xmrig | 257d53cee1588cb53e9b647b05ff936490504e4fb4488b9d88a46d3fda9edaec

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
Size

1.5MB
MD5

0c863360600c2da2971eee8b99055790
SHA1

3507b6c8b5473d2ac9f41fc5689a271a6dce8740
SHA256

257d53cee1588cb53e9b647b05ff936490504e4fb4488b9d88a46d3fda9edaec
SHA512

4ad25a4015a01f8c00925f608961db177b1e24308275db09f98e4ed43fac4a1e2b9d4170906d4f2e183f96c47e47cbef7498837054abf8e939aa7b98d74de46f
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727uROGdN12s06EQnpPU04OJalokGcTSHK7dpvKS++Fz:ROdWCCi7/rahwNhXEAUkaDG7qfWzg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 53 IoCs

miner

resource	yara_rule
behavioral2/memory/396-33-0x00007FF644C90000-0x00007FF644FE1000-memory.dmp	xmrig
behavioral2/memory/3060-41-0x00007FF727C60000-0x00007FF727FB1000-memory.dmp	xmrig
behavioral2/memory/4020-100-0x00007FF7460E0000-0x00007FF746431000-memory.dmp	xmrig
behavioral2/memory/1848-148-0x00007FF716B10000-0x00007FF716E61000-memory.dmp	xmrig
behavioral2/memory/2992-139-0x00007FF6138A0000-0x00007FF613BF1000-memory.dmp	xmrig
behavioral2/memory/3488-135-0x00007FF7430A0000-0x00007FF7433F1000-memory.dmp	xmrig
behavioral2/memory/624-133-0x00007FF70BB90000-0x00007FF70BEE1000-memory.dmp	xmrig
behavioral2/memory/1864-124-0x00007FF704E10000-0x00007FF705161000-memory.dmp	xmrig
behavioral2/memory/4400-116-0x00007FF6B2640000-0x00007FF6B2991000-memory.dmp	xmrig
behavioral2/memory/4500-92-0x00007FF717BC0000-0x00007FF717F11000-memory.dmp	xmrig
behavioral2/memory/3048-87-0x00007FF702660000-0x00007FF7029B1000-memory.dmp	xmrig
behavioral2/memory/4668-84-0x00007FF73B620000-0x00007FF73B971000-memory.dmp	xmrig
behavioral2/memory/4412-83-0x00007FF77A9A0000-0x00007FF77ACF1000-memory.dmp	xmrig
behavioral2/memory/4792-36-0x00007FF71E900000-0x00007FF71EC51000-memory.dmp	xmrig
behavioral2/memory/1444-12-0x00007FF666910000-0x00007FF666C61000-memory.dmp	xmrig
behavioral2/memory/2748-2277-0x00007FF64F490000-0x00007FF64F7E1000-memory.dmp	xmrig
behavioral2/memory/3440-2279-0x00007FF79C610000-0x00007FF79C961000-memory.dmp	xmrig
behavioral2/memory/4780-2282-0x00007FF60A010000-0x00007FF60A361000-memory.dmp	xmrig
behavioral2/memory/1580-2312-0x00007FF6F0780000-0x00007FF6F0AD1000-memory.dmp	xmrig
behavioral2/memory/212-2313-0x00007FF74C030000-0x00007FF74C381000-memory.dmp	xmrig
behavioral2/memory/1920-2317-0x00007FF667C70000-0x00007FF667FC1000-memory.dmp	xmrig
behavioral2/memory/2512-2320-0x00007FF70A920000-0x00007FF70AC71000-memory.dmp	xmrig
behavioral2/memory/3660-2321-0x00007FF6E54C0000-0x00007FF6E5811000-memory.dmp	xmrig
behavioral2/memory/1444-2323-0x00007FF666910000-0x00007FF666C61000-memory.dmp	xmrig
behavioral2/memory/396-2325-0x00007FF644C90000-0x00007FF644FE1000-memory.dmp	xmrig
behavioral2/memory/1864-2327-0x00007FF704E10000-0x00007FF705161000-memory.dmp	xmrig
behavioral2/memory/4792-2331-0x00007FF71E900000-0x00007FF71EC51000-memory.dmp	xmrig
behavioral2/memory/3060-2330-0x00007FF727C60000-0x00007FF727FB1000-memory.dmp	xmrig
behavioral2/memory/2992-2335-0x00007FF6138A0000-0x00007FF613BF1000-memory.dmp	xmrig
behavioral2/memory/4500-2341-0x00007FF717BC0000-0x00007FF717F11000-memory.dmp	xmrig
behavioral2/memory/4412-2343-0x00007FF77A9A0000-0x00007FF77ACF1000-memory.dmp	xmrig
behavioral2/memory/1848-2338-0x00007FF716B10000-0x00007FF716E61000-memory.dmp	xmrig
behavioral2/memory/3488-2339-0x00007FF7430A0000-0x00007FF7433F1000-memory.dmp	xmrig
behavioral2/memory/624-2334-0x00007FF70BB90000-0x00007FF70BEE1000-memory.dmp	xmrig
behavioral2/memory/4668-2345-0x00007FF73B620000-0x00007FF73B971000-memory.dmp	xmrig
behavioral2/memory/4020-2349-0x00007FF7460E0000-0x00007FF746431000-memory.dmp	xmrig
behavioral2/memory/3048-2348-0x00007FF702660000-0x00007FF7029B1000-memory.dmp	xmrig
behavioral2/memory/5008-2382-0x00007FF671080000-0x00007FF6713D1000-memory.dmp	xmrig
behavioral2/memory/1276-2428-0x00007FF6382F0000-0x00007FF638641000-memory.dmp	xmrig
behavioral2/memory/1372-2445-0x00007FF6BEFD0000-0x00007FF6BF321000-memory.dmp	xmrig
behavioral2/memory/212-2461-0x00007FF74C030000-0x00007FF74C381000-memory.dmp	xmrig
behavioral2/memory/4780-2459-0x00007FF60A010000-0x00007FF60A361000-memory.dmp	xmrig
behavioral2/memory/1432-2457-0x00007FF6890F0000-0x00007FF689441000-memory.dmp	xmrig
behavioral2/memory/3440-2454-0x00007FF79C610000-0x00007FF79C961000-memory.dmp	xmrig
behavioral2/memory/2748-2456-0x00007FF64F490000-0x00007FF64F7E1000-memory.dmp	xmrig
behavioral2/memory/748-2451-0x00007FF7733F0000-0x00007FF773741000-memory.dmp	xmrig
behavioral2/memory/4468-2448-0x00007FF6B0C70000-0x00007FF6B0FC1000-memory.dmp	xmrig
behavioral2/memory/2852-2449-0x00007FF79D7E0000-0x00007FF79DB31000-memory.dmp	xmrig
behavioral2/memory/3660-2473-0x00007FF6E54C0000-0x00007FF6E5811000-memory.dmp	xmrig
behavioral2/memory/5008-2470-0x00007FF671080000-0x00007FF6713D1000-memory.dmp	xmrig
behavioral2/memory/2512-2469-0x00007FF70A920000-0x00007FF70AC71000-memory.dmp	xmrig
behavioral2/memory/1920-2465-0x00007FF667C70000-0x00007FF667FC1000-memory.dmp	xmrig
behavioral2/memory/1580-2463-0x00007FF6F0780000-0x00007FF6F0AD1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1444	FYnyQRD.exe
1864	TDWVKwz.exe
396	WmVOxtW.exe
3060	jBiNXOG.exe
624	JSxJFQz.exe
4792	CCMUxrj.exe
2992	coNxPnK.exe
3488	flFjUci.exe
1848	KPTBOcR.exe
4500	PfKbaFF.exe
4412	DOGEFCM.exe
4668	OddXNxW.exe
3048	BQJKCRb.exe
1276	sRGecEx.exe
1372	WwMDBrO.exe
4020	mjDBubx.exe
2852	oJSHkFA.exe
748	PMAYyBI.exe
4468	MvggDmo.exe
1432	YmkbbkW.exe
2748	gktiBeW.exe
3440	MwIgABR.exe
4780	EPBRJfn.exe
1580	PAGZGVu.exe
1920	SoRcHGt.exe
212	cPQdxRy.exe
2512	vcyNmam.exe
3660	InoKoJf.exe
5008	jDTaFIY.exe
3004	IUdjlXA.exe
1296	WxKegDU.exe
3288	pvioLSq.exe
3564	jVHkjGR.exe
2812	ujmITDs.exe
2792	VTAVszz.exe
4200	HwPoJBg.exe
4464	VpKwBFH.exe
4436	klZwBxY.exe
2532	ryVFYFt.exe
4932	bqsYyZt.exe
3536	YvrvSLJ.exe
2920	zyZKzSO.exe
684	LRqhwFq.exe
2408	aoxbUPQ.exe
3300	FHhiVjn.exe
1244	dFHIgiL.exe
4008	lCZWFhs.exe
2384	IIMVTeT.exe
2092	lCzYZyh.exe
2988	wUYVwAG.exe
1552	cvqNfTJ.exe
4408	UjAKwDD.exe
3376	pYoawuK.exe
2696	NYzTmiA.exe
688	acPmUTl.exe
2204	YgYKOXF.exe
2308	gdxOzxT.exe
2412	UCAgakJ.exe
4704	ffHKgQy.exe
2288	JETyIrX.exe
3504	NViDFTI.exe
1080	YDwLEnt.exe
1536	cQVTVYV.exe
1236	BxeJZor.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4400-0-0x00007FF6B2640000-0x00007FF6B2991000-memory.dmp	upx
behavioral2/files/0x0008000000023430-4.dat	upx
behavioral2/files/0x0007000000023434-14.dat	upx
behavioral2/files/0x0007000000023435-13.dat	upx
behavioral2/files/0x0007000000023438-29.dat	upx
behavioral2/memory/396-33-0x00007FF644C90000-0x00007FF644FE1000-memory.dmp	upx
behavioral2/memory/3060-41-0x00007FF727C60000-0x00007FF727FB1000-memory.dmp	upx
behavioral2/memory/2992-55-0x00007FF6138A0000-0x00007FF613BF1000-memory.dmp	upx
behavioral2/files/0x000700000002343c-71.dat	upx
behavioral2/files/0x000700000002343f-77.dat	upx
behavioral2/files/0x0007000000023442-88.dat	upx
behavioral2/memory/4020-100-0x00007FF7460E0000-0x00007FF746431000-memory.dmp	upx
behavioral2/files/0x0007000000023445-108.dat	upx
behavioral2/memory/3440-125-0x00007FF79C610000-0x00007FF79C961000-memory.dmp	upx
behavioral2/files/0x000700000002344e-149.dat	upx
behavioral2/files/0x000700000002345a-188.dat	upx
behavioral2/files/0x0007000000023463-215.dat	upx
behavioral2/files/0x0007000000023462-212.dat	upx
behavioral2/files/0x0007000000023461-209.dat	upx
behavioral2/files/0x0007000000023460-206.dat	upx
behavioral2/files/0x000700000002345f-203.dat	upx
behavioral2/files/0x000700000002345e-200.dat	upx
behavioral2/files/0x000700000002345d-197.dat	upx
behavioral2/files/0x000700000002345c-194.dat	upx
behavioral2/files/0x000700000002345b-191.dat	upx
behavioral2/files/0x0007000000023459-185.dat	upx
behavioral2/files/0x0007000000023458-182.dat	upx
behavioral2/files/0x0007000000023457-179.dat	upx
behavioral2/files/0x0007000000023456-175.dat	upx
behavioral2/files/0x0007000000023455-173.dat	upx
behavioral2/files/0x0007000000023454-170.dat	upx
behavioral2/files/0x0007000000023453-167.dat	upx
behavioral2/files/0x0007000000023452-164.dat	upx
behavioral2/files/0x0007000000023451-161.dat	upx
behavioral2/files/0x0007000000023450-158.dat	upx
behavioral2/memory/5008-157-0x00007FF671080000-0x00007FF6713D1000-memory.dmp	upx
behavioral2/files/0x000700000002344f-154.dat	upx
behavioral2/memory/3660-153-0x00007FF6E54C0000-0x00007FF6E5811000-memory.dmp	upx
behavioral2/memory/2512-152-0x00007FF70A920000-0x00007FF70AC71000-memory.dmp	upx
behavioral2/memory/1848-148-0x00007FF716B10000-0x00007FF716E61000-memory.dmp	upx
behavioral2/files/0x000700000002344d-145.dat	upx
behavioral2/memory/212-144-0x00007FF74C030000-0x00007FF74C381000-memory.dmp	upx
behavioral2/files/0x000700000002344c-141.dat	upx
behavioral2/memory/1920-140-0x00007FF667C70000-0x00007FF667FC1000-memory.dmp	upx
behavioral2/memory/2992-139-0x00007FF6138A0000-0x00007FF613BF1000-memory.dmp	upx
behavioral2/files/0x000700000002344b-136.dat	upx
behavioral2/memory/3488-135-0x00007FF7430A0000-0x00007FF7433F1000-memory.dmp	upx
behavioral2/memory/1580-134-0x00007FF6F0780000-0x00007FF6F0AD1000-memory.dmp	upx
behavioral2/memory/624-133-0x00007FF70BB90000-0x00007FF70BEE1000-memory.dmp	upx
behavioral2/files/0x000700000002344a-130.dat	upx
behavioral2/memory/4780-129-0x00007FF60A010000-0x00007FF60A361000-memory.dmp	upx
behavioral2/files/0x0007000000023449-126.dat	upx
behavioral2/memory/1864-124-0x00007FF704E10000-0x00007FF705161000-memory.dmp	upx
behavioral2/files/0x0007000000023448-121.dat	upx
behavioral2/memory/2748-120-0x00007FF64F490000-0x00007FF64F7E1000-memory.dmp	upx
behavioral2/files/0x0007000000023447-117.dat	upx
behavioral2/memory/4400-116-0x00007FF6B2640000-0x00007FF6B2991000-memory.dmp	upx
behavioral2/memory/1432-115-0x00007FF6890F0000-0x00007FF689441000-memory.dmp	upx
behavioral2/files/0x0007000000023446-112.dat	upx
behavioral2/memory/4468-111-0x00007FF6B0C70000-0x00007FF6B0FC1000-memory.dmp	upx
behavioral2/memory/748-107-0x00007FF7733F0000-0x00007FF773741000-memory.dmp	upx
behavioral2/files/0x0007000000023444-104.dat	upx
behavioral2/memory/2852-103-0x00007FF79D7E0000-0x00007FF79DB31000-memory.dmp	upx
behavioral2/files/0x0007000000023443-99.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WxKegDU.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\IgUtThO.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\mEkkdWX.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\zaCCsWz.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\YgYKOXF.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\yavIupW.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\IhspqCK.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\tGUmpYY.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\CDraJrc.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\FyaklNl.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\TWogfmO.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\oFODSxP.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\jBiNXOG.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\aoxbUPQ.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\dFHIgiL.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\ClKDEve.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\qbidVrc.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\tqHLEjF.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\XpfQgyu.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\EPBRJfn.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\TAdCDoJ.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\TRDwidn.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\khDVKvf.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\SoRcHGt.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\EYnqzAj.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\ObfxClm.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\UGYvoKG.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\ARgEihT.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\mYitHtk.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\UjAKwDD.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\pYoawuK.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\cJbnTXj.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\WdtIDmT.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\RLflFOk.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\dMlptwr.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\rwGuRkm.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\tjbbPoZ.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\MwIgABR.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\gPoNFdw.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\LkszANk.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\XGFFCzL.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\frrPqMc.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\ojlLQIN.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\glzCnwL.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\NXCDxjB.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\VlYoGdo.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\ZhoAiLd.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\EdwtmHT.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\VAUQAWB.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\RvPNnyn.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\WomoohC.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\FzttCqt.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\KWEYHsj.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\aHHRjsC.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\Yybnjit.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\QaREvfC.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\vURhRvW.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\TVTljgT.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\MhFoKOo.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\pHXHqTU.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\oLokoZQ.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\mzWTYsi.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\fcHdEtF.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
File created	C:\Windows\System\UCkJSoK.exe	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1444	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	83
PID 4400 wrote to memory of 1444	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	83
PID 4400 wrote to memory of 396	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	84
PID 4400 wrote to memory of 396	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	84
PID 4400 wrote to memory of 1864	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	85
PID 4400 wrote to memory of 1864	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	85
PID 4400 wrote to memory of 3060	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	86
PID 4400 wrote to memory of 3060	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	86
PID 4400 wrote to memory of 624	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	87
PID 4400 wrote to memory of 624	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	87
PID 4400 wrote to memory of 4792	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	88
PID 4400 wrote to memory of 4792	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	88
PID 4400 wrote to memory of 2992	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	89
