xmrig | 8afa66c837b522d2a24a1a430dc93e0d9942d3a2078f7dc720f5cb78c31dd3ba

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
Size

1.7MB
MD5

0d196bc714505122a78528bf9151fe50
SHA1

4c71c74cff107efee0b3b8a9112119494ac04827
SHA256

8afa66c837b522d2a24a1a430dc93e0d9942d3a2078f7dc720f5cb78c31dd3ba
SHA512

710196f692e94cdfed3e1120a2820ca1716852e203be26642a843221eb0be89c2c2fcdbfa4c02d92276b1b0db9065860b1a0ec566dc5de34cef28c179cd5cca5
SSDEEP

49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAY:RWWBibat

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/2076-61-0x00007FF79A290000-0x00007FF79A5E1000-memory.dmp	xmrig
behavioral2/memory/2980-63-0x00007FF6373B0000-0x00007FF637701000-memory.dmp	xmrig
behavioral2/memory/2924-68-0x00007FF6D47F0000-0x00007FF6D4B41000-memory.dmp	xmrig
behavioral2/memory/4760-405-0x00007FF6A5750000-0x00007FF6A5AA1000-memory.dmp	xmrig
behavioral2/memory/4752-424-0x00007FF61B460000-0x00007FF61B7B1000-memory.dmp	xmrig
behavioral2/memory/2280-428-0x00007FF619810000-0x00007FF619B61000-memory.dmp	xmrig
behavioral2/memory/1456-433-0x00007FF7E6270000-0x00007FF7E65C1000-memory.dmp	xmrig
behavioral2/memory/1312-439-0x00007FF6E9B30000-0x00007FF6E9E81000-memory.dmp	xmrig
behavioral2/memory/1036-448-0x00007FF62D1E0000-0x00007FF62D531000-memory.dmp	xmrig
behavioral2/memory/4492-471-0x00007FF707B10000-0x00007FF707E61000-memory.dmp	xmrig
behavioral2/memory/3632-495-0x00007FF78FC00000-0x00007FF78FF51000-memory.dmp	xmrig
behavioral2/memory/4596-498-0x00007FF71D8F0000-0x00007FF71DC41000-memory.dmp	xmrig
behavioral2/memory/4036-504-0x00007FF671E30000-0x00007FF672181000-memory.dmp	xmrig
behavioral2/memory/3032-492-0x00007FF6A5790000-0x00007FF6A5AE1000-memory.dmp	xmrig
behavioral2/memory/4460-487-0x00007FF79C660000-0x00007FF79C9B1000-memory.dmp	xmrig
behavioral2/memory/3480-466-0x00007FF734BA0000-0x00007FF734EF1000-memory.dmp	xmrig
behavioral2/memory/3624-463-0x00007FF646200000-0x00007FF646551000-memory.dmp	xmrig
behavioral2/memory/1568-99-0x00007FF746D40000-0x00007FF747091000-memory.dmp	xmrig
behavioral2/memory/4896-96-0x00007FF7B7970000-0x00007FF7B7CC1000-memory.dmp	xmrig
behavioral2/memory/1972-91-0x00007FF664980000-0x00007FF664CD1000-memory.dmp	xmrig
behavioral2/memory/4760-1987-0x00007FF6A5750000-0x00007FF6A5AA1000-memory.dmp	xmrig
behavioral2/memory/4896-1968-0x00007FF7B7970000-0x00007FF7B7CC1000-memory.dmp	xmrig
behavioral2/memory/4352-2082-0x00007FF7A22F0000-0x00007FF7A2641000-memory.dmp	xmrig
behavioral2/memory/1572-2097-0x00007FF656E10000-0x00007FF657161000-memory.dmp	xmrig
behavioral2/memory/2076-2096-0x00007FF79A290000-0x00007FF79A5E1000-memory.dmp	xmrig
behavioral2/memory/2980-2095-0x00007FF6373B0000-0x00007FF637701000-memory.dmp	xmrig
behavioral2/memory/848-2094-0x00007FF70A950000-0x00007FF70ACA1000-memory.dmp	xmrig
behavioral2/memory/1040-2116-0x00007FF664220000-0x00007FF664571000-memory.dmp	xmrig
behavioral2/memory/1568-2115-0x00007FF746D40000-0x00007FF747091000-memory.dmp	xmrig
behavioral2/memory/2628-2114-0x00007FF7A4710000-0x00007FF7A4A61000-memory.dmp	xmrig
behavioral2/memory/2924-2113-0x00007FF6D47F0000-0x00007FF6D4B41000-memory.dmp	xmrig
behavioral2/memory/4848-2112-0x00007FF6128A0000-0x00007FF612BF1000-memory.dmp	xmrig
behavioral2/memory/3996-2119-0x00007FF704970000-0x00007FF704CC1000-memory.dmp	xmrig
behavioral2/memory/2280-2124-0x00007FF619810000-0x00007FF619B61000-memory.dmp	xmrig
behavioral2/memory/3632-2152-0x00007FF78FC00000-0x00007FF78FF51000-memory.dmp	xmrig
behavioral2/memory/3032-2165-0x00007FF6A5790000-0x00007FF6A5AE1000-memory.dmp	xmrig
behavioral2/memory/1312-2157-0x00007FF6E9B30000-0x00007FF6E9E81000-memory.dmp	xmrig
behavioral2/memory/4036-2154-0x00007FF671E30000-0x00007FF672181000-memory.dmp	xmrig
behavioral2/memory/4492-2149-0x00007FF707B10000-0x00007FF707E61000-memory.dmp	xmrig
behavioral2/memory/3624-2144-0x00007FF646200000-0x00007FF646551000-memory.dmp	xmrig
behavioral2/memory/1036-2135-0x00007FF62D1E0000-0x00007FF62D531000-memory.dmp	xmrig
behavioral2/memory/4596-2151-0x00007FF71D8F0000-0x00007FF71DC41000-memory.dmp	xmrig
behavioral2/memory/4460-2147-0x00007FF79C660000-0x00007FF79C9B1000-memory.dmp	xmrig
behavioral2/memory/3480-2143-0x00007FF734BA0000-0x00007FF734EF1000-memory.dmp	xmrig
behavioral2/memory/4752-2131-0x00007FF61B460000-0x00007FF61B7B1000-memory.dmp	xmrig
behavioral2/memory/1456-2125-0x00007FF7E6270000-0x00007FF7E65C1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4896	ARiEECn.exe
4760	gyZpAQw.exe
3468	qFopyxT.exe
4352	sdTZCRI.exe
2240	IhrcpzQ.exe
1572	NkILQfO.exe
848	btIwXDa.exe
2076	tbKqdbP.exe
2980	uOwEpFL.exe
2924	UQlNUNp.exe
2628	zgxUmnr.exe
4848	CkrPptZ.exe
3996	mMUDyYC.exe
532	wQpwRct.exe
1040	PArJuSf.exe
1568	wXxhOWw.exe
4752	oPMOlpL.exe
2280	mhqRDrV.exe
1456	KSqAjJh.exe
1312	mCfUsGn.exe
1036	fSdPIyG.exe
3624	xxlvmlN.exe
3480	GnXIbbW.exe
4492	FsmmVJu.exe
4460	yElcxil.exe
3032	uknNprj.exe
3632	liIDYRE.exe
4596	IiACJrl.exe
4036	IpkFcKs.exe
3952	pYoQkbI.exe
4040	VvfTHCT.exe
4872	nUOBAde.exe
4304	WLXaKPB.exe
3300	yGoaNjh.exe
2612	CFNtZLx.exe
3876	NHDgloZ.exe
5068	jocyafj.exe
2756	xKKtfVs.exe
1152	WCdWPrt.exe
3044	kmriATl.exe
2148	NBbKSfB.exe
1680	kRspIpK.exe
1720	pBxXbIU.exe
4340	pYQkLxB.exe
2132	PJDVpHr.exe
4768	FgUrqPm.exe
3792	ZcwArFs.exe
4576	ApGVFRz.exe
4056	EuProWM.exe
4952	mQPfGbR.exe
2360	oifIHSH.exe
1724	nFuflho.exe
4468	fWgaGYt.exe
624	nTVZniK.exe
4476	knjENlU.exe
4472	qOZaAiA.exe
4668	uoglmfE.exe
3968	vAfZcQn.exe
2572	XfKOJIE.exe
1816	sYAvkPS.exe
3732	WxyPHjh.exe
5144	tohVrMF.exe
5176	uvOJhDH.exe
5204	ATVDvPs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1972-0-0x00007FF664980000-0x00007FF664CD1000-memory.dmp	upx
behavioral2/files/0x000800000002326a-5.dat	upx
behavioral2/memory/4896-7-0x00007FF7B7970000-0x00007FF7B7CC1000-memory.dmp	upx
behavioral2/files/0x0008000000023270-9.dat	upx
behavioral2/files/0x000800000002326d-12.dat	upx
behavioral2/memory/4760-15-0x00007FF6A5750000-0x00007FF6A5AA1000-memory.dmp	upx
behavioral2/files/0x0008000000023272-19.dat	upx
behavioral2/files/0x0007000000023273-21.dat	upx
behavioral2/files/0x0007000000023274-25.dat	upx
behavioral2/memory/4352-27-0x00007FF7A22F0000-0x00007FF7A2641000-memory.dmp	upx
behavioral2/memory/2240-28-0x00007FF675BE0000-0x00007FF675F31000-memory.dmp	upx
behavioral2/memory/1572-30-0x00007FF656E10000-0x00007FF657161000-memory.dmp	upx
behavioral2/memory/3468-26-0x00007FF7E67D0000-0x00007FF7E6B21000-memory.dmp	upx
behavioral2/files/0x0007000000023275-41.dat	upx
behavioral2/memory/848-42-0x00007FF70A950000-0x00007FF70ACA1000-memory.dmp	upx
behavioral2/files/0x0007000000023277-59.dat	upx
behavioral2/memory/2076-61-0x00007FF79A290000-0x00007FF79A5E1000-memory.dmp	upx
behavioral2/memory/2980-63-0x00007FF6373B0000-0x00007FF637701000-memory.dmp	upx
behavioral2/memory/2924-68-0x00007FF6D47F0000-0x00007FF6D4B41000-memory.dmp	upx
behavioral2/memory/2628-71-0x00007FF7A4710000-0x00007FF7A4A61000-memory.dmp	upx
behavioral2/memory/4848-72-0x00007FF6128A0000-0x00007FF612BF1000-memory.dmp	upx
behavioral2/files/0x000700000002327b-79.dat	upx
behavioral2/files/0x000700000002327a-81.dat	upx
behavioral2/files/0x000700000002327c-88.dat	upx
behavioral2/files/0x000700000002327d-94.dat	upx
behavioral2/files/0x000700000002327f-108.dat	upx
behavioral2/files/0x0007000000023280-115.dat	upx
behavioral2/files/0x0007000000023284-136.dat	upx
behavioral2/files/0x0007000000023286-146.dat	upx
behavioral2/memory/4760-405-0x00007FF6A5750000-0x00007FF6A5AA1000-memory.dmp	upx
behavioral2/memory/4752-424-0x00007FF61B460000-0x00007FF61B7B1000-memory.dmp	upx
behavioral2/memory/2280-428-0x00007FF619810000-0x00007FF619B61000-memory.dmp	upx
behavioral2/memory/1456-433-0x00007FF7E6270000-0x00007FF7E65C1000-memory.dmp	upx
behavioral2/files/0x000700000002328e-179.dat	upx
behavioral2/memory/1312-439-0x00007FF6E9B30000-0x00007FF6E9E81000-memory.dmp	upx
behavioral2/files/0x000700000002328c-178.dat	upx
behavioral2/files/0x000700000002328d-175.dat	upx
behavioral2/files/0x000700000002328b-173.dat	upx
behavioral2/files/0x000700000002328a-166.dat	upx
behavioral2/files/0x0007000000023289-161.dat	upx
behavioral2/files/0x0007000000023288-156.dat	upx
behavioral2/files/0x0007000000023287-150.dat	upx
behavioral2/files/0x0007000000023285-141.dat	upx
behavioral2/memory/1036-448-0x00007FF62D1E0000-0x00007FF62D531000-memory.dmp	upx
behavioral2/memory/4492-471-0x00007FF707B10000-0x00007FF707E61000-memory.dmp	upx
behavioral2/memory/3632-495-0x00007FF78FC00000-0x00007FF78FF51000-memory.dmp	upx
behavioral2/memory/4596-498-0x00007FF71D8F0000-0x00007FF71DC41000-memory.dmp	upx
behavioral2/memory/4036-504-0x00007FF671E30000-0x00007FF672181000-memory.dmp	upx
behavioral2/memory/3032-492-0x00007FF6A5790000-0x00007FF6A5AE1000-memory.dmp	upx
behavioral2/memory/4460-487-0x00007FF79C660000-0x00007FF79C9B1000-memory.dmp	upx
behavioral2/memory/3480-466-0x00007FF734BA0000-0x00007FF734EF1000-memory.dmp	upx
behavioral2/memory/3624-463-0x00007FF646200000-0x00007FF646551000-memory.dmp	upx
behavioral2/files/0x0007000000023283-131.dat	upx
behavioral2/files/0x0007000000023282-125.dat	upx
behavioral2/files/0x0007000000023281-121.dat	upx
behavioral2/files/0x000700000002327e-106.dat	upx
behavioral2/memory/1568-99-0x00007FF746D40000-0x00007FF747091000-memory.dmp	upx
behavioral2/memory/4896-96-0x00007FF7B7970000-0x00007FF7B7CC1000-memory.dmp	upx
behavioral2/memory/1040-93-0x00007FF664220000-0x00007FF664571000-memory.dmp	upx
behavioral2/memory/1972-91-0x00007FF664980000-0x00007FF664CD1000-memory.dmp	upx
behavioral2/memory/532-85-0x00007FF77AC00000-0x00007FF77AF51000-memory.dmp	upx
behavioral2/memory/3996-80-0x00007FF704970000-0x00007FF704CC1000-memory.dmp	upx
behavioral2/files/0x0007000000023279-75.dat	upx
behavioral2/files/0x0007000000023278-64.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SCaNGgF.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\uJzanJL.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\WTUnmtY.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\MRLmEdH.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\ZnHHUBm.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\BlQuuUe.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\RnUjeaF.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\Fescmud.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\fSdPIyG.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\gudXXKy.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\UGpSEza.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\BdIlvFr.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\LtGAOMh.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\ulVyUjw.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\fPTUMfb.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\FqyjelU.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\xKKtfVs.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\RAcrduW.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\BVcWxdd.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\cQGhsfs.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\UlgqmYJ.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\lsodWyl.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\NJGhfDk.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\CHetDSy.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\EsfkJPq.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\PFwmkWA.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\oAnEWqW.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\bqegQxg.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\QouTzex.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\fSgLJSp.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\sEQGfvN.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\lnzfdCJ.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\KEiqBTM.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\WaZdGAo.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\pMAodmX.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\WSHpCzR.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\LtkWVJQ.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\DDNcLdJ.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\XEHQBqr.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\sGemlKo.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\KptmCgN.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\pubqwVx.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\flLSsBw.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\NJbyUsw.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\UHiSzoa.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\ldlWsQA.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\pXLiVXz.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\BVwECHd.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\RNKINZg.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\WNSwmPZ.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\UnaSLkd.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\EhzfOwt.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\DxGoqQh.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\SjykUsj.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\DSNSdld.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\VvrJhjg.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\WpLsiZr.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\quUVFzm.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\SKnqcLe.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\olciyjS.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\Xuqeofg.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\feMsbiL.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\CBqybDN.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
File created	C:\Windows\System\ncPefKz.exe	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 4896	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	92
PID 1972 wrote to memory of 4896	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	92
PID 1972 wrote to memory of 4760	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	93
PID 1972 wrote to memory of 4760	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	93
PID 1972 wrote to memory of 3468	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	94
PID 1972 wrote to memory of 3468	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	94
PID 1972 wrote to memory of 4352	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	95
PID 1972 wrote to memory of 4352	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	95
PID 1972 wrote to memory of 2240	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	96
