xmrig | f6e35766360ab45c9a23ee804ffcff87ae8ce8a5db258501267f1b4986e91996

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
Size

2.3MB
MD5

9055a488484c0a8d845322ab3309a200
SHA1

1551c68a4d7acca44cf9b35bfd923b3e2204b418
SHA256

f6e35766360ab45c9a23ee804ffcff87ae8ce8a5db258501267f1b4986e91996
SHA512

77a8812f0fde4bfded570b36547a07e3df17467f72ab3a84ca73ffc2e6fa95332c95e518aba9f865682db51d027e61aa48e92100dd1db175e68e8dc79a293aee
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+A4VBqxGLI9ey:BemTLkNdfE0pZrO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1956-0-0x000000013FF90000-0x00000001402E4000-memory.dmp	xmrig
behavioral1/files/0x0030000000014eb9-11.dat	xmrig
behavioral1/files/0x000c00000001480e-5.dat	xmrig
behavioral1/files/0x0007000000015645-22.dat	xmrig
behavioral1/memory/1632-27-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/1956-36-0x000000013F400000-0x000000013F754000-memory.dmp	xmrig
behavioral1/memory/2600-35-0x000000013FC20000-0x000000013FF74000-memory.dmp	xmrig
behavioral1/memory/2776-34-0x000000013F120000-0x000000013F474000-memory.dmp	xmrig
behavioral1/memory/2984-31-0x000000013F4D0000-0x000000013F824000-memory.dmp	xmrig
behavioral1/memory/2712-29-0x000000013F400000-0x000000013F754000-memory.dmp	xmrig
behavioral1/files/0x00070000000155f6-18.dat	xmrig
behavioral1/files/0x000700000001540d-17.dat	xmrig
behavioral1/files/0x000700000001564d-40.dat	xmrig
behavioral1/files/0x0006000000015d44-54.dat	xmrig
behavioral1/files/0x0007000000015d24-53.dat	xmrig
behavioral1/memory/2688-52-0x000000013F990000-0x000000013FCE4000-memory.dmp	xmrig
behavioral1/memory/1956-64-0x000000013F990000-0x000000013FCE4000-memory.dmp	xmrig
behavioral1/memory/2560-75-0x000000013FD80000-0x00000001400D4000-memory.dmp	xmrig
behavioral1/files/0x0006000000015e09-79.dat	xmrig
behavioral1/files/0x0006000000015f3c-93.dat	xmrig
behavioral1/files/0x0006000000016476-123.dat	xmrig
behavioral1/files/0x0006000000016a6f-143.dat	xmrig
behavioral1/files/0x0006000000016c3a-153.dat	xmrig
behavioral1/memory/2776-871-0x000000013F120000-0x000000013F474000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d05-188.dat	xmrig
behavioral1/files/0x0006000000016cfd-183.dat	xmrig
behavioral1/files/0x0006000000016cf5-178.dat	xmrig
behavioral1/files/0x0006000000016ce4-173.dat	xmrig
behavioral1/files/0x0006000000016cb2-168.dat	xmrig
behavioral1/files/0x0006000000016c8c-163.dat	xmrig
behavioral1/files/0x0006000000016c42-158.dat	xmrig
behavioral1/files/0x0006000000016c1d-148.dat	xmrig
behavioral1/files/0x0006000000016813-138.dat	xmrig
behavioral1/files/0x00060000000165f0-133.dat	xmrig
behavioral1/files/0x000600000001654a-128.dat	xmrig
behavioral1/files/0x00060000000162c9-118.dat	xmrig
behavioral1/files/0x00060000000161b3-113.dat	xmrig
behavioral1/files/0x00060000000160cc-108.dat	xmrig
behavioral1/memory/1956-104-0x000000013FF90000-0x00000001402E4000-memory.dmp	xmrig
behavioral1/files/0x0006000000015fa7-102.dat	xmrig
behavioral1/files/0x0006000000015e6d-89.dat	xmrig
behavioral1/memory/1248-97-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/memory/2860-95-0x000000013F140000-0x000000013F494000-memory.dmp	xmrig
behavioral1/memory/2576-85-0x000000013F3C0000-0x000000013F714000-memory.dmp	xmrig
behavioral1/memory/2444-78-0x000000013F250000-0x000000013F5A4000-memory.dmp	xmrig
behavioral1/memory/2508-68-0x000000013FBD0000-0x000000013FF24000-memory.dmp	xmrig
behavioral1/memory/2424-69-0x000000013F8E0000-0x000000013FC34000-memory.dmp	xmrig
behavioral1/files/0x003000000001502c-73.dat	xmrig
behavioral1/files/0x0006000000015d4c-61.dat	xmrig
behavioral1/memory/2428-60-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/files/0x0008000000015c4c-45.dat	xmrig
behavioral1/memory/1248-3279-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/memory/1632-4028-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/2712-4029-0x000000013F400000-0x000000013F754000-memory.dmp	xmrig
behavioral1/memory/2984-4030-0x000000013F4D0000-0x000000013F824000-memory.dmp	xmrig
behavioral1/memory/2600-4031-0x000000013FC20000-0x000000013FF74000-memory.dmp	xmrig
behavioral1/memory/2776-4032-0x000000013F120000-0x000000013F474000-memory.dmp	xmrig
behavioral1/memory/2428-4033-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/memory/2560-4035-0x000000013FD80000-0x00000001400D4000-memory.dmp	xmrig
behavioral1/memory/2688-4034-0x000000013F990000-0x000000013FCE4000-memory.dmp	xmrig
behavioral1/memory/2424-4037-0x000000013F8E0000-0x000000013FC34000-memory.dmp	xmrig
behavioral1/memory/2444-4038-0x000000013F250000-0x000000013F5A4000-memory.dmp	xmrig
behavioral1/memory/2508-4036-0x000000013FBD0000-0x000000013FF24000-memory.dmp	xmrig
behavioral1/memory/2576-4039-0x000000013F3C0000-0x000000013F714000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1632	xGzFtPu.exe
2712	cOBeMdI.exe
2984	ZzCDVgz.exe
2776	CjxMvgF.exe
2600	UnuUIuA.exe
2428	UkZaeiA.exe
2688	BWVlRan.exe
2560	CpUESEI.exe
2508	PjniekZ.exe
2424	JzsSLvp.exe
2444	ruxXCeW.exe
2576	stcNhXH.exe
2860	jRWYvPu.exe
1248	GefVdhU.exe
1564	aBjGFZu.exe
2280	pnugBXb.exe
1640	rCatWMG.exe
2352	rcVPWoL.exe
1252	ufRSkpe.exe
2160	vgSJRUX.exe
2016	NOXmkns.exe
2020	rDznLNU.exe
1940	RHALBgy.exe
2204	rbdrEfO.exe
2240	SzqenvQ.exe
2224	ZgrieqK.exe
2212	xuLAHWV.exe
2572	yZCbrQV.exe
780	iRMeXAF.exe
1056	qbcQqYk.exe
1384	SNtzdRk.exe
1692	CtmwpNi.exe
1136	DVbLCGL.exe
904	vYelqXy.exe
2108	XzXKHyF.exe
412	hbPwdZl.exe
2356	BSWnGqk.exe
2996	AwvLDQb.exe
2960	ZpfFKnx.exe
1428	BfjgNCu.exe
1456	RGzQRkq.exe
956	rqmnoDy.exe
1780	yOfhyBH.exe
1196	YQarAqG.exe
1660	iEjvmbO.exe
848	ejSvMBo.exe
3068	YCEJLMb.exe
2344	DhYbjDK.exe
2816	HiPLiwx.exe
1648	vYIsNDT.exe
1000	xFIlscK.exe
1776	YlJPvtf.exe
876	nQmwDrX.exe
1416	usbIYgp.exe
880	sdZiuJb.exe
1920	iaShcFV.exe
1592	pPXFJwe.exe
1500	pLyKLQG.exe
1628	HXyNSvO.exe
3032	nhGesoo.exe
2660	xezrHtn.exe
2552	ZTNJtnu.exe
2532	vKQeGJz.exe
1844	bJtIAAV.exe

