xmrig | 82ac6f28a1de7a8f0c92a53cc3e0b3cf1bde6fd8ae7400360cc840c9a2be9a55

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
Size

1.6MB
MD5

3cf5848c4c25b27d11280b8a349ea1a0
SHA1

0bb0286762d1bc70b2c35571bb0990b3364aa10e
SHA256

82ac6f28a1de7a8f0c92a53cc3e0b3cf1bde6fd8ae7400360cc840c9a2be9a55
SHA512

2787cc5e142df988b36148730f419b579bf426dcf3f70749bff612fc8bef030d45408b168e464d3d72031910cb840936ac4ff780e0bdf80274a06a0628118aba
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zD:Lz071uv4BPMkibTIA5lCx7kvRWa4pXYz

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2924-15-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2836-166-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/1648-165-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2220-163-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2988-161-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2564-159-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2544-157-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2476-155-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2676-153-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2628-147-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2096-14-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2724-33-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2676-5842-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2836-5894-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2544-5901-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2564-5983-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2988-5974-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2096-6283-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/1648-6470-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2924-6478-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2220-6507-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2628-6498-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2940-6786-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2476-6963-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1828	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2096	MweBxtQ.exe
2924	QguhMwd.exe
2724	JjUaDzK.exe
2628	yvbcorz.exe
2836	StdxOAJ.exe
2676	JoAtWKJ.exe
2476	RQUiOxC.exe
2544	KOjlfFR.exe
2564	goRleml.exe
2988	LIBgRKr.exe
2220	iggtePm.exe
1648	CqGtItW.exe
1960	YYpqMnQ.exe
1432	QaTvwmL.exe
2736	XiWMQXy.exe
2000	PnSXLFc.exe
2484	JGLJFgp.exe
2020	GDdQLsF.exe
2400	McLTCSU.exe
2188	ubKJarM.exe
1788	wLsbpcD.exe
2348	PPtcOnK.exe
1516	DOirRzk.exe
2016	QuHRvQV.exe
2404	zzhkGNn.exe
2864	EOESNbO.exe
480	LlWouyt.exe
2124	mIpYXDy.exe
1008	uzSmTWO.exe
3016	OtVQZAe.exe
3032	lbAtaeA.exe
2128	kSByTAu.exe
1344	OuogiHV.exe
1300	TznQWim.exe
2968	sjLVStw.exe
692	bcKDIHf.exe
300	IRuDCkC.exe
1768	lGlAyTh.exe
1320	KZKrBGY.exe
988	fiyvQGR.exe
1584	yYSTYfd.exe
1612	ydecoOX.exe
1348	GJjJwCV.exe
2872	eSAwyTe.exe
336	QFVwIGx.exe
1748	CTolqAx.exe
2104	dHlmJzR.exe
316	HaqntwK.exe
1568	TBqeClh.exe
1680	aUzabLX.exe
2748	kfLlBtt.exe
2668	jHFIffU.exe
2548	dMUnePc.exe
2184	OLnZSgu.exe
2344	IwyBUwO.exe
2528	dNVwahL.exe
1940	cqsZqwk.exe
1696	iWLduni.exe
296	RDIIEqX.exe
1964	OIcwMfq.exe
1936	gxxzuMe.exe
2372	VysIXSh.exe
340	gSZAXsU.exe
1592	oxrcHQS.exe

Loads dropped DLL 64 IoCs

pid	Process
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2940-0-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/files/0x0037000000015693-6.dat	upx
behavioral1/files/0x000a000000012286-3.dat	upx
behavioral1/files/0x0007000000015cc7-17.dat	upx
behavioral1/memory/2924-15-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/files/0x000d00000000549e-34.dat	upx
behavioral1/files/0x0007000000015d12-48.dat	upx
behavioral1/files/0x0008000000015d08-43.dat	upx
behavioral1/files/0x0006000000016835-67.dat	upx
behavioral1/files/0x0006000000016c52-79.dat	upx
behavioral1/files/0x0006000000016cc1-96.dat	upx
behavioral1/files/0x0006000000016d32-111.dat	upx
behavioral1/files/0x0006000000016d5f-129.dat	upx
behavioral1/files/0x0006000000016c78-94.dat	upx
behavioral1/files/0x0006000000016d3b-138.dat	upx
behavioral1/files/0x0006000000016d68-148.dat	upx
behavioral1/files/0x0006000000016d2a-136.dat	upx
behavioral1/files/0x0006000000016d4b-143.dat	upx
behavioral1/memory/2836-166-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/files/0x0006000000016d9f-180.dat	upx
behavioral1/files/0x0006000000016dc8-187.dat	upx
behavioral1/memory/1648-165-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2220-163-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2988-161-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2564-159-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2544-157-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2476-155-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2676-153-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/files/0x0006000000016d6f-151.dat	upx
behavioral1/memory/2628-147-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x0006000000016dba-185.dat	upx
behavioral1/files/0x0006000000016d64-145.dat	upx
behavioral1/files/0x0006000000016d43-127.dat	upx
behavioral1/files/0x0006000000016ceb-120.dat	upx
behavioral1/files/0x0006000000016d17-109.dat	upx
behavioral1/files/0x0006000000016d8b-171.dat	upx
behavioral1/files/0x0006000000016c6f-85.dat	upx
behavioral1/files/0x0037000000015b6e-89.dat	upx
behavioral1/files/0x0006000000016a8a-74.dat	upx
behavioral1/files/0x00060000000165e1-64.dat	upx
behavioral1/files/0x0006000000016581-59.dat	upx
behavioral1/files/0x0008000000015d3b-54.dat	upx
behavioral1/files/0x0008000000015cdf-26.dat	upx
behavioral1/memory/2096-14-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2724-33-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2676-5842-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/memory/2836-5894-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/2544-5901-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2564-5983-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2988-5974-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2096-6283-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/1648-6470-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2924-6478-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2220-6507-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2628-6498-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2940-6786-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2476-6963-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KzPOGTr.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\QbvgDVI.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\SLwZInC.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\XGoFJlO.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\moorVqe.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\AvTqiuy.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\uqRUxmc.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\ypFDiXp.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\DhfqAbx.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\zVDbrbp.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\KVSOebC.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\FjXCEIV.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\nUpYTLf.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\XGDfoFB.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\YiYDaee.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\dlrKOOJ.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\aTshMrO.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\BBfcUzD.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\spVkjJb.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\CXKAqNV.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\DnGgaNY.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\fMFvpDY.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\LdtuMlC.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\GaxFbef.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\iesycYD.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\UnJiCmf.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\cfHiWXw.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\ibAOduS.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\typdveT.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\kTwbzaF.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\axBpDys.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\ekevCEM.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\mWZfKzQ.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\AqoTwPT.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\gKJRiDx.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\jcocIQD.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\fCTniMM.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\zjoWcgu.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\xiPsyzN.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\TBqeClh.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\CpMdDOd.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\PNJbxpV.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\barPokC.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\yFDotni.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\YQquoMs.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\dDfMfpL.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\VzZCpBY.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\BfYlBNg.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\doAoTIb.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\IRuDCkC.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\VGYevGj.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\zwEjYtt.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\mZbvijX.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\JejDrcw.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\lDDEWcB.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\hroeYTt.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\plFCFym.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\LyqcpHL.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\fZnrEGQ.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\CYvvMAy.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\FSYibxt.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\JRiUoNs.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\ufapwoq.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\TLvsDSX.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1828	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1828	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1828	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	30
PID 2940 wrote to memory of 1828	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	30
PID 2940 wrote to memory of 1828	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	30
PID 2940 wrote to memory of 2096	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	31
PID 2940 wrote to memory of 2096	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	31
PID 2940 wrote to memory of 2096	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	31
PID 2940 wrote to memory of 2924	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	32
PID 2940 wrote to memory of 2924	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	32
PID 2940 wrote to memory of 2924	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	32
PID 2940 wrote to memory of 2724	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	33
PID 2940 wrote to memory of 2724	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	33
PID 2940 wrote to memory of 2724	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	33
PID 2940 wrote to memory of 2836	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	34
PID 2940 wrote to memory of 2836	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	34
PID 2940 wrote to memory of 2836	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	34
PID 2940 wrote to memory of 2628	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	35
PID 2940 wrote to memory of 2628	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	35
PID 2940 wrote to memory of 2628	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	35
PID 2940 wrote to memory of 2676	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	36
PID 2940 wrote to memory of 2676	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	36
PID 2940 wrote to memory of 2676	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	36
PID 2940 wrote to memory of 2476	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	37
PID 2940 wrote to memory of 2476	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	37
PID 2940 wrote to memory of 2476	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	37
PID 2940 wrote to memory of 2544	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	38
PID 2940 wrote to memory of 2544	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	38
PID 2940 wrote to memory of 2544	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	38
PID 2940 wrote to memory of 2564	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	39
PID 2940 wrote to memory of 2564	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	39
PID 2940 wrote to memory of 2564	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	39
PID 2940 wrote to memory of 2988	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	40
PID 2940 wrote to memory of 2988	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	40
PID 2940 wrote to memory of 2988	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	40
PID 2940 wrote to memory of 2220	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	41
PID 2940 wrote to memory of 2220	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	41
PID 2940 wrote to memory of 2220	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	41
PID 2940 wrote to memory of 1648	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	42
PID 2940 wrote to memory of 1648	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	42
PID 2940 wrote to memory of 1648	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	42
PID 2940 wrote to memory of 1960	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	43
PID 2940 wrote to memory of 1960	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	43
PID 2940 wrote to memory of 1960	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	43
PID 2940 wrote to memory of 1432	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	44
PID 2940 wrote to memory of 1432	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	44
PID 2940 wrote to memory of 1432	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	44
PID 2940 wrote to memory of 2736	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	45
PID 2940 wrote to memory of 2736	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	45
PID 2940 wrote to memory of 2736	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	45
PID 2940 wrote to memory of 2000	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	46
PID 2940 wrote to memory of 2000	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	46
PID 2940 wrote to memory of 2000	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	46
PID 2940 wrote to memory of 2484	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	47
PID 2940 wrote to memory of 2484	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	47
PID 2940 wrote to memory of 2484	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	47
PID 2940 wrote to memory of 2188	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	48
PID 2940 wrote to memory of 2188	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	48
PID 2940 wrote to memory of 2188	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	48
PID 2940 wrote to memory of 2020	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	49
PID 2940 wrote to memory of 2020	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	49
PID 2940 wrote to memory of 2020	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	49
PID 2940 wrote to memory of 1516	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	50
PID 2940 wrote to memory of 1516	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	50
PID 2940 wrote to memory of 1516	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	50
PID 2940 wrote to memory of 2400	2940	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	51

