xmrig | 371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
Size

2.3MB
MD5

d7f538102cf696fe415a622c54b5d800
SHA1

079343e6b0a18be1f8544e262f73a67ec68afabc
SHA256

371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9
SHA512

f5eeaf4ec0d4dde7bcee4e3e82a2ea46bcae7a6ee9831b7e8b369c8196338609906e025bd92b3813ada1bb722073e9acdadfb0b006b7b7afe40f1af4678defdf
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQUUvXjVTRdf5k5p8iKCoY:BemTLkNdfE0pZrQ8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 62 IoCs

miner

resource	yara_rule
behavioral1/memory/2752-0-0x000000013F930000-0x000000013FC84000-memory.dmp	xmrig
behavioral1/files/0x002f00000001566b-11.dat	xmrig
behavioral1/files/0x0008000000015ca6-15.dat	xmrig
behavioral1/files/0x0008000000015cba-16.dat	xmrig
behavioral1/files/0x0007000000015ce1-23.dat	xmrig
behavioral1/files/0x0006000000016c6b-74.dat	xmrig
behavioral1/files/0x0006000000016ce4-82.dat	xmrig
behavioral1/files/0x0006000000016d26-94.dat	xmrig
behavioral1/files/0x0006000000016d3a-98.dat	xmrig
behavioral1/files/0x0006000000017052-130.dat	xmrig
behavioral1/memory/2460-557-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/memory/360-555-0x000000013F9E0000-0x000000013FD34000-memory.dmp	xmrig
behavioral1/memory/2616-553-0x000000013F630000-0x000000013F984000-memory.dmp	xmrig
behavioral1/memory/2464-551-0x000000013F160000-0x000000013F4B4000-memory.dmp	xmrig
behavioral1/memory/2288-549-0x000000013F0C0000-0x000000013F414000-memory.dmp	xmrig
behavioral1/memory/1996-547-0x000000013F500000-0x000000013F854000-memory.dmp	xmrig
behavioral1/memory/2652-545-0x000000013FD90000-0x00000001400E4000-memory.dmp	xmrig
behavioral1/memory/2604-543-0x000000013FDB0000-0x0000000140104000-memory.dmp	xmrig
behavioral1/memory/2712-541-0x000000013FAD0000-0x000000013FE24000-memory.dmp	xmrig
behavioral1/memory/2636-539-0x000000013FB90000-0x000000013FEE4000-memory.dmp	xmrig
behavioral1/memory/2556-537-0x000000013FCD0000-0x0000000140024000-memory.dmp	xmrig
behavioral1/memory/2536-520-0x000000013FC00000-0x000000013FF54000-memory.dmp	xmrig
behavioral1/memory/2404-490-0x000000013F5F0000-0x000000013F944000-memory.dmp	xmrig
behavioral1/memory/1728-501-0x000000013F440000-0x000000013F794000-memory.dmp	xmrig
behavioral1/files/0x0006000000016eb2-126.dat	xmrig
behavioral1/files/0x0006000000016e94-122.dat	xmrig
behavioral1/files/0x0006000000016dbf-118.dat	xmrig
behavioral1/files/0x0006000000016dbb-114.dat	xmrig
behavioral1/files/0x0006000000016da7-110.dat	xmrig
behavioral1/files/0x0006000000016d90-107.dat	xmrig
behavioral1/files/0x0006000000016d7e-102.dat	xmrig
behavioral1/files/0x0006000000016d1e-90.dat	xmrig
behavioral1/files/0x0006000000016d0d-86.dat	xmrig
behavioral1/files/0x0006000000016cb7-78.dat	xmrig
behavioral1/files/0x0006000000016c63-70.dat	xmrig
behavioral1/files/0x0006000000016c4a-66.dat	xmrig
behavioral1/files/0x0006000000016a9a-62.dat	xmrig
behavioral1/files/0x0006000000016843-58.dat	xmrig
behavioral1/files/0x000600000001661c-54.dat	xmrig
behavioral1/files/0x0006000000016572-50.dat	xmrig
behavioral1/files/0x00060000000164b2-46.dat	xmrig
behavioral1/files/0x000600000001630b-42.dat	xmrig
behavioral1/files/0x00060000000161e7-38.dat	xmrig
behavioral1/files/0x0008000000016117-34.dat	xmrig
behavioral1/files/0x0007000000015d07-31.dat	xmrig
behavioral1/files/0x0007000000015ceb-26.dat	xmrig
behavioral1/files/0x000c00000001269e-6.dat	xmrig
behavioral1/memory/2752-3802-0x000000013F930000-0x000000013FC84000-memory.dmp	xmrig
behavioral1/memory/2404-4028-0x000000013F5F0000-0x000000013F944000-memory.dmp	xmrig
behavioral1/memory/2556-4030-0x000000013FCD0000-0x0000000140024000-memory.dmp	xmrig
behavioral1/memory/1728-4029-0x000000013F440000-0x000000013F794000-memory.dmp	xmrig
behavioral1/memory/2712-4031-0x000000013FAD0000-0x000000013FE24000-memory.dmp	xmrig
behavioral1/memory/2652-4032-0x000000013FD90000-0x00000001400E4000-memory.dmp	xmrig
behavioral1/memory/2464-4035-0x000000013F160000-0x000000013F4B4000-memory.dmp	xmrig
behavioral1/memory/1996-4034-0x000000013F500000-0x000000013F854000-memory.dmp	xmrig
behavioral1/memory/360-4033-0x000000013F9E0000-0x000000013FD34000-memory.dmp	xmrig
behavioral1/memory/2604-4036-0x000000013FDB0000-0x0000000140104000-memory.dmp	xmrig
behavioral1/memory/2636-4037-0x000000013FB90000-0x000000013FEE4000-memory.dmp	xmrig
behavioral1/memory/2536-4038-0x000000013FC00000-0x000000013FF54000-memory.dmp	xmrig
behavioral1/memory/2616-4039-0x000000013F630000-0x000000013F984000-memory.dmp	xmrig
behavioral1/memory/2460-4041-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/memory/2288-4040-0x000000013F0C0000-0x000000013F414000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2404	TKElCaa.exe
1728	AjzTDXp.exe
2536	URRkKBV.exe
2556	UflXsAP.exe
2636	hsjjJsc.exe
2712	gdhHdHm.exe
2604	jBoFaKu.exe
2652	NUrgEvm.exe
1996	HuYCVrK.exe
2288	zUsBGTV.exe
2464	HTKFcYt.exe
2616	sGAVNay.exe
360	GyWRzBf.exe
2460	rWFVzZa.exe
2520	tBVNSBq.exe
3000	hVyMzBZ.exe
1340	adsGTdd.exe
1576	OKSYfQg.exe
2812	WIBugDM.exe
2832	EynTaOT.exe
2840	oxsHfbQ.exe
2968	tGDDdrz.exe
2984	qEuzqwP.exe
1596	oqSWcEp.exe
1328	OxrfDTF.exe
324	BEfBJri.exe
3016	OaqhZhl.exe
2988	ZfPCXMP.exe
632	cQywYEC.exe
488	alDYycv.exe
2480	rRMpTZZ.exe
3028	wLOArRt.exe
1336	OvEPhJh.exe
2064	cYqBDCX.exe
2068	EtiekKQ.exe
2924	gBUWSLI.exe
2424	MTQukrh.exe
844	Pqdmdhb.exe
880	cmqxVeq.exe
1048	LBvVabE.exe
596	XXMZmLs.exe
1488	NaOarra.exe
532	OWDEAGt.exe
1680	ZNFHkfo.exe
2972	kKIJZxv.exe
2392	rPfwjVf.exe
2168	dgIAWZr.exe
700	SmwEZou.exe
1088	HGfnTIF.exe
1272	bHWKIGF.exe
2108	doUhhwg.exe
1760	LKKuvqK.exe
272	ugsDRZS.exe
1860	VceFeMl.exe
1940	XStvBRL.exe
1388	rXoYsie.exe
852	fFaMaOB.exe
1032	hVXhxcg.exe
1028	KKqkTGe.exe
868	vgwrBPS.exe
920	joBFfPN.exe
1956	CqWDqHg.exe
992	IUOjjFn.exe
2884	ULmpIzy.exe