Loads dropped DLL 64 IoCs

pid	Process
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1956-0-0x000000013FF90000-0x00000001402E4000-memory.dmp	upx
behavioral1/files/0x0030000000014eb9-11.dat	upx
behavioral1/files/0x000c00000001480e-5.dat	upx
behavioral1/files/0x0007000000015645-22.dat	upx
behavioral1/memory/1632-27-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/2600-35-0x000000013FC20000-0x000000013FF74000-memory.dmp	upx
behavioral1/memory/2776-34-0x000000013F120000-0x000000013F474000-memory.dmp	upx
behavioral1/memory/2984-31-0x000000013F4D0000-0x000000013F824000-memory.dmp	upx
behavioral1/memory/2712-29-0x000000013F400000-0x000000013F754000-memory.dmp	upx
behavioral1/files/0x00070000000155f6-18.dat	upx
behavioral1/files/0x000700000001540d-17.dat	upx
behavioral1/files/0x000700000001564d-40.dat	upx
behavioral1/files/0x0006000000015d44-54.dat	upx
behavioral1/files/0x0007000000015d24-53.dat	upx
behavioral1/memory/2688-52-0x000000013F990000-0x000000013FCE4000-memory.dmp	upx
behavioral1/memory/2560-75-0x000000013FD80000-0x00000001400D4000-memory.dmp	upx
behavioral1/files/0x0006000000015e09-79.dat	upx
behavioral1/files/0x0006000000015f3c-93.dat	upx
behavioral1/files/0x0006000000016476-123.dat	upx
behavioral1/files/0x0006000000016a6f-143.dat	upx
behavioral1/files/0x0006000000016c3a-153.dat	upx
behavioral1/memory/2776-871-0x000000013F120000-0x000000013F474000-memory.dmp	upx
behavioral1/files/0x0006000000016d05-188.dat	upx
behavioral1/files/0x0006000000016cfd-183.dat	upx
behavioral1/files/0x0006000000016cf5-178.dat	upx
behavioral1/files/0x0006000000016ce4-173.dat	upx
behavioral1/files/0x0006000000016cb2-168.dat	upx
behavioral1/files/0x0006000000016c8c-163.dat	upx
behavioral1/files/0x0006000000016c42-158.dat	upx
behavioral1/files/0x0006000000016c1d-148.dat	upx
behavioral1/files/0x0006000000016813-138.dat	upx
behavioral1/files/0x00060000000165f0-133.dat	upx
behavioral1/files/0x000600000001654a-128.dat	upx
behavioral1/files/0x00060000000162c9-118.dat	upx
behavioral1/files/0x00060000000161b3-113.dat	upx
behavioral1/files/0x00060000000160cc-108.dat	upx
behavioral1/memory/1956-104-0x000000013FF90000-0x00000001402E4000-memory.dmp	upx
behavioral1/files/0x0006000000015fa7-102.dat	upx
behavioral1/files/0x0006000000015e6d-89.dat	upx
behavioral1/memory/1248-97-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/memory/2860-95-0x000000013F140000-0x000000013F494000-memory.dmp	upx
behavioral1/memory/2576-85-0x000000013F3C0000-0x000000013F714000-memory.dmp	upx
behavioral1/memory/2444-78-0x000000013F250000-0x000000013F5A4000-memory.dmp	upx
behavioral1/memory/2508-68-0x000000013FBD0000-0x000000013FF24000-memory.dmp	upx
behavioral1/memory/2424-69-0x000000013F8E0000-0x000000013FC34000-memory.dmp	upx
behavioral1/files/0x003000000001502c-73.dat	upx
behavioral1/files/0x0006000000015d4c-61.dat	upx
behavioral1/memory/2428-60-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/files/0x0008000000015c4c-45.dat	upx
behavioral1/memory/1248-3279-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/memory/1632-4028-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/2712-4029-0x000000013F400000-0x000000013F754000-memory.dmp	upx
behavioral1/memory/2984-4030-0x000000013F4D0000-0x000000013F824000-memory.dmp	upx
behavioral1/memory/2600-4031-0x000000013FC20000-0x000000013FF74000-memory.dmp	upx
behavioral1/memory/2776-4032-0x000000013F120000-0x000000013F474000-memory.dmp	upx
behavioral1/memory/2428-4033-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/memory/2560-4035-0x000000013FD80000-0x00000001400D4000-memory.dmp	upx
behavioral1/memory/2688-4034-0x000000013F990000-0x000000013FCE4000-memory.dmp	upx
behavioral1/memory/2424-4037-0x000000013F8E0000-0x000000013FC34000-memory.dmp	upx
behavioral1/memory/2444-4038-0x000000013F250000-0x000000013F5A4000-memory.dmp	upx
behavioral1/memory/2508-4036-0x000000013FBD0000-0x000000013FF24000-memory.dmp	upx
behavioral1/memory/2576-4039-0x000000013F3C0000-0x000000013F714000-memory.dmp	upx
behavioral1/memory/2860-4040-0x000000013F140000-0x000000013F494000-memory.dmp	upx
behavioral1/memory/1248-4041-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xuvQZtp.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\lhDqOqU.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\ZTaoRSb.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\rFbnrBW.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\UHVdHfZ.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\ZdqVGIF.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\hPczgcC.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\tkKfIKy.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\tthkWLB.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\JAfBbLf.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\cvGSmyv.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\NKUVnRI.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\KMudCuA.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\stcNhXH.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\wzdFasS.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\tuUsqpZ.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\VZwqOnA.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\aJaTofs.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\JlLHeCy.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\CCxSuNs.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\jJPceyZ.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\BJZEgzZ.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\FPqrOvA.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\uNswdgX.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\RlfxyqO.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\qxiNIYr.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\Gmqemcq.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\twDTJRX.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\xuigixj.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\zhrJYGt.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\OMetIlL.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\frdxUty.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\ETpCCcn.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\vcYztNr.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\iWFtOFQ.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\GMkoVHx.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\PYWpPKb.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\vCMHhRN.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\NPajEDN.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\gsodQeM.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\qxzrWWP.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\RyXdvfk.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\FyIvscc.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\RbJwOtt.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\hUgoJBs.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\PVuRyHn.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\NPNliHL.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\mLXtyWE.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\DgPzDTH.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\dehHZly.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\yaUmJkN.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\CaEanpZ.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\sCtwLDp.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\hVZJKcb.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\pQiGvic.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\ENeohrP.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\VRFwFSh.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\yzmhEUi.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\vKQeGJz.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\AJCeIJn.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\uJpjPij.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\cJcwrZV.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\GmoaDRB.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
File created	C:\Windows\System\ZgrieqK.exe	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1632	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	29
PID 1956 wrote to memory of 1632	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	29
PID 1956 wrote to memory of 1632	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	29
PID 1956 wrote to memory of 2712	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	30
PID 1956 wrote to memory of 2712	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	30
PID 1956 wrote to memory of 2712	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	30
PID 1956 wrote to memory of 2984	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	31
PID 1956 wrote to memory of 2984	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	31
PID 1956 wrote to memory of 2984	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	31
PID 1956 wrote to memory of 2600	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	32
PID 1956 wrote to memory of 2600	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	32
PID 1956 wrote to memory of 2600	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	32
PID 1956 wrote to memory of 2776	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	33
PID 1956 wrote to memory of 2776	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	33
PID 1956 wrote to memory of 2776	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	33
PID 1956 wrote to memory of 2428	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	34
PID 1956 wrote to memory of 2428	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	34
PID 1956 wrote to memory of 2428	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	34
PID 1956 wrote to memory of 2688	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	35
PID 1956 wrote to memory of 2688	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	35
PID 1956 wrote to memory of 2688	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	35
PID 1956 wrote to memory of 2560	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	36
PID 1956 wrote to memory of 2560	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	36
PID 1956 wrote to memory of 2560	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	36
PID 1956 wrote to memory of 2508	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	37
PID 1956 wrote to memory of 2508	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	37
PID 1956 wrote to memory of 2508	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	37
PID 1956 wrote to memory of 2424	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	38
PID 1956 wrote to memory of 2424	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	38
PID 1956 wrote to memory of 2424	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	38
PID 1956 wrote to memory of 2444	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	39
PID 1956 wrote to memory of 2444	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	39
PID 1956 wrote to memory of 2444	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	39
PID 1956 wrote to memory of 2576	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	40
PID 1956 wrote to memory of 2576	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	40
PID 1956 wrote to memory of 2576	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	40
PID 1956 wrote to memory of 2860	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	41
PID 1956 wrote to memory of 2860	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	41
PID 1956 wrote to memory of 2860	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	41
PID 1956 wrote to memory of 1248	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	42
PID 1956 wrote to memory of 1248	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	42
PID 1956 wrote to memory of 1248	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	42
PID 1956 wrote to memory of 1564	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	43
PID 1956 wrote to memory of 1564	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	43
PID 1956 wrote to memory of 1564	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	43
PID 1956 wrote to memory of 2280	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	44
PID 1956 wrote to memory of 2280	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	44
PID 1956 wrote to memory of 2280	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	44
PID 1956 wrote to memory of 1640	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	45
PID 1956 wrote to memory of 1640	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	45
PID 1956 wrote to memory of 1640	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	45
PID 1956 wrote to memory of 2352	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	46
PID 1956 wrote to memory of 2352	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	46
PID 1956 wrote to memory of 2352	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	46
PID 1956 wrote to memory of 1252	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	47
PID 1956 wrote to memory of 1252	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	47
PID 1956 wrote to memory of 1252	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	47
PID 1956 wrote to memory of 2160	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	48
PID 1956 wrote to memory of 2160	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	48
PID 1956 wrote to memory of 2160	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	48
PID 1956 wrote to memory of 2016	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	49
PID 1956 wrote to memory of 2016	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	49
PID 1956 wrote to memory of 2016	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	49
PID 1956 wrote to memory of 2020	1956	9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9055a488484c0a8d845322ab3309a200_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\System\xGzFtPu.exe
  C:\Windows\System\xGzFtPu.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\cOBeMdI.exe
  C:\Windows\System\cOBeMdI.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\ZzCDVgz.exe
  C:\Windows\System\ZzCDVgz.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\UnuUIuA.exe
  C:\Windows\System\UnuUIuA.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\CjxMvgF.exe
  C:\Windows\System\CjxMvgF.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\UkZaeiA.exe
  C:\Windows\System\UkZaeiA.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\BWVlRan.exe
  C:\Windows\System\BWVlRan.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\CpUESEI.exe
  C:\Windows\System\CpUESEI.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\PjniekZ.exe
  C:\Windows\System\PjniekZ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\JzsSLvp.exe
  C:\Windows\System\JzsSLvp.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\ruxXCeW.exe
  C:\Windows\System\ruxXCeW.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\stcNhXH.exe
  C:\Windows\System\stcNhXH.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\jRWYvPu.exe
  C:\Windows\System\jRWYvPu.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\GefVdhU.exe
  C:\Windows\System\GefVdhU.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\aBjGFZu.exe
  C:\Windows\System\aBjGFZu.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\pnugBXb.exe
  C:\Windows\System\pnugBXb.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\rCatWMG.exe
  C:\Windows\System\rCatWMG.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\rcVPWoL.exe
  C:\Windows\System\rcVPWoL.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\ufRSkpe.exe
  C:\Windows\System\ufRSkpe.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\vgSJRUX.exe
  C:\Windows\System\vgSJRUX.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\NOXmkns.exe
  C:\Windows\System\NOXmkns.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\rDznLNU.exe
  C:\Windows\System\rDznLNU.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\RHALBgy.exe
  C:\Windows\System\RHALBgy.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\rbdrEfO.exe