PID 4400 wrote to memory of 2992	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	89
PID 4400 wrote to memory of 3488	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	90
PID 4400 wrote to memory of 3488	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	90
PID 4400 wrote to memory of 1848	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	91
PID 4400 wrote to memory of 1848	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	91
PID 4400 wrote to memory of 4500	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	92
PID 4400 wrote to memory of 4500	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	92
PID 4400 wrote to memory of 4412	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	93
PID 4400 wrote to memory of 4412	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	93
PID 4400 wrote to memory of 4668	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	94
PID 4400 wrote to memory of 4668	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	94
PID 4400 wrote to memory of 3048	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	95
PID 4400 wrote to memory of 3048	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	95
PID 4400 wrote to memory of 1276	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	96
PID 4400 wrote to memory of 1276	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	96
PID 4400 wrote to memory of 1372	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	97
PID 4400 wrote to memory of 1372	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	97
PID 4400 wrote to memory of 4020	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	98
PID 4400 wrote to memory of 4020	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	98
PID 4400 wrote to memory of 2852	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	99
PID 4400 wrote to memory of 2852	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	99
PID 4400 wrote to memory of 748	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	100
PID 4400 wrote to memory of 748	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	100
PID 4400 wrote to memory of 4468	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	101
PID 4400 wrote to memory of 4468	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	101
PID 4400 wrote to memory of 1432	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	102
PID 4400 wrote to memory of 1432	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	102
PID 4400 wrote to memory of 2748	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	103
PID 4400 wrote to memory of 2748	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	103
PID 4400 wrote to memory of 3440	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	104
PID 4400 wrote to memory of 3440	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	104
PID 4400 wrote to memory of 4780	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	105
PID 4400 wrote to memory of 4780	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	105
PID 4400 wrote to memory of 1580	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	106
PID 4400 wrote to memory of 1580	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	106
PID 4400 wrote to memory of 1920	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	107
PID 4400 wrote to memory of 1920	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	107
PID 4400 wrote to memory of 212	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	108
PID 4400 wrote to memory of 212	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	108
PID 4400 wrote to memory of 2512	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	109
PID 4400 wrote to memory of 2512	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	109
PID 4400 wrote to memory of 3660	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	110
PID 4400 wrote to memory of 3660	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	110
PID 4400 wrote to memory of 5008	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	111
PID 4400 wrote to memory of 5008	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	111
PID 4400 wrote to memory of 3004	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	112
PID 4400 wrote to memory of 3004	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	112
PID 4400 wrote to memory of 1296	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	113
PID 4400 wrote to memory of 1296	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	113
PID 4400 wrote to memory of 3288	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	114
PID 4400 wrote to memory of 3288	4400	0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0c863360600c2da2971eee8b99055790_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\System\FYnyQRD.exe
  C:\Windows\System\FYnyQRD.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\WmVOxtW.exe
  C:\Windows\System\WmVOxtW.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\TDWVKwz.exe
  C:\Windows\System\TDWVKwz.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\jBiNXOG.exe
  C:\Windows\System\jBiNXOG.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\JSxJFQz.exe
  C:\Windows\System\JSxJFQz.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\CCMUxrj.exe
  C:\Windows\System\CCMUxrj.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\coNxPnK.exe
  C:\Windows\System\coNxPnK.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\flFjUci.exe
  C:\Windows\System\flFjUci.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\KPTBOcR.exe
  C:\Windows\System\KPTBOcR.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\PfKbaFF.exe
  C:\Windows\System\PfKbaFF.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\DOGEFCM.exe
  C:\Windows\System\DOGEFCM.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\OddXNxW.exe
  C:\Windows\System\OddXNxW.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\BQJKCRb.exe
  C:\Windows\System\BQJKCRb.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\sRGecEx.exe
  C:\Windows\System\sRGecEx.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\WwMDBrO.exe
  C:\Windows\System\WwMDBrO.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\mjDBubx.exe
  C:\Windows\System\mjDBubx.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\oJSHkFA.exe
  C:\Windows\System\oJSHkFA.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\PMAYyBI.exe
  C:\Windows\System\PMAYyBI.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\MvggDmo.exe
  C:\Windows\System\MvggDmo.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\YmkbbkW.exe
  C:\Windows\System\YmkbbkW.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\gktiBeW.exe
  C:\Windows\System\gktiBeW.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\MwIgABR.exe
  C:\Windows\System\MwIgABR.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\EPBRJfn.exe
  C:\Windows\System\EPBRJfn.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\PAGZGVu.exe
  C:\Windows\System\PAGZGVu.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\SoRcHGt.exe
  C:\Windows\System\SoRcHGt.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\cPQdxRy.exe
  C:\Windows\System\cPQdxRy.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\vcyNmam.exe
  C:\Windows\System\vcyNmam.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\InoKoJf.exe
  C:\Windows\System\InoKoJf.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\jDTaFIY.exe
  C:\Windows\System\jDTaFIY.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\IUdjlXA.exe
  C:\Windows\System\IUdjlXA.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\WxKegDU.exe
  C:\Windows\System\WxKegDU.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\pvioLSq.exe
  C:\Windows\System\pvioLSq.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\jVHkjGR.exe
  C:\Windows\System\jVHkjGR.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\ujmITDs.exe
  C:\Windows\System\ujmITDs.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\VTAVszz.exe
  C:\Windows\System\VTAVszz.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\HwPoJBg.exe
  C:\Windows\System\HwPoJBg.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\VpKwBFH.exe
  C:\Windows\System\VpKwBFH.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\klZwBxY.exe
  C:\Windows\System\klZwBxY.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\ryVFYFt.exe
  C:\Windows\System\ryVFYFt.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\bqsYyZt.exe
  C:\Windows\System\bqsYyZt.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\YvrvSLJ.exe
  C:\Windows\System\YvrvSLJ.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\zyZKzSO.exe
  C:\Windows\System\zyZKzSO.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\LRqhwFq.exe
  C:\Windows\System\LRqhwFq.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\aoxbUPQ.exe
  C:\Windows\System\aoxbUPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\FHhiVjn.exe
  C:\Windows\System\FHhiVjn.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\dFHIgiL.exe
  C:\Windows\System\dFHIgiL.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\lCZWFhs.exe
  C:\Windows\System\lCZWFhs.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\IIMVTeT.exe
  C:\Windows\System\IIMVTeT.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\lCzYZyh.exe
  C:\Windows\System\lCzYZyh.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\wUYVwAG.exe
  C:\Windows\System\wUYVwAG.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\cvqNfTJ.exe
  C:\Windows\System\cvqNfTJ.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\UjAKwDD.exe
  C:\Windows\System\UjAKwDD.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\pYoawuK.exe
  C:\Windows\System\pYoawuK.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\NYzTmiA.exe
  C:\Windows\System\NYzTmiA.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\acPmUTl.exe
  C:\Windows\System\acPmUTl.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\YgYKOXF.exe
  C:\Windows\System\YgYKOXF.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\gdxOzxT.exe
  C:\Windows\System\gdxOzxT.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\UCAgakJ.exe
  C:\Windows\System\UCAgakJ.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ffHKgQy.exe
  C:\Windows\System\ffHKgQy.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\JETyIrX.exe
  C:\Windows\System\JETyIrX.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\NViDFTI.exe
  C:\Windows\System\NViDFTI.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\YDwLEnt.exe
  C:\Windows\System\YDwLEnt.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\cQVTVYV.exe
  C:\Windows\System\cQVTVYV.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\BxeJZor.exe
  C:\Windows\System\BxeJZor.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\jMTdinS.exe
  C:\Windows\System\jMTdinS.exe
  2⤵
  PID:1632
- C:\Windows\System\dPmhnFL.exe
  C:\Windows\System\dPmhnFL.exe
  2⤵
  PID:1888
- C:\Windows\System\wltJRhY.exe
  C:\Windows\System\wltJRhY.exe
  2⤵
  PID:4972
- C:\Windows\System\qmlPHvU.exe
  C:\Windows\System\qmlPHvU.exe
  2⤵
  PID:4032
- C:\Windows\System\dKwbGUy.exe
  C:\Windows\System\dKwbGUy.exe
  2⤵
  PID:4340
- C:\Windows\System\IDHzxnH.exe
  C:\Windows\System\IDHzxnH.exe
  2⤵
  PID:4328
- C:\Windows\System\CVcHxBw.exe
  C:\Windows\System\CVcHxBw.exe
  2⤵
  PID:1272
- C:\Windows\System\VMkBSXr.exe
  C:\Windows\System\VMkBSXr.exe
  2⤵
  PID:1852
- C:\Windows\System\Yybnjit.exe
  C:\Windows\System\Yybnjit.exe
  2⤵
  PID:3108
- C:\Windows\System\ABMKBst.exe
  C:\Windows\System\ABMKBst.exe
  2⤵
  PID:4384
- C:\Windows\System\iKnuJfv.exe
  C:\Windows\System\iKnuJfv.exe
  2⤵
  PID:388
- C:\Windows\System\opHuLwE.exe
  C:\Windows\System\opHuLwE.exe
  2⤵
  PID:1728
- C:\Windows\System\Rycfvlg.exe
  C:\Windows\System\Rycfvlg.exe
  2⤵
  PID:60
- C:\Windows\System\FUtvWAx.exe
  C:\Windows\System\FUtvWAx.exe
  2⤵
  PID:4968
- C:\Windows\System\lBxeTcj.exe
  C:\Windows\System\lBxeTcj.exe
  2⤵
  PID:3052
- C:\Windows\System\IKpWDVX.exe
  C:\Windows\System\IKpWDVX.exe
  2⤵
  PID:4720
- C:\Windows\System\xtjjIvv.exe
  C:\Windows\System\xtjjIvv.exe
  2⤵
  PID:2624
- C:\Windows\System\rNAAQhX.exe
  C:\Windows\System\rNAAQhX.exe
  2⤵
  PID:3928
- C:\Windows\System\HftYUGJ.exe
  C:\Windows\System\HftYUGJ.exe
  2⤵
  PID:920
- C:\Windows\System\IIFoHjZ.exe
  C:\Windows\System\IIFoHjZ.exe
  2⤵
  PID:1932
- C:\Windows\System\bYyHoWr.exe
  C:\Windows\System\bYyHoWr.exe
  2⤵
  PID:2228
- C:\Windows\System\VlYoGdo.exe
  C:\Windows\System\VlYoGdo.exe
  2⤵
  PID:1280
- C:\Windows\System\aoKYMWC.exe
  C:\Windows\System\aoKYMWC.exe
  2⤵
  PID:3704
- C:\Windows\System\SDNkQZB.exe
  C:\Windows\System\SDNkQZB.exe
  2⤵
  PID:5004
- C:\Windows\System\HobAaCq.exe
  C:\Windows\System\HobAaCq.exe
  2⤵
  PID:4420
- C:\Windows\System\QumqJVN.exe
  C:\Windows\System\QumqJVN.exe
  2⤵
  PID:5072
- C:\Windows\System\LaTRvaY.exe
  C:\Windows\System\LaTRvaY.exe
  2⤵
  PID:3240
- C:\Windows\System\VJQfhtP.exe
  C:\Windows\System\VJQfhtP.exe
  2⤵
  PID:4348
- C:\Windows\System\lNCxRhv.exe
  C:\Windows\System\lNCxRhv.exe
  2⤵
  PID:5092
- C:\Windows\System\ocKNpkd.exe
  C:\Windows\System\ocKNpkd.exe
  2⤵
  PID:5036
- C:\Windows\System\kSkprwB.exe
  C:\Windows\System\kSkprwB.exe
  2⤵
  PID:3608
- C:\Windows\System\PiGWDIl.exe
  C:\Windows\System\PiGWDIl.exe
  2⤵
  PID:3700
- C:\Windows\System\caPTqOF.exe
  C:\Windows\System\caPTqOF.exe
  2⤵
  PID:2044
- C:\Windows\System\taYwiGb.exe
  C:\Windows\System\taYwiGb.exe
  2⤵
  PID:5096
- C:\Windows\System\GzoKszC.exe
  C:\Windows\System\GzoKszC.exe
  2⤵
  PID:3696
- C:\Windows\System\mmyumEj.exe
  C:\Windows\System\mmyumEj.exe
  2⤵
  PID:3568
- C:\Windows\System\zOAYdnu.exe
  C:\Windows\System\zOAYdnu.exe
  2⤵
  PID:3668
- C:\Windows\System\mrFKeIF.exe
  C:\Windows\System\mrFKeIF.exe
  2⤵
  PID:2484
- C:\Windows\System\ClKDEve.exe
  C:\Windows\System\ClKDEve.exe
  2⤵
  PID:2592
- C:\Windows\System\FIkzOrx.exe
  C:\Windows\System\FIkzOrx.exe
  2⤵
  PID:872
- C:\Windows\System\mFNbSSk.exe
  C:\Windows\System\mFNbSSk.exe
  2⤵
  PID:4772
- C:\Windows\System\DUTTLum.exe
  C:\Windows\System\DUTTLum.exe
  2⤵
  PID:4536
- C:\Windows\System\MmluYYB.exe
  C:\Windows\System\MmluYYB.exe
  2⤵
  PID:2284
- C:\Windows\System\ecZsRvW.exe
  C:\Windows\System\ecZsRvW.exe
  2⤵
  PID:1344
- C:\Windows\System\mHZNrmW.exe
  C:\Windows\System\mHZNrmW.exe
  2⤵
  PID:952
- C:\Windows\System\MngOtWH.exe
  C:\Windows\System\MngOtWH.exe
  2⤵
  PID:4564
- C:\Windows\System\IxfAzgb.exe
  C:\Windows\System\IxfAzgb.exe
  2⤵
  PID:4476
- C:\Windows\System\NodcLZt.exe
  C:\Windows\System\NodcLZt.exe
  2⤵
  PID:1212
- C:\Windows\System\ZfwgpmA.exe
  C:\Windows\System\ZfwgpmA.exe
  2⤵
  PID:2240
- C:\Windows\System\IAxaIno.exe
  C:\Windows\System\IAxaIno.exe
  2⤵
  PID:1568
- C:\Windows\System\cRUxBao.exe
  C:\Windows\System\cRUxBao.exe
  2⤵
  PID:2008
- C:\Windows\System\nWxrocI.exe
  C:\Windows\System\nWxrocI.exe
  2⤵
  PID:4960
- C:\Windows\System\DUUinDy.exe
  C:\Windows\System\DUUinDy.exe
  2⤵
  PID:2632
- C:\Windows\System\mmwiIQt.exe
  C:\Windows\System\mmwiIQt.exe
  2⤵
  PID:1052
- C:\Windows\System\VsiPyei.exe
  C:\Windows\System\VsiPyei.exe
  2⤵
  PID:4076
- C:\Windows\System\QhvmdOP.exe
  C:\Windows\System\QhvmdOP.exe
  2⤵
  PID:224
- C:\Windows\System\TURoJNW.exe
  C:\Windows\System\TURoJNW.exe
  2⤵
  PID:4132
- C:\Windows\System\CJyoShp.exe
  C:\Windows\System\CJyoShp.exe