Loads dropped DLL 64 IoCs

pid	Process
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2752-0-0x000000013F930000-0x000000013FC84000-memory.dmp	upx
behavioral1/files/0x002f00000001566b-11.dat	upx
behavioral1/files/0x0008000000015ca6-15.dat	upx
behavioral1/files/0x0008000000015cba-16.dat	upx
behavioral1/files/0x0007000000015ce1-23.dat	upx
behavioral1/files/0x0006000000016c6b-74.dat	upx
behavioral1/files/0x0006000000016ce4-82.dat	upx
behavioral1/files/0x0006000000016d26-94.dat	upx
behavioral1/files/0x0006000000016d3a-98.dat	upx
behavioral1/files/0x0006000000017052-130.dat	upx
behavioral1/memory/2460-557-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/memory/360-555-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx
behavioral1/memory/2616-553-0x000000013F630000-0x000000013F984000-memory.dmp	upx
behavioral1/memory/2464-551-0x000000013F160000-0x000000013F4B4000-memory.dmp	upx
behavioral1/memory/2288-549-0x000000013F0C0000-0x000000013F414000-memory.dmp	upx
behavioral1/memory/1996-547-0x000000013F500000-0x000000013F854000-memory.dmp	upx
behavioral1/memory/2652-545-0x000000013FD90000-0x00000001400E4000-memory.dmp	upx
behavioral1/memory/2604-543-0x000000013FDB0000-0x0000000140104000-memory.dmp	upx
behavioral1/memory/2712-541-0x000000013FAD0000-0x000000013FE24000-memory.dmp	upx
behavioral1/memory/2636-539-0x000000013FB90000-0x000000013FEE4000-memory.dmp	upx
behavioral1/memory/2556-537-0x000000013FCD0000-0x0000000140024000-memory.dmp	upx
behavioral1/memory/2536-520-0x000000013FC00000-0x000000013FF54000-memory.dmp	upx
behavioral1/memory/2404-490-0x000000013F5F0000-0x000000013F944000-memory.dmp	upx
behavioral1/memory/1728-501-0x000000013F440000-0x000000013F794000-memory.dmp	upx
behavioral1/files/0x0006000000016eb2-126.dat	upx
behavioral1/files/0x0006000000016e94-122.dat	upx
behavioral1/files/0x0006000000016dbf-118.dat	upx
behavioral1/files/0x0006000000016dbb-114.dat	upx
behavioral1/files/0x0006000000016da7-110.dat	upx
behavioral1/files/0x0006000000016d90-107.dat	upx
behavioral1/files/0x0006000000016d7e-102.dat	upx
behavioral1/files/0x0006000000016d1e-90.dat	upx
behavioral1/files/0x0006000000016d0d-86.dat	upx
behavioral1/files/0x0006000000016cb7-78.dat	upx
behavioral1/files/0x0006000000016c63-70.dat	upx
behavioral1/files/0x0006000000016c4a-66.dat	upx
behavioral1/files/0x0006000000016a9a-62.dat	upx
behavioral1/files/0x0006000000016843-58.dat	upx
behavioral1/files/0x000600000001661c-54.dat	upx
behavioral1/files/0x0006000000016572-50.dat	upx
behavioral1/files/0x00060000000164b2-46.dat	upx
behavioral1/files/0x000600000001630b-42.dat	upx
behavioral1/files/0x00060000000161e7-38.dat	upx
behavioral1/files/0x0008000000016117-34.dat	upx
behavioral1/files/0x0007000000015d07-31.dat	upx
behavioral1/files/0x0007000000015ceb-26.dat	upx
behavioral1/files/0x000c00000001269e-6.dat	upx
behavioral1/memory/2752-3802-0x000000013F930000-0x000000013FC84000-memory.dmp	upx
behavioral1/memory/2404-4028-0x000000013F5F0000-0x000000013F944000-memory.dmp	upx
behavioral1/memory/2556-4030-0x000000013FCD0000-0x0000000140024000-memory.dmp	upx
behavioral1/memory/1728-4029-0x000000013F440000-0x000000013F794000-memory.dmp	upx
behavioral1/memory/2712-4031-0x000000013FAD0000-0x000000013FE24000-memory.dmp	upx
behavioral1/memory/2652-4032-0x000000013FD90000-0x00000001400E4000-memory.dmp	upx
behavioral1/memory/2464-4035-0x000000013F160000-0x000000013F4B4000-memory.dmp	upx
behavioral1/memory/1996-4034-0x000000013F500000-0x000000013F854000-memory.dmp	upx
behavioral1/memory/360-4033-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx
behavioral1/memory/2604-4036-0x000000013FDB0000-0x0000000140104000-memory.dmp	upx
behavioral1/memory/2636-4037-0x000000013FB90000-0x000000013FEE4000-memory.dmp	upx
behavioral1/memory/2536-4038-0x000000013FC00000-0x000000013FF54000-memory.dmp	upx
behavioral1/memory/2616-4039-0x000000013F630000-0x000000013F984000-memory.dmp	upx
behavioral1/memory/2460-4041-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/memory/2288-4040-0x000000013F0C0000-0x000000013F414000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oZmbVpm.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\znWoRsq.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\MsiUMGi.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\UPetinu.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\fCbWZMI.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\lAhSdHj.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\bmGwjoh.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\aChwxcG.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\EtiekKQ.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\jRUXcTP.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\sZpQlmb.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\MiFozQN.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\KwdOTpc.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\CgkbePE.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\oAtxaih.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\nivSHbG.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\VJLjhIK.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\PjHOCWN.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\cxxpGfu.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\UgnEobg.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\MDdhBob.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\OGCcVfh.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\hVyMzBZ.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\wBuVfEp.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\EeyBcNM.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\VZftcuZ.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\RKYFFOV.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\LFPbJdM.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\hgVBdcR.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\uPGvKHj.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\UHZJvuE.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\pKNlrtk.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\XggeoMq.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\pDlSLgS.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\ZskVjQe.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\bfSarQn.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\LlTgQZd.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\DhmSeUJ.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\zUsBGTV.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\UFNACmY.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\EqkpAAY.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\ouzpPkx.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\soJXqtC.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\LWQLyct.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\UaWLhME.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\DnIZlHO.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\QbDuKPk.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\vsnNeDJ.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\hNDWhTr.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\iliTFdi.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\lhEZoZA.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\kAjxtlm.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\JgzWhqP.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\kuziTiA.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\pfPwZbn.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\wXjbhwI.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\ZhcFmrI.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\BauhxYx.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\YybwMER.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\cQywYEC.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\OAWXBCJ.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\BCrnqbY.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\gtuBTEq.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
File created	C:\Windows\System\jUGCziQ.exe	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2404	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	29
PID 2752 wrote to memory of 2404	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	29
PID 2752 wrote to memory of 2404	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	29
PID 2752 wrote to memory of 1728	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	30
PID 2752 wrote to memory of 1728	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	30
PID 2752 wrote to memory of 1728	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	30
PID 2752 wrote to memory of 2536	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	31
PID 2752 wrote to memory of 2536	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	31
PID 2752 wrote to memory of 2536	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	31
PID 2752 wrote to memory of 2556	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	32
PID 2752 wrote to memory of 2556	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	32
PID 2752 wrote to memory of 2556	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	32
PID 2752 wrote to memory of 2636	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	33
PID 2752 wrote to memory of 2636	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	33
PID 2752 wrote to memory of 2636	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	33
PID 2752 wrote to memory of 2712	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	34
PID 2752 wrote to memory of 2712	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	34
PID 2752 wrote to memory of 2712	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	34
PID 2752 wrote to memory of 2604	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	35
PID 2752 wrote to memory of 2604	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	35
PID 2752 wrote to memory of 2604	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	35
PID 2752 wrote to memory of 2652	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	36
PID 2752 wrote to memory of 2652	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	36
PID 2752 wrote to memory of 2652	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	36
PID 2752 wrote to memory of 1996	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	37
PID 2752 wrote to memory of 1996	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	37
PID 2752 wrote to memory of 1996	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	37
PID 2752 wrote to memory of 2288	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	38
PID 2752 wrote to memory of 2288	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	38
PID 2752 wrote to memory of 2288	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	38
PID 2752 wrote to memory of 2464	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	39
PID 2752 wrote to memory of 2464	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	39
PID 2752 wrote to memory of 2464	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	39
PID 2752 wrote to memory of 2616	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	40
PID 2752 wrote to memory of 2616	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	40
PID 2752 wrote to memory of 2616	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	40
PID 2752 wrote to memory of 360	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	41
PID 2752 wrote to memory of 360	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	41
PID 2752 wrote to memory of 360	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	41
PID 2752 wrote to memory of 2460	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	42
PID 2752 wrote to memory of 2460	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	42
PID 2752 wrote to memory of 2460	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	42
PID 2752 wrote to memory of 2520	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	43
PID 2752 wrote to memory of 2520	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	43
PID 2752 wrote to memory of 2520	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	43
PID 2752 wrote to memory of 3000	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	44
PID 2752 wrote to memory of 3000	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	44
PID 2752 wrote to memory of 3000	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	44
PID 2752 wrote to memory of 1340	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	45
PID 2752 wrote to memory of 1340	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	45
PID 2752 wrote to memory of 1340	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	45
PID 2752 wrote to memory of 1576	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	46
PID 2752 wrote to memory of 1576	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	46
PID 2752 wrote to memory of 1576	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	46
PID 2752 wrote to memory of 2812	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	47
PID 2752 wrote to memory of 2812	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	47
PID 2752 wrote to memory of 2812	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	47
PID 2752 wrote to memory of 2832	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	48
PID 2752 wrote to memory of 2832	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	48
PID 2752 wrote to memory of 2832	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	48
PID 2752 wrote to memory of 2840	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	49
PID 2752 wrote to memory of 2840	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	49
PID 2752 wrote to memory of 2840	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	49
PID 2752 wrote to memory of 2968	2752	371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\371d7bee913c6fc0ed9f1e1dcbc2493ac5c10aa7126c3c518f848c2ef5e02de9_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System\TKElCaa.exe
  C:\Windows\System\TKElCaa.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\AjzTDXp.exe
  C:\Windows\System\AjzTDXp.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\URRkKBV.exe
  C:\Windows\System\URRkKBV.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\UflXsAP.exe
  C:\Windows\System\UflXsAP.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\hsjjJsc.exe
  C:\Windows\System\hsjjJsc.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\gdhHdHm.exe
  C:\Windows\System\gdhHdHm.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\jBoFaKu.exe
  C:\Windows\System\jBoFaKu.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\NUrgEvm.exe
  C:\Windows\System\NUrgEvm.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\HuYCVrK.exe
  C:\Windows\System\HuYCVrK.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\zUsBGTV.exe
  C:\Windows\System\zUsBGTV.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\HTKFcYt.exe
  C:\Windows\System\HTKFcYt.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\sGAVNay.exe
  C:\Windows\System\sGAVNay.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\GyWRzBf.exe
  C:\Windows\System\GyWRzBf.exe
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Windows\System\rWFVzZa.exe
  C:\Windows\System\rWFVzZa.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\tBVNSBq.exe
  C:\Windows\System\tBVNSBq.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\hVyMzBZ.exe
  C:\Windows\System\hVyMzBZ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\adsGTdd.exe
  C:\Windows\System\adsGTdd.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\OKSYfQg.exe
  C:\Windows\System\OKSYfQg.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\WIBugDM.exe
  C:\Windows\System\WIBugDM.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\EynTaOT.exe
  C:\Windows\System\EynTaOT.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\oxsHfbQ.exe
  C:\Windows\System\oxsHfbQ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\tGDDdrz.exe
  C:\Windows\System\tGDDdrz.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\qEuzqwP.exe
  C:\Windows\System\qEuzqwP.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\oqSWcEp.exe
