xmrig | 5ed4441e58f680c65a04870286c064edf3ab21f1e76af7f365e96fbb9fd12bf4

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
Size

1.5MB
MD5

1dc8dce92358d93cec850a9c74389ed0
SHA1

1521953daa71b3f2575ca80671462fa498db823e
SHA256

5ed4441e58f680c65a04870286c064edf3ab21f1e76af7f365e96fbb9fd12bf4
SHA512

981f5259e0b4bade644371aeff779de05f616531a927f487a056f0c6b82c9f4580b676c1cfeb839262cccd5312f0f71d0d4c1c8854f59d5bddb8c52af10b5b8d
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727uROGdN1W/yXK09PK89hHq4CYLom6OO9DwdVnKOqru:ROdWCCi7/rahwNGyX687xWHMTnWu

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/memory/3048-21-0x000000013FBF0000-0x000000013FF41000-memory.dmp	xmrig
behavioral1/memory/2084-22-0x000000013FF00000-0x0000000140251000-memory.dmp	xmrig
behavioral1/memory/2504-42-0x000000013F910000-0x000000013FC61000-memory.dmp	xmrig
behavioral1/memory/1756-39-0x000000013F620000-0x000000013F971000-memory.dmp	xmrig
behavioral1/memory/2492-51-0x000000013FF30000-0x0000000140281000-memory.dmp	xmrig
behavioral1/memory/2264-49-0x000000013FEF0000-0x0000000140241000-memory.dmp	xmrig
behavioral1/memory/2512-83-0x000000013F3A0000-0x000000013F6F1000-memory.dmp	xmrig
behavioral1/memory/2776-104-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/2620-801-0x000000013F210000-0x000000013F561000-memory.dmp	xmrig
behavioral1/memory/2668-799-0x000000013F090000-0x000000013F3E1000-memory.dmp	xmrig
behavioral1/memory/1756-111-0x0000000001EF0000-0x0000000002241000-memory.dmp	xmrig
behavioral1/memory/1756-110-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/2840-106-0x000000013F600000-0x000000013F951000-memory.dmp	xmrig
behavioral1/memory/2712-115-0x000000013F3D0000-0x000000013F721000-memory.dmp	xmrig
behavioral1/memory/1816-103-0x000000013FE00000-0x0000000140151000-memory.dmp	xmrig
behavioral1/memory/2428-90-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/2640-3252-0x000000013F160000-0x000000013F4B1000-memory.dmp	xmrig
behavioral1/memory/2264-3515-0x000000013FEF0000-0x0000000140241000-memory.dmp	xmrig
behavioral1/memory/3048-3541-0x000000013FBF0000-0x000000013FF41000-memory.dmp	xmrig
behavioral1/memory/2668-3572-0x000000013F090000-0x000000013F3E1000-memory.dmp	xmrig
behavioral1/memory/2084-3551-0x000000013FF00000-0x0000000140251000-memory.dmp	xmrig
behavioral1/memory/2504-3591-0x000000013F910000-0x000000013FC61000-memory.dmp	xmrig
behavioral1/memory/2620-3589-0x000000013F210000-0x000000013F561000-memory.dmp	xmrig
behavioral1/memory/2492-3606-0x000000013FF30000-0x0000000140281000-memory.dmp	xmrig
behavioral1/memory/2640-3617-0x000000013F160000-0x000000013F4B1000-memory.dmp	xmrig
behavioral1/memory/2428-3642-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/2512-3655-0x000000013F3A0000-0x000000013F6F1000-memory.dmp	xmrig
behavioral1/memory/2712-3657-0x000000013F3D0000-0x000000013F721000-memory.dmp	xmrig
behavioral1/memory/1816-3661-0x000000013FE00000-0x0000000140151000-memory.dmp	xmrig
behavioral1/memory/2840-3670-0x000000013F600000-0x000000013F951000-memory.dmp	xmrig
behavioral1/memory/2776-3687-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/1756-7412-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2264	FOjLkEG.exe
3048	KkYbYSY.exe
2084	fIHxCZh.exe
2668	JtKzJKg.exe
2620	byWaTle.exe
2504	lVxhzvm.exe
2492	CoObIQw.exe
2640	pDyjZIT.exe
2512	frQkGMf.exe
2428	KHZKnzg.exe
2712	rImRBmH.exe
1816	GfKWaSj.exe
2776	xsiUpST.exe
2840	AwOwCaT.exe
1156	SpGqjCo.exe
2940	NvWuBgv.exe
2172	SQIkayp.exe
1788	vkkQueC.exe
292	UWsSBUc.exe
1340	kMxctnW.exe
2648	CeDOSvq.exe
1560	PUlEnHU.exe
2412	WJJbSBZ.exe
1212	VofyiAF.exe
1516	kvlsFvq.exe
2332	roKbwAS.exe
2892	VgrAczy.exe
2304	jSfTzRl.exe
1964	iZEkhIw.exe
688	cHTYJWq.exe
1480	jVGgWul.exe
608	XhLfdoi.exe
3004	lchwLAc.exe
1912	XlDUKJJ.exe
1624	QsjgBXJ.exe
916	WbMlMvZ.exe
452	xiBybpZ.exe
2440	vRuuxar.exe
2284	OThEdZd.exe
2076	XproDMv.exe
1600	vUaTwjo.exe
2012	uOIOBmq.exe
1628	mWtYOlR.exe
1044	GAAPHKz.exe
2308	gCfMaEP.exe
1872	ZNpdSWH.exe
852	gvjPnSY.exe
2916	KXUhxsT.exe
552	iFtDFhW.exe
1724	Ycaxtkh.exe
572	fWjHCju.exe
2204	pinatAS.exe
3012	QmYDEkL.exe
2224	DMJcBNT.exe
1800	PBaIScb.exe
2376	GBoZjfg.exe
1580	eYVIucd.exe
868	OXUuexE.exe
2064	SiboeuT.exe
2680	vWzgmhe.exe
2608	pCQRslR.exe
1116	Bqiirjo.exe
3056	hwNDQnM.exe
2596	fjfJQqB.exe

