xmrig | 4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
Size

2.3MB
MD5

d9ded2a4155e10280c5387278e71faa0
SHA1

71e4c123e0d26c3f864da3e3a2ac53aed58be5eb
SHA256

4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28
SHA512

18b21511ecaaee1150aa210180c21b6b63099d675855c94ccbb3f4281752f7e76f4618e593decbad6a6cd44b0bc7e4a84765bb75d6d7402da37ec7da34d50633
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQFxxXgA5Bc+QvdL5Gqa4g:BemTLkNdfE0pZrQR

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 63 IoCs

miner

resource	yara_rule
behavioral1/memory/2888-0-0x000000013FB20000-0x000000013FE74000-memory.dmp	xmrig
behavioral1/files/0x00090000000149f5-3.dat	xmrig
behavioral1/memory/2768-8-0x000000013F7C0000-0x000000013FB14000-memory.dmp	xmrig
behavioral1/files/0x0009000000015018-9.dat	xmrig
behavioral1/files/0x00080000000155f7-13.dat	xmrig
behavioral1/files/0x000a000000015616-20.dat	xmrig
behavioral1/files/0x0007000000015605-17.dat	xmrig
behavioral1/memory/2792-36-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/memory/1720-35-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/memory/2996-33-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/memory/3012-23-0x000000013F8B0000-0x000000013FC04000-memory.dmp	xmrig
behavioral1/files/0x0009000000015626-37.dat	xmrig
behavioral1/files/0x0008000000015c3d-49.dat	xmrig
behavioral1/files/0x0006000000015c83-68.dat	xmrig
behavioral1/files/0x0006000000015cfe-98.dat	xmrig
behavioral1/files/0x0006000000015d0f-108.dat	xmrig
behavioral1/files/0x0006000000015d27-118.dat	xmrig
behavioral1/files/0x0006000000015d31-123.dat	xmrig
behavioral1/files/0x0006000000015f01-137.dat	xmrig
behavioral1/files/0x0006000000015df1-134.dat	xmrig
behavioral1/files/0x0006000000016287-164.dat	xmrig
behavioral1/memory/3000-503-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/memory/2836-571-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/2924-569-0x000000013F4A0000-0x000000013F7F4000-memory.dmp	xmrig
behavioral1/memory/2396-567-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig
behavioral1/memory/2648-557-0x000000013F050000-0x000000013F3A4000-memory.dmp	xmrig
behavioral1/memory/2516-565-0x000000013F900000-0x000000013FC54000-memory.dmp	xmrig
behavioral1/memory/2748-514-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/memory/2576-511-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/memory/2508-507-0x000000013F440000-0x000000013F794000-memory.dmp	xmrig
behavioral1/files/0x0006000000016448-168.dat	xmrig
behavioral1/files/0x00080000000155ed-159.dat	xmrig
behavioral1/files/0x0006000000016176-155.dat	xmrig
behavioral1/files/0x0006000000015f7a-141.dat	xmrig
behavioral1/files/0x00060000000160af-146.dat	xmrig
behavioral1/files/0x0006000000015d98-128.dat	xmrig
behavioral1/files/0x0006000000015d1a-113.dat	xmrig
behavioral1/files/0x0006000000015d07-103.dat	xmrig
behavioral1/files/0x0006000000015cf6-93.dat	xmrig
behavioral1/files/0x0006000000015cce-83.dat	xmrig
behavioral1/files/0x0006000000015cee-88.dat	xmrig
behavioral1/files/0x0006000000015c9f-73.dat	xmrig
behavioral1/files/0x0006000000015cb6-78.dat	xmrig
behavioral1/files/0x0007000000015c78-63.dat	xmrig
behavioral1/files/0x0008000000015c52-54.dat	xmrig
behavioral1/files/0x0007000000015c6b-59.dat	xmrig
behavioral1/files/0x0009000000015b6f-44.dat	xmrig
behavioral1/memory/3012-2391-0x000000013F8B0000-0x000000013FC04000-memory.dmp	xmrig
behavioral1/memory/2768-2614-0x000000013F7C0000-0x000000013FB14000-memory.dmp	xmrig
behavioral1/memory/2768-4024-0x000000013F7C0000-0x000000013FB14000-memory.dmp	xmrig
behavioral1/memory/3012-4025-0x000000013F8B0000-0x000000013FC04000-memory.dmp	xmrig
behavioral1/memory/2996-4026-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/memory/1720-4027-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/memory/2792-4028-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/memory/2508-4029-0x000000013F440000-0x000000013F794000-memory.dmp	xmrig
behavioral1/memory/2836-4030-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/2576-4031-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/memory/2648-4033-0x000000013F050000-0x000000013F3A4000-memory.dmp	xmrig
behavioral1/memory/2748-4032-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/memory/2516-4034-0x000000013F900000-0x000000013FC54000-memory.dmp	xmrig
behavioral1/memory/2924-4036-0x000000013F4A0000-0x000000013F7F4000-memory.dmp	xmrig
behavioral1/memory/2396-4035-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig
behavioral1/memory/3000-4037-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2768	foqNBEY.exe
3012	SmlKLtZ.exe
2996	xMELIoW.exe
1720	QxWFNAX.exe
2792	uhskDsr.exe
2836	rfAFjqI.exe
3000	UYrWxQf.exe
2508	cfohGNt.exe
2576	gwHvomF.exe
2748	UYZCSKm.exe
2648	dpMppRe.exe
2516	YzncYCD.exe
2396	SfbsoPQ.exe
2924	jCHnvCI.exe
2072	QSubvTN.exe
2344	vDEMAAh.exe
2808	WIJQdEM.exe
1676	rTOFjZt.exe
760	EcnThGr.exe
936	QiXneYs.exe
1980	nHWBFoz.exe
940	rLBYZjK.exe
2564	IRcjBMt.exe
2760	CxtKPnu.exe
2892	WgRcNKc.exe
1256	iwZosNa.exe
2292	xyvIqWX.exe
1968	hYUTYNX.exe
484	XXQXPHN.exe
1204	IZiNfoH.exe
1656	CYGUFGl.exe
572	FLWxRXK.exe
348	sNAaTJI.exe
1280	PYDcjdT.exe
1160	rvYIpUO.exe
1196	jCcHHEi.exe
2440	tojhuWV.exe
496	VOUUKVO.exe
3052	VTyXNmx.exe
2668	WZyLKpa.exe
1804	ARZmMpc.exe
844	ngaiXft.exe
1164	XcgOvjs.exe
1924	bPSKduo.exe
1604	CGHKzEP.exe
1664	oCmdmhc.exe
1048	nXgkKKA.exe
3064	ZoowQHe.exe
1840	TteLmpR.exe
2400	wSVpBUx.exe
2840	NoytVHC.exe
2340	EoTpSCR.exe
1180	hsGcfbP.exe
2316	coQsrPg.exe
872	KFHAxyE.exe
2312	cpXtaXJ.exe
1836	GsZhLzz.exe
1620	LzZHiqB.exe
1728	dRbjUfC.exe
2380	rdkQNjw.exe
2568	fMtHVzD.exe
2708	OeSjLvJ.exe
2624	JzrWIyR.exe
2592	iCncmLd.exe

