xmrig | 8f7030cd28c86201dae6a289023b1baa77fe3ee32b729c56dcf0a273d785d10e

Analysis

max time kernel
134s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
Size

2.7MB
MD5

b522135bdc40bfef1386435c05520c30
SHA1

ad515e223fdbd58731fc15d7420b15c86821581f
SHA256

8f7030cd28c86201dae6a289023b1baa77fe3ee32b729c56dcf0a273d785d10e
SHA512

697b42028b7a74262f98c5398026b1335a02a816c4217252e864e79d7d135635006925b75d4c7ac8ce32ee9112b9f0a139502076002d781674f7e25acd76bd17
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHg:BemTLkNdfE0pZrz

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2680-16-0x000000013F2F0000-0x000000013F644000-memory.dmp	xmrig
behavioral1/files/0x0024000000015c23-15.dat	xmrig
behavioral1/memory/1368-22-0x000000013F0C0000-0x000000013F414000-memory.dmp	xmrig
behavioral1/memory/2944-23-0x000000013F0C0000-0x000000013F414000-memory.dmp	xmrig
behavioral1/files/0x0007000000015c69-24.dat	xmrig
behavioral1/memory/1368-25-0x00000000020C0000-0x0000000002414000-memory.dmp	xmrig
behavioral1/memory/2584-21-0x000000013F500000-0x000000013F854000-memory.dmp	xmrig
behavioral1/files/0x0008000000015c5d-17.dat	xmrig
behavioral1/files/0x000b0000000155e2-6.dat	xmrig
behavioral1/memory/1368-0-0x000000013F590000-0x000000013F8E4000-memory.dmp	xmrig
behavioral1/memory/2672-36-0x000000013F6B0000-0x000000013FA04000-memory.dmp	xmrig
behavioral1/files/0x0007000000015c7c-35.dat	xmrig
behavioral1/memory/2196-57-0x000000013FCF0000-0x0000000140044000-memory.dmp	xmrig
behavioral1/memory/2712-65-0x000000013F6E0000-0x000000013FA34000-memory.dmp	xmrig
behavioral1/memory/2396-68-0x000000013F7F0000-0x000000013FB44000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b37-105.dat	xmrig
behavioral1/files/0x0006000000018b42-113.dat	xmrig
behavioral1/files/0x0006000000018d06-142.dat	xmrig
behavioral1/files/0x0005000000019333-161.dat	xmrig
behavioral1/memory/1368-628-0x000000013F590000-0x000000013F8E4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019410-182.dat	xmrig
behavioral1/files/0x0005000000019368-177.dat	xmrig
behavioral1/files/0x000500000001939b-173.dat	xmrig
behavioral1/files/0x000500000001931b-158.dat	xmrig
behavioral1/files/0x000500000001946b-189.dat	xmrig
behavioral1/files/0x00050000000193b0-180.dat	xmrig
behavioral1/files/0x0005000000019377-171.dat	xmrig
behavioral1/files/0x00050000000192f4-153.dat	xmrig
behavioral1/files/0x00050000000192c9-148.dat	xmrig
behavioral1/files/0x0006000000018ba2-138.dat	xmrig
behavioral1/files/0x0006000000018b96-132.dat	xmrig
behavioral1/files/0x0006000000018b73-128.dat	xmrig
behavioral1/files/0x0006000000018b6a-123.dat	xmrig
behavioral1/files/0x0006000000018b4a-118.dat	xmrig
behavioral1/files/0x0006000000018b15-104.dat	xmrig
behavioral1/files/0x0006000000018ae2-103.dat	xmrig
behavioral1/memory/1368-102-0x00000000020C0000-0x0000000002414000-memory.dmp	xmrig
behavioral1/memory/1984-101-0x000000013F1C0000-0x000000013F514000-memory.dmp	xmrig
behavioral1/memory/2376-98-0x000000013FB40000-0x000000013FE94000-memory.dmp	xmrig
behavioral1/memory/1368-97-0x000000013FB40000-0x000000013FE94000-memory.dmp	xmrig
behavioral1/memory/752-96-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/files/0x00050000000186a0-75.dat	xmrig
behavioral1/files/0x0005000000018698-67.dat	xmrig
behavioral1/files/0x0006000000018b33-88.dat	xmrig
behavioral1/files/0x0006000000018ae8-80.dat	xmrig
behavioral1/files/0x0009000000015d88-62.dat	xmrig
behavioral1/memory/2128-61-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig
behavioral1/memory/2432-60-0x000000013F970000-0x000000013FCC4000-memory.dmp	xmrig
behavioral1/memory/1368-58-0x000000013F020000-0x000000013F374000-memory.dmp	xmrig
behavioral1/memory/1368-52-0x00000000020C0000-0x0000000002414000-memory.dmp	xmrig
behavioral1/files/0x000500000001868c-51.dat	xmrig
behavioral1/files/0x0014000000015c2f-50.dat	xmrig
behavioral1/files/0x0007000000015c87-45.dat	xmrig
behavioral1/memory/2644-48-0x000000013F020000-0x000000013F374000-memory.dmp	xmrig
behavioral1/memory/2672-2222-0x000000013F6B0000-0x000000013FA04000-memory.dmp	xmrig
behavioral1/memory/752-2876-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/memory/2432-2887-0x000000013F970000-0x000000013FCC4000-memory.dmp	xmrig
behavioral1/memory/2196-2907-0x000000013FCF0000-0x0000000140044000-memory.dmp	xmrig
behavioral1/memory/2644-2908-0x000000013F020000-0x000000013F374000-memory.dmp	xmrig
behavioral1/memory/2128-2910-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig
behavioral1/memory/2680-2911-0x000000013F2F0000-0x000000013F644000-memory.dmp	xmrig
behavioral1/memory/2584-2916-0x000000013F500000-0x000000013F854000-memory.dmp	xmrig
behavioral1/memory/2672-2942-0x000000013F6B0000-0x000000013FA04000-memory.dmp	xmrig
behavioral1/memory/2944-2933-0x000000013F0C0000-0x000000013F414000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2680	HQHxKIb.exe
2584	OkcjsfS.exe
2944	eJtKexk.exe
2672	zASUFxZ.exe
2644	sKrrKvk.exe
2432	oWMfSfs.exe
2128	hZGxzoA.exe
2196	NiBAKZx.exe
2712	EBQftEb.exe
2396	vgGwfFk.exe
752	Fnvunee.exe
2376	PXjCcAY.exe
1984	swgSMPZ.exe
1492	sytUPaB.exe
1888	MptOEHR.exe
904	PMAproS.exe
760	kmhLnMC.exe
1092	ckcpLRX.exe
1172	ygnREPe.exe
1176	DPhWajE.exe
1704	rcsoILG.exe
2216	qrTxfvD.exe
1180	nFfOeWh.exe
1088	gHjsdBP.exe
1644	KgMdLxh.exe
1540	BpLmevj.exe
2256	AWJOjZp.exe
2740	kiVrTxe.exe
2976	baUBfJG.exe
2924	NNEWZSr.exe
1900	sEkBUEC.exe
436	NduuMeU.exe
1848	YRKIHko.exe
2260	Giujwys.exe
2996	OGqKKVz.exe
1628	eTgeZbM.exe
3060	NkBUSon.exe
2016	mYCdtQt.exe
932	ulceGaa.exe
976	DWjKRCr.exe
1624	QSFrmva.exe
2824	nEHOmii.exe
1428	JPEGHta.exe
1664	TRnIXzV.exe
1820	XqIFNNF.exe
972	CBgiwLA.exe
980	WopJuCf.exe
2820	ppJmTok.exe
2808	eoLUlRI.exe
1388	JIpkYKO.exe
2252	arDKtrT.exe
1412	iPXWHfK.exe
2764	PCADDIO.exe
1872	QbZYvyV.exe
1508	UpVMAnU.exe
2480	xElyalz.exe
1396	mmjPWCX.exe
1608	amFZQfF.exe
2536	GKMiQcJ.exe
2620	uGdCjEq.exe
2056	HtOVNMi.exe
2484	vEHeeps.exe
2872	jdsJsal.exe
844	uPhJcNU.exe