  C:\Windows\System\rbdrEfO.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\SzqenvQ.exe
  C:\Windows\System\SzqenvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\ZgrieqK.exe
  C:\Windows\System\ZgrieqK.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\xuLAHWV.exe
  C:\Windows\System\xuLAHWV.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\yZCbrQV.exe
  C:\Windows\System\yZCbrQV.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\iRMeXAF.exe
  C:\Windows\System\iRMeXAF.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\qbcQqYk.exe
  C:\Windows\System\qbcQqYk.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\SNtzdRk.exe
  C:\Windows\System\SNtzdRk.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\CtmwpNi.exe
  C:\Windows\System\CtmwpNi.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\DVbLCGL.exe
  C:\Windows\System\DVbLCGL.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\vYelqXy.exe
  C:\Windows\System\vYelqXy.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\XzXKHyF.exe
  C:\Windows\System\XzXKHyF.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\hbPwdZl.exe
  C:\Windows\System\hbPwdZl.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\BSWnGqk.exe
  C:\Windows\System\BSWnGqk.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\AwvLDQb.exe
  C:\Windows\System\AwvLDQb.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\ZpfFKnx.exe
  C:\Windows\System\ZpfFKnx.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\BfjgNCu.exe
  C:\Windows\System\BfjgNCu.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\RGzQRkq.exe
  C:\Windows\System\RGzQRkq.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\rqmnoDy.exe
  C:\Windows\System\rqmnoDy.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\yOfhyBH.exe
  C:\Windows\System\yOfhyBH.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\YQarAqG.exe
  C:\Windows\System\YQarAqG.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\iEjvmbO.exe
  C:\Windows\System\iEjvmbO.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ejSvMBo.exe
  C:\Windows\System\ejSvMBo.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\YCEJLMb.exe
  C:\Windows\System\YCEJLMb.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\DhYbjDK.exe
  C:\Windows\System\DhYbjDK.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\HiPLiwx.exe
  C:\Windows\System\HiPLiwx.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\vYIsNDT.exe
  C:\Windows\System\vYIsNDT.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\xFIlscK.exe
  C:\Windows\System\xFIlscK.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\YlJPvtf.exe
  C:\Windows\System\YlJPvtf.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\nQmwDrX.exe
  C:\Windows\System\nQmwDrX.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\usbIYgp.exe
  C:\Windows\System\usbIYgp.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\sdZiuJb.exe
  C:\Windows\System\sdZiuJb.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\iaShcFV.exe
  C:\Windows\System\iaShcFV.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\pPXFJwe.exe
  C:\Windows\System\pPXFJwe.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\pLyKLQG.exe
  C:\Windows\System\pLyKLQG.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\HXyNSvO.exe
  C:\Windows\System\HXyNSvO.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\nhGesoo.exe
  C:\Windows\System\nhGesoo.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\xezrHtn.exe
  C:\Windows\System\xezrHtn.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ZTNJtnu.exe
  C:\Windows\System\ZTNJtnu.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\vKQeGJz.exe
  C:\Windows\System\vKQeGJz.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\bJtIAAV.exe
  C:\Windows\System\bJtIAAV.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\PeEynNc.exe
  C:\Windows\System\PeEynNc.exe
  2⤵
  PID:2468
- C:\Windows\System\zCcSLhc.exe
  C:\Windows\System\zCcSLhc.exe
  2⤵
  PID:2876
- C:\Windows\System\KWokQiK.exe
  C:\Windows\System\KWokQiK.exe
  2⤵
  PID:2192
- C:\Windows\System\kUZyDHX.exe
  C:\Windows\System\kUZyDHX.exe
  2⤵
  PID:1760
- C:\Windows\System\ADfqeSJ.exe
  C:\Windows\System\ADfqeSJ.exe
  2⤵
  PID:1616
- C:\Windows\System\zGPxMcc.exe
  C:\Windows\System\zGPxMcc.exe
  2⤵
  PID:1636
- C:\Windows\System\ClKBaqX.exe
  C:\Windows\System\ClKBaqX.exe
  2⤵
  PID:2904
- C:\Windows\System\HAtrNZK.exe
  C:\Windows\System\HAtrNZK.exe
  2⤵
  PID:2452
- C:\Windows\System\vIqUqKC.exe
  C:\Windows\System\vIqUqKC.exe
  2⤵
  PID:2584
- C:\Windows\System\ykKSObr.exe
  C:\Windows\System\ykKSObr.exe
  2⤵
  PID:2908
- C:\Windows\System\ScFFIGy.exe
  C:\Windows\System\ScFFIGy.exe
  2⤵
  PID:1984
- C:\Windows\System\oYxaazw.exe
  C:\Windows\System\oYxaazw.exe
  2⤵
  PID:1700
- C:\Windows\System\iGWbAax.exe
  C:\Windows\System\iGWbAax.exe
  2⤵
  PID:2540
- C:\Windows\System\VPkZNfq.exe
  C:\Windows\System\VPkZNfq.exe
  2⤵
  PID:1036
- C:\Windows\System\fWaOrTb.exe
  C:\Windows\System\fWaOrTb.exe
  2⤵
  PID:1724
- C:\Windows\System\OXjGBIg.exe
  C:\Windows\System\OXjGBIg.exe
  2⤵
  PID:304
- C:\Windows\System\EZZoRhS.exe
  C:\Windows\System\EZZoRhS.exe
  2⤵
  PID:2080
- C:\Windows\System\MoWqNLA.exe
  C:\Windows\System\MoWqNLA.exe
  2⤵
  PID:2912
- C:\Windows\System\XoaIVdv.exe
  C:\Windows\System\XoaIVdv.exe
  2⤵
  PID:2360
- C:\Windows\System\Yapnvnx.exe
  C:\Windows\System\Yapnvnx.exe
  2⤵
  PID:2976
- C:\Windows\System\PVuRyHn.exe
  C:\Windows\System\PVuRyHn.exe
  2⤵
  PID:1492
- C:\Windows\System\JQcgrvV.exe
  C:\Windows\System\JQcgrvV.exe
  2⤵
  PID:1472
- C:\Windows\System\SddWcNx.exe
  C:\Windows\System\SddWcNx.exe
  2⤵
  PID:1536
- C:\Windows\System\RyXdvfk.exe
  C:\Windows\System\RyXdvfk.exe
  2⤵
  PID:332
- C:\Windows\System\ibOoeKD.exe
  C:\Windows\System\ibOoeKD.exe
  2⤵
  PID:924
- C:\Windows\System\ZNoCawp.exe
  C:\Windows\System\ZNoCawp.exe
  2⤵
  PID:1988
- C:\Windows\System\KLeFmXf.exe
  C:\Windows\System\KLeFmXf.exe
  2⤵
  PID:3048
- C:\Windows\System\bMADiUp.exe
  C:\Windows\System\bMADiUp.exe
  2⤵
  PID:3060
- C:\Windows\System\DWNHwyF.exe
  C:\Windows\System\DWNHwyF.exe
  2⤵
  PID:2268
- C:\Windows\System\pcMjUvw.exe
  C:\Windows\System\pcMjUvw.exe
  2⤵
  PID:2800
- C:\Windows\System\ShaFvbj.exe
  C:\Windows\System\ShaFvbj.exe
  2⤵
  PID:2804
- C:\Windows\System\sTMQchy.exe
  C:\Windows\System\sTMQchy.exe
  2⤵
  PID:1612
- C:\Windows\System\hJoOUJH.exe
  C:\Windows\System\hJoOUJH.exe
  2⤵
  PID:2524
- C:\Windows\System\bNPdLFZ.exe
  C:\Windows\System\bNPdLFZ.exe
  2⤵
  PID:2992
- C:\Windows\System\tvaygFa.exe
  C:\Windows\System\tvaygFa.exe
  2⤵
  PID:2312
- C:\Windows\System\VIOcFEO.exe
  C:\Windows\System\VIOcFEO.exe
  2⤵
  PID:2408
- C:\Windows\System\CBxeZkw.exe
  C:\Windows\System\CBxeZkw.exe
  2⤵
  PID:2856
- C:\Windows\System\XueMyXB.exe
  C:\Windows\System\XueMyXB.exe
  2⤵
  PID:2276
- C:\Windows\System\sSqJGmR.exe
  C:\Windows\System\sSqJGmR.exe
  2⤵
  PID:1584
- C:\Windows\System\rrSiSUK.exe
  C:\Windows\System\rrSiSUK.exe
  2⤵
  PID:836
- C:\Windows\System\fMNTQVb.exe
  C:\Windows\System\fMNTQVb.exe
  2⤵
  PID:2164
- C:\Windows\System\bNEsDvd.exe
  C:\Windows\System\bNEsDvd.exe
  2⤵
  PID:1936
- C:\Windows\System\oXbFgxf.exe
  C:\Windows\System\oXbFgxf.exe
  2⤵
  PID:1176
- C:\Windows\System\ydeUghu.exe
  C:\Windows\System\ydeUghu.exe
  2⤵
  PID:2372
- C:\Windows\System\KqRBNHo.exe
  C:\Windows\System\KqRBNHo.exe
  2⤵
  PID:3036
- C:\Windows\System\bKVoXuF.exe
  C:\Windows\System\bKVoXuF.exe
  2⤵
  PID:1124
- C:\Windows\System\BKLvhja.exe
  C:\Windows\System\BKLvhja.exe
  2⤵
  PID:1432
- C:\Windows\System\GAJnzgj.exe
  C:\Windows\System\GAJnzgj.exe
  2⤵
  PID:1872
- C:\Windows\System\YRkoqve.exe
  C:\Windows\System\YRkoqve.exe
  2⤵
  PID:1016
- C:\Windows\System\AsnneFm.exe
  C:\Windows\System\AsnneFm.exe
  2⤵
  PID:3040
- C:\Windows\System\jnbebCC.exe
  C:\Windows\System\jnbebCC.exe
  2⤵
  PID:1944
- C:\Windows\System\xnWHuBb.exe
  C:\Windows\System\xnWHuBb.exe
  2⤵
  PID:2168
- C:\Windows\System\NNJJxPL.exe
  C:\Windows\System\NNJJxPL.exe
  2⤵
  PID:568
- C:\Windows\System\kQJEBOo.exe
  C:\Windows\System\kQJEBOo.exe
  2⤵
  PID:1704
- C:\Windows\System\PpxxAgJ.exe
  C:\Windows\System\PpxxAgJ.exe
  2⤵
  PID:1520
- C:\Windows\System\tdiGVIe.exe
  C:\Windows\System\tdiGVIe.exe
  2⤵
  PID:2968
- C:\Windows\System\bViUWqd.exe
  C:\Windows\System\bViUWqd.exe
  2⤵
  PID:2564
- C:\Windows\System\ZvSPvFu.exe
  C:\Windows\System\ZvSPvFu.exe
  2⤵
  PID:1600
- C:\Windows\System\jTIoWwA.exe
  C:\Windows\System\jTIoWwA.exe
  2⤵
  PID:2500
- C:\Windows\System\OOCfGPP.exe
  C:\Windows\System\OOCfGPP.exe
  2⤵
  PID:1004
- C:\Windows\System\rrCXall.exe
  C:\Windows\System\rrCXall.exe
  2⤵
  PID:1964
- C:\Windows\System\aKFUjsS.exe
  C:\Windows\System\aKFUjsS.exe
  2⤵
  PID:1732
- C:\Windows\System\XmaumvQ.exe
  C:\Windows\System\XmaumvQ.exe
  2⤵
  PID:528
- C:\Windows\System\nyvFvAK.exe
  C:\Windows\System\nyvFvAK.exe
  2⤵
  PID:3056
- C:\Windows\System\KyewiQK.exe
  C:\Windows\System\KyewiQK.exe
  2⤵
  PID:940
- C:\Windows\System\MzrZaYm.exe
  C:\Windows\System\MzrZaYm.exe
  2⤵
  PID:808
- C:\Windows\System\lnlHbHO.exe
  C:\Windows\System\lnlHbHO.exe
  2⤵
  PID:2400
- C:\Windows\System\sCtwLDp.exe
  C:\Windows\System\sCtwLDp.exe
  2⤵
  PID:2196
- C:\Windows\System\MVZrNfF.exe
  C:\Windows\System\MVZrNfF.exe
  2⤵
  PID:3000
- C:\Windows\System\xguUpxr.exe
  C:\Windows\System\xguUpxr.exe
  2⤵
  PID:2232
- C:\Windows\System\YbguBnv.exe
  C:\Windows\System\YbguBnv.exe
  2⤵
  PID:2544
- C:\Windows\System\NGFBIxM.exe
  C:\Windows\System\NGFBIxM.exe
  2⤵
  PID:2620
- C:\Windows\System\CLjYAHO.exe
  C:\Windows\System\CLjYAHO.exe
  2⤵
  PID:1620
- C:\Windows\System\WuXdlvP.exe
  C:\Windows\System\WuXdlvP.exe
  2⤵
  PID:2504
- C:\Windows\System\zvwZWBz.exe
  C:\Windows\System\zvwZWBz.exe
  2⤵
  PID:1892
- C:\Windows\System\BbcHtUA.exe
  C:\Windows\System\BbcHtUA.exe
  2⤵
  PID:2528
- C:\Windows\System\jZhYVUO.exe
  C:\Windows\System\jZhYVUO.exe
  2⤵
  PID:1452
- C:\Windows\System\wkOVGnW.exe
  C:\Windows\System\wkOVGnW.exe
  2⤵
  PID:1304
- C:\Windows\System\fOhHODr.exe
  C:\Windows\System\fOhHODr.exe
  2⤵
  PID:2520
- C:\Windows\System\cUcTxcn.exe
  C:\Windows\System\cUcTxcn.exe
  2⤵
  PID:872
- C:\Windows\System\dQuIawZ.exe
  C:\Windows\System\dQuIawZ.exe
  2⤵
  PID:1524
- C:\Windows\System\zxiLkTx.exe
  C:\Windows\System\zxiLkTx.exe
  2⤵
  PID:2392
- C:\Windows\System\qWTbeEy.exe
  C:\Windows\System\qWTbeEy.exe
  2⤵
  PID:1096
- C:\Windows\System\dEGysHz.exe
  C:\Windows\System\dEGysHz.exe
  2⤵
  PID:2732
- C:\Windows\System\MBhcQTj.exe
  C:\Windows\System\MBhcQTj.exe
  2⤵
  PID:2768
- C:\Windows\System\uQjSFqS.exe
  C:\Windows\System\uQjSFqS.exe
  2⤵
  PID:2404
- C:\Windows\System\XDYWuzI.exe
  C:\Windows\System\XDYWuzI.exe
  2⤵
  PID:2388
- C:\Windows\System\NPNliHL.exe
  C:\Windows\System\NPNliHL.exe
  2⤵
  PID:860
- C:\Windows\System\pHzTOSm.exe
  C:\Windows\System\pHzTOSm.exe
  2⤵
  PID:2680
- C:\Windows\System\krsNmBy.exe
  C:\Windows\System\krsNmBy.exe
  2⤵
  PID:2556
- C:\Windows\System\ObAyloF.exe
  C:\Windows\System\ObAyloF.exe
  2⤵
  PID:2496
- C:\Windows\System\kPnQUps.exe
  C:\Windows\System\kPnQUps.exe
  2⤵
  PID:840
- C:\Windows\System\VtKDNty.exe
  C:\Windows\System\VtKDNty.exe
  2⤵
  PID:756
- C:\Windows\System\wZyGhTE.exe
  C:\Windows\System\wZyGhTE.exe
  2⤵
  PID:1544
- C:\Windows\System\VgxQAyJ.exe
  C:\Windows\System\VgxQAyJ.exe
  2⤵
  PID:3088
- C:\Windows\System\XelPYAA.exe
  C:\Windows\System\XelPYAA.exe
  2⤵
  PID:3104
- C:\Windows\System\UtymNmi.exe
  C:\Windows\System\UtymNmi.exe
  2⤵
  PID:3148
- C:\Windows\System\BEzjUSZ.exe
  C:\Windows\System\BEzjUSZ.exe
  2⤵
  PID:3164
- C:\Windows\System\pZdBxtx.exe
  C:\Windows\System\pZdBxtx.exe
  2⤵
  PID:3184
- C:\Windows\System\xdCBvwJ.exe
  C:\Windows\System\xdCBvwJ.exe
  2⤵
  PID:3208
- C:\Windows\System\yCCYgJt.exe
  C:\Windows\System\yCCYgJt.exe
  2⤵
  PID:3224
- C:\Windows\System\evJWckp.exe
  C:\Windows\System\evJWckp.exe
  2⤵
  PID:3240
- C:\Windows\System\QKLWUCN.exe
  C:\Windows\System\QKLWUCN.exe
  2⤵
  PID:3256
- C:\Windows\System\LBfzbSk.exe
  C:\Windows\System\LBfzbSk.exe
  2⤵
  PID:3276
- C:\Windows\System\gqxvCgX.exe
  C:\Windows\System\gqxvCgX.exe
  2⤵
  PID:3296
- C:\Windows\System\qSsFzLV.exe
  C:\Windows\System\qSsFzLV.exe
  2⤵
  PID:3312
- C:\Windows\System\ptOfWsx.exe
  C:\Windows\System\ptOfWsx.exe
  2⤵
  PID:3336
- C:\Windows\System\dqnSqdG.exe
  C:\Windows\System\dqnSqdG.exe
  2⤵
  PID:3352
- C:\Windows\System\ciFZBYQ.exe
  C:\Windows\System\ciFZBYQ.exe
  2⤵
  PID:3368
- C:\Windows\System\UBddcQx.exe
  C:\Windows\System\UBddcQx.exe
  2⤵
  PID:3384
- C:\Windows\System\ePjdaUX.exe
  C:\Windows\System\ePjdaUX.exe
  2⤵
  PID:3400
- C:\Windows\System\wgcaQUq.exe
  C:\Windows\System\wgcaQUq.exe
  2⤵
  PID:3444
- C:\Windows\System\WfBmcLL.exe
  C:\Windows\System\WfBmcLL.exe
  2⤵
  PID:3460
- C:\Windows\System\wCpTwGK.exe
  C:\Windows\System\wCpTwGK.exe
  2⤵
  PID:3480
- C:\Windows\System\fOqBuzf.exe
  C:\Windows\System\fOqBuzf.exe
  2⤵
  PID:3508
- C:\Windows\System\CRnDgme.exe
  C:\Windows\System\CRnDgme.exe
  2⤵
  PID:3524
- C:\Windows\System\YVTNTzb.exe
  C:\Windows\System\YVTNTzb.exe
  2⤵
  PID:3544
- C:\Windows\System\tAoskDH.exe
  C:\Windows\System\tAoskDH.exe
  2⤵
  PID:3564
- C:\Windows\System\XRuNBdH.exe
  C:\Windows\System\XRuNBdH.exe
  2⤵
  PID:3584
- C:\Windows\System\uvdamqo.exe
  C:\Windows\System\uvdamqo.exe
  2⤵
  PID:3600
- C:\Windows\System\tamailL.exe
  C:\Windows\System\tamailL.exe
  2⤵
  PID:3616
- C:\Windows\System\uJpjPij.exe
  C:\Windows\System\uJpjPij.exe
  2⤵
  PID:3632
- C:\Windows\System\mOaWJov.exe
  C:\Windows\System\mOaWJov.exe
  2⤵
  PID:3648
- C:\Windows\System\drPwqHu.exe
  C:\Windows\System\drPwqHu.exe
  2⤵
  PID:3664
- C:\Windows\System\PrZaNBZ.exe
  C:\Windows\System\PrZaNBZ.exe
  2⤵
  PID:3680
- C:\Windows\System\HIJEuvJ.exe
  C:\Windows\System\HIJEuvJ.exe
  2⤵
  PID:3704
- C:\Windows\System\qZmjQAL.exe
  C:\Windows\System\qZmjQAL.exe
  2⤵
  PID:3724
- C:\Windows\System\ywvCKbI.exe
  C:\Windows\System\ywvCKbI.exe
  2⤵
  PID:3740
- C:\Windows\System\oNoaAGa.exe
  C:\Windows\System\oNoaAGa.exe
  2⤵
  PID:3756
- C:\Windows\System\jPYqSng.exe
  C:\Windows\System\jPYqSng.exe
  2⤵
  PID:3772
- C:\Windows\System\KOWhutn.exe
  C:\Windows\System\KOWhutn.exe
  2⤵
  PID:3788
- C:\Windows\System\YqOreHC.exe
  C:\Windows\System\YqOreHC.exe
  2⤵
  PID:3804
- C:\Windows\System\yRDWAMj.exe
  C:\Windows\System\yRDWAMj.exe
  2⤵
  PID:3820
- C:\Windows\System\ENzFXSF.exe
  C:\Windows\System\ENzFXSF.exe
  2⤵
  PID:3836
- C:\Windows\System\JlLHeCy.exe
  C:\Windows\System\JlLHeCy.exe
  2⤵
  PID:3884
- C:\Windows\System\aswtbdQ.exe
  C:\Windows\System\aswtbdQ.exe
  2⤵
  PID:3916
- C:\Windows\System\izmossd.exe
  C:\Windows\System\izmossd.exe
  2⤵
  PID:3956
- C:\Windows\System\EOXLETr.exe
  C:\Windows\System\EOXLETr.exe
  2⤵
  PID:3972
- C:\Windows\System\iEzdJFK.exe
  C:\Windows\System\iEzdJFK.exe
  2⤵
  PID:3996
- C:\Windows\System\imkmOzH.exe
  C:\Windows\System\imkmOzH.exe
  2⤵
  PID:4020
- C:\Windows\System\KmjADSs.exe
  C:\Windows\System\KmjADSs.exe
  2⤵
  PID:4036
- C:\Windows\System\bkMuDwW.exe
  C:\Windows\System\bkMuDwW.exe
  2⤵
  PID:4052
- C:\Windows\System\oaGbgdy.exe
  C:\Windows\System\oaGbgdy.exe
  2⤵
  PID:4068
- C:\Windows\System\djnXeIO.exe
  C:\Windows\System\djnXeIO.exe
  2⤵
  PID:4088
- C:\Windows\System\vaYANFw.exe
  C:\Windows\System\vaYANFw.exe
  2⤵
  PID:2120
- C:\Windows\System\swRvEac.exe
  C:\Windows\System\swRvEac.exe
  2⤵
  PID:1560
- C:\Windows\System\eCruLrB.exe
  C:\Windows\System\eCruLrB.exe
  2⤵
  PID:3080
- C:\Windows\System\iWFtOFQ.exe
  C:\Windows\System\iWFtOFQ.exe
  2⤵
  PID:1824
- C:\Windows\System\qQLEWbH.exe
  C:\Windows\System\qQLEWbH.exe
  2⤵
  PID:1624
- C:\Windows\System\ccWxlwa.exe
  C:\Windows\System\ccWxlwa.exe
  2⤵
  PID:3112
- C:\Windows\System\xZLCpKF.exe
  C:\Windows\System\xZLCpKF.exe
  2⤵
  PID:3144
- C:\Windows\System\wZeUhvH.exe
  C:\Windows\System\wZeUhvH.exe
  2⤵
  PID:3216
- C:\Windows\System\JWtyFBw.exe
  C:\Windows\System\JWtyFBw.exe
  2⤵
  PID:3248
- C:\Windows\System\gDOaKZr.exe
  C:\Windows\System\gDOaKZr.exe
