xmrig | 74855b076a8c5cac95031a2d8b77d76a3da87f573bcbfc0bdf2376efed3d7648

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
Size

2.3MB
MD5

20457ffd763a8fe5318df5a6a366c190
SHA1

a59a648b5647526ba98e7aa3cf65e7a9495d4777
SHA256

74855b076a8c5cac95031a2d8b77d76a3da87f573bcbfc0bdf2376efed3d7648
SHA512

0ffce6c038d8beeee2e4152b4cacdcef4ea822f27ba9dba86c5971efeb0c3b0b2ab58b1e19c98aa0bbc33af9598167f31ac1fe958365879c081d8be2caf8eae1
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+A4VBqxGLI9e9:BemTLkNdfE0pZrZ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4616-0-0x00007FF75A270000-0x00007FF75A5C4000-memory.dmp	xmrig
behavioral2/files/0x000800000002326d-4.dat	xmrig
behavioral2/files/0x000800000002326e-10.dat	xmrig
behavioral2/memory/1216-12-0x00007FF668CB0000-0x00007FF669004000-memory.dmp	xmrig
behavioral2/memory/4456-11-0x00007FF6599B0000-0x00007FF659D04000-memory.dmp	xmrig
behavioral2/files/0x0008000000023270-9.dat	xmrig
behavioral2/memory/3412-18-0x00007FF7A62F0000-0x00007FF7A6644000-memory.dmp	xmrig
behavioral2/files/0x0008000000023272-23.dat	xmrig
behavioral2/files/0x0007000000023273-29.dat	xmrig
behavioral2/memory/2324-24-0x00007FF74EB30000-0x00007FF74EE84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023274-35.dat	xmrig
behavioral2/files/0x0007000000023275-39.dat	xmrig
behavioral2/files/0x0007000000023276-44.dat	xmrig
behavioral2/files/0x0007000000023277-49.dat	xmrig
behavioral2/memory/1464-50-0x00007FF6E27B0000-0x00007FF6E2B04000-memory.dmp	xmrig
behavioral2/memory/4572-47-0x00007FF752810000-0x00007FF752B64000-memory.dmp	xmrig
behavioral2/memory/224-54-0x00007FF64A1A0000-0x00007FF64A4F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023278-57.dat	xmrig
behavioral2/memory/5020-64-0x00007FF7A6370000-0x00007FF7A66C4000-memory.dmp	xmrig
behavioral2/memory/3568-65-0x00007FF6AAA70000-0x00007FF6AADC4000-memory.dmp	xmrig
behavioral2/memory/1424-66-0x00007FF781180000-0x00007FF7814D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023279-67.dat	xmrig
behavioral2/files/0x000700000002327a-71.dat	xmrig
behavioral2/files/0x000700000002327b-76.dat	xmrig
behavioral2/files/0x000700000002327c-82.dat	xmrig
behavioral2/files/0x000700000002327d-87.dat	xmrig
behavioral2/files/0x0007000000023280-101.dat	xmrig
behavioral2/files/0x0007000000023281-107.dat	xmrig
behavioral2/files/0x0007000000023282-112.dat	xmrig
behavioral2/files/0x0007000000023284-121.dat	xmrig
behavioral2/files/0x0007000000023285-127.dat	xmrig
behavioral2/files/0x0007000000023286-131.dat	xmrig
behavioral2/files/0x0007000000023283-117.dat	xmrig
behavioral2/files/0x0007000000023287-137.dat	xmrig
behavioral2/files/0x0007000000023289-147.dat	xmrig
behavioral2/files/0x000700000002328a-152.dat	xmrig
behavioral2/files/0x000700000002328b-157.dat	xmrig
behavioral2/files/0x000700000002328c-162.dat	xmrig
behavioral2/files/0x000700000002328e-172.dat	xmrig
behavioral2/files/0x000700000002328d-167.dat	xmrig
behavioral2/files/0x0007000000023288-142.dat	xmrig
behavioral2/files/0x000700000002327f-97.dat	xmrig
behavioral2/files/0x000700000002327e-92.dat	xmrig
behavioral2/memory/4640-212-0x00007FF6E7AE0000-0x00007FF6E7E34000-memory.dmp	xmrig
behavioral2/memory/2572-61-0x00007FF60B360000-0x00007FF60B6B4000-memory.dmp	xmrig
behavioral2/memory/1028-213-0x00007FF77BAA0000-0x00007FF77BDF4000-memory.dmp	xmrig
behavioral2/memory/936-217-0x00007FF692740000-0x00007FF692A94000-memory.dmp	xmrig
behavioral2/memory/4908-218-0x00007FF674E30000-0x00007FF675184000-memory.dmp	xmrig
behavioral2/memory/1368-216-0x00007FF773860000-0x00007FF773BB4000-memory.dmp	xmrig
behavioral2/memory/1480-220-0x00007FF7AA8A0000-0x00007FF7AABF4000-memory.dmp	xmrig
behavioral2/memory/1440-221-0x00007FF716D70000-0x00007FF7170C4000-memory.dmp	xmrig
behavioral2/memory/1360-223-0x00007FF75A120000-0x00007FF75A474000-memory.dmp	xmrig
behavioral2/memory/3100-222-0x00007FF6BAB40000-0x00007FF6BAE94000-memory.dmp	xmrig
behavioral2/memory/4472-227-0x00007FF70C1B0000-0x00007FF70C504000-memory.dmp	xmrig
behavioral2/memory/3792-228-0x00007FF6F3BF0000-0x00007FF6F3F44000-memory.dmp	xmrig
behavioral2/memory/2068-230-0x00007FF7983E0000-0x00007FF798734000-memory.dmp	xmrig
behavioral2/memory/3192-231-0x00007FF65E240000-0x00007FF65E594000-memory.dmp	xmrig
behavioral2/memory/3592-224-0x00007FF77E800000-0x00007FF77EB54000-memory.dmp	xmrig
behavioral2/memory/2724-232-0x00007FF7B6CB0000-0x00007FF7B7004000-memory.dmp	xmrig
behavioral2/memory/4100-234-0x00007FF766F30000-0x00007FF767284000-memory.dmp	xmrig
behavioral2/memory/2788-237-0x00007FF6FC8A0000-0x00007FF6FCBF4000-memory.dmp	xmrig
behavioral2/memory/5100-240-0x00007FF756580000-0x00007FF7568D4000-memory.dmp	xmrig
behavioral2/memory/4616-421-0x00007FF75A270000-0x00007FF75A5C4000-memory.dmp	xmrig
behavioral2/memory/1216-1218-0x00007FF668CB0000-0x00007FF669004000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4456	uOJevRV.exe
1216	lfcVGrU.exe
3412	ntBtROD.exe
2324	xxLoKdO.exe
4572	qtAuvoc.exe
2572	zxydrnm.exe
1464	szhAcuU.exe
224	dUpQGfI.exe
5020	ledKiFv.exe
3568	fmXegSl.exe
1424	QBzfnVr.exe
4640	znpOwwT.exe
1028	LeUhpWf.exe
1368	WRTXgko.exe
936	PtaUhpn.exe
4908	IQdNeCy.exe
1480	WqUDNrF.exe
1440	rHsaKdY.exe
3100	ozgbUyf.exe
1360	WXZTsRV.exe
3592	BVWpKXl.exe
4472	eNXqFlo.exe
3792	qqIElfv.exe
2068	oJQtgnj.exe
3192	EzgUitS.exe
2724	rEXPPDa.exe
4100	UcYZjGT.exe
2788	GLTJQCc.exe
5100	TIBWUGU.exe
2940	jIBZfPE.exe
2340	dPVZjOR.exe
4424	RKAzZUB.exe
4780	ufqDsXy.exe
4516	NtluhCF.exe
4656	CZAHOsb.exe
1600	bEmXtqN.exe
3308	QtZUQYA.exe
4936	XoGIuKy.exe
664	IWdixjJ.exe
4684	nljPGso.exe
912	tZOIlfQ.exe
1544	ONIPjhE.exe
2316	DkOROLZ.exe
4124	XqUHUQG.exe
1312	uPxTBTW.exe
228	XdQBvnC.exe
3532	psQbvzq.exe
3828	TwrSZnh.exe
3180	tJOpGvT.exe
3388	gIjrwnm.exe
4168	AqpGpJS.exe
3484	YDuogqL.exe
3628	JLmvcdh.exe
2140	UFgWAGx.exe
1548	DnEXuHX.exe
2004	CELEYPu.exe
3188	TRWZODh.exe
1364	nwynFcz.exe
3032	AMsmUSz.exe
3740	wdPZILJ.exe
800	zHrfOOv.exe
1524	hiaeKct.exe
1136	JjMmVPF.exe
4868	uYVrYYk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4616-0-0x00007FF75A270000-0x00007FF75A5C4000-memory.dmp	upx
behavioral2/files/0x000800000002326d-4.dat	upx
behavioral2/files/0x000800000002326e-10.dat	upx
behavioral2/memory/1216-12-0x00007FF668CB0000-0x00007FF669004000-memory.dmp	upx
behavioral2/memory/4456-11-0x00007FF6599B0000-0x00007FF659D04000-memory.dmp	upx
behavioral2/files/0x0008000000023270-9.dat	upx
behavioral2/memory/3412-18-0x00007FF7A62F0000-0x00007FF7A6644000-memory.dmp	upx
behavioral2/files/0x0008000000023272-23.dat	upx
behavioral2/files/0x0007000000023273-29.dat	upx
behavioral2/memory/2324-24-0x00007FF74EB30000-0x00007FF74EE84000-memory.dmp	upx
behavioral2/files/0x0007000000023274-35.dat	upx
behavioral2/files/0x0007000000023275-39.dat	upx
behavioral2/files/0x0007000000023276-44.dat	upx
behavioral2/files/0x0007000000023277-49.dat	upx
behavioral2/memory/1464-50-0x00007FF6E27B0000-0x00007FF6E2B04000-memory.dmp	upx
behavioral2/memory/4572-47-0x00007FF752810000-0x00007FF752B64000-memory.dmp	upx
behavioral2/memory/224-54-0x00007FF64A1A0000-0x00007FF64A4F4000-memory.dmp	upx
behavioral2/files/0x0007000000023278-57.dat	upx
behavioral2/memory/5020-64-0x00007FF7A6370000-0x00007FF7A66C4000-memory.dmp	upx
behavioral2/memory/3568-65-0x00007FF6AAA70000-0x00007FF6AADC4000-memory.dmp	upx
behavioral2/memory/1424-66-0x00007FF781180000-0x00007FF7814D4000-memory.dmp	upx
behavioral2/files/0x0007000000023279-67.dat	upx
behavioral2/files/0x000700000002327a-71.dat	upx
behavioral2/files/0x000700000002327b-76.dat	upx
behavioral2/files/0x000700000002327c-82.dat	upx
behavioral2/files/0x000700000002327d-87.dat	upx
behavioral2/files/0x0007000000023280-101.dat	upx
behavioral2/files/0x0007000000023281-107.dat	upx
behavioral2/files/0x0007000000023282-112.dat	upx
behavioral2/files/0x0007000000023284-121.dat	upx
behavioral2/files/0x0007000000023285-127.dat	upx
behavioral2/files/0x0007000000023286-131.dat	upx
behavioral2/files/0x0007000000023283-117.dat	upx
behavioral2/files/0x0007000000023287-137.dat	upx
behavioral2/files/0x0007000000023289-147.dat	upx
behavioral2/files/0x000700000002328a-152.dat	upx
behavioral2/files/0x000700000002328b-157.dat	upx
behavioral2/files/0x000700000002328c-162.dat	upx
behavioral2/files/0x000700000002328e-172.dat	upx
behavioral2/files/0x000700000002328d-167.dat	upx
behavioral2/files/0x0007000000023288-142.dat	upx
behavioral2/files/0x000700000002327f-97.dat	upx
behavioral2/files/0x000700000002327e-92.dat	upx
behavioral2/memory/4640-212-0x00007FF6E7AE0000-0x00007FF6E7E34000-memory.dmp	upx
behavioral2/memory/2572-61-0x00007FF60B360000-0x00007FF60B6B4000-memory.dmp	upx
behavioral2/memory/1028-213-0x00007FF77BAA0000-0x00007FF77BDF4000-memory.dmp	upx
behavioral2/memory/936-217-0x00007FF692740000-0x00007FF692A94000-memory.dmp	upx
behavioral2/memory/4908-218-0x00007FF674E30000-0x00007FF675184000-memory.dmp	upx
behavioral2/memory/1368-216-0x00007FF773860000-0x00007FF773BB4000-memory.dmp	upx
behavioral2/memory/1480-220-0x00007FF7AA8A0000-0x00007FF7AABF4000-memory.dmp	upx
behavioral2/memory/1440-221-0x00007FF716D70000-0x00007FF7170C4000-memory.dmp	upx
behavioral2/memory/1360-223-0x00007FF75A120000-0x00007FF75A474000-memory.dmp	upx
behavioral2/memory/3100-222-0x00007FF6BAB40000-0x00007FF6BAE94000-memory.dmp	upx
behavioral2/memory/4472-227-0x00007FF70C1B0000-0x00007FF70C504000-memory.dmp	upx
behavioral2/memory/3792-228-0x00007FF6F3BF0000-0x00007FF6F3F44000-memory.dmp	upx
behavioral2/memory/2068-230-0x00007FF7983E0000-0x00007FF798734000-memory.dmp	upx
behavioral2/memory/3192-231-0x00007FF65E240000-0x00007FF65E594000-memory.dmp	upx
behavioral2/memory/3592-224-0x00007FF77E800000-0x00007FF77EB54000-memory.dmp	upx
behavioral2/memory/2724-232-0x00007FF7B6CB0000-0x00007FF7B7004000-memory.dmp	upx
behavioral2/memory/4100-234-0x00007FF766F30000-0x00007FF767284000-memory.dmp	upx
behavioral2/memory/2788-237-0x00007FF6FC8A0000-0x00007FF6FCBF4000-memory.dmp	upx
behavioral2/memory/5100-240-0x00007FF756580000-0x00007FF7568D4000-memory.dmp	upx
behavioral2/memory/4616-421-0x00007FF75A270000-0x00007FF75A5C4000-memory.dmp	upx
behavioral2/memory/1216-1218-0x00007FF668CB0000-0x00007FF669004000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iXGlEuy.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\QCTOeOL.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\DyDCjYr.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\DreNSWV.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\bujylHv.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\eKGnBGW.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\oaKDrdC.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\ssmHpfD.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\upluJYs.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\wEZSomG.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\QllOegG.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\aZQrzlI.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\XyiXTHY.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\WHetLCK.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\CDEsFtR.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\VvAVtRi.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\QSYiOzL.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\enOaoiX.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\AdHeIyK.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\eluAePJ.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\nQDJddF.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\akWCach.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\zUhtxEC.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\MZnYQIt.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\wpGFmlQ.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\PnDnvsp.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\cLCcEuX.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\hUzSTgO.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\yaUvPOT.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\UjiKRfr.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\VLXiFJP.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\pCxNLUw.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\MoZTFND.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\KLCIpfB.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\mkZxFvg.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\ZEucskr.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\IVJrtGw.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\qaffssv.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\iLvPlZL.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\BsTuVPc.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\TNeFYUQ.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\ATisONB.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\DqSjAhP.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\RCOqFmA.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\FCITTpL.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\zjEcmkK.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\cFBhPSo.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\VVVOFgV.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\lHVDQrz.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\APOgTbv.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\VQmwpXH.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\NjwfXSv.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\yVXAzgP.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\ITZiSpq.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\cAmMcYq.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\IGlbiCN.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\sxpauHB.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\izcPEdu.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\zFAcUXi.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\uYVrYYk.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\dMOEXMJ.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\THFxGuQ.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\JPLuvXB.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
File created	C:\Windows\System\ghLpMBN.exe	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4456	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	92
PID 4616 wrote to memory of 4456	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	92
PID 4616 wrote to memory of 1216	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	93
PID 4616 wrote to memory of 1216	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	93
PID 4616 wrote to memory of 3412	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	94
PID 4616 wrote to memory of 3412	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	94
PID 4616 wrote to memory of 2324	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	95
PID 4616 wrote to memory of 2324	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	95
PID 4616 wrote to memory of 4572	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	96
PID 4616 wrote to memory of 4572	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	96
PID 4616 wrote to memory of 2572	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	97
PID 4616 wrote to memory of 2572	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	97
PID 4616 wrote to memory of 1464	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	98
PID 4616 wrote to memory of 1464	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	98
PID 4616 wrote to memory of 224	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	99
PID 4616 wrote to memory of 224	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	99
PID 4616 wrote to memory of 5020	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	100
PID 4616 wrote to memory of 5020	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	100
PID 4616 wrote to memory of 3568	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	101
PID 4616 wrote to memory of 3568	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	101
PID 4616 wrote to memory of 1424	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	102
PID 4616 wrote to memory of 1424	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	102
PID 4616 wrote to memory of 4640	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	103
PID 4616 wrote to memory of 4640	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	103
PID 4616 wrote to memory of 1028	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	104
PID 4616 wrote to memory of 1028	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	104
PID 4616 wrote to memory of 1368	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	105
PID 4616 wrote to memory of 1368	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	105
PID 4616 wrote to memory of 936	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	106
PID 4616 wrote to memory of 936	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	106
PID 4616 wrote to memory of 4908	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	107
PID 4616 wrote to memory of 4908	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	107
PID 4616 wrote to memory of 1480	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	108
PID 4616 wrote to memory of 1480	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	108
