xmrig | b35bda3dc512c8bdf31d82b2de633a4f67eb559f1f95a8bf82824081e9dacc6a

Analysis

max time kernel
134s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
Size

2.3MB
MD5

07c6ac412d0a8a9c048def5959b06b70
SHA1

2c8a995f1b64e3276aadfd7a56ac23532858b83d
SHA256

b35bda3dc512c8bdf31d82b2de633a4f67eb559f1f95a8bf82824081e9dacc6a
SHA512

c7dbffad1341491d256e365a4552435c00b2cf59d3887613069318649c411e62ec7ece833501aeed97257a91888aad5e855d559e12c39731e8f9d56b87f2ea36
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87Xx1gOqHs:BemTLkNdfE0pZrc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2876-0-0x000000013FE30000-0x0000000140184000-memory.dmp	xmrig
behavioral1/files/0x000e000000015a98-3.dat	xmrig
behavioral1/files/0x0008000000015c87-13.dat	xmrig
behavioral1/memory/2876-7-0x000000013F540000-0x000000013F894000-memory.dmp	xmrig
behavioral1/memory/3036-12-0x000000013F540000-0x000000013F894000-memory.dmp	xmrig
behavioral1/files/0x0007000000015db4-25.dat	xmrig
behavioral1/files/0x00080000000167db-47.dat	xmrig
behavioral1/files/0x0006000000018b37-75.dat	xmrig
behavioral1/files/0x0006000000018b4a-89.dat	xmrig
behavioral1/files/0x0005000000019410-156.dat	xmrig
behavioral1/files/0x0005000000019473-168.dat	xmrig
behavioral1/files/0x000500000001946f-164.dat	xmrig
behavioral1/files/0x000500000001946b-160.dat	xmrig
behavioral1/files/0x00050000000193b0-152.dat	xmrig
behavioral1/files/0x000500000001939b-148.dat	xmrig
behavioral1/files/0x0005000000019377-145.dat	xmrig
behavioral1/files/0x0005000000019333-144.dat	xmrig
behavioral1/files/0x00050000000192f4-143.dat	xmrig
behavioral1/files/0x0006000000018d06-142.dat	xmrig
behavioral1/files/0x0006000000018b96-141.dat	xmrig
behavioral1/files/0x0006000000018b6a-140.dat	xmrig
behavioral1/files/0x0006000000018b42-139.dat	xmrig
behavioral1/files/0x0006000000018b33-138.dat	xmrig
behavioral1/files/0x0006000000018ae8-136.dat	xmrig
behavioral1/memory/2876-127-0x000000013F780000-0x000000013FAD4000-memory.dmp	xmrig
behavioral1/files/0x00050000000192c9-116.dat	xmrig
behavioral1/memory/2800-110-0x000000013F110000-0x000000013F464000-memory.dmp	xmrig
behavioral1/memory/2876-101-0x000000013F1F0000-0x000000013F544000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b73-100.dat	xmrig
behavioral1/memory/2876-93-0x000000013FE30000-0x0000000140184000-memory.dmp	xmrig
behavioral1/memory/2876-74-0x0000000001E90000-0x00000000021E4000-memory.dmp	xmrig
behavioral1/files/0x0010000000015c5d-62.dat	xmrig
behavioral1/memory/3036-133-0x000000013F540000-0x000000013F894000-memory.dmp	xmrig
behavioral1/files/0x0005000000019368-132.dat	xmrig
behavioral1/memory/1468-123-0x000000013FBD0000-0x000000013FF24000-memory.dmp	xmrig
behavioral1/files/0x000500000001931b-122.dat	xmrig
behavioral1/files/0x0006000000018ba2-106.dat	xmrig
behavioral1/memory/2448-87-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/memory/2396-70-0x000000013F180000-0x000000013F4D4000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b15-69.dat	xmrig
behavioral1/memory/2428-68-0x000000013FA60000-0x000000013FDB4000-memory.dmp	xmrig
behavioral1/files/0x0006000000018ae2-57.dat	xmrig
behavioral1/memory/2548-53-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig
behavioral1/memory/2532-43-0x000000013F6B0000-0x000000013FA04000-memory.dmp	xmrig
behavioral1/memory/2524-42-0x000000013F5B0000-0x000000013F904000-memory.dmp	xmrig
behavioral1/files/0x0007000000015cb9-38.dat	xmrig
behavioral1/memory/2644-37-0x000000013F7C0000-0x000000013FB14000-memory.dmp	xmrig
behavioral1/memory/2480-36-0x000000013F8E0000-0x000000013FC34000-memory.dmp	xmrig
behavioral1/memory/2876-35-0x000000013F8E0000-0x000000013FC34000-memory.dmp	xmrig
behavioral1/memory/2880-34-0x000000013F4B0000-0x000000013F804000-memory.dmp	xmrig
behavioral1/files/0x0007000000015d88-28.dat	xmrig
behavioral1/files/0x0029000000015c52-27.dat	xmrig
behavioral1/memory/2800-3246-0x000000013F110000-0x000000013F464000-memory.dmp	xmrig
behavioral1/memory/2548-3247-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig
behavioral1/memory/2448-3249-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/memory/2480-3255-0x000000013F8E0000-0x000000013FC34000-memory.dmp	xmrig
behavioral1/memory/2644-3257-0x000000013F7C0000-0x000000013FB14000-memory.dmp	xmrig
behavioral1/memory/3036-3256-0x000000013F540000-0x000000013F894000-memory.dmp	xmrig
behavioral1/memory/2532-3274-0x000000013F6B0000-0x000000013FA04000-memory.dmp	xmrig
behavioral1/memory/2880-3275-0x000000013F4B0000-0x000000013F804000-memory.dmp	xmrig
behavioral1/memory/2396-3276-0x000000013F180000-0x000000013F4D4000-memory.dmp	xmrig
behavioral1/memory/2524-3273-0x000000013F5B0000-0x000000013F904000-memory.dmp	xmrig
behavioral1/memory/2428-3272-0x000000013FA60000-0x000000013FDB4000-memory.dmp	xmrig
behavioral1/memory/1468-3271-0x000000013FBD0000-0x000000013FF24000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3036	CsLlxVH.exe
2480	EElgYYx.exe
2880	vmqTJQb.exe
2644	IdICtfd.exe
2524	QoOPXBQ.exe
2532	NnFOtbc.exe
2548	Slowqvc.exe
2428	kUlHCIO.exe
2396	qLDssQI.exe
2448	FtqDGGq.exe
2800	wWsbFNp.exe
1468	XyQzIVa.exe
1364	CGOutuc.exe
2632	bOuGxMH.exe
2280	aUDxHel.exe
1800	UtRujLG.exe
752	MYggBuE.exe
2384	RSHTHHt.exe
2788	wXgIzSb.exe
1484	pTQqoDf.exe
940	oQzjtGQ.exe
1200	bwPkGiY.exe
2636	hUJWOHN.exe
2136	imLMjJp.exe
2300	wqvfKzG.exe
1952	IdEHlrA.exe
2016	VxRFXXK.exe
2260	HXHDjKL.exe
2552	lDAjlpJ.exe
2732	sBrWIHE.exe
2116	cQjHIbq.exe
268	jlVyguQ.exe
2916	sIWhWkF.exe
1060	nXQOhFq.exe
1720	GtxcWmI.exe
3052	veAbJLs.exe
432	gZzgaXD.exe
1140	dbuORjo.exe
1672	YoYzgRI.exe
2092	ioeFtpY.exe
1660	GiPoGdk.exe
1008	RYcAksC.exe
1612	SrfEiwJ.exe
1712	AKldsrs.exe
1868	ioZoEWg.exe
2104	fJtfibr.exe
1080	FdMinXH.exe
272	EGlPOYo.exe
892	MoIRVgZ.exe
2908	rAjaLKv.exe
1316	GXJyJuf.exe
2336	JHkJdqL.exe
1212	MvGCmcx.exe
2084	SqIBoEy.exe
2216	IIEHIlG.exe
2728	uUeJORk.exe
2856	EKkOguq.exe
2536	RZIRclO.exe
2716	zdAroKS.exe
1168	lnfrhyt.exe
2680	WLvrXYk.exe
2400	yqFPNAR.exe
1648	kHmZdfg.exe
2316	kkiOxtz.exe