PID 1972 wrote to memory of 2240	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	96
PID 1972 wrote to memory of 1572	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	97
PID 1972 wrote to memory of 1572	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	97
PID 1972 wrote to memory of 848	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	98
PID 1972 wrote to memory of 848	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	98
PID 1972 wrote to memory of 2076	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	99
PID 1972 wrote to memory of 2076	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	99
PID 1972 wrote to memory of 2980	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	100
PID 1972 wrote to memory of 2980	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	100
PID 1972 wrote to memory of 2924	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	101
PID 1972 wrote to memory of 2924	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	101
PID 1972 wrote to memory of 2628	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	102
PID 1972 wrote to memory of 2628	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	102
PID 1972 wrote to memory of 4848	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	103
PID 1972 wrote to memory of 4848	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	103
PID 1972 wrote to memory of 3996	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	104
PID 1972 wrote to memory of 3996	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	104
PID 1972 wrote to memory of 532	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	105
PID 1972 wrote to memory of 532	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	105
PID 1972 wrote to memory of 1040	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	106
PID 1972 wrote to memory of 1040	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	106
PID 1972 wrote to memory of 1568	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	107
PID 1972 wrote to memory of 1568	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	107
PID 1972 wrote to memory of 4752	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	108
PID 1972 wrote to memory of 4752	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	108
PID 1972 wrote to memory of 2280	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	109
PID 1972 wrote to memory of 2280	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	109
PID 1972 wrote to memory of 1456	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	110
PID 1972 wrote to memory of 1456	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	110
PID 1972 wrote to memory of 1312	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	111
PID 1972 wrote to memory of 1312	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	111
PID 1972 wrote to memory of 1036	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	112
PID 1972 wrote to memory of 1036	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	112
PID 1972 wrote to memory of 3624	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	113
PID 1972 wrote to memory of 3624	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	113
PID 1972 wrote to memory of 3480	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	114
PID 1972 wrote to memory of 3480	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	114
PID 1972 wrote to memory of 4492	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	115
PID 1972 wrote to memory of 4492	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	115
PID 1972 wrote to memory of 4460	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	116
PID 1972 wrote to memory of 4460	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	116
PID 1972 wrote to memory of 3032	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	117
PID 1972 wrote to memory of 3032	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	117
PID 1972 wrote to memory of 3632	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	118
PID 1972 wrote to memory of 3632	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	118
PID 1972 wrote to memory of 4596	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	119
PID 1972 wrote to memory of 4596	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	119
PID 1972 wrote to memory of 4036	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	120
PID 1972 wrote to memory of 4036	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	120
PID 1972 wrote to memory of 3952	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	121
PID 1972 wrote to memory of 3952	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	121
PID 1972 wrote to memory of 4040	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	122
PID 1972 wrote to memory of 4040	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	122
PID 1972 wrote to memory of 4872	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	123
PID 1972 wrote to memory of 4872	1972	0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d196bc714505122a78528bf9151fe50_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System\ARiEECn.exe
  C:\Windows\System\ARiEECn.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\gyZpAQw.exe
  C:\Windows\System\gyZpAQw.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\qFopyxT.exe
  C:\Windows\System\qFopyxT.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\sdTZCRI.exe
  C:\Windows\System\sdTZCRI.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\IhrcpzQ.exe
  C:\Windows\System\IhrcpzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\NkILQfO.exe
  C:\Windows\System\NkILQfO.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\btIwXDa.exe
  C:\Windows\System\btIwXDa.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\tbKqdbP.exe
  C:\Windows\System\tbKqdbP.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\uOwEpFL.exe
  C:\Windows\System\uOwEpFL.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\UQlNUNp.exe
  C:\Windows\System\UQlNUNp.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\zgxUmnr.exe
  C:\Windows\System\zgxUmnr.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\CkrPptZ.exe
  C:\Windows\System\CkrPptZ.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\mMUDyYC.exe
  C:\Windows\System\mMUDyYC.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\wQpwRct.exe
  C:\Windows\System\wQpwRct.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\PArJuSf.exe
  C:\Windows\System\PArJuSf.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\wXxhOWw.exe
  C:\Windows\System\wXxhOWw.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\oPMOlpL.exe
  C:\Windows\System\oPMOlpL.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\mhqRDrV.exe
  C:\Windows\System\mhqRDrV.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\KSqAjJh.exe
  C:\Windows\System\KSqAjJh.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\mCfUsGn.exe
  C:\Windows\System\mCfUsGn.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\fSdPIyG.exe
  C:\Windows\System\fSdPIyG.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\xxlvmlN.exe
  C:\Windows\System\xxlvmlN.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\GnXIbbW.exe
  C:\Windows\System\GnXIbbW.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\FsmmVJu.exe
  C:\Windows\System\FsmmVJu.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\yElcxil.exe
  C:\Windows\System\yElcxil.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\uknNprj.exe
  C:\Windows\System\uknNprj.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\liIDYRE.exe
  C:\Windows\System\liIDYRE.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\IiACJrl.exe
  C:\Windows\System\IiACJrl.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\IpkFcKs.exe
  C:\Windows\System\IpkFcKs.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\pYoQkbI.exe
  C:\Windows\System\pYoQkbI.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\VvfTHCT.exe
  C:\Windows\System\VvfTHCT.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\nUOBAde.exe
  C:\Windows\System\nUOBAde.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\WLXaKPB.exe
  C:\Windows\System\WLXaKPB.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\yGoaNjh.exe
  C:\Windows\System\yGoaNjh.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\CFNtZLx.exe
  C:\Windows\System\CFNtZLx.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\NHDgloZ.exe
  C:\Windows\System\NHDgloZ.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\jocyafj.exe
  C:\Windows\System\jocyafj.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\xKKtfVs.exe
  C:\Windows\System\xKKtfVs.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\WCdWPrt.exe
  C:\Windows\System\WCdWPrt.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\kmriATl.exe
  C:\Windows\System\kmriATl.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\NBbKSfB.exe
  C:\Windows\System\NBbKSfB.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\kRspIpK.exe
  C:\Windows\System\kRspIpK.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\pBxXbIU.exe
  C:\Windows\System\pBxXbIU.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\pYQkLxB.exe
  C:\Windows\System\pYQkLxB.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\PJDVpHr.exe
  C:\Windows\System\PJDVpHr.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\FgUrqPm.exe
  C:\Windows\System\FgUrqPm.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\ZcwArFs.exe
  C:\Windows\System\ZcwArFs.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\ApGVFRz.exe
  C:\Windows\System\ApGVFRz.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\EuProWM.exe
  C:\Windows\System\EuProWM.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\mQPfGbR.exe
  C:\Windows\System\mQPfGbR.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\oifIHSH.exe
  C:\Windows\System\oifIHSH.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\nFuflho.exe
  C:\Windows\System\nFuflho.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\fWgaGYt.exe
  C:\Windows\System\fWgaGYt.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\nTVZniK.exe
  C:\Windows\System\nTVZniK.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\knjENlU.exe
  C:\Windows\System\knjENlU.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\qOZaAiA.exe
  C:\Windows\System\qOZaAiA.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\uoglmfE.exe
  C:\Windows\System\uoglmfE.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\vAfZcQn.exe
  C:\Windows\System\vAfZcQn.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\XfKOJIE.exe
  C:\Windows\System\XfKOJIE.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\sYAvkPS.exe
  C:\Windows\System\sYAvkPS.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\WxyPHjh.exe
  C:\Windows\System\WxyPHjh.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\tohVrMF.exe
  C:\Windows\System\tohVrMF.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\uvOJhDH.exe
  C:\Windows\System\uvOJhDH.exe
  2⤵
  - Executes dropped EXE
  PID:5176
- C:\Windows\System\ATVDvPs.exe
  C:\Windows\System\ATVDvPs.exe
  2⤵
  - Executes dropped EXE
  PID:5204
- C:\Windows\System\hrYgoUK.exe
  C:\Windows\System\hrYgoUK.exe
  2⤵
  PID:5236
- C:\Windows\System\UuUohRy.exe
  C:\Windows\System\UuUohRy.exe
  2⤵
  PID:5260
- C:\Windows\System\FoQWCdI.exe
  C:\Windows\System\FoQWCdI.exe
  2⤵
  PID:5324
- C:\Windows\System\oHDKBSt.exe
  C:\Windows\System\oHDKBSt.exe
  2⤵
  PID:5348
- C:\Windows\System\RJqAdGu.exe
  C:\Windows\System\RJqAdGu.exe
  2⤵
  PID:5368
- C:\Windows\System\nCgfmip.exe
  C:\Windows\System\nCgfmip.exe
  2⤵
  PID:5384
- C:\Windows\System\CxCTfyd.exe
  C:\Windows\System\CxCTfyd.exe
  2⤵
  PID:5400
- C:\Windows\System\VOpRoxW.exe
  C:\Windows\System\VOpRoxW.exe
  2⤵
  PID:5428
- C:\Windows\System\TfroAsz.exe
  C:\Windows\System\TfroAsz.exe
  2⤵
  PID:5456
- C:\Windows\System\WlWjfZF.exe
  C:\Windows\System\WlWjfZF.exe
  2⤵
  PID:5492
- C:\Windows\System\rlCdWUa.exe
  C:\Windows\System\rlCdWUa.exe
  2⤵
  PID:5524
- C:\Windows\System\YCzBRAb.exe
  C:\Windows\System\YCzBRAb.exe
  2⤵
  PID:5540
- C:\Windows\System\sBUjaCV.exe
  C:\Windows\System\sBUjaCV.exe
  2⤵
  PID:5600
- C:\Windows\System\tUBDRKs.exe
  C:\Windows\System\tUBDRKs.exe
  2⤵
  PID:5620
- C:\Windows\System\qUgxaAW.exe
  C:\Windows\System\qUgxaAW.exe
  2⤵
  PID:5636
- C:\Windows\System\RKrvQCr.exe
  C:\Windows\System\RKrvQCr.exe
  2⤵
  PID:5668
- C:\Windows\System\QFMzWPO.exe
  C:\Windows\System\QFMzWPO.exe
  2⤵
  PID:5692
- C:\Windows\System\cNpeJot.exe
  C:\Windows\System\cNpeJot.exe
  2⤵
  PID:5716
- C:\Windows\System\IvoXMYR.exe
  C:\Windows\System\IvoXMYR.exe
  2⤵
  PID:5748
- C:\Windows\System\nCKYmVd.exe
  C:\Windows\System\nCKYmVd.exe
  2⤵
  PID:5776
- C:\Windows\System\QGfPrsB.exe
  C:\Windows\System\QGfPrsB.exe
  2⤵
  PID:5804
- C:\Windows\System\yzOdZBj.exe
  C:\Windows\System\yzOdZBj.exe
  2⤵
  PID:5832
- C:\Windows\System\VLwhhLa.exe
  C:\Windows\System\VLwhhLa.exe
  2⤵
  PID:5856
- C:\Windows\System\rHfSHHH.exe
  C:\Windows\System\rHfSHHH.exe
  2⤵
  PID:5912
- C:\Windows\System\eJlpmaW.exe
  C:\Windows\System\eJlpmaW.exe
  2⤵
  PID:5928
- C:\Windows\System\HGxiVIr.exe
  C:\Windows\System\HGxiVIr.exe
  2⤵
  PID:5944
- C:\Windows\System\gYXSKwZ.exe
  C:\Windows\System\gYXSKwZ.exe
  2⤵
  PID:5960
- C:\Windows\System\ulVyUjw.exe
  C:\Windows\System\ulVyUjw.exe
  2⤵
  PID:5984
- C:\Windows\System\jrTbgRp.exe
  C:\Windows\System\jrTbgRp.exe
  2⤵
  PID:6012
- C:\Windows\System\lBBJOrM.exe
  C:\Windows\System\lBBJOrM.exe
  2⤵
  PID:6040
- C:\Windows\System\QKFkswq.exe
  C:\Windows\System\QKFkswq.exe
  2⤵
  PID:6068
- C:\Windows\System\IbJwkcq.exe
  C:\Windows\System\IbJwkcq.exe
  2⤵
  PID:6092
- C:\Windows\System\juhazfJ.exe
  C:\Windows\System\juhazfJ.exe
  2⤵
  PID:6124
- C:\Windows\System\nNszoyZ.exe
  C:\Windows\System\nNszoyZ.exe
  2⤵
  PID:3580
- C:\Windows\System\pCGTGWf.exe
  C:\Windows\System\pCGTGWf.exe
  2⤵
  PID:5132
- C:\Windows\System\EDXdQPY.exe
  C:\Windows\System\EDXdQPY.exe
  2⤵
  PID:5276
- C:\Windows\System\Gtupqnt.exe
  C:\Windows\System\Gtupqnt.exe
  2⤵
  PID:5308
- C:\Windows\System\fluZGig.exe
  C:\Windows\System\fluZGig.exe
  2⤵
  PID:5332
- C:\Windows\System\KRSfKeD.exe
  C:\Windows\System\KRSfKeD.exe
  2⤵
  PID:5360
- C:\Windows\System\tILmksG.exe
  C:\Windows\System\tILmksG.exe
  2⤵
  PID:5416
- C:\Windows\System\zNwDzuF.exe
  C:\Windows\System\zNwDzuF.exe
  2⤵
  PID:5468
- C:\Windows\System\uKEfbez.exe
  C:\Windows\System\uKEfbez.exe
  2⤵
  PID:5508
- C:\Windows\System\EnWLPyL.exe
  C:\Windows\System\EnWLPyL.exe
  2⤵
  PID:5560
- C:\Windows\System\tSikTZb.exe
