xmrig | ca46a1a20b127787baf77adcd9baa2bed07cd067120135298c547c5b1564d742

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
Size

1.5MB
MD5

7ff5035a3b507d0ed57c2baeb99483f0
SHA1

66630ad342c2438804df36f8ec1ee448ea6f0b18
SHA256

ca46a1a20b127787baf77adcd9baa2bed07cd067120135298c547c5b1564d742
SHA512

db20e0743819df7ec279478469a89e841f725c0b33a03d366a1b1f1e432e0eece0512f55a08a2493e09f67f421185316250b0f0b416d6269b435da35b57726f4
SSDEEP

24576:RVIl/WDGCi7/qkatuBF672l6i2Ncb2ygupgrnACAmZ/NwFC31G3AcMxA7De5qv/T:ROdWCCi7/raU56uL3pgrCEdMeb7UDlwK

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/1668-14-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/2860-49-0x000000013FD40000-0x0000000140091000-memory.dmp	xmrig
behavioral1/memory/2684-50-0x000000013FD40000-0x0000000140091000-memory.dmp	xmrig
behavioral1/memory/2700-47-0x000000013F990000-0x000000013FCE1000-memory.dmp	xmrig
behavioral1/memory/2544-80-0x000000013F910000-0x000000013FC61000-memory.dmp	xmrig
behavioral1/memory/2944-128-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/2664-125-0x000000013F8B0000-0x000000013FC01000-memory.dmp	xmrig
behavioral1/memory/2488-78-0x000000013FEF0000-0x0000000140241000-memory.dmp	xmrig
behavioral1/memory/2548-77-0x000000013F1F0000-0x000000013F541000-memory.dmp	xmrig
behavioral1/memory/1600-75-0x000000013F6B0000-0x000000013FA01000-memory.dmp	xmrig
behavioral1/memory/2860-60-0x000000013F8D0000-0x000000013FC21000-memory.dmp	xmrig
behavioral1/memory/2860-123-0x0000000002030000-0x0000000002381000-memory.dmp	xmrig
behavioral1/memory/2536-122-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/2124-1237-0x000000013FEC0000-0x0000000140211000-memory.dmp	xmrig
behavioral1/memory/2704-2121-0x000000013FEC0000-0x0000000140211000-memory.dmp	xmrig
behavioral1/memory/2776-2362-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	xmrig
behavioral1/memory/2544-3705-0x000000013F910000-0x000000013FC61000-memory.dmp	xmrig
behavioral1/memory/2488-3706-0x000000013FEF0000-0x0000000140241000-memory.dmp	xmrig
behavioral1/memory/2700-3709-0x000000013F990000-0x000000013FCE1000-memory.dmp	xmrig
behavioral1/memory/2704-3708-0x000000013FEC0000-0x0000000140211000-memory.dmp	xmrig
behavioral1/memory/2548-3710-0x000000013F1F0000-0x000000013F541000-memory.dmp	xmrig
behavioral1/memory/1600-3827-0x000000013F6B0000-0x000000013FA01000-memory.dmp	xmrig
behavioral1/memory/2776-3832-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	xmrig
behavioral1/memory/1668-3860-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/2124-3867-0x000000013FEC0000-0x0000000140211000-memory.dmp	xmrig
behavioral1/memory/2664-3868-0x000000013F8B0000-0x000000013FC01000-memory.dmp	xmrig
behavioral1/memory/2536-3869-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/2684-3879-0x000000013FD40000-0x0000000140091000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1600	IWYlMzc.exe
1668	BbcMXdZ.exe
2124	FAptoUa.exe
2704	jWLyaxB.exe
2776	eaDRKFc.exe
2700	TPJNOBE.exe
2684	XIDWcqP.exe
2548	jLwVRVD.exe
2488	XsmEdkT.exe
2544	IlDCdpS.exe
2536	gAyHdhl.exe
2664	DImyRNs.exe
2944	cawkQRV.exe
760	ahRcgTf.exe
1652	yDjyCGL.exe
464	pyYIkDV.exe
2256	CzLdtch.exe
2744	lqOmRRU.exe
2224	IKphCUm.exe
1676	omxAtIZ.exe
2408	IqwskdD.exe
1584	vmvqtEh.exe
1564	uRgoAXq.exe
1288	XUZGwjf.exe
2588	uDaQsmr.exe
2532	iTZArek.exe
2252	mOrlazD.exe
2880	KcPPOeo.exe
1804	RXzvUTg.exe
696	SqXCTYg.exe
1028	DFVFYUl.exe
1732	NKAgFBT.exe
1860	VbrBweG.exe
3008	fdGODfB.exe
1128	kIglQxD.exe
2232	wZRGzvl.exe
2460	XQmMvLf.exe
2112	DLFJzof.exe
1692	BMxhVfV.exe
1352	NPjygHf.exe
1512	ENAcNTG.exe
1548	SdbhrrZ.exe
1588	jIiSYAv.exe
1636	DPtoBAg.exe
2212	McBHRQS.exe
2208	BSyoPRq.exe
952	dkbvlmT.exe
2092	vrBgeVD.exe
2128	aaGVZkM.exe
2864	uRamcgg.exe
2304	mHOlrfb.exe
2076	tsLHDXi.exe
984	wADIOUQ.exe
884	HOZolmk.exe
540	ofGKLCQ.exe
2220	lhUcYox.exe
2052	QneXUzW.exe
2156	xPepZsP.exe
2788	aqVuFOm.exe
2260	UAJgSlv.exe
1580	Euimfhb.exe
2152	UIjUewM.exe
2724	nLbUTxs.exe
2024	lmhbedE.exe