Loads dropped DLL 64 IoCs

pid	Process
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1756-0-0x000000013F620000-0x000000013F971000-memory.dmp	upx
behavioral1/files/0x000b000000014323-3.dat	upx
behavioral1/memory/2264-8-0x000000013FEF0000-0x0000000140241000-memory.dmp	upx
behavioral1/files/0x0035000000014588-9.dat	upx
behavioral1/files/0x000700000001480e-13.dat	upx
behavioral1/memory/3048-21-0x000000013FBF0000-0x000000013FF41000-memory.dmp	upx
behavioral1/memory/2084-22-0x000000013FF00000-0x0000000140251000-memory.dmp	upx
behavioral1/files/0x00070000000149e1-23.dat	upx
behavioral1/memory/2668-28-0x000000013F090000-0x000000013F3E1000-memory.dmp	upx
behavioral1/files/0x0007000000014b10-29.dat	upx
behavioral1/files/0x0007000000014b36-38.dat	upx
behavioral1/memory/2504-42-0x000000013F910000-0x000000013FC61000-memory.dmp	upx
behavioral1/memory/1756-39-0x000000013F620000-0x000000013F971000-memory.dmp	upx
behavioral1/memory/2620-36-0x000000013F210000-0x000000013F561000-memory.dmp	upx
behavioral1/files/0x0009000000014dae-43.dat	upx
behavioral1/memory/2492-51-0x000000013FF30000-0x0000000140281000-memory.dmp	upx
behavioral1/memory/2264-49-0x000000013FEF0000-0x0000000140241000-memory.dmp	upx
behavioral1/files/0x0035000000014662-55.dat	upx
behavioral1/memory/2640-58-0x000000013F160000-0x000000013F4B1000-memory.dmp	upx
behavioral1/files/0x0007000000015c85-61.dat	upx
behavioral1/files/0x0006000000015c9c-71.dat	upx
behavioral1/files/0x0006000000015c93-64.dat	upx
behavioral1/files/0x0006000000015cb0-76.dat	upx
behavioral1/memory/1756-78-0x0000000001EF0000-0x0000000002241000-memory.dmp	upx
behavioral1/files/0x0006000000015cbd-84.dat	upx
behavioral1/files/0x0006000000015cce-87.dat	upx
behavioral1/memory/2512-83-0x000000013F3A0000-0x000000013F6F1000-memory.dmp	upx
behavioral1/files/0x0006000000015cd9-91.dat	upx
behavioral1/files/0x0006000000015ce3-97.dat	upx
behavioral1/memory/2776-104-0x000000013F850000-0x000000013FBA1000-memory.dmp	upx
behavioral1/files/0x0006000000015d0c-116.dat	upx
behavioral1/files/0x0006000000015d44-129.dat	upx
behavioral1/files/0x0006000000015d4c-134.dat	upx
behavioral1/files/0x0006000000015e09-139.dat	upx
behavioral1/files/0x0006000000015fa7-152.dat	upx
behavioral1/files/0x00060000000161b3-165.dat	upx
behavioral1/files/0x0006000000016813-189.dat	upx
behavioral1/memory/2620-801-0x000000013F210000-0x000000013F561000-memory.dmp	upx
behavioral1/memory/2668-799-0x000000013F090000-0x000000013F3E1000-memory.dmp	upx
behavioral1/files/0x00060000000165f0-185.dat	upx
behavioral1/files/0x000600000001654a-179.dat	upx
behavioral1/files/0x0006000000016476-175.dat	upx
behavioral1/files/0x00060000000162c9-169.dat	upx
behavioral1/files/0x00060000000160cc-159.dat	upx
behavioral1/files/0x0006000000015f3c-149.dat	upx
behavioral1/files/0x0006000000015e6d-144.dat	upx
behavioral1/files/0x0006000000015d24-124.dat	upx
behavioral1/files/0x0006000000015cf5-121.dat	upx
behavioral1/memory/2840-106-0x000000013F600000-0x000000013F951000-memory.dmp	upx
behavioral1/memory/2712-115-0x000000013F3D0000-0x000000013F721000-memory.dmp	upx
behavioral1/memory/1816-103-0x000000013FE00000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/2428-90-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/2640-3252-0x000000013F160000-0x000000013F4B1000-memory.dmp	upx
behavioral1/memory/2264-3515-0x000000013FEF0000-0x0000000140241000-memory.dmp	upx
behavioral1/memory/3048-3541-0x000000013FBF0000-0x000000013FF41000-memory.dmp	upx
behavioral1/memory/2668-3572-0x000000013F090000-0x000000013F3E1000-memory.dmp	upx
behavioral1/memory/2084-3551-0x000000013FF00000-0x0000000140251000-memory.dmp	upx
behavioral1/memory/2504-3591-0x000000013F910000-0x000000013FC61000-memory.dmp	upx
behavioral1/memory/2620-3589-0x000000013F210000-0x000000013F561000-memory.dmp	upx
behavioral1/memory/2492-3606-0x000000013FF30000-0x0000000140281000-memory.dmp	upx
behavioral1/memory/2640-3617-0x000000013F160000-0x000000013F4B1000-memory.dmp	upx
behavioral1/memory/2428-3642-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/2512-3655-0x000000013F3A0000-0x000000013F6F1000-memory.dmp	upx
behavioral1/memory/2712-3657-0x000000013F3D0000-0x000000013F721000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yQdcLOF.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\iuwDrHe.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\MaYuvmm.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\wShaNPS.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\GMoiZkZ.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\SOVsQZv.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\vwmjWmL.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ZcttHSb.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\PZGclDQ.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\RiiEzUk.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\oyYbRsj.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\tHANext.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\uaTrDep.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\iyvcWGZ.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\kMxctnW.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\gHyRAxq.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\RdTnKkW.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\vfQaGbt.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ZwggyHA.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\HWooKRB.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\kvwQztL.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\WUeyiRq.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\cYvFIYh.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\mIzxfZr.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\eSnKAoR.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\oGqcnHS.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\LTxJxCe.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\pWfLZJc.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\jvDmEew.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\oRtjtzG.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\TvVZxQk.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\txeivmc.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\OoUgvRu.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\LozDVRe.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\bSkRDaR.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\qJItkkp.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\fDEPhQy.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\DtppPMu.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\sxcjnrY.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\lXrwfPj.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\iEMbwNm.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\QsjgBXJ.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\mqsdpuf.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\sdAKECH.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\inqXjMO.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\UPvnuql.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\VJROmBv.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ZMsaAfN.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\wtvstWX.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\JcarYjC.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\XNxAxlJ.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\AvMQsFy.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\egNOSWS.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\AqfxwtZ.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\rwnfurM.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\PzyMFvQ.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ZVhtaPQ.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\yAvgZHq.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\GJVOeMN.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\UFgqgdS.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\SSxJRMb.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\sOfNffl.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\NPDqKsh.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
File created	C:\Windows\System\zcIAyEc.exe	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2264	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	29
PID 1756 wrote to memory of 2264	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	29
PID 1756 wrote to memory of 2264	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	29
PID 1756 wrote to memory of 3048	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	30
PID 1756 wrote to memory of 3048	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	30
PID 1756 wrote to memory of 3048	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	30
PID 1756 wrote to memory of 2084	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	31
PID 1756 wrote to memory of 2084	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	31
PID 1756 wrote to memory of 2084	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	31
PID 1756 wrote to memory of 2668	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	32
PID 1756 wrote to memory of 2668	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	32
PID 1756 wrote to memory of 2668	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	32
PID 1756 wrote to memory of 2620	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	33
PID 1756 wrote to memory of 2620	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	33
PID 1756 wrote to memory of 2620	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	33
PID 1756 wrote to memory of 2504	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	34
PID 1756 wrote to memory of 2504	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	34
PID 1756 wrote to memory of 2504	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	34
PID 1756 wrote to memory of 2492	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	35
PID 1756 wrote to memory of 2492	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	35
PID 1756 wrote to memory of 2492	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	35
PID 1756 wrote to memory of 2640	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	36
PID 1756 wrote to memory of 2640	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	36
PID 1756 wrote to memory of 2640	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	36
PID 1756 wrote to memory of 2512	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	37
PID 1756 wrote to memory of 2512	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	37
PID 1756 wrote to memory of 2512	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	37
PID 1756 wrote to memory of 2428	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	38
PID 1756 wrote to memory of 2428	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	38
PID 1756 wrote to memory of 2428	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	38
PID 1756 wrote to memory of 2712	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	39
PID 1756 wrote to memory of 2712	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	39
PID 1756 wrote to memory of 2712	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	39
PID 1756 wrote to memory of 1816	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	40
PID 1756 wrote to memory of 1816	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	40
PID 1756 wrote to memory of 1816	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	40
PID 1756 wrote to memory of 2776	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	41
PID 1756 wrote to memory of 2776	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	41
PID 1756 wrote to memory of 2776	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	41
PID 1756 wrote to memory of 2840	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	42
PID 1756 wrote to memory of 2840	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	42
PID 1756 wrote to memory of 2840	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	42
PID 1756 wrote to memory of 2940	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	43
PID 1756 wrote to memory of 2940	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	43
PID 1756 wrote to memory of 2940	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	43
PID 1756 wrote to memory of 1156	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	44
PID 1756 wrote to memory of 1156	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	44
PID 1756 wrote to memory of 1156	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	44
PID 1756 wrote to memory of 1788	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	45
PID 1756 wrote to memory of 1788	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	45
PID 1756 wrote to memory of 1788	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	45
PID 1756 wrote to memory of 2172	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	46
PID 1756 wrote to memory of 2172	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	46
PID 1756 wrote to memory of 2172	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	46
PID 1756 wrote to memory of 292	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	47
PID 1756 wrote to memory of 292	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	47
PID 1756 wrote to memory of 292	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	47
PID 1756 wrote to memory of 1340	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	48
PID 1756 wrote to memory of 1340	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	48
PID 1756 wrote to memory of 1340	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	48
PID 1756 wrote to memory of 2648	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	49
PID 1756 wrote to memory of 2648	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	49
PID 1756 wrote to memory of 2648	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	49
PID 1756 wrote to memory of 1560	1756	1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1dc8dce92358d93cec850a9c74389ed0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\System\FOjLkEG.exe
  C:\Windows\System\FOjLkEG.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\KkYbYSY.exe
  C:\Windows\System\KkYbYSY.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\fIHxCZh.exe
  C:\Windows\System\fIHxCZh.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\JtKzJKg.exe
  C:\Windows\System\JtKzJKg.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\byWaTle.exe
  C:\Windows\System\byWaTle.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\lVxhzvm.exe
  C:\Windows\System\lVxhzvm.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\CoObIQw.exe
  C:\Windows\System\CoObIQw.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\pDyjZIT.exe
  C:\Windows\System\pDyjZIT.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\frQkGMf.exe
  C:\Windows\System\frQkGMf.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\KHZKnzg.exe
  C:\Windows\System\KHZKnzg.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\rImRBmH.exe
  C:\Windows\System\rImRBmH.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\GfKWaSj.exe
  C:\Windows\System\GfKWaSj.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\xsiUpST.exe
  C:\Windows\System\xsiUpST.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\AwOwCaT.exe
  C:\Windows\System\AwOwCaT.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\NvWuBgv.exe
  C:\Windows\System\NvWuBgv.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\SpGqjCo.exe
  C:\Windows\System\SpGqjCo.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\vkkQueC.exe
  C:\Windows\System\vkkQueC.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\SQIkayp.exe
  C:\Windows\System\SQIkayp.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\UWsSBUc.exe
  C:\Windows\System\UWsSBUc.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\kMxctnW.exe
  C:\Windows\System\kMxctnW.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\CeDOSvq.exe
  C:\Windows\System\CeDOSvq.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\PUlEnHU.exe
  C:\Windows\System\PUlEnHU.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\WJJbSBZ.exe
