xmrig | 067bbf88f0fd2ec90d4b6aaedbdbade8596165a40e3e8179785edcda5eebaf09

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
Size

1.9MB
MD5

39f53c6ed7511175e0ad697139c9bb20
SHA1

f11cfba2b4d530c644f039f742ca01630e56c6e3
SHA256

067bbf88f0fd2ec90d4b6aaedbdbade8596165a40e3e8179785edcda5eebaf09
SHA512

6bd16b8e16b588ac9403a1180a8c40de1d8eae3907597bf8128ea14e6fc134f396dece2c64463f9c990f5e0f7f5641fcf13e72adf920ba25180ed0635c977166
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxxdcvou25dwc:BemTLkNdfE0pZrQB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral1/memory/1652-0-0x000000013F3B0000-0x000000013F704000-memory.dmp	xmrig
behavioral1/files/0x000c00000001432c-3.dat	xmrig
behavioral1/files/0x0006000000015ce1-39.dat	xmrig
behavioral1/files/0x0006000000015e3a-106.dat	xmrig
behavioral1/files/0x0006000000015d8f-94.dat	xmrig
behavioral1/files/0x0009000000014b27-69.dat	xmrig
behavioral1/files/0x0006000000015eaf-150.dat	xmrig
behavioral1/memory/1652-2461-0x000000013F3B0000-0x000000013F704000-memory.dmp	xmrig
behavioral1/files/0x000600000001630b-179.dat	xmrig
behavioral1/files/0x00060000000164b2-184.dat	xmrig
behavioral1/files/0x00060000000161e7-174.dat	xmrig
behavioral1/files/0x0006000000016117-169.dat	xmrig
behavioral1/files/0x0006000000015fe9-164.dat	xmrig
behavioral1/files/0x003500000001459f-159.dat	xmrig
behavioral1/files/0x0006000000015f6d-155.dat	xmrig
behavioral1/files/0x0006000000015d9b-148.dat	xmrig
behavioral1/files/0x0006000000015d87-146.dat	xmrig
behavioral1/files/0x0006000000015d6f-144.dat	xmrig
behavioral1/files/0x0006000000015d5e-142.dat	xmrig
behavioral1/files/0x0006000000015d4a-140.dat	xmrig
behavioral1/files/0x0006000000015d07-138.dat	xmrig
behavioral1/files/0x0006000000015d79-132.dat	xmrig
behavioral1/files/0x0006000000015d67-131.dat	xmrig
behavioral1/memory/2556-130-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/memory/2444-125-0x000000013FDD0000-0x0000000140124000-memory.dmp	xmrig
behavioral1/memory/2468-124-0x000000013FCD0000-0x0000000140024000-memory.dmp	xmrig
behavioral1/memory/2716-121-0x000000013F840000-0x000000013FB94000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cba-120.dat	xmrig
behavioral1/memory/1652-119-0x0000000001EC0000-0x0000000002214000-memory.dmp	xmrig
behavioral1/memory/2604-118-0x000000013F950000-0x000000013FCA4000-memory.dmp	xmrig
behavioral1/memory/2656-117-0x000000013FCF0000-0x0000000140044000-memory.dmp	xmrig
behavioral1/memory/2540-115-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/files/0x0009000000014b63-114.dat	xmrig
behavioral1/memory/2172-113-0x000000013FD10000-0x0000000140064000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d56-79.dat	xmrig
behavioral1/files/0x0006000000015d28-78.dat	xmrig
behavioral1/files/0x0006000000015ceb-77.dat	xmrig
behavioral1/files/0x0007000000014971-68.dat	xmrig
behavioral1/files/0x0036000000014594-67.dat	xmrig
behavioral1/files/0x0007000000014aa2-66.dat	xmrig
behavioral1/memory/2732-41-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/memory/1652-89-0x0000000001EC0000-0x0000000002214000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cd5-73.dat	xmrig
behavioral1/files/0x0008000000015ca6-70.dat	xmrig
behavioral1/files/0x0007000000014857-22.dat	xmrig
behavioral1/memory/2024-27-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/2024-2580-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/2024-4012-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/2732-4013-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/memory/2540-4014-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/memory/2556-4015-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/memory/2172-4016-0x000000013FD10000-0x0000000140064000-memory.dmp	xmrig
behavioral1/memory/2604-4017-0x000000013F950000-0x000000013FCA4000-memory.dmp	xmrig
behavioral1/memory/2468-4018-0x000000013FCD0000-0x0000000140024000-memory.dmp	xmrig
behavioral1/memory/2656-4021-0x000000013FCF0000-0x0000000140044000-memory.dmp	xmrig
behavioral1/memory/2716-4020-0x000000013F840000-0x000000013FB94000-memory.dmp	xmrig
behavioral1/memory/2444-4019-0x000000013FDD0000-0x0000000140124000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2024	PPHwJZh.exe
2732	THekDDH.exe
2556	fuxsacS.exe
2172	FKgZIqL.exe
2540	uwpDsni.exe
2656	XTtRxLD.exe
2604	wIAaewL.exe
2716	VrYHIrf.exe
2468	ppdMCOg.exe
2444	BtTEdFP.exe
1656	wwLlApZ.exe
2704	CKMfFbr.exe
2720	cMvvPFm.exe
2712	VNcaRsh.exe
2252	GnClAZY.exe
2924	RJlpJpo.exe
1560	BUUPREZ.exe
1424	wExqaHR.exe
2492	BUJFZdW.exe
2476	sUrQZWR.exe
2028	ralhMYP.exe
2808	RGEcGzu.exe
2484	zTkBfSf.exe
300	KUJMHIe.exe
2624	YlBkeGo.exe
472	bzunZEB.exe
2876	EfcHTjc.exe
324	HVUpbyc.exe
980	NoIjrWV.exe
1612	MyFLmEA.exe
1464	TGIytMr.exe
824	UudlzTP.exe
1532	WlKuADb.exe
1156	FoNENTj.exe
1120	AIUVcwx.exe
2288	IQDuCKP.exe
1624	bKWNaOJ.exe
500	LeynykI.exe
1336	obROvuV.exe
1524	dZcuWyU.exe
1360	zCnFxpo.exe
924	tQpVBQa.exe
304	bMCjMHm.exe
1280	FkIvZSO.exe
896	HoWgvnc.exe
572	HXilDwS.exe
1072	FeKAYVN.exe
2040	TXEyqCx.exe
564	NSKiRVH.exe
312	gVFywXq.exe
1148	ZEdLIiU.exe
1752	vIibtBA.exe
2348	XGNfIgZ.exe
2232	JcTHoVU.exe
2240	TnrdNqt.exe
1540	fdYcBmw.exe
1684	zAPmXIE.exe
3040	lyqlGsH.exe
2092	QbEfGZA.exe
1984	fkJEsZI.exe
2608	ErQLVNC.exe
2408	QCcyMvj.exe
2820	fzJUpTa.exe
2904	vQCLnkb.exe