  C:\Windows\System\oqSWcEp.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\OxrfDTF.exe
  C:\Windows\System\OxrfDTF.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\BEfBJri.exe
  C:\Windows\System\BEfBJri.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\OaqhZhl.exe
  C:\Windows\System\OaqhZhl.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\ZfPCXMP.exe
  C:\Windows\System\ZfPCXMP.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\cQywYEC.exe
  C:\Windows\System\cQywYEC.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\alDYycv.exe
  C:\Windows\System\alDYycv.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\rRMpTZZ.exe
  C:\Windows\System\rRMpTZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\wLOArRt.exe
  C:\Windows\System\wLOArRt.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\OvEPhJh.exe
  C:\Windows\System\OvEPhJh.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\cYqBDCX.exe
  C:\Windows\System\cYqBDCX.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\EtiekKQ.exe
  C:\Windows\System\EtiekKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\gBUWSLI.exe
  C:\Windows\System\gBUWSLI.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\MTQukrh.exe
  C:\Windows\System\MTQukrh.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\Pqdmdhb.exe
  C:\Windows\System\Pqdmdhb.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\cmqxVeq.exe
  C:\Windows\System\cmqxVeq.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\LBvVabE.exe
  C:\Windows\System\LBvVabE.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\XXMZmLs.exe
  C:\Windows\System\XXMZmLs.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\NaOarra.exe
  C:\Windows\System\NaOarra.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\OWDEAGt.exe
  C:\Windows\System\OWDEAGt.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\ZNFHkfo.exe
  C:\Windows\System\ZNFHkfo.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\kKIJZxv.exe
  C:\Windows\System\kKIJZxv.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\rPfwjVf.exe
  C:\Windows\System\rPfwjVf.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\dgIAWZr.exe
  C:\Windows\System\dgIAWZr.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\SmwEZou.exe
  C:\Windows\System\SmwEZou.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\HGfnTIF.exe
  C:\Windows\System\HGfnTIF.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\bHWKIGF.exe
  C:\Windows\System\bHWKIGF.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\doUhhwg.exe
  C:\Windows\System\doUhhwg.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\LKKuvqK.exe
  C:\Windows\System\LKKuvqK.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ugsDRZS.exe
  C:\Windows\System\ugsDRZS.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\VceFeMl.exe
  C:\Windows\System\VceFeMl.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\XStvBRL.exe
  C:\Windows\System\XStvBRL.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\rXoYsie.exe
  C:\Windows\System\rXoYsie.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\fFaMaOB.exe
  C:\Windows\System\fFaMaOB.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\hVXhxcg.exe
  C:\Windows\System\hVXhxcg.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\KKqkTGe.exe
  C:\Windows\System\KKqkTGe.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\vgwrBPS.exe
  C:\Windows\System\vgwrBPS.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\joBFfPN.exe
  C:\Windows\System\joBFfPN.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\CqWDqHg.exe
  C:\Windows\System\CqWDqHg.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\IUOjjFn.exe
  C:\Windows\System\IUOjjFn.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\ULmpIzy.exe
  C:\Windows\System\ULmpIzy.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\lCXhkYw.exe
  C:\Windows\System\lCXhkYw.exe
  2⤵
  PID:1812
- C:\Windows\System\RphtDYl.exe
  C:\Windows\System\RphtDYl.exe
  2⤵
  PID:2228
- C:\Windows\System\tBaDfhm.exe
  C:\Windows\System\tBaDfhm.exe
  2⤵
  PID:2956
- C:\Windows\System\YkrRXiw.exe
  C:\Windows\System\YkrRXiw.exe
  2⤵
  PID:2240
- C:\Windows\System\OSLLGpd.exe
  C:\Windows\System\OSLLGpd.exe
  2⤵
  PID:1716
- C:\Windows\System\pdMpBrP.exe
  C:\Windows\System\pdMpBrP.exe
  2⤵
  PID:892
- C:\Windows\System\EclYoCV.exe
  C:\Windows\System\EclYoCV.exe
  2⤵
  PID:884
- C:\Windows\System\jRUXcTP.exe
  C:\Windows\System\jRUXcTP.exe
  2⤵
  PID:2072
- C:\Windows\System\bfIQBxO.exe
  C:\Windows\System\bfIQBxO.exe
  2⤵
  PID:2336
- C:\Windows\System\oLgKbHl.exe
  C:\Windows\System\oLgKbHl.exe
  2⤵
  PID:1568
- C:\Windows\System\rEnKDjF.exe
  C:\Windows\System\rEnKDjF.exe
  2⤵
  PID:1724
- C:\Windows\System\XYQUfnA.exe
  C:\Windows\System\XYQUfnA.exe
  2⤵
  PID:1740
- C:\Windows\System\VXSHiIC.exe
  C:\Windows\System\VXSHiIC.exe
  2⤵
  PID:2624
- C:\Windows\System\QqQwHBp.exe
  C:\Windows\System\QqQwHBp.exe
  2⤵
  PID:2596
- C:\Windows\System\yzsEfDG.exe
  C:\Windows\System\yzsEfDG.exe
  2⤵
  PID:2600
- C:\Windows\System\QMSkovD.exe
  C:\Windows\System\QMSkovD.exe
  2⤵
  PID:848
- C:\Windows\System\prvfKQH.exe
  C:\Windows\System\prvfKQH.exe
  2⤵
  PID:1932
- C:\Windows\System\nGUtQhw.exe
  C:\Windows\System\nGUtQhw.exe
  2⤵
  PID:2560
- C:\Windows\System\CgINQBc.exe
  C:\Windows\System\CgINQBc.exe
  2⤵
  PID:2500
- C:\Windows\System\ronwRTy.exe
  C:\Windows\System\ronwRTy.exe
  2⤵
  PID:2132
- C:\Windows\System\ZoniNWs.exe
  C:\Windows\System\ZoniNWs.exe
  2⤵
  PID:2768
- C:\Windows\System\DdumuwA.exe
  C:\Windows\System\DdumuwA.exe
  2⤵
  PID:2860
- C:\Windows\System\RzvodqH.exe
  C:\Windows\System\RzvodqH.exe
  2⤵
  PID:2512
- C:\Windows\System\vtAYNgW.exe
  C:\Windows\System\vtAYNgW.exe
  2⤵
  PID:1820
- C:\Windows\System\jGrDccK.exe
  C:\Windows\System\jGrDccK.exe
  2⤵
  PID:2320
- C:\Windows\System\lFFPsgA.exe
  C:\Windows\System\lFFPsgA.exe
  2⤵
  PID:2248
- C:\Windows\System\UcJCHGz.exe
  C:\Windows\System\UcJCHGz.exe
  2⤵
  PID:1448
- C:\Windows\System\eYUkfrN.exe
  C:\Windows\System\eYUkfrN.exe
  2⤵
  PID:1912
- C:\Windows\System\zieeQLC.exe
  C:\Windows\System\zieeQLC.exe
  2⤵
  PID:2308
- C:\Windows\System\lgWKMtP.exe
  C:\Windows\System\lgWKMtP.exe
  2⤵
  PID:2628
- C:\Windows\System\FmjtsRd.exe
  C:\Windows\System\FmjtsRd.exe
  2⤵
  PID:2284
- C:\Windows\System\nqBfYWm.exe
  C:\Windows\System\nqBfYWm.exe
  2⤵
  PID:1164
- C:\Windows\System\EmwfLHJ.exe
  C:\Windows\System\EmwfLHJ.exe
  2⤵
  PID:1500
- C:\Windows\System\pLecXwG.exe
  C:\Windows\System\pLecXwG.exe
  2⤵
  PID:2128
- C:\Windows\System\BiFtVXk.exe
  C:\Windows\System\BiFtVXk.exe
  2⤵
  PID:1804
- C:\Windows\System\UqQkNdT.exe
  C:\Windows\System\UqQkNdT.exe
  2⤵
  PID:1676
- C:\Windows\System\boJWsAo.exe
  C:\Windows\System\boJWsAo.exe
  2⤵
  PID:1132
- C:\Windows\System\bVFMBSq.exe
  C:\Windows\System\bVFMBSq.exe
  2⤵
  PID:2028
- C:\Windows\System\fzlCtwq.exe
  C:\Windows\System\fzlCtwq.exe
  2⤵
  PID:1356
- C:\Windows\System\lPTpjVs.exe
  C:\Windows\System\lPTpjVs.exe
  2⤵
  PID:2400
- C:\Windows\System\LqHZUkI.exe
  C:\Windows\System\LqHZUkI.exe
  2⤵
  PID:1868
- C:\Windows\System\hwnevDU.exe
  C:\Windows\System\hwnevDU.exe
  2⤵
  PID:1012
- C:\Windows\System\oBBNJBf.exe
  C:\Windows\System\oBBNJBf.exe
  2⤵
  PID:916
- C:\Windows\System\xMdpAfZ.exe
  C:\Windows\System\xMdpAfZ.exe
  2⤵
  PID:692
- C:\Windows\System\KoaYNOV.exe
  C:\Windows\System\KoaYNOV.exe
  2⤵
  PID:2032
- C:\Windows\System\VchJRfC.exe
  C:\Windows\System\VchJRfC.exe
  2⤵
  PID:3056
- C:\Windows\System\oqJXuHJ.exe
  C:\Windows\System\oqJXuHJ.exe
  2⤵
  PID:1752
- C:\Windows\System\nAYndpY.exe
  C:\Windows\System\nAYndpY.exe
  2⤵
  PID:2528
- C:\Windows\System\hEbliDd.exe
  C:\Windows\System\hEbliDd.exe
  2⤵
  PID:2036
- C:\Windows\System\gHHNaAd.exe
  C:\Windows\System\gHHNaAd.exe
  2⤵
  PID:1712
- C:\Windows\System\Bpimdvz.exe
  C:\Windows\System\Bpimdvz.exe
  2⤵
  PID:2880
- C:\Windows\System\VHbMFjU.exe
  C:\Windows\System\VHbMFjU.exe
  2⤵
  PID:2908
- C:\Windows\System\YFflyfz.exe
  C:\Windows\System\YFflyfz.exe
  2⤵
  PID:2764
- C:\Windows\System\GlWIPGU.exe
  C:\Windows\System\GlWIPGU.exe
  2⤵
  PID:2456
- C:\Windows\System\XTKCeRI.exe
  C:\Windows\System\XTKCeRI.exe
  2⤵
  PID:1660
- C:\Windows\System\OSkQCMu.exe
  C:\Windows\System\OSkQCMu.exe
  2⤵
  PID:2952
- C:\Windows\System\JoaKphe.exe
  C:\Windows\System\JoaKphe.exe
  2⤵
  PID:2356
- C:\Windows\System\DUFinNL.exe
  C:\Windows\System\DUFinNL.exe
  2⤵
  PID:3084
- C:\Windows\System\ywgwgal.exe
  C:\Windows\System\ywgwgal.exe
  2⤵
  PID:3100
- C:\Windows\System\BPgLbZd.exe
  C:\Windows\System\BPgLbZd.exe
  2⤵
  PID:3116
- C:\Windows\System\OffwgXg.exe
  C:\Windows\System\OffwgXg.exe
  2⤵
  PID:3132
- C:\Windows\System\iXZDFXw.exe
  C:\Windows\System\iXZDFXw.exe
  2⤵
  PID:3148
- C:\Windows\System\oZmbVpm.exe
  C:\Windows\System\oZmbVpm.exe
  2⤵
  PID:3164
- C:\Windows\System\QlibYeF.exe
  C:\Windows\System\QlibYeF.exe
  2⤵
  PID:3180
- C:\Windows\System\WpMVSea.exe
  C:\Windows\System\WpMVSea.exe
  2⤵
  PID:3196
- C:\Windows\System\dpTZAAL.exe
  C:\Windows\System\dpTZAAL.exe
  2⤵
  PID:3212
- C:\Windows\System\SnfnERW.exe
  C:\Windows\System\SnfnERW.exe
  2⤵
  PID:3228
- C:\Windows\System\zdTnGER.exe
  C:\Windows\System\zdTnGER.exe
  2⤵
  PID:3244
- C:\Windows\System\uxAGNEJ.exe
  C:\Windows\System\uxAGNEJ.exe
  2⤵
  PID:3260
- C:\Windows\System\wviPExd.exe
  C:\Windows\System\wviPExd.exe
  2⤵
  PID:3276
- C:\Windows\System\cTEzpGZ.exe
  C:\Windows\System\cTEzpGZ.exe
  2⤵
  PID:3292
- C:\Windows\System\tkuIBje.exe
  C:\Windows\System\tkuIBje.exe
  2⤵
  PID:3308
- C:\Windows\System\wDWPYgT.exe
  C:\Windows\System\wDWPYgT.exe
  2⤵
  PID:3324
- C:\Windows\System\CzeGNDA.exe
  C:\Windows\System\CzeGNDA.exe
  2⤵
  PID:3340
- C:\Windows\System\jVBNHyX.exe
  C:\Windows\System\jVBNHyX.exe
  2⤵
  PID:3356
- C:\Windows\System\kxrUEOm.exe
  C:\Windows\System\kxrUEOm.exe
  2⤵
  PID:3376
- C:\Windows\System\TpdoTSn.exe
  C:\Windows\System\TpdoTSn.exe
  2⤵
  PID:3392
- C:\Windows\System\btqoHaE.exe
  C:\Windows\System\btqoHaE.exe
  2⤵
  PID:3408
- C:\Windows\System\YZuEPGC.exe
  C:\Windows\System\YZuEPGC.exe
  2⤵
  PID:3424
- C:\Windows\System\alCSKvD.exe
  C:\Windows\System\alCSKvD.exe
  2⤵
  PID:3440
- C:\Windows\System\SpYQFIl.exe
  C:\Windows\System\SpYQFIl.exe
  2⤵
  PID:3456
- C:\Windows\System\UrXRvET.exe
  C:\Windows\System\UrXRvET.exe
  2⤵
  PID:3472
- C:\Windows\System\yxsPNKz.exe
  C:\Windows\System\yxsPNKz.exe
  2⤵
  PID:3488
- C:\Windows\System\MKlFHFq.exe
  C:\Windows\System\MKlFHFq.exe
  2⤵
  PID:3504
- C:\Windows\System\pLPLoBD.exe
  C:\Windows\System\pLPLoBD.exe
  2⤵
  PID:3520
- C:\Windows\System\qqjhqzJ.exe
  C:\Windows\System\qqjhqzJ.exe
  2⤵
  PID:3536
- C:\Windows\System\ZFTRkBo.exe
  C:\Windows\System\ZFTRkBo.exe
  2⤵
  PID:3552
- C:\Windows\System\dJupzfC.exe
  C:\Windows\System\dJupzfC.exe
  2⤵
  PID:3568
- C:\Windows\System\mWSMdtR.exe
  C:\Windows\System\mWSMdtR.exe
  2⤵
  PID:3584
- C:\Windows\System\MvLzRAh.exe
  C:\Windows\System\MvLzRAh.exe
  2⤵
  PID:3600
- C:\Windows\System\pwguGJX.exe
  C:\Windows\System\pwguGJX.exe
  2⤵
  PID:3616
- C:\Windows\System\YxPmXwV.exe
  C:\Windows\System\YxPmXwV.exe
  2⤵
  PID:3632
- C:\Windows\System\GyyKDsn.exe
  C:\Windows\System\GyyKDsn.exe
  2⤵
  PID:3648
- C:\Windows\System\JjxHlNj.exe
  C:\Windows\System\JjxHlNj.exe
  2⤵
  PID:3664
- C:\Windows\System\LWAxmRq.exe
  C:\Windows\System\LWAxmRq.exe
  2⤵
  PID:3680
- C:\Windows\System\hnswztu.exe
  C:\Windows\System\hnswztu.exe
  2⤵
  PID:3696
- C:\Windows\System\fdfHFeC.exe
  C:\Windows\System\fdfHFeC.exe
  2⤵
  PID:3712
- C:\Windows\System\wXjVBOD.exe
  C:\Windows\System\wXjVBOD.exe
  2⤵
  PID:3728
- C:\Windows\System\uoFnYJz.exe
  C:\Windows\System\uoFnYJz.exe
  2⤵
  PID:3744
- C:\Windows\System\lmlCrUr.exe
  C:\Windows\System\lmlCrUr.exe
  2⤵
  PID:3760
- C:\Windows\System\BqqfOnw.exe
  C:\Windows\System\BqqfOnw.exe
  2⤵
  PID:3776
- C:\Windows\System\lvpmUQK.exe
  C:\Windows\System\lvpmUQK.exe
  2⤵
  PID:3792
- C:\Windows\System\XfYUEwy.exe
  C:\Windows\System\XfYUEwy.exe
  2⤵
  PID:3808
- C:\Windows\System\OOHAJqC.exe
  C:\Windows\System\OOHAJqC.exe
  2⤵
  PID:3824
- C:\Windows\System\pswKVJu.exe
  C:\Windows\System\pswKVJu.exe
  2⤵
  PID:3840
- C:\Windows\System\bvBBdqw.exe
  C:\Windows\System\bvBBdqw.exe
  2⤵
  PID:3856
- C:\Windows\System\VJLjhIK.exe
  C:\Windows\System\VJLjhIK.exe
  2⤵
  PID:3872
- C:\Windows\System\SXmDncg.exe
  C:\Windows\System\SXmDncg.exe
  2⤵
  PID:3888
- C:\Windows\System\UrEmGRJ.exe
  C:\Windows\System\UrEmGRJ.exe
  2⤵
  PID:3904
- C:\Windows\System\xoabeOq.exe
  C:\Windows\System\xoabeOq.exe
  2⤵
  PID:3920
- C:\Windows\System\hbYCDDo.exe
  C:\Windows\System\hbYCDDo.exe
  2⤵
  PID:3936
- C:\Windows\System\bfspKdi.exe
  C:\Windows\System\bfspKdi.exe
  2⤵
  PID:3952
- C:\Windows\System\NqhWZsu.exe
  C:\Windows\System\NqhWZsu.exe
  2⤵
  PID:3968
- C:\Windows\System\RQgdSly.exe
  C:\Windows\System\RQgdSly.exe
  2⤵
  PID:3984
- C:\Windows\System\ZSvZjOZ.exe
  C:\Windows\System\ZSvZjOZ.exe
  2⤵
  PID:4000
- C:\Windows\System\EYfxmBa.exe
  C:\Windows\System\EYfxmBa.exe
  2⤵
  PID:4016
- C:\Windows\System\frTJMZg.exe
  C:\Windows\System\frTJMZg.exe
  2⤵
  PID:4032
- C:\Windows\System\UClUzOQ.exe
  C:\Windows\System\UClUzOQ.exe
  2⤵
  PID:4048
- C:\Windows\System\gSpRXXB.exe
  C:\Windows\System\gSpRXXB.exe
  2⤵
  PID:4064
- C:\Windows\System\oPwOitG.exe
  C:\Windows\System\oPwOitG.exe
  2⤵
  PID:4080
- C:\Windows\System\RVXZIJF.exe
  C:\Windows\System\RVXZIJF.exe
  2⤵
  PID:1612
- C:\Windows\System\kxcdrZx.exe
  C:\Windows\System\kxcdrZx.exe
  2⤵
  PID:2180
- C:\Windows\System\hKfnVpO.exe
  C:\Windows\System\hKfnVpO.exe
  2⤵
  PID:2292
- C:\Windows\System\MmKjQdA.exe
  C:\Windows\System\MmKjQdA.exe
  2⤵
  PID:1364
- C:\Windows\System\NHuhbmF.exe
  C:\Windows\System\NHuhbmF.exe
  2⤵
  PID:580
- C:\Windows\System\jjaCpBo.exe
  C:\Windows\System\jjaCpBo.exe
  2⤵
  PID:448
- C:\Windows\System\WhxQyqd.exe
  C:\Windows\System\WhxQyqd.exe
  2⤵
  PID:1244
- C:\Windows\System\soJXqtC.exe
  C:\Windows\System\soJXqtC.exe
  2⤵
  PID:768
- C:\Windows\System\czUZgex.exe
  C:\Windows\System\czUZgex.exe
  2⤵
  PID:1260
- C:\Windows\System\wKCnHnP.exe
  C:\Windows\System\wKCnHnP.exe
  2⤵
  PID:2932
- C:\Windows\System\uGpZDLJ.exe
  C:\Windows\System\uGpZDLJ.exe
  2⤵
  PID:1808
- C:\Windows\System\rYKtNQc.exe
  C:\Windows\System\rYKtNQc.exe
  2⤵
  PID:568
- C:\Windows\System\mdZGKXn.exe
  C:\Windows\System\mdZGKXn.exe
  2⤵
  PID:1296
- C:\Windows\System\VVmdXDb.exe
  C:\Windows\System\VVmdXDb.exe
  2⤵
  PID:2740
- C:\Windows\System\ZIFreAZ.exe
  C:\Windows\System\ZIFreAZ.exe
  2⤵
  PID:2304
- C:\Windows\System\SzhwEZc.exe
  C:\Windows\System\SzhwEZc.exe
  2⤵
  PID:3076
- C:\Windows\System\nDyVSUR.exe
  C:\Windows\System\nDyVSUR.exe
  2⤵
  PID:3140
- C:\Windows\System\OIQkKBW.exe
  C:\Windows\System\OIQkKBW.exe
  2⤵
  PID:3144
- C:\Windows\System\OMbiKbg.exe
  C:\Windows\System\OMbiKbg.exe
  2⤵
  PID:3172
- C:\Windows\System\PlggGxo.exe
  C:\Windows\System\PlggGxo.exe
  2⤵
  PID:3188
- C:\Windows\System\RECCqTv.exe
  C:\Windows\System\RECCqTv.exe
  2⤵
  PID:3220
- C:\Windows\System\LaKbWcE.exe
  C:\Windows\System\LaKbWcE.exe
  2⤵
  PID:3268
- C:\Windows\System\gmKXoHb.exe
  C:\Windows\System\gmKXoHb.exe
  2⤵
  PID:3284
- C:\Windows\System\geXzCvZ.exe
  C:\Windows\System\geXzCvZ.exe
  2⤵
  PID:3364
- C:\Windows\System\kuziTiA.exe
  C:\Windows\System\kuziTiA.exe
  2⤵
  PID:3316
- C:\Windows\System\Uhmnzzs.exe
  C:\Windows\System\Uhmnzzs.exe
  2⤵
  PID:3404
- C:\Windows\System\lnArzrw.exe
  C:\Windows\System\lnArzrw.exe
  2⤵
  PID:3416
- C:\Windows\System\yCpnEQP.exe
  C:\Windows\System\yCpnEQP.exe
  2⤵
  PID:3452
- C:\Windows\System\xgUWhmF.exe
  C:\Windows\System\xgUWhmF.exe
  2⤵
  PID:3480
- C:\Windows\System\vqsIePD.exe
  C:\Windows\System\vqsIePD.exe
  2⤵
  PID:3560
- C:\Windows\System\wfiKDGe.exe
  C:\Windows\System\wfiKDGe.exe
  2⤵
  PID:3516
- C:\Windows\System\rxpoMJF.exe
  C:\Windows\System\rxpoMJF.exe
  2⤵
  PID:3656
- C:\Windows\System\yNzkGwr.exe
  C:\Windows\System\yNzkGwr.exe
  2⤵
  PID:3544
- C:\Windows\System\GnmJsTU.exe
  C:\Windows\System\GnmJsTU.exe
  2⤵
