xmrig | f48ebf22d4ce25356db6e6ab02ac81826afa45a3c946085612d186e470d60d5f

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
Size

1.4MB
MD5

9cf03c42171d15220d5553e1460a0280
SHA1

28b988d99ee502238b2392220122c898cc1a2103
SHA256

f48ebf22d4ce25356db6e6ab02ac81826afa45a3c946085612d186e470d60d5f
SHA512

ab0040cf03ee281b7c63ef0134ebd0e77c0d0e5743aba78f583d594dbb5046dd9d94420840c5e250cbdacfb333daf63b336eb4fa4e14f5235e479c254da75128
SSDEEP

24576:BezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbEwlKjpv32wTlvck3AWsu4Jseu/l:BezaTF8FcNkNdfE0pZ9ozt4wIXxeHNsv

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 63 IoCs

miner

resource	yara_rule
behavioral1/memory/2180-0-0x000000013FA00000-0x000000013FD54000-memory.dmp	xmrig
behavioral1/files/0x000a000000013a21-7.dat	xmrig
behavioral1/files/0x00080000000141c0-27.dat	xmrig
behavioral1/files/0x0008000000014390-40.dat	xmrig
behavioral1/files/0x000a0000000143ec-44.dat	xmrig
behavioral1/files/0x000700000001447e-71.dat	xmrig
behavioral1/files/0x00060000000146a2-80.dat	xmrig
behavioral1/files/0x00060000000147ea-92.dat	xmrig
behavioral1/files/0x0006000000014abe-107.dat	xmrig
behavioral1/files/0x0006000000014b31-129.dat	xmrig
behavioral1/files/0x0006000000015616-182.dat	xmrig
behavioral1/files/0x0006000000015626-187.dat	xmrig
behavioral1/files/0x0006000000015605-177.dat	xmrig
behavioral1/files/0x00060000000155f7-172.dat	xmrig
behavioral1/files/0x00060000000155ed-163.dat	xmrig
behavioral1/files/0x00060000000155f3-166.dat	xmrig
behavioral1/files/0x0006000000014ef8-153.dat	xmrig
behavioral1/files/0x0006000000014b70-143.dat	xmrig
behavioral1/files/0x0006000000014af6-141.dat	xmrig
behavioral1/memory/2480-127-0x000000013FA60000-0x000000013FDB4000-memory.dmp	xmrig
behavioral1/files/0x0006000000015018-156.dat	xmrig
behavioral1/files/0x0006000000014de9-146.dat	xmrig
behavioral1/files/0x00060000000149f5-102.dat	xmrig
behavioral1/memory/1436-97-0x000000013F690000-0x000000013F9E4000-memory.dmp	xmrig
behavioral1/memory/2180-135-0x0000000001F20000-0x0000000002274000-memory.dmp	xmrig
behavioral1/memory/2180-131-0x0000000001F20000-0x0000000002274000-memory.dmp	xmrig
behavioral1/memory/2516-130-0x000000013F220000-0x000000013F574000-memory.dmp	xmrig
behavioral1/files/0x00060000000146c0-96.dat	xmrig
behavioral1/files/0x00060000000146b8-114.dat	xmrig
behavioral1/memory/2276-113-0x000000013F3E0000-0x000000013F734000-memory.dmp	xmrig
behavioral1/files/0x0006000000014825-111.dat	xmrig
behavioral1/memory/2464-88-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/2620-81-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/files/0x0006000000014667-78.dat	xmrig
behavioral1/memory/2180-76-0x0000000001F20000-0x0000000002274000-memory.dmp	xmrig
behavioral1/files/0x00070000000144ac-74.dat	xmrig
behavioral1/memory/2712-68-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/files/0x0006000000014539-67.dat	xmrig
behavioral1/files/0x000700000001448a-66.dat	xmrig
behavioral1/memory/2588-63-0x000000013F310000-0x000000013F664000-memory.dmp	xmrig
behavioral1/memory/2596-57-0x000000013F610000-0x000000013F964000-memory.dmp	xmrig
behavioral1/memory/2660-50-0x000000013F820000-0x000000013FB74000-memory.dmp	xmrig
behavioral1/memory/1916-49-0x000000013FCF0000-0x0000000140044000-memory.dmp	xmrig
behavioral1/memory/2912-35-0x000000013FEE0000-0x0000000140234000-memory.dmp	xmrig
behavioral1/files/0x00070000000142b0-32.dat	xmrig
behavioral1/files/0x000a0000000142c4-29.dat	xmrig
behavioral1/files/0x00070000000141e6-28.dat	xmrig
behavioral1/memory/2368-25-0x000000013FA60000-0x000000013FDB4000-memory.dmp	xmrig
behavioral1/files/0x000d00000001342b-5.dat	xmrig
behavioral1/memory/2180-3251-0x000000013FA00000-0x000000013FD54000-memory.dmp	xmrig
behavioral1/memory/2368-4011-0x000000013FA60000-0x000000013FDB4000-memory.dmp	xmrig
behavioral1/memory/2912-4012-0x000000013FEE0000-0x0000000140234000-memory.dmp	xmrig
behavioral1/memory/1916-4015-0x000000013FCF0000-0x0000000140044000-memory.dmp	xmrig
behavioral1/memory/2276-4014-0x000000013F3E0000-0x000000013F734000-memory.dmp	xmrig
behavioral1/memory/2660-4013-0x000000013F820000-0x000000013FB74000-memory.dmp	xmrig
behavioral1/memory/2596-4016-0x000000013F610000-0x000000013F964000-memory.dmp	xmrig
behavioral1/memory/2712-4017-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/2588-4018-0x000000013F310000-0x000000013F664000-memory.dmp	xmrig
behavioral1/memory/2516-4021-0x000000013F220000-0x000000013F574000-memory.dmp	xmrig
behavioral1/memory/2464-4020-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/2620-4019-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/2480-4022-0x000000013FA60000-0x000000013FDB4000-memory.dmp	xmrig
behavioral1/memory/1436-4023-0x000000013F690000-0x000000013F9E4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2368	njVnCdk.exe
2912	HYoOPHQ.exe
2276	GjOAPLk.exe
1916	FdCcswQ.exe
2660	KoPiLYw.exe
2596	vOAIpbm.exe
2588	gelYitg.exe
2712	apODHFQ.exe
2620	QXlRoqK.exe
2464	kKClHoT.exe
2480	TTpqsQu.exe
1436	UIxJvWR.exe
2516	TNQeYEE.exe
892	IEzPdIT.exe
2060	CIBcvQM.exe
1656	efjcQfY.exe
952	PJqRkNJ.exe
2212	MneKCYa.exe
1088	vOTkTkD.exe
1200	ZDaCgua.exe
764	OIoddph.exe
1808	xKNRZHP.exe
1576	bZPflGH.exe
1536	MRbpyLS.exe
2184	iVzWfqh.exe
1804	SOUtYsf.exe
1964	HQQyicW.exe
748	kOajSRy.exe
580	zelPQwA.exe
640	rkxQFgb.exe
356	nHsxGfO.exe
2428	XwDWXxz.exe
1052	pXxPFcM.exe
1528	cTcOfYe.exe
2668	vHrrbnD.exe
1376	SNiopLM.exe
1672	bjAHEOy.exe
984	MixpTkp.exe
1920	XrIZPOs.exe
1844	XtRBmWO.exe
1400	lOKUOcH.exe
908	xLqRYYz.exe
2144	zzXWFGz.exe
1144	fHjTBHX.exe
2356	FFluOGk.exe
3016	oIAPGcX.exe
704	GpEzFUt.exe
2028	pVuVdHq.exe
3048	ymSbsby.exe
896	aylONSe.exe
1976	DxKwrws.exe
2944	VoKdQGV.exe
2320	BUKSHXg.exe
2300	rYjRraX.exe
2876	VunkrIB.exe
2644	rhZZamo.exe
2564	GhjBcdm.exe
2580	OYUHmaV.exe
2736	hCyoCsA.exe
2448	TxCbDfm.exe
2704	TeFlYHf.exe
2892	dAPEXxZ.exe
2900	GYllbgY.exe
1988	mZBwgNR.exe

