xmrig | 30a6fdcb6cc8b3f1cbe835da4e97311d93163e376e9851e24c02bf6e87f75cd2

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
Size

1.6MB
MD5

bcc2891c393dbb77c3f3197e0c2267f0
SHA1

158bea548c2c69d6f5308193c8d2ce551a7cc6cd
SHA256

30a6fdcb6cc8b3f1cbe835da4e97311d93163e376e9851e24c02bf6e87f75cd2
SHA512

b8ba10b37a29f2ba732ac86d8dc758d2295af2c8c305ce030d8d8518ace94f19547da7fcf3460b9761b34e1346a86411c047d97328d937beb01b4b23d96d15eb
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727ZvhwoONE6phFrMiBsQVWGoPN966xy5eAOkzJsfEF+:ROdWCCi7/rahFD2P6QV8NcxeLkOP24

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 29 IoCs

miner

resource	yara_rule
behavioral1/memory/2524-13-0x000000013F970000-0x000000013FCC1000-memory.dmp	xmrig
behavioral1/memory/2912-20-0x000000013F600000-0x000000013F951000-memory.dmp	xmrig
behavioral1/memory/2684-101-0x000000013F0E0000-0x000000013F431000-memory.dmp	xmrig
behavioral1/memory/2556-120-0x000000013F270000-0x000000013F5C1000-memory.dmp	xmrig
behavioral1/memory/2680-118-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	xmrig
behavioral1/memory/2264-302-0x000000013F4C0000-0x000000013F811000-memory.dmp	xmrig
behavioral1/memory/2308-1856-0x000000013FD10000-0x0000000140061000-memory.dmp	xmrig
behavioral1/memory/2644-2616-0x000000013F440000-0x000000013F791000-memory.dmp	xmrig
behavioral1/memory/2636-316-0x000000013F810000-0x000000013FB61000-memory.dmp	xmrig
behavioral1/memory/2520-298-0x000000013F170000-0x000000013F4C1000-memory.dmp	xmrig
behavioral1/memory/2464-126-0x000000013F8B0000-0x000000013FC01000-memory.dmp	xmrig
behavioral1/memory/2296-116-0x000000013FFE0000-0x0000000140331000-memory.dmp	xmrig
behavioral1/memory/2308-115-0x0000000001E10000-0x0000000002161000-memory.dmp	xmrig
behavioral1/memory/2560-114-0x000000013F8D0000-0x000000013FC21000-memory.dmp	xmrig
behavioral1/memory/2308-106-0x000000013F8D0000-0x000000013FC21000-memory.dmp	xmrig
behavioral1/memory/2292-94-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/2644-3774-0x000000013F440000-0x000000013F791000-memory.dmp	xmrig
behavioral1/memory/2912-3773-0x000000013F600000-0x000000013F951000-memory.dmp	xmrig
behavioral1/memory/2524-3776-0x000000013F970000-0x000000013FCC1000-memory.dmp	xmrig
behavioral1/memory/2292-3781-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/2684-3783-0x000000013F0E0000-0x000000013F431000-memory.dmp	xmrig
behavioral1/memory/2636-3779-0x000000013F810000-0x000000013FB61000-memory.dmp	xmrig
behavioral1/memory/2296-3786-0x000000013FFE0000-0x0000000140331000-memory.dmp	xmrig
behavioral1/memory/2560-3784-0x000000013F8D0000-0x000000013FC21000-memory.dmp	xmrig
behavioral1/memory/2680-3805-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	xmrig
behavioral1/memory/2556-3798-0x000000013F270000-0x000000013F5C1000-memory.dmp	xmrig
behavioral1/memory/2264-3854-0x000000013F4C0000-0x000000013F811000-memory.dmp	xmrig
behavioral1/memory/2520-3850-0x000000013F170000-0x000000013F4C1000-memory.dmp	xmrig
behavioral1/memory/2464-3849-0x000000013F8B0000-0x000000013FC01000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2524	mZPIfFV.exe
2912	zHFVFip.exe
2644	MWuPtyV.exe
2636	fVOsyCN.exe
2292	DcIvnDi.exe
2684	mFeFyJy.exe
2560	CYMoGgZ.exe
2296	evRvanM.exe
2680	UtgWOlS.exe
2556	NZTTTYJ.exe
2464	HFlukTS.exe
2520	RWEfDYY.exe
2264	yISNtgR.exe
2896	kBAgnyy.exe
1824	sKoheHP.exe
2432	fwQLuZz.exe
2768	yqzldtn.exe
2872	yWriEZo.exe
2748	UoTdJTK.exe
2764	NQfiOMk.exe
1984	DIjLWgd.exe
820	RnZSoxt.exe
2088	GbvDlPr.exe
2080	fZkzprK.exe
2776	RYLsuAk.exe
1820	NVRCjLm.exe
2268	OiuTViI.exe
324	eRZsvaC.exe
784	XDPFzzI.exe
1496	LEGekIh.exe
1664	hBfflXa.exe
644	LnhFMeg.exe
356	yphDtOu.exe
1624	jussHRm.exe
452	vaiGhKh.exe
2392	zQtMXYU.exe
2144	ohxDziF.exe
1364	yVBSAbs.exe
360	vaQobQi.exe
1812	IdePAwV.exe
960	fRYdIFb.exe
772	RHRJnKG.exe
2876	DWKWQKv.exe
1044	yRWEVcI.exe
1828	hZpNSBn.exe
852	UPInSGy.exe
2868	EHoHQIu.exe
2228	UWuJlFq.exe
2176	MOmUsaU.exe
2932	zAnnhDs.exe
996	VKGMRNR.exe
2804	uBECKuZ.exe
1188	VBdODQz.exe
2036	cSWizNL.exe
1096	uSQZLhh.exe
1604	mGRltjP.exe
1608	WrjjWfD.exe
1700	wGvbTPV.exe
2276	OLSeRNz.exe
2984	VGLZkBV.exe
2700	luQxLYx.exe
2716	wsFryLf.exe
2492	ZMstnnC.exe
2516	hwIyByW.exe