Loads dropped DLL 64 IoCs

pid	Process
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2876-0-0x000000013FE30000-0x0000000140184000-memory.dmp	upx
behavioral1/files/0x000e000000015a98-3.dat	upx
behavioral1/files/0x0008000000015c87-13.dat	upx
behavioral1/memory/2876-7-0x000000013F540000-0x000000013F894000-memory.dmp	upx
behavioral1/memory/3036-12-0x000000013F540000-0x000000013F894000-memory.dmp	upx
behavioral1/files/0x0007000000015db4-25.dat	upx
behavioral1/files/0x00080000000167db-47.dat	upx
behavioral1/files/0x0006000000018b37-75.dat	upx
behavioral1/files/0x0006000000018b4a-89.dat	upx
behavioral1/files/0x0005000000019410-156.dat	upx
behavioral1/files/0x0005000000019473-168.dat	upx
behavioral1/files/0x000500000001946f-164.dat	upx
behavioral1/files/0x000500000001946b-160.dat	upx
behavioral1/files/0x00050000000193b0-152.dat	upx
behavioral1/files/0x000500000001939b-148.dat	upx
behavioral1/files/0x0005000000019377-145.dat	upx
behavioral1/files/0x0005000000019333-144.dat	upx
behavioral1/files/0x00050000000192f4-143.dat	upx
behavioral1/files/0x0006000000018d06-142.dat	upx
behavioral1/files/0x0006000000018b96-141.dat	upx
behavioral1/files/0x0006000000018b6a-140.dat	upx
behavioral1/files/0x0006000000018b42-139.dat	upx
behavioral1/files/0x0006000000018b33-138.dat	upx
behavioral1/files/0x0006000000018ae8-136.dat	upx
behavioral1/files/0x00050000000192c9-116.dat	upx
behavioral1/memory/2800-110-0x000000013F110000-0x000000013F464000-memory.dmp	upx
behavioral1/files/0x0006000000018b73-100.dat	upx
behavioral1/memory/2876-93-0x000000013FE30000-0x0000000140184000-memory.dmp	upx
behavioral1/files/0x0010000000015c5d-62.dat	upx
behavioral1/memory/3036-133-0x000000013F540000-0x000000013F894000-memory.dmp	upx
behavioral1/files/0x0005000000019368-132.dat	upx
behavioral1/memory/1468-123-0x000000013FBD0000-0x000000013FF24000-memory.dmp	upx
behavioral1/files/0x000500000001931b-122.dat	upx
behavioral1/files/0x0006000000018ba2-106.dat	upx
behavioral1/memory/2448-87-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/memory/2396-70-0x000000013F180000-0x000000013F4D4000-memory.dmp	upx
behavioral1/files/0x0006000000018b15-69.dat	upx
behavioral1/memory/2428-68-0x000000013FA60000-0x000000013FDB4000-memory.dmp	upx
behavioral1/files/0x0006000000018ae2-57.dat	upx
behavioral1/memory/2548-53-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	upx
behavioral1/memory/2532-43-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/memory/2524-42-0x000000013F5B0000-0x000000013F904000-memory.dmp	upx
behavioral1/files/0x0007000000015cb9-38.dat	upx
behavioral1/memory/2644-37-0x000000013F7C0000-0x000000013FB14000-memory.dmp	upx
behavioral1/memory/2480-36-0x000000013F8E0000-0x000000013FC34000-memory.dmp	upx
behavioral1/memory/2880-34-0x000000013F4B0000-0x000000013F804000-memory.dmp	upx
behavioral1/files/0x0007000000015d88-28.dat	upx
behavioral1/files/0x0029000000015c52-27.dat	upx
behavioral1/memory/2800-3246-0x000000013F110000-0x000000013F464000-memory.dmp	upx
behavioral1/memory/2548-3247-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	upx
behavioral1/memory/2448-3249-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/memory/2480-3255-0x000000013F8E0000-0x000000013FC34000-memory.dmp	upx
behavioral1/memory/2644-3257-0x000000013F7C0000-0x000000013FB14000-memory.dmp	upx
behavioral1/memory/3036-3256-0x000000013F540000-0x000000013F894000-memory.dmp	upx
behavioral1/memory/2532-3274-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/memory/2880-3275-0x000000013F4B0000-0x000000013F804000-memory.dmp	upx
behavioral1/memory/2396-3276-0x000000013F180000-0x000000013F4D4000-memory.dmp	upx
behavioral1/memory/2524-3273-0x000000013F5B0000-0x000000013F904000-memory.dmp	upx
behavioral1/memory/2428-3272-0x000000013FA60000-0x000000013FDB4000-memory.dmp	upx
behavioral1/memory/1468-3271-0x000000013FBD0000-0x000000013FF24000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uCKGNzz.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\LobMbFJ.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\cXfxKoy.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\xGUtdey.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\NHRmdyw.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\odBpGdz.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\WRwpuPe.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\goAaIWT.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\cShSBWj.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\pnMXjvu.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\zJLAWPM.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\fmqIGnP.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\sBrWIHE.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\wdChojE.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\qFPJhaG.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\xQxmZGj.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\JZPYUbT.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\etGsEly.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\iZTvcOl.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\RzuhoPg.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\NfWaYrL.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\kFgtXgK.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\vhERcKd.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\BMQqFcB.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\pKwJfKf.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\yQRlsdp.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\TkPTqLB.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\XsKPcnS.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\PipbWbv.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\tFgMvkW.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\XeTxhtI.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\fxQmJoO.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\vvmoxPV.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\xWXMFTc.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\sHZOCcj.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\stCYNFr.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\mLKqeFJ.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\QpBUcaP.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\SudpycK.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\ccZmddw.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\DjBAkVY.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\cyOhzGB.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\lrSkMEx.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\FESRwXH.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\JeZbXhN.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\RPzyydM.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\gVWbGbd.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\cQjHIbq.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\AXnLItK.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\ffopVoI.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\CaMEQkl.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\nmvtyHA.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\ocwEUEx.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\eJOYPet.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\PMJDhZD.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\GUAPnIn.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\yaEINVL.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\zLoeWSu.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\puLJvZG.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\reVkXux.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\rulMYjJ.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\LHzOBmg.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\SugHvok.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
File created	C:\Windows\System\TBBEYbj.exe	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3036	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	29
PID 2876 wrote to memory of 3036	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	29
PID 2876 wrote to memory of 3036	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	29
PID 2876 wrote to memory of 2880	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	30
PID 2876 wrote to memory of 2880	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	30
PID 2876 wrote to memory of 2880	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	30
PID 2876 wrote to memory of 2480	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	31
PID 2876 wrote to memory of 2480	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	31
PID 2876 wrote to memory of 2480	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	31
PID 2876 wrote to memory of 2524	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	32
PID 2876 wrote to memory of 2524	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	32
PID 2876 wrote to memory of 2524	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	32
PID 2876 wrote to memory of 2644	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	33
PID 2876 wrote to memory of 2644	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	33
PID 2876 wrote to memory of 2644	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	33
PID 2876 wrote to memory of 2532	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	34
PID 2876 wrote to memory of 2532	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	34
PID 2876 wrote to memory of 2532	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	34
PID 2876 wrote to memory of 2548	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	35
PID 2876 wrote to memory of 2548	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	35
PID 2876 wrote to memory of 2548	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	35
PID 2876 wrote to memory of 2396	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	36
PID 2876 wrote to memory of 2396	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	36
PID 2876 wrote to memory of 2396	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	36
PID 2876 wrote to memory of 2428	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	37
PID 2876 wrote to memory of 2428	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	37
PID 2876 wrote to memory of 2428	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	37
PID 2876 wrote to memory of 2384	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	38
PID 2876 wrote to memory of 2384	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	38
PID 2876 wrote to memory of 2384	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	38
PID 2876 wrote to memory of 2448	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	39
PID 2876 wrote to memory of 2448	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	39
PID 2876 wrote to memory of 2448	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	39
PID 2876 wrote to memory of 2788	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	40
PID 2876 wrote to memory of 2788	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	40
PID 2876 wrote to memory of 2788	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	40
PID 2876 wrote to memory of 2800	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	41
PID 2876 wrote to memory of 2800	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	41
PID 2876 wrote to memory of 2800	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	41
PID 2876 wrote to memory of 1484	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	42
PID 2876 wrote to memory of 1484	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	42
PID 2876 wrote to memory of 1484	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	42
PID 2876 wrote to memory of 1468	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	43
PID 2876 wrote to memory of 1468	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	43
PID 2876 wrote to memory of 1468	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	43
PID 2876 wrote to memory of 940	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	44
PID 2876 wrote to memory of 940	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	44
PID 2876 wrote to memory of 940	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	44
PID 2876 wrote to memory of 1364	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	45
PID 2876 wrote to memory of 1364	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	45
PID 2876 wrote to memory of 1364	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	45
PID 2876 wrote to memory of 1200	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	46
PID 2876 wrote to memory of 1200	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	46
PID 2876 wrote to memory of 1200	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	46
PID 2876 wrote to memory of 2632	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	47
PID 2876 wrote to memory of 2632	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	47
PID 2876 wrote to memory of 2632	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	47
PID 2876 wrote to memory of 2636	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	48
PID 2876 wrote to memory of 2636	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	48
PID 2876 wrote to memory of 2636	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	48
PID 2876 wrote to memory of 2280	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	49
PID 2876 wrote to memory of 2280	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	49
PID 2876 wrote to memory of 2280	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	49
PID 2876 wrote to memory of 2136	2876	07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07c6ac412d0a8a9c048def5959b06b70_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System\CsLlxVH.exe
  C:\Windows\System\CsLlxVH.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\vmqTJQb.exe
  C:\Windows\System\vmqTJQb.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\EElgYYx.exe
  C:\Windows\System\EElgYYx.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\QoOPXBQ.exe
  C:\Windows\System\QoOPXBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\IdICtfd.exe
  C:\Windows\System\IdICtfd.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\NnFOtbc.exe
  C:\Windows\System\NnFOtbc.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\Slowqvc.exe
  C:\Windows\System\Slowqvc.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\qLDssQI.exe
  C:\Windows\System\qLDssQI.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\kUlHCIO.exe
  C:\Windows\System\kUlHCIO.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\RSHTHHt.exe
  C:\Windows\System\RSHTHHt.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\FtqDGGq.exe
  C:\Windows\System\FtqDGGq.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\wXgIzSb.exe
  C:\Windows\System\wXgIzSb.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\wWsbFNp.exe
  C:\Windows\System\wWsbFNp.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\pTQqoDf.exe
  C:\Windows\System\pTQqoDf.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\XyQzIVa.exe
  C:\Windows\System\XyQzIVa.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\oQzjtGQ.exe
  C:\Windows\System\oQzjtGQ.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\CGOutuc.exe
  C:\Windows\System\CGOutuc.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\bwPkGiY.exe
  C:\Windows\System\bwPkGiY.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\bOuGxMH.exe
  C:\Windows\System\bOuGxMH.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\hUJWOHN.exe
  C:\Windows\System\hUJWOHN.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\aUDxHel.exe
  C:\Windows\System\aUDxHel.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\imLMjJp.exe
  C:\Windows\System\imLMjJp.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\UtRujLG.exe
  C:\Windows\System\UtRujLG.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\wqvfKzG.exe
  C:\Windows\System\wqvfKzG.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\MYggBuE.exe
  C:\Windows\System\MYggBuE.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\IdEHlrA.exe