PID 4616 wrote to memory of 1440	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	109
PID 4616 wrote to memory of 1440	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	109
PID 4616 wrote to memory of 3100	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	110
PID 4616 wrote to memory of 3100	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	110
PID 4616 wrote to memory of 1360	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	111
PID 4616 wrote to memory of 1360	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	111
PID 4616 wrote to memory of 3592	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	112
PID 4616 wrote to memory of 3592	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	112
PID 4616 wrote to memory of 4472	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	113
PID 4616 wrote to memory of 4472	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	113
PID 4616 wrote to memory of 3792	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	114
PID 4616 wrote to memory of 3792	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	114
PID 4616 wrote to memory of 2068	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	115
PID 4616 wrote to memory of 2068	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	115
PID 4616 wrote to memory of 3192	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	116
PID 4616 wrote to memory of 3192	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	116
PID 4616 wrote to memory of 2724	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	117
PID 4616 wrote to memory of 2724	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	117
PID 4616 wrote to memory of 4100	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	118
PID 4616 wrote to memory of 4100	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	118
PID 4616 wrote to memory of 2788	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	119
PID 4616 wrote to memory of 2788	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	119
PID 4616 wrote to memory of 5100	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	120
PID 4616 wrote to memory of 5100	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	120
PID 4616 wrote to memory of 2940	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	121
PID 4616 wrote to memory of 2940	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	121
PID 4616 wrote to memory of 2340	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	122
PID 4616 wrote to memory of 2340	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	122
PID 4616 wrote to memory of 4424	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	123
PID 4616 wrote to memory of 4424	4616	20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\20457ffd763a8fe5318df5a6a366c190_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\System\uOJevRV.exe
  C:\Windows\System\uOJevRV.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\lfcVGrU.exe
  C:\Windows\System\lfcVGrU.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\ntBtROD.exe
  C:\Windows\System\ntBtROD.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\xxLoKdO.exe
  C:\Windows\System\xxLoKdO.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\qtAuvoc.exe
  C:\Windows\System\qtAuvoc.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\zxydrnm.exe
  C:\Windows\System\zxydrnm.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\szhAcuU.exe
  C:\Windows\System\szhAcuU.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\dUpQGfI.exe
  C:\Windows\System\dUpQGfI.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\ledKiFv.exe
  C:\Windows\System\ledKiFv.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\fmXegSl.exe
  C:\Windows\System\fmXegSl.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\QBzfnVr.exe
  C:\Windows\System\QBzfnVr.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\znpOwwT.exe
  C:\Windows\System\znpOwwT.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\LeUhpWf.exe
  C:\Windows\System\LeUhpWf.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\WRTXgko.exe
  C:\Windows\System\WRTXgko.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\PtaUhpn.exe
  C:\Windows\System\PtaUhpn.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\IQdNeCy.exe
  C:\Windows\System\IQdNeCy.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\WqUDNrF.exe
  C:\Windows\System\WqUDNrF.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\rHsaKdY.exe
  C:\Windows\System\rHsaKdY.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\ozgbUyf.exe
  C:\Windows\System\ozgbUyf.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\WXZTsRV.exe
  C:\Windows\System\WXZTsRV.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\BVWpKXl.exe
  C:\Windows\System\BVWpKXl.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\eNXqFlo.exe
  C:\Windows\System\eNXqFlo.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\qqIElfv.exe
  C:\Windows\System\qqIElfv.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\oJQtgnj.exe
  C:\Windows\System\oJQtgnj.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\EzgUitS.exe
  C:\Windows\System\EzgUitS.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\rEXPPDa.exe
  C:\Windows\System\rEXPPDa.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\UcYZjGT.exe
  C:\Windows\System\UcYZjGT.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\GLTJQCc.exe
  C:\Windows\System\GLTJQCc.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\TIBWUGU.exe
  C:\Windows\System\TIBWUGU.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\jIBZfPE.exe
  C:\Windows\System\jIBZfPE.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\dPVZjOR.exe
  C:\Windows\System\dPVZjOR.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\RKAzZUB.exe
  C:\Windows\System\RKAzZUB.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\ufqDsXy.exe
  C:\Windows\System\ufqDsXy.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\NtluhCF.exe
  C:\Windows\System\NtluhCF.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\CZAHOsb.exe
  C:\Windows\System\CZAHOsb.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\bEmXtqN.exe
  C:\Windows\System\bEmXtqN.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\QtZUQYA.exe
  C:\Windows\System\QtZUQYA.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\XoGIuKy.exe
  C:\Windows\System\XoGIuKy.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\IWdixjJ.exe
  C:\Windows\System\IWdixjJ.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\nljPGso.exe
  C:\Windows\System\nljPGso.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\tZOIlfQ.exe
  C:\Windows\System\tZOIlfQ.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\ONIPjhE.exe
  C:\Windows\System\ONIPjhE.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\DkOROLZ.exe
  C:\Windows\System\DkOROLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\XqUHUQG.exe
  C:\Windows\System\XqUHUQG.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\uPxTBTW.exe
  C:\Windows\System\uPxTBTW.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\XdQBvnC.exe
  C:\Windows\System\XdQBvnC.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\psQbvzq.exe
  C:\Windows\System\psQbvzq.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\TwrSZnh.exe
  C:\Windows\System\TwrSZnh.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\tJOpGvT.exe
  C:\Windows\System\tJOpGvT.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\gIjrwnm.exe
  C:\Windows\System\gIjrwnm.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\AqpGpJS.exe
  C:\Windows\System\AqpGpJS.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\YDuogqL.exe
  C:\Windows\System\YDuogqL.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\JLmvcdh.exe
  C:\Windows\System\JLmvcdh.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\UFgWAGx.exe
  C:\Windows\System\UFgWAGx.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\DnEXuHX.exe
  C:\Windows\System\DnEXuHX.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\CELEYPu.exe
  C:\Windows\System\CELEYPu.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\TRWZODh.exe
  C:\Windows\System\TRWZODh.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\nwynFcz.exe
  C:\Windows\System\nwynFcz.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\AMsmUSz.exe
  C:\Windows\System\AMsmUSz.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\wdPZILJ.exe
  C:\Windows\System\wdPZILJ.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\zHrfOOv.exe
  C:\Windows\System\zHrfOOv.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\hiaeKct.exe
  C:\Windows\System\hiaeKct.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\JjMmVPF.exe
  C:\Windows\System\JjMmVPF.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\uYVrYYk.exe
  C:\Windows\System\uYVrYYk.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\QIGDGqe.exe
  C:\Windows\System\QIGDGqe.exe
  2⤵
  PID:5012
- C:\Windows\System\cJmdnUa.exe
  C:\Windows\System\cJmdnUa.exe
  2⤵
  PID:4708
- C:\Windows\System\OvqmJzH.exe
  C:\Windows\System\OvqmJzH.exe
  2⤵
  PID:1712
- C:\Windows\System\vFYiahs.exe
  C:\Windows\System\vFYiahs.exe
  2⤵
  PID:2592
- C:\Windows\System\bKEfXWT.exe
  C:\Windows\System\bKEfXWT.exe
  2⤵
  PID:1904
- C:\Windows\System\hOZqDbR.exe
  C:\Windows\System\hOZqDbR.exe
  2⤵
  PID:3800
- C:\Windows\System\ZEglPws.exe
  C:\Windows\System\ZEglPws.exe
  2⤵
  PID:1484
- C:\Windows\System\ldetnyD.exe
  C:\Windows\System\ldetnyD.exe
  2⤵
  PID:3196
- C:\Windows\System\cszZTbd.exe
  C:\Windows\System\cszZTbd.exe
  2⤵
  PID:2348
- C:\Windows\System\cqubelc.exe
  C:\Windows\System\cqubelc.exe
  2⤵
  PID:1160
- C:\Windows\System\TATsZMa.exe
  C:\Windows\System\TATsZMa.exe
  2⤵
  PID:3724
- C:\Windows\System\LPQCkRM.exe
  C:\Windows\System\LPQCkRM.exe
  2⤵
  PID:3600
- C:\Windows\System\PONCagA.exe
  C:\Windows\System\PONCagA.exe
  2⤵
  PID:1092
- C:\Windows\System\nJNQdUX.exe
  C:\Windows\System\nJNQdUX.exe
  2⤵
  PID:456
- C:\Windows\System\apbVNua.exe
  C:\Windows\System\apbVNua.exe
  2⤵
  PID:1404
- C:\Windows\System\BfSpXWa.exe
  C:\Windows\System\BfSpXWa.exe
  2⤵
  PID:4308
- C:\Windows\System\jkFZfmj.exe
  C:\Windows\System\jkFZfmj.exe
  2⤵
  PID:5128
- C:\Windows\System\pwXpaHf.exe
  C:\Windows\System\pwXpaHf.exe
  2⤵
  PID:5156
- C:\Windows\System\BdQgCuC.exe
  C:\Windows\System\BdQgCuC.exe
  2⤵
  PID:5184
- C:\Windows\System\htwTROS.exe
  C:\Windows\System\htwTROS.exe
  2⤵
  PID:5212
- C:\Windows\System\hrarpUZ.exe
  C:\Windows\System\hrarpUZ.exe
  2⤵
  PID:5240
- C:\Windows\System\XyNDcTL.exe
  C:\Windows\System\XyNDcTL.exe
  2⤵
  PID:5268
- C:\Windows\System\eQoShlk.exe
  C:\Windows\System\eQoShlk.exe
  2⤵
  PID:5296
- C:\Windows\System\mkZxFvg.exe
  C:\Windows\System\mkZxFvg.exe
  2⤵
  PID:5324
- C:\Windows\System\aVSJviO.exe
  C:\Windows\System\aVSJviO.exe
  2⤵
  PID:5344
- C:\Windows\System\QzPkNxO.exe
  C:\Windows\System\QzPkNxO.exe
  2⤵
  PID:5372
- C:\Windows\System\jetzqTL.exe
  C:\Windows\System\jetzqTL.exe
  2⤵
  PID:5396
- C:\Windows\System\iXGlEuy.exe
  C:\Windows\System\iXGlEuy.exe
  2⤵
  PID:5428
- C:\Windows\System\eerdtRR.exe
  C:\Windows\System\eerdtRR.exe
  2⤵
  PID:5456
- C:\Windows\System\wdgwduE.exe
  C:\Windows\System\wdgwduE.exe
  2⤵
  PID:5484
- C:\Windows\System\rKyquZl.exe
  C:\Windows\System\rKyquZl.exe
  2⤵
  PID:5512
- C:\Windows\System\gKlNJrS.exe
  C:\Windows\System\gKlNJrS.exe
  2⤵
  PID:5528
- C:\Windows\System\oHJLree.exe
  C:\Windows\System\oHJLree.exe
  2⤵
  PID:5560
- C:\Windows\System\BiPWnbb.exe
  C:\Windows\System\BiPWnbb.exe
  2⤵
  PID:5584
- C:\Windows\System\FGkfXtP.exe
  C:\Windows\System\FGkfXtP.exe
  2⤵
  PID:5620
- C:\Windows\System\BmUDVlK.exe
  C:\Windows\System\BmUDVlK.exe
  2⤵
  PID:5648
- C:\Windows\System\HLmLrDF.exe
  C:\Windows\System\HLmLrDF.exe
  2⤵
  PID:5668
- C:\Windows\System\xoaHvNE.exe
  C:\Windows\System\xoaHvNE.exe
  2⤵
  PID:5692
- C:\Windows\System\WEQjbuC.exe
  C:\Windows\System\WEQjbuC.exe
  2⤵
  PID:5728
- C:\Windows\System\jEvAlnc.exe
  C:\Windows\System\jEvAlnc.exe
  2⤵
  PID:5752
- C:\Windows\System\tDfbttP.exe
  C:\Windows\System\tDfbttP.exe
  2⤵
  PID:5780
- C:\Windows\System\GxgiAHx.exe
  C:\Windows\System\GxgiAHx.exe
  2⤵
  PID:5812
- C:\Windows\System\dMOEXMJ.exe
  C:\Windows\System\dMOEXMJ.exe
  2⤵
  PID:5872
- C:\Windows\System\QqGLCCk.exe
  C:\Windows\System\QqGLCCk.exe
  2⤵
  PID:5888
- C:\Windows\System\OnlLnxr.exe
  C:\Windows\System\OnlLnxr.exe
  2⤵
  PID:5904
- C:\Windows\System\tFFnigl.exe
  C:\Windows\System\tFFnigl.exe
  2⤵
  PID:5920
- C:\Windows\System\jyPjbQs.exe
  C:\Windows\System\jyPjbQs.exe
  2⤵
  PID:5948
- C:\Windows\System\LgpDxVT.exe
  C:\Windows\System\LgpDxVT.exe
  2⤵
  PID:5968
- C:\Windows\System\lhFZoVo.exe
  C:\Windows\System\lhFZoVo.exe
  2⤵
  PID:5996
- C:\Windows\System\yQcOBlh.exe
  C:\Windows\System\yQcOBlh.exe
  2⤵
  PID:6016
- C:\Windows\System\NMMXLRw.exe
  C:\Windows\System\NMMXLRw.exe
  2⤵
  PID:6036
- C:\Windows\System\ysOjOpL.exe
  C:\Windows\System\ysOjOpL.exe
  2⤵
  PID:6064
- C:\Windows\System\XiObtoe.exe
  C:\Windows\System\XiObtoe.exe
  2⤵
  PID:6088
- C:\Windows\System\VYslInv.exe
  C:\Windows\System\VYslInv.exe
  2⤵
  PID:6104
- C:\Windows\System\tJPCEKq.exe
  C:\Windows\System\tJPCEKq.exe
  2⤵
  PID:6132
- C:\Windows\System\ZGboyzC.exe
  C:\Windows\System\ZGboyzC.exe
  2⤵
  PID:5172
- C:\Windows\System\qMwqSdV.exe
  C:\Windows\System\qMwqSdV.exe
  2⤵
  PID:5236
- C:\Windows\System\fQbWaQd.exe
  C:\Windows\System\fQbWaQd.exe
  2⤵
  PID:5264
- C:\Windows\System\uzaZCVx.exe
  C:\Windows\System\uzaZCVx.exe
  2⤵
  PID:5316
- C:\Windows\System\luaiPHc.exe
  C:\Windows\System\luaiPHc.exe
  2⤵
  PID:5388
- C:\Windows\System\qloWUpx.exe
  C:\Windows\System\qloWUpx.exe
  2⤵
  PID:5440
- C:\Windows\System\jPplFIu.exe
  C:\Windows\System\jPplFIu.exe
  2⤵
  PID:5476
- C:\Windows\System\HMbVcmY.exe
  C:\Windows\System\HMbVcmY.exe
  2⤵
  PID:5592
- C:\Windows\System\ERbzIlu.exe
  C:\Windows\System\ERbzIlu.exe
  2⤵
  PID:4276
- C:\Windows\System\tljimYh.exe
  C:\Windows\System\tljimYh.exe
  2⤵
  PID:5688
- C:\Windows\System\gVqVqSj.exe
  C:\Windows\System\gVqVqSj.exe
  2⤵
  PID:5772
- C:\Windows\System\nvBykUr.exe
  C:\Windows\System\nvBykUr.exe
  2⤵
  PID:5860
- C:\Windows\System\QeoFHWk.exe
  C:\Windows\System\QeoFHWk.exe
  2⤵
  PID:5932
- C:\Windows\System\dBGrtvq.exe
  C:\Windows\System\dBGrtvq.exe
  2⤵
  PID:6004
- C:\Windows\System\yQTncQS.exe
  C:\Windows\System\yQTncQS.exe
  2⤵
  PID:6060
- C:\Windows\System\QyynjxS.exe
  C:\Windows\System\QyynjxS.exe
  2⤵
  PID:5208
- C:\Windows\System\RnpKzSm.exe
  C:\Windows\System\RnpKzSm.exe
  2⤵
  PID:6116
- C:\Windows\System\hhQmlmZ.exe
  C:\Windows\System\hhQmlmZ.exe
  2⤵
  PID:5368
- C:\Windows\System\ujvgOlH.exe
  C:\Windows\System\ujvgOlH.exe
  2⤵
  PID:5508
- C:\Windows\System\nowdKKM.exe
  C:\Windows\System\nowdKKM.exe
  2⤵
  PID:5804
- C:\Windows\System\SqbiQzu.exe
  C:\Windows\System\SqbiQzu.exe
  2⤵
  PID:5740
- C:\Windows\System\rlQOKiZ.exe
  C:\Windows\System\rlQOKiZ.exe
  2⤵
  PID:5936
- C:\Windows\System\LtGrTqM.exe
  C:\Windows\System\LtGrTqM.exe
  2⤵
  PID:5152
- C:\Windows\System\sokDZlf.exe
  C:\Windows\System\sokDZlf.exe
  2⤵
  PID:5580
- C:\Windows\System\jfJMbFy.exe
  C:\Windows\System\jfJMbFy.exe
  2⤵
  PID:5964
- C:\Windows\System\yelDlnO.exe
  C:\Windows\System\yelDlnO.exe
  2⤵
  PID:5144
- C:\Windows\System\kjXjBZt.exe
  C:\Windows\System\kjXjBZt.exe
  2⤵
  PID:6168
- C:\Windows\System\eKRpyGk.exe
  C:\Windows\System\eKRpyGk.exe
  2⤵
  PID:6188
- C:\Windows\System\fAWQeMo.exe
  C:\Windows\System\fAWQeMo.exe
  2⤵
  PID:6212
- C:\Windows\System\NEGlKZr.exe
  C:\Windows\System\NEGlKZr.exe
  2⤵
  PID:6228
- C:\Windows\System\iAHpQzM.exe
  C:\Windows\System\iAHpQzM.exe
  2⤵
  PID:6248
- C:\Windows\System\GKbGJZf.exe
  C:\Windows\System\GKbGJZf.exe
  2⤵
  PID:6284
- C:\Windows\System\ORoAFUc.exe
  C:\Windows\System\ORoAFUc.exe
  2⤵
  PID:6304
- C:\Windows\System\XkJypNn.exe
  C:\Windows\System\XkJypNn.exe
  2⤵
  PID:6328
- C:\Windows\System\LwCENiX.exe
  C:\Windows\System\LwCENiX.exe
  2⤵
  PID:6352
- C:\Windows\System\XObrvMn.exe
  C:\Windows\System\XObrvMn.exe
  2⤵
  PID:6376
- C:\Windows\System\IUOToIi.exe
  C:\Windows\System\IUOToIi.exe
  2⤵
  PID:6396
- C:\Windows\System\WrWjsYD.exe
  C:\Windows\System\WrWjsYD.exe
  2⤵
  PID:6412
- C:\Windows\System\ECfITzO.exe
  C:\Windows\System\ECfITzO.exe
  2⤵
  PID:6440
- C:\Windows\System\QxCopbi.exe
  C:\Windows\System\QxCopbi.exe
  2⤵
  PID:6468
- C:\Windows\System\hgjicOl.exe
  C:\Windows\System\hgjicOl.exe
  2⤵
  PID:6484
- C:\Windows\System\IrDQaEc.exe
  C:\Windows\System\IrDQaEc.exe
  2⤵
  PID:6500
- C:\Windows\System\JGdZksE.exe
  C:\Windows\System\JGdZksE.exe
  2⤵
  PID:6520
- C:\Windows\System\edibLCS.exe
  C:\Windows\System\edibLCS.exe
  2⤵
  PID:6544
- C:\Windows\System\dxupSmJ.exe
  C:\Windows\System\dxupSmJ.exe
  2⤵
  PID:6608
- C:\Windows\System\DrAsViy.exe
  C:\Windows\System\DrAsViy.exe
  2⤵
  PID:6640
- C:\Windows\System\ljKHYdj.exe
  C:\Windows\System\ljKHYdj.exe
  2⤵
  PID:6668
- C:\Windows\System\XlGSJcZ.exe
  C:\Windows\System\XlGSJcZ.exe
  2⤵
  PID:6700
- C:\Windows\System\flsMOuP.exe
  C:\Windows\System\flsMOuP.exe
  2⤵
  PID:6736
- C:\Windows\System\fIpohSL.exe
  C:\Windows\System\fIpohSL.exe
  2⤵
  PID:6764