Loads dropped DLL 64 IoCs

pid	Process
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2308-0-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/files/0x000c0000000144e0-5.dat	upx
behavioral1/files/0x003200000001480e-9.dat	upx
behavioral1/memory/2524-13-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/files/0x0008000000014ba7-16.dat	upx
behavioral1/memory/2912-20-0x000000013F600000-0x000000013F951000-memory.dmp	upx
behavioral1/memory/2644-24-0x000000013F440000-0x000000013F791000-memory.dmp	upx
behavioral1/files/0x0007000000014dae-26.dat	upx
behavioral1/files/0x0007000000014eb9-30.dat	upx
behavioral1/files/0x00090000000153d9-44.dat	upx
behavioral1/files/0x0006000000015ce3-55.dat	upx
behavioral1/files/0x0006000000015cd9-50.dat	upx
behavioral1/files/0x00070000000153c7-41.dat	upx
behavioral1/files/0x000700000001502c-35.dat	upx
behavioral1/files/0x0006000000015d44-73.dat	upx
behavioral1/memory/2684-101-0x000000013F0E0000-0x000000013F431000-memory.dmp	upx
behavioral1/memory/2556-120-0x000000013F270000-0x000000013F5C1000-memory.dmp	upx
behavioral1/memory/2680-118-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	upx
behavioral1/files/0x0006000000016c8c-180.dat	upx
behavioral1/memory/2264-302-0x000000013F4C0000-0x000000013F811000-memory.dmp	upx
behavioral1/memory/2308-1856-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/memory/2644-2616-0x000000013F440000-0x000000013F791000-memory.dmp	upx
behavioral1/memory/2636-316-0x000000013F810000-0x000000013FB61000-memory.dmp	upx
behavioral1/memory/2520-298-0x000000013F170000-0x000000013F4C1000-memory.dmp	upx
behavioral1/files/0x0006000000016c42-175.dat	upx
behavioral1/files/0x0006000000016c3a-170.dat	upx
behavioral1/files/0x0006000000016c1d-165.dat	upx
behavioral1/files/0x0006000000016813-155.dat	upx
behavioral1/files/0x0006000000016a6f-160.dat	upx
behavioral1/files/0x00060000000165f0-150.dat	upx
behavioral1/files/0x000600000001654a-145.dat	upx
behavioral1/files/0x0006000000016476-140.dat	upx
behavioral1/files/0x00060000000162c9-136.dat	upx
behavioral1/files/0x00320000000149e1-130.dat	upx
behavioral1/memory/2464-126-0x000000013F8B0000-0x000000013FC01000-memory.dmp	upx
behavioral1/files/0x00060000000161b3-124.dat	upx
behavioral1/memory/2296-116-0x000000013FFE0000-0x0000000140331000-memory.dmp	upx
behavioral1/memory/2560-114-0x000000013F8D0000-0x000000013FC21000-memory.dmp	upx
behavioral1/files/0x0006000000015fa7-109.dat	upx
behavioral1/files/0x0006000000015e6d-107.dat	upx
behavioral1/files/0x00060000000160cc-105.dat	upx
behavioral1/files/0x0006000000015f3c-104.dat	upx
behavioral1/files/0x0006000000015d4c-100.dat	upx
behavioral1/files/0x0006000000015d24-83.dat	upx
behavioral1/files/0x0006000000015e09-78.dat	upx
behavioral1/files/0x0006000000015d0c-71.dat	upx
behavioral1/memory/2292-94-0x000000013F850000-0x000000013FBA1000-memory.dmp	upx
behavioral1/files/0x0006000000015cf5-61.dat	upx
behavioral1/memory/2644-3774-0x000000013F440000-0x000000013F791000-memory.dmp	upx
behavioral1/memory/2912-3773-0x000000013F600000-0x000000013F951000-memory.dmp	upx
behavioral1/memory/2524-3776-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/memory/2292-3781-0x000000013F850000-0x000000013FBA1000-memory.dmp	upx
behavioral1/memory/2684-3783-0x000000013F0E0000-0x000000013F431000-memory.dmp	upx
behavioral1/memory/2636-3779-0x000000013F810000-0x000000013FB61000-memory.dmp	upx
behavioral1/memory/2296-3786-0x000000013FFE0000-0x0000000140331000-memory.dmp	upx
behavioral1/memory/2560-3784-0x000000013F8D0000-0x000000013FC21000-memory.dmp	upx
behavioral1/memory/2680-3805-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	upx
behavioral1/memory/2556-3798-0x000000013F270000-0x000000013F5C1000-memory.dmp	upx
behavioral1/memory/2264-3854-0x000000013F4C0000-0x000000013F811000-memory.dmp	upx
behavioral1/memory/2520-3850-0x000000013F170000-0x000000013F4C1000-memory.dmp	upx
behavioral1/memory/2464-3849-0x000000013F8B0000-0x000000013FC01000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uIOynja.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\hEkCzGo.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\bEVaNxf.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\LICTgFX.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\BpYLmCj.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\KuTBNru.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\PiBsZLG.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\iqVNDzD.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\ngkgHaa.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\EdWwrUe.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\MxmXYSx.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\LcZsTIu.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\YBJHEeb.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\JFeoQDH.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\YqdrvOY.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\iRGmJeH.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\nLMgEZN.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\FuzrNOZ.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\FrwmsXz.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\rEpjVFM.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\AnmmZhy.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\XoaklKS.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\mhXVBhn.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\JvLEOEj.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\XlPGVtN.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\LPafSfJ.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\WzCcpxx.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\cWOkdRx.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\qxRQRLK.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\RwCbyjR.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\BVdtjyo.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\rjfHpMN.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\cUjWSaH.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\ynoFzii.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\GMXobrh.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\EVOqaIV.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\bzfupyA.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\owOZzyj.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\DwqrCxA.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\uiUjEfF.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\rcyyKQP.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\fcCQGuo.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\iCNRhzT.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\sZwuhcD.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\aKEeKwU.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\VaaPuRm.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\lOKqWYX.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\VMHoWkb.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\rIxIAEk.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\nWBVvCA.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\hqphPiJ.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\jKueRjL.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\VSlTOQn.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\HiWsJnk.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\usmdzVc.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\zzPtcHI.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\CcVkKyM.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\JkYpsBb.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\QmGoLuB.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\kqGDWFd.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\hGRQbBW.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZrvVFtN.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\DAcTDNq.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
File created	C:\Windows\System\puNETaS.exe	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2524	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	29
PID 2308 wrote to memory of 2524	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	29
PID 2308 wrote to memory of 2524	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	29
PID 2308 wrote to memory of 2912	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	30
PID 2308 wrote to memory of 2912	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	30
PID 2308 wrote to memory of 2912	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	30
PID 2308 wrote to memory of 2644	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	31
PID 2308 wrote to memory of 2644	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	31
PID 2308 wrote to memory of 2644	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	31
PID 2308 wrote to memory of 2636	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	32
PID 2308 wrote to memory of 2636	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	32
PID 2308 wrote to memory of 2636	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	32
PID 2308 wrote to memory of 2292	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	33
PID 2308 wrote to memory of 2292	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	33
PID 2308 wrote to memory of 2292	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	33
PID 2308 wrote to memory of 2684	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	34
PID 2308 wrote to memory of 2684	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	34
PID 2308 wrote to memory of 2684	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	34
PID 2308 wrote to memory of 2560	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	35
PID 2308 wrote to memory of 2560	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	35
PID 2308 wrote to memory of 2560	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	35
PID 2308 wrote to memory of 2296	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	36
PID 2308 wrote to memory of 2296	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	36
PID 2308 wrote to memory of 2296	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	36
PID 2308 wrote to memory of 2680	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	37
PID 2308 wrote to memory of 2680	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	37
PID 2308 wrote to memory of 2680	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	37
PID 2308 wrote to memory of 2556	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	38
PID 2308 wrote to memory of 2556	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	38
PID 2308 wrote to memory of 2556	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	38
PID 2308 wrote to memory of 2464	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	39
PID 2308 wrote to memory of 2464	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	39
PID 2308 wrote to memory of 2464	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	39
PID 2308 wrote to memory of 2520	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	40
PID 2308 wrote to memory of 2520	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	40
PID 2308 wrote to memory of 2520	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	40
PID 2308 wrote to memory of 2896	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	41
PID 2308 wrote to memory of 2896	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	41
PID 2308 wrote to memory of 2896	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	41
PID 2308 wrote to memory of 2264	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	42
PID 2308 wrote to memory of 2264	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	42
PID 2308 wrote to memory of 2264	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	42
PID 2308 wrote to memory of 1824	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	43
PID 2308 wrote to memory of 1824	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	43
PID 2308 wrote to memory of 1824	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	43
PID 2308 wrote to memory of 2432	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	44
PID 2308 wrote to memory of 2432	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	44
PID 2308 wrote to memory of 2432	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	44
PID 2308 wrote to memory of 2748	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	45
PID 2308 wrote to memory of 2748	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	45
PID 2308 wrote to memory of 2748	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	45
PID 2308 wrote to memory of 2768	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	46
PID 2308 wrote to memory of 2768	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	46
PID 2308 wrote to memory of 2768	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	46
PID 2308 wrote to memory of 2764	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	47
PID 2308 wrote to memory of 2764	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	47
PID 2308 wrote to memory of 2764	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	47
PID 2308 wrote to memory of 2872	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	48
PID 2308 wrote to memory of 2872	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	48
PID 2308 wrote to memory of 2872	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	48
PID 2308 wrote to memory of 1984	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	49
PID 2308 wrote to memory of 1984	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	49
PID 2308 wrote to memory of 1984	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	49
PID 2308 wrote to memory of 820	2308	bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bcc2891c393dbb77c3f3197e0c2267f0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System\mZPIfFV.exe
  C:\Windows\System\mZPIfFV.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\zHFVFip.exe
  C:\Windows\System\zHFVFip.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\MWuPtyV.exe
  C:\Windows\System\MWuPtyV.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\fVOsyCN.exe
  C:\Windows\System\fVOsyCN.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\DcIvnDi.exe
  C:\Windows\System\DcIvnDi.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\mFeFyJy.exe
  C:\Windows\System\mFeFyJy.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\CYMoGgZ.exe
  C:\Windows\System\CYMoGgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\evRvanM.exe
  C:\Windows\System\evRvanM.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\UtgWOlS.exe
  C:\Windows\System\UtgWOlS.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\NZTTTYJ.exe
  C:\Windows\System\NZTTTYJ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\HFlukTS.exe
  C:\Windows\System\HFlukTS.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\RWEfDYY.exe
  C:\Windows\System\RWEfDYY.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\kBAgnyy.exe
  C:\Windows\System\kBAgnyy.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\yISNtgR.exe
  C:\Windows\System\yISNtgR.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\sKoheHP.exe
  C:\Windows\System\sKoheHP.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\fwQLuZz.exe
  C:\Windows\System\fwQLuZz.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\UoTdJTK.exe
  C:\Windows\System\UoTdJTK.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\yqzldtn.exe
  C:\Windows\System\yqzldtn.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\NQfiOMk.exe
  C:\Windows\System\NQfiOMk.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\yWriEZo.exe
  C:\Windows\System\yWriEZo.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\DIjLWgd.exe
  C:\Windows\System\DIjLWgd.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\RnZSoxt.exe
  C:\Windows\System\RnZSoxt.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\GbvDlPr.exe
  C:\Windows\System\GbvDlPr.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\fZkzprK.exe
  C:\Windows\System\fZkzprK.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\RYLsuAk.exe
