xmrig | 74a495b1e42539f4fc199507e4aba19fbc61c80e1931ad4699646be06fee9596

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
Size

2.1MB
MD5

77376d0145b2ba5a4a30bdaeedd82640
SHA1

0668d403116a67cef96503c8c690df5173a65e8e
SHA256

74a495b1e42539f4fc199507e4aba19fbc61c80e1931ad4699646be06fee9596
SHA512

8a4c2360f560ab79aeddb50973353c065bcb78b5fac99a23fc067d1f0f7b2982381fb49747c37c9f9ecc3543ba6495e76231bba5e2c5655408253f9ae9460da0
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNU6ff91f2x:oemTLkNdfE0pZrQH

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral1/files/0x0038000000013362-6.dat	xmrig
behavioral1/files/0x00060000000145c9-36.dat	xmrig
behavioral1/files/0x0008000000013a65-16.dat	xmrig
behavioral1/memory/2844-82-0x000000013FDC0000-0x0000000140114000-memory.dmp	xmrig
behavioral1/memory/2804-81-0x000000013F7D0000-0x000000013FB24000-memory.dmp	xmrig
behavioral1/files/0x0006000000014a29-125.dat	xmrig
behavioral1/files/0x000600000001543a-145.dat	xmrig
behavioral1/files/0x0006000000015ca9-186.dat	xmrig
behavioral1/files/0x0006000000015c9b-180.dat	xmrig
behavioral1/files/0x0006000000015c91-174.dat	xmrig
behavioral1/files/0x0006000000015bb5-170.dat	xmrig
behavioral1/files/0x0006000000015b72-165.dat	xmrig
behavioral1/files/0x0006000000015b37-160.dat	xmrig
behavioral1/files/0x0006000000015a15-155.dat	xmrig
behavioral1/files/0x00060000000155e8-150.dat	xmrig
behavioral1/files/0x000600000001523e-140.dat	xmrig
behavioral1/files/0x000600000001475f-124.dat	xmrig
behavioral1/files/0x0006000000015077-122.dat	xmrig
behavioral1/files/0x0006000000014730-115.dat	xmrig
behavioral1/files/0x00060000000145d4-113.dat	xmrig
behavioral1/files/0x0006000000014525-110.dat	xmrig
behavioral1/files/0x0006000000014d0f-107.dat	xmrig
behavioral1/memory/2032-98-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/memory/2548-97-0x000000013FF40000-0x0000000140294000-memory.dmp	xmrig
behavioral1/memory/2780-95-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/memory/3032-94-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
behavioral1/memory/2016-90-0x000000013FBE0000-0x000000013FF34000-memory.dmp	xmrig
behavioral1/memory/2028-88-0x00000000020A0000-0x00000000023F4000-memory.dmp	xmrig
behavioral1/memory/2580-87-0x000000013FB10000-0x000000013FE64000-memory.dmp	xmrig
behavioral1/files/0x00060000000150aa-129.dat	xmrig
behavioral1/files/0x00060000000146a7-59.dat	xmrig
behavioral1/files/0x00090000000134f5-56.dat	xmrig
behavioral1/files/0x0006000000014fac-118.dat	xmrig
behavioral1/files/0x0008000000013f4b-24.dat	xmrig
behavioral1/files/0x0008000000013a15-20.dat	xmrig
behavioral1/files/0x0006000000014c0b-102.dat	xmrig
behavioral1/memory/2716-76-0x000000013F900000-0x000000013FC54000-memory.dmp	xmrig
behavioral1/files/0x00060000000148af-75.dat	xmrig
behavioral1/files/0x000600000001474b-74.dat	xmrig
behavioral1/memory/2712-73-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/files/0x000d00000001227f-49.dat	xmrig
behavioral1/memory/3020-47-0x000000013FBB0000-0x000000013FF04000-memory.dmp	xmrig
behavioral1/files/0x000800000001451d-38.dat	xmrig
behavioral1/files/0x0008000000013a85-37.dat	xmrig
behavioral1/memory/2028-2-0x000000013F980000-0x000000013FCD4000-memory.dmp	xmrig
behavioral1/memory/2028-2763-0x000000013F980000-0x000000013FCD4000-memory.dmp	xmrig
behavioral1/memory/2580-3040-0x000000013FB10000-0x000000013FE64000-memory.dmp	xmrig
behavioral1/memory/2016-3998-0x000000013FBE0000-0x000000013FF34000-memory.dmp	xmrig
behavioral1/memory/3020-3999-0x000000013FBB0000-0x000000013FF04000-memory.dmp	xmrig
behavioral1/memory/3032-4003-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
behavioral1/memory/2804-4004-0x000000013F7D0000-0x000000013FB24000-memory.dmp	xmrig
behavioral1/memory/2712-4002-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/memory/2032-4001-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/memory/2716-4000-0x000000013F900000-0x000000013FC54000-memory.dmp	xmrig
behavioral1/memory/2780-4006-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/memory/2844-4005-0x000000013FDC0000-0x0000000140114000-memory.dmp	xmrig
behavioral1/memory/2548-4007-0x000000013FF40000-0x0000000140294000-memory.dmp	xmrig
behavioral1/memory/2580-4008-0x000000013FB10000-0x000000013FE64000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2016	iNCNIfI.exe
3020	DidDLMk.exe
2712	XYmtWlK.exe
2716	kcmEFiS.exe
3032	SFFuOZl.exe
2804	fokadYQ.exe
2780	hBgHSGK.exe
2844	yGQsGnK.exe
2548	CBAAomV.exe
2580	NuTlBSL.exe
2032	jOtGPeB.exe
2976	KIfSuBq.exe
2760	tsBdSKX.exe
2076	UfUnVNm.exe
1300	DancnKV.exe
2696	HQeBBoZ.exe
1996	UFTLREq.exe
2604	BoNxJcG.exe
1544	hxZshtv.exe
1692	gjegHtX.exe
2428	kXbKKwV.exe
1656	sNVGJdD.exe
1396	VTNZfiJ.exe
2204	LApmAXI.exe
1488	VrqDfOK.exe
2908	bcvgpea.exe
2100	KfvWbDX.exe
2912	qKLXiyC.exe
332	LHsVZjo.exe
1152	wMvejFV.exe
1468	VEnRnnm.exe
652	isbwLFR.exe
1084	atycXuK.exe
908	dhjMWSO.exe
444	qFKbsPj.exe
2896	LidBcPJ.exe
1644	TPkmfXn.exe
824	bvWBqsV.exe
1736	FCMvczE.exe
1988	GMucrgU.exe
1604	YpjRxPu.exe
1028	xTjIGFX.exe
2240	IsbwzIp.exe
748	UUvEQVO.exe
852	vzacYCS.exe
2044	RcSKtUR.exe
2920	vjAyLEc.exe
2108	BAbSxZS.exe
3016	GmLWdLV.exe
2152	glxAkNf.exe
2408	XCCWBFN.exe
2472	SzRGpKY.exe
884	qsYyoBL.exe
3000	mjndxxe.exe
2992	PpJewhr.exe
1556	vhZEdDF.exe
1704	UvAefvA.exe
1872	pANszba.exe
2672	zPXlNjx.exe
2644	zNhgYxp.exe
2980	RDpHZlk.exe
1960	RGqUify.exe
3036	bITazVk.exe
2792	MiTtOvD.exe

