xmrig | 874955419342b570b4be862fd51cecd5b6e31e1a5f30319b579ba79c93da38c5

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
Size

2.9MB
MD5

9552d8e6c7f3b0eb1809ebcf0f3df490
SHA1

675dfaef2517134cd093639082e2c22827ffea11
SHA256

874955419342b570b4be862fd51cecd5b6e31e1a5f30319b579ba79c93da38c5
SHA512

073bf1357bf70bd841d475ad6922117b1db2c805c67a3faf5f439c484c136bad2e9c7bc7a5755ca7d7139d064dfc1c3895b740b4d8ff4d795d54a5afe37a4d27
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16clf53q:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RL

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral1/memory/2416-0-0x000000013FA60000-0x000000013FE56000-memory.dmp	xmrig
behavioral1/files/0x000c00000001227f-3.dat	xmrig
behavioral1/files/0x0036000000015ce2-7.dat	xmrig
behavioral1/memory/2416-10-0x0000000002B90000-0x0000000002F86000-memory.dmp	xmrig
behavioral1/memory/2820-15-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	xmrig
behavioral1/files/0x0008000000015d13-20.dat	xmrig
behavioral1/files/0x0007000000015d42-33.dat	xmrig
behavioral1/files/0x000f000000003683-38.dat	xmrig
behavioral1/files/0x0008000000015de5-45.dat	xmrig
behavioral1/files/0x0006000000016d22-62.dat	xmrig
behavioral1/files/0x0006000000016d33-72.dat	xmrig
behavioral1/files/0x0006000000016d4c-87.dat	xmrig
behavioral1/files/0x0006000000016d44-82.dat	xmrig
behavioral1/memory/2580-108-0x000000013F650000-0x000000013FA46000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d55-92.dat	xmrig
behavioral1/files/0x0006000000016d70-127.dat	xmrig
behavioral1/files/0x0006000000016d78-136.dat	xmrig
behavioral1/memory/2416-2061-0x000000013FA60000-0x000000013FE56000-memory.dmp	xmrig
behavioral1/files/0x00060000000175e8-191.dat	xmrig
behavioral1/files/0x0006000000017568-186.dat	xmrig
behavioral1/files/0x00060000000173d6-181.dat	xmrig
behavioral1/files/0x00060000000173d3-176.dat	xmrig
behavioral1/files/0x00060000000173b4-171.dat	xmrig
behavioral1/files/0x000600000001720f-166.dat	xmrig
behavioral1/files/0x00060000000171ba-161.dat	xmrig
behavioral1/files/0x0006000000016dd1-156.dat	xmrig
behavioral1/files/0x0006000000016dc8-151.dat	xmrig
behavioral1/files/0x0006000000016db2-146.dat	xmrig
behavioral1/files/0x0006000000016da0-141.dat	xmrig
behavioral1/files/0x0036000000015cea-131.dat	xmrig
behavioral1/files/0x0006000000016d6c-122.dat	xmrig
behavioral1/memory/2772-120-0x000000013F330000-0x000000013F726000-memory.dmp	xmrig
behavioral1/memory/2244-118-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	xmrig
behavioral1/memory/2860-98-0x000000013FEA0000-0x0000000140296000-memory.dmp	xmrig
behavioral1/memory/2808-96-0x000000013F310000-0x000000013F706000-memory.dmp	xmrig
behavioral1/memory/2988-112-0x000000013F4F0000-0x000000013F8E6000-memory.dmp	xmrig
behavioral1/memory/2984-110-0x000000013F6A0000-0x000000013FA96000-memory.dmp	xmrig
behavioral1/memory/2520-106-0x000000013F6D0000-0x000000013FAC6000-memory.dmp	xmrig
behavioral1/memory/2684-104-0x000000013F5F0000-0x000000013F9E6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d68-102.dat	xmrig
behavioral1/files/0x0006000000016d3b-77.dat	xmrig
behavioral1/files/0x0006000000016d2b-67.dat	xmrig
behavioral1/files/0x0007000000016d1a-57.dat	xmrig
behavioral1/files/0x0008000000015f54-53.dat	xmrig
behavioral1/files/0x0008000000015d97-42.dat	xmrig
behavioral1/memory/2720-27-0x000000013F970000-0x000000013FD66000-memory.dmp	xmrig
behavioral1/memory/2308-16-0x000000013FCC0000-0x00000001400B6000-memory.dmp	xmrig
behavioral1/memory/2772-6376-0x000000013F330000-0x000000013F726000-memory.dmp	xmrig
behavioral1/memory/2244-6375-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2060	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2820	HBxmpfh.exe
2308	LJrvnhD.exe
2720	uSNisgK.exe
2808	SXjVqYs.exe
2860	rrxvDrO.exe
2684	iRvRzlx.exe
2520	tupQNGA.exe
2580	wsharLp.exe
2984	dGfKrVg.exe
2988	eVGMJaT.exe
2244	XiWOYue.exe
2772	HQyqHJe.exe
2864	hKUQbFT.exe
3000	HuiVBGX.exe
2340	QYmODdd.exe
756	idrOSOd.exe
1260	jdHUfQM.exe
304	Kpomhup.exe
2504	hNnDEqt.exe
280	dPcrvGU.exe
1612	zihwcti.exe
2320	zSJfCTS.exe
2496	IhyARfe.exe
664	UopMscu.exe
968	lLdJxgY.exe
580	yTstqBU.exe
492	tdDHzBN.exe
2612	qQvpqXD.exe
2476	StzZchu.exe
408	zKSxIJr.exe
1956	hxfzlDH.exe
1908	AhbkKYi.exe
1528	nLyfMBD.exe
1920	YGqaJVC.exe
1088	KFJfstC.exe
2324	HRMBBkE.exe
2964	LMaaqzN.exe
684	PjTeKAb.exe
936	NwHgZqI.exe
1148	nGuIurB.exe
2376	TebpFlE.exe
2144	vHDWuvs.exe
828	dJDbkyM.exe
3024	ZKyHgHQ.exe
2408	zaHlbEV.exe
1696	nxjPMLE.exe
2452	VhyaRSA.exe
2056	DFawLur.exe
2196	yJANTdG.exe
1564	ZQwnUel.exe
1596	gLkDNor.exe
2608	XjaOEyG.exe
2624	qtxsodw.exe
2728	DktQOnI.exe
2544	PgjQZWo.exe
2516	IUKkAne.exe
2636	bDyGtVw.exe
2336	wmGIPFm.exe
2840	pKtVHYM.exe
2692	QmBoFeS.exe
884	aoTNkLM.exe
1728	SqGQgpm.exe
2016	ycePxWm.exe
1692	IfclgPy.exe