Loads dropped DLL 64 IoCs

pid	Process
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-0-0x000000013F8D0000-0x000000013FC21000-memory.dmp	upx
behavioral1/files/0x000a000000012286-3.dat	upx
behavioral1/files/0x0038000000015670-6.dat	upx
behavioral1/files/0x0008000000015b6e-9.dat	upx
behavioral1/memory/2124-23-0x000000013FEC0000-0x0000000140211000-memory.dmp	upx
behavioral1/files/0x0007000000015cb8-24.dat	upx
behavioral1/memory/2776-35-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	upx
behavioral1/files/0x0007000000015cdf-36.dat	upx
behavioral1/files/0x0007000000015cc7-32.dat	upx
behavioral1/memory/1668-14-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx
behavioral1/memory/1600-13-0x000000013F6B0000-0x000000013FA01000-memory.dmp	upx
behavioral1/files/0x000600000001615c-64.dat	upx
behavioral1/files/0x0007000000015fef-54.dat	upx
behavioral1/memory/2684-50-0x000000013FD40000-0x0000000140091000-memory.dmp	upx
behavioral1/files/0x0009000000015ce8-51.dat	upx
behavioral1/memory/2700-47-0x000000013F990000-0x000000013FCE1000-memory.dmp	upx
behavioral1/files/0x0038000000015678-44.dat	upx
behavioral1/files/0x0006000000016cc1-118.dat	upx
behavioral1/memory/2544-80-0x000000013F910000-0x000000013FC61000-memory.dmp	upx
behavioral1/files/0x0006000000016d43-161.dat	upx
behavioral1/files/0x0006000000016d6f-189.dat	upx
behavioral1/files/0x0006000000016d68-184.dat	upx
behavioral1/files/0x0006000000016d64-179.dat	upx
behavioral1/files/0x0006000000016d4b-170.dat	upx
behavioral1/files/0x0006000000016d5f-174.dat	upx
behavioral1/files/0x0006000000016d3b-159.dat	upx
behavioral1/files/0x0006000000016d2a-150.dat	upx
behavioral1/files/0x0006000000016ceb-148.dat	upx
behavioral1/files/0x0006000000016d32-154.dat	upx
behavioral1/files/0x0006000000016c52-136.dat	upx
behavioral1/files/0x0006000000016835-134.dat	upx
behavioral1/files/0x0006000000016581-131.dat	upx
behavioral1/memory/2944-128-0x000000013F850000-0x000000013FBA1000-memory.dmp	upx
behavioral1/memory/2664-125-0x000000013F8B0000-0x000000013FC01000-memory.dmp	upx
behavioral1/files/0x0006000000016c78-111.dat	upx
behavioral1/files/0x000600000001611e-81.dat	upx
behavioral1/memory/2488-78-0x000000013FEF0000-0x0000000140241000-memory.dmp	upx
behavioral1/memory/2548-77-0x000000013F1F0000-0x000000013F541000-memory.dmp	upx
behavioral1/memory/1600-75-0x000000013F6B0000-0x000000013FA01000-memory.dmp	upx
behavioral1/files/0x00060000000162e4-67.dat	upx
behavioral1/files/0x0006000000016d17-139.dat	upx
behavioral1/memory/2860-60-0x000000013F8D0000-0x000000013FC21000-memory.dmp	upx
behavioral1/memory/2536-122-0x000000013FE40000-0x0000000140191000-memory.dmp	upx
behavioral1/files/0x0006000000016c6f-109.dat	upx
behavioral1/files/0x0006000000016a8a-100.dat	upx
behavioral1/files/0x00060000000165e1-92.dat	upx
behavioral1/files/0x0006000000016455-84.dat	upx
behavioral1/memory/2124-1237-0x000000013FEC0000-0x0000000140211000-memory.dmp	upx
behavioral1/memory/2704-2121-0x000000013FEC0000-0x0000000140211000-memory.dmp	upx
behavioral1/memory/2776-2362-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	upx
behavioral1/memory/2544-3705-0x000000013F910000-0x000000013FC61000-memory.dmp	upx
behavioral1/memory/2488-3706-0x000000013FEF0000-0x0000000140241000-memory.dmp	upx
behavioral1/memory/2700-3709-0x000000013F990000-0x000000013FCE1000-memory.dmp	upx
behavioral1/memory/2704-3708-0x000000013FEC0000-0x0000000140211000-memory.dmp	upx
behavioral1/memory/2548-3710-0x000000013F1F0000-0x000000013F541000-memory.dmp	upx
behavioral1/memory/1600-3827-0x000000013F6B0000-0x000000013FA01000-memory.dmp	upx
behavioral1/memory/2776-3832-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	upx
behavioral1/memory/1668-3860-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx
behavioral1/memory/2124-3867-0x000000013FEC0000-0x0000000140211000-memory.dmp	upx
behavioral1/memory/2664-3868-0x000000013F8B0000-0x000000013FC01000-memory.dmp	upx
behavioral1/memory/2536-3869-0x000000013FE40000-0x0000000140191000-memory.dmp	upx
behavioral1/memory/2684-3879-0x000000013FD40000-0x0000000140091000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gNMGxXj.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\AFvwONq.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\hoXjWsJ.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\pSkLiKT.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\AxPBpMj.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\yYnkhUv.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\bRlfblq.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\UQaAMuf.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\rhIYtRU.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\iJYelJH.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\zKbhkOk.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\YMXIWaj.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\nZPAZxR.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\RXzvUTg.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\ofGKLCQ.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\wVXroHs.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\IiffTpZ.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZoAdCoD.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZaYWAyu.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\YrKStlL.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\uCREhrL.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\gaXKLoP.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\cGoiGAu.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\XeMpuHm.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\XUCpvLT.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\UgltEWV.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\dzrDEFf.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\AKCoCoc.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\GhXToZK.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\pzKbsOL.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\qpRIXxn.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\JEZoLhG.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\GgqQVkt.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\jQDfJkh.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\FtIatgy.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\Xerypwt.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\FEggVhQ.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\aeFMvPC.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\hgzwfgK.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\GZWpCoa.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\ewiUuKC.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\DhOyeNS.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\MQBJPve.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\FTYheSF.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\aUfNdEs.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\VlUyVPn.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\lmhbedE.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\vqbeMTA.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\HtjVSTR.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\pyYIkDV.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\sbulWys.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\sVYNuTb.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\QPiEHce.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\DIVSqpy.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\XIDWcqP.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\ySSAuJR.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\msGFiWj.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\vxibxSm.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\KhqmFqj.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\hlzOJvM.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\KEBTyFE.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\uSIAjaL.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\NjwPMRg.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
File created	C:\Windows\System\VuvlFGm.exe	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1668	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	29
PID 2860 wrote to memory of 1668	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	29
PID 2860 wrote to memory of 1668	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	29
PID 2860 wrote to memory of 1600	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	30
PID 2860 wrote to memory of 1600	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	30
PID 2860 wrote to memory of 1600	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	30
PID 2860 wrote to memory of 2124	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	31
PID 2860 wrote to memory of 2124	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	31
PID 2860 wrote to memory of 2124	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	31
PID 2860 wrote to memory of 2704	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	32
PID 2860 wrote to memory of 2704	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	32
PID 2860 wrote to memory of 2704	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	32
PID 2860 wrote to memory of 2776	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	33
PID 2860 wrote to memory of 2776	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	33
PID 2860 wrote to memory of 2776	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	33
PID 2860 wrote to memory of 2700	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	34
PID 2860 wrote to memory of 2700	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	34
PID 2860 wrote to memory of 2700	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	34
PID 2860 wrote to memory of 2684	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	35
PID 2860 wrote to memory of 2684	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	35
PID 2860 wrote to memory of 2684	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	35
PID 2860 wrote to memory of 2548	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	36
PID 2860 wrote to memory of 2548	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	36
PID 2860 wrote to memory of 2548	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	36
PID 2860 wrote to memory of 2488	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	37
PID 2860 wrote to memory of 2488	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	37
PID 2860 wrote to memory of 2488	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	37
PID 2860 wrote to memory of 2536	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	38
PID 2860 wrote to memory of 2536	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	38
PID 2860 wrote to memory of 2536	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	38
PID 2860 wrote to memory of 2544	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	39
PID 2860 wrote to memory of 2544	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	39
PID 2860 wrote to memory of 2544	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	39
PID 2860 wrote to memory of 2256	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	40
PID 2860 wrote to memory of 2256	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	40
PID 2860 wrote to memory of 2256	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	40
PID 2860 wrote to memory of 2664	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	41
PID 2860 wrote to memory of 2664	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	41
PID 2860 wrote to memory of 2664	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	41
PID 2860 wrote to memory of 2744	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	42
PID 2860 wrote to memory of 2744	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	42
PID 2860 wrote to memory of 2744	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	42
PID 2860 wrote to memory of 2944	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	43
PID 2860 wrote to memory of 2944	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	43
PID 2860 wrote to memory of 2944	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	43
PID 2860 wrote to memory of 2224	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	44
PID 2860 wrote to memory of 2224	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	44
PID 2860 wrote to memory of 2224	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	44
PID 2860 wrote to memory of 760	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	45
PID 2860 wrote to memory of 760	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	45
PID 2860 wrote to memory of 760	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	45
PID 2860 wrote to memory of 1676	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	46
PID 2860 wrote to memory of 1676	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	46
PID 2860 wrote to memory of 1676	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	46
PID 2860 wrote to memory of 1652	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	47
PID 2860 wrote to memory of 1652	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	47
PID 2860 wrote to memory of 1652	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	47
PID 2860 wrote to memory of 1584	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	48
PID 2860 wrote to memory of 1584	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	48
PID 2860 wrote to memory of 1584	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	48
PID 2860 wrote to memory of 464	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	49
PID 2860 wrote to memory of 464	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	49
PID 2860 wrote to memory of 464	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	49
PID 2860 wrote to memory of 1564	2860	7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7ff5035a3b507d0ed57c2baeb99483f0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\System\BbcMXdZ.exe
  C:\Windows\System\BbcMXdZ.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\IWYlMzc.exe
  C:\Windows\System\IWYlMzc.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\FAptoUa.exe
  C:\Windows\System\FAptoUa.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\jWLyaxB.exe
  C:\Windows\System\jWLyaxB.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\eaDRKFc.exe
  C:\Windows\System\eaDRKFc.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\TPJNOBE.exe
  C:\Windows\System\TPJNOBE.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\XIDWcqP.exe
  C:\Windows\System\XIDWcqP.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\jLwVRVD.exe
  C:\Windows\System\jLwVRVD.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\XsmEdkT.exe
  C:\Windows\System\XsmEdkT.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\gAyHdhl.exe
  C:\Windows\System\gAyHdhl.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\IlDCdpS.exe
  C:\Windows\System\IlDCdpS.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\CzLdtch.exe
  C:\Windows\System\CzLdtch.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\DImyRNs.exe
  C:\Windows\System\DImyRNs.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\lqOmRRU.exe
  C:\Windows\System\lqOmRRU.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\cawkQRV.exe
  C:\Windows\System\cawkQRV.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\IKphCUm.exe
  C:\Windows\System\IKphCUm.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\ahRcgTf.exe
  C:\Windows\System\ahRcgTf.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\omxAtIZ.exe
  C:\Windows\System\omxAtIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\yDjyCGL.exe
  C:\Windows\System\yDjyCGL.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\vmvqtEh.exe
  C:\Windows\System\vmvqtEh.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\pyYIkDV.exe
  C:\Windows\System\pyYIkDV.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\uRgoAXq.exe
  C:\Windows\System\uRgoAXq.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\IqwskdD.exe
  C:\Windows\System\IqwskdD.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\XUZGwjf.exe
