xmrig | 8f89a84190b2eb48dfab094ca66d68e846b03b74ac6bc0b2df711055d54a976c

Analysis

max time kernel
152s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
Size

2.2MB
MD5

2b2bf47ef71983707ffc123b5c37e880
SHA1

85ba0039b4133df7fda25c8ce8d02139459d5924
SHA256

8f89a84190b2eb48dfab094ca66d68e846b03b74ac6bc0b2df711055d54a976c
SHA512

13c5a9653ccf5200da30d4291a8e09bab94ed1e87a17dab92b4010e14271f487c8172db3ef812312feadca902b09453e801c34079041703cbc630ef00d72cead
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXGv4rzq6c2HAUJhCvri:BemTLkNdfE0pZrt

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3232-0-0x00007FF6CD630000-0x00007FF6CD984000-memory.dmp	xmrig
behavioral2/files/0x0008000000023256-6.dat	xmrig
behavioral2/memory/3644-8-0x00007FF6D9620000-0x00007FF6D9974000-memory.dmp	xmrig
behavioral2/files/0x0008000000023259-10.dat	xmrig
behavioral2/memory/3472-14-0x00007FF69D0B0000-0x00007FF69D404000-memory.dmp	xmrig
behavioral2/files/0x000800000002325b-17.dat	xmrig
behavioral2/memory/788-22-0x00007FF7A01B0000-0x00007FF7A0504000-memory.dmp	xmrig
behavioral2/files/0x000800000002325d-24.dat	xmrig
behavioral2/files/0x000800000002325e-29.dat	xmrig
behavioral2/memory/3824-27-0x00007FF643FC0000-0x00007FF644314000-memory.dmp	xmrig
behavioral2/files/0x000700000002325f-34.dat	xmrig
behavioral2/files/0x0007000000023260-39.dat	xmrig
behavioral2/memory/4700-42-0x00007FF6CB5A0000-0x00007FF6CB8F4000-memory.dmp	xmrig
behavioral2/memory/5020-45-0x00007FF7603A0000-0x00007FF7606F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023261-47.dat	xmrig
behavioral2/files/0x0007000000023262-52.dat	xmrig
behavioral2/files/0x0007000000023263-57.dat	xmrig
behavioral2/files/0x0007000000023264-62.dat	xmrig
behavioral2/files/0x0007000000023265-67.dat	xmrig
behavioral2/files/0x0007000000023266-72.dat	xmrig
behavioral2/files/0x0007000000023267-77.dat	xmrig
behavioral2/files/0x0007000000023268-82.dat	xmrig
behavioral2/files/0x0007000000023269-87.dat	xmrig
behavioral2/files/0x000700000002326a-92.dat	xmrig
behavioral2/files/0x000700000002326b-97.dat	xmrig
behavioral2/files/0x000700000002326c-101.dat	xmrig
behavioral2/files/0x000700000002326d-107.dat	xmrig
behavioral2/files/0x000700000002326e-111.dat	xmrig
behavioral2/files/0x000700000002326f-117.dat	xmrig
behavioral2/files/0x0007000000023270-122.dat	xmrig
behavioral2/memory/2428-128-0x00007FF66A2F0000-0x00007FF66A644000-memory.dmp	xmrig
behavioral2/memory/4172-129-0x00007FF7A7A90000-0x00007FF7A7DE4000-memory.dmp	xmrig
behavioral2/memory/212-131-0x00007FF6E9740000-0x00007FF6E9A94000-memory.dmp	xmrig
behavioral2/memory/1492-132-0x00007FF7C7260000-0x00007FF7C75B4000-memory.dmp	xmrig
behavioral2/memory/4068-135-0x00007FF675F60000-0x00007FF6762B4000-memory.dmp	xmrig
behavioral2/memory/512-138-0x00007FF799020000-0x00007FF799374000-memory.dmp	xmrig
behavioral2/memory/4076-142-0x00007FF746640000-0x00007FF746994000-memory.dmp	xmrig
behavioral2/memory/1008-144-0x00007FF60E900000-0x00007FF60EC54000-memory.dmp	xmrig
behavioral2/memory/2900-147-0x00007FF6A1F80000-0x00007FF6A22D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023271-151.dat	xmrig
behavioral2/files/0x0007000000023273-156.dat	xmrig
behavioral2/files/0x0007000000023276-171.dat	xmrig
behavioral2/files/0x0007000000023277-176.dat	xmrig
behavioral2/files/0x0007000000023275-166.dat	xmrig
behavioral2/files/0x0007000000023278-180.dat	xmrig
behavioral2/files/0x0007000000023279-186.dat	xmrig
behavioral2/files/0x0007000000023279-185.dat	xmrig
behavioral2/files/0x0007000000023274-161.dat	xmrig
behavioral2/files/0x0007000000023272-149.dat	xmrig
behavioral2/memory/2324-148-0x00007FF7029A0000-0x00007FF702CF4000-memory.dmp	xmrig
behavioral2/memory/3560-145-0x00007FF6D4480000-0x00007FF6D47D4000-memory.dmp	xmrig
behavioral2/memory/4592-140-0x00007FF7C6870000-0x00007FF7C6BC4000-memory.dmp	xmrig
behavioral2/memory/2448-139-0x00007FF7D7550000-0x00007FF7D78A4000-memory.dmp	xmrig
behavioral2/memory/4220-137-0x00007FF617820000-0x00007FF617B74000-memory.dmp	xmrig
behavioral2/memory/1964-136-0x00007FF71F7C0000-0x00007FF71FB14000-memory.dmp	xmrig
behavioral2/memory/2812-134-0x00007FF746370000-0x00007FF7466C4000-memory.dmp	xmrig
behavioral2/memory/4940-133-0x00007FF67A840000-0x00007FF67AB94000-memory.dmp	xmrig
behavioral2/memory/4760-251-0x00007FF6E7730000-0x00007FF6E7A84000-memory.dmp	xmrig
behavioral2/memory/3476-252-0x00007FF6225A0000-0x00007FF6228F4000-memory.dmp	xmrig
behavioral2/memory/4604-253-0x00007FF79BD30000-0x00007FF79C084000-memory.dmp	xmrig
behavioral2/memory/1216-250-0x00007FF6CB890000-0x00007FF6CBBE4000-memory.dmp	xmrig
behavioral2/memory/3984-130-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	xmrig
behavioral2/memory/4380-126-0x00007FF6C81D0000-0x00007FF6C8524000-memory.dmp	xmrig
behavioral2/memory/3232-600-0x00007FF6CD630000-0x00007FF6CD984000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3644	ZNpVWWb.exe
3472	cErdvNL.exe
788	XFQmVOx.exe
3824	HrbMdeF.exe
4700	SemGShe.exe
5020	aBMVHXt.exe
4380	chqYjOg.exe
3560	pEskQSH.exe
2428	vYDFYJV.exe
4172	QaFLmsr.exe
3984	zxHXgIj.exe
212	gRwQwIR.exe
1492	yGUQDtz.exe
4940	RQeGrwq.exe
2812	RRLaoph.exe
4068	hhUVwbg.exe
1964	FFgNDYz.exe
4220	WowfNIw.exe
512	UShuMFB.exe
2448	KcFBmwb.exe
4592	xSEbcXI.exe
4076	XgbcYmd.exe
1008	qzHebPb.exe
2900	FABdCsa.exe
2324	zbseiNN.exe
1216	eMOBOnH.exe
4760	wwgPWFY.exe
3476	zFDsQUo.exe
4604	EwYCPAg.exe
3424	kVLeHyr.exe
2392	aqrwVZi.exe
3800	ZidfpyI.exe
1516	OwHTdAz.exe
4612	fVWbODl.exe
4472	tBFAoov.exe
4564	cCVLqkt.exe
4988	RZsncuE.exe
3468	LUgZhpB.exe
3540	jYbpCtQ.exe
1860	qBWfycT.exe
2436	PjTPtQP.exe
1988	wgOYGGF.exe
5068	CLDGgbW.exe
1524	DZLWOQt.exe
5112	HteUPdl.exe
2092	TItCcez.exe
3648	ZlxQnDR.exe
3752	AMnKsXz.exe
3264	hzTwikW.exe
3100	AqWAnOA.exe
1804	uNuHvVy.exe
1620	KnxvYar.exe
2416	pmmSwAp.exe
2244	fcgDepl.exe
1392	yZLRgMd.exe
1544	OLaDsWz.exe
2880	CKiUeJy.exe
208	amLTSle.exe
3464	jSUPqbh.exe
1628	ClTFvtv.exe
1012	PgJRbRQ.exe
3044	TJicGaN.exe
1288	FkiMXIl.exe
4568	hvtSvmZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3232-0-0x00007FF6CD630000-0x00007FF6CD984000-memory.dmp	upx
behavioral2/files/0x0008000000023256-6.dat	upx
behavioral2/memory/3644-8-0x00007FF6D9620000-0x00007FF6D9974000-memory.dmp	upx
behavioral2/files/0x0008000000023259-10.dat	upx
behavioral2/memory/3472-14-0x00007FF69D0B0000-0x00007FF69D404000-memory.dmp	upx
behavioral2/files/0x000800000002325b-17.dat	upx
behavioral2/memory/788-22-0x00007FF7A01B0000-0x00007FF7A0504000-memory.dmp	upx
behavioral2/files/0x000800000002325d-24.dat	upx
behavioral2/files/0x000800000002325e-29.dat	upx
behavioral2/memory/3824-27-0x00007FF643FC0000-0x00007FF644314000-memory.dmp	upx
behavioral2/files/0x000700000002325f-34.dat	upx
behavioral2/files/0x0007000000023260-39.dat	upx
behavioral2/memory/4700-42-0x00007FF6CB5A0000-0x00007FF6CB8F4000-memory.dmp	upx
behavioral2/memory/5020-45-0x00007FF7603A0000-0x00007FF7606F4000-memory.dmp	upx
behavioral2/files/0x0007000000023261-47.dat	upx
behavioral2/files/0x0007000000023262-52.dat	upx
behavioral2/files/0x0007000000023263-57.dat	upx
behavioral2/files/0x0007000000023264-62.dat	upx
behavioral2/files/0x0007000000023265-67.dat	upx
behavioral2/files/0x0007000000023266-72.dat	upx
behavioral2/files/0x0007000000023267-77.dat	upx
behavioral2/files/0x0007000000023268-82.dat	upx
behavioral2/files/0x0007000000023269-87.dat	upx
behavioral2/files/0x000700000002326a-92.dat	upx
behavioral2/files/0x000700000002326b-97.dat	upx
behavioral2/files/0x000700000002326c-101.dat	upx
behavioral2/files/0x000700000002326d-107.dat	upx
behavioral2/files/0x000700000002326e-111.dat	upx
behavioral2/files/0x000700000002326f-117.dat	upx
behavioral2/files/0x0007000000023270-122.dat	upx
behavioral2/memory/2428-128-0x00007FF66A2F0000-0x00007FF66A644000-memory.dmp	upx
behavioral2/memory/4172-129-0x00007FF7A7A90000-0x00007FF7A7DE4000-memory.dmp	upx
behavioral2/memory/212-131-0x00007FF6E9740000-0x00007FF6E9A94000-memory.dmp	upx
behavioral2/memory/1492-132-0x00007FF7C7260000-0x00007FF7C75B4000-memory.dmp	upx
behavioral2/memory/4068-135-0x00007FF675F60000-0x00007FF6762B4000-memory.dmp	upx
behavioral2/memory/512-138-0x00007FF799020000-0x00007FF799374000-memory.dmp	upx
behavioral2/memory/4076-142-0x00007FF746640000-0x00007FF746994000-memory.dmp	upx
behavioral2/memory/1008-144-0x00007FF60E900000-0x00007FF60EC54000-memory.dmp	upx
behavioral2/memory/2900-147-0x00007FF6A1F80000-0x00007FF6A22D4000-memory.dmp	upx
behavioral2/files/0x0007000000023271-151.dat	upx
behavioral2/files/0x0007000000023273-156.dat	upx
behavioral2/files/0x0007000000023276-171.dat	upx
behavioral2/files/0x0007000000023277-176.dat	upx
behavioral2/files/0x0007000000023275-166.dat	upx
behavioral2/files/0x0007000000023278-180.dat	upx
behavioral2/files/0x0007000000023279-186.dat	upx
behavioral2/files/0x0007000000023279-185.dat	upx
behavioral2/files/0x0007000000023274-161.dat	upx
behavioral2/files/0x0007000000023272-149.dat	upx
behavioral2/memory/2324-148-0x00007FF7029A0000-0x00007FF702CF4000-memory.dmp	upx
behavioral2/memory/3560-145-0x00007FF6D4480000-0x00007FF6D47D4000-memory.dmp	upx
behavioral2/memory/4592-140-0x00007FF7C6870000-0x00007FF7C6BC4000-memory.dmp	upx
behavioral2/memory/2448-139-0x00007FF7D7550000-0x00007FF7D78A4000-memory.dmp	upx
behavioral2/memory/4220-137-0x00007FF617820000-0x00007FF617B74000-memory.dmp	upx
behavioral2/memory/1964-136-0x00007FF71F7C0000-0x00007FF71FB14000-memory.dmp	upx
behavioral2/memory/2812-134-0x00007FF746370000-0x00007FF7466C4000-memory.dmp	upx
behavioral2/memory/4940-133-0x00007FF67A840000-0x00007FF67AB94000-memory.dmp	upx
behavioral2/memory/4760-251-0x00007FF6E7730000-0x00007FF6E7A84000-memory.dmp	upx
behavioral2/memory/3476-252-0x00007FF6225A0000-0x00007FF6228F4000-memory.dmp	upx
behavioral2/memory/4604-253-0x00007FF79BD30000-0x00007FF79C084000-memory.dmp	upx
behavioral2/memory/1216-250-0x00007FF6CB890000-0x00007FF6CBBE4000-memory.dmp	upx
behavioral2/memory/3984-130-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	upx
behavioral2/memory/4380-126-0x00007FF6C81D0000-0x00007FF6C8524000-memory.dmp	upx
behavioral2/memory/3232-600-0x00007FF6CD630000-0x00007FF6CD984000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RmFdeoJ.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\GEkEvaG.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\rzlBEeL.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\QpZRAaC.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\nofTMVC.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\qAxytiA.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\iaNRrJO.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\IijmwNg.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\fTUxGAU.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\rEMRdbp.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\ENjaPdj.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\XneaspF.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\osKJfoT.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\SmFVFbA.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\XQDOIoX.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\FUAoKno.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\RLszSGd.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\fnDlYAW.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\miuBxcx.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\sGSXLgP.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\dNAGPEj.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\qKLHQRj.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\FaAexjV.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\UkSrUvX.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\eONwOMe.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\DMFVweR.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\EzxxxSg.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\HKTYcZf.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\xYDCeCc.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\gSeOhvX.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\lpbqUAM.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\jzmQzrb.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\PUqFegr.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\sKEoWyJ.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\nrxpXBu.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\fkmTWRv.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\zXYeaCe.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\cSylNIr.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\cnofsxM.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\iOkmvnP.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\wShukoM.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\JiyWGXb.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\LsbjbEo.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\ABqbjQV.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\xoiJfuv.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\fcgDepl.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\OTSAYQv.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\TiwsExy.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\FwOKnwN.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\yYZBdld.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\UASGalQ.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\oSIiYJu.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\gfwLcoo.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\ADyObkQ.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\BKhqugV.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\ulXISlw.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\LfLldft.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\vhTvkIH.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\XhCsVZo.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\blNnasG.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\SMXaJhM.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\PZYrXuI.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\knikstg.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
File created	C:\Windows\System\aVDomMx.exe	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3644	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	92
PID 3232 wrote to memory of 3644	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	92
PID 3232 wrote to memory of 3472	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	93
PID 3232 wrote to memory of 3472	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	93
PID 3232 wrote to memory of 788	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	94
PID 3232 wrote to memory of 788	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	94
PID 3232 wrote to memory of 3824	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	95
PID 3232 wrote to memory of 3824	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	95
PID 3232 wrote to memory of 4700	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	96
PID 3232 wrote to memory of 4700	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	96
PID 3232 wrote to memory of 5020	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	97
PID 3232 wrote to memory of 5020	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	97
PID 3232 wrote to memory of 4380	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	98
PID 3232 wrote to memory of 4380	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	98
PID 3232 wrote to memory of 3560	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	99
PID 3232 wrote to memory of 3560	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	99
PID 3232 wrote to memory of 2428	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	100
PID 3232 wrote to memory of 2428	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	100
PID 3232 wrote to memory of 4172	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	101
PID 3232 wrote to memory of 4172	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	101
PID 3232 wrote to memory of 3984	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	102
PID 3232 wrote to memory of 3984	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	102
PID 3232 wrote to memory of 212	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	103
PID 3232 wrote to memory of 212	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	103
PID 3232 wrote to memory of 1492	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	104
PID 3232 wrote to memory of 1492	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	104
PID 3232 wrote to memory of 4940	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	105
PID 3232 wrote to memory of 4940	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	105
PID 3232 wrote to memory of 2812	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	106
PID 3232 wrote to memory of 2812	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	106
PID 3232 wrote to memory of 4068	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	107
PID 3232 wrote to memory of 4068	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	107
PID 3232 wrote to memory of 1964	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	108
PID 3232 wrote to memory of 1964	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	108