Loads dropped DLL 64 IoCs

pid	Process
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2416-0-0x000000013FA60000-0x000000013FE56000-memory.dmp	upx
behavioral1/files/0x000c00000001227f-3.dat	upx
behavioral1/files/0x0036000000015ce2-7.dat	upx
behavioral1/memory/2416-10-0x0000000002B90000-0x0000000002F86000-memory.dmp	upx
behavioral1/memory/2820-15-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	upx
behavioral1/files/0x0008000000015d13-20.dat	upx
behavioral1/files/0x0007000000015d42-33.dat	upx
behavioral1/files/0x000f000000003683-38.dat	upx
behavioral1/files/0x0008000000015de5-45.dat	upx
behavioral1/files/0x0006000000016d22-62.dat	upx
behavioral1/files/0x0006000000016d33-72.dat	upx
behavioral1/files/0x0006000000016d4c-87.dat	upx
behavioral1/files/0x0006000000016d44-82.dat	upx
behavioral1/memory/2580-108-0x000000013F650000-0x000000013FA46000-memory.dmp	upx
behavioral1/files/0x0006000000016d55-92.dat	upx
behavioral1/files/0x0006000000016d70-127.dat	upx
behavioral1/files/0x0006000000016d78-136.dat	upx
behavioral1/memory/2416-2061-0x000000013FA60000-0x000000013FE56000-memory.dmp	upx
behavioral1/files/0x00060000000175e8-191.dat	upx
behavioral1/files/0x0006000000017568-186.dat	upx
behavioral1/files/0x00060000000173d6-181.dat	upx
behavioral1/files/0x00060000000173d3-176.dat	upx
behavioral1/files/0x00060000000173b4-171.dat	upx
behavioral1/files/0x000600000001720f-166.dat	upx
behavioral1/files/0x00060000000171ba-161.dat	upx
behavioral1/files/0x0006000000016dd1-156.dat	upx
behavioral1/files/0x0006000000016dc8-151.dat	upx
behavioral1/files/0x0006000000016db2-146.dat	upx
behavioral1/files/0x0006000000016da0-141.dat	upx
behavioral1/files/0x0036000000015cea-131.dat	upx
behavioral1/files/0x0006000000016d6c-122.dat	upx
behavioral1/memory/2772-120-0x000000013F330000-0x000000013F726000-memory.dmp	upx
behavioral1/memory/2244-118-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	upx
behavioral1/memory/2860-98-0x000000013FEA0000-0x0000000140296000-memory.dmp	upx
behavioral1/memory/2808-96-0x000000013F310000-0x000000013F706000-memory.dmp	upx
behavioral1/memory/2988-112-0x000000013F4F0000-0x000000013F8E6000-memory.dmp	upx
behavioral1/memory/2984-110-0x000000013F6A0000-0x000000013FA96000-memory.dmp	upx
behavioral1/memory/2520-106-0x000000013F6D0000-0x000000013FAC6000-memory.dmp	upx
behavioral1/memory/2684-104-0x000000013F5F0000-0x000000013F9E6000-memory.dmp	upx
behavioral1/files/0x0006000000016d68-102.dat	upx
behavioral1/files/0x0006000000016d3b-77.dat	upx
behavioral1/files/0x0006000000016d2b-67.dat	upx
behavioral1/files/0x0007000000016d1a-57.dat	upx
behavioral1/files/0x0008000000015f54-53.dat	upx
behavioral1/files/0x0008000000015d97-42.dat	upx
behavioral1/memory/2720-27-0x000000013F970000-0x000000013FD66000-memory.dmp	upx
behavioral1/memory/2308-16-0x000000013FCC0000-0x00000001400B6000-memory.dmp	upx
behavioral1/memory/2772-6376-0x000000013F330000-0x000000013F726000-memory.dmp	upx
behavioral1/memory/2244-6375-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HtuzYZh.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\IbXKcsq.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\eSVelij.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\oRDTcJv.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\YVkHQRE.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\UPgTApF.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\OUIuHSa.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\hnYcNUi.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\KoxtZDx.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\GjGNSEJ.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\ddrsxMY.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\rSpwyBZ.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\KOMjpSo.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\SVxYGUf.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\eVYsZYf.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\RPlZVap.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\NgEPNyz.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\UBCWYcd.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\oZgxczN.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\JPPRvXb.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\klmSUMX.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\vPIGiYd.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\uMOGZtE.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\hoijLgi.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\tkbFicn.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\HCrRHBJ.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\iPIerdw.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\wZeBgWh.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\EfcYYCe.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\HiRyUep.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\jwQhDag.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\QCIMuNh.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\DFLxGWN.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\ClZIxQZ.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\SkFSqTd.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\qybZelI.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\ZyFeFvv.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\vJbrcQe.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\vBlaBax.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\zGbgrXT.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\JmYcXwJ.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\YBWryBH.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\mmJGncM.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\XWcYvMC.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\tCUEprl.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\HpKIdzx.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\rMbTUAq.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\iIxlNOT.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\poXVcVq.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\yiMAbjH.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\GVTGrnq.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\yCRAAVW.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\MWoRuXp.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\FoMmdRn.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\ujiyemI.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\TtUnsUO.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\NFhAbwz.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\WuGRDLJ.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\XcfyadU.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\EBkcfND.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\RbtXerz.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\XSiNITI.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\ioeYUmo.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
File created	C:\Windows\System\dXBqNdK.exe	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2060	powershell.exe
2060	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
Token: SeDebugPrivilege	2060	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2060	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	29
PID 2416 wrote to memory of 2060	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	29
PID 2416 wrote to memory of 2060	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	29
PID 2416 wrote to memory of 2820	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	30
PID 2416 wrote to memory of 2820	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	30
PID 2416 wrote to memory of 2820	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	30
PID 2416 wrote to memory of 2308	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	31
PID 2416 wrote to memory of 2308	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	31
PID 2416 wrote to memory of 2308	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	31
PID 2416 wrote to memory of 2720	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	32
PID 2416 wrote to memory of 2720	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	32
PID 2416 wrote to memory of 2720	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	32
PID 2416 wrote to memory of 2808	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	33
PID 2416 wrote to memory of 2808	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	33
PID 2416 wrote to memory of 2808	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	33
PID 2416 wrote to memory of 2860	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	34
PID 2416 wrote to memory of 2860	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	34
PID 2416 wrote to memory of 2860	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	34
PID 2416 wrote to memory of 2684	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	35
PID 2416 wrote to memory of 2684	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	35
PID 2416 wrote to memory of 2684	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	35
PID 2416 wrote to memory of 2520	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	36
PID 2416 wrote to memory of 2520	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	36
PID 2416 wrote to memory of 2520	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	36
PID 2416 wrote to memory of 2580	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	37
PID 2416 wrote to memory of 2580	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	37
PID 2416 wrote to memory of 2580	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	37
PID 2416 wrote to memory of 2984	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	38
PID 2416 wrote to memory of 2984	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	38
PID 2416 wrote to memory of 2984	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	38
PID 2416 wrote to memory of 2988	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	39
PID 2416 wrote to memory of 2988	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	39
PID 2416 wrote to memory of 2988	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	39
PID 2416 wrote to memory of 2244	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	40
PID 2416 wrote to memory of 2244	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	40
PID 2416 wrote to memory of 2244	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	40
PID 2416 wrote to memory of 2772	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	41
PID 2416 wrote to memory of 2772	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	41
PID 2416 wrote to memory of 2772	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	41
PID 2416 wrote to memory of 2864	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	42
PID 2416 wrote to memory of 2864	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	42
PID 2416 wrote to memory of 2864	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	42
PID 2416 wrote to memory of 3000	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	43
PID 2416 wrote to memory of 3000	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	43
PID 2416 wrote to memory of 3000	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	43
PID 2416 wrote to memory of 2340	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	44
PID 2416 wrote to memory of 2340	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	44
PID 2416 wrote to memory of 2340	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	44
PID 2416 wrote to memory of 756	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	45
PID 2416 wrote to memory of 756	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	45
PID 2416 wrote to memory of 756	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	45
PID 2416 wrote to memory of 1260	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	46
PID 2416 wrote to memory of 1260	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	46
PID 2416 wrote to memory of 1260	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	46
PID 2416 wrote to memory of 304	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	47
PID 2416 wrote to memory of 304	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	47
PID 2416 wrote to memory of 304	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	47
PID 2416 wrote to memory of 2504	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	48
PID 2416 wrote to memory of 2504	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	48
PID 2416 wrote to memory of 2504	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	48
PID 2416 wrote to memory of 280	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	49
PID 2416 wrote to memory of 280	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	49
PID 2416 wrote to memory of 280	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	49
PID 2416 wrote to memory of 1612	2416	9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9552d8e6c7f3b0eb1809ebcf0f3df490_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\System\HBxmpfh.exe
  C:\Windows\System\HBxmpfh.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\LJrvnhD.exe
  C:\Windows\System\LJrvnhD.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\uSNisgK.exe
  C:\Windows\System\uSNisgK.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\SXjVqYs.exe
  C:\Windows\System\SXjVqYs.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\rrxvDrO.exe
  C:\Windows\System\rrxvDrO.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\iRvRzlx.exe
  C:\Windows\System\iRvRzlx.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\tupQNGA.exe
  C:\Windows\System\tupQNGA.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\wsharLp.exe
  C:\Windows\System\wsharLp.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\dGfKrVg.exe
  C:\Windows\System\dGfKrVg.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\eVGMJaT.exe
  C:\Windows\System\eVGMJaT.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\XiWOYue.exe
  C:\Windows\System\XiWOYue.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\HQyqHJe.exe
  C:\Windows\System\HQyqHJe.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\hKUQbFT.exe
  C:\Windows\System\hKUQbFT.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\HuiVBGX.exe
  C:\Windows\System\HuiVBGX.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\QYmODdd.exe
  C:\Windows\System\QYmODdd.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\idrOSOd.exe
  C:\Windows\System\idrOSOd.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\jdHUfQM.exe
  C:\Windows\System\jdHUfQM.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\Kpomhup.exe
  C:\Windows\System\Kpomhup.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\hNnDEqt.exe
  C:\Windows\System\hNnDEqt.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\dPcrvGU.exe
  C:\Windows\System\dPcrvGU.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\zihwcti.exe
  C:\Windows\System\zihwcti.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\zSJfCTS.exe
  C:\Windows\System\zSJfCTS.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\IhyARfe.exe
  C:\Windows\System\IhyARfe.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\UopMscu.exe
  C:\Windows\System\UopMscu.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\lLdJxgY.exe
  C:\Windows\System\lLdJxgY.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\yTstqBU.exe
  C:\Windows\System\yTstqBU.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\tdDHzBN.exe
  C:\Windows\System\tdDHzBN.exe
  2⤵
  - Executes dropped EXE
  PID:492
- C:\Windows\System\qQvpqXD.exe
  C:\Windows\System\qQvpqXD.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\StzZchu.exe
  C:\Windows\System\StzZchu.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\zKSxIJr.exe
  C:\Windows\System\zKSxIJr.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\hxfzlDH.exe
  C:\Windows\System\hxfzlDH.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\AhbkKYi.exe
