\System\ibRIhHr.exe
  2⤵
  PID:7520
- C:\Windows\System\kFIghmf.exe
  C:\Windows\System\kFIghmf.exe
  2⤵
  PID:7560
- C:\Windows\System\tjAkyfW.exe
  C:\Windows\System\tjAkyfW.exe
  2⤵
  PID:7628
- C:\Windows\System\qlzbqCE.exe
  C:\Windows\System\qlzbqCE.exe
  2⤵
  PID:7660
- C:\Windows\System\BPtKJUl.exe
  C:\Windows\System\BPtKJUl.exe
  2⤵
  PID:7700
- C:\Windows\System\lNmnekN.exe
  C:\Windows\System\lNmnekN.exe
  2⤵
  PID:7848
- C:\Windows\System\LiStDQP.exe
  C:\Windows\System\LiStDQP.exe
  2⤵
  PID:8140
- C:\Windows\System\tEbeUvE.exe
  C:\Windows\System\tEbeUvE.exe
  2⤵
  PID:6756
- C:\Windows\System\OmONCnZ.exe
  C:\Windows\System\OmONCnZ.exe
  2⤵
  PID:5352
- C:\Windows\System\reyvcZM.exe
  C:\Windows\System\reyvcZM.exe
  2⤵
  PID:8272
- C:\Windows\System\ZUnWNer.exe
  C:\Windows\System\ZUnWNer.exe
  2⤵
  PID:8420
- C:\Windows\System\JnEpIyZ.exe
  C:\Windows\System\JnEpIyZ.exe
  2⤵
  PID:8624
- C:\Windows\System\SJCNTIU.exe
  C:\Windows\System\SJCNTIU.exe
  2⤵
  PID:8808
- C:\Windows\System\ZSFzdXi.exe
  C:\Windows\System\ZSFzdXi.exe
  2⤵
  PID:8956
- C:\Windows\System\UOmXoSx.exe
  C:\Windows\System\UOmXoSx.exe
  2⤵
  PID:5576
- C:\Windows\System\mhEZsIm.exe
  C:\Windows\System\mhEZsIm.exe
  2⤵
  PID:7936
- C:\Windows\System\ZhUYZUq.exe
  C:\Windows\System\ZhUYZUq.exe
  2⤵
  PID:7984
- C:\Windows\System\jobOpBO.exe
  C:\Windows\System\jobOpBO.exe
  2⤵
  PID:8020
- C:\Windows\System\ZDnuNCN.exe
  C:\Windows\System\ZDnuNCN.exe
  2⤵
  PID:8064
- C:\Windows\System\AltkSMG.exe
  C:\Windows\System\AltkSMG.exe
  2⤵
  PID:8112
- C:\Windows\System\kiEJaIf.exe
  C:\Windows\System\kiEJaIf.exe
  2⤵
  PID:1200
- C:\Windows\System\GBrHonR.exe
  C:\Windows\System\GBrHonR.exe
  2⤵
  PID:5892
- C:\Windows\System\tYiUevH.exe
  C:\Windows\System\tYiUevH.exe
  2⤵
  PID:6816
- C:\Windows\System\CYgTTrp.exe
  C:\Windows\System\CYgTTrp.exe
  2⤵
  PID:5180
- C:\Windows\System\hVvxmCq.exe
  C:\Windows\System\hVvxmCq.exe
  2⤵
  PID:2584
- C:\Windows\System\TdCwTJn.exe
  C:\Windows\System\TdCwTJn.exe
  2⤵
  PID:6164
- C:\Windows\System\IrOQDks.exe
  C:\Windows\System\IrOQDks.exe
  2⤵
  PID:3060
- C:\Windows\System\ntRFVjR.exe
  C:\Windows\System\ntRFVjR.exe
  2⤵
  PID:8204
- C:\Windows\System\QTUjSbY.exe
  C:\Windows\System\QTUjSbY.exe
  2⤵
  PID:8260
- C:\Windows\System\EwazIeC.exe
  C:\Windows\System\EwazIeC.exe
  2⤵
  PID:8344
- C:\Windows\System\VMrLsKw.exe
  C:\Windows\System\VMrLsKw.exe
  2⤵
  PID:8408
- C:\Windows\System\ORyGzJq.exe
  C:\Windows\System\ORyGzJq.exe
  2⤵
  PID:8476
- C:\Windows\System\kcoqSRM.exe
  C:\Windows\System\kcoqSRM.exe
  2⤵
  PID:8540
- C:\Windows\System\YiNpJUk.exe
  C:\Windows\System\YiNpJUk.exe
  2⤵
  PID:8632
- C:\Windows\System\WrFYRPM.exe
  C:\Windows\System\WrFYRPM.exe
  2⤵
  PID:8704
- C:\Windows\System\WZHanjE.exe
  C:\Windows\System\WZHanjE.exe
  2⤵
  PID:8764
- C:\Windows\System\ulTgCXp.exe
  C:\Windows\System\ulTgCXp.exe
  2⤵
  PID:8832
- C:\Windows\System\KDioQCE.exe
  C:\Windows\System\KDioQCE.exe
  2⤵
  PID:8896
- C:\Windows\System\TUQxmtA.exe
  C:\Windows\System\TUQxmtA.exe
  2⤵
  PID:8940
- C:\Windows\System\QxxFEfX.exe
  C:\Windows\System\QxxFEfX.exe
  2⤵
  PID:9032
- C:\Windows\System\JMFtNCf.exe
  C:\Windows\System\JMFtNCf.exe
  2⤵
  PID:9052
- C:\Windows\System\krMNRSv.exe
  C:\Windows\System\krMNRSv.exe
  2⤵
  PID:9092
- C:\Windows\System\JmNhvqG.exe
  C:\Windows\System\JmNhvqG.exe
  2⤵
  PID:9180
- C:\Windows\System\gRjnHMl.exe
  C:\Windows\System\gRjnHMl.exe
  2⤵
  PID:9228
- C:\Windows\System\oeTujSC.exe
  C:\Windows\System\oeTujSC.exe
  2⤵
  PID:9252
- C:\Windows\System\LcMwPsj.exe
  C:\Windows\System\LcMwPsj.exe
  2⤵
  PID:9272
- C:\Windows\System\ySLeWou.exe
  C:\Windows\System\ySLeWou.exe
  2⤵
  PID:9296
- C:\Windows\System\YVQDgUe.exe
  C:\Windows\System\YVQDgUe.exe
  2⤵
  PID:9316
- C:\Windows\System\ATfVXet.exe
  C:\Windows\System\ATfVXet.exe
  2⤵
  PID:9340
- C:\Windows\System\ACpRHnS.exe
  C:\Windows\System\ACpRHnS.exe
  2⤵
  PID:9364
- C:\Windows\System\LpKfsjP.exe
  C:\Windows\System\LpKfsjP.exe
  2⤵
  PID:9392
- C:\Windows\System\BnJbDLZ.exe
  C:\Windows\System\BnJbDLZ.exe
  2⤵
  PID:9412
- C:\Windows\System\MseJljN.exe
  C:\Windows\System\MseJljN.exe
  2⤵
  PID:9432
- C:\Windows\System\bXRDHgE.exe
  C:\Windows\System\bXRDHgE.exe
  2⤵
  PID:9456
- C:\Windows\System\YkyjnCY.exe
  C:\Windows\System\YkyjnCY.exe
  2⤵
  PID:9480
- C:\Windows\System\jupKArY.exe
  C:\Windows\System\jupKArY.exe
  2⤵
  PID:9504
- C:\Windows\System\cDvxOIz.exe
  C:\Windows\System\cDvxOIz.exe
  2⤵
  PID:9524
- C:\Windows\System\IcFmIEZ.exe
  C:\Windows\System\IcFmIEZ.exe
  2⤵
  PID:9548
- C:\Windows\System\sJGpirS.exe
  C:\Windows\System\sJGpirS.exe
  2⤵
  PID:9572
- C:\Windows\System\AxTXvIJ.exe
  C:\Windows\System\AxTXvIJ.exe
  2⤵
  PID:9604
- C:\Windows\System\shcrnof.exe
  C:\Windows\System\shcrnof.exe
  2⤵
  PID:9624
- C:\Windows\System\fVwKApZ.exe
  C:\Windows\System\fVwKApZ.exe
  2⤵
  PID:9648
- C:\Windows\System\HVnwuSe.exe
  C:\Windows\System\HVnwuSe.exe
  2⤵
  PID:9668
- C:\Windows\System\lQaZNPX.exe
  C:\Windows\System\lQaZNPX.exe
  2⤵
  PID:9696
- C:\Windows\System\ExlKbFQ.exe
  C:\Windows\System\ExlKbFQ.exe
  2⤵
  PID:9716
- C:\Windows\System\NFfNrVu.exe
  C:\Windows\System\NFfNrVu.exe
  2⤵
  PID:9744
- C:\Windows\System\QtpVAwJ.exe
  C:\Windows\System\QtpVAwJ.exe
  2⤵
  PID:9780
- C:\Windows\System\grUVjlh.exe
  C:\Windows\System\grUVjlh.exe
  2⤵
  PID:9808
- C:\Windows\System\WLHkhqP.exe
  C:\Windows\System\WLHkhqP.exe
  2⤵
  PID:9832
- C:\Windows\System\ZqwSjZp.exe
  C:\Windows\System\ZqwSjZp.exe
  2⤵
  PID:9852
- C:\Windows\System\euQaBFP.exe
  C:\Windows\System\euQaBFP.exe
  2⤵
  PID:9872
- C:\Windows\System\DZOsMwM.exe
  C:\Windows\System\DZOsMwM.exe
  2⤵
  PID:9900
- C:\Windows\System\fPPPHcN.exe
  C:\Windows\System\fPPPHcN.exe
  2⤵
  PID:9924
- C:\Windows\System\wkFyaqi.exe
  C:\Windows\System\wkFyaqi.exe
  2⤵
  PID:9944
- C:\Windows\System\zKqYGOz.exe
  C:\Windows\System\zKqYGOz.exe
  2⤵
  PID:9972
- C:\Windows\System\NVciuoz.exe
  C:\Windows\System\NVciuoz.exe
  2⤵
  PID:9996
- C:\Windows\System\qWLebDw.exe
  C:\Windows\System\qWLebDw.exe
  2⤵
  PID:10020
- C:\Windows\System\yvAzAHq.exe
  C:\Windows\System\yvAzAHq.exe
  2⤵
  PID:10044
- C:\Windows\System\nMxyyoZ.exe
  C:\Windows\System\nMxyyoZ.exe
  2⤵
  PID:10064
- C:\Windows\System\NHcCRFJ.exe
  C:\Windows\System\NHcCRFJ.exe
  2⤵
  PID:10084
- C:\Windows\System\vbjpTsu.exe
  C:\Windows\System\vbjpTsu.exe
  2⤵
  PID:10116
- C:\Windows\System\twJeMWg.exe
  C:\Windows\System\twJeMWg.exe
  2⤵
  PID:10140
- C:\Windows\System\ToGLDvf.exe
  C:\Windows\System\ToGLDvf.exe
  2⤵
  PID:10160
- C:\Windows\System\duIAiAq.exe