PID 3232 wrote to memory of 4220	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	109
PID 3232 wrote to memory of 4220	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	109
PID 3232 wrote to memory of 512	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	110
PID 3232 wrote to memory of 512	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	110
PID 3232 wrote to memory of 2448	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	111
PID 3232 wrote to memory of 2448	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	111
PID 3232 wrote to memory of 4592	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	112
PID 3232 wrote to memory of 4592	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	112
PID 3232 wrote to memory of 4076	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	113
PID 3232 wrote to memory of 4076	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	113
PID 3232 wrote to memory of 1008	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	114
PID 3232 wrote to memory of 1008	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	114
PID 3232 wrote to memory of 2900	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	115
PID 3232 wrote to memory of 2900	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	115
PID 3232 wrote to memory of 2324	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	116
PID 3232 wrote to memory of 2324	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	116
PID 3232 wrote to memory of 1216	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	117
PID 3232 wrote to memory of 1216	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	117
PID 3232 wrote to memory of 4760	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	118
PID 3232 wrote to memory of 4760	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	118
PID 3232 wrote to memory of 3476	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	119
PID 3232 wrote to memory of 3476	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	119
PID 3232 wrote to memory of 4604	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	120
PID 3232 wrote to memory of 4604	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	120
PID 3232 wrote to memory of 3424	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	121
PID 3232 wrote to memory of 3424	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	121
PID 3232 wrote to memory of 2392	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	122
PID 3232 wrote to memory of 2392	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	122
PID 3232 wrote to memory of 3800	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	123
PID 3232 wrote to memory of 3800	3232	2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2b2bf47ef71983707ffc123b5c37e880_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\System\ZNpVWWb.exe
  C:\Windows\System\ZNpVWWb.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\cErdvNL.exe
  C:\Windows\System\cErdvNL.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\XFQmVOx.exe
  C:\Windows\System\XFQmVOx.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\HrbMdeF.exe
  C:\Windows\System\HrbMdeF.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\SemGShe.exe
  C:\Windows\System\SemGShe.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\aBMVHXt.exe
  C:\Windows\System\aBMVHXt.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\chqYjOg.exe
  C:\Windows\System\chqYjOg.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\pEskQSH.exe
  C:\Windows\System\pEskQSH.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\vYDFYJV.exe
  C:\Windows\System\vYDFYJV.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\QaFLmsr.exe
  C:\Windows\System\QaFLmsr.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\zxHXgIj.exe
  C:\Windows\System\zxHXgIj.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\gRwQwIR.exe
  C:\Windows\System\gRwQwIR.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\yGUQDtz.exe
  C:\Windows\System\yGUQDtz.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\RQeGrwq.exe
  C:\Windows\System\RQeGrwq.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\RRLaoph.exe
  C:\Windows\System\RRLaoph.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\hhUVwbg.exe
  C:\Windows\System\hhUVwbg.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\FFgNDYz.exe
  C:\Windows\System\FFgNDYz.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\WowfNIw.exe
  C:\Windows\System\WowfNIw.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\UShuMFB.exe
  C:\Windows\System\UShuMFB.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\KcFBmwb.exe
  C:\Windows\System\KcFBmwb.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\xSEbcXI.exe
  C:\Windows\System\xSEbcXI.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\XgbcYmd.exe
  C:\Windows\System\XgbcYmd.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\qzHebPb.exe
  C:\Windows\System\qzHebPb.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\FABdCsa.exe
  C:\Windows\System\FABdCsa.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\zbseiNN.exe
  C:\Windows\System\zbseiNN.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\eMOBOnH.exe
  C:\Windows\System\eMOBOnH.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\wwgPWFY.exe
  C:\Windows\System\wwgPWFY.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\zFDsQUo.exe
  C:\Windows\System\zFDsQUo.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\EwYCPAg.exe
  C:\Windows\System\EwYCPAg.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\kVLeHyr.exe
  C:\Windows\System\kVLeHyr.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\aqrwVZi.exe
  C:\Windows\System\aqrwVZi.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\ZidfpyI.exe
  C:\Windows\System\ZidfpyI.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\OwHTdAz.exe
  C:\Windows\System\OwHTdAz.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\fVWbODl.exe
  C:\Windows\System\fVWbODl.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\tBFAoov.exe
  C:\Windows\System\tBFAoov.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\cCVLqkt.exe
  C:\Windows\System\cCVLqkt.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\RZsncuE.exe
  C:\Windows\System\RZsncuE.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\LUgZhpB.exe
  C:\Windows\System\LUgZhpB.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\jYbpCtQ.exe
  C:\Windows\System\jYbpCtQ.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\qBWfycT.exe
  C:\Windows\System\qBWfycT.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\PjTPtQP.exe
  C:\Windows\System\PjTPtQP.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\wgOYGGF.exe
  C:\Windows\System\wgOYGGF.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\CLDGgbW.exe
  C:\Windows\System\CLDGgbW.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\DZLWOQt.exe
  C:\Windows\System\DZLWOQt.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\HteUPdl.exe
  C:\Windows\System\HteUPdl.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\TItCcez.exe
  C:\Windows\System\TItCcez.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\ZlxQnDR.exe
  C:\Windows\System\ZlxQnDR.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\AMnKsXz.exe
  C:\Windows\System\AMnKsXz.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\hzTwikW.exe
  C:\Windows\System\hzTwikW.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\AqWAnOA.exe
  C:\Windows\System\AqWAnOA.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\uNuHvVy.exe
  C:\Windows\System\uNuHvVy.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\KnxvYar.exe
  C:\Windows\System\KnxvYar.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\pmmSwAp.exe
  C:\Windows\System\pmmSwAp.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\fcgDepl.exe
  C:\Windows\System\fcgDepl.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\yZLRgMd.exe
  C:\Windows\System\yZLRgMd.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\OLaDsWz.exe
  C:\Windows\System\OLaDsWz.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\CKiUeJy.exe
  C:\Windows\System\CKiUeJy.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\amLTSle.exe
  C:\Windows\System\amLTSle.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\jSUPqbh.exe
  C:\Windows\System\jSUPqbh.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\ClTFvtv.exe
  C:\Windows\System\ClTFvtv.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\PgJRbRQ.exe
  C:\Windows\System\PgJRbRQ.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\TJicGaN.exe
  C:\Windows\System\TJicGaN.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\FkiMXIl.exe
  C:\Windows\System\FkiMXIl.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\hvtSvmZ.exe
  C:\Windows\System\hvtSvmZ.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\aNvhUDm.exe
  C:\Windows\System\aNvhUDm.exe
  2⤵
  PID:392
- C:\Windows\System\yvoQNLb.exe
  C:\Windows\System\yvoQNLb.exe
  2⤵
  PID:2308
- C:\Windows\System\jSFQzxa.exe
  C:\Windows\System\jSFQzxa.exe
  2⤵
  PID:1564
- C:\Windows\System\XAquIcQ.exe
  C:\Windows\System\XAquIcQ.exe
  2⤵
  PID:2340
- C:\Windows\System\vnoNaAw.exe
  C:\Windows\System\vnoNaAw.exe
  2⤵
  PID:4584
- C:\Windows\System\PgqKoIZ.exe
  C:\Windows\System\PgqKoIZ.exe
  2⤵
  PID:1880
- C:\Windows\System\gkmJBwZ.exe
  C:\Windows\System\gkmJBwZ.exe
  2⤵
  PID:2620
- C:\Windows\System\xAGCfmt.exe
  C:\Windows\System\xAGCfmt.exe
  2⤵
  PID:3896
- C:\Windows\System\WADGych.exe
  C:\Windows\System\WADGych.exe
  2⤵
  PID:4080
- C:\Windows\System\djDLDsP.exe
  C:\Windows\System\djDLDsP.exe
  2⤵
  PID:976
- C:\Windows\System\AcCeXQs.exe
  C:\Windows\System\AcCeXQs.exe
  2⤵
  PID:812
- C:\Windows\System\UxEGAcr.exe
  C:\Windows\System\UxEGAcr.exe
  2⤵
  PID:3396
- C:\Windows\System\LArvoUw.exe
  C:\Windows\System\LArvoUw.exe
  2⤵
  PID:4640
- C:\Windows\System\pgVPqtf.exe
  C:\Windows\System\pgVPqtf.exe
  2⤵
  PID:4712
- C:\Windows\System\CNflYzJ.exe
  C:\Windows\System\CNflYzJ.exe
  2⤵
  PID:1692
- C:\Windows\System\MFuvJCN.exe
  C:\Windows\System\MFuvJCN.exe
  2⤵
  PID:1136
- C:\Windows\System\GIZenym.exe
  C:\Windows\System\GIZenym.exe
  2⤵
  PID:3716
- C:\Windows\System\snCJINV.exe
  C:\Windows\System\snCJINV.exe
  2⤵
  PID:2960
- C:\Windows\System\jOodZic.exe
  C:\Windows\System\jOodZic.exe
  2⤵
  PID:5148
- C:\Windows\System\cRiqQet.exe
  C:\Windows\System\cRiqQet.exe
  2⤵
  PID:5176
- C:\Windows\System\yYZBdld.exe
  C:\Windows\System\yYZBdld.exe
  2⤵
  PID:5204
- C:\Windows\System\tRVvyLi.exe
  C:\Windows\System\tRVvyLi.exe
  2⤵
  PID:5244
- C:\Windows\System\zBHyrfK.exe
  C:\Windows\System\zBHyrfK.exe
  2⤵
  PID:5260
- C:\Windows\System\uKDnuwN.exe
  C:\Windows\System\uKDnuwN.exe
  2⤵
  PID:5292
- C:\Windows\System\Lqdlmra.exe
  C:\Windows\System\Lqdlmra.exe
  2⤵
  PID:5320
- C:\Windows\System\AXeuuQk.exe
  C:\Windows\System\AXeuuQk.exe
  2⤵
  PID:5348
- C:\Windows\System\HxkyHmr.exe
  C:\Windows\System\HxkyHmr.exe
  2⤵
  PID:5376
- C:\Windows\System\tEnIGeD.exe
  C:\Windows\System\tEnIGeD.exe
  2⤵
  PID:5404
- C:\Windows\System\RordFPG.exe
  C:\Windows\System\RordFPG.exe
  2⤵
  PID:5436
- C:\Windows\System\JdHlwWh.exe
  C:\Windows\System\JdHlwWh.exe
  2⤵
  PID:5464
- C:\Windows\System\ToTBZMq.exe
  C:\Windows\System\ToTBZMq.exe
  2⤵
  PID:5492
- C:\Windows\System\QXSrLQI.exe
  C:\Windows\System\QXSrLQI.exe
  2⤵
  PID:5520
- C:\Windows\System\JYtnHaF.exe
  C:\Windows\System\JYtnHaF.exe
  2⤵
  PID:5548
- C:\Windows\System\NluXAKI.exe
  C:\Windows\System\NluXAKI.exe
  2⤵
  PID:5576
- C:\Windows\System\hSgWKFn.exe
  C:\Windows\System\hSgWKFn.exe
  2⤵
  PID:5604
- C:\Windows\System\abxBtjT.exe
  C:\Windows\System\abxBtjT.exe
  2⤵
  PID:5632
- C:\Windows\System\TxytEQu.exe
  C:\Windows\System\TxytEQu.exe
  2⤵
  PID:5664
- C:\Windows\System\XKDziqM.exe
  C:\Windows\System\XKDziqM.exe
  2⤵
  PID:5692
- C:\Windows\System\bwKkiON.exe
  C:\Windows\System\bwKkiON.exe
  2⤵
  PID:5720
- C:\Windows\System\xxSqxZZ.exe
  C:\Windows\System\xxSqxZZ.exe
  2⤵
  PID:5740
- C:\Windows\System\OkbNYiM.exe
  C:\Windows\System\OkbNYiM.exe
  2⤵
  PID:5760
- C:\Windows\System\jTxbqhJ.exe
  C:\Windows\System\jTxbqhJ.exe
  2⤵
  PID:5792
- C:\Windows\System\hwXrNHl.exe
  C:\Windows\System\hwXrNHl.exe
  2⤵
  PID:5824
- C:\Windows\System\EyGpADj.exe
  C:\Windows\System\EyGpADj.exe
  2⤵
  PID:5860
- C:\Windows\System\jMLxwKW.exe
  C:\Windows\System\jMLxwKW.exe
  2⤵
  PID:5888
- C:\Windows\System\PbUZtOz.exe
  C:\Windows\System\PbUZtOz.exe
  2⤵
  PID:5916
- C:\Windows\System\ocaYSlT.exe
  C:\Windows\System\ocaYSlT.exe
  2⤵
  PID:5944
- C:\Windows\System\ceBrsxZ.exe
  C:\Windows\System\ceBrsxZ.exe
  2⤵
  PID:5972
- C:\Windows\System\UdtWtHg.exe
  C:\Windows\System\UdtWtHg.exe
  2⤵
  PID:6000
- C:\Windows\System\CbjXXFM.exe
  C:\Windows\System\CbjXXFM.exe
  2⤵
  PID:6028
- C:\Windows\System\hKDfRkw.exe
  C:\Windows\System\hKDfRkw.exe
  2⤵
  PID:6056
- C:\Windows\System\PUTsOkL.exe
  C:\Windows\System\PUTsOkL.exe
  2⤵
  PID:6084
- C:\Windows\System\UigrcVP.exe
  C:\Windows\System\UigrcVP.exe
  2⤵
  PID:6128
- C:\Windows\System\YVfRAYM.exe
  C:\Windows\System\YVfRAYM.exe
  2⤵
  PID:3128
- C:\Windows\System\AdDbqSD.exe
  C:\Windows\System\AdDbqSD.exe
  2⤵
  PID:5192
- C:\Windows\System\GNHytLh.exe
  C:\Windows\System\GNHytLh.exe
  2⤵
  PID:5256
- C:\Windows\System\fbKMclc.exe
  C:\Windows\System\fbKMclc.exe
  2⤵
  PID:5316
- C:\Windows\System\iQzyBwU.exe
  C:\Windows\System\iQzyBwU.exe
  2⤵
  PID:5372
- C:\Windows\System\LtApmIl.exe
  C:\Windows\System\LtApmIl.exe
  2⤵
  PID:5448
- C:\Windows\System\guavuxi.exe
  C:\Windows\System\guavuxi.exe
  2⤵
  PID:5504
- C:\Windows\System\NJmdqKh.exe
  C:\Windows\System\NJmdqKh.exe
  2⤵
  PID:5568
- C:\Windows\System\lPKhZdv.exe
  C:\Windows\System\lPKhZdv.exe
  2⤵
  PID:5628
- C:\Windows\System\cerdHsf.exe
  C:\Windows\System\cerdHsf.exe
  2⤵
  PID:5708
- C:\Windows\System\NmWhzoy.exe
  C:\Windows\System\NmWhzoy.exe
  2⤵
  PID:5752
- C:\Windows\System\ThXlORy.exe
  C:\Windows\System\ThXlORy.exe
  2⤵
  PID:5836
- C:\Windows\System\fnDlYAW.exe
  C:\Windows\System\fnDlYAW.exe
  2⤵
  PID:5908
- C:\Windows\System\uzWzGcp.exe
  C:\Windows\System\uzWzGcp.exe
  2⤵
  PID:5988
- C:\Windows\System\MgMZHHU.exe
  C:\Windows\System\MgMZHHU.exe
  2⤵
  PID:6048
- C:\Windows\System\HaKCVKA.exe
  C:\Windows\System\HaKCVKA.exe
  2⤵
  PID:6120
- C:\Windows\System\jZjktZS.exe
  C:\Windows\System\jZjktZS.exe
  2⤵
  PID:5216
- C:\Windows\System\hZQPbHv.exe
  C:\Windows\System\hZQPbHv.exe
  2⤵
  PID:5340
- C:\Windows\System\AhsnnFe.exe
  C:\Windows\System\AhsnnFe.exe
  2⤵
  PID:5484
- C:\Windows\System\Dzievpm.exe
  C:\Windows\System\Dzievpm.exe
  2⤵
  PID:5620
- C:\Windows\System\NJqFiOk.exe
  C:\Windows\System\NJqFiOk.exe
  2⤵
  PID:5756
- C:\Windows\System\ADyObkQ.exe
  C:\Windows\System\ADyObkQ.exe
  2⤵
  PID:5900
- C:\Windows\System\qDtEbdV.exe
  C:\Windows\System\qDtEbdV.exe
  2⤵
  PID:6080
- C:\Windows\System\vkKtmSU.exe
  C:\Windows\System\vkKtmSU.exe
  2⤵
  PID:5308
- C:\Windows\System\SMzotIk.exe
  C:\Windows\System\SMzotIk.exe
  2⤵
  PID:5560
- C:\Windows\System\YXeRjSq.exe
  C:\Windows\System\YXeRjSq.exe
  2⤵
  PID:5168
- C:\Windows\System\CZVmlUV.exe
  C:\Windows\System\CZVmlUV.exe
  2⤵
  PID:6040
- C:\Windows\System\ICBvWqq.exe
  C:\Windows\System\ICBvWqq.exe
  2⤵
  PID:6160
- C:\Windows\System\KYQdFGc.exe
  C:\Windows\System\KYQdFGc.exe
  2⤵
  PID:6196
- C:\Windows\System\dXTCsLi.exe
  C:\Windows\System\dXTCsLi.exe
  2⤵
  PID:6220
- C:\Windows\System\PSVDpAr.exe
  C:\Windows\System\PSVDpAr.exe
  2⤵
  PID:6252
- C:\Windows\System\uHepbKx.exe
  C:\Windows\System\uHepbKx.exe
  2⤵
  PID:6280
- C:\Windows\System\wFxpgGD.exe
  C:\Windows\System\wFxpgGD.exe
  2⤵
  PID:6308
- C:\Windows\System\pzONfkJ.exe
  C:\Windows\System\pzONfkJ.exe
  2⤵
  PID:6336
- C:\Windows\System\OQBfQWe.exe
  C:\Windows\System\OQBfQWe.exe
  2⤵
  PID:6372
- C:\Windows\System\tUMTtWs.exe
  C:\Windows\System\tUMTtWs.exe
  2⤵
  PID:6400
- C:\Windows\System\LLqQnTI.exe
  C:\Windows\System\LLqQnTI.exe
  2⤵
  PID:6428
- C:\Windows\System\lChjCqU.exe
  C:\Windows\System\lChjCqU.exe
  2⤵
  PID:6456
- C:\Windows\System\kmxwQqK.exe
  C:\Windows\System\kmxwQqK.exe
  2⤵
  PID:6484
- C:\Windows\System\WEPqBRS.exe
  C:\Windows\System\WEPqBRS.exe
  2⤵
  PID:6512
- C:\Windows\System\cluQZXL.exe
  C:\Windows\System\cluQZXL.exe
  2⤵
  PID:6540
- C:\Windows\System\FamlRVP.exe
  C:\Windows\System\FamlRVP.exe
  2⤵
  PID:6568
- C:\Windows\System\WkkRPBL.exe
  C:\Windows\System\WkkRPBL.exe
  2⤵
  PID:6596
- C:\Windows\System\tTjrZJz.exe
  C:\Windows\System\tTjrZJz.exe
  2⤵
  PID:6624
- C:\Windows\System\ilaNdRa.exe
  C:\Windows\System\ilaNdRa.exe
  2⤵
  PID:6652
- C:\Windows\System\QJkLnZW.exe
  C:\Windows\System\QJkLnZW.exe
  2⤵
  PID:6680
- C:\Windows\System\OmNIMnd.exe
  C:\Windows\System\OmNIMnd.exe
  2⤵
  PID:6708
- C:\Windows\System\SmFllCs.exe
  C:\Windows\System\SmFllCs.exe
  2⤵
  PID:6736
- C:\Windows\System\NbJhnko.exe
  C:\Windows\System\NbJhnko.exe
  2⤵
  PID:6764
- C:\Windows\System\tnoUazU.exe
  C:\Windows\System\tnoUazU.exe
  2⤵
  PID:6792
- C:\Windows\System\FfHYCZF.exe
  C:\Windows\System\FfHYCZF.exe
  2⤵
  PID:6820
- C:\Windows\System\YEdozZF.exe
  C:\Windows\System\YEdozZF.exe
  2⤵
  PID:6852