  C:\Windows\System\XUZGwjf.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\uDaQsmr.exe
  C:\Windows\System\uDaQsmr.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\iTZArek.exe
  C:\Windows\System\iTZArek.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\mOrlazD.exe
  C:\Windows\System\mOrlazD.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\KcPPOeo.exe
  C:\Windows\System\KcPPOeo.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\RXzvUTg.exe
  C:\Windows\System\RXzvUTg.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\SqXCTYg.exe
  C:\Windows\System\SqXCTYg.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\DFVFYUl.exe
  C:\Windows\System\DFVFYUl.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\NKAgFBT.exe
  C:\Windows\System\NKAgFBT.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\VbrBweG.exe
  C:\Windows\System\VbrBweG.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\fdGODfB.exe
  C:\Windows\System\fdGODfB.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\kIglQxD.exe
  C:\Windows\System\kIglQxD.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\wZRGzvl.exe
  C:\Windows\System\wZRGzvl.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\XQmMvLf.exe
  C:\Windows\System\XQmMvLf.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\DLFJzof.exe
  C:\Windows\System\DLFJzof.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\BMxhVfV.exe
  C:\Windows\System\BMxhVfV.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\NPjygHf.exe
  C:\Windows\System\NPjygHf.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\ENAcNTG.exe
  C:\Windows\System\ENAcNTG.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\SdbhrrZ.exe
  C:\Windows\System\SdbhrrZ.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\jIiSYAv.exe
  C:\Windows\System\jIiSYAv.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\McBHRQS.exe
  C:\Windows\System\McBHRQS.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\DPtoBAg.exe
  C:\Windows\System\DPtoBAg.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\BSyoPRq.exe
  C:\Windows\System\BSyoPRq.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\dkbvlmT.exe
  C:\Windows\System\dkbvlmT.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\vrBgeVD.exe
  C:\Windows\System\vrBgeVD.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\aaGVZkM.exe
  C:\Windows\System\aaGVZkM.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\uRamcgg.exe
  C:\Windows\System\uRamcgg.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\mHOlrfb.exe
  C:\Windows\System\mHOlrfb.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\tsLHDXi.exe
  C:\Windows\System\tsLHDXi.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\wADIOUQ.exe
  C:\Windows\System\wADIOUQ.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\HOZolmk.exe
  C:\Windows\System\HOZolmk.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\ofGKLCQ.exe
  C:\Windows\System\ofGKLCQ.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\lhUcYox.exe
  C:\Windows\System\lhUcYox.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\QneXUzW.exe
  C:\Windows\System\QneXUzW.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\Euimfhb.exe
  C:\Windows\System\Euimfhb.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\xPepZsP.exe
  C:\Windows\System\xPepZsP.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\UIjUewM.exe
  C:\Windows\System\UIjUewM.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\aqVuFOm.exe
  C:\Windows\System\aqVuFOm.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\nLbUTxs.exe
  C:\Windows\System\nLbUTxs.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\UAJgSlv.exe
  C:\Windows\System\UAJgSlv.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\lmhbedE.exe
  C:\Windows\System\lmhbedE.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\KmxoKgH.exe
  C:\Windows\System\KmxoKgH.exe
  2⤵
  PID:2512
- C:\Windows\System\KJBGTTr.exe
  C:\Windows\System\KJBGTTr.exe
  2⤵
  PID:2616
- C:\Windows\System\BpPYghU.exe
  C:\Windows\System\BpPYghU.exe
  2⤵
  PID:1604
- C:\Windows\System\aomQQFu.exe
  C:\Windows\System\aomQQFu.exe
  2⤵
  PID:2400
- C:\Windows\System\kRvZQtS.exe
  C:\Windows\System\kRvZQtS.exe
  2⤵
  PID:1992
- C:\Windows\System\gxRSdzm.exe
  C:\Windows\System\gxRSdzm.exe
  2⤵
  PID:1616
- C:\Windows\System\HBBXpEL.exe
  C:\Windows\System\HBBXpEL.exe
  2⤵
  PID:2608
- C:\Windows\System\mPIxPOV.exe
  C:\Windows\System\mPIxPOV.exe
  2⤵
  PID:1436
- C:\Windows\System\DVfywEW.exe
  C:\Windows\System\DVfywEW.exe
  2⤵
  PID:2928
- C:\Windows\System\KANYwKD.exe
  C:\Windows\System\KANYwKD.exe
  2⤵
  PID:2828
- C:\Windows\System\qGopjxc.exe
  C:\Windows\System\qGopjxc.exe
  2⤵
  PID:1144
- C:\Windows\System\eKiVRdl.exe
  C:\Windows\System\eKiVRdl.exe
  2⤵
  PID:1272
- C:\Windows\System\tHwdrEC.exe
  C:\Windows\System\tHwdrEC.exe
  2⤵
  PID:2268
- C:\Windows\System\WhrtPES.exe
  C:\Windows\System\WhrtPES.exe
  2⤵
  PID:2012
- C:\Windows\System\FTYheSF.exe
  C:\Windows\System\FTYheSF.exe
  2⤵
  PID:2280
- C:\Windows\System\DNGXMzb.exe
  C:\Windows\System\DNGXMzb.exe
  2⤵
  PID:2888
- C:\Windows\System\MwMmZZC.exe
  C:\Windows\System\MwMmZZC.exe
  2⤵
  PID:1472
- C:\Windows\System\XjDyzql.exe
  C:\Windows\System\XjDyzql.exe
  2⤵
  PID:1092
- C:\Windows\System\WbfUGVE.exe
  C:\Windows\System\WbfUGVE.exe
  2⤵
  PID:1736
- C:\Windows\System\NKYYwVp.exe
  C:\Windows\System\NKYYwVp.exe
  2⤵
  PID:1840
- C:\Windows\System\YzIAbHw.exe
  C:\Windows\System\YzIAbHw.exe
  2⤵
  PID:2108
- C:\Windows\System\JnkrQct.exe
  C:\Windows\System\JnkrQct.exe
  2⤵
  PID:2008
- C:\Windows\System\GQEnTqi.exe
  C:\Windows\System\GQEnTqi.exe
  2⤵
  PID:1524
- C:\Windows\System\YrKStlL.exe
  C:\Windows\System\YrKStlL.exe
  2⤵
  PID:300
- C:\Windows\System\FopWxBd.exe
  C:\Windows\System\FopWxBd.exe
  2⤵
  PID:304
- C:\Windows\System\yGmausx.exe
  C:\Windows\System\yGmausx.exe
  2⤵
  PID:1824
- C:\Windows\System\GaaxbVg.exe
  C:\Windows\System\GaaxbVg.exe
  2⤵
  PID:656
- C:\Windows\System\YwYbspq.exe
  C:\Windows\System\YwYbspq.exe
  2⤵
  PID:1628
- C:\Windows\System\lMyXxfj.exe
  C:\Windows\System\lMyXxfj.exe
  2⤵
  PID:3064
- C:\Windows\System\oySvPmA.exe
  C:\Windows\System\oySvPmA.exe
  2⤵
  PID:1724
- C:\Windows\System\JexApXm.exe
  C:\Windows\System\JexApXm.exe
  2⤵
  PID:1744
- C:\Windows\System\NaNNAwg.exe
  C:\Windows\System\NaNNAwg.exe
  2⤵
  PID:1568
- C:\Windows\System\nnzLxHE.exe
  C:\Windows\System\nnzLxHE.exe
  2⤵
  PID:2444
- C:\Windows\System\mWXmpDO.exe
  C:\Windows\System\mWXmpDO.exe
  2⤵
  PID:2784
- C:\Windows\System\qPyMuBO.exe
  C:\Windows\System\qPyMuBO.exe
  2⤵
  PID:1808
- C:\Windows\System\gJvvXhu.exe
  C:\Windows\System\gJvvXhu.exe
  2⤵
  PID:2660
- C:\Windows\System\hkMJZlB.exe
  C:\Windows\System\hkMJZlB.exe
  2⤵
  PID:344
- C:\Windows\System\aCsQIJN.exe
  C:\Windows\System\aCsQIJN.exe
  2⤵
  PID:2720
- C:\Windows\System\QtJBJVg.exe
  C:\Windows\System\QtJBJVg.exe
  2⤵
  PID:2620
- C:\Windows\System\zuHdNAG.exe
  C:\Windows\System\zuHdNAG.exe
  2⤵
  PID:2552
- C:\Windows\System\XRyrYnr.exe
  C:\Windows\System\XRyrYnr.exe
  2⤵
  PID:2476
- C:\Windows\System\vxvfAxD.exe
  C:\Windows\System\vxvfAxD.exe
  2⤵
  PID:876
- C:\Windows\System\sBduamp.exe
  C:\Windows\System\sBduamp.exe
  2⤵
  PID:1124
- C:\Windows\System\Xaicxig.exe
  C:\Windows\System\Xaicxig.exe
  2⤵
  PID:292
- C:\Windows\System\HAnmWbo.exe
  C:\Windows\System\HAnmWbo.exe
  2⤵
  PID:1036
- C:\Windows\System\kgdvFEH.exe
  C:\Windows\System\kgdvFEH.exe
  2⤵
  PID:2812
- C:\Windows\System\DyGrqdQ.exe
  C:\Windows\System\DyGrqdQ.exe
  2⤵
  PID:2836
- C:\Windows\System\BKoiMhU.exe
  C:\Windows\System\BKoiMhU.exe
  2⤵
  PID:1968
- C:\Windows\System\AiHZEIv.exe
  C:\Windows\System\AiHZEIv.exe
  2⤵
  PID:1608
- C:\Windows\System\oUVONtG.exe
  C:\Windows\System\oUVONtG.exe
  2⤵
  PID:2432
- C:\Windows\System\gLnOCux.exe
  C:\Windows\System\gLnOCux.exe
  2⤵
  PID:2320
- C:\Windows\System\IVMcDmT.exe
  C:\Windows\System\IVMcDmT.exe
  2⤵
  PID:1768
- C:\Windows\System\WlKdyyi.exe
  C:\Windows\System\WlKdyyi.exe
  2⤵
  PID:844
- C:\Windows\System\TpNpTBs.exe
  C:\Windows\System\TpNpTBs.exe
  2⤵
  PID:1740
- C:\Windows\System\BRPCWMZ.exe
  C:\Windows\System\BRPCWMZ.exe
  2⤵
  PID:928
- C:\Windows\System\AGBYbxW.exe
  C:\Windows\System\AGBYbxW.exe
  2⤵
  PID:1796
- C:\Windows\System\hsuVKnm.exe
  C:\Windows\System\hsuVKnm.exe
  2⤵
  PID:2016
- C:\Windows\System\UuhFSCE.exe
  C:\Windows\System\UuhFSCE.exe
  2⤵
  PID:1688
- C:\Windows\System\xDXPHfX.exe
  C:\Windows\System\xDXPHfX.exe
  2⤵
  PID:2096
- C:\Windows\System\hcOoAhV.exe
  C:\Windows\System\hcOoAhV.exe
  2⤵
  PID:2452
- C:\Windows\System\DpktAdv.exe
  C:\Windows\System\DpktAdv.exe
  2⤵
  PID:2492
- C:\Windows\System\dioyvrv.exe
  C:\Windows\System\dioyvrv.exe
  2⤵
  PID:2900
- C:\Windows\System\PqBKAKF.exe
  C:\Windows\System\PqBKAKF.exe
  2⤵
  PID:1748
- C:\Windows\System\sbQpGJx.exe
  C:\Windows\System\sbQpGJx.exe
  2⤵
  PID:280
- C:\Windows\System\QktAVgR.exe
  C:\Windows\System\QktAVgR.exe
  2⤵
  PID:1316
- C:\Windows\System\zhiFMjd.exe
  C:\Windows\System\zhiFMjd.exe
  2⤵
  PID:1996
- C:\Windows\System\xqRqSIA.exe
  C:\Windows\System\xqRqSIA.exe
  2⤵
  PID:2832
- C:\Windows\System\rdAriLr.exe
  C:\Windows\System\rdAriLr.exe
  2⤵
  PID:1380
- C:\Windows\System\xaYofkL.exe
  C:\Windows\System\xaYofkL.exe
  2⤵
  PID:544
- C:\Windows\System\wunTofh.exe
  C:\Windows\System\wunTofh.exe
  2⤵
  PID:2472
- C:\Windows\System\oOPEZnN.exe
  C:\Windows\System\oOPEZnN.exe
  2⤵
  PID:896
- C:\Windows\System\mtoLrLS.exe
  C:\Windows\System\mtoLrLS.exe
  2⤵
  PID:1800
- C:\Windows\System\xNKpCpO.exe
  C:\Windows\System\xNKpCpO.exe
  2⤵
  PID:2916
- C:\Windows\System\XxoqRKd.exe
  C:\Windows\System\XxoqRKd.exe
  2⤵
  PID:1576
- C:\Windows\System\bUFuyJp.exe
  C:\Windows\System\bUFuyJp.exe
  2⤵
  PID:2628
- C:\Windows\System\IlZioTq.exe
  C:\Windows\System\IlZioTq.exe
  2⤵
  PID:1372
- C:\Windows\System\KXGeXmz.exe
  C:\Windows\System\KXGeXmz.exe
  2⤵
  PID:1916
- C:\Windows\System\ATzvsHZ.exe
  C:\Windows\System\ATzvsHZ.exe
  2⤵
  PID:1920
- C:\Windows\System\kXGbYQh.exe
  C:\Windows\System\kXGbYQh.exe
  2⤵
  PID:1052
- C:\Windows\System\xhHKDVL.exe
  C:\Windows\System\xhHKDVL.exe
  2⤵
  PID:2824
- C:\Windows\System\XdYPGjh.exe
  C:\Windows\System\XdYPGjh.exe
  2⤵
  PID:1852
- C:\Windows\System\vVZZqWB.exe
  C:\Windows\System\vVZZqWB.exe
  2⤵
  PID:2160
- C:\Windows\System\dddUlYo.exe
  C:\Windows\System\dddUlYo.exe
  2⤵
  PID:1756
- C:\Windows\System\tppDiqu.exe
  C:\Windows\System\tppDiqu.exe
  2⤵
  PID:2656
- C:\Windows\System\eZtWoqh.exe
  C:\Windows\System\eZtWoqh.exe
  2⤵
  PID:888
- C:\Windows\System\mwLelWZ.exe
  C:\Windows\System\mwLelWZ.exe
  2⤵
  PID:1484
- C:\Windows\System\lJPLLAi.exe
  C:\Windows\System\lJPLLAi.exe
  2⤵
  PID:352
- C:\Windows\System\lfsRLut.exe
  C:\Windows\System\lfsRLut.exe
  2⤵
  PID:2640
- C:\Windows\System\RBycXZe.exe
  C:\Windows\System\RBycXZe.exe
  2⤵
  PID:3004
- C:\Windows\System\mSrHnWd.exe
  C:\Windows\System\mSrHnWd.exe
  2⤵
  PID:2856
- C:\Windows\System\CzVIBOU.exe
  C:\Windows\System\CzVIBOU.exe
  2⤵
  PID:1816
- C:\Windows\System\QEoPCSB.exe
  C:\Windows\System\QEoPCSB.exe
  2⤵
  PID:2044
- C:\Windows\System\xGtQzuW.exe
  C:\Windows\System\xGtQzuW.exe
  2⤵
  PID:2600
- C:\Windows\System\FwYdcwB.exe
  C:\Windows\System\FwYdcwB.exe
  2⤵
  PID:2412
- C:\Windows\System\eVYkdrA.exe
  C:\Windows\System\eVYkdrA.exe
  2⤵
  PID:2480
- C:\Windows\System\YXnQwOx.exe
  C:\Windows\System\YXnQwOx.exe
  2⤵
  PID:976
- C:\Windows\System\VDTxOmy.exe
  C:\Windows\System\VDTxOmy.exe
  2⤵
  PID:1772
- C:\Windows\System\VJdnhvx.exe
  C:\Windows\System\VJdnhvx.exe
  2⤵
  PID:1244
- C:\Windows\System\YDEsbQb.exe
  C:\Windows\System\YDEsbQb.exe
  2⤵
  PID:1428
- C:\Windows\System\WUMHPJl.exe
  C:\Windows\System\WUMHPJl.exe
  2⤵
  PID:2240
- C:\Windows\System\SBvFRGV.exe
  C:\Windows\System\SBvFRGV.exe
  2⤵
  PID:2180
- C:\Windows\System\CZtzILM.exe
  C:\Windows\System\CZtzILM.exe
  2⤵
  PID:1980
- C:\Windows\System\sBraWlE.exe
  C:\Windows\System\sBraWlE.exe
  2⤵
  PID:2100
- C:\Windows\System\QbYCEzI.exe
  C:\Windows\System\QbYCEzI.exe
  2⤵
  PID:2796
- C:\Windows\System\okflWVR.exe
  C:\Windows\System\okflWVR.exe
  2⤵
  PID:2672
- C:\Windows\System\cTRXdfI.exe
  C:\Windows\System\cTRXdfI.exe
  2⤵
  PID:1820
- C:\Windows\System\NjoYmqV.exe
  C:\Windows\System\NjoYmqV.exe
  2⤵
  PID:1180
- C:\Windows\System\EMmtQYf.exe
  C:\Windows\System\EMmtQYf.exe
  2⤵
  PID:2896
- C:\Windows\System\qTGaQge.exe
  C:\Windows\System\qTGaQge.exe
  2⤵
  PID:264
- C:\Windows\System\NprOOxA.exe
  C:\Windows\System\NprOOxA.exe
  2⤵
  PID:1252
- C:\Windows\System\TYQieSp.exe
  C:\Windows\System\TYQieSp.exe
  2⤵
  PID:2584
- C:\Windows\System\AbXvcNv.exe
  C:\Windows\System\AbXvcNv.exe
  2⤵
  PID:2800
- C:\Windows\System\luvRXFi.exe
  C:\Windows\System\luvRXFi.exe
  2⤵
  PID:2992
- C:\Windows\System\QRwFrtv.exe
  C:\Windows\System\QRwFrtv.exe
  2⤵
  PID:1704
- C:\Windows\System\mzdVHHy.exe
  C:\Windows\System\mzdVHHy.exe
  2⤵
  PID:2804
- C:\Windows\System\JyDEraY.exe
  C:\Windows\System\JyDEraY.exe
  2⤵
  PID:1420
- C:\Windows\System\AotUvyK.exe
  C:\Windows\System\AotUvyK.exe
  2⤵
  PID:2192
- C:\Windows\System\gUXuypU.exe
  C:\Windows\System\gUXuypU.exe
  2⤵
  PID:2560
- C:\Windows\System\TxbOtbP.exe
  C:\Windows\System\TxbOtbP.exe
  2⤵
  PID:2840
- C:\Windows\System\zJztEqp.exe
  C:\Windows\System\zJztEqp.exe
  2⤵
  PID:2204
- C:\Windows\System\UgcLvsW.exe
  C:\Windows\System\UgcLvsW.exe
  2⤵
  PID:2264
- C:\Windows\System\jPYjohT.exe
  C:\Windows\System\jPYjohT.exe
  2⤵
  PID:1468
- C:\Windows\System\ZlAaShC.exe
  C:\Windows\System\ZlAaShC.exe
  2⤵
  PID:2424
- C:\Windows\System\kfXUuOa.exe
  C:\Windows\System\kfXUuOa.exe
  2⤵
  PID:3092
- C:\Windows\System\BmgBVkX.exe
  C:\Windows\System\BmgBVkX.exe
  2⤵
  PID:3108
- C:\Windows\System\sQPQgKe.exe
  C:\Windows\System\sQPQgKe.exe
  2⤵
  PID:3124
- C:\Windows\System\cQzbGVb.exe
  C:\Windows\System\cQzbGVb.exe
  2⤵
  PID:3140
- C:\Windows\System\QRsVHZU.exe
  C:\Windows\System\QRsVHZU.exe
  2⤵
  PID:3156
- C:\Windows\System\ApQwAdA.exe
  C:\Windows\System\ApQwAdA.exe
  2⤵
  PID:3176
- C:\Windows\System\Uqoqfmp.exe
  C:\Windows\System\Uqoqfmp.exe
  2⤵
  PID:3192
- C:\Windows\System\gNMGxXj.exe
  C:\Windows\System\gNMGxXj.exe
  2⤵
  PID:3208
- C:\Windows\System\dywdgZe.exe
  C:\Windows\System\dywdgZe.exe
  2⤵
  PID:3228
- C:\Windows\System\qohwzKi.exe
  C:\Windows\System\qohwzKi.exe
  2⤵
  PID:3244
- C:\Windows\System\dLwomko.exe
  C:\Windows\System\dLwomko.exe
  2⤵
  PID:3260
- C:\Windows\System\zRHsKju.exe
  C:\Windows\System\zRHsKju.exe
  2⤵
  PID:3276
- C:\Windows\System\RsRnkmR.exe
  C:\Windows\System\RsRnkmR.exe
  2⤵
  PID:3292
- C:\Windows\System\kTkgkTG.exe
  C:\Windows\System\kTkgkTG.exe
  2⤵
  PID:3312
- C:\Windows\System\vHrrkRN.exe
  C:\Windows\System\vHrrkRN.exe
  2⤵
  PID:3328
- C:\Windows\System\zXrFzTl.exe
  C:\Windows\System\zXrFzTl.exe
  2⤵
  PID:3432
- C:\Windows\System\HiKHHpn.exe
  C:\Windows\System\HiKHHpn.exe
  2⤵
  PID:3452
- C:\Windows\System\HANNUDC.exe
  C:\Windows\System\HANNUDC.exe
  2⤵
  PID:3468
- C:\Windows\System\rLaCRcc.exe
  C:\Windows\System\rLaCRcc.exe
  2⤵
  PID:3492
- C:\Windows\System\dWDoKHK.exe
  C:\Windows\System\dWDoKHK.exe
  2⤵
  PID:3508
- C:\Windows\System\QeBEUml.exe
  C:\Windows\System\QeBEUml.exe
  2⤵
  PID:3532
- C:\Windows\System\ZqUybbZ.exe
  C:\Windows\System\ZqUybbZ.exe
  2⤵
  PID:3548
- C:\Windows\System\tVxugGf.exe
  C:\Windows\System\tVxugGf.exe
  2⤵
  PID:3572
- C:\Windows\System\dovDABr.exe
  C:\Windows\System\dovDABr.exe
  2⤵
  PID:3588
- C:\Windows\System\PfkVjRM.exe
  C:\Windows\System\PfkVjRM.exe
  2⤵
  PID:3604
- C:\Windows\System\AQKOGQZ.exe
  C:\Windows\System\AQKOGQZ.exe
  2⤵
  PID:3620
- C:\Windows\System\ZAMpplx.exe
  C:\Windows\System\ZAMpplx.exe
  2⤵
  PID:3644
- C:\Windows\System\zVhviwS.exe
  C:\Windows\System\zVhviwS.exe
  2⤵
  PID:3668
- C:\Windows\System\SgKBfmy.exe
  C:\Windows\System\SgKBfmy.exe
  2⤵
  PID:3684
- C:\Windows\System\GABGUnc.exe
  C:\Windows\System\GABGUnc.exe
  2⤵
  PID:3700
- C:\Windows\System\dkQdhHE.exe
  C:\Windows\System\dkQdhHE.exe
  2⤵
  PID:3728