  C:\Windows\System\RYLsuAk.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\NVRCjLm.exe
  C:\Windows\System\NVRCjLm.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\OiuTViI.exe
  C:\Windows\System\OiuTViI.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\eRZsvaC.exe
  C:\Windows\System\eRZsvaC.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\XDPFzzI.exe
  C:\Windows\System\XDPFzzI.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\LEGekIh.exe
  C:\Windows\System\LEGekIh.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\hBfflXa.exe
  C:\Windows\System\hBfflXa.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\LnhFMeg.exe
  C:\Windows\System\LnhFMeg.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\yphDtOu.exe
  C:\Windows\System\yphDtOu.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\jussHRm.exe
  C:\Windows\System\jussHRm.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\vaiGhKh.exe
  C:\Windows\System\vaiGhKh.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\zQtMXYU.exe
  C:\Windows\System\zQtMXYU.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\ohxDziF.exe
  C:\Windows\System\ohxDziF.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\yVBSAbs.exe
  C:\Windows\System\yVBSAbs.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\vaQobQi.exe
  C:\Windows\System\vaQobQi.exe
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Windows\System\IdePAwV.exe
  C:\Windows\System\IdePAwV.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\fRYdIFb.exe
  C:\Windows\System\fRYdIFb.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\RHRJnKG.exe
  C:\Windows\System\RHRJnKG.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\DWKWQKv.exe
  C:\Windows\System\DWKWQKv.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\yRWEVcI.exe
  C:\Windows\System\yRWEVcI.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\hZpNSBn.exe
  C:\Windows\System\hZpNSBn.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\UPInSGy.exe
  C:\Windows\System\UPInSGy.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\EHoHQIu.exe
  C:\Windows\System\EHoHQIu.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\UWuJlFq.exe
  C:\Windows\System\UWuJlFq.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\MOmUsaU.exe
  C:\Windows\System\MOmUsaU.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\zAnnhDs.exe
  C:\Windows\System\zAnnhDs.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\VKGMRNR.exe
  C:\Windows\System\VKGMRNR.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\uBECKuZ.exe
  C:\Windows\System\uBECKuZ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\VBdODQz.exe
  C:\Windows\System\VBdODQz.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\cSWizNL.exe
  C:\Windows\System\cSWizNL.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\uSQZLhh.exe
  C:\Windows\System\uSQZLhh.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\mGRltjP.exe
  C:\Windows\System\mGRltjP.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\WrjjWfD.exe
  C:\Windows\System\WrjjWfD.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\wGvbTPV.exe
  C:\Windows\System\wGvbTPV.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\OLSeRNz.exe
  C:\Windows\System\OLSeRNz.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\VGLZkBV.exe
  C:\Windows\System\VGLZkBV.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\luQxLYx.exe
  C:\Windows\System\luQxLYx.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\wsFryLf.exe
  C:\Windows\System\wsFryLf.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\ZMstnnC.exe
  C:\Windows\System\ZMstnnC.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\hwIyByW.exe
  C:\Windows\System\hwIyByW.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\OayyyBQ.exe
  C:\Windows\System\OayyyBQ.exe
  2⤵
  PID:2760
- C:\Windows\System\mcIAueP.exe
  C:\Windows\System\mcIAueP.exe
  2⤵
  PID:2900
- C:\Windows\System\YrtWdVT.exe
  C:\Windows\System\YrtWdVT.exe
  2⤵
  PID:2668
- C:\Windows\System\iBATdDN.exe
  C:\Windows\System\iBATdDN.exe
  2⤵
  PID:2200
- C:\Windows\System\HbkrVrn.exe
  C:\Windows\System\HbkrVrn.exe
  2⤵
  PID:2216
- C:\Windows\System\mINzcSn.exe
  C:\Windows\System\mINzcSn.exe
  2⤵
  PID:1976
- C:\Windows\System\GNyPVxt.exe
  C:\Windows\System\GNyPVxt.exe
  2⤵
  PID:2092
- C:\Windows\System\ffaWZBB.exe
  C:\Windows\System\ffaWZBB.exe
  2⤵
  PID:2116
- C:\Windows\System\CQNihUr.exe
  C:\Windows\System\CQNihUr.exe
  2⤵
  PID:2284
- C:\Windows\System\rFHqYzZ.exe
  C:\Windows\System\rFHqYzZ.exe
  2⤵
  PID:2704
- C:\Windows\System\NZdOUrk.exe
  C:\Windows\System\NZdOUrk.exe
  2⤵
  PID:336
- C:\Windows\System\ixUdwtN.exe
  C:\Windows\System\ixUdwtN.exe
  2⤵
  PID:2376
- C:\Windows\System\NTIQxJZ.exe
  C:\Windows\System\NTIQxJZ.exe
  2⤵
  PID:1660
- C:\Windows\System\zYmPCaL.exe
  C:\Windows\System\zYmPCaL.exe
  2⤵
  PID:2412
- C:\Windows\System\XnFcPUa.exe
  C:\Windows\System\XnFcPUa.exe
  2⤵
  PID:2468
- C:\Windows\System\RyjJSJe.exe
  C:\Windows\System\RyjJSJe.exe
  2⤵
  PID:1092
- C:\Windows\System\FvGxPSN.exe
  C:\Windows\System\FvGxPSN.exe
  2⤵
  PID:2152
- C:\Windows\System\AKaXTpk.exe
  C:\Windows\System\AKaXTpk.exe
  2⤵
  PID:1016
- C:\Windows\System\ipRtipa.exe
  C:\Windows\System\ipRtipa.exe
  2⤵
  PID:1360
- C:\Windows\System\wCndkHR.exe
  C:\Windows\System\wCndkHR.exe
  2⤵
  PID:1028
- C:\Windows\System\pJJspjf.exe
  C:\Windows\System\pJJspjf.exe
  2⤵
  PID:1572
- C:\Windows\System\hIUJiNx.exe
  C:\Windows\System\hIUJiNx.exe
  2⤵
  PID:2604
- C:\Windows\System\bLGJUJz.exe
  C:\Windows\System\bLGJUJz.exe
  2⤵
  PID:1836
- C:\Windows\System\cxMgRFF.exe
  C:\Windows\System\cxMgRFF.exe
  2⤵
  PID:2156
- C:\Windows\System\pqeykrN.exe
  C:\Windows\System\pqeykrN.exe
  2⤵
  PID:2824
- C:\Windows\System\LlWlTGM.exe
  C:\Windows\System\LlWlTGM.exe
  2⤵
  PID:1612
- C:\Windows\System\kKjPrKV.exe
  C:\Windows\System\kKjPrKV.exe
  2⤵
  PID:616
- C:\Windows\System\lfbVEbs.exe
  C:\Windows\System\lfbVEbs.exe
  2⤵
  PID:2312
- C:\Windows\System\wEuXqJO.exe
  C:\Windows\System\wEuXqJO.exe
  2⤵
  PID:2400
- C:\Windows\System\hzwzFOD.exe
  C:\Windows\System\hzwzFOD.exe
  2⤵
  PID:2340
- C:\Windows\System\wxtkcEB.exe
  C:\Windows\System\wxtkcEB.exe
  2⤵
  PID:1760
- C:\Windows\System\zvrwJcs.exe
  C:\Windows\System\zvrwJcs.exe
  2⤵
  PID:1600
- C:\Windows\System\KcXeFOd.exe
  C:\Windows\System\KcXeFOd.exe
  2⤵
  PID:2168
- C:\Windows\System\KobedCG.exe
  C:\Windows\System\KobedCG.exe
  2⤵
  PID:2004
- C:\Windows\System\WaTjOSl.exe
  C:\Windows\System\WaTjOSl.exe
  2⤵
  PID:2812
- C:\Windows\System\lCXgpJV.exe
  C:\Windows\System\lCXgpJV.exe
  2⤵
  PID:2548
- C:\Windows\System\OWsbkRF.exe
  C:\Windows\System\OWsbkRF.exe
  2⤵
  PID:2496
- C:\Windows\System\xfIhrnd.exe
  C:\Windows\System\xfIhrnd.exe
  2⤵
  PID:1596
- C:\Windows\System\zQKOoXV.exe
  C:\Windows\System\zQKOoXV.exe
  2⤵
  PID:2736
- C:\Windows\System\qubREPY.exe
  C:\Windows\System\qubREPY.exe
  2⤵
  PID:312
- C:\Windows\System\SsfQVqm.exe
  C:\Windows\System\SsfQVqm.exe
  2⤵
  PID:2888
- C:\Windows\System\JhJJrjd.exe
  C:\Windows\System\JhJJrjd.exe
  2⤵
  PID:2588
- C:\Windows\System\jgWaDZV.exe
  C:\Windows\System\jgWaDZV.exe
  2⤵
  PID:2244
- C:\Windows\System\kZgmUDU.exe
  C:\Windows\System\kZgmUDU.exe
  2⤵
  PID:2832
- C:\Windows\System\TqtTggA.exe
  C:\Windows\System\TqtTggA.exe
  2⤵
  PID:1488
- C:\Windows\System\ODtgtKi.exe
  C:\Windows\System\ODtgtKi.exe
  2⤵
  PID:2572
- C:\Windows\System\bLtXlVa.exe
  C:\Windows\System\bLtXlVa.exe
  2⤵
  PID:2204
- C:\Windows\System\NysvJIF.exe
  C:\Windows\System\NysvJIF.exe
  2⤵
  PID:1356
- C:\Windows\System\wLdoDpD.exe
  C:\Windows\System\wLdoDpD.exe
  2⤵
  PID:3064
- C:\Windows\System\tcKnYzy.exe
  C:\Windows\System\tcKnYzy.exe
  2⤵
  PID:1640
- C:\Windows\System\KnYixGB.exe
  C:\Windows\System\KnYixGB.exe
  2⤵
  PID:1048
- C:\Windows\System\PLZCKgi.exe
  C:\Windows\System\PLZCKgi.exe
  2⤵
  PID:3040
- C:\Windows\System\YcZHlNE.exe
  C:\Windows\System\YcZHlNE.exe
  2⤵
  PID:2692
- C:\Windows\System\IaVHlNX.exe
  C:\Windows\System\IaVHlNX.exe
  2⤵
  PID:3016
- C:\Windows\System\gPsvkoc.exe
  C:\Windows\System\gPsvkoc.exe
  2⤵
  PID:2864
- C:\Windows\System\juJwKxU.exe
  C:\Windows\System\juJwKxU.exe
  2⤵
  PID:2944
- C:\Windows\System\fBwpPvb.exe
  C:\Windows\System\fBwpPvb.exe
  2⤵
  PID:1584
- C:\Windows\System\skPyulz.exe
  C:\Windows\System\skPyulz.exe
  2⤵
  PID:3060
- C:\Windows\System\mIOavXs.exe
  C:\Windows\System\mIOavXs.exe
  2⤵
  PID:2360
- C:\Windows\System\xdLZskR.exe
  C:\Windows\System\xdLZskR.exe
  2⤵
  PID:2032
- C:\Windows\System\CaMtvHJ.exe
  C:\Windows\System\CaMtvHJ.exe
  2⤵
  PID:2664
- C:\Windows\System\UIhXBmL.exe
  C:\Windows\System\UIhXBmL.exe
  2⤵
  PID:2660
- C:\Windows\System\fmKTbHB.exe
  C:\Windows\System\fmKTbHB.exe
  2⤵
  PID:3024
- C:\Windows\System\XjMOFQG.exe
  C:\Windows\System\XjMOFQG.exe
  2⤵
  PID:1720
- C:\Windows\System\dYwCupd.exe
  C:\Windows\System\dYwCupd.exe
  2⤵
  PID:2184
- C:\Windows\System\AlZdUsO.exe
  C:\Windows\System\AlZdUsO.exe
  2⤵
  PID:2800
- C:\Windows\System\TfeObmw.exe
  C:\Windows\System\TfeObmw.exe
  2⤵
  PID:1396
- C:\Windows\System\QRBdkES.exe
  C:\Windows\System\QRBdkES.exe
  2⤵
  PID:2460
- C:\Windows\System\jepvaYi.exe
  C:\Windows\System\jepvaYi.exe
  2⤵
  PID:2796
- C:\Windows\System\wAmHfqO.exe
  C:\Windows\System\wAmHfqO.exe
  2⤵
  PID:2884
- C:\Windows\System\nMGJZKm.exe
  C:\Windows\System\nMGJZKm.exe
  2⤵
  PID:2600
- C:\Windows\System\BEoKFFm.exe
  C:\Windows\System\BEoKFFm.exe
  2⤵
  PID:1532
- C:\Windows\System\PsBrMGs.exe
  C:\Windows\System\PsBrMGs.exe
  2⤵
  PID:2724
- C:\Windows\System\JIROjjv.exe
  C:\Windows\System\JIROjjv.exe
  2⤵
  PID:2632
- C:\Windows\System\jAHLaga.exe
  C:\Windows\System\jAHLaga.exe
  2⤵
  PID:2928
- C:\Windows\System\RlPOmlr.exe
  C:\Windows\System\RlPOmlr.exe
  2⤵
  PID:2072
- C:\Windows\System\LkhgcKQ.exe
  C:\Windows\System\LkhgcKQ.exe
  2⤵
  PID:1672
- C:\Windows\System\dlRnXYR.exe
  C:\Windows\System\dlRnXYR.exe
  2⤵
  PID:1764
- C:\Windows\System\UiOtHqj.exe
  C:\Windows\System\UiOtHqj.exe
  2⤵
  PID:2648
- C:\Windows\System\vJsgZvV.exe
  C:\Windows\System\vJsgZvV.exe
  2⤵
  PID:956
- C:\Windows\System\xLhnKhQ.exe
  C:\Windows\System\xLhnKhQ.exe
  2⤵
  PID:2576
- C:\Windows\System\yOeSvSY.exe
  C:\Windows\System\yOeSvSY.exe
  2⤵
  PID:1104
- C:\Windows\System\ChnxDsj.exe
  C:\Windows\System\ChnxDsj.exe
  2⤵
  PID:320
- C:\Windows\System\krUWEkQ.exe
  C:\Windows\System\krUWEkQ.exe
  2⤵
  PID:1308
- C:\Windows\System\DJEBqHX.exe
  C:\Windows\System\DJEBqHX.exe
  2⤵
  PID:992
- C:\Windows\System\THDXglO.exe
  C:\Windows\System\THDXglO.exe
  2⤵
  PID:332
- C:\Windows\System\yGQiXeo.exe
  C:\Windows\System\yGQiXeo.exe
  2⤵
  PID:2236
- C:\Windows\System\skVmzUb.exe
  C:\Windows\System\skVmzUb.exe
  2⤵
  PID:2616
- C:\Windows\System\nBEfDhz.exe
  C:\Windows\System\nBEfDhz.exe
  2⤵
  PID:2940
- C:\Windows\System\dAcEoKy.exe
  C:\Windows\System\dAcEoKy.exe
  2⤵
  PID:1768
- C:\Windows\System\OFtrQwx.exe
  C:\Windows\System\OFtrQwx.exe
  2⤵
  PID:1164
- C:\Windows\System\BCbYaUC.exe
  C:\Windows\System\BCbYaUC.exe
  2⤵
  PID:2260
- C:\Windows\System\EUOKCdu.exe
  C:\Windows\System\EUOKCdu.exe
  2⤵
  PID:2820
- C:\Windows\System\dgsWWgp.exe
  C:\Windows\System\dgsWWgp.exe
  2⤵
  PID:2332
- C:\Windows\System\WGKHLck.exe
  C:\Windows\System\WGKHLck.exe
  2⤵
  PID:2324
- C:\Windows\System\gLOERkH.exe
  C:\Windows\System\gLOERkH.exe
  2⤵
  PID:2528
- C:\Windows\System\gJVPACm.exe
  C:\Windows\System\gJVPACm.exe
  2⤵
  PID:2612
- C:\Windows\System\NQwYhQy.exe
  C:\Windows\System\NQwYhQy.exe
  2⤵
  PID:2960
- C:\Windows\System\uJwdBwU.exe
  C:\Windows\System\uJwdBwU.exe
  2⤵
  PID:2272
- C:\Windows\System\qanbouK.exe
  C:\Windows\System\qanbouK.exe
  2⤵
  PID:2732
- C:\Windows\System\AzzTnZU.exe
  C:\Windows\System\AzzTnZU.exe
  2⤵
  PID:1480
- C:\Windows\System\avNKeQc.exe
  C:\Windows\System\avNKeQc.exe
  2⤵
  PID:2720
- C:\Windows\System\JAkEGCt.exe
  C:\Windows\System\JAkEGCt.exe
  2⤵
  PID:1052
- C:\Windows\System\IKiLyLq.exe
  C:\Windows\System\IKiLyLq.exe
  2⤵
  PID:1956
- C:\Windows\System\gREpmya.exe
  C:\Windows\System\gREpmya.exe
  2⤵
  PID:2536
- C:\Windows\System\pKdadyj.exe
  C:\Windows\System\pKdadyj.exe
  2⤵
  PID:2320
- C:\Windows\System\MtGwcgi.exe
  C:\Windows\System\MtGwcgi.exe
  2⤵
  PID:2508
- C:\Windows\System\MWUpIVo.exe
  C:\Windows\System\MWUpIVo.exe
  2⤵
  PID:2408
- C:\Windows\System\NXKesSZ.exe
  C:\Windows\System\NXKesSZ.exe
  2⤵
  PID:916
- C:\Windows\System\lCdkMlT.exe
  C:\Windows\System\lCdkMlT.exe
  2⤵
  PID:3088
- C:\Windows\System\nhtyBWk.exe
  C:\Windows\System\nhtyBWk.exe
  2⤵
  PID:3104
- C:\Windows\System\lywnStH.exe
  C:\Windows\System\lywnStH.exe
  2⤵
  PID:3124
- C:\Windows\System\jrvQpsv.exe
  C:\Windows\System\jrvQpsv.exe
  2⤵
  PID:3140
- C:\Windows\System\DMSglhg.exe
  C:\Windows\System\DMSglhg.exe
  2⤵
  PID:3160
- C:\Windows\System\vsGAzZL.exe
  C:\Windows\System\vsGAzZL.exe
  2⤵
  PID:3176
- C:\Windows\System\GjYYatB.exe
  C:\Windows\System\GjYYatB.exe
  2⤵
  PID:3192
- C:\Windows\System\BaHBBAk.exe
  C:\Windows\System\BaHBBAk.exe
  2⤵
  PID:3208
- C:\Windows\System\tEHmjcl.exe
  C:\Windows\System\tEHmjcl.exe
  2⤵
  PID:3224
- C:\Windows\System\gqAWFnw.exe
  C:\Windows\System\gqAWFnw.exe
  2⤵
  PID:3240
- C:\Windows\System\sZPIxtT.exe
  C:\Windows\System\sZPIxtT.exe
  2⤵
  PID:3256
- C:\Windows\System\GaTMwzP.exe
  C:\Windows\System\GaTMwzP.exe
  2⤵
  PID:3272
- C:\Windows\System\wlDCzVE.exe
  C:\Windows\System\wlDCzVE.exe
  2⤵
  PID:3288
- C:\Windows\System\CpfWezs.exe
  C:\Windows\System\CpfWezs.exe
  2⤵
  PID:3308
- C:\Windows\System\medYgia.exe
  C:\Windows\System\medYgia.exe
  2⤵
  PID:3324
- C:\Windows\System\DuoylQj.exe
  C:\Windows\System\DuoylQj.exe
  2⤵
  PID:3344
- C:\Windows\System\ldrukKl.exe
  C:\Windows\System\ldrukKl.exe
  2⤵
  PID:3360
- C:\Windows\System\MKnTeHS.exe
  C:\Windows\System\MKnTeHS.exe
  2⤵
  PID:3376
- C:\Windows\System\hZCXjvh.exe
  C:\Windows\System\hZCXjvh.exe
  2⤵
  PID:3404
- C:\Windows\System\aPVptdS.exe
  C:\Windows\System\aPVptdS.exe
  2⤵
  PID:3420
- C:\Windows\System\LeOlFLb.exe
  C:\Windows\System\LeOlFLb.exe
  2⤵
  PID:3436
- C:\Windows\System\jWpiThE.exe
  C:\Windows\System\jWpiThE.exe
  2⤵
  PID:3496
- C:\Windows\System\wYihnVc.exe
  C:\Windows\System\wYihnVc.exe
  2⤵
  PID:3512
- C:\Windows\System\TcXPUbJ.exe
  C:\Windows\System\TcXPUbJ.exe
  2⤵
  PID:3528
- C:\Windows\System\zaDyTLZ.exe
  C:\Windows\System\zaDyTLZ.exe
  2⤵
  PID:3544
- C:\Windows\System\iMpCETI.exe
  C:\Windows\System\iMpCETI.exe
  2⤵
  PID:3560
- C:\Windows\System\jsTeYad.exe
  C:\Windows\System\jsTeYad.exe
  2⤵
  PID:3576
- C:\Windows\System\KxZwTsn.exe
  C:\Windows\System\KxZwTsn.exe
  2⤵
  PID:3592
- C:\Windows\System\XvALhtt.exe
  C:\Windows\System\XvALhtt.exe
  2⤵
  PID:3612
- C:\Windows\System\tPqkWiu.exe
  C:\Windows\System\tPqkWiu.exe
  2⤵
  PID:3628
- C:\Windows\System\WjRVAdi.exe
  C:\Windows\System\WjRVAdi.exe
  2⤵
  PID:3644
- C:\Windows\System\VRjdBsa.exe
  C:\Windows\System\VRjdBsa.exe
  2⤵
  PID:3664
- C:\Windows\System\yUjDxhx.exe
  C:\Windows\System\yUjDxhx.exe
  2⤵
  PID:3724
- C:\Windows\System\HSVRDfR.exe
  C:\Windows\System\HSVRDfR.exe
  2⤵
  PID:3740
- C:\Windows\System\eiSMBqW.exe
  C:\Windows\System\eiSMBqW.exe
  2⤵
  PID:3756
- C:\Windows\System\KiDXtLd.exe
  C:\Windows\System\KiDXtLd.exe
  2⤵
  PID:3772
- C:\Windows\System\UxuhtNT.exe
  C:\Windows\System\UxuhtNT.exe
  2⤵
  PID:3792
- C:\Windows\System\nailecX.exe
  C:\Windows\System\nailecX.exe
  2⤵
  PID:3808
- C:\Windows\System\GGrqYyL.exe
  C:\Windows\System\GGrqYyL.exe
  2⤵
  PID:3824
- C:\Windows\System\FhNjNkX.exe
  C:\Windows\System\FhNjNkX.exe
  2⤵
  PID:3852
- C:\Windows\System\MkpbaYl.exe
  C:\Windows\System\MkpbaYl.exe
  2⤵
  PID:3872
- C:\Windows\System\WFRVmqf.exe
  C:\Windows\System\WFRVmqf.exe
  2⤵
  PID:3892
- C:\Windows\System\VrAQghY.exe
  C:\Windows\System\VrAQghY.exe
  2⤵
  PID:3908
- C:\Windows\System\MzluOnC.exe
  C:\Windows\System\MzluOnC.exe
  2⤵
  PID:3924
- C:\Windows\System\wqIYMhv.exe
  C:\Windows\System\wqIYMhv.exe
  2⤵
  PID:3940
- C:\Windows\System\NsMIiDY.exe
  C:\Windows\System\NsMIiDY.exe
  2⤵