C:\Users\Admin\AppData\Local\Temp\3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\System\MweBxtQ.exe
  C:\Windows\System\MweBxtQ.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\QguhMwd.exe
  C:\Windows\System\QguhMwd.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\JjUaDzK.exe
  C:\Windows\System\JjUaDzK.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\StdxOAJ.exe
  C:\Windows\System\StdxOAJ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\yvbcorz.exe
  C:\Windows\System\yvbcorz.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\JoAtWKJ.exe
  C:\Windows\System\JoAtWKJ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\RQUiOxC.exe
  C:\Windows\System\RQUiOxC.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\KOjlfFR.exe
  C:\Windows\System\KOjlfFR.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\goRleml.exe
  C:\Windows\System\goRleml.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\LIBgRKr.exe
  C:\Windows\System\LIBgRKr.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\iggtePm.exe
  C:\Windows\System\iggtePm.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\CqGtItW.exe
  C:\Windows\System\CqGtItW.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\YYpqMnQ.exe
  C:\Windows\System\YYpqMnQ.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\QaTvwmL.exe
  C:\Windows\System\QaTvwmL.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\XiWMQXy.exe
  C:\Windows\System\XiWMQXy.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\PnSXLFc.exe
  C:\Windows\System\PnSXLFc.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\JGLJFgp.exe
  C:\Windows\System\JGLJFgp.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\ubKJarM.exe
  C:\Windows\System\ubKJarM.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\GDdQLsF.exe
  C:\Windows\System\GDdQLsF.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\DOirRzk.exe
  C:\Windows\System\DOirRzk.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\McLTCSU.exe
  C:\Windows\System\McLTCSU.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\QuHRvQV.exe
  C:\Windows\System\QuHRvQV.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\wLsbpcD.exe
  C:\Windows\System\wLsbpcD.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\zzhkGNn.exe
  C:\Windows\System\zzhkGNn.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\PPtcOnK.exe
  C:\Windows\System\PPtcOnK.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\EOESNbO.exe
  C:\Windows\System\EOESNbO.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\LlWouyt.exe
  C:\Windows\System\LlWouyt.exe
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Windows\System\uzSmTWO.exe
  C:\Windows\System\uzSmTWO.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\mIpYXDy.exe
  C:\Windows\System\mIpYXDy.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\OtVQZAe.exe
  C:\Windows\System\OtVQZAe.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\lbAtaeA.exe
  C:\Windows\System\lbAtaeA.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\kSByTAu.exe
  C:\Windows\System\kSByTAu.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\OuogiHV.exe
  C:\Windows\System\OuogiHV.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\lGlAyTh.exe
  C:\Windows\System\lGlAyTh.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\TznQWim.exe
  C:\Windows\System\TznQWim.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\yYSTYfd.exe
  C:\Windows\System\yYSTYfd.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\sjLVStw.exe
  C:\Windows\System\sjLVStw.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\ydecoOX.exe
  C:\Windows\System\ydecoOX.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\bcKDIHf.exe
  C:\Windows\System\bcKDIHf.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\GJjJwCV.exe
  C:\Windows\System\GJjJwCV.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\IRuDCkC.exe
  C:\Windows\System\IRuDCkC.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\eSAwyTe.exe
  C:\Windows\System\eSAwyTe.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\KZKrBGY.exe
  C:\Windows\System\KZKrBGY.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\QFVwIGx.exe
  C:\Windows\System\QFVwIGx.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\fiyvQGR.exe
  C:\Windows\System\fiyvQGR.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\CTolqAx.exe
  C:\Windows\System\CTolqAx.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\dHlmJzR.exe
  C:\Windows\System\dHlmJzR.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\HaqntwK.exe
  C:\Windows\System\HaqntwK.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\TBqeClh.exe
  C:\Windows\System\TBqeClh.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\aUzabLX.exe
  C:\Windows\System\aUzabLX.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\kfLlBtt.exe
  C:\Windows\System\kfLlBtt.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\jHFIffU.exe
  C:\Windows\System\jHFIffU.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\dMUnePc.exe
  C:\Windows\System\dMUnePc.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\IwyBUwO.exe
  C:\Windows\System\IwyBUwO.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\OLnZSgu.exe
  C:\Windows\System\OLnZSgu.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\iWLduni.exe
  C:\Windows\System\iWLduni.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\dNVwahL.exe
  C:\Windows\System\dNVwahL.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\RDIIEqX.exe
  C:\Windows\System\RDIIEqX.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\cqsZqwk.exe
  C:\Windows\System\cqsZqwk.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\OIcwMfq.exe
  C:\Windows\System\OIcwMfq.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\gxxzuMe.exe
  C:\Windows\System\gxxzuMe.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\cBLvzUG.exe
  C:\Windows\System\cBLvzUG.exe
  2⤵
  PID:1860
- C:\Windows\System\VysIXSh.exe
  C:\Windows\System\VysIXSh.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\KRemDSn.exe
  C:\Windows\System\KRemDSn.exe
  2⤵
  PID:2728
- C:\Windows\System\gSZAXsU.exe
  C:\Windows\System\gSZAXsU.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\GblZSqt.exe
  C:\Windows\System\GblZSqt.exe
  2⤵
  PID:1996
- C:\Windows\System\oxrcHQS.exe
  C:\Windows\System\oxrcHQS.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\pqPKBVz.exe
  C:\Windows\System\pqPKBVz.exe
  2⤵
  PID:2236
- C:\Windows\System\hNgCslM.exe
  C:\Windows\System\hNgCslM.exe
  2⤵
  PID:892
- C:\Windows\System\fNeThWv.exe
  C:\Windows\System\fNeThWv.exe
  2⤵
  PID:1132
- C:\Windows\System\XbWcwoJ.exe
  C:\Windows\System\XbWcwoJ.exe
  2⤵
  PID:2852
- C:\Windows\System\ECCfVtK.exe
  C:\Windows\System\ECCfVtK.exe
  2⤵
  PID:1392
- C:\Windows\System\pxLeROt.exe
  C:\Windows\System\pxLeROt.exe
  2⤵
  PID:2120
- C:\Windows\System\dcReeup.exe
  C:\Windows\System\dcReeup.exe
  2⤵
  PID:2136
- C:\Windows\System\kRwqRxc.exe
  C:\Windows\System\kRwqRxc.exe
  2⤵
  PID:3052
- C:\Windows\System\VHTYyOA.exe
  C:\Windows\System\VHTYyOA.exe
  2⤵
  PID:1740
- C:\Windows\System\Rfwtypx.exe
  C:\Windows\System\Rfwtypx.exe
  2⤵
  PID:344
- C:\Windows\System\VUkVZXo.exe
  C:\Windows\System\VUkVZXo.exe
  2⤵
  PID:884
- C:\Windows\System\oChWwdX.exe
  C:\Windows\System\oChWwdX.exe
  2⤵
  PID:2820
- C:\Windows\System\icPmtcZ.exe
  C:\Windows\System\icPmtcZ.exe
  2⤵
  PID:2844
- C:\Windows\System\KhRZHbf.exe
  C:\Windows\System\KhRZHbf.exe
  2⤵
  PID:548
- C:\Windows\System\UObbMRE.exe
  C:\Windows\System\UObbMRE.exe
  2⤵
  PID:2712
- C:\Windows\System\fQUxrxv.exe
  C:\Windows\System\fQUxrxv.exe
  2⤵
  PID:3020
- C:\Windows\System\phNnKgy.exe
  C:\Windows\System\phNnKgy.exe
  2⤵
  PID:2396
- C:\Windows\System\epcdAFd.exe
  C:\Windows\System\epcdAFd.exe
  2⤵
  PID:2420
- C:\Windows\System\TzdMFyR.exe
  C:\Windows\System\TzdMFyR.exe
  2⤵
  PID:2076
- C:\Windows\System\VAyUwVY.exe
  C:\Windows\System\VAyUwVY.exe
  2⤵
  PID:2428
- C:\Windows\System\gchPnqQ.exe
  C:\Windows\System\gchPnqQ.exe
  2⤵
  PID:1684
- C:\Windows\System\qBXzpBl.exe
  C:\Windows\System\qBXzpBl.exe
  2⤵
  PID:2944
- C:\Windows\System\HXvPKFW.exe
  C:\Windows\System\HXvPKFW.exe
  2⤵
  PID:2252
- C:\Windows\System\CzsTQvk.exe
  C:\Windows\System\CzsTQvk.exe
  2⤵
  PID:2808
- C:\Windows\System\XWrYFgQ.exe
  C:\Windows\System\XWrYFgQ.exe
  2⤵
  PID:2916
- C:\Windows\System\TcTqrLE.exe
  C:\Windows\System\TcTqrLE.exe
  2⤵
  PID:1812
- C:\Windows\System\dkPxjGu.exe
  C:\Windows\System\dkPxjGu.exe
  2⤵
  PID:2572
- C:\Windows\System\qkGzuVf.exe
  C:\Windows\System\qkGzuVf.exe
  2⤵
  PID:1896
- C:\Windows\System\ljvyDOi.exe
  C:\Windows\System\ljvyDOi.exe
  2⤵
  PID:1992
- C:\Windows\System\iuYsSpf.exe
  C:\Windows\System\iuYsSpf.exe
  2⤵
  PID:3024
- C:\Windows\System\RYGKoAN.exe
  C:\Windows\System\RYGKoAN.exe
  2⤵
  PID:2816
- C:\Windows\System\MMwYVvN.exe
  C:\Windows\System\MMwYVvN.exe
  2⤵
  PID:2064
- C:\Windows\System\ZzdBQse.exe
  C:\Windows\System\ZzdBQse.exe
  2⤵
  PID:2700
- C:\Windows\System\zKoizJT.exe
  C:\Windows\System\zKoizJT.exe
  2⤵
  PID:600
- C:\Windows\System\sUaaMmD.exe
  C:\Windows\System\sUaaMmD.exe
  2⤵
  PID:2612
- C:\Windows\System\jgrwyAK.exe
  C:\Windows\System\jgrwyAK.exe
  2⤵
  PID:2024
- C:\Windows\System\etfRpql.exe
  C:\Windows\System\etfRpql.exe
  2⤵
  PID:1576
- C:\Windows\System\bSLOzhD.exe
  C:\Windows\System\bSLOzhD.exe
  2⤵
  PID:1728
- C:\Windows\System\HzsiteV.exe
  C:\Windows\System\HzsiteV.exe
  2⤵
  PID:1640
- C:\Windows\System\YLlUUPK.exe
  C:\Windows\System\YLlUUPK.exe
  2⤵
  PID:684
- C:\Windows\System\tmFbtgk.exe
  C:\Windows\System\tmFbtgk.exe
  2⤵
  PID:440
- C:\Windows\System\yoklMge.exe
  C:\Windows\System\yoklMge.exe
  2⤵
  PID:1972
- C:\Windows\System\iJsCEmi.exe
  C:\Windows\System\iJsCEmi.exe
  2⤵
  PID:2764
- C:\Windows\System\aGJInxs.exe
  C:\Windows\System\aGJInxs.exe
  2⤵
  PID:2840
- C:\Windows\System\dYPWgdH.exe
  C:\Windows\System\dYPWgdH.exe
  2⤵
  PID:1780
- C:\Windows\System\BeBjRMJ.exe
  C:\Windows\System\BeBjRMJ.exe
  2⤵
  PID:1196
- C:\Windows\System\GaLmPev.exe
  C:\Windows\System\GaLmPev.exe
  2⤵
  PID:2224
- C:\Windows\System\eGIkIGH.exe
  C:\Windows\System\eGIkIGH.exe
  2⤵
  PID:1708
- C:\Windows\System\pEeUNaU.exe
  C:\Windows\System\pEeUNaU.exe
  2⤵
  PID:1652
- C:\Windows\System\ufapwoq.exe
  C:\Windows\System\ufapwoq.exe
  2⤵
  PID:2828
- C:\Windows\System\QTpJAtP.exe
  C:\Windows\System\QTpJAtP.exe
  2⤵
  PID:2028
- C:\Windows\System\dslwRSP.exe
  C:\Windows\System\dslwRSP.exe
  2⤵
  PID:1192
- C:\Windows\System\hWdCFQa.exe
  C:\Windows\System\hWdCFQa.exe
  2⤵
  PID:2704
- C:\Windows\System\mvfeNgv.exe
  C:\Windows\System\mvfeNgv.exe
  2⤵
  PID:2580
- C:\Windows\System\bKvxNTH.exe
  C:\Windows\System\bKvxNTH.exe
  2⤵
  PID:2660
- C:\Windows\System\DxesRbR.exe
  C:\Windows\System\DxesRbR.exe
  2⤵
  PID:1948
- C:\Windows\System\OfVZymg.exe
  C:\Windows\System\OfVZymg.exe
  2⤵
  PID:1492
- C:\Windows\System\XUgroHY.exe
  C:\Windows\System\XUgroHY.exe
  2⤵
  PID:1716
- C:\Windows\System\SJIGpPy.exe
  C:\Windows\System\SJIGpPy.exe
  2⤵
  PID:2624
- C:\Windows\System\spbcQUq.exe
  C:\Windows\System\spbcQUq.exe
  2⤵
  PID:740
- C:\Windows\System\bzYunyD.exe
  C:\Windows\System\bzYunyD.exe
  2⤵
  PID:1340
- C:\Windows\System\VVpJZqM.exe
  C:\Windows\System\VVpJZqM.exe
  2⤵
  PID:2656
- C:\Windows\System\jYdtyXX.exe
  C:\Windows\System\jYdtyXX.exe
  2⤵
  PID:2092
- C:\Windows\System\iKbpIaU.exe
  C:\Windows\System\iKbpIaU.exe
  2⤵
  PID:2604
- C:\Windows\System\NrugPiZ.exe
  C:\Windows\System\NrugPiZ.exe
  2⤵
  PID:2516
- C:\Windows\System\LBkLlME.exe
  C:\Windows\System\LBkLlME.exe
  2⤵
  PID:2972
- C:\Windows\System\uanSXeo.exe
  C:\Windows\System\uanSXeo.exe
  2⤵
  PID:1440
- C:\Windows\System\bcBkOev.exe
  C:\Windows\System\bcBkOev.exe
  2⤵
  PID:1984
- C:\Windows\System\llcRIdN.exe
  C:\Windows\System\llcRIdN.exe
  2⤵
  PID:2568
- C:\Windows\System\fDDcmZW.exe
  C:\Windows\System\fDDcmZW.exe
  2⤵
  PID:2524
- C:\Windows\System\GzNPRrt.exe
  C:\Windows\System\GzNPRrt.exe
  2⤵
  PID:3076
- C:\Windows\System\RszScsH.exe
  C:\Windows\System\RszScsH.exe
  2⤵
  PID:3092
- C:\Windows\System\VcFRXhn.exe
  C:\Windows\System\VcFRXhn.exe
  2⤵
  PID:3112
- C:\Windows\System\ddApIIu.exe
  C:\Windows\System\ddApIIu.exe
  2⤵
  PID:3128
- C:\Windows\System\bLsROaZ.exe
  C:\Windows\System\bLsROaZ.exe
  2⤵
  PID:3148
- C:\Windows\System\mnqpfKk.exe
  C:\Windows\System\mnqpfKk.exe
  2⤵
  PID:3172
- C:\Windows\System\QMcUJLH.exe
  C:\Windows\System\QMcUJLH.exe
  2⤵
  PID:3188
- C:\Windows\System\psBQJld.exe
  C:\Windows\System\psBQJld.exe
  2⤵
  PID:3204
- C:\Windows\System\ZAZxCwT.exe
  C:\Windows\System\ZAZxCwT.exe
  2⤵
  PID:3220
- C:\Windows\System\rfjmdKE.exe
  C:\Windows\System\rfjmdKE.exe
  2⤵
  PID:3236
- C:\Windows\System\AsfMJzV.exe
  C:\Windows\System\AsfMJzV.exe
  2⤵
  PID:3256
- C:\Windows\System\TFFPCMQ.exe
  C:\Windows\System\TFFPCMQ.exe
  2⤵
  PID:3308
- C:\Windows\System\TAiFnec.exe
  C:\Windows\System\TAiFnec.exe
  2⤵
  PID:3344
- C:\Windows\System\KVWOiMh.exe
  C:\Windows\System\KVWOiMh.exe
  2⤵
  PID:3364
- C:\Windows\System\pcqzwTf.exe
  C:\Windows\System\pcqzwTf.exe
  2⤵
  PID:3380
- C:\Windows\System\GvUgXhZ.exe
  C:\Windows\System\GvUgXhZ.exe
  2⤵
  PID:3396
- C:\Windows\System\FrKHgZf.exe
  C:\Windows\System\FrKHgZf.exe
  2⤵
  PID:3412
- C:\Windows\System\YEXrHEO.exe
  C:\Windows\System\YEXrHEO.exe
  2⤵
  PID:3444
- C:\Windows\System\iASjfJl.exe
  C:\Windows\System\iASjfJl.exe
  2⤵
  PID:3460
- C:\Windows\System\LmFLcLB.exe
  C:\Windows\System\LmFLcLB.exe
  2⤵
  PID:3480
- C:\Windows\System\ikSDFTq.exe
  C:\Windows\System\ikSDFTq.exe
  2⤵
  PID:3496
- C:\Windows\System\aJHQpTO.exe
  C:\Windows\System\aJHQpTO.exe
  2⤵
  PID:3516
- C:\Windows\System\WKNKPOk.exe
  C:\Windows\System\WKNKPOk.exe
  2⤵
  PID:3532
- C:\Windows\System\kfNOyiN.exe