Loads dropped DLL 64 IoCs

pid	Process
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2888-0-0x000000013FB20000-0x000000013FE74000-memory.dmp	upx
behavioral1/files/0x00090000000149f5-3.dat	upx
behavioral1/memory/2768-8-0x000000013F7C0000-0x000000013FB14000-memory.dmp	upx
behavioral1/files/0x0009000000015018-9.dat	upx
behavioral1/files/0x00080000000155f7-13.dat	upx
behavioral1/files/0x000a000000015616-20.dat	upx
behavioral1/files/0x0007000000015605-17.dat	upx
behavioral1/memory/2792-36-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/memory/1720-35-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/memory/2996-33-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/memory/3012-23-0x000000013F8B0000-0x000000013FC04000-memory.dmp	upx
behavioral1/files/0x0009000000015626-37.dat	upx
behavioral1/files/0x0008000000015c3d-49.dat	upx
behavioral1/files/0x0006000000015c83-68.dat	upx
behavioral1/files/0x0006000000015cfe-98.dat	upx
behavioral1/files/0x0006000000015d0f-108.dat	upx
behavioral1/files/0x0006000000015d27-118.dat	upx
behavioral1/files/0x0006000000015d31-123.dat	upx
behavioral1/files/0x0006000000015f01-137.dat	upx
behavioral1/files/0x0006000000015df1-134.dat	upx
behavioral1/files/0x0006000000016287-164.dat	upx
behavioral1/memory/3000-503-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/memory/2836-571-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/2924-569-0x000000013F4A0000-0x000000013F7F4000-memory.dmp	upx
behavioral1/memory/2396-567-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx
behavioral1/memory/2648-557-0x000000013F050000-0x000000013F3A4000-memory.dmp	upx
behavioral1/memory/2516-565-0x000000013F900000-0x000000013FC54000-memory.dmp	upx
behavioral1/memory/2748-514-0x000000013F800000-0x000000013FB54000-memory.dmp	upx
behavioral1/memory/2576-511-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/memory/2508-507-0x000000013F440000-0x000000013F794000-memory.dmp	upx
behavioral1/files/0x0006000000016448-168.dat	upx
behavioral1/files/0x00080000000155ed-159.dat	upx
behavioral1/files/0x0006000000016176-155.dat	upx
behavioral1/files/0x0006000000015f7a-141.dat	upx
behavioral1/files/0x00060000000160af-146.dat	upx
behavioral1/files/0x0006000000015d98-128.dat	upx
behavioral1/files/0x0006000000015d1a-113.dat	upx
behavioral1/files/0x0006000000015d07-103.dat	upx
behavioral1/files/0x0006000000015cf6-93.dat	upx
behavioral1/files/0x0006000000015cce-83.dat	upx
behavioral1/files/0x0006000000015cee-88.dat	upx
behavioral1/files/0x0006000000015c9f-73.dat	upx
behavioral1/files/0x0006000000015cb6-78.dat	upx
behavioral1/files/0x0007000000015c78-63.dat	upx
behavioral1/files/0x0008000000015c52-54.dat	upx
behavioral1/files/0x0007000000015c6b-59.dat	upx
behavioral1/files/0x0009000000015b6f-44.dat	upx
behavioral1/memory/3012-2391-0x000000013F8B0000-0x000000013FC04000-memory.dmp	upx
behavioral1/memory/2768-2614-0x000000013F7C0000-0x000000013FB14000-memory.dmp	upx
behavioral1/memory/2768-4024-0x000000013F7C0000-0x000000013FB14000-memory.dmp	upx
behavioral1/memory/3012-4025-0x000000013F8B0000-0x000000013FC04000-memory.dmp	upx
behavioral1/memory/2996-4026-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/memory/1720-4027-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/memory/2792-4028-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/memory/2508-4029-0x000000013F440000-0x000000013F794000-memory.dmp	upx
behavioral1/memory/2836-4030-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/2576-4031-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/memory/2648-4033-0x000000013F050000-0x000000013F3A4000-memory.dmp	upx
behavioral1/memory/2748-4032-0x000000013F800000-0x000000013FB54000-memory.dmp	upx
behavioral1/memory/2516-4034-0x000000013F900000-0x000000013FC54000-memory.dmp	upx
behavioral1/memory/2924-4036-0x000000013F4A0000-0x000000013F7F4000-memory.dmp	upx
behavioral1/memory/2396-4035-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx
behavioral1/memory/3000-4037-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FUueizH.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\jomapav.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\ttUidWj.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\IfdyCNO.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\gOxhQCm.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\GfOfBgw.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\NUliqat.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\ZjUeUtG.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\EHcqqQA.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\bPSKduo.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\UkRfRlX.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\YzKPgRs.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\yLTzAIZ.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\hjqJheX.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\wfFjQqK.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\zhblGWB.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\SfbsoPQ.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\gurSiJI.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\XPIkNbt.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\dHeBySo.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\ZFfiNob.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\wvPTJpI.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\KMRxwPG.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\oLKAwUF.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\qcAtLWo.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\XzOihFc.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\KPjlsDa.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\zYBkpmu.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\nPdKozd.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\sWCMTZu.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\zJpgxUy.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\QfnPowQ.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\SZdOEYO.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\DNgweqm.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\SeQkjEj.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\QVjCCqg.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\QezAWeF.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\htOkUdc.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\TteLmpR.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\AsENCRP.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\IOHtVTF.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\uNvXTLB.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\PyBkEQW.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\CrQYtyO.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\LxoEQGC.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\XafLWgX.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\qoeLDJE.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\BMBquyT.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\EjfGFGc.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\EoyNvBY.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\XEtyRvl.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\fnSewxX.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\kdUtAjF.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\BkfKAoQ.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\GmbsrRA.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\hIwRatA.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\ZSdVMUS.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\QOKYGGH.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\IACAHbL.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\HwqyqNa.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\QaFLWWX.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\KxCZIrE.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\IsUIQMK.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
File created	C:\Windows\System\yeFDdtZ.exe	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2768	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2768	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2768	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 3012	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	30
PID 2888 wrote to memory of 3012	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	30
PID 2888 wrote to memory of 3012	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	30
PID 2888 wrote to memory of 1720	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	31
PID 2888 wrote to memory of 1720	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	31
PID 2888 wrote to memory of 1720	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	31
PID 2888 wrote to memory of 2996	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	32
PID 2888 wrote to memory of 2996	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	32
PID 2888 wrote to memory of 2996	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	32
PID 2888 wrote to memory of 2792	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	33
PID 2888 wrote to memory of 2792	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	33
PID 2888 wrote to memory of 2792	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	33
PID 2888 wrote to memory of 2836	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	34
PID 2888 wrote to memory of 2836	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	34
PID 2888 wrote to memory of 2836	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	34
PID 2888 wrote to memory of 3000	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	35
PID 2888 wrote to memory of 3000	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	35
PID 2888 wrote to memory of 3000	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	35
PID 2888 wrote to memory of 2508	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	36
PID 2888 wrote to memory of 2508	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	36
PID 2888 wrote to memory of 2508	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	36
PID 2888 wrote to memory of 2576	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	37
PID 2888 wrote to memory of 2576	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	37
PID 2888 wrote to memory of 2576	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	37
PID 2888 wrote to memory of 2748	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	38
PID 2888 wrote to memory of 2748	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	38
PID 2888 wrote to memory of 2748	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	38
PID 2888 wrote to memory of 2648	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	39
PID 2888 wrote to memory of 2648	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	39
PID 2888 wrote to memory of 2648	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	39
PID 2888 wrote to memory of 2516	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	40
PID 2888 wrote to memory of 2516	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	40
PID 2888 wrote to memory of 2516	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	40
PID 2888 wrote to memory of 2396	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	41
PID 2888 wrote to memory of 2396	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	41
PID 2888 wrote to memory of 2396	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	41
PID 2888 wrote to memory of 2924	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	42
PID 2888 wrote to memory of 2924	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	42
PID 2888 wrote to memory of 2924	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	42
PID 2888 wrote to memory of 2072	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	43
PID 2888 wrote to memory of 2072	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	43
PID 2888 wrote to memory of 2072	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	43
PID 2888 wrote to memory of 2344	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	44
PID 2888 wrote to memory of 2344	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	44
PID 2888 wrote to memory of 2344	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	44
PID 2888 wrote to memory of 2808	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	45
PID 2888 wrote to memory of 2808	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	45
PID 2888 wrote to memory of 2808	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	45
PID 2888 wrote to memory of 1676	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	46
PID 2888 wrote to memory of 1676	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	46
PID 2888 wrote to memory of 1676	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	46
PID 2888 wrote to memory of 760	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	47
PID 2888 wrote to memory of 760	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	47
PID 2888 wrote to memory of 760	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	47
PID 2888 wrote to memory of 936	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	48
PID 2888 wrote to memory of 936	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	48
PID 2888 wrote to memory of 936	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	48
PID 2888 wrote to memory of 1980	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	49
PID 2888 wrote to memory of 1980	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	49
PID 2888 wrote to memory of 1980	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	49
PID 2888 wrote to memory of 940	2888	4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4d3bd3a306ca64c8e044056d3b4043a36be5d1c9588a2220d919b72bd96bbd28_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System\foqNBEY.exe
  C:\Windows\System\foqNBEY.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\SmlKLtZ.exe
  C:\Windows\System\SmlKLtZ.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\QxWFNAX.exe
  C:\Windows\System\QxWFNAX.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\xMELIoW.exe
  C:\Windows\System\xMELIoW.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\uhskDsr.exe
  C:\Windows\System\uhskDsr.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\rfAFjqI.exe
  C:\Windows\System\rfAFjqI.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\UYrWxQf.exe
  C:\Windows\System\UYrWxQf.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\cfohGNt.exe
  C:\Windows\System\cfohGNt.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\gwHvomF.exe
  C:\Windows\System\gwHvomF.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\UYZCSKm.exe
  C:\Windows\System\UYZCSKm.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\dpMppRe.exe
  C:\Windows\System\dpMppRe.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\YzncYCD.exe
  C:\Windows\System\YzncYCD.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\SfbsoPQ.exe
  C:\Windows\System\SfbsoPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\jCHnvCI.exe
  C:\Windows\System\jCHnvCI.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\QSubvTN.exe
  C:\Windows\System\QSubvTN.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\vDEMAAh.exe
  C:\Windows\System\vDEMAAh.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\WIJQdEM.exe
  C:\Windows\System\WIJQdEM.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\rTOFjZt.exe
  C:\Windows\System\rTOFjZt.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\EcnThGr.exe
  C:\Windows\System\EcnThGr.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\QiXneYs.exe
  C:\Windows\System\QiXneYs.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\nHWBFoz.exe
  C:\Windows\System\nHWBFoz.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\rLBYZjK.exe
  C:\Windows\System\rLBYZjK.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\IRcjBMt.exe
  C:\Windows\System\IRcjBMt.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\CxtKPnu.exe
  C:\Windows\System\CxtKPnu.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\WgRcNKc.exe
  C:\Windows\System\WgRcNKc.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\iwZosNa.exe