Loads dropped DLL 64 IoCs

pid	Process
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2680-16-0x000000013F2F0000-0x000000013F644000-memory.dmp	upx
behavioral1/files/0x0024000000015c23-15.dat	upx
behavioral1/memory/2944-23-0x000000013F0C0000-0x000000013F414000-memory.dmp	upx
behavioral1/files/0x0007000000015c69-24.dat	upx
behavioral1/memory/2584-21-0x000000013F500000-0x000000013F854000-memory.dmp	upx
behavioral1/files/0x0008000000015c5d-17.dat	upx
behavioral1/files/0x000b0000000155e2-6.dat	upx
behavioral1/memory/1368-0-0x000000013F590000-0x000000013F8E4000-memory.dmp	upx
behavioral1/memory/2672-36-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/files/0x0007000000015c7c-35.dat	upx
behavioral1/memory/2196-57-0x000000013FCF0000-0x0000000140044000-memory.dmp	upx
behavioral1/memory/2712-65-0x000000013F6E0000-0x000000013FA34000-memory.dmp	upx
behavioral1/memory/2396-68-0x000000013F7F0000-0x000000013FB44000-memory.dmp	upx
behavioral1/files/0x0006000000018b37-105.dat	upx
behavioral1/files/0x0006000000018b42-113.dat	upx
behavioral1/files/0x0006000000018d06-142.dat	upx
behavioral1/files/0x0005000000019333-161.dat	upx
behavioral1/memory/1368-628-0x000000013F590000-0x000000013F8E4000-memory.dmp	upx
behavioral1/files/0x0005000000019410-182.dat	upx
behavioral1/files/0x0005000000019368-177.dat	upx
behavioral1/files/0x000500000001939b-173.dat	upx
behavioral1/files/0x000500000001931b-158.dat	upx
behavioral1/files/0x000500000001946b-189.dat	upx
behavioral1/files/0x00050000000193b0-180.dat	upx
behavioral1/files/0x0005000000019377-171.dat	upx
behavioral1/files/0x00050000000192f4-153.dat	upx
behavioral1/files/0x00050000000192c9-148.dat	upx
behavioral1/files/0x0006000000018ba2-138.dat	upx
behavioral1/files/0x0006000000018b96-132.dat	upx
behavioral1/files/0x0006000000018b73-128.dat	upx
behavioral1/files/0x0006000000018b6a-123.dat	upx
behavioral1/files/0x0006000000018b4a-118.dat	upx
behavioral1/files/0x0006000000018b15-104.dat	upx
behavioral1/files/0x0006000000018ae2-103.dat	upx
behavioral1/memory/1984-101-0x000000013F1C0000-0x000000013F514000-memory.dmp	upx
behavioral1/memory/2376-98-0x000000013FB40000-0x000000013FE94000-memory.dmp	upx
behavioral1/memory/752-96-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/files/0x00050000000186a0-75.dat	upx
behavioral1/files/0x0005000000018698-67.dat	upx
behavioral1/files/0x0006000000018b33-88.dat	upx
behavioral1/files/0x0006000000018ae8-80.dat	upx
behavioral1/files/0x0009000000015d88-62.dat	upx
behavioral1/memory/2128-61-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	upx
behavioral1/memory/2432-60-0x000000013F970000-0x000000013FCC4000-memory.dmp	upx
behavioral1/files/0x000500000001868c-51.dat	upx
behavioral1/files/0x0014000000015c2f-50.dat	upx
behavioral1/files/0x0007000000015c87-45.dat	upx
behavioral1/memory/2644-48-0x000000013F020000-0x000000013F374000-memory.dmp	upx
behavioral1/memory/2672-2222-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/memory/752-2876-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/memory/2432-2887-0x000000013F970000-0x000000013FCC4000-memory.dmp	upx
behavioral1/memory/2196-2907-0x000000013FCF0000-0x0000000140044000-memory.dmp	upx
behavioral1/memory/2644-2908-0x000000013F020000-0x000000013F374000-memory.dmp	upx
behavioral1/memory/2128-2910-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	upx
behavioral1/memory/2680-2911-0x000000013F2F0000-0x000000013F644000-memory.dmp	upx
behavioral1/memory/2584-2916-0x000000013F500000-0x000000013F854000-memory.dmp	upx
behavioral1/memory/2672-2942-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/memory/2944-2933-0x000000013F0C0000-0x000000013F414000-memory.dmp	upx
behavioral1/memory/1984-3014-0x000000013F1C0000-0x000000013F514000-memory.dmp	upx
behavioral1/memory/2376-3015-0x000000013FB40000-0x000000013FE94000-memory.dmp	upx
behavioral1/memory/2712-3485-0x000000013F6E0000-0x000000013FA34000-memory.dmp	upx
behavioral1/memory/2396-3833-0x000000013F7F0000-0x000000013FB44000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BUrjViy.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\ZyCYzow.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\eIpYkyi.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\GmSPpal.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\mWsiNNw.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\WyXxbRE.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\tjqVoGB.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\XSAidgL.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\aVqTVuA.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\itFZQyt.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\YCXSOig.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\HBGTJgv.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\JDtEoWW.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\UEhBbot.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\gHjsdBP.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\oUweurs.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\HWfwbah.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\hgXPGwj.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\lfFZDhb.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\QphiUCO.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\iGqbVbP.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\kLxoWov.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\ojprjmM.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\KamfAOF.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\wlxmOHd.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\qAOrtkx.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\DPhWajE.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\DMTSHcL.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\IhfPuce.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\dwGHycC.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\eNRsEXo.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\OEvJPWd.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\WCbOXXw.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\EyTlSdu.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\UNOFFsx.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\RdOTKHf.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\CjPrzFp.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\COpSiGZ.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\ZAwLapc.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\fkVquKZ.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\EUMhCZe.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\OGUfazB.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\YTiBgEm.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\KWiFSWp.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\vUJIJOs.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\eoLUlRI.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\XizuJir.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\nmyyYYs.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\qrTxfvD.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\DGGhzwE.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\rICdvkB.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\bQconcA.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\ZwZSTlz.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\jQDXXOj.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\vsSTlVd.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\clofgOB.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\MDdTOnt.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\OUjqNkx.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\UCodMzY.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\fcUqBQE.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\WXttadW.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\hZGxzoA.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\QnqpgMP.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
File created	C:\Windows\System\QdfqNVM.exe	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2680	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 2680	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 2680	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 2584	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	30
PID 1368 wrote to memory of 2584	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	30
PID 1368 wrote to memory of 2584	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	30
PID 1368 wrote to memory of 2944	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	31
PID 1368 wrote to memory of 2944	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	31
PID 1368 wrote to memory of 2944	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	31
PID 1368 wrote to memory of 2672	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	32
PID 1368 wrote to memory of 2672	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	32
PID 1368 wrote to memory of 2672	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	32
PID 1368 wrote to memory of 2644	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	33
PID 1368 wrote to memory of 2644	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	33
PID 1368 wrote to memory of 2644	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	33
PID 1368 wrote to memory of 2128	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	34
PID 1368 wrote to memory of 2128	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	34
PID 1368 wrote to memory of 2128	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	34
PID 1368 wrote to memory of 2432	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	35
PID 1368 wrote to memory of 2432	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	35
PID 1368 wrote to memory of 2432	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	35
PID 1368 wrote to memory of 2712	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	36
PID 1368 wrote to memory of 2712	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	36
PID 1368 wrote to memory of 2712	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	36
PID 1368 wrote to memory of 2196	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	37
PID 1368 wrote to memory of 2196	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	37
PID 1368 wrote to memory of 2196	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	37
PID 1368 wrote to memory of 2396	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	38
PID 1368 wrote to memory of 2396	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	38
PID 1368 wrote to memory of 2396	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	38
PID 1368 wrote to memory of 752	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	39
PID 1368 wrote to memory of 752	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	39
PID 1368 wrote to memory of 752	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	39
PID 1368 wrote to memory of 1492	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	40
PID 1368 wrote to memory of 1492	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	40
PID 1368 wrote to memory of 1492	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	40
PID 1368 wrote to memory of 2376	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	41
PID 1368 wrote to memory of 2376	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	41
PID 1368 wrote to memory of 2376	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	41
PID 1368 wrote to memory of 1888	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	42
PID 1368 wrote to memory of 1888	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	42
PID 1368 wrote to memory of 1888	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	42
PID 1368 wrote to memory of 1984	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	43
PID 1368 wrote to memory of 1984	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	43
PID 1368 wrote to memory of 1984	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	43
PID 1368 wrote to memory of 904	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	44
PID 1368 wrote to memory of 904	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	44
PID 1368 wrote to memory of 904	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	44
PID 1368 wrote to memory of 760	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	45
PID 1368 wrote to memory of 760	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	45
PID 1368 wrote to memory of 760	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	45
PID 1368 wrote to memory of 1092	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	46
PID 1368 wrote to memory of 1092	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	46
PID 1368 wrote to memory of 1092	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	46
PID 1368 wrote to memory of 1172	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	47
PID 1368 wrote to memory of 1172	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	47
PID 1368 wrote to memory of 1172	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	47
PID 1368 wrote to memory of 1176	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	48
PID 1368 wrote to memory of 1176	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	48
PID 1368 wrote to memory of 1176	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	48
PID 1368 wrote to memory of 1704	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	49
PID 1368 wrote to memory of 1704	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	49
PID 1368 wrote to memory of 1704	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	49
PID 1368 wrote to memory of 2216	1368	b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b522135bdc40bfef1386435c05520c30_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\System\HQHxKIb.exe
  C:\Windows\System\HQHxKIb.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\OkcjsfS.exe
  C:\Windows\System\OkcjsfS.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\eJtKexk.exe
  C:\Windows\System\eJtKexk.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\zASUFxZ.exe
  C:\Windows\System\zASUFxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\sKrrKvk.exe
  C:\Windows\System\sKrrKvk.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\hZGxzoA.exe
  C:\Windows\System\hZGxzoA.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\oWMfSfs.exe
  C:\Windows\System\oWMfSfs.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\EBQftEb.exe
  C:\Windows\System\EBQftEb.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\NiBAKZx.exe
  C:\Windows\System\NiBAKZx.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\vgGwfFk.exe
  C:\Windows\System\vgGwfFk.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\Fnvunee.exe
  C:\Windows\System\Fnvunee.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\sytUPaB.exe
  C:\Windows\System\sytUPaB.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\PXjCcAY.exe
  C:\Windows\System\PXjCcAY.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\MptOEHR.exe
  C:\Windows\System\MptOEHR.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\swgSMPZ.exe
  C:\Windows\System\swgSMPZ.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\PMAproS.exe
  C:\Windows\System\PMAproS.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\kmhLnMC.exe
  C:\Windows\System\kmhLnMC.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ckcpLRX.exe
  C:\Windows\System\ckcpLRX.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\ygnREPe.exe
  C:\Windows\System\ygnREPe.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\DPhWajE.exe
  C:\Windows\System\DPhWajE.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\rcsoILG.exe
  C:\Windows\System\rcsoILG.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\qrTxfvD.exe
  C:\Windows\System\qrTxfvD.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\nFfOeWh.exe
  C:\Windows\System\nFfOeWh.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\gHjsdBP.exe
  C:\Windows\System\gHjsdBP.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\KgMdLxh.exe
  C:\Windows\System\KgMdLxh.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\BpLmevj.exe