  C:\Windows\System\tSikTZb.exe
  2⤵
  PID:1640
- C:\Windows\System\RFjavAk.exe
  C:\Windows\System\RFjavAk.exe
  2⤵
  PID:1556
- C:\Windows\System\vnSPwOR.exe
  C:\Windows\System\vnSPwOR.exe
  2⤵
  PID:5760
- C:\Windows\System\sNtgwts.exe
  C:\Windows\System\sNtgwts.exe
  2⤵
  PID:5788
- C:\Windows\System\nILSirW.exe
  C:\Windows\System\nILSirW.exe
  2⤵
  PID:2140
- C:\Windows\System\UBugniM.exe
  C:\Windows\System\UBugniM.exe
  2⤵
  PID:5924
- C:\Windows\System\szXYRjb.exe
  C:\Windows\System\szXYRjb.exe
  2⤵
  PID:6000
- C:\Windows\System\HxONOIG.exe
  C:\Windows\System\HxONOIG.exe
  2⤵
  PID:6028
- C:\Windows\System\PHdDoeo.exe
  C:\Windows\System\PHdDoeo.exe
  2⤵
  PID:6064
- C:\Windows\System\iSWmIrQ.exe
  C:\Windows\System\iSWmIrQ.exe
  2⤵
  PID:6088
- C:\Windows\System\UnaSLkd.exe
  C:\Windows\System\UnaSLkd.exe
  2⤵
  PID:4560
- C:\Windows\System\ICmDCyT.exe
  C:\Windows\System\ICmDCyT.exe
  2⤵
  PID:2788
- C:\Windows\System\ZAcPUjX.exe
  C:\Windows\System\ZAcPUjX.exe
  2⤵
  PID:1976
- C:\Windows\System\rIiAWTM.exe
  C:\Windows\System\rIiAWTM.exe
  2⤵
  PID:3180
- C:\Windows\System\LPkVATm.exe
  C:\Windows\System\LPkVATm.exe
  2⤵
  PID:5256
- C:\Windows\System\lRDcGIl.exe
  C:\Windows\System\lRDcGIl.exe
  2⤵
  PID:5596
- C:\Windows\System\PmwVlLc.exe
  C:\Windows\System\PmwVlLc.exe
  2⤵
  PID:5684
- C:\Windows\System\SdidFcR.exe
  C:\Windows\System\SdidFcR.exe
  2⤵
  PID:4480
- C:\Windows\System\ivpbbkk.exe
  C:\Windows\System\ivpbbkk.exe
  2⤵
  PID:6104
- C:\Windows\System\DoAWbfz.exe
  C:\Windows\System\DoAWbfz.exe
  2⤵
  PID:1424
- C:\Windows\System\DCcUTgQ.exe
  C:\Windows\System\DCcUTgQ.exe
  2⤵
  PID:4216
- C:\Windows\System\uEGESWP.exe
  C:\Windows\System\uEGESWP.exe
  2⤵
  PID:5220
- C:\Windows\System\SCaNGgF.exe
  C:\Windows\System\SCaNGgF.exe
  2⤵
  PID:5216
- C:\Windows\System\ZjvQMrA.exe
  C:\Windows\System\ZjvQMrA.exe
  2⤵
  PID:5552
- C:\Windows\System\eoncFIZ.exe
  C:\Windows\System\eoncFIZ.exe
  2⤵
  PID:2848
- C:\Windows\System\jywKdys.exe
  C:\Windows\System\jywKdys.exe
  2⤵
  PID:4908
- C:\Windows\System\kTdPyqZ.exe
  C:\Windows\System\kTdPyqZ.exe
  2⤵
  PID:6056
- C:\Windows\System\PvNxwNn.exe
  C:\Windows\System\PvNxwNn.exe
  2⤵
  PID:4344
- C:\Windows\System\DSNSdld.exe
  C:\Windows\System\DSNSdld.exe
  2⤵
  PID:748
- C:\Windows\System\juBzjfy.exe
  C:\Windows\System\juBzjfy.exe
  2⤵
  PID:5292
- C:\Windows\System\eDloaze.exe
  C:\Windows\System\eDloaze.exe
  2⤵
  PID:3452
- C:\Windows\System\VaCImPQ.exe
  C:\Windows\System\VaCImPQ.exe
  2⤵
  PID:1484
- C:\Windows\System\GznDzEU.exe
  C:\Windows\System\GznDzEU.exe
  2⤵
  PID:5920
- C:\Windows\System\LgldqSB.exe
  C:\Windows\System\LgldqSB.exe
  2⤵
  PID:5972
- C:\Windows\System\Jygtxuh.exe
  C:\Windows\System\Jygtxuh.exe
  2⤵
  PID:5892
- C:\Windows\System\RPJNATv.exe
  C:\Windows\System\RPJNATv.exe
  2⤵
  PID:640
- C:\Windows\System\HmOmxMD.exe
  C:\Windows\System\HmOmxMD.exe
  2⤵
  PID:2004
- C:\Windows\System\ECzLBOC.exe
  C:\Windows\System\ECzLBOC.exe
  2⤵
  PID:6180
- C:\Windows\System\TGKAdsB.exe
  C:\Windows\System\TGKAdsB.exe
  2⤵
  PID:6200
- C:\Windows\System\DYdhsGV.exe
  C:\Windows\System\DYdhsGV.exe
  2⤵
  PID:6236
- C:\Windows\System\OtWYlhy.exe
  C:\Windows\System\OtWYlhy.exe
  2⤵
  PID:6292
- C:\Windows\System\OWrRZkI.exe
  C:\Windows\System\OWrRZkI.exe
  2⤵
  PID:6312
- C:\Windows\System\eDQqSsz.exe
  C:\Windows\System\eDQqSsz.exe
  2⤵
  PID:6352
- C:\Windows\System\qydeAYI.exe
  C:\Windows\System\qydeAYI.exe
  2⤵
  PID:6372
- C:\Windows\System\WnPwxIw.exe
  C:\Windows\System\WnPwxIw.exe
  2⤵
  PID:6392
- C:\Windows\System\yJiiEGJ.exe
  C:\Windows\System\yJiiEGJ.exe
  2⤵
  PID:6416
- C:\Windows\System\JBERkwS.exe
  C:\Windows\System\JBERkwS.exe
  2⤵
  PID:6436
- C:\Windows\System\ffTkyhn.exe
  C:\Windows\System\ffTkyhn.exe
  2⤵
  PID:6460
- C:\Windows\System\LzLigAQ.exe
  C:\Windows\System\LzLigAQ.exe
  2⤵
  PID:6484
- C:\Windows\System\fltunCj.exe
  C:\Windows\System\fltunCj.exe
  2⤵
  PID:6520
- C:\Windows\System\tUDNtUy.exe
  C:\Windows\System\tUDNtUy.exe
  2⤵
  PID:6540
- C:\Windows\System\VEHlPum.exe
  C:\Windows\System\VEHlPum.exe
  2⤵
  PID:6556
- C:\Windows\System\yGPIQjn.exe
  C:\Windows\System\yGPIQjn.exe
  2⤵
  PID:6584
- C:\Windows\System\TMEKBIP.exe
  C:\Windows\System\TMEKBIP.exe
  2⤵
  PID:6600
- C:\Windows\System\VMLozxF.exe
  C:\Windows\System\VMLozxF.exe
  2⤵
  PID:6652
- C:\Windows\System\dXOtCYp.exe
  C:\Windows\System\dXOtCYp.exe
  2⤵
  PID:6672
- C:\Windows\System\OJLGhbA.exe
  C:\Windows\System\OJLGhbA.exe
  2⤵
  PID:6704
- C:\Windows\System\WiTudBL.exe
  C:\Windows\System\WiTudBL.exe
  2⤵
  PID:6728
- C:\Windows\System\UgXBWQZ.exe
  C:\Windows\System\UgXBWQZ.exe
  2⤵
  PID:6772
- C:\Windows\System\NCvrViA.exe
  C:\Windows\System\NCvrViA.exe
  2⤵
  PID:6816
- C:\Windows\System\EewHgbn.exe
  C:\Windows\System\EewHgbn.exe
  2⤵
  PID:6848
- C:\Windows\System\ZDEcVJm.exe
  C:\Windows\System\ZDEcVJm.exe
  2⤵
  PID:6868
- C:\Windows\System\gUGyppM.exe
  C:\Windows\System\gUGyppM.exe
  2⤵
  PID:6888
- C:\Windows\System\IMRdqjJ.exe
  C:\Windows\System\IMRdqjJ.exe
  2⤵
  PID:6924
- C:\Windows\System\UmgMfBa.exe
  C:\Windows\System\UmgMfBa.exe
  2⤵
  PID:6948
- C:\Windows\System\wuykzYa.exe
  C:\Windows\System\wuykzYa.exe
  2⤵
  PID:6968
- C:\Windows\System\FhwsgOR.exe
  C:\Windows\System\FhwsgOR.exe
  2⤵
  PID:6988
- C:\Windows\System\aFKAGBq.exe
  C:\Windows\System\aFKAGBq.exe
  2⤵
  PID:7012
- C:\Windows\System\PFhwzzJ.exe
  C:\Windows\System\PFhwzzJ.exe
  2⤵
  PID:7036
- C:\Windows\System\vTqBOfJ.exe
  C:\Windows\System\vTqBOfJ.exe
  2⤵
  PID:7056
- C:\Windows\System\gudXXKy.exe
  C:\Windows\System\gudXXKy.exe
  2⤵
  PID:7076
- C:\Windows\System\uBwTApU.exe
  C:\Windows\System\uBwTApU.exe
  2⤵
  PID:7124
- C:\Windows\System\STEXAwR.exe
  C:\Windows\System\STEXAwR.exe
  2⤵
  PID:5824
- C:\Windows\System\LylfWNr.exe
  C:\Windows\System\LylfWNr.exe
  2⤵
  PID:6160
- C:\Windows\System\wtsjMqi.exe
  C:\Windows\System\wtsjMqi.exe
  2⤵
  PID:6168
- C:\Windows\System\fgtxgnE.exe
  C:\Windows\System\fgtxgnE.exe
  2⤵
  PID:6264
- C:\Windows\System\UGpSEza.exe
  C:\Windows\System\UGpSEza.exe
  2⤵
  PID:6300
- C:\Windows\System\NwtrSID.exe
  C:\Windows\System\NwtrSID.exe
  2⤵
  PID:6336
- C:\Windows\System\MpznvIy.exe
  C:\Windows\System\MpznvIy.exe
  2⤵
  PID:6424
- C:\Windows\System\PAqUymP.exe
  C:\Windows\System\PAqUymP.exe
  2⤵
  PID:6384
- C:\Windows\System\SPsLQMA.exe
  C:\Windows\System\SPsLQMA.exe
  2⤵
  PID:6532
- C:\Windows\System\qiklOVI.exe
  C:\Windows\System\qiklOVI.exe
  2⤵
  PID:6480
- C:\Windows\System\beFZlxV.exe
  C:\Windows\System\beFZlxV.exe
  2⤵
  PID:6568
- C:\Windows\System\wPqzisU.exe
  C:\Windows\System\wPqzisU.exe
  2⤵
  PID:6548
- C:\Windows\System\QFhLvAd.exe
  C:\Windows\System\QFhLvAd.exe
  2⤵
  PID:6628
- C:\Windows\System\GnpHYRe.exe
  C:\Windows\System\GnpHYRe.exe
  2⤵
  PID:6748
- C:\Windows\System\soKMGOz.exe
  C:\Windows\System\soKMGOz.exe
  2⤵
  PID:6712
- C:\Windows\System\WTUnmtY.exe
  C:\Windows\System\WTUnmtY.exe
  2⤵
  PID:6844
- C:\Windows\System\oAnEWqW.exe
  C:\Windows\System\oAnEWqW.exe
  2⤵
  PID:6884
- C:\Windows\System\dQztnGW.exe
  C:\Windows\System\dQztnGW.exe
  2⤵
  PID:6912
- C:\Windows\System\RLBHCmU.exe
  C:\Windows\System\RLBHCmU.exe
  2⤵
  PID:6944
- C:\Windows\System\gPkzKpT.exe
  C:\Windows\System\gPkzKpT.exe
  2⤵
  PID:6984
- C:\Windows\System\uzHsCwJ.exe
  C:\Windows\System\uzHsCwJ.exe
  2⤵
  PID:7008
- C:\Windows\System\ewUlEHm.exe
  C:\Windows\System\ewUlEHm.exe
  2⤵
  PID:7072
- C:\Windows\System\cZmOTIT.exe
  C:\Windows\System\cZmOTIT.exe
  2⤵
  PID:7152
- C:\Windows\System\sxwpRlr.exe
  C:\Windows\System\sxwpRlr.exe
  2⤵
  PID:7164
- C:\Windows\System\WjzQOgi.exe
  C:\Windows\System\WjzQOgi.exe
  2⤵
  PID:6220
- C:\Windows\System\yndEMNQ.exe
  C:\Windows\System\yndEMNQ.exe
  2⤵
  PID:6452
- C:\Windows\System\zTIjfyE.exe
  C:\Windows\System\zTIjfyE.exe
  2⤵
  PID:6388
- C:\Windows\System\nUqlqCO.exe
  C:\Windows\System\nUqlqCO.exe
  2⤵
  PID:6908
- C:\Windows\System\SvXDFum.exe
  C:\Windows\System\SvXDFum.exe
  2⤵
  PID:7184
- C:\Windows\System\SBOUtRl.exe
  C:\Windows\System\SBOUtRl.exe
  2⤵
  PID:7204
- C:\Windows\System\TDxsdmZ.exe
  C:\Windows\System\TDxsdmZ.exe
  2⤵
  PID:7224
- C:\Windows\System\buXIUeW.exe
  C:\Windows\System\buXIUeW.exe
  2⤵
  PID:7248
- C:\Windows\System\pudYhVx.exe
  C:\Windows\System\pudYhVx.exe
  2⤵
  PID:7264
- C:\Windows\System\tDqtSLr.exe
  C:\Windows\System\tDqtSLr.exe
  2⤵
  PID:7292
- C:\Windows\System\KnWCERa.exe
  C:\Windows\System\KnWCERa.exe
  2⤵
  PID:7308
- C:\Windows\System\mzxWFaY.exe
  C:\Windows\System\mzxWFaY.exe
  2⤵
  PID:7328
- C:\Windows\System\TEFwJzR.exe
  C:\Windows\System\TEFwJzR.exe
  2⤵
  PID:7356
- C:\Windows\System\IYzuDre.exe
  C:\Windows\System\IYzuDre.exe
  2⤵
  PID:7380
- C:\Windows\System\lwylfnz.exe
  C:\Windows\System\lwylfnz.exe
  2⤵
  PID:7396
- C:\Windows\System\xqxjygF.exe
  C:\Windows\System\xqxjygF.exe
  2⤵
  PID:7416
- C:\Windows\System\MLVdVpL.exe
  C:\Windows\System\MLVdVpL.exe
  2⤵
  PID:7440
- C:\Windows\System\IUcjNJE.exe
  C:\Windows\System\IUcjNJE.exe
  2⤵
  PID:7460
- C:\Windows\System\rmhVJNq.exe
  C:\Windows\System\rmhVJNq.exe
  2⤵
  PID:7476
- C:\Windows\System\aNxdOFR.exe
  C:\Windows\System\aNxdOFR.exe
  2⤵
  PID:7496
- C:\Windows\System\BOHJrUv.exe
  C:\Windows\System\BOHJrUv.exe
  2⤵
  PID:7516
- C:\Windows\System\yhSlkOv.exe
  C:\Windows\System\yhSlkOv.exe
  2⤵
  PID:7536
- C:\Windows\System\oTTIUGx.exe
  C:\Windows\System\oTTIUGx.exe
  2⤵
  PID:7564
- C:\Windows\System\LtkWVJQ.exe
  C:\Windows\System\LtkWVJQ.exe
  2⤵
  PID:7588
- C:\Windows\System\Eagrzjf.exe
  C:\Windows\System\Eagrzjf.exe
  2⤵
  PID:7616
- C:\Windows\System\QwqkHaB.exe
  C:\Windows\System\QwqkHaB.exe
  2⤵
  PID:7748
- C:\Windows\System\MdzlDDZ.exe
  C:\Windows\System\MdzlDDZ.exe
  2⤵
  PID:7768
- C:\Windows\System\bGQTqLX.exe
  C:\Windows\System\bGQTqLX.exe
  2⤵
  PID:7792
- C:\Windows\System\DYfayFN.exe
  C:\Windows\System\DYfayFN.exe
  2⤵
  PID:7808
- C:\Windows\System\BllswJu.exe
  C:\Windows\System\BllswJu.exe
  2⤵
  PID:7832
- C:\Windows\System\Yiirert.exe
  C:\Windows\System\Yiirert.exe
  2⤵
  PID:7856
- C:\Windows\System\KLukVCc.exe
  C:\Windows\System\KLukVCc.exe
  2⤵
  PID:7872
- C:\Windows\System\GOefVRM.exe
  C:\Windows\System\GOefVRM.exe
  2⤵
  PID:7896
- C:\Windows\System\Jbzwfqb.exe
  C:\Windows\System\Jbzwfqb.exe
  2⤵
  PID:7924
- C:\Windows\System\hOKbgOL.exe
  C:\Windows\System\hOKbgOL.exe
  2⤵
  PID:7948
- C:\Windows\System\HTHnBnb.exe
  C:\Windows\System\HTHnBnb.exe
  2⤵
  PID:7968
- C:\Windows\System\FCVMCRR.exe
  C:\Windows\System\FCVMCRR.exe
  2⤵
  PID:7988
- C:\Windows\System\lLpBKRh.exe
  C:\Windows\System\lLpBKRh.exe
  2⤵
  PID:8024
- C:\Windows\System\YelAYcY.exe
  C:\Windows\System\YelAYcY.exe
  2⤵
  PID:8040
- C:\Windows\System\nlzrtEu.exe
  C:\Windows\System\nlzrtEu.exe
  2⤵
  PID:8064
- C:\Windows\System\AGwmxPu.exe
  C:\Windows\System\AGwmxPu.exe
  2⤵
  PID:8080
- C:\Windows\System\ZrmVjGy.exe
  C:\Windows\System\ZrmVjGy.exe
  2⤵
  PID:8096
- C:\Windows\System\XFZTmxa.exe
  C:\Windows\System\XFZTmxa.exe
  2⤵
  PID:8120
- C:\Windows\System\VBLHzFs.exe
  C:\Windows\System\VBLHzFs.exe
  2⤵
  PID:8148
- C:\Windows\System\FlgqCOF.exe
  C:\Windows\System\FlgqCOF.exe
  2⤵
  PID:8172
- C:\Windows\System\lmLxAxX.exe
  C:\Windows\System\lmLxAxX.exe
  2⤵
  PID:6404
- C:\Windows\System\KBrOFYf.exe
  C:\Windows\System\KBrOFYf.exe
  2⤵
  PID:6284
- C:\Windows\System\fIMuxbk.exe
  C:\Windows\System\fIMuxbk.exe
  2⤵
  PID:6516
- C:\Windows\System\MnIsoea.exe
  C:\Windows\System\MnIsoea.exe
  2⤵
  PID:7196
- C:\Windows\System\gjwfFUU.exe
  C:\Windows\System\gjwfFUU.exe
  2⤵
  PID:6812
- C:\Windows\System\wnBjITQ.exe
  C:\Windows\System\wnBjITQ.exe
  2⤵
  PID:6304
- C:\Windows\System\hqkrDSw.exe
  C:\Windows\System\hqkrDSw.exe
  2⤵
  PID:7348
- C:\Windows\System\KFUftGl.exe
  C:\Windows\System\KFUftGl.exe
  2⤵
  PID:7216
- C:\Windows\System\MRLmEdH.exe
  C:\Windows\System\MRLmEdH.exe
  2⤵
  PID:7148
- C:\Windows\System\cCHwtmR.exe
  C:\Windows\System\cCHwtmR.exe
  2⤵
  PID:7260
- C:\Windows\System\cvvRbFd.exe
  C:\Windows\System\cvvRbFd.exe
  2⤵
  PID:7760
- C:\Windows\System\RDglYke.exe
  C:\Windows\System\RDglYke.exe
  2⤵
  PID:7904
- C:\Windows\System\SWlyMYs.exe
  C:\Windows\System\SWlyMYs.exe
  2⤵
  PID:7940
- C:\Windows\System\pJOKATB.exe
  C:\Windows\System\pJOKATB.exe
  2⤵
  PID:7984
- C:\Windows\System\cnPhhSE.exe
  C:\Windows\System\cnPhhSE.exe
  2⤵
  PID:7704
- C:\Windows\System\eAssCBs.exe
  C:\Windows\System\eAssCBs.exe
  2⤵
  PID:7608
- C:\Windows\System\EhzfOwt.exe
  C:\Windows\System\EhzfOwt.exe
  2⤵
  PID:7272
- C:\Windows\System\ycelEnM.exe
  C:\Windows\System\ycelEnM.exe
  2⤵
  PID:7392
- C:\Windows\System\zPkPHGl.exe
  C:\Windows\System\zPkPHGl.exe
  2⤵
  PID:8036
- C:\Windows\System\SmXxPpD.exe
  C:\Windows\System\SmXxPpD.exe
  2⤵
  PID:8088
- C:\Windows\System\XWnNyrg.exe
  C:\Windows\System\XWnNyrg.exe
  2⤵
  PID:8128
- C:\Windows\System\RrwQWnG.exe
  C:\Windows\System\RrwQWnG.exe
  2⤵
  PID:8160
- C:\Windows\System\AfrXmJQ.exe
  C:\Windows\System\AfrXmJQ.exe
  2⤵
  PID:6724
- C:\Windows\System\mwbeISS.exe
  C:\Windows\System\mwbeISS.exe
  2⤵
  PID:5740
- C:\Windows\System\QmycqlS.exe
  C:\Windows\System\QmycqlS.exe
  2⤵
  PID:6788
- C:\Windows\System\wheOcHS.exe
  C:\Windows\System\wheOcHS.exe
  2⤵
  PID:7828
- C:\Windows\System\dlUcnga.exe
  C:\Windows\System\dlUcnga.exe
  2⤵
  PID:7116
- C:\Windows\System\PacbLyG.exe
  C:\Windows\System\PacbLyG.exe
  2⤵
  PID:6596
- C:\Windows\System\hYODfxL.exe
  C:\Windows\System\hYODfxL.exe
  2⤵
  PID:8016
- C:\Windows\System\olPCvmS.exe
  C:\Windows\System\olPCvmS.exe
  2⤵
  PID:7936
- C:\Windows\System\CvyZWMD.exe
  C:\Windows\System\CvyZWMD.exe
  2⤵
  PID:7784
- C:\Windows\System\UVZlpFG.exe
  C:\Windows\System\UVZlpFG.exe
  2⤵
  PID:8460
- C:\Windows\System\qVvGwtd.exe
  C:\Windows\System\qVvGwtd.exe
  2⤵
  PID:8612
- C:\Windows\System\RsSvcMf.exe
  C:\Windows\System\RsSvcMf.exe
  2⤵
  PID:8628
- C:\Windows\System\HmCTZTW.exe
  C:\Windows\System\HmCTZTW.exe
  2⤵
  PID:8644
- C:\Windows\System\jbnEsLA.exe
  C:\Windows\System\jbnEsLA.exe
  2⤵
  PID:8664
- C:\Windows\System\KIRxDkO.exe
  C:\Windows\System\KIRxDkO.exe
  2⤵
  PID:8684
- C:\Windows\System\NWfoCfQ.exe
  C:\Windows\System\NWfoCfQ.exe
  2⤵
  PID:8704
- C:\Windows\System\hBYFPRK.exe
  C:\Windows\System\hBYFPRK.exe
  2⤵
  PID:8720
- C:\Windows\System\yzVMBLM.exe
  C:\Windows\System\yzVMBLM.exe
  2⤵
  PID:8748
- C:\Windows\System\QYtgwcC.exe
  C:\Windows\System\QYtgwcC.exe
  2⤵
  PID:8768