  C:\Windows\System\IdEHlrA.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\VxRFXXK.exe
  C:\Windows\System\VxRFXXK.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\HXHDjKL.exe
  C:\Windows\System\HXHDjKL.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\lDAjlpJ.exe
  C:\Windows\System\lDAjlpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\sBrWIHE.exe
  C:\Windows\System\sBrWIHE.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\cQjHIbq.exe
  C:\Windows\System\cQjHIbq.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\jlVyguQ.exe
  C:\Windows\System\jlVyguQ.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\sIWhWkF.exe
  C:\Windows\System\sIWhWkF.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\nXQOhFq.exe
  C:\Windows\System\nXQOhFq.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\GtxcWmI.exe
  C:\Windows\System\GtxcWmI.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\veAbJLs.exe
  C:\Windows\System\veAbJLs.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\gZzgaXD.exe
  C:\Windows\System\gZzgaXD.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\dbuORjo.exe
  C:\Windows\System\dbuORjo.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\YoYzgRI.exe
  C:\Windows\System\YoYzgRI.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\ioeFtpY.exe
  C:\Windows\System\ioeFtpY.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\GiPoGdk.exe
  C:\Windows\System\GiPoGdk.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\RYcAksC.exe
  C:\Windows\System\RYcAksC.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\SrfEiwJ.exe
  C:\Windows\System\SrfEiwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ioZoEWg.exe
  C:\Windows\System\ioZoEWg.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\AKldsrs.exe
  C:\Windows\System\AKldsrs.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\fJtfibr.exe
  C:\Windows\System\fJtfibr.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\FdMinXH.exe
  C:\Windows\System\FdMinXH.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\MoIRVgZ.exe
  C:\Windows\System\MoIRVgZ.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\EGlPOYo.exe
  C:\Windows\System\EGlPOYo.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\rAjaLKv.exe
  C:\Windows\System\rAjaLKv.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\GXJyJuf.exe
  C:\Windows\System\GXJyJuf.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\JHkJdqL.exe
  C:\Windows\System\JHkJdqL.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\MvGCmcx.exe
  C:\Windows\System\MvGCmcx.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\SqIBoEy.exe
  C:\Windows\System\SqIBoEy.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\IIEHIlG.exe
  C:\Windows\System\IIEHIlG.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\EKkOguq.exe
  C:\Windows\System\EKkOguq.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\uUeJORk.exe
  C:\Windows\System\uUeJORk.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\RZIRclO.exe
  C:\Windows\System\RZIRclO.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\zdAroKS.exe
  C:\Windows\System\zdAroKS.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\yqFPNAR.exe
  C:\Windows\System\yqFPNAR.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\lnfrhyt.exe
  C:\Windows\System\lnfrhyt.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\kHmZdfg.exe
  C:\Windows\System\kHmZdfg.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\WLvrXYk.exe
  C:\Windows\System\WLvrXYk.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\kkiOxtz.exe
  C:\Windows\System\kkiOxtz.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\wdChojE.exe
  C:\Windows\System\wdChojE.exe
  2⤵
  PID:1960
- C:\Windows\System\dzyrvhW.exe
  C:\Windows\System\dzyrvhW.exe
  2⤵
  PID:2796
- C:\Windows\System\ZxCSfSl.exe
  C:\Windows\System\ZxCSfSl.exe
  2⤵
  PID:2804
- C:\Windows\System\LumLwQQ.exe
  C:\Windows\System\LumLwQQ.exe
  2⤵
  PID:2312
- C:\Windows\System\dArsIwq.exe
  C:\Windows\System\dArsIwq.exe
  2⤵
  PID:848
- C:\Windows\System\mdnGHfw.exe
  C:\Windows\System\mdnGHfw.exe
  2⤵
  PID:472
- C:\Windows\System\xLcxmJP.exe
  C:\Windows\System\xLcxmJP.exe
  2⤵
  PID:2988
- C:\Windows\System\lOItSZf.exe
  C:\Windows\System\lOItSZf.exe
  2⤵
  PID:3068
- C:\Windows\System\eStPICD.exe
  C:\Windows\System\eStPICD.exe
  2⤵
  PID:1844
- C:\Windows\System\vvmoxPV.exe
  C:\Windows\System\vvmoxPV.exe
  2⤵
  PID:928
- C:\Windows\System\ohzaDXp.exe
  C:\Windows\System\ohzaDXp.exe
  2⤵
  PID:1288
- C:\Windows\System\QFOgSww.exe
  C:\Windows\System\QFOgSww.exe
  2⤵
  PID:1072
- C:\Windows\System\dXLtJEk.exe
  C:\Windows\System\dXLtJEk.exe
  2⤵
  PID:1156
- C:\Windows\System\yJHQeRR.exe
  C:\Windows\System\yJHQeRR.exe
  2⤵
  PID:544
- C:\Windows\System\CXzGlOC.exe
  C:\Windows\System\CXzGlOC.exe
  2⤵
  PID:368
- C:\Windows\System\XJTvrQI.exe
  C:\Windows\System\XJTvrQI.exe
  2⤵
  PID:1616
- C:\Windows\System\iZqmaFL.exe
  C:\Windows\System\iZqmaFL.exe
  2⤵
  PID:2740
- C:\Windows\System\EdpLsSa.exe
  C:\Windows\System\EdpLsSa.exe
  2⤵
  PID:1812
- C:\Windows\System\QyqRlYP.exe
  C:\Windows\System\QyqRlYP.exe
  2⤵
  PID:1304
- C:\Windows\System\kyoRsWo.exe
  C:\Windows\System\kyoRsWo.exe
  2⤵
  PID:2452
- C:\Windows\System\wOHOdOf.exe
  C:\Windows\System\wOHOdOf.exe
  2⤵
  PID:2868
- C:\Windows\System\iuDQENy.exe
  C:\Windows\System\iuDQENy.exe
  2⤵
  PID:1572
- C:\Windows\System\RSrcezM.exe
  C:\Windows\System\RSrcezM.exe
  2⤵
  PID:2704
- C:\Windows\System\BWlfojj.exe
  C:\Windows\System\BWlfojj.exe
  2⤵
  PID:3016
- C:\Windows\System\xJTVrKv.exe
  C:\Windows\System\xJTVrKv.exe
  2⤵
  PID:2484
- C:\Windows\System\uHfMrMQ.exe
  C:\Windows\System\uHfMrMQ.exe
  2⤵
  PID:2904
- C:\Windows\System\DjBAkVY.exe
  C:\Windows\System\DjBAkVY.exe
  2⤵
  PID:2460
- C:\Windows\System\jksYxXK.exe
  C:\Windows\System\jksYxXK.exe
  2⤵
  PID:1052
- C:\Windows\System\JURYJMv.exe
  C:\Windows\System\JURYJMv.exe
  2⤵
  PID:2320
- C:\Windows\System\gegvyfB.exe
  C:\Windows\System\gegvyfB.exe
  2⤵
  PID:1872
- C:\Windows\System\JDvnMFs.exe
  C:\Windows\System\JDvnMFs.exe
  2⤵
  PID:1196
- C:\Windows\System\eJOYPet.exe
  C:\Windows\System\eJOYPet.exe
  2⤵
  PID:1552
- C:\Windows\System\dHNgjCI.exe
  C:\Windows\System\dHNgjCI.exe
  2⤵
  PID:2308
- C:\Windows\System\NLhazfQ.exe
  C:\Windows\System\NLhazfQ.exe
  2⤵
  PID:2204
- C:\Windows\System\SpDGqUe.exe
  C:\Windows\System\SpDGqUe.exe
  2⤵
  PID:2008
- C:\Windows\System\ArQqdRh.exe
  C:\Windows\System\ArQqdRh.exe
  2⤵
  PID:1476
- C:\Windows\System\uhyVDnN.exe
  C:\Windows\System\uhyVDnN.exe
  2⤵
  PID:1724
- C:\Windows\System\podpzqt.exe
  C:\Windows\System\podpzqt.exe
  2⤵
  PID:820
- C:\Windows\System\JPmyUJi.exe
  C:\Windows\System\JPmyUJi.exe
  2⤵
  PID:2192
- C:\Windows\System\IKUWLSd.exe
  C:\Windows\System\IKUWLSd.exe
  2⤵
  PID:2824
- C:\Windows\System\cNZJBZI.exe
  C:\Windows\System\cNZJBZI.exe
  2⤵
  PID:2900
- C:\Windows\System\wCrPVmj.exe
  C:\Windows\System\wCrPVmj.exe
  2⤵
  PID:1620
- C:\Windows\System\OZURVzJ.exe
  C:\Windows\System\OZURVzJ.exe
  2⤵
  PID:1700
- C:\Windows\System\ejKFgmM.exe
  C:\Windows\System\ejKFgmM.exe
  2⤵
  PID:3088
- C:\Windows\System\cDubkDW.exe
  C:\Windows\System\cDubkDW.exe
  2⤵
  PID:3116
- C:\Windows\System\PwOeEHZ.exe
  C:\Windows\System\PwOeEHZ.exe
  2⤵
  PID:3136
- C:\Windows\System\bJEYTLB.exe
  C:\Windows\System\bJEYTLB.exe
  2⤵
  PID:3180
- C:\Windows\System\fmrnhsN.exe
  C:\Windows\System\fmrnhsN.exe
  2⤵
  PID:3196
- C:\Windows\System\iYhnRDs.exe
  C:\Windows\System\iYhnRDs.exe
  2⤵
  PID:3212
- C:\Windows\System\fUiVwnP.exe
  C:\Windows\System\fUiVwnP.exe
  2⤵
  PID:3228
- C:\Windows\System\mSyxhSp.exe
  C:\Windows\System\mSyxhSp.exe
  2⤵
  PID:3244
- C:\Windows\System\SUnqyjI.exe
  C:\Windows\System\SUnqyjI.exe
  2⤵
  PID:3264
- C:\Windows\System\jzdImLc.exe
  C:\Windows\System\jzdImLc.exe
  2⤵
  PID:3284
- C:\Windows\System\glEQgYB.exe
  C:\Windows\System\glEQgYB.exe
  2⤵
  PID:3300
- C:\Windows\System\VeYaHPP.exe
  C:\Windows\System\VeYaHPP.exe
  2⤵
  PID:3320
- C:\Windows\System\MtzaxHt.exe
  C:\Windows\System\MtzaxHt.exe
  2⤵
  PID:3336
- C:\Windows\System\PWrAkKO.exe
  C:\Windows\System\PWrAkKO.exe
  2⤵
  PID:3352
- C:\Windows\System\zdpAsEu.exe
  C:\Windows\System\zdpAsEu.exe
  2⤵
  PID:3368
- C:\Windows\System\WBsNTqE.exe
  C:\Windows\System\WBsNTqE.exe
  2⤵
  PID:3420
- C:\Windows\System\xcMyIGs.exe
  C:\Windows\System\xcMyIGs.exe
  2⤵
  PID:3436
- C:\Windows\System\UYaNMmR.exe
  C:\Windows\System\UYaNMmR.exe
  2⤵
  PID:3452
- C:\Windows\System\fdKGvVB.exe
  C:\Windows\System\fdKGvVB.exe
  2⤵
  PID:3468
- C:\Windows\System\aRMeKZQ.exe
  C:\Windows\System\aRMeKZQ.exe
  2⤵
  PID:3484
- C:\Windows\System\VymyTQU.exe
  C:\Windows\System\VymyTQU.exe
  2⤵
  PID:3500
- C:\Windows\System\OPlrbIs.exe
  C:\Windows\System\OPlrbIs.exe
  2⤵
  PID:3516
- C:\Windows\System\JnZTVzK.exe
  C:\Windows\System\JnZTVzK.exe
  2⤵
  PID:3532
- C:\Windows\System\IUdBqxZ.exe
  C:\Windows\System\IUdBqxZ.exe
  2⤵
  PID:3548
- C:\Windows\System\GBmpbim.exe
  C:\Windows\System\GBmpbim.exe
  2⤵
  PID:3564
- C:\Windows\System\XNhjAvI.exe
  C:\Windows\System\XNhjAvI.exe
  2⤵
  PID:3580
- C:\Windows\System\spbPENS.exe
  C:\Windows\System\spbPENS.exe
  2⤵
  PID:3596
- C:\Windows\System\SGswHnV.exe
  C:\Windows\System\SGswHnV.exe
  2⤵
  PID:3612
- C:\Windows\System\KMTTAbn.exe
  C:\Windows\System\KMTTAbn.exe
  2⤵
  PID:3628
- C:\Windows\System\cCCVkcq.exe
  C:\Windows\System\cCCVkcq.exe
  2⤵
  PID:3644
- C:\Windows\System\nrIZLlT.exe
  C:\Windows\System\nrIZLlT.exe
  2⤵
  PID:3660
- C:\Windows\System\oMQqElU.exe
  C:\Windows\System\oMQqElU.exe
  2⤵
  PID:3676
- C:\Windows\System\UVWBSuA.exe
  C:\Windows\System\UVWBSuA.exe
  2⤵
  PID:3692
- C:\Windows\System\ITdDptZ.exe
  C:\Windows\System\ITdDptZ.exe
  2⤵
  PID:3708
- C:\Windows\System\qFPJhaG.exe
  C:\Windows\System\qFPJhaG.exe
  2⤵
  PID:3724
- C:\Windows\System\WtjHEap.exe
  C:\Windows\System\WtjHEap.exe
  2⤵
  PID:3740
- C:\Windows\System\SJBftfl.exe
  C:\Windows\System\SJBftfl.exe
  2⤵
  PID:3756
- C:\Windows\System\GunZEqM.exe
  C:\Windows\System\GunZEqM.exe
  2⤵
  PID:3772
- C:\Windows\System\SKtKMcv.exe
  C:\Windows\System\SKtKMcv.exe
  2⤵
  PID:3788
- C:\Windows\System\EIVlhBD.exe
  C:\Windows\System\EIVlhBD.exe
  2⤵
  PID:3804
- C:\Windows\System\rJkFrbu.exe
  C:\Windows\System\rJkFrbu.exe
  2⤵
  PID:3820
- C:\Windows\System\gwJmmnn.exe
  C:\Windows\System\gwJmmnn.exe
  2⤵
  PID:3836
- C:\Windows\System\NcIqDkq.exe
  C:\Windows\System\NcIqDkq.exe
  2⤵
  PID:3852
- C:\Windows\System\GJaxiHY.exe
  C:\Windows\System\GJaxiHY.exe
  2⤵
  PID:3868
- C:\Windows\System\klGcUhF.exe
  C:\Windows\System\klGcUhF.exe
  2⤵
  PID:3884
- C:\Windows\System\xQepupN.exe
  C:\Windows\System\xQepupN.exe
  2⤵
  PID:3900
- C:\Windows\System\xhDBddg.exe
  C:\Windows\System\xhDBddg.exe
  2⤵
  PID:3916
- C:\Windows\System\nEwAZDr.exe
  C:\Windows\System\nEwAZDr.exe
  2⤵
  PID:3932
- C:\Windows\System\VPNzdGg.exe
  C:\Windows\System\VPNzdGg.exe
  2⤵
  PID:3948
- C:\Windows\System\iJFFLMC.exe
  C:\Windows\System\iJFFLMC.exe
  2⤵
  PID:3964
- C:\Windows\System\fRCRUSl.exe
  C:\Windows\System\fRCRUSl.exe
  2⤵
  PID:3980
- C:\Windows\System\fUclJNd.exe
  C:\Windows\System\fUclJNd.exe
  2⤵
  PID:3996
- C:\Windows\System\QptSDrD.exe
  C:\Windows\System\QptSDrD.exe
  2⤵
  PID:4012
- C:\Windows\System\Uotleug.exe
  C:\Windows\System\Uotleug.exe
  2⤵
  PID:4032
- C:\Windows\System\fKlCpVm.exe
  C:\Windows\System\fKlCpVm.exe
  2⤵
  PID:4048
- C:\Windows\System\QkgZgwp.exe
  C:\Windows\System\QkgZgwp.exe
  2⤵
  PID:4064
- C:\Windows\System\NMZffjR.exe
  C:\Windows\System\NMZffjR.exe
  2⤵
  PID:4080
- C:\Windows\System\FQTZFgM.exe
  C:\Windows\System\FQTZFgM.exe
  2⤵
  PID:1796
- C:\Windows\System\EqwmqYR.exe
  C:\Windows\System\EqwmqYR.exe
  2⤵
  PID:2208
- C:\Windows\System\LeJyCgT.exe
  C:\Windows\System\LeJyCgT.exe
  2⤵
  PID:868
- C:\Windows\System\PMJDhZD.exe
  C:\Windows\System\PMJDhZD.exe
  2⤵
  PID:524
- C:\Windows\System\WRwpuPe.exe
  C:\Windows\System\WRwpuPe.exe
  2⤵
  PID:1704
- C:\Windows\System\dYkKYOh.exe
  C:\Windows\System\dYkKYOh.exe
  2⤵
  PID:2600
- C:\Windows\System\XuPvIko.exe
  C:\Windows\System\XuPvIko.exe
  2⤵
  PID:2368
- C:\Windows\System\qTMcxCf.exe
  C:\Windows\System\qTMcxCf.exe
  2⤵
  PID:1764
- C:\Windows\System\qyZtUll.exe
  C:\Windows\System\qyZtUll.exe
  2⤵
  PID:2504
- C:\Windows\System\HoocQqB.exe
  C:\Windows\System\HoocQqB.exe
  2⤵
  PID:2648
- C:\Windows\System\MJMolSl.exe
  C:\Windows\System\MJMolSl.exe
  2⤵
  PID:740
- C:\Windows\System\csFBIWD.exe
  C:\Windows\System\csFBIWD.exe
  2⤵
  PID:2996
- C:\Windows\System\YnWFeMr.exe
  C:\Windows\System\YnWFeMr.exe
  2⤵
  PID:2080
- C:\Windows\System\oEHTNdX.exe
  C:\Windows\System\oEHTNdX.exe
  2⤵
  PID:3128
- C:\Windows\System\BYrphwQ.exe
  C:\Windows\System\BYrphwQ.exe
  2⤵
  PID:3220
- C:\Windows\System\OGjCkIX.exe
  C:\Windows\System\OGjCkIX.exe
  2⤵
  PID:3260
- C:\Windows\System\nlLDBWs.exe
  C:\Windows\System\nlLDBWs.exe
  2⤵
  PID:2724
- C:\Windows\System\lKZNGiW.exe
  C:\Windows\System\lKZNGiW.exe
  2⤵
  PID:2700
- C:\Windows\System\thVUcYG.exe
  C:\Windows\System\thVUcYG.exe
  2⤵
  PID:1596
- C:\Windows\System\iciDmNd.exe
  C:\Windows\System\iciDmNd.exe
  2⤵
  PID:1924
- C:\Windows\System\EVklYrz.exe
  C:\Windows\System\EVklYrz.exe
  2⤵
  PID:3108
- C:\Windows\System\ssJHDsv.exe
  C:\Windows\System\ssJHDsv.exe
  2⤵
  PID:3160
- C:\Windows\System\WfeOOvT.exe
  C:\Windows\System\WfeOOvT.exe
  2⤵
  PID:3176
- C:\Windows\System\YkQyxPi.exe
  C:\Windows\System\YkQyxPi.exe
  2⤵
  PID:3236
- C:\Windows\System\gNLevea.exe
  C:\Windows\System\gNLevea.exe
  2⤵
  PID:3280
- C:\Windows\System\yMyuOec.exe
  C:\Windows\System\yMyuOec.exe
  2⤵
  PID:3344
- C:\Windows\System\hAlfGpe.exe
  C:\Windows\System\hAlfGpe.exe
  2⤵
  PID:3380
- C:\Windows\System\zDUmksq.exe
  C:\Windows\System\zDUmksq.exe
  2⤵
  PID:2456
- C:\Windows\System\cPNjNkC.exe
  C:\Windows\System\cPNjNkC.exe
  2⤵
  PID:1632
- C:\Windows\System\PZazqmm.exe
  C:\Windows\System\PZazqmm.exe
  2⤵
  PID:2640
- C:\Windows\System\kPzzVCC.exe
  C:\Windows\System\kPzzVCC.exe
  2⤵
  PID:3432
- C:\Windows\System\lhwNEwL.exe
  C:\Windows\System\lhwNEwL.exe
  2⤵
  PID:3492
- C:\Windows\System\rSuVqDD.exe
  C:\Windows\System\rSuVqDD.exe
  2⤵
  PID:3508
- C:\Windows\System\RJOLOvc.exe
  C:\Windows\System\RJOLOvc.exe
  2⤵
  PID:3560
- C:\Windows\System\MDZatYJ.exe
  C:\Windows\System\MDZatYJ.exe
  2⤵
  PID:3624
- C:\Windows\System\wJNEuWP.exe
  C:\Windows\System\wJNEuWP.exe
  2⤵
  PID:3544
- C:\Windows\System\xCbJBQA.exe
  C:\Windows\System\xCbJBQA.exe
  2⤵
  PID:3608
- C:\Windows\System\VdVzJnd.exe
  C:\Windows\System\VdVzJnd.exe
  2⤵
  PID:3912
- C:\Windows\System\CzHFoJV.exe
  C:\Windows\System\CzHFoJV.exe
  2⤵
  PID:3976
- C:\Windows\System\UNxBkgu.exe
  C:\Windows\System\UNxBkgu.exe
  2⤵
  PID:4044
- C:\Windows\System\tqSJVDO.exe
  C:\Windows\System\tqSJVDO.exe
  2⤵
  PID:1816
- C:\Windows\System\mlfkKTa.exe
  C:\Windows\System\mlfkKTa.exe
  2⤵
  PID:3012
- C:\Windows\System\lNPPdtH.exe
  C:\Windows\System\lNPPdtH.exe
  2⤵
  PID:3124
- C:\Windows\System\IHivyrC.exe
  C:\Windows\System\IHivyrC.exe
  2⤵
  PID:3704
- C:\Windows\System\RwweoTQ.exe
  C:\Windows\System\RwweoTQ.exe
  2⤵
  PID:3768
- C:\Windows\System\axkpRyC.exe
  C:\Windows\System\axkpRyC.exe
  2⤵
  PID:3828
- C:\Windows\System\xWXMFTc.exe
  C:\Windows\System\xWXMFTc.exe
  2⤵
  PID:3896
- C:\Windows\System\ByYYoHL.exe
  C:\Windows\System\ByYYoHL.exe
  2⤵
  PID:3256
- C:\Windows\System\ZAnHGpT.exe
  C:\Windows\System\ZAnHGpT.exe
  2⤵
  PID:3360
- C:\Windows\System\sDdCDDJ.exe
  C:\Windows\System\sDdCDDJ.exe
  2⤵
  PID:3208
- C:\Windows\System\OcdsMOe.exe
  C:\Windows\System\OcdsMOe.exe
  2⤵
  PID:3144
- C:\Windows\System\hzusBvb.exe
  C:\Windows\System\hzusBvb.exe
  2⤵
  PID:800
- C:\Windows\System\ObhDXzR.exe
  C:\Windows\System\ObhDXzR.exe
  2⤵
  PID:3556
- C:\Windows\System\yhjGzga.exe
  C:\Windows\System\yhjGzga.exe
  2⤵
  PID:3956
- C:\Windows\System\sIuztvu.exe
  C:\Windows\System\sIuztvu.exe
  2⤵
  PID:3992
- C:\Windows\System\MLbBuNV.exe
  C:\Windows\System\MLbBuNV.exe