  PID:3644
- C:\Windows\System\eJbsrYa.exe
  C:\Windows\System\eJbsrYa.exe
  2⤵
  PID:3724
- C:\Windows\System\UFNACmY.exe
  C:\Windows\System\UFNACmY.exe
  2⤵
  PID:3756
- C:\Windows\System\FaSEWdM.exe
  C:\Windows\System\FaSEWdM.exe
  2⤵
  PID:3820
- C:\Windows\System\PktsvlQ.exe
  C:\Windows\System\PktsvlQ.exe
  2⤵
  PID:3768
- C:\Windows\System\giYKSfD.exe
  C:\Windows\System\giYKSfD.exe
  2⤵
  PID:3884
- C:\Windows\System\HZNnkPQ.exe
  C:\Windows\System\HZNnkPQ.exe
  2⤵
  PID:4112
- C:\Windows\System\grsHiLv.exe
  C:\Windows\System\grsHiLv.exe
  2⤵
  PID:4132
- C:\Windows\System\sZpQlmb.exe
  C:\Windows\System\sZpQlmb.exe
  2⤵
  PID:4148
- C:\Windows\System\TIhCYBp.exe
  C:\Windows\System\TIhCYBp.exe
  2⤵
  PID:4164
- C:\Windows\System\wlmwqMU.exe
  C:\Windows\System\wlmwqMU.exe
  2⤵
  PID:4180
- C:\Windows\System\LFPbJdM.exe
  C:\Windows\System\LFPbJdM.exe
  2⤵
  PID:4196
- C:\Windows\System\kZmwTPq.exe
  C:\Windows\System\kZmwTPq.exe
  2⤵
  PID:4212
- C:\Windows\System\NexpjQO.exe
  C:\Windows\System\NexpjQO.exe
  2⤵
  PID:4244
- C:\Windows\System\QLUMhCc.exe
  C:\Windows\System\QLUMhCc.exe
  2⤵
  PID:3576
- C:\Windows\System\JRgWNIE.exe
  C:\Windows\System\JRgWNIE.exe
  2⤵
  PID:3816
- C:\Windows\System\OmvqEAP.exe
  C:\Windows\System\OmvqEAP.exe
  2⤵
  PID:4160
- C:\Windows\System\KuNXKRV.exe
  C:\Windows\System\KuNXKRV.exe
  2⤵
  PID:4232
- C:\Windows\System\dRfBLej.exe
  C:\Windows\System\dRfBLej.exe
  2⤵
  PID:1548
- C:\Windows\System\BzbWCbs.exe
  C:\Windows\System\BzbWCbs.exe
  2⤵
  PID:1268
- C:\Windows\System\ictUTXC.exe
  C:\Windows\System\ictUTXC.exe
  2⤵
  PID:2772
- C:\Windows\System\osKaKog.exe
  C:\Windows\System\osKaKog.exe
  2⤵
  PID:3176
- C:\Windows\System\znWoRsq.exe
  C:\Windows\System\znWoRsq.exe
  2⤵
  PID:3336
- C:\Windows\System\aqqXDaD.exe
  C:\Windows\System\aqqXDaD.exe
  2⤵
  PID:3464
- C:\Windows\System\ZvhkTWD.exe
  C:\Windows\System\ZvhkTWD.exe
  2⤵
  PID:3660
- C:\Windows\System\EdiuuMd.exe
  C:\Windows\System\EdiuuMd.exe
  2⤵
  PID:4108
- C:\Windows\System\FEhiYdF.exe
  C:\Windows\System\FEhiYdF.exe
  2⤵
  PID:4176
- C:\Windows\System\cesvgzn.exe
  C:\Windows\System\cesvgzn.exe
  2⤵
  PID:4024
- C:\Windows\System\MSfLDqE.exe
  C:\Windows\System\MSfLDqE.exe
  2⤵
  PID:3400
- C:\Windows\System\QFuksej.exe
  C:\Windows\System\QFuksej.exe
  2⤵
  PID:2516
- C:\Windows\System\WUxibIw.exe
  C:\Windows\System\WUxibIw.exe
  2⤵
  PID:2276
- C:\Windows\System\aysvXKg.exe
  C:\Windows\System\aysvXKg.exe
  2⤵
  PID:4404
- C:\Windows\System\gPnCQUi.exe
  C:\Windows\System\gPnCQUi.exe
  2⤵
  PID:4424
- C:\Windows\System\kGDoRfS.exe
  C:\Windows\System\kGDoRfS.exe
  2⤵
  PID:4440
- C:\Windows\System\dbLHBhd.exe
  C:\Windows\System\dbLHBhd.exe
  2⤵
  PID:4452
- C:\Windows\System\XERYYAI.exe
  C:\Windows\System\XERYYAI.exe
  2⤵
  PID:4476
- C:\Windows\System\aSieDAC.exe
  C:\Windows\System\aSieDAC.exe
  2⤵
  PID:4496
- C:\Windows\System\NougfoJ.exe
  C:\Windows\System\NougfoJ.exe
  2⤵
  PID:4512
- C:\Windows\System\YZmBpzZ.exe
  C:\Windows\System\YZmBpzZ.exe
  2⤵
  PID:2384
- C:\Windows\System\YYnypjg.exe
  C:\Windows\System\YYnypjg.exe
  2⤵
  PID:4540
- C:\Windows\System\nomcvVy.exe
  C:\Windows\System\nomcvVy.exe
  2⤵
  PID:4560
- C:\Windows\System\bGwyUBS.exe
  C:\Windows\System\bGwyUBS.exe
  2⤵
  PID:4584
- C:\Windows\System\AHggXJb.exe
  C:\Windows\System\AHggXJb.exe
  2⤵
  PID:4604
- C:\Windows\System\CXTRIJr.exe
  C:\Windows\System\CXTRIJr.exe
  2⤵
  PID:1692
- C:\Windows\System\rONfiPV.exe
  C:\Windows\System\rONfiPV.exe
  2⤵
  PID:4632
- C:\Windows\System\nhWKGUC.exe
  C:\Windows\System\nhWKGUC.exe
  2⤵
  PID:4652
- C:\Windows\System\jAwtNfR.exe
  C:\Windows\System\jAwtNfR.exe
  2⤵
  PID:4672
- C:\Windows\System\cJGwJar.exe
  C:\Windows\System\cJGwJar.exe
  2⤵
  PID:4688
- C:\Windows\System\TGKzwXe.exe
  C:\Windows\System\TGKzwXe.exe
  2⤵
  PID:4708
- C:\Windows\System\RUiehYs.exe
  C:\Windows\System\RUiehYs.exe
  2⤵
  PID:4724
- C:\Windows\System\jNgVvCE.exe
  C:\Windows\System\jNgVvCE.exe
  2⤵
  PID:4748
- C:\Windows\System\CRvDWvt.exe
  C:\Windows\System\CRvDWvt.exe
  2⤵
  PID:4776
- C:\Windows\System\KXcDZbU.exe
  C:\Windows\System\KXcDZbU.exe
  2⤵
  PID:4792
- C:\Windows\System\ydNrHop.exe
  C:\Windows\System\ydNrHop.exe
  2⤵
  PID:4804
- C:\Windows\System\CNpqktP.exe
  C:\Windows\System\CNpqktP.exe
  2⤵
  PID:4820
- C:\Windows\System\NuyPJMQ.exe
  C:\Windows\System\NuyPJMQ.exe
  2⤵
  PID:4848
- C:\Windows\System\EMuqxBQ.exe
  C:\Windows\System\EMuqxBQ.exe
  2⤵
  PID:4864
- C:\Windows\System\UmphsGo.exe
  C:\Windows\System\UmphsGo.exe
  2⤵
  PID:4884
- C:\Windows\System\mJhwdEM.exe
  C:\Windows\System\mJhwdEM.exe
  2⤵
  PID:4900
- C:\Windows\System\gKxfgXa.exe
  C:\Windows\System\gKxfgXa.exe
  2⤵
  PID:4932
- C:\Windows\System\WqqMFYy.exe
  C:\Windows\System\WqqMFYy.exe
  2⤵
  PID:4952
- C:\Windows\System\MnbAhvs.exe
  C:\Windows\System\MnbAhvs.exe
  2⤵
  PID:4972
- C:\Windows\System\FnJRuvC.exe
  C:\Windows\System\FnJRuvC.exe
  2⤵
  PID:4992
- C:\Windows\System\RbrJmgL.exe
  C:\Windows\System\RbrJmgL.exe
  2⤵
  PID:5012
- C:\Windows\System\dzuxIay.exe
  C:\Windows\System\dzuxIay.exe
  2⤵
  PID:5032
- C:\Windows\System\XvPwNRD.exe
  C:\Windows\System\XvPwNRD.exe
  2⤵
  PID:5052
- C:\Windows\System\hkxqlJN.exe
  C:\Windows\System\hkxqlJN.exe
  2⤵
  PID:5068
- C:\Windows\System\DMUlkJj.exe
  C:\Windows\System\DMUlkJj.exe
  2⤵
  PID:5084
- C:\Windows\System\XtEmLaa.exe
  C:\Windows\System\XtEmLaa.exe
  2⤵
  PID:2668
- C:\Windows\System\qULHnuF.exe
  C:\Windows\System\qULHnuF.exe
  2⤵
  PID:3912
- C:\Windows\System\gcJUSFV.exe
  C:\Windows\System\gcJUSFV.exe
  2⤵
  PID:3976
- C:\Windows\System\vQQsjEg.exe
  C:\Windows\System\vQQsjEg.exe
  2⤵
  PID:4012
- C:\Windows\System\PjHOCWN.exe
  C:\Windows\System\PjHOCWN.exe
  2⤵
  PID:3036
- C:\Windows\System\fseoNMW.exe
  C:\Windows\System\fseoNMW.exe
  2⤵
  PID:3832
- C:\Windows\System\crBvsWh.exe
  C:\Windows\System\crBvsWh.exe
  2⤵
  PID:3864
- C:\Windows\System\cxxpGfu.exe
  C:\Windows\System\cxxpGfu.exe
  2⤵
  PID:3900
- C:\Windows\System\hNDWhTr.exe
  C:\Windows\System\hNDWhTr.exe
  2⤵
  PID:1708
- C:\Windows\System\kxdCBCk.exe
  C:\Windows\System\kxdCBCk.exe
  2⤵
  PID:3192
- C:\Windows\System\oUiPOBE.exe
  C:\Windows\System\oUiPOBE.exe
  2⤵
  PID:3288
- C:\Windows\System\bcjjhwy.exe
  C:\Windows\System\bcjjhwy.exe
  2⤵
  PID:3592
- C:\Windows\System\kTeNdVp.exe
  C:\Windows\System\kTeNdVp.exe
  2⤵
  PID:4120
- C:\Windows\System\LVJKoWW.exe
  C:\Windows\System\LVJKoWW.exe
  2⤵
  PID:3720
- C:\Windows\System\iliTFdi.exe
  C:\Windows\System\iliTFdi.exe
  2⤵
  PID:1092
- C:\Windows\System\ngrjbdW.exe
  C:\Windows\System\ngrjbdW.exe
  2⤵
  PID:3332
- C:\Windows\System\BajSMMb.exe
  C:\Windows\System\BajSMMb.exe
  2⤵
  PID:4144
- C:\Windows\System\YjGSKyo.exe
  C:\Windows\System\YjGSKyo.exe
  2⤵
  PID:3436
- C:\Windows\System\uYsqZak.exe
  C:\Windows\System\uYsqZak.exe
  2⤵
  PID:2940
- C:\Windows\System\RamFRBd.exe
  C:\Windows\System\RamFRBd.exe
  2⤵
  PID:3740
- C:\Windows\System\dLzZZRq.exe
  C:\Windows\System\dLzZZRq.exe
  2⤵
  PID:4412
- C:\Windows\System\LtRBvdU.exe
  C:\Windows\System\LtRBvdU.exe
  2⤵
  PID:3704
- C:\Windows\System\cfRYlSI.exe
  C:\Windows\System\cfRYlSI.exe
  2⤵
  PID:904
- C:\Windows\System\OvWLJzp.exe
  C:\Windows\System\OvWLJzp.exe
  2⤵
  PID:4448
- C:\Windows\System\pFrKebl.exe
  C:\Windows\System\pFrKebl.exe
  2⤵
  PID:4492
- C:\Windows\System\MvLgAyd.exe
  C:\Windows\System\MvLgAyd.exe
  2⤵
  PID:4548
- C:\Windows\System\oTnYiHF.exe
  C:\Windows\System\oTnYiHF.exe
  2⤵
  PID:4592
- C:\Windows\System\VRvWtkU.exe
  C:\Windows\System\VRvWtkU.exe
  2⤵
  PID:1936
- C:\Windows\System\MKnmraJ.exe
  C:\Windows\System\MKnmraJ.exe
  2⤵
  PID:4624
- C:\Windows\System\LWQLyct.exe
  C:\Windows\System\LWQLyct.exe
  2⤵
  PID:4580
- C:\Windows\System\vgbfqXR.exe
  C:\Windows\System\vgbfqXR.exe
  2⤵
  PID:4536
- C:\Windows\System\hCcymmz.exe
  C:\Windows\System\hCcymmz.exe
  2⤵
  PID:4668
- C:\Windows\System\SpltCcQ.exe
  C:\Windows\System\SpltCcQ.exe
  2⤵
  PID:1980
- C:\Windows\System\eiCpPwB.exe
  C:\Windows\System\eiCpPwB.exe
  2⤵
  PID:2608
- C:\Windows\System\XSfdSAk.exe
  C:\Windows\System\XSfdSAk.exe
  2⤵
  PID:4680
- C:\Windows\System\tJsyedc.exe
  C:\Windows\System\tJsyedc.exe
  2⤵
  PID:4644
- C:\Windows\System\WzqOVeM.exe
  C:\Windows\System\WzqOVeM.exe
  2⤵
  PID:4788
- C:\Windows\System\GProXaS.exe
  C:\Windows\System\GProXaS.exe
  2⤵
  PID:4812
- C:\Windows\System\ocUOlju.exe
  C:\Windows\System\ocUOlju.exe
  2⤵
  PID:4860
- C:\Windows\System\xCmSAKv.exe
  C:\Windows\System\xCmSAKv.exe
  2⤵
  PID:4940
- C:\Windows\System\HuPqcrN.exe
  C:\Windows\System\HuPqcrN.exe
  2⤵
  PID:4980
- C:\Windows\System\UFxuekc.exe
  C:\Windows\System\UFxuekc.exe
  2⤵
  PID:5024
- C:\Windows\System\AGABrMo.exe
  C:\Windows\System\AGABrMo.exe
  2⤵
  PID:4872
- C:\Windows\System\evfHPAq.exe
  C:\Windows\System\evfHPAq.exe
  2⤵
  PID:4800
- C:\Windows\System\TGtdzAZ.exe
  C:\Windows\System\TGtdzAZ.exe
  2⤵
  PID:676
- C:\Windows\System\IhiAvwq.exe
  C:\Windows\System\IhiAvwq.exe
  2⤵
  PID:2716
- C:\Windows\System\cbqNfQr.exe
  C:\Windows\System\cbqNfQr.exe
  2⤵
  PID:3272
- C:\Windows\System\XGluUGW.exe
  C:\Windows\System\XGluUGW.exe
  2⤵
  PID:2052
- C:\Windows\System\RcamHrd.exe
  C:\Windows\System\RcamHrd.exe
  2⤵
  PID:5076
- C:\Windows\System\tQPCmnQ.exe
  C:\Windows\System\tQPCmnQ.exe
  2⤵
  PID:5048
- C:\Windows\System\XgTebDD.exe
  C:\Windows\System\XgTebDD.exe
  2⤵
  PID:3880
- C:\Windows\System\WpfRDHU.exe
  C:\Windows\System\WpfRDHU.exe
  2⤵
  PID:4220
- C:\Windows\System\MsiUMGi.exe
  C:\Windows\System\MsiUMGi.exe
  2⤵
  PID:2572
- C:\Windows\System\LOihCFv.exe
  C:\Windows\System\LOihCFv.exe
  2⤵
  PID:4208
- C:\Windows\System\IYjKaph.exe
  C:\Windows\System\IYjKaph.exe
  2⤵
  PID:4488
- C:\Windows\System\AFavoHB.exe
  C:\Windows\System\AFavoHB.exe
  2⤵
  PID:4572
- C:\Windows\System\GJsXYWG.exe
  C:\Windows\System\GJsXYWG.exe
  2⤵
  PID:5112
- C:\Windows\System\trKlXub.exe
  C:\Windows\System\trKlXub.exe
  2⤵
  PID:2592
- C:\Windows\System\vblVSvG.exe
  C:\Windows\System\vblVSvG.exe
  2⤵
  PID:3432
- C:\Windows\System\MJhiaQD.exe
  C:\Windows\System\MJhiaQD.exe
  2⤵
  PID:3692
- C:\Windows\System\vpWsKcD.exe
  C:\Windows\System\vpWsKcD.exe
  2⤵
  PID:4464
- C:\Windows\System\zfIWhCv.exe
  C:\Windows\System\zfIWhCv.exe
  2⤵
  PID:2820
- C:\Windows\System\xCktzJO.exe
  C:\Windows\System\xCktzJO.exe
  2⤵
  PID:4648
- C:\Windows\System\pPuvbMs.exe
  C:\Windows\System\pPuvbMs.exe
  2⤵
  PID:4740
- C:\Windows\System\kZuckAY.exe
  C:\Windows\System\kZuckAY.exe
  2⤵
  PID:4760
- C:\Windows\System\lOYLPmQ.exe
  C:\Windows\System\lOYLPmQ.exe
  2⤵
  PID:3064
- C:\Windows\System\xEnHJtx.exe
  C:\Windows\System\xEnHJtx.exe
  2⤵
  PID:3992
- C:\Windows\System\PALRgnT.exe
  C:\Windows\System\PALRgnT.exe
  2⤵
  PID:2580
- C:\Windows\System\xHxBppD.exe
  C:\Windows\System\xHxBppD.exe
  2⤵
  PID:4664
- C:\Windows\System\OuocJXJ.exe
  C:\Windows\System\OuocJXJ.exe
  2⤵
  PID:4892
- C:\Windows\System\qkOWeYD.exe
  C:\Windows\System\qkOWeYD.exe
  2⤵
  PID:4876
- C:\Windows\System\VqoZhzD.exe
  C:\Windows\System\VqoZhzD.exe
  2⤵
  PID:1948
- C:\Windows\System\wBuVfEp.exe
  C:\Windows\System\wBuVfEp.exe
  2⤵
  PID:4504
- C:\Windows\System\xGDovhK.exe
  C:\Windows\System\xGDovhK.exe
  2⤵
  PID:4600
- C:\Windows\System\BeQESfy.exe
  C:\Windows\System\BeQESfy.exe
  2⤵
  PID:4400
- C:\Windows\System\uAAgFRN.exe
  C:\Windows\System\uAAgFRN.exe
  2⤵
  PID:4920
- C:\Windows\System\GBlyHul.exe
  C:\Windows\System\GBlyHul.exe
  2⤵
  PID:4964
- C:\Windows\System\PINfxty.exe
  C:\Windows\System\PINfxty.exe
  2⤵
  PID:4968
- C:\Windows\System\dFYuQiT.exe
  C:\Windows\System\dFYuQiT.exe
  2⤵
  PID:5104
- C:\Windows\System\vuLjNam.exe
  C:\Windows\System\vuLjNam.exe
  2⤵
  PID:3948
- C:\Windows\System\qcgIMnU.exe
  C:\Windows\System\qcgIMnU.exe
  2⤵
  PID:4076
- C:\Windows\System\uOFBRip.exe
  C:\Windows\System\uOFBRip.exe
  2⤵
  PID:2700
- C:\Windows\System\JqKiLIR.exe
  C:\Windows\System\JqKiLIR.exe
  2⤵
  PID:4092
- C:\Windows\System\lwkCHpI.exe
  C:\Windows\System\lwkCHpI.exe
  2⤵
  PID:4484
- C:\Windows\System\FEOomME.exe
  C:\Windows\System\FEOomME.exe
  2⤵
  PID:4568
- C:\Windows\System\tWNqaqO.exe
  C:\Windows\System\tWNqaqO.exe
  2⤵
  PID:3868
- C:\Windows\System\tplhtfA.exe
  C:\Windows\System\tplhtfA.exe
  2⤵
  PID:4736
- C:\Windows\System\rMkWIaJ.exe
  C:\Windows\System\rMkWIaJ.exe
  2⤵
  PID:2244
- C:\Windows\System\gExOZqj.exe
  C:\Windows\System\gExOZqj.exe
  2⤵
  PID:4784
- C:\Windows\System\PBanUrU.exe
  C:\Windows\System\PBanUrU.exe
  2⤵
  PID:3996
- C:\Windows\System\xLBMaFg.exe
  C:\Windows\System\xLBMaFg.exe
  2⤵
  PID:4844
- C:\Windows\System\ygttKIE.exe
  C:\Windows\System\ygttKIE.exe
  2⤵
  PID:4984
- C:\Windows\System\gjELUfD.exe
  C:\Windows\System\gjELUfD.exe
  2⤵
  PID:812
- C:\Windows\System\RIRhdQe.exe
  C:\Windows\System\RIRhdQe.exe
  2⤵
  PID:4756
- C:\Windows\System\nPlzuxj.exe
  C:\Windows\System\nPlzuxj.exe
  2⤵
  PID:4428
- C:\Windows\System\fOFtOew.exe
  C:\Windows\System\fOFtOew.exe
  2⤵
  PID:2508
- C:\Windows\System\QeyxElG.exe
  C:\Windows\System\QeyxElG.exe
  2⤵
  PID:4928
- C:\Windows\System\kIxSPEC.exe
  C:\Windows\System\kIxSPEC.exe
  2⤵
  PID:4044
- C:\Windows\System\SJpLsgw.exe
  C:\Windows\System\SJpLsgw.exe
  2⤵
  PID:2836
- C:\Windows\System\oYYnmBR.exe
  C:\Windows\System\oYYnmBR.exe
  2⤵
  PID:3836
- C:\Windows\System\FbTXROZ.exe
  C:\Windows\System\FbTXROZ.exe
  2⤵
  PID:5096
- C:\Windows\System\WFbdnyE.exe
  C:\Windows\System\WFbdnyE.exe
  2⤵
  PID:1972
- C:\Windows\System\sNXReSf.exe
  C:\Windows\System\sNXReSf.exe
  2⤵
  PID:2496
- C:\Windows\System\oVtxdih.exe
  C:\Windows\System\oVtxdih.exe
  2⤵
  PID:1984
- C:\Windows\System\MNfMSdo.exe
  C:\Windows\System\MNfMSdo.exe
  2⤵
  PID:3628
- C:\Windows\System\tYbtqNO.exe
  C:\Windows\System\tYbtqNO.exe
  2⤵
  PID:3252
- C:\Windows\System\EFhvXjq.exe
  C:\Windows\System\EFhvXjq.exe
  2⤵
  PID:3500
- C:\Windows\System\mbUqwIl.exe
  C:\Windows\System\mbUqwIl.exe
  2⤵
  PID:2944
- C:\Windows\System\OWFGsAG.exe
  C:\Windows\System\OWFGsAG.exe
  2⤵
  PID:4556
- C:\Windows\System\qPmbqYn.exe
  C:\Windows\System\qPmbqYn.exe
  2⤵
  PID:2452
- C:\Windows\System\gkntDrg.exe
  C:\Windows\System\gkntDrg.exe
  2⤵
  PID:1704
- C:\Windows\System\ERcfvMu.exe
  C:\Windows\System\ERcfvMu.exe
  2⤵
  PID:3124
- C:\Windows\System\zLpKtQn.exe
  C:\Windows\System\zLpKtQn.exe
  2⤵
  PID:1528
- C:\Windows\System\FWfaFTP.exe
  C:\Windows\System\FWfaFTP.exe
  2⤵
  PID:3020
- C:\Windows\System\IpuxcoJ.exe
  C:\Windows\System\IpuxcoJ.exe
  2⤵
  PID:4704
- C:\Windows\System\WvGOgcJ.exe
  C:\Windows\System\WvGOgcJ.exe
  2⤵
  PID:2776
- C:\Windows\System\jyrppCT.exe
  C:\Windows\System\jyrppCT.exe
  2⤵
  PID:1960
- C:\Windows\System\xkwwlPU.exe
  C:\Windows\System\xkwwlPU.exe
  2⤵
  PID:4916
- C:\Windows\System\TVHPSsY.exe
  C:\Windows\System\TVHPSsY.exe
  2⤵
  PID:2024
- C:\Windows\System\CFZgySG.exe
  C:\Windows\System\CFZgySG.exe
  2⤵
  PID:4088
- C:\Windows\System\oLELnda.exe
  C:\Windows\System\oLELnda.exe
  2⤵
  PID:3092
- C:\Windows\System\tltvRZu.exe
  C:\Windows\System\tltvRZu.exe
  2⤵
  PID:4252
- C:\Windows\System\cvZmHPN.exe
  C:\Windows\System\cvZmHPN.exe
  2⤵
  PID:3108
- C:\Windows\System\OxXbeyH.exe
  C:\Windows\System\OxXbeyH.exe
  2⤵
  PID:1432
- C:\Windows\System\QArBWsK.exe
  C:\Windows\System\QArBWsK.exe
  2⤵
  PID:2112
- C:\Windows\System\XnJzauy.exe
  C:\Windows\System\XnJzauy.exe
  2⤵
  PID:2864
- C:\Windows\System\hwOPNbE.exe
  C:\Windows\System\hwOPNbE.exe
  2⤵
  PID:5136
- C:\Windows\System\TfVswOw.exe
  C:\Windows\System\TfVswOw.exe
  2⤵
  PID:5152
- C:\Windows\System\zgjFIUL.exe
  C:\Windows\System\zgjFIUL.exe
  2⤵
  PID:5168
- C:\Windows\System\mfwETzH.exe
  C:\Windows\System\mfwETzH.exe
  2⤵
  PID:5184
- C:\Windows\System\WRlBCtD.exe
  C:\Windows\System\WRlBCtD.exe
  2⤵
  PID:5200
- C:\Windows\System\JDohsHm.exe
  C:\Windows\System\JDohsHm.exe
  2⤵
  PID:5216
- C:\Windows\System\gARLBba.exe
  C:\Windows\System\gARLBba.exe
  2⤵
  PID:5232
- C:\Windows\System\NZCNeYD.exe
  C:\Windows\System\NZCNeYD.exe
  2⤵
  PID:5248
- C:\Windows\System\KojsHwJ.exe