  C:\Windows\System\kfNOyiN.exe
  2⤵
  PID:3548
- C:\Windows\System\cZAAeay.exe
  C:\Windows\System\cZAAeay.exe
  2⤵
  PID:3576
- C:\Windows\System\bDmfpmb.exe
  C:\Windows\System\bDmfpmb.exe
  2⤵
  PID:3592
- C:\Windows\System\iiePAze.exe
  C:\Windows\System\iiePAze.exe
  2⤵
  PID:3628
- C:\Windows\System\tjgroLn.exe
  C:\Windows\System\tjgroLn.exe
  2⤵
  PID:3644
- C:\Windows\System\Lnveotq.exe
  C:\Windows\System\Lnveotq.exe
  2⤵
  PID:3664
- C:\Windows\System\NJBXbIU.exe
  C:\Windows\System\NJBXbIU.exe
  2⤵
  PID:3684
- C:\Windows\System\UTYMmGv.exe
  C:\Windows\System\UTYMmGv.exe
  2⤵
  PID:3700
- C:\Windows\System\DoekYZE.exe
  C:\Windows\System\DoekYZE.exe
  2⤵
  PID:3716
- C:\Windows\System\EfMvQOG.exe
  C:\Windows\System\EfMvQOG.exe
  2⤵
  PID:3732
- C:\Windows\System\VndQhMT.exe
  C:\Windows\System\VndQhMT.exe
  2⤵
  PID:3748
- C:\Windows\System\swriCAS.exe
  C:\Windows\System\swriCAS.exe
  2⤵
  PID:3764
- C:\Windows\System\XhhCBwp.exe
  C:\Windows\System\XhhCBwp.exe
  2⤵
  PID:3784
- C:\Windows\System\fIzBwfr.exe
  C:\Windows\System\fIzBwfr.exe
  2⤵
  PID:3800
- C:\Windows\System\kGbIvyn.exe
  C:\Windows\System\kGbIvyn.exe
  2⤵
  PID:3840
- C:\Windows\System\bNMhYur.exe
  C:\Windows\System\bNMhYur.exe
  2⤵
  PID:3856
- C:\Windows\System\cfGXdxp.exe
  C:\Windows\System\cfGXdxp.exe
  2⤵
  PID:3872
- C:\Windows\System\NciyktZ.exe
  C:\Windows\System\NciyktZ.exe
  2⤵
  PID:3892
- C:\Windows\System\oxVvxIn.exe
  C:\Windows\System\oxVvxIn.exe
  2⤵
  PID:3908
- C:\Windows\System\JisCOlp.exe
  C:\Windows\System\JisCOlp.exe
  2⤵
  PID:3924
- C:\Windows\System\rEDjbln.exe
  C:\Windows\System\rEDjbln.exe
  2⤵
  PID:3940
- C:\Windows\System\JejDrcw.exe
  C:\Windows\System\JejDrcw.exe
  2⤵
  PID:3956
- C:\Windows\System\BSsxvjJ.exe
  C:\Windows\System\BSsxvjJ.exe
  2⤵
  PID:3972
- C:\Windows\System\kJMQlOM.exe
  C:\Windows\System\kJMQlOM.exe
  2⤵
  PID:3988
- C:\Windows\System\hmnaXtX.exe
  C:\Windows\System\hmnaXtX.exe
  2⤵
  PID:4004
- C:\Windows\System\wXGNkBu.exe
  C:\Windows\System\wXGNkBu.exe
  2⤵
  PID:4024
- C:\Windows\System\EnNbIqb.exe
  C:\Windows\System\EnNbIqb.exe
  2⤵
  PID:4040
- C:\Windows\System\LCTbbUd.exe
  C:\Windows\System\LCTbbUd.exe
  2⤵
  PID:4056
- C:\Windows\System\AGoKLgI.exe
  C:\Windows\System\AGoKLgI.exe
  2⤵
  PID:4072
- C:\Windows\System\xFjLeme.exe
  C:\Windows\System\xFjLeme.exe
  2⤵
  PID:4088
- C:\Windows\System\ocRRcpz.exe
  C:\Windows\System\ocRRcpz.exe
  2⤵
  PID:1844
- C:\Windows\System\DXuZEAu.exe
  C:\Windows\System\DXuZEAu.exe
  2⤵
  PID:3108
- C:\Windows\System\QQkMNqU.exe
  C:\Windows\System\QQkMNqU.exe
  2⤵
  PID:2636
- C:\Windows\System\soEMTKA.exe
  C:\Windows\System\soEMTKA.exe
  2⤵
  PID:2620
- C:\Windows\System\zxqVPFA.exe
  C:\Windows\System\zxqVPFA.exe
  2⤵
  PID:3144
- C:\Windows\System\npArsBw.exe
  C:\Windows\System\npArsBw.exe
  2⤵
  PID:3216
- C:\Windows\System\MgNEMsJ.exe
  C:\Windows\System\MgNEMsJ.exe
  2⤵
  PID:2556
- C:\Windows\System\SrmbUgK.exe
  C:\Windows\System\SrmbUgK.exe
  2⤵
  PID:1524
- C:\Windows\System\nsfBHrl.exe
  C:\Windows\System\nsfBHrl.exe
  2⤵
  PID:492
- C:\Windows\System\ZDveICe.exe
  C:\Windows\System\ZDveICe.exe
  2⤵
  PID:1532
- C:\Windows\System\dxpIaOH.exe
  C:\Windows\System\dxpIaOH.exe
  2⤵
  PID:1444
- C:\Windows\System\SEVElNU.exe
  C:\Windows\System\SEVElNU.exe
  2⤵
  PID:3228
- C:\Windows\System\iuLOhQp.exe
  C:\Windows\System\iuLOhQp.exe
  2⤵
  PID:3268
- C:\Windows\System\GiqDDuq.exe
  C:\Windows\System\GiqDDuq.exe
  2⤵
  PID:3276
- C:\Windows\System\hRcIcno.exe
  C:\Windows\System\hRcIcno.exe
  2⤵
  PID:3284
- C:\Windows\System\PiluyMH.exe
  C:\Windows\System\PiluyMH.exe
  2⤵
  PID:908
- C:\Windows\System\ddVCVSx.exe
  C:\Windows\System\ddVCVSx.exe
  2⤵
  PID:1080
- C:\Windows\System\ZiBTtPL.exe
  C:\Windows\System\ZiBTtPL.exe
  2⤵
  PID:2832
- C:\Windows\System\FPvsNGX.exe
  C:\Windows\System\FPvsNGX.exe
  2⤵
  PID:944
- C:\Windows\System\xxiyZMU.exe
  C:\Windows\System\xxiyZMU.exe
  2⤵
  PID:1480
- C:\Windows\System\RZzLYMr.exe
  C:\Windows\System\RZzLYMr.exe
  2⤵
  PID:2384
- C:\Windows\System\NYSLAIj.exe
  C:\Windows\System\NYSLAIj.exe
  2⤵
  PID:680
- C:\Windows\System\bXPhasp.exe
  C:\Windows\System\bXPhasp.exe
  2⤵
  PID:3352
- C:\Windows\System\RawbwoY.exe
  C:\Windows\System\RawbwoY.exe
  2⤵
  PID:2792
- C:\Windows\System\BzFCUDa.exe
  C:\Windows\System\BzFCUDa.exe
  2⤵
  PID:3420
- C:\Windows\System\pejKHtl.exe
  C:\Windows\System\pejKHtl.exe
  2⤵
  PID:3432
- C:\Windows\System\XrPmYcZ.exe
  C:\Windows\System\XrPmYcZ.exe
  2⤵
  PID:3544
- C:\Windows\System\hGNzIZL.exe
  C:\Windows\System\hGNzIZL.exe
  2⤵
  PID:3564
- C:\Windows\System\pnhFEud.exe
  C:\Windows\System\pnhFEud.exe
  2⤵
  PID:3492
- C:\Windows\System\dMMosMf.exe
  C:\Windows\System\dMMosMf.exe
  2⤵
  PID:3608
- C:\Windows\System\ivPouLQ.exe
  C:\Windows\System\ivPouLQ.exe
  2⤵
  PID:3612
- C:\Windows\System\HUgWVnf.exe
  C:\Windows\System\HUgWVnf.exe
  2⤵
  PID:3640
- C:\Windows\System\ariebLN.exe
  C:\Windows\System\ariebLN.exe
  2⤵
  PID:3696
- C:\Windows\System\WgvpRxc.exe
  C:\Windows\System\WgvpRxc.exe
  2⤵
  PID:3812
- C:\Windows\System\DVdGQtL.exe
  C:\Windows\System\DVdGQtL.exe
  2⤵
  PID:3820
- C:\Windows\System\CkVhCBZ.exe
  C:\Windows\System\CkVhCBZ.exe
  2⤵
  PID:3904
- C:\Windows\System\GqnRahC.exe
  C:\Windows\System\GqnRahC.exe
  2⤵
  PID:3968
- C:\Windows\System\QqVMuGf.exe
  C:\Windows\System\QqVMuGf.exe
  2⤵
  PID:3792
- C:\Windows\System\VLhQvRq.exe
  C:\Windows\System\VLhQvRq.exe
  2⤵
  PID:4036
- C:\Windows\System\ATnkfOu.exe
  C:\Windows\System\ATnkfOu.exe
  2⤵
  PID:880
- C:\Windows\System\cSiLcWK.exe
  C:\Windows\System\cSiLcWK.exe
  2⤵
  PID:3136
- C:\Windows\System\ewhnhMz.exe
  C:\Windows\System\ewhnhMz.exe
  2⤵
  PID:2468
- C:\Windows\System\xikWInF.exe
  C:\Windows\System\xikWInF.exe
  2⤵
  PID:2520
- C:\Windows\System\YZoEQmG.exe
  C:\Windows\System\YZoEQmG.exe
  2⤵
  PID:3280
- C:\Windows\System\taEXaKW.exe
  C:\Windows\System\taEXaKW.exe
  2⤵
  PID:3848
- C:\Windows\System\cbTQxDR.exe
  C:\Windows\System\cbTQxDR.exe
  2⤵
  PID:628
- C:\Windows\System\ABbywfW.exe
  C:\Windows\System\ABbywfW.exe
  2⤵
  PID:3920
- C:\Windows\System\IYztTWw.exe
  C:\Windows\System\IYztTWw.exe
  2⤵
  PID:4012
- C:\Windows\System\MyYufRC.exe
  C:\Windows\System\MyYufRC.exe
  2⤵
  PID:4052
- C:\Windows\System\vMhbJkI.exe
  C:\Windows\System\vMhbJkI.exe
  2⤵
  PID:532
- C:\Windows\System\YEFXbll.exe
  C:\Windows\System\YEFXbll.exe
  2⤵
  PID:2132
- C:\Windows\System\vQJRSlR.exe
  C:\Windows\System\vQJRSlR.exe
  2⤵
  PID:3404
- C:\Windows\System\IKvZmKN.exe
  C:\Windows\System\IKvZmKN.exe
  2⤵
  PID:3120
- C:\Windows\System\SUBuyGB.exe
  C:\Windows\System\SUBuyGB.exe
  2⤵
  PID:3296
- C:\Windows\System\LTBtzDZ.exe
  C:\Windows\System\LTBtzDZ.exe
  2⤵
  PID:1968
- C:\Windows\System\bayKCCS.exe
  C:\Windows\System\bayKCCS.exe
  2⤵
  PID:1916
- C:\Windows\System\nVpcwjG.exe
  C:\Windows\System\nVpcwjG.exe
  2⤵
  PID:1628
- C:\Windows\System\lDDEWcB.exe
  C:\Windows\System\lDDEWcB.exe
  2⤵
  PID:2856
- C:\Windows\System\UGMXrKT.exe
  C:\Windows\System\UGMXrKT.exe
  2⤵
  PID:1368
- C:\Windows\System\VUVlsrH.exe
  C:\Windows\System\VUVlsrH.exe
  2⤵
  PID:3356
- C:\Windows\System\tYYSdGT.exe
  C:\Windows\System\tYYSdGT.exe
  2⤵
  PID:664
- C:\Windows\System\xhMvglP.exe
  C:\Windows\System\xhMvglP.exe
  2⤵
  PID:3472
- C:\Windows\System\BeUgoRx.exe
  C:\Windows\System\BeUgoRx.exe
  2⤵
  PID:3540
- C:\Windows\System\ZyEpCPv.exe
  C:\Windows\System\ZyEpCPv.exe
  2⤵
  PID:3560
- C:\Windows\System\oZlosxR.exe
  C:\Windows\System\oZlosxR.exe
  2⤵
  PID:3620
- C:\Windows\System\jHwwfSv.exe
  C:\Windows\System\jHwwfSv.exe
  2⤵
  PID:3672
- C:\Windows\System\ropMdMA.exe
  C:\Windows\System\ropMdMA.exe
  2⤵
  PID:3676
- C:\Windows\System\rHXHhlK.exe
  C:\Windows\System\rHXHhlK.exe
  2⤵
  PID:3660
- C:\Windows\System\PeduLZv.exe
  C:\Windows\System\PeduLZv.exe
  2⤵
  PID:3772
- C:\Windows\System\NbBcHOP.exe
  C:\Windows\System\NbBcHOP.exe
  2⤵
  PID:4048
- C:\Windows\System\BVlMzsN.exe
  C:\Windows\System\BVlMzsN.exe
  2⤵
  PID:2632
- C:\Windows\System\LBfBEgv.exe
  C:\Windows\System\LBfBEgv.exe
  2⤵
  PID:2920
- C:\Windows\System\JOPsqnw.exe
  C:\Windows\System\JOPsqnw.exe
  2⤵
  PID:4068
- C:\Windows\System\ATCzSDp.exe
  C:\Windows\System\ATCzSDp.exe
  2⤵
  PID:2584
- C:\Windows\System\pQxCCCc.exe
  C:\Windows\System\pQxCCCc.exe
  2⤵
  PID:3984
- C:\Windows\System\NABdeDg.exe
  C:\Windows\System\NABdeDg.exe
  2⤵
  PID:3124
- C:\Windows\System\tyqVDot.exe
  C:\Windows\System\tyqVDot.exe
  2⤵
  PID:2392
- C:\Windows\System\wdmbGyF.exe
  C:\Windows\System\wdmbGyF.exe
  2⤵
  PID:3392
- C:\Windows\System\TgMKtvA.exe
  C:\Windows\System\TgMKtvA.exe
  2⤵
  PID:3528
- C:\Windows\System\nShZtJc.exe
  C:\Windows\System\nShZtJc.exe
  2⤵
  PID:3408
- C:\Windows\System\hrrcKFW.exe
  C:\Windows\System\hrrcKFW.exe
  2⤵
  PID:3252
- C:\Windows\System\pnSJTPa.exe
  C:\Windows\System\pnSJTPa.exe
  2⤵
  PID:1804
- C:\Windows\System\FnwNJGN.exe
  C:\Windows\System\FnwNJGN.exe
  2⤵
  PID:3164
- C:\Windows\System\BAYfxAf.exe
  C:\Windows\System\BAYfxAf.exe
  2⤵
  PID:3340
- C:\Windows\System\wZyrsyk.exe
  C:\Windows\System\wZyrsyk.exe
  2⤵
  PID:2716
- C:\Windows\System\CBQcBBu.exe
  C:\Windows\System\CBQcBBu.exe
  2⤵
  PID:1856
- C:\Windows\System\OchWmYB.exe
  C:\Windows\System\OchWmYB.exe
  2⤵
  PID:3728
- C:\Windows\System\rYhnIej.exe
  C:\Windows\System\rYhnIej.exe
  2⤵
  PID:3776
- C:\Windows\System\VCZHoAs.exe
  C:\Windows\System\VCZHoAs.exe
  2⤵
  PID:2412
- C:\Windows\System\IzEIWoN.exe
  C:\Windows\System\IzEIWoN.exe
  2⤵
  PID:3948
- C:\Windows\System\BDsvoah.exe
  C:\Windows\System\BDsvoah.exe
  2⤵
  PID:4000
- C:\Windows\System\NAtjgdx.exe
  C:\Windows\System\NAtjgdx.exe
  2⤵
  PID:3272
- C:\Windows\System\lVUItUK.exe
  C:\Windows\System\lVUItUK.exe
  2⤵
  PID:3200
- C:\Windows\System\GQjTbOV.exe
  C:\Windows\System\GQjTbOV.exe
  2⤵
  PID:2732
- C:\Windows\System\tzFQRgR.exe
  C:\Windows\System\tzFQRgR.exe
  2⤵
  PID:3600
- C:\Windows\System\WFBAJVj.exe
  C:\Windows\System\WFBAJVj.exe
  2⤵
  PID:536
- C:\Windows\System\nNbyIzZ.exe
  C:\Windows\System\nNbyIzZ.exe
  2⤵
  PID:3324
- C:\Windows\System\VgdUIeu.exe
  C:\Windows\System\VgdUIeu.exe
  2⤵
  PID:2332
- C:\Windows\System\HHrHWvy.exe
  C:\Windows\System\HHrHWvy.exe
  2⤵
  PID:3708
- C:\Windows\System\vefqycj.exe
  C:\Windows\System\vefqycj.exe
  2⤵
  PID:3156
- C:\Windows\System\MDovdAH.exe
  C:\Windows\System\MDovdAH.exe
  2⤵
  PID:1496
- C:\Windows\System\PnqSULv.exe
  C:\Windows\System\PnqSULv.exe
  2⤵
  PID:3780
- C:\Windows\System\RlCgXPv.exe
  C:\Windows\System\RlCgXPv.exe
  2⤵
  PID:3740
- C:\Windows\System\yjJnFai.exe
  C:\Windows\System\yjJnFai.exe
  2⤵
  PID:1908
- C:\Windows\System\pEpAnux.exe
  C:\Windows\System\pEpAnux.exe
  2⤵
  PID:304
- C:\Windows\System\CfSpxlx.exe
  C:\Windows\System\CfSpxlx.exe
  2⤵
  PID:4108
- C:\Windows\System\fFTvPta.exe
  C:\Windows\System\fFTvPta.exe
  2⤵
  PID:4124
- C:\Windows\System\mqAZOyD.exe
  C:\Windows\System\mqAZOyD.exe
  2⤵
  PID:4140
- C:\Windows\System\UAsTRVz.exe
  C:\Windows\System\UAsTRVz.exe
  2⤵
  PID:4200
- C:\Windows\System\oitKwAE.exe
  C:\Windows\System\oitKwAE.exe
  2⤵
  PID:4236
- C:\Windows\System\hDlnDkx.exe
  C:\Windows\System\hDlnDkx.exe
  2⤵
  PID:4252
- C:\Windows\System\UIaimAq.exe
  C:\Windows\System\UIaimAq.exe
  2⤵
  PID:4268
- C:\Windows\System\EeKpWeV.exe
  C:\Windows\System\EeKpWeV.exe
  2⤵
  PID:4284
- C:\Windows\System\XKCAvXc.exe
  C:\Windows\System\XKCAvXc.exe
  2⤵
  PID:4312
- C:\Windows\System\FjXCEIV.exe
  C:\Windows\System\FjXCEIV.exe
  2⤵
  PID:4328
- C:\Windows\System\YyVYFlL.exe
  C:\Windows\System\YyVYFlL.exe
  2⤵
  PID:4352
- C:\Windows\System\USUTxdR.exe
  C:\Windows\System\USUTxdR.exe
  2⤵
  PID:4368
- C:\Windows\System\lPMYxJS.exe
  C:\Windows\System\lPMYxJS.exe
  2⤵
  PID:4388
- C:\Windows\System\FBbqImt.exe
  C:\Windows\System\FBbqImt.exe
  2⤵
  PID:4404
- C:\Windows\System\qrYmTzw.exe
  C:\Windows\System\qrYmTzw.exe
  2⤵
  PID:4420
- C:\Windows\System\ZodcMJQ.exe
  C:\Windows\System\ZodcMJQ.exe
  2⤵
  PID:4448
- C:\Windows\System\djmZAPc.exe
  C:\Windows\System\djmZAPc.exe
  2⤵
  PID:4468
- C:\Windows\System\ZGYmboz.exe
  C:\Windows\System\ZGYmboz.exe
  2⤵
  PID:4488
- C:\Windows\System\YyktNuS.exe
  C:\Windows\System\YyktNuS.exe
  2⤵
  PID:4508
- C:\Windows\System\lreYHPu.exe
  C:\Windows\System\lreYHPu.exe
  2⤵
  PID:4532
- C:\Windows\System\oOTQLgZ.exe
  C:\Windows\System\oOTQLgZ.exe
  2⤵
  PID:4552
- C:\Windows\System\NpYHVah.exe
  C:\Windows\System\NpYHVah.exe
  2⤵
  PID:4576
- C:\Windows\System\GLLxBOn.exe
  C:\Windows\System\GLLxBOn.exe
  2⤵
  PID:4604
- C:\Windows\System\WlDULAC.exe
  C:\Windows\System\WlDULAC.exe
  2⤵
  PID:4628
- C:\Windows\System\lMCLCBz.exe
  C:\Windows\System\lMCLCBz.exe
  2⤵
  PID:4652
- C:\Windows\System\EhMiAaA.exe
  C:\Windows\System\EhMiAaA.exe
  2⤵
  PID:4676
- C:\Windows\System\WcHKdQT.exe
  C:\Windows\System\WcHKdQT.exe
  2⤵
  PID:4696
- C:\Windows\System\bjhBktj.exe
  C:\Windows\System\bjhBktj.exe
  2⤵
  PID:4712
- C:\Windows\System\YyDHbCp.exe
  C:\Windows\System\YyDHbCp.exe
  2⤵
  PID:4728
- C:\Windows\System\YBmYchj.exe
  C:\Windows\System\YBmYchj.exe
  2⤵
  PID:4744
- C:\Windows\System\lcCdAgN.exe
  C:\Windows\System\lcCdAgN.exe
  2⤵
  PID:4800
- C:\Windows\System\wAFgxhC.exe
  C:\Windows\System\wAFgxhC.exe
  2⤵
  PID:4816
- C:\Windows\System\qSBzcNy.exe
  C:\Windows\System\qSBzcNy.exe
  2⤵
  PID:4836
- C:\Windows\System\iDQpBod.exe
  C:\Windows\System\iDQpBod.exe
  2⤵
  PID:4852
- C:\Windows\System\vCZWkaj.exe
  C:\Windows\System\vCZWkaj.exe
  2⤵
  PID:4936
- C:\Windows\System\shaUzFv.exe
  C:\Windows\System\shaUzFv.exe
  2⤵
  PID:4952
- C:\Windows\System\YRHxwFY.exe
  C:\Windows\System\YRHxwFY.exe
  2⤵
  PID:4972
- C:\Windows\System\xBgYTsG.exe
  C:\Windows\System\xBgYTsG.exe
  2⤵