Loads dropped DLL 64 IoCs

pid	Process
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2180-0-0x000000013FA00000-0x000000013FD54000-memory.dmp	upx
behavioral1/files/0x000a000000013a21-7.dat	upx
behavioral1/files/0x00080000000141c0-27.dat	upx
behavioral1/files/0x0008000000014390-40.dat	upx
behavioral1/files/0x000a0000000143ec-44.dat	upx
behavioral1/files/0x000700000001447e-71.dat	upx
behavioral1/files/0x00060000000146a2-80.dat	upx
behavioral1/files/0x00060000000147ea-92.dat	upx
behavioral1/files/0x0006000000014abe-107.dat	upx
behavioral1/files/0x0006000000014b31-129.dat	upx
behavioral1/files/0x0006000000015616-182.dat	upx
behavioral1/files/0x0006000000015626-187.dat	upx
behavioral1/files/0x0006000000015605-177.dat	upx
behavioral1/files/0x00060000000155f7-172.dat	upx
behavioral1/files/0x00060000000155ed-163.dat	upx
behavioral1/files/0x00060000000155f3-166.dat	upx
behavioral1/files/0x0006000000014ef8-153.dat	upx
behavioral1/files/0x0006000000014b70-143.dat	upx
behavioral1/files/0x0006000000014af6-141.dat	upx
behavioral1/memory/2480-127-0x000000013FA60000-0x000000013FDB4000-memory.dmp	upx
behavioral1/files/0x0006000000015018-156.dat	upx
behavioral1/files/0x0006000000014de9-146.dat	upx
behavioral1/files/0x00060000000149f5-102.dat	upx
behavioral1/memory/1436-97-0x000000013F690000-0x000000013F9E4000-memory.dmp	upx
behavioral1/memory/2180-131-0x0000000001F20000-0x0000000002274000-memory.dmp	upx
behavioral1/memory/2516-130-0x000000013F220000-0x000000013F574000-memory.dmp	upx
behavioral1/files/0x00060000000146c0-96.dat	upx
behavioral1/files/0x00060000000146b8-114.dat	upx
behavioral1/memory/2276-113-0x000000013F3E0000-0x000000013F734000-memory.dmp	upx
behavioral1/files/0x0006000000014825-111.dat	upx
behavioral1/memory/2464-88-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/2620-81-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/files/0x0006000000014667-78.dat	upx
behavioral1/files/0x00070000000144ac-74.dat	upx
behavioral1/memory/2712-68-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/files/0x0006000000014539-67.dat	upx
behavioral1/files/0x000700000001448a-66.dat	upx
behavioral1/memory/2588-63-0x000000013F310000-0x000000013F664000-memory.dmp	upx
behavioral1/memory/2596-57-0x000000013F610000-0x000000013F964000-memory.dmp	upx
behavioral1/memory/2660-50-0x000000013F820000-0x000000013FB74000-memory.dmp	upx
behavioral1/memory/1916-49-0x000000013FCF0000-0x0000000140044000-memory.dmp	upx
behavioral1/memory/2912-35-0x000000013FEE0000-0x0000000140234000-memory.dmp	upx
behavioral1/files/0x00070000000142b0-32.dat	upx
behavioral1/files/0x000a0000000142c4-29.dat	upx
behavioral1/files/0x00070000000141e6-28.dat	upx
behavioral1/memory/2368-25-0x000000013FA60000-0x000000013FDB4000-memory.dmp	upx
behavioral1/files/0x000d00000001342b-5.dat	upx
behavioral1/memory/2180-3251-0x000000013FA00000-0x000000013FD54000-memory.dmp	upx
behavioral1/memory/2368-4011-0x000000013FA60000-0x000000013FDB4000-memory.dmp	upx
behavioral1/memory/2912-4012-0x000000013FEE0000-0x0000000140234000-memory.dmp	upx
behavioral1/memory/1916-4015-0x000000013FCF0000-0x0000000140044000-memory.dmp	upx
behavioral1/memory/2276-4014-0x000000013F3E0000-0x000000013F734000-memory.dmp	upx
behavioral1/memory/2660-4013-0x000000013F820000-0x000000013FB74000-memory.dmp	upx
behavioral1/memory/2596-4016-0x000000013F610000-0x000000013F964000-memory.dmp	upx
behavioral1/memory/2712-4017-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/2588-4018-0x000000013F310000-0x000000013F664000-memory.dmp	upx
behavioral1/memory/2516-4021-0x000000013F220000-0x000000013F574000-memory.dmp	upx
behavioral1/memory/2464-4020-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/2620-4019-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/2480-4022-0x000000013FA60000-0x000000013FDB4000-memory.dmp	upx
behavioral1/memory/1436-4023-0x000000013F690000-0x000000013F9E4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yTbRiKq.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\XzOJTSg.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\zjAXpPl.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\yRrQvgH.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\flHljEz.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\CkcjUPS.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\vVeTDWZ.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\IbnErcR.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\FPgNFkA.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\xQVDnvW.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\AKFxvjL.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\bFyJBrK.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\unXGDoh.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\ZVzayiu.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\lFsOjgr.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\lAnZhYz.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\QGIleua.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\QBqowcE.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\SNiopLM.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\TbfwRNE.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\KkMtpXh.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\dNiClZw.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\zwnPFPq.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\wTsdblT.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\XrozDiK.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\ENpXHru.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\MvkdHfP.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\ThOMHbl.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\vmVXFPQ.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\fAcyxEJ.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\YGrrjko.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\wbnssFN.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\vgeVAHF.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\FHDKupH.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\RaxgloG.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\mhZRzmE.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\qDNXJIK.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\UaMIxMy.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\vQjAHVP.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\wDFOOuR.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\HzKXAEP.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\YDdNzPI.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\EVOPdiW.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\OJVkioD.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\KLdbdJj.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\wwCTgKb.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\xfKpuwe.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\GkCihtf.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\PJSymnW.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\GhgLkta.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\dQMbgeK.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\OBwhsDj.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\adcVTEH.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\rzXtbOh.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\YFOQZwv.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\SowMYqx.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\SwUaqEo.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\ikYiebB.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\ZcknZgO.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\IuBAZyn.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\XqmtNPX.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\nkFeeoA.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\YahKkyJ.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
File created	C:\Windows\System\QFeamFU.exe	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2368	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 2368	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 2368	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 2912	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	30
PID 2180 wrote to memory of 2912	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	30
PID 2180 wrote to memory of 2912	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	30
PID 2180 wrote to memory of 2276	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	31
PID 2180 wrote to memory of 2276	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	31
PID 2180 wrote to memory of 2276	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	31
PID 2180 wrote to memory of 1916	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	32
PID 2180 wrote to memory of 1916	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	32
PID 2180 wrote to memory of 1916	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	32
PID 2180 wrote to memory of 2596	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	33
PID 2180 wrote to memory of 2596	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	33
PID 2180 wrote to memory of 2596	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	33
PID 2180 wrote to memory of 2660	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	34
PID 2180 wrote to memory of 2660	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	34
PID 2180 wrote to memory of 2660	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	34
PID 2180 wrote to memory of 2588	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	35
PID 2180 wrote to memory of 2588	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	35
PID 2180 wrote to memory of 2588	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	35
PID 2180 wrote to memory of 2712	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	36
PID 2180 wrote to memory of 2712	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	36
PID 2180 wrote to memory of 2712	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	36
PID 2180 wrote to memory of 2480	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	37
PID 2180 wrote to memory of 2480	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	37
PID 2180 wrote to memory of 2480	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	37
PID 2180 wrote to memory of 2620	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	38
PID 2180 wrote to memory of 2620	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	38
PID 2180 wrote to memory of 2620	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	38
PID 2180 wrote to memory of 1436	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	39
PID 2180 wrote to memory of 1436	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	39
PID 2180 wrote to memory of 1436	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	39
PID 2180 wrote to memory of 2464	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	40
PID 2180 wrote to memory of 2464	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	40
PID 2180 wrote to memory of 2464	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	40
PID 2180 wrote to memory of 2516	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	41
PID 2180 wrote to memory of 2516	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	41
PID 2180 wrote to memory of 2516	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	41
PID 2180 wrote to memory of 892	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	42
PID 2180 wrote to memory of 892	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	42
PID 2180 wrote to memory of 892	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	42
PID 2180 wrote to memory of 2212	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	43
PID 2180 wrote to memory of 2212	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	43
PID 2180 wrote to memory of 2212	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	43
PID 2180 wrote to memory of 2060	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	44
PID 2180 wrote to memory of 2060	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	44
PID 2180 wrote to memory of 2060	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	44
PID 2180 wrote to memory of 1088	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	45
PID 2180 wrote to memory of 1088	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	45
PID 2180 wrote to memory of 1088	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	45
PID 2180 wrote to memory of 1656	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	46
PID 2180 wrote to memory of 1656	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	46
PID 2180 wrote to memory of 1656	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	46
PID 2180 wrote to memory of 764	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	47
PID 2180 wrote to memory of 764	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	47
PID 2180 wrote to memory of 764	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	47
PID 2180 wrote to memory of 952	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	48
PID 2180 wrote to memory of 952	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	48
PID 2180 wrote to memory of 952	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	48
PID 2180 wrote to memory of 1808	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	49
PID 2180 wrote to memory of 1808	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	49
PID 2180 wrote to memory of 1808	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	49
PID 2180 wrote to memory of 1200	2180	9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9cf03c42171d15220d5553e1460a0280_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System\njVnCdk.exe
  C:\Windows\System\njVnCdk.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\HYoOPHQ.exe
  C:\Windows\System\HYoOPHQ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\GjOAPLk.exe
  C:\Windows\System\GjOAPLk.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\FdCcswQ.exe
  C:\Windows\System\FdCcswQ.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\vOAIpbm.exe
  C:\Windows\System\vOAIpbm.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\KoPiLYw.exe
  C:\Windows\System\KoPiLYw.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\gelYitg.exe
  C:\Windows\System\gelYitg.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\apODHFQ.exe
  C:\Windows\System\apODHFQ.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\TTpqsQu.exe
  C:\Windows\System\TTpqsQu.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\QXlRoqK.exe
  C:\Windows\System\QXlRoqK.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\UIxJvWR.exe
  C:\Windows\System\UIxJvWR.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\kKClHoT.exe
  C:\Windows\System\kKClHoT.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\TNQeYEE.exe
  C:\Windows\System\TNQeYEE.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\IEzPdIT.exe
  C:\Windows\System\IEzPdIT.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\MneKCYa.exe
  C:\Windows\System\MneKCYa.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\CIBcvQM.exe
  C:\Windows\System\CIBcvQM.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\vOTkTkD.exe
  C:\Windows\System\vOTkTkD.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\efjcQfY.exe
  C:\Windows\System\efjcQfY.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\OIoddph.exe
  C:\Windows\System\OIoddph.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\PJqRkNJ.exe
  C:\Windows\System\PJqRkNJ.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\xKNRZHP.exe
  C:\Windows\System\xKNRZHP.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\ZDaCgua.exe
  C:\Windows\System\ZDaCgua.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\bZPflGH.exe
  C:\Windows\System\bZPflGH.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\MRbpyLS.exe
  C:\Windows\System\MRbpyLS.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\iVzWfqh.exe
  C:\Windows\System\iVzWfqh.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\SOUtYsf.exe
  C:\Windows\System\SOUtYsf.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\HQQyicW.exe
