xmrig | 48929497f6f209896862ae90c69d05feaa87ea880dd4b3c448983e5bca8a1381

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
Size

2.7MB
MD5

45fa971f33833016d0c852fb771e12d0
SHA1

6a58d06096d27ca528d77344264ea3fbcd0f47a2
SHA256

48929497f6f209896862ae90c69d05feaa87ea880dd4b3c448983e5bca8a1381
SHA512

bfa575939a0bf45e382b3cc88bcc8b1910bfc1b37b9cc6bb10663e4daa53fa8e6dfc9e47fc24b241a2c2f2e579c3f85308551f2660101c8afd927eba0e137fc7
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+Aj4k3SJCavKM1W7FINqX:BemTLkNdfE0pZrO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3488-0-0x00007FF7231E0000-0x00007FF723534000-memory.dmp	xmrig
behavioral2/files/0x000900000002326d-6.dat	xmrig
behavioral2/memory/3220-8-0x00007FF67B120000-0x00007FF67B474000-memory.dmp	xmrig
behavioral2/files/0x0008000000023273-11.dat	xmrig
behavioral2/files/0x0008000000023271-10.dat	xmrig
behavioral2/memory/2908-19-0x00007FF756410000-0x00007FF756764000-memory.dmp	xmrig
behavioral2/files/0x0007000000023274-21.dat	xmrig
behavioral2/memory/552-23-0x00007FF65B5A0000-0x00007FF65B8F4000-memory.dmp	xmrig
behavioral2/memory/1820-26-0x00007FF63AB70000-0x00007FF63AEC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023275-28.dat	xmrig
behavioral2/memory/1588-30-0x00007FF74BC70000-0x00007FF74BFC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023276-36.dat	xmrig
behavioral2/files/0x0007000000023277-39.dat	xmrig
behavioral2/memory/3972-43-0x00007FF6A97F0000-0x00007FF6A9B44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023278-46.dat	xmrig
behavioral2/memory/3488-51-0x00007FF7231E0000-0x00007FF723534000-memory.dmp	xmrig
behavioral2/files/0x000700000002327a-52.dat	xmrig
behavioral2/memory/4476-55-0x00007FF634950000-0x00007FF634CA4000-memory.dmp	xmrig
behavioral2/memory/4112-56-0x00007FF70D320000-0x00007FF70D674000-memory.dmp	xmrig
behavioral2/memory/3220-57-0x00007FF67B120000-0x00007FF67B474000-memory.dmp	xmrig
behavioral2/memory/2908-61-0x00007FF756410000-0x00007FF756764000-memory.dmp	xmrig
behavioral2/files/0x000700000002327b-62.dat	xmrig
behavioral2/files/0x000700000002327c-67.dat	xmrig
behavioral2/files/0x000700000002327d-71.dat	xmrig
behavioral2/files/0x000700000002327e-77.dat	xmrig
behavioral2/files/0x000700000002327f-82.dat	xmrig
behavioral2/files/0x0007000000023280-86.dat	xmrig
behavioral2/files/0x0007000000023281-92.dat	xmrig
behavioral2/files/0x0007000000023282-97.dat	xmrig
behavioral2/files/0x0007000000023283-100.dat	xmrig
behavioral2/files/0x0007000000023285-112.dat	xmrig
behavioral2/files/0x0007000000023284-107.dat	xmrig
behavioral2/files/0x0007000000023286-116.dat	xmrig
behavioral2/files/0x0007000000023287-122.dat	xmrig
behavioral2/files/0x0007000000023288-127.dat	xmrig
behavioral2/files/0x0007000000023289-132.dat	xmrig
behavioral2/files/0x000700000002328a-137.dat	xmrig
behavioral2/files/0x000700000002328b-142.dat	xmrig
behavioral2/files/0x000700000002328d-152.dat	xmrig
behavioral2/files/0x000700000002328c-147.dat	xmrig
behavioral2/files/0x000700000002328e-157.dat	xmrig
behavioral2/files/0x000700000002328f-162.dat	xmrig
behavioral2/files/0x0007000000023290-166.dat	xmrig
behavioral2/files/0x0007000000023291-171.dat	xmrig
behavioral2/memory/4352-194-0x00007FF7763C0000-0x00007FF776714000-memory.dmp	xmrig
behavioral2/memory/2676-196-0x00007FF6FBAA0000-0x00007FF6FBDF4000-memory.dmp	xmrig
behavioral2/memory/4992-197-0x00007FF6DABB0000-0x00007FF6DAF04000-memory.dmp	xmrig
behavioral2/memory/4640-198-0x00007FF7C6A10000-0x00007FF7C6D64000-memory.dmp	xmrig
behavioral2/memory/1368-199-0x00007FF793FA0000-0x00007FF7942F4000-memory.dmp	xmrig
behavioral2/memory/1752-200-0x00007FF799E70000-0x00007FF79A1C4000-memory.dmp	xmrig
behavioral2/memory/4064-201-0x00007FF7CF500000-0x00007FF7CF854000-memory.dmp	xmrig
behavioral2/memory/3864-203-0x00007FF7B14E0000-0x00007FF7B1834000-memory.dmp	xmrig
behavioral2/memory/2976-205-0x00007FF7B3200000-0x00007FF7B3554000-memory.dmp	xmrig
behavioral2/memory/3648-207-0x00007FF649200000-0x00007FF649554000-memory.dmp	xmrig
behavioral2/memory/5048-211-0x00007FF7DDE90000-0x00007FF7DE1E4000-memory.dmp	xmrig
behavioral2/memory/4028-215-0x00007FF60A2B0000-0x00007FF60A604000-memory.dmp	xmrig
behavioral2/memory/2884-218-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp	xmrig
behavioral2/memory/932-219-0x00007FF6137D0000-0x00007FF613B24000-memory.dmp	xmrig
behavioral2/memory/2196-221-0x00007FF63E590000-0x00007FF63E8E4000-memory.dmp	xmrig
behavioral2/memory/1860-222-0x00007FF6825D0000-0x00007FF682924000-memory.dmp	xmrig
behavioral2/memory/4636-223-0x00007FF752820000-0x00007FF752B74000-memory.dmp	xmrig
behavioral2/memory/3956-226-0x00007FF717E50000-0x00007FF7181A4000-memory.dmp	xmrig
behavioral2/memory/4900-227-0x00007FF64AFC0000-0x00007FF64B314000-memory.dmp	xmrig
behavioral2/memory/2348-229-0x00007FF608EC0000-0x00007FF609214000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3220	HlCzOnN.exe
2908	yTgoUZT.exe
552	yttyMCI.exe
1820	NpaVdGq.exe
1588	QWOTFkY.exe
3972	KCKkPcD.exe
4476	OumyjYG.exe
4112	TudjjhZ.exe
4352	xDFhGUm.exe
2348	hzphNHZ.exe
4164	XhOzUUU.exe
2676	daPsdUV.exe
4992	lsvCjAl.exe
4640	OeUTCEk.exe
1368	judOJeU.exe
1752	TEClxLf.exe
4064	prgBzzb.exe
3864	WYrqCco.exe
2976	ZcjVaNO.exe
3648	QQlxTvO.exe
5048	oPlIIBh.exe
4028	LFMiLXd.exe
2884	NhuikGd.exe
932	JRWjMtD.exe
2196	QHMlVzB.exe
1860	vMuZKZq.exe
4636	RZRIeNT.exe
3956	JKfSrHe.exe
4900	nPChkkp.exe
3388	sNKAwey.exe
1744	oZuAFml.exe
764	xtkzOlC.exe
3508	hjZTzmD.exe
2576	hxlLsPD.exe
1800	pueqXOc.exe
3520	MnhmJeT.exe
3552	jrTtPGg.exe
5104	ebFywhu.exe
624	yXLcHkK.exe
2616	hllcgCa.exe
2260	LpZgYnv.exe
4912	dpSAFkt.exe
4068	EcLhZpT.exe
3928	SDLGtgG.exe
4108	YHIQQdE.exe
4884	ryykuAU.exe
3564	xkmNYsW.exe
456	xcWlied.exe
864	yjIMOww.exe
972	HCMvSiB.exe
2416	XEWBWxL.exe
2296	gdFWGLF.exe
664	OvoQQzT.exe
2564	fjfzqWY.exe
4692	zgSHQpk.exe
2468	tzCeKxN.exe
1788	tJhWujT.exe
992	ygvSPkb.exe
2568	pifMrJD.exe
4548	frUexDQ.exe
1028	zorZVam.exe
2844	rPuBUlp.exe
1492	yQrDiaD.exe
2696	yCdlUnK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3488-0-0x00007FF7231E0000-0x00007FF723534000-memory.dmp	upx
behavioral2/files/0x000900000002326d-6.dat	upx
behavioral2/memory/3220-8-0x00007FF67B120000-0x00007FF67B474000-memory.dmp	upx
behavioral2/files/0x0008000000023273-11.dat	upx
behavioral2/files/0x0008000000023271-10.dat	upx
behavioral2/memory/2908-19-0x00007FF756410000-0x00007FF756764000-memory.dmp	upx
behavioral2/files/0x0007000000023274-21.dat	upx
behavioral2/memory/552-23-0x00007FF65B5A0000-0x00007FF65B8F4000-memory.dmp	upx
behavioral2/memory/1820-26-0x00007FF63AB70000-0x00007FF63AEC4000-memory.dmp	upx
behavioral2/files/0x0007000000023275-28.dat	upx
behavioral2/memory/1588-30-0x00007FF74BC70000-0x00007FF74BFC4000-memory.dmp	upx
behavioral2/files/0x0007000000023276-36.dat	upx
behavioral2/files/0x0007000000023277-39.dat	upx
behavioral2/memory/3972-43-0x00007FF6A97F0000-0x00007FF6A9B44000-memory.dmp	upx
behavioral2/files/0x0007000000023278-46.dat	upx
behavioral2/memory/3488-51-0x00007FF7231E0000-0x00007FF723534000-memory.dmp	upx
behavioral2/files/0x000700000002327a-52.dat	upx
behavioral2/memory/4476-55-0x00007FF634950000-0x00007FF634CA4000-memory.dmp	upx
behavioral2/memory/4112-56-0x00007FF70D320000-0x00007FF70D674000-memory.dmp	upx
behavioral2/memory/3220-57-0x00007FF67B120000-0x00007FF67B474000-memory.dmp	upx
behavioral2/memory/2908-61-0x00007FF756410000-0x00007FF756764000-memory.dmp	upx
behavioral2/files/0x000700000002327b-62.dat	upx
behavioral2/files/0x000700000002327c-67.dat	upx
behavioral2/files/0x000700000002327d-71.dat	upx
behavioral2/files/0x000700000002327e-77.dat	upx
behavioral2/files/0x000700000002327f-82.dat	upx
behavioral2/files/0x0007000000023280-86.dat	upx
behavioral2/files/0x0007000000023281-92.dat	upx
behavioral2/files/0x0007000000023282-97.dat	upx
behavioral2/files/0x0007000000023283-100.dat	upx
behavioral2/files/0x0007000000023285-112.dat	upx
behavioral2/files/0x0007000000023284-107.dat	upx
behavioral2/files/0x0007000000023286-116.dat	upx
behavioral2/files/0x0007000000023287-122.dat	upx
behavioral2/files/0x0007000000023288-127.dat	upx
behavioral2/files/0x0007000000023289-132.dat	upx
behavioral2/files/0x000700000002328a-137.dat	upx
behavioral2/files/0x000700000002328b-142.dat	upx
behavioral2/files/0x000700000002328d-152.dat	upx
behavioral2/files/0x000700000002328c-147.dat	upx
behavioral2/files/0x000700000002328e-157.dat	upx
behavioral2/files/0x000700000002328f-162.dat	upx
behavioral2/files/0x0007000000023290-166.dat	upx
behavioral2/files/0x0007000000023291-171.dat	upx
behavioral2/memory/4352-194-0x00007FF7763C0000-0x00007FF776714000-memory.dmp	upx
behavioral2/memory/2676-196-0x00007FF6FBAA0000-0x00007FF6FBDF4000-memory.dmp	upx
behavioral2/memory/4992-197-0x00007FF6DABB0000-0x00007FF6DAF04000-memory.dmp	upx
behavioral2/memory/4640-198-0x00007FF7C6A10000-0x00007FF7C6D64000-memory.dmp	upx
behavioral2/memory/1368-199-0x00007FF793FA0000-0x00007FF7942F4000-memory.dmp	upx
behavioral2/memory/1752-200-0x00007FF799E70000-0x00007FF79A1C4000-memory.dmp	upx
behavioral2/memory/4064-201-0x00007FF7CF500000-0x00007FF7CF854000-memory.dmp	upx
behavioral2/memory/3864-203-0x00007FF7B14E0000-0x00007FF7B1834000-memory.dmp	upx
behavioral2/memory/2976-205-0x00007FF7B3200000-0x00007FF7B3554000-memory.dmp	upx
behavioral2/memory/3648-207-0x00007FF649200000-0x00007FF649554000-memory.dmp	upx
behavioral2/memory/5048-211-0x00007FF7DDE90000-0x00007FF7DE1E4000-memory.dmp	upx
behavioral2/memory/4028-215-0x00007FF60A2B0000-0x00007FF60A604000-memory.dmp	upx
behavioral2/memory/2884-218-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp	upx
behavioral2/memory/932-219-0x00007FF6137D0000-0x00007FF613B24000-memory.dmp	upx
behavioral2/memory/2196-221-0x00007FF63E590000-0x00007FF63E8E4000-memory.dmp	upx
behavioral2/memory/1860-222-0x00007FF6825D0000-0x00007FF682924000-memory.dmp	upx
behavioral2/memory/4636-223-0x00007FF752820000-0x00007FF752B74000-memory.dmp	upx
behavioral2/memory/3956-226-0x00007FF717E50000-0x00007FF7181A4000-memory.dmp	upx
behavioral2/memory/4900-227-0x00007FF64AFC0000-0x00007FF64B314000-memory.dmp	upx
behavioral2/memory/2348-229-0x00007FF608EC0000-0x00007FF609214000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FZSuGcW.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\DqXyfZy.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\qMKHCXU.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZMomZJa.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\UMwRYxn.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\ffPhTdJ.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\IVoXveC.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\IDZbHMo.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\DFwjBHc.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\cksQZoe.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\GuBPPDh.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\mMjBcUK.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\wHetOMf.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\fFtBZLe.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\ULAydBt.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\vhuHYsY.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\NyoiSQa.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\gomyrjS.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\koFdJWd.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\AjqpqMs.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\vSHHsqq.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\WVxzztp.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\Qhpmzpu.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\yQrDiaD.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZVzWtzq.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\uuXCxoh.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\duyWREW.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\AXQrhzu.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\daPsdUV.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\zOlIGKV.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\GmqjCjw.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\jATXEsn.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\mhZRsTx.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\SNaOUco.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\VlfTRkZ.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\qhJuhfj.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\YNBssCX.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\rwEqnCl.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\xraNIlI.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\JFRduyd.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\aoOxBty.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\xVBcLHn.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZhPsXbk.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\inWVEnB.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\JHzPuZF.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\VHNCutt.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\cNgxvaV.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\WvdCOAr.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\vfCqDEh.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\VLqeYsk.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\DirUMPD.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\lBMONdN.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\FBtQxPC.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\qJgqZmq.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\ARViYVO.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\HuphWpS.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\YhAjZMD.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZkbTbpj.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\EFBevcI.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\CUAtMBZ.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\pfivXAQ.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\oEqXted.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\HTBfHQt.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
File created	C:\Windows\System\cQJbEID.exe	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3220	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	92
PID 3488 wrote to memory of 3220	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	92
PID 3488 wrote to memory of 2908	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	93
PID 3488 wrote to memory of 2908	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	93
PID 3488 wrote to memory of 552	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	94
PID 3488 wrote to memory of 552	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	94
PID 3488 wrote to memory of 1820	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	95
PID 3488 wrote to memory of 1820	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	95
PID 3488 wrote to memory of 1588	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	96
PID 3488 wrote to memory of 1588	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	96
PID 3488 wrote to memory of 3972	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	97
PID 3488 wrote to memory of 3972	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	97
PID 3488 wrote to memory of 4476	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	98
PID 3488 wrote to memory of 4476	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	98
PID 3488 wrote to memory of 4112	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	99
PID 3488 wrote to memory of 4112	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	99
PID 3488 wrote to memory of 4352	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	100
PID 3488 wrote to memory of 4352	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	100
PID 3488 wrote to memory of 2348	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	101
PID 3488 wrote to memory of 2348	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	101
PID 3488 wrote to memory of 4164	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	102
PID 3488 wrote to memory of 4164	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	102
PID 3488 wrote to memory of 2676	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	103
PID 3488 wrote to memory of 2676	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	103
PID 3488 wrote to memory of 4992	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	104
PID 3488 wrote to memory of 4992	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	104
PID 3488 wrote to memory of 4640	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	105
PID 3488 wrote to memory of 4640	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	105
PID 3488 wrote to memory of 1368	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	106
PID 3488 wrote to memory of 1368	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	106
PID 3488 wrote to memory of 1752	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	107
PID 3488 wrote to memory of 1752	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	107
PID 3488 wrote to memory of 4064	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	108
PID 3488 wrote to memory of 4064	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	108