- C:\Windows\System\FbKlpKO.exe
  C:\Windows\System\FbKlpKO.exe
  2⤵
  PID:8796
- C:\Windows\System\ZMJofMK.exe
  C:\Windows\System\ZMJofMK.exe
  2⤵
  PID:8820
- C:\Windows\System\lyIHSYH.exe
  C:\Windows\System\lyIHSYH.exe
  2⤵
  PID:8840
- C:\Windows\System\bqegQxg.exe
  C:\Windows\System\bqegQxg.exe
  2⤵
  PID:8868
- C:\Windows\System\DYMwBur.exe
  C:\Windows\System\DYMwBur.exe
  2⤵
  PID:8892
- C:\Windows\System\ldlWsQA.exe
  C:\Windows\System\ldlWsQA.exe
  2⤵
  PID:8912
- C:\Windows\System\EsNTwyC.exe
  C:\Windows\System\EsNTwyC.exe
  2⤵
  PID:8936
- C:\Windows\System\xFGoVuU.exe
  C:\Windows\System\xFGoVuU.exe
  2⤵
  PID:8952
- C:\Windows\System\phlBaQq.exe
  C:\Windows\System\phlBaQq.exe
  2⤵
  PID:8968
- C:\Windows\System\cSRhusz.exe
  C:\Windows\System\cSRhusz.exe
  2⤵
  PID:8988
- C:\Windows\System\TLUqorj.exe
  C:\Windows\System\TLUqorj.exe
  2⤵
  PID:9012
- C:\Windows\System\CBqybDN.exe
  C:\Windows\System\CBqybDN.exe
  2⤵
  PID:9032
- C:\Windows\System\IpQXtvc.exe
  C:\Windows\System\IpQXtvc.exe
  2⤵
  PID:9056
- C:\Windows\System\MYICdFl.exe
  C:\Windows\System\MYICdFl.exe
  2⤵
  PID:9076
- C:\Windows\System\czkyxrx.exe
  C:\Windows\System\czkyxrx.exe
  2⤵
  PID:9092
- C:\Windows\System\CSZQvvv.exe
  C:\Windows\System\CSZQvvv.exe
  2⤵
  PID:9108
- C:\Windows\System\ueQqQgC.exe
  C:\Windows\System\ueQqQgC.exe
  2⤵
  PID:9128
- C:\Windows\System\JudkRWB.exe
  C:\Windows\System\JudkRWB.exe
  2⤵
  PID:9148
- C:\Windows\System\aPXSHCs.exe
  C:\Windows\System\aPXSHCs.exe
  2⤵
  PID:9168
- C:\Windows\System\wJVFehZ.exe
  C:\Windows\System\wJVFehZ.exe
  2⤵
  PID:9188
- C:\Windows\System\lMXDNYn.exe
  C:\Windows\System\lMXDNYn.exe
  2⤵
  PID:9204
- C:\Windows\System\WEasPDd.exe
  C:\Windows\System\WEasPDd.exe
  2⤵
  PID:8076
- C:\Windows\System\TEVATYJ.exe
  C:\Windows\System\TEVATYJ.exe
  2⤵
  PID:7508
- C:\Windows\System\AGSTvfp.exe
  C:\Windows\System\AGSTvfp.exe
  2⤵
  PID:7572
- C:\Windows\System\VdmTqWT.exe
  C:\Windows\System\VdmTqWT.exe
  2⤵
  PID:7640
- C:\Windows\System\UgAusbi.exe
  C:\Windows\System\UgAusbi.exe
  2⤵
  PID:7804
- C:\Windows\System\daAlVZu.exe
  C:\Windows\System\daAlVZu.exe
  2⤵
  PID:7880
- C:\Windows\System\rxjSIJP.exe
  C:\Windows\System\rxjSIJP.exe
  2⤵
  PID:8208
- C:\Windows\System\DDNcLdJ.exe
  C:\Windows\System\DDNcLdJ.exe
  2⤵
  PID:8308
- C:\Windows\System\gCvqIkS.exe
  C:\Windows\System\gCvqIkS.exe
  2⤵
  PID:8240
- C:\Windows\System\ZiZZWji.exe
  C:\Windows\System\ZiZZWji.exe
  2⤵
  PID:8364
- C:\Windows\System\iemBVlT.exe
  C:\Windows\System\iemBVlT.exe
  2⤵
  PID:8424
- C:\Windows\System\VsLujhg.exe
  C:\Windows\System\VsLujhg.exe
  2⤵
  PID:8512
- C:\Windows\System\LcEHjzd.exe
  C:\Windows\System\LcEHjzd.exe
  2⤵
  PID:8412
- C:\Windows\System\NwQxDjL.exe
  C:\Windows\System\NwQxDjL.exe
  2⤵
  PID:8700
- C:\Windows\System\DFpttRb.exe
  C:\Windows\System\DFpttRb.exe
  2⤵
  PID:8756
- C:\Windows\System\MSXJqcQ.exe
  C:\Windows\System\MSXJqcQ.exe
  2⤵
  PID:8848
- C:\Windows\System\fYmLhYA.exe
  C:\Windows\System\fYmLhYA.exe
  2⤵
  PID:8900
- C:\Windows\System\EFXpKBv.exe
  C:\Windows\System\EFXpKBv.exe
  2⤵
  PID:8920
- C:\Windows\System\hUqNRhi.exe
  C:\Windows\System\hUqNRhi.exe
  2⤵
  PID:8652
- C:\Windows\System\ZnHHUBm.exe
  C:\Windows\System\ZnHHUBm.exe
  2⤵
  PID:8672
- C:\Windows\System\ETzzwNk.exe
  C:\Windows\System\ETzzwNk.exe
  2⤵
  PID:8976
- C:\Windows\System\tvMqULB.exe
  C:\Windows\System\tvMqULB.exe
  2⤵
  PID:9008
- C:\Windows\System\SmfcSrL.exe
  C:\Windows\System\SmfcSrL.exe
  2⤵
  PID:8608
- C:\Windows\System\ySMqWYB.exe
  C:\Windows\System\ySMqWYB.exe
  2⤵
  PID:9196
- C:\Windows\System\oKAGzGH.exe
  C:\Windows\System\oKAGzGH.exe
  2⤵
  PID:7612
- C:\Windows\System\PWpqmUW.exe
  C:\Windows\System\PWpqmUW.exe
  2⤵
  PID:9040
- C:\Windows\System\xnhbcah.exe
  C:\Windows\System\xnhbcah.exe
  2⤵
  PID:8764
- C:\Windows\System\GEaZWXi.exe
  C:\Windows\System\GEaZWXi.exe
  2⤵
  PID:8816
- C:\Windows\System\rgPXcmH.exe
  C:\Windows\System\rgPXcmH.exe
  2⤵
  PID:7964
- C:\Windows\System\olciyjS.exe
  C:\Windows\System\olciyjS.exe
  2⤵
  PID:8888
- C:\Windows\System\jCgOmZe.exe
  C:\Windows\System\jCgOmZe.exe
  2⤵
  PID:6880
- C:\Windows\System\yBterjR.exe
  C:\Windows\System\yBterjR.exe
  2⤵
  PID:9164
- C:\Windows\System\tNrxNen.exe
  C:\Windows\System\tNrxNen.exe
  2⤵
  PID:8692
- C:\Windows\System\rvfkAKU.exe
  C:\Windows\System\rvfkAKU.exe
  2⤵
  PID:8448
- C:\Windows\System\rBYmNPP.exe
  C:\Windows\System\rBYmNPP.exe
  2⤵
  PID:8204
- C:\Windows\System\TJgvljb.exe
  C:\Windows\System\TJgvljb.exe
  2⤵
  PID:8944
- C:\Windows\System\SrVVWkY.exe
  C:\Windows\System\SrVVWkY.exe
  2⤵
  PID:8032
- C:\Windows\System\qMqPPmA.exe
  C:\Windows\System\qMqPPmA.exe
  2⤵
  PID:9224
- C:\Windows\System\RkBFHBk.exe
  C:\Windows\System\RkBFHBk.exe
  2⤵
  PID:9248
- C:\Windows\System\qxRLoRA.exe
  C:\Windows\System\qxRLoRA.exe
  2⤵
  PID:9268
- C:\Windows\System\cnaIxeN.exe
  C:\Windows\System\cnaIxeN.exe
  2⤵
  PID:9288
- C:\Windows\System\XoqteOh.exe
  C:\Windows\System\XoqteOh.exe
  2⤵
  PID:9312
- C:\Windows\System\mWDypmm.exe
  C:\Windows\System\mWDypmm.exe
  2⤵
  PID:9332
- C:\Windows\System\ykzjRsX.exe
  C:\Windows\System\ykzjRsX.exe
  2⤵
  PID:9356
- C:\Windows\System\lnzfdCJ.exe
  C:\Windows\System\lnzfdCJ.exe
  2⤵
  PID:9384
- C:\Windows\System\oghDuCa.exe
  C:\Windows\System\oghDuCa.exe
  2⤵
  PID:9404
- C:\Windows\System\WlOJATG.exe
  C:\Windows\System\WlOJATG.exe
  2⤵
  PID:9424
- C:\Windows\System\WCpDgKs.exe
  C:\Windows\System\WCpDgKs.exe
  2⤵
  PID:9444
- C:\Windows\System\JyiOyWL.exe
  C:\Windows\System\JyiOyWL.exe
  2⤵
  PID:9572
- C:\Windows\System\OwRNsdI.exe
  C:\Windows\System\OwRNsdI.exe
  2⤵
  PID:9592
- C:\Windows\System\TvjPjwA.exe
  C:\Windows\System\TvjPjwA.exe
  2⤵
  PID:9620
- C:\Windows\System\vplRFPP.exe
  C:\Windows\System\vplRFPP.exe
  2⤵
  PID:9640
- C:\Windows\System\IKKgbky.exe
  C:\Windows\System\IKKgbky.exe
  2⤵
  PID:9656
- C:\Windows\System\fAGFHJp.exe
  C:\Windows\System\fAGFHJp.exe
  2⤵
  PID:9680
- C:\Windows\System\pXLiVXz.exe
  C:\Windows\System\pXLiVXz.exe
  2⤵
  PID:9700
- C:\Windows\System\fCOKEti.exe
  C:\Windows\System\fCOKEti.exe
  2⤵
  PID:9720
- C:\Windows\System\LMGIyLy.exe
  C:\Windows\System\LMGIyLy.exe
  2⤵
  PID:9744
- C:\Windows\System\fRZNbvp.exe
  C:\Windows\System\fRZNbvp.exe
  2⤵
  PID:9764
- C:\Windows\System\rcokGmb.exe
  C:\Windows\System\rcokGmb.exe
  2⤵
  PID:9780
- C:\Windows\System\FHIaofZ.exe
  C:\Windows\System\FHIaofZ.exe
  2⤵
  PID:9804
- C:\Windows\System\gnBrkLI.exe
  C:\Windows\System\gnBrkLI.exe
  2⤵
  PID:9824
- C:\Windows\System\mHPIPtQ.exe
  C:\Windows\System\mHPIPtQ.exe
  2⤵
  PID:9844
- C:\Windows\System\oHrfxqp.exe
  C:\Windows\System\oHrfxqp.exe
  2⤵
  PID:9864
- C:\Windows\System\Witjqkv.exe
  C:\Windows\System\Witjqkv.exe
  2⤵
  PID:9888
- C:\Windows\System\OCaSgKB.exe
  C:\Windows\System\OCaSgKB.exe
  2⤵
  PID:9908
- C:\Windows\System\WowkoIY.exe
  C:\Windows\System\WowkoIY.exe
  2⤵
  PID:9924
- C:\Windows\System\uNxQDuu.exe
  C:\Windows\System\uNxQDuu.exe
  2⤵
  PID:9948
- C:\Windows\System\lKzpSjD.exe
  C:\Windows\System\lKzpSjD.exe
  2⤵
  PID:9968
- C:\Windows\System\yharZlk.exe
  C:\Windows\System\yharZlk.exe
  2⤵
  PID:9988
- C:\Windows\System\FDodDop.exe
  C:\Windows\System\FDodDop.exe
  2⤵
  PID:10008
- C:\Windows\System\ncPefKz.exe
  C:\Windows\System\ncPefKz.exe
  2⤵
  PID:10036
- C:\Windows\System\ZJdRQvc.exe
  C:\Windows\System\ZJdRQvc.exe
  2⤵
  PID:10060
- C:\Windows\System\SmZavrj.exe
  C:\Windows\System\SmZavrj.exe
  2⤵
  PID:10084
- C:\Windows\System\RDIljzT.exe
  C:\Windows\System\RDIljzT.exe
  2⤵
  PID:10108
- C:\Windows\System\PVhrSKs.exe
  C:\Windows\System\PVhrSKs.exe
  2⤵
  PID:10128
- C:\Windows\System\jDJBdfW.exe
  C:\Windows\System\jDJBdfW.exe
  2⤵
  PID:10152
- C:\Windows\System\jakYiRO.exe
  C:\Windows\System\jakYiRO.exe
  2⤵
  PID:10176
- C:\Windows\System\dDNMMDn.exe
  C:\Windows\System\dDNMMDn.exe
  2⤵
  PID:10192
- C:\Windows\System\dgXVdMB.exe
  C:\Windows\System\dgXVdMB.exe
  2⤵
  PID:10220
- C:\Windows\System\OlwAymN.exe
  C:\Windows\System\OlwAymN.exe
  2⤵
  PID:8140
- C:\Windows\System\ZpNkvuf.exe
  C:\Windows\System\ZpNkvuf.exe
  2⤵
  PID:8116
- C:\Windows\System\CbzQIAb.exe
  C:\Windows\System\CbzQIAb.exe
  2⤵
  PID:8812
- C:\Windows\System\NuZTlTJ.exe
  C:\Windows\System\NuZTlTJ.exe
  2⤵
  PID:8264
- C:\Windows\System\WrXtnmD.exe
  C:\Windows\System\WrXtnmD.exe
  2⤵
  PID:8780
- C:\Windows\System\fPTUMfb.exe
  C:\Windows\System\fPTUMfb.exe
  2⤵
  PID:3152
- C:\Windows\System\fOwiihy.exe
  C:\Windows\System\fOwiihy.exe
  2⤵
  PID:9212
- C:\Windows\System\FnZMGGH.exe
  C:\Windows\System\FnZMGGH.exe
  2⤵
  PID:6896
- C:\Windows\System\ybRqTGb.exe
  C:\Windows\System\ybRqTGb.exe
  2⤵
  PID:9432
- C:\Windows\System\fDNcoTR.exe
  C:\Windows\System\fDNcoTR.exe
  2⤵
  PID:8880
- C:\Windows\System\hdpMouF.exe
  C:\Windows\System\hdpMouF.exe
  2⤵
  PID:9584
- C:\Windows\System\VStCPrS.exe
  C:\Windows\System\VStCPrS.exe
  2⤵
  PID:9632
- C:\Windows\System\yDjKDRX.exe
  C:\Windows\System\yDjKDRX.exe
  2⤵
  PID:9692
- C:\Windows\System\zIjLpSM.exe
  C:\Windows\System\zIjLpSM.exe
  2⤵
  PID:9736
- C:\Windows\System\EOHVGNL.exe
  C:\Windows\System\EOHVGNL.exe
  2⤵
  PID:10256
- C:\Windows\System\aBZWQkq.exe
  C:\Windows\System\aBZWQkq.exe
  2⤵
  PID:10384
- C:\Windows\System\DkfOkSK.exe
  C:\Windows\System\DkfOkSK.exe
  2⤵
  PID:10400
- C:\Windows\System\iaRvsCG.exe
  C:\Windows\System\iaRvsCG.exe
  2⤵
  PID:10420
- C:\Windows\System\WhQtOZe.exe
  C:\Windows\System\WhQtOZe.exe
  2⤵
  PID:10440
- C:\Windows\System\bnlFAqr.exe
  C:\Windows\System\bnlFAqr.exe
  2⤵
  PID:10460
- C:\Windows\System\COYoJWI.exe
  C:\Windows\System\COYoJWI.exe
  2⤵
  PID:10476
- C:\Windows\System\uUylnvS.exe
  C:\Windows\System\uUylnvS.exe
  2⤵
  PID:10496
- C:\Windows\System\vVQRceF.exe
  C:\Windows\System\vVQRceF.exe
  2⤵
  PID:10524
- C:\Windows\System\eNSzHAx.exe
  C:\Windows\System\eNSzHAx.exe
  2⤵
  PID:10544
- C:\Windows\System\lLoeQIa.exe
  C:\Windows\System\lLoeQIa.exe
  2⤵
  PID:10564
- C:\Windows\System\KngHYfC.exe
  C:\Windows\System\KngHYfC.exe
  2⤵
  PID:10600
- C:\Windows\System\iVcgyrl.exe
  C:\Windows\System\iVcgyrl.exe
  2⤵
  PID:10620
- C:\Windows\System\DHKEMeJ.exe
  C:\Windows\System\DHKEMeJ.exe
  2⤵
  PID:10876
- C:\Windows\System\leSLbRP.exe
  C:\Windows\System\leSLbRP.exe
  2⤵
  PID:10892
- C:\Windows\System\WTblWzE.exe
  C:\Windows\System\WTblWzE.exe
  2⤵
  PID:10908
- C:\Windows\System\bBdyXcf.exe
  C:\Windows\System\bBdyXcf.exe
  2⤵
  PID:10952
- C:\Windows\System\TdTUrAV.exe
  C:\Windows\System\TdTUrAV.exe
  2⤵
  PID:10980
- C:\Windows\System\HvOBRyS.exe
  C:\Windows\System\HvOBRyS.exe
  2⤵
  PID:11036
- C:\Windows\System\NCToOIY.exe
  C:\Windows\System\NCToOIY.exe
  2⤵
  PID:11060
- C:\Windows\System\tQbBonB.exe
  C:\Windows\System\tQbBonB.exe
  2⤵
  PID:11088
- C:\Windows\System\RAcrduW.exe
  C:\Windows\System\RAcrduW.exe
  2⤵
  PID:11124
- C:\Windows\System\qlYXYVJ.exe
  C:\Windows\System\qlYXYVJ.exe
  2⤵
  PID:11140
- C:\Windows\System\RipQfEF.exe
  C:\Windows\System\RipQfEF.exe
  2⤵
  PID:11156
- C:\Windows\System\zrRLMTV.exe
  C:\Windows\System\zrRLMTV.exe
  2⤵
  PID:11184
- C:\Windows\System\FqyjelU.exe
  C:\Windows\System\FqyjelU.exe
  2⤵
  PID:11204
- C:\Windows\System\tDAkonn.exe
  C:\Windows\System\tDAkonn.exe
  2⤵
  PID:11220
- C:\Windows\System\KWTOFvZ.exe
  C:\Windows\System\KWTOFvZ.exe
  2⤵
  PID:11244
- C:\Windows\System\ksgOcVo.exe
  C:\Windows\System\ksgOcVo.exe
  2⤵
  PID:6640
- C:\Windows\System\yQkPuFZ.exe
  C:\Windows\System\yQkPuFZ.exe
  2⤵
  PID:9440
- C:\Windows\System\JpfYbxc.exe
  C:\Windows\System\JpfYbxc.exe
  2⤵
  PID:8836
- C:\Windows\System\YCvAjye.exe
  C:\Windows\System\YCvAjye.exe
  2⤵
  PID:9180
- C:\Windows\System\SKaTniG.exe
  C:\Windows\System\SKaTniG.exe
  2⤵
  PID:9308
- C:\Windows\System\Befnrbg.exe
  C:\Windows\System\Befnrbg.exe
  2⤵
  PID:8960
- C:\Windows\System\fbrqUAd.exe
  C:\Windows\System\fbrqUAd.exe
  2⤵
  PID:9836
- C:\Windows\System\dmpSmVL.exe
  C:\Windows\System\dmpSmVL.exe
  2⤵
  PID:9980
- C:\Windows\System\nlehHuY.exe
  C:\Windows\System\nlehHuY.exe
  2⤵
  PID:10000
- C:\Windows\System\svItIdx.exe
  C:\Windows\System\svItIdx.exe
  2⤵
  PID:8964
- C:\Windows\System\KEiqBTM.exe
  C:\Windows\System\KEiqBTM.exe
  2⤵
  PID:9544
- C:\Windows\System\tfSdOGG.exe
  C:\Windows\System\tfSdOGG.exe
  2⤵
  PID:7736
- C:\Windows\System\peJFuXl.exe
  C:\Windows\System\peJFuXl.exe
  2⤵
  PID:9328
- C:\Windows\System\YLiNokv.exe
  C:\Windows\System\YLiNokv.exe
  2⤵
  PID:9364
- C:\Windows\System\vmlSOnF.exe
  C:\Windows\System\vmlSOnF.exe
  2⤵
  PID:9436
- C:\Windows\System\EYIdiKd.exe
  C:\Windows\System\EYIdiKd.exe
  2⤵
  PID:8760
- C:\Windows\System\atxOnZU.exe
  C:\Windows\System\atxOnZU.exe
  2⤵
  PID:8184
- C:\Windows\System\oLwFdcA.exe
  C:\Windows\System\oLwFdcA.exe
  2⤵
  PID:9568
- C:\Windows\System\XTaudnl.exe
  C:\Windows\System\XTaudnl.exe
  2⤵
  PID:9672
- C:\Windows\System\xMNWYxn.exe
  C:\Windows\System\xMNWYxn.exe
  2⤵
  PID:10080
- C:\Windows\System\DxGoqQh.exe
  C:\Windows\System\DxGoqQh.exe
  2⤵
  PID:10136
- C:\Windows\System\hkwXAWg.exe
  C:\Windows\System\hkwXAWg.exe
  2⤵
  PID:10188
- C:\Windows\System\zkFeLZd.exe
  C:\Windows\System\zkFeLZd.exe
  2⤵
  PID:10676
- C:\Windows\System\igoEtlr.exe
  C:\Windows\System\igoEtlr.exe
  2⤵
  PID:10764
- C:\Windows\System\GWepNlz.exe
  C:\Windows\System\GWepNlz.exe
  2⤵
  PID:10796
- C:\Windows\System\oWksLdv.exe
  C:\Windows\System\oWksLdv.exe
  2⤵
  PID:7628
- C:\Windows\System\HrIGBRN.exe
  C:\Windows\System\HrIGBRN.exe
  2⤵
  PID:10776
- C:\Windows\System\SbNjPnq.exe
  C:\Windows\System\SbNjPnq.exe
  2⤵
  PID:10824
- C:\Windows\System\UlgqmYJ.exe
  C:\Windows\System\UlgqmYJ.exe
  2⤵
  PID:10416
- C:\Windows\System\xZVmRvT.exe
  C:\Windows\System\xZVmRvT.exe
  2⤵
  PID:10840
- C:\Windows\System\uTxLKor.exe
  C:\Windows\System\uTxLKor.exe
  2⤵
  PID:10532
- C:\Windows\System\pHXCPUp.exe
  C:\Windows\System\pHXCPUp.exe
  2⤵
  PID:10608
- C:\Windows\System\JkjYsJx.exe
  C:\Windows\System\JkjYsJx.exe
  2⤵
  PID:11120
- C:\Windows\System\UrptPVB.exe
  C:\Windows\System\UrptPVB.exe
  2⤵
  PID:11216
- C:\Windows\System\GTfYXCs.exe
  C:\Windows\System\GTfYXCs.exe
  2⤵
  PID:3112
- C:\Windows\System\XlmIVok.exe
  C:\Windows\System\XlmIVok.exe
  2⤵
  PID:4324
- C:\Windows\System\vaTrKAG.exe
  C:\Windows\System\vaTrKAG.exe
  2⤵
  PID:10720
- C:\Windows\System\lsodWyl.exe
  C:\Windows\System\lsodWyl.exe
  2⤵
  PID:10752
- C:\Windows\System\WaZdGAo.exe
  C:\Windows\System\WaZdGAo.exe
  2⤵
  PID:9688
- C:\Windows\System\LCWyNhn.exe