  C:\Windows\System\HQQyicW.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\kOajSRy.exe
  C:\Windows\System\kOajSRy.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\zelPQwA.exe
  C:\Windows\System\zelPQwA.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\rkxQFgb.exe
  C:\Windows\System\rkxQFgb.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\nHsxGfO.exe
  C:\Windows\System\nHsxGfO.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\XwDWXxz.exe
  C:\Windows\System\XwDWXxz.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\pXxPFcM.exe
  C:\Windows\System\pXxPFcM.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\cTcOfYe.exe
  C:\Windows\System\cTcOfYe.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\vHrrbnD.exe
  C:\Windows\System\vHrrbnD.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\SNiopLM.exe
  C:\Windows\System\SNiopLM.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\bjAHEOy.exe
  C:\Windows\System\bjAHEOy.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\MixpTkp.exe
  C:\Windows\System\MixpTkp.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\XrIZPOs.exe
  C:\Windows\System\XrIZPOs.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\XtRBmWO.exe
  C:\Windows\System\XtRBmWO.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\lOKUOcH.exe
  C:\Windows\System\lOKUOcH.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\xLqRYYz.exe
  C:\Windows\System\xLqRYYz.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\zzXWFGz.exe
  C:\Windows\System\zzXWFGz.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\fHjTBHX.exe
  C:\Windows\System\fHjTBHX.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\FFluOGk.exe
  C:\Windows\System\FFluOGk.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\oIAPGcX.exe
  C:\Windows\System\oIAPGcX.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\GpEzFUt.exe
  C:\Windows\System\GpEzFUt.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\pVuVdHq.exe
  C:\Windows\System\pVuVdHq.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\ymSbsby.exe
  C:\Windows\System\ymSbsby.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\aylONSe.exe
  C:\Windows\System\aylONSe.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\DxKwrws.exe
  C:\Windows\System\DxKwrws.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\VoKdQGV.exe
  C:\Windows\System\VoKdQGV.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\BUKSHXg.exe
  C:\Windows\System\BUKSHXg.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\rYjRraX.exe
  C:\Windows\System\rYjRraX.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\VunkrIB.exe
  C:\Windows\System\VunkrIB.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\rhZZamo.exe
  C:\Windows\System\rhZZamo.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\GhjBcdm.exe
  C:\Windows\System\GhjBcdm.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\OYUHmaV.exe
  C:\Windows\System\OYUHmaV.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\hCyoCsA.exe
  C:\Windows\System\hCyoCsA.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\TxCbDfm.exe
  C:\Windows\System\TxCbDfm.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\TeFlYHf.exe
  C:\Windows\System\TeFlYHf.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\dAPEXxZ.exe
  C:\Windows\System\dAPEXxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\GYllbgY.exe
  C:\Windows\System\GYllbgY.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\mZBwgNR.exe
  C:\Windows\System\mZBwgNR.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\YfMXhpI.exe
  C:\Windows\System\YfMXhpI.exe
  2⤵
  PID:1092
- C:\Windows\System\EoGAxZh.exe
  C:\Windows\System\EoGAxZh.exe
  2⤵
  PID:2020
- C:\Windows\System\XAMIqYW.exe
  C:\Windows\System\XAMIqYW.exe
  2⤵
  PID:1880
- C:\Windows\System\UvhXUwf.exe
  C:\Windows\System\UvhXUwf.exe
  2⤵
  PID:2544
- C:\Windows\System\cWjQSkx.exe
  C:\Windows\System\cWjQSkx.exe
  2⤵
  PID:900
- C:\Windows\System\fAmctha.exe
  C:\Windows\System\fAmctha.exe
  2⤵
  PID:2632
- C:\Windows\System\DfhZxEW.exe
  C:\Windows\System\DfhZxEW.exe
  2⤵
  PID:1488
- C:\Windows\System\UsWbliO.exe
  C:\Windows\System\UsWbliO.exe
  2⤵
  PID:760
- C:\Windows\System\KtTyAeZ.exe
  C:\Windows\System\KtTyAeZ.exe
  2⤵
  PID:452
- C:\Windows\System\tyyhEsW.exe
  C:\Windows\System\tyyhEsW.exe
  2⤵
  PID:3032
- C:\Windows\System\XSLHhWT.exe
  C:\Windows\System\XSLHhWT.exe
  2⤵
  PID:1076
- C:\Windows\System\fyxAljn.exe
  C:\Windows\System\fyxAljn.exe
  2⤵
  PID:2836
- C:\Windows\System\RvmYcAX.exe
  C:\Windows\System\RvmYcAX.exe
  2⤵
  PID:616
- C:\Windows\System\jEoYaLr.exe
  C:\Windows\System\jEoYaLr.exe
  2⤵
  PID:1864
- C:\Windows\System\fAWhwMy.exe
  C:\Windows\System\fAWhwMy.exe
  2⤵
  PID:1868
- C:\Windows\System\zIoFPrx.exe
  C:\Windows\System\zIoFPrx.exe
  2⤵
  PID:980
- C:\Windows\System\IuBAZyn.exe
  C:\Windows\System\IuBAZyn.exe
  2⤵
  PID:2852
- C:\Windows\System\TppIKqp.exe
  C:\Windows\System\TppIKqp.exe
  2⤵
  PID:2996
- C:\Windows\System\ExAWdxx.exe
  C:\Windows\System\ExAWdxx.exe
  2⤵
  PID:656
- C:\Windows\System\nFzGFaD.exe
  C:\Windows\System\nFzGFaD.exe
  2⤵
  PID:3004
- C:\Windows\System\pIrXNQu.exe
  C:\Windows\System\pIrXNQu.exe
  2⤵
  PID:1136
- C:\Windows\System\pbtJpZd.exe
  C:\Windows\System\pbtJpZd.exe
  2⤵
  PID:1840
- C:\Windows\System\eDbRdQD.exe
  C:\Windows\System\eDbRdQD.exe
  2⤵
  PID:1608
- C:\Windows\System\wbnssFN.exe
  C:\Windows\System\wbnssFN.exe
  2⤵
  PID:2928
- C:\Windows\System\mcubHsm.exe
  C:\Windows\System\mcubHsm.exe
  2⤵
  PID:2608
- C:\Windows\System\UgbtycJ.exe
  C:\Windows\System\UgbtycJ.exe
  2⤵
  PID:2968
- C:\Windows\System\zvMopOm.exe
  C:\Windows\System\zvMopOm.exe
  2⤵
  PID:2888
- C:\Windows\System\iTSPXwT.exe
  C:\Windows\System\iTSPXwT.exe
  2⤵
  PID:320
- C:\Windows\System\IKTvIRo.exe
  C:\Windows\System\IKTvIRo.exe
  2⤵
  PID:1748
- C:\Windows\System\dqDmnbp.exe
  C:\Windows\System\dqDmnbp.exe
  2⤵
  PID:2000
- C:\Windows\System\mggQWVy.exe
  C:\Windows\System\mggQWVy.exe
  2⤵
  PID:2524
- C:\Windows\System\OJVkioD.exe
  C:\Windows\System\OJVkioD.exe
  2⤵
  PID:1772
- C:\Windows\System\ilBSUDj.exe
  C:\Windows\System\ilBSUDj.exe
  2⤵
  PID:540
- C:\Windows\System\eqAfOKv.exe
  C:\Windows\System\eqAfOKv.exe
  2⤵
  PID:1600
- C:\Windows\System\tSoWDMU.exe
  C:\Windows\System\tSoWDMU.exe
  2⤵
  PID:1284
- C:\Windows\System\IFKyNvm.exe
  C:\Windows\System\IFKyNvm.exe
  2⤵
  PID:2072
- C:\Windows\System\nYAFduf.exe
  C:\Windows\System\nYAFduf.exe
  2⤵
  PID:2224
- C:\Windows\System\AoWqRwj.exe
  C:\Windows\System\AoWqRwj.exe
  2⤵
  PID:2924
- C:\Windows\System\EMzbBin.exe
  C:\Windows\System\EMzbBin.exe
  2⤵
  PID:2676
- C:\Windows\System\FPgNFkA.exe
  C:\Windows\System\FPgNFkA.exe
  2⤵
  PID:1108
- C:\Windows\System\WUfkUXz.exe
  C:\Windows\System\WUfkUXz.exe
  2⤵
  PID:2252
- C:\Windows\System\VvPHQcZ.exe
  C:\Windows\System\VvPHQcZ.exe
  2⤵
  PID:2824
- C:\Windows\System\pbiizZO.exe
  C:\Windows\System\pbiizZO.exe
  2⤵
  PID:2820
- C:\Windows\System\jntOFMQ.exe
  C:\Windows\System\jntOFMQ.exe
  2⤵
  PID:880
- C:\Windows\System\AOiHYyy.exe
  C:\Windows\System\AOiHYyy.exe
  2⤵
  PID:2332
- C:\Windows\System\gksxqEM.exe
  C:\Windows\System\gksxqEM.exe
  2⤵
  PID:2268
- C:\Windows\System\pfyBzHb.exe
  C:\Windows\System\pfyBzHb.exe
  2⤵
  PID:2612
- C:\Windows\System\NmtfMUI.exe
  C:\Windows\System\NmtfMUI.exe
  2⤵
  PID:2592
- C:\Windows\System\FoSiSsy.exe
  C:\Windows\System\FoSiSsy.exe
  2⤵
  PID:2896
- C:\Windows\System\zzrhAEj.exe
  C:\Windows\System\zzrhAEj.exe
  2⤵
  PID:2164
- C:\Windows\System\OZwUNQU.exe
  C:\Windows\System\OZwUNQU.exe
  2⤵
  PID:2880
- C:\Windows\System\ADoFJCK.exe
  C:\Windows\System\ADoFJCK.exe
  2⤵
  PID:2204
- C:\Windows\System\vutOKqt.exe
  C:\Windows\System\vutOKqt.exe
  2⤵
  PID:2260
- C:\Windows\System\euMecoo.exe
  C:\Windows\System\euMecoo.exe
  2⤵
  PID:3008
- C:\Windows\System\uYEvJzG.exe
  C:\Windows\System\uYEvJzG.exe
  2⤵
  PID:2004
- C:\Windows\System\UaMIxMy.exe
  C:\Windows\System\UaMIxMy.exe
  2⤵
  PID:2624
- C:\Windows\System\SoKjGkE.exe
  C:\Windows\System\SoKjGkE.exe
  2⤵
  PID:1784
- C:\Windows\System\mwXkPoE.exe
  C:\Windows\System\mwXkPoE.exe
  2⤵
  PID:2680
- C:\Windows\System\PuuDNZl.exe
  C:\Windows\System\PuuDNZl.exe
  2⤵
  PID:2348
- C:\Windows\System\jlRYPbU.exe
  C:\Windows\System\jlRYPbU.exe
  2⤵
  PID:2344
- C:\Windows\System\lFHWZoT.exe
  C:\Windows\System\lFHWZoT.exe
  2⤵
  PID:2800
- C:\Windows\System\BxxjThQ.exe
  C:\Windows\System\BxxjThQ.exe
  2⤵
  PID:1624
- C:\Windows\System\oDbvYxD.exe
  C:\Windows\System\oDbvYxD.exe
  2⤵
  PID:2760
- C:\Windows\System\DzEcCeo.exe
  C:\Windows\System\DzEcCeo.exe
  2⤵
  PID:1532
- C:\Windows\System\hnqARaa.exe
  C:\Windows\System\hnqARaa.exe
  2⤵
  PID:2600
- C:\Windows\System\OiOYmPd.exe
  C:\Windows\System\OiOYmPd.exe
  2⤵
  PID:2856
- C:\Windows\System\RirDPMW.exe
  C:\Windows\System\RirDPMW.exe
  2⤵
  PID:2840
- C:\Windows\System\KmvIwXo.exe
  C:\Windows\System\KmvIwXo.exe
  2⤵
  PID:2068
- C:\Windows\System\iATQxOM.exe
  C:\Windows\System\iATQxOM.exe
  2⤵
  PID:1636
- C:\Windows\System\HDpIIYu.exe
  C:\Windows\System\HDpIIYu.exe
  2⤵
  PID:2960
- C:\Windows\System\iwcTBtK.exe
  C:\Windows\System\iwcTBtK.exe
  2⤵
  PID:1680
- C:\Windows\System\mprGifb.exe
  C:\Windows\System\mprGifb.exe
  2⤵
  PID:2472
- C:\Windows\System\tmEPMzq.exe
  C:\Windows\System\tmEPMzq.exe
  2⤵
  PID:1068
- C:\Windows\System\DbREoeN.exe
  C:\Windows\System\DbREoeN.exe
  2⤵
  PID:2452
- C:\Windows\System\rzXtbOh.exe
  C:\Windows\System\rzXtbOh.exe
  2⤵
  PID:1640
- C:\Windows\System\EKonblg.exe
  C:\Windows\System\EKonblg.exe
  2⤵
  PID:380
- C:\Windows\System\USahvsx.exe
  C:\Windows\System\USahvsx.exe
  2⤵
  PID:2284
- C:\Windows\System\scIOIEd.exe
  C:\Windows\System\scIOIEd.exe
  2⤵
  PID:2280
- C:\Windows\System\ugWRKtj.exe
  C:\Windows\System\ugWRKtj.exe
  2⤵
  PID:3024
- C:\Windows\System\RyjYumt.exe
  C:\Windows\System\RyjYumt.exe
  2⤵
  PID:2652
- C:\Windows\System\CWYlIGe.exe
  C:\Windows\System\CWYlIGe.exe
  2⤵
  PID:2520
- C:\Windows\System\YtlPOdK.exe
  C:\Windows\System\YtlPOdK.exe
  2⤵
  PID:2748
- C:\Windows\System\UoGGMZd.exe
  C:\Windows\System\UoGGMZd.exe
  2⤵
  PID:1332
- C:\Windows\System\pNLxGKi.exe
  C:\Windows\System\pNLxGKi.exe
  2⤵
  PID:1908
- C:\Windows\System\lvTIPSF.exe
  C:\Windows\System\lvTIPSF.exe
  2⤵
  PID:1420
- C:\Windows\System\jSsNrHZ.exe
  C:\Windows\System\jSsNrHZ.exe
  2⤵
  PID:2440
- C:\Windows\System\UhUFZNx.exe
  C:\Windows\System\UhUFZNx.exe
  2⤵
  PID:1336
- C:\Windows\System\mnVFQzn.exe
  C:\Windows\System\mnVFQzn.exe
  2⤵
  PID:2304
- C:\Windows\System\cfYhLsA.exe
  C:\Windows\System\cfYhLsA.exe
  2⤵
  PID:1628
- C:\Windows\System\ywbMxES.exe
  C:\Windows\System\ywbMxES.exe
  2⤵
  PID:2804
- C:\Windows\System\jvJmjVq.exe
  C:\Windows\System\jvJmjVq.exe
  2⤵
  PID:2692
- C:\Windows\System\fklJigm.exe
  C:\Windows\System\fklJigm.exe
  2⤵
  PID:2720
- C:\Windows\System\KIsIamP.exe
  C:\Windows\System\KIsIamP.exe
  2⤵
  PID:2756
- C:\Windows\System\JTgepkh.exe
  C:\Windows\System\JTgepkh.exe
  2⤵
  PID:1464
- C:\Windows\System\vRgJUun.exe
  C:\Windows\System\vRgJUun.exe
  2⤵
  PID:2828
- C:\Windows\System\adcVTEH.exe
  C:\Windows\System\adcVTEH.exe
  2⤵
  PID:2576
- C:\Windows\System\trWlQLo.exe
  C:\Windows\System\trWlQLo.exe
  2⤵
  PID:2920
- C:\Windows\System\cjPPAIL.exe
  C:\Windows\System\cjPPAIL.exe
  2⤵
  PID:3076
- C:\Windows\System\fgCNGcd.exe
  C:\Windows\System\fgCNGcd.exe
  2⤵
  PID:3092
- C:\Windows\System\VhmFtpe.exe
  C:\Windows\System\VhmFtpe.exe
  2⤵
  PID:3108
- C:\Windows\System\zjpTQVQ.exe
  C:\Windows\System\zjpTQVQ.exe
  2⤵
  PID:3128
- C:\Windows\System\QJGAQey.exe
  C:\Windows\System\QJGAQey.exe
  2⤵
  PID:3144
- C:\Windows\System\wtPRrgM.exe
  C:\Windows\System\wtPRrgM.exe
  2⤵
  PID:3180
- C:\Windows\System\fLcrLFZ.exe
  C:\Windows\System\fLcrLFZ.exe
  2⤵
  PID:3196
- C:\Windows\System\upIOuhp.exe
  C:\Windows\System\upIOuhp.exe
  2⤵
  PID:3212
- C:\Windows\System\BxTwfYi.exe
  C:\Windows\System\BxTwfYi.exe
  2⤵
  PID:3236
- C:\Windows\System\DFyFETa.exe
  C:\Windows\System\DFyFETa.exe
  2⤵
  PID:3252
- C:\Windows\System\pKUfdmS.exe
  C:\Windows\System\pKUfdmS.exe
  2⤵
  PID:3268
- C:\Windows\System\fExMEWV.exe
  C:\Windows\System\fExMEWV.exe
  2⤵
  PID:3348
- C:\Windows\System\uIVESur.exe
  C:\Windows\System\uIVESur.exe
  2⤵
  PID:3368
- C:\Windows\System\TmQftnL.exe
  C:\Windows\System\TmQftnL.exe
  2⤵
  PID:3384
- C:\Windows\System\BlywLZi.exe
  C:\Windows\System\BlywLZi.exe
  2⤵
  PID:3400
- C:\Windows\System\XqmtNPX.exe
  C:\Windows\System\XqmtNPX.exe
  2⤵
  PID:3424
- C:\Windows\System\IbWcRPs.exe
  C:\Windows\System\IbWcRPs.exe
  2⤵
  PID:3440
- C:\Windows\System\RHFbhnj.exe
  C:\Windows\System\RHFbhnj.exe
  2⤵
  PID:3464
- C:\Windows\System\OVDmTdI.exe
  C:\Windows\System\OVDmTdI.exe
  2⤵
  PID:3480
- C:\Windows\System\CzNBgON.exe
  C:\Windows\System\CzNBgON.exe
  2⤵
  PID:3500
- C:\Windows\System\UssJLxU.exe
  C:\Windows\System\UssJLxU.exe
  2⤵
  PID:3524
- C:\Windows\System\leovgBs.exe
  C:\Windows\System\leovgBs.exe
  2⤵
  PID:3544
- C:\Windows\System\ddthKjQ.exe
  C:\Windows\System\ddthKjQ.exe
  2⤵
  PID:3560
- C:\Windows\System\VjIGlhH.exe
  C:\Windows\System\VjIGlhH.exe
  2⤵
  PID:3576
- C:\Windows\System\HpUxufD.exe
  C:\Windows\System\HpUxufD.exe
  2⤵
  PID:3592
- C:\Windows\System\FXsnmRT.exe
  C:\Windows\System\FXsnmRT.exe
  2⤵
  PID:3608
- C:\Windows\System\lCRWvls.exe
  C:\Windows\System\lCRWvls.exe
  2⤵
  PID:3624
- C:\Windows\System\cCahdNy.exe
  C:\Windows\System\cCahdNy.exe
  2⤵
  PID:3640
- C:\Windows\System\TnyLkTc.exe
  C:\Windows\System\TnyLkTc.exe
  2⤵
  PID:3660
- C:\Windows\System\UCViKYr.exe
  C:\Windows\System\UCViKYr.exe
  2⤵
  PID:3680
- C:\Windows\System\SjkjDcR.exe
  C:\Windows\System\SjkjDcR.exe
  2⤵
  PID:3728
- C:\Windows\System\bTgKBeJ.exe
  C:\Windows\System\bTgKBeJ.exe
  2⤵
  PID:3748
- C:\Windows\System\ManjJZN.exe
  C:\Windows\System\ManjJZN.exe
  2⤵
  PID:3768
- C:\Windows\System\wTsdblT.exe
  C:\Windows\System\wTsdblT.exe
  2⤵
  PID:3788
- C:\Windows\System\WEtNhMj.exe
  C:\Windows\System\WEtNhMj.exe
  2⤵
  PID:3808
- C:\Windows\System\polqwfC.exe
  C:\Windows\System\polqwfC.exe
  2⤵
  PID:3844
- C:\Windows\System\mfzcTNk.exe
  C:\Windows\System\mfzcTNk.exe
  2⤵
  PID:3860
- C:\Windows\System\btLaCkU.exe
  C:\Windows\System\btLaCkU.exe
  2⤵
  PID:3876
- C:\Windows\System\wNicBVo.exe
  C:\Windows\System\wNicBVo.exe
  2⤵
  PID:3892
- C:\Windows\System\JktJceY.exe
  C:\Windows\System\JktJceY.exe
  2⤵
  PID:3908
- C:\Windows\System\mKdDxQs.exe
  C:\Windows\System\mKdDxQs.exe
  2⤵
  PID:3924
- C:\Windows\System\UTIuDnq.exe
  C:\Windows\System\UTIuDnq.exe
  2⤵
  PID:3944
- C:\Windows\System\YFOQZwv.exe
  C:\Windows\System\YFOQZwv.exe
  2⤵
  PID:3988
- C:\Windows\System\QQnhoIg.exe
  C:\Windows\System\QQnhoIg.exe
  2⤵
  PID:4004
- C:\Windows\System\rlMmzvJ.exe
  C:\Windows\System\rlMmzvJ.exe
  2⤵
  PID:4020
- C:\Windows\System\XhGGdVh.exe
  C:\Windows\System\XhGGdVh.exe
  2⤵
  PID:4040
- C:\Windows\System\YOxbHpE.exe
  C:\Windows\System\YOxbHpE.exe
  2⤵
  PID:4056
- C:\Windows\System\wGuHPUx.exe
  C:\Windows\System\wGuHPUx.exe
  2⤵
  PID:4076
- C:\Windows\System\lAnZhYz.exe
  C:\Windows\System\lAnZhYz.exe
  2⤵
  PID:2040
- C:\Windows\System\rtxpqMk.exe
  C:\Windows\System\rtxpqMk.exe
  2⤵
  PID:3084
- C:\Windows\System\WynBMLD.exe
  C:\Windows\System\WynBMLD.exe
  2⤵
  PID:3152
- C:\Windows\System\OBwhsDj.exe
  C:\Windows\System\OBwhsDj.exe
  2⤵
  PID:3176
- C:\Windows\System\taWyaaL.exe
  C:\Windows\System\taWyaaL.exe
  2⤵
  PID:3244
- C:\Windows\System\pPkJxTA.exe
  C:\Windows\System\pPkJxTA.exe
  2⤵
  PID:412
- C:\Windows\System\jpIyLCF.exe
  C:\Windows\System\jpIyLCF.exe
  2⤵
  PID:3292
- C:\Windows\System\ISiwMTw.exe
  C:\Windows\System\ISiwMTw.exe
  2⤵
  PID:3300
- C:\Windows\System\dLwDggX.exe
  C:\Windows\System\dLwDggX.exe
  2⤵
  PID:3136
- C:\Windows\System\HWfKkPh.exe
  C:\Windows\System\HWfKkPh.exe
  2⤵
  PID:3220
- C:\Windows\System\CkcjUPS.exe
  C:\Windows\System\CkcjUPS.exe
  2⤵
  PID:3260
- C:\Windows\System\xQVDnvW.exe