PID 3488 wrote to memory of 3864	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	109
PID 3488 wrote to memory of 3864	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	109
PID 3488 wrote to memory of 2976	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	110
PID 3488 wrote to memory of 2976	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	110
PID 3488 wrote to memory of 3648	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	111
PID 3488 wrote to memory of 3648	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	111
PID 3488 wrote to memory of 5048	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	112
PID 3488 wrote to memory of 5048	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	112
PID 3488 wrote to memory of 4028	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	113
PID 3488 wrote to memory of 4028	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	113
PID 3488 wrote to memory of 2884	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	114
PID 3488 wrote to memory of 2884	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	114
PID 3488 wrote to memory of 932	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	115
PID 3488 wrote to memory of 932	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	115
PID 3488 wrote to memory of 2196	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	116
PID 3488 wrote to memory of 2196	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	116
PID 3488 wrote to memory of 1860	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	117
PID 3488 wrote to memory of 1860	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	117
PID 3488 wrote to memory of 4636	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	118
PID 3488 wrote to memory of 4636	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	118
PID 3488 wrote to memory of 3956	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	119
PID 3488 wrote to memory of 3956	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	119
PID 3488 wrote to memory of 4900	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	120
PID 3488 wrote to memory of 4900	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	120
PID 3488 wrote to memory of 3388	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	121
PID 3488 wrote to memory of 3388	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	121
PID 3488 wrote to memory of 1744	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	122
PID 3488 wrote to memory of 1744	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	122
PID 3488 wrote to memory of 764	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	123
PID 3488 wrote to memory of 764	3488	45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\45fa971f33833016d0c852fb771e12d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\System\HlCzOnN.exe
  C:\Windows\System\HlCzOnN.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\yTgoUZT.exe
  C:\Windows\System\yTgoUZT.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\yttyMCI.exe
  C:\Windows\System\yttyMCI.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\NpaVdGq.exe
  C:\Windows\System\NpaVdGq.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\QWOTFkY.exe
  C:\Windows\System\QWOTFkY.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\KCKkPcD.exe
  C:\Windows\System\KCKkPcD.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\OumyjYG.exe
  C:\Windows\System\OumyjYG.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\TudjjhZ.exe
  C:\Windows\System\TudjjhZ.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\xDFhGUm.exe
  C:\Windows\System\xDFhGUm.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\hzphNHZ.exe
  C:\Windows\System\hzphNHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\XhOzUUU.exe
  C:\Windows\System\XhOzUUU.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\daPsdUV.exe
  C:\Windows\System\daPsdUV.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\lsvCjAl.exe
  C:\Windows\System\lsvCjAl.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\OeUTCEk.exe
  C:\Windows\System\OeUTCEk.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\judOJeU.exe
  C:\Windows\System\judOJeU.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\TEClxLf.exe
  C:\Windows\System\TEClxLf.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\prgBzzb.exe
  C:\Windows\System\prgBzzb.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\WYrqCco.exe
  C:\Windows\System\WYrqCco.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\ZcjVaNO.exe
  C:\Windows\System\ZcjVaNO.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\QQlxTvO.exe
  C:\Windows\System\QQlxTvO.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\oPlIIBh.exe
  C:\Windows\System\oPlIIBh.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\LFMiLXd.exe
  C:\Windows\System\LFMiLXd.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\NhuikGd.exe
  C:\Windows\System\NhuikGd.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\JRWjMtD.exe
  C:\Windows\System\JRWjMtD.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\QHMlVzB.exe
  C:\Windows\System\QHMlVzB.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\vMuZKZq.exe
  C:\Windows\System\vMuZKZq.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\RZRIeNT.exe
  C:\Windows\System\RZRIeNT.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\JKfSrHe.exe
  C:\Windows\System\JKfSrHe.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\nPChkkp.exe
  C:\Windows\System\nPChkkp.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\sNKAwey.exe
  C:\Windows\System\sNKAwey.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\oZuAFml.exe
  C:\Windows\System\oZuAFml.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\xtkzOlC.exe
  C:\Windows\System\xtkzOlC.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\hjZTzmD.exe
  C:\Windows\System\hjZTzmD.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\hxlLsPD.exe
  C:\Windows\System\hxlLsPD.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\pueqXOc.exe
  C:\Windows\System\pueqXOc.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\MnhmJeT.exe
  C:\Windows\System\MnhmJeT.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\jrTtPGg.exe
  C:\Windows\System\jrTtPGg.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\ebFywhu.exe
  C:\Windows\System\ebFywhu.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\yXLcHkK.exe
  C:\Windows\System\yXLcHkK.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\hllcgCa.exe
  C:\Windows\System\hllcgCa.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\LpZgYnv.exe
  C:\Windows\System\LpZgYnv.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\dpSAFkt.exe
  C:\Windows\System\dpSAFkt.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\EcLhZpT.exe
  C:\Windows\System\EcLhZpT.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\SDLGtgG.exe
  C:\Windows\System\SDLGtgG.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\YHIQQdE.exe
  C:\Windows\System\YHIQQdE.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\ryykuAU.exe
  C:\Windows\System\ryykuAU.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\xkmNYsW.exe
  C:\Windows\System\xkmNYsW.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\xcWlied.exe
  C:\Windows\System\xcWlied.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\yjIMOww.exe
  C:\Windows\System\yjIMOww.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\HCMvSiB.exe
  C:\Windows\System\HCMvSiB.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\XEWBWxL.exe
  C:\Windows\System\XEWBWxL.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\gdFWGLF.exe
  C:\Windows\System\gdFWGLF.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\OvoQQzT.exe
  C:\Windows\System\OvoQQzT.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\fjfzqWY.exe
  C:\Windows\System\fjfzqWY.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\zgSHQpk.exe
  C:\Windows\System\zgSHQpk.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\tzCeKxN.exe
  C:\Windows\System\tzCeKxN.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\tJhWujT.exe
  C:\Windows\System\tJhWujT.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\ygvSPkb.exe
  C:\Windows\System\ygvSPkb.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\pifMrJD.exe
  C:\Windows\System\pifMrJD.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\frUexDQ.exe
  C:\Windows\System\frUexDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\zorZVam.exe
  C:\Windows\System\zorZVam.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\rPuBUlp.exe
  C:\Windows\System\rPuBUlp.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\yQrDiaD.exe
  C:\Windows\System\yQrDiaD.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\yCdlUnK.exe
  C:\Windows\System\yCdlUnK.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\yoOqxfu.exe
  C:\Windows\System\yoOqxfu.exe
  2⤵
  PID:4404
- C:\Windows\System\EWInUNF.exe
  C:\Windows\System\EWInUNF.exe
  2⤵
  PID:608
- C:\Windows\System\csyRnqi.exe
  C:\Windows\System\csyRnqi.exe
  2⤵
  PID:3896
- C:\Windows\System\UxmAGtT.exe
  C:\Windows\System\UxmAGtT.exe
  2⤵
  PID:3908
- C:\Windows\System\JmJTuDl.exe
  C:\Windows\System\JmJTuDl.exe
  2⤵
  PID:3992
- C:\Windows\System\enNoKHW.exe
  C:\Windows\System\enNoKHW.exe
  2⤵
  PID:800
- C:\Windows\System\BiZorFP.exe
  C:\Windows\System\BiZorFP.exe
  2⤵
  PID:4908
- C:\Windows\System\FlANxtY.exe
  C:\Windows\System\FlANxtY.exe
  2⤵
  PID:832
- C:\Windows\System\JbwskFX.exe
  C:\Windows\System\JbwskFX.exe
  2⤵
  PID:5100
- C:\Windows\System\jPpjSCD.exe
  C:\Windows\System\jPpjSCD.exe
  2⤵
  PID:1768
- C:\Windows\System\aFFdWmQ.exe
  C:\Windows\System\aFFdWmQ.exe
  2⤵
  PID:1928
- C:\Windows\System\jesmssU.exe
  C:\Windows\System\jesmssU.exe
  2⤵
  PID:5140
- C:\Windows\System\DfnwTwG.exe
  C:\Windows\System\DfnwTwG.exe
  2⤵
  PID:5168
- C:\Windows\System\leCmbLf.exe
  C:\Windows\System\leCmbLf.exe
  2⤵
  PID:5196
- C:\Windows\System\tjzKyKf.exe
  C:\Windows\System\tjzKyKf.exe
  2⤵
  PID:5224
- C:\Windows\System\kCxkNrK.exe
  C:\Windows\System\kCxkNrK.exe
  2⤵
  PID:5252
- C:\Windows\System\NoOZYyu.exe
  C:\Windows\System\NoOZYyu.exe
  2⤵
  PID:5280
- C:\Windows\System\bzWIcSC.exe
  C:\Windows\System\bzWIcSC.exe
  2⤵
  PID:5308
- C:\Windows\System\DcRGJdJ.exe
  C:\Windows\System\DcRGJdJ.exe
  2⤵
  PID:5336
- C:\Windows\System\WrpiEzM.exe
  C:\Windows\System\WrpiEzM.exe
  2⤵
  PID:5368
- C:\Windows\System\GVaCHZN.exe
  C:\Windows\System\GVaCHZN.exe
  2⤵
  PID:5396
- C:\Windows\System\sueGzuY.exe
  C:\Windows\System\sueGzuY.exe
  2⤵
  PID:5424
- C:\Windows\System\evgCviS.exe
  C:\Windows\System\evgCviS.exe
  2⤵
  PID:5452
- C:\Windows\System\lwwIVqO.exe
  C:\Windows\System\lwwIVqO.exe
  2⤵
  PID:5480
- C:\Windows\System\SsqRqIW.exe
  C:\Windows\System\SsqRqIW.exe
  2⤵
  PID:5508
- C:\Windows\System\wMaADGJ.exe
  C:\Windows\System\wMaADGJ.exe
  2⤵
  PID:5536
- C:\Windows\System\TdMXLCz.exe
  C:\Windows\System\TdMXLCz.exe
  2⤵
  PID:5564
- C:\Windows\System\OckGcqh.exe
  C:\Windows\System\OckGcqh.exe
  2⤵
  PID:5592
- C:\Windows\System\KmwuGGj.exe
  C:\Windows\System\KmwuGGj.exe
  2⤵
  PID:5620
- C:\Windows\System\SjTRIyp.exe
  C:\Windows\System\SjTRIyp.exe
  2⤵
  PID:5648
- C:\Windows\System\QPtxMpj.exe
  C:\Windows\System\QPtxMpj.exe
  2⤵
  PID:5668
- C:\Windows\System\LFAwHFs.exe
  C:\Windows\System\LFAwHFs.exe
  2⤵
  PID:5704
- C:\Windows\System\kSnpjCz.exe
  C:\Windows\System\kSnpjCz.exe
  2⤵
  PID:5732
- C:\Windows\System\JkJyCUR.exe
  C:\Windows\System\JkJyCUR.exe
  2⤵
  PID:5760
- C:\Windows\System\IdIfkny.exe
  C:\Windows\System\IdIfkny.exe
  2⤵
  PID:5788
- C:\Windows\System\onYVgBV.exe
  C:\Windows\System\onYVgBV.exe
  2⤵
  PID:5808
- C:\Windows\System\YhAjZMD.exe
  C:\Windows\System\YhAjZMD.exe
  2⤵
  PID:5844
- C:\Windows\System\qXqlwYl.exe
  C:\Windows\System\qXqlwYl.exe
  2⤵
  PID:5872
- C:\Windows\System\PTfMWbd.exe
  C:\Windows\System\PTfMWbd.exe
  2⤵
  PID:5888
- C:\Windows\System\ZhgWFuS.exe
  C:\Windows\System\ZhgWFuS.exe
  2⤵
  PID:5928
- C:\Windows\System\hWNQGyt.exe
  C:\Windows\System\hWNQGyt.exe
  2⤵
  PID:5948
- C:\Windows\System\PYEyTNa.exe
  C:\Windows\System\PYEyTNa.exe
  2⤵
  PID:5984
- C:\Windows\System\XiQDDTC.exe
  C:\Windows\System\XiQDDTC.exe
  2⤵
  PID:6012
- C:\Windows\System\jjyhzxH.exe
  C:\Windows\System\jjyhzxH.exe
  2⤵
  PID:6040
- C:\Windows\System\qmrmPHr.exe
  C:\Windows\System\qmrmPHr.exe
  2⤵
  PID:6068
- C:\Windows\System\FfQwOqc.exe
  C:\Windows\System\FfQwOqc.exe
  2⤵
  PID:6096
- C:\Windows\System\okaxjcA.exe
  C:\Windows\System\okaxjcA.exe
  2⤵
  PID:6112
- C:\Windows\System\iMbbCNz.exe
  C:\Windows\System\iMbbCNz.exe
  2⤵
  PID:6136
- C:\Windows\System\KasfYzX.exe
  C:\Windows\System\KasfYzX.exe
  2⤵
  PID:5132
- C:\Windows\System\ZUDyeoD.exe
  C:\Windows\System\ZUDyeoD.exe
  2⤵
  PID:5220
- C:\Windows\System\dwIfrGH.exe
  C:\Windows\System\dwIfrGH.exe
  2⤵
  PID:5264
- C:\Windows\System\bnNvszD.exe
  C:\Windows\System\bnNvszD.exe
  2⤵
  PID:5332
- C:\Windows\System\ffPhTdJ.exe
  C:\Windows\System\ffPhTdJ.exe
  2⤵
  PID:5408
- C:\Windows\System\QnTHElH.exe
  C:\Windows\System\QnTHElH.exe
  2⤵
  PID:5464
- C:\Windows\System\mKtZKbz.exe
  C:\Windows\System\mKtZKbz.exe
  2⤵
  PID:5556
- C:\Windows\System\fajEFXd.exe
  C:\Windows\System\fajEFXd.exe
  2⤵
  PID:5656
- C:\Windows\System\GPcEKap.exe
  C:\Windows\System\GPcEKap.exe
  2⤵
  PID:5716
- C:\Windows\System\amlgcIw.exe
  C:\Windows\System\amlgcIw.exe
  2⤵
  PID:5772
- C:\Windows\System\eHAhZpi.exe
  C:\Windows\System\eHAhZpi.exe
  2⤵
  PID:5856
- C:\Windows\System\epuXtgo.exe
  C:\Windows\System\epuXtgo.exe
  2⤵
  PID:5904
- C:\Windows\System\wHBjyFc.exe
  C:\Windows\System\wHBjyFc.exe
  2⤵
  PID:5956
- C:\Windows\System\oxwbzvW.exe
  C:\Windows\System\oxwbzvW.exe
  2⤵
  PID:6052
- C:\Windows\System\uVFbTdI.exe
  C:\Windows\System\uVFbTdI.exe
  2⤵
  PID:5356
- C:\Windows\System\cZkVuKP.exe
  C:\Windows\System\cZkVuKP.exe
  2⤵
  PID:5164
- C:\Windows\System\iaPAGaq.exe
  C:\Windows\System\iaPAGaq.exe
  2⤵
  PID:5244
- C:\Windows\System\KtUcRvo.exe
  C:\Windows\System\KtUcRvo.exe
  2⤵
  PID:2872
- C:\Windows\System\JHzPuZF.exe
  C:\Windows\System\JHzPuZF.exe
  2⤵
  PID:5548
- C:\Windows\System\JEslmHQ.exe
  C:\Windows\System\JEslmHQ.exe
  2⤵
  PID:4416
- C:\Windows\System\SyHJNob.exe
  C:\Windows\System\SyHJNob.exe
  2⤵
  PID:3436
- C:\Windows\System\GuBPPDh.exe
  C:\Windows\System\GuBPPDh.exe
  2⤵
  PID:5752
- C:\Windows\System\RMCyiqM.exe
  C:\Windows\System\RMCyiqM.exe
  2⤵
  PID:5912
- C:\Windows\System\XpXkJyF.exe
  C:\Windows\System\XpXkJyF.exe
  2⤵
  PID:5996
- C:\Windows\System\aJZBiqj.exe
  C:\Windows\System\aJZBiqj.exe
  2⤵
  PID:5276
- C:\Windows\System\oEpXFeX.exe
  C:\Windows\System\oEpXFeX.exe
  2⤵
  PID:5448
- C:\Windows\System\HAMFNXV.exe
  C:\Windows\System\HAMFNXV.exe
  2⤵
  PID:1568
- C:\Windows\System\OYUUFQv.exe
  C:\Windows\System\OYUUFQv.exe
  2⤵
  PID:4848
- C:\Windows\System\XfangWi.exe
  C:\Windows\System\XfangWi.exe
  2⤵
  PID:6004
- C:\Windows\System\yshMbHt.exe
  C:\Windows\System\yshMbHt.exe
  2⤵
  PID:5388
- C:\Windows\System\ofaWvym.exe
  C:\Windows\System\ofaWvym.exe
  2⤵
  PID:6156
- C:\Windows\System\NdHdCYn.exe
  C:\Windows\System\NdHdCYn.exe
  2⤵
  PID:6192
- C:\Windows\System\JKmnfQA.exe
  C:\Windows\System\JKmnfQA.exe
  2⤵
  PID:6216
- C:\Windows\System\ehpMnZJ.exe
  C:\Windows\System\ehpMnZJ.exe
  2⤵
  PID:6252
- C:\Windows\System\LcXsBGq.exe
  C:\Windows\System\LcXsBGq.exe
  2⤵
  PID:6276
- C:\Windows\System\SQkyMbe.exe
  C:\Windows\System\SQkyMbe.exe
  2⤵
  PID:6308
- C:\Windows\System\DUieivl.exe
  C:\Windows\System\DUieivl.exe
  2⤵
  PID:6324
- C:\Windows\System\NyoiSQa.exe
  C:\Windows\System\NyoiSQa.exe
  2⤵
  PID:6360
- C:\Windows\System\rudFQHi.exe
  C:\Windows\System\rudFQHi.exe
  2⤵
  PID:6380
- C:\Windows\System\oCBHfRa.exe
  C:\Windows\System\oCBHfRa.exe
  2⤵
  PID:6440
- C:\Windows\System\ZAfRyda.exe
  C:\Windows\System\ZAfRyda.exe
  2⤵
  PID:6468
- C:\Windows\System\INmItth.exe
  C:\Windows\System\INmItth.exe
  2⤵
  PID:6484
- C:\Windows\System\LJzDFpp.exe
  C:\Windows\System\LJzDFpp.exe
  2⤵
  PID:6512
- C:\Windows\System\LTjRQKL.exe
  C:\Windows\System\LTjRQKL.exe
  2⤵
  PID:6540
- C:\Windows\System\UdypBeB.exe
  C:\Windows\System\UdypBeB.exe
  2⤵
  PID:6568
- C:\Windows\System\RGZgOdH.exe
  C:\Windows\System\RGZgOdH.exe
  2⤵
  PID:6600
- C:\Windows\System\YnbtiPg.exe
  C:\Windows\System\YnbtiPg.exe
  2⤵
  PID:6644
- C:\Windows\System\stFbFrf.exe
  C:\Windows\System\stFbFrf.exe
  2⤵
  PID:6672
- C:\Windows\System\UGTaudW.exe
  C:\Windows\System\UGTaudW.exe
  2⤵
  PID:6704
- C:\Windows\System\okcvNzG.exe
  C:\Windows\System\okcvNzG.exe
  2⤵
  PID:6732
- C:\Windows\System\qohQZzW.exe
  C:\Windows\System\qohQZzW.exe
  2⤵
  PID:6764
- C:\Windows\System\VgReCMJ.exe
  C:\Windows\System\VgReCMJ.exe
  2⤵
  PID:6792
- C:\Windows\System\XLMXcsB.exe
  C:\Windows\System\XLMXcsB.exe
  2⤵
  PID:6820
- C:\Windows\System\OtNULfE.exe
  C:\Windows\System\OtNULfE.exe
  2⤵
  PID:6852
- C:\Windows\System\JiVLQdn.exe
  C:\Windows\System\JiVLQdn.exe
  2⤵
  PID:6880
- C:\Windows\System\rxqavZc.exe
  C:\Windows\System\rxqavZc.exe
  2⤵
  PID:6904
- C:\Windows\System\FNrLbpf.exe
  C:\Windows\System\FNrLbpf.exe
  2⤵
  PID:6932