- C:\Windows\System\NUsIozg.exe
  C:\Windows\System\NUsIozg.exe
  2⤵
  PID:6868
- C:\Windows\System\HSjTEqa.exe
  C:\Windows\System\HSjTEqa.exe
  2⤵
  PID:6900
- C:\Windows\System\yKTuJGe.exe
  C:\Windows\System\yKTuJGe.exe
  2⤵
  PID:6916
- C:\Windows\System\nYtLzlZ.exe
  C:\Windows\System\nYtLzlZ.exe
  2⤵
  PID:6952
- C:\Windows\System\yUukGgp.exe
  C:\Windows\System\yUukGgp.exe
  2⤵
  PID:6980
- C:\Windows\System\ZWPUNdu.exe
  C:\Windows\System\ZWPUNdu.exe
  2⤵
  PID:7028
- C:\Windows\System\ACgBevF.exe
  C:\Windows\System\ACgBevF.exe
  2⤵
  PID:7056
- C:\Windows\System\lPafULm.exe
  C:\Windows\System\lPafULm.exe
  2⤵
  PID:7084
- C:\Windows\System\AkPUZIf.exe
  C:\Windows\System\AkPUZIf.exe
  2⤵
  PID:7112
- C:\Windows\System\IzllNCt.exe
  C:\Windows\System\IzllNCt.exe
  2⤵
  PID:7140
- C:\Windows\System\FwQJvPI.exe
  C:\Windows\System\FwQJvPI.exe
  2⤵
  PID:6152
- C:\Windows\System\qAxytiA.exe
  C:\Windows\System\qAxytiA.exe
  2⤵
  PID:6192
- C:\Windows\System\OtoAOTw.exe
  C:\Windows\System\OtoAOTw.exe
  2⤵
  PID:6276
- C:\Windows\System\rzlBEeL.exe
  C:\Windows\System\rzlBEeL.exe
  2⤵
  PID:6356
- C:\Windows\System\DMDjfgq.exe
  C:\Windows\System\DMDjfgq.exe
  2⤵
  PID:6420
- C:\Windows\System\WHlJteq.exe
  C:\Windows\System\WHlJteq.exe
  2⤵
  PID:6476
- C:\Windows\System\OTTUZvR.exe
  C:\Windows\System\OTTUZvR.exe
  2⤵
  PID:6552
- C:\Windows\System\rVmNQEk.exe
  C:\Windows\System\rVmNQEk.exe
  2⤵
  PID:6588
- C:\Windows\System\kukhWXy.exe
  C:\Windows\System\kukhWXy.exe
  2⤵
  PID:6636
- C:\Windows\System\KWJrWlx.exe
  C:\Windows\System\KWJrWlx.exe
  2⤵
  PID:6704
- C:\Windows\System\BQkqcst.exe
  C:\Windows\System\BQkqcst.exe
  2⤵
  PID:6780
- C:\Windows\System\mffifxX.exe
  C:\Windows\System\mffifxX.exe
  2⤵
  PID:6840
- C:\Windows\System\VdAmCMr.exe
  C:\Windows\System\VdAmCMr.exe
  2⤵
  PID:6940
- C:\Windows\System\nDKOwxr.exe
  C:\Windows\System\nDKOwxr.exe
  2⤵
  PID:6964
- C:\Windows\System\wHlHBoz.exe
  C:\Windows\System\wHlHBoz.exe
  2⤵
  PID:7016
- C:\Windows\System\iaNRrJO.exe
  C:\Windows\System\iaNRrJO.exe
  2⤵
  PID:7100
- C:\Windows\System\LrczhLF.exe
  C:\Windows\System\LrczhLF.exe
  2⤵
  PID:7164
- C:\Windows\System\Pihqwkj.exe
  C:\Windows\System\Pihqwkj.exe
  2⤵
  PID:6332
- C:\Windows\System\QiqmdQM.exe
  C:\Windows\System\QiqmdQM.exe
  2⤵
  PID:6500
- C:\Windows\System\YSxcQDO.exe
  C:\Windows\System\YSxcQDO.exe
  2⤵
  PID:5940
- C:\Windows\System\LfLldft.exe
  C:\Windows\System\LfLldft.exe
  2⤵
  PID:6788
- C:\Windows\System\dYvPgmv.exe
  C:\Windows\System\dYvPgmv.exe
  2⤵
  PID:6976
- C:\Windows\System\tYyqXEp.exe
  C:\Windows\System\tYyqXEp.exe
  2⤵
  PID:7076
- C:\Windows\System\MEDZBbi.exe
  C:\Windows\System\MEDZBbi.exe
  2⤵
  PID:6272
- C:\Windows\System\JtuGyrI.exe
  C:\Windows\System\JtuGyrI.exe
  2⤵
  PID:6564
- C:\Windows\System\bRXoFna.exe
  C:\Windows\System\bRXoFna.exe
  2⤵
  PID:6884
- C:\Windows\System\FnwNgEq.exe
  C:\Windows\System\FnwNgEq.exe
  2⤵
  PID:6584
- C:\Windows\System\HNUZNuA.exe
  C:\Windows\System\HNUZNuA.exe
  2⤵
  PID:6452
- C:\Windows\System\sUsYpdG.exe
  C:\Windows\System\sUsYpdG.exe
  2⤵
  PID:4204
- C:\Windows\System\QsoYEOX.exe
  C:\Windows\System\QsoYEOX.exe
  2⤵
  PID:7172
- C:\Windows\System\EbvPEui.exe
  C:\Windows\System\EbvPEui.exe
  2⤵
  PID:7196
- C:\Windows\System\sJAJwya.exe
  C:\Windows\System\sJAJwya.exe
  2⤵
  PID:7212
- C:\Windows\System\xGzpHIe.exe
  C:\Windows\System\xGzpHIe.exe
  2⤵
  PID:7240
- C:\Windows\System\GXxjMuo.exe
  C:\Windows\System\GXxjMuo.exe
  2⤵
  PID:7272
- C:\Windows\System\uxcQhyJ.exe
  C:\Windows\System\uxcQhyJ.exe
  2⤵
  PID:7312
- C:\Windows\System\OvwJGml.exe
  C:\Windows\System\OvwJGml.exe
  2⤵
  PID:7336
- C:\Windows\System\KLBhfgi.exe
  C:\Windows\System\KLBhfgi.exe
  2⤵
  PID:7364
- C:\Windows\System\BymSYmS.exe
  C:\Windows\System\BymSYmS.exe
  2⤵
  PID:7384
- C:\Windows\System\hVzdiZO.exe
  C:\Windows\System\hVzdiZO.exe
  2⤵
  PID:7416
- C:\Windows\System\LJvbOaY.exe
  C:\Windows\System\LJvbOaY.exe
  2⤵
  PID:7452
- C:\Windows\System\AkyclOC.exe
  C:\Windows\System\AkyclOC.exe
  2⤵
  PID:7480
- C:\Windows\System\TWDJOWJ.exe
  C:\Windows\System\TWDJOWJ.exe
  2⤵
  PID:7500
- C:\Windows\System\AgTPGJy.exe
  C:\Windows\System\AgTPGJy.exe
  2⤵
  PID:7528
- C:\Windows\System\FWjqJKp.exe
  C:\Windows\System\FWjqJKp.exe
  2⤵
  PID:7552
- C:\Windows\System\gqDRYZB.exe
  C:\Windows\System\gqDRYZB.exe
  2⤵
  PID:7584
- C:\Windows\System\jVLcDdW.exe
  C:\Windows\System\jVLcDdW.exe
  2⤵
  PID:7620
- C:\Windows\System\CeUxDWv.exe
  C:\Windows\System\CeUxDWv.exe
  2⤵
  PID:7636
- C:\Windows\System\bcEuwYz.exe
  C:\Windows\System\bcEuwYz.exe
  2⤵
  PID:7660
- C:\Windows\System\MZGCagM.exe
  C:\Windows\System\MZGCagM.exe
  2⤵
  PID:7692
- C:\Windows\System\sJogjLE.exe
  C:\Windows\System\sJogjLE.exe
  2⤵
  PID:7720
- C:\Windows\System\FXWinXY.exe
  C:\Windows\System\FXWinXY.exe
  2⤵
  PID:7748
- C:\Windows\System\dlAYBdT.exe
  C:\Windows\System\dlAYBdT.exe
  2⤵
  PID:7772
- C:\Windows\System\YyYkVJo.exe
  C:\Windows\System\YyYkVJo.exe
  2⤵
  PID:7804
- C:\Windows\System\bvNiyda.exe
  C:\Windows\System\bvNiyda.exe
  2⤵
  PID:7828
- C:\Windows\System\bqUbLcG.exe
  C:\Windows\System\bqUbLcG.exe
  2⤵
  PID:7860
- C:\Windows\System\hJsBllG.exe
  C:\Windows\System\hJsBllG.exe
  2⤵
  PID:7884
- C:\Windows\System\iBrOqDd.exe
  C:\Windows\System\iBrOqDd.exe
  2⤵
  PID:7912
- C:\Windows\System\XWQEsQz.exe
  C:\Windows\System\XWQEsQz.exe
  2⤵
  PID:7944
- C:\Windows\System\NcqLSyT.exe
  C:\Windows\System\NcqLSyT.exe
  2⤵
  PID:7968
- C:\Windows\System\fDxkoWe.exe
  C:\Windows\System\fDxkoWe.exe
  2⤵
  PID:7996
- C:\Windows\System\UnciGAE.exe
  C:\Windows\System\UnciGAE.exe
  2⤵
  PID:8024
- C:\Windows\System\UAKsqwJ.exe
  C:\Windows\System\UAKsqwJ.exe
  2⤵
  PID:8096
- C:\Windows\System\GXRbpBQ.exe
  C:\Windows\System\GXRbpBQ.exe
  2⤵
  PID:8112
- C:\Windows\System\qOoqSbB.exe
  C:\Windows\System\qOoqSbB.exe
  2⤵
  PID:8140
- C:\Windows\System\FrHDoLF.exe
  C:\Windows\System\FrHDoLF.exe
  2⤵
  PID:7208
- C:\Windows\System\cnofsxM.exe
  C:\Windows\System\cnofsxM.exe
  2⤵
  PID:7264
- C:\Windows\System\agRXvvs.exe
  C:\Windows\System\agRXvvs.exe
  2⤵
  PID:7328
- C:\Windows\System\YlGitXD.exe
  C:\Windows\System\YlGitXD.exe
  2⤵
  PID:7348
- C:\Windows\System\yURyvzm.exe
  C:\Windows\System\yURyvzm.exe
  2⤵
  PID:7444
- C:\Windows\System\COCahFN.exe
  C:\Windows\System\COCahFN.exe
  2⤵
  PID:7520
- C:\Windows\System\ifwErph.exe
  C:\Windows\System\ifwErph.exe
  2⤵
  PID:7568
- C:\Windows\System\vLEszvN.exe
  C:\Windows\System\vLEszvN.exe
  2⤵
  PID:7608
- C:\Windows\System\BtUDsKP.exe
  C:\Windows\System\BtUDsKP.exe
  2⤵
  PID:7716
- C:\Windows\System\vhTvkIH.exe
  C:\Windows\System\vhTvkIH.exe
  2⤵
  PID:7760
- C:\Windows\System\yQZjqhY.exe
  C:\Windows\System\yQZjqhY.exe
  2⤵
  PID:7852
- C:\Windows\System\oPaDaHr.exe
  C:\Windows\System\oPaDaHr.exe
  2⤵
  PID:7932
- C:\Windows\System\xGjBKgV.exe
  C:\Windows\System\xGjBKgV.exe
  2⤵
  PID:7904
- C:\Windows\System\nNfyttU.exe
  C:\Windows\System\nNfyttU.exe
  2⤵
  PID:8008
- C:\Windows\System\pJFEgLf.exe
  C:\Windows\System\pJFEgLf.exe
  2⤵
  PID:8104
- C:\Windows\System\seHBmyz.exe
  C:\Windows\System\seHBmyz.exe
  2⤵
  PID:8188
- C:\Windows\System\zBrRLgS.exe
  C:\Windows\System\zBrRLgS.exe
  2⤵
  PID:7232
- C:\Windows\System\DzNciQo.exe
  C:\Windows\System\DzNciQo.exe
  2⤵
  PID:3656
- C:\Windows\System\GeQjlfL.exe
  C:\Windows\System\GeQjlfL.exe
  2⤵
  PID:7440
- C:\Windows\System\EJRGFYt.exe
  C:\Windows\System\EJRGFYt.exe
  2⤵
  PID:7672
- C:\Windows\System\yGCuson.exe
  C:\Windows\System\yGCuson.exe
  2⤵
  PID:7740
- C:\Windows\System\VFTfZpN.exe
  C:\Windows\System\VFTfZpN.exe
  2⤵
  PID:7952
- C:\Windows\System\plasdVE.exe
  C:\Windows\System\plasdVE.exe
  2⤵
  PID:8136
- C:\Windows\System\kOQKBUL.exe
  C:\Windows\System\kOQKBUL.exe
  2⤵
  PID:7656
- C:\Windows\System\WaxcRHw.exe
  C:\Windows\System\WaxcRHw.exe
  2⤵
  PID:7516
- C:\Windows\System\HHQGLMP.exe
  C:\Windows\System\HHQGLMP.exe
  2⤵
  PID:2196
- C:\Windows\System\yxoGixI.exe
  C:\Windows\System\yxoGixI.exe
  2⤵
  PID:8200
- C:\Windows\System\BOIVMgi.exe
  C:\Windows\System\BOIVMgi.exe
  2⤵
  PID:8232
- C:\Windows\System\BLYDkqj.exe
  C:\Windows\System\BLYDkqj.exe
  2⤵
  PID:8260
- C:\Windows\System\BAleGcQ.exe
  C:\Windows\System\BAleGcQ.exe
  2⤵
  PID:8292
- C:\Windows\System\VuHEctD.exe
  C:\Windows\System\VuHEctD.exe
  2⤵
  PID:8316
- C:\Windows\System\tAdPiVV.exe
  C:\Windows\System\tAdPiVV.exe
  2⤵
  PID:8348
- C:\Windows\System\vZoOgUl.exe
  C:\Windows\System\vZoOgUl.exe
  2⤵
  PID:8380
- C:\Windows\System\aIHLlNt.exe
  C:\Windows\System\aIHLlNt.exe
  2⤵
  PID:8408
- C:\Windows\System\FfGPmfg.exe
  C:\Windows\System\FfGPmfg.exe
  2⤵
  PID:8432
- C:\Windows\System\zmMdphx.exe
  C:\Windows\System\zmMdphx.exe
  2⤵
  PID:8456
- C:\Windows\System\ecsBchh.exe
  C:\Windows\System\ecsBchh.exe
  2⤵
  PID:8488
- C:\Windows\System\imDQOPd.exe
  C:\Windows\System\imDQOPd.exe
  2⤵
  PID:8508
- C:\Windows\System\qMkAfnG.exe
  C:\Windows\System\qMkAfnG.exe
  2⤵
  PID:8532
- C:\Windows\System\wNJYYsX.exe
  C:\Windows\System\wNJYYsX.exe
  2⤵
  PID:8560
- C:\Windows\System\LcOYVgr.exe
  C:\Windows\System\LcOYVgr.exe
  2⤵
  PID:8588
- C:\Windows\System\gOFKFPX.exe
  C:\Windows\System\gOFKFPX.exe
  2⤵
  PID:8612
- C:\Windows\System\WxgWexp.exe
  C:\Windows\System\WxgWexp.exe
  2⤵
  PID:8640
- C:\Windows\System\HKTYcZf.exe
  C:\Windows\System\HKTYcZf.exe
  2⤵
  PID:8672
- C:\Windows\System\VqqvDIZ.exe
  C:\Windows\System\VqqvDIZ.exe
  2⤵
  PID:8696
- C:\Windows\System\XSSsIaR.exe
  C:\Windows\System\XSSsIaR.exe
  2⤵
  PID:8728
- C:\Windows\System\fJqjGni.exe
  C:\Windows\System\fJqjGni.exe
  2⤵
  PID:8752
- C:\Windows\System\awePwyb.exe
  C:\Windows\System\awePwyb.exe
  2⤵
  PID:8780
- C:\Windows\System\jTvFIyf.exe
  C:\Windows\System\jTvFIyf.exe
  2⤵
  PID:8808
- C:\Windows\System\pYQdsfT.exe
  C:\Windows\System\pYQdsfT.exe
  2⤵
  PID:8832
- C:\Windows\System\GjJgjkN.exe
  C:\Windows\System\GjJgjkN.exe
  2⤵
  PID:8864
- C:\Windows\System\OWHYAlG.exe
  C:\Windows\System\OWHYAlG.exe
  2⤵
  PID:8892
- C:\Windows\System\miuBxcx.exe
  C:\Windows\System\miuBxcx.exe
  2⤵
  PID:8928
- C:\Windows\System\sqoJoTg.exe
  C:\Windows\System\sqoJoTg.exe
  2⤵
  PID:8948
- C:\Windows\System\cJhNoFu.exe
  C:\Windows\System\cJhNoFu.exe
  2⤵
  PID:8984
- C:\Windows\System\qZCtrmI.exe
  C:\Windows\System\qZCtrmI.exe
  2⤵
  PID:9008
- C:\Windows\System\AgZaPll.exe
  C:\Windows\System\AgZaPll.exe
  2⤵
  PID:9036
- C:\Windows\System\asjnKSb.exe
  C:\Windows\System\asjnKSb.exe
  2⤵
  PID:9060
- C:\Windows\System\OoNqemV.exe
  C:\Windows\System\OoNqemV.exe
  2⤵
  PID:9092
- C:\Windows\System\XAHkWwD.exe
  C:\Windows\System\XAHkWwD.exe
  2⤵
  PID:9116
- C:\Windows\System\zQYVTku.exe
  C:\Windows\System\zQYVTku.exe
  2⤵
  PID:9144
- C:\Windows\System\kMkOIfh.exe
  C:\Windows\System\kMkOIfh.exe
  2⤵
  PID:9168
- C:\Windows\System\vbnliGg.exe
  C:\Windows\System\vbnliGg.exe
  2⤵
  PID:9196
- C:\Windows\System\HhfAVPX.exe
  C:\Windows\System\HhfAVPX.exe
  2⤵
  PID:8032
- C:\Windows\System\HmhUFkj.exe
  C:\Windows\System\HmhUFkj.exe
  2⤵
  PID:8196
- C:\Windows\System\prXPsgK.exe
  C:\Windows\System\prXPsgK.exe
  2⤵
  PID:8228
- C:\Windows\System\IuXmzNB.exe
  C:\Windows\System\IuXmzNB.exe
  2⤵
  PID:8856
- C:\Windows\System\TWqcOpU.exe
  C:\Windows\System\TWqcOpU.exe
  2⤵
  PID:8904
- C:\Windows\System\GtnfZqr.exe
  C:\Windows\System\GtnfZqr.exe
  2⤵
  PID:8848
- C:\Windows\System\UASGalQ.exe
  C:\Windows\System\UASGalQ.exe
  2⤵
  PID:9056
- C:\Windows\System\lwWaKPL.exe
  C:\Windows\System\lwWaKPL.exe
  2⤵
  PID:8964
- C:\Windows\System\yVrgrxN.exe
  C:\Windows\System\yVrgrxN.exe
  2⤵
  PID:9020
- C:\Windows\System\IXTCruc.exe
  C:\Windows\System\IXTCruc.exe
  2⤵
  PID:9076
- C:\Windows\System\jhHyUSU.exe
  C:\Windows\System\jhHyUSU.exe
  2⤵
  PID:9112
- C:\Windows\System\ErwUknY.exe
  C:\Windows\System\ErwUknY.exe
  2⤵
  PID:8284
- C:\Windows\System\BirkxXD.exe
  C:\Windows\System\BirkxXD.exe
  2⤵
  PID:8356
- C:\Windows\System\YAeeLur.exe
  C:\Windows\System\YAeeLur.exe
  2⤵
  PID:8624
- C:\Windows\System\qmLyuTe.exe
  C:\Windows\System\qmLyuTe.exe
  2⤵
  PID:3180
- C:\Windows\System\ZZpHVNK.exe
  C:\Windows\System\ZZpHVNK.exe
  2⤵
  PID:8428
- C:\Windows\System\LXDDyiu.exe
  C:\Windows\System\LXDDyiu.exe
  2⤵
  PID:8824
- C:\Windows\System\muZMZfc.exe
  C:\Windows\System\muZMZfc.exe
  2⤵
  PID:8956
- C:\Windows\System\vtNcdTg.exe
  C:\Windows\System\vtNcdTg.exe
  2⤵
  PID:9164
- C:\Windows\System\aldZAAu.exe
  C:\Windows\System\aldZAAu.exe
  2⤵
  PID:9136
- C:\Windows\System\CwTMWGp.exe
  C:\Windows\System\CwTMWGp.exe
  2⤵
  PID:3844
- C:\Windows\System\MjXlhgg.exe
  C:\Windows\System\MjXlhgg.exe
  2⤵
  PID:1756
- C:\Windows\System\XhCsVZo.exe
  C:\Windows\System\XhCsVZo.exe
  2⤵
  PID:7256
- C:\Windows\System\QqfphhG.exe
  C:\Windows\System\QqfphhG.exe
  2⤵
  PID:9228
- C:\Windows\System\vxCFiJr.exe
  C:\Windows\System\vxCFiJr.exe
  2⤵
  PID:9252
- C:\Windows\System\ZqjHTTc.exe
  C:\Windows\System\ZqjHTTc.exe
  2⤵
  PID:9280
- C:\Windows\System\yGZSqYr.exe
  C:\Windows\System\yGZSqYr.exe
  2⤵
  PID:9304
- C:\Windows\System\IuOrYTH.exe
  C:\Windows\System\IuOrYTH.exe
  2⤵
  PID:9324
- C:\Windows\System\PWPtWPE.exe
  C:\Windows\System\PWPtWPE.exe
  2⤵
  PID:9344
- C:\Windows\System\GTExgxC.exe
  C:\Windows\System\GTExgxC.exe
  2⤵
  PID:9372
- C:\Windows\System\AQIPsny.exe
  C:\Windows\System\AQIPsny.exe
  2⤵
  PID:9392
- C:\Windows\System\qyjuKHe.exe
  C:\Windows\System\qyjuKHe.exe
  2⤵
  PID:9420
- C:\Windows\System\zteHCqT.exe
  C:\Windows\System\zteHCqT.exe
  2⤵
  PID:9456
- C:\Windows\System\gzzMwqB.exe
  C:\Windows\System\gzzMwqB.exe
  2⤵
  PID:9480
- C:\Windows\System\SSjyNHR.exe
  C:\Windows\System\SSjyNHR.exe
  2⤵
  PID:9516
- C:\Windows\System\ZduerBD.exe
  C:\Windows\System\ZduerBD.exe
  2⤵
  PID:9544
- C:\Windows\System\rRPtgSa.exe
  C:\Windows\System\rRPtgSa.exe
  2⤵
  PID:9564
- C:\Windows\System\FixQCFm.exe
  C:\Windows\System\FixQCFm.exe
  2⤵
  PID:9588
- C:\Windows\System\RqyDoZJ.exe
  C:\Windows\System\RqyDoZJ.exe
  2⤵
  PID:9612
- C:\Windows\System\cPiZtYq.exe
  C:\Windows\System\cPiZtYq.exe
  2⤵
  PID:9636
- C:\Windows\System\NHoUYGA.exe
  C:\Windows\System\NHoUYGA.exe
  2⤵
  PID:9656
- C:\Windows\System\ugEwtOA.exe
  C:\Windows\System\ugEwtOA.exe
  2⤵
  PID:9684
- C:\Windows\System\EiiOZKv.exe
  C:\Windows\System\EiiOZKv.exe
  2⤵
  PID:9712
- C:\Windows\System\JGCOBhp.exe
  C:\Windows\System\JGCOBhp.exe
  2⤵
  PID:9744
- C:\Windows\System\esVRjdG.exe
  C:\Windows\System\esVRjdG.exe
  2⤵
  PID:9768
- C:\Windows\System\KuBHHyc.exe
  C:\Windows\System\KuBHHyc.exe
  2⤵
  PID:9796
- C:\Windows\System\UbTlRMd.exe
  C:\Windows\System\UbTlRMd.exe
  2⤵
  PID:9824
- C:\Windows\System\DtMLfDg.exe
  C:\Windows\System\DtMLfDg.exe
  2⤵
  PID:9848
- C:\Windows\System\MCneFgN.exe
  C:\Windows\System\MCneFgN.exe
  2⤵
  PID:9884
- C:\Windows\System\YrBPNJM.exe
  C:\Windows\System\YrBPNJM.exe
  2⤵
  PID:9908
- C:\Windows\System\fRAkJKQ.exe
  C:\Windows\System\fRAkJKQ.exe
  2⤵
  PID:9932
- C:\Windows\System\JtfKKta.exe
  C:\Windows\System\JtfKKta.exe
  2⤵
  PID:9964
- C:\Windows\System\cPZoTWC.exe
  C:\Windows\System\cPZoTWC.exe
  2⤵
  PID:9988
- C:\Windows\System\MjBRfCp.exe
  C:\Windows\System\MjBRfCp.exe
  2⤵
  PID:10020
- C:\Windows\System\mTqsmBb.exe
  C:\Windows\System\mTqsmBb.exe
  2⤵
  PID:10048
- C:\Windows\System\ldqMjEh.exe
  C:\Windows\System\ldqMjEh.exe
  2⤵
  PID:10068
- C:\Windows\System\HXQrnrR.exe
  C:\Windows\System\HXQrnrR.exe
  2⤵
  PID:10088
- C:\Windows\System\bpyKLoG.exe
  C:\Windows\System\bpyKLoG.exe
  2⤵
  PID:10120
- C:\Windows\System\pAjomkq.exe
  C:\Windows\System\pAjomkq.exe
  2⤵
  PID:10136
- C:\Windows\System\xfuimuo.exe
  C:\Windows\System\xfuimuo.exe
  2⤵
  PID:10168
- C:\Windows\System\lbLYMrA.exe
  C:\Windows\System\lbLYMrA.exe
  2⤵
  PID:10200
- C:\Windows\System\mfBZKLT.exe
  C:\Windows\System\mfBZKLT.exe
  2⤵
  PID:10224
- C:\Windows\System\CbtLiCx.exe
  C:\Windows\System\CbtLiCx.exe
  2⤵
  PID:9224
- C:\Windows\System\AEdNsZO.exe
  C:\Windows\System\AEdNsZO.exe
  2⤵
  PID:9276
- C:\Windows\System\EaHVhKM.exe
  C:\Windows\System\EaHVhKM.exe
  2⤵
  PID:2140
- C:\Windows\System\OMWKBqN.exe
  C:\Windows\System\OMWKBqN.exe
  2⤵
  PID:9320
- C:\Windows\System\HDnUXer.exe
  C:\Windows\System\HDnUXer.exe
  2⤵
  PID:4620
- C:\Windows\System\MIlBojT.exe
  C:\Windows\System\MIlBojT.exe
  2⤵
  PID:9448
- C:\Windows\System\biUGfwV.exe
  C:\Windows\System\biUGfwV.exe
  2⤵
  PID:9472
- C:\Windows\System\JXeLYnA.exe
  C:\Windows\System\JXeLYnA.exe
  2⤵
  PID:9492
- C:\Windows\System\gtcbOtM.exe
  C:\Windows\System\gtcbOtM.exe
  2⤵
  PID:9608
- C:\Windows\System\RaFmTXz.exe
  C:\Windows\System\RaFmTXz.exe
  2⤵
  PID:9628
- C:\Windows\System\pduzSXD.exe
  C:\Windows\System\pduzSXD.exe
  2⤵
  PID:9792
- C:\Windows\System\ZotIZMx.exe
  C:\Windows\System\ZotIZMx.exe
  2⤵
  PID:9724
- C:\Windows\System\vtHWdDU.exe
  C:\Windows\System\vtHWdDU.exe
  2⤵
  PID:9900
- C:\Windows\System\ZCCqdSt.exe
  C:\Windows\System\ZCCqdSt.exe
  2⤵
  PID:9896
- C:\Windows\System\HkrtIHo.exe
  C:\Windows\System\HkrtIHo.exe
  2⤵
  PID:9928
- C:\Windows\System\nnfKTkL.exe
  C:\Windows\System\nnfKTkL.exe
  2⤵
  PID:10152