  C:\Windows\System\LCWyNhn.exe
  2⤵
  PID:11176
- C:\Windows\System\DkebbPP.exe
  C:\Windows\System\DkebbPP.exe
  2⤵
  PID:9284
- C:\Windows\System\SMScfmk.exe
  C:\Windows\System\SMScfmk.exe
  2⤵
  PID:10076
- C:\Windows\System\WbuLTfA.exe
  C:\Windows\System\WbuLTfA.exe
  2⤵
  PID:9376
- C:\Windows\System\ceNHYtM.exe
  C:\Windows\System\ceNHYtM.exe
  2⤵
  PID:11112
- C:\Windows\System\wAbLaqQ.exe
  C:\Windows\System\wAbLaqQ.exe
  2⤵
  PID:11280
- C:\Windows\System\EHyeemj.exe
  C:\Windows\System\EHyeemj.exe
  2⤵
  PID:11308
- C:\Windows\System\QDuUksa.exe
  C:\Windows\System\QDuUksa.exe
  2⤵
  PID:11332
- C:\Windows\System\nrfmFoG.exe
  C:\Windows\System\nrfmFoG.exe
  2⤵
  PID:11360
- C:\Windows\System\pMAodmX.exe
  C:\Windows\System\pMAodmX.exe
  2⤵
  PID:11380
- C:\Windows\System\qCFyrdq.exe
  C:\Windows\System\qCFyrdq.exe
  2⤵
  PID:11404
- C:\Windows\System\dALNRAA.exe
  C:\Windows\System\dALNRAA.exe
  2⤵
  PID:11428
- C:\Windows\System\AsSYlOL.exe
  C:\Windows\System\AsSYlOL.exe
  2⤵
  PID:11448
- C:\Windows\System\NBOhlDO.exe
  C:\Windows\System\NBOhlDO.exe
  2⤵
  PID:11468
- C:\Windows\System\lqyVmfP.exe
  C:\Windows\System\lqyVmfP.exe
  2⤵
  PID:11488
- C:\Windows\System\UXLvKHu.exe
  C:\Windows\System\UXLvKHu.exe
  2⤵
  PID:11508
- C:\Windows\System\UUAnIbD.exe
  C:\Windows\System\UUAnIbD.exe
  2⤵
  PID:11524
- C:\Windows\System\tRrPPEj.exe
  C:\Windows\System\tRrPPEj.exe
  2⤵
  PID:11544
- C:\Windows\System\isxOpBG.exe
  C:\Windows\System\isxOpBG.exe
  2⤵
  PID:11564
- C:\Windows\System\eWAqJWm.exe
  C:\Windows\System\eWAqJWm.exe
  2⤵
  PID:11580
- C:\Windows\System\WPPKONI.exe
  C:\Windows\System\WPPKONI.exe
  2⤵
  PID:11596
- C:\Windows\System\acnRuCH.exe
  C:\Windows\System\acnRuCH.exe
  2⤵
  PID:11616
- C:\Windows\System\mWbJfmi.exe
  C:\Windows\System\mWbJfmi.exe
  2⤵
  PID:11632
- C:\Windows\System\pCrWVyi.exe
  C:\Windows\System\pCrWVyi.exe
  2⤵
  PID:11648
- C:\Windows\System\kLdUoPJ.exe
  C:\Windows\System\kLdUoPJ.exe
  2⤵
  PID:11672
- C:\Windows\System\icpEkOd.exe
  C:\Windows\System\icpEkOd.exe
  2⤵
  PID:11696
- C:\Windows\System\NLspnBu.exe
  C:\Windows\System\NLspnBu.exe
  2⤵
  PID:11720
- C:\Windows\System\WfEjoxX.exe
  C:\Windows\System\WfEjoxX.exe
  2⤵
  PID:11740
- C:\Windows\System\hxTCAoZ.exe
  C:\Windows\System\hxTCAoZ.exe
  2⤵
  PID:11760
- C:\Windows\System\EPWhYjb.exe
  C:\Windows\System\EPWhYjb.exe
  2⤵
  PID:11784
- C:\Windows\System\fWoMtqw.exe
  C:\Windows\System\fWoMtqw.exe
  2⤵
  PID:11804
- C:\Windows\System\SKhpuWN.exe
  C:\Windows\System\SKhpuWN.exe
  2⤵
  PID:11824
- C:\Windows\System\MxojKOS.exe
  C:\Windows\System\MxojKOS.exe
  2⤵
  PID:11844
- C:\Windows\System\capkKvw.exe
  C:\Windows\System\capkKvw.exe
  2⤵
  PID:11868
- C:\Windows\System\JrMuutN.exe
  C:\Windows\System\JrMuutN.exe
  2⤵
  PID:11888
- C:\Windows\System\pSsbnRc.exe
  C:\Windows\System\pSsbnRc.exe
  2⤵
  PID:11916
- C:\Windows\System\BVcWxdd.exe
  C:\Windows\System\BVcWxdd.exe
  2⤵
  PID:11940
- C:\Windows\System\DNFBXQP.exe
  C:\Windows\System\DNFBXQP.exe
  2⤵
  PID:11956
- C:\Windows\System\qXXlcmL.exe
  C:\Windows\System\qXXlcmL.exe
  2⤵
  PID:11976
- C:\Windows\System\XGWadzR.exe
  C:\Windows\System\XGWadzR.exe
  2⤵
  PID:11996
- C:\Windows\System\QouTzex.exe
  C:\Windows\System\QouTzex.exe
  2⤵
  PID:12012
- C:\Windows\System\csFhWWd.exe
  C:\Windows\System\csFhWWd.exe
  2⤵
  PID:10164
- C:\Windows\System\HADWFWq.exe
  C:\Windows\System\HADWFWq.exe
  2⤵
  PID:10884
- C:\Windows\System\bYcxZWs.exe
  C:\Windows\System\bYcxZWs.exe
  2⤵
  PID:10684
- C:\Windows\System\HrZiZPU.exe
  C:\Windows\System\HrZiZPU.exe
  2⤵
  PID:11032
- C:\Windows\System\JirvYZx.exe
  C:\Windows\System\JirvYZx.exe
  2⤵
  PID:8508
- C:\Windows\System\FFemZLD.exe
  C:\Windows\System\FFemZLD.exe
  2⤵
  PID:9816
- C:\Windows\System\XoyQpMG.exe
  C:\Windows\System\XoyQpMG.exe
  2⤵
  PID:11316
- C:\Windows\System\mGPNtUp.exe
  C:\Windows\System\mGPNtUp.exe
  2⤵
  PID:9896
- C:\Windows\System\aarfCBz.exe
  C:\Windows\System\aarfCBz.exe
  2⤵
  PID:9564
- C:\Windows\System\DRvYdEW.exe
  C:\Windows\System\DRvYdEW.exe
  2⤵
  PID:4708
- C:\Windows\System\mJooOfm.exe
  C:\Windows\System\mJooOfm.exe
  2⤵
  PID:11820
- C:\Windows\System\uFSwumi.exe
  C:\Windows\System\uFSwumi.exe
  2⤵
  PID:10412
- C:\Windows\System\UCZOiLe.exe
  C:\Windows\System\UCZOiLe.exe
  2⤵
  PID:11200
- C:\Windows\System\DXgNrQv.exe
  C:\Windows\System\DXgNrQv.exe
  2⤵
  PID:11296
- C:\Windows\System\MRVLVPd.exe
  C:\Windows\System\MRVLVPd.exe
  2⤵
  PID:11460
- C:\Windows\System\GlxYjOj.exe
  C:\Windows\System\GlxYjOj.exe
  2⤵
  PID:11500
- C:\Windows\System\RgrVwUa.exe
  C:\Windows\System\RgrVwUa.exe
  2⤵
  PID:12316
- C:\Windows\System\WXpPwHH.exe
  C:\Windows\System\WXpPwHH.exe
  2⤵
  PID:12340
- C:\Windows\System\ccJsKhJ.exe
  C:\Windows\System\ccJsKhJ.exe
  2⤵
  PID:12360
- C:\Windows\System\hSgLQBV.exe
  C:\Windows\System\hSgLQBV.exe
  2⤵
  PID:12556
- C:\Windows\System\FwTxJTc.exe
  C:\Windows\System\FwTxJTc.exe
  2⤵
  PID:12580
- C:\Windows\System\mEFgvCJ.exe
  C:\Windows\System\mEFgvCJ.exe
  2⤵
  PID:12600
- C:\Windows\System\hqgElkZ.exe
  C:\Windows\System\hqgElkZ.exe
  2⤵
  PID:12620
- C:\Windows\System\DAbMDWa.exe
  C:\Windows\System\DAbMDWa.exe
  2⤵
  PID:12640
- C:\Windows\System\JoXGwXJ.exe
  C:\Windows\System\JoXGwXJ.exe
  2⤵
  PID:12664
- C:\Windows\System\ocQvsKA.exe
  C:\Windows\System\ocQvsKA.exe
  2⤵
  PID:11692
- C:\Windows\System\rSTrhSx.exe
  C:\Windows\System\rSTrhSx.exe
  2⤵
  PID:11752
- C:\Windows\System\TkiuvGD.exe
  C:\Windows\System\TkiuvGD.exe
  2⤵
  PID:10972
- C:\Windows\System\QhBkxOW.exe
  C:\Windows\System\QhBkxOW.exe
  2⤵
  PID:10540
- C:\Windows\System\SJYbLzB.exe
  C:\Windows\System\SJYbLzB.exe
  2⤵
  PID:11328
- C:\Windows\System\veEKKEd.exe
  C:\Windows\System\veEKKEd.exe
  2⤵
  PID:11388
- C:\Windows\System\zNuQynn.exe
  C:\Windows\System\zNuQynn.exe
  2⤵
  PID:11436
- C:\Windows\System\KvPxsEU.exe
  C:\Windows\System\KvPxsEU.exe
  2⤵
  PID:12128
- C:\Windows\System\BEsTUuZ.exe
  C:\Windows\System\BEsTUuZ.exe
  2⤵
  PID:11704
- C:\Windows\System\WSHpCzR.exe
  C:\Windows\System\WSHpCzR.exe
  2⤵
  PID:10216
- C:\Windows\System\nxOAkAS.exe
  C:\Windows\System\nxOAkAS.exe
  2⤵
  PID:11984
- C:\Windows\System\unPMUSr.exe
  C:\Windows\System\unPMUSr.exe
  2⤵
  PID:12088
- C:\Windows\System\gjPrbRa.exe
  C:\Windows\System\gjPrbRa.exe
  2⤵
  PID:12552
- C:\Windows\System\YFlhpNp.exe
  C:\Windows\System\YFlhpNp.exe
  2⤵
  PID:12372
- C:\Windows\System\ZVWFWHJ.exe
  C:\Windows\System\ZVWFWHJ.exe
  2⤵
  PID:12276
- C:\Windows\System\CDFaVHp.exe
  C:\Windows\System\CDFaVHp.exe
  2⤵
  PID:12460
- C:\Windows\System\Kueoekh.exe
  C:\Windows\System\Kueoekh.exe
  2⤵
  PID:10924
- C:\Windows\System\rUDryxI.exe
  C:\Windows\System\rUDryxI.exe
  2⤵
  PID:10236
- C:\Windows\System\dBfNYeb.exe
  C:\Windows\System\dBfNYeb.exe
  2⤵
  PID:10844
- C:\Windows\System\HJGiyij.exe
  C:\Windows\System\HJGiyij.exe
  2⤵
  PID:11572
- C:\Windows\System\UCbqXBh.exe
  C:\Windows\System\UCbqXBh.exe
  2⤵
  PID:11152
- C:\Windows\System\VHBAXhf.exe
  C:\Windows\System\VHBAXhf.exe
  2⤵
  PID:12304
- C:\Windows\System\VvrJhjg.exe
  C:\Windows\System\VvrJhjg.exe
  2⤵
  PID:12336
- C:\Windows\System\NwkoXyd.exe
  C:\Windows\System\NwkoXyd.exe
  2⤵
  PID:12456
- C:\Windows\System\WcwzgWU.exe
  C:\Windows\System\WcwzgWU.exe
  2⤵
  PID:12632
- C:\Windows\System\caicRgK.exe
  C:\Windows\System\caicRgK.exe
  2⤵
  PID:12680
- C:\Windows\System\PcBeJkg.exe
  C:\Windows\System\PcBeJkg.exe
  2⤵
  PID:12776
- C:\Windows\System\evqCjsJ.exe
  C:\Windows\System\evqCjsJ.exe
  2⤵
  PID:12812
- C:\Windows\System\jOcLFHI.exe
  C:\Windows\System\jOcLFHI.exe
  2⤵
  PID:13204
- C:\Windows\System\ZcYwGzv.exe
  C:\Windows\System\ZcYwGzv.exe
  2⤵
  PID:13172
- C:\Windows\System\qLsTyCc.exe
  C:\Windows\System\qLsTyCc.exe
  2⤵
  PID:13268
- C:\Windows\System\rkjdErs.exe
  C:\Windows\System\rkjdErs.exe
  2⤵
  PID:11400
- C:\Windows\System\BPfChZw.exe
  C:\Windows\System\BPfChZw.exe
  2⤵
  PID:13244
- C:\Windows\System\IYDDZuB.exe
  C:\Windows\System\IYDDZuB.exe
  2⤵
  PID:4524
- C:\Windows\System\eYYfcvn.exe
  C:\Windows\System\eYYfcvn.exe
  2⤵
  PID:11324
- C:\Windows\System\MqWFkNY.exe
  C:\Windows\System\MqWFkNY.exe
  2⤵
  PID:4996
- C:\Windows\System\tYCbsST.exe
  C:\Windows\System\tYCbsST.exe
  2⤵
  PID:11992
- C:\Windows\System\vQmFqnC.exe
  C:\Windows\System\vQmFqnC.exe
  2⤵
  PID:11816
- C:\Windows\System\EAJJBHI.exe
  C:\Windows\System\EAJJBHI.exe
  2⤵
  PID:12352
- C:\Windows\System\MfbNMdW.exe
  C:\Windows\System\MfbNMdW.exe
  2⤵
  PID:12200
- C:\Windows\System\tDOTHZi.exe
  C:\Windows\System\tDOTHZi.exe
  2⤵
  PID:12436
- C:\Windows\System\YtsdHfj.exe
  C:\Windows\System\YtsdHfj.exe
  2⤵
  PID:9760
- C:\Windows\System\DvTPCUR.exe
  C:\Windows\System\DvTPCUR.exe
  2⤵
  PID:12300
- C:\Windows\System\duMVojb.exe
  C:\Windows\System\duMVojb.exe
  2⤵
  PID:10208
- C:\Windows\System\PGaDfWi.exe
  C:\Windows\System\PGaDfWi.exe
  2⤵
  PID:12836
- C:\Windows\System\qoTZcwO.exe
  C:\Windows\System\qoTZcwO.exe
  2⤵
  PID:12592
- C:\Windows\System\pCDkGAG.exe
  C:\Windows\System\pCDkGAG.exe
  2⤵
  PID:12616
- C:\Windows\System\kqjvafb.exe
  C:\Windows\System\kqjvafb.exe
  2⤵
  PID:4520
- C:\Windows\System\wbaxFIn.exe
  C:\Windows\System\wbaxFIn.exe
  2⤵
  PID:11084
- C:\Windows\System\inCcGAI.exe
  C:\Windows\System\inCcGAI.exe
  2⤵
  PID:11412
- C:\Windows\System\kzhWjAl.exe
  C:\Windows\System\kzhWjAl.exe
  2⤵
  PID:12768
- C:\Windows\System\PVWxEDR.exe
  C:\Windows\System\PVWxEDR.exe
  2⤵
  PID:3740
- C:\Windows\System\ZNgaFyX.exe
  C:\Windows\System\ZNgaFyX.exe
  2⤵
  PID:13388
- C:\Windows\System\SyGimPN.exe
  C:\Windows\System\SyGimPN.exe
  2⤵
  PID:13404
- C:\Windows\System\TCaZVRr.exe
  C:\Windows\System\TCaZVRr.exe
  2⤵
  PID:13452
- C:\Windows\System\bYFYrhO.exe
  C:\Windows\System\bYFYrhO.exe
  2⤵
  PID:13468
- C:\Windows\System\TWtJziK.exe
  C:\Windows\System\TWtJziK.exe
  2⤵
  PID:13492
- C:\Windows\System\jJRqpMS.exe
  C:\Windows\System\jJRqpMS.exe
  2⤵
  PID:13520
- C:\Windows\System\YXDkSNL.exe
  C:\Windows\System\YXDkSNL.exe
  2⤵
  PID:13540
- C:\Windows\System\vqzmEPk.exe
  C:\Windows\System\vqzmEPk.exe
  2⤵
  PID:13568
- C:\Windows\System\cMoGLNd.exe
  C:\Windows\System\cMoGLNd.exe
  2⤵
  PID:13584
- C:\Windows\System\MFWqmcp.exe
  C:\Windows\System\MFWqmcp.exe
  2⤵
  PID:13616
- C:\Windows\System\nZVGiPD.exe
  C:\Windows\System\nZVGiPD.exe
  2⤵
  PID:13648
- C:\Windows\System\gkGwTTL.exe
  C:\Windows\System\gkGwTTL.exe
  2⤵
  PID:13664
- C:\Windows\System\yLFNCHy.exe
  C:\Windows\System\yLFNCHy.exe
  2⤵
  PID:13680
- C:\Windows\System\pZpJCVW.exe
  C:\Windows\System\pZpJCVW.exe
  2⤵
  PID:13896
- C:\Windows\System\KXZTtZt.exe
  C:\Windows\System\KXZTtZt.exe
  2⤵
  PID:13928
- C:\Windows\System\LNgWhzW.exe
  C:\Windows\System\LNgWhzW.exe
  2⤵
  PID:13948
- C:\Windows\System\egIdAXQ.exe
  C:\Windows\System\egIdAXQ.exe
  2⤵
  PID:13964
- C:\Windows\System\EQfUFBO.exe
  C:\Windows\System\EQfUFBO.exe
  2⤵
  PID:13984
- C:\Windows\System\zZkGFmH.exe
  C:\Windows\System\zZkGFmH.exe
  2⤵
  PID:14008
- C:\Windows\System\oKQNlZd.exe
  C:\Windows\System\oKQNlZd.exe
  2⤵
  PID:14040
- C:\Windows\System\DoXESri.exe
  C:\Windows\System\DoXESri.exe
  2⤵
  PID:14056
- C:\Windows\System\YKYmLHC.exe
  C:\Windows\System\YKYmLHC.exe
  2⤵
  PID:14088
- C:\Windows\System\TPZuSMN.exe
  C:\Windows\System\TPZuSMN.exe
  2⤵
  PID:14104
- C:\Windows\System\msYGtOy.exe
  C:\Windows\System\msYGtOy.exe
  2⤵
  PID:14120
- C:\Windows\System\tcHvIdd.exe
  C:\Windows\System\tcHvIdd.exe
  2⤵
  PID:14176
- C:\Windows\System\npKygTR.exe
  C:\Windows\System\npKygTR.exe
  2⤵
  PID:14196
- C:\Windows\System\idjXFbA.exe
  C:\Windows\System\idjXFbA.exe
  2⤵
  PID:14228
- C:\Windows\System\NWlDvFT.exe
  C:\Windows\System\NWlDvFT.exe
  2⤵
  PID:14256
- C:\Windows\System\ZLcmZwN.exe
  C:\Windows\System\ZLcmZwN.exe
  2⤵
  PID:14272
- C:\Windows\System\mOYqCza.exe
  C:\Windows\System\mOYqCza.exe
  2⤵
  PID:14300
- C:\Windows\System\JvEixBv.exe
  C:\Windows\System\JvEixBv.exe
  2⤵
  PID:14320
- C:\Windows\System\gQdzynJ.exe
  C:\Windows\System\gQdzynJ.exe
  2⤵
  PID:4828
- C:\Windows\System\TfEfJTz.exe
  C:\Windows\System\TfEfJTz.exe
  2⤵
  PID:12952
- C:\Windows\System\BIUmqBK.exe
  C:\Windows\System\BIUmqBK.exe
  2⤵
  PID:11516
- C:\Windows\System\RBUaPwS.exe
  C:\Windows\System\RBUaPwS.exe
  2⤵
  PID:13416
- C:\Windows\System\KptmCgN.exe
  C:\Windows\System\KptmCgN.exe
  2⤵
  PID:13364
- C:\Windows\System\rocZYLF.exe
  C:\Windows\System\rocZYLF.exe
  2⤵
  PID:13376
- C:\Windows\System\QVfuBFZ.exe
  C:\Windows\System\QVfuBFZ.exe
  2⤵
  PID:13412
- C:\Windows\System\HwhklrM.exe
  C:\Windows\System\HwhklrM.exe
  2⤵
  PID:13488
- C:\Windows\System\PpqgPHm.exe
  C:\Windows\System\PpqgPHm.exe
  2⤵
  PID:13508
- C:\Windows\System\bzifkLw.exe
  C:\Windows\System\bzifkLw.exe
  2⤵
  PID:13536
- C:\Windows\System\CYKifmr.exe
  C:\Windows\System\CYKifmr.exe
  2⤵
  PID:13552
- C:\Windows\System\GzPmUAZ.exe
  C:\Windows\System\GzPmUAZ.exe
  2⤵
  PID:13660
- C:\Windows\System\ibbTRis.exe
  C:\Windows\System\ibbTRis.exe
  2⤵
  PID:13700
- C:\Windows\System\kwLHiWF.exe
  C:\Windows\System\kwLHiWF.exe
  2⤵
  PID:5888
- C:\Windows\System\tIhkCmO.exe
  C:\Windows\System\tIhkCmO.exe
  2⤵
  PID:13828
- C:\Windows\System\cLKPeUF.exe
  C:\Windows\System\cLKPeUF.exe
  2⤵
  PID:13848
- C:\Windows\System\phnPLSb.exe
  C:\Windows\System\phnPLSb.exe
  2⤵
  PID:2556
- C:\Windows\System\CRjyiJb.exe
  C:\Windows\System\CRjyiJb.exe
  2⤵
  PID:13912
- C:\Windows\System\CtXRvBy.exe
  C:\Windows\System\CtXRvBy.exe
  2⤵
  PID:13944
- C:\Windows\System\bZgbMYs.exe
  C:\Windows\System\bZgbMYs.exe
  2⤵
  PID:13996
- C:\Windows\System\wbObxTE.exe
  C:\Windows\System\wbObxTE.exe
  2⤵
  PID:14032
- C:\Windows\System\PlBYVAc.exe
  C:\Windows\System\PlBYVAc.exe
  2⤵
  PID:14064
- C:\Windows\System\LiPvxHS.exe
  C:\Windows\System\LiPvxHS.exe
  2⤵
  PID:14116
- C:\Windows\System\nuaYMXN.exe
  C:\Windows\System\nuaYMXN.exe
  2⤵
  PID:14132
- C:\Windows\System\mtiMuCy.exe
  C:\Windows\System\mtiMuCy.exe
  2⤵
  PID:1184
- C:\Windows\System\WMXJEMk.exe
  C:\Windows\System\WMXJEMk.exe
  2⤵
  PID:5244
- C:\Windows\System\BmMmZkj.exe
  C:\Windows\System\BmMmZkj.exe
  2⤵
  PID:4624
- C:\Windows\System\HBpqXNf.exe
  C:\Windows\System\HBpqXNf.exe
  2⤵
  PID:1964
- C:\Windows\System\dHsqnUP.exe
  C:\Windows\System\dHsqnUP.exe
  2⤵
  PID:14192
- C:\Windows\System\UraeiiJ.exe
  C:\Windows\System\UraeiiJ.exe
  2⤵
  PID:3296
- C:\Windows\System\xOnShWu.exe
  C:\Windows\System\xOnShWu.exe
  2⤵
  PID:4252