- C:\Windows\System\WAWArgV.exe
  C:\Windows\System\WAWArgV.exe
  2⤵
  PID:6800
- C:\Windows\System\zhBvrAl.exe
  C:\Windows\System\zhBvrAl.exe
  2⤵
  PID:6820
- C:\Windows\System\IxBEIdr.exe
  C:\Windows\System\IxBEIdr.exe
  2⤵
  PID:6844
- C:\Windows\System\fQXaYnj.exe
  C:\Windows\System\fQXaYnj.exe
  2⤵
  PID:6868
- C:\Windows\System\TpDOPSy.exe
  C:\Windows\System\TpDOPSy.exe
  2⤵
  PID:6896
- C:\Windows\System\YPWMsuk.exe
  C:\Windows\System\YPWMsuk.exe
  2⤵
  PID:6924
- C:\Windows\System\jWlAZah.exe
  C:\Windows\System\jWlAZah.exe
  2⤵
  PID:6952
- C:\Windows\System\gBrHjlW.exe
  C:\Windows\System\gBrHjlW.exe
  2⤵
  PID:6984
- C:\Windows\System\VmTMKrL.exe
  C:\Windows\System\VmTMKrL.exe
  2⤵
  PID:7008
- C:\Windows\System\PnsDxJa.exe
  C:\Windows\System\PnsDxJa.exe
  2⤵
  PID:7040
- C:\Windows\System\zcijojw.exe
  C:\Windows\System\zcijojw.exe
  2⤵
  PID:7068
- C:\Windows\System\xQImajO.exe
  C:\Windows\System\xQImajO.exe
  2⤵
  PID:7088
- C:\Windows\System\zwnWoGr.exe
  C:\Windows\System\zwnWoGr.exe
  2⤵
  PID:7120
- C:\Windows\System\lASeeqe.exe
  C:\Windows\System\lASeeqe.exe
  2⤵
  PID:7140
- C:\Windows\System\JmoWDki.exe
  C:\Windows\System\JmoWDki.exe
  2⤵
  PID:5768
- C:\Windows\System\UTDECxg.exe
  C:\Windows\System\UTDECxg.exe
  2⤵
  PID:3480
- C:\Windows\System\LyDUKkI.exe
  C:\Windows\System\LyDUKkI.exe
  2⤵
  PID:6208
- C:\Windows\System\kgpbjsz.exe
  C:\Windows\System\kgpbjsz.exe
  2⤵
  PID:6200
- C:\Windows\System\tGZsxmc.exe
  C:\Windows\System\tGZsxmc.exe
  2⤵
  PID:6272
- C:\Windows\System\CBqwtwL.exe
  C:\Windows\System\CBqwtwL.exe
  2⤵
  PID:6388
- C:\Windows\System\oEvpCuJ.exe
  C:\Windows\System\oEvpCuJ.exe
  2⤵
  PID:6408
- C:\Windows\System\OSBGIuQ.exe
  C:\Windows\System\OSBGIuQ.exe
  2⤵
  PID:6476
- C:\Windows\System\XhiRKaQ.exe
  C:\Windows\System\XhiRKaQ.exe
  2⤵
  PID:6692
- C:\Windows\System\wUbtRhy.exe
  C:\Windows\System\wUbtRhy.exe
  2⤵
  PID:6604
- C:\Windows\System\cIIToXY.exe
  C:\Windows\System\cIIToXY.exe
  2⤵
  PID:6816
- C:\Windows\System\LNSpFpC.exe
  C:\Windows\System\LNSpFpC.exe
  2⤵
  PID:7084
- C:\Windows\System\AOwtMWO.exe
  C:\Windows\System\AOwtMWO.exe
  2⤵
  PID:7136
- C:\Windows\System\niJySsF.exe
  C:\Windows\System\niJySsF.exe
  2⤵
  PID:7112
- C:\Windows\System\SJgClkQ.exe
  C:\Windows\System\SJgClkQ.exe
  2⤵
  PID:6244
- C:\Windows\System\zrPzkzC.exe
  C:\Windows\System\zrPzkzC.exe
  2⤵
  PID:6316
- C:\Windows\System\GTUduNd.exe
  C:\Windows\System\GTUduNd.exe
  2⤵
  PID:6224
- C:\Windows\System\wjtHTgS.exe
  C:\Windows\System\wjtHTgS.exe
  2⤵
  PID:6676
- C:\Windows\System\VnSLExt.exe
  C:\Windows\System\VnSLExt.exe
  2⤵
  PID:6908
- C:\Windows\System\obrFdpZ.exe
  C:\Windows\System\obrFdpZ.exe
  2⤵
  PID:6836
- C:\Windows\System\XWZQprW.exe
  C:\Windows\System\XWZQprW.exe
  2⤵
  PID:6996
- C:\Windows\System\xNtkoAR.exe
  C:\Windows\System\xNtkoAR.exe
  2⤵
  PID:7164
- C:\Windows\System\Vlwehpu.exe
  C:\Windows\System\Vlwehpu.exe
  2⤵
  PID:6296
- C:\Windows\System\UnwqWSe.exe
  C:\Windows\System\UnwqWSe.exe
  2⤵
  PID:6688
- C:\Windows\System\KGBDywd.exe
  C:\Windows\System\KGBDywd.exe
  2⤵
  PID:6204
- C:\Windows\System\ssmHpfD.exe
  C:\Windows\System\ssmHpfD.exe
  2⤵
  PID:7176
- C:\Windows\System\nMVsvcb.exe
  C:\Windows\System\nMVsvcb.exe
  2⤵
  PID:7204
- C:\Windows\System\YUYtZuW.exe
  C:\Windows\System\YUYtZuW.exe
  2⤵
  PID:7224
- C:\Windows\System\LqIGBBs.exe
  C:\Windows\System\LqIGBBs.exe
  2⤵
  PID:7256
- C:\Windows\System\dDtqyba.exe
  C:\Windows\System\dDtqyba.exe
  2⤵
  PID:7304
- C:\Windows\System\EJVwoxf.exe
  C:\Windows\System\EJVwoxf.exe
  2⤵
  PID:7332
- C:\Windows\System\otxmSHE.exe
  C:\Windows\System\otxmSHE.exe
  2⤵
  PID:7364
- C:\Windows\System\WQYDzMU.exe
  C:\Windows\System\WQYDzMU.exe
  2⤵
  PID:7392
- C:\Windows\System\uDqVwiC.exe
  C:\Windows\System\uDqVwiC.exe
  2⤵
  PID:7420
- C:\Windows\System\ZEucskr.exe
  C:\Windows\System\ZEucskr.exe
  2⤵
  PID:7496
- C:\Windows\System\UckHzFv.exe
  C:\Windows\System\UckHzFv.exe
  2⤵
  PID:7512
- C:\Windows\System\NBIKKUj.exe
  C:\Windows\System\NBIKKUj.exe
  2⤵
  PID:7540
- C:\Windows\System\LzzlKjc.exe
  C:\Windows\System\LzzlKjc.exe
  2⤵
  PID:7568
- C:\Windows\System\yTNZmyu.exe
  C:\Windows\System\yTNZmyu.exe
  2⤵
  PID:7584
- C:\Windows\System\rhTAhrV.exe
  C:\Windows\System\rhTAhrV.exe
  2⤵
  PID:7624
- C:\Windows\System\OtDOxNF.exe
  C:\Windows\System\OtDOxNF.exe
  2⤵
  PID:7656
- C:\Windows\System\jjOWbnn.exe
  C:\Windows\System\jjOWbnn.exe
  2⤵
  PID:7684
- C:\Windows\System\pwKDrSx.exe
  C:\Windows\System\pwKDrSx.exe
  2⤵
  PID:7728
- C:\Windows\System\TSxOlYV.exe
  C:\Windows\System\TSxOlYV.exe
  2⤵
  PID:7748
- C:\Windows\System\ETQwQth.exe
  C:\Windows\System\ETQwQth.exe
  2⤵
  PID:7776
- C:\Windows\System\kBcFtxK.exe
  C:\Windows\System\kBcFtxK.exe
  2⤵
  PID:7796
- C:\Windows\System\gWJZBUo.exe
  C:\Windows\System\gWJZBUo.exe
  2⤵
  PID:7820
- C:\Windows\System\vHbmofh.exe
  C:\Windows\System\vHbmofh.exe
  2⤵
  PID:7844
- C:\Windows\System\hhfPKqN.exe
  C:\Windows\System\hhfPKqN.exe
  2⤵
  PID:7860
- C:\Windows\System\sKZKpte.exe
  C:\Windows\System\sKZKpte.exe
  2⤵
  PID:7880
- C:\Windows\System\LsKxNOF.exe
  C:\Windows\System\LsKxNOF.exe
  2⤵
  PID:7952
- C:\Windows\System\mREoNZN.exe
  C:\Windows\System\mREoNZN.exe
  2⤵
  PID:7980
- C:\Windows\System\LdWakHk.exe
  C:\Windows\System\LdWakHk.exe
  2⤵
  PID:8004
- C:\Windows\System\hIqgjxH.exe
  C:\Windows\System\hIqgjxH.exe
  2⤵
  PID:8028
- C:\Windows\System\ChAnPXV.exe
  C:\Windows\System\ChAnPXV.exe
  2⤵
  PID:8064
- C:\Windows\System\skwhZSx.exe
  C:\Windows\System\skwhZSx.exe
  2⤵
  PID:8088
- C:\Windows\System\YqmYfbu.exe
  C:\Windows\System\YqmYfbu.exe
  2⤵
  PID:8116
- C:\Windows\System\ZJtBWPu.exe
  C:\Windows\System\ZJtBWPu.exe
  2⤵
  PID:8144
- C:\Windows\System\JCwVhGJ.exe
  C:\Windows\System\JCwVhGJ.exe
  2⤵
  PID:8172
- C:\Windows\System\NxybtJM.exe
  C:\Windows\System\NxybtJM.exe
  2⤵
  PID:6784
- C:\Windows\System\LpyUauC.exe
  C:\Windows\System\LpyUauC.exe
  2⤵
  PID:7188
- C:\Windows\System\IEvZZPC.exe
  C:\Windows\System\IEvZZPC.exe
  2⤵
  PID:7216
- C:\Windows\System\xDrfhsU.exe
  C:\Windows\System\xDrfhsU.exe
  2⤵
  PID:7328
- C:\Windows\System\dGUTRtT.exe
  C:\Windows\System\dGUTRtT.exe
  2⤵
  PID:7412
- C:\Windows\System\lMDUvQF.exe
  C:\Windows\System\lMDUvQF.exe
  2⤵
  PID:7456
- C:\Windows\System\NKokCcj.exe
  C:\Windows\System\NKokCcj.exe
  2⤵
  PID:7524
- C:\Windows\System\UeopJfi.exe
  C:\Windows\System\UeopJfi.exe
  2⤵
  PID:7564
- C:\Windows\System\LPGkenk.exe
  C:\Windows\System\LPGkenk.exe
  2⤵
  PID:7644
- C:\Windows\System\zrgnBAm.exe
  C:\Windows\System\zrgnBAm.exe
  2⤵
  PID:7720
- C:\Windows\System\bEaZIUr.exe
  C:\Windows\System\bEaZIUr.exe
  2⤵
  PID:3604
- C:\Windows\System\AJhbzvF.exe
  C:\Windows\System\AJhbzvF.exe
  2⤵
  PID:7792
- C:\Windows\System\ZjngJZF.exe
  C:\Windows\System\ZjngJZF.exe
  2⤵
  PID:7832
- C:\Windows\System\KmyTyIV.exe
  C:\Windows\System\KmyTyIV.exe
  2⤵
  PID:8016
- C:\Windows\System\SWfSmDQ.exe
  C:\Windows\System\SWfSmDQ.exe
  2⤵
  PID:8056
- C:\Windows\System\xVfRhFR.exe
  C:\Windows\System\xVfRhFR.exe
  2⤵
  PID:8136
- C:\Windows\System\RFoQZio.exe
  C:\Windows\System\RFoQZio.exe
  2⤵
  PID:6348
- C:\Windows\System\qLfGCBl.exe
  C:\Windows\System\qLfGCBl.exe
  2⤵
  PID:7348
- C:\Windows\System\adaseKn.exe
  C:\Windows\System\adaseKn.exe
  2⤵
  PID:7384
- C:\Windows\System\EyFGXms.exe
  C:\Windows\System\EyFGXms.exe
  2⤵
  PID:6372
- C:\Windows\System\cBFPZzv.exe
  C:\Windows\System\cBFPZzv.exe
  2⤵
  PID:7816
- C:\Windows\System\symMPNL.exe
  C:\Windows\System\symMPNL.exe
  2⤵
  PID:7808
- C:\Windows\System\KtKOCIO.exe
  C:\Windows\System\KtKOCIO.exe
  2⤵
  PID:7872
- C:\Windows\System\AleWFdn.exe
  C:\Windows\System\AleWFdn.exe
  2⤵
  PID:8012
- C:\Windows\System\RLAUPwj.exe
  C:\Windows\System\RLAUPwj.exe
  2⤵
  PID:7312
- C:\Windows\System\DiqiHmg.exe
  C:\Windows\System\DiqiHmg.exe
  2⤵
  PID:7436
- C:\Windows\System\fkjuJyZ.exe
  C:\Windows\System\fkjuJyZ.exe
  2⤵
  PID:7444
- C:\Windows\System\CdMXxHJ.exe
  C:\Windows\System\CdMXxHJ.exe
  2⤵
  PID:8196
- C:\Windows\System\AvgOwyq.exe
  C:\Windows\System\AvgOwyq.exe
  2⤵
  PID:8220
- C:\Windows\System\uYDwXIc.exe
  C:\Windows\System\uYDwXIc.exe
  2⤵
  PID:8244
- C:\Windows\System\hKyQcMG.exe
  C:\Windows\System\hKyQcMG.exe
  2⤵
  PID:8268
- C:\Windows\System\LkhtXqc.exe
  C:\Windows\System\LkhtXqc.exe
  2⤵
  PID:8296
- C:\Windows\System\zNMcWCs.exe
  C:\Windows\System\zNMcWCs.exe
  2⤵
  PID:8352
- C:\Windows\System\WxpukHy.exe
  C:\Windows\System\WxpukHy.exe
  2⤵
  PID:8424
- C:\Windows\System\ibdOQUs.exe
  C:\Windows\System\ibdOQUs.exe
  2⤵
  PID:8456
- C:\Windows\System\xuSkhOj.exe
  C:\Windows\System\xuSkhOj.exe
  2⤵
  PID:8472
- C:\Windows\System\IMooUHv.exe
  C:\Windows\System\IMooUHv.exe
  2⤵
  PID:8496
- C:\Windows\System\bBeIAdj.exe
  C:\Windows\System\bBeIAdj.exe
  2⤵
  PID:8520
- C:\Windows\System\oasZLyT.exe
  C:\Windows\System\oasZLyT.exe
  2⤵
  PID:8548
- C:\Windows\System\tRMyCef.exe
  C:\Windows\System\tRMyCef.exe
  2⤵
  PID:8572
- C:\Windows\System\uwmpZSK.exe
  C:\Windows\System\uwmpZSK.exe
  2⤵
  PID:8604
- C:\Windows\System\seLFTCK.exe
  C:\Windows\System\seLFTCK.exe
  2⤵
  PID:8620
- C:\Windows\System\gEeCGqF.exe
  C:\Windows\System\gEeCGqF.exe
  2⤵
  PID:8660
- C:\Windows\System\SUHLpMP.exe
  C:\Windows\System\SUHLpMP.exe
  2⤵
  PID:8676
- C:\Windows\System\sEfAmxR.exe
  C:\Windows\System\sEfAmxR.exe
  2⤵
  PID:8696
- C:\Windows\System\rAwhRBQ.exe
  C:\Windows\System\rAwhRBQ.exe
  2⤵
  PID:8720
- C:\Windows\System\UXHZExk.exe
  C:\Windows\System\UXHZExk.exe
  2⤵
  PID:8740
- C:\Windows\System\LTcANQt.exe
  C:\Windows\System\LTcANQt.exe
  2⤵
  PID:8772
- C:\Windows\System\FZOYqVo.exe
  C:\Windows\System\FZOYqVo.exe
  2⤵
  PID:8804
- C:\Windows\System\aaNnSmP.exe
  C:\Windows\System\aaNnSmP.exe
  2⤵
  PID:8832
- C:\Windows\System\txeJoxW.exe
  C:\Windows\System\txeJoxW.exe
  2⤵
  PID:8892
- C:\Windows\System\FCITTpL.exe
  C:\Windows\System\FCITTpL.exe
  2⤵
  PID:8928
- C:\Windows\System\NZojURT.exe
  C:\Windows\System\NZojURT.exe
  2⤵
  PID:8948
- C:\Windows\System\TPTRVmo.exe
  C:\Windows\System\TPTRVmo.exe
  2⤵
  PID:9016
- C:\Windows\System\AQyFOtC.exe
  C:\Windows\System\AQyFOtC.exe
  2⤵
  PID:9056
- C:\Windows\System\BHPuSId.exe
  C:\Windows\System\BHPuSId.exe
  2⤵
  PID:9080
- C:\Windows\System\aiuMWWk.exe
  C:\Windows\System\aiuMWWk.exe
  2⤵
  PID:9100
- C:\Windows\System\IBMlAua.exe
  C:\Windows\System\IBMlAua.exe
  2⤵
  PID:9128
- C:\Windows\System\LWjupzP.exe
  C:\Windows\System\LWjupzP.exe
  2⤵
  PID:9156
- C:\Windows\System\ltpgdey.exe
  C:\Windows\System\ltpgdey.exe
  2⤵
  PID:9176
- C:\Windows\System\yqmkrdo.exe
  C:\Windows\System\yqmkrdo.exe
  2⤵
  PID:9208
- C:\Windows\System\qkJLrFn.exe
  C:\Windows\System\qkJLrFn.exe
  2⤵
  PID:7812
- C:\Windows\System\VVbpiAv.exe
  C:\Windows\System\VVbpiAv.exe
  2⤵
  PID:7960
- C:\Windows\System\RtndeJG.exe
  C:\Windows\System\RtndeJG.exe
  2⤵
  PID:8256
- C:\Windows\System\gRhlEOR.exe
  C:\Windows\System\gRhlEOR.exe
  2⤵
  PID:8332
- C:\Windows\System\FahuBMb.exe
  C:\Windows\System\FahuBMb.exe
  2⤵
  PID:8492
- C:\Windows\System\oWsOvOi.exe
  C:\Windows\System\oWsOvOi.exe
  2⤵
  PID:8512
- C:\Windows\System\ZnCyqvf.exe
  C:\Windows\System\ZnCyqvf.exe
  2⤵
  PID:8564
- C:\Windows\System\aJLJtWT.exe
  C:\Windows\System\aJLJtWT.exe
  2⤵
  PID:8656
- C:\Windows\System\zgwJRhh.exe
  C:\Windows\System\zgwJRhh.exe
  2⤵
  PID:8688
- C:\Windows\System\YNqAcsJ.exe
  C:\Windows\System\YNqAcsJ.exe
  2⤵
  PID:8668
- C:\Windows\System\msqJiXf.exe
  C:\Windows\System\msqJiXf.exe
  2⤵
  PID:8732
- C:\Windows\System\ngpVoqJ.exe
  C:\Windows\System\ngpVoqJ.exe
  2⤵
  PID:8816
- C:\Windows\System\IYScxra.exe
  C:\Windows\System\IYScxra.exe
  2⤵
  PID:8920
- C:\Windows\System\hszyOPI.exe
  C:\Windows\System\hszyOPI.exe
  2⤵
  PID:9004
- C:\Windows\System\aWvVttD.exe
  C:\Windows\System\aWvVttD.exe
  2⤵
  PID:9164
- C:\Windows\System\GBFnqut.exe
  C:\Windows\System\GBFnqut.exe
  2⤵
  PID:9184
- C:\Windows\System\eesAqNq.exe
  C:\Windows\System\eesAqNq.exe
  2⤵
  PID:8420
- C:\Windows\System\fETPXwA.exe
  C:\Windows\System\fETPXwA.exe
  2⤵
  PID:2344
- C:\Windows\System\eQMikqZ.exe
  C:\Windows\System\eQMikqZ.exe
  2⤵
  PID:8616
- C:\Windows\System\bfrxnMz.exe
  C:\Windows\System\bfrxnMz.exe
  2⤵
  PID:8884
- C:\Windows\System\DYCIYRV.exe
  C:\Windows\System\DYCIYRV.exe
  2⤵
  PID:8872
- C:\Windows\System\Omwegjh.exe
  C:\Windows\System\Omwegjh.exe
  2⤵
  PID:8540
- C:\Windows\System\wwKLSet.exe
  C:\Windows\System\wwKLSet.exe
  2⤵
  PID:8764
- C:\Windows\System\zjyRXqq.exe
  C:\Windows\System\zjyRXqq.exe
  2⤵
  PID:8904
- C:\Windows\System\iXFSDVt.exe
  C:\Windows\System\iXFSDVt.exe
  2⤵
  PID:8252
- C:\Windows\System\HDSRCWq.exe
  C:\Windows\System\HDSRCWq.exe
  2⤵
  PID:9224
- C:\Windows\System\QcIcVxk.exe
  C:\Windows\System\QcIcVxk.exe
  2⤵
  PID:9244
- C:\Windows\System\nqmWLsU.exe
  C:\Windows\System\nqmWLsU.exe
  2⤵
  PID:9264
- C:\Windows\System\uWzuhXP.exe
  C:\Windows\System\uWzuhXP.exe
  2⤵
  PID:9284
- C:\Windows\System\pVznEAt.exe
  C:\Windows\System\pVznEAt.exe
  2⤵
  PID:9300
- C:\Windows\System\GRBFAXv.exe
  C:\Windows\System\GRBFAXv.exe
  2⤵
  PID:9332
- C:\Windows\System\NCcbmvb.exe
  C:\Windows\System\NCcbmvb.exe
  2⤵
  PID:9396
- C:\Windows\System\mbnInXn.exe
  C:\Windows\System\mbnInXn.exe
  2⤵
  PID:9424
- C:\Windows\System\Rthupvu.exe
  C:\Windows\System\Rthupvu.exe
  2⤵
  PID:9476
- C:\Windows\System\IZCAqtK.exe
  C:\Windows\System\IZCAqtK.exe
  2⤵
  PID:9504
- C:\Windows\System\OozGynZ.exe
  C:\Windows\System\OozGynZ.exe
  2⤵
  PID:9532
- C:\Windows\System\wEmvnwl.exe
  C:\Windows\System\wEmvnwl.exe
  2⤵
  PID:9560
- C:\Windows\System\IybRdmu.exe
  C:\Windows\System\IybRdmu.exe
  2⤵
  PID:9580
- C:\Windows\System\wgGNbop.exe
  C:\Windows\System\wgGNbop.exe
  2⤵
  PID:9608
- C:\Windows\System\TftDORL.exe
  C:\Windows\System\TftDORL.exe
  2⤵
  PID:9628
- C:\Windows\System\EUuBgqG.exe
  C:\Windows\System\EUuBgqG.exe
  2⤵
  PID:9648
- C:\Windows\System\sxpauHB.exe
  C:\Windows\System\sxpauHB.exe
  2⤵
  PID:9664
- C:\Windows\System\Bgrkvkq.exe
  C:\Windows\System\Bgrkvkq.exe
  2⤵
  PID:9680
- C:\Windows\System\YHVbObV.exe
  C:\Windows\System\YHVbObV.exe
  2⤵
  PID:9704
- C:\Windows\System\andvuiT.exe
  C:\Windows\System\andvuiT.exe
  2⤵
  PID:9720
- C:\Windows\System\dLWFdeR.exe
  C:\Windows\System\dLWFdeR.exe
  2⤵
  PID:9744
- C:\Windows\System\iqwexfe.exe
  C:\Windows\System\iqwexfe.exe
  2⤵
  PID:9764
- C:\Windows\System\FAGaAhr.exe
  C:\Windows\System\FAGaAhr.exe
  2⤵
  PID:9784
- C:\Windows\System\tpTbAMD.exe
  C:\Windows\System\tpTbAMD.exe
  2⤵
  PID:9812
- C:\Windows\System\AsxNdBL.exe
  C:\Windows\System\AsxNdBL.exe
  2⤵
  PID:9832
- C:\Windows\System\spEFKRd.exe
  C:\Windows\System\spEFKRd.exe
  2⤵
  PID:9860
- C:\Windows\System\DmMMqmy.exe
  C:\Windows\System\DmMMqmy.exe
  2⤵
  PID:9888
- C:\Windows\System\ideQBBD.exe
  C:\Windows\System\ideQBBD.exe
  2⤵
  PID:9924
- C:\Windows\System\rYFkCsu.exe
  C:\Windows\System\rYFkCsu.exe
  2⤵
  PID:9952
- C:\Windows\System\dBjviYr.exe
  C:\Windows\System\dBjviYr.exe
  2⤵
  PID:9968
- C:\Windows\System\KXVRcQr.exe
  C:\Windows\System\KXVRcQr.exe
  2⤵
  PID:9992
- C:\Windows\System\hbBjKKF.exe
  C:\Windows\System\hbBjKKF.exe
  2⤵
  PID:10016
- C:\Windows\System\WmyigMr.exe
  C:\Windows\System\WmyigMr.exe
  2⤵
  PID:10048
- C:\Windows\System\jURlJKM.exe
  C:\Windows\System\jURlJKM.exe
  2⤵
  PID:10076
- C:\Windows\System\aSlwCUn.exe
  C:\Windows\System\aSlwCUn.exe
  2⤵
  PID:10104
- C:\Windows\System\kJdJgEm.exe
  C:\Windows\System\kJdJgEm.exe
  2⤵
  PID:10128
- C:\Windows\System\mqSTWRa.exe
  C:\Windows\System\mqSTWRa.exe
  2⤵
  PID:10188
- C:\Windows\System\KWxOzrM.exe
  C:\Windows\System\KWxOzrM.exe
  2⤵
  PID:10224
- C:\Windows\System\DUnouuQ.exe
  C:\Windows\System\DUnouuQ.exe
  2⤵
  PID:3460
- C:\Windows\System\QEhFbaQ.exe
  C:\Windows\System\QEhFbaQ.exe
  2⤵
  PID:8612
- C:\Windows\System\wNgdfei.exe
  C:\Windows\System\wNgdfei.exe
  2⤵
  PID:9376
- C:\Windows\System\yVXAzgP.exe
  C:\Windows\System\yVXAzgP.exe
  2⤵
  PID:9492
- C:\Windows\System\Emezhyy.exe
  C:\Windows\System\Emezhyy.exe
  2⤵
  PID:1496
- C:\Windows\System\GzUhZkx.exe
  C:\Windows\System\GzUhZkx.exe
  2⤵
  PID:9596
- C:\Windows\System\sGGvnSa.exe
  C:\Windows\System\sGGvnSa.exe
  2⤵
  PID:9752
- C:\Windows\System\fSUKgBQ.exe
  C:\Windows\System\fSUKgBQ.exe
  2⤵
  PID:9824
- C:\Windows\System\vAwViOI.exe
  C:\Windows\System\vAwViOI.exe
  2⤵
  PID:9884
- C:\Windows\System\QCTOeOL.exe
  C:\Windows\System\QCTOeOL.exe
  2⤵
  PID:10172
- C:\Windows\System\OsDGOKI.exe
  C:\Windows\System\OsDGOKI.exe
  2⤵
  PID:10184
- C:\Windows\System\tVGQCMw.exe
  C:\Windows\System\tVGQCMw.exe
  2⤵
  PID:10012
- C:\Windows\System\ncuMctO.exe
  C:\Windows\System\ncuMctO.exe
  2⤵
  PID:10064
- C:\Windows\System\TFslSEz.exe
  C:\Windows\System\TFslSEz.exe
  2⤵
  PID:9292
- C:\Windows\System\PKeNmKM.exe
  C:\Windows\System\PKeNmKM.exe
  2⤵
  PID:9468
- C:\Windows\System\TvApLmr.exe
  C:\Windows\System\TvApLmr.exe
  2⤵
  PID:9556
- C:\Windows\System\tiWMsmC.exe
  C:\Windows\System\tiWMsmC.exe
  2⤵
  PID:9640
- C:\Windows\System\mMUbkzm.exe
  C:\Windows\System\mMUbkzm.exe
  2⤵