- C:\Windows\System\qCWjHFU.exe
  C:\Windows\System\qCWjHFU.exe
  2⤵
  PID:10116
- C:\Windows\System\VtOxnTj.exe
  C:\Windows\System\VtOxnTj.exe
  2⤵
  PID:10232
- C:\Windows\System\JVPnANH.exe
  C:\Windows\System\JVPnANH.exe
  2⤵
  PID:9248
- C:\Windows\System\FrJPejL.exe
  C:\Windows\System\FrJPejL.exe
  2⤵
  PID:9312
- C:\Windows\System\yoGZhyr.exe
  C:\Windows\System\yoGZhyr.exe
  2⤵
  PID:9336
- C:\Windows\System\EXgrQmt.exe
  C:\Windows\System\EXgrQmt.exe
  2⤵
  PID:2296
- C:\Windows\System\tyEqyNK.exe
  C:\Windows\System\tyEqyNK.exe
  2⤵
  PID:9444
- C:\Windows\System\KYAywcL.exe
  C:\Windows\System\KYAywcL.exe
  2⤵
  PID:9476
- C:\Windows\System\mkDVdCH.exe
  C:\Windows\System\mkDVdCH.exe
  2⤵
  PID:9788
- C:\Windows\System\blNnasG.exe
  C:\Windows\System\blNnasG.exe
  2⤵
  PID:9604
- C:\Windows\System\WdoidOp.exe
  C:\Windows\System\WdoidOp.exe
  2⤵
  PID:10128
- C:\Windows\System\RZbtlsR.exe
  C:\Windows\System\RZbtlsR.exe
  2⤵
  PID:10272
- C:\Windows\System\lSLoGuV.exe
  C:\Windows\System\lSLoGuV.exe
  2⤵
  PID:10292
- C:\Windows\System\QGaFJnS.exe
  C:\Windows\System\QGaFJnS.exe
  2⤵
  PID:10316
- C:\Windows\System\oFYBbqM.exe
  C:\Windows\System\oFYBbqM.exe
  2⤵
  PID:10336
- C:\Windows\System\rkWhNwo.exe
  C:\Windows\System\rkWhNwo.exe
  2⤵
  PID:10436
- C:\Windows\System\ZLnpeft.exe
  C:\Windows\System\ZLnpeft.exe
  2⤵
  PID:10488
- C:\Windows\System\TcUbZgU.exe
  C:\Windows\System\TcUbZgU.exe
  2⤵
  PID:10520
- C:\Windows\System\cKloHPL.exe
  C:\Windows\System\cKloHPL.exe
  2⤵
  PID:10548
- C:\Windows\System\qkhqABu.exe
  C:\Windows\System\qkhqABu.exe
  2⤵
  PID:10576
- C:\Windows\System\FSnWytX.exe
  C:\Windows\System\FSnWytX.exe
  2⤵
  PID:10600
- C:\Windows\System\zKRxXsb.exe
  C:\Windows\System\zKRxXsb.exe
  2⤵
  PID:10632
- C:\Windows\System\vjEVqLE.exe
  C:\Windows\System\vjEVqLE.exe
  2⤵
  PID:10660
- C:\Windows\System\YISAaAO.exe
  C:\Windows\System\YISAaAO.exe
  2⤵
  PID:10676
- C:\Windows\System\VNwySda.exe
  C:\Windows\System\VNwySda.exe
  2⤵
  PID:10708
- C:\Windows\System\kgBJtYE.exe
  C:\Windows\System\kgBJtYE.exe
  2⤵
  PID:10732
- C:\Windows\System\SRcmtzk.exe
  C:\Windows\System\SRcmtzk.exe
  2⤵
  PID:10756
- C:\Windows\System\oLRpxKu.exe
  C:\Windows\System\oLRpxKu.exe
  2⤵
  PID:10780
- C:\Windows\System\IDRfvUu.exe
  C:\Windows\System\IDRfvUu.exe
  2⤵
  PID:10804
- C:\Windows\System\aeUBpjW.exe
  C:\Windows\System\aeUBpjW.exe
  2⤵
  PID:10832
- C:\Windows\System\DqiahCi.exe
  C:\Windows\System\DqiahCi.exe
  2⤵
  PID:10872
- C:\Windows\System\GgKGxEt.exe
  C:\Windows\System\GgKGxEt.exe
  2⤵
  PID:10904
- C:\Windows\System\riThZfi.exe
  C:\Windows\System\riThZfi.exe
  2⤵
  PID:10932
- C:\Windows\System\WFzxWKh.exe
  C:\Windows\System\WFzxWKh.exe
  2⤵
  PID:11028
- C:\Windows\System\aNyjgoq.exe
  C:\Windows\System\aNyjgoq.exe
  2⤵
  PID:11052
- C:\Windows\System\qDfmCpp.exe
  C:\Windows\System\qDfmCpp.exe
  2⤵
  PID:11076
- C:\Windows\System\EzylBog.exe
  C:\Windows\System\EzylBog.exe
  2⤵
  PID:11176
- C:\Windows\System\WjfJtcI.exe
  C:\Windows\System\WjfJtcI.exe
  2⤵
  PID:11208
- C:\Windows\System\xiNcNYf.exe
  C:\Windows\System\xiNcNYf.exe
  2⤵
  PID:11224
- C:\Windows\System\OZQrDTr.exe
  C:\Windows\System\OZQrDTr.exe
  2⤵
  PID:11244
- C:\Windows\System\uUzXsBX.exe
  C:\Windows\System\uUzXsBX.exe
  2⤵
  PID:9432
- C:\Windows\System\iOkmvnP.exe
  C:\Windows\System\iOkmvnP.exe
  2⤵
  PID:4500
- C:\Windows\System\ABWXByg.exe
  C:\Windows\System\ABWXByg.exe
  2⤵
  PID:4052
- C:\Windows\System\sGSXLgP.exe
  C:\Windows\System\sGSXLgP.exe
  2⤵
  PID:9332
- C:\Windows\System\sQDTvUw.exe
  C:\Windows\System\sQDTvUw.exe
  2⤵
  PID:9540
- C:\Windows\System\CdidRwk.exe
  C:\Windows\System\CdidRwk.exe
  2⤵
  PID:10252
- C:\Windows\System\UyyxlMl.exe
  C:\Windows\System\UyyxlMl.exe
  2⤵
  PID:10188
- C:\Windows\System\dLihGJm.exe
  C:\Windows\System\dLihGJm.exe
  2⤵
  PID:10376
- C:\Windows\System\JGVBLHu.exe
  C:\Windows\System\JGVBLHu.exe
  2⤵
  PID:10480
- C:\Windows\System\wShukoM.exe
  C:\Windows\System\wShukoM.exe
  2⤵
  PID:10444
- C:\Windows\System\ZwQMbIs.exe
  C:\Windows\System\ZwQMbIs.exe
  2⤵
  PID:10544
- C:\Windows\System\XYVENSM.exe
  C:\Windows\System\XYVENSM.exe
  2⤵
  PID:3452
- C:\Windows\System\vqHQfrP.exe
  C:\Windows\System\vqHQfrP.exe
  2⤵
  PID:10744
- C:\Windows\System\lUJsgzl.exe
  C:\Windows\System\lUJsgzl.exe
  2⤵
  PID:10860
- C:\Windows\System\puVEPQH.exe
  C:\Windows\System\puVEPQH.exe
  2⤵
  PID:10868
- C:\Windows\System\IONEhkn.exe
  C:\Windows\System\IONEhkn.exe
  2⤵
  PID:10912
- C:\Windows\System\daVQJnN.exe
  C:\Windows\System\daVQJnN.exe
  2⤵
  PID:9188
- C:\Windows\System\bSsQaef.exe
  C:\Windows\System\bSsQaef.exe
  2⤵
  PID:1876
- C:\Windows\System\MCKYWfN.exe
  C:\Windows\System\MCKYWfN.exe
  2⤵
  PID:11068
- C:\Windows\System\fJFrTWU.exe
  C:\Windows\System\fJFrTWU.exe
  2⤵
  PID:11100
- C:\Windows\System\yLnhYzC.exe
  C:\Windows\System\yLnhYzC.exe
  2⤵
  PID:4520
- C:\Windows\System\jDDjbWW.exe
  C:\Windows\System\jDDjbWW.exe
  2⤵
  PID:840
- C:\Windows\System\zShHSRi.exe
  C:\Windows\System\zShHSRi.exe
  2⤵
  PID:11184
- C:\Windows\System\JcffANy.exe
  C:\Windows\System\JcffANy.exe
  2⤵
  PID:11252
- C:\Windows\System\wdLEPRj.exe
  C:\Windows\System\wdLEPRj.exe
  2⤵
  PID:4512
- C:\Windows\System\smbIaLH.exe
  C:\Windows\System\smbIaLH.exe
  2⤵
  PID:3924
- C:\Windows\System\HgQKLHY.exe
  C:\Windows\System\HgQKLHY.exe
  2⤵
  PID:11256
- C:\Windows\System\nuMuTLi.exe
  C:\Windows\System\nuMuTLi.exe
  2⤵
  PID:10312
- C:\Windows\System\QFPOkcg.exe
  C:\Windows\System\QFPOkcg.exe
  2⤵
  PID:4536
- C:\Windows\System\DQemOli.exe
  C:\Windows\System\DQemOli.exe
  2⤵
  PID:10516
- C:\Windows\System\qzfAGuj.exe
  C:\Windows\System\qzfAGuj.exe
  2⤵
  PID:10460
- C:\Windows\System\gbNxgKd.exe
  C:\Windows\System\gbNxgKd.exe
  2⤵
  PID:10688
- C:\Windows\System\umvOglH.exe
  C:\Windows\System\umvOglH.exe
  2⤵
  PID:10716
- C:\Windows\System\WUXUhCJ.exe
  C:\Windows\System\WUXUhCJ.exe
  2⤵
  PID:4324
- C:\Windows\System\YCbitVq.exe
  C:\Windows\System\YCbitVq.exe
  2⤵
  PID:708
- C:\Windows\System\bLmcLLT.exe
  C:\Windows\System\bLmcLLT.exe
  2⤵
  PID:11140
- C:\Windows\System\bTGclwu.exe
  C:\Windows\System\bTGclwu.exe
  2⤵
  PID:4892
- C:\Windows\System\JiyWGXb.exe
  C:\Windows\System\JiyWGXb.exe
  2⤵
  PID:3348
- C:\Windows\System\SzgOxnE.exe
  C:\Windows\System\SzgOxnE.exe
  2⤵
  PID:10216
- C:\Windows\System\nfTTxNp.exe
  C:\Windows\System\nfTTxNp.exe
  2⤵
  PID:9980
- C:\Windows\System\LsbjbEo.exe
  C:\Windows\System\LsbjbEo.exe
  2⤵
  PID:10816
- C:\Windows\System\neGmiJB.exe
  C:\Windows\System\neGmiJB.exe
  2⤵
  PID:4688
- C:\Windows\System\clAYSfi.exe
  C:\Windows\System\clAYSfi.exe
  2⤵
  PID:2936
- C:\Windows\System\yIBMYNz.exe
  C:\Windows\System\yIBMYNz.exe
  2⤵
  PID:11168
- C:\Windows\System\zuXtBxU.exe
  C:\Windows\System\zuXtBxU.exe
  2⤵
  PID:11284
- C:\Windows\System\bCatSIc.exe
  C:\Windows\System\bCatSIc.exe
  2⤵
  PID:11304
- C:\Windows\System\GLVdwyW.exe
  C:\Windows\System\GLVdwyW.exe
  2⤵
  PID:11332
- C:\Windows\System\zIvboHc.exe
  C:\Windows\System\zIvboHc.exe
  2⤵
  PID:11372
- C:\Windows\System\wzRRDdq.exe
  C:\Windows\System\wzRRDdq.exe
  2⤵
  PID:11404
- C:\Windows\System\pmZiDjc.exe
  C:\Windows\System\pmZiDjc.exe
  2⤵
  PID:11440
- C:\Windows\System\WYsdMXu.exe
  C:\Windows\System\WYsdMXu.exe
  2⤵
  PID:11468
- C:\Windows\System\TJtGtTV.exe
  C:\Windows\System\TJtGtTV.exe
  2⤵
  PID:11508
- C:\Windows\System\TGsPjCM.exe
  C:\Windows\System\TGsPjCM.exe
  2⤵
  PID:11532
- C:\Windows\System\ZhEpIVv.exe
  C:\Windows\System\ZhEpIVv.exe
  2⤵
  PID:11568
- C:\Windows\System\aveAbsO.exe
  C:\Windows\System\aveAbsO.exe
  2⤵
  PID:11584
- C:\Windows\System\jvzOJUl.exe
  C:\Windows\System\jvzOJUl.exe
  2⤵
  PID:11608
- C:\Windows\System\opNOhUD.exe
  C:\Windows\System\opNOhUD.exe
  2⤵
  PID:11636
- C:\Windows\System\JvDFrck.exe
  C:\Windows\System\JvDFrck.exe
  2⤵
  PID:11668
- C:\Windows\System\QshbMkF.exe
  C:\Windows\System\QshbMkF.exe
  2⤵
  PID:11704
- C:\Windows\System\SbzNjum.exe
  C:\Windows\System\SbzNjum.exe
  2⤵
  PID:11728
- C:\Windows\System\EqLYOlr.exe
  C:\Windows\System\EqLYOlr.exe
  2⤵
  PID:11752
- C:\Windows\System\UkSrUvX.exe
  C:\Windows\System\UkSrUvX.exe
  2⤵
  PID:11784
- C:\Windows\System\jlQoPXR.exe
  C:\Windows\System\jlQoPXR.exe
  2⤵
  PID:11812
- C:\Windows\System\gYQDAzt.exe
  C:\Windows\System\gYQDAzt.exe
  2⤵
  PID:11832
- C:\Windows\System\jsKiRSD.exe
  C:\Windows\System\jsKiRSD.exe
  2⤵
  PID:11856
- C:\Windows\System\nALWdRL.exe
  C:\Windows\System\nALWdRL.exe
  2⤵
  PID:11884
- C:\Windows\System\kJuugVK.exe
  C:\Windows\System\kJuugVK.exe
  2⤵
  PID:11904
- C:\Windows\System\PNkcShV.exe
  C:\Windows\System\PNkcShV.exe
  2⤵
  PID:11928
- C:\Windows\System\OKQgaPQ.exe
  C:\Windows\System\OKQgaPQ.exe
  2⤵
  PID:11960
- C:\Windows\System\IxNRQXt.exe
  C:\Windows\System\IxNRQXt.exe
  2⤵
  PID:11980
- C:\Windows\System\BcPVOpX.exe
  C:\Windows\System\BcPVOpX.exe
  2⤵
  PID:12008
- C:\Windows\System\zchugao.exe
  C:\Windows\System\zchugao.exe
  2⤵
  PID:12024
- C:\Windows\System\ebXLkkD.exe
  C:\Windows\System\ebXLkkD.exe
  2⤵
  PID:12060
- C:\Windows\System\IVQmaSL.exe
  C:\Windows\System\IVQmaSL.exe
  2⤵
  PID:12080
- C:\Windows\System\ibBBPqS.exe
  C:\Windows\System\ibBBPqS.exe
  2⤵
  PID:12112
- C:\Windows\System\KgHutCQ.exe
  C:\Windows\System\KgHutCQ.exe
  2⤵
  PID:12132
- C:\Windows\System\odAFoHN.exe
  C:\Windows\System\odAFoHN.exe
  2⤵
  PID:12156
- C:\Windows\System\PkcXHMc.exe
  C:\Windows\System\PkcXHMc.exe
  2⤵
  PID:12176
- C:\Windows\System\AckzyBh.exe
  C:\Windows\System\AckzyBh.exe
  2⤵
  PID:12200
- C:\Windows\System\arhknsl.exe
  C:\Windows\System\arhknsl.exe
  2⤵
  PID:12224
- C:\Windows\System\QpZRAaC.exe
  C:\Windows\System\QpZRAaC.exe
  2⤵
  PID:12256
- C:\Windows\System\eKIhSth.exe
  C:\Windows\System\eKIhSth.exe
  2⤵
  PID:12280
- C:\Windows\System\mISLwPA.exe
  C:\Windows\System\mISLwPA.exe
  2⤵
  PID:10724
- C:\Windows\System\TgMicub.exe
  C:\Windows\System\TgMicub.exe
  2⤵
  PID:2248
- C:\Windows\System\lqhVMmr.exe
  C:\Windows\System\lqhVMmr.exe
  2⤵
  PID:720
- C:\Windows\System\ekiRvMb.exe
  C:\Windows\System\ekiRvMb.exe
  2⤵
  PID:4952
- C:\Windows\System\MSSkYwI.exe
  C:\Windows\System\MSSkYwI.exe
  2⤵
  PID:11488
- C:\Windows\System\PdEvGBP.exe
  C:\Windows\System\PdEvGBP.exe
  2⤵
  PID:11388
- C:\Windows\System\rbndHOu.exe
  C:\Windows\System\rbndHOu.exe
  2⤵
  PID:11360
- C:\Windows\System\DdtBwnB.exe
  C:\Windows\System\DdtBwnB.exe
  2⤵
  PID:11552
- C:\Windows\System\MBVWVEb.exe
  C:\Windows\System\MBVWVEb.exe
  2⤵
  PID:11696
- C:\Windows\System\OZNZXZB.exe
  C:\Windows\System\OZNZXZB.exe
  2⤵
  PID:11616
- C:\Windows\System\TGtcntw.exe
  C:\Windows\System\TGtcntw.exe
  2⤵
  PID:11796
- C:\Windows\System\otCgBFj.exe
  C:\Windows\System\otCgBFj.exe
  2⤵
  PID:11848
- C:\Windows\System\VXqbOzM.exe
  C:\Windows\System\VXqbOzM.exe
  2⤵
  PID:11744
- C:\Windows\System\dffyica.exe
  C:\Windows\System\dffyica.exe
  2⤵
  PID:11852
- C:\Windows\System\pEpjjcj.exe
  C:\Windows\System\pEpjjcj.exe
  2⤵
  PID:11916
- C:\Windows\System\oVeXeLS.exe
  C:\Windows\System\oVeXeLS.exe
  2⤵
  PID:12076
- C:\Windows\System\WgrPvft.exe
  C:\Windows\System\WgrPvft.exe
  2⤵
  PID:12128
- C:\Windows\System\qUrTEXV.exe
  C:\Windows\System\qUrTEXV.exe
  2⤵
  PID:12044
- C:\Windows\System\lFSaUBZ.exe
  C:\Windows\System\lFSaUBZ.exe
  2⤵
  PID:12196
- C:\Windows\System\MokYHJn.exe
  C:\Windows\System\MokYHJn.exe
  2⤵
  PID:10244
- C:\Windows\System\SMXaJhM.exe
  C:\Windows\System\SMXaJhM.exe
  2⤵
  PID:11648
- C:\Windows\System\bnGEqmU.exe
  C:\Windows\System\bnGEqmU.exe
  2⤵
  PID:11600
- C:\Windows\System\vVnpomY.exe
  C:\Windows\System\vVnpomY.exe
  2⤵
  PID:3972
- C:\Windows\System\viUvtQI.exe
  C:\Windows\System\viUvtQI.exe
  2⤵
  PID:11088
- C:\Windows\System\xYDCeCc.exe
  C:\Windows\System\xYDCeCc.exe
  2⤵
  PID:4548
- C:\Windows\System\XYxisiZ.exe
  C:\Windows\System\XYxisiZ.exe
  2⤵
  PID:11840
- C:\Windows\System\FQFKtdU.exe
  C:\Windows\System\FQFKtdU.exe
  2⤵
  PID:2148
- C:\Windows\System\lNmAaCp.exe
  C:\Windows\System\lNmAaCp.exe
  2⤵
  PID:660
- C:\Windows\System\GXvVSCF.exe
  C:\Windows\System\GXvVSCF.exe
  2⤵
  PID:12152
- C:\Windows\System\NqiDzkq.exe
  C:\Windows\System\NqiDzkq.exe
  2⤵
  PID:4372
- C:\Windows\System\bwscEnM.exe
  C:\Windows\System\bwscEnM.exe
  2⤵
  PID:3192
- C:\Windows\System\tWltalj.exe
  C:\Windows\System\tWltalj.exe
  2⤵
  PID:5044
- C:\Windows\System\SllrsGr.exe
  C:\Windows\System\SllrsGr.exe
  2⤵
  PID:3940
- C:\Windows\System\IijmwNg.exe
  C:\Windows\System\IijmwNg.exe
  2⤵
  PID:4912
- C:\Windows\System\uxrVIDk.exe
  C:\Windows\System\uxrVIDk.exe
  2⤵
  PID:12188
- C:\Windows\System\SMiEqJN.exe
  C:\Windows\System\SMiEqJN.exe
  2⤵
  PID:3248
- C:\Windows\System\KXcpFTi.exe
  C:\Windows\System\KXcpFTi.exe
  2⤵
  PID:12300
- C:\Windows\System\XPYVGos.exe
  C:\Windows\System\XPYVGos.exe
  2⤵
  PID:12316
- C:\Windows\System\eDfHZxF.exe
  C:\Windows\System\eDfHZxF.exe
  2⤵
  PID:12336
- C:\Windows\System\AankNJS.exe
  C:\Windows\System\AankNJS.exe
  2⤵
  PID:12360
- C:\Windows\System\VBwQqrY.exe
  C:\Windows\System\VBwQqrY.exe
  2⤵
  PID:12376
- C:\Windows\System\wJuwjlk.exe
  C:\Windows\System\wJuwjlk.exe
  2⤵
  PID:12396
- C:\Windows\System\EmqZJiM.exe
  C:\Windows\System\EmqZJiM.exe
  2⤵
  PID:12420
- C:\Windows\System\osoVysa.exe
  C:\Windows\System\osoVysa.exe
  2⤵
  PID:12452
- C:\Windows\System\yutsgvD.exe
  C:\Windows\System\yutsgvD.exe
  2⤵
  PID:12472
- C:\Windows\System\hUgWnqA.exe
  C:\Windows\System\hUgWnqA.exe
  2⤵
  PID:12492
- C:\Windows\System\fTUxGAU.exe
  C:\Windows\System\fTUxGAU.exe
  2⤵
  PID:12520
- C:\Windows\System\XIiQYGS.exe
  C:\Windows\System\XIiQYGS.exe
  2⤵
  PID:12544
- C:\Windows\System\gSeOhvX.exe
  C:\Windows\System\gSeOhvX.exe
  2⤵
  PID:12564
- C:\Windows\System\LgdNtEf.exe
  C:\Windows\System\LgdNtEf.exe
  2⤵
  PID:12592
- C:\Windows\System\UZyPfCz.exe
  C:\Windows\System\UZyPfCz.exe
  2⤵
  PID:12608
- C:\Windows\System\gGGMmTK.exe
  C:\Windows\System\gGGMmTK.exe
  2⤵
  PID:12692
- C:\Windows\System\QQTWPUi.exe
  C:\Windows\System\QQTWPUi.exe
  2⤵
  PID:12712
- C:\Windows\System\BDHRYCI.exe
  C:\Windows\System\BDHRYCI.exe
  2⤵
  PID:12732
- C:\Windows\System\hkophHt.exe
  C:\Windows\System\hkophHt.exe
  2⤵
  PID:12764
- C:\Windows\System\ExJQGXm.exe
  C:\Windows\System\ExJQGXm.exe
  2⤵
  PID:12784
- C:\Windows\System\ysvogiD.exe
  C:\Windows\System\ysvogiD.exe
  2⤵
  PID:12820
- C:\Windows\System\urfwgMw.exe
  C:\Windows\System\urfwgMw.exe
  2⤵
  PID:12852
- C:\Windows\System\ApVJnCa.exe
  C:\Windows\System\ApVJnCa.exe
  2⤵
  PID:12884
- C:\Windows\System\THFHWGT.exe
  C:\Windows\System\THFHWGT.exe
  2⤵
  PID:13004
- C:\Windows\System\tdqNaQF.exe
  C:\Windows\System\tdqNaQF.exe
  2⤵
  PID:13032
- C:\Windows\System\IgyKUTm.exe
  C:\Windows\System\IgyKUTm.exe
  2⤵
  PID:13060
- C:\Windows\System\JkgSfHo.exe
  C:\Windows\System\JkgSfHo.exe
  2⤵
  PID:13076
- C:\Windows\System\LswPICl.exe
  C:\Windows\System\LswPICl.exe
  2⤵
  PID:13096
- C:\Windows\System\knzUnJn.exe
  C:\Windows\System\knzUnJn.exe
  2⤵
  PID:13116
- C:\Windows\System\ZzOcByy.exe
  C:\Windows\System\ZzOcByy.exe
  2⤵
  PID:13168
- C:\Windows\System\QTnwmce.exe
  C:\Windows\System\QTnwmce.exe
  2⤵
  PID:13184
- C:\Windows\System\HAoXUay.exe
  C:\Windows\System\HAoXUay.exe
  2⤵
  PID:13208
- C:\Windows\System\PGimGXj.exe
  C:\Windows\System\PGimGXj.exe
  2⤵
  PID:13228
- C:\Windows\System\xsCVCMT.exe
  C:\Windows\System\xsCVCMT.exe
  2⤵
  PID:13252
- C:\Windows\System\QAFiGAz.exe
  C:\Windows\System\QAFiGAz.exe
  2⤵
  PID:13284
- C:\Windows\System\uQIBiey.exe
  C:\Windows\System\uQIBiey.exe
  2⤵
  PID:4024
- C:\Windows\System\lafBfMs.exe
  C:\Windows\System\lafBfMs.exe
  2⤵
  PID:3620
- C:\Windows\System\KTtIPUW.exe
  C:\Windows\System\KTtIPUW.exe
  2⤵
  PID:12500
- C:\Windows\System\ZhwAxxL.exe
  C:\Windows\System\ZhwAxxL.exe
  2⤵
  PID:12448
- C:\Windows\System\zkNrvno.exe
  C:\Windows\System\zkNrvno.exe
  2⤵
  PID:12552
- C:\Windows\System\eiqFhuT.exe
  C:\Windows\System\eiqFhuT.exe
  2⤵
  PID:12516
- C:\Windows\System\OkqZeNZ.exe
  C:\Windows\System\OkqZeNZ.exe
  2⤵
  PID:12672
- C:\Windows\System\ZAyQuQk.exe
  C:\Windows\System\ZAyQuQk.exe
  2⤵
  PID:12708
- C:\Windows\System\OTSAYQv.exe
  C:\Windows\System\OTSAYQv.exe
  2⤵
  PID:1496
- C:\Windows\System\UHDrLNc.exe
  C:\Windows\System\UHDrLNc.exe
  2⤵
  PID:12832
- C:\Windows\System\TdcOxAz.exe
  C:\Windows\System\TdcOxAz.exe
  2⤵
  PID:12816
- C:\Windows\System\TFGzaFs.exe
  C:\Windows\System\TFGzaFs.exe
  2⤵
  PID:12776
- C:\Windows\System\EGcKTbR.exe
  C:\Windows\System\EGcKTbR.exe
  2⤵
  PID:12872
- C:\Windows\System\bRcDaoV.exe
  C:\Windows\System\bRcDaoV.exe
  2⤵
  PID:12988
- C:\Windows\System\DEJOEeN.exe
  C:\Windows\System\DEJOEeN.exe
  2⤵
  PID:1684
- C:\Windows\System\wKdnAOQ.exe
  C:\Windows\System\wKdnAOQ.exe
  2⤵
  PID:13112
- C:\Windows\System\rjfeRra.exe
  C:\Windows\System\rjfeRra.exe
  2⤵
  PID:13104
- C:\Windows\System\lpbqUAM.exe
  C:\Windows\System\lpbqUAM.exe
  2⤵
  PID:3144
- C:\Windows\System\SSGsTJk.exe
  C:\Windows\System\SSGsTJk.exe
  2⤵
  PID:13216
- C:\Windows\System\XvKgXvu.exe
  C:\Windows\System\XvKgXvu.exe
  2⤵