  PID:4988
- C:\Windows\System\pjOJfIO.exe
  C:\Windows\System\pjOJfIO.exe
  2⤵
  PID:5004
- C:\Windows\System\yCqkzOI.exe
  C:\Windows\System\yCqkzOI.exe
  2⤵
  PID:5024
- C:\Windows\System\JyYqGQb.exe
  C:\Windows\System\JyYqGQb.exe
  2⤵
  PID:5040
- C:\Windows\System\TUKdAUw.exe
  C:\Windows\System\TUKdAUw.exe
  2⤵
  PID:5056
- C:\Windows\System\vqdMDdo.exe
  C:\Windows\System\vqdMDdo.exe
  2⤵
  PID:5076
- C:\Windows\System\tkyHdBj.exe
  C:\Windows\System\tkyHdBj.exe
  2⤵
  PID:5092
- C:\Windows\System\ZGcCicl.exe
  C:\Windows\System\ZGcCicl.exe
  2⤵
  PID:5108
- C:\Windows\System\wAjLwpy.exe
  C:\Windows\System\wAjLwpy.exe
  2⤵
  PID:3428
- C:\Windows\System\yXLMHdv.exe
  C:\Windows\System\yXLMHdv.exe
  2⤵
  PID:4136
- C:\Windows\System\GZEGQXK.exe
  C:\Windows\System\GZEGQXK.exe
  2⤵
  PID:3724
- C:\Windows\System\mHlrznO.exe
  C:\Windows\System\mHlrznO.exe
  2⤵
  PID:3828
- C:\Windows\System\MDCIQux.exe
  C:\Windows\System\MDCIQux.exe
  2⤵
  PID:3524
- C:\Windows\System\FQoWVeZ.exe
  C:\Windows\System\FQoWVeZ.exe
  2⤵
  PID:4032
- C:\Windows\System\YiTyzbO.exe
  C:\Windows\System\YiTyzbO.exe
  2⤵
  PID:4172
- C:\Windows\System\LYVfaav.exe
  C:\Windows\System\LYVfaav.exe
  2⤵
  PID:4192
- C:\Windows\System\utTAtaP.exe
  C:\Windows\System\utTAtaP.exe
  2⤵
  PID:4208
- C:\Windows\System\CDzusCg.exe
  C:\Windows\System\CDzusCg.exe
  2⤵
  PID:4228
- C:\Windows\System\yJqngww.exe
  C:\Windows\System\yJqngww.exe
  2⤵
  PID:4260
- C:\Windows\System\brDCILe.exe
  C:\Windows\System\brDCILe.exe
  2⤵
  PID:4300
- C:\Windows\System\JGXhqkA.exe
  C:\Windows\System\JGXhqkA.exe
  2⤵
  PID:4296
- C:\Windows\System\gDMnEoO.exe
  C:\Windows\System\gDMnEoO.exe
  2⤵
  PID:4324
- C:\Windows\System\RySJgpf.exe
  C:\Windows\System\RySJgpf.exe
  2⤵
  PID:4384
- C:\Windows\System\XMidsWU.exe
  C:\Windows\System\XMidsWU.exe
  2⤵
  PID:4396
- C:\Windows\System\NbTwMWe.exe
  C:\Windows\System\NbTwMWe.exe
  2⤵
  PID:4412
- C:\Windows\System\FMSUGJt.exe
  C:\Windows\System\FMSUGJt.exe
  2⤵
  PID:4444
- C:\Windows\System\SDusphU.exe
  C:\Windows\System\SDusphU.exe
  2⤵
  PID:4516
- C:\Windows\System\ylTzewJ.exe
  C:\Windows\System\ylTzewJ.exe
  2⤵
  PID:4456
- C:\Windows\System\DxsJWwz.exe
  C:\Windows\System\DxsJWwz.exe
  2⤵
  PID:4572
- C:\Windows\System\EuRRxAP.exe
  C:\Windows\System\EuRRxAP.exe
  2⤵
  PID:4624
- C:\Windows\System\CgsCpgG.exe
  C:\Windows\System\CgsCpgG.exe
  2⤵
  PID:4668
- C:\Windows\System\eiiDGdr.exe
  C:\Windows\System\eiiDGdr.exe
  2⤵
  PID:4736
- C:\Windows\System\EQnLMFj.exe
  C:\Windows\System\EQnLMFj.exe
  2⤵
  PID:4500
- C:\Windows\System\IFyinBc.exe
  C:\Windows\System\IFyinBc.exe
  2⤵
  PID:4548
- C:\Windows\System\OATKYLp.exe
  C:\Windows\System\OATKYLp.exe
  2⤵
  PID:4764
- C:\Windows\System\uPHKPaK.exe
  C:\Windows\System\uPHKPaK.exe
  2⤵
  PID:4720
- C:\Windows\System\syqWoJO.exe
  C:\Windows\System\syqWoJO.exe
  2⤵
  PID:4724
- C:\Windows\System\kwFmJCL.exe
  C:\Windows\System\kwFmJCL.exe
  2⤵
  PID:4808
- C:\Windows\System\OcWVkIz.exe
  C:\Windows\System\OcWVkIz.exe
  2⤵
  PID:4832
- C:\Windows\System\QiEPUgD.exe
  C:\Windows\System\QiEPUgD.exe
  2⤵
  PID:4984
- C:\Windows\System\LKtmrdw.exe
  C:\Windows\System\LKtmrdw.exe
  2⤵
  PID:5048
- C:\Windows\System\OIIMoOO.exe
  C:\Windows\System\OIIMoOO.exe
  2⤵
  PID:5116
- C:\Windows\System\pzSOPGW.exe
  C:\Windows\System\pzSOPGW.exe
  2⤵
  PID:3336
- C:\Windows\System\dKhBzfR.exe
  C:\Windows\System\dKhBzfR.exe
  2⤵
  PID:4908
- C:\Windows\System\nfiSWSj.exe
  C:\Windows\System\nfiSWSj.exe
  2⤵
  PID:4196
- C:\Windows\System\noEszND.exe
  C:\Windows\System\noEszND.exe
  2⤵
  PID:4864
- C:\Windows\System\HxtWuYv.exe
  C:\Windows\System\HxtWuYv.exe
  2⤵
  PID:4876
- C:\Windows\System\MbTbmJf.exe
  C:\Windows\System\MbTbmJf.exe
  2⤵
  PID:4896
- C:\Windows\System\UGAtcoD.exe
  C:\Windows\System\UGAtcoD.exe
  2⤵
  PID:4180
- C:\Windows\System\xdIrIRs.exe
  C:\Windows\System\xdIrIRs.exe
  2⤵
  PID:4912
- C:\Windows\System\VLXPoBL.exe
  C:\Windows\System\VLXPoBL.exe
  2⤵
  PID:5032
- C:\Windows\System\nVBRrUQ.exe
  C:\Windows\System\nVBRrUQ.exe
  2⤵
  PID:5072
- C:\Windows\System\WapJjmd.exe
  C:\Windows\System\WapJjmd.exe
  2⤵
  PID:2044
- C:\Windows\System\okDgFdG.exe
  C:\Windows\System\okDgFdG.exe
  2⤵
  PID:4336
- C:\Windows\System\xGghCJy.exe
  C:\Windows\System\xGghCJy.exe
  2⤵
  PID:4436
- C:\Windows\System\NCbwNBY.exe
  C:\Windows\System\NCbwNBY.exe
  2⤵
  PID:4540
- C:\Windows\System\vHPABPj.exe
  C:\Windows\System\vHPABPj.exe
  2⤵
  PID:4796
- C:\Windows\System\crorSRX.exe
  C:\Windows\System\crorSRX.exe
  2⤵
  PID:4772
- C:\Windows\System\gTVzXVt.exe
  C:\Windows\System\gTVzXVt.exe
  2⤵
  PID:4756
- C:\Windows\System\LvErcYW.exe
  C:\Windows\System\LvErcYW.exe
  2⤵
  PID:4588
- C:\Windows\System\xrMaSZO.exe
  C:\Windows\System\xrMaSZO.exe
  2⤵
  PID:4760
- C:\Windows\System\FLaOUSn.exe
  C:\Windows\System\FLaOUSn.exe
  2⤵
  PID:4780
- C:\Windows\System\NqWnXOb.exe
  C:\Windows\System\NqWnXOb.exe
  2⤵
  PID:4776
- C:\Windows\System\YhyERPL.exe
  C:\Windows\System\YhyERPL.exe
  2⤵
  PID:4944
- C:\Windows\System\etwiSpL.exe
  C:\Windows\System\etwiSpL.exe
  2⤵
  PID:5084
- C:\Windows\System\wEWvMeT.exe
  C:\Windows\System\wEWvMeT.exe
  2⤵
  PID:4248
- C:\Windows\System\sesmKpx.exe
  C:\Windows\System\sesmKpx.exe
  2⤵
  PID:5016
- C:\Windows\System\vApXSZC.exe
  C:\Windows\System\vApXSZC.exe
  2⤵
  PID:4116
- C:\Windows\System\mVzZuMy.exe
  C:\Windows\System\mVzZuMy.exe
  2⤵
  PID:4432
- C:\Windows\System\NPrkaCH.exe
  C:\Windows\System\NPrkaCH.exe
  2⤵
  PID:4924
- C:\Windows\System\tSdWjBE.exe
  C:\Windows\System\tSdWjBE.exe
  2⤵
  PID:328
- C:\Windows\System\xwqayRo.exe
  C:\Windows\System\xwqayRo.exe
  2⤵
  PID:4340
- C:\Windows\System\CORYHXS.exe
  C:\Windows\System\CORYHXS.exe
  2⤵
  PID:5104
- C:\Windows\System\rWMnCQz.exe
  C:\Windows\System\rWMnCQz.exe
  2⤵
  PID:4292
- C:\Windows\System\YRIzWCv.exe
  C:\Windows\System\YRIzWCv.exe
  2⤵
  PID:4184
- C:\Windows\System\nxiAlvG.exe
  C:\Windows\System\nxiAlvG.exe
  2⤵
  PID:5132
- C:\Windows\System\toIArdl.exe
  C:\Windows\System\toIArdl.exe
  2⤵
  PID:5148
- C:\Windows\System\jekhIcY.exe
  C:\Windows\System\jekhIcY.exe
  2⤵
  PID:5164
- C:\Windows\System\LNyPzTk.exe
  C:\Windows\System\LNyPzTk.exe
  2⤵
  PID:5180
- C:\Windows\System\iVhtJJy.exe
  C:\Windows\System\iVhtJJy.exe
  2⤵
  PID:5196
- C:\Windows\System\ndxQrBZ.exe
  C:\Windows\System\ndxQrBZ.exe
  2⤵
  PID:5212
- C:\Windows\System\zOTDmio.exe
  C:\Windows\System\zOTDmio.exe
  2⤵
  PID:5232
- C:\Windows\System\pAXWQpI.exe
  C:\Windows\System\pAXWQpI.exe
  2⤵
  PID:5248
- C:\Windows\System\YdyAKBs.exe
  C:\Windows\System\YdyAKBs.exe
  2⤵
  PID:5264
- C:\Windows\System\LxdlSPz.exe
  C:\Windows\System\LxdlSPz.exe
  2⤵
  PID:5280
- C:\Windows\System\ruarrdo.exe
  C:\Windows\System\ruarrdo.exe
  2⤵
  PID:5296
- C:\Windows\System\ddAaxKB.exe
  C:\Windows\System\ddAaxKB.exe
  2⤵
  PID:5312
- C:\Windows\System\YSTTUUB.exe
  C:\Windows\System\YSTTUUB.exe
  2⤵
  PID:5328
- C:\Windows\System\bGkTDOL.exe
  C:\Windows\System\bGkTDOL.exe
  2⤵
  PID:5344
- C:\Windows\System\wCAKyKB.exe
  C:\Windows\System\wCAKyKB.exe
  2⤵
  PID:5360
- C:\Windows\System\wKFRvfW.exe
  C:\Windows\System\wKFRvfW.exe
  2⤵
  PID:5376
- C:\Windows\System\xGodADU.exe
  C:\Windows\System\xGodADU.exe
  2⤵
  PID:5392
- C:\Windows\System\QJAdfPo.exe
  C:\Windows\System\QJAdfPo.exe
  2⤵
  PID:5408
- C:\Windows\System\tUtRJix.exe
  C:\Windows\System\tUtRJix.exe
  2⤵
  PID:5424
- C:\Windows\System\rnMcqwv.exe
  C:\Windows\System\rnMcqwv.exe
  2⤵
  PID:5440
- C:\Windows\System\ZWcdjjf.exe
  C:\Windows\System\ZWcdjjf.exe
  2⤵
  PID:5456
- C:\Windows\System\SbuKNmn.exe
  C:\Windows\System\SbuKNmn.exe
  2⤵
  PID:5472
- C:\Windows\System\dvFnswl.exe
  C:\Windows\System\dvFnswl.exe
  2⤵
  PID:5488
- C:\Windows\System\FixMlOY.exe
  C:\Windows\System\FixMlOY.exe
  2⤵
  PID:5504
- C:\Windows\System\oCZPzGe.exe
  C:\Windows\System\oCZPzGe.exe
  2⤵
  PID:5520
- C:\Windows\System\TRcbYBG.exe
  C:\Windows\System\TRcbYBG.exe
  2⤵
  PID:5536
- C:\Windows\System\nIQwCAd.exe
  C:\Windows\System\nIQwCAd.exe
  2⤵
  PID:5552
- C:\Windows\System\MxcSBYz.exe
  C:\Windows\System\MxcSBYz.exe
  2⤵
  PID:5568
- C:\Windows\System\UXnrNoM.exe
  C:\Windows\System\UXnrNoM.exe
  2⤵
  PID:5584
- C:\Windows\System\YKbLaFY.exe
  C:\Windows\System\YKbLaFY.exe
  2⤵
  PID:5600
- C:\Windows\System\XKdMYoU.exe
  C:\Windows\System\XKdMYoU.exe
  2⤵
  PID:5620
- C:\Windows\System\hcOxtCL.exe
  C:\Windows\System\hcOxtCL.exe
  2⤵
  PID:5636
- C:\Windows\System\UPQlcjD.exe
  C:\Windows\System\UPQlcjD.exe
  2⤵
  PID:5652
- C:\Windows\System\KcKEAeX.exe
  C:\Windows\System\KcKEAeX.exe
  2⤵
  PID:5672
- C:\Windows\System\lALvSVr.exe
  C:\Windows\System\lALvSVr.exe
  2⤵
  PID:5688
- C:\Windows\System\NGgTKSt.exe
  C:\Windows\System\NGgTKSt.exe
  2⤵
  PID:5704
- C:\Windows\System\BYScbGm.exe
  C:\Windows\System\BYScbGm.exe
  2⤵
  PID:5720
- C:\Windows\System\eSteIHb.exe
  C:\Windows\System\eSteIHb.exe
  2⤵
  PID:5740
- C:\Windows\System\AYkCtOF.exe
  C:\Windows\System\AYkCtOF.exe
  2⤵
  PID:5760
- C:\Windows\System\dFBqZAB.exe
  C:\Windows\System\dFBqZAB.exe
  2⤵
  PID:5776
- C:\Windows\System\cQXnVcf.exe
  C:\Windows\System\cQXnVcf.exe
  2⤵
  PID:5800
- C:\Windows\System\pIACkMV.exe
  C:\Windows\System\pIACkMV.exe
  2⤵
  PID:5820
- C:\Windows\System\VzWWrGa.exe
  C:\Windows\System\VzWWrGa.exe
  2⤵
  PID:5836
- C:\Windows\System\HHYoxaH.exe
  C:\Windows\System\HHYoxaH.exe
  2⤵
  PID:5852
- C:\Windows\System\HqOKKvn.exe
  C:\Windows\System\HqOKKvn.exe
  2⤵
  PID:5868
- C:\Windows\System\xQsbspp.exe
  C:\Windows\System\xQsbspp.exe
  2⤵
  PID:5964
- C:\Windows\System\tnTCcal.exe
  C:\Windows\System\tnTCcal.exe
  2⤵
  PID:5980
- C:\Windows\System\BWbukEk.exe
  C:\Windows\System\BWbukEk.exe
  2⤵
  PID:6004
- C:\Windows\System\YTsCAgv.exe
  C:\Windows\System\YTsCAgv.exe
  2⤵
  PID:6024
- C:\Windows\System\skDdXxI.exe
  C:\Windows\System\skDdXxI.exe
  2⤵
  PID:6052
- C:\Windows\System\qbSZgSe.exe
  C:\Windows\System\qbSZgSe.exe
  2⤵
  PID:6072
- C:\Windows\System\KCSxdIu.exe
  C:\Windows\System\KCSxdIu.exe
  2⤵
  PID:6088
- C:\Windows\System\uRkpajS.exe
  C:\Windows\System\uRkpajS.exe
  2⤵
  PID:6104
- C:\Windows\System\ekcMSva.exe
  C:\Windows\System\ekcMSva.exe
  2⤵
  PID:6120
- C:\Windows\System\gqcnsHt.exe
  C:\Windows\System\gqcnsHt.exe
  2⤵
  PID:6136
- C:\Windows\System\oOYdZMv.exe
  C:\Windows\System\oOYdZMv.exe
  2⤵
  PID:4364
- C:\Windows\System\hNrsDsz.exe
  C:\Windows\System\hNrsDsz.exe
  2⤵
  PID:4620
- C:\Windows\System\nLhAnAJ.exe
  C:\Windows\System\nLhAnAJ.exe
  2⤵
  PID:4520
- C:\Windows\System\emlEigF.exe
  C:\Windows\System\emlEigF.exe
  2⤵
  PID:4104
- C:\Windows\System\sSlprOk.exe
  C:\Windows\System\sSlprOk.exe
  2⤵
  PID:4692
- C:\Windows\System\KbKTJJn.exe
  C:\Windows\System\KbKTJJn.exe
  2⤵
  PID:4276
- C:\Windows\System\evzwbVH.exe
  C:\Windows\System\evzwbVH.exe
  2⤵
  PID:5128
- C:\Windows\System\VLDoPNT.exe
  C:\Windows\System\VLDoPNT.exe
  2⤵
  PID:4828
- C:\Windows\System\kazNEbh.exe
  C:\Windows\System\kazNEbh.exe
  2⤵
  PID:4168
- C:\Windows\System\LVgmQzM.exe
  C:\Windows\System\LVgmQzM.exe
  2⤵
  PID:5000
- C:\Windows\System\yeXEwqq.exe
  C:\Windows\System\yeXEwqq.exe
  2⤵
  PID:5144
- C:\Windows\System\wEPMQGY.exe
  C:\Windows\System\wEPMQGY.exe
  2⤵
  PID:5204
- C:\Windows\System\ozZtEbP.exe
  C:\Windows\System\ozZtEbP.exe
  2⤵
  PID:4592
- C:\Windows\System\CHnMCzY.exe
  C:\Windows\System\CHnMCzY.exe
  2⤵
  PID:5240
- C:\Windows\System\TZbrtsw.exe
  C:\Windows\System\TZbrtsw.exe
  2⤵
  PID:5336
- C:\Windows\System\lZWhvgp.exe
  C:\Windows\System\lZWhvgp.exe
  2⤵
  PID:5244
- C:\Windows\System\eJOjSsD.exe
  C:\Windows\System\eJOjSsD.exe
  2⤵
  PID:5400
- C:\Windows\System\xJgyATF.exe
  C:\Windows\System\xJgyATF.exe
  2⤵
  PID:5404
- C:\Windows\System\SVFfVNx.exe
  C:\Windows\System\SVFfVNx.exe
  2⤵
  PID:5452
- C:\Windows\System\pUkzTec.exe
  C:\Windows\System\pUkzTec.exe
  2⤵
  PID:5512
- C:\Windows\System\IyeXizp.exe
  C:\Windows\System\IyeXizp.exe
  2⤵
  PID:5516
- C:\Windows\System\mhbFDtS.exe
  C:\Windows\System\mhbFDtS.exe
  2⤵
  PID:5288
- C:\Windows\System\ghFCmnm.exe
  C:\Windows\System\ghFCmnm.exe
  2⤵
  PID:5324
- C:\Windows\System\GYxiFuh.exe
  C:\Windows\System\GYxiFuh.exe
  2⤵
  PID:5388
- C:\Windows\System\sBbXfAp.exe
  C:\Windows\System\sBbXfAp.exe
  2⤵
  PID:5564
- C:\Windows\System\jeSbQKE.exe
  C:\Windows\System\jeSbQKE.exe
  2⤵
  PID:5608
- C:\Windows\System\JyeWEkV.exe
  C:\Windows\System\JyeWEkV.exe
  2⤵
  PID:5648
- C:\Windows\System\lZyUSgM.exe
  C:\Windows\System\lZyUSgM.exe
  2⤵
  PID:5632
- C:\Windows\System\fIweAEb.exe
  C:\Windows\System\fIweAEb.exe
  2⤵
  PID:5696
- C:\Windows\System\BLtJHlO.exe
  C:\Windows\System\BLtJHlO.exe
  2⤵
  PID:5732
- C:\Windows\System\gBYKwhI.exe
  C:\Windows\System\gBYKwhI.exe
  2⤵
  PID:5748
- C:\Windows\System\zdylUGL.exe
  C:\Windows\System\zdylUGL.exe
  2⤵
  PID:5784
- C:\Windows\System\hUKEmvQ.exe
  C:\Windows\System\hUKEmvQ.exe
  2⤵
  PID:5772
- C:\Windows\System\NEePZew.exe
  C:\Windows\System\NEePZew.exe
  2⤵
  PID:5816
- C:\Windows\System\USsTScD.exe
  C:\Windows\System\USsTScD.exe
  2⤵
  PID:5884
- C:\Windows\System\BmoOseG.exe
  C:\Windows\System\BmoOseG.exe
  2⤵
  PID:5896
- C:\Windows\System\BkKnPhO.exe
  C:\Windows\System\BkKnPhO.exe
  2⤵
  PID:5912
- C:\Windows\System\uTkOekl.exe
  C:\Windows\System\uTkOekl.exe
  2⤵
  PID:5932
- C:\Windows\System\MEJLbGD.exe
  C:\Windows\System\MEJLbGD.exe
  2⤵
  PID:5952
- C:\Windows\System\JFhGPcq.exe
  C:\Windows\System\JFhGPcq.exe
  2⤵
  PID:5880
- C:\Windows\System\TYAeDsB.exe
  C:\Windows\System\TYAeDsB.exe
  2⤵
  PID:6064
- C:\Windows\System\RvAcJUB.exe
  C:\Windows\System\RvAcJUB.exe
  2⤵
  PID:6012
- C:\Windows\System\qmdkCFM.exe
  C:\Windows\System\qmdkCFM.exe
  2⤵
  PID:6100
- C:\Windows\System\eKHJCWQ.exe