  C:\Windows\System\BpLmevj.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\AWJOjZp.exe
  C:\Windows\System\AWJOjZp.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\baUBfJG.exe
  C:\Windows\System\baUBfJG.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\kiVrTxe.exe
  C:\Windows\System\kiVrTxe.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\Giujwys.exe
  C:\Windows\System\Giujwys.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\NNEWZSr.exe
  C:\Windows\System\NNEWZSr.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\OGqKKVz.exe
  C:\Windows\System\OGqKKVz.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\sEkBUEC.exe
  C:\Windows\System\sEkBUEC.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\eTgeZbM.exe
  C:\Windows\System\eTgeZbM.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\NduuMeU.exe
  C:\Windows\System\NduuMeU.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\NkBUSon.exe
  C:\Windows\System\NkBUSon.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\YRKIHko.exe
  C:\Windows\System\YRKIHko.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\mYCdtQt.exe
  C:\Windows\System\mYCdtQt.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\ulceGaa.exe
  C:\Windows\System\ulceGaa.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\DWjKRCr.exe
  C:\Windows\System\DWjKRCr.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\QSFrmva.exe
  C:\Windows\System\QSFrmva.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\JPEGHta.exe
  C:\Windows\System\JPEGHta.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\nEHOmii.exe
  C:\Windows\System\nEHOmii.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\TRnIXzV.exe
  C:\Windows\System\TRnIXzV.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\XqIFNNF.exe
  C:\Windows\System\XqIFNNF.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\WopJuCf.exe
  C:\Windows\System\WopJuCf.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\CBgiwLA.exe
  C:\Windows\System\CBgiwLA.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\eoLUlRI.exe
  C:\Windows\System\eoLUlRI.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\ppJmTok.exe
  C:\Windows\System\ppJmTok.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\arDKtrT.exe
  C:\Windows\System\arDKtrT.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\JIpkYKO.exe
  C:\Windows\System\JIpkYKO.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\iPXWHfK.exe
  C:\Windows\System\iPXWHfK.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\PCADDIO.exe
  C:\Windows\System\PCADDIO.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\UpVMAnU.exe
  C:\Windows\System\UpVMAnU.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\QbZYvyV.exe
  C:\Windows\System\QbZYvyV.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\xElyalz.exe
  C:\Windows\System\xElyalz.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\mmjPWCX.exe
  C:\Windows\System\mmjPWCX.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\amFZQfF.exe
  C:\Windows\System\amFZQfF.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\GKMiQcJ.exe
  C:\Windows\System\GKMiQcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\uGdCjEq.exe
  C:\Windows\System\uGdCjEq.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\HtOVNMi.exe
  C:\Windows\System\HtOVNMi.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\vEHeeps.exe
  C:\Windows\System\vEHeeps.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\jdsJsal.exe
  C:\Windows\System\jdsJsal.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\GmJQuID.exe
  C:\Windows\System\GmJQuID.exe
  2⤵
  PID:392
- C:\Windows\System\uPhJcNU.exe
  C:\Windows\System\uPhJcNU.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\gEHjpCR.exe
  C:\Windows\System\gEHjpCR.exe
  2⤵
  PID:2460
- C:\Windows\System\iGqbVbP.exe
  C:\Windows\System\iGqbVbP.exe
  2⤵
  PID:2380
- C:\Windows\System\MriXxdc.exe
  C:\Windows\System\MriXxdc.exe
  2⤵
  PID:2224
- C:\Windows\System\dfTWhjG.exe
  C:\Windows\System\dfTWhjG.exe
  2⤵
  PID:1780
- C:\Windows\System\RqsYqxy.exe
  C:\Windows\System\RqsYqxy.exe
  2⤵
  PID:1920
- C:\Windows\System\QVSTYeK.exe
  C:\Windows\System\QVSTYeK.exe
  2⤵
  PID:1504
- C:\Windows\System\eHrVNKy.exe
  C:\Windows\System\eHrVNKy.exe
  2⤵
  PID:1700
- C:\Windows\System\ijtzdQd.exe
  C:\Windows\System\ijtzdQd.exe
  2⤵
  PID:1964
- C:\Windows\System\KTHrzlu.exe
  C:\Windows\System\KTHrzlu.exe
  2⤵
  PID:1100
- C:\Windows\System\uCdKSYF.exe
  C:\Windows\System\uCdKSYF.exe
  2⤵
  PID:2780
- C:\Windows\System\ReWbpsE.exe
  C:\Windows\System\ReWbpsE.exe
  2⤵
  PID:2968
- C:\Windows\System\hWyaura.exe
  C:\Windows\System\hWyaura.exe
  2⤵
  PID:1604
- C:\Windows\System\KvgoTCy.exe
  C:\Windows\System\KvgoTCy.exe
  2⤵
  PID:2284
- C:\Windows\System\wfGUwPE.exe
  C:\Windows\System\wfGUwPE.exe
  2⤵
  PID:1060
- C:\Windows\System\YmuXqjr.exe
  C:\Windows\System\YmuXqjr.exe
  2⤵
  PID:2136
- C:\Windows\System\ypKnEvv.exe
  C:\Windows\System\ypKnEvv.exe
  2⤵
  PID:1320
- C:\Windows\System\FSfQwuq.exe
  C:\Windows\System\FSfQwuq.exe
  2⤵
  PID:1828
- C:\Windows\System\UdXrtok.exe
  C:\Windows\System\UdXrtok.exe
  2⤵
  PID:2332
- C:\Windows\System\dkHDTfZ.exe
  C:\Windows\System\dkHDTfZ.exe
  2⤵
  PID:1676
- C:\Windows\System\PjXwaXL.exe
  C:\Windows\System\PjXwaXL.exe
  2⤵
  PID:2344
- C:\Windows\System\SINcZeO.exe
  C:\Windows\System\SINcZeO.exe
  2⤵
  PID:808
- C:\Windows\System\TJqzMwJ.exe
  C:\Windows\System\TJqzMwJ.exe
  2⤵
  PID:2040
- C:\Windows\System\ZXnJdgn.exe
  C:\Windows\System\ZXnJdgn.exe
  2⤵
  PID:1344
- C:\Windows\System\buVyuAu.exe
  C:\Windows\System\buVyuAu.exe
  2⤵
  PID:2812
- C:\Windows\System\IXeBXxX.exe
  C:\Windows\System\IXeBXxX.exe
  2⤵
  PID:2948
- C:\Windows\System\asIRfRz.exe
  C:\Windows\System\asIRfRz.exe
  2⤵
  PID:2104
- C:\Windows\System\DjmwxTP.exe
  C:\Windows\System\DjmwxTP.exe
  2⤵
  PID:1212
- C:\Windows\System\hHcCAFY.exe
  C:\Windows\System\hHcCAFY.exe
  2⤵
  PID:1336
- C:\Windows\System\wBCnrom.exe
  C:\Windows\System\wBCnrom.exe
  2⤵
  PID:876
- C:\Windows\System\gEmotMj.exe
  C:\Windows\System\gEmotMj.exe
  2⤵
  PID:2304
- C:\Windows\System\iqneTll.exe
  C:\Windows\System\iqneTll.exe
  2⤵
  PID:1600
- C:\Windows\System\GFwQPkx.exe
  C:\Windows\System\GFwQPkx.exe
  2⤵
  PID:2624
- C:\Windows\System\ZuthQmy.exe
  C:\Windows\System\ZuthQmy.exe
  2⤵
  PID:2532
- C:\Windows\System\KYKWlBS.exe
  C:\Windows\System\KYKWlBS.exe
  2⤵
  PID:1612
- C:\Windows\System\CpflvrE.exe
  C:\Windows\System\CpflvrE.exe
  2⤵
  PID:2504
- C:\Windows\System\AzqAtqD.exe
  C:\Windows\System\AzqAtqD.exe
  2⤵
  PID:948
- C:\Windows\System\CnRbtgP.exe
  C:\Windows\System\CnRbtgP.exe
  2⤵
  PID:2540
- C:\Windows\System\zUdyXOB.exe
  C:\Windows\System\zUdyXOB.exe
  2⤵
  PID:1912
- C:\Windows\System\dPVLClW.exe
  C:\Windows\System\dPVLClW.exe
  2⤵
  PID:1744
- C:\Windows\System\nfBkTUf.exe
  C:\Windows\System\nfBkTUf.exe
  2⤵
  PID:2200
- C:\Windows\System\nGjjaTC.exe
  C:\Windows\System\nGjjaTC.exe
  2⤵
  PID:1908
- C:\Windows\System\HoRTYiv.exe
  C:\Windows\System\HoRTYiv.exe
  2⤵
  PID:2272
- C:\Windows\System\lZDvbKR.exe
  C:\Windows\System\lZDvbKR.exe
  2⤵
  PID:1792
- C:\Windows\System\pDKFJRS.exe
  C:\Windows\System\pDKFJRS.exe
  2⤵
  PID:2080
- C:\Windows\System\pygwXSt.exe
  C:\Windows\System\pygwXSt.exe
  2⤵
  PID:2244
- C:\Windows\System\mmAToOS.exe
  C:\Windows\System\mmAToOS.exe
  2⤵
  PID:1988
- C:\Windows\System\ePlMSnY.exe
  C:\Windows\System\ePlMSnY.exe
  2⤵
  PID:2428
- C:\Windows\System\CCwFemE.exe
  C:\Windows\System\CCwFemE.exe
  2⤵
  PID:2404
- C:\Windows\System\AApRzDb.exe
  C:\Windows\System\AApRzDb.exe
  2⤵
  PID:848
- C:\Windows\System\aBHxisE.exe
  C:\Windows\System\aBHxisE.exe
  2⤵
  PID:1484
- C:\Windows\System\cOjWcvC.exe
  C:\Windows\System\cOjWcvC.exe
  2⤵
  PID:3076
- C:\Windows\System\ZGfpgDm.exe
  C:\Windows\System\ZGfpgDm.exe
  2⤵
  PID:3092
- C:\Windows\System\Dpterdy.exe
  C:\Windows\System\Dpterdy.exe
  2⤵
  PID:3108
- C:\Windows\System\JnTeoRt.exe
  C:\Windows\System\JnTeoRt.exe
  2⤵
  PID:3124
- C:\Windows\System\mQcqscb.exe
  C:\Windows\System\mQcqscb.exe
  2⤵
  PID:3140
- C:\Windows\System\YoQgnnt.exe
  C:\Windows\System\YoQgnnt.exe
  2⤵
  PID:3156
- C:\Windows\System\gpVWgiz.exe
  C:\Windows\System\gpVWgiz.exe
  2⤵
  PID:3172
- C:\Windows\System\OVszDvR.exe
  C:\Windows\System\OVszDvR.exe
  2⤵
  PID:3188
- C:\Windows\System\UMCHvvE.exe
  C:\Windows\System\UMCHvvE.exe
  2⤵
  PID:3204
- C:\Windows\System\ABMkIAA.exe
  C:\Windows\System\ABMkIAA.exe
  2⤵
  PID:3264
- C:\Windows\System\aITyEUv.exe
  C:\Windows\System\aITyEUv.exe
  2⤵
  PID:3392
- C:\Windows\System\WCbOXXw.exe
  C:\Windows\System\WCbOXXw.exe
  2⤵
  PID:3412
- C:\Windows\System\ADLOOKC.exe
  C:\Windows\System\ADLOOKC.exe
  2⤵
  PID:3428
- C:\Windows\System\siCazUa.exe
  C:\Windows\System\siCazUa.exe
  2⤵
  PID:3444
- C:\Windows\System\XizuJir.exe
  C:\Windows\System\XizuJir.exe
  2⤵
  PID:3460
- C:\Windows\System\XopPPyZ.exe
  C:\Windows\System\XopPPyZ.exe
  2⤵
  PID:3476
- C:\Windows\System\smKXSWw.exe
  C:\Windows\System\smKXSWw.exe
  2⤵
  PID:3500
- C:\Windows\System\TzTQvkX.exe
  C:\Windows\System\TzTQvkX.exe
  2⤵
  PID:3532
- C:\Windows\System\ZfJkGEr.exe
  C:\Windows\System\ZfJkGEr.exe
  2⤵
  PID:3548
- C:\Windows\System\zwnEGzy.exe
  C:\Windows\System\zwnEGzy.exe
  2⤵
  PID:3568
- C:\Windows\System\wjopQBR.exe
  C:\Windows\System\wjopQBR.exe
  2⤵
  PID:3584
- C:\Windows\System\eIpYkyi.exe
  C:\Windows\System\eIpYkyi.exe
  2⤵
  PID:3600
- C:\Windows\System\OACNttY.exe
  C:\Windows\System\OACNttY.exe
  2⤵
  PID:3620
- C:\Windows\System\hnolADI.exe
  C:\Windows\System\hnolADI.exe
  2⤵
  PID:3636
- C:\Windows\System\VvaSHBV.exe
  C:\Windows\System\VvaSHBV.exe
  2⤵
  PID:3652
- C:\Windows\System\brWBCeH.exe
  C:\Windows\System\brWBCeH.exe
  2⤵
  PID:3668
- C:\Windows\System\uFHXKjI.exe
  C:\Windows\System\uFHXKjI.exe
  2⤵
  PID:3692
- C:\Windows\System\byjPRBV.exe
  C:\Windows\System\byjPRBV.exe
  2⤵
  PID:3708
- C:\Windows\System\HPhInTx.exe
  C:\Windows\System\HPhInTx.exe
  2⤵
  PID:3728
- C:\Windows\System\KoPkjtu.exe
  C:\Windows\System\KoPkjtu.exe
  2⤵
  PID:3744
- C:\Windows\System\YSLlLby.exe
  C:\Windows\System\YSLlLby.exe
  2⤵
  PID:3760
- C:\Windows\System\BMwwsWp.exe
  C:\Windows\System\BMwwsWp.exe
  2⤵
  PID:3776
- C:\Windows\System\GlYGtdg.exe
  C:\Windows\System\GlYGtdg.exe
  2⤵
  PID:3804
- C:\Windows\System\LrXYinx.exe
  C:\Windows\System\LrXYinx.exe
  2⤵
  PID:3820
- C:\Windows\System\kCdltsX.exe
  C:\Windows\System\kCdltsX.exe
  2⤵
  PID:3836
- C:\Windows\System\KJIGulS.exe
  C:\Windows\System\KJIGulS.exe
  2⤵
  PID:3860
- C:\Windows\System\yuswoEb.exe
  C:\Windows\System\yuswoEb.exe
  2⤵
  PID:3876
- C:\Windows\System\mwGFViZ.exe
  C:\Windows\System\mwGFViZ.exe
  2⤵
  PID:3892
- C:\Windows\System\QUGnGPy.exe
  C:\Windows\System\QUGnGPy.exe
  2⤵
  PID:3908
- C:\Windows\System\JhUAWqc.exe
  C:\Windows\System\JhUAWqc.exe
  2⤵
  PID:3924
- C:\Windows\System\PlbRsWh.exe
  C:\Windows\System\PlbRsWh.exe
  2⤵
  PID:3940
- C:\Windows\System\nKNBEVS.exe
  C:\Windows\System\nKNBEVS.exe
  2⤵
  PID:3956
- C:\Windows\System\UoezqNO.exe
  C:\Windows\System\UoezqNO.exe
  2⤵
  PID:3972
- C:\Windows\System\uvswNUE.exe
  C:\Windows\System\uvswNUE.exe
  2⤵
  PID:3988
- C:\Windows\System\WpSSLpj.exe
  C:\Windows\System\WpSSLpj.exe
  2⤵
  PID:4004
- C:\Windows\System\zabAmRq.exe
  C:\Windows\System\zabAmRq.exe
  2⤵
  PID:4020
- C:\Windows\System\IrIMFed.exe
  C:\Windows\System\IrIMFed.exe
  2⤵
  PID:4036
- C:\Windows\System\HGXKIDl.exe
  C:\Windows\System\HGXKIDl.exe
  2⤵
  PID:4052
- C:\Windows\System\RygYDrX.exe
  C:\Windows\System\RygYDrX.exe
  2⤵
  PID:4068
- C:\Windows\System\IbcUSQW.exe
  C:\Windows\System\IbcUSQW.exe
  2⤵
  PID:4084
- C:\Windows\System\BvkOeOC.exe
  C:\Windows\System\BvkOeOC.exe
  2⤵
  PID:1816
- C:\Windows\System\wnqgvsJ.exe
  C:\Windows\System\wnqgvsJ.exe
  2⤵
  PID:2744
- C:\Windows\System\gOgPPLV.exe
  C:\Windows\System\gOgPPLV.exe
  2⤵
  PID:1616
- C:\Windows\System\UwhZBaJ.exe
  C:\Windows\System\UwhZBaJ.exe
  2⤵
  PID:2988
- C:\Windows\System\MkKPENq.exe
  C:\Windows\System\MkKPENq.exe
  2⤵
  PID:3136
- C:\Windows\System\IbZXmTY.exe
  C:\Windows\System\IbZXmTY.exe
  2⤵
  PID:3052
- C:\Windows\System\iuKYsAX.exe
  C:\Windows\System\iuKYsAX.exe
  2⤵
  PID:2000
- C:\Windows\System\kLxoWov.exe
  C:\Windows\System\kLxoWov.exe
  2⤵
  PID:2496
- C:\Windows\System\jgOIFow.exe
  C:\Windows\System\jgOIFow.exe
  2⤵
  PID:2060
- C:\Windows\System\EHMZyXZ.exe
  C:\Windows\System\EHMZyXZ.exe
  2⤵
  PID:3196
- C:\Windows\System\OVJDTxX.exe
  C:\Windows\System\OVJDTxX.exe
  2⤵
  PID:1648
- C:\Windows\System\OjHdoKe.exe
  C:\Windows\System\OjHdoKe.exe
  2⤵
  PID:2656
- C:\Windows\System\XskKsQK.exe
  C:\Windows\System\XskKsQK.exe
  2⤵
  PID:1824
- C:\Windows\System\sHLOnSl.exe
  C:\Windows\System\sHLOnSl.exe
  2⤵
  PID:400
- C:\Windows\System\wVXLakg.exe
  C:\Windows\System\wVXLakg.exe
  2⤵
  PID:1352
- C:\Windows\System\PowmvBJ.exe
  C:\Windows\System\PowmvBJ.exe
  2⤵
  PID:1696
- C:\Windows\System\kMDRLue.exe
  C:\Windows\System\kMDRLue.exe
  2⤵
  PID:3116
- C:\Windows\System\tjRdFrz.exe
  C:\Windows\System\tjRdFrz.exe
  2⤵
  PID:3184
- C:\Windows\System\ACYhorS.exe
  C:\Windows\System\ACYhorS.exe
  2⤵
  PID:3224
- C:\Windows\System\peBPJVw.exe
  C:\Windows\System\peBPJVw.exe
  2⤵
  PID:2852
- C:\Windows\System\KWiFSWp.exe
  C:\Windows\System\KWiFSWp.exe
  2⤵
  PID:1308
- C:\Windows\System\HXxPhdT.exe
  C:\Windows\System\HXxPhdT.exe
  2⤵
  PID:2512
- C:\Windows\System\kaLwUMX.exe
  C:\Windows\System\kaLwUMX.exe
  2⤵
  PID:1028
- C:\Windows\System\KvjVBke.exe
  C:\Windows\System\KvjVBke.exe
  2⤵
  PID:2796
- C:\Windows\System\ffuzKaX.exe
  C:\Windows\System\ffuzKaX.exe
  2⤵
  PID:3036
- C:\Windows\System\HDrQMHM.exe
  C:\Windows\System\HDrQMHM.exe
  2⤵
  PID:3280
- C:\Windows\System\qjreWUK.exe
  C:\Windows\System\qjreWUK.exe
  2⤵
  PID:3296
- C:\Windows\System\slaMPwu.exe
  C:\Windows\System\slaMPwu.exe
  2⤵
  PID:3308
- C:\Windows\System\jKJIfeC.exe
  C:\Windows\System\jKJIfeC.exe
  2⤵
  PID:3320
- C:\Windows\System\cZJqXRv.exe
  C:\Windows\System\cZJqXRv.exe
  2⤵
  PID:3340
- C:\Windows\System\vuxhHay.exe
  C:\Windows\System\vuxhHay.exe
  2⤵
  PID:3360
- C:\Windows\System\awCkjAY.exe
  C:\Windows\System\awCkjAY.exe
  2⤵
  PID:3048
- C:\Windows\System\jJBGvBB.exe
  C:\Windows\System\jJBGvBB.exe
  2⤵
  PID:3384
- C:\Windows\System\BwjfquL.exe
  C:\Windows\System\BwjfquL.exe
  2⤵
  PID:3452
- C:\Windows\System\XVOxmnn.exe
  C:\Windows\System\XVOxmnn.exe
  2⤵
  PID:3488
- C:\Windows\System\MRwvxCl.exe
  C:\Windows\System\MRwvxCl.exe
  2⤵
  PID:3576
- C:\Windows\System\CjPrzFp.exe
  C:\Windows\System\CjPrzFp.exe
  2⤵
  PID:3616
- C:\Windows\System\walPNdn.exe
  C:\Windows\System\walPNdn.exe
  2⤵
  PID:2568
- C:\Windows\System\HvlTujv.exe
  C:\Windows\System\HvlTujv.exe
  2⤵
  PID:3752
- C:\Windows\System\PBoshBw.exe
  C:\Windows\System\PBoshBw.exe
  2⤵
  PID:3724
- C:\Windows\System\SztkOKU.exe
  C:\Windows\System\SztkOKU.exe
  2⤵
  PID:3796
- C:\Windows\System\ZhhUGxn.exe
  C:\Windows\System\ZhhUGxn.exe
  2⤵
  PID:3408
- C:\Windows\System\hamFvUS.exe
  C:\Windows\System\hamFvUS.exe
  2⤵
  PID:3828
- C:\Windows\System\xzULqsj.exe
  C:\Windows\System\xzULqsj.exe
  2⤵
  PID:3512
- C:\Windows\System\HNOPlUV.exe
  C:\Windows\System\HNOPlUV.exe
  2⤵
  PID:3524
- C:\Windows\System\MRjEKUe.exe
  C:\Windows\System\MRjEKUe.exe
  2⤵
  PID:3592
- C:\Windows\System\tjqVoGB.exe
  C:\Windows\System\tjqVoGB.exe
  2⤵
  PID:3632
- C:\Windows\System\rqhCUUl.exe
  C:\Windows\System\rqhCUUl.exe
  2⤵
  PID:3816
- C:\Windows\System\MYmLRDu.exe
  C:\Windows\System\MYmLRDu.exe
  2⤵
  PID:3904
- C:\Windows\System\bhpJSbl.exe
  C:\Windows\System\bhpJSbl.exe
  2⤵
  PID:3968
- C:\Windows\System\obnraXW.exe
  C:\Windows\System\obnraXW.exe
  2⤵
  PID:4000
- C:\Windows\System\IKGouxW.exe
  C:\Windows\System\IKGouxW.exe
  2⤵
  PID:3916
- C:\Windows\System\gewsgxq.exe
  C:\Windows\System\gewsgxq.exe
  2⤵
  PID:3980
- C:\Windows\System\UYTNHeU.exe
  C:\Windows\System\UYTNHeU.exe
  2⤵
  PID:4092
- C:\Windows\System\ZCPwvAp.exe