  C:\Windows\System\xQVDnvW.exe
  2⤵
  PID:3376
- C:\Windows\System\NpJngGy.exe
  C:\Windows\System\NpJngGy.exe
  2⤵
  PID:3420
- C:\Windows\System\XGkiqka.exe
  C:\Windows\System\XGkiqka.exe
  2⤵
  PID:3360
- C:\Windows\System\TqGmovP.exe
  C:\Windows\System\TqGmovP.exe
  2⤵
  PID:3392
- C:\Windows\System\rRKKNOa.exe
  C:\Windows\System\rRKKNOa.exe
  2⤵
  PID:2336
- C:\Windows\System\zKfSwCO.exe
  C:\Windows\System\zKfSwCO.exe
  2⤵
  PID:3672
- C:\Windows\System\yvZrDVZ.exe
  C:\Windows\System\yvZrDVZ.exe
  2⤵
  PID:3520
- C:\Windows\System\dCmxSlX.exe
  C:\Windows\System\dCmxSlX.exe
  2⤵
  PID:3648
- C:\Windows\System\cFQPCQE.exe
  C:\Windows\System\cFQPCQE.exe
  2⤵
  PID:3688
- C:\Windows\System\ZXugIiS.exe
  C:\Windows\System\ZXugIiS.exe
  2⤵
  PID:3744
- C:\Windows\System\zeBdKcn.exe
  C:\Windows\System\zeBdKcn.exe
  2⤵
  PID:3784
- C:\Windows\System\SCSxgPO.exe
  C:\Windows\System\SCSxgPO.exe
  2⤵
  PID:3696
- C:\Windows\System\ofhMBZg.exe
  C:\Windows\System\ofhMBZg.exe
  2⤵
  PID:3720
- C:\Windows\System\eREAYMv.exe
  C:\Windows\System\eREAYMv.exe
  2⤵
  PID:3796
- C:\Windows\System\mpcLnmd.exe
  C:\Windows\System\mpcLnmd.exe
  2⤵
  PID:3832
- C:\Windows\System\fyakeSq.exe
  C:\Windows\System\fyakeSq.exe
  2⤵
  PID:3872
- C:\Windows\System\DBpgbCO.exe
  C:\Windows\System\DBpgbCO.exe
  2⤵
  PID:3936
- C:\Windows\System\Xpggjvk.exe
  C:\Windows\System\Xpggjvk.exe
  2⤵
  PID:3920
- C:\Windows\System\jxRfUGl.exe
  C:\Windows\System\jxRfUGl.exe
  2⤵
  PID:3964
- C:\Windows\System\OKhRHWg.exe
  C:\Windows\System\OKhRHWg.exe
  2⤵
  PID:3984
- C:\Windows\System\cMKSpgd.exe
  C:\Windows\System\cMKSpgd.exe
  2⤵
  PID:4028
- C:\Windows\System\KlSCNyk.exe
  C:\Windows\System\KlSCNyk.exe
  2⤵
  PID:4036
- C:\Windows\System\pfDiYvO.exe
  C:\Windows\System\pfDiYvO.exe
  2⤵
  PID:2508
- C:\Windows\System\eAIlZxU.exe
  C:\Windows\System\eAIlZxU.exe
  2⤵
  PID:3276
- C:\Windows\System\VKYPoNF.exe
  C:\Windows\System\VKYPoNF.exe
  2⤵
  PID:3192
- C:\Windows\System\NlkwFch.exe
  C:\Windows\System\NlkwFch.exe
  2⤵
  PID:3452
- C:\Windows\System\zsYkTIA.exe
  C:\Windows\System\zsYkTIA.exe
  2⤵
  PID:2792
- C:\Windows\System\ISvhvZa.exe
  C:\Windows\System\ISvhvZa.exe
  2⤵
  PID:3512
- C:\Windows\System\LqBdoVz.exe
  C:\Windows\System\LqBdoVz.exe
  2⤵
  PID:3508
- C:\Windows\System\QBblIlK.exe
  C:\Windows\System\QBblIlK.exe
  2⤵
  PID:3124
- C:\Windows\System\gLXhSiX.exe
  C:\Windows\System\gLXhSiX.exe
  2⤵
  PID:3288
- C:\Windows\System\afYsRpR.exe
  C:\Windows\System\afYsRpR.exe
  2⤵
  PID:3408
- C:\Windows\System\ThOMHbl.exe
  C:\Windows\System\ThOMHbl.exe
  2⤵
  PID:3536
- C:\Windows\System\bYOBNLW.exe
  C:\Windows\System\bYOBNLW.exe
  2⤵
  PID:3780
- C:\Windows\System\gRaOgyd.exe
  C:\Windows\System\gRaOgyd.exe
  2⤵
  PID:3800
- C:\Windows\System\NmqVCFr.exe
  C:\Windows\System\NmqVCFr.exe
  2⤵
  PID:1520
- C:\Windows\System\xfKpuwe.exe
  C:\Windows\System\xfKpuwe.exe
  2⤵
  PID:4000
- C:\Windows\System\LAqaDjo.exe
  C:\Windows\System\LAqaDjo.exe
  2⤵
  PID:3604
- C:\Windows\System\TNqmaGz.exe
  C:\Windows\System\TNqmaGz.exe
  2⤵
  PID:4072
- C:\Windows\System\JPeUSrT.exe
  C:\Windows\System\JPeUSrT.exe
  2⤵
  PID:3616
- C:\Windows\System\BqxEpdE.exe
  C:\Windows\System\BqxEpdE.exe
  2⤵
  PID:3840
- C:\Windows\System\TntyLlk.exe
  C:\Windows\System\TntyLlk.exe
  2⤵
  PID:3888
- C:\Windows\System\TWOnXdI.exe
  C:\Windows\System\TWOnXdI.exe
  2⤵
  PID:4016
- C:\Windows\System\cjbNHrt.exe
  C:\Windows\System\cjbNHrt.exe
  2⤵
  PID:1020
- C:\Windows\System\lSJslaQ.exe
  C:\Windows\System\lSJslaQ.exe
  2⤵
  PID:1096
- C:\Windows\System\yTbRiKq.exe
  C:\Windows\System\yTbRiKq.exe
  2⤵
  PID:3172
- C:\Windows\System\FErOtni.exe
  C:\Windows\System\FErOtni.exe
  2⤵
  PID:4088
- C:\Windows\System\CBIqlSA.exe
  C:\Windows\System\CBIqlSA.exe
  2⤵
  PID:3736
- C:\Windows\System\EoGNQAJ.exe
  C:\Windows\System\EoGNQAJ.exe
  2⤵
  PID:3636
- C:\Windows\System\KtIzide.exe
  C:\Windows\System\KtIzide.exe
  2⤵
  PID:3916
- C:\Windows\System\XmmlALe.exe
  C:\Windows\System\XmmlALe.exe
  2⤵
  PID:2388
- C:\Windows\System\zMkJvxo.exe
  C:\Windows\System\zMkJvxo.exe
  2⤵
  PID:2232
- C:\Windows\System\sbwfPoD.exe
  C:\Windows\System\sbwfPoD.exe
  2⤵
  PID:3652
- C:\Windows\System\AZjiTnv.exe
  C:\Windows\System\AZjiTnv.exe
  2⤵
  PID:3692
- C:\Windows\System\kNWjiEL.exe
  C:\Windows\System\kNWjiEL.exe
  2⤵
  PID:3816
- C:\Windows\System\GHqWLfC.exe
  C:\Windows\System\GHqWLfC.exe
  2⤵
  PID:3012
- C:\Windows\System\DtbwklB.exe
  C:\Windows\System\DtbwklB.exe
  2⤵
  PID:2172
- C:\Windows\System\MiogZkT.exe
  C:\Windows\System\MiogZkT.exe
  2⤵
  PID:944
- C:\Windows\System\UtPjbMd.exe
  C:\Windows\System\UtPjbMd.exe
  2⤵
  PID:3432
- C:\Windows\System\WxyexMH.exe
  C:\Windows\System\WxyexMH.exe
  2⤵
  PID:3188
- C:\Windows\System\zZLdtfB.exe
  C:\Windows\System\zZLdtfB.exe
  2⤵
  PID:3476
- C:\Windows\System\pMMwddT.exe
  C:\Windows\System\pMMwddT.exe
  2⤵
  PID:820
- C:\Windows\System\IPIGLiH.exe
  C:\Windows\System\IPIGLiH.exe
  2⤵
  PID:112
- C:\Windows\System\RZHuktw.exe
  C:\Windows\System\RZHuktw.exe
  2⤵
  PID:856
- C:\Windows\System\wadNPgt.exe
  C:\Windows\System\wadNPgt.exe
  2⤵
  PID:1588
- C:\Windows\System\DGWZLjl.exe
  C:\Windows\System\DGWZLjl.exe
  2⤵
  PID:4120
- C:\Windows\System\ybzVshf.exe
  C:\Windows\System\ybzVshf.exe
  2⤵
  PID:4140
- C:\Windows\System\QGIleua.exe
  C:\Windows\System\QGIleua.exe
  2⤵
  PID:4160
- C:\Windows\System\ckpMKjG.exe
  C:\Windows\System\ckpMKjG.exe
  2⤵
  PID:4176
- C:\Windows\System\ObNAEkh.exe
  C:\Windows\System\ObNAEkh.exe
  2⤵
  PID:4196
- C:\Windows\System\ylLEXqt.exe
  C:\Windows\System\ylLEXqt.exe
  2⤵
  PID:4212
- C:\Windows\System\nvCOInG.exe
  C:\Windows\System\nvCOInG.exe
  2⤵
  PID:4236
- C:\Windows\System\OooSGUU.exe
  C:\Windows\System\OooSGUU.exe
  2⤵
  PID:4268
- C:\Windows\System\ChyQgdU.exe
  C:\Windows\System\ChyQgdU.exe
  2⤵
  PID:4292
- C:\Windows\System\QowyRCf.exe
  C:\Windows\System\QowyRCf.exe
  2⤵
  PID:4308
- C:\Windows\System\GXmJjsi.exe
  C:\Windows\System\GXmJjsi.exe
  2⤵
  PID:4324
- C:\Windows\System\pFtgpfF.exe
  C:\Windows\System\pFtgpfF.exe
  2⤵
  PID:4340
- C:\Windows\System\UrnYfZr.exe
  C:\Windows\System\UrnYfZr.exe
  2⤵
  PID:4356
- C:\Windows\System\dXslhEv.exe
  C:\Windows\System\dXslhEv.exe
  2⤵
  PID:4400
- C:\Windows\System\qmnbYdQ.exe
  C:\Windows\System\qmnbYdQ.exe
  2⤵
  PID:4420
- C:\Windows\System\UInDseM.exe
  C:\Windows\System\UInDseM.exe
  2⤵
  PID:4436
- C:\Windows\System\nOoxxtO.exe
  C:\Windows\System\nOoxxtO.exe
  2⤵
  PID:4456
- C:\Windows\System\SUXIMYY.exe
  C:\Windows\System\SUXIMYY.exe
  2⤵
  PID:4472
- C:\Windows\System\TJJMnwF.exe
  C:\Windows\System\TJJMnwF.exe
  2⤵
  PID:4488
- C:\Windows\System\MKycREC.exe
  C:\Windows\System\MKycREC.exe
  2⤵
  PID:4508
- C:\Windows\System\hAgDgNQ.exe
  C:\Windows\System\hAgDgNQ.exe
  2⤵
  PID:4524
- C:\Windows\System\ueykBHh.exe
  C:\Windows\System\ueykBHh.exe
  2⤵
  PID:4544
- C:\Windows\System\RiiwYYK.exe
  C:\Windows\System\RiiwYYK.exe
  2⤵
  PID:4560
- C:\Windows\System\dvXUrNt.exe
  C:\Windows\System\dvXUrNt.exe
  2⤵
  PID:4584
- C:\Windows\System\MPgJBRb.exe
  C:\Windows\System\MPgJBRb.exe
  2⤵
  PID:4604
- C:\Windows\System\szDyGKC.exe
  C:\Windows\System\szDyGKC.exe
  2⤵
  PID:4624
- C:\Windows\System\WNvpBcD.exe
  C:\Windows\System\WNvpBcD.exe
  2⤵
  PID:4648
- C:\Windows\System\oVeyTax.exe
  C:\Windows\System\oVeyTax.exe
  2⤵
  PID:4668
- C:\Windows\System\afncEvo.exe
  C:\Windows\System\afncEvo.exe
  2⤵
  PID:4688
- C:\Windows\System\AFUOAPI.exe
  C:\Windows\System\AFUOAPI.exe
  2⤵
  PID:4704
- C:\Windows\System\SYmwCrA.exe
  C:\Windows\System\SYmwCrA.exe
  2⤵
  PID:4724
- C:\Windows\System\OTRyEAX.exe
  C:\Windows\System\OTRyEAX.exe
  2⤵
  PID:4740
- C:\Windows\System\DWDTTYm.exe
  C:\Windows\System\DWDTTYm.exe
  2⤵
  PID:4756
- C:\Windows\System\hobbXRl.exe
  C:\Windows\System\hobbXRl.exe
  2⤵
  PID:4772
- C:\Windows\System\AfRSEzI.exe
  C:\Windows\System\AfRSEzI.exe
  2⤵
  PID:4788
- C:\Windows\System\hLDWoMh.exe
  C:\Windows\System\hLDWoMh.exe
  2⤵
  PID:4812
- C:\Windows\System\vQjAHVP.exe
  C:\Windows\System\vQjAHVP.exe
  2⤵
  PID:4828
- C:\Windows\System\DiKLjbu.exe
  C:\Windows\System\DiKLjbu.exe
  2⤵
  PID:4848
- C:\Windows\System\PmkIssx.exe
  C:\Windows\System\PmkIssx.exe
  2⤵
  PID:4864
- C:\Windows\System\hLOZASm.exe
  C:\Windows\System\hLOZASm.exe
  2⤵
  PID:4880
- C:\Windows\System\rDqlkCh.exe
  C:\Windows\System\rDqlkCh.exe
  2⤵
  PID:4896
- C:\Windows\System\RTYwxsp.exe
  C:\Windows\System\RTYwxsp.exe
  2⤵
  PID:4916
- C:\Windows\System\saKZsYV.exe
  C:\Windows\System\saKZsYV.exe
  2⤵
  PID:4936
- C:\Windows\System\vwdUrlm.exe
  C:\Windows\System\vwdUrlm.exe
  2⤵
  PID:4956
- C:\Windows\System\emzmVtJ.exe
  C:\Windows\System\emzmVtJ.exe
  2⤵
  PID:4972
- C:\Windows\System\aDbZvsn.exe
  C:\Windows\System\aDbZvsn.exe
  2⤵
  PID:4988
- C:\Windows\System\LVxeJtW.exe
  C:\Windows\System\LVxeJtW.exe
  2⤵
  PID:5004
- C:\Windows\System\NWbjLYH.exe
  C:\Windows\System\NWbjLYH.exe
  2⤵
  PID:5020
- C:\Windows\System\fCjZKUx.exe
  C:\Windows\System\fCjZKUx.exe
  2⤵
  PID:5036
- C:\Windows\System\yrZUgTk.exe
  C:\Windows\System\yrZUgTk.exe
  2⤵
  PID:5056
- C:\Windows\System\LUBqOYf.exe
  C:\Windows\System\LUBqOYf.exe
  2⤵
  PID:5072
- C:\Windows\System\fbdDsLq.exe
  C:\Windows\System\fbdDsLq.exe
  2⤵
  PID:5092
- C:\Windows\System\PDgfDab.exe
  C:\Windows\System\PDgfDab.exe
  2⤵
  PID:3356
- C:\Windows\System\ZuEIBQt.exe
  C:\Windows\System\ZuEIBQt.exe
  2⤵
  PID:2052
- C:\Windows\System\QvuwOgP.exe
  C:\Windows\System\QvuwOgP.exe
  2⤵
  PID:4136
- C:\Windows\System\ersDOyy.exe
  C:\Windows\System\ersDOyy.exe
  2⤵
  PID:3232
- C:\Windows\System\LSVbFQd.exe
  C:\Windows\System\LSVbFQd.exe
  2⤵
  PID:3764
- C:\Windows\System\eEnqRCb.exe
  C:\Windows\System\eEnqRCb.exe
  2⤵
  PID:3344
- C:\Windows\System\hbkBFnc.exe
  C:\Windows\System\hbkBFnc.exe
  2⤵
  PID:3960
- C:\Windows\System\toQaPpc.exe
  C:\Windows\System\toQaPpc.exe
  2⤵
  PID:3448
- C:\Windows\System\xmptxxQ.exe
  C:\Windows\System\xmptxxQ.exe
  2⤵
  PID:4184
- C:\Windows\System\SaxhpgJ.exe
  C:\Windows\System\SaxhpgJ.exe
  2⤵
  PID:4224
- C:\Windows\System\RSJvYkU.exe
  C:\Windows\System\RSJvYkU.exe
  2⤵
  PID:4244
- C:\Windows\System\ofSieKT.exe
  C:\Windows\System\ofSieKT.exe
  2⤵
  PID:4252
- C:\Windows\System\rMmQcOF.exe
  C:\Windows\System\rMmQcOF.exe
  2⤵
  PID:4304
- C:\Windows\System\XIuJwbV.exe
  C:\Windows\System\XIuJwbV.exe
  2⤵
  PID:4352
- C:\Windows\System\SowMYqx.exe
  C:\Windows\System\SowMYqx.exe
  2⤵
  PID:4380
- C:\Windows\System\zWEnQKD.exe
  C:\Windows\System\zWEnQKD.exe
  2⤵
  PID:1168
- C:\Windows\System\irYBNCo.exe
  C:\Windows\System\irYBNCo.exe
  2⤵
  PID:1644
- C:\Windows\System\OZJIRTI.exe
  C:\Windows\System\OZJIRTI.exe
  2⤵
  PID:1652
- C:\Windows\System\wntMDDL.exe
  C:\Windows\System\wntMDDL.exe
  2⤵
  PID:4412
- C:\Windows\System\wimhBoH.exe
  C:\Windows\System\wimhBoH.exe
  2⤵
  PID:4464
- C:\Windows\System\JflWlRw.exe
  C:\Windows\System\JflWlRw.exe
  2⤵
  PID:4568
- C:\Windows\System\fZSExqp.exe
  C:\Windows\System\fZSExqp.exe
  2⤵
  PID:4448
- C:\Windows\System\KhjtlOO.exe
  C:\Windows\System\KhjtlOO.exe
  2⤵
  PID:4452
- C:\Windows\System\kwVVRDL.exe
  C:\Windows\System\kwVVRDL.exe
  2⤵
  PID:4644
- C:\Windows\System\mcXSeNb.exe
  C:\Windows\System\mcXSeNb.exe
  2⤵
  PID:4736
- C:\Windows\System\JMdaqjR.exe
  C:\Windows\System\JMdaqjR.exe
  2⤵
  PID:4748
- C:\Windows\System\diVXGmb.exe
  C:\Windows\System\diVXGmb.exe
  2⤵
  PID:4784
- C:\Windows\System\RFyVMPR.exe
  C:\Windows\System\RFyVMPR.exe
  2⤵
  PID:4684
- C:\Windows\System\RfboXSK.exe
  C:\Windows\System\RfboXSK.exe
  2⤵
  PID:4840
- C:\Windows\System\wwrmtLN.exe
  C:\Windows\System\wwrmtLN.exe
  2⤵
  PID:4912
- C:\Windows\System\FKiephK.exe
  C:\Windows\System\FKiephK.exe
  2⤵
  PID:4952
- C:\Windows\System\ipxICNo.exe
  C:\Windows\System\ipxICNo.exe
  2⤵
  PID:5016
- C:\Windows\System\QKwXOps.exe
  C:\Windows\System\QKwXOps.exe
  2⤵
  PID:4820
- C:\Windows\System\siLMRHs.exe
  C:\Windows\System\siLMRHs.exe
  2⤵
  PID:4968
- C:\Windows\System\bVeRcNN.exe
  C:\Windows\System\bVeRcNN.exe
  2⤵
  PID:4892
- C:\Windows\System\dKdtxlY.exe
  C:\Windows\System\dKdtxlY.exe
  2⤵
  PID:4824
- C:\Windows\System\SdPjFQY.exe
  C:\Windows\System\SdPjFQY.exe
  2⤵
  PID:4052
- C:\Windows\System\TJCaipl.exe
  C:\Windows\System\TJCaipl.exe
  2⤵
  PID:3116
- C:\Windows\System\GbRvrjQ.exe
  C:\Windows\System\GbRvrjQ.exe
  2⤵
  PID:4156
- C:\Windows\System\nYLUYpB.exe
  C:\Windows\System\nYLUYpB.exe
  2⤵
  PID:4364
- C:\Windows\System\FbhmHKS.exe
  C:\Windows\System\FbhmHKS.exe
  2⤵
  PID:4320
- C:\Windows\System\YBjuWjA.exe
  C:\Windows\System\YBjuWjA.exe
  2⤵
  PID:4392
- C:\Windows\System\QlUZFzl.exe
  C:\Windows\System\QlUZFzl.exe
  2⤵
  PID:2540
- C:\Windows\System\vywTQCx.exe
  C:\Windows\System\vywTQCx.exe
  2⤵
  PID:4396
- C:\Windows\System\AovLdtb.exe
  C:\Windows\System\AovLdtb.exe
  2⤵
  PID:5112
- C:\Windows\System\qnAZfHe.exe
  C:\Windows\System\qnAZfHe.exe
  2⤵
  PID:4148
- C:\Windows\System\NNynBkd.exe
  C:\Windows\System\NNynBkd.exe
  2⤵
  PID:4580
- C:\Windows\System\QUUjOyp.exe
  C:\Windows\System\QUUjOyp.exe
  2⤵
  PID:4536
- C:\Windows\System\DDNYaTm.exe
  C:\Windows\System\DDNYaTm.exe
  2⤵
  PID:4300
- C:\Windows\System\HpUyLou.exe
  C:\Windows\System\HpUyLou.exe
  2⤵
  PID:4592
- C:\Windows\System\XUllnMF.exe
  C:\Windows\System\XUllnMF.exe
  2⤵
  PID:4808
- C:\Windows\System\ZNlpLcz.exe
  C:\Windows\System\ZNlpLcz.exe
  2⤵
  PID:4552
- C:\Windows\System\xXvxJuj.exe
  C:\Windows\System\xXvxJuj.exe
  2⤵
  PID:4612
- C:\Windows\System\ihOzrBP.exe
  C:\Windows\System\ihOzrBP.exe
  2⤵
  PID:4660
- C:\Windows\System\sEulbaJ.exe
  C:\Windows\System\sEulbaJ.exe
  2⤵
  PID:4768
- C:\Windows\System\wDFOOuR.exe
  C:\Windows\System\wDFOOuR.exe
  2⤵
  PID:4876
- C:\Windows\System\igIpurS.exe
  C:\Windows\System\igIpurS.exe
  2⤵
  PID:4800
- C:\Windows\System\JdNvvtr.exe
  C:\Windows\System\JdNvvtr.exe
  2⤵
  PID:4844
- C:\Windows\System\LVGWlbi.exe
  C:\Windows\System\LVGWlbi.exe
  2⤵
  PID:5068
- C:\Windows\System\XytdURj.exe
  C:\Windows\System\XytdURj.exe
  2⤵
  PID:4860
- C:\Windows\System\OPGQrme.exe
  C:\Windows\System\OPGQrme.exe
  2⤵
  PID:4428
- C:\Windows\System\rNXFNuj.exe
  C:\Windows\System\rNXFNuj.exe
  2⤵
  PID:4248
- C:\Windows\System\LXsKjQJ.exe
  C:\Windows\System\LXsKjQJ.exe
  2⤵
  PID:1816
- C:\Windows\System\kcClFTP.exe
  C:\Windows\System\kcClFTP.exe
  2⤵
  PID:4532
- C:\Windows\System\GkCihtf.exe
  C:\Windows\System\GkCihtf.exe
  2⤵
  PID:4112
- C:\Windows\System\OFcMyAk.exe
  C:\Windows\System\OFcMyAk.exe
  2⤵
  PID:3572
- C:\Windows\System\NoQniAg.exe
  C:\Windows\System\NoQniAg.exe
  2⤵
  PID:3600
- C:\Windows\System\QHahzwj.exe
  C:\Windows\System\QHahzwj.exe
  2⤵
  PID:3488
- C:\Windows\System\MaSgBDM.exe
  C:\Windows\System\MaSgBDM.exe
  2⤵
  PID:4520
- C:\Windows\System\raVynPL.exe
  C:\Windows\System\raVynPL.exe
  2⤵
  PID:4712
- C:\Windows\System\dzhXkWx.exe
  C:\Windows\System\dzhXkWx.exe
  2⤵
  PID:3932
- C:\Windows\System\pnBRyex.exe
  C:\Windows\System\pnBRyex.exe
  2⤵
  PID:3868
- C:\Windows\System\arvEnir.exe
  C:\Windows\System\arvEnir.exe
  2⤵
  PID:5080
- C:\Windows\System\RTxXaTj.exe
  C:\Windows\System\RTxXaTj.exe
  2⤵
  PID:4732
- C:\Windows\System\lDfoFdS.exe
  C:\Windows\System\lDfoFdS.exe
  2⤵
  PID:4984
- C:\Windows\System\pGIXOLV.exe
  C:\Windows\System\pGIXOLV.exe
  2⤵
  PID:4656
- C:\Windows\System\uqaccTv.exe
  C:\Windows\System\uqaccTv.exe
  2⤵
  PID:2512
- C:\Windows\System\KJFSQMh.exe
  C:\Windows\System\KJFSQMh.exe
  2⤵
  PID:4376
- C:\Windows\System\koOuDxD.exe
  C:\Windows\System\koOuDxD.exe
  2⤵
  PID:4260
- C:\Windows\System\xlPDaHa.exe
  C:\Windows\System\xlPDaHa.exe
  2⤵
  PID:4928
- C:\Windows\System\LsxdKsD.exe
  C:\Windows\System\LsxdKsD.exe
  2⤵
  PID:4500
- C:\Windows\System\fXSnjAv.exe
  C:\Windows\System\fXSnjAv.exe
  2⤵
  PID:4284
- C:\Windows\System\HEjQGGG.exe
  C:\Windows\System\HEjQGGG.exe
  2⤵
  PID:4348
- C:\Windows\System\PJSymnW.exe
  C:\Windows\System\PJSymnW.exe
  2⤵
  PID:2788
- C:\Windows\System\DRMEvsC.exe