- C:\Windows\System\FxVZKqr.exe
  C:\Windows\System\FxVZKqr.exe
  2⤵
  PID:3748
- C:\Windows\System\miXagsY.exe
  C:\Windows\System\miXagsY.exe
  2⤵
  PID:3772
- C:\Windows\System\UKKQKHj.exe
  C:\Windows\System\UKKQKHj.exe
  2⤵
  PID:3788
- C:\Windows\System\bqhfXkL.exe
  C:\Windows\System\bqhfXkL.exe
  2⤵
  PID:3812
- C:\Windows\System\jkWrRhS.exe
  C:\Windows\System\jkWrRhS.exe
  2⤵
  PID:3828
- C:\Windows\System\vCJNueE.exe
  C:\Windows\System\vCJNueE.exe
  2⤵
  PID:3852
- C:\Windows\System\CCRLmaS.exe
  C:\Windows\System\CCRLmaS.exe
  2⤵
  PID:3868
- C:\Windows\System\wtcLDhu.exe
  C:\Windows\System\wtcLDhu.exe
  2⤵
  PID:3892
- C:\Windows\System\VMIXVyb.exe
  C:\Windows\System\VMIXVyb.exe
  2⤵
  PID:3908
- C:\Windows\System\FCwcCen.exe
  C:\Windows\System\FCwcCen.exe
  2⤵
  PID:3932
- C:\Windows\System\WrzDaus.exe
  C:\Windows\System\WrzDaus.exe
  2⤵
  PID:3952
- C:\Windows\System\YzxWkuw.exe
  C:\Windows\System\YzxWkuw.exe
  2⤵
  PID:3976
- C:\Windows\System\GYhHlWo.exe
  C:\Windows\System\GYhHlWo.exe
  2⤵
  PID:3992
- C:\Windows\System\UgltEWV.exe
  C:\Windows\System\UgltEWV.exe
  2⤵
  PID:4016
- C:\Windows\System\WLSsgww.exe
  C:\Windows\System\WLSsgww.exe
  2⤵
  PID:4032
- C:\Windows\System\AxPBpMj.exe
  C:\Windows\System\AxPBpMj.exe
  2⤵
  PID:4056
- C:\Windows\System\hvIxYGM.exe
  C:\Windows\System\hvIxYGM.exe
  2⤵
  PID:4072
- C:\Windows\System\WKERPrS.exe
  C:\Windows\System\WKERPrS.exe
  2⤵
  PID:2148
- C:\Windows\System\BSBoQRL.exe
  C:\Windows\System\BSBoQRL.exe
  2⤵
  PID:2568
- C:\Windows\System\bWnNLia.exe
  C:\Windows\System\bWnNLia.exe
  2⤵
  PID:3104
- C:\Windows\System\oVUSNrS.exe
  C:\Windows\System\oVUSNrS.exe
  2⤵
  PID:3168
- C:\Windows\System\pYAJCsx.exe
  C:\Windows\System\pYAJCsx.exe
  2⤵
  PID:3268
- C:\Windows\System\ngyZJDf.exe
  C:\Windows\System\ngyZJDf.exe
  2⤵
  PID:3308
- C:\Windows\System\JnEZDFG.exe
  C:\Windows\System\JnEZDFG.exe
  2⤵
  PID:3352
- C:\Windows\System\rALKVYm.exe
  C:\Windows\System\rALKVYm.exe
  2⤵
  PID:3368
- C:\Windows\System\IZGFCnu.exe
  C:\Windows\System\IZGFCnu.exe
  2⤵
  PID:3388
- C:\Windows\System\OHoJquW.exe
  C:\Windows\System\OHoJquW.exe
  2⤵
  PID:3404
- C:\Windows\System\wVXroHs.exe
  C:\Windows\System\wVXroHs.exe
  2⤵
  PID:3000
- C:\Windows\System\cpmmoft.exe
  C:\Windows\System\cpmmoft.exe
  2⤵
  PID:3084
- C:\Windows\System\OEuVzic.exe
  C:\Windows\System\OEuVzic.exe
  2⤵
  PID:3148
- C:\Windows\System\IXdUQiu.exe
  C:\Windows\System\IXdUQiu.exe
  2⤵
  PID:3216
- C:\Windows\System\bdoKzYh.exe
  C:\Windows\System\bdoKzYh.exe
  2⤵
  PID:3256
- C:\Windows\System\AYbknrk.exe
  C:\Windows\System\AYbknrk.exe
  2⤵
  PID:3340
- C:\Windows\System\ZtXbAlr.exe
  C:\Windows\System\ZtXbAlr.exe
  2⤵
  PID:3460
- C:\Windows\System\JEZoLhG.exe
  C:\Windows\System\JEZoLhG.exe
  2⤵
  PID:3488
- C:\Windows\System\lFZOXvK.exe
  C:\Windows\System\lFZOXvK.exe
  2⤵
  PID:3516
- C:\Windows\System\LgIlwBt.exe
  C:\Windows\System\LgIlwBt.exe
  2⤵
  PID:3544
- C:\Windows\System\OoljGLH.exe
  C:\Windows\System\OoljGLH.exe
  2⤵
  PID:3580
- C:\Windows\System\tNukuoH.exe
  C:\Windows\System\tNukuoH.exe
  2⤵
  PID:3652
- C:\Windows\System\QMXxIYg.exe
  C:\Windows\System\QMXxIYg.exe
  2⤵
  PID:3664
- C:\Windows\System\nQHMuYI.exe
  C:\Windows\System\nQHMuYI.exe
  2⤵
  PID:3632
- C:\Windows\System\RVDUJYd.exe
  C:\Windows\System\RVDUJYd.exe
  2⤵
  PID:3680
- C:\Windows\System\DzvDCEY.exe
  C:\Windows\System\DzvDCEY.exe
  2⤵
  PID:3724
- C:\Windows\System\cevdIuw.exe
  C:\Windows\System\cevdIuw.exe
  2⤵
  PID:3740
- C:\Windows\System\MQZlNdZ.exe
  C:\Windows\System\MQZlNdZ.exe
  2⤵
  PID:3760
- C:\Windows\System\bLfVzZj.exe
  C:\Windows\System\bLfVzZj.exe
  2⤵
  PID:3808
- C:\Windows\System\hRBfCCj.exe
  C:\Windows\System\hRBfCCj.exe
  2⤵
  PID:3836
- C:\Windows\System\XevOcjf.exe
  C:\Windows\System\XevOcjf.exe
  2⤵
  PID:3840
- C:\Windows\System\jfJjJQH.exe
  C:\Windows\System\jfJjJQH.exe
  2⤵
  PID:3888
- C:\Windows\System\QLRYOlB.exe
  C:\Windows\System\QLRYOlB.exe
  2⤵
  PID:3904
- C:\Windows\System\oixCzLk.exe
  C:\Windows\System\oixCzLk.exe
  2⤵
  PID:3940
- C:\Windows\System\gnoZWGU.exe
  C:\Windows\System\gnoZWGU.exe
  2⤵
  PID:3944
- C:\Windows\System\nwDqknc.exe
  C:\Windows\System\nwDqknc.exe
  2⤵
  PID:4008
- C:\Windows\System\hVADCqi.exe
  C:\Windows\System\hVADCqi.exe
  2⤵
  PID:4024
- C:\Windows\System\rnecKjq.exe
  C:\Windows\System\rnecKjq.exe
  2⤵
  PID:4028
- C:\Windows\System\glNqKJE.exe
  C:\Windows\System\glNqKJE.exe
  2⤵
  PID:4088
- C:\Windows\System\vQSnueo.exe
  C:\Windows\System\vQSnueo.exe
  2⤵
  PID:4084
- C:\Windows\System\fkpIQZe.exe
  C:\Windows\System\fkpIQZe.exe
  2⤵
  PID:2652
- C:\Windows\System\FEggVhQ.exe
  C:\Windows\System\FEggVhQ.exe
  2⤵
  PID:3200
- C:\Windows\System\hngJlhS.exe
  C:\Windows\System\hngJlhS.exe
  2⤵
  PID:3080
- C:\Windows\System\WhVTIYi.exe
  C:\Windows\System\WhVTIYi.exe
  2⤵
  PID:3324
- C:\Windows\System\HCNAUtW.exe
  C:\Windows\System\HCNAUtW.exe
  2⤵
  PID:4100
- C:\Windows\System\dzrDEFf.exe
  C:\Windows\System\dzrDEFf.exe
  2⤵
  PID:4116
- C:\Windows\System\ceniBnd.exe
  C:\Windows\System\ceniBnd.exe
  2⤵
  PID:4136
- C:\Windows\System\YIZwbJk.exe
  C:\Windows\System\YIZwbJk.exe
  2⤵
  PID:4152
- C:\Windows\System\FLcKCUc.exe
  C:\Windows\System\FLcKCUc.exe
  2⤵
  PID:4168
- C:\Windows\System\KueCXAH.exe
  C:\Windows\System\KueCXAH.exe
  2⤵
  PID:4184
- C:\Windows\System\iLgljFJ.exe
  C:\Windows\System\iLgljFJ.exe
  2⤵
  PID:4204
- C:\Windows\System\bzaPojB.exe
  C:\Windows\System\bzaPojB.exe
  2⤵
  PID:4220
- C:\Windows\System\eRwsqeV.exe
  C:\Windows\System\eRwsqeV.exe
  2⤵
  PID:4236
- C:\Windows\System\oUeFmXl.exe
  C:\Windows\System\oUeFmXl.exe
  2⤵
  PID:4252
- C:\Windows\System\qpvdynz.exe
  C:\Windows\System\qpvdynz.exe
  2⤵
  PID:4268
- C:\Windows\System\yizAlTi.exe
  C:\Windows\System\yizAlTi.exe
  2⤵
  PID:4292
- C:\Windows\System\qbyNhEC.exe
  C:\Windows\System\qbyNhEC.exe
  2⤵
  PID:4308
- C:\Windows\System\XWzqmxF.exe
  C:\Windows\System\XWzqmxF.exe
  2⤵
  PID:4324
- C:\Windows\System\QAENojY.exe
  C:\Windows\System\QAENojY.exe
  2⤵
  PID:4340
- C:\Windows\System\VeIUFQR.exe
  C:\Windows\System\VeIUFQR.exe
  2⤵
  PID:4356
- C:\Windows\System\NWTrONY.exe
  C:\Windows\System\NWTrONY.exe
  2⤵
  PID:4376
- C:\Windows\System\BcYfufD.exe
  C:\Windows\System\BcYfufD.exe
  2⤵
  PID:4392
- C:\Windows\System\cdRRicN.exe
  C:\Windows\System\cdRRicN.exe
  2⤵
  PID:4408
- C:\Windows\System\JrtnPJy.exe
  C:\Windows\System\JrtnPJy.exe
  2⤵
  PID:4424
- C:\Windows\System\WCdHBMe.exe
  C:\Windows\System\WCdHBMe.exe
  2⤵
  PID:4440
- C:\Windows\System\YTRUaku.exe
  C:\Windows\System\YTRUaku.exe
  2⤵
  PID:4460
- C:\Windows\System\ntWETYE.exe
  C:\Windows\System\ntWETYE.exe
  2⤵
  PID:4476
- C:\Windows\System\XZnRhOI.exe
  C:\Windows\System\XZnRhOI.exe
  2⤵
  PID:4492
- C:\Windows\System\LbVaJhp.exe
  C:\Windows\System\LbVaJhp.exe
  2⤵
  PID:4512
- C:\Windows\System\CmklXeM.exe
  C:\Windows\System\CmklXeM.exe
  2⤵
  PID:4528
- C:\Windows\System\pyUUtjQ.exe
  C:\Windows\System\pyUUtjQ.exe
  2⤵
  PID:4544
- C:\Windows\System\nvGKVMk.exe
  C:\Windows\System\nvGKVMk.exe
  2⤵
  PID:4560
- C:\Windows\System\cQniJCU.exe
  C:\Windows\System\cQniJCU.exe
  2⤵
  PID:4584
- C:\Windows\System\HMlIrxQ.exe
  C:\Windows\System\HMlIrxQ.exe
  2⤵
  PID:4600
- C:\Windows\System\VuvlFGm.exe
  C:\Windows\System\VuvlFGm.exe
  2⤵
  PID:4616
- C:\Windows\System\aggCTgE.exe
  C:\Windows\System\aggCTgE.exe
  2⤵
  PID:4632
- C:\Windows\System\gVVrrwB.exe
  C:\Windows\System\gVVrrwB.exe
  2⤵
  PID:4648
- C:\Windows\System\aNUvdds.exe
  C:\Windows\System\aNUvdds.exe
  2⤵
  PID:4668
- C:\Windows\System\pclYfJx.exe
  C:\Windows\System\pclYfJx.exe
  2⤵
  PID:4920
- C:\Windows\System\XPtECMB.exe
  C:\Windows\System\XPtECMB.exe
  2⤵
  PID:4940
- C:\Windows\System\zupYZpB.exe
  C:\Windows\System\zupYZpB.exe
  2⤵
  PID:4956
- C:\Windows\System\uTaxTmL.exe
  C:\Windows\System\uTaxTmL.exe
  2⤵
  PID:4976
- C:\Windows\System\vWZUWUb.exe
  C:\Windows\System\vWZUWUb.exe
  2⤵
  PID:5012
- C:\Windows\System\bcUvxmh.exe
  C:\Windows\System\bcUvxmh.exe
  2⤵
  PID:5036
- C:\Windows\System\RECLzEA.exe
  C:\Windows\System\RECLzEA.exe
  2⤵
  PID:5056
- C:\Windows\System\QBasvLX.exe
  C:\Windows\System\QBasvLX.exe
  2⤵
  PID:5076
- C:\Windows\System\QIDOKSa.exe
  C:\Windows\System\QIDOKSa.exe
  2⤵
  PID:5096
- C:\Windows\System\hhwQBRg.exe
  C:\Windows\System\hhwQBRg.exe
  2⤵
  PID:5112
- C:\Windows\System\XwpLKFM.exe
  C:\Windows\System\XwpLKFM.exe
  2⤵
  PID:3520
- C:\Windows\System\nvyoeMF.exe
  C:\Windows\System\nvyoeMF.exe
  2⤵
  PID:3800
- C:\Windows\System\IsBWBhY.exe
  C:\Windows\System\IsBWBhY.exe
  2⤵
  PID:3928
- C:\Windows\System\aWKipjM.exe
  C:\Windows\System\aWKipjM.exe
  2⤵
  PID:3288
- C:\Windows\System\xImWMGg.exe
  C:\Windows\System\xImWMGg.exe
  2⤵
  PID:3236
- C:\Windows\System\zHwanjg.exe
  C:\Windows\System\zHwanjg.exe
  2⤵
  PID:4176
- C:\Windows\System\zSQUblV.exe
  C:\Windows\System\zSQUblV.exe
  2⤵
  PID:4244
- C:\Windows\System\HkwGxJE.exe
  C:\Windows\System\HkwGxJE.exe
  2⤵
  PID:3900
- C:\Windows\System\TLTBcyb.exe
  C:\Windows\System\TLTBcyb.exe
  2⤵
  PID:3988
- C:\Windows\System\NBCeDmN.exe
  C:\Windows\System\NBCeDmN.exe
  2⤵
  PID:3344
- C:\Windows\System\fbcIGZh.exe
  C:\Windows\System\fbcIGZh.exe
  2⤵
  PID:4656
- C:\Windows\System\imZAttK.exe
  C:\Windows\System\imZAttK.exe
  2⤵
  PID:4556
- C:\Windows\System\bArBaFe.exe
  C:\Windows\System\bArBaFe.exe
  2⤵
  PID:4680
- C:\Windows\System\gWrWGdr.exe
  C:\Windows\System\gWrWGdr.exe
  2⤵
  PID:3736
- C:\Windows\System\uPFPLPL.exe
  C:\Windows\System\uPFPLPL.exe
  2⤵
  PID:4064
- C:\Windows\System\itNCNRj.exe
  C:\Windows\System\itNCNRj.exe
  2⤵
  PID:3100
- C:\Windows\System\wRtjxyZ.exe
  C:\Windows\System\wRtjxyZ.exe
  2⤵
  PID:3384
- C:\Windows\System\TCblHWF.exe
  C:\Windows\System\TCblHWF.exe
  2⤵
  PID:3116
- C:\Windows\System\PFfEoOb.exe
  C:\Windows\System\PFfEoOb.exe
  2⤵
  PID:3448
- C:\Windows\System\DDsDnCf.exe
  C:\Windows\System\DDsDnCf.exe
  2⤵
  PID:3560
- C:\Windows\System\PilZHMc.exe
  C:\Windows\System\PilZHMc.exe
  2⤵
  PID:3744
- C:\Windows\System\iJYelJH.exe
  C:\Windows\System\iJYelJH.exe
  2⤵
  PID:3916
- C:\Windows\System\rVCUyeV.exe
  C:\Windows\System\rVCUyeV.exe
  2⤵
  PID:3400
- C:\Windows\System\XZTVfbP.exe
  C:\Windows\System\XZTVfbP.exe
  2⤵
  PID:4124
- C:\Windows\System\aQwrHcM.exe
  C:\Windows\System\aQwrHcM.exe
  2⤵
  PID:4164
- C:\Windows\System\dkQGKEd.exe
  C:\Windows\System\dkQGKEd.exe
  2⤵
  PID:4232
- C:\Windows\System\nyGryAI.exe
  C:\Windows\System\nyGryAI.exe
  2⤵
  PID:4332
- C:\Windows\System\MMBrzrt.exe
  C:\Windows\System\MMBrzrt.exe
  2⤵
  PID:4372
- C:\Windows\System\cCHFgZC.exe
  C:\Windows\System\cCHFgZC.exe
  2⤵
  PID:4436
- C:\Windows\System\cVFQtVm.exe
  C:\Windows\System\cVFQtVm.exe
  2⤵
  PID:4508
- C:\Windows\System\wTnOTcm.exe
  C:\Windows\System\wTnOTcm.exe
  2⤵
  PID:4572
- C:\Windows\System\udwjafH.exe
  C:\Windows\System\udwjafH.exe
  2⤵
  PID:4644
- C:\Windows\System\cnnicni.exe
  C:\Windows\System\cnnicni.exe
  2⤵
  PID:4692
- C:\Windows\System\rvEsqfl.exe
  C:\Windows\System\rvEsqfl.exe
  2⤵
  PID:4708
- C:\Windows\System\RomwDwE.exe
  C:\Windows\System\RomwDwE.exe
  2⤵
  PID:4724
- C:\Windows\System\ufbVsLe.exe
  C:\Windows\System\ufbVsLe.exe
  2⤵
  PID:4740
- C:\Windows\System\hqOKlWa.exe
  C:\Windows\System\hqOKlWa.exe
  2⤵
  PID:4756
- C:\Windows\System\CNAGXwH.exe
  C:\Windows\System\CNAGXwH.exe
  2⤵
  PID:4772
- C:\Windows\System\oyUjNvi.exe
  C:\Windows\System\oyUjNvi.exe
  2⤵
  PID:4812
- C:\Windows\System\plecMPu.exe
  C:\Windows\System\plecMPu.exe
  2⤵
  PID:4804
- C:\Windows\System\HpYAXVX.exe
  C:\Windows\System\HpYAXVX.exe
  2⤵
  PID:4824
- C:\Windows\System\ytevVPU.exe
  C:\Windows\System\ytevVPU.exe
  2⤵
  PID:4844
- C:\Windows\System\ZYjLrMj.exe
  C:\Windows\System\ZYjLrMj.exe
  2⤵
  PID:4864
- C:\Windows\System\UbMZfSH.exe
  C:\Windows\System\UbMZfSH.exe
  2⤵
  PID:4900
- C:\Windows\System\sbulWys.exe
  C:\Windows\System\sbulWys.exe
  2⤵
  PID:4892
- C:\Windows\System\cTkWoDF.exe
  C:\Windows\System\cTkWoDF.exe
  2⤵
  PID:4904
- C:\Windows\System\hSVJkBR.exe
  C:\Windows\System\hSVJkBR.exe
  2⤵
  PID:4928
- C:\Windows\System\AyqbPsR.exe
  C:\Windows\System\AyqbPsR.exe
  2⤵
  PID:4952
- C:\Windows\System\iOOfktj.exe
  C:\Windows\System\iOOfktj.exe
  2⤵
  PID:4972
- C:\Windows\System\AeGWlfw.exe
  C:\Windows\System\AeGWlfw.exe
  2⤵
  PID:5000
- C:\Windows\System\DqBCGOb.exe
  C:\Windows\System\DqBCGOb.exe
  2⤵
  PID:5024
- C:\Windows\System\paoqJKM.exe
  C:\Windows\System\paoqJKM.exe
  2⤵
  PID:688
- C:\Windows\System\WXpHFiY.exe
  C:\Windows\System\WXpHFiY.exe
  2⤵
  PID:5092
- C:\Windows\System\KPrxZxV.exe
  C:\Windows\System\KPrxZxV.exe
  2⤵
  PID:4420
- C:\Windows\System\EgeISmd.exe
  C:\Windows\System\EgeISmd.exe
  2⤵
  PID:4264
- C:\Windows\System\FEdaigQ.exe
  C:\Windows\System\FEdaigQ.exe
  2⤵
  PID:808
- C:\Windows\System\vCbYmtI.exe
  C:\Windows\System\vCbYmtI.exe
  2⤵
  PID:5072
- C:\Windows\System\WEoodZG.exe
  C:\Windows\System\WEoodZG.exe
  2⤵
  PID:3504
- C:\Windows\System\LpdONPc.exe
  C:\Windows\System\LpdONPc.exe
  2⤵
  PID:3484
- C:\Windows\System\VGmYWtB.exe
  C:\Windows\System\VGmYWtB.exe
  2⤵
  PID:4500
- C:\Windows\System\PdgChNX.exe
  C:\Windows\System\PdgChNX.exe
  2⤵
  PID:4640
- C:\Windows\System\dsUcZgU.exe
  C:\Windows\System\dsUcZgU.exe
  2⤵
  PID:4764
- C:\Windows\System\IcbdVCS.exe
  C:\Windows\System\IcbdVCS.exe
  2⤵
  PID:4836
- C:\Windows\System\kTUyhhL.exe
  C:\Windows\System\kTUyhhL.exe
  2⤵
  PID:4880
- C:\Windows\System\qZdWfPs.exe
  C:\Windows\System\qZdWfPs.exe
  2⤵
  PID:4936
- C:\Windows\System\PMtjfow.exe
  C:\Windows\System\PMtjfow.exe
  2⤵
  PID:4800
- C:\Windows\System\ySSAuJR.exe
  C:\Windows\System\ySSAuJR.exe
  2⤵
  PID:4404
- C:\Windows\System\yjCjIrQ.exe
  C:\Windows\System\yjCjIrQ.exe
  2⤵
  PID:4568
- C:\Windows\System\TbVYGrL.exe
  C:\Windows\System\TbVYGrL.exe
  2⤵
  PID:5088
- C:\Windows\System\bzFtgAW.exe
  C:\Windows\System\bzFtgAW.exe
  2⤵
  PID:4884
- C:\Windows\System\KEBTyFE.exe
  C:\Windows\System\KEBTyFE.exe
  2⤵
  PID:4932
- C:\Windows\System\aqkQfIU.exe
  C:\Windows\System\aqkQfIU.exe
  2⤵
  PID:3716
- C:\Windows\System\rRgeuMS.exe
  C:\Windows\System\rRgeuMS.exe
  2⤵
  PID:3984
- C:\Windows\System\VyXXNow.exe
  C:\Windows\System\VyXXNow.exe
  2⤵
  PID:5048
- C:\Windows\System\AFvwONq.exe
  C:\Windows\System\AFvwONq.exe
  2⤵
  PID:4520
- C:\Windows\System\wCGaZrx.exe
  C:\Windows\System\wCGaZrx.exe
  2⤵
  PID:3360
- C:\Windows\System\odbhcgk.exe
  C:\Windows\System\odbhcgk.exe
  2⤵
  PID:3968
- C:\Windows\System\GgqQVkt.exe
  C:\Windows\System\GgqQVkt.exe
  2⤵
  PID:4488
- C:\Windows\System\fVDDRsp.exe
  C:\Windows\System\fVDDRsp.exe
  2⤵
  PID:1264
- C:\Windows\System\ALBChMF.exe
  C:\Windows\System\ALBChMF.exe
  2⤵
  PID:4388
- C:\Windows\System\GUIeSIQ.exe
  C:\Windows\System\GUIeSIQ.exe
  2⤵
  PID:3696
- C:\Windows\System\LgyfCZZ.exe
  C:\Windows\System\LgyfCZZ.exe
  2⤵
  PID:3252
- C:\Windows\System\CfkzzZy.exe
  C:\Windows\System\CfkzzZy.exe
  2⤵
  PID:4472
- C:\Windows\System\NppzcJx.exe
  C:\Windows\System\NppzcJx.exe
  2⤵
  PID:4608
- C:\Windows\System\uGZIkxt.exe
  C:\Windows\System\uGZIkxt.exe
  2⤵
  PID:4368
- C:\Windows\System\VasURyT.exe
  C:\Windows\System\VasURyT.exe
  2⤵
  PID:4132
- C:\Windows\System\ZGdlxRM.exe
  C:\Windows\System\ZGdlxRM.exe
  2⤵
  PID:4872
- C:\Windows\System\lWkkoFy.exe
  C:\Windows\System\lWkkoFy.exe
  2⤵
  PID:4816
- C:\Windows\System\xIuDzpt.exe
  C:\Windows\System\xIuDzpt.exe
  2⤵
  PID:4968
- C:\Windows\System\SnqADcG.exe
  C:\Windows\System\SnqADcG.exe
  2⤵
  PID:4856
- C:\Windows\System\OqmNVDf.exe
  C:\Windows\System\OqmNVDf.exe
  2⤵
  PID:4716
- C:\Windows\System\jQDfJkh.exe
  C:\Windows\System\jQDfJkh.exe
  2⤵
  PID:4304
- C:\Windows\System\uoHRbId.exe
  C:\Windows\System\uoHRbId.exe
  2⤵
  PID:3528
- C:\Windows\System\ehTWRUb.exe
  C:\Windows\System\ehTWRUb.exe
  2⤵
  PID:5044
- C:\Windows\System\RqrkJUz.exe
  C:\Windows\System\RqrkJUz.exe
  2⤵
  PID:3600
- C:\Windows\System\uCREhrL.exe
  C:\Windows\System\uCREhrL.exe
  2⤵
  PID:4456
- C:\Windows\System\MjSvPcj.exe