  C:\Windows\System\duIAiAq.exe
  2⤵
  PID:10176
- C:\Windows\System\RkpLerA.exe
  C:\Windows\System\RkpLerA.exe
  2⤵
  PID:10204
- C:\Windows\System\sMfxAnk.exe
  C:\Windows\System\sMfxAnk.exe
  2⤵
  PID:10228
- C:\Windows\System\PGWWaQp.exe
  C:\Windows\System\PGWWaQp.exe
  2⤵
  PID:10252
- C:\Windows\System\BwTzMWN.exe
  C:\Windows\System\BwTzMWN.exe
  2⤵
  PID:10268
- C:\Windows\System\yggGAfe.exe
  C:\Windows\System\yggGAfe.exe
  2⤵
  PID:10288
- C:\Windows\System\SGcEYzg.exe
  C:\Windows\System\SGcEYzg.exe
  2⤵
  PID:10304
- C:\Windows\System\xubsIDO.exe
  C:\Windows\System\xubsIDO.exe
  2⤵
  PID:10328
- C:\Windows\System\Wrgpfhr.exe
  C:\Windows\System\Wrgpfhr.exe
  2⤵
  PID:10348
- C:\Windows\System\BzpBHXM.exe
  C:\Windows\System\BzpBHXM.exe
  2⤵
  PID:10364
- C:\Windows\System\HpextgX.exe
  C:\Windows\System\HpextgX.exe
  2⤵
  PID:10380
- C:\Windows\System\lfOZPso.exe
  C:\Windows\System\lfOZPso.exe
  2⤵
  PID:10396
- C:\Windows\System\XDnwagy.exe
  C:\Windows\System\XDnwagy.exe
  2⤵
  PID:10412
- C:\Windows\System\flwcbey.exe
  C:\Windows\System\flwcbey.exe
  2⤵
  PID:10436
- C:\Windows\System\MZoFqOo.exe
  C:\Windows\System\MZoFqOo.exe
  2⤵
  PID:10452
- C:\Windows\System\ifBLtTb.exe
  C:\Windows\System\ifBLtTb.exe
  2⤵
  PID:10476
- C:\Windows\System\kXuFVYQ.exe
  C:\Windows\System\kXuFVYQ.exe
  2⤵
  PID:10496
- C:\Windows\System\YOgAosk.exe
  C:\Windows\System\YOgAosk.exe
  2⤵
  PID:10512
- C:\Windows\System\IoJwdwO.exe
  C:\Windows\System\IoJwdwO.exe
  2⤵
  PID:10532
- C:\Windows\System\FWWJXxp.exe
  C:\Windows\System\FWWJXxp.exe
  2⤵
  PID:10552
- C:\Windows\System\GCanrxZ.exe
  C:\Windows\System\GCanrxZ.exe
  2⤵
  PID:10572
- C:\Windows\System\hWMnChK.exe
  C:\Windows\System\hWMnChK.exe
  2⤵
  PID:10588
- C:\Windows\System\ciahTEc.exe
  C:\Windows\System\ciahTEc.exe
  2⤵
  PID:10608
- C:\Windows\System\JUSedmP.exe
  C:\Windows\System\JUSedmP.exe
  2⤵
  PID:10628
- C:\Windows\System\ptjHoOA.exe
  C:\Windows\System\ptjHoOA.exe
  2⤵
  PID:10648
- C:\Windows\System\crWKzWw.exe
  C:\Windows\System\crWKzWw.exe
  2⤵
  PID:10668
- C:\Windows\System\knyCkaj.exe
  C:\Windows\System\knyCkaj.exe
  2⤵
  PID:10684
- C:\Windows\System\NcUeBsN.exe
  C:\Windows\System\NcUeBsN.exe
  2⤵
  PID:10708
- C:\Windows\System\cozSnkx.exe
  C:\Windows\System\cozSnkx.exe
  2⤵
  PID:10724
- C:\Windows\System\fIbVsyX.exe
  C:\Windows\System\fIbVsyX.exe
  2⤵
  PID:10740
- C:\Windows\System\QdjQMUG.exe
  C:\Windows\System\QdjQMUG.exe
  2⤵
  PID:10756
- C:\Windows\System\mrVCYfx.exe
  C:\Windows\System\mrVCYfx.exe
  2⤵
  PID:10772
- C:\Windows\System\qFnrUpY.exe
  C:\Windows\System\qFnrUpY.exe
  2⤵
  PID:10788
- C:\Windows\System\uDOlEcv.exe
  C:\Windows\System\uDOlEcv.exe
  2⤵
  PID:10808
- C:\Windows\System\zceCnEx.exe
  C:\Windows\System\zceCnEx.exe
  2⤵
  PID:10828
- C:\Windows\System\LBxQDyv.exe
  C:\Windows\System\LBxQDyv.exe
  2⤵
  PID:10844
- C:\Windows\System\kauFhCr.exe
  C:\Windows\System\kauFhCr.exe
  2⤵
  PID:10864
- C:\Windows\System\KPiXBuK.exe
  C:\Windows\System\KPiXBuK.exe
  2⤵
  PID:10884
- C:\Windows\System\HfonqEg.exe
  C:\Windows\System\HfonqEg.exe
  2⤵
  PID:10904
- C:\Windows\System\LfAKXue.exe
  C:\Windows\System\LfAKXue.exe
  2⤵
  PID:10920
- C:\Windows\System\lSOfxtV.exe
  C:\Windows\System\lSOfxtV.exe
  2⤵
  PID:10940
- C:\Windows\System\TdWdsJZ.exe
  C:\Windows\System\TdWdsJZ.exe
  2⤵
  PID:10960
- C:\Windows\System\zDLCTpO.exe
  C:\Windows\System\zDLCTpO.exe
  2⤵
  PID:10980
- C:\Windows\System\nxkwaFu.exe
  C:\Windows\System\nxkwaFu.exe
  2⤵
  PID:11004
- C:\Windows\System\zvCGiNs.exe
  C:\Windows\System\zvCGiNs.exe
  2⤵
  PID:11020
- C:\Windows\System\ioirypb.exe
  C:\Windows\System\ioirypb.exe
  2⤵
  PID:11044
- C:\Windows\System\rauRbjX.exe
  C:\Windows\System\rauRbjX.exe
  2⤵
  PID:11068
- C:\Windows\System\IAwHCiR.exe
  C:\Windows\System\IAwHCiR.exe
  2⤵
  PID:11088
- C:\Windows\System\yKWxFzZ.exe
  C:\Windows\System\yKWxFzZ.exe
  2⤵
  PID:11108
- C:\Windows\System\Nmnmlhi.exe
  C:\Windows\System\Nmnmlhi.exe
  2⤵
  PID:11124
- C:\Windows\System\KHJhwPu.exe
  C:\Windows\System\KHJhwPu.exe
  2⤵
  PID:11144
- C:\Windows\System\KCrJVQa.exe
  C:\Windows\System\KCrJVQa.exe
  2⤵
  PID:11164
- C:\Windows\System\zBYCjqp.exe
  C:\Windows\System\zBYCjqp.exe
  2⤵
  PID:11184
- C:\Windows\System\naweWIS.exe
  C:\Windows\System\naweWIS.exe
  2⤵
  PID:11200
- C:\Windows\System\QsxbRpy.exe
  C:\Windows\System\QsxbRpy.exe
  2⤵
  PID:11216
- C:\Windows\System\nPEBvKr.exe
  C:\Windows\System\nPEBvKr.exe
  2⤵
  PID:11236
- C:\Windows\System\YBAuJig.exe
  C:\Windows\System\YBAuJig.exe
  2⤵
  PID:11260
- C:\Windows\System\tTfvHsU.exe
  C:\Windows\System\tTfvHsU.exe
  2⤵
  PID:11284
- C:\Windows\System\lvWnDsm.exe
  C:\Windows\System\lvWnDsm.exe
  2⤵
  PID:11308
- C:\Windows\System\ePtLWVb.exe
  C:\Windows\System\ePtLWVb.exe
  2⤵
  PID:11332
- C:\Windows\System\SseOqkF.exe
  C:\Windows\System\SseOqkF.exe
  2⤵
  PID:11352
- C:\Windows\System\tyrJXEd.exe
  C:\Windows\System\tyrJXEd.exe
  2⤵
  PID:11376
- C:\Windows\System\aKvMsjF.exe
  C:\Windows\System\aKvMsjF.exe
  2⤵
  PID:11404
- C:\Windows\System\HgtktFS.exe
  C:\Windows\System\HgtktFS.exe
  2⤵
  PID:11420
- C:\Windows\System\CUkBjUR.exe
  C:\Windows\System\CUkBjUR.exe
  2⤵
  PID:11436
- C:\Windows\System\LhExifW.exe
  C:\Windows\System\LhExifW.exe
  2⤵
  PID:11460
- C:\Windows\System\AxVEgoP.exe
  C:\Windows\System\AxVEgoP.exe
  2⤵
  PID:11484
- C:\Windows\System\IhlOZoG.exe
  C:\Windows\System\IhlOZoG.exe
  2⤵
  PID:11504
- C:\Windows\System\BPpKcly.exe
  C:\Windows\System\BPpKcly.exe
  2⤵
  PID:11524
- C:\Windows\System\bcVxkXQ.exe
  C:\Windows\System\bcVxkXQ.exe
  2⤵
  PID:11548
- C:\Windows\System\axiLKYz.exe
  C:\Windows\System\axiLKYz.exe
  2⤵
  PID:11572
- C:\Windows\System\KMvlrXg.exe
  C:\Windows\System\KMvlrXg.exe
  2⤵
  PID:11596
- C:\Windows\System\FXMjDpo.exe
  C:\Windows\System\FXMjDpo.exe
  2⤵
  PID:11612
- C:\Windows\System\fLkOHts.exe
  C:\Windows\System\fLkOHts.exe
  2⤵
  PID:11640
- C:\Windows\System\TRITWfM.exe
  C:\Windows\System\TRITWfM.exe
  2⤵
  PID:11660
- C:\Windows\System\FAFZUJD.exe
  C:\Windows\System\FAFZUJD.exe
  2⤵
  PID:11684
- C:\Windows\System\JQqzZtj.exe
  C:\Windows\System\JQqzZtj.exe
  2⤵
  PID:11700
- C:\Windows\System\HKCnBiO.exe
  C:\Windows\System\HKCnBiO.exe
  2⤵
  PID:11724
- C:\Windows\System\GoLEBPG.exe
  C:\Windows\System\GoLEBPG.exe
  2⤵
  PID:11752
- C:\Windows\System\HjPDNrC.exe
  C:\Windows\System\HjPDNrC.exe
  2⤵
  PID:11768
- C:\Windows\System\GPqyIvk.exe
  C:\Windows\System\GPqyIvk.exe
  2⤵
  PID:11788
- C:\Windows\System\MLgbSuv.exe
  C:\Windows\System\MLgbSuv.exe
  2⤵
  PID:11812
- C:\Windows\System\gsHremd.exe