  2⤵
  PID:5136
- C:\Windows\System\qQvddNx.exe
  C:\Windows\System\qQvddNx.exe
  2⤵
  PID:5152
- C:\Windows\System\cFGNfbx.exe
  C:\Windows\System\cFGNfbx.exe
  2⤵
  PID:5168
- C:\Windows\System\TCKKnjJ.exe
  C:\Windows\System\TCKKnjJ.exe
  2⤵
  PID:5184
- C:\Windows\System\OyfzCMK.exe
  C:\Windows\System\OyfzCMK.exe
  2⤵
  PID:5200
- C:\Windows\System\KaDOBrz.exe
  C:\Windows\System\KaDOBrz.exe
  2⤵
  PID:5216
- C:\Windows\System\WoBVUvm.exe
  C:\Windows\System\WoBVUvm.exe
  2⤵
  PID:5232
- C:\Windows\System\YDfESNO.exe
  C:\Windows\System\YDfESNO.exe
  2⤵
  PID:5248
- C:\Windows\System\FNRGAbV.exe
  C:\Windows\System\FNRGAbV.exe
  2⤵
  PID:5264
- C:\Windows\System\dHSnrtM.exe
  C:\Windows\System\dHSnrtM.exe
  2⤵
  PID:5280
- C:\Windows\System\ctXBBQY.exe
  C:\Windows\System\ctXBBQY.exe
  2⤵
  PID:5296
- C:\Windows\System\djpdyby.exe
  C:\Windows\System\djpdyby.exe
  2⤵
  PID:5312
- C:\Windows\System\CPrpnXh.exe
  C:\Windows\System\CPrpnXh.exe
  2⤵
  PID:5328
- C:\Windows\System\bIXTLwd.exe
  C:\Windows\System\bIXTLwd.exe
  2⤵
  PID:5344
- C:\Windows\System\oMAcnRR.exe
  C:\Windows\System\oMAcnRR.exe
  2⤵
  PID:5360
- C:\Windows\System\knMVRqn.exe
  C:\Windows\System\knMVRqn.exe
  2⤵
  PID:5376
- C:\Windows\System\XbtaQFh.exe
  C:\Windows\System\XbtaQFh.exe
  2⤵
  PID:5392
- C:\Windows\System\xvJpJoj.exe
  C:\Windows\System\xvJpJoj.exe
  2⤵
  PID:5408
- C:\Windows\System\JAhteEB.exe
  C:\Windows\System\JAhteEB.exe
  2⤵
  PID:5424
- C:\Windows\System\TAdCDoJ.exe
  C:\Windows\System\TAdCDoJ.exe
  2⤵
  PID:5440
- C:\Windows\System\FhEbNQg.exe
  C:\Windows\System\FhEbNQg.exe
  2⤵
  PID:5456
- C:\Windows\System\TRDwidn.exe
  C:\Windows\System\TRDwidn.exe
  2⤵
  PID:5472
- C:\Windows\System\bKsobpJ.exe
  C:\Windows\System\bKsobpJ.exe
  2⤵
  PID:5488
- C:\Windows\System\FvwmpSD.exe
  C:\Windows\System\FvwmpSD.exe
  2⤵
  PID:5504
- C:\Windows\System\EnLCAnr.exe
  C:\Windows\System\EnLCAnr.exe
  2⤵
  PID:5520
- C:\Windows\System\sokdAQi.exe
  C:\Windows\System\sokdAQi.exe
  2⤵
  PID:5536
- C:\Windows\System\fBXtnyi.exe
  C:\Windows\System\fBXtnyi.exe
  2⤵
  PID:5552
- C:\Windows\System\IIqvrJI.exe
  C:\Windows\System\IIqvrJI.exe
  2⤵
  PID:5568
- C:\Windows\System\KNxqtxu.exe
  C:\Windows\System\KNxqtxu.exe
  2⤵
  PID:5584
- C:\Windows\System\rUrrxSj.exe
  C:\Windows\System\rUrrxSj.exe
  2⤵
  PID:5600
- C:\Windows\System\zTtpRcZ.exe
  C:\Windows\System\zTtpRcZ.exe
  2⤵
  PID:5616
- C:\Windows\System\DihEffc.exe
  C:\Windows\System\DihEffc.exe
  2⤵
  PID:5632
- C:\Windows\System\sqnxFAM.exe
  C:\Windows\System\sqnxFAM.exe
  2⤵
  PID:5648
- C:\Windows\System\NzmTvwb.exe
  C:\Windows\System\NzmTvwb.exe
  2⤵
  PID:5664
- C:\Windows\System\WYEMWOY.exe
  C:\Windows\System\WYEMWOY.exe
  2⤵
  PID:5680
- C:\Windows\System\cHGNVAK.exe
  C:\Windows\System\cHGNVAK.exe
  2⤵
  PID:5696
- C:\Windows\System\EOrzzyI.exe
  C:\Windows\System\EOrzzyI.exe
  2⤵
  PID:5712
- C:\Windows\System\llXnHKc.exe
  C:\Windows\System\llXnHKc.exe
  2⤵
  PID:5728
- C:\Windows\System\vVZMbkP.exe
  C:\Windows\System\vVZMbkP.exe
  2⤵
  PID:5744
- C:\Windows\System\NeDNHvu.exe
  C:\Windows\System\NeDNHvu.exe
  2⤵
  PID:5760
- C:\Windows\System\mSYJtHf.exe
  C:\Windows\System\mSYJtHf.exe
  2⤵
  PID:5776
- C:\Windows\System\UnbtwiE.exe
  C:\Windows\System\UnbtwiE.exe
  2⤵
  PID:5792
- C:\Windows\System\YGEIYQn.exe
  C:\Windows\System\YGEIYQn.exe
  2⤵
  PID:5808
- C:\Windows\System\WHcmkfW.exe
  C:\Windows\System\WHcmkfW.exe
  2⤵
  PID:5824
- C:\Windows\System\wJdYoak.exe
  C:\Windows\System\wJdYoak.exe
  2⤵
  PID:5840
- C:\Windows\System\dMTeZax.exe
  C:\Windows\System\dMTeZax.exe
  2⤵
  PID:5856
- C:\Windows\System\humPxNA.exe
  C:\Windows\System\humPxNA.exe
  2⤵
  PID:5872
- C:\Windows\System\ctDjjSW.exe
  C:\Windows\System\ctDjjSW.exe
  2⤵
  PID:5888
- C:\Windows\System\wzySlxm.exe
  C:\Windows\System\wzySlxm.exe
  2⤵
  PID:5904
- C:\Windows\System\tXTkXSE.exe
  C:\Windows\System\tXTkXSE.exe
  2⤵
  PID:5920
- C:\Windows\System\QaREvfC.exe
  C:\Windows\System\QaREvfC.exe
  2⤵
  PID:5936
- C:\Windows\System\wEAgZoF.exe
  C:\Windows\System\wEAgZoF.exe
  2⤵
  PID:5952
- C:\Windows\System\hohAiSA.exe
  C:\Windows\System\hohAiSA.exe
  2⤵
  PID:5968
- C:\Windows\System\OCBBLkI.exe
  C:\Windows\System\OCBBLkI.exe
  2⤵
  PID:5984
- C:\Windows\System\jsPqrTn.exe
  C:\Windows\System\jsPqrTn.exe
  2⤵
  PID:6000
- C:\Windows\System\tfhDvDi.exe
  C:\Windows\System\tfhDvDi.exe
  2⤵
  PID:6016
- C:\Windows\System\Kohdqph.exe
  C:\Windows\System\Kohdqph.exe
  2⤵
  PID:6032
- C:\Windows\System\CQwcLUn.exe
  C:\Windows\System\CQwcLUn.exe
  2⤵
  PID:6048
- C:\Windows\System\GAPgxqu.exe
  C:\Windows\System\GAPgxqu.exe
  2⤵
  PID:6064
- C:\Windows\System\aIDQGrT.exe
  C:\Windows\System\aIDQGrT.exe
  2⤵
  PID:6080
- C:\Windows\System\yvtJUPv.exe
  C:\Windows\System\yvtJUPv.exe
  2⤵
  PID:6096
- C:\Windows\System\MjlvmXm.exe
  C:\Windows\System\MjlvmXm.exe
  2⤵
  PID:6112
- C:\Windows\System\NUdAMss.exe
  C:\Windows\System\NUdAMss.exe
  2⤵
  PID:6128
- C:\Windows\System\UVxqUGU.exe
  C:\Windows\System\UVxqUGU.exe
  2⤵
  PID:1716
- C:\Windows\System\KxSZtNs.exe
  C:\Windows\System\KxSZtNs.exe
  2⤵
  PID:4688
- C:\Windows\System\SjFttkL.exe
  C:\Windows\System\SjFttkL.exe
  2⤵
  PID:2428
- C:\Windows\System\uwoIfAO.exe
  C:\Windows\System\uwoIfAO.exe
  2⤵
  PID:1012
- C:\Windows\System\WfwDomm.exe
  C:\Windows\System\WfwDomm.exe
  2⤵
  PID:2888
- C:\Windows\System\PLSPGKs.exe
  C:\Windows\System\PLSPGKs.exe
  2⤵
  PID:3544
- C:\Windows\System\aPihOPk.exe
  C:\Windows\System\aPihOPk.exe
  2⤵
  PID:668
- C:\Windows\System\AYmbTwl.exe
  C:\Windows\System\AYmbTwl.exe
  2⤵
  PID:864
- C:\Windows\System\EQzeHdN.exe
  C:\Windows\System\EQzeHdN.exe
  2⤵
  PID:1084
- C:\Windows\System\qXGFgHu.exe
  C:\Windows\System\qXGFgHu.exe
  2⤵
  PID:5044
- C:\Windows\System\ruanobJ.exe
  C:\Windows\System\ruanobJ.exe
  2⤵
  PID:3260
- C:\Windows\System\ZWqTHal.exe
  C:\Windows\System\ZWqTHal.exe
  2⤵
  PID:2300
- C:\Windows\System\zBpKBFm.exe
  C:\Windows\System\zBpKBFm.exe
  2⤵
  PID:4964
- C:\Windows\System\XxTmyYu.exe
  C:\Windows\System\XxTmyYu.exe
  2⤵
  PID:1048
- C:\Windows\System\cJbnTXj.exe
  C:\Windows\System\cJbnTXj.exe
  2⤵
  PID:1284
- C:\Windows\System\VMnVHWb.exe
  C:\Windows\System\VMnVHWb.exe
  2⤵
  PID:220
- C:\Windows\System\wrYvBGI.exe
  C:\Windows\System\wrYvBGI.exe
  2⤵
  PID:5132
- C:\Windows\System\yavIupW.exe
  C:\Windows\System\yavIupW.exe
  2⤵
  PID:5164
- C:\Windows\System\BoeKjTS.exe
  C:\Windows\System\BoeKjTS.exe
  2⤵
  PID:4396
- C:\Windows\System\ciUnTMw.exe
  C:\Windows\System\ciUnTMw.exe
  2⤵
  PID:3996
- C:\Windows\System\hfFXmlK.exe
  C:\Windows\System\hfFXmlK.exe
  2⤵
  PID:5244
- C:\Windows\System\Uprzpxt.exe
  C:\Windows\System\Uprzpxt.exe
  2⤵
  PID:5276
- C:\Windows\System\oHQJyIR.exe
  C:\Windows\System\oHQJyIR.exe
  2⤵
  PID:5308
- C:\Windows\System\zyCgbRn.exe
  C:\Windows\System\zyCgbRn.exe
  2⤵
  PID:5336
- C:\Windows\System\MENGAeR.exe
  C:\Windows\System\MENGAeR.exe
  2⤵
  PID:5368
- C:\Windows\System\fpvSZpf.exe
  C:\Windows\System\fpvSZpf.exe
  2⤵
  PID:5400
- C:\Windows\System\WdtIDmT.exe
  C:\Windows\System\WdtIDmT.exe
  2⤵
  PID:5432
- C:\Windows\System\dAhplqm.exe
  C:\Windows\System\dAhplqm.exe
  2⤵
  PID:5464
- C:\Windows\System\qNYnEuw.exe
  C:\Windows\System\qNYnEuw.exe
  2⤵
  PID:4088
- C:\Windows\System\iHyNJqh.exe
  C:\Windows\System\iHyNJqh.exe
  2⤵
  PID:5512
- C:\Windows\System\veBZTbR.exe
  C:\Windows\System\veBZTbR.exe
  2⤵
  PID:5544
- C:\Windows\System\EfnzhNZ.exe
  C:\Windows\System\EfnzhNZ.exe
  2⤵
  PID:5576
- C:\Windows\System\eKkDlgh.exe
  C:\Windows\System\eKkDlgh.exe
  2⤵
  PID:5608
- C:\Windows\System\WOShgVY.exe
  C:\Windows\System\WOShgVY.exe
  2⤵
  PID:5640
- C:\Windows\System\IOUWGtN.exe
  C:\Windows\System\IOUWGtN.exe
  2⤵
  PID:5672
- C:\Windows\System\uXdsRrD.exe
  C:\Windows\System\uXdsRrD.exe
  2⤵
  PID:5704
- C:\Windows\System\vLxvsaF.exe
  C:\Windows\System\vLxvsaF.exe
  2⤵
  PID:5736
- C:\Windows\System\DmQVZsp.exe
  C:\Windows\System\DmQVZsp.exe
  2⤵
  PID:5768
- C:\Windows\System\lLNylQy.exe
  C:\Windows\System\lLNylQy.exe
  2⤵
  PID:5800
- C:\Windows\System\vURhRvW.exe
  C:\Windows\System\vURhRvW.exe
  2⤵
  PID:5832
- C:\Windows\System\RVnMUVS.exe
  C:\Windows\System\RVnMUVS.exe
  2⤵
  PID:5864
- C:\Windows\System\rfqsvLb.exe
  C:\Windows\System\rfqsvLb.exe
  2⤵
  PID:5896
- C:\Windows\System\TVTljgT.exe
  C:\Windows\System\TVTljgT.exe
  2⤵
  PID:5928
- C:\Windows\System\ABLyPcq.exe
  C:\Windows\System\ABLyPcq.exe
  2⤵
  PID:5960
- C:\Windows\System\yBntbeW.exe
  C:\Windows\System\yBntbeW.exe
  2⤵
  PID:5992
- C:\Windows\System\kMtxjOh.exe
  C:\Windows\System\kMtxjOh.exe
  2⤵
  PID:736
- C:\Windows\System\fJRYQKT.exe
  C:\Windows\System\fJRYQKT.exe
  2⤵
  PID:6044
- C:\Windows\System\KEtpblI.exe
  C:\Windows\System\KEtpblI.exe
  2⤵
  PID:6072
- C:\Windows\System\llCHtOp.exe
  C:\Windows\System\llCHtOp.exe
  2⤵
  PID:6092
- C:\Windows\System\GuUnzGH.exe
  C:\Windows\System\GuUnzGH.exe
  2⤵
  PID:6124
- C:\Windows\System\QQyvpGA.exe
  C:\Windows\System\QQyvpGA.exe
  2⤵
  PID:5068
- C:\Windows\System\SXCJCDj.exe
  C:\Windows\System\SXCJCDj.exe
  2⤵
  PID:3304
- C:\Windows\System\Xxwpmxo.exe
  C:\Windows\System\Xxwpmxo.exe
  2⤵
  PID:1420
- C:\Windows\System\CDraJrc.exe
  C:\Windows\System\CDraJrc.exe
  2⤵
  PID:3724
- C:\Windows\System\bNOXHgX.exe
  C:\Windows\System\bNOXHgX.exe
  2⤵
  PID:2488
- C:\Windows\System\ZhoAiLd.exe
  C:\Windows\System\ZhoAiLd.exe
  2⤵
  PID:4344
- C:\Windows\System\vmKKKdp.exe
  C:\Windows\System\vmKKKdp.exe
  2⤵
  PID:4936
- C:\Windows\System\JoOugeX.exe
  C:\Windows\System\JoOugeX.exe
  2⤵
  PID:3596
- C:\Windows\System\IHSoIRi.exe
  C:\Windows\System\IHSoIRi.exe
  2⤵
  PID:3024
- C:\Windows\System\IYoJYUG.exe
  C:\Windows\System\IYoJYUG.exe
  2⤵
  PID:5148
- C:\Windows\System\DCEYzFs.exe
  C:\Windows\System\DCEYzFs.exe
  2⤵
  PID:5208
- C:\Windows\System\VLmTYns.exe
  C:\Windows\System\VLmTYns.exe
  2⤵
  PID:3940
- C:\Windows\System\xtFfWTE.exe
  C:\Windows\System\xtFfWTE.exe
  2⤵
  PID:5304
- C:\Windows\System\gCMPBJa.exe
  C:\Windows\System\gCMPBJa.exe
  2⤵
  PID:5356
- C:\Windows\System\JVtMZMk.exe
  C:\Windows\System\JVtMZMk.exe
  2⤵
  PID:816
- C:\Windows\System\WhEMAkD.exe
  C:\Windows\System\WhEMAkD.exe
  2⤵
  PID:5480
- C:\Windows\System\bZNTTeh.exe
  C:\Windows\System\bZNTTeh.exe
  2⤵
  PID:5528
- C:\Windows\System\oxaGMao.exe
  C:\Windows\System\oxaGMao.exe
  2⤵
  PID:3688
- C:\Windows\System\HUkKZbr.exe
  C:\Windows\System\HUkKZbr.exe
  2⤵
  PID:5624
- C:\Windows\System\ULluvUY.exe
  C:\Windows\System\ULluvUY.exe
  2⤵
  PID:5688
- C:\Windows\System\yGpvoQS.exe
  C:\Windows\System\yGpvoQS.exe
  2⤵
  PID:5724
- C:\Windows\System\TIuuVRM.exe
  C:\Windows\System\TIuuVRM.exe
  2⤵
  PID:5784
- C:\Windows\System\YBrdqIe.exe
  C:\Windows\System\YBrdqIe.exe
  2⤵
  PID:5848
- C:\Windows\System\BdRRUXw.exe
  C:\Windows\System\BdRRUXw.exe
  2⤵
  PID:5912
- C:\Windows\System\LyoYRRv.exe
  C:\Windows\System\LyoYRRv.exe
  2⤵
  PID:5976
- C:\Windows\System\OXYgzJB.exe
  C:\Windows\System\OXYgzJB.exe
  2⤵
  PID:6028
- C:\Windows\System\hPOQvFK.exe
  C:\Windows\System\hPOQvFK.exe
  2⤵
  PID:916
- C:\Windows\System\vevoyWo.exe
  C:\Windows\System\vevoyWo.exe
  2⤵
  PID:5076
- C:\Windows\System\XOqLoHo.exe
  C:\Windows\System\XOqLoHo.exe
  2⤵
  PID:1720
- C:\Windows\System\mBowrFI.exe
  C:\Windows\System\mBowrFI.exe
  2⤵
  PID:2424
- C:\Windows\System\iqcsCvq.exe
  C:\Windows\System\iqcsCvq.exe
  2⤵
  PID:3396
- C:\Windows\System\bCkTHTa.exe
  C:\Windows\System\bCkTHTa.exe
  2⤵
  PID:740
- C:\Windows\System\DmcMxRx.exe
  C:\Windows\System\DmcMxRx.exe
  2⤵
  PID:2448
- C:\Windows\System\rqWRMJZ.exe
  C:\Windows\System\rqWRMJZ.exe
  2⤵
  PID:4892
- C:\Windows\System\JPSRYJj.exe
  C:\Windows\System\JPSRYJj.exe
  2⤵
  PID:5292
- C:\Windows\System\rgzyemP.exe
  C:\Windows\System\rgzyemP.exe
  2⤵
  PID:5416
- C:\Windows\System\ZsaGTmZ.exe
  C:\Windows\System\ZsaGTmZ.exe
  2⤵
  PID:5500
- C:\Windows\System\VcyGJix.exe
  C:\Windows\System\VcyGJix.exe
  2⤵
  PID:5592
- C:\Windows\System\CACFrCu.exe
  C:\Windows\System\CACFrCu.exe
  2⤵
  PID:4716
- C:\Windows\System\WomoohC.exe
  C:\Windows\System\WomoohC.exe
  2⤵
  PID:5816
- C:\Windows\System\gPoNFdw.exe
  C:\Windows\System\gPoNFdw.exe
  2⤵
  PID:6148
- C:\Windows\System\aGCiIvn.exe
  C:\Windows\System\aGCiIvn.exe
  2⤵
  PID:6164
- C:\Windows\System\JXUeNiJ.exe
  C:\Windows\System\JXUeNiJ.exe
  2⤵
  PID:6180
- C:\Windows\System\ZDLbaAP.exe
  C:\Windows\System\ZDLbaAP.exe
  2⤵
  PID:6196
- C:\Windows\System\CfSLSsH.exe
  C:\Windows\System\CfSLSsH.exe
  2⤵
  PID:6212
- C:\Windows\System\LkszANk.exe
  C:\Windows\System\LkszANk.exe
  2⤵
  PID:6228
- C:\Windows\System\BaOzomA.exe
  C:\Windows\System\BaOzomA.exe
  2⤵
  PID:6244
- C:\Windows\System\JTArVhv.exe
  C:\Windows\System\JTArVhv.exe
  2⤵
  PID:6260
- C:\Windows\System\vdDSsEb.exe
  C:\Windows\System\vdDSsEb.exe
  2⤵
  PID:6276
- C:\Windows\System\AwxYlJp.exe
  C:\Windows\System\AwxYlJp.exe
  2⤵
  PID:6292
- C:\Windows\System\wXGDOmo.exe
  C:\Windows\System\wXGDOmo.exe
  2⤵
  PID:6308
- C:\Windows\System\teJCdLl.exe
  C:\Windows\System\teJCdLl.exe
  2⤵
  PID:6324
- C:\Windows\System\VvUkXzN.exe
  C:\Windows\System\VvUkXzN.exe
  2⤵
  PID:6340
- C:\Windows\System\NVczWFh.exe
  C:\Windows\System\NVczWFh.exe
  2⤵
  PID:6356
- C:\Windows\System\gfHRLDY.exe
  C:\Windows\System\gfHRLDY.exe
  2⤵
  PID:6372
- C:\Windows\System\qEeFMuf.exe
  C:\Windows\System\qEeFMuf.exe
  2⤵
  PID:6388
- C:\Windows\System\fWeIpdf.exe
  C:\Windows\System\fWeIpdf.exe
  2⤵
  PID:6404
- C:\Windows\System\ErabjxL.exe
  C:\Windows\System\ErabjxL.exe
  2⤵
  PID:6420
- C:\Windows\System\wIziBbm.exe
  C:\Windows\System\wIziBbm.exe
  2⤵
  PID:6436
- C:\Windows\System\cDpWUyV.exe
  C:\Windows\System\cDpWUyV.exe
  2⤵
  PID:6452
- C:\Windows\System\QsjOPGm.exe
  C:\Windows\System\QsjOPGm.exe
  2⤵
  PID:6468
- C:\Windows\System\gLvZwTQ.exe
  C:\Windows\System\gLvZwTQ.exe
  2⤵
  PID:6484
- C:\Windows\System\qTQugjb.exe
  C:\Windows\System\qTQugjb.exe
  2⤵
  PID:6500
- C:\Windows\System\xGIFzBj.exe
  C:\Windows\System\xGIFzBj.exe
  2⤵
  PID:6516
- C:\Windows\System\krUIyCD.exe
  C:\Windows\System\krUIyCD.exe
  2⤵
  PID:6532
- C:\Windows\System\uXKcSAH.exe
  C:\Windows\System\uXKcSAH.exe
  2⤵
  PID:6548
- C:\Windows\System\HrvUlgP.exe
  C:\Windows\System\HrvUlgP.exe
  2⤵
  PID:6564
- C:\Windows\System\mxkjtRy.exe
  C:\Windows\System\mxkjtRy.exe
  2⤵
  PID:6580
- C:\Windows\System\rHYztOY.exe
  C:\Windows\System\rHYztOY.exe
  2⤵
  PID:6596
- C:\Windows\System\dWDZEez.exe
  C:\Windows\System\dWDZEez.exe
  2⤵
  PID:6612
- C:\Windows\System\xHzFmjz.exe
  C:\Windows\System\xHzFmjz.exe
  2⤵
  PID:6628
- C:\Windows\System\FyaklNl.exe
  C:\Windows\System\FyaklNl.exe
  2⤵
  PID:6644
- C:\Windows\System\HzSRMYt.exe
  C:\Windows\System\HzSRMYt.exe
  2⤵
  PID:6660
- C:\Windows\System\EMuRXzp.exe
  C:\Windows\System\EMuRXzp.exe
  2⤵
  PID:6676
- C:\Windows\System\sXLVnbR.exe
  C:\Windows\System\sXLVnbR.exe
  2⤵
  PID:6692
- C:\Windows\System\khDVKvf.exe
  C:\Windows\System\khDVKvf.exe
  2⤵
  PID:6708
- C:\Windows\System\utxvAxk.exe
  C:\Windows\System\utxvAxk.exe
  2⤵
  PID:6724
- C:\Windows\System\PWqcSoQ.exe
  C:\Windows\System\PWqcSoQ.exe
  2⤵
  PID:6740
- C:\Windows\System\BEOdiqG.exe
  C:\Windows\System\BEOdiqG.exe
  2⤵
  PID:6756