  C:\Windows\System\eKHJCWQ.exe
  2⤵
  PID:6044
- C:\Windows\System\rNzMspu.exe
  C:\Windows\System\rNzMspu.exe
  2⤵
  PID:6116
- C:\Windows\System\sCYCQNI.exe
  C:\Windows\System\sCYCQNI.exe
  2⤵
  PID:4660
- C:\Windows\System\MZdLtzC.exe
  C:\Windows\System\MZdLtzC.exe
  2⤵
  PID:4708
- C:\Windows\System\lXRnmdi.exe
  C:\Windows\System\lXRnmdi.exe
  2⤵
  PID:2880
- C:\Windows\System\TsagGmz.exe
  C:\Windows\System\TsagGmz.exe
  2⤵
  PID:5996
- C:\Windows\System\wBSdAhx.exe
  C:\Windows\System\wBSdAhx.exe
  2⤵
  PID:4980
- C:\Windows\System\FqJlkyG.exe
  C:\Windows\System\FqJlkyG.exe
  2⤵
  PID:3756
- C:\Windows\System\xEGAZjp.exe
  C:\Windows\System\xEGAZjp.exe
  2⤵
  PID:5260
- C:\Windows\System\AkUDhgW.exe
  C:\Windows\System\AkUDhgW.exe
  2⤵
  PID:5436
- C:\Windows\System\aPKBbji.exe
  C:\Windows\System\aPKBbji.exe
  2⤵
  PID:4996
- C:\Windows\System\dAFmQzx.exe
  C:\Windows\System\dAFmQzx.exe
  2⤵
  PID:5228
- C:\Windows\System\GwRDVdD.exe
  C:\Windows\System\GwRDVdD.exe
  2⤵
  PID:5500
- C:\Windows\System\jSoccOL.exe
  C:\Windows\System\jSoccOL.exe
  2⤵
  PID:5320
- C:\Windows\System\bmDSOXn.exe
  C:\Windows\System\bmDSOXn.exe
  2⤵
  PID:5416
- C:\Windows\System\AZAxLvV.exe
  C:\Windows\System\AZAxLvV.exe
  2⤵
  PID:5356
- C:\Windows\System\VhjNaPH.exe
  C:\Windows\System\VhjNaPH.exe
  2⤵
  PID:5808
- C:\Windows\System\qNuTzXK.exe
  C:\Windows\System\qNuTzXK.exe
  2⤵
  PID:5960
- C:\Windows\System\ADfgGdu.exe
  C:\Windows\System\ADfgGdu.exe
  2⤵
  PID:5848
- C:\Windows\System\tdVpLum.exe
  C:\Windows\System\tdVpLum.exe
  2⤵
  PID:5716
- C:\Windows\System\ZkQIQmP.exe
  C:\Windows\System\ZkQIQmP.exe
  2⤵
  PID:6060
- C:\Windows\System\oLlWLBR.exe
  C:\Windows\System\oLlWLBR.exe
  2⤵
  PID:5596
- C:\Windows\System\aIApJGG.exe
  C:\Windows\System\aIApJGG.exe
  2⤵
  PID:5920
- C:\Windows\System\oiOgnWo.exe
  C:\Windows\System\oiOgnWo.exe
  2⤵
  PID:6084
- C:\Windows\System\FgrDHXw.exe
  C:\Windows\System\FgrDHXw.exe
  2⤵
  PID:4280
- C:\Windows\System\PhhMrLl.exe
  C:\Windows\System\PhhMrLl.exe
  2⤵
  PID:5944
- C:\Windows\System\QGsSEIi.exe
  C:\Windows\System\QGsSEIi.exe
  2⤵
  PID:5972
- C:\Windows\System\aydclMf.exe
  C:\Windows\System\aydclMf.exe
  2⤵
  PID:5020
- C:\Windows\System\cnIesZT.exe
  C:\Windows\System\cnIesZT.exe
  2⤵
  PID:5156
- C:\Windows\System\IjYpZCL.exe
  C:\Windows\System\IjYpZCL.exe
  2⤵
  PID:4648
- C:\Windows\System\uVZfklE.exe
  C:\Windows\System\uVZfklE.exe
  2⤵
  PID:5464
- C:\Windows\System\JIkrFya.exe
  C:\Windows\System\JIkrFya.exe
  2⤵
  PID:5792
- C:\Windows\System\BInexlv.exe
  C:\Windows\System\BInexlv.exe
  2⤵
  PID:4688
- C:\Windows\System\VPUxewF.exe
  C:\Windows\System\VPUxewF.exe
  2⤵
  PID:5448
- C:\Windows\System\rWTlKTy.exe
  C:\Windows\System\rWTlKTy.exe
  2⤵
  PID:5736
- C:\Windows\System\VbqORvl.exe
  C:\Windows\System\VbqORvl.exe
  2⤵
  PID:5924
- C:\Windows\System\ssuxnxa.exe
  C:\Windows\System\ssuxnxa.exe
  2⤵
  PID:5864
- C:\Windows\System\wqcZoRz.exe
  C:\Windows\System\wqcZoRz.exe
  2⤵
  PID:5576
- C:\Windows\System\QgPLQSc.exe
  C:\Windows\System\QgPLQSc.exe
  2⤵
  PID:4792
- C:\Windows\System\bKEPLmE.exe
  C:\Windows\System\bKEPLmE.exe
  2⤵
  PID:5220
- C:\Windows\System\zIueVMG.exe
  C:\Windows\System\zIueVMG.exe
  2⤵
  PID:5956
- C:\Windows\System\utsEZxv.exe
  C:\Windows\System\utsEZxv.exe
  2⤵
  PID:5756
- C:\Windows\System\pEUCpMM.exe
  C:\Windows\System\pEUCpMM.exe
  2⤵
  PID:5208
- C:\Windows\System\hKatnIb.exe
  C:\Windows\System\hKatnIb.exe
  2⤵
  PID:3964
- C:\Windows\System\wbzMnIi.exe
  C:\Windows\System\wbzMnIi.exe
  2⤵
  PID:4120
- C:\Windows\System\VuuUnrk.exe
  C:\Windows\System\VuuUnrk.exe
  2⤵
  PID:5796
- C:\Windows\System\gsjcQTT.exe
  C:\Windows\System\gsjcQTT.exe
  2⤵
  PID:5664
- C:\Windows\System\ccOBfTb.exe
  C:\Windows\System\ccOBfTb.exe
  2⤵
  PID:5860
- C:\Windows\System\htTTcXz.exe
  C:\Windows\System\htTTcXz.exe
  2⤵
  PID:6148
- C:\Windows\System\PFAEDdg.exe
  C:\Windows\System\PFAEDdg.exe
  2⤵
  PID:6164
- C:\Windows\System\DNrDaFl.exe
  C:\Windows\System\DNrDaFl.exe
  2⤵
  PID:6180
- C:\Windows\System\kaXFgro.exe
  C:\Windows\System\kaXFgro.exe
  2⤵
  PID:6196
- C:\Windows\System\PMBJLnN.exe
  C:\Windows\System\PMBJLnN.exe
  2⤵
  PID:6212
- C:\Windows\System\iTtOFwc.exe
  C:\Windows\System\iTtOFwc.exe
  2⤵
  PID:6228
- C:\Windows\System\uBcUYnk.exe
  C:\Windows\System\uBcUYnk.exe
  2⤵
  PID:6244
- C:\Windows\System\yrtosdE.exe
  C:\Windows\System\yrtosdE.exe
  2⤵
  PID:6260
- C:\Windows\System\XTIvspA.exe
  C:\Windows\System\XTIvspA.exe
  2⤵
  PID:6276
- C:\Windows\System\hLcMiGC.exe
  C:\Windows\System\hLcMiGC.exe
  2⤵
  PID:6292
- C:\Windows\System\lRYqaqW.exe
  C:\Windows\System\lRYqaqW.exe
  2⤵
  PID:6312
- C:\Windows\System\AhzmFnM.exe
  C:\Windows\System\AhzmFnM.exe
  2⤵
  PID:6328
- C:\Windows\System\ZEcNNHY.exe
  C:\Windows\System\ZEcNNHY.exe
  2⤵
  PID:6344
- C:\Windows\System\OOUdbhj.exe
  C:\Windows\System\OOUdbhj.exe
  2⤵
  PID:6360
- C:\Windows\System\qSnHEdk.exe
  C:\Windows\System\qSnHEdk.exe
  2⤵
  PID:6376
- C:\Windows\System\HxNtiSs.exe
  C:\Windows\System\HxNtiSs.exe
  2⤵
  PID:6392
- C:\Windows\System\efHXXfI.exe
  C:\Windows\System\efHXXfI.exe
  2⤵
  PID:6408
- C:\Windows\System\TaXJyYt.exe
  C:\Windows\System\TaXJyYt.exe
  2⤵
  PID:6424
- C:\Windows\System\DNvqADz.exe
  C:\Windows\System\DNvqADz.exe
  2⤵
  PID:6444
- C:\Windows\System\gCaQrnW.exe
  C:\Windows\System\gCaQrnW.exe
  2⤵
  PID:6460
- C:\Windows\System\LbhOqfD.exe
  C:\Windows\System\LbhOqfD.exe
  2⤵
  PID:6476
- C:\Windows\System\lHEnRnB.exe
  C:\Windows\System\lHEnRnB.exe
  2⤵
  PID:6492
- C:\Windows\System\vSJyoSd.exe
  C:\Windows\System\vSJyoSd.exe
  2⤵
  PID:6508
- C:\Windows\System\WtABAyf.exe
  C:\Windows\System\WtABAyf.exe
  2⤵
  PID:6524
- C:\Windows\System\AMqBNZq.exe
  C:\Windows\System\AMqBNZq.exe
  2⤵
  PID:6540
- C:\Windows\System\QKwdOPz.exe
  C:\Windows\System\QKwdOPz.exe
  2⤵
  PID:6556
- C:\Windows\System\eZBTuqi.exe
  C:\Windows\System\eZBTuqi.exe
  2⤵
  PID:6572
- C:\Windows\System\WKLMBrE.exe
  C:\Windows\System\WKLMBrE.exe
  2⤵
  PID:6588
- C:\Windows\System\FtApFLZ.exe
  C:\Windows\System\FtApFLZ.exe
  2⤵
  PID:6604
- C:\Windows\System\GnCnszK.exe
  C:\Windows\System\GnCnszK.exe
  2⤵
  PID:6620
- C:\Windows\System\SDTAlsN.exe
  C:\Windows\System\SDTAlsN.exe
  2⤵
  PID:6636
- C:\Windows\System\KLLbXoD.exe
  C:\Windows\System\KLLbXoD.exe
  2⤵
  PID:6652
- C:\Windows\System\kOMwIpu.exe
  C:\Windows\System\kOMwIpu.exe
  2⤵
  PID:6668
- C:\Windows\System\xTXBfid.exe
  C:\Windows\System\xTXBfid.exe
  2⤵
  PID:6684
- C:\Windows\System\QVBIsLR.exe
  C:\Windows\System\QVBIsLR.exe
  2⤵
  PID:6700
- C:\Windows\System\XpuFKpt.exe
  C:\Windows\System\XpuFKpt.exe
  2⤵
  PID:6720
- C:\Windows\System\frGDuwl.exe
  C:\Windows\System\frGDuwl.exe
  2⤵
  PID:6736
- C:\Windows\System\GNFookC.exe
  C:\Windows\System\GNFookC.exe
  2⤵
  PID:6752
- C:\Windows\System\FmSxdGv.exe
  C:\Windows\System\FmSxdGv.exe
  2⤵
  PID:6768
- C:\Windows\System\ClNmSCC.exe
  C:\Windows\System\ClNmSCC.exe
  2⤵
  PID:6784
- C:\Windows\System\gUVWFSq.exe
  C:\Windows\System\gUVWFSq.exe
  2⤵
  PID:6800
- C:\Windows\System\lGBixAV.exe
  C:\Windows\System\lGBixAV.exe
  2⤵
  PID:6816
- C:\Windows\System\vdkTdpJ.exe
  C:\Windows\System\vdkTdpJ.exe
  2⤵
  PID:6832
- C:\Windows\System\horrbrV.exe
  C:\Windows\System\horrbrV.exe
  2⤵
  PID:6848
- C:\Windows\System\klTaEPU.exe
  C:\Windows\System\klTaEPU.exe
  2⤵
  PID:6864
- C:\Windows\System\mZnqZcK.exe
  C:\Windows\System\mZnqZcK.exe
  2⤵
  PID:6880
- C:\Windows\System\RrbEVOz.exe
  C:\Windows\System\RrbEVOz.exe
  2⤵
  PID:6896
- C:\Windows\System\NTfbhxD.exe
  C:\Windows\System\NTfbhxD.exe
  2⤵
  PID:6912
- C:\Windows\System\gujIzJz.exe
  C:\Windows\System\gujIzJz.exe
  2⤵
  PID:6928
- C:\Windows\System\dafOZte.exe
  C:\Windows\System\dafOZte.exe
  2⤵
  PID:6944
- C:\Windows\System\ZlKICap.exe
  C:\Windows\System\ZlKICap.exe
  2⤵
  PID:6964
- C:\Windows\System\bjJlFsZ.exe
  C:\Windows\System\bjJlFsZ.exe
  2⤵
  PID:6980
- C:\Windows\System\ZkZqyUH.exe
  C:\Windows\System\ZkZqyUH.exe
  2⤵
  PID:6996
- C:\Windows\System\nsztYNf.exe
  C:\Windows\System\nsztYNf.exe
  2⤵
  PID:7012
- C:\Windows\System\PCKwcOM.exe
  C:\Windows\System\PCKwcOM.exe
  2⤵
  PID:7028
- C:\Windows\System\RrUQIlP.exe
  C:\Windows\System\RrUQIlP.exe
  2⤵
  PID:7044
- C:\Windows\System\MLIxjuS.exe
  C:\Windows\System\MLIxjuS.exe
  2⤵
  PID:7060
- C:\Windows\System\oHOohkD.exe
  C:\Windows\System\oHOohkD.exe
  2⤵
  PID:7076
- C:\Windows\System\esEYKLl.exe
  C:\Windows\System\esEYKLl.exe
  2⤵
  PID:7092
- C:\Windows\System\sqsTgJL.exe
  C:\Windows\System\sqsTgJL.exe
  2⤵
  PID:7108
- C:\Windows\System\fHUnRta.exe
  C:\Windows\System\fHUnRta.exe
  2⤵
  PID:7124
- C:\Windows\System\jHMqiZM.exe
  C:\Windows\System\jHMqiZM.exe
  2⤵
  PID:7140
- C:\Windows\System\JYVEicg.exe
  C:\Windows\System\JYVEicg.exe
  2⤵
  PID:7156
- C:\Windows\System\xikiOmp.exe
  C:\Windows\System\xikiOmp.exe
  2⤵
  PID:6160
- C:\Windows\System\HDQufjH.exe
  C:\Windows\System\HDQufjH.exe
  2⤵
  PID:6224
- C:\Windows\System\JHleLzA.exe
  C:\Windows\System\JHleLzA.exe
  2⤵
  PID:6284
- C:\Windows\System\hroeYTt.exe
  C:\Windows\System\hroeYTt.exe
  2⤵
  PID:5616
- C:\Windows\System\gBlHxPW.exe
  C:\Windows\System\gBlHxPW.exe
  2⤵
  PID:6356
- C:\Windows\System\ofrnpCX.exe
  C:\Windows\System\ofrnpCX.exe
  2⤵
  PID:6420
- C:\Windows\System\IzypYWQ.exe
  C:\Windows\System\IzypYWQ.exe
  2⤵
  PID:6452
- C:\Windows\System\ZMmIwla.exe
  C:\Windows\System\ZMmIwla.exe
  2⤵
  PID:6456
- C:\Windows\System\RMlaJlo.exe
  C:\Windows\System\RMlaJlo.exe
  2⤵
  PID:6172
- C:\Windows\System\PzFwpZl.exe
  C:\Windows\System\PzFwpZl.exe
  2⤵
  PID:6300
- C:\Windows\System\ZXqAWot.exe
  C:\Windows\System\ZXqAWot.exe
  2⤵
  PID:6336
- C:\Windows\System\RzZLVDw.exe
  C:\Windows\System\RzZLVDw.exe
  2⤵
  PID:6440
- C:\Windows\System\GsiWbdL.exe
  C:\Windows\System\GsiWbdL.exe
  2⤵
  PID:6552
- C:\Windows\System\VfomrJS.exe
  C:\Windows\System\VfomrJS.exe
  2⤵
  PID:6584
- C:\Windows\System\mkKFzAq.exe
  C:\Windows\System\mkKFzAq.exe
  2⤵
  PID:6616
- C:\Windows\System\izblAzB.exe
  C:\Windows\System\izblAzB.exe
  2⤵
  PID:6568
- C:\Windows\System\uMfASmF.exe
  C:\Windows\System\uMfASmF.exe
  2⤵
  PID:6712
- C:\Windows\System\lPrtCVp.exe
  C:\Windows\System\lPrtCVp.exe
  2⤵
  PID:6536
- C:\Windows\System\WbSxGgi.exe
  C:\Windows\System\WbSxGgi.exe
  2⤵
  PID:6696
- C:\Windows\System\EwMPzzB.exe
  C:\Windows\System\EwMPzzB.exe
  2⤵
  PID:6632
- C:\Windows\System\jGScTnV.exe
  C:\Windows\System\jGScTnV.exe
  2⤵
  PID:6732
- C:\Windows\System\iwCWNAU.exe
  C:\Windows\System\iwCWNAU.exe
  2⤵
  PID:6808
- C:\Windows\System\cnxArrX.exe
  C:\Windows\System\cnxArrX.exe
  2⤵
  PID:6872
- C:\Windows\System\RMEipgT.exe
  C:\Windows\System\RMEipgT.exe
  2⤵
  PID:6936
- C:\Windows\System\MRaTfgE.exe
  C:\Windows\System\MRaTfgE.exe
  2⤵
  PID:6952
- C:\Windows\System\raPOqwm.exe
  C:\Windows\System\raPOqwm.exe
  2⤵
  PID:6960
- C:\Windows\System\XowPtGq.exe
  C:\Windows\System\XowPtGq.exe
  2⤵
  PID:6920
- C:\Windows\System\fjSKJLx.exe
  C:\Windows\System\fjSKJLx.exe
  2⤵
  PID:7024
- C:\Windows\System\tfkaPfM.exe
  C:\Windows\System\tfkaPfM.exe
  2⤵
  PID:6976
- C:\Windows\System\BvaiEfw.exe
  C:\Windows\System\BvaiEfw.exe
  2⤵
  PID:7040
- C:\Windows\System\agXcSSN.exe
  C:\Windows\System\agXcSSN.exe
  2⤵
  PID:7084
- C:\Windows\System\wjSbpBU.exe
  C:\Windows\System\wjSbpBU.exe
  2⤵
  PID:7116
- C:\Windows\System\ttoSJMJ.exe
  C:\Windows\System\ttoSJMJ.exe
  2⤵
  PID:6324
- C:\Windows\System\yNVawzg.exe
  C:\Windows\System\yNVawzg.exe
  2⤵
  PID:6272
- C:\Windows\System\TzjGIKx.exe
  C:\Windows\System\TzjGIKx.exe
  2⤵
  PID:6048
- C:\Windows\System\NfFmWbl.exe
  C:\Windows\System\NfFmWbl.exe
  2⤵
  PID:5644
- C:\Windows\System\wwWupFi.exe
  C:\Windows\System\wwWupFi.exe
  2⤵
  PID:6020
- C:\Windows\System\KLPwwYf.exe
  C:\Windows\System\KLPwwYf.exe
  2⤵
  PID:6580
- C:\Windows\System\pPIcAWI.exe
  C:\Windows\System\pPIcAWI.exe
  2⤵
  PID:6372
- C:\Windows\System\sDIkFSy.exe
  C:\Windows\System\sDIkFSy.exe
  2⤵
  PID:6680
- C:\Windows\System\itKpVFN.exe
  C:\Windows\System\itKpVFN.exe
  2⤵
  PID:6744
- C:\Windows\System\zDzVwuZ.exe
  C:\Windows\System\zDzVwuZ.exe
  2⤵
  PID:6728
- C:\Windows\System\RWBwDam.exe
  C:\Windows\System\RWBwDam.exe
  2⤵
  PID:6532
- C:\Windows\System\wmWtOVJ.exe
  C:\Windows\System\wmWtOVJ.exe
  2⤵
  PID:6764
- C:\Windows\System\vJeaWUx.exe
  C:\Windows\System\vJeaWUx.exe
  2⤵
  PID:6856
- C:\Windows\System\hfNkaoQ.exe
  C:\Windows\System\hfNkaoQ.exe
  2⤵
  PID:6904
- C:\Windows\System\UPUdNlI.exe
  C:\Windows\System\UPUdNlI.exe
  2⤵
  PID:6988
- C:\Windows\System\HrYkwZv.exe
  C:\Windows\System\HrYkwZv.exe
  2⤵
  PID:7104
- C:\Windows\System\izFRsOo.exe
  C:\Windows\System\izFRsOo.exe
  2⤵
  PID:7136
- C:\Windows\System\jTrJetm.exe
  C:\Windows\System\jTrJetm.exe
  2⤵
  PID:6208
- C:\Windows\System\MwTqtjQ.exe
  C:\Windows\System\MwTqtjQ.exe
  2⤵
  PID:6416
- C:\Windows\System\QcKYYQg.exe
  C:\Windows\System\QcKYYQg.exe
  2⤵
  PID:7036
- C:\Windows\System\MrHXbJy.exe
  C:\Windows\System\MrHXbJy.exe
  2⤵
  PID:6628
- C:\Windows\System\GteddjY.exe
  C:\Windows\System\GteddjY.exe
  2⤵
  PID:7152
- C:\Windows\System\XexTEAj.exe
  C:\Windows\System\XexTEAj.exe
  2⤵
  PID:6612
- C:\Windows\System\pWNROiP.exe
  C:\Windows\System\pWNROiP.exe
  2⤵
  PID:1540
- C:\Windows\System\cZnvIPm.exe
  C:\Windows\System\cZnvIPm.exe
  2⤵
  PID:6256
- C:\Windows\System\EtCYaid.exe
  C:\Windows\System\EtCYaid.exe
  2⤵
  PID:6504
- C:\Windows\System\QYUAmst.exe
  C:\Windows\System\QYUAmst.exe
  2⤵
  PID:6992
- C:\Windows\System\YduMCni.exe
  C:\Windows\System\YduMCni.exe
  2⤵
  PID:6824
- C:\Windows\System\DMldbwc.exe
  C:\Windows\System\DMldbwc.exe
  2⤵
  PID:6484
- C:\Windows\System\bHnkRxm.exe
  C:\Windows\System\bHnkRxm.exe
  2⤵
  PID:7176