  PID:3960
- C:\Windows\System\MXbCssp.exe
  C:\Windows\System\MXbCssp.exe
  2⤵
  PID:3976
- C:\Windows\System\JAnJNLe.exe
  C:\Windows\System\JAnJNLe.exe
  2⤵
  PID:3992
- C:\Windows\System\nLMgEZN.exe
  C:\Windows\System\nLMgEZN.exe
  2⤵
  PID:4012
- C:\Windows\System\yQnYPop.exe
  C:\Windows\System\yQnYPop.exe
  2⤵
  PID:4028
- C:\Windows\System\gHDtqmu.exe
  C:\Windows\System\gHDtqmu.exe
  2⤵
  PID:4044
- C:\Windows\System\sXxsQSo.exe
  C:\Windows\System\sXxsQSo.exe
  2⤵
  PID:4064
- C:\Windows\System\YhLkaIp.exe
  C:\Windows\System\YhLkaIp.exe
  2⤵
  PID:4084
- C:\Windows\System\ednIiQi.exe
  C:\Windows\System\ednIiQi.exe
  2⤵
  PID:2424
- C:\Windows\System\RnvcMKp.exe
  C:\Windows\System\RnvcMKp.exe
  2⤵
  PID:3100
- C:\Windows\System\GbzsFPO.exe
  C:\Windows\System\GbzsFPO.exe
  2⤵
  PID:3132
- C:\Windows\System\YwtKFXo.exe
  C:\Windows\System\YwtKFXo.exe
  2⤵
  PID:3200
- C:\Windows\System\OVBHrha.exe
  C:\Windows\System\OVBHrha.exe
  2⤵
  PID:3296
- C:\Windows\System\aCBhhBX.exe
  C:\Windows\System\aCBhhBX.exe
  2⤵
  PID:3336
- C:\Windows\System\Eshtjpv.exe
  C:\Windows\System\Eshtjpv.exe
  2⤵
  PID:3216
- C:\Windows\System\ZKeriTh.exe
  C:\Windows\System\ZKeriTh.exe
  2⤵
  PID:3396
- C:\Windows\System\gCMljCC.exe
  C:\Windows\System\gCMljCC.exe
  2⤵
  PID:3444
- C:\Windows\System\zAAIobu.exe
  C:\Windows\System\zAAIobu.exe
  2⤵
  PID:3460
- C:\Windows\System\PUVdnhc.exe
  C:\Windows\System\PUVdnhc.exe
  2⤵
  PID:3472
- C:\Windows\System\PGxLAwV.exe
  C:\Windows\System\PGxLAwV.exe
  2⤵
  PID:3508
- C:\Windows\System\pwcrife.exe
  C:\Windows\System\pwcrife.exe
  2⤵
  PID:3520
- C:\Windows\System\GqoPmTg.exe
  C:\Windows\System\GqoPmTg.exe
  2⤵
  PID:3584
- C:\Windows\System\zARFkHg.exe
  C:\Windows\System\zARFkHg.exe
  2⤵
  PID:3652
- C:\Windows\System\hzPVsNo.exe
  C:\Windows\System\hzPVsNo.exe
  2⤵
  PID:2000
- C:\Windows\System\TUSGIKR.exe
  C:\Windows\System\TUSGIKR.exe
  2⤵
  PID:3768
- C:\Windows\System\fAHGiSN.exe
  C:\Windows\System\fAHGiSN.exe
  2⤵
  PID:3840
- C:\Windows\System\BQiXnwT.exe
  C:\Windows\System\BQiXnwT.exe
  2⤵
  PID:3704
- C:\Windows\System\MjAHiHA.exe
  C:\Windows\System\MjAHiHA.exe
  2⤵
  PID:3572
- C:\Windows\System\SjDxzxF.exe
  C:\Windows\System\SjDxzxF.exe
  2⤵
  PID:3636
- C:\Windows\System\pQaNfPm.exe
  C:\Windows\System\pQaNfPm.exe
  2⤵
  PID:3716
- C:\Windows\System\YcubJzp.exe
  C:\Windows\System\YcubJzp.exe
  2⤵
  PID:3672
- C:\Windows\System\MdVOZah.exe
  C:\Windows\System\MdVOZah.exe
  2⤵
  PID:3948
- C:\Windows\System\HypXIpr.exe
  C:\Windows\System\HypXIpr.exe
  2⤵
  PID:4020
- C:\Windows\System\OMOlbUI.exe
  C:\Windows\System\OMOlbUI.exe
  2⤵
  PID:4056
- C:\Windows\System\QCqTFqg.exe
  C:\Windows\System\QCqTFqg.exe
  2⤵
  PID:3784
- C:\Windows\System\QtQnExL.exe
  C:\Windows\System\QtQnExL.exe
  2⤵
  PID:4092
- C:\Windows\System\DAKuerT.exe
  C:\Windows\System\DAKuerT.exe
  2⤵
  PID:3712
- C:\Windows\System\MmFkYPn.exe
  C:\Windows\System\MmFkYPn.exe
  2⤵
  PID:3900
- C:\Windows\System\FJxLxkN.exe
  C:\Windows\System\FJxLxkN.exe
  2⤵
  PID:4000
- C:\Windows\System\iqhboUX.exe
  C:\Windows\System\iqhboUX.exe
  2⤵
  PID:4072
- C:\Windows\System\vxQHZJc.exe
  C:\Windows\System\vxQHZJc.exe
  2⤵
  PID:3096
- C:\Windows\System\xAloCxI.exe
  C:\Windows\System\xAloCxI.exe
  2⤵
  PID:3252
- C:\Windows\System\HKWVZQz.exe
  C:\Windows\System\HKWVZQz.exe
  2⤵
  PID:3320
- C:\Windows\System\hizLOyl.exe
  C:\Windows\System\hizLOyl.exe
  2⤵
  PID:3932
- C:\Windows\System\EmsVnns.exe
  C:\Windows\System\EmsVnns.exe
  2⤵
  PID:3264
- C:\Windows\System\sYgrJNs.exe
  C:\Windows\System\sYgrJNs.exe
  2⤵
  PID:3152
- C:\Windows\System\LtPvGar.exe
  C:\Windows\System\LtPvGar.exe
  2⤵
  PID:3428
- C:\Windows\System\GFwEMQW.exe
  C:\Windows\System\GFwEMQW.exe
  2⤵
  PID:3488
- C:\Windows\System\wGKmIPK.exe
  C:\Windows\System\wGKmIPK.exe
  2⤵
  PID:3624
- C:\Windows\System\qiCjClu.exe
  C:\Windows\System\qiCjClu.exe
  2⤵
  PID:3696
- C:\Windows\System\bltvRAn.exe
  C:\Windows\System\bltvRAn.exe
  2⤵
  PID:4100
- C:\Windows\System\ZlwhuKV.exe
  C:\Windows\System\ZlwhuKV.exe
  2⤵
  PID:4120
- C:\Windows\System\dQAkwPf.exe
  C:\Windows\System\dQAkwPf.exe
  2⤵
  PID:4208
- C:\Windows\System\dwZMgLf.exe
  C:\Windows\System\dwZMgLf.exe
  2⤵
  PID:4224
- C:\Windows\System\ypAGvaj.exe
  C:\Windows\System\ypAGvaj.exe
  2⤵
  PID:4240
- C:\Windows\System\mZgkuVp.exe
  C:\Windows\System\mZgkuVp.exe
  2⤵
  PID:4256
- C:\Windows\System\AWviEhK.exe
  C:\Windows\System\AWviEhK.exe
  2⤵
  PID:4272
- C:\Windows\System\quFscDg.exe
  C:\Windows\System\quFscDg.exe
  2⤵
  PID:4288
- C:\Windows\System\ztONCoJ.exe
  C:\Windows\System\ztONCoJ.exe
  2⤵
  PID:4308
- C:\Windows\System\qaRmtiE.exe
  C:\Windows\System\qaRmtiE.exe
  2⤵
  PID:4324
- C:\Windows\System\lrJqiDj.exe
  C:\Windows\System\lrJqiDj.exe
  2⤵
  PID:4340
- C:\Windows\System\mmbvufl.exe
  C:\Windows\System\mmbvufl.exe
  2⤵
  PID:4368
- C:\Windows\System\yBRklQe.exe
  C:\Windows\System\yBRklQe.exe
  2⤵
  PID:4384
- C:\Windows\System\aNMYGIm.exe
  C:\Windows\System\aNMYGIm.exe
  2⤵
  PID:4404
- C:\Windows\System\AToNnHn.exe
  C:\Windows\System\AToNnHn.exe
  2⤵
  PID:4420
- C:\Windows\System\FyKmCvO.exe
  C:\Windows\System\FyKmCvO.exe
  2⤵
  PID:4440
- C:\Windows\System\eDBpGuF.exe
  C:\Windows\System\eDBpGuF.exe
  2⤵
  PID:4456
- C:\Windows\System\srbtZmq.exe
  C:\Windows\System\srbtZmq.exe
  2⤵
  PID:4472
- C:\Windows\System\gBGBjUA.exe
  C:\Windows\System\gBGBjUA.exe
  2⤵
  PID:4492
- C:\Windows\System\pGIWphD.exe
  C:\Windows\System\pGIWphD.exe
  2⤵
  PID:4512
- C:\Windows\System\OEdPgZD.exe
  C:\Windows\System\OEdPgZD.exe
  2⤵
  PID:4528
- C:\Windows\System\TBmoeia.exe
  C:\Windows\System\TBmoeia.exe
  2⤵
  PID:4544
- C:\Windows\System\msnHdhn.exe
  C:\Windows\System\msnHdhn.exe
  2⤵
  PID:4560
- C:\Windows\System\GyrEnGB.exe
  C:\Windows\System\GyrEnGB.exe
  2⤵
  PID:4576
- C:\Windows\System\hexqMvs.exe
  C:\Windows\System\hexqMvs.exe
  2⤵
  PID:4592
- C:\Windows\System\pmVlhrt.exe
  C:\Windows\System\pmVlhrt.exe
  2⤵
  PID:4608
- C:\Windows\System\EktWgHo.exe
  C:\Windows\System\EktWgHo.exe
  2⤵
  PID:4624
- C:\Windows\System\jWSMjFr.exe
  C:\Windows\System\jWSMjFr.exe
  2⤵
  PID:4644
- C:\Windows\System\SchvsRK.exe
  C:\Windows\System\SchvsRK.exe
  2⤵
  PID:4660
- C:\Windows\System\CLFUUdp.exe
  C:\Windows\System\CLFUUdp.exe
  2⤵
  PID:4684
- C:\Windows\System\xXCsURJ.exe
  C:\Windows\System\xXCsURJ.exe
  2⤵
  PID:4700
- C:\Windows\System\TtrhwcZ.exe
  C:\Windows\System\TtrhwcZ.exe
  2⤵
  PID:4720
- C:\Windows\System\JkYpsBb.exe
  C:\Windows\System\JkYpsBb.exe
  2⤵
  PID:4736
- C:\Windows\System\TnIUEnd.exe
  C:\Windows\System\TnIUEnd.exe
  2⤵
  PID:4756
- C:\Windows\System\SguPiHR.exe
  C:\Windows\System\SguPiHR.exe
  2⤵
  PID:4772
- C:\Windows\System\XJKLwGk.exe
  C:\Windows\System\XJKLwGk.exe
  2⤵
  PID:4788
- C:\Windows\System\iutSjxK.exe
  C:\Windows\System\iutSjxK.exe
  2⤵
  PID:4804
- C:\Windows\System\HqCbKGc.exe
  C:\Windows\System\HqCbKGc.exe
  2⤵
  PID:4820
- C:\Windows\System\YEDaPVq.exe
  C:\Windows\System\YEDaPVq.exe
  2⤵
  PID:4836
- C:\Windows\System\nYVJqje.exe
  C:\Windows\System\nYVJqje.exe
  2⤵
  PID:4860
- C:\Windows\System\pZNabuN.exe
  C:\Windows\System\pZNabuN.exe
  2⤵
  PID:4884
- C:\Windows\System\WUcIgBJ.exe
  C:\Windows\System\WUcIgBJ.exe
  2⤵
  PID:4900
- C:\Windows\System\qZJiMXA.exe
  C:\Windows\System\qZJiMXA.exe
  2⤵
  PID:4916
- C:\Windows\System\SmCGCSs.exe
  C:\Windows\System\SmCGCSs.exe
  2⤵
  PID:4932
- C:\Windows\System\sXYYGmE.exe
  C:\Windows\System\sXYYGmE.exe
  2⤵
  PID:5012
- C:\Windows\System\tFsnmdo.exe
  C:\Windows\System\tFsnmdo.exe
  2⤵
  PID:3888
- C:\Windows\System\HXTRHZh.exe
  C:\Windows\System\HXTRHZh.exe
  2⤵
  PID:3956
- C:\Windows\System\YfLlXOD.exe
  C:\Windows\System\YfLlXOD.exe
  2⤵
  PID:3780
- C:\Windows\System\BVdtjyo.exe
  C:\Windows\System\BVdtjyo.exe
  2⤵
  PID:3112
- C:\Windows\System\OWVDQvb.exe
  C:\Windows\System\OWVDQvb.exe
  2⤵
  PID:3972
- C:\Windows\System\AjxctqG.exe
  C:\Windows\System\AjxctqG.exe
  2⤵
  PID:3412
- C:\Windows\System\bXlhehA.exe
  C:\Windows\System\bXlhehA.exe
  2⤵
  PID:3620
- C:\Windows\System\OohXJPQ.exe
  C:\Windows\System\OohXJPQ.exe
  2⤵
  PID:4132
- C:\Windows\System\iCNRhzT.exe
  C:\Windows\System\iCNRhzT.exe
  2⤵
  PID:4156
- C:\Windows\System\TckMxnT.exe
  C:\Windows\System\TckMxnT.exe
  2⤵
  PID:4052
- C:\Windows\System\pNMFZgs.exe
  C:\Windows\System\pNMFZgs.exe
  2⤵
  PID:3660
- C:\Windows\System\LzOXjHc.exe
  C:\Windows\System\LzOXjHc.exe
  2⤵
  PID:3820
- C:\Windows\System\hAGzBuf.exe
  C:\Windows\System\hAGzBuf.exe
  2⤵
  PID:4040
- C:\Windows\System\vmxODbQ.exe
  C:\Windows\System\vmxODbQ.exe
  2⤵
  PID:3968
- C:\Windows\System\Xjtdkih.exe
  C:\Windows\System\Xjtdkih.exe
  2⤵
  PID:2100
- C:\Windows\System\yadZZno.exe
  C:\Windows\System\yadZZno.exe
  2⤵
  PID:4108
- C:\Windows\System\EHpulJO.exe
  C:\Windows\System\EHpulJO.exe
  2⤵
  PID:4116
- C:\Windows\System\LhQRINZ.exe
  C:\Windows\System\LhQRINZ.exe
  2⤵
  PID:3552
- C:\Windows\System\LjiLURc.exe
  C:\Windows\System\LjiLURc.exe
  2⤵
  PID:4204
- C:\Windows\System\NxCVvNA.exe
  C:\Windows\System\NxCVvNA.exe
  2⤵
  PID:4300
- C:\Windows\System\qsEVoPn.exe
  C:\Windows\System\qsEVoPn.exe
  2⤵
  PID:4452
- C:\Windows\System\BIqJtrH.exe
  C:\Windows\System\BIqJtrH.exe
  2⤵
  PID:4520
- C:\Windows\System\gJaNltv.exe
  C:\Windows\System\gJaNltv.exe
  2⤵
  PID:4216
- C:\Windows\System\TjQIKUK.exe
  C:\Windows\System\TjQIKUK.exe
  2⤵
  PID:4248
- C:\Windows\System\YXLRkbi.exe
  C:\Windows\System\YXLRkbi.exe
  2⤵
  PID:4348
- C:\Windows\System\ttsYUJx.exe
  C:\Windows\System\ttsYUJx.exe
  2⤵
  PID:4392
- C:\Windows\System\RkLlUTB.exe
  C:\Windows\System\RkLlUTB.exe
  2⤵
  PID:4620
- C:\Windows\System\qpUgpYT.exe
  C:\Windows\System\qpUgpYT.exe
  2⤵
  PID:4464
- C:\Windows\System\POZIHId.exe
  C:\Windows\System\POZIHId.exe
  2⤵
  PID:4540
- C:\Windows\System\neZThGQ.exe
  C:\Windows\System\neZThGQ.exe
  2⤵
  PID:4632
- C:\Windows\System\vcIHTjU.exe
  C:\Windows\System\vcIHTjU.exe
  2⤵
  PID:824
- C:\Windows\System\zqxwclf.exe
  C:\Windows\System\zqxwclf.exe
  2⤵
  PID:4692
- C:\Windows\System\tjBFiad.exe
  C:\Windows\System\tjBFiad.exe
  2⤵
  PID:4768
- C:\Windows\System\aNuzJqx.exe
  C:\Windows\System\aNuzJqx.exe
  2⤵
  PID:4832
- C:\Windows\System\szcRQjP.exe
  C:\Windows\System\szcRQjP.exe
  2⤵
  PID:4844
- C:\Windows\System\cKVFSPz.exe
  C:\Windows\System\cKVFSPz.exe
  2⤵
  PID:4816
- C:\Windows\System\KlZkjaZ.exe
  C:\Windows\System\KlZkjaZ.exe
  2⤵
  PID:4752
- C:\Windows\System\IbMzGzX.exe
  C:\Windows\System\IbMzGzX.exe
  2⤵
  PID:4852
- C:\Windows\System\SNaIruo.exe
  C:\Windows\System\SNaIruo.exe
  2⤵
  PID:4924
- C:\Windows\System\CVEYYsc.exe
  C:\Windows\System\CVEYYsc.exe
  2⤵
  PID:4968
- C:\Windows\System\alOEwiX.exe
  C:\Windows\System\alOEwiX.exe
  2⤵
  PID:4988
- C:\Windows\System\emovWAf.exe
  C:\Windows\System\emovWAf.exe
  2⤵
  PID:5004
- C:\Windows\System\xGNLutC.exe
  C:\Windows\System\xGNLutC.exe
  2⤵
  PID:5084
- C:\Windows\System\rJIEOwp.exe
  C:\Windows\System\rJIEOwp.exe
  2⤵
  PID:5044
- C:\Windows\System\wrQOQuf.exe
  C:\Windows\System\wrQOQuf.exe
  2⤵
  PID:5060
- C:\Windows\System\JscXWpn.exe
  C:\Windows\System\JscXWpn.exe
  2⤵
  PID:5096
- C:\Windows\System\eFMIXri.exe
  C:\Windows\System\eFMIXri.exe
  2⤵
  PID:5112
- C:\Windows\System\HyRUpUO.exe
  C:\Windows\System\HyRUpUO.exe
  2⤵
  PID:3304
- C:\Windows\System\aPxXEBF.exe
  C:\Windows\System\aPxXEBF.exe
  2⤵
  PID:3432
- C:\Windows\System\mXeDbeE.exe
  C:\Windows\System\mXeDbeE.exe
  2⤵
  PID:3988
- C:\Windows\System\iXNlkSo.exe
  C:\Windows\System\iXNlkSo.exe
  2⤵
  PID:3860
- C:\Windows\System\fYlmiwh.exe
  C:\Windows\System\fYlmiwh.exe
  2⤵
  PID:3204
- C:\Windows\System\FmqAfNt.exe
  C:\Windows\System\FmqAfNt.exe
  2⤵
  PID:4128
- C:\Windows\System\BzvuLPm.exe
  C:\Windows\System\BzvuLPm.exe
  2⤵
  PID:4152
- C:\Windows\System\rMtwEEw.exe
  C:\Windows\System\rMtwEEw.exe
  2⤵
  PID:4164
- C:\Windows\System\vLxZSau.exe
  C:\Windows\System\vLxZSau.exe
  2⤵
  PID:2132
- C:\Windows\System\xRVuxRb.exe
  C:\Windows\System\xRVuxRb.exe
  2⤵
  PID:4008
- C:\Windows\System\hjGiThy.exe
  C:\Windows\System\hjGiThy.exe
  2⤵
  PID:3764
- C:\Windows\System\YcCUaHd.exe
  C:\Windows\System\YcCUaHd.exe
  2⤵
  PID:3556
- C:\Windows\System\RLThFKv.exe
  C:\Windows\System\RLThFKv.exe
  2⤵
  PID:4264
- C:\Windows\System\FbMHGLy.exe
  C:\Windows\System\FbMHGLy.exe
  2⤵
  PID:4412
- C:\Windows\System\wlxNStb.exe
  C:\Windows\System\wlxNStb.exe
  2⤵
  PID:4488
- C:\Windows\System\XEfcgrt.exe
  C:\Windows\System\XEfcgrt.exe
  2⤵
  PID:4556
- C:\Windows\System\lgpQzBM.exe
  C:\Windows\System\lgpQzBM.exe
  2⤵
  PID:4284
- C:\Windows\System\hlQkRdS.exe
  C:\Windows\System\hlQkRdS.exe
  2⤵
  PID:4616
- C:\Windows\System\EnQHxim.exe
  C:\Windows\System\EnQHxim.exe
  2⤵
  PID:4572
- C:\Windows\System\QlDrgTf.exe
  C:\Windows\System\QlDrgTf.exe
  2⤵
  PID:4640
- C:\Windows\System\GglMvUY.exe
  C:\Windows\System\GglMvUY.exe
  2⤵
  PID:4800
- C:\Windows\System\BIYeLKs.exe
  C:\Windows\System\BIYeLKs.exe
  2⤵
  PID:4940
- C:\Windows\System\MgXABdm.exe
  C:\Windows\System\MgXABdm.exe
  2⤵
  PID:4812
- C:\Windows\System\SgWYvdA.exe
  C:\Windows\System\SgWYvdA.exe
  2⤵
  PID:4784
- C:\Windows\System\VtjeVih.exe
  C:\Windows\System\VtjeVih.exe
  2⤵
  PID:4952
- C:\Windows\System\FhysMDV.exe
  C:\Windows\System\FhysMDV.exe
  2⤵
  PID:4708
- C:\Windows\System\jqCSnHB.exe
  C:\Windows\System\jqCSnHB.exe
  2⤵
  PID:4992
- C:\Windows\System\nYKVNgi.exe
  C:\Windows\System\nYKVNgi.exe
  2⤵
  PID:5008
- C:\Windows\System\cIndUvF.exe
  C:\Windows\System\cIndUvF.exe
  2⤵
  PID:5092
- C:\Windows\System\rLtuBpR.exe
  C:\Windows\System\rLtuBpR.exe
  2⤵
  PID:5048
- C:\Windows\System\BvWnmbu.exe
  C:\Windows\System\BvWnmbu.exe
  2⤵
  PID:2676
- C:\Windows\System\xqzXZYq.exe
  C:\Windows\System\xqzXZYq.exe
  2⤵
  PID:3076
- C:\Windows\System\oIhNMAu.exe
  C:\Windows\System\oIhNMAu.exe
  2⤵
  PID:3316
- C:\Windows\System\fBIpFMO.exe
  C:\Windows\System\fBIpFMO.exe
  2⤵
  PID:3916
- C:\Windows\System\OniJCMj.exe
  C:\Windows\System\OniJCMj.exe
  2⤵
  PID:3480
- C:\Windows\System\baOqCwW.exe
  C:\Windows\System\baOqCwW.exe
  2⤵
  PID:4036
- C:\Windows\System\PNXoKEn.exe
  C:\Windows\System\PNXoKEn.exe
  2⤵
  PID:3804
- C:\Windows\System\RMEVmnG.exe
  C:\Windows\System\RMEVmnG.exe
  2⤵
  PID:4200
- C:\Windows\System\qJLVSPs.exe
  C:\Windows\System\qJLVSPs.exe
  2⤵
  PID:2068
- C:\Windows\System\yaTGQmq.exe
  C:\Windows\System\yaTGQmq.exe
  2⤵
  PID:4364
- C:\Windows\System\LaYdZtq.exe
  C:\Windows\System\LaYdZtq.exe
  2⤵
  PID:4500
- C:\Windows\System\SqYmVDe.exe
  C:\Windows\System\SqYmVDe.exe
  2⤵
  PID:4600
- C:\Windows\System\upHOOma.exe
  C:\Windows\System\upHOOma.exe
  2⤵
  PID:4728
- C:\Windows\System\FQjZdIc.exe
  C:\Windows\System\FQjZdIc.exe
  2⤵
  PID:4908
- C:\Windows\System\gnEAyPw.exe
  C:\Windows\System\gnEAyPw.exe
  2⤵
  PID:4928
- C:\Windows\System\BjggiiD.exe
  C:\Windows\System\BjggiiD.exe
  2⤵
  PID:5020
- C:\Windows\System\CzzeBCa.exe
  C:\Windows\System\CzzeBCa.exe
  2⤵
  PID:5036
- C:\Windows\System\YOVXVtr.exe
  C:\Windows\System\YOVXVtr.exe
  2⤵
  PID:5108
- C:\Windows\System\egDTrWG.exe
  C:\Windows\System\egDTrWG.exe
  2⤵
  PID:1892
- C:\Windows\System\jcITkFb.exe
  C:\Windows\System\jcITkFb.exe
  2⤵
  PID:3232
- C:\Windows\System\FXJBmWV.exe
  C:\Windows\System\FXJBmWV.exe
  2⤵
  PID:4144
- C:\Windows\System\NFqvWCC.exe
  C:\Windows\System\NFqvWCC.exe
  2⤵
  PID:1668
- C:\Windows\System\xBFOrVU.exe
  C:\Windows\System\xBFOrVU.exe
  2⤵
  PID:4304
- C:\Windows\System\voiGRic.exe
  C:\Windows\System\voiGRic.exe
  2⤵
  PID:4504
- C:\Windows\System\HqaNKRn.exe
  C:\Windows\System\HqaNKRn.exe
  2⤵
  PID:4656
- C:\Windows\System\DwqrCxA.exe
  C:\Windows\System\DwqrCxA.exe
  2⤵
  PID:4748
- C:\Windows\System\UFiwIqN.exe
  C:\Windows\System\UFiwIqN.exe
  2⤵
  PID:4856
- C:\Windows\System\uUIBUDI.exe
  C:\Windows\System\uUIBUDI.exe
  2⤵
  PID:4984
- C:\Windows\System\iQizFUL.exe
  C:\Windows\System\iQizFUL.exe
  2⤵
  PID:5100
- C:\Windows\System\SQGMGUU.exe
  C:\Windows\System\SQGMGUU.exe
  2⤵
  PID:2252
- C:\Windows\System\OgcnyfQ.exe