  C:\Windows\System\DRMEvsC.exe
  2⤵
  PID:5000
- C:\Windows\System\KnsYOdI.exe
  C:\Windows\System\KnsYOdI.exe
  2⤵
  PID:3740
- C:\Windows\System\HmqQlAC.exe
  C:\Windows\System\HmqQlAC.exe
  2⤵
  PID:4640
- C:\Windows\System\GmlXOZT.exe
  C:\Windows\System\GmlXOZT.exe
  2⤵
  PID:5032
- C:\Windows\System\FaBkDyr.exe
  C:\Windows\System\FaBkDyr.exe
  2⤵
  PID:4064
- C:\Windows\System\CeYRlyz.exe
  C:\Windows\System\CeYRlyz.exe
  2⤵
  PID:5028
- C:\Windows\System\azVEpJA.exe
  C:\Windows\System\azVEpJA.exe
  2⤵
  PID:5012
- C:\Windows\System\jInfbDi.exe
  C:\Windows\System\jInfbDi.exe
  2⤵
  PID:4696
- C:\Windows\System\iLxLCsX.exe
  C:\Windows\System\iLxLCsX.exe
  2⤵
  PID:5088
- C:\Windows\System\VPYFaEv.exe
  C:\Windows\System\VPYFaEv.exe
  2⤵
  PID:5132
- C:\Windows\System\gyRUNre.exe
  C:\Windows\System\gyRUNre.exe
  2⤵
  PID:5152
- C:\Windows\System\mHsQExL.exe
  C:\Windows\System\mHsQExL.exe
  2⤵
  PID:5172
- C:\Windows\System\oqOmmob.exe
  C:\Windows\System\oqOmmob.exe
  2⤵
  PID:5192
- C:\Windows\System\uJaYUXa.exe
  C:\Windows\System\uJaYUXa.exe
  2⤵
  PID:5208
- C:\Windows\System\PYfrUMa.exe
  C:\Windows\System\PYfrUMa.exe
  2⤵
  PID:5224
- C:\Windows\System\XXMsJoH.exe
  C:\Windows\System\XXMsJoH.exe
  2⤵
  PID:5240
- C:\Windows\System\iMeaGRh.exe
  C:\Windows\System\iMeaGRh.exe
  2⤵
  PID:5256
- C:\Windows\System\FwdmbDS.exe
  C:\Windows\System\FwdmbDS.exe
  2⤵
  PID:5280
- C:\Windows\System\ySgJLCl.exe
  C:\Windows\System\ySgJLCl.exe
  2⤵
  PID:5300
- C:\Windows\System\ZMIgJLz.exe
  C:\Windows\System\ZMIgJLz.exe
  2⤵
  PID:5316
- C:\Windows\System\IFwQBMD.exe
  C:\Windows\System\IFwQBMD.exe
  2⤵
  PID:5340
- C:\Windows\System\lrraaYI.exe
  C:\Windows\System\lrraaYI.exe
  2⤵
  PID:5356
- C:\Windows\System\QGSboCj.exe
  C:\Windows\System\QGSboCj.exe
  2⤵
  PID:5376
- C:\Windows\System\EweDeLH.exe
  C:\Windows\System\EweDeLH.exe
  2⤵
  PID:5396
- C:\Windows\System\hmGgRPe.exe
  C:\Windows\System\hmGgRPe.exe
  2⤵
  PID:5416
- C:\Windows\System\BbYdXnh.exe
  C:\Windows\System\BbYdXnh.exe
  2⤵
  PID:5464
- C:\Windows\System\FulmUal.exe
  C:\Windows\System\FulmUal.exe
  2⤵
  PID:5484
- C:\Windows\System\ZUJuBan.exe
  C:\Windows\System\ZUJuBan.exe
  2⤵
  PID:5504
- C:\Windows\System\wzhggdY.exe
  C:\Windows\System\wzhggdY.exe
  2⤵
  PID:5524
- C:\Windows\System\AmbVxlo.exe
  C:\Windows\System\AmbVxlo.exe
  2⤵
  PID:5540
- C:\Windows\System\ODJbWdS.exe
  C:\Windows\System\ODJbWdS.exe
  2⤵
  PID:5556
- C:\Windows\System\bCNUwSY.exe
  C:\Windows\System\bCNUwSY.exe
  2⤵
  PID:5580
- C:\Windows\System\KTUOjwY.exe
  C:\Windows\System\KTUOjwY.exe
  2⤵
  PID:5600
- C:\Windows\System\SfAbaFT.exe
  C:\Windows\System\SfAbaFT.exe
  2⤵
  PID:5616
- C:\Windows\System\pMPHZcF.exe
  C:\Windows\System\pMPHZcF.exe
  2⤵
  PID:5636
- C:\Windows\System\HpEclqy.exe
  C:\Windows\System\HpEclqy.exe
  2⤵
  PID:5660
- C:\Windows\System\YfjZbKo.exe
  C:\Windows\System\YfjZbKo.exe
  2⤵
  PID:5676
- C:\Windows\System\gMFEZGG.exe
  C:\Windows\System\gMFEZGG.exe
  2⤵
  PID:5692
- C:\Windows\System\uajTqnc.exe
  C:\Windows\System\uajTqnc.exe
  2⤵
  PID:5708
- C:\Windows\System\FgBqQic.exe
  C:\Windows\System\FgBqQic.exe
  2⤵
  PID:5724
- C:\Windows\System\oMpsklw.exe
  C:\Windows\System\oMpsklw.exe
  2⤵
  PID:5740
- C:\Windows\System\iamnqOh.exe
  C:\Windows\System\iamnqOh.exe
  2⤵
  PID:5760
- C:\Windows\System\MvkdHfP.exe
  C:\Windows\System\MvkdHfP.exe
  2⤵
  PID:5776
- C:\Windows\System\IAGETKR.exe
  C:\Windows\System\IAGETKR.exe
  2⤵
  PID:5804
- C:\Windows\System\uwqFnta.exe
  C:\Windows\System\uwqFnta.exe
  2⤵
  PID:5820
- C:\Windows\System\BzKgXEx.exe
  C:\Windows\System\BzKgXEx.exe
  2⤵
  PID:5836
- C:\Windows\System\RVTTSKU.exe
  C:\Windows\System\RVTTSKU.exe
  2⤵
  PID:5856
- C:\Windows\System\EtGanyg.exe
  C:\Windows\System\EtGanyg.exe
  2⤵
  PID:5872
- C:\Windows\System\UyzNWHd.exe
  C:\Windows\System\UyzNWHd.exe
  2⤵
  PID:5888
- C:\Windows\System\ahsXiyF.exe
  C:\Windows\System\ahsXiyF.exe
  2⤵
  PID:5908
- C:\Windows\System\xKfhNxx.exe
  C:\Windows\System\xKfhNxx.exe
  2⤵
  PID:5928
- C:\Windows\System\UmVJpZD.exe
  C:\Windows\System\UmVJpZD.exe
  2⤵
  PID:5944
- C:\Windows\System\PTjLIqj.exe
  C:\Windows\System\PTjLIqj.exe
  2⤵
  PID:5964
- C:\Windows\System\UqaYVyt.exe
  C:\Windows\System\UqaYVyt.exe
  2⤵
  PID:5984
- C:\Windows\System\zplHqlh.exe
  C:\Windows\System\zplHqlh.exe
  2⤵
  PID:6000
- C:\Windows\System\aOdaqtS.exe
  C:\Windows\System\aOdaqtS.exe
  2⤵
  PID:6020
- C:\Windows\System\IopaujX.exe
  C:\Windows\System\IopaujX.exe
  2⤵
  PID:6040
- C:\Windows\System\FPzfgjT.exe
  C:\Windows\System\FPzfgjT.exe
  2⤵
  PID:6056
- C:\Windows\System\AGSTqhh.exe
  C:\Windows\System\AGSTqhh.exe
  2⤵
  PID:6128
- C:\Windows\System\KnmYlOz.exe
  C:\Windows\System\KnmYlOz.exe
  2⤵
  PID:4168
- C:\Windows\System\skgBVTZ.exe
  C:\Windows\System\skgBVTZ.exe
  2⤵
  PID:5164
- C:\Windows\System\YzExaqW.exe
  C:\Windows\System\YzExaqW.exe
  2⤵
  PID:5232
- C:\Windows\System\xNahleK.exe
  C:\Windows\System\xNahleK.exe
  2⤵
  PID:5272
- C:\Windows\System\DrnfTbx.exe
  C:\Windows\System\DrnfTbx.exe
  2⤵
  PID:5348
- C:\Windows\System\nYnUdxF.exe
  C:\Windows\System\nYnUdxF.exe
  2⤵
  PID:5148
- C:\Windows\System\vMhMrtl.exe
  C:\Windows\System\vMhMrtl.exe
  2⤵
  PID:5428
- C:\Windows\System\ApmKxCR.exe
  C:\Windows\System\ApmKxCR.exe
  2⤵
  PID:4932
- C:\Windows\System\zYMWjhJ.exe
  C:\Windows\System\zYMWjhJ.exe
  2⤵
  PID:5108
- C:\Windows\System\JndAezq.exe
  C:\Windows\System\JndAezq.exe
  2⤵
  PID:5432
- C:\Windows\System\fPgorxg.exe
  C:\Windows\System\fPgorxg.exe
  2⤵
  PID:5220
- C:\Windows\System\irqKRqD.exe
  C:\Windows\System\irqKRqD.exe
  2⤵
  PID:5328
- C:\Windows\System\FxuHoUS.exe
  C:\Windows\System\FxuHoUS.exe
  2⤵
  PID:5364
- C:\Windows\System\xpYwCta.exe
  C:\Windows\System\xpYwCta.exe
  2⤵
  PID:5476
- C:\Windows\System\YyUhfgD.exe
  C:\Windows\System\YyUhfgD.exe
  2⤵
  PID:5512
- C:\Windows\System\XjKdABW.exe
  C:\Windows\System\XjKdABW.exe
  2⤵
  PID:5568
- C:\Windows\System\NuSlCnw.exe
  C:\Windows\System\NuSlCnw.exe
  2⤵
  PID:5612
- C:\Windows\System\dMlkkIC.exe
  C:\Windows\System\dMlkkIC.exe
  2⤵
  PID:5684
- C:\Windows\System\oRvfSsD.exe
  C:\Windows\System\oRvfSsD.exe
  2⤵
  PID:5552
- C:\Windows\System\WzLtJNk.exe
  C:\Windows\System\WzLtJNk.exe
  2⤵
  PID:5752
- C:\Windows\System\IeUXQoe.exe
  C:\Windows\System\IeUXQoe.exe
  2⤵
  PID:5796
- C:\Windows\System\lmtCvAR.exe
  C:\Windows\System\lmtCvAR.exe
  2⤵
  PID:5864
- C:\Windows\System\qCLERfU.exe
  C:\Windows\System\qCLERfU.exe
  2⤵
  PID:5940
- C:\Windows\System\OjVySBR.exe
  C:\Windows\System\OjVySBR.exe
  2⤵
  PID:5624
- C:\Windows\System\tLsEKnu.exe
  C:\Windows\System\tLsEKnu.exe
  2⤵
  PID:6008
- C:\Windows\System\wNRoBTB.exe
  C:\Windows\System\wNRoBTB.exe
  2⤵
  PID:5704
- C:\Windows\System\yTlpIVT.exe
  C:\Windows\System\yTlpIVT.exe
  2⤵
  PID:6140
- C:\Windows\System\EvYnsyD.exe
  C:\Windows\System\EvYnsyD.exe
  2⤵
  PID:5732
- C:\Windows\System\lctOvlU.exe
  C:\Windows\System\lctOvlU.exe
  2⤵
  PID:5816
- C:\Windows\System\kodWcbK.exe
  C:\Windows\System\kodWcbK.exe
  2⤵
  PID:5952
- C:\Windows\System\OuYlgpB.exe
  C:\Windows\System\OuYlgpB.exe
  2⤵
  PID:5996
- C:\Windows\System\jJtVOEx.exe
  C:\Windows\System\jJtVOEx.exe
  2⤵
  PID:6080
- C:\Windows\System\RNhJkQf.exe
  C:\Windows\System\RNhJkQf.exe
  2⤵
  PID:5308
- C:\Windows\System\OKPrwYe.exe
  C:\Windows\System\OKPrwYe.exe
  2⤵
  PID:6108
- C:\Windows\System\CBkPmyT.exe
  C:\Windows\System\CBkPmyT.exe
  2⤵
  PID:6120
- C:\Windows\System\bfdWehh.exe
  C:\Windows\System\bfdWehh.exe
  2⤵
  PID:4388
- C:\Windows\System\Ylbnvco.exe
  C:\Windows\System\Ylbnvco.exe
  2⤵
  PID:5440
- C:\Windows\System\yLRhxcF.exe
  C:\Windows\System\yLRhxcF.exe
  2⤵
  PID:5216
- C:\Windows\System\QwxwOmB.exe
  C:\Windows\System\QwxwOmB.exe
  2⤵
  PID:5716
- C:\Windows\System\XOXZteA.exe
  C:\Windows\System\XOXZteA.exe
  2⤵
  PID:5800
- C:\Windows\System\ZAbsZzI.exe
  C:\Windows\System\ZAbsZzI.exe
  2⤵
  PID:5548
- C:\Windows\System\mRnvqNB.exe
  C:\Windows\System\mRnvqNB.exe
  2⤵
  PID:6068
- C:\Windows\System\DGuZyvh.exe
  C:\Windows\System\DGuZyvh.exe
  2⤵
  PID:5392
- C:\Windows\System\TKPqUFf.exe
  C:\Windows\System\TKPqUFf.exe
  2⤵
  PID:5880
- C:\Windows\System\fwqejCk.exe
  C:\Windows\System\fwqejCk.exe
  2⤵
  PID:5144
- C:\Windows\System\BBbheXs.exe
  C:\Windows\System\BBbheXs.exe
  2⤵
  PID:5896
- C:\Windows\System\RkDtspg.exe
  C:\Windows\System\RkDtspg.exe
  2⤵
  PID:5532
- C:\Windows\System\OClDejB.exe
  C:\Windows\System\OClDejB.exe
  2⤵
  PID:5652
- C:\Windows\System\HRyIVnZ.exe
  C:\Windows\System\HRyIVnZ.exe
  2⤵
  PID:5812
- C:\Windows\System\HVMbrEl.exe
  C:\Windows\System\HVMbrEl.exe
  2⤵
  PID:5700
- C:\Windows\System\ofZbRFT.exe
  C:\Windows\System\ofZbRFT.exe
  2⤵
  PID:6036
- C:\Windows\System\TWhNcet.exe
  C:\Windows\System\TWhNcet.exe
  2⤵
  PID:5736
- C:\Windows\System\YxDOBAd.exe
  C:\Windows\System\YxDOBAd.exe
  2⤵
  PID:6116
- C:\Windows\System\GXzsMRr.exe
  C:\Windows\System\GXzsMRr.exe
  2⤵
  PID:5188
- C:\Windows\System\gsyVyPY.exe
  C:\Windows\System\gsyVyPY.exe
  2⤵
  PID:5264
- C:\Windows\System\yPfNVIp.exe
  C:\Windows\System\yPfNVIp.exe
  2⤵
  PID:5496
- C:\Windows\System\eOhNBaH.exe
  C:\Windows\System\eOhNBaH.exe
  2⤵
  PID:5848
- C:\Windows\System\RQFVrne.exe
  C:\Windows\System\RQFVrne.exe
  2⤵
  PID:5460
- C:\Windows\System\svVIPZS.exe
  C:\Windows\System\svVIPZS.exe
  2⤵
  PID:5748
- C:\Windows\System\AyavgWB.exe
  C:\Windows\System\AyavgWB.exe
  2⤵
  PID:5960
- C:\Windows\System\khbloPf.exe
  C:\Windows\System\khbloPf.exe
  2⤵
  PID:6124
- C:\Windows\System\ZekEUUg.exe
  C:\Windows\System\ZekEUUg.exe
  2⤵
  PID:6052
- C:\Windows\System\OExrJIi.exe
  C:\Windows\System\OExrJIi.exe
  2⤵
  PID:5852
- C:\Windows\System\bifzHRT.exe
  C:\Windows\System\bifzHRT.exe
  2⤵
  PID:6160
- C:\Windows\System\FecGRQG.exe
  C:\Windows\System\FecGRQG.exe
  2⤵
  PID:6184
- C:\Windows\System\adQQOFG.exe
  C:\Windows\System\adQQOFG.exe
  2⤵
  PID:6200
- C:\Windows\System\OxACZPw.exe
  C:\Windows\System\OxACZPw.exe
  2⤵
  PID:6216
- C:\Windows\System\SXkCmFn.exe
  C:\Windows\System\SXkCmFn.exe
  2⤵
  PID:6232
- C:\Windows\System\XTuLhLb.exe
  C:\Windows\System\XTuLhLb.exe
  2⤵
  PID:6252
- C:\Windows\System\yeBdIcS.exe
  C:\Windows\System\yeBdIcS.exe
  2⤵
  PID:6268
- C:\Windows\System\umGuNgI.exe
  C:\Windows\System\umGuNgI.exe
  2⤵
  PID:6288
- C:\Windows\System\GukIyks.exe
  C:\Windows\System\GukIyks.exe
  2⤵
  PID:6308
- C:\Windows\System\GTDmhbo.exe
  C:\Windows\System\GTDmhbo.exe
  2⤵
  PID:6324
- C:\Windows\System\NGWMVgJ.exe
  C:\Windows\System\NGWMVgJ.exe
  2⤵
  PID:6344
- C:\Windows\System\BmTKfkp.exe
  C:\Windows\System\BmTKfkp.exe
  2⤵
  PID:6364
- C:\Windows\System\QHalVpz.exe
  C:\Windows\System\QHalVpz.exe
  2⤵
  PID:6380
- C:\Windows\System\ApeiYJO.exe
  C:\Windows\System\ApeiYJO.exe
  2⤵
  PID:6400
- C:\Windows\System\DqqiqUD.exe
  C:\Windows\System\DqqiqUD.exe
  2⤵
  PID:6416
- C:\Windows\System\piMvONd.exe
  C:\Windows\System\piMvONd.exe
  2⤵
  PID:6436
- C:\Windows\System\TnNZiPC.exe
  C:\Windows\System\TnNZiPC.exe
  2⤵
  PID:6460
- C:\Windows\System\vBEMBHX.exe
  C:\Windows\System\vBEMBHX.exe
  2⤵
  PID:6484
- C:\Windows\System\upNimDR.exe
  C:\Windows\System\upNimDR.exe
  2⤵
  PID:6508
- C:\Windows\System\nkFeeoA.exe
  C:\Windows\System\nkFeeoA.exe
  2⤵
  PID:6524
- C:\Windows\System\rDjGKEM.exe
  C:\Windows\System\rDjGKEM.exe
  2⤵
  PID:6540
- C:\Windows\System\TbfwRNE.exe
  C:\Windows\System\TbfwRNE.exe
  2⤵
  PID:6556
- C:\Windows\System\zcbzhqu.exe
  C:\Windows\System\zcbzhqu.exe
  2⤵
  PID:6584
- C:\Windows\System\JptDXVs.exe
  C:\Windows\System\JptDXVs.exe
  2⤵
  PID:6604
- C:\Windows\System\ofTWXQV.exe
  C:\Windows\System\ofTWXQV.exe
  2⤵
  PID:6624
- C:\Windows\System\sTzVQBH.exe
  C:\Windows\System\sTzVQBH.exe
  2⤵
  PID:6640
- C:\Windows\System\ILQvcKZ.exe
  C:\Windows\System\ILQvcKZ.exe
  2⤵
  PID:6656
- C:\Windows\System\YFdyRDi.exe
  C:\Windows\System\YFdyRDi.exe
  2⤵
  PID:6672
- C:\Windows\System\eNVzMdA.exe
  C:\Windows\System\eNVzMdA.exe
  2⤵
  PID:6692
- C:\Windows\System\nGaQSbV.exe
  C:\Windows\System\nGaQSbV.exe
  2⤵
  PID:6708
- C:\Windows\System\OuchdGI.exe
  C:\Windows\System\OuchdGI.exe
  2⤵
  PID:6724
- C:\Windows\System\TeEzRNf.exe
  C:\Windows\System\TeEzRNf.exe
  2⤵
  PID:6744
- C:\Windows\System\BHLmyKk.exe
  C:\Windows\System\BHLmyKk.exe
  2⤵
  PID:6768
- C:\Windows\System\XyVuUZw.exe
  C:\Windows\System\XyVuUZw.exe
  2⤵
  PID:6784
- C:\Windows\System\IbOevzP.exe
  C:\Windows\System\IbOevzP.exe
  2⤵
  PID:6800
- C:\Windows\System\hzDYWIR.exe
  C:\Windows\System\hzDYWIR.exe
  2⤵
  PID:6816
- C:\Windows\System\zetmLep.exe
  C:\Windows\System\zetmLep.exe
  2⤵
  PID:6832
- C:\Windows\System\DmXwhSA.exe
  C:\Windows\System\DmXwhSA.exe
  2⤵
  PID:6924
- C:\Windows\System\kMZcBRZ.exe
  C:\Windows\System\kMZcBRZ.exe
  2⤵
  PID:6944
- C:\Windows\System\VGOuKWp.exe
  C:\Windows\System\VGOuKWp.exe
  2⤵
  PID:6968
- C:\Windows\System\iufywhW.exe
  C:\Windows\System\iufywhW.exe
  2⤵
  PID:6984
- C:\Windows\System\yCaYBmc.exe
  C:\Windows\System\yCaYBmc.exe
  2⤵
  PID:7000
- C:\Windows\System\kJVgzsC.exe
  C:\Windows\System\kJVgzsC.exe
  2⤵
  PID:7020
- C:\Windows\System\wiVoyYw.exe
  C:\Windows\System\wiVoyYw.exe
  2⤵
  PID:7044
- C:\Windows\System\OrfmbJY.exe
  C:\Windows\System\OrfmbJY.exe
  2⤵
  PID:7064
- C:\Windows\System\nzepkHQ.exe
  C:\Windows\System\nzepkHQ.exe
  2⤵
  PID:7080
- C:\Windows\System\UmYzJrK.exe
  C:\Windows\System\UmYzJrK.exe
  2⤵
  PID:7096
- C:\Windows\System\WVVJHVs.exe
  C:\Windows\System\WVVJHVs.exe
  2⤵
  PID:7116
- C:\Windows\System\AKFxvjL.exe
  C:\Windows\System\AKFxvjL.exe
  2⤵
  PID:7136
- C:\Windows\System\EiqZpqb.exe
  C:\Windows\System\EiqZpqb.exe
  2⤵
  PID:7160
- C:\Windows\System\EgsgJYH.exe
  C:\Windows\System\EgsgJYH.exe
  2⤵
  PID:6168
- C:\Windows\System\HhaMXtE.exe
  C:\Windows\System\HhaMXtE.exe
  2⤵
  PID:6244
- C:\Windows\System\jEqHxJo.exe
  C:\Windows\System\jEqHxJo.exe
  2⤵
  PID:6284
- C:\Windows\System\JIeJSqt.exe
  C:\Windows\System\JIeJSqt.exe
  2⤵
  PID:6072
- C:\Windows\System\LjXbmaD.exe
  C:\Windows\System\LjXbmaD.exe
  2⤵
  PID:6392
- C:\Windows\System\FLAhbmR.exe
  C:\Windows\System\FLAhbmR.exe
  2⤵
  PID:6432
- C:\Windows\System\kxwFQQt.exe
  C:\Windows\System\kxwFQQt.exe
  2⤵
  PID:6480
- C:\Windows\System\eKwHJBx.exe
  C:\Windows\System\eKwHJBx.exe
  2⤵
  PID:5592
- C:\Windows\System\orxKacw.exe
  C:\Windows\System\orxKacw.exe
  2⤵
  PID:5976
- C:\Windows\System\AKtELZb.exe
  C:\Windows\System\AKtELZb.exe
  2⤵
  PID:6552
- C:\Windows\System\nYvcryg.exe
  C:\Windows\System\nYvcryg.exe
  2⤵
  PID:5184
- C:\Windows\System\jOijJhI.exe
  C:\Windows\System\jOijJhI.exe
  2⤵
  PID:6596
- C:\Windows\System\ooPMKAf.exe
  C:\Windows\System\ooPMKAf.exe
  2⤵
  PID:6636
- C:\Windows\System\xCKfXDX.exe
  C:\Windows\System\xCKfXDX.exe
  2⤵
  PID:6408
- C:\Windows\System\UEqODBg.exe
  C:\Windows\System\UEqODBg.exe
  2⤵
  PID:6700
- C:\Windows\System\bFyJBrK.exe
  C:\Windows\System\bFyJBrK.exe
  2⤵
  PID:6452
- C:\Windows\System\xZSdLMI.exe
  C:\Windows\System\xZSdLMI.exe
  2⤵
  PID:6492
- C:\Windows\System\NahvagO.exe
  C:\Windows\System\NahvagO.exe
  2⤵
  PID:6532
- C:\Windows\System\qABtPur.exe
  C:\Windows\System\qABtPur.exe
  2⤵
  PID:6572
- C:\Windows\System\opiOfch.exe
  C:\Windows\System\opiOfch.exe
  2⤵
  PID:6732
- C:\Windows\System\oVzHDps.exe
  C:\Windows\System\oVzHDps.exe
  2⤵
  PID:6840
- C:\Windows\System\UkDIMgs.exe
  C:\Windows\System\UkDIMgs.exe
  2⤵
  PID:6864
- C:\Windows\System\JqUUzrn.exe
  C:\Windows\System\JqUUzrn.exe
  2⤵
  PID:6880
- C:\Windows\System\ECVDIMV.exe
  C:\Windows\System\ECVDIMV.exe
  2⤵
  PID:6900
- C:\Windows\System\KLdbdJj.exe
  C:\Windows\System\KLdbdJj.exe
  2⤵
  PID:6652
- C:\Windows\System\feCvaHG.exe
  C:\Windows\System\feCvaHG.exe
  2⤵
  PID:6916
- C:\Windows\System\NwOFiCA.exe
  C:\Windows\System\NwOFiCA.exe
  2⤵
  PID:6260
- C:\Windows\System\AqcVPmC.exe
  C:\Windows\System\AqcVPmC.exe
  2⤵
  PID:5920
- C:\Windows\System\ULDpjxx.exe
  C:\Windows\System\ULDpjxx.exe
  2⤵
  PID:6332
- C:\Windows\System\aentRJU.exe