  C:\Windows\System\gsHremd.exe
  2⤵
  PID:11836
- C:\Windows\System\KCtLaFO.exe
  C:\Windows\System\KCtLaFO.exe
  2⤵
  PID:11864
- C:\Windows\System\RWBVDjk.exe
  C:\Windows\System\RWBVDjk.exe
  2⤵
  PID:11880
- C:\Windows\System\JazsqiT.exe
  C:\Windows\System\JazsqiT.exe
  2⤵
  PID:11896
- C:\Windows\System\kCoXvJQ.exe
  C:\Windows\System\kCoXvJQ.exe
  2⤵
  PID:11912
- C:\Windows\System\bZxMJzG.exe
  C:\Windows\System\bZxMJzG.exe
  2⤵
  PID:11928
- C:\Windows\System\azcOmcn.exe
  C:\Windows\System\azcOmcn.exe
  2⤵
  PID:11948
- C:\Windows\System\ZsLTOiP.exe
  C:\Windows\System\ZsLTOiP.exe
  2⤵
  PID:11976
- C:\Windows\System\cRvwgZb.exe
  C:\Windows\System\cRvwgZb.exe
  2⤵
  PID:12184
- C:\Windows\System\oYiIBHC.exe
  C:\Windows\System\oYiIBHC.exe
  2⤵
  PID:12200
- C:\Windows\System\OHxQxFF.exe
  C:\Windows\System\OHxQxFF.exe
  2⤵
  PID:12220
- C:\Windows\System\HlTfXBX.exe
  C:\Windows\System\HlTfXBX.exe
  2⤵
  PID:12236
- C:\Windows\System\adFVzcY.exe
  C:\Windows\System\adFVzcY.exe
  2⤵
  PID:12256
- C:\Windows\System\GhqRovM.exe
  C:\Windows\System\GhqRovM.exe
  2⤵
  PID:12276
- C:\Windows\System\iUhWfyq.exe
  C:\Windows\System\iUhWfyq.exe
  2⤵
  PID:3788
- C:\Windows\System\JRltBqZ.exe
  C:\Windows\System\JRltBqZ.exe
  2⤵
  PID:12300
- C:\Windows\System\CFlkuyG.exe
  C:\Windows\System\CFlkuyG.exe
  2⤵
  PID:12320
- C:\Windows\System\rvGbcCB.exe
  C:\Windows\System\rvGbcCB.exe
  2⤵
  PID:12340
- C:\Windows\System\gUdFdim.exe
  C:\Windows\System\gUdFdim.exe
  2⤵
  PID:12356
- C:\Windows\System\TbZXZog.exe
  C:\Windows\System\TbZXZog.exe
  2⤵
  PID:12372
- C:\Windows\System\OiIHpKb.exe
  C:\Windows\System\OiIHpKb.exe
  2⤵
  PID:12392
- C:\Windows\System\XZBuuKD.exe
  C:\Windows\System\XZBuuKD.exe
  2⤵
  PID:12420
- C:\Windows\System\uptADxP.exe
  C:\Windows\System\uptADxP.exe
  2⤵
  PID:12452
- C:\Windows\System\RUPOcPQ.exe
  C:\Windows\System\RUPOcPQ.exe
  2⤵
  PID:12472
- C:\Windows\System\wttCVXf.exe
  C:\Windows\System\wttCVXf.exe
  2⤵
  PID:12500
- C:\Windows\System\vuWlfMc.exe
  C:\Windows\System\vuWlfMc.exe
  2⤵
  PID:12536
- C:\Windows\System\WSoPGcB.exe
  C:\Windows\System\WSoPGcB.exe
  2⤵
  PID:12552
- C:\Windows\System\zwXVXtp.exe
  C:\Windows\System\zwXVXtp.exe
  2⤵
  PID:12568
- C:\Windows\System\zgxDQAP.exe
  C:\Windows\System\zgxDQAP.exe
  2⤵
  PID:12584
- C:\Windows\System\SVekctp.exe
  C:\Windows\System\SVekctp.exe
  2⤵
  PID:12600
- C:\Windows\System\MmondUo.exe
  C:\Windows\System\MmondUo.exe
  2⤵
  PID:12616
- C:\Windows\System\JwbYdee.exe
  C:\Windows\System\JwbYdee.exe
  2⤵
  PID:12632
- C:\Windows\System\NvMcMGQ.exe
  C:\Windows\System\NvMcMGQ.exe
  2⤵
  PID:12648
- C:\Windows\System\dhCSrHk.exe
  C:\Windows\System\dhCSrHk.exe
  2⤵
  PID:12664
- C:\Windows\System\BAZZyJf.exe
  C:\Windows\System\BAZZyJf.exe
  2⤵
  PID:12680
- C:\Windows\System\TCCsGvL.exe
  C:\Windows\System\TCCsGvL.exe
  2⤵
  PID:12696
- C:\Windows\System\sopOZEB.exe
  C:\Windows\System\sopOZEB.exe
  2⤵
  PID:12724
- C:\Windows\System\ogxnAEM.exe
  C:\Windows\System\ogxnAEM.exe
  2⤵
  PID:12752
- C:\Windows\System\WthAzjc.exe
  C:\Windows\System\WthAzjc.exe
  2⤵
  PID:12776
- C:\Windows\System\QmtHGNV.exe
  C:\Windows\System\QmtHGNV.exe
  2⤵
  PID:12804
- C:\Windows\System\JbGDFKr.exe
  C:\Windows\System\JbGDFKr.exe
  2⤵
  PID:12824
- C:\Windows\System\cctyHpn.exe
  C:\Windows\System\cctyHpn.exe
  2⤵
  PID:12852
- C:\Windows\System\FBfDuLR.exe
  C:\Windows\System\FBfDuLR.exe
  2⤵
  PID:12880
- C:\Windows\System\umQitPy.exe
  C:\Windows\System\umQitPy.exe
  2⤵
  PID:12908
- C:\Windows\System\KMRopWV.exe
  C:\Windows\System\KMRopWV.exe
  2⤵
  PID:12936
- C:\Windows\System\cWtaSdV.exe
  C:\Windows\System\cWtaSdV.exe
  2⤵
  PID:12956
- C:\Windows\System\qEoZibi.exe
  C:\Windows\System\qEoZibi.exe
  2⤵
  PID:12980
- C:\Windows\System\TBundIR.exe
  C:\Windows\System\TBundIR.exe
  2⤵
  PID:13004
- C:\Windows\System\xuuubqe.exe
  C:\Windows\System\xuuubqe.exe
  2⤵
  PID:13024
- C:\Windows\System\JJSfhsJ.exe
  C:\Windows\System\JJSfhsJ.exe
  2⤵
  PID:13060
- C:\Windows\System\btNRYtg.exe
  C:\Windows\System\btNRYtg.exe
  2⤵
  PID:13088
- C:\Windows\System\AVLutxF.exe
  C:\Windows\System\AVLutxF.exe
  2⤵
  PID:13108
- C:\Windows\System\AtgsWtY.exe
  C:\Windows\System\AtgsWtY.exe
  2⤵
  PID:13140
- C:\Windows\System\ilVincn.exe
  C:\Windows\System\ilVincn.exe
  2⤵
  PID:13172
- C:\Windows\System\YoQwRBj.exe
  C:\Windows\System\YoQwRBj.exe
  2⤵
  PID:9708
- C:\Windows\System\kBWMEgN.exe
  C:\Windows\System\kBWMEgN.exe
  2⤵
  PID:9848
- C:\Windows\System\xcdZybC.exe
  C:\Windows\System\xcdZybC.exe
  2⤵
  PID:10212
- C:\Windows\System\cpqbHdc.exe
  C:\Windows\System\cpqbHdc.exe
  2⤵
  PID:10264
- C:\Windows\System\RwUizHB.exe
  C:\Windows\System\RwUizHB.exe
  2⤵
  PID:10508
- C:\Windows\System\eFHhhqi.exe
  C:\Windows\System\eFHhhqi.exe
  2⤵
  PID:10616
- C:\Windows\System\ttfJtko.exe
  C:\Windows\System\ttfJtko.exe
  2⤵
  PID:5568
- C:\Windows\System\elFSYVb.exe
  C:\Windows\System\elFSYVb.exe
  2⤵
  PID:11496
- C:\Windows\System\rHPhMuG.exe
  C:\Windows\System\rHPhMuG.exe
  2⤵
  PID:9980
- C:\Windows\System\tejDzRP.exe
  C:\Windows\System\tejDzRP.exe
  2⤵
  PID:10076
- C:\Windows\System\CvnmWGV.exe
  C:\Windows\System\CvnmWGV.exe
  2⤵
  PID:10192
- C:\Windows\System\PWVbKHI.exe
  C:\Windows\System\PWVbKHI.exe
  2⤵
  PID:10280
- C:\Windows\System\BsrcmPM.exe
  C:\Windows\System\BsrcmPM.exe
  2⤵
  PID:10372
- C:\Windows\System\JOUjPHy.exe
  C:\Windows\System\JOUjPHy.exe
  2⤵
  PID:11368
- C:\Windows\System\IjmcQVq.exe
  C:\Windows\System\IjmcQVq.exe
  2⤵
  PID:10484
- C:\Windows\System\fAbiShN.exe
  C:\Windows\System\fAbiShN.exe
  2⤵
  PID:11152
- C:\Windows\System\mztjOog.exe
  C:\Windows\System\mztjOog.exe
  2⤵
  PID:10560
- C:\Windows\System\bfKEaZO.exe
  C:\Windows\System\bfKEaZO.exe
  2⤵
  PID:10640
- C:\Windows\System\ZuKCMGV.exe
  C:\Windows\System\ZuKCMGV.exe
  2⤵
  PID:10780
- C:\Windows\System\Slpczpe.exe
  C:\Windows\System\Slpczpe.exe
  2⤵
  PID:10876
- C:\Windows\System\BFeLMbi.exe
  C:\Windows\System\BFeLMbi.exe
  2⤵
  PID:10972
- C:\Windows\System\KkFgkoS.exe
  C:\Windows\System\KkFgkoS.exe
  2⤵
  PID:10544
- C:\Windows\System\peENHTp.exe
  C:\Windows\System\peENHTp.exe
  2⤵
  PID:11300
- C:\Windows\System\FtSBPxA.exe
  C:\Windows\System\FtSBPxA.exe
  2⤵
  PID:11428
- C:\Windows\System\GszvPDj.exe
  C:\Windows\System\GszvPDj.exe
  2⤵
  PID:11584
- C:\Windows\System\VjCVrmU.exe
  C:\Windows\System\VjCVrmU.exe
  2⤵
  PID:11652
- C:\Windows\System\qSjquVI.exe
  C:\Windows\System\qSjquVI.exe
  2⤵
  PID:13328
- C:\Windows\System\ZlHILBC.exe
  C:\Windows\System\ZlHILBC.exe
  2⤵
  PID:13348
- C:\Windows\System\lqeodjm.exe
  C:\Windows\System\lqeodjm.exe