- C:\Windows\System\riyYJhh.exe
  C:\Windows\System\riyYJhh.exe
  2⤵
  PID:6960
- C:\Windows\System\bUxRuqu.exe
  C:\Windows\System\bUxRuqu.exe
  2⤵
  PID:6988
- C:\Windows\System\xbGgXbb.exe
  C:\Windows\System\xbGgXbb.exe
  2⤵
  PID:7016
- C:\Windows\System\QGSOWGf.exe
  C:\Windows\System\QGSOWGf.exe
  2⤵
  PID:7048
- C:\Windows\System\ciwQFQN.exe
  C:\Windows\System\ciwQFQN.exe
  2⤵
  PID:7080
- C:\Windows\System\rnkMBoz.exe
  C:\Windows\System\rnkMBoz.exe
  2⤵
  PID:7108
- C:\Windows\System\OADCXhG.exe
  C:\Windows\System\OADCXhG.exe
  2⤵
  PID:7136
- C:\Windows\System\LYGhlKK.exe
  C:\Windows\System\LYGhlKK.exe
  2⤵
  PID:5840
- C:\Windows\System\dWyOXxT.exe
  C:\Windows\System\dWyOXxT.exe
  2⤵
  PID:6188
- C:\Windows\System\TBKuNFh.exe
  C:\Windows\System\TBKuNFh.exe
  2⤵
  PID:6204
- C:\Windows\System\fTGzOnd.exe
  C:\Windows\System\fTGzOnd.exe
  2⤵
  PID:6288
- C:\Windows\System\knZDbax.exe
  C:\Windows\System\knZDbax.exe
  2⤵
  PID:6376
- C:\Windows\System\pKdiUjp.exe
  C:\Windows\System\pKdiUjp.exe
  2⤵
  PID:6352
- C:\Windows\System\CODBDWJ.exe
  C:\Windows\System\CODBDWJ.exe
  2⤵
  PID:6464
- C:\Windows\System\rNlQlTe.exe
  C:\Windows\System\rNlQlTe.exe
  2⤵
  PID:6524
- C:\Windows\System\ffVJelL.exe
  C:\Windows\System\ffVJelL.exe
  2⤵
  PID:6560
- C:\Windows\System\VdPeFSw.exe
  C:\Windows\System\VdPeFSw.exe
  2⤵
  PID:6640
- C:\Windows\System\KxZUPiv.exe
  C:\Windows\System\KxZUPiv.exe
  2⤵
  PID:6700
- C:\Windows\System\FuyYBit.exe
  C:\Windows\System\FuyYBit.exe
  2⤵
  PID:6748
- C:\Windows\System\nifmDCn.exe
  C:\Windows\System\nifmDCn.exe
  2⤵
  PID:6788
- C:\Windows\System\ZCvEhRC.exe
  C:\Windows\System\ZCvEhRC.exe
  2⤵
  PID:6868
- C:\Windows\System\WNmrWgS.exe
  C:\Windows\System\WNmrWgS.exe
  2⤵
  PID:6912
- C:\Windows\System\UPimUoN.exe
  C:\Windows\System\UPimUoN.exe
  2⤵
  PID:7032
- C:\Windows\System\KipEqeF.exe
  C:\Windows\System\KipEqeF.exe
  2⤵
  PID:7088
- C:\Windows\System\awPROfy.exe
  C:\Windows\System\awPROfy.exe
  2⤵
  PID:7152
- C:\Windows\System\sWstWxe.exe
  C:\Windows\System\sWstWxe.exe
  2⤵
  PID:6232
- C:\Windows\System\pAguZad.exe
  C:\Windows\System\pAguZad.exe
  2⤵
  PID:6424
- C:\Windows\System\EWlTkIX.exe
  C:\Windows\System\EWlTkIX.exe
  2⤵
  PID:5328
- C:\Windows\System\HTDAzGA.exe
  C:\Windows\System\HTDAzGA.exe
  2⤵
  PID:6556
- C:\Windows\System\VsdqDeU.exe
  C:\Windows\System\VsdqDeU.exe
  2⤵
  PID:6436
- C:\Windows\System\TQdxZyU.exe
  C:\Windows\System\TQdxZyU.exe
  2⤵
  PID:6752
- C:\Windows\System\gNUmhjP.exe
  C:\Windows\System\gNUmhjP.exe
  2⤵
  PID:6896
- C:\Windows\System\IYxkkFV.exe
  C:\Windows\System\IYxkkFV.exe
  2⤵
  PID:1988
- C:\Windows\System\vYDGUJI.exe
  C:\Windows\System\vYDGUJI.exe
  2⤵
  PID:6152
- C:\Windows\System\mctYNvd.exe
  C:\Windows\System\mctYNvd.exe
  2⤵
  PID:6368
- C:\Windows\System\WnBjxvj.exe
  C:\Windows\System\WnBjxvj.exe
  2⤵
  PID:6632
- C:\Windows\System\TEilWfj.exe
  C:\Windows\System\TEilWfj.exe
  2⤵
  PID:7176
- C:\Windows\System\oRCQpKA.exe
  C:\Windows\System\oRCQpKA.exe
  2⤵
  PID:7204
- C:\Windows\System\QLhKHIl.exe
  C:\Windows\System\QLhKHIl.exe
  2⤵
  PID:7240
- C:\Windows\System\rXjJpLb.exe
  C:\Windows\System\rXjJpLb.exe
  2⤵
  PID:7260
- C:\Windows\System\QzPJiTx.exe
  C:\Windows\System\QzPJiTx.exe
  2⤵
  PID:7296
- C:\Windows\System\CJdUlKk.exe
  C:\Windows\System\CJdUlKk.exe
  2⤵
  PID:7320
- C:\Windows\System\uoESefP.exe
  C:\Windows\System\uoESefP.exe
  2⤵
  PID:7352
- C:\Windows\System\yaavyjI.exe
  C:\Windows\System\yaavyjI.exe
  2⤵
  PID:7380
- C:\Windows\System\vYUZUbb.exe
  C:\Windows\System\vYUZUbb.exe
  2⤵
  PID:7396
- C:\Windows\System\WrPDswG.exe
  C:\Windows\System\WrPDswG.exe
  2⤵
  PID:7428
- C:\Windows\System\upGfxSc.exe
  C:\Windows\System\upGfxSc.exe
  2⤵
  PID:7500
- C:\Windows\System\ZFhcRKZ.exe
  C:\Windows\System\ZFhcRKZ.exe
  2⤵
  PID:7536
- C:\Windows\System\GuJOrur.exe
  C:\Windows\System\GuJOrur.exe
  2⤵
  PID:7564
- C:\Windows\System\uldwfqo.exe
  C:\Windows\System\uldwfqo.exe
  2⤵
  PID:7588
- C:\Windows\System\ptTQTOh.exe
  C:\Windows\System\ptTQTOh.exe
  2⤵
  PID:7604
- C:\Windows\System\pokUUAS.exe
  C:\Windows\System\pokUUAS.exe
  2⤵
  PID:7636
- C:\Windows\System\osRrUdl.exe
  C:\Windows\System\osRrUdl.exe
  2⤵
  PID:7668
- C:\Windows\System\oGutmbZ.exe
  C:\Windows\System\oGutmbZ.exe
  2⤵
  PID:7704
- C:\Windows\System\kacDvPA.exe
  C:\Windows\System\kacDvPA.exe
  2⤵
  PID:7720
- C:\Windows\System\ARViYVO.exe
  C:\Windows\System\ARViYVO.exe
  2⤵
  PID:7752
- C:\Windows\System\ljItEMI.exe
  C:\Windows\System\ljItEMI.exe
  2⤵
  PID:7780
- C:\Windows\System\izNjoQs.exe
  C:\Windows\System\izNjoQs.exe
  2⤵
  PID:7812
- C:\Windows\System\qwLiGLW.exe
  C:\Windows\System\qwLiGLW.exe
  2⤵
  PID:7852
- C:\Windows\System\ppAUnPr.exe
  C:\Windows\System\ppAUnPr.exe
  2⤵
  PID:7872
- C:\Windows\System\PFuNgTO.exe
  C:\Windows\System\PFuNgTO.exe
  2⤵
  PID:7900
- C:\Windows\System\AHFhFEJ.exe
  C:\Windows\System\AHFhFEJ.exe
  2⤵
  PID:7936
- C:\Windows\System\ZsIfNdz.exe
  C:\Windows\System\ZsIfNdz.exe
  2⤵
  PID:7960
- C:\Windows\System\QqCeiwR.exe
  C:\Windows\System\QqCeiwR.exe
  2⤵
  PID:7996
- C:\Windows\System\WdrHUah.exe
  C:\Windows\System\WdrHUah.exe
  2⤵
  PID:8016
- C:\Windows\System\TiRlOMA.exe
  C:\Windows\System\TiRlOMA.exe
  2⤵
  PID:8040
- C:\Windows\System\vUInLdY.exe
  C:\Windows\System\vUInLdY.exe
  2⤵
  PID:8104
- C:\Windows\System\UulfZQB.exe
  C:\Windows\System\UulfZQB.exe
  2⤵
  PID:8128
- C:\Windows\System\HfWyrpc.exe
  C:\Windows\System\HfWyrpc.exe
  2⤵
  PID:8156
- C:\Windows\System\fMAuhYJ.exe
  C:\Windows\System\fMAuhYJ.exe
  2⤵
  PID:8184
- C:\Windows\System\EFnSpQY.exe
  C:\Windows\System\EFnSpQY.exe
  2⤵
  PID:7120
- C:\Windows\System\VLqeYsk.exe
  C:\Windows\System\VLqeYsk.exe
  2⤵
  PID:7044
- C:\Windows\System\cxEXFrE.exe
  C:\Windows\System\cxEXFrE.exe
  2⤵
  PID:7224
- C:\Windows\System\zBTWMeg.exe
  C:\Windows\System\zBTWMeg.exe
  2⤵
  PID:7304
- C:\Windows\System\zFFnJDa.exe
  C:\Windows\System\zFFnJDa.exe
  2⤵
  PID:7328
- C:\Windows\System\mHWSIBm.exe
  C:\Windows\System\mHWSIBm.exe
  2⤵
  PID:7424
- C:\Windows\System\nrwsPuW.exe
  C:\Windows\System\nrwsPuW.exe
  2⤵
  PID:7408
- C:\Windows\System\DtitKVz.exe
  C:\Windows\System\DtitKVz.exe
  2⤵
  PID:7448
- C:\Windows\System\WAiYKlZ.exe
  C:\Windows\System\WAiYKlZ.exe
  2⤵
  PID:7560
- C:\Windows\System\RyoNfAU.exe
  C:\Windows\System\RyoNfAU.exe
  2⤵
  PID:7632
- C:\Windows\System\izQOAGM.exe
  C:\Windows\System\izQOAGM.exe
  2⤵
  PID:7716
- C:\Windows\System\oXxEmDN.exe
  C:\Windows\System\oXxEmDN.exe
  2⤵
  PID:7748
- C:\Windows\System\tUTguMN.exe
  C:\Windows\System\tUTguMN.exe
  2⤵
  PID:7804
- C:\Windows\System\lBMONdN.exe
  C:\Windows\System\lBMONdN.exe
  2⤵
  PID:8004
- C:\Windows\System\eBghyjB.exe
  C:\Windows\System\eBghyjB.exe
  2⤵
  PID:8064
- C:\Windows\System\jmcWALj.exe
  C:\Windows\System\jmcWALj.exe
  2⤵
  PID:8124
- C:\Windows\System\DCsYHjw.exe
  C:\Windows\System\DCsYHjw.exe
  2⤵
  PID:7000
- C:\Windows\System\fElkpiw.exe
  C:\Windows\System\fElkpiw.exe
  2⤵
  PID:7288
- C:\Windows\System\toKYTxE.exe
  C:\Windows\System\toKYTxE.exe
  2⤵
  PID:7392
- C:\Windows\System\VmlcXgN.exe
  C:\Windows\System\VmlcXgN.exe
  2⤵
  PID:7388
- C:\Windows\System\PTlGPeB.exe
  C:\Windows\System\PTlGPeB.exe
  2⤵
  PID:7692
- C:\Windows\System\aqLrDJZ.exe
  C:\Windows\System\aqLrDJZ.exe
  2⤵
  PID:7892
- C:\Windows\System\sDuZdmr.exe
  C:\Windows\System\sDuZdmr.exe
  2⤵
  PID:224
- C:\Windows\System\yGpWXbD.exe
  C:\Windows\System\yGpWXbD.exe
  2⤵
  PID:4952
- C:\Windows\System\dkjSFkI.exe
  C:\Windows\System\dkjSFkI.exe
  2⤵
  PID:7920
- C:\Windows\System\SfEuYQq.exe
  C:\Windows\System\SfEuYQq.exe
  2⤵
  PID:2516
- C:\Windows\System\SZYevJw.exe
  C:\Windows\System\SZYevJw.exe
  2⤵
  PID:4536
- C:\Windows\System\idBdwOh.exe
  C:\Windows\System\idBdwOh.exe
  2⤵
  PID:7484
- C:\Windows\System\DirUMPD.exe
  C:\Windows\System\DirUMPD.exe
  2⤵
  PID:1328
- C:\Windows\System\TTfxPtt.exe
  C:\Windows\System\TTfxPtt.exe
  2⤵
  PID:4512
- C:\Windows\System\NbsNDPd.exe
  C:\Windows\System\NbsNDPd.exe
  2⤵
  PID:8036
- C:\Windows\System\IxNenGG.exe
  C:\Windows\System\IxNenGG.exe
  2⤵
  PID:8232
- C:\Windows\System\BKjsFel.exe
  C:\Windows\System\BKjsFel.exe
  2⤵
  PID:8256
- C:\Windows\System\JFRduyd.exe
  C:\Windows\System\JFRduyd.exe
  2⤵
  PID:8276
- C:\Windows\System\ECxLGXf.exe
  C:\Windows\System\ECxLGXf.exe
  2⤵
  PID:8328
- C:\Windows\System\PpWsaxA.exe
  C:\Windows\System\PpWsaxA.exe
  2⤵
  PID:8348
- C:\Windows\System\bFJpbbo.exe
  C:\Windows\System\bFJpbbo.exe
  2⤵
  PID:8364
- C:\Windows\System\YgudvhE.exe
  C:\Windows\System\YgudvhE.exe
  2⤵
  PID:8388
- C:\Windows\System\SnGqwZV.exe
  C:\Windows\System\SnGqwZV.exe
  2⤵
  PID:8412
- C:\Windows\System\NDDAaZu.exe
  C:\Windows\System\NDDAaZu.exe
  2⤵
  PID:8440
- C:\Windows\System\CwDIXxw.exe
  C:\Windows\System\CwDIXxw.exe
  2⤵
  PID:8468
- C:\Windows\System\lxoZyXQ.exe
  C:\Windows\System\lxoZyXQ.exe
  2⤵
  PID:8484
- C:\Windows\System\jCUsBFf.exe
  C:\Windows\System\jCUsBFf.exe
  2⤵
  PID:8508
- C:\Windows\System\jBPLGFB.exe
  C:\Windows\System\jBPLGFB.exe
  2⤵
  PID:8540
- C:\Windows\System\DxBBcxj.exe
  C:\Windows\System\DxBBcxj.exe
  2⤵
  PID:8576
- C:\Windows\System\kjFJYUc.exe
  C:\Windows\System\kjFJYUc.exe
  2⤵
  PID:8640
- C:\Windows\System\gErRnBr.exe
  C:\Windows\System\gErRnBr.exe
  2⤵
  PID:8664
- C:\Windows\System\CaXLOei.exe
  C:\Windows\System\CaXLOei.exe
  2⤵
  PID:8692
- C:\Windows\System\qXAnKmS.exe
  C:\Windows\System\qXAnKmS.exe
  2⤵
  PID:8720
- C:\Windows\System\dLgWERV.exe
  C:\Windows\System\dLgWERV.exe
  2⤵
  PID:8744
- C:\Windows\System\RXuwsDX.exe
  C:\Windows\System\RXuwsDX.exe
  2⤵
  PID:8776
- C:\Windows\System\pfivXAQ.exe
  C:\Windows\System\pfivXAQ.exe
  2⤵
  PID:8804
- C:\Windows\System\AijCRmi.exe
  C:\Windows\System\AijCRmi.exe
  2⤵
  PID:8824
- C:\Windows\System\OAjbXLs.exe
  C:\Windows\System\OAjbXLs.exe
  2⤵
  PID:8852
- C:\Windows\System\BAYqwfh.exe
  C:\Windows\System\BAYqwfh.exe
  2⤵
  PID:8876
- C:\Windows\System\DmGusHC.exe
  C:\Windows\System\DmGusHC.exe
  2⤵
  PID:8900
- C:\Windows\System\kgOicME.exe
  C:\Windows\System\kgOicME.exe
  2⤵
  PID:8928
- C:\Windows\System\tdbfQTe.exe
  C:\Windows\System\tdbfQTe.exe
  2⤵
  PID:8960
- C:\Windows\System\QIYIQuz.exe
  C:\Windows\System\QIYIQuz.exe
  2⤵
  PID:8992
- C:\Windows\System\JkBiSzn.exe
  C:\Windows\System\JkBiSzn.exe
  2⤵
  PID:9020
- C:\Windows\System\ZvbkZTf.exe
  C:\Windows\System\ZvbkZTf.exe
  2⤵
  PID:9048
- C:\Windows\System\vSbRWrI.exe
  C:\Windows\System\vSbRWrI.exe
  2⤵
  PID:9072
- C:\Windows\System\jXxIArU.exe
  C:\Windows\System\jXxIArU.exe
  2⤵
  PID:9092
- C:\Windows\System\DvxjEoz.exe
  C:\Windows\System\DvxjEoz.exe
  2⤵
  PID:9120
- C:\Windows\System\ZKePLVf.exe
  C:\Windows\System\ZKePLVf.exe
  2⤵
  PID:9156
- C:\Windows\System\fFkKGLu.exe
  C:\Windows\System\fFkKGLu.exe
  2⤵
  PID:9184
- C:\Windows\System\CztSLMH.exe
  C:\Windows\System\CztSLMH.exe
  2⤵
  PID:9204
- C:\Windows\System\WVxzztp.exe
  C:\Windows\System\WVxzztp.exe
  2⤵
  PID:7980
- C:\Windows\System\QOVlUjv.exe
  C:\Windows\System\QOVlUjv.exe
  2⤵
  PID:6724
- C:\Windows\System\wkkbBrd.exe
  C:\Windows\System\wkkbBrd.exe
  2⤵
  PID:8244
- C:\Windows\System\WmgCwxn.exe
  C:\Windows\System\WmgCwxn.exe
  2⤵
  PID:7712
- C:\Windows\System\kueksgg.exe
  C:\Windows\System\kueksgg.exe
  2⤵
  PID:8384
- C:\Windows\System\XaTmfCV.exe
  C:\Windows\System\XaTmfCV.exe
  2⤵
  PID:8404
- C:\Windows\System\gvMtcrx.exe
  C:\Windows\System\gvMtcrx.exe
  2⤵
  PID:8428
- C:\Windows\System\rqBLLYD.exe
  C:\Windows\System\rqBLLYD.exe
  2⤵
  PID:8524
- C:\Windows\System\RyddpRx.exe
  C:\Windows\System\RyddpRx.exe
  2⤵
  PID:8584
- C:\Windows\System\KlqDLGt.exe
  C:\Windows\System\KlqDLGt.exe
  2⤵
  PID:8684
- C:\Windows\System\VcFQXCr.exe
  C:\Windows\System\VcFQXCr.exe
  2⤵
  PID:8756
- C:\Windows\System\YWzkpJt.exe
  C:\Windows\System\YWzkpJt.exe
  2⤵
  PID:8736
- C:\Windows\System\ZuTcIXD.exe
  C:\Windows\System\ZuTcIXD.exe
  2⤵
  PID:8888
- C:\Windows\System\ZwlYKIq.exe
  C:\Windows\System\ZwlYKIq.exe
  2⤵
  PID:8924
- C:\Windows\System\QMbLPiH.exe
  C:\Windows\System\QMbLPiH.exe
  2⤵
  PID:8940
- C:\Windows\System\KMZvGmV.exe
  C:\Windows\System\KMZvGmV.exe
  2⤵
  PID:8972
- C:\Windows\System\CZBAkRB.exe
  C:\Windows\System\CZBAkRB.exe
  2⤵
  PID:9136
- C:\Windows\System\ZAcFrdV.exe
  C:\Windows\System\ZAcFrdV.exe
  2⤵
  PID:9176
- C:\Windows\System\SOEckto.exe
  C:\Windows\System\SOEckto.exe
  2⤵
  PID:9152
- C:\Windows\System\WowFHSV.exe
  C:\Windows\System\WowFHSV.exe
  2⤵
  PID:3088
- C:\Windows\System\fmvsNEn.exe
  C:\Windows\System\fmvsNEn.exe
  2⤵
  PID:8500
- C:\Windows\System\qANVqIK.exe
  C:\Windows\System\qANVqIK.exe
  2⤵
  PID:8672
- C:\Windows\System\JHGlddB.exe
  C:\Windows\System\JHGlddB.exe
  2⤵
  PID:8768
- C:\Windows\System\XujFIEh.exe
  C:\Windows\System\XujFIEh.exe
  2⤵
  PID:8796
- C:\Windows\System\vxLsxZP.exe
  C:\Windows\System\vxLsxZP.exe
  2⤵
  PID:2832
- C:\Windows\System\cLDzVrh.exe
  C:\Windows\System\cLDzVrh.exe
  2⤵
  PID:9192
- C:\Windows\System\XDBEpmm.exe
  C:\Windows\System\XDBEpmm.exe
  2⤵
  PID:8424
- C:\Windows\System\bnMYbvi.exe
  C:\Windows\System\bnMYbvi.exe
  2⤵
  PID:8792
- C:\Windows\System\JvlTPqX.exe
  C:\Windows\System\JvlTPqX.exe
  2⤵
  PID:8836
- C:\Windows\System\KpQIbmb.exe
  C:\Windows\System\KpQIbmb.exe
  2⤵
  PID:9116
- C:\Windows\System\DChxBFr.exe
  C:\Windows\System\DChxBFr.exe
  2⤵
  PID:8712
- C:\Windows\System\zNyGHsv.exe
  C:\Windows\System\zNyGHsv.exe
  2⤵
  PID:1364
- C:\Windows\System\DqXyfZy.exe
  C:\Windows\System\DqXyfZy.exe
  2⤵
  PID:9064
- C:\Windows\System\IIwfnTx.exe
  C:\Windows\System\IIwfnTx.exe
  2⤵
  PID:9276
- C:\Windows\System\dWdUBtS.exe
  C:\Windows\System\dWdUBtS.exe
  2⤵
  PID:9312
- C:\Windows\System\BhKTnoq.exe
  C:\Windows\System\BhKTnoq.exe
  2⤵
  PID:9332
- C:\Windows\System\cNgxvaV.exe
  C:\Windows\System\cNgxvaV.exe
  2⤵
  PID:9352
- C:\Windows\System\VDsinvB.exe
  C:\Windows\System\VDsinvB.exe
  2⤵
  PID:9380
- C:\Windows\System\WvdCOAr.exe
  C:\Windows\System\WvdCOAr.exe
  2⤵
  PID:9408
- C:\Windows\System\irjzNnw.exe
  C:\Windows\System\irjzNnw.exe
  2⤵
  PID:9448
- C:\Windows\System\PVtemeM.exe
  C:\Windows\System\PVtemeM.exe
  2⤵
  PID:9488
- C:\Windows\System\PXVSAxx.exe
  C:\Windows\System\PXVSAxx.exe
  2⤵
  PID:9520
- C:\Windows\System\KySLdKr.exe
  C:\Windows\System\KySLdKr.exe
  2⤵
  PID:9544
- C:\Windows\System\sOvqSls.exe
  C:\Windows\System\sOvqSls.exe
  2⤵
  PID:9572
- C:\Windows\System\gFFhfRe.exe
  C:\Windows\System\gFFhfRe.exe
  2⤵
  PID:9596
- C:\Windows\System\rrzpCSG.exe
  C:\Windows\System\rrzpCSG.exe
  2⤵
  PID:9632
- C:\Windows\System\rmIgvFP.exe
  C:\Windows\System\rmIgvFP.exe
  2⤵
  PID:9656
- C:\Windows\System\wihltVY.exe
  C:\Windows\System\wihltVY.exe
  2⤵
  PID:9676
- C:\Windows\System\zOlIGKV.exe
  C:\Windows\System\zOlIGKV.exe
  2⤵
  PID:9712
- C:\Windows\System\HuphWpS.exe
  C:\Windows\System\HuphWpS.exe
  2⤵
  PID:9736
- C:\Windows\System\ReqesiS.exe
  C:\Windows\System\ReqesiS.exe
  2⤵
  PID:9760
- C:\Windows\System\fwQpirG.exe
  C:\Windows\System\fwQpirG.exe
  2⤵
  PID:9792
- C:\Windows\System\fUZCeCw.exe
  C:\Windows\System\fUZCeCw.exe
  2⤵
  PID:9816
- C:\Windows\System\DYnpENb.exe
  C:\Windows\System\DYnpENb.exe
  2⤵
  PID:9844
- C:\Windows\System\yemUUaT.exe
  C:\Windows\System\yemUUaT.exe
  2⤵
  PID:9876
- C:\Windows\System\UjNmhwn.exe
  C:\Windows\System\UjNmhwn.exe
  2⤵
  PID:9904
- C:\Windows\System\ibhQXxE.exe
  C:\Windows\System\ibhQXxE.exe
  2⤵
  PID:9928
- C:\Windows\System\VhYsxlf.exe
  C:\Windows\System\VhYsxlf.exe
  2⤵
  PID:9960
- C:\Windows\System\wydcutF.exe
  C:\Windows\System\wydcutF.exe
  2⤵
  PID:9996
- C:\Windows\System\cUGpnqb.exe
  C:\Windows\System\cUGpnqb.exe
  2⤵
  PID:10024
- C:\Windows\System\sFcsJNg.exe
  C:\Windows\System\sFcsJNg.exe
  2⤵
  PID:10040
- C:\Windows\System\cKBxGIn.exe
  C:\Windows\System\cKBxGIn.exe
  2⤵
  PID:10064
- C:\Windows\System\GJDmfGv.exe
  C:\Windows\System\GJDmfGv.exe
  2⤵
  PID:10080
- C:\Windows\System\uyDZiXc.exe
  C:\Windows\System\uyDZiXc.exe
  2⤵
  PID:10104
- C:\Windows\System\TqlBfPn.exe
  C:\Windows\System\TqlBfPn.exe
  2⤵
  PID:10128
- C:\Windows\System\aELiRzY.exe
  C:\Windows\System\aELiRzY.exe
  2⤵
  PID:10152
- C:\Windows\System\EAxkWGy.exe
  C:\Windows\System\EAxkWGy.exe
  2⤵
  PID:10172
- C:\Windows\System\iTHGtAQ.exe
  C:\Windows\System\iTHGtAQ.exe
  2⤵
  PID:10196
- C:\Windows\System\qoYSAfR.exe
  C:\Windows\System\qoYSAfR.exe
  2⤵
  PID:10220
- C:\Windows\System\bGHIsQX.exe
  C:\Windows\System\bGHIsQX.exe
  2⤵
  PID:9212
- C:\Windows\System\DxOrvmm.exe
  C:\Windows\System\DxOrvmm.exe
  2⤵
  PID:9268
- C:\Windows\System\elGBvdH.exe
  C:\Windows\System\elGBvdH.exe
  2⤵
  PID:9420
- C:\Windows\System\kYMLhZe.exe
  C:\Windows\System\kYMLhZe.exe
  2⤵
  PID:9476
- C:\Windows\System\cIyhWUs.exe
  C:\Windows\System\cIyhWUs.exe
  2⤵
  PID:9560
- C:\Windows\System\IwiOqtI.exe
  C:\Windows\System\IwiOqtI.exe
  2⤵
  PID:9628
- C:\Windows\System\XhnHfzQ.exe
  C:\Windows\System\XhnHfzQ.exe
  2⤵
  PID:9688
- C:\Windows\System\vMgVXeH.exe
  C:\Windows\System\vMgVXeH.exe
  2⤵
  PID:9728
- C:\Windows\System\xLeACYZ.exe
  C:\Windows\System\xLeACYZ.exe
  2⤵