  C:\Windows\System\AhbkKYi.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\nLyfMBD.exe
  C:\Windows\System\nLyfMBD.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\YGqaJVC.exe
  C:\Windows\System\YGqaJVC.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\KFJfstC.exe
  C:\Windows\System\KFJfstC.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\HRMBBkE.exe
  C:\Windows\System\HRMBBkE.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\LMaaqzN.exe
  C:\Windows\System\LMaaqzN.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\PjTeKAb.exe
  C:\Windows\System\PjTeKAb.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\NwHgZqI.exe
  C:\Windows\System\NwHgZqI.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\nGuIurB.exe
  C:\Windows\System\nGuIurB.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\TebpFlE.exe
  C:\Windows\System\TebpFlE.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\vHDWuvs.exe
  C:\Windows\System\vHDWuvs.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\dJDbkyM.exe
  C:\Windows\System\dJDbkyM.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\ZKyHgHQ.exe
  C:\Windows\System\ZKyHgHQ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\zaHlbEV.exe
  C:\Windows\System\zaHlbEV.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\nxjPMLE.exe
  C:\Windows\System\nxjPMLE.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\VhyaRSA.exe
  C:\Windows\System\VhyaRSA.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\DFawLur.exe
  C:\Windows\System\DFawLur.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\yJANTdG.exe
  C:\Windows\System\yJANTdG.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\ZQwnUel.exe
  C:\Windows\System\ZQwnUel.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\gLkDNor.exe
  C:\Windows\System\gLkDNor.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\XjaOEyG.exe
  C:\Windows\System\XjaOEyG.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\qtxsodw.exe
  C:\Windows\System\qtxsodw.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\DktQOnI.exe
  C:\Windows\System\DktQOnI.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\PgjQZWo.exe
  C:\Windows\System\PgjQZWo.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\IUKkAne.exe
  C:\Windows\System\IUKkAne.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\bDyGtVw.exe
  C:\Windows\System\bDyGtVw.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\wmGIPFm.exe
  C:\Windows\System\wmGIPFm.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\pKtVHYM.exe
  C:\Windows\System\pKtVHYM.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\QmBoFeS.exe
  C:\Windows\System\QmBoFeS.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\aoTNkLM.exe
  C:\Windows\System\aoTNkLM.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\SqGQgpm.exe
  C:\Windows\System\SqGQgpm.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\ycePxWm.exe
  C:\Windows\System\ycePxWm.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\IfclgPy.exe
  C:\Windows\System\IfclgPy.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\bygpjiL.exe
  C:\Windows\System\bygpjiL.exe
  2⤵
  PID:868
- C:\Windows\System\KMYnlys.exe
  C:\Windows\System\KMYnlys.exe
  2⤵
  PID:1236
- C:\Windows\System\nJuCtWx.exe
  C:\Windows\System\nJuCtWx.exe
  2⤵
  PID:1772
- C:\Windows\System\JKDENnH.exe
  C:\Windows\System\JKDENnH.exe
  2⤵
  PID:704
- C:\Windows\System\PnFyOrK.exe
  C:\Windows\System\PnFyOrK.exe
  2⤵
  PID:3064
- C:\Windows\System\AABvuEC.exe
  C:\Windows\System\AABvuEC.exe
  2⤵
  PID:1804
- C:\Windows\System\FgFUBvw.exe
  C:\Windows\System\FgFUBvw.exe
  2⤵
  PID:1076
- C:\Windows\System\cAuGJll.exe
  C:\Windows\System\cAuGJll.exe
  2⤵
  PID:2280
- C:\Windows\System\KTKtspH.exe
  C:\Windows\System\KTKtspH.exe
  2⤵
  PID:1660
- C:\Windows\System\VVkUpyM.exe
  C:\Windows\System\VVkUpyM.exe
  2⤵
  PID:1608
- C:\Windows\System\KigYcOz.exe
  C:\Windows\System\KigYcOz.exe
  2⤵
  PID:1600
- C:\Windows\System\hDAXvZI.exe
  C:\Windows\System\hDAXvZI.exe
  2⤵
  PID:600
- C:\Windows\System\OFhYkPt.exe
  C:\Windows\System\OFhYkPt.exe
  2⤵
  PID:2480
- C:\Windows\System\AQfOCyr.exe
  C:\Windows\System\AQfOCyr.exe
  2⤵
  PID:1964
- C:\Windows\System\gkcwBme.exe
  C:\Windows\System\gkcwBme.exe
  2⤵
  PID:2332
- C:\Windows\System\hckWCkt.exe
  C:\Windows\System\hckWCkt.exe
  2⤵
  PID:2152
- C:\Windows\System\DTBcSep.exe
  C:\Windows\System\DTBcSep.exe
  2⤵
  PID:876
- C:\Windows\System\anANSZK.exe
  C:\Windows\System\anANSZK.exe
  2⤵
  PID:2188
- C:\Windows\System\aekbZEd.exe
  C:\Windows\System\aekbZEd.exe
  2⤵
  PID:2600
- C:\Windows\System\vFQgFKY.exe
  C:\Windows\System\vFQgFKY.exe
  2⤵
  PID:2788
- C:\Windows\System\ETUZbmN.exe
  C:\Windows\System\ETUZbmN.exe
  2⤵
  PID:2696
- C:\Windows\System\mNlGiou.exe
  C:\Windows\System\mNlGiou.exe
  2⤵
  PID:2796
- C:\Windows\System\vluNfga.exe
  C:\Windows\System\vluNfga.exe
  2⤵
  PID:2792
- C:\Windows\System\JLJHMPd.exe
  C:\Windows\System\JLJHMPd.exe
  2⤵
  PID:2856
- C:\Windows\System\kpXqZAy.exe
  C:\Windows\System\kpXqZAy.exe
  2⤵
  PID:2996
- C:\Windows\System\rzmdVIm.exe
  C:\Windows\System\rzmdVIm.exe
  2⤵
  PID:836
- C:\Windows\System\GJxpywu.exe
  C:\Windows\System\GJxpywu.exe
  2⤵
  PID:2500
- C:\Windows\System\aEsYJfw.exe
  C:\Windows\System\aEsYJfw.exe
  2⤵
  PID:3092
- C:\Windows\System\IzPhLYT.exe
  C:\Windows\System\IzPhLYT.exe
  2⤵
  PID:3108
- C:\Windows\System\LtaZQRS.exe
  C:\Windows\System\LtaZQRS.exe
  2⤵
  PID:3132
- C:\Windows\System\Wunqpiw.exe
  C:\Windows\System\Wunqpiw.exe
  2⤵
  PID:3152
- C:\Windows\System\EmWvyCH.exe
  C:\Windows\System\EmWvyCH.exe
  2⤵
  PID:3172
- C:\Windows\System\fscaDcJ.exe
  C:\Windows\System\fscaDcJ.exe
  2⤵
  PID:3192
- C:\Windows\System\YVHupgk.exe
  C:\Windows\System\YVHupgk.exe
  2⤵
  PID:3212
- C:\Windows\System\xIlbjEe.exe
  C:\Windows\System\xIlbjEe.exe
  2⤵
  PID:3232
- C:\Windows\System\DzvDJsg.exe
  C:\Windows\System\DzvDJsg.exe
  2⤵
  PID:3252
- C:\Windows\System\LmxbdbJ.exe
  C:\Windows\System\LmxbdbJ.exe
  2⤵
  PID:3272
- C:\Windows\System\BdMEfbr.exe
  C:\Windows\System\BdMEfbr.exe
  2⤵
  PID:3292
- C:\Windows\System\pPwGAVJ.exe
  C:\Windows\System\pPwGAVJ.exe
  2⤵
  PID:3308
- C:\Windows\System\USLIWKJ.exe
  C:\Windows\System\USLIWKJ.exe
  2⤵
  PID:3328
- C:\Windows\System\PVzpdbo.exe
  C:\Windows\System\PVzpdbo.exe
  2⤵
  PID:3352
- C:\Windows\System\lJDkWTo.exe
  C:\Windows\System\lJDkWTo.exe
  2⤵
  PID:3372
- C:\Windows\System\DczTAqv.exe
  C:\Windows\System\DczTAqv.exe
  2⤵
  PID:3388
- C:\Windows\System\ZapTnpX.exe
  C:\Windows\System\ZapTnpX.exe
  2⤵
  PID:3412
- C:\Windows\System\JWJuqCj.exe
  C:\Windows\System\JWJuqCj.exe
  2⤵
  PID:3428
- C:\Windows\System\fQhypUd.exe
  C:\Windows\System\fQhypUd.exe
  2⤵
  PID:3448
- C:\Windows\System\xYnPDyB.exe
  C:\Windows\System\xYnPDyB.exe
  2⤵
  PID:3464
- C:\Windows\System\xeJUinC.exe
  C:\Windows\System\xeJUinC.exe
  2⤵
  PID:3492
- C:\Windows\System\nmJwwfT.exe
  C:\Windows\System\nmJwwfT.exe
  2⤵
  PID:3512
- C:\Windows\System\jSYTSrf.exe
  C:\Windows\System\jSYTSrf.exe
  2⤵
  PID:3532
- C:\Windows\System\vQZAYnE.exe
  C:\Windows\System\vQZAYnE.exe
  2⤵
  PID:3552
- C:\Windows\System\VMOzEzW.exe
  C:\Windows\System\VMOzEzW.exe
  2⤵
  PID:3572
- C:\Windows\System\vkxoQNG.exe
  C:\Windows\System\vkxoQNG.exe
  2⤵
  PID:3592
- C:\Windows\System\ynETwuj.exe
  C:\Windows\System\ynETwuj.exe
  2⤵
  PID:3612
- C:\Windows\System\JtvrftW.exe
  C:\Windows\System\JtvrftW.exe
  2⤵
  PID:3632
- C:\Windows\System\LgKgSES.exe
  C:\Windows\System\LgKgSES.exe
  2⤵
  PID:3652
- C:\Windows\System\oiNgIbQ.exe
  C:\Windows\System\oiNgIbQ.exe
  2⤵
  PID:3672
- C:\Windows\System\VQOeWfP.exe
  C:\Windows\System\VQOeWfP.exe
  2⤵
  PID:3692
- C:\Windows\System\iYhGWuM.exe
  C:\Windows\System\iYhGWuM.exe
  2⤵
  PID:3712
- C:\Windows\System\aLzpeoF.exe
  C:\Windows\System\aLzpeoF.exe
  2⤵
  PID:3732
- C:\Windows\System\JeDtyES.exe
  C:\Windows\System\JeDtyES.exe
  2⤵
  PID:3756
- C:\Windows\System\AafATyI.exe
  C:\Windows\System\AafATyI.exe
  2⤵
  PID:3776
- C:\Windows\System\TPqNZZr.exe
  C:\Windows\System\TPqNZZr.exe
  2⤵
  PID:3796
- C:\Windows\System\jiISdNu.exe
  C:\Windows\System\jiISdNu.exe
  2⤵
  PID:3816
- C:\Windows\System\fRxbANl.exe
  C:\Windows\System\fRxbANl.exe
  2⤵
  PID:3836
- C:\Windows\System\ILhgnuT.exe
  C:\Windows\System\ILhgnuT.exe
  2⤵
  PID:3856
- C:\Windows\System\opCWevR.exe
  C:\Windows\System\opCWevR.exe
  2⤵
  PID:3872
- C:\Windows\System\MfNFCyK.exe
  C:\Windows\System\MfNFCyK.exe
  2⤵
  PID:3892
- C:\Windows\System\Oytelql.exe
  C:\Windows\System\Oytelql.exe
  2⤵
  PID:3908
- C:\Windows\System\WJodQby.exe
  C:\Windows\System\WJodQby.exe
  2⤵
  PID:3928
- C:\Windows\System\boDaLIX.exe
  C:\Windows\System\boDaLIX.exe
  2⤵
  PID:3956
- C:\Windows\System\qMzbjWK.exe
  C:\Windows\System\qMzbjWK.exe
  2⤵
  PID:3972
- C:\Windows\System\UPfzINx.exe
  C:\Windows\System\UPfzINx.exe
  2⤵
  PID:3992
- C:\Windows\System\CxtYtMH.exe
  C:\Windows\System\CxtYtMH.exe
  2⤵
  PID:4012
- C:\Windows\System\QaycFpV.exe
  C:\Windows\System\QaycFpV.exe
  2⤵
  PID:4032
- C:\Windows\System\vEzUmRM.exe
  C:\Windows\System\vEzUmRM.exe
  2⤵
  PID:4048
- C:\Windows\System\pcKmWaE.exe
  C:\Windows\System\pcKmWaE.exe
  2⤵
  PID:4064
- C:\Windows\System\vwRuWNy.exe
  C:\Windows\System\vwRuWNy.exe
  2⤵
  PID:4092
- C:\Windows\System\AuEQtmQ.exe
  C:\Windows\System\AuEQtmQ.exe
  2⤵
  PID:748
- C:\Windows\System\DLoMRka.exe
  C:\Windows\System\DLoMRka.exe
  2⤵
  PID:2472
- C:\Windows\System\xyYOAcq.exe
  C:\Windows\System\xyYOAcq.exe
  2⤵
  PID:920
- C:\Windows\System\GpYZmiI.exe
  C:\Windows\System\GpYZmiI.exe
  2⤵
  PID:1352
- C:\Windows\System\uqZVykv.exe
  C:\Windows\System\uqZVykv.exe
  2⤵
  PID:640
- C:\Windows\System\asfguPU.exe
  C:\Windows\System\asfguPU.exe
  2⤵
  PID:2940
- C:\Windows\System\XpKbcJO.exe
  C:\Windows\System\XpKbcJO.exe
  2⤵
  PID:2936
- C:\Windows\System\pSvdhzx.exe
  C:\Windows\System\pSvdhzx.exe
  2⤵
  PID:1636
- C:\Windows\System\LKTBYBJ.exe
  C:\Windows\System\LKTBYBJ.exe
  2⤵
  PID:2100
- C:\Windows\System\SWNPRBd.exe
  C:\Windows\System\SWNPRBd.exe
  2⤵
  PID:1688
- C:\Windows\System\omDyoIE.exe
  C:\Windows\System\omDyoIE.exe
  2⤵
  PID:864
- C:\Windows\System\DHOpsRV.exe
  C:\Windows\System\DHOpsRV.exe
  2⤵
  PID:2688
- C:\Windows\System\myTtpyN.exe
  C:\Windows\System\myTtpyN.exe
  2⤵
  PID:2752
- C:\Windows\System\XbbfGEA.exe
  C:\Windows\System\XbbfGEA.exe
  2⤵
  PID:376
- C:\Windows\System\FlneDKV.exe
  C:\Windows\System\FlneDKV.exe
  2⤵
  PID:2240
- C:\Windows\System\cOwvOYO.exe
  C:\Windows\System\cOwvOYO.exe
  2⤵
  PID:1988
- C:\Windows\System\oZikGWM.exe
  C:\Windows\System\oZikGWM.exe
  2⤵
  PID:3124
- C:\Windows\System\GbQPTbz.exe
  C:\Windows\System\GbQPTbz.exe
  2⤵
  PID:3140
- C:\Windows\System\MeYLxrv.exe
  C:\Windows\System\MeYLxrv.exe
  2⤵
  PID:3184
- C:\Windows\System\rkUwuMo.exe
  C:\Windows\System\rkUwuMo.exe
  2⤵
  PID:3220
- C:\Windows\System\vjRQzej.exe
  C:\Windows\System\vjRQzej.exe
  2⤵
  PID:3244
- C:\Windows\System\qHwvAnH.exe
  C:\Windows\System\qHwvAnH.exe
  2⤵
  PID:3280
- C:\Windows\System\ljvdFZa.exe
  C:\Windows\System\ljvdFZa.exe
  2⤵
  PID:3324
- C:\Windows\System\fAOVxOf.exe
  C:\Windows\System\fAOVxOf.exe
  2⤵
  PID:3300
- C:\Windows\System\wQDOqQS.exe
  C:\Windows\System\wQDOqQS.exe
  2⤵
  PID:3396
- C:\Windows\System\ciXqzYD.exe
  C:\Windows\System\ciXqzYD.exe
  2⤵
  PID:3400
- C:\Windows\System\HxpltFI.exe
  C:\Windows\System\HxpltFI.exe
  2⤵
  PID:3472
- C:\Windows\System\dDeHbIe.exe
  C:\Windows\System\dDeHbIe.exe
  2⤵
  PID:3456
- C:\Windows\System\wSGZNwY.exe
  C:\Windows\System\wSGZNwY.exe
  2⤵
  PID:3500
- C:\Windows\System\dUdhsza.exe
  C:\Windows\System\dUdhsza.exe
  2⤵
  PID:3540
- C:\Windows\System\tdZgKLr.exe
  C:\Windows\System\tdZgKLr.exe
  2⤵
  PID:3564
- C:\Windows\System\EQgkVFS.exe
  C:\Windows\System\EQgkVFS.exe
  2⤵
  PID:1032
- C:\Windows\System\mBJAJaX.exe
  C:\Windows\System\mBJAJaX.exe
  2⤵
  PID:3620
- C:\Windows\System\ezXsKXx.exe
  C:\Windows\System\ezXsKXx.exe
  2⤵
  PID:3644
- C:\Windows\System\ZEPWERA.exe
  C:\Windows\System\ZEPWERA.exe
  2⤵
  PID:3664
- C:\Windows\System\DUHINlt.exe
  C:\Windows\System\DUHINlt.exe
  2⤵
  PID:3728
- C:\Windows\System\wAiyQUS.exe
  C:\Windows\System\wAiyQUS.exe
  2⤵
  PID:3764
- C:\Windows\System\AOPjWPe.exe
  C:\Windows\System\AOPjWPe.exe
  2⤵
  PID:3812
- C:\Windows\System\acNpZTB.exe
  C:\Windows\System\acNpZTB.exe
  2⤵
  PID:3852
- C:\Windows\System\ObdoxwG.exe
  C:\Windows\System\ObdoxwG.exe
  2⤵
  PID:3848
- C:\Windows\System\HAxxbYH.exe
  C:\Windows\System\HAxxbYH.exe
  2⤵
  PID:3916
- C:\Windows\System\VbWltfn.exe
  C:\Windows\System\VbWltfn.exe
  2⤵
  PID:3868
- C:\Windows\System\HYKiyqo.exe
  C:\Windows\System\HYKiyqo.exe
  2⤵
  PID:3948
- C:\Windows\System\krMKOOh.exe
  C:\Windows\System\krMKOOh.exe
  2⤵
  PID:4040
- C:\Windows\System\BWsASbN.exe
  C:\Windows\System\BWsASbN.exe
  2⤵
  PID:3988
- C:\Windows\System\RPKmjqj.exe
  C:\Windows\System\RPKmjqj.exe
  2⤵
  PID:4024
- C:\Windows\System\bparcGR.exe
  C:\Windows\System\bparcGR.exe
  2⤵
  PID:4060
- C:\Windows\System\XxWARXx.exe
  C:\Windows\System\XxWARXx.exe
  2⤵
  PID:976
- C:\Windows\System\xRLyQhP.exe
  C:\Windows\System\xRLyQhP.exe
  2⤵
  PID:1676
- C:\Windows\System\txpBilt.exe
  C:\Windows\System\txpBilt.exe
  2⤵
  PID:1860
- C:\Windows\System\kSMorEj.exe
  C:\Windows\System\kSMorEj.exe
  2⤵
  PID:1972
- C:\Windows\System\UqJKOAn.exe
  C:\Windows\System\UqJKOAn.exe
  2⤵
  PID:556
- C:\Windows\System\XMJQQaz.exe
  C:\Windows\System\XMJQQaz.exe
  2⤵
  PID:348
- C:\Windows\System\hudiaSp.exe
  C:\Windows\System\hudiaSp.exe
  2⤵
  PID:2900
- C:\Windows\System\oNlqljp.exe
  C:\Windows\System\oNlqljp.exe
  2⤵
  PID:2396
- C:\Windows\System\twZZUSK.exe
  C:\Windows\System\twZZUSK.exe
  2⤵
  PID:2296
- C:\Windows\System\VHrkQNO.exe
  C:\Windows\System\VHrkQNO.exe
  2⤵
  PID:3168
- C:\Windows\System\gpzBusY.exe
  C:\Windows\System\gpzBusY.exe
  2⤵
  PID:3208
- C:\Windows\System\OMJUDVi.exe
  C:\Windows\System\OMJUDVi.exe
  2⤵
  PID:3148
- C:\Windows\System\qZluyVA.exe
  C:\Windows\System\qZluyVA.exe
  2⤵
  PID:3264
- C:\Windows\System\IrLMCat.exe
  C:\Windows\System\IrLMCat.exe
  2⤵
  PID:3316
- C:\Windows\System\KWgBfOV.exe
  C:\Windows\System\KWgBfOV.exe
  2⤵
  PID:3344
- C:\Windows\System\bnTlkgd.exe
  C:\Windows\System\bnTlkgd.exe
  2⤵
  PID:3484
- C:\Windows\System\SmpCVoa.exe
  C:\Windows\System\SmpCVoa.exe
  2⤵
  PID:3424
- C:\Windows\System\WGaUAGx.exe
  C:\Windows\System\WGaUAGx.exe
  2⤵
  PID:3524
- C:\Windows\System\nuFrajQ.exe
  C:\Windows\System\nuFrajQ.exe
  2⤵
  PID:3560
- C:\Windows\System\zIFkdaS.exe
  C:\Windows\System\zIFkdaS.exe
  2⤵
  PID:3584
- C:\Windows\System\HTPvgeD.exe
  C:\Windows\System\HTPvgeD.exe
  2⤵
  PID:3700
- C:\Windows\System\VHKQofS.exe
  C:\Windows\System\VHKQofS.exe
  2⤵
  PID:3744
- C:\Windows\System\JGnjeXc.exe
  C:\Windows\System\JGnjeXc.exe
  2⤵
  PID:3740
- C:\Windows\System\aKUiFbU.exe
  C:\Windows\System\aKUiFbU.exe
  2⤵
  PID:3808
- C:\Windows\System\VduWrZA.exe
  C:\Windows\System\VduWrZA.exe
  2⤵
  PID:2672
- C:\Windows\System\XemZUOQ.exe
  C:\Windows\System\XemZUOQ.exe
  2⤵
  PID:3888
- C:\Windows\System\gmwFiBD.exe
  C:\Windows\System\gmwFiBD.exe
  2⤵
  PID:3952
- C:\Windows\System\tBZpBAh.exe
  C:\Windows\System\tBZpBAh.exe
  2⤵
  PID:4088
- C:\Windows\System\pLfbsHa.exe
  C:\Windows\System\pLfbsHa.exe
  2⤵
  PID:4056
- C:\Windows\System\lGkqehJ.exe
  C:\Windows\System\lGkqehJ.exe
  2⤵
  PID:532
- C:\Windows\System\gHgtukt.exe
  C:\Windows\System\gHgtukt.exe
  2⤵
  PID:1808
- C:\Windows\System\UAKAMlG.exe
  C:\Windows\System\UAKAMlG.exe
  2⤵
  PID:1332
- C:\Windows\System\eezoEwJ.exe
  C:\Windows\System\eezoEwJ.exe
  2⤵
  PID:1700
- C:\Windows\System\XtecHhk.exe
  C:\Windows\System\XtecHhk.exe
  2⤵
  PID:2008
- C:\Windows\System\TsiUtis.exe
  C:\Windows\System\TsiUtis.exe
  2⤵
  PID:3164
- C:\Windows\System\NKlcBCE.exe
  C:\Windows\System\NKlcBCE.exe
  2⤵
  PID:3224
- C:\Windows\System\ZvACUDp.exe