  PID:9624
- C:\Windows\System\HaaSJzm.exe
  C:\Windows\System\HaaSJzm.exe
  2⤵
  PID:9780
- C:\Windows\System\ppnxyQF.exe
  C:\Windows\System\ppnxyQF.exe
  2⤵
  PID:652
- C:\Windows\System\OTdWstR.exe
  C:\Windows\System\OTdWstR.exe
  2⤵
  PID:1816
- C:\Windows\System\ittQbXI.exe
  C:\Windows\System\ittQbXI.exe
  2⤵
  PID:4828
- C:\Windows\System\CCYyNxC.exe
  C:\Windows\System\CCYyNxC.exe
  2⤵
  PID:2636
- C:\Windows\System\DCXBhUI.exe
  C:\Windows\System\DCXBhUI.exe
  2⤵
  PID:2208
- C:\Windows\System\NtuPurm.exe
  C:\Windows\System\NtuPurm.exe
  2⤵
  PID:10120
- C:\Windows\System\dmuzGFH.exe
  C:\Windows\System\dmuzGFH.exe
  2⤵
  PID:5068
- C:\Windows\System\XeSWymt.exe
  C:\Windows\System\XeSWymt.exe
  2⤵
  PID:9072
- C:\Windows\System\pmzNoZd.exe
  C:\Windows\System\pmzNoZd.exe
  2⤵
  PID:10084
- C:\Windows\System\aLanWDs.exe
  C:\Windows\System\aLanWDs.exe
  2⤵
  PID:9736
- C:\Windows\System\DHwbMas.exe
  C:\Windows\System\DHwbMas.exe
  2⤵
  PID:9940
- C:\Windows\System\QsAcePs.exe
  C:\Windows\System\QsAcePs.exe
  2⤵
  PID:9876
- C:\Windows\System\satkFea.exe
  C:\Windows\System\satkFea.exe
  2⤵
  PID:9912
- C:\Windows\System\BGfGlXr.exe
  C:\Windows\System\BGfGlXr.exe
  2⤵
  PID:10268
- C:\Windows\System\yQAICvZ.exe
  C:\Windows\System\yQAICvZ.exe
  2⤵
  PID:10296
- C:\Windows\System\rjUBCpU.exe
  C:\Windows\System\rjUBCpU.exe
  2⤵
  PID:10324
- C:\Windows\System\JJpfssH.exe
  C:\Windows\System\JJpfssH.exe
  2⤵
  PID:10348
- C:\Windows\System\CFuopXy.exe
  C:\Windows\System\CFuopXy.exe
  2⤵
  PID:10380
- C:\Windows\System\EjyMTnW.exe
  C:\Windows\System\EjyMTnW.exe
  2⤵
  PID:10408
- C:\Windows\System\njSIczD.exe
  C:\Windows\System\njSIczD.exe
  2⤵
  PID:10464
- C:\Windows\System\aiXQNlA.exe
  C:\Windows\System\aiXQNlA.exe
  2⤵
  PID:10484
- C:\Windows\System\dazDwFJ.exe
  C:\Windows\System\dazDwFJ.exe
  2⤵
  PID:10516
- C:\Windows\System\CafkSnt.exe
  C:\Windows\System\CafkSnt.exe
  2⤵
  PID:10540
- C:\Windows\System\rEOgzqt.exe
  C:\Windows\System\rEOgzqt.exe
  2⤵
  PID:10572
- C:\Windows\System\RiMFyKp.exe
  C:\Windows\System\RiMFyKp.exe
  2⤵
  PID:10604
- C:\Windows\System\KPesaww.exe
  C:\Windows\System\KPesaww.exe
  2⤵
  PID:10624
- C:\Windows\System\nQDJddF.exe
  C:\Windows\System\nQDJddF.exe
  2⤵
  PID:10656
- C:\Windows\System\UBoIbpR.exe
  C:\Windows\System\UBoIbpR.exe
  2⤵
  PID:10716
- C:\Windows\System\ITZiSpq.exe
  C:\Windows\System\ITZiSpq.exe
  2⤵
  PID:10740
- C:\Windows\System\rQKROUr.exe
  C:\Windows\System\rQKROUr.exe
  2⤵
  PID:10764
- C:\Windows\System\YzgRJAh.exe
  C:\Windows\System\YzgRJAh.exe
  2⤵
  PID:10796
- C:\Windows\System\DQyTPHz.exe
  C:\Windows\System\DQyTPHz.exe
  2⤵
  PID:10812
- C:\Windows\System\TNBodrZ.exe
  C:\Windows\System\TNBodrZ.exe
  2⤵
  PID:10856
- C:\Windows\System\CectEMz.exe
  C:\Windows\System\CectEMz.exe
  2⤵
  PID:10908
- C:\Windows\System\NAqCALc.exe
  C:\Windows\System\NAqCALc.exe
  2⤵
  PID:10932
- C:\Windows\System\akWCach.exe
  C:\Windows\System\akWCach.exe
  2⤵
  PID:10956
- C:\Windows\System\oJxDpGJ.exe
  C:\Windows\System\oJxDpGJ.exe
  2⤵
  PID:10980
- C:\Windows\System\CpaAJuM.exe
  C:\Windows\System\CpaAJuM.exe
  2⤵
  PID:11004
- C:\Windows\System\AYljOGv.exe
  C:\Windows\System\AYljOGv.exe
  2⤵
  PID:11024
- C:\Windows\System\OhSHjVf.exe
  C:\Windows\System\OhSHjVf.exe
  2⤵
  PID:11072
- C:\Windows\System\WzOMaET.exe
  C:\Windows\System\WzOMaET.exe
  2⤵
  PID:11092
- C:\Windows\System\zAFPIBJ.exe
  C:\Windows\System\zAFPIBJ.exe
  2⤵
  PID:11120
- C:\Windows\System\OOSjlkc.exe
  C:\Windows\System\OOSjlkc.exe
  2⤵
  PID:11144
- C:\Windows\System\FQWCVsB.exe
  C:\Windows\System\FQWCVsB.exe
  2⤵
  PID:11160
- C:\Windows\System\yWJqejk.exe
  C:\Windows\System\yWJqejk.exe
  2⤵
  PID:11188
- C:\Windows\System\XpwVBwu.exe
  C:\Windows\System\XpwVBwu.exe
  2⤵
  PID:11216
- C:\Windows\System\rfLmZEg.exe
  C:\Windows\System\rfLmZEg.exe
  2⤵
  PID:11244
- C:\Windows\System\tmdbgHz.exe
  C:\Windows\System\tmdbgHz.exe
  2⤵
  PID:1968
- C:\Windows\System\cEdmtqs.exe
  C:\Windows\System\cEdmtqs.exe
  2⤵
  PID:10248
- C:\Windows\System\YycIBjv.exe
  C:\Windows\System\YycIBjv.exe
  2⤵
  PID:10344
- C:\Windows\System\aAWNKmA.exe
  C:\Windows\System\aAWNKmA.exe
  2⤵
  PID:10364
- C:\Windows\System\BYzvWmx.exe
  C:\Windows\System\BYzvWmx.exe
  2⤵
  PID:10340
- C:\Windows\System\squDGhu.exe
  C:\Windows\System\squDGhu.exe
  2⤵
  PID:10548
- C:\Windows\System\WzmNDLu.exe
  C:\Windows\System\WzmNDLu.exe
  2⤵
  PID:10588
- C:\Windows\System\TTbdxzS.exe
  C:\Windows\System\TTbdxzS.exe
  2⤵
  PID:10652
- C:\Windows\System\CDzEArF.exe
  C:\Windows\System\CDzEArF.exe
  2⤵
  PID:10728
- C:\Windows\System\DjkSsoB.exe
  C:\Windows\System\DjkSsoB.exe
  2⤵
  PID:10760
- C:\Windows\System\cVUTXdu.exe
  C:\Windows\System\cVUTXdu.exe
  2⤵
  PID:10824
- C:\Windows\System\JLqIPcT.exe
  C:\Windows\System\JLqIPcT.exe
  2⤵
  PID:10864
- C:\Windows\System\JrDwRqI.exe
  C:\Windows\System\JrDwRqI.exe
  2⤵
  PID:10992
- C:\Windows\System\OFtqaxg.exe
  C:\Windows\System\OFtqaxg.exe
  2⤵
  PID:11044
- C:\Windows\System\jssRazg.exe
  C:\Windows\System\jssRazg.exe
  2⤵
  PID:11080
- C:\Windows\System\jQOmApe.exe
  C:\Windows\System\jQOmApe.exe
  2⤵
  PID:11152
- C:\Windows\System\IhFyEwN.exe
  C:\Windows\System\IhFyEwN.exe
  2⤵
  PID:4972
- C:\Windows\System\rwnMPSF.exe
  C:\Windows\System\rwnMPSF.exe
  2⤵
  PID:4232
- C:\Windows\System\BashcPe.exe
  C:\Windows\System\BashcPe.exe
  2⤵
  PID:4760
- C:\Windows\System\duLMDME.exe
  C:\Windows\System\duLMDME.exe
  2⤵
  PID:4596
- C:\Windows\System\LXWqsPf.exe
  C:\Windows\System\LXWqsPf.exe
  2⤵
  PID:2336
- C:\Windows\System\NjTMgwR.exe
  C:\Windows\System\NjTMgwR.exe
  2⤵
  PID:10560
- C:\Windows\System\KLDDlGE.exe
  C:\Windows\System\KLDDlGE.exe
  2⤵
  PID:2628
- C:\Windows\System\QvBzfNw.exe
  C:\Windows\System\QvBzfNw.exe
  2⤵
  PID:4468
- C:\Windows\System\NEJYDsh.exe
  C:\Windows\System\NEJYDsh.exe
  2⤵
  PID:10944
- C:\Windows\System\uDohxdO.exe
  C:\Windows\System\uDohxdO.exe
  2⤵
  PID:10836
- C:\Windows\System\dqHPgWx.exe
  C:\Windows\System\dqHPgWx.exe
  2⤵
  PID:11204
- C:\Windows\System\KLtVALu.exe
  C:\Windows\System\KLtVALu.exe
  2⤵
  PID:11196
- C:\Windows\System\gpnzfpO.exe
  C:\Windows\System\gpnzfpO.exe
  2⤵
  PID:4624
- C:\Windows\System\NuFsiee.exe
  C:\Windows\System\NuFsiee.exe
  2⤵
  PID:10460
- C:\Windows\System\oemeRlw.exe
  C:\Windows\System\oemeRlw.exe
  2⤵
  PID:10880
- C:\Windows\System\MQDnzfT.exe
  C:\Windows\System\MQDnzfT.exe
  2⤵
  PID:10776
- C:\Windows\System\DyDCjYr.exe
  C:\Windows\System\DyDCjYr.exe
  2⤵
  PID:3152
- C:\Windows\System\TealUDH.exe
  C:\Windows\System\TealUDH.exe
  2⤵
  PID:11280
- C:\Windows\System\OAgAeEa.exe
  C:\Windows\System\OAgAeEa.exe
  2⤵
  PID:11332
- C:\Windows\System\bOrvIog.exe
  C:\Windows\System\bOrvIog.exe
  2⤵
  PID:11352
- C:\Windows\System\qOzhbpA.exe
  C:\Windows\System\qOzhbpA.exe
  2⤵
  PID:11376
- C:\Windows\System\TEPfQUp.exe
  C:\Windows\System\TEPfQUp.exe
  2⤵
  PID:11400
- C:\Windows\System\qtkkUnM.exe
  C:\Windows\System\qtkkUnM.exe
  2⤵
  PID:11484
- C:\Windows\System\tFGXfAT.exe
  C:\Windows\System\tFGXfAT.exe
  2⤵
  PID:11516
- C:\Windows\System\NsGrYki.exe
  C:\Windows\System\NsGrYki.exe
  2⤵
  PID:11536
- C:\Windows\System\TNeFYUQ.exe
  C:\Windows\System\TNeFYUQ.exe
  2⤵
  PID:11560
- C:\Windows\System\iCVMsKC.exe
  C:\Windows\System\iCVMsKC.exe
  2⤵
  PID:11576
- C:\Windows\System\upokshB.exe
  C:\Windows\System\upokshB.exe
  2⤵
  PID:11600
- C:\Windows\System\DNvabtR.exe
  C:\Windows\System\DNvabtR.exe
  2⤵
  PID:11624
- C:\Windows\System\UFuIvBw.exe
  C:\Windows\System\UFuIvBw.exe
  2⤵
  PID:11644
- C:\Windows\System\RIAxYcd.exe
  C:\Windows\System\RIAxYcd.exe
  2⤵
  PID:11660
- C:\Windows\System\MlqJNUz.exe
  C:\Windows\System\MlqJNUz.exe
  2⤵
  PID:11720
- C:\Windows\System\AVCdGjJ.exe
  C:\Windows\System\AVCdGjJ.exe
  2⤵
  PID:11740
- C:\Windows\System\mIMnHJJ.exe
  C:\Windows\System\mIMnHJJ.exe
  2⤵
  PID:11764
- C:\Windows\System\CbaEhqx.exe
  C:\Windows\System\CbaEhqx.exe
  2⤵
  PID:11796
- C:\Windows\System\enOaoiX.exe
  C:\Windows\System\enOaoiX.exe
  2⤵
  PID:11820
- C:\Windows\System\tbADBUA.exe
  C:\Windows\System\tbADBUA.exe
  2⤵
  PID:11840
- C:\Windows\System\hpblSZw.exe
  C:\Windows\System\hpblSZw.exe
  2⤵
  PID:11868
- C:\Windows\System\AryYaWe.exe
  C:\Windows\System\AryYaWe.exe
  2⤵
  PID:11896
- C:\Windows\System\ElKzVWM.exe
  C:\Windows\System\ElKzVWM.exe
  2⤵
  PID:11936
- C:\Windows\System\ufZNmhQ.exe
  C:\Windows\System\ufZNmhQ.exe
  2⤵
  PID:11964
- C:\Windows\System\hwMxzrO.exe
  C:\Windows\System\hwMxzrO.exe
  2⤵
  PID:11996
- C:\Windows\System\QwDsRjb.exe
  C:\Windows\System\QwDsRjb.exe
  2⤵
  PID:12012
- C:\Windows\System\rqCpXiH.exe
  C:\Windows\System\rqCpXiH.exe
  2⤵
  PID:12040
- C:\Windows\System\RQItHbQ.exe
  C:\Windows\System\RQItHbQ.exe
  2⤵
  PID:12064
- C:\Windows\System\kXtDxMp.exe
  C:\Windows\System\kXtDxMp.exe
  2⤵
  PID:12096
- C:\Windows\System\lXlfNdS.exe
  C:\Windows\System\lXlfNdS.exe
  2⤵
  PID:12116
- C:\Windows\System\XLXqVis.exe
  C:\Windows\System\XLXqVis.exe
  2⤵
  PID:12148
- C:\Windows\System\lDGimOh.exe
  C:\Windows\System\lDGimOh.exe
  2⤵
  PID:12164
- C:\Windows\System\GsUTvSQ.exe
  C:\Windows\System\GsUTvSQ.exe
  2⤵
  PID:12184
- C:\Windows\System\hYNYAjr.exe
  C:\Windows\System\hYNYAjr.exe
  2⤵
  PID:12208
- C:\Windows\System\YVUvDKG.exe
  C:\Windows\System\YVUvDKG.exe
  2⤵
  PID:12276
- C:\Windows\System\OgIezGA.exe
  C:\Windows\System\OgIezGA.exe
  2⤵
  PID:11236
- C:\Windows\System\oqUlSKC.exe
  C:\Windows\System\oqUlSKC.exe
  2⤵
  PID:10536
- C:\Windows\System\cefvUiW.exe
  C:\Windows\System\cefvUiW.exe
  2⤵
  PID:11340
- C:\Windows\System\OOALXEg.exe
  C:\Windows\System\OOALXEg.exe
  2⤵
  PID:11428
- C:\Windows\System\xKAkIur.exe
  C:\Windows\System\xKAkIur.exe
  2⤵
  PID:11608
- C:\Windows\System\zwXQBAK.exe
  C:\Windows\System\zwXQBAK.exe
  2⤵
  PID:11584
- C:\Windows\System\yxDIZYu.exe
  C:\Windows\System\yxDIZYu.exe
  2⤵
  PID:11652
- C:\Windows\System\CkrMRlj.exe
  C:\Windows\System\CkrMRlj.exe
  2⤵
  PID:11676
- C:\Windows\System\AehtTig.exe
  C:\Windows\System\AehtTig.exe
  2⤵
  PID:11692
- C:\Windows\System\AzZcVCC.exe
  C:\Windows\System\AzZcVCC.exe
  2⤵
  PID:11836
- C:\Windows\System\EykTpuQ.exe
  C:\Windows\System\EykTpuQ.exe
  2⤵
  PID:11780
- C:\Windows\System\ZWhZDSK.exe
  C:\Windows\System\ZWhZDSK.exe
  2⤵
  PID:3348
- C:\Windows\System\xQnwXMB.exe
  C:\Windows\System\xQnwXMB.exe
  2⤵
  PID:11620
- C:\Windows\System\vFxvaMQ.exe
  C:\Windows\System\vFxvaMQ.exe
  2⤵
  PID:11364
- C:\Windows\System\FKUMWhH.exe
  C:\Windows\System\FKUMWhH.exe
  2⤵
  PID:11508
- C:\Windows\System\VLRGTml.exe
  C:\Windows\System\VLRGTml.exe
  2⤵
  PID:11748
- C:\Windows\System\ljlhHBU.exe
  C:\Windows\System\ljlhHBU.exe
  2⤵
  PID:11816
- C:\Windows\System\KxKRlrj.exe
  C:\Windows\System\KxKRlrj.exe
  2⤵
  PID:11928
- C:\Windows\System\WlfYxTb.exe
  C:\Windows\System\WlfYxTb.exe
  2⤵
  PID:1720
- C:\Windows\System\cehGThZ.exe
  C:\Windows\System\cehGThZ.exe
  2⤵
  PID:11592
- C:\Windows\System\JmhLcYv.exe
  C:\Windows\System\JmhLcYv.exe
  2⤵
  PID:4748
- C:\Windows\System\ndzIdpK.exe
  C:\Windows\System\ndzIdpK.exe
  2⤵
  PID:4752
- C:\Windows\System\xXOLsel.exe
  C:\Windows\System\xXOLsel.exe
  2⤵
  PID:3996
- C:\Windows\System\Fvhogqm.exe
  C:\Windows\System\Fvhogqm.exe
  2⤵
  PID:3092
- C:\Windows\System\lAURGcZ.exe
  C:\Windows\System\lAURGcZ.exe
  2⤵
  PID:11324
- C:\Windows\System\dvIhYEY.exe
  C:\Windows\System\dvIhYEY.exe
  2⤵
  PID:12256
- C:\Windows\System\mONSxVW.exe
  C:\Windows\System\mONSxVW.exe
  2⤵
  PID:12160
- C:\Windows\System\SRoJbnJ.exe
  C:\Windows\System\SRoJbnJ.exe
  2⤵
  PID:11756
- C:\Windows\System\ndJfByI.exe
  C:\Windows\System\ndJfByI.exe
  2⤵
  PID:4540
- C:\Windows\System\CmQWPOn.exe
  C:\Windows\System\CmQWPOn.exe
  2⤵
  PID:2612
- C:\Windows\System\kNngKtW.exe
  C:\Windows\System\kNngKtW.exe
  2⤵
  PID:10636
- C:\Windows\System\kBKbCDw.exe
  C:\Windows\System\kBKbCDw.exe
  2⤵
  PID:4588
- C:\Windows\System\qwyiwHw.exe
  C:\Windows\System\qwyiwHw.exe
  2⤵
  PID:2912
- C:\Windows\System\yxawvpQ.exe
  C:\Windows\System\yxawvpQ.exe
  2⤵
  PID:2992
- C:\Windows\System\xIVmwgF.exe
  C:\Windows\System\xIVmwgF.exe
  2⤵
  PID:3968
- C:\Windows\System\UHOBqld.exe
  C:\Windows\System\UHOBqld.exe
  2⤵
  PID:3864
- C:\Windows\System\WXDrxMK.exe
  C:\Windows\System\WXDrxMK.exe
  2⤵
  PID:1396
- C:\Windows\System\RfGQYvS.exe
  C:\Windows\System\RfGQYvS.exe
  2⤵
  PID:5136
- C:\Windows\System\WGGHJTs.exe
  C:\Windows\System\WGGHJTs.exe
  2⤵
  PID:11348
- C:\Windows\System\czRwNMG.exe
  C:\Windows\System\czRwNMG.exe
  2⤵
  PID:5288
- C:\Windows\System\iasEaQQ.exe
  C:\Windows\System\iasEaQQ.exe
  2⤵
  PID:5448
- C:\Windows\System\UjiKRfr.exe
  C:\Windows\System\UjiKRfr.exe
  2⤵
  PID:5492
- C:\Windows\System\dUrGIaf.exe
  C:\Windows\System\dUrGIaf.exe
  2⤵
  PID:1284
- C:\Windows\System\sEOhTYs.exe
  C:\Windows\System\sEOhTYs.exe
  2⤵
  PID:11732
- C:\Windows\System\QGXJFaF.exe
  C:\Windows\System\QGXJFaF.exe
  2⤵
  PID:12216
- C:\Windows\System\OAxMjLw.exe
  C:\Windows\System\OAxMjLw.exe
  2⤵
  PID:3468
- C:\Windows\System\KrSKtAy.exe
  C:\Windows\System\KrSKtAy.exe
  2⤵
  PID:1308
- C:\Windows\System\WyWqgkP.exe
  C:\Windows\System\WyWqgkP.exe
  2⤵
  PID:996
- C:\Windows\System\JQwzSYq.exe
  C:\Windows\System\JQwzSYq.exe
  2⤵
  PID:516
- C:\Windows\System\ZdZgCuR.exe
  C:\Windows\System\ZdZgCuR.exe
  2⤵
  PID:5260
- C:\Windows\System\EVBGBsP.exe
  C:\Windows\System\EVBGBsP.exe
  2⤵
  PID:12204
- C:\Windows\System\BLFiKuZ.exe
  C:\Windows\System\BLFiKuZ.exe
  2⤵
  PID:11832
- C:\Windows\System\IaItVKS.exe
  C:\Windows\System\IaItVKS.exe
  2⤵
  PID:4668
- C:\Windows\System\dkPyKls.exe
  C:\Windows\System\dkPyKls.exe
  2⤵
  PID:3624
- C:\Windows\System\OKbVhgF.exe
  C:\Windows\System\OKbVhgF.exe
  2⤵
  PID:3660
- C:\Windows\System\PviBdag.exe
  C:\Windows\System\PviBdag.exe
  2⤵
  PID:2900
- C:\Windows\System\qafbcZS.exe
  C:\Windows\System\qafbcZS.exe
  2⤵
  PID:12300
- C:\Windows\System\dLMRhXk.exe
  C:\Windows\System\dLMRhXk.exe
  2⤵
  PID:12328
- C:\Windows\System\upurJQU.exe
  C:\Windows\System\upurJQU.exe
  2⤵
  PID:12348
- C:\Windows\System\DOIigMr.exe
  C:\Windows\System\DOIigMr.exe
  2⤵
  PID:12376
- C:\Windows\System\wTOyNCN.exe
  C:\Windows\System\wTOyNCN.exe
  2⤵
  PID:12396
- C:\Windows\System\BDBkzRc.exe
  C:\Windows\System\BDBkzRc.exe
  2⤵
  PID:12420
- C:\Windows\System\OhGLJYj.exe
  C:\Windows\System\OhGLJYj.exe
  2⤵
  PID:12440
- C:\Windows\System\kqGJJck.exe
  C:\Windows\System\kqGJJck.exe
  2⤵
  PID:12464
- C:\Windows\System\sukQnWq.exe
  C:\Windows\System\sukQnWq.exe
  2⤵
  PID:12488
- C:\Windows\System\XCWktzz.exe
  C:\Windows\System\XCWktzz.exe
  2⤵
  PID:12512
- C:\Windows\System\gGbhXEw.exe
  C:\Windows\System\gGbhXEw.exe
  2⤵
  PID:12532
- C:\Windows\System\VeEJQmF.exe
  C:\Windows\System\VeEJQmF.exe
  2⤵
  PID:12556
- C:\Windows\System\HKXtUHX.exe
  C:\Windows\System\HKXtUHX.exe
  2⤵
  PID:12584
- C:\Windows\System\XTwohVy.exe
  C:\Windows\System\XTwohVy.exe
  2⤵
  PID:12616
- C:\Windows\System\IHpNBsu.exe
  C:\Windows\System\IHpNBsu.exe
  2⤵
  PID:12660
- C:\Windows\System\lWEJIxe.exe
  C:\Windows\System\lWEJIxe.exe
  2⤵
  PID:12756
- C:\Windows\System\krdKDpX.exe
  C:\Windows\System\krdKDpX.exe
  2⤵
  PID:12780
- C:\Windows\System\MoZTFND.exe
  C:\Windows\System\MoZTFND.exe
  2⤵
  PID:12804
- C:\Windows\System\kIwnFMG.exe
  C:\Windows\System\kIwnFMG.exe
  2⤵
  PID:12824
- C:\Windows\System\YCqSRtt.exe
  C:\Windows\System\YCqSRtt.exe
  2⤵
  PID:12844
- C:\Windows\System\IPRaSVo.exe
  C:\Windows\System\IPRaSVo.exe
  2⤵
  PID:12864
- C:\Windows\System\HQYsITb.exe
  C:\Windows\System\HQYsITb.exe
  2⤵
  PID:12880
- C:\Windows\System\JZOCHiQ.exe
  C:\Windows\System\JZOCHiQ.exe
  2⤵
  PID:12900
- C:\Windows\System\pIyRMbB.exe
  C:\Windows\System\pIyRMbB.exe
  2⤵
  PID:12932
- C:\Windows\System\bNWnTfo.exe
  C:\Windows\System\bNWnTfo.exe
  2⤵
  PID:12960
- C:\Windows\System\RHumeDj.exe
  C:\Windows\System\RHumeDj.exe
  2⤵
  PID:12984
- C:\Windows\System\YnKyReR.exe
  C:\Windows\System\YnKyReR.exe
  2⤵
  PID:13012
- C:\Windows\System\xTexZRS.exe
  C:\Windows\System\xTexZRS.exe
  2⤵
  PID:13040
- C:\Windows\System\JxHnGSa.exe
  C:\Windows\System\JxHnGSa.exe
  2⤵
  PID:13092
- C:\Windows\System\uxAjLSH.exe
  C:\Windows\System\uxAjLSH.exe
  2⤵
  PID:13132
- C:\Windows\System\pWXRLxQ.exe
  C:\Windows\System\pWXRLxQ.exe
  2⤵
  PID:13164
- C:\Windows\System\GMxAwnY.exe
  C:\Windows\System\GMxAwnY.exe
  2⤵
  PID:13200
- C:\Windows\System\iyavcTD.exe
  C:\Windows\System\iyavcTD.exe
  2⤵
  PID:13260
- C:\Windows\System\HATIyxQ.exe
  C:\Windows\System\HATIyxQ.exe
  2⤵
  PID:13284
- C:\Windows\System\aOnwCnO.exe
  C:\Windows\System\aOnwCnO.exe
  2⤵
  PID:5320
- C:\Windows\System\klyGFHO.exe
  C:\Windows\System\klyGFHO.exe
  2⤵
  PID:2132
- C:\Windows\System\kvLucuL.exe
  C:\Windows\System\kvLucuL.exe
  2⤵
  PID:3616
- C:\Windows\System\FwceMlX.exe
  C:\Windows\System\FwceMlX.exe
  2⤵
  PID:12392
- C:\Windows\System\hUXmkaq.exe
  C:\Windows\System\hUXmkaq.exe
  2⤵
  PID:12432
- C:\Windows\System\cAmMcYq.exe
  C:\Windows\System\cAmMcYq.exe
  2⤵
  PID:12344
- C:\Windows\System\ufGpvZN.exe
  C:\Windows\System\ufGpvZN.exe
  2⤵