- C:\Windows\System\UgQnEgV.exe
  C:\Windows\System\UgQnEgV.exe
  2⤵
  PID:4972
- C:\Windows\System\gZstylv.exe
  C:\Windows\System\gZstylv.exe
  2⤵
  PID:1360
- C:\Windows\System\hvsTTiU.exe
  C:\Windows\System\hvsTTiU.exe
  2⤵
  PID:3084
- C:\Windows\System\aycqBDx.exe
  C:\Windows\System\aycqBDx.exe
  2⤵
  PID:1140
- C:\Windows\System\aujUoEB.exe
  C:\Windows\System\aujUoEB.exe
  2⤵
  PID:13608
- C:\Windows\System\CRAtOEn.exe
  C:\Windows\System\CRAtOEn.exe
  2⤵
  PID:4500
- C:\Windows\System\ssYCTel.exe
  C:\Windows\System\ssYCTel.exe
  2⤵
  PID:2636
- C:\Windows\System\ygoEsta.exe
  C:\Windows\System\ygoEsta.exe
  2⤵
  PID:2412
- C:\Windows\System\sQwtWKD.exe
  C:\Windows\System\sQwtWKD.exe
  2⤵
  PID:1708
- C:\Windows\System\bvAxmfS.exe
  C:\Windows\System\bvAxmfS.exe
  2⤵
  PID:13532
- C:\Windows\System\ADSDUTQ.exe
  C:\Windows\System\ADSDUTQ.exe
  2⤵
  PID:14364
- C:\Windows\System\fytvqJD.exe
  C:\Windows\System\fytvqJD.exe
  2⤵
  PID:14388
- C:\Windows\System\SynrlNG.exe
  C:\Windows\System\SynrlNG.exe
  2⤵
  PID:14412
- C:\Windows\System\iRMDnNe.exe
  C:\Windows\System\iRMDnNe.exe
  2⤵
  PID:14428
- C:\Windows\System\IEaLmWl.exe
  C:\Windows\System\IEaLmWl.exe
  2⤵
  PID:14448
- C:\Windows\System\pCPiapy.exe
  C:\Windows\System\pCPiapy.exe
  2⤵
  PID:14468
- C:\Windows\System\BdIlvFr.exe
  C:\Windows\System\BdIlvFr.exe
  2⤵
  PID:14488
- C:\Windows\System\WpLsiZr.exe
  C:\Windows\System\WpLsiZr.exe
  2⤵
  PID:14508
- C:\Windows\System\IHkJjxr.exe
  C:\Windows\System\IHkJjxr.exe
  2⤵
  PID:14532
- C:\Windows\System\jpPfCNu.exe
  C:\Windows\System\jpPfCNu.exe
  2⤵
  PID:14616
- C:\Windows\System\ZufcJSc.exe
  C:\Windows\System\ZufcJSc.exe
  2⤵
  PID:14632
- C:\Windows\System\kPmnsdh.exe
  C:\Windows\System\kPmnsdh.exe
  2⤵
  PID:14656
- C:\Windows\System\ghnwCkC.exe
  C:\Windows\System\ghnwCkC.exe
  2⤵
  PID:14672
- C:\Windows\System\ouEswHC.exe
  C:\Windows\System\ouEswHC.exe
  2⤵
  PID:14688
- C:\Windows\System\pubqwVx.exe
  C:\Windows\System\pubqwVx.exe
  2⤵
  PID:14708
- C:\Windows\System\YgfPGrr.exe
  C:\Windows\System\YgfPGrr.exe
  2⤵
  PID:14732
- C:\Windows\System\HpfTPLq.exe
  C:\Windows\System\HpfTPLq.exe
  2⤵
  PID:14748
- C:\Windows\System\CtrJnax.exe
  C:\Windows\System\CtrJnax.exe
  2⤵
  PID:14764
- C:\Windows\System\CKEitcu.exe
  C:\Windows\System\CKEitcu.exe
  2⤵
  PID:14780
- C:\Windows\System\jhiUJmU.exe
  C:\Windows\System\jhiUJmU.exe
  2⤵
  PID:14796
- C:\Windows\System\JhuCqnh.exe
  C:\Windows\System\JhuCqnh.exe
  2⤵
  PID:14816
- C:\Windows\System\yzXbMCu.exe
  C:\Windows\System\yzXbMCu.exe
  2⤵
  PID:14832
- C:\Windows\System\DKcUMub.exe
  C:\Windows\System\DKcUMub.exe
  2⤵
  PID:14848
- C:\Windows\System\mUoOnDF.exe
  C:\Windows\System\mUoOnDF.exe
  2⤵
  PID:14872
- C:\Windows\System\XBONUyL.exe
  C:\Windows\System\XBONUyL.exe
  2⤵
  PID:14892
- C:\Windows\System\FalmBth.exe
  C:\Windows\System\FalmBth.exe
  2⤵
  PID:14912
- C:\Windows\System\wGanvDv.exe
  C:\Windows\System\wGanvDv.exe
  2⤵
  PID:14940
- C:\Windows\System\gtxeKbO.exe
  C:\Windows\System\gtxeKbO.exe
  2⤵
  PID:14956
- C:\Windows\System\MRWttPz.exe
  C:\Windows\System\MRWttPz.exe
  2⤵
  PID:14972
- C:\Windows\System\ukwTQQP.exe
  C:\Windows\System\ukwTQQP.exe
  2⤵
  PID:14992
- C:\Windows\System\BcOrrRN.exe
  C:\Windows\System\BcOrrRN.exe
  2⤵
  PID:15016
- C:\Windows\System\JSPGZWB.exe
  C:\Windows\System\JSPGZWB.exe
  2⤵
  PID:15032
- C:\Windows\System\CAoICww.exe
  C:\Windows\System\CAoICww.exe
  2⤵
  PID:15048
- C:\Windows\System\ukKiOgq.exe
  C:\Windows\System\ukKiOgq.exe
  2⤵
  PID:15072
- C:\Windows\System\OBCzaAP.exe
  C:\Windows\System\OBCzaAP.exe
  2⤵
  PID:15092
- C:\Windows\System\hgKnIKW.exe
  C:\Windows\System\hgKnIKW.exe
  2⤵
  PID:15108
- C:\Windows\System\PfjJDRj.exe
  C:\Windows\System\PfjJDRj.exe
  2⤵
  PID:15128
- C:\Windows\System\glJuqYs.exe
  C:\Windows\System\glJuqYs.exe
  2⤵
  PID:15148
- C:\Windows\System\vlGFMDM.exe
  C:\Windows\System\vlGFMDM.exe
  2⤵
  PID:15168
- C:\Windows\System\lXuaSEr.exe
  C:\Windows\System\lXuaSEr.exe
  2⤵
  PID:15188
- C:\Windows\System\KWkcbwr.exe
  C:\Windows\System\KWkcbwr.exe
  2⤵
  PID:15204
- C:\Windows\System\kmBduFT.exe
  C:\Windows\System\kmBduFT.exe
  2⤵
  PID:15224
- C:\Windows\System\esmsRZm.exe
  C:\Windows\System\esmsRZm.exe
  2⤵
  PID:15244
- C:\Windows\System\BlQuuUe.exe
  C:\Windows\System\BlQuuUe.exe
  2⤵
  PID:15260
- C:\Windows\System\cmbkyYr.exe
  C:\Windows\System\cmbkyYr.exe
  2⤵
  PID:15280
- C:\Windows\System\ILgback.exe
  C:\Windows\System\ILgback.exe
  2⤵
  PID:15300
- C:\Windows\System\xirtkOZ.exe
  C:\Windows\System\xirtkOZ.exe
  2⤵
  PID:15316
- C:\Windows\System\pJgkVBA.exe
  C:\Windows\System\pJgkVBA.exe
  2⤵
  PID:15344
- C:\Windows\System\lPiOcJb.exe
  C:\Windows\System\lPiOcJb.exe
  2⤵
  PID:3600
- C:\Windows\System\ICcfftw.exe
  C:\Windows\System\ICcfftw.exe
  2⤵
  PID:1052
- C:\Windows\System\LtGAOMh.exe
  C:\Windows\System\LtGAOMh.exe
  2⤵
  PID:4328
- C:\Windows\System\kbVOSfR.exe
  C:\Windows\System\kbVOSfR.exe
  2⤵
  PID:2776
- C:\Windows\System\dUcwJPD.exe
  C:\Windows\System\dUcwJPD.exe
  2⤵
  PID:3828
- C:\Windows\System\jijCTHZ.exe
  C:\Windows\System\jijCTHZ.exe
  2⤵
  PID:392
- C:\Windows\System\WFgUsvU.exe
  C:\Windows\System\WFgUsvU.exe
  2⤵
  PID:14728
- C:\Windows\System\LbqXkkk.exe
  C:\Windows\System\LbqXkkk.exe
  2⤵
  PID:14568
- C:\Windows\System\fSgLJSp.exe
  C:\Windows\System\fSgLJSp.exe
  2⤵
  PID:14792
- C:\Windows\System\BHMkOuq.exe
  C:\Windows\System\BHMkOuq.exe
  2⤵
  PID:4632
- C:\Windows\System\JGZZFaq.exe
  C:\Windows\System\JGZZFaq.exe
  2⤵
  PID:14360
- C:\Windows\System\gJZnyzo.exe
  C:\Windows\System\gJZnyzo.exe
  2⤵
  PID:14436
- C:\Windows\System\IbaPJTm.exe
  C:\Windows\System\IbaPJTm.exe
  2⤵
  PID:14920
- C:\Windows\System\rdcKVOx.exe
  C:\Windows\System\rdcKVOx.exe
  2⤵
  PID:14496
- C:\Windows\System\OHWsRhs.exe
  C:\Windows\System\OHWsRhs.exe
  2⤵
  PID:14932
- C:\Windows\System\pYZhhzO.exe
  C:\Windows\System\pYZhhzO.exe
  2⤵
  PID:15008
- C:\Windows\System\RSmNzni.exe
  C:\Windows\System\RSmNzni.exe
  2⤵
  PID:3264
- C:\Windows\System\zeJpxwD.exe
  C:\Windows\System\zeJpxwD.exe
  2⤵
  PID:1160
- C:\Windows\System\LpVUOBQ.exe
  C:\Windows\System\LpVUOBQ.exe
  2⤵
  PID:13904
- C:\Windows\System\LaJdPFy.exe
  C:\Windows\System\LaJdPFy.exe
  2⤵
  PID:4676
- C:\Windows\System\lLFUnpb.exe
  C:\Windows\System\lLFUnpb.exe
  2⤵
  PID:3776
- C:\Windows\System\YTMIjDN.exe
  C:\Windows\System\YTMIjDN.exe
  2⤵
  PID:14700
- C:\Windows\System\emToamt.exe
  C:\Windows\System\emToamt.exe
  2⤵
  PID:4680
- C:\Windows\System\CbPqIjR.exe
  C:\Windows\System\CbPqIjR.exe
  2⤵
  PID:14788
- C:\Windows\System\phSyOAv.exe
  C:\Windows\System\phSyOAv.exe
  2⤵
  PID:14348
- C:\Windows\System\Xuqeofg.exe
  C:\Windows\System\Xuqeofg.exe
  2⤵
  PID:14904
- C:\Windows\System\hlhnWex.exe
  C:\Windows\System\hlhnWex.exe
  2⤵
  PID:14524
- C:\Windows\System\WtHDNHl.exe
  C:\Windows\System\WtHDNHl.exe
  2⤵
  PID:14988
- C:\Windows\System\cQRdoMd.exe
  C:\Windows\System\cQRdoMd.exe
  2⤵
  PID:14844
- C:\Windows\System\nQrWeqH.exe
  C:\Windows\System\nQrWeqH.exe
  2⤵
  PID:15004
- C:\Windows\System\JRiRTLY.exe
  C:\Windows\System\JRiRTLY.exe
  2⤵
  PID:1012
- C:\Windows\System\plQCavZ.exe
  C:\Windows\System\plQCavZ.exe
  2⤵
  PID:5732
- C:\Windows\System\RyXaAxe.exe
  C:\Windows\System\RyXaAxe.exe
  2⤵
  PID:5876
- C:\Windows\System\yrMmQWo.exe
  C:\Windows\System\yrMmQWo.exe
  2⤵
  PID:5812
- C:\Windows\System\qzqyXaf.exe
  C:\Windows\System\qzqyXaf.exe
  2⤵
  PID:548
- C:\Windows\System\HSATjJW.exe
  C:\Windows\System\HSATjJW.exe
  2⤵
  PID:5288
- C:\Windows\System\feMsbiL.exe
  C:\Windows\System\feMsbiL.exe
  2⤵
  PID:3164
- C:\Windows\System\FlMTQOt.exe
  C:\Windows\System\FlMTQOt.exe
  2⤵
  PID:5800
- C:\Windows\System\hCscurb.exe
  C:\Windows\System\hCscurb.exe
  2⤵
  PID:5908
- C:\Windows\System\quUVFzm.exe
  C:\Windows\System\quUVFzm.exe
  2⤵
  PID:3704
- C:\Windows\System\njPsXZD.exe
  C:\Windows\System\njPsXZD.exe
  2⤵
  PID:2304
- C:\Windows\System\kzwiGkF.exe
  C:\Windows\System\kzwiGkF.exe
  2⤵
  PID:5612
- C:\Windows\System\NggKfhz.exe
  C:\Windows\System\NggKfhz.exe
  2⤵
  PID:5828
- C:\Windows\System\flLSsBw.exe
  C:\Windows\System\flLSsBw.exe
  2⤵
  PID:15220
- C:\Windows\System\RNKINZg.exe
  C:\Windows\System\RNKINZg.exe
  2⤵
  PID:6164
- C:\Windows\System\MrWzSIT.exe
  C:\Windows\System\MrWzSIT.exe
  2⤵
  PID:14880
- C:\Windows\System\ZRKEhLo.exe
  C:\Windows\System\ZRKEhLo.exe
  2⤵
  PID:5304
- C:\Windows\System\bRvJLNq.exe
  C:\Windows\System\bRvJLNq.exe
  2⤵
  PID:5200
- C:\Windows\System\gkmWens.exe
  C:\Windows\System\gkmWens.exe
  2⤵
  PID:5212
- C:\Windows\System\nYTroEA.exe
  C:\Windows\System\nYTroEA.exe
  2⤵
  PID:15064
- C:\Windows\System\vvftQSQ.exe
  C:\Windows\System\vvftQSQ.exe
  2⤵
  PID:1824
- C:\Windows\System\hoMApTa.exe
  C:\Windows\System\hoMApTa.exe
  2⤵
  PID:15216
- C:\Windows\System\zjDDCIZ.exe
  C:\Windows\System\zjDDCIZ.exe
  2⤵
  PID:5736
- C:\Windows\System\DSsmhAX.exe
  C:\Windows\System\DSsmhAX.exe
  2⤵
  PID:5192
- C:\Windows\System\ZBOTqRx.exe
  C:\Windows\System\ZBOTqRx.exe
  2⤵
  PID:3724
- C:\Windows\System\sEQGfvN.exe
  C:\Windows\System\sEQGfvN.exe
  2⤵
  PID:14184
- C:\Windows\System\abxwmjJ.exe
  C:\Windows\System\abxwmjJ.exe
  2⤵
  PID:15368
- C:\Windows\System\sbcJvoT.exe
  C:\Windows\System\sbcJvoT.exe
  2⤵
  PID:15388
- C:\Windows\System\ljmiKuU.exe
  C:\Windows\System\ljmiKuU.exe
  2⤵
  PID:15404
- C:\Windows\System\SGsoQJZ.exe
  C:\Windows\System\SGsoQJZ.exe
  2⤵
  PID:15420
- C:\Windows\System\XMcaRhA.exe
  C:\Windows\System\XMcaRhA.exe
  2⤵
  PID:15436
- C:\Windows\System\CKrMREo.exe
  C:\Windows\System\CKrMREo.exe
  2⤵
  PID:15452
- C:\Windows\System\pCAPvdJ.exe
  C:\Windows\System\pCAPvdJ.exe
  2⤵
  PID:15472
- C:\Windows\System\aPkyGGD.exe
  C:\Windows\System\aPkyGGD.exe
  2⤵
  PID:15492
- C:\Windows\System\uOsYbpa.exe
  C:\Windows\System\uOsYbpa.exe
  2⤵
  PID:15512
- C:\Windows\System\sVbgMGL.exe
  C:\Windows\System\sVbgMGL.exe
  2⤵
  PID:15532
- C:\Windows\System\CKEpaaK.exe
  C:\Windows\System\CKEpaaK.exe
  2⤵
  PID:15552
- C:\Windows\System\HemoQCA.exe
  C:\Windows\System\HemoQCA.exe
  2⤵
  PID:15568
- C:\Windows\System\JTUzmwp.exe
  C:\Windows\System\JTUzmwp.exe
  2⤵
  PID:15584
- C:\Windows\System\hRtyLWH.exe
  C:\Windows\System\hRtyLWH.exe
  2⤵
  PID:15612
- C:\Windows\System\GcAzWiX.exe
  C:\Windows\System\GcAzWiX.exe
  2⤵
  PID:15632
- C:\Windows\System\YxYwfvi.exe
  C:\Windows\System\YxYwfvi.exe
  2⤵
  PID:15652
- C:\Windows\System\SpJniGO.exe
  C:\Windows\System\SpJniGO.exe
  2⤵
  PID:15676
- C:\Windows\System\QkfmrvP.exe
  C:\Windows\System\QkfmrvP.exe
  2⤵
  PID:15700
- C:\Windows\System\PFwmkWA.exe
  C:\Windows\System\PFwmkWA.exe
  2⤵
  PID:15728
- C:\Windows\System\kdrDfne.exe
  C:\Windows\System\kdrDfne.exe
  2⤵
  PID:15752
- C:\Windows\System\vjRGNTw.exe
  C:\Windows\System\vjRGNTw.exe
  2⤵
  PID:15772
- C:\Windows\System\NxyNOgI.exe
  C:\Windows\System\NxyNOgI.exe
  2⤵
  PID:15788
- C:\Windows\System\saCAUfz.exe
  C:\Windows\System\saCAUfz.exe
  2⤵
  PID:15804
- C:\Windows\System\mkQGqbc.exe
  C:\Windows\System\mkQGqbc.exe
  2⤵
  PID:15820
- C:\Windows\System\BxjyLpC.exe
  C:\Windows\System\BxjyLpC.exe
  2⤵
  PID:15836
- C:\Windows\System\WwzERPK.exe
  C:\Windows\System\WwzERPK.exe
  2⤵
  PID:15852
- C:\Windows\System\vfrmhCd.exe
  C:\Windows\System\vfrmhCd.exe
  2⤵
  PID:15868
- C:\Windows\System\aTwCOwS.exe
  C:\Windows\System\aTwCOwS.exe
  2⤵
  PID:15884
- C:\Windows\System\eaweslp.exe
  C:\Windows\System\eaweslp.exe
  2⤵
  PID:15900
- C:\Windows\System\GTrPNXL.exe
  C:\Windows\System\GTrPNXL.exe
  2⤵
  PID:15916
- C:\Windows\System\RmBuzMp.exe
  C:\Windows\System\RmBuzMp.exe
  2⤵
  PID:15932
- C:\Windows\System\tdhfHqj.exe
  C:\Windows\System\tdhfHqj.exe
  2⤵
  PID:15972
- C:\Windows\System\cBJjajT.exe
  C:\Windows\System\cBJjajT.exe
  2⤵
  PID:15992
- C:\Windows\System\XuyQxxG.exe
  C:\Windows\System\XuyQxxG.exe
  2⤵
  PID:16028
- C:\Windows\System\KzMakVg.exe
  C:\Windows\System\KzMakVg.exe
  2⤵
  PID:16044
- C:\Windows\System\tYfZTaq.exe
  C:\Windows\System\tYfZTaq.exe
  2⤵
  PID:16068
- C:\Windows\System\NJbyUsw.exe
  C:\Windows\System\NJbyUsw.exe
  2⤵
  PID:16088
- C:\Windows\System\NHkZdEa.exe
  C:\Windows\System\NHkZdEa.exe
  2⤵
  PID:16104
- C:\Windows\System\BbSxBxC.exe
  C:\Windows\System\BbSxBxC.exe
  2⤵
  PID:16140
- C:\Windows\System\vQCCVxS.exe
  C:\Windows\System\vQCCVxS.exe
  2⤵
  PID:16160
- C:\Windows\System\cHdlfdZ.exe
  C:\Windows\System\cHdlfdZ.exe
  2⤵
  PID:16176
- C:\Windows\System\onqwJKY.exe
  C:\Windows\System\onqwJKY.exe
  2⤵
  PID:16192
- C:\Windows\System\NtzpFbv.exe
  C:\Windows\System\NtzpFbv.exe
  2⤵
  PID:16208
- C:\Windows\System\oZlAKxb.exe
  C:\Windows\System\oZlAKxb.exe
  2⤵
  PID:16224
- C:\Windows\System\gUBaqgt.exe
  C:\Windows\System\gUBaqgt.exe
  2⤵
  PID:16240
- C:\Windows\System\XEHQBqr.exe
  C:\Windows\System\XEHQBqr.exe
  2⤵
  PID:16264
- C:\Windows\System\uJzanJL.exe
  C:\Windows\System\uJzanJL.exe
  2⤵
  PID:16344
- C:\Windows\System\UHiSzoa.exe
  C:\Windows\System\UHiSzoa.exe
  2⤵
  PID:16364
- C:\Windows\System\eDoamii.exe
  C:\Windows\System\eDoamii.exe
  2⤵
  PID:16380
- C:\Windows\System\jnqTeGz.exe
  C:\Windows\System\jnqTeGz.exe
  2⤵
  PID:5164
- C:\Windows\System\TAXXOet.exe
  C:\Windows\System\TAXXOet.exe
  2⤵
  PID:5188
- C:\Windows\System\hvluMHL.exe
  C:\Windows\System\hvluMHL.exe
  2⤵
  PID:5584
- C:\Windows\System\JtfsRVb.exe
  C:\Windows\System\JtfsRVb.exe
  2⤵
  PID:5664
- C:\Windows\System\oWgwRJY.exe
  C:\Windows\System\oWgwRJY.exe
  2⤵
  PID:6036
- C:\Windows\System\npoSkpJ.exe
  C:\Windows\System\npoSkpJ.exe
  2⤵
  PID:1848
- C:\Windows\System\OFyyYBJ.exe
  C:\Windows\System\OFyyYBJ.exe
  2⤵
  PID:3196
- C:\Windows\System\mbeDRdW.exe
  C:\Windows\System\mbeDRdW.exe
  2⤵
  PID:5012
- C:\Windows\System\IKWswQp.exe
  C:\Windows\System\IKWswQp.exe
  2⤵
  PID:15692
- C:\Windows\System\SOkCnso.exe
  C:\Windows\System\SOkCnso.exe
  2⤵
  PID:2704
- C:\Windows\System\pXMZqVG.exe
  C:\Windows\System\pXMZqVG.exe
  2⤵
  PID:15256
- C:\Windows\System\KSUZQmZ.exe
  C:\Windows\System\KSUZQmZ.exe
  2⤵
  PID:15236
- C:\Windows\System\UlRKUQy.exe
  C:\Windows\System\UlRKUQy.exe
  2⤵
  PID:15376
- C:\Windows\System\sufLMjx.exe
  C:\Windows\System\sufLMjx.exe
  2⤵
  PID:15668
- C:\Windows\System\dOoJUMO.exe
  C:\Windows\System\dOoJUMO.exe
  2⤵
  PID:15432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5276 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:9116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ARiEECn.exe