  C:\Windows\System\iwZosNa.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\hYUTYNX.exe
  C:\Windows\System\hYUTYNX.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\xyvIqWX.exe
  C:\Windows\System\xyvIqWX.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\XXQXPHN.exe
  C:\Windows\System\XXQXPHN.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\IZiNfoH.exe
  C:\Windows\System\IZiNfoH.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\CYGUFGl.exe
  C:\Windows\System\CYGUFGl.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\FLWxRXK.exe
  C:\Windows\System\FLWxRXK.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\sNAaTJI.exe
  C:\Windows\System\sNAaTJI.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\PYDcjdT.exe
  C:\Windows\System\PYDcjdT.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\rvYIpUO.exe
  C:\Windows\System\rvYIpUO.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\jCcHHEi.exe
  C:\Windows\System\jCcHHEi.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\tojhuWV.exe
  C:\Windows\System\tojhuWV.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\VOUUKVO.exe
  C:\Windows\System\VOUUKVO.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\VTyXNmx.exe
  C:\Windows\System\VTyXNmx.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\WZyLKpa.exe
  C:\Windows\System\WZyLKpa.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ARZmMpc.exe
  C:\Windows\System\ARZmMpc.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\ngaiXft.exe
  C:\Windows\System\ngaiXft.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\XcgOvjs.exe
  C:\Windows\System\XcgOvjs.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\bPSKduo.exe
  C:\Windows\System\bPSKduo.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\CGHKzEP.exe
  C:\Windows\System\CGHKzEP.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\oCmdmhc.exe
  C:\Windows\System\oCmdmhc.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\nXgkKKA.exe
  C:\Windows\System\nXgkKKA.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\ZoowQHe.exe
  C:\Windows\System\ZoowQHe.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\TteLmpR.exe
  C:\Windows\System\TteLmpR.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\wSVpBUx.exe
  C:\Windows\System\wSVpBUx.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\NoytVHC.exe
  C:\Windows\System\NoytVHC.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\EoTpSCR.exe
  C:\Windows\System\EoTpSCR.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\hsGcfbP.exe
  C:\Windows\System\hsGcfbP.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\coQsrPg.exe
  C:\Windows\System\coQsrPg.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\KFHAxyE.exe
  C:\Windows\System\KFHAxyE.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\cpXtaXJ.exe
  C:\Windows\System\cpXtaXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\GsZhLzz.exe
  C:\Windows\System\GsZhLzz.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\LzZHiqB.exe
  C:\Windows\System\LzZHiqB.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\dRbjUfC.exe
  C:\Windows\System\dRbjUfC.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\rdkQNjw.exe
  C:\Windows\System\rdkQNjw.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\fMtHVzD.exe
  C:\Windows\System\fMtHVzD.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\OeSjLvJ.exe
  C:\Windows\System\OeSjLvJ.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\JzrWIyR.exe
  C:\Windows\System\JzrWIyR.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\iCncmLd.exe
  C:\Windows\System\iCncmLd.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\SlhGKMr.exe
  C:\Windows\System\SlhGKMr.exe
  2⤵
  PID:2520
- C:\Windows\System\xtMuZBf.exe
  C:\Windows\System\xtMuZBf.exe
  2⤵
  PID:2528
- C:\Windows\System\vIXkMoO.exe
  C:\Windows\System\vIXkMoO.exe
  2⤵
  PID:2488
- C:\Windows\System\PPbbODw.exe
  C:\Windows\System\PPbbODw.exe
  2⤵
  PID:2920
- C:\Windows\System\foYhSgI.exe
  C:\Windows\System\foYhSgI.exe
  2⤵
  PID:2044
- C:\Windows\System\wfjKlHH.exe
  C:\Windows\System\wfjKlHH.exe
  2⤵
  PID:1068
- C:\Windows\System\mvxfIaJ.exe
  C:\Windows\System\mvxfIaJ.exe
  2⤵
  PID:2536
- C:\Windows\System\KxFqHTv.exe
  C:\Windows\System\KxFqHTv.exe
  2⤵
  PID:1168
- C:\Windows\System\YagapRP.exe
  C:\Windows\System\YagapRP.exe
  2⤵
  PID:2544
- C:\Windows\System\gVvYTwm.exe
  C:\Windows\System\gVvYTwm.exe
  2⤵
  PID:1436
- C:\Windows\System\QhIfrwS.exe
  C:\Windows\System\QhIfrwS.exe
  2⤵
  PID:2896
- C:\Windows\System\nQgjOsT.exe
  C:\Windows\System\nQgjOsT.exe
  2⤵
  PID:2244
- C:\Windows\System\eZtiOxg.exe
  C:\Windows\System\eZtiOxg.exe
  2⤵
  PID:784
- C:\Windows\System\wGXozdg.exe
  C:\Windows\System\wGXozdg.exe
  2⤵
  PID:700
- C:\Windows\System\GgszwSo.exe
  C:\Windows\System\GgszwSo.exe
  2⤵
  PID:1228
- C:\Windows\System\bQxZbmF.exe
  C:\Windows\System\bQxZbmF.exe
  2⤵
  PID:2368
- C:\Windows\System\XyZfjwi.exe
  C:\Windows\System\XyZfjwi.exe
  2⤵
  PID:3060
- C:\Windows\System\cOUXoex.exe
  C:\Windows\System\cOUXoex.exe
  2⤵
  PID:1124
- C:\Windows\System\TpWuWNL.exe
  C:\Windows\System\TpWuWNL.exe
  2⤵
  PID:3044
- C:\Windows\System\zWNSwwv.exe
  C:\Windows\System\zWNSwwv.exe
  2⤵
  PID:2092
- C:\Windows\System\kdUtAjF.exe
  C:\Windows\System\kdUtAjF.exe
  2⤵
  PID:1976
- C:\Windows\System\OqlmIxb.exe
  C:\Windows\System\OqlmIxb.exe
  2⤵
  PID:752
- C:\Windows\System\PVgtGDP.exe
  C:\Windows\System\PVgtGDP.exe
  2⤵
  PID:1904
- C:\Windows\System\aQgpgCW.exe
  C:\Windows\System\aQgpgCW.exe
  2⤵
  PID:900
- C:\Windows\System\GvlUQWD.exe
  C:\Windows\System\GvlUQWD.exe
  2⤵
  PID:952
- C:\Windows\System\EDINyYM.exe
  C:\Windows\System\EDINyYM.exe
  2⤵
  PID:308
- C:\Windows\System\LBdkQpS.exe
  C:\Windows\System\LBdkQpS.exe
  2⤵
  PID:1648
- C:\Windows\System\fLWpOFE.exe
  C:\Windows\System\fLWpOFE.exe
  2⤵
  PID:1008
- C:\Windows\System\xKNOUps.exe
  C:\Windows\System\xKNOUps.exe
  2⤵
  PID:884
- C:\Windows\System\tiMYudF.exe
  C:\Windows\System\tiMYudF.exe
  2⤵
  PID:2192
- C:\Windows\System\alhBgxM.exe
  C:\Windows\System\alhBgxM.exe
  2⤵
  PID:2968
- C:\Windows\System\uDevGtr.exe
  C:\Windows\System\uDevGtr.exe
  2⤵
  PID:2384
- C:\Windows\System\eMLHBfE.exe
  C:\Windows\System\eMLHBfE.exe
  2⤵
  PID:2696
- C:\Windows\System\QlPdKhw.exe
  C:\Windows\System\QlPdKhw.exe
  2⤵
  PID:2604
- C:\Windows\System\MZCwuYM.exe
  C:\Windows\System\MZCwuYM.exe
  2⤵
  PID:2540
- C:\Windows\System\piXbaAw.exe
  C:\Windows\System\piXbaAw.exe
  2⤵
  PID:2672
- C:\Windows\System\sDeUlIe.exe
  C:\Windows\System\sDeUlIe.exe
  2⤵
  PID:2532
- C:\Windows\System\RHzEwVF.exe
  C:\Windows\System\RHzEwVF.exe
  2⤵
  PID:2352
- C:\Windows\System\JliWWJG.exe
  C:\Windows\System\JliWWJG.exe
  2⤵
  PID:2448
- C:\Windows\System\VWEMVyX.exe
  C:\Windows\System\VWEMVyX.exe
  2⤵
  PID:816
- C:\Windows\System\uPMSfpG.exe
  C:\Windows\System\uPMSfpG.exe
  2⤵
  PID:1692
- C:\Windows\System\VWorcKs.exe
  C:\Windows\System\VWorcKs.exe
  2⤵
  PID:536
- C:\Windows\System\VcHflks.exe
  C:\Windows\System\VcHflks.exe
  2⤵
  PID:2456
- C:\Windows\System\HblfWQH.exe
  C:\Windows\System\HblfWQH.exe
  2⤵
  PID:1012
- C:\Windows\System\CTlqrBd.exe
  C:\Windows\System\CTlqrBd.exe
  2⤵
  PID:1496
- C:\Windows\System\yFIUapA.exe
  C:\Windows\System\yFIUapA.exe
  2⤵
  PID:832
- C:\Windows\System\AqmnsEp.exe
  C:\Windows\System\AqmnsEp.exe
  2⤵
  PID:1456
- C:\Windows\System\TRxsmbm.exe
  C:\Windows\System\TRxsmbm.exe
  2⤵
  PID:1888
- C:\Windows\System\krzFFII.exe
  C:\Windows\System\krzFFII.exe
  2⤵
  PID:1144
- C:\Windows\System\qjQPcNg.exe
  C:\Windows\System\qjQPcNg.exe
  2⤵
  PID:2172
- C:\Windows\System\QoaBoxL.exe
  C:\Windows\System\QoaBoxL.exe
  2⤵
  PID:1700
- C:\Windows\System\aZVEkct.exe
  C:\Windows\System\aZVEkct.exe
  2⤵
  PID:1768
- C:\Windows\System\NXHoJIR.exe
  C:\Windows\System\NXHoJIR.exe
  2⤵
  PID:2064
- C:\Windows\System\XxwVewT.exe
  C:\Windows\System\XxwVewT.exe
  2⤵
  PID:3024
- C:\Windows\System\igxstRW.exe
  C:\Windows\System\igxstRW.exe
  2⤵
  PID:2332
- C:\Windows\System\UaowJgX.exe
  C:\Windows\System\UaowJgX.exe
  2⤵
  PID:2164
- C:\Windows\System\PDLnoYt.exe
  C:\Windows\System\PDLnoYt.exe
  2⤵
  PID:2680
- C:\Windows\System\oCoWoSj.exe
  C:\Windows\System\oCoWoSj.exe
  2⤵
  PID:2388
- C:\Windows\System\iqeynZd.exe
  C:\Windows\System\iqeynZd.exe
  2⤵
  PID:1376
- C:\Windows\System\jWRXRDI.exe
  C:\Windows\System\jWRXRDI.exe
  2⤵
  PID:2452
- C:\Windows\System\dpLQQlD.exe
  C:\Windows\System\dpLQQlD.exe
  2⤵
  PID:1756
- C:\Windows\System\cSCcxcJ.exe
  C:\Windows\System\cSCcxcJ.exe
  2⤵
  PID:2160
- C:\Windows\System\VKLLLnh.exe
  C:\Windows\System\VKLLLnh.exe
  2⤵
  PID:1516
- C:\Windows\System\tuipDum.exe
  C:\Windows\System\tuipDum.exe
  2⤵
  PID:2264
- C:\Windows\System\EmVPkyc.exe
  C:\Windows\System\EmVPkyc.exe
  2⤵
  PID:1156
- C:\Windows\System\mRJgqIy.exe
  C:\Windows\System\mRJgqIy.exe
  2⤵
  PID:2076
- C:\Windows\System\sVPRrfm.exe
  C:\Windows\System\sVPRrfm.exe
  2⤵
  PID:2360
- C:\Windows\System\gdfTSRb.exe
  C:\Windows\System\gdfTSRb.exe
  2⤵
  PID:1992
- C:\Windows\System\NEFCVew.exe
  C:\Windows\System\NEFCVew.exe
  2⤵
  PID:2736
- C:\Windows\System\faWKfWr.exe
  C:\Windows\System\faWKfWr.exe
  2⤵
  PID:1644
- C:\Windows\System\sNzbYlp.exe
  C:\Windows\System\sNzbYlp.exe
  2⤵
  PID:2596
- C:\Windows\System\SUrlgrJ.exe
  C:\Windows\System\SUrlgrJ.exe
  2⤵
  PID:2420
- C:\Windows\System\fLhkHhI.exe
  C:\Windows\System\fLhkHhI.exe
  2⤵
  PID:2020
- C:\Windows\System\dEAYkQZ.exe
  C:\Windows\System\dEAYkQZ.exe
  2⤵
  PID:1324
- C:\Windows\System\dpDWteZ.exe
  C:\Windows\System\dpDWteZ.exe
  2⤵
  PID:1672
- C:\Windows\System\ZQFqBzJ.exe
  C:\Windows\System\ZQFqBzJ.exe
  2⤵
  PID:2140
- C:\Windows\System\zogOTVs.exe
  C:\Windows\System\zogOTVs.exe
  2⤵
  PID:1296
- C:\Windows\System\MsnApqv.exe
  C:\Windows\System\MsnApqv.exe
  2⤵
  PID:1988
- C:\Windows\System\HZzeKWu.exe
  C:\Windows\System\HZzeKWu.exe
  2⤵
  PID:3092
- C:\Windows\System\VVEpYvp.exe
  C:\Windows\System\VVEpYvp.exe
  2⤵
  PID:3112
- C:\Windows\System\QOKYGGH.exe
  C:\Windows\System\QOKYGGH.exe
  2⤵
  PID:3188
- C:\Windows\System\GZpihFO.exe
  C:\Windows\System\GZpihFO.exe
  2⤵
  PID:3204
- C:\Windows\System\vwzamrD.exe
  C:\Windows\System\vwzamrD.exe
  2⤵
  PID:3224
- C:\Windows\System\NRjZPhE.exe
  C:\Windows\System\NRjZPhE.exe
  2⤵
  PID:3240
- C:\Windows\System\LIYAdWX.exe
  C:\Windows\System\LIYAdWX.exe
  2⤵
  PID:3256
- C:\Windows\System\kNhzHcv.exe
  C:\Windows\System\kNhzHcv.exe
  2⤵
  PID:3272
- C:\Windows\System\QQILQTk.exe
  C:\Windows\System\QQILQTk.exe
  2⤵
  PID:3288
- C:\Windows\System\bzGQgjS.exe
  C:\Windows\System\bzGQgjS.exe
  2⤵
  PID:3304
- C:\Windows\System\lQUoMzI.exe
  C:\Windows\System\lQUoMzI.exe
  2⤵
  PID:3320
- C:\Windows\System\jXVrwuG.exe
  C:\Windows\System\jXVrwuG.exe
  2⤵
  PID:3336
- C:\Windows\System\uTMuulR.exe
  C:\Windows\System\uTMuulR.exe
  2⤵
  PID:3352
- C:\Windows\System\dbBKIxj.exe
  C:\Windows\System\dbBKIxj.exe
  2⤵
  PID:3368
- C:\Windows\System\XBckZqe.exe
  C:\Windows\System\XBckZqe.exe
  2⤵
  PID:3384
- C:\Windows\System\QVjCCqg.exe
  C:\Windows\System\QVjCCqg.exe
  2⤵
  PID:3400
- C:\Windows\System\KiUZnQl.exe
  C:\Windows\System\KiUZnQl.exe
  2⤵
  PID:3416
- C:\Windows\System\kfgvSaZ.exe
  C:\Windows\System\kfgvSaZ.exe
  2⤵
  PID:3432
- C:\Windows\System\UWubfnq.exe
  C:\Windows\System\UWubfnq.exe
  2⤵
  PID:3448
- C:\Windows\System\xjBsdjN.exe
  C:\Windows\System\xjBsdjN.exe
  2⤵
  PID:3464
- C:\Windows\System\FkqyqqF.exe
  C:\Windows\System\FkqyqqF.exe
  2⤵
  PID:3480
- C:\Windows\System\ytSDaNA.exe
  C:\Windows\System\ytSDaNA.exe
  2⤵
  PID:3496
- C:\Windows\System\JDytvrv.exe
  C:\Windows\System\JDytvrv.exe
  2⤵
  PID:3512
- C:\Windows\System\ELqQLCD.exe
  C:\Windows\System\ELqQLCD.exe
  2⤵
  PID:3532
- C:\Windows\System\oLKAwUF.exe
  C:\Windows\System\oLKAwUF.exe
  2⤵
  PID:3548
- C:\Windows\System\ZjbfvKz.exe
  C:\Windows\System\ZjbfvKz.exe
  2⤵
  PID:3568
- C:\Windows\System\rjEWgBq.exe
  C:\Windows\System\rjEWgBq.exe
  2⤵
  PID:3664
- C:\Windows\System\dlPqAXQ.exe
  C:\Windows\System\dlPqAXQ.exe
  2⤵
  PID:3772
- C:\Windows\System\EdwZiar.exe
  C:\Windows\System\EdwZiar.exe
  2⤵
  PID:3792
- C:\Windows\System\XyQfMop.exe
  C:\Windows\System\XyQfMop.exe
  2⤵
  PID:3812
- C:\Windows\System\AEmWFgQ.exe
  C:\Windows\System\AEmWFgQ.exe
  2⤵
  PID:3832
- C:\Windows\System\sbTmSqO.exe
  C:\Windows\System\sbTmSqO.exe
  2⤵
  PID:3852
- C:\Windows\System\EYBLPSr.exe
  C:\Windows\System\EYBLPSr.exe
  2⤵
  PID:3872
- C:\Windows\System\LeLXnRb.exe
  C:\Windows\System\LeLXnRb.exe
  2⤵
  PID:3888
- C:\Windows\System\oRHKdke.exe
  C:\Windows\System\oRHKdke.exe
  2⤵
  PID:3908
- C:\Windows\System\MpuAaTL.exe
  C:\Windows\System\MpuAaTL.exe
  2⤵
  PID:3924
- C:\Windows\System\JxwCGSZ.exe
  C:\Windows\System\JxwCGSZ.exe
  2⤵
  PID:3944
- C:\Windows\System\QqHLoHb.exe
  C:\Windows\System\QqHLoHb.exe
  2⤵
  PID:3968
- C:\Windows\System\umCdagD.exe
  C:\Windows\System\umCdagD.exe
  2⤵
  PID:3988
- C:\Windows\System\Rdsrjpg.exe
  C:\Windows\System\Rdsrjpg.exe
  2⤵
  PID:4008
- C:\Windows\System\pHYExSi.exe
  C:\Windows\System\pHYExSi.exe
  2⤵
  PID:4032
- C:\Windows\System\WobJGNS.exe
  C:\Windows\System\WobJGNS.exe
  2⤵
  PID:4048
- C:\Windows\System\ockFLZB.exe
  C:\Windows\System\ockFLZB.exe
  2⤵
  PID:4072
- C:\Windows\System\miYPZxe.exe
  C:\Windows\System\miYPZxe.exe
  2⤵
  PID:4092
- C:\Windows\System\DAALBpA.exe
  C:\Windows\System\DAALBpA.exe
  2⤵
  PID:592
- C:\Windows\System\ileptcS.exe
  C:\Windows\System\ileptcS.exe
  2⤵
  PID:2200
- C:\Windows\System\gurSiJI.exe
  C:\Windows\System\gurSiJI.exe
  2⤵
  PID:612
- C:\Windows\System\tVSofKo.exe
  C:\Windows\System\tVSofKo.exe
  2⤵
  PID:1544
- C:\Windows\System\gEWHnhL.exe
  C:\Windows\System\gEWHnhL.exe
  2⤵
  PID:1572
- C:\Windows\System\RHfUzQE.exe
  C:\Windows\System\RHfUzQE.exe
  2⤵
  PID:3108
- C:\Windows\System\SJkATfX.exe
  C:\Windows\System\SJkATfX.exe
  2⤵
  PID:3124
- C:\Windows\System\MxEQCNV.exe
  C:\Windows\System\MxEQCNV.exe
  2⤵
  PID:3164
- C:\Windows\System\myYDJlC.exe
  C:\Windows\System\myYDJlC.exe
  2⤵
  PID:3216
- C:\Windows\System\pBePTRU.exe
  C:\Windows\System\pBePTRU.exe
  2⤵
  PID:3284
- C:\Windows\System\gkteXvi.exe
  C:\Windows\System\gkteXvi.exe
  2⤵
  PID:3376
- C:\Windows\System\azBOihJ.exe
  C:\Windows\System\azBOihJ.exe
  2⤵
  PID:3444
- C:\Windows\System\MuxTNgT.exe
  C:\Windows\System\MuxTNgT.exe
  2⤵
  PID:3540
- C:\Windows\System\qcAtLWo.exe
  C:\Windows\System\qcAtLWo.exe
  2⤵
  PID:3492
- C:\Windows\System\pfTmSSf.exe
  C:\Windows\System\pfTmSSf.exe
  2⤵
  PID:3392
- C:\Windows\System\bTjtwGh.exe
  C:\Windows\System\bTjtwGh.exe
  2⤵
  PID:3200
- C:\Windows\System\HzPcWqO.exe
  C:\Windows\System\HzPcWqO.exe
  2⤵
  PID:3300
- C:\Windows\System\OCWgyTG.exe
  C:\Windows\System\OCWgyTG.exe
  2⤵
  PID:3640
- C:\Windows\System\hUKbqkI.exe
  C:\Windows\System\hUKbqkI.exe
  2⤵
  PID:3684
- C:\Windows\System\jBkgMWY.exe
  C:\Windows\System\jBkgMWY.exe
  2⤵
  PID:3704
- C:\Windows\System\CgZhqKe.exe
  C:\Windows\System\CgZhqKe.exe
  2⤵
  PID:3724
- C:\Windows\System\PDGuNbq.exe
  C:\Windows\System\PDGuNbq.exe
  2⤵
  PID:3744
- C:\Windows\System\QVaOeIy.exe
  C:\Windows\System\QVaOeIy.exe
  2⤵
  PID:3780
- C:\Windows\System\RGkEUHv.exe
  C:\Windows\System\RGkEUHv.exe
  2⤵
  PID:3764
- C:\Windows\System\AbegGTX.exe
  C:\Windows\System\AbegGTX.exe
  2⤵
  PID:3864
- C:\Windows\System\zTuHLPL.exe
  C:\Windows\System\zTuHLPL.exe
  2⤵
  PID:3808
- C:\Windows\System\XQzcOqd.exe
  C:\Windows\System\XQzcOqd.exe
  2⤵
  PID:2800
- C:\Windows\System\uKZYoHB.exe
  C:\Windows\System\uKZYoHB.exe
  2⤵
  PID:3884
- C:\Windows\System\wlkBIkL.exe
  C:\Windows\System\wlkBIkL.exe
  2⤵
  PID:3964
- C:\Windows\System\BDeGDWa.exe
  C:\Windows\System\BDeGDWa.exe
  2⤵
  PID:4020
- C:\Windows\System\HRAkWBX.exe
  C:\Windows\System\HRAkWBX.exe
  2⤵
  PID:3996
- C:\Windows\System\QzAuoSR.exe
  C:\Windows\System\QzAuoSR.exe
  2⤵
  PID:2552
- C:\Windows\System\KuoJkuI.exe
  C:\Windows\System\KuoJkuI.exe
  2⤵
  PID:4004
- C:\Windows\System\eOUWTGM.exe