  C:\Windows\System\MjSvPcj.exe
  2⤵
  PID:4288
- C:\Windows\System\KdFwNYL.exe
  C:\Windows\System\KdFwNYL.exe
  2⤵
  PID:3224
- C:\Windows\System\QrWkyni.exe
  C:\Windows\System\QrWkyni.exe
  2⤵
  PID:864
- C:\Windows\System\lkIOHbs.exe
  C:\Windows\System\lkIOHbs.exe
  2⤵
  PID:1520
- C:\Windows\System\grhQKuu.exe
  C:\Windows\System\grhQKuu.exe
  2⤵
  PID:4792
- C:\Windows\System\ltTiwCb.exe
  C:\Windows\System\ltTiwCb.exe
  2⤵
  PID:4984
- C:\Windows\System\nYkjWhB.exe
  C:\Windows\System\nYkjWhB.exe
  2⤵
  PID:4752
- C:\Windows\System\IYkiuwV.exe
  C:\Windows\System\IYkiuwV.exe
  2⤵
  PID:4000
- C:\Windows\System\eIWxIIE.exe
  C:\Windows\System\eIWxIIE.exe
  2⤵
  PID:3628
- C:\Windows\System\AYjTell.exe
  C:\Windows\System\AYjTell.exe
  2⤵
  PID:5068
- C:\Windows\System\gaXKLoP.exe
  C:\Windows\System\gaXKLoP.exe
  2⤵
  PID:3188
- C:\Windows\System\WCFdiLe.exe
  C:\Windows\System\WCFdiLe.exe
  2⤵
  PID:4320
- C:\Windows\System\pgUatet.exe
  C:\Windows\System\pgUatet.exe
  2⤵
  PID:4688
- C:\Windows\System\SLOuFsb.exe
  C:\Windows\System\SLOuFsb.exe
  2⤵
  PID:4048
- C:\Windows\System\ckibZuk.exe
  C:\Windows\System\ckibZuk.exe
  2⤵
  PID:3348
- C:\Windows\System\vvKTHCY.exe
  C:\Windows\System\vvKTHCY.exe
  2⤵
  PID:5008
- C:\Windows\System\dTAsyiX.exe
  C:\Windows\System\dTAsyiX.exe
  2⤵
  PID:3564
- C:\Windows\System\kFUBVww.exe
  C:\Windows\System\kFUBVww.exe
  2⤵
  PID:4524
- C:\Windows\System\fxGUzXG.exe
  C:\Windows\System\fxGUzXG.exe
  2⤵
  PID:4540
- C:\Windows\System\yInWqOU.exe
  C:\Windows\System\yInWqOU.exe
  2⤵
  PID:4148
- C:\Windows\System\MOhFQAu.exe
  C:\Windows\System\MOhFQAu.exe
  2⤵
  PID:5124
- C:\Windows\System\rXLrsvU.exe
  C:\Windows\System\rXLrsvU.exe
  2⤵
  PID:5168
- C:\Windows\System\qVMFpmK.exe
  C:\Windows\System\qVMFpmK.exe
  2⤵
  PID:5184
- C:\Windows\System\vLROAal.exe
  C:\Windows\System\vLROAal.exe
  2⤵
  PID:5200
- C:\Windows\System\AdCYbjo.exe
  C:\Windows\System\AdCYbjo.exe
  2⤵
  PID:5216
- C:\Windows\System\uVOxYcx.exe
  C:\Windows\System\uVOxYcx.exe
  2⤵
  PID:5232
- C:\Windows\System\VMSFgru.exe
  C:\Windows\System\VMSFgru.exe
  2⤵
  PID:5252
- C:\Windows\System\hoXjWsJ.exe
  C:\Windows\System\hoXjWsJ.exe
  2⤵
  PID:5268
- C:\Windows\System\ZPaeFNq.exe
  C:\Windows\System\ZPaeFNq.exe
  2⤵
  PID:5284
- C:\Windows\System\vpGlapd.exe
  C:\Windows\System\vpGlapd.exe
  2⤵
  PID:5300
- C:\Windows\System\vWnCzyh.exe
  C:\Windows\System\vWnCzyh.exe
  2⤵
  PID:5316
- C:\Windows\System\BmWqPUM.exe
  C:\Windows\System\BmWqPUM.exe
  2⤵
  PID:5332
- C:\Windows\System\bijxjGZ.exe
  C:\Windows\System\bijxjGZ.exe
  2⤵
  PID:5348
- C:\Windows\System\aeFMvPC.exe
  C:\Windows\System\aeFMvPC.exe
  2⤵
  PID:5364
- C:\Windows\System\GjlNHSn.exe
  C:\Windows\System\GjlNHSn.exe
  2⤵
  PID:5384
- C:\Windows\System\nvAVGvY.exe
  C:\Windows\System\nvAVGvY.exe
  2⤵
  PID:5400
- C:\Windows\System\AWUZOHZ.exe
  C:\Windows\System\AWUZOHZ.exe
  2⤵
  PID:5416
- C:\Windows\System\lWGQxfd.exe
  C:\Windows\System\lWGQxfd.exe
  2⤵
  PID:5432
- C:\Windows\System\JuTUDVz.exe
  C:\Windows\System\JuTUDVz.exe
  2⤵
  PID:5448
- C:\Windows\System\BWEsuDu.exe
  C:\Windows\System\BWEsuDu.exe
  2⤵
  PID:5464
- C:\Windows\System\hgzwfgK.exe
  C:\Windows\System\hgzwfgK.exe
  2⤵
  PID:5488
- C:\Windows\System\kfwrpWa.exe
  C:\Windows\System\kfwrpWa.exe
  2⤵
  PID:5504
- C:\Windows\System\CyAPNyU.exe
  C:\Windows\System\CyAPNyU.exe
  2⤵
  PID:5520
- C:\Windows\System\XGRICPB.exe
  C:\Windows\System\XGRICPB.exe
  2⤵
  PID:5536
- C:\Windows\System\IiffTpZ.exe
  C:\Windows\System\IiffTpZ.exe
  2⤵
  PID:5552
- C:\Windows\System\JOEHgIE.exe
  C:\Windows\System\JOEHgIE.exe
  2⤵
  PID:5568
- C:\Windows\System\ERQhBBG.exe
  C:\Windows\System\ERQhBBG.exe
  2⤵
  PID:5584
- C:\Windows\System\iauVruy.exe
  C:\Windows\System\iauVruy.exe
  2⤵
  PID:5600
- C:\Windows\System\PjKxqfE.exe
  C:\Windows\System\PjKxqfE.exe
  2⤵
  PID:5616
- C:\Windows\System\YLOUSQw.exe
  C:\Windows\System\YLOUSQw.exe
  2⤵
  PID:5632
- C:\Windows\System\znsLaco.exe
  C:\Windows\System\znsLaco.exe
  2⤵
  PID:5648
- C:\Windows\System\VaRTeJM.exe
  C:\Windows\System\VaRTeJM.exe
  2⤵
  PID:5664
- C:\Windows\System\ywexaGo.exe
  C:\Windows\System\ywexaGo.exe
  2⤵
  PID:5680
- C:\Windows\System\duSakgA.exe
  C:\Windows\System\duSakgA.exe
  2⤵
  PID:5700
- C:\Windows\System\TINUeCF.exe
  C:\Windows\System\TINUeCF.exe
  2⤵
  PID:5716
- C:\Windows\System\nxLZmJz.exe
  C:\Windows\System\nxLZmJz.exe
  2⤵
  PID:5736
- C:\Windows\System\FqnjEoL.exe
  C:\Windows\System\FqnjEoL.exe
  2⤵
  PID:5752
- C:\Windows\System\ciFAxya.exe
  C:\Windows\System\ciFAxya.exe
  2⤵
  PID:5768
- C:\Windows\System\HklIPfP.exe
  C:\Windows\System\HklIPfP.exe
  2⤵
  PID:5788
- C:\Windows\System\rPDXgtt.exe
  C:\Windows\System\rPDXgtt.exe
  2⤵
  PID:5804
- C:\Windows\System\rTIicBq.exe
  C:\Windows\System\rTIicBq.exe
  2⤵
  PID:5820
- C:\Windows\System\dEQBfwI.exe
  C:\Windows\System\dEQBfwI.exe
  2⤵
  PID:5836
- C:\Windows\System\CXMwFLI.exe
  C:\Windows\System\CXMwFLI.exe
  2⤵
  PID:5852
- C:\Windows\System\mvvfumx.exe
  C:\Windows\System\mvvfumx.exe
  2⤵
  PID:5868
- C:\Windows\System\KBYoxJo.exe
  C:\Windows\System\KBYoxJo.exe
  2⤵
  PID:5884
- C:\Windows\System\iAYSpdN.exe
  C:\Windows\System\iAYSpdN.exe
  2⤵
  PID:5904
- C:\Windows\System\IBgQJrE.exe
  C:\Windows\System\IBgQJrE.exe
  2⤵
  PID:5920
- C:\Windows\System\dzInhsj.exe
  C:\Windows\System\dzInhsj.exe
  2⤵
  PID:5940
- C:\Windows\System\XQxXNKl.exe
  C:\Windows\System\XQxXNKl.exe
  2⤵
  PID:5956
- C:\Windows\System\ygtJIyw.exe
  C:\Windows\System\ygtJIyw.exe
  2⤵
  PID:5972
- C:\Windows\System\inIegmr.exe
  C:\Windows\System\inIegmr.exe
  2⤵
  PID:5988
- C:\Windows\System\nEDTiQb.exe
  C:\Windows\System\nEDTiQb.exe
  2⤵
  PID:6004
- C:\Windows\System\zxjmmYW.exe
  C:\Windows\System\zxjmmYW.exe
  2⤵
  PID:6020
- C:\Windows\System\RYpaRiM.exe
  C:\Windows\System\RYpaRiM.exe
  2⤵
  PID:6036
- C:\Windows\System\dfyWyWr.exe
  C:\Windows\System\dfyWyWr.exe
  2⤵
  PID:6052
- C:\Windows\System\WfzScBG.exe
  C:\Windows\System\WfzScBG.exe
  2⤵
  PID:6068
- C:\Windows\System\tDDVlhK.exe
  C:\Windows\System\tDDVlhK.exe
  2⤵
  PID:6084
- C:\Windows\System\fGcbevy.exe
  C:\Windows\System\fGcbevy.exe
  2⤵
  PID:6100
- C:\Windows\System\HOdQMlq.exe
  C:\Windows\System\HOdQMlq.exe
  2⤵
  PID:6116
- C:\Windows\System\HZjJEjX.exe
  C:\Windows\System\HZjJEjX.exe
  2⤵
  PID:6132
- C:\Windows\System\KQdFogj.exe
  C:\Windows\System\KQdFogj.exe
  2⤵
  PID:4212
- C:\Windows\System\VRunywV.exe
  C:\Windows\System\VRunywV.exe
  2⤵
  PID:4596
- C:\Windows\System\lDNZUFl.exe
  C:\Windows\System\lDNZUFl.exe
  2⤵
  PID:4660
- C:\Windows\System\NMczcKt.exe
  C:\Windows\System\NMczcKt.exe
  2⤵
  PID:5156
- C:\Windows\System\tmqVloX.exe
  C:\Windows\System\tmqVloX.exe
  2⤵
  PID:4732
- C:\Windows\System\yTzxAZb.exe
  C:\Windows\System\yTzxAZb.exe
  2⤵
  PID:4780
- C:\Windows\System\UvqRTdj.exe
  C:\Windows\System\UvqRTdj.exe
  2⤵
  PID:5196
- C:\Windows\System\lyaBLhe.exe
  C:\Windows\System\lyaBLhe.exe
  2⤵
  PID:5296
- C:\Windows\System\nblZHnk.exe
  C:\Windows\System\nblZHnk.exe
  2⤵
  PID:5324
- C:\Windows\System\hbmcdqy.exe
  C:\Windows\System\hbmcdqy.exe
  2⤵
  PID:5240
- C:\Windows\System\EJrTmUw.exe
  C:\Windows\System\EJrTmUw.exe
  2⤵
  PID:5360
- C:\Windows\System\GZWpCoa.exe
  C:\Windows\System\GZWpCoa.exe
  2⤵
  PID:5248
- C:\Windows\System\aXVduwW.exe
  C:\Windows\System\aXVduwW.exe
  2⤵
  PID:5340
- C:\Windows\System\LSqaqYL.exe
  C:\Windows\System\LSqaqYL.exe
  2⤵
  PID:5344
- C:\Windows\System\SdlWycj.exe
  C:\Windows\System\SdlWycj.exe
  2⤵
  PID:5456
- C:\Windows\System\vqUUqzk.exe
  C:\Windows\System\vqUUqzk.exe
  2⤵
  PID:5500
- C:\Windows\System\VeFsPKP.exe
  C:\Windows\System\VeFsPKP.exe
  2⤵
  PID:5564
- C:\Windows\System\lBpvLtn.exe
  C:\Windows\System\lBpvLtn.exe
  2⤵
  PID:5628
- C:\Windows\System\zDLLHlt.exe
  C:\Windows\System\zDLLHlt.exe
  2⤵
  PID:5692
- C:\Windows\System\XmOWgRl.exe
  C:\Windows\System\XmOWgRl.exe
  2⤵
  PID:5472
- C:\Windows\System\VOBzzCF.exe
  C:\Windows\System\VOBzzCF.exe
  2⤵
  PID:5484
- C:\Windows\System\ElVUVDE.exe
  C:\Windows\System\ElVUVDE.exe
  2⤵
  PID:5548
- C:\Windows\System\AKCoCoc.exe
  C:\Windows\System\AKCoCoc.exe
  2⤵
  PID:5612
- C:\Windows\System\sSVBztH.exe
  C:\Windows\System\sSVBztH.exe
  2⤵
  PID:5676
- C:\Windows\System\oVlhwwC.exe
  C:\Windows\System\oVlhwwC.exe
  2⤵
  PID:5760
- C:\Windows\System\TiSJmbH.exe
  C:\Windows\System\TiSJmbH.exe
  2⤵
  PID:5800
- C:\Windows\System\hDEKgkf.exe
  C:\Windows\System\hDEKgkf.exe
  2⤵
  PID:5864
- C:\Windows\System\HFPSxTl.exe
  C:\Windows\System\HFPSxTl.exe
  2⤵
  PID:5892
- C:\Windows\System\IRsXcuo.exe
  C:\Windows\System\IRsXcuo.exe
  2⤵
  PID:5936
- C:\Windows\System\vypWrBL.exe
  C:\Windows\System\vypWrBL.exe
  2⤵
  PID:5844
- C:\Windows\System\VOPZqwZ.exe
  C:\Windows\System\VOPZqwZ.exe
  2⤵
  PID:5848
- C:\Windows\System\TnfuDjK.exe
  C:\Windows\System\TnfuDjK.exe
  2⤵
  PID:5916
- C:\Windows\System\kxywCLM.exe
  C:\Windows\System\kxywCLM.exe
  2⤵
  PID:5996
- C:\Windows\System\okPihVF.exe
  C:\Windows\System\okPihVF.exe
  2⤵
  PID:6060
- C:\Windows\System\WDPrApA.exe
  C:\Windows\System\WDPrApA.exe
  2⤵
  PID:6124
- C:\Windows\System\uSIAjaL.exe
  C:\Windows\System\uSIAjaL.exe
  2⤵
  PID:6112
- C:\Windows\System\herMSmW.exe
  C:\Windows\System\herMSmW.exe
  2⤵
  PID:6076
- C:\Windows\System\nxiVrHJ.exe
  C:\Windows\System\nxiVrHJ.exe
  2⤵
  PID:3720
- C:\Windows\System\MLuFsLh.exe
  C:\Windows\System\MLuFsLh.exe
  2⤵
  PID:4228
- C:\Windows\System\hJyJzxS.exe
  C:\Windows\System\hJyJzxS.exe
  2⤵
  PID:5212
- C:\Windows\System\vcXgUoC.exe
  C:\Windows\System\vcXgUoC.exe
  2⤵
  PID:5424
- C:\Windows\System\pHMOcTg.exe
  C:\Windows\System\pHMOcTg.exe
  2⤵
  PID:5192
- C:\Windows\System\RdTWxVc.exe
  C:\Windows\System\RdTWxVc.exe
  2⤵
  PID:5496
- C:\Windows\System\FqiPCoT.exe
  C:\Windows\System\FqiPCoT.exe
  2⤵
  PID:5132
- C:\Windows\System\czhGaFC.exe
  C:\Windows\System\czhGaFC.exe
  2⤵
  PID:5308
- C:\Windows\System\BPHTKuC.exe
  C:\Windows\System\BPHTKuC.exe
  2⤵
  PID:5428
- C:\Windows\System\jEeHXJO.exe
  C:\Windows\System\jEeHXJO.exe
  2⤵
  PID:5444
- C:\Windows\System\puRRwTP.exe
  C:\Windows\System\puRRwTP.exe
  2⤵
  PID:5688
- C:\Windows\System\FfNFyYy.exe
  C:\Windows\System\FfNFyYy.exe
  2⤵
  PID:5728
- C:\Windows\System\ULWXaYw.exe
  C:\Windows\System\ULWXaYw.exe
  2⤵
  PID:5732
- C:\Windows\System\KjVLfQK.exe
  C:\Windows\System\KjVLfQK.exe
  2⤵
  PID:5748
- C:\Windows\System\POSBbjK.exe
  C:\Windows\System\POSBbjK.exe
  2⤵
  PID:5876
- C:\Windows\System\GnahlEH.exe
  C:\Windows\System\GnahlEH.exe
  2⤵
  PID:5932
- C:\Windows\System\Mupgsah.exe
  C:\Windows\System\Mupgsah.exe
  2⤵
  PID:5952
- C:\Windows\System\UvlmjOT.exe
  C:\Windows\System\UvlmjOT.exe
  2⤵
  PID:6128
- C:\Windows\System\NNuaAUf.exe
  C:\Windows\System\NNuaAUf.exe
  2⤵
  PID:5356
- C:\Windows\System\VWmoqFV.exe
  C:\Windows\System\VWmoqFV.exe
  2⤵
  PID:6012
- C:\Windows\System\magLNXC.exe
  C:\Windows\System\magLNXC.exe
  2⤵
  PID:5440
- C:\Windows\System\vHHRdNs.exe
  C:\Windows\System\vHHRdNs.exe
  2⤵
  PID:6152
- C:\Windows\System\DPdiWdf.exe
  C:\Windows\System\DPdiWdf.exe
  2⤵
  PID:6168
- C:\Windows\System\pOPiqDA.exe
  C:\Windows\System\pOPiqDA.exe
  2⤵
  PID:6184
- C:\Windows\System\ZQcYKeJ.exe
  C:\Windows\System\ZQcYKeJ.exe
  2⤵
  PID:6200
- C:\Windows\System\qqHAkou.exe
  C:\Windows\System\qqHAkou.exe
  2⤵
  PID:6216
- C:\Windows\System\mIJRCQv.exe
  C:\Windows\System\mIJRCQv.exe
  2⤵
  PID:6232
- C:\Windows\System\dfQqmqI.exe
  C:\Windows\System\dfQqmqI.exe
  2⤵
  PID:6248
- C:\Windows\System\UCpbVci.exe
  C:\Windows\System\UCpbVci.exe
  2⤵
  PID:6264
- C:\Windows\System\xsPLAsR.exe
  C:\Windows\System\xsPLAsR.exe
  2⤵
  PID:6280
- C:\Windows\System\BMkvpUW.exe
  C:\Windows\System\BMkvpUW.exe
  2⤵
  PID:6296
- C:\Windows\System\yEkTYzu.exe
  C:\Windows\System\yEkTYzu.exe
  2⤵
  PID:6312
- C:\Windows\System\ryNYfhD.exe
  C:\Windows\System\ryNYfhD.exe
  2⤵
  PID:6328
- C:\Windows\System\pbBYSnm.exe
  C:\Windows\System\pbBYSnm.exe
  2⤵
  PID:6344
- C:\Windows\System\zKbhkOk.exe
  C:\Windows\System\zKbhkOk.exe
  2⤵
  PID:6360
- C:\Windows\System\ktuVGzF.exe
  C:\Windows\System\ktuVGzF.exe
  2⤵
  PID:6376
- C:\Windows\System\wbBpPfl.exe
  C:\Windows\System\wbBpPfl.exe
  2⤵
  PID:6392
- C:\Windows\System\VWiCYqH.exe
  C:\Windows\System\VWiCYqH.exe
  2⤵
  PID:6408
- C:\Windows\System\RGwLKCk.exe
  C:\Windows\System\RGwLKCk.exe
  2⤵
  PID:6424
- C:\Windows\System\fnsyaaW.exe
  C:\Windows\System\fnsyaaW.exe
  2⤵
  PID:6444
- C:\Windows\System\cGoiGAu.exe
  C:\Windows\System\cGoiGAu.exe
  2⤵
  PID:6460
- C:\Windows\System\Ncrcain.exe
  C:\Windows\System\Ncrcain.exe
  2⤵
  PID:6476
- C:\Windows\System\AfrNnAO.exe
  C:\Windows\System\AfrNnAO.exe
  2⤵
  PID:6496
- C:\Windows\System\BitfazF.exe
  C:\Windows\System\BitfazF.exe
  2⤵
  PID:6512
- C:\Windows\System\Uuulyiu.exe
  C:\Windows\System\Uuulyiu.exe
  2⤵
  PID:6528
- C:\Windows\System\GuLRPkE.exe
  C:\Windows\System\GuLRPkE.exe
  2⤵
  PID:6548
- C:\Windows\System\rERgOoa.exe
  C:\Windows\System\rERgOoa.exe
  2⤵
  PID:6564
- C:\Windows\System\WEpgTgA.exe
  C:\Windows\System\WEpgTgA.exe
  2⤵
  PID:6580
- C:\Windows\System\VuXLFXc.exe
  C:\Windows\System\VuXLFXc.exe
  2⤵
  PID:6596
- C:\Windows\System\WWtFvio.exe
  C:\Windows\System\WWtFvio.exe
  2⤵
  PID:6612
- C:\Windows\System\msGFiWj.exe
  C:\Windows\System\msGFiWj.exe
  2⤵
  PID:6628
- C:\Windows\System\pNqbxyv.exe
  C:\Windows\System\pNqbxyv.exe
  2⤵
  PID:6652
- C:\Windows\System\SOFQxGK.exe
  C:\Windows\System\SOFQxGK.exe
  2⤵
  PID:6668
- C:\Windows\System\nmrinwW.exe
  C:\Windows\System\nmrinwW.exe
  2⤵
  PID:6684
- C:\Windows\System\RPMMtZW.exe
  C:\Windows\System\RPMMtZW.exe
  2⤵
  PID:6700
- C:\Windows\System\sBeOnCq.exe
  C:\Windows\System\sBeOnCq.exe
  2⤵
  PID:6716
- C:\Windows\System\eCUoJTS.exe
  C:\Windows\System\eCUoJTS.exe
  2⤵
  PID:6732
- C:\Windows\System\WMCDlrT.exe
  C:\Windows\System\WMCDlrT.exe
  2⤵
  PID:6752
- C:\Windows\System\AkNlprc.exe
  C:\Windows\System\AkNlprc.exe
  2⤵
  PID:6768
- C:\Windows\System\MapYpNe.exe
  C:\Windows\System\MapYpNe.exe
  2⤵
  PID:6784
- C:\Windows\System\bGwTcGx.exe
  C:\Windows\System\bGwTcGx.exe
  2⤵
  PID:6804
- C:\Windows\System\yqgnKHQ.exe
  C:\Windows\System\yqgnKHQ.exe
  2⤵
  PID:6820
- C:\Windows\System\xptAkEG.exe
  C:\Windows\System\xptAkEG.exe
  2⤵
  PID:6836
- C:\Windows\System\beRhINj.exe
  C:\Windows\System\beRhINj.exe
  2⤵
  PID:6852
- C:\Windows\System\iYGvyLT.exe
  C:\Windows\System\iYGvyLT.exe
  2⤵
  PID:6868
- C:\Windows\System\iTUMcif.exe
  C:\Windows\System\iTUMcif.exe
  2⤵
  PID:6900
- C:\Windows\System\iahSJww.exe
  C:\Windows\System\iahSJww.exe
  2⤵
  PID:6916
- C:\Windows\System\yFJYHwt.exe
  C:\Windows\System\yFJYHwt.exe
  2⤵
  PID:6932
- C:\Windows\System\iSAqewx.exe
  C:\Windows\System\iSAqewx.exe
  2⤵
  PID:6948
- C:\Windows\System\gJvlzcF.exe
  C:\Windows\System\gJvlzcF.exe
  2⤵
  PID:6964
- C:\Windows\System\BczYThR.exe
  C:\Windows\System\BczYThR.exe
  2⤵
  PID:6980
- C:\Windows\System\BAvUKdd.exe
  C:\Windows\System\BAvUKdd.exe
  2⤵
  PID:6996
- C:\Windows\System\EYNucQd.exe
  C:\Windows\System\EYNucQd.exe
  2⤵
  PID:7012
- C:\Windows\System\nigIDzw.exe
  C:\Windows\System\nigIDzw.exe
  2⤵
  PID:7028
- C:\Windows\System\UmAUUEy.exe
  C:\Windows\System\UmAUUEy.exe
  2⤵
  PID:7044
- C:\Windows\System\SjsrLzU.exe
  C:\Windows\System\SjsrLzU.exe
  2⤵
  PID:7060
- C:\Windows\System\XsKZyfT.exe
  C:\Windows\System\XsKZyfT.exe
  2⤵
  PID:7076
- C:\Windows\System\CTFzpiS.exe
  C:\Windows\System\CTFzpiS.exe
  2⤵
  PID:7092
- C:\Windows\System\fgjXJma.exe
  C:\Windows\System\fgjXJma.exe
  2⤵
  PID:7108
- C:\Windows\System\hATlfyr.exe
  C:\Windows\System\hATlfyr.exe
  2⤵
  PID:7124
- C:\Windows\System\EfwkYjY.exe
  C:\Windows\System\EfwkYjY.exe
  2⤵
  PID:7140
- C:\Windows\System\qMzJpKS.exe
  C:\Windows\System\qMzJpKS.exe
  2⤵
  PID:7156
- C:\Windows\System\rvOjHWC.exe
  C:\Windows\System\rvOjHWC.exe
  2⤵
  PID:5312
- C:\Windows\System\tGYinvk.exe
  C:\Windows\System\tGYinvk.exe
  2⤵
  PID:5580
- C:\Windows\System\vELeGWH.exe
  C:\Windows\System\vELeGWH.exe
  2⤵
  PID:5816