  PID:9780
- C:\Windows\System\GbvNbGp.exe
  C:\Windows\System\GbvNbGp.exe
  2⤵
  PID:9836
- C:\Windows\System\mLXwpYv.exe
  C:\Windows\System\mLXwpYv.exe
  2⤵
  PID:9864
- C:\Windows\System\FRgSiof.exe
  C:\Windows\System\FRgSiof.exe
  2⤵
  PID:9924
- C:\Windows\System\IDkQGgE.exe
  C:\Windows\System\IDkQGgE.exe
  2⤵
  PID:10012
- C:\Windows\System\oLVBknF.exe
  C:\Windows\System\oLVBknF.exe
  2⤵
  PID:10056
- C:\Windows\System\FQitrym.exe
  C:\Windows\System\FQitrym.exe
  2⤵
  PID:10036
- C:\Windows\System\BEvaCOd.exe
  C:\Windows\System\BEvaCOd.exe
  2⤵
  PID:1640
- C:\Windows\System\mQKZoCN.exe
  C:\Windows\System\mQKZoCN.exe
  2⤵
  PID:9244
- C:\Windows\System\sWlQJKo.exe
  C:\Windows\System\sWlQJKo.exe
  2⤵
  PID:10236
- C:\Windows\System\KfZJsJL.exe
  C:\Windows\System\KfZJsJL.exe
  2⤵
  PID:9540
- C:\Windows\System\gZEcadn.exe
  C:\Windows\System\gZEcadn.exe
  2⤵
  PID:9612
- C:\Windows\System\FBtQxPC.exe
  C:\Windows\System\FBtQxPC.exe
  2⤵
  PID:9772
- C:\Windows\System\yASPRNb.exe
  C:\Windows\System\yASPRNb.exe
  2⤵
  PID:4056
- C:\Windows\System\aqOKJDb.exe
  C:\Windows\System\aqOKJDb.exe
  2⤵
  PID:9972
- C:\Windows\System\qMKHCXU.exe
  C:\Windows\System\qMKHCXU.exe
  2⤵
  PID:10076
- C:\Windows\System\tHxRnsi.exe
  C:\Windows\System\tHxRnsi.exe
  2⤵
  PID:10148
- C:\Windows\System\HBXQjEw.exe
  C:\Windows\System\HBXQjEw.exe
  2⤵
  PID:9624
- C:\Windows\System\MvTuMsw.exe
  C:\Windows\System\MvTuMsw.exe
  2⤵
  PID:9604
- C:\Windows\System\qKwZNfV.exe
  C:\Windows\System\qKwZNfV.exe
  2⤵
  PID:9284
- C:\Windows\System\eWBgFHi.exe
  C:\Windows\System\eWBgFHi.exe
  2⤵
  PID:9704
- C:\Windows\System\opggToF.exe
  C:\Windows\System\opggToF.exe
  2⤵
  PID:9324
- C:\Windows\System\BWHHtPG.exe
  C:\Windows\System\BWHHtPG.exe
  2⤵
  PID:10272
- C:\Windows\System\ZhPsXbk.exe
  C:\Windows\System\ZhPsXbk.exe
  2⤵
  PID:10296
- C:\Windows\System\niwVnqA.exe
  C:\Windows\System\niwVnqA.exe
  2⤵
  PID:10312
- C:\Windows\System\fXoWwym.exe
  C:\Windows\System\fXoWwym.exe
  2⤵
  PID:10336
- C:\Windows\System\IwNIVSb.exe
  C:\Windows\System\IwNIVSb.exe
  2⤵
  PID:10376
- C:\Windows\System\mKWzKSQ.exe
  C:\Windows\System\mKWzKSQ.exe
  2⤵
  PID:10400
- C:\Windows\System\WriVuKe.exe
  C:\Windows\System\WriVuKe.exe
  2⤵
  PID:10428
- C:\Windows\System\KhCiyXF.exe
  C:\Windows\System\KhCiyXF.exe
  2⤵
  PID:10456
- C:\Windows\System\FOIyPxo.exe
  C:\Windows\System\FOIyPxo.exe
  2⤵
  PID:10488
- C:\Windows\System\aqBBElS.exe
  C:\Windows\System\aqBBElS.exe
  2⤵
  PID:10524
- C:\Windows\System\nAKEyNM.exe
  C:\Windows\System\nAKEyNM.exe
  2⤵
  PID:10548
- C:\Windows\System\tjHysJZ.exe
  C:\Windows\System\tjHysJZ.exe
  2⤵
  PID:10564
- C:\Windows\System\ZurKWEv.exe
  C:\Windows\System\ZurKWEv.exe
  2⤵
  PID:10588
- C:\Windows\System\rChWOCT.exe
  C:\Windows\System\rChWOCT.exe
  2⤵
  PID:10616
- C:\Windows\System\OQsbaBZ.exe
  C:\Windows\System\OQsbaBZ.exe
  2⤵
  PID:10644
- C:\Windows\System\rZlWlPO.exe
  C:\Windows\System\rZlWlPO.exe
  2⤵
  PID:10668
- C:\Windows\System\CTeQHbw.exe
  C:\Windows\System\CTeQHbw.exe
  2⤵
  PID:10700
- C:\Windows\System\PvZxmKc.exe
  C:\Windows\System\PvZxmKc.exe
  2⤵
  PID:10720
- C:\Windows\System\oIkZcEX.exe
  C:\Windows\System\oIkZcEX.exe
  2⤵
  PID:10744
- C:\Windows\System\oCSkHJj.exe
  C:\Windows\System\oCSkHJj.exe
  2⤵
  PID:10768
- C:\Windows\System\uKhgSMw.exe
  C:\Windows\System\uKhgSMw.exe
  2⤵
  PID:10800
- C:\Windows\System\tFsvFNL.exe
  C:\Windows\System\tFsvFNL.exe
  2⤵
  PID:10828
- C:\Windows\System\ZADggnC.exe
  C:\Windows\System\ZADggnC.exe
  2⤵
  PID:10860
- C:\Windows\System\MDKlQdk.exe
  C:\Windows\System\MDKlQdk.exe
  2⤵
  PID:10896
- C:\Windows\System\REhlRIN.exe
  C:\Windows\System\REhlRIN.exe
  2⤵
  PID:10916
- C:\Windows\System\aAkLBpR.exe
  C:\Windows\System\aAkLBpR.exe
  2⤵
  PID:10944
- C:\Windows\System\XTksNFZ.exe
  C:\Windows\System\XTksNFZ.exe
  2⤵
  PID:10988
- C:\Windows\System\dfvgCJY.exe
  C:\Windows\System\dfvgCJY.exe
  2⤵
  PID:11016
- C:\Windows\System\VBoiFsC.exe
  C:\Windows\System\VBoiFsC.exe
  2⤵
  PID:11040
- C:\Windows\System\TPaxHev.exe
  C:\Windows\System\TPaxHev.exe
  2⤵
  PID:11064
- C:\Windows\System\wdDjVgg.exe
  C:\Windows\System\wdDjVgg.exe
  2⤵
  PID:11092
- C:\Windows\System\WtJnFHs.exe
  C:\Windows\System\WtJnFHs.exe
  2⤵
  PID:11116
- C:\Windows\System\uuvivfY.exe
  C:\Windows\System\uuvivfY.exe
  2⤵
  PID:11156
- C:\Windows\System\IVoXveC.exe
  C:\Windows\System\IVoXveC.exe
  2⤵
  PID:11180
- C:\Windows\System\KdfwHFj.exe
  C:\Windows\System\KdfwHFj.exe
  2⤵
  PID:11204
- C:\Windows\System\nCGNdui.exe
  C:\Windows\System\nCGNdui.exe
  2⤵
  PID:11232
- C:\Windows\System\zMCkXXR.exe
  C:\Windows\System\zMCkXXR.exe
  2⤵
  PID:11260
- C:\Windows\System\uDrqOsF.exe
  C:\Windows\System\uDrqOsF.exe
  2⤵
  PID:1628
- C:\Windows\System\GiRKACn.exe
  C:\Windows\System\GiRKACn.exe
  2⤵
  PID:10292
- C:\Windows\System\KzieKrq.exe
  C:\Windows\System\KzieKrq.exe
  2⤵
  PID:10356
- C:\Windows\System\fqVxfNG.exe
  C:\Windows\System\fqVxfNG.exe
  2⤵
  PID:4168
- C:\Windows\System\akjlFiz.exe
  C:\Windows\System\akjlFiz.exe
  2⤵
  PID:10412
- C:\Windows\System\syTqLRJ.exe
  C:\Windows\System\syTqLRJ.exe
  2⤵
  PID:10508
- C:\Windows\System\VLomaiL.exe
  C:\Windows\System\VLomaiL.exe
  2⤵
  PID:10556
- C:\Windows\System\cbJyUdi.exe
  C:\Windows\System\cbJyUdi.exe
  2⤵
  PID:10612
- C:\Windows\System\WhrJwle.exe
  C:\Windows\System\WhrJwle.exe
  2⤵
  PID:10652
- C:\Windows\System\EwSNHAj.exe
  C:\Windows\System\EwSNHAj.exe
  2⤵
  PID:10716
- C:\Windows\System\SQOgijM.exe
  C:\Windows\System\SQOgijM.exe
  2⤵
  PID:10760
- C:\Windows\System\cpTTNGk.exe
  C:\Windows\System\cpTTNGk.exe
  2⤵
  PID:10852
- C:\Windows\System\cpETyXk.exe
  C:\Windows\System\cpETyXk.exe
  2⤵
  PID:10908
- C:\Windows\System\tdfeTmu.exe
  C:\Windows\System\tdfeTmu.exe
  2⤵
  PID:5096
- C:\Windows\System\gCCNrgm.exe
  C:\Windows\System\gCCNrgm.exe
  2⤵
  PID:11028
- C:\Windows\System\sAfPGRA.exe
  C:\Windows\System\sAfPGRA.exe
  2⤵
  PID:11076
- C:\Windows\System\WaFekxQ.exe
  C:\Windows\System\WaFekxQ.exe
  2⤵
  PID:11252
- C:\Windows\System\Tuhxjvz.exe
  C:\Windows\System\Tuhxjvz.exe
  2⤵
  PID:11256
- C:\Windows\System\rYsAhyT.exe
  C:\Windows\System\rYsAhyT.exe
  2⤵
  PID:4744
- C:\Windows\System\quqAyEj.exe
  C:\Windows\System\quqAyEj.exe
  2⤵
  PID:10736
- C:\Windows\System\IqtqbjJ.exe
  C:\Windows\System\IqtqbjJ.exe
  2⤵
  PID:676
- C:\Windows\System\mWmbGYr.exe
  C:\Windows\System\mWmbGYr.exe
  2⤵
  PID:11052
- C:\Windows\System\yeXKvzJ.exe
  C:\Windows\System\yeXKvzJ.exe
  2⤵
  PID:11008
- C:\Windows\System\hWELGjz.exe
  C:\Windows\System\hWELGjz.exe
  2⤵
  PID:4496
- C:\Windows\System\PzEtUUW.exe
  C:\Windows\System\PzEtUUW.exe
  2⤵
  PID:10260
- C:\Windows\System\ZmsACgm.exe
  C:\Windows\System\ZmsACgm.exe
  2⤵
  PID:10392
- C:\Windows\System\CEGFNcq.exe
  C:\Windows\System\CEGFNcq.exe
  2⤵
  PID:10792
- C:\Windows\System\hoCulCu.exe
  C:\Windows\System\hoCulCu.exe
  2⤵
  PID:11168
- C:\Windows\System\VjkLtJu.exe
  C:\Windows\System\VjkLtJu.exe
  2⤵
  PID:11284
- C:\Windows\System\zJUxzAQ.exe
  C:\Windows\System\zJUxzAQ.exe
  2⤵
  PID:11320
- C:\Windows\System\extuFrg.exe
  C:\Windows\System\extuFrg.exe
  2⤵
  PID:11340
- C:\Windows\System\lKHtFoL.exe
  C:\Windows\System\lKHtFoL.exe
  2⤵
  PID:11368
- C:\Windows\System\jWLtXni.exe
  C:\Windows\System\jWLtXni.exe
  2⤵
  PID:11388
- C:\Windows\System\bpBoHCz.exe
  C:\Windows\System\bpBoHCz.exe
  2⤵
  PID:11412
- C:\Windows\System\lFeGoFA.exe
  C:\Windows\System\lFeGoFA.exe
  2⤵
  PID:11448
- C:\Windows\System\DsLWTGl.exe
  C:\Windows\System\DsLWTGl.exe
  2⤵
  PID:11480
- C:\Windows\System\NFqBvQe.exe
  C:\Windows\System\NFqBvQe.exe
  2⤵
  PID:11508
- C:\Windows\System\ppghzCM.exe
  C:\Windows\System\ppghzCM.exe
  2⤵
  PID:11544
- C:\Windows\System\wnmPkJL.exe
  C:\Windows\System\wnmPkJL.exe
  2⤵
  PID:11560
- C:\Windows\System\BOQpUaE.exe
  C:\Windows\System\BOQpUaE.exe
  2⤵
  PID:11584
- C:\Windows\System\qCQpjIM.exe
  C:\Windows\System\qCQpjIM.exe
  2⤵
  PID:11616
- C:\Windows\System\JAdXxwY.exe
  C:\Windows\System\JAdXxwY.exe
  2⤵
  PID:11640
- C:\Windows\System\sAjcLij.exe
  C:\Windows\System\sAjcLij.exe
  2⤵
  PID:11672
- C:\Windows\System\CIVCnrt.exe
  C:\Windows\System\CIVCnrt.exe
  2⤵
  PID:11696
- C:\Windows\System\MlzoRpJ.exe
  C:\Windows\System\MlzoRpJ.exe
  2⤵
  PID:11724
- C:\Windows\System\spZfJSR.exe
  C:\Windows\System\spZfJSR.exe
  2⤵
  PID:11744
- C:\Windows\System\erYPVhn.exe
  C:\Windows\System\erYPVhn.exe
  2⤵
  PID:11768
- C:\Windows\System\YNBssCX.exe
  C:\Windows\System\YNBssCX.exe
  2⤵
  PID:11784
- C:\Windows\System\DEHTXbX.exe
  C:\Windows\System\DEHTXbX.exe
  2⤵
  PID:11812
- C:\Windows\System\tyfCGFQ.exe
  C:\Windows\System\tyfCGFQ.exe
  2⤵
  PID:11836
- C:\Windows\System\rnzuOvE.exe
  C:\Windows\System\rnzuOvE.exe
  2⤵
  PID:11852
- C:\Windows\System\XapotWU.exe
  C:\Windows\System\XapotWU.exe
  2⤵
  PID:11884
- C:\Windows\System\IeOineZ.exe
  C:\Windows\System\IeOineZ.exe
  2⤵
  PID:11908
- C:\Windows\System\zYqpxwp.exe
  C:\Windows\System\zYqpxwp.exe
  2⤵
  PID:11936
- C:\Windows\System\CXSaHNR.exe
  C:\Windows\System\CXSaHNR.exe
  2⤵
  PID:12104
- C:\Windows\System\PAUAxkK.exe
  C:\Windows\System\PAUAxkK.exe
  2⤵
  PID:12180
- C:\Windows\System\FUqxkQd.exe
  C:\Windows\System\FUqxkQd.exe
  2⤵
  PID:12216
- C:\Windows\System\zwQTPgA.exe
  C:\Windows\System\zwQTPgA.exe
  2⤵
  PID:12236
- C:\Windows\System\QeSjoHc.exe
  C:\Windows\System\QeSjoHc.exe
  2⤵
  PID:12252
- C:\Windows\System\rbwAZio.exe
  C:\Windows\System\rbwAZio.exe
  2⤵
  PID:12280
- C:\Windows\System\YAOPVey.exe
  C:\Windows\System\YAOPVey.exe
  2⤵
  PID:10680
- C:\Windows\System\Asyhxww.exe
  C:\Windows\System\Asyhxww.exe
  2⤵
  PID:11352
- C:\Windows\System\LCzRxRK.exe
  C:\Windows\System\LCzRxRK.exe
  2⤵
  PID:1076
- C:\Windows\System\ncSgkwM.exe
  C:\Windows\System\ncSgkwM.exe
  2⤵
  PID:11380
- C:\Windows\System\HZiLLAq.exe
  C:\Windows\System\HZiLLAq.exe
  2⤵
  PID:11400
- C:\Windows\System\BRAfIQp.exe
  C:\Windows\System\BRAfIQp.exe
  2⤵
  PID:2188
- C:\Windows\System\OHabayS.exe
  C:\Windows\System\OHabayS.exe
  2⤵
  PID:11660
- C:\Windows\System\LxdBOwY.exe
  C:\Windows\System\LxdBOwY.exe
  2⤵
  PID:11684
- C:\Windows\System\tODhRVn.exe
  C:\Windows\System\tODhRVn.exe
  2⤵
  PID:11528
- C:\Windows\System\dxHBodX.exe
  C:\Windows\System\dxHBodX.exe
  2⤵
  PID:11740
- C:\Windows\System\kenzTaN.exe
  C:\Windows\System\kenzTaN.exe
  2⤵
  PID:11828
- C:\Windows\System\WbiRxQU.exe
  C:\Windows\System\WbiRxQU.exe
  2⤵
  PID:11800
- C:\Windows\System\exKIzwk.exe
  C:\Windows\System\exKIzwk.exe
  2⤵
  PID:11992
- C:\Windows\System\gomyrjS.exe
  C:\Windows\System\gomyrjS.exe
  2⤵
  PID:12000
- C:\Windows\System\qESFQJc.exe
  C:\Windows\System\qESFQJc.exe
  2⤵
  PID:10328
- C:\Windows\System\kxpFWOE.exe
  C:\Windows\System\kxpFWOE.exe
  2⤵
  PID:10740
- C:\Windows\System\jzHvEUq.exe
  C:\Windows\System\jzHvEUq.exe
  2⤵
  PID:11792
- C:\Windows\System\OZXwawh.exe
  C:\Windows\System\OZXwawh.exe
  2⤵
  PID:12136
- C:\Windows\System\tVxZMNk.exe
  C:\Windows\System\tVxZMNk.exe
  2⤵
  PID:3576
- C:\Windows\System\txxxMiR.exe
  C:\Windows\System\txxxMiR.exe
  2⤵
  PID:3504
- C:\Windows\System\HuedyeX.exe
  C:\Windows\System\HuedyeX.exe
  2⤵
  PID:12228
- C:\Windows\System\KRWqckH.exe
  C:\Windows\System\KRWqckH.exe
  2⤵
  PID:11424
- C:\Windows\System\zhhqBRQ.exe
  C:\Windows\System\zhhqBRQ.exe
  2⤵
  PID:11408
- C:\Windows\System\WhqJGQb.exe
  C:\Windows\System\WhqJGQb.exe
  2⤵
  PID:11468
- C:\Windows\System\nXKYvQe.exe
  C:\Windows\System\nXKYvQe.exe
  2⤵
  PID:11628
- C:\Windows\System\SaqinqC.exe
  C:\Windows\System\SaqinqC.exe
  2⤵
  PID:11600
- C:\Windows\System\ztEHyGd.exe
  C:\Windows\System\ztEHyGd.exe
  2⤵
  PID:11780
- C:\Windows\System\LBYlIrI.exe
  C:\Windows\System\LBYlIrI.exe
  2⤵
  PID:4860
- C:\Windows\System\rwEqnCl.exe
  C:\Windows\System\rwEqnCl.exe
  2⤵
  PID:11904
- C:\Windows\System\kLQHaZp.exe
  C:\Windows\System\kLQHaZp.exe
  2⤵
  PID:1932
- C:\Windows\System\TjMoNHd.exe
  C:\Windows\System\TjMoNHd.exe
  2⤵
  PID:12268
- C:\Windows\System\qYqMkmK.exe
  C:\Windows\System\qYqMkmK.exe
  2⤵
  PID:11956
- C:\Windows\System\TLWNWOB.exe
  C:\Windows\System\TLWNWOB.exe
  2⤵
  PID:4344
- C:\Windows\System\ppPXlMe.exe
  C:\Windows\System\ppPXlMe.exe
  2⤵
  PID:4188
- C:\Windows\System\oNLoFVq.exe
  C:\Windows\System\oNLoFVq.exe
  2⤵
  PID:11948
- C:\Windows\System\VDVkrgO.exe
  C:\Windows\System\VDVkrgO.exe
  2⤵
  PID:748
- C:\Windows\System\bTTEVjB.exe
  C:\Windows\System\bTTEVjB.exe
  2⤵
  PID:4380
- C:\Windows\System\AhOGzyf.exe
  C:\Windows\System\AhOGzyf.exe
  2⤵
  PID:1388
- C:\Windows\System\PIufnKA.exe
  C:\Windows\System\PIufnKA.exe
  2⤵
  PID:4392
- C:\Windows\System\RxLwNOR.exe
  C:\Windows\System\RxLwNOR.exe
  2⤵
  PID:4700
- C:\Windows\System\dOiQwsd.exe
  C:\Windows\System\dOiQwsd.exe
  2⤵
  PID:1392
- C:\Windows\System\uuXCxoh.exe
  C:\Windows\System\uuXCxoh.exe
  2⤵
  PID:5232
- C:\Windows\System\IcszzNF.exe
  C:\Windows\System\IcszzNF.exe
  2⤵
  PID:11832
- C:\Windows\System\LWOEnOS.exe
  C:\Windows\System\LWOEnOS.exe
  2⤵
  PID:2264
- C:\Windows\System\cJfCRYu.exe
  C:\Windows\System\cJfCRYu.exe
  2⤵
  PID:5404
- C:\Windows\System\OKIEusC.exe
  C:\Windows\System\OKIEusC.exe
  2⤵
  PID:5460
- C:\Windows\System\zehntXO.exe
  C:\Windows\System\zehntXO.exe
  2⤵
  PID:5544
- C:\Windows\System\eiGzqHa.exe
  C:\Windows\System\eiGzqHa.exe
  2⤵
  PID:5600
- C:\Windows\System\OUrxrJd.exe
  C:\Windows\System\OUrxrJd.exe
  2⤵
  PID:5748
- C:\Windows\System\WxFWeRF.exe
  C:\Windows\System\WxFWeRF.exe
  2⤵
  PID:5828
- C:\Windows\System\JrkxBcD.exe
  C:\Windows\System\JrkxBcD.exe
  2⤵
  PID:5992
- C:\Windows\System\stcFyfz.exe
  C:\Windows\System\stcFyfz.exe
  2⤵
  PID:2972
- C:\Windows\System\QSlcJcJ.exe
  C:\Windows\System\QSlcJcJ.exe
  2⤵
  PID:1972
- C:\Windows\System\LyZUuXj.exe
  C:\Windows\System\LyZUuXj.exe
  2⤵
  PID:5240
- C:\Windows\System\owwxxnu.exe
  C:\Windows\System\owwxxnu.exe
  2⤵
  PID:5344
- C:\Windows\System\CuXWIJC.exe
  C:\Windows\System\CuXWIJC.exe
  2⤵
  PID:5784
- C:\Windows\System\LVBoBXm.exe
  C:\Windows\System\LVBoBXm.exe
  2⤵
  PID:5468
- C:\Windows\System\HewyeWr.exe
  C:\Windows\System\HewyeWr.exe
  2⤵
  PID:12272
- C:\Windows\System\mViGkwx.exe
  C:\Windows\System\mViGkwx.exe
  2⤵
  PID:5304
- C:\Windows\System\brEDmpf.exe
  C:\Windows\System\brEDmpf.exe
  2⤵
  PID:6000
- C:\Windows\System\zoVTtko.exe
  C:\Windows\System\zoVTtko.exe
  2⤵
  PID:3280
- C:\Windows\System\HlPisJr.exe
  C:\Windows\System\HlPisJr.exe
  2⤵
  PID:1476
- C:\Windows\System\jnJADlV.exe
  C:\Windows\System\jnJADlV.exe
  2⤵
  PID:544
- C:\Windows\System\wvESVRQ.exe
  C:\Windows\System\wvESVRQ.exe
  2⤵
  PID:5316
- C:\Windows\System\zBxPFdm.exe
  C:\Windows\System\zBxPFdm.exe
  2⤵
  PID:11880
- C:\Windows\System\cXizFtv.exe
  C:\Windows\System\cXizFtv.exe
  2⤵
  PID:11440
- C:\Windows\System\RLuRcVa.exe
  C:\Windows\System\RLuRcVa.exe
  2⤵
  PID:1756
- C:\Windows\System\iThtBrN.exe
  C:\Windows\System\iThtBrN.exe
  2⤵
  PID:12296
- C:\Windows\System\OgcEZDQ.exe
  C:\Windows\System\OgcEZDQ.exe
  2⤵
  PID:12316
- C:\Windows\System\MymCzDQ.exe
  C:\Windows\System\MymCzDQ.exe
  2⤵
  PID:12332
- C:\Windows\System\lumRvMz.exe
  C:\Windows\System\lumRvMz.exe
  2⤵
  PID:12348
- C:\Windows\System\DHSBkey.exe
  C:\Windows\System\DHSBkey.exe
  2⤵
  PID:12364
- C:\Windows\System\dqdnopS.exe
  C:\Windows\System\dqdnopS.exe
  2⤵
  PID:12380
- C:\Windows\System\NFfsKDP.exe
  C:\Windows\System\NFfsKDP.exe
  2⤵
  PID:12396
- C:\Windows\System\AfbmnHy.exe
  C:\Windows\System\AfbmnHy.exe
  2⤵
  PID:12420
- C:\Windows\System\NvjOOBq.exe
  C:\Windows\System\NvjOOBq.exe
  2⤵
  PID:12448
- C:\Windows\System\hwtlHZK.exe
  C:\Windows\System\hwtlHZK.exe
  2⤵
  PID:12472
- C:\Windows\System\QxnxGXh.exe
  C:\Windows\System\QxnxGXh.exe
  2⤵
  PID:12500
- C:\Windows\System\Qhpmzpu.exe
  C:\Windows\System\Qhpmzpu.exe
  2⤵
  PID:12532
- C:\Windows\System\MrQNqeh.exe
  C:\Windows\System\MrQNqeh.exe
  2⤵
  PID:12560
- C:\Windows\System\XEnmVyw.exe
  C:\Windows\System\XEnmVyw.exe
  2⤵
  PID:12580
- C:\Windows\System\VlfTRkZ.exe
  C:\Windows\System\VlfTRkZ.exe
  2⤵
  PID:12688
- C:\Windows\System\mhZRsTx.exe
  C:\Windows\System\mhZRsTx.exe
  2⤵
  PID:12716
- C:\Windows\System\sXClrFV.exe
  C:\Windows\System\sXClrFV.exe
  2⤵
  PID:12744
- C:\Windows\System\rfGIxJA.exe
  C:\Windows\System\rfGIxJA.exe
  2⤵
  PID:12768
- C:\Windows\System\OOdFQAH.exe
  C:\Windows\System\OOdFQAH.exe
  2⤵
  PID:12788
- C:\Windows\System\OJlFaOL.exe
  C:\Windows\System\OJlFaOL.exe
  2⤵
  PID:12816
- C:\Windows\System\rKJIMtP.exe
  C:\Windows\System\rKJIMtP.exe
  2⤵
  PID:12852
- C:\Windows\System\axApdxi.exe
  C:\Windows\System\axApdxi.exe
  2⤵
  PID:12904
- C:\Windows\System\ZBGugHu.exe
  C:\Windows\System\ZBGugHu.exe
  2⤵
  PID:12964
- C:\Windows\System\kOrjUOl.exe
  C:\Windows\System\kOrjUOl.exe
  2⤵
  PID:13000
- C:\Windows\System\pcYtfRO.exe
  C:\Windows\System\pcYtfRO.exe
  2⤵
  PID:13028
- C:\Windows\System\tFrcHft.exe
  C:\Windows\System\tFrcHft.exe
  2⤵
  PID:13052
- C:\Windows\System\UXVuURZ.exe
  C:\Windows\System\UXVuURZ.exe
  2⤵
  PID:13076
- C:\Windows\System\WyqzUQl.exe
  C:\Windows\System\WyqzUQl.exe
  2⤵
  PID:13100