Loads dropped DLL 64 IoCs

pid	Process
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1652-0-0x000000013F3B0000-0x000000013F704000-memory.dmp	upx
behavioral1/files/0x000c00000001432c-3.dat	upx
behavioral1/files/0x0006000000015ce1-39.dat	upx
behavioral1/files/0x0006000000015e3a-106.dat	upx
behavioral1/files/0x0006000000015d8f-94.dat	upx
behavioral1/files/0x0009000000014b27-69.dat	upx
behavioral1/files/0x0006000000015eaf-150.dat	upx
behavioral1/memory/1652-2461-0x000000013F3B0000-0x000000013F704000-memory.dmp	upx
behavioral1/files/0x000600000001630b-179.dat	upx
behavioral1/files/0x00060000000164b2-184.dat	upx
behavioral1/files/0x00060000000161e7-174.dat	upx
behavioral1/files/0x0006000000016117-169.dat	upx
behavioral1/files/0x0006000000015fe9-164.dat	upx
behavioral1/files/0x003500000001459f-159.dat	upx
behavioral1/files/0x0006000000015f6d-155.dat	upx
behavioral1/files/0x0006000000015d9b-148.dat	upx
behavioral1/files/0x0006000000015d87-146.dat	upx
behavioral1/files/0x0006000000015d6f-144.dat	upx
behavioral1/files/0x0006000000015d5e-142.dat	upx
behavioral1/files/0x0006000000015d4a-140.dat	upx
behavioral1/files/0x0006000000015d07-138.dat	upx
behavioral1/files/0x0006000000015d79-132.dat	upx
behavioral1/files/0x0006000000015d67-131.dat	upx
behavioral1/memory/2556-130-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/memory/2444-125-0x000000013FDD0000-0x0000000140124000-memory.dmp	upx
behavioral1/memory/2468-124-0x000000013FCD0000-0x0000000140024000-memory.dmp	upx
behavioral1/memory/2716-121-0x000000013F840000-0x000000013FB94000-memory.dmp	upx
behavioral1/files/0x0006000000015cba-120.dat	upx
behavioral1/memory/2604-118-0x000000013F950000-0x000000013FCA4000-memory.dmp	upx
behavioral1/memory/2656-117-0x000000013FCF0000-0x0000000140044000-memory.dmp	upx
behavioral1/memory/2540-115-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/files/0x0009000000014b63-114.dat	upx
behavioral1/memory/2172-113-0x000000013FD10000-0x0000000140064000-memory.dmp	upx
behavioral1/files/0x0006000000015d56-79.dat	upx
behavioral1/files/0x0006000000015d28-78.dat	upx
behavioral1/files/0x0006000000015ceb-77.dat	upx
behavioral1/files/0x0007000000014971-68.dat	upx
behavioral1/files/0x0036000000014594-67.dat	upx
behavioral1/files/0x0007000000014aa2-66.dat	upx
behavioral1/memory/2732-41-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/memory/1652-89-0x0000000001EC0000-0x0000000002214000-memory.dmp	upx
behavioral1/files/0x0006000000015cd5-73.dat	upx
behavioral1/files/0x0008000000015ca6-70.dat	upx
behavioral1/files/0x0007000000014857-22.dat	upx
behavioral1/memory/2024-27-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/2024-2580-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/2024-4012-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/2732-4013-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/memory/2540-4014-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/memory/2556-4015-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/memory/2172-4016-0x000000013FD10000-0x0000000140064000-memory.dmp	upx
behavioral1/memory/2604-4017-0x000000013F950000-0x000000013FCA4000-memory.dmp	upx
behavioral1/memory/2468-4018-0x000000013FCD0000-0x0000000140024000-memory.dmp	upx
behavioral1/memory/2656-4021-0x000000013FCF0000-0x0000000140044000-memory.dmp	upx
behavioral1/memory/2716-4020-0x000000013F840000-0x000000013FB94000-memory.dmp	upx
behavioral1/memory/2444-4019-0x000000013FDD0000-0x0000000140124000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jJnvpwU.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\EWfCXny.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\lbhzrXs.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\hYJSrpc.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\xaKQCmM.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\DIdnTpH.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\kRGZrWh.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\cIoqhkE.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\XDfdIZM.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\BkUujro.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\kTJyLxZ.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\gJDWZsd.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\THekDDH.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\LJVcair.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\PSxvXYH.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\sCMyfGB.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\sfWUiOw.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\dGHjbKk.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\WSkPJAS.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\yBcauKS.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\bsaAhjm.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\EMYNoYn.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\eiMCWlP.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\pRibdQt.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\RWSyPnO.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\EZeOJnL.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\HkyuXGe.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\NXLXejt.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\hCFzxLl.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\AKRPwKR.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\aeyuJjW.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\vsTHSsR.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\hAfWJHa.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\jzJMyPm.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\jKXkoSE.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\KJqFREV.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\iuzDxBW.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\SMdDRqD.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\TXEyqCx.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\WginsMT.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\bbyOacF.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\LLjpweO.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\tOtZZWI.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\wYYOXgw.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\lKaTvFK.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\qYTPUMO.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\foIkHoF.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\fhVMZBt.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\yXhtGRH.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\yIunzNS.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\vMbQfte.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\rQWAYRi.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\jRKPuTq.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\mMbcTmU.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\wwNZeKT.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\VQqpgmq.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\SjozDnt.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\ljyimgn.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\EuclbiX.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\vsIwEvv.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\TsjhuVJ.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\czzzXiw.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\GlMVZpR.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
File created	C:\Windows\System\PAYOIQC.exe	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2024	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	29
PID 1652 wrote to memory of 2024	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	29
PID 1652 wrote to memory of 2024	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	29
PID 1652 wrote to memory of 2172	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	30
PID 1652 wrote to memory of 2172	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	30
PID 1652 wrote to memory of 2172	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	30
PID 1652 wrote to memory of 2732	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	31
PID 1652 wrote to memory of 2732	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	31
PID 1652 wrote to memory of 2732	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	31
PID 1652 wrote to memory of 2540	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	32
PID 1652 wrote to memory of 2540	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	32
PID 1652 wrote to memory of 2540	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	32
PID 1652 wrote to memory of 2556	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	33
PID 1652 wrote to memory of 2556	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	33
PID 1652 wrote to memory of 2556	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	33
PID 1652 wrote to memory of 2656	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	34
PID 1652 wrote to memory of 2656	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	34
PID 1652 wrote to memory of 2656	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	34
PID 1652 wrote to memory of 2704	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	35
PID 1652 wrote to memory of 2704	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	35
PID 1652 wrote to memory of 2704	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	35
PID 1652 wrote to memory of 2604	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	36
PID 1652 wrote to memory of 2604	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	36
PID 1652 wrote to memory of 2604	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	36
PID 1652 wrote to memory of 2720	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	37
PID 1652 wrote to memory of 2720	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	37
PID 1652 wrote to memory of 2720	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	37
PID 1652 wrote to memory of 2716	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	38
PID 1652 wrote to memory of 2716	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	38
PID 1652 wrote to memory of 2716	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	38
PID 1652 wrote to memory of 2712	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	39
PID 1652 wrote to memory of 2712	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	39
PID 1652 wrote to memory of 2712	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	39
PID 1652 wrote to memory of 2468	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	40
PID 1652 wrote to memory of 2468	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	40
PID 1652 wrote to memory of 2468	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	40
PID 1652 wrote to memory of 2492	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	41
PID 1652 wrote to memory of 2492	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	41
PID 1652 wrote to memory of 2492	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	41
PID 1652 wrote to memory of 2444	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	42
PID 1652 wrote to memory of 2444	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	42
PID 1652 wrote to memory of 2444	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	42
PID 1652 wrote to memory of 2476	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	43
PID 1652 wrote to memory of 2476	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	43
PID 1652 wrote to memory of 2476	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	43
PID 1652 wrote to memory of 1656	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	44
PID 1652 wrote to memory of 1656	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	44
PID 1652 wrote to memory of 1656	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	44
PID 1652 wrote to memory of 2028	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	45
PID 1652 wrote to memory of 2028	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	45
PID 1652 wrote to memory of 2028	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	45
PID 1652 wrote to memory of 2252	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	46
PID 1652 wrote to memory of 2252	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	46
PID 1652 wrote to memory of 2252	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	46
PID 1652 wrote to memory of 2808	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	47
PID 1652 wrote to memory of 2808	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	47
PID 1652 wrote to memory of 2808	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	47
PID 1652 wrote to memory of 2924	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	48
PID 1652 wrote to memory of 2924	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	48
PID 1652 wrote to memory of 2924	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	48
PID 1652 wrote to memory of 2484	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	49
PID 1652 wrote to memory of 2484	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	49
PID 1652 wrote to memory of 2484	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	49
PID 1652 wrote to memory of 1560	1652	39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\39f53c6ed7511175e0ad697139c9bb20_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\System\PPHwJZh.exe
  C:\Windows\System\PPHwJZh.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\FKgZIqL.exe
  C:\Windows\System\FKgZIqL.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\THekDDH.exe
  C:\Windows\System\THekDDH.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\uwpDsni.exe
  C:\Windows\System\uwpDsni.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\fuxsacS.exe
  C:\Windows\System\fuxsacS.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\XTtRxLD.exe
  C:\Windows\System\XTtRxLD.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\CKMfFbr.exe
  C:\Windows\System\CKMfFbr.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\wIAaewL.exe
  C:\Windows\System\wIAaewL.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\cMvvPFm.exe
  C:\Windows\System\cMvvPFm.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\VrYHIrf.exe
  C:\Windows\System\VrYHIrf.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\VNcaRsh.exe
  C:\Windows\System\VNcaRsh.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\ppdMCOg.exe
  C:\Windows\System\ppdMCOg.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\BUJFZdW.exe
  C:\Windows\System\BUJFZdW.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\BtTEdFP.exe
  C:\Windows\System\BtTEdFP.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\sUrQZWR.exe
  C:\Windows\System\sUrQZWR.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\wwLlApZ.exe
  C:\Windows\System\wwLlApZ.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\ralhMYP.exe
  C:\Windows\System\ralhMYP.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\GnClAZY.exe
  C:\Windows\System\GnClAZY.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\RGEcGzu.exe
  C:\Windows\System\RGEcGzu.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\RJlpJpo.exe
  C:\Windows\System\RJlpJpo.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\zTkBfSf.exe
  C:\Windows\System\zTkBfSf.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\BUUPREZ.exe
  C:\Windows\System\BUUPREZ.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\KUJMHIe.exe
  C:\Windows\System\KUJMHIe.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\wExqaHR.exe
  C:\Windows\System\wExqaHR.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\YlBkeGo.exe
  C:\Windows\System\YlBkeGo.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\bzunZEB.exe
  C:\Windows\System\bzunZEB.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\EfcHTjc.exe
  C:\Windows\System\EfcHTjc.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\HVUpbyc.exe
  C:\Windows\System\HVUpbyc.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\NoIjrWV.exe