- C:\Windows\System\mEvdMxD.exe
  C:\Windows\System\mEvdMxD.exe
  2⤵
  PID:7192
- C:\Windows\System\grrFQJv.exe
  C:\Windows\System\grrFQJv.exe
  2⤵
  PID:7212
- C:\Windows\System\utwIUXS.exe
  C:\Windows\System\utwIUXS.exe
  2⤵
  PID:7228
- C:\Windows\System\BoBYTjV.exe
  C:\Windows\System\BoBYTjV.exe
  2⤵
  PID:7244
- C:\Windows\System\PNJbxpV.exe
  C:\Windows\System\PNJbxpV.exe
  2⤵
  PID:7260
- C:\Windows\System\BOnqOhF.exe
  C:\Windows\System\BOnqOhF.exe
  2⤵
  PID:7276
- C:\Windows\System\nvElzzi.exe
  C:\Windows\System\nvElzzi.exe
  2⤵
  PID:7292
- C:\Windows\System\mruCerx.exe
  C:\Windows\System\mruCerx.exe
  2⤵
  PID:7308
- C:\Windows\System\sUtKBEo.exe
  C:\Windows\System\sUtKBEo.exe
  2⤵
  PID:7324
- C:\Windows\System\QqoTFwj.exe
  C:\Windows\System\QqoTFwj.exe
  2⤵
  PID:7340
- C:\Windows\System\tSMuNnm.exe
  C:\Windows\System\tSMuNnm.exe
  2⤵
  PID:7436
- C:\Windows\System\HxBRqJQ.exe
  C:\Windows\System\HxBRqJQ.exe
  2⤵
  PID:7452
- C:\Windows\System\PzwLAvB.exe
  C:\Windows\System\PzwLAvB.exe
  2⤵
  PID:7468
- C:\Windows\System\RiAiHKx.exe
  C:\Windows\System\RiAiHKx.exe
  2⤵
  PID:7484
- C:\Windows\System\nOsQfXc.exe
  C:\Windows\System\nOsQfXc.exe
  2⤵
  PID:7500
- C:\Windows\System\fQeovRJ.exe
  C:\Windows\System\fQeovRJ.exe
  2⤵
  PID:7516
- C:\Windows\System\kvmfmuI.exe
  C:\Windows\System\kvmfmuI.exe
  2⤵
  PID:7532
- C:\Windows\System\yLLcxGF.exe
  C:\Windows\System\yLLcxGF.exe
  2⤵
  PID:7548
- C:\Windows\System\NYUdUYi.exe
  C:\Windows\System\NYUdUYi.exe
  2⤵
  PID:7564
- C:\Windows\System\zKXuaIZ.exe
  C:\Windows\System\zKXuaIZ.exe
  2⤵
  PID:7580
- C:\Windows\System\RGyVKgG.exe
  C:\Windows\System\RGyVKgG.exe
  2⤵
  PID:7596
- C:\Windows\System\yccCBOM.exe
  C:\Windows\System\yccCBOM.exe
  2⤵
  PID:7616
- C:\Windows\System\OlTNPVp.exe
  C:\Windows\System\OlTNPVp.exe
  2⤵
  PID:7632
- C:\Windows\System\qhuUTsx.exe
  C:\Windows\System\qhuUTsx.exe
  2⤵
  PID:7648
- C:\Windows\System\lwvqxJF.exe
  C:\Windows\System\lwvqxJF.exe
  2⤵
  PID:7664
- C:\Windows\System\CyDrfnP.exe
  C:\Windows\System\CyDrfnP.exe
  2⤵
  PID:7680
- C:\Windows\System\HZuTgpt.exe
  C:\Windows\System\HZuTgpt.exe
  2⤵
  PID:7696
- C:\Windows\System\YHznwDr.exe
  C:\Windows\System\YHznwDr.exe
  2⤵
  PID:7712
- C:\Windows\System\psBRYWj.exe
  C:\Windows\System\psBRYWj.exe
  2⤵
  PID:7728
- C:\Windows\System\pytCDPB.exe
  C:\Windows\System\pytCDPB.exe
  2⤵
  PID:7744
- C:\Windows\System\bjOofHD.exe
  C:\Windows\System\bjOofHD.exe
  2⤵
  PID:7760
- C:\Windows\System\eGyTOyi.exe
  C:\Windows\System\eGyTOyi.exe
  2⤵
  PID:7776
- C:\Windows\System\YepesDF.exe
  C:\Windows\System\YepesDF.exe
  2⤵
  PID:7792
- C:\Windows\System\teCxWnK.exe
  C:\Windows\System\teCxWnK.exe
  2⤵
  PID:7808
- C:\Windows\System\gcTvuOW.exe
  C:\Windows\System\gcTvuOW.exe
  2⤵
  PID:7824
- C:\Windows\System\XbColRT.exe
  C:\Windows\System\XbColRT.exe
  2⤵
  PID:7840
- C:\Windows\System\AtgbiPE.exe
  C:\Windows\System\AtgbiPE.exe
  2⤵
  PID:7856
- C:\Windows\System\jCbmLZF.exe
  C:\Windows\System\jCbmLZF.exe
  2⤵
  PID:7872
- C:\Windows\System\BJHiyZm.exe
  C:\Windows\System\BJHiyZm.exe
  2⤵
  PID:7888
- C:\Windows\System\GPhuJfa.exe
  C:\Windows\System\GPhuJfa.exe
  2⤵
  PID:7904
- C:\Windows\System\pmESTXX.exe
  C:\Windows\System\pmESTXX.exe
  2⤵
  PID:7920
- C:\Windows\System\LCGcLSg.exe
  C:\Windows\System\LCGcLSg.exe
  2⤵
  PID:7936
- C:\Windows\System\rJRGCvd.exe
  C:\Windows\System\rJRGCvd.exe
  2⤵
  PID:7952
- C:\Windows\System\cpOoMDv.exe
  C:\Windows\System\cpOoMDv.exe
  2⤵
  PID:7968
- C:\Windows\System\htGintu.exe
  C:\Windows\System\htGintu.exe
  2⤵
  PID:7984
- C:\Windows\System\hDHthAk.exe
  C:\Windows\System\hDHthAk.exe
  2⤵
  PID:8000
- C:\Windows\System\sENtHUH.exe
  C:\Windows\System\sENtHUH.exe
  2⤵
  PID:8016
- C:\Windows\System\nuMzIoZ.exe
  C:\Windows\System\nuMzIoZ.exe
  2⤵
  PID:8032
- C:\Windows\System\wmXWDIG.exe
  C:\Windows\System\wmXWDIG.exe
  2⤵
  PID:8048
- C:\Windows\System\jWWsPIm.exe
  C:\Windows\System\jWWsPIm.exe
  2⤵
  PID:8064
- C:\Windows\System\sflQuSU.exe
  C:\Windows\System\sflQuSU.exe
  2⤵
  PID:8080
- C:\Windows\System\ZjXqemX.exe
  C:\Windows\System\ZjXqemX.exe
  2⤵
  PID:8096
- C:\Windows\System\icKqKyk.exe
  C:\Windows\System\icKqKyk.exe
  2⤵
  PID:8112
- C:\Windows\System\ZZxqWIW.exe
  C:\Windows\System\ZZxqWIW.exe
  2⤵
  PID:8128
- C:\Windows\System\tdipaGi.exe
  C:\Windows\System\tdipaGi.exe
  2⤵
  PID:8144
- C:\Windows\System\pjFuyji.exe
  C:\Windows\System\pjFuyji.exe
  2⤵
  PID:8160
- C:\Windows\System\khoSPyr.exe
  C:\Windows\System\khoSPyr.exe
  2⤵
  PID:8176
- C:\Windows\System\SVkRxnI.exe
  C:\Windows\System\SVkRxnI.exe
  2⤵
  PID:6748
- C:\Windows\System\YgXDXLB.exe
  C:\Windows\System\YgXDXLB.exe
  2⤵
  PID:7200
- C:\Windows\System\zxdGXtZ.exe
  C:\Windows\System\zxdGXtZ.exe
  2⤵
  PID:6520
- C:\Windows\System\QDWXYkN.exe
  C:\Windows\System\QDWXYkN.exe
  2⤵
  PID:7304
- C:\Windows\System\KOWdqTs.exe
  C:\Windows\System\KOWdqTs.exe
  2⤵
  PID:7164
- C:\Windows\System\NNnfrqg.exe
  C:\Windows\System\NNnfrqg.exe
  2⤵
  PID:6304
- C:\Windows\System\dAEvxvf.exe
  C:\Windows\System\dAEvxvf.exe
  2⤵
  PID:7316
- C:\Windows\System\OjlaNsu.exe
  C:\Windows\System\OjlaNsu.exe
  2⤵
  PID:6516
- C:\Windows\System\LVNYgDA.exe
  C:\Windows\System\LVNYgDA.exe
  2⤵
  PID:7224
- C:\Windows\System\gQmYBGo.exe
  C:\Windows\System\gQmYBGo.exe
  2⤵
  PID:6472
- C:\Windows\System\dDqOpkN.exe
  C:\Windows\System\dDqOpkN.exe
  2⤵
  PID:7368
- C:\Windows\System\UtWHDAF.exe
  C:\Windows\System\UtWHDAF.exe
  2⤵
  PID:7384
- C:\Windows\System\VtYheAt.exe
  C:\Windows\System\VtYheAt.exe
  2⤵
  PID:6796
- C:\Windows\System\FrPzCgQ.exe
  C:\Windows\System\FrPzCgQ.exe
  2⤵
  PID:7416
- C:\Windows\System\VAcLzMQ.exe
  C:\Windows\System\VAcLzMQ.exe
  2⤵
  PID:7444
- C:\Windows\System\ApjJCMI.exe
  C:\Windows\System\ApjJCMI.exe
  2⤵
  PID:7496
- C:\Windows\System\BCuezah.exe
  C:\Windows\System\BCuezah.exe
  2⤵
  PID:7556
- C:\Windows\System\KxIgIgj.exe
  C:\Windows\System\KxIgIgj.exe
  2⤵
  PID:7592
- C:\Windows\System\CLBBRms.exe
  C:\Windows\System\CLBBRms.exe
  2⤵
  PID:7476
- C:\Windows\System\URuHiKk.exe
  C:\Windows\System\URuHiKk.exe
  2⤵
  PID:7540
- C:\Windows\System\cpSbEEn.exe
  C:\Windows\System\cpSbEEn.exe
  2⤵
  PID:7604
- C:\Windows\System\sjHzhmP.exe
  C:\Windows\System\sjHzhmP.exe
  2⤵
  PID:7644
- C:\Windows\System\eRzIegs.exe
  C:\Windows\System\eRzIegs.exe
  2⤵
  PID:7692
- C:\Windows\System\GacOcfW.exe
  C:\Windows\System\GacOcfW.exe
  2⤵
  PID:7708
- C:\Windows\System\kSfNjZy.exe
  C:\Windows\System\kSfNjZy.exe
  2⤵
  PID:7756
- C:\Windows\System\yZDbier.exe
  C:\Windows\System\yZDbier.exe
  2⤵
  PID:7800
- C:\Windows\System\JLTDSHX.exe
  C:\Windows\System\JLTDSHX.exe
  2⤵
  PID:7784
- C:\Windows\System\KfNtMtb.exe
  C:\Windows\System\KfNtMtb.exe
  2⤵
  PID:7852
- C:\Windows\System\xtZPvPP.exe
  C:\Windows\System\xtZPvPP.exe
  2⤵
  PID:7944
- C:\Windows\System\QSYkhes.exe
  C:\Windows\System\QSYkhes.exe
  2⤵
  PID:7864
- C:\Windows\System\ffMrgGm.exe
  C:\Windows\System\ffMrgGm.exe
  2⤵
  PID:7896
- C:\Windows\System\nxUixOv.exe
  C:\Windows\System\nxUixOv.exe
  2⤵
  PID:8012
- C:\Windows\System\POqfXeN.exe
  C:\Windows\System\POqfXeN.exe
  2⤵
  PID:7960
- C:\Windows\System\gyzAxFS.exe
  C:\Windows\System\gyzAxFS.exe
  2⤵
  PID:8024
- C:\Windows\System\NDInDPC.exe
  C:\Windows\System\NDInDPC.exe
  2⤵
  PID:8104
- C:\Windows\System\qnpStab.exe
  C:\Windows\System\qnpStab.exe
  2⤵
  PID:8140
- C:\Windows\System\oNucoWw.exe
  C:\Windows\System\oNucoWw.exe
  2⤵
  PID:8088
- C:\Windows\System\glgdXdA.exe
  C:\Windows\System\glgdXdA.exe
  2⤵
  PID:8184
- C:\Windows\System\opMDLYd.exe
  C:\Windows\System\opMDLYd.exe
  2⤵
  PID:8172
- C:\Windows\System\fBqWdQo.exe
  C:\Windows\System\fBqWdQo.exe
  2⤵
  PID:7100
- C:\Windows\System\lHCbhCa.exe
  C:\Windows\System\lHCbhCa.exe
  2⤵
  PID:7252
- C:\Windows\System\ZIgCLTg.exe
  C:\Windows\System\ZIgCLTg.exe
  2⤵
  PID:6888
- C:\Windows\System\LwHePts.exe
  C:\Windows\System\LwHePts.exe
  2⤵
  PID:7284
- C:\Windows\System\NjczxYd.exe
  C:\Windows\System\NjczxYd.exe
  2⤵
  PID:7408
- C:\Windows\System\vefDfyZ.exe
  C:\Windows\System\vefDfyZ.exe
  2⤵
  PID:7380
- C:\Windows\System\IBYlUKT.exe
  C:\Windows\System\IBYlUKT.exe
  2⤵
  PID:7432
- C:\Windows\System\UoWWBpY.exe
  C:\Windows\System\UoWWBpY.exe
  2⤵
  PID:7612
- C:\Windows\System\eJaaSel.exe
  C:\Windows\System\eJaaSel.exe
  2⤵
  PID:7420
- C:\Windows\System\kjUvZYI.exe
  C:\Windows\System\kjUvZYI.exe
  2⤵
  PID:7400
- C:\Windows\System\YurxPgk.exe
  C:\Windows\System\YurxPgk.exe
  2⤵
  PID:7672
- C:\Windows\System\oWkeSEf.exe
  C:\Windows\System\oWkeSEf.exe
  2⤵
  PID:7884
- C:\Windows\System\guCbspg.exe
  C:\Windows\System\guCbspg.exe
  2⤵
  PID:7768
- C:\Windows\System\cgKPQRo.exe
  C:\Windows\System\cgKPQRo.exe
  2⤵
  PID:7948
- C:\Windows\System\wOfTpyM.exe
  C:\Windows\System\wOfTpyM.exe
  2⤵
  PID:8008
- C:\Windows\System\PxSUhCV.exe
  C:\Windows\System\PxSUhCV.exe
  2⤵
  PID:8060
- C:\Windows\System\FmxItWh.exe
  C:\Windows\System\FmxItWh.exe
  2⤵
  PID:8152
- C:\Windows\System\XkkcIrW.exe
  C:\Windows\System\XkkcIrW.exe
  2⤵
  PID:8124
- C:\Windows\System\zQnVgIF.exe
  C:\Windows\System\zQnVgIF.exe
  2⤵
  PID:7204
- C:\Windows\System\CNbHfze.exe
  C:\Windows\System\CNbHfze.exe
  2⤵
  PID:6176
- C:\Windows\System\fjGNplz.exe
  C:\Windows\System\fjGNplz.exe
  2⤵
  PID:7512
- C:\Windows\System\qSNKrfR.exe
  C:\Windows\System\qSNKrfR.exe
  2⤵
  PID:7360
- C:\Windows\System\YJxauJI.exe
  C:\Windows\System\YJxauJI.exe
  2⤵
  PID:7396
- C:\Windows\System\ZZugHrv.exe
  C:\Windows\System\ZZugHrv.exe
  2⤵
  PID:7576
- C:\Windows\System\akOTqKo.exe
  C:\Windows\System\akOTqKo.exe
  2⤵
  PID:7816
- C:\Windows\System\emzpZsv.exe
  C:\Windows\System\emzpZsv.exe
  2⤵
  PID:7928
- C:\Windows\System\lzCpiCs.exe
  C:\Windows\System\lzCpiCs.exe
  2⤵
  PID:8028
- C:\Windows\System\FgHAVSD.exe
  C:\Windows\System\FgHAVSD.exe
  2⤵
  PID:7184
- C:\Windows\System\DZVyDcQ.exe
  C:\Windows\System\DZVyDcQ.exe
  2⤵
  PID:7364
- C:\Windows\System\uUsoEoy.exe
  C:\Windows\System\uUsoEoy.exe
  2⤵
  PID:7980
- C:\Windows\System\udMMUmW.exe
  C:\Windows\System\udMMUmW.exe
  2⤵
  PID:7752
- C:\Windows\System\kVnDoUk.exe
  C:\Windows\System\kVnDoUk.exe
  2⤵
  PID:7848
- C:\Windows\System\XtptGCS.exe
  C:\Windows\System\XtptGCS.exe
  2⤵
  PID:7508
- C:\Windows\System\oSrENmr.exe
  C:\Windows\System\oSrENmr.exe
  2⤵
  PID:7836
- C:\Windows\System\cIuRRMm.exe
  C:\Windows\System\cIuRRMm.exe
  2⤵
  PID:7236
- C:\Windows\System\ZRbcrig.exe
  C:\Windows\System\ZRbcrig.exe
  2⤵
  PID:7724
- C:\Windows\System\UfDDzvn.exe
  C:\Windows\System\UfDDzvn.exe
  2⤵
  PID:8208
- C:\Windows\System\nJztabd.exe
  C:\Windows\System\nJztabd.exe
  2⤵
  PID:8224
- C:\Windows\System\mKyEDxR.exe
  C:\Windows\System\mKyEDxR.exe
  2⤵
  PID:8240
- C:\Windows\System\tNvWCny.exe
  C:\Windows\System\tNvWCny.exe
  2⤵
  PID:8256
- C:\Windows\System\Wuapibp.exe
  C:\Windows\System\Wuapibp.exe
  2⤵
  PID:8272
- C:\Windows\System\WhkZiWW.exe
  C:\Windows\System\WhkZiWW.exe
  2⤵
  PID:8288
- C:\Windows\System\VkSoqIk.exe
  C:\Windows\System\VkSoqIk.exe
  2⤵
  PID:8304
- C:\Windows\System\YailNUE.exe
  C:\Windows\System\YailNUE.exe
  2⤵
  PID:8320
- C:\Windows\System\RdVeCap.exe
  C:\Windows\System\RdVeCap.exe
  2⤵
  PID:8336
- C:\Windows\System\DZWBocx.exe
  C:\Windows\System\DZWBocx.exe
  2⤵
  PID:8352
- C:\Windows\System\USupDyV.exe
  C:\Windows\System\USupDyV.exe
  2⤵
  PID:8368
- C:\Windows\System\COFidei.exe
  C:\Windows\System\COFidei.exe
  2⤵
  PID:8384
- C:\Windows\System\JKlvRut.exe
  C:\Windows\System\JKlvRut.exe
  2⤵
  PID:8400
- C:\Windows\System\ZDXLCRG.exe
  C:\Windows\System\ZDXLCRG.exe
  2⤵
  PID:8416
- C:\Windows\System\wmEPHJA.exe
  C:\Windows\System\wmEPHJA.exe
  2⤵
  PID:8432
- C:\Windows\System\trfzETr.exe
  C:\Windows\System\trfzETr.exe
  2⤵
  PID:8448
- C:\Windows\System\XsNsLPb.exe
  C:\Windows\System\XsNsLPb.exe
  2⤵
  PID:8464
- C:\Windows\System\pGVRbDa.exe
  C:\Windows\System\pGVRbDa.exe
  2⤵
  PID:8480
- C:\Windows\System\ZOtzvRx.exe
  C:\Windows\System\ZOtzvRx.exe
  2⤵
  PID:8496
- C:\Windows\System\eRJQEuk.exe
  C:\Windows\System\eRJQEuk.exe
  2⤵
  PID:8512
- C:\Windows\System\ODrAFRZ.exe
  C:\Windows\System\ODrAFRZ.exe
  2⤵
  PID:8528
- C:\Windows\System\KJJmbJl.exe
  C:\Windows\System\KJJmbJl.exe
  2⤵
  PID:8544
- C:\Windows\System\yAvjVrT.exe
  C:\Windows\System\yAvjVrT.exe
  2⤵
  PID:8560
- C:\Windows\System\IJYivEg.exe
  C:\Windows\System\IJYivEg.exe
  2⤵
  PID:8576
- C:\Windows\System\ToSznrs.exe
  C:\Windows\System\ToSznrs.exe
  2⤵
  PID:8592
- C:\Windows\System\hNZIkfs.exe
  C:\Windows\System\hNZIkfs.exe
  2⤵
  PID:8608
- C:\Windows\System\JWpehXr.exe
  C:\Windows\System\JWpehXr.exe
  2⤵
  PID:8624
- C:\Windows\System\ntMYYss.exe
  C:\Windows\System\ntMYYss.exe
  2⤵
  PID:8640
- C:\Windows\System\GUNfAPw.exe
  C:\Windows\System\GUNfAPw.exe
  2⤵
  PID:8656
- C:\Windows\System\ErKEQFR.exe
  C:\Windows\System\ErKEQFR.exe
  2⤵
  PID:8672
- C:\Windows\System\vEcqPWG.exe
  C:\Windows\System\vEcqPWG.exe
  2⤵
  PID:8688
- C:\Windows\System\fLBkilo.exe
  C:\Windows\System\fLBkilo.exe
  2⤵
  PID:8704
- C:\Windows\System\YiVLxaI.exe
  C:\Windows\System\YiVLxaI.exe
  2⤵
  PID:8720
- C:\Windows\System\nalCiWR.exe
  C:\Windows\System\nalCiWR.exe
  2⤵
  PID:8736
- C:\Windows\System\vQlUTsC.exe
  C:\Windows\System\vQlUTsC.exe
  2⤵
  PID:8752
- C:\Windows\System\nOMkIFH.exe
  C:\Windows\System\nOMkIFH.exe
  2⤵
  PID:8768
- C:\Windows\System\EBHPHFD.exe
  C:\Windows\System\EBHPHFD.exe
  2⤵
  PID:8784
- C:\Windows\System\QUTVJql.exe
  C:\Windows\System\QUTVJql.exe
  2⤵
  PID:8800
- C:\Windows\System\LcutjHb.exe
  C:\Windows\System\LcutjHb.exe
  2⤵
  PID:8816
- C:\Windows\System\Aofzoad.exe
  C:\Windows\System\Aofzoad.exe
  2⤵
  PID:8832
- C:\Windows\System\byDkyxk.exe
  C:\Windows\System\byDkyxk.exe
  2⤵
  PID:8852
- C:\Windows\System\wLCCWhA.exe
  C:\Windows\System\wLCCWhA.exe
  2⤵
  PID:8868
- C:\Windows\System\bWyxnUO.exe
  C:\Windows\System\bWyxnUO.exe
  2⤵
  PID:8884
- C:\Windows\System\bxNeeXS.exe
  C:\Windows\System\bxNeeXS.exe
  2⤵
  PID:8900
- C:\Windows\System\PeAAlzf.exe
  C:\Windows\System\PeAAlzf.exe
  2⤵
  PID:8916
- C:\Windows\System\SxKDNIl.exe
  C:\Windows\System\SxKDNIl.exe
  2⤵
  PID:8932
- C:\Windows\System\TyeQARj.exe
  C:\Windows\System\TyeQARj.exe
  2⤵
  PID:8948
- C:\Windows\System\GCosOuT.exe
  C:\Windows\System\GCosOuT.exe
  2⤵
  PID:8964
- C:\Windows\System\vteMcxP.exe
  C:\Windows\System\vteMcxP.exe
  2⤵
  PID:8980
- C:\Windows\System\JfUbHph.exe
  C:\Windows\System\JfUbHph.exe
  2⤵
  PID:8996
- C:\Windows\System\SkwTPPg.exe
  C:\Windows\System\SkwTPPg.exe
  2⤵
  PID:9012
- C:\Windows\System\qQhIzVR.exe
  C:\Windows\System\qQhIzVR.exe
  2⤵
  PID:9028
- C:\Windows\System\aUmpfMc.exe
  C:\Windows\System\aUmpfMc.exe
  2⤵
  PID:9044
- C:\Windows\System\tyDcCqB.exe
  C:\Windows\System\tyDcCqB.exe
  2⤵
  PID:9060
- C:\Windows\System\XzzBbgk.exe
  C:\Windows\System\XzzBbgk.exe
  2⤵
  PID:9076
- C:\Windows\System\iWOyAzA.exe
  C:\Windows\System\iWOyAzA.exe
  2⤵
  PID:9092
- C:\Windows\System\FyfxIWc.exe
  C:\Windows\System\FyfxIWc.exe
  2⤵
  PID:9108
- C:\Windows\System\PehtuFI.exe
  C:\Windows\System\PehtuFI.exe
  2⤵
  PID:9124
- C:\Windows\System\qbqVOmu.exe
  C:\Windows\System\qbqVOmu.exe
  2⤵
  PID:9140
- C:\Windows\System\bjcJmYd.exe
  C:\Windows\System\bjcJmYd.exe
  2⤵
  PID:9156
- C:\Windows\System\dZrJpGm.exe
  C:\Windows\System\dZrJpGm.exe
  2⤵
  PID:9172
- C:\Windows\System\VllXLVI.exe
  C:\Windows\System\VllXLVI.exe
  2⤵
  PID:9188
- C:\Windows\System\kBlYgdp.exe
  C:\Windows\System\kBlYgdp.exe
  2⤵
  PID:9204
- C:\Windows\System\UqwdbgN.exe
  C:\Windows\System\UqwdbgN.exe
  2⤵
  PID:8200
- C:\Windows\System\roHDYbT.exe
  C:\Windows\System\roHDYbT.exe
  2⤵
  PID:8236
- C:\Windows\System\qOBOFoZ.exe
  C:\Windows\System\qOBOFoZ.exe
  2⤵
  PID:8268
- C:\Windows\System\SYdpAHT.exe
  C:\Windows\System\SYdpAHT.exe
  2⤵
  PID:8284
- C:\Windows\System\yTNqpBN.exe
  C:\Windows\System\yTNqpBN.exe
  2⤵
  PID:8332
- C:\Windows\System\IpoflQx.exe
  C:\Windows\System\IpoflQx.exe
  2⤵
  PID:7428
- C:\Windows\System\SrzvreR.exe
  C:\Windows\System\SrzvreR.exe
  2⤵
  PID:8312
- C:\Windows\System\EYzpkDN.exe
  C:\Windows\System\EYzpkDN.exe
  2⤵
  PID:8380
- C:\Windows\System\Fgesmax.exe
  C:\Windows\System\Fgesmax.exe
  2⤵
  PID:8460
- C:\Windows\System\tFvYKKc.exe
  C:\Windows\System\tFvYKKc.exe
  2⤵
  PID:8440
- C:\Windows\System\DFLBIoW.exe
  C:\Windows\System\DFLBIoW.exe
  2⤵
  PID:8504
- C:\Windows\System\PkZLeKg.exe
  C:\Windows\System\PkZLeKg.exe
  2⤵
  PID:8572
- C:\Windows\System\PteJzKR.exe
  C:\Windows\System\PteJzKR.exe
  2⤵
  PID:8604
- C:\Windows\System\SfTWZgo.exe
  C:\Windows\System\SfTWZgo.exe
  2⤵
  PID:8552
- C:\Windows\System\ufvkKyg.exe
  C:\Windows\System\ufvkKyg.exe
  2⤵
  PID:8588
- C:\Windows\System\SsfZjoZ.exe
  C:\Windows\System\SsfZjoZ.exe
  2⤵
  PID:8652
- C:\Windows\System\pxIwjrZ.exe
  C:\Windows\System\pxIwjrZ.exe
  2⤵
  PID:8716
- C:\Windows\System\jjdrnxY.exe
  C:\Windows\System\jjdrnxY.exe
  2⤵
  PID:8780
- C:\Windows\System\esjtbWd.exe
  C:\Windows\System\esjtbWd.exe
  2⤵
  PID:8840
- C:\Windows\System\NoaSHYg.exe
  C:\Windows\System\NoaSHYg.exe
  2⤵
  PID:8876
- C:\Windows\System\VojbIuO.exe
  C:\Windows\System\VojbIuO.exe
  2⤵
  PID:8860
- C:\Windows\System\mFEzYLc.exe
  C:\Windows\System\mFEzYLc.exe
  2⤵
  PID:8732
- C:\Windows\System\NKsqhCP.exe
  C:\Windows\System\NKsqhCP.exe
  2⤵
  PID:8940
- C:\Windows\System\QiRPkEJ.exe
  C:\Windows\System\QiRPkEJ.exe
  2⤵
  PID:8972
- C:\Windows\System\zyZGdZU.exe
  C:\Windows\System\zyZGdZU.exe
  2⤵
  PID:8928
- C:\Windows\System\qMCESNM.exe
  C:\Windows\System\qMCESNM.exe
  2⤵
  PID:9036
- C:\Windows\System\qGzWDPk.exe
  C:\Windows\System\qGzWDPk.exe
  2⤵
  PID:9024
- C:\Windows\System\NWTzThc.exe
  C:\Windows\System\NWTzThc.exe
  2⤵
  PID:9072
- C:\Windows\System\YBmKHHz.exe
  C:\Windows\System\YBmKHHz.exe
  2⤵
  PID:9056
- C:\Windows\System\fwOLLIL.exe
  C:\Windows\System\fwOLLIL.exe
  2⤵
  PID:9120
- C:\Windows\System\DpahJAB.exe
  C:\Windows\System\DpahJAB.exe
  2⤵
  PID:9168
- C:\Windows\System\uRFAlUd.exe
  C:\Windows\System\uRFAlUd.exe
  2⤵
  PID:9148
- C:\Windows\System\xpehCtm.exe
  C:\Windows\System\xpehCtm.exe
  2⤵
  PID:9180
- C:\Windows\System\PJOjGQx.exe
  C:\Windows\System\PJOjGQx.exe
  2⤵
  PID:7492
- C:\Windows\System\FguSZhh.exe
  C:\Windows\System\FguSZhh.exe
  2⤵
  PID:8328
- C:\Windows\System\VFifPXw.exe
  C:\Windows\System\VFifPXw.exe
  2⤵
  PID:8364
- C:\Windows\System\ysNbOcJ.exe
  C:\Windows\System\ysNbOcJ.exe
  2⤵
  PID:8412
- C:\Windows\System\jWZBAZe.exe
  C:\Windows\System\jWZBAZe.exe
  2⤵
  PID:8568
- C:\Windows\System\QDlneYB.exe
  C:\Windows\System\QDlneYB.exe
  2⤵
  PID:8600
- C:\Windows\System\jGMDuMj.exe
  C:\Windows\System\jGMDuMj.exe
  2⤵
  PID:8668
- C:\Windows\System\WeRFYUq.exe
  C:\Windows\System\WeRFYUq.exe
  2⤵
  PID:8744
- C:\Windows\System\oFjcGCa.exe
  C:\Windows\System\oFjcGCa.exe
  2⤵
  PID:8764
- C:\Windows\System\pZFjHQE.exe
  C:\Windows\System\pZFjHQE.exe
  2⤵
  PID:8648
- C:\Windows\System\qyRqvSv.exe
  C:\Windows\System\qyRqvSv.exe
  2⤵
  PID:8912
- C:\Windows\System\ZxXOBPX.exe
  C:\Windows\System\ZxXOBPX.exe
  2⤵
  PID:8864
- C:\Windows\System\KDOmRCK.exe
  C:\Windows\System\KDOmRCK.exe
  2⤵
  PID:9052
- C:\Windows\System\kIMugMG.exe
  C:\Windows\System\kIMugMG.exe
  2⤵
  PID:8960
- C:\Windows\System\tMdkoZg.exe
  C:\Windows\System\tMdkoZg.exe
  2⤵
  PID:8232
- C:\Windows\System\aSgkFAu.exe
  C:\Windows\System\aSgkFAu.exe
  2⤵
  PID:8264
- C:\Windows\System\PxKPVay.exe
  C:\Windows\System\PxKPVay.exe
  2⤵
  PID:8280
- C:\Windows\System\dttVGtw.exe
  C:\Windows\System\dttVGtw.exe
  2⤵
  PID:8476
- C:\Windows\System\gucMWvS.exe
  C:\Windows\System\gucMWvS.exe
  2⤵
  PID:8636
- C:\Windows\System\ALyCapm.exe
  C:\Windows\System\ALyCapm.exe
  2⤵
  PID:8908
- C:\Windows\System\WNllPep.exe
  C:\Windows\System\WNllPep.exe
  2⤵
  PID:8524
- C:\Windows\System\bRSvklw.exe
  C:\Windows\System\bRSvklw.exe
  2⤵
  PID:9104
- C:\Windows\System\qIKKsMD.exe
  C:\Windows\System\qIKKsMD.exe
  2⤵
  PID:9008
- C:\Windows\System\fKRnwcj.exe
  C:\Windows\System\fKRnwcj.exe
  2⤵
  PID:8392
- C:\Windows\System\SdiTtgz.exe
  C:\Windows\System\SdiTtgz.exe
  2⤵
  PID:8520
- C:\Windows\System\tJXLTIG.exe
  C:\Windows\System\tJXLTIG.exe
  2⤵
  PID:8812
- C:\Windows\System\RYYZJfA.exe
  C:\Windows\System\RYYZJfA.exe
  2⤵
  PID:8828
- C:\Windows\System\sSnYvmm.exe
  C:\Windows\System\sSnYvmm.exe
  2⤵
  PID:8492
- C:\Windows\System\VRXrYZd.exe
  C:\Windows\System\VRXrYZd.exe
  2⤵
  PID:8344
- C:\Windows\System\hPnCmVQ.exe
  C:\Windows\System\hPnCmVQ.exe
  2⤵
  PID:9228
- C:\Windows\System\KypVSwP.exe
  C:\Windows\System\KypVSwP.exe
  2⤵
  PID:9244
- C:\Windows\System\uNGOgbj.exe
  C:\Windows\System\uNGOgbj.exe
  2⤵
  PID:9260
- C:\Windows\System\NcwPRcO.exe
  C:\Windows\System\NcwPRcO.exe
  2⤵
  PID:9276
- C:\Windows\System\SPsRfsd.exe
  C:\Windows\System\SPsRfsd.exe
  2⤵
  PID:9292
- C:\Windows\System\mRFKruc.exe
  C:\Windows\System\mRFKruc.exe
  2⤵
  PID:9308
- C:\Windows\System\sKBUTlk.exe
  C:\Windows\System\sKBUTlk.exe
  2⤵
  PID:9324
- C:\Windows\System\gsbiHou.exe
  C:\Windows\System\gsbiHou.exe
  2⤵
  PID:9340
- C:\Windows\System\xDJZwzC.exe
  C:\Windows\System\xDJZwzC.exe
  2⤵
  PID:9360
- C:\Windows\System\BNlbUoP.exe
  C:\Windows\System\BNlbUoP.exe
  2⤵
  PID:9376
- C:\Windows\System\BJzIZYw.exe
  C:\Windows\System\BJzIZYw.exe
  2⤵
  PID:9396
- C:\Windows\System\YzSjEzS.exe
  C:\Windows\System\YzSjEzS.exe
  2⤵
  PID:9412
- C:\Windows\System\cTbTmRc.exe
  C:\Windows\System\cTbTmRc.exe
  2⤵
  PID:9428
- C:\Windows\System\NoAUzDC.exe
  C:\Windows\System\NoAUzDC.exe
  2⤵
  PID:9444
- C:\Windows\System\ZcRCsVE.exe
  C:\Windows\System\ZcRCsVE.exe
  2⤵
  PID:9460
- C:\Windows\System\MEkftlH.exe
  C:\Windows\System\MEkftlH.exe
  2⤵
  PID:9476
- C:\Windows\System\aVnhsTo.exe
  C:\Windows\System\aVnhsTo.exe
  2⤵
  PID:9492
- C:\Windows\System\KKwcqdK.exe
  C:\Windows\System\KKwcqdK.exe
  2⤵
  PID:9508
- C:\Windows\System\QuwzjMS.exe
  C:\Windows\System\QuwzjMS.exe
  2⤵
  PID:9524
- C:\Windows\System\uwFtgog.exe
  C:\Windows\System\uwFtgog.exe
  2⤵
  PID:9540
- C:\Windows\System\onnPJIo.exe
  C:\Windows\System\onnPJIo.exe
  2⤵
  PID:9556
- C:\Windows\System\AdARUoh.exe
  C:\Windows\System\AdARUoh.exe
  2⤵
  PID:9572
- C:\Windows\System\WIPrizP.exe
  C:\Windows\System\WIPrizP.exe
  2⤵
  PID:9588
- C:\Windows\System\LITouAO.exe
  C:\Windows\System\LITouAO.exe
  2⤵
  PID:9604
- C:\Windows\System\XOEBAzQ.exe
  C:\Windows\System\XOEBAzQ.exe
  2⤵
  PID:9624
- C:\Windows\System\sFltTUP.exe
  C:\Windows\System\sFltTUP.exe
  2⤵
  PID:9640
- C:\Windows\System\RKytPHC.exe
  C:\Windows\System\RKytPHC.exe
  2⤵
  PID:9656
- C:\Windows\System\pyvomvy.exe
  C:\Windows\System\pyvomvy.exe
  2⤵
  PID:9672
- C:\Windows\System\FrWNFNA.exe
  C:\Windows\System\FrWNFNA.exe
  2⤵
  PID:9688
- C:\Windows\System\rIVbzMn.exe
  C:\Windows\System\rIVbzMn.exe
  2⤵
  PID:9708
- C:\Windows\System\hKHvWoy.exe
  C:\Windows\System\hKHvWoy.exe
  2⤵
  PID:9724
- C:\Windows\System\JwWnhcD.exe
  C:\Windows\System\JwWnhcD.exe
  2⤵
  PID:9740
- C:\Windows\System\EOrqjpI.exe
  C:\Windows\System\EOrqjpI.exe
  2⤵
  PID:9756
- C:\Windows\System\HDBPTFP.exe
  C:\Windows\System\HDBPTFP.exe
  2⤵
  PID:9772
- C:\Windows\System\jOEmUuC.exe
  C:\Windows\System\jOEmUuC.exe
  2⤵
  PID:9788
- C:\Windows\System\dSjDtrp.exe
  C:\Windows\System\dSjDtrp.exe
  2⤵
  PID:9804
- C:\Windows\System\PhIwyit.exe
  C:\Windows\System\PhIwyit.exe
  2⤵
  PID:9836
- C:\Windows\System\lAQmgtI.exe
  C:\Windows\System\lAQmgtI.exe
  2⤵
  PID:9856
- C:\Windows\System\PrsvzKA.exe
  C:\Windows\System\PrsvzKA.exe
  2⤵
  PID:9872
- C:\Windows\System\ofKlwcw.exe
  C:\Windows\System\ofKlwcw.exe
  2⤵
  PID:9888
- C:\Windows\System\SkAJobL.exe
  C:\Windows\System\SkAJobL.exe
  2⤵
  PID:9904
- C:\Windows\System\pFDKYpq.exe
  C:\Windows\System\pFDKYpq.exe
  2⤵
  PID:9920
- C:\Windows\System\IKAllHE.exe
  C:\Windows\System\IKAllHE.exe
  2⤵
  PID:9936
- C:\Windows\System\UOwMGHD.exe
  C:\Windows\System\UOwMGHD.exe
  2⤵
  PID:9952
- C:\Windows\System\PZilnBg.exe
  C:\Windows\System\PZilnBg.exe
  2⤵
  PID:9968
- C:\Windows\System\HXArQGu.exe
  C:\Windows\System\HXArQGu.exe
  2⤵
  PID:9984
- C:\Windows\System\EzTkjxc.exe
  C:\Windows\System\EzTkjxc.exe
  2⤵
  PID:10000
- C:\Windows\System\rRapkgF.exe
  C:\Windows\System\rRapkgF.exe
  2⤵
  PID:10016
- C:\Windows\System\OeHUQqJ.exe
  C:\Windows\System\OeHUQqJ.exe
  2⤵
  PID:10032
- C:\Windows\System\XfdSerd.exe
  C:\Windows\System\XfdSerd.exe
  2⤵
  PID:10048
- C:\Windows\System\sgBbKQQ.exe
  C:\Windows\System\sgBbKQQ.exe
  2⤵
  PID:10068
- C:\Windows\System\RoKJSTP.exe
  C:\Windows\System\RoKJSTP.exe
  2⤵
  PID:10084
- C:\Windows\System\aMYmwnD.exe
  C:\Windows\System\aMYmwnD.exe
  2⤵
  PID:10100
- C:\Windows\System\pKTxlPK.exe
  C:\Windows\System\pKTxlPK.exe
  2⤵
  PID:10120
- C:\Windows\System\HTSpUIA.exe
  C:\Windows\System\HTSpUIA.exe
  2⤵
  PID:10136
- C:\Windows\System\cfVLjWZ.exe
  C:\Windows\System\cfVLjWZ.exe
  2⤵
  PID:10152
- C:\Windows\System\hOKiIYy.exe
  C:\Windows\System\hOKiIYy.exe
  2⤵
  PID:10168
- C:\Windows\System\rhzRoTz.exe
  C:\Windows\System\rhzRoTz.exe
  2⤵
  PID:10192
- C:\Windows\System\CJUENic.exe
  C:\Windows\System\CJUENic.exe
  2⤵
  PID:10208
- C:\Windows\System\OLhBYqw.exe
  C:\Windows\System\OLhBYqw.exe
  2⤵
  PID:10228
- C:\Windows\System\NhgXras.exe
  C:\Windows\System\NhgXras.exe
  2⤵
  PID:9088
- C:\Windows\System\zbTRtAw.exe
  C:\Windows\System\zbTRtAw.exe
  2⤵
  PID:8824
- C:\Windows\System\KNhhzHj.exe
  C:\Windows\System\KNhhzHj.exe
  2⤵
  PID:9268
- C:\Windows\System\BmNndfp.exe
  C:\Windows\System\BmNndfp.exe
  2⤵
  PID:9336
- C:\Windows\System\MLhYyeB.exe
  C:\Windows\System\MLhYyeB.exe
  2⤵
  PID:9284
- C:\Windows\System\hUQXUeR.exe
  C:\Windows\System\hUQXUeR.exe
  2⤵
  PID:9408
- C:\Windows\System\bnYTuzw.exe
  C:\Windows\System\bnYTuzw.exe
  2⤵
  PID:9252
- C:\Windows\System\yvGaBFK.exe
  C:\Windows\System\yvGaBFK.exe
  2⤵
  PID:9468
- C:\Windows\System\zFCmoGx.exe
  C:\Windows\System\zFCmoGx.exe
  2⤵
  PID:9392
- C:\Windows\System\UIAquNn.exe
  C:\Windows\System\UIAquNn.exe
  2⤵
  PID:9456
- C:\Windows\System\sRjsDAC.exe
  C:\Windows\System\sRjsDAC.exe
  2⤵
  PID:9504
- C:\Windows\System\hrNnlzS.exe
  C:\Windows\System\hrNnlzS.exe
  2⤵
  PID:9516
- C:\Windows\System\vSgHrtV.exe
  C:\Windows\System\vSgHrtV.exe
  2⤵
  PID:9568
- C:\Windows\System\TqmEcnx.exe
  C:\Windows\System\TqmEcnx.exe
  2⤵
  PID:9552
- C:\Windows\System\kZYmMEp.exe
  C:\Windows\System\kZYmMEp.exe
  2⤵
  PID:9696
- C:\Windows\System\qHhYzNJ.exe
  C:\Windows\System\qHhYzNJ.exe
  2⤵
  PID:9648
- C:\Windows\System\rctGIav.exe
  C:\Windows\System\rctGIav.exe
  2⤵
  PID:9620
- C:\Windows\System\mvbdQFy.exe
  C:\Windows\System\mvbdQFy.exe
  2⤵
  PID:9720
- C:\Windows\System\sjCkECL.exe
  C:\Windows\System\sjCkECL.exe
  2⤵
  PID:9768
- C:\Windows\System\TyXBXUS.exe
  C:\Windows\System\TyXBXUS.exe
  2⤵
  PID:9752
- C:\Windows\System\kizNGhu.exe
  C:\Windows\System\kizNGhu.exe
  2⤵
  PID:9844
- C:\Windows\System\MBncMpY.exe
  C:\Windows\System\MBncMpY.exe
  2⤵
  PID:9852
- C:\Windows\System\eGdXtOA.exe
  C:\Windows\System\eGdXtOA.exe
  2⤵
  PID:9828
- C:\Windows\System\wsFHTLq.exe
  C:\Windows\System\wsFHTLq.exe
  2⤵
  PID:9820
- C:\Windows\System\AOlCHIM.exe
  C:\Windows\System\AOlCHIM.exe
  2⤵
  PID:10008
- C:\Windows\System\ClFLikM.exe
  C:\Windows\System\ClFLikM.exe
  2⤵
  PID:10076
- C:\Windows\System\DwyRggJ.exe
  C:\Windows\System\DwyRggJ.exe
  2⤵
  PID:10116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CqGtItW.exe