  C:\Windows\System\eOUWTGM.exe
  2⤵
  PID:4044
- C:\Windows\System\fJifwtY.exe
  C:\Windows\System\fJifwtY.exe
  2⤵
  PID:1112
- C:\Windows\System\DChYHEV.exe
  C:\Windows\System\DChYHEV.exe
  2⤵
  PID:3136
- C:\Windows\System\YpMhIhg.exe
  C:\Windows\System\YpMhIhg.exe
  2⤵
  PID:1564
- C:\Windows\System\OgsUaZz.exe
  C:\Windows\System\OgsUaZz.exe
  2⤵
  PID:3316
- C:\Windows\System\tyGEbzC.exe
  C:\Windows\System\tyGEbzC.exe
  2⤵
  PID:3476
- C:\Windows\System\juVtmYW.exe
  C:\Windows\System\juVtmYW.exe
  2⤵
  PID:3100
- C:\Windows\System\jjJlWTj.exe
  C:\Windows\System\jjJlWTj.exe
  2⤵
  PID:3160
- C:\Windows\System\WfKuzzv.exe
  C:\Windows\System\WfKuzzv.exe
  2⤵
  PID:3360
- C:\Windows\System\fcFHUmg.exe
  C:\Windows\System\fcFHUmg.exe
  2⤵
  PID:3428
- C:\Windows\System\yaVojra.exe
  C:\Windows\System\yaVojra.exe
  2⤵
  PID:2764
- C:\Windows\System\SnfVkbn.exe
  C:\Windows\System\SnfVkbn.exe
  2⤵
  PID:3688
- C:\Windows\System\mlFwcsj.exe
  C:\Windows\System\mlFwcsj.exe
  2⤵
  PID:3268
- C:\Windows\System\eSHOCWb.exe
  C:\Windows\System\eSHOCWb.exe
  2⤵
  PID:3700
- C:\Windows\System\CgFCLbH.exe
  C:\Windows\System\CgFCLbH.exe
  2⤵
  PID:3732
- C:\Windows\System\svohnsE.exe
  C:\Windows\System\svohnsE.exe
  2⤵
  PID:3820
- C:\Windows\System\CTLQrog.exe
  C:\Windows\System\CTLQrog.exe
  2⤵
  PID:1816
- C:\Windows\System\LuZJviK.exe
  C:\Windows\System\LuZJviK.exe
  2⤵
  PID:3800
- C:\Windows\System\grhsfzC.exe
  C:\Windows\System\grhsfzC.exe
  2⤵
  PID:1776
- C:\Windows\System\gVPKnAA.exe
  C:\Windows\System\gVPKnAA.exe
  2⤵
  PID:2788
- C:\Windows\System\UlcCXGn.exe
  C:\Windows\System\UlcCXGn.exe
  2⤵
  PID:3904
- C:\Windows\System\IdvfNEG.exe
  C:\Windows\System\IdvfNEG.exe
  2⤵
  PID:3984
- C:\Windows\System\Inimnxu.exe
  C:\Windows\System\Inimnxu.exe
  2⤵
  PID:3932
- C:\Windows\System\uvcAjqn.exe
  C:\Windows\System\uvcAjqn.exe
  2⤵
  PID:2936
- C:\Windows\System\NNmNMTb.exe
  C:\Windows\System\NNmNMTb.exe
  2⤵
  PID:688
- C:\Windows\System\QezAWeF.exe
  C:\Windows\System\QezAWeF.exe
  2⤵
  PID:4024
- C:\Windows\System\SgcHcqf.exe
  C:\Windows\System\SgcHcqf.exe
  2⤵
  PID:828
- C:\Windows\System\uTuDriU.exe
  C:\Windows\System\uTuDriU.exe
  2⤵
  PID:2080
- C:\Windows\System\ECIfXsk.exe
  C:\Windows\System\ECIfXsk.exe
  2⤵
  PID:2740
- C:\Windows\System\fDGSsPb.exe
  C:\Windows\System\fDGSsPb.exe
  2⤵
  PID:4000
- C:\Windows\System\JqutpeA.exe
  C:\Windows\System\JqutpeA.exe
  2⤵
  PID:972
- C:\Windows\System\CbcpygH.exe
  C:\Windows\System\CbcpygH.exe
  2⤵
  PID:944
- C:\Windows\System\lrbPKhy.exe
  C:\Windows\System\lrbPKhy.exe
  2⤵
  PID:1172
- C:\Windows\System\IoFOXbg.exe
  C:\Windows\System\IoFOXbg.exe
  2⤵
  PID:2032
- C:\Windows\System\xuzgbAk.exe
  C:\Windows\System\xuzgbAk.exe
  2⤵
  PID:3248
- C:\Windows\System\mgevdcD.exe
  C:\Windows\System\mgevdcD.exe
  2⤵
  PID:3424
- C:\Windows\System\zACwqRR.exe
  C:\Windows\System\zACwqRR.exe
  2⤵
  PID:3236
- C:\Windows\System\inXEXmo.exe
  C:\Windows\System\inXEXmo.exe
  2⤵
  PID:2816
- C:\Windows\System\LqFWdio.exe
  C:\Windows\System\LqFWdio.exe
  2⤵
  PID:3612
- C:\Windows\System\dbsLxpK.exe
  C:\Windows\System\dbsLxpK.exe
  2⤵
  PID:2728
- C:\Windows\System\wHNuYZE.exe
  C:\Windows\System\wHNuYZE.exe
  2⤵
  PID:608
- C:\Windows\System\xRjfgTD.exe
  C:\Windows\System\xRjfgTD.exe
  2⤵
  PID:1996
- C:\Windows\System\cjZqHsO.exe
  C:\Windows\System\cjZqHsO.exe
  2⤵
  PID:1668
- C:\Windows\System\EFDGbsT.exe
  C:\Windows\System\EFDGbsT.exe
  2⤵
  PID:3952
- C:\Windows\System\MEeGWQC.exe
  C:\Windows\System\MEeGWQC.exe
  2⤵
  PID:4084
- C:\Windows\System\bFJfjfH.exe
  C:\Windows\System\bFJfjfH.exe
  2⤵
  PID:2784
- C:\Windows\System\KSzYmUE.exe
  C:\Windows\System\KSzYmUE.exe
  2⤵
  PID:4060
- C:\Windows\System\tVuSORC.exe
  C:\Windows\System\tVuSORC.exe
  2⤵
  PID:2628
- C:\Windows\System\OXDKAXc.exe
  C:\Windows\System\OXDKAXc.exe
  2⤵
  PID:3804
- C:\Windows\System\VgyeJJp.exe
  C:\Windows\System\VgyeJJp.exe
  2⤵
  PID:3956
- C:\Windows\System\wlwwEEn.exe
  C:\Windows\System\wlwwEEn.exe
  2⤵
  PID:2612
- C:\Windows\System\dSIIGnb.exe
  C:\Windows\System\dSIIGnb.exe
  2⤵
  PID:2820
- C:\Windows\System\vKFAJRn.exe
  C:\Windows\System\vKFAJRn.exe
  2⤵
  PID:2744
- C:\Windows\System\LGXPDSi.exe
  C:\Windows\System\LGXPDSi.exe
  2⤵
  PID:3844
- C:\Windows\System\duhLnow.exe
  C:\Windows\System\duhLnow.exe
  2⤵
  PID:2128
- C:\Windows\System\qDjjgWa.exe
  C:\Windows\System\qDjjgWa.exe
  2⤵
  PID:3528
- C:\Windows\System\HrgJMdw.exe
  C:\Windows\System\HrgJMdw.exe
  2⤵
  PID:3232
- C:\Windows\System\fYTlxer.exe
  C:\Windows\System\fYTlxer.exe
  2⤵
  PID:1084
- C:\Windows\System\CyBcSvx.exe
  C:\Windows\System\CyBcSvx.exe
  2⤵
  PID:1824
- C:\Windows\System\wxlGYJw.exe
  C:\Windows\System\wxlGYJw.exe
  2⤵
  PID:596
- C:\Windows\System\AsENCRP.exe
  C:\Windows\System\AsENCRP.exe
  2⤵
  PID:4068
- C:\Windows\System\grErNcZ.exe
  C:\Windows\System\grErNcZ.exe
  2⤵
  PID:3460
- C:\Windows\System\BvKEQlY.exe
  C:\Windows\System\BvKEQlY.exe
  2⤵
  PID:2484
- C:\Windows\System\nFUWEng.exe
  C:\Windows\System\nFUWEng.exe
  2⤵
  PID:3504
- C:\Windows\System\eYHqHAz.exe
  C:\Windows\System\eYHqHAz.exe
  2⤵
  PID:3756
- C:\Windows\System\IxdLDbj.exe
  C:\Windows\System\IxdLDbj.exe
  2⤵
  PID:3720
- C:\Windows\System\cXUCyjV.exe
  C:\Windows\System\cXUCyjV.exe
  2⤵
  PID:2112
- C:\Windows\System\aGrsuyp.exe
  C:\Windows\System\aGrsuyp.exe
  2⤵
  PID:2700
- C:\Windows\System\miuPEvI.exe
  C:\Windows\System\miuPEvI.exe
  2⤵
  PID:896
- C:\Windows\System\JhNszQF.exe
  C:\Windows\System\JhNszQF.exe
  2⤵
  PID:2796
- C:\Windows\System\vVQfbvj.exe
  C:\Windows\System\vVQfbvj.exe
  2⤵
  PID:3860
- C:\Windows\System\nPdKozd.exe
  C:\Windows\System\nPdKozd.exe
  2⤵
  PID:1688
- C:\Windows\System\pbJFyRM.exe
  C:\Windows\System\pbJFyRM.exe
  2⤵
  PID:2720
- C:\Windows\System\OxWfBnV.exe
  C:\Windows\System\OxWfBnV.exe
  2⤵
  PID:2844
- C:\Windows\System\zLUAkVY.exe
  C:\Windows\System\zLUAkVY.exe
  2⤵
  PID:3280
- C:\Windows\System\nKXPhUy.exe
  C:\Windows\System\nKXPhUy.exe
  2⤵
  PID:2660
- C:\Windows\System\QMAzUJg.exe
  C:\Windows\System\QMAzUJg.exe
  2⤵
  PID:3672
- C:\Windows\System\pEDltUn.exe
  C:\Windows\System\pEDltUn.exe
  2⤵
  PID:4112
- C:\Windows\System\UkRfRlX.exe
  C:\Windows\System\UkRfRlX.exe
  2⤵
  PID:4128
- C:\Windows\System\OBlPiww.exe
  C:\Windows\System\OBlPiww.exe
  2⤵
  PID:4148
- C:\Windows\System\fYPfLgS.exe
  C:\Windows\System\fYPfLgS.exe
  2⤵
  PID:4164
- C:\Windows\System\DpFFDPh.exe
  C:\Windows\System\DpFFDPh.exe
  2⤵
  PID:4184
- C:\Windows\System\IGkGONw.exe
  C:\Windows\System\IGkGONw.exe
  2⤵
  PID:4200
- C:\Windows\System\acGcozT.exe
  C:\Windows\System\acGcozT.exe
  2⤵
  PID:4240
- C:\Windows\System\vUroaZA.exe
  C:\Windows\System\vUroaZA.exe
  2⤵
  PID:4260
- C:\Windows\System\KcYMvFc.exe
  C:\Windows\System\KcYMvFc.exe
  2⤵
  PID:4280
- C:\Windows\System\ILYekZp.exe
  C:\Windows\System\ILYekZp.exe
  2⤵
  PID:4300
- C:\Windows\System\FpOovYx.exe
  C:\Windows\System\FpOovYx.exe
  2⤵
  PID:4320
- C:\Windows\System\NLkDKUu.exe
  C:\Windows\System\NLkDKUu.exe
  2⤵
  PID:4340
- C:\Windows\System\EKWsBXo.exe
  C:\Windows\System\EKWsBXo.exe
  2⤵
  PID:4356
- C:\Windows\System\iBUYqsM.exe
  C:\Windows\System\iBUYqsM.exe
  2⤵
  PID:4372
- C:\Windows\System\oTUeeMg.exe
  C:\Windows\System\oTUeeMg.exe
  2⤵
  PID:4392
- C:\Windows\System\oQbDrJK.exe
  C:\Windows\System\oQbDrJK.exe
  2⤵
  PID:4412
- C:\Windows\System\CdUnpyM.exe
  C:\Windows\System\CdUnpyM.exe
  2⤵
  PID:4444
- C:\Windows\System\tTTxUrv.exe
  C:\Windows\System\tTTxUrv.exe
  2⤵
  PID:4460
- C:\Windows\System\BTWRuuC.exe
  C:\Windows\System\BTWRuuC.exe
  2⤵
  PID:4476
- C:\Windows\System\eoJhRjc.exe
  C:\Windows\System\eoJhRjc.exe
  2⤵
  PID:4496
- C:\Windows\System\xXFTYNR.exe
  C:\Windows\System\xXFTYNR.exe
  2⤵
  PID:4528
- C:\Windows\System\dBsXkXT.exe
  C:\Windows\System\dBsXkXT.exe
  2⤵
  PID:4544
- C:\Windows\System\rPpKrnC.exe
  C:\Windows\System\rPpKrnC.exe
  2⤵
  PID:4564
- C:\Windows\System\hyQSgsf.exe
  C:\Windows\System\hyQSgsf.exe
  2⤵
  PID:4580
- C:\Windows\System\VHzLYZU.exe
  C:\Windows\System\VHzLYZU.exe
  2⤵
  PID:4600
- C:\Windows\System\HHNBzsz.exe
  C:\Windows\System\HHNBzsz.exe
  2⤵
  PID:4632
- C:\Windows\System\dWBkxwu.exe
  C:\Windows\System\dWBkxwu.exe
  2⤵
  PID:4656
- C:\Windows\System\fdpJTNu.exe
  C:\Windows\System\fdpJTNu.exe
  2⤵
  PID:4672
- C:\Windows\System\rLPqQtY.exe
  C:\Windows\System\rLPqQtY.exe
  2⤵
  PID:4688
- C:\Windows\System\dGQRNVE.exe
  C:\Windows\System\dGQRNVE.exe
  2⤵
  PID:4704
- C:\Windows\System\TzGqGhi.exe
  C:\Windows\System\TzGqGhi.exe
  2⤵
  PID:4724
- C:\Windows\System\HtnhoQE.exe
  C:\Windows\System\HtnhoQE.exe
  2⤵
  PID:4748
- C:\Windows\System\TKDAQle.exe
  C:\Windows\System\TKDAQle.exe
  2⤵
  PID:4764
- C:\Windows\System\bySgcMc.exe
  C:\Windows\System\bySgcMc.exe
  2⤵
  PID:4780
- C:\Windows\System\NXqPlSS.exe
  C:\Windows\System\NXqPlSS.exe
  2⤵
  PID:4796
- C:\Windows\System\aSNsvwh.exe
  C:\Windows\System\aSNsvwh.exe
  2⤵
  PID:4812
- C:\Windows\System\JJsDoxV.exe
  C:\Windows\System\JJsDoxV.exe
  2⤵
  PID:4836
- C:\Windows\System\uLBEBOQ.exe
  C:\Windows\System\uLBEBOQ.exe
  2⤵
  PID:4852
- C:\Windows\System\HDzOQBj.exe
  C:\Windows\System\HDzOQBj.exe
  2⤵
  PID:4876
- C:\Windows\System\AVzlPGb.exe
  C:\Windows\System\AVzlPGb.exe
  2⤵
  PID:4900
- C:\Windows\System\BKnweZx.exe
  C:\Windows\System\BKnweZx.exe
  2⤵
  PID:4916
- C:\Windows\System\uYYTpgt.exe
  C:\Windows\System\uYYTpgt.exe
  2⤵
  PID:4932
- C:\Windows\System\OrSwOEX.exe
  C:\Windows\System\OrSwOEX.exe
  2⤵
  PID:4948
- C:\Windows\System\XafLWgX.exe
  C:\Windows\System\XafLWgX.exe
  2⤵
  PID:4964
- C:\Windows\System\tQpZoQq.exe
  C:\Windows\System\tQpZoQq.exe
  2⤵
  PID:4988
- C:\Windows\System\mgmBFDH.exe
  C:\Windows\System\mgmBFDH.exe
  2⤵
  PID:5004
- C:\Windows\System\KcZbmnf.exe
  C:\Windows\System\KcZbmnf.exe
  2⤵
  PID:5024
- C:\Windows\System\EtVyjub.exe
  C:\Windows\System\EtVyjub.exe
  2⤵
  PID:5044
- C:\Windows\System\xxDGoHM.exe
  C:\Windows\System\xxDGoHM.exe
  2⤵
  PID:5076
- C:\Windows\System\IlRPqbf.exe
  C:\Windows\System\IlRPqbf.exe
  2⤵
  PID:5092
- C:\Windows\System\BxJBQuD.exe
  C:\Windows\System\BxJBQuD.exe
  2⤵
  PID:5108
- C:\Windows\System\BEjBEio.exe
  C:\Windows\System\BEjBEio.exe
  2⤵
  PID:1500
- C:\Windows\System\NimNxMJ.exe
  C:\Windows\System\NimNxMJ.exe
  2⤵
  PID:4108
- C:\Windows\System\FBinhqL.exe
  C:\Windows\System\FBinhqL.exe
  2⤵
  PID:4172
- C:\Windows\System\PnzsZkR.exe
  C:\Windows\System\PnzsZkR.exe
  2⤵
  PID:4124
- C:\Windows\System\jEnsesm.exe
  C:\Windows\System\jEnsesm.exe
  2⤵
  PID:2480
- C:\Windows\System\wjFzVtZ.exe
  C:\Windows\System\wjFzVtZ.exe
  2⤵
  PID:4224
- C:\Windows\System\bgITbxk.exe
  C:\Windows\System\bgITbxk.exe
  2⤵
  PID:4228
- C:\Windows\System\PUIUhNH.exe
  C:\Windows\System\PUIUhNH.exe
  2⤵
  PID:4380
- C:\Windows\System\zJpgxUy.exe
  C:\Windows\System\zJpgxUy.exe
  2⤵
  PID:4428
- C:\Windows\System\qzBFFLj.exe
  C:\Windows\System\qzBFFLj.exe
  2⤵
  PID:4292
- C:\Windows\System\ELMjiIE.exe
  C:\Windows\System\ELMjiIE.exe
  2⤵
  PID:4408
- C:\Windows\System\XjUrHxT.exe
  C:\Windows\System\XjUrHxT.exe
  2⤵
  PID:4336
- C:\Windows\System\YzKPgRs.exe
  C:\Windows\System\YzKPgRs.exe
  2⤵
  PID:4296
- C:\Windows\System\fQLYNOV.exe
  C:\Windows\System\fQLYNOV.exe
  2⤵
  PID:4520
- C:\Windows\System\LFvbjLD.exe
  C:\Windows\System\LFvbjLD.exe
  2⤵
  PID:4492
- C:\Windows\System\owJqJXk.exe
  C:\Windows\System\owJqJXk.exe
  2⤵
  PID:4592
- C:\Windows\System\oCqLNim.exe
  C:\Windows\System\oCqLNim.exe
  2⤵
  PID:4652
- C:\Windows\System\sswCjuX.exe
  C:\Windows\System\sswCjuX.exe
  2⤵
  PID:4576
- C:\Windows\System\WEPfOfc.exe
  C:\Windows\System\WEPfOfc.exe
  2⤵
  PID:4680
- C:\Windows\System\YexmiPc.exe
  C:\Windows\System\YexmiPc.exe
  2⤵
  PID:4664
- C:\Windows\System\qrjfcgF.exe
  C:\Windows\System\qrjfcgF.exe
  2⤵
  PID:4712
- C:\Windows\System\IdINSbT.exe
  C:\Windows\System\IdINSbT.exe
  2⤵
  PID:4792
- C:\Windows\System\yuILUsI.exe
  C:\Windows\System\yuILUsI.exe
  2⤵
  PID:3180
- C:\Windows\System\hTuyihX.exe
  C:\Windows\System\hTuyihX.exe
  2⤵
  PID:4860
- C:\Windows\System\ErLhBZa.exe
  C:\Windows\System\ErLhBZa.exe
  2⤵
  PID:4868
- C:\Windows\System\gDkiHia.exe
  C:\Windows\System\gDkiHia.exe
  2⤵
  PID:4776
- C:\Windows\System\RIhkuTj.exe
  C:\Windows\System\RIhkuTj.exe
  2⤵
  PID:4848
- C:\Windows\System\YlrdmOe.exe
  C:\Windows\System\YlrdmOe.exe
  2⤵
  PID:3156
- C:\Windows\System\gIRAuWV.exe
  C:\Windows\System\gIRAuWV.exe
  2⤵
  PID:4908
- C:\Windows\System\sWCMTZu.exe
  C:\Windows\System\sWCMTZu.exe
  2⤵
  PID:4972
- C:\Windows\System\zBZLuSa.exe
  C:\Windows\System\zBZLuSa.exe
  2⤵
  PID:5016
- C:\Windows\System\KrDTqSW.exe
  C:\Windows\System\KrDTqSW.exe
  2⤵
  PID:5072
- C:\Windows\System\XzOihFc.exe
  C:\Windows\System\XzOihFc.exe
  2⤵
  PID:3868
- C:\Windows\System\ceEeDVV.exe
  C:\Windows\System\ceEeDVV.exe
  2⤵
  PID:2460
- C:\Windows\System\zbMSSTA.exe
  C:\Windows\System\zbMSSTA.exe
  2⤵
  PID:5032
- C:\Windows\System\YpRVWbn.exe
  C:\Windows\System\YpRVWbn.exe
  2⤵
  PID:5000
- C:\Windows\System\NtjBFaB.exe
  C:\Windows\System\NtjBFaB.exe
  2⤵
  PID:4196
- C:\Windows\System\sqLTSJt.exe
  C:\Windows\System\sqLTSJt.exe
  2⤵
  PID:4316
- C:\Windows\System\UJWxhei.exe
  C:\Windows\System\UJWxhei.exe
  2⤵
  PID:4212
- C:\Windows\System\qBRUYZu.exe
  C:\Windows\System\qBRUYZu.exe
  2⤵
  PID:4208
- C:\Windows\System\hJNjveu.exe
  C:\Windows\System\hJNjveu.exe
  2⤵
  PID:4216
- C:\Windows\System\JZJvbyC.exe
  C:\Windows\System\JZJvbyC.exe
  2⤵
  PID:4232
- C:\Windows\System\FfYcsmt.exe
  C:\Windows\System\FfYcsmt.exe
  2⤵
  PID:4468
- C:\Windows\System\BUEEyWf.exe
  C:\Windows\System\BUEEyWf.exe
  2⤵
  PID:4364
- C:\Windows\System\HKKucLz.exe
  C:\Windows\System\HKKucLz.exe
  2⤵
  PID:4560
- C:\Windows\System\jGNtLnH.exe
  C:\Windows\System\jGNtLnH.exe
  2⤵
  PID:4572
- C:\Windows\System\EjfGFGc.exe
  C:\Windows\System\EjfGFGc.exe
  2⤵
  PID:4760
- C:\Windows\System\DDtRHOi.exe
  C:\Windows\System\DDtRHOi.exe
  2⤵
  PID:4700
- C:\Windows\System\EoyNvBY.exe
  C:\Windows\System\EoyNvBY.exe
  2⤵
  PID:3604
- C:\Windows\System\bqMmprO.exe
  C:\Windows\System\bqMmprO.exe
  2⤵
  PID:4740
- C:\Windows\System\qoeLDJE.exe
  C:\Windows\System\qoeLDJE.exe
  2⤵
  PID:4484
- C:\Windows\System\wCJALnK.exe
  C:\Windows\System\wCJALnK.exe
  2⤵
  PID:4616
- C:\Windows\System\ZVLypOg.exe
  C:\Windows\System\ZVLypOg.exe
  2⤵
  PID:3608
- C:\Windows\System\DQQoZhC.exe
  C:\Windows\System\DQQoZhC.exe
  2⤵
  PID:4620
- C:\Windows\System\FWRxGOu.exe
  C:\Windows\System\FWRxGOu.exe
  2⤵
  PID:3596
- C:\Windows\System\yRrivcb.exe
  C:\Windows\System\yRrivcb.exe
  2⤵
  PID:5064
- C:\Windows\System\doVctDN.exe
  C:\Windows\System\doVctDN.exe
  2⤵
  PID:4956
- C:\Windows\System\sWWayhc.exe
  C:\Windows\System\sWWayhc.exe
  2⤵
  PID:4276
- C:\Windows\System\xROwFoQ.exe
  C:\Windows\System\xROwFoQ.exe
  2⤵
  PID:1680
- C:\Windows\System\AZGEclU.exe
  C:\Windows\System\AZGEclU.exe
  2⤵
  PID:4368
- C:\Windows\System\NSXoMBg.exe
  C:\Windows\System\NSXoMBg.exe
  2⤵
  PID:4832
- C:\Windows\System\ARvBFmO.exe
  C:\Windows\System\ARvBFmO.exe
  2⤵
  PID:4248
- C:\Windows\System\UPXzkXO.exe
  C:\Windows\System\UPXzkXO.exe
  2⤵
  PID:3556
- C:\Windows\System\dpwSrEa.exe
  C:\Windows\System\dpwSrEa.exe
  2⤵
  PID:4516
- C:\Windows\System\TuGIGok.exe
  C:\Windows\System\TuGIGok.exe
  2⤵
  PID:4804
- C:\Windows\System\sUulWPs.exe
  C:\Windows\System\sUulWPs.exe
  2⤵
  PID:3220
- C:\Windows\System\ZvRgmSq.exe
  C:\Windows\System\ZvRgmSq.exe
  2⤵
  PID:4944
- C:\Windows\System\nqzqpWH.exe
  C:\Windows\System\nqzqpWH.exe
  2⤵
  PID:4640
- C:\Windows\System\tjlWSXE.exe
  C:\Windows\System\tjlWSXE.exe
  2⤵
  PID:5056
- C:\Windows\System\GXJusPU.exe
  C:\Windows\System\GXJusPU.exe
  2⤵
  PID:5100
- C:\Windows\System\BhvcWCZ.exe
  C:\Windows\System\BhvcWCZ.exe
  2⤵
  PID:4332
- C:\Windows\System\thRICJF.exe
  C:\Windows\System\thRICJF.exe
  2⤵
  PID:4512
- C:\Windows\System\YKUWqEf.exe
  C:\Windows\System\YKUWqEf.exe
  2⤵
  PID:4732
- C:\Windows\System\otSoHpY.exe
  C:\Windows\System\otSoHpY.exe