  PID:12568
- C:\Windows\System\UAaacII.exe
  C:\Windows\System\UAaacII.exe
  2⤵
  PID:12608
- C:\Windows\System\mvlBUDw.exe
  C:\Windows\System\mvlBUDw.exe
  2⤵
  PID:12688
- C:\Windows\System\kvMbASa.exe
  C:\Windows\System\kvMbASa.exe
  2⤵
  PID:12704
- C:\Windows\System\obSZDyO.exe
  C:\Windows\System\obSZDyO.exe
  2⤵
  PID:12768
- C:\Windows\System\PXQynxU.exe
  C:\Windows\System\PXQynxU.exe
  2⤵
  PID:12820
- C:\Windows\System\mxIptVh.exe
  C:\Windows\System\mxIptVh.exe
  2⤵
  PID:12924
- C:\Windows\System\JxeuyxZ.exe
  C:\Windows\System\JxeuyxZ.exe
  2⤵
  PID:12836
- C:\Windows\System\aObkgUX.exe
  C:\Windows\System\aObkgUX.exe
  2⤵
  PID:13024
- C:\Windows\System\CAuOjTB.exe
  C:\Windows\System\CAuOjTB.exe
  2⤵
  PID:13008
- C:\Windows\System\ogdEofo.exe
  C:\Windows\System\ogdEofo.exe
  2⤵
  PID:10040
- C:\Windows\System\VtQcNAh.exe
  C:\Windows\System\VtQcNAh.exe
  2⤵
  PID:13124
- C:\Windows\System\mqfaBSG.exe
  C:\Windows\System\mqfaBSG.exe
  2⤵
  PID:13172
- C:\Windows\System\qyzdjWq.exe
  C:\Windows\System\qyzdjWq.exe
  2⤵
  PID:3252
- C:\Windows\System\jhTnHRa.exe
  C:\Windows\System\jhTnHRa.exe
  2⤵
  PID:13268
- C:\Windows\System\tWaTqcV.exe
  C:\Windows\System\tWaTqcV.exe
  2⤵
  PID:13296
- C:\Windows\System\avejiAs.exe
  C:\Windows\System\avejiAs.exe
  2⤵
  PID:12320
- C:\Windows\System\LVuMPeo.exe
  C:\Windows\System\LVuMPeo.exe
  2⤵
  PID:4392
- C:\Windows\System\UXZYDIV.exe
  C:\Windows\System\UXZYDIV.exe
  2⤵
  PID:12612
- C:\Windows\System\STFkRWh.exe
  C:\Windows\System\STFkRWh.exe
  2⤵
  PID:12764
- C:\Windows\System\AwTaaJK.exe
  C:\Windows\System\AwTaaJK.exe
  2⤵
  PID:12876
- C:\Windows\System\WtAugUy.exe
  C:\Windows\System\WtAugUy.exe
  2⤵
  PID:9804
- C:\Windows\System\pLZVHyO.exe
  C:\Windows\System\pLZVHyO.exe
  2⤵
  PID:13084
- C:\Windows\System\BnNaRBr.exe
  C:\Windows\System\BnNaRBr.exe
  2⤵
  PID:12604
- C:\Windows\System\XXwoPQM.exe
  C:\Windows\System\XXwoPQM.exe
  2⤵
  PID:13208
- C:\Windows\System\wUTnOFd.exe
  C:\Windows\System\wUTnOFd.exe
  2⤵
  PID:12484
- C:\Windows\System\lberqxr.exe
  C:\Windows\System\lberqxr.exe
  2⤵
  PID:7768
- C:\Windows\System\cPjoOqS.exe
  C:\Windows\System\cPjoOqS.exe
  2⤵
  PID:12860
- C:\Windows\System\lQGPgpT.exe
  C:\Windows\System\lQGPgpT.exe
  2⤵
  PID:13212
- C:\Windows\System\tIYbWwQ.exe
  C:\Windows\System\tIYbWwQ.exe
  2⤵
  PID:13328
- C:\Windows\System\gzeNthr.exe
  C:\Windows\System\gzeNthr.exe
  2⤵
  PID:13356
- C:\Windows\System\cErFDAZ.exe
  C:\Windows\System\cErFDAZ.exe
  2⤵
  PID:13484
- C:\Windows\System\THFxGuQ.exe
  C:\Windows\System\THFxGuQ.exe
  2⤵
  PID:13500
- C:\Windows\System\cObEeJG.exe
  C:\Windows\System\cObEeJG.exe
  2⤵
  PID:13520
- C:\Windows\System\rhLFioE.exe
  C:\Windows\System\rhLFioE.exe
  2⤵
  PID:13544
- C:\Windows\System\llxOrbL.exe
  C:\Windows\System\llxOrbL.exe
  2⤵
  PID:13560
- C:\Windows\System\jujDcWc.exe
  C:\Windows\System\jujDcWc.exe
  2⤵
  PID:13580
- C:\Windows\System\oAfMnhC.exe
  C:\Windows\System\oAfMnhC.exe
  2⤵
  PID:13608
- C:\Windows\System\zezxwvV.exe
  C:\Windows\System\zezxwvV.exe
  2⤵
  PID:13632
- C:\Windows\System\HXUjLvB.exe
  C:\Windows\System\HXUjLvB.exe
  2⤵
  PID:13648
- C:\Windows\System\NyziihF.exe
  C:\Windows\System\NyziihF.exe
  2⤵
  PID:13672
- C:\Windows\System\IGlbiCN.exe
  C:\Windows\System\IGlbiCN.exe
  2⤵
  PID:13700
- C:\Windows\System\KGYUNId.exe
  C:\Windows\System\KGYUNId.exe
  2⤵
  PID:13728
- C:\Windows\System\fosumzM.exe
  C:\Windows\System\fosumzM.exe
  2⤵
  PID:13748
- C:\Windows\System\yxvBvpU.exe
  C:\Windows\System\yxvBvpU.exe
  2⤵
  PID:13772
- C:\Windows\System\LulMwxN.exe
  C:\Windows\System\LulMwxN.exe
  2⤵
  PID:13800
- C:\Windows\System\fKuHiJZ.exe
  C:\Windows\System\fKuHiJZ.exe
  2⤵
  PID:13824
- C:\Windows\System\PGQtCCO.exe
  C:\Windows\System\PGQtCCO.exe
  2⤵
  PID:13844
- C:\Windows\System\KlMsflY.exe
  C:\Windows\System\KlMsflY.exe
  2⤵
  PID:13872
- C:\Windows\System\TqZlXuY.exe
  C:\Windows\System\TqZlXuY.exe
  2⤵
  PID:13908
- C:\Windows\System\gGlRmTA.exe
  C:\Windows\System\gGlRmTA.exe
  2⤵
  PID:13924
- C:\Windows\System\eviKOii.exe
  C:\Windows\System\eviKOii.exe
  2⤵
  PID:13948
- C:\Windows\System\fUmUNLz.exe
  C:\Windows\System\fUmUNLz.exe
  2⤵
  PID:13988
- C:\Windows\System\xwyMEGG.exe
  C:\Windows\System\xwyMEGG.exe
  2⤵
  PID:14012
- C:\Windows\System\yMpXppD.exe
  C:\Windows\System\yMpXppD.exe
  2⤵
  PID:14036
- C:\Windows\System\pdsaOzP.exe
  C:\Windows\System\pdsaOzP.exe
  2⤵
  PID:14060
- C:\Windows\System\vpCXYqg.exe
  C:\Windows\System\vpCXYqg.exe
  2⤵
  PID:14088
- C:\Windows\System\EJmLpky.exe
  C:\Windows\System\EJmLpky.exe
  2⤵
  PID:14116
- C:\Windows\System\BSdTjvw.exe
  C:\Windows\System\BSdTjvw.exe
  2⤵
  PID:14228
- C:\Windows\System\vPFaXbT.exe
  C:\Windows\System\vPFaXbT.exe
  2⤵
  PID:14260
- C:\Windows\System\FOZVsoU.exe
  C:\Windows\System\FOZVsoU.exe
  2⤵
  PID:14276
- C:\Windows\System\dEttgFe.exe
  C:\Windows\System\dEttgFe.exe
  2⤵
  PID:14300
- C:\Windows\System\cGawprZ.exe
  C:\Windows\System\cGawprZ.exe
  2⤵
  PID:14332
- C:\Windows\System\PMdLLwp.exe
  C:\Windows\System\PMdLLwp.exe
  2⤵
  PID:4324
- C:\Windows\System\HJYYlkw.exe
  C:\Windows\System\HJYYlkw.exe
  2⤵
  PID:7340
- C:\Windows\System\EKoAMxa.exe
  C:\Windows\System\EKoAMxa.exe
  2⤵
  PID:13352
- C:\Windows\System\vTNGGjE.exe
  C:\Windows\System\vTNGGjE.exe
  2⤵
  PID:13456
- C:\Windows\System\NBgbVwv.exe
  C:\Windows\System\NBgbVwv.exe
  2⤵
  PID:3496
- C:\Windows\System\OPiPSuJ.exe
  C:\Windows\System\OPiPSuJ.exe
  2⤵
  PID:7692
- C:\Windows\System\KloXVwO.exe
  C:\Windows\System\KloXVwO.exe
  2⤵
  PID:7924
- C:\Windows\System\DCPPPPS.exe
  C:\Windows\System\DCPPPPS.exe
  2⤵
  PID:13492
- C:\Windows\System\YGmJToK.exe
  C:\Windows\System\YGmJToK.exe
  2⤵
  PID:13540
- C:\Windows\System\nkzXcAC.exe
  C:\Windows\System\nkzXcAC.exe
  2⤵
  PID:13628
- C:\Windows\System\SWqzSND.exe
  C:\Windows\System\SWqzSND.exe
  2⤵
  PID:13688
- C:\Windows\System\hgrLsiq.exe
  C:\Windows\System\hgrLsiq.exe
  2⤵
  PID:13664
- C:\Windows\System\iUPxwwS.exe
  C:\Windows\System\iUPxwwS.exe
  2⤵
  PID:13684
- C:\Windows\System\ATisONB.exe
  C:\Windows\System\ATisONB.exe
  2⤵
  PID:13744
- C:\Windows\System\LTrdcMA.exe
  C:\Windows\System\LTrdcMA.exe
  2⤵
  PID:13820
- C:\Windows\System\RNRUsAf.exe
  C:\Windows\System\RNRUsAf.exe
  2⤵
  PID:14100
- C:\Windows\System\GhNuUCp.exe
  C:\Windows\System\GhNuUCp.exe
  2⤵
  PID:14128
- C:\Windows\System\zUhtxEC.exe
  C:\Windows\System\zUhtxEC.exe
  2⤵
  PID:14148
- C:\Windows\System\kZjxVoQ.exe
  C:\Windows\System\kZjxVoQ.exe
  2⤵
  PID:14252
- C:\Windows\System\mWocjKZ.exe
  C:\Windows\System\mWocjKZ.exe
  2⤵
  PID:14320
- C:\Windows\System\refJEjt.exe
  C:\Windows\System\refJEjt.exe
  2⤵
  PID:14328
- C:\Windows\System\AfhATfI.exe
  C:\Windows\System\AfhATfI.exe
  2⤵
  PID:13340
- C:\Windows\System\zlPlUCb.exe
  C:\Windows\System\zlPlUCb.exe
  2⤵
  PID:13388
- C:\Windows\System\YpsdgwT.exe
  C:\Windows\System\YpsdgwT.exe
  2⤵
  PID:7488
- C:\Windows\System\uAZUMdX.exe
  C:\Windows\System\uAZUMdX.exe
  2⤵
  PID:13568
- C:\Windows\System\dJzIFjl.exe
  C:\Windows\System\dJzIFjl.exe
  2⤵
  PID:13604
- C:\Windows\System\yJZgvJb.exe
  C:\Windows\System\yJZgvJb.exe
  2⤵
  PID:13984
- C:\Windows\System\ouVdohT.exe
  C:\Windows\System\ouVdohT.exe
  2⤵
  PID:5148
- C:\Windows\System\OOgKnFB.exe
  C:\Windows\System\OOgKnFB.exe
  2⤵
  PID:5552
- C:\Windows\System\ZltJEGC.exe
  C:\Windows\System\ZltJEGC.exe
  2⤵
  PID:5612
- C:\Windows\System\xboqjEf.exe
  C:\Windows\System\xboqjEf.exe
  2⤵
  PID:13788
- C:\Windows\System\LMvzLee.exe
  C:\Windows\System\LMvzLee.exe
  2⤵
  PID:13972
- C:\Windows\System\eZQqmvH.exe
  C:\Windows\System\eZQqmvH.exe
  2⤵
  PID:5736
- C:\Windows\System\qRImIeW.exe
  C:\Windows\System\qRImIeW.exe
  2⤵
  PID:5776
- C:\Windows\System\kqvuvxT.exe
  C:\Windows\System\kqvuvxT.exe
  2⤵
  PID:14104
- C:\Windows\System\NNLKZFd.exe
  C:\Windows\System\NNLKZFd.exe
  2⤵
  PID:14220
- C:\Windows\System\KKXGRJn.exe
  C:\Windows\System\KKXGRJn.exe
  2⤵
  PID:14312
- C:\Windows\System\KBaCVbz.exe
  C:\Windows\System\KBaCVbz.exe
  2⤵
  PID:13324
- C:\Windows\System\qzzTsGx.exe
  C:\Windows\System\qzzTsGx.exe
  2⤵
  PID:13476
- C:\Windows\System\zEUoGrw.exe
  C:\Windows\System\zEUoGrw.exe
  2⤵
  PID:6044
- C:\Windows\System\sJUSzfX.exe
  C:\Windows\System\sJUSzfX.exe
  2⤵
  PID:13812
- C:\Windows\System\KDCJPNM.exe
  C:\Windows\System\KDCJPNM.exe
  2⤵
  PID:5504
- C:\Windows\System\NsJJUFF.exe
  C:\Windows\System\NsJJUFF.exe
  2⤵
  PID:6124
- C:\Windows\System\XpwWKSS.exe
  C:\Windows\System\XpwWKSS.exe
  2⤵
  PID:5600
- C:\Windows\System\GhsWZVL.exe
  C:\Windows\System\GhsWZVL.exe
  2⤵
  PID:5760
- C:\Windows\System\HxMSoWh.exe
  C:\Windows\System\HxMSoWh.exe
  2⤵
  PID:1976
- C:\Windows\System\BNAYvzP.exe
  C:\Windows\System\BNAYvzP.exe
  2⤵
  PID:6140
- C:\Windows\System\JFkPgTp.exe
  C:\Windows\System\JFkPgTp.exe
  2⤵
  PID:5312
- C:\Windows\System\LLsyIzA.exe
  C:\Windows\System\LLsyIzA.exe
  2⤵
  PID:6100
- C:\Windows\System\ZXswJjf.exe
  C:\Windows\System\ZXswJjf.exe
  2⤵
  PID:5576
- C:\Windows\System\XIvZCvL.exe
  C:\Windows\System\XIvZCvL.exe
  2⤵
  PID:6008
- C:\Windows\System\YEkpgCY.exe
  C:\Windows\System\YEkpgCY.exe
  2⤵
  PID:5124
- C:\Windows\System\EgXHeSm.exe
  C:\Windows\System\EgXHeSm.exe
  2⤵
  PID:5684
- C:\Windows\System\zWQvMKx.exe
  C:\Windows\System\zWQvMKx.exe
  2⤵
  PID:7908
- C:\Windows\System\wENpfbZ.exe
  C:\Windows\System\wENpfbZ.exe
  2⤵
  PID:5496
- C:\Windows\System\sndHJZq.exe
  C:\Windows\System\sndHJZq.exe
  2⤵
  PID:6048
- C:\Windows\System\QVTIcQM.exe
  C:\Windows\System\QVTIcQM.exe
  2⤵
  PID:5748
- C:\Windows\System\izcPEdu.exe
  C:\Windows\System\izcPEdu.exe
  2⤵
  PID:6196
- C:\Windows\System\fiEsopl.exe
  C:\Windows\System\fiEsopl.exe
  2⤵
  PID:5452
- C:\Windows\System\WCyftCI.exe
  C:\Windows\System\WCyftCI.exe
  2⤵
  PID:6344
- C:\Windows\System\HXHtmjo.exe
  C:\Windows\System\HXHtmjo.exe
  2⤵
  PID:6012
- C:\Windows\System\chSmQwe.exe
  C:\Windows\System\chSmQwe.exe
  2⤵
  PID:5720
- C:\Windows\System\BWYDjER.exe
  C:\Windows\System\BWYDjER.exe
  2⤵
  PID:14344
- C:\Windows\System\vVdFVYc.exe
  C:\Windows\System\vVdFVYc.exe
  2⤵
  PID:14364
- C:\Windows\System\wnwOSpy.exe
  C:\Windows\System\wnwOSpy.exe
  2⤵
  PID:14388
- C:\Windows\System\ZgYWyuI.exe
  C:\Windows\System\ZgYWyuI.exe
  2⤵
  PID:14408
- C:\Windows\System\rIfYuQR.exe
  C:\Windows\System\rIfYuQR.exe
  2⤵
  PID:14456
- C:\Windows\System\uyxPQaW.exe
  C:\Windows\System\uyxPQaW.exe
  2⤵
  PID:14480
- C:\Windows\System\CxaqgVo.exe
  C:\Windows\System\CxaqgVo.exe
  2⤵
  PID:14504
- C:\Windows\System\GuIjKMJ.exe
  C:\Windows\System\GuIjKMJ.exe
  2⤵
  PID:14536
- C:\Windows\System\ypZvJjH.exe
  C:\Windows\System\ypZvJjH.exe
  2⤵
  PID:14560
- C:\Windows\System\ZVlXABj.exe
  C:\Windows\System\ZVlXABj.exe
  2⤵
  PID:14584
- C:\Windows\System\qYWgBRw.exe
  C:\Windows\System\qYWgBRw.exe
  2⤵
  PID:14600
- C:\Windows\System\hNZmLcQ.exe
  C:\Windows\System\hNZmLcQ.exe
  2⤵
  PID:14624
- C:\Windows\System\FgRdyKQ.exe
  C:\Windows\System\FgRdyKQ.exe
  2⤵
  PID:14660
- C:\Windows\System\FEUklnu.exe
  C:\Windows\System\FEUklnu.exe
  2⤵
  PID:14700
- C:\Windows\System\YiQmvdH.exe
  C:\Windows\System\YiQmvdH.exe
  2⤵
  PID:14724
- C:\Windows\System\XtlDrZp.exe
  C:\Windows\System\XtlDrZp.exe
  2⤵
  PID:14760
- C:\Windows\System\JGQYpnW.exe
  C:\Windows\System\JGQYpnW.exe
  2⤵
  PID:14780
- C:\Windows\System\jPecLWj.exe
  C:\Windows\System\jPecLWj.exe
  2⤵
  PID:14808
- C:\Windows\System\SdHlCGz.exe
  C:\Windows\System\SdHlCGz.exe
  2⤵
  PID:14860
- C:\Windows\System\JXWHqho.exe
  C:\Windows\System\JXWHqho.exe
  2⤵
  PID:14888
- C:\Windows\System\sqfYooC.exe
  C:\Windows\System\sqfYooC.exe
  2⤵
  PID:14904
- C:\Windows\System\mRaZvvW.exe
  C:\Windows\System\mRaZvvW.exe
  2⤵
  PID:14928
- C:\Windows\System\qSfplop.exe
  C:\Windows\System\qSfplop.exe
  2⤵
  PID:14996
- C:\Windows\System\FivmsLX.exe
  C:\Windows\System\FivmsLX.exe
  2⤵
  PID:15020
- C:\Windows\System\JWkjrxM.exe
  C:\Windows\System\JWkjrxM.exe
  2⤵
  PID:15056
- C:\Windows\System\MyBvACQ.exe
  C:\Windows\System\MyBvACQ.exe
  2⤵
  PID:15084
- C:\Windows\System\SBXrJgM.exe
  C:\Windows\System\SBXrJgM.exe
  2⤵
  PID:15116
- C:\Windows\System\sqUstyi.exe
  C:\Windows\System\sqUstyi.exe
  2⤵
  PID:15136
- C:\Windows\System\XrbFJDH.exe
  C:\Windows\System\XrbFJDH.exe
  2⤵
  PID:15176
- C:\Windows\System\QgMjOmF.exe
  C:\Windows\System\QgMjOmF.exe
  2⤵
  PID:15192
- C:\Windows\System\QvurGXL.exe
  C:\Windows\System\QvurGXL.exe
  2⤵
  PID:15216
- C:\Windows\System\DLUIkKD.exe
  C:\Windows\System\DLUIkKD.exe
  2⤵
  PID:15260
- C:\Windows\System\OEqQDrt.exe
  C:\Windows\System\OEqQDrt.exe
  2⤵
  PID:15284
- C:\Windows\System\OyJzksZ.exe
  C:\Windows\System\OyJzksZ.exe
  2⤵
  PID:15308
- C:\Windows\System\WPcAaPH.exe
  C:\Windows\System\WPcAaPH.exe
  2⤵
  PID:15336
- C:\Windows\System\mKQRQPj.exe
  C:\Windows\System\mKQRQPj.exe
  2⤵
  PID:15352
- C:\Windows\System\WDQMVzp.exe
  C:\Windows\System\WDQMVzp.exe
  2⤵
  PID:5256
- C:\Windows\System\lELYptv.exe
  C:\Windows\System\lELYptv.exe
  2⤵
  PID:6320
- C:\Windows\System\kNfNCiw.exe
  C:\Windows\System\kNfNCiw.exe
  2⤵
  PID:6516
- C:\Windows\System\bJJyfyA.exe
  C:\Windows\System\bJJyfyA.exe
  2⤵
  PID:14360
- C:\Windows\System\MoVdzzE.exe
  C:\Windows\System\MoVdzzE.exe
  2⤵
  PID:14432
- C:\Windows\System\ztOiOfa.exe
  C:\Windows\System\ztOiOfa.exe
  2⤵
  PID:6728
- C:\Windows\System\bTkfbFe.exe
  C:\Windows\System\bTkfbFe.exe
  2⤵
  PID:6780
- C:\Windows\System\oaKDrdC.exe
  C:\Windows\System\oaKDrdC.exe
  2⤵
  PID:6696
- C:\Windows\System\ubAnurm.exe
  C:\Windows\System\ubAnurm.exe
  2⤵
  PID:6744
- C:\Windows\System\yvLdXNt.exe
  C:\Windows\System\yvLdXNt.exe
  2⤵
  PID:14452
- C:\Windows\System\jEKYWjB.exe
  C:\Windows\System\jEKYWjB.exe
  2⤵
  PID:6828
- C:\Windows\System\OgZnpaN.exe
  C:\Windows\System\OgZnpaN.exe
  2⤵
  PID:6684
- C:\Windows\System\TTEehat.exe
  C:\Windows\System\TTEehat.exe
  2⤵
  PID:14772
- C:\Windows\System\PqDKtxI.exe
  C:\Windows\System\PqDKtxI.exe
  2⤵
  PID:14820
- C:\Windows\System\rVdIPSY.exe
  C:\Windows\System\rVdIPSY.exe
  2⤵
  PID:6424
- C:\Windows\System\truDuCz.exe
  C:\Windows\System\truDuCz.exe
  2⤵
  PID:14856
- C:\Windows\System\iapCoGw.exe
  C:\Windows\System\iapCoGw.exe
  2⤵
  PID:6624
- C:\Windows\System\yvinbYq.exe
  C:\Windows\System\yvinbYq.exe
  2⤵
  PID:14880
- C:\Windows\System\XUJvovZ.exe
  C:\Windows\System\XUJvovZ.exe
  2⤵
  PID:7028
- C:\Windows\System\ahZOAie.exe
  C:\Windows\System\ahZOAie.exe
  2⤵
  PID:14948
- C:\Windows\System\lneByMQ.exe
  C:\Windows\System\lneByMQ.exe
  2⤵
  PID:14924
- C:\Windows\System\OVvzYtA.exe
  C:\Windows\System\OVvzYtA.exe
  2⤵
  PID:6976
- C:\Windows\System\EuSESkr.exe
  C:\Windows\System\EuSESkr.exe
  2⤵
  PID:6944
- C:\Windows\System\oTbCJAL.exe
  C:\Windows\System\oTbCJAL.exe
  2⤵
  PID:15012
- C:\Windows\System\STWidLF.exe
  C:\Windows\System\STWidLF.exe
  2⤵
  PID:15016
- C:\Windows\System\aDzpcSN.exe
  C:\Windows\System\aDzpcSN.exe
  2⤵
  PID:15068
- C:\Windows\System\EJGsRwY.exe
  C:\Windows\System\EJGsRwY.exe
  2⤵
  PID:15100
- C:\Windows\System\yNnUZnF.exe
  C:\Windows\System\yNnUZnF.exe
  2⤵
  PID:6648
- C:\Windows\System\SalgoIw.exe
  C:\Windows\System\SalgoIw.exe
  2⤵
  PID:15188
- C:\Windows\System\inPloBb.exe
  C:\Windows\System\inPloBb.exe
  2⤵
  PID:6384
- C:\Windows\System\IHWHGth.exe
  C:\Windows\System\IHWHGth.exe
  2⤵
  PID:15232
- C:\Windows\System\vaJnpgb.exe
  C:\Windows\System\vaJnpgb.exe
  2⤵
  PID:7184
- C:\Windows\System\pLRCcaS.exe
  C:\Windows\System\pLRCcaS.exe
  2⤵
  PID:6052
- C:\Windows\System\vWwSGTZ.exe
  C:\Windows\System\vWwSGTZ.exe
  2⤵
  PID:7276
- C:\Windows\System\IjFdqjc.exe
  C:\Windows\System\IjFdqjc.exe
  2⤵
  PID:7320
- C:\Windows\System\JOrImIm.exe
  C:\Windows\System\JOrImIm.exe
  2⤵
  PID:14380
- C:\Windows\System\SUDTUak.exe
  C:\Windows\System\SUDTUak.exe
  2⤵
  PID:7280
- C:\Windows\System\IiAPDvT.exe
  C:\Windows\System\IiAPDvT.exe
  2⤵
  PID:7492
- C:\Windows\System\LyqFUAM.exe
  C:\Windows\System\LyqFUAM.exe
  2⤵
  PID:14444
- C:\Windows\System\nfBIwpR.exe
  C:\Windows\System\nfBIwpR.exe
  2⤵
  PID:7484
- C:\Windows\System\zjEcmkK.exe
  C:\Windows\System\zjEcmkK.exe
  2⤵
  PID:14356
- C:\Windows\System\cFBhPSo.exe
  C:\Windows\System\cFBhPSo.exe
  2⤵
  PID:14492
- C:\Windows\System\DqSjAhP.exe
  C:\Windows\System\DqSjAhP.exe
  2⤵
  PID:7680
- C:\Windows\System\OycXtgH.exe
  C:\Windows\System\OycXtgH.exe
  2⤵
  PID:7756
- C:\Windows\System\bWvCbRo.exe
  C:\Windows\System\bWvCbRo.exe
  2⤵
  PID:7804
- C:\Windows\System\lrTDBUy.exe
  C:\Windows\System\lrTDBUy.exe
  2⤵
  PID:7944
- C:\Windows\System\VVVOFgV.exe
  C:\Windows\System\VVVOFgV.exe
  2⤵
  PID:7148
- C:\Windows\System\rAFUCFc.exe
  C:\Windows\System\rAFUCFc.exe
  2⤵
  PID:7352
- C:\Windows\System\CWXnLOl.exe
  C:\Windows\System\CWXnLOl.exe
  2⤵
  PID:7300
- C:\Windows\System\ODIDnVJ.exe
  C:\Windows\System\ODIDnVJ.exe
  2⤵
  PID:14804
- C:\Windows\System\hhtYMYY.exe
  C:\Windows\System\hhtYMYY.exe
  2⤵
  PID:6340
- C:\Windows\System\aZQrzlI.exe
  C:\Windows\System\aZQrzlI.exe
  2⤵
  PID:10700
- C:\Windows\System\oKiNEEd.exe
  C:\Windows\System\oKiNEEd.exe
  2⤵
  PID:7772