  C:\Windows\System\KojsHwJ.exe
  2⤵
  PID:5264
- C:\Windows\System\CUcDtXG.exe
  C:\Windows\System\CUcDtXG.exe
  2⤵
  PID:5280
- C:\Windows\System\cjjTpXH.exe
  C:\Windows\System\cjjTpXH.exe
  2⤵
  PID:5296
- C:\Windows\System\cDkhwpE.exe
  C:\Windows\System\cDkhwpE.exe
  2⤵
  PID:5312
- C:\Windows\System\pqjTalw.exe
  C:\Windows\System\pqjTalw.exe
  2⤵
  PID:5332
- C:\Windows\System\vyklFcx.exe
  C:\Windows\System\vyklFcx.exe
  2⤵
  PID:5348
- C:\Windows\System\oUtJXpw.exe
  C:\Windows\System\oUtJXpw.exe
  2⤵
  PID:5364
- C:\Windows\System\vRhaPYw.exe
  C:\Windows\System\vRhaPYw.exe
  2⤵
  PID:5380
- C:\Windows\System\FQYoaTL.exe
  C:\Windows\System\FQYoaTL.exe
  2⤵
  PID:5396
- C:\Windows\System\MtQNFmd.exe
  C:\Windows\System\MtQNFmd.exe
  2⤵
  PID:5412
- C:\Windows\System\QUPWQfW.exe
  C:\Windows\System\QUPWQfW.exe
  2⤵
  PID:5428
- C:\Windows\System\KfmtQOW.exe
  C:\Windows\System\KfmtQOW.exe
  2⤵
  PID:5444
- C:\Windows\System\MiFozQN.exe
  C:\Windows\System\MiFozQN.exe
  2⤵
  PID:5460
- C:\Windows\System\caJAIqD.exe
  C:\Windows\System\caJAIqD.exe
  2⤵
  PID:5476
- C:\Windows\System\EeyBcNM.exe
  C:\Windows\System\EeyBcNM.exe
  2⤵
  PID:5492
- C:\Windows\System\rQdqShT.exe
  C:\Windows\System\rQdqShT.exe
  2⤵
  PID:5508
- C:\Windows\System\fODHteV.exe
  C:\Windows\System\fODHteV.exe
  2⤵
  PID:5524
- C:\Windows\System\vzSSlJw.exe
  C:\Windows\System\vzSSlJw.exe
  2⤵
  PID:5540
- C:\Windows\System\VZftcuZ.exe
  C:\Windows\System\VZftcuZ.exe
  2⤵
  PID:5556
- C:\Windows\System\DxXTnRg.exe
  C:\Windows\System\DxXTnRg.exe
  2⤵
  PID:5572
- C:\Windows\System\yHMzAvC.exe
  C:\Windows\System\yHMzAvC.exe
  2⤵
  PID:5588
- C:\Windows\System\geeAYEB.exe
  C:\Windows\System\geeAYEB.exe
  2⤵
  PID:5604
- C:\Windows\System\zMdnPjj.exe
  C:\Windows\System\zMdnPjj.exe
  2⤵
  PID:5620
- C:\Windows\System\jTWslAO.exe
  C:\Windows\System\jTWslAO.exe
  2⤵
  PID:5636
- C:\Windows\System\EKWACtp.exe
  C:\Windows\System\EKWACtp.exe
  2⤵
  PID:5652
- C:\Windows\System\MKCHQCf.exe
  C:\Windows\System\MKCHQCf.exe
  2⤵
  PID:5668
- C:\Windows\System\YzmhyfN.exe
  C:\Windows\System\YzmhyfN.exe
  2⤵
  PID:5684
- C:\Windows\System\gECDzOE.exe
  C:\Windows\System\gECDzOE.exe
  2⤵
  PID:5700
- C:\Windows\System\dZjIAgE.exe
  C:\Windows\System\dZjIAgE.exe
  2⤵
  PID:5716
- C:\Windows\System\xfvAeNm.exe
  C:\Windows\System\xfvAeNm.exe
  2⤵
  PID:5732
- C:\Windows\System\jARNmCc.exe
  C:\Windows\System\jARNmCc.exe
  2⤵
  PID:5748
- C:\Windows\System\JtcMdNp.exe
  C:\Windows\System\JtcMdNp.exe
  2⤵
  PID:5764
- C:\Windows\System\nhJozuz.exe
  C:\Windows\System\nhJozuz.exe
  2⤵
  PID:5780
- C:\Windows\System\zehmJZe.exe
  C:\Windows\System\zehmJZe.exe
  2⤵
  PID:5796
- C:\Windows\System\XbOvYYt.exe
  C:\Windows\System\XbOvYYt.exe
  2⤵
  PID:5812
- C:\Windows\System\FaDdJIJ.exe
  C:\Windows\System\FaDdJIJ.exe
  2⤵
  PID:5828
- C:\Windows\System\bBqbsav.exe
  C:\Windows\System\bBqbsav.exe
  2⤵
  PID:5844
- C:\Windows\System\MDjxOlF.exe
  C:\Windows\System\MDjxOlF.exe
  2⤵
  PID:5860
- C:\Windows\System\eEawvni.exe
  C:\Windows\System\eEawvni.exe
  2⤵
  PID:5876
- C:\Windows\System\YCjVnGv.exe
  C:\Windows\System\YCjVnGv.exe
  2⤵
  PID:5892
- C:\Windows\System\RZDaLvd.exe
  C:\Windows\System\RZDaLvd.exe
  2⤵
  PID:5908
- C:\Windows\System\oVjGMeo.exe
  C:\Windows\System\oVjGMeo.exe
  2⤵
  PID:5924
- C:\Windows\System\upoWLWJ.exe
  C:\Windows\System\upoWLWJ.exe
  2⤵
  PID:5940
- C:\Windows\System\EIOGMUv.exe
  C:\Windows\System\EIOGMUv.exe
  2⤵
  PID:5956
- C:\Windows\System\pDlSLgS.exe
  C:\Windows\System\pDlSLgS.exe
  2⤵
  PID:5972
- C:\Windows\System\HVdwBiu.exe
  C:\Windows\System\HVdwBiu.exe
  2⤵
  PID:5988
- C:\Windows\System\KMdXwRL.exe
  C:\Windows\System\KMdXwRL.exe
  2⤵
  PID:6004
- C:\Windows\System\rOfQywP.exe
  C:\Windows\System\rOfQywP.exe
  2⤵
  PID:6020
- C:\Windows\System\wmeRarH.exe
  C:\Windows\System\wmeRarH.exe
  2⤵
  PID:6036
- C:\Windows\System\tuggBEL.exe
  C:\Windows\System\tuggBEL.exe
  2⤵
  PID:6052
- C:\Windows\System\kEOueNK.exe
  C:\Windows\System\kEOueNK.exe
  2⤵
  PID:6068
- C:\Windows\System\aPeIqyW.exe
  C:\Windows\System\aPeIqyW.exe
  2⤵
  PID:6084
- C:\Windows\System\YcryOle.exe
  C:\Windows\System\YcryOle.exe
  2⤵
  PID:6100
- C:\Windows\System\hpuwxht.exe
  C:\Windows\System\hpuwxht.exe
  2⤵
  PID:6116
- C:\Windows\System\dstfvcw.exe
  C:\Windows\System\dstfvcw.exe
  2⤵
  PID:6132
- C:\Windows\System\XZXpplj.exe
  C:\Windows\System\XZXpplj.exe
  2⤵
  PID:2620
- C:\Windows\System\EgOSjhq.exe
  C:\Windows\System\EgOSjhq.exe
  2⤵
  PID:3528
- C:\Windows\System\AscaKbH.exe
  C:\Windows\System\AscaKbH.exe
  2⤵
  PID:5128
- C:\Windows\System\Lamznxi.exe
  C:\Windows\System\Lamznxi.exe
  2⤵
  PID:5164
- C:\Windows\System\hnaFKxP.exe
  C:\Windows\System\hnaFKxP.exe
  2⤵
  PID:5228
- C:\Windows\System\rPwQZMQ.exe
  C:\Windows\System\rPwQZMQ.exe
  2⤵
  PID:5292
- C:\Windows\System\AZIOYQh.exe
  C:\Windows\System\AZIOYQh.exe
  2⤵
  PID:1512
- C:\Windows\System\SGBKMkF.exe
  C:\Windows\System\SGBKMkF.exe
  2⤵
  PID:5212
- C:\Windows\System\odxBglL.exe
  C:\Windows\System\odxBglL.exe
  2⤵
  PID:5276
- C:\Windows\System\bkxLEZF.exe
  C:\Windows\System\bkxLEZF.exe
  2⤵
  PID:5180
- C:\Windows\System\OIsrnWQ.exe
  C:\Windows\System\OIsrnWQ.exe
  2⤵
  PID:5356
- C:\Windows\System\upYeOmq.exe
  C:\Windows\System\upYeOmq.exe
  2⤵
  PID:5376
- C:\Windows\System\IyvntaU.exe
  C:\Windows\System\IyvntaU.exe
  2⤵
  PID:5484
- C:\Windows\System\AiOoptI.exe
  C:\Windows\System\AiOoptI.exe
  2⤵
  PID:5436
- C:\Windows\System\VfWSwba.exe
  C:\Windows\System\VfWSwba.exe
  2⤵
  PID:5440
- C:\Windows\System\xJmyhwV.exe
  C:\Windows\System\xJmyhwV.exe
  2⤵
  PID:5468
- C:\Windows\System\fPKvaWd.exe
  C:\Windows\System\fPKvaWd.exe
  2⤵
  PID:5564
- C:\Windows\System\juHrPOZ.exe
  C:\Windows\System\juHrPOZ.exe
  2⤵
  PID:5596
- C:\Windows\System\clNOzJK.exe
  C:\Windows\System\clNOzJK.exe
  2⤵
  PID:5644
- C:\Windows\System\IAxkLgJ.exe
  C:\Windows\System\IAxkLgJ.exe
  2⤵
  PID:5708
- C:\Windows\System\LkexqnU.exe
  C:\Windows\System\LkexqnU.exe
  2⤵
  PID:5740
- C:\Windows\System\ueNwEIU.exe
  C:\Windows\System\ueNwEIU.exe
  2⤵
  PID:5692
- C:\Windows\System\rHNSJIz.exe
  C:\Windows\System\rHNSJIz.exe
  2⤵
  PID:5808
- C:\Windows\System\nRaJXyz.exe
  C:\Windows\System\nRaJXyz.exe
  2⤵
  PID:5792
- C:\Windows\System\xHWrhca.exe
  C:\Windows\System\xHWrhca.exe
  2⤵
  PID:5840
- C:\Windows\System\PSrhRKe.exe
  C:\Windows\System\PSrhRKe.exe
  2⤵
  PID:5900
- C:\Windows\System\UOFJbSW.exe
  C:\Windows\System\UOFJbSW.exe
  2⤵
  PID:5856
- C:\Windows\System\bmHlafg.exe
  C:\Windows\System\bmHlafg.exe
  2⤵
  PID:5936
- C:\Windows\System\VUcfCZZ.exe
  C:\Windows\System\VUcfCZZ.exe
  2⤵
  PID:5952
- C:\Windows\System\ntcDMbW.exe
  C:\Windows\System\ntcDMbW.exe
  2⤵
  PID:2792
- C:\Windows\System\EbRLtii.exe
  C:\Windows\System\EbRLtii.exe
  2⤵
  PID:5044
- C:\Windows\System\ijflLfe.exe
  C:\Windows\System\ijflLfe.exe
  2⤵
  PID:5224
- C:\Windows\System\MzJKTDV.exe
  C:\Windows\System\MzJKTDV.exe
  2⤵
  PID:5240
- C:\Windows\System\AYuNVmf.exe
  C:\Windows\System\AYuNVmf.exe
  2⤵
  PID:5340
- C:\Windows\System\dMbjTJJ.exe
  C:\Windows\System\dMbjTJJ.exe
  2⤵
  PID:5532
- C:\Windows\System\daAtXmx.exe
  C:\Windows\System\daAtXmx.exe
  2⤵
  PID:5628
- C:\Windows\System\CYWUexu.exe
  C:\Windows\System\CYWUexu.exe
  2⤵
  PID:5804
- C:\Windows\System\ntmKGqS.exe
  C:\Windows\System\ntmKGqS.exe
  2⤵
  PID:5756
- C:\Windows\System\jRcZqTs.exe
  C:\Windows\System\jRcZqTs.exe
  2⤵
  PID:4828
- C:\Windows\System\ILfGRph.exe
  C:\Windows\System\ILfGRph.exe
  2⤵
  PID:3944
- C:\Windows\System\oFVREzd.exe
  C:\Windows\System\oFVREzd.exe
  2⤵
  PID:5208
- C:\Windows\System\jMdDwcp.exe
  C:\Windows\System\jMdDwcp.exe
  2⤵
  PID:5388
- C:\Windows\System\hgVBdcR.exe
  C:\Windows\System\hgVBdcR.exe
  2⤵
  PID:5372
- C:\Windows\System\UIYixAq.exe
  C:\Windows\System\UIYixAq.exe
  2⤵
  PID:5472
- C:\Windows\System\mvWtUfc.exe
  C:\Windows\System\mvWtUfc.exe
  2⤵
  PID:5788
- C:\Windows\System\vCENfVe.exe
  C:\Windows\System\vCENfVe.exe
  2⤵
  PID:5584
- C:\Windows\System\ryRIyfS.exe
  C:\Windows\System\ryRIyfS.exe
  2⤵
  PID:4296
- C:\Windows\System\FzTgPZh.exe
  C:\Windows\System\FzTgPZh.exe
  2⤵
  PID:4260
- C:\Windows\System\JyctVvB.exe
  C:\Windows\System\JyctVvB.exe
  2⤵
  PID:4352
- C:\Windows\System\rlZrqQz.exe
  C:\Windows\System\rlZrqQz.exe
  2⤵
  PID:4264
- C:\Windows\System\kmzUvCJ.exe
  C:\Windows\System\kmzUvCJ.exe
  2⤵
  PID:4280
- C:\Windows\System\DiBqIaA.exe
  C:\Windows\System\DiBqIaA.exe
  2⤵
  PID:4312
- C:\Windows\System\UcPmqmD.exe
  C:\Windows\System\UcPmqmD.exe
  2⤵
  PID:4324
- C:\Windows\System\FqRNPgm.exe
  C:\Windows\System\FqRNPgm.exe
  2⤵
  PID:6000
- C:\Windows\System\hxBiyAk.exe
  C:\Windows\System\hxBiyAk.exe
  2⤵
  PID:5980
- C:\Windows\System\ZMQfUMR.exe
  C:\Windows\System\ZMQfUMR.exe
  2⤵
  PID:6044
- C:\Windows\System\JOirZQW.exe
  C:\Windows\System\JOirZQW.exe
  2⤵
  PID:6092
- C:\Windows\System\fasvKsS.exe
  C:\Windows\System\fasvKsS.exe
  2⤵
  PID:1852
- C:\Windows\System\LMvuGNS.exe
  C:\Windows\System\LMvuGNS.exe
  2⤵
  PID:6112
- C:\Windows\System\hcXicyo.exe
  C:\Windows\System\hcXicyo.exe
  2⤵
  PID:5244
- C:\Windows\System\oURifkH.exe
  C:\Windows\System\oURifkH.exe
  2⤵
  PID:4944
- C:\Windows\System\hbljKHq.exe
  C:\Windows\System\hbljKHq.exe
  2⤵
  PID:5776
- C:\Windows\System\prZpTyv.exe
  C:\Windows\System\prZpTyv.exe
  2⤵
  PID:4128
- C:\Windows\System\apzMKXY.exe
  C:\Windows\System\apzMKXY.exe
  2⤵
  PID:6124
- C:\Windows\System\uLeGCnj.exe
  C:\Windows\System\uLeGCnj.exe
  2⤵
  PID:5500
- C:\Windows\System\UPFBMQF.exe
  C:\Windows\System\UPFBMQF.exe
  2⤵
  PID:4288
- C:\Windows\System\kiQPObN.exe
  C:\Windows\System\kiQPObN.exe
  2⤵
  PID:5408
- C:\Windows\System\ZjAiLOq.exe
  C:\Windows\System\ZjAiLOq.exe
  2⤵
  PID:3736
- C:\Windows\System\aqvKCEg.exe
  C:\Windows\System\aqvKCEg.exe
  2⤵
  PID:5664
- C:\Windows\System\DnneGuf.exe
  C:\Windows\System\DnneGuf.exe
  2⤵
  PID:5964
- C:\Windows\System\xWjXnKi.exe
  C:\Windows\System\xWjXnKi.exe
  2⤵
  PID:6028
- C:\Windows\System\ncpcfEW.exe
  C:\Windows\System\ncpcfEW.exe
  2⤵
  PID:6140
- C:\Windows\System\jOsjdxS.exe
  C:\Windows\System\jOsjdxS.exe
  2⤵
  PID:6064
- C:\Windows\System\CfDeITE.exe
  C:\Windows\System\CfDeITE.exe
  2⤵
  PID:5888
- C:\Windows\System\WYtVvso.exe
  C:\Windows\System\WYtVvso.exe
  2⤵
  PID:4524
- C:\Windows\System\SKitPXp.exe
  C:\Windows\System\SKitPXp.exe
  2⤵
  PID:5824
- C:\Windows\System\KVqdCcL.exe
  C:\Windows\System\KVqdCcL.exe
  2⤵
  PID:5904
- C:\Windows\System\bsavwdq.exe
  C:\Windows\System\bsavwdq.exe
  2⤵
  PID:4316
- C:\Windows\System\xovbqrj.exe
  C:\Windows\System\xovbqrj.exe
  2⤵
  PID:5600
- C:\Windows\System\dOjasOl.exe
  C:\Windows\System\dOjasOl.exe
  2⤵
  PID:6128
- C:\Windows\System\GZoWfrg.exe
  C:\Windows\System\GZoWfrg.exe
  2⤵
  PID:2992
- C:\Windows\System\KANytCz.exe
  C:\Windows\System\KANytCz.exe
  2⤵
  PID:5948
- C:\Windows\System\YDXcLvD.exe
  C:\Windows\System\YDXcLvD.exe
  2⤵
  PID:5568
- C:\Windows\System\iPBCmaE.exe
  C:\Windows\System\iPBCmaE.exe
  2⤵
  PID:6108
- C:\Windows\System\qAFRcCz.exe
  C:\Windows\System\qAFRcCz.exe
  2⤵
  PID:5552
- C:\Windows\System\IQuGfLt.exe
  C:\Windows\System\IQuGfLt.exe
  2⤵
  PID:6152
- C:\Windows\System\pfPwZbn.exe
  C:\Windows\System\pfPwZbn.exe
  2⤵
  PID:6168
- C:\Windows\System\VJKWoGd.exe
  C:\Windows\System\VJKWoGd.exe
  2⤵
  PID:6184
- C:\Windows\System\rDcLAZb.exe
  C:\Windows\System\rDcLAZb.exe
  2⤵
  PID:6200
- C:\Windows\System\UaWLhME.exe
  C:\Windows\System\UaWLhME.exe
  2⤵
  PID:6216
- C:\Windows\System\bTdmbrG.exe
  C:\Windows\System\bTdmbrG.exe
  2⤵
  PID:6232
- C:\Windows\System\TpBJAVI.exe
  C:\Windows\System\TpBJAVI.exe
  2⤵
  PID:6248
- C:\Windows\System\IbOfNty.exe
  C:\Windows\System\IbOfNty.exe
  2⤵
  PID:6264
- C:\Windows\System\LYYSlax.exe
  C:\Windows\System\LYYSlax.exe
  2⤵
  PID:6280
- C:\Windows\System\lMOrRdx.exe
  C:\Windows\System\lMOrRdx.exe
  2⤵
  PID:6296
- C:\Windows\System\JOdFgyk.exe
  C:\Windows\System\JOdFgyk.exe
  2⤵
  PID:6312
- C:\Windows\System\ZskVjQe.exe
  C:\Windows\System\ZskVjQe.exe
  2⤵
  PID:6328
- C:\Windows\System\MNYVkEH.exe
  C:\Windows\System\MNYVkEH.exe
  2⤵
  PID:6344
- C:\Windows\System\WClEQXK.exe
  C:\Windows\System\WClEQXK.exe
  2⤵
  PID:6360
- C:\Windows\System\MlFNQGS.exe
  C:\Windows\System\MlFNQGS.exe
  2⤵
  PID:6376
- C:\Windows\System\FCMlBkJ.exe
  C:\Windows\System\FCMlBkJ.exe
  2⤵
  PID:6392
- C:\Windows\System\NfWThMb.exe
  C:\Windows\System\NfWThMb.exe
  2⤵
  PID:6408
- C:\Windows\System\regCZxS.exe
  C:\Windows\System\regCZxS.exe
  2⤵
  PID:6428
- C:\Windows\System\CqyleaS.exe
  C:\Windows\System\CqyleaS.exe
  2⤵
  PID:6444
- C:\Windows\System\afTkxxr.exe
  C:\Windows\System\afTkxxr.exe
  2⤵
  PID:6460
- C:\Windows\System\lXYuwqH.exe
  C:\Windows\System\lXYuwqH.exe
  2⤵
  PID:6476
- C:\Windows\System\HMaHsNv.exe
  C:\Windows\System\HMaHsNv.exe
  2⤵
  PID:6492
- C:\Windows\System\SdMNtyY.exe
  C:\Windows\System\SdMNtyY.exe
  2⤵
  PID:6508
- C:\Windows\System\lMLxzgB.exe
  C:\Windows\System\lMLxzgB.exe
  2⤵
  PID:6524
- C:\Windows\System\eNKhEeE.exe
  C:\Windows\System\eNKhEeE.exe
  2⤵
  PID:6540
- C:\Windows\System\cwZQXWX.exe
  C:\Windows\System\cwZQXWX.exe
  2⤵
  PID:6556
- C:\Windows\System\HvQHOzv.exe
  C:\Windows\System\HvQHOzv.exe
  2⤵
  PID:6572
- C:\Windows\System\qUGYlsK.exe
  C:\Windows\System\qUGYlsK.exe
  2⤵
  PID:6588
- C:\Windows\System\cMyomTh.exe
  C:\Windows\System\cMyomTh.exe
  2⤵
  PID:6604
- C:\Windows\System\XobrDiM.exe
  C:\Windows\System\XobrDiM.exe
  2⤵
  PID:6620
- C:\Windows\System\xLVGNnI.exe
  C:\Windows\System\xLVGNnI.exe
  2⤵
  PID:6636
- C:\Windows\System\yYQDUpg.exe
  C:\Windows\System\yYQDUpg.exe
  2⤵
  PID:6652
- C:\Windows\System\hvWzsSY.exe
  C:\Windows\System\hvWzsSY.exe
  2⤵
  PID:6668
- C:\Windows\System\qltwKsP.exe
  C:\Windows\System\qltwKsP.exe
  2⤵
  PID:6688
- C:\Windows\System\rFLiCZS.exe
  C:\Windows\System\rFLiCZS.exe
  2⤵
  PID:6704
- C:\Windows\System\uPGvKHj.exe
  C:\Windows\System\uPGvKHj.exe
  2⤵
  PID:6720
- C:\Windows\System\rNNFtqj.exe
  C:\Windows\System\rNNFtqj.exe
  2⤵
  PID:6736
- C:\Windows\System\xkoORtz.exe
  C:\Windows\System\xkoORtz.exe
  2⤵
  PID:6752
- C:\Windows\System\fbTaVtO.exe
  C:\Windows\System\fbTaVtO.exe
  2⤵
  PID:6768
- C:\Windows\System\UgnEobg.exe
  C:\Windows\System\UgnEobg.exe
  2⤵
  PID:6784
- C:\Windows\System\FWTTlUt.exe
  C:\Windows\System\FWTTlUt.exe
  2⤵
  PID:6800
- C:\Windows\System\ftyraTN.exe
  C:\Windows\System\ftyraTN.exe
  2⤵
  PID:6816
- C:\Windows\System\njSHaln.exe
  C:\Windows\System\njSHaln.exe
  2⤵
  PID:6832
- C:\Windows\System\NbhEtRW.exe
  C:\Windows\System\NbhEtRW.exe
  2⤵
  PID:6848
- C:\Windows\System\pyfTBtd.exe
  C:\Windows\System\pyfTBtd.exe
  2⤵
  PID:6864
- C:\Windows\System\ZlMKEDl.exe
  C:\Windows\System\ZlMKEDl.exe
  2⤵
  PID:6880
- C:\Windows\System\FQgUtpz.exe
  C:\Windows\System\FQgUtpz.exe
  2⤵
  PID:6896
- C:\Windows\System\ownsgZJ.exe
  C:\Windows\System\ownsgZJ.exe
  2⤵
  PID:6912
- C:\Windows\System\iTHiUrN.exe
  C:\Windows\System\iTHiUrN.exe
  2⤵
  PID:6928
- C:\Windows\System\UfoIndO.exe
  C:\Windows\System\UfoIndO.exe
  2⤵
  PID:6944
- C:\Windows\System\wpWUBbZ.exe
  C:\Windows\System\wpWUBbZ.exe
  2⤵
  PID:6976
- C:\Windows\System\BQIMKQQ.exe
  C:\Windows\System\BQIMKQQ.exe
  2⤵
  PID:6996
- C:\Windows\System\TwTFkyJ.exe
  C:\Windows\System\TwTFkyJ.exe
  2⤵
  PID:7012
- C:\Windows\System\GqaycBU.exe
  C:\Windows\System\GqaycBU.exe
  2⤵
  PID:7028
- C:\Windows\System\HCkMopS.exe
  C:\Windows\System\HCkMopS.exe
  2⤵
  PID:7044
- C:\Windows\System\uTaDCcI.exe
  C:\Windows\System\uTaDCcI.exe
  2⤵
  PID:7060
- C:\Windows\System\mrzEmQD.exe
  C:\Windows\System\mrzEmQD.exe
  2⤵
  PID:7076
- C:\Windows\System\znfZdJc.exe
  C:\Windows\System\znfZdJc.exe
  2⤵
  PID:7092
- C:\Windows\System\isxfFLk.exe
  C:\Windows\System\isxfFLk.exe
  2⤵
  PID:7108
- C:\Windows\System\VVDzyPT.exe
  C:\Windows\System\VVDzyPT.exe
  2⤵
  PID:7124
- C:\Windows\System\jsJgtnW.exe
  C:\Windows\System\jsJgtnW.exe
  2⤵
  PID:7140
- C:\Windows\System\flqYYkZ.exe
  C:\Windows\System\flqYYkZ.exe
  2⤵
  PID:7156
