xmrig | 0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
Size

941KB
MD5

43a52a47b4c315abfb0e029c22a7c1c0
SHA1

0d68b1e94860b12e93f63aadbae0704a5794f30b
SHA256

0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348
SHA512

80c709057da10f997feed3b69eaa2784132a4c933ee67f9781bf183201392e6168a52e4754d8abe8b5c2b5feb4c21c089c2d0f904c13cc975805a9aa24be7788
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenABWelqLBG:GezaTF8FcNkNdfE0pZ9oztFwIKTLQ

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x00060000000232b3-4.dat	xmrig
behavioral2/files/0x000700000002345e-8.dat	xmrig
behavioral2/files/0x000700000002345d-9.dat	xmrig
behavioral2/files/0x0007000000023460-34.dat	xmrig
behavioral2/files/0x0007000000023465-44.dat	xmrig
behavioral2/files/0x0007000000023467-56.dat	xmrig
behavioral2/files/0x0007000000023469-62.dat	xmrig
behavioral2/files/0x000700000002346b-86.dat	xmrig
behavioral2/files/0x0007000000023472-115.dat	xmrig
behavioral2/files/0x0007000000023471-113.dat	xmrig
behavioral2/files/0x0007000000023470-111.dat	xmrig
behavioral2/files/0x000700000002346f-109.dat	xmrig
behavioral2/files/0x000700000002346e-107.dat	xmrig
behavioral2/files/0x000700000002346d-105.dat	xmrig
behavioral2/files/0x000700000002346c-103.dat	xmrig
behavioral2/files/0x000700000002346a-99.dat	xmrig
behavioral2/files/0x0007000000023468-61.dat	xmrig
behavioral2/files/0x0007000000023466-55.dat	xmrig
behavioral2/files/0x0007000000023464-53.dat	xmrig
behavioral2/files/0x0007000000023463-49.dat	xmrig
behavioral2/files/0x0007000000023462-40.dat	xmrig
behavioral2/files/0x0007000000023461-38.dat	xmrig
behavioral2/files/0x000700000002345f-31.dat	xmrig
behavioral2/files/0x0007000000023473-122.dat	xmrig
behavioral2/files/0x0007000000023475-121.dat	xmrig
behavioral2/files/0x0007000000023476-128.dat	xmrig
behavioral2/files/0x000800000002345a-133.dat	xmrig
behavioral2/files/0x000700000002347b-156.dat	xmrig
behavioral2/files/0x0007000000023479-163.dat	xmrig
behavioral2/files/0x0007000000023477-161.dat	xmrig
behavioral2/files/0x0007000000023478-160.dat	xmrig
behavioral2/files/0x000700000002347e-159.dat	xmrig
behavioral2/files/0x000700000002347d-158.dat	xmrig
behavioral2/files/0x000700000002347c-157.dat	xmrig
behavioral2/files/0x000700000002347a-155.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3036	kOkqtUy.exe
4388	wDUcVqh.exe
1580	FynEPgq.exe
1516	ydEHOJZ.exe
4808	gaAUEKy.exe
1100	aVdCkrr.exe
3836	NUqUMFv.exe
4652	VweprWj.exe
1828	yUturmK.exe
4824	NIOAbvS.exe
3988	fmYFDbi.exe
4932	dYoLbRQ.exe
2444	JfCpNSf.exe
4752	MCytULe.exe
1464	pGScbJU.exe
3200	zAeEfWW.exe
1212	GcRrzLS.exe
2364	PBEOeon.exe
2760	oiDJVhp.exe
2128	RxqyHoO.exe
3956	MDtADdQ.exe
1628	JGzPGPc.exe
1608	Egtdkju.exe
2904	KnVVvKz.exe
1596	rjwECOd.exe
2996	ajktzje.exe
4708	xhIVmTi.exe
3564	FFppGzp.exe
4348	zYKbtZU.exe
2060	gQDyKln.exe
3412	rJYGvox.exe
1932	tzqpUfl.exe
4436	lolWiIW.exe
1508	PNbzUmc.exe
5056	QiAxzCy.exe
652	uyosauz.exe
4232	kvpFzLg.exe
2312	yogNSXo.exe
1136	RCOGUGx.exe
5088	yKEJFSB.exe
1184	bQrZelV.exe
2348	uajGrCB.exe
4696	KdvAtIn.exe
3348	diXIPkN.exe
932	YOefCIK.exe
4536	MUxklgY.exe
4368	IVBCRFz.exe
2140	ZchEMfb.exe
2280	bmBfehh.exe
4512	slxCGjS.exe
3020	QYEmihF.exe
780	ntqJold.exe
3992	vMWfpJu.exe
2256	CVQDoXB.exe
4384	VpwDtlw.exe
1736	BHiLfTx.exe
2664	nYwJdoZ.exe
1468	ijsvDCm.exe
4840	vUdQkHx.exe
3516	VAtwiJo.exe
1016	pCEWzoa.exe
2108	DnorBfX.exe
2264	KOJMLQe.exe
4492	lzacVsE.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UcZrNMn.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\bMHDSab.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\NsdeFBd.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\VAtwiJo.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\sAQtohu.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\chrEJxZ.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\zuTBHSu.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\ryaThJp.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\zaDDAmk.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\zEhBDvs.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\Mtwqwsz.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\wachiKO.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\ruDxrfP.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\LcMcapk.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\BZQbXBj.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\LzlYaHW.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\ryVekGb.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\OQJaTee.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\KdvAtIn.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\mJUPxiX.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\dzkMEOK.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\yEFZfLP.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\RRGVfvI.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\wtLflle.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\ZBmEfio.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\mWKKJXX.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\kOkqtUy.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\IVBCRFz.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\EQkMulX.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\yMDoGUD.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\dBUFxzj.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\Hwqftdr.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\XwXBVgc.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\GARfnPc.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\diXIPkN.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\XlGfkoa.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\IppjiQs.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\QIAQbcI.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\BNkXihB.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\wNlebJJ.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\qWHnkXD.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\IJHKYrd.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\HPynIbb.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\PBEOeon.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\fseDNoi.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\ZtglnaY.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\bDwpZWB.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\PEYkmrZ.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\cpHUoLz.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\GFRrcnq.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\rEqqXVk.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\ktcHeSU.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\rHOtplk.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\vliiTCp.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\nLJRzgK.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\nAHtrFI.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\MIuZBnd.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\GNWQUKo.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\zYfOzBB.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\YsKjcdc.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\FAnRxGx.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\inClqlv.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\iFZpjKD.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
File created	C:\Windows\System\xhIVmTi.exe	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3036	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	84
PID 4364 wrote to memory of 3036	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	84
PID 4364 wrote to memory of 4388	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	85
PID 4364 wrote to memory of 4388	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	85
PID 4364 wrote to memory of 1580	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	86
PID 4364 wrote to memory of 1580	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	86
PID 4364 wrote to memory of 1516	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	87
PID 4364 wrote to memory of 1516	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	87
PID 4364 wrote to memory of 4808	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	88
PID 4364 wrote to memory of 4808	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	88
PID 4364 wrote to memory of 1100	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	89
PID 4364 wrote to memory of 1100	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	89
PID 4364 wrote to memory of 3836	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	90
PID 4364 wrote to memory of 3836	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	90
PID 4364 wrote to memory of 4652	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	91
PID 4364 wrote to memory of 4652	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	91
PID 4364 wrote to memory of 1828	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	92
PID 4364 wrote to memory of 1828	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	92
PID 4364 wrote to memory of 4824	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	93
PID 4364 wrote to memory of 4824	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	93
PID 4364 wrote to memory of 3988	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	94
PID 4364 wrote to memory of 3988	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	94
PID 4364 wrote to memory of 4932	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	95
PID 4364 wrote to memory of 4932	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	95
PID 4364 wrote to memory of 2444	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	96
PID 4364 wrote to memory of 2444	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	96
PID 4364 wrote to memory of 4752	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	97
PID 4364 wrote to memory of 4752	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	97
PID 4364 wrote to memory of 1464	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	98
PID 4364 wrote to memory of 1464	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	98
PID 4364 wrote to memory of 3200	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	99
PID 4364 wrote to memory of 3200	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	99
PID 4364 wrote to memory of 1212	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	100
PID 4364 wrote to memory of 1212	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	100
PID 4364 wrote to memory of 2364	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	101
PID 4364 wrote to memory of 2364	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	101
PID 4364 wrote to memory of 2760	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	102
PID 4364 wrote to memory of 2760	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	102
PID 4364 wrote to memory of 2128	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	103
PID 4364 wrote to memory of 2128	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	103
PID 4364 wrote to memory of 3956	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	104
PID 4364 wrote to memory of 3956	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	104
PID 4364 wrote to memory of 1628	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	105
PID 4364 wrote to memory of 1628	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	105
PID 4364 wrote to memory of 1608	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	106
PID 4364 wrote to memory of 1608	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	106
PID 4364 wrote to memory of 1596	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	107
PID 4364 wrote to memory of 1596	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	107
PID 4364 wrote to memory of 2904	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	108
PID 4364 wrote to memory of 2904	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	108
PID 4364 wrote to memory of 2996	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	109
PID 4364 wrote to memory of 2996	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	109
PID 4364 wrote to memory of 4708	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	110
PID 4364 wrote to memory of 4708	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	110
PID 4364 wrote to memory of 3564	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	111
PID 4364 wrote to memory of 3564	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	111
PID 4364 wrote to memory of 5056	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	112
PID 4364 wrote to memory of 5056	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	112
PID 4364 wrote to memory of 4348	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	113
PID 4364 wrote to memory of 4348	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	113
PID 4364 wrote to memory of 2060	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	114
PID 4364 wrote to memory of 2060	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	114
PID 4364 wrote to memory of 3412	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	115
PID 4364 wrote to memory of 3412	4364	0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0a2db5339b113af6b705f75cf90c5af290b8f0c500a06749dbfb74d8329a4348_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\System\kOkqtUy.exe
  C:\Windows\System\kOkqtUy.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\wDUcVqh.exe
  C:\Windows\System\wDUcVqh.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\FynEPgq.exe
  C:\Windows\System\FynEPgq.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\ydEHOJZ.exe
  C:\Windows\System\ydEHOJZ.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\gaAUEKy.exe
  C:\Windows\System\gaAUEKy.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\aVdCkrr.exe
  C:\Windows\System\aVdCkrr.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\NUqUMFv.exe
  C:\Windows\System\NUqUMFv.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\VweprWj.exe
  C:\Windows\System\VweprWj.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\yUturmK.exe
  C:\Windows\System\yUturmK.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\NIOAbvS.exe
  C:\Windows\System\NIOAbvS.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\fmYFDbi.exe
  C:\Windows\System\fmYFDbi.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\dYoLbRQ.exe