  2⤵
  PID:4924
- C:\Windows\System\IOHtVTF.exe
  C:\Windows\System\IOHtVTF.exe
  2⤵
  PID:4388
- C:\Windows\System\TDEkuqz.exe
  C:\Windows\System\TDEkuqz.exe
  2⤵
  PID:4844
- C:\Windows\System\knGcizJ.exe
  C:\Windows\System\knGcizJ.exe
  2⤵
  PID:3600
- C:\Windows\System\hXLqCNR.exe
  C:\Windows\System\hXLqCNR.exe
  2⤵
  PID:4648
- C:\Windows\System\rKncfyr.exe
  C:\Windows\System\rKncfyr.exe
  2⤵
  PID:5012
- C:\Windows\System\UvrzeYV.exe
  C:\Windows\System\UvrzeYV.exe
  2⤵
  PID:4140
- C:\Windows\System\EAiynnQ.exe
  C:\Windows\System\EAiynnQ.exe
  2⤵
  PID:4720
- C:\Windows\System\iAhJGUe.exe
  C:\Windows\System\iAhJGUe.exe
  2⤵
  PID:5128
- C:\Windows\System\wAuEjif.exe
  C:\Windows\System\wAuEjif.exe
  2⤵
  PID:5144
- C:\Windows\System\sXwImcb.exe
  C:\Windows\System\sXwImcb.exe
  2⤵
  PID:5160
- C:\Windows\System\yLmjGBW.exe
  C:\Windows\System\yLmjGBW.exe
  2⤵
  PID:5176
- C:\Windows\System\FFRtyVy.exe
  C:\Windows\System\FFRtyVy.exe
  2⤵
  PID:5200
- C:\Windows\System\hHKOaln.exe
  C:\Windows\System\hHKOaln.exe
  2⤵
  PID:5216
- C:\Windows\System\uTNFZYp.exe
  C:\Windows\System\uTNFZYp.exe
  2⤵
  PID:5240
- C:\Windows\System\COCepOM.exe
  C:\Windows\System\COCepOM.exe
  2⤵
  PID:5260
- C:\Windows\System\SJfGNER.exe
  C:\Windows\System\SJfGNER.exe
  2⤵
  PID:5276
- C:\Windows\System\YzWfHCJ.exe
  C:\Windows\System\YzWfHCJ.exe
  2⤵
  PID:5308
- C:\Windows\System\TNOoIVK.exe
  C:\Windows\System\TNOoIVK.exe
  2⤵
  PID:5324
- C:\Windows\System\mIUUIFc.exe
  C:\Windows\System\mIUUIFc.exe
  2⤵
  PID:5340
- C:\Windows\System\haAgXlD.exe
  C:\Windows\System\haAgXlD.exe
  2⤵
  PID:5368
- C:\Windows\System\BXaXgjR.exe
  C:\Windows\System\BXaXgjR.exe
  2⤵
  PID:5388
- C:\Windows\System\gvdKYhF.exe
  C:\Windows\System\gvdKYhF.exe
  2⤵
  PID:5408
- C:\Windows\System\DNkjNsT.exe
  C:\Windows\System\DNkjNsT.exe
  2⤵
  PID:5428
- C:\Windows\System\vOpHevW.exe
  C:\Windows\System\vOpHevW.exe
  2⤵
  PID:5444
- C:\Windows\System\YItFVDT.exe
  C:\Windows\System\YItFVDT.exe
  2⤵
  PID:5468
- C:\Windows\System\PNNwLUp.exe
  C:\Windows\System\PNNwLUp.exe
  2⤵
  PID:5484
- C:\Windows\System\BMBquyT.exe
  C:\Windows\System\BMBquyT.exe
  2⤵
  PID:5500
- C:\Windows\System\BTOqalx.exe
  C:\Windows\System\BTOqalx.exe
  2⤵
  PID:5516
- C:\Windows\System\KrWQtaJ.exe
  C:\Windows\System\KrWQtaJ.exe
  2⤵
  PID:5532
- C:\Windows\System\IIHIKdG.exe
  C:\Windows\System\IIHIKdG.exe
  2⤵
  PID:5584
- C:\Windows\System\WTAJRkM.exe
  C:\Windows\System\WTAJRkM.exe
  2⤵
  PID:5604
- C:\Windows\System\JQNZBKD.exe
  C:\Windows\System\JQNZBKD.exe
  2⤵
  PID:5620
- C:\Windows\System\gbLiojk.exe
  C:\Windows\System\gbLiojk.exe
  2⤵
  PID:5640
- C:\Windows\System\yLTzAIZ.exe
  C:\Windows\System\yLTzAIZ.exe
  2⤵
  PID:5660
- C:\Windows\System\IVfxAhS.exe
  C:\Windows\System\IVfxAhS.exe
  2⤵
  PID:5680
- C:\Windows\System\dEfZPiX.exe
  C:\Windows\System\dEfZPiX.exe
  2⤵
  PID:5708
- C:\Windows\System\nVDCFfc.exe
  C:\Windows\System\nVDCFfc.exe
  2⤵
  PID:5724
- C:\Windows\System\heylgRP.exe
  C:\Windows\System\heylgRP.exe
  2⤵
  PID:5740
- C:\Windows\System\utQaIEB.exe
  C:\Windows\System\utQaIEB.exe
  2⤵
  PID:5760
- C:\Windows\System\CAmGdln.exe
  C:\Windows\System\CAmGdln.exe
  2⤵
  PID:5776
- C:\Windows\System\RMXKTAh.exe
  C:\Windows\System\RMXKTAh.exe
  2⤵
  PID:5792
- C:\Windows\System\QMcCvWm.exe
  C:\Windows\System\QMcCvWm.exe
  2⤵
  PID:5808
- C:\Windows\System\IOdGeQZ.exe
  C:\Windows\System\IOdGeQZ.exe
  2⤵
  PID:5828
- C:\Windows\System\XKdAiCp.exe
  C:\Windows\System\XKdAiCp.exe
  2⤵
  PID:5848
- C:\Windows\System\kNIhXbQ.exe
  C:\Windows\System\kNIhXbQ.exe
  2⤵
  PID:5868
- C:\Windows\System\ESjbPuH.exe
  C:\Windows\System\ESjbPuH.exe
  2⤵
  PID:5884
- C:\Windows\System\nsgtqrk.exe
  C:\Windows\System\nsgtqrk.exe
  2⤵
  PID:5908
- C:\Windows\System\dMUgjwP.exe
  C:\Windows\System\dMUgjwP.exe
  2⤵
  PID:5924
- C:\Windows\System\zJfEDqi.exe
  C:\Windows\System\zJfEDqi.exe
  2⤵
  PID:5940
- C:\Windows\System\tBaQscj.exe
  C:\Windows\System\tBaQscj.exe
  2⤵
  PID:5956
- C:\Windows\System\kpsscox.exe
  C:\Windows\System\kpsscox.exe
  2⤵
  PID:5976
- C:\Windows\System\XAEDHnd.exe
  C:\Windows\System\XAEDHnd.exe
  2⤵
  PID:6004
- C:\Windows\System\xNyFtmJ.exe
  C:\Windows\System\xNyFtmJ.exe
  2⤵
  PID:6032
- C:\Windows\System\VWuYJwq.exe
  C:\Windows\System\VWuYJwq.exe
  2⤵
  PID:6060
- C:\Windows\System\xcubukF.exe
  C:\Windows\System\xcubukF.exe
  2⤵
  PID:6080
- C:\Windows\System\ouIvexT.exe
  C:\Windows\System\ouIvexT.exe
  2⤵
  PID:6100
- C:\Windows\System\MbwhrSI.exe
  C:\Windows\System\MbwhrSI.exe
  2⤵
  PID:6124
- C:\Windows\System\ynLRyVu.exe
  C:\Windows\System\ynLRyVu.exe
  2⤵
  PID:4888
- C:\Windows\System\hHyKWxm.exe
  C:\Windows\System\hHyKWxm.exe
  2⤵
  PID:5124
- C:\Windows\System\nqgxcSc.exe
  C:\Windows\System\nqgxcSc.exe
  2⤵
  PID:1188
- C:\Windows\System\wBwYQpr.exe
  C:\Windows\System\wBwYQpr.exe
  2⤵
  PID:5224
- C:\Windows\System\EnsRCpY.exe
  C:\Windows\System\EnsRCpY.exe
  2⤵
  PID:5316
- C:\Windows\System\lCQUEEa.exe
  C:\Windows\System\lCQUEEa.exe
  2⤵
  PID:5172
- C:\Windows\System\mEBNpGu.exe
  C:\Windows\System\mEBNpGu.exe
  2⤵
  PID:5396
- C:\Windows\System\eLDQWHR.exe
  C:\Windows\System\eLDQWHR.exe
  2⤵
  PID:5304
- C:\Windows\System\uJhYClJ.exe
  C:\Windows\System\uJhYClJ.exe
  2⤵
  PID:4420
- C:\Windows\System\yDkwUMa.exe
  C:\Windows\System\yDkwUMa.exe
  2⤵
  PID:4404
- C:\Windows\System\lsHwVwX.exe
  C:\Windows\System\lsHwVwX.exe
  2⤵
  PID:5336
- C:\Windows\System\YjOiftT.exe
  C:\Windows\System\YjOiftT.exe
  2⤵
  PID:5252
- C:\Windows\System\RkzKXEx.exe
  C:\Windows\System\RkzKXEx.exe
  2⤵
  PID:5508
- C:\Windows\System\cENQPCU.exe
  C:\Windows\System\cENQPCU.exe
  2⤵
  PID:5540
- C:\Windows\System\aEVqIFV.exe
  C:\Windows\System\aEVqIFV.exe
  2⤵
  PID:5568
- C:\Windows\System\dXJgkGr.exe
  C:\Windows\System\dXJgkGr.exe
  2⤵
  PID:5376
- C:\Windows\System\QSXpuFl.exe
  C:\Windows\System\QSXpuFl.exe
  2⤵
  PID:5212
- C:\Windows\System\IsfaTYb.exe
  C:\Windows\System\IsfaTYb.exe
  2⤵
  PID:5248
- C:\Windows\System\NDuBgYi.exe
  C:\Windows\System\NDuBgYi.exe
  2⤵
  PID:5524
- C:\Windows\System\qUiOohX.exe
  C:\Windows\System\qUiOohX.exe
  2⤵
  PID:5576
- C:\Windows\System\QLBiyqY.exe
  C:\Windows\System\QLBiyqY.exe
  2⤵
  PID:5592
- C:\Windows\System\fPJTWBd.exe
  C:\Windows\System\fPJTWBd.exe
  2⤵
  PID:5632
- C:\Windows\System\dDJTBET.exe
  C:\Windows\System\dDJTBET.exe
  2⤵
  PID:5672
- C:\Windows\System\VbmGNKg.exe
  C:\Windows\System\VbmGNKg.exe
  2⤵
  PID:5732
- C:\Windows\System\ZYAqysg.exe
  C:\Windows\System\ZYAqysg.exe
  2⤵
  PID:5800
- C:\Windows\System\FhWUqGr.exe
  C:\Windows\System\FhWUqGr.exe
  2⤵
  PID:5876
- C:\Windows\System\JEiQrWR.exe
  C:\Windows\System\JEiQrWR.exe
  2⤵
  PID:5952
- C:\Windows\System\gKpswDc.exe
  C:\Windows\System\gKpswDc.exe
  2⤵
  PID:5864
- C:\Windows\System\LhGniTV.exe
  C:\Windows\System\LhGniTV.exe
  2⤵
  PID:6044
- C:\Windows\System\eiBIfIz.exe
  C:\Windows\System\eiBIfIz.exe
  2⤵
  PID:5896
- C:\Windows\System\gzHVcgD.exe
  C:\Windows\System\gzHVcgD.exe
  2⤵
  PID:5900
- C:\Windows\System\doigVEI.exe
  C:\Windows\System\doigVEI.exe
  2⤵
  PID:6016
- C:\Windows\System\yElqpNe.exe
  C:\Windows\System\yElqpNe.exe
  2⤵
  PID:6068
- C:\Windows\System\fcgtpZF.exe
  C:\Windows\System\fcgtpZF.exe
  2⤵
  PID:6088
- C:\Windows\System\uEiNaKC.exe
  C:\Windows\System\uEiNaKC.exe
  2⤵
  PID:6132
- C:\Windows\System\mDwYZBF.exe
  C:\Windows\System\mDwYZBF.exe
  2⤵
  PID:5156
- C:\Windows\System\IUjnEoa.exe
  C:\Windows\System\IUjnEoa.exe
  2⤵
  PID:5268
- C:\Windows\System\aIsrPfc.exe
  C:\Windows\System\aIsrPfc.exe
  2⤵
  PID:5356
- C:\Windows\System\mfjIjIV.exe
  C:\Windows\System\mfjIjIV.exe
  2⤵
  PID:5352
- C:\Windows\System\muzhZBd.exe
  C:\Windows\System\muzhZBd.exe
  2⤵
  PID:5404
- C:\Windows\System\eRCdPri.exe
  C:\Windows\System\eRCdPri.exe
  2⤵
  PID:4180
- C:\Windows\System\iriBQFx.exe
  C:\Windows\System\iriBQFx.exe
  2⤵
  PID:5256
- C:\Windows\System\LxllgOc.exe
  C:\Windows\System\LxllgOc.exe
  2⤵
  PID:5596
- C:\Windows\System\XPIkNbt.exe
  C:\Windows\System\XPIkNbt.exe
  2⤵
  PID:5948
- C:\Windows\System\EbZGYWQ.exe
  C:\Windows\System\EbZGYWQ.exe
  2⤵
  PID:5452
- C:\Windows\System\eUGSeKM.exe
  C:\Windows\System\eUGSeKM.exe
  2⤵
  PID:5296
- C:\Windows\System\GfOfBgw.exe
  C:\Windows\System\GfOfBgw.exe
  2⤵
  PID:4612
- C:\Windows\System\caIkbEd.exe
  C:\Windows\System\caIkbEd.exe
  2⤵
  PID:5992
- C:\Windows\System\coMvApU.exe
  C:\Windows\System\coMvApU.exe
  2⤵
  PID:5700
- C:\Windows\System\pXRDbdX.exe
  C:\Windows\System\pXRDbdX.exe
  2⤵
  PID:5856
- C:\Windows\System\DGCXITj.exe
  C:\Windows\System\DGCXITj.exe
  2⤵
  PID:6000
- C:\Windows\System\NUliqat.exe
  C:\Windows\System\NUliqat.exe
  2⤵
  PID:5784
- C:\Windows\System\rxIoCwL.exe
  C:\Windows\System\rxIoCwL.exe
  2⤵
  PID:6096
- C:\Windows\System\knLWIIq.exe
  C:\Windows\System\knLWIIq.exe
  2⤵
  PID:5360
- C:\Windows\System\euVQzGy.exe
  C:\Windows\System\euVQzGy.exe
  2⤵
  PID:5892
- C:\Windows\System\grYvNIj.exe
  C:\Windows\System\grYvNIj.exe
  2⤵
  PID:5936
- C:\Windows\System\xrzwJMN.exe
  C:\Windows\System\xrzwJMN.exe
  2⤵
  PID:5512
- C:\Windows\System\vsCZLoe.exe
  C:\Windows\System\vsCZLoe.exe
  2⤵
  PID:5152
- C:\Windows\System\sFIQbjD.exe
  C:\Windows\System\sFIQbjD.exe
  2⤵
  PID:5192
- C:\Windows\System\XwUhRnY.exe
  C:\Windows\System\XwUhRnY.exe
  2⤵
  PID:5844
- C:\Windows\System\vwVwmve.exe
  C:\Windows\System\vwVwmve.exe
  2⤵
  PID:5440
- C:\Windows\System\BkGFqkx.exe
  C:\Windows\System\BkGFqkx.exe
  2⤵
  PID:5696
- C:\Windows\System\aZEeGxW.exe
  C:\Windows\System\aZEeGxW.exe
  2⤵
  PID:5916
- C:\Windows\System\vqvhejs.exe
  C:\Windows\System\vqvhejs.exe
  2⤵
  PID:5920
- C:\Windows\System\QfnPowQ.exe
  C:\Windows\System\QfnPowQ.exe
  2⤵
  PID:5692
- C:\Windows\System\dHIPBdE.exe
  C:\Windows\System\dHIPBdE.exe
  2⤵
  PID:5480
- C:\Windows\System\jUkQxlH.exe
  C:\Windows\System\jUkQxlH.exe
  2⤵
  PID:6028
- C:\Windows\System\YvnQxjQ.exe
  C:\Windows\System\YvnQxjQ.exe
  2⤵
  PID:5968
- C:\Windows\System\UNdBcna.exe
  C:\Windows\System\UNdBcna.exe
  2⤵
  PID:5840
- C:\Windows\System\BhIyrxz.exe
  C:\Windows\System\BhIyrxz.exe
  2⤵
  PID:6208
- C:\Windows\System\GYKPyxA.exe
  C:\Windows\System\GYKPyxA.exe
  2⤵
  PID:6232
- C:\Windows\System\MTfeIff.exe
  C:\Windows\System\MTfeIff.exe
  2⤵
  PID:6248
- C:\Windows\System\bfaoLnN.exe
  C:\Windows\System\bfaoLnN.exe
  2⤵
  PID:6264
- C:\Windows\System\pJMtEcX.exe
  C:\Windows\System\pJMtEcX.exe
  2⤵
  PID:6284
- C:\Windows\System\BkfKAoQ.exe
  C:\Windows\System\BkfKAoQ.exe
  2⤵
  PID:6308
- C:\Windows\System\CyGTqeI.exe
  C:\Windows\System\CyGTqeI.exe
  2⤵
  PID:6328
- C:\Windows\System\jUNmzLW.exe
  C:\Windows\System\jUNmzLW.exe
  2⤵
  PID:6344
- C:\Windows\System\qCdfUBa.exe
  C:\Windows\System\qCdfUBa.exe
  2⤵
  PID:6360
- C:\Windows\System\GheBRkA.exe
  C:\Windows\System\GheBRkA.exe
  2⤵
  PID:6376
- C:\Windows\System\VlMsUeu.exe
  C:\Windows\System\VlMsUeu.exe
  2⤵
  PID:6396
- C:\Windows\System\zoWKMec.exe
  C:\Windows\System\zoWKMec.exe
  2⤵
  PID:6428
- C:\Windows\System\nafyrWg.exe
  C:\Windows\System\nafyrWg.exe
  2⤵
  PID:6448
- C:\Windows\System\EIrAKbY.exe
  C:\Windows\System\EIrAKbY.exe
  2⤵
  PID:6464
- C:\Windows\System\XGZVNsu.exe
  C:\Windows\System\XGZVNsu.exe
  2⤵
  PID:6484
- C:\Windows\System\LXUtzbm.exe
  C:\Windows\System\LXUtzbm.exe
  2⤵
  PID:6500
- C:\Windows\System\MrUrsEQ.exe
  C:\Windows\System\MrUrsEQ.exe
  2⤵
  PID:6516
- C:\Windows\System\AKVuxgi.exe
  C:\Windows\System\AKVuxgi.exe
  2⤵
  PID:6532
- C:\Windows\System\KPjlsDa.exe
  C:\Windows\System\KPjlsDa.exe
  2⤵
  PID:6548
- C:\Windows\System\reDzxoF.exe
  C:\Windows\System\reDzxoF.exe
  2⤵
  PID:6580
- C:\Windows\System\ZqpnSqi.exe
  C:\Windows\System\ZqpnSqi.exe
  2⤵
  PID:6600
- C:\Windows\System\oRYEFTG.exe
  C:\Windows\System\oRYEFTG.exe
  2⤵
  PID:6616
- C:\Windows\System\FZauwmQ.exe
  C:\Windows\System\FZauwmQ.exe
  2⤵
  PID:6632
- C:\Windows\System\rjIavHF.exe
  C:\Windows\System\rjIavHF.exe
  2⤵
  PID:6652
- C:\Windows\System\IdrYCsa.exe
  C:\Windows\System\IdrYCsa.exe
  2⤵
  PID:6688
- C:\Windows\System\iUwdxUA.exe
  C:\Windows\System\iUwdxUA.exe
  2⤵
  PID:6704
- C:\Windows\System\FiLaadf.exe
  C:\Windows\System\FiLaadf.exe
  2⤵
  PID:6728
- C:\Windows\System\nNdQgrR.exe
  C:\Windows\System\nNdQgrR.exe
  2⤵
  PID:6748
- C:\Windows\System\KxCZIrE.exe
  C:\Windows\System\KxCZIrE.exe
  2⤵
  PID:6768
- C:\Windows\System\KOKnYHm.exe
  C:\Windows\System\KOKnYHm.exe
  2⤵
  PID:6784
- C:\Windows\System\yegRnac.exe
  C:\Windows\System\yegRnac.exe
  2⤵
  PID:6804
- C:\Windows\System\kxxfcRv.exe
  C:\Windows\System\kxxfcRv.exe
  2⤵
  PID:6824
- C:\Windows\System\xkIIvGi.exe
  C:\Windows\System\xkIIvGi.exe
  2⤵
  PID:6844
- C:\Windows\System\cHvKDBD.exe
  C:\Windows\System\cHvKDBD.exe
  2⤵
  PID:6860
- C:\Windows\System\UfrqLAQ.exe
  C:\Windows\System\UfrqLAQ.exe
  2⤵
  PID:6876
- C:\Windows\System\lSFiqaJ.exe
  C:\Windows\System\lSFiqaJ.exe
  2⤵
  PID:6896
- C:\Windows\System\mXfrKAc.exe
  C:\Windows\System\mXfrKAc.exe
  2⤵
  PID:6920
- C:\Windows\System\QkPgaXX.exe
  C:\Windows\System\QkPgaXX.exe
  2⤵
  PID:6936
- C:\Windows\System\wpIzPll.exe
  C:\Windows\System\wpIzPll.exe
  2⤵
  PID:6952
- C:\Windows\System\toORUao.exe
  C:\Windows\System\toORUao.exe
  2⤵
  PID:6972
- C:\Windows\System\CWrSRKx.exe
  C:\Windows\System\CWrSRKx.exe
  2⤵
  PID:6992
- C:\Windows\System\DaRTIfl.exe
  C:\Windows\System\DaRTIfl.exe
  2⤵
  PID:7008
- C:\Windows\System\xXZeZJC.exe
  C:\Windows\System\xXZeZJC.exe
  2⤵
  PID:7024
- C:\Windows\System\OPnXKtR.exe
  C:\Windows\System\OPnXKtR.exe
  2⤵
  PID:7044
- C:\Windows\System\ixreKIo.exe
  C:\Windows\System\ixreKIo.exe
  2⤵
  PID:7068
- C:\Windows\System\lUTfbES.exe
  C:\Windows\System\lUTfbES.exe
  2⤵
  PID:7084
- C:\Windows\System\Dsdltsj.exe
  C:\Windows\System\Dsdltsj.exe
  2⤵
  PID:7104
- C:\Windows\System\qLYwccg.exe
  C:\Windows\System\qLYwccg.exe
  2⤵
  PID:7120
- C:\Windows\System\QomSala.exe
  C:\Windows\System\QomSala.exe
  2⤵
  PID:7136
- C:\Windows\System\YxYSfyY.exe
  C:\Windows\System\YxYSfyY.exe
  2⤵
  PID:7152
- C:\Windows\System\wENCAPR.exe
  C:\Windows\System\wENCAPR.exe
  2⤵
  PID:5824
- C:\Windows\System\UJwALUM.exe
  C:\Windows\System\UJwALUM.exe
  2⤵
  PID:5688
- C:\Windows\System\EnbYNIX.exe
  C:\Windows\System\EnbYNIX.exe
  2⤵
  PID:5768
- C:\Windows\System\ldQOzlX.exe
  C:\Windows\System\ldQOzlX.exe
  2⤵
  PID:4628
- C:\Windows\System\mYETEnn.exe
  C:\Windows\System\mYETEnn.exe
  2⤵
  PID:5788
- C:\Windows\System\tmLRzgl.exe
  C:\Windows\System\tmLRzgl.exe
  2⤵
  PID:6152
- C:\Windows\System\xmVHUkX.exe
  C:\Windows\System\xmVHUkX.exe
  2⤵
  PID:5656
- C:\Windows\System\kMRyYpN.exe
  C:\Windows\System\kMRyYpN.exe
  2⤵
  PID:4160
- C:\Windows\System\YvmtKpD.exe
  C:\Windows\System\YvmtKpD.exe
  2⤵
  PID:6228
- C:\Windows\System\ZqwhAwk.exe
  C:\Windows\System\ZqwhAwk.exe
  2⤵
  PID:6188
- C:\Windows\System\jIBakQL.exe
  C:\Windows\System\jIBakQL.exe
  2⤵
  PID:6204
- C:\Windows\System\vYdqHFE.exe
  C:\Windows\System\vYdqHFE.exe
  2⤵
  PID:6260
- C:\Windows\System\xtMPBsC.exe
  C:\Windows\System\xtMPBsC.exe
  2⤵
  PID:6296
- C:\Windows\System\BEgamER.exe
  C:\Windows\System\BEgamER.exe
  2⤵
  PID:6408
- C:\Windows\System\rSUfXWP.exe
  C:\Windows\System\rSUfXWP.exe
  2⤵
  PID:6424
- C:\Windows\System\CNKPqkW.exe
  C:\Windows\System\CNKPqkW.exe
  2⤵
  PID:6460
- C:\Windows\System\VeHvjcI.exe
  C:\Windows\System\VeHvjcI.exe
  2⤵
  PID:6524
- C:\Windows\System\AGrnJjj.exe
  C:\Windows\System\AGrnJjj.exe
  2⤵
  PID:6564
- C:\Windows\System\haLPQuY.exe
  C:\Windows\System\haLPQuY.exe
  2⤵
  PID:6476
- C:\Windows\System\TPMbNBa.exe
  C:\Windows\System\TPMbNBa.exe
  2⤵
  PID:6540
- C:\Windows\System\CNhIoyc.exe
  C:\Windows\System\CNhIoyc.exe
  2⤵
  PID:6640
- C:\Windows\System\GOVsSoD.exe
  C:\Windows\System\GOVsSoD.exe
  2⤵
  PID:6480
- C:\Windows\System\XXBYOli.exe
  C:\Windows\System\XXBYOli.exe
  2⤵
  PID:6660
- C:\Windows\System\UXClhOH.exe
  C:\Windows\System\UXClhOH.exe
  2⤵
  PID:6684
- C:\Windows\System\YBjUAXm.exe
  C:\Windows\System\YBjUAXm.exe