  C:\Windows\System\aentRJU.exe
  2⤵
  PID:6196
- C:\Windows\System\sVpErlB.exe
  C:\Windows\System\sVpErlB.exe
  2⤵
  PID:6720
- C:\Windows\System\UAKEUNn.exe
  C:\Windows\System\UAKEUNn.exe
  2⤵
  PID:6936
- C:\Windows\System\zfkGmbv.exe
  C:\Windows\System\zfkGmbv.exe
  2⤵
  PID:6964
- C:\Windows\System\PplTERh.exe
  C:\Windows\System\PplTERh.exe
  2⤵
  PID:7032
- C:\Windows\System\vSfzUNi.exe
  C:\Windows\System\vSfzUNi.exe
  2⤵
  PID:7104
- C:\Windows\System\yvTphZq.exe
  C:\Windows\System\yvTphZq.exe
  2⤵
  PID:7088
- C:\Windows\System\PDopIVF.exe
  C:\Windows\System\PDopIVF.exe
  2⤵
  PID:7016
- C:\Windows\System\jEibuuu.exe
  C:\Windows\System\jEibuuu.exe
  2⤵
  PID:6240
- C:\Windows\System\itoZXPg.exe
  C:\Windows\System\itoZXPg.exe
  2⤵
  PID:6356
- C:\Windows\System\xLzEzVV.exe
  C:\Windows\System\xLzEzVV.exe
  2⤵
  PID:6428
- C:\Windows\System\xcoeVpG.exe
  C:\Windows\System\xcoeVpG.exe
  2⤵
  PID:5644
- C:\Windows\System\XiKLxEw.exe
  C:\Windows\System\XiKLxEw.exe
  2⤵
  PID:6472
- C:\Windows\System\yLpZhSo.exe
  C:\Windows\System\yLpZhSo.exe
  2⤵
  PID:6548
- C:\Windows\System\uikOlhR.exe
  C:\Windows\System\uikOlhR.exe
  2⤵
  PID:5492
- C:\Windows\System\qZnVyeY.exe
  C:\Windows\System\qZnVyeY.exe
  2⤵
  PID:6388
- C:\Windows\System\yabGvTb.exe
  C:\Windows\System\yabGvTb.exe
  2⤵
  PID:4152
- C:\Windows\System\IGjTtEf.exe
  C:\Windows\System\IGjTtEf.exe
  2⤵
  PID:6448
- C:\Windows\System\pLZAdzP.exe
  C:\Windows\System\pLZAdzP.exe
  2⤵
  PID:6504
- C:\Windows\System\DqmjtJw.exe
  C:\Windows\System\DqmjtJw.exe
  2⤵
  PID:6580
- C:\Windows\System\AeLgcZH.exe
  C:\Windows\System\AeLgcZH.exe
  2⤵
  PID:6892
- C:\Windows\System\algPoCb.exe
  C:\Windows\System\algPoCb.exe
  2⤵
  PID:6756
- C:\Windows\System\iVUxyUs.exe
  C:\Windows\System\iVUxyUs.exe
  2⤵
  PID:6300
- C:\Windows\System\ZtgtQSm.exe
  C:\Windows\System\ZtgtQSm.exe
  2⤵
  PID:6760
- C:\Windows\System\EAyNzgK.exe
  C:\Windows\System\EAyNzgK.exe
  2⤵
  PID:7112
- C:\Windows\System\FxWGObB.exe
  C:\Windows\System\FxWGObB.exe
  2⤵
  PID:7056
- C:\Windows\System\VRYuGYW.exe
  C:\Windows\System\VRYuGYW.exe
  2⤵
  PID:6812
- C:\Windows\System\HztlPnO.exe
  C:\Windows\System\HztlPnO.exe
  2⤵
  PID:6136
- C:\Windows\System\wwCTgKb.exe
  C:\Windows\System\wwCTgKb.exe
  2⤵
  PID:7144
- C:\Windows\System\NvvSuMH.exe
  C:\Windows\System\NvvSuMH.exe
  2⤵
  PID:6340
- C:\Windows\System\HzKXAEP.exe
  C:\Windows\System\HzKXAEP.exe
  2⤵
  PID:7156
- C:\Windows\System\TQaDMtx.exe
  C:\Windows\System\TQaDMtx.exe
  2⤵
  PID:6716
- C:\Windows\System\BTCqCIy.exe
  C:\Windows\System\BTCqCIy.exe
  2⤵
  PID:7152
- C:\Windows\System\TRWJygk.exe
  C:\Windows\System\TRWJygk.exe
  2⤵
  PID:6516
- C:\Windows\System\MvufkXe.exe
  C:\Windows\System\MvufkXe.exe
  2⤵
  PID:6228
- C:\Windows\System\qCpoyMN.exe
  C:\Windows\System\qCpoyMN.exe
  2⤵
  PID:6888
- C:\Windows\System\DFVhDmQ.exe
  C:\Windows\System\DFVhDmQ.exe
  2⤵
  PID:6992
- C:\Windows\System\npILUtd.exe
  C:\Windows\System\npILUtd.exe
  2⤵
  PID:6564
- C:\Windows\System\GNrsxYw.exe
  C:\Windows\System\GNrsxYw.exe
  2⤵
  PID:6616
- C:\Windows\System\rAfgdAE.exe
  C:\Windows\System\rAfgdAE.exe
  2⤵
  PID:6496
- C:\Windows\System\EKtJEYk.exe
  C:\Windows\System\EKtJEYk.exe
  2⤵
  PID:5472
- C:\Windows\System\CCrTpnA.exe
  C:\Windows\System\CCrTpnA.exe
  2⤵
  PID:6872
- C:\Windows\System\xlTTWuI.exe
  C:\Windows\System\xlTTWuI.exe
  2⤵
  PID:5180
- C:\Windows\System\HBCDqFC.exe
  C:\Windows\System\HBCDqFC.exe
  2⤵
  PID:6592
- C:\Windows\System\lcTeqob.exe
  C:\Windows\System\lcTeqob.exe
  2⤵
  PID:7184
- C:\Windows\System\tdjaCIw.exe
  C:\Windows\System\tdjaCIw.exe
  2⤵
  PID:7204
- C:\Windows\System\GFnwVnQ.exe
  C:\Windows\System\GFnwVnQ.exe
  2⤵
  PID:7224
- C:\Windows\System\dPRYChk.exe
  C:\Windows\System\dPRYChk.exe
  2⤵
  PID:7248
- C:\Windows\System\QkrkNpi.exe
  C:\Windows\System\QkrkNpi.exe
  2⤵
  PID:7296
- C:\Windows\System\pwaVxlV.exe
  C:\Windows\System\pwaVxlV.exe
  2⤵
  PID:7316
- C:\Windows\System\QsnaOVf.exe
  C:\Windows\System\QsnaOVf.exe
  2⤵
  PID:7332
- C:\Windows\System\gfeaVLJ.exe
  C:\Windows\System\gfeaVLJ.exe
  2⤵
  PID:7348
- C:\Windows\System\gMImBGk.exe
  C:\Windows\System\gMImBGk.exe
  2⤵
  PID:7368
- C:\Windows\System\ghKpIUP.exe
  C:\Windows\System\ghKpIUP.exe
  2⤵
  PID:7392
- C:\Windows\System\RVoYfYu.exe
  C:\Windows\System\RVoYfYu.exe
  2⤵
  PID:7408
- C:\Windows\System\UzMyAcM.exe
  C:\Windows\System\UzMyAcM.exe
  2⤵
  PID:7424
- C:\Windows\System\dqjYvba.exe
  C:\Windows\System\dqjYvba.exe
  2⤵
  PID:7444
- C:\Windows\System\MHhwCVR.exe
  C:\Windows\System\MHhwCVR.exe
  2⤵
  PID:7472
- C:\Windows\System\RcXaDPI.exe
  C:\Windows\System\RcXaDPI.exe
  2⤵
  PID:7492
- C:\Windows\System\UyBlJeC.exe
  C:\Windows\System\UyBlJeC.exe
  2⤵
  PID:7508
- C:\Windows\System\LdcMczG.exe
  C:\Windows\System\LdcMczG.exe
  2⤵
  PID:7528
- C:\Windows\System\dhhirGw.exe
  C:\Windows\System\dhhirGw.exe
  2⤵
  PID:7556
- C:\Windows\System\wuQrgbd.exe
  C:\Windows\System\wuQrgbd.exe
  2⤵
  PID:7580
- C:\Windows\System\ghAtcAR.exe
  C:\Windows\System\ghAtcAR.exe
  2⤵
  PID:7600
- C:\Windows\System\UCeBkfV.exe
  C:\Windows\System\UCeBkfV.exe
  2⤵
  PID:7616
- C:\Windows\System\VcveCTo.exe
  C:\Windows\System\VcveCTo.exe
  2⤵
  PID:7636
- C:\Windows\System\rTTollJ.exe
  C:\Windows\System\rTTollJ.exe
  2⤵
  PID:7652
- C:\Windows\System\qgkCMrV.exe
  C:\Windows\System\qgkCMrV.exe
  2⤵
  PID:7672
- C:\Windows\System\AwOTOty.exe
  C:\Windows\System\AwOTOty.exe
  2⤵
  PID:7692
- C:\Windows\System\aZqhrUV.exe
  C:\Windows\System\aZqhrUV.exe
  2⤵
  PID:7708
- C:\Windows\System\RhkBsBj.exe
  C:\Windows\System\RhkBsBj.exe
  2⤵
  PID:7724
- C:\Windows\System\iaCpnnl.exe
  C:\Windows\System\iaCpnnl.exe
  2⤵
  PID:7744
- C:\Windows\System\cngoBYS.exe
  C:\Windows\System\cngoBYS.exe
  2⤵
  PID:7760
- C:\Windows\System\MxBYibH.exe
  C:\Windows\System\MxBYibH.exe
  2⤵
  PID:7776
- C:\Windows\System\CKGMfjJ.exe
  C:\Windows\System\CKGMfjJ.exe
  2⤵
  PID:7800
- C:\Windows\System\fCKYJcm.exe
  C:\Windows\System\fCKYJcm.exe
  2⤵
  PID:7816
- C:\Windows\System\iENbPhm.exe
  C:\Windows\System\iENbPhm.exe
  2⤵
  PID:7836
- C:\Windows\System\Kgxnmho.exe
  C:\Windows\System\Kgxnmho.exe
  2⤵
  PID:7852
- C:\Windows\System\iYoGFvh.exe
  C:\Windows\System\iYoGFvh.exe
  2⤵
  PID:7868
- C:\Windows\System\NXBavNl.exe
  C:\Windows\System\NXBavNl.exe
  2⤵
  PID:7884
- C:\Windows\System\jxmCWwY.exe
  C:\Windows\System\jxmCWwY.exe
  2⤵
  PID:7908
- C:\Windows\System\XrozDiK.exe
  C:\Windows\System\XrozDiK.exe
  2⤵
  PID:7924
- C:\Windows\System\UIELKwD.exe
  C:\Windows\System\UIELKwD.exe
  2⤵
  PID:7940
- C:\Windows\System\XbZTxot.exe
  C:\Windows\System\XbZTxot.exe
  2⤵
  PID:7960
- C:\Windows\System\LwBTpbI.exe
  C:\Windows\System\LwBTpbI.exe
  2⤵
  PID:7976
- C:\Windows\System\nRfiuAv.exe
  C:\Windows\System\nRfiuAv.exe
  2⤵
  PID:7992
- C:\Windows\System\mmvBpfI.exe
  C:\Windows\System\mmvBpfI.exe
  2⤵
  PID:8012
- C:\Windows\System\ZpLfdwl.exe
  C:\Windows\System\ZpLfdwl.exe
  2⤵
  PID:8032
- C:\Windows\System\LOuZlbh.exe
  C:\Windows\System\LOuZlbh.exe
  2⤵
  PID:8048
- C:\Windows\System\UxOlCNL.exe
  C:\Windows\System\UxOlCNL.exe
  2⤵
  PID:8064
- C:\Windows\System\PoeNPQS.exe
  C:\Windows\System\PoeNPQS.exe
  2⤵
  PID:8084
- C:\Windows\System\bfqYSKS.exe
  C:\Windows\System\bfqYSKS.exe
  2⤵
  PID:8104
- C:\Windows\System\KkMtpXh.exe
  C:\Windows\System\KkMtpXh.exe
  2⤵
  PID:8172
- C:\Windows\System\pQeEJUH.exe
  C:\Windows\System\pQeEJUH.exe
  2⤵
  PID:7180
- C:\Windows\System\PuhIOZW.exe
  C:\Windows\System\PuhIOZW.exe
  2⤵
  PID:6296
- C:\Windows\System\HlPvHyq.exe
  C:\Windows\System\HlPvHyq.exe
  2⤵
  PID:6320
- C:\Windows\System\nhnVmpC.exe
  C:\Windows\System\nhnVmpC.exe
  2⤵
  PID:5412
- C:\Windows\System\iaolRQo.exe
  C:\Windows\System\iaolRQo.exe
  2⤵
  PID:7268
- C:\Windows\System\qMBfRqL.exe
  C:\Windows\System\qMBfRqL.exe
  2⤵
  PID:7040
- C:\Windows\System\VlInaEr.exe
  C:\Windows\System\VlInaEr.exe
  2⤵
  PID:7284
- C:\Windows\System\APxxpXV.exe
  C:\Windows\System\APxxpXV.exe
  2⤵
  PID:6172
- C:\Windows\System\ZbNoTzr.exe
  C:\Windows\System\ZbNoTzr.exe
  2⤵
  PID:7260
- C:\Windows\System\wjpBHfD.exe
  C:\Windows\System\wjpBHfD.exe
  2⤵
  PID:6688
- C:\Windows\System\dNiClZw.exe
  C:\Windows\System\dNiClZw.exe
  2⤵
  PID:7324
- C:\Windows\System\CRaftjc.exe
  C:\Windows\System\CRaftjc.exe
  2⤵
  PID:7364
- C:\Windows\System\JFDlZvb.exe
  C:\Windows\System\JFDlZvb.exe
  2⤵
  PID:6792
- C:\Windows\System\ztGrEBQ.exe
  C:\Windows\System\ztGrEBQ.exe
  2⤵
  PID:7196
- C:\Windows\System\HotWKWI.exe
  C:\Windows\System\HotWKWI.exe
  2⤵
  PID:7240
- C:\Windows\System\zLHscAX.exe
  C:\Windows\System\zLHscAX.exe
  2⤵
  PID:7340
- C:\Windows\System\xjTFSMR.exe
  C:\Windows\System\xjTFSMR.exe
  2⤵
  PID:7440
- C:\Windows\System\ySCoDRs.exe
  C:\Windows\System\ySCoDRs.exe
  2⤵
  PID:7480
- C:\Windows\System\StXyuNS.exe
  C:\Windows\System\StXyuNS.exe
  2⤵
  PID:7516
- C:\Windows\System\UOgDEgC.exe
  C:\Windows\System\UOgDEgC.exe
  2⤵
  PID:7312
- C:\Windows\System\ffMWfOK.exe
  C:\Windows\System\ffMWfOK.exe
  2⤵
  PID:7504
- C:\Windows\System\DvwwUYO.exe
  C:\Windows\System\DvwwUYO.exe
  2⤵
  PID:7540
- C:\Windows\System\ITHKzit.exe
  C:\Windows\System\ITHKzit.exe
  2⤵
  PID:7564
- C:\Windows\System\QFhtTcl.exe
  C:\Windows\System\QFhtTcl.exe
  2⤵
  PID:7596
- C:\Windows\System\APDKGdG.exe
  C:\Windows\System\APDKGdG.exe
  2⤵
  PID:7680
- C:\Windows\System\UDEGeUc.exe
  C:\Windows\System\UDEGeUc.exe
  2⤵
  PID:7720
- C:\Windows\System\fqNSIBV.exe
  C:\Windows\System\fqNSIBV.exe
  2⤵
  PID:7892
- C:\Windows\System\RBXJrga.exe
  C:\Windows\System\RBXJrga.exe
  2⤵
  PID:7936
- C:\Windows\System\wTgGLAj.exe
  C:\Windows\System\wTgGLAj.exe
  2⤵
  PID:8000
- C:\Windows\System\YDdNzPI.exe
  C:\Windows\System\YDdNzPI.exe
  2⤵
  PID:8044
- C:\Windows\System\qXYmPvL.exe
  C:\Windows\System\qXYmPvL.exe
  2⤵
  PID:8120
- C:\Windows\System\iPnLsCy.exe
  C:\Windows\System\iPnLsCy.exe
  2⤵
  PID:8136
- C:\Windows\System\fpAltnt.exe
  C:\Windows\System\fpAltnt.exe
  2⤵
  PID:7880
- C:\Windows\System\JAZsvsw.exe
  C:\Windows\System\JAZsvsw.exe
  2⤵
  PID:8148
- C:\Windows\System\SmNCeuX.exe
  C:\Windows\System\SmNCeuX.exe
  2⤵
  PID:7956
- C:\Windows\System\OCtGMXQ.exe
  C:\Windows\System\OCtGMXQ.exe
  2⤵
  PID:8020
- C:\Windows\System\HOiPMBa.exe
  C:\Windows\System\HOiPMBa.exe
  2⤵
  PID:7628
- C:\Windows\System\leUmVDh.exe
  C:\Windows\System\leUmVDh.exe
  2⤵
  PID:7664
- C:\Windows\System\dutdBDL.exe
  C:\Windows\System\dutdBDL.exe
  2⤵
  PID:7732
- C:\Windows\System\ZdNjZWO.exe
  C:\Windows\System\ZdNjZWO.exe
  2⤵
  PID:7216
- C:\Windows\System\fBkMCmS.exe
  C:\Windows\System\fBkMCmS.exe
  2⤵
  PID:5564
- C:\Windows\System\msLENWo.exe
  C:\Windows\System\msLENWo.exe
  2⤵
  PID:5936
- C:\Windows\System\YtvBTXr.exe
  C:\Windows\System\YtvBTXr.exe
  2⤵
  PID:7176
- C:\Windows\System\vTUedRD.exe
  C:\Windows\System\vTUedRD.exe
  2⤵
  PID:7264
- C:\Windows\System\bXJhnmG.exe
  C:\Windows\System\bXJhnmG.exe
  2⤵
  PID:7280
- C:\Windows\System\VmkIjve.exe
  C:\Windows\System\VmkIjve.exe
  2⤵
  PID:6908
- C:\Windows\System\tLiZMYy.exe
  C:\Windows\System\tLiZMYy.exe
  2⤵
  PID:7076
- C:\Windows\System\CxNzQLc.exe
  C:\Windows\System\CxNzQLc.exe
  2⤵
  PID:7356
- C:\Windows\System\AWVDsyD.exe
  C:\Windows\System\AWVDsyD.exe
  2⤵
  PID:7400
- C:\Windows\System\aEuipBN.exe
  C:\Windows\System\aEuipBN.exe
  2⤵
  PID:7568
- C:\Windows\System\XquJlOo.exe
  C:\Windows\System\XquJlOo.exe
  2⤵
  PID:7132
- C:\Windows\System\nphHlCH.exe
  C:\Windows\System\nphHlCH.exe
  2⤵
  PID:7436
- C:\Windows\System\rjLKIst.exe
  C:\Windows\System\rjLKIst.exe
  2⤵
  PID:7416
- C:\Windows\System\HlPbMHB.exe
  C:\Windows\System\HlPbMHB.exe
  2⤵
  PID:7552
- C:\Windows\System\vORfAfN.exe
  C:\Windows\System\vORfAfN.exe
  2⤵
  PID:7756
- C:\Windows\System\TvEJFNl.exe
  C:\Windows\System\TvEJFNl.exe
  2⤵
  PID:7864
- C:\Windows\System\Doiahow.exe
  C:\Windows\System\Doiahow.exe
  2⤵
  PID:8040
- C:\Windows\System\WlIrnVC.exe
  C:\Windows\System\WlIrnVC.exe
  2⤵
  PID:8140
- C:\Windows\System\fGCRusF.exe
  C:\Windows\System\fGCRusF.exe
  2⤵
  PID:7948
- C:\Windows\System\vVeTDWZ.exe
  C:\Windows\System\vVeTDWZ.exe
  2⤵
  PID:8076
- C:\Windows\System\lYUPpUE.exe
  C:\Windows\System\lYUPpUE.exe
  2⤵
  PID:8116
- C:\Windows\System\bvntyKD.exe
  C:\Windows\System\bvntyKD.exe
  2⤵
  PID:7848
- C:\Windows\System\YhJfTNW.exe
  C:\Windows\System\YhJfTNW.exe
  2⤵
  PID:7772
- C:\Windows\System\gqcOpdq.exe
  C:\Windows\System\gqcOpdq.exe
  2⤵
  PID:8028
- C:\Windows\System\hVdPCfN.exe
  C:\Windows\System\hVdPCfN.exe
  2⤵
  PID:8100
- C:\Windows\System\JXVRvTN.exe
  C:\Windows\System\JXVRvTN.exe
  2⤵
  PID:6092
- C:\Windows\System\CTbZckQ.exe
  C:\Windows\System\CTbZckQ.exe
  2⤵
  PID:6824
- C:\Windows\System\crjAfET.exe
  C:\Windows\System\crjAfET.exe
  2⤵
  PID:7328
- C:\Windows\System\fhdMWgF.exe
  C:\Windows\System\fhdMWgF.exe
  2⤵
  PID:6736
- C:\Windows\System\bNDzqAZ.exe
  C:\Windows\System\bNDzqAZ.exe
  2⤵
  PID:6412
- C:\Windows\System\gnEOhIk.exe
  C:\Windows\System\gnEOhIk.exe
  2⤵
  PID:7344
- C:\Windows\System\WzHgyoF.exe
  C:\Windows\System\WzHgyoF.exe
  2⤵
  PID:7592
- C:\Windows\System\NUFqeAG.exe
  C:\Windows\System\NUFqeAG.exe
  2⤵
  PID:7236
- C:\Windows\System\WEVKoZO.exe
  C:\Windows\System\WEVKoZO.exe
  2⤵
  PID:7488
- C:\Windows\System\GCdlhUE.exe
  C:\Windows\System\GCdlhUE.exe
  2⤵
  PID:7784
- C:\Windows\System\qkblkRW.exe
  C:\Windows\System\qkblkRW.exe
  2⤵
  PID:8132
- C:\Windows\System\YahKkyJ.exe
  C:\Windows\System\YahKkyJ.exe
  2⤵
  PID:7740
- C:\Windows\System\zFAouGD.exe
  C:\Windows\System\zFAouGD.exe
  2⤵
  PID:8112
- C:\Windows\System\IiFsAEO.exe
  C:\Windows\System\IiFsAEO.exe
  2⤵
  PID:7916
- C:\Windows\System\ZtAssXO.exe
  C:\Windows\System\ZtAssXO.exe
  2⤵
  PID:8180
- C:\Windows\System\lNbhGeg.exe
  C:\Windows\System\lNbhGeg.exe
  2⤵
  PID:5456
- C:\Windows\System\iivnQLc.exe
  C:\Windows\System\iivnQLc.exe
  2⤵
  PID:7824
- C:\Windows\System\hEMtyfO.exe
  C:\Windows\System\hEMtyfO.exe
  2⤵
  PID:7828
- C:\Windows\System\wwgSYOM.exe
  C:\Windows\System\wwgSYOM.exe
  2⤵
  PID:7988
- C:\Windows\System\RfsTqSu.exe
  C:\Windows\System\RfsTqSu.exe
  2⤵
  PID:8200
- C:\Windows\System\UTsGOGb.exe
  C:\Windows\System\UTsGOGb.exe
  2⤵
  PID:8216
- C:\Windows\System\smGhrpt.exe
  C:\Windows\System\smGhrpt.exe
  2⤵
  PID:8232
- C:\Windows\System\FYTXsqO.exe
  C:\Windows\System\FYTXsqO.exe
  2⤵
  PID:8308
- C:\Windows\System\chDEVdG.exe
  C:\Windows\System\chDEVdG.exe
  2⤵
  PID:8324
- C:\Windows\System\SElejto.exe
  C:\Windows\System\SElejto.exe
  2⤵
  PID:8340
- C:\Windows\System\hdiUWNJ.exe
  C:\Windows\System\hdiUWNJ.exe
  2⤵
  PID:8360
- C:\Windows\System\bvWXsXn.exe
  C:\Windows\System\bvWXsXn.exe
  2⤵
  PID:8380
- C:\Windows\System\FMNsUGk.exe
  C:\Windows\System\FMNsUGk.exe
  2⤵
  PID:8396
- C:\Windows\System\OiqWkqq.exe
  C:\Windows\System\OiqWkqq.exe
  2⤵
  PID:8412
- C:\Windows\System\dKvuksx.exe
  C:\Windows\System\dKvuksx.exe
  2⤵
  PID:8432
- C:\Windows\System\raTiHiu.exe
  C:\Windows\System\raTiHiu.exe
  2⤵
  PID:8448
- C:\Windows\System\MKzUQbb.exe
  C:\Windows\System\MKzUQbb.exe
  2⤵
  PID:8464
- C:\Windows\System\askgSdy.exe
  C:\Windows\System\askgSdy.exe
  2⤵
  PID:8480
- C:\Windows\System\WYWYVFq.exe
  C:\Windows\System\WYWYVFq.exe
  2⤵
  PID:8496
- C:\Windows\System\qqLMdtg.exe
  C:\Windows\System\qqLMdtg.exe
  2⤵
  PID:8516
- C:\Windows\System\RTfYIQU.exe
  C:\Windows\System\RTfYIQU.exe
  2⤵
  PID:8532
- C:\Windows\System\FdUtrwu.exe
  C:\Windows\System\FdUtrwu.exe
  2⤵
  PID:8548
- C:\Windows\System\AzYiJPg.exe
  C:\Windows\System\AzYiJPg.exe
  2⤵
  PID:8564
- C:\Windows\System\vgeVAHF.exe
  C:\Windows\System\vgeVAHF.exe
  2⤵
  PID:8592
- C:\Windows\System\rlnxCes.exe
  C:\Windows\System\rlnxCes.exe
  2⤵
  PID:8652
- C:\Windows\System\uKsiNSh.exe
  C:\Windows\System\uKsiNSh.exe
  2⤵
  PID:8668
- C:\Windows\System\kInnIBn.exe
  C:\Windows\System\kInnIBn.exe
  2⤵
  PID:8684
- C:\Windows\System\sadBezt.exe
  C:\Windows\System\sadBezt.exe
  2⤵
  PID:8700