  2⤵
  PID:1016
- C:\Windows\System\ptbTmhC.exe
  C:\Windows\System\ptbTmhC.exe
  2⤵
  PID:3040
- C:\Windows\System\FwcJRYj.exe
  C:\Windows\System\FwcJRYj.exe
  2⤵
  PID:876
- C:\Windows\System\MVqhIxI.exe
  C:\Windows\System\MVqhIxI.exe
  2⤵
  PID:684
- C:\Windows\System\vbXYCJS.exe
  C:\Windows\System\vbXYCJS.exe
  2⤵
  PID:1984
- C:\Windows\System\QGtlqmU.exe
  C:\Windows\System\QGtlqmU.exe
  2⤵
  PID:4088
- C:\Windows\System\EsQqaJA.exe
  C:\Windows\System\EsQqaJA.exe
  2⤵
  PID:3540
- C:\Windows\System\HqLEzdU.exe
  C:\Windows\System\HqLEzdU.exe
  2⤵
  PID:3168
- C:\Windows\System\NXOjyAX.exe
  C:\Windows\System\NXOjyAX.exe
  2⤵
  PID:3276
- C:\Windows\System\emLGFPD.exe
  C:\Windows\System\emLGFPD.exe
  2⤵
  PID:1916
- C:\Windows\System\TlRRvFH.exe
  C:\Windows\System\TlRRvFH.exe
  2⤵
  PID:3620
- C:\Windows\System\EctMlqi.exe
  C:\Windows\System\EctMlqi.exe
  2⤵
  PID:1624
- C:\Windows\System\AdoxikR.exe
  C:\Windows\System\AdoxikR.exe
  2⤵
  PID:2672
- C:\Windows\System\PWQeklH.exe
  C:\Windows\System\PWQeklH.exe
  2⤵
  PID:2604
- C:\Windows\System\TMQCwTz.exe
  C:\Windows\System\TMQCwTz.exe
  2⤵
  PID:2748
- C:\Windows\System\qOuMKqJ.exe
  C:\Windows\System\qOuMKqJ.exe
  2⤵
  PID:2492
- C:\Windows\System\mkSRMcI.exe
  C:\Windows\System\mkSRMcI.exe
  2⤵
  PID:2956
- C:\Windows\System\ZtfkbfF.exe
  C:\Windows\System\ZtfkbfF.exe
  2⤵
  PID:2952
- C:\Windows\System\ylrcehc.exe
  C:\Windows\System\ylrcehc.exe
  2⤵
  PID:2580
- C:\Windows\System\NXkjIBw.exe
  C:\Windows\System\NXkjIBw.exe
  2⤵
  PID:2500
- C:\Windows\System\qopDLwI.exe
  C:\Windows\System\qopDLwI.exe
  2⤵
  PID:2744
- C:\Windows\System\KXwJBMw.exe
  C:\Windows\System\KXwJBMw.exe
  2⤵
  PID:2696
- C:\Windows\System\vovrZjc.exe
  C:\Windows\System\vovrZjc.exe
  2⤵
  PID:2588
- C:\Windows\System\ghxAJKn.exe
  C:\Windows\System\ghxAJKn.exe
  2⤵
  PID:2440
- C:\Windows\System\fNjYAsF.exe
  C:\Windows\System\fNjYAsF.exe
  2⤵
  PID:1636
- C:\Windows\System\VjoNzfk.exe
  C:\Windows\System\VjoNzfk.exe
  2⤵
  PID:784
- C:\Windows\System\CDqJRYa.exe
  C:\Windows\System\CDqJRYa.exe
  2⤵
  PID:768
- C:\Windows\System\BOnsrsY.exe
  C:\Windows\System\BOnsrsY.exe
  2⤵
  PID:2404
- C:\Windows\System\FpnvKIO.exe
  C:\Windows\System\FpnvKIO.exe
  2⤵
  PID:3716
- C:\Windows\System\wFqgOKD.exe
  C:\Windows\System\wFqgOKD.exe
  2⤵
  PID:2620
- C:\Windows\System\hWgyTZM.exe
  C:\Windows\System\hWgyTZM.exe
  2⤵
  PID:3048
- C:\Windows\System\kFLjEiL.exe
  C:\Windows\System\kFLjEiL.exe
  2⤵
  PID:3752
- C:\Windows\System\aQsAvEy.exe
  C:\Windows\System\aQsAvEy.exe
  2⤵
  PID:3844
- C:\Windows\System\FsnHhoc.exe
  C:\Windows\System\FsnHhoc.exe
  2⤵
  PID:3908
- C:\Windows\System\BFyTDaW.exe
  C:\Windows\System\BFyTDaW.exe
  2⤵
  PID:4008
- C:\Windows\System\QszKgdD.exe
  C:\Windows\System\QszKgdD.exe
  2⤵
  PID:4040
- C:\Windows\System\zjVSJFh.exe
  C:\Windows\System\zjVSJFh.exe
  2⤵
  PID:1992
- C:\Windows\System\NfWaYrL.exe
  C:\Windows\System\NfWaYrL.exe
  2⤵
  PID:2060
- C:\Windows\System\yTejLGH.exe
  C:\Windows\System\yTejLGH.exe
  2⤵
  PID:3672
- C:\Windows\System\zFAafHb.exe
  C:\Windows\System\zFAafHb.exe
  2⤵
  PID:2496
- C:\Windows\System\LChwOxT.exe
  C:\Windows\System\LChwOxT.exe
  2⤵
  PID:1744
- C:\Windows\System\JudMFUj.exe
  C:\Windows\System\JudMFUj.exe
  2⤵
  PID:3476
- C:\Windows\System\NPvJVDL.exe
  C:\Windows\System\NPvJVDL.exe
  2⤵
  PID:532
- C:\Windows\System\loThxYk.exe
  C:\Windows\System\loThxYk.exe
  2⤵
  PID:2324
- C:\Windows\System\DaCxrPj.exe
  C:\Windows\System\DaCxrPj.exe
  2⤵
  PID:3764
- C:\Windows\System\SzpEEDk.exe
  C:\Windows\System\SzpEEDk.exe
  2⤵
  PID:1068
- C:\Windows\System\wIBkSbU.exe
  C:\Windows\System\wIBkSbU.exe
  2⤵
  PID:3316
- C:\Windows\System\qkUIYNe.exe
  C:\Windows\System\qkUIYNe.exe
  2⤵
  PID:3296
- C:\Windows\System\jXWXIIS.exe
  C:\Windows\System\jXWXIIS.exe
  2⤵
  PID:2628
- C:\Windows\System\fAFIwSQ.exe
  C:\Windows\System\fAFIwSQ.exe
  2⤵
  PID:1748
- C:\Windows\System\ZPstBro.exe
  C:\Windows\System\ZPstBro.exe
  2⤵
  PID:2712
- C:\Windows\System\oNsIPfT.exe
  C:\Windows\System\oNsIPfT.exe
  2⤵
  PID:672
- C:\Windows\System\vJqbXMc.exe
  C:\Windows\System\vJqbXMc.exe
  2⤵
  PID:2684
- C:\Windows\System\xDiddjm.exe
  C:\Windows\System\xDiddjm.exe
  2⤵
  PID:3384
- C:\Windows\System\XUxQlJh.exe
  C:\Windows\System\XUxQlJh.exe
  2⤵
  PID:1408
- C:\Windows\System\zOTkwKi.exe
  C:\Windows\System\zOTkwKi.exe
  2⤵
  PID:2380
- C:\Windows\System\LnFlfOS.exe
  C:\Windows\System\LnFlfOS.exe
  2⤵
  PID:3748
- C:\Windows\System\ggLfbME.exe
  C:\Windows\System\ggLfbME.exe
  2⤵
  PID:3496
- C:\Windows\System\yfeJyIS.exe
  C:\Windows\System\yfeJyIS.exe
  2⤵
  PID:1696
- C:\Windows\System\uhtpEzc.exe
  C:\Windows\System\uhtpEzc.exe
  2⤵
  PID:3572
- C:\Windows\System\HwsllHu.exe
  C:\Windows\System\HwsllHu.exe
  2⤵
  PID:1396
- C:\Windows\System\OUpPFMc.exe
  C:\Windows\System\OUpPFMc.exe
  2⤵
  PID:2660
- C:\Windows\System\RJtEEUf.exe
  C:\Windows\System\RJtEEUf.exe
  2⤵
  PID:3604
- C:\Windows\System\TnOLJgm.exe
  C:\Windows\System\TnOLJgm.exe
  2⤵
  PID:3812
- C:\Windows\System\aAWICTw.exe
  C:\Windows\System\aAWICTw.exe
  2⤵
  PID:4076
- C:\Windows\System\ZdEkIDe.exe
  C:\Windows\System\ZdEkIDe.exe
  2⤵
  PID:4056
- C:\Windows\System\klrsrqk.exe
  C:\Windows\System\klrsrqk.exe
  2⤵
  PID:2284
- C:\Windows\System\swcThkS.exe
  C:\Windows\System\swcThkS.exe
  2⤵
  PID:3100
- C:\Windows\System\LpnqddV.exe
  C:\Windows\System\LpnqddV.exe
  2⤵
  PID:3592
- C:\Windows\System\PWuGgRu.exe
  C:\Windows\System\PWuGgRu.exe
  2⤵
  PID:2036
- C:\Windows\System\qCJabeD.exe
  C:\Windows\System\qCJabeD.exe
  2⤵
  PID:1544
- C:\Windows\System\MoJSdoc.exe
  C:\Windows\System\MoJSdoc.exe
  2⤵
  PID:1600
- C:\Windows\System\tXUcoNs.exe
  C:\Windows\System\tXUcoNs.exe
  2⤵
  PID:2784
- C:\Windows\System\oEKzqaL.exe
  C:\Windows\System\oEKzqaL.exe
  2⤵
  PID:1520
- C:\Windows\System\NJxmZps.exe
  C:\Windows\System\NJxmZps.exe
  2⤵
  PID:2156
- C:\Windows\System\BGRtyMQ.exe
  C:\Windows\System\BGRtyMQ.exe
  2⤵
  PID:1216
- C:\Windows\System\akaiHZA.exe
  C:\Windows\System\akaiHZA.exe
  2⤵
  PID:2944
- C:\Windows\System\goAaIWT.exe
  C:\Windows\System\goAaIWT.exe
  2⤵
  PID:1936
- C:\Windows\System\XADtHqC.exe
  C:\Windows\System\XADtHqC.exe
  2⤵
  PID:1864
- C:\Windows\System\KhveERm.exe
  C:\Windows\System\KhveERm.exe
  2⤵
  PID:3988
- C:\Windows\System\NitgJac.exe
  C:\Windows\System\NitgJac.exe
  2⤵
  PID:1340
- C:\Windows\System\WncCuGx.exe
  C:\Windows\System\WncCuGx.exe
  2⤵
  PID:2668
- C:\Windows\System\xvauiyu.exe
  C:\Windows\System\xvauiyu.exe
  2⤵
  PID:2528
- C:\Windows\System\VGKPpal.exe
  C:\Windows\System\VGKPpal.exe
  2⤵
  PID:2968
- C:\Windows\System\ijsiCwH.exe
  C:\Windows\System\ijsiCwH.exe
  2⤵
  PID:844
- C:\Windows\System\vJmnBwU.exe
  C:\Windows\System\vJmnBwU.exe
  2⤵
  PID:3720
- C:\Windows\System\PSuWtgR.exe
  C:\Windows\System\PSuWtgR.exe
  2⤵
  PID:1524
- C:\Windows\System\mZvQcxT.exe
  C:\Windows\System\mZvQcxT.exe
  2⤵
  PID:3084
- C:\Windows\System\yNFEBby.exe
  C:\Windows\System\yNFEBby.exe
  2⤵
  PID:2408
- C:\Windows\System\tIHAplZ.exe
  C:\Windows\System\tIHAplZ.exe
  2⤵
  PID:4112
- C:\Windows\System\yaoeKpt.exe
  C:\Windows\System\yaoeKpt.exe
  2⤵
  PID:4128
- C:\Windows\System\JLpaPjF.exe
  C:\Windows\System\JLpaPjF.exe
  2⤵
  PID:4144
- C:\Windows\System\yaDUekn.exe
  C:\Windows\System\yaDUekn.exe
  2⤵
  PID:4160
- C:\Windows\System\LrwdhZJ.exe
  C:\Windows\System\LrwdhZJ.exe
  2⤵
  PID:4176
- C:\Windows\System\VvxmesL.exe
  C:\Windows\System\VvxmesL.exe
  2⤵
  PID:4192
- C:\Windows\System\AaHRJVP.exe
  C:\Windows\System\AaHRJVP.exe
  2⤵
  PID:4208
- C:\Windows\System\ABVJXAI.exe
  C:\Windows\System\ABVJXAI.exe
  2⤵
  PID:4224
- C:\Windows\System\BrJdTmq.exe
  C:\Windows\System\BrJdTmq.exe
  2⤵
  PID:4240
- C:\Windows\System\biULyJq.exe
  C:\Windows\System\biULyJq.exe
  2⤵
  PID:4256
- C:\Windows\System\yZVnnTK.exe
  C:\Windows\System\yZVnnTK.exe
  2⤵
  PID:4272
- C:\Windows\System\wONvJzB.exe
  C:\Windows\System\wONvJzB.exe
  2⤵
  PID:4288
- C:\Windows\System\aZPCFGe.exe
  C:\Windows\System\aZPCFGe.exe
  2⤵
  PID:4304
- C:\Windows\System\PosTgXZ.exe
  C:\Windows\System\PosTgXZ.exe
  2⤵
  PID:4320
- C:\Windows\System\eOrlBiN.exe
  C:\Windows\System\eOrlBiN.exe
  2⤵
  PID:4336
- C:\Windows\System\UVYseEx.exe
  C:\Windows\System\UVYseEx.exe
  2⤵
  PID:4352
- C:\Windows\System\UcnfDin.exe
  C:\Windows\System\UcnfDin.exe
  2⤵
  PID:4368
- C:\Windows\System\GqAhrLG.exe
  C:\Windows\System\GqAhrLG.exe
  2⤵
  PID:4384
- C:\Windows\System\FjxvLjh.exe
  C:\Windows\System\FjxvLjh.exe
  2⤵
  PID:4400
- C:\Windows\System\FhBfjMd.exe
  C:\Windows\System\FhBfjMd.exe
  2⤵
  PID:4416
- C:\Windows\System\LSoItaz.exe
  C:\Windows\System\LSoItaz.exe
  2⤵
  PID:4432
- C:\Windows\System\UVjKTsb.exe
  C:\Windows\System\UVjKTsb.exe
  2⤵
  PID:4448
- C:\Windows\System\TBBEYbj.exe
  C:\Windows\System\TBBEYbj.exe
  2⤵
  PID:4464
- C:\Windows\System\embnKXS.exe
  C:\Windows\System\embnKXS.exe
  2⤵
  PID:4480
- C:\Windows\System\mWvKPKb.exe
  C:\Windows\System\mWvKPKb.exe
  2⤵
  PID:4496
- C:\Windows\System\sBlYBmh.exe
  C:\Windows\System\sBlYBmh.exe
  2⤵
  PID:4512
- C:\Windows\System\WbygmUu.exe
  C:\Windows\System\WbygmUu.exe
  2⤵
  PID:4528
- C:\Windows\System\IyMXDjL.exe
  C:\Windows\System\IyMXDjL.exe
  2⤵
  PID:4544
- C:\Windows\System\nLUeVuX.exe
  C:\Windows\System\nLUeVuX.exe
  2⤵
  PID:4560
- C:\Windows\System\nGajMWs.exe
  C:\Windows\System\nGajMWs.exe
  2⤵
  PID:4576
- C:\Windows\System\wCaQTeA.exe
  C:\Windows\System\wCaQTeA.exe
  2⤵
  PID:4592
- C:\Windows\System\taeMHZk.exe
  C:\Windows\System\taeMHZk.exe
  2⤵
  PID:4608
- C:\Windows\System\FWJozlt.exe
  C:\Windows\System\FWJozlt.exe
  2⤵
  PID:4624
- C:\Windows\System\kYtVtQm.exe
  C:\Windows\System\kYtVtQm.exe
  2⤵
  PID:4640
- C:\Windows\System\SniQBAw.exe
  C:\Windows\System\SniQBAw.exe
  2⤵
  PID:4656
- C:\Windows\System\rUNFYTx.exe
  C:\Windows\System\rUNFYTx.exe
  2⤵
  PID:4672
- C:\Windows\System\BOShCdm.exe
  C:\Windows\System\BOShCdm.exe
  2⤵
  PID:4688
- C:\Windows\System\JYhlZlS.exe
  C:\Windows\System\JYhlZlS.exe
  2⤵
  PID:4704
- C:\Windows\System\cShSBWj.exe
  C:\Windows\System\cShSBWj.exe
  2⤵
  PID:4720
- C:\Windows\System\AadiytW.exe
  C:\Windows\System\AadiytW.exe
  2⤵
  PID:4736
- C:\Windows\System\zLoeWSu.exe
  C:\Windows\System\zLoeWSu.exe
  2⤵
  PID:4752
- C:\Windows\System\ZHLMWjX.exe
  C:\Windows\System\ZHLMWjX.exe
  2⤵
  PID:4768
- C:\Windows\System\YkzXfCS.exe
  C:\Windows\System\YkzXfCS.exe
  2⤵
  PID:4788
- C:\Windows\System\OWqxThR.exe
  C:\Windows\System\OWqxThR.exe
  2⤵
  PID:4808
- C:\Windows\System\amAePrv.exe
  C:\Windows\System\amAePrv.exe
  2⤵
  PID:4824
- C:\Windows\System\liMzzcr.exe
  C:\Windows\System\liMzzcr.exe
  2⤵
  PID:4840
- C:\Windows\System\WNplHbc.exe
  C:\Windows\System\WNplHbc.exe
  2⤵
  PID:4856
- C:\Windows\System\RMjkWkr.exe
  C:\Windows\System\RMjkWkr.exe
  2⤵
  PID:4872
- C:\Windows\System\ocDHZbj.exe
  C:\Windows\System\ocDHZbj.exe
  2⤵
  PID:4888
- C:\Windows\System\jDzhRoY.exe
  C:\Windows\System\jDzhRoY.exe
  2⤵
  PID:4904
- C:\Windows\System\NxZjpht.exe
  C:\Windows\System\NxZjpht.exe
  2⤵
  PID:4920
- C:\Windows\System\bDHAULo.exe
  C:\Windows\System\bDHAULo.exe
  2⤵
  PID:4936
- C:\Windows\System\AnRLtyR.exe
  C:\Windows\System\AnRLtyR.exe
  2⤵
  PID:4952
- C:\Windows\System\oCoFyFO.exe
  C:\Windows\System\oCoFyFO.exe
  2⤵
  PID:4968
- C:\Windows\System\cAOrxqI.exe
  C:\Windows\System\cAOrxqI.exe
  2⤵
  PID:4984
- C:\Windows\System\LpsZrjz.exe
  C:\Windows\System\LpsZrjz.exe
  2⤵
  PID:5000
- C:\Windows\System\MMzlBrO.exe
  C:\Windows\System\MMzlBrO.exe
  2⤵
  PID:5016
- C:\Windows\System\wyGGHiq.exe
  C:\Windows\System\wyGGHiq.exe
  2⤵
  PID:5032
- C:\Windows\System\lzcKjni.exe
  C:\Windows\System\lzcKjni.exe
  2⤵
  PID:5048
- C:\Windows\System\oquUolC.exe
  C:\Windows\System\oquUolC.exe
  2⤵
  PID:5064
- C:\Windows\System\LMRrjbK.exe
  C:\Windows\System\LMRrjbK.exe
  2⤵
  PID:5080
- C:\Windows\System\BPkJMJr.exe
  C:\Windows\System\BPkJMJr.exe
  2⤵
  PID:5096
- C:\Windows\System\lRDAGug.exe
  C:\Windows\System\lRDAGug.exe
  2⤵
  PID:5112
- C:\Windows\System\auKippJ.exe
  C:\Windows\System\auKippJ.exe
  2⤵
  PID:4108
- C:\Windows\System\qVZjfIH.exe
  C:\Windows\System\qVZjfIH.exe
  2⤵
  PID:4200
- C:\Windows\System\eFjegBi.exe
  C:\Windows\System\eFjegBi.exe
  2⤵
  PID:4204
- C:\Windows\System\YawSFSc.exe
  C:\Windows\System\YawSFSc.exe
  2⤵
  PID:4264
- C:\Windows\System\NWVZlRh.exe
  C:\Windows\System\NWVZlRh.exe
  2⤵
  PID:4360
- C:\Windows\System\PlPkCrS.exe
  C:\Windows\System\PlPkCrS.exe
  2⤵
  PID:4268
- C:\Windows\System\WYRldzN.exe
  C:\Windows\System\WYRldzN.exe
  2⤵
  PID:4364
- C:\Windows\System\midvLGA.exe
  C:\Windows\System\midvLGA.exe
  2⤵
  PID:2812
- C:\Windows\System\WgPHQmq.exe
  C:\Windows\System\WgPHQmq.exe
  2⤵
  PID:4216
- C:\Windows\System\ppyOkOx.exe
  C:\Windows\System\ppyOkOx.exe
  2⤵
  PID:4152
- C:\Windows\System\MZqYnvp.exe
  C:\Windows\System\MZqYnvp.exe
  2⤵
  PID:4220
- C:\Windows\System\wIYagBU.exe
  C:\Windows\System\wIYagBU.exe
  2⤵
  PID:4280
- C:\Windows\System\PMfzBap.exe
  C:\Windows\System\PMfzBap.exe
  2⤵
  PID:4344
- C:\Windows\System\WUFZPnQ.exe
  C:\Windows\System\WUFZPnQ.exe
  2⤵
  PID:4408
- C:\Windows\System\BYlQZWD.exe
  C:\Windows\System\BYlQZWD.exe
  2⤵
  PID:4476
- C:\Windows\System\wTdgWKU.exe
  C:\Windows\System\wTdgWKU.exe
  2⤵
  PID:4540
- C:\Windows\System\OcbvYLi.exe
  C:\Windows\System\OcbvYLi.exe
  2⤵
  PID:4604
- C:\Windows\System\VqLhxlE.exe
  C:\Windows\System\VqLhxlE.exe
  2⤵
  PID:4668
- C:\Windows\System\xtGkCij.exe
  C:\Windows\System\xtGkCij.exe
  2⤵
  PID:4696
- C:\Windows\System\lXICDtN.exe
  C:\Windows\System\lXICDtN.exe
  2⤵
  PID:4760
- C:\Windows\System\wQDhEnP.exe
  C:\Windows\System\wQDhEnP.exe
  2⤵
  PID:4620
- C:\Windows\System\TGrnvrV.exe
  C:\Windows\System\TGrnvrV.exe
  2⤵
  PID:4748
- C:\Windows\System\XpvjgND.exe
  C:\Windows\System\XpvjgND.exe
  2⤵
  PID:4712
- C:\Windows\System\ylEUfKJ.exe
  C:\Windows\System\ylEUfKJ.exe
  2⤵
  PID:4784
- C:\Windows\System\xlVRRWw.exe
  C:\Windows\System\xlVRRWw.exe
  2⤵
  PID:4820
- C:\Windows\System\kPMxRju.exe
  C:\Windows\System\kPMxRju.exe
  2⤵
  PID:4880
- C:\Windows\System\uxrxzww.exe
  C:\Windows\System\uxrxzww.exe
  2⤵
  PID:4864
- C:\Windows\System\UyABoEc.exe
  C:\Windows\System\UyABoEc.exe
  2⤵
  PID:4944
- C:\Windows\System\XHxEnue.exe
  C:\Windows\System\XHxEnue.exe
  2⤵
  PID:4932
- C:\Windows\System\uMDtJRL.exe
  C:\Windows\System\uMDtJRL.exe
  2⤵
  PID:5008
- C:\Windows\System\IHAzEYB.exe
  C:\Windows\System\IHAzEYB.exe
  2⤵
  PID:5044
- C:\Windows\System\RlzAFzT.exe
  C:\Windows\System\RlzAFzT.exe
  2⤵
  PID:5104
- C:\Windows\System\qSlBFHQ.exe
  C:\Windows\System\qSlBFHQ.exe
  2⤵
  PID:4140
- C:\Windows\System\vUaZDmX.exe
  C:\Windows\System\vUaZDmX.exe
  2⤵
  PID:4396
- C:\Windows\System\OOMkSAh.exe
  C:\Windows\System\OOMkSAh.exe
  2⤵
  PID:4488
- C:\Windows\System\lqfBUcb.exe
  C:\Windows\System\lqfBUcb.exe
  2⤵
  PID:5028
- C:\Windows\System\YvlKAZl.exe
  C:\Windows\System\YvlKAZl.exe
  2⤵
  PID:4428
- C:\Windows\System\kFgtXgK.exe
  C:\Windows\System\kFgtXgK.exe
  2⤵
  PID:5056
- C:\Windows\System\nOBnJLx.exe
  C:\Windows\System\nOBnJLx.exe
  2⤵
  PID:4104
- C:\Windows\System\KTTWcpI.exe
  C:\Windows\System\KTTWcpI.exe
  2⤵
  PID:4252
- C:\Windows\System\tNZaNND.exe
  C:\Windows\System\tNZaNND.exe
  2⤵
  PID:4536
- C:\Windows\System\zwiPfzP.exe
  C:\Windows\System\zwiPfzP.exe
  2⤵
  PID:4524
- C:\Windows\System\DGvjDSW.exe
  C:\Windows\System\DGvjDSW.exe
  2⤵
  PID:4616
- C:\Windows\System\UViJDHC.exe
  C:\Windows\System\UViJDHC.exe
  2⤵
  PID:4600
- C:\Windows\System\RKIjtnd.exe
  C:\Windows\System\RKIjtnd.exe
  2⤵
  PID:4716
- C:\Windows\System\cbCYAsa.exe
  C:\Windows\System\cbCYAsa.exe
  2⤵
  PID:1096
- C:\Windows\System\jSzTYjw.exe
  C:\Windows\System\jSzTYjw.exe
  2⤵
  PID:4848
- C:\Windows\System\joVUMMd.exe
  C:\Windows\System\joVUMMd.exe
  2⤵
  PID:4836
- C:\Windows\System\cyOhzGB.exe
  C:\Windows\System\cyOhzGB.exe
  2⤵
  PID:4996
- C:\Windows\System\GkPsphc.exe
  C:\Windows\System\GkPsphc.exe
  2⤵