  C:\Windows\System\ZvACUDp.exe
  2⤵
  PID:3340
- C:\Windows\System\bPESDGh.exe
  C:\Windows\System\bPESDGh.exe
  2⤵
  PID:3384
- C:\Windows\System\TdPMBPJ.exe
  C:\Windows\System\TdPMBPJ.exe
  2⤵
  PID:4116
- C:\Windows\System\ChxRRhl.exe
  C:\Windows\System\ChxRRhl.exe
  2⤵
  PID:4136
- C:\Windows\System\DGWJfBv.exe
  C:\Windows\System\DGWJfBv.exe
  2⤵
  PID:4156
- C:\Windows\System\pUTxeff.exe
  C:\Windows\System\pUTxeff.exe
  2⤵
  PID:4172
- C:\Windows\System\iHrpovW.exe
  C:\Windows\System\iHrpovW.exe
  2⤵
  PID:4196
- C:\Windows\System\HTEMvoT.exe
  C:\Windows\System\HTEMvoT.exe
  2⤵
  PID:4216
- C:\Windows\System\QOgzwXG.exe
  C:\Windows\System\QOgzwXG.exe
  2⤵
  PID:4236
- C:\Windows\System\jUpozwL.exe
  C:\Windows\System\jUpozwL.exe
  2⤵
  PID:4256
- C:\Windows\System\CMvDVRA.exe
  C:\Windows\System\CMvDVRA.exe
  2⤵
  PID:4276
- C:\Windows\System\lsuwTip.exe
  C:\Windows\System\lsuwTip.exe
  2⤵
  PID:4292
- C:\Windows\System\inBVPzr.exe
  C:\Windows\System\inBVPzr.exe
  2⤵
  PID:4312
- C:\Windows\System\ExaXpXY.exe
  C:\Windows\System\ExaXpXY.exe
  2⤵
  PID:4336
- C:\Windows\System\xUFGzYX.exe
  C:\Windows\System\xUFGzYX.exe
  2⤵
  PID:4356
- C:\Windows\System\sFbQubs.exe
  C:\Windows\System\sFbQubs.exe
  2⤵
  PID:4372
- C:\Windows\System\eqXatdC.exe
  C:\Windows\System\eqXatdC.exe
  2⤵
  PID:4396
- C:\Windows\System\wluCAEq.exe
  C:\Windows\System\wluCAEq.exe
  2⤵
  PID:4416
- C:\Windows\System\wnayrYm.exe
  C:\Windows\System\wnayrYm.exe
  2⤵
  PID:4436
- C:\Windows\System\HwdWPga.exe
  C:\Windows\System\HwdWPga.exe
  2⤵
  PID:4456
- C:\Windows\System\mJjJQmh.exe
  C:\Windows\System\mJjJQmh.exe
  2⤵
  PID:4472
- C:\Windows\System\tNNOOrb.exe
  C:\Windows\System\tNNOOrb.exe
  2⤵
  PID:4496
- C:\Windows\System\pupnoAa.exe
  C:\Windows\System\pupnoAa.exe
  2⤵
  PID:4516
- C:\Windows\System\KMpSLcH.exe
  C:\Windows\System\KMpSLcH.exe
  2⤵
  PID:4532
- C:\Windows\System\yBjOPAR.exe
  C:\Windows\System\yBjOPAR.exe
  2⤵
  PID:4556
- C:\Windows\System\HRzLvxQ.exe
  C:\Windows\System\HRzLvxQ.exe
  2⤵
  PID:4576
- C:\Windows\System\AMsNWph.exe
  C:\Windows\System\AMsNWph.exe
  2⤵
  PID:4596
- C:\Windows\System\MPeKWKS.exe
  C:\Windows\System\MPeKWKS.exe
  2⤵
  PID:4616
- C:\Windows\System\nlObCFq.exe
  C:\Windows\System\nlObCFq.exe
  2⤵
  PID:4636
- C:\Windows\System\QxumGEf.exe
  C:\Windows\System\QxumGEf.exe
  2⤵
  PID:4656
- C:\Windows\System\hchlAHc.exe
  C:\Windows\System\hchlAHc.exe
  2⤵
  PID:4676
- C:\Windows\System\WSswxXs.exe
  C:\Windows\System\WSswxXs.exe
  2⤵
  PID:4692
- C:\Windows\System\XZZVKch.exe
  C:\Windows\System\XZZVKch.exe
  2⤵
  PID:4708
- C:\Windows\System\QElabze.exe
  C:\Windows\System\QElabze.exe
  2⤵
  PID:4732
- C:\Windows\System\VcCFVmD.exe
  C:\Windows\System\VcCFVmD.exe
  2⤵
  PID:4756
- C:\Windows\System\ExFsNuu.exe
  C:\Windows\System\ExFsNuu.exe
  2⤵
  PID:4772
- C:\Windows\System\ABQdfWy.exe
  C:\Windows\System\ABQdfWy.exe
  2⤵
  PID:4792
- C:\Windows\System\QjUNMyd.exe
  C:\Windows\System\QjUNMyd.exe
  2⤵
  PID:4812
- C:\Windows\System\zFXkekV.exe
  C:\Windows\System\zFXkekV.exe
  2⤵
  PID:4840
- C:\Windows\System\irlggaz.exe
  C:\Windows\System\irlggaz.exe
  2⤵
  PID:4860
- C:\Windows\System\MxGcwTe.exe
  C:\Windows\System\MxGcwTe.exe
  2⤵
  PID:4880
- C:\Windows\System\iLUKQNG.exe
  C:\Windows\System\iLUKQNG.exe
  2⤵
  PID:4896
- C:\Windows\System\mbrMGGR.exe
  C:\Windows\System\mbrMGGR.exe
  2⤵
  PID:4920
- C:\Windows\System\rrvpfwD.exe
  C:\Windows\System\rrvpfwD.exe
  2⤵
  PID:4940
- C:\Windows\System\WevxuQc.exe
  C:\Windows\System\WevxuQc.exe
  2⤵
  PID:4964
- C:\Windows\System\cJNTtzm.exe
  C:\Windows\System\cJNTtzm.exe
  2⤵
  PID:4984
- C:\Windows\System\FFoIfPZ.exe
  C:\Windows\System\FFoIfPZ.exe
  2⤵
  PID:5004
- C:\Windows\System\iIXxRUC.exe
  C:\Windows\System\iIXxRUC.exe
  2⤵
  PID:5024
- C:\Windows\System\YhGZOrx.exe
  C:\Windows\System\YhGZOrx.exe
  2⤵
  PID:5044
- C:\Windows\System\iIGwjHv.exe
  C:\Windows\System\iIGwjHv.exe
  2⤵
  PID:5060
- C:\Windows\System\ZadioUz.exe
  C:\Windows\System\ZadioUz.exe
  2⤵
  PID:5084
- C:\Windows\System\nEdCimQ.exe
  C:\Windows\System\nEdCimQ.exe
  2⤵
  PID:5104
- C:\Windows\System\OfbOjfK.exe
  C:\Windows\System\OfbOjfK.exe
  2⤵
  PID:3444
- C:\Windows\System\gkfcWjC.exe
  C:\Windows\System\gkfcWjC.exe
  2⤵
  PID:3528
- C:\Windows\System\mNXzgvH.exe
  C:\Windows\System\mNXzgvH.exe
  2⤵
  PID:3648
- C:\Windows\System\qmZPhpC.exe
  C:\Windows\System\qmZPhpC.exe
  2⤵
  PID:3768
- C:\Windows\System\CYjmFIJ.exe
  C:\Windows\System\CYjmFIJ.exe
  2⤵
  PID:3724
- C:\Windows\System\WvxQvjH.exe
  C:\Windows\System\WvxQvjH.exe
  2⤵
  PID:3792
- C:\Windows\System\xVeGUhx.exe
  C:\Windows\System\xVeGUhx.exe
  2⤵
  PID:3864
- C:\Windows\System\iGVrVGs.exe
  C:\Windows\System\iGVrVGs.exe
  2⤵
  PID:1616
- C:\Windows\System\sHExAbT.exe
  C:\Windows\System\sHExAbT.exe
  2⤵
  PID:1768
- C:\Windows\System\uMjwiRo.exe
  C:\Windows\System\uMjwiRo.exe
  2⤵
  PID:2120
- C:\Windows\System\elgPzTH.exe
  C:\Windows\System\elgPzTH.exe
  2⤵
  PID:2876
- C:\Windows\System\PVMwZiV.exe
  C:\Windows\System\PVMwZiV.exe
  2⤵
  PID:3004
- C:\Windows\System\RucqCYv.exe
  C:\Windows\System\RucqCYv.exe
  2⤵
  PID:3180
- C:\Windows\System\OXjNMgO.exe
  C:\Windows\System\OXjNMgO.exe
  2⤵
  PID:3380
- C:\Windows\System\EqvfFfL.exe
  C:\Windows\System\EqvfFfL.exe
  2⤵
  PID:4124
- C:\Windows\System\mzuFCHF.exe
  C:\Windows\System\mzuFCHF.exe
  2⤵
  PID:4132
- C:\Windows\System\uCvQfVS.exe
  C:\Windows\System\uCvQfVS.exe
  2⤵
  PID:4168
- C:\Windows\System\CFlgxfz.exe
  C:\Windows\System\CFlgxfz.exe
  2⤵
  PID:4164
- C:\Windows\System\HLTUWAv.exe
  C:\Windows\System\HLTUWAv.exe
  2⤵
  PID:4244
- C:\Windows\System\JQNufGy.exe
  C:\Windows\System\JQNufGy.exe
  2⤵
  PID:4300
- C:\Windows\System\asWkytH.exe
  C:\Windows\System\asWkytH.exe
  2⤵
  PID:4288
- C:\Windows\System\FfMEJmb.exe
  C:\Windows\System\FfMEJmb.exe
  2⤵
  PID:4324
- C:\Windows\System\cCLkAUK.exe
  C:\Windows\System\cCLkAUK.exe
  2⤵
  PID:4392
- C:\Windows\System\GcOkEPE.exe
  C:\Windows\System\GcOkEPE.exe
  2⤵
  PID:4428
- C:\Windows\System\MwXZHYU.exe
  C:\Windows\System\MwXZHYU.exe
  2⤵
  PID:4444
- C:\Windows\System\CqoObHA.exe
  C:\Windows\System\CqoObHA.exe
  2⤵
  PID:4484
- C:\Windows\System\rdrVlDq.exe
  C:\Windows\System\rdrVlDq.exe
  2⤵
  PID:4540
- C:\Windows\System\XsMMudQ.exe
  C:\Windows\System\XsMMudQ.exe
  2⤵
  PID:4548
- C:\Windows\System\sAVlaQw.exe
  C:\Windows\System\sAVlaQw.exe
  2⤵
  PID:4524
- C:\Windows\System\WWaaBRs.exe
  C:\Windows\System\WWaaBRs.exe
  2⤵
  PID:4568
- C:\Windows\System\ASaozZl.exe
  C:\Windows\System\ASaozZl.exe
  2⤵
  PID:4672
- C:\Windows\System\vLklxOV.exe
  C:\Windows\System\vLklxOV.exe
  2⤵
  PID:4700
- C:\Windows\System\feTZqUT.exe
  C:\Windows\System\feTZqUT.exe
  2⤵
  PID:4744
- C:\Windows\System\sUyuYSs.exe
  C:\Windows\System\sUyuYSs.exe
  2⤵
  PID:4728
- C:\Windows\System\HWjWJbO.exe
  C:\Windows\System\HWjWJbO.exe
  2⤵
  PID:4820
- C:\Windows\System\laFCuru.exe
  C:\Windows\System\laFCuru.exe
  2⤵
  PID:4800
- C:\Windows\System\inpjwcq.exe
  C:\Windows\System\inpjwcq.exe
  2⤵
  PID:4872
- C:\Windows\System\scmHYOZ.exe
  C:\Windows\System\scmHYOZ.exe
  2⤵
  PID:4904
- C:\Windows\System\MrXwMLz.exe
  C:\Windows\System\MrXwMLz.exe
  2⤵
  PID:4908
- C:\Windows\System\jWJdCJt.exe
  C:\Windows\System\jWJdCJt.exe
  2⤵
  PID:4932
- C:\Windows\System\nILtZui.exe
  C:\Windows\System\nILtZui.exe
  2⤵
  PID:4976
- C:\Windows\System\kjKmKYS.exe
  C:\Windows\System\kjKmKYS.exe
  2⤵
  PID:5016
- C:\Windows\System\YTEyCXq.exe
  C:\Windows\System\YTEyCXq.exe
  2⤵
  PID:5040
- C:\Windows\System\kDmrReU.exe
  C:\Windows\System\kDmrReU.exe
  2⤵
  PID:3420
- C:\Windows\System\YtNlPCA.exe
  C:\Windows\System\YtNlPCA.exe
  2⤵
  PID:5100
- C:\Windows\System\oYoOaeY.exe
  C:\Windows\System\oYoOaeY.exe
  2⤵
  PID:3440
- C:\Windows\System\XPhYaKV.exe
  C:\Windows\System\XPhYaKV.exe
  2⤵
  PID:3608
- C:\Windows\System\HhMgXnh.exe
  C:\Windows\System\HhMgXnh.exe
  2⤵
  PID:3968
- C:\Windows\System\hYwvwpd.exe
  C:\Windows\System\hYwvwpd.exe
  2⤵
  PID:3984
- C:\Windows\System\TqPhGQz.exe
  C:\Windows\System\TqPhGQz.exe
  2⤵
  PID:2044
- C:\Windows\System\WyjVKvj.exe
  C:\Windows\System\WyjVKvj.exe
  2⤵
  PID:2800
- C:\Windows\System\FRTUEqY.exe
  C:\Windows\System\FRTUEqY.exe
  2⤵
  PID:3240
- C:\Windows\System\tGKYGAq.exe
  C:\Windows\System\tGKYGAq.exe
  2⤵
  PID:3144
- C:\Windows\System\woFMSKt.exe
  C:\Windows\System\woFMSKt.exe
  2⤵
  PID:4144
- C:\Windows\System\aGnOVXh.exe
  C:\Windows\System\aGnOVXh.exe
  2⤵
  PID:4264
- C:\Windows\System\yiDeKqv.exe
  C:\Windows\System\yiDeKqv.exe
  2⤵
  PID:4352
- C:\Windows\System\bcmHqsf.exe
  C:\Windows\System\bcmHqsf.exe
  2⤵
  PID:4344
- C:\Windows\System\OtSiloe.exe
  C:\Windows\System\OtSiloe.exe
  2⤵
  PID:4332
- C:\Windows\System\vsoJwRG.exe
  C:\Windows\System\vsoJwRG.exe
  2⤵
  PID:4468
- C:\Windows\System\GWEhvSB.exe
  C:\Windows\System\GWEhvSB.exe
  2⤵
  PID:4504
- C:\Windows\System\vbZRIjc.exe
  C:\Windows\System\vbZRIjc.exe
  2⤵
  PID:4592
- C:\Windows\System\iwCJOSK.exe
  C:\Windows\System\iwCJOSK.exe
  2⤵
  PID:2232
- C:\Windows\System\twALtdu.exe
  C:\Windows\System\twALtdu.exe
  2⤵
  PID:4632
- C:\Windows\System\iuqzVci.exe
  C:\Windows\System\iuqzVci.exe
  2⤵
  PID:4740
- C:\Windows\System\XqGmeas.exe
  C:\Windows\System\XqGmeas.exe
  2⤵
  PID:4720
- C:\Windows\System\iwFmvRE.exe
  C:\Windows\System\iwFmvRE.exe
  2⤵
  PID:4808
- C:\Windows\System\CRaDqjc.exe
  C:\Windows\System\CRaDqjc.exe
  2⤵
  PID:4764
- C:\Windows\System\gJCoYNn.exe
  C:\Windows\System\gJCoYNn.exe
  2⤵
  PID:4888
- C:\Windows\System\OUPyzDJ.exe
  C:\Windows\System\OUPyzDJ.exe
  2⤵
  PID:4952
- C:\Windows\System\OrufUiS.exe
  C:\Windows\System\OrufUiS.exe
  2⤵
  PID:5012
- C:\Windows\System\EWmmJNk.exe
  C:\Windows\System\EWmmJNk.exe
  2⤵
  PID:5000
- C:\Windows\System\fdsYquH.exe
  C:\Windows\System\fdsYquH.exe
  2⤵
  PID:3364
- C:\Windows\System\iLXUCrK.exe
  C:\Windows\System\iLXUCrK.exe
  2⤵
  PID:3720
- C:\Windows\System\mqGLfdv.exe
  C:\Windows\System\mqGLfdv.exe
  2⤵
  PID:3844
- C:\Windows\System\oqxayGH.exe
  C:\Windows\System\oqxayGH.exe
  2⤵
  PID:2148
- C:\Windows\System\WigjShp.exe
  C:\Windows\System\WigjShp.exe
  2⤵
  PID:2528
- C:\Windows\System\AZQXxzU.exe
  C:\Windows\System\AZQXxzU.exe
  2⤵
  PID:3408
- C:\Windows\System\YTutpgU.exe
  C:\Windows\System\YTutpgU.exe
  2⤵
  PID:4232
- C:\Windows\System\xYVxULl.exe
  C:\Windows\System\xYVxULl.exe
  2⤵
  PID:4252
- C:\Windows\System\cEnfDnf.exe
  C:\Windows\System\cEnfDnf.exe
  2⤵
  PID:5136
- C:\Windows\System\zgaKOEl.exe
  C:\Windows\System\zgaKOEl.exe
  2⤵
  PID:5152
- C:\Windows\System\PhxZPyP.exe
  C:\Windows\System\PhxZPyP.exe
  2⤵
  PID:5176
- C:\Windows\System\bsLJhEC.exe
  C:\Windows\System\bsLJhEC.exe
  2⤵
  PID:5196
- C:\Windows\System\DfDTbtB.exe
  C:\Windows\System\DfDTbtB.exe
  2⤵
  PID:5212
- C:\Windows\System\qvIHNAS.exe
  C:\Windows\System\qvIHNAS.exe
  2⤵
  PID:5232
- C:\Windows\System\GKuGEmV.exe
  C:\Windows\System\GKuGEmV.exe
  2⤵
  PID:5256
- C:\Windows\System\rCkgBvU.exe
  C:\Windows\System\rCkgBvU.exe
  2⤵
  PID:5276
- C:\Windows\System\qTtGGmV.exe
  C:\Windows\System\qTtGGmV.exe
  2⤵
  PID:5296
- C:\Windows\System\HsrxCyM.exe
  C:\Windows\System\HsrxCyM.exe
  2⤵
  PID:5316
- C:\Windows\System\FCTLNAs.exe
  C:\Windows\System\FCTLNAs.exe
  2⤵
  PID:5336
- C:\Windows\System\sXgIXJq.exe
  C:\Windows\System\sXgIXJq.exe
  2⤵
  PID:5356
- C:\Windows\System\vCTgGvH.exe
  C:\Windows\System\vCTgGvH.exe
  2⤵
  PID:5376
- C:\Windows\System\oHExXQc.exe
  C:\Windows\System\oHExXQc.exe
  2⤵
  PID:5396
- C:\Windows\System\sPuUHBf.exe
  C:\Windows\System\sPuUHBf.exe
  2⤵
  PID:5416
- C:\Windows\System\tzBVRWQ.exe
  C:\Windows\System\tzBVRWQ.exe
  2⤵
  PID:5436
- C:\Windows\System\qjrBTDi.exe
  C:\Windows\System\qjrBTDi.exe
  2⤵
  PID:5456
- C:\Windows\System\RgVMOrh.exe
  C:\Windows\System\RgVMOrh.exe
  2⤵
  PID:5476
- C:\Windows\System\YFVKoOU.exe
  C:\Windows\System\YFVKoOU.exe
  2⤵
  PID:5492
- C:\Windows\System\QeyaJUk.exe
  C:\Windows\System\QeyaJUk.exe
  2⤵
  PID:5516
- C:\Windows\System\xevdsZh.exe
  C:\Windows\System\xevdsZh.exe
  2⤵
  PID:5532
- C:\Windows\System\puCiiai.exe
  C:\Windows\System\puCiiai.exe
  2⤵
  PID:5552
- C:\Windows\System\buUdmdf.exe
  C:\Windows\System\buUdmdf.exe
  2⤵
  PID:5576
- C:\Windows\System\RhnGoKd.exe
  C:\Windows\System\RhnGoKd.exe
  2⤵
  PID:5596
- C:\Windows\System\JgDeGmx.exe
  C:\Windows\System\JgDeGmx.exe
  2⤵
  PID:5612
- C:\Windows\System\UwjSnYK.exe
  C:\Windows\System\UwjSnYK.exe
  2⤵
  PID:5632
- C:\Windows\System\kXMINgl.exe
  C:\Windows\System\kXMINgl.exe
  2⤵
  PID:5660
- C:\Windows\System\JnXYaxx.exe
  C:\Windows\System\JnXYaxx.exe
  2⤵
  PID:5680
- C:\Windows\System\vrtWcis.exe
  C:\Windows\System\vrtWcis.exe
  2⤵
  PID:5700
- C:\Windows\System\kQMzQuK.exe
  C:\Windows\System\kQMzQuK.exe
  2⤵
  PID:5720
- C:\Windows\System\DcmLVzq.exe
  C:\Windows\System\DcmLVzq.exe
  2⤵
  PID:5740
- C:\Windows\System\cZayaGf.exe
  C:\Windows\System\cZayaGf.exe
  2⤵
  PID:5760
- C:\Windows\System\dJbokmG.exe
  C:\Windows\System\dJbokmG.exe
  2⤵
  PID:5780
- C:\Windows\System\NhSBcpo.exe
  C:\Windows\System\NhSBcpo.exe
  2⤵
  PID:5800
- C:\Windows\System\bOTMnhV.exe
  C:\Windows\System\bOTMnhV.exe
  2⤵
  PID:5820
- C:\Windows\System\eyyCHAC.exe
  C:\Windows\System\eyyCHAC.exe
  2⤵
  PID:5840
- C:\Windows\System\BtiDHPV.exe
  C:\Windows\System\BtiDHPV.exe
  2⤵
  PID:5860
- C:\Windows\System\VjxZpOA.exe
  C:\Windows\System\VjxZpOA.exe
  2⤵
  PID:5880
- C:\Windows\System\rtBQppW.exe
  C:\Windows\System\rtBQppW.exe
  2⤵
  PID:5900
- C:\Windows\System\bgVwinY.exe
  C:\Windows\System\bgVwinY.exe
  2⤵
  PID:5920
- C:\Windows\System\UuSQSPJ.exe
  C:\Windows\System\UuSQSPJ.exe
  2⤵
  PID:5940
- C:\Windows\System\MwfYhQp.exe
  C:\Windows\System\MwfYhQp.exe
  2⤵
  PID:5960
- C:\Windows\System\CgwLjty.exe
  C:\Windows\System\CgwLjty.exe
  2⤵
  PID:5980
- C:\Windows\System\PkzjLCa.exe
  C:\Windows\System\PkzjLCa.exe
  2⤵
  PID:6000
- C:\Windows\System\mvFFbJs.exe
  C:\Windows\System\mvFFbJs.exe
  2⤵
  PID:6020
- C:\Windows\System\lOrBYQs.exe
  C:\Windows\System\lOrBYQs.exe
  2⤵
  PID:6040
- C:\Windows\System\slxjSDm.exe
  C:\Windows\System\slxjSDm.exe
  2⤵
  PID:6060
- C:\Windows\System\ishgEax.exe
  C:\Windows\System\ishgEax.exe
  2⤵
  PID:6080
- C:\Windows\System\MgrKswB.exe
  C:\Windows\System\MgrKswB.exe
  2⤵
  PID:6100
- C:\Windows\System\pAKEcMy.exe
  C:\Windows\System\pAKEcMy.exe
  2⤵
  PID:6120
- C:\Windows\System\EmNXDOG.exe
  C:\Windows\System\EmNXDOG.exe
  2⤵
  PID:6136
- C:\Windows\System\IowQypP.exe
  C:\Windows\System\IowQypP.exe
  2⤵
  PID:4388
- C:\Windows\System\WGUEpif.exe
  C:\Windows\System\WGUEpif.exe
  2⤵
  PID:4480
- C:\Windows\System\QRHHttb.exe
  C:\Windows\System\QRHHttb.exe
  2⤵
  PID:4552
- C:\Windows\System\hEizboH.exe
  C:\Windows\System\hEizboH.exe
  2⤵
  PID:4572
- C:\Windows\System\TZXGMmM.exe
  C:\Windows\System\TZXGMmM.exe
  2⤵
  PID:4648
- C:\Windows\System\egmhowY.exe
  C:\Windows\System\egmhowY.exe
  2⤵
  PID:4788
- C:\Windows\System\NhXfTHo.exe
  C:\Windows\System\NhXfTHo.exe
  2⤵
  PID:4852
- C:\Windows\System\yRDlrxO.exe
  C:\Windows\System\yRDlrxO.exe
  2⤵
  PID:5032
- C:\Windows\System\hkCbNbJ.exe
  C:\Windows\System\hkCbNbJ.exe
  2⤵
  PID:2980
- C:\Windows\System\ZIvNXYV.exe
  C:\Windows\System\ZIvNXYV.exe
  2⤵
  PID:5056
- C:\Windows\System\FlbVcgC.exe
  C:\Windows\System\FlbVcgC.exe
  2⤵
  PID:1704
- C:\Windows\System\MXMXnjn.exe
  C:\Windows\System\MXMXnjn.exe
  2⤵
  PID:2540
- C:\Windows\System\IxYXhHv.exe
  C:\Windows\System\IxYXhHv.exe
  2⤵
  PID:4228
- C:\Windows\System\xuXiZZn.exe
  C:\Windows\System\xuXiZZn.exe
  2⤵
  PID:5124
- C:\Windows\System\cpzcbQI.exe
  C:\Windows\System\cpzcbQI.exe
  2⤵
  PID:5188
- C:\Windows\System\GTeSvqz.exe
  C:\Windows\System\GTeSvqz.exe
  2⤵
  PID:5168
- C:\Windows\System\FJqQoGD.exe
  C:\Windows\System\FJqQoGD.exe
  2⤵
  PID:5228
- C:\Windows\System\drsDRgb.exe
  C:\Windows\System\drsDRgb.exe
  2⤵