- C:\Windows\System\vOBFpxX.exe
  C:\Windows\System\vOBFpxX.exe
  2⤵
  PID:6772
- C:\Windows\System\NFEjBbw.exe
  C:\Windows\System\NFEjBbw.exe
  2⤵
  PID:6788
- C:\Windows\System\smFzHIp.exe
  C:\Windows\System\smFzHIp.exe
  2⤵
  PID:6804
- C:\Windows\System\cyeygPw.exe
  C:\Windows\System\cyeygPw.exe
  2⤵
  PID:6820
- C:\Windows\System\XGFFCzL.exe
  C:\Windows\System\XGFFCzL.exe
  2⤵
  PID:6836
- C:\Windows\System\JUIVXRL.exe
  C:\Windows\System\JUIVXRL.exe
  2⤵
  PID:6852
- C:\Windows\System\DEXDxnn.exe
  C:\Windows\System\DEXDxnn.exe
  2⤵
  PID:6868
- C:\Windows\System\uHriplJ.exe
  C:\Windows\System\uHriplJ.exe
  2⤵
  PID:6884
- C:\Windows\System\EBauWNi.exe
  C:\Windows\System\EBauWNi.exe
  2⤵
  PID:6900
- C:\Windows\System\IuTbQsI.exe
  C:\Windows\System\IuTbQsI.exe
  2⤵
  PID:6916
- C:\Windows\System\hCLxQon.exe
  C:\Windows\System\hCLxQon.exe
  2⤵
  PID:6932
- C:\Windows\System\tqSUAky.exe
  C:\Windows\System\tqSUAky.exe
  2⤵
  PID:6948
- C:\Windows\System\HOPgPVo.exe
  C:\Windows\System\HOPgPVo.exe
  2⤵
  PID:6964
- C:\Windows\System\ediLmIS.exe
  C:\Windows\System\ediLmIS.exe
  2⤵
  PID:6980
- C:\Windows\System\tfnQBbK.exe
  C:\Windows\System\tfnQBbK.exe
  2⤵
  PID:6996
- C:\Windows\System\wXtFzov.exe
  C:\Windows\System\wXtFzov.exe
  2⤵
  PID:7012
- C:\Windows\System\dKHAbQb.exe
  C:\Windows\System\dKHAbQb.exe
  2⤵
  PID:7028
- C:\Windows\System\ttJstJx.exe
  C:\Windows\System\ttJstJx.exe
  2⤵
  PID:7044
- C:\Windows\System\yBpvvyo.exe
  C:\Windows\System\yBpvvyo.exe
  2⤵
  PID:7060
- C:\Windows\System\KjKUtXR.exe
  C:\Windows\System\KjKUtXR.exe
  2⤵
  PID:7076
- C:\Windows\System\UZSBJYg.exe
  C:\Windows\System\UZSBJYg.exe
  2⤵
  PID:7092
- C:\Windows\System\ZYAjlOz.exe
  C:\Windows\System\ZYAjlOz.exe
  2⤵
  PID:7108
- C:\Windows\System\fhMNPDD.exe
  C:\Windows\System\fhMNPDD.exe
  2⤵
  PID:7124
- C:\Windows\System\wCXTcyM.exe
  C:\Windows\System\wCXTcyM.exe
  2⤵
  PID:7140
- C:\Windows\System\vIvnKjO.exe
  C:\Windows\System\vIvnKjO.exe
  2⤵
  PID:7156
- C:\Windows\System\RxFEDgN.exe
  C:\Windows\System\RxFEDgN.exe
  2⤵
  PID:5948
- C:\Windows\System\KGIJwoL.exe
  C:\Windows\System\KGIJwoL.exe
  2⤵
  PID:1092
- C:\Windows\System\NpCyxQO.exe
  C:\Windows\System\NpCyxQO.exe
  2⤵
  PID:1400
- C:\Windows\System\TbBpEjX.exe
  C:\Windows\System\TbBpEjX.exe
  2⤵
  PID:3372
- C:\Windows\System\kXUovKi.exe
  C:\Windows\System\kXUovKi.exe
  2⤵
  PID:2244
- C:\Windows\System\rGuhfzM.exe
  C:\Windows\System\rGuhfzM.exe
  2⤵
  PID:3076
- C:\Windows\System\awFtwcB.exe
  C:\Windows\System\awFtwcB.exe
  2⤵
  PID:5388
- C:\Windows\System\pQXCKcn.exe
  C:\Windows\System\pQXCKcn.exe
  2⤵
  PID:5564
- C:\Windows\System\IhspqCK.exe
  C:\Windows\System\IhspqCK.exe
  2⤵
  PID:5752
- C:\Windows\System\SvmYWcc.exe
  C:\Windows\System\SvmYWcc.exe
  2⤵
  PID:6156
- C:\Windows\System\KnxovVb.exe
  C:\Windows\System\KnxovVb.exe
  2⤵
  PID:6176
- C:\Windows\System\WYbHKKq.exe
  C:\Windows\System\WYbHKKq.exe
  2⤵
  PID:6204
- C:\Windows\System\vbPNfLL.exe
  C:\Windows\System\vbPNfLL.exe
  2⤵
  PID:6236
- C:\Windows\System\EOMXHZQ.exe
  C:\Windows\System\EOMXHZQ.exe
  2⤵
  PID:6268
- C:\Windows\System\izDDTaU.exe
  C:\Windows\System\izDDTaU.exe
  2⤵
  PID:6300
- C:\Windows\System\yBpUMnD.exe
  C:\Windows\System\yBpUMnD.exe
  2⤵
  PID:6332
- C:\Windows\System\ltLXyge.exe
  C:\Windows\System\ltLXyge.exe
  2⤵
  PID:6352
- C:\Windows\System\wvBXNGW.exe
  C:\Windows\System\wvBXNGW.exe
  2⤵
  PID:6384
- C:\Windows\System\KnKJFHm.exe
  C:\Windows\System\KnKJFHm.exe
  2⤵
  PID:6412
- C:\Windows\System\TAGjCKG.exe
  C:\Windows\System\TAGjCKG.exe
  2⤵
  PID:4832
- C:\Windows\System\kbkrUfU.exe
  C:\Windows\System\kbkrUfU.exe
  2⤵
  PID:6464
- C:\Windows\System\krYKssM.exe
  C:\Windows\System\krYKssM.exe
  2⤵
  PID:232
- C:\Windows\System\pfjhAdm.exe
  C:\Windows\System\pfjhAdm.exe
  2⤵
  PID:6508
- C:\Windows\System\dqGVrrI.exe
  C:\Windows\System\dqGVrrI.exe
  2⤵
  PID:6528
- C:\Windows\System\WhwrSHC.exe
  C:\Windows\System\WhwrSHC.exe
  2⤵
  PID:6560
- C:\Windows\System\eJDMfmi.exe
  C:\Windows\System\eJDMfmi.exe
  2⤵
  PID:6592
- C:\Windows\System\IKvhkeL.exe
  C:\Windows\System\IKvhkeL.exe
  2⤵
  PID:6620
- C:\Windows\System\tKqcqwu.exe
  C:\Windows\System\tKqcqwu.exe
  2⤵
  PID:6656
- C:\Windows\System\OQuQUDT.exe
  C:\Windows\System\OQuQUDT.exe
  2⤵
  PID:6672
- C:\Windows\System\jxYbmUN.exe
  C:\Windows\System\jxYbmUN.exe
  2⤵
  PID:6704
- C:\Windows\System\mHpEfiO.exe
  C:\Windows\System\mHpEfiO.exe
  2⤵
  PID:6736
- C:\Windows\System\mLsAcjX.exe
  C:\Windows\System\mLsAcjX.exe
  2⤵
  PID:4516
- C:\Windows\System\gshkCZt.exe
  C:\Windows\System\gshkCZt.exe
  2⤵
  PID:6780
- C:\Windows\System\oyMYwnd.exe
  C:\Windows\System\oyMYwnd.exe
  2⤵
  PID:1248
- C:\Windows\System\TWogfmO.exe
  C:\Windows\System\TWogfmO.exe
  2⤵
  PID:1940
- C:\Windows\System\tGUmpYY.exe
  C:\Windows\System\tGUmpYY.exe
  2⤵
  PID:6828
- C:\Windows\System\ycgSbHj.exe
  C:\Windows\System\ycgSbHj.exe
  2⤵
  PID:2980
- C:\Windows\System\YqZyaeq.exe
  C:\Windows\System\YqZyaeq.exe
  2⤵
  PID:6860
- C:\Windows\System\whTtZAG.exe
  C:\Windows\System\whTtZAG.exe
  2⤵
  PID:6876
- C:\Windows\System\eszvylf.exe
  C:\Windows\System\eszvylf.exe
  2⤵
  PID:6908
- C:\Windows\System\RBAkOya.exe
  C:\Windows\System\RBAkOya.exe
  2⤵
  PID:3532
- C:\Windows\System\EdwtmHT.exe
  C:\Windows\System\EdwtmHT.exe
  2⤵
  PID:6940
- C:\Windows\System\LFOkDZB.exe
  C:\Windows\System\LFOkDZB.exe
  2⤵
  PID:6960
- C:\Windows\System\OzEMVvP.exe
  C:\Windows\System\OzEMVvP.exe
  2⤵
  PID:6992
- C:\Windows\System\bMPWjbC.exe
  C:\Windows\System\bMPWjbC.exe
  2⤵
  PID:7024
- C:\Windows\System\cBfathm.exe
  C:\Windows\System\cBfathm.exe
  2⤵
  PID:7056
- C:\Windows\System\ARIIlqK.exe
  C:\Windows\System\ARIIlqK.exe
  2⤵
  PID:7088
- C:\Windows\System\wJaGklw.exe
  C:\Windows\System\wJaGklw.exe
  2⤵
  PID:7120
- C:\Windows\System\uLlgjLR.exe
  C:\Windows\System\uLlgjLR.exe
  2⤵
  PID:7152
- C:\Windows\System\oXuGOwg.exe
  C:\Windows\System\oXuGOwg.exe
  2⤵
  PID:6060
- C:\Windows\System\KOgphpS.exe
  C:\Windows\System\KOgphpS.exe
  2⤵
  PID:2356
- C:\Windows\System\FUgFxTP.exe
  C:\Windows\System\FUgFxTP.exe
  2⤵
  PID:5192
- C:\Windows\System\LaCaFVL.exe
  C:\Windows\System\LaCaFVL.exe
  2⤵
  PID:5496
- C:\Windows\System\FRUqvcU.exe
  C:\Windows\System\FRUqvcU.exe
  2⤵
  PID:5884
- C:\Windows\System\FzttCqt.exe
  C:\Windows\System\FzttCqt.exe
  2⤵
  PID:4380
- C:\Windows\System\XLIjnwb.exe
  C:\Windows\System\XLIjnwb.exe
  2⤵
  PID:6256
- C:\Windows\System\VEstFcU.exe
  C:\Windows\System\VEstFcU.exe
  2⤵
  PID:6320
- C:\Windows\System\jbMcDsx.exe
  C:\Windows\System\jbMcDsx.exe
  2⤵
  PID:6380
- C:\Windows\System\bUTqawi.exe
  C:\Windows\System\bUTqawi.exe
  2⤵
  PID:6432
- C:\Windows\System\BteMAjT.exe
  C:\Windows\System\BteMAjT.exe
  2⤵
  PID:6492
- C:\Windows\System\vmCXtuA.exe
  C:\Windows\System\vmCXtuA.exe
  2⤵
  PID:2108
- C:\Windows\System\HMYGsGd.exe
  C:\Windows\System\HMYGsGd.exe
  2⤵
  PID:6544
- C:\Windows\System\UDMuCHd.exe
  C:\Windows\System\UDMuCHd.exe
  2⤵
  PID:6604
- C:\Windows\System\lQGrQcS.exe
  C:\Windows\System\lQGrQcS.exe
  2⤵
  PID:3740
- C:\Windows\System\uktYbxn.exe
  C:\Windows\System\uktYbxn.exe
  2⤵
  PID:6720
- C:\Windows\System\yhSVSKA.exe
  C:\Windows\System\yhSVSKA.exe
  2⤵
  PID:6752
- C:\Windows\System\WDukkdw.exe
  C:\Windows\System\WDukkdw.exe
  2⤵
  PID:3416
- C:\Windows\System\YtKKgSN.exe
  C:\Windows\System\YtKKgSN.exe
  2⤵
  PID:2796
- C:\Windows\System\OBSZYQP.exe
  C:\Windows\System\OBSZYQP.exe
  2⤵
  PID:3020
- C:\Windows\System\YsDUssg.exe
  C:\Windows\System\YsDUssg.exe
  2⤵
  PID:7904
- C:\Windows\System\DYfUZXJ.exe
  C:\Windows\System\DYfUZXJ.exe
  2⤵
  PID:7952
- C:\Windows\System\KuoYWxn.exe
  C:\Windows\System\KuoYWxn.exe
  2⤵
  PID:8172
- C:\Windows\System\aVIdLTA.exe
  C:\Windows\System\aVIdLTA.exe
  2⤵
  PID:8200
- C:\Windows\System\IVjvsHu.exe
  C:\Windows\System\IVjvsHu.exe
  2⤵
  PID:8224
- C:\Windows\System\pwvXEDT.exe
  C:\Windows\System\pwvXEDT.exe
  2⤵
  PID:8244
- C:\Windows\System\zIREbKy.exe
  C:\Windows\System\zIREbKy.exe
  2⤵
  PID:8264
- C:\Windows\System\VoyzrbH.exe
  C:\Windows\System\VoyzrbH.exe
  2⤵
  PID:8196
- C:\Windows\System\QTPQaPs.exe
  C:\Windows\System\QTPQaPs.exe
  2⤵
  PID:8308
- C:\Windows\System\rFQMsRz.exe
  C:\Windows\System\rFQMsRz.exe
  2⤵
  PID:10260
- C:\Windows\System\rsVcPnz.exe
  C:\Windows\System\rsVcPnz.exe
  2⤵
  PID:10320
- C:\Windows\System\zoydqpx.exe
  C:\Windows\System\zoydqpx.exe
  2⤵
  PID:10356
- C:\Windows\System\KWEYHsj.exe
  C:\Windows\System\KWEYHsj.exe
  2⤵
  PID:9220
- C:\Windows\System\aHzpRKy.exe
  C:\Windows\System\aHzpRKy.exe
  2⤵
  PID:7556
- C:\Windows\System\dMSPgsC.exe
  C:\Windows\System\dMSPgsC.exe
  2⤵
  PID:7728
- C:\Windows\System\bXycFRA.exe
  C:\Windows\System\bXycFRA.exe
  2⤵
  PID:9412
- C:\Windows\System\EQGdfoc.exe
  C:\Windows\System\EQGdfoc.exe
  2⤵
  PID:9444
- C:\Windows\System\vHhPdDk.exe
  C:\Windows\System\vHhPdDk.exe
  2⤵
  PID:9484
- C:\Windows\System\TslDOAx.exe
  C:\Windows\System\TslDOAx.exe
  2⤵
  PID:10096
- C:\Windows\System\EhuTCTC.exe
  C:\Windows\System\EhuTCTC.exe
  2⤵
  PID:7756
- C:\Windows\System\JaMHOdi.exe
  C:\Windows\System\JaMHOdi.exe
  2⤵
  PID:1112
- C:\Windows\System\LBenSyC.exe
  C:\Windows\System\LBenSyC.exe
  2⤵
  PID:7188
- C:\Windows\System\LpXcUfI.exe
  C:\Windows\System\LpXcUfI.exe
  2⤵
  PID:7260
- C:\Windows\System\VAUQAWB.exe
  C:\Windows\System\VAUQAWB.exe
  2⤵
  PID:7312
- C:\Windows\System\RjILipf.exe
  C:\Windows\System\RjILipf.exe
  2⤵
  PID:7360
- C:\Windows\System\epqyWCE.exe
  C:\Windows\System\epqyWCE.exe
  2⤵
  PID:7416
- C:\Windows\System\laAdLbx.exe
  C:\Windows\System\laAdLbx.exe
  2⤵
  PID:8216
- C:\Windows\System\mlhxoeE.exe
  C:\Windows\System\mlhxoeE.exe
  2⤵
  PID:8260
- C:\Windows\System\PaaTmzo.exe
  C:\Windows\System\PaaTmzo.exe
  2⤵
  PID:8324
- C:\Windows\System\PtMRGBH.exe
  C:\Windows\System\PtMRGBH.exe
  2⤵
  PID:10456
- C:\Windows\System\SZSMNBP.exe
  C:\Windows\System\SZSMNBP.exe
  2⤵
  PID:10496
- C:\Windows\System\VtMhbSP.exe
  C:\Windows\System\VtMhbSP.exe
  2⤵
  PID:10984
- C:\Windows\System\tWHHluw.exe
  C:\Windows\System\tWHHluw.exe
  2⤵
  PID:7888
- C:\Windows\System\uVrRIIJ.exe
  C:\Windows\System\uVrRIIJ.exe
  2⤵
  PID:8368
- C:\Windows\System\aaffBsX.exe
  C:\Windows\System\aaffBsX.exe
  2⤵
  PID:8616
- C:\Windows\System\BVbfHUB.exe
  C:\Windows\System\BVbfHUB.exe
  2⤵
  PID:8732
- C:\Windows\System\qmfCjLk.exe
  C:\Windows\System\qmfCjLk.exe
  2⤵
  PID:8868
- C:\Windows\System\mEkkdWX.exe
  C:\Windows\System\mEkkdWX.exe
  2⤵
  PID:9784
- C:\Windows\System\EHcedri.exe
  C:\Windows\System\EHcedri.exe
  2⤵
  PID:9656
- C:\Windows\System\svizgKq.exe
  C:\Windows\System\svizgKq.exe
  2⤵
  PID:9584
- C:\Windows\System\DrtaZdR.exe
  C:\Windows\System\DrtaZdR.exe
  2⤵
  PID:9864
- C:\Windows\System\NZAhnce.exe
  C:\Windows\System\NZAhnce.exe
  2⤵
  PID:9936
- C:\Windows\System\mGfCNUK.exe
  C:\Windows\System\mGfCNUK.exe
  2⤵
  PID:9968
- C:\Windows\System\RQaKlQr.exe
  C:\Windows\System\RQaKlQr.exe
  2⤵
  PID:10056
- C:\Windows\System\GXpCZkS.exe
  C:\Windows\System\GXpCZkS.exe
  2⤵
  PID:10168
- C:\Windows\System\wuzUsCy.exe
  C:\Windows\System\wuzUsCy.exe
  2⤵
  PID:10216
- C:\Windows\System\edQhMPc.exe
  C:\Windows\System\edQhMPc.exe
  2⤵
  PID:8956
- C:\Windows\System\QqCNFny.exe
  C:\Windows\System\QqCNFny.exe
  2⤵
  PID:9012
- C:\Windows\System\SPwGULK.exe
  C:\Windows\System\SPwGULK.exe
  2⤵
  PID:10284
- C:\Windows\System\lGSqacW.exe
  C:\Windows\System\lGSqacW.exe
  2⤵
  PID:10396
- C:\Windows\System\fkPwRaE.exe
  C:\Windows\System\fkPwRaE.exe
  2⤵
  PID:11000
- C:\Windows\System\GINMIic.exe
  C:\Windows\System\GINMIic.exe
  2⤵
  PID:7524
- C:\Windows\System\nvXZwjQ.exe
  C:\Windows\System\nvXZwjQ.exe
  2⤵
  PID:9404
- C:\Windows\System\yifJqUU.exe
  C:\Windows\System\yifJqUU.exe
  2⤵
  PID:9704
- C:\Windows\System\IAyqdrt.exe
  C:\Windows\System\IAyqdrt.exe
  2⤵
  PID:2416
- C:\Windows\System\tqEvNTm.exe
  C:\Windows\System\tqEvNTm.exe
  2⤵
  PID:2960
- C:\Windows\System\szjhYcX.exe
  C:\Windows\System\szjhYcX.exe
  2⤵
  PID:7392
- C:\Windows\System\svWwodw.exe
  C:\Windows\System\svWwodw.exe
  2⤵
  PID:10428
- C:\Windows\System\vdDKYQr.exe
  C:\Windows\System\vdDKYQr.exe
  2⤵
  PID:10484
- C:\Windows\System\wMStDQE.exe
  C:\Windows\System\wMStDQE.exe
  2⤵
  PID:7180
- C:\Windows\System\oLokoZQ.exe
  C:\Windows\System\oLokoZQ.exe
  2⤵
  PID:8692
- C:\Windows\System\dHNzzRR.exe
  C:\Windows\System\dHNzzRR.exe
  2⤵
  PID:8900
- C:\Windows\System\UGYvoKG.exe
  C:\Windows\System\UGYvoKG.exe
  2⤵
  PID:9680
- C:\Windows\System\qSsqqvn.exe
  C:\Windows\System\qSsqqvn.exe
  2⤵
  PID:9848
- C:\Windows\System\HrGJpwY.exe
  C:\Windows\System\HrGJpwY.exe
  2⤵
  PID:10048
- C:\Windows\System\jQCafzq.exe
  C:\Windows\System\jQCafzq.exe
  2⤵
  PID:9044
- C:\Windows\System\AJAeWVz.exe
  C:\Windows\System\AJAeWVz.exe
  2⤵
  PID:10388
- C:\Windows\System\aaxGaSn.exe
  C:\Windows\System\aaxGaSn.exe
  2⤵
  PID:7716
- C:\Windows\System\QSnpbzG.exe
  C:\Windows\System\QSnpbzG.exe
  2⤵
  PID:9476
- C:\Windows\System\WyqPrHW.exe
  C:\Windows\System\WyqPrHW.exe
  2⤵
  PID:7204
- C:\Windows\System\uEWEKSr.exe
  C:\Windows\System\uEWEKSr.exe
  2⤵
  PID:6192
- C:\Windows\System\FFpcBwt.exe
  C:\Windows\System\FFpcBwt.exe
  2⤵
  PID:10312
- C:\Windows\System\hacDVdP.exe
  C:\Windows\System\hacDVdP.exe
  2⤵
  PID:8668
- C:\Windows\System\UzUFOpL.exe
  C:\Windows\System\UzUFOpL.exe
  2⤵
  PID:9944
- C:\Windows\System\RfwBdxL.exe
  C:\Windows\System\RfwBdxL.exe
  2⤵
  PID:2936
- C:\Windows\System\zcrgSiR.exe
  C:\Windows\System\zcrgSiR.exe
  2⤵
  PID:9152
- C:\Windows\System\rrXwrTX.exe
  C:\Windows\System\rrXwrTX.exe
  2⤵
  PID:7580
- C:\Windows\System\mzWTYsi.exe
  C:\Windows\System\mzWTYsi.exe
  2⤵
  PID:1620
- C:\Windows\System\ianfgCw.exe
  C:\Windows\System\ianfgCw.exe
  2⤵
  PID:9712
- C:\Windows\System\mfEwgPa.exe
  C:\Windows\System\mfEwgPa.exe
  2⤵
  PID:5084
- C:\Windows\System\GFKZtHs.exe
  C:\Windows\System\GFKZtHs.exe
  2⤵
  PID:4440
- C:\Windows\System\dhsJMqM.exe
  C:\Windows\System\dhsJMqM.exe
  2⤵
  PID:11276
- C:\Windows\System\FBguAkW.exe
  C:\Windows\System\FBguAkW.exe
  2⤵
  PID:11304
- C:\Windows\System\zhSlYie.exe
  C:\Windows\System\zhSlYie.exe
  2⤵
  PID:11336
- C:\Windows\System\XmZlZkU.exe
  C:\Windows\System\XmZlZkU.exe
  2⤵
  PID:11364
- C:\Windows\System\GlfPoRa.exe
  C:\Windows\System\GlfPoRa.exe
  2⤵
  PID:11384
- C:\Windows\System\sDxkPPJ.exe
  C:\Windows\System\sDxkPPJ.exe
  2⤵
  PID:11408
- C:\Windows\System\CqLQJhQ.exe
  C:\Windows\System\CqLQJhQ.exe
  2⤵
  PID:11428
- C:\Windows\System\szlgBYO.exe
  C:\Windows\System\szlgBYO.exe
  2⤵
  PID:11448
- C:\Windows\System\hKkbFSI.exe
  C:\Windows\System\hKkbFSI.exe
  2⤵
  PID:11516
- C:\Windows\System\cFyMiyP.exe
  C:\Windows\System\cFyMiyP.exe
  2⤵
  PID:11544
- C:\Windows\System\dHkUiFQ.exe
  C:\Windows\System\dHkUiFQ.exe
  2⤵
  PID:11568
- C:\Windows\System\thhCcwx.exe
  C:\Windows\System\thhCcwx.exe
  2⤵
  PID:11584
- C:\Windows\System\EVtvYyN.exe
  C:\Windows\System\EVtvYyN.exe
  2⤵
  PID:11632
- C:\Windows\System\qTnsmfJ.exe
  C:\Windows\System\qTnsmfJ.exe
  2⤵
  PID:11656
- C:\Windows\System\vWwAQVm.exe
  C:\Windows\System\vWwAQVm.exe
  2⤵
  PID:11680
- C:\Windows\System\ELrAPem.exe
  C:\Windows\System\ELrAPem.exe
  2⤵