  C:\Windows\System\dYoLbRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\JfCpNSf.exe
  C:\Windows\System\JfCpNSf.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\MCytULe.exe
  C:\Windows\System\MCytULe.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\pGScbJU.exe
  C:\Windows\System\pGScbJU.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\zAeEfWW.exe
  C:\Windows\System\zAeEfWW.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\GcRrzLS.exe
  C:\Windows\System\GcRrzLS.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\PBEOeon.exe
  C:\Windows\System\PBEOeon.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\oiDJVhp.exe
  C:\Windows\System\oiDJVhp.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\RxqyHoO.exe
  C:\Windows\System\RxqyHoO.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\MDtADdQ.exe
  C:\Windows\System\MDtADdQ.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\JGzPGPc.exe
  C:\Windows\System\JGzPGPc.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\Egtdkju.exe
  C:\Windows\System\Egtdkju.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\rjwECOd.exe
  C:\Windows\System\rjwECOd.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\KnVVvKz.exe
  C:\Windows\System\KnVVvKz.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\ajktzje.exe
  C:\Windows\System\ajktzje.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\xhIVmTi.exe
  C:\Windows\System\xhIVmTi.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\FFppGzp.exe
  C:\Windows\System\FFppGzp.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\QiAxzCy.exe
  C:\Windows\System\QiAxzCy.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\zYKbtZU.exe
  C:\Windows\System\zYKbtZU.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\gQDyKln.exe
  C:\Windows\System\gQDyKln.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\rJYGvox.exe
  C:\Windows\System\rJYGvox.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\tzqpUfl.exe
  C:\Windows\System\tzqpUfl.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\lolWiIW.exe
  C:\Windows\System\lolWiIW.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\PNbzUmc.exe
  C:\Windows\System\PNbzUmc.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\uyosauz.exe
  C:\Windows\System\uyosauz.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\kvpFzLg.exe
  C:\Windows\System\kvpFzLg.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\yogNSXo.exe
  C:\Windows\System\yogNSXo.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\RCOGUGx.exe
  C:\Windows\System\RCOGUGx.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\yKEJFSB.exe
  C:\Windows\System\yKEJFSB.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\bQrZelV.exe
  C:\Windows\System\bQrZelV.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\KdvAtIn.exe
  C:\Windows\System\KdvAtIn.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\uajGrCB.exe
  C:\Windows\System\uajGrCB.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\diXIPkN.exe
  C:\Windows\System\diXIPkN.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\YOefCIK.exe
  C:\Windows\System\YOefCIK.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\IVBCRFz.exe
  C:\Windows\System\IVBCRFz.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\MUxklgY.exe
  C:\Windows\System\MUxklgY.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\ZchEMfb.exe
  C:\Windows\System\ZchEMfb.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\bmBfehh.exe
  C:\Windows\System\bmBfehh.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\slxCGjS.exe
  C:\Windows\System\slxCGjS.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\QYEmihF.exe
  C:\Windows\System\QYEmihF.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\ntqJold.exe
  C:\Windows\System\ntqJold.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\vMWfpJu.exe
  C:\Windows\System\vMWfpJu.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\CVQDoXB.exe
  C:\Windows\System\CVQDoXB.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\VpwDtlw.exe
  C:\Windows\System\VpwDtlw.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\BHiLfTx.exe
  C:\Windows\System\BHiLfTx.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\nYwJdoZ.exe
  C:\Windows\System\nYwJdoZ.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\ijsvDCm.exe
  C:\Windows\System\ijsvDCm.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\vUdQkHx.exe
  C:\Windows\System\vUdQkHx.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\VAtwiJo.exe
  C:\Windows\System\VAtwiJo.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\QjvJvCS.exe
  C:\Windows\System\QjvJvCS.exe
  2⤵
  PID:1216
- C:\Windows\System\pCEWzoa.exe
  C:\Windows\System\pCEWzoa.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\DnorBfX.exe
  C:\Windows\System\DnorBfX.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\KOJMLQe.exe
  C:\Windows\System\KOJMLQe.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\lzacVsE.exe
  C:\Windows\System\lzacVsE.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\HXygmpH.exe
  C:\Windows\System\HXygmpH.exe
  2⤵
  PID:2696
- C:\Windows\System\jSriGvo.exe
  C:\Windows\System\jSriGvo.exe
  2⤵
  PID:1792
- C:\Windows\System\leeJoqx.exe
  C:\Windows\System\leeJoqx.exe
  2⤵
  PID:4940
- C:\Windows\System\kMuEduw.exe
  C:\Windows\System\kMuEduw.exe
  2⤵
  PID:1992
- C:\Windows\System\dARLyzB.exe
  C:\Windows\System\dARLyzB.exe
  2⤵
  PID:2032
- C:\Windows\System\ToTCxdi.exe
  C:\Windows\System\ToTCxdi.exe
  2⤵
  PID:3932
- C:\Windows\System\TwwABng.exe
  C:\Windows\System\TwwABng.exe
  2⤵
  PID:2772
- C:\Windows\System\JoccEHa.exe
  C:\Windows\System\JoccEHa.exe
  2⤵
  PID:2328
- C:\Windows\System\FBygIFE.exe
  C:\Windows\System\FBygIFE.exe
  2⤵
  PID:3452
- C:\Windows\System\WUBKNbn.exe
  C:\Windows\System\WUBKNbn.exe
  2⤵
  PID:964
- C:\Windows\System\BNnYxIK.exe
  C:\Windows\System\BNnYxIK.exe
  2⤵
  PID:2724
- C:\Windows\System\VDhaWyI.exe
  C:\Windows\System\VDhaWyI.exe
  2⤵
  PID:4872
- C:\Windows\System\EXyCuTy.exe
  C:\Windows\System\EXyCuTy.exe
  2⤵
  PID:4036
- C:\Windows\System\ruDxrfP.exe
  C:\Windows\System\ruDxrfP.exe
  2⤵
  PID:1800
- C:\Windows\System\TncoOZQ.exe
  C:\Windows\System\TncoOZQ.exe
  2⤵
  PID:2588
- C:\Windows\System\uMJVFjF.exe
  C:\Windows\System\uMJVFjF.exe
  2⤵
  PID:1132
- C:\Windows\System\MRDTYDR.exe
  C:\Windows\System\MRDTYDR.exe
  2⤵
  PID:408
- C:\Windows\System\DnbeWnZ.exe
  C:\Windows\System\DnbeWnZ.exe
  2⤵
  PID:3100
- C:\Windows\System\ywZCNvi.exe
  C:\Windows\System\ywZCNvi.exe
  2⤵
  PID:4964
- C:\Windows\System\GscrNds.exe
  C:\Windows\System\GscrNds.exe
  2⤵
  PID:1392
- C:\Windows\System\glysKYL.exe
  C:\Windows\System\glysKYL.exe
  2⤵
  PID:1356
- C:\Windows\System\HUqlVfq.exe
  C:\Windows\System\HUqlVfq.exe
  2⤵
  PID:3384
- C:\Windows\System\wWrxRXS.exe
  C:\Windows\System\wWrxRXS.exe
  2⤵
  PID:884
- C:\Windows\System\GenYMHN.exe
  C:\Windows\System\GenYMHN.exe
  2⤵
  PID:2912
- C:\Windows\System\ChKLyCY.exe
  C:\Windows\System\ChKLyCY.exe
  2⤵
  PID:4004
- C:\Windows\System\QzInPsn.exe
  C:\Windows\System\QzInPsn.exe
  2⤵
  PID:4592
- C:\Windows\System\aTbDwTl.exe
  C:\Windows\System\aTbDwTl.exe
  2⤵
  PID:2920
- C:\Windows\System\ntAHBOu.exe
  C:\Windows\System\ntAHBOu.exe
  2⤵
  PID:1112
- C:\Windows\System\IlmJLiq.exe
  C:\Windows\System\IlmJLiq.exe
  2⤵
  PID:4196
- C:\Windows\System\uXiIVbT.exe
  C:\Windows\System\uXiIVbT.exe
  2⤵
  PID:2576
- C:\Windows\System\iDemjWu.exe
  C:\Windows\System\iDemjWu.exe
  2⤵
  PID:3592
- C:\Windows\System\QEXKLQz.exe
  C:\Windows\System\QEXKLQz.exe
  2⤵
  PID:1872
- C:\Windows\System\jSztLlG.exe
  C:\Windows\System\jSztLlG.exe
  2⤵
  PID:5152
- C:\Windows\System\VWboHMr.exe
  C:\Windows\System\VWboHMr.exe
  2⤵
  PID:5184
- C:\Windows\System\rgGFLkr.exe
  C:\Windows\System\rgGFLkr.exe
  2⤵
  PID:5212
- C:\Windows\System\SEGKfsu.exe
  C:\Windows\System\SEGKfsu.exe
  2⤵
  PID:5232
- C:\Windows\System\TsAcPRS.exe
  C:\Windows\System\TsAcPRS.exe
  2⤵
  PID:5252
- C:\Windows\System\EYhZvti.exe
  C:\Windows\System\EYhZvti.exe
  2⤵
  PID:5276
- C:\Windows\System\QuaYvZo.exe
  C:\Windows\System\QuaYvZo.exe
  2⤵
  PID:5296
- C:\Windows\System\CqPYJcL.exe
  C:\Windows\System\CqPYJcL.exe
  2⤵
  PID:5316
- C:\Windows\System\glVaxaU.exe
  C:\Windows\System\glVaxaU.exe
  2⤵
  PID:5332
- C:\Windows\System\CMHtrqZ.exe
  C:\Windows\System\CMHtrqZ.exe
  2⤵
  PID:5360
- C:\Windows\System\Ouzmzad.exe
  C:\Windows\System\Ouzmzad.exe
  2⤵
  PID:5380
- C:\Windows\System\YOVMDvr.exe
  C:\Windows\System\YOVMDvr.exe
  2⤵
  PID:5408
- C:\Windows\System\NRqvNRt.exe
  C:\Windows\System\NRqvNRt.exe
  2⤵
  PID:5436
- C:\Windows\System\IRMwhTD.exe
  C:\Windows\System\IRMwhTD.exe
  2⤵
  PID:5460
- C:\Windows\System\cyNZCPp.exe
  C:\Windows\System\cyNZCPp.exe
  2⤵
  PID:5476
- C:\Windows\System\fSUIwho.exe
  C:\Windows\System\fSUIwho.exe
  2⤵
  PID:5496
- C:\Windows\System\lKAugtt.exe
  C:\Windows\System\lKAugtt.exe
  2⤵
  PID:5520
- C:\Windows\System\yzLDsBl.exe
  C:\Windows\System\yzLDsBl.exe
  2⤵
  PID:5536
- C:\Windows\System\LcMcapk.exe
  C:\Windows\System\LcMcapk.exe
  2⤵
  PID:5556
- C:\Windows\System\fgiVedi.exe
  C:\Windows\System\fgiVedi.exe
  2⤵
  PID:5604
- C:\Windows\System\EpmDUhM.exe
  C:\Windows\System\EpmDUhM.exe
  2⤵
  PID:5624
- C:\Windows\System\VPajIFu.exe
  C:\Windows\System\VPajIFu.exe
  2⤵
  PID:5648
- C:\Windows\System\xLtPWmL.exe
  C:\Windows\System\xLtPWmL.exe
  2⤵
  PID:5672
- C:\Windows\System\DmHqLoF.exe
  C:\Windows\System\DmHqLoF.exe
  2⤵
  PID:5696
- C:\Windows\System\DoAnBtn.exe
  C:\Windows\System\DoAnBtn.exe
  2⤵
  PID:5716
- C:\Windows\System\vGrUbxx.exe
  C:\Windows\System\vGrUbxx.exe
  2⤵
  PID:5740
- C:\Windows\System\vUVCBIz.exe
  C:\Windows\System\vUVCBIz.exe
  2⤵
  PID:5760
- C:\Windows\System\eTrfqUn.exe
  C:\Windows\System\eTrfqUn.exe
  2⤵
  PID:5780
- C:\Windows\System\DeRRTsR.exe
  C:\Windows\System\DeRRTsR.exe
  2⤵
  PID:5808
- C:\Windows\System\UeOUvGP.exe
  C:\Windows\System\UeOUvGP.exe
  2⤵
  PID:5848
- C:\Windows\System\WbhGKiD.exe
  C:\Windows\System\WbhGKiD.exe
  2⤵
  PID:5876
- C:\Windows\System\rslHoqC.exe
  C:\Windows\System\rslHoqC.exe
  2⤵
  PID:5904
- C:\Windows\System\VScnIRT.exe
  C:\Windows\System\VScnIRT.exe
  2⤵
  PID:5924
- C:\Windows\System\AZLbJYs.exe
  C:\Windows\System\AZLbJYs.exe
  2⤵
  PID:5996
- C:\Windows\System\tlLRwOp.exe
  C:\Windows\System\tlLRwOp.exe
  2⤵
  PID:6016
- C:\Windows\System\MVMnsUE.exe
  C:\Windows\System\MVMnsUE.exe
  2⤵
  PID:6052
- C:\Windows\System\dBwhzyb.exe
  C:\Windows\System\dBwhzyb.exe
  2⤵
  PID:6084
- C:\Windows\System\mZXWJnx.exe
  C:\Windows\System\mZXWJnx.exe
  2⤵
  PID:6120
- C:\Windows\System\VVqjscc.exe
  C:\Windows\System\VVqjscc.exe
  2⤵
  PID:4836
- C:\Windows\System\sAQtohu.exe
  C:\Windows\System\sAQtohu.exe
  2⤵
  PID:3952
- C:\Windows\System\RRGVfvI.exe
  C:\Windows\System\RRGVfvI.exe
  2⤵
  PID:5144
- C:\Windows\System\flbnhYG.exe
  C:\Windows\System\flbnhYG.exe
  2⤵
  PID:4040
- C:\Windows\System\GnUCWiI.exe
  C:\Windows\System\GnUCWiI.exe
  2⤵
  PID:5160
- C:\Windows\System\oIQnMny.exe
  C:\Windows\System\oIQnMny.exe
  2⤵
  PID:5352
- C:\Windows\System\ttpgbOV.exe
  C:\Windows\System\ttpgbOV.exe
  2⤵
  PID:5424
- C:\Windows\System\LzlYaHW.exe
  C:\Windows\System\LzlYaHW.exe
  2⤵
  PID:5340
- C:\Windows\System\nxCInhJ.exe
  C:\Windows\System\nxCInhJ.exe
  2⤵
  PID:5432
- C:\Windows\System\IZXBHUU.exe
  C:\Windows\System\IZXBHUU.exe
  2⤵
  PID:5400
- C:\Windows\System\FYbPbLB.exe
  C:\Windows\System\FYbPbLB.exe
  2⤵
  PID:5616
- C:\Windows\System\RcGCNZG.exe
  C:\Windows\System\RcGCNZG.exe
  2⤵
  PID:5552
- C:\Windows\System\YEiMWIR.exe
  C:\Windows\System\YEiMWIR.exe
  2⤵
  PID:5712
- C:\Windows\System\Hwqftdr.exe
  C:\Windows\System\Hwqftdr.exe
  2⤵
  PID:5916
- C:\Windows\System\RtrPmmj.exe
  C:\Windows\System\RtrPmmj.exe
  2⤵
  PID:5872
- C:\Windows\System\wNFCJyj.exe
  C:\Windows\System\wNFCJyj.exe
  2⤵
  PID:6104
- C:\Windows\System\gbnkJMV.exe
  C:\Windows\System\gbnkJMV.exe
  2⤵
  PID:5804
- C:\Windows\System\ayjSciD.exe
  C:\Windows\System\ayjSciD.exe
  2⤵
  PID:5896
- C:\Windows\System\ltlunuc.exe
  C:\Windows\System\ltlunuc.exe
  2⤵
  PID:5196
- C:\Windows\System\CJESUVP.exe
  C:\Windows\System\CJESUVP.exe
  2⤵
  PID:6064
- C:\Windows\System\JNIedRx.exe
  C:\Windows\System\JNIedRx.exe
  2⤵
  PID:3912
- C:\Windows\System\JmsJAXY.exe
  C:\Windows\System\JmsJAXY.exe
  2⤵
  PID:4712
- C:\Windows\System\fDsUbdI.exe
  C:\Windows\System\fDsUbdI.exe
  2⤵
  PID:5404
- C:\Windows\System\aDnobfr.exe
  C:\Windows\System\aDnobfr.exe
  2⤵
  PID:5324
- C:\Windows\System\AgoNsxN.exe
  C:\Windows\System\AgoNsxN.exe
  2⤵
  PID:6168
- C:\Windows\System\oCSQerF.exe
  C:\Windows\System\oCSQerF.exe
  2⤵
  PID:6196
- C:\Windows\System\FKdAxrT.exe
  C:\Windows\System\FKdAxrT.exe
  2⤵
  PID:6224
- C:\Windows\System\VmvaryA.exe
  C:\Windows\System\VmvaryA.exe
  2⤵
  PID:6248
- C:\Windows\System\tvWAbpI.exe
  C:\Windows\System\tvWAbpI.exe
  2⤵
  PID:6268
- C:\Windows\System\OUmPtGN.exe
  C:\Windows\System\OUmPtGN.exe
  2⤵
  PID:6312
- C:\Windows\System\WYFVIqA.exe
  C:\Windows\System\WYFVIqA.exe
  2⤵
  PID:6344
- C:\Windows\System\ryVekGb.exe
  C:\Windows\System\ryVekGb.exe
  2⤵
  PID:6380
- C:\Windows\System\hxIfKJp.exe
  C:\Windows\System\hxIfKJp.exe
  2⤵
  PID:6396
- C:\Windows\System\akZJWGe.exe
  C:\Windows\System\akZJWGe.exe
  2⤵
  PID:6420
- C:\Windows\System\EQkMulX.exe
  C:\Windows\System\EQkMulX.exe
  2⤵
  PID:6436
- C:\Windows\System\aYvPhXv.exe
  C:\Windows\System\aYvPhXv.exe
  2⤵
  PID:6452
- C:\Windows\System\suJRioO.exe
  C:\Windows\System\suJRioO.exe
  2⤵
  PID:6472
- C:\Windows\System\eJwJxST.exe
  C:\Windows\System\eJwJxST.exe
  2⤵
  PID:6500
- C:\Windows\System\yxGSLHv.exe
  C:\Windows\System\yxGSLHv.exe
  2⤵
  PID:6524
- C:\Windows\System\aOSaEgX.exe
  C:\Windows\System\aOSaEgX.exe
  2⤵
  PID:6548
- C:\Windows\System\RrtzBPU.exe
  C:\Windows\System\RrtzBPU.exe
  2⤵
  PID:6572
- C:\Windows\System\PTyTdMX.exe
  C:\Windows\System\PTyTdMX.exe
  2⤵
  PID:6592
- C:\Windows\System\FDziYHS.exe
  C:\Windows\System\FDziYHS.exe
  2⤵
  PID:6620
- C:\Windows\System\AZLswCs.exe
  C:\Windows\System\AZLswCs.exe
  2⤵
  PID:6640
- C:\Windows\System\zogVfQY.exe
  C:\Windows\System\zogVfQY.exe
  2⤵
  PID:6672
- C:\Windows\System\tHvhsGE.exe
  C:\Windows\System\tHvhsGE.exe
  2⤵
  PID:6696
- C:\Windows\System\rcukLBn.exe
  C:\Windows\System\rcukLBn.exe
  2⤵
  PID:6716
- C:\Windows\System\faqOxXd.exe
  C:\Windows\System\faqOxXd.exe