- C:\Windows\System\nqDhPBF.exe
  C:\Windows\System\nqDhPBF.exe
  2⤵
  PID:5164
- C:\Windows\System\mrhevJg.exe
  C:\Windows\System\mrhevJg.exe
  2⤵
  PID:5608
- C:\Windows\System\BKHqKNe.exe
  C:\Windows\System\BKHqKNe.exe
  2⤵
  PID:6256
- C:\Windows\System\BhGYmbl.exe
  C:\Windows\System\BhGYmbl.exe
  2⤵
  PID:5480
- C:\Windows\System\ICbZmPR.exe
  C:\Windows\System\ICbZmPR.exe
  2⤵
  PID:5928
- C:\Windows\System\tofveUn.exe
  C:\Windows\System\tofveUn.exe
  2⤵
  PID:5372
- C:\Windows\System\RxicLii.exe
  C:\Windows\System\RxicLii.exe
  2⤵
  PID:5860
- C:\Windows\System\gYExmOd.exe
  C:\Windows\System\gYExmOd.exe
  2⤵
  PID:5412
- C:\Windows\System\qkXFrpd.exe
  C:\Windows\System\qkXFrpd.exe
  2⤵
  PID:6212
- C:\Windows\System\TeLERPw.exe
  C:\Windows\System\TeLERPw.exe
  2⤵
  PID:6324
- C:\Windows\System\Gqurdus.exe
  C:\Windows\System\Gqurdus.exe
  2⤵
  PID:6272
- C:\Windows\System\tkJGtxz.exe
  C:\Windows\System\tkJGtxz.exe
  2⤵
  PID:6340
- C:\Windows\System\OHlczQs.exe
  C:\Windows\System\OHlczQs.exe
  2⤵
  PID:6416
- C:\Windows\System\kQlczmG.exe
  C:\Windows\System\kQlczmG.exe
  2⤵
  PID:6368
- C:\Windows\System\uaxqege.exe
  C:\Windows\System\uaxqege.exe
  2⤵
  PID:6492
- C:\Windows\System\LEaZvjY.exe
  C:\Windows\System\LEaZvjY.exe
  2⤵
  PID:6372
- C:\Windows\System\rufMdeD.exe
  C:\Windows\System\rufMdeD.exe
  2⤵
  PID:6432
- C:\Windows\System\ldVRhRi.exe
  C:\Windows\System\ldVRhRi.exe
  2⤵
  PID:6620
- C:\Windows\System\rxhhizw.exe
  C:\Windows\System\rxhhizw.exe
  2⤵
  PID:6692
- C:\Windows\System\TVpvKxN.exe
  C:\Windows\System\TVpvKxN.exe
  2⤵
  PID:6540
- C:\Windows\System\vFtrcbu.exe
  C:\Windows\System\vFtrcbu.exe
  2⤵
  PID:6472
- C:\Windows\System\NiGLqgr.exe
  C:\Windows\System\NiGLqgr.exe
  2⤵
  PID:6676
- C:\Windows\System\PMAXpVc.exe
  C:\Windows\System\PMAXpVc.exe
  2⤵
  PID:6608
- C:\Windows\System\WbQEqeU.exe
  C:\Windows\System\WbQEqeU.exe
  2⤵
  PID:6648
- C:\Windows\System\CAbDbpT.exe
  C:\Windows\System\CAbDbpT.exe
  2⤵
  PID:6740
- C:\Windows\System\aBbtAcd.exe
  C:\Windows\System\aBbtAcd.exe
  2⤵
  PID:6764
- C:\Windows\System\ivHPvda.exe
  C:\Windows\System\ivHPvda.exe
  2⤵
  PID:6776
- C:\Windows\System\IDHLRVY.exe
  C:\Windows\System\IDHLRVY.exe
  2⤵
  PID:6816
- C:\Windows\System\UEdRdra.exe
  C:\Windows\System\UEdRdra.exe
  2⤵
  PID:6844
- C:\Windows\System\kbVYeSd.exe
  C:\Windows\System\kbVYeSd.exe
  2⤵
  PID:5896
- C:\Windows\System\YUpdxMk.exe
  C:\Windows\System\YUpdxMk.exe
  2⤵
  PID:6908
- C:\Windows\System\RTpOdhw.exe
  C:\Windows\System\RTpOdhw.exe
  2⤵
  PID:6972
- C:\Windows\System\FtIatgy.exe
  C:\Windows\System\FtIatgy.exe
  2⤵
  PID:7036
- C:\Windows\System\ZQHHgcA.exe
  C:\Windows\System\ZQHHgcA.exe
  2⤵
  PID:7100
- C:\Windows\System\EOQmfhL.exe
  C:\Windows\System\EOQmfhL.exe
  2⤵
  PID:7164
- C:\Windows\System\SFinizn.exe
  C:\Windows\System\SFinizn.exe
  2⤵
  PID:6956
- C:\Windows\System\uEaQyIn.exe
  C:\Windows\System\uEaQyIn.exe
  2⤵
  PID:6960
- C:\Windows\System\BrnWEix.exe
  C:\Windows\System\BrnWEix.exe
  2⤵
  PID:7024
- C:\Windows\System\NyWjUfA.exe
  C:\Windows\System\NyWjUfA.exe
  2⤵
  PID:7088
- C:\Windows\System\mRiqeSL.exe
  C:\Windows\System\mRiqeSL.exe
  2⤵
  PID:7152
- C:\Windows\System\EEEHoit.exe
  C:\Windows\System\EEEHoit.exe
  2⤵
  PID:6164
- C:\Windows\System\afBpsAP.exe
  C:\Windows\System\afBpsAP.exe
  2⤵
  PID:6228
- C:\Windows\System\dzMNXTe.exe
  C:\Windows\System\dzMNXTe.exe
  2⤵
  PID:6208
- C:\Windows\System\TlICAka.exe
  C:\Windows\System\TlICAka.exe
  2⤵
  PID:6288
- C:\Windows\System\SEKGSRI.exe
  C:\Windows\System\SEKGSRI.exe
  2⤵
  PID:6456
- C:\Windows\System\fICCgVl.exe
  C:\Windows\System\fICCgVl.exe
  2⤵
  PID:5672
- C:\Windows\System\kGiRyGk.exe
  C:\Windows\System\kGiRyGk.exe
  2⤵
  PID:6436
- C:\Windows\System\epVpJPR.exe
  C:\Windows\System\epVpJPR.exe
  2⤵
  PID:6712
- C:\Windows\System\CpSAcMj.exe
  C:\Windows\System\CpSAcMj.exe
  2⤵
  PID:6864
- C:\Windows\System\OBbwMWw.exe
  C:\Windows\System\OBbwMWw.exe
  2⤵
  PID:7008
- C:\Windows\System\unRIToj.exe
  C:\Windows\System\unRIToj.exe
  2⤵
  PID:6812
- C:\Windows\System\cRqtJoJ.exe
  C:\Windows\System\cRqtJoJ.exe
  2⤵
  PID:6640
- C:\Windows\System\vqbeMTA.exe
  C:\Windows\System\vqbeMTA.exe
  2⤵
  PID:7020
- C:\Windows\System\ufAqZch.exe
  C:\Windows\System\ufAqZch.exe
  2⤵
  PID:6876
- C:\Windows\System\VnSYowr.exe
  C:\Windows\System\VnSYowr.exe
  2⤵
  PID:6992
- C:\Windows\System\pfySzdo.exe
  C:\Windows\System\pfySzdo.exe
  2⤵
  PID:6928
- C:\Windows\System\zDgbihJ.exe
  C:\Windows\System\zDgbihJ.exe
  2⤵
  PID:5968
- C:\Windows\System\sNzwOfm.exe
  C:\Windows\System\sNzwOfm.exe
  2⤵
  PID:6308
- C:\Windows\System\XJRjrHm.exe
  C:\Windows\System\XJRjrHm.exe
  2⤵
  PID:6544
- C:\Windows\System\VrKsHuy.exe
  C:\Windows\System\VrKsHuy.exe
  2⤵
  PID:6352
- C:\Windows\System\sflugYE.exe
  C:\Windows\System\sflugYE.exe
  2⤵
  PID:6032
- C:\Windows\System\tTmCMkE.exe
  C:\Windows\System\tTmCMkE.exe
  2⤵
  PID:6388
- C:\Windows\System\KNtnbuI.exe
  C:\Windows\System\KNtnbuI.exe
  2⤵
  PID:6604
- C:\Windows\System\bAnTSYK.exe
  C:\Windows\System\bAnTSYK.exe
  2⤵
  PID:7004
- C:\Windows\System\dICBJes.exe
  C:\Windows\System\dICBJes.exe
  2⤵
  PID:7120
- C:\Windows\System\rlTvAzm.exe
  C:\Windows\System\rlTvAzm.exe
  2⤵
  PID:5160
- C:\Windows\System\QcnvXxK.exe
  C:\Windows\System\QcnvXxK.exe
  2⤵
  PID:6860
- C:\Windows\System\eKPlahy.exe
  C:\Windows\System\eKPlahy.exe
  2⤵
  PID:6404
- C:\Windows\System\yYnkhUv.exe
  C:\Windows\System\yYnkhUv.exe
  2⤵
  PID:6880
- C:\Windows\System\PNdvYKh.exe
  C:\Windows\System\PNdvYKh.exe
  2⤵
  PID:5180
- C:\Windows\System\PXXlQfk.exe
  C:\Windows\System\PXXlQfk.exe
  2⤵
  PID:6708
- C:\Windows\System\PwkZUwP.exe
  C:\Windows\System\PwkZUwP.exe
  2⤵
  PID:7148
- C:\Windows\System\UoyDHOW.exe
  C:\Windows\System\UoyDHOW.exe
  2⤵
  PID:6336
- C:\Windows\System\LUsdxvX.exe
  C:\Windows\System\LUsdxvX.exe
  2⤵
  PID:6400
- C:\Windows\System\edlanfJ.exe
  C:\Windows\System\edlanfJ.exe
  2⤵
  PID:6556
- C:\Windows\System\xBlpALA.exe
  C:\Windows\System\xBlpALA.exe
  2⤵
  PID:5152
- C:\Windows\System\jhFiNdQ.exe
  C:\Windows\System\jhFiNdQ.exe
  2⤵
  PID:7072
- C:\Windows\System\suEUQWS.exe
  C:\Windows\System\suEUQWS.exe
  2⤵
  PID:6896
- C:\Windows\System\qBfPZvU.exe
  C:\Windows\System\qBfPZvU.exe
  2⤵
  PID:7172
- C:\Windows\System\pNrqZCQ.exe
  C:\Windows\System\pNrqZCQ.exe
  2⤵
  PID:7188
- C:\Windows\System\cVvjeyj.exe
  C:\Windows\System\cVvjeyj.exe
  2⤵
  PID:7204
- C:\Windows\System\nXwgAgF.exe
  C:\Windows\System\nXwgAgF.exe
  2⤵
  PID:7220
- C:\Windows\System\UgdOZrh.exe
  C:\Windows\System\UgdOZrh.exe
  2⤵
  PID:7236
- C:\Windows\System\sjFsRch.exe
  C:\Windows\System\sjFsRch.exe
  2⤵
  PID:7252
- C:\Windows\System\NgIFgvL.exe
  C:\Windows\System\NgIFgvL.exe
  2⤵
  PID:7268
- C:\Windows\System\RBSwuMD.exe
  C:\Windows\System\RBSwuMD.exe
  2⤵
  PID:7284
- C:\Windows\System\LlBKARb.exe
  C:\Windows\System\LlBKARb.exe
  2⤵
  PID:7300
- C:\Windows\System\Uimmoak.exe
  C:\Windows\System\Uimmoak.exe
  2⤵
  PID:7320
- C:\Windows\System\sVYNuTb.exe
  C:\Windows\System\sVYNuTb.exe
  2⤵
  PID:7336
- C:\Windows\System\GOEjFGX.exe
  C:\Windows\System\GOEjFGX.exe
  2⤵
  PID:7352
- C:\Windows\System\meJECyO.exe
  C:\Windows\System\meJECyO.exe
  2⤵
  PID:7368
- C:\Windows\System\sPmTElR.exe
  C:\Windows\System\sPmTElR.exe
  2⤵
  PID:7384
- C:\Windows\System\aTazlbv.exe
  C:\Windows\System\aTazlbv.exe
  2⤵
  PID:7764
- C:\Windows\System\KLLEbFS.exe
  C:\Windows\System\KLLEbFS.exe
  2⤵
  PID:7824
- C:\Windows\System\MLXShUb.exe
  C:\Windows\System\MLXShUb.exe
  2⤵
  PID:7840
- C:\Windows\System\XNVDwrQ.exe
  C:\Windows\System\XNVDwrQ.exe
  2⤵
  PID:7856
- C:\Windows\System\aXwiDmS.exe
  C:\Windows\System\aXwiDmS.exe
  2⤵
  PID:7872
- C:\Windows\System\DExFjca.exe
  C:\Windows\System\DExFjca.exe
  2⤵
  PID:7888
- C:\Windows\System\TUzZljG.exe
  C:\Windows\System\TUzZljG.exe
  2⤵
  PID:7904
- C:\Windows\System\YPyiEfc.exe
  C:\Windows\System\YPyiEfc.exe
  2⤵
  PID:7920
- C:\Windows\System\ZkuekFa.exe
  C:\Windows\System\ZkuekFa.exe
  2⤵
  PID:7936
- C:\Windows\System\pzeBEJs.exe
  C:\Windows\System\pzeBEJs.exe
  2⤵
  PID:7952
- C:\Windows\System\whqLrLK.exe
  C:\Windows\System\whqLrLK.exe
  2⤵
  PID:7968
- C:\Windows\System\BFgnReQ.exe
  C:\Windows\System\BFgnReQ.exe
  2⤵
  PID:7984
- C:\Windows\System\vxibxSm.exe
  C:\Windows\System\vxibxSm.exe
  2⤵
  PID:8000
- C:\Windows\System\hAvOAwE.exe
  C:\Windows\System\hAvOAwE.exe
  2⤵
  PID:8016
- C:\Windows\System\zpTqEko.exe
  C:\Windows\System\zpTqEko.exe
  2⤵
  PID:8032
- C:\Windows\System\qScRHHx.exe
  C:\Windows\System\qScRHHx.exe
  2⤵
  PID:8048
- C:\Windows\System\fKwRdzo.exe
  C:\Windows\System\fKwRdzo.exe
  2⤵
  PID:8064
- C:\Windows\System\nXbgtCN.exe
  C:\Windows\System\nXbgtCN.exe
  2⤵
  PID:8080
- C:\Windows\System\WhtCthV.exe
  C:\Windows\System\WhtCthV.exe
  2⤵
  PID:8096
- C:\Windows\System\KhqmFqj.exe
  C:\Windows\System\KhqmFqj.exe
  2⤵
  PID:8112
- C:\Windows\System\lUXbZRu.exe
  C:\Windows\System\lUXbZRu.exe
  2⤵
  PID:8128
- C:\Windows\System\xdOhNgj.exe
  C:\Windows\System\xdOhNgj.exe
  2⤵
  PID:8144
- C:\Windows\System\SOdGXJX.exe
  C:\Windows\System\SOdGXJX.exe
  2⤵
  PID:8160
- C:\Windows\System\VpxwDRt.exe
  C:\Windows\System\VpxwDRt.exe
  2⤵
  PID:8176
- C:\Windows\System\baCbuzX.exe
  C:\Windows\System\baCbuzX.exe
  2⤵
  PID:7180
- C:\Windows\System\RRcKkIu.exe
  C:\Windows\System\RRcKkIu.exe
  2⤵
  PID:6724
- C:\Windows\System\FOzaVuT.exe
  C:\Windows\System\FOzaVuT.exe
  2⤵
  PID:7232
- C:\Windows\System\vmSslWA.exe
  C:\Windows\System\vmSslWA.exe
  2⤵
  PID:7212
- C:\Windows\System\SGpHHiC.exe
  C:\Windows\System\SGpHHiC.exe
  2⤵
  PID:7248
- C:\Windows\System\nRdSLpj.exe
  C:\Windows\System\nRdSLpj.exe
  2⤵
  PID:7312
- C:\Windows\System\pjbDsrQ.exe
  C:\Windows\System\pjbDsrQ.exe
  2⤵
  PID:7364
- C:\Windows\System\cTOwWGu.exe
  C:\Windows\System\cTOwWGu.exe
  2⤵
  PID:7380
- C:\Windows\System\tKEhAKM.exe
  C:\Windows\System\tKEhAKM.exe
  2⤵
  PID:7400
- C:\Windows\System\aHvAbVw.exe
  C:\Windows\System\aHvAbVw.exe
  2⤵
  PID:7416
- C:\Windows\System\CDkFbKw.exe
  C:\Windows\System\CDkFbKw.exe
  2⤵
  PID:7428
- C:\Windows\System\vgDiXqI.exe
  C:\Windows\System\vgDiXqI.exe
  2⤵
  PID:7452
- C:\Windows\System\MiPpbgi.exe
  C:\Windows\System\MiPpbgi.exe
  2⤵
  PID:7472
- C:\Windows\System\dfZflNM.exe
  C:\Windows\System\dfZflNM.exe
  2⤵
  PID:7552
- C:\Windows\System\fTtDRdV.exe
  C:\Windows\System\fTtDRdV.exe
  2⤵
  PID:7556
- C:\Windows\System\VJTjZkD.exe
  C:\Windows\System\VJTjZkD.exe
  2⤵
  PID:7572
- C:\Windows\System\knfKyok.exe
  C:\Windows\System\knfKyok.exe
  2⤵
  PID:7588
- C:\Windows\System\JwlhEQy.exe
  C:\Windows\System\JwlhEQy.exe
  2⤵
  PID:7604
- C:\Windows\System\ngGPYmi.exe
  C:\Windows\System\ngGPYmi.exe
  2⤵
  PID:7620
- C:\Windows\System\FYNfIAD.exe
  C:\Windows\System\FYNfIAD.exe
  2⤵
  PID:7640
- C:\Windows\System\FioNWRM.exe
  C:\Windows\System\FioNWRM.exe
  2⤵
  PID:7652
- C:\Windows\System\YJgxhYK.exe
  C:\Windows\System\YJgxhYK.exe
  2⤵
  PID:7316
- C:\Windows\System\mCVLGEE.exe
  C:\Windows\System\mCVLGEE.exe
  2⤵
  PID:7700
- C:\Windows\System\GFmcFuu.exe
  C:\Windows\System\GFmcFuu.exe
  2⤵
  PID:7720
- C:\Windows\System\vkCrxUX.exe
  C:\Windows\System\vkCrxUX.exe
  2⤵
  PID:7744
- C:\Windows\System\IyXDSwN.exe
  C:\Windows\System\IyXDSwN.exe
  2⤵
  PID:7796
- C:\Windows\System\QMIEzWX.exe
  C:\Windows\System\QMIEzWX.exe
  2⤵
  PID:7776
- C:\Windows\System\XYMGBgY.exe
  C:\Windows\System\XYMGBgY.exe
  2⤵
  PID:7832
- C:\Windows\System\ZkCWPDE.exe
  C:\Windows\System\ZkCWPDE.exe
  2⤵
  PID:7944
- C:\Windows\System\fRinedh.exe
  C:\Windows\System\fRinedh.exe
  2⤵
  PID:8008
- C:\Windows\System\LYbNRDg.exe
  C:\Windows\System\LYbNRDg.exe
  2⤵
  PID:7928
- C:\Windows\System\vFEtFjh.exe
  C:\Windows\System\vFEtFjh.exe
  2⤵
  PID:8168
- C:\Windows\System\ybAViqn.exe
  C:\Windows\System\ybAViqn.exe
  2⤵
  PID:7864
- C:\Windows\System\lCmHkfJ.exe
  C:\Windows\System\lCmHkfJ.exe
  2⤵
  PID:6588
- C:\Windows\System\oSdyiZP.exe
  C:\Windows\System\oSdyiZP.exe
  2⤵
  PID:7996
- C:\Windows\System\qStZHAr.exe
  C:\Windows\System\qStZHAr.exe
  2⤵
  PID:8088
- C:\Windows\System\otVjRac.exe
  C:\Windows\System\otVjRac.exe
  2⤵
  PID:8156
- C:\Windows\System\niABBUP.exe
  C:\Windows\System\niABBUP.exe
  2⤵
  PID:7264
- C:\Windows\System\mngPKJN.exe
  C:\Windows\System\mngPKJN.exe
  2⤵
  PID:7344
- C:\Windows\System\mCvfXpX.exe
  C:\Windows\System\mCvfXpX.exe
  2⤵
  PID:7444
- C:\Windows\System\bLTvyWT.exe
  C:\Windows\System\bLTvyWT.exe
  2⤵
  PID:7360
- C:\Windows\System\vYnqfEx.exe
  C:\Windows\System\vYnqfEx.exe
  2⤵
  PID:7424
- C:\Windows\System\iZcowZl.exe
  C:\Windows\System\iZcowZl.exe
  2⤵
  PID:7480
- C:\Windows\System\tUaJDEM.exe
  C:\Windows\System\tUaJDEM.exe
  2⤵
  PID:7564
- C:\Windows\System\EwOWNBE.exe
  C:\Windows\System\EwOWNBE.exe
  2⤵
  PID:7600
- C:\Windows\System\KHawtSh.exe
  C:\Windows\System\KHawtSh.exe
  2⤵
  PID:7580
- C:\Windows\System\KYDtAog.exe
  C:\Windows\System\KYDtAog.exe
  2⤵
  PID:7648
- C:\Windows\System\MgtWJlt.exe
  C:\Windows\System\MgtWJlt.exe
  2⤵
  PID:7680
- C:\Windows\System\lmjfcBo.exe
  C:\Windows\System\lmjfcBo.exe
  2⤵
  PID:7732
- C:\Windows\System\ZMaznOm.exe
  C:\Windows\System\ZMaznOm.exe
  2⤵
  PID:7804
- C:\Windows\System\cjYeBkt.exe
  C:\Windows\System\cjYeBkt.exe
  2⤵
  PID:7980
- C:\Windows\System\IyfLmUo.exe
  C:\Windows\System\IyfLmUo.exe
  2⤵
  PID:8140
- C:\Windows\System\gNojOvE.exe
  C:\Windows\System\gNojOvE.exe
  2⤵
  PID:7200
- C:\Windows\System\FlxnMuJ.exe
  C:\Windows\System\FlxnMuJ.exe
  2⤵
  PID:7412
- C:\Windows\System\ZMzqSQN.exe
  C:\Windows\System\ZMzqSQN.exe
  2⤵
  PID:8196
- C:\Windows\System\SSrwkCF.exe
  C:\Windows\System\SSrwkCF.exe
  2⤵
  PID:8212
- C:\Windows\System\bqEjegu.exe
  C:\Windows\System\bqEjegu.exe
  2⤵
  PID:8228
- C:\Windows\System\XvkIwnL.exe
  C:\Windows\System\XvkIwnL.exe
  2⤵
  PID:8252
- C:\Windows\System\jzIbUKe.exe
  C:\Windows\System\jzIbUKe.exe
  2⤵
  PID:8268
- C:\Windows\System\WzAYzUX.exe
  C:\Windows\System\WzAYzUX.exe
  2⤵
  PID:8284
- C:\Windows\System\phECxHF.exe
  C:\Windows\System\phECxHF.exe
  2⤵
  PID:8300
- C:\Windows\System\NgTJtkH.exe
  C:\Windows\System\NgTJtkH.exe
  2⤵
  PID:8316
- C:\Windows\System\ZPAioep.exe
  C:\Windows\System\ZPAioep.exe
  2⤵
  PID:8332
- C:\Windows\System\QMWMPLm.exe
  C:\Windows\System\QMWMPLm.exe
  2⤵
  PID:8348
- C:\Windows\System\usCLTRI.exe
  C:\Windows\System\usCLTRI.exe
  2⤵
  PID:8376
- C:\Windows\System\uklgFSJ.exe
  C:\Windows\System\uklgFSJ.exe
  2⤵
  PID:8508
- C:\Windows\System\rMyIptb.exe
  C:\Windows\System\rMyIptb.exe
  2⤵
  PID:8536
- C:\Windows\System\sibJpSe.exe
  C:\Windows\System\sibJpSe.exe
  2⤵
  PID:8552
- C:\Windows\System\yUdsALz.exe
  C:\Windows\System\yUdsALz.exe
  2⤵
  PID:8568
- C:\Windows\System\LkOkUXJ.exe
  C:\Windows\System\LkOkUXJ.exe
  2⤵
  PID:8592
- C:\Windows\System\WraVTCM.exe
  C:\Windows\System\WraVTCM.exe
  2⤵
  PID:8608
- C:\Windows\System\ZpBEFOm.exe
  C:\Windows\System\ZpBEFOm.exe
  2⤵
  PID:8624
- C:\Windows\System\ajjSTXb.exe
  C:\Windows\System\ajjSTXb.exe
  2⤵
  PID:8640
- C:\Windows\System\bRlfblq.exe
  C:\Windows\System\bRlfblq.exe
  2⤵
  PID:8656
- C:\Windows\System\yYuDich.exe
  C:\Windows\System\yYuDich.exe
  2⤵
  PID:8672
- C:\Windows\System\bGMvdXQ.exe
  C:\Windows\System\bGMvdXQ.exe
  2⤵
  PID:8688
- C:\Windows\System\pCbFIYa.exe
  C:\Windows\System\pCbFIYa.exe
  2⤵
  PID:8708
- C:\Windows\System\JgpoBBb.exe
  C:\Windows\System\JgpoBBb.exe
  2⤵
  PID:8724
- C:\Windows\System\ODSBycO.exe
  C:\Windows\System\ODSBycO.exe
  2⤵
  PID:8740
- C:\Windows\System\isNInBR.exe
  C:\Windows\System\isNInBR.exe
  2⤵
  PID:8772
- C:\Windows\System\FzlxJcX.exe
  C:\Windows\System\FzlxJcX.exe
  2⤵
  PID:8788
- C:\Windows\System\zvhOtZF.exe
  C:\Windows\System\zvhOtZF.exe
  2⤵
  PID:8804
- C:\Windows\System\EUIVUZm.exe
  C:\Windows\System\EUIVUZm.exe
  2⤵
  PID:8820
- C:\Windows\System\EWnPWkG.exe
  C:\Windows\System\EWnPWkG.exe
  2⤵
  PID:8836
- C:\Windows\System\zAVMwoa.exe
  C:\Windows\System\zAVMwoa.exe
  2⤵
  PID:8852
- C:\Windows\System\vZGytmi.exe