  C:\Windows\System\NoIjrWV.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\MyFLmEA.exe
  C:\Windows\System\MyFLmEA.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\TGIytMr.exe
  C:\Windows\System\TGIytMr.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\UudlzTP.exe
  C:\Windows\System\UudlzTP.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\WlKuADb.exe
  C:\Windows\System\WlKuADb.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\FoNENTj.exe
  C:\Windows\System\FoNENTj.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\AIUVcwx.exe
  C:\Windows\System\AIUVcwx.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\IQDuCKP.exe
  C:\Windows\System\IQDuCKP.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\bKWNaOJ.exe
  C:\Windows\System\bKWNaOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\LeynykI.exe
  C:\Windows\System\LeynykI.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\obROvuV.exe
  C:\Windows\System\obROvuV.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\dZcuWyU.exe
  C:\Windows\System\dZcuWyU.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\zCnFxpo.exe
  C:\Windows\System\zCnFxpo.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\tQpVBQa.exe
  C:\Windows\System\tQpVBQa.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\bMCjMHm.exe
  C:\Windows\System\bMCjMHm.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\FkIvZSO.exe
  C:\Windows\System\FkIvZSO.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\HoWgvnc.exe
  C:\Windows\System\HoWgvnc.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\HXilDwS.exe
  C:\Windows\System\HXilDwS.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\FeKAYVN.exe
  C:\Windows\System\FeKAYVN.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\TXEyqCx.exe
  C:\Windows\System\TXEyqCx.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\NSKiRVH.exe
  C:\Windows\System\NSKiRVH.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\gVFywXq.exe
  C:\Windows\System\gVFywXq.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\ZEdLIiU.exe
  C:\Windows\System\ZEdLIiU.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\vIibtBA.exe
  C:\Windows\System\vIibtBA.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\XGNfIgZ.exe
  C:\Windows\System\XGNfIgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\JcTHoVU.exe
  C:\Windows\System\JcTHoVU.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\TnrdNqt.exe
  C:\Windows\System\TnrdNqt.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\fdYcBmw.exe
  C:\Windows\System\fdYcBmw.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\zAPmXIE.exe
  C:\Windows\System\zAPmXIE.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\lyqlGsH.exe
  C:\Windows\System\lyqlGsH.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\QbEfGZA.exe
  C:\Windows\System\QbEfGZA.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\fkJEsZI.exe
  C:\Windows\System\fkJEsZI.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\ErQLVNC.exe
  C:\Windows\System\ErQLVNC.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\QCcyMvj.exe
  C:\Windows\System\QCcyMvj.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\fzJUpTa.exe
  C:\Windows\System\fzJUpTa.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\vQCLnkb.exe
  C:\Windows\System\vQCLnkb.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\xgaisEp.exe
  C:\Windows\System\xgaisEp.exe
  2⤵
  PID:1512
- C:\Windows\System\ifDXKvZ.exe
  C:\Windows\System\ifDXKvZ.exe
  2⤵
  PID:2644
- C:\Windows\System\RWzeykS.exe
  C:\Windows\System\RWzeykS.exe
  2⤵
  PID:2500
- C:\Windows\System\dNXTslp.exe
  C:\Windows\System\dNXTslp.exe
  2⤵
  PID:2616
- C:\Windows\System\TsjhuVJ.exe
  C:\Windows\System\TsjhuVJ.exe
  2⤵
  PID:1592
- C:\Windows\System\btwLfZj.exe
  C:\Windows\System\btwLfZj.exe
  2⤵
  PID:2772
- C:\Windows\System\GHOAIvw.exe
  C:\Windows\System\GHOAIvw.exe
  2⤵
  PID:2076
- C:\Windows\System\NgbQgcA.exe
  C:\Windows\System\NgbQgcA.exe
  2⤵
  PID:2056
- C:\Windows\System\yiwdZNs.exe
  C:\Windows\System\yiwdZNs.exe
  2⤵
  PID:1492
- C:\Windows\System\JeNYPAH.exe
  C:\Windows\System\JeNYPAH.exe
  2⤵
  PID:772
- C:\Windows\System\AZsjOIg.exe
  C:\Windows\System\AZsjOIg.exe
  2⤵
  PID:1736
- C:\Windows\System\zyCbvtf.exe
  C:\Windows\System\zyCbvtf.exe
  2⤵
  PID:552
- C:\Windows\System\ljyimgn.exe
  C:\Windows\System\ljyimgn.exe
  2⤵
  PID:1832
- C:\Windows\System\dXnPhAk.exe
  C:\Windows\System\dXnPhAk.exe
  2⤵
  PID:2840
- C:\Windows\System\rslDBex.exe
  C:\Windows\System\rslDBex.exe
  2⤵
  PID:2416
- C:\Windows\System\czzzXiw.exe
  C:\Windows\System\czzzXiw.exe
  2⤵
  PID:1284
- C:\Windows\System\cSyKjTF.exe
  C:\Windows\System\cSyKjTF.exe
  2⤵
  PID:1504
- C:\Windows\System\MVPokKp.exe
  C:\Windows\System\MVPokKp.exe
  2⤵
  PID:1332
- C:\Windows\System\GEZtwxm.exe
  C:\Windows\System\GEZtwxm.exe
  2⤵
  PID:1792
- C:\Windows\System\HWjtMio.exe
  C:\Windows\System\HWjtMio.exe
  2⤵
  PID:384
- C:\Windows\System\olEuryb.exe
  C:\Windows\System\olEuryb.exe
  2⤵
  PID:1144
- C:\Windows\System\PcdOEPP.exe
  C:\Windows\System\PcdOEPP.exe
  2⤵
  PID:1692
- C:\Windows\System\MobVEaO.exe
  C:\Windows\System\MobVEaO.exe
  2⤵
  PID:1580
- C:\Windows\System\qAftual.exe
  C:\Windows\System\qAftual.exe
  2⤵
  PID:2000
- C:\Windows\System\ciFJGkh.exe
  C:\Windows\System\ciFJGkh.exe
  2⤵
  PID:864
- C:\Windows\System\FDGyjUp.exe
  C:\Windows\System\FDGyjUp.exe
  2⤵
  PID:2248
- C:\Windows\System\VBvxXav.exe
  C:\Windows\System\VBvxXav.exe
  2⤵
  PID:1568
- C:\Windows\System\XJdPvPK.exe
  C:\Windows\System\XJdPvPK.exe
  2⤵
  PID:2692
- C:\Windows\System\uLcdnJG.exe
  C:\Windows\System\uLcdnJG.exe
  2⤵
  PID:2684
- C:\Windows\System\LLoBMpb.exe
  C:\Windows\System\LLoBMpb.exe
  2⤵
  PID:2460
- C:\Windows\System\jgwCKxq.exe
  C:\Windows\System\jgwCKxq.exe
  2⤵
  PID:2968
- C:\Windows\System\ttfvjOU.exe
  C:\Windows\System\ttfvjOU.exe
  2⤵
  PID:2992
- C:\Windows\System\TgvILIV.exe
  C:\Windows\System\TgvILIV.exe
  2⤵
  PID:2812
- C:\Windows\System\GcnGwUw.exe
  C:\Windows\System\GcnGwUw.exe
  2⤵
  PID:2752
- C:\Windows\System\SXTnwhx.exe
  C:\Windows\System\SXTnwhx.exe
  2⤵
  PID:1268
- C:\Windows\System\DjoRPPt.exe
  C:\Windows\System\DjoRPPt.exe
  2⤵
  PID:1184
- C:\Windows\System\KqJUtlp.exe
  C:\Windows\System\KqJUtlp.exe
  2⤵
  PID:2628
- C:\Windows\System\DWTDkZO.exe
  C:\Windows\System\DWTDkZO.exe
  2⤵
  PID:680
- C:\Windows\System\xcjwYXP.exe
  C:\Windows\System\xcjwYXP.exe
  2⤵
  PID:1496
- C:\Windows\System\rwScRyB.exe
  C:\Windows\System\rwScRyB.exe
  2⤵
  PID:3084
- C:\Windows\System\aEgrpKS.exe
  C:\Windows\System\aEgrpKS.exe
  2⤵
  PID:3104
- C:\Windows\System\vIvTECI.exe
  C:\Windows\System\vIvTECI.exe
  2⤵
  PID:3124
- C:\Windows\System\UGPRRZL.exe
  C:\Windows\System\UGPRRZL.exe
  2⤵
  PID:3144
- C:\Windows\System\wNVPVnd.exe
  C:\Windows\System\wNVPVnd.exe
  2⤵
  PID:3164
- C:\Windows\System\kieJCWJ.exe
  C:\Windows\System\kieJCWJ.exe
  2⤵
  PID:3184
- C:\Windows\System\Vpeklsf.exe
  C:\Windows\System\Vpeklsf.exe
  2⤵
  PID:3204
- C:\Windows\System\LZetgNB.exe
  C:\Windows\System\LZetgNB.exe
  2⤵
  PID:3224
- C:\Windows\System\GDNZRBO.exe
  C:\Windows\System\GDNZRBO.exe
  2⤵
  PID:3244
- C:\Windows\System\KkptQjo.exe
  C:\Windows\System\KkptQjo.exe
  2⤵
  PID:3264
- C:\Windows\System\PCRZmEP.exe
  C:\Windows\System\PCRZmEP.exe
  2⤵
  PID:3284
- C:\Windows\System\mxhYzcI.exe
  C:\Windows\System\mxhYzcI.exe
  2⤵
  PID:3304
- C:\Windows\System\VjKHNkf.exe
  C:\Windows\System\VjKHNkf.exe
  2⤵
  PID:3324
- C:\Windows\System\yBKVUuQ.exe
  C:\Windows\System\yBKVUuQ.exe
  2⤵
  PID:3344
- C:\Windows\System\qGaRfed.exe
  C:\Windows\System\qGaRfed.exe
  2⤵
  PID:3364
- C:\Windows\System\CAYeUaC.exe
  C:\Windows\System\CAYeUaC.exe
  2⤵
  PID:3384
- C:\Windows\System\qUwCPlE.exe
  C:\Windows\System\qUwCPlE.exe
  2⤵
  PID:3404
- C:\Windows\System\cNvEFzS.exe
  C:\Windows\System\cNvEFzS.exe
  2⤵
  PID:3424
- C:\Windows\System\xTXtoil.exe
  C:\Windows\System\xTXtoil.exe
  2⤵
  PID:3444
- C:\Windows\System\HDoLxbB.exe
  C:\Windows\System\HDoLxbB.exe
  2⤵
  PID:3464
- C:\Windows\System\gFSTaTb.exe
  C:\Windows\System\gFSTaTb.exe
  2⤵
  PID:3484
- C:\Windows\System\ShWlugt.exe
  C:\Windows\System\ShWlugt.exe
  2⤵
  PID:3504
- C:\Windows\System\UTLZEFM.exe
  C:\Windows\System\UTLZEFM.exe
  2⤵
  PID:3520
- C:\Windows\System\ufHLfXY.exe
  C:\Windows\System\ufHLfXY.exe
  2⤵
  PID:3540
- C:\Windows\System\OMhCapJ.exe
  C:\Windows\System\OMhCapJ.exe
  2⤵
  PID:3564
- C:\Windows\System\gFRSKsT.exe
  C:\Windows\System\gFRSKsT.exe
  2⤵
  PID:3584
- C:\Windows\System\DCMdDIK.exe
  C:\Windows\System\DCMdDIK.exe
  2⤵
  PID:3604
- C:\Windows\System\LDlgXxi.exe
  C:\Windows\System\LDlgXxi.exe
  2⤵
  PID:3624
- C:\Windows\System\HadVllr.exe
  C:\Windows\System\HadVllr.exe
  2⤵
  PID:3644
- C:\Windows\System\ZBLhsab.exe
  C:\Windows\System\ZBLhsab.exe
  2⤵
  PID:3664
- C:\Windows\System\rIbhBRI.exe
  C:\Windows\System\rIbhBRI.exe
  2⤵
  PID:3680
- C:\Windows\System\kxIbDCy.exe
  C:\Windows\System\kxIbDCy.exe
  2⤵
  PID:3704
- C:\Windows\System\PiUSxgt.exe
  C:\Windows\System\PiUSxgt.exe
  2⤵
  PID:3720
- C:\Windows\System\PgNkDnf.exe
  C:\Windows\System\PgNkDnf.exe
  2⤵
  PID:3744
- C:\Windows\System\eHYQGAD.exe
  C:\Windows\System\eHYQGAD.exe
  2⤵
  PID:3760
- C:\Windows\System\bYGKPLj.exe
  C:\Windows\System\bYGKPLj.exe
  2⤵
  PID:3780
- C:\Windows\System\kssLRzo.exe
  C:\Windows\System\kssLRzo.exe
  2⤵
  PID:3804
- C:\Windows\System\OokHTnA.exe
  C:\Windows\System\OokHTnA.exe
  2⤵
  PID:3824
- C:\Windows\System\hVLsGFW.exe
  C:\Windows\System\hVLsGFW.exe
  2⤵
  PID:3844
- C:\Windows\System\sAGKCJb.exe
  C:\Windows\System\sAGKCJb.exe
  2⤵
  PID:3864
- C:\Windows\System\QsaYVDj.exe
  C:\Windows\System\QsaYVDj.exe
  2⤵
  PID:3884
- C:\Windows\System\JRrkrQl.exe
  C:\Windows\System\JRrkrQl.exe
  2⤵
  PID:3904
- C:\Windows\System\TAubiuN.exe
  C:\Windows\System\TAubiuN.exe
  2⤵
  PID:3924
- C:\Windows\System\QcYyhLK.exe
  C:\Windows\System\QcYyhLK.exe
  2⤵
  PID:3944
- C:\Windows\System\oHhDJYa.exe
  C:\Windows\System\oHhDJYa.exe
  2⤵
  PID:3960
- C:\Windows\System\eNuOeBj.exe
  C:\Windows\System\eNuOeBj.exe
  2⤵
  PID:3980
- C:\Windows\System\WginsMT.exe
  C:\Windows\System\WginsMT.exe
  2⤵
  PID:4000
- C:\Windows\System\IhXClmg.exe
  C:\Windows\System\IhXClmg.exe
  2⤵
  PID:4016
- C:\Windows\System\dTqjtCN.exe
  C:\Windows\System\dTqjtCN.exe
  2⤵
  PID:4036
- C:\Windows\System\DvsTCQE.exe
  C:\Windows\System\DvsTCQE.exe
  2⤵
  PID:4060
- C:\Windows\System\UaErIhF.exe
  C:\Windows\System\UaErIhF.exe
  2⤵
  PID:4084
- C:\Windows\System\yBcauKS.exe
  C:\Windows\System\yBcauKS.exe
  2⤵
  PID:2284
- C:\Windows\System\pyVKbja.exe
  C:\Windows\System\pyVKbja.exe
  2⤵
  PID:1772
- C:\Windows\System\kVJyxnp.exe
  C:\Windows\System\kVJyxnp.exe
  2⤵
  PID:604
- C:\Windows\System\TAqYfLZ.exe
  C:\Windows\System\TAqYfLZ.exe
  2⤵
  PID:2380
- C:\Windows\System\BOzIYgb.exe
  C:\Windows\System\BOzIYgb.exe
  2⤵
  PID:692
- C:\Windows\System\SKjoGlI.exe
  C:\Windows\System\SKjoGlI.exe
  2⤵
  PID:352
- C:\Windows\System\GfEumHW.exe
  C:\Windows\System\GfEumHW.exe
  2⤵
  PID:848
- C:\Windows\System\gmKLKai.exe
  C:\Windows\System\gmKLKai.exe
  2⤵
  PID:1688
- C:\Windows\System\pbklXyM.exe
  C:\Windows\System\pbklXyM.exe
  2⤵
  PID:1988
- C:\Windows\System\MCnlYOV.exe
  C:\Windows\System\MCnlYOV.exe
  2⤵
  PID:2580
- C:\Windows\System\qjSlCpl.exe
  C:\Windows\System\qjSlCpl.exe
  2⤵
  PID:2956
- C:\Windows\System\emYwvYa.exe
  C:\Windows\System\emYwvYa.exe
  2⤵
  PID:1016
- C:\Windows\System\duVbaru.exe
  C:\Windows\System\duVbaru.exe
  2⤵
  PID:1428
- C:\Windows\System\lVhlcyC.exe
  C:\Windows\System\lVhlcyC.exe
  2⤵
  PID:760
- C:\Windows\System\tikadpb.exe
  C:\Windows\System\tikadpb.exe
  2⤵
  PID:1064
- C:\Windows\System\SOehBVB.exe
  C:\Windows\System\SOehBVB.exe
  2⤵
  PID:1804
- C:\Windows\System\RGlesHY.exe
  C:\Windows\System\RGlesHY.exe
  2⤵
  PID:3096
- C:\Windows\System\qXSLdJj.exe
  C:\Windows\System\qXSLdJj.exe
  2⤵
  PID:3140
- C:\Windows\System\NGcBsKp.exe
  C:\Windows\System\NGcBsKp.exe
  2⤵
  PID:3152
- C:\Windows\System\ZTaVcui.exe
  C:\Windows\System\ZTaVcui.exe
  2⤵
  PID:3200
- C:\Windows\System\MHaihDq.exe
  C:\Windows\System\MHaihDq.exe
  2⤵
  PID:3232
- C:\Windows\System\xqoMvkG.exe
  C:\Windows\System\xqoMvkG.exe
  2⤵
  PID:3272
- C:\Windows\System\Shbutrn.exe
  C:\Windows\System\Shbutrn.exe
  2⤵
  PID:3276
- C:\Windows\System\KsnvFYH.exe
  C:\Windows\System\KsnvFYH.exe
  2⤵
  PID:3372
- C:\Windows\System\wgjkFew.exe
  C:\Windows\System\wgjkFew.exe
  2⤵
  PID:3316
- C:\Windows\System\BaGDKmL.exe
  C:\Windows\System\BaGDKmL.exe
  2⤵
  PID:3400
- C:\Windows\System\ieoPOPd.exe
  C:\Windows\System\ieoPOPd.exe
  2⤵
  PID:3452
- C:\Windows\System\phhUvWn.exe
  C:\Windows\System\phhUvWn.exe
  2⤵
  PID:3436
- C:\Windows\System\bkRRwbY.exe
  C:\Windows\System\bkRRwbY.exe
  2⤵
  PID:3480
- C:\Windows\System\JVeMvok.exe
  C:\Windows\System\JVeMvok.exe
  2⤵
  PID:3532
- C:\Windows\System\sqyavYq.exe
  C:\Windows\System\sqyavYq.exe
  2⤵
  PID:3556
- C:\Windows\System\DjuswFS.exe
  C:\Windows\System\DjuswFS.exe
  2⤵
  PID:3592
- C:\Windows\System\HouCcBa.exe
  C:\Windows\System\HouCcBa.exe
  2⤵
  PID:3660
- C:\Windows\System\PlOfBXk.exe
  C:\Windows\System\PlOfBXk.exe
  2⤵
  PID:3700
- C:\Windows\System\teGmmux.exe
  C:\Windows\System\teGmmux.exe
  2⤵
  PID:3676
- C:\Windows\System\GwWNZRq.exe
  C:\Windows\System\GwWNZRq.exe
  2⤵
  PID:3740
- C:\Windows\System\EntnRtf.exe
  C:\Windows\System\EntnRtf.exe
  2⤵
  PID:3756
- C:\Windows\System\pSRxxec.exe
  C:\Windows\System\pSRxxec.exe
  2⤵
  PID:3812
- C:\Windows\System\LCsDSuq.exe
  C:\Windows\System\LCsDSuq.exe
  2⤵
  PID:3796
- C:\Windows\System\dPWNqGX.exe
  C:\Windows\System\dPWNqGX.exe
  2⤵
  PID:3872
- C:\Windows\System\izxZHKl.exe
  C:\Windows\System\izxZHKl.exe
  2⤵
  PID:3912
- C:\Windows\System\krLfXPx.exe
  C:\Windows\System\krLfXPx.exe
  2⤵
  PID:3920
- C:\Windows\System\WYlgtwc.exe
  C:\Windows\System\WYlgtwc.exe
  2⤵
  PID:4012
- C:\Windows\System\MyGZRDi.exe
  C:\Windows\System\MyGZRDi.exe
  2⤵
  PID:4056
- C:\Windows\System\RWSyPnO.exe
  C:\Windows\System\RWSyPnO.exe
  2⤵
  PID:3952
- C:\Windows\System\xVmmlRK.exe
  C:\Windows\System\xVmmlRK.exe
  2⤵
  PID:4092
- C:\Windows\System\jyZXxsJ.exe
  C:\Windows\System\jyZXxsJ.exe
  2⤵
  PID:1516
- C:\Windows\System\oWkPLlC.exe
  C:\Windows\System\oWkPLlC.exe
  2⤵
  PID:2280
- C:\Windows\System\bRRdabi.exe
  C:\Windows\System\bRRdabi.exe
  2⤵
  PID:956
- C:\Windows\System\nRtMQzC.exe
  C:\Windows\System\nRtMQzC.exe
  2⤵
  PID:876
- C:\Windows\System\ssAfKqQ.exe
  C:\Windows\System\ssAfKqQ.exe
  2⤵
  PID:2404
- C:\Windows\System\mPaVcwF.exe
  C:\Windows\System\mPaVcwF.exe
  2⤵
  PID:3052
- C:\Windows\System\IRkavij.exe
  C:\Windows\System\IRkavij.exe
  2⤵
  PID:2524
- C:\Windows\System\aHpkukl.exe
  C:\Windows\System\aHpkukl.exe
  2⤵
  PID:1696
- C:\Windows\System\kQzXAvD.exe
  C:\Windows\System\kQzXAvD.exe
  2⤵
  PID:2620
- C:\Windows\System\KyfEHWh.exe
  C:\Windows\System\KyfEHWh.exe
  2⤵
  PID:3176
- C:\Windows\System\eSUxpFC.exe
  C:\Windows\System\eSUxpFC.exe
  2⤵
  PID:3116
- C:\Windows\System\bMiedxd.exe
  C:\Windows\System\bMiedxd.exe
  2⤵
  PID:3156
- C:\Windows\System\EwVFUpT.exe
  C:\Windows\System\EwVFUpT.exe
  2⤵
  PID:3296
- C:\Windows\System\hwDAkGk.exe
  C:\Windows\System\hwDAkGk.exe
  2⤵
  PID:3380
- C:\Windows\System\eykFntT.exe
  C:\Windows\System\eykFntT.exe
  2⤵
  PID:3332
- C:\Windows\System\hHXpKdA.exe
  C:\Windows\System\hHXpKdA.exe
  2⤵
  PID:3416
- C:\Windows\System\sMcKLiN.exe
  C:\Windows\System\sMcKLiN.exe
  2⤵
  PID:3392
- C:\Windows\System\wmQsYOg.exe
  C:\Windows\System\wmQsYOg.exe
  2⤵
  PID:3548
- C:\Windows\System\wIDGfOp.exe
  C:\Windows\System\wIDGfOp.exe
  2⤵
  PID:3440
- C:\Windows\System\WLIigoM.exe
  C:\Windows\System\WLIigoM.exe
  2⤵
  PID:3616
- C:\Windows\System\vpbHRdt.exe
  C:\Windows\System\vpbHRdt.exe
  2⤵
  PID:3600
- C:\Windows\System\bZNJfYc.exe
  C:\Windows\System\bZNJfYc.exe
  2⤵
  PID:3692
- C:\Windows\System\OlHjCyN.exe
  C:\Windows\System\OlHjCyN.exe
  2⤵
  PID:3732