  2⤵
  PID:6740
- C:\Windows\System\xSUCrKr.exe
  C:\Windows\System\xSUCrKr.exe
  2⤵
  PID:6760
- C:\Windows\System\AwUhtrJ.exe
  C:\Windows\System\AwUhtrJ.exe
  2⤵
  PID:6776
- C:\Windows\System\gwgvsxX.exe
  C:\Windows\System\gwgvsxX.exe
  2⤵
  PID:6792
- C:\Windows\System\jPFsjPw.exe
  C:\Windows\System\jPFsjPw.exe
  2⤵
  PID:6808
- C:\Windows\System\uZaPgat.exe
  C:\Windows\System\uZaPgat.exe
  2⤵
  PID:6828
- C:\Windows\System\vGjstvt.exe
  C:\Windows\System\vGjstvt.exe
  2⤵
  PID:6848
- C:\Windows\System\GeAWZHZ.exe
  C:\Windows\System\GeAWZHZ.exe
  2⤵
  PID:6872
- C:\Windows\System\mWKKJXX.exe
  C:\Windows\System\mWKKJXX.exe
  2⤵
  PID:6896
- C:\Windows\System\evJjRxx.exe
  C:\Windows\System\evJjRxx.exe
  2⤵
  PID:6920
- C:\Windows\System\BffEefE.exe
  C:\Windows\System\BffEefE.exe
  2⤵
  PID:6944
- C:\Windows\System\nIyOPRy.exe
  C:\Windows\System\nIyOPRy.exe
  2⤵
  PID:6968
- C:\Windows\System\kaHtKYi.exe
  C:\Windows\System\kaHtKYi.exe
  2⤵
  PID:6996
- C:\Windows\System\xPKeAYO.exe
  C:\Windows\System\xPKeAYO.exe
  2⤵
  PID:7016
- C:\Windows\System\KUDmhmX.exe
  C:\Windows\System\KUDmhmX.exe
  2⤵
  PID:7040
- C:\Windows\System\nWoZfUK.exe
  C:\Windows\System\nWoZfUK.exe
  2⤵
  PID:7060
- C:\Windows\System\HOswdrs.exe
  C:\Windows\System\HOswdrs.exe
  2⤵
  PID:7080
- C:\Windows\System\lWsxMaa.exe
  C:\Windows\System\lWsxMaa.exe
  2⤵
  PID:7112
- C:\Windows\System\JkrmXvK.exe
  C:\Windows\System\JkrmXvK.exe
  2⤵
  PID:7132
- C:\Windows\System\jDrRKCG.exe
  C:\Windows\System\jDrRKCG.exe
  2⤵
  PID:7156
- C:\Windows\System\QQiPNxv.exe
  C:\Windows\System\QQiPNxv.exe
  2⤵
  PID:5832
- C:\Windows\System\wOrWqbq.exe
  C:\Windows\System\wOrWqbq.exe
  2⤵
  PID:5532
- C:\Windows\System\WpQnjca.exe
  C:\Windows\System\WpQnjca.exe
  2⤵
  PID:5776
- C:\Windows\System\ozJgHfJ.exe
  C:\Windows\System\ozJgHfJ.exe
  2⤵
  PID:6100
- C:\Windows\System\zUKlJex.exe
  C:\Windows\System\zUKlJex.exe
  2⤵
  PID:6216
- C:\Windows\System\aZcDthA.exe
  C:\Windows\System\aZcDthA.exe
  2⤵
  PID:704
- C:\Windows\System\XaYeXZL.exe
  C:\Windows\System\XaYeXZL.exe
  2⤵
  PID:5452
- C:\Windows\System\hyODPEj.exe
  C:\Windows\System\hyODPEj.exe
  2⤵
  PID:6296
- C:\Windows\System\iLRjdsq.exe
  C:\Windows\System\iLRjdsq.exe
  2⤵
  PID:6376
- C:\Windows\System\rMSQngN.exe
  C:\Windows\System\rMSQngN.exe
  2⤵
  PID:6520
- C:\Windows\System\vtllVuo.exe
  C:\Windows\System\vtllVuo.exe
  2⤵
  PID:6256
- C:\Windows\System\XlGfkoa.exe
  C:\Windows\System\XlGfkoa.exe
  2⤵
  PID:6416
- C:\Windows\System\WWuxMTw.exe
  C:\Windows\System\WWuxMTw.exe
  2⤵
  PID:6516
- C:\Windows\System\znyMWan.exe
  C:\Windows\System\znyMWan.exe
  2⤵
  PID:6712
- C:\Windows\System\gfeRyBy.exe
  C:\Windows\System\gfeRyBy.exe
  2⤵
  PID:6336
- C:\Windows\System\jALgpCb.exe
  C:\Windows\System\jALgpCb.exe
  2⤵
  PID:6800
- C:\Windows\System\OVwQbks.exe
  C:\Windows\System\OVwQbks.exe
  2⤵
  PID:6604
- C:\Windows\System\EYXTtSe.exe
  C:\Windows\System\EYXTtSe.exe
  2⤵
  PID:6628
- C:\Windows\System\WaoGBto.exe
  C:\Windows\System\WaoGBto.exe
  2⤵
  PID:6844
- C:\Windows\System\TqAJXnB.exe
  C:\Windows\System\TqAJXnB.exe
  2⤵
  PID:7100
- C:\Windows\System\GnHdROT.exe
  C:\Windows\System\GnHdROT.exe
  2⤵
  PID:6888
- C:\Windows\System\kfyBGse.exe
  C:\Windows\System\kfyBGse.exe
  2⤵
  PID:5884
- C:\Windows\System\WtHPjlv.exe
  C:\Windows\System\WtHPjlv.exe
  2⤵
  PID:7012
- C:\Windows\System\axTfxqr.exe
  C:\Windows\System\axTfxqr.exe
  2⤵
  PID:6824
- C:\Windows\System\JVsPgSr.exe
  C:\Windows\System\JVsPgSr.exe
  2⤵
  PID:7180
- C:\Windows\System\difEPZY.exe
  C:\Windows\System\difEPZY.exe
  2⤵
  PID:7208
- C:\Windows\System\uvXgYAC.exe
  C:\Windows\System\uvXgYAC.exe
  2⤵
  PID:7228
- C:\Windows\System\auForxD.exe
  C:\Windows\System\auForxD.exe
  2⤵
  PID:7248
- C:\Windows\System\haUhdmQ.exe
  C:\Windows\System\haUhdmQ.exe
  2⤵
  PID:7272
- C:\Windows\System\xrjRfZL.exe
  C:\Windows\System\xrjRfZL.exe
  2⤵
  PID:7292
- C:\Windows\System\QjJQDjU.exe
  C:\Windows\System\QjJQDjU.exe
  2⤵
  PID:7312
- C:\Windows\System\IaeCwsc.exe
  C:\Windows\System\IaeCwsc.exe
  2⤵
  PID:7336
- C:\Windows\System\QzjpApI.exe
  C:\Windows\System\QzjpApI.exe
  2⤵
  PID:7360
- C:\Windows\System\OLJdcXS.exe
  C:\Windows\System\OLJdcXS.exe
  2⤵
  PID:7388
- C:\Windows\System\InjZxKk.exe
  C:\Windows\System\InjZxKk.exe
  2⤵
  PID:7412
- C:\Windows\System\tdXDdfY.exe
  C:\Windows\System\tdXDdfY.exe
  2⤵
  PID:7432
- C:\Windows\System\ZfypWRa.exe
  C:\Windows\System\ZfypWRa.exe
  2⤵
  PID:7456
- C:\Windows\System\yvJYKHi.exe
  C:\Windows\System\yvJYKHi.exe
  2⤵
  PID:7476
- C:\Windows\System\RRVbNmG.exe
  C:\Windows\System\RRVbNmG.exe
  2⤵
  PID:7500
- C:\Windows\System\RdGhZux.exe
  C:\Windows\System\RdGhZux.exe
  2⤵
  PID:7520
- C:\Windows\System\RNCQQLt.exe
  C:\Windows\System\RNCQQLt.exe
  2⤵
  PID:7536
- C:\Windows\System\NsScDVM.exe
  C:\Windows\System\NsScDVM.exe
  2⤵
  PID:7564
- C:\Windows\System\fMomXPk.exe
  C:\Windows\System\fMomXPk.exe
  2⤵
  PID:7592
- C:\Windows\System\gxhwJbH.exe
  C:\Windows\System\gxhwJbH.exe
  2⤵
  PID:7616
- C:\Windows\System\pFoJyXw.exe
  C:\Windows\System\pFoJyXw.exe
  2⤵
  PID:7644
- C:\Windows\System\bDwpZWB.exe
  C:\Windows\System\bDwpZWB.exe
  2⤵
  PID:7664
- C:\Windows\System\THcJpgp.exe
  C:\Windows\System\THcJpgp.exe
  2⤵
  PID:7688
- C:\Windows\System\TulLICB.exe
  C:\Windows\System\TulLICB.exe
  2⤵
  PID:7712
- C:\Windows\System\NHTEYlU.exe
  C:\Windows\System\NHTEYlU.exe
  2⤵
  PID:7732
- C:\Windows\System\OKeMNiH.exe
  C:\Windows\System\OKeMNiH.exe
  2⤵
  PID:7752
- C:\Windows\System\oXkCeXS.exe
  C:\Windows\System\oXkCeXS.exe
  2⤵
  PID:7780
- C:\Windows\System\eHhsOcd.exe
  C:\Windows\System\eHhsOcd.exe
  2⤵
  PID:7800
- C:\Windows\System\VrgSqTn.exe
  C:\Windows\System\VrgSqTn.exe
  2⤵
  PID:7824
- C:\Windows\System\IdiQSRZ.exe
  C:\Windows\System\IdiQSRZ.exe
  2⤵
  PID:7848
- C:\Windows\System\ZJXSPqT.exe
  C:\Windows\System\ZJXSPqT.exe
  2⤵
  PID:7872
- C:\Windows\System\fFkcriq.exe
  C:\Windows\System\fFkcriq.exe
  2⤵
  PID:7892
- C:\Windows\System\omgVDCG.exe
  C:\Windows\System\omgVDCG.exe
  2⤵
  PID:7912
- C:\Windows\System\LbHtvZS.exe
  C:\Windows\System\LbHtvZS.exe
  2⤵
  PID:7940
- C:\Windows\System\kqCYKkH.exe
  C:\Windows\System\kqCYKkH.exe
  2⤵
  PID:7968
- C:\Windows\System\FjDeywE.exe
  C:\Windows\System\FjDeywE.exe
  2⤵
  PID:7992
- C:\Windows\System\NToHrSb.exe
  C:\Windows\System\NToHrSb.exe
  2⤵
  PID:8012
- C:\Windows\System\wtLflle.exe
  C:\Windows\System\wtLflle.exe
  2⤵
  PID:8036
- C:\Windows\System\vpIChXP.exe
  C:\Windows\System\vpIChXP.exe
  2⤵
  PID:8056
- C:\Windows\System\BcvgXyG.exe
  C:\Windows\System\BcvgXyG.exe
  2⤵
  PID:8088
- C:\Windows\System\dGMWnXK.exe
  C:\Windows\System\dGMWnXK.exe
  2⤵
  PID:8112
- C:\Windows\System\TSkzuuV.exe
  C:\Windows\System\TSkzuuV.exe
  2⤵
  PID:8136
- C:\Windows\System\HoXTjex.exe
  C:\Windows\System\HoXTjex.exe
  2⤵
  PID:8160
- C:\Windows\System\DeQliTR.exe
  C:\Windows\System\DeQliTR.exe
  2⤵
  PID:8180
- C:\Windows\System\BCVzfQl.exe
  C:\Windows\System\BCVzfQl.exe
  2⤵
  PID:7096
- C:\Windows\System\UsiOUio.exe
  C:\Windows\System\UsiOUio.exe
  2⤵
  PID:7144
- C:\Windows\System\QkONfwq.exe
  C:\Windows\System\QkONfwq.exe
  2⤵
  PID:7164
- C:\Windows\System\RuZCNhv.exe
  C:\Windows\System\RuZCNhv.exe
  2⤵
  PID:6984
- C:\Windows\System\LkxyyDM.exe
  C:\Windows\System\LkxyyDM.exe
  2⤵
  PID:7024
- C:\Windows\System\EBrtHrM.exe
  C:\Windows\System\EBrtHrM.exe
  2⤵
  PID:1660
- C:\Windows\System\amEsvwD.exe
  C:\Windows\System\amEsvwD.exe
  2⤵
  PID:6232
- C:\Windows\System\OBjpOYm.exe
  C:\Windows\System\OBjpOYm.exe
  2⤵
  PID:5664
- C:\Windows\System\VTtGGDF.exe
  C:\Windows\System\VTtGGDF.exe
  2⤵
  PID:6544
- C:\Windows\System\BOKHApS.exe
  C:\Windows\System\BOKHApS.exe
  2⤵
  PID:6772
- C:\Windows\System\rQOecBU.exe
  C:\Windows\System\rQOecBU.exe
  2⤵
  PID:7128
- C:\Windows\System\EqehEjk.exe
  C:\Windows\System\EqehEjk.exe
  2⤵
  PID:7516
- C:\Windows\System\mwAFbrM.exe
  C:\Windows\System\mwAFbrM.exe
  2⤵
  PID:6480
- C:\Windows\System\xXwqUSq.exe
  C:\Windows\System\xXwqUSq.exe
  2⤵
  PID:7348
- C:\Windows\System\hJdDSDK.exe
  C:\Windows\System\hJdDSDK.exe
  2⤵
  PID:6428
- C:\Windows\System\sZvAKrD.exe
  C:\Windows\System\sZvAKrD.exe
  2⤵
  PID:6664
- C:\Windows\System\ERkjVXY.exe
  C:\Windows\System\ERkjVXY.exe
  2⤵
  PID:7840
- C:\Windows\System\clQPhwO.exe
  C:\Windows\System\clQPhwO.exe
  2⤵
  PID:5688
- C:\Windows\System\McKlMiu.exe
  C:\Windows\System\McKlMiu.exe
  2⤵
  PID:6956
- C:\Windows\System\KfqZGxk.exe
  C:\Windows\System\KfqZGxk.exe
  2⤵
  PID:7964
- C:\Windows\System\kSUsTxU.exe
  C:\Windows\System\kSUsTxU.exe
  2⤵
  PID:7560
- C:\Windows\System\FuLphLN.exe
  C:\Windows\System\FuLphLN.exe
  2⤵
  PID:8204
- C:\Windows\System\hEAsfvq.exe
  C:\Windows\System\hEAsfvq.exe
  2⤵
  PID:8232
- C:\Windows\System\wLrsema.exe
  C:\Windows\System\wLrsema.exe
  2⤵
  PID:8248
- C:\Windows\System\TCBldYl.exe
  C:\Windows\System\TCBldYl.exe
  2⤵
  PID:8264
- C:\Windows\System\sLRfACw.exe
  C:\Windows\System\sLRfACw.exe
  2⤵
  PID:8288
- C:\Windows\System\ivTgfmS.exe
  C:\Windows\System\ivTgfmS.exe
  2⤵
  PID:8312
- C:\Windows\System\HWZELcT.exe
  C:\Windows\System\HWZELcT.exe
  2⤵
  PID:8344
- C:\Windows\System\ycQCFnK.exe
  C:\Windows\System\ycQCFnK.exe
  2⤵
  PID:8368
- C:\Windows\System\uRcDBCf.exe
  C:\Windows\System\uRcDBCf.exe
  2⤵
  PID:8384
- C:\Windows\System\dXLZiCc.exe
  C:\Windows\System\dXLZiCc.exe
  2⤵
  PID:8412
- C:\Windows\System\JPXtKWC.exe
  C:\Windows\System\JPXtKWC.exe
  2⤵
  PID:8432
- C:\Windows\System\FhzCzYV.exe
  C:\Windows\System\FhzCzYV.exe
  2⤵
  PID:8460
- C:\Windows\System\eRdpvYO.exe
  C:\Windows\System\eRdpvYO.exe
  2⤵
  PID:8480
- C:\Windows\System\EvboBDJ.exe
  C:\Windows\System\EvboBDJ.exe
  2⤵
  PID:8500
- C:\Windows\System\cvylLNm.exe
  C:\Windows\System\cvylLNm.exe
  2⤵
  PID:8528
- C:\Windows\System\oAevGFY.exe
  C:\Windows\System\oAevGFY.exe
  2⤵
  PID:8544
- C:\Windows\System\cNPEmtP.exe
  C:\Windows\System\cNPEmtP.exe
  2⤵
  PID:8564
- C:\Windows\System\cgISrle.exe
  C:\Windows\System\cgISrle.exe
  2⤵
  PID:8588
- C:\Windows\System\tWtgjBi.exe
  C:\Windows\System\tWtgjBi.exe
  2⤵
  PID:8608
- C:\Windows\System\ktcHeSU.exe
  C:\Windows\System\ktcHeSU.exe
  2⤵
  PID:8628
- C:\Windows\System\BrXATbm.exe
  C:\Windows\System\BrXATbm.exe
  2⤵
  PID:8648
- C:\Windows\System\yXlmtQq.exe
  C:\Windows\System\yXlmtQq.exe
  2⤵
  PID:8672
- C:\Windows\System\qPemiDs.exe
  C:\Windows\System\qPemiDs.exe
  2⤵
  PID:8696
- C:\Windows\System\iBWLXQj.exe
  C:\Windows\System\iBWLXQj.exe
  2⤵
  PID:8716
- C:\Windows\System\AEYEalK.exe
  C:\Windows\System\AEYEalK.exe
  2⤵
  PID:8740
- C:\Windows\System\nfQawMK.exe
  C:\Windows\System\nfQawMK.exe
  2⤵
  PID:8760
- C:\Windows\System\DEcvHUd.exe
  C:\Windows\System\DEcvHUd.exe
  2⤵
  PID:8788
- C:\Windows\System\uUVMiOI.exe
  C:\Windows\System\uUVMiOI.exe
  2⤵
  PID:8812
- C:\Windows\System\RKWlXaE.exe
  C:\Windows\System\RKWlXaE.exe
  2⤵
  PID:8832
- C:\Windows\System\uxmuTMV.exe
  C:\Windows\System\uxmuTMV.exe
  2⤵
  PID:8852
- C:\Windows\System\PMLCBvR.exe
  C:\Windows\System\PMLCBvR.exe
  2⤵
  PID:8880
- C:\Windows\System\fBRSGoZ.exe
  C:\Windows\System\fBRSGoZ.exe
  2⤵
  PID:8900
- C:\Windows\System\DTyRNQz.exe
  C:\Windows\System\DTyRNQz.exe
  2⤵
  PID:8924
- C:\Windows\System\srBCEYu.exe
  C:\Windows\System\srBCEYu.exe
  2⤵
  PID:8952
- C:\Windows\System\pSIqULb.exe
  C:\Windows\System\pSIqULb.exe
  2⤵
  PID:8976
- C:\Windows\System\DFqQdQq.exe
  C:\Windows\System\DFqQdQq.exe
  2⤵
  PID:8996
- C:\Windows\System\rSRtnIk.exe
  C:\Windows\System\rSRtnIk.exe
  2⤵
  PID:9028
- C:\Windows\System\BTXfvZb.exe
  C:\Windows\System\BTXfvZb.exe
  2⤵
  PID:9056
- C:\Windows\System\tnEIZCo.exe
  C:\Windows\System\tnEIZCo.exe
  2⤵
  PID:9080
- C:\Windows\System\UnONqFM.exe
  C:\Windows\System\UnONqFM.exe
  2⤵
  PID:9100
- C:\Windows\System\cCcyIbD.exe
  C:\Windows\System\cCcyIbD.exe
  2⤵
  PID:9124
- C:\Windows\System\QlrXFpd.exe
  C:\Windows\System\QlrXFpd.exe
  2⤵
  PID:9152
- C:\Windows\System\sKdxsNJ.exe
  C:\Windows\System\sKdxsNJ.exe
  2⤵
  PID:9172
- C:\Windows\System\HhOnzog.exe
  C:\Windows\System\HhOnzog.exe
  2⤵
  PID:9200
- C:\Windows\System\iuBUcDL.exe
  C:\Windows\System\iuBUcDL.exe
  2⤵
  PID:8084
- C:\Windows\System\FDTdqWm.exe
  C:\Windows\System\FDTdqWm.exe
  2⤵
  PID:7640
- C:\Windows\System\jQFFjXZ.exe
  C:\Windows\System\jQFFjXZ.exe
  2⤵
  PID:7700
- C:\Windows\System\iFAmocM.exe
  C:\Windows\System\iFAmocM.exe
  2⤵
  PID:7728
- C:\Windows\System\lKiYJQE.exe
  C:\Windows\System\lKiYJQE.exe
  2⤵
  PID:7004
- C:\Windows\System\VBWtdno.exe
  C:\Windows\System\VBWtdno.exe
  2⤵
  PID:6636
- C:\Windows\System\ejqdvWV.exe
  C:\Windows\System\ejqdvWV.exe
  2⤵
  PID:7240
- C:\Windows\System\xCaoshP.exe
  C:\Windows\System\xCaoshP.exe
  2⤵
  PID:7952
- C:\Windows\System\jPFuvcM.exe
  C:\Windows\System\jPFuvcM.exe
  2⤵
  PID:6884
- C:\Windows\System\UmdZVIn.exe
  C:\Windows\System\UmdZVIn.exe
  2⤵
  PID:7196
- C:\Windows\System\letOHRq.exe
  C:\Windows\System\letOHRq.exe
  2⤵
  PID:7628
- C:\Windows\System\ZxVWoyq.exe
  C:\Windows\System\ZxVWoyq.exe
  2⤵
  PID:7604
- C:\Windows\System\vUDqzMH.exe
  C:\Windows\System\vUDqzMH.exe
  2⤵
  PID:7704
- C:\Windows\System\leFsxGq.exe
  C:\Windows\System\leFsxGq.exe
  2⤵
  PID:8188
- C:\Windows\System\RFDBQTh.exe
  C:\Windows\System\RFDBQTh.exe
  2⤵
  PID:6912
- C:\Windows\System\PCHYZXo.exe
  C:\Windows\System\PCHYZXo.exe
  2⤵
  PID:8356
- C:\Windows\System\vJXKhhr.exe
  C:\Windows\System\vJXKhhr.exe
  2⤵
  PID:7176
- C:\Windows\System\wkzYYxA.exe
  C:\Windows\System\wkzYYxA.exe
  2⤵
  PID:8540
- C:\Windows\System\JPsXAVU.exe
  C:\Windows\System\JPsXAVU.exe
  2⤵
  PID:5548
- C:\Windows\System\nahYyuM.exe
  C:\Windows\System\nahYyuM.exe
  2⤵
  PID:6328
- C:\Windows\System\nLJRzgK.exe
  C:\Windows\System\nLJRzgK.exe
  2⤵
  PID:6864
- C:\Windows\System\MgAIAfc.exe
  C:\Windows\System\MgAIAfc.exe
  2⤵
  PID:7488
- C:\Windows\System\qOLGMPM.exe
  C:\Windows\System\qOLGMPM.exe
  2⤵
  PID:7908
- C:\Windows\System\yKAXFlO.exe
  C:\Windows\System\yKAXFlO.exe
  2⤵
  PID:8068
- C:\Windows\System\CaQhfHD.exe
  C:\Windows\System\CaQhfHD.exe
  2⤵
  PID:8256
- C:\Windows\System\pjTONsN.exe
  C:\Windows\System\pjTONsN.exe
  2⤵
  PID:8364
- C:\Windows\System\KFsJftI.exe
  C:\Windows\System\KFsJftI.exe
  2⤵
  PID:8428
- C:\Windows\System\HYMrmlL.exe
  C:\Windows\System\HYMrmlL.exe
  2⤵