  PID:5204
- C:\Windows\System\hGdawGS.exe
  C:\Windows\System\hGdawGS.exe
  2⤵
  PID:5272
- C:\Windows\System\hkUgLYp.exe
  C:\Windows\System\hkUgLYp.exe
  2⤵
  PID:5288
- C:\Windows\System\ewbXmNV.exe
  C:\Windows\System\ewbXmNV.exe
  2⤵
  PID:5328
- C:\Windows\System\tHdgIoM.exe
  C:\Windows\System\tHdgIoM.exe
  2⤵
  PID:5368
- C:\Windows\System\WVpfccY.exe
  C:\Windows\System\WVpfccY.exe
  2⤵
  PID:5428
- C:\Windows\System\BkFcNJw.exe
  C:\Windows\System\BkFcNJw.exe
  2⤵
  PID:5408
- C:\Windows\System\rYZZJBd.exe
  C:\Windows\System\rYZZJBd.exe
  2⤵
  PID:5452
- C:\Windows\System\fFLbcqK.exe
  C:\Windows\System\fFLbcqK.exe
  2⤵
  PID:5488
- C:\Windows\System\rZSWkrV.exe
  C:\Windows\System\rZSWkrV.exe
  2⤵
  PID:5544
- C:\Windows\System\Lwhmxnk.exe
  C:\Windows\System\Lwhmxnk.exe
  2⤵
  PID:5568
- C:\Windows\System\WLUhqHq.exe
  C:\Windows\System\WLUhqHq.exe
  2⤵
  PID:5592
- C:\Windows\System\cTtCeik.exe
  C:\Windows\System\cTtCeik.exe
  2⤵
  PID:5668
- C:\Windows\System\HpcORuP.exe
  C:\Windows\System\HpcORuP.exe
  2⤵
  PID:5604
- C:\Windows\System\soeIrCD.exe
  C:\Windows\System\soeIrCD.exe
  2⤵
  PID:2768
- C:\Windows\System\sJwLbrM.exe
  C:\Windows\System\sJwLbrM.exe
  2⤵
  PID:5712
- C:\Windows\System\etKvVYn.exe
  C:\Windows\System\etKvVYn.exe
  2⤵
  PID:5736
- C:\Windows\System\udcygWq.exe
  C:\Windows\System\udcygWq.exe
  2⤵
  PID:5776
- C:\Windows\System\FtCoxFH.exe
  C:\Windows\System\FtCoxFH.exe
  2⤵
  PID:5808
- C:\Windows\System\WVGCTNe.exe
  C:\Windows\System\WVGCTNe.exe
  2⤵
  PID:5848
- C:\Windows\System\CvhciVr.exe
  C:\Windows\System\CvhciVr.exe
  2⤵
  PID:5816
- C:\Windows\System\KzcXsOC.exe
  C:\Windows\System\KzcXsOC.exe
  2⤵
  PID:5908
- C:\Windows\System\VugGGgA.exe
  C:\Windows\System\VugGGgA.exe
  2⤵
  PID:1996
- C:\Windows\System\teufVVW.exe
  C:\Windows\System\teufVVW.exe
  2⤵
  PID:5952
- C:\Windows\System\vFGMKlI.exe
  C:\Windows\System\vFGMKlI.exe
  2⤵
  PID:5968
- C:\Windows\System\rvzNuks.exe
  C:\Windows\System\rvzNuks.exe
  2⤵
  PID:2228
- C:\Windows\System\NwYZODz.exe
  C:\Windows\System\NwYZODz.exe
  2⤵
  PID:6036
- C:\Windows\System\LdQPFWo.exe
  C:\Windows\System\LdQPFWo.exe
  2⤵
  PID:6008
- C:\Windows\System\ZtZNLAs.exe
  C:\Windows\System\ZtZNLAs.exe
  2⤵
  PID:6052
- C:\Windows\System\TQVqydu.exe
  C:\Windows\System\TQVqydu.exe
  2⤵
  PID:2848
- C:\Windows\System\vVJPrvK.exe
  C:\Windows\System\vVJPrvK.exe
  2⤵
  PID:6092
- C:\Windows\System\mXFJZuH.exe
  C:\Windows\System\mXFJZuH.exe
  2⤵
  PID:4452
- C:\Windows\System\yTbIYMp.exe
  C:\Windows\System\yTbIYMp.exe
  2⤵
  PID:4588
- C:\Windows\System\DXULJLv.exe
  C:\Windows\System\DXULJLv.exe
  2⤵
  PID:4768
- C:\Windows\System\uZZBpzQ.exe
  C:\Windows\System\uZZBpzQ.exe
  2⤵
  PID:5080
- C:\Windows\System\cPlElQL.exe
  C:\Windows\System\cPlElQL.exe
  2⤵
  PID:2656
- C:\Windows\System\gWxPndU.exe
  C:\Windows\System\gWxPndU.exe
  2⤵
  PID:4992
- C:\Windows\System\FeVMeoG.exe
  C:\Windows\System\FeVMeoG.exe
  2⤵
  PID:3980
- C:\Windows\System\OJkjUqy.exe
  C:\Windows\System\OJkjUqy.exe
  2⤵
  PID:4084
- C:\Windows\System\pIxTKRb.exe
  C:\Windows\System\pIxTKRb.exe
  2⤵
  PID:4184
- C:\Windows\System\edtfPjz.exe
  C:\Windows\System\edtfPjz.exe
  2⤵
  PID:5220
- C:\Windows\System\lMdfIga.exe
  C:\Windows\System\lMdfIga.exe
  2⤵
  PID:5268
- C:\Windows\System\VbYOTCs.exe
  C:\Windows\System\VbYOTCs.exe
  2⤵
  PID:5312
- C:\Windows\System\MLTMeTL.exe
  C:\Windows\System\MLTMeTL.exe
  2⤵
  PID:5324
- C:\Windows\System\lOXGXVa.exe
  C:\Windows\System\lOXGXVa.exe
  2⤵
  PID:5468
- C:\Windows\System\vQYOofT.exe
  C:\Windows\System\vQYOofT.exe
  2⤵
  PID:5404
- C:\Windows\System\qPSrdkj.exe
  C:\Windows\System\qPSrdkj.exe
  2⤵
  PID:5540
- C:\Windows\System\NgKaVFw.exe
  C:\Windows\System\NgKaVFw.exe
  2⤵
  PID:5560
- C:\Windows\System\RGREFPz.exe
  C:\Windows\System\RGREFPz.exe
  2⤵
  PID:5628
- C:\Windows\System\BmqdkAj.exe
  C:\Windows\System\BmqdkAj.exe
  2⤵
  PID:5644
- C:\Windows\System\eFmYdMe.exe
  C:\Windows\System\eFmYdMe.exe
  2⤵
  PID:2844
- C:\Windows\System\SayQDHe.exe
  C:\Windows\System\SayQDHe.exe
  2⤵
  PID:5752
- C:\Windows\System\MeooHUH.exe
  C:\Windows\System\MeooHUH.exe
  2⤵
  PID:5828
- C:\Windows\System\hUthTfx.exe
  C:\Windows\System\hUthTfx.exe
  2⤵
  PID:2644
- C:\Windows\System\DiCmGhI.exe
  C:\Windows\System\DiCmGhI.exe
  2⤵
  PID:5876
- C:\Windows\System\guXltuI.exe
  C:\Windows\System\guXltuI.exe
  2⤵
  PID:2804
- C:\Windows\System\BVGqecp.exe
  C:\Windows\System\BVGqecp.exe
  2⤵
  PID:5992
- C:\Windows\System\xYSMYsx.exe
  C:\Windows\System\xYSMYsx.exe
  2⤵
  PID:2756
- C:\Windows\System\mjKuGDF.exe
  C:\Windows\System\mjKuGDF.exe
  2⤵
  PID:6056
- C:\Windows\System\PURbpXs.exe
  C:\Windows\System\PURbpXs.exe
  2⤵
  PID:6128
- C:\Windows\System\ZgoiEaE.exe
  C:\Windows\System\ZgoiEaE.exe
  2⤵
  PID:4464
- C:\Windows\System\GPFIDbW.exe
  C:\Windows\System\GPFIDbW.exe
  2⤵
  PID:4608
- C:\Windows\System\wKtKuma.exe
  C:\Windows\System\wKtKuma.exe
  2⤵
  PID:4868
- C:\Windows\System\uiVzgNN.exe
  C:\Windows\System\uiVzgNN.exe
  2⤵
  PID:2012
- C:\Windows\System\YWFCJnZ.exe
  C:\Windows\System\YWFCJnZ.exe
  2⤵
  PID:4996
- C:\Windows\System\LoaXIeU.exe
  C:\Windows\System\LoaXIeU.exe
  2⤵
  PID:3832
- C:\Windows\System\PHCvzFa.exe
  C:\Windows\System\PHCvzFa.exe
  2⤵
  PID:5264
- C:\Windows\System\SYbFUgS.exe
  C:\Windows\System\SYbFUgS.exe
  2⤵
  PID:5164
- C:\Windows\System\nXfoXbI.exe
  C:\Windows\System\nXfoXbI.exe
  2⤵
  PID:5472
- C:\Windows\System\iMoxFaH.exe
  C:\Windows\System\iMoxFaH.exe
  2⤵
  PID:5352
- C:\Windows\System\hLrYDab.exe
  C:\Windows\System\hLrYDab.exe
  2⤵
  PID:5588
- C:\Windows\System\lyBroLN.exe
  C:\Windows\System\lyBroLN.exe
  2⤵
  PID:5448
- C:\Windows\System\oWRJolI.exe
  C:\Windows\System\oWRJolI.exe
  2⤵
  PID:5620
- C:\Windows\System\RswhWAc.exe
  C:\Windows\System\RswhWAc.exe
  2⤵
  PID:5692
- C:\Windows\System\aNkCwzP.exe
  C:\Windows\System\aNkCwzP.exe
  2⤵
  PID:5656
- C:\Windows\System\YgyYJUE.exe
  C:\Windows\System\YgyYJUE.exe
  2⤵
  PID:5796
- C:\Windows\System\ITnsGnD.exe
  C:\Windows\System\ITnsGnD.exe
  2⤵
  PID:1788
- C:\Windows\System\CocYawI.exe
  C:\Windows\System\CocYawI.exe
  2⤵
  PID:2576
- C:\Windows\System\FCgqtZC.exe
  C:\Windows\System\FCgqtZC.exe
  2⤵
  PID:5988
- C:\Windows\System\DxuCFoO.exe
  C:\Windows\System\DxuCFoO.exe
  2⤵
  PID:4448
- C:\Windows\System\HhbgYPZ.exe
  C:\Windows\System\HhbgYPZ.exe
  2⤵
  PID:2736
- C:\Windows\System\HcFHrll.exe
  C:\Windows\System\HcFHrll.exe
  2⤵
  PID:1048
- C:\Windows\System\FoIHggp.exe
  C:\Windows\System\FoIHggp.exe
  2⤵
  PID:5052
- C:\Windows\System\gbByQsa.exe
  C:\Windows\System\gbByQsa.exe
  2⤵
  PID:1548
- C:\Windows\System\JenDTmL.exe
  C:\Windows\System\JenDTmL.exe
  2⤵
  PID:2744
- C:\Windows\System\oYDSLAV.exe
  C:\Windows\System\oYDSLAV.exe
  2⤵
  PID:5348
- C:\Windows\System\ySVHTML.exe
  C:\Windows\System\ySVHTML.exe
  2⤵
  PID:5388
- C:\Windows\System\HKQoeHQ.exe
  C:\Windows\System\HKQoeHQ.exe
  2⤵
  PID:1580
- C:\Windows\System\jtUICpo.exe
  C:\Windows\System\jtUICpo.exe
  2⤵
  PID:5716
- C:\Windows\System\UryBYgR.exe
  C:\Windows\System\UryBYgR.exe
  2⤵
  PID:5524
- C:\Windows\System\NsmIvEt.exe
  C:\Windows\System\NsmIvEt.exe
  2⤵
  PID:2748
- C:\Windows\System\KTjbWah.exe
  C:\Windows\System\KTjbWah.exe
  2⤵
  PID:2764
- C:\Windows\System\IdfYKbs.exe
  C:\Windows\System\IdfYKbs.exe
  2⤵
  PID:832
- C:\Windows\System\BiSScIU.exe
  C:\Windows\System\BiSScIU.exe
  2⤵
  PID:5932
- C:\Windows\System\JWpgxNv.exe
  C:\Windows\System\JWpgxNv.exe
  2⤵
  PID:2780
- C:\Windows\System\gsIVjTK.exe
  C:\Windows\System\gsIVjTK.exe
  2⤵
  PID:292
- C:\Windows\System\MzOhscI.exe
  C:\Windows\System\MzOhscI.exe
  2⤵
  PID:4604
- C:\Windows\System\MwnGZCU.exe
  C:\Windows\System\MwnGZCU.exe
  2⤵
  PID:1824
- C:\Windows\System\rqITpys.exe
  C:\Windows\System\rqITpys.exe
  2⤵
  PID:5192
- C:\Windows\System\aUGEfZp.exe
  C:\Windows\System\aUGEfZp.exe
  2⤵
  PID:4348
- C:\Windows\System\vusPIKN.exe
  C:\Windows\System\vusPIKN.exe
  2⤵
  PID:4008
- C:\Windows\System\InRLaEf.exe
  C:\Windows\System\InRLaEf.exe
  2⤵
  PID:5240
- C:\Windows\System\SUibAnl.exe
  C:\Windows\System\SUibAnl.exe
  2⤵
  PID:5732
- C:\Windows\System\LfUjhyC.exe
  C:\Windows\System\LfUjhyC.exe
  2⤵
  PID:564
- C:\Windows\System\UZOBJSm.exe
  C:\Windows\System\UZOBJSm.exe
  2⤵
  PID:5836
- C:\Windows\System\IXyOEeC.exe
  C:\Windows\System\IXyOEeC.exe
  2⤵
  PID:4380
- C:\Windows\System\BYPDgLn.exe
  C:\Windows\System\BYPDgLn.exe
  2⤵
  PID:2468
- C:\Windows\System\izcfTcB.exe
  C:\Windows\System\izcfTcB.exe
  2⤵
  PID:6012
- C:\Windows\System\tAjqjdY.exe
  C:\Windows\System\tAjqjdY.exe
  2⤵
  PID:4828
- C:\Windows\System\DGYrPuw.exe
  C:\Windows\System\DGYrPuw.exe
  2⤵
  PID:5304
- C:\Windows\System\WppSSqI.exe
  C:\Windows\System\WppSSqI.exe
  2⤵
  PID:5624
- C:\Windows\System\dcDZGgm.exe
  C:\Windows\System\dcDZGgm.exe
  2⤵
  PID:5788
- C:\Windows\System\FDzPXEj.exe
  C:\Windows\System\FDzPXEj.exe
  2⤵
  PID:616
- C:\Windows\System\wTsprVQ.exe
  C:\Windows\System\wTsprVQ.exe
  2⤵
  PID:1288
- C:\Windows\System\SapWtOi.exe
  C:\Windows\System\SapWtOi.exe
  2⤵
  PID:2548
- C:\Windows\System\KYXeDYp.exe
  C:\Windows\System\KYXeDYp.exe
  2⤵
  PID:1128
- C:\Windows\System\NJqzPCD.exe
  C:\Windows\System\NJqzPCD.exe
  2⤵
  PID:3476
- C:\Windows\System\CWpeSfu.exe
  C:\Windows\System\CWpeSfu.exe
  2⤵
  PID:2404
- C:\Windows\System\dSCLsdX.exe
  C:\Windows\System\dSCLsdX.exe
  2⤵
  PID:6116
- C:\Windows\System\KfjUucJ.exe
  C:\Windows\System\KfjUucJ.exe
  2⤵
  PID:5160
- C:\Windows\System\hYEKXQA.exe
  C:\Windows\System\hYEKXQA.exe
  2⤵
  PID:1940
- C:\Windows\System\IkUYBNq.exe
  C:\Windows\System\IkUYBNq.exe
  2⤵
  PID:2172
- C:\Windows\System\sLAtlOr.exe
  C:\Windows\System\sLAtlOr.exe
  2⤵
  PID:2704
- C:\Windows\System\GBfTLzc.exe
  C:\Windows\System\GBfTLzc.exe
  2⤵
  PID:5792
- C:\Windows\System\LDvXrgX.exe
  C:\Windows\System\LDvXrgX.exe
  2⤵
  PID:1272
- C:\Windows\System\gcRshnU.exe
  C:\Windows\System\gcRshnU.exe
  2⤵
  PID:372
- C:\Windows\System\sYZtUlR.exe
  C:\Windows\System\sYZtUlR.exe
  2⤵
  PID:1760
- C:\Windows\System\xfDvJLw.exe
  C:\Windows\System\xfDvJLw.exe
  2⤵
  PID:6152
- C:\Windows\System\srpdser.exe
  C:\Windows\System\srpdser.exe
  2⤵
  PID:6180
- C:\Windows\System\vTnwwUo.exe
  C:\Windows\System\vTnwwUo.exe
  2⤵
  PID:6196
- C:\Windows\System\bHfcgDQ.exe
  C:\Windows\System\bHfcgDQ.exe
  2⤵
  PID:6216
- C:\Windows\System\OLxuuDq.exe
  C:\Windows\System\OLxuuDq.exe
  2⤵
  PID:6232
- C:\Windows\System\XnSRPhy.exe
  C:\Windows\System\XnSRPhy.exe
  2⤵
  PID:6260
- C:\Windows\System\fKFuMcC.exe
  C:\Windows\System\fKFuMcC.exe
  2⤵
  PID:6288
- C:\Windows\System\uREHALX.exe
  C:\Windows\System\uREHALX.exe
  2⤵
  PID:6304
- C:\Windows\System\WUhrYjm.exe
  C:\Windows\System\WUhrYjm.exe
  2⤵
  PID:6320
- C:\Windows\System\WipiETr.exe
  C:\Windows\System\WipiETr.exe
  2⤵
  PID:6336
- C:\Windows\System\lOdshPt.exe
  C:\Windows\System\lOdshPt.exe
  2⤵
  PID:6356
- C:\Windows\System\fbCPTFr.exe
  C:\Windows\System\fbCPTFr.exe
  2⤵
  PID:6376
- C:\Windows\System\rQlLzlR.exe
  C:\Windows\System\rQlLzlR.exe
  2⤵
  PID:6392
- C:\Windows\System\zQtAneY.exe
  C:\Windows\System\zQtAneY.exe
  2⤵
  PID:6408
- C:\Windows\System\xxncPvF.exe
  C:\Windows\System\xxncPvF.exe
  2⤵
  PID:6432
- C:\Windows\System\TJwvJtx.exe
  C:\Windows\System\TJwvJtx.exe
  2⤵
  PID:6452
- C:\Windows\System\clDKcAB.exe
  C:\Windows\System\clDKcAB.exe
  2⤵
  PID:6468
- C:\Windows\System\NsaUOWy.exe
  C:\Windows\System\NsaUOWy.exe
  2⤵
  PID:6484
- C:\Windows\System\CvpAfhB.exe
  C:\Windows\System\CvpAfhB.exe
  2⤵
  PID:6500
- C:\Windows\System\Izhwsls.exe
  C:\Windows\System\Izhwsls.exe
  2⤵
  PID:6516
- C:\Windows\System\GPfGcTL.exe
  C:\Windows\System\GPfGcTL.exe
  2⤵
  PID:6532
- C:\Windows\System\TZVrJpM.exe
  C:\Windows\System\TZVrJpM.exe
  2⤵
  PID:6548
- C:\Windows\System\jLzZsew.exe
  C:\Windows\System\jLzZsew.exe
  2⤵
  PID:6568
- C:\Windows\System\QNMbhgR.exe
  C:\Windows\System\QNMbhgR.exe
  2⤵
  PID:6588
- C:\Windows\System\tuatrII.exe
  C:\Windows\System\tuatrII.exe
  2⤵
  PID:6608
- C:\Windows\System\cXtQtZD.exe
  C:\Windows\System\cXtQtZD.exe
  2⤵
  PID:6624
- C:\Windows\System\YDsGbDj.exe
  C:\Windows\System\YDsGbDj.exe
  2⤵
  PID:6640
- C:\Windows\System\AVURAsQ.exe
  C:\Windows\System\AVURAsQ.exe
  2⤵
  PID:6660
- C:\Windows\System\ejFuxaG.exe
  C:\Windows\System\ejFuxaG.exe
  2⤵
  PID:6680
- C:\Windows\System\RFJzVJO.exe
  C:\Windows\System\RFJzVJO.exe
  2⤵
  PID:6700
- C:\Windows\System\bBBSQEW.exe
  C:\Windows\System\bBBSQEW.exe
  2⤵
  PID:6720
- C:\Windows\System\GduUiTo.exe
  C:\Windows\System\GduUiTo.exe
  2⤵
  PID:6740
- C:\Windows\System\xBiOGin.exe
  C:\Windows\System\xBiOGin.exe
  2⤵
  PID:6760
- C:\Windows\System\yROtmiI.exe
  C:\Windows\System\yROtmiI.exe
  2⤵
  PID:6776
- C:\Windows\System\rVamaTK.exe
  C:\Windows\System\rVamaTK.exe
  2⤵
  PID:6792
- C:\Windows\System\PQDmyQy.exe
  C:\Windows\System\PQDmyQy.exe
  2⤵
  PID:6808
- C:\Windows\System\ZwRjoCU.exe
  C:\Windows\System\ZwRjoCU.exe
  2⤵
  PID:6824
- C:\Windows\System\sWqRucE.exe
  C:\Windows\System\sWqRucE.exe
  2⤵
  PID:6844
- C:\Windows\System\nBzRIYw.exe
  C:\Windows\System\nBzRIYw.exe
  2⤵
  PID:6860
- C:\Windows\System\PxJqPkA.exe
  C:\Windows\System\PxJqPkA.exe
  2⤵
  PID:6876
- C:\Windows\System\rXeBxlu.exe
  C:\Windows\System\rXeBxlu.exe
  2⤵
  PID:6896
- C:\Windows\System\OcURRtg.exe
  C:\Windows\System\OcURRtg.exe
  2⤵
  PID:6912
- C:\Windows\System\NSAyVyv.exe
  C:\Windows\System\NSAyVyv.exe
  2⤵
  PID:6928
- C:\Windows\System\bltgWig.exe
  C:\Windows\System\bltgWig.exe
  2⤵
  PID:6948
- C:\Windows\System\hyhZTCS.exe
  C:\Windows\System\hyhZTCS.exe
  2⤵
  PID:6968
- C:\Windows\System\bSWowgw.exe
  C:\Windows\System\bSWowgw.exe
  2⤵
  PID:6988
- C:\Windows\System\qSlXBJJ.exe
  C:\Windows\System\qSlXBJJ.exe
  2⤵
  PID:7088
- C:\Windows\System\KCmgOsp.exe
  C:\Windows\System\KCmgOsp.exe
  2⤵
  PID:7104
- C:\Windows\System\IMYBvAa.exe
  C:\Windows\System\IMYBvAa.exe
  2⤵
  PID:7120
- C:\Windows\System\VTmMMJq.exe
  C:\Windows\System\VTmMMJq.exe
  2⤵
  PID:7136
- C:\Windows\System\uYXBvBv.exe
  C:\Windows\System\uYXBvBv.exe
  2⤵
  PID:7156
- C:\Windows\System\srQSVeQ.exe
  C:\Windows\System\srQSVeQ.exe
  2⤵
  PID:1292
- C:\Windows\System\TKdqbZj.exe
  C:\Windows\System\TKdqbZj.exe
  2⤵
  PID:1632
- C:\Windows\System\YczUbmR.exe
  C:\Windows\System\YczUbmR.exe
  2⤵
  PID:6224
- C:\Windows\System\HDyOTnz.exe
  C:\Windows\System\HDyOTnz.exe
  2⤵
  PID:1568
- C:\Windows\System\vHXKYpE.exe
  C:\Windows\System\vHXKYpE.exe
  2⤵
  PID:6268
- C:\Windows\System\DVbgDfw.exe
  C:\Windows\System\DVbgDfw.exe
  2⤵
  PID:6284
- C:\Windows\System\yJveTAb.exe
  C:\Windows\System\yJveTAb.exe
  2⤵
  PID:1036
- C:\Windows\System\dwieqxV.exe
  C:\Windows\System\dwieqxV.exe
  2⤵
  PID:6416
- C:\Windows\System\McxONCE.exe
  C:\Windows\System\McxONCE.exe
  2⤵
  PID:6364
- C:\Windows\System\KsQOgjB.exe
  C:\Windows\System\KsQOgjB.exe
  2⤵
  PID:6168
- C:\Windows\System\fxnFHBn.exe
  C:\Windows\System\fxnFHBn.exe
  2⤵
  PID:6176
- C:\Windows\System\nCzDqTa.exe
  C:\Windows\System\nCzDqTa.exe
  2⤵
  PID:6540
- C:\Windows\System\IlbjQln.exe
  C:\Windows\System\IlbjQln.exe
  2⤵
  PID:6584
- C:\Windows\System\DshRqAl.exe
  C:\Windows\System\DshRqAl.exe
  2⤵
  PID:6696
- C:\Windows\System\VPSqGZs.exe
  C:\Windows\System\VPSqGZs.exe
  2⤵
  PID:6768
- C:\Windows\System\aSrTNAd.exe
  C:\Windows\System\aSrTNAd.exe
  2⤵
  PID:6832
- C:\Windows\System\qOYWBIp.exe
  C:\Windows\System\qOYWBIp.exe
  2⤵
  PID:6936
- C:\Windows\System\HvNfOmq.exe
  C:\Windows\System\HvNfOmq.exe
  2⤵
  PID:6980
- C:\Windows\System\uTkbzEB.exe
  C:\Windows\System\uTkbzEB.exe
  2⤵
  PID:6464
- C:\Windows\System\EZEiGvx.exe
  C:\Windows\System\EZEiGvx.exe
  2⤵
  PID:6924
- C:\Windows\System\HOeuAwp.exe
  C:\Windows\System\HOeuAwp.exe
  2⤵
  PID:6492
- C:\Windows\System\ZCNXlBR.exe
  C:\Windows\System\ZCNXlBR.exe
  2⤵
  PID:6560
- C:\Windows\System\sknmayY.exe