  2⤵
  PID:6712
- C:\Windows\System\xEtvOFS.exe
  C:\Windows\System\xEtvOFS.exe
  2⤵
  PID:6744
- C:\Windows\System\SwsPZHy.exe
  C:\Windows\System\SwsPZHy.exe
  2⤵
  PID:6776
- C:\Windows\System\igwTNDZ.exe
  C:\Windows\System\igwTNDZ.exe
  2⤵
  PID:6820
- C:\Windows\System\pIZIpde.exe
  C:\Windows\System\pIZIpde.exe
  2⤵
  PID:6884
- C:\Windows\System\kNFBKOl.exe
  C:\Windows\System\kNFBKOl.exe
  2⤵
  PID:6960
- C:\Windows\System\DmTvbXo.exe
  C:\Windows\System\DmTvbXo.exe
  2⤵
  PID:7004
- C:\Windows\System\BtrnUSl.exe
  C:\Windows\System\BtrnUSl.exe
  2⤵
  PID:7080
- C:\Windows\System\ORksEwC.exe
  C:\Windows\System\ORksEwC.exe
  2⤵
  PID:6916
- C:\Windows\System\ADqhCFr.exe
  C:\Windows\System\ADqhCFr.exe
  2⤵
  PID:5196
- C:\Windows\System\monHilp.exe
  C:\Windows\System\monHilp.exe
  2⤵
  PID:6024
- C:\Windows\System\DYrDEpd.exe
  C:\Windows\System\DYrDEpd.exe
  2⤵
  PID:6944
- C:\Windows\System\Hlhyuvb.exe
  C:\Windows\System\Hlhyuvb.exe
  2⤵
  PID:6988
- C:\Windows\System\JlFumyE.exe
  C:\Windows\System\JlFumyE.exe
  2⤵
  PID:5492
- C:\Windows\System\pHVbzhn.exe
  C:\Windows\System\pHVbzhn.exe
  2⤵
  PID:7056
- C:\Windows\System\oeXmBrZ.exe
  C:\Windows\System\oeXmBrZ.exe
  2⤵
  PID:6872
- C:\Windows\System\wTVblfg.exe
  C:\Windows\System\wTVblfg.exe
  2⤵
  PID:6184
- C:\Windows\System\otmJMdS.exe
  C:\Windows\System\otmJMdS.exe
  2⤵
  PID:6304
- C:\Windows\System\yyOnRsm.exe
  C:\Windows\System\yyOnRsm.exe
  2⤵
  PID:5984
- C:\Windows\System\tkTpqds.exe
  C:\Windows\System\tkTpqds.exe
  2⤵
  PID:6224
- C:\Windows\System\AvqJNCs.exe
  C:\Windows\System\AvqJNCs.exe
  2⤵
  PID:6280
- C:\Windows\System\ySxFYdI.exe
  C:\Windows\System\ySxFYdI.exe
  2⤵
  PID:6356
- C:\Windows\System\IXVNblS.exe
  C:\Windows\System\IXVNblS.exe
  2⤵
  PID:7128
- C:\Windows\System\coGxntl.exe
  C:\Windows\System\coGxntl.exe
  2⤵
  PID:5616
- C:\Windows\System\ErDAmLe.exe
  C:\Windows\System\ErDAmLe.exe
  2⤵
  PID:5364
- C:\Windows\System\kZETXuy.exe
  C:\Windows\System\kZETXuy.exe
  2⤵
  PID:6496
- C:\Windows\System\CbzajhX.exe
  C:\Windows\System\CbzajhX.exe
  2⤵
  PID:6672
- C:\Windows\System\BqyjlgV.exe
  C:\Windows\System\BqyjlgV.exe
  2⤵
  PID:6812
- C:\Windows\System\uNFDMmJ.exe
  C:\Windows\System\uNFDMmJ.exe
  2⤵
  PID:6932
- C:\Windows\System\iGaCPYd.exe
  C:\Windows\System\iGaCPYd.exe
  2⤵
  PID:7144
- C:\Windows\System\haRuuOh.exe
  C:\Windows\System\haRuuOh.exe
  2⤵
  PID:5168
- C:\Windows\System\FahrVYK.exe
  C:\Windows\System\FahrVYK.exe
  2⤵
  PID:6608
- C:\Windows\System\OaeLwye.exe
  C:\Windows\System\OaeLwye.exe
  2⤵
  PID:6840
- C:\Windows\System\chmoBWj.exe
  C:\Windows\System\chmoBWj.exe
  2⤵
  PID:5820
- C:\Windows\System\kHMaRKR.exe
  C:\Windows\System\kHMaRKR.exe
  2⤵
  PID:6436
- C:\Windows\System\HFYBrTY.exe
  C:\Windows\System\HFYBrTY.exe
  2⤵
  PID:6796
- C:\Windows\System\OpSWmcM.exe
  C:\Windows\System\OpSWmcM.exe
  2⤵
  PID:6720
- C:\Windows\System\LfahRKZ.exe
  C:\Windows\System\LfahRKZ.exe
  2⤵
  PID:6568
- C:\Windows\System\zdBaijo.exe
  C:\Windows\System\zdBaijo.exe
  2⤵
  PID:6244
- C:\Windows\System\ctxhVtX.exe
  C:\Windows\System\ctxhVtX.exe
  2⤵
  PID:6440
- C:\Windows\System\XniwxDu.exe
  C:\Windows\System\XniwxDu.exe
  2⤵
  PID:7076
- C:\Windows\System\OMFDOVa.exe
  C:\Windows\System\OMFDOVa.exe
  2⤵
  PID:7176
- C:\Windows\System\dHeBySo.exe
  C:\Windows\System\dHeBySo.exe
  2⤵
  PID:7192
- C:\Windows\System\JYJvAHZ.exe
  C:\Windows\System\JYJvAHZ.exe
  2⤵
  PID:7216
- C:\Windows\System\vRPymar.exe
  C:\Windows\System\vRPymar.exe
  2⤵
  PID:7252
- C:\Windows\System\dhfouER.exe
  C:\Windows\System\dhfouER.exe
  2⤵
  PID:7268
- C:\Windows\System\MzhFvxv.exe
  C:\Windows\System\MzhFvxv.exe
  2⤵
  PID:7284
- C:\Windows\System\bNaZSiU.exe
  C:\Windows\System\bNaZSiU.exe
  2⤵
  PID:7300
- C:\Windows\System\MYqRDUz.exe
  C:\Windows\System\MYqRDUz.exe
  2⤵
  PID:7320
- C:\Windows\System\xfUWAdb.exe
  C:\Windows\System\xfUWAdb.exe
  2⤵
  PID:7336
- C:\Windows\System\VaUvhCB.exe
  C:\Windows\System\VaUvhCB.exe
  2⤵
  PID:7360
- C:\Windows\System\xHFcmRn.exe
  C:\Windows\System\xHFcmRn.exe
  2⤵
  PID:7384
- C:\Windows\System\LUrzwXr.exe
  C:\Windows\System\LUrzwXr.exe
  2⤵
  PID:7404
- C:\Windows\System\DwJUrHA.exe
  C:\Windows\System\DwJUrHA.exe
  2⤵
  PID:7420
- C:\Windows\System\tCRsIkc.exe
  C:\Windows\System\tCRsIkc.exe
  2⤵
  PID:7436
- C:\Windows\System\gJHxNkw.exe
  C:\Windows\System\gJHxNkw.exe
  2⤵
  PID:7456
- C:\Windows\System\lrvMSqe.exe
  C:\Windows\System\lrvMSqe.exe
  2⤵
  PID:7472
- C:\Windows\System\EtcmRXb.exe
  C:\Windows\System\EtcmRXb.exe
  2⤵
  PID:7496
- C:\Windows\System\uNvXTLB.exe
  C:\Windows\System\uNvXTLB.exe
  2⤵
  PID:7516
- C:\Windows\System\ZFQEjSX.exe
  C:\Windows\System\ZFQEjSX.exe
  2⤵
  PID:7540
- C:\Windows\System\rgNUNMx.exe
  C:\Windows\System\rgNUNMx.exe
  2⤵
  PID:7560
- C:\Windows\System\SQsbNUA.exe
  C:\Windows\System\SQsbNUA.exe
  2⤵
  PID:7576
- C:\Windows\System\AjVeRVx.exe
  C:\Windows\System\AjVeRVx.exe
  2⤵
  PID:7596
- C:\Windows\System\mhHuhGm.exe
  C:\Windows\System\mhHuhGm.exe
  2⤵
  PID:7620
- C:\Windows\System\ObCkttJ.exe
  C:\Windows\System\ObCkttJ.exe
  2⤵
  PID:7644
- C:\Windows\System\WXRHKEh.exe
  C:\Windows\System\WXRHKEh.exe
  2⤵
  PID:7660
- C:\Windows\System\LGbSQyP.exe
  C:\Windows\System\LGbSQyP.exe
  2⤵
  PID:7684
- C:\Windows\System\gDmCmkb.exe
  C:\Windows\System\gDmCmkb.exe
  2⤵
  PID:7700
- C:\Windows\System\ZjUeUtG.exe
  C:\Windows\System\ZjUeUtG.exe
  2⤵
  PID:7780
- C:\Windows\System\hzDLNgQ.exe
  C:\Windows\System\hzDLNgQ.exe
  2⤵
  PID:7796
- C:\Windows\System\GUeLUPL.exe
  C:\Windows\System\GUeLUPL.exe
  2⤵
  PID:7812
- C:\Windows\System\UZHJSyc.exe
  C:\Windows\System\UZHJSyc.exe
  2⤵
  PID:7832
- C:\Windows\System\xihqRWf.exe
  C:\Windows\System\xihqRWf.exe
  2⤵
  PID:7852
- C:\Windows\System\DqeCYys.exe
  C:\Windows\System\DqeCYys.exe
  2⤵
  PID:7868
- C:\Windows\System\JqjAoDI.exe
  C:\Windows\System\JqjAoDI.exe
  2⤵
  PID:7884
- C:\Windows\System\AmtqATu.exe
  C:\Windows\System\AmtqATu.exe
  2⤵
  PID:7912
- C:\Windows\System\ayywMTH.exe
  C:\Windows\System\ayywMTH.exe
  2⤵
  PID:7932
- C:\Windows\System\rQAEiYw.exe
  C:\Windows\System\rQAEiYw.exe
  2⤵
  PID:7948
- C:\Windows\System\hTzbgOi.exe
  C:\Windows\System\hTzbgOi.exe
  2⤵
  PID:7968
- C:\Windows\System\AIQlYEv.exe
  C:\Windows\System\AIQlYEv.exe
  2⤵
  PID:7984
- C:\Windows\System\GCOtoKD.exe
  C:\Windows\System\GCOtoKD.exe
  2⤵
  PID:8004
- C:\Windows\System\UoaStAZ.exe
  C:\Windows\System\UoaStAZ.exe
  2⤵
  PID:8020
- C:\Windows\System\IMcvanx.exe
  C:\Windows\System\IMcvanx.exe
  2⤵
  PID:8036
- C:\Windows\System\bobCSgx.exe
  C:\Windows\System\bobCSgx.exe
  2⤵
  PID:8064
- C:\Windows\System\HYqVCsw.exe
  C:\Windows\System\HYqVCsw.exe
  2⤵
  PID:8084
- C:\Windows\System\hVYcmEk.exe
  C:\Windows\System\hVYcmEk.exe
  2⤵
  PID:8104
- C:\Windows\System\BQpWNSJ.exe
  C:\Windows\System\BQpWNSJ.exe
  2⤵
  PID:8120
- C:\Windows\System\MlHVSnD.exe
  C:\Windows\System\MlHVSnD.exe
  2⤵
  PID:8140
- C:\Windows\System\MJbxvfx.exe
  C:\Windows\System\MJbxvfx.exe
  2⤵
  PID:8164
- C:\Windows\System\pTvEpet.exe
  C:\Windows\System\pTvEpet.exe
  2⤵
  PID:8184
- C:\Windows\System\cYsLUBy.exe
  C:\Windows\System\cYsLUBy.exe
  2⤵
  PID:7052
- C:\Windows\System\ATomdNM.exe
  C:\Windows\System\ATomdNM.exe
  2⤵
  PID:6180
- C:\Windows\System\totmZGG.exe
  C:\Windows\System\totmZGG.exe
  2⤵
  PID:6904
- C:\Windows\System\tsXswqa.exe
  C:\Windows\System\tsXswqa.exe
  2⤵
  PID:6336
- C:\Windows\System\fiDVTyq.exe
  C:\Windows\System\fiDVTyq.exe
  2⤵
  PID:6196
- C:\Windows\System\EHcqqQA.exe
  C:\Windows\System\EHcqqQA.exe
  2⤵
  PID:7292
- C:\Windows\System\aMAJMcA.exe
  C:\Windows\System\aMAJMcA.exe
  2⤵
  PID:7380
- C:\Windows\System\wWqUirM.exe
  C:\Windows\System\wWqUirM.exe
  2⤵
  PID:7452
- C:\Windows\System\YaacKfX.exe
  C:\Windows\System\YaacKfX.exe
  2⤵
  PID:7492
- C:\Windows\System\sRZQAOD.exe
  C:\Windows\System\sRZQAOD.exe
  2⤵
  PID:7536
- C:\Windows\System\GKOYbYW.exe
  C:\Windows\System\GKOYbYW.exe
  2⤵
  PID:7612
- C:\Windows\System\evScecO.exe
  C:\Windows\System\evScecO.exe
  2⤵
  PID:6760
- C:\Windows\System\hzJGvRM.exe
  C:\Windows\System\hzJGvRM.exe
  2⤵
  PID:7164
- C:\Windows\System\JGcezDb.exe
  C:\Windows\System\JGcezDb.exe
  2⤵
  PID:7148
- C:\Windows\System\utrmfnF.exe
  C:\Windows\System\utrmfnF.exe
  2⤵
  PID:7096
- C:\Windows\System\jzHJzfZ.exe
  C:\Windows\System\jzHJzfZ.exe
  2⤵
  PID:6512
- C:\Windows\System\MsTkunJ.exe
  C:\Windows\System\MsTkunJ.exe
  2⤵
  PID:6928
- C:\Windows\System\UJNIDCl.exe
  C:\Windows\System\UJNIDCl.exe
  2⤵
  PID:6836
- C:\Windows\System\sajuELD.exe
  C:\Windows\System\sajuELD.exe
  2⤵
  PID:6680
- C:\Windows\System\GwRddfF.exe
  C:\Windows\System\GwRddfF.exe
  2⤵
  PID:7224
- C:\Windows\System\CnmqLrl.exe
  C:\Windows\System\CnmqLrl.exe
  2⤵
  PID:7244
- C:\Windows\System\chwxvjE.exe
  C:\Windows\System\chwxvjE.exe
  2⤵
  PID:7316
- C:\Windows\System\AWtEtDV.exe
  C:\Windows\System\AWtEtDV.exe
  2⤵
  PID:7392
- C:\Windows\System\BfMXafH.exe
  C:\Windows\System\BfMXafH.exe
  2⤵
  PID:7432
- C:\Windows\System\JcpCNio.exe
  C:\Windows\System\JcpCNio.exe
  2⤵
  PID:7824
- C:\Windows\System\ToJxLKo.exe
  C:\Windows\System\ToJxLKo.exe
  2⤵
  PID:7548
- C:\Windows\System\TvQMXZd.exe
  C:\Windows\System\TvQMXZd.exe
  2⤵
  PID:7592
- C:\Windows\System\rUJUohu.exe
  C:\Windows\System\rUJUohu.exe
  2⤵
  PID:7640
- C:\Windows\System\WkpwmHc.exe
  C:\Windows\System\WkpwmHc.exe
  2⤵
  PID:7708
- C:\Windows\System\HHDVQQO.exe
  C:\Windows\System\HHDVQQO.exe
  2⤵
  PID:7728
- C:\Windows\System\pTDRLIu.exe
  C:\Windows\System\pTDRLIu.exe
  2⤵
  PID:7896
- C:\Windows\System\TSVBRIl.exe
  C:\Windows\System\TSVBRIl.exe
  2⤵
  PID:7712
- C:\Windows\System\sYStRGX.exe
  C:\Windows\System\sYStRGX.exe
  2⤵
  PID:7808
- C:\Windows\System\SQZNxgW.exe
  C:\Windows\System\SQZNxgW.exe
  2⤵
  PID:7976
- C:\Windows\System\YJEdVxJ.exe
  C:\Windows\System\YJEdVxJ.exe
  2⤵
  PID:8052
- C:\Windows\System\PfMsKqV.exe
  C:\Windows\System\PfMsKqV.exe
  2⤵
  PID:7960
- C:\Windows\System\cmtTZmR.exe
  C:\Windows\System\cmtTZmR.exe
  2⤵
  PID:8028
- C:\Windows\System\uwHOHxW.exe
  C:\Windows\System\uwHOHxW.exe
  2⤵
  PID:7880
- C:\Windows\System\YtuLDLG.exe
  C:\Windows\System\YtuLDLG.exe
  2⤵
  PID:7992
- C:\Windows\System\HpsHHfD.exe
  C:\Windows\System\HpsHHfD.exe
  2⤵
  PID:8032
- C:\Windows\System\papHNEl.exe
  C:\Windows\System\papHNEl.exe
  2⤵
  PID:7212
- C:\Windows\System\MgHQkZc.exe
  C:\Windows\System\MgHQkZc.exe
  2⤵
  PID:6764
- C:\Windows\System\Zihlzsm.exe
  C:\Windows\System\Zihlzsm.exe
  2⤵
  PID:7260
- C:\Windows\System\UZcPXNb.exe
  C:\Windows\System\UZcPXNb.exe
  2⤵
  PID:8152
- C:\Windows\System\UMVedMo.exe
  C:\Windows\System\UMVedMo.exe
  2⤵
  PID:8160
- C:\Windows\System\fyddvFT.exe
  C:\Windows\System\fyddvFT.exe
  2⤵
  PID:5748
- C:\Windows\System\XRvwrtL.exe
  C:\Windows\System\XRvwrtL.exe
  2⤵
  PID:6492
- C:\Windows\System\OIRSLIr.exe
  C:\Windows\System\OIRSLIr.exe
  2⤵
  PID:7444
- C:\Windows\System\YZZHmHc.exe
  C:\Windows\System\YZZHmHc.exe
  2⤵
  PID:6800
- C:\Windows\System\xiUEVyy.exe
  C:\Windows\System\xiUEVyy.exe
  2⤵
  PID:5228
- C:\Windows\System\iIdAZCi.exe
  C:\Windows\System\iIdAZCi.exe
  2⤵
  PID:6980
- C:\Windows\System\PsljoIZ.exe
  C:\Windows\System\PsljoIZ.exe
  2⤵
  PID:7100
- C:\Windows\System\NDlOCUf.exe
  C:\Windows\System\NDlOCUf.exe
  2⤵
  PID:7184
- C:\Windows\System\yIkeKHQ.exe
  C:\Windows\System\yIkeKHQ.exe
  2⤵
  PID:7400
- C:\Windows\System\PwQyxNJ.exe
  C:\Windows\System\PwQyxNJ.exe
  2⤵
  PID:7512
- C:\Windows\System\XlnXjQz.exe
  C:\Windows\System\XlnXjQz.exe
  2⤵
  PID:7792
- C:\Windows\System\euUguYb.exe
  C:\Windows\System\euUguYb.exe
  2⤵
  PID:7236
- C:\Windows\System\QrznbEr.exe
  C:\Windows\System\QrznbEr.exe
  2⤵
  PID:6964
- C:\Windows\System\TulIWuk.exe
  C:\Windows\System\TulIWuk.exe
  2⤵
  PID:7756
- C:\Windows\System\pXUBIZJ.exe
  C:\Windows\System\pXUBIZJ.exe
  2⤵
  PID:7736
- C:\Windows\System\SbRCsLN.exe
  C:\Windows\System\SbRCsLN.exe
  2⤵
  PID:7720
- C:\Windows\System\qnxfokh.exe
  C:\Windows\System\qnxfokh.exe
  2⤵
  PID:7908
- C:\Windows\System\XKPNcYr.exe
  C:\Windows\System\XKPNcYr.exe
  2⤵
  PID:8044
- C:\Windows\System\GDDdYzf.exe
  C:\Windows\System\GDDdYzf.exe
  2⤵
  PID:8016
- C:\Windows\System\DRICrUe.exe
  C:\Windows\System\DRICrUe.exe
  2⤵
  PID:7996
- C:\Windows\System\iWTAbnW.exe
  C:\Windows\System\iWTAbnW.exe
  2⤵
  PID:7876
- C:\Windows\System\ZFfiNob.exe
  C:\Windows\System\ZFfiNob.exe
  2⤵
  PID:6276
- C:\Windows\System\xXDAtFE.exe
  C:\Windows\System\xXDAtFE.exe
  2⤵
  PID:7204
- C:\Windows\System\RjOMqIq.exe
  C:\Windows\System\RjOMqIq.exe
  2⤵
  PID:8076
- C:\Windows\System\FwQSamd.exe
  C:\Windows\System\FwQSamd.exe
  2⤵
  PID:6756
- C:\Windows\System\dxZZtOc.exe
  C:\Windows\System\dxZZtOc.exe
  2⤵
  PID:5208
- C:\Windows\System\MIJUjtn.exe
  C:\Windows\System\MIJUjtn.exe
  2⤵
  PID:7608
- C:\Windows\System\kKjsLKh.exe
  C:\Windows\System\kKjsLKh.exe
  2⤵
  PID:6912
- C:\Windows\System\UDbaGJh.exe
  C:\Windows\System\UDbaGJh.exe
  2⤵
  PID:6256
- C:\Windows\System\booIHtU.exe
  C:\Windows\System\booIHtU.exe
  2⤵
  PID:6148
- C:\Windows\System\hcksNrf.exe
  C:\Windows\System\hcksNrf.exe
  2⤵
  PID:7504
- C:\Windows\System\LhAhBYW.exe
  C:\Windows\System\LhAhBYW.exe
  2⤵
  PID:7632
- C:\Windows\System\SDiRvAO.exe
  C:\Windows\System\SDiRvAO.exe
  2⤵
  PID:7356
- C:\Windows\System\bOEnKoy.exe
  C:\Windows\System\bOEnKoy.exe
  2⤵
  PID:7764
- C:\Windows\System\AoUYwRz.exe
  C:\Windows\System\AoUYwRz.exe
  2⤵
  PID:7352
- C:\Windows\System\AWuQJeX.exe
  C:\Windows\System\AWuQJeX.exe
  2⤵
  PID:7804
- C:\Windows\System\idCoPRo.exe
  C:\Windows\System\idCoPRo.exe
  2⤵
  PID:8048
- C:\Windows\System\XrllYTG.exe
  C:\Windows\System\XrllYTG.exe
  2⤵
  PID:8176
- C:\Windows\System\sEBvuBK.exe
  C:\Windows\System\sEBvuBK.exe
  2⤵
  PID:8116
- C:\Windows\System\DqKzgit.exe
  C:\Windows\System\DqKzgit.exe
  2⤵
  PID:7696
- C:\Windows\System\eHsqaGT.exe
  C:\Windows\System\eHsqaGT.exe
  2⤵
  PID:6700
- C:\Windows\System\HANSMma.exe
  C:\Windows\System\HANSMma.exe
  2⤵
  PID:6112
- C:\Windows\System\nmxHplR.exe
  C:\Windows\System\nmxHplR.exe
  2⤵
  PID:7484
- C:\Windows\System\eLYeJhD.exe
  C:\Windows\System\eLYeJhD.exe
  2⤵
  PID:7344
- C:\Windows\System\cMeukQs.exe
  C:\Windows\System\cMeukQs.exe
  2⤵
  PID:7280
- C:\Windows\System\PngsNyj.exe
  C:\Windows\System\PngsNyj.exe
  2⤵
  PID:7636
- C:\Windows\System\HtaOrhB.exe
  C:\Windows\System\HtaOrhB.exe
  2⤵
  PID:2664
- C:\Windows\System\LpWsOyN.exe
  C:\Windows\System\LpWsOyN.exe
  2⤵
  PID:8096
- C:\Windows\System\DhhydSg.exe
  C:\Windows\System\DhhydSg.exe
  2⤵
  PID:8132
- C:\Windows\System\HRoaGzh.exe
  C:\Windows\System\HRoaGzh.exe
  2⤵
  PID:6628
- C:\Windows\System\qaXPDhW.exe
  C:\Windows\System\qaXPDhW.exe
  2⤵
  PID:7412
- C:\Windows\System\fvidSos.exe
  C:\Windows\System\fvidSos.exe
  2⤵
  PID:7676
- C:\Windows\System\CTWFtza.exe
  C:\Windows\System\CTWFtza.exe
  2⤵
  PID:7904
- C:\Windows\System\PyBkEQW.exe
  C:\Windows\System\PyBkEQW.exe
  2⤵
  PID:7332
- C:\Windows\System\GifjSTm.exe
  C:\Windows\System\GifjSTm.exe
  2⤵
  PID:7328
- C:\Windows\System\eLJcywg.exe
  C:\Windows\System\eLJcywg.exe
  2⤵
  PID:7240
- C:\Windows\System\HwVHVzx.exe
  C:\Windows\System\HwVHVzx.exe
  2⤵
  PID:6592
- C:\Windows\System\gBZFzKN.exe
  C:\Windows\System\gBZFzKN.exe
  2⤵
  PID:5652
- C:\Windows\System\KFoGlLn.exe
  C:\Windows\System\KFoGlLn.exe
  2⤵
  PID:8080
- C:\Windows\System\tiJxFRq.exe
  C:\Windows\System\tiJxFRq.exe
  2⤵
  PID:7820
- C:\Windows\System\ILNKvrL.exe
  C:\Windows\System\ILNKvrL.exe
  2⤵
  PID:7944
- C:\Windows\System\TjAOkNa.exe
  C:\Windows\System\TjAOkNa.exe
  2⤵
  PID:8196
- C:\Windows\System\IsUIQMK.exe
  C:\Windows\System\IsUIQMK.exe
  2⤵
  PID:8216
- C:\Windows\System\duJFkKc.exe
  C:\Windows\System\duJFkKc.exe
  2⤵
  PID:8232
- C:\Windows\System\XXqKMLm.exe
  C:\Windows\System\XXqKMLm.exe
  2⤵
  PID:8248
- C:\Windows\System\ILwJXku.exe
  C:\Windows\System\ILwJXku.exe
  2⤵
  PID:8264
- C:\Windows\System\YcgeHDs.exe
  C:\Windows\System\YcgeHDs.exe
  2⤵