  PID:1364
- C:\Windows\System\AApPpYa.exe
  C:\Windows\System\AApPpYa.exe
  2⤵
  PID:13292
- C:\Windows\System\YuNOzvN.exe
  C:\Windows\System\YuNOzvN.exe
  2⤵
  PID:13308
- C:\Windows\System\LIJuYZp.exe
  C:\Windows\System\LIJuYZp.exe
  2⤵
  PID:4736
- C:\Windows\System\hcRYNuG.exe
  C:\Windows\System\hcRYNuG.exe
  2⤵
  PID:12344
- C:\Windows\System\hiVDLWx.exe
  C:\Windows\System\hiVDLWx.exe
  2⤵
  PID:12388
- C:\Windows\System\CnSUzQf.exe
  C:\Windows\System\CnSUzQf.exe
  2⤵
  PID:12412
- C:\Windows\System\OiUPXsU.exe
  C:\Windows\System\OiUPXsU.exe
  2⤵
  PID:12584
- C:\Windows\System\ISrsPHv.exe
  C:\Windows\System\ISrsPHv.exe
  2⤵
  PID:3032
- C:\Windows\System\slzYwyM.exe
  C:\Windows\System\slzYwyM.exe
  2⤵
  PID:4588
- C:\Windows\System\ouBrOIE.exe
  C:\Windows\System\ouBrOIE.exe
  2⤵
  PID:5184
- C:\Windows\System\qcPyxiF.exe
  C:\Windows\System\qcPyxiF.exe
  2⤵
  PID:13044
- C:\Windows\System\mgSUMMI.exe
  C:\Windows\System\mgSUMMI.exe
  2⤵
  PID:12680
- C:\Windows\System\TiwsExy.exe
  C:\Windows\System\TiwsExy.exe
  2⤵
  PID:5364
- C:\Windows\System\CztwNBo.exe
  C:\Windows\System\CztwNBo.exe
  2⤵
  PID:13236
- C:\Windows\System\DCYHHIn.exe
  C:\Windows\System\DCYHHIn.exe
  2⤵
  PID:5452
- C:\Windows\System\IPFRFpA.exe
  C:\Windows\System\IPFRFpA.exe
  2⤵
  PID:5556
- C:\Windows\System\OjFAAye.exe
  C:\Windows\System\OjFAAye.exe
  2⤵
  PID:5648
- C:\Windows\System\DrZVVMJ.exe
  C:\Windows\System\DrZVVMJ.exe
  2⤵
  PID:7248
- C:\Windows\System\tCliDQr.exe
  C:\Windows\System\tCliDQr.exe
  2⤵
  PID:5808
- C:\Windows\System\fxUVCzt.exe
  C:\Windows\System\fxUVCzt.exe
  2⤵
  PID:5876
- C:\Windows\System\qsyseig.exe
  C:\Windows\System\qsyseig.exe
  2⤵
  PID:4960
- C:\Windows\System\XUiNMoD.exe
  C:\Windows\System\XUiNMoD.exe
  2⤵
  PID:2876
- C:\Windows\System\deMmwza.exe
  C:\Windows\System\deMmwza.exe
  2⤵
  PID:12536
- C:\Windows\System\NNEZlHI.exe
  C:\Windows\System\NNEZlHI.exe
  2⤵
  PID:60
- C:\Windows\System\JFqIUdU.exe
  C:\Windows\System\JFqIUdU.exe
  2⤵
  PID:5984
- C:\Windows\System\gAdfzPG.exe
  C:\Windows\System\gAdfzPG.exe
  2⤵
  PID:6072
- C:\Windows\System\qqbCduf.exe
  C:\Windows\System\qqbCduf.exe
  2⤵
  PID:12604
- C:\Windows\System\djPrFHk.exe
  C:\Windows\System\djPrFHk.exe
  2⤵
  PID:4108
- C:\Windows\System\jzmQzrb.exe
  C:\Windows\System\jzmQzrb.exe
  2⤵
  PID:7404
- C:\Windows\System\txdpvGn.exe
  C:\Windows\System\txdpvGn.exe
  2⤵
  PID:5508
- C:\Windows\System\Yxievjd.exe
  C:\Windows\System\Yxievjd.exe
  2⤵
  PID:4560
- C:\Windows\System\keszgYa.exe
  C:\Windows\System\keszgYa.exe
  2⤵
  PID:5536
- C:\Windows\System\pEdexRj.exe
  C:\Windows\System\pEdexRj.exe
  2⤵
  PID:5716
- C:\Windows\System\EaXoRHF.exe
  C:\Windows\System\EaXoRHF.exe
  2⤵
  PID:2460
- C:\Windows\System\JPzutBR.exe
  C:\Windows\System\JPzutBR.exe
  2⤵
  PID:5088
- C:\Windows\System\rapoRIv.exe
  C:\Windows\System\rapoRIv.exe
  2⤵
  PID:5924
- C:\Windows\System\lrhQkvA.exe
  C:\Windows\System\lrhQkvA.exe
  2⤵
  PID:12644
- C:\Windows\System\NDNvYTM.exe
  C:\Windows\System\NDNvYTM.exe
  2⤵
  PID:5728
- C:\Windows\System\UEGjhYi.exe
  C:\Windows\System\UEGjhYi.exe
  2⤵
  PID:5816
- C:\Windows\System\bkhluCF.exe
  C:\Windows\System\bkhluCF.exe
  2⤵
  PID:5872
- C:\Windows\System\WTxEsGw.exe
  C:\Windows\System\WTxEsGw.exe
  2⤵
  PID:6228
- C:\Windows\System\sZQELwb.exe
  C:\Windows\System\sZQELwb.exe
  2⤵
  PID:6316
- C:\Windows\System\eXVdUCC.exe
  C:\Windows\System\eXVdUCC.exe
  2⤵
  PID:6408
- C:\Windows\System\zxCPqYs.exe
  C:\Windows\System\zxCPqYs.exe
  2⤵
  PID:6492
- C:\Windows\System\UdTOTcW.exe
  C:\Windows\System\UdTOTcW.exe
  2⤵
  PID:6352
- C:\Windows\System\epCyAAs.exe
  C:\Windows\System\epCyAAs.exe
  2⤵
  PID:6576
- C:\Windows\System\YngLnsD.exe
  C:\Windows\System\YngLnsD.exe
  2⤵
  PID:5392
- C:\Windows\System\qoYvMcA.exe
  C:\Windows\System\qoYvMcA.exe
  2⤵
  PID:1460
- C:\Windows\System\PPTJRFn.exe
  C:\Windows\System\PPTJRFn.exe
  2⤵
  PID:2760
- C:\Windows\System\clCEAam.exe
  C:\Windows\System\clCEAam.exe
  2⤵
  PID:6748
- C:\Windows\System\nOdLLxH.exe
  C:\Windows\System\nOdLLxH.exe
  2⤵
  PID:12700
- C:\Windows\System\mUWyEyu.exe
  C:\Windows\System\mUWyEyu.exe
  2⤵
  PID:6800
- C:\Windows\System\jWOnsXN.exe
  C:\Windows\System\jWOnsXN.exe
  2⤵
  PID:13220
- C:\Windows\System\VQwNUNQ.exe
  C:\Windows\System\VQwNUNQ.exe
  2⤵
  PID:5672
- C:\Windows\System\uoHJxmP.exe
  C:\Windows\System\uoHJxmP.exe
  2⤵
  PID:6968
- C:\Windows\System\MZCRpQo.exe
  C:\Windows\System\MZCRpQo.exe
  2⤵
  PID:7012
- C:\Windows\System\DnYrTzT.exe
  C:\Windows\System\DnYrTzT.exe
  2⤵
  PID:7096
- C:\Windows\System\KsQYGgv.exe
  C:\Windows\System\KsQYGgv.exe
  2⤵
  PID:7160
- C:\Windows\System\CxxWkFa.exe
  C:\Windows\System\CxxWkFa.exe
  2⤵
  PID:6020
- C:\Windows\System\vtqFMuR.exe
  C:\Windows\System\vtqFMuR.exe
  2⤵
  PID:13280
- C:\Windows\System\ihGnnIW.exe
  C:\Windows\System\ihGnnIW.exe
  2⤵
  PID:6216
- C:\Windows\System\QrIFwVz.exe
  C:\Windows\System\QrIFwVz.exe
  2⤵
  PID:6472
- C:\Windows\System\PwHqhwL.exe
  C:\Windows\System\PwHqhwL.exe
  2⤵
  PID:6808
- C:\Windows\System\tjBFOtv.exe
  C:\Windows\System\tjBFOtv.exe
  2⤵
  PID:6944
- C:\Windows\System\ABqbjQV.exe
  C:\Windows\System\ABqbjQV.exe
  2⤵
  PID:6208
- C:\Windows\System\rpxiwZF.exe
  C:\Windows\System\rpxiwZF.exe
  2⤵
  PID:6396
- C:\Windows\System\ULwDXcc.exe
  C:\Windows\System\ULwDXcc.exe
  2⤵
  PID:11768
- C:\Windows\System\cgGPheJ.exe
  C:\Windows\System\cgGPheJ.exe
  2⤵
  PID:6528
- C:\Windows\System\QzrDNKa.exe
  C:\Windows\System\QzrDNKa.exe
  2⤵
  PID:3948
- C:\Windows\System\BJICmuV.exe
  C:\Windows\System\BJICmuV.exe
  2⤵
  PID:5688
- C:\Windows\System\PmoQhRV.exe
  C:\Windows\System\PmoQhRV.exe
  2⤵
  PID:6548
- C:\Windows\System\rswPLSk.exe
  C:\Windows\System\rswPLSk.exe
  2⤵
  PID:6180
- C:\Windows\System\niPkKcz.exe
  C:\Windows\System\niPkKcz.exe
  2⤵
  PID:7288
- C:\Windows\System\jBFdjZC.exe
  C:\Windows\System\jBFdjZC.exe
  2⤵
  PID:6772
- C:\Windows\System\RmFdeoJ.exe
  C:\Windows\System\RmFdeoJ.exe
  2⤵
  PID:7392
- C:\Windows\System\cYdeDIH.exe
  C:\Windows\System\cYdeDIH.exe
  2⤵
  PID:1188
- C:\Windows\System\ZUOLadF.exe
  C:\Windows\System\ZUOLadF.exe
  2⤵
  PID:7508
- C:\Windows\System\yTWaGaE.exe
  C:\Windows\System\yTWaGaE.exe
  2⤵
  PID:5780
- C:\Windows\System\UrIbbJy.exe
  C:\Windows\System\UrIbbJy.exe
  2⤵
  PID:6612
- C:\Windows\System\MZASDgT.exe
  C:\Windows\System\MZASDgT.exe
  2⤵
  PID:7840
- C:\Windows\System\FBTuNlq.exe
  C:\Windows\System\FBTuNlq.exe
  2⤵
  PID:6392
- C:\Windows\System\uXwNand.exe
  C:\Windows\System\uXwNand.exe
  2⤵
  PID:6760
- C:\Windows\System\KkPIlOU.exe
  C:\Windows\System\KkPIlOU.exe
  2⤵
  PID:8060
- C:\Windows\System\yevQbrH.exe
  C:\Windows\System\yevQbrH.exe
  2⤵
  PID:12720
- C:\Windows\System\CGOiUJg.exe
  C:\Windows\System\CGOiUJg.exe
  2⤵
  PID:2096
- C:\Windows\System\WjgCIMd.exe
  C:\Windows\System\WjgCIMd.exe
  2⤵
  PID:8128
- C:\Windows\System\hLCfSQS.exe
  C:\Windows\System\hLCfSQS.exe
  2⤵
  PID:6948
- C:\Windows\System\fSPolUg.exe
  C:\Windows\System\fSPolUg.exe
  2⤵
  PID:13192
- C:\Windows\System\kzhIuTm.exe
  C:\Windows\System\kzhIuTm.exe
  2⤵
  PID:2168
- C:\Windows\System\SoXjfYy.exe
  C:\Windows\System\SoXjfYy.exe
  2⤵
  PID:6836
- C:\Windows\System\zyXqYsd.exe
  C:\Windows\System\zyXqYsd.exe
  2⤵
  PID:404
- C:\Windows\System\bWNRxwb.exe
  C:\Windows\System\bWNRxwb.exe
  2⤵
  PID:13320
- C:\Windows\System\CGMvaCn.exe
  C:\Windows\System\CGMvaCn.exe
  2⤵
  PID:13344
- C:\Windows\System\ZnIAshV.exe
  C:\Windows\System\ZnIAshV.exe
  2⤵
  PID:13400
- C:\Windows\System\nzMIWjO.exe
  C:\Windows\System\nzMIWjO.exe
  2⤵
  PID:13420
- C:\Windows\System\vFqnCiw.exe
  C:\Windows\System\vFqnCiw.exe
  2⤵
  PID:13436
- C:\Windows\System\hlwCfBc.exe
  C:\Windows\System\hlwCfBc.exe
  2⤵
  PID:13460
- C:\Windows\System\kmqCHUJ.exe
  C:\Windows\System\kmqCHUJ.exe
  2⤵
  PID:13488
- C:\Windows\System\HDdYlSO.exe
  C:\Windows\System\HDdYlSO.exe
  2⤵
  PID:13516
- C:\Windows\System\jHgJzea.exe
  C:\Windows\System\jHgJzea.exe
  2⤵
  PID:13536
- C:\Windows\System\abWDRPi.exe
  C:\Windows\System\abWDRPi.exe
  2⤵
  PID:13556
- C:\Windows\System\idosqIk.exe
  C:\Windows\System\idosqIk.exe
  2⤵
  PID:13580
- C:\Windows\System\NhVOSfb.exe
  C:\Windows\System\NhVOSfb.exe
  2⤵
  PID:13608
- C:\Windows\System\NKwgPGF.exe
  C:\Windows\System\NKwgPGF.exe
  2⤵
  PID:13632
- C:\Windows\System\DhgevCg.exe
  C:\Windows\System\DhgevCg.exe
  2⤵
  PID:13648
- C:\Windows\System\ymBqMav.exe
  C:\Windows\System\ymBqMav.exe
  2⤵
  PID:13680
- C:\Windows\System\zEojvUT.exe
  C:\Windows\System\zEojvUT.exe
  2⤵
  PID:13744
- C:\Windows\System\TMGIUUJ.exe
  C:\Windows\System\TMGIUUJ.exe
  2⤵
  PID:13780
- C:\Windows\System\yvDmttk.exe
  C:\Windows\System\yvDmttk.exe
  2⤵
  PID:13820
- C:\Windows\System\eddUiev.exe
  C:\Windows\System\eddUiev.exe
  2⤵
  PID:13848
- C:\Windows\System\cPKefyR.exe
  C:\Windows\System\cPKefyR.exe
  2⤵
  PID:13868
- C:\Windows\System\sRIXpSU.exe
  C:\Windows\System\sRIXpSU.exe
  2⤵
  PID:13900
- C:\Windows\System\ldPQKNp.exe
  C:\Windows\System\ldPQKNp.exe
  2⤵
  PID:13920
- C:\Windows\System\DqXWfDh.exe
  C:\Windows\System\DqXWfDh.exe
  2⤵
  PID:13944
- C:\Windows\System\rBVOeAr.exe
  C:\Windows\System\rBVOeAr.exe
  2⤵
  PID:13964
- C:\Windows\System\mbsPKNU.exe
  C:\Windows\System\mbsPKNU.exe
  2⤵
  PID:13988
- C:\Windows\System\dXmteiT.exe
  C:\Windows\System\dXmteiT.exe
  2⤵
  PID:14008
- C:\Windows\System\yCRtjxo.exe
  C:\Windows\System\yCRtjxo.exe
  2⤵
  PID:14048
- C:\Windows\System\GXEkKhP.exe
  C:\Windows\System\GXEkKhP.exe
  2⤵
  PID:14072
- C:\Windows\System\RrYWKXs.exe
  C:\Windows\System\RrYWKXs.exe
  2⤵
  PID:14092
- C:\Windows\System\HCFRygp.exe
  C:\Windows\System\HCFRygp.exe
  2⤵
  PID:14120
- C:\Windows\System\bTKhGyW.exe
  C:\Windows\System\bTKhGyW.exe
  2⤵
  PID:14144
- C:\Windows\System\JRdpSjd.exe
  C:\Windows\System\JRdpSjd.exe
  2⤵
  PID:14164
- C:\Windows\System\IXNPEsb.exe
  C:\Windows\System\IXNPEsb.exe
  2⤵
  PID:14180
- C:\Windows\System\NMKmDVR.exe
  C:\Windows\System\NMKmDVR.exe
  2⤵
  PID:14216
- C:\Windows\System\fapxWNQ.exe
  C:\Windows\System\fapxWNQ.exe
  2⤵
  PID:14236
- C:\Windows\System\hpiIkVf.exe
  C:\Windows\System\hpiIkVf.exe
  2⤵
  PID:14256
- C:\Windows\System\GEkEvaG.exe
  C:\Windows\System\GEkEvaG.exe
  2⤵
  PID:14308
- C:\Windows\System\nVGDptM.exe
  C:\Windows\System\nVGDptM.exe
  2⤵
  PID:14324
- C:\Windows\System\hOzjMsx.exe
  C:\Windows\System\hOzjMsx.exe
  2⤵
  PID:13340
- C:\Windows\System\ZYYSzLd.exe
  C:\Windows\System\ZYYSzLd.exe
  2⤵
  PID:6320
- C:\Windows\System\NWxndnV.exe
  C:\Windows\System\NWxndnV.exe
  2⤵
  PID:13364
- C:\Windows\System\HaYsJSh.exe
  C:\Windows\System\HaYsJSh.exe
  2⤵
  PID:13416
- C:\Windows\System\ERTyEeu.exe
  C:\Windows\System\ERTyEeu.exe
  2⤵
  PID:13508
- C:\Windows\System\oUuGHaG.exe
  C:\Windows\System\oUuGHaG.exe
  2⤵
  PID:13628
- C:\Windows\System\WfeyWAT.exe
  C:\Windows\System\WfeyWAT.exe
  2⤵
  PID:14224
- C:\Windows\System\QrwCnzi.exe
  C:\Windows\System\QrwCnzi.exe
  2⤵
  PID:14252
- C:\Windows\System\lCCrXFV.exe
  C:\Windows\System\lCCrXFV.exe
  2⤵
  PID:6184
- C:\Windows\System\kRgfddf.exe
  C:\Windows\System\kRgfddf.exe
  2⤵
  PID:13504
- C:\Windows\System\ueLfRdQ.exe
  C:\Windows\System\ueLfRdQ.exe
  2⤵
  PID:13940
- C:\Windows\System\caEsGNG.exe
  C:\Windows\System\caEsGNG.exe
  2⤵
  PID:14000
- C:\Windows\System\epPqOzB.exe
  C:\Windows\System\epPqOzB.exe
  2⤵
  PID:14156
- C:\Windows\System\JtIgWal.exe
  C:\Windows\System\JtIgWal.exe
  2⤵
  PID:7128
- C:\Windows\System\xgjtfUG.exe
  C:\Windows\System\xgjtfUG.exe
  2⤵
  PID:14300
- C:\Windows\System\EKWDpOy.exe
  C:\Windows\System\EKWDpOy.exe
  2⤵
  PID:14284
- C:\Windows\System\adBhlPq.exe
  C:\Windows\System\adBhlPq.exe
  2⤵
  PID:3152
- C:\Windows\System\ZsalEeC.exe
  C:\Windows\System\ZsalEeC.exe
  2⤵
  PID:13512
- C:\Windows\System\PTTjcyR.exe
  C:\Windows\System\PTTjcyR.exe
  2⤵
  PID:13828
- C:\Windows\System\dKeuCdZ.exe
  C:\Windows\System\dKeuCdZ.exe
  2⤵
  PID:13624
- C:\Windows\System\DOfKnUi.exe
  C:\Windows\System\DOfKnUi.exe
  2⤵
  PID:13816
- C:\Windows\System\CLdXGtX.exe
  C:\Windows\System\CLdXGtX.exe
  2⤵
  PID:8212
- C:\Windows\System\GXkDFXd.exe
  C:\Windows\System\GXkDFXd.exe
  2⤵
  PID:8528
- C:\Windows\System\ycmjOTW.exe
  C:\Windows\System\ycmjOTW.exe
  2⤵
  PID:8548
- C:\Windows\System\aXFPPkg.exe
  C:\Windows\System\aXFPPkg.exe
  2⤵
  PID:8632
- C:\Windows\System\IMRLXVx.exe
  C:\Windows\System\IMRLXVx.exe
  2⤵
  PID:5748
- C:\Windows\System\CRrTsEf.exe
  C:\Windows\System\CRrTsEf.exe
  2⤵
  PID:5932
- C:\Windows\System\NIKqhFS.exe
  C:\Windows\System\NIKqhFS.exe
  2⤵
  PID:9080
- C:\Windows\System\fJbTqCK.exe
  C:\Windows\System\fJbTqCK.exe
  2⤵
  PID:9184
- C:\Windows\System\eloEMPD.exe
  C:\Windows\System\eloEMPD.exe
  2⤵
  PID:6532
- C:\Windows\System\yKuGQUj.exe
  C:\Windows\System\yKuGQUj.exe
  2⤵
  PID:14136
- C:\Windows\System\spyIBVO.exe
  C:\Windows\System\spyIBVO.exe
  2⤵
  PID:14104
- C:\Windows\System\lzVDFMm.exe
  C:\Windows\System\lzVDFMm.exe
  2⤵
  PID:14248
- C:\Windows\System\lgQtXCt.exe
  C:\Windows\System\lgQtXCt.exe
  2⤵
  PID:13876
- C:\Windows\System\iUeBIud.exe
  C:\Windows\System\iUeBIud.exe
  2⤵
  PID:2000
- C:\Windows\System\SIIDzbp.exe
  C:\Windows\System\SIIDzbp.exe
  2⤵
  PID:8540
- C:\Windows\System\PCSsoOY.exe
  C:\Windows\System\PCSsoOY.exe
  2⤵
  PID:8888
- C:\Windows\System\nJtBrTR.exe
  C:\Windows\System\nJtBrTR.exe
  2⤵
  PID:14356
- C:\Windows\System\TtcYJeB.exe
  C:\Windows\System\TtcYJeB.exe
  2⤵
  PID:14392
- C:\Windows\System\lKxdlUk.exe
  C:\Windows\System\lKxdlUk.exe
  2⤵
  PID:14560
- C:\Windows\System\xPKzgHK.exe
  C:\Windows\System\xPKzgHK.exe
  2⤵
  PID:14576
- C:\Windows\System\GzloQfz.exe
  C:\Windows\System\GzloQfz.exe
  2⤵
  PID:14604
- C:\Windows\System\ZiXuMEQ.exe
  C:\Windows\System\ZiXuMEQ.exe
  2⤵
  PID:14624
- C:\Windows\System\yJdBRnI.exe
  C:\Windows\System\yJdBRnI.exe
  2⤵
  PID:14652
- C:\Windows\System\edPGUFE.exe
  C:\Windows\System\edPGUFE.exe
  2⤵
  PID:14672
- C:\Windows\System\AhDNvJl.exe
  C:\Windows\System\AhDNvJl.exe
  2⤵
  PID:14688
- C:\Windows\System\WcAfzTh.exe
  C:\Windows\System\WcAfzTh.exe
  2⤵
  PID:14704
- C:\Windows\System\YJGDdCt.exe
  C:\Windows\System\YJGDdCt.exe
  2⤵
  PID:14720
- C:\Windows\System\nofTMVC.exe
  C:\Windows\System\nofTMVC.exe
  2⤵
  PID:14740
- C:\Windows\System\XyDxcoQ.exe
  C:\Windows\System\XyDxcoQ.exe
  2⤵
  PID:14764
- C:\Windows\System\vrePAil.exe
  C:\Windows\System\vrePAil.exe
  2⤵
  PID:14780
- C:\Windows\System\OWqjeVZ.exe
  C:\Windows\System\OWqjeVZ.exe
  2⤵
  PID:14808
- C:\Windows\System\UhuRcTW.exe
  C:\Windows\System\UhuRcTW.exe
  2⤵
  PID:14824
- C:\Windows\System\THsYhoq.exe
  C:\Windows\System\THsYhoq.exe
  2⤵
  PID:14840
- C:\Windows\System\whivauc.exe
  C:\Windows\System\whivauc.exe
  2⤵
  PID:14856
- C:\Windows\System\ztdeyst.exe
  C:\Windows\System\ztdeyst.exe
  2⤵
  PID:14872
- C:\Windows\System\pxcZDsh.exe
  C:\Windows\System\pxcZDsh.exe
  2⤵
  PID:14888
- C:\Windows\System\ABVSqiB.exe
  C:\Windows\System\ABVSqiB.exe
  2⤵
  PID:14904
- C:\Windows\System\rEMRdbp.exe
  C:\Windows\System\rEMRdbp.exe
  2⤵
  PID:14924
- C:\Windows\System\zukhmkW.exe
  C:\Windows\System\zukhmkW.exe
  2⤵
  PID:14948
- C:\Windows\System\lyZHogE.exe
  C:\Windows\System\lyZHogE.exe
  2⤵
  PID:14972
- C:\Windows\System\ZRaiCMW.exe
  C:\Windows\System\ZRaiCMW.exe
  2⤵
  PID:14992
- C:\Windows\System\GHnwluX.exe
  C:\Windows\System\GHnwluX.exe
  2⤵
  PID:15072
- C:\Windows\System\whvcbrs.exe
  C:\Windows\System\whvcbrs.exe
  2⤵
  PID:15108
- C:\Windows\System\hkaMeKQ.exe
  C:\Windows\System\hkaMeKQ.exe
  2⤵
  PID:15148
- C:\Windows\System\jcdWZQD.exe
  C:\Windows\System\jcdWZQD.exe
  2⤵
  PID:15176
- C:\Windows\System\kkFRNtC.exe
  C:\Windows\System\kkFRNtC.exe
  2⤵
  PID:15196
- C:\Windows\System\oTiphqO.exe
  C:\Windows\System\oTiphqO.exe
  2⤵
  PID:15228
- C:\Windows\System\nULMtBn.exe
  C:\Windows\System\nULMtBn.exe
  2⤵
  PID:15248
- C:\Windows\System\kPCXLdi.exe
  C:\Windows\System\kPCXLdi.exe
  2⤵
  PID:15280
- C:\Windows\System\iFpYbbv.exe
  C:\Windows\System\iFpYbbv.exe
  2⤵
  PID:15304
- C:\Windows\System\IbxwtLY.exe
  C:\Windows\System\IbxwtLY.exe
  2⤵
  PID:15332
- C:\Windows\System\oSIiYJu.exe
  C:\Windows\System\oSIiYJu.exe
  2⤵
  PID:15352
- C:\Windows\System\aCqLafH.exe
  C:\Windows\System\aCqLafH.exe
  2⤵
  PID:13952
- C:\Windows\System\lRZkSHQ.exe
  C:\Windows\System\lRZkSHQ.exe
  2⤵
  PID:4104
- C:\Windows\System\gsdrWAK.exe
  C:\Windows\System\gsdrWAK.exe
  2⤵
  PID:6124
- C:\Windows\System\SQTRFps.exe
  C:\Windows\System\SQTRFps.exe
  2⤵
  PID:13568
- C:\Windows\System\mVTLnzC.exe
  C:\Windows\System\mVTLnzC.exe
  2⤵
  PID:14020
- C:\Windows\System\ToGmPpG.exe
  C:\Windows\System\ToGmPpG.exe
  2⤵
  PID:6644
- C:\Windows\System\FGzQybv.exe
  C:\Windows\System\FGzQybv.exe
  2⤵
  PID:1664
- C:\Windows\System\JOJsGNZ.exe
  C:\Windows\System\JOJsGNZ.exe
  2⤵
  PID:6752
- C:\Windows\System\nsyOFgN.exe
  C:\Windows\System\nsyOFgN.exe
  2⤵
  PID:7280
- C:\Windows\System\YZbGHIs.exe
  C:\Windows\System\YZbGHIs.exe
  2⤵
  PID:7400
- C:\Windows\System\iEKCIas.exe
  C:\Windows\System\iEKCIas.exe
  2⤵
  PID:14572
- C:\Windows\System\ENjaPdj.exe