- C:\Windows\System\UHcWVNW.exe
  C:\Windows\System\UHcWVNW.exe
  2⤵
  PID:13128
- C:\Windows\System\FZSuGcW.exe
  C:\Windows\System\FZSuGcW.exe
  2⤵
  PID:13152
- C:\Windows\System\fgSFaiC.exe
  C:\Windows\System\fgSFaiC.exe
  2⤵
  PID:13176
- C:\Windows\System\QfuBruj.exe
  C:\Windows\System\QfuBruj.exe
  2⤵
  PID:13196
- C:\Windows\System\fQmoQKZ.exe
  C:\Windows\System\fQmoQKZ.exe
  2⤵
  PID:13228
- C:\Windows\System\yskcTVa.exe
  C:\Windows\System\yskcTVa.exe
  2⤵
  PID:13248
- C:\Windows\System\ygsrFLf.exe
  C:\Windows\System\ygsrFLf.exe
  2⤵
  PID:13264
- C:\Windows\System\jwOmCVC.exe
  C:\Windows\System\jwOmCVC.exe
  2⤵
  PID:13280
- C:\Windows\System\AThdWPt.exe
  C:\Windows\System\AThdWPt.exe
  2⤵
  PID:13296
- C:\Windows\System\SNaOUco.exe
  C:\Windows\System\SNaOUco.exe
  2⤵
  PID:5680
- C:\Windows\System\tYsAvxX.exe
  C:\Windows\System\tYsAvxX.exe
  2⤵
  PID:6064
- C:\Windows\System\UozeUuq.exe
  C:\Windows\System\UozeUuq.exe
  2⤵
  PID:12356
- C:\Windows\System\EPLFSAl.exe
  C:\Windows\System\EPLFSAl.exe
  2⤵
  PID:12440
- C:\Windows\System\IWFrbaJ.exe
  C:\Windows\System\IWFrbaJ.exe
  2⤵
  PID:12464
- C:\Windows\System\jrwHKIV.exe
  C:\Windows\System\jrwHKIV.exe
  2⤵
  PID:12644
- C:\Windows\System\xVrCYnn.exe
  C:\Windows\System\xVrCYnn.exe
  2⤵
  PID:12492
- C:\Windows\System\vjMHLLi.exe
  C:\Windows\System\vjMHLLi.exe
  2⤵
  PID:12828
- C:\Windows\System\sOkOXIY.exe
  C:\Windows\System\sOkOXIY.exe
  2⤵
  PID:12864
- C:\Windows\System\XOdRYay.exe
  C:\Windows\System\XOdRYay.exe
  2⤵
  PID:12972
- C:\Windows\System\YxdyYcW.exe
  C:\Windows\System\YxdyYcW.exe
  2⤵
  PID:13016
- C:\Windows\System\TIHPplJ.exe
  C:\Windows\System\TIHPplJ.exe
  2⤵
  PID:13068
- C:\Windows\System\bJnGdqV.exe
  C:\Windows\System\bJnGdqV.exe
  2⤵
  PID:13164
- C:\Windows\System\koFdJWd.exe
  C:\Windows\System\koFdJWd.exe
  2⤵
  PID:6452
- C:\Windows\System\AdYwcye.exe
  C:\Windows\System\AdYwcye.exe
  2⤵
  PID:13272
- C:\Windows\System\BIOHCjb.exe
  C:\Windows\System\BIOHCjb.exe
  2⤵
  PID:6624
- C:\Windows\System\rnLARXF.exe
  C:\Windows\System\rnLARXF.exe
  2⤵
  PID:6720
- C:\Windows\System\RHuBcFS.exe
  C:\Windows\System\RHuBcFS.exe
  2⤵
  PID:13308
- C:\Windows\System\cFziXYJ.exe
  C:\Windows\System\cFziXYJ.exe
  2⤵
  PID:12376
- C:\Windows\System\iWwnbga.exe
  C:\Windows\System\iWwnbga.exe
  2⤵
  PID:12444
- C:\Windows\System\CqdCYBt.exe
  C:\Windows\System\CqdCYBt.exe
  2⤵
  PID:12552
- C:\Windows\System\TArATSS.exe
  C:\Windows\System\TArATSS.exe
  2⤵
  PID:12804
- C:\Windows\System\yUpmUwA.exe
  C:\Windows\System\yUpmUwA.exe
  2⤵
  PID:7128
- C:\Windows\System\WAQzQZH.exe
  C:\Windows\System\WAQzQZH.exe
  2⤵
  PID:12984
- C:\Windows\System\IhFhsZF.exe
  C:\Windows\System\IhFhsZF.exe
  2⤵
  PID:13012
- C:\Windows\System\aTQmtYw.exe
  C:\Windows\System\aTQmtYw.exe
  2⤵
  PID:6480
- C:\Windows\System\uOjQWth.exe
  C:\Windows\System\uOjQWth.exe
  2⤵
  PID:13288
- C:\Windows\System\vbsgskj.exe
  C:\Windows\System\vbsgskj.exe
  2⤵
  PID:6804
- C:\Windows\System\cHiLIMo.exe
  C:\Windows\System\cHiLIMo.exe
  2⤵
  PID:13204
- C:\Windows\System\gOFFRmx.exe
  C:\Windows\System\gOFFRmx.exe
  2⤵
  PID:6240
- C:\Windows\System\DqRPdEu.exe
  C:\Windows\System\DqRPdEu.exe
  2⤵
  PID:13160
- C:\Windows\System\BGNYANg.exe
  C:\Windows\System\BGNYANg.exe
  2⤵
  PID:6652
- C:\Windows\System\uMdBpRh.exe
  C:\Windows\System\uMdBpRh.exe
  2⤵
  PID:7680
- C:\Windows\System\oAuSIXl.exe
  C:\Windows\System\oAuSIXl.exe
  2⤵
  PID:8060
- C:\Windows\System\hRZJWXH.exe
  C:\Windows\System\hRZJWXH.exe
  2⤵
  PID:12692
- C:\Windows\System\ckMbLgj.exe
  C:\Windows\System\ckMbLgj.exe
  2⤵
  PID:6476
- C:\Windows\System\HFvPTET.exe
  C:\Windows\System\HFvPTET.exe
  2⤵
  PID:12808
- C:\Windows\System\KAewbHH.exe
  C:\Windows\System\KAewbHH.exe
  2⤵
  PID:7820
- C:\Windows\System\dapACgV.exe
  C:\Windows\System\dapACgV.exe
  2⤵
  PID:7676
- C:\Windows\System\inWVEnB.exe
  C:\Windows\System\inWVEnB.exe
  2⤵
  PID:13328
- C:\Windows\System\wjxplkd.exe
  C:\Windows\System\wjxplkd.exe
  2⤵
  PID:13356
- C:\Windows\System\IuTceXv.exe
  C:\Windows\System\IuTceXv.exe
  2⤵
  PID:13388
- C:\Windows\System\MIPcOxC.exe
  C:\Windows\System\MIPcOxC.exe
  2⤵
  PID:13420
- C:\Windows\System\WETBCPW.exe
  C:\Windows\System\WETBCPW.exe
  2⤵
  PID:13440
- C:\Windows\System\WIOhViW.exe
  C:\Windows\System\WIOhViW.exe
  2⤵
  PID:13468
- C:\Windows\System\mptXalz.exe
  C:\Windows\System\mptXalz.exe
  2⤵
  PID:13488
- C:\Windows\System\LydSsev.exe
  C:\Windows\System\LydSsev.exe
  2⤵
  PID:13512
- C:\Windows\System\kFdvdlS.exe
  C:\Windows\System\kFdvdlS.exe
  2⤵
  PID:13528
- C:\Windows\System\ymgibGR.exe
  C:\Windows\System\ymgibGR.exe
  2⤵
  PID:13552
- C:\Windows\System\GkdrlZI.exe
  C:\Windows\System\GkdrlZI.exe
  2⤵
  PID:13604
- C:\Windows\System\yGLDYdV.exe
  C:\Windows\System\yGLDYdV.exe
  2⤵
  PID:13648
- C:\Windows\System\hIYBriO.exe
  C:\Windows\System\hIYBriO.exe
  2⤵
  PID:13680
- C:\Windows\System\euKMICP.exe
  C:\Windows\System\euKMICP.exe
  2⤵
  PID:13700
- C:\Windows\System\INtfVeQ.exe
  C:\Windows\System\INtfVeQ.exe
  2⤵
  PID:13728
- C:\Windows\System\IJPcBzz.exe
  C:\Windows\System\IJPcBzz.exe
  2⤵
  PID:13752
- C:\Windows\System\OXAypoR.exe
  C:\Windows\System\OXAypoR.exe
  2⤵
  PID:13780
- C:\Windows\System\YFvqIdI.exe
  C:\Windows\System\YFvqIdI.exe
  2⤵
  PID:13796
- C:\Windows\System\zkVxVWL.exe
  C:\Windows\System\zkVxVWL.exe
  2⤵
  PID:13820
- C:\Windows\System\ckUeUwY.exe
  C:\Windows\System\ckUeUwY.exe
  2⤵
  PID:13856
- C:\Windows\System\vuvFnur.exe
  C:\Windows\System\vuvFnur.exe
  2⤵
  PID:13884
- C:\Windows\System\DlPBGVd.exe
  C:\Windows\System\DlPBGVd.exe
  2⤵
  PID:13908
- C:\Windows\System\gAAXCDT.exe
  C:\Windows\System\gAAXCDT.exe
  2⤵
  PID:13928
- C:\Windows\System\KoVtCOC.exe
  C:\Windows\System\KoVtCOC.exe
  2⤵
  PID:13948
- C:\Windows\System\cMhudIU.exe
  C:\Windows\System\cMhudIU.exe
  2⤵
  PID:13976
- C:\Windows\System\frdMrAj.exe
  C:\Windows\System\frdMrAj.exe
  2⤵
  PID:13996
- C:\Windows\System\XlqIaIQ.exe
  C:\Windows\System\XlqIaIQ.exe
  2⤵
  PID:14020
- C:\Windows\System\NeMQwmm.exe
  C:\Windows\System\NeMQwmm.exe
  2⤵
  PID:14080
- C:\Windows\System\sDHTmYP.exe
  C:\Windows\System\sDHTmYP.exe
  2⤵
  PID:14128
- C:\Windows\System\yWbeVrD.exe
  C:\Windows\System\yWbeVrD.exe
  2⤵
  PID:14188
- C:\Windows\System\VylxwAu.exe
  C:\Windows\System\VylxwAu.exe
  2⤵
  PID:14228
- C:\Windows\System\VhgzQEd.exe
  C:\Windows\System\VhgzQEd.exe
  2⤵
  PID:14248
- C:\Windows\System\sLoWyUm.exe
  C:\Windows\System\sLoWyUm.exe
  2⤵
  PID:14272
- C:\Windows\System\beHGikb.exe
  C:\Windows\System\beHGikb.exe
  2⤵
  PID:14308
- C:\Windows\System\TChiTmg.exe
  C:\Windows\System\TChiTmg.exe
  2⤵
  PID:4852
- C:\Windows\System\JcXyiQN.exe
  C:\Windows\System\JcXyiQN.exe
  2⤵
  PID:13384
- C:\Windows\System\oEqXted.exe
  C:\Windows\System\oEqXted.exe
  2⤵
  PID:13544
- C:\Windows\System\RMRmNuC.exe
  C:\Windows\System\RMRmNuC.exe
  2⤵
  PID:13504
- C:\Windows\System\XUeJjNi.exe
  C:\Windows\System\XUeJjNi.exe
  2⤵
  PID:13564
- C:\Windows\System\bSUNImj.exe
  C:\Windows\System\bSUNImj.exe
  2⤵
  PID:13668
- C:\Windows\System\dYzQWGA.exe
  C:\Windows\System\dYzQWGA.exe
  2⤵
  PID:13708
- C:\Windows\System\vrtwXoV.exe
  C:\Windows\System\vrtwXoV.exe
  2⤵
  PID:13744
- C:\Windows\System\ewrBhfW.exe
  C:\Windows\System\ewrBhfW.exe
  2⤵
  PID:13832
- C:\Windows\System\eUOVgPx.exe
  C:\Windows\System\eUOVgPx.exe
  2⤵
  PID:13896
- C:\Windows\System\TJwUlaD.exe
  C:\Windows\System\TJwUlaD.exe
  2⤵
  PID:13876
- C:\Windows\System\dDjKvZg.exe
  C:\Windows\System\dDjKvZg.exe
  2⤵
  PID:14016
- C:\Windows\System\oBBtazt.exe
  C:\Windows\System\oBBtazt.exe
  2⤵
  PID:5664
- C:\Windows\System\XhIhEeJ.exe
  C:\Windows\System\XhIhEeJ.exe
  2⤵
  PID:5920
- C:\Windows\System\hUTrBsS.exe
  C:\Windows\System\hUTrBsS.exe
  2⤵
  PID:14076
- C:\Windows\System\NmgbGpt.exe
  C:\Windows\System\NmgbGpt.exe
  2⤵
  PID:14200
- C:\Windows\System\YPPGqhC.exe
  C:\Windows\System\YPPGqhC.exe
  2⤵
  PID:5192
- C:\Windows\System\BcVuydU.exe
  C:\Windows\System\BcVuydU.exe
  2⤵
  PID:5412
- C:\Windows\System\XSXTaHn.exe
  C:\Windows\System\XSXTaHn.exe
  2⤵
  PID:5632
- C:\Windows\System\IScnDba.exe
  C:\Windows\System\IScnDba.exe
  2⤵
  PID:13432
- C:\Windows\System\pjdHZQz.exe
  C:\Windows\System\pjdHZQz.exe
  2⤵
  PID:6400
- C:\Windows\System\DqgEbGK.exe
  C:\Windows\System\DqgEbGK.exe
  2⤵
  PID:13812
- C:\Windows\System\joFvrIV.exe
  C:\Windows\System\joFvrIV.exe
  2⤵
  PID:5968
- C:\Windows\System\vtqSmdL.exe
  C:\Windows\System\vtqSmdL.exe
  2⤵
  PID:13844
- C:\Windows\System\RPCcEtY.exe
  C:\Windows\System\RPCcEtY.exe
  2⤵
  PID:13972
- C:\Windows\System\SSMnvoo.exe
  C:\Windows\System\SSMnvoo.exe
  2⤵
  PID:14124
- C:\Windows\System\BYoNRBN.exe
  C:\Windows\System\BYoNRBN.exe
  2⤵
  PID:14140
- C:\Windows\System\zBZDkmZ.exe
  C:\Windows\System\zBZDkmZ.exe
  2⤵
  PID:8752
- C:\Windows\System\cCeyvDI.exe
  C:\Windows\System\cCeyvDI.exe
  2⤵
  PID:14268
- C:\Windows\System\ZgMgWsW.exe
  C:\Windows\System\ZgMgWsW.exe
  2⤵
  PID:8144
- C:\Windows\System\PdAUVTR.exe
  C:\Windows\System\PdAUVTR.exe
  2⤵
  PID:14332
- C:\Windows\System\NExWrRW.exe
  C:\Windows\System\NExWrRW.exe
  2⤵
  PID:13640
- C:\Windows\System\dPiVHEq.exe
  C:\Windows\System\dPiVHEq.exe
  2⤵
  PID:6180
- C:\Windows\System\GpKOPLD.exe
  C:\Windows\System\GpKOPLD.exe
  2⤵
  PID:6244
- C:\Windows\System\DiQfSmE.exe
  C:\Windows\System\DiQfSmE.exe
  2⤵
  PID:6300
- C:\Windows\System\bNZPZqy.exe
  C:\Windows\System\bNZPZqy.exe
  2⤵
  PID:5796
- C:\Windows\System\DSHxbeS.exe
  C:\Windows\System\DSHxbeS.exe
  2⤵
  PID:7436
- C:\Windows\System\XrVXyjB.exe
  C:\Windows\System\XrVXyjB.exe
  2⤵
  PID:6008
- C:\Windows\System\SzjhxuZ.exe
  C:\Windows\System\SzjhxuZ.exe
  2⤵
  PID:6332
- C:\Windows\System\XVmhiDE.exe
  C:\Windows\System\XVmhiDE.exe
  2⤵
  PID:5880
- C:\Windows\System\qEcCsqE.exe
  C:\Windows\System\qEcCsqE.exe
  2⤵
  PID:9084
- C:\Windows\System\MHBZTZB.exe
  C:\Windows\System\MHBZTZB.exe
  2⤵
  PID:5896
- C:\Windows\System\kfnHvdk.exe
  C:\Windows\System\kfnHvdk.exe
  2⤵
  PID:6396
- C:\Windows\System\GzxAVze.exe
  C:\Windows\System\GzxAVze.exe
  2⤵
  PID:9256
- C:\Windows\System\NCOsVbC.exe
  C:\Windows\System\NCOsVbC.exe
  2⤵
  PID:8892
- C:\Windows\System\sUoiGoS.exe
  C:\Windows\System\sUoiGoS.exe
  2⤵
  PID:9252
- C:\Windows\System\tSxCAQH.exe
  C:\Windows\System\tSxCAQH.exe
  2⤵
  PID:14348
- C:\Windows\System\TMyJdbl.exe
  C:\Windows\System\TMyJdbl.exe
  2⤵
  PID:14384
- C:\Windows\System\xsDugcG.exe
  C:\Windows\System\xsDugcG.exe
  2⤵
  PID:14408
- C:\Windows\System\QWDJneZ.exe
  C:\Windows\System\QWDJneZ.exe
  2⤵
  PID:14436
- C:\Windows\System\XYPDGwi.exe
  C:\Windows\System\XYPDGwi.exe
  2⤵
  PID:14468
- C:\Windows\System\LejLifF.exe
  C:\Windows\System\LejLifF.exe
  2⤵
  PID:14492
- C:\Windows\System\jnpvegy.exe
  C:\Windows\System\jnpvegy.exe
  2⤵
  PID:14516
- C:\Windows\System\jEDajRj.exe
  C:\Windows\System\jEDajRj.exe
  2⤵
  PID:14548
- C:\Windows\System\AOSuAhr.exe
  C:\Windows\System\AOSuAhr.exe
  2⤵
  PID:14580
- C:\Windows\System\oGZQJMF.exe
  C:\Windows\System\oGZQJMF.exe
  2⤵
  PID:14608
- C:\Windows\System\UTildux.exe
  C:\Windows\System\UTildux.exe
  2⤵
  PID:14636
- C:\Windows\System\rSeNTPT.exe
  C:\Windows\System\rSeNTPT.exe
  2⤵
  PID:14672
- C:\Windows\System\CXPieCC.exe
  C:\Windows\System\CXPieCC.exe
  2⤵
  PID:14700
- C:\Windows\System\suRuBtt.exe
  C:\Windows\System\suRuBtt.exe
  2⤵
  PID:14716
- C:\Windows\System\DCxzeYg.exe
  C:\Windows\System\DCxzeYg.exe
  2⤵
  PID:14752
- C:\Windows\System\kUJVNUR.exe
  C:\Windows\System\kUJVNUR.exe
  2⤵
  PID:14780
- C:\Windows\System\aoOxBty.exe
  C:\Windows\System\aoOxBty.exe
  2⤵
  PID:14800
- C:\Windows\System\mMjBcUK.exe
  C:\Windows\System\mMjBcUK.exe
  2⤵
  PID:14832
- C:\Windows\System\JvEZuIp.exe
  C:\Windows\System\JvEZuIp.exe
  2⤵
  PID:14868
- C:\Windows\System\xPAGqQI.exe
  C:\Windows\System\xPAGqQI.exe
  2⤵
  PID:14884
- C:\Windows\System\UbQLNof.exe
  C:\Windows\System\UbQLNof.exe
  2⤵
  PID:14900
- C:\Windows\System\hTWqixw.exe
  C:\Windows\System\hTWqixw.exe
  2⤵
  PID:14936
- C:\Windows\System\WWhILTD.exe
  C:\Windows\System\WWhILTD.exe
  2⤵
  PID:14968
- C:\Windows\System\kzfzpxm.exe
  C:\Windows\System\kzfzpxm.exe
  2⤵
  PID:14996
- C:\Windows\System\dKyXdtR.exe
  C:\Windows\System\dKyXdtR.exe
  2⤵
  PID:15024
- C:\Windows\System\QFioYew.exe
  C:\Windows\System\QFioYew.exe
  2⤵
  PID:15072
- C:\Windows\System\hWcywGR.exe
  C:\Windows\System\hWcywGR.exe
  2⤵
  PID:15112
- C:\Windows\System\YcXjpbc.exe
  C:\Windows\System\YcXjpbc.exe
  2⤵
  PID:15140
- C:\Windows\System\vhbaEah.exe
  C:\Windows\System\vhbaEah.exe
  2⤵
  PID:15168
- C:\Windows\System\mQmHiss.exe
  C:\Windows\System\mQmHiss.exe
  2⤵
  PID:15188
- C:\Windows\System\VcZVWsv.exe
  C:\Windows\System\VcZVWsv.exe
  2⤵
  PID:15216
- C:\Windows\System\XaPlazD.exe
  C:\Windows\System\XaPlazD.exe
  2⤵
  PID:15248
- C:\Windows\System\gqvytEd.exe
  C:\Windows\System\gqvytEd.exe
  2⤵
  PID:15276
- C:\Windows\System\SWnoGZH.exe
  C:\Windows\System\SWnoGZH.exe
  2⤵
  PID:15300
- C:\Windows\System\HTBfHQt.exe
  C:\Windows\System\HTBfHQt.exe
  2⤵
  PID:15324
- C:\Windows\System\IvNzJFm.exe
  C:\Windows\System\IvNzJFm.exe
  2⤵
  PID:15352
- C:\Windows\System\uWRwygp.exe
  C:\Windows\System\uWRwygp.exe
  2⤵
  PID:5964
- C:\Windows\System\LtJMPwJ.exe
  C:\Windows\System\LtJMPwJ.exe
  2⤵
  PID:14404
- C:\Windows\System\avbLgzs.exe
  C:\Windows\System\avbLgzs.exe
  2⤵
  PID:14488
- C:\Windows\System\KOKhGql.exe
  C:\Windows\System\KOKhGql.exe
  2⤵
  PID:14564
- C:\Windows\System\lgLgIDZ.exe
  C:\Windows\System\lgLgIDZ.exe
  2⤵
  PID:6564
- C:\Windows\System\xbFmYxp.exe
  C:\Windows\System\xbFmYxp.exe
  2⤵
  PID:14664
- C:\Windows\System\VXEPTxZ.exe
  C:\Windows\System\VXEPTxZ.exe
  2⤵
  PID:8844
- C:\Windows\System\MeiInlw.exe
  C:\Windows\System\MeiInlw.exe
  2⤵
  PID:14732
- C:\Windows\System\kJktAEx.exe
  C:\Windows\System\kJktAEx.exe
  2⤵
  PID:14816
- C:\Windows\System\WxSTGdY.exe
  C:\Windows\System\WxSTGdY.exe
  2⤵
  PID:14864
- C:\Windows\System\WmtnFDN.exe
  C:\Windows\System\WmtnFDN.exe
  2⤵
  PID:7004
- C:\Windows\System\TlKYfft.exe
  C:\Windows\System\TlKYfft.exe
  2⤵
  PID:14912
- C:\Windows\System\aSdaJwM.exe
  C:\Windows\System\aSdaJwM.exe
  2⤵
  PID:14964
- C:\Windows\System\DrOjULv.exe
  C:\Windows\System\DrOjULv.exe
  2⤵
  PID:6456
- C:\Windows\System\UMdYQaQ.exe
  C:\Windows\System\UMdYQaQ.exe
  2⤵
  PID:6728
- C:\Windows\System\igYjetH.exe
  C:\Windows\System\igYjetH.exe
  2⤵
  PID:15068
- C:\Windows\System\mcIymAY.exe
  C:\Windows\System\mcIymAY.exe
  2⤵
  PID:6928
- C:\Windows\System\nSQXibE.exe
  C:\Windows\System\nSQXibE.exe
  2⤵
  PID:6892
- C:\Windows\System\YJHtrWt.exe
  C:\Windows\System\YJHtrWt.exe
  2⤵
  PID:15132
- C:\Windows\System\GQQeNvJ.exe
  C:\Windows\System\GQQeNvJ.exe
  2⤵
  PID:7160
- C:\Windows\System\JynKfHo.exe
  C:\Windows\System\JynKfHo.exe
  2⤵
  PID:15184
- C:\Windows\System\IOJEBMT.exe
  C:\Windows\System\IOJEBMT.exe
  2⤵
  PID:15272
- C:\Windows\System\RTDNPlR.exe
  C:\Windows\System\RTDNPlR.exe
  2⤵
  PID:7132
- C:\Windows\System\HblLJtE.exe
  C:\Windows\System\HblLJtE.exe
  2⤵
  PID:15344
- C:\Windows\System\pbeqgNH.exe
  C:\Windows\System\pbeqgNH.exe
  2⤵
  PID:8968
- C:\Windows\System\IdfqKKj.exe
  C:\Windows\System\IdfqKKj.exe
  2⤵
  PID:14380
- C:\Windows\System\nQwkbUY.exe
  C:\Windows\System\nQwkbUY.exe
  2⤵
  PID:14476
- C:\Windows\System\DLQpgPP.exe
  C:\Windows\System\DLQpgPP.exe
  2⤵
  PID:7316
- C:\Windows\System\xXkpNwS.exe
  C:\Windows\System\xXkpNwS.exe
  2⤵
  PID:6576
- C:\Windows\System\DMTPxxJ.exe
  C:\Windows\System\DMTPxxJ.exe
  2⤵
  PID:14760
- C:\Windows\System\Cwxgwsn.exe
  C:\Windows\System\Cwxgwsn.exe
  2⤵
  PID:7472
- C:\Windows\System\aTXgZAF.exe
  C:\Windows\System\aTXgZAF.exe
  2⤵
  PID:7440
- C:\Windows\System\wlkOmIu.exe
  C:\Windows\System\wlkOmIu.exe
  2⤵
  PID:7572
- C:\Windows\System\RLSTWbX.exe
  C:\Windows\System\RLSTWbX.exe
  2⤵
  PID:8172
- C:\Windows\System\GkUdIlV.exe
  C:\Windows\System\GkUdIlV.exe
  2⤵
  PID:8024
- C:\Windows\System\nYJswGi.exe
  C:\Windows\System\nYJswGi.exe
  2⤵
  PID:7764
- C:\Windows\System\NjZdpKF.exe
  C:\Windows\System\NjZdpKF.exe
  2⤵
  PID:7860
- C:\Windows\System\fcGfpgL.exe
  C:\Windows\System\fcGfpgL.exe
  2⤵
  PID:7888
- C:\Windows\System\ronqJFh.exe
  C:\Windows\System\ronqJFh.exe
  2⤵
  PID:7952
- C:\Windows\System\RECagwr.exe
  C:\Windows\System\RECagwr.exe
  2⤵
  PID:8088
- C:\Windows\System\LQbGPee.exe
  C:\Windows\System\LQbGPee.exe
  2⤵
  PID:7344
- C:\Windows\System\wGeCByO.exe
  C:\Windows\System\wGeCByO.exe
  2⤵
  PID:7800
- C:\Windows\System\eJCTxMd.exe
  C:\Windows\System\eJCTxMd.exe
  2⤵
  PID:14776
- C:\Windows\System\GbpdtdG.exe
  C:\Windows\System\GbpdtdG.exe
  2⤵
  PID:7064
- C:\Windows\System\VHNCutt.exe
  C:\Windows\System\VHNCutt.exe
  2⤵
  PID:2760
- C:\Windows\System\uUlrUEx.exe
  C:\Windows\System\uUlrUEx.exe
  2⤵
  PID:6620
- C:\Windows\System\GsfgCgL.exe
  C:\Windows\System\GsfgCgL.exe
  2⤵
  PID:7040
- C:\Windows\System\zTukRgO.exe
  C:\Windows\System\zTukRgO.exe
  2⤵
  PID:15164
- C:\Windows\System\CDSduFa.exe
  C:\Windows\System\CDSduFa.exe
  2⤵
  PID:3120