- C:\Windows\System\hGgEZNk.exe
  C:\Windows\System\hGgEZNk.exe
  2⤵
  PID:6160
- C:\Windows\System\jnbKuye.exe
  C:\Windows\System\jnbKuye.exe
  2⤵
  PID:5060
- C:\Windows\System\aPfjnRV.exe
  C:\Windows\System\aPfjnRV.exe
  2⤵
  PID:5456
- C:\Windows\System\MjAaZAk.exe
  C:\Windows\System\MjAaZAk.exe
  2⤵
  PID:6180
- C:\Windows\System\jTEanBJ.exe
  C:\Windows\System\jTEanBJ.exe
  2⤵
  PID:3548
- C:\Windows\System\IZCVRCQ.exe
  C:\Windows\System\IZCVRCQ.exe
  2⤵
  PID:6244
- C:\Windows\System\nkMNIWX.exe
  C:\Windows\System\nkMNIWX.exe
  2⤵
  PID:6324
- C:\Windows\System\zFmdQbR.exe
  C:\Windows\System\zFmdQbR.exe
  2⤵
  PID:6388
- C:\Windows\System\RACVZwU.exe
  C:\Windows\System\RACVZwU.exe
  2⤵
  PID:6424
- C:\Windows\System\RFsXznP.exe
  C:\Windows\System\RFsXznP.exe
  2⤵
  PID:6336
- C:\Windows\System\uhFnotX.exe
  C:\Windows\System\uhFnotX.exe
  2⤵
  PID:6404
- C:\Windows\System\srjStJo.exe
  C:\Windows\System\srjStJo.exe
  2⤵
  PID:6488
- C:\Windows\System\bflLXLV.exe
  C:\Windows\System\bflLXLV.exe
  2⤵
  PID:6504
- C:\Windows\System\GjbPcBG.exe
  C:\Windows\System\GjbPcBG.exe
  2⤵
  PID:6532
- C:\Windows\System\rmBabHL.exe
  C:\Windows\System\rmBabHL.exe
  2⤵
  PID:6580
- C:\Windows\System\GCUAfoe.exe
  C:\Windows\System\GCUAfoe.exe
  2⤵
  PID:6600
- C:\Windows\System\MDdhBob.exe
  C:\Windows\System\MDdhBob.exe
  2⤵
  PID:6632
- C:\Windows\System\KwdOTpc.exe
  C:\Windows\System\KwdOTpc.exe
  2⤵
  PID:6664
- C:\Windows\System\jiqSScO.exe
  C:\Windows\System\jiqSScO.exe
  2⤵
  PID:6716
- C:\Windows\System\YGGHExy.exe
  C:\Windows\System\YGGHExy.exe
  2⤵
  PID:6780
- C:\Windows\System\HnuSIDd.exe
  C:\Windows\System\HnuSIDd.exe
  2⤵
  PID:6876
- C:\Windows\System\oZxishc.exe
  C:\Windows\System\oZxishc.exe
  2⤵
  PID:6796
- C:\Windows\System\AIpVEia.exe
  C:\Windows\System\AIpVEia.exe
  2⤵
  PID:6792
- C:\Windows\System\YAESjSb.exe
  C:\Windows\System\YAESjSb.exe
  2⤵
  PID:6824
- C:\Windows\System\ioXQSky.exe
  C:\Windows\System\ioXQSky.exe
  2⤵
  PID:6860
- C:\Windows\System\lnjZJud.exe
  C:\Windows\System\lnjZJud.exe
  2⤵
  PID:6940
- C:\Windows\System\tgZwmmA.exe
  C:\Windows\System\tgZwmmA.exe
  2⤵
  PID:6964
- C:\Windows\System\mporzql.exe
  C:\Windows\System\mporzql.exe
  2⤵
  PID:7020
- C:\Windows\System\FkTrZbH.exe
  C:\Windows\System\FkTrZbH.exe
  2⤵
  PID:7088
- C:\Windows\System\HGtgDrS.exe
  C:\Windows\System\HGtgDrS.exe
  2⤵
  PID:7008
- C:\Windows\System\RGtcsSg.exe
  C:\Windows\System\RGtcsSg.exe
  2⤵
  PID:7068
- C:\Windows\System\qXoFBBq.exe
  C:\Windows\System\qXoFBBq.exe
  2⤵
  PID:7152
- C:\Windows\System\VzbbCcY.exe
  C:\Windows\System\VzbbCcY.exe
  2⤵
  PID:6212
- C:\Windows\System\VCOzJNa.exe
  C:\Windows\System\VCOzJNa.exe
  2⤵
  PID:7132
- C:\Windows\System\wUUqIcp.exe
  C:\Windows\System\wUUqIcp.exe
  2⤵
  PID:7164
- C:\Windows\System\AEPzCVe.exe
  C:\Windows\System\AEPzCVe.exe
  2⤵
  PID:6256
- C:\Windows\System\hHWOiqO.exe
  C:\Windows\System\hHWOiqO.exe
  2⤵
  PID:6384
- C:\Windows\System\zZjKoZa.exe
  C:\Windows\System\zZjKoZa.exe
  2⤵
  PID:6440
- C:\Windows\System\AvcvEJw.exe
  C:\Windows\System\AvcvEJw.exe
  2⤵
  PID:6292
- C:\Windows\System\mkwIVdr.exe
  C:\Windows\System\mkwIVdr.exe
  2⤵
  PID:6552
- C:\Windows\System\wleaTtw.exe
  C:\Windows\System\wleaTtw.exe
  2⤵
  PID:6596
- C:\Windows\System\SgsSsXO.exe
  C:\Windows\System\SgsSsXO.exe
  2⤵
  PID:6748
- C:\Windows\System\kDGJAoK.exe
  C:\Windows\System\kDGJAoK.exe
  2⤵
  PID:6564
- C:\Windows\System\XCWEIpU.exe
  C:\Windows\System\XCWEIpU.exe
  2⤵
  PID:6760
- C:\Windows\System\HmNcMrJ.exe
  C:\Windows\System\HmNcMrJ.exe
  2⤵
  PID:6828
- C:\Windows\System\AgxdZdv.exe
  C:\Windows\System\AgxdZdv.exe
  2⤵
  PID:6888
- C:\Windows\System\xwnGqXl.exe
  C:\Windows\System\xwnGqXl.exe
  2⤵
  PID:6936
- C:\Windows\System\xKNfHRo.exe
  C:\Windows\System\xKNfHRo.exe
  2⤵
  PID:6988
- C:\Windows\System\qjTmglB.exe
  C:\Windows\System\qjTmglB.exe
  2⤵
  PID:2012
- C:\Windows\System\TOOlKSP.exe
  C:\Windows\System\TOOlKSP.exe
  2⤵
  PID:1736
- C:\Windows\System\aFvUkrq.exe
  C:\Windows\System\aFvUkrq.exe
  2⤵
  PID:6196
- C:\Windows\System\waUaRtk.exe
  C:\Windows\System\waUaRtk.exe
  2⤵
  PID:6372
- C:\Windows\System\tScnUOg.exe
  C:\Windows\System\tScnUOg.exe
  2⤵
  PID:6468
- C:\Windows\System\LPxqaCY.exe
  C:\Windows\System\LPxqaCY.exe
  2⤵
  PID:6240
- C:\Windows\System\RdmMMKG.exe
  C:\Windows\System\RdmMMKG.exe
  2⤵
  PID:6520
- C:\Windows\System\FxcYjlJ.exe
  C:\Windows\System\FxcYjlJ.exe
  2⤵
  PID:6908
- C:\Windows\System\apsXgIq.exe
  C:\Windows\System\apsXgIq.exe
  2⤵
  PID:6872
- C:\Windows\System\nQqRuAJ.exe
  C:\Windows\System\nQqRuAJ.exe
  2⤵
  PID:6612
- C:\Windows\System\NzUYVOr.exe
  C:\Windows\System\NzUYVOr.exe
  2⤵
  PID:6920
- C:\Windows\System\iqNKWwr.exe
  C:\Windows\System\iqNKWwr.exe
  2⤵
  PID:7072
- C:\Windows\System\qYgDTrm.exe
  C:\Windows\System\qYgDTrm.exe
  2⤵
  PID:4304
- C:\Windows\System\nHmGnKM.exe
  C:\Windows\System\nHmGnKM.exe
  2⤵
  PID:6276
- C:\Windows\System\iAYfOxF.exe
  C:\Windows\System\iAYfOxF.exe
  2⤵
  PID:3448
- C:\Windows\System\uRJnHQr.exe
  C:\Windows\System\uRJnHQr.exe
  2⤵
  PID:6568
- C:\Windows\System\NPuiEpR.exe
  C:\Windows\System\NPuiEpR.exe
  2⤵
  PID:7056
- C:\Windows\System\ZBruTLS.exe
  C:\Windows\System\ZBruTLS.exe
  2⤵
  PID:6644
- C:\Windows\System\zvMtFmv.exe
  C:\Windows\System\zvMtFmv.exe
  2⤵
  PID:6700
- C:\Windows\System\NFbpNhe.exe
  C:\Windows\System\NFbpNhe.exe
  2⤵
  PID:7176
- C:\Windows\System\NpODbTE.exe
  C:\Windows\System\NpODbTE.exe
  2⤵
  PID:7192
- C:\Windows\System\EzJYsGL.exe
  C:\Windows\System\EzJYsGL.exe
  2⤵
  PID:7208
- C:\Windows\System\nGwcSVG.exe
  C:\Windows\System\nGwcSVG.exe
  2⤵
  PID:7224
- C:\Windows\System\qUPKQuW.exe
  C:\Windows\System\qUPKQuW.exe
  2⤵
  PID:7240
- C:\Windows\System\QyidGwV.exe
  C:\Windows\System\QyidGwV.exe
  2⤵
  PID:7256
- C:\Windows\System\fBQndJZ.exe
  C:\Windows\System\fBQndJZ.exe
  2⤵
  PID:7272
- C:\Windows\System\iqXiVbs.exe
  C:\Windows\System\iqXiVbs.exe
  2⤵
  PID:7288
- C:\Windows\System\hqeyBKH.exe
  C:\Windows\System\hqeyBKH.exe
  2⤵
  PID:7304
- C:\Windows\System\pVMTAMQ.exe
  C:\Windows\System\pVMTAMQ.exe
  2⤵
  PID:7320
- C:\Windows\System\XCLbrxB.exe
  C:\Windows\System\XCLbrxB.exe
  2⤵
  PID:7336
- C:\Windows\System\rlBLSAP.exe
  C:\Windows\System\rlBLSAP.exe
  2⤵
  PID:7352
- C:\Windows\System\OfQvzAQ.exe
  C:\Windows\System\OfQvzAQ.exe
  2⤵
  PID:7368
- C:\Windows\System\DAjyJmp.exe
  C:\Windows\System\DAjyJmp.exe
  2⤵
  PID:7384
- C:\Windows\System\ARNUWoM.exe
  C:\Windows\System\ARNUWoM.exe
  2⤵
  PID:7400
- C:\Windows\System\wXjbhwI.exe
  C:\Windows\System\wXjbhwI.exe
  2⤵
  PID:7416
- C:\Windows\System\EdLAWiF.exe
  C:\Windows\System\EdLAWiF.exe
  2⤵
  PID:7432
- C:\Windows\System\vhGhMTi.exe
  C:\Windows\System\vhGhMTi.exe
  2⤵
  PID:7448
- C:\Windows\System\lhEZoZA.exe
  C:\Windows\System\lhEZoZA.exe
  2⤵
  PID:7464
- C:\Windows\System\NYRskOZ.exe
  C:\Windows\System\NYRskOZ.exe
  2⤵
  PID:7480
- C:\Windows\System\ZpScpGO.exe
  C:\Windows\System\ZpScpGO.exe
  2⤵
  PID:7496
- C:\Windows\System\IbkLGod.exe
  C:\Windows\System\IbkLGod.exe
  2⤵
  PID:7512
- C:\Windows\System\ryWFDJj.exe
  C:\Windows\System\ryWFDJj.exe
  2⤵
  PID:7528
- C:\Windows\System\vphQeaD.exe
  C:\Windows\System\vphQeaD.exe
  2⤵
  PID:7544
- C:\Windows\System\KVqHPLw.exe
  C:\Windows\System\KVqHPLw.exe
  2⤵
  PID:7560
- C:\Windows\System\PmhWCTd.exe
  C:\Windows\System\PmhWCTd.exe
  2⤵
  PID:7576
- C:\Windows\System\jWMiKao.exe
  C:\Windows\System\jWMiKao.exe
  2⤵
  PID:7592
- C:\Windows\System\dDUyGfY.exe
  C:\Windows\System\dDUyGfY.exe
  2⤵
  PID:7608
- C:\Windows\System\RDeYdrz.exe
  C:\Windows\System\RDeYdrz.exe
  2⤵
  PID:7624
- C:\Windows\System\WWwjCnl.exe
  C:\Windows\System\WWwjCnl.exe
  2⤵
  PID:7640
- C:\Windows\System\CgkbePE.exe
  C:\Windows\System\CgkbePE.exe
  2⤵
  PID:7656
- C:\Windows\System\HrynRQR.exe
  C:\Windows\System\HrynRQR.exe
  2⤵
  PID:7672
- C:\Windows\System\PuUxBoC.exe
  C:\Windows\System\PuUxBoC.exe
  2⤵
  PID:7688
- C:\Windows\System\KeqhnmE.exe
  C:\Windows\System\KeqhnmE.exe
  2⤵
  PID:7704
- C:\Windows\System\cMkDbzd.exe
  C:\Windows\System\cMkDbzd.exe
  2⤵
  PID:7720
- C:\Windows\System\MUieLdt.exe
  C:\Windows\System\MUieLdt.exe
  2⤵
  PID:7736
- C:\Windows\System\vSeUvHG.exe
  C:\Windows\System\vSeUvHG.exe
  2⤵
  PID:7752
- C:\Windows\System\mzTWkJT.exe
  C:\Windows\System\mzTWkJT.exe
  2⤵
  PID:7768
- C:\Windows\System\tWwZDFN.exe
  C:\Windows\System\tWwZDFN.exe
  2⤵
  PID:7784
- C:\Windows\System\PtGNSsZ.exe
  C:\Windows\System\PtGNSsZ.exe
  2⤵
  PID:7800
- C:\Windows\System\piEyWVM.exe
  C:\Windows\System\piEyWVM.exe
  2⤵
  PID:7816
- C:\Windows\System\yvugIbR.exe
  C:\Windows\System\yvugIbR.exe
  2⤵
  PID:7836
- C:\Windows\System\WGyYKlX.exe
  C:\Windows\System\WGyYKlX.exe
  2⤵
  PID:7852
- C:\Windows\System\xlutWKq.exe
  C:\Windows\System\xlutWKq.exe
  2⤵
  PID:7872
- C:\Windows\System\sXTmgrZ.exe
  C:\Windows\System\sXTmgrZ.exe
  2⤵
  PID:7888
- C:\Windows\System\FepZaCT.exe
  C:\Windows\System\FepZaCT.exe
  2⤵
  PID:7908
- C:\Windows\System\ZGvnMlV.exe
  C:\Windows\System\ZGvnMlV.exe
  2⤵
  PID:7936
- C:\Windows\System\VAwINfR.exe
  C:\Windows\System\VAwINfR.exe
  2⤵
  PID:7960
- C:\Windows\System\ClKHAva.exe
  C:\Windows\System\ClKHAva.exe
  2⤵
  PID:7992
- C:\Windows\System\hoejkvg.exe
  C:\Windows\System\hoejkvg.exe
  2⤵
  PID:8012
- C:\Windows\System\szWSHDj.exe
  C:\Windows\System\szWSHDj.exe
  2⤵
  PID:8028
- C:\Windows\System\ZhzkAHr.exe
  C:\Windows\System\ZhzkAHr.exe
  2⤵
  PID:8044
- C:\Windows\System\wJyFHEi.exe
  C:\Windows\System\wJyFHEi.exe
  2⤵
  PID:8060
- C:\Windows\System\abbGgEQ.exe
  C:\Windows\System\abbGgEQ.exe
  2⤵
  PID:8084
- C:\Windows\System\esUICaT.exe
  C:\Windows\System\esUICaT.exe
  2⤵
  PID:8100
- C:\Windows\System\TYORajt.exe
  C:\Windows\System\TYORajt.exe
  2⤵
  PID:8116
- C:\Windows\System\bEqQsgJ.exe
  C:\Windows\System\bEqQsgJ.exe
  2⤵
  PID:8132
- C:\Windows\System\BJnhLGB.exe
  C:\Windows\System\BJnhLGB.exe
  2⤵
  PID:8148
- C:\Windows\System\VttElEr.exe
  C:\Windows\System\VttElEr.exe
  2⤵
  PID:8164
- C:\Windows\System\KqVvCUp.exe
  C:\Windows\System\KqVvCUp.exe
  2⤵
  PID:8180
- C:\Windows\System\IOVoLEf.exe
  C:\Windows\System\IOVoLEf.exe
  2⤵
  PID:6416
- C:\Windows\System\UPetinu.exe
  C:\Windows\System\UPetinu.exe
  2⤵
  PID:6648
- C:\Windows\System\YSVTwVL.exe
  C:\Windows\System\YSVTwVL.exe
  2⤵
  PID:7216
- C:\Windows\System\sITmpOs.exe
  C:\Windows\System\sITmpOs.exe
  2⤵
  PID:7204
- C:\Windows\System\XKRTEcY.exe
  C:\Windows\System\XKRTEcY.exe
  2⤵
  PID:7268
- C:\Windows\System\KRofKFC.exe
  C:\Windows\System\KRofKFC.exe
  2⤵
  PID:7248
- C:\Windows\System\JvoiVlo.exe
  C:\Windows\System\JvoiVlo.exe
  2⤵
  PID:7284
- C:\Windows\System\CvrGpae.exe
  C:\Windows\System\CvrGpae.exe
  2⤵
  PID:7392
- C:\Windows\System\dplRIAK.exe
  C:\Windows\System\dplRIAK.exe
  2⤵
  PID:7380
- C:\Windows\System\dfYtTFv.exe
  C:\Windows\System\dfYtTFv.exe
  2⤵
  PID:7428
- C:\Windows\System\UdjbrBI.exe
  C:\Windows\System\UdjbrBI.exe
  2⤵
  PID:7412
- C:\Windows\System\RUJHTQX.exe
  C:\Windows\System\RUJHTQX.exe
  2⤵
  PID:7488
- C:\Windows\System\HHrVlkv.exe
  C:\Windows\System\HHrVlkv.exe
  2⤵
  PID:7520
- C:\Windows\System\qQxyLoh.exe
  C:\Windows\System\qQxyLoh.exe
  2⤵
  PID:7536
- C:\Windows\System\rPAhzoW.exe
  C:\Windows\System\rPAhzoW.exe
  2⤵
  PID:7584
- C:\Windows\System\QvvNsBQ.exe
  C:\Windows\System\QvvNsBQ.exe
  2⤵
  PID:7648
- C:\Windows\System\FqQvMvU.exe
  C:\Windows\System\FqQvMvU.exe
  2⤵
  PID:7568
- C:\Windows\System\yYUyFqf.exe
  C:\Windows\System\yYUyFqf.exe
  2⤵
  PID:7700
- C:\Windows\System\xNvlvXd.exe
  C:\Windows\System\xNvlvXd.exe
  2⤵
  PID:7664
- C:\Windows\System\cgYWJXh.exe
  C:\Windows\System\cgYWJXh.exe
  2⤵
  PID:7744
- C:\Windows\System\QTTypkW.exe
  C:\Windows\System\QTTypkW.exe
  2⤵
  PID:7732
- C:\Windows\System\nYiLBmW.exe
  C:\Windows\System\nYiLBmW.exe
  2⤵
  PID:7792
- C:\Windows\System\PqAXyoy.exe
  C:\Windows\System\PqAXyoy.exe
  2⤵
  PID:7844
- C:\Windows\System\cYQUXgZ.exe
  C:\Windows\System\cYQUXgZ.exe
  2⤵
  PID:7832
- C:\Windows\System\qwxkYpI.exe
  C:\Windows\System\qwxkYpI.exe
  2⤵
  PID:7884
- C:\Windows\System\zNsShAV.exe
  C:\Windows\System\zNsShAV.exe
  2⤵
  PID:7904
- C:\Windows\System\zvbNsFt.exe
  C:\Windows\System\zvbNsFt.exe
  2⤵
  PID:7944
- C:\Windows\System\Zmdnkkp.exe
  C:\Windows\System\Zmdnkkp.exe
  2⤵
  PID:7968
- C:\Windows\System\wRyKupP.exe
  C:\Windows\System\wRyKupP.exe
  2⤵
  PID:7956
- C:\Windows\System\oZJLRle.exe
  C:\Windows\System\oZJLRle.exe
  2⤵
  PID:7952
- C:\Windows\System\vvsbLUV.exe
  C:\Windows\System\vvsbLUV.exe
  2⤵
  PID:8000
- C:\Windows\System\ePYLUxA.exe
  C:\Windows\System\ePYLUxA.exe
  2⤵
  PID:8068
- C:\Windows\System\jVQWCcC.exe
  C:\Windows\System\jVQWCcC.exe
  2⤵
  PID:8092
- C:\Windows\System\usoUaLX.exe
  C:\Windows\System\usoUaLX.exe
  2⤵
  PID:8156
- C:\Windows\System\YFwUzRH.exe
  C:\Windows\System\YFwUzRH.exe
  2⤵
  PID:8108
- C:\Windows\System\myIbbUL.exe
  C:\Windows\System\myIbbUL.exe
  2⤵
  PID:6400
- C:\Windows\System\cTrfUjT.exe
  C:\Windows\System\cTrfUjT.exe
  2⤵
  PID:7104
- C:\Windows\System\YSTSikp.exe
  C:\Windows\System\YSTSikp.exe
  2⤵
  PID:7184
- C:\Windows\System\wYCuBPN.exe
  C:\Windows\System\wYCuBPN.exe
  2⤵
  PID:7316
- C:\Windows\System\ppqglWH.exe
  C:\Windows\System\ppqglWH.exe
  2⤵
  PID:7364
- C:\Windows\System\vxUCrxH.exe
  C:\Windows\System\vxUCrxH.exe
  2⤵
  PID:7348
- C:\Windows\System\lPXzcLr.exe
  C:\Windows\System\lPXzcLr.exe
  2⤵
  PID:7476
- C:\Windows\System\yviXDbM.exe
  C:\Windows\System\yviXDbM.exe
  2⤵
  PID:7504
- C:\Windows\System\KQnnBuk.exe
  C:\Windows\System\KQnnBuk.exe
  2⤵
  PID:7652
- C:\Windows\System\YVFwvas.exe
  C:\Windows\System\YVFwvas.exe
  2⤵
  PID:7620
- C:\Windows\System\atmRZLI.exe
  C:\Windows\System\atmRZLI.exe
  2⤵
  PID:7776
- C:\Windows\System\AtHlFTB.exe
  C:\Windows\System\AtHlFTB.exe
  2⤵
  PID:7868
- C:\Windows\System\MJDRGOz.exe
  C:\Windows\System\MJDRGOz.exe
  2⤵
  PID:7980
- C:\Windows\System\oiOATwJ.exe
  C:\Windows\System\oiOATwJ.exe
  2⤵
  PID:7828
- C:\Windows\System\yMhDExF.exe
  C:\Windows\System\yMhDExF.exe
  2⤵
  PID:7984
- C:\Windows\System\keuUaNc.exe
  C:\Windows\System\keuUaNc.exe
  2⤵
  PID:8072
- C:\Windows\System\PsiaodP.exe
  C:\Windows\System\PsiaodP.exe
  2⤵
  PID:8024
- C:\Windows\System\GvnBmpZ.exe
  C:\Windows\System\GvnBmpZ.exe
  2⤵
  PID:8128
- C:\Windows\System\pcdNXgc.exe
  C:\Windows\System\pcdNXgc.exe
  2⤵
  PID:8188
- C:\Windows\System\ZhcFmrI.exe
  C:\Windows\System\ZhcFmrI.exe
  2⤵
  PID:7300
- C:\Windows\System\WtvLHum.exe
  C:\Windows\System\WtvLHum.exe
  2⤵
  PID:7280
- C:\Windows\System\OGCcVfh.exe
  C:\Windows\System\OGCcVfh.exe
  2⤵
  PID:7492
- C:\Windows\System\wYcGLBu.exe
  C:\Windows\System\wYcGLBu.exe
  2⤵
  PID:7696
- C:\Windows\System\WLRaBAt.exe
  C:\Windows\System\WLRaBAt.exe
  2⤵
  PID:7780
- C:\Windows\System\JbFdJbC.exe
  C:\Windows\System\JbFdJbC.exe
  2⤵
  PID:7716
- C:\Windows\System\RpiaBRx.exe
  C:\Windows\System\RpiaBRx.exe
  2⤵
  PID:8056
- C:\Windows\System\gPXlhgI.exe
  C:\Windows\System\gPXlhgI.exe
  2⤵
  PID:8040
- C:\Windows\System\vgKPsOh.exe
  C:\Windows\System\vgKPsOh.exe
  2⤵
  PID:7264
- C:\Windows\System\IcJWSQe.exe
  C:\Windows\System\IcJWSQe.exe
  2⤵
  PID:7920
- C:\Windows\System\OAWXBCJ.exe
  C:\Windows\System\OAWXBCJ.exe
  2⤵
  PID:8204
- C:\Windows\System\snlPbpc.exe
  C:\Windows\System\snlPbpc.exe
  2⤵
  PID:8220
- C:\Windows\System\KDqDwsQ.exe
  C:\Windows\System\KDqDwsQ.exe
  2⤵
  PID:8236
- C:\Windows\System\YWeoXdn.exe
  C:\Windows\System\YWeoXdn.exe
  2⤵
  PID:8252
- C:\Windows\System\bfSarQn.exe
  C:\Windows\System\bfSarQn.exe
  2⤵
  PID:8268
- C:\Windows\System\fSzldhG.exe
  C:\Windows\System\fSzldhG.exe
  2⤵
  PID:8312
- C:\Windows\System\coNrvTM.exe
  C:\Windows\System\coNrvTM.exe
  2⤵
  PID:8328
- C:\Windows\System\mXdgzQC.exe
  C:\Windows\System\mXdgzQC.exe
  2⤵
  PID:8344
- C:\Windows\System\vCfLvdp.exe
  C:\Windows\System\vCfLvdp.exe
  2⤵
  PID:8360
- C:\Windows\System\jXZyLsh.exe
  C:\Windows\System\jXZyLsh.exe
  2⤵
  PID:8376
- C:\Windows\System\BcsAoWA.exe