  C:\Windows\System\ZCPwvAp.exe
  2⤵
  PID:4016
- C:\Windows\System\NEviHJg.exe
  C:\Windows\System\NEviHJg.exe
  2⤵
  PID:4076
- C:\Windows\System\vAttTEL.exe
  C:\Windows\System\vAttTEL.exe
  2⤵
  PID:576
- C:\Windows\System\aKtYhrL.exe
  C:\Windows\System\aKtYhrL.exe
  2⤵
  PID:3164
- C:\Windows\System\PFaouCs.exe
  C:\Windows\System\PFaouCs.exe
  2⤵
  PID:1656
- C:\Windows\System\rbxMbhl.exe
  C:\Windows\System\rbxMbhl.exe
  2⤵
  PID:1936
- C:\Windows\System\sWNCdyW.exe
  C:\Windows\System\sWNCdyW.exe
  2⤵
  PID:672
- C:\Windows\System\sOGBeua.exe
  C:\Windows\System\sOGBeua.exe
  2⤵
  PID:2612
- C:\Windows\System\vUJIJOs.exe
  C:\Windows\System\vUJIJOs.exe
  2⤵
  PID:3348
- C:\Windows\System\YVjKxbV.exe
  C:\Windows\System\YVjKxbV.exe
  2⤵
  PID:2768
- C:\Windows\System\eqKuTqT.exe
  C:\Windows\System\eqKuTqT.exe
  2⤵
  PID:2280
- C:\Windows\System\HOWPRwX.exe
  C:\Windows\System\HOWPRwX.exe
  2⤵
  PID:3564
- C:\Windows\System\LUaDChD.exe
  C:\Windows\System\LUaDChD.exe
  2⤵
  PID:3736
- C:\Windows\System\IFwwnTB.exe
  C:\Windows\System\IFwwnTB.exe
  2⤵
  PID:1096
- C:\Windows\System\zkoidLd.exe
  C:\Windows\System\zkoidLd.exe
  2⤵
  PID:3056
- C:\Windows\System\BrvPmPB.exe
  C:\Windows\System\BrvPmPB.exe
  2⤵
  PID:3368
- C:\Windows\System\GnGZBTG.exe
  C:\Windows\System\GnGZBTG.exe
  2⤵
  PID:3540
- C:\Windows\System\PlCaPLg.exe
  C:\Windows\System\PlCaPLg.exe
  2⤵
  PID:2440
- C:\Windows\System\zDthfwx.exe
  C:\Windows\System\zDthfwx.exe
  2⤵
  PID:3560
- C:\Windows\System\eozQTCS.exe
  C:\Windows\System\eozQTCS.exe
  2⤵
  PID:3872
- C:\Windows\System\AFTJuLK.exe
  C:\Windows\System\AFTJuLK.exe
  2⤵
  PID:3180
- C:\Windows\System\chZiQtt.exe
  C:\Windows\System\chZiQtt.exe
  2⤵
  PID:880
- C:\Windows\System\TBlXIhN.exe
  C:\Windows\System\TBlXIhN.exe
  2⤵
  PID:2548
- C:\Windows\System\DLthrMJ.exe
  C:\Windows\System\DLthrMJ.exe
  2⤵
  PID:2664
- C:\Windows\System\KpiZxvH.exe
  C:\Windows\System\KpiZxvH.exe
  2⤵
  PID:1812
- C:\Windows\System\GnvOdwP.exe
  C:\Windows\System\GnvOdwP.exe
  2⤵
  PID:1904
- C:\Windows\System\AweCjRP.exe
  C:\Windows\System\AweCjRP.exe
  2⤵
  PID:3212
- C:\Windows\System\EUmeGij.exe
  C:\Windows\System\EUmeGij.exe
  2⤵
  PID:800
- C:\Windows\System\PGaviDK.exe
  C:\Windows\System\PGaviDK.exe
  2⤵
  PID:2120
- C:\Windows\System\QsFDklO.exe
  C:\Windows\System\QsFDklO.exe
  2⤵
  PID:2492
- C:\Windows\System\sedgTbC.exe
  C:\Windows\System\sedgTbC.exe
  2⤵
  PID:3324
- C:\Windows\System\BToKRka.exe
  C:\Windows\System\BToKRka.exe
  2⤵
  PID:2392
- C:\Windows\System\QLXDiHo.exe
  C:\Windows\System\QLXDiHo.exe
  2⤵
  PID:3376
- C:\Windows\System\FUdyBZg.exe
  C:\Windows\System\FUdyBZg.exe
  2⤵
  PID:2560
- C:\Windows\System\jSlJIOG.exe
  C:\Windows\System\jSlJIOG.exe
  2⤵
  PID:2372
- C:\Windows\System\vsSTlVd.exe
  C:\Windows\System\vsSTlVd.exe
  2⤵
  PID:3784
- C:\Windows\System\KgMyPKM.exe
  C:\Windows\System\KgMyPKM.exe
  2⤵
  PID:3404
- C:\Windows\System\vQHssLg.exe
  C:\Windows\System\vQHssLg.exe
  2⤵
  PID:2488
- C:\Windows\System\MwQelOL.exe
  C:\Windows\System\MwQelOL.exe
  2⤵
  PID:824
- C:\Windows\System\esrhjId.exe
  C:\Windows\System\esrhjId.exe
  2⤵
  PID:3900
- C:\Windows\System\MlgLVoa.exe
  C:\Windows\System\MlgLVoa.exe
  2⤵
  PID:1756
- C:\Windows\System\NDGEBth.exe
  C:\Windows\System\NDGEBth.exe
  2⤵
  PID:2776
- C:\Windows\System\XvipFtd.exe
  C:\Windows\System\XvipFtd.exe
  2⤵
  PID:3332
- C:\Windows\System\FjUKlfe.exe
  C:\Windows\System\FjUKlfe.exe
  2⤵
  PID:756
- C:\Windows\System\beewead.exe
  C:\Windows\System\beewead.exe
  2⤵
  PID:1116
- C:\Windows\System\tKIuxMq.exe
  C:\Windows\System\tKIuxMq.exe
  2⤵
  PID:3104
- C:\Windows\System\voNASNK.exe
  C:\Windows\System\voNASNK.exe
  2⤵
  PID:1476
- C:\Windows\System\wUsogkV.exe
  C:\Windows\System\wUsogkV.exe
  2⤵
  PID:3436
- C:\Windows\System\YosheXv.exe
  C:\Windows\System\YosheXv.exe
  2⤵
  PID:2240
- C:\Windows\System\WesFDxk.exe
  C:\Windows\System\WesFDxk.exe
  2⤵
  PID:3220
- C:\Windows\System\zmrKjsa.exe
  C:\Windows\System\zmrKjsa.exe
  2⤵
  PID:476
- C:\Windows\System\WgaxFLH.exe
  C:\Windows\System\WgaxFLH.exe
  2⤵
  PID:2160
- C:\Windows\System\lrFhNoL.exe
  C:\Windows\System\lrFhNoL.exe
  2⤵
  PID:3304
- C:\Windows\System\jzoqOVp.exe
  C:\Windows\System\jzoqOVp.exe
  2⤵
  PID:2336
- C:\Windows\System\alJfKxf.exe
  C:\Windows\System\alJfKxf.exe
  2⤵
  PID:3680
- C:\Windows\System\jQDXXOj.exe
  C:\Windows\System\jQDXXOj.exe
  2⤵
  PID:3684
- C:\Windows\System\DMTSHcL.exe
  C:\Windows\System\DMTSHcL.exe
  2⤵
  PID:2472
- C:\Windows\System\YzxQKda.exe
  C:\Windows\System\YzxQKda.exe
  2⤵
  PID:2832
- C:\Windows\System\INeKplC.exe
  C:\Windows\System\INeKplC.exe
  2⤵
  PID:2516
- C:\Windows\System\PuLGucR.exe
  C:\Windows\System\PuLGucR.exe
  2⤵
  PID:3996
- C:\Windows\System\rWkhmDZ.exe
  C:\Windows\System\rWkhmDZ.exe
  2⤵
  PID:3336
- C:\Windows\System\lwmcbSw.exe
  C:\Windows\System\lwmcbSw.exe
  2⤵
  PID:3952
- C:\Windows\System\xDsBojc.exe
  C:\Windows\System\xDsBojc.exe
  2⤵
  PID:3032
- C:\Windows\System\kZCivro.exe
  C:\Windows\System\kZCivro.exe
  2⤵
  PID:1020
- C:\Windows\System\dcjbDQD.exe
  C:\Windows\System\dcjbDQD.exe
  2⤵
  PID:4060
- C:\Windows\System\VHziYmh.exe
  C:\Windows\System\VHziYmh.exe
  2⤵
  PID:4028
- C:\Windows\System\IzkQHgv.exe
  C:\Windows\System\IzkQHgv.exe
  2⤵
  PID:2704
- C:\Windows\System\BxGaqoL.exe
  C:\Windows\System\BxGaqoL.exe
  2⤵
  PID:1444
- C:\Windows\System\JbwdDac.exe
  C:\Windows\System\JbwdDac.exe
  2⤵
  PID:2756
- C:\Windows\System\dJDKPXu.exe
  C:\Windows\System\dJDKPXu.exe
  2⤵
  PID:2728
- C:\Windows\System\JvzzDuc.exe
  C:\Windows\System\JvzzDuc.exe
  2⤵
  PID:1688
- C:\Windows\System\aUnPaNU.exe
  C:\Windows\System\aUnPaNU.exe
  2⤵
  PID:2384
- C:\Windows\System\UVelzjz.exe
  C:\Windows\System\UVelzjz.exe
  2⤵
  PID:3292
- C:\Windows\System\aGIQHWz.exe
  C:\Windows\System\aGIQHWz.exe
  2⤵
  PID:1304
- C:\Windows\System\mqwPdZa.exe
  C:\Windows\System\mqwPdZa.exe
  2⤵
  PID:3472
- C:\Windows\System\BqnjTev.exe
  C:\Windows\System\BqnjTev.exe
  2⤵
  PID:2660
- C:\Windows\System\ffBuHUJ.exe
  C:\Windows\System\ffBuHUJ.exe
  2⤵
  PID:2632
- C:\Windows\System\mifcziO.exe
  C:\Windows\System\mifcziO.exe
  2⤵
  PID:3700
- C:\Windows\System\qOvkAFQ.exe
  C:\Windows\System\qOvkAFQ.exe
  2⤵
  PID:3948
- C:\Windows\System\zRySAQB.exe
  C:\Windows\System\zRySAQB.exe
  2⤵
  PID:1716
- C:\Windows\System\YvhrHcf.exe
  C:\Windows\System\YvhrHcf.exe
  2⤵
  PID:3772
- C:\Windows\System\stsDKXY.exe
  C:\Windows\System\stsDKXY.exe
  2⤵
  PID:4044
- C:\Windows\System\CxWzCqE.exe
  C:\Windows\System\CxWzCqE.exe
  2⤵
  PID:4048
- C:\Windows\System\FNOgagJ.exe
  C:\Windows\System\FNOgagJ.exe
  2⤵
  PID:2004
- C:\Windows\System\dHTvMuo.exe
  C:\Windows\System\dHTvMuo.exe
  2⤵
  PID:2448
- C:\Windows\System\FmYMMFC.exe
  C:\Windows\System\FmYMMFC.exe
  2⤵
  PID:3148
- C:\Windows\System\GNzTyuY.exe
  C:\Windows\System\GNzTyuY.exe
  2⤵
  PID:1068
- C:\Windows\System\ztsEhCW.exe
  C:\Windows\System\ztsEhCW.exe
  2⤵
  PID:3272
- C:\Windows\System\kUYpExk.exe
  C:\Windows\System\kUYpExk.exe
  2⤵
  PID:3648
- C:\Windows\System\KSnVeCO.exe
  C:\Windows\System\KSnVeCO.exe
  2⤵
  PID:3716
- C:\Windows\System\fIoTsZa.exe
  C:\Windows\System\fIoTsZa.exe
  2⤵
  PID:2784
- C:\Windows\System\lATLYEQ.exe
  C:\Windows\System\lATLYEQ.exe
  2⤵
  PID:2444
- C:\Windows\System\KkpssyY.exe
  C:\Windows\System\KkpssyY.exe
  2⤵
  PID:1272
- C:\Windows\System\GKdcDos.exe
  C:\Windows\System\GKdcDos.exe
  2⤵
  PID:3792
- C:\Windows\System\AIdKTLW.exe
  C:\Windows\System\AIdKTLW.exe
  2⤵
  PID:1580
- C:\Windows\System\DVBltXg.exe
  C:\Windows\System\DVBltXg.exe
  2⤵
  PID:3012
- C:\Windows\System\NZnHkIi.exe
  C:\Windows\System\NZnHkIi.exe
  2⤵
  PID:2464
- C:\Windows\System\QKDqMZp.exe
  C:\Windows\System\QKDqMZp.exe
  2⤵
  PID:2716
- C:\Windows\System\yGIlIAK.exe
  C:\Windows\System\yGIlIAK.exe
  2⤵
  PID:4108
- C:\Windows\System\VJNcuAB.exe
  C:\Windows\System\VJNcuAB.exe
  2⤵
  PID:4124
- C:\Windows\System\acPZQhv.exe
  C:\Windows\System\acPZQhv.exe
  2⤵
  PID:4140
- C:\Windows\System\hwbIBYr.exe
  C:\Windows\System\hwbIBYr.exe
  2⤵
  PID:4156
- C:\Windows\System\tURmoax.exe
  C:\Windows\System\tURmoax.exe
  2⤵
  PID:4172
- C:\Windows\System\lpzqkHC.exe
  C:\Windows\System\lpzqkHC.exe
  2⤵
  PID:4188
- C:\Windows\System\INPHnYf.exe
  C:\Windows\System\INPHnYf.exe
  2⤵
  PID:4204
- C:\Windows\System\olUkyBR.exe
  C:\Windows\System\olUkyBR.exe
  2⤵
  PID:4220
- C:\Windows\System\yBpNTSm.exe
  C:\Windows\System\yBpNTSm.exe
  2⤵
  PID:4236
- C:\Windows\System\AfEbuyr.exe
  C:\Windows\System\AfEbuyr.exe
  2⤵
  PID:4252
- C:\Windows\System\jEEXBYr.exe
  C:\Windows\System\jEEXBYr.exe
  2⤵
  PID:4268
- C:\Windows\System\JriKbsk.exe
  C:\Windows\System\JriKbsk.exe
  2⤵
  PID:4284
- C:\Windows\System\gLxHVqC.exe
  C:\Windows\System\gLxHVqC.exe
  2⤵
  PID:4300
- C:\Windows\System\wvAwSPP.exe
  C:\Windows\System\wvAwSPP.exe
  2⤵
  PID:4316
- C:\Windows\System\EJfgqeF.exe
  C:\Windows\System\EJfgqeF.exe
  2⤵
  PID:4332
- C:\Windows\System\fdFeroE.exe
  C:\Windows\System\fdFeroE.exe
  2⤵
  PID:4348
- C:\Windows\System\TVBwELi.exe
  C:\Windows\System\TVBwELi.exe
  2⤵
  PID:4364
- C:\Windows\System\tPPwnDt.exe
  C:\Windows\System\tPPwnDt.exe
  2⤵
  PID:4380
- C:\Windows\System\ZOFnawX.exe
  C:\Windows\System\ZOFnawX.exe
  2⤵
  PID:4396
- C:\Windows\System\rekDOtQ.exe
  C:\Windows\System\rekDOtQ.exe
  2⤵
  PID:4412
- C:\Windows\System\jMLSiGa.exe
  C:\Windows\System\jMLSiGa.exe
  2⤵
  PID:4428
- C:\Windows\System\KaVVfAP.exe
  C:\Windows\System\KaVVfAP.exe
  2⤵
  PID:4444
- C:\Windows\System\gmDYypS.exe
  C:\Windows\System\gmDYypS.exe
  2⤵
  PID:4460
- C:\Windows\System\qyChlta.exe
  C:\Windows\System\qyChlta.exe
  2⤵
  PID:4476
- C:\Windows\System\ivKKOpg.exe
  C:\Windows\System\ivKKOpg.exe
  2⤵
  PID:4492
- C:\Windows\System\iCTwyXX.exe
  C:\Windows\System\iCTwyXX.exe
  2⤵
  PID:4508
- C:\Windows\System\nTuuciX.exe
  C:\Windows\System\nTuuciX.exe
  2⤵
  PID:4524
- C:\Windows\System\pGKysyf.exe
  C:\Windows\System\pGKysyf.exe
  2⤵
  PID:4540
- C:\Windows\System\HxpwHyf.exe
  C:\Windows\System\HxpwHyf.exe
  2⤵
  PID:4556
- C:\Windows\System\tQYiWAI.exe
  C:\Windows\System\tQYiWAI.exe
  2⤵
  PID:4572
- C:\Windows\System\YGrjkay.exe
  C:\Windows\System\YGrjkay.exe
  2⤵
  PID:4588
- C:\Windows\System\QphiUCO.exe
  C:\Windows\System\QphiUCO.exe
  2⤵
  PID:4604
- C:\Windows\System\wPOMhTv.exe
  C:\Windows\System\wPOMhTv.exe
  2⤵
  PID:4620
- C:\Windows\System\fcuVoyF.exe
  C:\Windows\System\fcuVoyF.exe
  2⤵
  PID:4636
- C:\Windows\System\bAYCqeU.exe
  C:\Windows\System\bAYCqeU.exe
  2⤵
  PID:4656
- C:\Windows\System\KKVBpLI.exe
  C:\Windows\System\KKVBpLI.exe
  2⤵
  PID:4672
- C:\Windows\System\DOjDACt.exe
  C:\Windows\System\DOjDACt.exe
  2⤵
  PID:4696
- C:\Windows\System\VsGwxNF.exe
  C:\Windows\System\VsGwxNF.exe
  2⤵
  PID:4716
- C:\Windows\System\PLbwmSX.exe
  C:\Windows\System\PLbwmSX.exe
  2⤵
  PID:4732
- C:\Windows\System\cwuIDsR.exe
  C:\Windows\System\cwuIDsR.exe
  2⤵
  PID:4748
- C:\Windows\System\NmSRbFS.exe
  C:\Windows\System\NmSRbFS.exe
  2⤵
  PID:4764
- C:\Windows\System\llmhiHt.exe
  C:\Windows\System\llmhiHt.exe
  2⤵
  PID:4780
- C:\Windows\System\cphLcDq.exe
  C:\Windows\System\cphLcDq.exe
  2⤵
  PID:4796
- C:\Windows\System\rEVtSgK.exe
  C:\Windows\System\rEVtSgK.exe
  2⤵
  PID:4812
- C:\Windows\System\mvEdpba.exe
  C:\Windows\System\mvEdpba.exe
  2⤵
  PID:4828
- C:\Windows\System\OarrpVZ.exe
  C:\Windows\System\OarrpVZ.exe
  2⤵
  PID:4844
- C:\Windows\System\dIXveMK.exe
  C:\Windows\System\dIXveMK.exe
  2⤵
  PID:4860
- C:\Windows\System\ojprjmM.exe
  C:\Windows\System\ojprjmM.exe
  2⤵
  PID:4876
- C:\Windows\System\oUweurs.exe
  C:\Windows\System\oUweurs.exe
  2⤵
  PID:4892
- C:\Windows\System\segRFLu.exe
  C:\Windows\System\segRFLu.exe
  2⤵
  PID:4908
- C:\Windows\System\cTsvYwS.exe
  C:\Windows\System\cTsvYwS.exe
  2⤵
  PID:4924
- C:\Windows\System\xgZrEQc.exe
  C:\Windows\System\xgZrEQc.exe
  2⤵
  PID:4940
- C:\Windows\System\zPIZqDa.exe
  C:\Windows\System\zPIZqDa.exe
  2⤵
  PID:4956
- C:\Windows\System\PutapEG.exe
  C:\Windows\System\PutapEG.exe
  2⤵
  PID:4972
- C:\Windows\System\bAXREkG.exe
  C:\Windows\System\bAXREkG.exe
  2⤵
  PID:4988
- C:\Windows\System\qGRoZFU.exe
  C:\Windows\System\qGRoZFU.exe
  2⤵
  PID:5004
- C:\Windows\System\AQtiNor.exe
  C:\Windows\System\AQtiNor.exe
  2⤵
  PID:5020
- C:\Windows\System\tNoWDEz.exe
  C:\Windows\System\tNoWDEz.exe
  2⤵
  PID:5036
- C:\Windows\System\mYGZHur.exe
  C:\Windows\System\mYGZHur.exe
  2⤵
  PID:5052
- C:\Windows\System\nYYCnpx.exe
  C:\Windows\System\nYYCnpx.exe
  2⤵
  PID:5076
- C:\Windows\System\LrwbBnD.exe
  C:\Windows\System\LrwbBnD.exe
  2⤵
  PID:5096
- C:\Windows\System\WdnavmO.exe
  C:\Windows\System\WdnavmO.exe
  2⤵
  PID:5112
- C:\Windows\System\ifXwPve.exe
  C:\Windows\System\ifXwPve.exe
  2⤵
  PID:4100
- C:\Windows\System\cDwlNmN.exe
  C:\Windows\System\cDwlNmN.exe
  2⤵
  PID:3740
- C:\Windows\System\vemlvXX.exe
  C:\Windows\System\vemlvXX.exe
  2⤵
  PID:4132
- C:\Windows\System\WvjRRWZ.exe
  C:\Windows\System\WvjRRWZ.exe
  2⤵
  PID:4180
- C:\Windows\System\GRzsvrB.exe
  C:\Windows\System\GRzsvrB.exe
  2⤵
  PID:4196
- C:\Windows\System\pnrKzck.exe
  C:\Windows\System\pnrKzck.exe
  2⤵
  PID:4248
- C:\Windows\System\LuUazai.exe
  C:\Windows\System\LuUazai.exe
  2⤵
  PID:4260
- C:\Windows\System\MAQzBWn.exe
  C:\Windows\System\MAQzBWn.exe
  2⤵
  PID:3720
- C:\Windows\System\rpVIDOu.exe
  C:\Windows\System\rpVIDOu.exe
  2⤵
  PID:4344
- C:\Windows\System\IJLiaWp.exe
  C:\Windows\System\IJLiaWp.exe
  2⤵
  PID:4372
- C:\Windows\System\grFJZiN.exe
  C:\Windows\System\grFJZiN.exe
  2⤵
  PID:4388
- C:\Windows\System\eubhTMV.exe
  C:\Windows\System\eubhTMV.exe
  2⤵
  PID:4424
- C:\Windows\System\odgcnXw.exe
  C:\Windows\System\odgcnXw.exe
  2⤵
  PID:4468
- C:\Windows\System\AwxAVGk.exe
  C:\Windows\System\AwxAVGk.exe
  2⤵
  PID:4536
- C:\Windows\System\qsXSSKT.exe
  C:\Windows\System\qsXSSKT.exe
  2⤵
  PID:4564
- C:\Windows\System\xhxvrqB.exe
  C:\Windows\System\xhxvrqB.exe
  2⤵
  PID:4568
- C:\Windows\System\qGConjl.exe
  C:\Windows\System\qGConjl.exe
  2⤵
  PID:4580
- C:\Windows\System\cDAOOAb.exe
  C:\Windows\System\cDAOOAb.exe
  2⤵
  PID:4616
- C:\Windows\System\GnOcORT.exe
  C:\Windows\System\GnOcORT.exe
  2⤵
  PID:4632
- C:\Windows\System\OfTbfOg.exe
  C:\Windows\System\OfTbfOg.exe
  2⤵
  PID:4708
- C:\Windows\System\OzPdehb.exe
  C:\Windows\System\OzPdehb.exe
  2⤵
  PID:4724
- C:\Windows\System\aKLhbXG.exe
  C:\Windows\System\aKLhbXG.exe
  2⤵
  PID:4772
- C:\Windows\System\ANipcHU.exe
  C:\Windows\System\ANipcHU.exe
  2⤵
  PID:4756
- C:\Windows\System\bOhvBif.exe
  C:\Windows\System\bOhvBif.exe
  2⤵
  PID:4788
- C:\Windows\System\LULzqIQ.exe
  C:\Windows\System\LULzqIQ.exe
  2⤵
  PID:4824
- C:\Windows\System\xUpRwOO.exe
  C:\Windows\System\xUpRwOO.exe
  2⤵
  PID:4904
- C:\Windows\System\OJxzkrn.exe
  C:\Windows\System\OJxzkrn.exe
  2⤵
  PID:4884
- C:\Windows\System\bTIfPQH.exe
  C:\Windows\System\bTIfPQH.exe
  2⤵
  PID:4984
- C:\Windows\System\DySKVWq.exe
  C:\Windows\System\DySKVWq.exe
  2⤵
  PID:5032
- C:\Windows\System\DJVNDoZ.exe
  C:\Windows\System\DJVNDoZ.exe
  2⤵
  PID:5064
- C:\Windows\System\JKgTdQV.exe
  C:\Windows\System\JKgTdQV.exe
  2⤵
  PID:5084
- C:\Windows\System\OtHVLRo.exe
  C:\Windows\System\OtHVLRo.exe
  2⤵
  PID:1536
- C:\Windows\System\msWpJaX.exe
  C:\Windows\System\msWpJaX.exe
  2⤵
  PID:4116
- C:\Windows\System\cpoQHry.exe
  C:\Windows\System\cpoQHry.exe
  2⤵
  PID:4148
- C:\Windows\System\vzMJTIW.exe
  C:\Windows\System\vzMJTIW.exe
  2⤵
  PID:4244
- C:\Windows\System\HQLBzPl.exe
  C:\Windows\System\HQLBzPl.exe
  2⤵
  PID:4296
- C:\Windows\System\KrNWJLQ.exe
  C:\Windows\System\KrNWJLQ.exe
  2⤵
  PID:4500
- C:\Windows\System\egflHqE.exe
  C:\Windows\System\egflHqE.exe
  2⤵
  PID:4340
- C:\Windows\System\xcAGYCK.exe
  C:\Windows\System\xcAGYCK.exe
  2⤵
  PID:4612
- C:\Windows\System\tSywHwa.exe
  C:\Windows\System\tSywHwa.exe
  2⤵
  PID:4360
- C:\Windows\System\Rlvrxcl.exe
  C:\Windows\System\Rlvrxcl.exe
  2⤵
  PID:4704
- C:\Windows\System\mJXgPjL.exe
  C:\Windows\System\mJXgPjL.exe