  PID:9228
- C:\Windows\System\DrETBPr.exe
  C:\Windows\System\DrETBPr.exe
  2⤵
  PID:9252
- C:\Windows\System\giXBIbi.exe
  C:\Windows\System\giXBIbi.exe
  2⤵
  PID:9276
- C:\Windows\System\TwNZuUo.exe
  C:\Windows\System\TwNZuUo.exe
  2⤵
  PID:9300
- C:\Windows\System\qoXhvqB.exe
  C:\Windows\System\qoXhvqB.exe
  2⤵
  PID:9316
- C:\Windows\System\oiVpCOw.exe
  C:\Windows\System\oiVpCOw.exe
  2⤵
  PID:9344
- C:\Windows\System\nWqMPew.exe
  C:\Windows\System\nWqMPew.exe
  2⤵
  PID:9360
- C:\Windows\System\GDJzWpZ.exe
  C:\Windows\System\GDJzWpZ.exe
  2⤵
  PID:9376
- C:\Windows\System\nuxWcnh.exe
  C:\Windows\System\nuxWcnh.exe
  2⤵
  PID:9392
- C:\Windows\System\cTKVIXv.exe
  C:\Windows\System\cTKVIXv.exe
  2⤵
  PID:9416
- C:\Windows\System\MSdikoO.exe
  C:\Windows\System\MSdikoO.exe
  2⤵
  PID:9444
- C:\Windows\System\sMvnbwa.exe
  C:\Windows\System\sMvnbwa.exe
  2⤵
  PID:9460
- C:\Windows\System\RKjKxkb.exe
  C:\Windows\System\RKjKxkb.exe
  2⤵
  PID:9476
- C:\Windows\System\qybnvhs.exe
  C:\Windows\System\qybnvhs.exe
  2⤵
  PID:9508
- C:\Windows\System\XTZhDDz.exe
  C:\Windows\System\XTZhDDz.exe
  2⤵
  PID:9524
- C:\Windows\System\oPztMxi.exe
  C:\Windows\System\oPztMxi.exe
  2⤵
  PID:9548
- C:\Windows\System\vdIKaYU.exe
  C:\Windows\System\vdIKaYU.exe
  2⤵
  PID:9576
- C:\Windows\System\qqoRuLd.exe
  C:\Windows\System\qqoRuLd.exe
  2⤵
  PID:9592
- C:\Windows\System\CuhHEJb.exe
  C:\Windows\System\CuhHEJb.exe
  2⤵
  PID:9608
- C:\Windows\System\qCuhnXl.exe
  C:\Windows\System\qCuhnXl.exe
  2⤵
  PID:9632
- C:\Windows\System\nibDRnU.exe
  C:\Windows\System\nibDRnU.exe
  2⤵
  PID:9656
- C:\Windows\System\uWmBuSw.exe
  C:\Windows\System\uWmBuSw.exe
  2⤵
  PID:9676
- C:\Windows\System\EhegqVn.exe
  C:\Windows\System\EhegqVn.exe
  2⤵
  PID:9700
- C:\Windows\System\phNknyC.exe
  C:\Windows\System\phNknyC.exe
  2⤵
  PID:9720
- C:\Windows\System\oCtGKeV.exe
  C:\Windows\System\oCtGKeV.exe
  2⤵
  PID:9740
- C:\Windows\System\jYzAijI.exe
  C:\Windows\System\jYzAijI.exe
  2⤵
  PID:9760
- C:\Windows\System\YybUQUL.exe
  C:\Windows\System\YybUQUL.exe
  2⤵
  PID:9784
- C:\Windows\System\OBjyxRa.exe
  C:\Windows\System\OBjyxRa.exe
  2⤵
  PID:9808
- C:\Windows\System\fseDNoi.exe
  C:\Windows\System\fseDNoi.exe
  2⤵
  PID:9832
- C:\Windows\System\lvUPCso.exe
  C:\Windows\System\lvUPCso.exe
  2⤵
  PID:9852
- C:\Windows\System\mVpCfbw.exe
  C:\Windows\System\mVpCfbw.exe
  2⤵
  PID:9884
- C:\Windows\System\tWFzrYk.exe
  C:\Windows\System\tWFzrYk.exe
  2⤵
  PID:9908
- C:\Windows\System\GadMxwb.exe
  C:\Windows\System\GadMxwb.exe
  2⤵
  PID:9932
- C:\Windows\System\BSOaeUC.exe
  C:\Windows\System\BSOaeUC.exe
  2⤵
  PID:9948
- C:\Windows\System\zGaWbkM.exe
  C:\Windows\System\zGaWbkM.exe
  2⤵
  PID:9972
- C:\Windows\System\KykZyzN.exe
  C:\Windows\System\KykZyzN.exe
  2⤵
  PID:9996
- C:\Windows\System\zEhBDvs.exe
  C:\Windows\System\zEhBDvs.exe
  2⤵
  PID:10020
- C:\Windows\System\WGXqFRJ.exe
  C:\Windows\System\WGXqFRJ.exe
  2⤵
  PID:10036
- C:\Windows\System\vuagYet.exe
  C:\Windows\System\vuagYet.exe
  2⤵
  PID:10052
- C:\Windows\System\oSsszJy.exe
  C:\Windows\System\oSsszJy.exe
  2⤵
  PID:10080
- C:\Windows\System\FAMRjgG.exe
  C:\Windows\System\FAMRjgG.exe
  2⤵
  PID:10108
- C:\Windows\System\QIAQbcI.exe
  C:\Windows\System\QIAQbcI.exe
  2⤵
  PID:10128
- C:\Windows\System\ajZDxaQ.exe
  C:\Windows\System\ajZDxaQ.exe
  2⤵
  PID:10152
- C:\Windows\System\fNAmrfZ.exe
  C:\Windows\System\fNAmrfZ.exe
  2⤵
  PID:10176
- C:\Windows\System\GNWQUKo.exe
  C:\Windows\System\GNWQUKo.exe
  2⤵
  PID:10192
- C:\Windows\System\XfdkYwD.exe
  C:\Windows\System\XfdkYwD.exe
  2⤵
  PID:10224
- C:\Windows\System\RZWhGma.exe
  C:\Windows\System\RZWhGma.exe
  2⤵
  PID:8496
- C:\Windows\System\ghkXhjb.exe
  C:\Windows\System\ghkXhjb.exe
  2⤵
  PID:8556
- C:\Windows\System\kNJnueW.exe
  C:\Windows\System\kNJnueW.exe
  2⤵
  PID:7816
- C:\Windows\System\aYwUAtD.exe
  C:\Windows\System\aYwUAtD.exe
  2⤵
  PID:8736
- C:\Windows\System\fyCQhJc.exe
  C:\Windows\System\fyCQhJc.exe
  2⤵
  PID:8780
- C:\Windows\System\tBFLigr.exe
  C:\Windows\System\tBFLigr.exe
  2⤵
  PID:8784
- C:\Windows\System\bltuvKd.exe
  C:\Windows\System\bltuvKd.exe
  2⤵
  PID:8808
- C:\Windows\System\egZwfaD.exe
  C:\Windows\System\egZwfaD.exe
  2⤵
  PID:8156
- C:\Windows\System\QUusenP.exe
  C:\Windows\System\QUusenP.exe
  2⤵
  PID:8172
- C:\Windows\System\zuTBHSu.exe
  C:\Windows\System\zuTBHSu.exe
  2⤵
  PID:8284
- C:\Windows\System\opOUufJ.exe
  C:\Windows\System\opOUufJ.exe
  2⤵
  PID:8960
- C:\Windows\System\eMmKzUH.exe
  C:\Windows\System\eMmKzUH.exe
  2⤵
  PID:8048
- C:\Windows\System\hmNrzLn.exe
  C:\Windows\System\hmNrzLn.exe
  2⤵
  PID:9040
- C:\Windows\System\pBlKoVD.exe
  C:\Windows\System\pBlKoVD.exe
  2⤵
  PID:9220
- C:\Windows\System\zjVmPxo.exe
  C:\Windows\System\zjVmPxo.exe
  2⤵
  PID:9088
- C:\Windows\System\zYfOzBB.exe
  C:\Windows\System\zYfOzBB.exe
  2⤵
  PID:9288
- C:\Windows\System\qDtqXRI.exe
  C:\Windows\System\qDtqXRI.exe
  2⤵
  PID:9140
- C:\Windows\System\rCPRJOM.exe
  C:\Windows\System\rCPRJOM.exe
  2⤵
  PID:8584
- C:\Windows\System\TTNskpV.exe
  C:\Windows\System\TTNskpV.exe
  2⤵
  PID:7264
- C:\Windows\System\iqDUgOM.exe
  C:\Windows\System\iqDUgOM.exe
  2⤵
  PID:9468
- C:\Windows\System\nQmAfIN.exe
  C:\Windows\System\nQmAfIN.exe
  2⤵
  PID:7304
- C:\Windows\System\dfVGZBm.exe
  C:\Windows\System\dfVGZBm.exe
  2⤵
  PID:9664
- C:\Windows\System\xIJSPuN.exe
  C:\Windows\System\xIJSPuN.exe
  2⤵
  PID:5976
- C:\Windows\System\OyyFZxQ.exe
  C:\Windows\System\OyyFZxQ.exe
  2⤵
  PID:7936
- C:\Windows\System\gKwZVrg.exe
  C:\Windows\System\gKwZVrg.exe
  2⤵
  PID:10260
- C:\Windows\System\bBNCOun.exe
  C:\Windows\System\bBNCOun.exe
  2⤵
  PID:10284
- C:\Windows\System\CWxtwfI.exe
  C:\Windows\System\CWxtwfI.exe
  2⤵
  PID:10312
- C:\Windows\System\xNCRudv.exe
  C:\Windows\System\xNCRudv.exe
  2⤵
  PID:10340
- C:\Windows\System\XEmVTTd.exe
  C:\Windows\System\XEmVTTd.exe
  2⤵
  PID:10356
- C:\Windows\System\XSgevHK.exe
  C:\Windows\System\XSgevHK.exe
  2⤵
  PID:10380
- C:\Windows\System\XLvfjEi.exe
  C:\Windows\System\XLvfjEi.exe
  2⤵
  PID:10400
- C:\Windows\System\CzzNNvJ.exe
  C:\Windows\System\CzzNNvJ.exe
  2⤵
  PID:10428
- C:\Windows\System\RwrOFwA.exe
  C:\Windows\System\RwrOFwA.exe
  2⤵
  PID:10452
- C:\Windows\System\hZQMcHW.exe
  C:\Windows\System\hZQMcHW.exe
  2⤵
  PID:10472
- C:\Windows\System\nAHtrFI.exe
  C:\Windows\System\nAHtrFI.exe
  2⤵
  PID:10492
- C:\Windows\System\RNawxjH.exe
  C:\Windows\System\RNawxjH.exe
  2⤵
  PID:10524
- C:\Windows\System\EPyTMGS.exe
  C:\Windows\System\EPyTMGS.exe
  2⤵
  PID:10540
- C:\Windows\System\JllIFcp.exe
  C:\Windows\System\JllIFcp.exe
  2⤵
  PID:10560
- C:\Windows\System\OxowvTR.exe
  C:\Windows\System\OxowvTR.exe
  2⤵
  PID:10588
- C:\Windows\System\GsjteEz.exe
  C:\Windows\System\GsjteEz.exe
  2⤵
  PID:10612
- C:\Windows\System\gSgUwAi.exe
  C:\Windows\System\gSgUwAi.exe
  2⤵
  PID:10632
- C:\Windows\System\vNcZnxx.exe
  C:\Windows\System\vNcZnxx.exe
  2⤵
  PID:10648
- C:\Windows\System\ZyumLOE.exe
  C:\Windows\System\ZyumLOE.exe
  2⤵
  PID:10672
- C:\Windows\System\kByDuHh.exe
  C:\Windows\System\kByDuHh.exe
  2⤵
  PID:10692
- C:\Windows\System\LIHZxMq.exe
  C:\Windows\System\LIHZxMq.exe
  2⤵
  PID:10712
- C:\Windows\System\YowZmtN.exe
  C:\Windows\System\YowZmtN.exe
  2⤵
  PID:10736
- C:\Windows\System\oYwHxPZ.exe
  C:\Windows\System\oYwHxPZ.exe
  2⤵
  PID:10756
- C:\Windows\System\SuTsmsW.exe
  C:\Windows\System\SuTsmsW.exe
  2⤵
  PID:10776
- C:\Windows\System\zhIqraN.exe
  C:\Windows\System\zhIqraN.exe
  2⤵
  PID:10800
- C:\Windows\System\AbWhHVP.exe
  C:\Windows\System\AbWhHVP.exe
  2⤵
  PID:10828
- C:\Windows\System\wssPiMF.exe
  C:\Windows\System\wssPiMF.exe
  2⤵
  PID:10856
- C:\Windows\System\QXFRnqJ.exe
  C:\Windows\System\QXFRnqJ.exe
  2⤵
  PID:10876
- C:\Windows\System\GYuNbAF.exe
  C:\Windows\System\GYuNbAF.exe
  2⤵
  PID:10904
- C:\Windows\System\hXtvimh.exe
  C:\Windows\System\hXtvimh.exe
  2⤵
  PID:10924
- C:\Windows\System\YomoiJT.exe
  C:\Windows\System\YomoiJT.exe
  2⤵
  PID:10940
- C:\Windows\System\FtWwzEI.exe
  C:\Windows\System\FtWwzEI.exe
  2⤵
  PID:10956
- C:\Windows\System\ryaThJp.exe
  C:\Windows\System\ryaThJp.exe
  2⤵
  PID:10976
- C:\Windows\System\xtYOwMk.exe
  C:\Windows\System\xtYOwMk.exe
  2⤵
  PID:10996
- C:\Windows\System\yZIEXOa.exe
  C:\Windows\System\yZIEXOa.exe
  2⤵
  PID:11012
- C:\Windows\System\TWEDwqE.exe
  C:\Windows\System\TWEDwqE.exe
  2⤵
  PID:11036
- C:\Windows\System\jkYMGtV.exe
  C:\Windows\System\jkYMGtV.exe
  2⤵
  PID:11052
- C:\Windows\System\lPXlGzF.exe
  C:\Windows\System\lPXlGzF.exe
  2⤵
  PID:11072
- C:\Windows\System\wwzikme.exe
  C:\Windows\System\wwzikme.exe
  2⤵
  PID:11092
- C:\Windows\System\HaxyRRd.exe
  C:\Windows\System\HaxyRRd.exe
  2⤵
  PID:11112
- C:\Windows\System\fgZKhrM.exe
  C:\Windows\System\fgZKhrM.exe
  2⤵
  PID:11136
- C:\Windows\System\LWfIreS.exe
  C:\Windows\System\LWfIreS.exe
  2⤵
  PID:11168
- C:\Windows\System\JguYtLE.exe
  C:\Windows\System\JguYtLE.exe
  2⤵
  PID:11192
- C:\Windows\System\WqrMlxY.exe
  C:\Windows\System\WqrMlxY.exe
  2⤵
  PID:11208
- C:\Windows\System\chrEJxZ.exe
  C:\Windows\System\chrEJxZ.exe
  2⤵
  PID:11232
- C:\Windows\System\JGufatx.exe
  C:\Windows\System\JGufatx.exe
  2⤵
  PID:11256
- C:\Windows\System\IIYFtTd.exe
  C:\Windows\System\IIYFtTd.exe
  2⤵
  PID:9820
- C:\Windows\System\fCgBFQJ.exe
  C:\Windows\System\fCgBFQJ.exe
  2⤵
  PID:8848
- C:\Windows\System\qlgWUQV.exe
  C:\Windows\System\qlgWUQV.exe
  2⤵
  PID:9904
- C:\Windows\System\MUyiPfS.exe
  C:\Windows\System\MUyiPfS.exe
  2⤵
  PID:6488
- C:\Windows\System\gqXYIAd.exe
  C:\Windows\System\gqXYIAd.exe
  2⤵
  PID:8972
- C:\Windows\System\aRYIDmg.exe
  C:\Windows\System\aRYIDmg.exe
  2⤵
  PID:8712
- C:\Windows\System\FDnySIt.exe
  C:\Windows\System\FDnySIt.exe
  2⤵
  PID:9036
- C:\Windows\System\GFRrcnq.exe
  C:\Windows\System\GFRrcnq.exe
  2⤵
  PID:7676
- C:\Windows\System\MxcvATR.exe
  C:\Windows\System\MxcvATR.exe
  2⤵
  PID:8200
- C:\Windows\System\wwZTAYg.exe
  C:\Windows\System\wwZTAYg.exe
  2⤵
  PID:9388
- C:\Windows\System\YJCXVob.exe
  C:\Windows\System\YJCXVob.exe
  2⤵
  PID:9164
- C:\Windows\System\jOeqbUB.exe
  C:\Windows\System\jOeqbUB.exe
  2⤵
  PID:8308
- C:\Windows\System\qcdsgtm.exe
  C:\Windows\System\qcdsgtm.exe
  2⤵
  PID:9500
- C:\Windows\System\JaIXfkZ.exe
  C:\Windows\System\JaIXfkZ.exe
  2⤵
  PID:9628
- C:\Windows\System\asCTvDz.exe
  C:\Windows\System\asCTvDz.exe
  2⤵
  PID:9520
- C:\Windows\System\cqrZjot.exe
  C:\Windows\System\cqrZjot.exe
  2⤵
  PID:7548
- C:\Windows\System\ccFLBJU.exe
  C:\Windows\System\ccFLBJU.exe
  2⤵
  PID:10280
- C:\Windows\System\jcHIqkr.exe
  C:\Windows\System\jcHIqkr.exe
  2⤵
  PID:10324
- C:\Windows\System\nGEbCrE.exe
  C:\Windows\System\nGEbCrE.exe
  2⤵
  PID:11284
- C:\Windows\System\DahsIDS.exe
  C:\Windows\System\DahsIDS.exe
  2⤵
  PID:11300
- C:\Windows\System\fZhAhaZ.exe
  C:\Windows\System\fZhAhaZ.exe
  2⤵
  PID:11324
- C:\Windows\System\rEJqesT.exe
  C:\Windows\System\rEJqesT.exe
  2⤵
  PID:11340
- C:\Windows\System\NXkcmHZ.exe
  C:\Windows\System\NXkcmHZ.exe
  2⤵
  PID:11372
- C:\Windows\System\klKoWoK.exe
  C:\Windows\System\klKoWoK.exe
  2⤵
  PID:11392
- C:\Windows\System\qZuVUTC.exe
  C:\Windows\System\qZuVUTC.exe
  2⤵
  PID:11408
- C:\Windows\System\qbvLHGI.exe
  C:\Windows\System\qbvLHGI.exe
  2⤵
  PID:11424
- C:\Windows\System\wNzVasY.exe
  C:\Windows\System\wNzVasY.exe
  2⤵
  PID:11444
- C:\Windows\System\uexKNPw.exe
  C:\Windows\System\uexKNPw.exe
  2⤵
  PID:11472
- C:\Windows\System\qquHVOZ.exe
  C:\Windows\System\qquHVOZ.exe
  2⤵
  PID:11500
- C:\Windows\System\KJHswOa.exe
  C:\Windows\System\KJHswOa.exe
  2⤵
  PID:11520
- C:\Windows\System\knDbtRM.exe
  C:\Windows\System\knDbtRM.exe
  2⤵
  PID:11548
- C:\Windows\System\uMHArIh.exe
  C:\Windows\System\uMHArIh.exe
  2⤵
  PID:11576
- C:\Windows\System\OYeeQGC.exe
  C:\Windows\System\OYeeQGC.exe
  2⤵
  PID:11592
- C:\Windows\System\ZtglnaY.exe
  C:\Windows\System\ZtglnaY.exe
  2⤵
  PID:11616
- C:\Windows\System\IXNVeCp.exe
  C:\Windows\System\IXNVeCp.exe
  2⤵
  PID:11640
- C:\Windows\System\EsXSjcq.exe
  C:\Windows\System\EsXSjcq.exe
  2⤵
  PID:11660
- C:\Windows\System\FAnRxGx.exe
  C:\Windows\System\FAnRxGx.exe
  2⤵
  PID:11680
- C:\Windows\System\TXvtGjq.exe
  C:\Windows\System\TXvtGjq.exe
  2⤵
  PID:11712
- C:\Windows\System\lUCCqRD.exe
  C:\Windows\System\lUCCqRD.exe
  2⤵
  PID:11732
- C:\Windows\System\XwXBVgc.exe
  C:\Windows\System\XwXBVgc.exe
  2⤵
  PID:11752
- C:\Windows\System\aIoBMxR.exe
  C:\Windows\System\aIoBMxR.exe
  2⤵
  PID:11788
- C:\Windows\System\WvGcEhG.exe
  C:\Windows\System\WvGcEhG.exe
  2⤵
  PID:11808
- C:\Windows\System\hgSYpVS.exe
  C:\Windows\System\hgSYpVS.exe
  2⤵
  PID:11840
- C:\Windows\System\qWHnkXD.exe
  C:\Windows\System\qWHnkXD.exe
  2⤵
  PID:11856
- C:\Windows\System\sxilEcV.exe
  C:\Windows\System\sxilEcV.exe
  2⤵
  PID:11876
- C:\Windows\System\IpThncU.exe
  C:\Windows\System\IpThncU.exe
  2⤵
  PID:11908
- C:\Windows\System\XueIbQk.exe
  C:\Windows\System\XueIbQk.exe
  2⤵
  PID:11928
- C:\Windows\System\JoofGVh.exe
  C:\Windows\System\JoofGVh.exe
  2⤵
  PID:11948
- C:\Windows\System\aIZtMRH.exe
  C:\Windows\System\aIZtMRH.exe
  2⤵
  PID:11968
- C:\Windows\System\UPweiTV.exe
  C:\Windows\System\UPweiTV.exe
  2⤵
  PID:11988
- C:\Windows\System\vSZlyPx.exe
  C:\Windows\System\vSZlyPx.exe
  2⤵
  PID:12004
- C:\Windows\System\scgsyAB.exe
  C:\Windows\System\scgsyAB.exe
  2⤵
  PID:12024
- C:\Windows\System\ztMKdcY.exe
  C:\Windows\System\ztMKdcY.exe
  2⤵
  PID:12052
- C:\Windows\System\QuuKUDF.exe
  C:\Windows\System\QuuKUDF.exe
  2⤵
  PID:12072
- C:\Windows\System\rfoloGJ.exe
  C:\Windows\System\rfoloGJ.exe
  2⤵
  PID:12096
- C:\Windows\System\hHFBhaZ.exe
  C:\Windows\System\hHFBhaZ.exe
  2⤵
  PID:12120
- C:\Windows\System\UhXBbQf.exe
  C:\Windows\System\UhXBbQf.exe
  2⤵
  PID:12140
- C:\Windows\System\GbhsAqN.exe
  C:\Windows\System\GbhsAqN.exe
  2⤵
  PID:12160
- C:\Windows\System\HkyeDiX.exe
  C:\Windows\System\HkyeDiX.exe
  2⤵
  PID:12188
- C:\Windows\System\JyGIGNr.exe
  C:\Windows\System\JyGIGNr.exe
  2⤵
  PID:12204
- C:\Windows\System\tpbcGAN.exe
  C:\Windows\System\tpbcGAN.exe
  2⤵
  PID:12224
- C:\Windows\System\vEtFZvl.exe
  C:\Windows\System\vEtFZvl.exe
  2⤵
  PID:12244
- C:\Windows\System\dmonXiD.exe
  C:\Windows\System\dmonXiD.exe
  2⤵
  PID:12272
- C:\Windows\System\SPxsZEs.exe
  C:\Windows\System\SPxsZEs.exe