  PID:4136
- C:\Windows\System\FpZODfm.exe
  C:\Windows\System\FpZODfm.exe
  2⤵
  PID:5108
- C:\Windows\System\thmUVMI.exe
  C:\Windows\System\thmUVMI.exe
  2⤵
  PID:4332
- C:\Windows\System\ASGWsKA.exe
  C:\Windows\System\ASGWsKA.exe
  2⤵
  PID:4188
- C:\Windows\System\AXnLItK.exe
  C:\Windows\System\AXnLItK.exe
  2⤵
  PID:4328
- C:\Windows\System\IgkFgpy.exe
  C:\Windows\System\IgkFgpy.exe
  2⤵
  PID:4728
- C:\Windows\System\UFxlmPy.exe
  C:\Windows\System\UFxlmPy.exe
  2⤵
  PID:4776
- C:\Windows\System\SidojzI.exe
  C:\Windows\System\SidojzI.exe
  2⤵
  PID:4316
- C:\Windows\System\kIJYfZL.exe
  C:\Windows\System\kIJYfZL.exe
  2⤵
  PID:4800
- C:\Windows\System\OzOhpeJ.exe
  C:\Windows\System\OzOhpeJ.exe
  2⤵
  PID:4976
- C:\Windows\System\lwqewrR.exe
  C:\Windows\System\lwqewrR.exe
  2⤵
  PID:5124
- C:\Windows\System\HAWDebJ.exe
  C:\Windows\System\HAWDebJ.exe
  2⤵
  PID:5140
- C:\Windows\System\ILEdHVb.exe
  C:\Windows\System\ILEdHVb.exe
  2⤵
  PID:5156
- C:\Windows\System\FgwNjvS.exe
  C:\Windows\System\FgwNjvS.exe
  2⤵
  PID:5172
- C:\Windows\System\lrSkMEx.exe
  C:\Windows\System\lrSkMEx.exe
  2⤵
  PID:5188
- C:\Windows\System\xQxmZGj.exe
  C:\Windows\System\xQxmZGj.exe
  2⤵
  PID:5204
- C:\Windows\System\qkSKBgZ.exe
  C:\Windows\System\qkSKBgZ.exe
  2⤵
  PID:5220
- C:\Windows\System\xiWoUIK.exe
  C:\Windows\System\xiWoUIK.exe
  2⤵
  PID:5236
- C:\Windows\System\vpXZNjW.exe
  C:\Windows\System\vpXZNjW.exe
  2⤵
  PID:5860
- C:\Windows\System\FESRwXH.exe
  C:\Windows\System\FESRwXH.exe
  2⤵
  PID:5880
- C:\Windows\System\OFPdpwC.exe
  C:\Windows\System\OFPdpwC.exe
  2⤵
  PID:5900
- C:\Windows\System\cIoxrkd.exe
  C:\Windows\System\cIoxrkd.exe
  2⤵
  PID:5916
- C:\Windows\System\RJudMnm.exe
  C:\Windows\System\RJudMnm.exe
  2⤵
  PID:5932
- C:\Windows\System\XUxcAMJ.exe
  C:\Windows\System\XUxcAMJ.exe
  2⤵
  PID:5952
- C:\Windows\System\MyNQKTN.exe
  C:\Windows\System\MyNQKTN.exe
  2⤵
  PID:5968
- C:\Windows\System\ykEcpYK.exe
  C:\Windows\System\ykEcpYK.exe
  2⤵
  PID:5984
- C:\Windows\System\CcEfPto.exe
  C:\Windows\System\CcEfPto.exe
  2⤵
  PID:6000
- C:\Windows\System\cCsEluK.exe
  C:\Windows\System\cCsEluK.exe
  2⤵
  PID:6024
- C:\Windows\System\DccWfId.exe
  C:\Windows\System\DccWfId.exe
  2⤵
  PID:6040
- C:\Windows\System\NolkhOp.exe
  C:\Windows\System\NolkhOp.exe
  2⤵
  PID:6056
- C:\Windows\System\PGdPIvE.exe
  C:\Windows\System\PGdPIvE.exe
  2⤵
  PID:6072
- C:\Windows\System\DRyIHlR.exe
  C:\Windows\System\DRyIHlR.exe
  2⤵
  PID:6088
- C:\Windows\System\vEqVWSh.exe
  C:\Windows\System\vEqVWSh.exe
  2⤵
  PID:6104
- C:\Windows\System\pGcMuQW.exe
  C:\Windows\System\pGcMuQW.exe
  2⤵
  PID:6120
- C:\Windows\System\NoIEQmE.exe
  C:\Windows\System\NoIEQmE.exe
  2⤵
  PID:6136
- C:\Windows\System\gZcLgax.exe
  C:\Windows\System\gZcLgax.exe
  2⤵
  PID:4552
- C:\Windows\System\DXTwHgN.exe
  C:\Windows\System\DXTwHgN.exe
  2⤵
  PID:4832
- C:\Windows\System\PgGJkAc.exe
  C:\Windows\System\PgGJkAc.exe
  2⤵
  PID:4652
- C:\Windows\System\mQJoKCU.exe
  C:\Windows\System\mQJoKCU.exe
  2⤵
  PID:4664
- C:\Windows\System\rurhxrM.exe
  C:\Windows\System\rurhxrM.exe
  2⤵
  PID:4520
- C:\Windows\System\fenQvNx.exe
  C:\Windows\System\fenQvNx.exe
  2⤵
  PID:5168
- C:\Windows\System\pKeRSdL.exe
  C:\Windows\System\pKeRSdL.exe
  2⤵
  PID:5216
- C:\Windows\System\ZhnJDIc.exe
  C:\Windows\System\ZhnJDIc.exe
  2⤵
  PID:5232
- C:\Windows\System\LKZEDfC.exe
  C:\Windows\System\LKZEDfC.exe
  2⤵
  PID:5260
- C:\Windows\System\EmDXYWl.exe
  C:\Windows\System\EmDXYWl.exe
  2⤵
  PID:5280
- C:\Windows\System\CHmuePG.exe
  C:\Windows\System\CHmuePG.exe
  2⤵
  PID:5304
- C:\Windows\System\xjzwnNK.exe
  C:\Windows\System\xjzwnNK.exe
  2⤵
  PID:5320
- C:\Windows\System\PnbJNnc.exe
  C:\Windows\System\PnbJNnc.exe
  2⤵
  PID:5336
- C:\Windows\System\LtWuWpN.exe
  C:\Windows\System\LtWuWpN.exe
  2⤵
  PID:5352
- C:\Windows\System\QNPtFPG.exe
  C:\Windows\System\QNPtFPG.exe
  2⤵
  PID:5372
- C:\Windows\System\vnIhJvQ.exe
  C:\Windows\System\vnIhJvQ.exe
  2⤵
  PID:5384
- C:\Windows\System\nCbrmcO.exe
  C:\Windows\System\nCbrmcO.exe
  2⤵
  PID:5400
- C:\Windows\System\zNKkzWd.exe
  C:\Windows\System\zNKkzWd.exe
  2⤵
  PID:5420
- C:\Windows\System\uYjFhSp.exe
  C:\Windows\System\uYjFhSp.exe
  2⤵
  PID:5432
- C:\Windows\System\GUTCTVi.exe
  C:\Windows\System\GUTCTVi.exe
  2⤵
  PID:5452
- C:\Windows\System\jxmvpYy.exe
  C:\Windows\System\jxmvpYy.exe
  2⤵
  PID:5468
- C:\Windows\System\gVTBEIh.exe
  C:\Windows\System\gVTBEIh.exe
  2⤵
  PID:5484
- C:\Windows\System\Evwkypq.exe
  C:\Windows\System\Evwkypq.exe
  2⤵
  PID:5500
- C:\Windows\System\gnKlkPr.exe
  C:\Windows\System\gnKlkPr.exe
  2⤵
  PID:5516
- C:\Windows\System\LxcWOeG.exe
  C:\Windows\System\LxcWOeG.exe
  2⤵
  PID:5532
- C:\Windows\System\CmlorMU.exe
  C:\Windows\System\CmlorMU.exe
  2⤵
  PID:5548
- C:\Windows\System\WpAYfbh.exe
  C:\Windows\System\WpAYfbh.exe
  2⤵
  PID:5564
- C:\Windows\System\prqURRf.exe
  C:\Windows\System\prqURRf.exe
  2⤵
  PID:5588
- C:\Windows\System\TJqlZcS.exe
  C:\Windows\System\TJqlZcS.exe
  2⤵
  PID:5596
- C:\Windows\System\JeWCYEm.exe
  C:\Windows\System\JeWCYEm.exe
  2⤵
  PID:5612
- C:\Windows\System\qBAxmcj.exe
  C:\Windows\System\qBAxmcj.exe
  2⤵
  PID:5628
- C:\Windows\System\pnMXjvu.exe
  C:\Windows\System\pnMXjvu.exe
  2⤵
  PID:5644
- C:\Windows\System\gHoMgaR.exe
  C:\Windows\System\gHoMgaR.exe
  2⤵
  PID:5664
- C:\Windows\System\cNtJdMq.exe
  C:\Windows\System\cNtJdMq.exe
  2⤵
  PID:5680
- C:\Windows\System\NxLQiTH.exe
  C:\Windows\System\NxLQiTH.exe
  2⤵
  PID:5692
- C:\Windows\System\JeZbXhN.exe
  C:\Windows\System\JeZbXhN.exe
  2⤵
  PID:5700
- C:\Windows\System\cfFFMCo.exe
  C:\Windows\System\cfFFMCo.exe
  2⤵
  PID:5724
- C:\Windows\System\uAeCxot.exe
  C:\Windows\System\uAeCxot.exe
  2⤵
  PID:5736
- C:\Windows\System\kQHlGQW.exe
  C:\Windows\System\kQHlGQW.exe
  2⤵
  PID:5756
- C:\Windows\System\wauhFOq.exe
  C:\Windows\System\wauhFOq.exe
  2⤵
  PID:5772
- C:\Windows\System\EhtxDaF.exe
  C:\Windows\System\EhtxDaF.exe
  2⤵
  PID:5788
- C:\Windows\System\nscqEaH.exe
  C:\Windows\System\nscqEaH.exe
  2⤵
  PID:5800
- C:\Windows\System\mTucmOl.exe
  C:\Windows\System\mTucmOl.exe
  2⤵
  PID:5820
- C:\Windows\System\kFrIGzz.exe
  C:\Windows\System\kFrIGzz.exe
  2⤵
  PID:5196
- C:\Windows\System\AAUpYiT.exe
  C:\Windows\System\AAUpYiT.exe
  2⤵
  PID:5856
- C:\Windows\System\eqppOJE.exe
  C:\Windows\System\eqppOJE.exe
  2⤵
  PID:5876
- C:\Windows\System\tsakyDR.exe
  C:\Windows\System\tsakyDR.exe
  2⤵
  PID:5892
- C:\Windows\System\SWPxmsH.exe
  C:\Windows\System\SWPxmsH.exe
  2⤵
  PID:5964
- C:\Windows\System\rqZajbi.exe
  C:\Windows\System\rqZajbi.exe
  2⤵
  PID:5948
- C:\Windows\System\UqDRFgs.exe
  C:\Windows\System\UqDRFgs.exe
  2⤵
  PID:5996
- C:\Windows\System\NCxRFqV.exe
  C:\Windows\System\NCxRFqV.exe
  2⤵
  PID:6080
- C:\Windows\System\ukSDUCs.exe
  C:\Windows\System\ukSDUCs.exe
  2⤵
  PID:6112
- C:\Windows\System\YpAfslo.exe
  C:\Windows\System\YpAfslo.exe
  2⤵
  PID:6096
- C:\Windows\System\saIqaFF.exe
  C:\Windows\System\saIqaFF.exe
  2⤵
  PID:6116
- C:\Windows\System\qpbmAxy.exe
  C:\Windows\System\qpbmAxy.exe
  2⤵
  PID:1568
- C:\Windows\System\nYkvTRf.exe
  C:\Windows\System\nYkvTRf.exe
  2⤵
  PID:4916
- C:\Windows\System\efQhIjr.exe
  C:\Windows\System\efQhIjr.exe
  2⤵
  PID:5212
- C:\Windows\System\ONvlxUM.exe
  C:\Windows\System\ONvlxUM.exe
  2⤵
  PID:5200
- C:\Windows\System\HCTVcWB.exe
  C:\Windows\System\HCTVcWB.exe
  2⤵
  PID:5272
- C:\Windows\System\wIoaotA.exe
  C:\Windows\System\wIoaotA.exe
  2⤵
  PID:5364
- C:\Windows\System\bnurkiA.exe
  C:\Windows\System\bnurkiA.exe
  2⤵
  PID:5312
- C:\Windows\System\nQwAzDj.exe
  C:\Windows\System\nQwAzDj.exe
  2⤵
  PID:5376
- C:\Windows\System\MRjOENU.exe
  C:\Windows\System\MRjOENU.exe
  2⤵
  PID:5408
- C:\Windows\System\tWccKrl.exe
  C:\Windows\System\tWccKrl.exe
  2⤵
  PID:5464
- C:\Windows\System\DenxbXs.exe
  C:\Windows\System\DenxbXs.exe
  2⤵
  PID:5524
- C:\Windows\System\LZkblEk.exe
  C:\Windows\System\LZkblEk.exe
  2⤵
  PID:5580
- C:\Windows\System\FfcrkMt.exe
  C:\Windows\System\FfcrkMt.exe
  2⤵
  PID:5512
- C:\Windows\System\huxcxnX.exe
  C:\Windows\System\huxcxnX.exe
  2⤵
  PID:5576
- C:\Windows\System\BlegLQz.exe
  C:\Windows\System\BlegLQz.exe
  2⤵
  PID:5656
- C:\Windows\System\nVdXJki.exe
  C:\Windows\System\nVdXJki.exe
  2⤵
  PID:5712
- C:\Windows\System\WMFafVH.exe
  C:\Windows\System\WMFafVH.exe
  2⤵
  PID:5744
- C:\Windows\System\GGGDoKf.exe
  C:\Windows\System\GGGDoKf.exe
  2⤵
  PID:5840
- C:\Windows\System\oQflqUn.exe
  C:\Windows\System\oQflqUn.exe
  2⤵
  PID:5912
- C:\Windows\System\KdDCwLS.exe
  C:\Windows\System\KdDCwLS.exe
  2⤵
  PID:6048
- C:\Windows\System\uCKGNzz.exe
  C:\Windows\System\uCKGNzz.exe
  2⤵
  PID:5148
- C:\Windows\System\CVaEJhq.exe
  C:\Windows\System\CVaEJhq.exe
  2⤵
  PID:5632
- C:\Windows\System\DtPqCfZ.exe
  C:\Windows\System\DtPqCfZ.exe
  2⤵
  PID:5708
- C:\Windows\System\YZtzdxg.exe
  C:\Windows\System\YZtzdxg.exe
  2⤵
  PID:5768
- C:\Windows\System\BGfgyNK.exe
  C:\Windows\System\BGfgyNK.exe
  2⤵
  PID:5392
- C:\Windows\System\uEDyLNM.exe
  C:\Windows\System\uEDyLNM.exe
  2⤵
  PID:5832
- C:\Windows\System\EzosREb.exe
  C:\Windows\System\EzosREb.exe
  2⤵
  PID:5960
- C:\Windows\System\xaYswcf.exe
  C:\Windows\System\xaYswcf.exe
  2⤵
  PID:6032
- C:\Windows\System\bkfSFjh.exe
  C:\Windows\System\bkfSFjh.exe
  2⤵
  PID:5444
- C:\Windows\System\AQCyBqY.exe
  C:\Windows\System\AQCyBqY.exe
  2⤵
  PID:5040
- C:\Windows\System\XbPfuvE.exe
  C:\Windows\System\XbPfuvE.exe
  2⤵
  PID:5332
- C:\Windows\System\TMvnBTI.exe
  C:\Windows\System\TMvnBTI.exe
  2⤵
  PID:5460
- C:\Windows\System\pQabvTy.exe
  C:\Windows\System\pQabvTy.exe
  2⤵
  PID:5784
- C:\Windows\System\PnPobXY.exe
  C:\Windows\System\PnPobXY.exe
  2⤵
  PID:5896
- C:\Windows\System\yHPcwyE.exe
  C:\Windows\System\yHPcwyE.exe
  2⤵
  PID:5660
- C:\Windows\System\sqZukHV.exe
  C:\Windows\System\sqZukHV.exe
  2⤵
  PID:5688
- C:\Windows\System\aTPIjgm.exe
  C:\Windows\System\aTPIjgm.exe
  2⤵
  PID:5796
- C:\Windows\System\UVLzqIJ.exe
  C:\Windows\System\UVLzqIJ.exe
  2⤵
  PID:6128
- C:\Windows\System\RtDjcVK.exe
  C:\Windows\System\RtDjcVK.exe
  2⤵
  PID:6084
- C:\Windows\System\OobfDcE.exe
  C:\Windows\System\OobfDcE.exe
  2⤵
  PID:5888
- C:\Windows\System\Pqfbbpn.exe
  C:\Windows\System\Pqfbbpn.exe
  2⤵
  PID:5288
- C:\Windows\System\gajYqZf.exe
  C:\Windows\System\gajYqZf.exe
  2⤵
  PID:5136
- C:\Windows\System\FHsevAv.exe
  C:\Windows\System\FHsevAv.exe
  2⤵
  PID:4732
- C:\Windows\System\vnENHFw.exe
  C:\Windows\System\vnENHFw.exe
  2⤵
  PID:5440
- C:\Windows\System\rBcwkpF.exe
  C:\Windows\System\rBcwkpF.exe
  2⤵
  PID:5992
- C:\Windows\System\QNNVrld.exe
  C:\Windows\System\QNNVrld.exe
  2⤵
  PID:5824
- C:\Windows\System\puLJvZG.exe
  C:\Windows\System\puLJvZG.exe
  2⤵
  PID:5348
- C:\Windows\System\RylpLHs.exe
  C:\Windows\System\RylpLHs.exe
  2⤵
  PID:6160
- C:\Windows\System\mjRcjqy.exe
  C:\Windows\System\mjRcjqy.exe
  2⤵
  PID:6176
- C:\Windows\System\vGZSJwm.exe
  C:\Windows\System\vGZSJwm.exe
  2⤵
  PID:6200
- C:\Windows\System\TFjcQWK.exe
  C:\Windows\System\TFjcQWK.exe
  2⤵
  PID:6216
- C:\Windows\System\reVkXux.exe
  C:\Windows\System\reVkXux.exe
  2⤵
  PID:6232
- C:\Windows\System\ZKvIQPF.exe
  C:\Windows\System\ZKvIQPF.exe
  2⤵
  PID:6248
- C:\Windows\System\gOXxwnt.exe
  C:\Windows\System\gOXxwnt.exe
  2⤵
  PID:6264
- C:\Windows\System\KxEJAeq.exe
  C:\Windows\System\KxEJAeq.exe
  2⤵
  PID:6280
- C:\Windows\System\poOEfUr.exe
  C:\Windows\System\poOEfUr.exe
  2⤵
  PID:6304
- C:\Windows\System\LvbmxYK.exe
  C:\Windows\System\LvbmxYK.exe
  2⤵
  PID:6320
- C:\Windows\System\oIgYVYy.exe
  C:\Windows\System\oIgYVYy.exe
  2⤵
  PID:6336
- C:\Windows\System\aIrrtfS.exe
  C:\Windows\System\aIrrtfS.exe
  2⤵
  PID:6352
- C:\Windows\System\WzoCnXJ.exe
  C:\Windows\System\WzoCnXJ.exe
  2⤵
  PID:6368
- C:\Windows\System\eAdZOta.exe
  C:\Windows\System\eAdZOta.exe
  2⤵
  PID:6384
- C:\Windows\System\cdkRpCf.exe
  C:\Windows\System\cdkRpCf.exe
  2⤵
  PID:6400
- C:\Windows\System\EHrwrVR.exe
  C:\Windows\System\EHrwrVR.exe
  2⤵
  PID:6416
- C:\Windows\System\Kpcwrte.exe
  C:\Windows\System\Kpcwrte.exe
  2⤵
  PID:6432
- C:\Windows\System\fjjeKsZ.exe
  C:\Windows\System\fjjeKsZ.exe
  2⤵
  PID:6448
- C:\Windows\System\gWFYZkt.exe
  C:\Windows\System\gWFYZkt.exe
  2⤵
  PID:6464
- C:\Windows\System\qKypXqd.exe
  C:\Windows\System\qKypXqd.exe
  2⤵
  PID:6484
- C:\Windows\System\mHTqwTO.exe
  C:\Windows\System\mHTqwTO.exe
  2⤵
  PID:6500
- C:\Windows\System\mMomXoR.exe
  C:\Windows\System\mMomXoR.exe
  2⤵
  PID:6516
- C:\Windows\System\GCyqJBA.exe
  C:\Windows\System\GCyqJBA.exe
  2⤵
  PID:6532
- C:\Windows\System\zJLAWPM.exe
  C:\Windows\System\zJLAWPM.exe
  2⤵
  PID:6548
- C:\Windows\System\VnRHwSq.exe
  C:\Windows\System\VnRHwSq.exe
  2⤵
  PID:6564
- C:\Windows\System\fsjbsRx.exe
  C:\Windows\System\fsjbsRx.exe
  2⤵
  PID:6580
- C:\Windows\System\EBJazel.exe
  C:\Windows\System\EBJazel.exe
  2⤵
  PID:6596
- C:\Windows\System\DOljShk.exe
  C:\Windows\System\DOljShk.exe
  2⤵
  PID:6612
- C:\Windows\System\awFQYHR.exe
  C:\Windows\System\awFQYHR.exe
  2⤵
  PID:6628
- C:\Windows\System\whNVfaz.exe
  C:\Windows\System\whNVfaz.exe
  2⤵
  PID:6644
- C:\Windows\System\YLsQjdj.exe
  C:\Windows\System\YLsQjdj.exe
  2⤵
  PID:6660
- C:\Windows\System\KQCcHYx.exe
  C:\Windows\System\KQCcHYx.exe
  2⤵
  PID:6676
- C:\Windows\System\pXNGCBz.exe
  C:\Windows\System\pXNGCBz.exe
  2⤵
  PID:6692
- C:\Windows\System\sHZOCcj.exe
  C:\Windows\System\sHZOCcj.exe
  2⤵
  PID:6708
- C:\Windows\System\TNeDGQY.exe
  C:\Windows\System\TNeDGQY.exe
  2⤵
  PID:6724
- C:\Windows\System\ECoaBTU.exe
  C:\Windows\System\ECoaBTU.exe
  2⤵
  PID:6740
- C:\Windows\System\XuMkBSm.exe
  C:\Windows\System\XuMkBSm.exe
  2⤵
  PID:6756
- C:\Windows\System\wAgOrgp.exe
  C:\Windows\System\wAgOrgp.exe
  2⤵
  PID:6772
- C:\Windows\System\BJMFilT.exe
  C:\Windows\System\BJMFilT.exe
  2⤵
  PID:6788
- C:\Windows\System\rAjWtei.exe
  C:\Windows\System\rAjWtei.exe
  2⤵
  PID:6804
- C:\Windows\System\XQiZviE.exe
  C:\Windows\System\XQiZviE.exe
  2⤵
  PID:6820
- C:\Windows\System\BTglACZ.exe
  C:\Windows\System\BTglACZ.exe
  2⤵
  PID:6836
- C:\Windows\System\MjmSKjq.exe
  C:\Windows\System\MjmSKjq.exe
  2⤵
  PID:6852
- C:\Windows\System\eYThHBR.exe
  C:\Windows\System\eYThHBR.exe
  2⤵
  PID:6868
- C:\Windows\System\nhkvihj.exe
  C:\Windows\System\nhkvihj.exe
  2⤵
  PID:6884
- C:\Windows\System\SfCpIMm.exe
  C:\Windows\System\SfCpIMm.exe
  2⤵
  PID:6900
- C:\Windows\System\XfHOzhX.exe
  C:\Windows\System\XfHOzhX.exe
  2⤵
  PID:6916
- C:\Windows\System\ERZZORQ.exe
  C:\Windows\System\ERZZORQ.exe
  2⤵
  PID:6932
- C:\Windows\System\AHhRdjP.exe
  C:\Windows\System\AHhRdjP.exe
  2⤵
  PID:6948
- C:\Windows\System\lSQYpow.exe
  C:\Windows\System\lSQYpow.exe
  2⤵
  PID:6964
- C:\Windows\System\GHEoEhT.exe
  C:\Windows\System\GHEoEhT.exe
  2⤵
  PID:6980
- C:\Windows\System\PYFPgPK.exe
  C:\Windows\System\PYFPgPK.exe
  2⤵
  PID:6996
- C:\Windows\System\JSpiOek.exe
  C:\Windows\System\JSpiOek.exe
  2⤵
  PID:7012
- C:\Windows\System\UcStSOV.exe
  C:\Windows\System\UcStSOV.exe
  2⤵
  PID:7028
- C:\Windows\System\BCGaiwQ.exe
  C:\Windows\System\BCGaiwQ.exe
  2⤵
  PID:7044
- C:\Windows\System\TPkzJsU.exe
  C:\Windows\System\TPkzJsU.exe
  2⤵
  PID:7060
- C:\Windows\System\stCYNFr.exe
  C:\Windows\System\stCYNFr.exe
  2⤵
  PID:7076
- C:\Windows\System\kjjSuVx.exe
  C:\Windows\System\kjjSuVx.exe
  2⤵
  PID:7092
- C:\Windows\System\PturwOi.exe
  C:\Windows\System\PturwOi.exe
  2⤵
  PID:7108
- C:\Windows\System\UjPgWeF.exe
  C:\Windows\System\UjPgWeF.exe
  2⤵
  PID:7124
- C:\Windows\System\qvDrDmQ.exe
  C:\Windows\System\qvDrDmQ.exe
  2⤵
  PID:7140
- C:\Windows\System\zlgsdhT.exe
  C:\Windows\System\zlgsdhT.exe
  2⤵
  PID:7156
- C:\Windows\System\FUzHfWh.exe
  C:\Windows\System\FUzHfWh.exe
  2⤵
  PID:5604
- C:\Windows\System\zuhWIeA.exe
  C:\Windows\System\zuhWIeA.exe
  2⤵
  PID:5544
- C:\Windows\System\CUHJgBr.exe
  C:\Windows\System\CUHJgBr.exe
  2⤵
  PID:6064
- C:\Windows\System\PSTATPN.exe
  C:\Windows\System\PSTATPN.exe
  2⤵
  PID:6212