  2⤵
  PID:4516
- C:\Windows\System\iqbtGss.exe
  C:\Windows\System\iqbtGss.exe
  2⤵
  PID:4744
- C:\Windows\System\YhOHVlo.exe
  C:\Windows\System\YhOHVlo.exe
  2⤵
  PID:4808
- C:\Windows\System\JZfIjlT.exe
  C:\Windows\System\JZfIjlT.exe
  2⤵
  PID:4868
- C:\Windows\System\vVczDfq.exe
  C:\Windows\System\vVczDfq.exe
  2⤵
  PID:4964
- C:\Windows\System\OJyyuOs.exe
  C:\Windows\System\OJyyuOs.exe
  2⤵
  PID:4916
- C:\Windows\System\pMWARCU.exe
  C:\Windows\System\pMWARCU.exe
  2⤵
  PID:4952
- C:\Windows\System\MZaEJCe.exe
  C:\Windows\System\MZaEJCe.exe
  2⤵
  PID:5108
- C:\Windows\System\GPyrQmT.exe
  C:\Windows\System\GPyrQmT.exe
  2⤵
  PID:5060
- C:\Windows\System\IjFGClO.exe
  C:\Windows\System\IjFGClO.exe
  2⤵
  PID:4532
- C:\Windows\System\VgerJIU.exe
  C:\Windows\System\VgerJIU.exe
  2⤵
  PID:4392
- C:\Windows\System\LyaqLTo.exe
  C:\Windows\System\LyaqLTo.exe
  2⤵
  PID:4200
- C:\Windows\System\DhrsWdM.exe
  C:\Windows\System\DhrsWdM.exe
  2⤵
  PID:5072
- C:\Windows\System\knBnyoj.exe
  C:\Windows\System\knBnyoj.exe
  2⤵
  PID:4452
- C:\Windows\System\jRTjhaJ.exe
  C:\Windows\System\jRTjhaJ.exe
  2⤵
  PID:4228
- C:\Windows\System\iIZbpeP.exe
  C:\Windows\System\iIZbpeP.exe
  2⤵
  PID:4856
- C:\Windows\System\qkhRnwd.exe
  C:\Windows\System\qkhRnwd.exe
  2⤵
  PID:4888
- C:\Windows\System\cgHKDNZ.exe
  C:\Windows\System\cgHKDNZ.exe
  2⤵
  PID:4280
- C:\Windows\System\AKUdLiX.exe
  C:\Windows\System\AKUdLiX.exe
  2⤵
  PID:5104
- C:\Windows\System\WyVlqOR.exe
  C:\Windows\System\WyVlqOR.exe
  2⤵
  PID:3628
- C:\Windows\System\vrXmALH.exe
  C:\Windows\System\vrXmALH.exe
  2⤵
  PID:4820
- C:\Windows\System\IhfPuce.exe
  C:\Windows\System\IhfPuce.exe
  2⤵
  PID:5132
- C:\Windows\System\NbbDPhT.exe
  C:\Windows\System\NbbDPhT.exe
  2⤵
  PID:5152
- C:\Windows\System\ZZWeCww.exe
  C:\Windows\System\ZZWeCww.exe
  2⤵
  PID:5168
- C:\Windows\System\JOyzVvZ.exe
  C:\Windows\System\JOyzVvZ.exe
  2⤵
  PID:5184
- C:\Windows\System\XCYzQWn.exe
  C:\Windows\System\XCYzQWn.exe
  2⤵
  PID:5200
- C:\Windows\System\SMZwzSw.exe
  C:\Windows\System\SMZwzSw.exe
  2⤵
  PID:5216
- C:\Windows\System\cJqxMie.exe
  C:\Windows\System\cJqxMie.exe
  2⤵
  PID:5240
- C:\Windows\System\wzGEBhP.exe
  C:\Windows\System\wzGEBhP.exe
  2⤵
  PID:5260
- C:\Windows\System\BXUFoym.exe
  C:\Windows\System\BXUFoym.exe
  2⤵
  PID:5276
- C:\Windows\System\ItfzUhA.exe
  C:\Windows\System\ItfzUhA.exe
  2⤵
  PID:5296
- C:\Windows\System\QsbKirT.exe
  C:\Windows\System\QsbKirT.exe
  2⤵
  PID:5320
- C:\Windows\System\BOQnlrI.exe
  C:\Windows\System\BOQnlrI.exe
  2⤵
  PID:5336
- C:\Windows\System\NRYgBrG.exe
  C:\Windows\System\NRYgBrG.exe
  2⤵
  PID:5356
- C:\Windows\System\Ouywkjp.exe
  C:\Windows\System\Ouywkjp.exe
  2⤵
  PID:5372
- C:\Windows\System\GgBgzSN.exe
  C:\Windows\System\GgBgzSN.exe
  2⤵
  PID:5388
- C:\Windows\System\FGzeISJ.exe
  C:\Windows\System\FGzeISJ.exe
  2⤵
  PID:5404
- C:\Windows\System\NcewFTD.exe
  C:\Windows\System\NcewFTD.exe
  2⤵
  PID:5420
- C:\Windows\System\zBxWylm.exe
  C:\Windows\System\zBxWylm.exe
  2⤵
  PID:5436
- C:\Windows\System\rHoeYiC.exe
  C:\Windows\System\rHoeYiC.exe
  2⤵
  PID:5452
- C:\Windows\System\aGwpUEG.exe
  C:\Windows\System\aGwpUEG.exe
  2⤵
  PID:5468
- C:\Windows\System\YGPhhkh.exe
  C:\Windows\System\YGPhhkh.exe
  2⤵
  PID:5484
- C:\Windows\System\viXIrqN.exe
  C:\Windows\System\viXIrqN.exe
  2⤵
  PID:5500
- C:\Windows\System\HHiCExO.exe
  C:\Windows\System\HHiCExO.exe
  2⤵
  PID:5516
- C:\Windows\System\EabgsWt.exe
  C:\Windows\System\EabgsWt.exe
  2⤵
  PID:5532
- C:\Windows\System\VkmitAJ.exe
  C:\Windows\System\VkmitAJ.exe
  2⤵
  PID:5552
- C:\Windows\System\AjevOxy.exe
  C:\Windows\System\AjevOxy.exe
  2⤵
  PID:5592
- C:\Windows\System\laTPPUf.exe
  C:\Windows\System\laTPPUf.exe
  2⤵
  PID:5636
- C:\Windows\System\YrZgNbp.exe
  C:\Windows\System\YrZgNbp.exe
  2⤵
  PID:5664
- C:\Windows\System\FPoBvPI.exe
  C:\Windows\System\FPoBvPI.exe
  2⤵
  PID:5684
- C:\Windows\System\XocohfA.exe
  C:\Windows\System\XocohfA.exe
  2⤵
  PID:5700
- C:\Windows\System\zADxRiD.exe
  C:\Windows\System\zADxRiD.exe
  2⤵
  PID:5720
- C:\Windows\System\bfspOko.exe
  C:\Windows\System\bfspOko.exe
  2⤵
  PID:5736
- C:\Windows\System\YtxYVHL.exe
  C:\Windows\System\YtxYVHL.exe
  2⤵
  PID:5752
- C:\Windows\System\bUEgHuX.exe
  C:\Windows\System\bUEgHuX.exe
  2⤵
  PID:5768
- C:\Windows\System\TSFLiRp.exe
  C:\Windows\System\TSFLiRp.exe
  2⤵
  PID:5784
- C:\Windows\System\JKhGQEK.exe
  C:\Windows\System\JKhGQEK.exe
  2⤵
  PID:5800
- C:\Windows\System\kjSPSLm.exe
  C:\Windows\System\kjSPSLm.exe
  2⤵
  PID:5816
- C:\Windows\System\ybuSyXm.exe
  C:\Windows\System\ybuSyXm.exe
  2⤵
  PID:5832
- C:\Windows\System\WgElGAA.exe
  C:\Windows\System\WgElGAA.exe
  2⤵
  PID:5848
- C:\Windows\System\QugzqKl.exe
  C:\Windows\System\QugzqKl.exe
  2⤵
  PID:5864
- C:\Windows\System\XPPxiiC.exe
  C:\Windows\System\XPPxiiC.exe
  2⤵
  PID:5880
- C:\Windows\System\densnHq.exe
  C:\Windows\System\densnHq.exe
  2⤵
  PID:5896
- C:\Windows\System\ZfSwpbQ.exe
  C:\Windows\System\ZfSwpbQ.exe
  2⤵
  PID:5912
- C:\Windows\System\KkhrUWs.exe
  C:\Windows\System\KkhrUWs.exe
  2⤵
  PID:5932
- C:\Windows\System\dKoRWgo.exe
  C:\Windows\System\dKoRWgo.exe
  2⤵
  PID:5948
- C:\Windows\System\NtRrxWN.exe
  C:\Windows\System\NtRrxWN.exe
  2⤵
  PID:5972
- C:\Windows\System\DTrsMIk.exe
  C:\Windows\System\DTrsMIk.exe
  2⤵
  PID:5988
- C:\Windows\System\VrhOUcJ.exe
  C:\Windows\System\VrhOUcJ.exe
  2⤵
  PID:6004
- C:\Windows\System\zpupJci.exe
  C:\Windows\System\zpupJci.exe
  2⤵
  PID:6020
- C:\Windows\System\ZxeAkPP.exe
  C:\Windows\System\ZxeAkPP.exe
  2⤵
  PID:6036
- C:\Windows\System\GLompyA.exe
  C:\Windows\System\GLompyA.exe
  2⤵
  PID:6052
- C:\Windows\System\UmOVTee.exe
  C:\Windows\System\UmOVTee.exe
  2⤵
  PID:6072
- C:\Windows\System\ralYbiB.exe
  C:\Windows\System\ralYbiB.exe
  2⤵
  PID:6088
- C:\Windows\System\opkyRQP.exe
  C:\Windows\System\opkyRQP.exe
  2⤵
  PID:6108
- C:\Windows\System\nmjlpBq.exe
  C:\Windows\System\nmjlpBq.exe
  2⤵
  PID:6124
- C:\Windows\System\EPcZbMi.exe
  C:\Windows\System\EPcZbMi.exe
  2⤵
  PID:6140
- C:\Windows\System\itFZQyt.exe
  C:\Windows\System\itFZQyt.exe
  2⤵
  PID:4680
- C:\Windows\System\clvPnVB.exe
  C:\Windows\System\clvPnVB.exe
  2⤵
  PID:5148
- C:\Windows\System\zgudyuE.exe
  C:\Windows\System\zgudyuE.exe
  2⤵
  PID:5028
- C:\Windows\System\YcGmrvu.exe
  C:\Windows\System\YcGmrvu.exe
  2⤵
  PID:5308
- C:\Windows\System\OEXKaVx.exe
  C:\Windows\System\OEXKaVx.exe
  2⤵
  PID:5348
- C:\Windows\System\RGICrmh.exe
  C:\Windows\System\RGICrmh.exe
  2⤵
  PID:5380
- C:\Windows\System\DnJLXOa.exe
  C:\Windows\System\DnJLXOa.exe
  2⤵
  PID:5416
- C:\Windows\System\txauhgX.exe
  C:\Windows\System\txauhgX.exe
  2⤵
  PID:5432
- C:\Windows\System\VtBPKMi.exe
  C:\Windows\System\VtBPKMi.exe
  2⤵
  PID:5512
- C:\Windows\System\FDNjWcI.exe
  C:\Windows\System\FDNjWcI.exe
  2⤵
  PID:5544
- C:\Windows\System\nkIVKcn.exe
  C:\Windows\System\nkIVKcn.exe
  2⤵
  PID:5576
- C:\Windows\System\GbqNErV.exe
  C:\Windows\System\GbqNErV.exe
  2⤵
  PID:5600
- C:\Windows\System\VGCmFCL.exe
  C:\Windows\System\VGCmFCL.exe
  2⤵
  PID:5616
- C:\Windows\System\wyrfrAo.exe
  C:\Windows\System\wyrfrAo.exe
  2⤵
  PID:5624
- C:\Windows\System\VjZBtwU.exe
  C:\Windows\System\VjZBtwU.exe
  2⤵
  PID:5660
- C:\Windows\System\OrZcwYL.exe
  C:\Windows\System\OrZcwYL.exe
  2⤵
  PID:5672
- C:\Windows\System\YxCXsnD.exe
  C:\Windows\System\YxCXsnD.exe
  2⤵
  PID:5744
- C:\Windows\System\gtbuqlQ.exe
  C:\Windows\System\gtbuqlQ.exe
  2⤵
  PID:5780
- C:\Windows\System\sgBlvpx.exe
  C:\Windows\System\sgBlvpx.exe
  2⤵
  PID:5764
- C:\Windows\System\bSbICdn.exe
  C:\Windows\System\bSbICdn.exe
  2⤵
  PID:5844
- C:\Windows\System\wXDXVrA.exe
  C:\Windows\System\wXDXVrA.exe
  2⤵
  PID:5928
- C:\Windows\System\ZOlMrRy.exe
  C:\Windows\System\ZOlMrRy.exe
  2⤵
  PID:5908
- C:\Windows\System\YBvYChx.exe
  C:\Windows\System\YBvYChx.exe
  2⤵
  PID:5996
- C:\Windows\System\wMIGzZE.exe
  C:\Windows\System\wMIGzZE.exe
  2⤵
  PID:5960
- C:\Windows\System\cBHdYrG.exe
  C:\Windows\System\cBHdYrG.exe
  2⤵
  PID:6064
- C:\Windows\System\lSWbzUL.exe
  C:\Windows\System\lSWbzUL.exe
  2⤵
  PID:6100
- C:\Windows\System\CopATiw.exe
  C:\Windows\System\CopATiw.exe
  2⤵
  PID:5048
- C:\Windows\System\sTOjUAV.exe
  C:\Windows\System\sTOjUAV.exe
  2⤵
  PID:6116
- C:\Windows\System\clofgOB.exe
  C:\Windows\System\clofgOB.exe
  2⤵
  PID:3556
- C:\Windows\System\mCeqnNP.exe
  C:\Windows\System\mCeqnNP.exe
  2⤵
  PID:5160
- C:\Windows\System\BUrjViy.exe
  C:\Windows\System\BUrjViy.exe
  2⤵
  PID:5212
- C:\Windows\System\MeFUngh.exe
  C:\Windows\System\MeFUngh.exe
  2⤵
  PID:5196
- C:\Windows\System\jxZzgem.exe
  C:\Windows\System\jxZzgem.exe
  2⤵
  PID:5252
- C:\Windows\System\ZXJHlrF.exe
  C:\Windows\System\ZXJHlrF.exe
  2⤵
  PID:5328
- C:\Windows\System\dAeZJLj.exe
  C:\Windows\System\dAeZJLj.exe
  2⤵
  PID:5812
- C:\Windows\System\vwoidEc.exe
  C:\Windows\System\vwoidEc.exe
  2⤵
  PID:5316
- C:\Windows\System\jSfdaSj.exe
  C:\Windows\System\jSfdaSj.exe
  2⤵
  PID:5428
- C:\Windows\System\SFMBMkz.exe
  C:\Windows\System\SFMBMkz.exe
  2⤵
  PID:5444
- C:\Windows\System\JvyPcip.exe
  C:\Windows\System\JvyPcip.exe
  2⤵
  PID:5528
- C:\Windows\System\SaCaVWU.exe
  C:\Windows\System\SaCaVWU.exe
  2⤵
  PID:5760
- C:\Windows\System\jazpEds.exe
  C:\Windows\System\jazpEds.exe
  2⤵
  PID:5792
- C:\Windows\System\eVatdTO.exe
  C:\Windows\System\eVatdTO.exe
  2⤵
  PID:5840
- C:\Windows\System\SlQLpld.exe
  C:\Windows\System\SlQLpld.exe
  2⤵
  PID:5924
- C:\Windows\System\jywHMZK.exe
  C:\Windows\System\jywHMZK.exe
  2⤵
  PID:6048
- C:\Windows\System\cDLnxRr.exe
  C:\Windows\System\cDLnxRr.exe
  2⤵
  PID:6032
- C:\Windows\System\sfyAKAl.exe
  C:\Windows\System\sfyAKAl.exe
  2⤵
  PID:5828
- C:\Windows\System\qblzdsH.exe
  C:\Windows\System\qblzdsH.exe
  2⤵
  PID:4484
- C:\Windows\System\JbAhtoM.exe
  C:\Windows\System\JbAhtoM.exe
  2⤵
  PID:5232
- C:\Windows\System\nhgqTrL.exe
  C:\Windows\System\nhgqTrL.exe
  2⤵
  PID:5332
- C:\Windows\System\pJfeCDO.exe
  C:\Windows\System\pJfeCDO.exe
  2⤵
  PID:5272
- C:\Windows\System\EpepONB.exe
  C:\Windows\System\EpepONB.exe
  2⤵
  PID:5584
- C:\Windows\System\hZoBdih.exe
  C:\Windows\System\hZoBdih.exe
  2⤵
  PID:5648
- C:\Windows\System\MDdTOnt.exe
  C:\Windows\System\MDdTOnt.exe
  2⤵
  PID:5716
- C:\Windows\System\mZXvSkH.exe
  C:\Windows\System\mZXvSkH.exe
  2⤵
  PID:5128
- C:\Windows\System\xzRLYjE.exe
  C:\Windows\System\xzRLYjE.exe
  2⤵
  PID:5620
- C:\Windows\System\OUjqNkx.exe
  C:\Windows\System\OUjqNkx.exe
  2⤵
  PID:5728
- C:\Windows\System\dAokevP.exe
  C:\Windows\System\dAokevP.exe
  2⤵
  PID:2636
- C:\Windows\System\GYMbhUS.exe
  C:\Windows\System\GYMbhUS.exe
  2⤵
  PID:5944
- C:\Windows\System\zAxxKID.exe
  C:\Windows\System\zAxxKID.exe
  2⤵
  PID:5984
- C:\Windows\System\KamfAOF.exe
  C:\Windows\System\KamfAOF.exe
  2⤵
  PID:5192
- C:\Windows\System\QNGLFBa.exe
  C:\Windows\System\QNGLFBa.exe
  2⤵
  PID:5708
- C:\Windows\System\PnBfWuF.exe
  C:\Windows\System\PnBfWuF.exe
  2⤵
  PID:5224
- C:\Windows\System\jdpndYD.exe
  C:\Windows\System\jdpndYD.exe
  2⤵
  PID:6132
- C:\Windows\System\EhwACpy.exe
  C:\Windows\System\EhwACpy.exe
  2⤵
  PID:5496
- C:\Windows\System\RBmRpju.exe
  C:\Windows\System\RBmRpju.exe
  2⤵
  PID:5652
- C:\Windows\System\WMRfYrv.exe
  C:\Windows\System\WMRfYrv.exe
  2⤵
  PID:4692
- C:\Windows\System\LoDNcsk.exe
  C:\Windows\System\LoDNcsk.exe
  2⤵
  PID:5892
- C:\Windows\System\CHdKGnD.exe
  C:\Windows\System\CHdKGnD.exe
  2⤵
  PID:5344
- C:\Windows\System\bkwwlKy.exe
  C:\Windows\System\bkwwlKy.exe
  2⤵
  PID:5712
- C:\Windows\System\tDjIogR.exe
  C:\Windows\System\tDjIogR.exe
  2⤵
  PID:5268
- C:\Windows\System\pZHpDuv.exe
  C:\Windows\System\pZHpDuv.exe
  2⤵
  PID:6152
- C:\Windows\System\NsskTzc.exe
  C:\Windows\System\NsskTzc.exe
  2⤵
  PID:6176
- C:\Windows\System\XIkxgJx.exe
  C:\Windows\System\XIkxgJx.exe
  2⤵
  PID:6192
- C:\Windows\System\qyAucXM.exe
  C:\Windows\System\qyAucXM.exe
  2⤵
  PID:6212
- C:\Windows\System\fGzdfxc.exe
  C:\Windows\System\fGzdfxc.exe
  2⤵
  PID:6232
- C:\Windows\System\UaDJtMF.exe
  C:\Windows\System\UaDJtMF.exe
  2⤵
  PID:6256
- C:\Windows\System\uujSjUC.exe
  C:\Windows\System\uujSjUC.exe
  2⤵
  PID:6272
- C:\Windows\System\NDUsjli.exe
  C:\Windows\System\NDUsjli.exe
  2⤵
  PID:6292
- C:\Windows\System\QzXdLLZ.exe
  C:\Windows\System\QzXdLLZ.exe
  2⤵
  PID:6316
- C:\Windows\System\GPnxoiZ.exe
  C:\Windows\System\GPnxoiZ.exe
  2⤵
  PID:6340
- C:\Windows\System\zaxMKHi.exe
  C:\Windows\System\zaxMKHi.exe
  2⤵
  PID:6356
- C:\Windows\System\JOWQuBc.exe
  C:\Windows\System\JOWQuBc.exe
  2⤵
  PID:6380
- C:\Windows\System\yRCRMal.exe
  C:\Windows\System\yRCRMal.exe
  2⤵
  PID:6396
- C:\Windows\System\tEXHSSC.exe
  C:\Windows\System\tEXHSSC.exe
  2⤵
  PID:6416
- C:\Windows\System\SxRHlxg.exe
  C:\Windows\System\SxRHlxg.exe
  2⤵
  PID:6440
- C:\Windows\System\bOkdOde.exe
  C:\Windows\System\bOkdOde.exe
  2⤵
  PID:6468
- C:\Windows\System\foMHnwZ.exe
  C:\Windows\System\foMHnwZ.exe
  2⤵
  PID:6488
- C:\Windows\System\CdxfTZl.exe
  C:\Windows\System\CdxfTZl.exe
  2⤵
  PID:6508
- C:\Windows\System\AppRRQJ.exe
  C:\Windows\System\AppRRQJ.exe
  2⤵
  PID:6528
- C:\Windows\System\AmYkUEr.exe
  C:\Windows\System\AmYkUEr.exe
  2⤵
  PID:6552
- C:\Windows\System\MWTcFih.exe
  C:\Windows\System\MWTcFih.exe
  2⤵
  PID:6580
- C:\Windows\System\vvucnoE.exe
  C:\Windows\System\vvucnoE.exe
  2⤵
  PID:6596
- C:\Windows\System\XYEyYun.exe
  C:\Windows\System\XYEyYun.exe
  2⤵
  PID:6624
- C:\Windows\System\zaRxIKP.exe
  C:\Windows\System\zaRxIKP.exe
  2⤵
  PID:6640
- C:\Windows\System\wYWOwLs.exe
  C:\Windows\System\wYWOwLs.exe
  2⤵
  PID:6660
- C:\Windows\System\ziwJhJX.exe
  C:\Windows\System\ziwJhJX.exe
  2⤵
  PID:6688
- C:\Windows\System\mkZzqHr.exe
  C:\Windows\System\mkZzqHr.exe
  2⤵
  PID:6704
- C:\Windows\System\vlOaXyw.exe
  C:\Windows\System\vlOaXyw.exe
  2⤵
  PID:6724
- C:\Windows\System\cmBXbce.exe
  C:\Windows\System\cmBXbce.exe
  2⤵
  PID:6744
- C:\Windows\System\ssjEDOP.exe
  C:\Windows\System\ssjEDOP.exe
  2⤵
  PID:6760
- C:\Windows\System\XwZFtij.exe
  C:\Windows\System\XwZFtij.exe
  2⤵
  PID:6784
- C:\Windows\System\fufnbHk.exe
  C:\Windows\System\fufnbHk.exe
  2⤵
  PID:6804
- C:\Windows\System\HtrRhGq.exe
  C:\Windows\System\HtrRhGq.exe
  2⤵
  PID:6820
- C:\Windows\System\oVwQVeS.exe
  C:\Windows\System\oVwQVeS.exe
  2⤵
  PID:6840
- C:\Windows\System\ExTNiwV.exe
  C:\Windows\System\ExTNiwV.exe
  2⤵
  PID:6856
- C:\Windows\System\JNGZmxE.exe
  C:\Windows\System\JNGZmxE.exe
  2⤵
  PID:6872
- C:\Windows\System\nLmsAUz.exe
  C:\Windows\System\nLmsAUz.exe
  2⤵
  PID:6912
- C:\Windows\System\ldIbOOJ.exe
  C:\Windows\System\ldIbOOJ.exe
  2⤵
  PID:6936
- C:\Windows\System\mTQPtQX.exe
  C:\Windows\System\mTQPtQX.exe
  2⤵
  PID:6956
- C:\Windows\System\QHxDCHS.exe
  C:\Windows\System\QHxDCHS.exe
  2⤵
  PID:6972
- C:\Windows\System\DArwHVl.exe
  C:\Windows\System\DArwHVl.exe
  2⤵
  PID:6996
- C:\Windows\System\VCVFddR.exe
  C:\Windows\System\VCVFddR.exe
  2⤵
  PID:7020
- C:\Windows\System\PgOnjUC.exe
  C:\Windows\System\PgOnjUC.exe
  2⤵
  PID:7036
- C:\Windows\System\zVIYEGp.exe
  C:\Windows\System\zVIYEGp.exe
  2⤵
  PID:7052
- C:\Windows\System\uzpwXkY.exe
  C:\Windows\System\uzpwXkY.exe
  2⤵
  PID:7072
- C:\Windows\System\WMZaYlW.exe
  C:\Windows\System\WMZaYlW.exe
  2⤵
  PID:7088
- C:\Windows\System\xXJuXMX.exe
  C:\Windows\System\xXJuXMX.exe
  2⤵
  PID:7104
- C:\Windows\System\slKRflv.exe
  C:\Windows\System\slKRflv.exe
  2⤵
  PID:7124
- C:\Windows\System\AVEGrDI.exe
  C:\Windows\System\AVEGrDI.exe
  2⤵
  PID:7144
- C:\Windows\System\KywMwZK.exe
  C:\Windows\System\KywMwZK.exe
  2⤵
  PID:6160
- C:\Windows\System\LpDSvSw.exe
  C:\Windows\System\LpDSvSw.exe
  2⤵
  PID:6228
- C:\Windows\System\HxDqFCg.exe
  C:\Windows\System\HxDqFCg.exe
  2⤵
  PID:5580
- C:\Windows\System\KBGpzIY.exe
  C:\Windows\System\KBGpzIY.exe
  2⤵
  PID:5696
- C:\Windows\System\mZJIgyL.exe
  C:\Windows\System\mZJIgyL.exe
  2⤵
  PID:6304
- C:\Windows\System\MUuyfmF.exe
  C:\Windows\System\MUuyfmF.exe