  C:\Windows\System\WJJbSBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\VofyiAF.exe
  C:\Windows\System\VofyiAF.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\kvlsFvq.exe
  C:\Windows\System\kvlsFvq.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\roKbwAS.exe
  C:\Windows\System\roKbwAS.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\VgrAczy.exe
  C:\Windows\System\VgrAczy.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\jSfTzRl.exe
  C:\Windows\System\jSfTzRl.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\iZEkhIw.exe
  C:\Windows\System\iZEkhIw.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\cHTYJWq.exe
  C:\Windows\System\cHTYJWq.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\jVGgWul.exe
  C:\Windows\System\jVGgWul.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\XhLfdoi.exe
  C:\Windows\System\XhLfdoi.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\lchwLAc.exe
  C:\Windows\System\lchwLAc.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\XlDUKJJ.exe
  C:\Windows\System\XlDUKJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\QsjgBXJ.exe
  C:\Windows\System\QsjgBXJ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\WbMlMvZ.exe
  C:\Windows\System\WbMlMvZ.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\xiBybpZ.exe
  C:\Windows\System\xiBybpZ.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\vRuuxar.exe
  C:\Windows\System\vRuuxar.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\OThEdZd.exe
  C:\Windows\System\OThEdZd.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\XproDMv.exe
  C:\Windows\System\XproDMv.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\vUaTwjo.exe
  C:\Windows\System\vUaTwjo.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\uOIOBmq.exe
  C:\Windows\System\uOIOBmq.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\mWtYOlR.exe
  C:\Windows\System\mWtYOlR.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\GAAPHKz.exe
  C:\Windows\System\GAAPHKz.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\gCfMaEP.exe
  C:\Windows\System\gCfMaEP.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\ZNpdSWH.exe
  C:\Windows\System\ZNpdSWH.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\gvjPnSY.exe
  C:\Windows\System\gvjPnSY.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\KXUhxsT.exe
  C:\Windows\System\KXUhxsT.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\iFtDFhW.exe
  C:\Windows\System\iFtDFhW.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\Ycaxtkh.exe
  C:\Windows\System\Ycaxtkh.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\fWjHCju.exe
  C:\Windows\System\fWjHCju.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\pinatAS.exe
  C:\Windows\System\pinatAS.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\QmYDEkL.exe
  C:\Windows\System\QmYDEkL.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\DMJcBNT.exe
  C:\Windows\System\DMJcBNT.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\GBoZjfg.exe
  C:\Windows\System\GBoZjfg.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\PBaIScb.exe
  C:\Windows\System\PBaIScb.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\OXUuexE.exe
  C:\Windows\System\OXUuexE.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\eYVIucd.exe
  C:\Windows\System\eYVIucd.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\SiboeuT.exe
  C:\Windows\System\SiboeuT.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\vWzgmhe.exe
  C:\Windows\System\vWzgmhe.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\pCQRslR.exe
  C:\Windows\System\pCQRslR.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\Bqiirjo.exe
  C:\Windows\System\Bqiirjo.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\hwNDQnM.exe
  C:\Windows\System\hwNDQnM.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\fjfJQqB.exe
  C:\Windows\System\fjfJQqB.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\IBjHMjw.exe
  C:\Windows\System\IBjHMjw.exe
  2⤵
  PID:2592
- C:\Windows\System\CRtvswX.exe
  C:\Windows\System\CRtvswX.exe
  2⤵
  PID:2632
- C:\Windows\System\nzsCsll.exe
  C:\Windows\System\nzsCsll.exe
  2⤵
  PID:2140
- C:\Windows\System\tseJBgg.exe
  C:\Windows\System\tseJBgg.exe
  2⤵
  PID:2684
- C:\Windows\System\nfIHCEc.exe
  C:\Windows\System\nfIHCEc.exe
  2⤵
  PID:2636
- C:\Windows\System\zNdXVhx.exe
  C:\Windows\System\zNdXVhx.exe
  2⤵
  PID:1644
- C:\Windows\System\BbaaGoK.exe
  C:\Windows\System\BbaaGoK.exe
  2⤵
  PID:2796
- C:\Windows\System\EcwCkmi.exe
  C:\Windows\System\EcwCkmi.exe
  2⤵
  PID:2960
- C:\Windows\System\PhIQxeg.exe
  C:\Windows\System\PhIQxeg.exe
  2⤵
  PID:2716
- C:\Windows\System\VrJNrbm.exe
  C:\Windows\System\VrJNrbm.exe
  2⤵
  PID:2360
- C:\Windows\System\mndiOTd.exe
  C:\Windows\System\mndiOTd.exe
  2⤵
  PID:2756
- C:\Windows\System\zCJWxIZ.exe
  C:\Windows\System\zCJWxIZ.exe
  2⤵
  PID:2528
- C:\Windows\System\AMirXpH.exe
  C:\Windows\System\AMirXpH.exe
  2⤵
  PID:312
- C:\Windows\System\OuMeVpt.exe
  C:\Windows\System\OuMeVpt.exe
  2⤵
  PID:1844
- C:\Windows\System\AvMQsFy.exe
  C:\Windows\System\AvMQsFy.exe
  2⤵
  PID:2112
- C:\Windows\System\dJhvIuX.exe
  C:\Windows\System\dJhvIuX.exe
  2⤵
  PID:2896
- C:\Windows\System\afjPEFm.exe
  C:\Windows\System\afjPEFm.exe
  2⤵
  PID:2240
- C:\Windows\System\ROkHTMa.exe
  C:\Windows\System\ROkHTMa.exe
  2⤵
  PID:2804
- C:\Windows\System\FjhgSHj.exe
  C:\Windows\System\FjhgSHj.exe
  2⤵
  PID:700
- C:\Windows\System\yAvgZHq.exe
  C:\Windows\System\yAvgZHq.exe
  2⤵
  PID:1476
- C:\Windows\System\gujVGGp.exe
  C:\Windows\System\gujVGGp.exe
  2⤵
  PID:1664
- C:\Windows\System\RYmJDRe.exe
  C:\Windows\System\RYmJDRe.exe
  2⤵
  PID:1760
- C:\Windows\System\hNSTkyy.exe
  C:\Windows\System\hNSTkyy.exe
  2⤵
  PID:412
- C:\Windows\System\iKXFSfd.exe
  C:\Windows\System\iKXFSfd.exe
  2⤵
  PID:1132
- C:\Windows\System\qFxxPKT.exe
  C:\Windows\System\qFxxPKT.exe
  2⤵
  PID:1312
- C:\Windows\System\iOBOOzC.exe
  C:\Windows\System\iOBOOzC.exe
  2⤵
  PID:2116
- C:\Windows\System\jBeBIOS.exe
  C:\Windows\System\jBeBIOS.exe
  2⤵
  PID:1820
- C:\Windows\System\oyYbRsj.exe
  C:\Windows\System\oyYbRsj.exe
  2⤵
  PID:1556
- C:\Windows\System\jtvvJMB.exe
  C:\Windows\System\jtvvJMB.exe
  2⤵
  PID:2944
- C:\Windows\System\wifRAKr.exe
  C:\Windows\System\wifRAKr.exe
  2⤵
  PID:2036
- C:\Windows\System\aJsZALy.exe
  C:\Windows\System\aJsZALy.exe
  2⤵
  PID:1040
- C:\Windows\System\fwMfawI.exe
  C:\Windows\System\fwMfawI.exe
  2⤵
  PID:1160
- C:\Windows\System\lVHBetd.exe
  C:\Windows\System\lVHBetd.exe
  2⤵
  PID:2288
- C:\Windows\System\eVstGqh.exe
  C:\Windows\System\eVstGqh.exe
  2⤵
  PID:980
- C:\Windows\System\LtTKnrJ.exe
  C:\Windows\System\LtTKnrJ.exe
  2⤵
  PID:2996
- C:\Windows\System\vQqkPPY.exe
  C:\Windows\System\vQqkPPY.exe
  2⤵
  PID:1824
- C:\Windows\System\OfYBVaL.exe
  C:\Windows\System\OfYBVaL.exe
  2⤵
  PID:1608
- C:\Windows\System\WTwJCfG.exe
  C:\Windows\System\WTwJCfG.exe
  2⤵
  PID:1744
- C:\Windows\System\tVBWYpY.exe
  C:\Windows\System\tVBWYpY.exe
  2⤵
  PID:2256
- C:\Windows\System\QJBRGur.exe
  C:\Windows\System\QJBRGur.exe
  2⤵
  PID:2272
- C:\Windows\System\TSKxYtS.exe
  C:\Windows\System\TSKxYtS.exe
  2⤵
  PID:2656
- C:\Windows\System\GvRgLxv.exe
  C:\Windows\System\GvRgLxv.exe
  2⤵
  PID:2704
- C:\Windows\System\GKaYKgd.exe
  C:\Windows\System\GKaYKgd.exe
  2⤵
  PID:1752
- C:\Windows\System\TbEqbYL.exe
  C:\Windows\System\TbEqbYL.exe
  2⤵
  PID:2764
- C:\Windows\System\duuxYbH.exe
  C:\Windows\System\duuxYbH.exe
  2⤵
  PID:2740
- C:\Windows\System\UaAtvum.exe
  C:\Windows\System\UaAtvum.exe
  2⤵
  PID:1532
- C:\Windows\System\wsTJlhL.exe
  C:\Windows\System\wsTJlhL.exe
  2⤵
  PID:1528
- C:\Windows\System\bkxtIyY.exe
  C:\Windows\System\bkxtIyY.exe
  2⤵
  PID:2664
- C:\Windows\System\TaPnLGy.exe
  C:\Windows\System\TaPnLGy.exe
  2⤵
  PID:2672
- C:\Windows\System\egNOSWS.exe
  C:\Windows\System\egNOSWS.exe
  2⤵
  PID:3036
- C:\Windows\System\qqkOPqO.exe
  C:\Windows\System\qqkOPqO.exe
  2⤵
  PID:2748
- C:\Windows\System\kYsqRPi.exe
  C:\Windows\System\kYsqRPi.exe
  2⤵
  PID:2720
- C:\Windows\System\nXZeldQ.exe
  C:\Windows\System\nXZeldQ.exe
  2⤵
  PID:2484
- C:\Windows\System\XxHKcuU.exe
  C:\Windows\System\XxHKcuU.exe
  2⤵
  PID:2544
- C:\Windows\System\JJZDqBP.exe
  C:\Windows\System\JJZDqBP.exe
  2⤵
  PID:2964
- C:\Windows\System\LubISyU.exe
  C:\Windows\System\LubISyU.exe
  2⤵
  PID:3008
- C:\Windows\System\HlldRBW.exe
  C:\Windows\System\HlldRBW.exe
  2⤵
  PID:1420
- C:\Windows\System\KSCDqIT.exe
  C:\Windows\System\KSCDqIT.exe
  2⤵
  PID:2536
- C:\Windows\System\KUUxvee.exe
  C:\Windows\System\KUUxvee.exe
  2⤵
  PID:2780
- C:\Windows\System\JWISaZK.exe
  C:\Windows\System\JWISaZK.exe
  2⤵
  PID:628
- C:\Windows\System\oOCxQZi.exe
  C:\Windows\System\oOCxQZi.exe
  2⤵
  PID:2564
- C:\Windows\System\BweGfIv.exe
  C:\Windows\System\BweGfIv.exe
  2⤵
  PID:1252
- C:\Windows\System\dRmQhTR.exe
  C:\Windows\System\dRmQhTR.exe
  2⤵
  PID:392
- C:\Windows\System\xIpUzkH.exe
  C:\Windows\System\xIpUzkH.exe
  2⤵
  PID:1772
- C:\Windows\System\uwPsmfE.exe
  C:\Windows\System\uwPsmfE.exe
  2⤵
  PID:1868
- C:\Windows\System\sIchENE.exe
  C:\Windows\System\sIchENE.exe
  2⤵
  PID:1860
- C:\Windows\System\lDwNKZx.exe
  C:\Windows\System\lDwNKZx.exe
  2⤵
  PID:2072
- C:\Windows\System\FiWIvXa.exe
  C:\Windows\System\FiWIvXa.exe
  2⤵
  PID:936
- C:\Windows\System\qalSWXs.exe
  C:\Windows\System\qalSWXs.exe
  2⤵
  PID:376
- C:\Windows\System\FUSRgUQ.exe
  C:\Windows\System\FUSRgUQ.exe
  2⤵
  PID:2168
- C:\Windows\System\nurmLVi.exe
  C:\Windows\System\nurmLVi.exe
  2⤵
  PID:1344
- C:\Windows\System\AcCYefK.exe
  C:\Windows\System\AcCYefK.exe
  2⤵
  PID:2196
- C:\Windows\System\zOwtCpI.exe
  C:\Windows\System\zOwtCpI.exe
  2⤵
  PID:1572
- C:\Windows\System\igcuMjd.exe
  C:\Windows\System\igcuMjd.exe
  2⤵
  PID:2824
- C:\Windows\System\ujPZkHk.exe
  C:\Windows\System\ujPZkHk.exe
  2⤵
  PID:3052
- C:\Windows\System\oRtjtzG.exe
  C:\Windows\System\oRtjtzG.exe
  2⤵
  PID:652
- C:\Windows\System\YqkpaAo.exe
  C:\Windows\System\YqkpaAo.exe
  2⤵
  PID:1228
- C:\Windows\System\JrAQrKp.exe
  C:\Windows\System\JrAQrKp.exe
  2⤵
  PID:1740
- C:\Windows\System\CaLWGrH.exe
  C:\Windows\System\CaLWGrH.exe
  2⤵
  PID:1216
- C:\Windows\System\LnXHUaO.exe
  C:\Windows\System\LnXHUaO.exe
  2⤵
  PID:2828
- C:\Windows\System\pGEbFxR.exe
  C:\Windows\System\pGEbFxR.exe
  2⤵
  PID:2952
- C:\Windows\System\KRqVQyY.exe
  C:\Windows\System\KRqVQyY.exe
  2⤵
  PID:1916
- C:\Windows\System\zSSdvin.exe
  C:\Windows\System\zSSdvin.exe
  2⤵
  PID:1436
- C:\Windows\System\UwSMgkp.exe
  C:\Windows\System\UwSMgkp.exe
  2⤵
  PID:380
- C:\Windows\System\dsGWuRh.exe
  C:\Windows\System\dsGWuRh.exe
  2⤵
  PID:1588
- C:\Windows\System\vQDPdEL.exe
  C:\Windows\System\vQDPdEL.exe
  2⤵
  PID:988
- C:\Windows\System\dQorctr.exe
  C:\Windows\System\dQorctr.exe
  2⤵
  PID:1976
- C:\Windows\System\xekKeda.exe
  C:\Windows\System\xekKeda.exe
  2⤵
  PID:952
- C:\Windows\System\rbzScqT.exe
  C:\Windows\System\rbzScqT.exe
  2⤵
  PID:3060
- C:\Windows\System\rhUcZdf.exe
  C:\Windows\System\rhUcZdf.exe
  2⤵
  PID:112
- C:\Windows\System\THIFMUj.exe
  C:\Windows\System\THIFMUj.exe
  2⤵
  PID:1248
- C:\Windows\System\vJhIptA.exe
  C:\Windows\System\vJhIptA.exe
  2⤵
  PID:2624
- C:\Windows\System\lQwIFEb.exe
  C:\Windows\System\lQwIFEb.exe
  2⤵
  PID:1056
- C:\Windows\System\AMEfNZb.exe
  C:\Windows\System\AMEfNZb.exe
  2⤵
  PID:1084
- C:\Windows\System\oIvuEKH.exe
  C:\Windows\System\oIvuEKH.exe
  2⤵
  PID:2696
- C:\Windows\System\qVMqeQc.exe
  C:\Windows\System\qVMqeQc.exe
  2⤵
  PID:2540
- C:\Windows\System\iSaOAkh.exe
  C:\Windows\System\iSaOAkh.exe
  2⤵
  PID:792
- C:\Windows\System\QyPByfq.exe
  C:\Windows\System\QyPByfq.exe
  2⤵
  PID:2104
- C:\Windows\System\AsOXlXm.exe
  C:\Windows\System\AsOXlXm.exe
  2⤵
  PID:2652
- C:\Windows\System\lcOnQlq.exe
  C:\Windows\System\lcOnQlq.exe
  2⤵
  PID:768
- C:\Windows\System\GSTUDzl.exe
  C:\Windows\System\GSTUDzl.exe
  2⤵
  PID:1640
- C:\Windows\System\OMQckoQ.exe
  C:\Windows\System\OMQckoQ.exe
  2⤵
  PID:1680
- C:\Windows\System\IMnMyPi.exe
  C:\Windows\System\IMnMyPi.exe
  2⤵
  PID:3024
- C:\Windows\System\osujFbX.exe
  C:\Windows\System\osujFbX.exe
  2⤵
  PID:3032
- C:\Windows\System\bHjpntE.exe
  C:\Windows\System\bHjpntE.exe
  2⤵
  PID:892
- C:\Windows\System\QqyIajI.exe
  C:\Windows\System\QqyIajI.exe
  2⤵
  PID:2068
- C:\Windows\System\PXBTKiu.exe
  C:\Windows\System\PXBTKiu.exe
  2⤵
  PID:592
- C:\Windows\System\sdBBMgy.exe
  C:\Windows\System\sdBBMgy.exe
  2⤵
  PID:2800
- C:\Windows\System\gSpgLZp.exe
  C:\Windows\System\gSpgLZp.exe
  2⤵
  PID:1096
- C:\Windows\System\TvVZxQk.exe
  C:\Windows\System\TvVZxQk.exe
  2⤵
  PID:2924
- C:\Windows\System\xpkYWKg.exe
  C:\Windows\System\xpkYWKg.exe
  2⤵
  PID:2832
- C:\Windows\System\VOwMCAK.exe
  C:\Windows\System\VOwMCAK.exe
  2⤵
  PID:720
- C:\Windows\System\fivTHJx.exe
  C:\Windows\System\fivTHJx.exe
  2⤵
  PID:2348
- C:\Windows\System\ySLhgQY.exe
  C:\Windows\System\ySLhgQY.exe
  2⤵
  PID:1876
- C:\Windows\System\cYIllQr.exe
  C:\Windows\System\cYIllQr.exe
  2⤵
  PID:1968
- C:\Windows\System\cSlrrrl.exe
  C:\Windows\System\cSlrrrl.exe
  2⤵
  PID:1524
- C:\Windows\System\BBWyHur.exe
  C:\Windows\System\BBWyHur.exe
  2⤵
  PID:1584
- C:\Windows\System\LjTUxEN.exe
  C:\Windows\System\LjTUxEN.exe
  2⤵
  PID:2296
- C:\Windows\System\hQsGLBN.exe
  C:\Windows\System\hQsGLBN.exe
  2⤵
  PID:1884
- C:\Windows\System\ZtqfOkR.exe
  C:\Windows\System\ZtqfOkR.exe
  2⤵
  PID:1920
- C:\Windows\System\ljrknqP.exe
  C:\Windows\System\ljrknqP.exe
  2⤵
  PID:2692
- C:\Windows\System\EGOrDoT.exe
  C:\Windows\System\EGOrDoT.exe
  2⤵
  PID:540
- C:\Windows\System\HbbJanV.exe
  C:\Windows\System\HbbJanV.exe
  2⤵
  PID:2452
- C:\Windows\System\QZqSLqQ.exe
  C:\Windows\System\QZqSLqQ.exe
  2⤵
  PID:1432
- C:\Windows\System\ebvwAsR.exe
  C:\Windows\System\ebvwAsR.exe
  2⤵
  PID:1672
- C:\Windows\System\gyQedwB.exe
  C:\Windows\System\gyQedwB.exe
  2⤵
  PID:1152
- C:\Windows\System\eSnKAoR.exe
  C:\Windows\System\eSnKAoR.exe
  2⤵
  PID:3084
- C:\Windows\System\cyDxFSF.exe
  C:\Windows\System\cyDxFSF.exe
  2⤵
  PID:3108
- C:\Windows\System\xSlFmkk.exe
  C:\Windows\System\xSlFmkk.exe
  2⤵
  PID:3128
- C:\Windows\System\lcTCRJx.exe
  C:\Windows\System\lcTCRJx.exe
  2⤵
  PID:3152
- C:\Windows\System\hRqTJkn.exe
  C:\Windows\System\hRqTJkn.exe
  2⤵
  PID:3168
- C:\Windows\System\tgskLjM.exe
  C:\Windows\System\tgskLjM.exe
  2⤵
  PID:3188
- C:\Windows\System\XyqbONW.exe
  C:\Windows\System\XyqbONW.exe
  2⤵
  PID:3212
- C:\Windows\System\DDoRiRd.exe
  C:\Windows\System\DDoRiRd.exe
  2⤵
  PID:3228
- C:\Windows\System\CUVLhAe.exe
  C:\Windows\System\CUVLhAe.exe
  2⤵
  PID:3248
- C:\Windows\System\rpeglMT.exe
  C:\Windows\System\rpeglMT.exe
  2⤵
  PID:3264
- C:\Windows\System\ETeLmBD.exe
  C:\Windows\System\ETeLmBD.exe
  2⤵
  PID:3284
- C:\Windows\System\Vzaigzp.exe
  C:\Windows\System\Vzaigzp.exe
  2⤵
  PID:3300
- C:\Windows\System\pyFbacI.exe
  C:\Windows\System\pyFbacI.exe
  2⤵
  PID:3316
- C:\Windows\System\BbKsAgz.exe
  C:\Windows\System\BbKsAgz.exe
  2⤵
  PID:3340
- C:\Windows\System\mGKuBSi.exe
  C:\Windows\System\mGKuBSi.exe
  2⤵
  PID:3360
- C:\Windows\System\YwxWOdl.exe
  C:\Windows\System\YwxWOdl.exe
  2⤵
  PID:3376
- C:\Windows\System\ZlLVFHI.exe
  C:\Windows\System\ZlLVFHI.exe
  2⤵
  PID:3392
- C:\Windows\System\mqsdpuf.exe
  C:\Windows\System\mqsdpuf.exe
  2⤵
  PID:3408
- C:\Windows\System\TIufkPk.exe
  C:\Windows\System\TIufkPk.exe
  2⤵
  PID:3444
- C:\Windows\System\ZJgWZjD.exe
  C:\Windows\System\ZJgWZjD.exe
  2⤵
  PID:3460
- C:\Windows\System\omtBIZY.exe
  C:\Windows\System\omtBIZY.exe
  2⤵
  PID:3476
- C:\Windows\System\uAiZpHI.exe
  C:\Windows\System\uAiZpHI.exe
  2⤵
  PID:3492
- C:\Windows\System\fDwyuzz.exe
  C:\Windows\System\fDwyuzz.exe
  2⤵
  PID:3512
- C:\Windows\System\tfpVZeb.exe
  C:\Windows\System\tfpVZeb.exe
  2⤵
  PID:3528
- C:\Windows\System\VHkQiFK.exe
  C:\Windows\System\VHkQiFK.exe
  2⤵
  PID:3544
- C:\Windows\System\brPeOns.exe
  C:\Windows\System\brPeOns.exe
  2⤵
  PID:3560
- C:\Windows\System\NpyIbYF.exe
  C:\Windows\System\NpyIbYF.exe
  2⤵
  PID:3576
- C:\Windows\System\updIbOq.exe