  2⤵
  PID:3292
- C:\Windows\System\EIVlFMp.exe
  C:\Windows\System\EIVlFMp.exe
  2⤵
  PID:3328
- C:\Windows\System\llzxTpB.exe
  C:\Windows\System\llzxTpB.exe
  2⤵
  PID:3196
- C:\Windows\System\OtOJjLV.exe
  C:\Windows\System\OtOJjLV.exe
  2⤵
  PID:1596
- C:\Windows\System\HVhnXVS.exe
  C:\Windows\System\HVhnXVS.exe
  2⤵
  PID:3232
- C:\Windows\System\VTlzQgy.exe
  C:\Windows\System\VTlzQgy.exe
  2⤵
  PID:3348
- C:\Windows\System\IPlNjrm.exe
  C:\Windows\System\IPlNjrm.exe
  2⤵
  PID:3308
- C:\Windows\System\WEVHsEM.exe
  C:\Windows\System\WEVHsEM.exe
  2⤵
  PID:3428
- C:\Windows\System\ygGsiTK.exe
  C:\Windows\System\ygGsiTK.exe
  2⤵
  PID:952
- C:\Windows\System\LNriCgc.exe
  C:\Windows\System\LNriCgc.exe
  2⤵
  PID:3608
- C:\Windows\System\BiIufVk.exe
  C:\Windows\System\BiIufVk.exe
  2⤵
  PID:3672
- C:\Windows\System\zlfcLCn.exe
  C:\Windows\System\zlfcLCn.exe
  2⤵
  PID:3716
- C:\Windows\System\gUuFrTl.exe
  C:\Windows\System\gUuFrTl.exe
  2⤵
  PID:1184
- C:\Windows\System\IpEooIj.exe
  C:\Windows\System\IpEooIj.exe
  2⤵
  PID:3784
- C:\Windows\System\AQImFQe.exe
  C:\Windows\System\AQImFQe.exe
  2⤵
  PID:3556
- C:\Windows\System\mPmDRYG.exe
  C:\Windows\System\mPmDRYG.exe
  2⤵
  PID:2004
- C:\Windows\System\PdQPujJ.exe
  C:\Windows\System\PdQPujJ.exe
  2⤵
  PID:3516
- C:\Windows\System\PMQvJnV.exe
  C:\Windows\System\PMQvJnV.exe
  2⤵
  PID:3876
- C:\Windows\System\cyhJCSM.exe
  C:\Windows\System\cyhJCSM.exe
  2⤵
  PID:2868
- C:\Windows\System\pApwwIw.exe
  C:\Windows\System\pApwwIw.exe
  2⤵
  PID:3764
- C:\Windows\System\NHrOPYp.exe
  C:\Windows\System\NHrOPYp.exe
  2⤵
  PID:3800
- C:\Windows\System\buoVQzg.exe
  C:\Windows\System\buoVQzg.exe
  2⤵
  PID:3696
- C:\Windows\System\ctfagAW.exe
  C:\Windows\System\ctfagAW.exe
  2⤵
  PID:3924
- C:\Windows\System\DFoVMAP.exe
  C:\Windows\System\DFoVMAP.exe
  2⤵
  PID:3940
- C:\Windows\System\WelmxSz.exe
  C:\Windows\System\WelmxSz.exe
  2⤵
  PID:3980
- C:\Windows\System\RbQatIx.exe
  C:\Windows\System\RbQatIx.exe
  2⤵
  PID:3984
- C:\Windows\System\bPWhXFo.exe
  C:\Windows\System\bPWhXFo.exe
  2⤵
  PID:632
- C:\Windows\System\SednVfU.exe
  C:\Windows\System\SednVfU.exe
  2⤵
  PID:4032
- C:\Windows\System\vUBJtRE.exe
  C:\Windows\System\vUBJtRE.exe
  2⤵
  PID:2784
- C:\Windows\System\OgwufTM.exe
  C:\Windows\System\OgwufTM.exe
  2⤵
  PID:3124
- C:\Windows\System\qOkQXTa.exe
  C:\Windows\System\qOkQXTa.exe
  2⤵
  PID:4004
- C:\Windows\System\efriUuZ.exe
  C:\Windows\System\efriUuZ.exe
  2⤵
  PID:4044
- C:\Windows\System\iIsdPmi.exe
  C:\Windows\System\iIsdPmi.exe
  2⤵
  PID:3192
- C:\Windows\System\XqaKwss.exe
  C:\Windows\System\XqaKwss.exe
  2⤵
  PID:3160
- C:\Windows\System\UvSBFBb.exe
  C:\Windows\System\UvSBFBb.exe
  2⤵
  PID:2772
- C:\Windows\System\gIGYpVm.exe
  C:\Windows\System\gIGYpVm.exe
  2⤵
  PID:2740
- C:\Windows\System\IWThwIT.exe
  C:\Windows\System\IWThwIT.exe
  2⤵
  PID:3100
- C:\Windows\System\iXqcAeK.exe
  C:\Windows\System\iXqcAeK.exe
  2⤵
  PID:3180
- C:\Windows\System\eArAqWn.exe
  C:\Windows\System\eArAqWn.exe
  2⤵
  PID:3364
- C:\Windows\System\yAkVsou.exe
  C:\Windows\System\yAkVsou.exe
  2⤵
  PID:3420
- C:\Windows\System\lgQqlWo.exe
  C:\Windows\System\lgQqlWo.exe
  2⤵
  PID:3504
- C:\Windows\System\xmptWZl.exe
  C:\Windows\System\xmptWZl.exe
  2⤵
  PID:3580
- C:\Windows\System\MHMyzum.exe
  C:\Windows\System\MHMyzum.exe
  2⤵
  PID:2916
- C:\Windows\System\PWbgINm.exe
  C:\Windows\System\PWbgINm.exe
  2⤵
  PID:3752
- C:\Windows\System\jlkeIKm.exe
  C:\Windows\System\jlkeIKm.exe
  2⤵
  PID:3868
- C:\Windows\System\Tabslro.exe
  C:\Windows\System\Tabslro.exe
  2⤵
  PID:3832
- C:\Windows\System\xRbzLIB.exe
  C:\Windows\System\xRbzLIB.exe
  2⤵
  PID:3732
- C:\Windows\System\uCddjYA.exe
  C:\Windows\System\uCddjYA.exe
  2⤵
  PID:3816
- C:\Windows\System\Ynuzwik.exe
  C:\Windows\System\Ynuzwik.exe
  2⤵
  PID:3536
- C:\Windows\System\faofXAa.exe
  C:\Windows\System\faofXAa.exe
  2⤵
  PID:3796
- C:\Windows\System\bswwpvN.exe
  C:\Windows\System\bswwpvN.exe
  2⤵
  PID:3936
- C:\Windows\System\socCkwY.exe
  C:\Windows\System\socCkwY.exe
  2⤵
  PID:1440
- C:\Windows\System\GMkoVHx.exe
  C:\Windows\System\GMkoVHx.exe
  2⤵
  PID:3948
- C:\Windows\System\NOblwkV.exe
  C:\Windows\System\NOblwkV.exe
  2⤵
  PID:2152
- C:\Windows\System\wzdFasS.exe
  C:\Windows\System\wzdFasS.exe
  2⤵
  PID:4076
- C:\Windows\System\EAjxKrZ.exe
  C:\Windows\System\EAjxKrZ.exe
  2⤵
  PID:2780
- C:\Windows\System\DIYaPIY.exe
  C:\Windows\System\DIYaPIY.exe
  2⤵
  PID:3968
- C:\Windows\System\tkKfIKy.exe
  C:\Windows\System\tkKfIKy.exe
  2⤵
  PID:1336
- C:\Windows\System\ksoQPlA.exe
  C:\Windows\System\ksoQPlA.exe
  2⤵
  PID:1568
- C:\Windows\System\bbcsBji.exe
  C:\Windows\System\bbcsBji.exe
  2⤵
  PID:3288
- C:\Windows\System\KEjQvaZ.exe
  C:\Windows\System\KEjQvaZ.exe
  2⤵
  PID:3500
- C:\Windows\System\LCsffga.exe
  C:\Windows\System\LCsffga.exe
  2⤵
  PID:3272
- C:\Windows\System\AlSBoKd.exe
  C:\Windows\System\AlSBoKd.exe
  2⤵
  PID:3424
- C:\Windows\System\xplGKAe.exe
  C:\Windows\System\xplGKAe.exe
  2⤵
  PID:3700
- C:\Windows\System\HVMeHJq.exe
  C:\Windows\System\HVMeHJq.exe
  2⤵
  PID:2320
- C:\Windows\System\AHhuAwu.exe
  C:\Windows\System\AHhuAwu.exe
  2⤵
  PID:3476
- C:\Windows\System\OjojNpa.exe
  C:\Windows\System\OjojNpa.exe
  2⤵
  PID:2948
- C:\Windows\System\BXFGUhg.exe
  C:\Windows\System\BXFGUhg.exe
  2⤵
  PID:2828
- C:\Windows\System\eFaLscE.exe
  C:\Windows\System\eFaLscE.exe
  2⤵
  PID:3436
- C:\Windows\System\tuqHhCu.exe
  C:\Windows\System\tuqHhCu.exe
  2⤵
  PID:3932
- C:\Windows\System\QmswXSW.exe
  C:\Windows\System\QmswXSW.exe
  2⤵
  PID:3096
- C:\Windows\System\RayQtMh.exe
  C:\Windows\System\RayQtMh.exe
  2⤵
  PID:1352
- C:\Windows\System\sqUHMMU.exe
  C:\Windows\System\sqUHMMU.exe
  2⤵
  PID:3492
- C:\Windows\System\giwSQiB.exe
  C:\Windows\System\giwSQiB.exe
  2⤵
  PID:3852
- C:\Windows\System\pmygFlV.exe
  C:\Windows\System\pmygFlV.exe
  2⤵
  PID:4012
- C:\Windows\System\CdbTqqu.exe
  C:\Windows\System\CdbTqqu.exe
  2⤵
  PID:3624
- C:\Windows\System\rlAgRvk.exe
  C:\Windows\System\rlAgRvk.exe
  2⤵
  PID:2848
- C:\Windows\System\TYjGWYE.exe
  C:\Windows\System\TYjGWYE.exe
  2⤵
  PID:888
- C:\Windows\System\FuUICNa.exe
  C:\Windows\System\FuUICNa.exe
  2⤵
  PID:4028
- C:\Windows\System\YsfIyiP.exe
  C:\Windows\System\YsfIyiP.exe
  2⤵
  PID:3644
- C:\Windows\System\uxOlpWr.exe
  C:\Windows\System\uxOlpWr.exe
  2⤵
  PID:1784
- C:\Windows\System\XJhTnut.exe
  C:\Windows\System\XJhTnut.exe
  2⤵
  PID:3360
- C:\Windows\System\AiVoMhC.exe
  C:\Windows\System\AiVoMhC.exe
  2⤵
  PID:3656
- C:\Windows\System\XrsKgDy.exe
  C:\Windows\System\XrsKgDy.exe
  2⤵
  PID:1900
- C:\Windows\System\vchcsCv.exe
  C:\Windows\System\vchcsCv.exe
  2⤵
  PID:3488
- C:\Windows\System\USyBJTs.exe
  C:\Windows\System\USyBJTs.exe
  2⤵
  PID:2588
- C:\Windows\System\OYxyRcP.exe
  C:\Windows\System\OYxyRcP.exe
  2⤵
  PID:3200
- C:\Windows\System\djTUDDO.exe
  C:\Windows\System\djTUDDO.exe
  2⤵
  PID:3952
- C:\Windows\System\CHlIjjW.exe
  C:\Windows\System\CHlIjjW.exe
  2⤵
  PID:1512
- C:\Windows\System\FyIvscc.exe
  C:\Windows\System\FyIvscc.exe
  2⤵
  PID:2332
- C:\Windows\System\Fcujtuy.exe
  C:\Windows\System\Fcujtuy.exe
  2⤵
  PID:3856
- C:\Windows\System\ukdbMuv.exe
  C:\Windows\System\ukdbMuv.exe
  2⤵
  PID:4108
- C:\Windows\System\hUeSYgR.exe
  C:\Windows\System\hUeSYgR.exe
  2⤵
  PID:4132
- C:\Windows\System\uzrnkYJ.exe
  C:\Windows\System\uzrnkYJ.exe
  2⤵
  PID:4152
- C:\Windows\System\TSlotQW.exe
  C:\Windows\System\TSlotQW.exe
  2⤵
  PID:4168
- C:\Windows\System\MwhWMoq.exe
  C:\Windows\System\MwhWMoq.exe
  2⤵
  PID:4184
- C:\Windows\System\rEtmomB.exe
  C:\Windows\System\rEtmomB.exe
  2⤵
  PID:4200
- C:\Windows\System\GfyFIol.exe
  C:\Windows\System\GfyFIol.exe
  2⤵
  PID:4216
- C:\Windows\System\rTaIeZc.exe
  C:\Windows\System\rTaIeZc.exe
  2⤵
  PID:4236
- C:\Windows\System\QuDsRtg.exe
  C:\Windows\System\QuDsRtg.exe
  2⤵
  PID:4256
- C:\Windows\System\Wceasyo.exe
  C:\Windows\System\Wceasyo.exe
  2⤵
  PID:4272
- C:\Windows\System\GivCSBA.exe
  C:\Windows\System\GivCSBA.exe
  2⤵
  PID:4288
- C:\Windows\System\hVZJKcb.exe
  C:\Windows\System\hVZJKcb.exe
  2⤵
  PID:4304
- C:\Windows\System\RbJwOtt.exe
  C:\Windows\System\RbJwOtt.exe
  2⤵
  PID:4320
- C:\Windows\System\RqwBZAc.exe
  C:\Windows\System\RqwBZAc.exe
  2⤵
  PID:4336
- C:\Windows\System\XIzgliR.exe
  C:\Windows\System\XIzgliR.exe
  2⤵
  PID:4352
- C:\Windows\System\ZLrqCWl.exe
  C:\Windows\System\ZLrqCWl.exe
  2⤵
  PID:4368
- C:\Windows\System\xOSYHxm.exe
  C:\Windows\System\xOSYHxm.exe
  2⤵
  PID:4384
- C:\Windows\System\OyTPLze.exe
  C:\Windows\System\OyTPLze.exe
  2⤵
  PID:4400
- C:\Windows\System\dPknvyg.exe
  C:\Windows\System\dPknvyg.exe
  2⤵
  PID:4416
- C:\Windows\System\SLMVKnT.exe
  C:\Windows\System\SLMVKnT.exe
  2⤵
  PID:4440
- C:\Windows\System\SpNSTNh.exe
  C:\Windows\System\SpNSTNh.exe
  2⤵
  PID:4456
- C:\Windows\System\mCdxTZr.exe
  C:\Windows\System\mCdxTZr.exe
  2⤵
  PID:4476
- C:\Windows\System\TGhfCKK.exe
  C:\Windows\System\TGhfCKK.exe
  2⤵
  PID:4496
- C:\Windows\System\xuigixj.exe
  C:\Windows\System\xuigixj.exe
  2⤵
  PID:4516
- C:\Windows\System\fsVTqeY.exe
  C:\Windows\System\fsVTqeY.exe
  2⤵
  PID:4532
- C:\Windows\System\CMRWFEv.exe
  C:\Windows\System\CMRWFEv.exe
  2⤵
  PID:4552
- C:\Windows\System\SRaLVRK.exe
  C:\Windows\System\SRaLVRK.exe
  2⤵
  PID:4568
- C:\Windows\System\eRHubnk.exe
  C:\Windows\System\eRHubnk.exe
  2⤵
  PID:4584
- C:\Windows\System\OdIPCvW.exe
  C:\Windows\System\OdIPCvW.exe
  2⤵
  PID:4696
- C:\Windows\System\ICtTnap.exe
  C:\Windows\System\ICtTnap.exe
  2⤵
  PID:4712
- C:\Windows\System\esBnJYr.exe
  C:\Windows\System\esBnJYr.exe
  2⤵
  PID:4728
- C:\Windows\System\xRYJlfj.exe
  C:\Windows\System\xRYJlfj.exe
  2⤵
  PID:4744
- C:\Windows\System\qZsafSV.exe
  C:\Windows\System\qZsafSV.exe
  2⤵
  PID:4760
- C:\Windows\System\QTVQPLv.exe
  C:\Windows\System\QTVQPLv.exe
  2⤵
  PID:4776
- C:\Windows\System\BHRxjXR.exe
  C:\Windows\System\BHRxjXR.exe
  2⤵
  PID:4796
- C:\Windows\System\bmdRUpX.exe
  C:\Windows\System\bmdRUpX.exe
  2⤵
  PID:4816
- C:\Windows\System\tgeSRWy.exe
  C:\Windows\System\tgeSRWy.exe
  2⤵
  PID:4836
- C:\Windows\System\bVVMDZO.exe
  C:\Windows\System\bVVMDZO.exe
  2⤵
  PID:4856
- C:\Windows\System\eLFbcbI.exe
  C:\Windows\System\eLFbcbI.exe
  2⤵
  PID:4876
- C:\Windows\System\XlbqEsH.exe
  C:\Windows\System\XlbqEsH.exe
  2⤵
  PID:4896
- C:\Windows\System\uuoSiuR.exe
  C:\Windows\System\uuoSiuR.exe
  2⤵
  PID:4912
- C:\Windows\System\WQLZblN.exe
  C:\Windows\System\WQLZblN.exe
  2⤵
  PID:4928
- C:\Windows\System\VskrwLG.exe
  C:\Windows\System\VskrwLG.exe
  2⤵
  PID:4944
- C:\Windows\System\uWCbnon.exe
  C:\Windows\System\uWCbnon.exe
  2⤵
  PID:4960
- C:\Windows\System\MtfukNu.exe
  C:\Windows\System\MtfukNu.exe
  2⤵
  PID:4992
- C:\Windows\System\tRlhSMv.exe
  C:\Windows\System\tRlhSMv.exe
  2⤵
  PID:5012
- C:\Windows\System\uNswdgX.exe
  C:\Windows\System\uNswdgX.exe
  2⤵
  PID:5032
- C:\Windows\System\CaOqlqy.exe
  C:\Windows\System\CaOqlqy.exe
  2⤵
  PID:5052
- C:\Windows\System\wbSlqCD.exe
  C:\Windows\System\wbSlqCD.exe
  2⤵
  PID:5076
- C:\Windows\System\LpssBxi.exe
  C:\Windows\System\LpssBxi.exe
  2⤵
  PID:5096
- C:\Windows\System\DTvwnFF.exe
  C:\Windows\System\DTvwnFF.exe
  2⤵
  PID:5112
- C:\Windows\System\HRjtTaK.exe
  C:\Windows\System\HRjtTaK.exe
  2⤵
  PID:3136
- C:\Windows\System\yAWqiGN.exe
  C:\Windows\System\yAWqiGN.exe
  2⤵
  PID:4140
- C:\Windows\System\jzYVBtb.exe
  C:\Windows\System\jzYVBtb.exe
  2⤵
  PID:4180
- C:\Windows\System\KURFeMK.exe
  C:\Windows\System\KURFeMK.exe
  2⤵
  PID:4252
- C:\Windows\System\DuRksOz.exe
  C:\Windows\System\DuRksOz.exe
  2⤵
  PID:4488
- C:\Windows\System\ggKCjjZ.exe
  C:\Windows\System\ggKCjjZ.exe
  2⤵
  PID:4376
- C:\Windows\System\QypnYdc.exe
  C:\Windows\System\QypnYdc.exe
  2⤵
  PID:4452
- C:\Windows\System\hNKJsJP.exe
  C:\Windows\System\hNKJsJP.exe
  2⤵
  PID:4564
- C:\Windows\System\DtGEyTN.exe
  C:\Windows\System\DtGEyTN.exe
  2⤵
  PID:4608
- C:\Windows\System\jcYYTQg.exe
  C:\Windows\System\jcYYTQg.exe
  2⤵
  PID:3456
- C:\Windows\System\QiARVjh.exe
  C:\Windows\System\QiARVjh.exe
  2⤵
  PID:4128
- C:\Windows\System\HegiUoM.exe
  C:\Windows\System\HegiUoM.exe
  2⤵
  PID:4232
- C:\Windows\System\ClnREUa.exe
  C:\Windows\System\ClnREUa.exe
  2⤵
  PID:4620
- C:\Windows\System\klhjeJv.exe
  C:\Windows\System\klhjeJv.exe
  2⤵
  PID:4636
- C:\Windows\System\zXhgpSA.exe
  C:\Windows\System\zXhgpSA.exe
  2⤵
  PID:4656
- C:\Windows\System\umHlPBU.exe
  C:\Windows\System\umHlPBU.exe
  2⤵
  PID:3768
- C:\Windows\System\TBOcWdn.exe
  C:\Windows\System\TBOcWdn.exe
  2⤵
  PID:4160
- C:\Windows\System\GVAfeFa.exe
  C:\Windows\System\GVAfeFa.exe
  2⤵
  PID:4664
- C:\Windows\System\jbCqNON.exe
  C:\Windows\System\jbCqNON.exe
  2⤵
  PID:4684
- C:\Windows\System\zetbwfk.exe
  C:\Windows\System\zetbwfk.exe
  2⤵
  PID:4756
- C:\Windows\System\TWvjEyn.exe
  C:\Windows\System\TWvjEyn.exe
  2⤵
  PID:4832
- C:\Windows\System\Serfooj.exe
  C:\Windows\System\Serfooj.exe
  2⤵
  PID:4332
- C:\Windows\System\fRVwqdJ.exe
  C:\Windows\System\fRVwqdJ.exe
  2⤵
  PID:4436
- C:\Windows\System\XoahzDl.exe
  C:\Windows\System\XoahzDl.exe
  2⤵
  PID:4468
- C:\Windows\System\GJjlqqE.exe
  C:\Windows\System\GJjlqqE.exe
  2⤵
  PID:4704
- C:\Windows\System\oFLVCPr.exe
  C:\Windows\System\oFLVCPr.exe
  2⤵
  PID:4904
- C:\Windows\System\iPnedqu.exe
  C:\Windows\System\iPnedqu.exe
  2⤵
  PID:4976
- C:\Windows\System\CYlOcmV.exe
  C:\Windows\System\CYlOcmV.exe
  2⤵
  PID:4804
- C:\Windows\System\NDzzIQs.exe
  C:\Windows\System\NDzzIQs.exe
  2⤵
  PID:5060
- C:\Windows\System\CSpXnVT.exe
  C:\Windows\System\CSpXnVT.exe
  2⤵
  PID:5072
- C:\Windows\System\pCDxApi.exe
  C:\Windows\System\pCDxApi.exe
  2⤵
  PID:5108
- C:\Windows\System\rITWeGh.exe
  C:\Windows\System\rITWeGh.exe
  2⤵
  PID:1508
- C:\Windows\System\SbdhSyz.exe
  C:\Windows\System\SbdhSyz.exe
  2⤵
  PID:4524
- C:\Windows\System\mfXIWnO.exe
  C:\Windows\System\mfXIWnO.exe
  2⤵
  PID:4528
- C:\Windows\System\Sfmbnov.exe
  C:\Windows\System\Sfmbnov.exe
  2⤵
  PID:4812
- C:\Windows\System\FMdDoEI.exe
  C:\Windows\System\FMdDoEI.exe
  2⤵
  PID:4628
- C:\Windows\System\Wrqkplz.exe
  C:\Windows\System\Wrqkplz.exe
  2⤵
  PID:4580
- C:\Windows\System\pShSAfh.exe
  C:\Windows\System\pShSAfh.exe
  2⤵
  PID:4668
- C:\Windows\System\NHQdIeM.exe
  C:\Windows\System\NHQdIeM.exe
  2⤵
  PID:4872
- C:\Windows\System\AkGapsf.exe
  C:\Windows\System\AkGapsf.exe
  2⤵
  PID:4424
- C:\Windows\System\pBLtEqy.exe
  C:\Windows\System\pBLtEqy.exe
  2⤵
  PID:4956
- C:\Windows\System\ACBdcZy.exe
  C:\Windows\System\ACBdcZy.exe
  2⤵
  PID:5004
- C:\Windows\System\zuizrgP.exe
  C:\Windows\System\zuizrgP.exe
  2⤵
  PID:4348
- C:\Windows\System\lFSNLmW.exe
  C:\Windows\System\lFSNLmW.exe
  2⤵
  PID:4316
- C:\Windows\System\LpqBCWp.exe
  C:\Windows\System\LpqBCWp.exe
  2⤵
  PID:4408
- C:\Windows\System\scoyWdt.exe
  C:\Windows\System\scoyWdt.exe
  2⤵
  PID:4604
- C:\Windows\System\nCwcetQ.exe
  C:\Windows\System\nCwcetQ.exe
  2⤵
  PID:4428
- C:\Windows\System\zkILFnM.exe
  C:\Windows\System\zkILFnM.exe
  2⤵
  PID:4508
- C:\Windows\System\shQkggf.exe
  C:\Windows\System\shQkggf.exe
  2⤵
  PID:4940
- C:\Windows\System\xCvsitV.exe
  C:\Windows\System\xCvsitV.exe
  2⤵
  PID:1552
- C:\Windows\System\OSKFQxL.exe
  C:\Windows\System\OSKFQxL.exe
  2⤵
  PID:4808
- C:\Windows\System\GFbGoqo.exe
  C:\Windows\System\GFbGoqo.exe
  2⤵
  PID:5104
- C:\Windows\System\pmWpSgK.exe
  C:\Windows\System\pmWpSgK.exe
  2⤵
  PID:4284
- C:\Windows\System\xrVkMvW.exe
  C:\Windows\System\xrVkMvW.exe
  2⤵
  PID:5040
- C:\Windows\System\VrNTUHp.exe
  C:\Windows\System\VrNTUHp.exe
  2⤵
  PID:4736
- C:\Windows\System\KOzoqVg.exe
  C:\Windows\System\KOzoqVg.exe
  2⤵
  PID:4448
- C:\Windows\System\JUgciio.exe
  C:\Windows\System\JUgciio.exe
  2⤵
  PID:5044
- C:\Windows\System\KnKglod.exe
  C:\Windows\System\KnKglod.exe
  2⤵
  PID:4392
- C:\Windows\System\gadxrzQ.exe
  C:\Windows\System\gadxrzQ.exe
  2⤵
  PID:4512
- C:\Windows\System\PtzdbiG.exe
  C:\Windows\System\PtzdbiG.exe
  2⤵
  PID:4968
- C:\Windows\System\PuXdLYy.exe