  2⤵
  PID:6352
- C:\Windows\System\XlGZfKU.exe
  C:\Windows\System\XlGZfKU.exe
  2⤵
  PID:6252
- C:\Windows\System\gNwQIbv.exe
  C:\Windows\System\gNwQIbv.exe
  2⤵
  PID:6332
- C:\Windows\System\GzcYVof.exe
  C:\Windows\System\GzcYVof.exe
  2⤵
  PID:6428
- C:\Windows\System\gLVcIhy.exe
  C:\Windows\System\gLVcIhy.exe
  2⤵
  PID:6364
- C:\Windows\System\VtIRnSO.exe
  C:\Windows\System\VtIRnSO.exe
  2⤵
  PID:6432
- C:\Windows\System\REUqmgx.exe
  C:\Windows\System\REUqmgx.exe
  2⤵
  PID:6464
- C:\Windows\System\cgaRUio.exe
  C:\Windows\System\cgaRUio.exe
  2⤵
  PID:6536
- C:\Windows\System\DVAEhVB.exe
  C:\Windows\System\DVAEhVB.exe
  2⤵
  PID:6520
- C:\Windows\System\bpfThRr.exe
  C:\Windows\System\bpfThRr.exe
  2⤵
  PID:6604
- C:\Windows\System\HGOGBGA.exe
  C:\Windows\System\HGOGBGA.exe
  2⤵
  PID:6616
- C:\Windows\System\AfOiZdv.exe
  C:\Windows\System\AfOiZdv.exe
  2⤵
  PID:5656
- C:\Windows\System\lckaxqg.exe
  C:\Windows\System\lckaxqg.exe
  2⤵
  PID:6676
- C:\Windows\System\DWdgIbs.exe
  C:\Windows\System\DWdgIbs.exe
  2⤵
  PID:6752
- C:\Windows\System\OIxDoJy.exe
  C:\Windows\System\OIxDoJy.exe
  2⤵
  PID:6828
- C:\Windows\System\SDqlNSM.exe
  C:\Windows\System\SDqlNSM.exe
  2⤵
  PID:6768
- C:\Windows\System\WeojZNm.exe
  C:\Windows\System\WeojZNm.exe
  2⤵
  PID:6700
- C:\Windows\System\ZNdCIfB.exe
  C:\Windows\System\ZNdCIfB.exe
  2⤵
  PID:6780
- C:\Windows\System\jNtvhSF.exe
  C:\Windows\System\jNtvhSF.exe
  2⤵
  PID:6900
- C:\Windows\System\pzhHwmY.exe
  C:\Windows\System\pzhHwmY.exe
  2⤵
  PID:6892
- C:\Windows\System\oZqIjwW.exe
  C:\Windows\System\oZqIjwW.exe
  2⤵
  PID:6968
- C:\Windows\System\rChNZwn.exe
  C:\Windows\System\rChNZwn.exe
  2⤵
  PID:7012
- C:\Windows\System\kFmadYS.exe
  C:\Windows\System\kFmadYS.exe
  2⤵
  PID:7048
- C:\Windows\System\AJBekTE.exe
  C:\Windows\System\AJBekTE.exe
  2⤵
  PID:7152
- C:\Windows\System\WkfMWVK.exe
  C:\Windows\System\WkfMWVK.exe
  2⤵
  PID:7156
- C:\Windows\System\fSSTZyG.exe
  C:\Windows\System\fSSTZyG.exe
  2⤵
  PID:6028
- C:\Windows\System\SRCELjh.exe
  C:\Windows\System\SRCELjh.exe
  2⤵
  PID:7068
- C:\Windows\System\rTalYIf.exe
  C:\Windows\System\rTalYIf.exe
  2⤵
  PID:7140
- C:\Windows\System\pDBlQxw.exe
  C:\Windows\System\pDBlQxw.exe
  2⤵
  PID:6220
- C:\Windows\System\LcNYLnT.exe
  C:\Windows\System\LcNYLnT.exe
  2⤵
  PID:6312
- C:\Windows\System\xXEstXm.exe
  C:\Windows\System\xXEstXm.exe
  2⤵
  PID:6244
- C:\Windows\System\bBvZocW.exe
  C:\Windows\System\bBvZocW.exe
  2⤵
  PID:6336
- C:\Windows\System\AcfnZcL.exe
  C:\Windows\System\AcfnZcL.exe
  2⤵
  PID:6496
- C:\Windows\System\bZYBSFh.exe
  C:\Windows\System\bZYBSFh.exe
  2⤵
  PID:6588
- C:\Windows\System\LJiQzMX.exe
  C:\Windows\System\LJiQzMX.exe
  2⤵
  PID:6324
- C:\Windows\System\wqWoprP.exe
  C:\Windows\System\wqWoprP.exe
  2⤵
  PID:6868
- C:\Windows\System\JFuezhs.exe
  C:\Windows\System\JFuezhs.exe
  2⤵
  PID:6740
- C:\Windows\System\aFIIboG.exe
  C:\Windows\System\aFIIboG.exe
  2⤵
  PID:6612
- C:\Windows\System\eYczmwh.exe
  C:\Windows\System\eYczmwh.exe
  2⤵
  PID:6812
- C:\Windows\System\kuZAUbx.exe
  C:\Windows\System\kuZAUbx.exe
  2⤵
  PID:6848
- C:\Windows\System\GfvbaAl.exe
  C:\Windows\System\GfvbaAl.exe
  2⤵
  PID:6980
- C:\Windows\System\bDSjWNW.exe
  C:\Windows\System\bDSjWNW.exe
  2⤵
  PID:6932
- C:\Windows\System\dItJpLm.exe
  C:\Windows\System\dItJpLm.exe
  2⤵
  PID:6952
- C:\Windows\System\dwGHycC.exe
  C:\Windows\System\dwGHycC.exe
  2⤵
  PID:7044
- C:\Windows\System\sbIISrm.exe
  C:\Windows\System\sbIISrm.exe
  2⤵
  PID:6264
- C:\Windows\System\gvAJmCi.exe
  C:\Windows\System\gvAJmCi.exe
  2⤵
  PID:6544
- C:\Windows\System\EqQCjha.exe
  C:\Windows\System\EqQCjha.exe
  2⤵
  PID:5208
- C:\Windows\System\UlGiUHI.exe
  C:\Windows\System\UlGiUHI.exe
  2⤵
  PID:5612
- C:\Windows\System\bDptKuk.exe
  C:\Windows\System\bDptKuk.exe
  2⤵
  PID:6240
- C:\Windows\System\PPkgbds.exe
  C:\Windows\System\PPkgbds.exe
  2⤵
  PID:6484
- C:\Windows\System\kDHYcGU.exe
  C:\Windows\System\kDHYcGU.exe
  2⤵
  PID:240
- C:\Windows\System\bgNBeoD.exe
  C:\Windows\System\bgNBeoD.exe
  2⤵
  PID:5480
- C:\Windows\System\DyKjBsu.exe
  C:\Windows\System\DyKjBsu.exe
  2⤵
  PID:6776
- C:\Windows\System\xkSAEOZ.exe
  C:\Windows\System\xkSAEOZ.exe
  2⤵
  PID:6880
- C:\Windows\System\PRfoFSI.exe
  C:\Windows\System\PRfoFSI.exe
  2⤵
  PID:7160
- C:\Windows\System\fpkSuAS.exe
  C:\Windows\System\fpkSuAS.exe
  2⤵
  PID:7028
- C:\Windows\System\xAxmgHA.exe
  C:\Windows\System\xAxmgHA.exe
  2⤵
  PID:6796
- C:\Windows\System\GVvEpkM.exe
  C:\Windows\System\GVvEpkM.exe
  2⤵
  PID:6480
- C:\Windows\System\EtVHAes.exe
  C:\Windows\System\EtVHAes.exe
  2⤵
  PID:6772
- C:\Windows\System\cQUmvBx.exe
  C:\Windows\System\cQUmvBx.exe
  2⤵
  PID:6560
- C:\Windows\System\KoUqNBg.exe
  C:\Windows\System\KoUqNBg.exe
  2⤵
  PID:6920
- C:\Windows\System\JkUHbDq.exe
  C:\Windows\System\JkUHbDq.exe
  2⤵
  PID:7120
- C:\Windows\System\IbnSkGX.exe
  C:\Windows\System\IbnSkGX.exe
  2⤵
  PID:6836
- C:\Windows\System\SKNvjaN.exe
  C:\Windows\System\SKNvjaN.exe
  2⤵
  PID:7084
- C:\Windows\System\zfRraFB.exe
  C:\Windows\System\zfRraFB.exe
  2⤵
  PID:6948
- C:\Windows\System\nvfTeMY.exe
  C:\Windows\System\nvfTeMY.exe
  2⤵
  PID:7136
- C:\Windows\System\mERwteD.exe
  C:\Windows\System\mERwteD.exe
  2⤵
  PID:7112
- C:\Windows\System\uNghRJh.exe
  C:\Windows\System\uNghRJh.exe
  2⤵
  PID:7032
- C:\Windows\System\zfRPKrX.exe
  C:\Windows\System\zfRPKrX.exe
  2⤵
  PID:6756
- C:\Windows\System\kVNKhxM.exe
  C:\Windows\System\kVNKhxM.exe
  2⤵
  PID:7184
- C:\Windows\System\SZJsFPv.exe
  C:\Windows\System\SZJsFPv.exe
  2⤵
  PID:7204
- C:\Windows\System\UWATwBg.exe
  C:\Windows\System\UWATwBg.exe
  2⤵
  PID:7220
- C:\Windows\System\BZgYGze.exe
  C:\Windows\System\BZgYGze.exe
  2⤵
  PID:7236
- C:\Windows\System\QKRHPDu.exe
  C:\Windows\System\QKRHPDu.exe
  2⤵
  PID:7252
- C:\Windows\System\SBbSyjN.exe
  C:\Windows\System\SBbSyjN.exe
  2⤵
  PID:7268
- C:\Windows\System\aSoqgIA.exe
  C:\Windows\System\aSoqgIA.exe
  2⤵
  PID:7292
- C:\Windows\System\EefTVDu.exe
  C:\Windows\System\EefTVDu.exe
  2⤵
  PID:7316
- C:\Windows\System\FBzJLaA.exe
  C:\Windows\System\FBzJLaA.exe
  2⤵
  PID:7332
- C:\Windows\System\kXrtaPG.exe
  C:\Windows\System\kXrtaPG.exe
  2⤵
  PID:7348
- C:\Windows\System\penDXbr.exe
  C:\Windows\System\penDXbr.exe
  2⤵
  PID:7364
- C:\Windows\System\hCsBwnY.exe
  C:\Windows\System\hCsBwnY.exe
  2⤵
  PID:7384
- C:\Windows\System\rHJdxgC.exe
  C:\Windows\System\rHJdxgC.exe
  2⤵
  PID:7404
- C:\Windows\System\TiGNhdx.exe
  C:\Windows\System\TiGNhdx.exe
  2⤵
  PID:7424
- C:\Windows\System\CfvKdHp.exe
  C:\Windows\System\CfvKdHp.exe
  2⤵
  PID:7440
- C:\Windows\System\pBxzqJN.exe
  C:\Windows\System\pBxzqJN.exe
  2⤵
  PID:7460
- C:\Windows\System\pbbxmgy.exe
  C:\Windows\System\pbbxmgy.exe
  2⤵
  PID:7476
- C:\Windows\System\XtTFIld.exe
  C:\Windows\System\XtTFIld.exe
  2⤵
  PID:7496
- C:\Windows\System\nPBEtxO.exe
  C:\Windows\System\nPBEtxO.exe
  2⤵
  PID:7512
- C:\Windows\System\duBPQHF.exe
  C:\Windows\System\duBPQHF.exe
  2⤵
  PID:7532
- C:\Windows\System\mSzvlex.exe
  C:\Windows\System\mSzvlex.exe
  2⤵
  PID:7552
- C:\Windows\System\GsJVSLQ.exe
  C:\Windows\System\GsJVSLQ.exe
  2⤵
  PID:7628
- C:\Windows\System\HpLQJBA.exe
  C:\Windows\System\HpLQJBA.exe
  2⤵
  PID:7644
- C:\Windows\System\STLjmSi.exe
  C:\Windows\System\STLjmSi.exe
  2⤵
  PID:7660
- C:\Windows\System\DRqDofv.exe
  C:\Windows\System\DRqDofv.exe
  2⤵
  PID:7676
- C:\Windows\System\AhEypiO.exe
  C:\Windows\System\AhEypiO.exe
  2⤵
  PID:7692
- C:\Windows\System\nQywsAD.exe
  C:\Windows\System\nQywsAD.exe
  2⤵
  PID:7708
- C:\Windows\System\IffEWsg.exe
  C:\Windows\System\IffEWsg.exe
  2⤵
  PID:7724
- C:\Windows\System\GmSPpal.exe
  C:\Windows\System\GmSPpal.exe
  2⤵
  PID:7760
- C:\Windows\System\zxEKbRR.exe
  C:\Windows\System\zxEKbRR.exe
  2⤵
  PID:7780
- C:\Windows\System\syIvdzx.exe
  C:\Windows\System\syIvdzx.exe
  2⤵
  PID:7796
- C:\Windows\System\ZZtwiPc.exe
  C:\Windows\System\ZZtwiPc.exe
  2⤵
  PID:7812
- C:\Windows\System\STUFDbQ.exe
  C:\Windows\System\STUFDbQ.exe
  2⤵
  PID:7828
- C:\Windows\System\CuKzhZj.exe
  C:\Windows\System\CuKzhZj.exe
  2⤵
  PID:7844
- C:\Windows\System\aCIwcBL.exe
  C:\Windows\System\aCIwcBL.exe
  2⤵
  PID:7864
- C:\Windows\System\kVhyfVt.exe
  C:\Windows\System\kVhyfVt.exe
  2⤵
  PID:7880
- C:\Windows\System\ZotgHsq.exe
  C:\Windows\System\ZotgHsq.exe
  2⤵
  PID:7908
- C:\Windows\System\pGxZTXL.exe
  C:\Windows\System\pGxZTXL.exe
  2⤵
  PID:7928
- C:\Windows\System\UPHnvEU.exe
  C:\Windows\System\UPHnvEU.exe
  2⤵
  PID:7944
- C:\Windows\System\GibLxae.exe
  C:\Windows\System\GibLxae.exe
  2⤵
  PID:7968
- C:\Windows\System\dWjsoQc.exe
  C:\Windows\System\dWjsoQc.exe
  2⤵
  PID:7984
- C:\Windows\System\HQRVLHj.exe
  C:\Windows\System\HQRVLHj.exe
  2⤵
  PID:8036
- C:\Windows\System\XnNErQH.exe
  C:\Windows\System\XnNErQH.exe
  2⤵
  PID:8052
- C:\Windows\System\nQxrfZy.exe
  C:\Windows\System\nQxrfZy.exe
  2⤵
  PID:8068
- C:\Windows\System\InOKdAP.exe
  C:\Windows\System\InOKdAP.exe
  2⤵
  PID:8088
- C:\Windows\System\KcgHIXK.exe
  C:\Windows\System\KcgHIXK.exe
  2⤵
  PID:8108
- C:\Windows\System\TWwTvFn.exe
  C:\Windows\System\TWwTvFn.exe
  2⤵
  PID:8124
- C:\Windows\System\EqEBCtw.exe
  C:\Windows\System\EqEBCtw.exe
  2⤵
  PID:8140
- C:\Windows\System\LUuYjWD.exe
  C:\Windows\System\LUuYjWD.exe
  2⤵
  PID:8156
- C:\Windows\System\qctJwKK.exe
  C:\Windows\System\qctJwKK.exe
  2⤵
  PID:8172
- C:\Windows\System\NlwWGgC.exe
  C:\Windows\System\NlwWGgC.exe
  2⤵
  PID:8188
- C:\Windows\System\DkkXyMy.exe
  C:\Windows\System\DkkXyMy.exe
  2⤵
  PID:7212
- C:\Windows\System\COJIXdI.exe
  C:\Windows\System\COJIXdI.exe
  2⤵
  PID:7288
- C:\Windows\System\wfDHcVT.exe
  C:\Windows\System\wfDHcVT.exe
  2⤵
  PID:7360
- C:\Windows\System\hytiKnC.exe
  C:\Windows\System\hytiKnC.exe
  2⤵
  PID:7432
- C:\Windows\System\dVmefsN.exe
  C:\Windows\System\dVmefsN.exe
  2⤵
  PID:7504
- C:\Windows\System\jqnUkFz.exe
  C:\Windows\System\jqnUkFz.exe
  2⤵
  PID:7372
- C:\Windows\System\BhLEvPv.exe
  C:\Windows\System\BhLEvPv.exe
  2⤵
  PID:6636
- C:\Windows\System\ytTbYey.exe
  C:\Windows\System\ytTbYey.exe
  2⤵
  PID:6376
- C:\Windows\System\kfQZRib.exe
  C:\Windows\System\kfQZRib.exe
  2⤵
  PID:7304
- C:\Windows\System\NhbbQUa.exe
  C:\Windows\System\NhbbQUa.exe
  2⤵
  PID:7448
- C:\Windows\System\klArVtb.exe
  C:\Windows\System\klArVtb.exe
  2⤵
  PID:7704
- C:\Windows\System\eYQPRFu.exe
  C:\Windows\System\eYQPRFu.exe
  2⤵
  PID:7528
- C:\Windows\System\EyTlSdu.exe
  C:\Windows\System\EyTlSdu.exe
  2⤵
  PID:7572
- C:\Windows\System\MucvNEu.exe
  C:\Windows\System\MucvNEu.exe
  2⤵
  PID:7592
- C:\Windows\System\KNFAxTw.exe
  C:\Windows\System\KNFAxTw.exe
  2⤵
  PID:7608
- C:\Windows\System\QPcQXpD.exe
  C:\Windows\System\QPcQXpD.exe
  2⤵
  PID:7624
- C:\Windows\System\mGLtffh.exe
  C:\Windows\System\mGLtffh.exe
  2⤵
  PID:7788
- C:\Windows\System\kzEBKIa.exe
  C:\Windows\System\kzEBKIa.exe
  2⤵
  PID:7852
- C:\Windows\System\VFSuKTd.exe
  C:\Windows\System\VFSuKTd.exe
  2⤵
  PID:7896
- C:\Windows\System\XttjIdC.exe
  C:\Windows\System\XttjIdC.exe
  2⤵
  PID:7940
- C:\Windows\System\szzjnIM.exe
  C:\Windows\System\szzjnIM.exe
  2⤵
  PID:7688
- C:\Windows\System\gePNpKw.exe
  C:\Windows\System\gePNpKw.exe
  2⤵
  PID:8044
- C:\Windows\System\UCodMzY.exe
  C:\Windows\System\UCodMzY.exe
  2⤵
  PID:7808
- C:\Windows\System\JYdlcIB.exe
  C:\Windows\System\JYdlcIB.exe
  2⤵
  PID:7876
- C:\Windows\System\CPssQYX.exe
  C:\Windows\System\CPssQYX.exe
  2⤵
  PID:7952
- C:\Windows\System\ACZNjSA.exe
  C:\Windows\System\ACZNjSA.exe
  2⤵
  PID:8032
- C:\Windows\System\DAQiANJ.exe
  C:\Windows\System\DAQiANJ.exe
  2⤵
  PID:8080
- C:\Windows\System\yEsjbPY.exe
  C:\Windows\System\yEsjbPY.exe
  2⤵
  PID:8012
- C:\Windows\System\CJdeJOk.exe
  C:\Windows\System\CJdeJOk.exe
  2⤵
  PID:8024
- C:\Windows\System\wHyZTcp.exe
  C:\Windows\System\wHyZTcp.exe
  2⤵
  PID:8116
- C:\Windows\System\uKTkqQy.exe
  C:\Windows\System\uKTkqQy.exe
  2⤵
  PID:8148
- C:\Windows\System\zzWdtuQ.exe
  C:\Windows\System\zzWdtuQ.exe
  2⤵
  PID:8184
- C:\Windows\System\KJWXbfm.exe
  C:\Windows\System\KJWXbfm.exe
  2⤵
  PID:7396
- C:\Windows\System\rbpvOpd.exe
  C:\Windows\System\rbpvOpd.exe
  2⤵
  PID:7060
- C:\Windows\System\TKiNraT.exe
  C:\Windows\System\TKiNraT.exe
  2⤵
  PID:7668
- C:\Windows\System\VLrEXkB.exe
  C:\Windows\System\VLrEXkB.exe
  2⤵
  PID:7300
- C:\Windows\System\ctiJDHE.exe
  C:\Windows\System\ctiJDHE.exe
  2⤵
  PID:6516
- C:\Windows\System\gLmxtCm.exe
  C:\Windows\System\gLmxtCm.exe
  2⤵
  PID:7488
- C:\Windows\System\ejgVqAX.exe
  C:\Windows\System\ejgVqAX.exe
  2⤵
  PID:7900
- C:\Windows\System\EyHrftp.exe
  C:\Windows\System\EyHrftp.exe
  2⤵
  PID:7584
- C:\Windows\System\XmGnQGL.exe
  C:\Windows\System\XmGnQGL.exe
  2⤵
  PID:7492
- C:\Windows\System\YOYFYJW.exe
  C:\Windows\System\YOYFYJW.exe
  2⤵
  PID:7860
- C:\Windows\System\EzkDrTD.exe
  C:\Windows\System\EzkDrTD.exe
  2⤵
  PID:7568
- C:\Windows\System\zuZkyWI.exe
  C:\Windows\System\zuZkyWI.exe
  2⤵
  PID:7736
- C:\Windows\System\GnWNkhz.exe
  C:\Windows\System\GnWNkhz.exe
  2⤵
  PID:7720
- C:\Windows\System\aoNxgmB.exe
  C:\Windows\System\aoNxgmB.exe
  2⤵
  PID:7960
- C:\Windows\System\xRYplgq.exe
  C:\Windows\System\xRYplgq.exe
  2⤵
  PID:7992
- C:\Windows\System\YQkbeep.exe
  C:\Windows\System\YQkbeep.exe
  2⤵
  PID:8000
- C:\Windows\System\UQyCQsi.exe
  C:\Windows\System\UQyCQsi.exe
  2⤵
  PID:8064
- C:\Windows\System\aeDCkSz.exe
  C:\Windows\System\aeDCkSz.exe
  2⤵
  PID:8048
- C:\Windows\System\wWLEQjX.exe
  C:\Windows\System\wWLEQjX.exe
  2⤵
  PID:8104
- C:\Windows\System\GyMhdHr.exe
  C:\Windows\System\GyMhdHr.exe
  2⤵
  PID:8164
- C:\Windows\System\EgcQaRS.exe
  C:\Windows\System\EgcQaRS.exe
  2⤵
  PID:6712
- C:\Windows\System\GwoipFJ.exe
  C:\Windows\System\GwoipFJ.exe
  2⤵
  PID:7176
- C:\Windows\System\YTiBgEm.exe
  C:\Windows\System\YTiBgEm.exe
  2⤵
  PID:7324
- C:\Windows\System\nAauCul.exe
  C:\Windows\System\nAauCul.exe
  2⤵
  PID:7508
- C:\Windows\System\ZApDlfq.exe
  C:\Windows\System\ZApDlfq.exe
  2⤵
  PID:7640
- C:\Windows\System\NHMMPyF.exe
  C:\Windows\System\NHMMPyF.exe
  2⤵
  PID:7964
- C:\Windows\System\tQvOOVL.exe
  C:\Windows\System\tQvOOVL.exe
  2⤵
  PID:7604
- C:\Windows\System\fcUqBQE.exe
  C:\Windows\System\fcUqBQE.exe
  2⤵
  PID:7756
- C:\Windows\System\KgrjSuD.exe
  C:\Windows\System\KgrjSuD.exe
  2⤵
  PID:7328
- C:\Windows\System\LLEHxeS.exe
  C:\Windows\System\LLEHxeS.exe
  2⤵
  PID:8136
- C:\Windows\System\HWzXXUJ.exe
  C:\Windows\System\HWzXXUJ.exe
  2⤵
  PID:7200
- C:\Windows\System\TKeQtQV.exe
  C:\Windows\System\TKeQtQV.exe
  2⤵
  PID:7564
- C:\Windows\System\MxXSJLJ.exe
  C:\Windows\System\MxXSJLJ.exe
  2⤵
  PID:7804
- C:\Windows\System\xKuBSJI.exe
  C:\Windows\System\xKuBSJI.exe
  2⤵
  PID:6984
- C:\Windows\System\tUXPDde.exe
  C:\Windows\System\tUXPDde.exe
  2⤵
  PID:7260
- C:\Windows\System\wlxmOHd.exe
  C:\Windows\System\wlxmOHd.exe
  2⤵
  PID:7772
- C:\Windows\System\Oonivnc.exe
  C:\Windows\System\Oonivnc.exe
  2⤵
  PID:7924
- C:\Windows\System\qRPnvnk.exe
  C:\Windows\System\qRPnvnk.exe
  2⤵
  PID:7380
- C:\Windows\System\EPvEWZl.exe
  C:\Windows\System\EPvEWZl.exe
  2⤵
  PID:7976
- C:\Windows\System\vuHRUnP.exe
  C:\Windows\System\vuHRUnP.exe
  2⤵
  PID:8020
- C:\Windows\System\YaPoNZb.exe
  C:\Windows\System\YaPoNZb.exe
  2⤵
  PID:7484
- C:\Windows\System\OnrgMGa.exe
  C:\Windows\System\OnrgMGa.exe
  2⤵
  PID:6668
- C:\Windows\System\PMoVUhX.exe
  C:\Windows\System\PMoVUhX.exe
  2⤵
  PID:7232
- C:\Windows\System\YCXSOig.exe
  C:\Windows\System\YCXSOig.exe
  2⤵
  PID:8212
- C:\Windows\System\BLWlOfK.exe
  C:\Windows\System\BLWlOfK.exe
  2⤵
  PID:8228
- C:\Windows\System\wlkDALD.exe
  C:\Windows\System\wlkDALD.exe
  2⤵
  PID:8244
- C:\Windows\System\YKVsdxq.exe
  C:\Windows\System\YKVsdxq.exe
  2⤵
  PID:8264
- C:\Windows\System\AKFUBJD.exe
  C:\Windows\System\AKFUBJD.exe
  2⤵
  PID:8280
- C:\Windows\System\KLGwxhZ.exe
  C:\Windows\System\KLGwxhZ.exe
  2⤵
  PID:8296
- C:\Windows\System\aVqTVuA.exe
  C:\Windows\System\aVqTVuA.exe
  2⤵