  PID:8280
- C:\Windows\System\xlWgHpj.exe
  C:\Windows\System\xlWgHpj.exe
  2⤵
  PID:8300
- C:\Windows\System\lObSTKr.exe
  C:\Windows\System\lObSTKr.exe
  2⤵
  PID:8320
- C:\Windows\System\PSbthjy.exe
  C:\Windows\System\PSbthjy.exe
  2⤵
  PID:8340
- C:\Windows\System\ndcEBSt.exe
  C:\Windows\System\ndcEBSt.exe
  2⤵
  PID:8356
- C:\Windows\System\PEbkKLS.exe
  C:\Windows\System\PEbkKLS.exe
  2⤵
  PID:8372
- C:\Windows\System\QfBtwiq.exe
  C:\Windows\System\QfBtwiq.exe
  2⤵
  PID:8392
- C:\Windows\System\rBhGPZB.exe
  C:\Windows\System\rBhGPZB.exe
  2⤵
  PID:8412
- C:\Windows\System\xVkMjcO.exe
  C:\Windows\System\xVkMjcO.exe
  2⤵
  PID:8440
- C:\Windows\System\JpSnRsS.exe
  C:\Windows\System\JpSnRsS.exe
  2⤵
  PID:8484
- C:\Windows\System\BwscaAH.exe
  C:\Windows\System\BwscaAH.exe
  2⤵
  PID:8504
- C:\Windows\System\EAtkyts.exe
  C:\Windows\System\EAtkyts.exe
  2⤵
  PID:8524
- C:\Windows\System\eOzjVxq.exe
  C:\Windows\System\eOzjVxq.exe
  2⤵
  PID:8548
- C:\Windows\System\JyGaMkA.exe
  C:\Windows\System\JyGaMkA.exe
  2⤵
  PID:8564
- C:\Windows\System\wCePZTr.exe
  C:\Windows\System\wCePZTr.exe
  2⤵
  PID:8580
- C:\Windows\System\lismHde.exe
  C:\Windows\System\lismHde.exe
  2⤵
  PID:8596
- C:\Windows\System\CmCBBlu.exe
  C:\Windows\System\CmCBBlu.exe
  2⤵
  PID:8612
- C:\Windows\System\mfFCiRF.exe
  C:\Windows\System\mfFCiRF.exe
  2⤵
  PID:8628
- C:\Windows\System\cciGlSi.exe
  C:\Windows\System\cciGlSi.exe
  2⤵
  PID:8680
- C:\Windows\System\vKnXkNs.exe
  C:\Windows\System\vKnXkNs.exe
  2⤵
  PID:8700
- C:\Windows\System\eDcpZsB.exe
  C:\Windows\System\eDcpZsB.exe
  2⤵
  PID:8716
- C:\Windows\System\BcEOKyA.exe
  C:\Windows\System\BcEOKyA.exe
  2⤵
  PID:8732
- C:\Windows\System\yKHIKPj.exe
  C:\Windows\System\yKHIKPj.exe
  2⤵
  PID:8756
- C:\Windows\System\DAbePhy.exe
  C:\Windows\System\DAbePhy.exe
  2⤵
  PID:8776
- C:\Windows\System\ruFrunw.exe
  C:\Windows\System\ruFrunw.exe
  2⤵
  PID:8792
- C:\Windows\System\yWeJbcm.exe
  C:\Windows\System\yWeJbcm.exe
  2⤵
  PID:8812
- C:\Windows\System\zIcwyRF.exe
  C:\Windows\System\zIcwyRF.exe
  2⤵
  PID:8828
- C:\Windows\System\RaECWSm.exe
  C:\Windows\System\RaECWSm.exe
  2⤵
  PID:8852
- C:\Windows\System\luUuoes.exe
  C:\Windows\System\luUuoes.exe
  2⤵
  PID:8872
- C:\Windows\System\PJIEtQy.exe
  C:\Windows\System\PJIEtQy.exe
  2⤵
  PID:8888
- C:\Windows\System\ZoRlXrt.exe
  C:\Windows\System\ZoRlXrt.exe
  2⤵
  PID:8912
- C:\Windows\System\spSAuFt.exe
  C:\Windows\System\spSAuFt.exe
  2⤵
  PID:8932
- C:\Windows\System\EoyqjYT.exe
  C:\Windows\System\EoyqjYT.exe
  2⤵
  PID:8956
- C:\Windows\System\mQHJMYI.exe
  C:\Windows\System\mQHJMYI.exe
  2⤵
  PID:8976
- C:\Windows\System\kwDoAlk.exe
  C:\Windows\System\kwDoAlk.exe
  2⤵
  PID:8992
- C:\Windows\System\DKCdIuu.exe
  C:\Windows\System\DKCdIuu.exe
  2⤵
  PID:9008
- C:\Windows\System\kVTrnJe.exe
  C:\Windows\System\kVTrnJe.exe
  2⤵
  PID:9024
- C:\Windows\System\zTKDydP.exe
  C:\Windows\System\zTKDydP.exe
  2⤵
  PID:9040
- C:\Windows\System\AZKdJjD.exe
  C:\Windows\System\AZKdJjD.exe
  2⤵
  PID:9060
- C:\Windows\System\tzhdZuZ.exe
  C:\Windows\System\tzhdZuZ.exe
  2⤵
  PID:9076
- C:\Windows\System\VHKIJTW.exe
  C:\Windows\System\VHKIJTW.exe
  2⤵
  PID:9124
- C:\Windows\System\sihjnjZ.exe
  C:\Windows\System\sihjnjZ.exe
  2⤵
  PID:9144
- C:\Windows\System\sbimrCx.exe
  C:\Windows\System\sbimrCx.exe
  2⤵
  PID:9160
- C:\Windows\System\dMdJJVi.exe
  C:\Windows\System\dMdJJVi.exe
  2⤵
  PID:9176
- C:\Windows\System\pzuNdkk.exe
  C:\Windows\System\pzuNdkk.exe
  2⤵
  PID:9196
- C:\Windows\System\uNegaCR.exe
  C:\Windows\System\uNegaCR.exe
  2⤵
  PID:9212
- C:\Windows\System\VQtUmDf.exe
  C:\Windows\System\VQtUmDf.exe
  2⤵
  PID:2232
- C:\Windows\System\YioipnW.exe
  C:\Windows\System\YioipnW.exe
  2⤵
  PID:8240
- C:\Windows\System\LkslyzA.exe
  C:\Windows\System\LkslyzA.exe
  2⤵
  PID:8312
- C:\Windows\System\IfdyCNO.exe
  C:\Windows\System\IfdyCNO.exe
  2⤵
  PID:8328
- C:\Windows\System\NEnpzCt.exe
  C:\Windows\System\NEnpzCt.exe
  2⤵
  PID:8296
- C:\Windows\System\HfEkvXf.exe
  C:\Windows\System\HfEkvXf.exe
  2⤵
  PID:8420
- C:\Windows\System\ReTfmbw.exe
  C:\Windows\System\ReTfmbw.exe
  2⤵
  PID:996
- C:\Windows\System\wumINKZ.exe
  C:\Windows\System\wumINKZ.exe
  2⤵
  PID:8448
- C:\Windows\System\dMBVprZ.exe
  C:\Windows\System\dMBVprZ.exe
  2⤵
  PID:8472
- C:\Windows\System\AnBUItH.exe
  C:\Windows\System\AnBUItH.exe
  2⤵
  PID:8512
- C:\Windows\System\oAgtBId.exe
  C:\Windows\System\oAgtBId.exe
  2⤵
  PID:8572
- C:\Windows\System\leilUoU.exe
  C:\Windows\System\leilUoU.exe
  2⤵
  PID:8604
- C:\Windows\System\bGSXPlk.exe
  C:\Windows\System\bGSXPlk.exe
  2⤵
  PID:8620
- C:\Windows\System\ubdAdBW.exe
  C:\Windows\System\ubdAdBW.exe
  2⤵
  PID:8644
- C:\Windows\System\Bglapyh.exe
  C:\Windows\System\Bglapyh.exe
  2⤵
  PID:8676
- C:\Windows\System\ZIpUokR.exe
  C:\Windows\System\ZIpUokR.exe
  2⤵
  PID:8708
- C:\Windows\System\RZgVvjC.exe
  C:\Windows\System\RZgVvjC.exe
  2⤵
  PID:8728
- C:\Windows\System\ogBWzfa.exe
  C:\Windows\System\ogBWzfa.exe
  2⤵
  PID:8784
- C:\Windows\System\aHwWseL.exe
  C:\Windows\System\aHwWseL.exe
  2⤵
  PID:8848
- C:\Windows\System\jFErbHv.exe
  C:\Windows\System\jFErbHv.exe
  2⤵
  PID:8804
- C:\Windows\System\IACAHbL.exe
  C:\Windows\System\IACAHbL.exe
  2⤵
  PID:8860
- C:\Windows\System\ZAqIkvK.exe
  C:\Windows\System\ZAqIkvK.exe
  2⤵
  PID:8904
- C:\Windows\System\Rixvhwd.exe
  C:\Windows\System\Rixvhwd.exe
  2⤵
  PID:8928
- C:\Windows\System\ZtWHrPQ.exe
  C:\Windows\System\ZtWHrPQ.exe
  2⤵
  PID:8984
- C:\Windows\System\TIIFELP.exe
  C:\Windows\System\TIIFELP.exe
  2⤵
  PID:9048
- C:\Windows\System\XEbKyam.exe
  C:\Windows\System\XEbKyam.exe
  2⤵
  PID:9088
- C:\Windows\System\TIgsntU.exe
  C:\Windows\System\TIgsntU.exe
  2⤵
  PID:8968
- C:\Windows\System\Slanvfx.exe
  C:\Windows\System\Slanvfx.exe
  2⤵
  PID:9096
- C:\Windows\System\YQNVVoC.exe
  C:\Windows\System\YQNVVoC.exe
  2⤵
  PID:9108
- C:\Windows\System\mPkyAgM.exe
  C:\Windows\System\mPkyAgM.exe
  2⤵
  PID:9140
- C:\Windows\System\sawXBfA.exe
  C:\Windows\System\sawXBfA.exe
  2⤵
  PID:9188
- C:\Windows\System\sfyNBzd.exe
  C:\Windows\System\sfyNBzd.exe
  2⤵
  PID:8128
- C:\Windows\System\YxVdNdm.exe
  C:\Windows\System\YxVdNdm.exe
  2⤵
  PID:8292
- C:\Windows\System\OgsqPDk.exe
  C:\Windows\System\OgsqPDk.exe
  2⤵
  PID:8212
- C:\Windows\System\xQywqrw.exe
  C:\Windows\System\xQywqrw.exe
  2⤵
  PID:8348
- C:\Windows\System\XpJwEtl.exe
  C:\Windows\System\XpJwEtl.exe
  2⤵
  PID:8408
- C:\Windows\System\BApEBCc.exe
  C:\Windows\System\BApEBCc.exe
  2⤵
  PID:8432
- C:\Windows\System\JoxSSZt.exe
  C:\Windows\System\JoxSSZt.exe
  2⤵
  PID:8500
- C:\Windows\System\QrgYMJe.exe
  C:\Windows\System\QrgYMJe.exe
  2⤵
  PID:8624
- C:\Windows\System\gHmpDAb.exe
  C:\Windows\System\gHmpDAb.exe
  2⤵
  PID:8664
- C:\Windows\System\RNAvAbg.exe
  C:\Windows\System\RNAvAbg.exe
  2⤵
  PID:8744
- C:\Windows\System\UWpSGtH.exe
  C:\Windows\System\UWpSGtH.exe
  2⤵
  PID:8824
- C:\Windows\System\xGtiiqH.exe
  C:\Windows\System\xGtiiqH.exe
  2⤵
  PID:8924
- C:\Windows\System\lPnQKUI.exe
  C:\Windows\System\lPnQKUI.exe
  2⤵
  PID:8764
- C:\Windows\System\uMCVGKX.exe
  C:\Windows\System\uMCVGKX.exe
  2⤵
  PID:9084
- C:\Windows\System\FiyFodd.exe
  C:\Windows\System\FiyFodd.exe
  2⤵
  PID:9068
- C:\Windows\System\LIelWnV.exe
  C:\Windows\System\LIelWnV.exe
  2⤵
  PID:8944
- C:\Windows\System\bnHiBcE.exe
  C:\Windows\System\bnHiBcE.exe
  2⤵
  PID:9104
- C:\Windows\System\FPzjuYp.exe
  C:\Windows\System\FPzjuYp.exe
  2⤵
  PID:8276
- C:\Windows\System\ErjJrzn.exe
  C:\Windows\System\ErjJrzn.exe
  2⤵
  PID:8404
- C:\Windows\System\SSXjuMu.exe
  C:\Windows\System\SSXjuMu.exe
  2⤵
  PID:8428
- C:\Windows\System\sqjxtNi.exe
  C:\Windows\System\sqjxtNi.exe
  2⤵
  PID:8012
- C:\Windows\System\QdQLBCz.exe
  C:\Windows\System\QdQLBCz.exe
  2⤵
  PID:8384
- C:\Windows\System\fNMifDy.exe
  C:\Windows\System\fNMifDy.exe
  2⤵
  PID:8480
- C:\Windows\System\UvnFjDa.exe
  C:\Windows\System\UvnFjDa.exe
  2⤵
  PID:8544
- C:\Windows\System\CGPDxQA.exe
  C:\Windows\System\CGPDxQA.exe
  2⤵
  PID:8652
- C:\Windows\System\UzLOzQL.exe
  C:\Windows\System\UzLOzQL.exe
  2⤵
  PID:8820
- C:\Windows\System\KeoXiXW.exe
  C:\Windows\System\KeoXiXW.exe
  2⤵
  PID:9032
- C:\Windows\System\qnbvWPE.exe
  C:\Windows\System\qnbvWPE.exe
  2⤵
  PID:8800
- C:\Windows\System\zelyJzk.exe
  C:\Windows\System\zelyJzk.exe
  2⤵
  PID:9156
- C:\Windows\System\TULHfFR.exe
  C:\Windows\System\TULHfFR.exe
  2⤵
  PID:8308
- C:\Windows\System\rBtrljk.exe
  C:\Windows\System\rBtrljk.exe
  2⤵
  PID:9208
- C:\Windows\System\URIqvmk.exe
  C:\Windows\System\URIqvmk.exe
  2⤵
  PID:8260
- C:\Windows\System\APfXwSX.exe
  C:\Windows\System\APfXwSX.exe
  2⤵
  PID:9132
- C:\Windows\System\nYHwyCJ.exe
  C:\Windows\System\nYHwyCJ.exe
  2⤵
  PID:7892
- C:\Windows\System\pCBpBrN.exe
  C:\Windows\System\pCBpBrN.exe
  2⤵
  PID:8868
- C:\Windows\System\AVmrqml.exe
  C:\Windows\System\AVmrqml.exe
  2⤵
  PID:9020
- C:\Windows\System\NwCsOYj.exe
  C:\Windows\System\NwCsOYj.exe
  2⤵
  PID:9092
- C:\Windows\System\DgAItCO.exe
  C:\Windows\System\DgAItCO.exe
  2⤵
  PID:8576
- C:\Windows\System\wtNWYTg.exe
  C:\Windows\System\wtNWYTg.exe
  2⤵
  PID:8920
- C:\Windows\System\CeaJdVZ.exe
  C:\Windows\System\CeaJdVZ.exe
  2⤵
  PID:8536
- C:\Windows\System\htOkUdc.exe
  C:\Windows\System\htOkUdc.exe
  2⤵
  PID:8496
- C:\Windows\System\RdvKVKh.exe
  C:\Windows\System\RdvKVKh.exe
  2⤵
  PID:9228
- C:\Windows\System\zYtJuFK.exe
  C:\Windows\System\zYtJuFK.exe
  2⤵
  PID:9244
- C:\Windows\System\qRYglyN.exe
  C:\Windows\System\qRYglyN.exe
  2⤵
  PID:9260
- C:\Windows\System\yzqTnuC.exe
  C:\Windows\System\yzqTnuC.exe
  2⤵
  PID:9300
- C:\Windows\System\YyscIQr.exe
  C:\Windows\System\YyscIQr.exe
  2⤵
  PID:9340
- C:\Windows\System\CZkogXq.exe
  C:\Windows\System\CZkogXq.exe
  2⤵
  PID:9356
- C:\Windows\System\HssjASg.exe
  C:\Windows\System\HssjASg.exe
  2⤵
  PID:9376
- C:\Windows\System\cTceFOE.exe
  C:\Windows\System\cTceFOE.exe
  2⤵
  PID:9392
- C:\Windows\System\bIVyhWR.exe
  C:\Windows\System\bIVyhWR.exe
  2⤵
  PID:9412
- C:\Windows\System\gTXqNMk.exe
  C:\Windows\System\gTXqNMk.exe
  2⤵
  PID:9432
- C:\Windows\System\qUcdOpo.exe
  C:\Windows\System\qUcdOpo.exe
  2⤵
  PID:9448
- C:\Windows\System\pKUfamb.exe
  C:\Windows\System\pKUfamb.exe
  2⤵
  PID:9464
- C:\Windows\System\GohNPPs.exe
  C:\Windows\System\GohNPPs.exe
  2⤵
  PID:9480
- C:\Windows\System\dDgsnBG.exe
  C:\Windows\System\dDgsnBG.exe
  2⤵
  PID:9496
- C:\Windows\System\YElTRMa.exe
  C:\Windows\System\YElTRMa.exe
  2⤵
  PID:9516
- C:\Windows\System\CMAVlPf.exe
  C:\Windows\System\CMAVlPf.exe
  2⤵
  PID:9552
- C:\Windows\System\cxGmESd.exe
  C:\Windows\System\cxGmESd.exe
  2⤵
  PID:9580
- C:\Windows\System\NGdSqre.exe
  C:\Windows\System\NGdSqre.exe
  2⤵
  PID:9608
- C:\Windows\System\nZdvtLc.exe
  C:\Windows\System\nZdvtLc.exe
  2⤵
  PID:9628
- C:\Windows\System\ApxVBZk.exe
  C:\Windows\System\ApxVBZk.exe
  2⤵
  PID:9644
- C:\Windows\System\zyyVdGq.exe
  C:\Windows\System\zyyVdGq.exe
  2⤵
  PID:9664
- C:\Windows\System\RfgZBdA.exe
  C:\Windows\System\RfgZBdA.exe
  2⤵
  PID:9684
- C:\Windows\System\rvTBYYl.exe
  C:\Windows\System\rvTBYYl.exe
  2⤵
  PID:9704
- C:\Windows\System\GmbsrRA.exe
  C:\Windows\System\GmbsrRA.exe
  2⤵
  PID:9724
- C:\Windows\System\hNOgMek.exe
  C:\Windows\System\hNOgMek.exe
  2⤵
  PID:9740
- C:\Windows\System\KVtZMek.exe
  C:\Windows\System\KVtZMek.exe
  2⤵
  PID:9760
- C:\Windows\System\HgVUtaU.exe
  C:\Windows\System\HgVUtaU.exe
  2⤵
  PID:9788
- C:\Windows\System\JQXTNUF.exe
  C:\Windows\System\JQXTNUF.exe
  2⤵
  PID:9804
- C:\Windows\System\QzUNeyQ.exe
  C:\Windows\System\QzUNeyQ.exe
  2⤵
  PID:9824
- C:\Windows\System\dSlzXbq.exe
  C:\Windows\System\dSlzXbq.exe
  2⤵
  PID:9848
- C:\Windows\System\nwOtzUQ.exe
  C:\Windows\System\nwOtzUQ.exe
  2⤵
  PID:9868
- C:\Windows\System\DcNWNbJ.exe
  C:\Windows\System\DcNWNbJ.exe
  2⤵
  PID:9888
- C:\Windows\System\dIoEBle.exe
  C:\Windows\System\dIoEBle.exe
  2⤵
  PID:9912
- C:\Windows\System\MPDmuNV.exe
  C:\Windows\System\MPDmuNV.exe
  2⤵
  PID:9928
- C:\Windows\System\vtJYTGI.exe
  C:\Windows\System\vtJYTGI.exe
  2⤵
  PID:9952
- C:\Windows\System\JguoMEm.exe
  C:\Windows\System\JguoMEm.exe
  2⤵
  PID:9968
- C:\Windows\System\HmsCEwX.exe
  C:\Windows\System\HmsCEwX.exe
  2⤵
  PID:9988
- C:\Windows\System\tlWVVLL.exe
  C:\Windows\System\tlWVVLL.exe
  2⤵
  PID:10008
- C:\Windows\System\JWLbbTW.exe
  C:\Windows\System\JWLbbTW.exe
  2⤵
  PID:10028
- C:\Windows\System\ZsXsCtF.exe
  C:\Windows\System\ZsXsCtF.exe
  2⤵
  PID:10048
- C:\Windows\System\zWSyYlA.exe
  C:\Windows\System\zWSyYlA.exe
  2⤵
  PID:10068
- C:\Windows\System\XExOxWe.exe
  C:\Windows\System\XExOxWe.exe
  2⤵
  PID:10084
- C:\Windows\System\YTVJfYy.exe
  C:\Windows\System\YTVJfYy.exe
  2⤵
  PID:10108
- C:\Windows\System\DKYiKAU.exe
  C:\Windows\System\DKYiKAU.exe
  2⤵
  PID:10128
- C:\Windows\System\UtBCdnT.exe
  C:\Windows\System\UtBCdnT.exe
  2⤵
  PID:10144
- C:\Windows\System\FctJpTG.exe
  C:\Windows\System\FctJpTG.exe
  2⤵
  PID:10164
- C:\Windows\System\yVaUWFf.exe
  C:\Windows\System\yVaUWFf.exe
  2⤵
  PID:10184
- C:\Windows\System\ppfjFBW.exe
  C:\Windows\System\ppfjFBW.exe
  2⤵
  PID:10204
- C:\Windows\System\hjqJheX.exe
  C:\Windows\System\hjqJheX.exe
  2⤵
  PID:10220
- C:\Windows\System\WzYwJVR.exe
  C:\Windows\System\WzYwJVR.exe
  2⤵
  PID:9224
- C:\Windows\System\qdMfwmN.exe
  C:\Windows\System\qdMfwmN.exe
  2⤵
  PID:9280
- C:\Windows\System\MDWbqKH.exe
  C:\Windows\System\MDWbqKH.exe
  2⤵
  PID:9004
- C:\Windows\System\JYQvsJG.exe
  C:\Windows\System\JYQvsJG.exe
  2⤵
  PID:9240
- C:\Windows\System\XXjDIHK.exe
  C:\Windows\System\XXjDIHK.exe
  2⤵
  PID:9276
- C:\Windows\System\gkgRIqn.exe
  C:\Windows\System\gkgRIqn.exe
  2⤵
  PID:9316
- C:\Windows\System\Ogcazcn.exe
  C:\Windows\System\Ogcazcn.exe
  2⤵
  PID:8588
- C:\Windows\System\aQzGEQc.exe
  C:\Windows\System\aQzGEQc.exe
  2⤵
  PID:9364
- C:\Windows\System\dUJNDMy.exe
  C:\Windows\System\dUJNDMy.exe
  2⤵
  PID:9404
- C:\Windows\System\vtwQrZU.exe
  C:\Windows\System\vtwQrZU.exe
  2⤵
  PID:9476
- C:\Windows\System\gqZJwOp.exe
  C:\Windows\System\gqZJwOp.exe
  2⤵
  PID:9424
- C:\Windows\System\kXRHoSm.exe
  C:\Windows\System\kXRHoSm.exe
  2⤵
  PID:9420
- C:\Windows\System\XEtyRvl.exe
  C:\Windows\System\XEtyRvl.exe
  2⤵
  PID:9548
- C:\Windows\System\TXDBXKz.exe
  C:\Windows\System\TXDBXKz.exe
  2⤵
  PID:9576
- C:\Windows\System\iiDkBIB.exe
  C:\Windows\System\iiDkBIB.exe
  2⤵
  PID:9600
- C:\Windows\System\ZirjoXN.exe
  C:\Windows\System\ZirjoXN.exe
  2⤵
  PID:9620
- C:\Windows\System\dghLZSf.exe
  C:\Windows\System\dghLZSf.exe
  2⤵
  PID:9656
- C:\Windows\System\bWoiSEI.exe
  C:\Windows\System\bWoiSEI.exe
  2⤵
  PID:9604
- C:\Windows\System\ZZBmVix.exe
  C:\Windows\System\ZZBmVix.exe
  2⤵
  PID:9716
- C:\Windows\System\tqmhGEg.exe
  C:\Windows\System\tqmhGEg.exe
  2⤵
  PID:9736
- C:\Windows\System\bTNtTQz.exe
  C:\Windows\System\bTNtTQz.exe
  2⤵
  PID:9796
- C:\Windows\System\SpuZyRb.exe
  C:\Windows\System\SpuZyRb.exe
  2⤵
  PID:9832
- C:\Windows\System\PWEoTOa.exe
  C:\Windows\System\PWEoTOa.exe
  2⤵
  PID:9860
- C:\Windows\System\XvDEDwl.exe
  C:\Windows\System\XvDEDwl.exe
  2⤵
  PID:9884
- C:\Windows\System\yhpnIpR.exe
  C:\Windows\System\yhpnIpR.exe
  2⤵
  PID:9908
- C:\Windows\System\ZtrlZSX.exe
  C:\Windows\System\ZtrlZSX.exe
  2⤵
  PID:9944
- C:\Windows\System\VUjNRZy.exe
  C:\Windows\System\VUjNRZy.exe
  2⤵
  PID:9984
- C:\Windows\System\PjoWFps.exe
  C:\Windows\System\PjoWFps.exe
  2⤵
  PID:10036
- C:\Windows\System\hrMGcab.exe
  C:\Windows\System\hrMGcab.exe
  2⤵
  PID:10060
- C:\Windows\System\kCSZvGC.exe
  C:\Windows\System\kCSZvGC.exe
  2⤵
  PID:10096
- C:\Windows\System\aJzmXjZ.exe
  C:\Windows\System\aJzmXjZ.exe
  2⤵
  PID:10124
- C:\Windows\System\xSeNSQD.exe
  C:\Windows\System\xSeNSQD.exe
  2⤵
  PID:10156
- C:\Windows\System\nmvOfxo.exe
  C:\Windows\System\nmvOfxo.exe
  2⤵
  PID:10212
- C:\Windows\System\TVmWTNR.exe
  C:\Windows\System\TVmWTNR.exe
  2⤵
  PID:9220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CYGUFGl.exe