- C:\Windows\System\foIkHoF.exe
  C:\Windows\System\foIkHoF.exe
  2⤵
  PID:3860
- C:\Windows\System\XfMCiZI.exe
  C:\Windows\System\XfMCiZI.exe
  2⤵
  PID:3792
- C:\Windows\System\broTnnD.exe
  C:\Windows\System\broTnnD.exe
  2⤵
  PID:3892
- C:\Windows\System\ESLZwUz.exe
  C:\Windows\System\ESLZwUz.exe
  2⤵
  PID:3976
- C:\Windows\System\sBniuTr.exe
  C:\Windows\System\sBniuTr.exe
  2⤵
  PID:3936
- C:\Windows\System\qXweDgR.exe
  C:\Windows\System\qXweDgR.exe
  2⤵
  PID:2148
- C:\Windows\System\XeACmSo.exe
  C:\Windows\System\XeACmSo.exe
  2⤵
  PID:1004
- C:\Windows\System\TDvXEJL.exe
  C:\Windows\System\TDvXEJL.exe
  2⤵
  PID:1672
- C:\Windows\System\sjrJRHy.exe
  C:\Windows\System\sjrJRHy.exe
  2⤵
  PID:2584
- C:\Windows\System\RJQTWfJ.exe
  C:\Windows\System\RJQTWfJ.exe
  2⤵
  PID:2908
- C:\Windows\System\eivxiAK.exe
  C:\Windows\System\eivxiAK.exe
  2⤵
  PID:2864
- C:\Windows\System\UIxSeJB.exe
  C:\Windows\System\UIxSeJB.exe
  2⤵
  PID:3252
- C:\Windows\System\PIftaSO.exe
  C:\Windows\System\PIftaSO.exe
  2⤵
  PID:3360
- C:\Windows\System\LtrAwlm.exe
  C:\Windows\System\LtrAwlm.exe
  2⤵
  PID:2648
- C:\Windows\System\YddncLP.exe
  C:\Windows\System\YddncLP.exe
  2⤵
  PID:3580
- C:\Windows\System\zpxxzjI.exe
  C:\Windows\System\zpxxzjI.exe
  2⤵
  PID:3136
- C:\Windows\System\sydibLu.exe
  C:\Windows\System\sydibLu.exe
  2⤵
  PID:3280
- C:\Windows\System\gSCsVtH.exe
  C:\Windows\System\gSCsVtH.exe
  2⤵
  PID:3312
- C:\Windows\System\BpiYodf.exe
  C:\Windows\System\BpiYodf.exe
  2⤵
  PID:2592
- C:\Windows\System\eeOgeZQ.exe
  C:\Windows\System\eeOgeZQ.exe
  2⤵
  PID:3536
- C:\Windows\System\QRyMfiK.exe
  C:\Windows\System\QRyMfiK.exe
  2⤵
  PID:3940
- C:\Windows\System\yCYjTZr.exe
  C:\Windows\System\yCYjTZr.exe
  2⤵
  PID:696
- C:\Windows\System\erHMccn.exe
  C:\Windows\System\erHMccn.exe
  2⤵
  PID:3896
- C:\Windows\System\ztJokLg.exe
  C:\Windows\System\ztJokLg.exe
  2⤵
  PID:1856
- C:\Windows\System\VkhpOQH.exe
  C:\Windows\System\VkhpOQH.exe
  2⤵
  PID:4068
- C:\Windows\System\ePpCyLo.exe
  C:\Windows\System\ePpCyLo.exe
  2⤵
  PID:2340
- C:\Windows\System\tNyebMP.exe
  C:\Windows\System\tNyebMP.exe
  2⤵
  PID:1564
- C:\Windows\System\bsaAhjm.exe
  C:\Windows\System\bsaAhjm.exe
  2⤵
  PID:2180
- C:\Windows\System\COJkQBK.exe
  C:\Windows\System\COJkQBK.exe
  2⤵
  PID:3076
- C:\Windows\System\cREiooE.exe
  C:\Windows\System\cREiooE.exe
  2⤵
  PID:3696
- C:\Windows\System\rVEqTOS.exe
  C:\Windows\System\rVEqTOS.exe
  2⤵
  PID:3456
- C:\Windows\System\QAycoCQ.exe
  C:\Windows\System\QAycoCQ.exe
  2⤵
  PID:3968
- C:\Windows\System\JmjqdTy.exe
  C:\Windows\System\JmjqdTy.exe
  2⤵
  PID:4112
- C:\Windows\System\AsSmiLf.exe
  C:\Windows\System\AsSmiLf.exe
  2⤵
  PID:4132
- C:\Windows\System\EqSVwDw.exe
  C:\Windows\System\EqSVwDw.exe
  2⤵
  PID:4152
- C:\Windows\System\yFeNxHP.exe
  C:\Windows\System\yFeNxHP.exe
  2⤵
  PID:4172
- C:\Windows\System\wgkfyDi.exe
  C:\Windows\System\wgkfyDi.exe
  2⤵
  PID:4188
- C:\Windows\System\ZZIHYCm.exe
  C:\Windows\System\ZZIHYCm.exe
  2⤵
  PID:4212
- C:\Windows\System\NkYtkon.exe
  C:\Windows\System\NkYtkon.exe
  2⤵
  PID:4232
- C:\Windows\System\IkXTUes.exe
  C:\Windows\System\IkXTUes.exe
  2⤵
  PID:4252
- C:\Windows\System\FfuOHhq.exe
  C:\Windows\System\FfuOHhq.exe
  2⤵
  PID:4268
- C:\Windows\System\NJZRNiD.exe
  C:\Windows\System\NJZRNiD.exe
  2⤵
  PID:4292
- C:\Windows\System\uPKFCCN.exe
  C:\Windows\System\uPKFCCN.exe
  2⤵
  PID:4312
- C:\Windows\System\DVymTHE.exe
  C:\Windows\System\DVymTHE.exe
  2⤵
  PID:4328
- C:\Windows\System\JfNivcW.exe
  C:\Windows\System\JfNivcW.exe
  2⤵
  PID:4348
- C:\Windows\System\SpCSwiQ.exe
  C:\Windows\System\SpCSwiQ.exe
  2⤵
  PID:4372
- C:\Windows\System\LJVcair.exe
  C:\Windows\System\LJVcair.exe
  2⤵
  PID:4392
- C:\Windows\System\fhVMZBt.exe
  C:\Windows\System\fhVMZBt.exe
  2⤵
  PID:4412
- C:\Windows\System\cBPcehj.exe
  C:\Windows\System\cBPcehj.exe
  2⤵
  PID:4428
- C:\Windows\System\WUbwdMC.exe
  C:\Windows\System\WUbwdMC.exe
  2⤵
  PID:4452
- C:\Windows\System\OSpNPzJ.exe
  C:\Windows\System\OSpNPzJ.exe
  2⤵
  PID:4472
- C:\Windows\System\pWWMTkK.exe
  C:\Windows\System\pWWMTkK.exe
  2⤵
  PID:4488
- C:\Windows\System\BuwSbsi.exe
  C:\Windows\System\BuwSbsi.exe
  2⤵
  PID:4508
- C:\Windows\System\KEeDAYm.exe
  C:\Windows\System\KEeDAYm.exe
  2⤵
  PID:4528
- C:\Windows\System\StbjZDq.exe
  C:\Windows\System\StbjZDq.exe
  2⤵
  PID:4552
- C:\Windows\System\EOwpKhQ.exe
  C:\Windows\System\EOwpKhQ.exe
  2⤵
  PID:4572
- C:\Windows\System\GRNxCYb.exe
  C:\Windows\System\GRNxCYb.exe
  2⤵
  PID:4592
- C:\Windows\System\fqySNqb.exe
  C:\Windows\System\fqySNqb.exe
  2⤵
  PID:4612
- C:\Windows\System\YNhkCrP.exe
  C:\Windows\System\YNhkCrP.exe
  2⤵
  PID:4632
- C:\Windows\System\fhzaLGH.exe
  C:\Windows\System\fhzaLGH.exe
  2⤵
  PID:4652
- C:\Windows\System\ujYzBTT.exe
  C:\Windows\System\ujYzBTT.exe
  2⤵
  PID:4668
- C:\Windows\System\zzTnxsn.exe
  C:\Windows\System\zzTnxsn.exe
  2⤵
  PID:4688
- C:\Windows\System\JCXvzjh.exe
  C:\Windows\System\JCXvzjh.exe
  2⤵
  PID:4712
- C:\Windows\System\BfyfNBh.exe
  C:\Windows\System\BfyfNBh.exe
  2⤵
  PID:4728
- C:\Windows\System\NNvHjbg.exe
  C:\Windows\System\NNvHjbg.exe
  2⤵
  PID:4748
- C:\Windows\System\EOgbikg.exe
  C:\Windows\System\EOgbikg.exe
  2⤵
  PID:4768
- C:\Windows\System\CBKzGNX.exe
  C:\Windows\System\CBKzGNX.exe
  2⤵
  PID:4784
- C:\Windows\System\MrLtvpd.exe
  C:\Windows\System\MrLtvpd.exe
  2⤵
  PID:4812
- C:\Windows\System\rRGZJPm.exe
  C:\Windows\System\rRGZJPm.exe
  2⤵
  PID:4828
- C:\Windows\System\nlFeGcs.exe
  C:\Windows\System\nlFeGcs.exe
  2⤵
  PID:4852
- C:\Windows\System\yXhtGRH.exe
  C:\Windows\System\yXhtGRH.exe
  2⤵
  PID:4868
- C:\Windows\System\MtAoLhN.exe
  C:\Windows\System\MtAoLhN.exe
  2⤵
  PID:4892
- C:\Windows\System\ocNAJPq.exe
  C:\Windows\System\ocNAJPq.exe
  2⤵
  PID:4908
- C:\Windows\System\dXAYsKQ.exe
  C:\Windows\System\dXAYsKQ.exe
  2⤵
  PID:4932
- C:\Windows\System\bEWNMPj.exe
  C:\Windows\System\bEWNMPj.exe
  2⤵
  PID:4948
- C:\Windows\System\yEnVbbR.exe
  C:\Windows\System\yEnVbbR.exe
  2⤵
  PID:4968
- C:\Windows\System\qSXTDVH.exe
  C:\Windows\System\qSXTDVH.exe
  2⤵
  PID:4988
- C:\Windows\System\aFHfftt.exe
  C:\Windows\System\aFHfftt.exe
  2⤵
  PID:5012
- C:\Windows\System\uHQaYdx.exe
  C:\Windows\System\uHQaYdx.exe
  2⤵
  PID:5028
- C:\Windows\System\hEUqRpg.exe
  C:\Windows\System\hEUqRpg.exe
  2⤵
  PID:5048
- C:\Windows\System\xkHWOuG.exe
  C:\Windows\System\xkHWOuG.exe
  2⤵
  PID:5068
- C:\Windows\System\lUHDTFp.exe
  C:\Windows\System\lUHDTFp.exe
  2⤵
  PID:5092
- C:\Windows\System\RsAMVdK.exe
  C:\Windows\System\RsAMVdK.exe
  2⤵
  PID:5112
- C:\Windows\System\ldOOuLH.exe
  C:\Windows\System\ldOOuLH.exe
  2⤵
  PID:4008
- C:\Windows\System\FJxXlIR.exe
  C:\Windows\System\FJxXlIR.exe
  2⤵
  PID:3636
- C:\Windows\System\XPKjGPg.exe
  C:\Windows\System\XPKjGPg.exe
  2⤵
  PID:4072
- C:\Windows\System\HBpSBsZ.exe
  C:\Windows\System\HBpSBsZ.exe
  2⤵
  PID:3560
- C:\Windows\System\RWZVRMO.exe
  C:\Windows\System\RWZVRMO.exe
  2⤵
  PID:3552
- C:\Windows\System\WuyFPzO.exe
  C:\Windows\System\WuyFPzO.exe
  2⤵
  PID:2564
- C:\Windows\System\TobHqYj.exe
  C:\Windows\System\TobHqYj.exe
  2⤵
  PID:3840
- C:\Windows\System\roIUoPk.exe
  C:\Windows\System\roIUoPk.exe
  2⤵
  PID:3672
- C:\Windows\System\MuftIJK.exe
  C:\Windows\System\MuftIJK.exe
  2⤵
  PID:4100
- C:\Windows\System\bbMtPKi.exe
  C:\Windows\System\bbMtPKi.exe
  2⤵
  PID:4140
- C:\Windows\System\cOzFoLf.exe
  C:\Windows\System\cOzFoLf.exe
  2⤵
  PID:4168
- C:\Windows\System\ODhYOCw.exe
  C:\Windows\System\ODhYOCw.exe
  2⤵
  PID:748
- C:\Windows\System\qYCuXsH.exe
  C:\Windows\System\qYCuXsH.exe
  2⤵
  PID:4204
- C:\Windows\System\hszTBQQ.exe
  C:\Windows\System\hszTBQQ.exe
  2⤵
  PID:4244
- C:\Windows\System\nRcxqeG.exe
  C:\Windows\System\nRcxqeG.exe
  2⤵
  PID:4284
- C:\Windows\System\cHAEtRN.exe
  C:\Windows\System\cHAEtRN.exe
  2⤵
  PID:4324
- C:\Windows\System\OoZMaFx.exe
  C:\Windows\System\OoZMaFx.exe
  2⤵
  PID:4364
- C:\Windows\System\iuJclGM.exe
  C:\Windows\System\iuJclGM.exe
  2⤵
  PID:4340
- C:\Windows\System\EsJYfwj.exe
  C:\Windows\System\EsJYfwj.exe
  2⤵
  PID:4440
- C:\Windows\System\YvKPpKV.exe
  C:\Windows\System\YvKPpKV.exe
  2⤵
  PID:4384
- C:\Windows\System\XSERFrr.exe
  C:\Windows\System\XSERFrr.exe
  2⤵
  PID:4480
- C:\Windows\System\NLghsWK.exe
  C:\Windows\System\NLghsWK.exe
  2⤵
  PID:4468
- C:\Windows\System\xDoPpXM.exe
  C:\Windows\System\xDoPpXM.exe
  2⤵
  PID:4496
- C:\Windows\System\FWVyEXU.exe
  C:\Windows\System\FWVyEXU.exe
  2⤵
  PID:4560
- C:\Windows\System\MWlrDYi.exe
  C:\Windows\System\MWlrDYi.exe
  2⤵
  PID:4580
- C:\Windows\System\NFBtngg.exe
  C:\Windows\System\NFBtngg.exe
  2⤵
  PID:4588
- C:\Windows\System\NhCYQpw.exe
  C:\Windows\System\NhCYQpw.exe
  2⤵
  PID:4676
- C:\Windows\System\GjcbMFt.exe
  C:\Windows\System\GjcbMFt.exe
  2⤵
  PID:4720
- C:\Windows\System\MadLrac.exe
  C:\Windows\System\MadLrac.exe
  2⤵
  PID:4704
- C:\Windows\System\fYSKUig.exe
  C:\Windows\System\fYSKUig.exe
  2⤵
  PID:4740
- C:\Windows\System\OTLVXHL.exe
  C:\Windows\System\OTLVXHL.exe
  2⤵
  PID:4792
- C:\Windows\System\rQFplIY.exe
  C:\Windows\System\rQFplIY.exe
  2⤵
  PID:4820
- C:\Windows\System\wVienCN.exe
  C:\Windows\System\wVienCN.exe
  2⤵
  PID:4876
- C:\Windows\System\arMHddg.exe
  C:\Windows\System\arMHddg.exe
  2⤵
  PID:4860
- C:\Windows\System\VbgoDAB.exe
  C:\Windows\System\VbgoDAB.exe
  2⤵
  PID:4924
- C:\Windows\System\VhPHbmv.exe
  C:\Windows\System\VhPHbmv.exe
  2⤵
  PID:1256
- C:\Windows\System\wTcyVAv.exe
  C:\Windows\System\wTcyVAv.exe
  2⤵
  PID:1840
- C:\Windows\System\natlFIa.exe
  C:\Windows\System\natlFIa.exe
  2⤵
  PID:5044
- C:\Windows\System\yLBgnQb.exe
  C:\Windows\System\yLBgnQb.exe
  2⤵
  PID:5080
- C:\Windows\System\NGAPHUS.exe
  C:\Windows\System\NGAPHUS.exe
  2⤵
  PID:3028
- C:\Windows\System\yYhsaut.exe
  C:\Windows\System\yYhsaut.exe
  2⤵
  PID:5104
- C:\Windows\System\IkXuvtY.exe
  C:\Windows\System\IkXuvtY.exe
  2⤵
  PID:5108
- C:\Windows\System\nHRufyy.exe
  C:\Windows\System\nHRufyy.exe
  2⤵
  PID:1808
- C:\Windows\System\ifUKMkr.exe
  C:\Windows\System\ifUKMkr.exe
  2⤵
  PID:3260
- C:\Windows\System\HuMERPy.exe
  C:\Windows\System\HuMERPy.exe
  2⤵
  PID:668
- C:\Windows\System\sULJKKA.exe
  C:\Windows\System\sULJKKA.exe
  2⤵
  PID:2976
- C:\Windows\System\rGkwXyl.exe
  C:\Windows\System\rGkwXyl.exe
  2⤵
  PID:4144
- C:\Windows\System\GdLFAjo.exe
  C:\Windows\System\GdLFAjo.exe
  2⤵
  PID:4224
- C:\Windows\System\VqxHWfj.exe
  C:\Windows\System\VqxHWfj.exe
  2⤵
  PID:4276
- C:\Windows\System\UUJgcob.exe
  C:\Windows\System\UUJgcob.exe
  2⤵
  PID:2292
- C:\Windows\System\Iynlzce.exe
  C:\Windows\System\Iynlzce.exe
  2⤵
  PID:1084
- C:\Windows\System\lIgSvno.exe
  C:\Windows\System\lIgSvno.exe
  2⤵
  PID:2824
- C:\Windows\System\oXESyfR.exe
  C:\Windows\System\oXESyfR.exe
  2⤵
  PID:3856
- C:\Windows\System\cvObzYC.exe
  C:\Windows\System\cvObzYC.exe
  2⤵
  PID:800
- C:\Windows\System\Xljvmsi.exe
  C:\Windows\System\Xljvmsi.exe
  2⤵
  PID:4108
- C:\Windows\System\MxKDGaM.exe
  C:\Windows\System\MxKDGaM.exe
  2⤵
  PID:2996
- C:\Windows\System\quOgztE.exe
  C:\Windows\System\quOgztE.exe
  2⤵
  PID:2044
- C:\Windows\System\sYzXded.exe
  C:\Windows\System\sYzXded.exe
  2⤵
  PID:4208
- C:\Windows\System\dUyZNQB.exe
  C:\Windows\System\dUyZNQB.exe
  2⤵
  PID:1484
- C:\Windows\System\iNGKRmF.exe
  C:\Windows\System\iNGKRmF.exe
  2⤵
  PID:4320
- C:\Windows\System\trabrRW.exe
  C:\Windows\System\trabrRW.exe
  2⤵
  PID:4404
- C:\Windows\System\yJbLDWO.exe
  C:\Windows\System\yJbLDWO.exe
  2⤵
  PID:4444
- C:\Windows\System\hCFzxLl.exe
  C:\Windows\System\hCFzxLl.exe
  2⤵
  PID:4524
- C:\Windows\System\SBuLMKC.exe
  C:\Windows\System\SBuLMKC.exe
  2⤵
  PID:4600
- C:\Windows\System\lqBIgVS.exe
  C:\Windows\System\lqBIgVS.exe
  2⤵
  PID:4540
- C:\Windows\System\ldLnTgX.exe
  C:\Windows\System\ldLnTgX.exe
  2⤵
  PID:4776
- C:\Windows\System\JXROdlw.exe
  C:\Windows\System\JXROdlw.exe
  2⤵
  PID:4844
- C:\Windows\System\mMbcTmU.exe
  C:\Windows\System\mMbcTmU.exe
  2⤵
  PID:4904
- C:\Windows\System\OrdGrAd.exe
  C:\Windows\System\OrdGrAd.exe
  2⤵
  PID:4660
- C:\Windows\System\zlVAPLF.exe
  C:\Windows\System\zlVAPLF.exe
  2⤵
  PID:4940
- C:\Windows\System\TmeZWLf.exe
  C:\Windows\System\TmeZWLf.exe
  2⤵
  PID:4764
- C:\Windows\System\aekEJqY.exe
  C:\Windows\System\aekEJqY.exe
  2⤵
  PID:4804
- C:\Windows\System\ZOqBeTm.exe
  C:\Windows\System\ZOqBeTm.exe
  2⤵
  PID:4964
- C:\Windows\System\CkHpEoM.exe
  C:\Windows\System\CkHpEoM.exe
  2⤵
  PID:2600
- C:\Windows\System\caXIEON.exe
  C:\Windows\System\caXIEON.exe
  2⤵
  PID:5076
- C:\Windows\System\QQvUppn.exe
  C:\Windows\System\QQvUppn.exe
  2⤵
  PID:5088
- C:\Windows\System\nJvGzZP.exe
  C:\Windows\System\nJvGzZP.exe
  2⤵
  PID:2612
- C:\Windows\System\iQkLHGl.exe
  C:\Windows\System\iQkLHGl.exe
  2⤵
  PID:5056
- C:\Windows\System\OfZRAqW.exe
  C:\Windows\System\OfZRAqW.exe
  2⤵
  PID:2080
- C:\Windows\System\srfuMjp.exe
  C:\Windows\System\srfuMjp.exe
  2⤵
  PID:2744
- C:\Windows\System\nuOOOaz.exe
  C:\Windows\System\nuOOOaz.exe
  2⤵
  PID:2432
- C:\Windows\System\aUlCMmw.exe
  C:\Windows\System\aUlCMmw.exe
  2⤵
  PID:2440
- C:\Windows\System\EuclbiX.exe
  C:\Windows\System\EuclbiX.exe
  2⤵
  PID:868
- C:\Windows\System\tlQiirI.exe
  C:\Windows\System\tlQiirI.exe
  2⤵
  PID:2928
- C:\Windows\System\HEdgaqE.exe
  C:\Windows\System\HEdgaqE.exe
  2⤵
  PID:1616
- C:\Windows\System\Jhznsiy.exe
  C:\Windows\System\Jhznsiy.exe
  2⤵
  PID:4308
- C:\Windows\System\BxjKdCq.exe
  C:\Windows\System\BxjKdCq.exe
  2⤵
  PID:688
- C:\Windows\System\MQOahYe.exe
  C:\Windows\System\MQOahYe.exe
  2⤵
  PID:4408
- C:\Windows\System\ypBfuAQ.exe
  C:\Windows\System\ypBfuAQ.exe
  2⤵
  PID:4604
- C:\Windows\System\prpJjvb.exe
  C:\Windows\System\prpJjvb.exe
  2⤵
  PID:1956
- C:\Windows\System\trTxLxT.exe
  C:\Windows\System\trTxLxT.exe
  2⤵
  PID:2896
- C:\Windows\System\oaSALjm.exe
  C:\Windows\System\oaSALjm.exe
  2⤵
  PID:4796
- C:\Windows\System\gTCOiVA.exe
  C:\Windows\System\gTCOiVA.exe
  2⤵
  PID:4648
- C:\Windows\System\uiGcosi.exe
  C:\Windows\System\uiGcosi.exe
  2⤵
  PID:2496
- C:\Windows\System\BnCohkG.exe
  C:\Windows\System\BnCohkG.exe
  2⤵
  PID:3656
- C:\Windows\System\UsvUClX.exe
  C:\Windows\System\UsvUClX.exe
  2⤵
  PID:3032
- C:\Windows\System\ExDPbtI.exe
  C:\Windows\System\ExDPbtI.exe
  2⤵
  PID:4460
- C:\Windows\System\JRllcsw.exe
  C:\Windows\System\JRllcsw.exe
  2⤵
  PID:4628
- C:\Windows\System\VIogEgP.exe
  C:\Windows\System\VIogEgP.exe
  2⤵
  PID:5036
- C:\Windows\System\YmGgZzB.exe
  C:\Windows\System\YmGgZzB.exe
  2⤵
  PID:1676
- C:\Windows\System\acvIVYX.exe
  C:\Windows\System\acvIVYX.exe
  2⤵
  PID:3216
- C:\Windows\System\kIbMGkV.exe
  C:\Windows\System\kIbMGkV.exe
  2⤵
  PID:3820
- C:\Windows\System\jJnvpwU.exe
  C:\Windows\System\jJnvpwU.exe
  2⤵
  PID:4980
- C:\Windows\System\LlcFSFc.exe
  C:\Windows\System\LlcFSFc.exe
  2⤵
  PID:4544
- C:\Windows\System\uxFaEfC.exe
  C:\Windows\System\uxFaEfC.exe
  2⤵
  PID:4900
- C:\Windows\System\ttRRucP.exe
  C:\Windows\System\ttRRucP.exe
  2⤵
  PID:5024
- C:\Windows\System\YeVDLlM.exe
  C:\Windows\System\YeVDLlM.exe
  2⤵
  PID:4280
- C:\Windows\System\RRJWNXD.exe
  C:\Windows\System\RRJWNXD.exe
  2⤵
  PID:4424
- C:\Windows\System\wZWCFve.exe
  C:\Windows\System\wZWCFve.exe
  2⤵
  PID:2936
- C:\Windows\System\wZdHDeX.exe
  C:\Windows\System\wZdHDeX.exe
  2⤵
  PID:2828
- C:\Windows\System\kaznQSc.exe
  C:\Windows\System\kaznQSc.exe
  2⤵
  PID:4624
- C:\Windows\System\CYUvgBz.exe
  C:\Windows\System\CYUvgBz.exe
  2⤵
  PID:4220
- C:\Windows\System\mGdlTgF.exe
  C:\Windows\System\mGdlTgF.exe
  2⤵
  PID:2388
- C:\Windows\System\wYDFUke.exe
  C:\Windows\System\wYDFUke.exe
  2⤵
  PID:736
- C:\Windows\System\aYyXjQt.exe
  C:\Windows\System\aYyXjQt.exe
  2⤵
  PID:2792
- C:\Windows\System\qEQLkWe.exe
  C:\Windows\System\qEQLkWe.exe
  2⤵
  PID:3500
- C:\Windows\System\KRVCukz.exe
  C:\Windows\System\KRVCukz.exe
  2⤵
  PID:4800
- C:\Windows\System\oNkgAZl.exe