  2⤵
  PID:13368
- C:\Windows\System\vxCOYAU.exe
  C:\Windows\System\vxCOYAU.exe
  2⤵
  PID:13392
- C:\Windows\System\lfxFCUk.exe
  C:\Windows\System\lfxFCUk.exe
  2⤵
  PID:13416
- C:\Windows\System\OlBzWvU.exe
  C:\Windows\System\OlBzWvU.exe
  2⤵
  PID:13436
- C:\Windows\System\mQyrkIE.exe
  C:\Windows\System\mQyrkIE.exe
  2⤵
  PID:13460
- C:\Windows\System\UCukFPT.exe
  C:\Windows\System\UCukFPT.exe
  2⤵
  PID:13480
- C:\Windows\System\eylGDxd.exe
  C:\Windows\System\eylGDxd.exe
  2⤵
  PID:13500
- C:\Windows\System\CBFUfxg.exe
  C:\Windows\System\CBFUfxg.exe
  2⤵
  PID:13516
- C:\Windows\System\jMOYXkH.exe
  C:\Windows\System\jMOYXkH.exe
  2⤵
  PID:13532
- C:\Windows\System\ERGKaAB.exe
  C:\Windows\System\ERGKaAB.exe
  2⤵
  PID:13552
- C:\Windows\System\YQNzPcd.exe
  C:\Windows\System\YQNzPcd.exe
  2⤵
  PID:13572
- C:\Windows\System\SBLtBiZ.exe
  C:\Windows\System\SBLtBiZ.exe
  2⤵
  PID:13588
- C:\Windows\System\BriQipt.exe
  C:\Windows\System\BriQipt.exe
  2⤵
  PID:13604
- C:\Windows\System\fZwGswu.exe
  C:\Windows\System\fZwGswu.exe
  2⤵
  PID:13620
- C:\Windows\System\KyNcAmK.exe
  C:\Windows\System\KyNcAmK.exe
  2⤵
  PID:13636
- C:\Windows\System\IYCaCxQ.exe
  C:\Windows\System\IYCaCxQ.exe
  2⤵
  PID:13652
- C:\Windows\System\geALVxp.exe
  C:\Windows\System\geALVxp.exe
  2⤵
  PID:13668
- C:\Windows\System\WLwEUJu.exe
  C:\Windows\System\WLwEUJu.exe
  2⤵
  PID:13684
- C:\Windows\System\IaSkUpj.exe
  C:\Windows\System\IaSkUpj.exe
  2⤵
  PID:13712
- C:\Windows\System\qDwtMGu.exe
  C:\Windows\System\qDwtMGu.exe
  2⤵
  PID:13728
- C:\Windows\System\NfjrRPW.exe
  C:\Windows\System\NfjrRPW.exe
  2⤵
  PID:13744
- C:\Windows\System\mhSwNAi.exe
  C:\Windows\System\mhSwNAi.exe
  2⤵
  PID:13760
- C:\Windows\System\rZMLvFA.exe
  C:\Windows\System\rZMLvFA.exe
  2⤵
  PID:13780
- C:\Windows\System\ixWiBxu.exe
  C:\Windows\System\ixWiBxu.exe
  2⤵
  PID:13796
- C:\Windows\System\GUHAecu.exe
  C:\Windows\System\GUHAecu.exe
  2⤵
  PID:13812
- C:\Windows\System\ibxFsEy.exe
  C:\Windows\System\ibxFsEy.exe
  2⤵
  PID:13852
- C:\Windows\System\jIVXJhv.exe
  C:\Windows\System\jIVXJhv.exe
  2⤵
  PID:13868
- C:\Windows\System\YNFbXRl.exe
  C:\Windows\System\YNFbXRl.exe
  2⤵
  PID:13884
- C:\Windows\System\ekxvHSC.exe
  C:\Windows\System\ekxvHSC.exe
  2⤵
  PID:13900
- C:\Windows\System\oAmVZaM.exe
  C:\Windows\System\oAmVZaM.exe
  2⤵
  PID:13916
- C:\Windows\System\UZlpKCr.exe
  C:\Windows\System\UZlpKCr.exe
  2⤵
  PID:13932
- C:\Windows\System\iHXPXyn.exe
  C:\Windows\System\iHXPXyn.exe
  2⤵
  PID:13948
- C:\Windows\System\riYJMuu.exe
  C:\Windows\System\riYJMuu.exe
  2⤵
  PID:13972
- C:\Windows\System\lrKWRDJ.exe
  C:\Windows\System\lrKWRDJ.exe
  2⤵
  PID:13996
- C:\Windows\System\bSzjYII.exe
  C:\Windows\System\bSzjYII.exe
  2⤵
  PID:14012
- C:\Windows\System\ztyquRf.exe
  C:\Windows\System\ztyquRf.exe
  2⤵
  PID:14032
- C:\Windows\System\quEiMgJ.exe
  C:\Windows\System\quEiMgJ.exe
  2⤵
  PID:14052
- C:\Windows\System\unLCrkz.exe
  C:\Windows\System\unLCrkz.exe
  2⤵
  PID:14072
- C:\Windows\System\cmAwSdN.exe
  C:\Windows\System\cmAwSdN.exe
  2⤵
  PID:14092
- C:\Windows\System\rIbEXkM.exe
  C:\Windows\System\rIbEXkM.exe
  2⤵
  PID:14108
- C:\Windows\System\HctQJJL.exe
  C:\Windows\System\HctQJJL.exe
  2⤵
  PID:14124
- C:\Windows\System\QkixTZb.exe
  C:\Windows\System\QkixTZb.exe
  2⤵
  PID:14148
- C:\Windows\System\jzgIuLj.exe
  C:\Windows\System\jzgIuLj.exe
  2⤵
  PID:14164
- C:\Windows\System\nbROvME.exe
  C:\Windows\System\nbROvME.exe
  2⤵
  PID:14180
- C:\Windows\System\sxETiAW.exe
  C:\Windows\System\sxETiAW.exe
  2⤵
  PID:14200
- C:\Windows\System\oFkUQWj.exe
  C:\Windows\System\oFkUQWj.exe
  2⤵
  PID:14224
- C:\Windows\System\VaauKiK.exe
  C:\Windows\System\VaauKiK.exe
  2⤵
  PID:14240
- C:\Windows\System\wglGFsC.exe
  C:\Windows\System\wglGFsC.exe
  2⤵
  PID:14256
- C:\Windows\System\TukGoTU.exe
  C:\Windows\System\TukGoTU.exe
  2⤵
  PID:14276
- C:\Windows\System\oIUUtXJ.exe
  C:\Windows\System\oIUUtXJ.exe
  2⤵
  PID:14300
- C:\Windows\System\sCeajYH.exe
  C:\Windows\System\sCeajYH.exe
  2⤵
  PID:14328
- C:\Windows\System\JjAMqEt.exe
  C:\Windows\System\JjAMqEt.exe
  2⤵
  PID:11852
- C:\Windows\System\aDzuwkk.exe
  C:\Windows\System\aDzuwkk.exe
  2⤵
  PID:1752
- C:\Windows\System\ANIVMci.exe
  C:\Windows\System\ANIVMci.exe
  2⤵
  PID:12428
- C:\Windows\System\kSUUULa.exe
  C:\Windows\System\kSUUULa.exe
  2⤵
  PID:3972
- C:\Windows\System\QbEOeOB.exe
  C:\Windows\System\QbEOeOB.exe
  2⤵
  PID:7020
- C:\Windows\System\KWBKVuz.exe
  C:\Windows\System\KWBKVuz.exe
  2⤵
  PID:12608
- C:\Windows\System\IguCWdj.exe
  C:\Windows\System\IguCWdj.exe
  2⤵
  PID:12688
- C:\Windows\System\TVImFdY.exe
  C:\Windows\System\TVImFdY.exe
  2⤵
  PID:12840
- C:\Windows\System\VFNkqVk.exe
  C:\Windows\System\VFNkqVk.exe
  2⤵
  PID:9564
- C:\Windows\System\CpmmUnK.exe
  C:\Windows\System\CpmmUnK.exe
  2⤵
  PID:9612
- C:\Windows\System\QDahEbI.exe
  C:\Windows\System\QDahEbI.exe
  2⤵
  PID:9676
- C:\Windows\System\gZoxYti.exe
  C:\Windows\System\gZoxYti.exe
  2⤵
  PID:9768
- C:\Windows\System\glYLzDp.exe
  C:\Windows\System\glYLzDp.exe
  2⤵
  PID:9920
- C:\Windows\System\jrXUZFz.exe
  C:\Windows\System\jrXUZFz.exe
  2⤵
  PID:10420
- C:\Windows\System\wYXaoEb.exe
  C:\Windows\System\wYXaoEb.exe
  2⤵
  PID:10644
- C:\Windows\System\vUDFchH.exe
  C:\Windows\System\vUDFchH.exe
  2⤵
  PID:10752
- C:\Windows\System\upjEpWS.exe
  C:\Windows\System\upjEpWS.exe
  2⤵
  PID:10820
- C:\Windows\System\aFTNybL.exe
  C:\Windows\System\aFTNybL.exe
  2⤵
  PID:10880
- C:\Windows\System\FLwesPv.exe
  C:\Windows\System\FLwesPv.exe
  2⤵
  PID:10948
- C:\Windows\System\yqEmNdk.exe
  C:\Windows\System\yqEmNdk.exe
  2⤵
  PID:11016
- C:\Windows\System\EcEqPCD.exe
  C:\Windows\System\EcEqPCD.exe
  2⤵
  PID:11084
- C:\Windows\System\uVusWCZ.exe
  C:\Windows\System\uVusWCZ.exe
  2⤵
  PID:7192
- C:\Windows\System\croJPWU.exe
  C:\Windows\System\croJPWU.exe
  2⤵
  PID:11160
- C:\Windows\System\MQuFvTy.exe
  C:\Windows\System\MQuFvTy.exe
  2⤵
  PID:7952
- C:\Windows\System\bwWbmnz.exe
  C:\Windows\System\bwWbmnz.exe
  2⤵
  PID:11468
- C:\Windows\System\ZGmuJkd.exe
  C:\Windows\System\ZGmuJkd.exe
  2⤵
  PID:11680
- C:\Windows\System\vORgnHT.exe
  C:\Windows\System\vORgnHT.exe
  2⤵
  PID:14356
- C:\Windows\System\wEuIIbJ.exe
  C:\Windows\System\wEuIIbJ.exe
  2⤵
  PID:14372
- C:\Windows\System\GAXfXln.exe
  C:\Windows\System\GAXfXln.exe
  2⤵
  PID:14388
- C:\Windows\System\FomWzOr.exe
  C:\Windows\System\FomWzOr.exe
  2⤵
  PID:14404
- C:\Windows\System\mJQWPTX.exe
  C:\Windows\System\mJQWPTX.exe
  2⤵
  PID:14420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AQHeLFD.exe