  C:\Windows\System\vZGytmi.exe
  2⤵
  PID:8868
- C:\Windows\System\VUlZDAK.exe
  C:\Windows\System\VUlZDAK.exe
  2⤵
  PID:8884
- C:\Windows\System\RMrXPeE.exe
  C:\Windows\System\RMrXPeE.exe
  2⤵
  PID:8900
- C:\Windows\System\jUgtDnd.exe
  C:\Windows\System\jUgtDnd.exe
  2⤵
  PID:8916
- C:\Windows\System\gnzYdWS.exe
  C:\Windows\System\gnzYdWS.exe
  2⤵
  PID:8936
- C:\Windows\System\XeMpuHm.exe
  C:\Windows\System\XeMpuHm.exe
  2⤵
  PID:8952
- C:\Windows\System\MJCYaii.exe
  C:\Windows\System\MJCYaii.exe
  2⤵
  PID:8968
- C:\Windows\System\lBMZfWO.exe
  C:\Windows\System\lBMZfWO.exe
  2⤵
  PID:8984
- C:\Windows\System\UtTxJop.exe
  C:\Windows\System\UtTxJop.exe
  2⤵
  PID:9000
- C:\Windows\System\zhFyDFC.exe
  C:\Windows\System\zhFyDFC.exe
  2⤵
  PID:9016
- C:\Windows\System\XZlXjnS.exe
  C:\Windows\System\XZlXjnS.exe
  2⤵
  PID:9032
- C:\Windows\System\rrdHJgC.exe
  C:\Windows\System\rrdHJgC.exe
  2⤵
  PID:9048
- C:\Windows\System\FELoAJu.exe
  C:\Windows\System\FELoAJu.exe
  2⤵
  PID:9064
- C:\Windows\System\eRLeEfb.exe
  C:\Windows\System\eRLeEfb.exe
  2⤵
  PID:9080
- C:\Windows\System\rPRTAyB.exe
  C:\Windows\System\rPRTAyB.exe
  2⤵
  PID:9096
- C:\Windows\System\BJcxgCu.exe
  C:\Windows\System\BJcxgCu.exe
  2⤵
  PID:9112
- C:\Windows\System\joKHyXT.exe
  C:\Windows\System\joKHyXT.exe
  2⤵
  PID:9168
- C:\Windows\System\BNzcjsK.exe
  C:\Windows\System\BNzcjsK.exe
  2⤵
  PID:9184
- C:\Windows\System\NEzntqm.exe
  C:\Windows\System\NEzntqm.exe
  2⤵
  PID:7816
- C:\Windows\System\PxFFBVt.exe
  C:\Windows\System\PxFFBVt.exe
  2⤵
  PID:7436
- C:\Windows\System\ICbXcZP.exe
  C:\Windows\System\ICbXcZP.exe
  2⤵
  PID:8264
- C:\Windows\System\qNzPYPJ.exe
  C:\Windows\System\qNzPYPJ.exe
  2⤵
  PID:8328
- C:\Windows\System\aprRFlV.exe
  C:\Windows\System\aprRFlV.exe
  2⤵
  PID:7692
- C:\Windows\System\gEESSJx.exe
  C:\Windows\System\gEESSJx.exe
  2⤵
  PID:7736
- C:\Windows\System\uSNfvUA.exe
  C:\Windows\System\uSNfvUA.exe
  2⤵
  PID:7780
- C:\Windows\System\IoDctwp.exe
  C:\Windows\System\IoDctwp.exe
  2⤵
  PID:7884
- C:\Windows\System\GUTRZED.exe
  C:\Windows\System\GUTRZED.exe
  2⤵
  PID:8044
- C:\Windows\System\EkhZZcw.exe
  C:\Windows\System\EkhZZcw.exe
  2⤵
  PID:7992
- C:\Windows\System\YCiCvnv.exe
  C:\Windows\System\YCiCvnv.exe
  2⤵
  PID:7308
- C:\Windows\System\SNOWXiR.exe
  C:\Windows\System\SNOWXiR.exe
  2⤵
  PID:7464
- C:\Windows\System\KMjgQhC.exe
  C:\Windows\System\KMjgQhC.exe
  2⤵
  PID:7644
- C:\Windows\System\DsDvypi.exe
  C:\Windows\System\DsDvypi.exe
  2⤵
  PID:7540
- C:\Windows\System\SdEgnJs.exe
  C:\Windows\System\SdEgnJs.exe
  2⤵
  PID:8372
- C:\Windows\System\KtckerM.exe
  C:\Windows\System\KtckerM.exe
  2⤵
  PID:8472
- C:\Windows\System\ktVnpjG.exe
  C:\Windows\System\ktVnpjG.exe
  2⤵
  PID:8456
- C:\Windows\System\bigScQL.exe
  C:\Windows\System\bigScQL.exe
  2⤵
  PID:8440
- C:\Windows\System\jhaKBur.exe
  C:\Windows\System\jhaKBur.exe
  2⤵
  PID:8424
- C:\Windows\System\FZMYyXH.exe
  C:\Windows\System\FZMYyXH.exe
  2⤵
  PID:8408
- C:\Windows\System\ZpPdTRj.exe
  C:\Windows\System\ZpPdTRj.exe
  2⤵
  PID:8392
- C:\Windows\System\sSylhGx.exe
  C:\Windows\System\sSylhGx.exe
  2⤵
  PID:8340
- C:\Windows\System\HqTWdsj.exe
  C:\Windows\System\HqTWdsj.exe
  2⤵
  PID:8276
- C:\Windows\System\JkFBiGn.exe
  C:\Windows\System\JkFBiGn.exe
  2⤵
  PID:8236
- C:\Windows\System\lWTbwSj.exe
  C:\Windows\System\lWTbwSj.exe
  2⤵
  PID:7228
- C:\Windows\System\xfrQkbo.exe
  C:\Windows\System\xfrQkbo.exe
  2⤵
  PID:8136
- C:\Windows\System\QJOIkrk.exe
  C:\Windows\System\QJOIkrk.exe
  2⤵
  PID:8492
- C:\Windows\System\CZQtZtA.exe
  C:\Windows\System\CZQtZtA.exe
  2⤵
  PID:8544
- C:\Windows\System\tUBkXdf.exe
  C:\Windows\System\tUBkXdf.exe
  2⤵
  PID:8524
- C:\Windows\System\BtPUAKR.exe
  C:\Windows\System\BtPUAKR.exe
  2⤵
  PID:8564
- C:\Windows\System\hzFesMs.exe
  C:\Windows\System\hzFesMs.exe
  2⤵
  PID:8584
- C:\Windows\System\bTuNvsn.exe
  C:\Windows\System\bTuNvsn.exe
  2⤵
  PID:8620
- C:\Windows\System\PvecXEj.exe
  C:\Windows\System\PvecXEj.exe
  2⤵
  PID:8632
- C:\Windows\System\HtjVSTR.exe
  C:\Windows\System\HtjVSTR.exe
  2⤵
  PID:8680
- C:\Windows\System\ETDlRYM.exe
  C:\Windows\System\ETDlRYM.exe
  2⤵
  PID:8732
- C:\Windows\System\lMqSpeb.exe
  C:\Windows\System\lMqSpeb.exe
  2⤵
  PID:8748
- C:\Windows\System\OlufCqb.exe
  C:\Windows\System\OlufCqb.exe
  2⤵
  PID:8760
- C:\Windows\System\sOxRhki.exe
  C:\Windows\System\sOxRhki.exe
  2⤵
  PID:8796
- C:\Windows\System\mAjZhuX.exe
  C:\Windows\System\mAjZhuX.exe
  2⤵
  PID:8860
- C:\Windows\System\YUtsIpO.exe
  C:\Windows\System\YUtsIpO.exe
  2⤵
  PID:8924
- C:\Windows\System\AqKZyCk.exe
  C:\Windows\System\AqKZyCk.exe
  2⤵
  PID:8880
- C:\Windows\System\KorPJGo.exe
  C:\Windows\System\KorPJGo.exe
  2⤵
  PID:8908
- C:\Windows\System\UQaAMuf.exe
  C:\Windows\System\UQaAMuf.exe
  2⤵
  PID:8944
- C:\Windows\System\jjZHYaa.exe
  C:\Windows\System\jjZHYaa.exe
  2⤵
  PID:8992
- C:\Windows\System\SVVKVbY.exe
  C:\Windows\System\SVVKVbY.exe
  2⤵
  PID:9056
- C:\Windows\System\qRsundd.exe
  C:\Windows\System\qRsundd.exe
  2⤵
  PID:9120
- C:\Windows\System\HgvIwVa.exe
  C:\Windows\System\HgvIwVa.exe
  2⤵
  PID:9108
- C:\Windows\System\oHGWOzb.exe
  C:\Windows\System\oHGWOzb.exe
  2⤵
  PID:9104
- C:\Windows\System\OXqWAHH.exe
  C:\Windows\System\OXqWAHH.exe
  2⤵
  PID:9132
- C:\Windows\System\eduWKRZ.exe
  C:\Windows\System\eduWKRZ.exe
  2⤵
  PID:9148
- C:\Windows\System\YRDDanm.exe
  C:\Windows\System\YRDDanm.exe
  2⤵
  PID:9160
- C:\Windows\System\kLeafZO.exe
  C:\Windows\System\kLeafZO.exe
  2⤵
  PID:9176
- C:\Windows\System\lCNAcur.exe
  C:\Windows\System\lCNAcur.exe
  2⤵
  PID:7196
- C:\Windows\System\uBYAXes.exe
  C:\Windows\System\uBYAXes.exe
  2⤵
  PID:9196
- C:\Windows\System\zFCsenm.exe
  C:\Windows\System\zFCsenm.exe
  2⤵
  PID:8260
- C:\Windows\System\WkgiqLD.exe
  C:\Windows\System\WkgiqLD.exe
  2⤵
  PID:8296
- C:\Windows\System\YBJgNNs.exe
  C:\Windows\System\YBJgNNs.exe
  2⤵
  PID:7728
- C:\Windows\System\UhyQZOn.exe
  C:\Windows\System\UhyQZOn.exe
  2⤵
  PID:7784
- C:\Windows\System\YjVTBSG.exe
  C:\Windows\System\YjVTBSG.exe
  2⤵
  PID:7932
- C:\Windows\System\GYNaWpF.exe
  C:\Windows\System\GYNaWpF.exe
  2⤵
  PID:7440
- C:\Windows\System\wxNfXjl.exe
  C:\Windows\System\wxNfXjl.exe
  2⤵
  PID:7584
- C:\Windows\System\MjuoKPM.exe
  C:\Windows\System\MjuoKPM.exe
  2⤵
  PID:8464
- C:\Windows\System\DObpCIo.exe
  C:\Windows\System\DObpCIo.exe
  2⤵
  PID:8400
- C:\Windows\System\YMXIWaj.exe
  C:\Windows\System\YMXIWaj.exe
  2⤵
  PID:8204
- C:\Windows\System\OBGXLNd.exe
  C:\Windows\System\OBGXLNd.exe
  2⤵
  PID:8516
- C:\Windows\System\wDDCCuq.exe
  C:\Windows\System\wDDCCuq.exe
  2⤵
  PID:8652
- C:\Windows\System\QpTtOaY.exe
  C:\Windows\System\QpTtOaY.exe
  2⤵
  PID:8756
- C:\Windows\System\zZYVuGB.exe
  C:\Windows\System\zZYVuGB.exe
  2⤵
  PID:8496
- C:\Windows\System\fCVwcEa.exe
  C:\Windows\System\fCVwcEa.exe
  2⤵
  PID:8664
- C:\Windows\System\FXPqHCQ.exe
  C:\Windows\System\FXPqHCQ.exe
  2⤵
  PID:8244
- C:\Windows\System\BbvipgY.exe
  C:\Windows\System\BbvipgY.exe
  2⤵
  PID:8412
- C:\Windows\System\KOMVIgY.exe
  C:\Windows\System\KOMVIgY.exe
  2⤵
  PID:7460
- C:\Windows\System\BInIdrS.exe
  C:\Windows\System\BInIdrS.exe
  2⤵
  PID:8716
- C:\Windows\System\mADmsyz.exe
  C:\Windows\System\mADmsyz.exe
  2⤵
  PID:8816
- C:\Windows\System\nNjAIWi.exe
  C:\Windows\System\nNjAIWi.exe
  2⤵
  PID:9024
- C:\Windows\System\yBZGwlB.exe
  C:\Windows\System\yBZGwlB.exe
  2⤵
  PID:9124
- C:\Windows\System\rYTAgOH.exe
  C:\Windows\System\rYTAgOH.exe
  2⤵
  PID:8892
- C:\Windows\System\LSSwypS.exe
  C:\Windows\System\LSSwypS.exe
  2⤵
  PID:9092
- C:\Windows\System\RrXxqle.exe
  C:\Windows\System\RrXxqle.exe
  2⤵
  PID:9144
- C:\Windows\System\WWlwAKS.exe
  C:\Windows\System\WWlwAKS.exe
  2⤵
  PID:8964
- C:\Windows\System\XDeyeFP.exe
  C:\Windows\System\XDeyeFP.exe
  2⤵
  PID:9204
- C:\Windows\System\WgkEssC.exe
  C:\Windows\System\WgkEssC.exe
  2⤵
  PID:7704
- C:\Windows\System\uDlujQj.exe
  C:\Windows\System\uDlujQj.exe
  2⤵
  PID:8432
- C:\Windows\System\EmUiDxZ.exe
  C:\Windows\System\EmUiDxZ.exe
  2⤵
  PID:8704
- C:\Windows\System\MtuUxVd.exe
  C:\Windows\System\MtuUxVd.exe
  2⤵
  PID:8416
- C:\Windows\System\jGcgNCi.exe
  C:\Windows\System\jGcgNCi.exe
  2⤵
  PID:8764
- C:\Windows\System\jrdnJKl.exe
  C:\Windows\System\jrdnJKl.exe
  2⤵
  PID:9164
- C:\Windows\System\TTmlOei.exe
  C:\Windows\System\TTmlOei.exe
  2⤵
  PID:9200
- C:\Windows\System\YPOakSd.exe
  C:\Windows\System\YPOakSd.exe
  2⤵
  PID:8616
- C:\Windows\System\rfVrYQn.exe
  C:\Windows\System\rfVrYQn.exe
  2⤵
  PID:7788
- C:\Windows\System\RWIicIl.exe
  C:\Windows\System\RWIicIl.exe
  2⤵
  PID:7964
- C:\Windows\System\DShgEDF.exe
  C:\Windows\System\DShgEDF.exe
  2⤵
  PID:8476
- C:\Windows\System\aPYxmvL.exe
  C:\Windows\System\aPYxmvL.exe
  2⤵
  PID:8280
- C:\Windows\System\QJoVgBz.exe
  C:\Windows\System\QJoVgBz.exe
  2⤵
  PID:8028
- C:\Windows\System\xEfZklL.exe
  C:\Windows\System\xEfZklL.exe
  2⤵
  PID:8812
- C:\Windows\System\nZPAZxR.exe
  C:\Windows\System\nZPAZxR.exe
  2⤵
  PID:7712
- C:\Windows\System\XAngJXA.exe
  C:\Windows\System\XAngJXA.exe
  2⤵
  PID:8976
- C:\Windows\System\nAMaESR.exe
  C:\Windows\System\nAMaESR.exe
  2⤵
  PID:8720
- C:\Windows\System\ozeYQeU.exe
  C:\Windows\System\ozeYQeU.exe
  2⤵
  PID:7960
- C:\Windows\System\JQJsYmh.exe
  C:\Windows\System\JQJsYmh.exe
  2⤵
  PID:8060
- C:\Windows\System\ddsQnpd.exe
  C:\Windows\System\ddsQnpd.exe
  2⤵
  PID:8848
- C:\Windows\System\ctGNyWv.exe
  C:\Windows\System\ctGNyWv.exe
  2⤵
  PID:8360
- C:\Windows\System\tzsmMwL.exe
  C:\Windows\System\tzsmMwL.exe
  2⤵
  PID:7916
- C:\Windows\System\CeECvaM.exe
  C:\Windows\System\CeECvaM.exe
  2⤵
  PID:9072
- C:\Windows\System\cHeDoMv.exe
  C:\Windows\System\cHeDoMv.exe
  2⤵
  PID:9156
- C:\Windows\System\erFrHUY.exe
  C:\Windows\System\erFrHUY.exe
  2⤵
  PID:9088
- C:\Windows\System\tmnxARL.exe
  C:\Windows\System\tmnxARL.exe
  2⤵
  PID:9140
- C:\Windows\System\jloJzLX.exe
  C:\Windows\System\jloJzLX.exe
  2⤵
  PID:7772
- C:\Windows\System\zNzqeZo.exe
  C:\Windows\System\zNzqeZo.exe
  2⤵
  PID:9232
- C:\Windows\System\bthlwPg.exe
  C:\Windows\System\bthlwPg.exe
  2⤵
  PID:9248
- C:\Windows\System\hCXFaio.exe
  C:\Windows\System\hCXFaio.exe
  2⤵
  PID:9264
- C:\Windows\System\mPslvtO.exe
  C:\Windows\System\mPslvtO.exe
  2⤵
  PID:9280
- C:\Windows\System\YkslVCW.exe
  C:\Windows\System\YkslVCW.exe
  2⤵
  PID:9296
- C:\Windows\System\BLFFnaU.exe
  C:\Windows\System\BLFFnaU.exe
  2⤵
  PID:9312
- C:\Windows\System\bccNZbx.exe
  C:\Windows\System\bccNZbx.exe
  2⤵
  PID:9328
- C:\Windows\System\KgfLJMa.exe
  C:\Windows\System\KgfLJMa.exe
  2⤵
  PID:9344
- C:\Windows\System\CExKxWq.exe
  C:\Windows\System\CExKxWq.exe
  2⤵
  PID:9360
- C:\Windows\System\chjwHbj.exe
  C:\Windows\System\chjwHbj.exe
  2⤵
  PID:9376
- C:\Windows\System\TQIPQvr.exe
  C:\Windows\System\TQIPQvr.exe
  2⤵
  PID:9392
- C:\Windows\System\pXnjLje.exe
  C:\Windows\System\pXnjLje.exe
  2⤵
  PID:9408
- C:\Windows\System\TMLebMO.exe
  C:\Windows\System\TMLebMO.exe
  2⤵
  PID:9424
- C:\Windows\System\EzvCkmf.exe
  C:\Windows\System\EzvCkmf.exe
  2⤵
  PID:9440
- C:\Windows\System\LrUEEKM.exe
  C:\Windows\System\LrUEEKM.exe
  2⤵
  PID:9456
- C:\Windows\System\EaAODFe.exe
  C:\Windows\System\EaAODFe.exe
  2⤵
  PID:9472
- C:\Windows\System\sACBraw.exe
  C:\Windows\System\sACBraw.exe
  2⤵
  PID:9488
- C:\Windows\System\JFSSjdu.exe
  C:\Windows\System\JFSSjdu.exe
  2⤵
  PID:9504
- C:\Windows\System\uLWkFaR.exe
  C:\Windows\System\uLWkFaR.exe
  2⤵
  PID:9520
- C:\Windows\System\SVIVjHB.exe
  C:\Windows\System\SVIVjHB.exe
  2⤵
  PID:9536
- C:\Windows\System\tKMLJMY.exe
  C:\Windows\System\tKMLJMY.exe
  2⤵
  PID:9552
- C:\Windows\System\oiKwULV.exe
  C:\Windows\System\oiKwULV.exe
  2⤵
  PID:9568
- C:\Windows\System\cWtSzFv.exe
  C:\Windows\System\cWtSzFv.exe
  2⤵
  PID:9584
- C:\Windows\System\CotzZml.exe
  C:\Windows\System\CotzZml.exe
  2⤵
  PID:9620
- C:\Windows\System\UVEYcCB.exe
  C:\Windows\System\UVEYcCB.exe
  2⤵
  PID:9636
- C:\Windows\System\kWSGDoj.exe
  C:\Windows\System\kWSGDoj.exe
  2⤵
  PID:9652
- C:\Windows\System\lgnluER.exe
  C:\Windows\System\lgnluER.exe
  2⤵
  PID:9668
- C:\Windows\System\kgtwASK.exe
  C:\Windows\System\kgtwASK.exe
  2⤵
  PID:9684
- C:\Windows\System\BuqotIy.exe
  C:\Windows\System\BuqotIy.exe
  2⤵
  PID:9700
- C:\Windows\System\wxexZkB.exe
  C:\Windows\System\wxexZkB.exe
  2⤵
  PID:9716
- C:\Windows\System\GVVkEds.exe
  C:\Windows\System\GVVkEds.exe
  2⤵
  PID:9732
- C:\Windows\System\bBYzltS.exe
  C:\Windows\System\bBYzltS.exe
  2⤵
  PID:9748
- C:\Windows\System\xwURGhP.exe
  C:\Windows\System\xwURGhP.exe
  2⤵
  PID:9764
- C:\Windows\System\pUPgSxd.exe
  C:\Windows\System\pUPgSxd.exe
  2⤵
  PID:9780
- C:\Windows\System\KRsDQOK.exe
  C:\Windows\System\KRsDQOK.exe
  2⤵
  PID:9800
- C:\Windows\System\zhLirMn.exe
  C:\Windows\System\zhLirMn.exe
  2⤵
  PID:9816
- C:\Windows\System\ggZBfjN.exe
  C:\Windows\System\ggZBfjN.exe
  2⤵
  PID:9832
- C:\Windows\System\JvZsSKx.exe
  C:\Windows\System\JvZsSKx.exe
  2⤵
  PID:9848
- C:\Windows\System\JLZcGup.exe
  C:\Windows\System\JLZcGup.exe
  2⤵
  PID:9864
- C:\Windows\System\NdyXFNI.exe
  C:\Windows\System\NdyXFNI.exe
  2⤵
  PID:9880
- C:\Windows\System\jCuRsZe.exe
  C:\Windows\System\jCuRsZe.exe
  2⤵
  PID:9896
- C:\Windows\System\BRMrYgD.exe
  C:\Windows\System\BRMrYgD.exe
  2⤵
  PID:9912
- C:\Windows\System\gwugItG.exe
  C:\Windows\System\gwugItG.exe
  2⤵
  PID:9928
- C:\Windows\System\mnTccoh.exe
  C:\Windows\System\mnTccoh.exe
  2⤵
  PID:9944
- C:\Windows\System\YfsaEzE.exe
  C:\Windows\System\YfsaEzE.exe
  2⤵
  PID:9960
- C:\Windows\System\aUfNdEs.exe
  C:\Windows\System\aUfNdEs.exe
  2⤵
  PID:9976
- C:\Windows\System\hlzOJvM.exe
  C:\Windows\System\hlzOJvM.exe
  2⤵
  PID:9992
- C:\Windows\System\GRMSfFY.exe
  C:\Windows\System\GRMSfFY.exe
  2⤵
  PID:10008
- C:\Windows\System\mCHgbBN.exe
  C:\Windows\System\mCHgbBN.exe
  2⤵
  PID:10024
- C:\Windows\System\eEEtQSq.exe
  C:\Windows\System\eEEtQSq.exe
  2⤵
  PID:10040
- C:\Windows\System\KdgLzHe.exe
  C:\Windows\System\KdgLzHe.exe
  2⤵
  PID:10056
- C:\Windows\System\gwwkdOp.exe
  C:\Windows\System\gwwkdOp.exe
  2⤵
  PID:10072
- C:\Windows\System\xbVECgq.exe
  C:\Windows\System\xbVECgq.exe
  2⤵
  PID:10088
- C:\Windows\System\nsBqvQg.exe
  C:\Windows\System\nsBqvQg.exe
  2⤵
  PID:10104
- C:\Windows\System\AceSNje.exe
  C:\Windows\System\AceSNje.exe
  2⤵
  PID:10120
- C:\Windows\System\qHzOmbA.exe
  C:\Windows\System\qHzOmbA.exe
  2⤵
  PID:10136
- C:\Windows\System\LeLErrJ.exe
  C:\Windows\System\LeLErrJ.exe
  2⤵
  PID:10152
- C:\Windows\System\uTiJaAM.exe
  C:\Windows\System\uTiJaAM.exe
  2⤵
  PID:10168
- C:\Windows\System\iVUvbbc.exe
  C:\Windows\System\iVUvbbc.exe
  2⤵
  PID:10184
- C:\Windows\System\nFELUnW.exe
  C:\Windows\System\nFELUnW.exe
  2⤵
  PID:10200
- C:\Windows\System\lXUIdgz.exe
  C:\Windows\System\lXUIdgz.exe
  2⤵
  PID:10216
- C:\Windows\System\qaIRGdb.exe
  C:\Windows\System\qaIRGdb.exe
  2⤵
  PID:10232
- C:\Windows\System\qAVwWfL.exe
  C:\Windows\System\qAVwWfL.exe
  2⤵
  PID:9256
- C:\Windows\System\pyeHyyw.exe
  C:\Windows\System\pyeHyyw.exe
  2⤵
  PID:9320
- C:\Windows\System\weSRoiz.exe
  C:\Windows\System\weSRoiz.exe
  2⤵
  PID:9244
- C:\Windows\System\eohLWak.exe
  C:\Windows\System\eohLWak.exe
  2⤵
  PID:9304
- C:\Windows\System\tkNipXZ.exe
  C:\Windows\System\tkNipXZ.exe
  2⤵
  PID:9340
- C:\Windows\System\EwGGdiM.exe
  C:\Windows\System\EwGGdiM.exe
  2⤵
  PID:9416
- C:\Windows\System\ctcRdNq.exe
  C:\Windows\System\ctcRdNq.exe
  2⤵
  PID:9480
- C:\Windows\System\QOROZKh.exe
  C:\Windows\System\QOROZKh.exe
  2⤵
  PID:9432
- C:\Windows\System\ewiUuKC.exe
  C:\Windows\System\ewiUuKC.exe
  2⤵
  PID:9468
- C:\Windows\System\KnyticL.exe
  C:\Windows\System\KnyticL.exe
  2⤵
  PID:9544
- C:\Windows\System\KcdSuts.exe
  C:\Windows\System\KcdSuts.exe
  2⤵
  PID:9580
- C:\Windows\System\dcsrWBK.exe
  C:\Windows\System\dcsrWBK.exe
  2⤵
  PID:9564
- C:\Windows\System\OeUqJNG.exe
  C:\Windows\System\OeUqJNG.exe
  2⤵
  PID:9600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DFVFYUl.exe