  PID:11700
- C:\Windows\System\okYhZIN.exe
  C:\Windows\System\okYhZIN.exe
  2⤵
  PID:11756
- C:\Windows\System\jhSBwtD.exe
  C:\Windows\System\jhSBwtD.exe
  2⤵
  PID:11776
- C:\Windows\System\frrPqMc.exe
  C:\Windows\System\frrPqMc.exe
  2⤵
  PID:11796
- C:\Windows\System\IShqNHb.exe
  C:\Windows\System\IShqNHb.exe
  2⤵
  PID:11816
- C:\Windows\System\jgxtaKt.exe
  C:\Windows\System\jgxtaKt.exe
  2⤵
  PID:11836
- C:\Windows\System\lKkITMX.exe
  C:\Windows\System\lKkITMX.exe
  2⤵
  PID:11868
- C:\Windows\System\sNNwzJx.exe
  C:\Windows\System\sNNwzJx.exe
  2⤵
  PID:11896
- C:\Windows\System\DCMHHTl.exe
  C:\Windows\System\DCMHHTl.exe
  2⤵
  PID:11932
- C:\Windows\System\pHNxKGr.exe
  C:\Windows\System\pHNxKGr.exe
  2⤵
  PID:11964
- C:\Windows\System\RLflFOk.exe
  C:\Windows\System\RLflFOk.exe
  2⤵
  PID:11984
- C:\Windows\System\pXIiOfo.exe
  C:\Windows\System\pXIiOfo.exe
  2⤵
  PID:12016
- C:\Windows\System\juJexpa.exe
  C:\Windows\System\juJexpa.exe
  2⤵
  PID:12036
- C:\Windows\System\YrNlzUy.exe
  C:\Windows\System\YrNlzUy.exe
  2⤵
  PID:12072
- C:\Windows\System\LJNlxPy.exe
  C:\Windows\System\LJNlxPy.exe
  2⤵
  PID:12104
- C:\Windows\System\oFODSxP.exe
  C:\Windows\System\oFODSxP.exe
  2⤵
  PID:12128
- C:\Windows\System\ojlLQIN.exe
  C:\Windows\System\ojlLQIN.exe
  2⤵
  PID:12148
- C:\Windows\System\IrXtTzB.exe
  C:\Windows\System\IrXtTzB.exe
  2⤵
  PID:12180
- C:\Windows\System\JOUSvvB.exe
  C:\Windows\System\JOUSvvB.exe
  2⤵
  PID:12200
- C:\Windows\System\kcVZOGE.exe
  C:\Windows\System\kcVZOGE.exe
  2⤵
  PID:12236
- C:\Windows\System\bSClueu.exe
  C:\Windows\System\bSClueu.exe
  2⤵
  PID:12256
- C:\Windows\System\DkZVAGd.exe
  C:\Windows\System\DkZVAGd.exe
  2⤵
  PID:12280
- C:\Windows\System\TlRsXPM.exe
  C:\Windows\System\TlRsXPM.exe
  2⤵
  PID:8804
- C:\Windows\System\GKzbbUz.exe
  C:\Windows\System\GKzbbUz.exe
  2⤵
  PID:10988
- C:\Windows\System\aHHRjsC.exe
  C:\Windows\System\aHHRjsC.exe
  2⤵
  PID:11444
- C:\Windows\System\TBohkMJ.exe
  C:\Windows\System\TBohkMJ.exe
  2⤵
  PID:11468
- C:\Windows\System\zaCCsWz.exe
  C:\Windows\System\zaCCsWz.exe
  2⤵
  PID:11560
- C:\Windows\System\nUaQtLG.exe
  C:\Windows\System\nUaQtLG.exe
  2⤵
  PID:11624
- C:\Windows\System\GUbzDAm.exe
  C:\Windows\System\GUbzDAm.exe
  2⤵
  PID:11600
- C:\Windows\System\cLNUkfm.exe
  C:\Windows\System\cLNUkfm.exe
  2⤵
  PID:11728
- C:\Windows\System\MhFoKOo.exe
  C:\Windows\System\MhFoKOo.exe
  2⤵
  PID:11784
- C:\Windows\System\StmKKPI.exe
  C:\Windows\System\StmKKPI.exe
  2⤵
  PID:11860
- C:\Windows\System\SzLEsbJ.exe
  C:\Windows\System\SzLEsbJ.exe
  2⤵
  PID:11952
- C:\Windows\System\KBlYPrO.exe
  C:\Windows\System\KBlYPrO.exe
  2⤵
  PID:12008
- C:\Windows\System\gYafcfj.exe
  C:\Windows\System\gYafcfj.exe
  2⤵
  PID:12084
- C:\Windows\System\ajVllYi.exe
  C:\Windows\System\ajVllYi.exe
  2⤵
  PID:12120
- C:\Windows\System\DipskLo.exe
  C:\Windows\System\DipskLo.exe
  2⤵
  PID:4376
- C:\Windows\System\PEshJyW.exe
  C:\Windows\System\PEshJyW.exe
  2⤵
  PID:12264
- C:\Windows\System\JiowOgD.exe
  C:\Windows\System\JiowOgD.exe
  2⤵
  PID:10224
- C:\Windows\System\pwVEgRZ.exe
  C:\Windows\System\pwVEgRZ.exe
  2⤵
  PID:11356
- C:\Windows\System\bojvfxv.exe
  C:\Windows\System\bojvfxv.exe
  2⤵
  PID:11440
- C:\Windows\System\bTpVama.exe
  C:\Windows\System\bTpVama.exe
  2⤵
  PID:11608
- C:\Windows\System\xaUNDiv.exe
  C:\Windows\System\xaUNDiv.exe
  2⤵
  PID:11712
- C:\Windows\System\fcHdEtF.exe
  C:\Windows\System\fcHdEtF.exe
  2⤵
  PID:11808
- C:\Windows\System\EfqXXag.exe
  C:\Windows\System\EfqXXag.exe
  2⤵
  PID:11992
- C:\Windows\System\glzCnwL.exe
  C:\Windows\System\glzCnwL.exe
  2⤵
  PID:12164
- C:\Windows\System\qrnKxIE.exe
  C:\Windows\System\qrnKxIE.exe
  2⤵
  PID:11348
- C:\Windows\System\jxixwuS.exe
  C:\Windows\System\jxixwuS.exe
  2⤵
  PID:11552
- C:\Windows\System\QKtLrsY.exe
  C:\Windows\System\QKtLrsY.exe
  2⤵
  PID:12116
- C:\Windows\System\NNzzEBW.exe
  C:\Windows\System\NNzzEBW.exe
  2⤵
  PID:11884
- C:\Windows\System\hEsrdev.exe
  C:\Windows\System\hEsrdev.exe
  2⤵
  PID:12300
- C:\Windows\System\UCkJSoK.exe
  C:\Windows\System\UCkJSoK.exe
  2⤵
  PID:12328
- C:\Windows\System\cQGQmLl.exe
  C:\Windows\System\cQGQmLl.exe
  2⤵
  PID:12348
- C:\Windows\System\PuOkgWi.exe
  C:\Windows\System\PuOkgWi.exe
  2⤵
  PID:12384
- C:\Windows\System\ZrLAUrj.exe
  C:\Windows\System\ZrLAUrj.exe
  2⤵
  PID:12412
- C:\Windows\System\jbpXjwm.exe
  C:\Windows\System\jbpXjwm.exe
  2⤵
  PID:12436
- C:\Windows\System\xztnoRQ.exe
  C:\Windows\System\xztnoRQ.exe
  2⤵
  PID:12480
- C:\Windows\System\ECKlOvm.exe
  C:\Windows\System\ECKlOvm.exe
  2⤵
  PID:12504
- C:\Windows\System\hxShrMe.exe
  C:\Windows\System\hxShrMe.exe
  2⤵
  PID:12528
- C:\Windows\System\JGtMmmn.exe
  C:\Windows\System\JGtMmmn.exe
  2⤵
  PID:12548
- C:\Windows\System\fHrJwZc.exe
  C:\Windows\System\fHrJwZc.exe
  2⤵
  PID:12604
- C:\Windows\System\GRVDEWe.exe
  C:\Windows\System\GRVDEWe.exe
  2⤵
  PID:12628
- C:\Windows\System\VIBZcSc.exe
  C:\Windows\System\VIBZcSc.exe
  2⤵
  PID:12644
- C:\Windows\System\IIEaudC.exe
  C:\Windows\System\IIEaudC.exe
  2⤵
  PID:12672
- C:\Windows\System\shFEATI.exe
  C:\Windows\System\shFEATI.exe
  2⤵
  PID:12692
- C:\Windows\System\cNNljxs.exe
  C:\Windows\System\cNNljxs.exe
  2⤵
  PID:12716
- C:\Windows\System\YFfgiRz.exe
  C:\Windows\System\YFfgiRz.exe
  2⤵
  PID:12768
- C:\Windows\System\ypKZokf.exe
  C:\Windows\System\ypKZokf.exe
  2⤵
  PID:12792
- C:\Windows\System\tZFGYgk.exe
  C:\Windows\System\tZFGYgk.exe
  2⤵
  PID:12808
- C:\Windows\System\JhDQKcy.exe
  C:\Windows\System\JhDQKcy.exe
  2⤵
  PID:12832
- C:\Windows\System\RHYqppC.exe
  C:\Windows\System\RHYqppC.exe
  2⤵
  PID:12848
- C:\Windows\System\ARgEihT.exe
  C:\Windows\System\ARgEihT.exe
  2⤵
  PID:12876
- C:\Windows\System\PVGTARk.exe
  C:\Windows\System\PVGTARk.exe
  2⤵
  PID:12924
- C:\Windows\System\glxZCVn.exe
  C:\Windows\System\glxZCVn.exe
  2⤵
  PID:12956
- C:\Windows\System\ZNVtguT.exe
  C:\Windows\System\ZNVtguT.exe
  2⤵
  PID:12984
- C:\Windows\System\qpIXemS.exe
  C:\Windows\System\qpIXemS.exe
  2⤵
  PID:13004
- C:\Windows\System\XfYxqft.exe
  C:\Windows\System\XfYxqft.exe
  2⤵
  PID:13024
- C:\Windows\System\YwBbYyb.exe
  C:\Windows\System\YwBbYyb.exe
  2⤵
  PID:13056
- C:\Windows\System\TbqgysX.exe
  C:\Windows\System\TbqgysX.exe
  2⤵
  PID:13076
- C:\Windows\System\Pfexlky.exe
  C:\Windows\System\Pfexlky.exe
  2⤵
  PID:13128
- C:\Windows\System\zHBeHFr.exe
  C:\Windows\System\zHBeHFr.exe
  2⤵
  PID:13164
- C:\Windows\System\aXMRhzC.exe
  C:\Windows\System\aXMRhzC.exe
  2⤵
  PID:13204
- C:\Windows\System\ztnBPGT.exe
  C:\Windows\System\ztnBPGT.exe
  2⤵
  PID:13224
- C:\Windows\System\bBCMgls.exe
  C:\Windows\System\bBCMgls.exe
  2⤵
  PID:13248
- C:\Windows\System\WndxJCF.exe
  C:\Windows\System\WndxJCF.exe
  2⤵
  PID:13264
- C:\Windows\System\cjxfGbn.exe
  C:\Windows\System\cjxfGbn.exe
  2⤵
  PID:13304
- C:\Windows\System\ZVhFKDu.exe
  C:\Windows\System\ZVhFKDu.exe
  2⤵
  PID:12308
- C:\Windows\System\TkFmumt.exe
  C:\Windows\System\TkFmumt.exe
  2⤵
  PID:12392
- C:\Windows\System\NXCDxjB.exe
  C:\Windows\System\NXCDxjB.exe
  2⤵
  PID:12380
- C:\Windows\System\ASpqWPU.exe
  C:\Windows\System\ASpqWPU.exe
  2⤵
  PID:12448
- C:\Windows\System\xojbXjz.exe
  C:\Windows\System\xojbXjz.exe
  2⤵
  PID:12572
- C:\Windows\System\YtUFXUg.exe
  C:\Windows\System\YtUFXUg.exe
  2⤵
  PID:12612
- C:\Windows\System\jHdNgsO.exe
  C:\Windows\System\jHdNgsO.exe
  2⤵
  PID:12704
- C:\Windows\System\NvwDRUU.exe
  C:\Windows\System\NvwDRUU.exe
  2⤵
  PID:12680
- C:\Windows\System\KPXYRXd.exe
  C:\Windows\System\KPXYRXd.exe
  2⤵
  PID:12780
- C:\Windows\System\tPMaHrs.exe
  C:\Windows\System\tPMaHrs.exe
  2⤵
  PID:12764
- C:\Windows\System\qraYfYR.exe
  C:\Windows\System\qraYfYR.exe
  2⤵
  PID:12844
- C:\Windows\System\IWkBbgP.exe
  C:\Windows\System\IWkBbgP.exe
  2⤵
  PID:12004
- C:\Windows\System\ckCVdxj.exe
  C:\Windows\System\ckCVdxj.exe
  2⤵
  PID:13096
- C:\Windows\System\zWHaLcV.exe
  C:\Windows\System\zWHaLcV.exe
  2⤵
  PID:13120
- C:\Windows\System\KseqVgA.exe
  C:\Windows\System\KseqVgA.exe
  2⤵
  PID:13148
- C:\Windows\System\GvzxvoC.exe
  C:\Windows\System\GvzxvoC.exe
  2⤵
  PID:13200
- C:\Windows\System\qqajINF.exe
  C:\Windows\System\qqajINF.exe
  2⤵
  PID:13220
- C:\Windows\System\YqoIMXX.exe
  C:\Windows\System\YqoIMXX.exe
  2⤵
  PID:13276
- C:\Windows\System\rgwOobO.exe
  C:\Windows\System\rgwOobO.exe
  2⤵
  PID:2180
- C:\Windows\System\KBuBari.exe
  C:\Windows\System\KBuBari.exe
  2⤵
  PID:12344
- C:\Windows\System\BKnakiU.exe
  C:\Windows\System\BKnakiU.exe
  2⤵
  PID:12408
- C:\Windows\System\Btonqqg.exe
  C:\Windows\System\Btonqqg.exe
  2⤵
  PID:12684
- C:\Windows\System\ryyClGE.exe
  C:\Windows\System\ryyClGE.exe
  2⤵
  PID:13012
- C:\Windows\System\XeGPwCj.exe
  C:\Windows\System\XeGPwCj.exe
  2⤵
  PID:12540
- C:\Windows\System\hicNzTC.exe
  C:\Windows\System\hicNzTC.exe
  2⤵
  PID:13320
- C:\Windows\System\EWEwpNc.exe
  C:\Windows\System\EWEwpNc.exe
  2⤵
  PID:13336
- C:\Windows\System\stNHTjl.exe
  C:\Windows\System\stNHTjl.exe
  2⤵
  PID:13396
- C:\Windows\System\xgCgsxG.exe
  C:\Windows\System\xgCgsxG.exe
  2⤵
  PID:13436
- C:\Windows\System\qbidVrc.exe
  C:\Windows\System\qbidVrc.exe
  2⤵
  PID:13464
- C:\Windows\System\SLZivIa.exe
  C:\Windows\System\SLZivIa.exe
  2⤵
  PID:13484
- C:\Windows\System\EYnqzAj.exe
  C:\Windows\System\EYnqzAj.exe
  2⤵
  PID:13548
- C:\Windows\System\ljPHLnt.exe
  C:\Windows\System\ljPHLnt.exe
  2⤵
  PID:13568
- C:\Windows\System\geRPNcc.exe
  C:\Windows\System\geRPNcc.exe
  2⤵
  PID:13644
- C:\Windows\System\eWPSDZN.exe
  C:\Windows\System\eWPSDZN.exe
  2⤵
  PID:13708
- C:\Windows\System\evCXCtj.exe
  C:\Windows\System\evCXCtj.exe
  2⤵
  PID:13728
- C:\Windows\System\BQfuLYG.exe
  C:\Windows\System\BQfuLYG.exe
  2⤵
  PID:13752
- C:\Windows\System\XBxIPII.exe
  C:\Windows\System\XBxIPII.exe
  2⤵
  PID:13768
- C:\Windows\System\mJkBBLH.exe
  C:\Windows\System\mJkBBLH.exe
  2⤵
  PID:13792
- C:\Windows\System\TDdLWTZ.exe
  C:\Windows\System\TDdLWTZ.exe
  2⤵
  PID:13812
- C:\Windows\System\VmGwloQ.exe
  C:\Windows\System\VmGwloQ.exe
  2⤵
  PID:13832
- C:\Windows\System\vfDxgpO.exe
  C:\Windows\System\vfDxgpO.exe
  2⤵
  PID:13896
- C:\Windows\System\gCxbJRB.exe
  C:\Windows\System\gCxbJRB.exe
  2⤵
  PID:13924
- C:\Windows\System\dMlptwr.exe
  C:\Windows\System\dMlptwr.exe
  2⤵
  PID:13956
- C:\Windows\System\YJSAiCg.exe
  C:\Windows\System\YJSAiCg.exe
  2⤵
  PID:13980
- C:\Windows\System\sNupDXT.exe
  C:\Windows\System\sNupDXT.exe
  2⤵
  PID:14016
- C:\Windows\System\ObfxClm.exe
  C:\Windows\System\ObfxClm.exe
  2⤵
  PID:14036
- C:\Windows\System\lyImgRz.exe
  C:\Windows\System\lyImgRz.exe
  2⤵
  PID:14060
- C:\Windows\System\gmkkJpo.exe
  C:\Windows\System\gmkkJpo.exe
  2⤵
  PID:14084
- C:\Windows\System\MXkbhsb.exe
  C:\Windows\System\MXkbhsb.exe
  2⤵
  PID:14104
- C:\Windows\System\KkUQPFC.exe
  C:\Windows\System\KkUQPFC.exe
  2⤵
  PID:14136
- C:\Windows\System\pNvIRZY.exe
  C:\Windows\System\pNvIRZY.exe
  2⤵
  PID:14156
- C:\Windows\System\mYitHtk.exe
  C:\Windows\System\mYitHtk.exe
  2⤵
  PID:14188
- C:\Windows\System\qPkTmZB.exe
  C:\Windows\System\qPkTmZB.exe
  2⤵
  PID:14232
- C:\Windows\System\ZZXbFOY.exe
  C:\Windows\System\ZZXbFOY.exe
  2⤵
  PID:14272
- C:\Windows\System\enfowlZ.exe
  C:\Windows\System\enfowlZ.exe
  2⤵
  PID:14288
- C:\Windows\System\JfYXZio.exe
  C:\Windows\System\JfYXZio.exe
  2⤵
  PID:14324
- C:\Windows\System\mkOjJqL.exe
  C:\Windows\System\mkOjJqL.exe
  2⤵
  PID:12872
- C:\Windows\System\tXavkYw.exe
  C:\Windows\System\tXavkYw.exe
  2⤵
  PID:13236
- C:\Windows\System\rXuytcF.exe
  C:\Windows\System\rXuytcF.exe
  2⤵
  PID:13292
- C:\Windows\System\zlNEBYi.exe
  C:\Windows\System\zlNEBYi.exe
  2⤵
  PID:3816
- C:\Windows\System\WhtODAk.exe
  C:\Windows\System\WhtODAk.exe
  2⤵
  PID:11828
- C:\Windows\System\wnpkAuY.exe
  C:\Windows\System\wnpkAuY.exe
  2⤵
  PID:12776
- C:\Windows\System\fTQNdrD.exe
  C:\Windows\System\fTQNdrD.exe
  2⤵
  PID:3120
- C:\Windows\System\qeEnTqt.exe
  C:\Windows\System\qeEnTqt.exe
  2⤵
  PID:13316
- C:\Windows\System\KnKbKdd.exe
  C:\Windows\System\KnKbKdd.exe
  2⤵
  PID:13428
- C:\Windows\System\OZwVuoG.exe
  C:\Windows\System\OZwVuoG.exe
  2⤵
  PID:13588
- C:\Windows\System\VwCGaBT.exe
  C:\Windows\System\VwCGaBT.exe
  2⤵
  PID:13660
- C:\Windows\System\tqHLEjF.exe
  C:\Windows\System\tqHLEjF.exe
  2⤵
  PID:13532
- C:\Windows\System\jjLWRLY.exe
  C:\Windows\System\jjLWRLY.exe
  2⤵
  PID:13684
- C:\Windows\System\OucogzS.exe
  C:\Windows\System\OucogzS.exe
  2⤵
  PID:13764
- C:\Windows\System\focDGAU.exe
  C:\Windows\System\focDGAU.exe
  2⤵
  PID:13820
- C:\Windows\System\PVwzoQC.exe
  C:\Windows\System\PVwzoQC.exe
  2⤵
  PID:13932
- C:\Windows\System\ArBsVZj.exe
  C:\Windows\System\ArBsVZj.exe
  2⤵
  PID:3232
- C:\Windows\System\rwGuRkm.exe
  C:\Windows\System\rwGuRkm.exe
  2⤵
  PID:14008
- C:\Windows\System\gwzaBje.exe
  C:\Windows\System\gwzaBje.exe
  2⤵
  PID:14044
- C:\Windows\System\NJzKtyL.exe
  C:\Windows\System\NJzKtyL.exe
  2⤵
  PID:14032
- C:\Windows\System\GADAyYP.exe
  C:\Windows\System\GADAyYP.exe
  2⤵
  PID:14132
- C:\Windows\System\qtvtYfs.exe
  C:\Windows\System\qtvtYfs.exe
  2⤵
  PID:14204
- C:\Windows\System\XpfQgyu.exe
  C:\Windows\System\XpfQgyu.exe
  2⤵
  PID:14260
- C:\Windows\System\ZnhiAYy.exe
  C:\Windows\System\ZnhiAYy.exe
  2⤵
  PID:12968
- C:\Windows\System\ntoySoS.exe
  C:\Windows\System\ntoySoS.exe
  2⤵
  PID:13000
- C:\Windows\System\imogyKf.exe
  C:\Windows\System\imogyKf.exe
  2⤵
  PID:12820
- C:\Windows\System\jEzFcpa.exe
  C:\Windows\System\jEzFcpa.exe
  2⤵
  PID:13576
- C:\Windows\System\gKrZXlp.exe
  C:\Windows\System\gKrZXlp.exe
  2⤵
  PID:13636
- C:\Windows\System\HnAADEc.exe
  C:\Windows\System\HnAADEc.exe
  2⤵
  PID:13908
- C:\Windows\System\MPkzjCo.exe
  C:\Windows\System\MPkzjCo.exe
  2⤵
  PID:13868
- C:\Windows\System\uXVFwbu.exe
  C:\Windows\System\uXVFwbu.exe
  2⤵
  PID:14112
- C:\Windows\System\fZPKors.exe
  C:\Windows\System\fZPKors.exe
  2⤵
  PID:14076
- C:\Windows\System\gtJwPnW.exe
  C:\Windows\System\gtJwPnW.exe
  2⤵
  PID:14268
- C:\Windows\System\DVPkPJt.exe
  C:\Windows\System\DVPkPJt.exe
  2⤵
  PID:12948
- C:\Windows\System\pjccral.exe
  C:\Windows\System\pjccral.exe
  2⤵
  PID:12700
- C:\Windows\System\kqVlSWp.exe
  C:\Windows\System\kqVlSWp.exe
  2⤵
  PID:13972
- C:\Windows\System\UevBBGG.exe
  C:\Windows\System\UevBBGG.exe
  2⤵
  PID:14176
- C:\Windows\System\tlrBXXq.exe
  C:\Windows\System\tlrBXXq.exe
  2⤵
  PID:12996
- C:\Windows\System\wgcHGAA.exe
  C:\Windows\System\wgcHGAA.exe
  2⤵
  PID:13760
- C:\Windows\System\IRScOqx.exe
  C:\Windows\System\IRScOqx.exe
  2⤵
  PID:14360
- C:\Windows\System\nUHOsWO.exe
  C:\Windows\System\nUHOsWO.exe
  2⤵
  PID:14380
- C:\Windows\System\JQitzBz.exe
  C:\Windows\System\JQitzBz.exe
  2⤵
  PID:14400
- C:\Windows\System\BdiCPgq.exe
  C:\Windows\System\BdiCPgq.exe
  2⤵
  PID:14432
- C:\Windows\System\KRteeqd.exe
  C:\Windows\System\KRteeqd.exe
  2⤵
  PID:14492
- C:\Windows\System\pqpMzjL.exe
  C:\Windows\System\pqpMzjL.exe
  2⤵
  PID:14508
- C:\Windows\System\winHfgb.exe
  C:\Windows\System\winHfgb.exe
  2⤵
  PID:14584
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14584 -s 248
    3⤵
    PID:15228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BQJKCRb.exe