Filesize
1.3MB

MD5
e57cb2767b4657f4760e1b06fbc1f724

SHA1
1d48152adf040d06dcb877318e7a3382dc880c82

SHA256
b34324d8d0a4489ec944970a5d5f3feabc90893009e21b21193027cef0357f54

SHA512
79ed0acb6f235eb555bc874762b6aca712a851d6d775185a42ae39e24857812c9b5e74bbf14061557608a6e0b6d3d1c41b96c659da5d63dee455bf69b8a54ee9

Download Submit
C:\Windows\System\FWbCzUA.exe

Filesize
1.3MB

MD5
640b82b580fdffbda732c5b8631e5ef5

SHA1
610462113d8e21f6c53f433c7f085df955399991

SHA256
2e74f246854e92f7ad4c8a595d23b8fd6b7d3f7d5bf4e0fa8ea51433e6a6a1ae

SHA512
d45ed46aee4a2cf713947be0057b8470fa1022e277f9b42c893befe6a8a06d312c44fe34e8e8d0514330866a1c72da71a86baf5889c92271eed6f084f52d2195

Download Submit
C:\Windows\System\GCTAlWW.exe

Filesize
1.3MB

MD5
46313b6fd5b3971dd5cfdcf95a36c769

SHA1
1e4a572dd3c57aea8f52e0bcecb7ffcf5aa8477f

SHA256
8453f5e18f803628c7c9eaba14227bb2e619179b730a9646df639c2ab621a421

SHA512
487dad41b74cd9ca68d28e4b8a32d96e528c686543fdc1dc342961fdf3048d4fbbd0f81d348e2571fcd53b44dac51aba01d74533546d43d1b50a6a46551984c0

Download Submit
C:\Windows\System\HeMHEDT.exe

Filesize
1.3MB

MD5
300e8adc2dc612a900814c7045bb1668

SHA1
55d9d9b5af47f884286a6f2657bc4376c49436e5

SHA256
68da0b5e9ae9e7780a6e2acf39c1130db4fb0d7b920c378e3230ead8467e0a88

SHA512
73fc6e8c0e0f9d6c369d7e409d3a325ce6f6c931895581d22233108ec35acfea3f4fc812fc783b35019f53379f41a28c1a4035781f2bd34193b7294d702a3b7b

Download Submit
C:\Windows\System\ILHDaxf.exe

Filesize
1.3MB

MD5
c33410e04d7148743294fe61a1162d0c

SHA1
d9d6f4382aa4dd1acffc60fa8bc787edf7ea2a09

SHA256
56eec02add9536fabb4cd44386e6a26171f96ca0628ffc9ff7c64228af57858e

SHA512
7ed51d4e7080315f4a9d5bc918b5f4e0034ffb83732765e14d86236d92315f0a5ae2fe9341ee3cbc4e44577edd1e025b9db678215b72d57444401480c0d4da4e

Download Submit
C:\Windows\System\JZafTeF.exe

Filesize
1.3MB

MD5
c4ac1d106cc3f6b2bc8631838115936f

SHA1
30b7819d4c79bcdbab8029949c759b86c2a6d736

SHA256
9d782621fec8a1ea718fa51a2239eaf56c5f4646a0504b821441025fb7bf62d6

SHA512
8ec5cae54bce1a11f4424869680a291bdc9a1fcd8cff14b491d2116fb287cd17faca5e122e1ffc24690a76c933a27b42294a963fe3f830ac551ee7b94fffb1a6

Download Submit
C:\Windows\System\KOhAGFG.exe

Filesize
1.3MB

MD5
248681394124a250ceb39bfa79d3a3b5

SHA1
e0e86567ec6aa153dd713a7ad5efc604cb470025

SHA256
6379a4602df0efb28eb745231af6924006d5c6a504d2530e66e3c7014f9817c8

SHA512
67ee5007cae1247e59f6d11c30ea246c076d5a9366c7f9c7deea137bee5d53072576806e1763ebc3ddbbd18802162c38966d529e39639a6bedf05c2edc0af911