  C:\Windows\System\ENjaPdj.exe
  2⤵
  PID:7476
- C:\Windows\System\juJUJoF.exe
  C:\Windows\System\juJUJoF.exe
  2⤵
  PID:14736
- C:\Windows\System\WUnJRre.exe
  C:\Windows\System\WUnJRre.exe
  2⤵
  PID:11124
- C:\Windows\System\iICToau.exe
  C:\Windows\System\iICToau.exe
  2⤵
  PID:7756
- C:\Windows\System\gsBxNwf.exe
  C:\Windows\System\gsBxNwf.exe
  2⤵
  PID:7736
- C:\Windows\System\oxzdlpu.exe
  C:\Windows\System\oxzdlpu.exe
  2⤵
  PID:7920
- C:\Windows\System\zSobmIn.exe
  C:\Windows\System\zSobmIn.exe
  2⤵
  PID:7472
- C:\Windows\System\ETfHcMv.exe
  C:\Windows\System\ETfHcMv.exe
  2⤵
  PID:8056
- C:\Windows\System\pNSHMIq.exe
  C:\Windows\System\pNSHMIq.exe
  2⤵
  PID:14960
- C:\Windows\System\hHCvmub.exe
  C:\Windows\System\hHCvmub.exe
  2⤵
  PID:14984
- C:\Windows\System\wqPkxsi.exe
  C:\Windows\System\wqPkxsi.exe
  2⤵
  PID:13836
- C:\Windows\System\DgVtcMG.exe
  C:\Windows\System\DgVtcMG.exe
  2⤵
  PID:15184
- C:\Windows\System\NywxTHA.exe
  C:\Windows\System\NywxTHA.exe
  2⤵
  PID:15088
- C:\Windows\System\wHKSmKa.exe
  C:\Windows\System\wHKSmKa.exe
  2⤵
  PID:14400
- C:\Windows\System\tOqLvAJ.exe
  C:\Windows\System\tOqLvAJ.exe
  2⤵
  PID:15324
- C:\Windows\System\GFsWskp.exe
  C:\Windows\System\GFsWskp.exe
  2⤵
  PID:15272
- C:\Windows\System\SmVECGM.exe
  C:\Windows\System\SmVECGM.exe
  2⤵
  PID:8792
- C:\Windows\System\xeDQfOo.exe
  C:\Windows\System\xeDQfOo.exe
  2⤵
  PID:7260
- C:\Windows\System\tcOHYqW.exe
  C:\Windows\System\tcOHYqW.exe
  2⤵
  PID:14512
- C:\Windows\System\rKpxuGl.exe
  C:\Windows\System\rKpxuGl.exe
  2⤵
  PID:14620
- C:\Windows\System\KNqyGeL.exe
  C:\Windows\System\KNqyGeL.exe
  2⤵
  PID:14660
- C:\Windows\System\BDTproo.exe
  C:\Windows\System\BDTproo.exe
  2⤵
  PID:14944
- C:\Windows\System\ZpVUCfO.exe
  C:\Windows\System\ZpVUCfO.exe
  2⤵
  PID:11132
- C:\Windows\System\FvcyFwb.exe
  C:\Windows\System\FvcyFwb.exe
  2⤵
  PID:14988
- C:\Windows\System\ohPuWJC.exe
  C:\Windows\System\ohPuWJC.exe
  2⤵
  PID:15144
- C:\Windows\System\PUqFegr.exe
  C:\Windows\System\PUqFegr.exe
  2⤵
  PID:15204
- C:\Windows\System\cXNQMAo.exe
  C:\Windows\System\cXNQMAo.exe
  2⤵
  PID:15256
- C:\Windows\System\HiWZkdb.exe
  C:\Windows\System\HiWZkdb.exe
  2⤵
  PID:14456
- C:\Windows\System\tbusSOp.exe
  C:\Windows\System\tbusSOp.exe
  2⤵
  PID:7856
- C:\Windows\System\oPgsVYx.exe
  C:\Windows\System\oPgsVYx.exe
  2⤵
  PID:7540
- C:\Windows\System\TrUoEUb.exe
  C:\Windows\System\TrUoEUb.exe
  2⤵
  PID:8500
- C:\Windows\System\fTNCVSs.exe
  C:\Windows\System\fTNCVSs.exe
  2⤵
  PID:7408
- C:\Windows\System\GfJsFnD.exe
  C:\Windows\System\GfJsFnD.exe
  2⤵
  PID:15320
- C:\Windows\System\QQNHEmG.exe
  C:\Windows\System\QQNHEmG.exe
  2⤵
  PID:14348
- C:\Windows\System\GLnPiTr.exe
  C:\Windows\System\GLnPiTr.exe
  2⤵
  PID:15368
- C:\Windows\System\yjmwsKk.exe
  C:\Windows\System\yjmwsKk.exe
  2⤵
  PID:15396
- C:\Windows\System\zGzPzNZ.exe
  C:\Windows\System\zGzPzNZ.exe
  2⤵
  PID:15432
- C:\Windows\System\pdmQhmR.exe
  C:\Windows\System\pdmQhmR.exe
  2⤵
  PID:15488
- C:\Windows\System\OlNKhcu.exe
  C:\Windows\System\OlNKhcu.exe
  2⤵
  PID:15516
- C:\Windows\System\saaHYpk.exe
  C:\Windows\System\saaHYpk.exe
  2⤵
  PID:15544
- C:\Windows\System\NHJRmcm.exe
  C:\Windows\System\NHJRmcm.exe
  2⤵
  PID:15568
- C:\Windows\System\RcoRHEG.exe
  C:\Windows\System\RcoRHEG.exe
  2⤵
  PID:15584
- C:\Windows\System\VPaZgqF.exe
  C:\Windows\System\VPaZgqF.exe
  2⤵
  PID:15608
- C:\Windows\System\MEDmwDZ.exe
  C:\Windows\System\MEDmwDZ.exe
  2⤵
  PID:15624
- C:\Windows\System\UhSEocm.exe
  C:\Windows\System\UhSEocm.exe
  2⤵
  PID:15644
- C:\Windows\System\wVcRieS.exe
  C:\Windows\System\wVcRieS.exe
  2⤵
  PID:15668
- C:\Windows\System\rAkLoxl.exe
  C:\Windows\System\rAkLoxl.exe
  2⤵
  PID:15692
- C:\Windows\System\sOlnkIW.exe
  C:\Windows\System\sOlnkIW.exe
  2⤵
  PID:15708
- C:\Windows\System\mjsQQxy.exe
  C:\Windows\System\mjsQQxy.exe
  2⤵
  PID:15728
- C:\Windows\System\OjtNQDM.exe
  C:\Windows\System\OjtNQDM.exe
  2⤵
  PID:15756
- C:\Windows\System\uZtGJVN.exe
  C:\Windows\System\uZtGJVN.exe
  2⤵
  PID:15780
- C:\Windows\System\BGCXWwb.exe
  C:\Windows\System\BGCXWwb.exe
  2⤵
  PID:15796
- C:\Windows\System\zgAestc.exe
  C:\Windows\System\zgAestc.exe
  2⤵
  PID:15816
- C:\Windows\System\rpnkSNB.exe
  C:\Windows\System\rpnkSNB.exe
  2⤵
  PID:15844
- C:\Windows\System\LMjqDDW.exe
  C:\Windows\System\LMjqDDW.exe
  2⤵
  PID:15864
- C:\Windows\System\mDApFna.exe
  C:\Windows\System\mDApFna.exe
  2⤵
  PID:15892
- C:\Windows\System\KMkqzfw.exe
  C:\Windows\System\KMkqzfw.exe
  2⤵
  PID:15924
- C:\Windows\System\eYtDILI.exe
  C:\Windows\System\eYtDILI.exe
  2⤵
  PID:15944
- C:\Windows\System\FCmCiGN.exe
  C:\Windows\System\FCmCiGN.exe
  2⤵
  PID:15964
- C:\Windows\System\lXjnLjx.exe
  C:\Windows\System\lXjnLjx.exe
  2⤵
  PID:16016
- C:\Windows\System\GjtALNn.exe
  C:\Windows\System\GjtALNn.exe
  2⤵
  PID:16040
- C:\Windows\System\OzVCamQ.exe
  C:\Windows\System\OzVCamQ.exe
  2⤵
  PID:16068
- C:\Windows\System\XXsJXhZ.exe
  C:\Windows\System\XXsJXhZ.exe
  2⤵
  PID:16084
- C:\Windows\System\DELcRrP.exe
  C:\Windows\System\DELcRrP.exe
  2⤵
  PID:16108
- C:\Windows\System\XDVgSOP.exe
  C:\Windows\System\XDVgSOP.exe
  2⤵
  PID:16128
- C:\Windows\System\vtMCVds.exe
  C:\Windows\System\vtMCVds.exe
  2⤵
  PID:16240
- C:\Windows\System\Xbsuoyi.exe
  C:\Windows\System\Xbsuoyi.exe
  2⤵
  PID:16264
- C:\Windows\System\MFWteHk.exe
  C:\Windows\System\MFWteHk.exe
  2⤵
  PID:16284
- C:\Windows\System\PZYrXuI.exe
  C:\Windows\System\PZYrXuI.exe
  2⤵
  PID:16324
- C:\Windows\System\qhCzSZq.exe
  C:\Windows\System\qhCzSZq.exe
  2⤵
  PID:8004
- C:\Windows\System\DMFVweR.exe
  C:\Windows\System\DMFVweR.exe
  2⤵
  PID:7812
- C:\Windows\System\gYhnFPv.exe
  C:\Windows\System\gYhnFPv.exe
  2⤵
  PID:7836
- C:\Windows\System\rvCnpzt.exe
  C:\Windows\System\rvCnpzt.exe
  2⤵
  PID:7412
- C:\Windows\System\CyrWCvo.exe
  C:\Windows\System\CyrWCvo.exe
  2⤵
  PID:15392
- C:\Windows\System\gxBUlEg.exe
  C:\Windows\System\gxBUlEg.exe
  2⤵
  PID:7572
- C:\Windows\System\cIgXnZc.exe
  C:\Windows\System\cIgXnZc.exe
  2⤵
  PID:15528
- C:\Windows\System\HJaUaog.exe
  C:\Windows\System\HJaUaog.exe
  2⤵
  PID:15580
- C:\Windows\System\TRCafHH.exe
  C:\Windows\System\TRCafHH.exe
  2⤵
  PID:15656
- C:\Windows\System\TQqvurO.exe
  C:\Windows\System\TQqvurO.exe
  2⤵
  PID:7764
- C:\Windows\System\CrGrNON.exe
  C:\Windows\System\CrGrNON.exe
  2⤵
  PID:8248
- C:\Windows\System\OkVkOWf.exe
  C:\Windows\System\OkVkOWf.exe
  2⤵
  PID:15748
- C:\Windows\System\SYsYcby.exe
  C:\Windows\System\SYsYcby.exe
  2⤵
  PID:15660
- C:\Windows\System\jwHOWBm.exe
  C:\Windows\System\jwHOWBm.exe
  2⤵
  PID:15836
- C:\Windows\System\MXgvXiz.exe
  C:\Windows\System\MXgvXiz.exe
  2⤵
  PID:8440
- C:\Windows\System\GrCKFrl.exe
  C:\Windows\System\GrCKFrl.exe
  2⤵
  PID:15812
- C:\Windows\System\KpTdTKx.exe
  C:\Windows\System\KpTdTKx.exe
  2⤵
  PID:15880
- C:\Windows\System\QUPCMAN.exe
  C:\Windows\System\QUPCMAN.exe
  2⤵
  PID:8504
- C:\Windows\System\EEolDRN.exe
  C:\Windows\System\EEolDRN.exe
  2⤵
  PID:8648
- C:\Windows\System\aqBpcKr.exe
  C:\Windows\System\aqBpcKr.exe
  2⤵
  PID:15980
- C:\Windows\System\AYEOddx.exe
  C:\Windows\System\AYEOddx.exe
  2⤵
  PID:8816
- C:\Windows\System\iBIjEmj.exe
  C:\Windows\System\iBIjEmj.exe
  2⤵
  PID:8708
- C:\Windows\System\UyOAMNe.exe
  C:\Windows\System\UyOAMNe.exe
  2⤵
  PID:8804
- C:\Windows\System\ZSIXPqJ.exe
  C:\Windows\System\ZSIXPqJ.exe
  2⤵
  PID:8968
- C:\Windows\System\VrQCxsO.exe
  C:\Windows\System\VrQCxsO.exe
  2⤵
  PID:8844
- C:\Windows\System\VfaaoLS.exe
  C:\Windows\System\VfaaoLS.exe
  2⤵
  PID:9016
- C:\Windows\System\VKFcnvb.exe
  C:\Windows\System\VKFcnvb.exe
  2⤵
  PID:16256
- C:\Windows\System\dYhidET.exe
  C:\Windows\System\dYhidET.exe
  2⤵
  PID:16280
- C:\Windows\System\nyCQoGA.exe
  C:\Windows\System\nyCQoGA.exe
  2⤵
  PID:8272
- C:\Windows\System\VLxyAER.exe
  C:\Windows\System\VLxyAER.exe
  2⤵
  PID:16304
- C:\Windows\System\sKEoWyJ.exe
  C:\Windows\System\sKEoWyJ.exe
  2⤵
  PID:16276
- C:\Windows\System\IPeSsEm.exe
  C:\Windows\System\IPeSsEm.exe
  2⤵
  PID:7728
- C:\Windows\System\jMgFgHN.exe
  C:\Windows\System\jMgFgHN.exe
  2⤵
  PID:8680
- C:\Windows\System\qPyMGGQ.exe
  C:\Windows\System\qPyMGGQ.exe
  2⤵
  PID:3148
- C:\Windows\System\eAddFKi.exe
  C:\Windows\System\eAddFKi.exe
  2⤵
  PID:7496
- C:\Windows\System\iHGpyQX.exe
  C:\Windows\System\iHGpyQX.exe
  2⤵
  PID:7992
- C:\Windows\System\IWJNBXg.exe
  C:\Windows\System\IWJNBXg.exe
  2⤵
  PID:7360
- C:\Windows\System\xUIJFaX.exe
  C:\Windows\System\xUIJFaX.exe
  2⤵
  PID:7844
- C:\Windows\System\roiIiGM.exe
  C:\Windows\System\roiIiGM.exe
  2⤵
  PID:12120
- C:\Windows\System\BOqxDsI.exe
  C:\Windows\System\BOqxDsI.exe
  2⤵
  PID:8216
- C:\Windows\System\pMxDDEJ.exe
  C:\Windows\System\pMxDDEJ.exe
  2⤵
  PID:8324
- C:\Windows\System\cwChsEI.exe
  C:\Windows\System\cwChsEI.exe
  2⤵
  PID:8392
- C:\Windows\System\lwpsWqK.exe
  C:\Windows\System\lwpsWqK.exe
  2⤵
  PID:8424
- C:\Windows\System\KgwjFkm.exe
  C:\Windows\System\KgwjFkm.exe
  2⤵
  PID:8628
- C:\Windows\System\CegUVHU.exe
  C:\Windows\System\CegUVHU.exe
  2⤵
  PID:15904
- C:\Windows\System\LaCOnCI.exe
  C:\Windows\System\LaCOnCI.exe
  2⤵
  PID:8620
- C:\Windows\System\upIDUTd.exe
  C:\Windows\System\upIDUTd.exe
  2⤵
  PID:8900
- C:\Windows\System\TGkSBYb.exe
  C:\Windows\System\TGkSBYb.exe
  2⤵
  PID:7488
- C:\Windows\System\AyiAEaK.exe
  C:\Windows\System\AyiAEaK.exe
  2⤵
  PID:16308
- C:\Windows\System\nrxpXBu.exe
  C:\Windows\System\nrxpXBu.exe
  2⤵
  PID:7792
- C:\Windows\System\oxVeumq.exe
  C:\Windows\System\oxVeumq.exe
  2⤵
  PID:8688
- C:\Windows\System\inSPEyz.exe
  C:\Windows\System\inSPEyz.exe
  2⤵
  PID:15508
- C:\Windows\System\IQDAGpz.exe
  C:\Windows\System\IQDAGpz.exe
  2⤵
  PID:8160
- C:\Windows\System\QDQZHnk.exe
  C:\Windows\System\QDQZHnk.exe
  2⤵
  PID:9128
- C:\Windows\System\vrjfVYq.exe
  C:\Windows\System\vrjfVYq.exe
  2⤵
  PID:15776
- C:\Windows\System\yEBeJQW.exe
  C:\Windows\System\yEBeJQW.exe
  2⤵
  PID:16124
- C:\Windows\System\CPRqthL.exe
  C:\Windows\System\CPRqthL.exe
  2⤵
  PID:16092
- C:\Windows\System\dNAGPEj.exe
  C:\Windows\System\dNAGPEj.exe
  2⤵
  PID:8472
- C:\Windows\System\xKauIkK.exe
  C:\Windows\System\xKauIkK.exe
  2⤵
  PID:8288
- C:\Windows\System\urNWDqv.exe
  C:\Windows\System\urNWDqv.exe
  2⤵
  PID:8304
- C:\Windows\System\KhrZFkc.exe
  C:\Windows\System\KhrZFkc.exe
  2⤵
  PID:16312
- C:\Windows\System\EcTaOxm.exe
  C:\Windows\System\EcTaOxm.exe
  2⤵
  PID:15364
- C:\Windows\System\diBrBms.exe
  C:\Windows\System\diBrBms.exe
  2⤵
  PID:8016
- C:\Windows\System\CPDTiOD.exe
  C:\Windows\System\CPDTiOD.exe
  2⤵
  PID:9356
- C:\Windows\System\cOLDSeK.exe
  C:\Windows\System\cOLDSeK.exe
  2⤵
  PID:9508
- C:\Windows\System\dqCPXJY.exe
  C:\Windows\System\dqCPXJY.exe
  2⤵
  PID:3572
- C:\Windows\System\wDKeZmT.exe
  C:\Windows\System\wDKeZmT.exe
  2⤵
  PID:9044
- C:\Windows\System\OHgFstE.exe
  C:\Windows\System\OHgFstE.exe
  2⤵
  PID:9488
- C:\Windows\System\eNMLeTb.exe
  C:\Windows\System\eNMLeTb.exe
  2⤵
  PID:15792
- C:\Windows\System\gqicEoa.exe
  C:\Windows\System\gqicEoa.exe
  2⤵
  PID:9620
- C:\Windows\System\gXnGLtg.exe
  C:\Windows\System\gXnGLtg.exe
  2⤵
  PID:7876
- C:\Windows\System\TAzjtXy.exe
  C:\Windows\System\TAzjtXy.exe
  2⤵
  PID:9720
- C:\Windows\System\LhwSaHc.exe
  C:\Windows\System\LhwSaHc.exe
  2⤵
  PID:11824
- C:\Windows\System\YKCsiYZ.exe
  C:\Windows\System\YKCsiYZ.exe
  2⤵
  PID:9464
- C:\Windows\System\nIiAocN.exe
  C:\Windows\System\nIiAocN.exe
  2⤵
  PID:9728
- C:\Windows\System\uELitVe.exe
  C:\Windows\System\uELitVe.exe
  2⤵
  PID:9512
- C:\Windows\System\huJJVDF.exe
  C:\Windows\System\huJJVDF.exe
  2⤵
  PID:9388
- C:\Windows\System\fvVsvYu.exe
  C:\Windows\System\fvVsvYu.exe
  2⤵
  PID:10156
- C:\Windows\System\rwLdtbT.exe
  C:\Windows\System\rwLdtbT.exe
  2⤵
  PID:9524
- C:\Windows\System\cxGrwfx.exe
  C:\Windows\System\cxGrwfx.exe
  2⤵
  PID:9776
- C:\Windows\System\zRcNDna.exe
  C:\Windows\System\zRcNDna.exe
  2⤵
  PID:11996
- C:\Windows\System\qjgmDLp.exe
  C:\Windows\System\qjgmDLp.exe
  2⤵
  PID:10016
- C:\Windows\System\hatgILL.exe
  C:\Windows\System\hatgILL.exe
  2⤵
  PID:9452
- C:\Windows\System\NKcnsqQ.exe
  C:\Windows\System\NKcnsqQ.exe
  2⤵
  PID:10112
- C:\Windows\System\oIyruoq.exe
  C:\Windows\System\oIyruoq.exe
  2⤵
  PID:9956
- C:\Windows\System\xotKefi.exe
  C:\Windows\System\xotKefi.exe
  2⤵
  PID:10084
- C:\Windows\System\vjmEYUn.exe
  C:\Windows\System\vjmEYUn.exe
  2⤵
  PID:10300
- C:\Windows\System\chtDiTf.exe
  C:\Windows\System\chtDiTf.exe
  2⤵
  PID:9416
- C:\Windows\System\TYYbHEL.exe
  C:\Windows\System\TYYbHEL.exe
  2⤵
  PID:1980
- C:\Windows\System\PfElVlv.exe
  C:\Windows\System\PfElVlv.exe
  2⤵
  PID:10464
- C:\Windows\System\bLnaQgB.exe
  C:\Windows\System\bLnaQgB.exe
  2⤵
  PID:10404
- C:\Windows\System\QjInklD.exe
  C:\Windows\System\QjInklD.exe
  2⤵
  PID:10500
- C:\Windows\System\NrntYoP.exe
  C:\Windows\System\NrntYoP.exe
  2⤵
  PID:10556
- C:\Windows\System\IKoPdCn.exe
  C:\Windows\System\IKoPdCn.exe
  2⤵
  PID:10764
- C:\Windows\System\oJlFVIT.exe
  C:\Windows\System\oJlFVIT.exe
  2⤵
  PID:10840
- C:\Windows\System\IEVzBhK.exe
  C:\Windows\System\IEVzBhK.exe
  2⤵
  PID:10748
- C:\Windows\System\RwspxDV.exe
  C:\Windows\System\RwspxDV.exe
  2⤵
  PID:10996
- C:\Windows\System\ylyHTnc.exe
  C:\Windows\System\ylyHTnc.exe
  2⤵
  PID:10896
- C:\Windows\System\RMSOhcc.exe
  C:\Windows\System\RMSOhcc.exe
  2⤵
  PID:11120
- C:\Windows\System\LsFhshQ.exe
  C:\Windows\System\LsFhshQ.exe
  2⤵
  PID:8132
- C:\Windows\System\aRKKTXU.exe
  C:\Windows\System\aRKKTXU.exe
  2⤵
  PID:9648
- C:\Windows\System\tgfFGSF.exe
  C:\Windows\System\tgfFGSF.exe
  2⤵
  PID:10104
- C:\Windows\System\wfwYkyI.exe
  C:\Windows\System\wfwYkyI.exe
  2⤵
  PID:8944
- C:\Windows\System\JvlfLGZ.exe
  C:\Windows\System\JvlfLGZ.exe
  2⤵
  PID:10616
- C:\Windows\System\bRjzODj.exe
  C:\Windows\System\bRjzODj.exe
  2⤵
  PID:10768
- C:\Windows\System\EZMFQkC.exe
  C:\Windows\System\EZMFQkC.exe
  2⤵
  PID:10916
- C:\Windows\System\GwQYDQN.exe
  C:\Windows\System\GwQYDQN.exe
  2⤵
  PID:10972
- C:\Windows\System\qjwhFgZ.exe
  C:\Windows\System\qjwhFgZ.exe
  2⤵
  PID:9004
- C:\Windows\System\EWiMmyC.exe
  C:\Windows\System\EWiMmyC.exe
  2⤵
  PID:9264
- C:\Windows\System\BKhqugV.exe
  C:\Windows\System\BKhqugV.exe
  2⤵
  PID:11128
- C:\Windows\System\FIUcewn.exe
  C:\Windows\System\FIUcewn.exe
  2⤵
  PID:10264
- C:\Windows\System\DJkkGUo.exe
  C:\Windows\System\DJkkGUo.exe
  2⤵
  PID:9680
- C:\Windows\System\FhWfkAi.exe
  C:\Windows\System\FhWfkAi.exe
  2⤵
  PID:10448
- C:\Windows\System\KOCVlWb.exe
  C:\Windows\System\KOCVlWb.exe
  2⤵
  PID:10640
- C:\Windows\System\iMrHnaa.exe
  C:\Windows\System\iMrHnaa.exe
  2⤵
  PID:10456
- C:\Windows\System\rcfrLQV.exe
  C:\Windows\System\rcfrLQV.exe
  2⤵
  PID:10752
- C:\Windows\System\yQdvchk.exe
  C:\Windows\System\yQdvchk.exe
  2⤵
  PID:11096
- C:\Windows\System\PFvzygC.exe
  C:\Windows\System\PFvzygC.exe
  2⤵
  PID:10308
- C:\Windows\System\gsHsIwr.exe
  C:\Windows\System\gsHsIwr.exe
  2⤵
  PID:10332
- C:\Windows\System\EZgoogz.exe
  C:\Windows\System\EZgoogz.exe
  2⤵
  PID:11040
- C:\Windows\System\yeGxXLV.exe
  C:\Windows\System\yeGxXLV.exe
  2⤵
  PID:10536
- C:\Windows\System\yIvzZMz.exe
  C:\Windows\System\yIvzZMz.exe
  2⤵
  PID:9844
- C:\Windows\System\zmrvzBc.exe
  C:\Windows\System\zmrvzBc.exe
  2⤵
  PID:10656
- C:\Windows\System\tYCnPjb.exe
  C:\Windows\System\tYCnPjb.exe
  2⤵
  PID:10416
- C:\Windows\System\PNNFKlC.exe
  C:\Windows\System\PNNFKlC.exe
  2⤵
  PID:16404
- C:\Windows\System\SkAiyBW.exe
  C:\Windows\System\SkAiyBW.exe
  2⤵
  PID:16424
- C:\Windows\System\lvregIh.exe
  C:\Windows\System\lvregIh.exe
  2⤵
  PID:16448
- C:\Windows\System\LopoVQD.exe
  C:\Windows\System\LopoVQD.exe
  2⤵
  PID:16496
- C:\Windows\System\KmibcXh.exe
  C:\Windows\System\KmibcXh.exe
  2⤵
  PID:16532
- C:\Windows\System\qcuPXDp.exe
  C:\Windows\System\qcuPXDp.exe
  2⤵
  PID:16572
- C:\Windows\System\xUrIIyC.exe
  C:\Windows\System\xUrIIyC.exe
  2⤵
  PID:16620
- C:\Windows\System\RNoDqkS.exe
  C:\Windows\System\RNoDqkS.exe
  2⤵
  PID:16636
- C:\Windows\System\hAxEWJk.exe
  C:\Windows\System\hAxEWJk.exe
  2⤵
  PID:16656
- C:\Windows\System\UwXrGYc.exe
  C:\Windows\System\UwXrGYc.exe
  2⤵
  PID:16688
- C:\Windows\System\TPpCMWd.exe
  C:\Windows\System\TPpCMWd.exe
  2⤵
  PID:16716
- C:\Windows\System\SbNYhsF.exe
  C:\Windows\System\SbNYhsF.exe
  2⤵
  PID:16744
- C:\Windows\System\nUvYZbE.exe
  C:\Windows\System\nUvYZbE.exe
  2⤵
  PID:16868
- C:\Windows\System\QACiaDF.exe
  C:\Windows\System\QACiaDF.exe
  2⤵
  PID:16884
- C:\Windows\System\dzjQmeI.exe
  C:\Windows\System\dzjQmeI.exe
  2⤵
  PID:16920
- C:\Windows\System\LKnAHpF.exe
  C:\Windows\System\LKnAHpF.exe
  2⤵
  PID:16940
- C:\Windows\System\zrtsvlF.exe
  C:\Windows\System\zrtsvlF.exe
  2⤵
  PID:16964
- C:\Windows\System\eYVqhwi.exe
  C:\Windows\System\eYVqhwi.exe
  2⤵
  PID:16984
- C:\Windows\System\ttmJzXR.exe
  C:\Windows\System\ttmJzXR.exe
  2⤵
  PID:17012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:11948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\EwYCPAg.exe