Filesize
2.3MB

MD5
2c07f03b0deccee0d3f140c43e794a3e

SHA1
8d997c39d75ab80cddc96d034da1ee489fb9227e

SHA256
4ec7d9d2f1d46feabc766f1c562a41180802f9a9236d0659af74e54d194dc912

SHA512
9e12a1711453f04b5c9f22b0fec4a79fd6efb3d57e512bc1fac6889f35042fc87a1438afe0dbadea7e1e36427913e379029aef39c2c500eb82c0a1bdeed49053

Download Submit
C:\Windows\system\CxtKPnu.exe

Filesize
2.3MB

MD5
b1224e52508363356e946f6d25de0c68

SHA1
f76425c02e84dfcc1ee889e4776eaa39d688bf5e

SHA256
ab001101383a796d109c1082eb20c4df70a45ae38e732bea8eb8fec48994a187

SHA512
f9be5a49f078c109746ba12d435af705b626b9572e48cbc539449914a0e6400341c66fc54754e714ac50f068f48168fab1f0fe9549850e6310ebaa4bda5d9866

Download Submit
C:\Windows\system\EcnThGr.exe

Filesize
2.3MB

MD5
a365cd2910101d3b03c0b6108e9484c5

SHA1
38f16028ef26ac0d0147fc67f7bab558756618b9

SHA256
8a1e582d1698b15b90e872b39f68e9010bcabedf66813b83190b8ff4d37080c2

SHA512
d426563103a668aee7dd693225edc067756de6487de0fa7dc52e07824082bcd8e1172492921a54229b6185aea7e58303f0a3226402df51e367d4bc75f422265a

Download Submit
C:\Windows\system\FLWxRXK.exe

Filesize
2.3MB

MD5
908ba1c75e4311f7aad323695e1f9006

SHA1
4bccc04dc1d4b82e1d81f11ce7255027405ca27d

SHA256
9f001ce654ec4f4951d455ddae526752326f94efcf563a04dad0490a75c07acb

SHA512
746e366bebc83dc6c02a29749ca34b3003714a049a86898be6bdfd49370d075f3dd453070fe03da3b41537ca85b4e93c22a5c1f62738236870351e0df35875c9

Download Submit
C:\Windows\system\IRcjBMt.exe

Filesize
2.3MB

MD5
7e3a8e515a4c5af64a5b6ab21a9c0803

SHA1
67c533d7cfb1d6760fad39c2131567afb77bf6f5

SHA256
a1a678c3fee3640f772c48a45a1094ce7cee9608ee78da9e6f0550a330579039

SHA512
fd8efe109eafdcdd27a9c9699bacda95adfb4b51023d16dc3ae38a6186f9a515b9dc3fba580add71c0dc20fd17dff0754d1e12293014d7b88ccc13da9be3590a

Download Submit
C:\Windows\system\IZiNfoH.exe

Filesize
2.3MB

MD5
c06e1a09f519bf336e12f4d193f3a501

SHA1
ca601bf14da8b61780fe8b68ce08e6dcfd2d18fd

SHA256
bf812e029339ec6595268ae0fa74334f8fcc7a8c870673c2134870c8c71c93ce

SHA512
3885758e6bb4dfbe988a33f3fddcdb8426241946142ea7d9a924c2707a54519d434c987232aaa6ab25b6252e73d5662a2d4bb53b4e1e4ee428cd048935692647

Download Submit
C:\Windows\system\QSubvTN.exe

Filesize
2.3MB

MD5
01a828b2a1080888a6b4ce9da90fb290

SHA1
d4f903d5ed175b9965d7414a1f910dc92d983bc8

SHA256
fd1cd60a0ca426c40f7433d75e628621d61ea2987c940d2ed9e566c4c1467f3d

SHA512
46d537d498b477eeaba9a4623e39bfbfeaec9035980498d1eca8faf8288b5a2ed5172a5fef4bcea3c74f87afb03f43fd9d73639797dcf1b5ac74e34a0fd4bf5c

Download Submit
C:\Windows\system\QiXneYs.exe

Filesize
2.3MB

MD5
7f8621e5c7f346492a9c5facf80ddb28

SHA1
ab264ce6953b140c332e3c143ee0f346f96ea81b

SHA256
d7463ceb0084480ee9eddf21b43f12e74b2e35a91c721222b91fa85b8a682851

SHA512
d0b25c1a40ddb23fe5b0b9ee97d3791eda87af7759363e12c47b41c6b6a2fc99b5564d15f4b5be02428f6c5946c9f0285cead530f06457e8a53a5067d1a8ca36

Download Submit
C:\Windows\system\SfbsoPQ.exe

Filesize
2.3MB

MD5
acd41133be242206205649e3d3ae6f78

SHA1
1519bc9f484c8af4740c743c8a87ecf95d66e251

SHA256
8366bf6c1ad911d985f9300ee9de013869829b0a0d4e51fd18e64e098edc2caa

SHA512
ec9871c0bce7e7418769fa4e2f3edb49081165a892b7d9c86df481fa759915603182756d8275a5c7d276a6ed761e00918e360c14973774e77258fa8afeb0c94d

Download Submit
C:\Windows\system\UYZCSKm.exe

Filesize
2.3MB

MD5
04d611f603bb6dfcf7ec87c74272ceec

SHA1
0873fa5239d73f5ceba88167440456cd870f9f70

SHA256
1c239db0cd7c24329c6062b43c8bb4cdc70b767d3d7b187d2719d2d399a74bf6

SHA512
9e0a54c8700aad7aae7813af008d9671c10906c7089c9bac97544ed2713f39db7f6b4b6e884f38552b441ec8294539cf3d1b87d98fce39fc83873aa1d8fbdd18

Download Submit
C:\Windows\system\UYrWxQf.exe

Filesize
2.3MB

MD5
1301fed75d6e840e4e73efa73c1d42b7

SHA1
31d79172c809bfab4b08e5dbfca7d6b5e1609e93

SHA256
0fe108de01649f62709598b6467ccd1f52485a6a3dd5c723a1c6a81eead84b49

SHA512
a3c39940fd2f50ea61c86644e5ffeb65fbc5f3b9a4cf41c4a2d823f7c01b29582dd604ee057b676a7bd24f2d6b7b235c8c206813b96172f98f2ac231d7ba7c20

Download Submit
C:\Windows\system\WIJQdEM.exe

Filesize
2.3MB

MD5
0810f6f2237a77445466901aa46fd315

SHA1
b2d1a604e72416f6f800be4f32b91d72e3b3c707

SHA256
0961f9910be3288b897b05c6f1f537932a3a34b43ae5b46077d8d057eec0cad3

SHA512
a6a538835cd6240f054e238e6a90dc7009c40904debfb8c7f351eba5e88be59fb2b0e6b13df7c7fee7ce068d6b69fe1be033e3ae9742b3cb6ac52b06b0bbb8a5

Download Submit
C:\Windows\system\WgRcNKc.exe

Filesize
2.3MB

MD5
401b8042b37f8eb67cfe946d6bb7b5eb

SHA1
8453de00e5fbcb34dbf4f5eb3df9286c224c0899

SHA256
bd467cbecde7ce03988220d449a59d59d603219d5a4d341bf9f40eacded2d9db

SHA512
119bce095685dc2e4a257b0e48a4b3d2b6d51016861a7f0534c0d84a7812429d2f83a432edeba93a2b925841875e2bee4b6eab712be5e1842261d93e78fd3da7

Download Submit
C:\Windows\system\XXQXPHN.exe

Filesize
2.3MB

MD5
198507857cfba7c53d7987d1d21ab8ac

SHA1
c912ece99230d86487f3876ce254a55a315a5616

SHA256
a001107c56bbd6eac8a70f32c209c340cbf0ae28afbf14ea9aa9383fe180b506

SHA512
07d8b83dbd80c54a1450251abc9d1b8cfc2b770b10bee2545794d5bd53c07c5c94fa184c220b9e6f894387d1849ad75e56cdff630c41e6776668bad507f79607

Download Submit
C:\Windows\system\YzncYCD.exe

Filesize
2.3MB

MD5
f04f0076958320fba906bf5ea5dc1f94

SHA1
5ad4424d1c6021df27e8d663bb07e62c4ea4e58d

SHA256
d8a0a6b5cc6fc36a02eacacaa507c9c4cb407f8e3af1cdfde08d8b1e47d26ead

SHA512
1ce70502e0c486d51c9f4eb800c24ebad617f64317aabff3d9520740a27defe36f1f8da13916f0e4b6d0962a2cb884d734cda5fa571d1660cf8b19c9f1aa3278

Download Submit
C:\Windows\system\cfohGNt.exe

Filesize
2.3MB

MD5
931fe676d58e2edea85d5b9fe6dc679b

SHA1
8c518e86cd0f85ff39191b9f21ca77e18a5cdc85

SHA256
b4bfe3a2ad73b98943f1977f65c39de4cc771c32ab00f8117ee4731a054449c9

SHA512
42107a4bb75fdbaac2fb133f654cf824f72ff92d4d091cf90030ca8a57f9de47656a5b69f0f3ed0ea6b91af51d0ba3b340fd39d458e4dc00e597ad5d0c98b7e3

Download Submit
C:\Windows\system\dpMppRe.exe

Filesize
2.3MB

MD5
c528a02937d291c233e0c9add6d840d7

SHA1
53693f3fb1814d0db3d65236211a7c5a17d1526f

SHA256
1328d28649262043a8b5ff43985cb49296a2c24d38942f3a560e1e17306630ed

SHA512
1eeffb2965dfa4d08be312e1e378b5563431f07b0879a585261f51d542f6926341ba822358977d343856433c188c9a9db65260b06a90e0e1558f4b83729bad75

Download Submit
C:\Windows\system\gwHvomF.exe

Filesize
2.3MB

MD5
f4aa18be5f637917d958bb930a4446c1

SHA1
3fa8eae68fa115546bbc12c2ba2646c6d86bcfa6

SHA256
7990f3fd2cf9082a3c70f104f7fc017e7bab96811e091cc47cd984d41faf02bd

SHA512
88945342bada8fe1023d259ebb23d56490bb1a23d4463f05545b91aa406139a815f8000353a466da261841824306e96eaa783999664c7ded0f4e553ba3411c42

Download Submit
C:\Windows\system\iwZosNa.exe

Filesize
2.3MB

MD5
88507de5e7e98159db21f5d4c690b881

SHA1
11a76c3a9ee1f1f9e30e98ce61c7dae41af8cd2a

SHA256
62144f96235aff49fc97e83dce92932cad3f77b527c99152f2d6f5d7a589734c

SHA512
7c0fdbcbbab3a7b3715b02fc799d0a41f5a1da96e49179aee184fb07a8e5cc5bd0310daf44db4b8ff08822e0cf71c8a56b1158f80b3cb2a0702f98bfa29c4550

Download Submit
C:\Windows\system\jCHnvCI.exe

Filesize
2.3MB

MD5
fc87739e98883c6e53547cc0b2c6916d

SHA1
bb74309eb83f68b6154a4eada035c907f5b98ece

SHA256
ff1cd4fa13fe853ba1b63f0026fea49ca5338860ca56eb87aadf217a7bfd309a

SHA512
78eba967de2f665ae4cbdf6fab4bd8d4d3709eacd054f1ab9e3593e8444cfaed76b3c22c7fd1e190ab86c3c78e8d7c0e90d4a79e56705ff52a2f9c3afe0d17d8

Download Submit
C:\Windows\system\nHWBFoz.exe

Filesize
2.3MB

MD5
4ec1776d9ad2f1fea78a68751ed8acf2

SHA1
6e661dc4a41fb8bacc23926d8eaccc361615f2b1

SHA256
3ab5d6e90554c585a36feb50045b9bd1b02756db017c021e8db1dc81475547ca

SHA512
78c244295fd524632073fbc4ad7d1a13244a5e1c763b1734599cac6d9a23ddf737fd36793cef8007194b7b03d0144498ea73acfdfb75f28e7f61c029b6065375

Download Submit
C:\Windows\system\rLBYZjK.exe

Filesize
2.3MB

MD5
71257219e018dd1fbb3910ba7962f823

SHA1
fcf290e59b45299b1adf256544408cedb2aad0e6

SHA256
ea76b9dd7e905ffd9e3292de0895470419e8b8926f42c2507231daa207357720

SHA512
b3e8d309ac0e5d0ec4aec8a08f9e154834a1d018257afac6620e11351f51903e152120688b272328a471b4664e5c1379a764fca9d9956365bfc5ee0c839f938c

Download Submit
C:\Windows\system\rTOFjZt.exe

Filesize
2.3MB

MD5
c7d2138b946e6271f791c0b4ac1882b9

SHA1
8d82281456c0662411f0f2a8e24aaa592ce7f36a

SHA256
61db834b5eceeb42a69dd7b7b339bd2242ca8a00b8e893b9755ced336751b86e

SHA512
1e3faf8bb1a41e05647c0ca4cdd213c707f847da08ae3e8d5979c996302e975c318d3b414c5a899e26a934730e957d95b40884f6a027c11b7d0c85adbf63e754

Download Submit
C:\Windows\system\vDEMAAh.exe

Filesize
2.3MB

MD5
5a83e876e724ea4f83a68881f33d2911

SHA1
f6a6a8ea96a38216d65834bf7b06156dcd552c00

SHA256
529d181d4c0036a7b031068ffb55a6e38f96a731a3cceaee13e5fa475bb281da

SHA512
9fbbfeec3338a37f2511ecf87c5fca5329f10ced7e59eafcd81719f1ffa53ae7f1e579e769ae76fc69fb96816df9d871082d8e34c9fd89ea794e47c900f0cc2b

Download Submit
C:\Windows\system\xyvIqWX.exe

Filesize
2.3MB

MD5
c06b29d9394584008a034535e1e287be

SHA1
011f3691093ae50b966ace105f321657a80d46af

SHA256
878f555a8b78376fa27625f850d3d1e9faafe746e6e5ada88c2cfe81da9efb23

SHA512
85a169cad3e76d18e88476b03cc39f5a693917e2ea7fe318c677467f7e4e8f085ccbd3be741afd05421de6164684608a2da9901933623668a4334a16350c7d5f

Download Submit
\Windows\system\QxWFNAX.exe

Filesize
2.3MB

MD5
d16123b57ee4cf17ced562bc809b346f

SHA1
7790c700a83d99893d8fb69a54cc776699b2b878

SHA256
c6c6c97d7c82a231f7389d1bae3d122474b160cdaa41d5e4d8abc73602c373c0

SHA512
bdaff1f7f7dda943c0ad3ffcb9e6e41c8f87203ae57f5d4b4336cb5ba9bd5c968929d3725802b11bbbcd015bb2e31bc7fd9fbb1f200f3135467a704e2276d8ac

Download Submit
\Windows\system\SmlKLtZ.exe

Filesize
2.3MB

MD5
a4479b434cc4db10b15396a388abfdc4

SHA1
262d6ec886457d0a454a507862f7c3bcd7f9973b

SHA256
76f4a1433b60783c922d0adfba91bbd06643df8b164ef7d34f5c15a16e05c9a0

SHA512
71b3bf317288df8dddbb51c319db2ac556d55d1d8f95cc8cab37a9569456da58ee80e1f81eb2f80b6ba5f0811a5b6f76789e69f91eb0dbb0918163b41ae6ff04

Download Submit
\Windows\system\foqNBEY.exe

Filesize
2.3MB

MD5
7f262e2aa4ed45b4310eb2b6e323e1f4

SHA1
f38b7651eb49b259cc449f667f2dd6cecdeef7cf

SHA256
787573120075de53ea117d10420dc88e32a925842713ca8f6d310327851d8bfa

SHA512
99c22c5c4be5808f271b26d1968fe565cc57ff20ffbab5d681b0f9e35830325552bd872ae903a797bb5a0a185a452c9eaa85d94d5ad47d362c73c834efdfd1fd

Download Submit
\Windows\system\hYUTYNX.exe

Filesize
2.3MB

MD5
69b5224c148e8ab6e273a7e52cf030e9

SHA1
0c07005c2426db32ec4703a974cc5a71c144ad55

SHA256
a1dc36c4217bfd238c86a2226d0df8231602bccedaa6fd4fd086d1c5b7de992a

SHA512
06dfcba95f7ed3023bc3d849e08441b982b79b130660735424a3640709857e86aef6e234bd62d6721356f7a481536e0e13dfb275a1931c0c3fe11c8b0575a5ca

Download Submit
\Windows\system\rfAFjqI.exe

Filesize
2.3MB

MD5
fd5596f8f0b58439edb5921c6d813965

SHA1
7b1d09ac1b1b5822bb1b1153fec3d8a588c2afb6

SHA256
5a20e09ad8d37e286bdb2004366c18a7d3f8f366ff964a6430d912fe1cc4a003

SHA512
1c9eebe5ceae1915f27fdb289f50a0a91c733c2cb17263d639938568d1142f7c2f8ac73028048e4e15ba13e90a986b6eafed8565cb081b9be1b1784c5aecdbd1

Download Submit
\Windows\system\uhskDsr.exe

Filesize
2.3MB

MD5
01b68cc3b9615397fba1e9384edb8fc2

SHA1
c828bcd414f220acb90ff54df4175102393710cf

SHA256
a884df1320526e8062af4f474e9767f154034452404b717f449b0bbaedf4ed15

SHA512
98915f1908d2fc22fd7d7af377414bac5ed60bdf894a6ddb4701663faea3257518879a574b8919e197c1b424a245241574ab4969349648fe7bc1d48c2eab91d4

Download Submit
\Windows\system\xMELIoW.exe

Filesize
2.3MB

MD5
0e42e096a649df18ff0d527f7b709b2f

SHA1
fea9dfec58ceba5d0ce6275fee588a2b9929cd7b

SHA256
b56c85bb2063fb5dedb0b62f12ce7a44bfd266d52330b172680561a7cc6e608f

SHA512
fba1db30701de0e9cedd231143d4eba4ab74d18e7f10dd553ddb029b514ab517ef220e1126813e2d910ec8c205e175309f0f4d4df0aec8b01ea0be0da8625368

Download Submit
memory/1720-4027-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/1720-35-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2396-567-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2396-4035-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2508-4029-0x000000013F440000-0x000000013F794000-memory.dmp

Filesize
3.3MB

Download
memory/2508-507-0x000000013F440000-0x000000013F794000-memory.dmp

Filesize
3.3MB

Download
memory/2516-4034-0x000000013F900000-0x000000013FC54000-memory.dmp

Filesize
3.3MB

Download
memory/2516-565-0x000000013F900000-0x000000013FC54000-memory.dmp

Filesize
3.3MB

Download
memory/2576-511-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/2576-4031-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/2648-557-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/2648-4033-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/2748-514-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/2748-4032-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/2768-2614-0x000000013F7C0000-0x000000013FB14000-memory.dmp

Filesize
3.3MB

Download
memory/2768-4024-0x000000013F7C0000-0x000000013FB14000-memory.dmp

Filesize
3.3MB

Download
memory/2768-8-0x000000013F7C0000-0x000000013FB14000-memory.dmp

Filesize
3.3MB

Download
memory/2792-4028-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/2792-36-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/2836-571-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2836-4030-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2888-504-0x000000013F440000-0x000000013F794000-memory.dmp

Filesize
3.3MB

Download
memory/2888-3701-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2888-0-0x000000013FB20000-0x000000013FE74000-memory.dmp

Filesize
3.3MB

Download
memory/2888-510-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-513-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-566-0x000000013F2D0000-0x000000013F624000-memory.dmp

Filesize
3.3MB

Download
memory/2888-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2888-570-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-572-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-16-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-568-0x000000013F4A0000-0x000000013F7F4000-memory.dmp

Filesize
3.3MB

Download
memory/2888-2615-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-2616-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-2969-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-3668-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2888-3710-0x000000013F4A0000-0x000000013F7F4000-memory.dmp

Filesize
3.3MB

Download
memory/2888-3716-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-3696-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-3690-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/2888-501-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2888-3683-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-3679-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-3677-0x000000013F440000-0x000000013F794000-memory.dmp

Filesize
3.3MB

Download
memory/2888-4004-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-561-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-31-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2888-30-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2888-519-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/2888-26-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2924-4036-0x000000013F4A0000-0x000000013F7F4000-memory.dmp

Filesize
3.3MB

Download
memory/2924-569-0x000000013F4A0000-0x000000013F7F4000-memory.dmp

Filesize
3.3MB

Download
memory/2996-4026-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/2996-33-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/3000-503-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Filesize
3.3MB

Download
memory/3000-4037-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Filesize
3.3MB

Download
memory/3012-23-0x000000013F8B0000-0x000000013FC04000-memory.dmp

Filesize
3.3MB

Download
memory/3012-4025-0x000000013F8B0000-0x000000013FC04000-memory.dmp

Filesize
3.3MB

Download
memory/3012-2391-0x000000013F8B0000-0x000000013FC04000-memory.dmp

Filesize
3.3MB

Download