  C:\Windows\System\BcsAoWA.exe
  2⤵
  PID:8392
- C:\Windows\System\sAUOvzM.exe
  C:\Windows\System\sAUOvzM.exe
  2⤵
  PID:8408
- C:\Windows\System\PsYtMDc.exe
  C:\Windows\System\PsYtMDc.exe
  2⤵
  PID:8424
- C:\Windows\System\MAuCvPt.exe
  C:\Windows\System\MAuCvPt.exe
  2⤵
  PID:8440
- C:\Windows\System\GEWptDS.exe
  C:\Windows\System\GEWptDS.exe
  2⤵
  PID:8456
- C:\Windows\System\IJnqpsC.exe
  C:\Windows\System\IJnqpsC.exe
  2⤵
  PID:8472
- C:\Windows\System\IBgRwSY.exe
  C:\Windows\System\IBgRwSY.exe
  2⤵
  PID:8488
- C:\Windows\System\IsAbpby.exe
  C:\Windows\System\IsAbpby.exe
  2⤵
  PID:8504
- C:\Windows\System\CcUbRPm.exe
  C:\Windows\System\CcUbRPm.exe
  2⤵
  PID:8520
- C:\Windows\System\FGmXjFI.exe
  C:\Windows\System\FGmXjFI.exe
  2⤵
  PID:8536
- C:\Windows\System\fkhLWTH.exe
  C:\Windows\System\fkhLWTH.exe
  2⤵
  PID:8552
- C:\Windows\System\zYsmksp.exe
  C:\Windows\System\zYsmksp.exe
  2⤵
  PID:8568
- C:\Windows\System\PYQeeaX.exe
  C:\Windows\System\PYQeeaX.exe
  2⤵
  PID:8584
- C:\Windows\System\QndvOXC.exe
  C:\Windows\System\QndvOXC.exe
  2⤵
  PID:8600
- C:\Windows\System\SXJiRjk.exe
  C:\Windows\System\SXJiRjk.exe
  2⤵
  PID:8620
- C:\Windows\System\AGTJlCN.exe
  C:\Windows\System\AGTJlCN.exe
  2⤵
  PID:8636
- C:\Windows\System\wkHqZDg.exe
  C:\Windows\System\wkHqZDg.exe
  2⤵
  PID:8652
- C:\Windows\System\yheYPih.exe
  C:\Windows\System\yheYPih.exe
  2⤵
  PID:8668
- C:\Windows\System\fvpeNlD.exe
  C:\Windows\System\fvpeNlD.exe
  2⤵
  PID:8684
- C:\Windows\System\dOpSOfO.exe
  C:\Windows\System\dOpSOfO.exe
  2⤵
  PID:8700
- C:\Windows\System\SFtWlBU.exe
  C:\Windows\System\SFtWlBU.exe
  2⤵
  PID:8716
- C:\Windows\System\ZuwgCTd.exe
  C:\Windows\System\ZuwgCTd.exe
  2⤵
  PID:8732
- C:\Windows\System\lHXykkA.exe
  C:\Windows\System\lHXykkA.exe
  2⤵
  PID:8748
- C:\Windows\System\eZeoZkF.exe
  C:\Windows\System\eZeoZkF.exe
  2⤵
  PID:8764
- C:\Windows\System\BlehzZm.exe
  C:\Windows\System\BlehzZm.exe
  2⤵
  PID:8780
- C:\Windows\System\QbLNTnA.exe
  C:\Windows\System\QbLNTnA.exe
  2⤵
  PID:8796
- C:\Windows\System\fvpGXvw.exe
  C:\Windows\System\fvpGXvw.exe
  2⤵
  PID:8812
- C:\Windows\System\UHZJvuE.exe
  C:\Windows\System\UHZJvuE.exe
  2⤵
  PID:8828
- C:\Windows\System\DSojMrp.exe
  C:\Windows\System\DSojMrp.exe
  2⤵
  PID:8844
- C:\Windows\System\ksBrWoq.exe
  C:\Windows\System\ksBrWoq.exe
  2⤵
  PID:8860
- C:\Windows\System\sdzjISv.exe
  C:\Windows\System\sdzjISv.exe
  2⤵
  PID:8876
- C:\Windows\System\vXpjwyY.exe
  C:\Windows\System\vXpjwyY.exe
  2⤵
  PID:8892
- C:\Windows\System\dgCCKrw.exe
  C:\Windows\System\dgCCKrw.exe
  2⤵
  PID:8908
- C:\Windows\System\RUYTBAV.exe
  C:\Windows\System\RUYTBAV.exe
  2⤵
  PID:8924
- C:\Windows\System\JogKgLp.exe
  C:\Windows\System\JogKgLp.exe
  2⤵
  PID:8940
- C:\Windows\System\AHIJcNN.exe
  C:\Windows\System\AHIJcNN.exe
  2⤵
  PID:8956
- C:\Windows\System\NxpUKda.exe
  C:\Windows\System\NxpUKda.exe
  2⤵
  PID:8972
- C:\Windows\System\UsLopTd.exe
  C:\Windows\System\UsLopTd.exe
  2⤵
  PID:8988
- C:\Windows\System\LmtXPgc.exe
  C:\Windows\System\LmtXPgc.exe
  2⤵
  PID:9004
- C:\Windows\System\kAQmNId.exe
  C:\Windows\System\kAQmNId.exe
  2⤵
  PID:9020
- C:\Windows\System\AJMqXmI.exe
  C:\Windows\System\AJMqXmI.exe
  2⤵
  PID:9036
- C:\Windows\System\pllSlPM.exe
  C:\Windows\System\pllSlPM.exe
  2⤵
  PID:9052
- C:\Windows\System\DATanBs.exe
  C:\Windows\System\DATanBs.exe
  2⤵
  PID:9068
- C:\Windows\System\VYxuHoK.exe
  C:\Windows\System\VYxuHoK.exe
  2⤵
  PID:9084
- C:\Windows\System\WYDWifB.exe
  C:\Windows\System\WYDWifB.exe
  2⤵
  PID:9100
- C:\Windows\System\JDGDhlh.exe
  C:\Windows\System\JDGDhlh.exe
  2⤵
  PID:9116
- C:\Windows\System\JgqhNxT.exe
  C:\Windows\System\JgqhNxT.exe
  2⤵
  PID:9132
- C:\Windows\System\cRAZCXY.exe
  C:\Windows\System\cRAZCXY.exe
  2⤵
  PID:9148
- C:\Windows\System\EqkpAAY.exe
  C:\Windows\System\EqkpAAY.exe
  2⤵
  PID:9164
- C:\Windows\System\uGAHlem.exe
  C:\Windows\System\uGAHlem.exe
  2⤵
  PID:9184
- C:\Windows\System\ORocqPt.exe
  C:\Windows\System\ORocqPt.exe
  2⤵
  PID:9200
- C:\Windows\System\ziHzkeJ.exe
  C:\Windows\System\ziHzkeJ.exe
  2⤵
  PID:7460
- C:\Windows\System\QFmFqeG.exe
  C:\Windows\System\QFmFqeG.exe
  2⤵
  PID:8228
- C:\Windows\System\kFclpar.exe
  C:\Windows\System\kFclpar.exe
  2⤵
  PID:8264
- C:\Windows\System\MvTAYoD.exe
  C:\Windows\System\MvTAYoD.exe
  2⤵
  PID:7508
- C:\Windows\System\RtvykJK.exe
  C:\Windows\System\RtvykJK.exe
  2⤵
  PID:7572
- C:\Windows\System\lOykIwW.exe
  C:\Windows\System\lOykIwW.exe
  2⤵
  PID:7760
- C:\Windows\System\IdBJaQK.exe
  C:\Windows\System\IdBJaQK.exe
  2⤵
  PID:7896
- C:\Windows\System\tXhgVBO.exe
  C:\Windows\System\tXhgVBO.exe
  2⤵
  PID:8288
- C:\Windows\System\MnnpPlx.exe
  C:\Windows\System\MnnpPlx.exe
  2⤵
  PID:8320
- C:\Windows\System\AaxFDIz.exe
  C:\Windows\System\AaxFDIz.exe
  2⤵
  PID:8356
- C:\Windows\System\LmBrUin.exe
  C:\Windows\System\LmBrUin.exe
  2⤵
  PID:8336
- C:\Windows\System\JcaCriu.exe
  C:\Windows\System\JcaCriu.exe
  2⤵
  PID:8452
- C:\Windows\System\XSJqbfQ.exe
  C:\Windows\System\XSJqbfQ.exe
  2⤵
  PID:8420
- C:\Windows\System\FrkENsg.exe
  C:\Windows\System\FrkENsg.exe
  2⤵
  PID:8544
- C:\Windows\System\GdbrMPJ.exe
  C:\Windows\System\GdbrMPJ.exe
  2⤵
  PID:8608
- C:\Windows\System\ponFOTZ.exe
  C:\Windows\System\ponFOTZ.exe
  2⤵
  PID:8644
- C:\Windows\System\sWjhtpo.exe
  C:\Windows\System\sWjhtpo.exe
  2⤵
  PID:8740
- C:\Windows\System\lDcnhUY.exe
  C:\Windows\System\lDcnhUY.exe
  2⤵
  PID:8804
- C:\Windows\System\BCrnqbY.exe
  C:\Windows\System\BCrnqbY.exe
  2⤵
  PID:8868
- C:\Windows\System\HlCSBfG.exe
  C:\Windows\System\HlCSBfG.exe
  2⤵
  PID:8936
- C:\Windows\System\niGAcdZ.exe
  C:\Windows\System\niGAcdZ.exe
  2⤵
  PID:8964
- C:\Windows\System\urAVGxo.exe
  C:\Windows\System\urAVGxo.exe
  2⤵
  PID:9000
- C:\Windows\System\liFrujq.exe
  C:\Windows\System\liFrujq.exe
  2⤵
  PID:8436
- C:\Windows\System\bJWxcjR.exe
  C:\Windows\System\bJWxcjR.exe
  2⤵
  PID:8500
- C:\Windows\System\bxygRqT.exe
  C:\Windows\System\bxygRqT.exe
  2⤵
  PID:8596
- C:\Windows\System\kXxoTvm.exe
  C:\Windows\System\kXxoTvm.exe
  2⤵
  PID:9060
- C:\Windows\System\OxxXoTH.exe
  C:\Windows\System\OxxXoTH.exe
  2⤵
  PID:8980
- C:\Windows\System\SsFyQsz.exe
  C:\Windows\System\SsFyQsz.exe
  2⤵
  PID:8920
- C:\Windows\System\nKYVgJO.exe
  C:\Windows\System\nKYVgJO.exe
  2⤵
  PID:9092
- C:\Windows\System\nQKieVz.exe
  C:\Windows\System\nQKieVz.exe
  2⤵
  PID:8852
- C:\Windows\System\oJUDgfg.exe
  C:\Windows\System\oJUDgfg.exe
  2⤵
  PID:8788
- C:\Windows\System\AdXyUOE.exe
  C:\Windows\System\AdXyUOE.exe
  2⤵
  PID:8724
- C:\Windows\System\WPKnMst.exe
  C:\Windows\System\WPKnMst.exe
  2⤵
  PID:9112
- C:\Windows\System\BkWCpdC.exe
  C:\Windows\System\BkWCpdC.exe
  2⤵
  PID:9076
- C:\Windows\System\VxaFrnn.exe
  C:\Windows\System\VxaFrnn.exe
  2⤵
  PID:9160
- C:\Windows\System\DLqElXF.exe
  C:\Windows\System\DLqElXF.exe
  2⤵
  PID:7200
- C:\Windows\System\pNLlMHD.exe
  C:\Windows\System\pNLlMHD.exe
  2⤵
  PID:8212
- C:\Windows\System\iIXeziS.exe
  C:\Windows\System\iIXeziS.exe
  2⤵
  PID:8280
- C:\Windows\System\WhDRpRQ.exe
  C:\Windows\System\WhDRpRQ.exe
  2⤵
  PID:8516
- C:\Windows\System\LmexBNm.exe
  C:\Windows\System\LmexBNm.exe
  2⤵
  PID:8772
- C:\Windows\System\FqHSRsq.exe
  C:\Windows\System\FqHSRsq.exe
  2⤵
  PID:9208
- C:\Windows\System\LcPncKP.exe
  C:\Windows\System\LcPncKP.exe
  2⤵
  PID:8660
- C:\Windows\System\svPtoDl.exe
  C:\Windows\System\svPtoDl.exe
  2⤵
  PID:7424
- C:\Windows\System\LuyBbiq.exe
  C:\Windows\System\LuyBbiq.exe
  2⤵
  PID:9128
- C:\Windows\System\qSaQAuh.exe
  C:\Windows\System\qSaQAuh.exe
  2⤵
  PID:7864
- C:\Windows\System\JsikwrU.exe
  C:\Windows\System\JsikwrU.exe
  2⤵
  PID:9212
- C:\Windows\System\ftdOAQg.exe
  C:\Windows\System\ftdOAQg.exe
  2⤵
  PID:8368
- C:\Windows\System\TFyUwev.exe
  C:\Windows\System\TFyUwev.exe
  2⤵
  PID:9028
- C:\Windows\System\fbaKdHG.exe
  C:\Windows\System\fbaKdHG.exe
  2⤵
  PID:8404
- C:\Windows\System\iPnaNqW.exe
  C:\Windows\System\iPnaNqW.exe
  2⤵
  PID:8836
- C:\Windows\System\uWufQZQ.exe
  C:\Windows\System\uWufQZQ.exe
  2⤵
  PID:8792
- C:\Windows\System\JjgJRrZ.exe
  C:\Windows\System\JjgJRrZ.exe
  2⤵
  PID:8984
- C:\Windows\System\YwGlGRg.exe
  C:\Windows\System\YwGlGRg.exe
  2⤵
  PID:8628
- C:\Windows\System\mHlocwg.exe
  C:\Windows\System\mHlocwg.exe
  2⤵
  PID:9196
- C:\Windows\System\XnYFjwj.exe
  C:\Windows\System\XnYFjwj.exe
  2⤵
  PID:9156
- C:\Windows\System\CURMcWI.exe
  C:\Windows\System\CURMcWI.exe
  2⤵
  PID:8680
- C:\Windows\System\kGdUEzH.exe
  C:\Windows\System\kGdUEzH.exe
  2⤵
  PID:8888
- C:\Windows\System\mDuJUdX.exe
  C:\Windows\System\mDuJUdX.exe
  2⤵
  PID:8904
- C:\Windows\System\WozjQmk.exe
  C:\Windows\System\WozjQmk.exe
  2⤵
  PID:7332
- C:\Windows\System\CXGwudP.exe
  C:\Windows\System\CXGwudP.exe
  2⤵
  PID:9180
- C:\Windows\System\FFflVHr.exe
  C:\Windows\System\FFflVHr.exe
  2⤵
  PID:8692
- C:\Windows\System\YXOfrFc.exe
  C:\Windows\System\YXOfrFc.exe
  2⤵
  PID:8484
- C:\Windows\System\TDMnmsk.exe
  C:\Windows\System\TDMnmsk.exe
  2⤵
  PID:9080
- C:\Windows\System\zERqKeu.exe
  C:\Windows\System\zERqKeu.exe
  2⤵
  PID:8200
- C:\Windows\System\eSpPFGt.exe
  C:\Windows\System\eSpPFGt.exe
  2⤵
  PID:8712
- C:\Windows\System\RKYFFOV.exe
  C:\Windows\System\RKYFFOV.exe
  2⤵
  PID:8216
- C:\Windows\System\VdtFIkV.exe
  C:\Windows\System\VdtFIkV.exe
  2⤵
  PID:9176
- C:\Windows\System\yjFbSBD.exe
  C:\Windows\System\yjFbSBD.exe
  2⤵
  PID:8884
- C:\Windows\System\FLjNRal.exe
  C:\Windows\System\FLjNRal.exe
  2⤵
  PID:8432
- C:\Windows\System\FFdJkBE.exe
  C:\Windows\System\FFdJkBE.exe
  2⤵
  PID:8532
- C:\Windows\System\MSFIKFG.exe
  C:\Windows\System\MSFIKFG.exe
  2⤵
  PID:9228
- C:\Windows\System\EmvzXzS.exe
  C:\Windows\System\EmvzXzS.exe
  2⤵
  PID:9244
- C:\Windows\System\AeovJbG.exe
  C:\Windows\System\AeovJbG.exe
  2⤵
  PID:9260
- C:\Windows\System\jNrpQUF.exe
  C:\Windows\System\jNrpQUF.exe
  2⤵
  PID:9276
- C:\Windows\System\WIYCBCV.exe
  C:\Windows\System\WIYCBCV.exe
  2⤵
  PID:9292
- C:\Windows\System\roKolhO.exe
  C:\Windows\System\roKolhO.exe
  2⤵
  PID:9308
- C:\Windows\System\hRLjPcb.exe
  C:\Windows\System\hRLjPcb.exe
  2⤵
  PID:9324
- C:\Windows\System\iIrhFMN.exe
  C:\Windows\System\iIrhFMN.exe
  2⤵
  PID:9340
- C:\Windows\System\MTHfbhA.exe
  C:\Windows\System\MTHfbhA.exe
  2⤵
  PID:9412
- C:\Windows\System\YnQhpdP.exe
  C:\Windows\System\YnQhpdP.exe
  2⤵
  PID:9428
- C:\Windows\System\JAGloLa.exe
  C:\Windows\System\JAGloLa.exe
  2⤵
  PID:9444
- C:\Windows\System\QrPQqwh.exe
  C:\Windows\System\QrPQqwh.exe
  2⤵
  PID:9464
- C:\Windows\System\juxtfcH.exe
  C:\Windows\System\juxtfcH.exe
  2⤵
  PID:9480
- C:\Windows\System\RPUgbUu.exe
  C:\Windows\System\RPUgbUu.exe
  2⤵
  PID:9500
- C:\Windows\System\nUftDEe.exe
  C:\Windows\System\nUftDEe.exe
  2⤵
  PID:9648
- C:\Windows\System\TAGDmHf.exe
  C:\Windows\System\TAGDmHf.exe
  2⤵
  PID:9692
- C:\Windows\System\sjIgXrq.exe
  C:\Windows\System\sjIgXrq.exe
  2⤵
  PID:9716
- C:\Windows\System\oZOnZFz.exe
  C:\Windows\System\oZOnZFz.exe
  2⤵
  PID:9740
- C:\Windows\System\aTAIXKv.exe
  C:\Windows\System\aTAIXKv.exe
  2⤵
  PID:9772
- C:\Windows\System\skiACfs.exe
  C:\Windows\System\skiACfs.exe
  2⤵
  PID:9788
- C:\Windows\System\iqwfjJF.exe
  C:\Windows\System\iqwfjJF.exe
  2⤵
  PID:9804
- C:\Windows\System\ZKxQoAJ.exe
  C:\Windows\System\ZKxQoAJ.exe
  2⤵
  PID:9824
- C:\Windows\System\vlYVixE.exe
  C:\Windows\System\vlYVixE.exe
  2⤵
  PID:9840
- C:\Windows\System\DXjPCIX.exe
  C:\Windows\System\DXjPCIX.exe
  2⤵
  PID:9856
- C:\Windows\System\siKQzzG.exe
  C:\Windows\System\siKQzzG.exe
  2⤵
  PID:9872
- C:\Windows\System\XaLWaIp.exe
  C:\Windows\System\XaLWaIp.exe
  2⤵
  PID:9888
- C:\Windows\System\KaDqMMG.exe
  C:\Windows\System\KaDqMMG.exe
  2⤵
  PID:9904
- C:\Windows\System\IIUFPRj.exe
  C:\Windows\System\IIUFPRj.exe
  2⤵
  PID:9920
- C:\Windows\System\LKejohh.exe
  C:\Windows\System\LKejohh.exe
  2⤵
  PID:9936
- C:\Windows\System\YAGoLug.exe
  C:\Windows\System\YAGoLug.exe
  2⤵
  PID:9952
- C:\Windows\System\JIvOTWb.exe
  C:\Windows\System\JIvOTWb.exe
  2⤵
  PID:9968
- C:\Windows\System\OOzvXjv.exe
  C:\Windows\System\OOzvXjv.exe
  2⤵
  PID:9984
- C:\Windows\System\PskXBOO.exe
  C:\Windows\System\PskXBOO.exe
  2⤵
  PID:10000
- C:\Windows\System\mpxwLIM.exe
  C:\Windows\System\mpxwLIM.exe
  2⤵
  PID:10140
- C:\Windows\System\FxWlZQT.exe
  C:\Windows\System\FxWlZQT.exe
  2⤵
  PID:10168
- C:\Windows\System\qAjcyUo.exe
  C:\Windows\System\qAjcyUo.exe
  2⤵
  PID:9220
- C:\Windows\System\ulLERIV.exe
  C:\Windows\System\ulLERIV.exe
  2⤵
  PID:9404
- C:\Windows\System\fsmazxP.exe
  C:\Windows\System\fsmazxP.exe
  2⤵
  PID:9496
- C:\Windows\System\GMmcHgu.exe
  C:\Windows\System\GMmcHgu.exe
  2⤵
  PID:9656
- C:\Windows\System\nbXPDVh.exe
  C:\Windows\System\nbXPDVh.exe
  2⤵
  PID:10220
- C:\Windows\System\kAYiIoO.exe
  C:\Windows\System\kAYiIoO.exe
  2⤵
  PID:9336
- C:\Windows\System\LGbOQfp.exe
  C:\Windows\System\LGbOQfp.exe
  2⤵
  PID:9456
- C:\Windows\System\NIQibkQ.exe
  C:\Windows\System\NIQibkQ.exe
  2⤵
  PID:9512
- C:\Windows\System\nlSBNuo.exe
  C:\Windows\System\nlSBNuo.exe
  2⤵
  PID:9528
- C:\Windows\System\xATzTBP.exe
  C:\Windows\System\xATzTBP.exe
  2⤵
  PID:9552
- C:\Windows\System\zNMosVh.exe
  C:\Windows\System\zNMosVh.exe
  2⤵
  PID:9572
- C:\Windows\System\xHOYfOZ.exe
  C:\Windows\System\xHOYfOZ.exe
  2⤵
  PID:9588
- C:\Windows\System\mwRKwvV.exe
  C:\Windows\System\mwRKwvV.exe
  2⤵
  PID:9608
- C:\Windows\System\ouzpPkx.exe
  C:\Windows\System\ouzpPkx.exe
  2⤵
  PID:9628
- C:\Windows\System\uzmWNQV.exe
  C:\Windows\System\uzmWNQV.exe
  2⤵
  PID:9644
- C:\Windows\System\PpWFrlu.exe
  C:\Windows\System\PpWFrlu.exe
  2⤵
  PID:9752
- C:\Windows\System\eAKqIvV.exe
  C:\Windows\System\eAKqIvV.exe
  2⤵
  PID:9676
- C:\Windows\System\oVDHtEU.exe
  C:\Windows\System\oVDHtEU.exe
  2⤵
  PID:9700
- C:\Windows\System\kAjxtlm.exe
  C:\Windows\System\kAjxtlm.exe
  2⤵
  PID:9732
- C:\Windows\System\wTMpfXf.exe
  C:\Windows\System\wTMpfXf.exe
  2⤵
  PID:9724
- C:\Windows\System\tYGOlbI.exe
  C:\Windows\System\tYGOlbI.exe
  2⤵
  PID:9800
- C:\Windows\System\oAtxaih.exe
  C:\Windows\System\oAtxaih.exe
  2⤵
  PID:10236
- C:\Windows\System\XGggOqb.exe
  C:\Windows\System\XGggOqb.exe
  2⤵
  PID:9408
- C:\Windows\System\YrqFwyH.exe
  C:\Windows\System\YrqFwyH.exe
  2⤵
  PID:9848
- C:\Windows\System\WNWrJFb.exe
  C:\Windows\System\WNWrJFb.exe
  2⤵
  PID:10204
- C:\Windows\System\vcdMzcX.exe
  C:\Windows\System\vcdMzcX.exe
  2⤵
  PID:10196
- C:\Windows\System\LlTgQZd.exe
  C:\Windows\System\LlTgQZd.exe
  2⤵
  PID:9900
- C:\Windows\System\iQSoGod.exe
  C:\Windows\System\iQSoGod.exe
  2⤵
  PID:10016
- C:\Windows\System\YPCyzsv.exe
  C:\Windows\System\YPCyzsv.exe
  2⤵
  PID:9568
- C:\Windows\System\PfeVNKu.exe
  C:\Windows\System\PfeVNKu.exe
  2⤵
  PID:1564
- C:\Windows\System\JgzWhqP.exe
  C:\Windows\System\JgzWhqP.exe
  2⤵
  PID:10076
- C:\Windows\System\TbFEeVG.exe
  C:\Windows\System\TbFEeVG.exe
  2⤵
  PID:10104
- C:\Windows\System\KlFsLgR.exe
  C:\Windows\System\KlFsLgR.exe
  2⤵
  PID:10124
- C:\Windows\System\bFmtGHH.exe
  C:\Windows\System\bFmtGHH.exe
  2⤵
  PID:10152
- C:\Windows\System\gpGYoYd.exe
  C:\Windows\System\gpGYoYd.exe
  2⤵
  PID:9272
- C:\Windows\System\lywgCuT.exe
  C:\Windows\System\lywgCuT.exe
  2⤵
  PID:10208
- C:\Windows\System\pAgStga.exe
  C:\Windows\System\pAgStga.exe
  2⤵
  PID:10052
- C:\Windows\System\tJgAgWd.exe
  C:\Windows\System\tJgAgWd.exe
  2⤵
  PID:9820
- C:\Windows\System\pJkFDbK.exe
  C:\Windows\System\pJkFDbK.exe
  2⤵
  PID:9780
- C:\Windows\System\dohwxPq.exe
  C:\Windows\System\dohwxPq.exe
  2⤵
  PID:9420
- C:\Windows\System\bwmaNMM.exe
  C:\Windows\System\bwmaNMM.exe
  2⤵
  PID:9996
- C:\Windows\System\XoViMib.exe
  C:\Windows\System\XoViMib.exe
  2⤵
  PID:10092
- C:\Windows\System\TBCJMrB.exe
  C:\Windows\System\TBCJMrB.exe
  2⤵
  PID:8300
- C:\Windows\System\CALeRsa.exe
  C:\Windows\System\CALeRsa.exe
  2⤵
  PID:9440
- C:\Windows\System\NRLtKnu.exe
  C:\Windows\System\NRLtKnu.exe
  2⤵
  PID:9596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AjzTDXp.exe