- C:\Windows\System\oKjwjOl.exe
  C:\Windows\System\oKjwjOl.exe
  2⤵
  PID:1852
- C:\Windows\System\inhyGuc.exe
  C:\Windows\System\inhyGuc.exe
  2⤵
  PID:14644
- C:\Windows\System\gsrKyhm.exe
  C:\Windows\System\gsrKyhm.exe
  2⤵
  PID:7512
- C:\Windows\System\WOmGuca.exe
  C:\Windows\System\WOmGuca.exe
  2⤵
  PID:7508
- C:\Windows\System\pFYaAvX.exe
  C:\Windows\System\pFYaAvX.exe
  2⤵
  PID:8152
- C:\Windows\System\XoEEXAA.exe
  C:\Windows\System\XoEEXAA.exe
  2⤵
  PID:7768
- C:\Windows\System\AzRIDPP.exe
  C:\Windows\System\AzRIDPP.exe
  2⤵
  PID:7340
- C:\Windows\System\iFlSjrN.exe
  C:\Windows\System\iFlSjrN.exe
  2⤵
  PID:7556
- C:\Windows\System\CystKIS.exe
  C:\Windows\System\CystKIS.exe
  2⤵
  PID:14980
- C:\Windows\System\zpDwmZt.exe
  C:\Windows\System\zpDwmZt.exe
  2⤵
  PID:7116
- C:\Windows\System\JzZnglf.exe
  C:\Windows\System\JzZnglf.exe
  2⤵
  PID:8076
- C:\Windows\System\MOZpbkb.exe
  C:\Windows\System\MOZpbkb.exe
  2⤵
  PID:6268
- C:\Windows\System\ZbFIJhe.exe
  C:\Windows\System\ZbFIJhe.exe
  2⤵
  PID:15336
- C:\Windows\System\eHWWJdP.exe
  C:\Windows\System\eHWWJdP.exe
  2⤵
  PID:7372
- C:\Windows\System\rtSMutw.exe
  C:\Windows\System\rtSMutw.exe
  2⤵
  PID:4668
- C:\Windows\System\HmTuWEl.exe
  C:\Windows\System\HmTuWEl.exe
  2⤵
  PID:6952
- C:\Windows\System\pYaevDW.exe
  C:\Windows\System\pYaevDW.exe
  2⤵
  PID:7624
- C:\Windows\System\sFDXGWc.exe
  C:\Windows\System\sFDXGWc.exe
  2⤵
  PID:7848
- C:\Windows\System\HqQfRgZ.exe
  C:\Windows\System\HqQfRgZ.exe
  2⤵
  PID:7792
- C:\Windows\System\QGHogGW.exe
  C:\Windows\System\QGHogGW.exe
  2⤵
  PID:6980
- C:\Windows\System\oIJtKZi.exe
  C:\Windows\System\oIJtKZi.exe
  2⤵
  PID:8240
- C:\Windows\System\sfzDwkP.exe
  C:\Windows\System\sfzDwkP.exe
  2⤵
  PID:6776
- C:\Windows\System\qTwkOGL.exe
  C:\Windows\System\qTwkOGL.exe
  2⤵
  PID:8316
- C:\Windows\System\LlgWnZC.exe
  C:\Windows\System\LlgWnZC.exe
  2⤵
  PID:4868
- C:\Windows\System\vyTsYTS.exe
  C:\Windows\System\vyTsYTS.exe
  2⤵
  PID:5156
- C:\Windows\System\pccDCXS.exe
  C:\Windows\System\pccDCXS.exe
  2⤵
  PID:7656
- C:\Windows\System\FuViMnF.exe
  C:\Windows\System\FuViMnF.exe
  2⤵
  PID:8552
- C:\Windows\System\ZkbTbpj.exe
  C:\Windows\System\ZkbTbpj.exe
  2⤵
  PID:12080
- C:\Windows\System\BsBintL.exe
  C:\Windows\System\BsBintL.exe
  2⤵
  PID:15160
- C:\Windows\System\aBgwyjC.exe
  C:\Windows\System\aBgwyjC.exe
  2⤵
  PID:8588
- C:\Windows\System\tSivcrP.exe
  C:\Windows\System\tSivcrP.exe
  2⤵
  PID:8560
- C:\Windows\System\oWsuMcO.exe
  C:\Windows\System\oWsuMcO.exe
  2⤵
  PID:7200
- C:\Windows\System\lvnzorr.exe
  C:\Windows\System\lvnzorr.exe
  2⤵
  PID:8728
- C:\Windows\System\uHctlnA.exe
  C:\Windows\System\uHctlnA.exe
  2⤵
  PID:8464
- C:\Windows\System\vpHpVlm.exe
  C:\Windows\System\vpHpVlm.exe
  2⤵
  PID:8604
- C:\Windows\System\InIWUwy.exe
  C:\Windows\System\InIWUwy.exe
  2⤵
  PID:14432
- C:\Windows\System\ddiaKay.exe
  C:\Windows\System\ddiaKay.exe
  2⤵
  PID:8872
- C:\Windows\System\GzFuKFo.exe
  C:\Windows\System\GzFuKFo.exe
  2⤵
  PID:9036
- C:\Windows\System\mlqshBu.exe
  C:\Windows\System\mlqshBu.exe
  2⤵
  PID:8988
- C:\Windows\System\lWxmCII.exe
  C:\Windows\System\lWxmCII.exe
  2⤵
  PID:8272
- C:\Windows\System\tChclMC.exe
  C:\Windows\System\tChclMC.exe
  2⤵
  PID:9104
- C:\Windows\System\RQcLcRO.exe
  C:\Windows\System\RQcLcRO.exe
  2⤵
  PID:9172
- C:\Windows\System\JvhtOkm.exe
  C:\Windows\System\JvhtOkm.exe
  2⤵
  PID:9196
- C:\Windows\System\detHFoc.exe
  C:\Windows\System\detHFoc.exe
  2⤵
  PID:9088
- C:\Windows\System\AfpxPnN.exe
  C:\Windows\System\AfpxPnN.exe
  2⤵
  PID:8360
- C:\Windows\System\CYGnQTB.exe
  C:\Windows\System\CYGnQTB.exe
  2⤵
  PID:8396
- C:\Windows\System\sFlSCOl.exe
  C:\Windows\System\sFlSCOl.exe
  2⤵
  PID:8656
- C:\Windows\System\lzPnODg.exe
  C:\Windows\System\lzPnODg.exe
  2⤵
  PID:8944
- C:\Windows\System\SkEUelD.exe
  C:\Windows\System\SkEUelD.exe
  2⤵
  PID:8624
- C:\Windows\System\OnpLtGT.exe
  C:\Windows\System\OnpLtGT.exe
  2⤵
  PID:9016
- C:\Windows\System\uQzLilX.exe
  C:\Windows\System\uQzLilX.exe
  2⤵
  PID:9168
- C:\Windows\System\TitrwjH.exe
  C:\Windows\System\TitrwjH.exe
  2⤵
  PID:2336
- C:\Windows\System\RrCKHhs.exe
  C:\Windows\System\RrCKHhs.exe
  2⤵
  PID:2984
- C:\Windows\System\RCDtOGm.exe
  C:\Windows\System\RCDtOGm.exe
  2⤵
  PID:2396
- C:\Windows\System\PtUFgha.exe
  C:\Windows\System\PtUFgha.exe
  2⤵
  PID:8864
- C:\Windows\System\XNmXFNo.exe
  C:\Windows\System\XNmXFNo.exe
  2⤵
  PID:8264
- C:\Windows\System\vnfINBY.exe
  C:\Windows\System\vnfINBY.exe
  2⤵
  PID:8984
- C:\Windows\System\RKIHYce.exe
  C:\Windows\System\RKIHYce.exe
  2⤵
  PID:8920
- C:\Windows\System\nnNFrlR.exe
  C:\Windows\System\nnNFrlR.exe
  2⤵
  PID:8952
- C:\Windows\System\JhOXJmU.exe
  C:\Windows\System\JhOXJmU.exe
  2⤵
  PID:15396
- C:\Windows\System\ruZIjAD.exe
  C:\Windows\System\ruZIjAD.exe
  2⤵
  PID:15428
- C:\Windows\System\xBdQKyS.exe
  C:\Windows\System\xBdQKyS.exe
  2⤵
  PID:15456
- C:\Windows\System\BFpWKkr.exe
  C:\Windows\System\BFpWKkr.exe
  2⤵
  PID:15484
- C:\Windows\System\MTcDswW.exe
  C:\Windows\System\MTcDswW.exe
  2⤵
  PID:15504
- C:\Windows\System\KSwzloD.exe
  C:\Windows\System\KSwzloD.exe
  2⤵
  PID:15536
- C:\Windows\System\mZvLrpw.exe
  C:\Windows\System\mZvLrpw.exe
  2⤵
  PID:15572
- C:\Windows\System\GZtSoMs.exe
  C:\Windows\System\GZtSoMs.exe
  2⤵
  PID:15624
- C:\Windows\System\wtUoyHC.exe
  C:\Windows\System\wtUoyHC.exe
  2⤵
  PID:15640
- C:\Windows\System\ELgfyEN.exe
  C:\Windows\System\ELgfyEN.exe
  2⤵
  PID:15668
- C:\Windows\System\rNlDjQi.exe
  C:\Windows\System\rNlDjQi.exe
  2⤵
  PID:15696
- C:\Windows\System\UsSBhTx.exe
  C:\Windows\System\UsSBhTx.exe
  2⤵
  PID:15720
- C:\Windows\System\jAsKHTb.exe
  C:\Windows\System\jAsKHTb.exe
  2⤵
  PID:15740
- C:\Windows\System\krygbGa.exe
  C:\Windows\System\krygbGa.exe
  2⤵
  PID:15768
- C:\Windows\System\KxOfwiD.exe
  C:\Windows\System\KxOfwiD.exe
  2⤵
  PID:15788
- C:\Windows\System\WhbObFc.exe
  C:\Windows\System\WhbObFc.exe
  2⤵
  PID:15824
- C:\Windows\System\UYIWJEA.exe
  C:\Windows\System\UYIWJEA.exe
  2⤵
  PID:15864
- C:\Windows\System\UfYfaBI.exe
  C:\Windows\System\UfYfaBI.exe
  2⤵
  PID:15888
- C:\Windows\System\PHwmgty.exe
  C:\Windows\System\PHwmgty.exe
  2⤵
  PID:15928
- C:\Windows\System\nBhvmhm.exe
  C:\Windows\System\nBhvmhm.exe
  2⤵
  PID:15960
- C:\Windows\System\TuIpaBK.exe
  C:\Windows\System\TuIpaBK.exe
  2⤵
  PID:15984
- C:\Windows\System\xraNIlI.exe
  C:\Windows\System\xraNIlI.exe
  2⤵
  PID:16012
- C:\Windows\System\qhhfmhJ.exe
  C:\Windows\System\qhhfmhJ.exe
  2⤵
  PID:16032
- C:\Windows\System\siajddC.exe
  C:\Windows\System\siajddC.exe
  2⤵
  PID:16056
- C:\Windows\System\AWkYnVS.exe
  C:\Windows\System\AWkYnVS.exe
  2⤵
  PID:16104
- C:\Windows\System\TTcTqmU.exe
  C:\Windows\System\TTcTqmU.exe
  2⤵
  PID:16128
- C:\Windows\System\BCFdFMf.exe
  C:\Windows\System\BCFdFMf.exe
  2⤵
  PID:16144
- C:\Windows\System\xKJLfnH.exe
  C:\Windows\System\xKJLfnH.exe
  2⤵
  PID:16164
- C:\Windows\System\cqfDjlh.exe
  C:\Windows\System\cqfDjlh.exe
  2⤵
  PID:16180
- C:\Windows\System\bCIjHLk.exe
  C:\Windows\System\bCIjHLk.exe
  2⤵
  PID:16196
- C:\Windows\System\BsaGaHv.exe
  C:\Windows\System\BsaGaHv.exe
  2⤵
  PID:16212
- C:\Windows\System\sobhOGj.exe
  C:\Windows\System\sobhOGj.exe
  2⤵
  PID:16232
- C:\Windows\System\ERTnUCm.exe
  C:\Windows\System\ERTnUCm.exe
  2⤵
  PID:16260
- C:\Windows\System\wHetOMf.exe
  C:\Windows\System\wHetOMf.exe
  2⤵
  PID:16324
- C:\Windows\System\HaiNJKn.exe
  C:\Windows\System\HaiNJKn.exe
  2⤵
  PID:16356
- C:\Windows\System\idzyhZX.exe
  C:\Windows\System\idzyhZX.exe
  2⤵
  PID:3740
- C:\Windows\System\JAbEaaq.exe
  C:\Windows\System\JAbEaaq.exe
  2⤵
  PID:12164
- C:\Windows\System\WlBsydM.exe
  C:\Windows\System\WlBsydM.exe
  2⤵
  PID:15392
- C:\Windows\System\RWfUyMO.exe
  C:\Windows\System\RWfUyMO.exe
  2⤵
  PID:15548
- C:\Windows\System\WbmilEx.exe
  C:\Windows\System\WbmilEx.exe
  2⤵
  PID:9516
- C:\Windows\System\UXGqvFk.exe
  C:\Windows\System\UXGqvFk.exe
  2⤵
  PID:9616
- C:\Windows\System\gLVHlDs.exe
  C:\Windows\System\gLVHlDs.exe
  2⤵
  PID:9692
- C:\Windows\System\eHXESYs.exe
  C:\Windows\System\eHXESYs.exe
  2⤵
  PID:4896
- C:\Windows\System\fkdYoRR.exe
  C:\Windows\System\fkdYoRR.exe
  2⤵
  PID:9916
- C:\Windows\System\IuvrgFu.exe
  C:\Windows\System\IuvrgFu.exe
  2⤵
  PID:9992
- C:\Windows\System\pcfownW.exe
  C:\Windows\System\pcfownW.exe
  2⤵
  PID:10112
- C:\Windows\System\YPKhTHb.exe
  C:\Windows\System\YPKhTHb.exe
  2⤵
  PID:10188
- C:\Windows\System\ZmcKpQu.exe
  C:\Windows\System\ZmcKpQu.exe
  2⤵
  PID:15708
- C:\Windows\System\KznAXsh.exe
  C:\Windows\System\KznAXsh.exe
  2⤵
  PID:9500
- C:\Windows\System\dgFJwOl.exe
  C:\Windows\System\dgFJwOl.exe
  2⤵
  PID:15752
- C:\Windows\System\xAHzRXt.exe
  C:\Windows\System\xAHzRXt.exe
  2⤵
  PID:15764
- C:\Windows\System\GCBzKxo.exe
  C:\Windows\System\GCBzKxo.exe
  2⤵
  PID:9532
- C:\Windows\System\ctHkvnQ.exe
  C:\Windows\System\ctHkvnQ.exe
  2⤵
  PID:15876
- C:\Windows\System\Serxsaw.exe
  C:\Windows\System\Serxsaw.exe
  2⤵
  PID:15896
- C:\Windows\System\DYfvEjp.exe
  C:\Windows\System\DYfvEjp.exe
  2⤵
  PID:10008
- C:\Windows\System\EwJToLR.exe
  C:\Windows\System\EwJToLR.exe
  2⤵
  PID:15924
- C:\Windows\System\BzLYiAV.exe
  C:\Windows\System\BzLYiAV.exe
  2⤵
  PID:16004
- C:\Windows\System\NJfghdt.exe
  C:\Windows\System\NJfghdt.exe
  2⤵
  PID:9260
- C:\Windows\System\FMTtbyV.exe
  C:\Windows\System\FMTtbyV.exe
  2⤵
  PID:16048
- C:\Windows\System\nTDcSqB.exe
  C:\Windows\System\nTDcSqB.exe
  2⤵
  PID:16052
- C:\Windows\System\htSeLZw.exe
  C:\Windows\System\htSeLZw.exe
  2⤵
  PID:16068
- C:\Windows\System\YkfPGOo.exe
  C:\Windows\System\YkfPGOo.exe
  2⤵
  PID:16100
- C:\Windows\System\BRVWNge.exe
  C:\Windows\System\BRVWNge.exe
  2⤵
  PID:15948
- C:\Windows\System\hmRyxPy.exe
  C:\Windows\System\hmRyxPy.exe
  2⤵
  PID:5092
- C:\Windows\System\QgNfPre.exe
  C:\Windows\System\QgNfPre.exe
  2⤵
  PID:10364
- C:\Windows\System\hbvhcwV.exe
  C:\Windows\System\hbvhcwV.exe
  2⤵
  PID:9512
- C:\Windows\System\TeHqPeY.exe
  C:\Windows\System\TeHqPeY.exe
  2⤵
  PID:10140
- C:\Windows\System\AdDfmZp.exe
  C:\Windows\System\AdDfmZp.exe
  2⤵
  PID:10384
- C:\Windows\System\XfFPmxQ.exe
  C:\Windows\System\XfFPmxQ.exe
  2⤵
  PID:9300
- C:\Windows\System\KBgXTdX.exe
  C:\Windows\System\KBgXTdX.exe
  2⤵
  PID:10372
- C:\Windows\System\PSfwoBg.exe
  C:\Windows\System\PSfwoBg.exe
  2⤵
  PID:10520
- C:\Windows\System\LyEsbhA.exe
  C:\Windows\System\LyEsbhA.exe
  2⤵
  PID:16320
- C:\Windows\System\eiHBhTp.exe
  C:\Windows\System\eiHBhTp.exe
  2⤵
  PID:9240
- C:\Windows\System\eolUbWb.exe
  C:\Windows\System\eolUbWb.exe
  2⤵
  PID:10624
- C:\Windows\System\DDMbQKd.exe
  C:\Windows\System\DDMbQKd.exe
  2⤵
  PID:15448
- C:\Windows\System\QDLoNnQ.exe
  C:\Windows\System\QDLoNnQ.exe
  2⤵
  PID:9468
- C:\Windows\System\LQWwMOO.exe
  C:\Windows\System\LQWwMOO.exe
  2⤵
  PID:10752
- C:\Windows\System\BpnIgPv.exe
  C:\Windows\System\BpnIgPv.exe
  2⤵
  PID:9580
- C:\Windows\System\RSmEZYI.exe
  C:\Windows\System\RSmEZYI.exe
  2⤵
  PID:10848
- C:\Windows\System\SyplqQP.exe
  C:\Windows\System\SyplqQP.exe
  2⤵
  PID:11048
- C:\Windows\System\hYZLscS.exe
  C:\Windows\System\hYZLscS.exe
  2⤵
  PID:10996
- C:\Windows\System\vNNZzRJ.exe
  C:\Windows\System\vNNZzRJ.exe
  2⤵
  PID:11128
- C:\Windows\System\LnJGbyC.exe
  C:\Windows\System\LnJGbyC.exe
  2⤵
  PID:15652
- C:\Windows\System\wTuipSf.exe
  C:\Windows\System\wTuipSf.exe
  2⤵
  PID:11164
- C:\Windows\System\RSetIBI.exe
  C:\Windows\System\RSetIBI.exe
  2⤵
  PID:11228
- C:\Windows\System\AjqpqMs.exe
  C:\Windows\System\AjqpqMs.exe
  2⤵
  PID:10424
- C:\Windows\System\FbodRsh.exe
  C:\Windows\System\FbodRsh.exe
  2⤵
  PID:9536
- C:\Windows\System\mHXHOfF.exe
  C:\Windows\System\mHXHOfF.exe
  2⤵
  PID:9644
- C:\Windows\System\xMfntIR.exe
  C:\Windows\System\xMfntIR.exe
  2⤵
  PID:9652
- C:\Windows\System\TzXAsWp.exe
  C:\Windows\System\TzXAsWp.exe
  2⤵
  PID:10936
- C:\Windows\System\diWTanU.exe
  C:\Windows\System\diWTanU.exe
  2⤵
  PID:9988
- C:\Windows\System\pYDNrIe.exe
  C:\Windows\System\pYDNrIe.exe
  2⤵
  PID:11132
- C:\Windows\System\jXySsSe.exe
  C:\Windows\System\jXySsSe.exe
  2⤵
  PID:10872
- C:\Windows\System\dTESrZV.exe
  C:\Windows\System\dTESrZV.exe
  2⤵
  PID:9396
- C:\Windows\System\WOZtkYP.exe
  C:\Windows\System\WOZtkYP.exe
  2⤵
  PID:16008
- C:\Windows\System\qysZRXe.exe
  C:\Windows\System\qysZRXe.exe
  2⤵
  PID:10584
- C:\Windows\System\dfMSfHY.exe
  C:\Windows\System\dfMSfHY.exe
  2⤵
  PID:16064
- C:\Windows\System\AtALWWP.exe
  C:\Windows\System\AtALWWP.exe
  2⤵
  PID:5380
- C:\Windows\System\CbIjNjt.exe
  C:\Windows\System\CbIjNjt.exe
  2⤵
  PID:16124
- C:\Windows\System\PyplIgC.exe
  C:\Windows\System\PyplIgC.exe
  2⤵
  PID:10780
- C:\Windows\System\guyScqn.exe
  C:\Windows\System\guyScqn.exe
  2⤵
  PID:10576
- C:\Windows\System\aWHvNJC.exe
  C:\Windows\System\aWHvNJC.exe
  2⤵
  PID:9416
- C:\Windows\System\ognmxug.exe
  C:\Windows\System\ognmxug.exe
  2⤵
  PID:11060
- C:\Windows\System\RsswSKx.exe
  C:\Windows\System\RsswSKx.exe
  2⤵
  PID:11364
- C:\Windows\System\lBnUtnW.exe
  C:\Windows\System\lBnUtnW.exe
  2⤵
  PID:10468
- C:\Windows\System\HaFjMdK.exe
  C:\Windows\System\HaFjMdK.exe
  2⤵
  PID:9040
- C:\Windows\System\xntDjOK.exe
  C:\Windows\System\xntDjOK.exe
  2⤵
  PID:11420
- C:\Windows\System\UiVjFFu.exe
  C:\Windows\System\UiVjFFu.exe
  2⤵
  PID:15476
- C:\Windows\System\NuRdzce.exe
  C:\Windows\System\NuRdzce.exe
  2⤵
  PID:1444
- C:\Windows\System\XyQRIZs.exe
  C:\Windows\System\XyQRIZs.exe
  2⤵
  PID:11716
- C:\Windows\System\QHKeVok.exe
  C:\Windows\System\QHKeVok.exe
  2⤵
  PID:12632
- C:\Windows\System\kScUlVI.exe
  C:\Windows\System\kScUlVI.exe
  2⤵
  PID:4504
- C:\Windows\System\DGbwsUi.exe
  C:\Windows\System\DGbwsUi.exe
  2⤵
  PID:10868
- C:\Windows\System\vzblTIx.exe
  C:\Windows\System\vzblTIx.exe
  2⤵
  PID:9684
- C:\Windows\System\WwsYnqa.exe
  C:\Windows\System\WwsYnqa.exe
  2⤵
  PID:9868
- C:\Windows\System\dJPjIDr.exe
  C:\Windows\System\dJPjIDr.exe
  2⤵
  PID:12020
- C:\Windows\System\WPeDBaC.exe
  C:\Windows\System\WPeDBaC.exe
  2⤵
  PID:11968
- C:\Windows\System\gzBYSAb.exe
  C:\Windows\System\gzBYSAb.exe
  2⤵
  PID:11144
- C:\Windows\System\lXfPqkr.exe
  C:\Windows\System\lXfPqkr.exe
  2⤵
  PID:12092
- C:\Windows\System\ENuQXil.exe
  C:\Windows\System\ENuQXil.exe
  2⤵
  PID:10580
- C:\Windows\System\kzLAjpT.exe
  C:\Windows\System\kzLAjpT.exe
  2⤵
  PID:10764
- C:\Windows\System\ZFRlNqi.exe
  C:\Windows\System\ZFRlNqi.exe
  2⤵
  PID:10144
- C:\Windows\System\JeeXZgx.exe
  C:\Windows\System\JeeXZgx.exe
  2⤵
  PID:10984
- C:\Windows\System\XkwubHc.exe
  C:\Windows\System\XkwubHc.exe
  2⤵
  PID:11248
- C:\Windows\System\uOMheEm.exe
  C:\Windows\System\uOMheEm.exe
  2⤵
  PID:4820
- C:\Windows\System\IQPYINN.exe
  C:\Windows\System\IQPYINN.exe
  2⤵
  PID:16188
- C:\Windows\System\iyawENC.exe
  C:\Windows\System\iyawENC.exe
  2⤵
  PID:13184
- C:\Windows\System\ruslIDA.exe
  C:\Windows\System\ruslIDA.exe
  2⤵
  PID:11304
- C:\Windows\System\JClqkUM.exe
  C:\Windows\System\JClqkUM.exe
  2⤵
  PID:11384
- C:\Windows\System\PdCYYlG.exe
  C:\Windows\System\PdCYYlG.exe
  2⤵
  PID:11436
- C:\Windows\System\EDpIRQC.exe
  C:\Windows\System\EDpIRQC.exe
  2⤵
  PID:11568
- C:\Windows\System\HgFflxW.exe
  C:\Windows\System\HgFflxW.exe
  2⤵
  PID:11652
- C:\Windows\System\ubiQQJI.exe
  C:\Windows\System\ubiQQJI.exe
  2⤵
  PID:13220
- C:\Windows\System\FxIsmQM.exe
  C:\Windows\System\FxIsmQM.exe
  2⤵
  PID:2864
- C:\Windows\System\tYgbyME.exe
  C:\Windows\System\tYgbyME.exe
  2⤵
  PID:9936
- C:\Windows\System\bUuieEN.exe
  C:\Windows\System\bUuieEN.exe
  2⤵
  PID:9948
- C:\Windows\System\dkFpOqB.exe
  C:\Windows\System\dkFpOqB.exe
  2⤵
  PID:11244
- C:\Windows\System\mmELXrU.exe
  C:\Windows\System\mmELXrU.exe
  2⤵
  PID:11136
- C:\Windows\System\sBkJlHy.exe
  C:\Windows\System\sBkJlHy.exe
  2⤵
  PID:12760
- C:\Windows\System\pwzPQDR.exe
  C:\Windows\System\pwzPQDR.exe
  2⤵
  PID:11756
- C:\Windows\System\BEffViP.exe
  C:\Windows\System\BEffViP.exe
  2⤵
  PID:2452
- C:\Windows\System\oXISaFp.exe
  C:\Windows\System\oXISaFp.exe
  2⤵
  PID:11316
- C:\Windows\System\RmYVsJl.exe
  C:\Windows\System\RmYVsJl.exe
  2⤵
  PID:11476
- C:\Windows\System\Qsiaigs.exe
  C:\Windows\System\Qsiaigs.exe
  2⤵
  PID:11540
- C:\Windows\System\fOUWnEz.exe
  C:\Windows\System\fOUWnEz.exe
  2⤵
  PID:11692
- C:\Windows\System\bxzShOT.exe
  C:\Windows\System\bxzShOT.exe
  2⤵
  PID:6272
- C:\Windows\System\RbJojKJ.exe
  C:\Windows\System\RbJojKJ.exe
  2⤵
  PID:11920
- C:\Windows\System\qTggGOg.exe
  C:\Windows\System\qTggGOg.exe
  2⤵
  PID:6148
- C:\Windows\System\KiKWqbB.exe
  C:\Windows\System\KiKWqbB.exe
  2⤵
  PID:15756
- C:\Windows\System\uyWWgKe.exe
  C:\Windows\System\uyWWgKe.exe
  2⤵
  PID:10688
- C:\Windows\System\BbsGuwg.exe
  C:\Windows\System\BbsGuwg.exe
  2⤵
  PID:12012
- C:\Windows\System\sHgdfwq.exe
  C:\Windows\System\sHgdfwq.exe
  2⤵
  PID:2540
- C:\Windows\System\KAEQJMF.exe
  C:\Windows\System\KAEQJMF.exe
  2⤵
  PID:12248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:8024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\HlCzOnN.exe