  C:\Windows\System\OgcnyfQ.exe
  2⤵
  PID:1852
- C:\Windows\System\uoeqYha.exe
  C:\Windows\System\uoeqYha.exe
  2⤵
  PID:4168
- C:\Windows\System\suTikKr.exe
  C:\Windows\System\suTikKr.exe
  2⤵
  PID:4220
- C:\Windows\System\AsLFhCF.exe
  C:\Windows\System\AsLFhCF.exe
  2⤵
  PID:4352
- C:\Windows\System\VJvoquC.exe
  C:\Windows\System\VJvoquC.exe
  2⤵
  PID:2016
- C:\Windows\System\HyKmrrk.exe
  C:\Windows\System\HyKmrrk.exe
  2⤵
  PID:3392
- C:\Windows\System\rjfHpMN.exe
  C:\Windows\System\rjfHpMN.exe
  2⤵
  PID:4588
- C:\Windows\System\yOCPYyV.exe
  C:\Windows\System\yOCPYyV.exe
  2⤵
  PID:1568
- C:\Windows\System\pErffXC.exe
  C:\Windows\System\pErffXC.exe
  2⤵
  PID:4868
- C:\Windows\System\hLjXfTn.exe
  C:\Windows\System\hLjXfTn.exe
  2⤵
  PID:5056
- C:\Windows\System\OLwbIjj.exe
  C:\Windows\System\OLwbIjj.exe
  2⤵
  PID:5072
- C:\Windows\System\AWMuiXO.exe
  C:\Windows\System\AWMuiXO.exe
  2⤵
  PID:5136
- C:\Windows\System\BAQnRwT.exe
  C:\Windows\System\BAQnRwT.exe
  2⤵
  PID:5160
- C:\Windows\System\cTaNLBt.exe
  C:\Windows\System\cTaNLBt.exe
  2⤵
  PID:5196
- C:\Windows\System\qmteKvJ.exe
  C:\Windows\System\qmteKvJ.exe
  2⤵
  PID:5240
- C:\Windows\System\oXidfQM.exe
  C:\Windows\System\oXidfQM.exe
  2⤵
  PID:5256
- C:\Windows\System\SvBBhfz.exe
  C:\Windows\System\SvBBhfz.exe
  2⤵
  PID:5272
- C:\Windows\System\jjbkhFI.exe
  C:\Windows\System\jjbkhFI.exe
  2⤵
  PID:5288
- C:\Windows\System\YaqkzeM.exe
  C:\Windows\System\YaqkzeM.exe
  2⤵
  PID:5316
- C:\Windows\System\QiqLnZB.exe
  C:\Windows\System\QiqLnZB.exe
  2⤵
  PID:5336
- C:\Windows\System\tjNydYt.exe
  C:\Windows\System\tjNydYt.exe
  2⤵
  PID:5356
- C:\Windows\System\WxNKKPY.exe
  C:\Windows\System\WxNKKPY.exe
  2⤵
  PID:5376
- C:\Windows\System\NbRKlhm.exe
  C:\Windows\System\NbRKlhm.exe
  2⤵
  PID:5392
- C:\Windows\System\mnJJkPM.exe
  C:\Windows\System\mnJJkPM.exe
  2⤵
  PID:5412
- C:\Windows\System\smCHxPP.exe
  C:\Windows\System\smCHxPP.exe
  2⤵
  PID:5428
- C:\Windows\System\Htvzncl.exe
  C:\Windows\System\Htvzncl.exe
  2⤵
  PID:5448
- C:\Windows\System\NuJnJkz.exe
  C:\Windows\System\NuJnJkz.exe
  2⤵
  PID:5464
- C:\Windows\System\VJMjGqr.exe
  C:\Windows\System\VJMjGqr.exe
  2⤵
  PID:5480
- C:\Windows\System\PvBTdYP.exe
  C:\Windows\System\PvBTdYP.exe
  2⤵
  PID:5500
- C:\Windows\System\MNcHVxr.exe
  C:\Windows\System\MNcHVxr.exe
  2⤵
  PID:5572
- C:\Windows\System\fsYtMcJ.exe
  C:\Windows\System\fsYtMcJ.exe
  2⤵
  PID:5592
- C:\Windows\System\oNrowzE.exe
  C:\Windows\System\oNrowzE.exe
  2⤵
  PID:5628
- C:\Windows\System\sVGYLBM.exe
  C:\Windows\System\sVGYLBM.exe
  2⤵
  PID:5648
- C:\Windows\System\ErursPZ.exe
  C:\Windows\System\ErursPZ.exe
  2⤵
  PID:5664
- C:\Windows\System\pOCpqWJ.exe
  C:\Windows\System\pOCpqWJ.exe
  2⤵
  PID:5680
- C:\Windows\System\TxDmsgG.exe
  C:\Windows\System\TxDmsgG.exe
  2⤵
  PID:5696
- C:\Windows\System\LcZsTIu.exe
  C:\Windows\System\LcZsTIu.exe
  2⤵
  PID:5732
- C:\Windows\System\KyfwTII.exe
  C:\Windows\System\KyfwTII.exe
  2⤵
  PID:5748
- C:\Windows\System\MAtxvJg.exe
  C:\Windows\System\MAtxvJg.exe
  2⤵
  PID:5764
- C:\Windows\System\ROoUUyO.exe
  C:\Windows\System\ROoUUyO.exe
  2⤵
  PID:5784
- C:\Windows\System\CRBMMBh.exe
  C:\Windows\System\CRBMMBh.exe
  2⤵
  PID:5804
- C:\Windows\System\aZqjIXO.exe
  C:\Windows\System\aZqjIXO.exe
  2⤵
  PID:5820
- C:\Windows\System\GMnQHnr.exe
  C:\Windows\System\GMnQHnr.exe
  2⤵
  PID:5844
- C:\Windows\System\NetwCXA.exe
  C:\Windows\System\NetwCXA.exe
  2⤵
  PID:5860
- C:\Windows\System\ZCGQIav.exe
  C:\Windows\System\ZCGQIav.exe
  2⤵
  PID:5884
- C:\Windows\System\xsljccy.exe
  C:\Windows\System\xsljccy.exe
  2⤵
  PID:5904
- C:\Windows\System\TQvhCIP.exe
  C:\Windows\System\TQvhCIP.exe
  2⤵
  PID:5924
- C:\Windows\System\UlTvpLc.exe
  C:\Windows\System\UlTvpLc.exe
  2⤵
  PID:5940
- C:\Windows\System\DKNluHM.exe
  C:\Windows\System\DKNluHM.exe
  2⤵
  PID:5972
- C:\Windows\System\qyXDgka.exe
  C:\Windows\System\qyXDgka.exe
  2⤵
  PID:5992
- C:\Windows\System\zBFXBhB.exe
  C:\Windows\System\zBFXBhB.exe
  2⤵
  PID:6008
- C:\Windows\System\ScQEOIt.exe
  C:\Windows\System\ScQEOIt.exe
  2⤵
  PID:6024
- C:\Windows\System\fzNVnmp.exe
  C:\Windows\System\fzNVnmp.exe
  2⤵
  PID:6040
- C:\Windows\System\WGgWkSY.exe
  C:\Windows\System\WGgWkSY.exe
  2⤵
  PID:6056
- C:\Windows\System\cxEFZfV.exe
  C:\Windows\System\cxEFZfV.exe
  2⤵
  PID:6080
- C:\Windows\System\UoqIYAC.exe
  C:\Windows\System\UoqIYAC.exe
  2⤵
  PID:6100
- C:\Windows\System\mDfkONc.exe
  C:\Windows\System\mDfkONc.exe
  2⤵
  PID:6116
- C:\Windows\System\OhfTnCE.exe
  C:\Windows\System\OhfTnCE.exe
  2⤵
  PID:6136
- C:\Windows\System\LUXBOYd.exe
  C:\Windows\System\LUXBOYd.exe
  2⤵
  PID:2240
- C:\Windows\System\kGrWstS.exe
  C:\Windows\System\kGrWstS.exe
  2⤵
  PID:5172
- C:\Windows\System\ROIzoUI.exe
  C:\Windows\System\ROIzoUI.exe
  2⤵
  PID:5040
- C:\Windows\System\prmPHer.exe
  C:\Windows\System\prmPHer.exe
  2⤵
  PID:4380
- C:\Windows\System\WGJQDmx.exe
  C:\Windows\System\WGJQDmx.exe
  2⤵
  PID:5192
- C:\Windows\System\FkvAhrf.exe
  C:\Windows\System\FkvAhrf.exe
  2⤵
  PID:5236
- C:\Windows\System\wjxyUPz.exe
  C:\Windows\System\wjxyUPz.exe
  2⤵
  PID:5296
- C:\Windows\System\lEWtPby.exe
  C:\Windows\System\lEWtPby.exe
  2⤵
  PID:5300
- C:\Windows\System\dKMgFPs.exe
  C:\Windows\System\dKMgFPs.exe
  2⤵
  PID:5220
- C:\Windows\System\aeXiKCi.exe
  C:\Windows\System\aeXiKCi.exe
  2⤵
  PID:4436
- C:\Windows\System\mKIGARQ.exe
  C:\Windows\System\mKIGARQ.exe
  2⤵
  PID:5408
- C:\Windows\System\DtARsOO.exe
  C:\Windows\System\DtARsOO.exe
  2⤵
  PID:5364
- C:\Windows\System\cCtbYUK.exe
  C:\Windows\System\cCtbYUK.exe
  2⤵
  PID:5456
- C:\Windows\System\FPOQtnQ.exe
  C:\Windows\System\FPOQtnQ.exe
  2⤵
  PID:5492
- C:\Windows\System\gTyhmpa.exe
  C:\Windows\System\gTyhmpa.exe
  2⤵
  PID:5512
- C:\Windows\System\MarAzlB.exe
  C:\Windows\System\MarAzlB.exe
  2⤵
  PID:5528
- C:\Windows\System\hVjDVam.exe
  C:\Windows\System\hVjDVam.exe
  2⤵
  PID:5544
- C:\Windows\System\ileEjDk.exe
  C:\Windows\System\ileEjDk.exe
  2⤵
  PID:5560
- C:\Windows\System\eYuTwRA.exe
  C:\Windows\System\eYuTwRA.exe
  2⤵
  PID:5588
- C:\Windows\System\KNgdrsy.exe
  C:\Windows\System\KNgdrsy.exe
  2⤵
  PID:5616
- C:\Windows\System\MdNzjWL.exe
  C:\Windows\System\MdNzjWL.exe
  2⤵
  PID:5636
- C:\Windows\System\WruIQLt.exe
  C:\Windows\System\WruIQLt.exe
  2⤵
  PID:5692
- C:\Windows\System\jUgWwuf.exe
  C:\Windows\System\jUgWwuf.exe
  2⤵
  PID:5712
- C:\Windows\System\nJQxYis.exe
  C:\Windows\System\nJQxYis.exe
  2⤵
  PID:5728
- C:\Windows\System\PKxgNnF.exe
  C:\Windows\System\PKxgNnF.exe
  2⤵
  PID:5760
- C:\Windows\System\SLRaZtJ.exe
  C:\Windows\System\SLRaZtJ.exe
  2⤵
  PID:5792
- C:\Windows\System\XwkzSmn.exe
  C:\Windows\System\XwkzSmn.exe
  2⤵
  PID:5836
- C:\Windows\System\jkbtuuV.exe
  C:\Windows\System\jkbtuuV.exe
  2⤵
  PID:5856
- C:\Windows\System\uGHNvBu.exe
  C:\Windows\System\uGHNvBu.exe
  2⤵
  PID:5876
- C:\Windows\System\PAzUYgn.exe
  C:\Windows\System\PAzUYgn.exe
  2⤵
  PID:5912
- C:\Windows\System\pQwHOEo.exe
  C:\Windows\System\pQwHOEo.exe
  2⤵
  PID:5936
- C:\Windows\System\jPVvbdI.exe
  C:\Windows\System\jPVvbdI.exe
  2⤵
  PID:5948
- C:\Windows\System\IelIhSx.exe
  C:\Windows\System\IelIhSx.exe
  2⤵
  PID:6000
- C:\Windows\System\clTuehy.exe
  C:\Windows\System\clTuehy.exe
  2⤵
  PID:1900
- C:\Windows\System\GfeLBiC.exe
  C:\Windows\System\GfeLBiC.exe
  2⤵
  PID:6052
- C:\Windows\System\YvHgglc.exe
  C:\Windows\System\YvHgglc.exe
  2⤵
  PID:6076
- C:\Windows\System\bqckiXx.exe
  C:\Windows\System\bqckiXx.exe
  2⤵
  PID:4764
- C:\Windows\System\iEzVcxs.exe
  C:\Windows\System\iEzVcxs.exe
  2⤵
  PID:5148
- C:\Windows\System\FNxMEAu.exe
  C:\Windows\System\FNxMEAu.exe
  2⤵
  PID:5568
- C:\Windows\System\yyDrcFe.exe
  C:\Windows\System\yyDrcFe.exe
  2⤵
  PID:5624
- C:\Windows\System\zTlbaFF.exe
  C:\Windows\System\zTlbaFF.exe
  2⤵
  PID:5708
- C:\Windows\System\xfoBGZV.exe
  C:\Windows\System\xfoBGZV.exe
  2⤵
  PID:5812
- C:\Windows\System\JeQSTMO.exe
  C:\Windows\System\JeQSTMO.exe
  2⤵
  PID:5204
- C:\Windows\System\IrAAzeN.exe
  C:\Windows\System\IrAAzeN.exe
  2⤵
  PID:5932
- C:\Windows\System\gKWtVIs.exe
  C:\Windows\System\gKWtVIs.exe
  2⤵
  PID:6036
- C:\Windows\System\kAGIygD.exe
  C:\Windows\System\kAGIygD.exe
  2⤵
  PID:6088
- C:\Windows\System\kQZcYPD.exe
  C:\Windows\System\kQZcYPD.exe
  2⤵
  PID:5184
- C:\Windows\System\ShkfyuI.exe
  C:\Windows\System\ShkfyuI.exe
  2⤵
  PID:4980
- C:\Windows\System\IQWJoqm.exe
  C:\Windows\System\IQWJoqm.exe
  2⤵
  PID:5896
- C:\Windows\System\xetfdnx.exe
  C:\Windows\System\xetfdnx.exe
  2⤵
  PID:5232
- C:\Windows\System\ZRIucLe.exe
  C:\Windows\System\ZRIucLe.exe
  2⤵
  PID:5964
- C:\Windows\System\fSLqwXB.exe
  C:\Windows\System\fSLqwXB.exe
  2⤵
  PID:6128
- C:\Windows\System\QCcFMxX.exe
  C:\Windows\System\QCcFMxX.exe
  2⤵
  PID:5348
- C:\Windows\System\ZQasKnp.exe
  C:\Windows\System\ZQasKnp.exe
  2⤵
  PID:5520
- C:\Windows\System\uEDuzFX.exe
  C:\Windows\System\uEDuzFX.exe
  2⤵
  PID:6096
- C:\Windows\System\FbERzFO.exe
  C:\Windows\System\FbERzFO.exe
  2⤵
  PID:5900
- C:\Windows\System\LJSDVgx.exe
  C:\Windows\System\LJSDVgx.exe
  2⤵
  PID:5780
- C:\Windows\System\ndwVJJq.exe
  C:\Windows\System\ndwVJJq.exe
  2⤵
  PID:5612
- C:\Windows\System\KVBlCCS.exe
  C:\Windows\System\KVBlCCS.exe
  2⤵
  PID:5388
- C:\Windows\System\Vrwprkh.exe
  C:\Windows\System\Vrwprkh.exe
  2⤵
  PID:5440
- C:\Windows\System\natkWOo.exe
  C:\Windows\System\natkWOo.exe
  2⤵
  PID:5508
- C:\Windows\System\WOpvfGH.exe
  C:\Windows\System\WOpvfGH.exe
  2⤵
  PID:5688
- C:\Windows\System\ktaegfo.exe
  C:\Windows\System\ktaegfo.exe
  2⤵
  PID:5832
- C:\Windows\System\XEGWVJm.exe
  C:\Windows\System\XEGWVJm.exe
  2⤵
  PID:5284
- C:\Windows\System\uCLAyyD.exe
  C:\Windows\System\uCLAyyD.exe
  2⤵
  PID:5344
- C:\Windows\System\tspaoTk.exe
  C:\Windows\System\tspaoTk.exe
  2⤵
  PID:5744
- C:\Windows\System\fBccYeH.exe
  C:\Windows\System\fBccYeH.exe
  2⤵
  PID:5224
- C:\Windows\System\RCGhfSp.exe
  C:\Windows\System\RCGhfSp.exe
  2⤵
  PID:6092
- C:\Windows\System\KnpODmn.exe
  C:\Windows\System\KnpODmn.exe
  2⤵
  PID:5984
- C:\Windows\System\OduPhVU.exe
  C:\Windows\System\OduPhVU.exe
  2⤵
  PID:6016
- C:\Windows\System\bNzmImV.exe
  C:\Windows\System\bNzmImV.exe
  2⤵
  PID:5676
- C:\Windows\System\CljuPFH.exe
  C:\Windows\System\CljuPFH.exe
  2⤵
  PID:5800
- C:\Windows\System\kfUhnkr.exe
  C:\Windows\System\kfUhnkr.exe
  2⤵
  PID:5540
- C:\Windows\System\ZIYXQhL.exe
  C:\Windows\System\ZIYXQhL.exe
  2⤵
  PID:5328
- C:\Windows\System\wBRbZib.exe
  C:\Windows\System\wBRbZib.exe
  2⤵
  PID:5672
- C:\Windows\System\IcLtzPf.exe
  C:\Windows\System\IcLtzPf.exe
  2⤵
  PID:5604
- C:\Windows\System\heEsauK.exe
  C:\Windows\System\heEsauK.exe
  2⤵
  PID:5216
- C:\Windows\System\KGlYNbD.exe
  C:\Windows\System\KGlYNbD.exe
  2⤵
  PID:5840
- C:\Windows\System\qqizPsB.exe
  C:\Windows\System\qqizPsB.exe
  2⤵
  PID:5892
- C:\Windows\System\QmGoLuB.exe
  C:\Windows\System\QmGoLuB.exe
  2⤵
  PID:5304
- C:\Windows\System\SYepXNm.exe
  C:\Windows\System\SYepXNm.exe
  2⤵
  PID:5280
- C:\Windows\System\XWQwxqJ.exe
  C:\Windows\System\XWQwxqJ.exe
  2⤵
  PID:5524
- C:\Windows\System\WdfCnND.exe
  C:\Windows\System\WdfCnND.exe
  2⤵
  PID:6156
- C:\Windows\System\tifVpfO.exe
  C:\Windows\System\tifVpfO.exe
  2⤵
  PID:6172
- C:\Windows\System\VbPNLDN.exe
  C:\Windows\System\VbPNLDN.exe
  2⤵
  PID:6188
- C:\Windows\System\yNIjYKS.exe
  C:\Windows\System\yNIjYKS.exe
  2⤵
  PID:6204
- C:\Windows\System\skgnhne.exe
  C:\Windows\System\skgnhne.exe
  2⤵
  PID:6224
- C:\Windows\System\tQlAHzB.exe
  C:\Windows\System\tQlAHzB.exe
  2⤵
  PID:6240
- C:\Windows\System\fmLUfYQ.exe
  C:\Windows\System\fmLUfYQ.exe
  2⤵
  PID:6260
- C:\Windows\System\zAiCFTT.exe
  C:\Windows\System\zAiCFTT.exe
  2⤵
  PID:6276
- C:\Windows\System\LCSTUvi.exe
  C:\Windows\System\LCSTUvi.exe
  2⤵
  PID:6292
- C:\Windows\System\QivgDsA.exe
  C:\Windows\System\QivgDsA.exe
  2⤵
  PID:6312
- C:\Windows\System\vlzpHbU.exe
  C:\Windows\System\vlzpHbU.exe
  2⤵
  PID:6332
- C:\Windows\System\lWAzZUu.exe
  C:\Windows\System\lWAzZUu.exe
  2⤵
  PID:6348
- C:\Windows\System\fKzklXl.exe
  C:\Windows\System\fKzklXl.exe
  2⤵
  PID:6364
- C:\Windows\System\NKWVDCY.exe
  C:\Windows\System\NKWVDCY.exe
  2⤵
  PID:6380
- C:\Windows\System\OYgcKrs.exe
  C:\Windows\System\OYgcKrs.exe
  2⤵
  PID:6396
- C:\Windows\System\HocOJmP.exe
  C:\Windows\System\HocOJmP.exe
  2⤵
  PID:6412
- C:\Windows\System\cAyOdra.exe
  C:\Windows\System\cAyOdra.exe
  2⤵
  PID:6428
- C:\Windows\System\EyfYSSU.exe
  C:\Windows\System\EyfYSSU.exe
  2⤵
  PID:6448
- C:\Windows\System\AnREPvx.exe
  C:\Windows\System\AnREPvx.exe
  2⤵
  PID:6464
- C:\Windows\System\aQuZcTR.exe
  C:\Windows\System\aQuZcTR.exe
  2⤵
  PID:6480
- C:\Windows\System\eRKZnlE.exe
  C:\Windows\System\eRKZnlE.exe
  2⤵
  PID:6496
- C:\Windows\System\yyiqQTM.exe
  C:\Windows\System\yyiqQTM.exe
  2⤵
  PID:6512
- C:\Windows\System\vlzXuvC.exe
  C:\Windows\System\vlzXuvC.exe
  2⤵
  PID:6532
- C:\Windows\System\MZtZNwP.exe
  C:\Windows\System\MZtZNwP.exe
  2⤵
  PID:6548
- C:\Windows\System\oemWmgo.exe
  C:\Windows\System\oemWmgo.exe
  2⤵
  PID:6564
- C:\Windows\System\bsBlluO.exe
  C:\Windows\System\bsBlluO.exe
  2⤵
  PID:6580
- C:\Windows\System\PiUrWwH.exe
  C:\Windows\System\PiUrWwH.exe
  2⤵
  PID:6596
- C:\Windows\System\OgLrBWI.exe
  C:\Windows\System\OgLrBWI.exe
  2⤵
  PID:6612
- C:\Windows\System\jadkvDI.exe
  C:\Windows\System\jadkvDI.exe
  2⤵
  PID:6628
- C:\Windows\System\vhdGApy.exe
  C:\Windows\System\vhdGApy.exe
  2⤵
  PID:6644
- C:\Windows\System\knUoRMe.exe
  C:\Windows\System\knUoRMe.exe
  2⤵
  PID:6660
- C:\Windows\System\oyyyCwu.exe
  C:\Windows\System\oyyyCwu.exe
  2⤵
  PID:6804
- C:\Windows\System\vlUazPR.exe
  C:\Windows\System\vlUazPR.exe
  2⤵
  PID:6820
- C:\Windows\System\iXfkvcK.exe
  C:\Windows\System\iXfkvcK.exe
  2⤵
  PID:6840
- C:\Windows\System\qAyRUWy.exe
  C:\Windows\System\qAyRUWy.exe
  2⤵
  PID:6856
- C:\Windows\System\QRoITSU.exe
  C:\Windows\System\QRoITSU.exe
  2⤵
  PID:6884
- C:\Windows\System\dudfPAG.exe
  C:\Windows\System\dudfPAG.exe
  2⤵
  PID:6932
- C:\Windows\System\WdAtuyT.exe
  C:\Windows\System\WdAtuyT.exe
  2⤵
  PID:7000
- C:\Windows\System\kyteRSi.exe
  C:\Windows\System\kyteRSi.exe
  2⤵
  PID:7016
- C:\Windows\System\RWFQKkt.exe
  C:\Windows\System\RWFQKkt.exe
  2⤵
  PID:7036
- C:\Windows\System\nXhYeyQ.exe
  C:\Windows\System\nXhYeyQ.exe
  2⤵
  PID:7052
- C:\Windows\System\kXmQPEQ.exe
  C:\Windows\System\kXmQPEQ.exe
  2⤵
  PID:7072
- C:\Windows\System\GrXpGvi.exe
  C:\Windows\System\GrXpGvi.exe
  2⤵
  PID:7088
- C:\Windows\System\VpsYBId.exe
  C:\Windows\System\VpsYBId.exe
  2⤵
  PID:7104
- C:\Windows\System\dfpxwSy.exe
  C:\Windows\System\dfpxwSy.exe
  2⤵
  PID:7120
- C:\Windows\System\CctwbgQ.exe
  C:\Windows\System\CctwbgQ.exe
  2⤵
  PID:7136
- C:\Windows\System\GjOpzrz.exe
  C:\Windows\System\GjOpzrz.exe
  2⤵
  PID:7156
- C:\Windows\System\CeIzSza.exe
  C:\Windows\System\CeIzSza.exe
  2⤵
  PID:5988
- C:\Windows\System\EdUVRXc.exe
  C:\Windows\System\EdUVRXc.exe
  2⤵
  PID:5608
- C:\Windows\System\NQfQdMn.exe
  C:\Windows\System\NQfQdMn.exe
  2⤵
  PID:5332
- C:\Windows\System\ngLYQrn.exe
  C:\Windows\System\ngLYQrn.exe
  2⤵
  PID:5312
- C:\Windows\System\SklIRTx.exe
  C:\Windows\System\SklIRTx.exe
  2⤵
  PID:6216
- C:\Windows\System\ODizCBG.exe
  C:\Windows\System\ODizCBG.exe
  2⤵
  PID:6284
- C:\Windows\System\uIOynja.exe
  C:\Windows\System\uIOynja.exe
  2⤵
  PID:6232
- C:\Windows\System\BaUpNkS.exe
  C:\Windows\System\BaUpNkS.exe
  2⤵
  PID:6304
- C:\Windows\System\PeHCFUz.exe
  C:\Windows\System\PeHCFUz.exe
  2⤵
  PID:6340
- C:\Windows\System\FlsrLkP.exe
  C:\Windows\System\FlsrLkP.exe
  2⤵
  PID:6424
- C:\Windows\System\RzDOwlH.exe
  C:\Windows\System\RzDOwlH.exe
  2⤵
  PID:6444
- C:\Windows\System\uQhNqZp.exe
  C:\Windows\System\uQhNqZp.exe
  2⤵
  PID:6460
- C:\Windows\System\lWPeGTH.exe
  C:\Windows\System\lWPeGTH.exe
  2⤵
  PID:6456
- C:\Windows\System\psnbLdT.exe
  C:\Windows\System\psnbLdT.exe
  2⤵
  PID:6528
- C:\Windows\System\DvUCPbK.exe