Download Submit
C:\Windows\System\LbUnfSE.exe

Filesize
1.3MB

MD5
71057bd653e094226b938b80637677a4

SHA1
f9276676049433d5c88b037f8dfd3135ed7c9763

SHA256
8f4e786d5a20e5ea60d1c25985bc47f00d2d9ac0b6a57edbc55f634966c26d57

SHA512
e5ad66b0cdb7fcf47c928f1e5ac7c62ff73027d7009b86410eba89e27efe7feac94d92afd3953ad575704169f81db737f670eb360465d78d2b037347ecbee0fb

Download Submit
C:\Windows\System\NBoNMMJ.exe

Filesize
1.3MB

MD5
79f99b694bbffdca3ef3c781d2202a7e

SHA1
a9a661de5505e25b9e03b08d5872650eb85619f3

SHA256
51b8981a2323fe4e9eb28e324f50549fc0d27fe74c0d4beb4cb1e118a02640cb

SHA512
95bc0936271467914e6e74c6902bfdb142a8d43268efca8cb712cecf648e9f972470f636d29a0df409a097206183a92ab0ce712f7f8912735fe2e5c684380469

Download Submit
C:\Windows\System\QIbhmjm.exe

Filesize
1.3MB

MD5
1f214d53ac6e2cfcffa6f380fbe77e4e

SHA1
07bb12358e6eb6d4de72b016dc9d8b1120d2469d

SHA256
407c2e75996233753fde3f801b69cd3d5331605f6cc72d7e08fef2d2162af29e

SHA512
9050eaffabc024c6bd82037ab70bd135f9e555641a7ed8a0704200fc217db8ff52be4e6fe77e59c0dd8ebcdae3f29b18b1e2f0fcab929508330b2ef026712461

Download Submit
C:\Windows\System\SJcCdEu.exe

Filesize
1.3MB

MD5
e368bdf2d161a5162e451899111ccdf4

SHA1
31f36f87f207302bf51a36b70ca40193b1c1f23c

SHA256
318670801de95149b3890bab3f67568d89acc805eb3596209ffdb3ca54cca7d6

SHA512
6458a5a4bde54e0bba3389a0a9967463cd17b3f08273b9a1d1656dad2d001c4e421b159917830f4114d20ba55bfb1863744f8ec640a51ce681042b7019db55e0

Download Submit
C:\Windows\System\VSyNtnx.exe

Filesize
1.3MB

MD5
98e36174c609cfa24bd930e3b136965f

SHA1
e0b2b4bd90138f45f97ac6354027b8f13fbad444

SHA256
a07d876ad0c092b4f2dd4b8c5f09b76a624247486a96920a569315a428d90bba

SHA512
0db3bb0e47cf5d83cc20bb9ed83ad66206077ba031062fd65b2ba61626318ad1a75b31e0deaf72779286843b0d17e9e83723dce11392eb61fbc7e9156fe62a29

Download Submit
C:\Windows\System\WjQWAuQ.exe

Filesize
1.3MB

MD5
d492675f28c1eef39e4995e936826dcf

SHA1
f166f27e067848c6451993e61ad7a134854837a9

SHA256
9900c37df951dff683feb544d9a37ab51ecc7e361e2c3b53c74adb1a6964487c

SHA512
47f326678ee1cbfbfc027995df65e34e428e1ca3c496f1965530f25cbbdfcec3f022bfbd07fdc2e85893ca2b8401cdb418ce638d25956009a8f4db6c41fd13e2

Download Submit
C:\Windows\System\WvShCAz.exe

Filesize
1.3MB

MD5
997347392ef14967f814d1c0ea7e25aa

SHA1
54bff0389d329035713c5f7f0b50d7e2a89841bc

SHA256
7cd158ee9a6ca801a3ebe72c3f7d9cf05c836e083178706f6a4463966688fd6c

SHA512
f66c94eddd72741a6252598954e9909015615d9144a9b408d1b0920d323913befef0bd890d61c786e90e1edbedd2fb646bdb17a9b1ce7d10180f9c3494a5e5a9

Download Submit
C:\Windows\System\ZEjoxVm.exe

Filesize
1.3MB

MD5
98e8c3198f91094626c9cdc54d0c58bd

SHA1
1fdf64db8d630b04cb1e1a07256de271f91de259

SHA256
1a8e6bef523c7e320d6851682bc8a61eae51376e415336e8242b7b1b13e8c489

SHA512
f263b070e52c9012f33a8bd0a9f68477f9ad6291094c6289da95fe2aaa53af84daf8d3f12242dd628d9ff5add8829293aee653e5d2006e5ec6666127ecc8a368

Download Submit
C:\Windows\System\ZQYRqRM.exe

Filesize
1.3MB

MD5
b62cd5d557aea5f8040ec32b85beb047

SHA1
efa471391fd8daa3b586c465a4f8a146a8b9cae1

SHA256
6104bb80a3ef8596f87bdfb46433d3ff8b652cae208a084280b4e11b22b31c41

SHA512
89d6cfe56a2954ac5525b96f194327333f35eb0a55dab2d740ece4e22100dd93a2d32a38c3ccdf10d5c741922bf70cd6fb68ce313d6769d621a7a1caaec70e2e

Download Submit
C:\Windows\System\ZqAFoDI.exe

Filesize
1.3MB

MD5
2ff026e572efe1c44ac5462b806fc697

SHA1
38f2e6e8f480c8a6da78e1c70302749ed33398eb

SHA256
5871868d2c056f4a75a42300e494d88019f41505e6fcfef3db47a7b03a261472

SHA512
96b3cdbc105babc431207e9f85cb000d816a73c01d9c2be36573b212dae42174a1e120664f994ba94b0d8de471537fdaf50c0c59f7287d0a015abcbcc6fbdc75

Download Submit
C:\Windows\System\aXGBUdA.exe

Filesize
1.3MB

MD5
886a7cfc4ee00c375b16a98cbd62898e

SHA1
8e46173956fd066b433f624deb997b3ce458861b

SHA256
725045484a74b1d599318844913dacfc8c4b09983536721933fae0e7818be332

SHA512
054c87a069710153cccd93f3669f610a255831f36c4b40408523767473cc3b29d4bcd5ef673baa0cf65dd4d3e6c7697adf9454391804408329c12378634d2cf0

Download Submit
C:\Windows\System\bbaJlUv.exe

Filesize
1.3MB

MD5
15ce619d563fd6f28e19c64a44be8356

SHA1
af48bfc6a0bdaf43007dbcea72350501258b74c1

SHA256
7e17c0c7dde687cf23b2317cb5582b45de1e5bd231f627ac586c50d9ffa30ce2

SHA512
687c49a1d81b3783e7dfe541615ee38ee4bbadd95386bf76026661d7d3653f4a448e3cb42a020136e5eb98d2dcdc46e8e8a348be0fb719ddce60ecbfd971a9fe

Download Submit
C:\Windows\System\bcfoViz.exe

Filesize
1.3MB

MD5
f5f2910197f099a71cba2fd7a3195c93

SHA1
24ce576a8dbaf4482e58fc606929e99c76f14d7b

SHA256
332f060e8d1fc89cce10ff8c1923a37686128b7032a6431ae7be05e867ccc7a1

SHA512
4ee68934e76e94f87a8f95ac4049e0fd57e4dc97468abcec11593a840dab77c25b9256b21794a8f3822593e2bee39be02e20347785f5a7da7e656457e5bec7fb

Download Submit
C:\Windows\System\bhmYMoF.exe

Filesize
1.3MB

MD5
1ad899c35116724561a6ad2aeed8b872

SHA1
843acabfa16dc8c347653683caf0f49135a877f6

SHA256
28dc689c53f13585c09637c66a2b75dfe00395a531c4e47617fc587b80b79778

SHA512
ec42f6ce59f6510b3ac357dfa8f56584318782c26f48e7b366491aea8f1f5f169d63f13c1978b630111ccd15a2b67e91d413c992ffec12e86d412ef5fed76e42

Download Submit
C:\Windows\System\bzgGhrJ.exe

Filesize
1.3MB

MD5
c4434e65a04194e2f34013cdadafd24e

SHA1
e209e8f920cb16515d1f219faa53012aedf9c8a9

SHA256
6598ecb33f01a6e71bb25e266716a1698bd4ea862a01bfc8673a4e262dbb0ea6

SHA512
02d1a1f5c098eac8f99e9a1628b809e6fb733f9976e62d9e633ae97679719ccc01233914531419700570a09f7c138bb537976062be3ab1dae58d63670f4c9944

Download Submit
C:\Windows\System\ctXerXx.exe

Filesize
1.3MB

MD5
a1dcf875ccf29f7e44a2068246c13913

SHA1
21270fb15b0798616526b4bb9af0cb50b9e42492

SHA256
7e4deac16443aa6635b74fcf392a177db863b42a2e463621a134d4839349eb5d

SHA512
c7373310160d7c8db23bb74a3051040244890090de4052777c72d0b573f67a77aac77191a979e493463075e1b3ef6f10e90d23fe512222bc52214e3f84f563d7

Download Submit
C:\Windows\System\dWVJPTU.exe

Filesize
1.3MB

MD5
f604971b4d7f890f9b689334a29f8804

SHA1
1ad4a1dc445a06a20a62f4a78a43445a1d95ddb2

SHA256
ac3b00290e74b30e86985b55983426402d55beb1cfa25b34394e87628c11068a

SHA512
dc1b454d96f2019bd5b1a6600937646e70a8bd64f9e95e058077e2995228bdb8efb596b18cfb232d7137c2fa20858f927c9cffc9cdca2878abe2be4a6e2f9ee4