  C:\Windows\System\oNkgAZl.exe
  2⤵
  PID:2152
- C:\Windows\System\TkinRIF.exe
  C:\Windows\System\TkinRIF.exe
  2⤵
  PID:4516
- C:\Windows\System\ZPYxeBc.exe
  C:\Windows\System\ZPYxeBc.exe
  2⤵
  PID:5128
- C:\Windows\System\unfJpEQ.exe
  C:\Windows\System\unfJpEQ.exe
  2⤵
  PID:5144
- C:\Windows\System\YezEYJN.exe
  C:\Windows\System\YezEYJN.exe
  2⤵
  PID:5160
- C:\Windows\System\hhWxhQA.exe
  C:\Windows\System\hhWxhQA.exe
  2⤵
  PID:5176
- C:\Windows\System\BYkUvVS.exe
  C:\Windows\System\BYkUvVS.exe
  2⤵
  PID:5192
- C:\Windows\System\ddYFvXi.exe
  C:\Windows\System\ddYFvXi.exe
  2⤵
  PID:5208
- C:\Windows\System\vMkCnhZ.exe
  C:\Windows\System\vMkCnhZ.exe
  2⤵
  PID:5224
- C:\Windows\System\jTiQYTi.exe
  C:\Windows\System\jTiQYTi.exe
  2⤵
  PID:5240
- C:\Windows\System\QYzGivg.exe
  C:\Windows\System\QYzGivg.exe
  2⤵
  PID:5256
- C:\Windows\System\NmtEEkJ.exe
  C:\Windows\System\NmtEEkJ.exe
  2⤵
  PID:5272
- C:\Windows\System\oQpffeF.exe
  C:\Windows\System\oQpffeF.exe
  2⤵
  PID:5288
- C:\Windows\System\XxmMJfN.exe
  C:\Windows\System\XxmMJfN.exe
  2⤵
  PID:5304
- C:\Windows\System\HLMERex.exe
  C:\Windows\System\HLMERex.exe
  2⤵
  PID:5320
- C:\Windows\System\mUktJqG.exe
  C:\Windows\System\mUktJqG.exe
  2⤵
  PID:5336
- C:\Windows\System\hjWXhvv.exe
  C:\Windows\System\hjWXhvv.exe
  2⤵
  PID:5352
- C:\Windows\System\pLTMzsa.exe
  C:\Windows\System\pLTMzsa.exe
  2⤵
  PID:5368
- C:\Windows\System\CGJwXpg.exe
  C:\Windows\System\CGJwXpg.exe
  2⤵
  PID:5384
- C:\Windows\System\vMisjCh.exe
  C:\Windows\System\vMisjCh.exe
  2⤵
  PID:5400
- C:\Windows\System\MNGRhtg.exe
  C:\Windows\System\MNGRhtg.exe
  2⤵
  PID:5416
- C:\Windows\System\ZLipRJP.exe
  C:\Windows\System\ZLipRJP.exe
  2⤵
  PID:5432
- C:\Windows\System\tBsoZRX.exe
  C:\Windows\System\tBsoZRX.exe
  2⤵
  PID:5448
- C:\Windows\System\DKbHDgB.exe
  C:\Windows\System\DKbHDgB.exe
  2⤵
  PID:5464
- C:\Windows\System\EWfCXny.exe
  C:\Windows\System\EWfCXny.exe
  2⤵
  PID:5480
- C:\Windows\System\vZqjhFs.exe
  C:\Windows\System\vZqjhFs.exe
  2⤵
  PID:5496
- C:\Windows\System\gkQsCZA.exe
  C:\Windows\System\gkQsCZA.exe
  2⤵
  PID:5512
- C:\Windows\System\NOpokQZ.exe
  C:\Windows\System\NOpokQZ.exe
  2⤵
  PID:5528
- C:\Windows\System\FxGxEJh.exe
  C:\Windows\System\FxGxEJh.exe
  2⤵
  PID:5544
- C:\Windows\System\sdgIzkv.exe
  C:\Windows\System\sdgIzkv.exe
  2⤵
  PID:5560
- C:\Windows\System\OYVKfmV.exe
  C:\Windows\System\OYVKfmV.exe
  2⤵
  PID:5576
- C:\Windows\System\LOJopwO.exe
  C:\Windows\System\LOJopwO.exe
  2⤵
  PID:5592
- C:\Windows\System\CdcsqvB.exe
  C:\Windows\System\CdcsqvB.exe
  2⤵
  PID:5608
- C:\Windows\System\HEaKCDa.exe
  C:\Windows\System\HEaKCDa.exe
  2⤵
  PID:5624
- C:\Windows\System\AbpdlZo.exe
  C:\Windows\System\AbpdlZo.exe
  2⤵
  PID:5640
- C:\Windows\System\InPCjEl.exe
  C:\Windows\System\InPCjEl.exe
  2⤵
  PID:5656
- C:\Windows\System\yxQrUrY.exe
  C:\Windows\System\yxQrUrY.exe
  2⤵
  PID:5672
- C:\Windows\System\FLmdQZa.exe
  C:\Windows\System\FLmdQZa.exe
  2⤵
  PID:5688
- C:\Windows\System\gAImbbk.exe
  C:\Windows\System\gAImbbk.exe
  2⤵
  PID:5704
- C:\Windows\System\jTiLmvP.exe
  C:\Windows\System\jTiLmvP.exe
  2⤵
  PID:5720
- C:\Windows\System\KONIYxm.exe
  C:\Windows\System\KONIYxm.exe
  2⤵
  PID:5736
- C:\Windows\System\aLNQAga.exe
  C:\Windows\System\aLNQAga.exe
  2⤵
  PID:5756
- C:\Windows\System\meSWFKe.exe
  C:\Windows\System\meSWFKe.exe
  2⤵
  PID:5780
- C:\Windows\System\FoOnAQu.exe
  C:\Windows\System\FoOnAQu.exe
  2⤵
  PID:5804
- C:\Windows\System\DPxlnhm.exe
  C:\Windows\System\DPxlnhm.exe
  2⤵
  PID:5824
- C:\Windows\System\OfCwIhF.exe
  C:\Windows\System\OfCwIhF.exe
  2⤵
  PID:5840
- C:\Windows\System\lbhzrXs.exe
  C:\Windows\System\lbhzrXs.exe
  2⤵
  PID:5856
- C:\Windows\System\rRPIyXE.exe
  C:\Windows\System\rRPIyXE.exe
  2⤵
  PID:5872
- C:\Windows\System\aBuBWXj.exe
  C:\Windows\System\aBuBWXj.exe
  2⤵
  PID:5888
- C:\Windows\System\yOYOxTj.exe
  C:\Windows\System\yOYOxTj.exe
  2⤵
  PID:5904
- C:\Windows\System\xmuGIyG.exe
  C:\Windows\System\xmuGIyG.exe
  2⤵
  PID:5920
- C:\Windows\System\KkSXMzb.exe
  C:\Windows\System\KkSXMzb.exe
  2⤵
  PID:5936
- C:\Windows\System\YKEutyz.exe
  C:\Windows\System\YKEutyz.exe
  2⤵
  PID:5952
- C:\Windows\System\lGyxGIG.exe
  C:\Windows\System\lGyxGIG.exe
  2⤵
  PID:5968
- C:\Windows\System\LeKvnNE.exe
  C:\Windows\System\LeKvnNE.exe
  2⤵
  PID:5188
- C:\Windows\System\nwcNiFW.exe
  C:\Windows\System\nwcNiFW.exe
  2⤵
  PID:5360
- C:\Windows\System\oBRnjNy.exe
  C:\Windows\System\oBRnjNy.exe
  2⤵
  PID:5424
- C:\Windows\System\ZlCoLsx.exe
  C:\Windows\System\ZlCoLsx.exe
  2⤵
  PID:2680
- C:\Windows\System\vsIwEvv.exe
  C:\Windows\System\vsIwEvv.exe
  2⤵
  PID:4984
- C:\Windows\System\MGOaOui.exe
  C:\Windows\System\MGOaOui.exe
  2⤵
  PID:1728
- C:\Windows\System\XABKdSC.exe
  C:\Windows\System\XABKdSC.exe
  2⤵
  PID:5556
- C:\Windows\System\hNPYekH.exe
  C:\Windows\System\hNPYekH.exe
  2⤵
  PID:5440
- C:\Windows\System\RdzKSgu.exe
  C:\Windows\System\RdzKSgu.exe
  2⤵
  PID:5472
- C:\Windows\System\HfBefKu.exe
  C:\Windows\System\HfBefKu.exe
  2⤵
  PID:5504
- C:\Windows\System\SsXZvdw.exe
  C:\Windows\System\SsXZvdw.exe
  2⤵
  PID:5376
- C:\Windows\System\LWwgBCF.exe
  C:\Windows\System\LWwgBCF.exe
  2⤵
  PID:5680
- C:\Windows\System\wQsaZcD.exe
  C:\Windows\System\wQsaZcD.exe
  2⤵
  PID:5572
- C:\Windows\System\ulGCFOT.exe
  C:\Windows\System\ulGCFOT.exe
  2⤵
  PID:5600
- C:\Windows\System\DceyIHP.exe
  C:\Windows\System\DceyIHP.exe
  2⤵
  PID:5636
- C:\Windows\System\xEnNEcb.exe
  C:\Windows\System\xEnNEcb.exe
  2⤵
  PID:5732
- C:\Windows\System\PaGalxt.exe
  C:\Windows\System\PaGalxt.exe
  2⤵
  PID:5792
- C:\Windows\System\DEyJjsj.exe
  C:\Windows\System\DEyJjsj.exe
  2⤵
  PID:5868
- C:\Windows\System\KkXECVz.exe
  C:\Windows\System\KkXECVz.exe
  2⤵
  PID:5880
- C:\Windows\System\QNzDnyx.exe
  C:\Windows\System\QNzDnyx.exe
  2⤵
  PID:5960
- C:\Windows\System\GFxrnkX.exe
  C:\Windows\System\GFxrnkX.exe
  2⤵
  PID:5948
- C:\Windows\System\eXGYfXL.exe
  C:\Windows\System\eXGYfXL.exe
  2⤵
  PID:5992
- C:\Windows\System\RcnZiyK.exe
  C:\Windows\System\RcnZiyK.exe
  2⤵
  PID:6016
- C:\Windows\System\GlMVZpR.exe
  C:\Windows\System\GlMVZpR.exe
  2⤵
  PID:6032
- C:\Windows\System\cedNEtf.exe
  C:\Windows\System\cedNEtf.exe
  2⤵
  PID:6052
- C:\Windows\System\FBLREyp.exe
  C:\Windows\System\FBLREyp.exe
  2⤵
  PID:6068
- C:\Windows\System\gDwofOZ.exe
  C:\Windows\System\gDwofOZ.exe
  2⤵
  PID:6076
- C:\Windows\System\uFFFVMa.exe
  C:\Windows\System\uFFFVMa.exe
  2⤵
  PID:6104
- C:\Windows\System\rZcLNAo.exe
  C:\Windows\System\rZcLNAo.exe
  2⤵
  PID:6116
- C:\Windows\System\OowzWog.exe
  C:\Windows\System\OowzWog.exe
  2⤵
  PID:6136
- C:\Windows\System\tGYOyAN.exe
  C:\Windows\System\tGYOyAN.exe
  2⤵
  PID:1620
- C:\Windows\System\bbyOacF.exe
  C:\Windows\System\bbyOacF.exe
  2⤵
  PID:5136
- C:\Windows\System\QXEmZfq.exe
  C:\Windows\System\QXEmZfq.exe
  2⤵
  PID:5232
- C:\Windows\System\WPiItJV.exe
  C:\Windows\System\WPiItJV.exe
  2⤵
  PID:1292
- C:\Windows\System\HanQnxy.exe
  C:\Windows\System\HanQnxy.exe
  2⤵
  PID:5264
- C:\Windows\System\ifKykGL.exe
  C:\Windows\System\ifKykGL.exe
  2⤵
  PID:5124
- C:\Windows\System\SUCAeHQ.exe
  C:\Windows\System\SUCAeHQ.exe
  2⤵
  PID:2944
- C:\Windows\System\fkQQhuu.exe
  C:\Windows\System\fkQQhuu.exe
  2⤵
  PID:5456
- C:\Windows\System\bTJNNGM.exe
  C:\Windows\System\bTJNNGM.exe
  2⤵
  PID:5488
- C:\Windows\System\BTOfRGf.exe
  C:\Windows\System\BTOfRGf.exe
  2⤵
  PID:5588
- C:\Windows\System\sLRnlHU.exe
  C:\Windows\System\sLRnlHU.exe
  2⤵
  PID:5648
- C:\Windows\System\ZUxBQnO.exe
  C:\Windows\System\ZUxBQnO.exe
  2⤵
  PID:5552
- C:\Windows\System\MUGUbkw.exe
  C:\Windows\System\MUGUbkw.exe
  2⤵
  PID:5508
- C:\Windows\System\zngAsKL.exe
  C:\Windows\System\zngAsKL.exe
  2⤵
  PID:5408
- C:\Windows\System\MJBkPqF.exe
  C:\Windows\System\MJBkPqF.exe
  2⤵
  PID:5700
- C:\Windows\System\PficPBi.exe
  C:\Windows\System\PficPBi.exe
  2⤵
  PID:5696
- C:\Windows\System\bHPyuxO.exe
  C:\Windows\System\bHPyuxO.exe
  2⤵
  PID:5812
- C:\Windows\System\uxGBkpR.exe
  C:\Windows\System\uxGBkpR.exe
  2⤵
  PID:5928
- C:\Windows\System\zjOVAFE.exe
  C:\Windows\System\zjOVAFE.exe
  2⤵
  PID:5848
- C:\Windows\System\wwNZeKT.exe
  C:\Windows\System\wwNZeKT.exe
  2⤵
  PID:5764
- C:\Windows\System\aQIoifn.exe
  C:\Windows\System\aQIoifn.exe
  2⤵
  PID:5944
- C:\Windows\System\XDfdIZM.exe
  C:\Windows\System\XDfdIZM.exe
  2⤵
  PID:1188
- C:\Windows\System\EerbLzQ.exe
  C:\Windows\System\EerbLzQ.exe
  2⤵
  PID:6096
- C:\Windows\System\ukGvZiM.exe
  C:\Windows\System\ukGvZiM.exe
  2⤵
  PID:5268
- C:\Windows\System\QxZdrNl.exe
  C:\Windows\System\QxZdrNl.exe
  2⤵
  PID:5328
- C:\Windows\System\XYlmfFf.exe
  C:\Windows\System\XYlmfFf.exe
  2⤵
  PID:4024
- C:\Windows\System\gcgijMi.exe
  C:\Windows\System\gcgijMi.exe
  2⤵
  PID:5620
- C:\Windows\System\zrlUvkI.exe
  C:\Windows\System\zrlUvkI.exe
  2⤵
  PID:5864
- C:\Windows\System\FYrykTU.exe
  C:\Windows\System\FYrykTU.exe
  2⤵
  PID:5140
- C:\Windows\System\FwBTJgI.exe
  C:\Windows\System\FwBTJgI.exe
  2⤵
  PID:5204
- C:\Windows\System\EZeOJnL.exe
  C:\Windows\System\EZeOJnL.exe
  2⤵
  PID:6112
- C:\Windows\System\fhZvWQE.exe
  C:\Windows\System\fhZvWQE.exe
  2⤵
  PID:5988
- C:\Windows\System\KzqUxOx.exe
  C:\Windows\System\KzqUxOx.exe
  2⤵
  PID:4888
- C:\Windows\System\rxZlAvz.exe
  C:\Windows\System\rxZlAvz.exe
  2⤵
  PID:5476
- C:\Windows\System\cgqxiwk.exe
  C:\Windows\System\cgqxiwk.exe
  2⤵
  PID:6064
- C:\Windows\System\FfJNjZl.exe
  C:\Windows\System\FfJNjZl.exe
  2⤵
  PID:6008
- C:\Windows\System\cyeDatc.exe
  C:\Windows\System\cyeDatc.exe
  2⤵
  PID:6048
- C:\Windows\System\vCAxtUP.exe
  C:\Windows\System\vCAxtUP.exe
  2⤵
  PID:2068
- C:\Windows\System\ALpMVpK.exe
  C:\Windows\System\ALpMVpK.exe
  2⤵
  PID:5396
- C:\Windows\System\ObpyNsr.exe
  C:\Windows\System\ObpyNsr.exe
  2⤵
  PID:2980
- C:\Windows\System\MwrhKGE.exe
  C:\Windows\System\MwrhKGE.exe
  2⤵
  PID:5184
- C:\Windows\System\wfWFYUg.exe
  C:\Windows\System\wfWFYUg.exe
  2⤵
  PID:5220
- C:\Windows\System\XuZxJwk.exe
  C:\Windows\System\XuZxJwk.exe
  2⤵
  PID:6028
- C:\Windows\System\iVQgwTv.exe
  C:\Windows\System\iVQgwTv.exe
  2⤵
  PID:6132
- C:\Windows\System\QJpBeWL.exe
  C:\Windows\System\QJpBeWL.exe
  2⤵
  PID:6060
- C:\Windows\System\xJOOxyD.exe
  C:\Windows\System\xJOOxyD.exe
  2⤵
  PID:6040
- C:\Windows\System\XzleyUL.exe
  C:\Windows\System\XzleyUL.exe
  2⤵
  PID:5712
- C:\Windows\System\keuChNN.exe
  C:\Windows\System\keuChNN.exe
  2⤵
  PID:5852
- C:\Windows\System\JGQZcGy.exe
  C:\Windows\System\JGQZcGy.exe
  2⤵
  PID:5280
- C:\Windows\System\zRCkGwB.exe
  C:\Windows\System\zRCkGwB.exe
  2⤵
  PID:1308
- C:\Windows\System\zBfmEsp.exe
  C:\Windows\System\zBfmEsp.exe
  2⤵
  PID:6156
- C:\Windows\System\LLjpweO.exe
  C:\Windows\System\LLjpweO.exe
  2⤵
  PID:6172
- C:\Windows\System\kPkdTMu.exe
  C:\Windows\System\kPkdTMu.exe
  2⤵
  PID:6188
- C:\Windows\System\nnHCfrm.exe
  C:\Windows\System\nnHCfrm.exe
  2⤵
  PID:6224
- C:\Windows\System\BAccfxB.exe
  C:\Windows\System\BAccfxB.exe
  2⤵
  PID:6244
- C:\Windows\System\EHBnRKd.exe
  C:\Windows\System\EHBnRKd.exe
  2⤵
  PID:6264
- C:\Windows\System\pwdAbZw.exe
  C:\Windows\System\pwdAbZw.exe
  2⤵
  PID:6284
- C:\Windows\System\VDYNvzc.exe
  C:\Windows\System\VDYNvzc.exe
  2⤵
  PID:6300
- C:\Windows\System\aJyTwdb.exe
  C:\Windows\System\aJyTwdb.exe
  2⤵
  PID:6316
- C:\Windows\System\qSxabUt.exe
  C:\Windows\System\qSxabUt.exe
  2⤵
  PID:6336
- C:\Windows\System\bRrpOGS.exe
  C:\Windows\System\bRrpOGS.exe
  2⤵
  PID:6356
- C:\Windows\System\SPWmfGP.exe
  C:\Windows\System\SPWmfGP.exe
  2⤵
  PID:6372
- C:\Windows\System\kBooton.exe
  C:\Windows\System\kBooton.exe
  2⤵
  PID:6392
- C:\Windows\System\KukEQHj.exe
  C:\Windows\System\KukEQHj.exe
  2⤵
  PID:6420
- C:\Windows\System\QfBocpn.exe
  C:\Windows\System\QfBocpn.exe
  2⤵
  PID:6440
- C:\Windows\System\hAfWJHa.exe
  C:\Windows\System\hAfWJHa.exe
  2⤵
  PID:6460
- C:\Windows\System\GRZpuMW.exe
  C:\Windows\System\GRZpuMW.exe
  2⤵
  PID:6476
- C:\Windows\System\fIBvegK.exe
  C:\Windows\System\fIBvegK.exe
  2⤵
  PID:6496
- C:\Windows\System\ellxBCz.exe
  C:\Windows\System\ellxBCz.exe
  2⤵
  PID:6520
- C:\Windows\System\chLpLRY.exe
  C:\Windows\System\chLpLRY.exe
  2⤵
  PID:6540
- C:\Windows\System\fSSHtpa.exe
  C:\Windows\System\fSSHtpa.exe
  2⤵
  PID:6576
- C:\Windows\System\hxOgloz.exe
  C:\Windows\System\hxOgloz.exe
  2⤵
  PID:6596
- C:\Windows\System\IBRyLhl.exe
  C:\Windows\System\IBRyLhl.exe
  2⤵
  PID:6616
- C:\Windows\System\XySBmMH.exe
  C:\Windows\System\XySBmMH.exe
  2⤵
  PID:6632
- C:\Windows\System\WeOBsKh.exe
  C:\Windows\System\WeOBsKh.exe
  2⤵
  PID:6648
- C:\Windows\System\efArfhQ.exe
  C:\Windows\System\efArfhQ.exe
  2⤵
  PID:6668
- C:\Windows\System\yIunzNS.exe
  C:\Windows\System\yIunzNS.exe
  2⤵
  PID:6688
- C:\Windows\System\vKqzLLe.exe
  C:\Windows\System\vKqzLLe.exe
  2⤵
  PID:6704
- C:\Windows\System\SZjZTgb.exe
  C:\Windows\System\SZjZTgb.exe
  2⤵
  PID:6720
- C:\Windows\System\HQLmOea.exe
  C:\Windows\System\HQLmOea.exe
  2⤵
  PID:6736
- C:\Windows\System\ydqRwWu.exe
  C:\Windows\System\ydqRwWu.exe
  2⤵
  PID:6752
- C:\Windows\System\LlAnTxP.exe
  C:\Windows\System\LlAnTxP.exe
  2⤵
  PID:6768
- C:\Windows\System\IajVtJl.exe
  C:\Windows\System\IajVtJl.exe
  2⤵
  PID:6784
- C:\Windows\System\cyUhjEM.exe
  C:\Windows\System\cyUhjEM.exe
  2⤵
  PID:6800
- C:\Windows\System\MAOriNH.exe
  C:\Windows\System\MAOriNH.exe
  2⤵
  PID:6816
- C:\Windows\System\xrGTsBr.exe
  C:\Windows\System\xrGTsBr.exe
  2⤵
  PID:6832
- C:\Windows\System\bEBjUcy.exe
  C:\Windows\System\bEBjUcy.exe
  2⤵
  PID:6848
- C:\Windows\System\ATMJkdC.exe
  C:\Windows\System\ATMJkdC.exe
  2⤵
  PID:6872
- C:\Windows\System\bfsXcma.exe
  C:\Windows\System\bfsXcma.exe
  2⤵
  PID:6904
- C:\Windows\System\pLWUcZE.exe
  C:\Windows\System\pLWUcZE.exe
  2⤵
  PID:6932
- C:\Windows\System\ONKPPUg.exe
  C:\Windows\System\ONKPPUg.exe
  2⤵
  PID:6964
- C:\Windows\System\xIAGBwh.exe
  C:\Windows\System\xIAGBwh.exe
  2⤵
  PID:6984
- C:\Windows\System\pVpzBUq.exe
  C:\Windows\System\pVpzBUq.exe
  2⤵
  PID:7004
- C:\Windows\System\KWahZKz.exe
  C:\Windows\System\KWahZKz.exe
  2⤵
  PID:7020
- C:\Windows\System\DPDRkNw.exe
  C:\Windows\System\DPDRkNw.exe
  2⤵
  PID:7040
- C:\Windows\System\hYJSrpc.exe
  C:\Windows\System\hYJSrpc.exe
  2⤵
  PID:7056
- C:\Windows\System\fFnvxMU.exe
  C:\Windows\System\fFnvxMU.exe
  2⤵
  PID:7076
- C:\Windows\System\utVAFmI.exe
  C:\Windows\System\utVAFmI.exe
  2⤵
  PID:7092
- C:\Windows\System\zWqRhmQ.exe
  C:\Windows\System\zWqRhmQ.exe
  2⤵
  PID:7108
- C:\Windows\System\tOCvxLx.exe
  C:\Windows\System\tOCvxLx.exe
  2⤵
  PID:7132
- C:\Windows\System\SaJaDBq.exe
  C:\Windows\System\SaJaDBq.exe
  2⤵
  PID:7152
- C:\Windows\System\dOKftaT.exe
  C:\Windows\System\dOKftaT.exe
  2⤵
  PID:5664
- C:\Windows\System\jYkHmDZ.exe
  C:\Windows\System\jYkHmDZ.exe
  2⤵
  PID:6216
- C:\Windows\System\tOtZZWI.exe
  C:\Windows\System\tOtZZWI.exe
  2⤵
  PID:5348
- C:\Windows\System\EMYNoYn.exe
  C:\Windows\System\EMYNoYn.exe
  2⤵
  PID:5524
- C:\Windows\System\IMqkgxu.exe
  C:\Windows\System\IMqkgxu.exe
  2⤵
  PID:6184
- C:\Windows\System\EPzqcSf.exe
  C:\Windows\System\EPzqcSf.exe
  2⤵
  PID:5300
- C:\Windows\System\wgwTuFV.exe
  C:\Windows\System\wgwTuFV.exe
  2⤵
  PID:6292
- C:\Windows\System\XdngeYd.exe
  C:\Windows\System\XdngeYd.exe
  2⤵
  PID:6332
- C:\Windows\System\JkYRWcT.exe
  C:\Windows\System\JkYRWcT.exe
  2⤵
  PID:6408
- C:\Windows\System\KEElmHW.exe
  C:\Windows\System\KEElmHW.exe
  2⤵
  PID:6416
- C:\Windows\System\ZJAlvDw.exe
  C:\Windows\System\ZJAlvDw.exe
  2⤵
  PID:6272
- C:\Windows\System\xRzCgMz.exe
  C:\Windows\System\xRzCgMz.exe
  2⤵
  PID:6488
- C:\Windows\System\MQHKisr.exe
  C:\Windows\System\MQHKisr.exe
  2⤵
  PID:6380
- C:\Windows\System\yMMOTOI.exe
  C:\Windows\System\yMMOTOI.exe
  2⤵
  PID:6532
- C:\Windows\System\yjQbpzK.exe
  C:\Windows\System\yjQbpzK.exe
  2⤵
  PID:6384
- C:\Windows\System\YUqSTkr.exe