- C:\Windows\System\dJXougw.exe
  C:\Windows\System\dJXougw.exe
  2⤵
  PID:14884
- C:\Windows\System\syWrNcc.exe
  C:\Windows\System\syWrNcc.exe
  2⤵
  PID:7988
- C:\Windows\System\DlKKgen.exe
  C:\Windows\System\DlKKgen.exe
  2⤵
  PID:6452
- C:\Windows\System\ToxfjTc.exe
  C:\Windows\System\ToxfjTc.exe
  2⤵
  PID:10872
- C:\Windows\System\EnLDxSd.exe
  C:\Windows\System\EnLDxSd.exe
  2⤵
  PID:10092
- C:\Windows\System\TmmzLVh.exe
  C:\Windows\System\TmmzLVh.exe
  2⤵
  PID:5616
- C:\Windows\System\YQThhXF.exe
  C:\Windows\System\YQThhXF.exe
  2⤵
  PID:8140
- C:\Windows\System\PAJtufs.exe
  C:\Windows\System\PAJtufs.exe
  2⤵
  PID:6432
- C:\Windows\System\ubOPANb.exe
  C:\Windows\System\ubOPANb.exe
  2⤵
  PID:15296
- C:\Windows\System\ahpbGKo.exe
  C:\Windows\System\ahpbGKo.exe
  2⤵
  PID:15304
- C:\Windows\System\vVikWng.exe
  C:\Windows\System\vVikWng.exe
  2⤵
  PID:7700
- C:\Windows\System\vvPoTMR.exe
  C:\Windows\System\vvPoTMR.exe
  2⤵
  PID:15348
- C:\Windows\System\QcWnKLk.exe
  C:\Windows\System\QcWnKLk.exe
  2⤵
  PID:8048
- C:\Windows\System\yyJHlAQ.exe
  C:\Windows\System\yyJHlAQ.exe
  2⤵
  PID:8156
- C:\Windows\System\UpHQRLb.exe
  C:\Windows\System\UpHQRLb.exe
  2⤵
  PID:14420
- C:\Windows\System\ugEySkj.exe
  C:\Windows\System\ugEySkj.exe
  2⤵
  PID:6568
- C:\Windows\System\MXmvJzZ.exe
  C:\Windows\System\MXmvJzZ.exe
  2⤵
  PID:8292
- C:\Windows\System\ZVrIEVf.exe
  C:\Windows\System\ZVrIEVf.exe
  2⤵
  PID:8444
- C:\Windows\System\GDtMCaD.exe
  C:\Windows\System\GDtMCaD.exe
  2⤵
  PID:6964
- C:\Windows\System\xlmvIqh.exe
  C:\Windows\System\xlmvIqh.exe
  2⤵
  PID:8132
- C:\Windows\System\oKadpUJ.exe
  C:\Windows\System\oKadpUJ.exe
  2⤵
  PID:7344
- C:\Windows\System\MoJuPSb.exe
  C:\Windows\System\MoJuPSb.exe
  2⤵
  PID:8628
- C:\Windows\System\ozmGfoW.exe
  C:\Windows\System\ozmGfoW.exe
  2⤵
  PID:8728
- C:\Windows\System\hnyoJVG.exe
  C:\Windows\System\hnyoJVG.exe
  2⤵
  PID:6300
- C:\Windows\System\quHdUvY.exe
  C:\Windows\System\quHdUvY.exe
  2⤵
  PID:8820
- C:\Windows\System\JrdkCjq.exe
  C:\Windows\System\JrdkCjq.exe
  2⤵
  PID:3444
- C:\Windows\System\uipNlgJ.exe
  C:\Windows\System\uipNlgJ.exe
  2⤵
  PID:7948
- C:\Windows\System\QdvMcnG.exe
  C:\Windows\System\QdvMcnG.exe
  2⤵
  PID:8940
- C:\Windows\System\KasBeTy.exe
  C:\Windows\System\KasBeTy.exe
  2⤵
  PID:7968
- C:\Windows\System\upluJYs.exe
  C:\Windows\System\upluJYs.exe
  2⤵
  PID:10888
- C:\Windows\System\goPHwpb.exe
  C:\Windows\System\goPHwpb.exe
  2⤵
  PID:8976
- C:\Windows\System\yIJPqFn.exe
  C:\Windows\System\yIJPqFn.exe
  2⤵
  PID:7232
- C:\Windows\System\hluKxNC.exe
  C:\Windows\System\hluKxNC.exe
  2⤵
  PID:6260
- C:\Windows\System\oTkIeqz.exe
  C:\Windows\System\oTkIeqz.exe
  2⤵
  PID:9204
- C:\Windows\System\UxIUObv.exe
  C:\Windows\System\UxIUObv.exe
  2⤵
  PID:14400
- C:\Windows\System\SIgNhlI.exe
  C:\Windows\System\SIgNhlI.exe
  2⤵
  PID:7972
- C:\Windows\System\FjonjBL.exe
  C:\Windows\System\FjonjBL.exe
  2⤵
  PID:14544
- C:\Windows\System\JmfZKkj.exe
  C:\Windows\System\JmfZKkj.exe
  2⤵
  PID:7408
- C:\Windows\System\mErvSLT.exe
  C:\Windows\System\mErvSLT.exe
  2⤵
  PID:8960
- C:\Windows\System\cZnxAwC.exe
  C:\Windows\System\cZnxAwC.exe
  2⤵
  PID:9048
- C:\Windows\System\KLCIpfB.exe
  C:\Windows\System\KLCIpfB.exe
  2⤵
  PID:7440
- C:\Windows\System\nHUwmjh.exe
  C:\Windows\System\nHUwmjh.exe
  2⤵
  PID:7620
- C:\Windows\System\yisvffy.exe
  C:\Windows\System\yisvffy.exe
  2⤵
  PID:8280
- C:\Windows\System\VtvouNl.exe
  C:\Windows\System\VtvouNl.exe
  2⤵
  PID:8384
- C:\Windows\System\YObKpub.exe
  C:\Windows\System\YObKpub.exe
  2⤵
  PID:14468
- C:\Windows\System\STFiLdA.exe
  C:\Windows\System\STFiLdA.exe
  2⤵
  PID:8180
- C:\Windows\System\HexiOXp.exe
  C:\Windows\System\HexiOXp.exe
  2⤵
  PID:8780
- C:\Windows\System\AoUChBo.exe
  C:\Windows\System\AoUChBo.exe
  2⤵
  PID:9092
- C:\Windows\System\jWAeWtz.exe
  C:\Windows\System\jWAeWtz.exe
  2⤵
  PID:9108
- C:\Windows\System\GkNfnVu.exe
  C:\Windows\System\GkNfnVu.exe
  2⤵
  PID:8924
- C:\Windows\System\FvmNkRr.exe
  C:\Windows\System\FvmNkRr.exe
  2⤵
  PID:8844
- C:\Windows\System\XByozJu.exe
  C:\Windows\System\XByozJu.exe
  2⤵
  PID:9256
- C:\Windows\System\dGucufP.exe
  C:\Windows\System\dGucufP.exe
  2⤵
  PID:9372
- C:\Windows\System\CsWOXSC.exe
  C:\Windows\System\CsWOXSC.exe
  2⤵
  PID:7240
- C:\Windows\System\DPGUkNz.exe
  C:\Windows\System\DPGUkNz.exe
  2⤵
  PID:7636
- C:\Windows\System\adkIpsx.exe
  C:\Windows\System\adkIpsx.exe
  2⤵
  PID:9464
- C:\Windows\System\tdnciXN.exe
  C:\Windows\System\tdnciXN.exe
  2⤵
  PID:9452
- C:\Windows\System\ugHotAW.exe
  C:\Windows\System\ugHotAW.exe
  2⤵
  PID:8736
- C:\Windows\System\eIlcRWl.exe
  C:\Windows\System\eIlcRWl.exe
  2⤵
  PID:4416
- C:\Windows\System\DjjAzSP.exe
  C:\Windows\System\DjjAzSP.exe
  2⤵
  PID:9588
- C:\Windows\System\XWKalmp.exe
  C:\Windows\System\XWKalmp.exe
  2⤵
  PID:9200
- C:\Windows\System\cisXuhz.exe
  C:\Windows\System\cisXuhz.exe
  2⤵
  PID:9688
- C:\Windows\System\hEdgRBP.exe
  C:\Windows\System\hEdgRBP.exe
  2⤵
  PID:8432
- C:\Windows\System\LAddAXB.exe
  C:\Windows\System\LAddAXB.exe
  2⤵
  PID:8760
- C:\Windows\System\eRrJviA.exe
  C:\Windows\System\eRrJviA.exe
  2⤵
  PID:3868
- C:\Windows\System\RDIwPLB.exe
  C:\Windows\System\RDIwPLB.exe
  2⤵
  PID:10036
- C:\Windows\System\jShcCBX.exe
  C:\Windows\System\jShcCBX.exe
  2⤵
  PID:8956
- C:\Windows\System\ZlqXnVH.exe
  C:\Windows\System\ZlqXnVH.exe
  2⤵
  PID:8852
- C:\Windows\System\uRSstfz.exe
  C:\Windows\System\uRSstfz.exe
  2⤵
  PID:9348
- C:\Windows\System\WIAOwUH.exe
  C:\Windows\System\WIAOwUH.exe
  2⤵
  PID:9148
- C:\Windows\System\QJlznfd.exe
  C:\Windows\System\QJlznfd.exe
  2⤵
  PID:9552
- C:\Windows\System\lNXtzTq.exe
  C:\Windows\System\lNXtzTq.exe
  2⤵
  PID:10236
- C:\Windows\System\HOUFGGh.exe
  C:\Windows\System\HOUFGGh.exe
  2⤵
  PID:9232
- C:\Windows\System\YvwvTbH.exe
  C:\Windows\System\YvwvTbH.exe
  2⤵
  PID:9524
- C:\Windows\System\QaeSYgk.exe
  C:\Windows\System\QaeSYgk.exe
  2⤵
  PID:9936
- C:\Windows\System\bAXNCOf.exe
  C:\Windows\System\bAXNCOf.exe
  2⤵
  PID:9920
- C:\Windows\System\WcVMMkG.exe
  C:\Windows\System\WcVMMkG.exe
  2⤵
  PID:9316
- C:\Windows\System\QWxAbek.exe
  C:\Windows\System\QWxAbek.exe
  2⤵
  PID:9872
- C:\Windows\System\CGdCIjL.exe
  C:\Windows\System\CGdCIjL.exe
  2⤵
  PID:9544
- C:\Windows\System\SVteStx.exe
  C:\Windows\System\SVteStx.exe
  2⤵
  PID:11904
- C:\Windows\System\NrvDKEm.exe
  C:\Windows\System\NrvDKEm.exe
  2⤵
  PID:8096
- C:\Windows\System\RXurSPl.exe
  C:\Windows\System\RXurSPl.exe
  2⤵
  PID:9964
- C:\Windows\System\FrFdjqs.exe
  C:\Windows\System\FrFdjqs.exe
  2⤵
  PID:10144
- C:\Windows\System\XnErAoh.exe
  C:\Windows\System\XnErAoh.exe
  2⤵
  PID:8040
- C:\Windows\System\hkUKYMr.exe
  C:\Windows\System\hkUKYMr.exe
  2⤵
  PID:9792
- C:\Windows\System\BvqvyhA.exe
  C:\Windows\System\BvqvyhA.exe
  2⤵
  PID:10056
- C:\Windows\System\IOmGiMo.exe
  C:\Windows\System\IOmGiMo.exe
  2⤵
  PID:9620
- C:\Windows\System\UFetYQP.exe
  C:\Windows\System\UFetYQP.exe
  2⤵
  PID:9700
- C:\Windows\System\GrKqKuf.exe
  C:\Windows\System\GrKqKuf.exe
  2⤵
  PID:9512
- C:\Windows\System\NxVYmzB.exe
  C:\Windows\System\NxVYmzB.exe
  2⤵
  PID:8980
- C:\Windows\System\XyiXTHY.exe
  C:\Windows\System\XyiXTHY.exe
  2⤵
  PID:9672
- C:\Windows\System\IkdrYuq.exe
  C:\Windows\System\IkdrYuq.exe
  2⤵
  PID:3124
- C:\Windows\System\JJqFJVr.exe
  C:\Windows\System\JJqFJVr.exe
  2⤵
  PID:9068
- C:\Windows\System\KdvEwJj.exe
  C:\Windows\System\KdvEwJj.exe
  2⤵
  PID:15380
- C:\Windows\System\xUEReaf.exe
  C:\Windows\System\xUEReaf.exe
  2⤵
  PID:15412
- C:\Windows\System\DreNSWV.exe
  C:\Windows\System\DreNSWV.exe
  2⤵
  PID:15436
- C:\Windows\System\JzDNFGE.exe
  C:\Windows\System\JzDNFGE.exe
  2⤵
  PID:15484
- C:\Windows\System\ehCuuFR.exe
  C:\Windows\System\ehCuuFR.exe
  2⤵
  PID:15508
- C:\Windows\System\QluFxLP.exe
  C:\Windows\System\QluFxLP.exe
  2⤵
  PID:15536
- C:\Windows\System\OmBBjAE.exe
  C:\Windows\System\OmBBjAE.exe
  2⤵
  PID:15556
- C:\Windows\System\qUArnZc.exe
  C:\Windows\System\qUArnZc.exe
  2⤵
  PID:15580
- C:\Windows\System\ugVWdRb.exe
  C:\Windows\System\ugVWdRb.exe
  2⤵
  PID:15604
- C:\Windows\System\lnILMWO.exe
  C:\Windows\System\lnILMWO.exe
  2⤵
  PID:15628
- C:\Windows\System\mZbFOYo.exe
  C:\Windows\System\mZbFOYo.exe
  2⤵
  PID:15656
- C:\Windows\System\zsziMsf.exe
  C:\Windows\System\zsziMsf.exe
  2⤵
  PID:15684
- C:\Windows\System\QPKvQLv.exe
  C:\Windows\System\QPKvQLv.exe
  2⤵
  PID:15716
- C:\Windows\System\dIAbIaA.exe
  C:\Windows\System\dIAbIaA.exe
  2⤵
  PID:15748
- C:\Windows\System\kUUfeny.exe
  C:\Windows\System\kUUfeny.exe
  2⤵
  PID:15772
- C:\Windows\System\eqSKBUt.exe
  C:\Windows\System\eqSKBUt.exe
  2⤵
  PID:15812
- C:\Windows\System\hCbjmfE.exe
  C:\Windows\System\hCbjmfE.exe
  2⤵
  PID:15840
- C:\Windows\System\nXDVgnW.exe
  C:\Windows\System\nXDVgnW.exe
  2⤵
  PID:15888
- C:\Windows\System\RXlTVIo.exe
  C:\Windows\System\RXlTVIo.exe
  2⤵
  PID:15916
- C:\Windows\System\KnCoOzH.exe
  C:\Windows\System\KnCoOzH.exe
  2⤵
  PID:15956
- C:\Windows\System\QLUqLgB.exe
  C:\Windows\System\QLUqLgB.exe
  2⤵
  PID:15984
- C:\Windows\System\FuNIPFw.exe
  C:\Windows\System\FuNIPFw.exe
  2⤵
  PID:16008
- C:\Windows\System\uUQtxLL.exe
  C:\Windows\System\uUQtxLL.exe
  2⤵
  PID:16028
- C:\Windows\System\VGeoNmn.exe
  C:\Windows\System\VGeoNmn.exe
  2⤵
  PID:16100
- C:\Windows\System\mnIACHa.exe
  C:\Windows\System\mnIACHa.exe
  2⤵
  PID:16116
- C:\Windows\System\XVAvbYg.exe
  C:\Windows\System\XVAvbYg.exe
  2⤵
  PID:16136
- C:\Windows\System\ZqGIdXS.exe
  C:\Windows\System\ZqGIdXS.exe
  2⤵
  PID:16160
- C:\Windows\System\RuIqVpQ.exe
  C:\Windows\System\RuIqVpQ.exe
  2⤵
  PID:16176
- C:\Windows\System\mYpzFzU.exe
  C:\Windows\System\mYpzFzU.exe
  2⤵
  PID:16204
- C:\Windows\System\qpbLmDV.exe
  C:\Windows\System\qpbLmDV.exe
  2⤵
  PID:16224
- C:\Windows\System\HbexnQR.exe
  C:\Windows\System\HbexnQR.exe
  2⤵
  PID:16248
- C:\Windows\System\AFgKfhn.exe
  C:\Windows\System\AFgKfhn.exe
  2⤵
  PID:16272
- C:\Windows\System\sZwgPeB.exe
  C:\Windows\System\sZwgPeB.exe
  2⤵
  PID:16296
- C:\Windows\System\vbeCdLb.exe
  C:\Windows\System\vbeCdLb.exe
  2⤵
  PID:16328
- C:\Windows\System\HYXBPqh.exe
  C:\Windows\System\HYXBPqh.exe
  2⤵
  PID:16356
- C:\Windows\System\gsRRKMb.exe
  C:\Windows\System\gsRRKMb.exe
  2⤵
  PID:9740
- C:\Windows\System\IAqrJko.exe
  C:\Windows\System\IAqrJko.exe
  2⤵
  PID:8312
- C:\Windows\System\bxOhCFD.exe
  C:\Windows\System\bxOhCFD.exe
  2⤵
  PID:15444
- C:\Windows\System\ZnXnGlY.exe
  C:\Windows\System\ZnXnGlY.exe
  2⤵
  PID:15532
- C:\Windows\System\GYQqRLW.exe
  C:\Windows\System\GYQqRLW.exe
  2⤵
  PID:15620
- C:\Windows\System\ybjUqXI.exe
  C:\Windows\System\ybjUqXI.exe
  2⤵
  PID:15668
- C:\Windows\System\iTXVhEv.exe
  C:\Windows\System\iTXVhEv.exe
  2⤵
  PID:15724
- C:\Windows\System\URBEbPA.exe
  C:\Windows\System\URBEbPA.exe
  2⤵
  PID:15828
- C:\Windows\System\oXDLvUz.exe
  C:\Windows\System\oXDLvUz.exe
  2⤵
  PID:15856
- C:\Windows\System\QpQAoqQ.exe
  C:\Windows\System\QpQAoqQ.exe
  2⤵
  PID:15940
- C:\Windows\System\ilLuzJU.exe
  C:\Windows\System\ilLuzJU.exe
  2⤵
  PID:15980
- C:\Windows\System\NtKDWjS.exe
  C:\Windows\System\NtKDWjS.exe
  2⤵
  PID:10220
- C:\Windows\System\qUDZKSN.exe
  C:\Windows\System\qUDZKSN.exe
  2⤵
  PID:16024
- C:\Windows\System\gjGIkMX.exe
  C:\Windows\System\gjGIkMX.exe
  2⤵
  PID:16084
- C:\Windows\System\sebSEQw.exe
  C:\Windows\System\sebSEQw.exe
  2⤵
  PID:10068
- C:\Windows\System\GJsqauj.exe
  C:\Windows\System\GJsqauj.exe
  2⤵
  PID:2496
- C:\Windows\System\PSCTqwQ.exe
  C:\Windows\System\PSCTqwQ.exe
  2⤵
  PID:16152
- C:\Windows\System\suZKYgB.exe
  C:\Windows\System\suZKYgB.exe
  2⤵
  PID:16144
- C:\Windows\System\hUngPrB.exe
  C:\Windows\System\hUngPrB.exe
  2⤵
  PID:9280
- C:\Windows\System\HCWpnTD.exe
  C:\Windows\System\HCWpnTD.exe
  2⤵
  PID:16168
- C:\Windows\System\cLCcEuX.exe
  C:\Windows\System\cLCcEuX.exe
  2⤵
  PID:16200
- C:\Windows\System\HIsbXfi.exe
  C:\Windows\System\HIsbXfi.exe
  2⤵
  PID:16364
- C:\Windows\System\fayPKSI.exe
  C:\Windows\System\fayPKSI.exe
  2⤵
  PID:16308
- C:\Windows\System\sdXhVnM.exe
  C:\Windows\System\sdXhVnM.exe
  2⤵
  PID:15428
- C:\Windows\System\WaCzHYx.exe
  C:\Windows\System\WaCzHYx.exe
  2⤵
  PID:10336
- C:\Windows\System\EnQmnAK.exe
  C:\Windows\System\EnQmnAK.exe
  2⤵
  PID:10432
- C:\Windows\System\BtBIXqi.exe
  C:\Windows\System\BtBIXqi.exe
  2⤵
  PID:15744
- C:\Windows\System\LSSfFbc.exe
  C:\Windows\System\LSSfFbc.exe
  2⤵
  PID:15796
- C:\Windows\System\bgXeJNm.exe
  C:\Windows\System\bgXeJNm.exe
  2⤵
  PID:15972
- C:\Windows\System\LbDFPCZ.exe
  C:\Windows\System\LbDFPCZ.exe
  2⤵
  PID:9312
- C:\Windows\System\AvIAvxw.exe
  C:\Windows\System\AvIAvxw.exe
  2⤵
  PID:9496
- C:\Windows\System\dQcLMHP.exe
  C:\Windows\System\dQcLMHP.exe
  2⤵
  PID:9572
- C:\Windows\System\FLJGcaR.exe
  C:\Windows\System\FLJGcaR.exe
  2⤵
  PID:9880
- C:\Windows\System\LmDJWHM.exe
  C:\Windows\System\LmDJWHM.exe
  2⤵
  PID:16052
- C:\Windows\System\xTiOeGP.exe
  C:\Windows\System\xTiOeGP.exe
  2⤵
  PID:4964
- C:\Windows\System\krKaVFV.exe
  C:\Windows\System\krKaVFV.exe
  2⤵
  PID:10708
- C:\Windows\System\KNUDgkC.exe
  C:\Windows\System\KNUDgkC.exe
  2⤵
  PID:10260
- C:\Windows\System\pxBlDGS.exe
  C:\Windows\System\pxBlDGS.exe
  2⤵
  PID:16192
- C:\Windows\System\nHflnKO.exe
  C:\Windows\System\nHflnKO.exe
  2⤵
  PID:16216
- C:\Windows\System\hIBTcIp.exe
  C:\Windows\System\hIBTcIp.exe
  2⤵
  PID:3580
- C:\Windows\System\NNhsvid.exe
  C:\Windows\System\NNhsvid.exe
  2⤵
  PID:15576
- C:\Windows\System\MvffRlK.exe
  C:\Windows\System\MvffRlK.exe
  2⤵
  PID:11056
- C:\Windows\System\lkitvlK.exe
  C:\Windows\System\lkitvlK.exe
  2⤵
  PID:11000
- C:\Windows\System\yDVMGTg.exe
  C:\Windows\System\yDVMGTg.exe
  2⤵
  PID:9432
- C:\Windows\System\YCwwlba.exe
  C:\Windows\System\YCwwlba.exe
  2⤵
  PID:11140
- C:\Windows\System\ViHTkZP.exe
  C:\Windows\System\ViHTkZP.exe
  2⤵
  PID:4952
- C:\Windows\System\ZbVRymZ.exe
  C:\Windows\System\ZbVRymZ.exe
  2⤵
  PID:11176
- C:\Windows\System\rzZMkHU.exe
  C:\Windows\System\rzZMkHU.exe
  2⤵
  PID:10792
- C:\Windows\System\DTqVOyC.exe
  C:\Windows\System\DTqVOyC.exe
  2⤵
  PID:10252
- C:\Windows\System\sNaPsyS.exe
  C:\Windows\System\sNaPsyS.exe
  2⤵
  PID:5036
- C:\Windows\System\ZbSIQWw.exe
  C:\Windows\System\ZbSIQWw.exe
  2⤵
  PID:4312
- C:\Windows\System\gyuIPIK.exe
  C:\Windows\System\gyuIPIK.exe
  2⤵
  PID:10808
- C:\Windows\System\kTGdEMK.exe
  C:\Windows\System\kTGdEMK.exe
  2⤵
  PID:10396
- C:\Windows\System\SyHOOrI.exe
  C:\Windows\System\SyHOOrI.exe
  2⤵
  PID:10032
- C:\Windows\System\heyaXNX.exe
  C:\Windows\System\heyaXNX.exe
  2⤵
  PID:15564
- C:\Windows\System\tROkkWW.exe
  C:\Windows\System\tROkkWW.exe
  2⤵
  PID:10784
- C:\Windows\System\hUzSTgO.exe
  C:\Windows\System\hUzSTgO.exe
  2⤵
  PID:5200
- C:\Windows\System\YFmHKjE.exe
  C:\Windows\System\YFmHKjE.exe
  2⤵
  PID:16304
- C:\Windows\System\ulCZmYt.exe
  C:\Windows\System\ulCZmYt.exe
  2⤵
  PID:5304
- C:\Windows\System\dMpkQIS.exe
  C:\Windows\System\dMpkQIS.exe
  2⤵
  PID:10360
- C:\Windows\System\vgVrtuj.exe
  C:\Windows\System\vgVrtuj.exe
  2⤵
  PID:11020
- C:\Windows\System\FejxfPD.exe
  C:\Windows\System\FejxfPD.exe
  2⤵
  PID:15800
- C:\Windows\System\LjqCtnp.exe
  C:\Windows\System\LjqCtnp.exe
  2⤵
  PID:10972
- C:\Windows\System\riabpyx.exe
  C:\Windows\System\riabpyx.exe
  2⤵
  PID:10496
- C:\Windows\System\zFAcUXi.exe
  C:\Windows\System\zFAcUXi.exe
  2⤵
  PID:10528
- C:\Windows\System\CmnSIzw.exe
  C:\Windows\System\CmnSIzw.exe
  2⤵
  PID:540
- C:\Windows\System\dqFYxsr.exe
  C:\Windows\System\dqFYxsr.exe
  2⤵
  PID:10904
- C:\Windows\System\lgIZTvD.exe
  C:\Windows\System\lgIZTvD.exe
  2⤵
  PID:11052
- C:\Windows\System\ZHyuOFr.exe
  C:\Windows\System\ZHyuOFr.exe
  2⤵
  PID:10100
- C:\Windows\System\fxbycqh.exe
  C:\Windows\System\fxbycqh.exe
  2⤵
  PID:11136
- C:\Windows\System\fkctMQG.exe
  C:\Windows\System\fkctMQG.exe
  2⤵
  PID:4496
- C:\Windows\System\zOKSBzl.exe
  C:\Windows\System\zOKSBzl.exe
  2⤵
  PID:12308
- C:\Windows\System\WuwovyI.exe
  C:\Windows\System\WuwovyI.exe
  2⤵
  PID:12080
- C:\Windows\System\TDHDLrO.exe
  C:\Windows\System\TDHDLrO.exe
  2⤵
  PID:11132
- C:\Windows\System\sWWWuCY.exe
  C:\Windows\System\sWWWuCY.exe
  2⤵
  PID:10640
- C:\Windows\System\KWhuWyD.exe
  C:\Windows\System\KWhuWyD.exe
  2⤵
  PID:12472
- C:\Windows\System\tghIQaS.exe
  C:\Windows\System\tghIQaS.exe
  2⤵
  PID:11672
- C:\Windows\System\oLUUPSW.exe
  C:\Windows\System\oLUUPSW.exe
  2⤵
  PID:16400
- C:\Windows\System\IOwCMUI.exe
  C:\Windows\System\IOwCMUI.exe
  2⤵
  PID:16420
- C:\Windows\System\GukwoHE.exe
  C:\Windows\System\GukwoHE.exe
  2⤵
  PID:16444
- C:\Windows\System\GmjyFlp.exe
  C:\Windows\System\GmjyFlp.exe
  2⤵
  PID:16472
- C:\Windows\System\WkHvvrr.exe
  C:\Windows\System\WkHvvrr.exe
  2⤵
  PID:16488
- C:\Windows\System\JUyPGPm.exe
  C:\Windows\System\JUyPGPm.exe
  2⤵
  PID:16516
- C:\Windows\System\uYYwwFX.exe
  C:\Windows\System\uYYwwFX.exe
  2⤵
  PID:16540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:11944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BVWpKXl.exe