  2⤵
  PID:9844
- C:\Windows\System\Kzyqyna.exe
  C:\Windows\System\Kzyqyna.exe
  2⤵
  PID:10416
- C:\Windows\System\XiirRjx.exe
  C:\Windows\System\XiirRjx.exe
  2⤵
  PID:10464
- C:\Windows\System\xTbWFjc.exe
  C:\Windows\System\xTbWFjc.exe
  2⤵
  PID:9984
- C:\Windows\System\FYcfQsU.exe
  C:\Windows\System\FYcfQsU.exe
  2⤵
  PID:9992
- C:\Windows\System\cKInjOr.exe
  C:\Windows\System\cKInjOr.exe
  2⤵
  PID:10628
- C:\Windows\System\PEYkmrZ.exe
  C:\Windows\System\PEYkmrZ.exe
  2⤵
  PID:8656
- C:\Windows\System\pXEZWZN.exe
  C:\Windows\System\pXEZWZN.exe
  2⤵
  PID:10148
- C:\Windows\System\IJHKYrd.exe
  C:\Windows\System\IJHKYrd.exe
  2⤵
  PID:7072
- C:\Windows\System\vcdmJIT.exe
  C:\Windows\System\vcdmJIT.exe
  2⤵
  PID:8424
- C:\Windows\System\HPckOoV.exe
  C:\Windows\System\HPckOoV.exe
  2⤵
  PID:8520
- C:\Windows\System\rbUJtGm.exe
  C:\Windows\System\rbUJtGm.exe
  2⤵
  PID:8776
- C:\Windows\System\vJFmTjJ.exe
  C:\Windows\System\vJFmTjJ.exe
  2⤵
  PID:9308
- C:\Windows\System\gseEslt.exe
  C:\Windows\System\gseEslt.exe
  2⤵
  PID:10968
- C:\Windows\System\BeHkcVu.exe
  C:\Windows\System\BeHkcVu.exe
  2⤵
  PID:11060
- C:\Windows\System\vzGREhf.exe
  C:\Windows\System\vzGREhf.exe
  2⤵
  PID:11088
- C:\Windows\System\VCjagtH.exe
  C:\Windows\System\VCjagtH.exe
  2⤵
  PID:9496
- C:\Windows\System\JxsTjSg.exe
  C:\Windows\System\JxsTjSg.exe
  2⤵
  PID:9560
- C:\Windows\System\cpHUoLz.exe
  C:\Windows\System\cpHUoLz.exe
  2⤵
  PID:11252
- C:\Windows\System\ufWoKub.exe
  C:\Windows\System\ufWoKub.exe
  2⤵
  PID:8328
- C:\Windows\System\yKVROVY.exe
  C:\Windows\System\yKVROVY.exe
  2⤵
  PID:9072
- C:\Windows\System\HedSnfI.exe
  C:\Windows\System\HedSnfI.exe
  2⤵
  PID:9624
- C:\Windows\System\mrGsSjs.exe
  C:\Windows\System\mrGsSjs.exe
  2⤵
  PID:9692
- C:\Windows\System\zutHPYA.exe
  C:\Windows\System\zutHPYA.exe
  2⤵
  PID:9196
- C:\Windows\System\WBPnkMq.exe
  C:\Windows\System\WBPnkMq.exe
  2⤵
  PID:9736
- C:\Windows\System\qAHmYdm.exe
  C:\Windows\System\qAHmYdm.exe
  2⤵
  PID:12296
- C:\Windows\System\wurgWBN.exe
  C:\Windows\System\wurgWBN.exe
  2⤵
  PID:12312
- C:\Windows\System\oPpJyap.exe
  C:\Windows\System\oPpJyap.exe
  2⤵
  PID:12332
- C:\Windows\System\ZBmEfio.exe
  C:\Windows\System\ZBmEfio.exe
  2⤵
  PID:12360
- C:\Windows\System\ondlQXw.exe
  C:\Windows\System\ondlQXw.exe
  2⤵
  PID:12384
- C:\Windows\System\cJJyBgN.exe
  C:\Windows\System\cJJyBgN.exe
  2⤵
  PID:12404
- C:\Windows\System\Mtwqwsz.exe
  C:\Windows\System\Mtwqwsz.exe
  2⤵
  PID:12424
- C:\Windows\System\cIzScyx.exe
  C:\Windows\System\cIzScyx.exe
  2⤵
  PID:12444
- C:\Windows\System\fMbyNLP.exe
  C:\Windows\System\fMbyNLP.exe
  2⤵
  PID:12460
- C:\Windows\System\jdIMudH.exe
  C:\Windows\System\jdIMudH.exe
  2⤵
  PID:12480
- C:\Windows\System\yxDXfzv.exe
  C:\Windows\System\yxDXfzv.exe
  2⤵
  PID:12504
- C:\Windows\System\AuOHBoF.exe
  C:\Windows\System\AuOHBoF.exe
  2⤵
  PID:12524
- C:\Windows\System\ctsZNmo.exe
  C:\Windows\System\ctsZNmo.exe
  2⤵
  PID:12540
- C:\Windows\System\OOXcoJY.exe
  C:\Windows\System\OOXcoJY.exe
  2⤵
  PID:12576
- C:\Windows\System\aTZrBDK.exe
  C:\Windows\System\aTZrBDK.exe
  2⤵
  PID:12592
- C:\Windows\System\LVsiAtD.exe
  C:\Windows\System\LVsiAtD.exe
  2⤵
  PID:12612
- C:\Windows\System\CYuBmFE.exe
  C:\Windows\System\CYuBmFE.exe
  2⤵
  PID:12644
- C:\Windows\System\lzhRuvZ.exe
  C:\Windows\System\lzhRuvZ.exe
  2⤵
  PID:12672
- C:\Windows\System\cIBDXOr.exe
  C:\Windows\System\cIBDXOr.exe
  2⤵
  PID:12700
- C:\Windows\System\DkEBvGC.exe
  C:\Windows\System\DkEBvGC.exe
  2⤵
  PID:12720
- C:\Windows\System\kwlzotC.exe
  C:\Windows\System\kwlzotC.exe
  2⤵
  PID:12736
- C:\Windows\System\dYPeKcT.exe
  C:\Windows\System\dYPeKcT.exe
  2⤵
  PID:12760
- C:\Windows\System\Eqaapxl.exe
  C:\Windows\System\Eqaapxl.exe
  2⤵
  PID:12780
- C:\Windows\System\OmJhhmO.exe
  C:\Windows\System\OmJhhmO.exe
  2⤵
  PID:12804
- C:\Windows\System\phmHVMn.exe
  C:\Windows\System\phmHVMn.exe
  2⤵
  PID:12824
- C:\Windows\System\afjTDXZ.exe
  C:\Windows\System\afjTDXZ.exe
  2⤵
  PID:12844
- C:\Windows\System\Fgrshfs.exe
  C:\Windows\System\Fgrshfs.exe
  2⤵
  PID:12864
- C:\Windows\System\nxYFRkw.exe
  C:\Windows\System\nxYFRkw.exe
  2⤵
  PID:12888
- C:\Windows\System\bgMkjTV.exe
  C:\Windows\System\bgMkjTV.exe
  2⤵
  PID:12912
- C:\Windows\System\KFaYUbZ.exe
  C:\Windows\System\KFaYUbZ.exe
  2⤵
  PID:12940
- C:\Windows\System\qYfhLTS.exe
  C:\Windows\System\qYfhLTS.exe
  2⤵
  PID:12956
- C:\Windows\System\xHNvSrV.exe
  C:\Windows\System\xHNvSrV.exe
  2⤵
  PID:12972
- C:\Windows\System\EqFKUph.exe
  C:\Windows\System\EqFKUph.exe
  2⤵
  PID:12988
- C:\Windows\System\sftRcMj.exe
  C:\Windows\System\sftRcMj.exe
  2⤵
  PID:13008
- C:\Windows\System\UcZrNMn.exe
  C:\Windows\System\UcZrNMn.exe
  2⤵
  PID:13036
- C:\Windows\System\GxdPXFH.exe
  C:\Windows\System\GxdPXFH.exe
  2⤵
  PID:13064
- C:\Windows\System\dVMLLij.exe
  C:\Windows\System\dVMLLij.exe
  2⤵
  PID:13096
- C:\Windows\System\ZWkQUca.exe
  C:\Windows\System\ZWkQUca.exe
  2⤵
  PID:13128
- C:\Windows\System\kKZeenM.exe
  C:\Windows\System\kKZeenM.exe
  2⤵
  PID:13160
- C:\Windows\System\oOKrcSe.exe
  C:\Windows\System\oOKrcSe.exe
  2⤵
  PID:13184
- C:\Windows\System\inClqlv.exe
  C:\Windows\System\inClqlv.exe
  2⤵
  PID:13212
- C:\Windows\System\DNZgmOP.exe
  C:\Windows\System\DNZgmOP.exe
  2⤵
  PID:13240
- C:\Windows\System\FZRAKdf.exe
  C:\Windows\System\FZRAKdf.exe
  2⤵
  PID:13264
- C:\Windows\System\wbUzmzw.exe
  C:\Windows\System\wbUzmzw.exe
  2⤵
  PID:13292
- C:\Windows\System\zERyDtL.exe
  C:\Windows\System\zERyDtL.exe
  2⤵
  PID:9792
- C:\Windows\System\dXDCEqq.exe
  C:\Windows\System\dXDCEqq.exe
  2⤵
  PID:9864
- C:\Windows\System\QFFLYTI.exe
  C:\Windows\System\QFFLYTI.exe
  2⤵
  PID:11332
- C:\Windows\System\umfmmOU.exe
  C:\Windows\System\umfmmOU.exe
  2⤵
  PID:11416
- C:\Windows\System\nnUSccp.exe
  C:\Windows\System\nnUSccp.exe
  2⤵
  PID:10032
- C:\Windows\System\mQYsJPh.exe
  C:\Windows\System\mQYsJPh.exe
  2⤵
  PID:10076
- C:\Windows\System\SFhmEeh.exe
  C:\Windows\System\SFhmEeh.exe
  2⤵
  PID:10644
- C:\Windows\System\CHcBEGn.exe
  C:\Windows\System\CHcBEGn.exe
  2⤵
  PID:10120
- C:\Windows\System\JmPsiGi.exe
  C:\Windows\System\JmPsiGi.exe
  2⤵
  PID:10184
- C:\Windows\System\XTkuFdT.exe
  C:\Windows\System\XTkuFdT.exe
  2⤵
  PID:11936
- C:\Windows\System\Touvmpm.exe
  C:\Windows\System\Touvmpm.exe
  2⤵
  PID:11956
- C:\Windows\System\ryikESF.exe
  C:\Windows\System\ryikESF.exe
  2⤵
  PID:12000
- C:\Windows\System\TOoEUWs.exe
  C:\Windows\System\TOoEUWs.exe
  2⤵
  PID:12032
- C:\Windows\System\rFYGncu.exe
  C:\Windows\System\rFYGncu.exe
  2⤵
  PID:13328
- C:\Windows\System\yILxdgj.exe
  C:\Windows\System\yILxdgj.exe
  2⤵
  PID:13344
- C:\Windows\System\IppjiQs.exe
  C:\Windows\System\IppjiQs.exe
  2⤵
  PID:13364
- C:\Windows\System\XyWkuYm.exe
  C:\Windows\System\XyWkuYm.exe
  2⤵
  PID:13392
- C:\Windows\System\nAZFNAw.exe
  C:\Windows\System\nAZFNAw.exe
  2⤵
  PID:13412
- C:\Windows\System\rHOtplk.exe
  C:\Windows\System\rHOtplk.exe
  2⤵
  PID:13436
- C:\Windows\System\FRmkVif.exe
  C:\Windows\System\FRmkVif.exe
  2⤵
  PID:13460
- C:\Windows\System\zjmHYBl.exe
  C:\Windows\System\zjmHYBl.exe
  2⤵
  PID:13480
- C:\Windows\System\RvrFDRo.exe
  C:\Windows\System\RvrFDRo.exe
  2⤵
  PID:13508
- C:\Windows\System\dyJHdfH.exe
  C:\Windows\System\dyJHdfH.exe
  2⤵
  PID:13528
- C:\Windows\System\rbHqKXT.exe
  C:\Windows\System\rbHqKXT.exe
  2⤵
  PID:13556
- C:\Windows\System\tOoukWa.exe
  C:\Windows\System\tOoukWa.exe
  2⤵
  PID:13572
- C:\Windows\System\rayKJYg.exe
  C:\Windows\System\rayKJYg.exe
  2⤵
  PID:13588
- C:\Windows\System\MiBRbjR.exe
  C:\Windows\System\MiBRbjR.exe
  2⤵
  PID:13604
- C:\Windows\System\XZhWYPa.exe
  C:\Windows\System\XZhWYPa.exe
  2⤵
  PID:13628
- C:\Windows\System\dRykAjM.exe
  C:\Windows\System\dRykAjM.exe
  2⤵
  PID:13656
- C:\Windows\System\QTFitlY.exe
  C:\Windows\System\QTFitlY.exe
  2⤵
  PID:13672
- C:\Windows\System\UAQrqeO.exe
  C:\Windows\System\UAQrqeO.exe
  2⤵
  PID:13688
- C:\Windows\System\DGZPwtC.exe
  C:\Windows\System\DGZPwtC.exe
  2⤵
  PID:13712
- C:\Windows\System\zpKXBHp.exe
  C:\Windows\System\zpKXBHp.exe
  2⤵
  PID:13732
- C:\Windows\System\vpEIuSh.exe
  C:\Windows\System\vpEIuSh.exe
  2⤵
  PID:13752
- C:\Windows\System\mJUPxiX.exe
  C:\Windows\System\mJUPxiX.exe
  2⤵
  PID:13772
- C:\Windows\System\hKopyVK.exe
  C:\Windows\System\hKopyVK.exe
  2⤵
  PID:13792
- C:\Windows\System\SSzejMc.exe
  C:\Windows\System\SSzejMc.exe
  2⤵
  PID:13816
- C:\Windows\System\fqQxWJh.exe
  C:\Windows\System\fqQxWJh.exe
  2⤵
  PID:13844
- C:\Windows\System\NRbpcaE.exe
  C:\Windows\System\NRbpcaE.exe
  2⤵
  PID:13860
- C:\Windows\System\Dtqeyab.exe
  C:\Windows\System\Dtqeyab.exe
  2⤵
  PID:13880
- C:\Windows\System\PiAMImH.exe
  C:\Windows\System\PiAMImH.exe
  2⤵
  PID:13896
- C:\Windows\System\HjtRUPe.exe
  C:\Windows\System\HjtRUPe.exe
  2⤵
  PID:13924
- C:\Windows\System\spfYYzt.exe
  C:\Windows\System\spfYYzt.exe
  2⤵
  PID:13940
- C:\Windows\System\MZdMzFe.exe
  C:\Windows\System\MZdMzFe.exe
  2⤵
  PID:13960
- C:\Windows\System\RLCPOhv.exe
  C:\Windows\System\RLCPOhv.exe
  2⤵
  PID:13988
- C:\Windows\System\rmivBYO.exe
  C:\Windows\System\rmivBYO.exe
  2⤵
  PID:14008
- C:\Windows\System\ANGwAyk.exe
  C:\Windows\System\ANGwAyk.exe
  2⤵
  PID:14036
- C:\Windows\System\FloSVNh.exe
  C:\Windows\System\FloSVNh.exe
  2⤵
  PID:14056
- C:\Windows\System\CJxqvKH.exe
  C:\Windows\System\CJxqvKH.exe
  2⤵
  PID:14072
- C:\Windows\System\VmYzutJ.exe
  C:\Windows\System\VmYzutJ.exe
  2⤵
  PID:14096
- C:\Windows\System\ohvGsYe.exe
  C:\Windows\System\ohvGsYe.exe
  2⤵
  PID:14112
- C:\Windows\System\HPXfvXa.exe
  C:\Windows\System\HPXfvXa.exe
  2⤵
  PID:14140
- C:\Windows\System\iHZpBhT.exe
  C:\Windows\System\iHZpBhT.exe
  2⤵
  PID:14160
- C:\Windows\System\dtlCNWn.exe
  C:\Windows\System\dtlCNWn.exe
  2⤵
  PID:14184
- C:\Windows\System\NhOxWUi.exe
  C:\Windows\System\NhOxWUi.exe
  2⤵
  PID:14212
- C:\Windows\System\uaUDEKk.exe
  C:\Windows\System\uaUDEKk.exe
  2⤵
  PID:14228
- C:\Windows\System\wnpbidg.exe
  C:\Windows\System\wnpbidg.exe
  2⤵
  PID:14248
- C:\Windows\System\MKOlSfo.exe
  C:\Windows\System\MKOlSfo.exe
  2⤵
  PID:14268
- C:\Windows\System\joqFPxH.exe
  C:\Windows\System\joqFPxH.exe
  2⤵
  PID:14300
- C:\Windows\System\IhZnCSh.exe
  C:\Windows\System\IhZnCSh.exe
  2⤵
  PID:14328
- C:\Windows\System\GwIahCV.exe
  C:\Windows\System\GwIahCV.exe
  2⤵
  PID:8228
- C:\Windows\System\VyEAPSj.exe
  C:\Windows\System\VyEAPSj.exe
  2⤵
  PID:12132
- C:\Windows\System\Scxzdye.exe
  C:\Windows\System\Scxzdye.exe
  2⤵
  PID:12232
- C:\Windows\System\bMHDSab.exe
  C:\Windows\System\bMHDSab.exe
  2⤵
  PID:10376
- C:\Windows\System\gFCAQxx.exe
  C:\Windows\System\gFCAQxx.exe
  2⤵
  PID:8640
- C:\Windows\System\EeIWJoQ.exe
  C:\Windows\System\EeIWJoQ.exe
  2⤵
  PID:7796
- C:\Windows\System\qqzBWSo.exe
  C:\Windows\System\qqzBWSo.exe
  2⤵
  PID:7724
- C:\Windows\System\SIuYnHA.exe
  C:\Windows\System\SIuYnHA.exe
  2⤵
  PID:9584
- C:\Windows\System\USqEbKv.exe
  C:\Windows\System\USqEbKv.exe
  2⤵
  PID:9684
- C:\Windows\System\cIDDRAj.exe
  C:\Windows\System\cIDDRAj.exe
  2⤵
  PID:9604
- C:\Windows\System\sVAYbBI.exe
  C:\Windows\System\sVAYbBI.exe
  2⤵
  PID:10252
- C:\Windows\System\AbwVNSf.exe
  C:\Windows\System\AbwVNSf.exe
  2⤵
  PID:9716
- C:\Windows\System\GnALhcV.exe
  C:\Windows\System\GnALhcV.exe
  2⤵
  PID:10308
- C:\Windows\System\qQPilDE.exe
  C:\Windows\System\qQPilDE.exe
  2⤵
  PID:11296
- C:\Windows\System\bkzxeVy.exe
  C:\Windows\System\bkzxeVy.exe
  2⤵
  PID:10388
- C:\Windows\System\ivisAdc.exe
  C:\Windows\System\ivisAdc.exe
  2⤵
  PID:12456
- C:\Windows\System\doXHIhl.exe
  C:\Windows\System\doXHIhl.exe
  2⤵
  PID:11420
- C:\Windows\System\FnBVLVf.exe
  C:\Windows\System\FnBVLVf.exe
  2⤵
  PID:12628
- C:\Windows\System\YqNNzUH.exe
  C:\Windows\System\YqNNzUH.exe
  2⤵
  PID:14356
- C:\Windows\System\yapYHbG.exe
  C:\Windows\System\yapYHbG.exe
  2⤵
  PID:14376
- C:\Windows\System\pBaNetB.exe
  C:\Windows\System\pBaNetB.exe
  2⤵
  PID:14400
- C:\Windows\System\wYKyjDZ.exe
  C:\Windows\System\wYKyjDZ.exe
  2⤵
  PID:14420
- C:\Windows\System\juEDETL.exe
  C:\Windows\System\juEDETL.exe
  2⤵
  PID:14436
- C:\Windows\System\iufnpHX.exe
  C:\Windows\System\iufnpHX.exe
  2⤵
  PID:14464
- C:\Windows\System\ZTzPKwl.exe
  C:\Windows\System\ZTzPKwl.exe
  2⤵
  PID:14480
- C:\Windows\System\eLHGUOJ.exe
  C:\Windows\System\eLHGUOJ.exe
  2⤵
  PID:14512
- C:\Windows\System\sikKjnk.exe
  C:\Windows\System\sikKjnk.exe
  2⤵
  PID:14540
- C:\Windows\System\lwpjCoT.exe
  C:\Windows\System\lwpjCoT.exe
  2⤵
  PID:14556
- C:\Windows\System\dsPEdxh.exe
  C:\Windows\System\dsPEdxh.exe
  2⤵
  PID:14584
- C:\Windows\System\DAdrZDw.exe
  C:\Windows\System\DAdrZDw.exe
  2⤵
  PID:14600
- C:\Windows\System\iSSvIUZ.exe
  C:\Windows\System\iSSvIUZ.exe
  2⤵
  PID:14620
- C:\Windows\System\jWRvYbP.exe
  C:\Windows\System\jWRvYbP.exe
  2⤵
  PID:14640
- C:\Windows\System\weLLfNx.exe
  C:\Windows\System\weLLfNx.exe
  2⤵
  PID:14664
- C:\Windows\System\wASJJpT.exe
  C:\Windows\System\wASJJpT.exe
  2⤵
  PID:14684
- C:\Windows\System\cTPhpER.exe
  C:\Windows\System\cTPhpER.exe
  2⤵
  PID:14700
- C:\Windows\System\ltkbEia.exe
  C:\Windows\System\ltkbEia.exe
  2⤵
  PID:14716
- C:\Windows\System\EIvKLhc.exe
  C:\Windows\System\EIvKLhc.exe
  2⤵
  PID:14732
- C:\Windows\System\BZQbXBj.exe
  C:\Windows\System\BZQbXBj.exe
  2⤵
  PID:14752
- C:\Windows\System\qxAjaFu.exe
  C:\Windows\System\qxAjaFu.exe
  2⤵
  PID:14768
- C:\Windows\System\Hwdavwu.exe
  C:\Windows\System\Hwdavwu.exe
  2⤵
  PID:14784
- C:\Windows\System\XIdkgCc.exe
  C:\Windows\System\XIdkgCc.exe
  2⤵
  PID:14804
- C:\Windows\System\kzzELow.exe
  C:\Windows\System\kzzELow.exe
  2⤵
  PID:14820
- C:\Windows\System\HjbnsMl.exe
  C:\Windows\System\HjbnsMl.exe
  2⤵
  PID:14836
- C:\Windows\System\TInjuaO.exe
  C:\Windows\System\TInjuaO.exe
  2⤵
  PID:14852
- C:\Windows\System\JOHhlkR.exe
  C:\Windows\System\JOHhlkR.exe
  2⤵
  PID:14872
- C:\Windows\System\mPCyqsl.exe
  C:\Windows\System\mPCyqsl.exe
  2⤵
  PID:14892
- C:\Windows\System\zKzKoiS.exe
  C:\Windows\System\zKzKoiS.exe
  2⤵
  PID:14912
- C:\Windows\System\fgeRUQD.exe
  C:\Windows\System\fgeRUQD.exe
  2⤵
  PID:14936
- C:\Windows\System\PFPlRxA.exe
  C:\Windows\System\PFPlRxA.exe
  2⤵
  PID:14956
- C:\Windows\System\PkVHPFC.exe
  C:\Windows\System\PkVHPFC.exe
  2⤵
  PID:14980