Filesize
2.3MB

MD5
f9d95e04041169aa8ce2e00a4f5fff34

SHA1
5789df3a2f911a0f7b0a2b2cadf1c209eab9dfda

SHA256
ac1178587ff7b57713e833f3fae0235583f968bbaa8a4b5f9e8aaecbb96fa05e

SHA512
644d2fcc5760ed5e5001ea6236cca2765046d15a0a91d1616cc159a605571533a8706dbfdb17dde575c37d27274dd479a464b12385228afc623d3653889676e1

Download Submit
C:\Windows\system\BEfBJri.exe

Filesize
2.3MB

MD5
357804302906c56a105f2d4b13482f66

SHA1
c0ac34d5254206adc5a6b95f01af8e6c6dd0b79c

SHA256
b647b415e24540da1ce7e982d579c65a0363dd7efc872fe094068a64e25016d9

SHA512
4f64a3d14d00ffafb9f8edfa28b1932945ab771a05abb07babbfe858e4771de16adc7dffa488ee9ff2389f170ca364202cc7806b917ed405765324b232eac2e4

Download Submit
C:\Windows\system\EynTaOT.exe

Filesize
2.3MB

MD5
7496bb340ceb9959b238585be68cdb60

SHA1
15c657353952c85bd8135b1ba62571331a201cff

SHA256
c92b5359ba070450a5a7a9eb85d1d65e9773833f74c11709dce0a1afe56a77c1

SHA512
5da64991c968068d932485a4e212042fa1e112b6f309ca68799c64a71975f626ad97648839792a5f011e5c42138af570e14354e9a1f92499e078c020129b2960

Download Submit
C:\Windows\system\GyWRzBf.exe

Filesize
2.3MB

MD5
4c7601c8c1bd0d398e8150bb51f4cf76

SHA1
15c2175abe64ea313aab7a32e5560a54fd12ea89

SHA256
bba0357f0fa2abe42bd6ca7a5b3790460e91284d493c0c1378c66a2df8ddffd6

SHA512
ec850f6da6b047b449e2e7268209e84f89669b5385cd18c32a893288e332307be7186e652110e36aadd66f941d384e7877468803554b67cf08c79df42d9b9118

Download Submit
C:\Windows\system\HTKFcYt.exe

Filesize
2.3MB

MD5
282b36c0310a380863c386d4a35f7495

SHA1
dcbc7b67aea1491983bf240165358f3f174a64e1

SHA256
9b6c2b7ecfbe1ba722fae8053c9867188ac084d0b0184af03ab17e672946dde5

SHA512
de0f8f673b37f62a95038ea549fb235b3a05bd72e66e0ba0b410b05388819de2db94cdc5d46943cff328d20ca866faaaeb560e5de25ed1f4c81d7f3a01333078

Download Submit
C:\Windows\system\HuYCVrK.exe

Filesize
2.3MB

MD5
da4df3d82afe24b11b1d528105f3177b

SHA1
50bd3e5d4d32b857524cfdf606bf1f2728914e6a

SHA256
2ae32ecc210a7dd5c5989a431cebec13bd2541311983dca0c84f6a1f2692596c

SHA512
32aa777b6f8be9858185b56fc375cdd7511749f536c89c35e9be61a8636248b5c92134741c1aab46d99036ffc00fb92bb91c289af55458033cb91f52be67081f

Download Submit
C:\Windows\system\NUrgEvm.exe

Filesize
2.3MB

MD5
6399a22ae156eab18ba7a2a2da08cca3

SHA1
3082f8e9bb5889663d195e10c299f520dc762ede

SHA256
5926ff19b7b5e89a8567b36d69d38fe7e2a5eed0cb80ca75f4de8b7b4b0f2929

SHA512
0b314b1d03f2d40b1b2ba7a83f675c89a29fe25f53ff4b96b091a4794f954e22715777da45d16c8c8ff4a462957ec030b9a4c30ab1ddaa088703549da7288453

Download Submit
C:\Windows\system\OKSYfQg.exe

Filesize
2.3MB

MD5
2704f34302a4962c03652e731840f293

SHA1
2705cfe798dd43e0da569b3ade72d09bc70563b3

SHA256
8dd31b83d67af3016998825e54ced3040705ff81ac823ab785a79b36dca291c6

SHA512
79c13b08177005e1354906f2e334ab034ebdf7b5321f4789cfd5f008778af5e951a2bac698747c7d4e4e8457815cb7c59cf5cb848409a6216a3820b2158942db

Download Submit
C:\Windows\system\OaqhZhl.exe

Filesize
2.3MB

MD5
663f9bef78d44b5f5f82974095e2a900

SHA1
3ea32b99baafc2d02639be060e6d99a9c9f7579d

SHA256
247ad2b633efba1eab6c06ae600ea4e90e529d13a6e2d8da0d111efbaa113dfb

SHA512
650d38460788b0634b3679fcab6035ef1497802e246bbbe1af43795e9fe676bc781905d79f2e450a595003e893b826f39d2263b4b365d2175466540fa4647a82

Download Submit
C:\Windows\system\OxrfDTF.exe

Filesize
2.3MB

MD5
ba7eb6f2b08c6ed8bf1e6880689aa9e9

SHA1
937fb63c412ed7fccc355cf8541c4ebe45790b26

SHA256
246ad2486172b00984b88d9b54833edebbc50bbf3ae6bf63686799bc0ee21f6d

SHA512
4c1e791dde6d1e9d8263b8db7da7afec701d8863ba6a7227cae68049236d13b0b8b077373bd674e5ae154d19b20e85ec1af9c833df52c7f10cc091a4b4dfd4f2

Download Submit
C:\Windows\system\TKElCaa.exe

Filesize
2.3MB

MD5
100ce62a0d4eefceee5c3c8de2d57057

SHA1
59c1ae13f2d483ddfd5bd52335b2785f28354d09

SHA256
cc2ff40fee8ed5aec46bcafda2e8b5a1e4654b6ab122d8eea7728d6f5489ccef

SHA512
ccbac2b5aa49ea6211ff07c7d034879b86bedb11871a75e1eb171c132c06a5568e4264a282d7d5d47c94c3cd0d2e76ebd59803cf58413e642579ce8b092e4a5c

Download Submit
C:\Windows\system\URRkKBV.exe

Filesize
2.3MB

MD5
14d50f4ba42074637022c34f47541900

SHA1
ef8746adc10d99b6714287fea24e6ee2a3e86ecf

SHA256
b037cbdf8979c0f0b75937692054354d3e480710cf65294c08f027ba776e738c

SHA512
a98ce378611351ec7a8c7cbca31e2b10ca445fd69574246647437c5baf9fa3d3dfa88d420b15d71b121041821887f8007c2718663ad230ba0a8041c956aa291d

Download Submit
C:\Windows\system\WIBugDM.exe

Filesize
2.3MB

MD5
6a7dd49edc60f3c28493326fbbef237b

SHA1
8a79ac325fb8b8557233ccc4b51039e7c84cbcb2

SHA256
b4485adb07d83b45b5b383995ec467db15fee16dd931f8aa8a6ea1e90de5d303

SHA512
6a0052afd40ea759879ca829700aaa42fc6f275e2b7dd41f1f511d716c4ff61a270e7880432350c13435691e152e73c5f2eef17f0c14d4750318529e6f0de1ee

Download Submit
C:\Windows\system\ZfPCXMP.exe

Filesize
2.3MB

MD5
e27818877ee1945b5194472ef4a4f688

SHA1
205172f9fd5b8f36a465850132291e1e23e26175

SHA256
2d01998f4f37b30bfdef6f3b1b19779adeff5636274a9dbda68563936afd2298

SHA512
fbbcb2365c2a64a30a3865a7cc8326e57064706790c496599dd328eb4138a6d12419ab9f72834610bbbd61eb547884d0fce7b9336c97f846112ed0e73d15813f

Download Submit
C:\Windows\system\adsGTdd.exe

Filesize
2.3MB

MD5
e18ae74cff491597e6bbe5a7608a5f14

SHA1
dcea0894afa9ac00e25d05b8ae68f76c73d8e548

SHA256
bfb5be5f1b831c9f6094de3d8be007fbf40804e2ca80bc5a6b53dd5bad0b9ae6

SHA512
a837441f329c7d8e43435d2d5ac96689dbf777161453e63467b383ca901badce0df38ffda7c6979a82f3af9fc61ecc3e3eecb2f8a498820836bce484887f3ab2

Download Submit
C:\Windows\system\alDYycv.exe

Filesize
2.3MB

MD5
65dcde52889f86a31e85e45a1cfad4b1

SHA1
3a3148796aac7807a395f74ddd39aaf178256ab3

SHA256
33d7b9b0943ee6fd0c8d251b5d50a2387de4c9c8fd28df155cf3e0a6357ab9f6

SHA512
f0481d97b821ef1942ea8e1142bf2aece00d36afb7a4d202b9d0eebd62462862944e282036243e5c4c273109ff846b75d92d01124b957a3f973da952e0d9a043

Download Submit
C:\Windows\system\cQywYEC.exe

Filesize
2.3MB

MD5
134ba5a7fd76fb0842e611a14b4b2ff0

SHA1
f37465f1140a5dabb794c6f2e25e10620a6c4937

SHA256
0ce5d679f422a4be79decace894eea207fab0691626f091cc2e8ed4a1a4c6699

SHA512
05c95bdf8cd20e01b82db935f0fc7fccb9cde8bf32f1ba3277c39f55d4f19a1b4661ec60ab69435a8cf703103dfd2e9908b05a5d7efa0b539926970ceb0d42a3

Download Submit
C:\Windows\system\gdhHdHm.exe

Filesize
2.3MB

MD5
fe8d3704e3db8ae064e44536e0c72c0e

SHA1
902dfbb9018e81dae08c34cc063493800f5e8971

SHA256
9f1d001881647aaf9e8d754a2b507ee703aedd45db0ac525d699ca5575dd740e

SHA512
5d44cc4b264f18278719f6370ac2f786f2c625a58d5a24bb8f2f32a262fe5312ca7bc244c8adba8b4ad46e9dbff0c0b677620b210008292ba021887bb274d3c2

Download Submit
C:\Windows\system\hVyMzBZ.exe

Filesize
2.3MB

MD5
94a599db9bce43d62c4e07136b5a968f

SHA1
2ac0f0b1d824fc75a6650b9016b890ef2497d80b

SHA256
c18f1418c3103665f2f7c07c5a870649c713e5c733513b07708fab183d215636

SHA512
122e8ab3db6bffd7cb6d44da6888513fff1dc10f7457b480685ff4e4027dbfc0dd97d23953db226981260a2e4af00be2a7def3f875a4080b20de10c3ecd728db

Download Submit
C:\Windows\system\hsjjJsc.exe

Filesize
2.3MB

MD5
e22da32d7a79d6a86b8a36e4a977400f

SHA1
5486464034abd79cb484d85722a765b9ca077bc4

SHA256
860f5ec9ad4c4942503b37c48b118685b3e6e1f343431dcee693f6c675a6efab

SHA512
90323b8e54fdbdbcd06bf2f7ddd48f705b97f4a98402b58bf86c45efd711d0b0b04efaf00a7a2a5be649030f693b134986f4846bfbc14eb5056b72ccf1b29f35

Download Submit
C:\Windows\system\jBoFaKu.exe

Filesize
2.3MB

MD5
42001bfe3da4e0279575d895b8c7325a

SHA1
68fb463c50ec74a88abea503515b35342da01377

SHA256
62e461600114a4cb58b323961c13f6d2c0d5992c737b9a1e087f9067285b8f9f

SHA512
a2d3d25abc7d276e9bc58c36c5beaf3b8052f98e86c92e266c4af4867583ad30f410a4f2f6df332b8af8490dfd84a47065144118096d4e6fbe1ccc28889242d6

Download Submit
C:\Windows\system\oqSWcEp.exe

Filesize
2.3MB

MD5
ea5cc14f3923869c711e9632db98a0f2

SHA1
dfc2131a6915c8b93c576b6ef73868d957005e61

SHA256
0f29bfa89a67007f7a7c5ed31f9bb1b33bf2a0f09593a74528b0407167fe32ca

SHA512
dead09a492e35822c5850094da64fc522f3277c67628b4b763c109532c8e7f435f02296eb63250154648f33d6123af15afc0a1f399fae7a1b68a0e993234d2bc

Download Submit
C:\Windows\system\oxsHfbQ.exe

Filesize
2.3MB

MD5
5d21e5606a3314ebd638b6273692692e

SHA1
fe359afbffb84e9e5fdb9cab29b1643bb6cf2f94

SHA256
9ce86237ed63a323636c559a31ac9b87749dfad5f67b23ff662c581ca83b2803

SHA512
9e6d99659879684b70ae70441918a3a219bd4d1d296f42b3df25599b99d5ea284a741faca6106e69ca03c6caf229bd912ab5e3b82ce3a1556c1b7c1c12b3e90c

Download Submit
C:\Windows\system\qEuzqwP.exe

Filesize
2.3MB

MD5
a6817b32c67eb524b1ac5a49b78badc8

SHA1
595c08efc86893c6a02f0725dd74b08d5787c8aa

SHA256
d146f4e3e7b7504698a32c7639561c6b504af581e35ee623bb81dadeb924c69c

SHA512
de238844213ad4664fcaf887b654f0164279d3889d5a18adfaffab258ee864022c90a7a5b404af48faf0af2acada46423d43428a9385239034abfe874ccf2c30

Download Submit
C:\Windows\system\rRMpTZZ.exe

Filesize
2.3MB

MD5
ec1362f5f075d2c6eab368ca03fa16ba

SHA1
23e60be5328b3553e3febff0e765c7460a75fcfd

SHA256
c139da170eb2686d160bba3ec85752458cc7ffc458d205f3fe9878381dbfb4c7

SHA512
f74817108ef96d7b66801d68ab8747cf0debc2d72010dd62b2a16992fe82a45b39d6dcddbfa3100954288921b12e2bd7396e768b3bf6f37b682dea8976b5e3cd

Download Submit
C:\Windows\system\rWFVzZa.exe

Filesize
2.3MB

MD5
a5592e7ec9986eaada7bfc9defde934a

SHA1
86955edaf6f65b7025a91d0c4d7892a4ddad59b5

SHA256
9d6ab357d2de8bcef7ac3bbb8a0a74342dea43d09b18c73c0048cd3b22794efe

SHA512
0ce496dbcb99cc914ac6885f66f0ad3f1543a0038e34e3d8bdc738df722c4d931a2079045979a199778e1c41fbc5500ff5996c7ac59d023566ee1c196c951ecf

Download Submit
C:\Windows\system\sGAVNay.exe

Filesize
2.3MB

MD5
f7d15fb4f276cc10fcf5e9d35c1fe383

SHA1
a83c3dd79d126eb9231274a791ad7024fc2c12e9

SHA256
5752dec03f9f718c99af944272b27541f40dd6efde0c6b5fc0d98f048c75e5d4

SHA512
c6aeeaac2dbfb21ada754aa3e18813c37ca85a02a678ce013f38fbca0671fa6291e80f0b9e38fedb37f6aa8912939ee48561f7f24dbc4f454dd59d25865ebe7e

Download Submit
C:\Windows\system\tBVNSBq.exe

Filesize
2.3MB

MD5
88cc45e47989017db32a48ed9149b43e

SHA1
db94e5cc9c43d8f5b4edf14d0bd869762fb96b3d

SHA256
9c15cdecd91bd20a4978b1e3540b1e9045b3bc56aa7682bb3dfdb5f760f97d59

SHA512
d04e2f4c1045efa0692e419507dc00d861dc12282936cc92ccd89f105b8fa2f26022f1f07c14d3ced51ef183b4f953b89c9082c51ccee0c45abfc85eef5a7557

Download Submit
C:\Windows\system\tGDDdrz.exe

Filesize
2.3MB

MD5
37c6e2002cde6643ddecd7e30fd2455a

SHA1
11e3d4947d1b65723de6a2b0ff75ad1e87c6e174

SHA256
ce0deadfb5a1ef45a3a608e1e305a6bf7cf45950d6cda0fceca32e3405faf72c

SHA512
7ce0a285ccb3922e95ecf0b20fce5c8c0b9d83635a5f9b392a4b1cd2ef707d248f6c8276630ef3225e832b73671c2752f37abbc5344669b1b1fde9ddf28085ae

Download Submit
C:\Windows\system\wLOArRt.exe

Filesize
2.3MB

MD5
3d5e86d29df5d3def91a2f35e03809f7

SHA1
d7d75bf7d36074cdeb97159f5749fad94545aff1

SHA256
04678edae7423b6459353a634e91436ba76e9469c2dc2ed484b7710c40442604

SHA512
997388d6f787d65eca1f0af4ecd4eeb226ddb6bab7f430b34a81b61fd14236391aad391dba1a4a194dead44846bfb9746a9fa78648646b489a414bedf2827369

Download Submit
C:\Windows\system\zUsBGTV.exe

Filesize
2.3MB

MD5
1d8e5a9d61e72c80dabdc4cb175ee881

SHA1
5438fe08458a34d95d52daa482896bfb08cc7303

SHA256
89374f5ddfa262fdafa99314d7c737ca0e89d49742c6b16b7c695a9c3f52593d

SHA512
ed4486ac647b31398b23e687bb151a266d7ed293d8342e2e908091b90d764ea2e06501beab5967ffabf5bc6f4e17fc855b438853fb082f2d19b2745b516f61a8

Download Submit
\Windows\system\UflXsAP.exe

Filesize
2.3MB

MD5
36d8a3c2887c2374d42a4378fad187dd

SHA1
9fa7d42d6b9c9261efabfd68ec85ddc86b5288ef

SHA256
13d52defb5c007a50af1ac068661ccec6e600e3c7118a2dc0e3bb040d922574a

SHA512
0e2fad071ddcb9b3c326c45a937b0a9e1316b59e96ca55d007bf02b63108332bc07f45d80df9ab766e1010bb5e30e88ec81fb0eaf16e0ab1f18b9d81223646a2

Download Submit
memory/360-4033-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/360-555-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/1728-501-0x000000013F440000-0x000000013F794000-memory.dmp

Filesize
3.3MB

Download
memory/1728-4029-0x000000013F440000-0x000000013F794000-memory.dmp

Filesize
3.3MB

Download
memory/1996-547-0x000000013F500000-0x000000013F854000-memory.dmp

Filesize
3.3MB

Download
memory/1996-4034-0x000000013F500000-0x000000013F854000-memory.dmp

Filesize
3.3MB

Download
memory/2288-549-0x000000013F0C0000-0x000000013F414000-memory.dmp

Filesize
3.3MB

Download
memory/2288-4040-0x000000013F0C0000-0x000000013F414000-memory.dmp

Filesize
3.3MB

Download
memory/2404-4028-0x000000013F5F0000-0x000000013F944000-memory.dmp

Filesize
3.3MB

Download
memory/2404-490-0x000000013F5F0000-0x000000013F944000-memory.dmp

Filesize
3.3MB

Download
memory/2460-557-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2460-4041-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2464-4035-0x000000013F160000-0x000000013F4B4000-memory.dmp

Filesize
3.3MB

Download
memory/2464-551-0x000000013F160000-0x000000013F4B4000-memory.dmp

Filesize
3.3MB

Download
memory/2536-520-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2536-4038-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2556-537-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/2556-4030-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/2604-4036-0x000000013FDB0000-0x0000000140104000-memory.dmp

Filesize
3.3MB

Download
memory/2604-543-0x000000013FDB0000-0x0000000140104000-memory.dmp

Filesize
3.3MB

Download
memory/2616-553-0x000000013F630000-0x000000013F984000-memory.dmp

Filesize
3.3MB

Download
memory/2616-4039-0x000000013F630000-0x000000013F984000-memory.dmp

Filesize
3.3MB

Download
memory/2636-4037-0x000000013FB90000-0x000000013FEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2636-539-0x000000013FB90000-0x000000013FEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-545-0x000000013FD90000-0x00000001400E4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-4032-0x000000013FD90000-0x00000001400E4000-memory.dmp

Filesize
3.3MB

Download
memory/2712-4031-0x000000013FAD0000-0x000000013FE24000-memory.dmp

Filesize
3.3MB

Download
memory/2712-541-0x000000013FAD0000-0x000000013FE24000-memory.dmp

Filesize
3.3MB

Download
memory/2752-548-0x000000013F0C0000-0x000000013F414000-memory.dmp

Filesize
3.3MB

Download
memory/2752-0-0x000000013F930000-0x000000013FC84000-memory.dmp

Filesize
3.3MB

Download
memory/2752-542-0x000000013FDB0000-0x0000000140104000-memory.dmp

Filesize
3.3MB

Download
memory/2752-3802-0x000000013F930000-0x000000013FC84000-memory.dmp

Filesize
3.3MB

Download
memory/2752-546-0x000000013F500000-0x000000013F854000-memory.dmp

Filesize
3.3MB

Download
memory/2752-475-0x0000000002080000-0x00000000023D4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-552-0x0000000002080000-0x00000000023D4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-540-0x0000000002080000-0x00000000023D4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-538-0x0000000002080000-0x00000000023D4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-544-0x000000013FD90000-0x00000001400E4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-554-0x0000000002080000-0x00000000023D4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-556-0x0000000002080000-0x00000000023D4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-558-0x0000000002080000-0x00000000023D4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-536-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/2752-559-0x000000013F440000-0x000000013F794000-memory.dmp

Filesize
3.3MB

Download
memory/2752-510-0x0000000002080000-0x00000000023D4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-550-0x000000013F160000-0x000000013F4B4000-memory.dmp

Filesize
3.3MB

Download
memory/2752-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download