Filesize
2.3MB

MD5
71979bb8adafdc4d66f1c826774d5da3

SHA1
03fcd739260da9fb10e36399ff7ac035f9c63dd9

SHA256
a16ae5ed533d667ee7b1a8810eba2e28255639467e1c4737bac383e8b46d9a43

SHA512
deda39d784ee15266ad4affa27a9b35e2f98c9d50b844972f7fe8e979a6c2491331b974b5f7a69a23ef0b59c8e763c083ddc446123fb8916d1bba38701336f86

Download Submit
C:\Windows\System\EzgUitS.exe

Filesize
2.3MB

MD5
f4438e93b7051ff0eb1f0eb30409d32d

SHA1
43935b007a7ee388e45e6f91ab88f3c243843a95

SHA256
f91789195e8310836382678cfb3c23cddee1ee575c83386ef6103577bbff8687

SHA512
b613353f43135b95ce05ab6290e56c997033451598fb376887bc4e505134783549a515b33ef4376e0f6c63766d8aff58cb2ddaf88e39a07400d609e05f5ea3f5

Download Submit
C:\Windows\System\GLTJQCc.exe

Filesize
2.3MB

MD5
1163a4b647a88ccbc10a2bca69b8d5b3

SHA1
da326a01761995ba4aa9f524669b2227449edcb1

SHA256
07b77d7ba634a3769348e124161e669be88fdd06b8104a5be66c6a263f4374de

SHA512
32b16bec4ba5771fa8e4300e330198c59a9d58c5cefe2b715c0a6c910223dc2429f07dd2f2f83933f6c571a02006e7949c08e35ca8ac15f8c07447bfb417f16f

Download Submit
C:\Windows\System\IQdNeCy.exe

Filesize
2.3MB

MD5
c68aac67710e51ef48a672c0bbd31a2c

SHA1
78d71aa03fae3b7fb8f344bed1765c1aebb89946

SHA256
c78a4a59a1b45e617eeef195abaff28420b813a53a3d0abd8be3496cdc1ce90b

SHA512
c81233aa344f183f7656775f98d3264446c1456c7a017f29bf3700d10257bbea75790ae32ca76528d906f3b813bfcfd2f9fc494c086e31d4b9843e27b2bfad0b

Download Submit
C:\Windows\System\LeUhpWf.exe

Filesize
2.3MB

MD5
7a380893e6e90ddb5f35b3f43e647d96

SHA1
e6543088d58e907e409ef2ad5b8bf0b8c4edd36e

SHA256
385745a42121fbf954c4f9d6ab3949b46265e49a6896c51352416134bb82a3a3

SHA512
1000c4a823f397b42c5158dce8c13516820dc6669e3dcc3dd8aab07c46851e4ac4035fd2591245ddddcdaeb0f346aed0697a94df01933a29b833c3c4e17febe8

Download Submit
C:\Windows\System\PtaUhpn.exe

Filesize
2.3MB

MD5
fa3d82821532d8587b8480f0f01d6d0a

SHA1
1953b0ca778d875f21e70d4303a041b9de90ec00

SHA256
b518ae798d15611ec6e56d188671943df9f99a6fe13b4dd3c544b01f28b7cbd6

SHA512
e98c44b7aa6aa5d41c2f7ee03e567e42e6f58f391f0a853905ba20f516b0a53ccf7735436fb08ac9cd80b58f7ed7439d98f2c8ca569f55371d5eca7627c71a8f

Download Submit
C:\Windows\System\QBzfnVr.exe

Filesize
2.3MB

MD5
80b5049d19d7e4a23815c7b196c78c51

SHA1
5b59360bb8b3fb726ba8dbd87b1323a9bc820055

SHA256
1a1673fb0b28ec0041b641b2b1122ae2001e94d749825dde2cfd75fdf1c2c0ce

SHA512
f2c7478ba1c0854dbe5320953c89edba83a338484151ff1ac5562e3f9ea6f62ec10b7732cdca682d5ad27d165b3cfbffd0823bcf215d3825c9ea621193766019