  C:\Windows\System\updIbOq.exe
  2⤵
  PID:3592
- C:\Windows\System\ZHlMYGN.exe
  C:\Windows\System\ZHlMYGN.exe
  2⤵
  PID:3612
- C:\Windows\System\NUkCzsM.exe
  C:\Windows\System\NUkCzsM.exe
  2⤵
  PID:3628
- C:\Windows\System\SPNddnC.exe
  C:\Windows\System\SPNddnC.exe
  2⤵
  PID:3644
- C:\Windows\System\bGeuolv.exe
  C:\Windows\System\bGeuolv.exe
  2⤵
  PID:3660
- C:\Windows\System\HznASqm.exe
  C:\Windows\System\HznASqm.exe
  2⤵
  PID:3676
- C:\Windows\System\HYyaLny.exe
  C:\Windows\System\HYyaLny.exe
  2⤵
  PID:3696
- C:\Windows\System\XGvfDcZ.exe
  C:\Windows\System\XGvfDcZ.exe
  2⤵
  PID:3712
- C:\Windows\System\TRxrPkF.exe
  C:\Windows\System\TRxrPkF.exe
  2⤵
  PID:3728
- C:\Windows\System\INMTMyJ.exe
  C:\Windows\System\INMTMyJ.exe
  2⤵
  PID:3744
- C:\Windows\System\PzGTgJc.exe
  C:\Windows\System\PzGTgJc.exe
  2⤵
  PID:3760
- C:\Windows\System\ELZUxnx.exe
  C:\Windows\System\ELZUxnx.exe
  2⤵
  PID:3780
- C:\Windows\System\LJwjJgV.exe
  C:\Windows\System\LJwjJgV.exe
  2⤵
  PID:3796
- C:\Windows\System\nGtfdfb.exe
  C:\Windows\System\nGtfdfb.exe
  2⤵
  PID:3812
- C:\Windows\System\yPCBUPc.exe
  C:\Windows\System\yPCBUPc.exe
  2⤵
  PID:3828
- C:\Windows\System\IgZZzWg.exe
  C:\Windows\System\IgZZzWg.exe
  2⤵
  PID:3848
- C:\Windows\System\Judfssr.exe
  C:\Windows\System\Judfssr.exe
  2⤵
  PID:3864
- C:\Windows\System\HzNdqcx.exe
  C:\Windows\System\HzNdqcx.exe
  2⤵
  PID:3880
- C:\Windows\System\xnidQKQ.exe
  C:\Windows\System\xnidQKQ.exe
  2⤵
  PID:3896
- C:\Windows\System\qNyqqbj.exe
  C:\Windows\System\qNyqqbj.exe
  2⤵
  PID:3916
- C:\Windows\System\lMmeqzN.exe
  C:\Windows\System\lMmeqzN.exe
  2⤵
  PID:3932
- C:\Windows\System\tuiLAxJ.exe
  C:\Windows\System\tuiLAxJ.exe
  2⤵
  PID:4048
- C:\Windows\System\RzLRxBq.exe
  C:\Windows\System\RzLRxBq.exe
  2⤵
  PID:4064
- C:\Windows\System\AODksSX.exe
  C:\Windows\System\AODksSX.exe
  2⤵
  PID:4080
- C:\Windows\System\siIYJJQ.exe
  C:\Windows\System\siIYJJQ.exe
  2⤵
  PID:1980
- C:\Windows\System\wTbKaTc.exe
  C:\Windows\System\wTbKaTc.exe
  2⤵
  PID:3080
- C:\Windows\System\kvwQztL.exe
  C:\Windows\System\kvwQztL.exe
  2⤵
  PID:3124
- C:\Windows\System\AWCmiSz.exe
  C:\Windows\System\AWCmiSz.exe
  2⤵
  PID:3148
- C:\Windows\System\HDUzIwF.exe
  C:\Windows\System\HDUzIwF.exe
  2⤵
  PID:3176
- C:\Windows\System\VrslOyi.exe
  C:\Windows\System\VrslOyi.exe
  2⤵
  PID:3204
- C:\Windows\System\OxdkCmk.exe
  C:\Windows\System\OxdkCmk.exe
  2⤵
  PID:3236
- C:\Windows\System\qhLhrRI.exe
  C:\Windows\System\qhLhrRI.exe
  2⤵
  PID:3256
- C:\Windows\System\IHRTfYY.exe
  C:\Windows\System\IHRTfYY.exe
  2⤵
  PID:3280
- C:\Windows\System\OfeXQDu.exe
  C:\Windows\System\OfeXQDu.exe
  2⤵
  PID:3296
- C:\Windows\System\WUeyiRq.exe
  C:\Windows\System\WUeyiRq.exe
  2⤵
  PID:3432
- C:\Windows\System\qePynTJ.exe
  C:\Windows\System\qePynTJ.exe
  2⤵
  PID:3400
- C:\Windows\System\YvTPJce.exe
  C:\Windows\System\YvTPJce.exe
  2⤵
  PID:3484
- C:\Windows\System\mWGUhTl.exe
  C:\Windows\System\mWGUhTl.exe
  2⤵
  PID:3552
- C:\Windows\System\KJTtIzd.exe
  C:\Windows\System\KJTtIzd.exe
  2⤵
  PID:3500
- C:\Windows\System\sAMHdvL.exe
  C:\Windows\System\sAMHdvL.exe
  2⤵
  PID:3620
- C:\Windows\System\ridClSE.exe
  C:\Windows\System\ridClSE.exe
  2⤵
  PID:3540
- C:\Windows\System\QxwYHMv.exe
  C:\Windows\System\QxwYHMv.exe
  2⤵
  PID:3656
- C:\Windows\System\xWDxqZF.exe
  C:\Windows\System\xWDxqZF.exe
  2⤵
  PID:3940
- C:\Windows\System\qPlfGAo.exe
  C:\Windows\System\qPlfGAo.exe
  2⤵
  PID:3672
- C:\Windows\System\tSDYdfO.exe
  C:\Windows\System\tSDYdfO.exe
  2⤵
  PID:3844
- C:\Windows\System\BOEYehp.exe
  C:\Windows\System\BOEYehp.exe
  2⤵
  PID:3908
- C:\Windows\System\YTSPAxh.exe
  C:\Windows\System\YTSPAxh.exe
  2⤵
  PID:3952
- C:\Windows\System\cgkarjZ.exe
  C:\Windows\System\cgkarjZ.exe
  2⤵
  PID:3988
- C:\Windows\System\fQTwBnS.exe
  C:\Windows\System\fQTwBnS.exe
  2⤵
  PID:4004
- C:\Windows\System\iKZINnV.exe
  C:\Windows\System\iKZINnV.exe
  2⤵
  PID:4028
- C:\Windows\System\jEpTFjq.exe
  C:\Windows\System\jEpTFjq.exe
  2⤵
  PID:4040
- C:\Windows\System\THzpfAp.exe
  C:\Windows\System\THzpfAp.exe
  2⤵
  PID:3788
- C:\Windows\System\HYvmARY.exe
  C:\Windows\System\HYvmARY.exe
  2⤵
  PID:3928
- C:\Windows\System\zUkdrIE.exe
  C:\Windows\System\zUkdrIE.exe
  2⤵
  PID:4092
- C:\Windows\System\fYEKeJx.exe
  C:\Windows\System\fYEKeJx.exe
  2⤵
  PID:3136
- C:\Windows\System\SmhJNbi.exe
  C:\Windows\System\SmhJNbi.exe
  2⤵
  PID:3244
- C:\Windows\System\uQcajcb.exe
  C:\Windows\System\uQcajcb.exe
  2⤵
  PID:3096
- C:\Windows\System\DUMjODP.exe
  C:\Windows\System\DUMjODP.exe
  2⤵
  PID:3164
- C:\Windows\System\swrXIka.exe
  C:\Windows\System\swrXIka.exe
  2⤵
  PID:3328
- C:\Windows\System\zgmhCtB.exe
  C:\Windows\System\zgmhCtB.exe
  2⤵
  PID:3368
- C:\Windows\System\DtppPMu.exe
  C:\Windows\System\DtppPMu.exe
  2⤵
  PID:3388
- C:\Windows\System\peQZKvN.exe
  C:\Windows\System\peQZKvN.exe
  2⤵
  PID:3436
- C:\Windows\System\OutNuQQ.exe
  C:\Windows\System\OutNuQQ.exe
  2⤵
  PID:3524
- C:\Windows\System\GLGWEUn.exe
  C:\Windows\System\GLGWEUn.exe
  2⤵
  PID:3688
- C:\Windows\System\zDurmop.exe
  C:\Windows\System\zDurmop.exe
  2⤵
  PID:3372
- C:\Windows\System\JAiVIko.exe
  C:\Windows\System\JAiVIko.exe
  2⤵
  PID:3808
- C:\Windows\System\TTYpQMv.exe
  C:\Windows\System\TTYpQMv.exe
  2⤵
  PID:3836
- C:\Windows\System\hBdbAxq.exe
  C:\Windows\System\hBdbAxq.exe
  2⤵
  PID:3608
- C:\Windows\System\rDeCiid.exe
  C:\Windows\System\rDeCiid.exe
  2⤵
  PID:3740
- C:\Windows\System\FxgnCMZ.exe
  C:\Windows\System\FxgnCMZ.exe
  2⤵
  PID:3944
- C:\Windows\System\aRkOYeg.exe
  C:\Windows\System\aRkOYeg.exe
  2⤵
  PID:3824
- C:\Windows\System\MVYeYiD.exe
  C:\Windows\System\MVYeYiD.exe
  2⤵
  PID:3856
- C:\Windows\System\hSnMXIc.exe
  C:\Windows\System\hSnMXIc.exe
  2⤵
  PID:3196
- C:\Windows\System\VfqwuVl.exe
  C:\Windows\System\VfqwuVl.exe
  2⤵
  PID:3092
- C:\Windows\System\tHQYtSA.exe
  C:\Windows\System\tHQYtSA.exe
  2⤵
  PID:3424
- C:\Windows\System\oGqcnHS.exe
  C:\Windows\System\oGqcnHS.exe
  2⤵
  PID:3776
- C:\Windows\System\rGuwcJt.exe
  C:\Windows\System\rGuwcJt.exe
  2⤵
  PID:3772
- C:\Windows\System\aDhvbwM.exe
  C:\Windows\System\aDhvbwM.exe
  2⤵
  PID:3308
- C:\Windows\System\mBttnQz.exe
  C:\Windows\System\mBttnQz.exe
  2⤵
  PID:3276
- C:\Windows\System\xgIVKdA.exe
  C:\Windows\System\xgIVKdA.exe
  2⤵
  PID:3520
- C:\Windows\System\sjEIzKi.exe
  C:\Windows\System\sjEIzKi.exe
  2⤵
  PID:3976
- C:\Windows\System\hrPluuk.exe
  C:\Windows\System\hrPluuk.exe
  2⤵
  PID:3996
- C:\Windows\System\aclZqOJ.exe
  C:\Windows\System\aclZqOJ.exe
  2⤵
  PID:4024
- C:\Windows\System\lhDalFj.exe
  C:\Windows\System\lhDalFj.exe
  2⤵
  PID:3708
- C:\Windows\System\Jkhspol.exe
  C:\Windows\System\Jkhspol.exe
  2⤵
  PID:3892
- C:\Windows\System\iiCvBNY.exe
  C:\Windows\System\iiCvBNY.exe
  2⤵
  PID:2588
- C:\Windows\System\odlKIei.exe
  C:\Windows\System\odlKIei.exe
  2⤵
  PID:4108
- C:\Windows\System\dyhhgAw.exe
  C:\Windows\System\dyhhgAw.exe
  2⤵
  PID:4152
- C:\Windows\System\kjUUviM.exe
  C:\Windows\System\kjUUviM.exe
  2⤵
  PID:4188
- C:\Windows\System\OzRpckb.exe
  C:\Windows\System\OzRpckb.exe
  2⤵
  PID:4204
- C:\Windows\System\kZIypQs.exe
  C:\Windows\System\kZIypQs.exe
  2⤵
  PID:4220
- C:\Windows\System\pAYsEqQ.exe
  C:\Windows\System\pAYsEqQ.exe
  2⤵
  PID:4240
- C:\Windows\System\ccCWRak.exe
  C:\Windows\System\ccCWRak.exe
  2⤵
  PID:4256
- C:\Windows\System\hxNZMFG.exe
  C:\Windows\System\hxNZMFG.exe
  2⤵
  PID:4276
- C:\Windows\System\UHzoyDc.exe
  C:\Windows\System\UHzoyDc.exe
  2⤵
  PID:4292
- C:\Windows\System\UeXZJtz.exe
  C:\Windows\System\UeXZJtz.exe
  2⤵
  PID:4308
- C:\Windows\System\auAZcLS.exe
  C:\Windows\System\auAZcLS.exe
  2⤵
  PID:4324
- C:\Windows\System\rZkgimU.exe
  C:\Windows\System\rZkgimU.exe
  2⤵
  PID:4340
- C:\Windows\System\EmCSUiv.exe
  C:\Windows\System\EmCSUiv.exe
  2⤵
  PID:4392
- C:\Windows\System\gqTmvmO.exe
  C:\Windows\System\gqTmvmO.exe
  2⤵
  PID:4408
- C:\Windows\System\dFvVHbK.exe
  C:\Windows\System\dFvVHbK.exe
  2⤵
  PID:4424
- C:\Windows\System\jfuMxEb.exe
  C:\Windows\System\jfuMxEb.exe
  2⤵
  PID:4440
- C:\Windows\System\arjUPsK.exe
  C:\Windows\System\arjUPsK.exe
  2⤵
  PID:4456
- C:\Windows\System\vKIiNAN.exe
  C:\Windows\System\vKIiNAN.exe
  2⤵
  PID:4476
- C:\Windows\System\olWpaOQ.exe
  C:\Windows\System\olWpaOQ.exe
  2⤵
  PID:4492
- C:\Windows\System\oypzyaT.exe
  C:\Windows\System\oypzyaT.exe
  2⤵
  PID:4516
- C:\Windows\System\tHANext.exe
  C:\Windows\System\tHANext.exe
  2⤵
  PID:4532
- C:\Windows\System\bnkKnJb.exe
  C:\Windows\System\bnkKnJb.exe
  2⤵
  PID:4552
- C:\Windows\System\QsQZPTG.exe
  C:\Windows\System\QsQZPTG.exe
  2⤵
  PID:4568
- C:\Windows\System\cnoKtnP.exe
  C:\Windows\System\cnoKtnP.exe
  2⤵
  PID:4584
- C:\Windows\System\zcYwjhM.exe
  C:\Windows\System\zcYwjhM.exe
  2⤵
  PID:4604
- C:\Windows\System\RMgBbTy.exe
  C:\Windows\System\RMgBbTy.exe
  2⤵
  PID:4620
- C:\Windows\System\ffbpWKc.exe
  C:\Windows\System\ffbpWKc.exe
  2⤵
  PID:4636
- C:\Windows\System\tLVnnzP.exe
  C:\Windows\System\tLVnnzP.exe
  2⤵
  PID:4652
- C:\Windows\System\ouUhUbl.exe
  C:\Windows\System\ouUhUbl.exe
  2⤵
  PID:4668
- C:\Windows\System\VKQnmFV.exe
  C:\Windows\System\VKQnmFV.exe
  2⤵
  PID:4756
- C:\Windows\System\WQvBoDu.exe
  C:\Windows\System\WQvBoDu.exe
  2⤵
  PID:4776
- C:\Windows\System\OCWdjfU.exe
  C:\Windows\System\OCWdjfU.exe
  2⤵
  PID:4792
- C:\Windows\System\ruQlrAY.exe
  C:\Windows\System\ruQlrAY.exe
  2⤵
  PID:4808
- C:\Windows\System\JTKWMUf.exe
  C:\Windows\System\JTKWMUf.exe
  2⤵
  PID:4824
- C:\Windows\System\tLgwgxI.exe
  C:\Windows\System\tLgwgxI.exe
  2⤵
  PID:4840
- C:\Windows\System\IQicQwC.exe
  C:\Windows\System\IQicQwC.exe
  2⤵
  PID:4860
- C:\Windows\System\ePGpFqX.exe
  C:\Windows\System\ePGpFqX.exe
  2⤵
  PID:4892
- C:\Windows\System\aTuyWTN.exe
  C:\Windows\System\aTuyWTN.exe
  2⤵
  PID:4916
- C:\Windows\System\FMBUHxR.exe
  C:\Windows\System\FMBUHxR.exe
  2⤵
  PID:4932
- C:\Windows\System\loRXALX.exe
  C:\Windows\System\loRXALX.exe
  2⤵
  PID:4948
- C:\Windows\System\AXzGCdQ.exe
  C:\Windows\System\AXzGCdQ.exe
  2⤵
  PID:4968
- C:\Windows\System\oIHtnJg.exe
  C:\Windows\System\oIHtnJg.exe
  2⤵
  PID:4984
- C:\Windows\System\OvmdBVe.exe
  C:\Windows\System\OvmdBVe.exe
  2⤵
  PID:5004
- C:\Windows\System\wvdJpdJ.exe
  C:\Windows\System\wvdJpdJ.exe
  2⤵
  PID:5024
- C:\Windows\System\BNYneVe.exe
  C:\Windows\System\BNYneVe.exe
  2⤵
  PID:5044
- C:\Windows\System\qwQVJMQ.exe
  C:\Windows\System\qwQVJMQ.exe
  2⤵
  PID:5080
- C:\Windows\System\oYWKRaz.exe
  C:\Windows\System\oYWKRaz.exe
  2⤵
  PID:5100
- C:\Windows\System\MLniwfT.exe
  C:\Windows\System\MLniwfT.exe
  2⤵
  PID:5116
- C:\Windows\System\TzBslVb.exe
  C:\Windows\System\TzBslVb.exe
  2⤵
  PID:3468
- C:\Windows\System\ppTtImh.exe
  C:\Windows\System\ppTtImh.exe
  2⤵
  PID:4076
- C:\Windows\System\YQzwojA.exe
  C:\Windows\System\YQzwojA.exe
  2⤵
  PID:3272
- C:\Windows\System\AbfVhsN.exe
  C:\Windows\System\AbfVhsN.exe
  2⤵
  PID:4000
- C:\Windows\System\fifFdsw.exe
  C:\Windows\System\fifFdsw.exe
  2⤵
  PID:3640
- C:\Windows\System\SGiGZHk.exe
  C:\Windows\System\SGiGZHk.exe
  2⤵
  PID:3180
- C:\Windows\System\bqlZMco.exe
  C:\Windows\System\bqlZMco.exe
  2⤵
  PID:4120
- C:\Windows\System\pVKnPPn.exe
  C:\Windows\System\pVKnPPn.exe
  2⤵
  PID:4140
- C:\Windows\System\wQjYeQj.exe
  C:\Windows\System\wQjYeQj.exe
  2⤵
  PID:4164
- C:\Windows\System\uwFfGhf.exe
  C:\Windows\System\uwFfGhf.exe
  2⤵
  PID:4168
- C:\Windows\System\oqyFifT.exe
  C:\Windows\System\oqyFifT.exe
  2⤵
  PID:4228
- C:\Windows\System\dCswXTV.exe
  C:\Windows\System\dCswXTV.exe
  2⤵
  PID:4252
- C:\Windows\System\YBmCmHZ.exe
  C:\Windows\System\YBmCmHZ.exe
  2⤵
  PID:4320
- C:\Windows\System\bSOtUSE.exe
  C:\Windows\System\bSOtUSE.exe
  2⤵
  PID:4352
- C:\Windows\System\oMZGOrN.exe
  C:\Windows\System\oMZGOrN.exe
  2⤵
  PID:4368
- C:\Windows\System\PynHkvn.exe
  C:\Windows\System\PynHkvn.exe
  2⤵
  PID:4400
- C:\Windows\System\dspBbLA.exe
  C:\Windows\System\dspBbLA.exe
  2⤵
  PID:4448
- C:\Windows\System\etIXzYt.exe
  C:\Windows\System\etIXzYt.exe
  2⤵
  PID:4468
- C:\Windows\System\iJQjgfi.exe
  C:\Windows\System\iJQjgfi.exe
  2⤵
  PID:4508
- C:\Windows\System\aCzAhKk.exe
  C:\Windows\System\aCzAhKk.exe
  2⤵
  PID:4540
- C:\Windows\System\pVZYlJt.exe
  C:\Windows\System\pVZYlJt.exe
  2⤵
  PID:4596
- C:\Windows\System\tXiBWtu.exe
  C:\Windows\System\tXiBWtu.exe
  2⤵
  PID:4524
- C:\Windows\System\oYhORBG.exe
  C:\Windows\System\oYhORBG.exe
  2⤵
  PID:4676
- C:\Windows\System\JfrZDRW.exe
  C:\Windows\System\JfrZDRW.exe
  2⤵
  PID:4688
- C:\Windows\System\laEyiot.exe
  C:\Windows\System\laEyiot.exe
  2⤵
  PID:4708
- C:\Windows\System\iXtLRjG.exe
  C:\Windows\System\iXtLRjG.exe
  2⤵
  PID:4732
- C:\Windows\System\inVuZGN.exe
  C:\Windows\System\inVuZGN.exe
  2⤵
  PID:4740
- C:\Windows\System\bFNTRZb.exe
  C:\Windows\System\bFNTRZb.exe
  2⤵
  PID:4772
- C:\Windows\System\zMjIQNz.exe
  C:\Windows\System\zMjIQNz.exe
  2⤵
  PID:4800
- C:\Windows\System\QwJlYwI.exe
  C:\Windows\System\QwJlYwI.exe
  2⤵
  PID:4832
- C:\Windows\System\NBMrsHZ.exe
  C:\Windows\System\NBMrsHZ.exe
  2⤵
  PID:4804
- C:\Windows\System\UPvnuql.exe
  C:\Windows\System\UPvnuql.exe
  2⤵
  PID:4888
- C:\Windows\System\VuhyaFQ.exe
  C:\Windows\System\VuhyaFQ.exe
  2⤵
  PID:4924
- C:\Windows\System\qDRhAbX.exe
  C:\Windows\System\qDRhAbX.exe
  2⤵
  PID:4944
- C:\Windows\System\bmyVmFN.exe
  C:\Windows\System\bmyVmFN.exe
  2⤵
  PID:4980
- C:\Windows\System\HMelgNk.exe
  C:\Windows\System\HMelgNk.exe
  2⤵
  PID:5016
- C:\Windows\System\NDdvdTs.exe
  C:\Windows\System\NDdvdTs.exe
  2⤵
  PID:5056
- C:\Windows\System\mUljvDM.exe
  C:\Windows\System\mUljvDM.exe
  2⤵
  PID:5076
- C:\Windows\System\yahqbgF.exe
  C:\Windows\System\yahqbgF.exe
  2⤵
  PID:5092
- C:\Windows\System\boVpmzU.exe
  C:\Windows\System\boVpmzU.exe
  2⤵
  PID:3964
- C:\Windows\System\AGeMTcY.exe
  C:\Windows\System\AGeMTcY.exe
  2⤵
  PID:3840
- C:\Windows\System\OshAIMu.exe
  C:\Windows\System\OshAIMu.exe
  2⤵
  PID:2388
- C:\Windows\System\xvDgfYv.exe
  C:\Windows\System\xvDgfYv.exe
  2⤵
  PID:4044
- C:\Windows\System\yjAdiyW.exe
  C:\Windows\System\yjAdiyW.exe
  2⤵
  PID:4248
- C:\Windows\System\iHZRJdP.exe
  C:\Windows\System\iHZRJdP.exe
  2⤵
  PID:4200
- C:\Windows\System\yCrLueT.exe
  C:\Windows\System\yCrLueT.exe
  2⤵
  PID:4316
- C:\Windows\System\NYTymvv.exe
  C:\Windows\System\NYTymvv.exe
  2⤵
  PID:4356
- C:\Windows\System\pchmUoC.exe
  C:\Windows\System\pchmUoC.exe
  2⤵
  PID:4388
- C:\Windows\System\djeLoOc.exe
  C:\Windows\System\djeLoOc.exe
  2⤵
  PID:4464
- C:\Windows\System\gkvFtDD.exe
  C:\Windows\System\gkvFtDD.exe
  2⤵
  PID:4580
- C:\Windows\System\nxvseui.exe
  C:\Windows\System\nxvseui.exe
  2⤵
  PID:4628
- C:\Windows\System\zdLAZFH.exe
  C:\Windows\System\zdLAZFH.exe
  2⤵
  PID:4644
- C:\Windows\System\YVmkgSP.exe
  C:\Windows\System\YVmkgSP.exe
  2⤵
  PID:4700
- C:\Windows\System\nAmCrAd.exe
  C:\Windows\System\nAmCrAd.exe
  2⤵
  PID:4724
- C:\Windows\System\YtrJObr.exe
  C:\Windows\System\YtrJObr.exe
  2⤵
  PID:4716
- C:\Windows\System\VuEWBUI.exe
  C:\Windows\System\VuEWBUI.exe
  2⤵
  PID:5000
- C:\Windows\System\gBDxCeO.exe
  C:\Windows\System\gBDxCeO.exe
  2⤵
  PID:4912
- C:\Windows\System\OdNZUss.exe
  C:\Windows\System\OdNZUss.exe
  2⤵
  PID:5060
- C:\Windows\System\jZtlohv.exe
  C:\Windows\System\jZtlohv.exe
  2⤵
  PID:5064
- C:\Windows\System\ZMgcFym.exe
  C:\Windows\System\ZMgcFym.exe
  2⤵
  PID:5012
- C:\Windows\System\ofGjDRH.exe
  C:\Windows\System\ofGjDRH.exe
  2⤵
  PID:4876
- C:\Windows\System\yxSNJKW.exe
  C:\Windows\System\yxSNJKW.exe
  2⤵
  PID:3972
- C:\Windows\System\Upcuzbc.exe
  C:\Windows\System\Upcuzbc.exe
  2⤵
  PID:4160
- C:\Windows\System\HxqiJhk.exe
  C:\Windows\System\HxqiJhk.exe
  2⤵
  PID:4300
- C:\Windows\System\anCtmPY.exe
  C:\Windows\System\anCtmPY.exe
  2⤵
  PID:4380
- C:\Windows\System\GsWgSfm.exe
  C:\Windows\System\GsWgSfm.exe
  2⤵
  PID:4768
- C:\Windows\System\SoDGdbK.exe
  C:\Windows\System\SoDGdbK.exe
  2⤵
  PID:4560
- C:\Windows\System\aFCosOr.exe
  C:\Windows\System\aFCosOr.exe
  2⤵
  PID:4684