Filesize
2.2MB

MD5
25a9d1e6c1319c728de77403c063e64c

SHA1
de0c10f661a4a2a3f605153956afbc174c881f77

SHA256
906ae8375622e1376c6c33c72ebdbd9bd9fd23b5bde8bff7585967dcd712334e

SHA512
89c6983d9df55d5c7a111830626704c9cc9c8f310bd570a1b04485827bd3c792eafcb4c063e9a9c3ab988847cd16199994f2e7c62881425cbf7f983f5de60387

Download Submit
C:\Windows\System\FABdCsa.exe

Filesize
2.2MB

MD5
d6338af893ac05af545a7e1131b454d9

SHA1
5a051ccf2d03be0b57dcc5bf3bd128282331616f

SHA256
39e77cc08c404a8b0222b6640471510724d4948a1f283cf798d931831d4072bf

SHA512
4a8813de11f30d304c7a3d6fe15642141a211be072f578dadcc9030e4a1e1ae39514c3f29d7b20003a0d77069bcd5c408b5abc80e1ff18a983fa253c3ef95869

Download Submit
C:\Windows\System\FFgNDYz.exe

Filesize
2.2MB

MD5
7ed90db8d0437d71ca5b9ad391e2f2d2

SHA1
a8ace4367212604059709469093b212638d6fd79

SHA256
214e5d645a8d772b6c43931e992e8a63dfac1609ee390c836ee0734302c645de

SHA512
c11e142061a504d6b730ca5f4e7e4591a834f74118c6dacd631b84d092210afdc44da0b865af2b4271eca646a31e7f819daabb45d7cc5b42100bd69ce7b8bfa3

Download Submit
C:\Windows\System\HrbMdeF.exe

Filesize
2.2MB

MD5
1603966dd5c458e1480dc972c371149b

SHA1
b7dd5d11d6d21b7722fbd2fcb12cc2736b733825

SHA256
28a24bd9fe8f94c9254b21fcaaec407b026cc47498b0190350ba52c9140b4160

SHA512
37cd99923846de1e0b03477526cf87ad8f964f6a34189e66ce8bcd3c911b54db14f2d7d862241662333d5a53c2412ebd64eaa2ee722831d26b5c59b4af69ef2a

Download Submit
C:\Windows\System\KcFBmwb.exe

Filesize
2.2MB

MD5
9fde8efee68fb8a575bb7e1f095ff4f2

SHA1
a01edb6c654e1ae8e1ddfe0e9b0cbcc44be03bb0

SHA256
5ab490d53d4acd64692f83d66a9bc8c7f91f6abef7e7f406495f4609c3606142

SHA512
fd0b6e76189e0f1fa4038797257b95cbd83fb7b6493347e3072c3dbb5fc2f6a5cdbde83fb0b48dd59bd3520988dc61346c94be432ec9ab818945236c284ee024

Download Submit
C:\Windows\System\QaFLmsr.exe

Filesize
2.2MB

MD5
68ec1ca624756a2a517dbe15b03ef9aa

SHA1
ff4dd739cce86485fe385ae42ed9af4981c61fb1

SHA256
3c70c4dc3bea225495a42e6943d186a84faab5e1ce467b4c2e11582b280b4a5c

SHA512
cb3da0bb2f8f6c78c5d1a9001e4abcbf8e4da1ca912d080a689ac5d855a7436482bee4602c916ad09bb5573d23220404db9cbd1cdc2ab69690ef9b1ab3a1bef1

Download Submit
C:\Windows\System\RQeGrwq.exe

Filesize
2.2MB

MD5
c07e5fbd30470a3c1f92b92bf9050a66

SHA1
9de4c5718bed7a86f379883f649ce5befd35d480

SHA256
c1cad08161dc38ed53335552eb0a2a3d23653a141de175f3e118110a80bf1887

SHA512
2b9bdaa9651a5a93d16be6531c8c722291a769902a317c8a09f5916546cd6bbfd40af17d3cc88d115903b0c890f20eddf3706251b3b9c3f29b81cf52b5291cef

Download Submit
C:\Windows\System\RRLaoph.exe

Filesize
2.2MB

MD5
108b5b5a43c0853b0ee1ab6bc3883250

SHA1
e412c5fe92b9d8efb6392e35d89982afeccf9584

SHA256
1d675ba847809ee14214f4f6eb2bce70c00363bbd805d6beacbfac7b084f9960

SHA512
ddf2a8c6d1dee8cebf19bc9bd01ce4368fd4be9790b27356b96dd62c761ac732508a6ff37cfa372f685f5bb6141f7de6516006e1d691cad3d13c043a46080d24