  C:\Windows\System\sknmayY.exe
  2⤵
  PID:6600
- C:\Windows\System\IRiRlIb.exe
  C:\Windows\System\IRiRlIb.exe
  2⤵
  PID:6672
- C:\Windows\System\XUoePRB.exe
  C:\Windows\System\XUoePRB.exe
  2⤵
  PID:6960
- C:\Windows\System\adJsEmn.exe
  C:\Windows\System\adJsEmn.exe
  2⤵
  PID:7032
- C:\Windows\System\sMKEgbn.exe
  C:\Windows\System\sMKEgbn.exe
  2⤵
  PID:7048
- C:\Windows\System\mgfYBiR.exe
  C:\Windows\System\mgfYBiR.exe
  2⤵
  PID:7036
- C:\Windows\System\VXaSApv.exe
  C:\Windows\System\VXaSApv.exe
  2⤵
  PID:7132
- C:\Windows\System\UuciTNR.exe
  C:\Windows\System\UuciTNR.exe
  2⤵
  PID:6244
- C:\Windows\System\cYfwCVD.exe
  C:\Windows\System\cYfwCVD.exe
  2⤵
  PID:6344
- C:\Windows\System\HuZwnMr.exe
  C:\Windows\System\HuZwnMr.exe
  2⤵
  PID:6852
- C:\Windows\System\aWKGcZt.exe
  C:\Windows\System\aWKGcZt.exe
  2⤵
  PID:6756
- C:\Windows\System\RxOEPGC.exe
  C:\Windows\System\RxOEPGC.exe
  2⤵
  PID:7072
- C:\Windows\System\nYKhMGL.exe
  C:\Windows\System\nYKhMGL.exe
  2⤵
  PID:6252
- C:\Windows\System\CYxqFhT.exe
  C:\Windows\System\CYxqFhT.exe
  2⤵
  PID:6404
- C:\Windows\System\PtUOvAK.exe
  C:\Windows\System\PtUOvAK.exe
  2⤵
  PID:7112
- C:\Windows\System\FiIQcea.exe
  C:\Windows\System\FiIQcea.exe
  2⤵
  PID:1952
- C:\Windows\System\lLSXSRW.exe
  C:\Windows\System\lLSXSRW.exe
  2⤵
  PID:6384
- C:\Windows\System\GLiwDnC.exe
  C:\Windows\System\GLiwDnC.exe
  2⤵
  PID:6300
- C:\Windows\System\NdJqXWO.exe
  C:\Windows\System\NdJqXWO.exe
  2⤵
  PID:6476
- C:\Windows\System\vdMRwzS.exe
  C:\Windows\System\vdMRwzS.exe
  2⤵
  PID:6580
- C:\Windows\System\BKGwmpl.exe
  C:\Windows\System\BKGwmpl.exe
  2⤵
  PID:6688
- C:\Windows\System\zbawGgr.exe
  C:\Windows\System\zbawGgr.exe
  2⤵
  PID:6868
- C:\Windows\System\NqVEVtA.exe
  C:\Windows\System\NqVEVtA.exe
  2⤵
  PID:7012
- C:\Windows\System\EPgwJDx.exe
  C:\Windows\System\EPgwJDx.exe
  2⤵
  PID:6596
- C:\Windows\System\FxogUXv.exe
  C:\Windows\System\FxogUXv.exe
  2⤵
  PID:7040
- C:\Windows\System\FzMPPCv.exe
  C:\Windows\System\FzMPPCv.exe
  2⤵
  PID:6816
- C:\Windows\System\NJWfQIx.exe
  C:\Windows\System\NJWfQIx.exe
  2⤵
  PID:6524
- C:\Windows\System\QitJIUp.exe
  C:\Windows\System\QitJIUp.exe
  2⤵
  PID:6276
- C:\Windows\System\QaEYZdI.exe
  C:\Windows\System\QaEYZdI.exe
  2⤵
  PID:7056
- C:\Windows\System\uGKzdAp.exe
  C:\Windows\System\uGKzdAp.exe
  2⤵
  PID:6444
- C:\Windows\System\ZYyMYtq.exe
  C:\Windows\System\ZYyMYtq.exe
  2⤵
  PID:1912
- C:\Windows\System\JfzsaCU.exe
  C:\Windows\System\JfzsaCU.exe
  2⤵
  PID:6248
- C:\Windows\System\kBFdMUd.exe
  C:\Windows\System\kBFdMUd.exe
  2⤵
  PID:6556
- C:\Windows\System\GNgsbUa.exe
  C:\Windows\System\GNgsbUa.exe
  2⤵
  PID:7024
- C:\Windows\System\wbXHoTT.exe
  C:\Windows\System\wbXHoTT.exe
  2⤵
  PID:6188
- C:\Windows\System\hihGZnH.exe
  C:\Windows\System\hihGZnH.exe
  2⤵
  PID:6884
- C:\Windows\System\bJafOEC.exe
  C:\Windows\System\bJafOEC.exe
  2⤵
  PID:6372
- C:\Windows\System\XQYGhkh.exe
  C:\Windows\System\XQYGhkh.exe
  2⤵
  PID:6448
- C:\Windows\System\aIkmgyp.exe
  C:\Windows\System\aIkmgyp.exe
  2⤵
  PID:6656
- C:\Windows\System\tFFSQzH.exe
  C:\Windows\System\tFFSQzH.exe
  2⤵
  PID:7008
- C:\Windows\System\ORjhASh.exe
  C:\Windows\System\ORjhASh.exe
  2⤵
  PID:6736
- C:\Windows\System\PlxXAjb.exe
  C:\Windows\System\PlxXAjb.exe
  2⤵
  PID:6752
- C:\Windows\System\tRbKSRM.exe
  C:\Windows\System\tRbKSRM.exe
  2⤵
  PID:7084
- C:\Windows\System\hJNypuB.exe
  C:\Windows\System\hJNypuB.exe
  2⤵
  PID:6888
- C:\Windows\System\JUEGAwx.exe
  C:\Windows\System\JUEGAwx.exe
  2⤵
  PID:6708
- C:\Windows\System\tFIVXTL.exe
  C:\Windows\System\tFIVXTL.exe
  2⤵
  PID:6240
- C:\Windows\System\STrNaRq.exe
  C:\Windows\System\STrNaRq.exe
  2⤵
  PID:6908
- C:\Windows\System\yDOVNNN.exe
  C:\Windows\System\yDOVNNN.exe
  2⤵
  PID:6400
- C:\Windows\System\wZjYGgC.exe
  C:\Windows\System\wZjYGgC.exe
  2⤵
  PID:6508
- C:\Windows\System\hkwUkfO.exe
  C:\Windows\System\hkwUkfO.exe
  2⤵
  PID:6920
- C:\Windows\System\nsGcOpO.exe
  C:\Windows\System\nsGcOpO.exe
  2⤵
  PID:6316
- C:\Windows\System\LpqoIEt.exe
  C:\Windows\System\LpqoIEt.exe
  2⤵
  PID:6460
- C:\Windows\System\LwWIoER.exe
  C:\Windows\System\LwWIoER.exe
  2⤵
  PID:7172
- C:\Windows\System\rPSJCrf.exe
  C:\Windows\System\rPSJCrf.exe
  2⤵
  PID:7192
- C:\Windows\System\prDULiq.exe
  C:\Windows\System\prDULiq.exe
  2⤵
  PID:7216
- C:\Windows\System\MlPnQys.exe
  C:\Windows\System\MlPnQys.exe
  2⤵
  PID:7236
- C:\Windows\System\GgIXLQV.exe
  C:\Windows\System\GgIXLQV.exe
  2⤵
  PID:7252
- C:\Windows\System\LODTzuw.exe
  C:\Windows\System\LODTzuw.exe
  2⤵
  PID:7272
- C:\Windows\System\QpVBPfL.exe
  C:\Windows\System\QpVBPfL.exe
  2⤵
  PID:7288
- C:\Windows\System\UiOKRee.exe
  C:\Windows\System\UiOKRee.exe
  2⤵
  PID:7304
- C:\Windows\System\rnCaYKK.exe
  C:\Windows\System\rnCaYKK.exe
  2⤵
  PID:7324
- C:\Windows\System\OnAxOtP.exe
  C:\Windows\System\OnAxOtP.exe
  2⤵
  PID:7340
- C:\Windows\System\JQiHSaw.exe
  C:\Windows\System\JQiHSaw.exe
  2⤵
  PID:7356
- C:\Windows\System\fwAQCdS.exe
  C:\Windows\System\fwAQCdS.exe
  2⤵
  PID:7372
- C:\Windows\System\jrKKCFa.exe
  C:\Windows\System\jrKKCFa.exe
  2⤵
  PID:7388
- C:\Windows\System\asrzhrr.exe
  C:\Windows\System\asrzhrr.exe
  2⤵
  PID:7404
- C:\Windows\System\ZKehscJ.exe
  C:\Windows\System\ZKehscJ.exe
  2⤵
  PID:7428
- C:\Windows\System\ahkVfAQ.exe
  C:\Windows\System\ahkVfAQ.exe
  2⤵
  PID:7448
- C:\Windows\System\khnidqU.exe
  C:\Windows\System\khnidqU.exe
  2⤵
  PID:7468
- C:\Windows\System\yyMOnCl.exe
  C:\Windows\System\yyMOnCl.exe
  2⤵
  PID:7484
- C:\Windows\System\ontVJOx.exe
  C:\Windows\System\ontVJOx.exe
  2⤵
  PID:7500
- C:\Windows\System\iGAcrJb.exe
  C:\Windows\System\iGAcrJb.exe
  2⤵
  PID:7516
- C:\Windows\System\DPBGGUI.exe
  C:\Windows\System\DPBGGUI.exe
  2⤵
  PID:7532
- C:\Windows\System\rZZIkdi.exe
  C:\Windows\System\rZZIkdi.exe
  2⤵
  PID:7548
- C:\Windows\System\eOmlpGj.exe
  C:\Windows\System\eOmlpGj.exe
  2⤵
  PID:7564
- C:\Windows\System\VhXpMBi.exe
  C:\Windows\System\VhXpMBi.exe
  2⤵
  PID:7580
- C:\Windows\System\mLmrLRE.exe
  C:\Windows\System\mLmrLRE.exe
  2⤵
  PID:7596
- C:\Windows\System\GUcTQzR.exe
  C:\Windows\System\GUcTQzR.exe
  2⤵
  PID:7612
- C:\Windows\System\iMiQrIT.exe
  C:\Windows\System\iMiQrIT.exe
  2⤵
  PID:7628
- C:\Windows\System\vqNsTXh.exe
  C:\Windows\System\vqNsTXh.exe
  2⤵
  PID:7644
- C:\Windows\System\HiGRLFI.exe
  C:\Windows\System\HiGRLFI.exe
  2⤵
  PID:7660
- C:\Windows\System\gTXvTuc.exe
  C:\Windows\System\gTXvTuc.exe
  2⤵
  PID:7680
- C:\Windows\System\hiZRmBU.exe
  C:\Windows\System\hiZRmBU.exe
  2⤵
  PID:7696
- C:\Windows\System\IhBuVnJ.exe
  C:\Windows\System\IhBuVnJ.exe
  2⤵
  PID:7716
- C:\Windows\System\oSjerCG.exe
  C:\Windows\System\oSjerCG.exe
  2⤵
  PID:7732
- C:\Windows\System\LPINLto.exe
  C:\Windows\System\LPINLto.exe
  2⤵
  PID:7748
- C:\Windows\System\ECOnITc.exe
  C:\Windows\System\ECOnITc.exe
  2⤵
  PID:7764
- C:\Windows\System\qYJXRLg.exe
  C:\Windows\System\qYJXRLg.exe
  2⤵
  PID:7780
- C:\Windows\System\cfDjHQx.exe
  C:\Windows\System\cfDjHQx.exe
  2⤵
  PID:7796
- C:\Windows\System\iQxGZfw.exe
  C:\Windows\System\iQxGZfw.exe
  2⤵
  PID:7812
- C:\Windows\System\KaFwaie.exe
  C:\Windows\System\KaFwaie.exe
  2⤵
  PID:7828
- C:\Windows\System\IlEmyxj.exe
  C:\Windows\System\IlEmyxj.exe
  2⤵
  PID:7844
- C:\Windows\System\bWCvsYm.exe
  C:\Windows\System\bWCvsYm.exe
  2⤵
  PID:7860
- C:\Windows\System\TlXHBdd.exe
  C:\Windows\System\TlXHBdd.exe
  2⤵
  PID:7876
- C:\Windows\System\XVNYPvZ.exe
  C:\Windows\System\XVNYPvZ.exe
  2⤵
  PID:7892
- C:\Windows\System\SPkEvNY.exe
  C:\Windows\System\SPkEvNY.exe
  2⤵
  PID:7908
- C:\Windows\System\XguMyPn.exe
  C:\Windows\System\XguMyPn.exe
  2⤵
  PID:7924
- C:\Windows\System\ocxyOUz.exe
  C:\Windows\System\ocxyOUz.exe
  2⤵
  PID:7940
- C:\Windows\System\gEJjjDz.exe
  C:\Windows\System\gEJjjDz.exe
  2⤵
  PID:7956
- C:\Windows\System\plGWxlA.exe
  C:\Windows\System\plGWxlA.exe
  2⤵
  PID:7976
- C:\Windows\System\TzUfkuN.exe
  C:\Windows\System\TzUfkuN.exe
  2⤵
  PID:7996
- C:\Windows\System\EdwYYPt.exe
  C:\Windows\System\EdwYYPt.exe
  2⤵
  PID:8020
- C:\Windows\System\btESFsF.exe
  C:\Windows\System\btESFsF.exe
  2⤵
  PID:8040
- C:\Windows\System\cZyNGEK.exe
  C:\Windows\System\cZyNGEK.exe
  2⤵
  PID:8056
- C:\Windows\System\jQidvYD.exe
  C:\Windows\System\jQidvYD.exe
  2⤵
  PID:8072
- C:\Windows\System\TySClKa.exe
  C:\Windows\System\TySClKa.exe
  2⤵
  PID:8092
- C:\Windows\System\BGlcLxB.exe
  C:\Windows\System\BGlcLxB.exe
  2⤵
  PID:7336
- C:\Windows\System\vCHhmIG.exe
  C:\Windows\System\vCHhmIG.exe
  2⤵
  PID:7128
- C:\Windows\System\mLIxxRe.exe
  C:\Windows\System\mLIxxRe.exe
  2⤵
  PID:7244
- C:\Windows\System\fploJks.exe
  C:\Windows\System\fploJks.exe
  2⤵
  PID:7312
- C:\Windows\System\CVkTAWP.exe
  C:\Windows\System\CVkTAWP.exe
  2⤵
  PID:7368
- C:\Windows\System\MpJbsJX.exe
  C:\Windows\System\MpJbsJX.exe
  2⤵
  PID:7396
- C:\Windows\System\CKamYMo.exe
  C:\Windows\System\CKamYMo.exe
  2⤵
  PID:7384
- C:\Windows\System\DIdQjuc.exe
  C:\Windows\System\DIdQjuc.exe
  2⤵
  PID:7508
- C:\Windows\System\oVSHHKa.exe
  C:\Windows\System\oVSHHKa.exe
  2⤵
  PID:7456
- C:\Windows\System\AclJGpk.exe
  C:\Windows\System\AclJGpk.exe
  2⤵
  PID:7496
- C:\Windows\System\dWNVlhd.exe
  C:\Windows\System\dWNVlhd.exe
  2⤵
  PID:7576
- C:\Windows\System\LOfmdQb.exe
  C:\Windows\System\LOfmdQb.exe
  2⤵
  PID:7608
- C:\Windows\System\mHAFASf.exe
  C:\Windows\System\mHAFASf.exe
  2⤵
  PID:7540
- C:\Windows\System\jvQrqql.exe
  C:\Windows\System\jvQrqql.exe
  2⤵
  PID:7592
- C:\Windows\System\HLgbyHl.exe
  C:\Windows\System\HLgbyHl.exe
  2⤵
  PID:7652
- C:\Windows\System\rZiMaGo.exe
  C:\Windows\System\rZiMaGo.exe
  2⤵
  PID:7756
- C:\Windows\System\YMptKoH.exe
  C:\Windows\System\YMptKoH.exe
  2⤵
  PID:7788
- C:\Windows\System\fnVJWNl.exe
  C:\Windows\System\fnVJWNl.exe
  2⤵
  PID:7852
- C:\Windows\System\PwnbiqZ.exe
  C:\Windows\System\PwnbiqZ.exe
  2⤵
  PID:7916
- C:\Windows\System\czdnVPt.exe
  C:\Windows\System\czdnVPt.exe
  2⤵
  PID:7984
- C:\Windows\System\MgvIrPx.exe
  C:\Windows\System\MgvIrPx.exe
  2⤵
  PID:8032
- C:\Windows\System\LunHznt.exe
  C:\Windows\System\LunHznt.exe
  2⤵
  PID:8068
- C:\Windows\System\ytKgdYH.exe
  C:\Windows\System\ytKgdYH.exe
  2⤵
  PID:8112
- C:\Windows\System\uzPqhko.exe
  C:\Windows\System\uzPqhko.exe
  2⤵
  PID:7904
- C:\Windows\System\SDDhtIi.exe
  C:\Windows\System\SDDhtIi.exe
  2⤵
  PID:7740
- C:\Windows\System\nTklRaM.exe
  C:\Windows\System\nTklRaM.exe
  2⤵
  PID:8144
- C:\Windows\System\PpAsMkG.exe
  C:\Windows\System\PpAsMkG.exe
  2⤵
  PID:8132
- C:\Windows\System\UBAsjhJ.exe
  C:\Windows\System\UBAsjhJ.exe
  2⤵
  PID:8156
- C:\Windows\System\MNWwhav.exe
  C:\Windows\System\MNWwhav.exe
  2⤵
  PID:8180
- C:\Windows\System\bSpTTDD.exe
  C:\Windows\System\bSpTTDD.exe
  2⤵
  PID:7184
- C:\Windows\System\TIskXoU.exe
  C:\Windows\System\TIskXoU.exe
  2⤵
  PID:7232
- C:\Windows\System\SsgxWcP.exe
  C:\Windows\System\SsgxWcP.exe
  2⤵
  PID:7300
- C:\Windows\System\KRyiDKb.exe
  C:\Windows\System\KRyiDKb.exe
  2⤵
  PID:6208
- C:\Windows\System\hQhuNVB.exe
  C:\Windows\System\hQhuNVB.exe
  2⤵
  PID:7064
- C:\Windows\System\EXXfKju.exe
  C:\Windows\System\EXXfKju.exe
  2⤵
  PID:7364
- C:\Windows\System\vFWnyeP.exe
  C:\Windows\System\vFWnyeP.exe
  2⤵
  PID:7412
- C:\Windows\System\qVCtJNk.exe
  C:\Windows\System\qVCtJNk.exe
  2⤵
  PID:7572
- C:\Windows\System\sKiVNeC.exe
  C:\Windows\System\sKiVNeC.exe
  2⤵
  PID:7624
- C:\Windows\System\ayPedJy.exe
  C:\Windows\System\ayPedJy.exe
  2⤵
  PID:7888
- C:\Windows\System\jnUDYPq.exe
  C:\Windows\System\jnUDYPq.exe
  2⤵
  PID:7972
- C:\Windows\System\XyhYxrB.exe
  C:\Windows\System\XyhYxrB.exe
  2⤵
  PID:7464
- C:\Windows\System\hzvLwEl.exe
  C:\Windows\System\hzvLwEl.exe
  2⤵
  PID:6296
- C:\Windows\System\ZHjBQat.exe
  C:\Windows\System\ZHjBQat.exe
  2⤵
  PID:7524
- C:\Windows\System\HBnOzlp.exe
  C:\Windows\System\HBnOzlp.exe
  2⤵
  PID:7688
- C:\Windows\System\wHkpIWg.exe
  C:\Windows\System\wHkpIWg.exe
  2⤵
  PID:8100
- C:\Windows\System\HNHHWku.exe
  C:\Windows\System\HNHHWku.exe
  2⤵
  PID:7676
- C:\Windows\System\IkAwKlv.exe
  C:\Windows\System\IkAwKlv.exe
  2⤵
  PID:7804
- C:\Windows\System\epXJcbc.exe
  C:\Windows\System\epXJcbc.exe
  2⤵
  PID:7840
- C:\Windows\System\GIHXVmk.exe
  C:\Windows\System\GIHXVmk.exe
  2⤵
  PID:7264
- C:\Windows\System\RXDjmio.exe
  C:\Windows\System\RXDjmio.exe
  2⤵
  PID:7188
- C:\Windows\System\MDTggBm.exe
  C:\Windows\System\MDTggBm.exe
  2⤵
  PID:8160
- C:\Windows\System\rGOrLxx.exe
  C:\Windows\System\rGOrLxx.exe
  2⤵
  PID:7348
- C:\Windows\System\OJdlCoy.exe
  C:\Windows\System\OJdlCoy.exe
  2⤵
  PID:7332
- C:\Windows\System\iHxtmrB.exe
  C:\Windows\System\iHxtmrB.exe
  2⤵
  PID:7884
- C:\Windows\System\nxeunez.exe
  C:\Windows\System\nxeunez.exe
  2⤵
  PID:7492
- C:\Windows\System\CfRltbN.exe
  C:\Windows\System\CfRltbN.exe
  2⤵
  PID:7872
- C:\Windows\System\yqWAHQN.exe
  C:\Windows\System\yqWAHQN.exe
  2⤵
  PID:7820
- C:\Windows\System\CihuoTw.exe
  C:\Windows\System\CihuoTw.exe
  2⤵
  PID:7964
- C:\Windows\System\QCjVCHa.exe
  C:\Windows\System\QCjVCHa.exe
  2⤵
  PID:8008
- C:\Windows\System\qzCGZiw.exe
  C:\Windows\System\qzCGZiw.exe
  2⤵
  PID:8048
- C:\Windows\System\JoOSsXg.exe
  C:\Windows\System\JoOSsXg.exe
  2⤵
  PID:8152
- C:\Windows\System\rqughjT.exe
  C:\Windows\System\rqughjT.exe
  2⤵
  PID:8188
- C:\Windows\System\OSjNcpW.exe
  C:\Windows\System\OSjNcpW.exe
  2⤵
  PID:7052
- C:\Windows\System\RkXmbot.exe
  C:\Windows\System\RkXmbot.exe
  2⤵
  PID:7268
- C:\Windows\System\DUrrBMM.exe
  C:\Windows\System\DUrrBMM.exe
  2⤵
  PID:8104
- C:\Windows\System\BSufRpj.exe
  C:\Windows\System\BSufRpj.exe
  2⤵
  PID:7932
- C:\Windows\System\huhlPDt.exe
  C:\Windows\System\huhlPDt.exe
  2⤵
  PID:7284
- C:\Windows\System\ygDpexb.exe
  C:\Windows\System\ygDpexb.exe
  2⤵
  PID:8184
- C:\Windows\System\KRyzsGv.exe
  C:\Windows\System\KRyzsGv.exe
  2⤵
  PID:7512
- C:\Windows\System\cUgzfLW.exe
  C:\Windows\System\cUgzfLW.exe
  2⤵
  PID:7708
- C:\Windows\System\BqanwUu.exe
  C:\Windows\System\BqanwUu.exe
  2⤵
  PID:7436
- C:\Windows\System\kEKFCIn.exe
  C:\Windows\System\kEKFCIn.exe
  2⤵
  PID:6332
- C:\Windows\System\sCWPVFn.exe
  C:\Windows\System\sCWPVFn.exe
  2⤵
  PID:8004
- C:\Windows\System\SmStfRL.exe
  C:\Windows\System\SmStfRL.exe
  2⤵
  PID:7228
- C:\Windows\System\xFHKjMG.exe
  C:\Windows\System\xFHKjMG.exe
  2⤵
  PID:7560
- C:\Windows\System\ELlmiIA.exe
  C:\Windows\System\ELlmiIA.exe
  2⤵
  PID:1672
- C:\Windows\System\gaHQMKt.exe
  C:\Windows\System\gaHQMKt.exe
  2⤵
  PID:7544
- C:\Windows\System\ZwhEtpP.exe
  C:\Windows\System\ZwhEtpP.exe
  2⤵
  PID:8052
- C:\Windows\System\WhCSTjN.exe
  C:\Windows\System\WhCSTjN.exe
  2⤵
  PID:8204
- C:\Windows\System\qAGSZFi.exe
  C:\Windows\System\qAGSZFi.exe
  2⤵
  PID:8220
- C:\Windows\System\zYxSRjk.exe
  C:\Windows\System\zYxSRjk.exe
  2⤵
  PID:8236
- C:\Windows\System\GWOTedM.exe
  C:\Windows\System\GWOTedM.exe
  2⤵
  PID:8256
- C:\Windows\System\asAUcoR.exe
  C:\Windows\System\asAUcoR.exe
  2⤵
  PID:8272
- C:\Windows\System\UVxMfej.exe
  C:\Windows\System\UVxMfej.exe
  2⤵
  PID:8288
- C:\Windows\System\XPKHHpn.exe
  C:\Windows\System\XPKHHpn.exe
  2⤵
  PID:8304
- C:\Windows\System\SoGbCwF.exe
  C:\Windows\System\SoGbCwF.exe
  2⤵
  PID:8320
- C:\Windows\System\ypNijsc.exe
  C:\Windows\System\ypNijsc.exe
  2⤵
  PID:8336
- C:\Windows\System\BbDaPoj.exe
  C:\Windows\System\BbDaPoj.exe
  2⤵
  PID:8352
- C:\Windows\System\RxorTbo.exe
  C:\Windows\System\RxorTbo.exe
  2⤵
  PID:8368
- C:\Windows\System\IjNQCYA.exe
  C:\Windows\System\IjNQCYA.exe
  2⤵
  PID:8384
- C:\Windows\System\YSIMTvK.exe
  C:\Windows\System\YSIMTvK.exe
  2⤵
  PID:8400
- C:\Windows\System\WfcJSwU.exe
  C:\Windows\System\WfcJSwU.exe
  2⤵
  PID:8420
- C:\Windows\System\QRUlMOw.exe
  C:\Windows\System\QRUlMOw.exe
  2⤵
  PID:8440
- C:\Windows\System\jHALAbB.exe
  C:\Windows\System\jHALAbB.exe