- C:\Windows\System\OguzmAT.exe
  C:\Windows\System\OguzmAT.exe
  2⤵
  PID:4616
- C:\Windows\System\qYtLAiz.exe
  C:\Windows\System\qYtLAiz.exe
  2⤵
  PID:4660
- C:\Windows\System\kudSsYT.exe
  C:\Windows\System\kudSsYT.exe
  2⤵
  PID:3604
- C:\Windows\System\Mycclgu.exe
  C:\Windows\System\Mycclgu.exe
  2⤵
  PID:4852
- C:\Windows\System\MVlxRzA.exe
  C:\Windows\System\MVlxRzA.exe
  2⤵
  PID:3968
- C:\Windows\System\icitZgF.exe
  C:\Windows\System\icitZgF.exe
  2⤵
  PID:4136
- C:\Windows\System\nzePZPZ.exe
  C:\Windows\System\nzePZPZ.exe
  2⤵
  PID:4964
- C:\Windows\System\rqkVvIz.exe
  C:\Windows\System\rqkVvIz.exe
  2⤵
  PID:4104
- C:\Windows\System\ZGDMdZt.exe
  C:\Windows\System\ZGDMdZt.exe
  2⤵
  PID:4272
- C:\Windows\System\uxxHXTW.exe
  C:\Windows\System\uxxHXTW.exe
  2⤵
  PID:4452
- C:\Windows\System\rYxplbf.exe
  C:\Windows\System\rYxplbf.exe
  2⤵
  PID:4680
- C:\Windows\System\ISIEJjl.exe
  C:\Windows\System\ISIEJjl.exe
  2⤵
  PID:4100
- C:\Windows\System\HdqWSDu.exe
  C:\Windows\System\HdqWSDu.exe
  2⤵
  PID:4928
- C:\Windows\System\gkHGjms.exe
  C:\Windows\System\gkHGjms.exe
  2⤵
  PID:4236
- C:\Windows\System\auGVGXl.exe
  C:\Windows\System\auGVGXl.exe
  2⤵
  PID:4288
- C:\Windows\System\sOfNffl.exe
  C:\Windows\System\sOfNffl.exe
  2⤵
  PID:4728
- C:\Windows\System\RqfrHQo.exe
  C:\Windows\System\RqfrHQo.exe
  2⤵
  PID:4900
- C:\Windows\System\HwPcNYy.exe
  C:\Windows\System\HwPcNYy.exe
  2⤵
  PID:4960
- C:\Windows\System\pgajDyf.exe
  C:\Windows\System\pgajDyf.exe
  2⤵
  PID:4884
- C:\Windows\System\FtyCZng.exe
  C:\Windows\System\FtyCZng.exe
  2⤵
  PID:4420
- C:\Windows\System\wjwLOoP.exe
  C:\Windows\System\wjwLOoP.exe
  2⤵
  PID:4348
- C:\Windows\System\cIoBnTc.exe
  C:\Windows\System\cIoBnTc.exe
  2⤵
  PID:4956
- C:\Windows\System\ptGyGkN.exe
  C:\Windows\System\ptGyGkN.exe
  2⤵
  PID:4184
- C:\Windows\System\hzBVjoX.exe
  C:\Windows\System\hzBVjoX.exe
  2⤵
  PID:4632
- C:\Windows\System\BOyyhZG.exe
  C:\Windows\System\BOyyhZG.exe
  2⤵
  PID:4148
- C:\Windows\System\fnnCEeP.exe
  C:\Windows\System\fnnCEeP.exe
  2⤵
  PID:3348
- C:\Windows\System\ZmyGudH.exe
  C:\Windows\System\ZmyGudH.exe
  2⤵
  PID:5128
- C:\Windows\System\FKJQZKN.exe
  C:\Windows\System\FKJQZKN.exe
  2⤵
  PID:5144
- C:\Windows\System\JqvCplP.exe
  C:\Windows\System\JqvCplP.exe
  2⤵
  PID:5160
- C:\Windows\System\VAfNdjD.exe
  C:\Windows\System\VAfNdjD.exe
  2⤵
  PID:5176
- C:\Windows\System\UheVrUL.exe
  C:\Windows\System\UheVrUL.exe
  2⤵
  PID:5196
- C:\Windows\System\bVFGDnj.exe
  C:\Windows\System\bVFGDnj.exe
  2⤵
  PID:5212
- C:\Windows\System\ZojlSuL.exe
  C:\Windows\System\ZojlSuL.exe
  2⤵
  PID:5232
- C:\Windows\System\XuuXUgJ.exe
  C:\Windows\System\XuuXUgJ.exe
  2⤵
  PID:5252
- C:\Windows\System\dwwQxLr.exe
  C:\Windows\System\dwwQxLr.exe
  2⤵
  PID:5268
- C:\Windows\System\OFcgpos.exe
  C:\Windows\System\OFcgpos.exe
  2⤵
  PID:5284
- C:\Windows\System\QFLHGcW.exe
  C:\Windows\System\QFLHGcW.exe
  2⤵
  PID:5300
- C:\Windows\System\zITcEzy.exe
  C:\Windows\System\zITcEzy.exe
  2⤵
  PID:5316
- C:\Windows\System\oENKgbk.exe
  C:\Windows\System\oENKgbk.exe
  2⤵
  PID:5332
- C:\Windows\System\dDyiUtn.exe
  C:\Windows\System\dDyiUtn.exe
  2⤵
  PID:5348
- C:\Windows\System\bHLJlwQ.exe
  C:\Windows\System\bHLJlwQ.exe
  2⤵
  PID:5364
- C:\Windows\System\FwKuRLV.exe
  C:\Windows\System\FwKuRLV.exe
  2⤵
  PID:5380
- C:\Windows\System\RPEDGMP.exe
  C:\Windows\System\RPEDGMP.exe
  2⤵
  PID:5404
- C:\Windows\System\INtntLz.exe
  C:\Windows\System\INtntLz.exe
  2⤵
  PID:5464
- C:\Windows\System\wFoABUu.exe
  C:\Windows\System\wFoABUu.exe
  2⤵
  PID:5488
- C:\Windows\System\kRBAQTO.exe
  C:\Windows\System\kRBAQTO.exe
  2⤵
  PID:5508
- C:\Windows\System\msRnUOy.exe
  C:\Windows\System\msRnUOy.exe
  2⤵
  PID:5524
- C:\Windows\System\MAvWbiJ.exe
  C:\Windows\System\MAvWbiJ.exe
  2⤵
  PID:5540
- C:\Windows\System\brKHaTC.exe
  C:\Windows\System\brKHaTC.exe
  2⤵
  PID:5560
- C:\Windows\System\ShYZrpP.exe
  C:\Windows\System\ShYZrpP.exe
  2⤵
  PID:5580
- C:\Windows\System\bLqqXyz.exe
  C:\Windows\System\bLqqXyz.exe
  2⤵
  PID:5596
- C:\Windows\System\pgsRjDg.exe
  C:\Windows\System\pgsRjDg.exe
  2⤵
  PID:5612
- C:\Windows\System\WxrgKeR.exe
  C:\Windows\System\WxrgKeR.exe
  2⤵
  PID:5628
- C:\Windows\System\YdtengI.exe
  C:\Windows\System\YdtengI.exe
  2⤵
  PID:5644
- C:\Windows\System\PEgkbeG.exe
  C:\Windows\System\PEgkbeG.exe
  2⤵
  PID:5664
- C:\Windows\System\TGRBqvZ.exe
  C:\Windows\System\TGRBqvZ.exe
  2⤵
  PID:5680
- C:\Windows\System\fIpbeWs.exe
  C:\Windows\System\fIpbeWs.exe
  2⤵
  PID:5712
- C:\Windows\System\HzIAlXS.exe
  C:\Windows\System\HzIAlXS.exe
  2⤵
  PID:5752
- C:\Windows\System\sxDQiJY.exe
  C:\Windows\System\sxDQiJY.exe
  2⤵
  PID:5780
- C:\Windows\System\iyPzHzc.exe
  C:\Windows\System\iyPzHzc.exe
  2⤵
  PID:5824
- C:\Windows\System\UEtsXhN.exe
  C:\Windows\System\UEtsXhN.exe
  2⤵
  PID:5844
- C:\Windows\System\jejgaCm.exe
  C:\Windows\System\jejgaCm.exe
  2⤵
  PID:5860
- C:\Windows\System\uJCfVCB.exe
  C:\Windows\System\uJCfVCB.exe
  2⤵
  PID:5876
- C:\Windows\System\uYVGLYO.exe
  C:\Windows\System\uYVGLYO.exe
  2⤵
  PID:5892
- C:\Windows\System\sSzymak.exe
  C:\Windows\System\sSzymak.exe
  2⤵
  PID:5908
- C:\Windows\System\hXguqgz.exe
  C:\Windows\System\hXguqgz.exe
  2⤵
  PID:5924
- C:\Windows\System\pxmoVmQ.exe
  C:\Windows\System\pxmoVmQ.exe
  2⤵
  PID:5944
- C:\Windows\System\zeXdBCU.exe
  C:\Windows\System\zeXdBCU.exe
  2⤵
  PID:5960
- C:\Windows\System\LTxJxCe.exe
  C:\Windows\System\LTxJxCe.exe
  2⤵
  PID:5976
- C:\Windows\System\IPFruXu.exe
  C:\Windows\System\IPFruXu.exe
  2⤵
  PID:5996
- C:\Windows\System\QKCtkvo.exe
  C:\Windows\System\QKCtkvo.exe
  2⤵
  PID:6012
- C:\Windows\System\zzQFUwW.exe
  C:\Windows\System\zzQFUwW.exe
  2⤵
  PID:6028
- C:\Windows\System\DWFvFmn.exe
  C:\Windows\System\DWFvFmn.exe
  2⤵
  PID:6048
- C:\Windows\System\ICHgnTt.exe
  C:\Windows\System\ICHgnTt.exe
  2⤵
  PID:6064
- C:\Windows\System\KHDcWtB.exe
  C:\Windows\System\KHDcWtB.exe
  2⤵
  PID:6080
- C:\Windows\System\ZBHKYQK.exe
  C:\Windows\System\ZBHKYQK.exe
  2⤵
  PID:6096
- C:\Windows\System\EAVmJvO.exe
  C:\Windows\System\EAVmJvO.exe
  2⤵
  PID:6116
- C:\Windows\System\NLdiVtv.exe
  C:\Windows\System\NLdiVtv.exe
  2⤵
  PID:5124
- C:\Windows\System\ZMsaAfN.exe
  C:\Windows\System\ZMsaAfN.exe
  2⤵
  PID:5136
- C:\Windows\System\cfTItQH.exe
  C:\Windows\System\cfTItQH.exe
  2⤵
  PID:5324
- C:\Windows\System\xyOzjYb.exe
  C:\Windows\System\xyOzjYb.exe
  2⤵
  PID:5228
- C:\Windows\System\vnAuTTG.exe
  C:\Windows\System\vnAuTTG.exe
  2⤵
  PID:5392
- C:\Windows\System\BTjsycH.exe
  C:\Windows\System\BTjsycH.exe
  2⤵
  PID:4008
- C:\Windows\System\dTSwsHO.exe
  C:\Windows\System\dTSwsHO.exe
  2⤵
  PID:5312
- C:\Windows\System\VSLXPQi.exe
  C:\Windows\System\VSLXPQi.exe
  2⤵
  PID:5428
- C:\Windows\System\yUQYsww.exe
  C:\Windows\System\yUQYsww.exe
  2⤵
  PID:5444
- C:\Windows\System\BJuEzmK.exe
  C:\Windows\System\BJuEzmK.exe
  2⤵
  PID:5476
- C:\Windows\System\RuAOqPU.exe
  C:\Windows\System\RuAOqPU.exe
  2⤵
  PID:5500
- C:\Windows\System\UXJQlXV.exe
  C:\Windows\System\UXJQlXV.exe
  2⤵
  PID:5568
- C:\Windows\System\XhAygPU.exe
  C:\Windows\System\XhAygPU.exe
  2⤵
  PID:5720
- C:\Windows\System\GmRSHEl.exe
  C:\Windows\System\GmRSHEl.exe
  2⤵
  PID:5692
- C:\Windows\System\mZkZjIt.exe
  C:\Windows\System\mZkZjIt.exe
  2⤵
  PID:5708
- C:\Windows\System\XMIdsZP.exe
  C:\Windows\System\XMIdsZP.exe
  2⤵
  PID:5732
- C:\Windows\System\xoqWoMW.exe
  C:\Windows\System\xoqWoMW.exe
  2⤵
  PID:5520
- C:\Windows\System\PFkfEHu.exe
  C:\Windows\System\PFkfEHu.exe
  2⤵
  PID:5744
- C:\Windows\System\qHnhmMu.exe
  C:\Windows\System\qHnhmMu.exe
  2⤵
  PID:5760
- C:\Windows\System\uojsZmU.exe
  C:\Windows\System\uojsZmU.exe
  2⤵
  PID:5776
- C:\Windows\System\rWuqoIQ.exe
  C:\Windows\System\rWuqoIQ.exe
  2⤵
  PID:5800
- C:\Windows\System\QVvOKkU.exe
  C:\Windows\System\QVvOKkU.exe
  2⤵
  PID:5816
- C:\Windows\System\iZkomHE.exe
  C:\Windows\System\iZkomHE.exe
  2⤵
  PID:5836
- C:\Windows\System\JGHMeXo.exe
  C:\Windows\System\JGHMeXo.exe
  2⤵
  PID:5868
- C:\Windows\System\IraRKUc.exe
  C:\Windows\System\IraRKUc.exe
  2⤵
  PID:5968
- C:\Windows\System\XwrflRS.exe
  C:\Windows\System\XwrflRS.exe
  2⤵
  PID:5888
- C:\Windows\System\yWTFLHg.exe
  C:\Windows\System\yWTFLHg.exe
  2⤵
  PID:5952
- C:\Windows\System\VDCdGiE.exe
  C:\Windows\System\VDCdGiE.exe
  2⤵
  PID:6008
- C:\Windows\System\eEDYUjN.exe
  C:\Windows\System\eEDYUjN.exe
  2⤵
  PID:6060
- C:\Windows\System\YqPhsDO.exe
  C:\Windows\System\YqPhsDO.exe
  2⤵
  PID:6128
- C:\Windows\System\fePRvfI.exe
  C:\Windows\System\fePRvfI.exe
  2⤵
  PID:6104
- C:\Windows\System\qQYwauk.exe
  C:\Windows\System\qQYwauk.exe
  2⤵
  PID:6132
- C:\Windows\System\XZxXqxY.exe
  C:\Windows\System\XZxXqxY.exe
  2⤵
  PID:4116
- C:\Windows\System\wpeRCFq.exe
  C:\Windows\System\wpeRCFq.exe
  2⤵
  PID:5356
- C:\Windows\System\PkObNnY.exe
  C:\Windows\System\PkObNnY.exe
  2⤵
  PID:5260
- C:\Windows\System\xhQLdqQ.exe
  C:\Windows\System\xhQLdqQ.exe
  2⤵
  PID:5264
- C:\Windows\System\fFOqEJK.exe
  C:\Windows\System\fFOqEJK.exe
  2⤵
  PID:5244
- C:\Windows\System\hsSvprv.exe
  C:\Windows\System\hsSvprv.exe
  2⤵
  PID:5168
- C:\Windows\System\mpdVczb.exe
  C:\Windows\System\mpdVczb.exe
  2⤵
  PID:5172
- C:\Windows\System\JzGZjys.exe
  C:\Windows\System\JzGZjys.exe
  2⤵
  PID:5376
- C:\Windows\System\GBlDleS.exe
  C:\Windows\System\GBlDleS.exe
  2⤵
  PID:5452
- C:\Windows\System\YUJJGSK.exe
  C:\Windows\System\YUJJGSK.exe
  2⤵
  PID:5504
- C:\Windows\System\AiatPXR.exe
  C:\Windows\System\AiatPXR.exe
  2⤵
  PID:5676
- C:\Windows\System\JVuwDMg.exe
  C:\Windows\System\JVuwDMg.exe
  2⤵
  PID:5700
- C:\Windows\System\zngpRxz.exe
  C:\Windows\System\zngpRxz.exe
  2⤵
  PID:5792
- C:\Windows\System\RNypAJv.exe
  C:\Windows\System\RNypAJv.exe
  2⤵
  PID:5932
- C:\Windows\System\ZzhUgUs.exe
  C:\Windows\System\ZzhUgUs.exe
  2⤵
  PID:5936
- C:\Windows\System\PLYDgHc.exe
  C:\Windows\System\PLYDgHc.exe
  2⤵
  PID:5688
- C:\Windows\System\BVhZsad.exe
  C:\Windows\System\BVhZsad.exe
  2⤵
  PID:6024
- C:\Windows\System\kpMeesw.exe
  C:\Windows\System\kpMeesw.exe
  2⤵
  PID:5856
- C:\Windows\System\YtfzuxL.exe
  C:\Windows\System\YtfzuxL.exe
  2⤵
  PID:4564
- C:\Windows\System\HsSZYGt.exe
  C:\Windows\System\HsSZYGt.exe
  2⤵
  PID:5740
- C:\Windows\System\RwVIhfM.exe
  C:\Windows\System\RwVIhfM.exe
  2⤵
  PID:5808
- C:\Windows\System\hQAPcGh.exe
  C:\Windows\System\hQAPcGh.exe
  2⤵
  PID:5904
- C:\Windows\System\Xqjnjmx.exe
  C:\Windows\System\Xqjnjmx.exe
  2⤵
  PID:5988
- C:\Windows\System\TvZUspp.exe
  C:\Windows\System\TvZUspp.exe
  2⤵
  PID:5440
- C:\Windows\System\NyQGtBK.exe
  C:\Windows\System\NyQGtBK.exe
  2⤵
  PID:5724
- C:\Windows\System\jiqVrjU.exe
  C:\Windows\System\jiqVrjU.exe
  2⤵
  PID:5728
- C:\Windows\System\eLKDFcO.exe
  C:\Windows\System\eLKDFcO.exe
  2⤵
  PID:6124
- C:\Windows\System\lCxisIx.exe
  C:\Windows\System\lCxisIx.exe
  2⤵
  PID:5588
- C:\Windows\System\sFBXmvR.exe
  C:\Windows\System\sFBXmvR.exe
  2⤵
  PID:5884
- C:\Windows\System\GuHYxFu.exe
  C:\Windows\System\GuHYxFu.exe
  2⤵
  PID:5480
- C:\Windows\System\GUjZZfK.exe
  C:\Windows\System\GUjZZfK.exe
  2⤵
  PID:6152
- C:\Windows\System\ThXJkSL.exe
  C:\Windows\System\ThXJkSL.exe
  2⤵
  PID:6168
- C:\Windows\System\elviiiR.exe
  C:\Windows\System\elviiiR.exe
  2⤵
  PID:6184
- C:\Windows\System\GfJJiaa.exe
  C:\Windows\System\GfJJiaa.exe
  2⤵
  PID:6200
- C:\Windows\System\mjamzov.exe
  C:\Windows\System\mjamzov.exe
  2⤵
  PID:6216
- C:\Windows\System\KOnbOyR.exe
  C:\Windows\System\KOnbOyR.exe
  2⤵
  PID:6232
- C:\Windows\System\hzHXCdw.exe
  C:\Windows\System\hzHXCdw.exe
  2⤵
  PID:6248
- C:\Windows\System\KSeGwwf.exe
  C:\Windows\System\KSeGwwf.exe
  2⤵
  PID:6264
- C:\Windows\System\ekzySEj.exe
  C:\Windows\System\ekzySEj.exe
  2⤵
  PID:6280
- C:\Windows\System\kLmJbUf.exe
  C:\Windows\System\kLmJbUf.exe
  2⤵
  PID:6296
- C:\Windows\System\ccZTmvQ.exe
  C:\Windows\System\ccZTmvQ.exe
  2⤵
  PID:6312
- C:\Windows\System\AithcoZ.exe
  C:\Windows\System\AithcoZ.exe
  2⤵
  PID:6328
- C:\Windows\System\iKDRtZf.exe
  C:\Windows\System\iKDRtZf.exe
  2⤵
  PID:6344
- C:\Windows\System\bYSXvem.exe
  C:\Windows\System\bYSXvem.exe
  2⤵
  PID:6360
- C:\Windows\System\mggdhgl.exe
  C:\Windows\System\mggdhgl.exe
  2⤵
  PID:6376
- C:\Windows\System\qWmmyVS.exe
  C:\Windows\System\qWmmyVS.exe
  2⤵
  PID:6392
- C:\Windows\System\IkcWDPI.exe
  C:\Windows\System\IkcWDPI.exe
  2⤵
  PID:6408
- C:\Windows\System\MckebIc.exe
  C:\Windows\System\MckebIc.exe
  2⤵
  PID:6424
- C:\Windows\System\cMjDdEV.exe
  C:\Windows\System\cMjDdEV.exe
  2⤵
  PID:6440
- C:\Windows\System\QDikZNL.exe
  C:\Windows\System\QDikZNL.exe
  2⤵
  PID:6456
- C:\Windows\System\fvBXRuf.exe
  C:\Windows\System\fvBXRuf.exe
  2⤵
  PID:6476
- C:\Windows\System\jLIgelN.exe
  C:\Windows\System\jLIgelN.exe
  2⤵
  PID:6492
- C:\Windows\System\cQhfVQE.exe
  C:\Windows\System\cQhfVQE.exe
  2⤵
  PID:6508
- C:\Windows\System\qeUxUvc.exe
  C:\Windows\System\qeUxUvc.exe
  2⤵
  PID:6548
- C:\Windows\System\llAYxUe.exe
  C:\Windows\System\llAYxUe.exe
  2⤵
  PID:6564
- C:\Windows\System\FxeMBtg.exe
  C:\Windows\System\FxeMBtg.exe
  2⤵
  PID:6580
- C:\Windows\System\FBTTSem.exe
  C:\Windows\System\FBTTSem.exe
  2⤵
  PID:6604
- C:\Windows\System\rxzXmSU.exe
  C:\Windows\System\rxzXmSU.exe
  2⤵
  PID:6620
- C:\Windows\System\GOTbahP.exe
  C:\Windows\System\GOTbahP.exe
  2⤵
  PID:6636
- C:\Windows\System\LHqLKEL.exe
  C:\Windows\System\LHqLKEL.exe
  2⤵
  PID:6656
- C:\Windows\System\JZwMEjS.exe
  C:\Windows\System\JZwMEjS.exe
  2⤵
  PID:6672
- C:\Windows\System\YNjvFPk.exe
  C:\Windows\System\YNjvFPk.exe
  2⤵
  PID:6692
- C:\Windows\System\CftsrYD.exe
  C:\Windows\System\CftsrYD.exe
  2⤵
  PID:6708
- C:\Windows\System\nNUurvk.exe
  C:\Windows\System\nNUurvk.exe
  2⤵
  PID:6728
- C:\Windows\System\HVeUtNl.exe
  C:\Windows\System\HVeUtNl.exe
  2⤵
  PID:6744
- C:\Windows\System\HbLesto.exe
  C:\Windows\System\HbLesto.exe
  2⤵
  PID:6760
- C:\Windows\System\ZKVCPHU.exe
  C:\Windows\System\ZKVCPHU.exe
  2⤵
  PID:6780
- C:\Windows\System\QHHsfbh.exe
  C:\Windows\System\QHHsfbh.exe
  2⤵
  PID:6796
- C:\Windows\System\GWnWtqy.exe
  C:\Windows\System\GWnWtqy.exe
  2⤵
  PID:6816
- C:\Windows\System\AljBmqy.exe
  C:\Windows\System\AljBmqy.exe
  2⤵
  PID:6836
- C:\Windows\System\uqXyrxB.exe
  C:\Windows\System\uqXyrxB.exe
  2⤵
  PID:6852
- C:\Windows\System\EuQAQCl.exe
  C:\Windows\System\EuQAQCl.exe
  2⤵
  PID:6868
- C:\Windows\System\wtvstWX.exe
  C:\Windows\System\wtvstWX.exe
  2⤵
  PID:6884
- C:\Windows\System\UfpxutL.exe
  C:\Windows\System\UfpxutL.exe
  2⤵
  PID:6900
- C:\Windows\System\bjOgkPu.exe
  C:\Windows\System\bjOgkPu.exe
  2⤵
  PID:6920
- C:\Windows\System\UuzSmsb.exe
  C:\Windows\System\UuzSmsb.exe
  2⤵
  PID:6936
- C:\Windows\System\MNLtuBt.exe
  C:\Windows\System\MNLtuBt.exe
  2⤵
  PID:6960
- C:\Windows\System\mYDEQjB.exe
  C:\Windows\System\mYDEQjB.exe
  2⤵
  PID:7084
- C:\Windows\System\NAfqfSO.exe
  C:\Windows\System\NAfqfSO.exe
  2⤵
  PID:7100
- C:\Windows\System\NchnmMs.exe
  C:\Windows\System\NchnmMs.exe
  2⤵
  PID:7116
- C:\Windows\System\eSAfcUX.exe
  C:\Windows\System\eSAfcUX.exe
  2⤵
  PID:7132
- C:\Windows\System\RdRknah.exe
  C:\Windows\System\RdRknah.exe
  2⤵
  PID:7148
- C:\Windows\System\szEWZiE.exe
  C:\Windows\System\szEWZiE.exe
  2⤵
  PID:7164
- C:\Windows\System\hCNJoXy.exe
  C:\Windows\System\hCNJoXy.exe
  2⤵
  PID:5388
- C:\Windows\System\ojGkcVL.exe
  C:\Windows\System\ojGkcVL.exe
  2⤵
  PID:5532
- C:\Windows\System\SfQypDF.exe
  C:\Windows\System\SfQypDF.exe
  2⤵
  PID:5496
- C:\Windows\System\SSgWsAx.exe
  C:\Windows\System\SSgWsAx.exe
  2⤵
  PID:5796
- C:\Windows\System\qJItkkp.exe
  C:\Windows\System\qJItkkp.exe
  2⤵
  PID:6036
- C:\Windows\System\GJVOeMN.exe
  C:\Windows\System\GJVOeMN.exe
  2⤵
  PID:6244
- C:\Windows\System\tkcsvue.exe
  C:\Windows\System\tkcsvue.exe
  2⤵
  PID:5872
- C:\Windows\System\uQgFeMP.exe
  C:\Windows\System\uQgFeMP.exe
  2⤵
  PID:6044
- C:\Windows\System\nSZVAnW.exe
  C:\Windows\System\nSZVAnW.exe
  2⤵
  PID:6196
- C:\Windows\System\jJZAOHG.exe
  C:\Windows\System\jJZAOHG.exe