  C:\Windows\System\YUqSTkr.exe
  2⤵
  PID:6536
- C:\Windows\System\VeLzLJg.exe
  C:\Windows\System\VeLzLJg.exe
  2⤵
  PID:6516
- C:\Windows\System\omBMNfi.exe
  C:\Windows\System\omBMNfi.exe
  2⤵
  PID:6592
- C:\Windows\System\iVWFOxi.exe
  C:\Windows\System\iVWFOxi.exe
  2⤵
  PID:6564
- C:\Windows\System\rMKIMNg.exe
  C:\Windows\System\rMKIMNg.exe
  2⤵
  PID:6728
- C:\Windows\System\xfKgsWH.exe
  C:\Windows\System\xfKgsWH.exe
  2⤵
  PID:6792
- C:\Windows\System\YEmSkwB.exe
  C:\Windows\System\YEmSkwB.exe
  2⤵
  PID:6824
- C:\Windows\System\NswcvAT.exe
  C:\Windows\System\NswcvAT.exe
  2⤵
  PID:6912
- C:\Windows\System\bhkkdbn.exe
  C:\Windows\System\bhkkdbn.exe
  2⤵
  PID:6916
- C:\Windows\System\YZqcGBa.exe
  C:\Windows\System\YZqcGBa.exe
  2⤵
  PID:6808
- C:\Windows\System\tHHtffC.exe
  C:\Windows\System\tHHtffC.exe
  2⤵
  PID:6608
- C:\Windows\System\ObNlZaB.exe
  C:\Windows\System\ObNlZaB.exe
  2⤵
  PID:6640
- C:\Windows\System\WgDYPgU.exe
  C:\Windows\System\WgDYPgU.exe
  2⤵
  PID:7088
- C:\Windows\System\goOlDej.exe
  C:\Windows\System\goOlDej.exe
  2⤵
  PID:7128
- C:\Windows\System\jbIxACv.exe
  C:\Windows\System\jbIxACv.exe
  2⤵
  PID:6744
- C:\Windows\System\HJoDNhR.exe
  C:\Windows\System\HJoDNhR.exe
  2⤵
  PID:6900
- C:\Windows\System\FBpdFYy.exe
  C:\Windows\System\FBpdFYy.exe
  2⤵
  PID:6168
- C:\Windows\System\JvPKvbL.exe
  C:\Windows\System\JvPKvbL.exe
  2⤵
  PID:1820
- C:\Windows\System\WyAWnnt.exe
  C:\Windows\System\WyAWnnt.exe
  2⤵
  PID:7032
- C:\Windows\System\xTpTfGn.exe
  C:\Windows\System\xTpTfGn.exe
  2⤵
  PID:6260
- C:\Windows\System\HUYpdOb.exe
  C:\Windows\System\HUYpdOb.exe
  2⤵
  PID:6528
- C:\Windows\System\hMPCBrq.exe
  C:\Windows\System\hMPCBrq.exe
  2⤵
  PID:6352
- C:\Windows\System\KtCooXn.exe
  C:\Windows\System\KtCooXn.exe
  2⤵
  PID:6628
- C:\Windows\System\BNLToFL.exe
  C:\Windows\System\BNLToFL.exe
  2⤵
  PID:7072
- C:\Windows\System\NHoGBGY.exe
  C:\Windows\System\NHoGBGY.exe
  2⤵
  PID:6920
- C:\Windows\System\oxMriKP.exe
  C:\Windows\System\oxMriKP.exe
  2⤵
  PID:6976
- C:\Windows\System\kPTyjpb.exe
  C:\Windows\System\kPTyjpb.exe
  2⤵
  PID:6644
- C:\Windows\System\HkyuXGe.exe
  C:\Windows\System\HkyuXGe.exe
  2⤵
  PID:6148
- C:\Windows\System\wYYOXgw.exe
  C:\Windows\System\wYYOXgw.exe
  2⤵
  PID:6308
- C:\Windows\System\RbQhBJJ.exe
  C:\Windows\System\RbQhBJJ.exe
  2⤵
  PID:6972
- C:\Windows\System\BkUujro.exe
  C:\Windows\System\BkUujro.exe
  2⤵
  PID:7124
- C:\Windows\System\uPXtNko.exe
  C:\Windows\System\uPXtNko.exe
  2⤵
  PID:6560
- C:\Windows\System\dKFtZTr.exe
  C:\Windows\System\dKFtZTr.exe
  2⤵
  PID:7184
- C:\Windows\System\rbPWRTE.exe
  C:\Windows\System\rbPWRTE.exe
  2⤵
  PID:7204
- C:\Windows\System\TxBOYtz.exe
  C:\Windows\System\TxBOYtz.exe
  2⤵
  PID:7220
- C:\Windows\System\KsAHCMn.exe
  C:\Windows\System\KsAHCMn.exe
  2⤵
  PID:7240
- C:\Windows\System\hRTqVyV.exe
  C:\Windows\System\hRTqVyV.exe
  2⤵
  PID:7256
- C:\Windows\System\bQNhoGJ.exe
  C:\Windows\System\bQNhoGJ.exe
  2⤵
  PID:7276
- C:\Windows\System\bSAgXZl.exe
  C:\Windows\System\bSAgXZl.exe
  2⤵
  PID:7296
- C:\Windows\System\KCRtjhM.exe
  C:\Windows\System\KCRtjhM.exe
  2⤵
  PID:7316
- C:\Windows\System\xMVKtEv.exe
  C:\Windows\System\xMVKtEv.exe
  2⤵
  PID:7344
- C:\Windows\System\dsLciHz.exe
  C:\Windows\System\dsLciHz.exe
  2⤵
  PID:7360
- C:\Windows\System\bCuIuyN.exe
  C:\Windows\System\bCuIuyN.exe
  2⤵
  PID:7380
- C:\Windows\System\bmLofVc.exe
  C:\Windows\System\bmLofVc.exe
  2⤵
  PID:7400
- C:\Windows\System\aiIHusZ.exe
  C:\Windows\System\aiIHusZ.exe
  2⤵
  PID:7416
- C:\Windows\System\pQjfsGp.exe
  C:\Windows\System\pQjfsGp.exe
  2⤵
  PID:7440
- C:\Windows\System\RAWFtFX.exe
  C:\Windows\System\RAWFtFX.exe
  2⤵
  PID:7460
- C:\Windows\System\wpXBkbG.exe
  C:\Windows\System\wpXBkbG.exe
  2⤵
  PID:7484
- C:\Windows\System\wnWEvBk.exe
  C:\Windows\System\wnWEvBk.exe
  2⤵
  PID:7500
- C:\Windows\System\FSsvBHQ.exe
  C:\Windows\System\FSsvBHQ.exe
  2⤵
  PID:7520
- C:\Windows\System\BztJpFH.exe
  C:\Windows\System\BztJpFH.exe
  2⤵
  PID:7540
- C:\Windows\System\VwTIpko.exe
  C:\Windows\System\VwTIpko.exe
  2⤵
  PID:7556
- C:\Windows\System\usRuaIk.exe
  C:\Windows\System\usRuaIk.exe
  2⤵
  PID:7572
- C:\Windows\System\JzwPWlf.exe
  C:\Windows\System\JzwPWlf.exe
  2⤵
  PID:7592
- C:\Windows\System\oUJUgHI.exe
  C:\Windows\System\oUJUgHI.exe
  2⤵
  PID:7620
- C:\Windows\System\BOmbteh.exe
  C:\Windows\System\BOmbteh.exe
  2⤵
  PID:7640
- C:\Windows\System\eiMCWlP.exe
  C:\Windows\System\eiMCWlP.exe
  2⤵
  PID:7656
- C:\Windows\System\kTJyLxZ.exe
  C:\Windows\System\kTJyLxZ.exe
  2⤵
  PID:7680
- C:\Windows\System\ibIkZfo.exe
  C:\Windows\System\ibIkZfo.exe
  2⤵
  PID:7696
- C:\Windows\System\sCMyfGB.exe
  C:\Windows\System\sCMyfGB.exe
  2⤵
  PID:7712
- C:\Windows\System\sftHerd.exe
  C:\Windows\System\sftHerd.exe
  2⤵
  PID:7732
- C:\Windows\System\rqtYANQ.exe
  C:\Windows\System\rqtYANQ.exe
  2⤵
  PID:7748
- C:\Windows\System\QbxMDVo.exe
  C:\Windows\System\QbxMDVo.exe
  2⤵
  PID:7764
- C:\Windows\System\sSxmvmM.exe
  C:\Windows\System\sSxmvmM.exe
  2⤵
  PID:7784
- C:\Windows\System\skaSFsl.exe
  C:\Windows\System\skaSFsl.exe
  2⤵
  PID:7804
- C:\Windows\System\yIDNlmc.exe
  C:\Windows\System\yIDNlmc.exe
  2⤵
  PID:7832
- C:\Windows\System\sVkjRIQ.exe
  C:\Windows\System\sVkjRIQ.exe
  2⤵
  PID:7856
- C:\Windows\System\dZNuNsP.exe
  C:\Windows\System\dZNuNsP.exe
  2⤵
  PID:7872
- C:\Windows\System\gJDWZsd.exe
  C:\Windows\System\gJDWZsd.exe
  2⤵
  PID:7892
- C:\Windows\System\WaqaDYW.exe
  C:\Windows\System\WaqaDYW.exe
  2⤵
  PID:7912
- C:\Windows\System\IvSOllw.exe
  C:\Windows\System\IvSOllw.exe
  2⤵
  PID:7932
- C:\Windows\System\oVpLwqr.exe
  C:\Windows\System\oVpLwqr.exe
  2⤵
  PID:7948
- C:\Windows\System\brbHavk.exe
  C:\Windows\System\brbHavk.exe
  2⤵
  PID:7964
- C:\Windows\System\VXnEivn.exe
  C:\Windows\System\VXnEivn.exe
  2⤵
  PID:7988
- C:\Windows\System\oIGNhvA.exe
  C:\Windows\System\oIGNhvA.exe
  2⤵
  PID:8008
- C:\Windows\System\iNkIwAj.exe
  C:\Windows\System\iNkIwAj.exe
  2⤵
  PID:8024
- C:\Windows\System\vmAhPFZ.exe
  C:\Windows\System\vmAhPFZ.exe
  2⤵
  PID:8040
- C:\Windows\System\MOHzTRL.exe
  C:\Windows\System\MOHzTRL.exe
  2⤵
  PID:8060
- C:\Windows\System\GVIiePX.exe
  C:\Windows\System\GVIiePX.exe
  2⤵
  PID:8080
- C:\Windows\System\ZOnMERN.exe
  C:\Windows\System\ZOnMERN.exe
  2⤵
  PID:8104
- C:\Windows\System\VQqpgmq.exe
  C:\Windows\System\VQqpgmq.exe
  2⤵
  PID:8128
- C:\Windows\System\IyOAnGH.exe
  C:\Windows\System\IyOAnGH.exe
  2⤵
  PID:8148
- C:\Windows\System\NYjwviL.exe
  C:\Windows\System\NYjwviL.exe
  2⤵
  PID:8164
- C:\Windows\System\lcGtIEz.exe
  C:\Windows\System\lcGtIEz.exe
  2⤵
  PID:8180
- C:\Windows\System\ZyeUkZP.exe
  C:\Windows\System\ZyeUkZP.exe
  2⤵
  PID:7196
- C:\Windows\System\MICKnls.exe
  C:\Windows\System\MICKnls.exe
  2⤵
  PID:7236
- C:\Windows\System\RRShIyG.exe
  C:\Windows\System\RRShIyG.exe
  2⤵
  PID:7308
- C:\Windows\System\PAGLZCo.exe
  C:\Windows\System\PAGLZCo.exe
  2⤵
  PID:7388
- C:\Windows\System\pMTLNTm.exe
  C:\Windows\System\pMTLNTm.exe
  2⤵
  PID:7428
- C:\Windows\System\dMNnJoV.exe
  C:\Windows\System\dMNnJoV.exe
  2⤵
  PID:6548
- C:\Windows\System\ivgidPw.exe
  C:\Windows\System\ivgidPw.exe
  2⤵
  PID:7512
- C:\Windows\System\YyiWTLO.exe
  C:\Windows\System\YyiWTLO.exe
  2⤵
  PID:7584
- C:\Windows\System\siGEjdv.exe
  C:\Windows\System\siGEjdv.exe
  2⤵
  PID:6864
- C:\Windows\System\QgVatGC.exe
  C:\Windows\System\QgVatGC.exe
  2⤵
  PID:7012
- C:\Windows\System\jTUZBDF.exe
  C:\Windows\System\jTUZBDF.exe
  2⤵
  PID:6940
- C:\Windows\System\HwpSXWQ.exe
  C:\Windows\System\HwpSXWQ.exe
  2⤵
  PID:6952
- C:\Windows\System\MySDTFu.exe
  C:\Windows\System\MySDTFu.exe
  2⤵
  PID:7000
- C:\Windows\System\zMFGHvP.exe
  C:\Windows\System\zMFGHvP.exe
  2⤵
  PID:7664
- C:\Windows\System\jzbFGDE.exe
  C:\Windows\System\jzbFGDE.exe
  2⤵
  PID:7708
- C:\Windows\System\eDdzyMw.exe
  C:\Windows\System\eDdzyMw.exe
  2⤵
  PID:7812
- C:\Windows\System\BHJhHrN.exe
  C:\Windows\System\BHJhHrN.exe
  2⤵
  PID:7864
- C:\Windows\System\OgdRLOO.exe
  C:\Windows\System\OgdRLOO.exe
  2⤵
  PID:7944
- C:\Windows\System\eDKLRBz.exe
  C:\Windows\System\eDKLRBz.exe
  2⤵
  PID:8020
- C:\Windows\System\mrDYaoo.exe
  C:\Windows\System\mrDYaoo.exe
  2⤵
  PID:8092
- C:\Windows\System\ylvMoMb.exe
  C:\Windows\System\ylvMoMb.exe
  2⤵
  PID:8140
- C:\Windows\System\jKXkoSE.exe
  C:\Windows\System\jKXkoSE.exe
  2⤵
  PID:7268
- C:\Windows\System\YIDyvgF.exe
  C:\Windows\System\YIDyvgF.exe
  2⤵
  PID:7468
- C:\Windows\System\qdzmWKY.exe
  C:\Windows\System\qdzmWKY.exe
  2⤵
  PID:5200
- C:\Windows\System\MwJAECw.exe
  C:\Windows\System\MwJAECw.exe
  2⤵
  PID:6208
- C:\Windows\System\dFjoFhx.exe
  C:\Windows\System\dFjoFhx.exe
  2⤵
  PID:7744
- C:\Windows\System\VONHCvL.exe
  C:\Windows\System\VONHCvL.exe
  2⤵
  PID:7904
- C:\Windows\System\alvdkSp.exe
  C:\Windows\System\alvdkSp.exe
  2⤵
  PID:7648
- C:\Windows\System\OPYpZBN.exe
  C:\Windows\System\OPYpZBN.exe
  2⤵
  PID:7016
- C:\Windows\System\UGdbRZj.exe
  C:\Windows\System\UGdbRZj.exe
  2⤵
  PID:8172
- C:\Windows\System\VQLmToZ.exe
  C:\Windows\System\VQLmToZ.exe
  2⤵
  PID:7580
- C:\Windows\System\FPnVvaE.exe
  C:\Windows\System\FPnVvaE.exe
  2⤵
  PID:2368
- C:\Windows\System\LZRwhiv.exe
  C:\Windows\System\LZRwhiv.exe
  2⤵
  PID:6164
- C:\Windows\System\ickwsqD.exe
  C:\Windows\System\ickwsqD.exe
  2⤵
  PID:7940
- C:\Windows\System\OanXgti.exe
  C:\Windows\System\OanXgti.exe
  2⤵
  PID:6680
- C:\Windows\System\gdVwIhr.exe
  C:\Windows\System\gdVwIhr.exe
  2⤵
  PID:6432
- C:\Windows\System\GqijgWI.exe
  C:\Windows\System\GqijgWI.exe
  2⤵
  PID:6568
- C:\Windows\System\mSqvNfw.exe
  C:\Windows\System\mSqvNfw.exe
  2⤵
  PID:7632
- C:\Windows\System\HkyhuPO.exe
  C:\Windows\System\HkyhuPO.exe
  2⤵
  PID:7796
- C:\Windows\System\zhhsGxb.exe
  C:\Windows\System\zhhsGxb.exe
  2⤵
  PID:5796
- C:\Windows\System\qSjlrVJ.exe
  C:\Windows\System\qSjlrVJ.exe
  2⤵
  PID:7356
- C:\Windows\System\SNmcCte.exe
  C:\Windows\System\SNmcCte.exe
  2⤵
  PID:8016
- C:\Windows\System\AKRPwKR.exe
  C:\Windows\System\AKRPwKR.exe
  2⤵
  PID:7984
- C:\Windows\System\YNNmpLA.exe
  C:\Windows\System\YNNmpLA.exe
  2⤵
  PID:7532
- C:\Windows\System\FFoEzEG.exe
  C:\Windows\System\FFoEzEG.exe
  2⤵
  PID:6588
- C:\Windows\System\lKaTvFK.exe
  C:\Windows\System\lKaTvFK.exe
  2⤵
  PID:6368
- C:\Windows\System\BvpZhyM.exe
  C:\Windows\System\BvpZhyM.exe
  2⤵
  PID:6760
- C:\Windows\System\UXReHjQ.exe
  C:\Windows\System\UXReHjQ.exe
  2⤵
  PID:8068
- C:\Windows\System\gtXgzdl.exe
  C:\Windows\System\gtXgzdl.exe
  2⤵
  PID:8116
- C:\Windows\System\LmbQtjM.exe
  C:\Windows\System\LmbQtjM.exe
  2⤵
  PID:7176
- C:\Windows\System\ripjKnx.exe
  C:\Windows\System\ripjKnx.exe
  2⤵
  PID:7252
- C:\Windows\System\FHXYZTE.exe
  C:\Windows\System\FHXYZTE.exe
  2⤵
  PID:7324
- C:\Windows\System\gDgteDY.exe
  C:\Windows\System\gDgteDY.exe
  2⤵
  PID:7340
- C:\Windows\System\MNndSze.exe
  C:\Windows\System\MNndSze.exe
  2⤵
  PID:7448
- C:\Windows\System\fTcxpji.exe
  C:\Windows\System\fTcxpji.exe
  2⤵
  PID:7104
- C:\Windows\System\kaJvaAc.exe
  C:\Windows\System\kaJvaAc.exe
  2⤵
  PID:7888
- C:\Windows\System\iAIPLIN.exe
  C:\Windows\System\iAIPLIN.exe
  2⤵
  PID:7960
- C:\Windows\System\AyqcmlT.exe
  C:\Windows\System\AyqcmlT.exe
  2⤵
  PID:8188
- C:\Windows\System\jnzchWQ.exe
  C:\Windows\System\jnzchWQ.exe
  2⤵
  PID:6180
- C:\Windows\System\uYpDfGn.exe
  C:\Windows\System\uYpDfGn.exe
  2⤵
  PID:6960
- C:\Windows\System\GNtnuxx.exe
  C:\Windows\System\GNtnuxx.exe
  2⤵
  PID:7396
- C:\Windows\System\KwtTEoZ.exe
  C:\Windows\System\KwtTEoZ.exe
  2⤵
  PID:6892
- C:\Windows\System\xActKcJ.exe
  C:\Windows\System\xActKcJ.exe
  2⤵
  PID:6780
- C:\Windows\System\hWxeTuC.exe
  C:\Windows\System\hWxeTuC.exe
  2⤵
  PID:8112
- C:\Windows\System\pgFBzzc.exe
  C:\Windows\System\pgFBzzc.exe
  2⤵
  PID:7508
- C:\Windows\System\bGiGMcj.exe
  C:\Windows\System\bGiGMcj.exe
  2⤵
  PID:6324
- C:\Windows\System\ucliYLU.exe
  C:\Windows\System\ucliYLU.exe
  2⤵
  PID:6388
- C:\Windows\System\gHcxKaa.exe
  C:\Windows\System\gHcxKaa.exe
  2⤵
  PID:6472
- C:\Windows\System\paUMRFL.exe
  C:\Windows\System\paUMRFL.exe
  2⤵
  PID:7760
- C:\Windows\System\gXGKyrV.exe
  C:\Windows\System\gXGKyrV.exe
  2⤵
  PID:6884
- C:\Windows\System\JpvRtpE.exe
  C:\Windows\System\JpvRtpE.exe
  2⤵
  PID:7564
- C:\Windows\System\VTAUFsd.exe
  C:\Windows\System\VTAUFsd.exe
  2⤵
  PID:7552
- C:\Windows\System\zNPfPAU.exe
  C:\Windows\System\zNPfPAU.exe
  2⤵
  PID:7288
- C:\Windows\System\PicuDyn.exe
  C:\Windows\System\PicuDyn.exe
  2⤵
  PID:7412
- C:\Windows\System\lLMogGL.exe
  C:\Windows\System\lLMogGL.exe
  2⤵
  PID:7336
- C:\Windows\System\TarVauX.exe
  C:\Windows\System\TarVauX.exe
  2⤵
  PID:7212
- C:\Windows\System\LsgPwnB.exe
  C:\Windows\System\LsgPwnB.exe
  2⤵
  PID:6452
- C:\Windows\System\pwisNxr.exe
  C:\Windows\System\pwisNxr.exe
  2⤵
  PID:7704
- C:\Windows\System\gAGGuIl.exe
  C:\Windows\System\gAGGuIl.exe
  2⤵
  PID:6236
- C:\Windows\System\llQvVTA.exe
  C:\Windows\System\llQvVTA.exe
  2⤵
  PID:8124
- C:\Windows\System\Uyjqunj.exe
  C:\Windows\System\Uyjqunj.exe
  2⤵
  PID:7636
- C:\Windows\System\CdLEkPe.exe
  C:\Windows\System\CdLEkPe.exe
  2⤵
  PID:7304
- C:\Windows\System\IRnvarL.exe
  C:\Windows\System\IRnvarL.exe
  2⤵
  PID:7036
- C:\Windows\System\stwFeKq.exe
  C:\Windows\System\stwFeKq.exe
  2⤵
  PID:6812
- C:\Windows\System\rpaiFIP.exe
  C:\Windows\System\rpaiFIP.exe
  2⤵
  PID:7424
- C:\Windows\System\ocGGDzX.exe
  C:\Windows\System\ocGGDzX.exe
  2⤵
  PID:8120
- C:\Windows\System\JIpSmKt.exe
  C:\Windows\System\JIpSmKt.exe
  2⤵
  PID:7800
- C:\Windows\System\WfEqPoX.exe
  C:\Windows\System\WfEqPoX.exe
  2⤵
  PID:6700
- C:\Windows\System\NBRfWTg.exe
  C:\Windows\System\NBRfWTg.exe
  2⤵
  PID:7824
- C:\Windows\System\BgEZOQV.exe
  C:\Windows\System\BgEZOQV.exe
  2⤵
  PID:7408
- C:\Windows\System\kcMGHjx.exe
  C:\Windows\System\kcMGHjx.exe
  2⤵
  PID:6764
- C:\Windows\System\GgHOsqa.exe
  C:\Windows\System\GgHOsqa.exe
  2⤵
  PID:7980
- C:\Windows\System\yxUZiJa.exe
  C:\Windows\System\yxUZiJa.exe
  2⤵
  PID:7328
- C:\Windows\System\BLShfKc.exe
  C:\Windows\System\BLShfKc.exe
  2⤵
  PID:6468
- C:\Windows\System\pfmHvbn.exe
  C:\Windows\System\pfmHvbn.exe
  2⤵
  PID:6252
- C:\Windows\System\adMyglv.exe
  C:\Windows\System\adMyglv.exe
  2⤵
  PID:8156
- C:\Windows\System\ndZvtWf.exe
  C:\Windows\System\ndZvtWf.exe
  2⤵
  PID:7172
- C:\Windows\System\MfhhHfv.exe
  C:\Windows\System\MfhhHfv.exe
  2⤵
  PID:7848
- C:\Windows\System\GzMjdli.exe
  C:\Windows\System\GzMjdli.exe
  2⤵
  PID:6712
- C:\Windows\System\agbucCC.exe
  C:\Windows\System\agbucCC.exe
  2⤵
  PID:6512
- C:\Windows\System\ycSzMcF.exe
  C:\Windows\System\ycSzMcF.exe
  2⤵
  PID:7908
- C:\Windows\System\ymjuMUE.exe
  C:\Windows\System\ymjuMUE.exe
  2⤵
  PID:8088
- C:\Windows\System\YHGyKus.exe
  C:\Windows\System\YHGyKus.exe
  2⤵
  PID:7996
- C:\Windows\System\zWUIkAg.exe
  C:\Windows\System\zWUIkAg.exe
  2⤵
  PID:7272
- C:\Windows\System\CsIBKZr.exe
  C:\Windows\System\CsIBKZr.exe
  2⤵
  PID:8000
- C:\Windows\System\pHfziiW.exe
  C:\Windows\System\pHfziiW.exe
  2⤵
  PID:7780
- C:\Windows\System\bpJPGik.exe
  C:\Windows\System\bpJPGik.exe
  2⤵
  PID:6676
- C:\Windows\System\bNBHEmp.exe
  C:\Windows\System\bNBHEmp.exe
  2⤵
  PID:7652
- C:\Windows\System\KITSyZr.exe
  C:\Windows\System\KITSyZr.exe
  2⤵
  PID:8100
- C:\Windows\System\HBRfFyh.exe
  C:\Windows\System\HBRfFyh.exe
  2⤵
  PID:7376
- C:\Windows\System\mHXafzF.exe
  C:\Windows\System\mHXafzF.exe
  2⤵
  PID:6200
- C:\Windows\System\wXHafbo.exe
  C:\Windows\System\wXHafbo.exe
  2⤵
  PID:992
- C:\Windows\System\uCrgSQx.exe
  C:\Windows\System\uCrgSQx.exe
  2⤵
  PID:2224
- C:\Windows\System\xZhRxij.exe
  C:\Windows\System\xZhRxij.exe
  2⤵
  PID:8212
- C:\Windows\System\geMmhoM.exe
  C:\Windows\System\geMmhoM.exe
  2⤵
  PID:8232
- C:\Windows\System\UJEpXVa.exe
  C:\Windows\System\UJEpXVa.exe
  2⤵
  PID:8256
- C:\Windows\System\iueSgQk.exe
  C:\Windows\System\iueSgQk.exe
  2⤵
  PID:8292
- C:\Windows\System\CjeDrdu.exe
  C:\Windows\System\CjeDrdu.exe
  2⤵
  PID:8316
- C:\Windows\System\OrvzTDc.exe
  C:\Windows\System\OrvzTDc.exe
  2⤵
  PID:8332
- C:\Windows\System\ZNXJuLR.exe
  C:\Windows\System\ZNXJuLR.exe
  2⤵
  PID:8348
- C:\Windows\System\IhYdDyS.exe
  C:\Windows\System\IhYdDyS.exe
  2⤵
  PID:8364
- C:\Windows\System\RQKwsAD.exe
  C:\Windows\System\RQKwsAD.exe
  2⤵
  PID:8380
- C:\Windows\System\ElSrYXa.exe
  C:\Windows\System\ElSrYXa.exe
  2⤵
  PID:8428
- C:\Windows\System\ayfeoCH.exe
  C:\Windows\System\ayfeoCH.exe
  2⤵
  PID:8448
- C:\Windows\System\MsuNnzY.exe
  C:\Windows\System\MsuNnzY.exe
  2⤵
  PID:8464
- C:\Windows\System\bvcsiPA.exe
  C:\Windows\System\bvcsiPA.exe
  2⤵
  PID:8480
- C:\Windows\System\ZeyFsHW.exe
  C:\Windows\System\ZeyFsHW.exe
  2⤵
  PID:8500
- C:\Windows\System\jbZmZRm.exe
  C:\Windows\System\jbZmZRm.exe
  2⤵
  PID:8520
- C:\Windows\System\IXKTPuL.exe
  C:\Windows\System\IXKTPuL.exe
  2⤵
  PID:8540
- C:\Windows\System\nikIXPp.exe
  C:\Windows\System\nikIXPp.exe
  2⤵
  PID:8556
- C:\Windows\System\mHsdOvP.exe
  C:\Windows\System\mHsdOvP.exe
  2⤵
  PID:8572
- C:\Windows\System\PBuoYZS.exe
  C:\Windows\System\PBuoYZS.exe
  2⤵
  PID:8592
- C:\Windows\System\mfTovCA.exe
  C:\Windows\System\mfTovCA.exe
  2⤵
  PID:8616
- C:\Windows\System\qSyJndG.exe
  C:\Windows\System\qSyJndG.exe
  2⤵
  PID:8632
- C:\Windows\System\hlPPsHX.exe
  C:\Windows\System\hlPPsHX.exe
  2⤵
  PID:8656
- C:\Windows\System\zlgquKU.exe
  C:\Windows\System\zlgquKU.exe
  2⤵
  PID:8672
- C:\Windows\System\coYzYxj.exe
  C:\Windows\System\coYzYxj.exe
  2⤵
  PID:8692
- C:\Windows\System\jvAhZDI.exe
  C:\Windows\System\jvAhZDI.exe
  2⤵
  PID:8712
- C:\Windows\System\FmgBoCr.exe
  C:\Windows\System\FmgBoCr.exe
  2⤵
  PID:8732
- C:\Windows\System\VPZhNkr.exe
  C:\Windows\System\VPZhNkr.exe
  2⤵
  PID:8756
- C:\Windows\System\OhUuzRM.exe
  C:\Windows\System\OhUuzRM.exe
  2⤵
  PID:8772
- C:\Windows\System\rNaqrFp.exe
  C:\Windows\System\rNaqrFp.exe
  2⤵
  PID:8800
- C:\Windows\System\qXLDSmN.exe
  C:\Windows\System\qXLDSmN.exe
  2⤵
  PID:8824
- C:\Windows\System\eoUCzGE.exe
  C:\Windows\System\eoUCzGE.exe
  2⤵
  PID:8840
- C:\Windows\System\eYZQFhX.exe
  C:\Windows\System\eYZQFhX.exe
  2⤵
  PID:8856
- C:\Windows\System\CtCeYAy.exe
  C:\Windows\System\CtCeYAy.exe
  2⤵
  PID:8880
- C:\Windows\System\tykcdrA.exe
  C:\Windows\System\tykcdrA.exe
  2⤵
  PID:8900
- C:\Windows\System\prdTSVt.exe
  C:\Windows\System\prdTSVt.exe
  2⤵
  PID:8916
- C:\Windows\System\dCLCYRH.exe
  C:\Windows\System\dCLCYRH.exe
  2⤵
  PID:8932
- C:\Windows\System\DfCoSaE.exe
  C:\Windows\System\DfCoSaE.exe
  2⤵
  PID:8948
- C:\Windows\System\TCFiMQY.exe
  C:\Windows\System\TCFiMQY.exe
  2⤵
  PID:8964
- C:\Windows\System\WffCvBC.exe
  C:\Windows\System\WffCvBC.exe
  2⤵
  PID:8984
- C:\Windows\System\oDlGJNK.exe
  C:\Windows\System\oDlGJNK.exe
  2⤵
  PID:9000
- C:\Windows\System\qFvVhQJ.exe
  C:\Windows\System\qFvVhQJ.exe
  2⤵
  PID:9032
- C:\Windows\System\WijRdlY.exe
  C:\Windows\System\WijRdlY.exe
  2⤵
  PID:9048
- C:\Windows\System\VkzUghZ.exe
  C:\Windows\System\VkzUghZ.exe
  2⤵
  PID:9092
- C:\Windows\System\lVdAyiO.exe
  C:\Windows\System\lVdAyiO.exe
  2⤵
  PID:9108
- C:\Windows\System\pIngdQu.exe
  C:\Windows\System\pIngdQu.exe
  2⤵
  PID:9124
- C:\Windows\System\mZESCxw.exe
  C:\Windows\System\mZESCxw.exe
  2⤵
  PID:9140
- C:\Windows\System\jRPKTfS.exe
  C:\Windows\System\jRPKTfS.exe
  2⤵
  PID:9156
- C:\Windows\System\hyhEJZl.exe
  C:\Windows\System\hyhEJZl.exe
  2⤵
  PID:9184
- C:\Windows\System\SUgJuAv.exe
  C:\Windows\System\SUgJuAv.exe
  2⤵
  PID:9200
- C:\Windows\System\ihBYDMs.exe
  C:\Windows\System\ihBYDMs.exe
  2⤵
  PID:8200
- C:\Windows\System\STlKsFT.exe
  C:\Windows\System\STlKsFT.exe
  2⤵
  PID:8228
- C:\Windows\System\zsTDgpy.exe
  C:\Windows\System\zsTDgpy.exe
  2⤵
  PID:8272
- C:\Windows\System\WhDKjef.exe
  C:\Windows\System\WhDKjef.exe
  2⤵
  PID:8300
- C:\Windows\System\yQXloOZ.exe
  C:\Windows\System\yQXloOZ.exe
  2⤵
  PID:8328
- C:\Windows\System\vicbcoF.exe
  C:\Windows\System\vicbcoF.exe
  2⤵
  PID:8376
- C:\Windows\System\FbpqBLf.exe
  C:\Windows\System\FbpqBLf.exe
  2⤵
  PID:8396
- C:\Windows\System\GWWGQKD.exe
  C:\Windows\System\GWWGQKD.exe
  2⤵
  PID:8436
- C:\Windows\System\stEAMPF.exe
  C:\Windows\System\stEAMPF.exe
  2⤵
  PID:8472
- C:\Windows\System\BFYlIPE.exe
  C:\Windows\System\BFYlIPE.exe
  2⤵
  PID:8512
- C:\Windows\System\AqoTpxn.exe
  C:\Windows\System\AqoTpxn.exe
  2⤵
  PID:8584
- C:\Windows\System\IkjJoyp.exe
  C:\Windows\System\IkjJoyp.exe
  2⤵
  PID:8488
- C:\Windows\System\QBXqjRt.exe
  C:\Windows\System\QBXqjRt.exe
  2⤵
  PID:8532
- C:\Windows\System\xaKQCmM.exe
  C:\Windows\System\xaKQCmM.exe
  2⤵
  PID:8600
- C:\Windows\System\jaPMuFQ.exe
  C:\Windows\System\jaPMuFQ.exe
  2⤵
  PID:8640
- C:\Windows\System\oeRIVxg.exe
  C:\Windows\System\oeRIVxg.exe
  2⤵
  PID:8652
- C:\Windows\System\oWTdvMA.exe
  C:\Windows\System\oWTdvMA.exe
  2⤵
  PID:8688
- C:\Windows\System\enMEWyr.exe
  C:\Windows\System\enMEWyr.exe
  2⤵
  PID:8764
- C:\Windows\System\IGSKtwg.exe
  C:\Windows\System\IGSKtwg.exe
  2⤵
  PID:8796
- C:\Windows\System\bqtiImH.exe
  C:\Windows\System\bqtiImH.exe
  2⤵
  PID:8864
- C:\Windows\System\uacYwjZ.exe
  C:\Windows\System\uacYwjZ.exe
  2⤵
  PID:8876
- C:\Windows\System\wRLfhmq.exe
  C:\Windows\System\wRLfhmq.exe
  2⤵
  PID:8972
- C:\Windows\System\hHsKBdB.exe
  C:\Windows\System\hHsKBdB.exe
  2⤵
  PID:8848
- C:\Windows\System\qYTPUMO.exe
  C:\Windows\System\qYTPUMO.exe
  2⤵
  PID:8956
- C:\Windows\System\bjowEmK.exe
  C:\Windows\System\bjowEmK.exe
  2⤵
  PID:8960
- C:\Windows\System\crcTFIk.exe
  C:\Windows\System\crcTFIk.exe
  2⤵
  PID:9040
- C:\Windows\System\WJUyyxW.exe
  C:\Windows\System\WJUyyxW.exe
  2⤵
  PID:8420
- C:\Windows\System\OdeFkhV.exe
  C:\Windows\System\OdeFkhV.exe
  2⤵
  PID:9088
- C:\Windows\System\mzOIcqf.exe
  C:\Windows\System\mzOIcqf.exe
  2⤵
  PID:9120
- C:\Windows\System\sWPNKLM.exe
  C:\Windows\System\sWPNKLM.exe
  2⤵
  PID:9196
- C:\Windows\System\yVoaEYo.exe
  C:\Windows\System\yVoaEYo.exe
  2⤵
  PID:9164
- C:\Windows\System\IIIRxqq.exe
  C:\Windows\System\IIIRxqq.exe
  2⤵
  PID:9168
- C:\Windows\System\xTyJsNP.exe
  C:\Windows\System\xTyJsNP.exe
  2⤵
  PID:8244
- C:\Windows\System\NgbcftE.exe
  C:\Windows\System\NgbcftE.exe
  2⤵
  PID:9012
- C:\Windows\System\zzXjnAo.exe
  C:\Windows\System\zzXjnAo.exe
  2⤵
  PID:8392
- C:\Windows\System\WKahQtF.exe
  C:\Windows\System\WKahQtF.exe
  2⤵
  PID:8440
- C:\Windows\System\hMxEmZH.exe
  C:\Windows\System\hMxEmZH.exe
  2⤵
  PID:8628
- C:\Windows\System\KJBbGHu.exe
  C:\Windows\System\KJBbGHu.exe
  2⤵
  PID:8664
- C:\Windows\System\NPpFhsD.exe
  C:\Windows\System\NPpFhsD.exe
  2⤵
  PID:8740
- C:\Windows\System\UmGrJQc.exe
  C:\Windows\System\UmGrJQc.exe
  2⤵
  PID:8496
- C:\Windows\System\wBvustR.exe
  C:\Windows\System\wBvustR.exe
  2⤵
  PID:8724
- C:\Windows\System\KJqFREV.exe
  C:\Windows\System\KJqFREV.exe
  2⤵
  PID:8720
- C:\Windows\System\nbmhMki.exe
  C:\Windows\System\nbmhMki.exe
  2⤵
  PID:8792
- C:\Windows\System\TJfyrjZ.exe
  C:\Windows\System\TJfyrjZ.exe
  2⤵
  PID:8668
- C:\Windows\System\csWjrol.exe
  C:\Windows\System\csWjrol.exe
  2⤵
  PID:8580
- C:\Windows\System\fdXQzqI.exe
  C:\Windows\System\fdXQzqI.exe
  2⤵
  PID:9064
- C:\Windows\System\SXfsldE.exe
  C:\Windows\System\SXfsldE.exe
  2⤵
  PID:9044
- C:\Windows\System\LbzPPdt.exe
  C:\Windows\System\LbzPPdt.exe
  2⤵
  PID:9104
- C:\Windows\System\EUsuMhz.exe
  C:\Windows\System\EUsuMhz.exe
  2⤵
  PID:9116
- C:\Windows\System\INxLXba.exe
  C:\Windows\System\INxLXba.exe
  2⤵
  PID:8280
- C:\Windows\System\MOKieKP.exe
  C:\Windows\System\MOKieKP.exe
  2⤵
  PID:8276
- C:\Windows\System\VxJkiov.exe
  C:\Windows\System\VxJkiov.exe
  2⤵
  PID:8324
- C:\Windows\System\RGnFwmH.exe
  C:\Windows\System\RGnFwmH.exe
  2⤵
  PID:8388
- C:\Windows\System\vxAEhSE.exe
  C:\Windows\System\vxAEhSE.exe
  2⤵
  PID:8528
- C:\Windows\System\CtpDdGK.exe
  C:\Windows\System\CtpDdGK.exe
  2⤵
  PID:8644
- C:\Windows\System\MpfQawo.exe
  C:\Windows\System\MpfQawo.exe
  2⤵
  PID:8812
- C:\Windows\System\CBJWzJx.exe
  C:\Windows\System\CBJWzJx.exe
  2⤵
  PID:8820
- C:\Windows\System\vgiXpWx.exe
  C:\Windows\System\vgiXpWx.exe
  2⤵
  PID:8940
- C:\Windows\System\uvceBGD.exe
  C:\Windows\System\uvceBGD.exe
  2⤵
  PID:9020
- C:\Windows\System\vMbQfte.exe
  C:\Windows\System\vMbQfte.exe
  2⤵
  PID:9080
- C:\Windows\System\TUnRnAx.exe
  C:\Windows\System\TUnRnAx.exe
  2⤵
  PID:8220
- C:\Windows\System\ebIUpyV.exe
  C:\Windows\System\ebIUpyV.exe
  2⤵
  PID:8288
- C:\Windows\System\aichCWF.exe
  C:\Windows\System\aichCWF.exe
  2⤵
  PID:8404
- C:\Windows\System\NHQEXpe.exe
  C:\Windows\System\NHQEXpe.exe
  2⤵
  PID:8752
- C:\Windows\System\DmZHxJo.exe
  C:\Windows\System\DmZHxJo.exe
  2⤵
  PID:8816
- C:\Windows\System\aeyuJjW.exe
  C:\Windows\System\aeyuJjW.exe
  2⤵
  PID:8784
- C:\Windows\System\lyytWHG.exe
  C:\Windows\System\lyytWHG.exe
  2⤵
  PID:8996
- C:\Windows\System\btLrDfW.exe
  C:\Windows\System\btLrDfW.exe
  2⤵
  PID:9136
- C:\Windows\System\BUeEBvb.exe
  C:\Windows\System\BUeEBvb.exe
  2⤵
  PID:9024
- C:\Windows\System\cTyeXrt.exe
  C:\Windows\System\cTyeXrt.exe
  2⤵
  PID:8208
- C:\Windows\System\zKNstjU.exe
  C:\Windows\System\zKNstjU.exe
  2⤵
  PID:8744
- C:\Windows\System\KgDgCrv.exe
  C:\Windows\System\KgDgCrv.exe
  2⤵
  PID:9072
- C:\Windows\System\AkTnOvD.exe
  C:\Windows\System\AkTnOvD.exe
  2⤵
  PID:8568
- C:\Windows\System\ZVjlJGB.exe
  C:\Windows\System\ZVjlJGB.exe
  2⤵
  PID:9056
- C:\Windows\System\XyiYqNX.exe
  C:\Windows\System\XyiYqNX.exe
  2⤵
  PID:8304
- C:\Windows\System\HaVHcHc.exe
  C:\Windows\System\HaVHcHc.exe
  2⤵
  PID:8284
- C:\Windows\System\uxoCKvJ.exe
  C:\Windows\System\uxoCKvJ.exe
  2⤵
  PID:8424
- C:\Windows\System\nCzasSI.exe
  C:\Windows\System\nCzasSI.exe
  2⤵
  PID:8612
- C:\Windows\System\TbuKyAQ.exe
  C:\Windows\System\TbuKyAQ.exe
  2⤵
  PID:9232
- C:\Windows\System\vsTHSsR.exe
  C:\Windows\System\vsTHSsR.exe
  2⤵
  PID:9252
- C:\Windows\System\HRJqvdy.exe
  C:\Windows\System\HRJqvdy.exe
  2⤵
  PID:9268
- C:\Windows\System\DNRQhlN.exe
  C:\Windows\System\DNRQhlN.exe
  2⤵
  PID:9284
- C:\Windows\System\vJXWxFf.exe
  C:\Windows\System\vJXWxFf.exe
  2⤵
  PID:9300
- C:\Windows\System\ipAOWwT.exe
  C:\Windows\System\ipAOWwT.exe
  2⤵
  PID:9332
- C:\Windows\System\LvqVAvO.exe
  C:\Windows\System\LvqVAvO.exe
  2⤵
  PID:9348
- C:\Windows\System\rNEffxa.exe
  C:\Windows\System\rNEffxa.exe
  2⤵
  PID:9368
- C:\Windows\System\oBQzHjd.exe
  C:\Windows\System\oBQzHjd.exe
  2⤵
  PID:9388
- C:\Windows\System\QnDubUJ.exe
  C:\Windows\System\QnDubUJ.exe
  2⤵
  PID:9404
- C:\Windows\System\VmapZDE.exe
  C:\Windows\System\VmapZDE.exe
  2⤵
  PID:9428
- C:\Windows\System\tFBMCDf.exe
  C:\Windows\System\tFBMCDf.exe
  2⤵
  PID:9444
- C:\Windows\System\ZwwKHYc.exe
  C:\Windows\System\ZwwKHYc.exe
  2⤵
  PID:9460
- C:\Windows\System\wIUkXJM.exe
  C:\Windows\System\wIUkXJM.exe
  2⤵
  PID:9484
- C:\Windows\System\MxMGTJw.exe
  C:\Windows\System\MxMGTJw.exe
  2⤵
  PID:9512
- C:\Windows\System\PTqQBOv.exe
  C:\Windows\System\PTqQBOv.exe
  2⤵
  PID:9528
- C:\Windows\System\uYpahrK.exe
  C:\Windows\System\uYpahrK.exe
  2⤵
  PID:9544
- C:\Windows\System\mtJmRxn.exe
  C:\Windows\System\mtJmRxn.exe
  2⤵
  PID:9588
- C:\Windows\System\CHRiGkJ.exe
  C:\Windows\System\CHRiGkJ.exe
  2⤵
  PID:9608
- C:\Windows\System\RLltiHf.exe
  C:\Windows\System\RLltiHf.exe
  2⤵
  PID:9624
- C:\Windows\System\FcFNjuk.exe
  C:\Windows\System\FcFNjuk.exe
  2⤵
  PID:9644
- C:\Windows\System\pdiaSXi.exe
  C:\Windows\System\pdiaSXi.exe
  2⤵
  PID:9664
- C:\Windows\System\OsFheXN.exe
  C:\Windows\System\OsFheXN.exe
  2⤵
  PID:9684
- C:\Windows\System\lUUXcgV.exe
  C:\Windows\System\lUUXcgV.exe
  2⤵
  PID:9700
- C:\Windows\System\buZfYdZ.exe
  C:\Windows\System\buZfYdZ.exe
  2⤵
  PID:9720
- C:\Windows\System\tDSQvlU.exe
  C:\Windows\System\tDSQvlU.exe
  2⤵
  PID:9736
- C:\Windows\System\JFaNlOw.exe
  C:\Windows\System\JFaNlOw.exe
  2⤵
  PID:9752
- C:\Windows\System\GDnLmOU.exe
  C:\Windows\System\GDnLmOU.exe
  2⤵
  PID:9776
- C:\Windows\System\YQBTJaw.exe
  C:\Windows\System\YQBTJaw.exe
  2⤵
  PID:9800
- C:\Windows\System\tuTbHQW.exe
  C:\Windows\System\tuTbHQW.exe
  2⤵
  PID:9816
- C:\Windows\System\rfiOoeZ.exe
  C:\Windows\System\rfiOoeZ.exe
  2⤵
  PID:9840
- C:\Windows\System\EtWRuaX.exe
  C:\Windows\System\EtWRuaX.exe
  2⤵
  PID:9864
- C:\Windows\System\ZOkopAr.exe
  C:\Windows\System\ZOkopAr.exe
  2⤵
  PID:9888
- C:\Windows\System\VDiQIao.exe
  C:\Windows\System\VDiQIao.exe
  2⤵
  PID:9904
- C:\Windows\System\eSwlgGg.exe
  C:\Windows\System\eSwlgGg.exe
  2⤵
  PID:9920
- C:\Windows\System\vXePIjh.exe
  C:\Windows\System\vXePIjh.exe
  2⤵
  PID:9936
- C:\Windows\System\PwCprfO.exe
  C:\Windows\System\PwCprfO.exe
  2⤵
  PID:9952
- C:\Windows\System\yQDseLb.exe
  C:\Windows\System\yQDseLb.exe
  2⤵
  PID:9968
- C:\Windows\System\YIeXbcS.exe
  C:\Windows\System\YIeXbcS.exe
  2⤵
  PID:9984
- C:\Windows\System\YRCeKYi.exe
  C:\Windows\System\YRCeKYi.exe
  2⤵
  PID:10000
- C:\Windows\System\nDUZdVH.exe
  C:\Windows\System\nDUZdVH.exe
  2⤵
  PID:10016
- C:\Windows\System\ymyeysj.exe
  C:\Windows\System\ymyeysj.exe
  2⤵
  PID:10032
- C:\Windows\System\ZDvhagD.exe
  C:\Windows\System\ZDvhagD.exe
  2⤵
  PID:10048
- C:\Windows\System\DIdnTpH.exe
  C:\Windows\System\DIdnTpH.exe
  2⤵
  PID:10064
- C:\Windows\System\jzJMyPm.exe
  C:\Windows\System\jzJMyPm.exe
  2⤵
  PID:10088
- C:\Windows\System\FtrxOEc.exe
  C:\Windows\System\FtrxOEc.exe
  2⤵
  PID:10116
- C:\Windows\System\xeLzjDp.exe
  C:\Windows\System\xeLzjDp.exe
  2⤵
  PID:10144
- C:\Windows\System\EbieuAT.exe
  C:\Windows\System\EbieuAT.exe
  2⤵
  PID:10168
- C:\Windows\System\FDbccoW.exe
  C:\Windows\System\FDbccoW.exe
  2⤵
  PID:10212
- C:\Windows\System\JNizzuZ.exe
  C:\Windows\System\JNizzuZ.exe
  2⤵
  PID:10228
- C:\Windows\System\kAtyAjh.exe
  C:\Windows\System\kAtyAjh.exe
  2⤵
  PID:9244
- C:\Windows\System\XFfcviO.exe
  C:\Windows\System\XFfcviO.exe
  2⤵
  PID:9316
- C:\Windows\System\EXrjCtC.exe
  C:\Windows\System\EXrjCtC.exe
  2⤵
  PID:9360
- C:\Windows\System\vMnRzmk.exe
  C:\Windows\System\vMnRzmk.exe
  2⤵
  PID:9264
- C:\Windows\System\oOvmlrn.exe
  C:\Windows\System\oOvmlrn.exe
  2⤵
  PID:8980
- C:\Windows\System\ifWjpvV.exe
  C:\Windows\System\ifWjpvV.exe
  2⤵
  PID:9440
- C:\Windows\System\zFpvtuu.exe
  C:\Windows\System\zFpvtuu.exe
  2⤵
  PID:9380
- C:\Windows\System\ocKhtAD.exe
  C:\Windows\System\ocKhtAD.exe
  2⤵
  PID:9420
- C:\Windows\System\rIaClxr.exe
  C:\Windows\System\rIaClxr.exe
  2⤵
  PID:9340
- C:\Windows\System\okGpKsf.exe
  C:\Windows\System\okGpKsf.exe
  2⤵
  PID:9500
- C:\Windows\System\yTGzBKD.exe
  C:\Windows\System\yTGzBKD.exe
  2⤵
  PID:9556
- C:\Windows\System\hVXOEqM.exe
  C:\Windows\System\hVXOEqM.exe
  2⤵
  PID:9576
- C:\Windows\System\ZnvAYNc.exe
  C:\Windows\System\ZnvAYNc.exe
  2⤵
  PID:9600
- C:\Windows\System\oJljcSv.exe
  C:\Windows\System\oJljcSv.exe
  2⤵
  PID:9636
- C:\Windows\System\NEZtrdl.exe
  C:\Windows\System\NEZtrdl.exe
  2⤵
  PID:9676
- C:\Windows\System\Xtrdrfy.exe
  C:\Windows\System\Xtrdrfy.exe
  2⤵
  PID:9708
- C:\Windows\System\glLkbIZ.exe
  C:\Windows\System\glLkbIZ.exe
  2⤵
  PID:9764
- C:\Windows\System\fbUElms.exe
  C:\Windows\System\fbUElms.exe
  2⤵
  PID:9788
- C:\Windows\System\DmeYryS.exe
  C:\Windows\System\DmeYryS.exe
  2⤵
  PID:9828
- C:\Windows\System\gTTjZpY.exe
  C:\Windows\System\gTTjZpY.exe
  2⤵
  PID:9852
- C:\Windows\System\tTCJOjn.exe
  C:\Windows\System\tTCJOjn.exe
  2⤵
  PID:9876
- C:\Windows\System\DmferBe.exe
  C:\Windows\System\DmferBe.exe
  2⤵
  PID:9912
- C:\Windows\System\ePThJDH.exe
  C:\Windows\System\ePThJDH.exe
  2⤵
  PID:9996
- C:\Windows\System\TrMUtQE.exe
  C:\Windows\System\TrMUtQE.exe
  2⤵
  PID:9916
- C:\Windows\System\RBEYLXz.exe
  C:\Windows\System\RBEYLXz.exe
  2⤵
  PID:9980
- C:\Windows\System\MfNTsxA.exe
  C:\Windows\System\MfNTsxA.exe
  2⤵
  PID:10072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BUJFZdW.exe