- C:\Windows\System\Eovzxjc.exe
  C:\Windows\System\Eovzxjc.exe
  2⤵
  PID:15004
- C:\Windows\System\uzIrSmw.exe
  C:\Windows\System\uzIrSmw.exe
  2⤵
  PID:15028
- C:\Windows\System\UmlLsGA.exe
  C:\Windows\System\UmlLsGA.exe
  2⤵
  PID:15056
- C:\Windows\System\dzkMEOK.exe
  C:\Windows\System\dzkMEOK.exe
  2⤵
  PID:15072
- C:\Windows\System\domRNiI.exe
  C:\Windows\System\domRNiI.exe
  2⤵
  PID:15100
- C:\Windows\System\GkfIDtq.exe
  C:\Windows\System\GkfIDtq.exe
  2⤵
  PID:15120
- C:\Windows\System\hpzdmjJ.exe
  C:\Windows\System\hpzdmjJ.exe
  2⤵
  PID:15140
- C:\Windows\System\NKNCDJB.exe
  C:\Windows\System\NKNCDJB.exe
  2⤵
  PID:15168
- C:\Windows\System\EPaiinN.exe
  C:\Windows\System\EPaiinN.exe
  2⤵
  PID:15188
- C:\Windows\System\JSMqngQ.exe
  C:\Windows\System\JSMqngQ.exe
  2⤵
  PID:15208
- C:\Windows\System\JQOBiUu.exe
  C:\Windows\System\JQOBiUu.exe
  2⤵
  PID:15240
- C:\Windows\System\NyOTPxJ.exe
  C:\Windows\System\NyOTPxJ.exe
  2⤵
  PID:15260
- C:\Windows\System\NZwIkfc.exe
  C:\Windows\System\NZwIkfc.exe
  2⤵
  PID:15276
- C:\Windows\System\poaKzBr.exe
  C:\Windows\System\poaKzBr.exe
  2⤵
  PID:15304
- C:\Windows\System\Ueokziy.exe
  C:\Windows\System\Ueokziy.exe
  2⤵
  PID:15320
- C:\Windows\System\XKrUKCl.exe
  C:\Windows\System\XKrUKCl.exe
  2⤵
  PID:15348
- C:\Windows\System\pAfnjRd.exe
  C:\Windows\System\pAfnjRd.exe
  2⤵
  PID:10536
- C:\Windows\System\RkqjWir.exe
  C:\Windows\System\RkqjWir.exe
  2⤵
  PID:10568
- C:\Windows\System\BNkXihB.exe
  C:\Windows\System\BNkXihB.exe
  2⤵
  PID:10576
- C:\Windows\System\JXezGhe.exe
  C:\Windows\System\JXezGhe.exe
  2⤵
  PID:12820
- C:\Windows\System\nWcLWZC.exe
  C:\Windows\System\nWcLWZC.exe
  2⤵
  PID:11676
- C:\Windows\System\PeScknD.exe
  C:\Windows\System\PeScknD.exe
  2⤵
  PID:11704
- C:\Windows\System\SjqvFLV.exe
  C:\Windows\System\SjqvFLV.exe
  2⤵
  PID:11728
- C:\Windows\System\RbmLjRW.exe
  C:\Windows\System\RbmLjRW.exe
  2⤵
  PID:10752
- C:\Windows\System\WARjwPQ.exe
  C:\Windows\System\WARjwPQ.exe
  2⤵
  PID:10796
- C:\Windows\System\EdrfguV.exe
  C:\Windows\System\EdrfguV.exe
  2⤵
  PID:13016
- C:\Windows\System\VvSaZfm.exe
  C:\Windows\System\VvSaZfm.exe
  2⤵
  PID:3820
- C:\Windows\System\tKJAsjq.exe
  C:\Windows\System\tKJAsjq.exe
  2⤵
  PID:11804
- C:\Windows\System\tXjSCNQ.exe
  C:\Windows\System\tXjSCNQ.exe
  2⤵
  PID:10816
- C:\Windows\System\BxJmmSn.exe
  C:\Windows\System\BxJmmSn.exe
  2⤵
  PID:11916
- C:\Windows\System\pLzAnHB.exe
  C:\Windows\System\pLzAnHB.exe
  2⤵
  PID:10708
- C:\Windows\System\TgeTFOR.exe
  C:\Windows\System\TgeTFOR.exe
  2⤵
  PID:11940
- C:\Windows\System\GBRKkXg.exe
  C:\Windows\System\GBRKkXg.exe
  2⤵
  PID:13384
- C:\Windows\System\mmGUhHy.exe
  C:\Windows\System\mmGUhHy.exe
  2⤵
  PID:11024
- C:\Windows\System\nqWSMYb.exe
  C:\Windows\System\nqWSMYb.exe
  2⤵
  PID:12156
- C:\Windows\System\DqWCMyZ.exe
  C:\Windows\System\DqWCMyZ.exe
  2⤵
  PID:4184
- C:\Windows\System\etpAwyA.exe
  C:\Windows\System\etpAwyA.exe
  2⤵
  PID:13584
- C:\Windows\System\HPynIbb.exe
  C:\Windows\System\HPynIbb.exe
  2⤵
  PID:15364
- C:\Windows\System\wrCvARp.exe
  C:\Windows\System\wrCvARp.exe
  2⤵
  PID:15380
- C:\Windows\System\OVcKvoQ.exe
  C:\Windows\System\OVcKvoQ.exe
  2⤵
  PID:15396
- C:\Windows\System\HKwjVNh.exe
  C:\Windows\System\HKwjVNh.exe
  2⤵
  PID:15420
- C:\Windows\System\OnePbpi.exe
  C:\Windows\System\OnePbpi.exe
  2⤵
  PID:15436
- C:\Windows\System\soSkHIz.exe
  C:\Windows\System\soSkHIz.exe
  2⤵
  PID:15460
- C:\Windows\System\MSNecEL.exe
  C:\Windows\System\MSNecEL.exe
  2⤵
  PID:15488
- C:\Windows\System\nlvuqkr.exe
  C:\Windows\System\nlvuqkr.exe
  2⤵
  PID:15508
- C:\Windows\System\grnCKhH.exe
  C:\Windows\System\grnCKhH.exe
  2⤵
  PID:15524
- C:\Windows\System\ogPAxqa.exe
  C:\Windows\System\ogPAxqa.exe
  2⤵
  PID:15544
- C:\Windows\System\bjMDXBB.exe
  C:\Windows\System\bjMDXBB.exe
  2⤵
  PID:15568
- C:\Windows\System\RroFvIh.exe
  C:\Windows\System\RroFvIh.exe
  2⤵
  PID:15584
- C:\Windows\System\rOIyNUz.exe
  C:\Windows\System\rOIyNUz.exe
  2⤵
  PID:15608
- C:\Windows\System\gApzpMB.exe
  C:\Windows\System\gApzpMB.exe
  2⤵
  PID:15628
- C:\Windows\System\wWaeWbo.exe
  C:\Windows\System\wWaeWbo.exe
  2⤵
  PID:15644
- C:\Windows\System\kcoapUQ.exe
  C:\Windows\System\kcoapUQ.exe
  2⤵
  PID:15664
- C:\Windows\System\bfZdDJF.exe
  C:\Windows\System\bfZdDJF.exe
  2⤵
  PID:15692
- C:\Windows\System\yaydTKY.exe
  C:\Windows\System\yaydTKY.exe
  2⤵
  PID:15712
- C:\Windows\System\FjnPBsZ.exe
  C:\Windows\System\FjnPBsZ.exe
  2⤵
  PID:15728
- C:\Windows\System\lBJorZr.exe
  C:\Windows\System\lBJorZr.exe
  2⤵
  PID:15748
- C:\Windows\System\taVYcbT.exe
  C:\Windows\System\taVYcbT.exe
  2⤵
  PID:15772
- C:\Windows\System\GJfCAzZ.exe
  C:\Windows\System\GJfCAzZ.exe
  2⤵
  PID:15792
- C:\Windows\System\THgEmIx.exe
  C:\Windows\System\THgEmIx.exe
  2⤵
  PID:15808
- C:\Windows\System\JaPXVFe.exe
  C:\Windows\System\JaPXVFe.exe
  2⤵
  PID:15824
- C:\Windows\System\YsKjcdc.exe
  C:\Windows\System\YsKjcdc.exe
  2⤵
  PID:15852
- C:\Windows\System\dQboYwg.exe
  C:\Windows\System\dQboYwg.exe
  2⤵
  PID:15872
- C:\Windows\System\GARfnPc.exe
  C:\Windows\System\GARfnPc.exe
  2⤵
  PID:15888
- C:\Windows\System\FfLDiTN.exe
  C:\Windows\System\FfLDiTN.exe
  2⤵
  PID:15916
- C:\Windows\System\KMBbtwZ.exe
  C:\Windows\System\KMBbtwZ.exe
  2⤵
  PID:15944
- C:\Windows\System\xUekCGH.exe
  C:\Windows\System\xUekCGH.exe
  2⤵
  PID:15960
- C:\Windows\System\eFfOguX.exe
  C:\Windows\System\eFfOguX.exe
  2⤵
  PID:15976
- C:\Windows\System\JxmtMVs.exe
  C:\Windows\System\JxmtMVs.exe
  2⤵
  PID:16000
- C:\Windows\System\OCJbBen.exe
  C:\Windows\System\OCJbBen.exe
  2⤵
  PID:16024
- C:\Windows\System\MsvzpEj.exe
  C:\Windows\System\MsvzpEj.exe
  2⤵
  PID:16052
- C:\Windows\System\IaWmrxW.exe
  C:\Windows\System\IaWmrxW.exe
  2⤵
  PID:16068
- C:\Windows\System\QdDzAxh.exe
  C:\Windows\System\QdDzAxh.exe
  2⤵
  PID:16096
- C:\Windows\System\fBgITVJ.exe
  C:\Windows\System\fBgITVJ.exe
  2⤵
  PID:16120
- C:\Windows\System\yMDoGUD.exe
  C:\Windows\System\yMDoGUD.exe
  2⤵
  PID:16140
- C:\Windows\System\XOIWryK.exe
  C:\Windows\System\XOIWryK.exe
  2⤵
  PID:16176
- C:\Windows\System\qlhKuDX.exe
  C:\Windows\System\qlhKuDX.exe
  2⤵
  PID:16196
- C:\Windows\System\OQJaTee.exe
  C:\Windows\System\OQJaTee.exe
  2⤵
  PID:16212
- C:\Windows\System\rAOctBH.exe
  C:\Windows\System\rAOctBH.exe
  2⤵
  PID:16228
- C:\Windows\System\klPQzjt.exe
  C:\Windows\System\klPQzjt.exe
  2⤵
  PID:16256
- C:\Windows\System\YULiBOw.exe
  C:\Windows\System\YULiBOw.exe
  2⤵
  PID:16276
- C:\Windows\System\mPtWcqu.exe
  C:\Windows\System\mPtWcqu.exe
  2⤵
  PID:16296
- C:\Windows\System\hjNUtqQ.exe
  C:\Windows\System\hjNUtqQ.exe
  2⤵
  PID:16316
- C:\Windows\System\ynPeZoH.exe
  C:\Windows\System\ynPeZoH.exe
  2⤵
  PID:16336
- C:\Windows\System\jgiUPNn.exe
  C:\Windows\System\jgiUPNn.exe
  2⤵
  PID:16352
- C:\Windows\System\iFZpjKD.exe
  C:\Windows\System\iFZpjKD.exe
  2⤵
  PID:16368
- C:\Windows\System\RfntGqD.exe
  C:\Windows\System\RfntGqD.exe
  2⤵
  PID:2924
- C:\Windows\System\FsmqhrQ.exe
  C:\Windows\System\FsmqhrQ.exe
  2⤵
  PID:10512
- C:\Windows\System\dBUFxzj.exe
  C:\Windows\System\dBUFxzj.exe
  2⤵
  PID:13764
- C:\Windows\System\tTvCBEZ.exe
  C:\Windows\System\tTvCBEZ.exe
  2⤵
  PID:10700
- C:\Windows\System\glLQWOt.exe
  C:\Windows\System\glLQWOt.exe
  2⤵
  PID:13808
- C:\Windows\System\mNwzazb.exe
  C:\Windows\System\mNwzazb.exe
  2⤵
  PID:10216
- C:\Windows\System\XUgfUTV.exe
  C:\Windows\System\XUgfUTV.exe
  2⤵
  PID:13888
- C:\Windows\System\nLmNATG.exe
  C:\Windows\System\nLmNATG.exe
  2⤵
  PID:13952
- C:\Windows\System\WyeyFjJ.exe
  C:\Windows\System\WyeyFjJ.exe
  2⤵
  PID:9004
- C:\Windows\System\UvIhrkm.exe
  C:\Windows\System\UvIhrkm.exe
  2⤵
  PID:9332
- C:\Windows\System\OcQVMoU.exe
  C:\Windows\System\OcQVMoU.exe
  2⤵
  PID:9244
- C:\Windows\System\WkiwgvE.exe
  C:\Windows\System\WkiwgvE.exe
  2⤵
  PID:9484
- C:\Windows\System\UWzLGar.exe
  C:\Windows\System\UWzLGar.exe
  2⤵
  PID:8768
- C:\Windows\System\DcLbALa.exe
  C:\Windows\System\DcLbALa.exe
  2⤵
  PID:12308
- C:\Windows\System\DifatBL.exe
  C:\Windows\System\DifatBL.exe
  2⤵
  PID:7576
- C:\Windows\System\NpbsrdU.exe
  C:\Windows\System\NpbsrdU.exe
  2⤵
  PID:12260
- C:\Windows\System\porapxG.exe
  C:\Windows\System\porapxG.exe
  2⤵
  PID:12416
- C:\Windows\System\wComzaS.exe
  C:\Windows\System\wComzaS.exe
  2⤵
  PID:9336
- C:\Windows\System\UuXGpSn.exe
  C:\Windows\System\UuXGpSn.exe
  2⤵
  PID:8280
- C:\Windows\System\ulEkOUq.exe
  C:\Windows\System\ulEkOUq.exe
  2⤵
  PID:6024
- C:\Windows\System\zvZtvUv.exe
  C:\Windows\System\zvZtvUv.exe
  2⤵
  PID:12292
- C:\Windows\System\aJsrFcj.exe
  C:\Windows\System\aJsrFcj.exe
  2⤵
  PID:11452
- C:\Windows\System\kedTxGX.exe
  C:\Windows\System\kedTxGX.exe
  2⤵
  PID:11492
- C:\Windows\System\zaDDAmk.exe
  C:\Windows\System\zaDDAmk.exe
  2⤵
  PID:12368
- C:\Windows\System\hyMaOyw.exe
  C:\Windows\System\hyMaOyw.exe
  2⤵
  PID:11292
- C:\Windows\System\atREivA.exe
  C:\Windows\System\atREivA.exe
  2⤵
  PID:12516
- C:\Windows\System\jnvCkjA.exe
  C:\Windows\System\jnvCkjA.exe
  2⤵
  PID:11540
- C:\Windows\System\fajBoHz.exe
  C:\Windows\System\fajBoHz.exe
  2⤵
  PID:14448
- C:\Windows\System\MIuZBnd.exe
  C:\Windows\System\MIuZBnd.exe
  2⤵
  PID:14472
- C:\Windows\System\gbiolfq.exe
  C:\Windows\System\gbiolfq.exe
  2⤵
  PID:11608
- C:\Windows\System\aKopMRo.exe
  C:\Windows\System\aKopMRo.exe
  2⤵
  PID:16392
- C:\Windows\System\sSjJydV.exe
  C:\Windows\System\sSjJydV.exe
  2⤵
  PID:16412
- C:\Windows\System\iihzWNp.exe
  C:\Windows\System\iihzWNp.exe
  2⤵
  PID:16428
- C:\Windows\System\xmymUoA.exe
  C:\Windows\System\xmymUoA.exe
  2⤵
  PID:16444
- C:\Windows\System\NsdeFBd.exe
  C:\Windows\System\NsdeFBd.exe
  2⤵
  PID:16460
- C:\Windows\System\DHysrAS.exe
  C:\Windows\System\DHysrAS.exe
  2⤵
  PID:16476
- C:\Windows\System\GDCmgyn.exe
  C:\Windows\System\GDCmgyn.exe
  2⤵
  PID:16508
- C:\Windows\System\skVcSDY.exe
  C:\Windows\System\skVcSDY.exe
  2⤵
  PID:16540
- C:\Windows\System\KdAPPsf.exe
  C:\Windows\System\KdAPPsf.exe
  2⤵
  PID:16576
- C:\Windows\System\qhAvHIV.exe
  C:\Windows\System\qhAvHIV.exe
  2⤵
  PID:16612
- C:\Windows\System\xQdtpip.exe
  C:\Windows\System\xQdtpip.exe
  2⤵
  PID:16648
- C:\Windows\System\wWEHsas.exe
  C:\Windows\System\wWEHsas.exe
  2⤵
  PID:16680
- C:\Windows\System\UqNwmGB.exe
  C:\Windows\System\UqNwmGB.exe
  2⤵
  PID:16708
- C:\Windows\System\iQBbBfI.exe
  C:\Windows\System\iQBbBfI.exe
  2⤵
  PID:16724
- C:\Windows\System\Stagtso.exe
  C:\Windows\System\Stagtso.exe
  2⤵
  PID:16748
- C:\Windows\System\VDXCUYX.exe
  C:\Windows\System\VDXCUYX.exe
  2⤵
  PID:16768
- C:\Windows\System\AairDla.exe
  C:\Windows\System\AairDla.exe
  2⤵
  PID:16784
- C:\Windows\System\XUBXTqP.exe
  C:\Windows\System\XUBXTqP.exe
  2⤵
  PID:16804
- C:\Windows\System\pPOSPTt.exe
  C:\Windows\System\pPOSPTt.exe
  2⤵
  PID:16824
- C:\Windows\System\rEqqXVk.exe
  C:\Windows\System\rEqqXVk.exe
  2⤵
  PID:16852
- C:\Windows\System\qArPPZM.exe
  C:\Windows\System\qArPPZM.exe
  2⤵
  PID:16872
- C:\Windows\System\RuvCUUB.exe
  C:\Windows\System\RuvCUUB.exe
  2⤵
  PID:16888
- C:\Windows\System\OSBCUpm.exe
  C:\Windows\System\OSBCUpm.exe
  2⤵
  PID:16912
- C:\Windows\System\lTQwnFM.exe
  C:\Windows\System\lTQwnFM.exe
  2⤵
  PID:16928
- C:\Windows\System\qDrjCeA.exe
  C:\Windows\System\qDrjCeA.exe
  2⤵
  PID:16944
- C:\Windows\System\NRqnirR.exe
  C:\Windows\System\NRqnirR.exe
  2⤵
  PID:16960
- C:\Windows\System\POfVdCt.exe
  C:\Windows\System\POfVdCt.exe
  2⤵
  PID:16976
- C:\Windows\System\wrqfwJQ.exe
  C:\Windows\System\wrqfwJQ.exe
  2⤵
  PID:16992
- C:\Windows\System\BMtamDQ.exe
  C:\Windows\System\BMtamDQ.exe
  2⤵
  PID:17012
- C:\Windows\System\yEFZfLP.exe
  C:\Windows\System\yEFZfLP.exe
  2⤵
  PID:17028
- C:\Windows\System\hMDeGXU.exe
  C:\Windows\System\hMDeGXU.exe
  2⤵
  PID:17044
- C:\Windows\System\xViWMSh.exe
  C:\Windows\System\xViWMSh.exe
  2⤵
  PID:17060
- C:\Windows\System\utAxpSi.exe
  C:\Windows\System\utAxpSi.exe
  2⤵
  PID:17080
- C:\Windows\System\htWwaXX.exe
  C:\Windows\System\htWwaXX.exe
  2⤵
  PID:17096
- C:\Windows\System\RlHvKwZ.exe
  C:\Windows\System\RlHvKwZ.exe
  2⤵
  PID:17116
- C:\Windows\System\IoVgtWo.exe
  C:\Windows\System\IoVgtWo.exe
  2⤵
  PID:17132
- C:\Windows\System\Wydwlmj.exe
  C:\Windows\System\Wydwlmj.exe
  2⤵
  PID:17148
- C:\Windows\System\UiTImVf.exe
  C:\Windows\System\UiTImVf.exe
  2⤵
  PID:17176
- C:\Windows\System\iuIrFJD.exe
  C:\Windows\System\iuIrFJD.exe
  2⤵
  PID:17204
- C:\Windows\System\IQScrhl.exe
  C:\Windows\System\IQScrhl.exe
  2⤵
  PID:17224
- C:\Windows\System\YIoEvpw.exe
  C:\Windows\System\YIoEvpw.exe
  2⤵
  PID:17240
- C:\Windows\System\dilCpdt.exe
  C:\Windows\System\dilCpdt.exe
  2⤵
  PID:17268
- C:\Windows\System\VKXKuxq.exe
  C:\Windows\System\VKXKuxq.exe
  2⤵
  PID:17284
- C:\Windows\System\zxZOLvl.exe
  C:\Windows\System\zxZOLvl.exe
  2⤵
  PID:17312
- C:\Windows\System\TYpRAck.exe
  C:\Windows\System\TYpRAck.exe
  2⤵
  PID:17332
- C:\Windows\System\ZRDgwQQ.exe
  C:\Windows\System\ZRDgwQQ.exe
  2⤵
  PID:17352
- C:\Windows\System\AhcrOSR.exe
  C:\Windows\System\AhcrOSR.exe
  2⤵
  PID:17376
- C:\Windows\System\ciXmYqb.exe
  C:\Windows\System\ciXmYqb.exe
  2⤵
  PID:17396
- C:\Windows\System\wNlebJJ.exe
  C:\Windows\System\wNlebJJ.exe
  2⤵
  PID:14608
- C:\Windows\System\tczYkGV.exe
  C:\Windows\System\tczYkGV.exe
  2⤵
  PID:11772
- C:\Windows\System\OarCYsS.exe
  C:\Windows\System\OarCYsS.exe
  2⤵
  PID:11776
- C:\Windows\System\mZpmoAx.exe
  C:\Windows\System\mZpmoAx.exe
  2⤵
  PID:2740
- C:\Windows\System\yLcuhOB.exe
  C:\Windows\System\yLcuhOB.exe
  2⤵
  PID:12984
- C:\Windows\System\ZJyQNDR.exe
  C:\Windows\System\ZJyQNDR.exe
  2⤵
  PID:13080
- C:\Windows\System\cVBdrxp.exe
  C:\Windows\System\cVBdrxp.exe
  2⤵
  PID:13104
- C:\Windows\System\NxKlimu.exe
  C:\Windows\System\NxKlimu.exe
  2⤵
  PID:14888
- C:\Windows\System\vhrRxQl.exe
  C:\Windows\System\vhrRxQl.exe
  2⤵
  PID:13284
- C:\Windows\System\mFmBgpV.exe
  C:\Windows\System\mFmBgpV.exe
  2⤵
  PID:11836
- C:\Windows\System\MNjnqEm.exe
  C:\Windows\System\MNjnqEm.exe
  2⤵
  PID:11864
- C:\Windows\System\jeyaOVK.exe
  C:\Windows\System\jeyaOVK.exe
  2⤵
  PID:11900
- C:\Windows\System\aAYZFxj.exe
  C:\Windows\System\aAYZFxj.exe
  2⤵
  PID:15136
- C:\Windows\System\rlHkPON.exe
  C:\Windows\System\rlHkPON.exe
  2⤵
  PID:10916