  C:\Windows\System\DvUCPbK.exe
  2⤵
  PID:6560
- C:\Windows\System\dJsGwkr.exe
  C:\Windows\System\dJsGwkr.exe
  2⤵
  PID:6624
- C:\Windows\System\oALziOY.exe
  C:\Windows\System\oALziOY.exe
  2⤵
  PID:6540
- C:\Windows\System\XMvwbhX.exe
  C:\Windows\System\XMvwbhX.exe
  2⤵
  PID:6640
- C:\Windows\System\onbHlxV.exe
  C:\Windows\System\onbHlxV.exe
  2⤵
  PID:6576
- C:\Windows\System\LpaDYep.exe
  C:\Windows\System\LpaDYep.exe
  2⤵
  PID:6688
- C:\Windows\System\kIpXlxR.exe
  C:\Windows\System\kIpXlxR.exe
  2⤵
  PID:6704
- C:\Windows\System\VbetLlk.exe
  C:\Windows\System\VbetLlk.exe
  2⤵
  PID:6728
- C:\Windows\System\lOdFeYS.exe
  C:\Windows\System\lOdFeYS.exe
  2⤵
  PID:6740
- C:\Windows\System\SJpStsQ.exe
  C:\Windows\System\SJpStsQ.exe
  2⤵
  PID:6756
- C:\Windows\System\ZlHqXWJ.exe
  C:\Windows\System\ZlHqXWJ.exe
  2⤵
  PID:6776
- C:\Windows\System\mhXVBhn.exe
  C:\Windows\System\mhXVBhn.exe
  2⤵
  PID:6780
- C:\Windows\System\VRzEvzb.exe
  C:\Windows\System\VRzEvzb.exe
  2⤵
  PID:6812
- C:\Windows\System\BkPqifW.exe
  C:\Windows\System\BkPqifW.exe
  2⤵
  PID:6852
- C:\Windows\System\euREZTr.exe
  C:\Windows\System\euREZTr.exe
  2⤵
  PID:6868
- C:\Windows\System\IbgpNrR.exe
  C:\Windows\System\IbgpNrR.exe
  2⤵
  PID:6904
- C:\Windows\System\dnOGoHG.exe
  C:\Windows\System\dnOGoHG.exe
  2⤵
  PID:6916
- C:\Windows\System\WXPruRc.exe
  C:\Windows\System\WXPruRc.exe
  2⤵
  PID:6940
- C:\Windows\System\fMpjqMA.exe
  C:\Windows\System\fMpjqMA.exe
  2⤵
  PID:1580
- C:\Windows\System\YnpcWkI.exe
  C:\Windows\System\YnpcWkI.exe
  2⤵
  PID:6960
- C:\Windows\System\MItaphD.exe
  C:\Windows\System\MItaphD.exe
  2⤵
  PID:7080
- C:\Windows\System\IUPpKpH.exe
  C:\Windows\System\IUPpKpH.exe
  2⤵
  PID:7144
- C:\Windows\System\tuwkYFf.exe
  C:\Windows\System\tuwkYFf.exe
  2⤵
  PID:6996
- C:\Windows\System\nFsmdft.exe
  C:\Windows\System\nFsmdft.exe
  2⤵
  PID:7032
- C:\Windows\System\ZvhXEpf.exe
  C:\Windows\System\ZvhXEpf.exe
  2⤵
  PID:7128
- C:\Windows\System\xkkKGdk.exe
  C:\Windows\System\xkkKGdk.exe
  2⤵
  PID:6152
- C:\Windows\System\fnoKHNJ.exe
  C:\Windows\System\fnoKHNJ.exe
  2⤵
  PID:6320
- C:\Windows\System\mbTpyTm.exe
  C:\Windows\System\mbTpyTm.exe
  2⤵
  PID:6324
- C:\Windows\System\KMYmpTG.exe
  C:\Windows\System\KMYmpTG.exe
  2⤵
  PID:7112
- C:\Windows\System\SvHcFey.exe
  C:\Windows\System\SvHcFey.exe
  2⤵
  PID:5488
- C:\Windows\System\GlblEQz.exe
  C:\Windows\System\GlblEQz.exe
  2⤵
  PID:6392
- C:\Windows\System\lBryLRH.exe
  C:\Windows\System\lBryLRH.exe
  2⤵
  PID:6420
- C:\Windows\System\PkdYGUt.exe
  C:\Windows\System\PkdYGUt.exe
  2⤵
  PID:6524
- C:\Windows\System\nmlPXbs.exe
  C:\Windows\System\nmlPXbs.exe
  2⤵
  PID:7068
- C:\Windows\System\DhseCXF.exe
  C:\Windows\System\DhseCXF.exe
  2⤵
  PID:6720
- C:\Windows\System\UGEFbPy.exe
  C:\Windows\System\UGEFbPy.exe
  2⤵
  PID:6680
- C:\Windows\System\dgckEOD.exe
  C:\Windows\System\dgckEOD.exe
  2⤵
  PID:6784
- C:\Windows\System\vaZlKqE.exe
  C:\Windows\System\vaZlKqE.exe
  2⤵
  PID:6604
- C:\Windows\System\lnFychv.exe
  C:\Windows\System\lnFychv.exe
  2⤵
  PID:6736
- C:\Windows\System\cUKhxVL.exe
  C:\Windows\System\cUKhxVL.exe
  2⤵
  PID:6800
- C:\Windows\System\lBIMBqq.exe
  C:\Windows\System\lBIMBqq.exe
  2⤵
  PID:6476
- C:\Windows\System\sdAYZMB.exe
  C:\Windows\System\sdAYZMB.exe
  2⤵
  PID:6408
- C:\Windows\System\zyguFEN.exe
  C:\Windows\System\zyguFEN.exe
  2⤵
  PID:6896
- C:\Windows\System\PcIGiFv.exe
  C:\Windows\System\PcIGiFv.exe
  2⤵
  PID:6972
- C:\Windows\System\jPRdSqa.exe
  C:\Windows\System\jPRdSqa.exe
  2⤵
  PID:7028
- C:\Windows\System\ibOCzOr.exe
  C:\Windows\System\ibOCzOr.exe
  2⤵
  PID:7064
- C:\Windows\System\LZShgWA.exe
  C:\Windows\System\LZShgWA.exe
  2⤵
  PID:6968
- C:\Windows\System\jcWpyDA.exe
  C:\Windows\System\jcWpyDA.exe
  2⤵
  PID:5156
- C:\Windows\System\HiWsJnk.exe
  C:\Windows\System\HiWsJnk.exe
  2⤵
  PID:6924
- C:\Windows\System\ZxcxzEQ.exe
  C:\Windows\System\ZxcxzEQ.exe
  2⤵
  PID:6212
- C:\Windows\System\cTQAqAG.exe
  C:\Windows\System\cTQAqAG.exe
  2⤵
  PID:6184
- C:\Windows\System\LfKvBQy.exe
  C:\Windows\System\LfKvBQy.exe
  2⤵
  PID:6268
- C:\Windows\System\UKtMWMD.exe
  C:\Windows\System\UKtMWMD.exe
  2⤵
  PID:6520
- C:\Windows\System\YBJHEeb.exe
  C:\Windows\System\YBJHEeb.exe
  2⤵
  PID:6656
- C:\Windows\System\UBbsNlk.exe
  C:\Windows\System\UBbsNlk.exe
  2⤵
  PID:7164
- C:\Windows\System\twGRLzP.exe
  C:\Windows\System\twGRLzP.exe
  2⤵
  PID:6984
- C:\Windows\System\QMokvgi.exe
  C:\Windows\System\QMokvgi.exe
  2⤵
  PID:6908
- C:\Windows\System\sHTLQwT.exe
  C:\Windows\System\sHTLQwT.exe
  2⤵
  PID:6272
- C:\Windows\System\KziZPCq.exe
  C:\Windows\System\KziZPCq.exe
  2⤵
  PID:6724
- C:\Windows\System\MXjJtRF.exe
  C:\Windows\System\MXjJtRF.exe
  2⤵
  PID:6848
- C:\Windows\System\LVsAPZe.exe
  C:\Windows\System\LVsAPZe.exe
  2⤵
  PID:6964
- C:\Windows\System\zHqEfCn.exe
  C:\Windows\System\zHqEfCn.exe
  2⤵
  PID:6676
- C:\Windows\System\iQJzTCl.exe
  C:\Windows\System\iQJzTCl.exe
  2⤵
  PID:6508
- C:\Windows\System\gnRyMXp.exe
  C:\Windows\System\gnRyMXp.exe
  2⤵
  PID:6360
- C:\Windows\System\kvGXQoY.exe
  C:\Windows\System\kvGXQoY.exe
  2⤵
  PID:7012
- C:\Windows\System\GPZaNOh.exe
  C:\Windows\System\GPZaNOh.exe
  2⤵
  PID:6816
- C:\Windows\System\udPfQDH.exe
  C:\Windows\System\udPfQDH.exe
  2⤵
  PID:6700
- C:\Windows\System\aMXgixM.exe
  C:\Windows\System\aMXgixM.exe
  2⤵
  PID:7180
- C:\Windows\System\WgAYTcY.exe
  C:\Windows\System\WgAYTcY.exe
  2⤵
  PID:7208
- C:\Windows\System\EPqafqx.exe
  C:\Windows\System\EPqafqx.exe
  2⤵
  PID:7224
- C:\Windows\System\INqnuct.exe
  C:\Windows\System\INqnuct.exe
  2⤵
  PID:7240
- C:\Windows\System\enZIcFR.exe
  C:\Windows\System\enZIcFR.exe
  2⤵
  PID:7256
- C:\Windows\System\nssFpgR.exe
  C:\Windows\System\nssFpgR.exe
  2⤵
  PID:7272
- C:\Windows\System\TJVzQUJ.exe
  C:\Windows\System\TJVzQUJ.exe
  2⤵
  PID:7288
- C:\Windows\System\OBqETLJ.exe
  C:\Windows\System\OBqETLJ.exe
  2⤵
  PID:7304
- C:\Windows\System\mTEeHmY.exe
  C:\Windows\System\mTEeHmY.exe
  2⤵
  PID:7324
- C:\Windows\System\aDZlsnV.exe
  C:\Windows\System\aDZlsnV.exe
  2⤵
  PID:7340
- C:\Windows\System\KuFoywz.exe
  C:\Windows\System\KuFoywz.exe
  2⤵
  PID:7360
- C:\Windows\System\szsneXJ.exe
  C:\Windows\System\szsneXJ.exe
  2⤵
  PID:7384
- C:\Windows\System\qwpzgdF.exe
  C:\Windows\System\qwpzgdF.exe
  2⤵
  PID:7400
- C:\Windows\System\reBGMXQ.exe
  C:\Windows\System\reBGMXQ.exe
  2⤵
  PID:7416
- C:\Windows\System\cItIeaS.exe
  C:\Windows\System\cItIeaS.exe
  2⤵
  PID:7460
- C:\Windows\System\WDklCQs.exe
  C:\Windows\System\WDklCQs.exe
  2⤵
  PID:7476
- C:\Windows\System\CUjfuZm.exe
  C:\Windows\System\CUjfuZm.exe
  2⤵
  PID:7492
- C:\Windows\System\baLfLVR.exe
  C:\Windows\System\baLfLVR.exe
  2⤵
  PID:7536
- C:\Windows\System\ZgqeLRg.exe
  C:\Windows\System\ZgqeLRg.exe
  2⤵
  PID:7552
- C:\Windows\System\SFKxgnK.exe
  C:\Windows\System\SFKxgnK.exe
  2⤵
  PID:7568
- C:\Windows\System\MgHTEYw.exe
  C:\Windows\System\MgHTEYw.exe
  2⤵
  PID:7584
- C:\Windows\System\uvDbkCD.exe
  C:\Windows\System\uvDbkCD.exe
  2⤵
  PID:7600
- C:\Windows\System\KetHmHD.exe
  C:\Windows\System\KetHmHD.exe
  2⤵
  PID:7616
- C:\Windows\System\FswDevZ.exe
  C:\Windows\System\FswDevZ.exe
  2⤵
  PID:7632
- C:\Windows\System\SaAnGae.exe
  C:\Windows\System\SaAnGae.exe
  2⤵
  PID:7832
- C:\Windows\System\WEQYvWF.exe
  C:\Windows\System\WEQYvWF.exe
  2⤵
  PID:8036
- C:\Windows\System\aHjfCWb.exe
  C:\Windows\System\aHjfCWb.exe
  2⤵
  PID:8056
- C:\Windows\System\NsiNmVn.exe
  C:\Windows\System\NsiNmVn.exe
  2⤵
  PID:8076
- C:\Windows\System\EeeENAC.exe
  C:\Windows\System\EeeENAC.exe
  2⤵
  PID:8096
- C:\Windows\System\JYQMwCe.exe
  C:\Windows\System\JYQMwCe.exe
  2⤵
  PID:8116
- C:\Windows\System\rQCAwFH.exe
  C:\Windows\System\rQCAwFH.exe
  2⤵
  PID:8132
- C:\Windows\System\HcqDcbc.exe
  C:\Windows\System\HcqDcbc.exe
  2⤵
  PID:8148
- C:\Windows\System\ilDjCXT.exe
  C:\Windows\System\ilDjCXT.exe
  2⤵
  PID:7264
- C:\Windows\System\wUNUkWP.exe
  C:\Windows\System\wUNUkWP.exe
  2⤵
  PID:7368
- C:\Windows\System\tLaLzHV.exe
  C:\Windows\System\tLaLzHV.exe
  2⤵
  PID:7204
- C:\Windows\System\gOlvdXP.exe
  C:\Windows\System\gOlvdXP.exe
  2⤵
  PID:7428
- C:\Windows\System\HhzIhEk.exe
  C:\Windows\System\HhzIhEk.exe
  2⤵
  PID:7436
- C:\Windows\System\PzXtIeJ.exe
  C:\Windows\System\PzXtIeJ.exe
  2⤵
  PID:7456
- C:\Windows\System\WqbkhiI.exe
  C:\Windows\System\WqbkhiI.exe
  2⤵
  PID:7548
- C:\Windows\System\QaHyitH.exe
  C:\Windows\System\QaHyitH.exe
  2⤵
  PID:7608
- C:\Windows\System\suqWqkj.exe
  C:\Windows\System\suqWqkj.exe
  2⤵
  PID:7468
- C:\Windows\System\KrGujZQ.exe
  C:\Windows\System\KrGujZQ.exe
  2⤵
  PID:7512
- C:\Windows\System\ZIfTqKg.exe
  C:\Windows\System\ZIfTqKg.exe
  2⤵
  PID:7560
- C:\Windows\System\fEvXHHU.exe
  C:\Windows\System\fEvXHHU.exe
  2⤵
  PID:7644
- C:\Windows\System\hZpJaOY.exe
  C:\Windows\System\hZpJaOY.exe
  2⤵
  PID:7656
- C:\Windows\System\OWvbcxt.exe
  C:\Windows\System\OWvbcxt.exe
  2⤵
  PID:7676
- C:\Windows\System\udxwYdS.exe
  C:\Windows\System\udxwYdS.exe
  2⤵
  PID:7692
- C:\Windows\System\hXVWMCl.exe
  C:\Windows\System\hXVWMCl.exe
  2⤵
  PID:6196
- C:\Windows\System\kzUwSQt.exe
  C:\Windows\System\kzUwSQt.exe
  2⤵
  PID:7752
- C:\Windows\System\YrsAtlD.exe
  C:\Windows\System\YrsAtlD.exe
  2⤵
  PID:7772
- C:\Windows\System\sRZeaWG.exe
  C:\Windows\System\sRZeaWG.exe
  2⤵
  PID:7784
- C:\Windows\System\TTQKhOj.exe
  C:\Windows\System\TTQKhOj.exe
  2⤵
  PID:7804
- C:\Windows\System\UlofVSG.exe
  C:\Windows\System\UlofVSG.exe
  2⤵
  PID:7820
- C:\Windows\System\Uqimjpq.exe
  C:\Windows\System\Uqimjpq.exe
  2⤵
  PID:7880
- C:\Windows\System\mBhkWTF.exe
  C:\Windows\System\mBhkWTF.exe
  2⤵
  PID:7924
- C:\Windows\System\NQnEkNY.exe
  C:\Windows\System\NQnEkNY.exe
  2⤵
  PID:7944
- C:\Windows\System\pTFmTOv.exe
  C:\Windows\System\pTFmTOv.exe
  2⤵
  PID:7964
- C:\Windows\System\QGXSAHB.exe
  C:\Windows\System\QGXSAHB.exe
  2⤵
  PID:7908
- C:\Windows\System\ZZxGEAU.exe
  C:\Windows\System\ZZxGEAU.exe
  2⤵
  PID:7988
- C:\Windows\System\CUOXzNL.exe
  C:\Windows\System\CUOXzNL.exe
  2⤵
  PID:8004
- C:\Windows\System\vcMzHTB.exe
  C:\Windows\System\vcMzHTB.exe
  2⤵
  PID:7980
- C:\Windows\System\GUuzswD.exe
  C:\Windows\System\GUuzswD.exe
  2⤵
  PID:8024
- C:\Windows\System\GXpsvPw.exe
  C:\Windows\System\GXpsvPw.exe
  2⤵
  PID:8084
- C:\Windows\System\Hdhshei.exe
  C:\Windows\System\Hdhshei.exe
  2⤵
  PID:8140
- C:\Windows\System\cGRnukT.exe
  C:\Windows\System\cGRnukT.exe
  2⤵
  PID:8064
- C:\Windows\System\CVvPrcR.exe
  C:\Windows\System\CVvPrcR.exe
  2⤵
  PID:8128
- C:\Windows\System\iAaqFEs.exe
  C:\Windows\System\iAaqFEs.exe
  2⤵
  PID:8160
- C:\Windows\System\iDiVPWW.exe
  C:\Windows\System\iDiVPWW.exe
  2⤵
  PID:6836
- C:\Windows\System\vicTPSx.exe
  C:\Windows\System\vicTPSx.exe
  2⤵
  PID:7048
- C:\Windows\System\IFDooEl.exe
  C:\Windows\System\IFDooEl.exe
  2⤵
  PID:8180
- C:\Windows\System\SetKaLX.exe
  C:\Windows\System\SetKaLX.exe
  2⤵
  PID:6388
- C:\Windows\System\AdCleqF.exe
  C:\Windows\System\AdCleqF.exe
  2⤵
  PID:7280
- C:\Windows\System\heIGpOH.exe
  C:\Windows\System\heIGpOH.exe
  2⤵
  PID:7188
- C:\Windows\System\fIwysVj.exe
  C:\Windows\System\fIwysVj.exe
  2⤵
  PID:7284
- C:\Windows\System\wMgawbz.exe
  C:\Windows\System\wMgawbz.exe
  2⤵
  PID:7352
- C:\Windows\System\xaaNLiw.exe
  C:\Windows\System\xaaNLiw.exe
  2⤵
  PID:7392
- C:\Windows\System\sZwuhcD.exe
  C:\Windows\System\sZwuhcD.exe
  2⤵
  PID:7396
- C:\Windows\System\siEMIrX.exe
  C:\Windows\System\siEMIrX.exe
  2⤵
  PID:7200
- C:\Windows\System\MLqYbTc.exe
  C:\Windows\System\MLqYbTc.exe
  2⤵
  PID:7544
- C:\Windows\System\edsrnub.exe
  C:\Windows\System\edsrnub.exe
  2⤵
  PID:7528
- C:\Windows\System\KXoOLhO.exe
  C:\Windows\System\KXoOLhO.exe
  2⤵
  PID:7508
- C:\Windows\System\EfTefPa.exe
  C:\Windows\System\EfTefPa.exe
  2⤵
  PID:7444
- C:\Windows\System\mIWESKJ.exe
  C:\Windows\System\mIWESKJ.exe
  2⤵
  PID:7760
- C:\Windows\System\RimJEED.exe
  C:\Windows\System\RimJEED.exe
  2⤵
  PID:7688
- C:\Windows\System\tPnuiaD.exe
  C:\Windows\System\tPnuiaD.exe
  2⤵
  PID:7828
- C:\Windows\System\RTYVsjk.exe
  C:\Windows\System\RTYVsjk.exe
  2⤵
  PID:7412
- C:\Windows\System\olEvjtg.exe
  C:\Windows\System\olEvjtg.exe
  2⤵
  PID:7876
- C:\Windows\System\slmFYrJ.exe
  C:\Windows\System\slmFYrJ.exe
  2⤵
  PID:7948
- C:\Windows\System\cyDvakL.exe
  C:\Windows\System\cyDvakL.exe
  2⤵
  PID:7936
- C:\Windows\System\dgNGDDK.exe
  C:\Windows\System\dgNGDDK.exe
  2⤵
  PID:8032
- C:\Windows\System\dTseJLw.exe
  C:\Windows\System\dTseJLw.exe
  2⤵
  PID:8104
- C:\Windows\System\lUwEdOl.exe
  C:\Windows\System\lUwEdOl.exe
  2⤵
  PID:8144
- C:\Windows\System\TMCKuBp.exe
  C:\Windows\System\TMCKuBp.exe
  2⤵
  PID:7172
- C:\Windows\System\NambvAA.exe
  C:\Windows\System\NambvAA.exe
  2⤵
  PID:7176
- C:\Windows\System\mrRnuWa.exe
  C:\Windows\System\mrRnuWa.exe
  2⤵
  PID:7320
- C:\Windows\System\HaPkoVJ.exe
  C:\Windows\System\HaPkoVJ.exe
  2⤵
  PID:7488
- C:\Windows\System\TCVveCa.exe
  C:\Windows\System\TCVveCa.exe
  2⤵
  PID:7708
- C:\Windows\System\zVcppru.exe
  C:\Windows\System\zVcppru.exe
  2⤵
  PID:7332
- C:\Windows\System\zYDJhex.exe
  C:\Windows\System\zYDJhex.exe
  2⤵
  PID:7380
- C:\Windows\System\eslCall.exe
  C:\Windows\System\eslCall.exe
  2⤵
  PID:7816
- C:\Windows\System\aJJULQc.exe
  C:\Windows\System\aJJULQc.exe
  2⤵
  PID:7856
- C:\Windows\System\yKsloSe.exe
  C:\Windows\System\yKsloSe.exe
  2⤵
  PID:7252
- C:\Windows\System\eFgmGjd.exe
  C:\Windows\System\eFgmGjd.exe
  2⤵
  PID:7640
- C:\Windows\System\qSHyqFU.exe
  C:\Windows\System\qSHyqFU.exe
  2⤵
  PID:7972
- C:\Windows\System\QaUhiqc.exe
  C:\Windows\System\QaUhiqc.exe
  2⤵
  PID:7196
- C:\Windows\System\FuzrNOZ.exe
  C:\Windows\System\FuzrNOZ.exe
  2⤵
  PID:8012
- C:\Windows\System\FrwmsXz.exe
  C:\Windows\System\FrwmsXz.exe
  2⤵
  PID:7812
- C:\Windows\System\UfnJOjG.exe
  C:\Windows\System\UfnJOjG.exe
  2⤵
  PID:7788
- C:\Windows\System\fhgWIOM.exe
  C:\Windows\System\fhgWIOM.exe
  2⤵
  PID:7700
- C:\Windows\System\kHzhOzf.exe
  C:\Windows\System\kHzhOzf.exe
  2⤵
  PID:7860
- C:\Windows\System\JuKFcyt.exe
  C:\Windows\System\JuKFcyt.exe
  2⤵
  PID:7872
- C:\Windows\System\TcLslDk.exe
  C:\Windows\System\TcLslDk.exe
  2⤵
  PID:8000
- C:\Windows\System\jYJgrcV.exe
  C:\Windows\System\jYJgrcV.exe
  2⤵
  PID:8108
- C:\Windows\System\pgQdecu.exe
  C:\Windows\System\pgQdecu.exe
  2⤵
  PID:7940
- C:\Windows\System\xNqemgs.exe
  C:\Windows\System\xNqemgs.exe
  2⤵
  PID:7704
- C:\Windows\System\NzELlrs.exe
  C:\Windows\System\NzELlrs.exe
  2⤵
  PID:8020
- C:\Windows\System\vSDBabw.exe
  C:\Windows\System\vSDBabw.exe
  2⤵
  PID:8196
- C:\Windows\System\qmiRMek.exe
  C:\Windows\System\qmiRMek.exe
  2⤵
  PID:8216
- C:\Windows\System\dpqLwTE.exe
  C:\Windows\System\dpqLwTE.exe
  2⤵
  PID:8232
- C:\Windows\System\UZBkDCZ.exe
  C:\Windows\System\UZBkDCZ.exe
  2⤵
  PID:8248
- C:\Windows\System\YceWFmD.exe
  C:\Windows\System\YceWFmD.exe
  2⤵
  PID:8280
- C:\Windows\System\JoKgsGu.exe
  C:\Windows\System\JoKgsGu.exe
  2⤵
  PID:8296
- C:\Windows\System\aKEeKwU.exe
  C:\Windows\System\aKEeKwU.exe
  2⤵
  PID:8312
- C:\Windows\System\jZdlEUj.exe
  C:\Windows\System\jZdlEUj.exe
  2⤵
  PID:8328
- C:\Windows\System\eGNUdhR.exe
  C:\Windows\System\eGNUdhR.exe
  2⤵
  PID:8344
- C:\Windows\System\LKqVxQz.exe
  C:\Windows\System\LKqVxQz.exe
  2⤵
  PID:8360
- C:\Windows\System\HxcRlxN.exe
  C:\Windows\System\HxcRlxN.exe
  2⤵
  PID:8404
- C:\Windows\System\ZiwyIDT.exe
  C:\Windows\System\ZiwyIDT.exe
  2⤵
  PID:8424
- C:\Windows\System\vOLdSPW.exe
  C:\Windows\System\vOLdSPW.exe
  2⤵
  PID:8444
- C:\Windows\System\lteCxLi.exe
  C:\Windows\System\lteCxLi.exe
  2⤵
  PID:8460
- C:\Windows\System\AlRusEK.exe
  C:\Windows\System\AlRusEK.exe
  2⤵
  PID:8480
- C:\Windows\System\HUtmYgQ.exe
  C:\Windows\System\HUtmYgQ.exe
  2⤵
  PID:8548
- C:\Windows\System\IAhbQNo.exe
  C:\Windows\System\IAhbQNo.exe
  2⤵
  PID:8564
- C:\Windows\System\GjohPLe.exe
  C:\Windows\System\GjohPLe.exe
  2⤵
  PID:8580
- C:\Windows\System\npkIYai.exe
  C:\Windows\System\npkIYai.exe