Download Submit
C:\Windows\System\diZFIec.exe

Filesize
1.3MB

MD5
b6369db48e3014e756ee1eca76d2d8a5

SHA1
ea894786150bd1a71a7fb1fa68eef0ee75187256

SHA256
72e2666d087746cf3c6a106e559b42613e2375f394a1adca55ff9ed31d699b37

SHA512
64e1b23fe87481a875ccb4ccc9971b7d245e10c0d75b0ecb4cd49485a177e00a135186f2ae7b66454a20e4c12a61844b7679d6d7b2890efed79f78e92ff72e66

Download Submit
C:\Windows\System\fqQNggS.exe

Filesize
1.3MB

MD5
4b3169f8b3bc043432ee05f02ba44c18

SHA1
4bf731eaa126417baf742110252dc1e35a6e651f

SHA256
ebfeb3bec31c905a7d0ba775af3471a28f5fa6f895ae85966fdd53b10841dfb6

SHA512
89948394f06ef6f98d8a9b7f5286d5195461eb319ec89148886cd3f4a7d4f5cad9d96e5a1b7fb982ead0b6201061c80ba10f4ccfe1ab59af6d8c36d86a8cb1d5

Download Submit
C:\Windows\System\htPjmqM.exe

Filesize
1.3MB

MD5
cc0a0b9a4da05d74d426de43f1f60ae0

SHA1
1fa73f39b626fd85fa6f828ab35cfc0e8418657e

SHA256
7722b8b1b4ef32432d121907c5e9b86bec31ed05ce5671e80764fbb296806c16

SHA512
03d071936dd84328daf220995ffcd243b7e58ed0840d01570399a3c29662d614291e881ed26c2e46d7b9414c611d7ce50562a37e559923eb0c5252acf2effc20

Download Submit
C:\Windows\System\hyxdVlI.exe

Filesize
1.3MB

MD5
bfa9919e93dead7601b971c1ce0eef91

SHA1
ea9faee7139a43320c91c80be6a9e247fe7d6438

SHA256
bf161cde1785168170e7ff4a81b2234f7e44080c3fad0582402f4b087b66ef09

SHA512
540a2af27925b4c41f8dec2942afa9e9e92ef0c8ba3c5d015e28ff820caea2e2d3c2c8e94941c8566eac3508bc8653e5c91aafce4326f0880b4d76c4acab2cc9

Download Submit
C:\Windows\System\kRrpnMV.exe

Filesize
1.3MB

MD5
09e1286838234bf5b12af97bb305fe94

SHA1
cdd956395b44679ac22b56e674de4ce4806e1f4f

SHA256
67b57ef9679d17577d54c264a4d4eea09f986360c78a2705b01da198a711091c

SHA512
9ec81be56e2bf1f17191dfe9c9eecefc141e5919f710047ab9a7f7bdb494de32521bb1ac268726746ab8f6cbc6048634975e91f0775ae6b3a49efd1f4820b338

Download Submit
C:\Windows\System\lstBguC.exe

Filesize
1.3MB

MD5
7526ffdde3a0a1a5071f6a99b6e4c836

SHA1
c459d87ad6366d29d4637be5b3d311bb934d65ed

SHA256
b31bf636101d364237944c13cac55123e83f49fcaaa20eda1adf5cabed61884d

SHA512
8d250aa570ec2ca315f39747c04e35bcb17efbc2750493b4386027da47ec7eb40fe684f2ac4cb3134db4e02fa18812ab6c086b8114e57879e627ecf5fe5ca761

Download Submit
C:\Windows\System\mGiRJzo.exe

Filesize
1.3MB

MD5
da2868fe4c346499c63749d1aaef830a

SHA1
c5a6aa8d40f63800e1974e10259394da6f52b4cc

SHA256
012ac7b5a6711a9dae49a4e1e92f85298ba40b9add97e131f496931483147946

SHA512
6565f6c076fec03457583394cd0d8487cc0d7e326e627542d2ea4fd02d9523680ca98893deb5c2ec1a6fba68169977a6766e2d37a3492496b531f80bb59e156e

Download Submit
C:\Windows\System\nPYHTez.exe

Filesize
1.3MB

MD5
ec14fff90613751c3458b6b08421085a

SHA1
afd43a0afd159bc7725aa2402bce842aaaa2db24

SHA256
734f4ef8f3d3b270fdc1f5bb5457394831fe78584e1dc9ef944d75f002c2cdd6

SHA512
2ab81a5424569eb2867848532b59270111977b3a2a17f8508ab0f54ba66144b8c9d5d9e9dfd7db5e30514a60b68f56fc1ff6bbfa6afe411bcb6c638f5625d29c

Download Submit
C:\Windows\System\nbnJojf.exe

Filesize
1.3MB

MD5
512c5878ad8e592ab536bc34b6192714

SHA1
f3c68b925be99365ba2c4bd1837a24eeac5b5b8d

SHA256
6d602bbf58303fa62de0c83f7526a933563265aeb0f5c96ef78a0b4d4cede54b

SHA512
5d3f10107b80104f1a5be5a94445d3e0acdfdd7c7c2d8dd8728f2ff032201a1acdf86e68b0d4f03e6fc5dbded3a2fd73f48cbf278d8eb0f630e82d64d8ec52bd

Download Submit
C:\Windows\System\nzFXCvg.exe

Filesize
1.3MB

MD5
4f077793271d738ffde1f60c420ee56d

SHA1
40468733470591c185fc5cab0971ac196a2793a3

SHA256
ec5dd7d80916a51a674a569d6beba8ba2f1afffcbc3469897786ee1add9ae2f9

SHA512
85b7b5a3e99b5549841a9e5604d2aee050d3929a0d8e251aee796a57c8a80a46b13b448b880f0f52eece295849ca37f584bca2b501bc77d05a243894a3cb6f9d

Download Submit
C:\Windows\System\pyVVwjU.exe

Filesize
1.3MB

MD5
0ff73c14823c65e5c14328fd62138eb3

SHA1
5959569a64644cd997c013178cbe77f7c83c9b37

SHA256
ee4dfc3407c38b05c0eb4c21aaf2934dcf21981dda5b9fd71baed7a8d001b550

SHA512
92cbe2a25a2c665c5cd8530ff79350a0a93e3500bbcd5d5bb93b2f9fb4f777921adda41aca4837140d269b534eafe9f84a758eeb59c1d075c48d4a8f753b81f6

Download Submit
C:\Windows\System\rtpKZMn.exe

Filesize
1.3MB

MD5
f6a1d12608b92ccb439bd81e5041845f

SHA1
fb808d89f829c3ab0db1a7af9742a6cb9e29121c

SHA256
656c1cba84a10714d2213f7e523181005bfe796088ec9990351925f638d27d21

SHA512
c0755ea016940b40f6afb8fe7c215409acd084d83a87fe9041cfadd7df742432f5f937761d8531af8bb98d214cf7c768fe0ced246d90acc6b044d487cfaab33b

Download Submit
C:\Windows\System\sCvERVz.exe

Filesize
1.3MB

MD5
90a3994f84ddab10725a5f5077fa3974

SHA1
6b3848a21f9032c93f845be1bd54ad87977b7ea5

SHA256
25e3f1ca83540070c0bfb29fb52c6ba8d78db821b0bd0732970f2135f35fba05

SHA512
32f1af0533e264fa12826d7358e2a122e65964d011eabe93ed9b87080adff3b48d8185dbe8fbb6ed71194ba5eceaec4d09358a10b4fa5253595a738a22d1d970

Download Submit
C:\Windows\System\sPwktJF.exe

Filesize
1.3MB

MD5
a6115d38bdb416d16ba10b05d22faa82

SHA1
9da67188db577abd8d40b7951bcee3bbda9451ec

SHA256
001260c0f495966a032236184bc20ffe55f52c812574d40b679981d40beb1f83

SHA512
2c53d84e63ea736c2e60517c948d9122b0a3a12592814aa75ec8c6fb8edd48e184b8a846d88691d97e2f81a75509251078d41e3e11730b3fe91cc22eb8a31320

Download Submit
C:\Windows\System\xCyAWqK.exe

Filesize
1.3MB

MD5
481ba1557153bb881e91b963de6998bd

SHA1
aa97ea776398db4a142e746fc9073400d4c77df9

SHA256
da0e9d8da7d96c7d5e726a2a5fb42599136d35fbba8c17d500f6dcfe4a74d22e

SHA512
b7486fc342b2b4d78608816886746073f4c10d4d27e5e2da6aac1f952bcf8890f189bb8f5d0252fe19d2250f2878100582b718fa0bdff59c38e01c1c667ca21e

Download Submit
C:\Windows\System\xvRXrBX.exe

Filesize
1.3MB

MD5
28c79a7b355135ec08bd41e466649503

SHA1
3e9718547c133b151f4ddcfd3e6cef9321922719

SHA256
a357e454e0860799c9b783b4bc344431be9abff0b5d80a4668136084e4909b07

SHA512
cafde918b4e2cb47ad5abf03bf6def16aa1b4be3965ea0edd7c0352d260277f2a331edff7f93bee44ff22f2cb6799e128b172986a02adacc5a4dda8464751145

Download Submit
C:\Windows\System\ykuVJDm.exe

Filesize
1.3MB

MD5
869b2894600cfc0c334f03823a9c0899

SHA1
15b8f4379bd98ae5fb72ed55b0a81bc2e983d126

SHA256
2a02eb2d9fe8b9e12e43a1d18855d7b2c5b31caa4f598b168e5720a5f8f00cd5

SHA512
f743d1a0c0f564c3ce663e16b97917f3935be60b7dd321eb2fb3d405d821d8492905e1d30dcac80751e9bc6dd342901f01be3593a3aaedf66b6a7f3ebf56d732