Filesize
1.5MB

MD5
a613900b4a380be47287cd13d1aa442e

SHA1
33bf150718fd5781704753c07498d6397517a718

SHA256
a4c32c510e980ca5342d42b9ee8c45aa5b788bc87ebda5993abd07b1179300e3

SHA512
2f24de0c60ee5a64388dafe53e7a55ed558b4d8492656cc3cac53802b975bb72b4221de8f27f4ef26c16780f507d8ff33e8d8d61bbd90e9cab2f5b8963e25e1c

Download Submit
C:\Windows\System\CCMUxrj.exe

Filesize
1.5MB

MD5
587eab840fd9d22ef4b7b81f5b54fe5c

SHA1
b247cd8d637400456fcd59e28fe29fffc5815365

SHA256
38ee756c4e75dea054feef6661c76572a1b6218d8817ed0a9ab7fa133a7b42e3

SHA512
bd5976a4de1ad5da9cd44eec30ed2d168085c1785ea70284e2062837e2cdf2d25d4c7c01b4a9b899a10f29ad18e53d1f9fa806d91d923e741a56ed68ac89fc40

Download Submit
C:\Windows\System\DOGEFCM.exe

Filesize
1.5MB

MD5
623ea337129d94262a6030b93f787080

SHA1
ef6ff25561993d0b94f483a38ad85ebd5b522a46

SHA256
3a6d6786d4a573809c7389e8d8377fad8511dfa29eaf4fc5b465a701e8a109e0

SHA512
ad2176f0cb3ce41160b7d6b4b1fc0b0dd4efd0b7a9f929db267c339925e725de2f4ec73de08f5f23861507033495c4374c2aced9b84ad965042f00e188611b71