  C:\Windows\System\PuXdLYy.exe
  2⤵
  PID:4176
- C:\Windows\System\UnsldmU.exe
  C:\Windows\System\UnsldmU.exe
  2⤵
  PID:4312
- C:\Windows\System\msokHQr.exe
  C:\Windows\System\msokHQr.exe
  2⤵
  PID:4648
- C:\Windows\System\HioIRYg.exe
  C:\Windows\System\HioIRYg.exe
  2⤵
  PID:5132
- C:\Windows\System\zJpshjI.exe
  C:\Windows\System\zJpshjI.exe
  2⤵
  PID:5204
- C:\Windows\System\IMmcAQl.exe
  C:\Windows\System\IMmcAQl.exe
  2⤵
  PID:5220
- C:\Windows\System\bOpnBzD.exe
  C:\Windows\System\bOpnBzD.exe
  2⤵
  PID:5236
- C:\Windows\System\fIIFRep.exe
  C:\Windows\System\fIIFRep.exe
  2⤵
  PID:5256
- C:\Windows\System\SBnQaZb.exe
  C:\Windows\System\SBnQaZb.exe
  2⤵
  PID:5272
- C:\Windows\System\iyUVXVR.exe
  C:\Windows\System\iyUVXVR.exe
  2⤵
  PID:5304
- C:\Windows\System\KnqStup.exe
  C:\Windows\System\KnqStup.exe
  2⤵
  PID:5324
- C:\Windows\System\GXqStAO.exe
  C:\Windows\System\GXqStAO.exe
  2⤵
  PID:5340
- C:\Windows\System\JMWFCZY.exe
  C:\Windows\System\JMWFCZY.exe
  2⤵
  PID:5356
- C:\Windows\System\NBuBCWS.exe
  C:\Windows\System\NBuBCWS.exe
  2⤵
  PID:5376
- C:\Windows\System\VyawDue.exe
  C:\Windows\System\VyawDue.exe
  2⤵
  PID:5392
- C:\Windows\System\fUHYvUN.exe
  C:\Windows\System\fUHYvUN.exe
  2⤵
  PID:5412
- C:\Windows\System\wZZVOAy.exe
  C:\Windows\System\wZZVOAy.exe
  2⤵
  PID:5432
- C:\Windows\System\oHQpZAk.exe
  C:\Windows\System\oHQpZAk.exe
  2⤵
  PID:5448
- C:\Windows\System\eBEHNVn.exe
  C:\Windows\System\eBEHNVn.exe
  2⤵
  PID:5464
- C:\Windows\System\WtcrMJK.exe
  C:\Windows\System\WtcrMJK.exe
  2⤵
  PID:5480
- C:\Windows\System\NNWWQSp.exe
  C:\Windows\System\NNWWQSp.exe
  2⤵
  PID:5496
- C:\Windows\System\oJIMmKJ.exe
  C:\Windows\System\oJIMmKJ.exe
  2⤵
  PID:5516
- C:\Windows\System\JTJcBlb.exe
  C:\Windows\System\JTJcBlb.exe
  2⤵
  PID:5536
- C:\Windows\System\GLnXgSw.exe
  C:\Windows\System\GLnXgSw.exe
  2⤵
  PID:5552
- C:\Windows\System\uulOdhC.exe
  C:\Windows\System\uulOdhC.exe
  2⤵
  PID:5568
- C:\Windows\System\DouREDn.exe
  C:\Windows\System\DouREDn.exe
  2⤵
  PID:5588
- C:\Windows\System\RSPDaDQ.exe
  C:\Windows\System\RSPDaDQ.exe
  2⤵
  PID:5608
- C:\Windows\System\jhaURJJ.exe
  C:\Windows\System\jhaURJJ.exe
  2⤵
  PID:5624
- C:\Windows\System\ROosFsT.exe
  C:\Windows\System\ROosFsT.exe
  2⤵
  PID:5644
- C:\Windows\System\bGbBwTs.exe
  C:\Windows\System\bGbBwTs.exe
  2⤵
  PID:5660
- C:\Windows\System\itNCdEh.exe
  C:\Windows\System\itNCdEh.exe
  2⤵
  PID:5684
- C:\Windows\System\AJCeIJn.exe
  C:\Windows\System\AJCeIJn.exe
  2⤵
  PID:5700
- C:\Windows\System\uiwlnXJ.exe
  C:\Windows\System\uiwlnXJ.exe
  2⤵
  PID:5732
- C:\Windows\System\tcilycp.exe
  C:\Windows\System\tcilycp.exe
  2⤵
  PID:5752
- C:\Windows\System\ltksnCk.exe
  C:\Windows\System\ltksnCk.exe
  2⤵
  PID:5780
- C:\Windows\System\RQGWAAs.exe
  C:\Windows\System\RQGWAAs.exe
  2⤵
  PID:5824
- C:\Windows\System\bUMPScD.exe
  C:\Windows\System\bUMPScD.exe
  2⤵
  PID:5840
- C:\Windows\System\ahVPfUq.exe
  C:\Windows\System\ahVPfUq.exe
  2⤵
  PID:5856
- C:\Windows\System\FFGmyuX.exe
  C:\Windows\System\FFGmyuX.exe
  2⤵
  PID:5872
- C:\Windows\System\EXwxTGX.exe
  C:\Windows\System\EXwxTGX.exe
  2⤵
  PID:5892
- C:\Windows\System\PYWpPKb.exe
  C:\Windows\System\PYWpPKb.exe
  2⤵
  PID:5912
- C:\Windows\System\dFrlenE.exe
  C:\Windows\System\dFrlenE.exe
  2⤵
  PID:5928
- C:\Windows\System\ldnNwmY.exe
  C:\Windows\System\ldnNwmY.exe
  2⤵
  PID:5948
- C:\Windows\System\pjDWvgH.exe
  C:\Windows\System\pjDWvgH.exe
  2⤵
  PID:5964
- C:\Windows\System\KqjARhO.exe
  C:\Windows\System\KqjARhO.exe
  2⤵
  PID:5984
- C:\Windows\System\WbYIvMJ.exe
  C:\Windows\System\WbYIvMJ.exe
  2⤵
  PID:6000
- C:\Windows\System\tDFFjqi.exe
  C:\Windows\System\tDFFjqi.exe
  2⤵
  PID:6016
- C:\Windows\System\PfbChPO.exe
  C:\Windows\System\PfbChPO.exe
  2⤵
  PID:6032
- C:\Windows\System\ZBVjNPq.exe
  C:\Windows\System\ZBVjNPq.exe
  2⤵
  PID:6084
- C:\Windows\System\vVSWkXq.exe
  C:\Windows\System\vVSWkXq.exe
  2⤵
  PID:6100
- C:\Windows\System\tUQlHxN.exe
  C:\Windows\System\tUQlHxN.exe
  2⤵
  PID:6116
- C:\Windows\System\hwUiJhq.exe
  C:\Windows\System\hwUiJhq.exe
  2⤵
  PID:6140
- C:\Windows\System\rqNdvSj.exe
  C:\Windows\System\rqNdvSj.exe
  2⤵
  PID:5128
- C:\Windows\System\pESBiJU.exe
  C:\Windows\System\pESBiJU.exe
  2⤵
  PID:4148
- C:\Windows\System\PRtwJYR.exe
  C:\Windows\System\PRtwJYR.exe
  2⤵
  PID:4888
- C:\Windows\System\wVNLwJE.exe
  C:\Windows\System\wVNLwJE.exe
  2⤵
  PID:4680
- C:\Windows\System\mLXtyWE.exe
  C:\Windows\System\mLXtyWE.exe
  2⤵
  PID:5064
- C:\Windows\System\XKyxKLJ.exe
  C:\Windows\System\XKyxKLJ.exe
  2⤵
  PID:4952
- C:\Windows\System\JypKvvg.exe
  C:\Windows\System\JypKvvg.exe
  2⤵
  PID:4824
- C:\Windows\System\WjfmFEa.exe
  C:\Windows\System\WjfmFEa.exe
  2⤵
  PID:4328
- C:\Windows\System\vwoweYM.exe
  C:\Windows\System\vwoweYM.exe
  2⤵
  PID:5084
- C:\Windows\System\FQOPswU.exe
  C:\Windows\System\FQOPswU.exe
  2⤵
  PID:4296
- C:\Windows\System\tthkWLB.exe
  C:\Windows\System\tthkWLB.exe
  2⤵
  PID:5172
- C:\Windows\System\aDxxoTn.exe
  C:\Windows\System\aDxxoTn.exe
  2⤵
  PID:4600
- C:\Windows\System\HJFFggl.exe
  C:\Windows\System\HJFFggl.exe
  2⤵
  PID:5188
- C:\Windows\System\BUdEZJj.exe
  C:\Windows\System\BUdEZJj.exe
  2⤵
  PID:5244
- C:\Windows\System\JctJHSD.exe
  C:\Windows\System\JctJHSD.exe
  2⤵
  PID:5268
- C:\Windows\System\PYygaNL.exe
  C:\Windows\System\PYygaNL.exe
  2⤵
  PID:5296
- C:\Windows\System\ubGqjjz.exe
  C:\Windows\System\ubGqjjz.exe
  2⤵
  PID:5332
- C:\Windows\System\CAwfLvI.exe
  C:\Windows\System\CAwfLvI.exe
  2⤵
  PID:5372
- C:\Windows\System\cHlkAtc.exe
  C:\Windows\System\cHlkAtc.exe
  2⤵
  PID:2172
- C:\Windows\System\aCzUIoU.exe
  C:\Windows\System\aCzUIoU.exe
  2⤵
  PID:5476
- C:\Windows\System\CcSxLlq.exe
  C:\Windows\System\CcSxLlq.exe
  2⤵
  PID:5548
- C:\Windows\System\LGYyLkO.exe
  C:\Windows\System\LGYyLkO.exe
  2⤵
  PID:5576
- C:\Windows\System\PnnmdNR.exe
  C:\Windows\System\PnnmdNR.exe
  2⤵
  PID:5524
- C:\Windows\System\MWcQYBj.exe
  C:\Windows\System\MWcQYBj.exe
  2⤵
  PID:5420
- C:\Windows\System\NoGtswg.exe
  C:\Windows\System\NoGtswg.exe
  2⤵
  PID:5748
- C:\Windows\System\DVxmHye.exe
  C:\Windows\System\DVxmHye.exe
  2⤵
  PID:5596
- C:\Windows\System\vlTatyA.exe
  C:\Windows\System\vlTatyA.exe
  2⤵
  PID:5636
- C:\Windows\System\ZDJQvHE.exe
  C:\Windows\System\ZDJQvHE.exe
  2⤵
  PID:5388
- C:\Windows\System\uNcoiit.exe
  C:\Windows\System\uNcoiit.exe
  2⤵
  PID:5724
- C:\Windows\System\XaalMeG.exe
  C:\Windows\System\XaalMeG.exe
  2⤵
  PID:5760
- C:\Windows\System\UgtqvBJ.exe
  C:\Windows\System\UgtqvBJ.exe
  2⤵
  PID:5800
- C:\Windows\System\eLLSfyA.exe
  C:\Windows\System\eLLSfyA.exe
  2⤵
  PID:5816
- C:\Windows\System\pqhiiCw.exe
  C:\Windows\System\pqhiiCw.exe
  2⤵
  PID:5852
- C:\Windows\System\DgyShuj.exe
  C:\Windows\System\DgyShuj.exe
  2⤵
  PID:5836
- C:\Windows\System\RIcNmEK.exe
  C:\Windows\System\RIcNmEK.exe
  2⤵
  PID:5992
- C:\Windows\System\EWUqgER.exe
  C:\Windows\System\EWUqgER.exe
  2⤵
  PID:5900
- C:\Windows\System\ecwGMtM.exe
  C:\Windows\System\ecwGMtM.exe
  2⤵
  PID:5904
- C:\Windows\System\FwodAdF.exe
  C:\Windows\System\FwodAdF.exe
  2⤵
  PID:5944
- C:\Windows\System\uGtqsCf.exe
  C:\Windows\System\uGtqsCf.exe
  2⤵
  PID:5980
- C:\Windows\System\bjHgiqE.exe
  C:\Windows\System\bjHgiqE.exe
  2⤵
  PID:6040
- C:\Windows\System\qIctOBi.exe
  C:\Windows\System\qIctOBi.exe
  2⤵
  PID:6076
- C:\Windows\System\SUXDUgs.exe
  C:\Windows\System\SUXDUgs.exe
  2⤵
  PID:6128
- C:\Windows\System\EYiEtNR.exe
  C:\Windows\System\EYiEtNR.exe
  2⤵
  PID:4248
- C:\Windows\System\QwWRExG.exe
  C:\Windows\System\QwWRExG.exe
  2⤵
  PID:4244
- C:\Windows\System\HxPrNsO.exe
  C:\Windows\System\HxPrNsO.exe
  2⤵
  PID:4104
- C:\Windows\System\KQvRyLc.exe
  C:\Windows\System\KQvRyLc.exe
  2⤵
  PID:5176
- C:\Windows\System\kMGMYga.exe
  C:\Windows\System\kMGMYga.exe
  2⤵
  PID:5216
- C:\Windows\System\vcLCDry.exe
  C:\Windows\System\vcLCDry.exe
  2⤵
  PID:5284
- C:\Windows\System\TfPdBmN.exe
  C:\Windows\System\TfPdBmN.exe
  2⤵
  PID:5364
- C:\Windows\System\CCxSuNs.exe
  C:\Windows\System\CCxSuNs.exe
  2⤵
  PID:4124
- C:\Windows\System\ZdqVGIF.exe
  C:\Windows\System\ZdqVGIF.exe
  2⤵
  PID:4936
- C:\Windows\System\yoaFOUU.exe
  C:\Windows\System\yoaFOUU.exe
  2⤵
  PID:5424
- C:\Windows\System\xNnOeZW.exe
  C:\Windows\System\xNnOeZW.exe
  2⤵
  PID:5564
- C:\Windows\System\eepdsgL.exe
  C:\Windows\System\eepdsgL.exe
  2⤵
  PID:5408
- C:\Windows\System\JAfBbLf.exe
  C:\Windows\System\JAfBbLf.exe
  2⤵
  PID:5580
- C:\Windows\System\CVtGcKy.exe
  C:\Windows\System\CVtGcKy.exe
  2⤵
  PID:5788
- C:\Windows\System\GhOweDf.exe
  C:\Windows\System\GhOweDf.exe
  2⤵
  PID:5672
- C:\Windows\System\ovXvpNH.exe
  C:\Windows\System\ovXvpNH.exe
  2⤵
  PID:5812
- C:\Windows\System\MWUSnrO.exe
  C:\Windows\System\MWUSnrO.exe
  2⤵
  PID:6096
- C:\Windows\System\WISByon.exe
  C:\Windows\System\WISByon.exe
  2⤵
  PID:4548
- C:\Windows\System\LlMRaxD.exe
  C:\Windows\System\LlMRaxD.exe
  2⤵
  PID:5716
- C:\Windows\System\snfbjxV.exe
  C:\Windows\System\snfbjxV.exe
  2⤵
  PID:6108
- C:\Windows\System\zvaOtGk.exe
  C:\Windows\System\zvaOtGk.exe
  2⤵
  PID:5924
- C:\Windows\System\voNNXJP.exe
  C:\Windows\System\voNNXJP.exe
  2⤵
  PID:5124
- C:\Windows\System\kpKNHcZ.exe
  C:\Windows\System\kpKNHcZ.exe
  2⤵
  PID:4676
- C:\Windows\System\FxCkrom.exe
  C:\Windows\System\FxCkrom.exe
  2⤵
  PID:5152
- C:\Windows\System\yRXDWns.exe
  C:\Windows\System\yRXDWns.exe
  2⤵
  PID:5848
- C:\Windows\System\xiqLAwt.exe
  C:\Windows\System\xiqLAwt.exe
  2⤵
  PID:5228
- C:\Windows\System\AsYGEdi.exe
  C:\Windows\System\AsYGEdi.exe
  2⤵
  PID:5708
- C:\Windows\System\qaVkAkJ.exe
  C:\Windows\System\qaVkAkJ.exe
  2⤵
  PID:5460
- C:\Windows\System\lQmZgpW.exe
  C:\Windows\System\lQmZgpW.exe
  2⤵
  PID:5808
- C:\Windows\System\LgVMvmr.exe
  C:\Windows\System\LgVMvmr.exe
  2⤵
  PID:5720
- C:\Windows\System\vhMrnRU.exe
  C:\Windows\System\vhMrnRU.exe
  2⤵
  PID:6024
- C:\Windows\System\IFLfhzi.exe
  C:\Windows\System\IFLfhzi.exe
  2⤵
  PID:4988
- C:\Windows\System\slPaAqc.exe
  C:\Windows\System\slPaAqc.exe
  2⤵
  PID:5544
- C:\Windows\System\jTnvGgc.exe
  C:\Windows\System\jTnvGgc.exe
  2⤵
  PID:5940
- C:\Windows\System\AMANaGj.exe
  C:\Windows\System\AMANaGj.exe
  2⤵
  PID:6092
- C:\Windows\System\ZuhuRQf.exe
  C:\Windows\System\ZuhuRQf.exe
  2⤵
  PID:5164
- C:\Windows\System\JnQfRAi.exe
  C:\Windows\System\JnQfRAi.exe
  2⤵
  PID:3748
- C:\Windows\System\EaGUgjd.exe
  C:\Windows\System\EaGUgjd.exe
  2⤵
  PID:5868
- C:\Windows\System\abXbtDb.exe
  C:\Windows\System\abXbtDb.exe
  2⤵
  PID:5472
- C:\Windows\System\VkarpPb.exe
  C:\Windows\System\VkarpPb.exe
  2⤵
  PID:4120
- C:\Windows\System\oCxAMTP.exe
  C:\Windows\System\oCxAMTP.exe
  2⤵
  PID:5492
- C:\Windows\System\WKYybVR.exe
  C:\Windows\System\WKYybVR.exe
  2⤵
  PID:5288
- C:\Windows\System\VfGnVHB.exe
  C:\Windows\System\VfGnVHB.exe
  2⤵
  PID:5604
- C:\Windows\System\SQjyPmA.exe
  C:\Windows\System\SQjyPmA.exe
  2⤵
  PID:5144
- C:\Windows\System\pvyvuBQ.exe
  C:\Windows\System\pvyvuBQ.exe
  2⤵
  PID:5200
- C:\Windows\System\VAbmOko.exe
  C:\Windows\System\VAbmOko.exe
  2⤵
  PID:6060
- C:\Windows\System\QlITNOu.exe
  C:\Windows\System\QlITNOu.exe
  2⤵
  PID:5692
- C:\Windows\System\hxioKUS.exe
  C:\Windows\System\hxioKUS.exe
  2⤵
  PID:4924
- C:\Windows\System\QMAmTEm.exe
  C:\Windows\System\QMAmTEm.exe
  2⤵
  PID:5184
- C:\Windows\System\WYqnzGs.exe
  C:\Windows\System\WYqnzGs.exe
  2⤵
  PID:5884
- C:\Windows\System\IZFlwhP.exe
  C:\Windows\System\IZFlwhP.exe
  2⤵
  PID:5320
- C:\Windows\System\bzfAroZ.exe
  C:\Windows\System\bzfAroZ.exe
  2⤵
  PID:4972
- C:\Windows\System\jRLiKHa.exe
  C:\Windows\System\jRLiKHa.exe
  2⤵
  PID:6072
- C:\Windows\System\PoeKVIA.exe
  C:\Windows\System\PoeKVIA.exe
  2⤵
  PID:6156
- C:\Windows\System\zhrJYGt.exe
  C:\Windows\System\zhrJYGt.exe
  2⤵
  PID:6172
- C:\Windows\System\RkghVjI.exe
  C:\Windows\System\RkghVjI.exe
  2⤵
  PID:6192
- C:\Windows\System\fTmVXnB.exe
  C:\Windows\System\fTmVXnB.exe
  2⤵
  PID:6228
- C:\Windows\System\HKNPMbT.exe
  C:\Windows\System\HKNPMbT.exe
  2⤵
  PID:6248
- C:\Windows\System\JzMrdgt.exe
  C:\Windows\System\JzMrdgt.exe
  2⤵
  PID:6264
- C:\Windows\System\ZZhcJPb.exe
  C:\Windows\System\ZZhcJPb.exe
  2⤵
  PID:6280
- C:\Windows\System\svQBYec.exe
  C:\Windows\System\svQBYec.exe
  2⤵
  PID:6300
- C:\Windows\System\sbFVtIm.exe
  C:\Windows\System\sbFVtIm.exe
  2⤵
  PID:6316
- C:\Windows\System\VoExWCv.exe
  C:\Windows\System\VoExWCv.exe
  2⤵
  PID:6340
- C:\Windows\System\JBctTHw.exe
  C:\Windows\System\JBctTHw.exe
  2⤵
  PID:6356
- C:\Windows\System\ghuGBNm.exe
  C:\Windows\System\ghuGBNm.exe
  2⤵
  PID:6372
- C:\Windows\System\yxVOQPK.exe
  C:\Windows\System\yxVOQPK.exe
  2⤵
  PID:6396
- C:\Windows\System\AMjBgTJ.exe
  C:\Windows\System\AMjBgTJ.exe
  2⤵
  PID:6412
- C:\Windows\System\ZWTwmWg.exe
  C:\Windows\System\ZWTwmWg.exe
  2⤵
  PID:6428
- C:\Windows\System\sDJEHXf.exe
  C:\Windows\System\sDJEHXf.exe
  2⤵
  PID:6472
- C:\Windows\System\ZgJjpAA.exe
  C:\Windows\System\ZgJjpAA.exe
  2⤵
  PID:6488
- C:\Windows\System\ILhwZEn.exe
  C:\Windows\System\ILhwZEn.exe
  2⤵
  PID:6508
- C:\Windows\System\jECmnNu.exe
  C:\Windows\System\jECmnNu.exe
  2⤵
  PID:6524
- C:\Windows\System\obFOCGI.exe
  C:\Windows\System\obFOCGI.exe
  2⤵
  PID:6540
- C:\Windows\System\yiHMqBx.exe
  C:\Windows\System\yiHMqBx.exe
  2⤵
  PID:6560
- C:\Windows\System\TlGcYSj.exe
  C:\Windows\System\TlGcYSj.exe
  2⤵
  PID:6576
- C:\Windows\System\mViNybA.exe
  C:\Windows\System\mViNybA.exe
  2⤵
  PID:6604
- C:\Windows\System\QmFaEOi.exe
  C:\Windows\System\QmFaEOi.exe
  2⤵
  PID:6620
- C:\Windows\System\kfIiqiU.exe
  C:\Windows\System\kfIiqiU.exe
  2⤵
  PID:6636
- C:\Windows\System\cJcwrZV.exe
  C:\Windows\System\cJcwrZV.exe
  2⤵
  PID:6652
- C:\Windows\System\uDAIFrw.exe
  C:\Windows\System\uDAIFrw.exe
  2⤵
  PID:6668
- C:\Windows\System\SvOCUTo.exe
  C:\Windows\System\SvOCUTo.exe
  2⤵
  PID:6684
- C:\Windows\System\MFpkUBp.exe
  C:\Windows\System\MFpkUBp.exe
  2⤵
  PID:6700
- C:\Windows\System\NNhMRNq.exe
  C:\Windows\System\NNhMRNq.exe
  2⤵
  PID:6716
- C:\Windows\System\kvwMOrd.exe
  C:\Windows\System\kvwMOrd.exe
  2⤵
  PID:6732
- C:\Windows\System\GcIRadH.exe
  C:\Windows\System\GcIRadH.exe
  2⤵
  PID:6756
- C:\Windows\System\NrfNIzT.exe
  C:\Windows\System\NrfNIzT.exe
  2⤵
  PID:6772
- C:\Windows\System\jAhjPaE.exe
  C:\Windows\System\jAhjPaE.exe
  2⤵
  PID:6788
- C:\Windows\System\SzgDjEm.exe
  C:\Windows\System\SzgDjEm.exe
  2⤵
  PID:6808
- C:\Windows\System\rXtXHVN.exe
  C:\Windows\System\rXtXHVN.exe
  2⤵
  PID:6824
- C:\Windows\System\TRySYdY.exe
  C:\Windows\System\TRySYdY.exe
  2⤵
  PID:6844
- C:\Windows\System\mcHLQWX.exe
  C:\Windows\System\mcHLQWX.exe
  2⤵
  PID:6864
- C:\Windows\System\PQUiWfq.exe
  C:\Windows\System\PQUiWfq.exe
  2⤵
  PID:6884
- C:\Windows\System\ECPdoVn.exe
  C:\Windows\System\ECPdoVn.exe
  2⤵
  PID:6900
- C:\Windows\System\jZvvzIy.exe
  C:\Windows\System\jZvvzIy.exe
  2⤵
  PID:6920
- C:\Windows\System\monMLRx.exe
  C:\Windows\System\monMLRx.exe
  2⤵
  PID:6936
- C:\Windows\System\gudTdbv.exe
  C:\Windows\System\gudTdbv.exe
  2⤵
  PID:6952
- C:\Windows\System\FPtjKsM.exe
  C:\Windows\System\FPtjKsM.exe
  2⤵
  PID:7040
- C:\Windows\System\qsDIolq.exe
  C:\Windows\System\qsDIolq.exe
  2⤵
  PID:7060
- C:\Windows\System\JGoSPBs.exe
  C:\Windows\System\JGoSPBs.exe
  2⤵
  PID:7076
- C:\Windows\System\vDRORKg.exe
  C:\Windows\System\vDRORKg.exe
  2⤵
  PID:7092
- C:\Windows\System\UxwpyBo.exe
  C:\Windows\System\UxwpyBo.exe
  2⤵
  PID:7108
- C:\Windows\System\MnqJpPy.exe
  C:\Windows\System\MnqJpPy.exe
  2⤵
  PID:7128
- C:\Windows\System\pQiGvic.exe
  C:\Windows\System\pQiGvic.exe
  2⤵
  PID:7148
- C:\Windows\System\DLdrpiE.exe
  C:\Windows\System\DLdrpiE.exe
  2⤵
  PID:7164
- C:\Windows\System\VjTfUEG.exe
  C:\Windows\System\VjTfUEG.exe
  2⤵
  PID:6152
- C:\Windows\System\KbFbCuH.exe
  C:\Windows\System\KbFbCuH.exe
  2⤵
  PID:6080
- C:\Windows\System\RlfxyqO.exe
  C:\Windows\System\RlfxyqO.exe
  2⤵
  PID:6164
- C:\Windows\System\jjiJkUH.exe
  C:\Windows\System\jjiJkUH.exe
  2⤵