Filesize
2.7MB

MD5
d291908a4f3ed88b1f0323d9167f2818

SHA1
7f97428d21f47024c172b3c1102ad046c87818ed

SHA256
6275e251525cae235bb55d3cb699c3ade060f08a4bf6b1a81079e9398a80c448

SHA512
7f8ef43d869d7194c147f78fb48d39fef1a1009d695427d430011120b6344362720774c5b6e76e39b141f8d148d2695d58a38d05492d7d9c76cc529bfea6b6e4

Download Submit
C:\Windows\System\JKfSrHe.exe

Filesize
2.7MB

MD5
5311757bf2386df6bd146ea0970e5a9a

SHA1
bcbdf357d2f8f5c40ff5b030dbcc2f6e6b492f97

SHA256
8a89a364b0ffa391b9306b60661bcd08bc1042362be5a3712f908780c958cbfd

SHA512
0a77b7ae434b4be2ea06988f2f9b564491255cc84b08046d2107b14420014fe499a9c5fe7b5a303c6d28d3fb941cd003f13cd3216140939d59b94d98f0dcd861

Download Submit
C:\Windows\System\JRWjMtD.exe

Filesize
2.7MB

MD5
9261d4c9489bdd469a747c883fbd6df0

SHA1
e92527e55222e6d2b161ac31726389c42b13c404

SHA256
af49f8c7aa8659c3e7ba1fba843cec81bdcfbf6bf42750521704d463a3b0003d

SHA512
576a317f9a8d17b4ca296e13a2a0ffbccaf8017be4a97dd6da9a61375fefae621367119dcedacc52c802bc40521f4112f77fdf1cddb3e72b747483fc10e2dd2f

Download Submit
C:\Windows\System\KCKkPcD.exe

Filesize
2.7MB

MD5
478f4063789de4bc2d901c3059bcf6fb

SHA1
31fcfaf7a4049db5de4fbfb00bab9f7b771d3176

SHA256
b7fc5a5d04429ae531f500963720526181588d4d9296372b0ba5d1e32217b2a1

SHA512
214f909accab7906cef8de0d240846c8bb7bf56d00fa185b2ddbef41649df59189f751f0154c09ed1610ab05be7dfa11052e645d83ecfedb5ffc7e3a0eaf9dbc

Download Submit
C:\Windows\System\LFMiLXd.exe

Filesize
2.7MB

MD5
089e814aa110b21763dc05712ffe08fb

SHA1
fffd16526435e7ac2d6dc136f3ebe7aea730cd55

SHA256
a7e84cb5a45d147df96c1c5cd64764482b9f6e3c2e10edab79f4c99ea6af1a82

SHA512
d5e48921054d03a0bbe7a6fd3ef5e5eb3eac7f0b08c2a38a8d0912bddc6d33bd7fe01b3d437c8c0fdd288b0c8d668ee3aa9afc10f398c95ac95b63618361df4f

Download Submit
C:\Windows\System\NhuikGd.exe

Filesize
2.7MB

MD5
e42c48a293ed50d62f2461d1d8444be1

SHA1
94abbdb10874c36140627e28ab47c0fc2da63d94

SHA256
c3ce8fd55be173b9cacba19d6129e5bde4c2e6ed135f170b3fcda55992cd2bf9

SHA512
3714ad2d78d9d4725626bda0202ff17b7a3ae97aa5f5a46bd7d362f2b6949a9887ac30c1e2ea870ab506f016b0d07c9e89bf2b04b0e8689c4fb696c3d4622ed9

Download Submit
C:\Windows\System\NpaVdGq.exe

Filesize
2.7MB

MD5
8e532b952ddabd334aa7711a39f7206d

SHA1
d42fdb1d880b73d3462177271797857e7c5c9d95

SHA256
038b835c0e2041743f5720994d80efde9e1f0850c395cc529af350b5d805dbf4

SHA512
86c9759f2e9d4465906503b1cb98f1ce76984f9abe62915f7e0010a40df22b61e0e62d78b9aebc01f560fda04db483df9c586ab4fd4f1ece298b05b709a19ebd