  2⤵
  PID:8596
- C:\Windows\System\GhbwuOE.exe
  C:\Windows\System\GhbwuOE.exe
  2⤵
  PID:8624
- C:\Windows\System\lSmMrLn.exe
  C:\Windows\System\lSmMrLn.exe
  2⤵
  PID:8644
- C:\Windows\System\tmgAGFb.exe
  C:\Windows\System\tmgAGFb.exe
  2⤵
  PID:8660
- C:\Windows\System\xVostfu.exe
  C:\Windows\System\xVostfu.exe
  2⤵
  PID:8680
- C:\Windows\System\IrMGQoM.exe
  C:\Windows\System\IrMGQoM.exe
  2⤵
  PID:8696
- C:\Windows\System\edchBRM.exe
  C:\Windows\System\edchBRM.exe
  2⤵
  PID:8712
- C:\Windows\System\WQxVFnM.exe
  C:\Windows\System\WQxVFnM.exe
  2⤵
  PID:8732
- C:\Windows\System\SvePofM.exe
  C:\Windows\System\SvePofM.exe
  2⤵
  PID:8748
- C:\Windows\System\Orhduth.exe
  C:\Windows\System\Orhduth.exe
  2⤵
  PID:8768
- C:\Windows\System\gLVLMRC.exe
  C:\Windows\System\gLVLMRC.exe
  2⤵
  PID:8784
- C:\Windows\System\cQbBFbz.exe
  C:\Windows\System\cQbBFbz.exe
  2⤵
  PID:8800
- C:\Windows\System\zQXCDtp.exe
  C:\Windows\System\zQXCDtp.exe
  2⤵
  PID:8820
- C:\Windows\System\OZSXQQw.exe
  C:\Windows\System\OZSXQQw.exe
  2⤵
  PID:8868
- C:\Windows\System\zxINNxZ.exe
  C:\Windows\System\zxINNxZ.exe
  2⤵
  PID:8884
- C:\Windows\System\aWceRLT.exe
  C:\Windows\System\aWceRLT.exe
  2⤵
  PID:8900
- C:\Windows\System\NtPWDqN.exe
  C:\Windows\System\NtPWDqN.exe
  2⤵
  PID:8920
- C:\Windows\System\flQrIVT.exe
  C:\Windows\System\flQrIVT.exe
  2⤵
  PID:8936
- C:\Windows\System\gouSCCB.exe
  C:\Windows\System\gouSCCB.exe
  2⤵
  PID:8968
- C:\Windows\System\YHLNeBc.exe
  C:\Windows\System\YHLNeBc.exe
  2⤵
  PID:8984
- C:\Windows\System\BiemCGY.exe
  C:\Windows\System\BiemCGY.exe
  2⤵
  PID:9000
- C:\Windows\System\MyZWkGv.exe
  C:\Windows\System\MyZWkGv.exe
  2⤵
  PID:9016
- C:\Windows\System\ShjmZvC.exe
  C:\Windows\System\ShjmZvC.exe
  2⤵
  PID:9044
- C:\Windows\System\PhvZmSn.exe
  C:\Windows\System\PhvZmSn.exe
  2⤵
  PID:9072
- C:\Windows\System\mrACETj.exe
  C:\Windows\System\mrACETj.exe
  2⤵
  PID:9088
- C:\Windows\System\uMMCWoy.exe
  C:\Windows\System\uMMCWoy.exe
  2⤵
  PID:9104
- C:\Windows\System\NBbeuxy.exe
  C:\Windows\System\NBbeuxy.exe
  2⤵
  PID:9120
- C:\Windows\System\OAECUGQ.exe
  C:\Windows\System\OAECUGQ.exe
  2⤵
  PID:9140
- C:\Windows\System\NRajyuN.exe
  C:\Windows\System\NRajyuN.exe
  2⤵
  PID:9156
- C:\Windows\System\RvzwLLw.exe
  C:\Windows\System\RvzwLLw.exe
  2⤵
  PID:9176
- C:\Windows\System\puNETaS.exe
  C:\Windows\System\puNETaS.exe
  2⤵
  PID:9192
- C:\Windows\System\sPxEbJD.exe
  C:\Windows\System\sPxEbJD.exe
  2⤵
  PID:9208
- C:\Windows\System\kxkIeUP.exe
  C:\Windows\System\kxkIeUP.exe
  2⤵
  PID:7768
- C:\Windows\System\wNBvrSh.exe
  C:\Windows\System\wNBvrSh.exe
  2⤵
  PID:7296
- C:\Windows\System\VTwWGof.exe
  C:\Windows\System\VTwWGof.exe
  2⤵
  PID:7916
- C:\Windows\System\BFFJmhB.exe
  C:\Windows\System\BFFJmhB.exe
  2⤵
  PID:7932
- C:\Windows\System\VzHtInK.exe
  C:\Windows\System\VzHtInK.exe
  2⤵
  PID:8204
- C:\Windows\System\oVSxhMN.exe
  C:\Windows\System\oVSxhMN.exe
  2⤵
  PID:8244
- C:\Windows\System\ldITccX.exe
  C:\Windows\System\ldITccX.exe
  2⤵
  PID:7868
- C:\Windows\System\XyaJRMq.exe
  C:\Windows\System\XyaJRMq.exe
  2⤵
  PID:8264
- C:\Windows\System\KRFhhGp.exe
  C:\Windows\System\KRFhhGp.exe
  2⤵
  PID:8304
- C:\Windows\System\tYvDzVB.exe
  C:\Windows\System\tYvDzVB.exe
  2⤵
  PID:8340
- C:\Windows\System\cbxPEom.exe
  C:\Windows\System\cbxPEom.exe
  2⤵
  PID:8324
- C:\Windows\System\xdpTJgg.exe
  C:\Windows\System\xdpTJgg.exe
  2⤵
  PID:8388
- C:\Windows\System\uJMfdAW.exe
  C:\Windows\System\uJMfdAW.exe
  2⤵
  PID:8396
- C:\Windows\System\tobTVsy.exe
  C:\Windows\System\tobTVsy.exe
  2⤵
  PID:8436
- C:\Windows\System\jmCUwBa.exe
  C:\Windows\System\jmCUwBa.exe
  2⤵
  PID:8472
- C:\Windows\System\WruIwaz.exe
  C:\Windows\System\WruIwaz.exe
  2⤵
  PID:8592
- C:\Windows\System\rqONztQ.exe
  C:\Windows\System\rqONztQ.exe
  2⤵
  PID:8616
- C:\Windows\System\jtYVkAZ.exe
  C:\Windows\System\jtYVkAZ.exe
  2⤵
  PID:8632
- C:\Windows\System\tfWgjiT.exe
  C:\Windows\System\tfWgjiT.exe
  2⤵
  PID:8676
- C:\Windows\System\zRfAprD.exe
  C:\Windows\System\zRfAprD.exe
  2⤵
  PID:8740
- C:\Windows\System\sPJOeGj.exe
  C:\Windows\System\sPJOeGj.exe
  2⤵
  PID:8812
- C:\Windows\System\fkUaRCE.exe
  C:\Windows\System\fkUaRCE.exe
  2⤵
  PID:8688
- C:\Windows\System\NeDFpkz.exe
  C:\Windows\System\NeDFpkz.exe
  2⤵
  PID:8828
- C:\Windows\System\rndyxXN.exe
  C:\Windows\System\rndyxXN.exe
  2⤵
  PID:8724
- C:\Windows\System\DNatCaG.exe
  C:\Windows\System\DNatCaG.exe
  2⤵
  PID:8840
- C:\Windows\System\zCfwxhn.exe
  C:\Windows\System\zCfwxhn.exe
  2⤵
  PID:8860
- C:\Windows\System\FXwtGuD.exe
  C:\Windows\System\FXwtGuD.exe
  2⤵
  PID:8912
- C:\Windows\System\UsjdWji.exe
  C:\Windows\System\UsjdWji.exe
  2⤵
  PID:8932
- C:\Windows\System\aFIzyFD.exe
  C:\Windows\System\aFIzyFD.exe
  2⤵
  PID:8952
- C:\Windows\System\dBPJmBz.exe
  C:\Windows\System\dBPJmBz.exe
  2⤵
  PID:9032
- C:\Windows\System\emrHQSP.exe
  C:\Windows\System\emrHQSP.exe
  2⤵
  PID:9052
- C:\Windows\System\nHMZraR.exe
  C:\Windows\System\nHMZraR.exe
  2⤵
  PID:8956
- C:\Windows\System\CSOhXFr.exe
  C:\Windows\System\CSOhXFr.exe
  2⤵
  PID:9184
- C:\Windows\System\wYJDVQS.exe
  C:\Windows\System\wYJDVQS.exe
  2⤵
  PID:6716
- C:\Windows\System\ERYwlaQ.exe
  C:\Windows\System\ERYwlaQ.exe
  2⤵
  PID:8052
- C:\Windows\System\umdrKKm.exe
  C:\Windows\System\umdrKKm.exe
  2⤵
  PID:8292
- C:\Windows\System\LLdrURc.exe
  C:\Windows\System\LLdrURc.exe
  2⤵
  PID:8468
- C:\Windows\System\FRgSBqx.exe
  C:\Windows\System\FRgSBqx.exe
  2⤵
  PID:8500
- C:\Windows\System\Adtxqgl.exe
  C:\Windows\System\Adtxqgl.exe
  2⤵
  PID:8432
- C:\Windows\System\rUqhiuy.exe
  C:\Windows\System\rUqhiuy.exe
  2⤵
  PID:8604
- C:\Windows\System\GldURvh.exe
  C:\Windows\System\GldURvh.exe
  2⤵
  PID:8308
- C:\Windows\System\NxbJMGe.exe
  C:\Windows\System\NxbJMGe.exe
  2⤵
  PID:8184
- C:\Windows\System\MAcrBpM.exe
  C:\Windows\System\MAcrBpM.exe
  2⤵
  PID:9200
- C:\Windows\System\gwRVRkq.exe
  C:\Windows\System\gwRVRkq.exe
  2⤵
  PID:8588
- C:\Windows\System\oXmZGCr.exe
  C:\Windows\System\oXmZGCr.exe
  2⤵
  PID:8516
- C:\Windows\System\NBxgElv.exe
  C:\Windows\System\NBxgElv.exe
  2⤵
  PID:8520
- C:\Windows\System\UfSkDqz.exe
  C:\Windows\System\UfSkDqz.exe
  2⤵
  PID:8528
- C:\Windows\System\panGNvC.exe
  C:\Windows\System\panGNvC.exe
  2⤵
  PID:8776
- C:\Windows\System\AAsHwuM.exe
  C:\Windows\System\AAsHwuM.exe
  2⤵
  PID:8620
- C:\Windows\System\GVnKCQR.exe
  C:\Windows\System\GVnKCQR.exe
  2⤵
  PID:9028
- C:\Windows\System\SIfPmso.exe
  C:\Windows\System\SIfPmso.exe
  2⤵
  PID:8964
- C:\Windows\System\gBahCZc.exe
  C:\Windows\System\gBahCZc.exe
  2⤵
  PID:8756
- C:\Windows\System\htJaRnz.exe
  C:\Windows\System\htJaRnz.exe
  2⤵
  PID:8916
- C:\Windows\System\ceqGUGO.exe
  C:\Windows\System\ceqGUGO.exe
  2⤵
  PID:9012
- C:\Windows\System\aOVmWLW.exe
  C:\Windows\System\aOVmWLW.exe
  2⤵
  PID:9064
- C:\Windows\System\PGkJIjL.exe
  C:\Windows\System\PGkJIjL.exe
  2⤵
  PID:9112
- C:\Windows\System\NNaDZEa.exe
  C:\Windows\System\NNaDZEa.exe
  2⤵
  PID:7524
- C:\Windows\System\eSmkmyW.exe
  C:\Windows\System\eSmkmyW.exe
  2⤵
  PID:8272
- C:\Windows\System\SxHPaLL.exe
  C:\Windows\System\SxHPaLL.exe
  2⤵
  PID:8420
- C:\Windows\System\qUVIira.exe
  C:\Windows\System\qUVIira.exe
  2⤵
  PID:8240
- C:\Windows\System\PxiKZwn.exe
  C:\Windows\System\PxiKZwn.exe
  2⤵
  PID:8504
- C:\Windows\System\zPBFRoE.exe
  C:\Windows\System\zPBFRoE.exe
  2⤵
  PID:8808
- C:\Windows\System\lmddaBA.exe
  C:\Windows\System\lmddaBA.exe
  2⤵
  PID:7236
- C:\Windows\System\TuZtaca.exe
  C:\Windows\System\TuZtaca.exe
  2⤵
  PID:8780
- C:\Windows\System\lmoEzle.exe
  C:\Windows\System\lmoEzle.exe
  2⤵
  PID:9168
- C:\Windows\System\roEsDUk.exe
  C:\Windows\System\roEsDUk.exe
  2⤵
  PID:8796
- C:\Windows\System\teniaOu.exe
  C:\Windows\System\teniaOu.exe
  2⤵
  PID:8948
- C:\Windows\System\lARQuFI.exe
  C:\Windows\System\lARQuFI.exe
  2⤵
  PID:9080
- C:\Windows\System\oWSsCcc.exe
  C:\Windows\System\oWSsCcc.exe
  2⤵
  PID:8852
- C:\Windows\System\XQQggYU.exe
  C:\Windows\System\XQQggYU.exe
  2⤵
  PID:8704
- C:\Windows\System\INmVyAp.exe
  C:\Windows\System\INmVyAp.exe
  2⤵
  PID:7840
- C:\Windows\System\FeosAZu.exe
  C:\Windows\System\FeosAZu.exe
  2⤵
  PID:8708
- C:\Windows\System\lGQYiWq.exe
  C:\Windows\System\lGQYiWq.exe
  2⤵
  PID:8412
- C:\Windows\System\zzwfAga.exe
  C:\Windows\System\zzwfAga.exe
  2⤵
  PID:9224
- C:\Windows\System\YbYIJsB.exe
  C:\Windows\System\YbYIJsB.exe
  2⤵
  PID:9240
- C:\Windows\System\JdclOqB.exe
  C:\Windows\System\JdclOqB.exe
  2⤵
  PID:9260
- C:\Windows\System\ngTwdqu.exe
  C:\Windows\System\ngTwdqu.exe
  2⤵
  PID:9276
- C:\Windows\System\cnilyIF.exe
  C:\Windows\System\cnilyIF.exe
  2⤵
  PID:9292
- C:\Windows\System\WGfcVJr.exe
  C:\Windows\System\WGfcVJr.exe
  2⤵
  PID:9312
- C:\Windows\System\kKdttaz.exe
  C:\Windows\System\kKdttaz.exe
  2⤵
  PID:9328
- C:\Windows\System\LlFRygV.exe
  C:\Windows\System\LlFRygV.exe
  2⤵
  PID:9344
- C:\Windows\System\ehEzDwA.exe
  C:\Windows\System\ehEzDwA.exe
  2⤵
  PID:9364
- C:\Windows\System\MTpcRBt.exe
  C:\Windows\System\MTpcRBt.exe
  2⤵
  PID:9380
- C:\Windows\System\INpYVmf.exe
  C:\Windows\System\INpYVmf.exe
  2⤵
  PID:9444
- C:\Windows\System\GYLnApm.exe
  C:\Windows\System\GYLnApm.exe
  2⤵
  PID:9460
- C:\Windows\System\swmRbcO.exe
  C:\Windows\System\swmRbcO.exe
  2⤵
  PID:9476
- C:\Windows\System\UfpDXhp.exe
  C:\Windows\System\UfpDXhp.exe
  2⤵
  PID:9492
- C:\Windows\System\cUjWSaH.exe
  C:\Windows\System\cUjWSaH.exe
  2⤵
  PID:9508
- C:\Windows\System\NaUHcqd.exe
  C:\Windows\System\NaUHcqd.exe
  2⤵
  PID:9524
- C:\Windows\System\VFMPcZf.exe
  C:\Windows\System\VFMPcZf.exe
  2⤵
  PID:9544
- C:\Windows\System\ZSYcSgk.exe
  C:\Windows\System\ZSYcSgk.exe
  2⤵
  PID:9564
- C:\Windows\System\HzImdId.exe
  C:\Windows\System\HzImdId.exe
  2⤵
  PID:9584
- C:\Windows\System\IhYdGED.exe
  C:\Windows\System\IhYdGED.exe
  2⤵
  PID:9600
- C:\Windows\System\udwrzeo.exe
  C:\Windows\System\udwrzeo.exe
  2⤵
  PID:9616
- C:\Windows\System\nMaARAU.exe
  C:\Windows\System\nMaARAU.exe
  2⤵
  PID:9640
- C:\Windows\System\tIAcCBE.exe
  C:\Windows\System\tIAcCBE.exe
  2⤵
  PID:9656
- C:\Windows\System\ghDgKzk.exe
  C:\Windows\System\ghDgKzk.exe
  2⤵
  PID:9672
- C:\Windows\System\fedKpnL.exe
  C:\Windows\System\fedKpnL.exe
  2⤵
  PID:9688
- C:\Windows\System\BIxEAOi.exe
  C:\Windows\System\BIxEAOi.exe
  2⤵
  PID:9708
- C:\Windows\System\wHHmMVR.exe
  C:\Windows\System\wHHmMVR.exe
  2⤵
  PID:9724
- C:\Windows\System\VzLzlhR.exe
  C:\Windows\System\VzLzlhR.exe
  2⤵
  PID:9740
- C:\Windows\System\oRQcGID.exe
  C:\Windows\System\oRQcGID.exe
  2⤵
  PID:9756
- C:\Windows\System\HFPVdMJ.exe
  C:\Windows\System\HFPVdMJ.exe
  2⤵
  PID:9776
- C:\Windows\System\ylOTrFE.exe
  C:\Windows\System\ylOTrFE.exe
  2⤵
  PID:9792
- C:\Windows\System\IYPQeSX.exe
  C:\Windows\System\IYPQeSX.exe
  2⤵
  PID:9808
- C:\Windows\System\aneFkIq.exe
  C:\Windows\System\aneFkIq.exe
  2⤵
  PID:9824
- C:\Windows\System\PnbWWYr.exe
  C:\Windows\System\PnbWWYr.exe
  2⤵
  PID:9840
- C:\Windows\System\YAYBvnZ.exe
  C:\Windows\System\YAYBvnZ.exe
  2⤵
  PID:9860
- C:\Windows\System\FCaBwAF.exe
  C:\Windows\System\FCaBwAF.exe
  2⤵
  PID:9876
- C:\Windows\System\WzHcNtW.exe
  C:\Windows\System\WzHcNtW.exe
  2⤵
  PID:9892
- C:\Windows\System\ytRIDVf.exe
  C:\Windows\System\ytRIDVf.exe
  2⤵
  PID:9908
- C:\Windows\System\aEmYayT.exe
  C:\Windows\System\aEmYayT.exe
  2⤵
  PID:9924
- C:\Windows\System\AARjBCw.exe
  C:\Windows\System\AARjBCw.exe
  2⤵
  PID:9940
- C:\Windows\System\SpwKrVe.exe
  C:\Windows\System\SpwKrVe.exe
  2⤵
  PID:9956
- C:\Windows\System\ftUfDqN.exe
  C:\Windows\System\ftUfDqN.exe
  2⤵
  PID:9976
- C:\Windows\System\QQjZlmL.exe
  C:\Windows\System\QQjZlmL.exe
  2⤵
  PID:9992
- C:\Windows\System\RoqrDhN.exe
  C:\Windows\System\RoqrDhN.exe
  2⤵
  PID:10008
- C:\Windows\System\DPdBvyX.exe
  C:\Windows\System\DPdBvyX.exe
  2⤵
  PID:10024
- C:\Windows\System\VewKEVa.exe
  C:\Windows\System\VewKEVa.exe
  2⤵
  PID:10044
- C:\Windows\System\xZLQzEw.exe
  C:\Windows\System\xZLQzEw.exe
  2⤵
  PID:10064
- C:\Windows\System\SZXGTdF.exe
  C:\Windows\System\SZXGTdF.exe
  2⤵
  PID:10080
- C:\Windows\System\mPqPoEB.exe
  C:\Windows\System\mPqPoEB.exe
  2⤵
  PID:10096
- C:\Windows\System\VaaPuRm.exe
  C:\Windows\System\VaaPuRm.exe
  2⤵
  PID:10112
- C:\Windows\System\tXIjudS.exe
  C:\Windows\System\tXIjudS.exe
  2⤵
  PID:10128
- C:\Windows\System\JVPqCQh.exe
  C:\Windows\System\JVPqCQh.exe
  2⤵
  PID:10144
- C:\Windows\System\HylkaZJ.exe
  C:\Windows\System\HylkaZJ.exe
  2⤵
  PID:10160
- C:\Windows\System\MhHKGnq.exe
  C:\Windows\System\MhHKGnq.exe
  2⤵
  PID:10176
- C:\Windows\System\VOpxKSu.exe
  C:\Windows\System\VOpxKSu.exe
  2⤵
  PID:10192
- C:\Windows\System\vmymwNy.exe
  C:\Windows\System\vmymwNy.exe
  2⤵
  PID:10208
- C:\Windows\System\hHUWEJL.exe
  C:\Windows\System\hHUWEJL.exe
  2⤵
  PID:10224
- C:\Windows\System\HfipmTv.exe
  C:\Windows\System\HfipmTv.exe
  2⤵
  PID:8880
- C:\Windows\System\cemIfHq.exe
  C:\Windows\System\cemIfHq.exe
  2⤵
  PID:8392
- C:\Windows\System\wUjsKCA.exe
  C:\Windows\System\wUjsKCA.exe
  2⤵
  PID:8532
- C:\Windows\System\jdVxcXZ.exe
  C:\Windows\System\jdVxcXZ.exe
  2⤵
  PID:8212
- C:\Windows\System\mscAflP.exe
  C:\Windows\System\mscAflP.exe
  2⤵
  PID:9164
- C:\Windows\System\RsOSPSk.exe
  C:\Windows\System\RsOSPSk.exe
  2⤵
  PID:9388
- C:\Windows\System\DQGlnVh.exe
  C:\Windows\System\DQGlnVh.exe
  2⤵
  PID:9324
- C:\Windows\System\NfFbLtG.exe
  C:\Windows\System\NfFbLtG.exe
  2⤵
  PID:9252
- C:\Windows\System\JdqIeHw.exe
  C:\Windows\System\JdqIeHw.exe
  2⤵
  PID:8892
- C:\Windows\System\eRHvFeF.exe
  C:\Windows\System\eRHvFeF.exe
  2⤵
  PID:8836
- C:\Windows\System\YLLuflt.exe
  C:\Windows\System\YLLuflt.exe
  2⤵
  PID:9404
- C:\Windows\System\EYrKike.exe
  C:\Windows\System\EYrKike.exe
  2⤵
  PID:9420
- C:\Windows\System\yJhtwGb.exe
  C:\Windows\System\yJhtwGb.exe
  2⤵
  PID:9432
- C:\Windows\System\wjbERxR.exe
  C:\Windows\System\wjbERxR.exe
  2⤵
  PID:9232
- C:\Windows\System\pGYFpeI.exe
  C:\Windows\System\pGYFpeI.exe
  2⤵
  PID:9148
- C:\Windows\System\tglNYCv.exe
  C:\Windows\System\tglNYCv.exe
  2⤵
  PID:9236
- C:\Windows\System\mNkUDFM.exe
  C:\Windows\System\mNkUDFM.exe
  2⤵
  PID:8336
- C:\Windows\System\aVIAHmN.exe
  C:\Windows\System\aVIAHmN.exe
  2⤵
  PID:9484
- C:\Windows\System\slmcByL.exe
  C:\Windows\System\slmcByL.exe
  2⤵
  PID:9552
- C:\Windows\System\gLnjsxF.exe
  C:\Windows\System\gLnjsxF.exe
  2⤵
  PID:9788
- C:\Windows\System\QvJqjrC.exe
  C:\Windows\System\QvJqjrC.exe
  2⤵
  PID:9680
- C:\Windows\System\jUosfIX.exe
  C:\Windows\System\jUosfIX.exe
  2⤵
  PID:9748
- C:\Windows\System\JkswTnJ.exe
  C:\Windows\System\JkswTnJ.exe
  2⤵
  PID:9884
- C:\Windows\System\bsyGBTJ.exe
  C:\Windows\System\bsyGBTJ.exe
  2⤵
  PID:9920
- C:\Windows\System\TizByWr.exe
  C:\Windows\System\TizByWr.exe
  2⤵
  PID:9984
- C:\Windows\System\TqXbVLj.exe
  C:\Windows\System\TqXbVLj.exe
  2⤵
  PID:10032
- C:\Windows\System\ylxjQQm.exe
  C:\Windows\System\ylxjQQm.exe
  2⤵
  PID:10076
- C:\Windows\System\xmAwVHZ.exe
  C:\Windows\System\xmAwVHZ.exe
  2⤵
  PID:10136
- C:\Windows\System\hZfWFUx.exe
  C:\Windows\System\hZfWFUx.exe
  2⤵
  PID:10016
- C:\Windows\System\SrDFSDB.exe
  C:\Windows\System\SrDFSDB.exe
  2⤵
  PID:10088
- C:\Windows\System\bdLWtlD.exe
  C:\Windows\System\bdLWtlD.exe
  2⤵
  PID:10124
- C:\Windows\System\NldaIwY.exe
  C:\Windows\System\NldaIwY.exe
  2⤵
  PID:10188
- C:\Windows\System\IyiWOdR.exe
  C:\Windows\System\IyiWOdR.exe
  2⤵
  PID:10220
- C:\Windows\System\KnyWdqj.exe
  C:\Windows\System\KnyWdqj.exe
  2⤵
  PID:8668
- C:\Windows\System\LMqswSl.exe
  C:\Windows\System\LMqswSl.exe
  2⤵
  PID:9220
- C:\Windows\System\yjXIYdH.exe
  C:\Windows\System\yjXIYdH.exe
  2⤵
  PID:9336
- C:\Windows\System\pIeibqL.exe
  C:\Windows\System\pIeibqL.exe
  2⤵
  PID:8008
- C:\Windows\System\rIxIAEk.exe
  C:\Windows\System\rIxIAEk.exe
  2⤵
  PID:8612
- C:\Windows\System\ZhQSfha.exe
  C:\Windows\System\ZhQSfha.exe
  2⤵
  PID:9532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CYMoGgZ.exe