Loads dropped DLL 64 IoCs

pid	Process
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0038000000013362-6.dat	upx
behavioral1/files/0x00060000000145c9-36.dat	upx
behavioral1/files/0x0008000000013a65-16.dat	upx
behavioral1/memory/2844-82-0x000000013FDC0000-0x0000000140114000-memory.dmp	upx
behavioral1/memory/2804-81-0x000000013F7D0000-0x000000013FB24000-memory.dmp	upx
behavioral1/files/0x0006000000014a29-125.dat	upx
behavioral1/files/0x000600000001543a-145.dat	upx
behavioral1/files/0x0006000000015ca9-186.dat	upx
behavioral1/files/0x0006000000015c9b-180.dat	upx
behavioral1/files/0x0006000000015c91-174.dat	upx
behavioral1/files/0x0006000000015bb5-170.dat	upx
behavioral1/files/0x0006000000015b72-165.dat	upx
behavioral1/files/0x0006000000015b37-160.dat	upx
behavioral1/files/0x0006000000015a15-155.dat	upx
behavioral1/files/0x00060000000155e8-150.dat	upx
behavioral1/files/0x000600000001523e-140.dat	upx
behavioral1/files/0x000600000001475f-124.dat	upx
behavioral1/files/0x0006000000015077-122.dat	upx
behavioral1/files/0x0006000000014730-115.dat	upx
behavioral1/files/0x00060000000145d4-113.dat	upx
behavioral1/files/0x0006000000014525-110.dat	upx
behavioral1/files/0x0006000000014d0f-107.dat	upx
behavioral1/memory/2032-98-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/memory/2548-97-0x000000013FF40000-0x0000000140294000-memory.dmp	upx
behavioral1/memory/2780-95-0x000000013F320000-0x000000013F674000-memory.dmp	upx
behavioral1/memory/3032-94-0x000000013F940000-0x000000013FC94000-memory.dmp	upx
behavioral1/memory/2016-90-0x000000013FBE0000-0x000000013FF34000-memory.dmp	upx
behavioral1/memory/2580-87-0x000000013FB10000-0x000000013FE64000-memory.dmp	upx
behavioral1/files/0x00060000000150aa-129.dat	upx
behavioral1/files/0x00060000000146a7-59.dat	upx
behavioral1/files/0x00090000000134f5-56.dat	upx
behavioral1/files/0x0006000000014fac-118.dat	upx
behavioral1/files/0x0008000000013f4b-24.dat	upx
behavioral1/files/0x0008000000013a15-20.dat	upx
behavioral1/files/0x0006000000014c0b-102.dat	upx
behavioral1/memory/2716-76-0x000000013F900000-0x000000013FC54000-memory.dmp	upx
behavioral1/files/0x00060000000148af-75.dat	upx
behavioral1/files/0x000600000001474b-74.dat	upx
behavioral1/memory/2712-73-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/files/0x000d00000001227f-49.dat	upx
behavioral1/memory/3020-47-0x000000013FBB0000-0x000000013FF04000-memory.dmp	upx
behavioral1/files/0x000800000001451d-38.dat	upx
behavioral1/files/0x0008000000013a85-37.dat	upx
behavioral1/memory/2028-2-0x000000013F980000-0x000000013FCD4000-memory.dmp	upx
behavioral1/memory/2028-2763-0x000000013F980000-0x000000013FCD4000-memory.dmp	upx
behavioral1/memory/2580-3040-0x000000013FB10000-0x000000013FE64000-memory.dmp	upx
behavioral1/memory/2016-3998-0x000000013FBE0000-0x000000013FF34000-memory.dmp	upx
behavioral1/memory/3020-3999-0x000000013FBB0000-0x000000013FF04000-memory.dmp	upx
behavioral1/memory/3032-4003-0x000000013F940000-0x000000013FC94000-memory.dmp	upx
behavioral1/memory/2804-4004-0x000000013F7D0000-0x000000013FB24000-memory.dmp	upx
behavioral1/memory/2712-4002-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/memory/2032-4001-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/memory/2716-4000-0x000000013F900000-0x000000013FC54000-memory.dmp	upx
behavioral1/memory/2780-4006-0x000000013F320000-0x000000013F674000-memory.dmp	upx
behavioral1/memory/2844-4005-0x000000013FDC0000-0x0000000140114000-memory.dmp	upx
behavioral1/memory/2548-4007-0x000000013FF40000-0x0000000140294000-memory.dmp	upx
behavioral1/memory/2580-4008-0x000000013FB10000-0x000000013FE64000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kByfuPz.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\sJBsZNV.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\XmlxJCY.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\RGqUify.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\emmezWG.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\cNSzIMK.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\fKIpShd.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\ZLucSyE.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\WmAzEHc.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\ZSXioeO.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\PWazUMt.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\cYbpPDb.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\WigIrJW.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\bCTFSEM.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\qOBYDuG.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\csISwfr.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\ygDWbDU.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\reuloKt.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\hsUqDuq.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\qTenDyw.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\CaMLiEE.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\ITzSrMM.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\sjQXAwb.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\OcavhIN.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\VrqDfOK.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\fmajMGw.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\XlMHToK.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\oFRusAJ.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\xeIeUFh.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\oTyerJw.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\zJLfzew.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\GixmyIU.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\JktRObt.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\TMQhopW.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\SFFuOZl.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\aodrONI.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\UjdVBeB.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\DPzHdBV.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\daCCoCC.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\GPpUuoQ.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\WcvEnkV.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\rvcvBRs.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\LZjZVjE.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\xTtlGkz.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\sMhgWUg.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\QLNNyNd.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\jmIErrb.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\yfleykw.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\iTPFVNj.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\GKmxHHW.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\IrWpMbv.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\BBMyxSc.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\vmWAWPS.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\ZHwNcxe.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\zXPpyLZ.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\EiUwVmO.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\qQxAZEI.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\TjEZQkC.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\sqEcyDC.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\XdvoIkB.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\QdPYcqp.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\FLsYMVj.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\dcmzvbY.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
File created	C:\Windows\System\kUKYWfk.exe	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 3032	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	29
PID 2028 wrote to memory of 3032	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	29
PID 2028 wrote to memory of 3032	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	29
PID 2028 wrote to memory of 2016	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	30
PID 2028 wrote to memory of 2016	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	30
PID 2028 wrote to memory of 2016	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	30
PID 2028 wrote to memory of 2804	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	31
PID 2028 wrote to memory of 2804	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	31
PID 2028 wrote to memory of 2804	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	31
PID 2028 wrote to memory of 3020	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	32
PID 2028 wrote to memory of 3020	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	32
PID 2028 wrote to memory of 3020	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	32
PID 2028 wrote to memory of 2032	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	33
PID 2028 wrote to memory of 2032	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	33
PID 2028 wrote to memory of 2032	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	33
PID 2028 wrote to memory of 2712	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	34
PID 2028 wrote to memory of 2712	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	34
PID 2028 wrote to memory of 2712	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	34
PID 2028 wrote to memory of 2760	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	35
PID 2028 wrote to memory of 2760	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	35
PID 2028 wrote to memory of 2760	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	35
PID 2028 wrote to memory of 2716	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	36
PID 2028 wrote to memory of 2716	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	36
PID 2028 wrote to memory of 2716	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	36
PID 2028 wrote to memory of 2076	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	37
PID 2028 wrote to memory of 2076	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	37
PID 2028 wrote to memory of 2076	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	37
PID 2028 wrote to memory of 2780	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	38
PID 2028 wrote to memory of 2780	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	38
PID 2028 wrote to memory of 2780	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	38
PID 2028 wrote to memory of 1300	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	39
PID 2028 wrote to memory of 1300	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	39
PID 2028 wrote to memory of 1300	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	39
PID 2028 wrote to memory of 2844	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	40
PID 2028 wrote to memory of 2844	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	40
PID 2028 wrote to memory of 2844	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	40
PID 2028 wrote to memory of 2696	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	41
PID 2028 wrote to memory of 2696	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	41
PID 2028 wrote to memory of 2696	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	41
PID 2028 wrote to memory of 2548	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	42
PID 2028 wrote to memory of 2548	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	42
PID 2028 wrote to memory of 2548	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	42
PID 2028 wrote to memory of 2604	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	43
PID 2028 wrote to memory of 2604	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	43
PID 2028 wrote to memory of 2604	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	43
PID 2028 wrote to memory of 2580	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	44
PID 2028 wrote to memory of 2580	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	44
PID 2028 wrote to memory of 2580	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	44
PID 2028 wrote to memory of 1544	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	45
PID 2028 wrote to memory of 1544	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	45
PID 2028 wrote to memory of 1544	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	45
PID 2028 wrote to memory of 2976	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	46
PID 2028 wrote to memory of 2976	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	46
PID 2028 wrote to memory of 2976	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	46
PID 2028 wrote to memory of 2428	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	47
PID 2028 wrote to memory of 2428	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	47
PID 2028 wrote to memory of 2428	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	47
PID 2028 wrote to memory of 1996	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	48
PID 2028 wrote to memory of 1996	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	48
PID 2028 wrote to memory of 1996	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	48
PID 2028 wrote to memory of 1656	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	49
PID 2028 wrote to memory of 1656	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	49
PID 2028 wrote to memory of 1656	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	49
PID 2028 wrote to memory of 1692	2028	77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\77376d0145b2ba5a4a30bdaeedd82640_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System\SFFuOZl.exe
  C:\Windows\System\SFFuOZl.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\iNCNIfI.exe
  C:\Windows\System\iNCNIfI.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\fokadYQ.exe
  C:\Windows\System\fokadYQ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\DidDLMk.exe
  C:\Windows\System\DidDLMk.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\jOtGPeB.exe
  C:\Windows\System\jOtGPeB.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\XYmtWlK.exe
  C:\Windows\System\XYmtWlK.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\tsBdSKX.exe
  C:\Windows\System\tsBdSKX.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\kcmEFiS.exe
  C:\Windows\System\kcmEFiS.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\UfUnVNm.exe
  C:\Windows\System\UfUnVNm.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\hBgHSGK.exe
  C:\Windows\System\hBgHSGK.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\DancnKV.exe
  C:\Windows\System\DancnKV.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\yGQsGnK.exe
  C:\Windows\System\yGQsGnK.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\HQeBBoZ.exe
  C:\Windows\System\HQeBBoZ.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\CBAAomV.exe
  C:\Windows\System\CBAAomV.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\BoNxJcG.exe
  C:\Windows\System\BoNxJcG.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\NuTlBSL.exe
  C:\Windows\System\NuTlBSL.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\hxZshtv.exe
  C:\Windows\System\hxZshtv.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\KIfSuBq.exe
  C:\Windows\System\KIfSuBq.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\kXbKKwV.exe
  C:\Windows\System\kXbKKwV.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\UFTLREq.exe
  C:\Windows\System\UFTLREq.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\sNVGJdD.exe
  C:\Windows\System\sNVGJdD.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\gjegHtX.exe
  C:\Windows\System\gjegHtX.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\VTNZfiJ.exe
  C:\Windows\System\VTNZfiJ.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\LApmAXI.exe
  C:\Windows\System\LApmAXI.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\VrqDfOK.exe
  C:\Windows\System\VrqDfOK.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\bcvgpea.exe
  C:\Windows\System\bcvgpea.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\KfvWbDX.exe
  C:\Windows\System\KfvWbDX.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\qKLXiyC.exe