  2⤵
  PID:6160
- C:\Windows\System\uIvFDeC.exe
  C:\Windows\System\uIvFDeC.exe
  2⤵
  PID:6340
- C:\Windows\System\oiMEsbp.exe
  C:\Windows\System\oiMEsbp.exe
  2⤵
  PID:6256
- C:\Windows\System\kTIaopB.exe
  C:\Windows\System\kTIaopB.exe
  2⤵
  PID:6404
- C:\Windows\System\gmyupFy.exe
  C:\Windows\System\gmyupFy.exe
  2⤵
  PID:6436
- C:\Windows\System\MYZDgxw.exe
  C:\Windows\System\MYZDgxw.exe
  2⤵
  PID:6464
- C:\Windows\System\nbYPJMz.exe
  C:\Windows\System\nbYPJMz.exe
  2⤵
  PID:6352
- C:\Windows\System\TFwsTax.exe
  C:\Windows\System\TFwsTax.exe
  2⤵
  PID:6356
- C:\Windows\System\pdRypfK.exe
  C:\Windows\System\pdRypfK.exe
  2⤵
  PID:6488
- C:\Windows\System\ThlFAul.exe
  C:\Windows\System\ThlFAul.exe
  2⤵
  PID:6536
- C:\Windows\System\TYKFqLr.exe
  C:\Windows\System\TYKFqLr.exe
  2⤵
  PID:6532
- C:\Windows\System\BNrGsHY.exe
  C:\Windows\System\BNrGsHY.exe
  2⤵
  PID:6612
- C:\Windows\System\DTPLTvD.exe
  C:\Windows\System\DTPLTvD.exe
  2⤵
  PID:6504
- C:\Windows\System\FGvsGFB.exe
  C:\Windows\System\FGvsGFB.exe
  2⤵
  PID:6644
- C:\Windows\System\vdwrsWu.exe
  C:\Windows\System\vdwrsWu.exe
  2⤵
  PID:6600
- C:\Windows\System\qsgjTfu.exe
  C:\Windows\System\qsgjTfu.exe
  2⤵
  PID:6668
- C:\Windows\System\yYTqhxM.exe
  C:\Windows\System\yYTqhxM.exe
  2⤵
  PID:6768
- C:\Windows\System\TRHvHkR.exe
  C:\Windows\System\TRHvHkR.exe
  2⤵
  PID:6808
- C:\Windows\System\taqoZge.exe
  C:\Windows\System\taqoZge.exe
  2⤵
  PID:6652
- C:\Windows\System\iWvOLPn.exe
  C:\Windows\System\iWvOLPn.exe
  2⤵
  PID:6716
- C:\Windows\System\kMctIdH.exe
  C:\Windows\System\kMctIdH.exe
  2⤵
  PID:6752
- C:\Windows\System\jniryfg.exe
  C:\Windows\System\jniryfg.exe
  2⤵
  PID:6844
- C:\Windows\System\iwubMet.exe
  C:\Windows\System\iwubMet.exe
  2⤵
  PID:6892
- C:\Windows\System\rHVMlZg.exe
  C:\Windows\System\rHVMlZg.exe
  2⤵
  PID:6912
- C:\Windows\System\YYbLmIF.exe
  C:\Windows\System\YYbLmIF.exe
  2⤵
  PID:6916
- C:\Windows\System\pfeZwDX.exe
  C:\Windows\System\pfeZwDX.exe
  2⤵
  PID:6972
- C:\Windows\System\xFOZLiE.exe
  C:\Windows\System\xFOZLiE.exe
  2⤵
  PID:6988
- C:\Windows\System\KxtbFQZ.exe
  C:\Windows\System\KxtbFQZ.exe
  2⤵
  PID:7004
- C:\Windows\System\LMYFQWf.exe
  C:\Windows\System\LMYFQWf.exe
  2⤵
  PID:5788
- C:\Windows\System\tvDRsgU.exe
  C:\Windows\System\tvDRsgU.exe
  2⤵
  PID:7044
- C:\Windows\System\TgGsxqS.exe
  C:\Windows\System\TgGsxqS.exe
  2⤵
  PID:7060
- C:\Windows\System\pzrFnVt.exe
  C:\Windows\System\pzrFnVt.exe
  2⤵
  PID:7076
- C:\Windows\System\SQATLTL.exe
  C:\Windows\System\SQATLTL.exe
  2⤵
  PID:7128
- C:\Windows\System\QzvSThW.exe
  C:\Windows\System\QzvSThW.exe
  2⤵
  PID:7108
- C:\Windows\System\yjdHVDe.exe
  C:\Windows\System\yjdHVDe.exe
  2⤵
  PID:7144
- C:\Windows\System\dIHahwY.exe
  C:\Windows\System\dIHahwY.exe
  2⤵
  PID:5536
- C:\Windows\System\iNIdfqy.exe
  C:\Windows\System\iNIdfqy.exe
  2⤵
  PID:5372
- C:\Windows\System\VDyBmUS.exe
  C:\Windows\System\VDyBmUS.exe
  2⤵
  PID:6092
- C:\Windows\System\FGWMFjl.exe
  C:\Windows\System\FGWMFjl.exe
  2⤵
  PID:6224
- C:\Windows\System\rAfdyCC.exe
  C:\Windows\System\rAfdyCC.exe
  2⤵
  PID:6416
- C:\Windows\System\DBDxilU.exe
  C:\Windows\System\DBDxilU.exe
  2⤵
  PID:6308
- C:\Windows\System\PlpgRHk.exe
  C:\Windows\System\PlpgRHk.exe
  2⤵
  PID:6384
- C:\Windows\System\vLKLAFn.exe
  C:\Windows\System\vLKLAFn.exe
  2⤵
  PID:6272
- C:\Windows\System\UDNLMxz.exe
  C:\Windows\System\UDNLMxz.exe
  2⤵
  PID:6112
- C:\Windows\System\bcSjmzc.exe
  C:\Windows\System\bcSjmzc.exe
  2⤵
  PID:6544
- C:\Windows\System\CvpclAh.exe
  C:\Windows\System\CvpclAh.exe
  2⤵
  PID:6648
- C:\Windows\System\UGZRRCI.exe
  C:\Windows\System\UGZRRCI.exe
  2⤵
  PID:6588
- C:\Windows\System\XiaAjeB.exe
  C:\Windows\System\XiaAjeB.exe
  2⤵
  PID:6792
- C:\Windows\System\coCYPmw.exe
  C:\Windows\System\coCYPmw.exe
  2⤵
  PID:6824
- C:\Windows\System\inWDiKW.exe
  C:\Windows\System\inWDiKW.exe
  2⤵
  PID:6684
- C:\Windows\System\wUXlwFs.exe
  C:\Windows\System\wUXlwFs.exe
  2⤵
  PID:6908
- C:\Windows\System\deCzbFZ.exe
  C:\Windows\System\deCzbFZ.exe
  2⤵
  PID:6880
- C:\Windows\System\gQApaoI.exe
  C:\Windows\System\gQApaoI.exe
  2⤵
  PID:7016
- C:\Windows\System\XgdtZIv.exe
  C:\Windows\System\XgdtZIv.exe
  2⤵
  PID:7056
- C:\Windows\System\OoVcYje.exe
  C:\Windows\System\OoVcYje.exe
  2⤵
  PID:7112
- C:\Windows\System\AjRFfCt.exe
  C:\Windows\System\AjRFfCt.exe
  2⤵
  PID:6212
- C:\Windows\System\pnyQDLW.exe
  C:\Windows\System\pnyQDLW.exe
  2⤵
  PID:6468
- C:\Windows\System\jhIClCA.exe
  C:\Windows\System\jhIClCA.exe
  2⤵
  PID:6448
- C:\Windows\System\KdGRubk.exe
  C:\Windows\System\KdGRubk.exe
  2⤵
  PID:5840
- C:\Windows\System\DYlhoiq.exe
  C:\Windows\System\DYlhoiq.exe
  2⤵
  PID:6432
- C:\Windows\System\UfzbdNz.exe
  C:\Windows\System\UfzbdNz.exe
  2⤵
  PID:7160
- C:\Windows\System\YLZhKRc.exe
  C:\Windows\System\YLZhKRc.exe
  2⤵
  PID:6572
- C:\Windows\System\NmBgHsp.exe
  C:\Windows\System\NmBgHsp.exe
  2⤵
  PID:6560
- C:\Windows\System\dZzNvpZ.exe
  C:\Windows\System\dZzNvpZ.exe
  2⤵
  PID:6804
- C:\Windows\System\HiExRKB.exe
  C:\Windows\System\HiExRKB.exe
  2⤵
  PID:6788
- C:\Windows\System\iygCCth.exe
  C:\Windows\System\iygCCth.exe
  2⤵
  PID:6932
- C:\Windows\System\hwvTWtn.exe
  C:\Windows\System\hwvTWtn.exe
  2⤵
  PID:6688
- C:\Windows\System\gudCXox.exe
  C:\Windows\System\gudCXox.exe
  2⤵
  PID:5660
- C:\Windows\System\ecqfhdq.exe
  C:\Windows\System\ecqfhdq.exe
  2⤵
  PID:7036
- C:\Windows\System\JvEvCUT.exe
  C:\Windows\System\JvEvCUT.exe
  2⤵
  PID:6832
- C:\Windows\System\CCNqoAx.exe
  C:\Windows\System\CCNqoAx.exe
  2⤵
  PID:7000
- C:\Windows\System\kgfidHR.exe
  C:\Windows\System\kgfidHR.exe
  2⤵
  PID:7012
- C:\Windows\System\DRjwsFS.exe
  C:\Windows\System\DRjwsFS.exe
  2⤵
  PID:6724
- C:\Windows\System\AjOgilX.exe
  C:\Windows\System\AjOgilX.exe
  2⤵
  PID:5204
- C:\Windows\System\DBCkYza.exe
  C:\Windows\System\DBCkYza.exe
  2⤵
  PID:7028
- C:\Windows\System\gMACVKf.exe
  C:\Windows\System\gMACVKf.exe
  2⤵
  PID:7068
- C:\Windows\System\huOfuNm.exe
  C:\Windows\System\huOfuNm.exe
  2⤵
  PID:7180
- C:\Windows\System\UKwinyF.exe
  C:\Windows\System\UKwinyF.exe
  2⤵
  PID:7196
- C:\Windows\System\VtxjjQz.exe
  C:\Windows\System\VtxjjQz.exe
  2⤵
  PID:7216
- C:\Windows\System\BNrHmWi.exe
  C:\Windows\System\BNrHmWi.exe
  2⤵
  PID:7232
- C:\Windows\System\lCROmNT.exe
  C:\Windows\System\lCROmNT.exe
  2⤵
  PID:7248
- C:\Windows\System\EsmwiQo.exe
  C:\Windows\System\EsmwiQo.exe
  2⤵
  PID:7264
- C:\Windows\System\qgkLBmb.exe
  C:\Windows\System\qgkLBmb.exe
  2⤵
  PID:7280
- C:\Windows\System\DdpBPeq.exe
  C:\Windows\System\DdpBPeq.exe
  2⤵
  PID:7296
- C:\Windows\System\TbzjJPX.exe
  C:\Windows\System\TbzjJPX.exe
  2⤵
  PID:7312
- C:\Windows\System\koaWXFr.exe
  C:\Windows\System\koaWXFr.exe
  2⤵
  PID:7328
- C:\Windows\System\bbdCgTI.exe
  C:\Windows\System\bbdCgTI.exe
  2⤵
  PID:7344
- C:\Windows\System\ItwgKmT.exe
  C:\Windows\System\ItwgKmT.exe
  2⤵
  PID:7360
- C:\Windows\System\GFBGDwL.exe
  C:\Windows\System\GFBGDwL.exe
  2⤵
  PID:7376
- C:\Windows\System\hfRxvci.exe
  C:\Windows\System\hfRxvci.exe
  2⤵
  PID:7392
- C:\Windows\System\JMFvSiB.exe
  C:\Windows\System\JMFvSiB.exe
  2⤵
  PID:7408
- C:\Windows\System\qjKcxGq.exe
  C:\Windows\System\qjKcxGq.exe
  2⤵
  PID:7424
- C:\Windows\System\oqzHxsD.exe
  C:\Windows\System\oqzHxsD.exe
  2⤵
  PID:7440
- C:\Windows\System\VDmtRMZ.exe
  C:\Windows\System\VDmtRMZ.exe
  2⤵
  PID:7456
- C:\Windows\System\PLVbIor.exe
  C:\Windows\System\PLVbIor.exe
  2⤵
  PID:7476
- C:\Windows\System\XmhjfvL.exe
  C:\Windows\System\XmhjfvL.exe
  2⤵
  PID:7492
- C:\Windows\System\lIfNjSC.exe
  C:\Windows\System\lIfNjSC.exe
  2⤵
  PID:7508
- C:\Windows\System\sNhegJv.exe
  C:\Windows\System\sNhegJv.exe
  2⤵
  PID:7524
- C:\Windows\System\BfGzmoA.exe
  C:\Windows\System\BfGzmoA.exe
  2⤵
  PID:7540
- C:\Windows\System\hVFiDlW.exe
  C:\Windows\System\hVFiDlW.exe
  2⤵
  PID:7560
- C:\Windows\System\GsPaTtG.exe
  C:\Windows\System\GsPaTtG.exe
  2⤵
  PID:7576
- C:\Windows\System\RtBawGC.exe
  C:\Windows\System\RtBawGC.exe
  2⤵
  PID:7592
- C:\Windows\System\KrLJEin.exe
  C:\Windows\System\KrLJEin.exe
  2⤵
  PID:7608
- C:\Windows\System\mRQLQpR.exe
  C:\Windows\System\mRQLQpR.exe
  2⤵
  PID:7624
- C:\Windows\System\OeqCXZy.exe
  C:\Windows\System\OeqCXZy.exe
  2⤵
  PID:7640
- C:\Windows\System\uJAoWRW.exe
  C:\Windows\System\uJAoWRW.exe
  2⤵
  PID:7656
- C:\Windows\System\MTiJDKX.exe
  C:\Windows\System\MTiJDKX.exe
  2⤵
  PID:7672
- C:\Windows\System\GRlotXL.exe
  C:\Windows\System\GRlotXL.exe
  2⤵
  PID:7688
- C:\Windows\System\FfpJquQ.exe
  C:\Windows\System\FfpJquQ.exe
  2⤵
  PID:7704
- C:\Windows\System\KgcdlbZ.exe
  C:\Windows\System\KgcdlbZ.exe
  2⤵
  PID:7720
- C:\Windows\System\UjwxOeD.exe
  C:\Windows\System\UjwxOeD.exe
  2⤵
  PID:7736
- C:\Windows\System\vCBerVm.exe
  C:\Windows\System\vCBerVm.exe
  2⤵
  PID:7752
- C:\Windows\System\KxoVLCd.exe
  C:\Windows\System\KxoVLCd.exe
  2⤵
  PID:7768
- C:\Windows\System\POdfynL.exe
  C:\Windows\System\POdfynL.exe
  2⤵
  PID:7784
- C:\Windows\System\MkBsLDs.exe
  C:\Windows\System\MkBsLDs.exe
  2⤵
  PID:7800
- C:\Windows\System\LiaoJxj.exe
  C:\Windows\System\LiaoJxj.exe
  2⤵
  PID:7816
- C:\Windows\System\OFJveNh.exe
  C:\Windows\System\OFJveNh.exe
  2⤵
  PID:7832
- C:\Windows\System\vgVVSKb.exe
  C:\Windows\System\vgVVSKb.exe
  2⤵
  PID:7848
- C:\Windows\System\GlgEbfy.exe
  C:\Windows\System\GlgEbfy.exe
  2⤵
  PID:7864
- C:\Windows\System\PnXqPyL.exe
  C:\Windows\System\PnXqPyL.exe
  2⤵
  PID:7884
- C:\Windows\System\nVxNOoD.exe
  C:\Windows\System\nVxNOoD.exe
  2⤵
  PID:7900
- C:\Windows\System\ZfWHnKu.exe
  C:\Windows\System\ZfWHnKu.exe
  2⤵
  PID:7916
- C:\Windows\System\CkCJPHq.exe
  C:\Windows\System\CkCJPHq.exe
  2⤵
  PID:7932
- C:\Windows\System\tlWEUTl.exe
  C:\Windows\System\tlWEUTl.exe
  2⤵
  PID:7952
- C:\Windows\System\lArIjnR.exe
  C:\Windows\System\lArIjnR.exe
  2⤵
  PID:7968
- C:\Windows\System\yoONaIQ.exe
  C:\Windows\System\yoONaIQ.exe
  2⤵
  PID:7984
- C:\Windows\System\muNPoHR.exe
  C:\Windows\System\muNPoHR.exe
  2⤵
  PID:8000
- C:\Windows\System\zQuCorQ.exe
  C:\Windows\System\zQuCorQ.exe
  2⤵
  PID:8016
- C:\Windows\System\pWfLZJc.exe
  C:\Windows\System\pWfLZJc.exe
  2⤵
  PID:8036
- C:\Windows\System\agjAYlX.exe
  C:\Windows\System\agjAYlX.exe
  2⤵
  PID:8052
- C:\Windows\System\nymsehZ.exe
  C:\Windows\System\nymsehZ.exe
  2⤵
  PID:8068
- C:\Windows\System\ZgMRXXh.exe
  C:\Windows\System\ZgMRXXh.exe
  2⤵
  PID:8084
- C:\Windows\System\HVMhojd.exe
  C:\Windows\System\HVMhojd.exe
  2⤵
  PID:8100
- C:\Windows\System\UMiCFWU.exe
  C:\Windows\System\UMiCFWU.exe
  2⤵
  PID:8116
- C:\Windows\System\yOVIuzk.exe
  C:\Windows\System\yOVIuzk.exe
  2⤵
  PID:8132
- C:\Windows\System\JjLwuSN.exe
  C:\Windows\System\JjLwuSN.exe
  2⤵
  PID:8148
- C:\Windows\System\wyYsHaL.exe
  C:\Windows\System\wyYsHaL.exe
  2⤵
  PID:8164
- C:\Windows\System\yxcgCmA.exe
  C:\Windows\System\yxcgCmA.exe
  2⤵
  PID:8180
- C:\Windows\System\AoWUwdo.exe
  C:\Windows\System\AoWUwdo.exe
  2⤵
  PID:7176
- C:\Windows\System\WxgoeRL.exe
  C:\Windows\System\WxgoeRL.exe
  2⤵
  PID:7212
- C:\Windows\System\EhXhvZj.exe
  C:\Windows\System\EhXhvZj.exe
  2⤵
  PID:7244
- C:\Windows\System\tVEzljH.exe
  C:\Windows\System\tVEzljH.exe
  2⤵
  PID:7404
- C:\Windows\System\JOhOOQg.exe
  C:\Windows\System\JOhOOQg.exe
  2⤵
  PID:7468
- C:\Windows\System\MojgGqZ.exe
  C:\Windows\System\MojgGqZ.exe
  2⤵
  PID:7356
- C:\Windows\System\KuOBXto.exe
  C:\Windows\System\KuOBXto.exe
  2⤵
  PID:7572
- C:\Windows\System\ZmyPDOe.exe
  C:\Windows\System\ZmyPDOe.exe
  2⤵
  PID:7604
- C:\Windows\System\AGMvXqT.exe
  C:\Windows\System\AGMvXqT.exe
  2⤵
  PID:7452
- C:\Windows\System\GVfmOAX.exe
  C:\Windows\System\GVfmOAX.exe
  2⤵
  PID:7352
- C:\Windows\System\DOvitfD.exe
  C:\Windows\System\DOvitfD.exe
  2⤵
  PID:7448
- C:\Windows\System\MLZqZOv.exe
  C:\Windows\System\MLZqZOv.exe
  2⤵
  PID:7584
- C:\Windows\System\fnAknrI.exe
  C:\Windows\System\fnAknrI.exe
  2⤵
  PID:7696
- C:\Windows\System\pokiGNJ.exe
  C:\Windows\System\pokiGNJ.exe
  2⤵
  PID:7516
- C:\Windows\System\KXpPEXK.exe
  C:\Windows\System\KXpPEXK.exe
  2⤵
  PID:7732
- C:\Windows\System\EXaSgon.exe
  C:\Windows\System\EXaSgon.exe
  2⤵
  PID:7796
- C:\Windows\System\xHBBoTB.exe
  C:\Windows\System\xHBBoTB.exe
  2⤵
  PID:7828
- C:\Windows\System\wzXItjJ.exe
  C:\Windows\System\wzXItjJ.exe
  2⤵
  PID:7856
- C:\Windows\System\mLHDjHK.exe
  C:\Windows\System\mLHDjHK.exe
  2⤵
  PID:7924
- C:\Windows\System\AdcUPhz.exe
  C:\Windows\System\AdcUPhz.exe
  2⤵
  PID:7992
- C:\Windows\System\JEqJXEx.exe
  C:\Windows\System\JEqJXEx.exe
  2⤵
  PID:7844
- C:\Windows\System\JgFuNqL.exe
  C:\Windows\System\JgFuNqL.exe
  2⤵
  PID:7840
- C:\Windows\System\fGhhPlK.exe
  C:\Windows\System\fGhhPlK.exe
  2⤵
  PID:8096
- C:\Windows\System\AGQmOyC.exe
  C:\Windows\System\AGQmOyC.exe
  2⤵
  PID:8188
- C:\Windows\System\BGUEBrx.exe
  C:\Windows\System\BGUEBrx.exe
  2⤵
  PID:8112
- C:\Windows\System\MzOccZR.exe
  C:\Windows\System\MzOccZR.exe
  2⤵
  PID:7880
- C:\Windows\System\OHnMxuo.exe
  C:\Windows\System\OHnMxuo.exe
  2⤵
  PID:7204
- C:\Windows\System\jQnPrIj.exe
  C:\Windows\System\jQnPrIj.exe
  2⤵
  PID:8008
- C:\Windows\System\uiigmpD.exe
  C:\Windows\System\uiigmpD.exe
  2⤵
  PID:8144
- C:\Windows\System\hlvFkHM.exe
  C:\Windows\System\hlvFkHM.exe
  2⤵
  PID:7912
- C:\Windows\System\oUUOMEC.exe
  C:\Windows\System\oUUOMEC.exe
  2⤵
  PID:7020
- C:\Windows\System\GlxoCQO.exe
  C:\Windows\System\GlxoCQO.exe
  2⤵
  PID:7256
- C:\Windows\System\NaHnMNb.exe
  C:\Windows\System\NaHnMNb.exe
  2⤵
  PID:7308
- C:\Windows\System\XdkXKqz.exe
  C:\Windows\System\XdkXKqz.exe
  2⤵
  PID:7324
- C:\Windows\System\IVelIXH.exe
  C:\Windows\System\IVelIXH.exe
  2⤵
  PID:7616
- C:\Windows\System\wkWxMpx.exe
  C:\Windows\System\wkWxMpx.exe
  2⤵
  PID:7548
- C:\Windows\System\ViBjXQb.exe
  C:\Windows\System\ViBjXQb.exe
  2⤵
  PID:7620
- C:\Windows\System\imSyoXW.exe
  C:\Windows\System\imSyoXW.exe
  2⤵
  PID:7728
- C:\Windows\System\isRdoWC.exe
  C:\Windows\System\isRdoWC.exe
  2⤵
  PID:7824
- C:\Windows\System\cJJPUem.exe
  C:\Windows\System\cJJPUem.exe
  2⤵
  PID:7996
- C:\Windows\System\vHPUExw.exe
  C:\Windows\System\vHPUExw.exe
  2⤵
  PID:8064
- C:\Windows\System\nLRpzBe.exe
  C:\Windows\System\nLRpzBe.exe
  2⤵
  PID:7960
- C:\Windows\System\gagflUg.exe
  C:\Windows\System\gagflUg.exe
  2⤵
  PID:8128
- C:\Windows\System\SSjDAXH.exe
  C:\Windows\System\SSjDAXH.exe
  2⤵
  PID:8076
- C:\Windows\System\NhDHvTL.exe
  C:\Windows\System\NhDHvTL.exe
  2⤵
  PID:5812
- C:\Windows\System\ycBAakh.exe
  C:\Windows\System\ycBAakh.exe
  2⤵
  PID:6192
- C:\Windows\System\MYbOFlJ.exe
  C:\Windows\System\MYbOFlJ.exe
  2⤵
  PID:7276
- C:\Windows\System\OZNgesP.exe
  C:\Windows\System\OZNgesP.exe
  2⤵
  PID:7292
- C:\Windows\System\OHreRuo.exe
  C:\Windows\System\OHreRuo.exe
  2⤵
  PID:7340
- C:\Windows\System\KHLhUFU.exe
  C:\Windows\System\KHLhUFU.exe
  2⤵
  PID:7432
- C:\Windows\System\XSbRyHC.exe
  C:\Windows\System\XSbRyHC.exe
  2⤵
  PID:7568
- C:\Windows\System\lXVAtGU.exe
  C:\Windows\System\lXVAtGU.exe
  2⤵
  PID:7668
- C:\Windows\System\NEMkdxx.exe
  C:\Windows\System\NEMkdxx.exe
  2⤵
  PID:7388
- C:\Windows\System\NvGoXwn.exe
  C:\Windows\System\NvGoXwn.exe
  2⤵
  PID:7684
- C:\Windows\System\mfddVsZ.exe
  C:\Windows\System\mfddVsZ.exe
  2⤵
  PID:7748
- C:\Windows\System\CNCzUTc.exe
  C:\Windows\System\CNCzUTc.exe
  2⤵
  PID:7976
- C:\Windows\System\EjXdvqx.exe
  C:\Windows\System\EjXdvqx.exe
  2⤵
  PID:8140
- C:\Windows\System\dyDOrFD.exe
  C:\Windows\System\dyDOrFD.exe
  2⤵
  PID:8080
- C:\Windows\System\FBrstev.exe
  C:\Windows\System\FBrstev.exe
  2⤵
  PID:8108
- C:\Windows\System\NCXMjwV.exe
  C:\Windows\System\NCXMjwV.exe
  2⤵
  PID:7224
- C:\Windows\System\hocBJCU.exe
  C:\Windows\System\hocBJCU.exe
  2⤵
  PID:7552
- C:\Windows\System\mZcPFGH.exe
  C:\Windows\System\mZcPFGH.exe
  2⤵
  PID:7744
- C:\Windows\System\CFPruDd.exe
  C:\Windows\System\CFPruDd.exe
  2⤵
  PID:6772
- C:\Windows\System\HCfgVwo.exe
  C:\Windows\System\HCfgVwo.exe
  2⤵
  PID:7664
- C:\Windows\System\NoEdKNJ.exe