  PID:6188
- C:\Windows\System\LnmoqPC.exe
  C:\Windows\System\LnmoqPC.exe
  2⤵
  PID:6244
- C:\Windows\System\zJCWNAD.exe
  C:\Windows\System\zJCWNAD.exe
  2⤵
  PID:6348
- C:\Windows\System\ZhyciYY.exe
  C:\Windows\System\ZhyciYY.exe
  2⤵
  PID:6200
- C:\Windows\System\PVjezrZ.exe
  C:\Windows\System\PVjezrZ.exe
  2⤵
  PID:6212
- C:\Windows\System\PCHldfT.exe
  C:\Windows\System\PCHldfT.exe
  2⤵
  PID:6384
- C:\Windows\System\grzYjhg.exe
  C:\Windows\System\grzYjhg.exe
  2⤵
  PID:6292
- C:\Windows\System\eJGCBSY.exe
  C:\Windows\System\eJGCBSY.exe
  2⤵
  PID:6368
- C:\Windows\System\uSDGOBB.exe
  C:\Windows\System\uSDGOBB.exe
  2⤵
  PID:6460
- C:\Windows\System\tLyOkbe.exe
  C:\Windows\System\tLyOkbe.exe
  2⤵
  PID:6464
- C:\Windows\System\bOXfocw.exe
  C:\Windows\System\bOXfocw.exe
  2⤵
  PID:6496
- C:\Windows\System\PGQjmVa.exe
  C:\Windows\System\PGQjmVa.exe
  2⤵
  PID:6600
- C:\Windows\System\IiUkAWg.exe
  C:\Windows\System\IiUkAWg.exe
  2⤵
  PID:6664
- C:\Windows\System\DcfHUNK.exe
  C:\Windows\System\DcfHUNK.exe
  2⤵
  PID:6692
- C:\Windows\System\hPczgcC.exe
  C:\Windows\System\hPczgcC.exe
  2⤵
  PID:6724
- C:\Windows\System\VpRQxrS.exe
  C:\Windows\System\VpRQxrS.exe
  2⤵
  PID:6804
- C:\Windows\System\oTmdJlj.exe
  C:\Windows\System\oTmdJlj.exe
  2⤵
  PID:6840
- C:\Windows\System\GmoaDRB.exe
  C:\Windows\System\GmoaDRB.exe
  2⤵
  PID:6908
- C:\Windows\System\cQceeIE.exe
  C:\Windows\System\cQceeIE.exe
  2⤵
  PID:6744
- C:\Windows\System\iaqXeDF.exe
  C:\Windows\System\iaqXeDF.exe
  2⤵
  PID:6820
- C:\Windows\System\IlDvkcq.exe
  C:\Windows\System\IlDvkcq.exe
  2⤵
  PID:6932
- C:\Windows\System\zIFRKyJ.exe
  C:\Windows\System\zIFRKyJ.exe
  2⤵
  PID:6648
- C:\Windows\System\ebTvQKD.exe
  C:\Windows\System\ebTvQKD.exe
  2⤵
  PID:6976
- C:\Windows\System\FaroqnQ.exe
  C:\Windows\System\FaroqnQ.exe
  2⤵
  PID:6612
- C:\Windows\System\uxipOIq.exe
  C:\Windows\System\uxipOIq.exe
  2⤵
  PID:7000
- C:\Windows\System\nhJQlQT.exe
  C:\Windows\System\nhJQlQT.exe
  2⤵
  PID:7008
- C:\Windows\System\cXIQJvM.exe
  C:\Windows\System\cXIQJvM.exe
  2⤵
  PID:7020
- C:\Windows\System\EZyLVVX.exe
  C:\Windows\System\EZyLVVX.exe
  2⤵
  PID:7048
- C:\Windows\System\PBIiCmM.exe
  C:\Windows\System\PBIiCmM.exe
  2⤵
  PID:7120
- C:\Windows\System\FqjOXnt.exe
  C:\Windows\System\FqjOXnt.exe
  2⤵
  PID:6184
- C:\Windows\System\gibKZpT.exe
  C:\Windows\System\gibKZpT.exe
  2⤵
  PID:6220
- C:\Windows\System\ZNduMwY.exe
  C:\Windows\System\ZNduMwY.exe
  2⤵
  PID:7100
- C:\Windows\System\lhSrwje.exe
  C:\Windows\System\lhSrwje.exe
  2⤵
  PID:4396
- C:\Windows\System\cnXMPzc.exe
  C:\Windows\System\cnXMPzc.exe
  2⤵
  PID:6480
- C:\Windows\System\qMVceLR.exe
  C:\Windows\System\qMVceLR.exe
  2⤵
  PID:6516
- C:\Windows\System\nPxuNCc.exe
  C:\Windows\System\nPxuNCc.exe
  2⤵
  PID:6224
- C:\Windows\System\kTqYzss.exe
  C:\Windows\System\kTqYzss.exe
  2⤵
  PID:7140
- C:\Windows\System\eZjYEMO.exe
  C:\Windows\System\eZjYEMO.exe
  2⤵
  PID:6584
- C:\Windows\System\nFfgaiF.exe
  C:\Windows\System\nFfgaiF.exe
  2⤵
  PID:6876
- C:\Windows\System\nMfjvfx.exe
  C:\Windows\System\nMfjvfx.exe
  2⤵
  PID:6832
- C:\Windows\System\NpsHNgx.exe
  C:\Windows\System\NpsHNgx.exe
  2⤵
  PID:6860
- C:\Windows\System\hSIPdqY.exe
  C:\Windows\System\hSIPdqY.exe
  2⤵
  PID:6928
- C:\Windows\System\cvGSmyv.exe
  C:\Windows\System\cvGSmyv.exe
  2⤵
  PID:6616
- C:\Windows\System\AqwxLrE.exe
  C:\Windows\System\AqwxLrE.exe
  2⤵
  PID:6596
- C:\Windows\System\uXCicVy.exe
  C:\Windows\System\uXCicVy.exe
  2⤵
  PID:6880
- C:\Windows\System\LLKnsbS.exe
  C:\Windows\System\LLKnsbS.exe
  2⤵
  PID:6712
- C:\Windows\System\oZBbgzM.exe
  C:\Windows\System\oZBbgzM.exe
  2⤵
  PID:6588
- C:\Windows\System\HoTgbEq.exe
  C:\Windows\System\HoTgbEq.exe
  2⤵
  PID:7088
- C:\Windows\System\DveDxXM.exe
  C:\Windows\System\DveDxXM.exe
  2⤵
  PID:6308
- C:\Windows\System\wHKihav.exe
  C:\Windows\System\wHKihav.exe
  2⤵
  PID:2316
- C:\Windows\System\MRXyRtx.exe
  C:\Windows\System\MRXyRtx.exe
  2⤵
  PID:7144
- C:\Windows\System\ulJnneL.exe
  C:\Windows\System\ulJnneL.exe
  2⤵
  PID:7072
- C:\Windows\System\TzUorkH.exe
  C:\Windows\System\TzUorkH.exe
  2⤵
  PID:6208
- C:\Windows\System\oXaaEGB.exe
  C:\Windows\System\oXaaEGB.exe
  2⤵
  PID:6796
- C:\Windows\System\zTbDGBm.exe
  C:\Windows\System\zTbDGBm.exe
  2⤵
  PID:7160
- C:\Windows\System\uQBkmGN.exe
  C:\Windows\System\uQBkmGN.exe
  2⤵
  PID:6364
- C:\Windows\System\fdnFFUW.exe
  C:\Windows\System\fdnFFUW.exe
  2⤵
  PID:6408
- C:\Windows\System\EoREoDi.exe
  C:\Windows\System\EoREoDi.exe
  2⤵
  PID:6944
- C:\Windows\System\wYQPQAC.exe
  C:\Windows\System\wYQPQAC.exe
  2⤵
  PID:6748
- C:\Windows\System\GbxIlRf.exe
  C:\Windows\System\GbxIlRf.exe
  2⤵
  PID:6856
- C:\Windows\System\iBawUGJ.exe
  C:\Windows\System\iBawUGJ.exe
  2⤵
  PID:6504
- C:\Windows\System\VhgwplH.exe
  C:\Windows\System\VhgwplH.exe
  2⤵
  PID:6448
- C:\Windows\System\DKBeFje.exe
  C:\Windows\System\DKBeFje.exe
  2⤵
  PID:6896
- C:\Windows\System\pbpQBjP.exe
  C:\Windows\System\pbpQBjP.exe
  2⤵
  PID:6568
- C:\Windows\System\yMoeUpM.exe
  C:\Windows\System\yMoeUpM.exe
  2⤵
  PID:6388
- C:\Windows\System\hTkioWP.exe
  C:\Windows\System\hTkioWP.exe
  2⤵
  PID:5744
- C:\Windows\System\RSvBqGe.exe
  C:\Windows\System\RSvBqGe.exe
  2⤵
  PID:6328
- C:\Windows\System\ohCbjBc.exe
  C:\Windows\System\ohCbjBc.exe
  2⤵
  PID:6988
- C:\Windows\System\doByCka.exe
  C:\Windows\System\doByCka.exe
  2⤵
  PID:6532
- C:\Windows\System\DJWzYVY.exe
  C:\Windows\System\DJWzYVY.exe
  2⤵
  PID:6784
- C:\Windows\System\JHyAbfa.exe
  C:\Windows\System\JHyAbfa.exe
  2⤵
  PID:6836
- C:\Windows\System\UkhwfAQ.exe
  C:\Windows\System\UkhwfAQ.exe
  2⤵
  PID:6440
- C:\Windows\System\CSOLViC.exe
  C:\Windows\System\CSOLViC.exe
  2⤵
  PID:7068
- C:\Windows\System\IMGcooG.exe
  C:\Windows\System\IMGcooG.exe
  2⤵
  PID:7036
- C:\Windows\System\sKJrimD.exe
  C:\Windows\System\sKJrimD.exe
  2⤵
  PID:6240
- C:\Windows\System\modsAAt.exe
  C:\Windows\System\modsAAt.exe
  2⤵
  PID:7176
- C:\Windows\System\eFJAwWw.exe
  C:\Windows\System\eFJAwWw.exe
  2⤵
  PID:7192
- C:\Windows\System\hiUgNrE.exe
  C:\Windows\System\hiUgNrE.exe
  2⤵
  PID:7208
- C:\Windows\System\JPbyAWe.exe
  C:\Windows\System\JPbyAWe.exe
  2⤵
  PID:7224
- C:\Windows\System\JOwrSFJ.exe
  C:\Windows\System\JOwrSFJ.exe
  2⤵
  PID:7244
- C:\Windows\System\ZARhReT.exe
  C:\Windows\System\ZARhReT.exe
  2⤵
  PID:7260
- C:\Windows\System\AuSnjkp.exe
  C:\Windows\System\AuSnjkp.exe
  2⤵
  PID:7276
- C:\Windows\System\hUgoJBs.exe
  C:\Windows\System\hUgoJBs.exe
  2⤵
  PID:7308
- C:\Windows\System\xtksfLs.exe
  C:\Windows\System\xtksfLs.exe
  2⤵
  PID:7328
- C:\Windows\System\kOTLGKA.exe
  C:\Windows\System\kOTLGKA.exe
  2⤵
  PID:7344
- C:\Windows\System\XcAAiOA.exe
  C:\Windows\System\XcAAiOA.exe
  2⤵
  PID:7360
- C:\Windows\System\UCoZsQR.exe
  C:\Windows\System\UCoZsQR.exe
  2⤵
  PID:7376
- C:\Windows\System\GAxkyRO.exe
  C:\Windows\System\GAxkyRO.exe
  2⤵
  PID:7396
- C:\Windows\System\dWQJGaU.exe
  C:\Windows\System\dWQJGaU.exe
  2⤵
  PID:7412
- C:\Windows\System\HXCGYrG.exe
  C:\Windows\System\HXCGYrG.exe
  2⤵
  PID:7436
- C:\Windows\System\uSQCzfY.exe
  C:\Windows\System\uSQCzfY.exe
  2⤵
  PID:7456
- C:\Windows\System\GdusuSk.exe
  C:\Windows\System\GdusuSk.exe
  2⤵
  PID:7476
- C:\Windows\System\MJHzLJQ.exe
  C:\Windows\System\MJHzLJQ.exe
  2⤵
  PID:7492
- C:\Windows\System\nbosfPG.exe
  C:\Windows\System\nbosfPG.exe
  2⤵
  PID:7508
- C:\Windows\System\pUOSMeP.exe
  C:\Windows\System\pUOSMeP.exe
  2⤵
  PID:7524
- C:\Windows\System\HJWiqPR.exe
  C:\Windows\System\HJWiqPR.exe
  2⤵
  PID:7540
- C:\Windows\System\tamEfSt.exe
  C:\Windows\System\tamEfSt.exe
  2⤵
  PID:7556
- C:\Windows\System\YNraEVs.exe
  C:\Windows\System\YNraEVs.exe
  2⤵
  PID:7624
- C:\Windows\System\MlaipZt.exe
  C:\Windows\System\MlaipZt.exe
  2⤵
  PID:7644
- C:\Windows\System\RHmjSbQ.exe
  C:\Windows\System\RHmjSbQ.exe
  2⤵
  PID:7664
- C:\Windows\System\DmdycJA.exe
  C:\Windows\System\DmdycJA.exe
  2⤵
  PID:7688
- C:\Windows\System\opPxMvK.exe
  C:\Windows\System\opPxMvK.exe
  2⤵
  PID:7704
- C:\Windows\System\daYQxaJ.exe
  C:\Windows\System\daYQxaJ.exe
  2⤵
  PID:7720
- C:\Windows\System\VjyrOWX.exe
  C:\Windows\System\VjyrOWX.exe
  2⤵
  PID:7736
- C:\Windows\System\pYHhcJv.exe
  C:\Windows\System\pYHhcJv.exe
  2⤵
  PID:7752
- C:\Windows\System\QOwHqcZ.exe
  C:\Windows\System\QOwHqcZ.exe
  2⤵
  PID:7772
- C:\Windows\System\qVfPnWR.exe
  C:\Windows\System\qVfPnWR.exe
  2⤵
  PID:7792
- C:\Windows\System\oNWAoQl.exe
  C:\Windows\System\oNWAoQl.exe
  2⤵
  PID:7816
- C:\Windows\System\vgJTgIN.exe
  C:\Windows\System\vgJTgIN.exe
  2⤵
  PID:7836
- C:\Windows\System\UkxhlVN.exe
  C:\Windows\System\UkxhlVN.exe
  2⤵
  PID:7860
- C:\Windows\System\zPrIdUV.exe
  C:\Windows\System\zPrIdUV.exe
  2⤵
  PID:7880
- C:\Windows\System\GcYTHlB.exe
  C:\Windows\System\GcYTHlB.exe
  2⤵
  PID:7904
- C:\Windows\System\thPTjOc.exe
  C:\Windows\System\thPTjOc.exe
  2⤵
  PID:7920
- C:\Windows\System\VpWfVcb.exe
  C:\Windows\System\VpWfVcb.exe
  2⤵
  PID:7936
- C:\Windows\System\FloeRTo.exe
  C:\Windows\System\FloeRTo.exe
  2⤵
  PID:7960
- C:\Windows\System\wPquYmH.exe
  C:\Windows\System\wPquYmH.exe
  2⤵
  PID:7980
- C:\Windows\System\jvEeWDu.exe
  C:\Windows\System\jvEeWDu.exe
  2⤵
  PID:7996
- C:\Windows\System\KEGHbkD.exe
  C:\Windows\System\KEGHbkD.exe
  2⤵
  PID:8012
- C:\Windows\System\OMetIlL.exe
  C:\Windows\System\OMetIlL.exe
  2⤵
  PID:8032
- C:\Windows\System\IqEKvds.exe
  C:\Windows\System\IqEKvds.exe
  2⤵
  PID:8060
- C:\Windows\System\moBWVmB.exe
  C:\Windows\System\moBWVmB.exe
  2⤵
  PID:8076
- C:\Windows\System\kRWkxqL.exe
  C:\Windows\System\kRWkxqL.exe
  2⤵
  PID:8096
- C:\Windows\System\dYyWmDV.exe
  C:\Windows\System\dYyWmDV.exe
  2⤵
  PID:8128
- C:\Windows\System\NEacjsG.exe
  C:\Windows\System\NEacjsG.exe
  2⤵
  PID:8144
- C:\Windows\System\NcwRIvF.exe
  C:\Windows\System\NcwRIvF.exe
  2⤵
  PID:8160
- C:\Windows\System\PIdYlmF.exe
  C:\Windows\System\PIdYlmF.exe
  2⤵
  PID:8188
- C:\Windows\System\GrwbVzG.exe
  C:\Windows\System\GrwbVzG.exe
  2⤵
  PID:7184
- C:\Windows\System\ZIpjylm.exe
  C:\Windows\System\ZIpjylm.exe
  2⤵
  PID:7256
- C:\Windows\System\UnIeFmO.exe
  C:\Windows\System\UnIeFmO.exe
  2⤵
  PID:6660
- C:\Windows\System\TimsJDP.exe
  C:\Windows\System\TimsJDP.exe
  2⤵
  PID:7304
- C:\Windows\System\KTRlelo.exe
  C:\Windows\System\KTRlelo.exe
  2⤵
  PID:7368
- C:\Windows\System\BESJNSl.exe
  C:\Windows\System\BESJNSl.exe
  2⤵
  PID:7444
- C:\Windows\System\QXxFsvz.exe
  C:\Windows\System\QXxFsvz.exe
  2⤵
  PID:7268
- C:\Windows\System\iFEXyjC.exe
  C:\Windows\System\iFEXyjC.exe
  2⤵
  PID:7552
- C:\Windows\System\oBJXbRR.exe
  C:\Windows\System\oBJXbRR.exe
  2⤵
  PID:7236
- C:\Windows\System\yqgiHEo.exe
  C:\Windows\System\yqgiHEo.exe
  2⤵
  PID:7548
- C:\Windows\System\tMViovR.exe
  C:\Windows\System\tMViovR.exe
  2⤵
  PID:7588
- C:\Windows\System\vNXlnjU.exe
  C:\Windows\System\vNXlnjU.exe
  2⤵
  PID:7600
- C:\Windows\System\AHQJhSl.exe
  C:\Windows\System\AHQJhSl.exe
  2⤵
  PID:7616
- C:\Windows\System\WwcPGyV.exe
  C:\Windows\System\WwcPGyV.exe
  2⤵
  PID:7592
- C:\Windows\System\JLDxHIf.exe
  C:\Windows\System\JLDxHIf.exe
  2⤵
  PID:7608
- C:\Windows\System\SyrjLsw.exe
  C:\Windows\System\SyrjLsw.exe
  2⤵
  PID:7568
- C:\Windows\System\ywhIJvf.exe
  C:\Windows\System\ywhIJvf.exe
  2⤵
  PID:7656
- C:\Windows\System\dsTBtYX.exe
  C:\Windows\System\dsTBtYX.exe
  2⤵
  PID:7700
- C:\Windows\System\QuwAGzx.exe
  C:\Windows\System\QuwAGzx.exe
  2⤵
  PID:7780
- C:\Windows\System\CNwcqKQ.exe
  C:\Windows\System\CNwcqKQ.exe
  2⤵
  PID:6288
- C:\Windows\System\ysVquco.exe
  C:\Windows\System\ysVquco.exe
  2⤵
  PID:7800
- C:\Windows\System\jmkgPfs.exe
  C:\Windows\System\jmkgPfs.exe
  2⤵
  PID:7828
- C:\Windows\System\HOcyLiN.exe
  C:\Windows\System\HOcyLiN.exe
  2⤵
  PID:7852
- C:\Windows\System\RqZRLuR.exe
  C:\Windows\System\RqZRLuR.exe
  2⤵
  PID:7876
- C:\Windows\System\RUYjsOA.exe
  C:\Windows\System\RUYjsOA.exe
  2⤵
  PID:7932
- C:\Windows\System\bJgtcEH.exe
  C:\Windows\System\bJgtcEH.exe
  2⤵
  PID:8020
- C:\Windows\System\qkhsPMk.exe
  C:\Windows\System\qkhsPMk.exe
  2⤵
  PID:8068
- C:\Windows\System\LpdweYQ.exe
  C:\Windows\System\LpdweYQ.exe
  2⤵
  PID:8040
- C:\Windows\System\pwVlTtn.exe
  C:\Windows\System\pwVlTtn.exe
  2⤵
  PID:8056
- C:\Windows\System\WPpUqbC.exe
  C:\Windows\System\WPpUqbC.exe
  2⤵
  PID:8108
- C:\Windows\System\FpIBalP.exe
  C:\Windows\System\FpIBalP.exe
  2⤵
  PID:8120
- C:\Windows\System\dRARPYU.exe
  C:\Windows\System\dRARPYU.exe
  2⤵
  PID:8156
- C:\Windows\System\fntNEGc.exe
  C:\Windows\System\fntNEGc.exe
  2⤵
  PID:8180
- C:\Windows\System\FQIVedM.exe
  C:\Windows\System\FQIVedM.exe
  2⤵
  PID:7292
- C:\Windows\System\vCMHhRN.exe
  C:\Windows\System\vCMHhRN.exe
  2⤵
  PID:7408
- C:\Windows\System\NKUVnRI.exe
  C:\Windows\System\NKUVnRI.exe
  2⤵
  PID:7452
- C:\Windows\System\huBkmed.exe
  C:\Windows\System\huBkmed.exe
  2⤵
  PID:7232
- C:\Windows\System\VIBqIkG.exe
  C:\Windows\System\VIBqIkG.exe
  2⤵
  PID:7488
- C:\Windows\System\VRxseZi.exe
  C:\Windows\System\VRxseZi.exe
  2⤵
  PID:7472
- C:\Windows\System\oKbZlnP.exe
  C:\Windows\System\oKbZlnP.exe
  2⤵
  PID:7576
- C:\Windows\System\ZhYmvdj.exe
  C:\Windows\System\ZhYmvdj.exe
  2⤵
  PID:7536
- C:\Windows\System\DNfQYLH.exe
  C:\Windows\System\DNfQYLH.exe
  2⤵
  PID:7716
- C:\Windows\System\PRhFghO.exe
  C:\Windows\System\PRhFghO.exe
  2⤵
  PID:7768
- C:\Windows\System\zDGrdQJ.exe
  C:\Windows\System\zDGrdQJ.exe
  2⤵
  PID:7848
- C:\Windows\System\dkgpltX.exe
  C:\Windows\System\dkgpltX.exe
  2⤵
  PID:7680
- C:\Windows\System\tWPHIYr.exe
  C:\Windows\System\tWPHIYr.exe
  2⤵
  PID:7912
- C:\Windows\System\YwKXyxP.exe
  C:\Windows\System\YwKXyxP.exe
  2⤵
  PID:7948
- C:\Windows\System\HHsGnWl.exe
  C:\Windows\System\HHsGnWl.exe
  2⤵
  PID:7992
- C:\Windows\System\grIyhZz.exe
  C:\Windows\System\grIyhZz.exe
  2⤵
  PID:8116
- C:\Windows\System\sDuiuiX.exe
  C:\Windows\System\sDuiuiX.exe
  2⤵
  PID:8104
- C:\Windows\System\JjDkGRc.exe
  C:\Windows\System\JjDkGRc.exe
  2⤵
  PID:7296
- C:\Windows\System\lpIhytZ.exe
  C:\Windows\System\lpIhytZ.exe
  2⤵
  PID:7252
- C:\Windows\System\WMZzfjR.exe
  C:\Windows\System\WMZzfjR.exe
  2⤵
  PID:7300
- C:\Windows\System\FbKfghI.exe
  C:\Windows\System\FbKfghI.exe
  2⤵
  PID:7432
- C:\Windows\System\yuekoUc.exe
  C:\Windows\System\yuekoUc.exe
  2⤵
  PID:7324
- C:\Windows\System\FLpfSmC.exe
  C:\Windows\System\FLpfSmC.exe
  2⤵
  PID:7356
- C:\Windows\System\EygGLJB.exe
  C:\Windows\System\EygGLJB.exe
  2⤵
  PID:7484
- C:\Windows\System\trDNGdT.exe
  C:\Windows\System\trDNGdT.exe
  2⤵
  PID:7652
- C:\Windows\System\Gmqemcq.exe
  C:\Windows\System\Gmqemcq.exe
  2⤵
  PID:7824
- C:\Windows\System\MPioskG.exe
  C:\Windows\System\MPioskG.exe
  2⤵
  PID:7788
- C:\Windows\System\CtylxEo.exe
  C:\Windows\System\CtylxEo.exe
  2⤵
  PID:7340
- C:\Windows\System\OSDfmyT.exe
  C:\Windows\System\OSDfmyT.exe
  2⤵
  PID:7928
- C:\Windows\System\gFvPOas.exe
  C:\Windows\System\gFvPOas.exe
  2⤵
  PID:7900
- C:\Windows\System\vlNqNak.exe
  C:\Windows\System\vlNqNak.exe
  2⤵
  PID:8176
- C:\Windows\System\ENeohrP.exe
  C:\Windows\System\ENeohrP.exe
  2⤵
  PID:7220
- C:\Windows\System\VRFwFSh.exe
  C:\Windows\System\VRFwFSh.exe
  2⤵
  PID:7204
- C:\Windows\System\bzwxZrY.exe
  C:\Windows\System\bzwxZrY.exe
  2⤵
  PID:7520
- C:\Windows\System\FMdTTGf.exe
  C:\Windows\System\FMdTTGf.exe
  2⤵
  PID:7728
- C:\Windows\System\goBCcjF.exe
  C:\Windows\System\goBCcjF.exe
  2⤵
  PID:7620
- C:\Windows\System\EsNmrmz.exe
  C:\Windows\System\EsNmrmz.exe
  2⤵
  PID:8028
- C:\Windows\System\naOeXfg.exe
  C:\Windows\System\naOeXfg.exe
  2⤵
  PID:8136
- C:\Windows\System\bXQKJIp.exe
  C:\Windows\System\bXQKJIp.exe
  2⤵
  PID:7764
- C:\Windows\System\tZiQIWZ.exe
  C:\Windows\System\tZiQIWZ.exe
  2⤵
  PID:8212
- C:\Windows\System\McZRCyW.exe
  C:\Windows\System\McZRCyW.exe
  2⤵
  PID:8232
- C:\Windows\System\ekbbvHA.exe
  C:\Windows\System\ekbbvHA.exe
  2⤵
  PID:8248
- C:\Windows\System\mxeMXUR.exe
  C:\Windows\System\mxeMXUR.exe
  2⤵
  PID:8264
- C:\Windows\System\RPkXXjy.exe