Filesize
1.5MB

MD5
58ee9dd704e56615f9fb94c911604769

SHA1
0c4c830af102e3a28adfc91ac749a1ae535b4410

SHA256
3e467b3155879d59887ac159d5e598003a6b4aea616021b1e866905dbc8912d0

SHA512
058549e8129cea87ffcbe760020988e26f889b437072ac3d465c2c6b01801df6d0cfa508f0e83463bec3987a71533ca04a0f1d2c99d40cbd88bba08dbbe3924c

Download Submit
C:\Windows\system\DImyRNs.exe

Filesize
1.5MB

MD5
331405c1444d847dad9a769435b88af2

SHA1
8fd4dfda3c7d01b6cd36e8ddcb8ec57d2987832d

SHA256
3cfc3829954f91795803edb99aedfaeaba5493eec416423b8df07cd94f31c757

SHA512
491fd69bd859cb92dc43c431055f13f32aaa136ba245d8b486e18741b097ffddc83d1ca9aefeb8aee58440bce60d1c2e245a5d47955cafa098dc050f0ab4dc89

Download Submit
C:\Windows\system\FAptoUa.exe

Filesize
1.5MB

MD5
a59a28ed3d9592b5043042490a4cab50

SHA1
f2e6576dfad534c3c234ecde9e7cce238a374abc

SHA256
04e18bff485777947a9122eb28047cde30329b02f1a686cf196fb809c943e2e7

SHA512
cb5a9394d1fec2b0199067509effc1eb0ec00e50a4aea4af1cf38ecb888e7dd8b43581228b005a7b9b46c7206e1695d71f517d263db2e53e8a8eb9dbdcf6408b

Download Submit
C:\Windows\system\IKphCUm.exe

Filesize
1.5MB

MD5
f2867796481ae63bc0e488064e77e60a

SHA1
bb8164aaa8953dc4af381377f5ac0f54205129b2

SHA256
dd0ca8180e9e86f87baf59be13154f235a7a8251227468648ec6150182eb6f4a

SHA512
23160e84fa79e5185bd091c4f12d3dcb6481996592d7efe01794b9e1430b454dac21c85b989d1a47ce3c85c4f98439a52971398c5f70b48af03a23401cbbc004

Download Submit
C:\Windows\system\IqwskdD.exe

Filesize
1.5MB

MD5
9cbef2068e5e6922518ca018fdcfa475

SHA1
eb8438aec9999fa9e854797361de5b5980d32db9

SHA256
a895ab199501967f688a824aa09a50d54d278df76c5b1c6c4cfb1dfba2a03505

SHA512
41e77eb6af7ededdd044023757bffe620cb0cd736e16279e9602ff721b7e9cc1ac042d53d5a2a4342637f5b36e8db8c48b928b52ababb47145c466125601e13a

Download Submit
C:\Windows\system\KcPPOeo.exe

Filesize
1.5MB

MD5
3ee8423ef867bb942ed984377e398ba4

SHA1
5d9b336f063400db0befcfd4b06ea3c30144d01a

SHA256
a5835894db141cf1d5907bfbd61799034d9aaf8597b9c59b71a2fd770c97247e

SHA512
5512bb90720bb30c4ac91753199908e5ee1e408fad521dc081caa8828dc5817007d15ec8cbd997ef733652d9afae9037e4fc07de3b28178027d9bd65f036b7f8

Download Submit
C:\Windows\system\NKAgFBT.exe

Filesize
1.5MB

MD5
88a7424e0757da2903e485c772578ea9

SHA1
f015ee5f442341556f4446271560db27d6337516

SHA256
f518fac544ea7b521ecc2c2b523afae97daa4086fb6583f58390f987ea5c4ae9

SHA512
b241a70043e037cb9ee16411fa98309f3ad7198ef4367fd6c79fb78b6e8d245888f8d2ef69f5f2ca7b92a078e2800600040dd37d91664f163f063a0c6653564f

Download Submit
C:\Windows\system\RXzvUTg.exe

Filesize
1.5MB

MD5
e781b6afc2ba4b993170c803a009e7c6

SHA1
5fb5140805c2477ef790b17352012089a68df15d

SHA256
d90e7bdf77e88885410e1f9317a3861fd9d61a05b35df717c6d4a9230661db2a

SHA512
098d5517ee8881f96b057e50f9f304bf105818a46fc495537f16ea2558b621616fd601e9c47d8d1f0964d858bd71b184976a5566f0562bb766bbe7dd7861f563

Download Submit
C:\Windows\system\SqXCTYg.exe

Filesize
1.5MB

MD5
fa37b34661d141440b73045610f1ca11

SHA1
dc52913f03e1cf80f586051c8a2a62d7e4237eb1

SHA256
92ecd09380fade3dea85ded627a102e9611c22a76e275f864c6c73ca838173e7

SHA512
1f3011d5675eb6663c282563b609d3d034e25500ff32aae8fc606660bf1da5c2c13b86554872a0fc18a5e9ab3881730338b17cd50f55ceab0648608f9dea94f3

Download Submit
C:\Windows\system\XIDWcqP.exe

Filesize
1.5MB

MD5
e1720e7aa8c970b8ea3215a4ff25f23a

SHA1
5d01b31b9097f8d68c037cef18d26c686fd2869f

SHA256
0664e0a1032e17eaa33d5c8beb4f932a470e86caae785e867848f9894c4e726b

SHA512
d99761ad96903f668b0f3804b2d4a029a6071af6c47ef93e2252e042e9f66e84de4c85b675d7a728973acd7199d34285191ce6148808eb74e5679fc9d2ccc53c

Download Submit
C:\Windows\system\XUZGwjf.exe

Filesize
1.5MB

MD5
5942bc3745f1bc8529e1a0c500d4f9e6

SHA1
98e0842d86c0d5f0befdfafd1098ac2638827672

SHA256
24660ed1f4c160813c947f3175484df69d0449aec649b33039d29fbf24fe73fb

SHA512
95b64ffc6d082b000b93953238a9426ea79ca8b0d7f42d881083726241e5b3f17af550f2ba8b789b2084b58395d72caf6e1d1376e444fb2d605363a96b0dc306

Download Submit
C:\Windows\system\ahRcgTf.exe

Filesize
1.5MB

MD5
2cffb983cabf1e9f278ef8703cfdbe8a

SHA1
08108925b67fcb6318b43662e14d09a9df40005a

SHA256
e3dabb38ce291323c7d72ba4081526f7add87df0b617d5188c3a658961edeec2

SHA512
c014b8508b524261aa5e4abdbde6f8628e3c80bbc6c8a8edc7120f3d8f82887dd97a68a4e93819f0cbd7b7962ba129291b4332b2ba096233bd9a88c0b698051a

Download Submit
C:\Windows\system\cawkQRV.exe

Filesize
1.5MB

MD5
57f79b81e7cef411697d8b212035a8a5

SHA1
350c8ccf0f4d698c363eb7360f8f2ad98d4679f6

SHA256
fcbf3b5cb599c1ea207ea6aeb2e7017a98e5457243e27b600b4a7ff3b2826923

SHA512
03eb26a73ef201b1f69594b5db4e1c681f55167d87a92b329b9bb460a6d97a0c0392021ebba87dfa44d9f479e757a17336eed75948a0bd8953ac1d1b5361648c

Download Submit
C:\Windows\system\eaDRKFc.exe

Filesize
1.5MB

MD5
25f801d191ccb2de66ddde3a2099fff1

SHA1
666f72efd8ca139d011b03b9825d7b2bb4c1ea43

SHA256
8367e03fab802e90dd70bba0a72121175bf9b39ab105b775bd00d2609f35bd0c

SHA512
ef1a55de0b8abc0096eff4c0f73347c623a5bbcee18b116e573d1ff89b32b6dac1283a533df1f945e6b83ba56a511e74fd7c265867557a39974537a05628240e

Download Submit
C:\Windows\system\gAyHdhl.exe

Filesize
1.5MB

MD5
f5dade2bd0df5bfa53c7574d74cb54ea

SHA1
350901bbe7edcbe0c00c922952cf59d19596db2a

SHA256
2fc4dc03b56b1b922d774af7c02f5be7ce1a11458c685b78f419893a98f714a8

SHA512
1823975f3b8f485f34049c9d29202ee2b4fc67197ab215782581f9b7f64f10fd6fd5e767cd8d6defa9f5f7c75975bcab6856a4be4b3605086e47ea29fefa733d

Download Submit
C:\Windows\system\iTZArek.exe

Filesize
1.5MB

MD5
612ea5d0b797e6339793ccc2465edf38

SHA1
2e0e345e88d877373996e1b72f8e80f286444f67

SHA256
0d0429dbc85cf03a27c3dcf95145a0ea4ad48b7ed4c81330d0234a3c90322786

SHA512
50c880be5fb598b9462e6980d5b5b285427d09af3d4d48036bc8754fe115e8dcb2782c57fe04eaee450d3d267e04280475cf67162d915e407c53299e4de2561f

Download Submit
C:\Windows\system\lqOmRRU.exe

Filesize
1.5MB

MD5
79fe24cc63cfb49f25fd55853d4f49d2

SHA1
3d10a877576a0c82602c0f4c733afdf9c3df49ee

SHA256
94bcd13729a8847caa9e6a45eeeae5093f67f437b7a8000f42dbc428ce97e96a

SHA512
ed4b44657b878b9418e01e6d145d2e93672f474e0ba66874d17041b0c82b476557ea6e5147e75ec9338ea66731face595ea0c6a0181d1a2bd37ea579fc8809c5

Download Submit
C:\Windows\system\omxAtIZ.exe

Filesize
1.5MB

MD5
090ab59c7e048737873eb7ea50ef7315

SHA1
1d4f3c38e8d0e03843c5360200e2f188d897495c

SHA256
ab2c95265698edb0da50d04403a78d5fbce9dd958d1733952bd22b16cf458908

SHA512
3d10d84168aca15f2c858af995df60b13f4805ceb3966c53724e2a758738c91694acfb00d8c406a81394f7957f52a2c982e79ca6e8650d18081aff2762fc17fe

Download Submit
C:\Windows\system\pyYIkDV.exe

Filesize
1.5MB

MD5
afce758111fa55225e94833d4772c945

SHA1
6d86b071e087c5992b20d345c67498ddbc4d1e72

SHA256
db5649ec40678afd9083ed0555251836848de23cf18919e01b92a212c00854d0

SHA512
ce1c1db21dcd9570affb52f9caa27c562cd08a5fea6e2e410b4244afb91e6e0ce906d4b4132d22f36f3f84a45da12561cdc5cba38bd1c8a849a0f949c3759b98

Download Submit
C:\Windows\system\uDaQsmr.exe

Filesize
1.5MB

MD5
0c3700dbeaf75f7d20960eab40dc3b71

SHA1
327f4f870798233dbc1348b3d1c53ac81de2c7ad

SHA256
cf4a0192509c8b89e3249233f2d48944de56f834771697487d5029bc55ab2f3c

SHA512
d291c6910ea0e730ff6530e6b23b449de2a7c03d5a63da3b2a6a3ea2ae06feac5b86a95efd8dc8de5cebce722fc0418d1a5487bbb4ea3a1fd141f048098c8e6c

Download Submit
C:\Windows\system\uRgoAXq.exe

Filesize
1.5MB

MD5
b3d40d96427d5f93998bea3a8e6a8a9b

SHA1
5cd83f627f779ce042dc3e2a2243f7b0ad3ff74d

SHA256
069f50930a59b3ff4397cb3fbfad4db3f214e9c544e369e10728f1d78a5acfe7

SHA512
a9469792db7e36e68cb3a1394fd270209ab01adae0917ed52fd25f70ac8cec670e5ea4f87377de7dcd14e802a3f3c8390c30a75f8c4b470bc7e2ad130a08e265

Download Submit
C:\Windows\system\yDjyCGL.exe

Filesize
1.5MB

MD5
47fe712aace931444bdbf06922734da3

SHA1
d42fa979f7a64c15bb22079bfc8899009bec4d98

SHA256
c80f8fe53acdb23c4a298dc2570e82c3b61e080c8382d63a08be7cc680bfebd4

SHA512
4b65728eeb1232de54e3d280d12a4eeca9c949a4289f3da59abcbd3cd60ccad5440989ecf7f7610085d73c642dcc4889928357b2360a9c0ca9a64963a3477cad

Download Submit
\Windows\system\BbcMXdZ.exe

Filesize
1.5MB

MD5
5fd405c802637195d4235e75d2e250e2

SHA1
44009b69fbd5381776c45e1852486d319a5976c8

SHA256
90a853ae348b48359123d7f30dd6c56c8df4c4fc71992b58746ecfaab2b2e013

SHA512
a9de20c21f0e7bcade1f8e871a5f941f4e1a9dc318ab3f8ceda3a6b49e0dc371c7d9ff7360fd8a5f98ccc7126d54eebab395f41e0542218d3bb3f608421563d6

Download Submit
\Windows\system\CzLdtch.exe

Filesize
1.5MB

MD5
0a822d87c583f8b28cf9919fa0d2531b

SHA1
e2e5a0619892782f078bdd9a3fdfbbbc24d202f0

SHA256
1d264698f2bacfb8f56938bed23ac1b7a5b5521343d0a9e8dbcfa677afa62170

SHA512
25fe6b4b8db311d88bc45c19b7a61962c3a221c38b2a67f5f3467f62a17ef728a4a8152fe2377d80e46a6986007b8ac8af2ece67a310974618f623620e4da491

Download Submit
\Windows\system\IWYlMzc.exe

Filesize
1.5MB

MD5
9ef8be2a0cd67e1b006aab33dfe43c37

SHA1
1fc90de498482c9904649031c23410d26076bc35

SHA256
d1876a0c9363c35e22cf4767a64b35d25ee1f86b86f861263b7925a5d1d91455

SHA512
dee0e36c6607a7c5da522e1491c095179a31061f19d18e29c6a00d9c03afe094dc66d905af4bdcca27b698450a27dd04c0639ce315bf04c94a34a26f847d1ba3

Download Submit
\Windows\system\IlDCdpS.exe

Filesize
1.5MB

MD5
3217a01cd99bc08e7230bafb5f051868

SHA1
bab22f962bfdef37a89ed5402f1d5388b044dd88

SHA256
c0e7a9ce4bbb979139d917f1719d2dae741d1bf5172fcbb1a3b73c1cf50e81fa

SHA512
73a1496a2e02450d4bbca9408bc6cde72226ba21323e6748fdbe92be1dfb353c31f4107568dec664c2f7ddaadeca62a0370a389fc445930a1aa755925c8718af

Download Submit
\Windows\system\TPJNOBE.exe

Filesize
1.5MB

MD5
31b83398e0f7a9f1ac6cfec1d645c0d3

SHA1
cf49778db73bf3ffaae22696695ed92639649c72

SHA256
a8ecf289389e8b73883fcebb2e01fbb19b90cead0a69d2676274c4d14c2c16b1

SHA512
e5851dab7cd63db410da3a23173ba10c9ce95786cf01eddb4370d5bea8ff1f03959c2ece7e7e9f9b1d07a03016fb7941ea7af2064bc5c86fb6ece6c8c113253c

Download Submit
\Windows\system\XsmEdkT.exe

Filesize
1.5MB

MD5
b89ba7721aa2df7198fdf2546c2db449

SHA1
8488e7cbb2e2927ef607a08099b850c514f2aa0d

SHA256
e6b57b4e1e76a1d9ef09bfaf7ec1fc2a5b37070121612c4c44ed3fd185bca505

SHA512
c9561758297b983fbc11fc37d201823941a822881e00a9a20d6ab1c98d4158572f076d88788d791a4e27983cd1cf3c8b4fba61c77d45fa4d8da1f699e32e272a

Download Submit
\Windows\system\jLwVRVD.exe

Filesize
1.5MB

MD5
86693b599cf78d36306078b56a1d94a2

SHA1
abea895583cace31b1a3041c7ee17acc26778acd

SHA256
8a55968e4a38e72c73be9b4afd4bdef2965d89078f1e72ff109619a6673ed104

SHA512
c459ca69b2ba37c68a7124eeeeb19c1cd20eef8bb633456bc22e9360d332b113639c13e604022535b76a3f2ec9cc4fded27c601a828fa319a2c1d771cf599c22

Download Submit
\Windows\system\jWLyaxB.exe

Filesize
1.5MB

MD5
59496f45c209e4c1b905c46bf33dddfa

SHA1
9c90144097437c710fb087ffad37d22d54e165ab

SHA256
7cb2652ab7108ac6af501b4ecca1b580ad41e34255e9397087562e1f50b84ca8

SHA512
565ec83729a8690336f5216a67788f9df976cad92bcec8dde903120c979f7bd75288cf3397cd7117e9d579071d83d60d7af6e4a30524f4ad944e06d6ed28e8f8

Download Submit
\Windows\system\mOrlazD.exe

Filesize
1.5MB

MD5
5b9eb6d3edb968e5d7a884d38e7797b2

SHA1
23ebd7a966fe80d7e37488ec53bbb3227fc99ea7

SHA256
b73a93819b0db5f891f6d82f0721b9045641da362fb5748efe40921cd1559e28

SHA512
a28d9b2f395443b4252967e1e2e755b585cce8d3ad6e755585078d97b184e067ffb61fd671e8cb60848caeec7c54a50e3e5315df986f182621b12376ed521d8a

Download Submit
\Windows\system\vmvqtEh.exe

Filesize
1.5MB

MD5
6342c7897b426d128ac8d2595dc92241

SHA1
5c68476322c8d24ad6d403966ac55017b1ca8a66

SHA256
7673c2ff4f2c9698bbfaac4fca39afdfbc112a04188df98cbe168c7f934d3c8d

SHA512
b90d681005c9ff311625a922a62ed9d605589bfe3c898d972f5d9fc1b3c69f3dd1b66d42f381fc745ede61da1cad25472abc103aedaeede2d80bc6efd60815e9

Download Submit
memory/1600-13-0x000000013F6B0000-0x000000013FA01000-memory.dmp

Filesize
3.3MB

Download
memory/1600-75-0x000000013F6B0000-0x000000013FA01000-memory.dmp

Filesize
3.3MB

Download
memory/1600-3827-0x000000013F6B0000-0x000000013FA01000-memory.dmp

Filesize
3.3MB

Download
memory/1668-14-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/1668-3860-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2124-1237-0x000000013FEC0000-0x0000000140211000-memory.dmp

Filesize
3.3MB

Download
memory/2124-3867-0x000000013FEC0000-0x0000000140211000-memory.dmp

Filesize
3.3MB

Download
memory/2124-23-0x000000013FEC0000-0x0000000140211000-memory.dmp

Filesize
3.3MB

Download
memory/2488-3706-0x000000013FEF0000-0x0000000140241000-memory.dmp

Filesize
3.3MB

Download
memory/2488-78-0x000000013FEF0000-0x0000000140241000-memory.dmp

Filesize
3.3MB

Download
memory/2536-3869-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2536-122-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2544-80-0x000000013F910000-0x000000013FC61000-memory.dmp

Filesize
3.3MB

Download
memory/2544-3705-0x000000013F910000-0x000000013FC61000-memory.dmp

Filesize
3.3MB

Download
memory/2548-3710-0x000000013F1F0000-0x000000013F541000-memory.dmp

Filesize
3.3MB

Download
memory/2548-77-0x000000013F1F0000-0x000000013F541000-memory.dmp

Filesize
3.3MB

Download
memory/2664-125-0x000000013F8B0000-0x000000013FC01000-memory.dmp

Filesize
3.3MB

Download
memory/2664-3868-0x000000013F8B0000-0x000000013FC01000-memory.dmp

Filesize
3.3MB

Download
memory/2684-50-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/2684-3879-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/2700-3709-0x000000013F990000-0x000000013FCE1000-memory.dmp

Filesize
3.3MB

Download
memory/2700-47-0x000000013F990000-0x000000013FCE1000-memory.dmp

Filesize
3.3MB

Download
memory/2704-3708-0x000000013FEC0000-0x0000000140211000-memory.dmp

Filesize
3.3MB

Download
memory/2704-2121-0x000000013FEC0000-0x0000000140211000-memory.dmp

Filesize
3.3MB

Download
memory/2776-3832-0x000000013F5A0000-0x000000013F8F1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-2362-0x000000013F5A0000-0x000000013F8F1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-35-0x000000013F5A0000-0x000000013F8F1000-memory.dmp

Filesize
3.3MB

Download
memory/2860-127-0x0000000002030000-0x0000000002381000-memory.dmp

Filesize
3.3MB

Download
memory/2860-74-0x000000013FEF0000-0x0000000140241000-memory.dmp

Filesize
3.3MB

Download
memory/2860-10-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2860-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2860-20-0x000000013FEC0000-0x0000000140211000-memory.dmp

Filesize
3.3MB

Download
memory/2860-123-0x0000000002030000-0x0000000002381000-memory.dmp

Filesize
3.3MB

Download
memory/2860-60-0x000000013F8D0000-0x000000013FC21000-memory.dmp

Filesize
3.3MB

Download
memory/2860-2357-0x0000000002030000-0x0000000002381000-memory.dmp

Filesize
3.3MB

Download
memory/2860-2533-0x0000000002030000-0x0000000002381000-memory.dmp

Filesize
3.3MB

Download
memory/2860-71-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2860-73-0x0000000002030000-0x0000000002381000-memory.dmp

Filesize
3.3MB

Download
memory/2860-15-0x0000000002030000-0x0000000002381000-memory.dmp

Filesize
3.3MB

Download
memory/2860-79-0x000000013F560000-0x000000013F8B1000-memory.dmp

Filesize
3.3MB

Download
memory/2860-33-0x0000000002030000-0x0000000002381000-memory.dmp

Filesize
3.3MB

Download
memory/2860-126-0x0000000002030000-0x0000000002381000-memory.dmp

Filesize
3.3MB

Download
memory/2860-0-0x000000013F8D0000-0x000000013FC21000-memory.dmp

Filesize
3.3MB

Download
memory/2860-129-0x0000000002030000-0x0000000002381000-memory.dmp

Filesize
3.3MB

Download
memory/2860-37-0x0000000002030000-0x0000000002381000-memory.dmp

Filesize
3.3MB

Download
memory/2860-25-0x000000013FEC0000-0x0000000140211000-memory.dmp

Filesize
3.3MB

Download
memory/2860-49-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/2944-128-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download