  PID:8312
- C:\Windows\System\KQOAwoI.exe
  C:\Windows\System\KQOAwoI.exe
  2⤵
  PID:8340
- C:\Windows\System\qkSxIZO.exe
  C:\Windows\System\qkSxIZO.exe
  2⤵
  PID:8356
- C:\Windows\System\ABMGvyW.exe
  C:\Windows\System\ABMGvyW.exe
  2⤵
  PID:8372
- C:\Windows\System\bddppGP.exe
  C:\Windows\System\bddppGP.exe
  2⤵
  PID:8392
- C:\Windows\System\bVJqLBs.exe
  C:\Windows\System\bVJqLBs.exe
  2⤵
  PID:8412
- C:\Windows\System\tvdmsKv.exe
  C:\Windows\System\tvdmsKv.exe
  2⤵
  PID:8428
- C:\Windows\System\pLsVUzU.exe
  C:\Windows\System\pLsVUzU.exe
  2⤵
  PID:8444
- C:\Windows\System\vQlPVHF.exe
  C:\Windows\System\vQlPVHF.exe
  2⤵
  PID:8464
- C:\Windows\System\MBEqJQN.exe
  C:\Windows\System\MBEqJQN.exe
  2⤵
  PID:8488
- C:\Windows\System\NgKQdJI.exe
  C:\Windows\System\NgKQdJI.exe
  2⤵
  PID:8504
- C:\Windows\System\MarvNLK.exe
  C:\Windows\System\MarvNLK.exe
  2⤵
  PID:8528
- C:\Windows\System\HBGTJgv.exe
  C:\Windows\System\HBGTJgv.exe
  2⤵
  PID:8560
- C:\Windows\System\DyCtOVk.exe
  C:\Windows\System\DyCtOVk.exe
  2⤵
  PID:8576
- C:\Windows\System\Qaxhvch.exe
  C:\Windows\System\Qaxhvch.exe
  2⤵
  PID:8592
- C:\Windows\System\nkrAaRA.exe
  C:\Windows\System\nkrAaRA.exe
  2⤵
  PID:8608
- C:\Windows\System\fXBdLRj.exe
  C:\Windows\System\fXBdLRj.exe
  2⤵
  PID:8624
- C:\Windows\System\UZhVvma.exe
  C:\Windows\System\UZhVvma.exe
  2⤵
  PID:8644
- C:\Windows\System\OKiVFlc.exe
  C:\Windows\System\OKiVFlc.exe
  2⤵
  PID:8660
- C:\Windows\System\KVXxelC.exe
  C:\Windows\System\KVXxelC.exe
  2⤵
  PID:8676
- C:\Windows\System\FbvGYSF.exe
  C:\Windows\System\FbvGYSF.exe
  2⤵
  PID:8696
- C:\Windows\System\zloBPfu.exe
  C:\Windows\System\zloBPfu.exe
  2⤵
  PID:8716
- C:\Windows\System\pXhIIhy.exe
  C:\Windows\System\pXhIIhy.exe
  2⤵
  PID:8732
- C:\Windows\System\gyMqCLf.exe
  C:\Windows\System\gyMqCLf.exe
  2⤵
  PID:8756
- C:\Windows\System\AOmRkmA.exe
  C:\Windows\System\AOmRkmA.exe
  2⤵
  PID:8776
- C:\Windows\System\RjhGZos.exe
  C:\Windows\System\RjhGZos.exe
  2⤵
  PID:8792
- C:\Windows\System\ITmNzaZ.exe
  C:\Windows\System\ITmNzaZ.exe
  2⤵
  PID:8808
- C:\Windows\System\LGcpAbi.exe
  C:\Windows\System\LGcpAbi.exe
  2⤵
  PID:8824
- C:\Windows\System\eqAgRNf.exe
  C:\Windows\System\eqAgRNf.exe
  2⤵
  PID:8840
- C:\Windows\System\XYKAOif.exe
  C:\Windows\System\XYKAOif.exe
  2⤵
  PID:8856
- C:\Windows\System\bcmEPcG.exe
  C:\Windows\System\bcmEPcG.exe
  2⤵
  PID:8876
- C:\Windows\System\TjLzmxt.exe
  C:\Windows\System\TjLzmxt.exe
  2⤵
  PID:8892
- C:\Windows\System\qjRlZKG.exe
  C:\Windows\System\qjRlZKG.exe
  2⤵
  PID:8908
- C:\Windows\System\VwymYQi.exe
  C:\Windows\System\VwymYQi.exe
  2⤵
  PID:8928
- C:\Windows\System\CJtUMrf.exe
  C:\Windows\System\CJtUMrf.exe
  2⤵
  PID:8944
- C:\Windows\System\aouEiJh.exe
  C:\Windows\System\aouEiJh.exe
  2⤵
  PID:8960
- C:\Windows\System\Xwbflrq.exe
  C:\Windows\System\Xwbflrq.exe
  2⤵
  PID:8976
- C:\Windows\System\EybKKcW.exe
  C:\Windows\System\EybKKcW.exe
  2⤵
  PID:9000
- C:\Windows\System\UeleDvr.exe
  C:\Windows\System\UeleDvr.exe
  2⤵
  PID:9016
- C:\Windows\System\eNRsEXo.exe
  C:\Windows\System\eNRsEXo.exe
  2⤵
  PID:9036
- C:\Windows\System\nvpoSyA.exe
  C:\Windows\System\nvpoSyA.exe
  2⤵
  PID:9052
- C:\Windows\System\wCoTCOR.exe
  C:\Windows\System\wCoTCOR.exe
  2⤵
  PID:9068
- C:\Windows\System\ZjuyjFX.exe
  C:\Windows\System\ZjuyjFX.exe
  2⤵
  PID:9084
- C:\Windows\System\EBsBEzR.exe
  C:\Windows\System\EBsBEzR.exe
  2⤵
  PID:9104
- C:\Windows\System\ygglZWg.exe
  C:\Windows\System\ygglZWg.exe
  2⤵
  PID:9120
- C:\Windows\System\odcWPgr.exe
  C:\Windows\System\odcWPgr.exe
  2⤵
  PID:9136
- C:\Windows\System\iiGuKPs.exe
  C:\Windows\System\iiGuKPs.exe
  2⤵
  PID:9156
- C:\Windows\System\XaKBUhz.exe
  C:\Windows\System\XaKBUhz.exe
  2⤵
  PID:9172
- C:\Windows\System\CbPfCCz.exe
  C:\Windows\System\CbPfCCz.exe
  2⤵
  PID:9188
- C:\Windows\System\nHwyMBY.exe
  C:\Windows\System\nHwyMBY.exe
  2⤵
  PID:9204
- C:\Windows\System\afgYfZF.exe
  C:\Windows\System\afgYfZF.exe
  2⤵
  PID:7904
- C:\Windows\System\KdEUaPU.exe
  C:\Windows\System\KdEUaPU.exe
  2⤵
  PID:7420
- C:\Windows\System\mzNuaFd.exe
  C:\Windows\System\mzNuaFd.exe
  2⤵
  PID:8016
- C:\Windows\System\yRPZtiN.exe
  C:\Windows\System\yRPZtiN.exe
  2⤵
  PID:8236
- C:\Windows\System\tRkyTjE.exe
  C:\Windows\System\tRkyTjE.exe
  2⤵
  PID:8276
- C:\Windows\System\Xqytqvw.exe
  C:\Windows\System\Xqytqvw.exe
  2⤵
  PID:8288
- C:\Windows\System\VKGiAeY.exe
  C:\Windows\System\VKGiAeY.exe
  2⤵
  PID:8308
- C:\Windows\System\qBPPVwu.exe
  C:\Windows\System\qBPPVwu.exe
  2⤵
  PID:8352
- C:\Windows\System\ZlWGoaD.exe
  C:\Windows\System\ZlWGoaD.exe
  2⤵
  PID:8400
- C:\Windows\System\ylcxvJF.exe
  C:\Windows\System\ylcxvJF.exe
  2⤵
  PID:8436
- C:\Windows\System\VnKqmWc.exe
  C:\Windows\System\VnKqmWc.exe
  2⤵
  PID:8480
- C:\Windows\System\BGcmmWh.exe
  C:\Windows\System\BGcmmWh.exe
  2⤵
  PID:8512
- C:\Windows\System\JrYIppW.exe
  C:\Windows\System\JrYIppW.exe
  2⤵
  PID:8544
- C:\Windows\System\kcpkgky.exe
  C:\Windows\System\kcpkgky.exe
  2⤵
  PID:8588
- C:\Windows\System\vSrLVLU.exe
  C:\Windows\System\vSrLVLU.exe
  2⤵
  PID:8604
- C:\Windows\System\mWsiNNw.exe
  C:\Windows\System\mWsiNNw.exe
  2⤵
  PID:8652
- C:\Windows\System\Loashbr.exe
  C:\Windows\System\Loashbr.exe
  2⤵
  PID:8200
- C:\Windows\System\FKjwTPX.exe
  C:\Windows\System\FKjwTPX.exe
  2⤵
  PID:8712
- C:\Windows\System\DmgLsyB.exe
  C:\Windows\System\DmgLsyB.exe
  2⤵
  PID:8768
- C:\Windows\System\NYpPjFZ.exe
  C:\Windows\System\NYpPjFZ.exe
  2⤵
  PID:8744
- C:\Windows\System\qBaWKbN.exe
  C:\Windows\System\qBaWKbN.exe
  2⤵
  PID:8900
- C:\Windows\System\PAnmJob.exe
  C:\Windows\System\PAnmJob.exe
  2⤵
  PID:8864
- C:\Windows\System\VKwVZCr.exe
  C:\Windows\System\VKwVZCr.exe
  2⤵
  PID:8972
- C:\Windows\System\CLihlHw.exe
  C:\Windows\System\CLihlHw.exe
  2⤵
  PID:8884
- C:\Windows\System\edibvCi.exe
  C:\Windows\System\edibvCi.exe
  2⤵
  PID:8924
- C:\Windows\System\DFzYBAA.exe
  C:\Windows\System\DFzYBAA.exe
  2⤵
  PID:8984
- C:\Windows\System\Ahphnop.exe
  C:\Windows\System\Ahphnop.exe
  2⤵
  PID:9024
- C:\Windows\System\afSvGYY.exe
  C:\Windows\System\afSvGYY.exe
  2⤵
  PID:9012
- C:\Windows\System\JDtEoWW.exe
  C:\Windows\System\JDtEoWW.exe
  2⤵
  PID:9096
- C:\Windows\System\RzwuNOs.exe
  C:\Windows\System\RzwuNOs.exe
  2⤵
  PID:9112
- C:\Windows\System\qQeUVbq.exe
  C:\Windows\System\qQeUVbq.exe
  2⤵
  PID:9132
- C:\Windows\System\OHBbalA.exe
  C:\Windows\System\OHBbalA.exe
  2⤵
  PID:9168
- C:\Windows\System\pwGksMh.exe
  C:\Windows\System\pwGksMh.exe
  2⤵
  PID:9184
- C:\Windows\System\REetYmv.exe
  C:\Windows\System\REetYmv.exe
  2⤵
  PID:7472
- C:\Windows\System\fKuqJmA.exe
  C:\Windows\System\fKuqJmA.exe
  2⤵
  PID:8252
- C:\Windows\System\WPcKhBu.exe
  C:\Windows\System\WPcKhBu.exe
  2⤵
  PID:8256
- C:\Windows\System\rdRlEmW.exe
  C:\Windows\System\rdRlEmW.exe
  2⤵
  PID:8388
- C:\Windows\System\wOfrBJt.exe
  C:\Windows\System\wOfrBJt.exe
  2⤵
  PID:8260
- C:\Windows\System\GuvxIeE.exe
  C:\Windows\System\GuvxIeE.exe
  2⤵
  PID:8424
- C:\Windows\System\iFcVSdt.exe
  C:\Windows\System\iFcVSdt.exe
  2⤵
  PID:8460
- C:\Windows\System\EkecNVH.exe
  C:\Windows\System\EkecNVH.exe
  2⤵
  PID:8516
- C:\Windows\System\xIgdHNR.exe
  C:\Windows\System\xIgdHNR.exe
  2⤵
  PID:8584
- C:\Windows\System\UbhbYVL.exe
  C:\Windows\System\UbhbYVL.exe
  2⤵
  PID:8708
- C:\Windows\System\HWfwbah.exe
  C:\Windows\System\HWfwbah.exe
  2⤵
  PID:8568
- C:\Windows\System\iOCBrOa.exe
  C:\Windows\System\iOCBrOa.exe
  2⤵
  PID:8804
- C:\Windows\System\UCrBdQV.exe
  C:\Windows\System\UCrBdQV.exe
  2⤵
  PID:8868
- C:\Windows\System\ENOdfcD.exe
  C:\Windows\System\ENOdfcD.exe
  2⤵
  PID:8728
- C:\Windows\System\qhHjilB.exe
  C:\Windows\System\qhHjilB.exe
  2⤵
  PID:8936
- C:\Windows\System\xgBHPWy.exe
  C:\Windows\System\xgBHPWy.exe
  2⤵
  PID:8848
- C:\Windows\System\BhaUBQk.exe
  C:\Windows\System\BhaUBQk.exe
  2⤵
  PID:8920
- C:\Windows\System\dOTnzZu.exe
  C:\Windows\System\dOTnzZu.exe
  2⤵
  PID:9116
- C:\Windows\System\nFTdchg.exe
  C:\Windows\System\nFTdchg.exe
  2⤵
  PID:7776
- C:\Windows\System\xjVqaRl.exe
  C:\Windows\System\xjVqaRl.exe
  2⤵
  PID:8324
- C:\Windows\System\SucarNL.exe
  C:\Windows\System\SucarNL.exe
  2⤵
  PID:9200
- C:\Windows\System\tovldMx.exe
  C:\Windows\System\tovldMx.exe
  2⤵
  PID:8420
- C:\Windows\System\IdeguER.exe
  C:\Windows\System\IdeguER.exe
  2⤵
  PID:8524
- C:\Windows\System\duJDyoQ.exe
  C:\Windows\System\duJDyoQ.exe
  2⤵
  PID:8556
- C:\Windows\System\YTeRdcn.exe
  C:\Windows\System\YTeRdcn.exe
  2⤵
  PID:8684
- C:\Windows\System\vvhXneq.exe
  C:\Windows\System\vvhXneq.exe
  2⤵
  PID:8672
- C:\Windows\System\WgmyfCZ.exe
  C:\Windows\System\WgmyfCZ.exe
  2⤵
  PID:8836
- C:\Windows\System\KQrfXLD.exe
  C:\Windows\System\KQrfXLD.exe
  2⤵
  PID:9076
- C:\Windows\System\BTQVcwB.exe
  C:\Windows\System\BTQVcwB.exe
  2⤵
  PID:9060
- C:\Windows\System\avPriFH.exe
  C:\Windows\System\avPriFH.exe
  2⤵
  PID:8224
- C:\Windows\System\pXkYwoa.exe
  C:\Windows\System\pXkYwoa.exe
  2⤵
  PID:9148
- C:\Windows\System\HFrzUNK.exe
  C:\Windows\System\HFrzUNK.exe
  2⤵
  PID:8336
- C:\Windows\System\AYENTGD.exe
  C:\Windows\System\AYENTGD.exe
  2⤵
  PID:8472
- C:\Windows\System\WehgWzq.exe
  C:\Windows\System\WehgWzq.exe
  2⤵
  PID:8600
- C:\Windows\System\ubKuugO.exe
  C:\Windows\System\ubKuugO.exe
  2⤵
  PID:8640
- C:\Windows\System\gWOiUos.exe
  C:\Windows\System\gWOiUos.exe
  2⤵
  PID:5000
- C:\Windows\System\UeIarmb.exe
  C:\Windows\System\UeIarmb.exe
  2⤵
  PID:8800
- C:\Windows\System\jUtGkBL.exe
  C:\Windows\System\jUtGkBL.exe
  2⤵
  PID:8536
- C:\Windows\System\qAOrtkx.exe
  C:\Windows\System\qAOrtkx.exe
  2⤵
  PID:8820
- C:\Windows\System\cMUEWYY.exe
  C:\Windows\System\cMUEWYY.exe
  2⤵
  PID:9232
- C:\Windows\System\MaOUYbA.exe
  C:\Windows\System\MaOUYbA.exe
  2⤵
  PID:9248
- C:\Windows\System\PGucHVB.exe
  C:\Windows\System\PGucHVB.exe
  2⤵
  PID:9280
- C:\Windows\System\VzbEkVS.exe
  C:\Windows\System\VzbEkVS.exe
  2⤵
  PID:9296
- C:\Windows\System\XvligVc.exe
  C:\Windows\System\XvligVc.exe
  2⤵
  PID:9312
- C:\Windows\System\hxDAjzF.exe
  C:\Windows\System\hxDAjzF.exe
  2⤵
  PID:9328
- C:\Windows\System\XcBrNCi.exe
  C:\Windows\System\XcBrNCi.exe
  2⤵
  PID:9344
- C:\Windows\System\cJMqJBj.exe
  C:\Windows\System\cJMqJBj.exe
  2⤵
  PID:9360
- C:\Windows\System\YPmpnKO.exe
  C:\Windows\System\YPmpnKO.exe
  2⤵
  PID:9376
- C:\Windows\System\zdcdthw.exe
  C:\Windows\System\zdcdthw.exe
  2⤵
  PID:9392
- C:\Windows\System\HJNNlms.exe
  C:\Windows\System\HJNNlms.exe
  2⤵
  PID:9408
- C:\Windows\System\JDxOojH.exe
  C:\Windows\System\JDxOojH.exe
  2⤵
  PID:9424
- C:\Windows\System\YtJlLNm.exe
  C:\Windows\System\YtJlLNm.exe
  2⤵
  PID:9440
- C:\Windows\System\khKleTD.exe
  C:\Windows\System\khKleTD.exe
  2⤵
  PID:9456
- C:\Windows\System\qBTVwrS.exe
  C:\Windows\System\qBTVwrS.exe
  2⤵
  PID:9472
- C:\Windows\System\IQVssbm.exe
  C:\Windows\System\IQVssbm.exe
  2⤵
  PID:9488
- C:\Windows\System\OGuubsG.exe
  C:\Windows\System\OGuubsG.exe
  2⤵
  PID:9520
- C:\Windows\System\CSksrVm.exe
  C:\Windows\System\CSksrVm.exe
  2⤵
  PID:9536
- C:\Windows\System\cfhmflq.exe
  C:\Windows\System\cfhmflq.exe
  2⤵
  PID:9552
- C:\Windows\System\McYKHiu.exe
  C:\Windows\System\McYKHiu.exe
  2⤵
  PID:9568
- C:\Windows\System\ztrKfMv.exe
  C:\Windows\System\ztrKfMv.exe
  2⤵
  PID:9584
- C:\Windows\System\DiMBGtS.exe
  C:\Windows\System\DiMBGtS.exe
  2⤵
  PID:9600
- C:\Windows\System\rRWIoob.exe
  C:\Windows\System\rRWIoob.exe
  2⤵
  PID:9616
- C:\Windows\System\FHnUfRi.exe
  C:\Windows\System\FHnUfRi.exe
  2⤵
  PID:9632
- C:\Windows\System\bjNHsZw.exe
  C:\Windows\System\bjNHsZw.exe
  2⤵
  PID:9652
- C:\Windows\System\RgGYdMk.exe
  C:\Windows\System\RgGYdMk.exe
  2⤵
  PID:9668
- C:\Windows\System\KPGitmK.exe
  C:\Windows\System\KPGitmK.exe
  2⤵
  PID:9684
- C:\Windows\System\sNfJjVk.exe
  C:\Windows\System\sNfJjVk.exe
  2⤵
  PID:9700
- C:\Windows\System\GZLJPiC.exe
  C:\Windows\System\GZLJPiC.exe
  2⤵
  PID:9720
- C:\Windows\System\jeEhBSh.exe
  C:\Windows\System\jeEhBSh.exe
  2⤵
  PID:9740
- C:\Windows\System\ADAvtDm.exe
  C:\Windows\System\ADAvtDm.exe
  2⤵
  PID:9756
- C:\Windows\System\VKhrFXV.exe
  C:\Windows\System\VKhrFXV.exe
  2⤵
  PID:9772
- C:\Windows\System\LoXcjKv.exe
  C:\Windows\System\LoXcjKv.exe
  2⤵
  PID:9788
- C:\Windows\System\QsiTJfQ.exe
  C:\Windows\System\QsiTJfQ.exe
  2⤵
  PID:9804
- C:\Windows\System\SSDBaow.exe
  C:\Windows\System\SSDBaow.exe
  2⤵
  PID:9820
- C:\Windows\System\yJImlId.exe
  C:\Windows\System\yJImlId.exe
  2⤵
  PID:9864
- C:\Windows\System\XSAidgL.exe
  C:\Windows\System\XSAidgL.exe
  2⤵
  PID:9924
- C:\Windows\System\ZBjtdZT.exe
  C:\Windows\System\ZBjtdZT.exe
  2⤵
  PID:10040
- C:\Windows\System\FrHGWgp.exe
  C:\Windows\System\FrHGWgp.exe
  2⤵
  PID:10072
- C:\Windows\System\YvxTjGk.exe
  C:\Windows\System\YvxTjGk.exe
  2⤵
  PID:10136
- C:\Windows\System\fcxMzfJ.exe
  C:\Windows\System\fcxMzfJ.exe
  2⤵
  PID:10160
- C:\Windows\System\dVoHuUj.exe
  C:\Windows\System\dVoHuUj.exe
  2⤵
  PID:10176
- C:\Windows\System\gPUWMTK.exe
  C:\Windows\System\gPUWMTK.exe
  2⤵
  PID:10192
- C:\Windows\System\NgvMnIT.exe
  C:\Windows\System\NgvMnIT.exe
  2⤵
  PID:10208
- C:\Windows\System\nOnxonC.exe
  C:\Windows\System\nOnxonC.exe
  2⤵
  PID:10224
- C:\Windows\System\gWjObBF.exe
  C:\Windows\System\gWjObBF.exe
  2⤵
  PID:9128
- C:\Windows\System\hgXPGwj.exe
  C:\Windows\System\hgXPGwj.exe
  2⤵
  PID:9224
- C:\Windows\System\BzuMcZu.exe
  C:\Windows\System\BzuMcZu.exe
  2⤵
  PID:9256
- C:\Windows\System\xlXlmta.exe
  C:\Windows\System\xlXlmta.exe
  2⤵
  PID:9276
- C:\Windows\System\jDewoWh.exe
  C:\Windows\System\jDewoWh.exe
  2⤵
  PID:9288
- C:\Windows\System\wJUnVbf.exe
  C:\Windows\System\wJUnVbf.exe
  2⤵
  PID:9340
- C:\Windows\System\wjuogni.exe
  C:\Windows\System\wjuogni.exe
  2⤵
  PID:9432
- C:\Windows\System\yMqzVsJ.exe
  C:\Windows\System\yMqzVsJ.exe
  2⤵
  PID:9468
- C:\Windows\System\aEavpeK.exe
  C:\Windows\System\aEavpeK.exe
  2⤵
  PID:9352
- C:\Windows\System\MYjbnbt.exe
  C:\Windows\System\MYjbnbt.exe
  2⤵
  PID:9416
- C:\Windows\System\IGktXcg.exe
  C:\Windows\System\IGktXcg.exe
  2⤵
  PID:9480
- C:\Windows\System\yIaYLIW.exe
  C:\Windows\System\yIaYLIW.exe
  2⤵
  PID:9504
- C:\Windows\System\OqNOTeF.exe
  C:\Windows\System\OqNOTeF.exe
  2⤵
  PID:9544
- C:\Windows\System\noKRCFC.exe
  C:\Windows\System\noKRCFC.exe
  2⤵
  PID:9580
- C:\Windows\System\FVlZatx.exe
  C:\Windows\System\FVlZatx.exe
  2⤵
  PID:9628
- C:\Windows\System\fyrWIxE.exe
  C:\Windows\System\fyrWIxE.exe
  2⤵
  PID:9592
- C:\Windows\System\AuVhNwn.exe
  C:\Windows\System\AuVhNwn.exe
  2⤵
  PID:9664
- C:\Windows\System\ATUWCRX.exe
  C:\Windows\System\ATUWCRX.exe
  2⤵
  PID:9712
- C:\Windows\System\TOHjIrz.exe
  C:\Windows\System\TOHjIrz.exe
  2⤵
  PID:9732
- C:\Windows\System\aaaaRzj.exe
  C:\Windows\System\aaaaRzj.exe
  2⤵
  PID:9812
- C:\Windows\System\jVTWTpS.exe
  C:\Windows\System\jVTWTpS.exe
  2⤵
  PID:9836
- C:\Windows\System\JIvJOlx.exe
  C:\Windows\System\JIvJOlx.exe
  2⤵
  PID:9852
- C:\Windows\System\nIdoqGZ.exe
  C:\Windows\System\nIdoqGZ.exe
  2⤵
  PID:9516
- C:\Windows\System\FwTQlhu.exe
  C:\Windows\System\FwTQlhu.exe
  2⤵
  PID:9932
- C:\Windows\System\AqNmXre.exe
  C:\Windows\System\AqNmXre.exe
  2⤵
  PID:9912
- C:\Windows\System\FqClyTZ.exe
  C:\Windows\System\FqClyTZ.exe
  2⤵
  PID:9940
- C:\Windows\System\OCdObaB.exe
  C:\Windows\System\OCdObaB.exe
  2⤵
  PID:9956
- C:\Windows\System\nvGqFkz.exe
  C:\Windows\System\nvGqFkz.exe
  2⤵
  PID:9976
- C:\Windows\System\RSitlmd.exe
  C:\Windows\System\RSitlmd.exe
  2⤵
  PID:9996
- C:\Windows\System\kGIWlKu.exe
  C:\Windows\System\kGIWlKu.exe
  2⤵
  PID:10012
- C:\Windows\System\jyJzhsj.exe
  C:\Windows\System\jyJzhsj.exe
  2⤵
  PID:10036
- C:\Windows\System\aLGYrzD.exe
  C:\Windows\System\aLGYrzD.exe
  2⤵
  PID:10060
- C:\Windows\System\oCxhIcN.exe
  C:\Windows\System\oCxhIcN.exe
  2⤵
  PID:10068
- C:\Windows\System\hPqhpiL.exe
  C:\Windows\System\hPqhpiL.exe
  2⤵
  PID:9884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BpLmevj.exe