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:12844

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:12156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\Egtdkju.exe

Filesize
946KB

MD5
a78e21aac7d4ad8c50a422c99fc7826c

SHA1
06e676f6086172609c0eb63d7e44bcc4f9124cb5

SHA256
e9a8522cae1c36cf9e44c36e60b7f7429ec006532f29e8ba388285971ff21231

SHA512
78903cbd09ec965aa6bfce6e830c050fd3ae02b4f5fc5471fcf658463a26570e1328b7989131529e0b84161b5635a0e603f44af88495f3b0bab6dca59429e85d

Download Submit
C:\Windows\System\FFppGzp.exe

Filesize
948KB

MD5
d07f457937428e22fcd327a8b4a3be5f

SHA1
ce411e7ba57a756c6c6f3fc7af1a2e82dfe5e001

SHA256
e35ea600d7b20c707009f034044276a2bb686e0b2786995bc1665ed88aa23df1

SHA512
0df507586537560186cd49c3f29c2e336790fd744376fb15480af4c81e59bc522feb17c1935e25e1d5eb82dbeb18667dbdd47d6b5de95be6bec0194eb8aa45d5

Download Submit
C:\Windows\System\FynEPgq.exe

Filesize
941KB

MD5
366bc57b80704888b343970735d6cce1

SHA1
1deaac4f234728c65c2773bc71bf16ba41961acf

SHA256
1ed6c44f824babdb766e65a55762e92d4a0030d93a3897acd283c4cc84e919e9

SHA512
a04daa6f2d537d312b65b97d53cf5a8da517cbd9decb013bf9e6f461cebc3287bb109181aacf8ef0c3cf6b5a06d6b9b48a00230b6b5dc1839ac1f9eb49d716d6