Download Submit
C:\Windows\System\EPBRJfn.exe

Filesize
1.5MB

MD5
c0d9008fbd8f71f0cb1edd399d42c12f

SHA1
099ec996408e60d64e193951afac940e5e98e0cb

SHA256
e9b95009833e983ca160236d6351755e7e546df2420542918b946dc34a3f7a7b

SHA512
d3725d62615229fa71560b0c7a8574a7555d1cd9797ecc0df13a545c3283cc3109d5c841786ce82b13fb45962a9cc74892cd74142adcda68b5b1ed9e718c1059

Download Submit
C:\Windows\System\FHhiVjn.exe

Filesize
1.5MB

MD5
3c35fc6a844a8bc831200e18adf57018

SHA1
a9ba8b441b716299d70b7d3599b4c8e12b152712

SHA256
2ab4f56c655a92003d205ef69337836a1ef45673144d8e5d3381bf3fec5f9fbe

SHA512
f9b5f24f458ff19abeb1b52452781132e8bb2cefec0e584500846aea76b1bd332cab2f1427ed9a0fd627b4244354ea7dafb56e8d1af1227709869d804b9b2802

Download Submit
C:\Windows\System\FYnyQRD.exe

Filesize
1.5MB

MD5
c2e08dfee063469c57765b21f7a1101f

SHA1
ed092ae7ca939503e15f87b77823d0bb2fb4b6f8

SHA256
81dfb0976ec80781b2ffb5ecb9620a4007f13779b3030cd13a70483b86a0ee9e

SHA512
d93709c8fd4d364ea8b753cd9d9223d342632502a4284c3a2fcee02a4c52234a694bbe800f9223b06f087465c68b8f43aea42efff1ed56ee2e3dc154c701b646

Download Submit
C:\Windows\System\HwPoJBg.exe

Filesize
1.5MB

MD5
fdcc0b40b7bd2ea1770145ae5ce4631b

SHA1
d28f727a342c8c5d0a862c4a47730c0456ca6f3c

SHA256
1d9cc3e7d225b5fd8bf1dc701b53de64b1f7a02562e3df68b40f9b25251919c2

SHA512
8cd5987c0a5c8cb5c2085444b9031994235c1cb7218477d49fb34472ce7dcb724b78dbd673836aa0ad9ca521aafef2c5acc4a8de130fe0f002bfac0765213c4f

Download Submit
C:\Windows\System\IIMVTeT.exe

Filesize
1.5MB

MD5
8fc9d01fe0527e36aa7f246c0ae326ee

SHA1
383338b4affa6e896c6cd8109eb3b2332dc71eb1

SHA256
e2f7887d65c9596589d42f3a68671733abbd830832553354b2e17fb989e8238a

SHA512
a91b3550807d450a012605fbd3023035dac556caf5b2b77b44cca5e290ee1b05d48be5727ca86a7499aaae48227b6f552b8a9583b53201eda8f4df4708987c64

Download Submit
C:\Windows\System\IUdjlXA.exe

Filesize
1.5MB

MD5
37bcf76292b8b2d57805fee1e6e05365

SHA1
65fb8c065ed82cbbedea2a1a7065b42523ba5d1b

SHA256
8776f2d9196b0e7bebdcecf43c362d4db5f59172780b3e2d75b86461063c0c9b

SHA512
40b2a2e2f2f09eb2dc614cbb90c2f037c55976ef9149c715e62cb906120a01c52cccf029284a46d309c4a9fc0ca672dc161be92c04e7f3e6e7537ea4c50be9db

Download Submit
C:\Windows\System\InoKoJf.exe

Filesize
1.5MB

MD5
3dbc652fa8089125b508d6b6bf611641

SHA1
6f9bf4e1a131cdbcd9fb6012af99394d2068da6e

SHA256
fb1412933e87b13367df2d8e2709a98dc76b2f12ec56644232058f6ecd293e3e

SHA512
946ef0c1f7d3f1a7a5845e7cdded86ed262f0ec7d2f5555ebffc58b95549c9f8e69022e97a4687acff82401b2738367ba2b837ff3a5ccd7abf84e3195e841076

Download Submit
C:\Windows\System\JSxJFQz.exe

Filesize
1.5MB

MD5
2ed64a6a148b140457eb3dc69da4f1a4

SHA1
8d82493527895c9854e714d9b73f8675d7cc19a7

SHA256
9ce7b8de6fc35be1f9d0fcbf850acfc6fb9033252a98cf1f606a8d3fb1d71a35

SHA512
56b81ed06eed475018eaa089029638e03bb7f8b7a94c1f8538a1b25fbb23bc1eafc85934ae9922c9c468700cba5fe413e8c6a887d6c1015791f1bb618d1ca698

Download Submit
C:\Windows\System\KPTBOcR.exe

Filesize
1.5MB

MD5
5e293596a626b3fbce5c6431146eedb8

SHA1
8209b3c5c8ddd3e9781ecd07052c3fd880d06c5a

SHA256
c9b8ada75fcd3d0a9b97deb2ce0cf2cec4b8554eda59e89298fd0c1cd4fe432f

SHA512
5a7195ec4014256e93f955606423131f288de926c24cfd72fe56865adf21a2e50deff17d340e920948445c4e89638ca789cc7f5dac583b3107ca521174525e09

Download Submit
C:\Windows\System\LRqhwFq.exe

Filesize
1.5MB

MD5
d78802b37d8326200bba292e286eb07e

SHA1
dc56a1a3938561443f212cf7877fe71b2f752243

SHA256
111acc03d9063cff3ea1c5471ae452f25bbb93a4bf1d4c4d2424d2f8af92f5c5

SHA512
0962e37a85a68759effd1cc609467107a3aabd214310c8e26a114506a48b274014d4c8f19c48afa980e478825ee042d5174f828ffca7af311d417575f5ba552a

Download Submit
C:\Windows\System\MvggDmo.exe

Filesize
1.5MB

MD5
f7eb7e6e1d4f16d6745fb7d9f60b8062

SHA1
387aaec247e2d3eaf046d6006a22976094b213c3

SHA256
3b5ea4d4839d2a41e9b1b3f0cea4b65747908fcb84cddefb83179ffa68516da4

SHA512
564830d8faeacc3ab2d8054bf1340184a7987bf19b458c7f131e4259f0aaa9b83773f9b3385566cde007401e28353bccf6089075672cfa0f78451ce27e85b6eb

Download Submit
C:\Windows\System\MwIgABR.exe

Filesize
1.5MB

MD5
7456051881ee1b3e4849db45763fabfc

SHA1
cee41637e874f26939438effed31c776c2438d86

SHA256
5ccd44a4d623b5160dcf3ad51d551b9acb347cd33738381ca0ff83c36aa42dba

SHA512
cfd2bcc37240aa24935f9c6dfb1e8cc857e0a44ea1135e3e8db73bdf646ddcf7a6f1bd0e0c897b7252c899a7e7f49015e87947a7e52156c8fa7c3f37868ad855

Download Submit
C:\Windows\System\OddXNxW.exe

Filesize
1.5MB

MD5
72a2a6fa6e172b64c30504bb18849d9a

SHA1
5822a9297ae48ca61f8bb71c72aada5d1a7c9be8

SHA256
30e8d67c9f6cfab0426dacccd0a13a0da80a61cbfbeb9196842661b41b98b092

SHA512
59c03f99f63429f4f62d22e960d6a378a251204048d4361194da4f9594c9942fc9f57e874509f1e550f6b5c8fd0b2cb3195239a1bb7555f0294731ef1e0d06b6

Download Submit
C:\Windows\System\PAGZGVu.exe

Filesize
1.5MB

MD5
66e39e1dffaeccc246b24749f35cc9e9

SHA1
60e15a2206c9a5f2bce053ece6c988488995a3db

SHA256
bb9aca13473b482b73e37e84ddf763930c45dc21de13f39503d7e9647b5d7b8e

SHA512
efa90f1e28c53cf047bf030e8abdb77eaeada255e5f7b277331cb07727f9ca51d378324e292a23db724e7ff62077fb47ebf76aac72933ed24802a329e42a984b

Download Submit
C:\Windows\System\PMAYyBI.exe

Filesize
1.5MB

MD5
5c47b98e4be77a551d3a82d66e4cd820

SHA1
d0d7ecb5b201316a785d6654c9fc28ce7f6b8973

SHA256
d7355c2426d4d5f6b2bc388c92ae1fb73b8e8bc0ea1bc82768dd13ef9fd4594e

SHA512
3db3321f6714c8d95b4a5474c6a7b4ab2b5fada08d51ba450e5df8484cb70e08325eb09f2db4294d5a413ab8118b6653b0bee8d6f3b504b5183291f95998140d

Download Submit
C:\Windows\System\PfKbaFF.exe

Filesize
1.5MB

MD5
cac0e7769b99a9fab5bb4ee0abbd59f2

SHA1
f845820591bce68a8947228f5e54676d074d4e0b

SHA256
1225c9d33253bbf0426163b4e93f6be6e29a559ae9ef410f65f8e81d485ef557

SHA512
36b88fef21a2baa565c3f3dde6af8af56f3a7fe69934979dfa8cd5bcd5c8629e3ba32209604136f02b454a868d681e51aef11c9482b1021b40eb8d4fc5a338b4

Download Submit
C:\Windows\System\SoRcHGt.exe

Filesize
1.5MB

MD5
04a915ed37bd761794bee1c0c9bba88b

SHA1
02bae03f51fcc0188777f226e77b3e1cc4229db9

SHA256
5f24c7bfffdf348efa11dea25d77f2ca44b4c0bf8161dcd5575afa32c1aa6300

SHA512
7819f052ae68b9afdcb52b9d42db7b3d3e33471ace5a809e1a11aba1e7504308445c081fd52c69a9937fafdae20abf418fde0fe09095cf98c7e9748daa40f660

Download Submit
C:\Windows\System\TDWVKwz.exe

Filesize
1.5MB

MD5
d3d6a266ef11442fdbb78b070add71b5

SHA1
117c16cc03a7f867cb9b48638a9002f7275c370d

SHA256
f582de3b14f48be7ce338db1dc3db8cedbe6e129018ad3fac02a1a709864f028

SHA512
55244f6a1925b205a225c661ecbca8dc04c5261d2c6398d4b93fefe1db5c47501451613291a022897447dde699dc4f981d55e4f7f85117146ee2ffa8fc16e54e

Download Submit
C:\Windows\System\VTAVszz.exe

Filesize
1.5MB

MD5
4b080bd28b79e682014ceb33ff24b6dc

SHA1
5d9521b380c85f7e208373f89391d1c35ee1f3da

SHA256
3c7ed781dbb38a1847f58df21502a08bee1521c537128484b2280e73ba01fd08

SHA512
823338e5fd8f90a99831e6ade3f40a7d190ec00880b9927d6be27c89f33ea9ffd5e83ecf7be9a1eb0d50773f6a0a46454647fbb9bbbacb1a20662699eccbb07d

Download Submit
C:\Windows\System\VpKwBFH.exe

Filesize
1.5MB

MD5
56865fc2170a8b4cd7780c649177571b

SHA1
b4371097c0297d6f9df9c02bb60f6db679ee3377

SHA256
4a62c40771af0077010efe837a1eb1b316e8a8a056dd39bc2708bf3ad192c7d7

SHA512
5893b86385d4e936ec389d6b5e629e12698353a3e26d8fb536443aefd5bf7a5deeb0d7fccc31b3510cb8e15ae9863e3797ef2141b3c4b16cf4c9caf3f9bacd15

Download Submit
C:\Windows\System\WmVOxtW.exe

Filesize
1.5MB

MD5
3cdb77c9e78736d3ab7f08ce6f7ab7e4

SHA1
c29519f0ff7dfa103d6f934f50acb941378403d7

SHA256
08eed5992375c680f89f722a702ab17dd725fc35dd0730759856af02742b4c53

SHA512
f1bd633da2f38f0806778f0e1a155da561369dd5415144af8a6b6da4c4f0656e4a4765f92e044921121c62e493f9174a13ac477f688a80d55ac3387dc7615f3c

Download Submit
C:\Windows\System\WwMDBrO.exe

Filesize
1.5MB

MD5
cb6b2b96ddda1723955971eff7660154

SHA1
6370e50f4d9436fa0e4583c11cb0399e4dbfb3ef

SHA256
9cdfc26e0c9ed28426652adbec26fd2c321358a65abee3f808625f72ad00f4eb

SHA512
6c35550f52e318cb28989367a860af97184f38b489e34023c785ba3a6d43f166d68e6dca54441d047e85210c7e77824f7e995d8495af930fb5895f43bb99dc08

Download Submit
C:\Windows\System\WxKegDU.exe

Filesize
1.5MB

MD5
cc10991b62a45b0108703bf0942e83ce

SHA1
70fe873364b55d57f7dce3e3ab4162c8e616e43e

SHA256
294d87684d172c5a574c6f5e42dc264a57a3416df1b8724a79c3f8d3c74fe2e8

SHA512
453dea426b2b67ef546e33f26e427328e72980af3ee0709e7b6aac7053eaad5b3a8fff5164d010805cf41a6c45183980f61c6ffe80df3b4760c043aa7a614533

Download Submit
C:\Windows\System\YmkbbkW.exe

Filesize
1.5MB

MD5
57cde42de56b69263c9dd42442d78cd2

SHA1
34d09c6968c9f23df456d0b778df43059d61239a

SHA256
72a770806c956806c91756472e3235cda5c5f21187e0b00184dfe31822c81d59

SHA512
95da2049541bf8d06f89349316c7dd55a73e72f8c7268f29e8cb8ee17defb09017c7735254797e84adb8fce13d68879b0397726ae18e9b59c0b80505e6fa7fca

Download Submit
C:\Windows\System\YvrvSLJ.exe

Filesize
1.5MB

MD5
395faa60aa5357e88e31491d0bc0bdab

SHA1
fefb9d24ea3655a493c9c8fbec25bbfe3ab6a515

SHA256
d474c435aefbf1d8b59975869848025f55726f037b32b19b05bd2aafb5e54899

SHA512
41c52474fbbae62d7f630fa7fc96071fa18272b0bb4a47f76ea9f809a95ff6a94f6cd446d28f20f9d56b1dfd9c173498c20be1f08cc9ad409a4fd1acdf27fc5b

Download Submit
C:\Windows\System\aoxbUPQ.exe

Filesize
1.5MB

MD5
6238141750e1bee9aec727d9663c0fd5

SHA1
d66fb038378379ce197bc7414a788cb85fa1bc84

SHA256
7f681e7699f6651fa937013e238a900a87cbacf0158ff5f5af24d3db7887110e

SHA512
fb3b563e7dc8d3b2d47e83d4555981b563b5ca33ad215b30b516bd9fa82add15fe48b694ebcc35256e01e9a01a5941826fa6abe92eefdbc432b033e34c2c61af

Download Submit
C:\Windows\System\bqsYyZt.exe

Filesize
1.5MB

MD5
0362bf6e74d050cfcaffb6dffa95959d

SHA1
12f81f4b473eb20646e07931f235266a632d8c2e

SHA256
1c5e9532691613c3b66cba96701a72dc7da3933bfde90ef789c0667bbf929e04

SHA512
76a1e7fe60f09b22851d01a8fca05e1ef563c2ff59d2279f944408afd9a71ce00a9fa95f33d68c63084c4001958dee8aa3f4c75f37eb19016d1ee0979c0f7078

Download Submit
C:\Windows\System\cPQdxRy.exe

Filesize
1.5MB

MD5
23231b945cd3e4cbea9a510e84dfdb8e

SHA1
c1a60b5a2a5300a4146043f322fb55560ac583cc

SHA256
105539c68c25d2a3f4ff94553b059538b003ece24590003b50bed9c5373b12c4

SHA512
8da131e7bbe50cd707c91ea1fe13f147f1f9ee19e290ad89d5284b506896919f8ecfb25d0b2dc077a04f83da10073e65bd90402a6672e266927f83b03afba8b0

Download Submit
C:\Windows\System\coNxPnK.exe

Filesize
1.5MB

MD5
d1e6ef3fda73c3c4b193ac81a9c13733

SHA1
1ed7e675d0fea87f319ea605fa7cc81e5a72637d

SHA256
4fd2e59d38186d7ef97fa244615b85b88af90cd52ef650252d5146977204f744

SHA512
68380b35b94ec404af0b14b6eef4333456b070061463866a75aac48574078b44c1d4f848e36c65311a2af48b7422bc2bd7e0d86d677871462817985f5024cda3

Download Submit
C:\Windows\System\dFHIgiL.exe

Filesize
1.5MB

MD5
2ec83bf00a8f635735ff438774854691

SHA1
0bf121046aa2bd9064392bf1206a9067daa720bf

SHA256
745c470642b6ce58f3b948422e36ef6eacc8b250dbf97b9d251f1835de237833

SHA512
70358521b15ff913c1c828db1ebef65b3bc513ff40299bdd69d650c1c23505ffa1a0a6a6b6a987d08f8efa2f8188243b393be7aaa30637c3d8d9a5134b1ab7bd

Download Submit
C:\Windows\System\flFjUci.exe

Filesize
1.5MB

MD5
7f005b8500b2d2e5cbd72a6372f91082

SHA1
7f64ca069bc7015de22c8909a553e574eab246f3

SHA256
2769f9825ee0acee2894921ebcf4fb299a8db11d129f9bf6c0ce657979d300ac

SHA512
cf8250018be2c85e7129c7322fe743eaa4440265920386bc88911adc6ea2a844de7896d5a6ce68d6a0a1f73b18033d4c3af75533a145093d1f80b3e26da5ee86

Download Submit
C:\Windows\System\gktiBeW.exe

Filesize
1.5MB

MD5
97f180a2e5ff34c3efbeaa74f4cfa598

SHA1
15637a0bfe4ef5c0aee93c077eb76fcfb6b34bb0

SHA256
8b69d7c56866fca08b3fdb71a82ecd63f14583f2bbcbb6ab5945b36e09609f8b

SHA512
117fb344ee3e150cd2a9c29f50c2d98996f8bc41b3f8845dc7382ed2340e3fe316f57e4815362496ff7d1483dcecdaad3aa2708b0283f1e2b8786b1733a6ad31