Download Submit
C:\Windows\System\OeUTCEk.exe

Filesize
2.7MB

MD5
4b31604eb7bf68100e8fc8f5a1e7f1e8

SHA1
aa9b797d74bf222287706d59b0dd205ebce05e68

SHA256
29cfebec2c3ddee769d40dc15d0923088aa14f482dc1ad64d47df69a66839e72

SHA512
c5ba5c04b40dbe45ae125471acbc5d088f6702e8eb8d619d3e544789a748db82baf6c3800cbda5466a8a2cb4c2ca6f21fe81ff14301d8bb52383b9f70e9b266d

Download Submit
C:\Windows\System\OumyjYG.exe

Filesize
2.7MB

MD5
c56e013989440e1cf127b1d5e864f55d

SHA1
3447bec73a5b7c056325ba91484e8ab051ec1d6b

SHA256
bcabc5526e7f8585555ab73a828f1cf35c233c2d5a22f3c3e5d40d83b6eeb043

SHA512
5f503578dcad9578527465135176cc9540058485176983dad8f08d59bcbdd236e9d141bfe4b83d2ebc7333f272a0a4fbeb97170a6547e19adad37cc4fcc23866

Download Submit
C:\Windows\System\QHMlVzB.exe

Filesize
2.7MB

MD5
32222a521a4893d69e1824da5b4f0bf1

SHA1
25b65c36bc4f497bec90a08a89efec67b816e642

SHA256
78c637c550865445449cfba0db3ac9ec708a859031e46af366a63fbc56e473b9

SHA512
59773057e8be5e37e366091699aa5c4ed894b35691cf5e6bdea6212d8481c3bc9aff7d069732d6005cb5957c15ba4f822425aa37eb9bf3f338656ba18f0d503b

Download Submit
C:\Windows\System\QQlxTvO.exe

Filesize
2.7MB

MD5
1124389468a59a13148388b97ccf75e1

SHA1
516c2520c3a219c9c2f3a667bf134fc5f144d835

SHA256
bc62cacd3374c0f95c56b0a415d3ec652113f6723eb73a3269b8d8a8dad88713

SHA512
5898a25790d63ab7562db8a70c6e5a8b3802d9e7f2e771f9f871099304b2ae456f1adae75cf5660b5be92840996899eeaf33b8373021598e5c998ad78ecdfefb

Download Submit
C:\Windows\System\QWOTFkY.exe

Filesize
2.7MB

MD5
fb8f8cd46816c32619d6f46d4694f8b4

SHA1
047f89eda777cc7f847359aa3b6d1676fa58a504

SHA256
52d52e737ded66c60c3bb92e523cefd6b01d920803fe4dbb023f1b5ce54660f7

SHA512
f94cbc5382986cf2550a6ad8f37c711b1f54cfe72c138fcb3005dfbd3dab3b923bc2f0d9f4a1d397679031e81694ea06d3cae170a2513d7a7ceaa47ab606dab4

Download Submit
C:\Windows\System\RZRIeNT.exe

Filesize
2.7MB

MD5
708c6b8f94421a26e710538b2996ad00

SHA1
f5072ba733723ab5118a4dec787d00ed0ef4ba93

SHA256
368ddc96b1e969acec454a08764933c60f0bae7f0791b86dad15b53ce929a695

SHA512
29f8984b39e0adca041d3a0c9edeb486692a8452bf480fca77462c262c455f6962d6533aca76844fb7784e8c616052bfbff55b2f971028d34c6fd5a22c4257fe

Download Submit
C:\Windows\System\TEClxLf.exe

Filesize
2.7MB

MD5
04e5f6e343eb5701552e0e6ebd27ca95

SHA1
3240db7ee28e1f5ba04132e95ab91d63fa4b48af

SHA256
22241c443034716289007e8144f402d38bbcc5b1d424dbb01993f7589cd00e25

SHA512
c995ec7f5e46b761421bf93469faf95f9741fa29c3c38bcd22c06581a4a259defef474af724f18ac818650da8cba212f979c31a35d157c06600cc79d63dfd9b0

Download Submit
C:\Windows\System\TudjjhZ.exe

Filesize
2.7MB

MD5
af49ec659a0e69e73d0c707e14e13b19

SHA1
c800a58dd1df121841f41fb98230d92cdc99ef94

SHA256
cdac94bfc855935beb48a220b345030eeb43f21f19fa8f70a31f8b29961629a5

SHA512
dd6ff6b52df845fe6066572916eee8ffcff999ed5882c127fc573611f0b52dfcedb442d7356e936219a78408123d8bf3dd37d84197c714e63c3eae1ddcd8bdfc

Download Submit
C:\Windows\System\WYrqCco.exe

Filesize
2.7MB

MD5
ced9f927f1f3d3d2e7e61e8ffadc59c3

SHA1
86c21ab1391815869117e75adda2d9b26cabfb56

SHA256
c0b019c02bc88f961e795c2de4e04358abe006c3391a99ea23c649de8e8d6892

SHA512
824865f1a88a0e179f254a4a11a21f488ad97ab9f72b96ea83e3bf4747d74631860f398cc2d774abe5a27cc594bd16b62731a9a7b66257302de0b77ade68b3aa

Download Submit
C:\Windows\System\XhOzUUU.exe

Filesize
2.7MB

MD5
35f1ac291ab4f0cdc26836c9419659b1

SHA1
c50e29e80bddab2aaa6c73792b9abce1543d0785

SHA256
cba85e70759a2f7b26cc40dcbd72f0021a4b4be1e111e49a7b38c5452a47597e

SHA512
f377c84e161a0fa250ee5a449f19f6c415d36095c2a07c1a50d56677117cef4d72e3cbf374713c3adc7e19a4522fe720fce17a714168087f199f6182f1faae57

Download Submit
C:\Windows\System\ZcjVaNO.exe

Filesize
2.7MB

MD5
1404a48640c3651ebe0079009cdcbd5f

SHA1
73306af54751c2e6d38c8185f68b508bafa6802c

SHA256
a05f535e383ab420cde5dafce291fe30b593b97fc78d5d139e1b43d20025f227

SHA512
2d64bc4e0b319ffeaaf3fe1c9d4f75864e9e3e91b836849f84cd41f45a6d51526136f49a333a8ef6134880a55e0c20e547ca83ad0177a5228c1de1b281d82cb8

Download Submit
C:\Windows\System\daPsdUV.exe

Filesize
2.7MB

MD5
c3299840b72c767a78c7c5ee794b363e

SHA1
e4185b9a791a3155133418456728051bd152d4a5

SHA256
7eb9e4d017644294894946b8df6ce3bc6a10372793b658ba0443ae28fe484835

SHA512
c6f731d5b723eaa22ff35f14327dc6df248806c27d2de4df0bffcddd44e119553c99b68f8dffa695f486fdd0ef4bcd155dfe5757187f1f33f62ee2ec30435aba

Download Submit
C:\Windows\System\hzphNHZ.exe

Filesize
2.7MB

MD5
f07ad87bb278934e6e517465127d6d42

SHA1
05540c5f7881246e79c8cd4bc658e767e1f1d49e

SHA256
3b8508fae4035033ff0d42a400e829f9fa5e2b86a6e3cfd7e57e8199d3d24e9f

SHA512
35ecf60d2e16abafe363362b9577359cff3009b1c61bd9efaf8a5c6c69e4b0810e31df0e3619efdacfda012b4f61d46ca24a1a19df1a77f4cea3e0005eb6779a

Download Submit
C:\Windows\System\judOJeU.exe

Filesize
2.7MB

MD5
e7107b7c7442a63a389d1f44b65ea50e

SHA1
10a7269a69f34b897c980ad365d2281aacfcdb70

SHA256
302e9820cb463cdb8009df4e3dcd5db25369962083745931da1d0fb253987618

SHA512
aa64439b16875049684fe49c7e297099a7e12d9ad2d8b2d6d4a013b85d5998159ba7390883f67f57a040ec4fabd2cbd45f9ac17ec05d3d65ea09686b6613d562

Download Submit
C:\Windows\System\lsvCjAl.exe

Filesize
2.7MB

MD5
0bba5d384c67d4fe51d41ac091d9b99b

SHA1
843df3fa4db5486bd92c63e1dfab6281c4fb4484

SHA256
881ffa92849379feabf4fae420c70b37b3bdbeae4550f7721eb2d40bb5d6fc50

SHA512
d39b35ebc7b2e746febd8f2f7b58126e05fd799f4246c2c68259f7f678cba9946fbee0639a08a74dc64421a9ef0f30b17a9a9d22209e2c03fbf8f24096d19ed7

Download Submit
C:\Windows\System\nPChkkp.exe

Filesize
2.7MB

MD5
e6278ac6abde92551be9d8506ce21852

SHA1
8ae7c2adea1d073b78d664e7a96b77fa4ef474cf

SHA256
55e3d5604831e5931eae21e5f69a263ab27e576a864c89890fe8ecd0c410d9d2

SHA512
6ce0247977a9a2ddf65cf4a7f329461cb232511cd9964f13c96d60968915d17bb92a580f71d21d110b60dbb5d4ba558dbe1605217774558d743715bbca7ed600

Download Submit
C:\Windows\System\oPlIIBh.exe

Filesize
2.7MB

MD5
b5dbb3fcfad3753bdeabde5f77f349ad

SHA1
5db760bc7d828d7bbea56c525d6e0f689fa82e24

SHA256
544a638aef8e91c789c21b1441f0b0f0c58d35a8589c2788b43b5b9deaa53a54

SHA512
4a9edf0c7c8d5073a9f2d55627816b4be42cbc6e3b12477cd41c15df3d08e5b206a34d55931394278832dfd75bf0bc91830fc3388de821a6b19d5e305a69ff71

Download Submit
C:\Windows\System\oZuAFml.exe

Filesize
2.7MB

MD5
cca0ef72c46d56399d08972a10a02944

SHA1
f62649d9ed9a08fd35267dc80ba57cb8ad3158ab

SHA256
2cd9a422f31cc7ca93a7dc96bdce2fd36ef6f1a489452a6fd7374e37258c4da7

SHA512
e10e5ce2934e9c66e8984483fcfdb91e71c376f53770c84d7d1f6793822603aa44277f81eeec07fe1ea90ad40aa2692780ce3e8baf29278b8009887017919b63

Download Submit
C:\Windows\System\prgBzzb.exe

Filesize
2.7MB

MD5
7a914c0bc58d1adc0cb75b7a0d81ea5e

SHA1
510c9788d8f778753780f10cf1511c78be8e1324

SHA256
10baeeb47e83a71345ce2a9fbb4add69899625f0dc1ee3d4d222b0844ec65585

SHA512
91610c841dbc2d455d4fa87664ab33c888425ed7b40e2e16b9ff22a44880d56a4ee1fb82672bb71f1d8ca6ef6c430afe9822b9a64ba5770130162b3927d82347

Download Submit
C:\Windows\System\sNKAwey.exe

Filesize
2.7MB

MD5
89dc59f76f5b8ff569087571ea164eeb

SHA1
c9a8d5e1c7b433e5a3f35bc4deace84059b21c10

SHA256
645da31f7a59ca6130932e8de1a877309cf245fceab11ad802591f220c9e6177

SHA512
4f4fe34d51dffe629361e459d09e23928a1ea1124721078690040f97c73a1c2a57bf4562dde300ac96cfc20ac18f643f86a87385b5c72c844dcc2d25153d1797

Download Submit
C:\Windows\System\vMuZKZq.exe

Filesize
2.7MB

MD5
e932ad0e523d9f3b2acbfe1f28ceb097

SHA1
15ff176478e79df9775b48c7cc3acad2f95f5999

SHA256
c2df540dd4bae67dc0bb2b079124e869aa70f17416ef2a6ecab2982972b5efcd

SHA512
9d4a714119ddc8e8097b8e1bdd94816b2bf11611804ee951973922764373d5fb51ffe3b3329901f6ccd7fdc42aa701d18595e8269e8665399bb6fc5b5fce54db

Download Submit
C:\Windows\System\xDFhGUm.exe

Filesize
2.7MB

MD5
e4f93a3d4f6a9e814ff789dbd770cb71

SHA1
8c9797a952d1a30c4953f12794709eb140d8f280

SHA256
cadbd1a9f784da011eb20193f0c2802cbca77a95b1c9374b2546a107bf0899eb

SHA512
ed7172681cd55bcdbe3b8aa0413fb84703b8da88e60ef18d577d71d54c14a5f2ded5e17c0455a3d6bea7f17e506ca9884645c9af9736e3d88bae6a76d12ee11a

Download Submit
C:\Windows\System\xtkzOlC.exe

Filesize
2.7MB

MD5
4a2fae2f37f24b20587598d62c805b1a

SHA1
5d07bb6029ad49aec84efea3e0483d191df5df36

SHA256
a9817b021f2f94babecea2f3b044b1d0db88e2310f18721eda038f9fd59e79ab

SHA512
257bd3981b0715aa3c77430c881d0ca8e46a5d72e21ec49718ee75b07030955a01020523955b761a058ae187cf59b714cd238aa3fcfa3bb4fddd2147edddc744

Download Submit
C:\Windows\System\yTgoUZT.exe

Filesize
2.7MB

MD5
ae0f377a1625c9ebd1723e2a1408179c

SHA1
279196e874d3865403ec9837b3388e95859c8d87

SHA256
4bace44e0df907129a0befc862190f331ca10213eba0c1559b6b937b3b5b3d2f

SHA512
eb429c14790e06d9f6832de57c86d7edfdf4b0c5f5930eb627692dcb4a78119543390a4f181b587363dc02eaca67793bf9bfa09ac01e196c2984630b7be50932

Download Submit
C:\Windows\System\yttyMCI.exe

Filesize
2.7MB

MD5
bfeb8b89b18f6c4d9338f10003b16df1

SHA1
0bc9af283d7d8102c2e6b19ffe65af18dc23ed19

SHA256
80b099d99d3eb9cbc1908afefb0be6a2967d7cd3e51af6f756d0d5c0ce900ee7

SHA512
1f9e060572f13ac56f94f27a09dfded5eb503e99e57c1c7d2b8e50aebfcbcf804ca71abcd41761ee694e3ffcce3dec491d4a3be557611c0db0aad9c31e2c9423

Download Submit
memory/552-23-0x00007FF65B5A0000-0x00007FF65B8F4000-memory.dmp

Filesize
3.3MB

Download
memory/552-877-0x00007FF65B5A0000-0x00007FF65B8F4000-memory.dmp

Filesize
3.3MB

Download
memory/932-1670-0x00007FF6137D0000-0x00007FF613B24000-memory.dmp

Filesize
3.3MB

Download
memory/932-219-0x00007FF6137D0000-0x00007FF613B24000-memory.dmp

Filesize
3.3MB

Download
memory/1368-199-0x00007FF793FA0000-0x00007FF7942F4000-memory.dmp

Filesize
3.3MB

Download
memory/1368-1603-0x00007FF793FA0000-0x00007FF7942F4000-memory.dmp

Filesize
3.3MB

Download
memory/1588-1430-0x00007FF74BC70000-0x00007FF74BFC4000-memory.dmp

Filesize
3.3MB

Download
memory/1588-30-0x00007FF74BC70000-0x00007FF74BFC4000-memory.dmp

Filesize
3.3MB

Download
memory/1752-200-0x00007FF799E70000-0x00007FF79A1C4000-memory.dmp

Filesize
3.3MB

Download
memory/1752-1604-0x00007FF799E70000-0x00007FF79A1C4000-memory.dmp

Filesize
3.3MB

Download
memory/1820-908-0x00007FF63AB70000-0x00007FF63AEC4000-memory.dmp

Filesize
3.3MB

Download
memory/1820-509-0x00007FF63AB70000-0x00007FF63AEC4000-memory.dmp

Filesize
3.3MB

Download
memory/1820-26-0x00007FF63AB70000-0x00007FF63AEC4000-memory.dmp

Filesize
3.3MB

Download
memory/1860-222-0x00007FF6825D0000-0x00007FF682924000-memory.dmp

Filesize
3.3MB

Download
memory/1860-1688-0x00007FF6825D0000-0x00007FF682924000-memory.dmp

Filesize
3.3MB

Download
memory/2196-1667-0x00007FF63E590000-0x00007FF63E8E4000-memory.dmp

Filesize
3.3MB

Download
memory/2196-221-0x00007FF63E590000-0x00007FF63E8E4000-memory.dmp

Filesize
3.3MB

Download
memory/2348-1567-0x00007FF608EC0000-0x00007FF609214000-memory.dmp

Filesize
3.3MB

Download
memory/2348-229-0x00007FF608EC0000-0x00007FF609214000-memory.dmp

Filesize
3.3MB

Download
memory/2676-196-0x00007FF6FBAA0000-0x00007FF6FBDF4000-memory.dmp

Filesize
3.3MB

Download
memory/2676-1593-0x00007FF6FBAA0000-0x00007FF6FBDF4000-memory.dmp

Filesize
3.3MB

Download
memory/2884-1645-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp

Filesize
3.3MB

Download
memory/2884-218-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp

Filesize
3.3MB

Download
memory/2908-61-0x00007FF756410000-0x00007FF756764000-memory.dmp

Filesize
3.3MB

Download
memory/2908-19-0x00007FF756410000-0x00007FF756764000-memory.dmp

Filesize
3.3MB

Download
memory/2908-856-0x00007FF756410000-0x00007FF756764000-memory.dmp

Filesize
3.3MB

Download
memory/2976-205-0x00007FF7B3200000-0x00007FF7B3554000-memory.dmp

Filesize
3.3MB

Download
memory/2976-1609-0x00007FF7B3200000-0x00007FF7B3554000-memory.dmp

Filesize
3.3MB

Download
memory/3220-8-0x00007FF67B120000-0x00007FF67B474000-memory.dmp

Filesize
3.3MB

Download
memory/3220-859-0x00007FF67B120000-0x00007FF67B474000-memory.dmp

Filesize
3.3MB

Download
memory/3220-57-0x00007FF67B120000-0x00007FF67B474000-memory.dmp

Filesize
3.3MB

Download
memory/3488-51-0x00007FF7231E0000-0x00007FF723534000-memory.dmp

Filesize
3.3MB

Download
memory/3488-1-0x0000023DC56F0000-0x0000023DC5700000-memory.dmp

Filesize
64KB

Download
memory/3488-0-0x00007FF7231E0000-0x00007FF723534000-memory.dmp

Filesize
3.3MB

Download
memory/3648-207-0x00007FF649200000-0x00007FF649554000-memory.dmp

Filesize
3.3MB

Download
memory/3648-1610-0x00007FF649200000-0x00007FF649554000-memory.dmp

Filesize
3.3MB

Download
memory/3864-1605-0x00007FF7B14E0000-0x00007FF7B1834000-memory.dmp

Filesize
3.3MB

Download
memory/3864-203-0x00007FF7B14E0000-0x00007FF7B1834000-memory.dmp

Filesize
3.3MB

Download
memory/3956-226-0x00007FF717E50000-0x00007FF7181A4000-memory.dmp

Filesize
3.3MB

Download
memory/3956-1699-0x00007FF717E50000-0x00007FF7181A4000-memory.dmp

Filesize
3.3MB

Download
memory/3972-1425-0x00007FF6A97F0000-0x00007FF6A9B44000-memory.dmp

Filesize
3.3MB

Download
memory/3972-43-0x00007FF6A97F0000-0x00007FF6A9B44000-memory.dmp

Filesize
3.3MB

Download
memory/4028-215-0x00007FF60A2B0000-0x00007FF60A604000-memory.dmp

Filesize
3.3MB

Download
memory/4028-1628-0x00007FF60A2B0000-0x00007FF60A604000-memory.dmp

Filesize
3.3MB

Download
memory/4064-1607-0x00007FF7CF500000-0x00007FF7CF854000-memory.dmp

Filesize
3.3MB

Download
memory/4064-201-0x00007FF7CF500000-0x00007FF7CF854000-memory.dmp

Filesize
3.3MB

Download
memory/4112-1490-0x00007FF70D320000-0x00007FF70D674000-memory.dmp

Filesize
3.3MB

Download
memory/4112-56-0x00007FF70D320000-0x00007FF70D674000-memory.dmp

Filesize
3.3MB

Download
memory/4164-230-0x00007FF65AA90000-0x00007FF65ADE4000-memory.dmp

Filesize
3.3MB

Download
memory/4164-1580-0x00007FF65AA90000-0x00007FF65ADE4000-memory.dmp

Filesize
3.3MB

Download
memory/4352-1536-0x00007FF7763C0000-0x00007FF776714000-memory.dmp

Filesize
3.3MB

Download
memory/4352-194-0x00007FF7763C0000-0x00007FF776714000-memory.dmp

Filesize
3.3MB

Download
memory/4476-55-0x00007FF634950000-0x00007FF634CA4000-memory.dmp

Filesize
3.3MB

Download
memory/4476-1439-0x00007FF634950000-0x00007FF634CA4000-memory.dmp

Filesize
3.3MB

Download
memory/4636-223-0x00007FF752820000-0x00007FF752B74000-memory.dmp

Filesize
3.3MB

Download
memory/4636-1702-0x00007FF752820000-0x00007FF752B74000-memory.dmp

Filesize
3.3MB

Download
memory/4640-198-0x00007FF7C6A10000-0x00007FF7C6D64000-memory.dmp

Filesize
3.3MB

Download
memory/4640-1601-0x00007FF7C6A10000-0x00007FF7C6D64000-memory.dmp

Filesize
3.3MB

Download
memory/4900-227-0x00007FF64AFC0000-0x00007FF64B314000-memory.dmp

Filesize
3.3MB

Download
memory/4900-1705-0x00007FF64AFC0000-0x00007FF64B314000-memory.dmp

Filesize
3.3MB

Download
memory/4992-1602-0x00007FF6DABB0000-0x00007FF6DAF04000-memory.dmp

Filesize
3.3MB

Download
memory/4992-197-0x00007FF6DABB0000-0x00007FF6DAF04000-memory.dmp

Filesize
3.3MB

Download
memory/5048-1613-0x00007FF7DDE90000-0x00007FF7DE1E4000-memory.dmp

Filesize
3.3MB

Download
memory/5048-211-0x00007FF7DDE90000-0x00007FF7DE1E4000-memory.dmp

Filesize
3.3MB

Download