Download Submit
C:\Windows\System\GcRrzLS.exe

Filesize
945KB

MD5
7990262d26bfad189f265674c7f7a9b9

SHA1
92900d63aae077542716096beadb9dd6b7f8b241

SHA256
989f822fb0700aef1f6e28b926d727d2f24caa87f3f9b1b43b2d07ad55c722bb

SHA512
32b945fea9f52a6030f1c07392a3e56dccd6ae8e6eb4869c4b71e090d9c7a333a4d8c294a3b03d156f3a69bc6a8b204263952c650d09aa1a0bf21ad3d3029e15

Download Submit
C:\Windows\System\JGzPGPc.exe

Filesize
946KB

MD5
cea3e6900e8a5d8f1e08247dcdf9f021

SHA1
bf3eb398a2d8c342295e6db999e6fd6642dbeac4

SHA256
79ec1461ff110155b49c9dd157f83d2d55ee71ab789f988d792fea11c02a5f3a

SHA512
b040ff393e3652f6f446d886e80cac527ba2a40edf4c94d6eb0fd0a527568a082a5dc313791dfd535f56a6a2751b6f209a02a21b4e7c5e7013f79dc69184ce87

Download Submit
C:\Windows\System\JfCpNSf.exe

Filesize
944KB

MD5
e727379cc9132be9c5a931b133927d53

SHA1
697536c31628fa1e23c841824c8b2f9e308b8f12

SHA256
5ddd7fa2f7a7ad45ed53efb8467836f93e142505dcaf1dfb545c4c106cafbf95

SHA512
7f1328637ccc931a91f1bab569fe4ab7987e8e7809f7ea018cf108fe095ab402824494606d014efa36c4060e9f40ff9584627c3960a366d9540f95de3e62d382

Download Submit
C:\Windows\System\KnVVvKz.exe

Filesize
947KB

MD5
7694481809d33533c7d8b8d6e4177440

SHA1
2a8395d76057914b25028cd9cf3f7a74031d1d76

SHA256
dae7c36e333c7f6eb699fb017a4ec736c670047216a693c1260d4b012c03eedd

SHA512
772741069cfccfb5023d646776e17419fd0a3b9cf9a346d0bee6e9f2ba47a0e5c22e20bb979b1b96031154bb7f7f73ec04638e16f001d54aa96ff58456602f3b

Download Submit
C:\Windows\System\MCytULe.exe

Filesize
944KB

MD5
8bcda4ac3e6e8f80a0ab02552f080646

SHA1
872426763cf91cc4096f6a569714dcd1abe28056

SHA256
e6e5b37025718a9c31c9cb1af6b01f27a82f5237125bb5a0d91ba900026d66a4

SHA512
ae16abfe1db69de64729b1ba0a0e45a8619cc39e72c5644eb2acd38da4c4cc2eded24d37d0c02ebb6acb8cfe5550ab61428bbf17fb7e9aad721fd6c4ce7a7667

Download Submit
C:\Windows\System\MDtADdQ.exe

Filesize
946KB

MD5
1f65825912fb010a91e5f58618e5d843

SHA1
e6ef75e80c6239251f85170a0c52af66211c66d4

SHA256
3f0c37c184a8cd67fc3e421b9ef11e2296a4a957cd8a533d2f870b7f11c686d0

SHA512
f0d8cfc3d7d5b997b713f8eaf29dda986b0ecf908fecf3f7300e26e51811e5f18b1de759378eb6cefa0c128a8d91d37dc7ee61f1e0a61297b187233dfd14ad76

Download Submit
C:\Windows\System\NIOAbvS.exe

Filesize
943KB

MD5
c4205df5327eeb087455b1d27b92357f

SHA1
251022edc70f9413b25e4c631d1d366315120393

SHA256
0d1834acfd96485f24340e142f8548eb4ec87049691f21500878841332c61a1c

SHA512
23a64e9e873ab8eba798adaafc69d196c62ae7afc642e2aa9b42e7ee41257401ced9d63d333ddf4d6dd58cafe420d25012d143f23b5215e646f508b4defb9538

Download Submit
C:\Windows\System\NUqUMFv.exe

Filesize
942KB

MD5
d61cc6e6b996e2893f96b95b6b3899e1

SHA1
197103604f30005692af1f87de985a943de3f25e

SHA256
c5a858928cf6de7470b017adf12700667cbc579994cbe0e670e015ec0ec0137d

SHA512
57037855c302b49d8bb305935ed629e4bf7d37997434b4a59100d8b88f737d4e566f2c85538f984f731effe941201849b7cb3f426d2587c64db52e8282781432

Download Submit
C:\Windows\System\PBEOeon.exe

Filesize
945KB

MD5
4cccb424e729d8952198963dd4a2d93e

SHA1
01a49558cada745903dc98cfefb3dd72408f134d

SHA256
8ddadb2aa6eee2e7114ca42b2fd5b863cd671310de260f9b93ba9f09d36f41e3

SHA512
9ad24d059f2fa3714f85b4c8403238ce0d0aa773949299dc820ffa7c5b71dc90be56bdba294b23c0ae58f68a6a0b6d086b53e21ffcda4dbc39fe15cf3740fb32

Download Submit
C:\Windows\System\PNbzUmc.exe

Filesize
949KB

MD5
2e4ede1f9c14d9227b71f90ed6046129

SHA1
b735e4d21900dc95017cdd2265a444879b94825d

SHA256
b7abb1867cd03565af779ed76dda008a5a9ecdabb616641654bb56e337d1be7e

SHA512
85eff6d0165b747fc77206e21d9332ae254bc5fa61f74ce08eaebdaaf560b2924b104687bf68ff41862653c769bc09ef268d7cdb6db0559ef5d6ae81e8048b70

Download Submit
C:\Windows\System\QiAxzCy.exe

Filesize
948KB

MD5
95afa68663b0212fbf5b034203f9efe7

SHA1
da5dec9d27b53e1fd26091405f899c86371e0384

SHA256
73864b865073d0eb69d1b384caab7d0ec511e0090775d7e020b0bf8531039c7d

SHA512
96259f18396d5dd1fb410eac12168f820bb626d3e139f90947da977cab292386bf01e5421ac64c21b68feb7093c6106aa13e885e8fc743ea624936dcc21fafce

Download Submit
C:\Windows\System\RxqyHoO.exe

Filesize
946KB

MD5
6c787586573004e91b00a4bd29247666

SHA1
1cad1376bc779a3c2321e62bbaca93c6c5e47cef

SHA256
faf1d2e5e476eba8b3338d9b1d0a167a86bd4cab5acdf43c82561c280b546d0d

SHA512
1539efaff355cf51e59d36de6bacb9f77d8fd7c516e70fd72cb4109787da5ccfad2147528db545298d5225d99a3fe3891897c8de7b1f1289d7f5dad75bdf3835

Download Submit
C:\Windows\System\VweprWj.exe

Filesize
943KB

MD5
93fd6bab338498e038eee8b320166d03

SHA1
addb86e632b1c2464cca25b4c0c52f900afc86d7

SHA256
a2b9e51bacbadc7c70e3c9f1c9e47e137cb47a10f4981c95dcaecefcf573fb0c

SHA512
e6938d3cf75fb0e4c7876f7af9e3b33645737d484db2dc810f321a37c7b7b9f6dae98d73055f31ed3b66be2122e7ddfab8fa7a4adf0e7aec99ca5450ee5147bf

Download Submit
C:\Windows\System\aVdCkrr.exe

Filesize
942KB

MD5
b4339f080afa93daf6fda6d782dc7eef

SHA1
0c588c288182b71561e6cfcf85cdb4d9a925a697

SHA256
5b0b7793c163b879d440062c7670efde36431a71803dff4d7c81a76a08a65cc4

SHA512
896069caaf73fc021c360c0f66815731d2ae3a67fa93a5169c91d48a392a3e3ef022b0b1d965043ae039bfa15c6c4a917048ddd79e73bf1ab7bafba019e97dc6

Download Submit
C:\Windows\System\ajktzje.exe

Filesize
947KB

MD5
e9cdf8ec9db30f71e49886ae563c4b19

SHA1
84d768c2f8499da6bb6d699a3c69a2161938201f

SHA256
0d3d4e5e304a1048b28b49b38eaa2c9cef61bfdc02ca25969e33016f4185d07b

SHA512
8e9806127b57ab6ccbc85ce4bb6e51228f144ba7bf8eae4cd5b16d0f1d64dcdce2a7ceb7b2fadfde951fd9d0785d7f512957d7d858a69683a1d70e03a8c5e6fd

Download Submit
C:\Windows\System\dYoLbRQ.exe

Filesize
944KB

MD5
08715e964ac168e7152f2215e6fdf56e

SHA1
7bf921ff59ed4ac0f27d65ee4d8f094f36dd3490

SHA256
3f1e782c4ea31d45eb8c961550ea56aac1ba3657c1c336e27b285d45f3266aa3

SHA512
8d838a7aabcc7d3fb7f59a57188829edb58e3e591a74ef447e91893ddc365fa2165df705ffedd81c13203e6eaa0513ee17ed6eac7d19e58f02bb6ab5a77d7ec0

Download Submit
C:\Windows\System\fmYFDbi.exe

Filesize
943KB

MD5
0b4be6ab3991f04fc40449f121a35451

SHA1
63221333f0c96c5edf4222113601e08c2975e19e

SHA256
a980195c9d72cec2b051a45f445fee953048a58bc64a8459393e087de626f082

SHA512
39f46d4d018dff03761d9c5de0c8cc7f49ba36408ea0346c8cf8643b75dacc25cc045bea50aa28b52776a763f587e583ab71f33da2a14f6abb69b9b1e49cba43

Download Submit
C:\Windows\System\gQDyKln.exe

Filesize
948KB

MD5
3b53906648974a37a59efda7aae63d7a

SHA1
ceed152c3eb42659ba13e7d14fe3ba31fcc03b59

SHA256
3f67b9909a0088838de7ba7d70fc88d0a102586ec8fd9e0c542305e0602415a1

SHA512
8b35227d4735e24be63ef766a48a61e8f07f151f6ae537a0d43b11667e1fb468f3d334f661136222f9dedd2db66431eb0b739799758588f16e35268e8e271273

Download Submit
C:\Windows\System\gaAUEKy.exe

Filesize
942KB

MD5
221983a80509d91388cde8bb160fa339

SHA1
fe9d2bb00c502339da7b96130c3a256c579101a2

SHA256
b395602b4fcc98ae5e5edda36874dcc27cd56fa58cb3dadb78b330df33640522

SHA512
53e48c4e6a462dca643df51f18e23af416e581500d7a7f4f81541e974497702363d283197d9fb4c6fe1eee25484736ff6e8c972f979fe79908fa58ac9c5cce74

Download Submit
C:\Windows\System\kOkqtUy.exe

Filesize
941KB

MD5
0537a8b1cf8f0e059b534a87d5e4f284

SHA1
8a3b87247d1737e2453093ac2b18a7f29411b753

SHA256
86ee02503353fa402f64369171aa0bea7ca2783c54c8b2e13eca89ea798ceaad

SHA512
d928cf6e5eeba7a62acb28d9fe664f429aad8d06ff31ca92653b81e437d80460626c88b186cd80193885157e2283c0e92e886c4577e5350e47cb18b1ea79cddf

Download Submit
C:\Windows\System\lolWiIW.exe

Filesize
949KB

MD5
f1d1afc7d2e1f84f097325b7d41535f5

SHA1
4552567c8dbb096dacbefda9bc873bce5ef013d3

SHA256
1b1eaf1821fc301ac230f3f0966abbd472ed24d495d88507b458e2cf65e2bbce

SHA512
20837d7b02e4d71e9b0fc1129986588cc0fc912c547e48d150269b45c64b649fd174806c1ee8c9bf5224788656549efc5efabd86703c3179607c9fa501ed5649

Download Submit
C:\Windows\System\oiDJVhp.exe

Filesize
945KB

MD5
7f72caab6e594438a60ab9bca7055f7c

SHA1
74de50efc3d04c758f4eba51c83384286078efa2

SHA256
618e293ea664f6c18f0aca973084a49c40605779ea017393bebe58d5a60fd618

SHA512
a17d8ee1c71b316f1891fd46a31993656fbe542b26f790a237521f8a10a0e584ea56c2069c4f94da1d9ca0bc7f554e52eea57e7b18d65504a300112e13dd2308

Download Submit
C:\Windows\System\pGScbJU.exe

Filesize
944KB

MD5
f6fb4a4436bf63bc8cc6da87b07ff801

SHA1
7fcb02fc91e42970d35e1af078c5bcc65e6bffe6

SHA256
b95959840d1ed5108865899da990f0bbf2f6d1bf18edca304f9dd3a95f151c9d

SHA512
b3bd5ab85fc25f279e9fb3a3c37917df7a6248069fb4bfb2208114cd548166729dc90955211a03ac53473322b56f32a591acee990fb0062a8121500e2a24ba67

Download Submit
C:\Windows\System\rJYGvox.exe

Filesize
949KB

MD5
92eb50963f3302575819c18e37d58313

SHA1
6c0cad1b1bb8b1464f91d56c73abed0e844a91a1

SHA256
60554f9221f2e3a55e993d15cb19bdb6b35717bd04faa5fd66e5c5a0169528b7

SHA512
1787b794e6c5906d2f77eb21b5bd2d6d7aefd82cefce487fb812fd3400e66661d300b580446eda3d3891e5784481253669d748b13f7c6df9a54e629a1506b0d5

Download Submit
C:\Windows\System\rjwECOd.exe

Filesize
947KB

MD5
c41e804c885cd862ea157f94f18b5277

SHA1
cd458d2deb442904259351b0f159ff2ef774b36b

SHA256
7fbccf86b7ce0f731d98642e104c1543be329d773c8b1613d2417163c05905f6

SHA512
dbb3036505c823cbfa0193f777e99ecdac77213a740488946c64373d5e4e5883bf5cd316f0f2675cb4e802203e79864efae6e51d563c2d787e6a8141df7f7816

Download Submit
C:\Windows\System\tzqpUfl.exe

Filesize
949KB

MD5
d396ee7d168316e6dc17a236e3defc10

SHA1
c2c6c0a87e39f5b635757e7f33fac174699d93e9

SHA256
516dafd53ba0d096ffb24eebd9f05b0787fa0eb84ae05649b1969f5a41f07f0d

SHA512
581a348fd9c8c0efa8d16342ed606d108e3237821b96017c0086a295869c3aa1b5c3858f5080abeabc13681e7702bd06c885b9dccb4144bf6c5b3018c09da307

Download Submit
C:\Windows\System\wDUcVqh.exe

Filesize
941KB

MD5
36cdb4849b29038ac0ac132b883e0034

SHA1
8552156700663ddc8df94d378607fa539f4f5e31

SHA256
c69587297c0e0011a937e1a84d73b6524564118a88b9dc57ec513578f5ce80fe

SHA512
a08e5df8c954cc157d2f4bbd139806802209a4ac268e2045ebd81ab04cd0c4757c9db869f8ccbbe607f8cbb0feafb2e8edf307a0dbd8d45c1c49784da2455ea9

Download Submit
C:\Windows\System\xhIVmTi.exe

Filesize
947KB

MD5
890fce09979448b7cbee769361c36db2

SHA1
aceca498233f41125fc2c9f3aafca23146be2657

SHA256
215210a5e4be319ad5d63fd9c73dfa124fbe476a3a89934c74dc7ca62047bcc7

SHA512
86369183f13ee657574de266d7668258db3a85c4cfae3db3ac1c8acb634a9145af8eb25c05e1609b7b1bb7e9cc2956e292c1a96552c5ef0a5d60de9df0e81c42

Download Submit
C:\Windows\System\yUturmK.exe

Filesize
943KB

MD5
4a1ca954aac185211b20ace64191a655

SHA1
a898e08f29d4f1a44667f86df0489e175c7a91b6

SHA256
e8f80a460c4f1f78c1e87c7640be29030a3f8d34827724826b9b75881016a5d8

SHA512
817e1c0528b31282a5ab1b15f0da00a53426c23aa02eb6e5d3759b95fd8b203f01c68132cc8f569ecdf9f7cfc8faf2c778b2bcedc519bf2fd0e5c5830224d9fe

Download Submit
C:\Windows\System\ydEHOJZ.exe

Filesize
942KB

MD5
8368684a7dc99cd7ee5c3f542c909132

SHA1
584970b3723129a7cb341a809f3be2c27f75861e

SHA256
dac07abde919cbec9ee6c4b5d418177007676066f98a1863845e6933df701271

SHA512
06688822f0dbd19826dce92cf0013a22f7b03ce9fdfbba1a75e6d3e2f4bebc564b1ec05208ec4d5b322b1cd696ccfec89204400b2bb1198f7e4175d21d39c4e2

Download Submit
C:\Windows\System\zAeEfWW.exe

Filesize
945KB

MD5
9996e6904c36feda24748063198b008a

SHA1
10e74e32e324b7ea2f12ec6259ee4fdac5be5a0c

SHA256
f3f1c455c7c257aafef941aa12e84286ce89c091e664d1b3a03e25ed20526223

SHA512
c83d660a81374848b8f7853f7234af57723fb3347f37f17ade50d4b35fb6a22bcd00eeb2918ad67d1f03fba48921ec26e4d3082333e40ea52e58daf91243b693

Download Submit
C:\Windows\System\zYKbtZU.exe

Filesize
948KB

MD5
340327c7c0fd034e24cc3352e344bcbd

SHA1
9449d1d8fd1b5e25aa17d436b7b1a5f03a98b669

SHA256
14551d8442cc26cf2e4985381f21b44cdd2e81512d0e7a960b6c4b7c5a33f110

SHA512
78628bc047eb81a10ad109e984e74639fdd5d44273e25033d725c9ad830b3f8dbfefef184d146edc8ba59fd29b7004d7bf6109567cf91997e3e519b926008589

Download Submit
memory/4364-0-0x0000013610CD0000-0x0000013610CE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads