xmrig | e0e294c7b2ec594404dcb48e022fa90f2bc5cf9f811c7c0ec43cfed62b4aa0a7

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
Size

2.2MB
MD5

24088b4ea5b871066752d79d2cbc72f0
SHA1

e3287ae736d9df0d6419101d9c8128dd2df1576f
SHA256

e0e294c7b2ec594404dcb48e022fa90f2bc5cf9f811c7c0ec43cfed62b4aa0a7
SHA512

29f92d6ae2cea8549aeb5b6a8134988288eaecc39e1b655854b7774b8a2931c3bd08dcb6784f07b3c681ef349c62057863e798491eeda80881ea62015c4bf4d7
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT4gvmX:BemTLkNdfE0pZrQB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3640-0-0x00007FF70D890000-0x00007FF70DBE4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023261-4.dat	xmrig
behavioral2/memory/5076-8-0x00007FF644440000-0x00007FF644794000-memory.dmp	xmrig
behavioral2/files/0x0009000000023267-10.dat	xmrig
behavioral2/files/0x0007000000023268-11.dat	xmrig
behavioral2/files/0x0007000000023269-24.dat	xmrig
behavioral2/files/0x000700000002326a-30.dat	xmrig
behavioral2/memory/516-28-0x00007FF6E2920000-0x00007FF6E2C74000-memory.dmp	xmrig
behavioral2/memory/2384-23-0x00007FF656C30000-0x00007FF656F84000-memory.dmp	xmrig
behavioral2/memory/3444-17-0x00007FF787610000-0x00007FF787964000-memory.dmp	xmrig
behavioral2/files/0x000700000002326b-33.dat	xmrig
behavioral2/memory/572-38-0x00007FF78D520000-0x00007FF78D874000-memory.dmp	xmrig
behavioral2/files/0x0008000000023266-40.dat	xmrig
behavioral2/files/0x000700000002326c-44.dat	xmrig
behavioral2/files/0x000700000002326d-54.dat	xmrig
behavioral2/files/0x000700000002326e-59.dat	xmrig
behavioral2/files/0x0007000000023270-64.dat	xmrig
behavioral2/files/0x0007000000023271-68.dat	xmrig
behavioral2/files/0x0007000000023272-77.dat	xmrig
behavioral2/files/0x0007000000023274-83.dat	xmrig
behavioral2/files/0x0007000000023276-94.dat	xmrig
behavioral2/files/0x0007000000023278-103.dat	xmrig
behavioral2/files/0x000700000002327b-118.dat	xmrig
behavioral2/files/0x0007000000023280-147.dat	xmrig
behavioral2/files/0x0007000000023284-167.dat	xmrig
behavioral2/files/0x0007000000023285-171.dat	xmrig
behavioral2/files/0x0007000000023283-159.dat	xmrig
behavioral2/files/0x0007000000023282-157.dat	xmrig
behavioral2/files/0x0007000000023281-152.dat	xmrig
behavioral2/files/0x000700000002327f-142.dat	xmrig
behavioral2/files/0x000700000002327e-136.dat	xmrig
behavioral2/files/0x000700000002327d-132.dat	xmrig
behavioral2/files/0x000700000002327c-127.dat	xmrig
behavioral2/files/0x000700000002327a-114.dat	xmrig
behavioral2/files/0x0007000000023279-109.dat	xmrig
behavioral2/files/0x0007000000023277-99.dat	xmrig
behavioral2/files/0x0007000000023275-91.dat	xmrig
behavioral2/files/0x0007000000023273-79.dat	xmrig
behavioral2/memory/4460-46-0x00007FF71D7F0000-0x00007FF71DB44000-memory.dmp	xmrig
behavioral2/memory/2992-45-0x00007FF609540000-0x00007FF609894000-memory.dmp	xmrig
behavioral2/memory/1188-42-0x00007FF7C27B0000-0x00007FF7C2B04000-memory.dmp	xmrig
behavioral2/memory/216-413-0x00007FF67D910000-0x00007FF67DC64000-memory.dmp	xmrig
behavioral2/memory/3632-417-0x00007FF7B72C0000-0x00007FF7B7614000-memory.dmp	xmrig
behavioral2/memory/1612-408-0x00007FF754CA0000-0x00007FF754FF4000-memory.dmp	xmrig
behavioral2/memory/2084-433-0x00007FF6F4950000-0x00007FF6F4CA4000-memory.dmp	xmrig
behavioral2/memory/3860-443-0x00007FF6AD0A0000-0x00007FF6AD3F4000-memory.dmp	xmrig
behavioral2/memory/4492-422-0x00007FF738250000-0x00007FF7385A4000-memory.dmp	xmrig
behavioral2/memory/3620-427-0x00007FF693CE0000-0x00007FF694034000-memory.dmp	xmrig
behavioral2/memory/3684-556-0x00007FF71D2F0000-0x00007FF71D644000-memory.dmp	xmrig
behavioral2/memory/4176-535-0x00007FF734370000-0x00007FF7346C4000-memory.dmp	xmrig
behavioral2/memory/1716-511-0x00007FF780B00000-0x00007FF780E54000-memory.dmp	xmrig
behavioral2/memory/556-514-0x00007FF7DF400000-0x00007FF7DF754000-memory.dmp	xmrig
behavioral2/memory/4632-488-0x00007FF728520000-0x00007FF728874000-memory.dmp	xmrig
behavioral2/memory/3136-468-0x00007FF7E3FE0000-0x00007FF7E4334000-memory.dmp	xmrig
behavioral2/memory/3452-457-0x00007FF7D8A60000-0x00007FF7D8DB4000-memory.dmp	xmrig
behavioral2/memory/2500-585-0x00007FF77FA00000-0x00007FF77FD54000-memory.dmp	xmrig
behavioral2/memory/4252-612-0x00007FF770160000-0x00007FF7704B4000-memory.dmp	xmrig
behavioral2/memory/4944-583-0x00007FF7A13B0000-0x00007FF7A1704000-memory.dmp	xmrig
behavioral2/memory/3052-627-0x00007FF6D21E0000-0x00007FF6D2534000-memory.dmp	xmrig
behavioral2/memory/2348-668-0x00007FF7117A0000-0x00007FF711AF4000-memory.dmp	xmrig
behavioral2/memory/3216-652-0x00007FF7F4590000-0x00007FF7F48E4000-memory.dmp	xmrig
behavioral2/memory/4744-649-0x00007FF701E20000-0x00007FF702174000-memory.dmp	xmrig
behavioral2/memory/3444-1918-0x00007FF787610000-0x00007FF787964000-memory.dmp	xmrig
behavioral2/memory/2384-1927-0x00007FF656C30000-0x00007FF656F84000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5076	tIrAjgP.exe
3444	jmllZYZ.exe
2384	ZHesWhG.exe
516	NgxHSsS.exe
572	XQXAdPK.exe
1188	PluOXyN.exe
2992	xjHbJOl.exe
4460	Ygpmory.exe
1612	KsyVGDC.exe
216	pFaiCDM.exe
3632	GhpDtoG.exe
4492	yjOGNcT.exe
3620	XAOUOUY.exe
2084	JfKzBJX.exe
3860	BZYRToE.exe
3452	vctpOHL.exe
3136	rXHmaVi.exe
4632	DoYLkuo.exe
1716	uhkvJKu.exe
556	FOncoIc.exe
4176	nvIGsoR.exe
3684	gKcumYW.exe
4944	QDgHaQO.exe
2500	jKbnwpN.exe
4252	vBlGiIC.exe
3052	TryZxXG.exe
4744	FOPLsMN.exe
3216	ZQdZnjI.exe
2348	jkrmeeH.exe
4604	bAhuYJm.exe
3652	abaaoRC.exe
2412	BqSWHze.exe
4456	GdJOPBE.exe
1548	rOuQbps.exe
4760	UxQzbsF.exe
4316	gJwyFqU.exe
2916	CdplOpC.exe
3116	wQZFyYJ.exe
4960	WccKnTV.exe
2268	iPJtVDL.exe
1508	bizgSUN.exe
1248	xZhuCQg.exe
1468	MLlIrWq.exe
1596	klBonBf.exe
452	XtEcPtP.exe
4328	olAxLUz.exe
2236	PFCbLSD.exe
456	VoMTOLf.exe
1160	WoAWcyS.exe
2012	mRbPFcZ.exe
1284	sBuXenz.exe
4904	qMLLvjS.exe
5016	AKsRMXm.exe
4732	NWCHCCk.exe
4372	vOtmbwk.exe
1996	kKCWFpI.exe
4364	UwdcXua.exe
4412	gMGyMpq.exe
3692	klYMQTx.exe
3980	SIqyeNt.exe
1552	OVYTnIg.exe
1812	dWXpNXC.exe
1480	Obwpecs.exe
1796	doMaiKr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3640-0-0x00007FF70D890000-0x00007FF70DBE4000-memory.dmp	upx
behavioral2/files/0x0008000000023261-4.dat	upx
behavioral2/memory/5076-8-0x00007FF644440000-0x00007FF644794000-memory.dmp	upx
behavioral2/files/0x0009000000023267-10.dat	upx
behavioral2/files/0x0007000000023268-11.dat	upx
behavioral2/files/0x0007000000023269-24.dat	upx
behavioral2/files/0x000700000002326a-30.dat	upx
behavioral2/memory/516-28-0x00007FF6E2920000-0x00007FF6E2C74000-memory.dmp	upx
behavioral2/memory/2384-23-0x00007FF656C30000-0x00007FF656F84000-memory.dmp	upx
behavioral2/memory/3444-17-0x00007FF787610000-0x00007FF787964000-memory.dmp	upx
behavioral2/files/0x000700000002326b-33.dat	upx
behavioral2/memory/572-38-0x00007FF78D520000-0x00007FF78D874000-memory.dmp	upx
behavioral2/files/0x0008000000023266-40.dat	upx
behavioral2/files/0x000700000002326c-44.dat	upx
behavioral2/files/0x000700000002326d-54.dat	upx
behavioral2/files/0x000700000002326e-59.dat	upx
behavioral2/files/0x0007000000023270-64.dat	upx
behavioral2/files/0x0007000000023271-68.dat	upx
behavioral2/files/0x0007000000023272-77.dat	upx
behavioral2/files/0x0007000000023274-83.dat	upx
behavioral2/files/0x0007000000023276-94.dat	upx
behavioral2/files/0x0007000000023278-103.dat	upx
behavioral2/files/0x000700000002327b-118.dat	upx
behavioral2/files/0x0007000000023280-147.dat	upx
behavioral2/files/0x0007000000023284-167.dat	upx
behavioral2/files/0x0007000000023285-171.dat	upx
behavioral2/files/0x0007000000023283-159.dat	upx
behavioral2/files/0x0007000000023282-157.dat	upx
behavioral2/files/0x0007000000023281-152.dat	upx
behavioral2/files/0x000700000002327f-142.dat	upx
behavioral2/files/0x000700000002327e-136.dat	upx
behavioral2/files/0x000700000002327d-132.dat	upx
behavioral2/files/0x000700000002327c-127.dat	upx
behavioral2/files/0x000700000002327a-114.dat	upx
behavioral2/files/0x0007000000023279-109.dat	upx
behavioral2/files/0x0007000000023277-99.dat	upx
behavioral2/files/0x0007000000023275-91.dat	upx
behavioral2/files/0x0007000000023273-79.dat	upx
behavioral2/memory/4460-46-0x00007FF71D7F0000-0x00007FF71DB44000-memory.dmp	upx
behavioral2/memory/2992-45-0x00007FF609540000-0x00007FF609894000-memory.dmp	upx
behavioral2/memory/1188-42-0x00007FF7C27B0000-0x00007FF7C2B04000-memory.dmp	upx
behavioral2/memory/216-413-0x00007FF67D910000-0x00007FF67DC64000-memory.dmp	upx
behavioral2/memory/3632-417-0x00007FF7B72C0000-0x00007FF7B7614000-memory.dmp	upx
behavioral2/memory/1612-408-0x00007FF754CA0000-0x00007FF754FF4000-memory.dmp	upx
behavioral2/memory/2084-433-0x00007FF6F4950000-0x00007FF6F4CA4000-memory.dmp	upx
behavioral2/memory/3860-443-0x00007FF6AD0A0000-0x00007FF6AD3F4000-memory.dmp	upx
behavioral2/memory/4492-422-0x00007FF738250000-0x00007FF7385A4000-memory.dmp	upx
behavioral2/memory/3620-427-0x00007FF693CE0000-0x00007FF694034000-memory.dmp	upx
behavioral2/memory/3684-556-0x00007FF71D2F0000-0x00007FF71D644000-memory.dmp	upx
behavioral2/memory/4176-535-0x00007FF734370000-0x00007FF7346C4000-memory.dmp	upx
behavioral2/memory/1716-511-0x00007FF780B00000-0x00007FF780E54000-memory.dmp	upx
behavioral2/memory/556-514-0x00007FF7DF400000-0x00007FF7DF754000-memory.dmp	upx
behavioral2/memory/4632-488-0x00007FF728520000-0x00007FF728874000-memory.dmp	upx
behavioral2/memory/3136-468-0x00007FF7E3FE0000-0x00007FF7E4334000-memory.dmp	upx
behavioral2/memory/3452-457-0x00007FF7D8A60000-0x00007FF7D8DB4000-memory.dmp	upx
behavioral2/memory/2500-585-0x00007FF77FA00000-0x00007FF77FD54000-memory.dmp	upx
behavioral2/memory/4252-612-0x00007FF770160000-0x00007FF7704B4000-memory.dmp	upx
behavioral2/memory/4944-583-0x00007FF7A13B0000-0x00007FF7A1704000-memory.dmp	upx
behavioral2/memory/3052-627-0x00007FF6D21E0000-0x00007FF6D2534000-memory.dmp	upx
behavioral2/memory/2348-668-0x00007FF7117A0000-0x00007FF711AF4000-memory.dmp	upx
behavioral2/memory/3216-652-0x00007FF7F4590000-0x00007FF7F48E4000-memory.dmp	upx
behavioral2/memory/4744-649-0x00007FF701E20000-0x00007FF702174000-memory.dmp	upx
behavioral2/memory/3444-1918-0x00007FF787610000-0x00007FF787964000-memory.dmp	upx
behavioral2/memory/2384-1927-0x00007FF656C30000-0x00007FF656F84000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NXlERlU.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\bBcQTDR.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\PDDgJUz.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\LkivAqB.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\zDvmdMM.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZZhUwOO.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\LNhfjxG.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\OVYTnIg.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\yIohSAr.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\uVmrvFZ.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\sOoXNpY.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\xGuPVMg.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\GfmfUHb.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\SlYJAQJ.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\ubNAJRn.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\XjMhbLv.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\BuSmDAL.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\CRhFcoA.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\DFTaXsp.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\efcUEjr.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\zpConzp.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\UrvCsjq.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\hckbXvA.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\tVltGrV.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\QEQBWlI.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\jKfLnse.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\sdYxnKV.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\dGxMuzD.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\TcDQXsn.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\jjFSHRB.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\eKerZDq.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\MLEDrxU.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\jiPyifc.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\xPjCWeg.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\xEKnmPL.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\cQbxtCq.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\vZEeHEt.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\PzlZEFI.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\bAYTkMn.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZTHPcmA.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\ASGrAFK.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\XhzBSbQ.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\PyfaOsc.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\YjEXpXs.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\GsJFXNT.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\ONYSXci.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\UczMfQb.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\rsGCSRN.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\dkQmbJX.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\tFsdTVk.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\YgButOH.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\uXMYIUw.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\BbSpwCG.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\eOSCbkq.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\OeohEXr.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\dWXpNXC.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\AITkdsY.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\HUXMGWL.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\vLqsUPl.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\MfovMSI.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\rOuQbps.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\pZfzSTY.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\AfKMelO.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
File created	C:\Windows\System\PVphUNu.exe	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 5076	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	90
PID 3640 wrote to memory of 5076	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	90
PID 3640 wrote to memory of 3444	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	91
PID 3640 wrote to memory of 3444	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	91
PID 3640 wrote to memory of 2384	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	92
PID 3640 wrote to memory of 2384	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	92
PID 3640 wrote to memory of 516	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	93
PID 3640 wrote to memory of 516	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	93
PID 3640 wrote to memory of 572	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	94
PID 3640 wrote to memory of 572	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	94
PID 3640 wrote to memory of 1188	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	95
PID 3640 wrote to memory of 1188	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	95
PID 3640 wrote to memory of 2992	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	96
PID 3640 wrote to memory of 2992	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	96
PID 3640 wrote to memory of 4460	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	97
PID 3640 wrote to memory of 4460	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	97
PID 3640 wrote to memory of 1612	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	98
PID 3640 wrote to memory of 1612	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	98
PID 3640 wrote to memory of 216	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	99
PID 3640 wrote to memory of 216	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	99
PID 3640 wrote to memory of 3632	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	100
PID 3640 wrote to memory of 3632	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	100
PID 3640 wrote to memory of 4492	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	101
PID 3640 wrote to memory of 4492	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	101
PID 3640 wrote to memory of 3620	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	102
PID 3640 wrote to memory of 3620	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	102
PID 3640 wrote to memory of 2084	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	103
PID 3640 wrote to memory of 2084	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	103
PID 3640 wrote to memory of 3860	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	104
PID 3640 wrote to memory of 3860	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	104
PID 3640 wrote to memory of 3452	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	105
PID 3640 wrote to memory of 3452	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	105
PID 3640 wrote to memory of 3136	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	106
PID 3640 wrote to memory of 3136	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	106
PID 3640 wrote to memory of 4632	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	107
PID 3640 wrote to memory of 4632	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	107
PID 3640 wrote to memory of 1716	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	108
PID 3640 wrote to memory of 1716	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	108
PID 3640 wrote to memory of 556	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	109
PID 3640 wrote to memory of 556	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	109
PID 3640 wrote to memory of 4176	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	110
PID 3640 wrote to memory of 4176	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	110
PID 3640 wrote to memory of 3684	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	111
PID 3640 wrote to memory of 3684	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	111
PID 3640 wrote to memory of 4944	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	112
PID 3640 wrote to memory of 4944	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	112
PID 3640 wrote to memory of 2500	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	113
PID 3640 wrote to memory of 2500	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	113
PID 3640 wrote to memory of 4252	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	114
PID 3640 wrote to memory of 4252	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	114
PID 3640 wrote to memory of 3052	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	115
PID 3640 wrote to memory of 3052	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	115
PID 3640 wrote to memory of 4744	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	116
PID 3640 wrote to memory of 4744	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	116
PID 3640 wrote to memory of 3216	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	117
PID 3640 wrote to memory of 3216	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	117
PID 3640 wrote to memory of 2348	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	118
PID 3640 wrote to memory of 2348	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	118
PID 3640 wrote to memory of 4604	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	119
PID 3640 wrote to memory of 4604	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	119
PID 3640 wrote to memory of 3652	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	120
PID 3640 wrote to memory of 3652	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	120
PID 3640 wrote to memory of 2412	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	121
PID 3640 wrote to memory of 2412	3640	24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe	121

C:\Users\Admin\AppData\Local\Temp\24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\24088b4ea5b871066752d79d2cbc72f0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\System\tIrAjgP.exe
  C:\Windows\System\tIrAjgP.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\jmllZYZ.exe
  C:\Windows\System\jmllZYZ.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\ZHesWhG.exe
  C:\Windows\System\ZHesWhG.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\NgxHSsS.exe
  C:\Windows\System\NgxHSsS.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\XQXAdPK.exe
  C:\Windows\System\XQXAdPK.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\PluOXyN.exe
  C:\Windows\System\PluOXyN.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\xjHbJOl.exe
  C:\Windows\System\xjHbJOl.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\Ygpmory.exe
  C:\Windows\System\Ygpmory.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\KsyVGDC.exe
  C:\Windows\System\KsyVGDC.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\pFaiCDM.exe
  C:\Windows\System\pFaiCDM.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\GhpDtoG.exe
  C:\Windows\System\GhpDtoG.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\yjOGNcT.exe
  C:\Windows\System\yjOGNcT.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\XAOUOUY.exe
  C:\Windows\System\XAOUOUY.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\JfKzBJX.exe
  C:\Windows\System\JfKzBJX.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\BZYRToE.exe
  C:\Windows\System\BZYRToE.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\vctpOHL.exe
  C:\Windows\System\vctpOHL.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\rXHmaVi.exe
  C:\Windows\System\rXHmaVi.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\DoYLkuo.exe
  C:\Windows\System\DoYLkuo.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\uhkvJKu.exe
  C:\Windows\System\uhkvJKu.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\FOncoIc.exe
  C:\Windows\System\FOncoIc.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\nvIGsoR.exe
  C:\Windows\System\nvIGsoR.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\gKcumYW.exe
  C:\Windows\System\gKcumYW.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\QDgHaQO.exe
  C:\Windows\System\QDgHaQO.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\jKbnwpN.exe
  C:\Windows\System\jKbnwpN.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\vBlGiIC.exe
  C:\Windows\System\vBlGiIC.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\TryZxXG.exe
  C:\Windows\System\TryZxXG.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\FOPLsMN.exe
  C:\Windows\System\FOPLsMN.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\ZQdZnjI.exe
  C:\Windows\System\ZQdZnjI.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\jkrmeeH.exe
  C:\Windows\System\jkrmeeH.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\bAhuYJm.exe
  C:\Windows\System\bAhuYJm.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\abaaoRC.exe
  C:\Windows\System\abaaoRC.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\BqSWHze.exe
  C:\Windows\System\BqSWHze.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\GdJOPBE.exe
  C:\Windows\System\GdJOPBE.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\rOuQbps.exe
  C:\Windows\System\rOuQbps.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\UxQzbsF.exe
  C:\Windows\System\UxQzbsF.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\gJwyFqU.exe
  C:\Windows\System\gJwyFqU.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\CdplOpC.exe
  C:\Windows\System\CdplOpC.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\wQZFyYJ.exe
  C:\Windows\System\wQZFyYJ.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\WccKnTV.exe
  C:\Windows\System\WccKnTV.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\iPJtVDL.exe
  C:\Windows\System\iPJtVDL.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\bizgSUN.exe
  C:\Windows\System\bizgSUN.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\xZhuCQg.exe
  C:\Windows\System\xZhuCQg.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\MLlIrWq.exe
  C:\Windows\System\MLlIrWq.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\klBonBf.exe
  C:\Windows\System\klBonBf.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\XtEcPtP.exe
  C:\Windows\System\XtEcPtP.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\olAxLUz.exe
  C:\Windows\System\olAxLUz.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\PFCbLSD.exe
  C:\Windows\System\PFCbLSD.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\VoMTOLf.exe
  C:\Windows\System\VoMTOLf.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\WoAWcyS.exe
  C:\Windows\System\WoAWcyS.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\mRbPFcZ.exe
  C:\Windows\System\mRbPFcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\sBuXenz.exe
  C:\Windows\System\sBuXenz.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\qMLLvjS.exe
  C:\Windows\System\qMLLvjS.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\AKsRMXm.exe
  C:\Windows\System\AKsRMXm.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\NWCHCCk.exe
  C:\Windows\System\NWCHCCk.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\vOtmbwk.exe
  C:\Windows\System\vOtmbwk.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\kKCWFpI.exe
  C:\Windows\System\kKCWFpI.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\UwdcXua.exe
  C:\Windows\System\UwdcXua.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\gMGyMpq.exe
  C:\Windows\System\gMGyMpq.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\klYMQTx.exe
  C:\Windows\System\klYMQTx.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\SIqyeNt.exe
  C:\Windows\System\SIqyeNt.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\OVYTnIg.exe
  C:\Windows\System\OVYTnIg.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\dWXpNXC.exe
  C:\Windows\System\dWXpNXC.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\Obwpecs.exe
  C:\Windows\System\Obwpecs.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\doMaiKr.exe
  C:\Windows\System\doMaiKr.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\PDDgJUz.exe
  C:\Windows\System\PDDgJUz.exe
  2⤵
  PID:4784
- C:\Windows\System\xYlRJMg.exe
  C:\Windows\System\xYlRJMg.exe
  2⤵
  PID:3188
- C:\Windows\System\peBLXxI.exe
  C:\Windows\System\peBLXxI.exe
  2⤵
  PID:400
- C:\Windows\System\mYDjqqR.exe
  C:\Windows\System\mYDjqqR.exe
  2⤵
  PID:1004
- C:\Windows\System\mXcDrcJ.exe
  C:\Windows\System\mXcDrcJ.exe
  2⤵
  PID:3688
- C:\Windows\System\fCTlGkf.exe
  C:\Windows\System\fCTlGkf.exe
  2⤵
  PID:5148
- C:\Windows\System\ddIHSdK.exe
  C:\Windows\System\ddIHSdK.exe
  2⤵
  PID:5172
- C:\Windows\System\xXmrQfy.exe
  C:\Windows\System\xXmrQfy.exe
  2⤵
  PID:5192
- C:\Windows\System\sXFxpoy.exe
  C:\Windows\System\sXFxpoy.exe
  2⤵
  PID:5252
- C:\Windows\System\oUOEPYG.exe
  C:\Windows\System\oUOEPYG.exe
  2⤵
  PID:5268
- C:\Windows\System\rCDdURq.exe
  C:\Windows\System\rCDdURq.exe
  2⤵
  PID:5284
- C:\Windows\System\kBzbmfs.exe
  C:\Windows\System\kBzbmfs.exe
  2⤵
  PID:5300
- C:\Windows\System\VrtqlVQ.exe
  C:\Windows\System\VrtqlVQ.exe
  2⤵
  PID:5328
- C:\Windows\System\QKCdoeD.exe
  C:\Windows\System\QKCdoeD.exe
  2⤵
  PID:5352
- C:\Windows\System\TEjXnAD.exe
  C:\Windows\System\TEjXnAD.exe
  2⤵
  PID:5380
- C:\Windows\System\aXHPzTk.exe
  C:\Windows\System\aXHPzTk.exe
  2⤵
  PID:5408
- C:\Windows\System\atXIfgu.exe
  C:\Windows\System\atXIfgu.exe
  2⤵
  PID:5436
- C:\Windows\System\dmnZpGp.exe
  C:\Windows\System\dmnZpGp.exe
  2⤵
  PID:5468
- C:\Windows\System\aRoZePr.exe
  C:\Windows\System\aRoZePr.exe
  2⤵
  PID:5496
- C:\Windows\System\xbQkdnM.exe
  C:\Windows\System\xbQkdnM.exe
  2⤵
  PID:5520
- C:\Windows\System\wYHXOTF.exe
  C:\Windows\System\wYHXOTF.exe
  2⤵
  PID:5592
- C:\Windows\System\kxuezZP.exe
  C:\Windows\System\kxuezZP.exe
  2⤵
  PID:5612
- C:\Windows\System\KDaeLej.exe
  C:\Windows\System\KDaeLej.exe
  2⤵
  PID:5628
- C:\Windows\System\fZPCawM.exe
  C:\Windows\System\fZPCawM.exe
  2⤵
  PID:5644
- C:\Windows\System\ncOFVor.exe
  C:\Windows\System\ncOFVor.exe
  2⤵
  PID:5672
- C:\Windows\System\euDCWQa.exe
  C:\Windows\System\euDCWQa.exe
  2⤵
  PID:5700
- C:\Windows\System\OnQQOuv.exe
  C:\Windows\System\OnQQOuv.exe
  2⤵
  PID:5724
- C:\Windows\System\UKMkMea.exe
  C:\Windows\System\UKMkMea.exe
  2⤵
  PID:5752
- C:\Windows\System\ciJGvLc.exe
  C:\Windows\System\ciJGvLc.exe
  2⤵
  PID:5780
- C:\Windows\System\UgfDXeP.exe
  C:\Windows\System\UgfDXeP.exe
  2⤵
  PID:5808
- C:\Windows\System\FxxZvAg.exe
  C:\Windows\System\FxxZvAg.exe
  2⤵
  PID:5836
- C:\Windows\System\avTuUho.exe
  C:\Windows\System\avTuUho.exe
  2⤵
  PID:5864
- C:\Windows\System\QTYkiFN.exe
  C:\Windows\System\QTYkiFN.exe
  2⤵
  PID:5892
- C:\Windows\System\FsXjTqJ.exe
  C:\Windows\System\FsXjTqJ.exe
  2⤵
  PID:5920
- C:\Windows\System\AITkdsY.exe
  C:\Windows\System\AITkdsY.exe
  2⤵
  PID:5948
- C:\Windows\System\NtmjxYD.exe
  C:\Windows\System\NtmjxYD.exe
  2⤵
  PID:5976
- C:\Windows\System\eNglroo.exe
  C:\Windows\System\eNglroo.exe
  2⤵
  PID:6004
- C:\Windows\System\PohKMVr.exe
  C:\Windows\System\PohKMVr.exe
  2⤵
  PID:6032
- C:\Windows\System\DiORGrk.exe
  C:\Windows\System\DiORGrk.exe
  2⤵
  PID:6060
- C:\Windows\System\nbrZHLV.exe
  C:\Windows\System\nbrZHLV.exe
  2⤵
  PID:6088
- C:\Windows\System\COEsciL.exe
  C:\Windows\System\COEsciL.exe
  2⤵
  PID:6116
- C:\Windows\System\PhLUffV.exe
  C:\Windows\System\PhLUffV.exe
  2⤵
  PID:3572
- C:\Windows\System\OWhWtqC.exe
  C:\Windows\System\OWhWtqC.exe
  2⤵
  PID:4884
- C:\Windows\System\CcQpiaH.exe
  C:\Windows\System\CcQpiaH.exe
  2⤵
  PID:5204
- C:\Windows\System\yoUFfUp.exe
  C:\Windows\System\yoUFfUp.exe
  2⤵
  PID:5264
- C:\Windows\System\EOBKgTy.exe
  C:\Windows\System\EOBKgTy.exe
  2⤵
  PID:2140
- C:\Windows\System\pXJVALq.exe
  C:\Windows\System\pXJVALq.exe
  2⤵
  PID:5368
- C:\Windows\System\XBVtqVn.exe
  C:\Windows\System\XBVtqVn.exe
  2⤵
  PID:5404
- C:\Windows\System\kBHhiNe.exe
  C:\Windows\System\kBHhiNe.exe
  2⤵
  PID:3588
- C:\Windows\System\MaMbDQM.exe
  C:\Windows\System\MaMbDQM.exe
  2⤵
  PID:1152
- C:\Windows\System\dBOMYsP.exe
  C:\Windows\System\dBOMYsP.exe
  2⤵
  PID:5604
- C:\Windows\System\hcbTMWG.exe
  C:\Windows\System\hcbTMWG.exe
  2⤵
  PID:3904
- C:\Windows\System\rsGCSRN.exe
  C:\Windows\System\rsGCSRN.exe
  2⤵
  PID:5744
- C:\Windows\System\ZoYgUPy.exe
  C:\Windows\System\ZoYgUPy.exe
  2⤵
  PID:4920
- C:\Windows\System\mLxjKwk.exe
  C:\Windows\System\mLxjKwk.exe
  2⤵
  PID:1424
- C:\Windows\System\QxDDkxc.exe
  C:\Windows\System\QxDDkxc.exe
  2⤵
  PID:5852
- C:\Windows\System\xIPORAd.exe
  C:\Windows\System\xIPORAd.exe
  2⤵
  PID:3900
- C:\Windows\System\WNVDnse.exe
  C:\Windows\System\WNVDnse.exe
  2⤵
  PID:5912
- C:\Windows\System\DMgRNEU.exe
  C:\Windows\System\DMgRNEU.exe
  2⤵
  PID:5944
- C:\Windows\System\aWzNlym.exe
  C:\Windows\System\aWzNlym.exe
  2⤵
  PID:5992
- C:\Windows\System\zjvFtSw.exe
  C:\Windows\System\zjvFtSw.exe
  2⤵
  PID:2528
- C:\Windows\System\WeagyeF.exe
  C:\Windows\System\WeagyeF.exe
  2⤵
  PID:6076
- C:\Windows\System\wwzyCLe.exe
  C:\Windows\System\wwzyCLe.exe
  2⤵
  PID:6080
- C:\Windows\System\xPjCWeg.exe
  C:\Windows\System\xPjCWeg.exe
  2⤵
  PID:5160
- C:\Windows\System\woxgowB.exe
  C:\Windows\System\woxgowB.exe
  2⤵
  PID:828
- C:\Windows\System\QSXGyib.exe
  C:\Windows\System\QSXGyib.exe
  2⤵
  PID:6108
- C:\Windows\System\NNNynuV.exe
  C:\Windows\System\NNNynuV.exe
  2⤵
  PID:1372
- C:\Windows\System\eLQdqPA.exe
  C:\Windows\System\eLQdqPA.exe
  2⤵
  PID:3844
- C:\Windows\System\wNWjrSL.exe
  C:\Windows\System\wNWjrSL.exe
  2⤵
  PID:5004
- C:\Windows\System\KcvjdJa.exe
  C:\Windows\System\KcvjdJa.exe
  2⤵
  PID:3612
- C:\Windows\System\MTgyYDM.exe
  C:\Windows\System\MTgyYDM.exe
  2⤵
  PID:5216
- C:\Windows\System\eutFbAu.exe
  C:\Windows\System\eutFbAu.exe
  2⤵
  PID:4888
- C:\Windows\System\RMUUdnv.exe
  C:\Windows\System\RMUUdnv.exe
  2⤵
  PID:5348
- C:\Windows\System\YWrOryn.exe
  C:\Windows\System\YWrOryn.exe
  2⤵
  PID:1792
- C:\Windows\System\zaVHZEt.exe
  C:\Windows\System\zaVHZEt.exe
  2⤵
  PID:5656
- C:\Windows\System\PgMODiX.exe
  C:\Windows\System\PgMODiX.exe
  2⤵
  PID:5768
- C:\Windows\System\IGBMapT.exe
  C:\Windows\System\IGBMapT.exe
  2⤵
  PID:5748
- C:\Windows\System\FYxVXLF.exe
  C:\Windows\System\FYxVXLF.exe
  2⤵
  PID:4508
- C:\Windows\System\cBRugdO.exe
  C:\Windows\System\cBRugdO.exe
  2⤵
  PID:3320
- C:\Windows\System\CuPCyYM.exe
  C:\Windows\System\CuPCyYM.exe
  2⤵
  PID:716
- C:\Windows\System\XEidYuf.exe
  C:\Windows\System\XEidYuf.exe
  2⤵
  PID:1988
- C:\Windows\System\euEUkLJ.exe
  C:\Windows\System\euEUkLJ.exe
  2⤵
  PID:2656
- C:\Windows\System\vZVBMiQ.exe
  C:\Windows\System\vZVBMiQ.exe
  2⤵
  PID:5316
- C:\Windows\System\fVMyWld.exe
  C:\Windows\System\fVMyWld.exe
  2⤵
  PID:5584
- C:\Windows\System\NknIDLA.exe
  C:\Windows\System\NknIDLA.exe
  2⤵
  PID:6160
- C:\Windows\System\DOLdtpi.exe
  C:\Windows\System\DOLdtpi.exe
  2⤵
  PID:6184
- C:\Windows\System\uSkbUwZ.exe
  C:\Windows\System\uSkbUwZ.exe
  2⤵
  PID:6212
- C:\Windows\System\HmlJGcN.exe
  C:\Windows\System\HmlJGcN.exe
  2⤵
  PID:6232
- C:\Windows\System\tYnrdQo.exe
  C:\Windows\System\tYnrdQo.exe
  2⤵
  PID:6260
- C:\Windows\System\GwEIkuC.exe
  C:\Windows\System\GwEIkuC.exe
  2⤵
  PID:6280
- C:\Windows\System\XjXppVp.exe
  C:\Windows\System\XjXppVp.exe
  2⤵
  PID:6308
- C:\Windows\System\pxDLtpd.exe
  C:\Windows\System\pxDLtpd.exe
  2⤵
  PID:6324
- C:\Windows\System\isojppl.exe
  C:\Windows\System\isojppl.exe
  2⤵
  PID:6348
- C:\Windows\System\rpMpynh.exe
  C:\Windows\System\rpMpynh.exe
  2⤵
  PID:6380
- C:\Windows\System\uIMfbAv.exe
  C:\Windows\System\uIMfbAv.exe
  2⤵
  PID:6408
- C:\Windows\System\ovVGnpx.exe
  C:\Windows\System\ovVGnpx.exe
  2⤵
  PID:6436
- C:\Windows\System\XzaMcoX.exe
  C:\Windows\System\XzaMcoX.exe
  2⤵
  PID:6464
- C:\Windows\System\EelWlhZ.exe
  C:\Windows\System\EelWlhZ.exe
  2⤵
  PID:6484
- C:\Windows\System\UzANVOj.exe
  C:\Windows\System\UzANVOj.exe
  2⤵
  PID:6508
- C:\Windows\System\jymfplo.exe
  C:\Windows\System\jymfplo.exe
  2⤵
  PID:6524
- C:\Windows\System\ThlCmdy.exe
  C:\Windows\System\ThlCmdy.exe
  2⤵
  PID:6540
- C:\Windows\System\QBFhPPT.exe
  C:\Windows\System\QBFhPPT.exe
  2⤵
  PID:6564
- C:\Windows\System\jRYyyPN.exe
  C:\Windows\System\jRYyyPN.exe
  2⤵
  PID:6588
- C:\Windows\System\ABSsmFD.exe
  C:\Windows\System\ABSsmFD.exe
  2⤵
  PID:6604
- C:\Windows\System\kvAytwL.exe
  C:\Windows\System\kvAytwL.exe
  2⤵
  PID:6636
- C:\Windows\System\chDTJQi.exe
  C:\Windows\System\chDTJQi.exe
  2⤵
  PID:6664
- C:\Windows\System\JYiZdwM.exe
  C:\Windows\System\JYiZdwM.exe
  2⤵
  PID:6704
- C:\Windows\System\SZSDBbs.exe
  C:\Windows\System\SZSDBbs.exe
  2⤵
  PID:6724
- C:\Windows\System\MisNBYG.exe
  C:\Windows\System\MisNBYG.exe
  2⤵
  PID:6756
- C:\Windows\System\rUmyBSz.exe
  C:\Windows\System\rUmyBSz.exe
  2⤵
  PID:6776
- C:\Windows\System\UrvCsjq.exe
  C:\Windows\System\UrvCsjq.exe
  2⤵
  PID:6800
- C:\Windows\System\oqbAkhv.exe
  C:\Windows\System\oqbAkhv.exe
  2⤵
  PID:6816
- C:\Windows\System\Qnicfzb.exe
  C:\Windows\System\Qnicfzb.exe
  2⤵
  PID:6848
- C:\Windows\System\FzpMPiO.exe
  C:\Windows\System\FzpMPiO.exe
  2⤵
  PID:6872
- C:\Windows\System\SlYJAQJ.exe
  C:\Windows\System\SlYJAQJ.exe
  2⤵
  PID:6892
- C:\Windows\System\vqeXlME.exe
  C:\Windows\System\vqeXlME.exe
  2⤵
  PID:6912
- C:\Windows\System\WyNsitc.exe
  C:\Windows\System\WyNsitc.exe
  2⤵
  PID:6952
- C:\Windows\System\brYRizF.exe
  C:\Windows\System\brYRizF.exe
  2⤵
  PID:6976
- C:\Windows\System\jeUQGEx.exe
  C:\Windows\System\jeUQGEx.exe
  2⤵
  PID:7000
- C:\Windows\System\YyKpdyU.exe
  C:\Windows\System\YyKpdyU.exe
  2⤵
  PID:7028
- C:\Windows\System\slRbSpN.exe
  C:\Windows\System\slRbSpN.exe
  2⤵
  PID:7052
- C:\Windows\System\sUYdYWW.exe
  C:\Windows\System\sUYdYWW.exe
  2⤵
  PID:7076
- C:\Windows\System\uaWPzaF.exe
  C:\Windows\System\uaWPzaF.exe
  2⤵
  PID:7104
- C:\Windows\System\IGTKQXj.exe
  C:\Windows\System\IGTKQXj.exe
  2⤵
  PID:2988
- C:\Windows\System\llXUIte.exe
  C:\Windows\System\llXUIte.exe
  2⤵
  PID:5860
- C:\Windows\System\uwRijkK.exe
  C:\Windows\System\uwRijkK.exe
  2⤵
  PID:6388
- C:\Windows\System\UKWBmiF.exe
  C:\Windows\System\UKWBmiF.exe
  2⤵
  PID:6248
- C:\Windows\System\gRkigpN.exe
  C:\Windows\System\gRkigpN.exe
  2⤵
  PID:6492
- C:\Windows\System\OCTKODc.exe
  C:\Windows\System\OCTKODc.exe
  2⤵
  PID:6208
- C:\Windows\System\SIJXVRg.exe
  C:\Windows\System\SIJXVRg.exe
  2⤵
  PID:6404
- C:\Windows\System\hHFGQZO.exe
  C:\Windows\System\hHFGQZO.exe
  2⤵
  PID:6456
- C:\Windows\System\ciESioh.exe
  C:\Windows\System\ciESioh.exe
  2⤵
  PID:6272
- C:\Windows\System\rbhwhao.exe
  C:\Windows\System\rbhwhao.exe
  2⤵
  PID:6336
- C:\Windows\System\ukKvcay.exe
  C:\Windows\System\ukKvcay.exe
  2⤵
  PID:6812
- C:\Windows\System\FkfbNhT.exe
  C:\Windows\System\FkfbNhT.exe
  2⤵
  PID:6836
- C:\Windows\System\zdJXQjG.exe
  C:\Windows\System\zdJXQjG.exe
  2⤵
  PID:7092
- C:\Windows\System\fKOhRHq.exe
  C:\Windows\System\fKOhRHq.exe
  2⤵
  PID:6156
- C:\Windows\System\YgButOH.exe
  C:\Windows\System\YgButOH.exe
  2⤵
  PID:6240
- C:\Windows\System\QTJyEVP.exe
  C:\Windows\System\QTJyEVP.exe
  2⤵
  PID:5828
- C:\Windows\System\MdgMQdi.exe
  C:\Windows\System\MdgMQdi.exe
  2⤵
  PID:6596
- C:\Windows\System\TMqHVpF.exe
  C:\Windows\System\TMqHVpF.exe
  2⤵
  PID:6648
- C:\Windows\System\ZvHkWPQ.exe
  C:\Windows\System\ZvHkWPQ.exe
  2⤵
  PID:7172
- C:\Windows\System\HICpttu.exe
  C:\Windows\System\HICpttu.exe
  2⤵
  PID:7212
- C:\Windows\System\KMjNziz.exe
  C:\Windows\System\KMjNziz.exe
  2⤵
  PID:7228
- C:\Windows\System\fJQNmNN.exe
  C:\Windows\System\fJQNmNN.exe
  2⤵
  PID:7252
- C:\Windows\System\YniIJel.exe
  C:\Windows\System\YniIJel.exe
  2⤵
  PID:7284
- C:\Windows\System\osfpxec.exe
  C:\Windows\System\osfpxec.exe
  2⤵
  PID:7368
- C:\Windows\System\YVnLcHf.exe
  C:\Windows\System\YVnLcHf.exe
  2⤵
  PID:7388
- C:\Windows\System\aLdqyRm.exe
  C:\Windows\System\aLdqyRm.exe
  2⤵
  PID:7420
- C:\Windows\System\wobrLBV.exe
  C:\Windows\System\wobrLBV.exe
  2⤵
  PID:7444
- C:\Windows\System\dtJiKeE.exe
  C:\Windows\System\dtJiKeE.exe
  2⤵
  PID:7484
- C:\Windows\System\HQcWpqS.exe
  C:\Windows\System\HQcWpqS.exe
  2⤵
  PID:7500
- C:\Windows\System\eKerZDq.exe
  C:\Windows\System\eKerZDq.exe
  2⤵
  PID:7524
- C:\Windows\System\aaePQnp.exe
  C:\Windows\System\aaePQnp.exe
  2⤵
  PID:7552
- C:\Windows\System\DjUrjub.exe
  C:\Windows\System\DjUrjub.exe
  2⤵
  PID:7612
- C:\Windows\System\oZEHmnt.exe
  C:\Windows\System\oZEHmnt.exe
  2⤵
  PID:7632
- C:\Windows\System\ouFIidB.exe
  C:\Windows\System\ouFIidB.exe
  2⤵
  PID:7648
- C:\Windows\System\YjEXpXs.exe
  C:\Windows\System\YjEXpXs.exe
  2⤵
  PID:7668
- C:\Windows\System\dtqffXe.exe
  C:\Windows\System\dtqffXe.exe
  2⤵
  PID:7688
- C:\Windows\System\KTkGlCZ.exe
  C:\Windows\System\KTkGlCZ.exe
  2⤵
  PID:7704
- C:\Windows\System\xkjcWbr.exe
  C:\Windows\System\xkjcWbr.exe
  2⤵
  PID:7724
- C:\Windows\System\HDgxypE.exe
  C:\Windows\System\HDgxypE.exe
  2⤵
  PID:7752
- C:\Windows\System\MBpjDiF.exe
  C:\Windows\System\MBpjDiF.exe
  2⤵
  PID:7768
- C:\Windows\System\UcyytRd.exe
  C:\Windows\System\UcyytRd.exe
  2⤵
  PID:7788
- C:\Windows\System\ElbbLwf.exe
  C:\Windows\System\ElbbLwf.exe
  2⤵
  PID:7828
- C:\Windows\System\kgYSGQw.exe
  C:\Windows\System\kgYSGQw.exe
  2⤵
  PID:7852
- C:\Windows\System\BjhbeDL.exe
  C:\Windows\System\BjhbeDL.exe
  2⤵
  PID:7944
- C:\Windows\System\VEjZEdH.exe
  C:\Windows\System\VEjZEdH.exe
  2⤵
  PID:7972
- C:\Windows\System\MLEDrxU.exe
  C:\Windows\System\MLEDrxU.exe
  2⤵
  PID:8032
- C:\Windows\System\yxjmOnV.exe
  C:\Windows\System\yxjmOnV.exe
  2⤵
  PID:8064
- C:\Windows\System\oKNADnW.exe
  C:\Windows\System\oKNADnW.exe
  2⤵
  PID:8100
- C:\Windows\System\VTEZIPK.exe
  C:\Windows\System\VTEZIPK.exe
  2⤵
  PID:8120
- C:\Windows\System\bpObqph.exe
  C:\Windows\System\bpObqph.exe
  2⤵
  PID:8140
- C:\Windows\System\bQioGQI.exe
  C:\Windows\System\bQioGQI.exe
  2⤵
  PID:8168
- C:\Windows\System\eAYqpLT.exe
  C:\Windows\System\eAYqpLT.exe
  2⤵
  PID:6984
- C:\Windows\System\WeegUHW.exe
  C:\Windows\System\WeegUHW.exe
  2⤵
  PID:6320
- C:\Windows\System\mWkFwZy.exe
  C:\Windows\System\mWkFwZy.exe
  2⤵
  PID:1096
- C:\Windows\System\vjEClqK.exe
  C:\Windows\System\vjEClqK.exe
  2⤵
  PID:6696
- C:\Windows\System\PQTfhNP.exe
  C:\Windows\System\PQTfhNP.exe
  2⤵
  PID:6744
- C:\Windows\System\ehlRyFH.exe
  C:\Windows\System\ehlRyFH.exe
  2⤵
  PID:6968
- C:\Windows\System\xExCwSh.exe
  C:\Windows\System\xExCwSh.exe
  2⤵
  PID:7268
- C:\Windows\System\XJPsITq.exe
  C:\Windows\System\XJPsITq.exe
  2⤵
  PID:7316
- C:\Windows\System\avTjFbL.exe
  C:\Windows\System\avTjFbL.exe
  2⤵
  PID:7376
- C:\Windows\System\AgtcppW.exe
  C:\Windows\System\AgtcppW.exe
  2⤵
  PID:7564
- C:\Windows\System\KLGzIGC.exe
  C:\Windows\System\KLGzIGC.exe
  2⤵
  PID:7496
- C:\Windows\System\WEFsAZs.exe
  C:\Windows\System\WEFsAZs.exe
  2⤵
  PID:7540
- C:\Windows\System\QsESsKa.exe
  C:\Windows\System\QsESsKa.exe
  2⤵
  PID:3020
- C:\Windows\System\kXCejza.exe
  C:\Windows\System\kXCejza.exe
  2⤵
  PID:7696
- C:\Windows\System\reEAiSY.exe
  C:\Windows\System\reEAiSY.exe
  2⤵
  PID:7952
- C:\Windows\System\YXCDIif.exe
  C:\Windows\System\YXCDIif.exe
  2⤵
  PID:436
- C:\Windows\System\CNfKOJW.exe
  C:\Windows\System\CNfKOJW.exe
  2⤵
  PID:5996
- C:\Windows\System\wbFzdlg.exe
  C:\Windows\System\wbFzdlg.exe
  2⤵
  PID:5880
- C:\Windows\System\HmXKpCs.exe
  C:\Windows\System\HmXKpCs.exe
  2⤵
  PID:6356
- C:\Windows\System\BNZtvaw.exe
  C:\Windows\System\BNZtvaw.exe
  2⤵
  PID:7936
- C:\Windows\System\BJHafxh.exe
  C:\Windows\System\BJHafxh.exe
  2⤵
  PID:8044
- C:\Windows\System\YQnKCYn.exe
  C:\Windows\System\YQnKCYn.exe
  2⤵
  PID:8136
- C:\Windows\System\iQqxhfN.exe
  C:\Windows\System\iQqxhfN.exe
  2⤵
  PID:8184
- C:\Windows\System\pOdibLA.exe
  C:\Windows\System\pOdibLA.exe
  2⤵
  PID:7048
- C:\Windows\System\rCNeDaP.exe
  C:\Windows\System\rCNeDaP.exe
  2⤵
  PID:7608
- C:\Windows\System\YrpSfjE.exe
  C:\Windows\System\YrpSfjE.exe
  2⤵
  PID:7476
- C:\Windows\System\oWmOEal.exe
  C:\Windows\System\oWmOEal.exe
  2⤵
  PID:7596
- C:\Windows\System\QNNlFXy.exe
  C:\Windows\System\QNNlFXy.exe
  2⤵
  PID:7844
- C:\Windows\System\FyKiOfR.exe
  C:\Windows\System\FyKiOfR.exe
  2⤵
  PID:7676
- C:\Windows\System\gYvdtDv.exe
  C:\Windows\System\gYvdtDv.exe
  2⤵
  PID:7848
- C:\Windows\System\dHMTvMb.exe
  C:\Windows\System\dHMTvMb.exe
  2⤵
  PID:6180
- C:\Windows\System\WwRZpXE.exe
  C:\Windows\System\WwRZpXE.exe
  2⤵
  PID:8040
- C:\Windows\System\zYPqycU.exe
  C:\Windows\System\zYPqycU.exe
  2⤵
  PID:8180
- C:\Windows\System\RapNyja.exe
  C:\Windows\System\RapNyja.exe
  2⤵
  PID:5688
- C:\Windows\System\wPJHLmo.exe
  C:\Windows\System\wPJHLmo.exe
  2⤵
  PID:7360
- C:\Windows\System\GTZcYqr.exe
  C:\Windows\System\GTZcYqr.exe
  2⤵
  PID:7836
- C:\Windows\System\xrnNQYT.exe
  C:\Windows\System\xrnNQYT.exe
  2⤵
  PID:8212
- C:\Windows\System\SHNuFYy.exe
  C:\Windows\System\SHNuFYy.exe
  2⤵
  PID:8232
- C:\Windows\System\nXcpPJD.exe
  C:\Windows\System\nXcpPJD.exe
  2⤵
  PID:8304
- C:\Windows\System\fFygFMm.exe
  C:\Windows\System\fFygFMm.exe
  2⤵
  PID:8320
- C:\Windows\System\NTdFYDZ.exe
  C:\Windows\System\NTdFYDZ.exe
  2⤵
  PID:8352
- C:\Windows\System\PxhbRCC.exe
  C:\Windows\System\PxhbRCC.exe
  2⤵
  PID:8388
- C:\Windows\System\kxtysmu.exe
  C:\Windows\System\kxtysmu.exe
  2⤵
  PID:8412
- C:\Windows\System\evuGrYD.exe
  C:\Windows\System\evuGrYD.exe
  2⤵
  PID:8440
- C:\Windows\System\wXZmrRv.exe
  C:\Windows\System\wXZmrRv.exe
  2⤵
  PID:8472
- C:\Windows\System\RPVXjFq.exe
  C:\Windows\System\RPVXjFq.exe
  2⤵
  PID:8492
- C:\Windows\System\ObKutrx.exe
  C:\Windows\System\ObKutrx.exe
  2⤵
  PID:8516
- C:\Windows\System\PzXTknI.exe
  C:\Windows\System\PzXTknI.exe
  2⤵
  PID:8540
- C:\Windows\System\zDYCbJT.exe
  C:\Windows\System\zDYCbJT.exe
  2⤵
  PID:8568
- C:\Windows\System\QPkAUhA.exe
  C:\Windows\System\QPkAUhA.exe
  2⤵
  PID:8596
- C:\Windows\System\pvfaVSL.exe
  C:\Windows\System\pvfaVSL.exe
  2⤵
  PID:8620
- C:\Windows\System\lgJyYLq.exe
  C:\Windows\System\lgJyYLq.exe
  2⤵
  PID:8652
- C:\Windows\System\ATwqQPS.exe
  C:\Windows\System\ATwqQPS.exe
  2⤵
  PID:8680
- C:\Windows\System\PNBzCiA.exe
  C:\Windows\System\PNBzCiA.exe
  2⤵
  PID:8704
- C:\Windows\System\BwqwDoW.exe
  C:\Windows\System\BwqwDoW.exe
  2⤵
  PID:8736
- C:\Windows\System\BxdmJki.exe
  C:\Windows\System\BxdmJki.exe
  2⤵
  PID:8756
- C:\Windows\System\VCppFep.exe
  C:\Windows\System\VCppFep.exe
  2⤵
  PID:8784
- C:\Windows\System\WmoiQCf.exe
  C:\Windows\System\WmoiQCf.exe
  2⤵
  PID:8816
- C:\Windows\System\ezOqhel.exe
  C:\Windows\System\ezOqhel.exe
  2⤵
  PID:8840
- C:\Windows\System\pURnxHc.exe
  C:\Windows\System\pURnxHc.exe
  2⤵
  PID:8884
- C:\Windows\System\jcEwkwv.exe
  C:\Windows\System\jcEwkwv.exe
  2⤵
  PID:8904
- C:\Windows\System\tOwZPPS.exe
  C:\Windows\System\tOwZPPS.exe
  2⤵
  PID:8932
- C:\Windows\System\iitNYUM.exe
  C:\Windows\System\iitNYUM.exe
  2⤵
  PID:8952
- C:\Windows\System\yeZEMNi.exe
  C:\Windows\System\yeZEMNi.exe
  2⤵
  PID:8984
- C:\Windows\System\CvABCeF.exe
  C:\Windows\System\CvABCeF.exe
  2⤵
  PID:9016
- C:\Windows\System\AWbhGmU.exe
  C:\Windows\System\AWbhGmU.exe
  2⤵
  PID:9040
- C:\Windows\System\LDVASnS.exe
  C:\Windows\System\LDVASnS.exe
  2⤵
  PID:9060
- C:\Windows\System\FHrBdvC.exe
  C:\Windows\System\FHrBdvC.exe
  2⤵
  PID:9084
- C:\Windows\System\ojbypPn.exe
  C:\Windows\System\ojbypPn.exe
  2⤵
  PID:9116
- C:\Windows\System\UtCmkzu.exe
  C:\Windows\System\UtCmkzu.exe
  2⤵
  PID:9144
- C:\Windows\System\wxyZYUm.exe
  C:\Windows\System\wxyZYUm.exe
  2⤵
  PID:9180
- C:\Windows\System\FQaWmuv.exe
  C:\Windows\System\FQaWmuv.exe
  2⤵
  PID:7520
- C:\Windows\System\MJZMVmW.exe
  C:\Windows\System\MJZMVmW.exe
  2⤵
  PID:8280
- C:\Windows\System\goSfyyU.exe
  C:\Windows\System\goSfyyU.exe
  2⤵
  PID:8276
- C:\Windows\System\xLehWbY.exe
  C:\Windows\System\xLehWbY.exe
  2⤵
  PID:8364
- C:\Windows\System\QrvjNxG.exe
  C:\Windows\System\QrvjNxG.exe
  2⤵
  PID:8384
- C:\Windows\System\nRsdPnC.exe
  C:\Windows\System\nRsdPnC.exe
  2⤵
  PID:8484
- C:\Windows\System\eqEJCfK.exe
  C:\Windows\System\eqEJCfK.exe
  2⤵
  PID:8564
- C:\Windows\System\EDOgyAY.exe
  C:\Windows\System\EDOgyAY.exe
  2⤵
  PID:8664
- C:\Windows\System\hAHOWIi.exe
  C:\Windows\System\hAHOWIi.exe
  2⤵
  PID:8604
- C:\Windows\System\XekSyXj.exe
  C:\Windows\System\XekSyXj.exe
  2⤵
  PID:8628
- C:\Windows\System\Qxktbun.exe
  C:\Windows\System\Qxktbun.exe
  2⤵
  PID:8780
- C:\Windows\System\CMTaHop.exe
  C:\Windows\System\CMTaHop.exe
  2⤵
  PID:8824
- C:\Windows\System\MGyoORs.exe
  C:\Windows\System\MGyoORs.exe
  2⤵
  PID:8924
- C:\Windows\System\hLzzNzr.exe
  C:\Windows\System\hLzzNzr.exe
  2⤵
  PID:8968
- C:\Windows\System\ivWAPZW.exe
  C:\Windows\System\ivWAPZW.exe
  2⤵
  PID:8992
- C:\Windows\System\KRXnQCE.exe
  C:\Windows\System\KRXnQCE.exe
  2⤵
  PID:9192
- C:\Windows\System\RdenmTv.exe
  C:\Windows\System\RdenmTv.exe
  2⤵
  PID:8132
- C:\Windows\System\EiXkNDB.exe
  C:\Windows\System\EiXkNDB.exe
  2⤵
  PID:9160
- C:\Windows\System\tFXRQBR.exe
  C:\Windows\System\tFXRQBR.exe
  2⤵
  PID:6900
- C:\Windows\System\TjGxYNF.exe
  C:\Windows\System\TjGxYNF.exe
  2⤵
  PID:8552
- C:\Windows\System\UWNqjCs.exe
  C:\Windows\System\UWNqjCs.exe
  2⤵
  PID:8436
- C:\Windows\System\qiAutnO.exe
  C:\Windows\System\qiAutnO.exe
  2⤵
  PID:8728
- C:\Windows\System\etldiZV.exe
  C:\Windows\System\etldiZV.exe
  2⤵
  PID:8804
- C:\Windows\System\IgUHqQv.exe
  C:\Windows\System\IgUHqQv.exe
  2⤵
  PID:9076
- C:\Windows\System\iuhZBnx.exe
  C:\Windows\System\iuhZBnx.exe
  2⤵
  PID:9000
- C:\Windows\System\yJWmDML.exe
  C:\Windows\System\yJWmDML.exe
  2⤵
  PID:9196
- C:\Windows\System\dkQmbJX.exe
  C:\Windows\System\dkQmbJX.exe
  2⤵
  PID:7960
- C:\Windows\System\DHSYFsI.exe
  C:\Windows\System\DHSYFsI.exe
  2⤵
  PID:8768
- C:\Windows\System\wvehFYE.exe
  C:\Windows\System\wvehFYE.exe
  2⤵
  PID:8532
- C:\Windows\System\TKHmtPq.exe
  C:\Windows\System\TKHmtPq.exe
  2⤵
  PID:9140
- C:\Windows\System\vzqgOVf.exe
  C:\Windows\System\vzqgOVf.exe
  2⤵
  PID:9236
- C:\Windows\System\wmLUqbT.exe
  C:\Windows\System\wmLUqbT.exe
  2⤵
  PID:9256
- C:\Windows\System\FaYXrEQ.exe
  C:\Windows\System\FaYXrEQ.exe
  2⤵
  PID:9284
- C:\Windows\System\DiRZiob.exe
  C:\Windows\System\DiRZiob.exe
  2⤵
  PID:9312
- C:\Windows\System\XmeYocK.exe
  C:\Windows\System\XmeYocK.exe
  2⤵
  PID:9332
- C:\Windows\System\lKmkEVn.exe
  C:\Windows\System\lKmkEVn.exe
  2⤵
  PID:9360
- C:\Windows\System\icOpcYc.exe
  C:\Windows\System\icOpcYc.exe
  2⤵
  PID:9392
- C:\Windows\System\VXLqVZa.exe
  C:\Windows\System\VXLqVZa.exe
  2⤵
  PID:9420
- C:\Windows\System\EvNtYLg.exe
  C:\Windows\System\EvNtYLg.exe
  2⤵
  PID:9448
- C:\Windows\System\nHdVaWj.exe
  C:\Windows\System\nHdVaWj.exe
  2⤵
  PID:9472
- C:\Windows\System\stGWEOV.exe
  C:\Windows\System\stGWEOV.exe
  2⤵
  PID:9528
- C:\Windows\System\eHMTvLB.exe
  C:\Windows\System\eHMTvLB.exe
  2⤵
  PID:9552
- C:\Windows\System\CrRaOVm.exe
  C:\Windows\System\CrRaOVm.exe
  2⤵
  PID:9580
- C:\Windows\System\LziKwgh.exe
  C:\Windows\System\LziKwgh.exe
  2⤵
  PID:9612
- C:\Windows\System\stCbdeX.exe
  C:\Windows\System\stCbdeX.exe
  2⤵
  PID:9644
- C:\Windows\System\IRoJumO.exe
  C:\Windows\System\IRoJumO.exe
  2⤵
  PID:9664
- C:\Windows\System\dKnSuSz.exe
  C:\Windows\System\dKnSuSz.exe
  2⤵
  PID:9688
- C:\Windows\System\fvWvIqR.exe
  C:\Windows\System\fvWvIqR.exe
  2⤵
  PID:9716
- C:\Windows\System\hbGdMkR.exe
  C:\Windows\System\hbGdMkR.exe
  2⤵
  PID:9736
- C:\Windows\System\TqUvZJx.exe
  C:\Windows\System\TqUvZJx.exe
  2⤵
  PID:9768
- C:\Windows\System\ErngzRO.exe
  C:\Windows\System\ErngzRO.exe
  2⤵
  PID:9796
- C:\Windows\System\SavEnao.exe
  C:\Windows\System\SavEnao.exe
  2⤵
  PID:9812
- C:\Windows\System\zXQPPpC.exe
  C:\Windows\System\zXQPPpC.exe
  2⤵
  PID:9844
- C:\Windows\System\SBpZSzo.exe
  C:\Windows\System\SBpZSzo.exe
  2⤵
  PID:9868
- C:\Windows\System\MsUcObm.exe
  C:\Windows\System\MsUcObm.exe
  2⤵
  PID:9896
- C:\Windows\System\tINbNdG.exe
  C:\Windows\System\tINbNdG.exe
  2⤵
  PID:9920
- C:\Windows\System\XNbQpne.exe
  C:\Windows\System\XNbQpne.exe
  2⤵
  PID:9944
- C:\Windows\System\Arjmvpp.exe
  C:\Windows\System\Arjmvpp.exe
  2⤵
  PID:9984
- C:\Windows\System\atQiCft.exe
  C:\Windows\System\atQiCft.exe
  2⤵
  PID:10012
- C:\Windows\System\JKZnwsr.exe
  C:\Windows\System\JKZnwsr.exe
  2⤵
  PID:10036
- C:\Windows\System\rrkwbeJ.exe
  C:\Windows\System\rrkwbeJ.exe
  2⤵
  PID:10060
- C:\Windows\System\ZtQWrsj.exe
  C:\Windows\System\ZtQWrsj.exe
  2⤵
  PID:10144
- C:\Windows\System\XvnJRPH.exe
  C:\Windows\System\XvnJRPH.exe
  2⤵
  PID:10172
- C:\Windows\System\TJsdeFm.exe
  C:\Windows\System\TJsdeFm.exe
  2⤵
  PID:10200
- C:\Windows\System\SYoiQJV.exe
  C:\Windows\System\SYoiQJV.exe
  2⤵
  PID:10228
- C:\Windows\System\TFZMZtq.exe
  C:\Windows\System\TFZMZtq.exe
  2⤵
  PID:8404
- C:\Windows\System\stYzKYk.exe
  C:\Windows\System\stYzKYk.exe
  2⤵
  PID:9224
- C:\Windows\System\TxBOYoL.exe
  C:\Windows\System\TxBOYoL.exe
  2⤵
  PID:9248
- C:\Windows\System\ymXzxsa.exe
  C:\Windows\System\ymXzxsa.exe
  2⤵
  PID:8672
- C:\Windows\System\OrBBEXB.exe
  C:\Windows\System\OrBBEXB.exe
  2⤵
  PID:9348
- C:\Windows\System\CLeKBiL.exe
  C:\Windows\System\CLeKBiL.exe
  2⤵
  PID:9304
- C:\Windows\System\PzlZEFI.exe
  C:\Windows\System\PzlZEFI.exe
  2⤵
  PID:9416
- C:\Windows\System\jOTkrBW.exe
  C:\Windows\System\jOTkrBW.exe
  2⤵
  PID:9404
- C:\Windows\System\lFANCZa.exe
  C:\Windows\System\lFANCZa.exe
  2⤵
  PID:9660
- C:\Windows\System\gyjbUtN.exe
  C:\Windows\System\gyjbUtN.exe
  2⤵
  PID:9676
- C:\Windows\System\XPysqGD.exe
  C:\Windows\System\XPysqGD.exe
  2⤵
  PID:9784
- C:\Windows\System\ryMbAJH.exe
  C:\Windows\System\ryMbAJH.exe
  2⤵
  PID:9780
- C:\Windows\System\RlnFQbl.exe
  C:\Windows\System\RlnFQbl.exe
  2⤵
  PID:9952
- C:\Windows\System\rjzNnMv.exe
  C:\Windows\System\rjzNnMv.exe
  2⤵
  PID:10020
- C:\Windows\System\BOmGsTS.exe
  C:\Windows\System\BOmGsTS.exe
  2⤵
  PID:10032
- C:\Windows\System\cCKYdLe.exe
  C:\Windows\System\cCKYdLe.exe
  2⤵
  PID:9212
- C:\Windows\System\PnnBvUz.exe
  C:\Windows\System\PnnBvUz.exe
  2⤵
  PID:9264
- C:\Windows\System\aKPhENm.exe
  C:\Windows\System\aKPhENm.exe
  2⤵
  PID:696
- C:\Windows\System\QGFqIfv.exe
  C:\Windows\System\QGFqIfv.exe
  2⤵
  PID:9752
- C:\Windows\System\sHmHEjN.exe
  C:\Windows\System\sHmHEjN.exe
  2⤵
  PID:9884
- C:\Windows\System\jZLHnBV.exe
  C:\Windows\System\jZLHnBV.exe
  2⤵
  PID:9992
- C:\Windows\System\tPCHEKV.exe
  C:\Windows\System\tPCHEKV.exe
  2⤵
  PID:10224
- C:\Windows\System\buEEodr.exe
  C:\Windows\System\buEEodr.exe
  2⤵
  PID:9368
- C:\Windows\System\MCNgwiD.exe
  C:\Windows\System\MCNgwiD.exe
  2⤵
  PID:9712
- C:\Windows\System\jJlEMvn.exe
  C:\Windows\System\jJlEMvn.exe
  2⤵
  PID:9968
- C:\Windows\System\OdMwOow.exe
  C:\Windows\System\OdMwOow.exe
  2⤵
  PID:9408
- C:\Windows\System\txegDdB.exe
  C:\Windows\System\txegDdB.exe
  2⤵
  PID:9340
- C:\Windows\System\eWzuosl.exe
  C:\Windows\System\eWzuosl.exe
  2⤵
  PID:10256
- C:\Windows\System\gApMAAf.exe
  C:\Windows\System\gApMAAf.exe
  2⤵
  PID:10280
- C:\Windows\System\qISRsCo.exe
  C:\Windows\System\qISRsCo.exe
  2⤵
  PID:10320
- C:\Windows\System\SUQgbey.exe
  C:\Windows\System\SUQgbey.exe
  2⤵
  PID:10348
- C:\Windows\System\YaFVVqn.exe
  C:\Windows\System\YaFVVqn.exe
  2⤵
  PID:10372
- C:\Windows\System\sPjJUpF.exe
  C:\Windows\System\sPjJUpF.exe
  2⤵
  PID:10412
- C:\Windows\System\zKwjZbk.exe
  C:\Windows\System\zKwjZbk.exe
  2⤵
  PID:10428
- C:\Windows\System\HxzgsTA.exe
  C:\Windows\System\HxzgsTA.exe
  2⤵
  PID:10496
- C:\Windows\System\TlAJKBY.exe
  C:\Windows\System\TlAJKBY.exe
  2⤵
  PID:10516
- C:\Windows\System\vmveNTF.exe
  C:\Windows\System\vmveNTF.exe
  2⤵
  PID:10536
- C:\Windows\System\tVMGxAk.exe
  C:\Windows\System\tVMGxAk.exe
  2⤵
  PID:10556
- C:\Windows\System\KPxoxPM.exe
  C:\Windows\System\KPxoxPM.exe
  2⤵
  PID:10588
- C:\Windows\System\gkzjHpo.exe
  C:\Windows\System\gkzjHpo.exe
  2⤵
  PID:10604
- C:\Windows\System\shzrDVt.exe
  C:\Windows\System\shzrDVt.exe
  2⤵
  PID:10632
- C:\Windows\System\oenYCvs.exe
  C:\Windows\System\oenYCvs.exe
  2⤵
  PID:10664
- C:\Windows\System\nNRavOv.exe
  C:\Windows\System\nNRavOv.exe
  2⤵
  PID:10696
- C:\Windows\System\fZJssbf.exe
  C:\Windows\System\fZJssbf.exe
  2⤵
  PID:10724
- C:\Windows\System\pyEhDGV.exe
  C:\Windows\System\pyEhDGV.exe
  2⤵
  PID:10744
- C:\Windows\System\waINXJg.exe
  C:\Windows\System\waINXJg.exe
  2⤵
  PID:10764
- C:\Windows\System\glPGQln.exe
  C:\Windows\System\glPGQln.exe
  2⤵
  PID:10796
- C:\Windows\System\DnOTbMu.exe
  C:\Windows\System\DnOTbMu.exe
  2⤵
  PID:10828
- C:\Windows\System\zECbhsi.exe
  C:\Windows\System\zECbhsi.exe
  2⤵
  PID:10856
- C:\Windows\System\RVHGnRg.exe
  C:\Windows\System\RVHGnRg.exe
  2⤵
  PID:10880
- C:\Windows\System\gqcRxSM.exe
  C:\Windows\System\gqcRxSM.exe
  2⤵
  PID:10912
- C:\Windows\System\diIBGgb.exe
  C:\Windows\System\diIBGgb.exe
  2⤵
  PID:10940
- C:\Windows\System\RWzWPUn.exe
  C:\Windows\System\RWzWPUn.exe
  2⤵
  PID:10960
- C:\Windows\System\lvflKSM.exe
  C:\Windows\System\lvflKSM.exe
  2⤵
  PID:10988
- C:\Windows\System\MdabDEs.exe
  C:\Windows\System\MdabDEs.exe
  2⤵
  PID:11012
- C:\Windows\System\imMeLYH.exe
  C:\Windows\System\imMeLYH.exe
  2⤵
  PID:11036
- C:\Windows\System\oVNOlQp.exe
  C:\Windows\System\oVNOlQp.exe
  2⤵
  PID:11068
- C:\Windows\System\MgfUwRZ.exe
  C:\Windows\System\MgfUwRZ.exe
  2⤵
  PID:11088
- C:\Windows\System\eXovSdl.exe
  C:\Windows\System\eXovSdl.exe
  2⤵
  PID:11116
- C:\Windows\System\BWScvib.exe
  C:\Windows\System\BWScvib.exe
  2⤵
  PID:11164
- C:\Windows\System\XfaqgZi.exe
  C:\Windows\System\XfaqgZi.exe
  2⤵
  PID:11192
- C:\Windows\System\lTjHHMJ.exe
  C:\Windows\System\lTjHHMJ.exe
  2⤵
  PID:11220
- C:\Windows\System\rCMdeiI.exe
  C:\Windows\System\rCMdeiI.exe
  2⤵
  PID:11244
- C:\Windows\System\wDkSqsN.exe
  C:\Windows\System\wDkSqsN.exe
  2⤵
  PID:10244
- C:\Windows\System\dLxbZMU.exe
  C:\Windows\System\dLxbZMU.exe
  2⤵
  PID:10276
- C:\Windows\System\NdPooIg.exe
  C:\Windows\System\NdPooIg.exe
  2⤵
  PID:10340
- C:\Windows\System\yIohSAr.exe
  C:\Windows\System\yIohSAr.exe
  2⤵
  PID:10492
- C:\Windows\System\AIncXou.exe
  C:\Windows\System\AIncXou.exe
  2⤵
  PID:10684
- C:\Windows\System\uvHhoLz.exe
  C:\Windows\System\uvHhoLz.exe
  2⤵
  PID:10776
- C:\Windows\System\FhGSdid.exe
  C:\Windows\System\FhGSdid.exe
  2⤵
  PID:10872
- C:\Windows\System\RvlSRnP.exe
  C:\Windows\System\RvlSRnP.exe
  2⤵
  PID:10952
- C:\Windows\System\HryxZyH.exe
  C:\Windows\System\HryxZyH.exe
  2⤵
  PID:11136
- C:\Windows\System\uqPCGza.exe
  C:\Windows\System\uqPCGza.exe
  2⤵
  PID:11112
- C:\Windows\System\QfsuPqq.exe
  C:\Windows\System\QfsuPqq.exe
  2⤵
  PID:1748
- C:\Windows\System\foosRoS.exe
  C:\Windows\System\foosRoS.exe
  2⤵
  PID:10248
- C:\Windows\System\iqjvsnx.exe
  C:\Windows\System\iqjvsnx.exe
  2⤵
  PID:10368
- C:\Windows\System\OKATSEu.exe
  C:\Windows\System\OKATSEu.exe
  2⤵
  PID:11236
- C:\Windows\System\FuchIIo.exe
  C:\Windows\System\FuchIIo.exe
  2⤵
  PID:11256
- C:\Windows\System\wWthfdE.exe
  C:\Windows\System\wWthfdE.exe
  2⤵
  PID:10652
- C:\Windows\System\htGeATX.exe
  C:\Windows\System\htGeATX.exe
  2⤵
  PID:5164
- C:\Windows\System\JGPxRkz.exe
  C:\Windows\System\JGPxRkz.exe
  2⤵
  PID:10756
- C:\Windows\System\EfjeZqh.exe
  C:\Windows\System\EfjeZqh.exe
  2⤵
  PID:10868
- C:\Windows\System\ArjKoJl.exe
  C:\Windows\System\ArjKoJl.exe
  2⤵
  PID:11084
- C:\Windows\System\JHdNClm.exe
  C:\Windows\System\JHdNClm.exe
  2⤵
  PID:11176
- C:\Windows\System\gYkxTIs.exe
  C:\Windows\System\gYkxTIs.exe
  2⤵
  PID:10388
- C:\Windows\System\bDibNPp.exe
  C:\Windows\System\bDibNPp.exe
  2⤵
  PID:10580
- C:\Windows\System\mTqSfkV.exe
  C:\Windows\System\mTqSfkV.exe
  2⤵
  PID:11272
- C:\Windows\System\IYMVowe.exe
  C:\Windows\System\IYMVowe.exe
  2⤵
  PID:11300
- C:\Windows\System\XhzaFtc.exe
  C:\Windows\System\XhzaFtc.exe
  2⤵
  PID:11324
- C:\Windows\System\KuxOkOo.exe
  C:\Windows\System\KuxOkOo.exe
  2⤵
  PID:11352
- C:\Windows\System\hAgWFxM.exe
  C:\Windows\System\hAgWFxM.exe
  2⤵
  PID:11380
- C:\Windows\System\EpBwxJA.exe
  C:\Windows\System\EpBwxJA.exe
  2⤵
  PID:11400
- C:\Windows\System\GeLnCfM.exe
  C:\Windows\System\GeLnCfM.exe
  2⤵
  PID:11424
- C:\Windows\System\riqUyyH.exe
  C:\Windows\System\riqUyyH.exe
  2⤵
  PID:11452
- C:\Windows\System\vmuseuV.exe
  C:\Windows\System\vmuseuV.exe
  2⤵
  PID:11472
- C:\Windows\System\ZLNlvFz.exe
  C:\Windows\System\ZLNlvFz.exe
  2⤵
  PID:11492
- C:\Windows\System\XxQzKJt.exe
  C:\Windows\System\XxQzKJt.exe
  2⤵
  PID:11516
- C:\Windows\System\QSAKQbN.exe
  C:\Windows\System\QSAKQbN.exe
  2⤵
  PID:11540
- C:\Windows\System\sNfqxpP.exe
  C:\Windows\System\sNfqxpP.exe
  2⤵
  PID:11564
- C:\Windows\System\XRrqXUP.exe
  C:\Windows\System\XRrqXUP.exe
  2⤵
  PID:11588
- C:\Windows\System\MwfTsPq.exe
  C:\Windows\System\MwfTsPq.exe
  2⤵
  PID:11612
- C:\Windows\System\BEOtnxg.exe
  C:\Windows\System\BEOtnxg.exe
  2⤵
  PID:11644
- C:\Windows\System\IPSHySt.exe
  C:\Windows\System\IPSHySt.exe
  2⤵
  PID:11668
- C:\Windows\System\BJXzbgj.exe
  C:\Windows\System\BJXzbgj.exe
  2⤵
  PID:11696
- C:\Windows\System\AEeeEOF.exe
  C:\Windows\System\AEeeEOF.exe
  2⤵
  PID:11764
- C:\Windows\System\WonPknM.exe
  C:\Windows\System\WonPknM.exe
  2⤵
  PID:11832
- C:\Windows\System\RVSLSIf.exe
  C:\Windows\System\RVSLSIf.exe
  2⤵
  PID:11876
- C:\Windows\System\vFsuFOz.exe
  C:\Windows\System\vFsuFOz.exe
  2⤵
  PID:11900
- C:\Windows\System\xHKWaUL.exe
  C:\Windows\System\xHKWaUL.exe
  2⤵
  PID:11924
- C:\Windows\System\ODMGAoi.exe
  C:\Windows\System\ODMGAoi.exe
  2⤵
  PID:12036
- C:\Windows\System\ZnFhObF.exe
  C:\Windows\System\ZnFhObF.exe
  2⤵
  PID:12060
- C:\Windows\System\LUZPXLb.exe
  C:\Windows\System\LUZPXLb.exe
  2⤵
  PID:12080
- C:\Windows\System\dgzWdeh.exe
  C:\Windows\System\dgzWdeh.exe
  2⤵
  PID:12100
- C:\Windows\System\DujRCnJ.exe
  C:\Windows\System\DujRCnJ.exe
  2⤵
  PID:12120
- C:\Windows\System\EfQBTOi.exe
  C:\Windows\System\EfQBTOi.exe
  2⤵
  PID:12148
- C:\Windows\System\QQNbXSf.exe
  C:\Windows\System\QQNbXSf.exe
  2⤵
  PID:12168
- C:\Windows\System\sySsuad.exe
  C:\Windows\System\sySsuad.exe
  2⤵
  PID:12184
- C:\Windows\System\orIVlNH.exe
  C:\Windows\System\orIVlNH.exe
  2⤵
  PID:12208
- C:\Windows\System\HSwDAAQ.exe
  C:\Windows\System\HSwDAAQ.exe
  2⤵
  PID:12256
- C:\Windows\System\bwsqEwl.exe
  C:\Windows\System\bwsqEwl.exe
  2⤵
  PID:12280
- C:\Windows\System\bpiESyr.exe
  C:\Windows\System\bpiESyr.exe
  2⤵
  PID:1032
- C:\Windows\System\uavCxtY.exe
  C:\Windows\System\uavCxtY.exe
  2⤵
  PID:11268
- C:\Windows\System\VxyvcmI.exe
  C:\Windows\System\VxyvcmI.exe
  2⤵
  PID:11320
- C:\Windows\System\DxBAuwE.exe
  C:\Windows\System\DxBAuwE.exe
  2⤵
  PID:2060
- C:\Windows\System\EhxOOZA.exe
  C:\Windows\System\EhxOOZA.exe
  2⤵
  PID:11420
- C:\Windows\System\ZNiDlcZ.exe
  C:\Windows\System\ZNiDlcZ.exe
  2⤵
  PID:11392
- C:\Windows\System\qCIpYGG.exe
  C:\Windows\System\qCIpYGG.exe
  2⤵
  PID:11436
- C:\Windows\System\IGonpCS.exe
  C:\Windows\System\IGonpCS.exe
  2⤵
  PID:936
- C:\Windows\System\NuUthay.exe
  C:\Windows\System\NuUthay.exe
  2⤵
  PID:3784
- C:\Windows\System\BtjNIxX.exe
  C:\Windows\System\BtjNIxX.exe
  2⤵
  PID:11580
- C:\Windows\System\cdFzkXB.exe
  C:\Windows\System\cdFzkXB.exe
  2⤵
  PID:1180
- C:\Windows\System\rmYxDNR.exe
  C:\Windows\System\rmYxDNR.exe
  2⤵
  PID:11652
- C:\Windows\System\VYWKlSk.exe
  C:\Windows\System\VYWKlSk.exe
  2⤵
  PID:11692
- C:\Windows\System\hBShYcM.exe
  C:\Windows\System\hBShYcM.exe
  2⤵
  PID:11784
- C:\Windows\System\jHrUTix.exe
  C:\Windows\System\jHrUTix.exe
  2⤵
  PID:11920
- C:\Windows\System\iQYMSKh.exe
  C:\Windows\System\iQYMSKh.exe
  2⤵
  PID:11912
- C:\Windows\System\JQpvjQK.exe
  C:\Windows\System\JQpvjQK.exe
  2⤵
  PID:11988
- C:\Windows\System\xzWpEZu.exe
  C:\Windows\System\xzWpEZu.exe
  2⤵
  PID:5292
- C:\Windows\System\obZnQJa.exe
  C:\Windows\System\obZnQJa.exe
  2⤵
  PID:10508
- C:\Windows\System\BmMPWza.exe
  C:\Windows\System\BmMPWza.exe
  2⤵
  PID:12076
- C:\Windows\System\DGbKuXG.exe
  C:\Windows\System\DGbKuXG.exe
  2⤵
  PID:12088
- C:\Windows\System\mykbtfy.exe
  C:\Windows\System\mykbtfy.exe
  2⤵
  PID:12160
- C:\Windows\System\EmCBQxJ.exe
  C:\Windows\System\EmCBQxJ.exe
  2⤵
  PID:12272
- C:\Windows\System\MBlwEut.exe
  C:\Windows\System\MBlwEut.exe
  2⤵
  PID:11208
- C:\Windows\System\gqOXLgU.exe
  C:\Windows\System\gqOXLgU.exe
  2⤵
  PID:11288
- C:\Windows\System\doYPtRw.exe
  C:\Windows\System\doYPtRw.exe
  2⤵
  PID:4216
- C:\Windows\System\ludJdbl.exe
  C:\Windows\System\ludJdbl.exe
  2⤵
  PID:11408
- C:\Windows\System\pPJjyha.exe
  C:\Windows\System\pPJjyha.exe
  2⤵
  PID:11576
- C:\Windows\System\qSxHRBS.exe
  C:\Windows\System\qSxHRBS.exe
  2⤵
  PID:1776
- C:\Windows\System\zQNPfMi.exe
  C:\Windows\System\zQNPfMi.exe
  2⤵
  PID:1288
- C:\Windows\System\ubNAJRn.exe
  C:\Windows\System\ubNAJRn.exe
  2⤵
  PID:11908
- C:\Windows\System\OvZZknW.exe
  C:\Windows\System\OvZZknW.exe
  2⤵
  PID:11684
- C:\Windows\System\oskJbPG.exe
  C:\Windows\System\oskJbPG.exe
  2⤵
  PID:1100
- C:\Windows\System\WCPgnUf.exe
  C:\Windows\System\WCPgnUf.exe
  2⤵
  PID:11284
- C:\Windows\System\vBybXyM.exe
  C:\Windows\System\vBybXyM.exe
  2⤵
  PID:536
- C:\Windows\System\mYlTNYr.exe
  C:\Windows\System\mYlTNYr.exe
  2⤵
  PID:11280
- C:\Windows\System\TAvONrT.exe
  C:\Windows\System\TAvONrT.exe
  2⤵
  PID:752
- C:\Windows\System\KjwiwKj.exe
  C:\Windows\System\KjwiwKj.exe
  2⤵
  PID:11888
- C:\Windows\System\pMidAha.exe
  C:\Windows\System\pMidAha.exe
  2⤵
  PID:11460
- C:\Windows\System\JhhIyDx.exe
  C:\Windows\System\JhhIyDx.exe
  2⤵
  PID:12336
- C:\Windows\System\QtxoIlK.exe
  C:\Windows\System\QtxoIlK.exe
  2⤵
  PID:12360
- C:\Windows\System\hSJBRGq.exe
  C:\Windows\System\hSJBRGq.exe
  2⤵
  PID:12412
- C:\Windows\System\TvCAtev.exe
  C:\Windows\System\TvCAtev.exe
  2⤵
  PID:12432
- C:\Windows\System\YdDUqcu.exe
  C:\Windows\System\YdDUqcu.exe
  2⤵
  PID:12480
- C:\Windows\System\tiNcwoL.exe
  C:\Windows\System\tiNcwoL.exe
  2⤵
  PID:12500
- C:\Windows\System\KxjXxea.exe
  C:\Windows\System\KxjXxea.exe
  2⤵
  PID:12528
- C:\Windows\System\GPUMiqF.exe
  C:\Windows\System\GPUMiqF.exe
  2⤵
  PID:12560
- C:\Windows\System\ZkTxvKw.exe
  C:\Windows\System\ZkTxvKw.exe
  2⤵
  PID:12616
- C:\Windows\System\NVIsILO.exe
  C:\Windows\System\NVIsILO.exe
  2⤵
  PID:12632
- C:\Windows\System\wrHvEcw.exe
  C:\Windows\System\wrHvEcw.exe
  2⤵
  PID:12660
- C:\Windows\System\iaTAJxM.exe
  C:\Windows\System\iaTAJxM.exe
  2⤵
  PID:12704
- C:\Windows\System\OFptUGh.exe
  C:\Windows\System\OFptUGh.exe
  2⤵
  PID:12724
- C:\Windows\System\qnavDkt.exe
  C:\Windows\System\qnavDkt.exe
  2⤵
  PID:12760
- C:\Windows\System\BubtwjB.exe
  C:\Windows\System\BubtwjB.exe
  2⤵
  PID:12808
- C:\Windows\System\nBJFKFx.exe
  C:\Windows\System\nBJFKFx.exe
  2⤵
  PID:12832
- C:\Windows\System\VAslGOW.exe
  C:\Windows\System\VAslGOW.exe
  2⤵
  PID:12880
- C:\Windows\System\pZfzSTY.exe
  C:\Windows\System\pZfzSTY.exe
  2⤵
  PID:12900
- C:\Windows\System\wKhxaXe.exe
  C:\Windows\System\wKhxaXe.exe
  2⤵
  PID:12924
- C:\Windows\System\qWeTpqM.exe
  C:\Windows\System\qWeTpqM.exe
  2⤵
  PID:12948
- C:\Windows\System\GRodfAq.exe
  C:\Windows\System\GRodfAq.exe
  2⤵
  PID:12992
- C:\Windows\System\ozyCPZv.exe
  C:\Windows\System\ozyCPZv.exe
  2⤵
  PID:13012
- C:\Windows\System\ZxpYhUz.exe
  C:\Windows\System\ZxpYhUz.exe
  2⤵
  PID:13036
- C:\Windows\System\amHvzlw.exe
  C:\Windows\System\amHvzlw.exe
  2⤵
  PID:13072
- C:\Windows\System\aofCuUY.exe
  C:\Windows\System\aofCuUY.exe
  2⤵
  PID:13144
- C:\Windows\System\PWXRoEt.exe
  C:\Windows\System\PWXRoEt.exe
  2⤵
  PID:13164
- C:\Windows\System\hZrVbXr.exe
  C:\Windows\System\hZrVbXr.exe
  2⤵
  PID:13184
- C:\Windows\System\WMYxumI.exe
  C:\Windows\System\WMYxumI.exe
  2⤵
  PID:13208
- C:\Windows\System\ZXJFTgN.exe
  C:\Windows\System\ZXJFTgN.exe
  2⤵
  PID:13224
- C:\Windows\System\KSKUWGx.exe
  C:\Windows\System\KSKUWGx.exe
  2⤵
  PID:13252
- C:\Windows\System\LMUDzIJ.exe
  C:\Windows\System\LMUDzIJ.exe
  2⤵
  PID:13272
- C:\Windows\System\eJGbNXA.exe
  C:\Windows\System\eJGbNXA.exe
  2⤵
  PID:11240
- C:\Windows\System\novkfEw.exe
  C:\Windows\System\novkfEw.exe
  2⤵
  PID:12252
- C:\Windows\System\rbyVmjS.exe
  C:\Windows\System\rbyVmjS.exe
  2⤵
  PID:12228
- C:\Windows\System\WMUWyhV.exe
  C:\Windows\System\WMUWyhV.exe
  2⤵
  PID:12300
- C:\Windows\System\ocSAHTz.exe
  C:\Windows\System\ocSAHTz.exe
  2⤵
  PID:12344
- C:\Windows\System\psPjVwX.exe
  C:\Windows\System\psPjVwX.exe
  2⤵
  PID:12440
- C:\Windows\System\hwTQEiQ.exe
  C:\Windows\System\hwTQEiQ.exe
  2⤵
  PID:12448
- C:\Windows\System\czBSsvw.exe
  C:\Windows\System\czBSsvw.exe
  2⤵
  PID:12544
- C:\Windows\System\pOJjDvn.exe
  C:\Windows\System\pOJjDvn.exe
  2⤵
  PID:12604
- C:\Windows\System\bsBmsyg.exe
  C:\Windows\System\bsBmsyg.exe
  2⤵
  PID:12644
- C:\Windows\System\KYuZvBI.exe
  C:\Windows\System\KYuZvBI.exe
  2⤵
  PID:12776
- C:\Windows\System\ZndxPZl.exe
  C:\Windows\System\ZndxPZl.exe
  2⤵
  PID:12744
- C:\Windows\System\DHZNjqg.exe
  C:\Windows\System\DHZNjqg.exe
  2⤵
  PID:12840
- C:\Windows\System\llZImcu.exe
  C:\Windows\System\llZImcu.exe
  2⤵
  PID:12868
- C:\Windows\System\fffxUrx.exe
  C:\Windows\System\fffxUrx.exe
  2⤵
  PID:12980
- C:\Windows\System\AfKMelO.exe
  C:\Windows\System\AfKMelO.exe
  2⤵
  PID:13020
- C:\Windows\System\vpAiPXR.exe
  C:\Windows\System\vpAiPXR.exe
  2⤵
  PID:13048
- C:\Windows\System\ajPIjUA.exe
  C:\Windows\System\ajPIjUA.exe
  2⤵
  PID:13132
- C:\Windows\System\FhMYZUd.exe
  C:\Windows\System\FhMYZUd.exe
  2⤵
  PID:13172
- C:\Windows\System\bwftiCS.exe
  C:\Windows\System\bwftiCS.exe
  2⤵
  PID:13260
- C:\Windows\System\AOVypQa.exe
  C:\Windows\System\AOVypQa.exe
  2⤵
  PID:13300
- C:\Windows\System\GDCGVjk.exe
  C:\Windows\System\GDCGVjk.exe
  2⤵
  PID:11896
- C:\Windows\System\DAnWtLv.exe
  C:\Windows\System\DAnWtLv.exe
  2⤵
  PID:11348
- C:\Windows\System\FPIUEkp.exe
  C:\Windows\System\FPIUEkp.exe
  2⤵
  PID:12392
- C:\Windows\System\tDkzRwA.exe
  C:\Windows\System\tDkzRwA.exe
  2⤵
  PID:12524
- C:\Windows\System\iYmwzVs.exe
  C:\Windows\System\iYmwzVs.exe
  2⤵
  PID:12628
- C:\Windows\System\XAIXAtF.exe
  C:\Windows\System\XAIXAtF.exe
  2⤵
  PID:12676
- C:\Windows\System\neTcxBF.exe
  C:\Windows\System\neTcxBF.exe
  2⤵
  PID:12820
- C:\Windows\System\rTLKxWc.exe
  C:\Windows\System\rTLKxWc.exe
  2⤵
  PID:13008
- C:\Windows\System\hOGSfYV.exe
  C:\Windows\System\hOGSfYV.exe
  2⤵
  PID:11004
- C:\Windows\System\VNIZWNG.exe
  C:\Windows\System\VNIZWNG.exe
  2⤵
  PID:12772
- C:\Windows\System\LFSOexk.exe
  C:\Windows\System\LFSOexk.exe
  2⤵
  PID:13192
- C:\Windows\System\WOSDnpT.exe
  C:\Windows\System\WOSDnpT.exe
  2⤵
  PID:12976
- C:\Windows\System\fqsqVtP.exe
  C:\Windows\System\fqsqVtP.exe
  2⤵
  PID:13324
- C:\Windows\System\CHtLeIw.exe
  C:\Windows\System\CHtLeIw.exe
  2⤵
  PID:13348
- C:\Windows\System\BhelEet.exe
  C:\Windows\System\BhelEet.exe
  2⤵
  PID:13380
- C:\Windows\System\ceIkNUR.exe
  C:\Windows\System\ceIkNUR.exe
  2⤵
  PID:13404
- C:\Windows\System\EsEOzOX.exe
  C:\Windows\System\EsEOzOX.exe
  2⤵
  PID:13424
- C:\Windows\System\fUAyuXL.exe
  C:\Windows\System\fUAyuXL.exe
  2⤵
  PID:13452
- C:\Windows\System\WLLPGGF.exe
  C:\Windows\System\WLLPGGF.exe
  2⤵
  PID:13480
- C:\Windows\System\lKvNfcz.exe
  C:\Windows\System\lKvNfcz.exe
  2⤵
  PID:13500
- C:\Windows\System\vQuXjsm.exe
  C:\Windows\System\vQuXjsm.exe
  2⤵
  PID:13524
- C:\Windows\System\hsZPJoN.exe
  C:\Windows\System\hsZPJoN.exe
  2⤵
  PID:13552
- C:\Windows\System\nVdQmTj.exe
  C:\Windows\System\nVdQmTj.exe
  2⤵
  PID:13572
- C:\Windows\System\sRjPEWC.exe
  C:\Windows\System\sRjPEWC.exe
  2⤵
  PID:13608
- C:\Windows\System\lwDNdQT.exe
  C:\Windows\System\lwDNdQT.exe
  2⤵
  PID:13660
- C:\Windows\System\DcCRSxt.exe
  C:\Windows\System\DcCRSxt.exe
  2⤵
  PID:13688
- C:\Windows\System\vSenlOJ.exe
  C:\Windows\System\vSenlOJ.exe
  2⤵
  PID:13728
- C:\Windows\System\ZitKcyU.exe
  C:\Windows\System\ZitKcyU.exe
  2⤵
  PID:13768
- C:\Windows\System\ZAdbeBd.exe
  C:\Windows\System\ZAdbeBd.exe
  2⤵
  PID:13792
- C:\Windows\System\oIvrCpw.exe
  C:\Windows\System\oIvrCpw.exe
  2⤵
  PID:13860
- C:\Windows\System\iegtFkt.exe
  C:\Windows\System\iegtFkt.exe
  2⤵
  PID:13880
- C:\Windows\System\TTwnwtT.exe
  C:\Windows\System\TTwnwtT.exe
  2⤵
  PID:13904
- C:\Windows\System\FDzZZJM.exe
  C:\Windows\System\FDzZZJM.exe
  2⤵
  PID:13928
- C:\Windows\System\jiPyifc.exe
  C:\Windows\System\jiPyifc.exe
  2⤵
  PID:13960
- C:\Windows\System\kdZBRGg.exe
  C:\Windows\System\kdZBRGg.exe
  2⤵
  PID:13976
- C:\Windows\System\OyYsYNO.exe
  C:\Windows\System\OyYsYNO.exe
  2⤵
  PID:13996
- C:\Windows\System\HuKIIMk.exe
  C:\Windows\System\HuKIIMk.exe
  2⤵
  PID:14020
- C:\Windows\System\tBOZpSd.exe
  C:\Windows\System\tBOZpSd.exe
  2⤵
  PID:14112
- C:\Windows\System\rPhIcmo.exe
  C:\Windows\System\rPhIcmo.exe
  2⤵
  PID:14136
- C:\Windows\System\RGoukRd.exe
  C:\Windows\System\RGoukRd.exe
  2⤵
  PID:14152
- C:\Windows\System\QVrqlRE.exe
  C:\Windows\System\QVrqlRE.exe
  2⤵
  PID:14168
- C:\Windows\System\ALzGJRW.exe
  C:\Windows\System\ALzGJRW.exe
  2⤵
  PID:14196
- C:\Windows\System\wxVIxDO.exe
  C:\Windows\System\wxVIxDO.exe
  2⤵
  PID:14256
- C:\Windows\System\SpJRnGM.exe
  C:\Windows\System\SpJRnGM.exe
  2⤵
  PID:14320
- C:\Windows\System\gfqzuxr.exe
  C:\Windows\System\gfqzuxr.exe
  2⤵
  PID:13220
- C:\Windows\System\LJQPmYG.exe
  C:\Windows\System\LJQPmYG.exe
  2⤵
  PID:13268
- C:\Windows\System\TfzlKlK.exe
  C:\Windows\System\TfzlKlK.exe
  2⤵
  PID:4040
- C:\Windows\System\qkKjptz.exe
  C:\Windows\System\qkKjptz.exe
  2⤵
  PID:13416
- C:\Windows\System\opXJFBM.exe
  C:\Windows\System\opXJFBM.exe
  2⤵
  PID:13472
- C:\Windows\System\IkgWSEk.exe
  C:\Windows\System\IkgWSEk.exe
  2⤵
  PID:13468
- C:\Windows\System\lKOOUZR.exe
  C:\Windows\System\lKOOUZR.exe
  2⤵
  PID:13336
- C:\Windows\System\IVlOGGn.exe
  C:\Windows\System\IVlOGGn.exe
  2⤵
  PID:13360
- C:\Windows\System\NppTKqt.exe
  C:\Windows\System\NppTKqt.exe
  2⤵
  PID:13568
- C:\Windows\System\pdfOwZU.exe
  C:\Windows\System\pdfOwZU.exe
  2⤵
  PID:13680
- C:\Windows\System\izSqgLY.exe
  C:\Windows\System\izSqgLY.exe
  2⤵
  PID:13704
- C:\Windows\System\JoQBvDL.exe
  C:\Windows\System\JoQBvDL.exe
  2⤵
  PID:13656
- C:\Windows\System\oUIeALF.exe
  C:\Windows\System\oUIeALF.exe
  2⤵
  PID:13856
- C:\Windows\System\IuvmQVf.exe
  C:\Windows\System\IuvmQVf.exe
  2⤵
  PID:13804
- C:\Windows\System\dCcvvcP.exe
  C:\Windows\System\dCcvvcP.exe
  2⤵
  PID:13892
- C:\Windows\System\nQnrAyI.exe
  C:\Windows\System\nQnrAyI.exe
  2⤵
  PID:13948
- C:\Windows\System\ZbPefbt.exe
  C:\Windows\System\ZbPefbt.exe
  2⤵
  PID:14068
- C:\Windows\System\ZIZzoPk.exe
  C:\Windows\System\ZIZzoPk.exe
  2⤵
  PID:14028
- C:\Windows\System\ZIuoKIn.exe
  C:\Windows\System\ZIuoKIn.exe
  2⤵
  PID:14176
- C:\Windows\System\uTYOelE.exe
  C:\Windows\System\uTYOelE.exe
  2⤵
  PID:14132
- C:\Windows\System\jGcqKiK.exe
  C:\Windows\System\jGcqKiK.exe
  2⤵
  PID:14208
- C:\Windows\System\tCPJTPE.exe
  C:\Windows\System\tCPJTPE.exe
  2⤵
  PID:14268
- C:\Windows\System\hLdXfkF.exe
  C:\Windows\System\hLdXfkF.exe
  2⤵
  PID:14300
- C:\Windows\System\geyJfSL.exe
  C:\Windows\System\geyJfSL.exe
  2⤵
  PID:2316
- C:\Windows\System\FCfMSWx.exe
  C:\Windows\System\FCfMSWx.exe
  2⤵
  PID:5064
- C:\Windows\System\jOKqqZE.exe
  C:\Windows\System\jOKqqZE.exe
  2⤵
  PID:13476
- C:\Windows\System\yUjlMtK.exe
  C:\Windows\System\yUjlMtK.exe
  2⤵
  PID:3896
- C:\Windows\System\ALbddWz.exe
  C:\Windows\System\ALbddWz.exe
  2⤵
  PID:13620
- C:\Windows\System\IWUtPLO.exe
  C:\Windows\System\IWUtPLO.exe
  2⤵
  PID:13720
- C:\Windows\System\wLLTUuJ.exe
  C:\Windows\System\wLLTUuJ.exe
  2⤵
  PID:14436
- C:\Windows\System\DFTaXsp.exe
  C:\Windows\System\DFTaXsp.exe
  2⤵
  PID:14452
- C:\Windows\System\feQfXlp.exe
  C:\Windows\System\feQfXlp.exe
  2⤵
  PID:14468
- C:\Windows\System\IQhupIQ.exe
  C:\Windows\System\IQhupIQ.exe
  2⤵
  PID:14500
- C:\Windows\System\qqUBSgJ.exe
  C:\Windows\System\qqUBSgJ.exe
  2⤵
  PID:14536
- C:\Windows\System\pdmhbCV.exe
  C:\Windows\System\pdmhbCV.exe
  2⤵
  PID:14552
- C:\Windows\System\dbHxYAA.exe
  C:\Windows\System\dbHxYAA.exe
  2⤵
  PID:14572
- C:\Windows\System\YvHvzkJ.exe
  C:\Windows\System\YvHvzkJ.exe
  2⤵
  PID:14588
- C:\Windows\System\TcDQXsn.exe
  C:\Windows\System\TcDQXsn.exe
  2⤵
  PID:14604
- C:\Windows\System\DPbQooX.exe
  C:\Windows\System\DPbQooX.exe
  2⤵
  PID:14620
- C:\Windows\System\cTSmuLO.exe
  C:\Windows\System\cTSmuLO.exe
  2⤵
  PID:14636
- C:\Windows\System\EVtCbiy.exe
  C:\Windows\System\EVtCbiy.exe
  2⤵
  PID:14692
- C:\Windows\System\getGCzM.exe
  C:\Windows\System\getGCzM.exe
  2⤵
  PID:14760
- C:\Windows\System\iOtDLvI.exe
  C:\Windows\System\iOtDLvI.exe
  2⤵
  PID:14796
- C:\Windows\System\MMrdBHa.exe
  C:\Windows\System\MMrdBHa.exe
  2⤵
  PID:14820
- C:\Windows\System\vCJtfZP.exe
  C:\Windows\System\vCJtfZP.exe
  2⤵
  PID:14848
- C:\Windows\System\avNdNMm.exe
  C:\Windows\System\avNdNMm.exe
  2⤵
  PID:14876
- C:\Windows\System\CmJWLeg.exe
  C:\Windows\System\CmJWLeg.exe
  2⤵
  PID:14896
- C:\Windows\System\qtokqUt.exe
  C:\Windows\System\qtokqUt.exe
  2⤵
  PID:14912
- C:\Windows\System\OCJLHXi.exe
  C:\Windows\System\OCJLHXi.exe
  2⤵
  PID:14928
- C:\Windows\System\KAgtPnB.exe
  C:\Windows\System\KAgtPnB.exe
  2⤵
  PID:14944
- C:\Windows\System\utsJbdw.exe
  C:\Windows\System\utsJbdw.exe
  2⤵
  PID:14960
- C:\Windows\System\yPJRSIn.exe
  C:\Windows\System\yPJRSIn.exe
  2⤵
  PID:14976
- C:\Windows\System\KYSsuFd.exe
  C:\Windows\System\KYSsuFd.exe
  2⤵
  PID:15004
- C:\Windows\System\KjGNTSp.exe
  C:\Windows\System\KjGNTSp.exe
  2⤵
  PID:15020
- C:\Windows\System\SXJTcCD.exe
  C:\Windows\System\SXJTcCD.exe
  2⤵
  PID:15036
- C:\Windows\System\TkzUhiL.exe
  C:\Windows\System\TkzUhiL.exe
  2⤵
  PID:15052
- C:\Windows\System\tFsdTVk.exe
  C:\Windows\System\tFsdTVk.exe
  2⤵
  PID:15076
- C:\Windows\System\wumcBgD.exe
  C:\Windows\System\wumcBgD.exe
  2⤵
  PID:15100
- C:\Windows\System\SCgZYcw.exe
  C:\Windows\System\SCgZYcw.exe
  2⤵
  PID:15116
- C:\Windows\System\LibgcAw.exe
  C:\Windows\System\LibgcAw.exe
  2⤵
  PID:15144
- C:\Windows\System\cvXROHW.exe
  C:\Windows\System\cvXROHW.exe
  2⤵
  PID:15184
- C:\Windows\System\TLfZkOI.exe
  C:\Windows\System\TLfZkOI.exe
  2⤵
  PID:15248
- C:\Windows\System\noWCDqy.exe
  C:\Windows\System\noWCDqy.exe
  2⤵
  PID:15268
- C:\Windows\System\yMVGkZy.exe
  C:\Windows\System\yMVGkZy.exe
  2⤵
  PID:15312
- C:\Windows\System\iYuatpY.exe
  C:\Windows\System\iYuatpY.exe
  2⤵
  PID:15352
- C:\Windows\System\yunjYKZ.exe
  C:\Windows\System\yunjYKZ.exe
  2⤵
  PID:548
- C:\Windows\System\BQLkmza.exe
  C:\Windows\System\BQLkmza.exe
  2⤵
  PID:4076
- C:\Windows\System\gPQstLA.exe
  C:\Windows\System\gPQstLA.exe
  2⤵
  PID:14360
- C:\Windows\System\NyVWmlk.exe
  C:\Windows\System\NyVWmlk.exe
  2⤵
  PID:13516
- C:\Windows\System\MnKhkFJ.exe
  C:\Windows\System\MnKhkFJ.exe
  2⤵
  PID:3044
- C:\Windows\System\XrolXLa.exe
  C:\Windows\System\XrolXLa.exe
  2⤵
  PID:14332
- C:\Windows\System\GUkfLVa.exe
  C:\Windows\System\GUkfLVa.exe
  2⤵
  PID:14400
- C:\Windows\System\rCJpmGx.exe
  C:\Windows\System\rCJpmGx.exe
  2⤵
  PID:14464
- C:\Windows\System\zgHPIcf.exe
  C:\Windows\System\zgHPIcf.exe
  2⤵
  PID:2192
- C:\Windows\System\ePPpuBf.exe
  C:\Windows\System\ePPpuBf.exe
  2⤵
  PID:14568
- C:\Windows\System\IpfyprL.exe
  C:\Windows\System\IpfyprL.exe
  2⤵
  PID:9600
- C:\Windows\System\GrMxrdn.exe
  C:\Windows\System\GrMxrdn.exe
  2⤵
  PID:1368
- C:\Windows\System\IemcYwF.exe
  C:\Windows\System\IemcYwF.exe
  2⤵
  PID:2648
- C:\Windows\System\ozsnsmc.exe
  C:\Windows\System\ozsnsmc.exe
  2⤵
  PID:14756
- C:\Windows\System\JuSRfQS.exe
  C:\Windows\System\JuSRfQS.exe
  2⤵
  PID:14804
- C:\Windows\System\NBFccjf.exe
  C:\Windows\System\NBFccjf.exe
  2⤵
  PID:9916
- C:\Windows\System\gRRUjzW.exe
  C:\Windows\System\gRRUjzW.exe
  2⤵
  PID:3100
- C:\Windows\System\ZhLdSwd.exe
  C:\Windows\System\ZhLdSwd.exe
  2⤵
  PID:14856
- C:\Windows\System\mpLnkWa.exe
  C:\Windows\System\mpLnkWa.exe
  2⤵
  PID:14904
- C:\Windows\System\FmFuwuF.exe
  C:\Windows\System\FmFuwuF.exe
  2⤵
  PID:7012
- C:\Windows\System\odvnWDB.exe
  C:\Windows\System\odvnWDB.exe
  2⤵
  PID:7188
- C:\Windows\System\aDSsxZx.exe
  C:\Windows\System\aDSsxZx.exe
  2⤵
  PID:7156
- C:\Windows\System\lLWJizT.exe
  C:\Windows\System\lLWJizT.exe
  2⤵
  PID:14952
- C:\Windows\System\XvpOfeg.exe
  C:\Windows\System\XvpOfeg.exe
  2⤵
  PID:2428
- C:\Windows\System\DCpLpOe.exe
  C:\Windows\System\DCpLpOe.exe
  2⤵
  PID:5156
- C:\Windows\System\QeOQHRK.exe
  C:\Windows\System\QeOQHRK.exe
  2⤵
  PID:15048
- C:\Windows\System\qWWEELM.exe
  C:\Windows\System\qWWEELM.exe
  2⤵
  PID:15012
- C:\Windows\System\OvBoGOo.exe
  C:\Windows\System\OvBoGOo.exe
  2⤵
  PID:15324
- C:\Windows\System\sxptuuu.exe
  C:\Windows\System\sxptuuu.exe
  2⤵
  PID:15212
- C:\Windows\System\SbBBpBO.exe
  C:\Windows\System\SbBBpBO.exe
  2⤵
  PID:5360
- C:\Windows\System\FGlpLqF.exe
  C:\Windows\System\FGlpLqF.exe
  2⤵
  PID:2540
- C:\Windows\System\kmIPOgp.exe
  C:\Windows\System\kmIPOgp.exe
  2⤵
  PID:14344
- C:\Windows\System\cbMqBOu.exe
  C:\Windows\System\cbMqBOu.exe
  2⤵
  PID:3992
- C:\Windows\System\QnUFDCe.exe
  C:\Windows\System\QnUFDCe.exe
  2⤵
  PID:13800
- C:\Windows\System\NJrNepo.exe
  C:\Windows\System\NJrNepo.exe
  2⤵
  PID:12116
- C:\Windows\System\pXSOKdo.exe
  C:\Windows\System\pXSOKdo.exe
  2⤵
  PID:7920
- C:\Windows\System\ZgEjEVB.exe
  C:\Windows\System\ZgEjEVB.exe
  2⤵
  PID:8028
- C:\Windows\System\VkKCmDJ.exe
  C:\Windows\System\VkKCmDJ.exe
  2⤵
  PID:8176
- C:\Windows\System\kiRFito.exe
  C:\Windows\System\kiRFito.exe
  2⤵
  PID:7044
- C:\Windows\System\PjPvXSM.exe
  C:\Windows\System\PjPvXSM.exe
  2⤵
  PID:7620
- C:\Windows\System\CJKjVMd.exe
  C:\Windows\System\CJKjVMd.exe
  2⤵
  PID:7436
- C:\Windows\System\myaVJaa.exe
  C:\Windows\System\myaVJaa.exe
  2⤵
  PID:7748
- C:\Windows\System\bsxpDeP.exe
  C:\Windows\System\bsxpDeP.exe
  2⤵
  PID:7800
- C:\Windows\System\jBAySGC.exe
  C:\Windows\System\jBAySGC.exe
  2⤵
  PID:5544
- C:\Windows\System\VufHhJl.exe
  C:\Windows\System\VufHhJl.exe
  2⤵
  PID:5680
- C:\Windows\System\dRIstgF.exe
  C:\Windows\System\dRIstgF.exe
  2⤵
  PID:2836
- C:\Windows\System\saoHIvT.exe
  C:\Windows\System\saoHIvT.exe
  2⤵
  PID:8108
- C:\Windows\System\lsDkNEE.exe
  C:\Windows\System\lsDkNEE.exe
  2⤵
  PID:14460
- C:\Windows\System\VRtGYyR.exe
  C:\Windows\System\VRtGYyR.exe
  2⤵
  PID:5820
- C:\Windows\System\SJLHRoD.exe
  C:\Windows\System\SJLHRoD.exe
  2⤵
  PID:6040
- C:\Windows\System\xEtwNNx.exe
  C:\Windows\System\xEtwNNx.exe
  2⤵
  PID:5956
- C:\Windows\System\gUFAFLw.exe
  C:\Windows\System\gUFAFLw.exe
  2⤵
  PID:6072
- C:\Windows\System\XrtYNpl.exe
  C:\Windows\System\XrtYNpl.exe
  2⤵
  PID:6172
- C:\Windows\System\aGCLPoq.exe
  C:\Windows\System\aGCLPoq.exe
  2⤵
  PID:5736
- C:\Windows\System\kSnQUDU.exe
  C:\Windows\System\kSnQUDU.exe
  2⤵
  PID:5548
- C:\Windows\System\ZDIJLuf.exe
  C:\Windows\System\ZDIJLuf.exe
  2⤵
  PID:8208
- C:\Windows\System\BwLENoa.exe
  C:\Windows\System\BwLENoa.exe
  2⤵
  PID:8268
- C:\Windows\System\VGaSjWC.exe
  C:\Windows\System\VGaSjWC.exe
  2⤵
  PID:5388
- C:\Windows\System\mXdQUoQ.exe
  C:\Windows\System\mXdQUoQ.exe
  2⤵
  PID:5100
- C:\Windows\System\AqWtoQI.exe
  C:\Windows\System\AqWtoQI.exe
  2⤵
  PID:464
- C:\Windows\System\QRIiQsn.exe
  C:\Windows\System\QRIiQsn.exe
  2⤵
  PID:14812
- C:\Windows\System\tCUqeUJ.exe
  C:\Windows\System\tCUqeUJ.exe
  2⤵
  PID:4452
- C:\Windows\System\xEDgmEJ.exe
  C:\Windows\System\xEDgmEJ.exe
  2⤵
  PID:1980
- C:\Windows\System\FBlBWJt.exe
  C:\Windows\System\FBlBWJt.exe
  2⤵
  PID:2240
- C:\Windows\System\rReNJfi.exe
  C:\Windows\System\rReNJfi.exe
  2⤵
  PID:5212
- C:\Windows\System\PRFuRnX.exe
  C:\Windows\System\PRFuRnX.exe
  2⤵
  PID:3764
- C:\Windows\System\MJcnnBZ.exe
  C:\Windows\System\MJcnnBZ.exe
  2⤵
  PID:8872
- C:\Windows\System\ShUAnXw.exe
  C:\Windows\System\ShUAnXw.exe
  2⤵
  PID:5516
- C:\Windows\System\xmOSODc.exe
  C:\Windows\System\xmOSODc.exe
  2⤵
  PID:6136
- C:\Windows\System\HqtbptT.exe
  C:\Windows\System\HqtbptT.exe
  2⤵
  PID:5540
- C:\Windows\System\mjjrLjB.exe
  C:\Windows\System\mjjrLjB.exe
  2⤵
  PID:5228
- C:\Windows\System\eVUNhIC.exe
  C:\Windows\System\eVUNhIC.exe
  2⤵
  PID:4424
- C:\Windows\System\FHtTsRO.exe
  C:\Windows\System\FHtTsRO.exe
  2⤵
  PID:14996
- C:\Windows\System\gIxGrRn.exe
  C:\Windows\System\gIxGrRn.exe
  2⤵
  PID:15300
- C:\Windows\System\tHjjytM.exe
  C:\Windows\System\tHjjytM.exe
  2⤵
  PID:15256
- C:\Windows\System\EkKydUx.exe
  C:\Windows\System\EkKydUx.exe
  2⤵
  PID:8456
- C:\Windows\System\pWyWqzT.exe
  C:\Windows\System\pWyWqzT.exe
  2⤵
  PID:3536
- C:\Windows\System\wqvrGBG.exe
  C:\Windows\System\wqvrGBG.exe
  2⤵
  PID:13832
- C:\Windows\System\bAYTkMn.exe
  C:\Windows\System\bAYTkMn.exe
  2⤵
  PID:13736
- C:\Windows\System\HWbOyQe.exe
  C:\Windows\System\HWbOyQe.exe
  2⤵
  PID:2044
- C:\Windows\System\NYclnMq.exe
  C:\Windows\System\NYclnMq.exe
  2⤵
  PID:8848
- C:\Windows\System\zhFYcva.exe
  C:\Windows\System\zhFYcva.exe
  2⤵
  PID:7900
- C:\Windows\System\ZDHQQcG.exe
  C:\Windows\System\ZDHQQcG.exe
  2⤵
  PID:15000
- C:\Windows\System\XGuIgZV.exe
  C:\Windows\System\XGuIgZV.exe
  2⤵
  PID:4240
- C:\Windows\System\LkivAqB.exe
  C:\Windows\System\LkivAqB.exe
  2⤵
  PID:7432
- C:\Windows\System\osRDmSs.exe
  C:\Windows\System\osRDmSs.exe
  2⤵
  PID:7796
- C:\Windows\System\xkWqFHB.exe
  C:\Windows\System\xkWqFHB.exe
  2⤵
  PID:636
- C:\Windows\System\gxGpuYy.exe
  C:\Windows\System\gxGpuYy.exe
  2⤵
  PID:7964
- C:\Windows\System\UESBurv.exe
  C:\Windows\System\UESBurv.exe
  2⤵
  PID:5668
- C:\Windows\System\UaqoARr.exe
  C:\Windows\System\UaqoARr.exe
  2⤵
  PID:6244
- C:\Windows\System\PcuIUWz.exe
  C:\Windows\System\PcuIUWz.exe
  2⤵
  PID:7916
- C:\Windows\System\gIbwjpy.exe
  C:\Windows\System\gIbwjpy.exe
  2⤵
  PID:7992
- C:\Windows\System\yozpUBA.exe
  C:\Windows\System\yozpUBA.exe
  2⤵
  PID:6100
- C:\Windows\System\dZPzxAj.exe
  C:\Windows\System\dZPzxAj.exe
  2⤵
  PID:6304
- C:\Windows\System\hHRSLzq.exe
  C:\Windows\System\hHRSLzq.exe
  2⤵
  PID:6096
- C:\Windows\System\etmHXwv.exe
  C:\Windows\System\etmHXwv.exe
  2⤵
  PID:5760
- C:\Windows\System\zQBBNJK.exe
  C:\Windows\System\zQBBNJK.exe
  2⤵
  PID:8252
- C:\Windows\System\pLxsyqP.exe
  C:\Windows\System\pLxsyqP.exe
  2⤵
  PID:5816
- C:\Windows\System\BjMzhcP.exe
  C:\Windows\System\BjMzhcP.exe
  2⤵
  PID:8296
- C:\Windows\System\OOlaULS.exe
  C:\Windows\System\OOlaULS.exe
  2⤵
  PID:5416
- C:\Windows\System\VxABdDJ.exe
  C:\Windows\System\VxABdDJ.exe
  2⤵
  PID:9652
- C:\Windows\System\PUuMfsV.exe
  C:\Windows\System\PUuMfsV.exe
  2⤵
  PID:8480
- C:\Windows\System\HcsSmWP.exe
  C:\Windows\System\HcsSmWP.exe
  2⤵
  PID:1416
- C:\Windows\System\wHMboHg.exe
  C:\Windows\System\wHMboHg.exe
  2⤵
  PID:14016
- C:\Windows\System\QkAaGGC.exe
  C:\Windows\System\QkAaGGC.exe
  2⤵
  PID:9852
- C:\Windows\System\NMJNIjQ.exe
  C:\Windows\System\NMJNIjQ.exe
  2⤵
  PID:7196
- C:\Windows\System\ONYSXci.exe
  C:\Windows\System\ONYSXci.exe
  2⤵
  PID:6824
- C:\Windows\System\TYNjQQU.exe
  C:\Windows\System\TYNjQQU.exe
  2⤵
  PID:6580
- C:\Windows\System\LiMAhCy.exe
  C:\Windows\System\LiMAhCy.exe
  2⤵
  PID:15088
- C:\Windows\System\JMsnUIx.exe
  C:\Windows\System\JMsnUIx.exe
  2⤵
  PID:3956
- C:\Windows\System\MoAJClX.exe
  C:\Windows\System\MoAJClX.exe
  2⤵
  PID:1516
- C:\Windows\System\OQUPfgj.exe
  C:\Windows\System\OQUPfgj.exe
  2⤵
  PID:5800
- C:\Windows\System\UWKDnGM.exe
  C:\Windows\System\UWKDnGM.exe
  2⤵
  PID:7020
- C:\Windows\System\HrhAUCU.exe
  C:\Windows\System\HrhAUCU.exe
  2⤵
  PID:1676
- C:\Windows\System\gVBHujd.exe
  C:\Windows\System\gVBHujd.exe
  2⤵
  PID:13988
- C:\Windows\System\mwmvybd.exe
  C:\Windows\System\mwmvybd.exe
  2⤵
  PID:7896
- C:\Windows\System\xZwOMje.exe
  C:\Windows\System\xZwOMje.exe
  2⤵
  PID:4980
- C:\Windows\System\mYYeUcT.exe
  C:\Windows\System\mYYeUcT.exe
  2⤵
  PID:732
- C:\Windows\System\jKfLnse.exe
  C:\Windows\System\jKfLnse.exe
  2⤵
  PID:5972
- C:\Windows\System\sqmbgWr.exe
  C:\Windows\System\sqmbgWr.exe
  2⤵
  PID:5832
- C:\Windows\System\GWccwRJ.exe
  C:\Windows\System\GWccwRJ.exe
  2⤵
  PID:6024
- C:\Windows\System\tjLJCAx.exe
  C:\Windows\System\tjLJCAx.exe
  2⤵
  PID:6292
- C:\Windows\System\NLowjRK.exe
  C:\Windows\System\NLowjRK.exe
  2⤵
  PID:6044
- C:\Windows\System\AdXRcOd.exe
  C:\Windows\System\AdXRcOd.exe
  2⤵
  PID:6576
- C:\Windows\System\olvSUNc.exe
  C:\Windows\System\olvSUNc.exe
  2⤵
  PID:5988
- C:\Windows\System\UczMfQb.exe
  C:\Windows\System\UczMfQb.exe
  2⤵
  PID:9936
- C:\Windows\System\vOJklTA.exe
  C:\Windows\System\vOJklTA.exe
  2⤵
  PID:6712
- C:\Windows\System\fnrKjcI.exe
  C:\Windows\System\fnrKjcI.exe
  2⤵
  PID:2716
- C:\Windows\System\YIRQtle.exe
  C:\Windows\System\YIRQtle.exe
  2⤵
  PID:10212
- C:\Windows\System\fXtaJLx.exe
  C:\Windows\System\fXtaJLx.exe
  2⤵
  PID:6556
- C:\Windows\System\nHeXYlu.exe
  C:\Windows\System\nHeXYlu.exe
  2⤵
  PID:6868
- C:\Windows\System\YskSRis.exe
  C:\Windows\System\YskSRis.exe
  2⤵
  PID:6444
- C:\Windows\System\ECFlzUU.exe
  C:\Windows\System\ECFlzUU.exe
  2⤵
  PID:6392
- C:\Windows\System\jUMCkFX.exe
  C:\Windows\System\jUMCkFX.exe
  2⤵
  PID:5536
- C:\Windows\System\cvpuvQg.exe
  C:\Windows\System\cvpuvQg.exe
  2⤵
  PID:9880
- C:\Windows\System\wuDBEuE.exe
  C:\Windows\System\wuDBEuE.exe
  2⤵
  PID:7112
- C:\Windows\System\DaMDqQV.exe
  C:\Windows\System\DaMDqQV.exe
  2⤵
  PID:15072
- C:\Windows\System\EiaCwll.exe
  C:\Windows\System\EiaCwll.exe
  2⤵
  PID:7332
- C:\Windows\System\eRIspVL.exe
  C:\Windows\System\eRIspVL.exe
  2⤵
  PID:7560
- C:\Windows\System\GIpHupT.exe
  C:\Windows\System\GIpHupT.exe
  2⤵
  PID:10328
- C:\Windows\System\rDFKVSe.exe
  C:\Windows\System\rDFKVSe.exe
  2⤵
  PID:8808
- C:\Windows\System\cIPtruU.exe
  C:\Windows\System\cIPtruU.exe
  2⤵
  PID:10296
- C:\Windows\System\AveEMJl.exe
  C:\Windows\System\AveEMJl.exe
  2⤵
  PID:6152
- C:\Windows\System\CBzHkUd.exe
  C:\Windows\System\CBzHkUd.exe
  2⤵
  PID:7412
- C:\Windows\System\qngTRTo.exe
  C:\Windows\System\qngTRTo.exe
  2⤵
  PID:540
- C:\Windows\System\IebWjJL.exe
  C:\Windows\System\IebWjJL.exe
  2⤵
  PID:7164
- C:\Windows\System\LbcVrzE.exe
  C:\Windows\System\LbcVrzE.exe
  2⤵
  PID:7472
- C:\Windows\System\VGTqKhY.exe
  C:\Windows\System\VGTqKhY.exe
  2⤵
  PID:7116
- C:\Windows\System\RlwmTsu.exe
  C:\Windows\System\RlwmTsu.exe
  2⤵
  PID:9808
- C:\Windows\System\iXiwutV.exe
  C:\Windows\System\iXiwutV.exe
  2⤵
  PID:6732
- C:\Windows\System\PLdzgUM.exe
  C:\Windows\System\PLdzgUM.exe
  2⤵
  PID:7312
- C:\Windows\System\QRbTJOA.exe
  C:\Windows\System\QRbTJOA.exe
  2⤵
  PID:8116
- C:\Windows\System\KuVkWWb.exe
  C:\Windows\System\KuVkWWb.exe
  2⤵
  PID:6368
- C:\Windows\System\lYwGxgw.exe
  C:\Windows\System\lYwGxgw.exe
  2⤵
  PID:7680
- C:\Windows\System\AusIxqR.exe
  C:\Windows\System\AusIxqR.exe
  2⤵
  PID:7824
- C:\Windows\System\SkOMebG.exe
  C:\Windows\System\SkOMebG.exe
  2⤵
  PID:7084
- C:\Windows\System\yJEsnMb.exe
  C:\Windows\System\yJEsnMb.exe
  2⤵
  PID:8052
- C:\Windows\System\cGHnDAO.exe
  C:\Windows\System\cGHnDAO.exe
  2⤵
  PID:6924
- C:\Windows\System\bVkSTws.exe
  C:\Windows\System\bVkSTws.exe
  2⤵
  PID:10292
- C:\Windows\System\jSbiYHm.exe
  C:\Windows\System\jSbiYHm.exe
  2⤵
  PID:7568
- C:\Windows\System\ulLQIPd.exe
  C:\Windows\System\ulLQIPd.exe
  2⤵
  PID:7468
- C:\Windows\System\wNFCiZi.exe
  C:\Windows\System\wNFCiZi.exe
  2⤵
  PID:6168
- C:\Windows\System\EBzxfAd.exe
  C:\Windows\System\EBzxfAd.exe
  2⤵
  PID:7664
- C:\Windows\System\XouSbjr.exe
  C:\Windows\System\XouSbjr.exe
  2⤵
  PID:6520
- C:\Windows\System\LovGvcZ.exe
  C:\Windows\System\LovGvcZ.exe
  2⤵
  PID:10852
- C:\Windows\System\ZwbgBfx.exe
  C:\Windows\System\ZwbgBfx.exe
  2⤵
  PID:9328
- C:\Windows\System\wPqKSvM.exe
  C:\Windows\System\wPqKSvM.exe
  2⤵
  PID:7940
- C:\Windows\System\XNoeZad.exe
  C:\Windows\System\XNoeZad.exe
  2⤵
  PID:8008
- C:\Windows\System\insshCO.exe
  C:\Windows\System\insshCO.exe
  2⤵
  PID:7452
- C:\Windows\System\WbjkTxU.exe
  C:\Windows\System\WbjkTxU.exe
  2⤵
  PID:6716
- C:\Windows\System\NMgMRSd.exe
  C:\Windows\System\NMgMRSd.exe
  2⤵
  PID:7860
- C:\Windows\System\jGmAHci.exe
  C:\Windows\System\jGmAHci.exe
  2⤵
  PID:2432
- C:\Windows\System\PhdcJLj.exe
  C:\Windows\System\PhdcJLj.exe
  2⤵
  PID:10356
- C:\Windows\System\RLhHOWA.exe
  C:\Windows\System\RLhHOWA.exe
  2⤵
  PID:10676
- C:\Windows\System\BRzxVQv.exe
  C:\Windows\System\BRzxVQv.exe
  2⤵
  PID:11996
- C:\Windows\System\pxsRdgY.exe
  C:\Windows\System\pxsRdgY.exe
  2⤵
  PID:10836
- C:\Windows\System\bekFsYa.exe
  C:\Windows\System\bekFsYa.exe
  2⤵
  PID:11992
- C:\Windows\System\bfCHaVO.exe
  C:\Windows\System\bfCHaVO.exe
  2⤵
  PID:15376
- C:\Windows\System\TqvrtHN.exe
  C:\Windows\System\TqvrtHN.exe
  2⤵
  PID:15408
- C:\Windows\System\BEskFYa.exe
  C:\Windows\System\BEskFYa.exe
  2⤵
  PID:15452
- C:\Windows\System\ywJOiVw.exe
  C:\Windows\System\ywJOiVw.exe
  2⤵
  PID:15484
- C:\Windows\System\iKDrTho.exe
  C:\Windows\System\iKDrTho.exe
  2⤵
  PID:15520
- C:\Windows\System\EcORukm.exe
  C:\Windows\System\EcORukm.exe
  2⤵
  PID:15536
- C:\Windows\System\kHQoFOl.exe
  C:\Windows\System\kHQoFOl.exe
  2⤵
  PID:15588
- C:\Windows\System\rsrttVX.exe
  C:\Windows\System\rsrttVX.exe
  2⤵
  PID:15604
- C:\Windows\System\wuQbxFV.exe
  C:\Windows\System\wuQbxFV.exe
  2⤵
  PID:15628
- C:\Windows\System\ITxhkZQ.exe
  C:\Windows\System\ITxhkZQ.exe
  2⤵
  PID:15648
- C:\Windows\System\cvtueKl.exe
  C:\Windows\System\cvtueKl.exe
  2⤵
  PID:15676
- C:\Windows\System\tftIYZm.exe
  C:\Windows\System\tftIYZm.exe
  2⤵
  PID:15704
- C:\Windows\System\HVzlilY.exe
  C:\Windows\System\HVzlilY.exe
  2⤵
  PID:15720
- C:\Windows\System\uVmrvFZ.exe
  C:\Windows\System\uVmrvFZ.exe
  2⤵
  PID:15748
- C:\Windows\System\SLoewjb.exe
  C:\Windows\System\SLoewjb.exe
  2⤵
  PID:15768
- C:\Windows\System\FGqHvKM.exe
  C:\Windows\System\FGqHvKM.exe
  2⤵
  PID:15808
- C:\Windows\System\JThNNOE.exe
  C:\Windows\System\JThNNOE.exe
  2⤵
  PID:15852
- C:\Windows\System\cYpDTel.exe
  C:\Windows\System\cYpDTel.exe
  2⤵
  PID:15876
- C:\Windows\System\ZyOwSCu.exe
  C:\Windows\System\ZyOwSCu.exe
  2⤵
  PID:15904
- C:\Windows\System\NfcfJRl.exe
  C:\Windows\System\NfcfJRl.exe
  2⤵
  PID:15944
- C:\Windows\System\gpTGSrX.exe
  C:\Windows\System\gpTGSrX.exe
  2⤵
  PID:15972
- C:\Windows\System\fZDLXRJ.exe
  C:\Windows\System\fZDLXRJ.exe
  2⤵
  PID:16004
- C:\Windows\System\oYkXvYY.exe
  C:\Windows\System\oYkXvYY.exe
  2⤵
  PID:16028
- C:\Windows\System\yQwVCFu.exe
  C:\Windows\System\yQwVCFu.exe
  2⤵
  PID:16048
- C:\Windows\System\iuCgxAr.exe
  C:\Windows\System\iuCgxAr.exe
  2⤵
  PID:16072
- C:\Windows\System\LXXWiHN.exe
  C:\Windows\System\LXXWiHN.exe
  2⤵
  PID:16104
- C:\Windows\System\cEVlAso.exe
  C:\Windows\System\cEVlAso.exe
  2⤵
  PID:16124
- C:\Windows\System\QicBrYK.exe
  C:\Windows\System\QicBrYK.exe
  2⤵
  PID:16156
- C:\Windows\System\oPFbBho.exe
  C:\Windows\System\oPFbBho.exe
  2⤵
  PID:16180
- C:\Windows\System\fMuYQZh.exe
  C:\Windows\System\fMuYQZh.exe
  2⤵
  PID:16200
- C:\Windows\System\tVzeugm.exe
  C:\Windows\System\tVzeugm.exe
  2⤵
  PID:16216
- C:\Windows\System\PlFRxwS.exe
  C:\Windows\System\PlFRxwS.exe
  2⤵
  PID:16232
- C:\Windows\System\XIrLKjN.exe
  C:\Windows\System\XIrLKjN.exe
  2⤵
  PID:16256
- C:\Windows\System\nMewHzW.exe
  C:\Windows\System\nMewHzW.exe
  2⤵
  PID:16272
- C:\Windows\System\AlSpOTX.exe
  C:\Windows\System\AlSpOTX.exe
  2⤵
  PID:16340
- C:\Windows\System\lPlEJZB.exe
  C:\Windows\System\lPlEJZB.exe
  2⤵
  PID:16372
- C:\Windows\System\BbEQFRl.exe
  C:\Windows\System\BbEQFRl.exe
  2⤵
  PID:15372
- C:\Windows\System\vQARzTE.exe
  C:\Windows\System\vQARzTE.exe
  2⤵
  PID:8048
- C:\Windows\System\djOUcAQ.exe
  C:\Windows\System\djOUcAQ.exe
  2⤵
  PID:15428
- C:\Windows\System\nncrISf.exe
  C:\Windows\System\nncrISf.exe
  2⤵
  PID:7348
- C:\Windows\System\xEKnmPL.exe
  C:\Windows\System\xEKnmPL.exe
  2⤵
  PID:15476
- C:\Windows\System\asveRYW.exe
  C:\Windows\System\asveRYW.exe
  2⤵
  PID:15556
- C:\Windows\System\EAThvKG.exe
  C:\Windows\System\EAThvKG.exe
  2⤵
  PID:15572
- C:\Windows\System\gYgqlSg.exe
  C:\Windows\System\gYgqlSg.exe
  2⤵
  PID:15616
- C:\Windows\System\PUkfXmI.exe
  C:\Windows\System\PUkfXmI.exe
  2⤵
  PID:8196
- C:\Windows\System\XWzgsQQ.exe
  C:\Windows\System\XWzgsQQ.exe
  2⤵
  PID:8428
- C:\Windows\System\JZQXGCW.exe
  C:\Windows\System\JZQXGCW.exe
  2⤵
  PID:8328
- C:\Windows\System\xFeXpSE.exe
  C:\Windows\System\xFeXpSE.exe
  2⤵
  PID:8420
- C:\Windows\System\xEtWywN.exe
  C:\Windows\System\xEtWywN.exe
  2⤵
  PID:15776
- C:\Windows\System\RiCfHmH.exe
  C:\Windows\System\RiCfHmH.exe
  2⤵
  PID:15792
- C:\Windows\System\ZycHpQj.exe
  C:\Windows\System\ZycHpQj.exe
  2⤵
  PID:15820
- C:\Windows\System\fMlJUsr.exe
  C:\Windows\System\fMlJUsr.exe
  2⤵
  PID:15864
- C:\Windows\System\nfxouMI.exe
  C:\Windows\System\nfxouMI.exe
  2⤵
  PID:15892
- C:\Windows\System\jMPwOQt.exe
  C:\Windows\System\jMPwOQt.exe
  2⤵
  PID:8860
- C:\Windows\System\kAvHeWT.exe
  C:\Windows\System\kAvHeWT.exe
  2⤵
  PID:9008
- C:\Windows\System\ldZouYx.exe
  C:\Windows\System\ldZouYx.exe
  2⤵
  PID:15988
- C:\Windows\System\OcFyqqR.exe
  C:\Windows\System\OcFyqqR.exe
  2⤵
  PID:9028
- C:\Windows\System\AIRyZvj.exe
  C:\Windows\System\AIRyZvj.exe
  2⤵
  PID:16080
- C:\Windows\System\nUJrJJi.exe
  C:\Windows\System\nUJrJJi.exe
  2⤵
  PID:9068
- C:\Windows\System\EcpKWjy.exe
  C:\Windows\System\EcpKWjy.exe
  2⤵
  PID:16132
- C:\Windows\System\RhjLZWK.exe
  C:\Windows\System\RhjLZWK.exe
  2⤵
  PID:16116
- C:\Windows\System\ByycrdF.exe
  C:\Windows\System\ByycrdF.exe
  2⤵
  PID:16136
- C:\Windows\System\yQreLAV.exe
  C:\Windows\System\yQreLAV.exe
  2⤵
  PID:16152
- C:\Windows\System\CewIIbT.exe
  C:\Windows\System\CewIIbT.exe
  2⤵
  PID:16176
- C:\Windows\System\QtKFRap.exe
  C:\Windows\System\QtKFRap.exe
  2⤵
  PID:16248
- C:\Windows\System\KeesPkV.exe
  C:\Windows\System\KeesPkV.exe
  2⤵
  PID:16284
- C:\Windows\System\bXzVOPe.exe
  C:\Windows\System\bXzVOPe.exe
  2⤵
  PID:16336
- C:\Windows\System\ptetBmX.exe
  C:\Windows\System\ptetBmX.exe
  2⤵
  PID:9048
- C:\Windows\System\uXMYIUw.exe
  C:\Windows\System\uXMYIUw.exe
  2⤵
  PID:6772
- C:\Windows\System\grPpJza.exe
  C:\Windows\System\grPpJza.exe
  2⤵
  PID:8508
- C:\Windows\System\niZAmJH.exe
  C:\Windows\System\niZAmJH.exe
  2⤵
  PID:8900
- C:\Windows\System\hpvCPBv.exe
  C:\Windows\System\hpvCPBv.exe
  2⤵
  PID:316
- C:\Windows\System\YOXTsav.exe
  C:\Windows\System\YOXTsav.exe
  2⤵
  PID:15528
- C:\Windows\System\gyCzKKM.exe
  C:\Windows\System\gyCzKKM.exe
  2⤵
  PID:8300
- C:\Windows\System\UdYTCIE.exe
  C:\Windows\System\UdYTCIE.exe
  2⤵
  PID:15624
- C:\Windows\System\sunldVF.exe
  C:\Windows\System\sunldVF.exe
  2⤵
  PID:15660
- C:\Windows\System\qmhsbcU.exe
  C:\Windows\System\qmhsbcU.exe
  2⤵
  PID:9244
- C:\Windows\System\THeVCnf.exe
  C:\Windows\System\THeVCnf.exe
  2⤵
  PID:8560
- C:\Windows\System\YwMEtKA.exe
  C:\Windows\System\YwMEtKA.exe
  2⤵
  PID:9436
- C:\Windows\System\zAUfvTO.exe
  C:\Windows\System\zAUfvTO.exe
  2⤵
  PID:8764
- C:\Windows\System\hJAjtdJ.exe
  C:\Windows\System\hJAjtdJ.exe
  2⤵
  PID:9488
- C:\Windows\System\wdqEPdc.exe
  C:\Windows\System\wdqEPdc.exe
  2⤵
  PID:8976
- C:\Windows\System\agsUNMM.exe
  C:\Windows\System\agsUNMM.exe
  2⤵
  PID:16024
- C:\Windows\System\dPlQmhj.exe
  C:\Windows\System\dPlQmhj.exe
  2⤵
  PID:9204
- C:\Windows\System\gyQWFqm.exe
  C:\Windows\System\gyQWFqm.exe
  2⤵
  PID:9696
- C:\Windows\System\NhvXDtH.exe
  C:\Windows\System\NhvXDtH.exe
  2⤵
  PID:9744
- C:\Windows\System\LAZralI.exe
  C:\Windows\System\LAZralI.exe
  2⤵
  PID:9836
- C:\Windows\System\kGpupLD.exe
  C:\Windows\System\kGpupLD.exe
  2⤵
  PID:9176
- C:\Windows\System\iIROOnr.exe
  C:\Windows\System\iIROOnr.exe
  2⤵
  PID:9208
- C:\Windows\System\BQiBeaH.exe
  C:\Windows\System\BQiBeaH.exe
  2⤵
  PID:12680
- C:\Windows\System\TcWYRco.exe
  C:\Windows\System\TcWYRco.exe
  2⤵
  PID:16324
- C:\Windows\System\zvhnRbL.exe
  C:\Windows\System\zvhnRbL.exe
  2⤵
  PID:16368
- C:\Windows\System\olztyJU.exe
  C:\Windows\System\olztyJU.exe
  2⤵
  PID:10092
- C:\Windows\System\kjWiptd.exe
  C:\Windows\System\kjWiptd.exe
  2⤵
  PID:7804
- C:\Windows\System\pvOQNwc.exe
  C:\Windows\System\pvOQNwc.exe
  2⤵
  PID:9972
- C:\Windows\System\kSzIIeP.exe
  C:\Windows\System\kSzIIeP.exe
  2⤵
  PID:8460
- C:\Windows\System\bELeJtV.exe
  C:\Windows\System\bELeJtV.exe
  2⤵
  PID:10180
- C:\Windows\System\yoaThCa.exe
  C:\Windows\System\yoaThCa.exe
  2⤵
  PID:9220
- C:\Windows\System\KYFIEXk.exe
  C:\Windows\System\KYFIEXk.exe
  2⤵
  PID:8660
- C:\Windows\System\nGlccPx.exe
  C:\Windows\System\nGlccPx.exe
  2⤵
  PID:9272
- C:\Windows\System\DmnOFTM.exe
  C:\Windows\System\DmnOFTM.exe
  2⤵
  PID:15936
- C:\Windows\System\auJjTTd.exe
  C:\Windows\System\auJjTTd.exe
  2⤵
  PID:9440
- C:\Windows\System\tGsXnhl.exe
  C:\Windows\System\tGsXnhl.exe
  2⤵
  PID:9468
- C:\Windows\System\koJHcod.exe
  C:\Windows\System\koJHcod.exe
  2⤵
  PID:13112
- C:\Windows\System\PhzHDWD.exe
  C:\Windows\System\PhzHDWD.exe
  2⤵
  PID:9376
- C:\Windows\System\vdnYbAy.exe
  C:\Windows\System\vdnYbAy.exe
  2⤵
  PID:9792
- C:\Windows\System\nAMTSSA.exe
  C:\Windows\System\nAMTSSA.exe
  2⤵
  PID:9764
- C:\Windows\System\hAPOrgV.exe
  C:\Windows\System\hAPOrgV.exe
  2⤵
  PID:12516
- C:\Windows\System\KBCgxKK.exe
  C:\Windows\System\KBCgxKK.exe
  2⤵
  PID:16212
- C:\Windows\System\qwYNsbk.exe
  C:\Windows\System\qwYNsbk.exe
  2⤵
  PID:16264
- C:\Windows\System\etjWzMk.exe
  C:\Windows\System\etjWzMk.exe
  2⤵
  PID:10088
- C:\Windows\System\RwHDovd.exe
  C:\Windows\System\RwHDovd.exe
  2⤵
  PID:15392
- C:\Windows\System\MYnpqLu.exe
  C:\Windows\System\MYnpqLu.exe
  2⤵
  PID:13308
- C:\Windows\System\tPjGFCn.exe
  C:\Windows\System\tPjGFCn.exe
  2⤵
  PID:9588
- C:\Windows\System\SonZpXe.exe
  C:\Windows\System\SonZpXe.exe
  2⤵
  PID:12592
- C:\Windows\System\iKSXuUC.exe
  C:\Windows\System\iKSXuUC.exe
  2⤵
  PID:15532
- C:\Windows\System\emYklir.exe
  C:\Windows\System\emYklir.exe
  2⤵
  PID:10612
- C:\Windows\System\Mbrpigb.exe
  C:\Windows\System\Mbrpigb.exe
  2⤵
  PID:10616
- C:\Windows\System\LNhfjxG.exe
  C:\Windows\System\LNhfjxG.exe
  2⤵
  PID:10732
- C:\Windows\System\bbfISbb.exe
  C:\Windows\System\bbfISbb.exe
  2⤵
  PID:8536
- C:\Windows\System\jLKnWrY.exe
  C:\Windows\System\jLKnWrY.exe
  2⤵
  PID:13124
- C:\Windows\System\oTXVsFc.exe
  C:\Windows\System\oTXVsFc.exe
  2⤵
  PID:7096
- C:\Windows\System\LltqBkJ.exe
  C:\Windows\System\LltqBkJ.exe
  2⤵
  PID:16056
- C:\Windows\System\sCQzGHu.exe
  C:\Windows\System\sCQzGHu.exe
  2⤵
  PID:9960
- C:\Windows\System\SCCgDHD.exe
  C:\Windows\System\SCCgDHD.exe
  2⤵
  PID:12792
- C:\Windows\System\LCLOKjg.exe
  C:\Windows\System\LCLOKjg.exe
  2⤵
  PID:6448
- C:\Windows\System\dhaBeHY.exe
  C:\Windows\System\dhaBeHY.exe
  2⤵
  PID:10404
- C:\Windows\System\laZTBIA.exe
  C:\Windows\System\laZTBIA.exe
  2⤵
  PID:9724
- C:\Windows\System\wsmBsYJ.exe
  C:\Windows\System\wsmBsYJ.exe
  2⤵
  PID:10512
- C:\Windows\System\FGuVafT.exe
  C:\Windows\System\FGuVafT.exe
  2⤵
  PID:12892
- C:\Windows\System\yuEzlnt.exe
  C:\Windows\System\yuEzlnt.exe
  2⤵
  PID:10740
- C:\Windows\System\KTCmcrT.exe
  C:\Windows\System\KTCmcrT.exe
  2⤵
  PID:15956
- C:\Windows\System\vkWWzcT.exe
  C:\Windows\System\vkWWzcT.exe
  2⤵
  PID:11260
- C:\Windows\System\pwMrsyE.exe
  C:\Windows\System\pwMrsyE.exe
  2⤵
  PID:8432
- C:\Windows\System\MitvrUu.exe
  C:\Windows\System\MitvrUu.exe
  2⤵
  PID:11156
- C:\Windows\System\qSkhEoj.exe
  C:\Windows\System\qSkhEoj.exe
  2⤵
  PID:16044
- C:\Windows\System\voWCbzJ.exe
  C:\Windows\System\voWCbzJ.exe
  2⤵
  PID:10360
- C:\Windows\System\PFohXwQ.exe
  C:\Windows\System\PFohXwQ.exe
  2⤵
  PID:10164
- C:\Windows\System\oGUZcQi.exe
  C:\Windows\System\oGUZcQi.exe
  2⤵
  PID:10436
- C:\Windows\System\eXDhdxt.exe
  C:\Windows\System\eXDhdxt.exe
  2⤵
  PID:9604
- C:\Windows\System\OnbjOAD.exe
  C:\Windows\System\OnbjOAD.exe
  2⤵
  PID:10620
- C:\Windows\System\TJhdYwO.exe
  C:\Windows\System\TJhdYwO.exe
  2⤵
  PID:10400
- C:\Windows\System\EHTVnsu.exe
  C:\Windows\System\EHTVnsu.exe
  2⤵
  PID:9292
- C:\Windows\System\kuLgxjw.exe
  C:\Windows\System\kuLgxjw.exe
  2⤵
  PID:11504
- C:\Windows\System\vJmLVnG.exe
  C:\Windows\System\vJmLVnG.exe
  2⤵
  PID:10272
- C:\Windows\System\AGfKyRS.exe
  C:\Windows\System\AGfKyRS.exe
  2⤵
  PID:11108
- C:\Windows\System\UKQzxwF.exe
  C:\Windows\System\UKQzxwF.exe
  2⤵
  PID:8080
- C:\Windows\System\WfKfsJz.exe
  C:\Windows\System\WfKfsJz.exe
  2⤵
  PID:11728
- C:\Windows\System\FvOnjXH.exe
  C:\Windows\System\FvOnjXH.exe
  2⤵
  PID:11184
- C:\Windows\System\tWHVkhy.exe
  C:\Windows\System\tWHVkhy.exe
  2⤵
  PID:11444
- C:\Windows\System\vhdyZqS.exe
  C:\Windows\System\vhdyZqS.exe
  2⤵
  PID:11396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:14984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BZYRToE.exe

Filesize
2.2MB

MD5
9c9b0effec95e889d1728906b88d3f3f

SHA1
703efe4ee35158ed1562b39e980c2f624be6f027

SHA256
b6cb936b4a01088991847809392e7704fc89cc513a08a8f6139c5dd1dbcf5946

SHA512
d19075f65148d082bc79eb586dc80bfd7d9b20ac90e145974fb560bb9b83c6b7eee5d83e16fc34fa868b2453cf9e6efdbcbb4799706c6211e695f004be8f331e

Download Submit
C:\Windows\System\BqSWHze.exe

Filesize
2.2MB

MD5
b1c61c14519a087d804b0b8cd4c1bd26

SHA1
330361de560e649a5f3f46ecb09f3121c72b0b51

SHA256
ac765608bc9e6f4af75379f09870eba1ac9e822e149c2017fa99a9e24060977f

SHA512
2d45ae6cd7fcf739ef02a3edbb4af7d3ea3378764e1b9d8c7b65836cea17ddb0762a736493da2c142f290e8766cd6e013544893825f65eeb3b6394d2785245e6

Download Submit
C:\Windows\System\DoYLkuo.exe

Filesize
2.2MB

MD5
d05ace2e5cf80a2ec9a850a398e8a02e

SHA1
a01251667c1a9ccb1ecebfa0ee91e3bf99999f19

SHA256
01283aed8ed198558f3a48466c1ed3c111497f516b03046bd4fb52ebe5badc7d

SHA512
405bede92c2901113aaa60bce5f68face55ea65c4c095498d976d1f75bf43ccf90fcaa6dbd9c53924e60f5a6b6eb3aa5ebd97702a4ce0820fc5d47535b92f393

Download Submit
C:\Windows\System\FOPLsMN.exe

Filesize
2.2MB

MD5
84f340df63686d2933f6010541a03b17

SHA1
4704c4cd7ff94d33428018a464a24be2615f16d5

SHA256
84e2b7fa8e660ec2eb1aafa92ab3bdc410d18e94d20ce8a0360592194c8aefd1

SHA512
22c03f2df0f129fc0e24a5406dc606a081f4a2bdf08cea71be12c6c21651e7fddec16ecddeed2b65ef7932af753525f84a825a37a52a9fdc2424add9eb478f49

Download Submit
C:\Windows\System\FOncoIc.exe

Filesize
2.2MB

MD5
963f3dbcb887f86377ef054787f572c4

SHA1
d4e9536f377aa7d5b3b6a8198e820cdf9f6fa5b3

SHA256
677eaf94bd8bc0e4f17cf401eec747c6ae86face3cd853a5043921bfe2c51e80

SHA512
fc43dd4500878400331f39b212179f40a2a0da5731303e5594b4847ecc0989bc8625fd9efafc16f143e3601d6b4a94db97a85199c24159a7375058af344e36c6

Download Submit
C:\Windows\System\GhpDtoG.exe

Filesize
2.2MB

MD5
64da4c898212bcc0154b44423e5ae72a

SHA1
e30cab76d2bd5d530a6071fd12c3a29aa01e90a3

SHA256
893e09aad46f02da5fddd326b552f212faa70aeca4634d5935d06ac0e8020744

SHA512
2ffc27e3635558f1b791f2d923a5d1c2a7b2e763e1d60e852b38cf6c86173d7e01e68148b15de4849e4fff5ce181b9af8eecacfb93031f35caf44bf443997c8b

Download Submit
C:\Windows\System\JfKzBJX.exe

Filesize
2.2MB

MD5
f392b1ae1a1c5f8c655f77b73037d03e

SHA1
dfa9ac8b9be8555ca8917a8d0203ec119a1fbc7b

SHA256
e0370a698598ddfc0a216b081a0deb584202ac6f0cc5184f818caf3edd71639b

SHA512
408aff3e1f30c33c04e9a0646bc5ffe57560654c7c2da4ddc08731bf4662cae3e2a58b2463296996f0f2f90f13fa393728b11d011685e32b23a2866d9ed63220

Download Submit
C:\Windows\System\KsyVGDC.exe

Filesize
2.2MB

MD5
b4a3240a280b036bdaf28e1cdca41ee9

SHA1
51be6d45d526d8ab3ea9e887072b08e5b7baf802

SHA256
2bfedeca966efb2db49b516e4d6ff44fa3c5988921b41d3bb00852a4e73c2bfd

SHA512
b2709544f8334cea807048506e169ad05cd027475e6d246f358acf3830bbde4dd60ad605df42085093fe46414e6bccd3252f310cc4157487455f1e7182c64e81

Download Submit
C:\Windows\System\NgxHSsS.exe

Filesize
2.2MB

MD5
1f2d350df937843d13c3e133cba9a46f

SHA1
2fc525ec02b3b690c34addafa77dbbcfdc50cdac

SHA256
0ad4d1f1fdee1ae54e4e7a30f116ad32820cb5289512eb4a17b97d262e7ef312

SHA512
102d3ed9aef018d9aa00b1ae8fdec9fb2819fbe03c9b4b1512f76ac68e78245b56be446df3cb857d5b34427c395a4096f7ff25fac8a92b6511a0368da75cbc22

Download Submit
C:\Windows\System\PluOXyN.exe

Filesize
2.2MB

MD5
68fe24639b53ae574cd5650457658b9d

SHA1
920ae2044e0d52cd3efc53b6da8992c56e62b800

SHA256
ae357f6c0c232153934749e9ff6444859f19f4a07838cd585015025049e264e2

SHA512
781f37b4182d5a388cf6cd862bacbfb4e30033b1776b29505fbea6d0d45e0f20b55741ef36ebf9bbe955dea75151841773dd7a1663de99eb835dbc91d2bb04f5

Download Submit
C:\Windows\System\QDgHaQO.exe

Filesize
2.2MB

MD5
c54016fbdcca2b6fd8c0aa225192cf76

SHA1
a72b30d14d8732cbcf7a1ff0edf257506a90c180

SHA256
78d43603b4e4e259c0f7fe7c8ae8df5819118338e59181d0bef1d122bb7d6fdf

SHA512
841e27177d6f812e156487d16b0162047e5b5d918039e1ceb568de0ae72ab78a641caf43b7431403b70ac99dad1018dc891c397964d6b4ccc488bffe563dce4d

Download Submit
C:\Windows\System\TryZxXG.exe

Filesize
2.2MB

MD5
55e0c41cbe6fa1348fda9a4c382c6c16

SHA1
d3b446345adf597be437122dbf6138bd5eab516c

SHA256
ae8d8cd7ce597a183ecd35154fed8bf5e1763f309baf5c2f135a37a252404143

SHA512
e4594b267ebbd003f77be55355d9444fdfcc399d3af0a44a83e21d0bf9631601b6ff4991af798cc9cd93ad71c7507a9834339db86860f9461619fc01793563a3

Download Submit
C:\Windows\System\XAOUOUY.exe

Filesize
2.2MB

MD5
5c9d6e3daec5141b2c00db00f4bb7959

SHA1
c99b042f63746d99a32611d6a683c31fde914e32

SHA256
d7a091b609ed382a55402b614034acbd489d2a97dfb66b45680dae1913dff58a

SHA512
dbf7119bd835d2f0075e0585faf20d12e62fb0335cc0102006bf18f885b1ccbf0d26d9ec6dbc87278050065f6a7e061e0b5eb179440c3aa8fc1f216f04d7d8cd

Download Submit
C:\Windows\System\XQXAdPK.exe

Filesize
2.2MB

MD5
964dc2d0d80e9340facdf485ae546d21

SHA1
73772537ce65b515961795302e48e39a2349d3c0

SHA256
ba96a2b57721781c3ad4f056e8b596cd255cdd911e146729053af664e3389f27

SHA512
211a9d769c9e696c315f417d819894ddcd65471debbc13653ce73375b2c580fe6a03b18dcbbcf190d4310d4b8b8a3fe42eec92c7b84bc0e6b20a0fb84abda790

Download Submit
C:\Windows\System\Ygpmory.exe

Filesize
2.2MB

MD5
54e194af7c1696d19d3f0baf348833b5

SHA1
d05835e8b372476dda952df711cb247c13063533

SHA256
a4a8812b7e021c4e41b4989f7b305352776d9f0a8963eef42b84bb7f00e20af8

SHA512
1fab270a77cda522b3f1d63881f22191ea42996da22ea6ad2948a371699cf8e645c5acf181275a8b40123a4a8b2b572ff29bb174662a10702e074c602deb5669

Download Submit
C:\Windows\System\ZHesWhG.exe

Filesize
2.2MB

MD5
9571e247fec78eba543f43de423fa358

SHA1
1d3436c67d183b3fff337b4abbf97818ee0f043b

SHA256
ddc3a57a2924bb1d021a93064cb6ff8951adc9bc25e9e23ad258eb7e133ce2de

SHA512
da1c555b85196c5227604ba3eec32abaccd229d09da4601036ad1f1027ba5d54ede9649265722a313a0413053296c4fc546b2dc24bced82a11d1bd7978530e4e

Download Submit
C:\Windows\System\ZQdZnjI.exe

Filesize
2.2MB

MD5
d4f97b800915ee482af3e9a0d45f5e73

SHA1
e073f3a8aa8ecfbf8c59d5974997cb9fc4e0fdf0

SHA256
d2b53e0926be847443f7709e1eed5783774a600c483111746ba6f2c1b0fee5db

SHA512
01bc14c325390571d66505d62b9446800a02962adc774428ad5180d8e0d015f43875156cee6b154e2e634d72526be5d57684ecaab164d745da46d94f2016f3e7

Download Submit
C:\Windows\System\abaaoRC.exe

Filesize
2.2MB

MD5
6f1012ec72a9298fde601b6f0c5a4274

SHA1
982058c72611a944a7036c63266356f39027ef6e

SHA256
6d6c8169b3d8d9a8a5b5353bb4787af4c8d7edd5447eba1a65d8b7ca41c91da7

SHA512
00270b17564bf3f508419821731c9d63f27e36b65c953eba67874488bd8a3060c81220a0f8f3a1613fab766f8696efb5981fcb2a11d744c30a8b6822dd01255c

Download Submit
C:\Windows\System\bAhuYJm.exe

Filesize
2.2MB

MD5
a36427dcaf97bd46b8ae4024b49a8dc3

SHA1
b632e804cbea4800d2f91567303302057824d6c8

SHA256
966e1038954034d9450014777645d6bb58e93fa397b24078f473dac6b2d83b82

SHA512
e7da52cbb62bafd61521b3fe96cf63ee3d165f7b364723fb12d7c061b642e031e41004129a0f33966feddcd9c8f8f4413cc20ae2a80dd2dfb01acf381a62bacd

Download Submit
C:\Windows\System\gKcumYW.exe

Filesize
2.2MB

MD5
b4cd36663d4eaaaab3654154492a2678

SHA1
9c8e7b5487b89b801bb84e8a40f97385bf7d7b81

SHA256
eff4b0b72fc1dd859964bd2dc2f3ad3c698cd8c954e3e4441d737fe0421abaa2

SHA512
e4f217964e82970a77fa9b1e4e30bc30baae6d02a3593f448c9d41deb7dd75e22237750829232390165b2ff16e164aea4981cf56ae33059084221c4c60c7a11d

Download Submit
C:\Windows\System\jKbnwpN.exe

Filesize
2.2MB

MD5
ea6eb621528f395e7b079efd2bb06f19

SHA1
661efd1face9851fb77bd02b5a9afea6655dc8b3

SHA256
03abcd2d0b6506d33c2f21360643a96c5e571fe789d6981a9a585ecf24f87fe0

SHA512
fe5a2a6ec52bd95c5086b1b598513da541179bfcde42488f15933def1bf95c9a83823787e2b359e960be3b63978cacdfe23f440c6e0cf1b451cc0fb4e2d5bfc7

Download Submit
C:\Windows\System\jkrmeeH.exe

Filesize
2.2MB

MD5
5c9f063d91ec39d7798737fe41b49a24

SHA1
dd8565d615257b11ee5475ff97d6e31159f7ec7f

SHA256
d5d20bab5b571498224954bf5795b5d2fc734c988bd5747f050e5736af87eab2

SHA512
8cd18cbe63262b91e665971cfd10183b60e7a834710d028549b880fb7606ee94cb5970a74cf6f4a617cee79a0968daef908c53a2514fed022a47bb0f77740bbd

Download Submit
C:\Windows\System\jmllZYZ.exe

Filesize
2.2MB

MD5
31143888534398db8b95bc51fa63c00b

SHA1
1a34e583bc66b116b66b71535c92ba787abf767f

SHA256
e302b00c20d8b12b2a2418e63215b75a49c09c440690bc2960580a3814ee8bb5

SHA512
bfad53bfee35e00ed0d7dce12fb49cdb31a9afd2458208444381fc76578651620a809b6fb574dfefe8f036113c581b0f61558dc39827aaf53b2ae0f628fa7531

Download Submit
C:\Windows\System\nvIGsoR.exe

Filesize
2.2MB

MD5
77bd717087f193260af6b08814a77482

SHA1
e5e76cfde43cffff5d4a9ad578eba993ac59745f

SHA256
3b80950efda18ea48f2c0975a267e44f6ed4e1de31134b38c8d23b0ca6964dbb

SHA512
ea1078284d363fa574c84a33d1dfac80b86e5ca7090011df072c4609ae811577f93ca4336b486d7802ee7566379387b0f48af38e32a6362c57f51c155611b0f3

Download Submit
C:\Windows\System\pFaiCDM.exe

Filesize
2.2MB

MD5
17314521a51f5f2922ce5da04af530a1

SHA1
f68400ef56d727584295264cb236fa9ade661c00

SHA256
35956d59bd4cc00c001093455b441330151540dc02060f3abc91351b7213333c

SHA512
cb0464ca9a2c8af2920ee65095c597d5d2a5f1292e7aa4a4b7f1c506ec6b0de9b4b17ce6147315b4e426d2a16abd53379e39bf0ca81545b71888c47d80a730d4

Download Submit
C:\Windows\System\rXHmaVi.exe

Filesize
2.2MB

MD5
239517988448840d9a54fd22f0fd1703

SHA1
cdc584dafcf1234333873bb59238f51b7a19072c

SHA256
fc03a2a317046ff3b0050877930e87c41d2d3ff16342b04de76bf977db0f303a

SHA512
8a4db3fa0ca5ea0b554546be4d89c68f89e777bcbb8e1fbee9cf75a26c3f7f383afbf09f4e6030871087519b36ad73742926520652a4a9eca35e519afa382eb2

Download Submit
C:\Windows\System\tIrAjgP.exe

Filesize
2.2MB

MD5
c22ea2835bd7f4cc6f464c74e2a5b40b

SHA1
28320f43e97380e5b48788c09dc58c21024e21e2

SHA256
4b0b04e47498ac650134b95ee3aa9fa453f4da7b244ed8ae5cf41405f5145429

SHA512
c950e83ac515716111fbcbe7f4067c2cc722bfdb9e7c665909da918f984bb513e6b71ae8f2aac5bb0073de9176dde43ffcb0cd4b5cabdf09df533b79990a55c8

Download Submit
C:\Windows\System\uhkvJKu.exe

Filesize
2.2MB

MD5
2973eaf9dc2ac4a92851951a466661f0

SHA1
283f2307ab2b17e6e04df3fd450d26a3bd71c1e2

SHA256
9ffc842cf188ae42c66d1297b712083e4575a4887475bee5ba0ed665108502a4

SHA512
26d4f2983e682f4c02ad6dc5bc4977b2601c155d9af4fdbd67d7c1f8611f45b7066fb491c57d19362b5106bfa1b541a285d7fe8bce35ed1b86126ad1ce2f681d

Download Submit
C:\Windows\System\vBlGiIC.exe

Filesize
2.2MB

MD5
2a9063ae80552dedde10db47d8886303

SHA1
fc0edd21a5df7c5e6229435fd2d2d8a50c083895

SHA256
2f9f65e81752e2501fb1f7a973cdbe3ad844b3777369681e63fb08b17508b774

SHA512
ca03aa05b24306e849729c43247e7e5d36ec4298d9ccb7a06d48e947c8cc9774faac3b900bf9ed689956a8ab6a543570aa6cdbfa45ba06f1b0f06a74366a10be

Download Submit
C:\Windows\System\vctpOHL.exe

Filesize
2.2MB

MD5
37a11cfafe123a5347527c271a5441a7

SHA1
5b101f15af586e66caa280f9c0708269227a6f97

SHA256
5be64cd3c40817f66e7f45f9fca95f64a0e355beb6b930ed89b21a485f40c9d0

SHA512
ab54ac18afbccc3bae6c09fcdbba88ec85cb41977d68dd38e4b054fdfb43c668cbbf7c67421c840977ca9d73bfc5f422be84ddf97ddaecfd8d4df05d8ecb59c5

Download Submit
C:\Windows\System\xjHbJOl.exe

Filesize
2.2MB

MD5
68fdb9fe6b796d0e711b6ee3b01a725d

SHA1
2fc3075d482474ac6ca44077055a1752eba5245d

SHA256
c904bb1a77ee77b73292c0d158fe50144171dca57db2116a5f5cf5aa5702bf3b

SHA512
e9a8947c870bc6b7713c9d471b24013db4f7faaf4845ce67168ec69c79bc9b415dfec9260f12934a190443820857231b450e9f2ab7a096a8ba5ed8ddf5f380f0

Download Submit
C:\Windows\System\yjOGNcT.exe

Filesize
2.2MB

MD5
975059693e723571c20e83d8a1e9df5a

SHA1
a57c02cd42d3036279f3981943339b8562874eef

SHA256
9bbe57ded83a791abee912b6bf3e03b1681e38b20160a0bbe65dfb8fd7c1e387

SHA512
f1cce4a80e67e85c002978b23c639aff1caf4f9237544b549cb2ed166eba9c7d24a41d4096dbe9205f159ea20b2e4c2661f72b335d68f3da176fd48bbd9bd3d7

Download Submit
memory/216-413-0x00007FF67D910000-0x00007FF67DC64000-memory.dmp

Filesize
3.3MB

Download
memory/216-1993-0x00007FF67D910000-0x00007FF67DC64000-memory.dmp

Filesize
3.3MB

Download
memory/516-1929-0x00007FF6E2920000-0x00007FF6E2C74000-memory.dmp

Filesize
3.3MB

Download
memory/516-28-0x00007FF6E2920000-0x00007FF6E2C74000-memory.dmp

Filesize
3.3MB

Download
memory/556-514-0x00007FF7DF400000-0x00007FF7DF754000-memory.dmp

Filesize
3.3MB

Download
memory/556-2081-0x00007FF7DF400000-0x00007FF7DF754000-memory.dmp

Filesize
3.3MB

Download
memory/572-38-0x00007FF78D520000-0x00007FF78D874000-memory.dmp

Filesize
3.3MB

Download
memory/572-1924-0x00007FF78D520000-0x00007FF78D874000-memory.dmp

Filesize
3.3MB

Download
memory/1188-1973-0x00007FF7C27B0000-0x00007FF7C2B04000-memory.dmp

Filesize
3.3MB

Download
memory/1188-42-0x00007FF7C27B0000-0x00007FF7C2B04000-memory.dmp

Filesize
3.3MB

Download
memory/1612-408-0x00007FF754CA0000-0x00007FF754FF4000-memory.dmp

Filesize
3.3MB

Download
memory/1612-1997-0x00007FF754CA0000-0x00007FF754FF4000-memory.dmp

Filesize
3.3MB

Download
memory/1716-511-0x00007FF780B00000-0x00007FF780E54000-memory.dmp

Filesize
3.3MB

Download
memory/2084-2071-0x00007FF6F4950000-0x00007FF6F4CA4000-memory.dmp

Filesize
3.3MB

Download
memory/2084-433-0x00007FF6F4950000-0x00007FF6F4CA4000-memory.dmp

Filesize
3.3MB

Download
memory/2348-2087-0x00007FF7117A0000-0x00007FF711AF4000-memory.dmp

Filesize
3.3MB

Download
memory/2348-668-0x00007FF7117A0000-0x00007FF711AF4000-memory.dmp

Filesize
3.3MB

Download
memory/2384-23-0x00007FF656C30000-0x00007FF656F84000-memory.dmp

Filesize
3.3MB

Download
memory/2384-1927-0x00007FF656C30000-0x00007FF656F84000-memory.dmp

Filesize
3.3MB

Download
memory/2500-2082-0x00007FF77FA00000-0x00007FF77FD54000-memory.dmp

Filesize
3.3MB

Download
memory/2500-585-0x00007FF77FA00000-0x00007FF77FD54000-memory.dmp

Filesize
3.3MB

Download
memory/2992-45-0x00007FF609540000-0x00007FF609894000-memory.dmp

Filesize
3.3MB

Download
memory/2992-1995-0x00007FF609540000-0x00007FF609894000-memory.dmp

Filesize
3.3MB

Download
memory/3052-2084-0x00007FF6D21E0000-0x00007FF6D2534000-memory.dmp

Filesize
3.3MB

Download
memory/3052-627-0x00007FF6D21E0000-0x00007FF6D2534000-memory.dmp

Filesize
3.3MB

Download
memory/3136-2077-0x00007FF7E3FE0000-0x00007FF7E4334000-memory.dmp

Filesize
3.3MB

Download
memory/3136-468-0x00007FF7E3FE0000-0x00007FF7E4334000-memory.dmp

Filesize
3.3MB

Download
memory/3216-652-0x00007FF7F4590000-0x00007FF7F48E4000-memory.dmp

Filesize
3.3MB

Download
memory/3216-2086-0x00007FF7F4590000-0x00007FF7F48E4000-memory.dmp

Filesize
3.3MB

Download
memory/3444-1918-0x00007FF787610000-0x00007FF787964000-memory.dmp

Filesize
3.3MB

Download
memory/3444-17-0x00007FF787610000-0x00007FF787964000-memory.dmp

Filesize
3.3MB

Download
memory/3452-2038-0x00007FF7D8A60000-0x00007FF7D8DB4000-memory.dmp

Filesize
3.3MB

Download
memory/3452-457-0x00007FF7D8A60000-0x00007FF7D8DB4000-memory.dmp

Filesize
3.3MB

Download
memory/3620-2016-0x00007FF693CE0000-0x00007FF694034000-memory.dmp

Filesize
3.3MB

Download
memory/3620-427-0x00007FF693CE0000-0x00007FF694034000-memory.dmp

Filesize
3.3MB

Download
memory/3632-417-0x00007FF7B72C0000-0x00007FF7B7614000-memory.dmp

Filesize
3.3MB

Download
memory/3632-2007-0x00007FF7B72C0000-0x00007FF7B7614000-memory.dmp

Filesize
3.3MB

Download
memory/3640-1907-0x00007FF70D890000-0x00007FF70DBE4000-memory.dmp

Filesize
3.3MB

Download
memory/3640-1-0x000002580F090000-0x000002580F0A0000-memory.dmp

Filesize
64KB

Download
memory/3640-0-0x00007FF70D890000-0x00007FF70DBE4000-memory.dmp

Filesize
3.3MB

Download
memory/3684-556-0x00007FF71D2F0000-0x00007FF71D644000-memory.dmp

Filesize
3.3MB

Download
memory/3684-2079-0x00007FF71D2F0000-0x00007FF71D644000-memory.dmp

Filesize
3.3MB

Download
memory/3860-443-0x00007FF6AD0A0000-0x00007FF6AD3F4000-memory.dmp

Filesize
3.3MB

Download
memory/3860-2050-0x00007FF6AD0A0000-0x00007FF6AD3F4000-memory.dmp

Filesize
3.3MB

Download
memory/4176-535-0x00007FF734370000-0x00007FF7346C4000-memory.dmp

Filesize
3.3MB

Download
memory/4176-2063-0x00007FF734370000-0x00007FF7346C4000-memory.dmp

Filesize
3.3MB

Download
memory/4252-2083-0x00007FF770160000-0x00007FF7704B4000-memory.dmp

Filesize
3.3MB

Download
memory/4252-612-0x00007FF770160000-0x00007FF7704B4000-memory.dmp

Filesize
3.3MB

Download
memory/4460-46-0x00007FF71D7F0000-0x00007FF71DB44000-memory.dmp

Filesize
3.3MB

Download
memory/4460-1994-0x00007FF71D7F0000-0x00007FF71DB44000-memory.dmp

Filesize
3.3MB

Download
memory/4492-2029-0x00007FF738250000-0x00007FF7385A4000-memory.dmp

Filesize
3.3MB

Download
memory/4492-422-0x00007FF738250000-0x00007FF7385A4000-memory.dmp

Filesize
3.3MB

Download
memory/4632-2088-0x00007FF728520000-0x00007FF728874000-memory.dmp

Filesize
3.3MB

Download
memory/4632-488-0x00007FF728520000-0x00007FF728874000-memory.dmp

Filesize
3.3MB

Download
memory/4744-2085-0x00007FF701E20000-0x00007FF702174000-memory.dmp

Filesize
3.3MB

Download
memory/4744-649-0x00007FF701E20000-0x00007FF702174000-memory.dmp

Filesize
3.3MB

Download
memory/4944-583-0x00007FF7A13B0000-0x00007FF7A1704000-memory.dmp

Filesize
3.3MB

Download
memory/4944-2080-0x00007FF7A13B0000-0x00007FF7A1704000-memory.dmp

Filesize
3.3MB

Download
memory/5076-8-0x00007FF644440000-0x00007FF644794000-memory.dmp

Filesize
3.3MB

Download
memory/5076-1906-0x00007FF644440000-0x00007FF644794000-memory.dmp

Filesize
3.3MB

Download