Download Submit
C:\Windows\System\yolEQzz.exe

Filesize
1.3MB

MD5
5e0ad4a1885a0d75981713bcf8bd4802

SHA1
17f4e227507f64c6eb63bceecd812538a2d67cb4

SHA256
c578210165be3c0232f7eded5fe74a8a08c9d9f328b6507c71a429d10ac01f38

SHA512
13a852fdbce636f62f8b534bbd4532e911f95925b2bab7cf5abdf1c359147c677c41a62f600a1594a5a5b6ecfbd18f31e52d6f5609503eba1d3304833a5288d8

Download Submit
C:\Windows\System\zPvpisp.exe

Filesize
1.3MB

MD5
bb2e1c1593e2584599dc1b91f2a6b2cf

SHA1
025f5cb8d51bfead79822a18d229385542806ba6

SHA256
1a68fd00c041a0b4b2932ca60f72e153c2ceb6d7ecfd3832d3797d50e220a2b7

SHA512
e0b7fe06c4749efa32e0d90073e76c666bc9a222e869cf3ad7bd98a9c9a6093e612323e9d32847551bd3cfa9ec1151694ca28d9937ea6dbebd02a63d3f36dfa6

Download Submit
memory/756-655-0x00007FF6A8680000-0x00007FF6A89D1000-memory.dmp

Filesize
3.3MB

Download
memory/756-2236-0x00007FF6A8680000-0x00007FF6A89D1000-memory.dmp

Filesize
3.3MB

Download
memory/1020-279-0x00007FF6DFEC0000-0x00007FF6E0211000-memory.dmp

Filesize
3.3MB

Download
memory/1020-2219-0x00007FF6DFEC0000-0x00007FF6E0211000-memory.dmp

Filesize
3.3MB

Download
memory/1156-2229-0x00007FF70BEE0000-0x00007FF70C231000-memory.dmp

Filesize
3.3MB

Download
memory/1156-207-0x00007FF70BEE0000-0x00007FF70C231000-memory.dmp

Filesize
3.3MB

Download
memory/1156-2194-0x00007FF70BEE0000-0x00007FF70C231000-memory.dmp

Filesize
3.3MB

Download
memory/1248-2211-0x00007FF70A370000-0x00007FF70A6C1000-memory.dmp

Filesize
3.3MB

Download
memory/1248-376-0x00007FF70A370000-0x00007FF70A6C1000-memory.dmp

Filesize
3.3MB

Download
memory/1312-929-0x00007FF710550000-0x00007FF7108A1000-memory.dmp

Filesize
3.3MB

Download
memory/1312-2200-0x00007FF710550000-0x00007FF7108A1000-memory.dmp

Filesize
3.3MB

Download
memory/1800-928-0x00007FF69C060000-0x00007FF69C3B1000-memory.dmp

Filesize
3.3MB

Download
memory/1800-2311-0x00007FF69C060000-0x00007FF69C3B1000-memory.dmp

Filesize
3.3MB

Download
memory/2116-2193-0x00007FF7EC160000-0x00007FF7EC4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2116-2217-0x00007FF7EC160000-0x00007FF7EC4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2116-56-0x00007FF7EC160000-0x00007FF7EC4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2120-2215-0x00007FF623ED0000-0x00007FF624221000-memory.dmp

Filesize
3.3MB

Download
memory/2120-930-0x00007FF623ED0000-0x00007FF624221000-memory.dmp

Filesize
3.3MB

Download
memory/2148-2257-0x00007FF6A68C0000-0x00007FF6A6C11000-memory.dmp

Filesize
3.3MB

Download
memory/2148-650-0x00007FF6A68C0000-0x00007FF6A6C11000-memory.dmp

Filesize
3.3MB

Download
memory/2528-2233-0x00007FF74F590000-0x00007FF74F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2528-499-0x00007FF74F590000-0x00007FF74F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2720-2209-0x00007FF702F80000-0x00007FF7032D1000-memory.dmp

Filesize
3.3MB

Download
memory/2720-145-0x00007FF702F80000-0x00007FF7032D1000-memory.dmp

Filesize
3.3MB

Download
memory/2804-926-0x00007FF6DCED0000-0x00007FF6DD221000-memory.dmp

Filesize
3.3MB

Download
memory/2804-2281-0x00007FF6DCED0000-0x00007FF6DD221000-memory.dmp

Filesize
3.3MB

Download
memory/3028-920-0x00007FF60AE40000-0x00007FF60B191000-memory.dmp

Filesize
3.3MB

Download
memory/3028-2248-0x00007FF60AE40000-0x00007FF60B191000-memory.dmp

Filesize
3.3MB

Download
memory/3208-2244-0x00007FF6CD080000-0x00007FF6CD3D1000-memory.dmp

Filesize
3.3MB

Download
memory/3208-922-0x00007FF6CD080000-0x00007FF6CD3D1000-memory.dmp

Filesize
3.3MB

Download
memory/3216-2092-0x00007FF6E8130000-0x00007FF6E8481000-memory.dmp

Filesize
3.3MB

Download
memory/3216-0-0x00007FF6E8130000-0x00007FF6E8481000-memory.dmp

Filesize
3.3MB

Download
memory/3216-1-0x00000285A57A0000-0x00000285A57B0000-memory.dmp

Filesize
64KB

Download
memory/3284-270-0x00007FF681D20000-0x00007FF682071000-memory.dmp

Filesize
3.3MB

Download
memory/3284-2237-0x00007FF681D20000-0x00007FF682071000-memory.dmp

Filesize
3.3MB

Download
memory/3652-2254-0x00007FF62C230000-0x00007FF62C581000-memory.dmp

Filesize
3.3MB

Download
memory/3652-921-0x00007FF62C230000-0x00007FF62C581000-memory.dmp

Filesize
3.3MB

Download
memory/3696-2202-0x00007FF68B840000-0x00007FF68BB91000-memory.dmp

Filesize
3.3MB

Download
memory/3696-40-0x00007FF68B840000-0x00007FF68BB91000-memory.dmp

Filesize
3.3MB

Download
memory/3696-2191-0x00007FF68B840000-0x00007FF68BB91000-memory.dmp

Filesize
3.3MB

Download
memory/3824-2198-0x00007FF6CACA0000-0x00007FF6CAFF1000-memory.dmp

Filesize
3.3MB

Download
memory/3824-23-0x00007FF6CACA0000-0x00007FF6CAFF1000-memory.dmp

Filesize
3.3MB

Download
memory/3824-2190-0x00007FF6CACA0000-0x00007FF6CAFF1000-memory.dmp

Filesize
3.3MB

Download
memory/3940-2232-0x00007FF63AE20000-0x00007FF63B171000-memory.dmp

Filesize
3.3MB

Download
memory/3940-379-0x00007FF63AE20000-0x00007FF63B171000-memory.dmp

Filesize
3.3MB

Download
memory/4004-2243-0x00007FF6CBF50000-0x00007FF6CC2A1000-memory.dmp

Filesize
3.3MB

Download
memory/4004-925-0x00007FF6CBF50000-0x00007FF6CC2A1000-memory.dmp

Filesize
3.3MB

Download
memory/4016-501-0x00007FF620010000-0x00007FF620361000-memory.dmp

Filesize
3.3MB

Download
memory/4016-2250-0x00007FF620010000-0x00007FF620361000-memory.dmp

Filesize
3.3MB

Download
memory/4416-18-0x00007FF717190000-0x00007FF7174E1000-memory.dmp

Filesize
3.3MB

Download
memory/4416-2196-0x00007FF717190000-0x00007FF7174E1000-memory.dmp

Filesize
3.3MB

Download
memory/4420-931-0x00007FF623890000-0x00007FF623BE1000-memory.dmp

Filesize
3.3MB

Download
memory/4420-2213-0x00007FF623890000-0x00007FF623BE1000-memory.dmp

Filesize
3.3MB

Download
memory/4460-2204-0x00007FF688890000-0x00007FF688BE1000-memory.dmp

Filesize
3.3MB

Download
memory/4460-135-0x00007FF688890000-0x00007FF688BE1000-memory.dmp

Filesize
3.3MB

Download
memory/4468-2241-0x00007FF6B3F40000-0x00007FF6B4291000-memory.dmp

Filesize
3.3MB

Download
memory/4468-927-0x00007FF6B3F40000-0x00007FF6B4291000-memory.dmp

Filesize
3.3MB

Download
memory/4536-924-0x00007FF6B8230000-0x00007FF6B8581000-memory.dmp

Filesize
3.3MB

Download
memory/4536-2240-0x00007FF6B8230000-0x00007FF6B8581000-memory.dmp

Filesize
3.3MB

Download
memory/4568-2246-0x00007FF6B4E90000-0x00007FF6B51E1000-memory.dmp

Filesize
3.3MB

Download
memory/4568-883-0x00007FF6B4E90000-0x00007FF6B51E1000-memory.dmp

Filesize
3.3MB

Download
memory/4744-2252-0x00007FF615910000-0x00007FF615C61000-memory.dmp

Filesize
3.3MB

Download
memory/4744-923-0x00007FF615910000-0x00007FF615C61000-memory.dmp

Filesize
3.3MB

Download
memory/4888-2192-0x00007FF753360000-0x00007FF7536B1000-memory.dmp

Filesize
3.3MB

Download
memory/4888-2206-0x00007FF753360000-0x00007FF7536B1000-memory.dmp

Filesize
3.3MB

Download
memory/4888-93-0x00007FF753360000-0x00007FF7536B1000-memory.dmp

Filesize
3.3MB

Download