  C:\Windows\System\qKLXiyC.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\LHsVZjo.exe
  C:\Windows\System\LHsVZjo.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\wMvejFV.exe
  C:\Windows\System\wMvejFV.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\VEnRnnm.exe
  C:\Windows\System\VEnRnnm.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\isbwLFR.exe
  C:\Windows\System\isbwLFR.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\atycXuK.exe
  C:\Windows\System\atycXuK.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\dhjMWSO.exe
  C:\Windows\System\dhjMWSO.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\qFKbsPj.exe
  C:\Windows\System\qFKbsPj.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\LidBcPJ.exe
  C:\Windows\System\LidBcPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\TPkmfXn.exe
  C:\Windows\System\TPkmfXn.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\bvWBqsV.exe
  C:\Windows\System\bvWBqsV.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\FCMvczE.exe
  C:\Windows\System\FCMvczE.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\GMucrgU.exe
  C:\Windows\System\GMucrgU.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\YpjRxPu.exe
  C:\Windows\System\YpjRxPu.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\xTjIGFX.exe
  C:\Windows\System\xTjIGFX.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\IsbwzIp.exe
  C:\Windows\System\IsbwzIp.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\UUvEQVO.exe
  C:\Windows\System\UUvEQVO.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\vzacYCS.exe
  C:\Windows\System\vzacYCS.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\RcSKtUR.exe
  C:\Windows\System\RcSKtUR.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\vjAyLEc.exe
  C:\Windows\System\vjAyLEc.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\BAbSxZS.exe
  C:\Windows\System\BAbSxZS.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\GmLWdLV.exe
  C:\Windows\System\GmLWdLV.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\glxAkNf.exe
  C:\Windows\System\glxAkNf.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\XCCWBFN.exe
  C:\Windows\System\XCCWBFN.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\SzRGpKY.exe
  C:\Windows\System\SzRGpKY.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\qsYyoBL.exe
  C:\Windows\System\qsYyoBL.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\mjndxxe.exe
  C:\Windows\System\mjndxxe.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\PpJewhr.exe
  C:\Windows\System\PpJewhr.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\vhZEdDF.exe
  C:\Windows\System\vhZEdDF.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\UvAefvA.exe
  C:\Windows\System\UvAefvA.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\pANszba.exe
  C:\Windows\System\pANszba.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\zPXlNjx.exe
  C:\Windows\System\zPXlNjx.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\zNhgYxp.exe
  C:\Windows\System\zNhgYxp.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\RDpHZlk.exe
  C:\Windows\System\RDpHZlk.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\RGqUify.exe
  C:\Windows\System\RGqUify.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\bITazVk.exe
  C:\Windows\System\bITazVk.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\MiTtOvD.exe
  C:\Windows\System\MiTtOvD.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\KQOguei.exe
  C:\Windows\System\KQOguei.exe
  2⤵
  PID:1624
- C:\Windows\System\uFmukYY.exe
  C:\Windows\System\uFmukYY.exe
  2⤵
  PID:2640
- C:\Windows\System\UIhirZv.exe
  C:\Windows\System\UIhirZv.exe
  2⤵
  PID:3004
- C:\Windows\System\dkEYnCr.exe
  C:\Windows\System\dkEYnCr.exe
  2⤵
  PID:836
- C:\Windows\System\MWnHynf.exe
  C:\Windows\System\MWnHynf.exe
  2⤵
  PID:2588
- C:\Windows\System\vZxsfBN.exe
  C:\Windows\System\vZxsfBN.exe
  2⤵
  PID:1840
- C:\Windows\System\LjpXLFX.exe
  C:\Windows\System\LjpXLFX.exe
  2⤵
  PID:1628
- C:\Windows\System\cFKJCMY.exe
  C:\Windows\System\cFKJCMY.exe
  2⤵
  PID:2356
- C:\Windows\System\EvyCTiF.exe
  C:\Windows\System\EvyCTiF.exe
  2⤵
  PID:2512
- C:\Windows\System\FqNpwBO.exe
  C:\Windows\System\FqNpwBO.exe
  2⤵
  PID:760
- C:\Windows\System\lllevlQ.exe
  C:\Windows\System\lllevlQ.exe
  2⤵
  PID:584
- C:\Windows\System\jQExmcm.exe
  C:\Windows\System\jQExmcm.exe
  2⤵
  PID:1748
- C:\Windows\System\sNEaIPa.exe
  C:\Windows\System\sNEaIPa.exe
  2⤵
  PID:788
- C:\Windows\System\VOskZyk.exe
  C:\Windows\System\VOskZyk.exe
  2⤵
  PID:1116
- C:\Windows\System\dqgXtNd.exe
  C:\Windows\System\dqgXtNd.exe
  2⤵
  PID:3052
- C:\Windows\System\oXyyqtS.exe
  C:\Windows\System\oXyyqtS.exe
  2⤵
  PID:2256
- C:\Windows\System\djykEnf.exe
  C:\Windows\System\djykEnf.exe
  2⤵
  PID:1536
- C:\Windows\System\sUaGvDz.exe
  C:\Windows\System\sUaGvDz.exe
  2⤵
  PID:352
- C:\Windows\System\RaELjUE.exe
  C:\Windows\System\RaELjUE.exe
  2⤵
  PID:1044
- C:\Windows\System\ZaABNty.exe
  C:\Windows\System\ZaABNty.exe
  2⤵
  PID:1212
- C:\Windows\System\TsdFYyN.exe
  C:\Windows\System\TsdFYyN.exe
  2⤵
  PID:3024
- C:\Windows\System\klNimSB.exe
  C:\Windows\System\klNimSB.exe
  2⤵
  PID:2092
- C:\Windows\System\wTpKYiF.exe
  C:\Windows\System\wTpKYiF.exe
  2⤵
  PID:2172
- C:\Windows\System\BGcebGX.exe
  C:\Windows\System\BGcebGX.exe
  2⤵
  PID:2272
- C:\Windows\System\xEJjopQ.exe
  C:\Windows\System\xEJjopQ.exe
  2⤵
  PID:2320
- C:\Windows\System\XvgiVSR.exe
  C:\Windows\System\XvgiVSR.exe
  2⤵
  PID:560
- C:\Windows\System\bjVAkIp.exe
  C:\Windows\System\bjVAkIp.exe
  2⤵
  PID:1584
- C:\Windows\System\IUsItcm.exe
  C:\Windows\System\IUsItcm.exe
  2⤵
  PID:2084
- C:\Windows\System\GQpKSme.exe
  C:\Windows\System\GQpKSme.exe
  2⤵
  PID:2700
- C:\Windows\System\YOAyHLP.exe
  C:\Windows\System\YOAyHLP.exe
  2⤵
  PID:2104
- C:\Windows\System\ZGuWiGQ.exe
  C:\Windows\System\ZGuWiGQ.exe
  2⤵
  PID:3080
- C:\Windows\System\uNgMEbR.exe
  C:\Windows\System\uNgMEbR.exe
  2⤵
  PID:3100
- C:\Windows\System\oyBCrxw.exe
  C:\Windows\System\oyBCrxw.exe
  2⤵
  PID:3120
- C:\Windows\System\skzPmvi.exe
  C:\Windows\System\skzPmvi.exe
  2⤵
  PID:3136
- C:\Windows\System\SzSvmzf.exe
  C:\Windows\System\SzSvmzf.exe
  2⤵
  PID:3160
- C:\Windows\System\HqOSfpc.exe
  C:\Windows\System\HqOSfpc.exe
  2⤵
  PID:3180
- C:\Windows\System\ZjzBMqr.exe
  C:\Windows\System\ZjzBMqr.exe
  2⤵
  PID:3200
- C:\Windows\System\tmHsxTr.exe
  C:\Windows\System\tmHsxTr.exe
  2⤵
  PID:3220
- C:\Windows\System\UtIPvmq.exe
  C:\Windows\System\UtIPvmq.exe
  2⤵
  PID:3240
- C:\Windows\System\NzWuQGC.exe
  C:\Windows\System\NzWuQGC.exe
  2⤵
  PID:3260
- C:\Windows\System\csSjrui.exe
  C:\Windows\System\csSjrui.exe
  2⤵
  PID:3280
- C:\Windows\System\LpuBjlW.exe
  C:\Windows\System\LpuBjlW.exe
  2⤵
  PID:3300
- C:\Windows\System\iTPFVNj.exe
  C:\Windows\System\iTPFVNj.exe
  2⤵
  PID:3320
- C:\Windows\System\JJEnpSo.exe
  C:\Windows\System\JJEnpSo.exe
  2⤵
  PID:3340
- C:\Windows\System\uGnjscT.exe
  C:\Windows\System\uGnjscT.exe
  2⤵
  PID:3360
- C:\Windows\System\cRGMndC.exe
  C:\Windows\System\cRGMndC.exe
  2⤵
  PID:3376
- C:\Windows\System\daaAWYm.exe
  C:\Windows\System\daaAWYm.exe
  2⤵
  PID:3396
- C:\Windows\System\tnkygyQ.exe
  C:\Windows\System\tnkygyQ.exe
  2⤵
  PID:3420
- C:\Windows\System\puGjPMN.exe
  C:\Windows\System\puGjPMN.exe
  2⤵
  PID:3440
- C:\Windows\System\oAMihPx.exe
  C:\Windows\System\oAMihPx.exe
  2⤵
  PID:3460
- C:\Windows\System\jfjwWEI.exe
  C:\Windows\System\jfjwWEI.exe
  2⤵
  PID:3480
- C:\Windows\System\kyZhoqs.exe
  C:\Windows\System\kyZhoqs.exe
  2⤵
  PID:3500
- C:\Windows\System\qQxAZEI.exe
  C:\Windows\System\qQxAZEI.exe
  2⤵
  PID:3520
- C:\Windows\System\ETsLjAP.exe
  C:\Windows\System\ETsLjAP.exe
  2⤵
  PID:3540
- C:\Windows\System\aZmdKft.exe
  C:\Windows\System\aZmdKft.exe
  2⤵
  PID:3560
- C:\Windows\System\VagmwNR.exe
  C:\Windows\System\VagmwNR.exe
  2⤵
  PID:3580
- C:\Windows\System\VjMNVHp.exe
  C:\Windows\System\VjMNVHp.exe
  2⤵
  PID:3600
- C:\Windows\System\BHDuOJv.exe
  C:\Windows\System\BHDuOJv.exe
  2⤵
  PID:3620
- C:\Windows\System\ZrGzdKl.exe
  C:\Windows\System\ZrGzdKl.exe
  2⤵
  PID:3640
- C:\Windows\System\xLjwRoi.exe
  C:\Windows\System\xLjwRoi.exe
  2⤵
  PID:3656
- C:\Windows\System\jTlWKhf.exe
  C:\Windows\System\jTlWKhf.exe
  2⤵
  PID:3680
- C:\Windows\System\AYAqzdG.exe
  C:\Windows\System\AYAqzdG.exe
  2⤵
  PID:3696
- C:\Windows\System\OzFLVuS.exe
  C:\Windows\System\OzFLVuS.exe
  2⤵
  PID:3720
- C:\Windows\System\JzyENfC.exe
  C:\Windows\System\JzyENfC.exe
  2⤵
  PID:3740
- C:\Windows\System\OqnyBoT.exe
  C:\Windows\System\OqnyBoT.exe
  2⤵
  PID:3760
- C:\Windows\System\PyhSQhB.exe
  C:\Windows\System\PyhSQhB.exe
  2⤵
  PID:3776
- C:\Windows\System\XCVoNxj.exe
  C:\Windows\System\XCVoNxj.exe
  2⤵
  PID:3800
- C:\Windows\System\cnAKVHa.exe
  C:\Windows\System\cnAKVHa.exe
  2⤵
  PID:3820
- C:\Windows\System\fbEWlMK.exe
  C:\Windows\System\fbEWlMK.exe
  2⤵
  PID:3840
- C:\Windows\System\LXcztrL.exe
  C:\Windows\System\LXcztrL.exe
  2⤵
  PID:3856
- C:\Windows\System\qOBYDuG.exe
  C:\Windows\System\qOBYDuG.exe
  2⤵
  PID:3880
- C:\Windows\System\qcegcxb.exe
  C:\Windows\System\qcegcxb.exe
  2⤵
  PID:3896
- C:\Windows\System\MCRrCWH.exe
  C:\Windows\System\MCRrCWH.exe
  2⤵
  PID:3920
- C:\Windows\System\XwZRenY.exe
  C:\Windows\System\XwZRenY.exe
  2⤵
  PID:3940
- C:\Windows\System\Qxtqfsg.exe
  C:\Windows\System\Qxtqfsg.exe
  2⤵
  PID:3960
- C:\Windows\System\lUCPgri.exe
  C:\Windows\System\lUCPgri.exe
  2⤵
  PID:3976
- C:\Windows\System\rvcvBRs.exe
  C:\Windows\System\rvcvBRs.exe
  2⤵
  PID:4000
- C:\Windows\System\LbkQToi.exe
  C:\Windows\System\LbkQToi.exe
  2⤵
  PID:4020
- C:\Windows\System\ykAlzVv.exe
  C:\Windows\System\ykAlzVv.exe
  2⤵
  PID:4040
- C:\Windows\System\ZCoBDzD.exe
  C:\Windows\System\ZCoBDzD.exe
  2⤵
  PID:4060
- C:\Windows\System\pWUBlWK.exe
  C:\Windows\System\pWUBlWK.exe
  2⤵
  PID:4080
- C:\Windows\System\guUiQkV.exe
  C:\Windows\System\guUiQkV.exe
  2⤵
  PID:2248
- C:\Windows\System\lVRbIrj.exe
  C:\Windows\System\lVRbIrj.exe
  2⤵
  PID:2752
- C:\Windows\System\FvmYbMy.exe
  C:\Windows\System\FvmYbMy.exe
  2⤵
  PID:1648
- C:\Windows\System\QZkPfuE.exe
  C:\Windows\System\QZkPfuE.exe
  2⤵
  PID:2052
- C:\Windows\System\cOZwzMu.exe
  C:\Windows\System\cOZwzMu.exe
  2⤵
  PID:1620
- C:\Windows\System\gvrsmgf.exe
  C:\Windows\System\gvrsmgf.exe
  2⤵
  PID:2900
- C:\Windows\System\qxOpZRb.exe
  C:\Windows\System\qxOpZRb.exe
  2⤵
  PID:672
- C:\Windows\System\OYSjbGy.exe
  C:\Windows\System\OYSjbGy.exe
  2⤵
  PID:1484
- C:\Windows\System\BikHuCN.exe
  C:\Windows\System\BikHuCN.exe
  2⤵
  PID:1080
- C:\Windows\System\qUNdKQv.exe
  C:\Windows\System\qUNdKQv.exe
  2⤵
  PID:1612
- C:\Windows\System\buzibgN.exe
  C:\Windows\System\buzibgN.exe
  2⤵
  PID:764
- C:\Windows\System\nLsubBZ.exe
  C:\Windows\System\nLsubBZ.exe
  2⤵
  PID:1304
- C:\Windows\System\LkCTFyZ.exe
  C:\Windows\System\LkCTFyZ.exe
  2⤵
  PID:696
- C:\Windows\System\BPbbmBp.exe
  C:\Windows\System\BPbbmBp.exe
  2⤵
  PID:1716
- C:\Windows\System\JAEyRqq.exe
  C:\Windows\System\JAEyRqq.exe
  2⤵
  PID:2924
- C:\Windows\System\WSpEkLM.exe
  C:\Windows\System\WSpEkLM.exe
  2⤵
  PID:2488
- C:\Windows\System\kUKYWfk.exe
  C:\Windows\System\kUKYWfk.exe
  2⤵
  PID:1848
- C:\Windows\System\QouXMbU.exe
  C:\Windows\System\QouXMbU.exe
  2⤵
  PID:2996
- C:\Windows\System\TjEZQkC.exe
  C:\Windows\System\TjEZQkC.exe
  2⤵
  PID:2860
- C:\Windows\System\qhiYBYs.exe
  C:\Windows\System\qhiYBYs.exe
  2⤵
  PID:3088
- C:\Windows\System\DGBzLzd.exe
  C:\Windows\System\DGBzLzd.exe
  2⤵
  PID:3096
- C:\Windows\System\KIEPvwn.exe
  C:\Windows\System\KIEPvwn.exe
  2⤵
  PID:3152
- C:\Windows\System\rFtPpPO.exe
  C:\Windows\System\rFtPpPO.exe
  2⤵
  PID:3188
- C:\Windows\System\EHeGcGa.exe
  C:\Windows\System\EHeGcGa.exe
  2⤵
  PID:3212
- C:\Windows\System\WckBDpC.exe
  C:\Windows\System\WckBDpC.exe
  2⤵
  PID:3256
- C:\Windows\System\jcJVPFN.exe
  C:\Windows\System\jcJVPFN.exe
  2⤵
  PID:3276
- C:\Windows\System\fmajMGw.exe
  C:\Windows\System\fmajMGw.exe
  2⤵
  PID:3312
- C:\Windows\System\QYDxpSB.exe
  C:\Windows\System\QYDxpSB.exe
  2⤵
  PID:3352
- C:\Windows\System\zyzTmYl.exe
  C:\Windows\System\zyzTmYl.exe
  2⤵
  PID:3392
- C:\Windows\System\fSkCADY.exe
  C:\Windows\System\fSkCADY.exe
  2⤵
  PID:3428
- C:\Windows\System\jfvVPGr.exe
  C:\Windows\System\jfvVPGr.exe
  2⤵
  PID:3448
- C:\Windows\System\bqPgfls.exe
  C:\Windows\System\bqPgfls.exe
  2⤵
  PID:3476
- C:\Windows\System\DdNzmEs.exe
  C:\Windows\System\DdNzmEs.exe
  2⤵
  PID:3516
- C:\Windows\System\meTGkDh.exe
  C:\Windows\System\meTGkDh.exe
  2⤵
  PID:3556
- C:\Windows\System\rUtMeHv.exe
  C:\Windows\System\rUtMeHv.exe
  2⤵
  PID:3588
- C:\Windows\System\UNGNaKu.exe
  C:\Windows\System\UNGNaKu.exe
  2⤵
  PID:3636
- C:\Windows\System\muDFPVI.exe
  C:\Windows\System\muDFPVI.exe
  2⤵
  PID:3608
- C:\Windows\System\GcQhCxl.exe
  C:\Windows\System\GcQhCxl.exe
  2⤵
  PID:3704
- C:\Windows\System\dTqHiwd.exe
  C:\Windows\System\dTqHiwd.exe
  2⤵
  PID:3692
- C:\Windows\System\WvSDlFE.exe
  C:\Windows\System\WvSDlFE.exe
  2⤵
  PID:3752
- C:\Windows\System\IcVSsrx.exe
  C:\Windows\System\IcVSsrx.exe
  2⤵
  PID:3796
- C:\Windows\System\aqUnxcm.exe
  C:\Windows\System\aqUnxcm.exe
  2⤵
  PID:3832
- C:\Windows\System\gxGkItP.exe
  C:\Windows\System\gxGkItP.exe
  2⤵
  PID:3848
- C:\Windows\System\XlMHToK.exe
  C:\Windows\System\XlMHToK.exe
  2⤵
  PID:3888
- C:\Windows\System\YSCNDxl.exe
  C:\Windows\System\YSCNDxl.exe
  2⤵
  PID:3912
- C:\Windows\System\MWotJIy.exe
  C:\Windows\System\MWotJIy.exe
  2⤵
  PID:3952
- C:\Windows\System\MPLdknt.exe
  C:\Windows\System\MPLdknt.exe
  2⤵
  PID:3988
- C:\Windows\System\SsKwJtv.exe
  C:\Windows\System\SsKwJtv.exe
  2⤵
  PID:4008
- C:\Windows\System\rpggQBn.exe
  C:\Windows\System\rpggQBn.exe
  2⤵
  PID:4068
- C:\Windows\System\wdtlnlt.exe
  C:\Windows\System\wdtlnlt.exe
  2⤵
  PID:4056
- C:\Windows\System\qdlRxkY.exe
  C:\Windows\System\qdlRxkY.exe
  2⤵
  PID:2880
- C:\Windows\System\YmZjBoG.exe
  C:\Windows\System\YmZjBoG.exe
  2⤵
  PID:1940
- C:\Windows\System\vsdOCvM.exe
  C:\Windows\System\vsdOCvM.exe
  2⤵
  PID:1724
- C:\Windows\System\tcSjcAY.exe
  C:\Windows\System\tcSjcAY.exe
  2⤵
  PID:2800
- C:\Windows\System\TYEzlqj.exe
  C:\Windows\System\TYEzlqj.exe
  2⤵
  PID:1732
- C:\Windows\System\UUessfk.exe
  C:\Windows\System\UUessfk.exe
  2⤵
  PID:1712
- C:\Windows\System\QUdMBFW.exe
  C:\Windows\System\QUdMBFW.exe
  2⤵
  PID:1368
- C:\Windows\System\KaNtvqq.exe
  C:\Windows\System\KaNtvqq.exe
  2⤵
  PID:340
- C:\Windows\System\XxgRRPs.exe
  C:\Windows\System\XxgRRPs.exe
  2⤵
  PID:1492
- C:\Windows\System\rAIRVnH.exe
  C:\Windows\System\rAIRVnH.exe
  2⤵
  PID:1596
- C:\Windows\System\KMKJknv.exe
  C:\Windows\System\KMKJknv.exe
  2⤵
  PID:2664
- C:\Windows\System\WhKHwyJ.exe
  C:\Windows\System\WhKHwyJ.exe
  2⤵
  PID:2692
- C:\Windows\System\vzJswdV.exe
  C:\Windows\System\vzJswdV.exe
  2⤵
  PID:3132
- C:\Windows\System\xIfToHl.exe
  C:\Windows\System\xIfToHl.exe
  2⤵
  PID:3112
- C:\Windows\System\uNaEWuN.exe
  C:\Windows\System\uNaEWuN.exe
  2⤵
  PID:3268
- C:\Windows\System\KvtBRVs.exe
  C:\Windows\System\KvtBRVs.exe
  2⤵
  PID:3296
- C:\Windows\System\NbqUkYU.exe
  C:\Windows\System\NbqUkYU.exe
  2⤵
  PID:3332
- C:\Windows\System\qTenDyw.exe
  C:\Windows\System\qTenDyw.exe
  2⤵
  PID:3472
- C:\Windows\System\kvmLKsR.exe
  C:\Windows\System\kvmLKsR.exe
  2⤵
  PID:3536
- C:\Windows\System\oGtCzfR.exe
  C:\Windows\System\oGtCzfR.exe
  2⤵
  PID:3436
- C:\Windows\System\NOXTfvM.exe
  C:\Windows\System\NOXTfvM.exe
  2⤵
  PID:3512
- C:\Windows\System\HzgccRW.exe
  C:\Windows\System\HzgccRW.exe
  2⤵
  PID:3652
- C:\Windows\System\NYDzimZ.exe
  C:\Windows\System\NYDzimZ.exe
  2⤵
  PID:3664
- C:\Windows\System\PHBskpb.exe
  C:\Windows\System\PHBskpb.exe
  2⤵
  PID:3688
- C:\Windows\System\ZjGJvur.exe
  C:\Windows\System\ZjGJvur.exe
  2⤵
  PID:3828
- C:\Windows\System\fITAVoZ.exe
  C:\Windows\System\fITAVoZ.exe
  2⤵
  PID:3872
- C:\Windows\System\DJUsRHC.exe
  C:\Windows\System\DJUsRHC.exe
  2⤵
  PID:3904
- C:\Windows\System\OwAZxjJ.exe
  C:\Windows\System\OwAZxjJ.exe
  2⤵
  PID:4028
- C:\Windows\System\tkzHWfc.exe
  C:\Windows\System\tkzHWfc.exe
  2⤵
  PID:1944
- C:\Windows\System\BmmrIyz.exe
  C:\Windows\System\BmmrIyz.exe
  2⤵
  PID:2968
- C:\Windows\System\bujcDAu.exe
  C:\Windows\System\bujcDAu.exe
  2⤵
  PID:4036
- C:\Windows\System\dZRBiuW.exe
  C:\Windows\System\dZRBiuW.exe
  2⤵
  PID:844
- C:\Windows\System\wvEfzpL.exe
  C:\Windows\System\wvEfzpL.exe
  2⤵
  PID:1896
- C:\Windows\System\spAlLOX.exe
  C:\Windows\System\spAlLOX.exe
  2⤵
  PID:2916
- C:\Windows\System\lUUHTOx.exe
  C:\Windows\System\lUUHTOx.exe
  2⤵
  PID:768
- C:\Windows\System\pCuMJPu.exe
  C:\Windows\System\pCuMJPu.exe
  2⤵
  PID:2160
- C:\Windows\System\uMXePIm.exe
  C:\Windows\System\uMXePIm.exe
  2⤵
  PID:1588
- C:\Windows\System\smTpXQk.exe
  C:\Windows\System\smTpXQk.exe
  2⤵
  PID:3196
- C:\Windows\System\ohxvYZj.exe
  C:\Windows\System\ohxvYZj.exe
  2⤵
  PID:3144
- C:\Windows\System\mWizBSt.exe
  C:\Windows\System\mWizBSt.exe
  2⤵
  PID:4108
- C:\Windows\System\cekEirt.exe
  C:\Windows\System\cekEirt.exe
  2⤵
  PID:4132
- C:\Windows\System\sDLBVgZ.exe
  C:\Windows\System\sDLBVgZ.exe
  2⤵
  PID:4156
- C:\Windows\System\iGhuscQ.exe
  C:\Windows\System\iGhuscQ.exe
  2⤵
  PID:4184
- C:\Windows\System\KlsRrnF.exe
  C:\Windows\System\KlsRrnF.exe
  2⤵
  PID:4208
- C:\Windows\System\rAiGflY.exe
  C:\Windows\System\rAiGflY.exe
  2⤵
  PID:4224
- C:\Windows\System\VOsOhhy.exe
  C:\Windows\System\VOsOhhy.exe
  2⤵
  PID:4244
- C:\Windows\System\oTyerJw.exe
  C:\Windows\System\oTyerJw.exe
  2⤵
  PID:4264
- C:\Windows\System\WePJVxa.exe
  C:\Windows\System\WePJVxa.exe
  2⤵
  PID:4284
- C:\Windows\System\hyvgpbZ.exe
  C:\Windows\System\hyvgpbZ.exe
  2⤵
  PID:4304
- C:\Windows\System\kEFpMMV.exe
  C:\Windows\System\kEFpMMV.exe
  2⤵
  PID:4328
- C:\Windows\System\sFGMxkj.exe
  C:\Windows\System\sFGMxkj.exe
  2⤵
  PID:4344
- C:\Windows\System\ivjKoGR.exe
  C:\Windows\System\ivjKoGR.exe
  2⤵
  PID:4364
- C:\Windows\System\zbGJJWf.exe
  C:\Windows\System\zbGJJWf.exe
  2⤵
  PID:4384
- C:\Windows\System\XywnUYi.exe
  C:\Windows\System\XywnUYi.exe
  2⤵
  PID:4408
- C:\Windows\System\NiGRbMd.exe
  C:\Windows\System\NiGRbMd.exe
  2⤵
  PID:4428
- C:\Windows\System\QtVaNal.exe
  C:\Windows\System\QtVaNal.exe
  2⤵
  PID:4448
- C:\Windows\System\rWWddML.exe
  C:\Windows\System\rWWddML.exe
  2⤵
  PID:4468
- C:\Windows\System\uYGfcqv.exe
  C:\Windows\System\uYGfcqv.exe
  2⤵
  PID:4488
- C:\Windows\System\cDlwcrI.exe
  C:\Windows\System\cDlwcrI.exe
  2⤵
  PID:4504
- C:\Windows\System\fJMrPJy.exe
  C:\Windows\System\fJMrPJy.exe
  2⤵
  PID:4528
- C:\Windows\System\OwvRbHy.exe
  C:\Windows\System\OwvRbHy.exe
  2⤵
  PID:4544
- C:\Windows\System\OmuHIOJ.exe
  C:\Windows\System\OmuHIOJ.exe
  2⤵
  PID:4568
- C:\Windows\System\AyJVRiq.exe
  C:\Windows\System\AyJVRiq.exe
  2⤵
  PID:4584
- C:\Windows\System\zibIVEv.exe
  C:\Windows\System\zibIVEv.exe
  2⤵
  PID:4608
- C:\Windows\System\tnzUTMB.exe
  C:\Windows\System\tnzUTMB.exe
  2⤵
  PID:4624
- C:\Windows\System\UGgQIQz.exe
  C:\Windows\System\UGgQIQz.exe
  2⤵
  PID:4644
- C:\Windows\System\vgHOBUE.exe
  C:\Windows\System\vgHOBUE.exe
  2⤵
  PID:4664
- C:\Windows\System\nmlGEwx.exe
  C:\Windows\System\nmlGEwx.exe
  2⤵
  PID:4688
- C:\Windows\System\lSGzPzA.exe
  C:\Windows\System\lSGzPzA.exe
  2⤵
  PID:4708
- C:\Windows\System\ATghIGE.exe
  C:\Windows\System\ATghIGE.exe
  2⤵
  PID:4728
- C:\Windows\System\KivOUee.exe
  C:\Windows\System\KivOUee.exe
  2⤵
  PID:4744
- C:\Windows\System\WVEuLgA.exe
  C:\Windows\System\WVEuLgA.exe
  2⤵
  PID:4768
- C:\Windows\System\QZPMPBy.exe
  C:\Windows\System\QZPMPBy.exe
  2⤵
  PID:4788
- C:\Windows\System\apXPZkn.exe
  C:\Windows\System\apXPZkn.exe
  2⤵
  PID:4808
- C:\Windows\System\lkEKDpk.exe
  C:\Windows\System\lkEKDpk.exe
  2⤵
  PID:4824
- C:\Windows\System\LhUTXph.exe
  C:\Windows\System\LhUTXph.exe
  2⤵
  PID:4848
- C:\Windows\System\ImtEWXk.exe
  C:\Windows\System\ImtEWXk.exe
  2⤵
  PID:4864
- C:\Windows\System\uFfByhz.exe
  C:\Windows\System\uFfByhz.exe
  2⤵
  PID:4888
- C:\Windows\System\GKmxHHW.exe
  C:\Windows\System\GKmxHHW.exe
  2⤵
  PID:4904
- C:\Windows\System\yaUCrbS.exe
  C:\Windows\System\yaUCrbS.exe
  2⤵
  PID:4928
- C:\Windows\System\SauYeee.exe
  C:\Windows\System\SauYeee.exe
  2⤵
  PID:4944
- C:\Windows\System\LuLGGOe.exe
  C:\Windows\System\LuLGGOe.exe
  2⤵
  PID:4968
- C:\Windows\System\xfomUhI.exe
  C:\Windows\System\xfomUhI.exe
  2⤵
  PID:4984
- C:\Windows\System\QlNZXkT.exe
  C:\Windows\System\QlNZXkT.exe
  2⤵
  PID:5008
- C:\Windows\System\CknHGUv.exe
  C:\Windows\System\CknHGUv.exe
  2⤵
  PID:5024
- C:\Windows\System\MKaeQJa.exe
  C:\Windows\System\MKaeQJa.exe
  2⤵
  PID:5048
- C:\Windows\System\PLCdTNb.exe
  C:\Windows\System\PLCdTNb.exe
  2⤵
  PID:5064
- C:\Windows\System\HUEjDtQ.exe
  C:\Windows\System\HUEjDtQ.exe
  2⤵
  PID:5088
- C:\Windows\System\oQjUFOl.exe
  C:\Windows\System\oQjUFOl.exe
  2⤵
  PID:5108
- C:\Windows\System\UONRaqD.exe
  C:\Windows\System\UONRaqD.exe
  2⤵
  PID:2684
- C:\Windows\System\rHUOXhq.exe
  C:\Windows\System\rHUOXhq.exe
  2⤵
  PID:3404
- C:\Windows\System\zJLfzew.exe
  C:\Windows\System\zJLfzew.exe
  2⤵
  PID:3452
- C:\Windows\System\kmxyDNj.exe
  C:\Windows\System\kmxyDNj.exe
  2⤵
  PID:3628
- C:\Windows\System\rZISSaS.exe
  C:\Windows\System\rZISSaS.exe
  2⤵
  PID:3616
- C:\Windows\System\zGlGXTK.exe
  C:\Windows\System\zGlGXTK.exe
  2⤵
  PID:3712
- C:\Windows\System\rxLyRtN.exe
  C:\Windows\System\rxLyRtN.exe
  2⤵
  PID:3792
- C:\Windows\System\BetXAbY.exe
  C:\Windows\System\BetXAbY.exe
  2⤵
  PID:3948
- C:\Windows\System\YupcBkr.exe
  C:\Windows\System\YupcBkr.exe
  2⤵
  PID:3808
- C:\Windows\System\ErcElVt.exe
  C:\Windows\System\ErcElVt.exe
  2⤵
  PID:2612
- C:\Windows\System\oUdpWPB.exe
  C:\Windows\System\oUdpWPB.exe
  2⤵
  PID:2872
- C:\Windows\System\oFYQgJM.exe
  C:\Windows\System\oFYQgJM.exe
  2⤵
  PID:1956
- C:\Windows\System\ckdRkUG.exe
  C:\Windows\System\ckdRkUG.exe
  2⤵
  PID:2288
- C:\Windows\System\LzdItsG.exe
  C:\Windows\System\LzdItsG.exe
  2⤵
  PID:1776
- C:\Windows\System\iCnIIZS.exe
  C:\Windows\System\iCnIIZS.exe
  2⤵
  PID:944
- C:\Windows\System\eaphhaI.exe
  C:\Windows\System\eaphhaI.exe
  2⤵
  PID:1788
- C:\Windows\System\uXCTdhh.exe
  C:\Windows\System\uXCTdhh.exe
  2⤵
  PID:4148
- C:\Windows\System\BmEqIGu.exe
  C:\Windows\System\BmEqIGu.exe
  2⤵
  PID:3228
- C:\Windows\System\kPRdVYB.exe
  C:\Windows\System\kPRdVYB.exe
  2⤵
  PID:4164
- C:\Windows\System\FnYauBp.exe
  C:\Windows\System\FnYauBp.exe
  2⤵
  PID:4204
- C:\Windows\System\fNjpiWb.exe
  C:\Windows\System\fNjpiWb.exe
  2⤵
  PID:2572
- C:\Windows\System\ozqUpOJ.exe
  C:\Windows\System\ozqUpOJ.exe
  2⤵
  PID:4316
- C:\Windows\System\xAyAXHk.exe
  C:\Windows\System\xAyAXHk.exe
  2⤵
  PID:4296
- C:\Windows\System\kYqxrPj.exe
  C:\Windows\System\kYqxrPj.exe
  2⤵
  PID:4352
- C:\Windows\System\BZQnuhx.exe
  C:\Windows\System\BZQnuhx.exe
  2⤵
  PID:4336
- C:\Windows\System\rTHUCEm.exe
  C:\Windows\System\rTHUCEm.exe
  2⤵
  PID:4400
- C:\Windows\System\KiTEEbn.exe
  C:\Windows\System\KiTEEbn.exe
  2⤵
  PID:4440
- C:\Windows\System\PUeDrDO.exe
  C:\Windows\System\PUeDrDO.exe
  2⤵
  PID:4456
- C:\Windows\System\UFvjQhz.exe
  C:\Windows\System\UFvjQhz.exe
  2⤵
  PID:4512
- C:\Windows\System\lSyvKRJ.exe
  C:\Windows\System\lSyvKRJ.exe
  2⤵
  PID:4500
- C:\Windows\System\QjJPZok.exe
  C:\Windows\System\QjJPZok.exe
  2⤵
  PID:4540
- C:\Windows\System\SmMWMka.exe
  C:\Windows\System\SmMWMka.exe
  2⤵
  PID:4580
- C:\Windows\System\yBwJGhl.exe
  C:\Windows\System\yBwJGhl.exe
  2⤵
  PID:4620
- C:\Windows\System\ZwWQbqF.exe
  C:\Windows\System\ZwWQbqF.exe
  2⤵
  PID:4676
- C:\Windows\System\lbRyvjt.exe
  C:\Windows\System\lbRyvjt.exe
  2⤵
  PID:4724
- C:\Windows\System\iyfIjGg.exe
  C:\Windows\System\iyfIjGg.exe
  2⤵
  PID:4752
- C:\Windows\System\rXOTReH.exe
  C:\Windows\System\rXOTReH.exe
  2⤵
  PID:4796
- C:\Windows\System\soGVVFT.exe
  C:\Windows\System\soGVVFT.exe
  2⤵
  PID:4780
- C:\Windows\System\csISwfr.exe
  C:\Windows\System\csISwfr.exe
  2⤵
  PID:4820
- C:\Windows\System\DsOoPlR.exe
  C:\Windows\System\DsOoPlR.exe
  2⤵
  PID:4876
- C:\Windows\System\JgzvQTq.exe
  C:\Windows\System\JgzvQTq.exe
  2⤵
  PID:4912
- C:\Windows\System\cIujSDs.exe
  C:\Windows\System\cIujSDs.exe
  2⤵
  PID:4952
- C:\Windows\System\iYgZFVS.exe
  C:\Windows\System\iYgZFVS.exe
  2⤵
  PID:4940
- C:\Windows\System\mlfSMMq.exe
  C:\Windows\System\mlfSMMq.exe
  2⤵
  PID:5004
- C:\Windows\System\AFKvuiH.exe
  C:\Windows\System\AFKvuiH.exe
  2⤵
  PID:4180
- C:\Windows\System\TpNCPrT.exe
  C:\Windows\System\TpNCPrT.exe
  2⤵
  PID:5072
- C:\Windows\System\EqGuLuo.exe
  C:\Windows\System\EqGuLuo.exe
  2⤵
  PID:5080
- C:\Windows\System\GIcUYZe.exe
  C:\Windows\System\GIcUYZe.exe
  2⤵
  PID:2728
- C:\Windows\System\HpdryqI.exe
  C:\Windows\System\HpdryqI.exe
  2⤵
  PID:3408
- C:\Windows\System\VMElQXT.exe
  C:\Windows\System\VMElQXT.exe
  2⤵
  PID:3368
- C:\Windows\System\HyQfjlN.exe
  C:\Windows\System\HyQfjlN.exe
  2⤵
  PID:3492
- C:\Windows\System\IixQTos.exe
  C:\Windows\System\IixQTos.exe
  2⤵
  PID:3736
- C:\Windows\System\mCUIlxz.exe
  C:\Windows\System\mCUIlxz.exe
  2⤵
  PID:3812
- C:\Windows\System\RhFwlnj.exe
  C:\Windows\System\RhFwlnj.exe
  2⤵
  PID:4048
- C:\Windows\System\IfzKEJd.exe
  C:\Windows\System\IfzKEJd.exe
  2⤵
  PID:1144
- C:\Windows\System\bOoRzij.exe
  C:\Windows\System\bOoRzij.exe
  2⤵
  PID:2400
- C:\Windows\System\igLMyZk.exe
  C:\Windows\System\igLMyZk.exe
  2⤵
  PID:4104
- C:\Windows\System\NvrifFO.exe
  C:\Windows\System\NvrifFO.exe
  2⤵
  PID:2072
- C:\Windows\System\IrWpMbv.exe
  C:\Windows\System\IrWpMbv.exe
  2⤵
  PID:4128
- C:\Windows\System\tgTmVGe.exe
  C:\Windows\System\tgTmVGe.exe
  2⤵
  PID:4236
- C:\Windows\System\ldvkJDZ.exe
  C:\Windows\System\ldvkJDZ.exe
  2⤵
  PID:4260
- C:\Windows\System\vLPqwUL.exe
  C:\Windows\System\vLPqwUL.exe
  2⤵
  PID:4356
- C:\Windows\System\YCmfVgt.exe
  C:\Windows\System\YCmfVgt.exe
  2⤵
  PID:4372
- C:\Windows\System\bdBYxnx.exe
  C:\Windows\System\bdBYxnx.exe
  2⤵
  PID:4380
- C:\Windows\System\gSiJDIt.exe
  C:\Windows\System\gSiJDIt.exe
  2⤵
  PID:4536
- C:\Windows\System\YXZEIxp.exe
  C:\Windows\System\YXZEIxp.exe
  2⤵
  PID:4444
- C:\Windows\System\rtHmafr.exe
  C:\Windows\System\rtHmafr.exe
  2⤵
  PID:4616
- C:\Windows\System\IhuMNuA.exe
  C:\Windows\System\IhuMNuA.exe
  2⤵
  PID:4656
- C:\Windows\System\qwUOmNr.exe
  C:\Windows\System\qwUOmNr.exe
  2⤵
  PID:4672
- C:\Windows\System\ynlzEjT.exe
  C:\Windows\System\ynlzEjT.exe
  2⤵
  PID:4704
- C:\Windows\System\DuklrgR.exe
  C:\Windows\System\DuklrgR.exe
  2⤵
  PID:4776
- C:\Windows\System\RJTrbXs.exe
  C:\Windows\System\RJTrbXs.exe
  2⤵
  PID:4844
- C:\Windows\System\DZJXqBY.exe
  C:\Windows\System\DZJXqBY.exe
  2⤵
  PID:4960
- C:\Windows\System\KRWBpHY.exe
  C:\Windows\System\KRWBpHY.exe
  2⤵
  PID:4976
- C:\Windows\System\PBuztVD.exe
  C:\Windows\System\PBuztVD.exe
  2⤵
  PID:3056
- C:\Windows\System\TPBFiNP.exe
  C:\Windows\System\TPBFiNP.exe
  2⤵
  PID:5044
- C:\Windows\System\EtspbFf.exe
  C:\Windows\System\EtspbFf.exe
  2⤵
  PID:3576
- C:\Windows\System\lXQEKex.exe
  C:\Windows\System\lXQEKex.exe
  2⤵
  PID:3236
- C:\Windows\System\xIznKlg.exe
  C:\Windows\System\xIznKlg.exe
  2⤵
  PID:3956
- C:\Windows\System\gpWjvCO.exe
  C:\Windows\System\gpWjvCO.exe
  2⤵
  PID:3984
- C:\Windows\System\yKzJyKD.exe
  C:\Windows\System\yKzJyKD.exe
  2⤵
  PID:2388
- C:\Windows\System\kSEXWJP.exe
  C:\Windows\System\kSEXWJP.exe
  2⤵
  PID:2620
- C:\Windows\System\LZjZVjE.exe
  C:\Windows\System\LZjZVjE.exe
  2⤵
  PID:4192
- C:\Windows\System\lMZxhcc.exe
  C:\Windows\System\lMZxhcc.exe
  2⤵
  PID:4200
- C:\Windows\System\mAfowpX.exe
  C:\Windows\System\mAfowpX.exe
  2⤵
  PID:4436
- C:\Windows\System\pMpkDek.exe
  C:\Windows\System\pMpkDek.exe
  2⤵
  PID:4276
- C:\Windows\System\uXIxQNc.exe
  C:\Windows\System\uXIxQNc.exe
  2⤵
  PID:4416
- C:\Windows\System\vByizeb.exe
  C:\Windows\System\vByizeb.exe
  2⤵
  PID:4376
- C:\Windows\System\Ozmsjua.exe
  C:\Windows\System\Ozmsjua.exe
  2⤵
  PID:4696
- C:\Windows\System\llZMoqn.exe
  C:\Windows\System\llZMoqn.exe
  2⤵
  PID:4816
- C:\Windows\System\KVxaCXl.exe
  C:\Windows\System\KVxaCXl.exe
  2⤵
  PID:4700
- C:\Windows\System\NzFPmQa.exe
  C:\Windows\System\NzFPmQa.exe
  2⤵
  PID:5140
- C:\Windows\System\xgwzTEc.exe
  C:\Windows\System\xgwzTEc.exe
  2⤵
  PID:5164
- C:\Windows\System\aDdHFVD.exe
  C:\Windows\System\aDdHFVD.exe
  2⤵
  PID:5184
- C:\Windows\System\vKpHGpI.exe
  C:\Windows\System\vKpHGpI.exe
  2⤵
  PID:5204
- C:\Windows\System\RbiUJKM.exe
  C:\Windows\System\RbiUJKM.exe
  2⤵
  PID:5224
- C:\Windows\System\hEoyPiU.exe
  C:\Windows\System\hEoyPiU.exe
  2⤵
  PID:5244
- C:\Windows\System\BNjZZTu.exe
  C:\Windows\System\BNjZZTu.exe
  2⤵
  PID:5260
- C:\Windows\System\MSTZyWr.exe
  C:\Windows\System\MSTZyWr.exe
  2⤵
  PID:5280
- C:\Windows\System\nfChCND.exe
  C:\Windows\System\nfChCND.exe
  2⤵
  PID:5300
- C:\Windows\System\bUtkszV.exe
  C:\Windows\System\bUtkszV.exe
  2⤵
  PID:5324
- C:\Windows\System\aodrONI.exe
  C:\Windows\System\aodrONI.exe
  2⤵
  PID:5340
- C:\Windows\System\coNGHVk.exe
  C:\Windows\System\coNGHVk.exe
  2⤵
  PID:5364
- C:\Windows\System\mFiwNUs.exe
  C:\Windows\System\mFiwNUs.exe
  2⤵
  PID:5380
- C:\Windows\System\VEgQgiJ.exe
  C:\Windows\System\VEgQgiJ.exe
  2⤵
  PID:5404
- C:\Windows\System\YUuddfm.exe
  C:\Windows\System\YUuddfm.exe
  2⤵
  PID:5420
- C:\Windows\System\VhpdZQm.exe
  C:\Windows\System\VhpdZQm.exe
  2⤵
  PID:5440
- C:\Windows\System\pjDwygm.exe
  C:\Windows\System\pjDwygm.exe
  2⤵
  PID:5464
- C:\Windows\System\cOqyWxt.exe
  C:\Windows\System\cOqyWxt.exe
  2⤵
  PID:5488
- C:\Windows\System\qWylaDp.exe
  C:\Windows\System\qWylaDp.exe
  2⤵
  PID:5504
- C:\Windows\System\cEMBwfc.exe
  C:\Windows\System\cEMBwfc.exe
  2⤵
  PID:5528
- C:\Windows\System\QIasHia.exe
  C:\Windows\System\QIasHia.exe
  2⤵
  PID:5544
- C:\Windows\System\KCftayG.exe
  C:\Windows\System\KCftayG.exe
  2⤵
  PID:5568
- C:\Windows\System\EAdXjoi.exe
  C:\Windows\System\EAdXjoi.exe
  2⤵
  PID:5584
- C:\Windows\System\oygzCPn.exe
  C:\Windows\System\oygzCPn.exe
  2⤵
  PID:5608
- C:\Windows\System\hzLGZgt.exe
  C:\Windows\System\hzLGZgt.exe
  2⤵
  PID:5624
- C:\Windows\System\vHiAvWP.exe
  C:\Windows\System\vHiAvWP.exe
  2⤵
  PID:5648
- C:\Windows\System\lpIejIu.exe
  C:\Windows\System\lpIejIu.exe
  2⤵
  PID:5668
- C:\Windows\System\slUoCPd.exe
  C:\Windows\System\slUoCPd.exe
  2⤵
  PID:5688
- C:\Windows\System\kByfuPz.exe
  C:\Windows\System\kByfuPz.exe
  2⤵
  PID:5704
- C:\Windows\System\zzHgeQg.exe
  C:\Windows\System\zzHgeQg.exe
  2⤵
  PID:5728
- C:\Windows\System\SDfThRU.exe
  C:\Windows\System\SDfThRU.exe
  2⤵
  PID:5744
- C:\Windows\System\YKAZLHy.exe
  C:\Windows\System\YKAZLHy.exe
  2⤵
  PID:5768
- C:\Windows\System\PeifUjn.exe
  C:\Windows\System\PeifUjn.exe
  2⤵
  PID:5784
- C:\Windows\System\zcYHZjr.exe
  C:\Windows\System\zcYHZjr.exe
  2⤵
  PID:5804
- C:\Windows\System\BWwRJan.exe
  C:\Windows\System\BWwRJan.exe
  2⤵
  PID:5824
- C:\Windows\System\EerzjvU.exe
  C:\Windows\System\EerzjvU.exe
  2⤵
  PID:5844
- C:\Windows\System\yBMcDRh.exe
  C:\Windows\System\yBMcDRh.exe
  2⤵
  PID:5864
- C:\Windows\System\VYCTRmN.exe
  C:\Windows\System\VYCTRmN.exe
  2⤵
  PID:5888
- C:\Windows\System\EUHPijQ.exe
  C:\Windows\System\EUHPijQ.exe
  2⤵
  PID:5904
- C:\Windows\System\ctUSPdE.exe
  C:\Windows\System\ctUSPdE.exe
  2⤵
  PID:5924
- C:\Windows\System\beqxjPt.exe
  C:\Windows\System\beqxjPt.exe
  2⤵
  PID:5940
- C:\Windows\System\EDsPYpQ.exe
  C:\Windows\System\EDsPYpQ.exe
  2⤵
  PID:5968
- C:\Windows\System\DlkWNKp.exe
  C:\Windows\System\DlkWNKp.exe
  2⤵
  PID:5984
- C:\Windows\System\iZwnWeT.exe
  C:\Windows\System\iZwnWeT.exe
  2⤵
  PID:6008
- C:\Windows\System\actMYQe.exe
  C:\Windows\System\actMYQe.exe
  2⤵
  PID:6024
- C:\Windows\System\QVgEUaO.exe
  C:\Windows\System\QVgEUaO.exe
  2⤵
  PID:6048
- C:\Windows\System\dGMfbCS.exe
  C:\Windows\System\dGMfbCS.exe
  2⤵
  PID:6068
- C:\Windows\System\minBGZU.exe
  C:\Windows\System\minBGZU.exe
  2⤵
  PID:6088
- C:\Windows\System\BPEMwhD.exe
  C:\Windows\System\BPEMwhD.exe
  2⤵
  PID:6104
- C:\Windows\System\lrpOgoG.exe
  C:\Windows\System\lrpOgoG.exe
  2⤵
  PID:6124
- C:\Windows\System\ZhvOThW.exe
  C:\Windows\System\ZhvOThW.exe
  2⤵
  PID:4880
- C:\Windows\System\SvhxoMY.exe
  C:\Windows\System\SvhxoMY.exe
  2⤵
  PID:2984
- C:\Windows\System\vAcivEr.exe
  C:\Windows\System\vAcivEr.exe
  2⤵
  PID:4996
- C:\Windows\System\QeopPaa.exe
  C:\Windows\System\QeopPaa.exe
  2⤵
  PID:2676
- C:\Windows\System\EtWAamT.exe
  C:\Windows\System\EtWAamT.exe
  2⤵
  PID:296
- C:\Windows\System\ebTqvIu.exe
  C:\Windows\System\ebTqvIu.exe
  2⤵
  PID:2764
- C:\Windows\System\HHFexGs.exe
  C:\Windows\System\HHFexGs.exe
  2⤵
  PID:3148
- C:\Windows\System\pfHQFxT.exe
  C:\Windows\System\pfHQFxT.exe
  2⤵
  PID:4032
- C:\Windows\System\EDzAVbT.exe
  C:\Windows\System\EDzAVbT.exe
  2⤵
  PID:3528
- C:\Windows\System\JsAwaik.exe
  C:\Windows\System\JsAwaik.exe
  2⤵
  PID:2524
- C:\Windows\System\aiHAYaX.exe
  C:\Windows\System\aiHAYaX.exe
  2⤵
  PID:2768
- C:\Windows\System\MTXsVDk.exe
  C:\Windows\System\MTXsVDk.exe
  2⤵
  PID:4292
- C:\Windows\System\cCzVROM.exe
  C:\Windows\System\cCzVROM.exe
  2⤵
  PID:4460
- C:\Windows\System\avTAHIK.exe
  C:\Windows\System\avTAHIK.exe
  2⤵
  PID:4280
- C:\Windows\System\KTEyxxc.exe
  C:\Windows\System\KTEyxxc.exe
  2⤵
  PID:4660
- C:\Windows\System\LaWRYoX.exe
  C:\Windows\System\LaWRYoX.exe
  2⤵
  PID:4600
- C:\Windows\System\ZSXioeO.exe
  C:\Windows\System\ZSXioeO.exe
  2⤵
  PID:1968
- C:\Windows\System\vezqCqq.exe
  C:\Windows\System\vezqCqq.exe
  2⤵
  PID:5160
- C:\Windows\System\MfmPgtJ.exe
  C:\Windows\System\MfmPgtJ.exe
  2⤵
  PID:5200
- C:\Windows\System\VEEOBcw.exe
  C:\Windows\System\VEEOBcw.exe
  2⤵
  PID:5172
- C:\Windows\System\BtaeUGy.exe
  C:\Windows\System\BtaeUGy.exe
  2⤵
  PID:1972
- C:\Windows\System\HPPxmDI.exe
  C:\Windows\System\HPPxmDI.exe
  2⤵
  PID:1608
- C:\Windows\System\roQRGbP.exe
  C:\Windows\System\roQRGbP.exe
  2⤵
  PID:5276
- C:\Windows\System\stYxGyl.exe
  C:\Windows\System\stYxGyl.exe
  2⤵
  PID:5316
- C:\Windows\System\WywcXLz.exe
  C:\Windows\System\WywcXLz.exe
  2⤵
  PID:5296
- C:\Windows\System\iFJOJgO.exe
  C:\Windows\System\iFJOJgO.exe
  2⤵
  PID:2836
- C:\Windows\System\FGIRtAP.exe
  C:\Windows\System\FGIRtAP.exe
  2⤵
  PID:1508
- C:\Windows\System\HBJwERi.exe
  C:\Windows\System\HBJwERi.exe
  2⤵
  PID:5400
- C:\Windows\System\xEjnGhY.exe
  C:\Windows\System\xEjnGhY.exe
  2⤵
  PID:5412
- C:\Windows\System\FubuXFg.exe
  C:\Windows\System\FubuXFg.exe
  2⤵
  PID:1128
- C:\Windows\System\NRiRIbu.exe
  C:\Windows\System\NRiRIbu.exe
  2⤵
  PID:5480
- C:\Windows\System\dXDFMcr.exe
  C:\Windows\System\dXDFMcr.exe
  2⤵
  PID:2116
- C:\Windows\System\rYifVfw.exe
  C:\Windows\System\rYifVfw.exe
  2⤵
  PID:5524
- C:\Windows\System\ydwyoEq.exe
  C:\Windows\System\ydwyoEq.exe
  2⤵
  PID:5500
- C:\Windows\System\bqRJEZB.exe
  C:\Windows\System\bqRJEZB.exe
  2⤵
  PID:5560
- C:\Windows\System\AxTfjXG.exe
  C:\Windows\System\AxTfjXG.exe
  2⤵
  PID:1092
- C:\Windows\System\HrjHEdr.exe
  C:\Windows\System\HrjHEdr.exe
  2⤵
  PID:5604
- C:\Windows\System\JBqgHuB.exe
  C:\Windows\System\JBqgHuB.exe
  2⤵
  PID:5640
- C:\Windows\System\cXBqepc.exe
  C:\Windows\System\cXBqepc.exe
  2⤵
  PID:5680
- C:\Windows\System\jnyYbBW.exe
  C:\Windows\System\jnyYbBW.exe
  2⤵
  PID:5664
- C:\Windows\System\THpytfe.exe
  C:\Windows\System\THpytfe.exe
  2⤵
  PID:5752
- C:\Windows\System\ipZFMsG.exe
  C:\Windows\System\ipZFMsG.exe
  2⤵
  PID:5792
- C:\Windows\System\tvGRvqS.exe
  C:\Windows\System\tvGRvqS.exe
  2⤵
  PID:5832
- C:\Windows\System\vQVvyDd.exe
  C:\Windows\System\vQVvyDd.exe
  2⤵
  PID:5780
- C:\Windows\System\znNkRUQ.exe
  C:\Windows\System\znNkRUQ.exe
  2⤵
  PID:5820
- C:\Windows\System\gHbeZBd.exe
  C:\Windows\System\gHbeZBd.exe
  2⤵
  PID:1836
- C:\Windows\System\aVnYPPR.exe
  C:\Windows\System\aVnYPPR.exe
  2⤵
  PID:5916
- C:\Windows\System\IaWfPYc.exe
  C:\Windows\System\IaWfPYc.exe
  2⤵
  PID:5952
- C:\Windows\System\CaMLiEE.exe
  C:\Windows\System\CaMLiEE.exe
  2⤵
  PID:5896
- C:\Windows\System\lXfFyiN.exe
  C:\Windows\System\lXfFyiN.exe
  2⤵
  PID:5976
- C:\Windows\System\WFclQFU.exe
  C:\Windows\System\WFclQFU.exe
  2⤵
  PID:6036
- C:\Windows\System\FrVcLzW.exe
  C:\Windows\System\FrVcLzW.exe
  2⤵
  PID:6076
- C:\Windows\System\ckvLXOF.exe
  C:\Windows\System\ckvLXOF.exe
  2⤵
  PID:6060
- C:\Windows\System\tAuSbdV.exe
  C:\Windows\System\tAuSbdV.exe
  2⤵
  PID:6096
- C:\Windows\System\Ataosjw.exe
  C:\Windows\System\Ataosjw.exe
  2⤵
  PID:6132
- C:\Windows\System\XFWFBWQ.exe
  C:\Windows\System\XFWFBWQ.exe
  2⤵
  PID:5056
- C:\Windows\System\CeepKtB.exe
  C:\Windows\System\CeepKtB.exe
  2⤵
  PID:4980
- C:\Windows\System\HhzDZYB.exe
  C:\Windows\System\HhzDZYB.exe
  2⤵
  PID:3568
- C:\Windows\System\LntFkog.exe
  C:\Windows\System\LntFkog.exe
  2⤵
  PID:2528
- C:\Windows\System\ObHTqKV.exe
  C:\Windows\System\ObHTqKV.exe
  2⤵
  PID:2772
- C:\Windows\System\kkctLjP.exe
  C:\Windows\System\kkctLjP.exe
  2⤵
  PID:2332
- C:\Windows\System\BzdwRyt.exe
  C:\Windows\System\BzdwRyt.exe
  2⤵
  PID:2660
- C:\Windows\System\tRPOikw.exe
  C:\Windows\System\tRPOikw.exe
  2⤵
  PID:4760
- C:\Windows\System\tYmgLhN.exe
  C:\Windows\System\tYmgLhN.exe
  2⤵
  PID:2216
- C:\Windows\System\nUknwjn.exe
  C:\Windows\System\nUknwjn.exe
  2⤵
  PID:808
- C:\Windows\System\ygDWbDU.exe
  C:\Windows\System\ygDWbDU.exe
  2⤵
  PID:5136
- C:\Windows\System\tTMRtgA.exe
  C:\Windows\System\tTMRtgA.exe
  2⤵
  PID:2544
- C:\Windows\System\JDcHDza.exe
  C:\Windows\System\JDcHDza.exe
  2⤵
  PID:4484
- C:\Windows\System\TMQhopW.exe
  C:\Windows\System\TMQhopW.exe
  2⤵
  PID:2784
- C:\Windows\System\pgbzjKo.exe
  C:\Windows\System\pgbzjKo.exe
  2⤵
  PID:2812
- C:\Windows\System\QHQWFwx.exe
  C:\Windows\System\QHQWFwx.exe
  2⤵
  PID:2628
- C:\Windows\System\LtJpQTd.exe
  C:\Windows\System\LtJpQTd.exe
  2⤵
  PID:2940
- C:\Windows\System\mYsmnyD.exe
  C:\Windows\System\mYsmnyD.exe
  2⤵
  PID:5196
- C:\Windows\System\vbVaQjm.exe
  C:\Windows\System\vbVaQjm.exe
  2⤵
  PID:5252
- C:\Windows\System\hGOuYvB.exe
  C:\Windows\System\hGOuYvB.exe
  2⤵
  PID:5320
- C:\Windows\System\wEPaHkb.exe
  C:\Windows\System\wEPaHkb.exe
  2⤵
  PID:5360
- C:\Windows\System\qwzPUDM.exe
  C:\Windows\System\qwzPUDM.exe
  2⤵
  PID:5392
- C:\Windows\System\CYHkBXS.exe
  C:\Windows\System\CYHkBXS.exe
  2⤵
  PID:5452
- C:\Windows\System\MaFcUBG.exe
  C:\Windows\System\MaFcUBG.exe
  2⤵
  PID:5436
- C:\Windows\System\cAtHqqm.exe
  C:\Windows\System\cAtHqqm.exe
  2⤵
  PID:5428
- C:\Windows\System\fbtDTaO.exe
  C:\Windows\System\fbtDTaO.exe
  2⤵
  PID:5476
- C:\Windows\System\iNRPbXB.exe
  C:\Windows\System\iNRPbXB.exe
  2⤵
  PID:1600
- C:\Windows\System\fafqumN.exe
  C:\Windows\System\fafqumN.exe
  2⤵
  PID:5836
- C:\Windows\System\MiqobRx.exe
  C:\Windows\System\MiqobRx.exe
  2⤵
  PID:548
- C:\Windows\System\uhKUKaV.exe
  C:\Windows\System\uhKUKaV.exe
  2⤵
  PID:5816
- C:\Windows\System\yEAWVmg.exe
  C:\Windows\System\yEAWVmg.exe
  2⤵
  PID:5600
- C:\Windows\System\NIBgiVM.exe
  C:\Windows\System\NIBgiVM.exe
  2⤵
  PID:5996
- C:\Windows\System\BBMyxSc.exe
  C:\Windows\System\BBMyxSc.exe
  2⤵
  PID:5920
- C:\Windows\System\sNWQUmb.exe
  C:\Windows\System\sNWQUmb.exe
  2⤵
  PID:5964
- C:\Windows\System\ltsAsRV.exe
  C:\Windows\System\ltsAsRV.exe
  2⤵
  PID:6120
- C:\Windows\System\IWavMWo.exe
  C:\Windows\System\IWavMWo.exe
  2⤵
  PID:5036
- C:\Windows\System\vMdjUrr.exe
  C:\Windows\System\vMdjUrr.exe
  2⤵
  PID:2540
- C:\Windows\System\yzpuJkQ.exe
  C:\Windows\System\yzpuJkQ.exe
  2⤵
  PID:2948
- C:\Windows\System\IiGwnfK.exe
  C:\Windows\System\IiGwnfK.exe
  2⤵
  PID:308
- C:\Windows\System\UuosSbo.exe
  C:\Windows\System\UuosSbo.exe
  2⤵
  PID:5216
- C:\Windows\System\BwOVdij.exe
  C:\Windows\System\BwOVdij.exe
  2⤵
  PID:6080
- C:\Windows\System\KFJrUbk.exe
  C:\Windows\System\KFJrUbk.exe
  2⤵
  PID:344
- C:\Windows\System\SGsWlIF.exe
  C:\Windows\System\SGsWlIF.exe
  2⤵
  PID:536
- C:\Windows\System\lhtqzlH.exe
  C:\Windows\System\lhtqzlH.exe
  2⤵
  PID:2564
- C:\Windows\System\TBraADu.exe
  C:\Windows\System\TBraADu.exe
  2⤵
  PID:2132
- C:\Windows\System\beCbTdU.exe
  C:\Windows\System\beCbTdU.exe
  2⤵
  PID:5240
- C:\Windows\System\aMZaeMe.exe
  C:\Windows\System\aMZaeMe.exe
  2⤵
  PID:4800
- C:\Windows\System\SYCpEhT.exe
  C:\Windows\System\SYCpEhT.exe
  2⤵
  PID:3116
- C:\Windows\System\AriFFuw.exe
  C:\Windows\System\AriFFuw.exe
  2⤵
  PID:5556
- C:\Windows\System\svShfLT.exe
  C:\Windows\System\svShfLT.exe
  2⤵
  PID:5656
- C:\Windows\System\eLgAKYp.exe
  C:\Windows\System\eLgAKYp.exe
  2⤵
  PID:5460
- C:\Windows\System\qiPMeGo.exe
  C:\Windows\System\qiPMeGo.exe
  2⤵
  PID:5776
- C:\Windows\System\UaPEqRj.exe
  C:\Windows\System\UaPEqRj.exe
  2⤵
  PID:5796
- C:\Windows\System\funWKED.exe
  C:\Windows\System\funWKED.exe
  2⤵
  PID:5596
- C:\Windows\System\cNbYghO.exe
  C:\Windows\System\cNbYghO.exe
  2⤵
  PID:6112
- C:\Windows\System\geYKmDz.exe
  C:\Windows\System\geYKmDz.exe
  2⤵
  PID:5700
- C:\Windows\System\aTJDfOp.exe
  C:\Windows\System\aTJDfOp.exe
  2⤵
  PID:1416
- C:\Windows\System\pbDgriv.exe
  C:\Windows\System\pbDgriv.exe
  2⤵
  PID:5876
- C:\Windows\System\FqiNRda.exe
  C:\Windows\System\FqiNRda.exe
  2⤵
  PID:4464
- C:\Windows\System\pslDGLG.exe
  C:\Windows\System\pslDGLG.exe
  2⤵
  PID:2636
- C:\Windows\System\jfLIZYb.exe
  C:\Windows\System\jfLIZYb.exe
  2⤵
  PID:5268
- C:\Windows\System\pYHDaDO.exe
  C:\Windows\System\pYHDaDO.exe
  2⤵
  PID:5312
- C:\Windows\System\qblLkOZ.exe
  C:\Windows\System\qblLkOZ.exe
  2⤵
  PID:5128
- C:\Windows\System\jVgSanc.exe
  C:\Windows\System\jVgSanc.exe
  2⤵
  PID:1264
- C:\Windows\System\uzFrndL.exe
  C:\Windows\System\uzFrndL.exe
  2⤵
  PID:2852
- C:\Windows\System\HgQJPbh.exe
  C:\Windows\System\HgQJPbh.exe
  2⤵
  PID:4896
- C:\Windows\System\iLirsep.exe
  C:\Windows\System\iLirsep.exe
  2⤵
  PID:5696
- C:\Windows\System\EVrrFQl.exe
  C:\Windows\System\EVrrFQl.exe
  2⤵
  PID:5676
- C:\Windows\System\LXAhkyh.exe
  C:\Windows\System\LXAhkyh.exe
  2⤵
  PID:6000
- C:\Windows\System\zxRAlZr.exe
  C:\Windows\System\zxRAlZr.exe
  2⤵
  PID:3648
- C:\Windows\System\JDtoelQ.exe
  C:\Windows\System\JDtoelQ.exe
  2⤵
  PID:4556
- C:\Windows\System\TogrkXu.exe
  C:\Windows\System\TogrkXu.exe
  2⤵
  PID:6004
- C:\Windows\System\ywxylfc.exe
  C:\Windows\System\ywxylfc.exe
  2⤵
  PID:5396
- C:\Windows\System\btZalQO.exe
  C:\Windows\System\btZalQO.exe
  2⤵
  PID:4092
- C:\Windows\System\ProlSFq.exe
  C:\Windows\System\ProlSFq.exe
  2⤵
  PID:5636
- C:\Windows\System\XtUFVtw.exe
  C:\Windows\System\XtUFVtw.exe
  2⤵
  PID:1532
- C:\Windows\System\XercUWL.exe
  C:\Windows\System\XercUWL.exe
  2⤵
  PID:2508
- C:\Windows\System\nDYoJBN.exe
  C:\Windows\System\nDYoJBN.exe
  2⤵
  PID:5948
- C:\Windows\System\glMVNOw.exe
  C:\Windows\System\glMVNOw.exe
  2⤵
  PID:892
- C:\Windows\System\itCcdmz.exe
  C:\Windows\System\itCcdmz.exe
  2⤵
  PID:5884
- C:\Windows\System\ebouJvb.exe
  C:\Windows\System\ebouJvb.exe
  2⤵
  PID:5580
- C:\Windows\System\mvcupZJ.exe
  C:\Windows\System\mvcupZJ.exe
  2⤵
  PID:5756
- C:\Windows\System\uUEfqch.exe
  C:\Windows\System\uUEfqch.exe
  2⤵
  PID:4936
- C:\Windows\System\suNKCuT.exe
  C:\Windows\System\suNKCuT.exe
  2⤵
  PID:6184
- C:\Windows\System\vUCSSgY.exe
  C:\Windows\System\vUCSSgY.exe
  2⤵
  PID:6200
- C:\Windows\System\hUgRBWH.exe
  C:\Windows\System\hUgRBWH.exe
  2⤵
  PID:6216
- C:\Windows\System\flAEGoF.exe
  C:\Windows\System\flAEGoF.exe
  2⤵
  PID:6232
- C:\Windows\System\lBlUzFZ.exe
  C:\Windows\System\lBlUzFZ.exe
  2⤵
  PID:6248
- C:\Windows\System\WdlxDxc.exe
  C:\Windows\System\WdlxDxc.exe
  2⤵
  PID:6264
- C:\Windows\System\fZNzSxf.exe
  C:\Windows\System\fZNzSxf.exe
  2⤵
  PID:6280
- C:\Windows\System\XgSvMfE.exe
  C:\Windows\System\XgSvMfE.exe
  2⤵
  PID:6296
- C:\Windows\System\DuEWttN.exe
  C:\Windows\System\DuEWttN.exe
  2⤵
  PID:6312
- C:\Windows\System\RuEVNmI.exe
  C:\Windows\System\RuEVNmI.exe
  2⤵
  PID:6328
- C:\Windows\System\SMbnqbX.exe
  C:\Windows\System\SMbnqbX.exe
  2⤵
  PID:6344
- C:\Windows\System\iFtHCuH.exe
  C:\Windows\System\iFtHCuH.exe
  2⤵
  PID:6360
- C:\Windows\System\hhNpyTv.exe
  C:\Windows\System\hhNpyTv.exe
  2⤵
  PID:6376
- C:\Windows\System\aUBNfUD.exe
  C:\Windows\System\aUBNfUD.exe
  2⤵
  PID:6392
- C:\Windows\System\IqDiVoI.exe
  C:\Windows\System\IqDiVoI.exe
  2⤵
  PID:6408
- C:\Windows\System\DVucLbZ.exe
  C:\Windows\System\DVucLbZ.exe
  2⤵
  PID:6428
- C:\Windows\System\reuloKt.exe
  C:\Windows\System\reuloKt.exe
  2⤵
  PID:6448
- C:\Windows\System\hAgVMFq.exe
  C:\Windows\System\hAgVMFq.exe
  2⤵
  PID:6468
- C:\Windows\System\jtkZzqg.exe
  C:\Windows\System\jtkZzqg.exe
  2⤵
  PID:6488
- C:\Windows\System\fOaCVjf.exe
  C:\Windows\System\fOaCVjf.exe
  2⤵
  PID:6508
- C:\Windows\System\WodugCv.exe
  C:\Windows\System\WodugCv.exe
  2⤵
  PID:6524
- C:\Windows\System\WklOrpz.exe
  C:\Windows\System\WklOrpz.exe
  2⤵
  PID:6548
- C:\Windows\System\jKoVnyF.exe
  C:\Windows\System\jKoVnyF.exe
  2⤵
  PID:6564
- C:\Windows\System\oxGFyBB.exe
  C:\Windows\System\oxGFyBB.exe
  2⤵
  PID:6584
- C:\Windows\System\LfGxwMJ.exe
  C:\Windows\System\LfGxwMJ.exe
  2⤵
  PID:6600
- C:\Windows\System\ZfpVdqI.exe
  C:\Windows\System\ZfpVdqI.exe
  2⤵
  PID:6616
- C:\Windows\System\vwOIxmE.exe
  C:\Windows\System\vwOIxmE.exe
  2⤵
  PID:6636
- C:\Windows\System\fTlMfSu.exe
  C:\Windows\System\fTlMfSu.exe
  2⤵
  PID:6656
- C:\Windows\System\ZKmzaQI.exe
  C:\Windows\System\ZKmzaQI.exe
  2⤵
  PID:6676
- C:\Windows\System\ljQvplK.exe
  C:\Windows\System\ljQvplK.exe
  2⤵
  PID:6696
- C:\Windows\System\PMKbZyV.exe
  C:\Windows\System\PMKbZyV.exe
  2⤵
  PID:6712
- C:\Windows\System\BOPbUtw.exe
  C:\Windows\System\BOPbUtw.exe
  2⤵
  PID:6732
- C:\Windows\System\DfFrLYq.exe
  C:\Windows\System\DfFrLYq.exe
  2⤵
  PID:6752
- C:\Windows\System\sqEcyDC.exe
  C:\Windows\System\sqEcyDC.exe
  2⤵
  PID:6772
- C:\Windows\System\YkLcuNW.exe
  C:\Windows\System\YkLcuNW.exe
  2⤵
  PID:6792
- C:\Windows\System\VCtySWv.exe
  C:\Windows\System\VCtySWv.exe
  2⤵
  PID:6808
- C:\Windows\System\HkoQprj.exe
  C:\Windows\System\HkoQprj.exe
  2⤵
  PID:6828
- C:\Windows\System\cRGsRbU.exe
  C:\Windows\System\cRGsRbU.exe
  2⤵
  PID:6844
- C:\Windows\System\FuhQBTm.exe
  C:\Windows\System\FuhQBTm.exe
  2⤵
  PID:6860
- C:\Windows\System\vHBYDLY.exe
  C:\Windows\System\vHBYDLY.exe
  2⤵
  PID:6884
- C:\Windows\System\pfkxvbX.exe
  C:\Windows\System\pfkxvbX.exe
  2⤵
  PID:6908
- C:\Windows\System\HqlCLti.exe
  C:\Windows\System\HqlCLti.exe
  2⤵
  PID:6928
- C:\Windows\System\OPlYvKa.exe
  C:\Windows\System\OPlYvKa.exe
  2⤵
  PID:6948
- C:\Windows\System\wOtloin.exe
  C:\Windows\System\wOtloin.exe
  2⤵
  PID:6976
- C:\Windows\System\YzyysKB.exe
  C:\Windows\System\YzyysKB.exe
  2⤵
  PID:7044
- C:\Windows\System\tllxQON.exe
  C:\Windows\System\tllxQON.exe
  2⤵
  PID:7076
- C:\Windows\System\mTdxUhL.exe
  C:\Windows\System\mTdxUhL.exe
  2⤵
  PID:7092
- C:\Windows\System\ijvArHi.exe
  C:\Windows\System\ijvArHi.exe
  2⤵
  PID:7108
- C:\Windows\System\SbtaFLi.exe
  C:\Windows\System\SbtaFLi.exe
  2⤵
  PID:7136
- C:\Windows\System\KEpujqi.exe
  C:\Windows\System\KEpujqi.exe
  2⤵
  PID:7152
- C:\Windows\System\eRDoqdb.exe
  C:\Windows\System\eRDoqdb.exe
  2⤵
  PID:2504
- C:\Windows\System\AXyxpeb.exe
  C:\Windows\System\AXyxpeb.exe
  2⤵
  PID:5852
- C:\Windows\System\bRVaqaB.exe
  C:\Windows\System\bRVaqaB.exe
  2⤵
  PID:6160
- C:\Windows\System\zxppArJ.exe
  C:\Windows\System\zxppArJ.exe
  2⤵
  PID:4636
- C:\Windows\System\ygxkvqi.exe
  C:\Windows\System\ygxkvqi.exe
  2⤵
  PID:2952
- C:\Windows\System\KHVThTI.exe
  C:\Windows\System\KHVThTI.exe
  2⤵
  PID:5456
- C:\Windows\System\GbqZHQu.exe
  C:\Windows\System\GbqZHQu.exe
  2⤵
  PID:6196
- C:\Windows\System\EbhUxKB.exe
  C:\Windows\System\EbhUxKB.exe
  2⤵
  PID:6256
- C:\Windows\System\TNtLbHC.exe
  C:\Windows\System\TNtLbHC.exe
  2⤵
  PID:6320
- C:\Windows\System\UunMJcg.exe
  C:\Windows\System\UunMJcg.exe
  2⤵
  PID:6384
- C:\Windows\System\boIepYu.exe
  C:\Windows\System\boIepYu.exe
  2⤵
  PID:6420
- C:\Windows\System\JQZvEoc.exe
  C:\Windows\System\JQZvEoc.exe
  2⤵
  PID:6504
- C:\Windows\System\MLQZLUg.exe
  C:\Windows\System\MLQZLUg.exe
  2⤵
  PID:6544
- C:\Windows\System\PWazUMt.exe
  C:\Windows\System\PWazUMt.exe
  2⤵
  PID:6608
- C:\Windows\System\HimBDnw.exe
  C:\Windows\System\HimBDnw.exe
  2⤵
  PID:6652
- C:\Windows\System\bYMawrB.exe
  C:\Windows\System\bYMawrB.exe
  2⤵
  PID:6692
- C:\Windows\System\QdPYcqp.exe
  C:\Windows\System\QdPYcqp.exe
  2⤵
  PID:6764
- C:\Windows\System\ryKYlOM.exe
  C:\Windows\System\ryKYlOM.exe
  2⤵
  PID:6180
- C:\Windows\System\XqNvLRi.exe
  C:\Windows\System\XqNvLRi.exe
  2⤵
  PID:6872
- C:\Windows\System\MCqIXTl.exe
  C:\Windows\System\MCqIXTl.exe
  2⤵
  PID:6920
- C:\Windows\System\tdRuSoZ.exe
  C:\Windows\System\tdRuSoZ.exe
  2⤵
  PID:6956
- C:\Windows\System\SiiaAPR.exe
  C:\Windows\System\SiiaAPR.exe
  2⤵
  PID:6476
- C:\Windows\System\isDvPdP.exe
  C:\Windows\System\isDvPdP.exe
  2⤵
  PID:6624
- C:\Windows\System\QzlgPOz.exe
  C:\Windows\System\QzlgPOz.exe
  2⤵
  PID:6852
- C:\Windows\System\fcdWETx.exe
  C:\Windows\System\fcdWETx.exe
  2⤵
  PID:6244
- C:\Windows\System\JuwlUke.exe
  C:\Windows\System\JuwlUke.exe
  2⤵
  PID:6308
- C:\Windows\System\UgsBSgm.exe
  C:\Windows\System\UgsBSgm.exe
  2⤵
  PID:6404
- C:\Windows\System\LYkcWcc.exe
  C:\Windows\System\LYkcWcc.exe
  2⤵
  PID:6516
- C:\Windows\System\uEcbmma.exe
  C:\Windows\System\uEcbmma.exe
  2⤵
  PID:6592
- C:\Windows\System\PEjTicO.exe
  C:\Windows\System\PEjTicO.exe
  2⤵
  PID:6704
- C:\Windows\System\zKPgPvc.exe
  C:\Windows\System\zKPgPvc.exe
  2⤵
  PID:6748
- C:\Windows\System\NeOhQSu.exe
  C:\Windows\System\NeOhQSu.exe
  2⤵
  PID:6820
- C:\Windows\System\IEdtWhX.exe
  C:\Windows\System\IEdtWhX.exe
  2⤵
  PID:6896
- C:\Windows\System\jCvNyQX.exe
  C:\Windows\System\jCvNyQX.exe
  2⤵
  PID:6944
- C:\Windows\System\NMxiDcm.exe
  C:\Windows\System\NMxiDcm.exe
  2⤵
  PID:6368
- C:\Windows\System\Xtdvktq.exe
  C:\Windows\System\Xtdvktq.exe
  2⤵
  PID:7064
- C:\Windows\System\zSRTjec.exe
  C:\Windows\System\zSRTjec.exe
  2⤵
  PID:7104
- C:\Windows\System\JiQavAL.exe
  C:\Windows\System\JiQavAL.exe
  2⤵
  PID:7040
- C:\Windows\System\CVgPzTN.exe
  C:\Windows\System\CVgPzTN.exe
  2⤵
  PID:7132
- C:\Windows\System\IGfmuBj.exe
  C:\Windows\System\IGfmuBj.exe
  2⤵
  PID:1708
- C:\Windows\System\GeoJsRX.exe
  C:\Windows\System\GeoJsRX.exe
  2⤵
  PID:6168
- C:\Windows\System\VSKsPTO.exe
  C:\Windows\System\VSKsPTO.exe
  2⤵
  PID:4076
- C:\Windows\System\fuJcwky.exe
  C:\Windows\System\fuJcwky.exe
  2⤵
  PID:6152
- C:\Windows\System\mazRbFO.exe
  C:\Windows\System\mazRbFO.exe
  2⤵
  PID:6228
- C:\Windows\System\kDdknhF.exe
  C:\Windows\System\kDdknhF.exe
  2⤵
  PID:6356
- C:\Windows\System\VjpfyRB.exe
  C:\Windows\System\VjpfyRB.exe
  2⤵
  PID:6580
- C:\Windows\System\ExAfKkO.exe
  C:\Windows\System\ExAfKkO.exe
  2⤵
  PID:6416
- C:\Windows\System\pDkLroa.exe
  C:\Windows\System\pDkLroa.exe
  2⤵
  PID:6540
- C:\Windows\System\xGkkUpQ.exe
  C:\Windows\System\xGkkUpQ.exe
  2⤵
  PID:6916
- C:\Windows\System\lWHJCdr.exe
  C:\Windows\System\lWHJCdr.exe
  2⤵
  PID:6724
- C:\Windows\System\dAggonF.exe
  C:\Windows\System\dAggonF.exe
  2⤵
  PID:6728
- C:\Windows\System\RCIdJFL.exe
  C:\Windows\System\RCIdJFL.exe
  2⤵
  PID:6484
- C:\Windows\System\oDWmWIT.exe
  C:\Windows\System\oDWmWIT.exe
  2⤵
  PID:6668
- C:\Windows\System\PFCmuAc.exe
  C:\Windows\System\PFCmuAc.exe
  2⤵
  PID:6276
- C:\Windows\System\QKLUyUr.exe
  C:\Windows\System\QKLUyUr.exe
  2⤵
  PID:6596
- C:\Windows\System\JuRXBBi.exe
  C:\Windows\System\JuRXBBi.exe
  2⤵
  PID:6240
- C:\Windows\System\rivJWiY.exe
  C:\Windows\System\rivJWiY.exe
  2⤵
  PID:7056
- C:\Windows\System\FJKzuDt.exe
  C:\Windows\System\FJKzuDt.exe
  2⤵
  PID:6816
- C:\Windows\System\QXvJGZX.exe
  C:\Windows\System\QXvJGZX.exe
  2⤵
  PID:6988
- C:\Windows\System\Eiykela.exe
  C:\Windows\System\Eiykela.exe
  2⤵
  PID:7128
- C:\Windows\System\sBtnZvV.exe
  C:\Windows\System\sBtnZvV.exe
  2⤵
  PID:7144
- C:\Windows\System\ykQJCoP.exe
  C:\Windows\System\ykQJCoP.exe
  2⤵
  PID:6288
- C:\Windows\System\HIsVXnt.exe
  C:\Windows\System\HIsVXnt.exe
  2⤵
  PID:6688
- C:\Windows\System\IjgJRSN.exe
  C:\Windows\System\IjgJRSN.exe
  2⤵
  PID:6964
- C:\Windows\System\hJKQMTZ.exe
  C:\Windows\System\hJKQMTZ.exe
  2⤵
  PID:6352
- C:\Windows\System\ITzSrMM.exe
  C:\Windows\System\ITzSrMM.exe
  2⤵
  PID:6632
- C:\Windows\System\CQRbNQK.exe
  C:\Windows\System\CQRbNQK.exe
  2⤵
  PID:6868
- C:\Windows\System\rcStSAl.exe
  C:\Windows\System\rcStSAl.exe
  2⤵
  PID:6788
- C:\Windows\System\igotweH.exe
  C:\Windows\System\igotweH.exe
  2⤵
  PID:6892
- C:\Windows\System\AgMvEJg.exe
  C:\Windows\System\AgMvEJg.exe
  2⤵
  PID:7184
- C:\Windows\System\oVNibFo.exe
  C:\Windows\System\oVNibFo.exe
  2⤵
  PID:7200
- C:\Windows\System\qdDnaBx.exe
  C:\Windows\System\qdDnaBx.exe
  2⤵
  PID:7216
- C:\Windows\System\GHzekjL.exe
  C:\Windows\System\GHzekjL.exe
  2⤵
  PID:7232
- C:\Windows\System\DmfrEzr.exe
  C:\Windows\System\DmfrEzr.exe
  2⤵
  PID:7248
- C:\Windows\System\aNURxZa.exe
  C:\Windows\System\aNURxZa.exe
  2⤵
  PID:7264
- C:\Windows\System\UtKKpfo.exe
  C:\Windows\System\UtKKpfo.exe
  2⤵
  PID:7280
- C:\Windows\System\bUmbRDc.exe
  C:\Windows\System\bUmbRDc.exe
  2⤵
  PID:7296
- C:\Windows\System\PVcdekK.exe
  C:\Windows\System\PVcdekK.exe
  2⤵
  PID:7312
- C:\Windows\System\GpImxSQ.exe
  C:\Windows\System\GpImxSQ.exe
  2⤵
  PID:7328
- C:\Windows\System\SbacKyc.exe
  C:\Windows\System\SbacKyc.exe
  2⤵
  PID:7344
- C:\Windows\System\UJCzhAS.exe
  C:\Windows\System\UJCzhAS.exe
  2⤵
  PID:7360
- C:\Windows\System\QLNNyNd.exe
  C:\Windows\System\QLNNyNd.exe
  2⤵
  PID:7376
- C:\Windows\System\gJocysA.exe
  C:\Windows\System\gJocysA.exe
  2⤵
  PID:7392
- C:\Windows\System\FzQgMNx.exe
  C:\Windows\System\FzQgMNx.exe
  2⤵
  PID:7408
- C:\Windows\System\FbgvmPM.exe
  C:\Windows\System\FbgvmPM.exe
  2⤵
  PID:7424
- C:\Windows\System\vRNDRWr.exe
  C:\Windows\System\vRNDRWr.exe
  2⤵
  PID:7440
- C:\Windows\System\ujDIDrJ.exe
  C:\Windows\System\ujDIDrJ.exe
  2⤵
  PID:7456
- C:\Windows\System\GiROFWc.exe
  C:\Windows\System\GiROFWc.exe
  2⤵
  PID:7472
- C:\Windows\System\IuAyMAt.exe
  C:\Windows\System\IuAyMAt.exe
  2⤵
  PID:7488
- C:\Windows\System\MiYbJIX.exe
  C:\Windows\System\MiYbJIX.exe
  2⤵
  PID:7504
- C:\Windows\System\oouLytX.exe
  C:\Windows\System\oouLytX.exe
  2⤵
  PID:7520
- C:\Windows\System\IbfncxR.exe
  C:\Windows\System\IbfncxR.exe
  2⤵
  PID:7536
- C:\Windows\System\LEDiYPV.exe
  C:\Windows\System\LEDiYPV.exe
  2⤵
  PID:7552
- C:\Windows\System\RYXdCYF.exe
  C:\Windows\System\RYXdCYF.exe
  2⤵
  PID:7568
- C:\Windows\System\CFlgECv.exe
  C:\Windows\System\CFlgECv.exe
  2⤵
  PID:7584
- C:\Windows\System\rKTPBYH.exe
  C:\Windows\System\rKTPBYH.exe
  2⤵
  PID:7600
- C:\Windows\System\tCeWctt.exe
  C:\Windows\System\tCeWctt.exe
  2⤵
  PID:7616
- C:\Windows\System\rFKwsDy.exe
  C:\Windows\System\rFKwsDy.exe
  2⤵
  PID:7632
- C:\Windows\System\qZFJBib.exe
  C:\Windows\System\qZFJBib.exe
  2⤵
  PID:7648
- C:\Windows\System\cYbpPDb.exe
  C:\Windows\System\cYbpPDb.exe
  2⤵
  PID:7664
- C:\Windows\System\gPlDvAv.exe
  C:\Windows\System\gPlDvAv.exe
  2⤵
  PID:7680
- C:\Windows\System\oFRusAJ.exe
  C:\Windows\System\oFRusAJ.exe
  2⤵
  PID:7696
- C:\Windows\System\BiLPwxF.exe
  C:\Windows\System\BiLPwxF.exe
  2⤵
  PID:7712
- C:\Windows\System\yUounoH.exe
  C:\Windows\System\yUounoH.exe
  2⤵
  PID:7728
- C:\Windows\System\qEuHGJB.exe
  C:\Windows\System\qEuHGJB.exe
  2⤵
  PID:7744
- C:\Windows\System\SEQXEZw.exe
  C:\Windows\System\SEQXEZw.exe
  2⤵
  PID:7760
- C:\Windows\System\bojHfbV.exe
  C:\Windows\System\bojHfbV.exe
  2⤵
  PID:7776
- C:\Windows\System\ndnzHiW.exe
  C:\Windows\System\ndnzHiW.exe
  2⤵
  PID:7792
- C:\Windows\System\zTvvpvR.exe
  C:\Windows\System\zTvvpvR.exe
  2⤵
  PID:7808
- C:\Windows\System\cNSzIMK.exe
  C:\Windows\System\cNSzIMK.exe
  2⤵
  PID:7824
- C:\Windows\System\WigIrJW.exe
  C:\Windows\System\WigIrJW.exe
  2⤵
  PID:7840
- C:\Windows\System\ZGHUnBz.exe
  C:\Windows\System\ZGHUnBz.exe
  2⤵
  PID:7856
- C:\Windows\System\TwWDVCx.exe
  C:\Windows\System\TwWDVCx.exe
  2⤵
  PID:7872
- C:\Windows\System\ejrxYKe.exe
  C:\Windows\System\ejrxYKe.exe
  2⤵
  PID:7892
- C:\Windows\System\FmKLYGb.exe
  C:\Windows\System\FmKLYGb.exe
  2⤵
  PID:7908
- C:\Windows\System\XeTgvsE.exe
  C:\Windows\System\XeTgvsE.exe
  2⤵
  PID:7924
- C:\Windows\System\ldemQBF.exe
  C:\Windows\System\ldemQBF.exe
  2⤵
  PID:7940
- C:\Windows\System\dBTnmOw.exe
  C:\Windows\System\dBTnmOw.exe
  2⤵
  PID:7956
- C:\Windows\System\EsokTPe.exe
  C:\Windows\System\EsokTPe.exe
  2⤵
  PID:7972
- C:\Windows\System\iDJaLdI.exe
  C:\Windows\System\iDJaLdI.exe
  2⤵
  PID:7988
- C:\Windows\System\kJbLLQa.exe
  C:\Windows\System\kJbLLQa.exe
  2⤵
  PID:8004
- C:\Windows\System\jnJiCVD.exe
  C:\Windows\System\jnJiCVD.exe
  2⤵
  PID:8020
- C:\Windows\System\pYvDVMq.exe
  C:\Windows\System\pYvDVMq.exe
  2⤵
  PID:8036
- C:\Windows\System\jWUADdS.exe
  C:\Windows\System\jWUADdS.exe
  2⤵
  PID:8052
- C:\Windows\System\nnrgKwt.exe
  C:\Windows\System\nnrgKwt.exe
  2⤵
  PID:8068
- C:\Windows\System\nnYINFK.exe
  C:\Windows\System\nnYINFK.exe
  2⤵
  PID:8084
- C:\Windows\System\kVxNTxH.exe
  C:\Windows\System\kVxNTxH.exe
  2⤵
  PID:8100
- C:\Windows\System\jonzIIw.exe
  C:\Windows\System\jonzIIw.exe
  2⤵
  PID:8116
- C:\Windows\System\MFyNlaD.exe
  C:\Windows\System\MFyNlaD.exe
  2⤵
  PID:8132
- C:\Windows\System\EmCTaMd.exe
  C:\Windows\System\EmCTaMd.exe
  2⤵
  PID:8148
- C:\Windows\System\CIcQDGz.exe
  C:\Windows\System\CIcQDGz.exe
  2⤵
  PID:8164
- C:\Windows\System\koMVKvN.exe
  C:\Windows\System\koMVKvN.exe
  2⤵
  PID:8180
- C:\Windows\System\lGeAuvB.exe
  C:\Windows\System\lGeAuvB.exe
  2⤵
  PID:6400
- C:\Windows\System\QYqeHSd.exe
  C:\Windows\System\QYqeHSd.exe
  2⤵
  PID:7088
- C:\Windows\System\zyJoKnN.exe
  C:\Windows\System\zyJoKnN.exe
  2⤵
  PID:6972
- C:\Windows\System\XdvoIkB.exe
  C:\Windows\System\XdvoIkB.exe
  2⤵
  PID:6744
- C:\Windows\System\aJWvPkf.exe
  C:\Windows\System\aJWvPkf.exe
  2⤵
  PID:7212
- C:\Windows\System\fKvvogd.exe
  C:\Windows\System\fKvvogd.exe
  2⤵
  PID:6576
- C:\Windows\System\XkIMBho.exe
  C:\Windows\System\XkIMBho.exe
  2⤵
  PID:6440
- C:\Windows\System\MWJhVTD.exe
  C:\Windows\System\MWJhVTD.exe
  2⤵
  PID:7192
- C:\Windows\System\mIAzwRR.exe
  C:\Windows\System\mIAzwRR.exe
  2⤵
  PID:7256
- C:\Windows\System\pnMplXd.exe
  C:\Windows\System\pnMplXd.exe
  2⤵
  PID:7320
- C:\Windows\System\GoqDduz.exe
  C:\Windows\System\GoqDduz.exe
  2⤵
  PID:7304
- C:\Windows\System\XTLRZFE.exe
  C:\Windows\System\XTLRZFE.exe
  2⤵
  PID:7308
- C:\Windows\System\LBnrsQX.exe
  C:\Windows\System\LBnrsQX.exe
  2⤵
  PID:7372
- C:\Windows\System\ZXBnFva.exe
  C:\Windows\System\ZXBnFva.exe
  2⤵
  PID:7436
- C:\Windows\System\vmWAWPS.exe
  C:\Windows\System\vmWAWPS.exe
  2⤵
  PID:7500
- C:\Windows\System\PzDobew.exe
  C:\Windows\System\PzDobew.exe
  2⤵
  PID:7516
- C:\Windows\System\HKdLtBt.exe
  C:\Windows\System\HKdLtBt.exe
  2⤵
  PID:7452
- C:\Windows\System\iebOzuT.exe
  C:\Windows\System\iebOzuT.exe
  2⤵
  PID:7448
- C:\Windows\System\aVhudDK.exe
  C:\Windows\System\aVhudDK.exe
  2⤵
  PID:7548
- C:\Windows\System\RKpfHpO.exe
  C:\Windows\System\RKpfHpO.exe
  2⤵
  PID:7564
- C:\Windows\System\hlViDXd.exe
  C:\Windows\System\hlViDXd.exe
  2⤵
  PID:7628
- C:\Windows\System\wapnENU.exe
  C:\Windows\System\wapnENU.exe
  2⤵
  PID:7688
- C:\Windows\System\mGEYyiY.exe
  C:\Windows\System\mGEYyiY.exe
  2⤵
  PID:7576
- C:\Windows\System\FFgYQkF.exe
  C:\Windows\System\FFgYQkF.exe
  2⤵
  PID:7752
- C:\Windows\System\mGqsddd.exe
  C:\Windows\System\mGqsddd.exe
  2⤵
  PID:7816
- C:\Windows\System\eeadZdI.exe
  C:\Windows\System\eeadZdI.exe
  2⤵
  PID:7880
- C:\Windows\System\usIsfrp.exe
  C:\Windows\System\usIsfrp.exe
  2⤵
  PID:7672
- C:\Windows\System\zAMddMV.exe
  C:\Windows\System\zAMddMV.exe
  2⤵
  PID:7768
- C:\Windows\System\iDlXsnm.exe
  C:\Windows\System\iDlXsnm.exe
  2⤵
  PID:7904
- C:\Windows\System\LQJodYV.exe
  C:\Windows\System\LQJodYV.exe
  2⤵
  PID:7948
- C:\Windows\System\uUXXIEe.exe
  C:\Windows\System\uUXXIEe.exe
  2⤵
  PID:7800
- C:\Windows\System\xLtMUDM.exe
  C:\Windows\System\xLtMUDM.exe
  2⤵
  PID:7964
- C:\Windows\System\wdpZiKE.exe
  C:\Windows\System\wdpZiKE.exe
  2⤵
  PID:8000
- C:\Windows\System\ctZQpLs.exe
  C:\Windows\System\ctZQpLs.exe
  2⤵
  PID:8016
- C:\Windows\System\sjQXAwb.exe
  C:\Windows\System\sjQXAwb.exe
  2⤵
  PID:8064
- C:\Windows\System\eWgEMHc.exe
  C:\Windows\System\eWgEMHc.exe
  2⤵
  PID:8112
- C:\Windows\System\GhiJWLz.exe
  C:\Windows\System\GhiJWLz.exe
  2⤵
  PID:8124
- C:\Windows\System\QBcwURN.exe
  C:\Windows\System\QBcwURN.exe
  2⤵
  PID:8188
- C:\Windows\System\lTAlVtV.exe
  C:\Windows\System\lTAlVtV.exe
  2⤵
  PID:6940
- C:\Windows\System\VPszepM.exe
  C:\Windows\System\VPszepM.exe
  2⤵
  PID:6304
- C:\Windows\System\EppEQVP.exe
  C:\Windows\System\EppEQVP.exe
  2⤵
  PID:7120
- C:\Windows\System\BNuBvEd.exe
  C:\Windows\System\BNuBvEd.exe
  2⤵
  PID:7228
- C:\Windows\System\TzWWvIx.exe
  C:\Windows\System\TzWWvIx.exe
  2⤵
  PID:7272
- C:\Windows\System\PPRYQyC.exe
  C:\Windows\System\PPRYQyC.exe
  2⤵
  PID:7340
- C:\Windows\System\UudYbUJ.exe
  C:\Windows\System\UudYbUJ.exe
  2⤵
  PID:7512
- C:\Windows\System\PjIlQQQ.exe
  C:\Windows\System\PjIlQQQ.exe
  2⤵
  PID:7356
- C:\Windows\System\LtPkHJi.exe
  C:\Windows\System\LtPkHJi.exe
  2⤵
  PID:7644
- C:\Windows\System\aOaawaN.exe
  C:\Windows\System\aOaawaN.exe
  2⤵
  PID:7580
- C:\Windows\System\BVBhatI.exe
  C:\Windows\System\BVBhatI.exe
  2⤵
  PID:7848
- C:\Windows\System\yPHSRKq.exe
  C:\Windows\System\yPHSRKq.exe
  2⤵
  PID:7708
- C:\Windows\System\UuygOvB.exe
  C:\Windows\System\UuygOvB.exe
  2⤵
  PID:7920
- C:\Windows\System\wXUUVMG.exe
  C:\Windows\System\wXUUVMG.exe
  2⤵
  PID:7832
- C:\Windows\System\ZzgiTAU.exe
  C:\Windows\System\ZzgiTAU.exe
  2⤵
  PID:8108
- C:\Windows\System\IodVARb.exe
  C:\Windows\System\IodVARb.exe
  2⤵
  PID:8048
- C:\Windows\System\dbuonTC.exe
  C:\Windows\System\dbuonTC.exe
  2⤵
  PID:8096
- C:\Windows\System\LbctSuO.exe
  C:\Windows\System\LbctSuO.exe
  2⤵
  PID:8176
- C:\Windows\System\NQiLQpe.exe
  C:\Windows\System\NQiLQpe.exe
  2⤵
  PID:5720
- C:\Windows\System\mwTZJNr.exe
  C:\Windows\System\mwTZJNr.exe
  2⤵
  PID:7224
- C:\Windows\System\CGzxRsh.exe
  C:\Windows\System\CGzxRsh.exe
  2⤵
  PID:7384
- C:\Windows\System\kSJQOjt.exe
  C:\Windows\System\kSJQOjt.exe
  2⤵
  PID:7484
- C:\Windows\System\HwvHYPI.exe
  C:\Windows\System\HwvHYPI.exe
  2⤵
  PID:7560
- C:\Windows\System\YZSaQyJ.exe
  C:\Windows\System\YZSaQyJ.exe
  2⤵
  PID:7788
- C:\Windows\System\xqOzuIO.exe
  C:\Windows\System\xqOzuIO.exe
  2⤵
  PID:8012
- C:\Windows\System\CfbygAb.exe
  C:\Windows\System\CfbygAb.exe
  2⤵
  PID:7900
- C:\Windows\System\JxbSIfQ.exe
  C:\Windows\System\JxbSIfQ.exe
  2⤵
  PID:8032
- C:\Windows\System\ulEgGLf.exe
  C:\Windows\System\ulEgGLf.exe
  2⤵
  PID:7244
- C:\Windows\System\ivCeynK.exe
  C:\Windows\System\ivCeynK.exe
  2⤵
  PID:7208
- C:\Windows\System\OzzXxmH.exe
  C:\Windows\System\OzzXxmH.exe
  2⤵
  PID:1288
- C:\Windows\System\bqWgfvS.exe
  C:\Windows\System\bqWgfvS.exe
  2⤵
  PID:7720
- C:\Windows\System\WeBUzOW.exe
  C:\Windows\System\WeBUzOW.exe
  2⤵
  PID:7868
- C:\Windows\System\aovtKyu.exe
  C:\Windows\System\aovtKyu.exe
  2⤵
  PID:8144
- C:\Windows\System\fKIpShd.exe
  C:\Windows\System\fKIpShd.exe
  2⤵
  PID:7544
- C:\Windows\System\KYZGmnD.exe
  C:\Windows\System\KYZGmnD.exe
  2⤵
  PID:7640
- C:\Windows\System\tKwRveE.exe
  C:\Windows\System\tKwRveE.exe
  2⤵
  PID:8208
- C:\Windows\System\WOKMUAO.exe
  C:\Windows\System\WOKMUAO.exe
  2⤵
  PID:8224
- C:\Windows\System\KwaMDQx.exe
  C:\Windows\System\KwaMDQx.exe
  2⤵
  PID:8240
- C:\Windows\System\yAMcZRi.exe
  C:\Windows\System\yAMcZRi.exe
  2⤵
  PID:8256
- C:\Windows\System\SizCumh.exe
  C:\Windows\System\SizCumh.exe
  2⤵
  PID:8480
- C:\Windows\System\sUzjtua.exe
  C:\Windows\System\sUzjtua.exe
  2⤵
  PID:8944
- C:\Windows\System\qDwVJgD.exe
  C:\Windows\System\qDwVJgD.exe
  2⤵
  PID:8988
- C:\Windows\System\nTKypHW.exe
  C:\Windows\System\nTKypHW.exe
  2⤵
  PID:9088
- C:\Windows\System\oEdtIMv.exe
  C:\Windows\System\oEdtIMv.exe
  2⤵
  PID:9124
- C:\Windows\System\aLHoNcK.exe
  C:\Windows\System\aLHoNcK.exe
  2⤵
  PID:9148
- C:\Windows\System\PELCmJF.exe
  C:\Windows\System\PELCmJF.exe
  2⤵
  PID:9176
- C:\Windows\System\iTKvjLD.exe
  C:\Windows\System\iTKvjLD.exe
  2⤵
  PID:9212
- C:\Windows\System\URHWeck.exe
  C:\Windows\System\URHWeck.exe
  2⤵
  PID:6388
- C:\Windows\System\fGIYLOD.exe
  C:\Windows\System\fGIYLOD.exe
  2⤵
  PID:8268
- C:\Windows\System\vrqYCsk.exe
  C:\Windows\System\vrqYCsk.exe
  2⤵
  PID:8304
- C:\Windows\System\KdntvRX.exe
  C:\Windows\System\KdntvRX.exe
  2⤵
  PID:8328
- C:\Windows\System\sJBsZNV.exe
  C:\Windows\System\sJBsZNV.exe
  2⤵
  PID:8348
- C:\Windows\System\hCQVkRG.exe
  C:\Windows\System\hCQVkRG.exe
  2⤵
  PID:8368
- C:\Windows\System\SrjFaBg.exe
  C:\Windows\System\SrjFaBg.exe
  2⤵
  PID:8388
- C:\Windows\System\DAFlOrn.exe
  C:\Windows\System\DAFlOrn.exe
  2⤵
  PID:8412
- C:\Windows\System\LjScQue.exe
  C:\Windows\System\LjScQue.exe
  2⤵
  PID:8432
- C:\Windows\System\vFtLSKx.exe
  C:\Windows\System\vFtLSKx.exe
  2⤵
  PID:8448
- C:\Windows\System\yiBrbpt.exe
  C:\Windows\System\yiBrbpt.exe
  2⤵
  PID:8468
- C:\Windows\System\aaACaUu.exe
  C:\Windows\System\aaACaUu.exe
  2⤵
  PID:8504
- C:\Windows\System\jTQSiRB.exe
  C:\Windows\System\jTQSiRB.exe
  2⤵
  PID:8520
- C:\Windows\System\jsOfSsF.exe
  C:\Windows\System\jsOfSsF.exe
  2⤵
  PID:8536
- C:\Windows\System\kPbpGZm.exe
  C:\Windows\System\kPbpGZm.exe
  2⤵
  PID:8564
- C:\Windows\System\vabFcrf.exe
  C:\Windows\System\vabFcrf.exe
  2⤵
  PID:8584
- C:\Windows\System\SjQMmyi.exe
  C:\Windows\System\SjQMmyi.exe
  2⤵
  PID:8604
- C:\Windows\System\BtQlXjG.exe
  C:\Windows\System\BtQlXjG.exe
  2⤵
  PID:8624
- C:\Windows\System\uFurSuy.exe
  C:\Windows\System\uFurSuy.exe
  2⤵
  PID:8644
- C:\Windows\System\jBNdejh.exe
  C:\Windows\System\jBNdejh.exe
  2⤵
  PID:8660
- C:\Windows\System\UjdVBeB.exe
  C:\Windows\System\UjdVBeB.exe
  2⤵
  PID:8680
- C:\Windows\System\tbMfVhu.exe
  C:\Windows\System\tbMfVhu.exe
  2⤵
  PID:8772
- C:\Windows\System\ziqTMCF.exe
  C:\Windows\System\ziqTMCF.exe
  2⤵
  PID:8812
- C:\Windows\System\FfVpLMA.exe
  C:\Windows\System\FfVpLMA.exe
  2⤵
  PID:8708
- C:\Windows\System\cSaKGoJ.exe
  C:\Windows\System\cSaKGoJ.exe
  2⤵
  PID:8724
- C:\Windows\System\jmIErrb.exe
  C:\Windows\System\jmIErrb.exe
  2⤵
  PID:8748
- C:\Windows\System\syMqiwV.exe
  C:\Windows\System\syMqiwV.exe
  2⤵
  PID:8768
- C:\Windows\System\SrsPsNY.exe
  C:\Windows\System\SrsPsNY.exe
  2⤵
  PID:8788
- C:\Windows\System\cCuwwzJ.exe
  C:\Windows\System\cCuwwzJ.exe
  2⤵
  PID:8820
- C:\Windows\System\gPpwXxy.exe
  C:\Windows\System\gPpwXxy.exe
  2⤵
  PID:8952
- C:\Windows\System\djmJozl.exe
  C:\Windows\System\djmJozl.exe
  2⤵
  PID:8880
- C:\Windows\System\uNWJEVA.exe
  C:\Windows\System\uNWJEVA.exe
  2⤵
  PID:8852
- C:\Windows\System\qZWmUvG.exe
  C:\Windows\System\qZWmUvG.exe
  2⤵
  PID:8884
- C:\Windows\System\CDIHxVr.exe
  C:\Windows\System\CDIHxVr.exe
  2⤵
  PID:8908
- C:\Windows\System\iXYyfCY.exe
  C:\Windows\System\iXYyfCY.exe
  2⤵
  PID:8940
- C:\Windows\System\VerxKhw.exe
  C:\Windows\System\VerxKhw.exe
  2⤵
  PID:9004
- C:\Windows\System\gitmQBk.exe
  C:\Windows\System\gitmQBk.exe
  2⤵
  PID:8980
- C:\Windows\System\oiRWFFS.exe
  C:\Windows\System\oiRWFFS.exe
  2⤵
  PID:9032
- C:\Windows\System\kuqblVX.exe
  C:\Windows\System\kuqblVX.exe
  2⤵
  PID:9112
- C:\Windows\System\DrmdxKA.exe
  C:\Windows\System\DrmdxKA.exe
  2⤵
  PID:9024
- C:\Windows\System\UjQwkFM.exe
  C:\Windows\System\UjQwkFM.exe
  2⤵
  PID:9064
- C:\Windows\System\ehkUpdS.exe
  C:\Windows\System\ehkUpdS.exe
  2⤵
  PID:9068
- C:\Windows\System\jGjjwqp.exe
  C:\Windows\System\jGjjwqp.exe
  2⤵
  PID:9156
- C:\Windows\System\MCPfOfN.exe
  C:\Windows\System\MCPfOfN.exe
  2⤵
  PID:9140
- C:\Windows\System\WDRpxHu.exe
  C:\Windows\System\WDRpxHu.exe
  2⤵
  PID:2988
- C:\Windows\System\RnARRUF.exe
  C:\Windows\System\RnARRUF.exe
  2⤵
  PID:8232
- C:\Windows\System\vmqmTst.exe
  C:\Windows\System\vmqmTst.exe
  2⤵
  PID:8236
- C:\Windows\System\bCTFSEM.exe
  C:\Windows\System\bCTFSEM.exe
  2⤵
  PID:8296
- C:\Windows\System\eRdFIbS.exe
  C:\Windows\System\eRdFIbS.exe
  2⤵
  PID:8332
- C:\Windows\System\jyBVyKi.exe
  C:\Windows\System\jyBVyKi.exe
  2⤵
  PID:8344
- C:\Windows\System\biFtWtr.exe
  C:\Windows\System\biFtWtr.exe
  2⤵
  PID:8380
- C:\Windows\System\IfxwRkC.exe
  C:\Windows\System\IfxwRkC.exe
  2⤵
  PID:8420
- C:\Windows\System\LynXORt.exe
  C:\Windows\System\LynXORt.exe
  2⤵
  PID:8440
- C:\Windows\System\tAXrhbP.exe
  C:\Windows\System\tAXrhbP.exe
  2⤵
  PID:8488
- C:\Windows\System\bzZeGWv.exe
  C:\Windows\System\bzZeGWv.exe
  2⤵
  PID:8548
- C:\Windows\System\iPHJVEd.exe
  C:\Windows\System\iPHJVEd.exe
  2⤵
  PID:8572
- C:\Windows\System\XmlxJCY.exe
  C:\Windows\System\XmlxJCY.exe
  2⤵
  PID:8596
- C:\Windows\System\IkXIpsP.exe
  C:\Windows\System\IkXIpsP.exe
  2⤵
  PID:8652
- C:\Windows\System\UvVPwfk.exe
  C:\Windows\System\UvVPwfk.exe
  2⤵
  PID:8672
- C:\Windows\System\dWurhlV.exe
  C:\Windows\System\dWurhlV.exe
  2⤵
  PID:8756
- C:\Windows\System\bYBKFvA.exe
  C:\Windows\System\bYBKFvA.exe
  2⤵
  PID:8716
- C:\Windows\System\qYiIjPZ.exe
  C:\Windows\System\qYiIjPZ.exe
  2⤵
  PID:8864
- C:\Windows\System\eERgIDJ.exe
  C:\Windows\System\eERgIDJ.exe
  2⤵
  PID:8876
- C:\Windows\System\gotBatR.exe
  C:\Windows\System\gotBatR.exe
  2⤵
  PID:8996
- C:\Windows\System\PMnfpBX.exe
  C:\Windows\System\PMnfpBX.exe
  2⤵
  PID:9116
- C:\Windows\System\yjkmTaT.exe
  C:\Windows\System\yjkmTaT.exe
  2⤵
  PID:9168
- C:\Windows\System\ARlOGOG.exe
  C:\Windows\System\ARlOGOG.exe
  2⤵
  PID:8736
- C:\Windows\System\BuAIxyR.exe
  C:\Windows\System\BuAIxyR.exe
  2⤵
  PID:9056
- C:\Windows\System\JqDuwgH.exe
  C:\Windows\System\JqDuwgH.exe
  2⤵
  PID:8896
- C:\Windows\System\lsmSzsP.exe
  C:\Windows\System\lsmSzsP.exe
  2⤵
  PID:9192
- C:\Windows\System\KPmjXtZ.exe
  C:\Windows\System\KPmjXtZ.exe
  2⤵
  PID:8172
- C:\Windows\System\lBOLGIS.exe
  C:\Windows\System\lBOLGIS.exe
  2⤵
  PID:8832
- C:\Windows\System\XtYOQer.exe
  C:\Windows\System\XtYOQer.exe
  2⤵
  PID:8780
- C:\Windows\System\jnqOFzR.exe
  C:\Windows\System\jnqOFzR.exe
  2⤵
  PID:8252
- C:\Windows\System\cdirYsI.exe
  C:\Windows\System\cdirYsI.exe
  2⤵
  PID:8284
- C:\Windows\System\FXiGGCN.exe
  C:\Windows\System\FXiGGCN.exe
  2⤵
  PID:8384
- C:\Windows\System\gmmVbID.exe
  C:\Windows\System\gmmVbID.exe
  2⤵
  PID:8464
- C:\Windows\System\OEQNBSS.exe
  C:\Windows\System\OEQNBSS.exe
  2⤵
  PID:7888
- C:\Windows\System\MZSVHHV.exe
  C:\Windows\System\MZSVHHV.exe
  2⤵
  PID:8512
- C:\Windows\System\DvxAoEr.exe
  C:\Windows\System\DvxAoEr.exe
  2⤵
  PID:8656
- C:\Windows\System\DQmiFle.exe
  C:\Windows\System\DQmiFle.exe
  2⤵
  PID:8712
- C:\Windows\System\QjEsSxY.exe
  C:\Windows\System\QjEsSxY.exe
  2⤵
  PID:8612
- C:\Windows\System\cThDFNv.exe
  C:\Windows\System\cThDFNv.exe
  2⤵
  PID:8764
- C:\Windows\System\hiFEFAJ.exe
  C:\Windows\System\hiFEFAJ.exe
  2⤵
  PID:8856
- C:\Windows\System\ZHwNcxe.exe
  C:\Windows\System\ZHwNcxe.exe
  2⤵
  PID:9100
- C:\Windows\System\DHcmMPL.exe
  C:\Windows\System\DHcmMPL.exe
  2⤵
  PID:9108
- C:\Windows\System\pGLcFSm.exe
  C:\Windows\System\pGLcFSm.exe
  2⤵
  PID:9060
- C:\Windows\System\PUOKCqC.exe
  C:\Windows\System\PUOKCqC.exe
  2⤵
  PID:9008
- C:\Windows\System\dRBrjVO.exe
  C:\Windows\System\dRBrjVO.exe
  2⤵
  PID:9204
- C:\Windows\System\ypvWzxY.exe
  C:\Windows\System\ypvWzxY.exe
  2⤵
  PID:7496
- C:\Windows\System\qmGxLBo.exe
  C:\Windows\System\qmGxLBo.exe
  2⤵
  PID:8204
- C:\Windows\System\lqukGwh.exe
  C:\Windows\System\lqukGwh.exe
  2⤵
  PID:8324
- C:\Windows\System\JLcITbx.exe
  C:\Windows\System\JLcITbx.exe
  2⤵
  PID:8428
- C:\Windows\System\EZlKmtn.exe
  C:\Windows\System\EZlKmtn.exe
  2⤵
  PID:8516
- C:\Windows\System\vGLgXia.exe
  C:\Windows\System\vGLgXia.exe
  2⤵
  PID:9164
- C:\Windows\System\XOxNEDn.exe
  C:\Windows\System\XOxNEDn.exe
  2⤵
  PID:8904
- C:\Windows\System\giXGnWJ.exe
  C:\Windows\System\giXGnWJ.exe
  2⤵
  PID:9084
- C:\Windows\System\eBhMoKq.exe
  C:\Windows\System\eBhMoKq.exe
  2⤵
  PID:9144
- C:\Windows\System\yyeEejO.exe
  C:\Windows\System\yyeEejO.exe
  2⤵
  PID:972
- C:\Windows\System\XWzZbmz.exe
  C:\Windows\System\XWzZbmz.exe
  2⤵
  PID:7980
- C:\Windows\System\rempkwW.exe
  C:\Windows\System\rempkwW.exe
  2⤵
  PID:8376
- C:\Windows\System\uytwzrl.exe
  C:\Windows\System\uytwzrl.exe
  2⤵
  PID:8248
- C:\Windows\System\yzSxoLq.exe
  C:\Windows\System\yzSxoLq.exe
  2⤵
  PID:8632
- C:\Windows\System\aqloQCz.exe
  C:\Windows\System\aqloQCz.exe
  2⤵
  PID:8576
- C:\Windows\System\QhCkKWu.exe
  C:\Windows\System\QhCkKWu.exe
  2⤵
  PID:7596
- C:\Windows\System\ISkgEKf.exe
  C:\Windows\System\ISkgEKf.exe
  2⤵
  PID:8616
- C:\Windows\System\woZlCmi.exe
  C:\Windows\System\woZlCmi.exe
  2⤵
  PID:9132
- C:\Windows\System\dFbyMmO.exe
  C:\Windows\System\dFbyMmO.exe
  2⤵
  PID:8400
- C:\Windows\System\YgVQtHq.exe
  C:\Windows\System\YgVQtHq.exe
  2⤵
  PID:8496
- C:\Windows\System\grbdyLT.exe
  C:\Windows\System\grbdyLT.exe
  2⤵
  PID:8840
- C:\Windows\System\ivHDIJF.exe
  C:\Windows\System\ivHDIJF.exe
  2⤵
  PID:9080
- C:\Windows\System\zvWrYWJ.exe
  C:\Windows\System\zvWrYWJ.exe
  2⤵
  PID:9228
- C:\Windows\System\GotjXIV.exe
  C:\Windows\System\GotjXIV.exe
  2⤵
  PID:9244
- C:\Windows\System\rliLTxH.exe
  C:\Windows\System\rliLTxH.exe
  2⤵
  PID:9272
- C:\Windows\System\ehfKnSb.exe
  C:\Windows\System\ehfKnSb.exe
  2⤵
  PID:9288
- C:\Windows\System\FLsYMVj.exe
  C:\Windows\System\FLsYMVj.exe
  2⤵
  PID:9320
- C:\Windows\System\jMhfkPq.exe
  C:\Windows\System\jMhfkPq.exe
  2⤵
  PID:9336
- C:\Windows\System\hGWigsE.exe
  C:\Windows\System\hGWigsE.exe
  2⤵
  PID:9352
- C:\Windows\System\SwPiZQy.exe
  C:\Windows\System\SwPiZQy.exe
  2⤵
  PID:9368
- C:\Windows\System\RZDHztj.exe
  C:\Windows\System\RZDHztj.exe
  2⤵
  PID:9392
- C:\Windows\System\kBJkjEm.exe
  C:\Windows\System\kBJkjEm.exe
  2⤵
  PID:9412
- C:\Windows\System\JZOQBKC.exe
  C:\Windows\System\JZOQBKC.exe
  2⤵
  PID:9436
- C:\Windows\System\eyMFihN.exe
  C:\Windows\System\eyMFihN.exe
  2⤵
  PID:9460
- C:\Windows\System\yqWqJCF.exe
  C:\Windows\System\yqWqJCF.exe
  2⤵
  PID:9476
- C:\Windows\System\BOxirZf.exe
  C:\Windows\System\BOxirZf.exe
  2⤵
  PID:9492
- C:\Windows\System\yNnfszv.exe
  C:\Windows\System\yNnfszv.exe
  2⤵
  PID:9520
- C:\Windows\System\UlFdXKG.exe
  C:\Windows\System\UlFdXKG.exe
  2⤵
  PID:9544
- C:\Windows\System\lCYneEK.exe
  C:\Windows\System\lCYneEK.exe
  2⤵
  PID:9576
- C:\Windows\System\vzPIWDJ.exe
  C:\Windows\System\vzPIWDJ.exe
  2⤵
  PID:9592
- C:\Windows\System\zmzDQFg.exe
  C:\Windows\System\zmzDQFg.exe
  2⤵
  PID:9608
- C:\Windows\System\qrFIsSo.exe
  C:\Windows\System\qrFIsSo.exe
  2⤵
  PID:9628
- C:\Windows\System\eJICmFh.exe
  C:\Windows\System\eJICmFh.exe
  2⤵
  PID:9648
- C:\Windows\System\PxDqMHu.exe
  C:\Windows\System\PxDqMHu.exe
  2⤵
  PID:9668
- C:\Windows\System\NqwEBqC.exe
  C:\Windows\System\NqwEBqC.exe
  2⤵
  PID:9700
- C:\Windows\System\JZowokW.exe
  C:\Windows\System\JZowokW.exe
  2⤵
  PID:9716
- C:\Windows\System\XGAmEzZ.exe
  C:\Windows\System\XGAmEzZ.exe
  2⤵
  PID:9732
- C:\Windows\System\LffLngW.exe
  C:\Windows\System\LffLngW.exe
  2⤵
  PID:9748
- C:\Windows\System\JniHIDr.exe
  C:\Windows\System\JniHIDr.exe
  2⤵
  PID:9764
- C:\Windows\System\hLYvPou.exe
  C:\Windows\System\hLYvPou.exe
  2⤵
  PID:9780
- C:\Windows\System\zXPpyLZ.exe
  C:\Windows\System\zXPpyLZ.exe
  2⤵
  PID:9804
- C:\Windows\System\YbUopZS.exe
  C:\Windows\System\YbUopZS.exe
  2⤵
  PID:9820
- C:\Windows\System\hsUqDuq.exe
  C:\Windows\System\hsUqDuq.exe
  2⤵
  PID:9836
- C:\Windows\System\mpHfhEq.exe
  C:\Windows\System\mpHfhEq.exe
  2⤵
  PID:9852
- C:\Windows\System\nfQdyvd.exe
  C:\Windows\System\nfQdyvd.exe
  2⤵
  PID:9868
- C:\Windows\System\RUBYbJJ.exe
  C:\Windows\System\RUBYbJJ.exe
  2⤵
  PID:9884
- C:\Windows\System\UXGJtqH.exe
  C:\Windows\System\UXGJtqH.exe
  2⤵
  PID:9904
- C:\Windows\System\mVmRCdz.exe
  C:\Windows\System\mVmRCdz.exe
  2⤵
  PID:9928
- C:\Windows\System\opHpoha.exe
  C:\Windows\System\opHpoha.exe
  2⤵
  PID:9964
- C:\Windows\System\IYtvnvp.exe
  C:\Windows\System\IYtvnvp.exe
  2⤵
  PID:10000
- C:\Windows\System\lKBpyLQ.exe
  C:\Windows\System\lKBpyLQ.exe
  2⤵
  PID:10016
- C:\Windows\System\ZLucSyE.exe
  C:\Windows\System\ZLucSyE.exe
  2⤵
  PID:10032
- C:\Windows\System\ZsVxvBD.exe
  C:\Windows\System\ZsVxvBD.exe
  2⤵
  PID:10048
- C:\Windows\System\iMdlFoZ.exe
  C:\Windows\System\iMdlFoZ.exe
  2⤵
  PID:10064
- C:\Windows\System\KxyUXKT.exe
  C:\Windows\System\KxyUXKT.exe
  2⤵
  PID:10088
- C:\Windows\System\ZBpeCnW.exe
  C:\Windows\System\ZBpeCnW.exe
  2⤵
  PID:10108
- C:\Windows\System\fPabwPv.exe
  C:\Windows\System\fPabwPv.exe
  2⤵
  PID:10124
- C:\Windows\System\bxFHjbu.exe
  C:\Windows\System\bxFHjbu.exe
  2⤵
  PID:10144
- C:\Windows\System\AtmMwiD.exe
  C:\Windows\System\AtmMwiD.exe
  2⤵
  PID:10160
- C:\Windows\System\wuXWVwo.exe
  C:\Windows\System\wuXWVwo.exe
  2⤵
  PID:10176
- C:\Windows\System\hnSWJUS.exe
  C:\Windows\System\hnSWJUS.exe
  2⤵
  PID:10196
- C:\Windows\System\mnTwXbG.exe
  C:\Windows\System\mnTwXbG.exe
  2⤵
  PID:10228
- C:\Windows\System\YFKczoa.exe
  C:\Windows\System\YFKczoa.exe
  2⤵
  PID:9236
- C:\Windows\System\NewqcRP.exe
  C:\Windows\System\NewqcRP.exe
  2⤵
  PID:8844
- C:\Windows\System\LPeFJtf.exe
  C:\Windows\System\LPeFJtf.exe
  2⤵
  PID:8924
- C:\Windows\System\JzOSwvq.exe
  C:\Windows\System\JzOSwvq.exe
  2⤵
  PID:9328
- C:\Windows\System\AByGwQg.exe
  C:\Windows\System\AByGwQg.exe
  2⤵
  PID:9296
- C:\Windows\System\xueCHlu.exe
  C:\Windows\System\xueCHlu.exe
  2⤵
  PID:9252
- C:\Windows\System\OcavhIN.exe
  C:\Windows\System\OcavhIN.exe
  2⤵
  PID:9404
- C:\Windows\System\EHlAmQD.exe
  C:\Windows\System\EHlAmQD.exe
  2⤵
  PID:9448
- C:\Windows\System\FxIPLyR.exe
  C:\Windows\System\FxIPLyR.exe
  2⤵
  PID:8532
- C:\Windows\System\SeMsivu.exe
  C:\Windows\System\SeMsivu.exe
  2⤵
  PID:9504
- C:\Windows\System\odpbqpd.exe
  C:\Windows\System\odpbqpd.exe
  2⤵
  PID:9536
- C:\Windows\System\AtMpcXQ.exe
  C:\Windows\System\AtMpcXQ.exe
  2⤵
  PID:9512
- C:\Windows\System\fXQFJAV.exe
  C:\Windows\System\fXQFJAV.exe
  2⤵
  PID:9560
- C:\Windows\System\UCEGyLy.exe
  C:\Windows\System\UCEGyLy.exe
  2⤵
  PID:9588
- C:\Windows\System\EbduLld.exe
  C:\Windows\System\EbduLld.exe
  2⤵
  PID:9636
- C:\Windows\System\iCKZkYg.exe
  C:\Windows\System\iCKZkYg.exe
  2⤵
  PID:9740
- C:\Windows\System\YGuEoYx.exe
  C:\Windows\System\YGuEoYx.exe
  2⤵
  PID:9828
- C:\Windows\System\axGDPhD.exe
  C:\Windows\System\axGDPhD.exe
  2⤵
  PID:9760
- C:\Windows\System\HNWPnOQ.exe
  C:\Windows\System\HNWPnOQ.exe
  2⤵
  PID:9696
- C:\Windows\System\dUarDVF.exe
  C:\Windows\System\dUarDVF.exe
  2⤵
  PID:9844
- C:\Windows\System\VENJdfn.exe
  C:\Windows\System\VENJdfn.exe
  2⤵
  PID:9860
- C:\Windows\System\PXklIln.exe
  C:\Windows\System\PXklIln.exe
  2⤵
  PID:9892
- C:\Windows\System\pvUuyjI.exe
  C:\Windows\System\pvUuyjI.exe
  2⤵
  PID:9756
- C:\Windows\System\xTtlGkz.exe
  C:\Windows\System\xTtlGkz.exe
  2⤵
  PID:9944
- C:\Windows\System\AgIaVvV.exe
  C:\Windows\System\AgIaVvV.exe
  2⤵
  PID:9948
- C:\Windows\System\RtgcqAh.exe
  C:\Windows\System\RtgcqAh.exe
  2⤵
  PID:9992
- C:\Windows\System\IvohZnd.exe
  C:\Windows\System\IvohZnd.exe
  2⤵
  PID:10028
- C:\Windows\System\JpwgYCb.exe
  C:\Windows\System\JpwgYCb.exe
  2⤵
  PID:10060
- C:\Windows\System\mCBEyFR.exe
  C:\Windows\System\mCBEyFR.exe
  2⤵
  PID:10132
- C:\Windows\System\sMhgWUg.exe
  C:\Windows\System\sMhgWUg.exe
  2⤵
  PID:10172
- C:\Windows\System\zCVOpFa.exe
  C:\Windows\System\zCVOpFa.exe
  2⤵
  PID:10188
- C:\Windows\System\jBFZOLW.exe
  C:\Windows\System\jBFZOLW.exe
  2⤵
  PID:10216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BoNxJcG.exe

Filesize
2.1MB

MD5
5ff8d4360da99875c94a84e3d8b0534d

SHA1
f730d58f3d68a544146982ccd305cc68303fbcf2

SHA256
a194c5ede3399d10f3b50d74652f4ca3d5c77e3e4ef813bec2c2efaa8dc78513

SHA512
dc252d84db8a5d53f44bb14d30b601fd15a63a9ec4eba4dea5124d13a1eb42ae22a553f8d4d551c48dd7f09b6bdb2cdd1501c636ebf016fedd62f96cf69ebe2c

Download Submit
C:\Windows\system\CBAAomV.exe

Filesize
2.1MB

MD5
84ed11cb0651dab79a9e3276587db31a

SHA1
b5da808310cd7007d258197801fd2fce52d85fbb

SHA256
84e2dc7aa557cf6728995d664b908569c5d127e68a2dceaa9fef9cdc3bc56219

SHA512
0c6d1498a62684e09d4e8287b3872801694c08999f97a6bd65481391419380dcf6a666194f9f7a366ed546c4500749a693996ac497d1b5b4fe7f36b7a2231553

Download Submit
C:\Windows\system\DancnKV.exe

Filesize
2.1MB

MD5
adef8159a3fb5918a96bc4405164b3ef

SHA1
b4078153eded44cd157893fefe3ebb4a774acab5

SHA256
37ab1d82c03be94038e2cb26e146efdd709ff0a58721710d3aadd2cd4f23517f

SHA512
d27f84529258c8f4ffbae1392b9028aa0760af42268f800735495f89a86917a68a8502df9ad9f2660ec0a0c51d0f2b0f46bfc462552763546f35533e99eb7768

Download Submit
C:\Windows\system\DidDLMk.exe

Filesize
2.1MB

MD5
2a0a76a707188ed74b87f6bb542d7ddd

SHA1
c212157d3a3727f04780bef10945f620a24049b4

SHA256
923f8220c46aa684e04f5717c50e3f7f138101647d8647c45b06c984eb88f81f

SHA512
2e1afce7c495e836992968181a7a8824dc7dc87ef9248e70b6eb51d8d4a7af738d59354af098125c41cc6730f16f5be79bd1d9a23251a1cf6f745f471161ea93

Download Submit
C:\Windows\system\HQeBBoZ.exe

Filesize
2.1MB

MD5
16dddb1d93f701cbfebb95671bf447c3

SHA1
4f3b0a90a3e20cd8553a9c5981997176604e23f2

SHA256
49ebab0395f70738f9b4032dbec0da6ad0aa860293ceac11a427cb80d6b1b5fe

SHA512
e608f4cdf0f3db4de80da9c9d978ef5c2418bab33ed79c83b96da5ff300ee91337d2d547204fa941b2b5ff4dc01c673bed99121191ae702f16d39b435b71b325

Download Submit
C:\Windows\system\KIfSuBq.exe

Filesize
2.1MB

MD5
804e81640ccfdd37013b8a1cf64fde23

SHA1
7928af50335637011cb2933904d1b389ae16d7ee

SHA256
ef963e7edf9c896637b93e09a1a70b0bff6016a3862d1c53bd86fa3ef18294a0

SHA512
1bcbb14c5c70c2e84e56310fa93192761afcaa25d948d5948cbe14caf66142866ca9f6cb09339b305e6d010bb80b810d4c50c54e9c2f7d6d32254267e12ab4f9

Download Submit
C:\Windows\system\KfvWbDX.exe

Filesize
2.1MB

MD5
7497341a64b66ea5eaabdf6223f56d78

SHA1
b501e604696585679c722f87dbec754bec9b6269

SHA256
7b938a4f026d21bcd77f7fb2ff21ec3356380a514e49dd52d5b79740ad604fec

SHA512
3576a66fbe586b20c93d98ddae7676de22d7a4111b193470c66313390b7827160fb26a9737a6df0e31122d9f12f7622efdce5778a59d801b14ef336d658bf15f

Download Submit
C:\Windows\system\LApmAXI.exe

Filesize
2.1MB

MD5
823ccb64cfed2dfc748af67e522cd0e4

SHA1
b40447db0d07544f5c0716f7ef8ae16671e68769

SHA256
c1ac0d9d75f888e34a99e52776e73e4e248e142ee4eee2c1a85d967f5b3a359f

SHA512
9401c2f5d260ab8ca99bbf4b2b35bcf9b68470b3ac61cea8d96eebffe7c42908b948a6f04b2fa5cdfb1f90053ac12bc1a2a3f377373524f77acb7e18b9a7c887

Download Submit
C:\Windows\system\LHsVZjo.exe

Filesize
2.1MB

MD5
303f8993c5e60823ce9afd5cd5b14a0b

SHA1
c224aa1bd1b683ec308b73fc192af0c044faf1c2

SHA256
6d5eee70a9a0ed8dfb97693a2e7b546ec7692aa0ee2dc401bb9521cdffda7e70

SHA512
8c95a492a87b07d9e577a7dbf1eabcb6c33c1c884876a414b9cb1268030b28c829818c7097795c411afae68436778e47c6f4e0258418be1fd496abb5048fdb7b

Download Submit
C:\Windows\system\NuTlBSL.exe

Filesize
2.1MB

MD5
ad0cb8912700e62083e6613b2eaf4ef5

SHA1
061403edad3f2b24097b653b8b9d6bc01bf52c42

SHA256
b69b61ec3ef792f7e52e4c79f0248997df4c0c5f75602562cfad2a6a47d137be

SHA512
461bbc1883fa3effafedd9005edfb3ce047d0e71dfba71805b32c256795c53e37b67fd535b12ad513e64d4db0b76638f43163e7e006a3da5d4c76c84553708df

Download Submit
C:\Windows\system\SFFuOZl.exe

Filesize
2.1MB

MD5
36636cac9d4b13418986cc337c6eeaff

SHA1
f3ea1ff8326789009c0fdadac52a34b9a6e2acbf

SHA256
dd35f9d2ce1de11f72f56597e4df6e87d0412a2568e229ff0fea0d0b74229ce3

SHA512
130d00999749a4c36c0ed54b9e50b7693ef2ff74f8b81a18293b34b6246595941fe57ee1d2bd7f44e7edaec2aebb5845b2e7b366e1525ee81f77595f5022bea9

Download Submit
C:\Windows\system\UFTLREq.exe

Filesize
2.1MB

MD5
f6aeef551fd5c20295be3044f4908eb9

SHA1
cf772dd73f20def1a18fd8eefa2f335607a0e970

SHA256
85d294c107a2da44e6e8716b759053967e1b7de933a52908f54dfbb23ff4ab26

SHA512
07269c26d06432fb89d11be1be5f51f10d8b8315274951abc2bff14a0743de414d0d5707823a6c1d53b359f0d7745aa7f1d67c1e883eda1414efedf8b80dd25b

Download Submit
C:\Windows\system\UfUnVNm.exe

Filesize
2.1MB

MD5
f708a70ad5799d0b35036e19d97efcf1

SHA1
237bb3ae1dc1c2bf21de3f9ed4e1ce317b8c1f77

SHA256
eb99076a97b2734d1c4110e9d7e2ab403bd6df536a37a2a20c12b74fafc91f96

SHA512
6a4634c59002b9fe3126cb4337d2ede8bb01f8420591647736964ea76a4e8a0414fbff8a8320b530dfef26cb58095ae4c883e892a0b9ffbc7797ea6012318146

Download Submit
C:\Windows\system\VEnRnnm.exe

Filesize
2.1MB

MD5
4e2d7ddb4dee3673810fd3eb00a2c791

SHA1
7422e2e2adb0f7ee5b4ec08c9163363648a6e2c2

SHA256
85fcf7f5bbb7de191ad18e8192c8909b0d8f846e85706fed2ca7201f10927bc7

SHA512
465621eb2695d1f80de68c3b011304168a2b005838acfd4092646733bdffe24ad76db0827956fdfbfbbfe239e7925ecdffb88631e1ecef70a00755c19c083892

Download Submit
C:\Windows\system\VTNZfiJ.exe

Filesize
2.1MB

MD5
dc083fb144c091b9336f807069d4085a

SHA1
9973d7b834f08f58c3c476a999c9f32577187d78

SHA256
27b2051bf937342e755a16a9af8e1cc45e43d382b28e6bd7e8506952f2d52424

SHA512
45751040670adec1b64554cba0e81a54cd5a3c2a78e69c540574f24c1d878441329019f238f231d9cc6edc43ddabc6b559ba9a02fde8b4cb5ecba2f4eb5ce250

Download Submit
C:\Windows\system\VrqDfOK.exe

Filesize
2.1MB

MD5
67a9f263f8f529e9316ee2cb070e0bfe

SHA1
2d0152aa36ba4d4040914f4265a4a263682bcf1e

SHA256
65212b017992d6eadd9fe5dcefb2e3fb4e081fda89e598501c2f07be9c8063fc

SHA512
cb38086b86f6d9c0cfba6eeae6b27d9dc38162fb5f6d5c22d23c2d876d1a6771c33b1a6b16bf7940f7679559d26005f6629455170bcb795324b4190326953312

Download Submit
C:\Windows\system\XYmtWlK.exe

Filesize
2.1MB

MD5
5d3d99c5f9597f546b390b9d5de197fe

SHA1
d4aa0b1873571602bf31d5f4bcc1b89268ec7944

SHA256
7852c8445aa3d5487ab00a9d4fb801245474bde9fa0dcd84471705528f4961e5

SHA512
78188fc59ff7ae85f65d76facff0b616a6a7b11ff25be42d5f357300040abf8ddbd9b5072bbfcf9de458acb8d4e7f2fad1413f10d624dd33752400bd3844fe4e

Download Submit
C:\Windows\system\bcvgpea.exe

Filesize
2.1MB

MD5
894789aaa3665c086f852349a7072c5e

SHA1
e763a9c2923e6f1b1d18fc98af698f5cbdb55efa

SHA256
3e6b99399aa5868332202be3c9a095e64e21143007762d27dd579e6e3e5461f2

SHA512
49b09887f8cd533ebeae5d6c1ed9f14f56250fe66e167c76efa039c9d14b2e84cb8e0639c7d2f068f1327a0123181445c36602521b40d3dd6e1f5929081f8882

Download Submit
C:\Windows\system\fokadYQ.exe

Filesize
2.1MB

MD5
e0e46939b4e079aa503ab6149c4c1465

SHA1
fdf637222bcc69fb46ed1f837861cdfc8aa43563

SHA256
1a9159f5576ee13cdf3a28e515a785658d5a0b0b985ae926d80dce70b191a7ba

SHA512
4aed0022fd7f50b986b6bc11d2a7731278dc0e0db246fafd26e6f14fda65dc34eeab18e692a97c349f12861cf5851b69878fc8d79a61db5e56df02e62dbc205a

Download Submit
C:\Windows\system\gjegHtX.exe

Filesize
2.1MB

MD5
23b77e587ee0b7673d5d5e924b121d19

SHA1
5c09aa288848d84c82d31aa14bd982cd5cf57761

SHA256
daf137cb99207c0e1e2c680c07705067879320ed50f9725f471d0183f56e5b95

SHA512
4c74bd5f75acb3199a3f6410b9b09697e86f27f4694108b63cc31e518e9ef3730ba4d7e6595f9a14004288e0c7b7875cdb796bb77d520c01c2b55543ffd17ea9

Download Submit
C:\Windows\system\hxZshtv.exe

Filesize
2.1MB

MD5
fc67318fd968be0c8faa260e59337cc9

SHA1
1ffd8b20c8adc5d9c1c0de403c116c96ee739eb3

SHA256
44076cf25b34bcfd0b05f88e4b529bc9a3a967a0e3d757a4f88cedbbb9e60cac

SHA512
3692db9a5184d1763ac3405b8747e62307ebdeba43b21f2cc75825798bb5ba940ba09b7a2d254fe8397d44050eff20eebfbcff564f0f50a4dcf6ac7755df6e03

Download Submit
C:\Windows\system\isbwLFR.exe

Filesize
2.1MB

MD5
832e93e829717d2a1c21cc024f29cc9c

SHA1
cbe6e7b1e1ef4a7379898b87c4bfc9895f750490

SHA256
5a15a085420be37c12efcd19808d552fc356a33b0f307a71bc2547024b24ed96

SHA512
ad7258cb844f1e41bb8784d21855bce99f2e0390e4a4d2178d295be20aee2066990b38130f2b971570517b17d3bf8e1e8b096fdfe5b36172ed4620f1b04818d6

Download Submit
C:\Windows\system\kcmEFiS.exe

Filesize
2.1MB

MD5
3b3f2df3fa354be1785288f734660a67

SHA1
17ab533900f83c7d64233bb69277bfe566825613

SHA256
de07142ab9160901847b0bf26e192e010b35a9421d6eed63dd63382755584da6

SHA512
daac8cad6e5f9346900354b8f36ad0a4f65bf78974e5b4386d2388e71e866100fb69f5a8ecf4d3ebeb95eea7f66878807d0ee643cec4e2f5b4799c163cd2f7bf

Download Submit
C:\Windows\system\qKLXiyC.exe

Filesize
2.1MB

MD5
ada5b26386d5ca5af48351b8d17bc34b

SHA1
ea21066deb0fc7063da0d57d0109e09a56376b6b

SHA256
082137b4a9b3bb7be49b531865333576fe8f8a88bfc1f6e68a96f65620466c03

SHA512
8bdd49d2dffc9a1580322f438d6fd7580b88c25f6c84442829d5f197a3c4eaf2b0977830af3cfeace4ae9f3740e9792e792fcce36020d6add0088406fd014fca

Download Submit
C:\Windows\system\wMvejFV.exe

Filesize
2.1MB

MD5
edad86c4436b9f0b7a9e9155a5a90aa4

SHA1
07b0a52a17a1f70fbb26d3f74e3d4254822adbfd

SHA256
da2d652129d6497f8b694587b3a601bf2e14117041f3e1cc98d104f1ddca78f0

SHA512
b4c759b5e2fb562039caf54a6113fbd71469e2c0a5d2a8a324d840d286f1c6d696c1f8f071b9f20a96e7efc0afefa139a407daac45afb017cfea439040de0fe2

Download Submit
C:\Windows\system\yGQsGnK.exe

Filesize
2.1MB

MD5
26d4a09b42df342b881c8a1ebfa1cdd3

SHA1
beff62574331ca5d4acad4fba5bf86ebc1787fd9

SHA256
44f0be614d3e9ccfa60a4ffe9dc3aa97b585f35d45e7c2372c972da0690ac3e7

SHA512
a58da72c630f8255368583882ce843936ba31f68941a498dd1c2d7d5e2e07db929651a1282210a237c871faebd63618addc44f02ad0397aaa78b34ae4ea716af

Download Submit
\Windows\system\hBgHSGK.exe

Filesize
2.1MB

MD5
a1425e0ada1f38f6f99ed901b09c3a0a

SHA1
94a908a6fb708d9d58cbf04c8a8e4f66351bcc84

SHA256
dd70bacb68a0f3af2759b80ebe166860042a9f3ea1d9fb397f1d1bf9efc128dd

SHA512
f711b2b771d0199aabae5fb4b1b51a89259c598b29a678439d16f6ef42a79951f7c71bb54f7736713d16371314c31a1aa349ab6c74a46c354a9421b0a0d16caf

Download Submit
\Windows\system\iNCNIfI.exe

Filesize
2.1MB

MD5
e9437fb0d9137b6865056b15b5201c8b

SHA1
df44c44bd39e80c62cabcd6995323cd03d0b782f

SHA256
acba1d4da4086dc8dcdf6117908a6952ee8dedff03f44cdc2a487f5c726ed265

SHA512
fb0ff7c7f0c7cad0d8e6924040b8d53f08e7c77df3579d162d445d68f8916400ff129d5a50d127f8c9e783533eba3a02c8f101e2d81551908dc6114ea430fe08

Download Submit
\Windows\system\jOtGPeB.exe

Filesize
2.1MB

MD5
22e95034afaf803f557f7db6852c0d00

SHA1
486ee7b68760e9f75d8f90f4962c7c275976e763

SHA256
e170e478e66605c7e44b0ba25c2cfc2d69630ecbb567205c3175fe9257eb7158

SHA512
b3a6b2bda0cf62bd3dbb237bb28a5865a788b3d2e83e4ae2c0de5b97c2c7568ad3a4d1e268cbd5fb1d1b20ddf159b3d65178260e6274ef35dd42284310f02f0e

Download Submit
\Windows\system\kXbKKwV.exe

Filesize
2.1MB

MD5
1075cf718619b787347d24b59a8e2776

SHA1
4789fea0f93823349909d8c2f603a47852987d10

SHA256
5ca67e4a88c3ac5763e5e869b6cfe0b5c2b4032eba4857b62064f5d8a40a8dd5

SHA512
db0e8042fdd419678be55e7a86cd82be15ebce1b9d16b105d347cdce5bf4cdb38e980e7355b10b9b987f724a980b79ce2edb7a3f16ac4e76efeb74b808545a55

Download Submit
\Windows\system\sNVGJdD.exe

Filesize
2.1MB

MD5
df7233448c00427c3320be0d7e36e2ae

SHA1
98a0e77aeecb5e82458ffaf02810ca2394fe6ad5

SHA256
913c390e11d21d36f1714cf6e060e99139f146704e8b829a197034eb7a0c774f

SHA512
a3da52985a08dbcbe33bfc2598c57693b07e142ea577bf5e67f9dd11700c31fa7593e73fc8a4640baf86da0d14f1252aaf192d0407c0c321f29e12dee99ed2ab

Download Submit
\Windows\system\tsBdSKX.exe

Filesize
2.1MB

MD5
c3028e790a8fee6352ab42d6a27eb476

SHA1
c82555bdfd47a2493f29d9ec7601b89314017c84

SHA256
cbaea385baeaf68422210d34b486b749a880a35beb70bd6b75ecada2032b67c5

SHA512
de4debf542e856a58d2456f84dd12d3ebb42d11ed298c557298a58f117851dd87afef2c16c77df978fee115da884bbbab3c95566372ba14bdb55b135805e708f

Download Submit
memory/2016-3998-0x000000013FBE0000-0x000000013FF34000-memory.dmp

Filesize
3.3MB

Download
memory/2016-90-0x000000013FBE0000-0x000000013FF34000-memory.dmp

Filesize
3.3MB

Download
memory/2028-60-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-15-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-3408-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-88-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-91-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/2028-57-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-92-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-93-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-3168-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-3167-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2028-106-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-96-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2028-77-0x000000013FDC0000-0x0000000140114000-memory.dmp

Filesize
3.3MB

Download
memory/2028-3166-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-3165-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-2818-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-2763-0x000000013F980000-0x000000013FCD4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-99-0x000000013F5B0000-0x000000013F904000-memory.dmp

Filesize
3.3MB

Download
memory/2028-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2028-40-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2028-80-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-2-0x000000013F980000-0x000000013FCD4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-30-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2028-86-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2032-98-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2032-4001-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2548-97-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2548-4007-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2580-87-0x000000013FB10000-0x000000013FE64000-memory.dmp

Filesize
3.3MB

Download
memory/2580-4008-0x000000013FB10000-0x000000013FE64000-memory.dmp

Filesize
3.3MB

Download
memory/2580-3040-0x000000013FB10000-0x000000013FE64000-memory.dmp

Filesize
3.3MB

Download
memory/2712-73-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2712-4002-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2716-76-0x000000013F900000-0x000000013FC54000-memory.dmp

Filesize
3.3MB

Download
memory/2716-4000-0x000000013F900000-0x000000013FC54000-memory.dmp

Filesize
3.3MB

Download
memory/2780-95-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2780-4006-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2804-81-0x000000013F7D0000-0x000000013FB24000-memory.dmp

Filesize
3.3MB

Download
memory/2804-4004-0x000000013F7D0000-0x000000013FB24000-memory.dmp

Filesize
3.3MB

Download
memory/2844-82-0x000000013FDC0000-0x0000000140114000-memory.dmp

Filesize
3.3MB

Download
memory/2844-4005-0x000000013FDC0000-0x0000000140114000-memory.dmp

Filesize
3.3MB

Download
memory/3020-3999-0x000000013FBB0000-0x000000013FF04000-memory.dmp

Filesize
3.3MB

Download
memory/3020-47-0x000000013FBB0000-0x000000013FF04000-memory.dmp

Filesize
3.3MB

Download
memory/3032-4003-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/3032-94-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download