Filesize
1.9MB

MD5
d729b7f179f47cae730f7dcf9b228eb0

SHA1
e72c4bce8ce6281abff8c0bec112340aa4554b7e

SHA256
3fc02212beeb16da5f63f3ed4cbae3140bacb29ef050ba2b9b2e8fcd563f7249

SHA512
1f5b01b231f8e6fb702377b43d637b59557cfbdff71842312f5f896a2e5174d8132422356b92de615eb2503873f60f4f66cae86cc7bc8deb472318cd10c06335

Download Submit
C:\Windows\system\BtTEdFP.exe

Filesize
1.9MB

MD5
f8f0a4c8efe62c8c02fb16c6680a857f

SHA1
1018e05461f3b19c9d1bc43e053521266ac3e2fc

SHA256
4ee33d92cc91ad2f47b2d3c750bb5e7b773f876678d50b30f1da6e7bc457f000

SHA512
af039f791a126c5d72a58d162d732e672c4ba80a42eb4a9dca74bdcf1adf778474f20266fe5875d7e355d112372898e3ca72e711a82dba4db895b30c45547ef1

Download Submit
C:\Windows\system\CKMfFbr.exe

Filesize
1.9MB

MD5
0931d3b129e4687347783d2bfec22fa3

SHA1
c003289c834a1c2c8acb7d2081396405b1f1dbad

SHA256
ba47c5148a54eb57a86b3f6e7335f36617f2af42f2a435c323f7f9e9a5fb0b0f

SHA512
cdcbbf73c0d308660e64028e23f84f0a9cacd2309a16dbe51935b9ad7663e948e77e47d769565894f77bf3c06e8aaf384f2aeacd5c3c9142b389ee1cec0cd9fa

Download Submit
C:\Windows\system\EfcHTjc.exe

Filesize
1.9MB

MD5
60b43c9e0c80fec75d00373653221ec6

SHA1
fe783a9c1875b89c8ade670c2f31ea58f5b9d22c

SHA256
cd681d0c82fdd16cf6fb9397e89621c98de58851cd41ad9953723ed13d2ee7af

SHA512
f71181b245ad701ba6fc7a1b0a8cf6f498fba6bbf54a4acc31e9928b287a9c2d323565a47afb6060d9eb37c6da84d04a792286a1bac3fcf2349f680ffacf9665

Download Submit
C:\Windows\system\FKgZIqL.exe

Filesize
1.9MB

MD5
6942ca99634532b7d2cef8e1a8904d68

SHA1
ea42484318c8fd80351e92e17e40de96ffe71014

SHA256
4d33656ed9f0279b8c87e89eeffa2b1c33c67d4b08fae85ec8bd693fc56007d5

SHA512
20d65e71a9e81f1ff803b4e5d0980bbc9812eeb9cf36a2ebd8a400973a71a7c9655871c06d41b3482524be3d6c6bfbbc1d6538d12b9506724f5654ccf0ec5dee

Download Submit
C:\Windows\system\GnClAZY.exe

Filesize
1.9MB

MD5
7daa9d498dbc6c71e79994414ee582c5

SHA1
198ac37f98297f3b2f24c8f61f05b83daa39b8ac

SHA256
bd93ac59437ff06fc429764b331f4de7949fb4df4991b7ec79ab726d719caf5e

SHA512
e3a868e0a28d5e6bc0091526cd92c85a157d4730c6ee8297f47b4b8e71ccaf20e7f0314b87efbd01f35e46b86a962398cc6d93fff4c7fc02d8794c84438fd3f1

Download Submit
C:\Windows\system\HVUpbyc.exe

Filesize
1.9MB

MD5
7b3a8115ac7908144525afd3743a697d

SHA1
9694de028aa88a705826b2ab979cd63f0d376d95

SHA256
d8dd0da00d592d240cf4f81d3d636e5c11b027419dfbe1d974f9906130f4ca25

SHA512
97c7e6028c294400a5c9e3d467a44de9c0b068eeb58e2d1cde753d866e6fa76754cd7d9123ad88bc2fe1fdeb0298b40ce6e5625f40df27701c48827dca710ca1

Download Submit
C:\Windows\system\KUJMHIe.exe

Filesize
1.9MB

MD5
aceaa4e23a5017309c812151e67fb53e

SHA1
68c697eecbb9645012916525cb0c2d2dd4d7e369

SHA256
4a6500cdce435449a5ba9d4529f5e95a95192b878e745f5821b58c28b550768c

SHA512
b8fb7a7b633a2e91b0b11db2b119a158911b676655c16b0a4289af9a4d366de5dfb9894045887ffe45aef2b933edcb27fdf7737abaaa04b86c40ac2ab29babaf

Download Submit
C:\Windows\system\MyFLmEA.exe

Filesize
1.9MB

MD5
dc801d2e69765f56bcd8a8d7b0bd8a1e

SHA1
dd5d50ab08633d4a6ecb7a65a8c7f95014d27d86

SHA256
bec9770577d7f50fa7f101ccf7883cc9aecf0ba13822284adc8d7976d49cf3a2

SHA512
904f2bbd28f65c299e1c3f0a936a5bd983a47e4b2ad2bbe9ac50c211c70b173fcdaf3ade6a8b903af0f02b24d864d49cb13a85834b6edd7272f79ff6ce2b79df

Download Submit
C:\Windows\system\NoIjrWV.exe

Filesize
1.9MB

MD5
d1c8e998c1973e48698ecebd55813c62

SHA1
bf459ccfa14902170be5ec10ba1941853f340d29

SHA256
8d113564222f689c1b0c5a41f4bdfaf43b6df3f92726b6f43b76f13cd5df3efc

SHA512
95e81c3e88299639679088f220dd7b999d0e4e975255c29359c62b7bf3f31d94fbb3d94670589c4778f93ac1e32dca04c794396be54df8c3438579e59b7508a4

Download Submit
C:\Windows\system\RGEcGzu.exe

Filesize
1.9MB

MD5
fc22a64fe3994be678e9670a10e887ca

SHA1
479f2e6897588bd586188126e717ee15473d0f92

SHA256
c969d337377bd2ebb9fe8d74598049acb616e22239b8fdcc21be23d2752048e2

SHA512
5327d4da61067634aec9178aa98b96793f62e4df9552e69381d36cc83131898a6cf0a28471d1daf405c5a239c69de26b8d8ebd1c6527b6e61e03776c0326a01a

Download Submit
C:\Windows\system\RJlpJpo.exe

Filesize
1.9MB

MD5
1344ecd5dba6032e1b267d09ec0f1e3f

SHA1
5e1a618ffced573207e8715fe38f90f4c29d8b26

SHA256
757e7651152c7964a5b30a39f23a13527006b42f63d6396f964044de01fad303

SHA512
dfc7ae912be75dfd126668b166554b6288731817ce03841abc30fa55b4a6c2e51da449a9e78a0d010e31fd16a41d633b6336520cd3f30039c540e49286910fa9

Download Submit
C:\Windows\system\TGIytMr.exe

Filesize
1.9MB

MD5
919f6f3dc889f63f56a68cb104a21f63

SHA1
b0b29dbeb0a317049d166612db903f8cdf7681b8

SHA256
d2e18f0f0db9ec3257e0d4db29ff5b23afd5898e4ea97b75b7c2cf719abe6650

SHA512
f46ea648484b759f40bd5663c42952fffffd0d1385a2517b31b9681fe8db71a9a2d624054a126a2fc1835f4b1671bcb0d124d173b21165a22f73d4a67f970333

Download Submit
C:\Windows\system\THekDDH.exe

Filesize
1.9MB

MD5
6bc53785a8ef01f95d1f50b45d368d08

SHA1
fc83ff326ba5e6b972f3acfea9e4ac77ef59a273

SHA256
bda61feeeca6cefe6e0766b74baf56fad2955432ee4cb65256a1ed6f7e28f5cf

SHA512
09bc27d7bcc9fb6a1e9ad957b746cfacddeaaf6717e6261bb88b733020159543a193aec061c9a147b208e73bfc3e5464248e2091591f1e1e5498e30780a3e4a0

Download Submit
C:\Windows\system\UudlzTP.exe

Filesize
1.9MB

MD5
d7090f105821d3b0550c3a1e64be80fa

SHA1
b8625f157108e03b9e8aff1c2821add6a881533c

SHA256
56b04004b1ae288e5e3cffd7fead319144ff80935f8ba27174421c3590561339

SHA512
c4f8b9b9baaadb9c3f45bdb49e091ee72c50b30cb7047160e466d7d05751ae3a118cb0e56eaae709d7c3b7559092c33cbf5740dd66470c7a3926986ef4b7520f

Download Submit
C:\Windows\system\VrYHIrf.exe

Filesize
1.9MB

MD5
5fe03d45fbf4ba3858d25c12cb889ac4

SHA1
81fb59314d71bde3284b4f5e750de63fc4f958a7

SHA256
26887d9e1a5b9da7c7deafeaba31755a3fa8375dd562cdd2627ebab32bd662f1

SHA512
23e206156c745ebe9579c6a4b5f1190bf606111cc58ccf8182573a8ddd9fbbd59de2ad5b2b4ef70c4b3bcc4d143bdbadeda6bb4d2d68b32483b0b5734094774f

Download Submit
C:\Windows\system\XTtRxLD.exe

Filesize
1.9MB

MD5
7cdb275fd7bfa50cf5df844020a4a3f7

SHA1
db7fe1cc017e597c55b27d042ec530fc0f1a0da3

SHA256
975137a624082c8ad4e05376894a4d9035985b7b4aeb1b3310dd021ee6bcc531

SHA512
dee8a4327a2171b7785b903a41aa091d1cb6be8c2ff5258bbe01de5fc4acf2ec2bc537cd6f1854b529592783a798369fde4c6fa2a0c347abf07b9db1c0776662

Download Submit
C:\Windows\system\YlBkeGo.exe

Filesize
1.9MB

MD5
7c375da12bb81cd9768345ae0533d334

SHA1
7edd5476efc2506e18d5e1847f9284dacf4b3309

SHA256
6d1c22dc339cdc7f2300592d7b62dbb415c4121936e26d66c20cd829cd50c631

SHA512
9c1b82b3af7e0f2e609fe965403f2f0305b345a61b9c0546f02530716768166739af732959362f3d59836e51077d847b4bf92f2990d8ec45adfbbe673b730caa

Download Submit
C:\Windows\system\bzunZEB.exe

Filesize
1.9MB

MD5
0bdb0bc864973599fecbe2444b7812e8

SHA1
927fdaa209947dbba9936af4aab64dbbc7182e53

SHA256
af911665476317cc8fca659857f742224d42779639f72ac6654c262d34232c56

SHA512
9b01be6a77d7760fa3e172d4723e0e349ebcf3b5d22c249a5f42a9158e398c302fb28c3ad7f56f0f8cf5cf5f0cec37548d78c53ac398977df296399f256fcc80

Download Submit
C:\Windows\system\cMvvPFm.exe

Filesize
1.9MB

MD5
d5686891f2610849c94f8c2643c94d8e

SHA1
6e0a1176b646292f3a61e065e31266ddc5fb54e0

SHA256
449ef26e1e190ccc686c535daf2a6cf0c63595580223bd55b66062bb8fdfa6d2

SHA512
a9012faaa986880e6af66fcf7942f54b6350c84aff78398d41754c4fbc7369439381ead1704dce9a17a632fc5f38fa1da5b767b98df288708356f57e9e5e3637

Download Submit
C:\Windows\system\fuxsacS.exe

Filesize
1.9MB

MD5
174e19ae8be4cec86d146ea146abcade

SHA1
e15248cf38f77c8f4ccc6362fc5894d491453f5c

SHA256
e093e167ef27d75e3dfb2e5ee600a816f55cd0769794f48658df723f93cbff35

SHA512
ed194b20fd4cd9272b90cc624b6f2f6bbce84f3a1d95d24bbd49b1a2aa38279ddda60d39f102ed7ddb53d2dbbe00f68a3700440ac5f3a9cc7a26003bd3a7835c

Download Submit
C:\Windows\system\ppdMCOg.exe

Filesize
1.9MB

MD5
0e885dfcb3c4f1be0bb36093906ab0e4

SHA1
305fe96623bcefd8712e621a1875ea07de0e858e

SHA256
0b821055d5b6b5e5840ced1d513a5b27e47dda7691c324f5d8712644349b9f49

SHA512
3ace7a096ca52219f589422565b99a74ac9d435382c5a8b1fdf1d2b883f22ee9016cd18c26eacc5e33dbffc9a5e88cf7939ae5b5ddfdd5737b62127d075b75a7

Download Submit
C:\Windows\system\ralhMYP.exe

Filesize
1.9MB

MD5
5e1e77f0213eeb886f94ece6a3776fe8

SHA1
9b0de9c66780683757275748d4a93c5cddc1eab2

SHA256
14194afe611de57040fb08b2e0b4b1f6527ac4544a19e671315d7cf4be82d14f

SHA512
1d317ccdb30f6724235e8c06225ffb7edba2e9d38d3d928cff52a273f56a28289645d8c121004a3840c708520691721f336acb32ba7497338f7fddaf0efbfb6f

Download Submit
C:\Windows\system\sUrQZWR.exe

Filesize
1.9MB

MD5
a889dcdd546e2b1e4e744d058b6436a8

SHA1
da2b67a62254e2f8ed06bc06e614d1c23e9c7f1c

SHA256
eee29c6089bf10ee2d14a66a40fbf266edbe3a8d6e4d7195e13959dfcb3c1fc4

SHA512
0237bd0768bc6e15e919093faa0210cab777038197370c720d7670871a1fb421f6b72a6efacdd4533098633330429ab745f3f264223b65c4c3e2533d75939062

Download Submit
C:\Windows\system\uwpDsni.exe

Filesize
1.9MB

MD5
c0fd1d1db1bb3063274b65e42cbd81f4

SHA1
8a7d47a1eb728b0dbc0841f4e122b39bd42d6953

SHA256
a715ceb69b83df7f3b949713781b86c6cda26df765ed117d53c86336d50fc7e6

SHA512
7e255f30e6618a894d3b2799d12ec2b868f290f9c53ae298b5aa600d94eb0f139bac6be6f8b6e532c4e3a8f3451a2e6242c60698a876e45a655c076f1d2d10b3

Download Submit
C:\Windows\system\wIAaewL.exe

Filesize
1.9MB

MD5
bba967471d180144b197cf2220226ea2

SHA1
6ade6dc168881a62174c79fca1e12d21829102da

SHA256
7c3da92e4939352a3d5baad34d0231b40772627e223e9adf6c4066894482b773

SHA512
d2a600089f6b906ef72c6ebae83644b2d4e69fd3e1ec73fd5a9b034d99f03b006b5a92f4149f6d7c50e1ec552bc7d135cf06cea6d2f3559204d3ba38f3daa067

Download Submit
C:\Windows\system\wwLlApZ.exe

Filesize
1.9MB

MD5
2731e56679f761149205c59935d28a04

SHA1
6c5491cc9f0966ef78072b9489f5b2210dcaf966

SHA256
3b68e796a45e3a527fef66459be550332fa06a27598fa6d2d5506c97fc333dcc

SHA512
fba5a383c2f239016e1cc28adc75fdb7fbbb023e9d569b1e08051754ced16fbbfee05a465282a8bcb6e5a234048b04c562d9b928a5f9e270f8fc3585b9a1c170

Download Submit
C:\Windows\system\zTkBfSf.exe

Filesize
1.9MB

MD5
d527df95ec10c6d95aea12d48300fc13

SHA1
ed03f067e45da936a0ca28cc9c92372f24465995

SHA256
b3b2807dd6b56e7d15ae04a7542d06a5346d86bb35e1f293428cbc7b670f61b9

SHA512
8d5b2f43daa369956c08ad6cf9c7b53027986238a2125cffd8c68e879501c7b38486b98c9f0612c869c4b58d78d151d0d8d70d374ae2de45e82487dbc584cfef

Download Submit
\Windows\system\BUUPREZ.exe

Filesize
1.9MB

MD5
277b352cff204a3ada0d5adb1d6f40d8

SHA1
f2a62b3ef3f06dd13111de2e7d405feb5a3e2503

SHA256
574696dd6d3486adf5000571f160b39dca1687ed58ab4eb371d7bb391a073138

SHA512
06922cb42a8abb624cf7253632014018ad509555b5ab4241a8907ced28346ed8fe83deee37bd20193d5ad6832acc6c9cc8ad692a2fdf97259f4cb7bf645baa02

Download Submit
\Windows\system\PPHwJZh.exe

Filesize
1.9MB

MD5
4552e2762725468d7596c5aad58275fb

SHA1
99249df09876767ed21ec15f08d426c2e3ff127e

SHA256
c3013f0c33a3e3cb3e53ab8c0381d1066cfbde77edff28a9080d3cff2d288cca

SHA512
d53538323c9a4b25ec2ed290e1a6d5ca86bc93d0464f315a19c06fc0360cd92dbff34c83fe8f75cd91217c3abbcc08db42c54f6f744812b11975a76e12b22f65

Download Submit
\Windows\system\VNcaRsh.exe

Filesize
1.9MB

MD5
77c7f2e939391d0f9bfdc18b228e6f69

SHA1
93fa5af2c716c3e2f2f305224fd696cfff2a8d26

SHA256
bfdecc8fd130cea39e99f6729001c871894a2b6ccb9cbf93e5290df81c20eab1

SHA512
aea45fa8b0dab297a597154b9453ed67fcedcf39a2f967525366446788741e8d7ea4b55473cdb6b6ef52b71fb2e6311b38256a5a44ce119a05f6dc3c701111f7

Download Submit
\Windows\system\wExqaHR.exe

Filesize
1.9MB

MD5
fda82c52f44ccdcd5fbf958554b88bdf

SHA1
8814b94f208bff6ffe298de61ce2ca8de893b2c9

SHA256
6da24ed8499cb8750d19a00151d2a1d42a1fee419838f08cbc40dfda44ff5659

SHA512
a9bb592efbb367e658dda07ccee85b28c4cedc76962823af63b02ed735bb95536cb58a82247a0c41f0568b202b36e5d164c4b5738d4d5a63813ff8fa6fbef8be

Download Submit
memory/1652-2841-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-123-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2839-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2840-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-119-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2739-0x000000013F840000-0x000000013FB94000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2729-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2581-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2842-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2579-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-80-0x000000013F840000-0x000000013FB94000-memory.dmp

Filesize
3.3MB

Download
memory/1652-127-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/1652-129-0x000000013FEA0000-0x00000001401F4000-memory.dmp

Filesize
3.3MB

Download
memory/1652-13-0x000000013FD10000-0x0000000140064000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2461-0x000000013F3B0000-0x000000013F704000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2467-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-97-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-58-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-50-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/1652-0-0x000000013F3B0000-0x000000013F704000-memory.dmp

Filesize
3.3MB

Download
memory/1652-89-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-85-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/1652-109-0x0000000001EC0000-0x0000000002214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-62-0x000000013FEC0000-0x0000000140214000-memory.dmp

Filesize
3.3MB

Download
memory/1652-54-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/1652-46-0x000000013FBC0000-0x000000013FF14000-memory.dmp

Filesize
3.3MB

Download
memory/1652-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2024-27-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2024-2580-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2024-4012-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2172-113-0x000000013FD10000-0x0000000140064000-memory.dmp

Filesize
3.3MB

Download
memory/2172-4016-0x000000013FD10000-0x0000000140064000-memory.dmp

Filesize
3.3MB

Download
memory/2444-4019-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/2444-125-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/2468-4018-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/2468-124-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/2540-4014-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/2540-115-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/2556-130-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/2556-4015-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/2604-118-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/2604-4017-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/2656-4021-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/2656-117-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/2716-121-0x000000013F840000-0x000000013FB94000-memory.dmp

Filesize
3.3MB

Download
memory/2716-4020-0x000000013F840000-0x000000013FB94000-memory.dmp

Filesize
3.3MB

Download
memory/2732-4013-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2732-41-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download