  2⤵
  PID:8456
- C:\Windows\System\zbWckTo.exe
  C:\Windows\System\zbWckTo.exe
  2⤵
  PID:8484
- C:\Windows\System\vQDTQtF.exe
  C:\Windows\System\vQDTQtF.exe
  2⤵
  PID:8504
- C:\Windows\System\vNaTVjV.exe
  C:\Windows\System\vNaTVjV.exe
  2⤵
  PID:8532
- C:\Windows\System\qwBxvkc.exe
  C:\Windows\System\qwBxvkc.exe
  2⤵
  PID:8564
- C:\Windows\System\wajQbuR.exe
  C:\Windows\System\wajQbuR.exe
  2⤵
  PID:8580
- C:\Windows\System\QlkCyAc.exe
  C:\Windows\System\QlkCyAc.exe
  2⤵
  PID:8596
- C:\Windows\System\SQARbqV.exe
  C:\Windows\System\SQARbqV.exe
  2⤵
  PID:8612
- C:\Windows\System\oSPfpjY.exe
  C:\Windows\System\oSPfpjY.exe
  2⤵
  PID:8688
- C:\Windows\System\xBCjTdM.exe
  C:\Windows\System\xBCjTdM.exe
  2⤵
  PID:8712
- C:\Windows\System\GDNFJOj.exe
  C:\Windows\System\GDNFJOj.exe
  2⤵
  PID:8732
- C:\Windows\System\RXtlhsj.exe
  C:\Windows\System\RXtlhsj.exe
  2⤵
  PID:8752
- C:\Windows\System\sgnvzhM.exe
  C:\Windows\System\sgnvzhM.exe
  2⤵
  PID:8768
- C:\Windows\System\RwzFakp.exe
  C:\Windows\System\RwzFakp.exe
  2⤵
  PID:8788
- C:\Windows\System\IhkuRBt.exe
  C:\Windows\System\IhkuRBt.exe
  2⤵
  PID:8812
- C:\Windows\System\AnIeUEr.exe
  C:\Windows\System\AnIeUEr.exe
  2⤵
  PID:8828
- C:\Windows\System\eTTobsg.exe
  C:\Windows\System\eTTobsg.exe
  2⤵
  PID:8844
- C:\Windows\System\hajkbvN.exe
  C:\Windows\System\hajkbvN.exe
  2⤵
  PID:8868
- C:\Windows\System\IfDWDMB.exe
  C:\Windows\System\IfDWDMB.exe
  2⤵
  PID:8884
- C:\Windows\System\ANwmkYp.exe
  C:\Windows\System\ANwmkYp.exe
  2⤵
  PID:8908
- C:\Windows\System\mjxyaAh.exe
  C:\Windows\System\mjxyaAh.exe
  2⤵
  PID:8924
- C:\Windows\System\QTUqIAz.exe
  C:\Windows\System\QTUqIAz.exe
  2⤵
  PID:8952
- C:\Windows\System\NpqagyI.exe
  C:\Windows\System\NpqagyI.exe
  2⤵
  PID:8976
- C:\Windows\System\aiiszuQ.exe
  C:\Windows\System\aiiszuQ.exe
  2⤵
  PID:8992
- C:\Windows\System\oUWIgug.exe
  C:\Windows\System\oUWIgug.exe
  2⤵
  PID:9012
- C:\Windows\System\IwHDORM.exe
  C:\Windows\System\IwHDORM.exe
  2⤵
  PID:9036
- C:\Windows\System\iGUqkfR.exe
  C:\Windows\System\iGUqkfR.exe
  2⤵
  PID:9056
- C:\Windows\System\TADWrwk.exe
  C:\Windows\System\TADWrwk.exe
  2⤵
  PID:9076
- C:\Windows\System\ghVMyMA.exe
  C:\Windows\System\ghVMyMA.exe
  2⤵
  PID:9100
- C:\Windows\System\FthbWlR.exe
  C:\Windows\System\FthbWlR.exe
  2⤵
  PID:9120
- C:\Windows\System\IEuWduD.exe
  C:\Windows\System\IEuWduD.exe
  2⤵
  PID:9140
- C:\Windows\System\YJZBOJH.exe
  C:\Windows\System\YJZBOJH.exe
  2⤵
  PID:9160
- C:\Windows\System\IGpxVIp.exe
  C:\Windows\System\IGpxVIp.exe
  2⤵
  PID:9176
- C:\Windows\System\MbZnbLD.exe
  C:\Windows\System\MbZnbLD.exe
  2⤵
  PID:9196
- C:\Windows\System\VZUHBYb.exe
  C:\Windows\System\VZUHBYb.exe
  2⤵
  PID:9212
- C:\Windows\System\ItAjIUJ.exe
  C:\Windows\System\ItAjIUJ.exe
  2⤵
  PID:8216
- C:\Windows\System\lDfIbHw.exe
  C:\Windows\System\lDfIbHw.exe
  2⤵
  PID:8228
- C:\Windows\System\qaIKmkW.exe
  C:\Windows\System\qaIKmkW.exe
  2⤵
  PID:8296
- C:\Windows\System\KUimFFK.exe
  C:\Windows\System\KUimFFK.exe
  2⤵
  PID:8248
- C:\Windows\System\TPCfSfM.exe
  C:\Windows\System\TPCfSfM.exe
  2⤵
  PID:8284
- C:\Windows\System\PeWLrvH.exe
  C:\Windows\System\PeWLrvH.exe
  2⤵
  PID:8428
- C:\Windows\System\JrDLKIj.exe
  C:\Windows\System\JrDLKIj.exe
  2⤵
  PID:8360
- C:\Windows\System\MECfKAx.exe
  C:\Windows\System\MECfKAx.exe
  2⤵
  PID:8348
- C:\Windows\System\SfKNHyq.exe
  C:\Windows\System\SfKNHyq.exe
  2⤵
  PID:8492
- C:\Windows\System\tuxcrma.exe
  C:\Windows\System\tuxcrma.exe
  2⤵
  PID:8496
- C:\Windows\System\UERBNxl.exe
  C:\Windows\System\UERBNxl.exe
  2⤵
  PID:8544
- C:\Windows\System\hmlRNRk.exe
  C:\Windows\System\hmlRNRk.exe
  2⤵
  PID:8552
- C:\Windows\System\zqUvLzO.exe
  C:\Windows\System\zqUvLzO.exe
  2⤵
  PID:8624
- C:\Windows\System\iiRqVNu.exe
  C:\Windows\System\iiRqVNu.exe
  2⤵
  PID:8640
- C:\Windows\System\BhOcEiB.exe
  C:\Windows\System\BhOcEiB.exe
  2⤵
  PID:8604
- C:\Windows\System\vIIhYhK.exe
  C:\Windows\System\vIIhYhK.exe
  2⤵
  PID:2724
- C:\Windows\System\BgEgQoz.exe
  C:\Windows\System\BgEgQoz.exe
  2⤵
  PID:8720
- C:\Windows\System\Nbkwpsq.exe
  C:\Windows\System\Nbkwpsq.exe
  2⤵
  PID:8748
- C:\Windows\System\DVNLawr.exe
  C:\Windows\System\DVNLawr.exe
  2⤵
  PID:8796
- C:\Windows\System\bFqRbJI.exe
  C:\Windows\System\bFqRbJI.exe
  2⤵
  PID:8800
- C:\Windows\System\DDiGBPQ.exe
  C:\Windows\System\DDiGBPQ.exe
  2⤵
  PID:8852
- C:\Windows\System\kXAUBKm.exe
  C:\Windows\System\kXAUBKm.exe
  2⤵
  PID:8876
- C:\Windows\System\bMJePPU.exe
  C:\Windows\System\bMJePPU.exe
  2⤵
  PID:2660
- C:\Windows\System\WSSrxBw.exe
  C:\Windows\System\WSSrxBw.exe
  2⤵
  PID:8932
- C:\Windows\System\oLJxmrR.exe
  C:\Windows\System\oLJxmrR.exe
  2⤵
  PID:8244
- C:\Windows\System\GVguFlo.exe
  C:\Windows\System\GVguFlo.exe
  2⤵
  PID:8968
- C:\Windows\System\QXQhSNz.exe
  C:\Windows\System\QXQhSNz.exe
  2⤵
  PID:9004
- C:\Windows\System\QqDlzQH.exe
  C:\Windows\System\QqDlzQH.exe
  2⤵
  PID:9052
- C:\Windows\System\RLAddnd.exe
  C:\Windows\System\RLAddnd.exe
  2⤵
  PID:9092
- C:\Windows\System\BcgQqdo.exe
  C:\Windows\System\BcgQqdo.exe
  2⤵
  PID:9116
- C:\Windows\System\UpUgCPk.exe
  C:\Windows\System\UpUgCPk.exe
  2⤵
  PID:9148
- C:\Windows\System\fwKfnMd.exe
  C:\Windows\System\fwKfnMd.exe
  2⤵
  PID:9192
- C:\Windows\System\vpVmILw.exe
  C:\Windows\System\vpVmILw.exe
  2⤵
  PID:9204
- C:\Windows\System\AreQAEq.exe
  C:\Windows\System\AreQAEq.exe
  2⤵
  PID:8316
- C:\Windows\System\zqmysoX.exe
  C:\Windows\System\zqmysoX.exe
  2⤵
  PID:8392
- C:\Windows\System\SqlYRXN.exe
  C:\Windows\System\SqlYRXN.exe
  2⤵
  PID:8412
- C:\Windows\System\jZLlznt.exe
  C:\Windows\System\jZLlznt.exe
  2⤵
  PID:8476
- C:\Windows\System\GXvClOY.exe
  C:\Windows\System\GXvClOY.exe
  2⤵
  PID:8380
- C:\Windows\System\htWuDqV.exe
  C:\Windows\System\htWuDqV.exe
  2⤵
  PID:8312
- C:\Windows\System\bXmXDvp.exe
  C:\Windows\System\bXmXDvp.exe
  2⤵
  PID:8648
- C:\Windows\System\UgZnCaj.exe
  C:\Windows\System\UgZnCaj.exe
  2⤵
  PID:8576
- C:\Windows\System\jnglbCe.exe
  C:\Windows\System\jnglbCe.exe
  2⤵
  PID:8524
- C:\Windows\System\spDmxlv.exe
  C:\Windows\System\spDmxlv.exe
  2⤵
  PID:8548
- C:\Windows\System\CffxiiV.exe
  C:\Windows\System\CffxiiV.exe
  2⤵
  PID:8696
- C:\Windows\System\RUdOirp.exe
  C:\Windows\System\RUdOirp.exe
  2⤵
  PID:8760
- C:\Windows\System\wRQLVhV.exe
  C:\Windows\System\wRQLVhV.exe
  2⤵
  PID:8824
- C:\Windows\System\WzbomBb.exe
  C:\Windows\System\WzbomBb.exe
  2⤵
  PID:8780
- C:\Windows\System\AYoYbAX.exe
  C:\Windows\System\AYoYbAX.exe
  2⤵
  PID:8904
- C:\Windows\System\lHdzpUS.exe
  C:\Windows\System\lHdzpUS.exe
  2⤵
  PID:8652
- C:\Windows\System\XlgYcmR.exe
  C:\Windows\System\XlgYcmR.exe
  2⤵
  PID:8860
- C:\Windows\System\HUkhCJa.exe
  C:\Windows\System\HUkhCJa.exe
  2⤵
  PID:9028
- C:\Windows\System\zigUHnH.exe
  C:\Windows\System\zigUHnH.exe
  2⤵
  PID:9072
- C:\Windows\System\maySCsR.exe
  C:\Windows\System\maySCsR.exe
  2⤵
  PID:9020
- C:\Windows\System\xIOnDYM.exe
  C:\Windows\System\xIOnDYM.exe
  2⤵
  PID:9136
- C:\Windows\System\htWzTdw.exe
  C:\Windows\System\htWzTdw.exe
  2⤵
  PID:9168
- C:\Windows\System\NOAMAWH.exe
  C:\Windows\System\NOAMAWH.exe
  2⤵
  PID:8408
- C:\Windows\System\DqrJIGq.exe
  C:\Windows\System\DqrJIGq.exe
  2⤵
  PID:8480
- C:\Windows\System\SuvGHGA.exe
  C:\Windows\System\SuvGHGA.exe
  2⤵
  PID:8700
- C:\Windows\System\YUenFWV.exe
  C:\Windows\System\YUenFWV.exe
  2⤵
  PID:8940
- C:\Windows\System\LSLyMGS.exe
  C:\Windows\System\LSLyMGS.exe
  2⤵
  PID:9008
- C:\Windows\System\PpGrLEW.exe
  C:\Windows\System\PpGrLEW.exe
  2⤵
  PID:9172
- C:\Windows\System\LTgrJfx.exe
  C:\Windows\System\LTgrJfx.exe
  2⤵
  PID:9108
- C:\Windows\System\spcANkF.exe
  C:\Windows\System\spcANkF.exe
  2⤵
  PID:9184
- C:\Windows\System\dfhNUuS.exe
  C:\Windows\System\dfhNUuS.exe
  2⤵
  PID:9240
- C:\Windows\System\obBIPHD.exe
  C:\Windows\System\obBIPHD.exe
  2⤵
  PID:9256
- C:\Windows\System\NXBpwVQ.exe
  C:\Windows\System\NXBpwVQ.exe
  2⤵
  PID:9280
- C:\Windows\System\PewhFDQ.exe
  C:\Windows\System\PewhFDQ.exe
  2⤵
  PID:9296
- C:\Windows\System\mTcOAuF.exe
  C:\Windows\System\mTcOAuF.exe
  2⤵
  PID:9316
- C:\Windows\System\gzsOsUY.exe
  C:\Windows\System\gzsOsUY.exe
  2⤵
  PID:9336
- C:\Windows\System\hBgpnxq.exe
  C:\Windows\System\hBgpnxq.exe
  2⤵
  PID:9352
- C:\Windows\System\pnGCgxE.exe
  C:\Windows\System\pnGCgxE.exe
  2⤵
  PID:9368
- C:\Windows\System\SlPaGTQ.exe
  C:\Windows\System\SlPaGTQ.exe
  2⤵
  PID:9440
- C:\Windows\System\LsGPWeS.exe
  C:\Windows\System\LsGPWeS.exe
  2⤵
  PID:9460
- C:\Windows\System\oXVnRTB.exe
  C:\Windows\System\oXVnRTB.exe
  2⤵
  PID:9476
- C:\Windows\System\yTKFFQi.exe
  C:\Windows\System\yTKFFQi.exe
  2⤵
  PID:9492
- C:\Windows\System\vPPQcpH.exe
  C:\Windows\System\vPPQcpH.exe
  2⤵
  PID:9512
- C:\Windows\System\etKIQri.exe
  C:\Windows\System\etKIQri.exe
  2⤵
  PID:9528
- C:\Windows\System\VgONtIs.exe
  C:\Windows\System\VgONtIs.exe
  2⤵
  PID:9548
- C:\Windows\System\QCblbqU.exe
  C:\Windows\System\QCblbqU.exe
  2⤵
  PID:9572
- C:\Windows\System\XkrOcwM.exe
  C:\Windows\System\XkrOcwM.exe
  2⤵
  PID:9588
- C:\Windows\System\FgDrhjr.exe
  C:\Windows\System\FgDrhjr.exe
  2⤵
  PID:9608
- C:\Windows\System\RGMcagx.exe
  C:\Windows\System\RGMcagx.exe
  2⤵
  PID:9628
- C:\Windows\System\PNxSabu.exe
  C:\Windows\System\PNxSabu.exe
  2⤵
  PID:9648
- C:\Windows\System\IwlwywR.exe
  C:\Windows\System\IwlwywR.exe
  2⤵
  PID:9668
- C:\Windows\System\EyZECBJ.exe
  C:\Windows\System\EyZECBJ.exe
  2⤵
  PID:9684
- C:\Windows\System\kViSgPy.exe
  C:\Windows\System\kViSgPy.exe
  2⤵
  PID:9708
- C:\Windows\System\psSeaWw.exe
  C:\Windows\System\psSeaWw.exe
  2⤵
  PID:9724
- C:\Windows\System\yttNbFy.exe
  C:\Windows\System\yttNbFy.exe
  2⤵
  PID:9744
- C:\Windows\System\oFZRpaf.exe
  C:\Windows\System\oFZRpaf.exe
  2⤵
  PID:9764
- C:\Windows\System\gtZrLcv.exe
  C:\Windows\System\gtZrLcv.exe
  2⤵
  PID:9784
- C:\Windows\System\WEIHXha.exe
  C:\Windows\System\WEIHXha.exe
  2⤵
  PID:9800
- C:\Windows\System\LwDwzHR.exe
  C:\Windows\System\LwDwzHR.exe
  2⤵
  PID:9816
- C:\Windows\System\aLSxJXS.exe
  C:\Windows\System\aLSxJXS.exe
  2⤵
  PID:9836
- C:\Windows\System\uIjXVRt.exe
  C:\Windows\System\uIjXVRt.exe
  2⤵
  PID:9852
- C:\Windows\System\uUlzoLn.exe
  C:\Windows\System\uUlzoLn.exe
  2⤵
  PID:9872
- C:\Windows\System\CDIIqFn.exe
  C:\Windows\System\CDIIqFn.exe
  2⤵
  PID:9908
- C:\Windows\System\aIIpgVx.exe
  C:\Windows\System\aIIpgVx.exe
  2⤵
  PID:9940
- C:\Windows\System\WzeWQsQ.exe
  C:\Windows\System\WzeWQsQ.exe
  2⤵
  PID:9956
- C:\Windows\System\BepgdgS.exe
  C:\Windows\System\BepgdgS.exe
  2⤵
  PID:9972
- C:\Windows\System\ZOfeOGW.exe
  C:\Windows\System\ZOfeOGW.exe
  2⤵
  PID:9988
- C:\Windows\System\xhrAxTI.exe
  C:\Windows\System\xhrAxTI.exe
  2⤵
  PID:10020
- C:\Windows\System\LbCuKoO.exe
  C:\Windows\System\LbCuKoO.exe
  2⤵
  PID:10040
- C:\Windows\System\SUEVRea.exe
  C:\Windows\System\SUEVRea.exe
  2⤵
  PID:10056
- C:\Windows\System\aUdPyGZ.exe
  C:\Windows\System\aUdPyGZ.exe
  2⤵
  PID:10072
- C:\Windows\System\jtUSnCM.exe
  C:\Windows\System\jtUSnCM.exe
  2⤵
  PID:10096
- C:\Windows\System\qnArjHJ.exe
  C:\Windows\System\qnArjHJ.exe
  2⤵
  PID:10116
- C:\Windows\System\FqjZkni.exe
  C:\Windows\System\FqjZkni.exe
  2⤵
  PID:10132
- C:\Windows\System\AfEqWLw.exe
  C:\Windows\System\AfEqWLw.exe
  2⤵
  PID:10160
- C:\Windows\System\qQMRuZI.exe
  C:\Windows\System\qQMRuZI.exe
  2⤵
  PID:10180
- C:\Windows\System\RjwDwNn.exe
  C:\Windows\System\RjwDwNn.exe
  2⤵
  PID:10196
- C:\Windows\System\AWdPwro.exe
  C:\Windows\System\AWdPwro.exe
  2⤵
  PID:10216
- C:\Windows\System\fCYPomr.exe
  C:\Windows\System\fCYPomr.exe
  2⤵
  PID:10232
- C:\Windows\System\FdGlJKC.exe
  C:\Windows\System\FdGlJKC.exe
  2⤵
  PID:8920
- C:\Windows\System\CyEuYcR.exe
  C:\Windows\System\CyEuYcR.exe
  2⤵
  PID:9208
- C:\Windows\System\oZEiTJm.exe
  C:\Windows\System\oZEiTJm.exe
  2⤵
  PID:9324
- C:\Windows\System\SxLdGIO.exe
  C:\Windows\System\SxLdGIO.exe
  2⤵
  PID:9364
- C:\Windows\System\TEvDMqV.exe
  C:\Windows\System\TEvDMqV.exe
  2⤵
  PID:9228
- C:\Windows\System\pNxHvUm.exe
  C:\Windows\System\pNxHvUm.exe
  2⤵
  PID:9264
- C:\Windows\System\bsKvsko.exe
  C:\Windows\System\bsKvsko.exe
  2⤵
  PID:8588
- C:\Windows\System\OpyntXK.exe
  C:\Windows\System\OpyntXK.exe
  2⤵
  PID:8516
- C:\Windows\System\NAfJyNE.exe
  C:\Windows\System\NAfJyNE.exe
  2⤵
  PID:9344
- C:\Windows\System\wWyrCxD.exe
  C:\Windows\System\wWyrCxD.exe
  2⤵
  PID:9396
- C:\Windows\System\uzgPytn.exe
  C:\Windows\System\uzgPytn.exe
  2⤵
  PID:8900
- C:\Windows\System\iLilZJc.exe
  C:\Windows\System\iLilZJc.exe
  2⤵
  PID:9064
- C:\Windows\System\DioAeuw.exe
  C:\Windows\System\DioAeuw.exe
  2⤵
  PID:8344
- C:\Windows\System\xYndeEv.exe
  C:\Windows\System\xYndeEv.exe
  2⤵
  PID:9268
- C:\Windows\System\whehOqq.exe
  C:\Windows\System\whehOqq.exe
  2⤵
  PID:8988
- C:\Windows\System\aNlIovu.exe
  C:\Windows\System\aNlIovu.exe
  2⤵
  PID:9272
- C:\Windows\System\KteSbQD.exe
  C:\Windows\System\KteSbQD.exe
  2⤵
  PID:9404
- C:\Windows\System\dhBgvWU.exe
  C:\Windows\System\dhBgvWU.exe
  2⤵
  PID:9452
- C:\Windows\System\mCjgBUM.exe
  C:\Windows\System\mCjgBUM.exe
  2⤵
  PID:9484
- C:\Windows\System\bYjxALQ.exe
  C:\Windows\System\bYjxALQ.exe
  2⤵
  PID:9556
- C:\Windows\System\SZAdXVb.exe
  C:\Windows\System\SZAdXVb.exe
  2⤵
  PID:9604
- C:\Windows\System\dzyAQdf.exe
  C:\Windows\System\dzyAQdf.exe
  2⤵
  PID:9676
- C:\Windows\System\yhzgYJl.exe
  C:\Windows\System\yhzgYJl.exe
  2⤵
  PID:9720
- C:\Windows\System\XRyWDfc.exe
  C:\Windows\System\XRyWDfc.exe
  2⤵
  PID:9796
- C:\Windows\System\jVkrSzB.exe
  C:\Windows\System\jVkrSzB.exe
  2⤵
  PID:9832
- C:\Windows\System\ojvkGUv.exe
  C:\Windows\System\ojvkGUv.exe
  2⤵
  PID:9780
- C:\Windows\System\nGwecOs.exe
  C:\Windows\System\nGwecOs.exe
  2⤵
  PID:9732
- C:\Windows\System\azGdNGn.exe
  C:\Windows\System\azGdNGn.exe
  2⤵
  PID:9896
- C:\Windows\System\qKCdkQW.exe
  C:\Windows\System\qKCdkQW.exe
  2⤵
  PID:9888
- C:\Windows\System\HuNdilb.exe
  C:\Windows\System\HuNdilb.exe
  2⤵
  PID:9928
- C:\Windows\System\ICOtEOr.exe
  C:\Windows\System\ICOtEOr.exe
  2⤵
  PID:10000
- C:\Windows\System\lctvxVv.exe
  C:\Windows\System\lctvxVv.exe
  2⤵
  PID:10016
- C:\Windows\System\MLGMeRR.exe
  C:\Windows\System\MLGMeRR.exe
  2⤵
  PID:10028
- C:\Windows\System\qopvqEC.exe
  C:\Windows\System\qopvqEC.exe
  2⤵
  PID:10068
- C:\Windows\System\WOhnabM.exe
  C:\Windows\System\WOhnabM.exe
  2⤵
  PID:10104
- C:\Windows\System\tcJnfbJ.exe
  C:\Windows\System\tcJnfbJ.exe
  2⤵
  PID:10140
- C:\Windows\System\NTRhZvJ.exe
  C:\Windows\System\NTRhZvJ.exe
  2⤵
  PID:10172
- C:\Windows\System\rEnRJSv.exe
  C:\Windows\System\rEnRJSv.exe
  2⤵
  PID:10208
- C:\Windows\System\TqFxAKg.exe
  C:\Windows\System\TqFxAKg.exe
  2⤵
  PID:9252
- C:\Windows\System\lhcRPDe.exe
  C:\Windows\System\lhcRPDe.exe
  2⤵
  PID:8520
- C:\Windows\System\UntSxvK.exe
  C:\Windows\System\UntSxvK.exe
  2⤵
  PID:8840
- C:\Windows\System\jorcbWC.exe
  C:\Windows\System\jorcbWC.exe
  2⤵
  PID:8468
- C:\Windows\System\HVrfDbD.exe
  C:\Windows\System\HVrfDbD.exe
  2⤵
  PID:8264
- C:\Windows\System\TsVTxXD.exe
  C:\Windows\System\TsVTxXD.exe
  2⤵
  PID:8836
- C:\Windows\System\slRTMAq.exe
  C:\Windows\System\slRTMAq.exe
  2⤵
  PID:2732
- C:\Windows\System\yFuiEAf.exe
  C:\Windows\System\yFuiEAf.exe
  2⤵
  PID:8636
- C:\Windows\System\cVrFsfq.exe
  C:\Windows\System\cVrFsfq.exe
  2⤵
  PID:9304
- C:\Windows\System\XPCyuoz.exe
  C:\Windows\System\XPCyuoz.exe
  2⤵
  PID:9380
- C:\Windows\System\sMrSMZn.exe
  C:\Windows\System\sMrSMZn.exe
  2⤵
  PID:9568
- C:\Windows\System\NeXPjkO.exe
  C:\Windows\System\NeXPjkO.exe
  2⤵
  PID:9640
- C:\Windows\System\ZugBHCq.exe
  C:\Windows\System\ZugBHCq.exe
  2⤵
  PID:9508
- C:\Windows\System\MgTqKhK.exe
  C:\Windows\System\MgTqKhK.exe
  2⤵
  PID:9584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AhbkKYi.exe