Filesize
1.6MB

MD5
3c154ba9a4defa8d70deeed41e64bea2

SHA1
6a047dce16870998015ea76d7ee237370516a657

SHA256
0e236b045eb5d6190df8a2e878ac6e2e3fd8ca00eea5411e166462c522a36c7e

SHA512
3dc671c198fa0200b0585c647835b06c487876283ebf1be07a3f1bb6d93ad4d1c42bbde16812e5bc778cb22cf30ed69bb789665527bcfe56e39bfc41847ab5db

Download Submit
C:\Windows\system\DOirRzk.exe

Filesize
1.6MB

MD5
4f5c6725aadd222d4242341a65bc20a3

SHA1
ef0bbbd64b83d78764b6d7d746390ed99d03785d

SHA256
6a556dbfe22ed7c608f04fd63f059af8b2bd532028267e5d91a03fdf87eae004

SHA512
ddb0723f7d65c0a82e9708304c4e390d84365229fa78caeb385360d3357cedf3838ad7194fc5aec8073911885925622cdb1c15de2faaa9a40c7a7a9b6c106fe5

Download Submit
C:\Windows\system\EOESNbO.exe

Filesize
1.6MB

MD5
22ba5814a46467d5d611d9b5fa2d48b2

SHA1
291c17c7bf7d601366ebad4db3a821e280b49bc1

SHA256
adeafb00d01685d122c2a7be9492680252f278f5b4c728dd8d48b8a2e0703a97

SHA512
f030f02821adb99417934d784ee84b37b60120bcce3bd5687db12857735987279b5e3b0a7349fb8d9da8b2f1ff83114a464e77174341bfec826f6676960d04e3

Download Submit
C:\Windows\system\GDdQLsF.exe

Filesize
1.6MB

MD5
8a4429f83976f06d3a5ce57210215036

SHA1
b4603c812fd8648dcc1c2f08db8ba0a01690f6d1

SHA256
9902de7c69570ba27fff90d370d832aab457f76e897fe7d38623f30ae9c1d643

SHA512
f5de485922174ad31dad75dea2b083f528b96c47c87643a4de154c5dd5b3d50679221173ee7e40707872d0bf82eb66fe5739b6a4be3cc7987d1136b4f793c2cd

Download Submit
C:\Windows\system\JoAtWKJ.exe

Filesize
1.6MB

MD5
4e8ec0a4968a2d6c368b78a99bf56141

SHA1
f7fa0dc23c36c5f79d6a07e532096ae71bb907c8

SHA256
18dd00fa5db4f1bc17ac272bdacc11d3a84a35e0f0a93b7217423db73255f282

SHA512
d9e52f2833666380aef59809de5fecbd771eb5430fea2fc347283b24a6ab0e660acc1a11bd8621d430ca7706434c82460b648db71d7188a393d8ec0761f695a4

Download Submit
C:\Windows\system\KOjlfFR.exe

Filesize
1.6MB

MD5
0a76dada0876b8423675980b177a8b27

SHA1
4c4f6e5b84d35dd465d1660afc0aa307440749ad

SHA256
c149ccfc1ac12259af0f74b18427dbd7bdaa98a39fa477bc2fea5bc521b771ad

SHA512
c56638579a0df4c164770e71f82a12e7de7a28d7754947579eb5ba2c2ca427cbae2c36ae48b7695bb43092fe31a206551382418a5d26c631f28d9bea125d274e

Download Submit
C:\Windows\system\LIBgRKr.exe

Filesize
1.6MB

MD5
5510024eb94b642366c42546e259224a

SHA1
73d5d3c1e1e6de630a6af5e6679d2a163a963052

SHA256
8f137e1c3e4479f4c550d633a26dd8040d0289f4a71bfc9ee3342cc04ed90fa0

SHA512
7de474eb3dc2c1f0f972233fdd1f9316cf977887848647df379ce036c80b0e2d7bd8812e5531bbd8648e42e96f380272a32f628d1fc6129ccc35ae9f1829fc71

Download Submit
C:\Windows\system\OtVQZAe.exe

Filesize
1.6MB

MD5
12f10b0450b66182f1c92a2d2bce271a

SHA1
a28a14dc38eed4a96486c12116e741789e500a94

SHA256
4b5a21c07fa2981990d2528559bca04f92b313b75109eb6949da559378835b2c

SHA512
20b9cbf2e8fc49dcdd267e45f9b517ef94e7abfe19b050c37731dc108fa1fd8dc601ebe18a93c9fc5e4242ca63a691a69be35cc2ce8dd03d1d28c3ae42a138f0

Download Submit
C:\Windows\system\PnSXLFc.exe

Filesize
1.6MB

MD5
4a1e5a52711d5afd1da8363e79aa406e

SHA1
a2ca10c3ab77af625f2b0f8f85eaef39d56d6055

SHA256
82f8836e114aaa3859643b6a3f26cbf32f8845d7e06cb42192fe6e2b9d90d5fe

SHA512
900cbd159c50b0a47471fec875eaa652bd59189bac4138b3337674b1522e283d1770924cb50b75b83707ed66945574cf31943dd1e7d78228b12d1791987a41cf

Download Submit
C:\Windows\system\PwDewsB.exe

Filesize
8B

MD5
8e1226661f8ca09fc62a1fef1fd7fcb8

SHA1
5b44def3d0e8d434236fee53ad977e411181a3d8

SHA256
7c2ccee11204a3d84ff9c71237bbe484161717fa152009f68b3a2efb0ad9c1c9

SHA512
45cc72f2ca6df3fbb9deac023207f7093a2e236cf6702146e776d1f3b55a9e5f29fbb748ba3deb570ab4a7bdfa68cee4df84414f0ac4a063de36a2a303bd6323

Download Submit
C:\Windows\system\QaTvwmL.exe

Filesize
1.6MB

MD5
a732fbbb06a8f4bf331ad5f75c10ce62

SHA1
7fbad85d032afa2dcb92daad52bb5bf370ebba00

SHA256
1d6322d2e3f0ed9dc543c2848e86a6f8fe9351311c9b9e73e133dc5da32a93e5

SHA512
d0ce117e6269b1d0c262d012d7813b00a08e5cc3ebd640df45f8641560166c4825a24c14077a640391a386e2babff780c8d5ceef403e948a32b8f12fe4e5db74

Download Submit
C:\Windows\system\QuHRvQV.exe

Filesize
1.6MB

MD5
fd10f8af4ab4ec784fac2549c407772a

SHA1
f1039a9b0b6fec5297f9340357f90c46b0860c53

SHA256
b1e826295a937411370d844b103b0fa5810a1723df31417bf6780f1aca309d6c

SHA512
0eb93aa5e327921b7c28bc8d3393702f53f7d1a773867fa6c2c824c24a5379e1a62de39513563bd7d2978e8a7674c28c475d095cf15476997d6f3fa306b1e0e1

Download Submit
C:\Windows\system\RQUiOxC.exe

Filesize
1.6MB

MD5
c2dbdf316fdd681bc4270f2ee644056f

SHA1
40b0b3e745e56a89aabc624d1d87df0ec366e3b9

SHA256
2b4a1166d5eb19f96cebaa11f30448ec547e679d8cbbd4c1c7e225d0d35eafcd

SHA512
d696fa5fe702a3fab50aa8c2b6da54441cbc569551af4c0f2a9b0b5070eaec450fd19a01073ab11bf4a26bf225887159bddd3798cc817ed0e9c67b0605c420cc

Download Submit
C:\Windows\system\XiWMQXy.exe

Filesize
1.6MB

MD5
415349c4fc98953027e43998ccec6e98

SHA1
4b219546faafda6bc054900a4ec6f1a108a6c66d

SHA256
92aa70c17cc5f97698034353c930640ba863bc5a6350bb1c8ac41c8851c9c358

SHA512
ec6e23773aaad37f6b4f59964e81d3c42b3587a16e2ac4b3aaf97bdfaef22c390170f1c92775a63a4dcb7e76b5981c3a5e8b0b629a0d15df1a8f1c8685028ab6

Download Submit
C:\Windows\system\YYpqMnQ.exe

Filesize
1.6MB

MD5
3f4df96e9895fa73e5d06b187de93202

SHA1
d7f724c0fa7daf50ca6bb7ce53ab3b8be1c8f21d

SHA256
a7e95e7da4156c3b5b3da8bc068c4fd7424be0bdd04b94db39f82faf7ff6b381

SHA512
e590ef46a1fb6fbec6ab480571bf0c97ea5408a9d18c1b56b74e465ff5bbd178e91893939fbe7fbcd6fbaeb1067ba5632cb1f3d3916e94cd73a0a8e05a80e223

Download Submit
C:\Windows\system\goRleml.exe

Filesize
1.6MB

MD5
5c673e38566754de914f49471378c832

SHA1
ce804c9b5a35d78c94bbc5a2d7663bc988afcbc8

SHA256
cf358f6bfeb37c76b25b55f5a37478e8b510b5a8b9ff317c33b6e250f62966ad

SHA512
c25f12e2237b99b34db45ecca16ba8e38505748bed93c42f9464ae17925976f7fe48bfcf5e01aa5aa848597f562580120f37448de3759fcf1d35eb5078bc9622

Download Submit
C:\Windows\system\lbAtaeA.exe

Filesize
1.6MB

MD5
46016a26131e8dfa30405276e738260c

SHA1
06dfc6094423403e9975828180041a9e1a81d9c2

SHA256
1205e988850f6f74bda6c2d86ba7bfef4e6c131711537b5c174dfde6557bcfab

SHA512
cec2d2c242e2fd233fdc1b23d192530e827ab8bf22a5fa88c06c439e7e46fd47c9ca5e1e8c474cb3c1173dadbe7ec1474760b7fc22841219958d1c2329762ae2

Download Submit
C:\Windows\system\mIpYXDy.exe

Filesize
1.6MB

MD5
43de66e863d8e216e033594d8aa75692

SHA1
935c7c3bef14ea8ac0f37b114e5a92ae43eee5ea

SHA256
82d365e99aae07b032d360ae390a7af2d520c98974c8ce1e1b287524399e5773

SHA512
dd743019b9a384e7e92705c4be2219314baced4532ac4e98e6ca5b655d6f1dddfe3d6531fee6d2223b0cfc275aa8edecfaa53c9450c5096506fd70927108fd13

Download Submit
C:\Windows\system\ubKJarM.exe

Filesize
1.6MB

MD5
69c528fce74e52b3f9672e5179689bc2

SHA1
22bc34e62cec80a1d05351bd3ffe48a04dc76169

SHA256
eb6938a48bd31a300c9f123b29404e13cccf61c9344d3ea700ac71efb7283600

SHA512
8095e1d8dbd50111af96e20b04537439d05d43072afc844efd36952ea2b4ebacc39818808c9ea473612d1aa5f5e0ee4154fb64dbd8741bb8cf67273ea62a5e92

Download Submit
C:\Windows\system\wLsbpcD.exe

Filesize
1.6MB

MD5
38914f601ea0c32af259ea8b0301061d

SHA1
ba0a4cc0e2601c105158ddaa3221c3879505c023

SHA256
e568d31608a80e49fffce7cf5a65ae5c30b6bd1323c5662f6c9999607a91ddff

SHA512
8253fdc6c48f6a15878886c7d8393cd49debed1eff0f5f4d80d48b637c0e7545650bc7d7028402a6a75dc32d0d39bbebe1474f781e2fde620c7d7f039a0ef302

Download Submit
C:\Windows\system\yvbcorz.exe

Filesize
1.6MB

MD5
6f0b37e4c5cd3a508445bd816d4bc258

SHA1
1200a393dd524575e85b55a4fad7ab1e7e5fe7dc

SHA256
4c24cd4688f45c0e1526f213682ccdd82c82592ea80e67e06f5583fed394fd25

SHA512
34d01e227b80f7dc357fdae56f10f59568db2abeab69feaa459d36e29ca05ad2f1590223d323fbaf4e373db3e5584f3516106fb118041add528858e773fb9095

Download Submit
C:\Windows\system\zzhkGNn.exe

Filesize
1.6MB

MD5
bc3ccb7049f612bf6a90315607ce75e1

SHA1
3275472813b74c0bae17f36f55d80ac0aea626c8

SHA256
63d1f3f8a5a29fac91c7f01c20aff979d960d14385c238b282bd879782c8465c

SHA512
939d4ea47d554c8998d2598590c01f9955577b14ae9ca498a135a423899910d86ffd19ba6dee92d378128157dac00d13f9aaed6e824477946e20e69ee72a7c84

Download Submit
\Windows\system\JGLJFgp.exe

Filesize
1.6MB

MD5
3ff4e108bbe6eb4efd3666dc712045d0

SHA1
32a371122eca8b35d03a574549981726df3b79fa

SHA256
d1d0469513e7d5631813b49b64ff0c698243dbddfb0ed02da8490d04aa100fb1

SHA512
f9c694181cb1d975c79e623afa197b86654f7aaa68b6db01782dd2281f75dbb67b2517372ba3b4d335f44272b92fca18c338e40d2e070af89383453ab9f3e7e4

Download Submit
\Windows\system\JjUaDzK.exe

Filesize
1.6MB

MD5
64b18ab97fc263bfcdf25a578de5dab8

SHA1
eabbed48328d80271d4f3b988d6280cdbe1bed52

SHA256
461555e1aff0e24ac98886698e174026ecc7ae00de6cc8d64e1cff9d7a466bbd

SHA512
8e9f2bcf581cb31adee9734fc8685124b29b27d34167c5d8139a1289996ad4123d74b267667a23ac8bbe0895f6d0f3ee017d6776d73bc62349fe12e8908a105d

Download Submit
\Windows\system\LlWouyt.exe

Filesize
1.6MB

MD5
4bb383747197f516a0290284641099e5

SHA1
e7a372162691609abfc9d608a73a4e47657350c7

SHA256
9cde3134f2a37174c58964eb7e7b1359c26d3b8a03ef0e83afb7a61065c3437a

SHA512
665b6539f97d1e0489acc35c8f87b08360ef95cefff9ec074f99bb8c109ed9e04c17ecafc465cebc090059b35aa5b264b7846ae90c7abfdd0451812201aaabad

Download Submit
\Windows\system\McLTCSU.exe

Filesize
1.6MB

MD5
9a6094c08603b43c6614a339291b9fc6

SHA1
816fdf8877ea753cac756f35cdb7b8b0492ecd43

SHA256
15767aeea9186771a325c72102e410ec9cf5d7aeacadfb3931cf9476dbd67eb9

SHA512
950bd6fd7579a9f5e832f6735d94a51df2f46e305aa87c22ebdb58bcf52665b9c8f26c95bad0f133fce449acd433e8240ee28ef4c9ecebe7dad5ce3cc33b4999

Download Submit
\Windows\system\MweBxtQ.exe

Filesize
1.6MB

MD5
5bf214153db9626003d109821cab2ccc

SHA1
26b4cb93a0f7f57511f10fd49dbfd8997b67b800

SHA256
83ec7d7d046188e582cb30ee62f404b26f8b7d47bb5792196d39dcf063acd6af

SHA512
d5eb229f4c0ccfb850fde13715ce770d84c33cfaf32743cebd2191109b1852f599763c6cb01007160cf6d097354ab65a25b1101270a6a33debc9744e69fc4fea

Download Submit
\Windows\system\PPtcOnK.exe

Filesize
1.6MB

MD5
dc5f0c59f6b07b412cc3c48aaba05ac5

SHA1
5be92f9607557e661f9af9d4aff4930649cbeec4

SHA256
6afb7081d95176e05bbd8e234505d46e4d62a8a607dad5e370a3b01483bd24c6

SHA512
4fd5d0b6cb0bc54af9044de2253436d11e295e64d18af64450cbda8605e5e80c59188f07e43f34484b55d77d49794e9bbc99745264478a7929b615e3dbe165de

Download Submit
\Windows\system\QguhMwd.exe

Filesize
1.6MB

MD5
0805d8d4e2c856438abc010656fc9067

SHA1
59054334d18dc8488dd73bb1735cb42f37a1b4ab

SHA256
164f25260dfb97764e10f96b308a72db964e6b9ea667c614eab260115b02da6a

SHA512
389d829365df3b904484737cdeb248e87394610bd974d215b59a5adaaf9870a0438e35a13fb001db3f77f0d8bef7ca6b1a3a8d88577c5c7e3146064cd8a4e7f1

Download Submit
\Windows\system\StdxOAJ.exe

Filesize
1.6MB

MD5
45fb621a8efec70a90593168502116b6

SHA1
4308c7d7365e27227097edce7c063bf7a9162c29

SHA256
dbf246cfe0fa6697d3ac270061b27b0bda88621bcf70369a1cde28f3ba1eb3ea

SHA512
3e54bd4f19a0ca6bbd3f5c66fd96202f91a529f4ee7777767185fbfa766c883807fd396a87a0f00972e0b198dd43eb67ff3740651616bffa6d73da83e7405bf9

Download Submit
\Windows\system\iggtePm.exe

Filesize
1.6MB

MD5
9f25d7aa51c277b546edfa2ff94faecb

SHA1
dc3d4dd02a4c509855f23c4bba434d689ebcb831

SHA256
09b1fa39b72818ab7c01859f5dd061c04e7174dd34cbdac66f968a9f7f099c87

SHA512
1b0a82d9a5009bb6bd77bf66e16582ff3f9cfc4dc5325aaff6430200efcbbc749971336b192c1aced10b34f3cdd10843f0d546ddbab4569332b611414425baef

Download Submit
\Windows\system\kSByTAu.exe

Filesize
1.6MB

MD5
1214d95ed75bf5a711d10c39601dcf2e

SHA1
bed07d1793cb6c032d44ce0722e12d25411b3d8a

SHA256
5fb51e1994d7ef80e690e7913936184c8337c20762fe1e0377feeaa35cda9e96

SHA512
ddfe1f31e0037b1ad7b4d7b7edc246af3eb90fbc863f9aa3465f5da12a366ee5718687d8d6bebdc52561be12d071a9baee0077ba808175e9510e4a5254844105

Download Submit
\Windows\system\uzSmTWO.exe

Filesize
1.6MB

MD5
be519aae1c8fa7ffee2a61c96f702565

SHA1
024993d6efdf4ff1371a6f75eea241cf38dc43dd

SHA256
57a1a84ef966c106a8d70f41c5fcbcc6a36a3d503baec1e0584ef076a0897998

SHA512
343a28a4f6e73f72f86661cb504dc9edf90e00239d571440c61b0bdd5c5631173ce5efa6cd313a10e46f1bc2ccdb03af4d25d1b9b533e3b396588f636ad1a162

Download Submit
memory/1648-6470-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-165-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/1828-146-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

Filesize
9.6MB

Download
memory/1828-424-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

Filesize
9.6MB

Download
memory/1828-320-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/1828-319-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/1828-35-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/1828-36-0x000007FEF5A4E000-0x000007FEF5A4F000-memory.dmp

Filesize
4KB

Download
memory/2096-6283-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2096-14-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2220-163-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2220-6507-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2476-6963-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-155-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-5901-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2544-157-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2564-5983-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2564-159-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2628-6498-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2628-147-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2676-153-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2676-5842-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2724-33-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-166-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-5894-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-6478-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2924-15-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2940-156-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-0-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2940-162-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-9-0x0000000002410000-0x0000000002802000-memory.dmp

Filesize
3.9MB

Download
memory/2940-16-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2940-160-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-7665-0x0000000002410000-0x0000000002802000-memory.dmp

Filesize
3.9MB

Download
memory/2940-37-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/2940-154-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-158-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2940-1-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/2940-29-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/2940-39-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/2940-164-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-6786-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2988-5974-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2988-161-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download