- C:\Windows\System\mLKqeFJ.exe
  C:\Windows\System\mLKqeFJ.exe
  2⤵
  PID:6260
- C:\Windows\System\vQrrlXg.exe
  C:\Windows\System\vQrrlXg.exe
  2⤵
  PID:6244
- C:\Windows\System\SFGZbhK.exe
  C:\Windows\System\SFGZbhK.exe
  2⤵
  PID:6332
- C:\Windows\System\GwHgqht.exe
  C:\Windows\System\GwHgqht.exe
  2⤵
  PID:6312
- C:\Windows\System\FSqVNQw.exe
  C:\Windows\System\FSqVNQw.exe
  2⤵
  PID:6376
- C:\Windows\System\sOAMBJs.exe
  C:\Windows\System\sOAMBJs.exe
  2⤵
  PID:6408
- C:\Windows\System\QRjAzzv.exe
  C:\Windows\System\QRjAzzv.exe
  2⤵
  PID:6440
- C:\Windows\System\iHQSqJK.exe
  C:\Windows\System\iHQSqJK.exe
  2⤵
  PID:6508
- C:\Windows\System\WvRcyes.exe
  C:\Windows\System\WvRcyes.exe
  2⤵
  PID:6544
- C:\Windows\System\LEEtnBC.exe
  C:\Windows\System\LEEtnBC.exe
  2⤵
  PID:6496
- C:\Windows\System\UKKmCyU.exe
  C:\Windows\System\UKKmCyU.exe
  2⤵
  PID:6588
- C:\Windows\System\mdHNLJz.exe
  C:\Windows\System\mdHNLJz.exe
  2⤵
  PID:6652
- C:\Windows\System\UutnUnm.exe
  C:\Windows\System\UutnUnm.exe
  2⤵
  PID:6604
- C:\Windows\System\JezfbNV.exe
  C:\Windows\System\JezfbNV.exe
  2⤵
  PID:6668
- C:\Windows\System\NjIKXVr.exe
  C:\Windows\System\NjIKXVr.exe
  2⤵
  PID:6716
- C:\Windows\System\PeAIFnb.exe
  C:\Windows\System\PeAIFnb.exe
  2⤵
  PID:6784
- C:\Windows\System\YJHoUGa.exe
  C:\Windows\System\YJHoUGa.exe
  2⤵
  PID:6876
- C:\Windows\System\oZLCGho.exe
  C:\Windows\System\oZLCGho.exe
  2⤵
  PID:6940
- C:\Windows\System\NbHNxsK.exe
  C:\Windows\System\NbHNxsK.exe
  2⤵
  PID:6880
- C:\Windows\System\vgIPijd.exe
  C:\Windows\System\vgIPijd.exe
  2⤵
  PID:7008
- C:\Windows\System\irulFZp.exe
  C:\Windows\System\irulFZp.exe
  2⤵
  PID:7100
- C:\Windows\System\rRhnCaA.exe
  C:\Windows\System\rRhnCaA.exe
  2⤵
  PID:6704
- C:\Windows\System\YWAaAeJ.exe
  C:\Windows\System\YWAaAeJ.exe
  2⤵
  PID:6152
- C:\Windows\System\lUfelcx.exe
  C:\Windows\System\lUfelcx.exe
  2⤵
  PID:6828
- C:\Windows\System\fqaOtRT.exe
  C:\Windows\System\fqaOtRT.exe
  2⤵
  PID:6768
- C:\Windows\System\wpxlxUd.exe
  C:\Windows\System\wpxlxUd.exe
  2⤵
  PID:6960
- C:\Windows\System\goLzJll.exe
  C:\Windows\System\goLzJll.exe
  2⤵
  PID:7152
- C:\Windows\System\ZBQriAp.exe
  C:\Windows\System\ZBQriAp.exe
  2⤵
  PID:6228
- C:\Windows\System\uAKIoUE.exe
  C:\Windows\System\uAKIoUE.exe
  2⤵
  PID:6992
- C:\Windows\System\fkmTpfu.exe
  C:\Windows\System\fkmTpfu.exe
  2⤵
  PID:7056
- C:\Windows\System\xQlZfHo.exe
  C:\Windows\System\xQlZfHo.exe
  2⤵
  PID:7148
- C:\Windows\System\RQCXqTZ.exe
  C:\Windows\System\RQCXqTZ.exe
  2⤵
  PID:6396
- C:\Windows\System\wgDNqBk.exe
  C:\Windows\System\wgDNqBk.exe
  2⤵
  PID:6540
- C:\Windows\System\ZScTgPS.exe
  C:\Windows\System\ZScTgPS.exe
  2⤵
  PID:5380
- C:\Windows\System\wUmrptA.exe
  C:\Windows\System\wUmrptA.exe
  2⤵
  PID:6360
- C:\Windows\System\PeFihuw.exe
  C:\Windows\System\PeFihuw.exe
  2⤵
  PID:6380
- C:\Windows\System\JVsdfTB.exe
  C:\Windows\System\JVsdfTB.exe
  2⤵
  PID:6476
- C:\Windows\System\HsrrppN.exe
  C:\Windows\System\HsrrppN.exe
  2⤵
  PID:6572
- C:\Windows\System\kaZKdkd.exe
  C:\Windows\System\kaZKdkd.exe
  2⤵
  PID:6620
- C:\Windows\System\iaOYoSy.exe
  C:\Windows\System\iaOYoSy.exe
  2⤵
  PID:6780
- C:\Windows\System\didLkvr.exe
  C:\Windows\System\didLkvr.exe
  2⤵
  PID:6912
- C:\Windows\System\moiCVoU.exe
  C:\Windows\System\moiCVoU.exe
  2⤵
  PID:7068
- C:\Windows\System\VcrAyFi.exe
  C:\Windows\System\VcrAyFi.exe
  2⤵
  PID:6860
- C:\Windows\System\ySsDDTs.exe
  C:\Windows\System\ySsDDTs.exe
  2⤵
  PID:6956
- C:\Windows\System\sxXbhkv.exe
  C:\Windows\System\sxXbhkv.exe
  2⤵
  PID:6168
- C:\Windows\System\bhTGzpD.exe
  C:\Windows\System\bhTGzpD.exe
  2⤵
  PID:6412
- C:\Windows\System\mVSfRET.exe
  C:\Windows\System\mVSfRET.exe
  2⤵
  PID:6456
- C:\Windows\System\xSyLNld.exe
  C:\Windows\System\xSyLNld.exe
  2⤵
  PID:6844
- C:\Windows\System\okGDefp.exe
  C:\Windows\System\okGDefp.exe
  2⤵
  PID:7052
- C:\Windows\System\tFdmRdR.exe
  C:\Windows\System\tFdmRdR.exe
  2⤵
  PID:6528
- C:\Windows\System\actANDu.exe
  C:\Windows\System\actANDu.exe
  2⤵
  PID:6576
- C:\Windows\System\YYGeUio.exe
  C:\Windows\System\YYGeUio.exe
  2⤵
  PID:7004
- C:\Windows\System\AbTSGdU.exe
  C:\Windows\System\AbTSGdU.exe
  2⤵
  PID:6700
- C:\Windows\System\ZFyGgfo.exe
  C:\Windows\System\ZFyGgfo.exe
  2⤵
  PID:7072
- C:\Windows\System\sFdGEfD.exe
  C:\Windows\System\sFdGEfD.exe
  2⤵
  PID:6524
- C:\Windows\System\AakgOYO.exe
  C:\Windows\System\AakgOYO.exe
  2⤵
  PID:7176
- C:\Windows\System\OSyYKug.exe
  C:\Windows\System\OSyYKug.exe
  2⤵
  PID:7192
- C:\Windows\System\YNFKRGc.exe
  C:\Windows\System\YNFKRGc.exe
  2⤵
  PID:7208
- C:\Windows\System\hQbEBBc.exe
  C:\Windows\System\hQbEBBc.exe
  2⤵
  PID:7224
- C:\Windows\System\RDaRWSF.exe
  C:\Windows\System\RDaRWSF.exe
  2⤵
  PID:7240
- C:\Windows\System\nOkyLEW.exe
  C:\Windows\System\nOkyLEW.exe
  2⤵
  PID:7256
- C:\Windows\System\rbHOizX.exe
  C:\Windows\System\rbHOizX.exe
  2⤵
  PID:7272
- C:\Windows\System\JZPYUbT.exe
  C:\Windows\System\JZPYUbT.exe
  2⤵
  PID:7288
- C:\Windows\System\wjmvgPK.exe
  C:\Windows\System\wjmvgPK.exe
  2⤵
  PID:7304
- C:\Windows\System\oMnXpeG.exe
  C:\Windows\System\oMnXpeG.exe
  2⤵
  PID:7320
- C:\Windows\System\VieGpCa.exe
  C:\Windows\System\VieGpCa.exe
  2⤵
  PID:7336
- C:\Windows\System\tNIIJLd.exe
  C:\Windows\System\tNIIJLd.exe
  2⤵
  PID:7352
- C:\Windows\System\Ixmgknu.exe
  C:\Windows\System\Ixmgknu.exe
  2⤵
  PID:7368
- C:\Windows\System\sFzCyeA.exe
  C:\Windows\System\sFzCyeA.exe
  2⤵
  PID:7384
- C:\Windows\System\FtRBhGg.exe
  C:\Windows\System\FtRBhGg.exe
  2⤵
  PID:7400
- C:\Windows\System\mtmzfUA.exe
  C:\Windows\System\mtmzfUA.exe
  2⤵
  PID:7416
- C:\Windows\System\YApUdcg.exe
  C:\Windows\System\YApUdcg.exe
  2⤵
  PID:7432
- C:\Windows\System\PLrHoQE.exe
  C:\Windows\System\PLrHoQE.exe
  2⤵
  PID:7452
- C:\Windows\System\ybsGIUr.exe
  C:\Windows\System\ybsGIUr.exe
  2⤵
  PID:7468
- C:\Windows\System\qPUATTT.exe
  C:\Windows\System\qPUATTT.exe
  2⤵
  PID:7484
- C:\Windows\System\vhERcKd.exe
  C:\Windows\System\vhERcKd.exe
  2⤵
  PID:7500
- C:\Windows\System\GGoBsJS.exe
  C:\Windows\System\GGoBsJS.exe
  2⤵
  PID:7516
- C:\Windows\System\EygghjL.exe
  C:\Windows\System\EygghjL.exe
  2⤵
  PID:7532
- C:\Windows\System\KxqhXOd.exe
  C:\Windows\System\KxqhXOd.exe
  2⤵
  PID:7548
- C:\Windows\System\DKVFRNP.exe
  C:\Windows\System\DKVFRNP.exe
  2⤵
  PID:7564
- C:\Windows\System\AhVqNTB.exe
  C:\Windows\System\AhVqNTB.exe
  2⤵
  PID:7580
- C:\Windows\System\nXSDAqD.exe
  C:\Windows\System\nXSDAqD.exe
  2⤵
  PID:7596
- C:\Windows\System\wrILLil.exe
  C:\Windows\System\wrILLil.exe
  2⤵
  PID:7612
- C:\Windows\System\eEWsdfL.exe
  C:\Windows\System\eEWsdfL.exe
  2⤵
  PID:7628
- C:\Windows\System\THJtwjn.exe
  C:\Windows\System\THJtwjn.exe
  2⤵
  PID:7644
- C:\Windows\System\rPrcYda.exe
  C:\Windows\System\rPrcYda.exe
  2⤵
  PID:7660
- C:\Windows\System\BLhqofR.exe
  C:\Windows\System\BLhqofR.exe
  2⤵
  PID:7676
- C:\Windows\System\vqYCoDP.exe
  C:\Windows\System\vqYCoDP.exe
  2⤵
  PID:7692
- C:\Windows\System\xzwNwHw.exe
  C:\Windows\System\xzwNwHw.exe
  2⤵
  PID:7708
- C:\Windows\System\fjwngEC.exe
  C:\Windows\System\fjwngEC.exe
  2⤵
  PID:7724
- C:\Windows\System\TNdBXuw.exe
  C:\Windows\System\TNdBXuw.exe
  2⤵
  PID:7740
- C:\Windows\System\jRaRVME.exe
  C:\Windows\System\jRaRVME.exe
  2⤵
  PID:7756
- C:\Windows\System\dXGJGNZ.exe
  C:\Windows\System\dXGJGNZ.exe
  2⤵
  PID:7776
- C:\Windows\System\ICzgoBt.exe
  C:\Windows\System\ICzgoBt.exe
  2⤵
  PID:7792
- C:\Windows\System\etGsEly.exe
  C:\Windows\System\etGsEly.exe
  2⤵
  PID:7808
- C:\Windows\System\CVTXEka.exe
  C:\Windows\System\CVTXEka.exe
  2⤵
  PID:7828
- C:\Windows\System\UkdiTJn.exe
  C:\Windows\System\UkdiTJn.exe
  2⤵
  PID:7844
- C:\Windows\System\jSqMKoE.exe
  C:\Windows\System\jSqMKoE.exe
  2⤵
  PID:7860
- C:\Windows\System\RmoJtXV.exe
  C:\Windows\System\RmoJtXV.exe
  2⤵
  PID:7876
- C:\Windows\System\EydiGhE.exe
  C:\Windows\System\EydiGhE.exe
  2⤵
  PID:7892
- C:\Windows\System\PrCCIyv.exe
  C:\Windows\System\PrCCIyv.exe
  2⤵
  PID:7912
- C:\Windows\System\eVUbHOi.exe
  C:\Windows\System\eVUbHOi.exe
  2⤵
  PID:7928
- C:\Windows\System\eYsUvLK.exe
  C:\Windows\System\eYsUvLK.exe
  2⤵
  PID:7944
- C:\Windows\System\hyIWRpO.exe
  C:\Windows\System\hyIWRpO.exe
  2⤵
  PID:7960
- C:\Windows\System\LrWrbrj.exe
  C:\Windows\System\LrWrbrj.exe
  2⤵
  PID:7976
- C:\Windows\System\fmqIGnP.exe
  C:\Windows\System\fmqIGnP.exe
  2⤵
  PID:7992
- C:\Windows\System\GtEjQQj.exe
  C:\Windows\System\GtEjQQj.exe
  2⤵
  PID:8008
- C:\Windows\System\wgEBivW.exe
  C:\Windows\System\wgEBivW.exe
  2⤵
  PID:8024
- C:\Windows\System\aXmjydT.exe
  C:\Windows\System\aXmjydT.exe
  2⤵
  PID:8044
- C:\Windows\System\nCuMRxR.exe
  C:\Windows\System\nCuMRxR.exe
  2⤵
  PID:8060
- C:\Windows\System\yOJGcaP.exe
  C:\Windows\System\yOJGcaP.exe
  2⤵
  PID:8076
- C:\Windows\System\lDaBmoo.exe
  C:\Windows\System\lDaBmoo.exe
  2⤵
  PID:8092
- C:\Windows\System\qrVQmPt.exe
  C:\Windows\System\qrVQmPt.exe
  2⤵
  PID:8108
- C:\Windows\System\BMQqFcB.exe
  C:\Windows\System\BMQqFcB.exe
  2⤵
  PID:8124
- C:\Windows\System\ibHhOgC.exe
  C:\Windows\System\ibHhOgC.exe
  2⤵
  PID:8140
- C:\Windows\System\tMaPLzr.exe
  C:\Windows\System\tMaPLzr.exe
  2⤵
  PID:8156
- C:\Windows\System\sqcVJLw.exe
  C:\Windows\System\sqcVJLw.exe
  2⤵
  PID:8172
- C:\Windows\System\SVYKphI.exe
  C:\Windows\System\SVYKphI.exe
  2⤵
  PID:8188
- C:\Windows\System\awezxbf.exe
  C:\Windows\System\awezxbf.exe
  2⤵
  PID:6736
- C:\Windows\System\LfBocaN.exe
  C:\Windows\System\LfBocaN.exe
  2⤵
  PID:7280
- C:\Windows\System\AkmsXuE.exe
  C:\Windows\System\AkmsXuE.exe
  2⤵
  PID:7344
- C:\Windows\System\uvaYDKj.exe
  C:\Windows\System\uvaYDKj.exe
  2⤵
  PID:7440
- C:\Windows\System\bmEeMYG.exe
  C:\Windows\System\bmEeMYG.exe
  2⤵
  PID:240
- C:\Windows\System\EEztiEl.exe
  C:\Windows\System\EEztiEl.exe
  2⤵
  PID:7024
- C:\Windows\System\PLjMSbA.exe
  C:\Windows\System\PLjMSbA.exe
  2⤵
  PID:7540
- C:\Windows\System\slyAyjm.exe
  C:\Windows\System\slyAyjm.exe
  2⤵
  PID:6292
- C:\Windows\System\ZMCjxuD.exe
  C:\Windows\System\ZMCjxuD.exe
  2⤵
  PID:7036
- C:\Windows\System\dlpMHiG.exe
  C:\Windows\System\dlpMHiG.exe
  2⤵
  PID:6732
- C:\Windows\System\yrFOFVS.exe
  C:\Windows\System\yrFOFVS.exe
  2⤵
  PID:7204
- C:\Windows\System\cvjNBBp.exe
  C:\Windows\System\cvjNBBp.exe
  2⤵
  PID:7268
- C:\Windows\System\rnfphVT.exe
  C:\Windows\System\rnfphVT.exe
  2⤵
  PID:7332
- C:\Windows\System\EtjgJHk.exe
  C:\Windows\System\EtjgJHk.exe
  2⤵
  PID:7428
- C:\Windows\System\RPzyydM.exe
  C:\Windows\System\RPzyydM.exe
  2⤵
  PID:7496
- C:\Windows\System\adqTiXn.exe
  C:\Windows\System\adqTiXn.exe
  2⤵
  PID:7560
- C:\Windows\System\BQTjmlB.exe
  C:\Windows\System\BQTjmlB.exe
  2⤵
  PID:7608
- C:\Windows\System\WPUNZHN.exe
  C:\Windows\System\WPUNZHN.exe
  2⤵
  PID:7700
- C:\Windows\System\QpBUcaP.exe
  C:\Windows\System\QpBUcaP.exe
  2⤵
  PID:7736
- C:\Windows\System\WiejGsJ.exe
  C:\Windows\System\WiejGsJ.exe
  2⤵
  PID:7804
- C:\Windows\System\XgnkqMb.exe
  C:\Windows\System\XgnkqMb.exe
  2⤵
  PID:7836
- C:\Windows\System\ydgmxRf.exe
  C:\Windows\System\ydgmxRf.exe
  2⤵
  PID:7904
- C:\Windows\System\hEuQjUT.exe
  C:\Windows\System\hEuQjUT.exe
  2⤵
  PID:7620
- C:\Windows\System\YXlMEoE.exe
  C:\Windows\System\YXlMEoE.exe
  2⤵
  PID:7656
- C:\Windows\System\FNzfuZs.exe
  C:\Windows\System\FNzfuZs.exe
  2⤵
  PID:7748
- C:\Windows\System\CLKLbaN.exe
  C:\Windows\System\CLKLbaN.exe
  2⤵
  PID:7788
- C:\Windows\System\gaoacjK.exe
  C:\Windows\System\gaoacjK.exe
  2⤵
  PID:7856
- C:\Windows\System\EklJGUX.exe
  C:\Windows\System\EklJGUX.exe
  2⤵
  PID:7956
- C:\Windows\System\qxOuLSH.exe
  C:\Windows\System\qxOuLSH.exe
  2⤵
  PID:8000
- C:\Windows\System\WTjxjcF.exe
  C:\Windows\System\WTjxjcF.exe
  2⤵
  PID:8068
- C:\Windows\System\DqPUAZe.exe
  C:\Windows\System\DqPUAZe.exe
  2⤵
  PID:8104
- C:\Windows\System\WdNfzue.exe
  C:\Windows\System\WdNfzue.exe
  2⤵
  PID:8164
- C:\Windows\System\YkuOnxB.exe
  C:\Windows\System\YkuOnxB.exe
  2⤵
  PID:7316
- C:\Windows\System\tlmRFwk.exe
  C:\Windows\System\tlmRFwk.exe
  2⤵
  PID:8056
- C:\Windows\System\TuvpFMc.exe
  C:\Windows\System\TuvpFMc.exe
  2⤵
  PID:6924
- C:\Windows\System\Ikiqydz.exe
  C:\Windows\System\Ikiqydz.exe
  2⤵
  PID:8152
- C:\Windows\System\tMMwzPF.exe
  C:\Windows\System\tMMwzPF.exe
  2⤵
  PID:7252
- C:\Windows\System\DweEvsQ.exe
  C:\Windows\System\DweEvsQ.exe
  2⤵
  PID:7476
- C:\Windows\System\pKwJfKf.exe
  C:\Windows\System\pKwJfKf.exe
  2⤵
  PID:7172
- C:\Windows\System\sANTFne.exe
  C:\Windows\System\sANTFne.exe
  2⤵
  PID:7492
- C:\Windows\System\dUPMYFt.exe
  C:\Windows\System\dUPMYFt.exe
  2⤵
  PID:7704
- C:\Windows\System\yQRlsdp.exe
  C:\Windows\System\yQRlsdp.exe
  2⤵
  PID:7936
- C:\Windows\System\HerouEA.exe
  C:\Windows\System\HerouEA.exe
  2⤵
  PID:7392
- C:\Windows\System\jlDRQOP.exe
  C:\Windows\System\jlDRQOP.exe
  2⤵
  PID:7364
- C:\Windows\System\RqPtwoI.exe
  C:\Windows\System\RqPtwoI.exe
  2⤵
  PID:7556
- C:\Windows\System\rSwiPig.exe
  C:\Windows\System\rSwiPig.exe
  2⤵
  PID:7772
- C:\Windows\System\iZTvcOl.exe
  C:\Windows\System\iZTvcOl.exe
  2⤵
  PID:7652
- C:\Windows\System\ZMyBnaf.exe
  C:\Windows\System\ZMyBnaf.exe
  2⤵
  PID:7852
- C:\Windows\System\WsRthjr.exe
  C:\Windows\System\WsRthjr.exe
  2⤵
  PID:8016
- C:\Windows\System\RzuhoPg.exe
  C:\Windows\System\RzuhoPg.exe
  2⤵
  PID:7920
- C:\Windows\System\wFaNnFh.exe
  C:\Windows\System\wFaNnFh.exe
  2⤵
  PID:8136
- C:\Windows\System\GdGRfDT.exe
  C:\Windows\System\GdGRfDT.exe
  2⤵
  PID:7508
- C:\Windows\System\DnJoMKv.exe
  C:\Windows\System\DnJoMKv.exe
  2⤵
  PID:8052
- C:\Windows\System\cQzHswN.exe
  C:\Windows\System\cQzHswN.exe
  2⤵
  PID:5556
- C:\Windows\System\abfETrc.exe
  C:\Windows\System\abfETrc.exe
  2⤵
  PID:7588
- C:\Windows\System\CgmwRMF.exe
  C:\Windows\System\CgmwRMF.exe
  2⤵
  PID:6428
- C:\Windows\System\rKjcPhA.exe
  C:\Windows\System\rKjcPhA.exe
  2⤵
  PID:8100
- C:\Windows\System\gsCYlnO.exe
  C:\Windows\System\gsCYlnO.exe
  2⤵
  PID:7720
- C:\Windows\System\fDIHYvk.exe
  C:\Windows\System\fDIHYvk.exe
  2⤵
  PID:7264
- C:\Windows\System\bDtVJFt.exe
  C:\Windows\System\bDtVJFt.exe
  2⤵
  PID:7884
- C:\Windows\System\KfNHZYl.exe
  C:\Windows\System\KfNHZYl.exe
  2⤵
  PID:8088
- C:\Windows\System\suYYNsf.exe
  C:\Windows\System\suYYNsf.exe
  2⤵
  PID:7424
- C:\Windows\System\ehztQeR.exe
  C:\Windows\System\ehztQeR.exe
  2⤵
  PID:7528
- C:\Windows\System\neLcbjG.exe
  C:\Windows\System\neLcbjG.exe
  2⤵
  PID:7116
- C:\Windows\System\SXVlrTI.exe
  C:\Windows\System\SXVlrTI.exe
  2⤵
  PID:7312
- C:\Windows\System\DMzmzbv.exe
  C:\Windows\System\DMzmzbv.exe
  2⤵
  PID:8208
- C:\Windows\System\qszhlQn.exe
  C:\Windows\System\qszhlQn.exe
  2⤵
  PID:8224
- C:\Windows\System\FsVrdMv.exe
  C:\Windows\System\FsVrdMv.exe
  2⤵
  PID:8240
- C:\Windows\System\hRRjByD.exe
  C:\Windows\System\hRRjByD.exe
  2⤵
  PID:8260
- C:\Windows\System\FxrRebt.exe
  C:\Windows\System\FxrRebt.exe
  2⤵
  PID:8276
- C:\Windows\System\YPxHBjq.exe
  C:\Windows\System\YPxHBjq.exe
  2⤵
  PID:8292
- C:\Windows\System\kMqkcpj.exe
  C:\Windows\System\kMqkcpj.exe
  2⤵
  PID:8308
- C:\Windows\System\DfwrVzw.exe
  C:\Windows\System\DfwrVzw.exe
  2⤵
  PID:8324
- C:\Windows\System\xcmTLBp.exe
  C:\Windows\System\xcmTLBp.exe
  2⤵
  PID:8340
- C:\Windows\System\MbrUrkt.exe
  C:\Windows\System\MbrUrkt.exe
  2⤵
  PID:8356
- C:\Windows\System\hAHFleM.exe
  C:\Windows\System\hAHFleM.exe
  2⤵
  PID:8372
- C:\Windows\System\lxyMCpE.exe
  C:\Windows\System\lxyMCpE.exe
  2⤵
  PID:8388
- C:\Windows\System\NsTEWAi.exe
  C:\Windows\System\NsTEWAi.exe
  2⤵
  PID:8404
- C:\Windows\System\voeHaaR.exe
  C:\Windows\System\voeHaaR.exe
  2⤵
  PID:8420
- C:\Windows\System\rulMYjJ.exe
  C:\Windows\System\rulMYjJ.exe
  2⤵
  PID:8444
- C:\Windows\System\KeITicP.exe
  C:\Windows\System\KeITicP.exe
  2⤵
  PID:8464
- C:\Windows\System\bCbbXFN.exe
  C:\Windows\System\bCbbXFN.exe
  2⤵
  PID:8480
- C:\Windows\System\JvRrROZ.exe
  C:\Windows\System\JvRrROZ.exe
  2⤵
  PID:8496
- C:\Windows\System\ELqxuBL.exe
  C:\Windows\System\ELqxuBL.exe
  2⤵
  PID:8512
- C:\Windows\System\YeGOaPb.exe
  C:\Windows\System\YeGOaPb.exe
  2⤵
  PID:8528
- C:\Windows\System\qrGuVIz.exe
  C:\Windows\System\qrGuVIz.exe
  2⤵
  PID:8544
- C:\Windows\System\SCrKqdE.exe
  C:\Windows\System\SCrKqdE.exe
  2⤵
  PID:8560
- C:\Windows\System\XeTxhtI.exe
  C:\Windows\System\XeTxhtI.exe
  2⤵
  PID:8576
- C:\Windows\System\tdyiZVr.exe
  C:\Windows\System\tdyiZVr.exe
  2⤵
  PID:8592
- C:\Windows\System\xOJgjmS.exe
  C:\Windows\System\xOJgjmS.exe
  2⤵
  PID:8608
- C:\Windows\System\sZUwUXX.exe
  C:\Windows\System\sZUwUXX.exe
  2⤵
  PID:8624
- C:\Windows\System\ihhuUjX.exe
  C:\Windows\System\ihhuUjX.exe
  2⤵
  PID:8640
- C:\Windows\System\YHIYpdE.exe
  C:\Windows\System\YHIYpdE.exe
  2⤵
  PID:8656
- C:\Windows\System\oxaGMDv.exe
  C:\Windows\System\oxaGMDv.exe
  2⤵
  PID:8672
- C:\Windows\System\LobMbFJ.exe
  C:\Windows\System\LobMbFJ.exe
  2⤵
  PID:8688
- C:\Windows\System\JMVFgHF.exe
  C:\Windows\System\JMVFgHF.exe
  2⤵
  PID:8704
- C:\Windows\System\YYAVzIO.exe
  C:\Windows\System\YYAVzIO.exe
  2⤵
  PID:8720
- C:\Windows\System\OsUanxn.exe
  C:\Windows\System\OsUanxn.exe
  2⤵
  PID:8736
- C:\Windows\System\MaiwsQG.exe
  C:\Windows\System\MaiwsQG.exe
  2⤵
  PID:8752
- C:\Windows\System\GNyMEwa.exe
  C:\Windows\System\GNyMEwa.exe
  2⤵
  PID:8768
- C:\Windows\System\aoUulSN.exe
  C:\Windows\System\aoUulSN.exe
  2⤵
  PID:8784
- C:\Windows\System\NHRmdyw.exe
  C:\Windows\System\NHRmdyw.exe
  2⤵
  PID:8800
- C:\Windows\System\IcaKDZx.exe
  C:\Windows\System\IcaKDZx.exe
  2⤵
  PID:8816
- C:\Windows\System\EYzsHvD.exe
  C:\Windows\System\EYzsHvD.exe
  2⤵
  PID:8832
- C:\Windows\System\KOKXwqR.exe
  C:\Windows\System\KOKXwqR.exe
  2⤵
  PID:8848
- C:\Windows\System\qnjlplz.exe
  C:\Windows\System\qnjlplz.exe
  2⤵
  PID:8864
- C:\Windows\System\roVtXKg.exe
  C:\Windows\System\roVtXKg.exe
  2⤵
  PID:8880
- C:\Windows\System\xbqHZdj.exe
  C:\Windows\System\xbqHZdj.exe
  2⤵
  PID:8896
- C:\Windows\System\lrGXEEq.exe
  C:\Windows\System\lrGXEEq.exe
  2⤵
  PID:8912
- C:\Windows\System\fdpKovE.exe
  C:\Windows\System\fdpKovE.exe
  2⤵
  PID:8928
- C:\Windows\System\wKvYgXJ.exe
  C:\Windows\System\wKvYgXJ.exe
  2⤵
  PID:8944
- C:\Windows\System\wIFhsWB.exe
  C:\Windows\System\wIFhsWB.exe
  2⤵
  PID:8960
- C:\Windows\System\MYIXmwW.exe
  C:\Windows\System\MYIXmwW.exe
  2⤵
  PID:8976
- C:\Windows\System\khaPBxZ.exe
  C:\Windows\System\khaPBxZ.exe
  2⤵
  PID:8992
- C:\Windows\System\UskpiLq.exe
  C:\Windows\System\UskpiLq.exe
  2⤵
  PID:9008
- C:\Windows\System\rWjbQJI.exe
  C:\Windows\System\rWjbQJI.exe
  2⤵
  PID:9024
- C:\Windows\System\UqDbZHW.exe
  C:\Windows\System\UqDbZHW.exe
  2⤵
  PID:9044
- C:\Windows\System\BgpKqCg.exe
  C:\Windows\System\BgpKqCg.exe
  2⤵
  PID:9060
- C:\Windows\System\ADbQjiO.exe
  C:\Windows\System\ADbQjiO.exe
  2⤵
  PID:9076
- C:\Windows\System\VzejDXA.exe
  C:\Windows\System\VzejDXA.exe
  2⤵
  PID:9092
- C:\Windows\System\iqYPmNi.exe
  C:\Windows\System\iqYPmNi.exe
  2⤵
  PID:9108
- C:\Windows\System\nzyOasj.exe
  C:\Windows\System\nzyOasj.exe
  2⤵
  PID:9124
- C:\Windows\System\lUwIHCO.exe
  C:\Windows\System\lUwIHCO.exe
  2⤵
  PID:9140
- C:\Windows\System\OZhYcqC.exe
  C:\Windows\System\OZhYcqC.exe
  2⤵
  PID:9156
- C:\Windows\System\mZbEePX.exe
  C:\Windows\System\mZbEePX.exe
  2⤵
  PID:9172
- C:\Windows\System\FIdCCPo.exe
  C:\Windows\System\FIdCCPo.exe
  2⤵
  PID:9188
- C:\Windows\System\GuwVjOi.exe
  C:\Windows\System\GuwVjOi.exe
  2⤵
  PID:9204
- C:\Windows\System\PcPtbLC.exe
  C:\Windows\System\PcPtbLC.exe
  2⤵
  PID:7624
- C:\Windows\System\TgvPnZZ.exe
  C:\Windows\System\TgvPnZZ.exe
  2⤵
  PID:7824
- C:\Windows\System\KihWRrg.exe
  C:\Windows\System\KihWRrg.exe
  2⤵
  PID:7408
- C:\Windows\System\rQVFgKx.exe
  C:\Windows\System\rQVFgKx.exe
  2⤵
  PID:8236
- C:\Windows\System\vwyGubI.exe
  C:\Windows\System\vwyGubI.exe
  2⤵
  PID:8284
- C:\Windows\System\uVLhLzy.exe
  C:\Windows\System\uVLhLzy.exe
  2⤵
  PID:8300
- C:\Windows\System\YlRKyQy.exe
  C:\Windows\System\YlRKyQy.exe
  2⤵
  PID:8352
- C:\Windows\System\HPaqXIZ.exe
  C:\Windows\System\HPaqXIZ.exe
  2⤵
  PID:8416
- C:\Windows\System\gtjSTLe.exe
  C:\Windows\System\gtjSTLe.exe
  2⤵
  PID:8396
- C:\Windows\System\HNUuMka.exe
  C:\Windows\System\HNUuMka.exe
  2⤵
  PID:7784
- C:\Windows\System\BteENyC.exe
  C:\Windows\System\BteENyC.exe
  2⤵
  PID:8472
- C:\Windows\System\RtubreG.exe
  C:\Windows\System\RtubreG.exe
  2⤵
  PID:8536
- C:\Windows\System\QTSYoMk.exe
  C:\Windows\System\QTSYoMk.exe
  2⤵
  PID:8456
- C:\Windows\System\DdpFldX.exe
  C:\Windows\System\DdpFldX.exe
  2⤵
  PID:8524
- C:\Windows\System\sXxFaXB.exe
  C:\Windows\System\sXxFaXB.exe
  2⤵
  PID:8588
- C:\Windows\System\vhnoKYz.exe
  C:\Windows\System\vhnoKYz.exe
  2⤵
  PID:8652
- C:\Windows\System\EUDYISN.exe
  C:\Windows\System\EUDYISN.exe
  2⤵
  PID:8684
- C:\Windows\System\sPXLdka.exe
  C:\Windows\System\sPXLdka.exe
  2⤵
  PID:8808
- C:\Windows\System\EzeMWeL.exe
  C:\Windows\System\EzeMWeL.exe
  2⤵
  PID:8812
- C:\Windows\System\pvAUUxx.exe
  C:\Windows\System\pvAUUxx.exe
  2⤵
  PID:8936
- C:\Windows\System\soRrXPu.exe
  C:\Windows\System\soRrXPu.exe
  2⤵
  PID:8604
- C:\Windows\System\cWjOIqN.exe
  C:\Windows\System\cWjOIqN.exe
  2⤵
  PID:9068
- C:\Windows\System\sULDgJu.exe
  C:\Windows\System\sULDgJu.exe
  2⤵
  PID:8636
- C:\Windows\System\APuZIiW.exe
  C:\Windows\System\APuZIiW.exe
  2⤵
  PID:9004
- C:\Windows\System\VCSlsVS.exe
  C:\Windows\System\VCSlsVS.exe
  2⤵
  PID:8696
- C:\Windows\System\DwQIDKb.exe
  C:\Windows\System\DwQIDKb.exe
  2⤵
  PID:8892
- C:\Windows\System\oxACVBe.exe
  C:\Windows\System\oxACVBe.exe
  2⤵
  PID:8856
- C:\Windows\System\vkwgqhR.exe
  C:\Windows\System\vkwgqhR.exe
  2⤵
  PID:8924
- C:\Windows\System\ekxDdvs.exe
  C:\Windows\System\ekxDdvs.exe
  2⤵
  PID:8988
- C:\Windows\System\VzfjIYX.exe
  C:\Windows\System\VzfjIYX.exe
  2⤵
  PID:9056
- C:\Windows\System\zikjymi.exe
  C:\Windows\System\zikjymi.exe
  2⤵
  PID:9116
- C:\Windows\System\apSwpKp.exe
  C:\Windows\System\apSwpKp.exe
  2⤵
  PID:9136
- C:\Windows\System\HFRpfLj.exe
  C:\Windows\System\HFRpfLj.exe
  2⤵
  PID:9200
- C:\Windows\System\SDeRtQw.exe
  C:\Windows\System\SDeRtQw.exe
  2⤵
  PID:9180
- C:\Windows\System\rJmubpJ.exe
  C:\Windows\System\rJmubpJ.exe
  2⤵
  PID:8032
- C:\Windows\System\iWKoNTb.exe
  C:\Windows\System\iWKoNTb.exe
  2⤵
  PID:8200
- C:\Windows\System\KoRnRrJ.exe
  C:\Windows\System\KoRnRrJ.exe
  2⤵
  PID:8412
- C:\Windows\System\UMQNclQ.exe
  C:\Windows\System\UMQNclQ.exe
  2⤵
  PID:8348
- C:\Windows\System\hoDFyRN.exe
  C:\Windows\System\hoDFyRN.exe
  2⤵
  PID:8504
- C:\Windows\System\fUZqsFM.exe
  C:\Windows\System\fUZqsFM.exe
  2⤵
  PID:8440
- C:\Windows\System\fxmjbSm.exe
  C:\Windows\System\fxmjbSm.exe
  2⤵
  PID:8520
- C:\Windows\System\wcLbvQV.exe
  C:\Windows\System\wcLbvQV.exe
  2⤵
  PID:8776
- C:\Windows\System\VUqTgwP.exe
  C:\Windows\System\VUqTgwP.exe
  2⤵
  PID:8584
- C:\Windows\System\SANvGXj.exe
  C:\Windows\System\SANvGXj.exe
  2⤵
  PID:8844
- C:\Windows\System\FAYUCaT.exe
  C:\Windows\System\FAYUCaT.exe
  2⤵
  PID:8968
- C:\Windows\System\oRroCnT.exe
  C:\Windows\System\oRroCnT.exe
  2⤵
  PID:8972
- C:\Windows\System\xrEnoOV.exe
  C:\Windows\System\xrEnoOV.exe
  2⤵
  PID:9000
- C:\Windows\System\nmKlPlF.exe
  C:\Windows\System\nmKlPlF.exe
  2⤵
  PID:8888
- C:\Windows\System\GUAPnIn.exe
  C:\Windows\System\GUAPnIn.exe
  2⤵
  PID:9020
- C:\Windows\System\LPWpyfV.exe
  C:\Windows\System\LPWpyfV.exe
  2⤵
  PID:9152
- C:\Windows\System\DwlKzdN.exe
  C:\Windows\System\DwlKzdN.exe
  2⤵
  PID:8956
- C:\Windows\System\EwurVYS.exe
  C:\Windows\System\EwurVYS.exe
  2⤵
  PID:9196
- C:\Windows\System\CaMEQkl.exe
  C:\Windows\System\CaMEQkl.exe
  2⤵
  PID:8384
- C:\Windows\System\IKFgjoX.exe
  C:\Windows\System\IKFgjoX.exe
  2⤵
  PID:8488
- C:\Windows\System\cTNFzFA.exe
  C:\Windows\System\cTNFzFA.exe
  2⤵
  PID:7640
- C:\Windows\System\vNahbew.exe
  C:\Windows\System\vNahbew.exe
  2⤵
  PID:8748
- C:\Windows\System\fnvcycy.exe
  C:\Windows\System\fnvcycy.exe
  2⤵
  PID:8668
- C:\Windows\System\DUresnY.exe
  C:\Windows\System\DUresnY.exe
  2⤵
  PID:8732
- C:\Windows\System\tnoyMRa.exe
  C:\Windows\System\tnoyMRa.exe
  2⤵
  PID:9132
- C:\Windows\System\JWonbES.exe
  C:\Windows\System\JWonbES.exe
  2⤵
  PID:8232
- C:\Windows\System\bagQLFD.exe
  C:\Windows\System\bagQLFD.exe
  2⤵
  PID:8744
- C:\Windows\System\GHPmIJT.exe
  C:\Windows\System\GHPmIJT.exe
  2⤵
  PID:8568
- C:\Windows\System\rsgLXzK.exe
  C:\Windows\System\rsgLXzK.exe
  2⤵
  PID:9100
- C:\Windows\System\ffopVoI.exe
  C:\Windows\System\ffopVoI.exe
  2⤵
  PID:8984
- C:\Windows\System\TTngcyh.exe
  C:\Windows\System\TTngcyh.exe
  2⤵
  PID:8320
- C:\Windows\System\BdgBYMn.exe
  C:\Windows\System\BdgBYMn.exe
  2⤵
  PID:8664
- C:\Windows\System\RGAtTCD.exe
  C:\Windows\System\RGAtTCD.exe
  2⤵
  PID:9228
- C:\Windows\System\EpXTqjt.exe
  C:\Windows\System\EpXTqjt.exe
  2⤵
  PID:9244
- C:\Windows\System\JDWcnXl.exe
  C:\Windows\System\JDWcnXl.exe
  2⤵
  PID:9260
- C:\Windows\System\DOeaDzg.exe
  C:\Windows\System\DOeaDzg.exe
  2⤵
  PID:9276
- C:\Windows\System\AsGDytD.exe
  C:\Windows\System\AsGDytD.exe
  2⤵
  PID:9292
- C:\Windows\System\EJtspyY.exe
  C:\Windows\System\EJtspyY.exe
  2⤵
  PID:9308
- C:\Windows\System\DusuAwp.exe
  C:\Windows\System\DusuAwp.exe
  2⤵
  PID:9324
- C:\Windows\System\krneEvV.exe
  C:\Windows\System\krneEvV.exe
  2⤵
  PID:9340
- C:\Windows\System\cqUbFfi.exe
  C:\Windows\System\cqUbFfi.exe
  2⤵
  PID:9356
- C:\Windows\System\trVlMuq.exe
  C:\Windows\System\trVlMuq.exe
  2⤵
  PID:9372
- C:\Windows\System\gyMfXHc.exe
  C:\Windows\System\gyMfXHc.exe
  2⤵
  PID:9388
- C:\Windows\System\YZOEeIl.exe
  C:\Windows\System\YZOEeIl.exe
  2⤵
  PID:9404
- C:\Windows\System\pMiBWmB.exe
  C:\Windows\System\pMiBWmB.exe
  2⤵
  PID:9420
- C:\Windows\System\VgrNFGl.exe
  C:\Windows\System\VgrNFGl.exe
  2⤵
  PID:9436
- C:\Windows\System\wgvZeAc.exe
  C:\Windows\System\wgvZeAc.exe
  2⤵
  PID:9452
- C:\Windows\System\wTATzVt.exe
  C:\Windows\System\wTATzVt.exe
  2⤵
  PID:9468
- C:\Windows\System\xxnDIqs.exe
  C:\Windows\System\xxnDIqs.exe
  2⤵
  PID:9484
- C:\Windows\System\NARbpYc.exe
  C:\Windows\System\NARbpYc.exe
  2⤵
  PID:9500
- C:\Windows\System\hwnUzXx.exe
  C:\Windows\System\hwnUzXx.exe
  2⤵
  PID:9516
- C:\Windows\System\garAzcF.exe
  C:\Windows\System\garAzcF.exe
  2⤵
  PID:9532
- C:\Windows\System\ktHYPuX.exe
  C:\Windows\System\ktHYPuX.exe
  2⤵
  PID:9548
- C:\Windows\System\sAUUSFd.exe
  C:\Windows\System\sAUUSFd.exe
  2⤵
  PID:9564
- C:\Windows\System\QSZvMcn.exe
  C:\Windows\System\QSZvMcn.exe
  2⤵
  PID:9580
- C:\Windows\System\jyELGoI.exe
  C:\Windows\System\jyELGoI.exe
  2⤵
  PID:9600
- C:\Windows\System\uafTUUB.exe
  C:\Windows\System\uafTUUB.exe
  2⤵
  PID:9616
- C:\Windows\System\txMOiXr.exe
  C:\Windows\System\txMOiXr.exe
  2⤵
  PID:9632
- C:\Windows\System\cXfxKoy.exe
  C:\Windows\System\cXfxKoy.exe
  2⤵
  PID:9648
- C:\Windows\System\XYvVxRY.exe
  C:\Windows\System\XYvVxRY.exe
  2⤵
  PID:9664
- C:\Windows\System\kedpPvu.exe
  C:\Windows\System\kedpPvu.exe
  2⤵
  PID:9680
- C:\Windows\System\GBnAnsZ.exe
  C:\Windows\System\GBnAnsZ.exe
  2⤵
  PID:9696
- C:\Windows\System\ZKVaDGw.exe
  C:\Windows\System\ZKVaDGw.exe
  2⤵
  PID:9712
- C:\Windows\System\lpiFEpn.exe
  C:\Windows\System\lpiFEpn.exe
  2⤵
  PID:9728
- C:\Windows\System\DTSXJYO.exe
  C:\Windows\System\DTSXJYO.exe
  2⤵
  PID:9744
- C:\Windows\System\ioXXXtT.exe
  C:\Windows\System\ioXXXtT.exe
  2⤵
  PID:9760
- C:\Windows\System\kjCuWwI.exe
  C:\Windows\System\kjCuWwI.exe
  2⤵
  PID:9776
- C:\Windows\System\huhnBbB.exe
  C:\Windows\System\huhnBbB.exe
  2⤵
  PID:9792
- C:\Windows\System\SETEUpn.exe
  C:\Windows\System\SETEUpn.exe
  2⤵
  PID:9808
- C:\Windows\System\VAwjnVs.exe
  C:\Windows\System\VAwjnVs.exe
  2⤵
  PID:9824
- C:\Windows\System\fztwVxD.exe
  C:\Windows\System\fztwVxD.exe
  2⤵
  PID:9844
- C:\Windows\System\AVIzaUd.exe
  C:\Windows\System\AVIzaUd.exe
  2⤵
  PID:9868
- C:\Windows\System\ZWSwAef.exe
  C:\Windows\System\ZWSwAef.exe
  2⤵
  PID:9884
- C:\Windows\System\AVUoyUQ.exe
  C:\Windows\System\AVUoyUQ.exe
  2⤵
  PID:9900
- C:\Windows\System\axRmHbs.exe
  C:\Windows\System\axRmHbs.exe
  2⤵
  PID:9916
- C:\Windows\System\vdzKlue.exe
  C:\Windows\System\vdzKlue.exe
  2⤵
  PID:9932
- C:\Windows\System\Qgzfoir.exe
  C:\Windows\System\Qgzfoir.exe
  2⤵
  PID:9948
- C:\Windows\System\fVruOIl.exe
  C:\Windows\System\fVruOIl.exe
  2⤵
  PID:9964
- C:\Windows\System\EaAQYKj.exe
  C:\Windows\System\EaAQYKj.exe
  2⤵
  PID:9980
- C:\Windows\System\IZXjrvY.exe
  C:\Windows\System\IZXjrvY.exe
  2⤵
  PID:9996
- C:\Windows\System\NAOgHln.exe
  C:\Windows\System\NAOgHln.exe
  2⤵
  PID:10012
- C:\Windows\System\sJpYzMQ.exe
  C:\Windows\System\sJpYzMQ.exe
  2⤵
  PID:10028
- C:\Windows\System\utriAoK.exe
  C:\Windows\System\utriAoK.exe
  2⤵
  PID:10044
- C:\Windows\System\QvAzUzb.exe
  C:\Windows\System\QvAzUzb.exe
  2⤵
  PID:10060
- C:\Windows\System\AaYTwRd.exe
  C:\Windows\System\AaYTwRd.exe
  2⤵
  PID:10076
- C:\Windows\System\wvHOvjv.exe
  C:\Windows\System\wvHOvjv.exe
  2⤵
  PID:10092
- C:\Windows\System\WMZiEIS.exe
  C:\Windows\System\WMZiEIS.exe
  2⤵
  PID:10108
- C:\Windows\System\FehgOdb.exe
  C:\Windows\System\FehgOdb.exe
  2⤵
  PID:10128
- C:\Windows\System\PJSzwJw.exe
  C:\Windows\System\PJSzwJw.exe
  2⤵
  PID:10144
- C:\Windows\System\GpNJeGh.exe
  C:\Windows\System\GpNJeGh.exe
  2⤵
  PID:10160
- C:\Windows\System\NeFbpdl.exe
  C:\Windows\System\NeFbpdl.exe
  2⤵
  PID:10176
- C:\Windows\System\AHnbsSG.exe
  C:\Windows\System\AHnbsSG.exe
  2⤵
  PID:10192
- C:\Windows\System\XgmtscM.exe
  C:\Windows\System\XgmtscM.exe
  2⤵
  PID:10208
- C:\Windows\System\ifXpLuf.exe
  C:\Windows\System\ifXpLuf.exe
  2⤵
  PID:10224
- C:\Windows\System\LjQtvtn.exe
  C:\Windows\System\LjQtvtn.exe
  2⤵
  PID:9240
- C:\Windows\System\yoAvogy.exe
  C:\Windows\System\yoAvogy.exe
  2⤵
  PID:8552
- C:\Windows\System\rWkdsNR.exe
  C:\Windows\System\rWkdsNR.exe
  2⤵
  PID:9072
- C:\Windows\System\loaecjA.exe
  C:\Windows\System\loaecjA.exe
  2⤵
  PID:9252
- C:\Windows\System\SxBjsBH.exe
  C:\Windows\System\SxBjsBH.exe
  2⤵
  PID:9332
- C:\Windows\System\QFpVRHw.exe
  C:\Windows\System\QFpVRHw.exe
  2⤵
  PID:9348
- C:\Windows\System\aKZAJod.exe
  C:\Windows\System\aKZAJod.exe
  2⤵
  PID:9396
- C:\Windows\System\abvLruM.exe
  C:\Windows\System\abvLruM.exe
  2⤵
  PID:9380
- C:\Windows\System\mxFtKRJ.exe
  C:\Windows\System\mxFtKRJ.exe
  2⤵
  PID:9444
- C:\Windows\System\mrdWzvw.exe
  C:\Windows\System\mrdWzvw.exe
  2⤵
  PID:9492
- C:\Windows\System\jcCxGWt.exe
  C:\Windows\System\jcCxGWt.exe
  2⤵
  PID:9528
- C:\Windows\System\iuKRnWN.exe
  C:\Windows\System\iuKRnWN.exe
  2⤵
  PID:9540
- C:\Windows\System\iovLdbe.exe
  C:\Windows\System\iovLdbe.exe
  2⤵
  PID:9592
- C:\Windows\System\VHHaMee.exe
  C:\Windows\System\VHHaMee.exe
  2⤵
  PID:9612
- C:\Windows\System\DdCeiWV.exe
  C:\Windows\System\DdCeiWV.exe
  2⤵
  PID:9660
- C:\Windows\System\Unpvcaw.exe
  C:\Windows\System\Unpvcaw.exe
  2⤵
  PID:9640
- C:\Windows\System\HgTsdCR.exe
  C:\Windows\System\HgTsdCR.exe
  2⤵
  PID:9752
- C:\Windows\System\yrkrxLt.exe
  C:\Windows\System\yrkrxLt.exe
  2⤵
  PID:9708
- C:\Windows\System\FLEYGWo.exe
  C:\Windows\System\FLEYGWo.exe
  2⤵
  PID:9772
- C:\Windows\System\ZVehfte.exe
  C:\Windows\System\ZVehfte.exe
  2⤵
  PID:9804
- C:\Windows\System\QLoWDbV.exe
  C:\Windows\System\QLoWDbV.exe
  2⤵
  PID:9588
- C:\Windows\System\AgtlINE.exe
  C:\Windows\System\AgtlINE.exe
  2⤵
  PID:9856
- C:\Windows\System\BhZYqNA.exe
  C:\Windows\System\BhZYqNA.exe
  2⤵
  PID:9892
- C:\Windows\System\CLQXPBo.exe
  C:\Windows\System\CLQXPBo.exe
  2⤵
  PID:9928
- C:\Windows\System\NwRPGmn.exe
  C:\Windows\System\NwRPGmn.exe
  2⤵
  PID:9972
- C:\Windows\System\svYCLrt.exe
  C:\Windows\System\svYCLrt.exe
  2⤵
  PID:9976
- C:\Windows\System\AQTqEpa.exe
  C:\Windows\System\AQTqEpa.exe
  2⤵
  PID:10052
- C:\Windows\System\jymTvYL.exe
  C:\Windows\System\jymTvYL.exe
  2⤵
  PID:10004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CGOutuc.exe

Filesize
2.3MB

MD5
643f89d31175522c6e46b1132fc3c3a0

SHA1
7548398c54e3e4bc608734c70091a47f6889efcc

SHA256
9ae4f99ae31f2b8aa33a3826e67d1945282ce3f377f665a28c59bf02af737055

SHA512
fd4e16f2087cc018cb0bc180364dfc6b51bb5b4877e3a775679f1542e4f1672bf14c56dcef7e82de65fdb0e03281f65fb2fe343919caf99c34b50885ca788731

Download Submit
C:\Windows\system\FtqDGGq.exe

Filesize
2.3MB

MD5
dd5b8c92a8e2b2a6ad344889e0fafa8e

SHA1
91c09e3f56b5ae9d87c1f0f7b0ece879d98e1e67

SHA256
da3bf7d0191004ad895c5802c518010798090045c238f881fc27a7614da83d46

SHA512
ea06ae63054eb6e0e223619f8c1ef6321ab99e307a942165f1de2661bb3b44a4c46bc9363f10539cbd812107fd5e6f25cec588df5056977701b54d014f117ac8

Download Submit
C:\Windows\system\HXHDjKL.exe

Filesize
2.3MB

MD5
21b0e0264e26d3db4ba6e2bf3b5a288c

SHA1
397a8cf3b8453e339ef407949330cfbfde12a363

SHA256
e5a05fbee17e3fd9589cc1caf99d89bc9f3ae3d0fe3a03b324995a8d5347671f

SHA512
d05efbdbfd1b1f8ff9f93e3713b8b840f1b2d0e765a395b0799a9097ac60e4a7a7e2610c6b23e5830b742b5406e20ca9f8bb985ec6e4673bed8becc48e263b98

Download Submit
C:\Windows\system\IdEHlrA.exe

Filesize
2.3MB

MD5
1881c908a4fef43a757a8b794b23f680

SHA1
6a6995e6c23347e70ea14362061aa8ac2bb2d115

SHA256
0e977d4e447fe0ad267f84a1b5253484f8d64bca078d5055170137e9cc43df98

SHA512
50cfd0dd239899cb803e54dde3aa72a2c4f1effe03eb2914a6bed2ef3f0f61272956326e0443a8d680d5248611dccf0d7a471a01f836ae1c0ade9a97180c4274

Download Submit
C:\Windows\system\IdICtfd.exe

Filesize
2.3MB

MD5
76a75369f542767ffee4ab236607a030

SHA1
33adbc22599ab9aff8e79827e2991a78f31bf485

SHA256
fcde5fb1d2a152f51e1588ad9fc6c522e7f43f58153463f5448a0ae390d40e23

SHA512
1af3a0b402fc551a7199a2c069dd4dab59a82ca2f680f0bec177864eba223840a223ec8b4d4ae150542e56641ae9953ac6c7f039bbdb8d847cb279c87289f78d

Download Submit
C:\Windows\system\MYggBuE.exe

Filesize
2.3MB

MD5
235438315b708792cc7d6b6fd4a88da1

SHA1
b440d861fdc9b96acf74ed0ccc5fcee011573db7

SHA256
ab9cfce8ca3f8b37938a78d118eae27caa31533c992a29b6e65a63bc546e5bf0

SHA512
697937e8d4ac1e706ae019df53bf5a61a8c1624c678298647922c8b410310f6e7faf4fd65f6301367fca6330bd4d0b9389b26769b7747b5ac5aca898a688dc3a

Download Submit
C:\Windows\system\QoOPXBQ.exe

Filesize
2.3MB

MD5
9cb7eebfc61e4aa2f565879e5ced329c

SHA1
9ebbc2a3f6950adb14f49c82f2d8a535374686f8

SHA256
eca44bafc49d1cdfb8c56c5a64f4233193f653091101afa170e5fde10c4ad20f

SHA512
d37ce0656f661ee4b49301a89d9e0f9ea822212331eee4f415aa79d288e0f5b34f8b15491f3c40edaf0837f361f5ea74c74cb218a708b270fc21bd1d53b523cf

Download Submit
C:\Windows\system\RSHTHHt.exe

Filesize
2.3MB

MD5
be0b7150e0eb693ff937b51909a8d939

SHA1
d37ea81f6e10569a58100973ee2e1a0afe449ed4

SHA256
fc50d210927f914d92a8908c2a2a82110e6d008cfbae733355e4d59c1049297b

SHA512
6315407ba058338802d353e6f8a4a09cbe29a83fe36ebb2ba4bcfdec6f92ba370689b5af52af4dd9db44732ce3be125097b05cdae5415989a827041a7c8a3a71

Download Submit
C:\Windows\system\Slowqvc.exe

Filesize
2.3MB

MD5
2a7aa747fbe0bfa44f37d28644de3deb

SHA1
4c39db02b9dfb4d1822e06a82533435d907fed24

SHA256
0551b3c2ff7c7b6f415439697669c69149d15d86464d87e5a0167175218d9ee9

SHA512
998d1336ee1fd5dc21a53c88a70099ec652ce4fa5a36bead9fdc57db2723d6819aafdb109e109d7ae847ec4618418ed615c427151c1fa298af6dba0a44a11275

Download Submit
C:\Windows\system\UtRujLG.exe

Filesize
2.3MB

MD5
b9a5aaff193dd659ca9119c6dc45f2ae

SHA1
02db6257c4b0c536ef9fda9672baf7bdff5730f3

SHA256
7b52bc07a38f9b6a00672185f2b783680876093d5d040338fdd1bf395cca7c1b

SHA512
dd80420f16fe68973d9479add0425b396155e39b7e42b1904b520130941b348bd7a708c7f1bd905f954f6a673486e3d87021d111bf82d95f969e5e3cdd8aaf52

Download Submit
C:\Windows\system\VxRFXXK.exe

Filesize
2.3MB

MD5
f0e8ea22ff6c494db6d4bc703f19b6e4

SHA1
95a83687e22d8a84554eba276f431de8522f670b

SHA256
9b296278cd9bfc525b7ba079eba0b1371b575329e9b809717727df5ee7dc2188

SHA512
272ac3802f0a78696663f00dbb38998f4f6e9e5220bffcf5bac377e4648614c7024c04ef3b4732d476d9a47d00ef45132ed5ed58dc667bbb5571c33e11a7d499

Download Submit
C:\Windows\system\XyQzIVa.exe

Filesize
2.3MB

MD5
394e473718c7af440633bc799f5b29a1

SHA1
b0e21df53593524c42b8ea6655fe9844b52bb87d

SHA256
d8472d6ec6b961e8dc82a81c3e633aa586ede16fbe174de3ef328e211df4416f

SHA512
29eb57a3da8abce8862c3c519d969da51064a69378e1b9716d5269c55ebcf7213e09c68fcfa61f1e895352733b5cbab215d37b77e664820b426ef865d97fa300

Download Submit
C:\Windows\system\aUDxHel.exe

Filesize
2.3MB

MD5
7ac91341cc460a9e2ce893588ff4fb5e

SHA1
cefb89cf6bb092b74b4ebdb226377859ea609cd4

SHA256
eb851f933c9eb4bc171f9dee8fa1d2ad2c82e23a7996478688b78a5be2aa6339

SHA512
5ae014b9977c94d0a95d299096cb70ea91f179d9700c70bbc4c9355fa04fd9e1ecddb8a86b0b0d1f4fac8466e64fac1017ce2578c38e2a5daf925c6e20b15316

Download Submit
C:\Windows\system\bOuGxMH.exe

Filesize
2.3MB

MD5
774e71ced526486676f8bf55130275a7

SHA1
5cd73f33ccd153590baa83ce3b1abc2ee75e442d

SHA256
8ebc315f9cb5ce74395e6cf392e6aa809f330b2ea5b812eb4ab0d2baa083724a

SHA512
fcec0dbe09e80b747cc7a4ac7434d08d8b091fcea53b3a91e5b810d710d6ed6b362072c8d686f9287bb61abef7c345a7b7b17af7b43b8d30e582a12435ff6c22

Download Submit
C:\Windows\system\bwPkGiY.exe

Filesize
2.3MB

MD5
a64db3e5206eb3ddecd3c7c472e73f0b

SHA1
8f6adb0880525386e58e93d5d48a76ef3cbd1e98

SHA256
c37e51d552c3e89d1c2f7a70e8f6140ae8534a123b19f2b1ed9e1de62ba66704

SHA512
85b79739937174b4b7deb81de1f97c77b018c77ffcb09fab2ad929cd687cd044a007a79ce85d7d195531070bfa93f230ac4ba115934c00d1496b72074bc11ec4

Download Submit
C:\Windows\system\cQjHIbq.exe

Filesize
2.3MB

MD5
041a2f8d1501c2cbf59296447a09e287

SHA1
890f9a1f6d911f92709ea668d40d3c799c098bfa

SHA256
512d9c3341d71d2b692fc83b10cf7f668370e7bb53b03af23cb9c5288824b5ec

SHA512
46f7e58cb922e904a7ca7e3d6debadd22e38a7d5297ddda7f1825a44184a4b9b8991eceb74dcb375f279a060eb30ac301b2690fcfca84829670c21b191e6accd

Download Submit
C:\Windows\system\hUJWOHN.exe

Filesize
2.3MB

MD5
bde15262b3280d0852cd16b2b65989a8

SHA1
f5479131a861b4e06537e57ea966fad61f455dbf

SHA256
95eb427d00548a65fdc9b307e539e3a4a0a7fafa3019ff476cb0c5f7dbcd7a2e

SHA512
23c86b0250c6d911c7670941a6bb953e435b47ddb30b1691b8c82abbf2ed1c8867a004eda91749a66e72e5ef05f48c31ac62b7b99b162740a28e98c7c49674e0

Download Submit
C:\Windows\system\imLMjJp.exe

Filesize
2.3MB

MD5
da8921cf7463a8a755b757b09a63ec8c

SHA1
4145a08c239832b14ac8007c01ad0991e9c85513

SHA256
c61a8f299f1a238226b0d002d524a22bc3683006d7d0459fb4aba0f62663ffb4

SHA512
cd94ddfeaaac96a113aa6f4ab3d1a1f84c9199e7cc05481993a55ec9951159d561ce24a26b0f4a92b58d32caad9f597c23835aba9fdd5a327c2d5fffdf9f867a

Download Submit
C:\Windows\system\jlVyguQ.exe

Filesize
2.3MB

MD5
5e4f58af215b28a1745a270d4bd0d82c

SHA1
fc794752a63fbb1e9530fa7e069e01f05fa1256d

SHA256
3f3bf325e9e82829398719738abe7399abf9643fde16936603993b7e598adc90

SHA512
e68af708db7a08ccaf0165c36700d37c124a8dbadba5d68d404b74dc059e22137f5d75e80fe466517125024c8e4577e71be3d83099038331b03ccbef90769a26

Download Submit
C:\Windows\system\kUlHCIO.exe

Filesize
2.3MB

MD5
f94dd1e30b245b873d81c899f8c36677

SHA1
4346ca78d99dba4ed0c14e202b19530f169342b8

SHA256
540fa3f9810819875a084bebd0f935a47bf4c75999a2ed09815f6a42f77896f3

SHA512
54f54238097b177f4e36f42e13d783a276cf569b7c6e4459513c3a20cfdc823f349de0ea4b7482be34799b9085fdc61bc166dc89885538f82ab3e27bc3786c18

Download Submit
C:\Windows\system\lDAjlpJ.exe

Filesize
2.3MB

MD5
3a6fabcf910c78199edf08be60af40c3

SHA1
02d1c75cc0c31119d4a484b29b385f3d79292c53

SHA256
b0dc9cf380d3085daf8d590b00ef7a72e11f41e8ba227822fa8c7fafb6a87c55

SHA512
ce2ad7d970101a47d502508c4ffda2d7d90c7c275d983f53317fc4a3e1b8d1b4121bd2ae564d334646485ec97cdf0b37644c2e13bb4510c2c997364f47e10224

Download Submit
C:\Windows\system\oQzjtGQ.exe

Filesize
2.3MB

MD5
7111a545081e186d836c31701d3962d7

SHA1
8db81d40413e3652dd668deae18b1a01794f0685

SHA256
3d8f664cb97a82ef72cc35a31e3168fd570f967de0d3a7377b7c868311f5e758

SHA512
343a93cef86823018143798031ea40baec55834c05981d0520eccf684b9ddc39cd148647c0438e839a6ed7ac029c77533992648ca0c73037cecdbd13fca58667

Download Submit
C:\Windows\system\pTQqoDf.exe

Filesize
2.3MB

MD5
66b76adf36025b94f8e913f2515e8747

SHA1
26e21a7ea2166c7721be6defe0927f30d6490479

SHA256
58a4e50ba1cf4b9c59d2a0f0e3a7736140d190aaa198e1ccdf225b5871b20890

SHA512
904bc1a95b09351fe160ad0ac3bdc412172d4b08ce839e26a8a52b51fb4f492cc9b2d35a1ac1023d51848230ff928429f10133247ec991cf42699505a72b7857

Download Submit
C:\Windows\system\qLDssQI.exe

Filesize
2.3MB

MD5
d5489e7d248d07379ac205b15790dd3c

SHA1
1ab14ca4e4fc724e26a25e91a7ed89f7e0893314

SHA256
f197b55f5ab85ae5e5f24e79e62081af4eee7d4066206ef32ed113cb1f3e9d2c

SHA512
00acff1fa1dfc10d7bdb51d066c8e9b82cf1866a2181afbb0c32b30fc67e934b43e5363f996fd71b7c49e525731317aadb616b5eafa212dba0f99e90d41b9e3d

Download Submit
C:\Windows\system\sBrWIHE.exe

Filesize
2.3MB

MD5
bf461d4385b30febae6e881bed9014d7

SHA1
f29c633aacb55c7b9beb63f5361358a8d7d23294

SHA256
ffd562985350a8dcc2e087f264b740204190283764b807fe04c82f6d1a1559c9

SHA512
3390b0f9202d1ccec8cb6fd5d1118f4b08487cd05619e170e43894b52f71fb13e465cb83466feb6c95ddfeaeb32a15b41e868c3ceaf545010a217f9cdcbde54e

Download Submit
C:\Windows\system\vmqTJQb.exe

Filesize
2.3MB

MD5
7eb07114f6d88bb011782dfeb1454fae

SHA1
77ff704d8d64043a6b88b1092a68368823304330

SHA256
f975a7509cda1c5f8c9c17c823d4900120ad5102cd64156ca23f6c202b0cfecf

SHA512
9296e15b0e815e0d1874674d99556d253d0e0b3ef1b390d5ffb9d8274aab32f9fa92bf82f2138a2fccfcd5c4d58f7886a515505225716a3b23e19470700eb20d

Download Submit
C:\Windows\system\wXgIzSb.exe

Filesize
2.3MB

MD5
f56f36063d9caaa66e93f92513ea5e2b

SHA1
fbd2f1de304577d1000b493257a2c43818a6403b

SHA256
d8d81cce422e9d1c33aeef28f4ff59a9713326a1b7070908143e237cda764416

SHA512
373614d4ee91c0e3244937d80f9d8282761a627e7578b40699a2acbd0fef820b14de482d291f20439687d067b0cc819f6c8c3bfd4aef52f2f9f7249460ef6921

Download Submit
C:\Windows\system\wqvfKzG.exe

Filesize
2.3MB

MD5
9f0b58ce9f0c89691d019416a9f2cc55

SHA1
4c2e89b2e686b6a9ee723b36c76dfc4cfba1d20f

SHA256
7e06e19352e476e4683c47896eb16507ffee9385236e0d49ec72429afc17d0b5

SHA512
82373e62d3c5487c05a490ac33c5a0813b4b37dbb564e25c2e7bb94f3f957012db69189ff8dc8e1904d4288dc236729e110765737e34ebd7c13a3319bf83e4d0

Download Submit
\Windows\system\CsLlxVH.exe

Filesize
2.3MB

MD5
c09f6fd329f9f613c568e50e39cb3433

SHA1
64a9e39e82144291f6554a743f44ce7138fb1eb8

SHA256
a2ef343b5cdeb2171f114c03360e98b47532b9b956e109949eb89a8a4f3973e4

SHA512
a5c3219d295f914fa9745970acb5b2a52b2eea4f4b8a0eb5807335dbe50d24ee7a55f2a0c50322224bf1e43a3bab30b4f759ec98544b517427111e768f9e32af

Download Submit
\Windows\system\EElgYYx.exe

Filesize
2.3MB

MD5
e3203ef3ae76198a0df673766484e4f6

SHA1
969e7afc10fadd7cdc2c08a41e81f5698e596725

SHA256
417594901421f53a6eef6d1b5ed50f8b076b28258454cb93ceb84c398f758564

SHA512
921c50a1d62ae45abec93cb8ba97b28f544b86ac77b8f70e62de829536e6aecfd1a43bf57edd85d0fb43212a28684d28a14f43dbf6b63bf1e3c7b7d00db586bc

Download Submit
\Windows\system\NnFOtbc.exe

Filesize
2.3MB

MD5
9c47671c5f9f65d367c63ecc118276fe

SHA1
bc6c38002fefc17c1749161e4f84fb638c932268

SHA256
1fe4d4c76d8ebef7379794886d523d6c16fed88f232ffc9804763e1996d423cd

SHA512
bef329e0924bde979706793118f8a92a5f55f8edeaadd24aeffcce251f79f73e4d2b0af3f531e035134db6e71acdee205c6f14c054930da61c91b04d98092aea

Download Submit
\Windows\system\wWsbFNp.exe

Filesize
2.3MB

MD5
a008334a924aa113b424b209bfdbad83

SHA1
5a6ab932ded4d134f9893bcd76cb45d76c7a913e

SHA256
1b7dc6809812c2ae317067069387a10ea9ac583220ffb87b245d060e4b0a7dc4

SHA512
2c1778ce1d8b9b7cc559a358c4a929bd0aac97bd6b7c7125b0d1745c7c8ae28e6df92c378a3adc0930bcf7e912c879b9a664f3041200f94e70c2b7a896ebd373

Download Submit
memory/1468-123-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/1468-3271-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/2396-3276-0x000000013F180000-0x000000013F4D4000-memory.dmp

Filesize
3.3MB

Download
memory/2396-70-0x000000013F180000-0x000000013F4D4000-memory.dmp

Filesize
3.3MB

Download
memory/2428-68-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2428-3272-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2448-3249-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2448-87-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2480-36-0x000000013F8E0000-0x000000013FC34000-memory.dmp

Filesize
3.3MB

Download
memory/2480-3255-0x000000013F8E0000-0x000000013FC34000-memory.dmp

Filesize
3.3MB

Download
memory/2524-42-0x000000013F5B0000-0x000000013F904000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3273-0x000000013F5B0000-0x000000013F904000-memory.dmp

Filesize
3.3MB

Download
memory/2532-43-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2532-3274-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2548-3247-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2548-53-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2644-37-0x000000013F7C0000-0x000000013FB14000-memory.dmp

Filesize
3.3MB

Download
memory/2644-3257-0x000000013F7C0000-0x000000013FB14000-memory.dmp

Filesize
3.3MB

Download
memory/2800-3246-0x000000013F110000-0x000000013F464000-memory.dmp

Filesize
3.3MB

Download
memory/2800-110-0x000000013F110000-0x000000013F464000-memory.dmp

Filesize
3.3MB

Download
memory/2876-19-0x000000013F4B0000-0x000000013F804000-memory.dmp

Filesize
3.3MB

Download
memory/2876-101-0x000000013F1F0000-0x000000013F544000-memory.dmp

Filesize
3.3MB

Download
memory/2876-74-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-35-0x000000013F8E0000-0x000000013FC34000-memory.dmp

Filesize
3.3MB

Download
memory/2876-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2876-33-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2876-30-0x000000013F7C0000-0x000000013FB14000-memory.dmp

Filesize
3.3MB

Download
memory/2876-90-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-93-0x000000013FE30000-0x0000000140184000-memory.dmp

Filesize
3.3MB

Download
memory/2876-80-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-63-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-0-0x000000013FE30000-0x0000000140184000-memory.dmp

Filesize
3.3MB

Download
memory/2876-49-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-118-0x000000013F090000-0x000000013F3E4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-7-0x000000013F540000-0x000000013F894000-memory.dmp

Filesize
3.3MB

Download
memory/2876-131-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-127-0x000000013F780000-0x000000013FAD4000-memory.dmp

Filesize
3.3MB

Download
memory/2880-3275-0x000000013F4B0000-0x000000013F804000-memory.dmp

Filesize
3.3MB

Download
memory/2880-34-0x000000013F4B0000-0x000000013F804000-memory.dmp

Filesize
3.3MB

Download
memory/3036-3256-0x000000013F540000-0x000000013F894000-memory.dmp

Filesize
3.3MB

Download
memory/3036-12-0x000000013F540000-0x000000013F894000-memory.dmp

Filesize
3.3MB

Download
memory/3036-133-0x000000013F540000-0x000000013F894000-memory.dmp

Filesize
3.3MB

Download