  C:\Windows\System\RPkXXjy.exe
  2⤵
  PID:8284
- C:\Windows\System\xuvQZtp.exe
  C:\Windows\System\xuvQZtp.exe
  2⤵
  PID:8308
- C:\Windows\System\cJqmAsI.exe
  C:\Windows\System\cJqmAsI.exe
  2⤵
  PID:8328
- C:\Windows\System\tQGJsFk.exe
  C:\Windows\System\tQGJsFk.exe
  2⤵
  PID:8348
- C:\Windows\System\mWNPxLG.exe
  C:\Windows\System\mWNPxLG.exe
  2⤵
  PID:8364
- C:\Windows\System\JdwwbMV.exe
  C:\Windows\System\JdwwbMV.exe
  2⤵
  PID:8384
- C:\Windows\System\JRiNbXw.exe
  C:\Windows\System\JRiNbXw.exe
  2⤵
  PID:8400
- C:\Windows\System\ZfUrfxq.exe
  C:\Windows\System\ZfUrfxq.exe
  2⤵
  PID:8424
- C:\Windows\System\XXsJBQb.exe
  C:\Windows\System\XXsJBQb.exe
  2⤵
  PID:8444
- C:\Windows\System\LtoqEGd.exe
  C:\Windows\System\LtoqEGd.exe
  2⤵
  PID:8500
- C:\Windows\System\nxKzWMB.exe
  C:\Windows\System\nxKzWMB.exe
  2⤵
  PID:8516
- C:\Windows\System\eauEENW.exe
  C:\Windows\System\eauEENW.exe
  2⤵
  PID:8536
- C:\Windows\System\LfkXsvR.exe
  C:\Windows\System\LfkXsvR.exe
  2⤵
  PID:8556
- C:\Windows\System\lvsqUpc.exe
  C:\Windows\System\lvsqUpc.exe
  2⤵
  PID:8576
- C:\Windows\System\KwKxzBd.exe
  C:\Windows\System\KwKxzBd.exe
  2⤵
  PID:8592
- C:\Windows\System\nydWyqV.exe
  C:\Windows\System\nydWyqV.exe
  2⤵
  PID:8616
- C:\Windows\System\kScMShh.exe
  C:\Windows\System\kScMShh.exe
  2⤵
  PID:8632
- C:\Windows\System\kWAmerN.exe
  C:\Windows\System\kWAmerN.exe
  2⤵
  PID:8648
- C:\Windows\System\mhlLMPC.exe
  C:\Windows\System\mhlLMPC.exe
  2⤵
  PID:8668
- C:\Windows\System\cBLRoIE.exe
  C:\Windows\System\cBLRoIE.exe
  2⤵
  PID:8688
- C:\Windows\System\kEbHHpi.exe
  C:\Windows\System\kEbHHpi.exe
  2⤵
  PID:8704
- C:\Windows\System\vDLWYce.exe
  C:\Windows\System\vDLWYce.exe
  2⤵
  PID:8720
- C:\Windows\System\wLWdgrj.exe
  C:\Windows\System\wLWdgrj.exe
  2⤵
  PID:8740
- C:\Windows\System\FGmMQaP.exe
  C:\Windows\System\FGmMQaP.exe
  2⤵
  PID:8760
- C:\Windows\System\syZgVMM.exe
  C:\Windows\System\syZgVMM.exe
  2⤵
  PID:8776
- C:\Windows\System\bfDEBgM.exe
  C:\Windows\System\bfDEBgM.exe
  2⤵
  PID:8796
- C:\Windows\System\QbKHndI.exe
  C:\Windows\System\QbKHndI.exe
  2⤵
  PID:8820
- C:\Windows\System\SRNviGd.exe
  C:\Windows\System\SRNviGd.exe
  2⤵
  PID:8840
- C:\Windows\System\rdjTxUB.exe
  C:\Windows\System\rdjTxUB.exe
  2⤵
  PID:8864
- C:\Windows\System\qPAJTBn.exe
  C:\Windows\System\qPAJTBn.exe
  2⤵
  PID:8900
- C:\Windows\System\rDiAvhL.exe
  C:\Windows\System\rDiAvhL.exe
  2⤵
  PID:8920
- C:\Windows\System\aTpILRE.exe
  C:\Windows\System\aTpILRE.exe
  2⤵
  PID:8936
- C:\Windows\System\wSXIylA.exe
  C:\Windows\System\wSXIylA.exe
  2⤵
  PID:8956
- C:\Windows\System\FIncwkj.exe
  C:\Windows\System\FIncwkj.exe
  2⤵
  PID:8972
- C:\Windows\System\droteEh.exe
  C:\Windows\System\droteEh.exe
  2⤵
  PID:8992
- C:\Windows\System\lzatkXV.exe
  C:\Windows\System\lzatkXV.exe
  2⤵
  PID:9012
- C:\Windows\System\HppXmKy.exe
  C:\Windows\System\HppXmKy.exe
  2⤵
  PID:9028
- C:\Windows\System\ChpduKs.exe
  C:\Windows\System\ChpduKs.exe
  2⤵
  PID:9044
- C:\Windows\System\zADJMfS.exe
  C:\Windows\System\zADJMfS.exe
  2⤵
  PID:9064
- C:\Windows\System\hCOQyXL.exe
  C:\Windows\System\hCOQyXL.exe
  2⤵
  PID:9084
- C:\Windows\System\vsQBIQd.exe
  C:\Windows\System\vsQBIQd.exe
  2⤵
  PID:9100
- C:\Windows\System\QIZyJxl.exe
  C:\Windows\System\QIZyJxl.exe
  2⤵
  PID:9116
- C:\Windows\System\aGgTcqa.exe
  C:\Windows\System\aGgTcqa.exe
  2⤵
  PID:9140
- C:\Windows\System\XPLmsHu.exe
  C:\Windows\System\XPLmsHu.exe
  2⤵
  PID:9156
- C:\Windows\System\TCdltUQ.exe
  C:\Windows\System\TCdltUQ.exe
  2⤵
  PID:9184
- C:\Windows\System\nAQMXDZ.exe
  C:\Windows\System\nAQMXDZ.exe
  2⤵
  PID:9204
- C:\Windows\System\pIulqdn.exe
  C:\Windows\System\pIulqdn.exe
  2⤵
  PID:8244
- C:\Windows\System\wYadkKl.exe
  C:\Windows\System\wYadkKl.exe
  2⤵
  PID:8280
- C:\Windows\System\jJPceyZ.exe
  C:\Windows\System\jJPceyZ.exe
  2⤵
  PID:7696
- C:\Windows\System\pKbJwEQ.exe
  C:\Windows\System\pKbJwEQ.exe
  2⤵
  PID:8316
- C:\Windows\System\jDLqLDO.exe
  C:\Windows\System\jDLqLDO.exe
  2⤵
  PID:8392
- C:\Windows\System\uMYziSY.exe
  C:\Windows\System\uMYziSY.exe
  2⤵
  PID:7676
- C:\Windows\System\XFPjUOK.exe
  C:\Windows\System\XFPjUOK.exe
  2⤵
  PID:8172
- C:\Windows\System\ayzQaYD.exe
  C:\Windows\System\ayzQaYD.exe
  2⤵
  PID:7892
- C:\Windows\System\VZwqOnA.exe
  C:\Windows\System\VZwqOnA.exe
  2⤵
  PID:8220
- C:\Windows\System\ELubjSJ.exe
  C:\Windows\System\ELubjSJ.exe
  2⤵
  PID:8300
- C:\Windows\System\PgpIMhx.exe
  C:\Windows\System\PgpIMhx.exe
  2⤵
  PID:8376
- C:\Windows\System\RKjZIaq.exe
  C:\Windows\System\RKjZIaq.exe
  2⤵
  PID:8480
- C:\Windows\System\twDTJRX.exe
  C:\Windows\System\twDTJRX.exe
  2⤵
  PID:8420
- C:\Windows\System\PTgAQlS.exe
  C:\Windows\System\PTgAQlS.exe
  2⤵
  PID:8472
- C:\Windows\System\gifUAnD.exe
  C:\Windows\System\gifUAnD.exe
  2⤵
  PID:8584
- C:\Windows\System\XWDBfJE.exe
  C:\Windows\System\XWDBfJE.exe
  2⤵
  PID:8656
- C:\Windows\System\dlfkLvl.exe
  C:\Windows\System\dlfkLvl.exe
  2⤵
  PID:8728
- C:\Windows\System\FBlbFSC.exe
  C:\Windows\System\FBlbFSC.exe
  2⤵
  PID:8524
- C:\Windows\System\KDxuXuD.exe
  C:\Windows\System\KDxuXuD.exe
  2⤵
  PID:8568
- C:\Windows\System\GdARXTL.exe
  C:\Windows\System\GdARXTL.exe
  2⤵
  PID:8640
- C:\Windows\System\vyScrdJ.exe
  C:\Windows\System\vyScrdJ.exe
  2⤵
  PID:8680
- C:\Windows\System\hnXyqqF.exe
  C:\Windows\System\hnXyqqF.exe
  2⤵
  PID:8748
- C:\Windows\System\IOpKCka.exe
  C:\Windows\System\IOpKCka.exe
  2⤵
  PID:8808
- C:\Windows\System\WVysvzy.exe
  C:\Windows\System\WVysvzy.exe
  2⤵
  PID:8816
- C:\Windows\System\gjzVjHg.exe
  C:\Windows\System\gjzVjHg.exe
  2⤵
  PID:8852
- C:\Windows\System\nlNJOOs.exe
  C:\Windows\System\nlNJOOs.exe
  2⤵
  PID:8876
- C:\Windows\System\cOfNPzV.exe
  C:\Windows\System\cOfNPzV.exe
  2⤵
  PID:8896
- C:\Windows\System\QdfbZZc.exe
  C:\Windows\System\QdfbZZc.exe
  2⤵
  PID:8912
- C:\Windows\System\DsdwPnQ.exe
  C:\Windows\System\DsdwPnQ.exe
  2⤵
  PID:2812
- C:\Windows\System\lfBKgwB.exe
  C:\Windows\System\lfBKgwB.exe
  2⤵
  PID:8984
- C:\Windows\System\MMSplcC.exe
  C:\Windows\System\MMSplcC.exe
  2⤵
  PID:9052
- C:\Windows\System\yjiMyMD.exe
  C:\Windows\System\yjiMyMD.exe
  2⤵
  PID:9096
- C:\Windows\System\ruxBgef.exe
  C:\Windows\System\ruxBgef.exe
  2⤵
  PID:9132
- C:\Windows\System\frdxUty.exe
  C:\Windows\System\frdxUty.exe
  2⤵
  PID:9168
- C:\Windows\System\foDByiy.exe
  C:\Windows\System\foDByiy.exe
  2⤵
  PID:9180
- C:\Windows\System\YmlbjrJ.exe
  C:\Windows\System\YmlbjrJ.exe
  2⤵
  PID:9036
- C:\Windows\System\vkbqXzb.exe
  C:\Windows\System\vkbqXzb.exe
  2⤵
  PID:9152
- C:\Windows\System\NPajEDN.exe
  C:\Windows\System\NPajEDN.exe
  2⤵
  PID:9080
- C:\Windows\System\OfXDvME.exe
  C:\Windows\System\OfXDvME.exe
  2⤵
  PID:8140
- C:\Windows\System\BtXLAFw.exe
  C:\Windows\System\BtXLAFw.exe
  2⤵
  PID:8204
- C:\Windows\System\yhmxLNR.exe
  C:\Windows\System\yhmxLNR.exe
  2⤵
  PID:7640
- C:\Windows\System\pCpoclF.exe
  C:\Windows\System\pCpoclF.exe
  2⤵
  PID:6964
- C:\Windows\System\GSRnmnJ.exe
  C:\Windows\System\GSRnmnJ.exe
  2⤵
  PID:8440
- C:\Windows\System\MslgbQg.exe
  C:\Windows\System\MslgbQg.exe
  2⤵
  PID:7284
- C:\Windows\System\DVdidsx.exe
  C:\Windows\System\DVdidsx.exe
  2⤵
  PID:8052
- C:\Windows\System\OWLwrJs.exe
  C:\Windows\System\OWLwrJs.exe
  2⤵
  PID:8260
- C:\Windows\System\TXiuEzh.exe
  C:\Windows\System\TXiuEzh.exe
  2⤵
  PID:8460
- C:\Windows\System\wVvzlpj.exe
  C:\Windows\System\wVvzlpj.exe
  2⤵
  PID:6436
- C:\Windows\System\xHeKvFo.exe
  C:\Windows\System\xHeKvFo.exe
  2⤵
  PID:8508
- C:\Windows\System\RnRpqAb.exe
  C:\Windows\System\RnRpqAb.exe
  2⤵
  PID:8548
- C:\Windows\System\zDfnhGj.exe
  C:\Windows\System\zDfnhGj.exe
  2⤵
  PID:8700
- C:\Windows\System\vRTLhIn.exe
  C:\Windows\System\vRTLhIn.exe
  2⤵
  PID:8644
- C:\Windows\System\GWeTMwZ.exe
  C:\Windows\System\GWeTMwZ.exe
  2⤵
  PID:8772
- C:\Windows\System\pZEnibD.exe
  C:\Windows\System\pZEnibD.exe
  2⤵
  PID:8196
- C:\Windows\System\oDEbrKO.exe
  C:\Windows\System\oDEbrKO.exe
  2⤵
  PID:9212
- C:\Windows\System\QYSiVfZ.exe
  C:\Windows\System\QYSiVfZ.exe
  2⤵
  PID:8340
- C:\Windows\System\XOZUDpQ.exe
  C:\Windows\System\XOZUDpQ.exe
  2⤵
  PID:9200
- C:\Windows\System\autTcmU.exe
  C:\Windows\System\autTcmU.exe
  2⤵
  PID:7404
- C:\Windows\System\oepXqzt.exe
  C:\Windows\System\oepXqzt.exe
  2⤵
  PID:8664
- C:\Windows\System\pHEYODI.exe
  C:\Windows\System\pHEYODI.exe
  2⤵
  PID:8676
- C:\Windows\System\OVAWjCy.exe
  C:\Windows\System\OVAWjCy.exe
  2⤵
  PID:8804
- C:\Windows\System\vlEMjwD.exe
  C:\Windows\System\vlEMjwD.exe
  2⤵
  PID:8528
- C:\Windows\System\ZjtfUzI.exe
  C:\Windows\System\ZjtfUzI.exe
  2⤵
  PID:8624
- C:\Windows\System\kJiguDm.exe
  C:\Windows\System\kJiguDm.exe
  2⤵
  PID:8888
- C:\Windows\System\Vdhujdq.exe
  C:\Windows\System\Vdhujdq.exe
  2⤵
  PID:9020
- C:\Windows\System\ctznTPz.exe
  C:\Windows\System\ctznTPz.exe
  2⤵
  PID:8908
- C:\Windows\System\AItpaae.exe
  C:\Windows\System\AItpaae.exe
  2⤵
  PID:8948
- C:\Windows\System\enOJvuT.exe
  C:\Windows\System\enOJvuT.exe
  2⤵
  PID:9076
- C:\Windows\System\ewQBayb.exe
  C:\Windows\System\ewQBayb.exe
  2⤵
  PID:9192
- C:\Windows\System\aBuOPJu.exe
  C:\Windows\System\aBuOPJu.exe
  2⤵
  PID:7956
- C:\Windows\System\dmnIIJN.exe
  C:\Windows\System\dmnIIJN.exe
  2⤵
  PID:8408
- C:\Windows\System\eSZitLk.exe
  C:\Windows\System\eSZitLk.exe
  2⤵
  PID:8604
- C:\Windows\System\IwCervp.exe
  C:\Windows\System\IwCervp.exe
  2⤵
  PID:8608
- C:\Windows\System\WBAjqUL.exe
  C:\Windows\System\WBAjqUL.exe
  2⤵
  PID:8932
- C:\Windows\System\NXyyeKk.exe
  C:\Windows\System\NXyyeKk.exe
  2⤵
  PID:8828
- C:\Windows\System\YRdfWeC.exe
  C:\Windows\System\YRdfWeC.exe
  2⤵
  PID:9128
- C:\Windows\System\YWegwsl.exe
  C:\Windows\System\YWegwsl.exe
  2⤵
  PID:8336
- C:\Windows\System\AhcYTiI.exe
  C:\Windows\System\AhcYTiI.exe
  2⤵
  PID:8544
- C:\Windows\System\xVrnRoB.exe
  C:\Windows\System\xVrnRoB.exe
  2⤵
  PID:8756
- C:\Windows\System\KMudCuA.exe
  C:\Windows\System\KMudCuA.exe
  2⤵
  PID:8884
- C:\Windows\System\DgPzDTH.exe
  C:\Windows\System\DgPzDTH.exe
  2⤵
  PID:9172
- C:\Windows\System\NlmbSmu.exe
  C:\Windows\System\NlmbSmu.exe
  2⤵
  PID:8292
- C:\Windows\System\rKkCNGa.exe
  C:\Windows\System\rKkCNGa.exe
  2⤵
  PID:9000
- C:\Windows\System\ZKJUOoC.exe
  C:\Windows\System\ZKJUOoC.exe
  2⤵
  PID:9092
- C:\Windows\System\mbAasQt.exe
  C:\Windows\System\mbAasQt.exe
  2⤵
  PID:8860
- C:\Windows\System\gsodQeM.exe
  C:\Windows\System\gsodQeM.exe
  2⤵
  PID:8736
- C:\Windows\System\dclXDEa.exe
  C:\Windows\System\dclXDEa.exe
  2⤵
  PID:8324
- C:\Windows\System\yNVttnu.exe
  C:\Windows\System\yNVttnu.exe
  2⤵
  PID:9232
- C:\Windows\System\dpfjQvy.exe
  C:\Windows\System\dpfjQvy.exe
  2⤵
  PID:9256
- C:\Windows\System\lDHlPQM.exe
  C:\Windows\System\lDHlPQM.exe
  2⤵
  PID:9272
- C:\Windows\System\GhcRKGm.exe
  C:\Windows\System\GhcRKGm.exe
  2⤵
  PID:9288
- C:\Windows\System\ETpCCcn.exe
  C:\Windows\System\ETpCCcn.exe
  2⤵
  PID:9308
- C:\Windows\System\TzxqroW.exe
  C:\Windows\System\TzxqroW.exe
  2⤵
  PID:9332
- C:\Windows\System\OuAXtKJ.exe
  C:\Windows\System\OuAXtKJ.exe
  2⤵
  PID:9352
- C:\Windows\System\jCInmNB.exe
  C:\Windows\System\jCInmNB.exe
  2⤵
  PID:9368
- C:\Windows\System\EAIejEK.exe
  C:\Windows\System\EAIejEK.exe
  2⤵
  PID:9404
- C:\Windows\System\HRsIcKu.exe
  C:\Windows\System\HRsIcKu.exe
  2⤵
  PID:9424
- C:\Windows\System\IcvJkzZ.exe
  C:\Windows\System\IcvJkzZ.exe
  2⤵
  PID:9440
- C:\Windows\System\mZspdcu.exe
  C:\Windows\System\mZspdcu.exe
  2⤵
  PID:9460
- C:\Windows\System\fpGHsaz.exe
  C:\Windows\System\fpGHsaz.exe
  2⤵
  PID:9480
- C:\Windows\System\AjPuJgY.exe
  C:\Windows\System\AjPuJgY.exe
  2⤵
  PID:9496
- C:\Windows\System\UWncVbL.exe
  C:\Windows\System\UWncVbL.exe
  2⤵
  PID:9520
- C:\Windows\System\XrrGPbR.exe
  C:\Windows\System\XrrGPbR.exe
  2⤵
  PID:9544
- C:\Windows\System\kvJZKrY.exe
  C:\Windows\System\kvJZKrY.exe
  2⤵
  PID:9560
- C:\Windows\System\POOpqXs.exe
  C:\Windows\System\POOpqXs.exe
  2⤵
  PID:9580
- C:\Windows\System\iKOBJOK.exe
  C:\Windows\System\iKOBJOK.exe
  2⤵
  PID:9604
- C:\Windows\System\AFnwRpS.exe
  C:\Windows\System\AFnwRpS.exe
  2⤵
  PID:9620
- C:\Windows\System\COuIBQV.exe
  C:\Windows\System\COuIBQV.exe
  2⤵
  PID:9636
- C:\Windows\System\CHUKaos.exe
  C:\Windows\System\CHUKaos.exe
  2⤵
  PID:9660
- C:\Windows\System\woDcAjo.exe
  C:\Windows\System\woDcAjo.exe
  2⤵
  PID:9688
- C:\Windows\System\KnDYmWO.exe
  C:\Windows\System\KnDYmWO.exe
  2⤵
  PID:9704
- C:\Windows\System\vqaOFjd.exe
  C:\Windows\System\vqaOFjd.exe
  2⤵
  PID:9720
- C:\Windows\System\VtmCmEW.exe
  C:\Windows\System\VtmCmEW.exe
  2⤵
  PID:9744
- C:\Windows\System\oeWTcVU.exe
  C:\Windows\System\oeWTcVU.exe
  2⤵
  PID:9760
- C:\Windows\System\aQwvyFK.exe
  C:\Windows\System\aQwvyFK.exe
  2⤵
  PID:9780
- C:\Windows\System\DaJCKXB.exe
  C:\Windows\System\DaJCKXB.exe
  2⤵
  PID:9796
- C:\Windows\System\rpCaglF.exe
  C:\Windows\System\rpCaglF.exe
  2⤵
  PID:9812
- C:\Windows\System\LFwPAEy.exe
  C:\Windows\System\LFwPAEy.exe
  2⤵
  PID:9828
- C:\Windows\System\vEfiUxT.exe
  C:\Windows\System\vEfiUxT.exe
  2⤵
  PID:9848
- C:\Windows\System\Tmjuemo.exe
  C:\Windows\System\Tmjuemo.exe
  2⤵
  PID:9872
- C:\Windows\System\lhDqOqU.exe
  C:\Windows\System\lhDqOqU.exe
  2⤵
  PID:9892
- C:\Windows\System\aJaTofs.exe
  C:\Windows\System\aJaTofs.exe
  2⤵
  PID:9916
- C:\Windows\System\RpCFLwv.exe
  C:\Windows\System\RpCFLwv.exe
  2⤵
  PID:9940
- C:\Windows\System\YkxxLWo.exe
  C:\Windows\System\YkxxLWo.exe
  2⤵
  PID:9964
- C:\Windows\System\KjZurIC.exe
  C:\Windows\System\KjZurIC.exe
  2⤵
  PID:9980
- C:\Windows\System\RNBwKkW.exe
  C:\Windows\System\RNBwKkW.exe
  2⤵
  PID:10012
- C:\Windows\System\tuUsqpZ.exe
  C:\Windows\System\tuUsqpZ.exe
  2⤵
  PID:10036
- C:\Windows\System\ytxNEMa.exe
  C:\Windows\System\ytxNEMa.exe
  2⤵
  PID:10052
- C:\Windows\System\kPzmoFp.exe
  C:\Windows\System\kPzmoFp.exe
  2⤵
  PID:10076
- C:\Windows\System\xReFtBs.exe
  C:\Windows\System\xReFtBs.exe
  2⤵
  PID:10092
- C:\Windows\System\xLQafIq.exe
  C:\Windows\System\xLQafIq.exe
  2⤵
  PID:10108
- C:\Windows\System\GSMEWLL.exe
  C:\Windows\System\GSMEWLL.exe
  2⤵
  PID:10128
- C:\Windows\System\FNyNeGz.exe
  C:\Windows\System\FNyNeGz.exe
  2⤵
  PID:10148
- C:\Windows\System\AjDdXAE.exe
  C:\Windows\System\AjDdXAE.exe
  2⤵
  PID:10164
- C:\Windows\System\BZnIIQK.exe
  C:\Windows\System\BZnIIQK.exe
  2⤵
  PID:10188
- C:\Windows\System\nCdsHIo.exe
  C:\Windows\System\nCdsHIo.exe
  2⤵
  PID:10208
- C:\Windows\System\yRzZcWj.exe
  C:\Windows\System\yRzZcWj.exe
  2⤵
  PID:10224
- C:\Windows\System\RGTQGcY.exe
  C:\Windows\System\RGTQGcY.exe
  2⤵
  PID:9240
- C:\Windows\System\bLJZecD.exe
  C:\Windows\System\bLJZecD.exe
  2⤵
  PID:9280
- C:\Windows\System\uXZzEJs.exe
  C:\Windows\System\uXZzEJs.exe
  2⤵
  PID:9324
- C:\Windows\System\DDLOmpj.exe
  C:\Windows\System\DDLOmpj.exe
  2⤵
  PID:9224
- C:\Windows\System\LgObSie.exe
  C:\Windows\System\LgObSie.exe
  2⤵
  PID:9304
- C:\Windows\System\EmOIZAN.exe
  C:\Windows\System\EmOIZAN.exe
  2⤵
  PID:9380
- C:\Windows\System\kNDibNs.exe
  C:\Windows\System\kNDibNs.exe
  2⤵
  PID:1496
- C:\Windows\System\GRWIiGm.exe
  C:\Windows\System\GRWIiGm.exe
  2⤵
  PID:9416
- C:\Windows\System\EcXTIcl.exe
  C:\Windows\System\EcXTIcl.exe
  2⤵
  PID:9492
- C:\Windows\System\cFHqtUZ.exe
  C:\Windows\System\cFHqtUZ.exe
  2⤵
  PID:9512
- C:\Windows\System\mRphJtP.exe
  C:\Windows\System\mRphJtP.exe
  2⤵
  PID:9532
- C:\Windows\System\NQSFUoY.exe
  C:\Windows\System\NQSFUoY.exe
  2⤵
  PID:9616
- C:\Windows\System\tLEbJaT.exe
  C:\Windows\System\tLEbJaT.exe
  2⤵
  PID:9628
- C:\Windows\System\jUjTQjQ.exe
  C:\Windows\System\jUjTQjQ.exe
  2⤵
  PID:9596
- C:\Windows\System\LBRmlAx.exe
  C:\Windows\System\LBRmlAx.exe
  2⤵
  PID:9676
- C:\Windows\System\wqqBNrE.exe
  C:\Windows\System\wqqBNrE.exe
  2⤵
  PID:9732
- C:\Windows\System\QNaFqoY.exe
  C:\Windows\System\QNaFqoY.exe
  2⤵
  PID:9768
- C:\Windows\System\DfyiwEe.exe
  C:\Windows\System\DfyiwEe.exe
  2⤵
  PID:9788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BWVlRan.exe