Filesize
1.6MB

MD5
f463352c10322d94518718a7c54f9970

SHA1
9b51ae1d454aee6e387fd5933f8d8a3f48ffbd1a

SHA256
6efb43755269c0308ad73e842a2da4f4253eb232c565d63c2f2c274313fc1449

SHA512
60b016c34f70cad0cde16ab6d492132cee35ca043c4ff84ba2787538cd07df60e37b8854de0b7de6ac4907c855f18da365386dd1ffa0f468ebaafa89ec32c1e5

Download Submit
C:\Windows\system\DIjLWgd.exe

Filesize
1.6MB

MD5
7a5cebf8f40e08172f052ebd31835f7a

SHA1
d4d04c6847a2804707bfa94e35be52176ee59bf1

SHA256
dba7824bac5b402ed9f23ed4324cb51fbb5b6e1149350edfbb4b3cf81b027ec1

SHA512
05da21bff6d6d001fe3131ac880c2285051eb01ba0e99b21eb90eebd0fec009eb15c8dcad6b7d62cf379d1471b946fc26bd77adeeff7d1fed8e838ae7f19f869

Download Submit
C:\Windows\system\DcIvnDi.exe

Filesize
1.6MB

MD5
2e80158e183808937383a94167faeccf

SHA1
2a38e587db8bd8d8d1e402b406de7ca36da2e217

SHA256
e74371253ed3f2140f7c30b336c6bc2c941d8fd5c2b4b180516b68065260539c

SHA512
8f101ddfa9cb21b0ea31d1240e68cd48ae027bf97da5ebc27328c7c2ef34adfc124ac8c02e364ed79b25d5fb98edb78fae0e9082c32be3b172210e8f15dcbd68

Download Submit
C:\Windows\system\GbvDlPr.exe

Filesize
1.6MB

MD5
ca587c5eae0095b45aa4a300f4913a32

SHA1
89e14c8f6d9bb5f9f19985b911f67daa9b30ae52

SHA256
6174d1bc1957bc2523600f04cb46232efca4227a196193e84db53de6e4b05b91

SHA512
1cf990382d83e8433f611d2027f415a125caa234ca92b876456f3d0926b89293be2b7f0e81121f7c70ac9d137d07d5d162d54929d101ac341a4abad37d170900

Download Submit
C:\Windows\system\HFlukTS.exe

Filesize
1.6MB

MD5
38b63ea7fef51b417e9dbeb2f91e597e

SHA1
3df2a6ca660a9ec07b1b40f527b2e2e8bdff1650

SHA256
fa74894a2dfe2999763a069d26d1919f3bf12d180caeef55c3860fd33055c8c5

SHA512
f29b6e2dd1586307cbb336166483f119bfc3bf413c38195614b9211def66f6a93a3ee23bc16328308babb3e331303e3917976d8242fb8e8602a2b0ab3e273539

Download Submit
C:\Windows\system\LEGekIh.exe

Filesize
1.6MB

MD5
78aad9d01d818c02b51a9efa17247910

SHA1
dec524fc2f7b360b6539c4a92c5128cc1693c28c

SHA256
ddcbd1a81e8e7bf2655646e6965c6a6fafa0e2adb6da3eb574d73f05113720a5

SHA512
2cd66269208ff2d31ca1e65632c3bff4705c8cea3acf8142da32b8f61b49447630379e7149ea211419bd4e702224817839722cfa877ee210983e743fcd5e64b1

Download Submit
C:\Windows\system\LnhFMeg.exe

Filesize
1.6MB

MD5
1f234c7853c1fef7a39006a7cf7af7f5

SHA1
d4fee529ec847ccb2a4fe51a09809d2150ad04e8

SHA256
ef11b5ddbb472b2af10294551a49d4d5cf9c66e457c7ceadf256562f1162ddbc

SHA512
da9e8eb813285df52d150f779486cb88415aa10ed143d24a09904a6b67197750907f3dd98087e9d804e7cc968a7dbcc919e1aacf070db44620952f66e4f5cbad

Download Submit
C:\Windows\system\NQfiOMk.exe

Filesize
1.6MB

MD5
1872c32019b27e0094efef3cb97f9f93

SHA1
b5fe0d4cf244903e5d506c48d75d3406bad88bb5

SHA256
4aa097c2ff53896d4902d7a186147cd98967cbb9bde5aedff6b764e6b1163c53

SHA512
c4b89aab9e29de3aaf27ce7584811d6c4733ed45870fe4536a63e357d3a0d5a7d1d3afc2a22ba362f5b7087b1cef755198ce695d18d7f2e740e980e37c2c3235

Download Submit
C:\Windows\system\NVRCjLm.exe

Filesize
1.6MB

MD5
65c8c8dc81ab78ebdd396918fcba41a8

SHA1
f00cd582a79cd10da78d12ba3bbbafec1ff682d9

SHA256
de7d6e9b7d00478297f1d3ff876fe57c91964d600d5e7e38457a4c151be0e514

SHA512
d56374a5d904037d5518062f1af88f15bf32ad010ae1f75cf36fd5b58f8e7cbaf193d4752d32f06c0bf9cc1dbd01f1cdff493f79a863cdbeef626fee91d52829

Download Submit
C:\Windows\system\NZTTTYJ.exe

Filesize
1.6MB

MD5
72d9cdaab1c59c251ddd9e7b14e3abec

SHA1
ac382586acf857fdcb63c9725c7777d81bb8b262

SHA256
5cb211c3ffd7d1c5e47fc48282a8e54c3f5186a3d2aad9121368ea63a46747ae

SHA512
98618267c645d14fc092481e96415d1cc1184531c4c21dc62d3e1f8b19fcdd67501348db2f9184a4c5c502b0a5b30b75c0863cd3d956e2f6d9f34452fa0d847b

Download Submit
C:\Windows\system\OiuTViI.exe

Filesize
1.6MB

MD5
6906145750ef4f74be950d18830cd361

SHA1
7961aa0bec93ab15b0e565b5775a445f5e455adb

SHA256
e899805d4567432da264cf09a1c11dc8935479f22bf1c0046c236c9b6e8a5aca

SHA512
4c6c19a89abac584a931bdb6b441613ff3a587db9c7ea21f6069ce9b7da8fb7318751d4044663a55119c4d554273c235057389f4ee7b7dbc49ad51ba0132cfb0

Download Submit
C:\Windows\system\RWEfDYY.exe

Filesize
1.6MB

MD5
a4d220f5d4ad0ccd6bbb7d21e908cefa

SHA1
109cd9e1d7c0f7641ce935a8b6b863eb1a981d49

SHA256
edf2b17f2d040fd67139eeb2e4eec3cf34327c0f77036eb5a4cb1b14877c30f2

SHA512
0dda497c096950002aa234d73fd8d2da8c12f6e9f43a3d11f490e70acc762e5451355fceae3053365d9faa50b327be4f80526fb3fb83a19f5d40cb1ae51343aa

Download Submit
C:\Windows\system\RYLsuAk.exe

Filesize
1.6MB

MD5
71bcf19643648af7f89c42a7c660d483

SHA1
cfa2cec19e9e18649f2c2a503d888b21281c4d9c

SHA256
a6dab3239a2a267ef4e49e1d671eab6d17a3fc6e8ac285fdd7378c89dbf49e63

SHA512
d67c82666604726faab32022fc5c213ccc226e73edd9ece6828327dfe3f34a8562f8f93256be140449be2a243ba1166bf4d90b7cceb48cb3c1f61df80f188a8e

Download Submit
C:\Windows\system\RnZSoxt.exe

Filesize
1.6MB

MD5
2ca6fece355da729d39bffb55c7aecf6

SHA1
1e3fe4015672c9144f801a7bb1da628c9babc960

SHA256
751e7cdb86640be6c6cbf22d59230705064b8ed46743606150cd68cb35292371

SHA512
aa80b91370efc523e2dfb0fa72827cb1f5a943b9a6d352cc7d7edcff31dd9315409cac499f5f8054a430e4f71ef7d7faa6278b627ace3a39338360a7ead9bd82

Download Submit
C:\Windows\system\UoTdJTK.exe

Filesize
1.6MB

MD5
43b855679090ea6b14b922648ed0c9a8

SHA1
390b17776ac4a598764a7f03c95d23faa48cd272

SHA256
8f7d1124d83981ec58f721780dbfe624eb05be16910be4c0494cda33845cc9c9

SHA512
cbf7c54aa6ddb49f36f4dc8d26cce9a5aeaf6d0fe1e6b02dda177964402cafdc43c1c158157864fd5db75d6ad764ea41ab06f84c7466cd982c94b87d40110f68

Download Submit
C:\Windows\system\UtgWOlS.exe

Filesize
1.6MB

MD5
2d39f1cb563b88d56b7dfc4ab692a735

SHA1
45ebd3caeb4a94598be3a041cec738226792f973

SHA256
a39fd23f76950cd112a065b1169181e7179111383b11d30e0537e292a403a996

SHA512
61d04c53315c5e7ef928917bfff15034169b604ce689a51537cb5e9d2498ab77743c5e695fa0f9bae319e572d632834ef6f4df50ae6affed6941f63e95d4a7df

Download Submit
C:\Windows\system\XDPFzzI.exe

Filesize
1.6MB

MD5
de093142bdea95dacbc5f7686673e62b

SHA1
43dc82916c3caa33352c9c5ca8598d6721cc8219

SHA256
fe74b97929986bbbbd9f52c263035b830e5c3ce42ad6cb09db827d00c6df640f

SHA512
5de8ed2728b7d09b30eabeaed47cac088685b964172d1434bddb01069199a15f1d46ce1f1ffa4ed4ab9d650a86f45e87c20ac0fbba0c875cb1cac09f6ea9f34d

Download Submit
C:\Windows\system\eRZsvaC.exe

Filesize
1.6MB

MD5
8adf652e1ee61befe51822a99e0a59d7

SHA1
5fac295e60044397bf8326244dab47a9fd1d1c95

SHA256
e4440ba1321323804b1b2e0ecb0990ac17f4ab12653e6aaabfc4b57c8d468752

SHA512
f81794ed08722ee2090a96eb428e8b00c309e8b73e58eca7aff896bc7605353b0f6c11234649d2d8eecca66d4dc18ef894abcca67f457813062b56524014d0d1

Download Submit
C:\Windows\system\evRvanM.exe

Filesize
1.6MB

MD5
30e2d01dea2d611609319607e3df2416

SHA1
7a291615f1c245ce49c79108265a5b6433163334

SHA256
1c2c846da55bcf995802c034a31e1dcf0a8427d5b49c2bd01049a9cf3c0a09b5

SHA512
3a3f03cfd7bb6261175bba7e94fb6e40b7642c39bbcefbd21fd2da23be6d10808e452946c3961bec18f60597103c394220607a114c3781267533d31b9267c8c3

Download Submit
C:\Windows\system\fVOsyCN.exe

Filesize
1.6MB

MD5
a7f27973ebeeb38294e0c99cdc88e19d

SHA1
d1b05182ad9a2d642d0c8d957519817d50df49a7

SHA256
a8215173f457fde67ab5230459dbcd2e811750d0f9cec1dd5068205d2cc45108

SHA512
f3646c3e58ad2f9a557c195c2bad30f26923e9122464519dabea1e6a2dbed089d96317ec8d1aefc524fd6d409bd10c414d58282c4592753f8505c01267032602

Download Submit
C:\Windows\system\fZkzprK.exe

Filesize
1.6MB

MD5
de6efbe9ff0cafb495245fce4617fa38

SHA1
aa8575b64eaa25bc99f5145ad7e3a19ee7c85c81

SHA256
6905dbc508ce4a05a1b689775fe72d2d30ae73d94a1c9e4e540f6527629053ee

SHA512
32b95c06fc235d72131b34170a5c263b300d269923194b293a1b9291092537019e06755a6e1933887c0df74bb50907bc9abce7509ad8649f48c0364d9a88dad1

Download Submit
C:\Windows\system\hBfflXa.exe

Filesize
1.6MB

MD5
152774de417a5a2b1e85bd179184d258

SHA1
3f6cafa3359dd9f632911c776fae8eb01f64f9c2

SHA256
72b66c246652d81094244879b847ff50520da1f0f752e06cb3ff68b0d12de8a4

SHA512
5940fda2b3bd41b64b561452d6e32262e38601bf514e3119c5d46bbc438241ba640cef69aa02f74a90fcf5778ecf2ca7d27568440be61487f751f2cbb47c332b

Download Submit
C:\Windows\system\kBAgnyy.exe

Filesize
1.6MB

MD5
3dc92d3a7e4f0905fbe9c88084f8b054

SHA1
e89bb50db7f923e97bd14c301e583932187511da

SHA256
f4d47bd57a279e4eae2b1614adb44377c32495e1e9d91929442ddfb63735bb9a

SHA512
19065a52ba8d99556ee7a867767ee797bd858485ba565eb267aafb35d7c96272479b4291067d46c8379b5a33fead833ac036e57df90534754a1a68ead14d33cf

Download Submit
C:\Windows\system\mFeFyJy.exe

Filesize
1.6MB

MD5
2d589ff1551d8d8d3ae6caf0a6178ab4

SHA1
3e214baafb58a5d824482f54ba3eb05e12628497

SHA256
76b3c1ff9ebf7fef9d4b9ca7cc666338233f2c2c79b02f542f67b47e4012bea8

SHA512
d561056b0bdc1c7c906d2853c90396c6888905a701e3bd503d694fcef75eeb6c5fc3503550bc91dda5e106c3c6c87efababb09041ea3f68fa8580709c14f7cdd

Download Submit
C:\Windows\system\mZPIfFV.exe

Filesize
1.6MB

MD5
d00259c429ac2e64813d8334fa0fed01

SHA1
d1a78a028e857d532c3b97e2da78cda7fde07e12

SHA256
5a4a3069b89f03598279f79af5e2bccec1a7c8a21accd39aed83f30e1b156a16

SHA512
06bc992998c2b20bc6fc95010e1648baf10ae1a2754ce9bf23d5016adc959fbcecd4ca2ed11c9483a12b5cca939394b78888a12064815a93dfc96caa45a38653

Download Submit
C:\Windows\system\sKoheHP.exe

Filesize
1.6MB

MD5
934099c2ffa0b4326dc63318d6ca2673

SHA1
de4d1919183ccf7dda5d2b887d23fd41f93ad02f

SHA256
3865790ac1112b3075ede934a702e478b6482b9cde4fb66b87d0f74e461f177f

SHA512
001bbd73a29247330ef9f78046e589ca80d33745cdc6890eaec7cee5387d2144281108c87c211106b677e8589eec69d93baaca450503c7b540177fc6d9602305

Download Submit
C:\Windows\system\yISNtgR.exe

Filesize
1.6MB

MD5
6e309f7e642ca1c7780a8a4d2dc70385

SHA1
daf8aeba996ba6d6407b06765a9d13ceb5e23056

SHA256
a4861bcaaab6220403477eaa681a85125a6b62cbd6e8a337a6495d2b71fc4b78

SHA512
058394e9c861c7c57f06f0fb5491fc5eb611e851a7a06733d6ea7f138a8103adfcc5bbca5f014cd891f87d3e223e79dc2ad54ed4ed04de500c28cea34f7fec7d

Download Submit
C:\Windows\system\yWriEZo.exe

Filesize
1.6MB

MD5
85f26d5d885c1e3f40eccb0dc52fbc53

SHA1
8737a088c502d5a1c5b7f471f3345c86d83bae80

SHA256
6562e0122fe54675c42505a9965a007780e145ea79a48a05f7de459130aef5e8

SHA512
aafa8c603434f33803654152b4138a2064b7415554898e4733c3a7fd7d0389e6abca2690dad54d723d9eec261542701e8ff69053994429ed1fa90d3acffa8b22

Download Submit
C:\Windows\system\yqzldtn.exe

Filesize
1.6MB

MD5
d2721039b1b412c335b9ad45b455b999

SHA1
3a9ea8095a9aa15effe626289797fd355358fef4

SHA256
5e3b3d6791b2b1b3bd7104c2e03c6eb7a2da1e4b86e90f428e0757e49bfe06fb

SHA512
8fe66f9a0c9762cbb9ac2030ba2c4c2062da123a320d932724493d85fadf4f0df0055352ba2fcb356565616f9a3d0c044c92988a608deb344b6c5378e2b43728

Download Submit
\Windows\system\MWuPtyV.exe

Filesize
1.6MB

MD5
66e20d0f733b3bbf9167d3a6aec0ae57

SHA1
78d2d4897f77aa1ffad9a1f3790f5b03c10172ef

SHA256
cf815312e6069180d7af63c84e50922000d1c7a5126ca0ab87634e37d34c7e3e

SHA512
6bbaf3445bbb080b953b511bb9ecb43e3d0570a0ca4dc0d5e0a93f935973ba7c3968427a3f991f52bde2e74e7282caf3a82810ef286cb67310e5cbb6b53c248e

Download Submit
\Windows\system\fwQLuZz.exe

Filesize
1.6MB

MD5
13952a7f1ef185bb53490ca03dd49161

SHA1
4f435efee40d80c86374444a7d4073ad4a1cba70

SHA256
ecb6c17110ee042b339f41e781efb3ef490da94c89264629cb8991578597d8f8

SHA512
a9b8b2799dc036ed5d56cc140d8f58253704ee2a52fbfde265b143111a29deab19c26fcf4aa182814f56df6411ddd4bbd82b81b5e0560e297f07adb32fdc2d81

Download Submit
\Windows\system\zHFVFip.exe

Filesize
1.6MB

MD5
7ca2b35b8992950ee1762a5bd6319807

SHA1
4c30273d25d7ba4006024c0dbc52b31967eeae14

SHA256
47e26e3de679cbdcd7c846d36a1355e7f0d32e48cbdf25ad79710425c70e0a90

SHA512
0ca04cd2daed12a00471f8a98a115d2b1a6a4a861b442d7f56ba9dc0bd83670c7df5a8218771866122bc988f542d33b578e2b66c4fbab55a715b5099a026fc49

Download Submit
memory/2264-302-0x000000013F4C0000-0x000000013F811000-memory.dmp

Filesize
3.3MB

Download
memory/2264-3854-0x000000013F4C0000-0x000000013F811000-memory.dmp

Filesize
3.3MB

Download
memory/2292-94-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/2292-3781-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/2296-116-0x000000013FFE0000-0x0000000140331000-memory.dmp

Filesize
3.3MB

Download
memory/2296-3786-0x000000013FFE0000-0x0000000140331000-memory.dmp

Filesize
3.3MB

Download
memory/2308-314-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2308-127-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/2308-66-0x000000013F810000-0x000000013FB61000-memory.dmp

Filesize
3.3MB

Download
memory/2308-315-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2308-99-0x000000013F0E0000-0x000000013F431000-memory.dmp

Filesize
3.3MB

Download
memory/2308-337-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2308-3514-0x000000013F8B0000-0x000000013FC01000-memory.dmp

Filesize
3.3MB

Download
memory/2308-3516-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2308-3513-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/2308-3322-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2308-3323-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2308-3317-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2308-8-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2308-57-0x000000013F440000-0x000000013F791000-memory.dmp

Filesize
3.3MB

Download
memory/2308-0-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2308-1856-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2308-117-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Filesize
3.3MB

Download
memory/2308-318-0x000000013F8B0000-0x000000013FC01000-memory.dmp

Filesize
3.3MB

Download
memory/2308-115-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2308-1-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/2308-317-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/2308-14-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2308-106-0x000000013F8D0000-0x000000013FC21000-memory.dmp

Filesize
3.3MB

Download
memory/2308-119-0x000000013F270000-0x000000013F5C1000-memory.dmp

Filesize
3.3MB

Download
memory/2464-126-0x000000013F8B0000-0x000000013FC01000-memory.dmp

Filesize
3.3MB

Download
memory/2464-3849-0x000000013F8B0000-0x000000013FC01000-memory.dmp

Filesize
3.3MB

Download
memory/2520-3850-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/2520-298-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3776-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2524-13-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2556-120-0x000000013F270000-0x000000013F5C1000-memory.dmp

Filesize
3.3MB

Download
memory/2556-3798-0x000000013F270000-0x000000013F5C1000-memory.dmp

Filesize
3.3MB

Download
memory/2560-114-0x000000013F8D0000-0x000000013FC21000-memory.dmp

Filesize
3.3MB

Download
memory/2560-3784-0x000000013F8D0000-0x000000013FC21000-memory.dmp

Filesize
3.3MB

Download
memory/2636-3779-0x000000013F810000-0x000000013FB61000-memory.dmp

Filesize
3.3MB

Download
memory/2636-316-0x000000013F810000-0x000000013FB61000-memory.dmp

Filesize
3.3MB

Download
memory/2644-24-0x000000013F440000-0x000000013F791000-memory.dmp

Filesize
3.3MB

Download
memory/2644-3774-0x000000013F440000-0x000000013F791000-memory.dmp

Filesize
3.3MB

Download
memory/2644-2616-0x000000013F440000-0x000000013F791000-memory.dmp

Filesize
3.3MB

Download
memory/2680-118-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Filesize
3.3MB

Download
memory/2680-3805-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-3783-0x000000013F0E0000-0x000000013F431000-memory.dmp

Filesize
3.3MB

Download
memory/2684-101-0x000000013F0E0000-0x000000013F431000-memory.dmp

Filesize
3.3MB

Download
memory/2912-3773-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2912-20-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download