Filesize
2.7MB

MD5
b3cb85c2bf055ea2150a16451db14fc1

SHA1
104c54d655f6393b1dd40d39af90a6f341229948

SHA256
e5446e3973c2ddd3bab788487ed08da30c22b1392b3dafcfe5ef9ff5058962c0

SHA512
173d4a96d4f5e80ab921f3509fa8ccf3b5c4880a8eb6cf504be6fb3536e6d15c383a2e7cebffe84dffee9a0d91da7e1d47d094452f14ce766caf0c54cef66ebc

Download Submit
C:\Windows\system\DPhWajE.exe

Filesize
2.7MB

MD5
a95aa17403d3894a5567c4ffd8ede6ac

SHA1
febcff3bb10512a3371bbf222884019dc673a721

SHA256
36474375d43c59dfa81b7996ea9fedd962ab1cb11d8951321f59f52f4b77f041

SHA512
6b0cedbb0225b8b714ee738a4f1219cfe3c025c5a262112d03904f99a7b0f6fefef40327d121dcac86581cd297a562c9b1d1ead6cc2c5cebe23f590c5356aea9

Download Submit
C:\Windows\system\EBQftEb.exe

Filesize
2.7MB

MD5
74995b230d2fd54ee23771d09551f637

SHA1
fc53f78cc45fbbabfe944f1b7b7dc11f68df26b9

SHA256
3ba739819e705f143ec47ddcbe616a84dfcaa0648ee0702940ef235b1c9b8e16

SHA512
8595ac1bf83d27c72703934db016af07e79eaca21119b0a5b12ca023394d5424f5ec7e20004396805d3f94ff357b04a30858441f1e13f87bb794d1d7e163ed69

Download Submit
C:\Windows\system\Fnvunee.exe

Filesize
2.7MB

MD5
9b141568b6e7d552db0a2a88f4ee4633

SHA1
90817ffedffa815bbb66d72be22f90eedbeda0ea

SHA256
067ed4ebe778d4b48fdddf1157d46b9fefa77b3ee3c87ff6a0edaf0a37ee9c9a

SHA512
b378779ea1ae8072ca65bc6aae75efad2f490404669cac8999800805bbc269015cb73a780b8d5d064d86b03a21855bec4c2cd00ae3426201ca087c6e5ae913b2

Download Submit
C:\Windows\system\HQHxKIb.exe

Filesize
2.7MB

MD5
6ef01daee4d8bb1cbbc63a9a95926160

SHA1
374a41aff20c30c5bf94a4c9ddac7c6df3360e10

SHA256
c44351e2eeca5630603d04130ffacdd5bd1f416ad09c7415ce64d639ed6b33d7

SHA512
2ee22a61c8e9ce6f1ae942c1c57c8d2d36e1571263aa36955b21fe0bdb520c30062cb3377337c869e2d438c93fabfa40d4aa2c27a0ac35a334c5a16d8baf98be

Download Submit
C:\Windows\system\KgMdLxh.exe

Filesize
2.7MB

MD5
c1e25c201776c979344748b79ea51af7

SHA1
c7d14ae604378ca72a8ee0cb99f5251aa89560dc

SHA256
42311d36abc41943e24eedc2339c2adffadccd97dbce908e7f6694b6e38d2c64

SHA512
77579eae4dc80791dbe1b295a40b6255dca4b0dc2815eb51acff85673d4ac6c331436a260d5b9ffa079b03788fd0be85d9106af5e6ccd6c85905a6179a0f219b

Download Submit
C:\Windows\system\MptOEHR.exe

Filesize
2.7MB

MD5
52bb1983316b632b0cc1f950b72c0900

SHA1
3018fba9c03d2c616c8886fd12cf6dddd393cb24

SHA256
1a72c5af9768815d5c86d9c461e781a7dc0346b1563dc2eaa6d494091cfe59ff

SHA512
ccaf84e2c37d7c52772d771a6de7be85d5fce5e2ca20a264d7751d259d697d022ae5d788b7cb00b7ecb92feb9b06fcf2c36ff7711509d19561f928a9f03f0b03

Download Submit
C:\Windows\system\NNEWZSr.exe

Filesize
2.7MB

MD5
3627393fcc907977d0625c73d1e6c1be

SHA1
cf0fd23f5efc950a540828dffc3798c5a0f2c368

SHA256
bde97d5f7981a01be30c9acdfdda042997443e595cd790a377ec372ac277ea21

SHA512
ba9e45c423c09a5b1c97a276a8e4f222b1e081e15294d97b731656e0cd033a52309751a13822de5c0d84cfbe0e3f22d642575a96259701c966eabee68fa968af

Download Submit
C:\Windows\system\NiBAKZx.exe

Filesize
2.7MB

MD5
15e074c71009fd11f048215bc48e882d

SHA1
f3571d9dcab36ce64011837c64c4d5a3b14c25a6

SHA256
812207ac2ff5198291e79dec1224ee89a6fef8fc0b8db5efda3d858f7ecb5f89

SHA512
ee21436349d8ee2c2e7ed01c0748b0cf488b212cd181194b81dc63141913604b483ac25eb0331a99b0506a273860fdcd34d6ef6db08dfeafea01cc2e3dd70743

Download Submit
C:\Windows\system\OkcjsfS.exe

Filesize
2.7MB

MD5
a54f79fdd1fbbb1982a8678c5557a52a

SHA1
16095377b0789bfb6e06933cf84cdf536418ccb0

SHA256
f483919d96914a0d6ac4465b7f7f10f5aa4001f6c00b5ee48cea6148daf222fc

SHA512
8919e69c4f744c03d2268b580e91ffe9e4bed2e0e1db162c4937fc2712702cb6c08c8d3576d1e7158b11c3ae3ecde48b017f789e67655847293e46091490db9a

Download Submit
C:\Windows\system\PMAproS.exe

Filesize
2.7MB

MD5
6f613f272555e384f36e75e81f56abf5

SHA1
bfadd56525fa55c5e5637481240fb4c179318fd2

SHA256
3186c0331d5d1bc059787973b560de3551604e39688a24f0d9cc91eea6719b95

SHA512
ab6b895d48889085bd7297a3e9e801222d82d58c4396a02b80ef7e69c3e4b42e93bbae1701ad172fa51aa5d48a8582d7240df510633e4da6a8d603ce6c6bc9fb

Download Submit
C:\Windows\system\PXjCcAY.exe

Filesize
2.7MB

MD5
f245e89987c92733e3868601bde49c0e

SHA1
acece63fc73c12091d0e826e2843dd790b87f2fc

SHA256
b43e01aef8788cf750f8275aea5e2a0fd15520d6941a3c60d85a64805e93a209

SHA512
8085cbb38eb5ee0d3d02b71253fc686ef6206f65bb35ceeeb421613c3dd78bb0e8679dbb0ca75a8174c7b6cfe93ef9918bbf45e17c7166a0375ba03a508fb7d4

Download Submit
C:\Windows\system\baUBfJG.exe

Filesize
2.7MB

MD5
3860f1f55a6b83f4f684737bb5bfceb5

SHA1
c09c4befb11516b43b06be5a4665e161f9a51efe

SHA256
4b17ee8112e62bb050e15c3cc558393588fd6a412def8296f414edd04de95e7b

SHA512
bf6493f5645e9675d4465bcd5c2234e12836af39f334570272a7949266bd090d73025130c2b1dcac190bac238886ae78aeca3c688501e25b5f34f17eaad37f13

Download Submit
C:\Windows\system\ckcpLRX.exe

Filesize
2.7MB

MD5
6c0ce6d9998626604785e7f8fa913370

SHA1
07a09bc32060b060d51c476d9ea8701c7432f837

SHA256
5fe36eb7d6452f9ebd1c387695e62fa99eba6240c232d20bf1d4a9a6c4cb13ff

SHA512
54ff4adb460e704fd66b4795192cfc894ebad4e3889bcdf89ab70549c3fa2cb0a93202e6de8bc42f998c89fe6addbf9ba553c55cafc46159e2456bcdadf22b48

Download Submit
C:\Windows\system\eJtKexk.exe

Filesize
2.7MB

MD5
d2040097588dba89955c21613435414c

SHA1
7b6c8f6dac0d06a8f096fb2cbf0f7523513ceadd

SHA256
7db948c396f338459fb8b8865f7b1d0f4e024c9b2daf2dc5f6ee98175e056f84

SHA512
0dcf930094bda308e906b04b1bc46f18338380bea70ed1304ee9a43040cdd5e4a78a196c442dc40a78aebd99b514e89231b441a6c733a6b496635f478ddf0492

Download Submit
C:\Windows\system\gHjsdBP.exe

Filesize
2.7MB

MD5
32cee6b13184f49119f8a4712dc0444d

SHA1
c880ca17f6470acb936686bb110f1ca6304d6ad0

SHA256
cfcb0bc5cb4c936b4d7f0ca63e796adc09d9a394aa81dff8b43c523a0874915f

SHA512
8dfa378d26e57fde586f88da401b31b1b5b2d8573645e95b3dbb7dfb79423d664dbef4a0d9d244847f99a59812d23d63610785642b3a826450f0791829fa8356

Download Submit
C:\Windows\system\hZGxzoA.exe

Filesize
2.7MB

MD5
e3eed8000022b91d8e43d05e72dab10c

SHA1
e7f3a34556a8eea96687579889fab30240a9f0ae

SHA256
8b1cfe6aa711a9e9ff22e982a94adf9bf9bd03fe096587400128e98a24e167af

SHA512
81a63fd0708e971af7ce65d823254b60217222b11a8dbf1e450e9eaf883a145c37b666a50c05a564d33bded2e1248cdc78b793360b49415b4f5f0e0a85cea4b0

Download Submit
C:\Windows\system\kiVrTxe.exe

Filesize
2.7MB

MD5
7a14a0a030a610a9822a0867e26ac961

SHA1
dcd440dacf2ecbd51ce17c53df88f396e0abc326

SHA256
f75808744f627168cafe05be7254766b46d3efd6bc3bdf3003ab8a9851538e29

SHA512
05a417bec2be84dde36f336c13f0000043b35b33faf0ac6be5028aa45931be8720adaec110d21036f9094f5d4df3a7107779cc5f307098894b212583fab62ccd

Download Submit
C:\Windows\system\kmhLnMC.exe

Filesize
2.7MB

MD5
18eecd96d4546e7e1ec9dfaf708676cb

SHA1
6b3dd8f147f8bee766f81d01e62f89981739adc9

SHA256
52b50248861c75bb1cdb967b3e99abde10a2264f82eb49cd326ea15b50fcf558

SHA512
0b7afd93c551f8427589a0dc3bf74d864960ceed2e9b42321bbd6f9544d098bf4e6e3675112de74582efb557245de84ce313f7825dc60025dd4fd39ac25207bc

Download Submit
C:\Windows\system\nFfOeWh.exe

Filesize
2.7MB

MD5
b2e4d45c90b7cbca6292208353b5169b

SHA1
05198dccdf3443ecfbb0f89fca5caeab6e2f3c92

SHA256
fbf71421d06d2fef1bffa2dc2bc43705c5ce23ff71c885772bb1a6a9481e1527

SHA512
418ff70188fc4d5c5fc062367280ac2fb06a91471889556f0d8cb525858dde969574faf329217f3ddfba24f506831283e8f57def14742153008d2e1a1a545507

Download Submit
C:\Windows\system\oWMfSfs.exe

Filesize
2.7MB

MD5
883b5f9c6cf41b1c8cf73ea1095178a1

SHA1
511aa60651ee8158331b7cfaac173e2c4d65af6c

SHA256
3ad8b19d8717d33ac66b1d5407d86b171bccba10d8333ed4870d82256c96d05f

SHA512
b92fb5aefe4dc17aff72fb16d9fffb4ceafe729d6cc3907a028775403dd8ab1484387f62d9b7b8ce15b5cca77750063a333dd4c387691905d0734e33c0e66a58

Download Submit
C:\Windows\system\qrTxfvD.exe

Filesize
2.7MB

MD5
c595e0762c2ee6238c67a723ec6e66f4

SHA1
b907e993661e97e5a2eca92702c64725d4badf63

SHA256
450348b92bb1c92b091515980ffe61fe4684bad1c932b22682b31161b1a232cb

SHA512
7c551c7a5eb3dc1eb96053b040b62b6a14a11c01753d65c8d51d62f1405186e8da0b5ad01ecf0361a201e8724c9365e89620db38db408bff4e5f0b2aec19c33a

Download Submit
C:\Windows\system\rcsoILG.exe

Filesize
2.7MB

MD5
037c943dbb79d576aebc343816595bbf

SHA1
2bfc345d4ceae3673a31c53c0a93e7209a1b816c

SHA256
b4922a694810f9e6034189c556271421409819c1b3a3cf9004d020093871586a

SHA512
37c665187cb68d01aa43d4b36caf4c87c51fbe0bb82d758669be6605b30e009309e60ddbff8f5ed58af2eb09f360c361dec000b2104862bfbaca11da819c4c5a

Download Submit
C:\Windows\system\sEkBUEC.exe

Filesize
2.7MB

MD5
bd7eb2e0750d6a04e9a7d4f6972033e7

SHA1
1f19599443a9931c656256ca16dd4adb6a9689ed

SHA256
b46ffe5c1731b2ea2b5b1ff4e64f94b257e864aa9459888d1e40120fc63fc0d2

SHA512
0a7c1346f488f1bce93c3bac14e1eb9d14a9529343d169839ad95bb0ae76838f16503057a5964fa1622c57882f12566044131cb1d9323eb161e9e289a1cf2953

Download Submit
C:\Windows\system\sKrrKvk.exe

Filesize
2.7MB

MD5
49126d053d74a2dea19c3b05c4c1b14f

SHA1
fa417689a7aaf36806d61d5dcf6bc2166dd049da

SHA256
2cc8d3b5c29626d134398ef9cccd9047d74b92320f79635a2bc27dbbc5fde7b1

SHA512
ea8610f9e4d440cc458ed4406273cd7492f438a9e35cc3bcb2c82007f2c7492b29c1cc39f29c1e43e8779190f80f8d8e8f2670c09e768568f8e78eb3c94e386c

Download Submit
C:\Windows\system\swgSMPZ.exe

Filesize
2.7MB

MD5
dae9c65a7c98edf0ecae7cce7db57424

SHA1
9c664b23bc70a1a754833f592ae58e86e05058b9

SHA256
45c3319ee8555976dbbb5b2f8e0e4cf165325a808adff58dec900e995a7d261e

SHA512
01e5b796be5ccd4fb39a629a73be7ab1f0f75910bd8521d0d09ef6c82cfa5ede7f015002807d903508b85fa478d017f61e24ab89ad5b6835a857b50c6683f51f

Download Submit
C:\Windows\system\sytUPaB.exe

Filesize
2.7MB

MD5
41efcd76d547412b622b480bbabc4b5b

SHA1
cfa8fadcee6f0969f7633dcaa52a7e84a3ef3d25

SHA256
d41a33e67923f79481e4bbc83a50d5c8a0e509a49a07ca778ee7b825491478cd

SHA512
d1db47e46c7db4bb42906bbb68bb91eec34ce96c9d9aa473b48774146ab9ac46ea8c9db70f8e8ed537f4fed4a81e946e83c1f5fe393f58f4ca979233401cbf18

Download Submit
C:\Windows\system\vgGwfFk.exe

Filesize
2.7MB

MD5
a97fe8b8033eb2b939c07ba2740fe76a

SHA1
7e161c7cba06e1f6127fe628eb97269319b51503

SHA256
b87f6027971afc7cb0c34894550d2c131c4920d4b02daee2f8154000f246a206

SHA512
2038393e1753b2ffac7153615e4c7a7d7852b38d86ee2c3ac2ea523423daaad3cada4ab0287b6da2e7276a0bff798ef0c82dcfb14dce3d67046644f64207bd36

Download Submit
C:\Windows\system\ygnREPe.exe

Filesize
2.7MB

MD5
b99671584822f0a2ecd80ab90bb294ef

SHA1
dfb97c7166f0daaf17031a8be25ba54dd26eaa7c

SHA256
ed2a98272d6dcaee9144e47c7e725cee6be78032ae6fd6f383e97d50e851e377

SHA512
5bfbe3f7bb4c8269508a2bb4de811d9664a926d38e68fe48d6322dac460dd1171596eada496eea4cf4c55808ad1d159e5a2073572047e6e2936cdb8dce850c01

Download Submit
\Windows\system\AWJOjZp.exe

Filesize
2.7MB

MD5
02003096e892b9b58e796aba86f213ed

SHA1
1cdc7ddb8eb2bb8a3486d8b6fdff09859af4ae41

SHA256
acdba0070607c78390e61205befaa27be0e44b04e68ceacab852d578ea10ab40

SHA512
e92ccd3455c450d9ca57810734ac495e3a4a5f8ce7773c23edf0311bd3e699f13e9b9cea0aadf4f950e862fcb6abcf4666c0bc6028b5f4a3db4bc9ccf04e5847

Download Submit
\Windows\system\Giujwys.exe

Filesize
2.7MB

MD5
6a56125959cfc60ca51e137d12da5ef7

SHA1
20f735c3c85b2f80fd55f3754677297afe30a7d9

SHA256
49a678c68baff1e609632505c4440cd7d713d8637f89bc9e3af274f4068cd1e0

SHA512
cdaca97e14123956788ff4111f74241704421ae7df60b50d7fcdd8b3df73666382b3e32810d0a87d1741bcdce4e344c267375cc5d195a12fe95be53652308be9

Download Submit
\Windows\system\OGqKKVz.exe

Filesize
2.7MB

MD5
0f40f63d9880dc9eefed8353d79dfaa4

SHA1
b8ef859aaf36bf0342be41c488291211cb9ffd94

SHA256
d96b86cc8460fef2d89bbe512fc02042dfd9eaee9a2e81c39a522d0517b7093c

SHA512
203b9384c159ee2efe3faf643b125960faa1941634f3c69fafb54cd074e12504b42f4f40fcae893cdffda2379f5ff452e1b562c6511c7cfb7a33d0621a183a99

Download Submit
\Windows\system\zASUFxZ.exe

Filesize
2.7MB

MD5
ea45ee5a55c2fc0166a2d93eeab3b696

SHA1
d5696ca683fedae6f0dc33f2322712c466e680b1

SHA256
59ef25bc46f3a9ecdfce70a0be0f750402c70004db8f2495b75bf6b4c67e90a8

SHA512
bea890f87497f157e0fb8586dfbcb651936bd121108daf9128c0cf23774442cb7530238edcef25917d9cc7d7364a698fb45e1c63727c7eba2595d7d0082a2caa

Download Submit
memory/752-96-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/752-2876-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/1368-102-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-58-0x000000013F020000-0x000000013F374000-memory.dmp

Filesize
3.3MB

Download
memory/1368-1069-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-643-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-22-0x000000013F0C0000-0x000000013F414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-2214-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-25-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-100-0x000000013F1C0000-0x000000013F514000-memory.dmp

Filesize
3.3MB

Download
memory/1368-99-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-11-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-97-0x000000013FB40000-0x000000013FE94000-memory.dmp

Filesize
3.3MB

Download
memory/1368-20-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-95-0x000000013FD80000-0x00000001400D4000-memory.dmp

Filesize
3.3MB

Download
memory/1368-94-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-52-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-0-0x000000013F590000-0x000000013F8E4000-memory.dmp

Filesize
3.3MB

Download
memory/1368-66-0x00000000020C0000-0x0000000002414000-memory.dmp

Filesize
3.3MB

Download
memory/1368-55-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/1368-628-0x000000013F590000-0x000000013F8E4000-memory.dmp

Filesize
3.3MB

Download
memory/1368-59-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/1984-101-0x000000013F1C0000-0x000000013F514000-memory.dmp

Filesize
3.3MB

Download
memory/1984-3014-0x000000013F1C0000-0x000000013F514000-memory.dmp

Filesize
3.3MB

Download
memory/2128-2910-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2128-61-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2196-2907-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/2196-57-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/2376-3015-0x000000013FB40000-0x000000013FE94000-memory.dmp

Filesize
3.3MB

Download
memory/2376-98-0x000000013FB40000-0x000000013FE94000-memory.dmp

Filesize
3.3MB

Download
memory/2396-68-0x000000013F7F0000-0x000000013FB44000-memory.dmp

Filesize
3.3MB

Download
memory/2396-3833-0x000000013F7F0000-0x000000013FB44000-memory.dmp

Filesize
3.3MB

Download
memory/2432-2887-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2432-60-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2584-21-0x000000013F500000-0x000000013F854000-memory.dmp

Filesize
3.3MB

Download
memory/2584-2916-0x000000013F500000-0x000000013F854000-memory.dmp

Filesize
3.3MB

Download
memory/2644-2908-0x000000013F020000-0x000000013F374000-memory.dmp

Filesize
3.3MB

Download
memory/2644-48-0x000000013F020000-0x000000013F374000-memory.dmp

Filesize
3.3MB

Download
memory/2672-2942-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2672-2222-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2672-36-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2680-2911-0x000000013F2F0000-0x000000013F644000-memory.dmp

Filesize
3.3MB

Download
memory/2680-16-0x000000013F2F0000-0x000000013F644000-memory.dmp

Filesize
3.3MB

Download
memory/2680-7-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2712-3485-0x000000013F6E0000-0x000000013FA34000-memory.dmp

Filesize
3.3MB

Download
memory/2712-65-0x000000013F6E0000-0x000000013FA34000-memory.dmp

Filesize
3.3MB

Download
memory/2944-23-0x000000013F0C0000-0x000000013F414000-memory.dmp

Filesize
3.3MB

Download
memory/2944-2933-0x000000013F0C0000-0x000000013F414000-memory.dmp

Filesize
3.3MB

Download