Download Submit
C:\Windows\System\jBiNXOG.exe

Filesize
1.5MB

MD5
b887996dc98fd23f5d8e089debbadc28

SHA1
07938455aa483d2b2a10e46e7259b8457f96e9e9

SHA256
885c1557b3d65135aba886057bd0a921c617199a27d8bfcc219b089c28ea0d2d

SHA512
77ea684ec59828d97c849694c8778dd5912c3ed32e98598cf7dc39c4104e43b81739b68afcba98a8f266723c3236b4c123f784ff5e5549f60323acf5ec56567d

Download Submit
C:\Windows\System\jDTaFIY.exe

Filesize
1.5MB

MD5
161876a93fc8bfe63aeb314e7a2c0cdc

SHA1
800a99f36737a6ecc926b1201c47e39f10af1be1

SHA256
7a8a5642a99afdca83ae6327ce515a0eb4729d73823bb564bd1d415786264a2d

SHA512
dca96dba8e7e407c7309a64d7af76deb77e1111e73df1e19803e27f1090f5517be8d3219fcaa5a272b6c79b2bf0d658ba717d67183dffc5af7cca0a42c89cace

Download Submit
C:\Windows\System\jVHkjGR.exe

Filesize
1.5MB

MD5
1af675efbd3e52e43123e32581021d0b

SHA1
61c4a5bd09223f980df7f1b5e5e74ad027288bbf

SHA256
4807d139782ff8cbe5c41128efc9a598adb9bf099bbba375f520bc2790ce29e9

SHA512
a01010a6144a2593df5132fb40fa90264ac105030550fb01af532b27728a9126f67a75640b0e1f97d88553f3f9df3c80e25461d706c5257cc5997440aeac1a1d

Download Submit
C:\Windows\System\klZwBxY.exe

Filesize
1.5MB

MD5
e688bfc39f253b58a01e46a5e4f9532d

SHA1
1ee9ad1b61af01c21ec7e44b97763ce861415fe2

SHA256
94e07eab9d3825af7998b960eb9ae77f137a9c8daad29502795fabdb4a770122

SHA512
609ec677dd7206324b80ff617571023b684e40ad70ebe95b549825f866ffa399557598a22c5cca64deac410c7fca8123e55da9006aa1dc9a82a9ee006cf1e960

Download Submit
C:\Windows\System\lCZWFhs.exe

Filesize
1.5MB

MD5
49c8117cc098678239c7dc0214fec990

SHA1
5cecd565391977434637251b007c15fd0428b955

SHA256
d8e259afa2b38e728ee039c770d0cbebf0463c0776cd466722260d2c48d63951

SHA512
c3b58de5286293caa7ef5cee8edb2af3d40725d1e0f1ebc07c8819e474be49e5a78fdcd795357f7dec18472e413326d55a9421dbb944b9c612543998b97f90d3

Download Submit
C:\Windows\System\lCzYZyh.exe

Filesize
1.5MB

MD5
f2e37c50a9e598d87a663664b0d685e3

SHA1
ab45366fb123bd8c4caec99e7f10781e736b2af4

SHA256
ed2c03ad037ff8394bd3d9800a61e338ee23b264b191e4fdc28ec4dc77378bd3

SHA512
6752fc807dbf9712eef8eb721ae6738b94bbcc3a4f1c53b449fb8fb51f219937ab7d519b6727521a3a3a35fdec449abc7f1b4a488ed10fa2b5503b5b41c4a4a5

Download Submit
C:\Windows\System\mjDBubx.exe

Filesize
1.5MB

MD5
c0a34fc11af2ec28d4f2e6984b70c89a

SHA1
d6dbe9002ab7a25fb2072d220c585eac1b7ead49

SHA256
bbbea9b09ad520037cc4dbfd5a413b70c9cbf56974bb59faaefc2e899b2df6a5

SHA512
31c5c54a45f4784acf44a03a9b746f6f32fc3aa9b8bac39cdfc1fda311957b0d8a76a164ef0b4622decfc78b7dbc240e4a73ab0fc05d25bbd386e7db98ca1f4c

Download Submit
C:\Windows\System\oJSHkFA.exe

Filesize
1.5MB

MD5
67bd33d19c11bad847fd91142e377741

SHA1
eddb4337ae5c878e204185adf6103fd7dfcb5e18

SHA256
6f70f2e7aabb78424fcb1ad2d9135ca7f6256f7139b8a358d571b8518d029662

SHA512
c297b32d920fdba7a451eb76197f8e5c0fdb6caad685299726afc8d9c10ad69e1a7644d0aa25ee9ed3874ea32c9d7289c204441edf904e3c69736eef34b245b7

Download Submit
C:\Windows\System\pvioLSq.exe

Filesize
1.5MB

MD5
de8ef710bc6f774d075188048293294c

SHA1
39e7936856d306e39c65a10b5ca6e73c51ad13f8

SHA256
4d0fcfe635903126f46ccf8023fab5137b40806ede026b7f0675e28557bf99d4

SHA512
a034461ab1e914d01825b622e771969657cb1bfae6963fdb2fbd0ef67bc4f3164dc24b5360c731c1a457c6261f3d36faf99c9b53c04ae3b91473094673d10a10

Download Submit
C:\Windows\System\ryVFYFt.exe

Filesize
1.5MB

MD5
1c4e80c6e5fd275bd14eeaacf1d5ced1

SHA1
140974ce0216522044e3607aef6255d85cb6d17b

SHA256
83321d102a22ba21d9a8aa108db7044fad15cbf315262d9a6521a635fddcba08

SHA512
769c90211e30542c2e44ec0170316587432513b7aec585be9b025f60f709885bc2cb52b96a94572a293a2fc9ef929121f0358205f16af67bf877b5afaecd7ec1

Download Submit
C:\Windows\System\sRGecEx.exe

Filesize
1.5MB

MD5
1aac9e2b7a34182ec1b3fbc03b04134b

SHA1
9eb48302278f226a27db38e9a9a3a0868d718b57

SHA256
757fda6003422fd382146bc775b1bd085e928d33e22cd291bf47eab1acab2a63

SHA512
b447d9d9bc94c278df7d6acef4df23b7d604544f35db6ff2f7e18ea06dfd510f1a6c48e47e926e2a1c6741e18171b18a3e5483d49749daa8a4b60ce554761c7d

Download Submit
C:\Windows\System\ujmITDs.exe

Filesize
1.5MB

MD5
a8282f8b5c930a7a0caaa3b8a56d4ec9

SHA1
aa92d5de7a13a65c0b269171a5fe640ab4ea056f

SHA256
a77417d8923db2fc341ccb869254be0e996ef7dc50cb80d833f3bafe35cf8449

SHA512
d11fab96b59daa6df7d0101490fd3382c1bae069d1198992827d737ea86c7de2fba14c5ade3217449b2e7ffcac08a1e21b5a5bccdceaedcaf616ba126a83cdd2

Download Submit
C:\Windows\System\vcyNmam.exe

Filesize
1.5MB

MD5
8419d9a0a5aada1e60476ef62ac47b01

SHA1
4239d76b921c70ca33e3d6c06e1f2c7a4ce2375f

SHA256
a23a71f7410f55e832d02310827ca8e6542a29dc6f0c5ea2e4e0996d54fa9876

SHA512
10a833c84554adb99d9f94ec12dd1174ee6e2608d2a3b7387f1c4106e1ef552e81fd4e149eeaeffbd4118a9659a4d5dd9623d1253a140552a05396772329cc52

Download Submit
C:\Windows\System\wUYVwAG.exe

Filesize
1.5MB

MD5
6cfdc7729f743e736bdd48767b1f9663

SHA1
d835b1014a074b76460d2e31b1caca6f400d6f62

SHA256
e81e59c0165e2e963a1a37e10be3d00878af6d4da7fbda9068f873be5b44526f

SHA512
e0eaf9a1263ae555416ba808b03411341d81ca1dfc69d2a7a522e32d47e8070915b9159537df11c800a1bc8fbecbb5eebd9a888703c0b7a30a081a52fa7f5e4a

Download Submit
C:\Windows\System\zyZKzSO.exe

Filesize
1.5MB

MD5
daa9fa08455715bcab70afd52b1755c0

SHA1
b0cf1808520ecb75faf5a254703cc496517ec70b

SHA256
2897103ef6b4297531002cc509cab6ac919cfdd94aa82200d2f2b5dca7d4da4e

SHA512
26d79ca173df7bdb1ec616dfd66d04b5517e54e3b388104c052e36a70b4f656d77c4dc20b21baea60b35284fde0e47c1bff077de73585b26fa8dbf63859cf47c

Download Submit
memory/212-2313-0x00007FF74C030000-0x00007FF74C381000-memory.dmp

Filesize
3.3MB

Download
memory/212-144-0x00007FF74C030000-0x00007FF74C381000-memory.dmp

Filesize
3.3MB

Download
memory/212-2461-0x00007FF74C030000-0x00007FF74C381000-memory.dmp

Filesize
3.3MB

Download
memory/396-2325-0x00007FF644C90000-0x00007FF644FE1000-memory.dmp

Filesize
3.3MB

Download
memory/396-33-0x00007FF644C90000-0x00007FF644FE1000-memory.dmp

Filesize
3.3MB

Download
memory/624-133-0x00007FF70BB90000-0x00007FF70BEE1000-memory.dmp

Filesize
3.3MB

Download
memory/624-44-0x00007FF70BB90000-0x00007FF70BEE1000-memory.dmp

Filesize
3.3MB

Download
memory/624-2334-0x00007FF70BB90000-0x00007FF70BEE1000-memory.dmp

Filesize
3.3MB

Download
memory/748-107-0x00007FF7733F0000-0x00007FF773741000-memory.dmp

Filesize
3.3MB

Download
memory/748-2451-0x00007FF7733F0000-0x00007FF773741000-memory.dmp

Filesize
3.3MB

Download
memory/1276-97-0x00007FF6382F0000-0x00007FF638641000-memory.dmp

Filesize
3.3MB

Download
memory/1276-2428-0x00007FF6382F0000-0x00007FF638641000-memory.dmp

Filesize
3.3MB

Download
memory/1372-91-0x00007FF6BEFD0000-0x00007FF6BF321000-memory.dmp

Filesize
3.3MB

Download
memory/1372-2445-0x00007FF6BEFD0000-0x00007FF6BF321000-memory.dmp

Filesize
3.3MB

Download
memory/1432-2457-0x00007FF6890F0000-0x00007FF689441000-memory.dmp

Filesize
3.3MB

Download
memory/1432-115-0x00007FF6890F0000-0x00007FF689441000-memory.dmp

Filesize
3.3MB

Download
memory/1444-12-0x00007FF666910000-0x00007FF666C61000-memory.dmp

Filesize
3.3MB

Download
memory/1444-2323-0x00007FF666910000-0x00007FF666C61000-memory.dmp

Filesize
3.3MB

Download
memory/1580-2463-0x00007FF6F0780000-0x00007FF6F0AD1000-memory.dmp

Filesize
3.3MB

Download
memory/1580-2312-0x00007FF6F0780000-0x00007FF6F0AD1000-memory.dmp

Filesize
3.3MB

Download
memory/1580-134-0x00007FF6F0780000-0x00007FF6F0AD1000-memory.dmp

Filesize
3.3MB

Download
memory/1848-2338-0x00007FF716B10000-0x00007FF716E61000-memory.dmp

Filesize
3.3MB

Download
memory/1848-62-0x00007FF716B10000-0x00007FF716E61000-memory.dmp

Filesize
3.3MB

Download
memory/1848-148-0x00007FF716B10000-0x00007FF716E61000-memory.dmp

Filesize
3.3MB

Download
memory/1864-25-0x00007FF704E10000-0x00007FF705161000-memory.dmp

Filesize
3.3MB

Download
memory/1864-124-0x00007FF704E10000-0x00007FF705161000-memory.dmp

Filesize
3.3MB

Download
memory/1864-2327-0x00007FF704E10000-0x00007FF705161000-memory.dmp

Filesize
3.3MB

Download
memory/1920-2317-0x00007FF667C70000-0x00007FF667FC1000-memory.dmp

Filesize
3.3MB

Download
memory/1920-140-0x00007FF667C70000-0x00007FF667FC1000-memory.dmp

Filesize
3.3MB

Download
memory/1920-2465-0x00007FF667C70000-0x00007FF667FC1000-memory.dmp

Filesize
3.3MB

Download
memory/2512-152-0x00007FF70A920000-0x00007FF70AC71000-memory.dmp

Filesize
3.3MB

Download
memory/2512-2469-0x00007FF70A920000-0x00007FF70AC71000-memory.dmp

Filesize
3.3MB

Download
memory/2512-2320-0x00007FF70A920000-0x00007FF70AC71000-memory.dmp

Filesize
3.3MB

Download
memory/2748-120-0x00007FF64F490000-0x00007FF64F7E1000-memory.dmp

Filesize
3.3MB

Download
memory/2748-2456-0x00007FF64F490000-0x00007FF64F7E1000-memory.dmp

Filesize
3.3MB

Download
memory/2748-2277-0x00007FF64F490000-0x00007FF64F7E1000-memory.dmp

Filesize
3.3MB

Download
memory/2852-103-0x00007FF79D7E0000-0x00007FF79DB31000-memory.dmp

Filesize
3.3MB

Download
memory/2852-2449-0x00007FF79D7E0000-0x00007FF79DB31000-memory.dmp

Filesize
3.3MB

Download
memory/2992-139-0x00007FF6138A0000-0x00007FF613BF1000-memory.dmp

Filesize
3.3MB

Download
memory/2992-55-0x00007FF6138A0000-0x00007FF613BF1000-memory.dmp

Filesize
3.3MB

Download
memory/2992-2335-0x00007FF6138A0000-0x00007FF613BF1000-memory.dmp

Filesize
3.3MB

Download
memory/3048-2348-0x00007FF702660000-0x00007FF7029B1000-memory.dmp

Filesize
3.3MB

Download
memory/3048-87-0x00007FF702660000-0x00007FF7029B1000-memory.dmp

Filesize
3.3MB

Download
memory/3060-41-0x00007FF727C60000-0x00007FF727FB1000-memory.dmp

Filesize
3.3MB

Download
memory/3060-2330-0x00007FF727C60000-0x00007FF727FB1000-memory.dmp

Filesize
3.3MB

Download
memory/3440-125-0x00007FF79C610000-0x00007FF79C961000-memory.dmp

Filesize
3.3MB

Download
memory/3440-2454-0x00007FF79C610000-0x00007FF79C961000-memory.dmp

Filesize
3.3MB

Download
memory/3440-2279-0x00007FF79C610000-0x00007FF79C961000-memory.dmp

Filesize
3.3MB

Download
memory/3488-135-0x00007FF7430A0000-0x00007FF7433F1000-memory.dmp

Filesize
3.3MB

Download
memory/3488-45-0x00007FF7430A0000-0x00007FF7433F1000-memory.dmp

Filesize
3.3MB

Download
memory/3488-2339-0x00007FF7430A0000-0x00007FF7433F1000-memory.dmp

Filesize
3.3MB

Download
memory/3660-2473-0x00007FF6E54C0000-0x00007FF6E5811000-memory.dmp

Filesize
3.3MB

Download
memory/3660-153-0x00007FF6E54C0000-0x00007FF6E5811000-memory.dmp

Filesize
3.3MB

Download
memory/3660-2321-0x00007FF6E54C0000-0x00007FF6E5811000-memory.dmp

Filesize
3.3MB

Download
memory/4020-100-0x00007FF7460E0000-0x00007FF746431000-memory.dmp

Filesize
3.3MB

Download
memory/4020-2349-0x00007FF7460E0000-0x00007FF746431000-memory.dmp

Filesize
3.3MB

Download
memory/4400-0-0x00007FF6B2640000-0x00007FF6B2991000-memory.dmp

Filesize
3.3MB

Download
memory/4400-116-0x00007FF6B2640000-0x00007FF6B2991000-memory.dmp

Filesize
3.3MB

Download
memory/4400-1-0x00000172FFAB0000-0x00000172FFAC0000-memory.dmp

Filesize
64KB

Download
memory/4412-2343-0x00007FF77A9A0000-0x00007FF77ACF1000-memory.dmp

Filesize
3.3MB

Download
memory/4412-83-0x00007FF77A9A0000-0x00007FF77ACF1000-memory.dmp

Filesize
3.3MB

Download
memory/4468-2448-0x00007FF6B0C70000-0x00007FF6B0FC1000-memory.dmp

Filesize
3.3MB

Download
memory/4468-111-0x00007FF6B0C70000-0x00007FF6B0FC1000-memory.dmp

Filesize
3.3MB

Download
memory/4500-2341-0x00007FF717BC0000-0x00007FF717F11000-memory.dmp

Filesize
3.3MB

Download
memory/4500-92-0x00007FF717BC0000-0x00007FF717F11000-memory.dmp

Filesize
3.3MB

Download
memory/4668-84-0x00007FF73B620000-0x00007FF73B971000-memory.dmp

Filesize
3.3MB

Download
memory/4668-2345-0x00007FF73B620000-0x00007FF73B971000-memory.dmp

Filesize
3.3MB

Download
memory/4780-2282-0x00007FF60A010000-0x00007FF60A361000-memory.dmp

Filesize
3.3MB

Download
memory/4780-2459-0x00007FF60A010000-0x00007FF60A361000-memory.dmp

Filesize
3.3MB

Download
memory/4780-129-0x00007FF60A010000-0x00007FF60A361000-memory.dmp

Filesize
3.3MB

Download
memory/4792-2331-0x00007FF71E900000-0x00007FF71EC51000-memory.dmp

Filesize
3.3MB

Download
memory/4792-36-0x00007FF71E900000-0x00007FF71EC51000-memory.dmp

Filesize
3.3MB

Download
memory/5008-2382-0x00007FF671080000-0x00007FF6713D1000-memory.dmp

Filesize
3.3MB

Download
memory/5008-2470-0x00007FF671080000-0x00007FF6713D1000-memory.dmp

Filesize
3.3MB

Download
memory/5008-157-0x00007FF671080000-0x00007FF6713D1000-memory.dmp

Filesize
3.3MB

Download