- C:\Windows\System\XzOJTSg.exe
  C:\Windows\System\XzOJTSg.exe
  2⤵
  PID:8716
- C:\Windows\System\SyqeLOC.exe
  C:\Windows\System\SyqeLOC.exe
  2⤵
  PID:8736
- C:\Windows\System\MizhxTZ.exe
  C:\Windows\System\MizhxTZ.exe
  2⤵
  PID:8772
- C:\Windows\System\TwzJAlu.exe
  C:\Windows\System\TwzJAlu.exe
  2⤵
  PID:8788
- C:\Windows\System\EQNYfZz.exe
  C:\Windows\System\EQNYfZz.exe
  2⤵
  PID:8804
- C:\Windows\System\mTplrkN.exe
  C:\Windows\System\mTplrkN.exe
  2⤵
  PID:8820
- C:\Windows\System\fEwoMtp.exe
  C:\Windows\System\fEwoMtp.exe
  2⤵
  PID:8836
- C:\Windows\System\qyHxtXE.exe
  C:\Windows\System\qyHxtXE.exe
  2⤵
  PID:8860
- C:\Windows\System\gsXMrHf.exe
  C:\Windows\System\gsXMrHf.exe
  2⤵
  PID:8876
- C:\Windows\System\sDxRmwl.exe
  C:\Windows\System\sDxRmwl.exe
  2⤵
  PID:8900
- C:\Windows\System\nXuCJHB.exe
  C:\Windows\System\nXuCJHB.exe
  2⤵
  PID:8936
- C:\Windows\System\ENpXHru.exe
  C:\Windows\System\ENpXHru.exe
  2⤵
  PID:8952
- C:\Windows\System\uEgTsuP.exe
  C:\Windows\System\uEgTsuP.exe
  2⤵
  PID:8972
- C:\Windows\System\HLeJcQZ.exe
  C:\Windows\System\HLeJcQZ.exe
  2⤵
  PID:8992
- C:\Windows\System\cfNBAPf.exe
  C:\Windows\System\cfNBAPf.exe
  2⤵
  PID:9016
- C:\Windows\System\fbBFSOr.exe
  C:\Windows\System\fbBFSOr.exe
  2⤵
  PID:9032
- C:\Windows\System\eAvIPXC.exe
  C:\Windows\System\eAvIPXC.exe
  2⤵
  PID:9048
- C:\Windows\System\LKEeNGl.exe
  C:\Windows\System\LKEeNGl.exe
  2⤵
  PID:9072
- C:\Windows\System\NdaBzpx.exe
  C:\Windows\System\NdaBzpx.exe
  2⤵
  PID:9092
- C:\Windows\System\jyxyHyk.exe
  C:\Windows\System\jyxyHyk.exe
  2⤵
  PID:9108
- C:\Windows\System\fmPwvHo.exe
  C:\Windows\System\fmPwvHo.exe
  2⤵
  PID:9124
- C:\Windows\System\SWalbsn.exe
  C:\Windows\System\SWalbsn.exe
  2⤵
  PID:9148
- C:\Windows\System\IRYgZlA.exe
  C:\Windows\System\IRYgZlA.exe
  2⤵
  PID:9164
- C:\Windows\System\UxzkYlm.exe
  C:\Windows\System\UxzkYlm.exe
  2⤵
  PID:9188
- C:\Windows\System\TaeSeNl.exe
  C:\Windows\System\TaeSeNl.exe
  2⤵
  PID:9208
- C:\Windows\System\jjydEzd.exe
  C:\Windows\System\jjydEzd.exe
  2⤵
  PID:8004
- C:\Windows\System\czSrSwZ.exe
  C:\Windows\System\czSrSwZ.exe
  2⤵
  PID:8212
- C:\Windows\System\QFeamFU.exe
  C:\Windows\System\QFeamFU.exe
  2⤵
  PID:8060
- C:\Windows\System\xSFJLfU.exe
  C:\Windows\System\xSFJLfU.exe
  2⤵
  PID:7968
- C:\Windows\System\unXGDoh.exe
  C:\Windows\System\unXGDoh.exe
  2⤵
  PID:7768
- C:\Windows\System\FHDKupH.exe
  C:\Windows\System\FHDKupH.exe
  2⤵
  PID:7460
- C:\Windows\System\tobtfcJ.exe
  C:\Windows\System\tobtfcJ.exe
  2⤵
  PID:6740
- C:\Windows\System\spNyNef.exe
  C:\Windows\System\spNyNef.exe
  2⤵
  PID:8260
- C:\Windows\System\eWqHxqj.exe
  C:\Windows\System\eWqHxqj.exe
  2⤵
  PID:8268
- C:\Windows\System\livGRhP.exe
  C:\Windows\System\livGRhP.exe
  2⤵
  PID:8288
- C:\Windows\System\wdDsLTq.exe
  C:\Windows\System\wdDsLTq.exe
  2⤵
  PID:2376
- C:\Windows\System\SLnzLOh.exe
  C:\Windows\System\SLnzLOh.exe
  2⤵
  PID:8332
- C:\Windows\System\DnZujqv.exe
  C:\Windows\System\DnZujqv.exe
  2⤵
  PID:8356
- C:\Windows\System\ePJxPrX.exe
  C:\Windows\System\ePJxPrX.exe
  2⤵
  PID:8404
- C:\Windows\System\qaQfUGb.exe
  C:\Windows\System\qaQfUGb.exe
  2⤵
  PID:8444
- C:\Windows\System\MCxyRje.exe
  C:\Windows\System\MCxyRje.exe
  2⤵
  PID:8388
- C:\Windows\System\tyZiZSu.exe
  C:\Windows\System\tyZiZSu.exe
  2⤵
  PID:8528
- C:\Windows\System\BCqsuIl.exe
  C:\Windows\System\BCqsuIl.exe
  2⤵
  PID:8524
- C:\Windows\System\Cszcogm.exe
  C:\Windows\System\Cszcogm.exe
  2⤵
  PID:8420
- C:\Windows\System\tWkcBGc.exe
  C:\Windows\System\tWkcBGc.exe
  2⤵
  PID:8584
- C:\Windows\System\mqQtPWh.exe
  C:\Windows\System\mqQtPWh.exe
  2⤵
  PID:8632
- C:\Windows\System\xwfqcaq.exe
  C:\Windows\System\xwfqcaq.exe
  2⤵
  PID:8624
- C:\Windows\System\DJqOJxi.exe
  C:\Windows\System\DJqOJxi.exe
  2⤵
  PID:8660
- C:\Windows\System\qwXtThN.exe
  C:\Windows\System\qwXtThN.exe
  2⤵
  PID:8724
- C:\Windows\System\WKrwdHR.exe
  C:\Windows\System\WKrwdHR.exe
  2⤵
  PID:8756
- C:\Windows\System\QbVCzWK.exe
  C:\Windows\System\QbVCzWK.exe
  2⤵
  PID:8784
- C:\Windows\System\MHCbNWB.exe
  C:\Windows\System\MHCbNWB.exe
  2⤵
  PID:8852
- C:\Windows\System\vEltHlb.exe
  C:\Windows\System\vEltHlb.exe
  2⤵
  PID:8888
- C:\Windows\System\NOsDzzc.exe
  C:\Windows\System\NOsDzzc.exe
  2⤵
  PID:8908
- C:\Windows\System\JmyEsXH.exe
  C:\Windows\System\JmyEsXH.exe
  2⤵
  PID:8600
- C:\Windows\System\JqZvCNm.exe
  C:\Windows\System\JqZvCNm.exe
  2⤵
  PID:8960
- C:\Windows\System\AVCLLrW.exe
  C:\Windows\System\AVCLLrW.exe
  2⤵
  PID:9004
- C:\Windows\System\MpUdtSF.exe
  C:\Windows\System\MpUdtSF.exe
  2⤵
  PID:9028
- C:\Windows\System\gmxHXTk.exe
  C:\Windows\System\gmxHXTk.exe
  2⤵
  PID:9068
- C:\Windows\System\likHtYh.exe
  C:\Windows\System\likHtYh.exe
  2⤵
  PID:9100
- C:\Windows\System\GhxWHzl.exe
  C:\Windows\System\GhxWHzl.exe
  2⤵
  PID:9132
- C:\Windows\System\cyaEovV.exe
  C:\Windows\System\cyaEovV.exe
  2⤵
  PID:9176
- C:\Windows\System\XHwiJtE.exe
  C:\Windows\System\XHwiJtE.exe
  2⤵
  PID:7536
- C:\Windows\System\dRpSnMJ.exe
  C:\Windows\System\dRpSnMJ.exe
  2⤵
  PID:9160
- C:\Windows\System\ndMNOOu.exe
  C:\Windows\System\ndMNOOu.exe
  2⤵
  PID:8096
- C:\Windows\System\GHMpVGP.exe
  C:\Windows\System\GHMpVGP.exe
  2⤵
  PID:6620
- C:\Windows\System\zWqoNDY.exe
  C:\Windows\System\zWqoNDY.exe
  2⤵
  PID:7388
- C:\Windows\System\MZbyiSn.exe
  C:\Windows\System\MZbyiSn.exe
  2⤵
  PID:8092
- C:\Windows\System\zegCvOY.exe
  C:\Windows\System\zegCvOY.exe
  2⤵
  PID:8280
- C:\Windows\System\wHmvEGI.exe
  C:\Windows\System\wHmvEGI.exe
  2⤵
  PID:8284
- C:\Windows\System\yDhRoqX.exe
  C:\Windows\System\yDhRoqX.exe
  2⤵
  PID:8348
- C:\Windows\System\oucoOei.exe
  C:\Windows\System\oucoOei.exe
  2⤵
  PID:8424
- C:\Windows\System\ZgpdIys.exe
  C:\Windows\System\ZgpdIys.exe
  2⤵
  PID:8604
- C:\Windows\System\zwnPFPq.exe
  C:\Windows\System\zwnPFPq.exe
  2⤵
  PID:8648
- C:\Windows\System\BHmTtGJ.exe
  C:\Windows\System\BHmTtGJ.exe
  2⤵
  PID:8620
- C:\Windows\System\GhgLkta.exe
  C:\Windows\System\GhgLkta.exe
  2⤵
  PID:8476
- C:\Windows\System\XYGYDjM.exe
  C:\Windows\System\XYGYDjM.exe
  2⤵
  PID:8744
- C:\Windows\System\ZuqmbfD.exe
  C:\Windows\System\ZuqmbfD.exe
  2⤵
  PID:8760
- C:\Windows\System\DEHmmnX.exe
  C:\Windows\System\DEHmmnX.exe
  2⤵
  PID:8816
- C:\Windows\System\dSYNNon.exe
  C:\Windows\System\dSYNNon.exe
  2⤵
  PID:8828
- C:\Windows\System\vbsdbin.exe
  C:\Windows\System\vbsdbin.exe
  2⤵
  PID:8896
- C:\Windows\System\sBNVgAS.exe
  C:\Windows\System\sBNVgAS.exe
  2⤵
  PID:8984
- C:\Windows\System\SwUaqEo.exe
  C:\Windows\System\SwUaqEo.exe
  2⤵
  PID:9000
- C:\Windows\System\Ghklsgx.exe
  C:\Windows\System\Ghklsgx.exe
  2⤵
  PID:9044
- C:\Windows\System\QLRBAaF.exe
  C:\Windows\System\QLRBAaF.exe
  2⤵
  PID:9144
- C:\Windows\System\dXqTFyx.exe
  C:\Windows\System\dXqTFyx.exe
  2⤵
  PID:9184
- C:\Windows\System\JffQOLy.exe
  C:\Windows\System\JffQOLy.exe
  2⤵
  PID:9116
- C:\Windows\System\aMzSNpX.exe
  C:\Windows\System\aMzSNpX.exe
  2⤵
  PID:8188
- C:\Windows\System\ReCnQlI.exe
  C:\Windows\System\ReCnQlI.exe
  2⤵
  PID:7484
- C:\Windows\System\dEsjCVP.exe
  C:\Windows\System\dEsjCVP.exe
  2⤵
  PID:5384
- C:\Windows\System\ZdiMKAC.exe
  C:\Windows\System\ZdiMKAC.exe
  2⤵
  PID:8928
- C:\Windows\System\OarIVWv.exe
  C:\Windows\System\OarIVWv.exe
  2⤵
  PID:8276
- C:\Windows\System\SwtBjcD.exe
  C:\Windows\System\SwtBjcD.exe
  2⤵
  PID:8504
- C:\Windows\System\tsWYhnD.exe
  C:\Windows\System\tsWYhnD.exe
  2⤵
  PID:8456
- C:\Windows\System\wExPvof.exe
  C:\Windows\System\wExPvof.exe
  2⤵
  PID:8712
- C:\Windows\System\XjHaumC.exe
  C:\Windows\System\XjHaumC.exe
  2⤵
  PID:8844
- C:\Windows\System\pDLyFGZ.exe
  C:\Windows\System\pDLyFGZ.exe
  2⤵
  PID:8924
- C:\Windows\System\zGAqpnV.exe
  C:\Windows\System\zGAqpnV.exe
  2⤵
  PID:1744
- C:\Windows\System\voabcvM.exe
  C:\Windows\System\voabcvM.exe
  2⤵
  PID:8868
- C:\Windows\System\zjAXpPl.exe
  C:\Windows\System\zjAXpPl.exe
  2⤵
  PID:8196
- C:\Windows\System\DdCNpUE.exe
  C:\Windows\System\DdCNpUE.exe
  2⤵
  PID:7972
- C:\Windows\System\NHELFQi.exe
  C:\Windows\System\NHELFQi.exe
  2⤵
  PID:8080
- C:\Windows\System\WyeHhRm.exe
  C:\Windows\System\WyeHhRm.exe
  2⤵
  PID:8588
- C:\Windows\System\nFYxNXU.exe
  C:\Windows\System\nFYxNXU.exe
  2⤵
  PID:8492
- C:\Windows\System\XzAFtfp.exe
  C:\Windows\System\XzAFtfp.exe
  2⤵
  PID:8376
- C:\Windows\System\kioDUce.exe
  C:\Windows\System\kioDUce.exe
  2⤵
  PID:8708
- C:\Windows\System\jBIlfgV.exe
  C:\Windows\System\jBIlfgV.exe
  2⤵
  PID:8812
- C:\Windows\System\gfYoGie.exe
  C:\Windows\System\gfYoGie.exe
  2⤵
  PID:9120
- C:\Windows\System\CEXExFP.exe
  C:\Windows\System\CEXExFP.exe
  2⤵
  PID:9088
- C:\Windows\System\eHxMZON.exe
  C:\Windows\System\eHxMZON.exe
  2⤵
  PID:7028
- C:\Windows\System\YDKKumw.exe
  C:\Windows\System\YDKKumw.exe
  2⤵
  PID:8640
- C:\Windows\System\TwQmicy.exe
  C:\Windows\System\TwQmicy.exe
  2⤵
  PID:8316
- C:\Windows\System\keftoYC.exe
  C:\Windows\System\keftoYC.exe
  2⤵
  PID:8980
- C:\Windows\System\ZVzayiu.exe
  C:\Windows\System\ZVzayiu.exe
  2⤵
  PID:9220
- C:\Windows\System\AXAUhnu.exe
  C:\Windows\System\AXAUhnu.exe
  2⤵
  PID:9236
- C:\Windows\System\dnWUBWA.exe
  C:\Windows\System\dnWUBWA.exe
  2⤵
  PID:9256
- C:\Windows\System\xdHzjUR.exe
  C:\Windows\System\xdHzjUR.exe
  2⤵
  PID:9296
- C:\Windows\System\fqStewO.exe
  C:\Windows\System\fqStewO.exe
  2⤵
  PID:9312
- C:\Windows\System\HMtwUKR.exe
  C:\Windows\System\HMtwUKR.exe
  2⤵
  PID:9332
- C:\Windows\System\uKyrBcJ.exe
  C:\Windows\System\uKyrBcJ.exe
  2⤵
  PID:9352
- C:\Windows\System\wtySxBb.exe
  C:\Windows\System\wtySxBb.exe
  2⤵
  PID:9368
- C:\Windows\System\qJAXnrS.exe
  C:\Windows\System\qJAXnrS.exe
  2⤵
  PID:9384
- C:\Windows\System\JXcogIZ.exe
  C:\Windows\System\JXcogIZ.exe
  2⤵
  PID:9400
- C:\Windows\System\wtcERZM.exe
  C:\Windows\System\wtcERZM.exe
  2⤵
  PID:9416
- C:\Windows\System\jxylwzu.exe
  C:\Windows\System\jxylwzu.exe
  2⤵
  PID:9440
- C:\Windows\System\uJCcFgN.exe
  C:\Windows\System\uJCcFgN.exe
  2⤵
  PID:9456
- C:\Windows\System\ceQuGPH.exe
  C:\Windows\System\ceQuGPH.exe
  2⤵
  PID:9480
- C:\Windows\System\gdYTdLT.exe
  C:\Windows\System\gdYTdLT.exe
  2⤵
  PID:9520
- C:\Windows\System\QapczGI.exe
  C:\Windows\System\QapczGI.exe
  2⤵
  PID:9536
- C:\Windows\System\xDySzBh.exe
  C:\Windows\System\xDySzBh.exe
  2⤵
  PID:9556
- C:\Windows\System\QxGqMOG.exe
  C:\Windows\System\QxGqMOG.exe
  2⤵
  PID:9580
- C:\Windows\System\ywInfkb.exe
  C:\Windows\System\ywInfkb.exe
  2⤵
  PID:9596
- C:\Windows\System\RxTdzJT.exe
  C:\Windows\System\RxTdzJT.exe
  2⤵
  PID:9620
- C:\Windows\System\aaUoTBG.exe
  C:\Windows\System\aaUoTBG.exe
  2⤵
  PID:9636
- C:\Windows\System\YCxrkFf.exe
  C:\Windows\System\YCxrkFf.exe
  2⤵
  PID:9656
- C:\Windows\System\oeiFjvO.exe
  C:\Windows\System\oeiFjvO.exe
  2⤵
  PID:9680
- C:\Windows\System\LuROoEO.exe
  C:\Windows\System\LuROoEO.exe
  2⤵
  PID:9696
- C:\Windows\System\SuRrRUF.exe
  C:\Windows\System\SuRrRUF.exe
  2⤵
  PID:9724
- C:\Windows\System\rgOUERQ.exe
  C:\Windows\System\rgOUERQ.exe
  2⤵
  PID:9744
- C:\Windows\System\Ebozznq.exe
  C:\Windows\System\Ebozznq.exe
  2⤵
  PID:9760
- C:\Windows\System\rgXTwRC.exe
  C:\Windows\System\rgXTwRC.exe
  2⤵
  PID:9776
- C:\Windows\System\ngLjJdh.exe
  C:\Windows\System\ngLjJdh.exe
  2⤵
  PID:9792
- C:\Windows\System\titZJKA.exe
  C:\Windows\System\titZJKA.exe
  2⤵
  PID:9808
- C:\Windows\System\dgPaFIA.exe
  C:\Windows\System\dgPaFIA.exe
  2⤵
  PID:9832
- C:\Windows\System\JUzgSlb.exe
  C:\Windows\System\JUzgSlb.exe
  2⤵
  PID:9864
- C:\Windows\System\hVxssMb.exe
  C:\Windows\System\hVxssMb.exe
  2⤵
  PID:9884
- C:\Windows\System\pwweXYS.exe
  C:\Windows\System\pwweXYS.exe
  2⤵
  PID:9900
- C:\Windows\System\OdhjQWd.exe
  C:\Windows\System\OdhjQWd.exe
  2⤵
  PID:9920
- C:\Windows\System\LcvTmbY.exe
  C:\Windows\System\LcvTmbY.exe
  2⤵
  PID:9940
- C:\Windows\System\AyKhKLP.exe
  C:\Windows\System\AyKhKLP.exe
  2⤵
  PID:9956
- C:\Windows\System\IlLdtQV.exe
  C:\Windows\System\IlLdtQV.exe
  2⤵
  PID:9972
- C:\Windows\System\OOiFICh.exe
  C:\Windows\System\OOiFICh.exe
  2⤵
  PID:9988
- C:\Windows\System\PXbXVGP.exe
  C:\Windows\System\PXbXVGP.exe
  2⤵
  PID:10012
- C:\Windows\System\yClrNwe.exe
  C:\Windows\System\yClrNwe.exe
  2⤵
  PID:10028
- C:\Windows\System\Cxnfshi.exe
  C:\Windows\System\Cxnfshi.exe
  2⤵
  PID:10064
- C:\Windows\System\CcSAinK.exe
  C:\Windows\System\CcSAinK.exe
  2⤵
  PID:10084
- C:\Windows\System\HCcvhCj.exe
  C:\Windows\System\HCcvhCj.exe
  2⤵
  PID:10100
- C:\Windows\System\GTLKReN.exe
  C:\Windows\System\GTLKReN.exe
  2⤵
  PID:10116
- C:\Windows\System\sFrZqhl.exe
  C:\Windows\System\sFrZqhl.exe
  2⤵
  PID:10132
- C:\Windows\System\HLSsail.exe
  C:\Windows\System\HLSsail.exe
  2⤵
  PID:10152
- C:\Windows\System\iaWIkub.exe
  C:\Windows\System\iaWIkub.exe
  2⤵
  PID:10168
- C:\Windows\System\vmVXFPQ.exe
  C:\Windows\System\vmVXFPQ.exe
  2⤵
  PID:10184
- C:\Windows\System\xwMvWhk.exe
  C:\Windows\System\xwMvWhk.exe
  2⤵
  PID:10200
- C:\Windows\System\vDWhVvf.exe
  C:\Windows\System\vDWhVvf.exe
  2⤵
  PID:10220
- C:\Windows\System\GUoJPlk.exe
  C:\Windows\System\GUoJPlk.exe
  2⤵
  PID:9012
- C:\Windows\System\rNSolXM.exe
  C:\Windows\System\rNSolXM.exe
  2⤵
  PID:8920
- C:\Windows\System\Jxexslj.exe
  C:\Windows\System\Jxexslj.exe
  2⤵
  PID:8644
- C:\Windows\System\uXTIvXH.exe
  C:\Windows\System\uXTIvXH.exe
  2⤵
  PID:9276
- C:\Windows\System\bacLhcd.exe
  C:\Windows\System\bacLhcd.exe
  2⤵
  PID:9292
- C:\Windows\System\BtYlINE.exe
  C:\Windows\System\BtYlINE.exe
  2⤵
  PID:9324
- C:\Windows\System\xhABnXY.exe
  C:\Windows\System\xhABnXY.exe
  2⤵
  PID:9344
- C:\Windows\System\WBXXnMS.exe
  C:\Windows\System\WBXXnMS.exe
  2⤵
  PID:9380
- C:\Windows\System\xuHiZHM.exe
  C:\Windows\System\xuHiZHM.exe
  2⤵
  PID:9448
- C:\Windows\System\qmraWbM.exe
  C:\Windows\System\qmraWbM.exe
  2⤵
  PID:9392
- C:\Windows\System\RHiTNcc.exe
  C:\Windows\System\RHiTNcc.exe
  2⤵
  PID:9488
- C:\Windows\System\BDHgxxh.exe
  C:\Windows\System\BDHgxxh.exe
  2⤵
  PID:9504
- C:\Windows\System\vKkgwzi.exe
  C:\Windows\System\vKkgwzi.exe
  2⤵
  PID:8264
- C:\Windows\System\fAcyxEJ.exe
  C:\Windows\System\fAcyxEJ.exe
  2⤵
  PID:9548
- C:\Windows\System\AscWWZL.exe
  C:\Windows\System\AscWWZL.exe
  2⤵
  PID:9572
- C:\Windows\System\wQzAsuy.exe
  C:\Windows\System\wQzAsuy.exe
  2⤵
  PID:9612
- C:\Windows\System\eeYeLCZ.exe
  C:\Windows\System\eeYeLCZ.exe
  2⤵
  PID:9664
- C:\Windows\System\bkKjZyf.exe
  C:\Windows\System\bkKjZyf.exe
  2⤵
  PID:9716
- C:\Windows\System\QKgelwp.exe
  C:\Windows\System\QKgelwp.exe
  2⤵
  PID:9708
- C:\Windows\System\OLTYzAC.exe
  C:\Windows\System\OLTYzAC.exe
  2⤵
  PID:9784
- C:\Windows\System\AUQrpUY.exe
  C:\Windows\System\AUQrpUY.exe
  2⤵
  PID:9804
- C:\Windows\System\qUzVSNU.exe
  C:\Windows\System\qUzVSNU.exe
  2⤵
  PID:9844
- C:\Windows\System\HmMDAoB.exe
  C:\Windows\System\HmMDAoB.exe
  2⤵
  PID:9880
- C:\Windows\System\knpUHXm.exe
  C:\Windows\System\knpUHXm.exe
  2⤵
  PID:9912
- C:\Windows\System\DtXRSRi.exe
  C:\Windows\System\DtXRSRi.exe
  2⤵
  PID:9932
- C:\Windows\System\tpQEhNp.exe
  C:\Windows\System\tpQEhNp.exe
  2⤵
  PID:10024
- C:\Windows\System\oBbnpXM.exe
  C:\Windows\System\oBbnpXM.exe
  2⤵
  PID:9964
- C:\Windows\System\lFsOjgr.exe
  C:\Windows\System\lFsOjgr.exe
  2⤵
  PID:10004
- C:\Windows\System\aoeCfqd.exe
  C:\Windows\System\aoeCfqd.exe
  2⤵
  PID:10044
- C:\Windows\System\ikbvBKR.exe
  C:\Windows\System\ikbvBKR.exe
  2⤵
  PID:10080
- C:\Windows\System\IDMExWp.exe
  C:\Windows\System\IDMExWp.exe
  2⤵
  PID:10148
- C:\Windows\System\IRPzqmM.exe
  C:\Windows\System\IRPzqmM.exe
  2⤵
  PID:10144
- C:\Windows\System\NjVxrPM.exe
  C:\Windows\System\NjVxrPM.exe
  2⤵
  PID:9244
- C:\Windows\System\EPIQZPZ.exe
  C:\Windows\System\EPIQZPZ.exe
  2⤵
  PID:8556
- C:\Windows\System\YdVCAWh.exe
  C:\Windows\System\YdVCAWh.exe
  2⤵
  PID:9196
- C:\Windows\System\mHnihGz.exe
  C:\Windows\System\mHnihGz.exe
  2⤵
  PID:7832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CIBcvQM.exe