  C:\Windows\System\NoEdKNJ.exe
  2⤵
  PID:7764
- C:\Windows\System\RgrtDDY.exe
  C:\Windows\System\RgrtDDY.exe
  2⤵
  PID:8204
- C:\Windows\System\KTAiWaP.exe
  C:\Windows\System\KTAiWaP.exe
  2⤵
  PID:8220
- C:\Windows\System\kVUebzS.exe
  C:\Windows\System\kVUebzS.exe
  2⤵
  PID:8236
- C:\Windows\System\jBMElJf.exe
  C:\Windows\System\jBMElJf.exe
  2⤵
  PID:8256
- C:\Windows\System\ostKBYj.exe
  C:\Windows\System\ostKBYj.exe
  2⤵
  PID:8272
- C:\Windows\System\pXPKkkW.exe
  C:\Windows\System\pXPKkkW.exe
  2⤵
  PID:8288
- C:\Windows\System\iNDtOhX.exe
  C:\Windows\System\iNDtOhX.exe
  2⤵
  PID:8304
- C:\Windows\System\GbdbnsH.exe
  C:\Windows\System\GbdbnsH.exe
  2⤵
  PID:8320
- C:\Windows\System\bgzmOSF.exe
  C:\Windows\System\bgzmOSF.exe
  2⤵
  PID:8336
- C:\Windows\System\PIsOSla.exe
  C:\Windows\System\PIsOSla.exe
  2⤵
  PID:8352
- C:\Windows\System\uTzuCnf.exe
  C:\Windows\System\uTzuCnf.exe
  2⤵
  PID:8368
- C:\Windows\System\shKYfrx.exe
  C:\Windows\System\shKYfrx.exe
  2⤵
  PID:8384
- C:\Windows\System\CGdYPCW.exe
  C:\Windows\System\CGdYPCW.exe
  2⤵
  PID:8400
- C:\Windows\System\osdGFCm.exe
  C:\Windows\System\osdGFCm.exe
  2⤵
  PID:8416
- C:\Windows\System\zybYXZc.exe
  C:\Windows\System\zybYXZc.exe
  2⤵
  PID:8432
- C:\Windows\System\VxWwcLI.exe
  C:\Windows\System\VxWwcLI.exe
  2⤵
  PID:8448
- C:\Windows\System\MYamtAu.exe
  C:\Windows\System\MYamtAu.exe
  2⤵
  PID:8464
- C:\Windows\System\wEnvwQQ.exe
  C:\Windows\System\wEnvwQQ.exe
  2⤵
  PID:8480
- C:\Windows\System\NpxCxFr.exe
  C:\Windows\System\NpxCxFr.exe
  2⤵
  PID:8496
- C:\Windows\System\RzTFmlR.exe
  C:\Windows\System\RzTFmlR.exe
  2⤵
  PID:8516
- C:\Windows\System\IntqBov.exe
  C:\Windows\System\IntqBov.exe
  2⤵
  PID:8532
- C:\Windows\System\GWOkXbc.exe
  C:\Windows\System\GWOkXbc.exe
  2⤵
  PID:8548
- C:\Windows\System\wkJfvFx.exe
  C:\Windows\System\wkJfvFx.exe
  2⤵
  PID:8564
- C:\Windows\System\lRvBdzJ.exe
  C:\Windows\System\lRvBdzJ.exe
  2⤵
  PID:8580
- C:\Windows\System\sLDoOxF.exe
  C:\Windows\System\sLDoOxF.exe
  2⤵
  PID:8596
- C:\Windows\System\ulQvdcW.exe
  C:\Windows\System\ulQvdcW.exe
  2⤵
  PID:8612
- C:\Windows\System\bJDCdGq.exe
  C:\Windows\System\bJDCdGq.exe
  2⤵
  PID:8640
- C:\Windows\System\srNSpMb.exe
  C:\Windows\System\srNSpMb.exe
  2⤵
  PID:8656
- C:\Windows\System\EtqkWey.exe
  C:\Windows\System\EtqkWey.exe
  2⤵
  PID:8676
- C:\Windows\System\jnVMJiy.exe
  C:\Windows\System\jnVMJiy.exe
  2⤵
  PID:8692
- C:\Windows\System\xgacDSa.exe
  C:\Windows\System\xgacDSa.exe
  2⤵
  PID:8708
- C:\Windows\System\KeeizWa.exe
  C:\Windows\System\KeeizWa.exe
  2⤵
  PID:8724
- C:\Windows\System\BTjFYUI.exe
  C:\Windows\System\BTjFYUI.exe
  2⤵
  PID:8740
- C:\Windows\System\nPZtEJx.exe
  C:\Windows\System\nPZtEJx.exe
  2⤵
  PID:8756
- C:\Windows\System\QofgIXi.exe
  C:\Windows\System\QofgIXi.exe
  2⤵
  PID:8772
- C:\Windows\System\QmZQcTV.exe
  C:\Windows\System\QmZQcTV.exe
  2⤵
  PID:8788
- C:\Windows\System\VFwWYNG.exe
  C:\Windows\System\VFwWYNG.exe
  2⤵
  PID:8804
- C:\Windows\System\EAVztFo.exe
  C:\Windows\System\EAVztFo.exe
  2⤵
  PID:8820
- C:\Windows\System\ZPPcZKl.exe
  C:\Windows\System\ZPPcZKl.exe
  2⤵
  PID:8836
- C:\Windows\System\XymowKz.exe
  C:\Windows\System\XymowKz.exe
  2⤵
  PID:8852
- C:\Windows\System\JCvsFtO.exe
  C:\Windows\System\JCvsFtO.exe
  2⤵
  PID:8872
- C:\Windows\System\aqTPGdP.exe
  C:\Windows\System\aqTPGdP.exe
  2⤵
  PID:8888
- C:\Windows\System\bRZrJzs.exe
  C:\Windows\System\bRZrJzs.exe
  2⤵
  PID:8904
- C:\Windows\System\heUJnHZ.exe
  C:\Windows\System\heUJnHZ.exe
  2⤵
  PID:8920
- C:\Windows\System\xXhymMV.exe
  C:\Windows\System\xXhymMV.exe
  2⤵
  PID:8936
- C:\Windows\System\gxkVYln.exe
  C:\Windows\System\gxkVYln.exe
  2⤵
  PID:8952
- C:\Windows\System\jGUqwsv.exe
  C:\Windows\System\jGUqwsv.exe
  2⤵
  PID:9092
- C:\Windows\System\ChcDWGM.exe
  C:\Windows\System\ChcDWGM.exe
  2⤵
  PID:9108
- C:\Windows\System\GHyRwOl.exe
  C:\Windows\System\GHyRwOl.exe
  2⤵
  PID:9124
- C:\Windows\System\NPckYVl.exe
  C:\Windows\System\NPckYVl.exe
  2⤵
  PID:9144
- C:\Windows\System\rXgtdoC.exe
  C:\Windows\System\rXgtdoC.exe
  2⤵
  PID:9160
- C:\Windows\System\qMnsfgr.exe
  C:\Windows\System\qMnsfgr.exe
  2⤵
  PID:9176
- C:\Windows\System\wtHmAeg.exe
  C:\Windows\System\wtHmAeg.exe
  2⤵
  PID:9192
- C:\Windows\System\IhNVpCL.exe
  C:\Windows\System\IhNVpCL.exe
  2⤵
  PID:9212
- C:\Windows\System\emDKOnt.exe
  C:\Windows\System\emDKOnt.exe
  2⤵
  PID:8328
- C:\Windows\System\mcASXdJ.exe
  C:\Windows\System\mcASXdJ.exe
  2⤵
  PID:8440
- C:\Windows\System\CzZKjaB.exe
  C:\Windows\System\CzZKjaB.exe
  2⤵
  PID:8424
- C:\Windows\System\IqCjszV.exe
  C:\Windows\System\IqCjszV.exe
  2⤵
  PID:8488
- C:\Windows\System\tKMYmig.exe
  C:\Windows\System\tKMYmig.exe
  2⤵
  PID:8508
- C:\Windows\System\uPqMjEt.exe
  C:\Windows\System\uPqMjEt.exe
  2⤵
  PID:8572
- C:\Windows\System\LbuKvMQ.exe
  C:\Windows\System\LbuKvMQ.exe
  2⤵
  PID:8688
- C:\Windows\System\HKaJlzU.exe
  C:\Windows\System\HKaJlzU.exe
  2⤵
  PID:8736
- C:\Windows\System\gzLxRQL.exe
  C:\Windows\System\gzLxRQL.exe
  2⤵
  PID:8752
- C:\Windows\System\eHzSTLd.exe
  C:\Windows\System\eHzSTLd.exe
  2⤵
  PID:8780
- C:\Windows\System\HFdMMpO.exe
  C:\Windows\System\HFdMMpO.exe
  2⤵
  PID:8828
- C:\Windows\System\ZNTVfZb.exe
  C:\Windows\System\ZNTVfZb.exe
  2⤵
  PID:9116
- C:\Windows\System\ZKmERDm.exe
  C:\Windows\System\ZKmERDm.exe
  2⤵
  PID:9152
- C:\Windows\System\kqCIJhH.exe
  C:\Windows\System\kqCIJhH.exe
  2⤵
  PID:9204
- C:\Windows\System\jTnMNfk.exe
  C:\Windows\System\jTnMNfk.exe
  2⤵
  PID:7896
- C:\Windows\System\eaSidbF.exe
  C:\Windows\System\eaSidbF.exe
  2⤵
  PID:7980
- C:\Windows\System\vONdIGT.exe
  C:\Windows\System\vONdIGT.exe
  2⤵
  PID:8588
- C:\Windows\System\EwPDSjx.exe
  C:\Windows\System\EwPDSjx.exe
  2⤵
  PID:8524
- C:\Windows\System\yMvkKDX.exe
  C:\Windows\System\yMvkKDX.exe
  2⤵
  PID:8944
- C:\Windows\System\LGemmlR.exe
  C:\Windows\System\LGemmlR.exe
  2⤵
  PID:8972
- C:\Windows\System\BKwUIgZ.exe
  C:\Windows\System\BKwUIgZ.exe
  2⤵
  PID:9004
- C:\Windows\System\wFcnSaI.exe
  C:\Windows\System\wFcnSaI.exe
  2⤵
  PID:9032
- C:\Windows\System\gIcCrpq.exe
  C:\Windows\System\gIcCrpq.exe
  2⤵
  PID:9060
- C:\Windows\System\EVsVrAA.exe
  C:\Windows\System\EVsVrAA.exe
  2⤵
  PID:8984
- C:\Windows\System\DJJigvE.exe
  C:\Windows\System\DJJigvE.exe
  2⤵
  PID:9020
- C:\Windows\System\BrZXZry.exe
  C:\Windows\System\BrZXZry.exe
  2⤵
  PID:8264
- C:\Windows\System\fnNDpVH.exe
  C:\Windows\System\fnNDpVH.exe
  2⤵
  PID:8848
- C:\Windows\System\WZpzqGS.exe
  C:\Windows\System\WZpzqGS.exe
  2⤵
  PID:8812
- C:\Windows\System\oeqzztD.exe
  C:\Windows\System\oeqzztD.exe
  2⤵
  PID:8864
- C:\Windows\System\bPHQWhF.exe
  C:\Windows\System\bPHQWhF.exe
  2⤵
  PID:8900
- C:\Windows\System\eFbHPvq.exe
  C:\Windows\System\eFbHPvq.exe
  2⤵
  PID:8928
- C:\Windows\System\YoOxbpG.exe
  C:\Windows\System\YoOxbpG.exe
  2⤵
  PID:9008
- C:\Windows\System\gkmkeBH.exe
  C:\Windows\System\gkmkeBH.exe
  2⤵
  PID:9068
- C:\Windows\System\hcrLERN.exe
  C:\Windows\System\hcrLERN.exe
  2⤵
  PID:9036
- C:\Windows\System\PkOTMoK.exe
  C:\Windows\System\PkOTMoK.exe
  2⤵
  PID:9056
- C:\Windows\System\GXOrjwj.exe
  C:\Windows\System\GXOrjwj.exe
  2⤵
  PID:9156
- C:\Windows\System\eLPjIfJ.exe
  C:\Windows\System\eLPjIfJ.exe
  2⤵
  PID:9080
- C:\Windows\System\wRrjcaZ.exe
  C:\Windows\System\wRrjcaZ.exe
  2⤵
  PID:9184
- C:\Windows\System\LBTEWDD.exe
  C:\Windows\System\LBTEWDD.exe
  2⤵
  PID:7600
- C:\Windows\System\NhGFztw.exe
  C:\Windows\System\NhGFztw.exe
  2⤵
  PID:8244
- C:\Windows\System\hDFybRA.exe
  C:\Windows\System\hDFybRA.exe
  2⤵
  PID:8284
- C:\Windows\System\DpBiZkc.exe
  C:\Windows\System\DpBiZkc.exe
  2⤵
  PID:8316
- C:\Windows\System\eiAeJJn.exe
  C:\Windows\System\eiAeJJn.exe
  2⤵
  PID:8560
- C:\Windows\System\uVgmSJy.exe
  C:\Windows\System\uVgmSJy.exe
  2⤵
  PID:8408
- C:\Windows\System\brDtotZ.exe
  C:\Windows\System\brDtotZ.exe
  2⤵
  PID:8652
- C:\Windows\System\qDNQWBL.exe
  C:\Windows\System\qDNQWBL.exe
  2⤵
  PID:8556
- C:\Windows\System\hgTWCmN.exe
  C:\Windows\System\hgTWCmN.exe
  2⤵
  PID:8604
- C:\Windows\System\QOgsXAw.exe
  C:\Windows\System\QOgsXAw.exe
  2⤵
  PID:9016
- C:\Windows\System\zgpiHAP.exe
  C:\Windows\System\zgpiHAP.exe
  2⤵
  PID:8960
- C:\Windows\System\TVrBFUt.exe
  C:\Windows\System\TVrBFUt.exe
  2⤵
  PID:8196
- C:\Windows\System\BjUiTgY.exe
  C:\Windows\System\BjUiTgY.exe
  2⤵
  PID:8832
- C:\Windows\System\kuUbkDU.exe
  C:\Windows\System\kuUbkDU.exe
  2⤵
  PID:9172
- C:\Windows\System\aKWKXcf.exe
  C:\Windows\System\aKWKXcf.exe
  2⤵
  PID:8412
- C:\Windows\System\EABpSyr.exe
  C:\Windows\System\EABpSyr.exe
  2⤵
  PID:8456
- C:\Windows\System\VzGJJhJ.exe
  C:\Windows\System\VzGJJhJ.exe
  2⤵
  PID:8968
- C:\Windows\System\hYoyIJv.exe
  C:\Windows\System\hYoyIJv.exe
  2⤵
  PID:9088
- C:\Windows\System\lvpgUJT.exe
  C:\Windows\System\lvpgUJT.exe
  2⤵
  PID:9072
- C:\Windows\System\CXPNZTY.exe
  C:\Windows\System\CXPNZTY.exe
  2⤵
  PID:8748
- C:\Windows\System\LlIbsKH.exe
  C:\Windows\System\LlIbsKH.exe
  2⤵
  PID:8504
- C:\Windows\System\HwveYss.exe
  C:\Windows\System\HwveYss.exe
  2⤵
  PID:8868
- C:\Windows\System\fVKJVmd.exe
  C:\Windows\System\fVKJVmd.exe
  2⤵
  PID:8912
- C:\Windows\System\NhoCMhy.exe
  C:\Windows\System\NhoCMhy.exe
  2⤵
  PID:8796
- C:\Windows\System\vnNdzWo.exe
  C:\Windows\System\vnNdzWo.exe
  2⤵
  PID:9220
- C:\Windows\System\BhFUtYK.exe
  C:\Windows\System\BhFUtYK.exe
  2⤵
  PID:9236
- C:\Windows\System\SnJyiQc.exe
  C:\Windows\System\SnJyiQc.exe
  2⤵
  PID:9252
- C:\Windows\System\IZvIVWg.exe
  C:\Windows\System\IZvIVWg.exe
  2⤵
  PID:9268
- C:\Windows\System\CtCgnnJ.exe
  C:\Windows\System\CtCgnnJ.exe
  2⤵
  PID:9400
- C:\Windows\System\mBbvWaN.exe
  C:\Windows\System\mBbvWaN.exe
  2⤵
  PID:9420
- C:\Windows\System\CfjDxrM.exe
  C:\Windows\System\CfjDxrM.exe
  2⤵
  PID:9588
- C:\Windows\System\CUgKGiL.exe
  C:\Windows\System\CUgKGiL.exe
  2⤵
  PID:9652
- C:\Windows\System\UgdCegN.exe
  C:\Windows\System\UgdCegN.exe
  2⤵
  PID:9668
- C:\Windows\System\CYcddPt.exe
  C:\Windows\System\CYcddPt.exe
  2⤵
  PID:9688
- C:\Windows\System\yMUrsmZ.exe
  C:\Windows\System\yMUrsmZ.exe
  2⤵
  PID:9708
- C:\Windows\System\seIsROF.exe
  C:\Windows\System\seIsROF.exe
  2⤵
  PID:9724
- C:\Windows\System\fLyKSqZ.exe
  C:\Windows\System\fLyKSqZ.exe
  2⤵
  PID:9740
- C:\Windows\System\YzDQOOO.exe
  C:\Windows\System\YzDQOOO.exe
  2⤵
  PID:9760
- C:\Windows\System\JCwEfaP.exe
  C:\Windows\System\JCwEfaP.exe
  2⤵
  PID:9776
- C:\Windows\System\zNvzYdY.exe
  C:\Windows\System\zNvzYdY.exe
  2⤵
  PID:9804
- C:\Windows\System\jZvnIsk.exe
  C:\Windows\System\jZvnIsk.exe
  2⤵
  PID:9820
- C:\Windows\System\ijdIqKJ.exe
  C:\Windows\System\ijdIqKJ.exe
  2⤵
  PID:9840
- C:\Windows\System\MYUVjhb.exe
  C:\Windows\System\MYUVjhb.exe
  2⤵
  PID:9860
- C:\Windows\System\SEahqIP.exe
  C:\Windows\System\SEahqIP.exe
  2⤵
  PID:9876
- C:\Windows\System\IpCdydj.exe
  C:\Windows\System\IpCdydj.exe
  2⤵
  PID:9904
- C:\Windows\System\MgtPAeu.exe
  C:\Windows\System\MgtPAeu.exe
  2⤵
  PID:9920
- C:\Windows\System\fhpsWQw.exe
  C:\Windows\System\fhpsWQw.exe
  2⤵
  PID:9936
- C:\Windows\System\NjoFWdf.exe
  C:\Windows\System\NjoFWdf.exe
  2⤵
  PID:9956
- C:\Windows\System\phXaFVN.exe
  C:\Windows\System\phXaFVN.exe
  2⤵
  PID:9972
- C:\Windows\System\apRGwWa.exe
  C:\Windows\System\apRGwWa.exe
  2⤵
  PID:9988
- C:\Windows\System\uYltXrn.exe
  C:\Windows\System\uYltXrn.exe
  2⤵
  PID:10004
- C:\Windows\System\tZYkSiz.exe
  C:\Windows\System\tZYkSiz.exe
  2⤵
  PID:10028
- C:\Windows\System\bEXPSRp.exe
  C:\Windows\System\bEXPSRp.exe
  2⤵
  PID:10044
- C:\Windows\System\oqwJnam.exe
  C:\Windows\System\oqwJnam.exe
  2⤵
  PID:10060
- C:\Windows\System\RsZSNoU.exe
  C:\Windows\System\RsZSNoU.exe
  2⤵
  PID:10084
- C:\Windows\System\rhCORha.exe
  C:\Windows\System\rhCORha.exe
  2⤵
  PID:10100
- C:\Windows\System\hKGkUnf.exe
  C:\Windows\System\hKGkUnf.exe
  2⤵
  PID:10120
- C:\Windows\System\YPKRwLi.exe
  C:\Windows\System\YPKRwLi.exe
  2⤵
  PID:10140
- C:\Windows\System\sxcjnrY.exe
  C:\Windows\System\sxcjnrY.exe
  2⤵
  PID:10232
- C:\Windows\System\JLwyhYj.exe
  C:\Windows\System\JLwyhYj.exe
  2⤵
  PID:8476
- C:\Windows\System\obttGfV.exe
  C:\Windows\System\obttGfV.exe
  2⤵
  PID:9244
- C:\Windows\System\CVyLMpr.exe
  C:\Windows\System\CVyLMpr.exe
  2⤵
  PID:9320
- C:\Windows\System\iwGYjxh.exe
  C:\Windows\System\iwGYjxh.exe
  2⤵
  PID:9372
- C:\Windows\System\WNYSfYo.exe
  C:\Windows\System\WNYSfYo.exe
  2⤵
  PID:9392
- C:\Windows\System\Hokhtef.exe
  C:\Windows\System\Hokhtef.exe
  2⤵
  PID:9416
- C:\Windows\System\RUqNQer.exe
  C:\Windows\System\RUqNQer.exe
  2⤵
  PID:9456
- C:\Windows\System\gCVocBa.exe
  C:\Windows\System\gCVocBa.exe
  2⤵
  PID:9520
- C:\Windows\System\snuWEEp.exe
  C:\Windows\System\snuWEEp.exe
  2⤵
  PID:9524
- C:\Windows\System\pTJhWTX.exe
  C:\Windows\System\pTJhWTX.exe
  2⤵
  PID:9624
- C:\Windows\System\ZjIbHmG.exe
  C:\Windows\System\ZjIbHmG.exe
  2⤵
  PID:9448
- C:\Windows\System\TTCZcuN.exe
  C:\Windows\System\TTCZcuN.exe
  2⤵
  PID:9636
- C:\Windows\System\KuMWbSf.exe
  C:\Windows\System\KuMWbSf.exe
  2⤵
  PID:9504
- C:\Windows\System\dzrMNDq.exe
  C:\Windows\System\dzrMNDq.exe
  2⤵
  PID:9444
- C:\Windows\System\ihKAMyV.exe
  C:\Windows\System\ihKAMyV.exe
  2⤵
  PID:9560
- C:\Windows\System\UlJAcwE.exe
  C:\Windows\System\UlJAcwE.exe
  2⤵
  PID:9584
- C:\Windows\System\fDEPhQy.exe
  C:\Windows\System\fDEPhQy.exe
  2⤵
  PID:9680
- C:\Windows\System\basapfK.exe
  C:\Windows\System\basapfK.exe
  2⤵
  PID:9752
- C:\Windows\System\mhmllvx.exe
  C:\Windows\System\mhmllvx.exe
  2⤵
  PID:9828
- C:\Windows\System\zQpIhsu.exe
  C:\Windows\System\zQpIhsu.exe
  2⤵
  PID:9872
- C:\Windows\System\ZAVYado.exe
  C:\Windows\System\ZAVYado.exe
  2⤵
  PID:9768
- C:\Windows\System\ESYtukw.exe
  C:\Windows\System\ESYtukw.exe
  2⤵
  PID:9856
- C:\Windows\System\soHrvVJ.exe
  C:\Windows\System\soHrvVJ.exe
  2⤵
  PID:9952
- C:\Windows\System\LrcLrcF.exe
  C:\Windows\System\LrcLrcF.exe
  2⤵
  PID:9888
- C:\Windows\System\SJfDann.exe
  C:\Windows\System\SJfDann.exe
  2⤵
  PID:9932
- C:\Windows\System\qImItqC.exe
  C:\Windows\System\qImItqC.exe
  2⤵
  PID:9984
- C:\Windows\System\RAKOyNC.exe
  C:\Windows\System\RAKOyNC.exe
  2⤵
  PID:10024
- C:\Windows\System\tkXvtbZ.exe
  C:\Windows\System\tkXvtbZ.exe
  2⤵
  PID:10036
- C:\Windows\System\mDcPibO.exe
  C:\Windows\System\mDcPibO.exe
  2⤵
  PID:10092
- C:\Windows\System\dwxYBfY.exe
  C:\Windows\System\dwxYBfY.exe
  2⤵
  PID:10080
- C:\Windows\System\cjEtmWi.exe
  C:\Windows\System\cjEtmWi.exe
  2⤵
  PID:10148
- C:\Windows\System\HHYKozf.exe
  C:\Windows\System\HHYKozf.exe
  2⤵
  PID:10180
- C:\Windows\System\CZnrtUS.exe
  C:\Windows\System\CZnrtUS.exe
  2⤵
  PID:10208
- C:\Windows\System\YlCxHUm.exe
  C:\Windows\System\YlCxHUm.exe
  2⤵
  PID:8592
- C:\Windows\System\MlVfJWt.exe
  C:\Windows\System\MlVfJWt.exe
  2⤵
  PID:8460
- C:\Windows\System\GaKBzMR.exe
  C:\Windows\System\GaKBzMR.exe
  2⤵
  PID:8300
- C:\Windows\System\jLBXBUe.exe
  C:\Windows\System\jLBXBUe.exe
  2⤵
  PID:9348
- C:\Windows\System\qRdbbxE.exe
  C:\Windows\System\qRdbbxE.exe
  2⤵
  PID:9336
- C:\Windows\System\zQGMBzq.exe
  C:\Windows\System\zQGMBzq.exe
  2⤵
  PID:9368
- C:\Windows\System\cZrlQCb.exe
  C:\Windows\System\cZrlQCb.exe
  2⤵
  PID:9296
- C:\Windows\System\dEZDyGL.exe
  C:\Windows\System\dEZDyGL.exe
  2⤵
  PID:9264
- C:\Windows\System\JPiPvXl.exe
  C:\Windows\System\JPiPvXl.exe
  2⤵
  PID:8332
- C:\Windows\System\fYssgwn.exe
  C:\Windows\System\fYssgwn.exe
  2⤵
  PID:9380
- C:\Windows\System\GDZvxty.exe
  C:\Windows\System\GDZvxty.exe
  2⤵
  PID:9228
- C:\Windows\System\UJvJEML.exe
  C:\Windows\System\UJvJEML.exe
  2⤵
  PID:9260
- C:\Windows\System\qobvFLb.exe
  C:\Windows\System\qobvFLb.exe
  2⤵
  PID:9476
- C:\Windows\System\vhvRENP.exe
  C:\Windows\System\vhvRENP.exe
  2⤵
  PID:9600
- C:\Windows\System\WdQhpdp.exe
  C:\Windows\System\WdQhpdp.exe
  2⤵
  PID:9512
- C:\Windows\System\YMWTRzc.exe
  C:\Windows\System\YMWTRzc.exe
  2⤵
  PID:9544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AwOwCaT.exe