Filesize
2.3MB

MD5
34a61a80715f3f21b318f73f0736a440

SHA1
58123870ec14e0084f06655dd74e7215bc4ea0b1

SHA256
4e0fcee9f2994b02ee43d68470f5662a02f0ce9744924d84296a4bf5f87dcb39

SHA512
61298bd980b3e59230a1f9a7234724471ae7fd6fea09c176b1164ff97e13ad2ecf5d074495f7b98b3a87d3fa370262acb362de89e81c173618eb9bd5d45da0b4

Download Submit
C:\Windows\system\CpUESEI.exe

Filesize
2.3MB

MD5
aade37f3b02c0b3f9bec774cb3bba9bb

SHA1
07dc333af308b5ca8ab8a7d274324da93e0a0f08

SHA256
d5e5c43c214afbe2d318bc1e63d02c7f3295c5fb78044b7d4d712f3fb4a5e077

SHA512
e96b4ef1beae5758b1bc51271860cfed936bc7d585d01f2e1b2ae0920856c56d39481d8c50addb2b93b0891e1606b0ea00173fc8cc760aa87bde5304fc61732d

Download Submit
C:\Windows\system\CtmwpNi.exe

Filesize
2.3MB

MD5
bb4388d1c98e165307e0b5f97ce160d2

SHA1
ac1c63c3ca7dc91177b1458e3c3274fba615e1fd

SHA256
d2d9a89d36a4b2046495a50f4d0301a33f951cd3cc3c6a3de34401b9eec899e9

SHA512
4dd739f07d6cf013cbd23e6b13157cce72f4cb45f5923a7be7ebfd5f9b1ad2147f530509259761190cd94ceca2ed35237567ceb90cb9ef61cd0998a1a5c866ed

Download Submit
C:\Windows\system\GefVdhU.exe

Filesize
2.3MB

MD5
28d1258db6b66df80201c307f8e8c391

SHA1
bf6e8d008766dd469f397cca52652f49e6b0e9fa

SHA256
c74b9324ebcb70061f5b6977eee81a1269bf8a827d6c769a6886857549fae3a7

SHA512
709ec96dcbada60cd51958037d92a72b1e8edcd12581eabc311a4df953428127982dc1740ceae28205b0f5103ba3d995d3866a2edb887f3e525365a2951c1b85

Download Submit
C:\Windows\system\NOXmkns.exe

Filesize
2.3MB

MD5
2a90669cb9b4b66b976f29f5a84c02a1

SHA1
8546752cd762e511c6a23c5886157f0c7bab2798

SHA256
8e052be1629cb34409e3a712441884a439106e09ca77b7d4f5bd8c520ab2d99a

SHA512
3bcd1bd469240fc277d46ea4ced0e92ea1638f410c8e11671371d31e3bc0075f032334bf31f050bcf958635d4c6658257d13653f13b975deeb55f671e0c3cbe8

Download Submit
C:\Windows\system\RHALBgy.exe

Filesize
2.3MB

MD5
c25e7b9087199cb400baf2735edead0f

SHA1
07b83e00644c94b624361c417fc1b683bccdd9b2

SHA256
980e0b441bc91bc1749a29fe60f8c06ea87e84a079453986c8b6ff5e713abcc7

SHA512
90100704c04d8c59a8dc4ed0dcfeac861d574941f32b62a6021c217352960ae69286faa78b3a05a022a7c9f92753d79cc2bcaaea6dd1d4dbed5ece1cd0a5376a

Download Submit
C:\Windows\system\SNtzdRk.exe

Filesize
2.3MB

MD5
206249f8b2cdc0f522fab7687cf522f3

SHA1
d3f3af111a84fe43345cb6d1ba1251a14d1fa204

SHA256
9fc9f2c091ec15041ada9693e1b8ee4b3b4e7d3360eb11610d1f2cf6f2628d4b

SHA512
a30f12e774be0ea8f6979a12ba2c0e3c37618f3e5b4b2e3ddceaaf781c9fbf1fc2a59a2167f50f083a99a166d4ab578cfb9b31c5c661d113d8e72bcceca7cffa

Download Submit
C:\Windows\system\SzqenvQ.exe

Filesize
2.3MB

MD5
e42cff92ec503426fd5f03729f4de12d

SHA1
f4822a2da90ab61d6d1b2db06407bb1c37c0996c

SHA256
678cbc98fdfec255bcaa5b732215ab99cd670e2ee90f11346fa8bad94aa1ff7a

SHA512
bfe22abc183dfd19140e31f1b2f303fb07d0a14c23fbe2fa23dfd57cd11606a0d2316296d811f6716a17b030c227ff4338974b1c8152d20d901f11b646bed73f

Download Submit
C:\Windows\system\UkZaeiA.exe

Filesize
2.3MB

MD5
5500a3b0de1e9272b04d372cff52d960

SHA1
0e46cfc96e419bc9c080e47b5e3a6ab7bc974612

SHA256
915295264287352dba50c6a9ce2bc0117566be264e70fce03b28bd4de59cd64b

SHA512
9104356b76726701500c6148107e68021da809d5e516be87076f61abe05521cda6e3a499ab5a97504f77ecd7a85b759476b20cb0360a1ab97fbca8febb626215

Download Submit
C:\Windows\system\ZgrieqK.exe

Filesize
2.3MB

MD5
73cc14677be1efd0ea4321e0b1487266

SHA1
e910f19d2640c58dcc43f469c066959c5917563f

SHA256
ff5da61b922ea5a523cee2a79302467b9e136356ad8b695fd371bcf0dfefc96e

SHA512
72916e744e5f72d7800398737d9e9ed3781b83fd188737fcc35e1f0752dcc451a096ea523b99a37425415afb9814bc2eca58e12c309f618d4ee6e27ae2d2ffc8

Download Submit
C:\Windows\system\ZzCDVgz.exe

Filesize
2.3MB

MD5
338c3177ceb473aafe435d05106e65bc

SHA1
350ca97ffdb3023f779675d894782bcd4cd677ac

SHA256
c2745b61a873a4763bd4786a53f80ca0fdcaf586cfed7272b49c20b9088da69c

SHA512
0c399dd5dd5d07925b262517bf59c4108c372bb08d1949896faf94c3b8caa57ca86a100c834f699fe88fe88d1569247c964a507ecd2a6be039c06299eb6cfda0

Download Submit
C:\Windows\system\aBjGFZu.exe

Filesize
2.3MB

MD5
0c8a67d4003a1618e5193d64aff60082

SHA1
47fae1aec41521fabe9ebfdbfe2c367259b7f1b6

SHA256
d311f163ab849bee1b794ccc985392e69b5e37fa245fde966122be0e3964cb9b

SHA512
3fef15775983189c79a5527e12d29998925e6cbbaffefff1de0fb42e886730e91cbe6cb82283dc1544eb1bb6f3706c9188b127ba769332b9335fc2c8c2092e7d

Download Submit
C:\Windows\system\cOBeMdI.exe

Filesize
2.3MB

MD5
e79243700fd20da060629a884a57de70

SHA1
78f9656a0de78624f1645da041f1a8d93e12cbca

SHA256
32ffcccd746aaf1b0fb9f696de0a138d2afd922018813d5bfe976e0bb4a74d3f

SHA512
214aa5ad931849b36f05ae20e1b5f2544fb3927ac638e3f60d011f43c3b891deee7b12c92dc98d6709f5c7b1a5412b5879c13bb68598eda026fe359e2c85c690

Download Submit
C:\Windows\system\iRMeXAF.exe

Filesize
2.3MB

MD5
b0ab0b3c968dd0e1ee0f40f7a4e23c03

SHA1
c7cbf55f120948d89bdedd76aa5b04aed6e87cea

SHA256
f84971b770d63bd42941b681f589a0e91bba33be4cebdf157e437b0467490886

SHA512
ea3890ce73ac90eda9e34be00d67f21c5bf6c6c7f4aff40688db17ed87eb831da8c50a092d18fe442fc48a02c8444baa8ed8004a552323bb62b84cd7dc728511

Download Submit
C:\Windows\system\jRWYvPu.exe

Filesize
2.3MB

MD5
2b1b9153696ede7b539cd547989ae86d

SHA1
fa4ad602cb8452478b8bf27154c84ac0f53dffef

SHA256
ebea13a3a5aee76e0e906ce346a672f9df34a4dce53d4a4e5475930cac93a61f

SHA512
ac41a4758033ef3b83d438d110fa1318f5bfb0de3acf5e447d86bcefb8a177b1e75df5e45722a16247276399a0d2e3b3f03e957c60985eee8d45e516a34dc3ae

Download Submit
C:\Windows\system\pnugBXb.exe

Filesize
2.3MB

MD5
cbcbccc9d4127a4ac738933ce1350a2c

SHA1
0f7caa20aa8d536e4ee81422f53434953b956e29

SHA256
457ed466bfc703e97e27cfb157a311ba06706759c80427808341ce8e1d52645e

SHA512
e08d2405231470a28b51636e043e6e4d13cd5dc119fdc6f0e3b98680a618849d43d7f0af8cae8db0c7c8997fec8c06d1940a073c3bdeb1e3a60883944795aee7

Download Submit
C:\Windows\system\qbcQqYk.exe

Filesize
2.3MB

MD5
3782c5db0d1f9eef4413eb61d0abb715

SHA1
85b226513e8a6aabb5bc5e32f8ee4cd2682702b4

SHA256
0a5ec02b89e8b8cbc319464248f045bef45eb674aad74dfd9b064a56b355a421

SHA512
3584fb2a86ebfcc2ca0ff6fe1beedeaee2bad8a905f97aba14a133b5e65f16ec5338759193d7d28c08846159f8848acad6f84c01980e11dd658c544983c84d5d

Download Submit
C:\Windows\system\rCatWMG.exe

Filesize
2.3MB

MD5
26070f3a5a806cb736d7f52e29decce5

SHA1
a70377df46bc2c6a1189998320610f67971878cb

SHA256
d69f8f093f5761ebc57f649ae951504e703d1724ac0a39c4728f27eaefd33bc8

SHA512
c1b67293f88a5f53961a292e09cccde3af156453c25d29f37ce14165d63dd113b2f6787e8ffe577bcd4227468651f8a023d25fc075733569b960e4c2998b77f9

Download Submit
C:\Windows\system\rDznLNU.exe

Filesize
2.3MB

MD5
bcae872e8a66844d1c5e21bea69c81ba

SHA1
d51e859b1c2e795d7a7f92d4b5dd383a1521475a

SHA256
53325b60f7bc5511d035daa3f01727707cdba60959665eee44740b26d13adc7c

SHA512
206749fe7ae7e369b2bea54f7eef1804a1882a57b9ae5d800851b865717409f2bde11c4659c3bec10a5827c5f3a043ae8a3d063e7ca2ff57d04e14a43609f8da

Download Submit
C:\Windows\system\rbdrEfO.exe

Filesize
2.3MB

MD5
63bfd61b5765961c75a4ee38fdcf0de7

SHA1
ab9e18136425075abac05b28407681245033373b

SHA256
27aa85b212384c5656172643865c39ff1912ceb0db85030fbd5693a09ff5ea60

SHA512
4be8d3dfe45e8c6d705966ab33cc31ed931071819da7ceb4c8f4bf4be7c79a3a42477ee97c1916a22d14b680cfb4c4f668ab8ddc06b24e022edf8105da72444f

Download Submit
C:\Windows\system\rcVPWoL.exe

Filesize
2.3MB

MD5
d041cfcc08a67742916c60d93a46b8c8

SHA1
0d4236550541c6f540c6febe8c602257cc60a590

SHA256
8597f28c19e8c0da975e8869d60b774d0b9bd9211dd23a14c952eef06a2ec564

SHA512
0d6ab7224e5ef30f010f87735b7cda61ed8facc89f4e2d738af1bfb938bb4279a6b7d70d492108ff10f5f5a483d43bb5c97d666e1b6a866c2aebec05b0e6861e

Download Submit
C:\Windows\system\ruxXCeW.exe

Filesize
2.3MB

MD5
2756355eb4dd218aac72fe8259cd5a5e

SHA1
20e8ef326accfe36975c68215d1e4ae8a76dd1f3

SHA256
fac07c35939c0427df8d1171b976482ddaa29f8aa6babbaf8f5708a7f8eca88b

SHA512
dee1017b1684196893e4e2f6a2be4ec0959a81feb5d429b5f75417698229ebaeeec08dedd5f62b7719b30cdc1a61b61f8acc31a5ca25bc64071d66dd90dde598

Download Submit
C:\Windows\system\ufRSkpe.exe

Filesize
2.3MB

MD5
ff51eadc7df3c4aa8faa7f473604f619

SHA1
f7b7628c33ba9fb3c8e0a6343ed7874666b4bcec

SHA256
50b4a4d73e6f60145b4e4e3bc1aee4aa5784ffea2731cf4c19905fae7b729577

SHA512
07f5dc0b36fe1bbcf0217a95a45db46a00e9199f07e3f1173375f0589a7ebacf4d132c432c0206f2a221bc2dfa8e0709faec9e79c88bed8f57ceff7752f7da31

Download Submit
C:\Windows\system\vgSJRUX.exe

Filesize
2.3MB

MD5
8f1c5556e72d31ef8b362efabe970d0e

SHA1
c8baab3409ecc39c1491af084ec9fd219217dec3

SHA256
4702b343c6cca4f25ff6bb55bdd2b5a06ff27b8e67f3f4b0a22789f39f0d72aa

SHA512
7f834624eb2c0f8777c88d047b110bfae1c902b93d03dba426fb81f41fb2376a396472fffab977cae735a6eb0dad055c799be38e689cfd26999a6d49ef1ada2f

Download Submit
C:\Windows\system\xGzFtPu.exe

Filesize
2.3MB

MD5
6bfc28553c59b364a46f7f268ac498aa

SHA1
0451167371b58e636eec9edf055066b9e6bc0bc7

SHA256
4a86d53ebb546f50b9473d03d5c2011227ee5e3170c93cdaa3300e719972a397

SHA512
af992dd224f100d1865f08597c2ba01b83c39ee10f304ada552a6fd5874091638b95dc62b7d45380866a553d51c961b25a36b5ff3b181bc9de0a40b498c378c5

Download Submit
C:\Windows\system\xuLAHWV.exe

Filesize
2.3MB

MD5
abe3b20238620b5e8aaf8d7c764d1c08

SHA1
4862fbbde80a52429ec3f84089c1e3bf938794ca

SHA256
48c8f4859de71dd49919561bca90994c7be6aa5cf5a7a105ed16d3af090e3feb

SHA512
a4e0ed076a2c77691d30b33dbb7ad9f9c30c4842a85fbd4249f7584c70bd9c60d57a39049442e2db4a67ad91ae4c10210dc718ea83c1d9c4a1a2d2990ee4d596

Download Submit
C:\Windows\system\yZCbrQV.exe

Filesize
2.3MB

MD5
72c71b34b94d5240184722f7deeef041

SHA1
1e9f15ce5dfa5883b5b83ae15596927d252efb10

SHA256
ed51c7f7a63a72a88a25023e3f7e32ed8ed26553d25b3a6c343e955d5d818664

SHA512
fcf58f4d726993720c466edf2366855557d09f58d3bbe133ebb819d2f4df5b74a86e53eda01a5306e60a65feb0d30a463b42a8d0b81b361cf6a1e523a4e51d57

Download Submit
\Windows\system\CjxMvgF.exe

Filesize
2.3MB

MD5
442bf70b870909546796501b69b6275e

SHA1
f370ae2ff11adcb0ce4cee7222f60cddd2ac6799

SHA256
8ed7df0141d241bc626fc75c9b6dd04180be4125480c7cd906b38b9ccdd713ec

SHA512
53c97b62393d973b6ca1f15b6f9986106aab2c59f5d5e51d8e01243fb0fbcbf23f290ce7b76bb45b9dc46846981a0b2fa15c7f5cf58418fb6e6ceb3cc1183c52

Download Submit
\Windows\system\JzsSLvp.exe

Filesize
2.3MB

MD5
32c548471bf97ffc0d32dc7a106bf71b

SHA1
50a55dd6a50cbe7185505a9117cc7afe886c2f6e

SHA256
30e0b338ce39ce4d1910f50752bab1343e3d758738db2975e06f49bfed749e80

SHA512
e48e7f09c40473a110ca8099668432906a08e4a9eeab40559b247d20aa8860a5b5431c67b897cc56b5a01c0a581cac6d8274a463b92203e3e2932e218fe45344

Download Submit
\Windows\system\PjniekZ.exe

Filesize
2.3MB

MD5
2c6a5defaf8fe4b56c0eb2c25591a470

SHA1
e60c7cdc0d4f189cc0defe1f420e57e178126182

SHA256
e6527384bec8a8c73fb0f526b2af50bbae8087f7498cb9762dc7c2d6592f8491

SHA512
b68b12a03fdda6b252021a091eef15da97a06eee5533355e95a2577448f7af958451e734e64d1888fa3d2df8bb522448d213a05483493eb662a812b510ef9054

Download Submit
\Windows\system\UnuUIuA.exe

Filesize
2.3MB

MD5
3d1fb7646b5772186160ff056d4c52a0

SHA1
ed17c3c76341b49e7a10a174c72e79751a8fb1bd

SHA256
94c158f6233f5c442e66a11aa1402f2d3c1147cd32bcc978e27e817365d74dbd

SHA512
b0d558bfc270774b7bda9eee0cafc1bfb548ee028a7203cdd399a1a716b59d7794a17076dfed0d9c4f1a81717bdc0d3dfc0953f3e296e2b47461f54a4330bb5d

Download Submit
\Windows\system\stcNhXH.exe

Filesize
2.3MB

MD5
4c1f2e1a69fd6c730bfba9165e32da00

SHA1
da764a681b8b31631d35a29af7462eb850568351

SHA256
359528d1c88bb6588671d3cd6ffa4b6a63a3fb8976b83ce150266744dd8d13f7

SHA512
322aadccd7cc36b1d8b338cf5784fc1d32a25b79d98b4ad92432abb4dc9ae99947c17ba531837ef634abd596df621efeb263dc6c6da68ac162e296331bc046ee

Download Submit
memory/1248-97-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/1248-3279-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/1248-4041-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/1632-4028-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/1632-27-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/1956-64-0x000000013F990000-0x000000013FCE4000-memory.dmp

Filesize
3.3MB

Download
memory/1956-66-0x0000000002050000-0x00000000023A4000-memory.dmp

Filesize
3.3MB

Download
memory/1956-1906-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/1956-2489-0x0000000002050000-0x00000000023A4000-memory.dmp

Filesize
3.3MB

Download
memory/1956-2407-0x000000013F990000-0x000000013FCE4000-memory.dmp

Filesize
3.3MB

Download
memory/1956-1883-0x000000013F400000-0x000000013F754000-memory.dmp

Filesize
3.3MB

Download
memory/1956-96-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/1956-76-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/1956-77-0x000000013F8E0000-0x000000013FC34000-memory.dmp

Filesize
3.3MB

Download
memory/1956-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1956-0-0x000000013FF90000-0x00000001402E4000-memory.dmp

Filesize
3.3MB

Download
memory/1956-30-0x000000013F4D0000-0x000000013F824000-memory.dmp

Filesize
3.3MB

Download
memory/1956-15-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/1956-104-0x000000013FF90000-0x00000001402E4000-memory.dmp

Filesize
3.3MB

Download
memory/1956-32-0x000000013F120000-0x000000013F474000-memory.dmp

Filesize
3.3MB

Download
memory/1956-37-0x000000013FC20000-0x000000013FF74000-memory.dmp

Filesize
3.3MB

Download
memory/1956-48-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/1956-36-0x000000013F400000-0x000000013F754000-memory.dmp

Filesize
3.3MB

Download
memory/1956-94-0x000000013F140000-0x000000013F494000-memory.dmp

Filesize
3.3MB

Download
memory/1956-84-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/2424-4037-0x000000013F8E0000-0x000000013FC34000-memory.dmp

Filesize
3.3MB

Download
memory/2424-69-0x000000013F8E0000-0x000000013FC34000-memory.dmp

Filesize
3.3MB

Download
memory/2428-60-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2428-4033-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2444-78-0x000000013F250000-0x000000013F5A4000-memory.dmp

Filesize
3.3MB

Download
memory/2444-4038-0x000000013F250000-0x000000013F5A4000-memory.dmp

Filesize
3.3MB

Download
memory/2508-4036-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/2508-68-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/2560-75-0x000000013FD80000-0x00000001400D4000-memory.dmp

Filesize
3.3MB

Download
memory/2560-4035-0x000000013FD80000-0x00000001400D4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-4039-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/2576-85-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/2600-35-0x000000013FC20000-0x000000013FF74000-memory.dmp

Filesize
3.3MB

Download
memory/2600-4031-0x000000013FC20000-0x000000013FF74000-memory.dmp

Filesize
3.3MB

Download
memory/2688-52-0x000000013F990000-0x000000013FCE4000-memory.dmp

Filesize
3.3MB

Download
memory/2688-4034-0x000000013F990000-0x000000013FCE4000-memory.dmp

Filesize
3.3MB

Download
memory/2712-4029-0x000000013F400000-0x000000013F754000-memory.dmp

Filesize
3.3MB

Download
memory/2712-29-0x000000013F400000-0x000000013F754000-memory.dmp

Filesize
3.3MB

Download
memory/2776-4032-0x000000013F120000-0x000000013F474000-memory.dmp

Filesize
3.3MB

Download
memory/2776-34-0x000000013F120000-0x000000013F474000-memory.dmp

Filesize
3.3MB

Download
memory/2776-871-0x000000013F120000-0x000000013F474000-memory.dmp

Filesize
3.3MB

Download
memory/2860-95-0x000000013F140000-0x000000013F494000-memory.dmp

Filesize
3.3MB

Download
memory/2860-4040-0x000000013F140000-0x000000013F494000-memory.dmp

Filesize
3.3MB

Download
memory/2984-4030-0x000000013F4D0000-0x000000013F824000-memory.dmp

Filesize
3.3MB

Download
memory/2984-31-0x000000013F4D0000-0x000000013F824000-memory.dmp

Filesize
3.3MB

Download