Filesize
1.4MB

MD5
bc51d3763d13e34fdd3f0d3586972ef9

SHA1
a6c5e25148627d1d9d2ea072811c20d921a929be

SHA256
766f0b64f79433e7ac4f9f015c8eede16a03c9e82d105508a5011d98ef9bd9c5

SHA512
89fe588df94df04308963a4906ee63b847268b8d4b04f77a07839cca58e4375232c161f6fe50e8b5425791f3fef1df05dc1900f06fdf6a8c920f5193ab69c32f

Download Submit
C:\Windows\system\FdCcswQ.exe

Filesize
1.4MB

MD5
d067ed62457b72bef7bc08f59f56e104

SHA1
2cd7f9b2d12a61bd246538037ccbe5a02040067f

SHA256
71a342f0a858a82cedd7fd63a912f36a8bd3a1e02e1f19b4e82d0eba2109ea69

SHA512
9b84800a28386af48ad833ca177f93c7dfe68be07508aa4311e035e06cd87cd55029ea0007038dbc0bf402f0465270b04bb238b3f9e790ee1140f719a0470e09

Download Submit
C:\Windows\system\GjOAPLk.exe

Filesize
1.4MB

MD5
fcbcb1b1561f3450be9bad5e96fe84bc

SHA1
c4b6c7146dfbb92dec6cd45425b51aab872a62df

SHA256
8f1b0f6f53f784cc7ed0dcb77778853c50fa3b93398bb398cc1f03b57efe98bc

SHA512
2de3193c012e7ca868377a8c6c59d411a40b3c37bdb68511737b91831d60e1238e55b4f09da1c9213ed92f408f3ce4f656e638a3cb07a89652ceb44c699945f0

Download Submit
C:\Windows\system\HQQyicW.exe

Filesize
1.4MB

MD5
4d597a05d7e82d6434bf0ad81da64bda

SHA1
8c02385e04b3b4a87910dc3482494c1274773809

SHA256
198b82c0f42a75a86e4d52b751be1f276d5ed34ac31361db46c79c7dd3607374

SHA512
1065098dd5d47acf25390ae7df27eeb6e5368c51496220db33917bda53ac332b4fa56d4b916e3e4f45b550823a189a25ecad443bae9e6f135f2eceb64b46b2f5

Download Submit
C:\Windows\system\KoPiLYw.exe

Filesize
1.4MB

MD5
a9994747e7863a95892f8eeb2470f359

SHA1
48e84c5aafb98510b3076cc6b8b7de1559e37770

SHA256
ec4d4c6e2e7b54e6602746d613daaaf03f2cad12e268a4cb4ce28e8e2eb91b1a

SHA512
08521d9c6dc0d73519511eb5ea14d660afb7f562a6db4d187ca37d26d02f66c345e7f8d7fdf7a6f541d072afb96ad2c070678dbef7093f6ef300778cdf52c69e

Download Submit
C:\Windows\system\MRbpyLS.exe

Filesize
1.4MB

MD5
f4088b8fccf179d0521c8eb6aa3385b7

SHA1
0749f6dd501f8b74e53ef6e5bbccbc81cd1569bd

SHA256
304de340b174057fbc9e10280885ddfda063d1d82cdda4dd8f54cb45d96c4d78

SHA512
93296ccac4061a18378af24dd10bc2342d284fca44de3c9c741f90b7b5d413e6b279a2f9930a407d4486df06fd3407f5da0244d4142d892df3c17807bd784cf2

Download Submit
C:\Windows\system\MneKCYa.exe

Filesize
1.4MB

MD5
3619b22232905b0713874bf33056d3fe

SHA1
1223f043f1fc219814f0f20c32ad1b2e1f2dc075

SHA256
ef9fda750e17b49e99aebe402e404face17bed5c2e97468381d52b12d80d0691

SHA512
d1ed7662f6bc107bb34772868e8e71a70dfc8c53eaa188581df2a3b942b68747093aa70da6e861f5cb43ad9ca82ea9bf14deff02c0317fcd9a39eca657ed9484

Download Submit
C:\Windows\system\QXlRoqK.exe

Filesize
1.4MB

MD5
be88c945278570254072f8d03bb5beac

SHA1
2ccb9fd6a7093ee794d543a19323af66d714a4f9

SHA256
ce549d2b9de2d728c2d0805beed5f92a07b2aed64098cea4f41c9f1f7bdf92ec

SHA512
875abe2b7b569b796dbd4a6ee4a65e2a8619553b7cf72ccb4050881c33d1d2181fd7c51e5958fe5d5527c27967f602bd8291e774e324e928b7cf6398bd40bcc4

Download Submit
C:\Windows\system\SOUtYsf.exe

Filesize
1.4MB

MD5
62a042af6fb4f1cbc3147a297c399dbb

SHA1
ff8c819f15c3d3af8e6c2c32684409be3ddca319

SHA256
c397d9d3636f16af99f0d25a6138514477b0b928aa8c5ef22486398b8a090ce3

SHA512
efa75d73aa72ab01170c594151f143063788f3f2cfe0e9e33f15b9a75e40d74a69be559b435bc92a4ee7788cf663a967dfe54b45d80899ccf363f534c09746ab

Download Submit
C:\Windows\system\TNQeYEE.exe

Filesize
1.4MB

MD5
728e9fc80955a8476075731a7cad3336

SHA1
f40e3ae23babfbd6a12daef400c79bcef76663ab

SHA256
fc3d451f1d022958eea4da0bbb484e46e1231b707b7f3dc7bd603754496dbee2

SHA512
3d4440ebcf08a815001e4e4a995a18deb68d59a6a2b538e1f42dd5e9b98ea3d685efd70045c7a9ffe75d66a3dfd5b156178d084ef2db22aad6ba34af008929d3

Download Submit
C:\Windows\system\TTpqsQu.exe

Filesize
1.4MB

MD5
1274152642b15b466888e47eefa69f03

SHA1
874ee94eb65820ef7000667c40d1dd5705ab99b0

SHA256
22794e8d0460b9165b83fddc629e7166237b8e78f06c2b41ee3dc35d49fb665d

SHA512
602a2512609b0f89cc26b3f1043279ba15dae0e5255c51bc6807a6a32343d9a56e8c098f927664cf62be1c9854157c3f1d7ca3753a7f2cf03f712bd38f043159

Download Submit
C:\Windows\system\UIxJvWR.exe

Filesize
1.4MB

MD5
28c2a92f40c7afc229803628fdd8a8f0

SHA1
74282e502d6e41d6a0041f4239aa36c47b571934

SHA256
480ed7527efad9d8470869c76d142ad91ae428ebb5086c2270593a0c39b6460e

SHA512
9c1e4e6de71db4d2b0810bb414c3f2d047cd8ba7b6970be6f99be6baf93fd3a8750f70a6fbc905303ffe673371024ad4a8e0996cff2f7f6beb38a2375055ad99

Download Submit
C:\Windows\system\XwDWXxz.exe

Filesize
1.4MB

MD5
ae6e11dd4d2fa0442d6d4d21141e3c3a

SHA1
4bc7eb20b27c5b2012aa9998e04544a5f4c18940

SHA256
72fa9315ae952e023b8b1bcd4c97fb7fe099becbe7709a3aed3280fa6ae29889

SHA512
ec472946cdd7bcf84e621ddefb48c3e4385e0228df04e9f1e16e14ec0b94517ae0ebaee4c9aff094440320c74e68ce7ad0aa45195a58c2286e989f1a0ec627a4

Download Submit
C:\Windows\system\apODHFQ.exe

Filesize
1.4MB

MD5
482e4fd08680662897277d86c25f2a6d

SHA1
79cd34a05bdcdb943b234654cadc2bf6f00fd845

SHA256
1fa81f5f3071349c6ab829e99bee3b68c57354bc5bd2730df7ba22a9fb16b445

SHA512
830922ffe61967940bf06fe82c9876f1d56545cd10711a42e4c748469c3e9d18d278eb504d0e549f26f8e78f619d8db2cdb5d7c7e4e2a25c9bb44ecf0da34416

Download Submit
C:\Windows\system\bZPflGH.exe

Filesize
1.4MB

MD5
e53d88e917ba6bbb5476c5505cae6d6c

SHA1
90b5da22620ffdcbe5b0945011afb74a11e6bc8b

SHA256
7717fa121e493dfaf7c7cc4cfecac7870ae7b8141881b7e38b546e8ee82252d1

SHA512
19248ace4dc23ad41513a1faa2a26676dfd2911b89ba1f5363c8b0316b0ad5805c9cf7f13285b376f2f4eef57b3eacbf2d8bbf76cec73245232d65c0f910e321

Download Submit
C:\Windows\system\efjcQfY.exe

Filesize
1.4MB

MD5
8b27c60768181d3b0c4230f14c7c3c4d

SHA1
ef4f3bc5e3226906bd4758f9a8a80095e86929fd

SHA256
ddea3df070652bad237f819ab5a40e07f7807ed75e4950589a02407e466e0ec0

SHA512
0173b5a15900c42bab1329f33f325cdaf017b1257521b157ab1fd76c8974930330d853fc6f599bc62dcebadc604af05aa13e3556425a74c8aa453863af118384

Download Submit
C:\Windows\system\gelYitg.exe

Filesize
1.4MB

MD5
c16e902c858a985060a643a763f37920

SHA1
fbf91045aadcede303e08edcb2d3c18f201b0847

SHA256
38042b3741aecf69ccaa3a7824a2b71cdcb7140de1d2f19e571dfe73fcd9b161

SHA512
b3bb1735834673848536432cf4e0e2f4d13dae9b3d29977cc62442787867c17bacc4833b8002bc9feb13a6a36925f4ce244335c115bebddd604496aa42531c88

Download Submit
C:\Windows\system\iVzWfqh.exe

Filesize
1.4MB

MD5
14468d0959feafec1f11b9093264587c

SHA1
2d59208f117aca3f879bcc124c13046c56091b75

SHA256
f1c75ae140a64ab4cd1e2492076fa5bb8cf16c9cad02ffd2747c6f5b70a3e660

SHA512
16853410e1ec31193e78752d1a2d580ef122fca2e9501795d6d59cf624a52438f95c0b2224fa78ea61ef80e5d0464f055cf733dc8a4f01416436091f1568dc00

Download Submit
C:\Windows\system\kKClHoT.exe

Filesize
1.4MB

MD5
b4221a3ff51510743c972128c5e39100

SHA1
35b3382456fdd16669094976c44f20d5cdc3010a

SHA256
e5862704b8da276fa9ed461b14294721f14cff84319316cb2a69697164d9aa6f

SHA512
73d6cb52aa914516fe519a0c88be005b30ffac130118ad0ec3db3e2fb1c96f44d5e3f3afcf7e93d60839ccf4583751a1779efc56536cbd38df0c08730e52b78a

Download Submit
C:\Windows\system\kOajSRy.exe

Filesize
1.4MB

MD5
e43c253acb9d9b6781a9e5b5b5625348

SHA1
1c0f08c3319f3afaf031cf46598a0e68f4e1d602

SHA256
02ce8976a69de81e6165693389a6f147be48064545e6792b6644a174634107ae

SHA512
2c0e19fc5df4cd6f86e27480481daf63747c05db9e3c756d3514863cb72437ec172f9a4e99df5a3fe94c88586bcf9480ef63961f2abfada7ee75831a7522d1e0

Download Submit
C:\Windows\system\nHsxGfO.exe

Filesize
1.4MB

MD5
4be1a31ffda5be01afc4a3f800c8f957

SHA1
366b19e188d802e0888c245b532443b8b4f00227

SHA256
85e7cc0898c12d137b5b58f8a52593eaecd2f3ae96c4ec20c673e5aab8b98a03

SHA512
18bb6861425873573675bd133387d1d654d0c6361e87bc4f100815c0d384cf2b6aa3065f3424c6e96166090c437768ea3226bf53c6201a46ec7ce50f0ce13c52

Download Submit
C:\Windows\system\njVnCdk.exe

Filesize
1.4MB

MD5
d616d312c41172222ace98f93395cf08

SHA1
509240a9c316952b9d5d54ac5e15a8d0bd73011c

SHA256
6598962f3bc11a9ed7780e93ad5c30946f080a99efdcde6c8c36a2a2c0efbddb

SHA512
ebdf039813109894756c2bcceaa6ff1762fc5c3178a69b7dd6e3d3bf323a13a3d280636b48a4a1e2961dd383e57c33a5513a6e13c232ba7aa57f44f44f179c3b

Download Submit
C:\Windows\system\rkxQFgb.exe

Filesize
1.4MB

MD5
fa0ad01f37c5b18339a97fd26797aba3

SHA1
322120078d066e1cf5fdde72e3d9ee2d88c1a0bc

SHA256
03dc7350d0d43719deae06508c0180be628839f37a0da7191811171398ee758b

SHA512
992b4aaf8af47275606d8b7f9b4eaba2bc50dd6f9c1544630bce0a8fe95b2fc9b9b8c3f5c3c7c194958993a92109bb54ba39a59ce2ab5d1093c1e5b7c2d82e1e

Download Submit
C:\Windows\system\vOAIpbm.exe

Filesize
1.4MB

MD5
bf65020bb78b308dc8a20aa862e2ccec

SHA1
014b67b10a05b196cf933def0e8078c4b802ba55

SHA256
f69811bb066d43fa56349bf139d905c2ece8665aa9de85c9a9a75397f5e4014d

SHA512
1225a425169c4e0d0ba54e8ff6bd945fb10cab21a799e49787c3dd9d40b2250ddd558f2ae4a6f12b877c2c04f9e36c612a28311b0555a9af3ac624afccde1261

Download Submit
C:\Windows\system\xKNRZHP.exe

Filesize
1.4MB

MD5
f65d8f92455b501b7bc039235187e346

SHA1
a550d60476cec686125fdb0bdca1a3d82e8b26f2

SHA256
b377a03d38715de0797ee141ce7fc634e2d24704b59640e26eeac18f48e772a1

SHA512
2d8dafc6c9ee47783c1969463e65d00a68db08e4c51f0212bc5ba0da445123cb0e8e2d7f46b04228fd66c5af96cbbefe980186703e9cc3ccaa16b6aed5a9c002

Download Submit
C:\Windows\system\zelPQwA.exe

Filesize
1.4MB

MD5
e2c346f5781c76fff1ac158414512373

SHA1
2eff27abfbf2e3cea35ab9d5fcae4773e572a899

SHA256
87eac4c9ba41537f5e9713bd8e29f4f0814f88737462b93587bcb46103574818

SHA512
bd246c72afe1f674cb0c56633a835764f72b898f87a8cba984ba57130f0cbedeed23dd44c2c41289abf626a95ded2180de3961e4f0217bfeaec7d19ca40b4bdf

Download Submit
\Windows\system\HYoOPHQ.exe

Filesize
1.4MB

MD5
154e546e377774ec2473360549957297

SHA1
ecb0930da27d3dd85c505e87c747ce05b940076d

SHA256
33434305edbd3472b2dd9798a25cb1e7ed240c79912b936da254f1d1e918622d

SHA512
47f04d2ec8d4ae428a134989906fae69f4360ef3c4493a0ab762a109c89dbc6703c01245b2fd00fc7b6a61407c0cdaf05f5f846d6f8276bf1b5d6ee934221733

Download Submit
\Windows\system\IEzPdIT.exe

Filesize
1.4MB

MD5
029c51449eaf34e139d68e641ff1965d

SHA1
3c8479fd22579ff4ea114bceabdb7ca80ba7bcb7

SHA256
b1245cbfef5861d62447e980475c36a5cd33fd32b57eac9c98a3089e422a392b

SHA512
c196da04e1981ec921f302722ac062400a6721ebc805d71063cd6305b983eda951c460690fd235863642da87a65a4ece90cf3af356c3e356adf0320dfff1eeea

Download Submit
\Windows\system\OIoddph.exe

Filesize
1.4MB

MD5
7b2184fd6239341ebc9362a9797676ae

SHA1
fd9c8cf05798eb8f40a563f44b48d66e49cede57

SHA256
125ebf35c60a72cf9f28b1e305de7e6171c0e29dbfa7119f59e6b3601c868af6

SHA512
cbb4b5f4c7f3bd208ab613558ad8eddab4c79c3512ab9ffb906edbd05762ab53b2aec2e07d020bc3bdaa09f04800fcdc6a571de41f971cfe318724f7f2eab030

Download Submit
\Windows\system\PJqRkNJ.exe

Filesize
1.4MB

MD5
96729cbdc8216a4dd19e422a957b6cc0

SHA1
81b4bba6b58f2e64c70448abf6463e76ac395c9c

SHA256
eae7e7be0d046168f948559fd9a5a2f1d05175fa04230f36b613d050d4bd4301

SHA512
142afc973e82e9867b41f2dfcdd69c56203df93944a898eb710badf8d166d291ea3fb5ee619e35e638f57a69932b8079f78036a9379ba5a0fc014a61e91d3cd0

Download Submit
\Windows\system\ZDaCgua.exe

Filesize
1.4MB

MD5
073ac7acc00ab3517534efc00d0efc25

SHA1
5c1fe340950a41ef9af8c10015c20b80f8636d10

SHA256
bb6e7cd58db8359ff63eb2a3e334fca905ad36fec1ff86550f56737ec9136257

SHA512
2ab73c1aabf270fc2f158dd50cfd5fb8dc5c23ee6a7922448a9d2d61696e2b2e9a0e6ae626f95762b1691440ac945970751f84e216382550ed229dc1063af2fc

Download Submit
\Windows\system\vOTkTkD.exe

Filesize
1.4MB

MD5
1f6af4dfd7e8173a54f814668e98c0ad

SHA1
7edf943e0d303aecf447a720f317bdcdd9889b21

SHA256
889c2487c1aafa1c62278bc95957fdf71dcf5c8c02cc8e16a0457b2b20e520ae

SHA512
c3d129aced3078aa1134193ca3126f5180d427c36f398c25d5dc8f5a158106bf84a55e9fcafa2ef988de449f1775ab80d1f1f926f94e529713ec14a1ecdd5086

Download Submit
memory/1436-97-0x000000013F690000-0x000000013F9E4000-memory.dmp

Filesize
3.3MB

Download
memory/1436-4023-0x000000013F690000-0x000000013F9E4000-memory.dmp

Filesize
3.3MB

Download
memory/1916-4015-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/1916-49-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/2180-79-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-3918-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2180-3264-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-0-0x000000013FA00000-0x000000013FD54000-memory.dmp

Filesize
3.3MB

Download
memory/2180-124-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2180-117-0x000000013F310000-0x000000013F664000-memory.dmp

Filesize
3.3MB

Download
memory/2180-76-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-121-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2180-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2180-122-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-123-0x000000013F690000-0x000000013F9E4000-memory.dmp

Filesize
3.3MB

Download
memory/2180-3904-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-3937-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-3252-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-3901-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2180-48-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-47-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-39-0x000000013F3E0000-0x000000013F734000-memory.dmp

Filesize
3.3MB

Download
memory/2180-3557-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-131-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-135-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-98-0x000000013FEE0000-0x0000000140234000-memory.dmp

Filesize
3.3MB

Download
memory/2180-3251-0x000000013FA00000-0x000000013FD54000-memory.dmp

Filesize
3.3MB

Download
memory/2180-15-0x0000000001F20000-0x0000000002274000-memory.dmp

Filesize
3.3MB

Download
memory/2180-106-0x000000013F610000-0x000000013F964000-memory.dmp

Filesize
3.3MB

Download
memory/2276-113-0x000000013F3E0000-0x000000013F734000-memory.dmp

Filesize
3.3MB

Download
memory/2276-4014-0x000000013F3E0000-0x000000013F734000-memory.dmp

Filesize
3.3MB

Download
memory/2368-4011-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2368-25-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2464-4020-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2464-88-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2480-127-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2480-4022-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2516-130-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2516-4021-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2588-63-0x000000013F310000-0x000000013F664000-memory.dmp

Filesize
3.3MB

Download
memory/2588-4018-0x000000013F310000-0x000000013F664000-memory.dmp

Filesize
3.3MB

Download
memory/2596-4016-0x000000013F610000-0x000000013F964000-memory.dmp

Filesize
3.3MB

Download
memory/2596-57-0x000000013F610000-0x000000013F964000-memory.dmp

Filesize
3.3MB

Download
memory/2620-81-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2620-4019-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2660-4013-0x000000013F820000-0x000000013FB74000-memory.dmp

Filesize
3.3MB

Download
memory/2660-50-0x000000013F820000-0x000000013FB74000-memory.dmp

Filesize
3.3MB

Download
memory/2712-4017-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2712-68-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2912-4012-0x000000013FEE0000-0x0000000140234000-memory.dmp

Filesize
3.3MB

Download
memory/2912-35-0x000000013FEE0000-0x0000000140234000-memory.dmp

Filesize
3.3MB

Download