Filesize
2.9MB

MD5
eaadcc32222170fe6dd5e4b706bc7a8f

SHA1
c46459ae2e294b956cd1fd6e06d8b6aa90de053a

SHA256
5a5089c8031f84e745ab2abd52fb2bd93dae93964d8a309ae50743f86fb56a90

SHA512
af3210252aa79b4e3439c8d674b613aad9d46851809cc9c89035e208c57037cdd2bf3e2a28d62295363055b41b11e372810b052b9fe325d700f8199df57e7a77

Download Submit
C:\Windows\system\HQyqHJe.exe

Filesize
2.9MB

MD5
c2ec7dd762e9c0ab7876ec257206dff1

SHA1
8b6e68fb3acd07627af4c1ada4b59455671b20d0

SHA256
25e107ceb54b6d0cea3a76bcd52fea8bcb1fc2048143f68b5306602d7835f366

SHA512
6e9d6c4dad5a77dcd0abe234e0d9666076439beba5aa725a06ca76be4d0fc5ef4126b77e11e15554dce7972d978d76ab46f28649334c59f3830901bddc7dff58

Download Submit
C:\Windows\system\HuiVBGX.exe

Filesize
2.9MB

MD5
3991dadaf26b92272df620f77604d649

SHA1
12d2d31858502bd3acda64d02bb82129797f5856

SHA256
51fa3fc57f3d6902b086586d76873aa5c36d6ea057a7c1ed04306a5f0ac00b67

SHA512
80c1299f136b4f4232cebc1fcc6d759646371b5a53e0f5c4c8bd7cce22736461730e32924bbef8061604499dc368b64739ab883199817b8d3ec2cdd742409de9

Download Submit
C:\Windows\system\IhyARfe.exe

Filesize
2.9MB

MD5
ffc170b3ddf1d1446e08fcc939c7dfdc

SHA1
c8e472d624068ea7e43abd598cf25bb903510715

SHA256
4b6df630766cc7b619e7e4e61979d83fbe0474a28bd49518f3ce8832192d4943

SHA512
28d3cce71386b0be80a4250a6be550125709094acda38bf9021462fee8a7f22ba1582a0aa79a9931f2811ee994b608ef92f9cc9ad99ab027d17e8056da30e7ce

Download Submit
C:\Windows\system\Kpomhup.exe

Filesize
2.9MB

MD5
941dcdbbbbb247b504c1a7f850cc89ec

SHA1
35809a9484401c8ff301b3fd28fc7e10a1cf37e2

SHA256
019ab168e7ea1daebb074bfac02860fdc7d01386323f657d4f54aee42ed8e530

SHA512
8f6bddd6044ca5b6cba44af0f05f03d19ce99095cf644dfb9ec7502b63e5050f847fdc73e94e9d0d107425f8f07e347163c13d1a0cd3d48d7e0957535c9ed9a0

Download Submit
C:\Windows\system\QYmODdd.exe

Filesize
2.9MB

MD5
62c70ce893f40768a5c80e64bfa5b942

SHA1
388e2e7d9b9958f4303c9d644fc378e8a61906b8

SHA256
fc46f33614fdc1650da4cb0a3d5e76085a9f2e64b8b30696b4af080f9492119a

SHA512
d99a295bc4e588a137bd8ab1d276e4cdd61ebbbaacf4006f734c0cba3bd3a9c992fffaee431824425056aaeba587044b005295bcb9b1051a37616a7023d8de17

Download Submit
C:\Windows\system\SXjVqYs.exe

Filesize
2.9MB

MD5
8e448246d875e6fdea72ea71f6870bc5

SHA1
737c5d1a466dfc8b4de064d1d250288f534f557d

SHA256
a702ebb1304a6e8081a1ef6e7c56b09204cedf0ef51ab191b3834ddffcc3e9df

SHA512
149a8faa929a6546fe9ecc74031ccf72b594530cca5fc49ce6fffddba4c88f1568ac67aba438613256473ea6eccf0a4c8654810e409a60a33a07f036d9efaba6

Download Submit
C:\Windows\system\StzZchu.exe

Filesize
2.9MB

MD5
84c5e0b9b33c52fe79a0685b55fa65eb

SHA1
ac0468aabec6d754d807a4cce5dcff0605b68931

SHA256
bc460a4cc87b881a0780a5102d46130e08d95665bb0faec245b9560b5deb6a36

SHA512
1e6d47d39a895b1977d39c5769e23cdc6fe03c6b71aff1b5425778b6c4afcbb3f3db2f3c9f2b88aefa297e695c64963d77fb1f0c88a871eab93b7b4c63c788b2

Download Submit
C:\Windows\system\UopMscu.exe

Filesize
2.9MB

MD5
fa5b7ef2a41e1fa4dfabe899e9e401b0

SHA1
ca3e5b2d177fa1efaec8828f227c9f50d702e3ba

SHA256
b8ef603fa9ff3f949d4c73fbdc3eccbe46bf897cea501c1f50531581f48d67b7

SHA512
c72b4f4320c95bc4cff8d48359e38f4832e67a02c07309eeeef83f64f1e94aa8b34da57b85e9634027f45b393f4561e6a057efc3b4357902fb016407dd7886d5

Download Submit
C:\Windows\system\XiWOYue.exe

Filesize
2.9MB

MD5
31caae9ccbf2d34bae33aac96cc91c1b

SHA1
d6426d0e09fbbe487ce3c883328d96656b6a8ca5

SHA256
70e4e7d2b3da382b2ff4a72dd69e2cb962d8c4baee53e4b5d4f8b84439aa41fd

SHA512
4c2acde2a16717ca6b5b8e5aa3d286cfa8e6e6559e413bc27a3d713c4b2b42c021d5ff52f84514908aa746d1339f58e48b4a5bb0558c0cea7e1e07fa014319e1

Download Submit
C:\Windows\system\dGfKrVg.exe

Filesize
2.9MB

MD5
c208916a23b4186f0bc4f41bd7f70e84

SHA1
4cb048bb17fa2c9b2845b5982d38e740b000edc5

SHA256
2234855075b3fa0ecae1217b4b3c5fe2c746374f29f88c6e6ca397697cf0b21c

SHA512
ea51fbb9e3e9d08feca8808a7b03e3d9458cba9009921ce6ec2be3cbca45bab9764211da79e60350ddf66e51b38d2fa6151c65733d4373ac40df0046536673ec

Download Submit
C:\Windows\system\dPcrvGU.exe

Filesize
2.9MB

MD5
005619c88ba4b3840441506552eebd51

SHA1
b2c5410acdbfe01593d9ef0c65b02f56657c3309

SHA256
a3cd6fbd2ece60b69e83c95241d928b51884727af8596156a4310a06d2d04141

SHA512
1397cd0f61068c12da3b8e96bf0f7616e48ff07863d0a3319ae0811ca778a177968e750501fca9d4756d6b3071810059284d9af63a77e8a6f73b344dbb4fc37e

Download Submit
C:\Windows\system\eVGMJaT.exe

Filesize
2.9MB

MD5
82a1bf53a2839477ad897a795eeebc8b

SHA1
985d2a4ac82fbb1578e9e58d0b152bf0104f871f

SHA256
3a7e441572b661b78807b1616e8c7ca0ed5e589f217c69e607f69238d363e1b9

SHA512
404e655e9e750cce2b962c88f395ab610f7a4ba6a8893746487ff75193d974fd460117e2eb30bf05a39bd088a0f50fed0a75ad65ba9e346896e3a0dd4fa54e50

Download Submit
C:\Windows\system\hKUQbFT.exe

Filesize
2.9MB

MD5
6ae7d2d5f0b3d5900558a9adf6a59920

SHA1
39096001db7d3f62da2228f643dc2fe043c2bdef

SHA256
c87537ef036bedd5121b7f08e134dab8e656f5908b26b747f59749dda7d30597

SHA512
4d20da4df2272ca0a76ceddc1831842483530a01ec8ee60eb597081563b3f7281e7230793b089811b9f1d7af529e7f44d94f877a4be03d9f5980adef70b87a85

Download Submit
C:\Windows\system\hNnDEqt.exe

Filesize
2.9MB

MD5
e80c16c85e9a59b518a2910614fbfc26

SHA1
f81a42f6931c92af87618b15346c28a9f7819ef3

SHA256
7afce1fddb412e5a7f480463cb4727cbbadced8f5af20a2558f592866db011f7

SHA512
829c5a98dea507d12d35f3341e546428de68410efe9935ed172b75ad79883b02b8d48f0e400e0e0829e4906c0485961c618530b0f98182013aa617a654432c8b

Download Submit
C:\Windows\system\hxfzlDH.exe

Filesize
2.9MB

MD5
124bbe354f5d7ab2ddad5869ce0d7011

SHA1
69588d3d44f85f4a53bf0b44abb1daa57408568c

SHA256
83224ea86c0dd52935ec3651e7e51a2237340f01c7df0fc4cb6938352e56d0b9

SHA512
d24966a3fec83fedebd90638b8e20d2f6cf78c3dabf5c420b8c49c6c13d8fb6233db5340b8f86d01881df49bd8e86bd2cdb60e1c4b6ecf90e62fbd33bd3e7560

Download Submit
C:\Windows\system\iRvRzlx.exe

Filesize
2.9MB

MD5
3e79b366d596dbc026d6eb2b02fc3a24

SHA1
913666463bebdeac4e7ae77981a0ac1bac280138

SHA256
b764997ee227b45848e398fc7b31c8ee922d4fa8bcadf891471e0eb335e8f3e9

SHA512
178cd6abd36311e6f5d0169d8a7610eaf0572cbe88352871bba9bda3826f3d0033e138b29620f2bd56c9c16e19f8ad5e71779dc31d7df53496fa2b91f0b8d4ac

Download Submit
C:\Windows\system\idrOSOd.exe

Filesize
2.9MB

MD5
550086bf9db6e77e4d728a21afd27550

SHA1
59fcbb7c55a87c8ecc5bb08086850a296d1c0a8b

SHA256
ff7ef257a655077aaf7331b3f5142718687976ffa3f6fded11ae591d56f462aa

SHA512
6f7ee11250800f544f65fd03e96a4197d4606b3e24d5e52232e0807d30f9000dd752f265ac982e109a3a1994e4da97ab89282b8897ea1b10fcbf6a07aa0ec020

Download Submit
C:\Windows\system\jdHUfQM.exe

Filesize
2.9MB

MD5
171f2b2a42552cca7b22aa892a43c2c5

SHA1
eec3ad84c5dfcdb65be66691b4d00a670cf5f892

SHA256
249670e6af3cc398419cc63eb16f1ad7923fa445b202da6557a773e7b31ddca4

SHA512
25b6b55299c77607c96d3910baa055f9176dcbffe1e619315bdfca55654ac3b36b967ee6164b196eae50e41b99c5fd46dc6d7aa558841a94969f493ab47e544b

Download Submit
C:\Windows\system\lLdJxgY.exe

Filesize
2.9MB

MD5
23dec12216ab46872b862ac267302207

SHA1
a9d4e20072fec7c925ecdac1672e873c969c994a

SHA256
f0ae6f21090a4790368f80264bff79d669d254c10725c627e40a3c53fb8701ee

SHA512
0bd404131cea2bcef8bfc285df40428e58bd529b5982c0f0ec5edf83ca41a44fb10d20470d0de30bffda4e8b82720c83b15da5c3b93c3dfcf629b1e1f83faedd

Download Submit
C:\Windows\system\qQvpqXD.exe

Filesize
2.9MB

MD5
90f6f09a7a26b7ab0ed4d9636a4328aa

SHA1
36c68a5300155cfb0d24923d58c58568e4dfa20b

SHA256
7d8bdd88f36b0836e574d3c5f081f0378e14ee823103abb5328fd19d0df43a14

SHA512
ffaa76d98163fd2d042591cbe0520ae3243d7455b71728a648a2e6c99a0e9898f372a3a481cd00caee0c3c820b279fea90887d117c54caff0ca77c85b50c4f04

Download Submit
C:\Windows\system\rrxvDrO.exe

Filesize
2.9MB

MD5
81606ea137c0b2fdf5ec7f5ada1ad013

SHA1
a75a1e104a23b94229ac7f04007321b29fbdce16

SHA256
fbf30aff2cfc68fd66bb400e8db951b743b00427b9b3a8c7d68f2916edee7232

SHA512
0c39f33374643a194151d428a942b79879d9d1f4c104224b6c6d6b5c0e3d6bf8fdef1d6160729cb53f3f7c642950be972787d59adc92cce96838e39038a032bc

Download Submit
C:\Windows\system\tdDHzBN.exe

Filesize
2.9MB

MD5
80a15b5a8205747a0aca9d18c8f084b1

SHA1
c2adc53c42bb95e462faeb9db2a772b0257b54ad

SHA256
abb84a696191322c112b2a4bf34bb4a95477237096b7b5855d36a5ad72b31c31

SHA512
5297fbfb6f7106c953ea68049354e22b73aa7e1f2ace9deb3338da582b82744c6825b7a9868ef6c84708a34c165baee63b088d317f902f03843e943b6af2b264

Download Submit
C:\Windows\system\uSNisgK.exe

Filesize
2.9MB

MD5
01fb710e3903f5300082967dc23979fa

SHA1
f5628e95c7850b9560f64fa7ac64f78b7fac0fec

SHA256
8e92a647107989fcad40532891c351a6d4f0d62652f05b385c8b5b971cb84033

SHA512
fbd34eec09f7b8b8378f2f6166fca79816bfa6c6fa653bc6214956f0886bc61794408623b61093124dcd69c64ba286f619e8cbf85a0d3facefbca5d00d72ac68

Download Submit
C:\Windows\system\wsharLp.exe

Filesize
2.9MB

MD5
4ded49d3599a15d3b354ceba5c49aedb

SHA1
6c31611d2df8f87d8750b38acb5a2ac5fa4d8da1

SHA256
7a67cbb506be9fa92e8379c9ebea6c53627a15bb24ed179150821b1d80d6ba29

SHA512
400db8c7570c10145a7c2fe2976dcf3c1e70306cf7715065600a57681f11921c38cfda3dd849762559643c607e6d4eedffa63a5d17009dee0c3a6dc1e3e816d4

Download Submit
C:\Windows\system\yTstqBU.exe

Filesize
2.9MB

MD5
fb177e5f04bdba4387962042f9eab80d

SHA1
3df7385dc166d45dd30915cb7538622ee8bb03fd

SHA256
f0c3fa577e25cbf03405126974d6db4159e9a8f7e7f4f8c2a1469396fe9b0c2e

SHA512
f3dd23ea5931d0dbbb927a57b413c3e1b2513515bf7c892785b037e25f202749947f7ce22cc43caf61887153038d621ece6bed657181579941755d33eef20444

Download Submit
C:\Windows\system\zKSxIJr.exe

Filesize
2.9MB

MD5
9a82c6df107f9ac5dcf26adb344fa0a6

SHA1
5d3f02e446e8fd5439d6e90d30ed7f43e83ed4d2

SHA256
e45a5797364071e030cfd9b19a0d67ffe9c5dc44dc20d7dfba2bc49e3aa6f1e8

SHA512
3e77133f2317ad38981321724bb61b6eaf10d1955efa9520027c062442b729a0319329de8bc58fa76b19d1649cd35c929c2ef65b36fc5d3ce3ea9847ca25bd3c

Download Submit
C:\Windows\system\zSJfCTS.exe

Filesize
2.9MB

MD5
5621a538d9349f99bfcad0bf995b4b35

SHA1
31c107f3e42ea53437895b85908489599e0a13f0

SHA256
e02f7bfe98ac45b09ebfcdd895950056dbc8c5b67e69d5a98a92a311f2f1c77c

SHA512
c9c485c48f61f217274e1e29df2fbb9c43451d4239051bbbf15e504a463f09957c75e4aeb364300db0061fda8205a8743a2126ff39821ee04b87509a68617601

Download Submit
C:\Windows\system\zihwcti.exe

Filesize
2.9MB

MD5
a4ec9399bde87ecd5ee11ad7b162c831

SHA1
147801cc0021dcdac1046c9736bab9901a56cfb4

SHA256
51359755337c3527f81bfab4259a12568cc130f7fc7daf680a0ff50a9ef1404f

SHA512
20f5a6fb568968da5487c99033855350dc492cc53b0682e25512b3d3b6015ca73c3a3fc32c6a7c2418afb91e7412df83877a28d2e5cc13c564f47b3eac649810

Download Submit
\Windows\system\HBxmpfh.exe

Filesize
2.9MB

MD5
3edffc0499285bc57e89f6064a42d68b

SHA1
c590f52663a1406bbd3e3b0d9f4861d44516f420

SHA256
232d680767eec214125646dfeb5d599b911b94657390ec92141acf417594be5d

SHA512
ae717fccfec832f2e36c58de5192b13093dcfd89dbadafe7f4f400255d2b2f55781faeb73c2d4530951709de2bf4026d965a24cb61e6b52bb1d4be873962c605

Download Submit
\Windows\system\LJrvnhD.exe

Filesize
2.9MB

MD5
e43328aea759261516f9eeb2b96a6b24

SHA1
ae7c407a2540cd60688e10cd967220ab06863ddd

SHA256
24cbb2af5fe8f608d125c821e6d66868d3df75b388acb4a4d2e84745d1a5e6af

SHA512
1e965466a3bc211ef96d8a97041d1bc25e30196d2ad5869a3d1405d0794557f649ca8115cb537d186a016735ecb8fff748340989aacd63ccfa1f68c2a54ad967

Download Submit
\Windows\system\tupQNGA.exe

Filesize
2.9MB

MD5
62f581bd8b399b86f2f7c16aec5f87c8

SHA1
84e1d76f261c89484b34622abea24c7247f102fd

SHA256
36023a39d2592413fca393ceea47265bc3f691c9caae9747694228bd91a3807c

SHA512
987eeec010f30f53a6ba3c11d5a6c6eeb4d5e49993162f448fec52001a42c557910d4225a98e03f8f5f60fc529663a911bd6d50c0cf8391474cedcd5b2c76b2c

Download Submit
memory/2060-1881-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2060-1732-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2060-28-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2060-2612-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2060-29-0x000007FEF5B2E000-0x000007FEF5B2F000-memory.dmp

Filesize
4KB

Download
memory/2060-95-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2244-118-0x000000013F7B0000-0x000000013FBA6000-memory.dmp

Filesize
4.0MB

Download
memory/2244-6375-0x000000013F7B0000-0x000000013FBA6000-memory.dmp

Filesize
4.0MB

Download
memory/2308-16-0x000000013FCC0000-0x00000001400B6000-memory.dmp

Filesize
4.0MB

Download
memory/2416-111-0x000000013F4F0000-0x000000013F8E6000-memory.dmp

Filesize
4.0MB

Download
memory/2416-1324-0x0000000002B90000-0x0000000002F86000-memory.dmp

Filesize
4.0MB

Download
memory/2416-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2416-116-0x0000000003620000-0x0000000003A16000-memory.dmp

Filesize
4.0MB

Download
memory/2416-99-0x000000013F5F0000-0x000000013F9E6000-memory.dmp

Filesize
4.0MB

Download
memory/2416-3459-0x0000000003620000-0x0000000003A16000-memory.dmp

Filesize
4.0MB

Download
memory/2416-97-0x000000013FEA0000-0x0000000140296000-memory.dmp

Filesize
4.0MB

Download
memory/2416-3458-0x0000000003620000-0x0000000003A16000-memory.dmp

Filesize
4.0MB

Download
memory/2416-121-0x000000013F310000-0x000000013F706000-memory.dmp

Filesize
4.0MB

Download
memory/2416-10-0x0000000002B90000-0x0000000002F86000-memory.dmp

Filesize
4.0MB

Download
memory/2416-14-0x0000000002B90000-0x0000000002F86000-memory.dmp

Filesize
4.0MB

Download
memory/2416-109-0x0000000003620000-0x0000000003A16000-memory.dmp

Filesize
4.0MB

Download
memory/2416-107-0x000000013F650000-0x000000013FA46000-memory.dmp

Filesize
4.0MB

Download
memory/2416-26-0x0000000002C90000-0x0000000003086000-memory.dmp

Filesize
4.0MB

Download
memory/2416-105-0x0000000003620000-0x0000000003A16000-memory.dmp

Filesize
4.0MB

Download
memory/2416-119-0x000000013F330000-0x000000013F726000-memory.dmp

Filesize
4.0MB

Download
memory/2416-2077-0x0000000002B90000-0x0000000002F86000-memory.dmp

Filesize
4.0MB

Download
memory/2416-2061-0x000000013FA60000-0x000000013FE56000-memory.dmp

Filesize
4.0MB

Download
memory/2416-0-0x000000013FA60000-0x000000013FE56000-memory.dmp

Filesize
4.0MB

Download
memory/2520-106-0x000000013F6D0000-0x000000013FAC6000-memory.dmp

Filesize
4.0MB

Download
memory/2580-108-0x000000013F650000-0x000000013FA46000-memory.dmp

Filesize
4.0MB

Download
memory/2684-104-0x000000013F5F0000-0x000000013F9E6000-memory.dmp

Filesize
4.0MB

Download
memory/2720-27-0x000000013F970000-0x000000013FD66000-memory.dmp

Filesize
4.0MB

Download
memory/2772-6376-0x000000013F330000-0x000000013F726000-memory.dmp

Filesize
4.0MB

Download
memory/2772-120-0x000000013F330000-0x000000013F726000-memory.dmp

Filesize
4.0MB

Download
memory/2808-96-0x000000013F310000-0x000000013F706000-memory.dmp

Filesize
4.0MB

Download
memory/2820-15-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-98-0x000000013FEA0000-0x0000000140296000-memory.dmp

Filesize
4.0MB

Download
memory/2984-110-0x000000013F6A0000-0x000000013FA96000-memory.dmp

Filesize
4.0MB

Download
memory/2988-112-0x000000013F4F0000-0x000000013F8E6000-memory.dmp

Filesize
4.0MB

Download