Download Submit
C:\Windows\System\RKAzZUB.exe

Filesize
2.3MB

MD5
996a248fd4165d0e3f96634cb80d2e70

SHA1
a2a9cded954718dfbdb324f5a7c893dc4de3d5b6

SHA256
813249e1f86986bddab4e784709df1c763e4c60ad7ff7bcce1d6ab3760976a00

SHA512
a32b7a8d2c1cf7f095d74ec697d677d3c43d04aa59586c15702f5db10cf4f69fe712705ff792c2e6761bf6eb3ad25eead43c87f075674b43d0ab1cf67b2ea257

Download Submit
C:\Windows\System\TIBWUGU.exe

Filesize
2.3MB

MD5
acf85c7f07d25a96c17a23c9f8d32302

SHA1
e39a3dee83bd04ac96a298f54f38bd1e1ccffb9e

SHA256
b2144197153ade278de628dc0fa1307590a469e60823f6ff93c14269c6a7f400

SHA512
5369295633cf8cedb3a6f3391a66c35ae23661f8ac3d2959871f8f9bde6cc64df349377ceafe67b34f0e50eb58faeffb32cfa591617207bd4751d8f10428806c

Download Submit
C:\Windows\System\UcYZjGT.exe

Filesize
2.3MB

MD5
8b3c05b1e326c59ffc6cd5fa93c02967

SHA1
532a90c06657307dae61ee563ff2b5a6a3e57ca9

SHA256
31b12e1dc35c1da0a947667c80a92ec19ff15e6a48569a54c8625ea81a5d479b

SHA512
939f4378672976a6902b96a49d429f6124a67128d234d9f7f04e98317c17884f0d07dd5807dccc26537c0f57bb8840f999f41339e3da38a0e356c05624dc4fc5

Download Submit
C:\Windows\System\WRTXgko.exe

Filesize
2.3MB

MD5
8bf47962b7ed4de964ee5f446aa19c21

SHA1
2a251ce63f87b99f76e95d48e4cbf976f7011e7f

SHA256
a3861bfeb3c4fb390d1d82040eb4b591383b3bed7d267e4fd7c9bff9be9d837f

SHA512
ea3ab41a80a227dcdcaa17176dff335fdf2cac9d5ddd376a49610dddc045fffd7e0c27a48aaeefb39da7ef268cd1495be91f39be42ef6050a9b43c1e8571bd9b

Download Submit
C:\Windows\System\WXZTsRV.exe

Filesize
2.3MB

MD5
f7f60eaaf2d5fa0ca67ea5176ceb916a

SHA1
068a44ff3203ad06276080af058c2efd35f16038

SHA256
750e423294862b235902db91dd543abcc2ee72a4b913f9d222d120958b4de402

SHA512
f16e49a63a75090ec1c6f0fd4b7d9cc27f7919a3ca139d735742d81485b4a09ade999106c20236774094aab3635f4cc486a0adf7439d0d9fc74e5679c22ef70c

Download Submit
C:\Windows\System\WqUDNrF.exe

Filesize
2.3MB

MD5
12a9895008d63f52418b1f7f1e17bd8b

SHA1
9d20d82ed8d2483ea93e88c0be13eb1a782cfae4

SHA256
37cb73ccd65340c8dbf6f238b01cd6162ea4a8722bf4b93a981941d1bee54cac

SHA512
e9e8bf422d13b8fdbec42b4dd2de9b1e26f7ec2e2947e68f15406d82879da055ab51e7ea72917266aa99f0711d50ec7063c256b655338ca8c615ce3b0b6c34a2

Download Submit
C:\Windows\System\dPVZjOR.exe

Filesize
2.3MB

MD5
c1bc9a6c5abfc4bbe9ba39693e13de4e

SHA1
bd2de06422c98b082694bd6d5291e7cfe0818ad4

SHA256
dcf093cd1d14066d84c4ae4ae86bfe26d653daf74ed73dcbfb1323844b024a3a

SHA512
9e9bb1af2d3ea0bd2022434db32332bbe256e10901d755e23bc476f607c2bf90993ffb0444128bb2e83e34fc7f37bb4436b5ee5f547a8cba2087f36d2da06c67

Download Submit
C:\Windows\System\dUpQGfI.exe

Filesize
2.3MB

MD5
ffde22868bc8ebadbd2921a12f09c426

SHA1
6a11b7be6980d33903b824a0aa7ce9b59b91ff92

SHA256
17bce754efe92fa212d8b463acb67a0b960000ba3ffdfd4c943c19d4830cb7f6

SHA512
0ca4189e0844d6d5b076f5cc1b4bf35436572ace011890596a9d3e5dfab83ac9fefea55e50340bd12c9d485fea7798994281ae80b87dd1fda3886c37bad5adc2

Download Submit
C:\Windows\System\eNXqFlo.exe

Filesize
2.3MB

MD5
021500330d55d7731da4e8279c027741

SHA1
31008e7908e02f3c71ba4c41d5f417a7fbdbab3f

SHA256
284225ac8b8f6855b9558c1afb2aa52139374cadcafbfb92526d84b627179e40

SHA512
55a99b153652659239f946a21b92198dadb6afb5bd7380eae1014caf2b15f814b4e76fcdc20a710255922d42a627885a46e6681339ea71439739628d2923f87e

Download Submit
C:\Windows\System\fmXegSl.exe

Filesize
2.3MB

MD5
460a401cbda0491eec721c4c5251039f

SHA1
10844a21703a9bf41aad44260889bc401e352608

SHA256
b02b262771788f9c8023c94614107fe6f7db969eff433ce2f6f99c06cb9ab412

SHA512
8f700b2ff5f0fcaad7e675f5271aa154295eaee982e3cf556724ca2bfb657e616bddc17d04f5c8c74b8df3f9523f6d79d3b28411e65ef9dbb98e51bd3196133f

Download Submit
C:\Windows\System\jIBZfPE.exe

Filesize
2.3MB

MD5
15d42dd734845fe63442ad51fa4a35b7

SHA1
6de36bd48270ac00abb474d0849cd26e69334f2f

SHA256
30acbccd0f2740388987d81e3c97b20af0c5aa9800ab9149f3392cd5a4168a2b

SHA512
2bf8a535f8129157d39c10a13cc4ae214a2928bcb1a2f50c343857feb90bb901543f8f905cd4606501a6db01010f72788762fa4e948c6de05009830a3711f1bc

Download Submit
C:\Windows\System\ledKiFv.exe

Filesize
2.3MB

MD5
b6e159b22dda0502b7629ec23a7bc5a2

SHA1
15aa5c16ae39c738c950735442735f5cc372a984

SHA256
a1a667bac400c8fbf9ec51235d01ddbb30bc3752ca81fbdc52d4f4d1de4c8090

SHA512
dfb7e54d009a4f095f00116c42ca6ac656ec2b4baaaca087abe3d0d729a3ee680cba1430c8f1693d38ba5a24138d151ae53123b89c50430867b28ae976a5a948

Download Submit
C:\Windows\System\lfcVGrU.exe

Filesize
2.3MB

MD5
2a9e5bcc927b6fd41aed12a71376fa65

SHA1
a540b5249a50558e21e8d3845d0f6dac13c2c197

SHA256
3ef05ae575ae5a7626609805042ee445ea2e34870ba53484607ff91f2fa98cb2

SHA512
0712e65cd9bdf50aeb0f4d10534d999b5e5e5bba48e2828f839612d191269ccb8de64da2648406d7d6ff88d4cdff72b4fba3f5570b0aea2d9f901d1ea1bf0e4a

Download Submit
C:\Windows\System\ntBtROD.exe

Filesize
2.3MB

MD5
c987423bbb4b72727240b90382d2d140

SHA1
e5a339882456d6caf3d00f022b4bbe870794ca53

SHA256
1a62496552fc29921e1924a034b5305b4a3c37bd467f73a47aa290f2be21a62e

SHA512
a1532a66f5fc3772975a65a85d01aa4e05b21f25f07c3114ff3b9896b8af474b119c1685d83fc18b7d5da625666034934ca23ac8033baea8e64b8336fb25589c

Download Submit
C:\Windows\System\oJQtgnj.exe

Filesize
2.3MB

MD5
baf8279ced985b4712ff111bf2f2e702

SHA1
a420b678a30c11932772e5df1d27fb89f8a5e9d8

SHA256
e2b356d1f082e0bc3ab6a9e182eb92cc2ff280e9dc7b6e736b80c9f927c72f43

SHA512
88dcce3602efdae11fa6be0e31f2676827d0c68a2540f0225d709e94dfdc121f765e1c6cfeae086d40e21f4b9fec3a64545744d7718104badcaa25fef6410c4f

Download Submit
C:\Windows\System\ozgbUyf.exe

Filesize
2.3MB

MD5
4c73433420f83cc97b9f41213d03b4ab

SHA1
c210521388a9e1de89f34d307f042faad5bd3a17

SHA256
f15951a28fd60662953b28ad684712e4fafa6b3892344e0501e8da2aa14b99c9

SHA512
c3af3a36cf0b4b1c0731d513cb2bd719c5b7da99920b3da4b8609282c002165826464cf6cfa169376aea2b93467d09b5e10ac3bce4bb4cd201edb6669d795b85

Download Submit
C:\Windows\System\qqIElfv.exe

Filesize
2.3MB

MD5
9cd7266a1d29a8a728a65578afc0ef62

SHA1
42bf1fe4b9dd8b5ac9a172af7b17e63dee67e83e

SHA256
e34241f3b7b2d3ae51df4a93e67a59dfda00cf2f55bb5dc841b7c65006fcba16

SHA512
77ef1e6b30ccf5e8aaaa517d63daa348542f1e0a7db38c282099b0685f8f95430e50e10ff8662af2d6161e54d8893cbbd602fac772bb583a02d8d19612175deb

Download Submit
C:\Windows\System\qtAuvoc.exe

Filesize
2.3MB

MD5
d2242fd196c15e9fc1646cb0f019425a

SHA1
160ec787ad04788b45f4bd7095bba71a046e435e

SHA256
6ab11060676e8bf34375a80f8ef217c6c1f09386743f588ca5ebc05ffcd3b350

SHA512
b6dd4ad6d3d1fdba08ea8d74395d649816fd04a9d844bb4aa36c5850d49b2e4ad9dca9f62d1d8d7929f92261467c8ed38a74d58f59c3b0d738cc0fc798a14c4e

Download Submit
C:\Windows\System\rEXPPDa.exe

Filesize
2.3MB

MD5
00e2f725b8ef980ed29abb9d9f451c52

SHA1
a9f043c2908ec41ec0cbba07ceef7a2be51a3026

SHA256
cf1508ce2ebd7e197a39d56384498edb8ee0abf6ae2fedc56e0ea3568957df77

SHA512
ae8ee2ed80d62e88b7b95635edbaa5d243bc5152cd324256d2b62dba30bf2efafbc85774d5b393c7298c667e2feb29819dfb5a3a9382c0255d914ed6aeda4451

Download Submit
C:\Windows\System\rHsaKdY.exe

Filesize
2.3MB

MD5
67e60482c92649228575b54f47907272

SHA1
650e62789a2a26896f4ec77f96fb2d49355e0013

SHA256
0bb6f4da884ca1bf400c6abe2f4414b658d3507a92b788db16c7c9d04dd40b23

SHA512
b676ac9130618bca64f0bc82c5b42bec3d108fc4e116e54d4ba56208d98b171c9fe56646d7feb72eb585c91cf91a632b70194b9c6044584870802a612aef4900

Download Submit
C:\Windows\System\szhAcuU.exe

Filesize
2.3MB

MD5
5b99be12a8b93355738e9cdcf826b886

SHA1
72c94428507e9b8b7e39f6ffbb5ebe146c5e8f05

SHA256
26e2d37772edff2e66d47ef17ebdf57cec57b1551e9036390947b38dd18c42fd

SHA512
72d6aaf84b0a48e15742dc84a33bc0746321d54669b8469b0db1aac2a6e42013059a1f0b126045faaabcd4540634b5e6bf4699a5740b97220211e79be731a187

Download Submit
C:\Windows\System\uOJevRV.exe

Filesize
2.3MB

MD5
03394a024c15192e2de06737d3181684

SHA1
40b8db1cafbfc4689c185c37ccf8cc6d06dedb78

SHA256
080f7518e1fad16462b81346256b31177e80a332b579d233d6b2c515aa66d18e

SHA512
b7b4507acb1a5f0f46ddd66a27afbb3a310ee3c1f4915afa0adc7765f989fad4b816aefefb91ca425aac9364f6071b5b00960504a8213df86153f5fc6ad6dcbf

Download Submit
C:\Windows\System\xxLoKdO.exe

Filesize
2.3MB

MD5
7956cb25529c5b6f820b875640a671bb

SHA1
199bf736cd8c42cd65e2c67541107a0e0544f678

SHA256
b3099ea53a9d6524b091e83c30ba2c39272f840accabffdf72a1be44147c626e

SHA512
0f8a73a20f58c715a44990b8b207dea57ab5317b4c357374c639bf3692bbcdc287441e669827ef558f8561bd00b98f1ea4b05185e727c611dddddc6f8bc2c571

Download Submit
C:\Windows\System\znpOwwT.exe

Filesize
2.3MB

MD5
cfb2f4df8ede44cdf19f5942a223c11e

SHA1
03704a8a68e978dfcf59d0f1e61ecb83f78c26f8

SHA256
901d0954d471565121e3807ae07b7a3b633ec209638a9fc468eb233b1c3e4faa

SHA512
c130fbca60b59b963e856c1ca7ba1bbe55d68cd5ce1939c65322379226625cdd8dfb177148f425fd00becb0c75c15313d13ca2a31da2f7f646b03ce02ac741aa

Download Submit
C:\Windows\System\zxydrnm.exe

Filesize
2.3MB

MD5
23431bcc144514a3ca98080d32bec29d

SHA1
d29f2fa8e05f6493a39f4b4def9a1f321b03486f

SHA256
c18f68c2b89e936f0178e28f15d61c7014ab32d7deec1d58ba155d0503068f6c

SHA512
0d7e3ea555d19b0305796e0d8993fd9a90b830b96401cb5f368a026e1277f72a7dc190934698afd5676b8066a6d07e1bd81fa393d029471d94713cc49d3a27fc

Download Submit
memory/224-54-0x00007FF64A1A0000-0x00007FF64A4F4000-memory.dmp

Filesize
3.3MB

Download
memory/224-1608-0x00007FF64A1A0000-0x00007FF64A4F4000-memory.dmp

Filesize
3.3MB

Download
memory/936-217-0x00007FF692740000-0x00007FF692A94000-memory.dmp

Filesize
3.3MB

Download
memory/936-1647-0x00007FF692740000-0x00007FF692A94000-memory.dmp

Filesize
3.3MB

Download
memory/1028-213-0x00007FF77BAA0000-0x00007FF77BDF4000-memory.dmp

Filesize
3.3MB

Download
memory/1028-1643-0x00007FF77BAA0000-0x00007FF77BDF4000-memory.dmp

Filesize
3.3MB

Download
memory/1216-1508-0x00007FF668CB0000-0x00007FF669004000-memory.dmp

Filesize
3.3MB

Download
memory/1216-12-0x00007FF668CB0000-0x00007FF669004000-memory.dmp

Filesize
3.3MB

Download
memory/1216-1218-0x00007FF668CB0000-0x00007FF669004000-memory.dmp

Filesize
3.3MB

Download
memory/1360-1650-0x00007FF75A120000-0x00007FF75A474000-memory.dmp

Filesize
3.3MB

Download
memory/1360-223-0x00007FF75A120000-0x00007FF75A474000-memory.dmp

Filesize
3.3MB

Download
memory/1368-216-0x00007FF773860000-0x00007FF773BB4000-memory.dmp

Filesize
3.3MB

Download
memory/1368-1644-0x00007FF773860000-0x00007FF773BB4000-memory.dmp

Filesize
3.3MB

Download
memory/1424-1642-0x00007FF781180000-0x00007FF7814D4000-memory.dmp

Filesize
3.3MB

Download
memory/1424-66-0x00007FF781180000-0x00007FF7814D4000-memory.dmp

Filesize
3.3MB

Download
memory/1440-221-0x00007FF716D70000-0x00007FF7170C4000-memory.dmp

Filesize
3.3MB

Download
memory/1440-1648-0x00007FF716D70000-0x00007FF7170C4000-memory.dmp

Filesize
3.3MB

Download
memory/1464-50-0x00007FF6E27B0000-0x00007FF6E2B04000-memory.dmp

Filesize
3.3MB

Download
memory/1464-1591-0x00007FF6E27B0000-0x00007FF6E2B04000-memory.dmp

Filesize
3.3MB

Download
memory/1480-220-0x00007FF7AA8A0000-0x00007FF7AABF4000-memory.dmp

Filesize
3.3MB

Download
memory/1480-1645-0x00007FF7AA8A0000-0x00007FF7AABF4000-memory.dmp

Filesize
3.3MB

Download
memory/2068-1654-0x00007FF7983E0000-0x00007FF798734000-memory.dmp

Filesize
3.3MB

Download
memory/2068-230-0x00007FF7983E0000-0x00007FF798734000-memory.dmp

Filesize
3.3MB

Download
memory/2324-24-0x00007FF74EB30000-0x00007FF74EE84000-memory.dmp

Filesize
3.3MB

Download
memory/2324-1533-0x00007FF74EB30000-0x00007FF74EE84000-memory.dmp

Filesize
3.3MB

Download
memory/2572-1576-0x00007FF60B360000-0x00007FF60B6B4000-memory.dmp

Filesize
3.3MB

Download
memory/2572-61-0x00007FF60B360000-0x00007FF60B6B4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-232-0x00007FF7B6CB0000-0x00007FF7B7004000-memory.dmp

Filesize
3.3MB

Download
memory/2724-1661-0x00007FF7B6CB0000-0x00007FF7B7004000-memory.dmp

Filesize
3.3MB

Download
memory/2788-237-0x00007FF6FC8A0000-0x00007FF6FCBF4000-memory.dmp

Filesize
3.3MB

Download
memory/2788-1668-0x00007FF6FC8A0000-0x00007FF6FCBF4000-memory.dmp

Filesize
3.3MB

Download
memory/3100-222-0x00007FF6BAB40000-0x00007FF6BAE94000-memory.dmp

Filesize
3.3MB

Download
memory/3100-1649-0x00007FF6BAB40000-0x00007FF6BAE94000-memory.dmp

Filesize
3.3MB

Download
memory/3192-231-0x00007FF65E240000-0x00007FF65E594000-memory.dmp

Filesize
3.3MB

Download
memory/3192-1658-0x00007FF65E240000-0x00007FF65E594000-memory.dmp

Filesize
3.3MB

Download
memory/3412-1520-0x00007FF7A62F0000-0x00007FF7A6644000-memory.dmp

Filesize
3.3MB

Download
memory/3412-18-0x00007FF7A62F0000-0x00007FF7A6644000-memory.dmp

Filesize
3.3MB

Download
memory/3412-1503-0x00007FF7A62F0000-0x00007FF7A6644000-memory.dmp

Filesize
3.3MB

Download
memory/3568-1638-0x00007FF6AAA70000-0x00007FF6AADC4000-memory.dmp

Filesize
3.3MB

Download
memory/3568-65-0x00007FF6AAA70000-0x00007FF6AADC4000-memory.dmp

Filesize
3.3MB

Download
memory/3592-224-0x00007FF77E800000-0x00007FF77EB54000-memory.dmp

Filesize
3.3MB

Download
memory/3592-1651-0x00007FF77E800000-0x00007FF77EB54000-memory.dmp

Filesize
3.3MB

Download
memory/3792-1653-0x00007FF6F3BF0000-0x00007FF6F3F44000-memory.dmp

Filesize
3.3MB

Download
memory/3792-228-0x00007FF6F3BF0000-0x00007FF6F3F44000-memory.dmp

Filesize
3.3MB

Download
memory/4100-234-0x00007FF766F30000-0x00007FF767284000-memory.dmp

Filesize
3.3MB

Download
memory/4100-1665-0x00007FF766F30000-0x00007FF767284000-memory.dmp

Filesize
3.3MB

Download
memory/4456-11-0x00007FF6599B0000-0x00007FF659D04000-memory.dmp

Filesize
3.3MB

Download
memory/4456-1488-0x00007FF6599B0000-0x00007FF659D04000-memory.dmp

Filesize
3.3MB

Download
memory/4472-1652-0x00007FF70C1B0000-0x00007FF70C504000-memory.dmp

Filesize
3.3MB

Download
memory/4472-227-0x00007FF70C1B0000-0x00007FF70C504000-memory.dmp

Filesize
3.3MB

Download
memory/4572-47-0x00007FF752810000-0x00007FF752B64000-memory.dmp

Filesize
3.3MB

Download
memory/4572-1552-0x00007FF752810000-0x00007FF752B64000-memory.dmp

Filesize
3.3MB

Download
memory/4616-421-0x00007FF75A270000-0x00007FF75A5C4000-memory.dmp

Filesize
3.3MB

Download
memory/4616-0-0x00007FF75A270000-0x00007FF75A5C4000-memory.dmp

Filesize
3.3MB

Download
memory/4616-1-0x000001C2767D0000-0x000001C2767E0000-memory.dmp

Filesize
64KB

Download
memory/4640-212-0x00007FF6E7AE0000-0x00007FF6E7E34000-memory.dmp

Filesize
3.3MB

Download
memory/4640-1641-0x00007FF6E7AE0000-0x00007FF6E7E34000-memory.dmp

Filesize
3.3MB

Download
memory/4908-218-0x00007FF674E30000-0x00007FF675184000-memory.dmp

Filesize
3.3MB

Download
memory/4908-1646-0x00007FF674E30000-0x00007FF675184000-memory.dmp

Filesize
3.3MB

Download
memory/5020-64-0x00007FF7A6370000-0x00007FF7A66C4000-memory.dmp

Filesize
3.3MB

Download
memory/5020-1633-0x00007FF7A6370000-0x00007FF7A66C4000-memory.dmp

Filesize
3.3MB

Download
memory/5100-1670-0x00007FF756580000-0x00007FF7568D4000-memory.dmp

Filesize
3.3MB

Download
memory/5100-240-0x00007FF756580000-0x00007FF7568D4000-memory.dmp

Filesize
3.3MB

Download