Filesize
1.5MB

MD5
119358e746ea33e2d91959bc3c6b8b84

SHA1
8f64e991fc1d3029628e3bbe583be3a0ae0b40cd

SHA256
907dfafd10785713ac7a7ef662d696a768e16ff758114f093c88dae5e8ece342

SHA512
fe478fff0881eef51e03ca10c37dd0cb08bf9096db25b94adcc8277eb15f029bed092c5ab85f6689710cb18b563a7052a14659f11835b578b0e8054c54f927dd

Download Submit
C:\Windows\system\CeDOSvq.exe

Filesize
1.5MB

MD5
d133165798fa6e458983ffaf49c9bb22

SHA1
72d9a2d0ce49644d44ed7ccdfecea80450b3ffc7

SHA256
3b74328a005bb02415834b86bc33f0b2cce4e047092b13fb7562fb993498dd15

SHA512
fb51306e181a0a60683935e17f0fb18625fa0c2d4cc997a2df5fce08f2bce9174c160c9a7246020942308d080b685e60f8dae6154c845f3ebef7e5a0c7dbb8e0

Download Submit
C:\Windows\system\GfKWaSj.exe

Filesize
1.5MB

MD5
f00ab500711d2043d104483bcbb7a754

SHA1
270eea0136f3073c4294807272ea6c7c86200a90

SHA256
5339f168322e994403d6a2e561fa075b099dcfd63c6f87dbf99db67e6ebf3ef1

SHA512
25056bdc5053288593a9c0b77039ac0e5d25925727e4288b7544997bf1c0accdb0665b9d6354568519d636a258499e0dcdda554190151258ff78a27ec86672eb

Download Submit
C:\Windows\system\PUlEnHU.exe

Filesize
1.5MB

MD5
48ff1f067e8984cb72cf01ce9cee6229

SHA1
bdf7cdd72a7e760de969c8f3c2365866b3da03b8

SHA256
aa681c4e6f20221741a68835a58b1b381ec3a2d0e2aa2d69d8e60fad1ddd801e

SHA512
e2fcbb91b427d2a2558ad44c7d6e94c312de1ef8c0c208315f2083044eacecc92928e1e14d97d448d543421a6e022a8a006d39fa6dd23629a037502d02bea358

Download Submit
C:\Windows\system\SQIkayp.exe

Filesize
1.5MB

MD5
d8768bc3553e512f5611156529d45fe6

SHA1
e13d3e0254ba0ffb5f6247c46552e65b1c3e58f3

SHA256
1450ffc96def4450a825d7fab2e8b390690ea34172f4468278ec9b67729b767f

SHA512
01e9b872e70834578c0ea49086201effcdd9c35e695a4a7b4c7c9aa106855acbb300d9911ee066fa67e5387a3707040cb0312ed30c4057bc77f1ca31c387478d

Download Submit
C:\Windows\system\SpGqjCo.exe

Filesize
1.5MB

MD5
16100d79973b47ad469702cbf3509ea5

SHA1
1c331edd97ab073b7d5bd73812b5ca608e3b5d25

SHA256
c886c9372b1acd0ab91618cf983dc229a6c49809b8704ff4bafa698427eecb5c

SHA512
b2e467500c8228079deebcd3e6659399a73ec53d04d8c495e310218ccc9cf5634d51b487db385b2fb95a13ead02643ccd4bbcdaab7861610a9d38e110aaec5f4

Download Submit
C:\Windows\system\UWsSBUc.exe

Filesize
1.5MB

MD5
33e30c48f152aba52bdf7005d4775da1

SHA1
8dcddbb29c21393d5f80e712556f5aabe5e32352

SHA256
52638fa1e6289865c3224ccfa5d756efd0a6508b5aed8198ef854dd780977cfe

SHA512
304c060d82c48373068ad870a1ba18c13747deb4d494662bad76f3b93deee0f0190348d2ac9bfc0a1665ea1940180ae0e9ae0994a5632f250d083f8954e7ef19

Download Submit
C:\Windows\system\VgrAczy.exe

Filesize
1.5MB

MD5
9a88d949a460f80617419de09dce62e7

SHA1
2c998583fe1c3eb626953153830d85f2fd21816a

SHA256
b8ebee1dc777c81f74413a54c072db11f3836202329921c61e8ce4f5891932fd

SHA512
acdadd3307114957018cbb971d13ed6ea6a3a7b199de2e31892e433c2d3e9a878bfeb1c5063644ffadf18859e9b3291b70fdb625c127026c53886b0ae953ff1d

Download Submit
C:\Windows\system\VofyiAF.exe

Filesize
1.5MB

MD5
dd522cddf5575ebb1e2baf8e82edbc83

SHA1
77232484d6c2f1c85f03ea28c57c5ec10281e1a5

SHA256
51eeeff4e689fd03e21b6358453ac19dea44031ffefa0342c875621745be393f

SHA512
db30fac187c3a3045441e1d71d20084dbb925f58c19849ca6dcef0c9d30a88dea7ab7bddfc370c4560259d4182761c5bec14007880af537185dff9c9e22540d0

Download Submit
C:\Windows\system\WJJbSBZ.exe

Filesize
1.5MB

MD5
b97376792db592c660db74d675f5f65b

SHA1
4c22db379259f316c3a9384633c80cc16dc1bd0d

SHA256
33cd8b47e040e3959046b4975c87f65e4cfd24590240f39bcebb4b94f28597f9

SHA512
f4a92b42d251add213f91dc42cebb368bfe16a059638eee5ab47dadaec0eef8ab5d8a7245a95eebbc47c12e7cf1115fb2917e33c94fdad4a74462636952586b9

Download Submit
C:\Windows\system\XhLfdoi.exe

Filesize
1.5MB

MD5
ca2119826560cffc85b8b3148d8bbccd

SHA1
9f6924e07b8de4602717a9371f0e8d051686246d

SHA256
90c7e07adacf71ae37806c33bafee2c2eb6ef233becd4116460ce8e27327bbdc

SHA512
593e91681842131feb9d4fb897952bc15dcf16662d861e0bc3ac23f10ea5e928143625be052a8f276a2700e069db00d1b6367324479554a2869a0806a5c11f2f

Download Submit
C:\Windows\system\cHTYJWq.exe

Filesize
1.5MB

MD5
bf7bc843eeaa22f83af99ba5cb150271

SHA1
27b391d3da7574a1a046d4834a2aff4868b8e8db

SHA256
b7b1b282f03fe42a844e2cf3cc6361cf4959aacc887ea516cfc6324ac44b81a0

SHA512
3b0f97ae80ec94c55fc99473007a61181901cf2528f0115721d87d68a6ba34820a8fe1ee74019d87472799d15b5f507f99211495650d9613eb966088613aa283

Download Submit
C:\Windows\system\frQkGMf.exe

Filesize
1.5MB

MD5
1a8f0108d93ab13a2e819ce38be622e1

SHA1
c6c75b699262dd2a3404171a1ea139e373c422d5

SHA256
ddfd93f60fde34a41a5d0914b0b6ab53aa6e77d8ba65d6462d7b79d70b039452

SHA512
0c74e90da764808f292d4e945b8674ba6f2d2953020bbcbfb4a288652d0d76360924c4bcdd2e9d318b270f90bc667d32aef71127708e210357eec563db666631

Download Submit
C:\Windows\system\iZEkhIw.exe

Filesize
1.5MB

MD5
03f17705bdd7c896a22433c1dbdceac5

SHA1
04052156ce636cae7e07d51e02f0c18dddac4621

SHA256
4b9e72aa7190dee1fc8fc62cefc39d67046c280741bb0260bed5ce8e8f0fd4e7

SHA512
00fd7f5f1e77718cd2959ade8bc06710e9524e15676da374e52187ab1b69c522b45b158d6ffa7c559eead0d4ff1eff5bbd1a65cc4853d8df39104171f8d56145

Download Submit
C:\Windows\system\jSfTzRl.exe

Filesize
1.5MB

MD5
12ac460963806c71083fd41890d7ce00

SHA1
12c03fd2747e7ea91423c804c5dc03d449ee9250

SHA256
8b3a7acb2b9ad11b62230528ef779fc8bd2b0a8a390a421612c70c089725febe

SHA512
947f13481c2b6af60c30cdf5477874eb512c865cd969d2601a238f379804b50156dc51152ec1d68b6ec280f5e2ad3800d8975d30b454c0dba3672a2a192be7f1

Download Submit
C:\Windows\system\jVGgWul.exe

Filesize
1.5MB

MD5
70fce55156ade17f18c3ccf70755bc2d

SHA1
38f9db2e826f16c49a192a135e3d0c5e5d04cea7

SHA256
78a64e88482d282011702cbfc05f8297bee77efc459a8045a1d1f2888dd838e1

SHA512
3684745d006f41f850f10c0bbd66dcfaf615515d48050b8a0ee56d84b602f503eb790b385cf1562619e11054f46d48661dd6d0eed6523c0507bf1d988e315e1c

Download Submit
C:\Windows\system\kMxctnW.exe

Filesize
1.5MB

MD5
3060bb9173b32cf3266587c5a330caab

SHA1
00e583e85c1da88af39461e832eb953063ba1f98

SHA256
3642b6f5aad58dee580af78fbed1e11179d2c7cd63b85a1fcfaf8c9b7b89538a

SHA512
6d4ad02f0dbce769d6a1e1f47bb8970524dd8ff85079a00f07e1c21f73cfefa0e4d3aa40102cea96ff7d33420a0859f5fb41cac9890b50b045974c0f7392c33d

Download Submit
C:\Windows\system\lVxhzvm.exe

Filesize
1.5MB

MD5
f5ac8868c109acc0a9ff2db838975f14

SHA1
506f8335e05cb68c25cc0cb8528f06193a510f30

SHA256
8cefd400c1f3f461f346fbe9a0c4e23be26282c859f04ac090f13d4fa5c56c5a

SHA512
023e75bf6b7307672dd6d8a2eaa564a91f79b03c3e751b0ffa7143daf00796f8b7b0f9810ee3f5957ff51c8d578bd88157bd61c8e3e6bd3641946b14687ad25a

Download Submit
C:\Windows\system\pDyjZIT.exe

Filesize
1.5MB

MD5
237d6ac3d109ef138041deabb635e76a

SHA1
3835d82185d51d4f3c93479c2e36b87f54e1cb8a

SHA256
a78c839970a1da78de7fde04db2878b06de2ecaf9014f71a6e6cb6f965a5810e

SHA512
b84cd06ab73b953f1b1e8608f6629d4cb42e929eb17553797c9be772d779bc709196092bacf2b7849b6c60db1536f9e5918b9812678d413dc44d44390a8864c1

Download Submit
C:\Windows\system\rImRBmH.exe

Filesize
1.5MB

MD5
e65dd386fbb63b19fcb201a962bc7e76

SHA1
6d563ba6a14f48ab431a84492273adc3ad861105

SHA256
489f2eefdfc356a5c9ca7a4599646b5fe6de53f6dadc205c2395d30f2ab1a701

SHA512
91f90d330a04044408fb7a5b72ad54b3cde72f4392f0ba042cb9500814c202c99f60da4878d2ca3f556fa60979577ae08ab8a230db666b793ff541b15cea653f

Download Submit
C:\Windows\system\roKbwAS.exe

Filesize
1.5MB

MD5
9bc1cf40994078f9dc56fbe313ec3d19

SHA1
e164c0c840abe5bdb235f82c8cf05a55d679c06d

SHA256
9de44ff513bba562f41d433e29493878260206298b4fac8147cea86616d1bb75

SHA512
e6ca7b8d20e31fa1b1b4566863ca17a005ece6f5914b8c57f08a44de99eb65ec01762f52a3e7233b58083ba49988dcb9062af3043a5c2766cf1333100caeb3b6

Download Submit
C:\Windows\system\vkkQueC.exe

Filesize
1.5MB

MD5
926d788186b697269aef551e3ea1276c

SHA1
1e10c9bcf505f1b3c96a9e7b1f2816c16ed93406

SHA256
c36adb47c5ce175753aec348ab75d53f6c9ae1d1127cab5028745263fb771efb

SHA512
6b5fcf685c776ced47e69b878ed9e211cce5938750a27c5f5f91d413a250ef78c3f397668f533a2506e48e8431a478a6033cedf2a463aab1080743965d053a4d

Download Submit
C:\Windows\system\xsiUpST.exe

Filesize
1.5MB

MD5
ae695f71a4e05caba1c57b2636bf0f0a

SHA1
8b5828aec5b2a5f9087ec3e3eee89889d34a6e22

SHA256
6f06a355251793330b16c07a23cfe1b18d8837b6a2f4c5d9423b773826c71e35

SHA512
4874780927e795d4d81d189cf5ed26a4c8da4c2569118dc8ece7b5a66d7da2cd238c288df0842dcd4540478915f1b82e807d1f95be7b434ad8c6b99f7528a643

Download Submit
\Windows\system\CoObIQw.exe

Filesize
1.5MB

MD5
d9a1f4c3f822fb97ea48b971bfabbd76

SHA1
72eab951a732dd0240e0f9c378a1b2dd52c45665

SHA256
de16f659e8422cc74492df8f7e1f13a498993ee4e81a35691608ac653c83e4f7

SHA512
14dc0e5ac2974314bd1b416bdb51d718927ec1dc8dc3737e71c5041d4691b24b4a8be613091e1194f8aafb2385298f614c0ef48bda9506de241c787546d30ab1

Download Submit
\Windows\system\FOjLkEG.exe

Filesize
1.5MB

MD5
56d06658b6ce7bea435e3d84caccdeee

SHA1
7f9562217eaefb01ad8ebaacd8c3c91a625f3a16

SHA256
d4bde70bb97065558c35f094d2aac7d36cc1a114691b288e845f8185f87921be

SHA512
e9dcde7ad7bfcd12eacae0dd9db6912316f1d5aff773986f1d23a6f8549f6350fed000d0c9a6198ccaafef0c8c42fff8954d90b9ddc606d5eb2b3897729180f2

Download Submit
\Windows\system\JtKzJKg.exe

Filesize
1.5MB

MD5
504e81717beadbecdf305882fc5041f1

SHA1
ed4a633cd5a162f24684fd268566798ccd21ea76

SHA256
48376162351eb0049aa4e16a9a532b109013ad435147b01480a16e4187266c24

SHA512
ec6ac39b44abd48226b408e7ad88ed2a9f6645bbe414d0b55071f5af2e2e103001f17ca599f271387d836ca7355a9b479f085b571a719c80f2164001fad8978f

Download Submit
\Windows\system\KHZKnzg.exe

Filesize
1.5MB

MD5
59c83d15ede9436dd01bc3d936f53a1a

SHA1
ea7c72776226feaee20bf76045b3d6379efd9621

SHA256
0f4dd1a1b8ac97c9bb95d074a579a50754d9c1bbf5a008601de836f2134bd35b

SHA512
c92b3f5fbc9697888c76185991c6e19910331630138857999f3221d40e9973d42b6e4ecc53a8bbb2764935b1bc2dc8e66e697d9e10a114c54642ddf4c3095611

Download Submit
\Windows\system\KkYbYSY.exe

Filesize
1.5MB

MD5
4f818db409ef6f42861d286ea718d068

SHA1
37c3d7737487f754cfbd8872876445a09019d6b8

SHA256
d3264573dd2ae51bbc743066ab6acb870b2927629661b9aa7ae0467761e43363

SHA512
0c1e41d1da50e496c4e0d5b96e9096ce4c49f92a621fb0c13e60bcc642a8cca7b11552ae2da5c71a9e6242e18376614c58219397d45de4745e0bc91fff5538fa

Download Submit
\Windows\system\NvWuBgv.exe

Filesize
1.5MB

MD5
efc6eec0d0238c88da3dcc6f0c4975ba

SHA1
6b62d63b44956d0326d546875e5541d9974ab16c

SHA256
9c3e17843e6e03b14af347d86f6efda6a3b5c8c816510f34b73f6c54655e638e

SHA512
df3f2c7a8c335d20fbcd5af008d05eea97a8870c70b1f77745cb989e0504244b35f09c59515a2a27f3cc81154f564f950c514c12348022d84e2171b6760f348d

Download Submit
\Windows\system\byWaTle.exe

Filesize
1.5MB

MD5
42e5aced8f607e0cf2e9bb2ce899b8ab

SHA1
e2d53818d7e171e366d4fe6d73984428ce1d0c27

SHA256
7f060d50736ffed1268277ce05c701d85c4bae2ff74465c5485053850f7f942d

SHA512
5cb3f63798c15231c79035a6cf94739818a7be4b9532599580730a4f80177b05bdfe5b56006e400615206369878d16e4fce59fbe084a0ed3488ed5ebca14dc9c

Download Submit
\Windows\system\fIHxCZh.exe

Filesize
1.5MB

MD5
7cd4c6b9c9b344baeee2f97d5ba786ab

SHA1
deab0f519fdaea01b86c890cf4fab54d40ed058b

SHA256
34cfd17c3acdc67c2d46fa01db2a742ff796bef5ae67b662f0181355a7c2dfb6

SHA512
0a56b688432586705b9176911c3bbb4b9bd82296fd49772c750dab63bd3645e5bb7adc0dc60da535cbaf9e6c3c435d5d10406088deff4e19018fd776a9b029dd

Download Submit
\Windows\system\kvlsFvq.exe

Filesize
1.5MB

MD5
f547b47b86907d088b9736923f67cd4e

SHA1
3677227666ba58ab6a1991c48d90c23a28e0eda1

SHA256
1675ad1f45f1de220fae527bd21095ebf85442f525f7467f8fa96cd23dca9095

SHA512
3a44c1fb20114367af53717c3ca73bf3c9d6704e3e0a41c0f57d6a408f817d5f04d0205b351e746d5df4b1588912ffc027aecd467dc6bf05ae86cb466d8012a8

Download Submit
memory/1756-46-0x000000013FF30000-0x0000000140281000-memory.dmp

Filesize
3.3MB

Download
memory/1756-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1756-78-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/1756-56-0x000000013F160000-0x000000013F4B1000-memory.dmp

Filesize
3.3MB

Download
memory/1756-7710-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/1756-7627-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/1756-118-0x000000013F210000-0x000000013F561000-memory.dmp

Filesize
3.3MB

Download
memory/1756-117-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/1756-0-0x000000013F620000-0x000000013F971000-memory.dmp

Filesize
3.3MB

Download
memory/1756-98-0x000000013FE00000-0x0000000140151000-memory.dmp

Filesize
3.3MB

Download
memory/1756-50-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Filesize
3.3MB

Download
memory/1756-3415-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/1756-7412-0x000000013FD70000-0x00000001400C1000-memory.dmp

Filesize
3.3MB

Download
memory/1756-39-0x000000013F620000-0x000000013F971000-memory.dmp

Filesize
3.3MB

Download
memory/1756-5963-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/1756-105-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/1756-299-0x000000013F090000-0x000000013F3E1000-memory.dmp

Filesize
3.3MB

Download
memory/1756-33-0x000000013F210000-0x000000013F561000-memory.dmp

Filesize
3.3MB

Download
memory/1756-110-0x000000013FD70000-0x00000001400C1000-memory.dmp

Filesize
3.3MB

Download
memory/1756-111-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/1756-17-0x000000013FF00000-0x0000000140251000-memory.dmp

Filesize
3.3MB

Download
memory/1756-1498-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/1756-12-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Filesize
3.3MB

Download
memory/1816-3661-0x000000013FE00000-0x0000000140151000-memory.dmp

Filesize
3.3MB

Download
memory/1816-103-0x000000013FE00000-0x0000000140151000-memory.dmp

Filesize
3.3MB

Download
memory/2084-3551-0x000000013FF00000-0x0000000140251000-memory.dmp

Filesize
3.3MB

Download
memory/2084-22-0x000000013FF00000-0x0000000140251000-memory.dmp

Filesize
3.3MB

Download
memory/2264-8-0x000000013FEF0000-0x0000000140241000-memory.dmp

Filesize
3.3MB

Download
memory/2264-3515-0x000000013FEF0000-0x0000000140241000-memory.dmp

Filesize
3.3MB

Download
memory/2264-49-0x000000013FEF0000-0x0000000140241000-memory.dmp

Filesize
3.3MB

Download
memory/2428-3642-0x000000013FD70000-0x00000001400C1000-memory.dmp

Filesize
3.3MB

Download
memory/2428-90-0x000000013FD70000-0x00000001400C1000-memory.dmp

Filesize
3.3MB

Download
memory/2492-3606-0x000000013FF30000-0x0000000140281000-memory.dmp

Filesize
3.3MB

Download
memory/2492-51-0x000000013FF30000-0x0000000140281000-memory.dmp

Filesize
3.3MB

Download
memory/2504-3591-0x000000013F910000-0x000000013FC61000-memory.dmp

Filesize
3.3MB

Download
memory/2504-42-0x000000013F910000-0x000000013FC61000-memory.dmp

Filesize
3.3MB

Download
memory/2512-83-0x000000013F3A0000-0x000000013F6F1000-memory.dmp

Filesize
3.3MB

Download
memory/2512-3655-0x000000013F3A0000-0x000000013F6F1000-memory.dmp

Filesize
3.3MB

Download
memory/2620-36-0x000000013F210000-0x000000013F561000-memory.dmp

Filesize
3.3MB

Download
memory/2620-801-0x000000013F210000-0x000000013F561000-memory.dmp

Filesize
3.3MB

Download
memory/2620-3589-0x000000013F210000-0x000000013F561000-memory.dmp

Filesize
3.3MB

Download
memory/2640-3252-0x000000013F160000-0x000000013F4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2640-3617-0x000000013F160000-0x000000013F4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2640-58-0x000000013F160000-0x000000013F4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2668-3572-0x000000013F090000-0x000000013F3E1000-memory.dmp

Filesize
3.3MB

Download
memory/2668-28-0x000000013F090000-0x000000013F3E1000-memory.dmp

Filesize
3.3MB

Download
memory/2668-799-0x000000013F090000-0x000000013F3E1000-memory.dmp

Filesize
3.3MB

Download
memory/2712-115-0x000000013F3D0000-0x000000013F721000-memory.dmp

Filesize
3.3MB

Download
memory/2712-3657-0x000000013F3D0000-0x000000013F721000-memory.dmp

Filesize
3.3MB

Download
memory/2776-3687-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-104-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/2840-3670-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2840-106-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/3048-21-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Filesize
3.3MB

Download
memory/3048-3541-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Filesize
3.3MB

Download