Filesize
1.7MB

MD5
1169d3c53ab441d2f3cb55ae60aee59b

SHA1
26b5ee4dbf9c53508041460fdd68e97fca1356c9

SHA256
89548a064d97c146996366d595126ca4e5ae752b40ea6c4c24a6778939c36273

SHA512
858b38b6972a0fa86a75b3c0f7adbbb54e8bd1f9d7a944f503085985eda764eebcad3babf00911531e33ee04b7e7170097964a3acc835622f125becad576549a

Download Submit
C:\Windows\System\CkrPptZ.exe

Filesize
1.7MB

MD5
b672bcfd4a3e0105d04a177973adcd3b

SHA1
eabfa68fc4ed88763c5f7bca1bafd5bfa909a172

SHA256
827f4cc81d11b49bb84d864dc18ba825d6f994e429d270b353a1eab82ff48e8b

SHA512
d1444135fd0139fb9bdcde10bf70f58dcf8539cb2b6dafffccd741fd3fdddb5cef55bf03eed1d10f0b183929a304132e30229c93887f1fb5dd7303c613806855

Download Submit
C:\Windows\System\FsmmVJu.exe

Filesize
1.7MB

MD5
06576a905627afaef462c0107a56fb25

SHA1
8f170ea42baf128e0f458651a7e9f2dbac290c0f

SHA256
3d72673a97c27d61add523a8326ce2dc49eae3515be3f65c1b768b4f8ffec878

SHA512
661e40949989380192fa861b821e2d3b3f5b8d4f026da896c302acf7767daa79f16ab2438d507b080d6a956e3fa936e23daad8215ef125c4975690b9668f7cc7

Download Submit
C:\Windows\System\GnXIbbW.exe

Filesize
1.7MB

MD5
eef77d2c2103e79052a4753e1a1e19ee

SHA1
295c12e069fadd1174b4861db408c918449ebf21

SHA256
ff59c4fc7ecb5d9614fe850609e30611304800a13facde48f19a840f78f96d50

SHA512
e14272fee0ca673f62364f61155b40bc5f763913f916cadd724b6c2e0fb1df8e3ae5e1fd24721093f4beb6a8463e045c7b193b7a172d9972382b76df0154ec85

Download Submit
C:\Windows\System\IhrcpzQ.exe

Filesize
1.7MB

MD5
af1f6c9bcb5e92fb450a9289b67dcf5c

SHA1
943b7f51d8296aacc92a2fee0a3cdae043eb98f7

SHA256
c727d1cf090671243ccab0f057e9dd9f5e7e3e27c6205539f1229a3a3bf2c6e0

SHA512
844f049bf1deb07a476ebb0fc99dfa790542bb2a91a8fac587e79e693c2d7002d775bcc3fa0d5f1d95b2a3d6b8a47faf26a310a6fc65b44605c97682c05a603c

Download Submit
C:\Windows\System\IiACJrl.exe

Filesize
1.7MB

MD5
13bad46b29574ffaeff1c38a25aaa416

SHA1
5f5e997f265391a8503b82054e60e3c42d71b0bb

SHA256
9de4d91eae84c1d766a5400e6de803cd13ab10914510ddc6b089bcd2635131cc

SHA512
3d8d3d379537ba922fb4e2df0322a0a2e6e15dc0a471d4ad297eb1dbee92e0bf630aee6b6adafc12ae1fc9c842a5e7780413390991500594d48422fc23e94451

Download Submit
C:\Windows\System\IpkFcKs.exe

Filesize
1.7MB

MD5
a46a98d53f1e3c93f726d08459fba556

SHA1
e73ac45f863fe2718d7dcb4bab83e7f67fdb6c72

SHA256
65540df3052153686d4fd07d318d904586c22c55666f0532df302b5320989f19

SHA512
404dae0b6e319ec47217a63c9a6c4cb767a40d6ff2cefff192436543ddff40273b7c17cc94a03b33c52719c98585694e322dc68b25fb860e8a5aff1fd06d1137

Download Submit
C:\Windows\System\KSqAjJh.exe

Filesize
1.7MB

MD5
bf0c222700e35dc336168416aee6e193

SHA1
fd6efd5715b903ddf729baabbaacbe1ae2bdc5f9

SHA256
5741c0606dcd315cac7f3e17316e4897bb9d81f437a3bfc5ddabcc8084cd6cab

SHA512
244d8c26515c29f600cf80a106c205c04673b6021b1e88aff9916aaf238ea339a98216a90184f152928449f04050c20242abae0b02c3858bc6fd9bb24dea7f35

Download Submit
C:\Windows\System\NkILQfO.exe

Filesize
1.7MB

MD5
d64e395b35751af51273c811a0138d99

SHA1
239da0f59098fd504aaf03015384be2cd04b4c6e

SHA256
49411c4d401265f1ba10bc187dbb4fc6b78f74583e9d5979110f95bd63617876

SHA512
804d7955ca999d8e89e25970b7c4ea614d7a59dc6ae1aadb57dd8365e14718b92d97e6bad392be1be1a0b8d7501ed6def032ecd2389d0ebd02ee3ca579121a3d

Download Submit
C:\Windows\System\PArJuSf.exe

Filesize
1.7MB

MD5
45de39c07bd6d4bb6809de21d9a941b0

SHA1
2ed33d33b8fca27d2da038182370b1f0b9c2b8df

SHA256
bb5866118bed4a3b8e2a1232718607ca63631a3f4cacb30e3c404277f11f02e1

SHA512
eb40d02d33b4bfd1c5cd39fae010b79e52ef3017dd71395aeab4f9bc81c984d3c07aa39cba188711d2b7c9087bf82906e822c4260b23afcbaa6c97efd488ed86

Download Submit
C:\Windows\System\UQlNUNp.exe

Filesize
1.7MB

MD5
57f7d4e63803153121c4a4b557409a78

SHA1
32bb3bdbdc3504d6b243fa0681082b7654d14215

SHA256
eb1bdf3841826e7db7b0775c35c7c88940f6a8fb96a48a381c4e25440603b748

SHA512
fe26f3ed21e59d42b680385aaadd18a12194721fa2ff02f36d04d287db0ad5c4443299d6b1c45d990bd08fb1e849318456559ee95e8abf9efc2075de5b8500e0

Download Submit
C:\Windows\System\VvfTHCT.exe

Filesize
1.7MB

MD5
a9bd57ceb0dfd76a83ee67c6b549cd85

SHA1
8e128a9b6086326b4ab770bd21bd7bbf17a756c3

SHA256
263f795a8da592290ef2dc3756a99803740c674b64587baed532ba1115cd8805

SHA512
f0d904c420bacec4163a8fa48479fec57d537fc0c9858e5fd08f7484e62f921ac276d62f3a7a2f280313056a05259a335f99181f6ad2b17a43afe2ee05236a49

Download Submit
C:\Windows\System\WLXaKPB.exe

Filesize
1.7MB

MD5
32c7246aa87bba59607ddc9ba6890d3f

SHA1
5be6c0bc35ed0846a7696c5d87295e4e0a2418d3

SHA256
7630179f2a27f0538432f8d99f5198eddde996f2d4fda2c5f0f3115eae606b8a

SHA512
0611198507988231072e573aaac4dc3d7c2b0b70aaebfc6d03a7cb84089869d83132aa7f5cb700bd34597e809c8aeb0631467a09761af9e1203f49fda11a9f56