Download Submit
C:\Windows\System\SemGShe.exe

Filesize
2.2MB

MD5
a8daf119bf1aa1cb65d92303dcbd678a

SHA1
471a4e67d11511bb48351895143a1f19c419b01f

SHA256
ccc4c99f9d466ceadc2cf3024430928bfd1ef655ce75d6df35f872ff19c33d8d

SHA512
c49e07c1bf1dfe1dde70f91d3f7b09de3af3a03a2d64b70a8d1231a48afc77769a2023a0663d339ce388bccdc46379a616713a41a5c2aa96fb5745a8ce04f2cc

Download Submit
C:\Windows\System\UShuMFB.exe

Filesize
2.2MB

MD5
dd47b9e00fcf2593b35c220d1047c437

SHA1
4e03144a0d5cf08ed3d0c34835546b28a52777bc

SHA256
8a9fc64b120b109f235b45218c5b27aa5be29977095ae77162ad9c3a426ad294

SHA512
462e0fe85428c2f02e28e15510729a2d4de054c10d613ef6246b0d83742f5da204c6ce3bc967dcffcdca58dcf52b61ce6f6137e0ba7acdacbac8682f6b50d815

Download Submit
C:\Windows\System\WowfNIw.exe

Filesize
2.2MB

MD5
40f12d0a242f885f07cac02cfafe6c9a

SHA1
5bd925fc85bded4c4e64cef238c05aef417d9ac1

SHA256
9608e8a07e581760f986be112c224c6f7fb02a1f248de0ed05ef3553ee31aa0e

SHA512
af683846cdea4f6ae24640d7e1078e86ea7b9c741fbc7f4b112339ed75261b1f0fb2ba218354b0121b6adb0200c60c83e2898872c0fb7a2e73e2a62ff5e225b6

Download Submit
C:\Windows\System\XFQmVOx.exe

Filesize
2.2MB

MD5
ccf80b9cd0ab33b2d7771d664f161898

SHA1
2b406f8693c6c4b9709ad25630b0eaba470ec91e

SHA256
342365903d434e7b57294fcb4fc56ddf8d76f8b3ff24ad95695d3181ad9ef876

SHA512
dccde1793a3a476a0d2baeb6e6a0d9ff357ed1bf1574482e8c7bcf427fbdfc89ccc511f9d8ca15c580ecc9ba457ebd49d59991f9d93d89f3a8d2e640a8bc983a

Download Submit
C:\Windows\System\XgbcYmd.exe

Filesize
2.2MB

MD5
4c7b78443ba97a29d89c3c4acf0dadfb

SHA1
9ad1286b373a7c87d4f858ff4c0c8e5e25108c5c

SHA256
67692a5fae7faffe95f99e6c024c568122017658c318e40f9573b9bc2976374e

SHA512
75d60410da94e3ae3956bed3d5bba3084c86b603d193625992c981c3acfe9e04037401c686a66c37dee8f000ef4a9ab5ae3be4668c42c890054f3e7f0035f6e9

Download Submit
C:\Windows\System\ZNpVWWb.exe

Filesize
2.2MB

MD5
c65c405ea2d312ca35f26e8c08494b0c

SHA1
5df2cbf8de28b11da82fbd9a806d8c38e70b9708

SHA256
dbc3b86dfa72787c438ea2878311fbb9f79aca297b8f42b5710acb4ce8813470

SHA512
321116bf09cc17de6edede2ff98537c42f80a5e66af33b4ccb6ab3c1efa215aa0cc4490797a41553815b8e2f1d7411a3569d166207d2ba3e2106826487611fc2

Download Submit
C:\Windows\System\ZidfpyI.exe

Filesize
2.2MB

MD5
b1754c485be0acbfe1ef804d663a632b

SHA1
28bad17654956de2b7459df1ce02c80a3f423b70

SHA256
76135fed9906b08bc2664aafdef0cd34bb3089753397f01c70c57c6cdf5a51d3

SHA512
9c44df609b77b1964cb16c0ef252f5b83882dc3d9d982f038100c104dcf293a5bbd243049457249a65d0070bfcef94685bb90e49dba41eb17192ac72c24e0087

Download Submit
C:\Windows\System\ZidfpyI.exe

Filesize
1.5MB

MD5
b0af8d3e8272f89bfaae572c87df5448

SHA1
b67e975b1f0a00c8da64474196483081716e2b9d

SHA256
9e4eb601db9b7fa72b07b84ae1c9f6fb92113b7af5b3a7b80bc2b6baaacae6ab

SHA512
5c27f1098f3464429c266df1bec8a8e03c4cb3ebea86fa91692c37b15ae5e91d6a622d08d8755e306e2ffb397d29e6c8420dbbfccb20f0ecc6bfb4e73e178ace

Download Submit
C:\Windows\System\aBMVHXt.exe

Filesize
2.2MB

MD5
9ca8a31e58c1eb61eeec623154fca1d0

SHA1
b0ae68a0ca0d79b201637fdfa06c5810b49348ae

SHA256
6017099b96b3107c4b234d25bbde21511e8dcd982c5917770598dc64b0860dd8

SHA512
c4b4470335335b7ede56bd31ce75d28bbca2ef484f3e1a884681760cf25588ab30c0af483f8f322326723d663754ce9588c7214c4024123f42d06244e0b948df

Download Submit
C:\Windows\System\aqrwVZi.exe

Filesize
2.2MB

MD5
7e9b89fd103f3413a5f9e1d0b1f751f3

SHA1
497caeba51fc7dd8e71f7975f278aea9947c746e

SHA256
173790f00ad54d836a548ffca84553df6ab8ad2b254b8b4f04960bf72749dd73

SHA512
2311b5269ff66b19d70a2a0fc3960cb304a3bce3814d0254d8b561c648162782c613b289acd6e3315e1d6c4e36f681fa057a74d33c0a83d3fc1740f95a4955bb

Download Submit
C:\Windows\System\cErdvNL.exe

Filesize
2.2MB

MD5
0abda308ce664f8615f8a132d01b4b95

SHA1
8afb741937def1ef1b1d475d906a8474ab295610

SHA256
e4c9f245e5f1ebd91074641f1dc6797997bbe3d5a0b4c92cca8934d414dadecf

SHA512
c418e10df7a53a9bd9b3de598b56305226ed55efeda886f30398a41bd4899290176e53bb2a9f2489b66dd6b7fb9118a2ff006efea07477deb3d8d5cf9394f904

Download Submit
C:\Windows\System\chqYjOg.exe

Filesize
2.2MB

MD5
f1be1756e5337d265d067148d7a6cd25

SHA1
ad44be6db5aec5df0400a97d2b238acc5730ca94

SHA256
6e0d0f1ecff35ba52a55b6c9f6efb932552ec566848c2f76092ae503b6b01d71

SHA512
7d90920831a1f8f94ddecb7260f3981fa7998e58c94bd0a0d8f0db68f0b89dc20b80bccfa8007f22c69269f3b4bd9a236cc762627d8620ff941c0e65d6f0125f

Download Submit
C:\Windows\System\eMOBOnH.exe

Filesize
2.2MB

MD5
a16d3cc2201b0abd48e3025dc1c6f532

SHA1
6626cde8529d37fa28ccd3e1d1d5931d2f722303

SHA256
b9810fcaf6df52f690450f18c2b000174786d6f31afc1b2fd652fbf0a42040ac

SHA512
41ad1f4203e531d20c0293afa4593230ccb8842bae671f9c82a7bff60036fc7587eb2eede02c02c2fe9e6d9a18483d2a2fef1169a7d36f37a2aa87cf631348a3

Download Submit
C:\Windows\System\gRwQwIR.exe

Filesize
2.2MB

MD5
c1db156255fc1fb32a951b2412892914

SHA1
da9348c83f8c5a73704e529b7302eaff49b9e082

SHA256
08ad3010f27834640304355c8dd675d8a0ff7cdcc7f3c4204c485a564d24912f

SHA512
73a84e445a99fbfac98098eb24ea2cd907f8769c751dd47d07aa59fa2d4ca3c9e57504f40e0287603bf1422dae7f9fdf9e77df6ac1b683d57b61377e1ab86369

Download Submit
C:\Windows\System\hhUVwbg.exe

Filesize
2.2MB

MD5
d8ed9f56f420716b00049a1c9b855856

SHA1
a073772edbb4b33384cdedb6ef2e494db94fcd8e

SHA256
6cbd11e3ab6d6207f0198c9f46e2411db87ad9b54da91829f1db21e5c064ad70

SHA512
044e03f4bed7c631ceb22af674be611fc342ad81dd91b943b69053f2d801a0ce9c378e6f46ca8eba851313af471891ec7836eb7eb18020a5445daa503929e298

Download Submit
C:\Windows\System\kVLeHyr.exe

Filesize
2.2MB

MD5
47d60260f47b165f944b8f19075e7426

SHA1
130881a939d4e738d764e1840dee5c8a821dad49

SHA256
fb58cc1da845dd045e1d4b43513c00ea1fbfa002dc175e767f786cd4ff95b2ab

SHA512
00ba66b10ce8a698395a4f2477e2c48db20ed7ade47253d78de6bf3bb911835d0bb17f8f946474ca3d0d9683fb7378dd7700f2bb2e0e5a6fd88998c42e7584f5

Download Submit
C:\Windows\System\pEskQSH.exe

Filesize
2.2MB

MD5
e81fc190f01d7c818be42319824323c9

SHA1
57630765d241a5948836269b69070eb0a34ad1cd

SHA256
8327f4147c03cf6e095b38f36f78b3cc15918592439d26a81cd94d84eb814873

SHA512
e34a5605aebb2e64276696cb20fbf7fc8ab652b63a5906b984bf768fb2bd8bc833921a7e9e88473e523a0b23ce73dadde52be56182f0fffc53fbf8c7090a54f4

Download Submit
C:\Windows\System\qzHebPb.exe

Filesize
2.2MB

MD5
69f8074c7ca9b476d1091342c2c02a24

SHA1
c03dd4f2797144d1feebe5a112cf23879d810df9

SHA256
69a76f3941a780a8ab6f9133416725bb10ff5b2a5d7d23497549623e8135cdad

SHA512
0804c7798e5121d5456f4a9aa97d87968dbbbeeac34532228d415835f4615978644c5bddc99d538425c925ca230b4f8f3fb10f4fa1df0aefe5d75773ce7fc03f

Download Submit
C:\Windows\System\vYDFYJV.exe

Filesize
2.2MB

MD5
cdc635838a5cc2d810989e06c4175350

SHA1
50b2cc68a74f7b343cae4bf8404f07a607ce23aa

SHA256
98499bd598bba9adc862457af2063c03a36ae78eaf599e4e627b91db82eb2784

SHA512
cc901458dfd7ed712dd833903336e79d2ded87f582a15b5aa10b66c409fa623907b8967ca4fd66c68500fa12cd5afd0ae742819a16e8170222db15f33887ab70

Download Submit
C:\Windows\System\wwgPWFY.exe

Filesize
2.2MB

MD5
bd7a7d10ce5f80501ef25010f575b29e

SHA1
46a6b3af2d696dcd3e97aa7e1370ec2ac3809e17

SHA256
d21dcbc17a2d851ff51e8cb683a1b8aa355fe48321fa2e6cd6f21eee9c3380b2

SHA512
31b5035c48fba89313c3df302e5dd4811b35578a1ce3be0c600a274de2857e9860c69774972cc59fb986abd868288f348f39a42b0c77ecd895f62c4d47bdf508

Download Submit
C:\Windows\System\xSEbcXI.exe

Filesize
2.2MB

MD5
1019f6aecaede2d4311b9c373647ce7e

SHA1
08b59332387a4abbd33534563a8c00fdde0c003c

SHA256
e9c0dde05ad6a33e6b9b50f744800e7b6187e2c86c7aa381c23dbdd1e27da564

SHA512
5e023d18c36bbb77ec768b6d2c519210f701f22dae82fbdc618d03e03bab3098474d1300d2df0e54900308d4050fa063ea139ae02675532192a54c72f0b2c2d8

Download Submit
C:\Windows\System\yGUQDtz.exe

Filesize
2.2MB

MD5
4f653ce2474949e9efc6fcd5a23fa8b5

SHA1
40fed6c16ccf82c82677994f223d9d8f6afd7100

SHA256
afc58393a6bdb06a15e9c7e28f545bd9c2ef53e7581a1cc52c2a10c13e95349f

SHA512
b9ac3792e03961adff2b010546a08235eab9f1f6269f21e0290afcf8ded621e10c9bb24272847e9e09a0ab4f2c604ce69aaa7d853eaa66e20f45669a40152c73

Download Submit
C:\Windows\System\zFDsQUo.exe

Filesize
2.2MB

MD5
a8757d625e77ae4b214b132d7f7886ec

SHA1
101563a5a37092cf075584aaffc5fb66db362bfd

SHA256
8e6613130736878aba35b99aff81c26fab27d355111e10851bbe3d09fdbfcb26

SHA512
b566c8edefef28a526634e1904c52dbdea40c6e2cd543b6adc4f959cdb1d7860e5b5ce355811c910ecfc3c120cb4ee2db94b37cd95d5f9208f28f57aeb0df8aa

Download Submit
C:\Windows\System\zbseiNN.exe

Filesize
2.2MB

MD5
f07514e17046379d639edc8508e3ef3f

SHA1
23f22e96af7f1b1ed5db5a837dd92361a233e5c1

SHA256
56741d227e946b9712067e6699248c7ccc08c9b1b7f2ef296cdff86c0ad8a6e0

SHA512
e4e3d54286a3e561d0a5c75f481d4d15d2a88f1ddff52979c7e1f613cfca27f580b685dc3f2347bfb72ca0c2651b6e82c6ab2122735818daa1116e6543cfeda5

Download Submit
C:\Windows\System\zxHXgIj.exe

Filesize
2.2MB

MD5
9018513ff65df2a7c675b0c2f0ba717e

SHA1
3c2207a17afd891163c3992fa329f4a15068355c

SHA256
37f178df6c8b9b2b70376be912048489f9fbcea55d1c85b3c2cef757ce421179

SHA512
485b8a35494777989915bfb85f9eddadd1ebf1f0f54408361ae6a23e89e28cd5c2a4ee657fb191f62c31bf843d6938b3775636382425ecc73e0b6a926e36c6a0

Download Submit
memory/212-131-0x00007FF6E9740000-0x00007FF6E9A94000-memory.dmp

Filesize
3.3MB

Download
memory/212-1719-0x00007FF6E9740000-0x00007FF6E9A94000-memory.dmp

Filesize
3.3MB

Download
memory/512-1837-0x00007FF799020000-0x00007FF799374000-memory.dmp

Filesize
3.3MB

Download
memory/512-138-0x00007FF799020000-0x00007FF799374000-memory.dmp

Filesize
3.3MB

Download
memory/788-1339-0x00007FF7A01B0000-0x00007FF7A0504000-memory.dmp

Filesize
3.3MB

Download
memory/788-22-0x00007FF7A01B0000-0x00007FF7A0504000-memory.dmp

Filesize
3.3MB

Download
memory/788-1677-0x00007FF7A01B0000-0x00007FF7A0504000-memory.dmp

Filesize
3.3MB

Download
memory/1008-144-0x00007FF60E900000-0x00007FF60EC54000-memory.dmp

Filesize
3.3MB

Download
memory/1008-1845-0x00007FF60E900000-0x00007FF60EC54000-memory.dmp

Filesize
3.3MB

Download
memory/1216-1889-0x00007FF6CB890000-0x00007FF6CBBE4000-memory.dmp

Filesize
3.3MB

Download
memory/1216-250-0x00007FF6CB890000-0x00007FF6CBBE4000-memory.dmp

Filesize
3.3MB

Download
memory/1492-1762-0x00007FF7C7260000-0x00007FF7C75B4000-memory.dmp

Filesize
3.3MB

Download
memory/1492-132-0x00007FF7C7260000-0x00007FF7C75B4000-memory.dmp

Filesize
3.3MB

Download
memory/1964-1818-0x00007FF71F7C0000-0x00007FF71FB14000-memory.dmp

Filesize
3.3MB

Download
memory/1964-136-0x00007FF71F7C0000-0x00007FF71FB14000-memory.dmp

Filesize
3.3MB

Download
memory/2324-1867-0x00007FF7029A0000-0x00007FF702CF4000-memory.dmp

Filesize
3.3MB

Download
memory/2324-148-0x00007FF7029A0000-0x00007FF702CF4000-memory.dmp

Filesize
3.3MB

Download
memory/2428-1683-0x00007FF66A2F0000-0x00007FF66A644000-memory.dmp

Filesize
3.3MB

Download
memory/2428-128-0x00007FF66A2F0000-0x00007FF66A644000-memory.dmp

Filesize
3.3MB

Download
memory/2448-139-0x00007FF7D7550000-0x00007FF7D78A4000-memory.dmp

Filesize
3.3MB

Download
memory/2448-1843-0x00007FF7D7550000-0x00007FF7D78A4000-memory.dmp

Filesize
3.3MB

Download
memory/2812-1813-0x00007FF746370000-0x00007FF7466C4000-memory.dmp

Filesize
3.3MB

Download
memory/2812-134-0x00007FF746370000-0x00007FF7466C4000-memory.dmp

Filesize
3.3MB

Download
memory/2900-147-0x00007FF6A1F80000-0x00007FF6A22D4000-memory.dmp

Filesize
3.3MB

Download
memory/2900-1870-0x00007FF6A1F80000-0x00007FF6A22D4000-memory.dmp

Filesize
3.3MB

Download
memory/3232-0-0x00007FF6CD630000-0x00007FF6CD984000-memory.dmp

Filesize
3.3MB

Download
memory/3232-1-0x00000232F3B60000-0x00000232F3B70000-memory.dmp

Filesize
64KB

Download
memory/3232-600-0x00007FF6CD630000-0x00007FF6CD984000-memory.dmp

Filesize
3.3MB

Download
memory/3472-14-0x00007FF69D0B0000-0x00007FF69D404000-memory.dmp

Filesize
3.3MB

Download
memory/3472-1676-0x00007FF69D0B0000-0x00007FF69D404000-memory.dmp

Filesize
3.3MB

Download
memory/3476-1906-0x00007FF6225A0000-0x00007FF6228F4000-memory.dmp

Filesize
3.3MB

Download
memory/3476-252-0x00007FF6225A0000-0x00007FF6228F4000-memory.dmp

Filesize
3.3MB

Download
memory/3560-1682-0x00007FF6D4480000-0x00007FF6D47D4000-memory.dmp

Filesize
3.3MB

Download
memory/3560-145-0x00007FF6D4480000-0x00007FF6D47D4000-memory.dmp

Filesize
3.3MB

Download
memory/3644-1675-0x00007FF6D9620000-0x00007FF6D9974000-memory.dmp

Filesize
3.3MB

Download
memory/3644-8-0x00007FF6D9620000-0x00007FF6D9974000-memory.dmp

Filesize
3.3MB

Download
memory/3824-27-0x00007FF643FC0000-0x00007FF644314000-memory.dmp

Filesize
3.3MB

Download
memory/3824-1678-0x00007FF643FC0000-0x00007FF644314000-memory.dmp

Filesize
3.3MB

Download
memory/3984-130-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp

Filesize
3.3MB

Download
memory/3984-1702-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp

Filesize
3.3MB

Download
memory/4068-1799-0x00007FF675F60000-0x00007FF6762B4000-memory.dmp

Filesize
3.3MB

Download
memory/4068-135-0x00007FF675F60000-0x00007FF6762B4000-memory.dmp

Filesize
3.3MB

Download
memory/4076-1846-0x00007FF746640000-0x00007FF746994000-memory.dmp

Filesize
3.3MB

Download
memory/4076-142-0x00007FF746640000-0x00007FF746994000-memory.dmp

Filesize
3.3MB

Download
memory/4172-129-0x00007FF7A7A90000-0x00007FF7A7DE4000-memory.dmp

Filesize
3.3MB

Download
memory/4172-1684-0x00007FF7A7A90000-0x00007FF7A7DE4000-memory.dmp

Filesize
3.3MB

Download
memory/4220-137-0x00007FF617820000-0x00007FF617B74000-memory.dmp

Filesize
3.3MB

Download
memory/4220-1827-0x00007FF617820000-0x00007FF617B74000-memory.dmp

Filesize
3.3MB

Download
memory/4380-1681-0x00007FF6C81D0000-0x00007FF6C8524000-memory.dmp

Filesize
3.3MB

Download
memory/4380-126-0x00007FF6C81D0000-0x00007FF6C8524000-memory.dmp

Filesize
3.3MB

Download
memory/4592-1844-0x00007FF7C6870000-0x00007FF7C6BC4000-memory.dmp

Filesize
3.3MB

Download
memory/4592-140-0x00007FF7C6870000-0x00007FF7C6BC4000-memory.dmp

Filesize
3.3MB

Download
memory/4604-253-0x00007FF79BD30000-0x00007FF79C084000-memory.dmp

Filesize
3.3MB

Download
memory/4604-1918-0x00007FF79BD30000-0x00007FF79C084000-memory.dmp

Filesize
3.3MB

Download
memory/4700-42-0x00007FF6CB5A0000-0x00007FF6CB8F4000-memory.dmp

Filesize
3.3MB

Download
memory/4700-1679-0x00007FF6CB5A0000-0x00007FF6CB8F4000-memory.dmp

Filesize
3.3MB

Download
memory/4760-251-0x00007FF6E7730000-0x00007FF6E7A84000-memory.dmp

Filesize
3.3MB

Download
memory/4760-1898-0x00007FF6E7730000-0x00007FF6E7A84000-memory.dmp

Filesize
3.3MB

Download
memory/4940-133-0x00007FF67A840000-0x00007FF67AB94000-memory.dmp

Filesize
3.3MB

Download
memory/4940-1764-0x00007FF67A840000-0x00007FF67AB94000-memory.dmp

Filesize
3.3MB

Download
memory/5020-1680-0x00007FF7603A0000-0x00007FF7606F4000-memory.dmp

Filesize
3.3MB

Download
memory/5020-45-0x00007FF7603A0000-0x00007FF7606F4000-memory.dmp

Filesize
3.3MB

Download