Download Submit
C:\Windows\System\btIwXDa.exe

Filesize
1.7MB

MD5
bb4ca9b7d626a5bd3eeb98fade9b00b9

SHA1
9edf6abe78e50ea6c709f1006360b068e623f6e2

SHA256
2830c3c27de8f2a993702300e4f4c3468ea2cd23c0d926c02e6ee6d1692adb33

SHA512
cc2428356f65767373a4d9c64cb7a95166f0a1d53e45751c1b5e10d9daaa823be62d133833cf390a11be6e7d85f4e102b6ad061280a5e7b3fa1cc0445bc325b5

Download Submit
C:\Windows\System\fSdPIyG.exe

Filesize
1.7MB

MD5
6150383451f91a077024fbcd5f2ab352

SHA1
24443351216594e8a15b92ddb263a5a585d4428b

SHA256
d33dd004eeb5835c4567ecde9c4d037196ee9554f7703bd5c958020bc50d1e53

SHA512
1a9595485e81ad5508c99fb738e12fa4df8cde9aedab2069baee38cdc1c0b50d892c665c0d76819cdb748d20bc09262f9e75b54f132ea2a6eb0dedd9cb070cdc

Download Submit
C:\Windows\System\gyZpAQw.exe

Filesize
1.7MB

MD5
14075f6a9eb67627c37bfc9e6f0fe802

SHA1
ee42d6e07766f1bde91e0b7f7369908ca8a8a49b

SHA256
71506af0565762f86c3528625f7e4ce1dbd20bcc99b0317c3ae12577d82e0065

SHA512
a7191b7e0a01e7e32fda641b471afececf3c1a41e0f596f067e5e87c8f5973ed46bfee7390863cd62827c831d21277279cb92719fc7d9194fd014bcb21382e72

Download Submit
C:\Windows\System\liIDYRE.exe

Filesize
1.7MB

MD5
e3e76d62a87e883cc5a5ee9b450bfb92

SHA1
c6e414e7611c6e5ae303df84fc77921cf5f65a64

SHA256
60ffae146b0b5eeb3d2cbb31e8b0ece1e70e5e199001e445d27702a50ac286e8

SHA512
4526f4beca241b2081d459edba2a1a9af3deaaebd4dbdaf5880a9d2f7944c9a0cb42f9846e066d2bb44c1c486ec3668826463d905427c12aa5e5410d256deb8d

Download Submit
C:\Windows\System\mCfUsGn.exe

Filesize
1.7MB

MD5
fa940a848dca41575c3e6c68b1031234

SHA1
c591f83f763aa41d210ce39bc8300183e6e8219b

SHA256
4b7fa31d38d4e96e1792e2fdbc7ed8335c98af48fcaeeae116d0e094c454ee21

SHA512
47766ac7341ecd98b9d15f8b87264a6865b01e2511242b99944401a38f579975e26c374b188608961b258a053a577daf2b8cea436b1d73dad992fa9a6ec1eb50

Download Submit
C:\Windows\System\mMUDyYC.exe

Filesize
1.7MB

MD5
4faf558541bdedf2a82046ce991d5310

SHA1
5a131788e7f43dfe8d0e75f0611af27e6fcf938c

SHA256
1a1b22d0db795854f2c14a97cb3a53a93f70b80a6778eefb8bdd833755481052

SHA512
bf4f840c6af42e1344e2e2e0c9e15d5e4d3c2d069c62e517814ac887340037173b709ed2cac4a7bd7162296aa1178a7aae80427c3019858248fd9e6a69e91b77

Download Submit
C:\Windows\System\mhqRDrV.exe

Filesize
1.7MB

MD5
8a59684c756d2337b2f6b079fac805a8

SHA1
1c177e426459a4e439e4ad31f1cb14a766630b2f

SHA256
b013d06f096c7ac99ac0b486ace422050e47ac098a3e8be575eccaab2deedf54

SHA512
8cd1dc5031b5c10b43a3710fc7a09de9e5aef4a0f4d7c0df49936e272a8b40aeace0671d74c87019d328571131e4e86c14ff81a13b641f538380d27b0cbd223d

Download Submit
C:\Windows\System\nUOBAde.exe

Filesize
1.7MB

MD5
4a72a6c198cab44da9681dc36b96b394

SHA1
b00187ed292e2e554522deeed861bddaa2b7943f

SHA256
f0358be0852b24ee2b30525c6a1237419128d8c68fea79436dd99765fd393ef5

SHA512
d9c913e44997e891dc41e536d8ab0a6e87c863b4e28dd4bf1007423203285afb81f363f9e38d524880ac6ca7b21669f1ff9d666addf424e41b1cc2b4a21b95fd

Download Submit
C:\Windows\System\oPMOlpL.exe

Filesize
1.7MB

MD5
5b1c80b78b119aab647ba23ff58366d5

SHA1
4968e8f4f227fbe17592cb3a46aa1862368388cb

SHA256
0d51fedc2f25ba3d69c719216d3323a42071f2ca0fc3d07c6001872c2925dec6

SHA512
766d04679cacbb3789959c9749185df9e1d6a81c60d8c1b7b7fecdb81bf02a27aae34ec01572d45f9eb2a21d7354ac0633a6540e2eeba51d22e522dc43bf9af5

Download Submit
C:\Windows\System\pYoQkbI.exe

Filesize
1.7MB

MD5
4001a0f7d12b600a897de178c2548050

SHA1
ae0e985e47d29a313ad00e4e0a020e5a7771c43c

SHA256
5040ae9c71ea27753f3b8ae2c786f401128bf96466d86da39da74a9048034730

SHA512
9e120646925736d108953ac7e5e3211a6fe5a50ee9a39150591b6fe2eb909e727e9b63a65a62016ce54bd9f4411b0a7ac21eaa2b7ad9ac318aa3d2f7247350f6

Download Submit
C:\Windows\System\qFopyxT.exe

Filesize
1.7MB

MD5
60eccfbd82246a4d7ca5ab825ac65398

SHA1
2dfb89b7c10d1151933c2bc3e2e85802a82d1dac

SHA256
3ebf3f37b960d6a38163668dd51d1af3b4b68345a72702fc8061af3a74aee525

SHA512
a44920ab1939ccbe2ab7f13edaad3b40c232e7e46517f32cca03c72fd128c196e24b6e5f64494f48ef87e62f94f67e3d452c840bd098914555286c742d5994c4

Download Submit
C:\Windows\System\sdTZCRI.exe

Filesize
1.7MB

MD5
19b663642690a98f1a211b9a9d6b5f64

SHA1
f91c4cd5b8e8180e192e2ee451c7e6dc99657e60

SHA256
1c40eeff6685429610ccf12e6c25ff299d1c228a5c9293be89f653fac631cbfc

SHA512
e2b18853a9b6b917e53e171a1fcd7adb988def6065b28b57c850bd1faba5853c38f2a8dfe2eb4c0d5915fd66be3fa3624ddeb4bda33aaf0d3f5b0bb482008810

Download Submit
C:\Windows\System\tbKqdbP.exe

Filesize
1.7MB

MD5
9bb94e979a9e5a50fe1e8302e6c88b85

SHA1
c9d4226003bd086491506bce75509842fad22d80

SHA256
b1befecf8688132f7764855faa66a2ad8ae1cb43be339e74f4851971cf6abb3d

SHA512
bbe3319c007ce349e4f6e01dff41c48efd8442ecaf25c84a57f040747d390ae23b5ec81d4259163602aa99e2265ef9adf4325630d94836fad66a0c6b0ca91110

Download Submit
C:\Windows\System\uOwEpFL.exe

Filesize
1.7MB

MD5
9ced437f4367c050cd63170ebbb20907

SHA1
f4951e1475ecf3a2d8d824034187d9bf1c33e9b0

SHA256
92d7f309c872d7ee9e98048a9938394c17e2159a9d24ad71d372735e4410f1a8

SHA512
45a3e967b9d05e2ac847d356c8f47d699c05e1aa988eb442c9f0753ff65ee3227f240200df8bfdeac131e07a2fcd653cf7abe9e22087df7c0d41aedd34ccf873

Download Submit
C:\Windows\System\uknNprj.exe

Filesize
1.7MB

MD5
d0d0ceb9a748be1ff39df15497be8614

SHA1
6e4731d0032b8545b6ac6c4cf74cbb42c13046f2

SHA256
555f6376f2f92e217097a3e5fc2416470102c376441dffdd347fd09b7d0bdf34

SHA512
496e528150d05fc8db2e22a75b2b33444735cb7cada80c61db72ee4c7c2b63f4d3770f1842c76dc9fe2caec093adfeb0948cafd8af93fc6ea1c4fbb727d09642

Download Submit
C:\Windows\System\wQpwRct.exe

Filesize
1.7MB

MD5
70709e6400964aa4ffae1ee1fe6c8ab1

SHA1
a5f450a478d55174bf457292d5fe09924ad3f3ef

SHA256
1ecba05e77b39dd6c0e81968980e224bc25da2e8ea47d879905e4b9995902f4a

SHA512
923560b47d93ada8aa0f2f3f91c428810d8266e564016efc4a6deab1dea075683100edb82be160b412d5bf9996d0c089f49c5d102678a533f518755329e57d06

Download Submit
C:\Windows\System\wXxhOWw.exe

Filesize
1.7MB

MD5
c559b2079e57f504953e331c47dfb945

SHA1
442b7ba8cf5ec6fe2e89319fa4fc38cf0f806115

SHA256
96b854afab1adfd985f044fb5364528fb05ac1564b3e24af49b0d0c8f0a2c0ad

SHA512
ccf35de833f37439ea0407eb679cee22b7f9340dd9524b2de05ad7c2e85f19354a826fa0832a89d85ac885ee5e3dfede8799cab1373bfdce725a77689bca5938

Download Submit
C:\Windows\System\xxlvmlN.exe

Filesize
1.7MB

MD5
8c2fc65ed3d6111335100ab78ff9d9a1

SHA1
1343505947ac95c5f52f3282b6482acbfa297fcb

SHA256
2503f21b0137511400f7e7869e12ef244b0aad6ac8adf4b1b9776543431a8fc1

SHA512
2c6c4b6d58561b87ce857eaf851cf607bb354b4ca48fb496bb38ee167c6465d9e60c2ff8b0cc405d2b9546337625f471fac5775578c75687641d25a025caa42e

Download Submit
C:\Windows\System\yElcxil.exe

Filesize
1.7MB

MD5
ff73b6cc8f7f3366edaba6da61d20096

SHA1
e56b4b016f24260688a43b4ddc26e1947e230321

SHA256
83f0aa72279c3b4e864d1c61275284df9ade61781ac341e51af409957388813b

SHA512
ff9f9788e6a55798c00957c018b02b09bfd2244a5ce783edab1183be0985c78db9649b8db40035aa0f6f0fd9336400aa8797087120fa6fd0c1d501b303d590af

Download Submit
C:\Windows\System\zgxUmnr.exe

Filesize
1.7MB

MD5
dbb14c336323fb4c9f7d454c5e68f8b6

SHA1
6d6298797970685496a753f28d8c673989e529d9

SHA256
e7aba9814995f48906810d3637adcf6eb050e220deefab0d06316497b32278b8

SHA512
67dc16d1f6046f48ac42d599530b6204cd730263584268cb0f3769f997744b6b5fc063fb2d951f4ad68b469d8a6035762aff478dd77a9e44bf2cfc8c90ba9912

Download Submit
memory/532-85-0x00007FF77AC00000-0x00007FF77AF51000-memory.dmp

Filesize
3.3MB

Download
memory/848-2094-0x00007FF70A950000-0x00007FF70ACA1000-memory.dmp

Filesize
3.3MB

Download
memory/848-42-0x00007FF70A950000-0x00007FF70ACA1000-memory.dmp

Filesize
3.3MB

Download
memory/1036-448-0x00007FF62D1E0000-0x00007FF62D531000-memory.dmp

Filesize
3.3MB

Download
memory/1036-2135-0x00007FF62D1E0000-0x00007FF62D531000-memory.dmp

Filesize
3.3MB

Download
memory/1040-93-0x00007FF664220000-0x00007FF664571000-memory.dmp

Filesize
3.3MB

Download
memory/1040-2116-0x00007FF664220000-0x00007FF664571000-memory.dmp

Filesize
3.3MB

Download
memory/1312-439-0x00007FF6E9B30000-0x00007FF6E9E81000-memory.dmp

Filesize
3.3MB

Download
memory/1312-2157-0x00007FF6E9B30000-0x00007FF6E9E81000-memory.dmp

Filesize
3.3MB

Download
memory/1456-433-0x00007FF7E6270000-0x00007FF7E65C1000-memory.dmp

Filesize
3.3MB

Download
memory/1456-2125-0x00007FF7E6270000-0x00007FF7E65C1000-memory.dmp

Filesize
3.3MB

Download
memory/1568-99-0x00007FF746D40000-0x00007FF747091000-memory.dmp

Filesize
3.3MB

Download
memory/1568-2115-0x00007FF746D40000-0x00007FF747091000-memory.dmp

Filesize
3.3MB

Download
memory/1572-2097-0x00007FF656E10000-0x00007FF657161000-memory.dmp

Filesize
3.3MB

Download
memory/1572-30-0x00007FF656E10000-0x00007FF657161000-memory.dmp

Filesize
3.3MB

Download
memory/1972-0-0x00007FF664980000-0x00007FF664CD1000-memory.dmp

Filesize
3.3MB

Download
memory/1972-1-0x00000167C7980000-0x00000167C7990000-memory.dmp

Filesize
64KB

Download
memory/1972-91-0x00007FF664980000-0x00007FF664CD1000-memory.dmp

Filesize
3.3MB

Download
memory/2076-2096-0x00007FF79A290000-0x00007FF79A5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2076-61-0x00007FF79A290000-0x00007FF79A5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2240-28-0x00007FF675BE0000-0x00007FF675F31000-memory.dmp

Filesize
3.3MB

Download
memory/2280-428-0x00007FF619810000-0x00007FF619B61000-memory.dmp

Filesize
3.3MB

Download
memory/2280-2124-0x00007FF619810000-0x00007FF619B61000-memory.dmp

Filesize
3.3MB

Download
memory/2628-71-0x00007FF7A4710000-0x00007FF7A4A61000-memory.dmp

Filesize
3.3MB

Download
memory/2628-2114-0x00007FF7A4710000-0x00007FF7A4A61000-memory.dmp

Filesize
3.3MB

Download
memory/2924-68-0x00007FF6D47F0000-0x00007FF6D4B41000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2113-0x00007FF6D47F0000-0x00007FF6D4B41000-memory.dmp

Filesize
3.3MB

Download
memory/2980-2095-0x00007FF6373B0000-0x00007FF637701000-memory.dmp

Filesize
3.3MB

Download
memory/2980-63-0x00007FF6373B0000-0x00007FF637701000-memory.dmp

Filesize
3.3MB

Download
memory/3032-2165-0x00007FF6A5790000-0x00007FF6A5AE1000-memory.dmp

Filesize
3.3MB

Download
memory/3032-492-0x00007FF6A5790000-0x00007FF6A5AE1000-memory.dmp

Filesize
3.3MB

Download
memory/3468-26-0x00007FF7E67D0000-0x00007FF7E6B21000-memory.dmp

Filesize
3.3MB

Download
memory/3480-466-0x00007FF734BA0000-0x00007FF734EF1000-memory.dmp

Filesize
3.3MB

Download
memory/3480-2143-0x00007FF734BA0000-0x00007FF734EF1000-memory.dmp

Filesize
3.3MB

Download
memory/3624-2144-0x00007FF646200000-0x00007FF646551000-memory.dmp

Filesize
3.3MB

Download
memory/3624-463-0x00007FF646200000-0x00007FF646551000-memory.dmp

Filesize
3.3MB

Download
memory/3632-2152-0x00007FF78FC00000-0x00007FF78FF51000-memory.dmp

Filesize
3.3MB

Download
memory/3632-495-0x00007FF78FC00000-0x00007FF78FF51000-memory.dmp

Filesize
3.3MB

Download
memory/3996-80-0x00007FF704970000-0x00007FF704CC1000-memory.dmp

Filesize
3.3MB

Download
memory/3996-2119-0x00007FF704970000-0x00007FF704CC1000-memory.dmp

Filesize
3.3MB

Download
memory/4036-2154-0x00007FF671E30000-0x00007FF672181000-memory.dmp

Filesize
3.3MB

Download
memory/4036-504-0x00007FF671E30000-0x00007FF672181000-memory.dmp

Filesize
3.3MB

Download
memory/4352-2082-0x00007FF7A22F0000-0x00007FF7A2641000-memory.dmp

Filesize
3.3MB

Download
memory/4352-27-0x00007FF7A22F0000-0x00007FF7A2641000-memory.dmp

Filesize
3.3MB

Download
memory/4460-2147-0x00007FF79C660000-0x00007FF79C9B1000-memory.dmp

Filesize
3.3MB

Download
memory/4460-487-0x00007FF79C660000-0x00007FF79C9B1000-memory.dmp

Filesize
3.3MB

Download
memory/4492-471-0x00007FF707B10000-0x00007FF707E61000-memory.dmp

Filesize
3.3MB

Download
memory/4492-2149-0x00007FF707B10000-0x00007FF707E61000-memory.dmp

Filesize
3.3MB

Download
memory/4596-2151-0x00007FF71D8F0000-0x00007FF71DC41000-memory.dmp

Filesize
3.3MB

Download
memory/4596-498-0x00007FF71D8F0000-0x00007FF71DC41000-memory.dmp

Filesize
3.3MB

Download
memory/4752-424-0x00007FF61B460000-0x00007FF61B7B1000-memory.dmp

Filesize
3.3MB

Download
memory/4752-2131-0x00007FF61B460000-0x00007FF61B7B1000-memory.dmp

Filesize
3.3MB

Download
memory/4760-405-0x00007FF6A5750000-0x00007FF6A5AA1000-memory.dmp

Filesize
3.3MB

Download
memory/4760-1987-0x00007FF6A5750000-0x00007FF6A5AA1000-memory.dmp

Filesize
3.3MB

Download
memory/4760-15-0x00007FF6A5750000-0x00007FF6A5AA1000-memory.dmp

Filesize
3.3MB

Download
memory/4848-72-0x00007FF6128A0000-0x00007FF612BF1000-memory.dmp

Filesize
3.3MB

Download
memory/4848-2112-0x00007FF6128A0000-0x00007FF612BF1000-memory.dmp

Filesize
3.3MB

Download
memory/4896-96-0x00007FF7B7970000-0x00007FF7B7CC1000-memory.dmp

Filesize
3.3MB

Download
memory/4896-1968-0x00007FF7B7970000-0x00007FF7B7CC1000-memory.dmp

Filesize
3.3MB

Download
memory/4896-7-0x00007FF7B7970000-0x00007FF7B7CC1000-memory.dmp

Filesize
3.3MB

Download