xmrig | f3592b50c5c3a660e955a76f5280c622623d6d85ba9ad7fbb10802682fdee2e2

Analysis

max time kernel
146s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
Size

1.6MB
MD5

d1e1f965a8e3d1ae05599f8557f1c860
SHA1

d247e0beca1275b7ba609851d402aa4c42068f11
SHA256

f3592b50c5c3a660e955a76f5280c622623d6d85ba9ad7fbb10802682fdee2e2
SHA512

f9504780014373375e69809a485504e34acbf2cfd6b55fc01ff8a6ca4253a1c542efcfcb8cf6385cb3a6875808fc022dd01cae610bdba9fc152a2c1311639451
SSDEEP

49152:ROdWCCi7/raU56uL3pgrCEd2EiTx6TvA15:RWWBib356utgC

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/2596-67-0x000000013FCC0000-0x0000000140011000-memory.dmp	xmrig
behavioral1/memory/2656-68-0x000000013FBD0000-0x000000013FF21000-memory.dmp	xmrig
behavioral1/memory/2800-66-0x000000013F3E0000-0x000000013F731000-memory.dmp	xmrig
behavioral1/memory/2624-65-0x000000013F3E0000-0x000000013F731000-memory.dmp	xmrig
behavioral1/memory/3056-64-0x000000013F6F0000-0x000000013FA41000-memory.dmp	xmrig
behavioral1/memory/2684-86-0x000000013F750000-0x000000013FAA1000-memory.dmp	xmrig
behavioral1/memory/2864-93-0x000000013F030000-0x000000013F381000-memory.dmp	xmrig
behavioral1/memory/2812-50-0x000000013FE90000-0x00000001401E1000-memory.dmp	xmrig
behavioral1/memory/2556-49-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/3008-47-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/2864-24-0x000000013F030000-0x000000013F381000-memory.dmp	xmrig
behavioral1/memory/2176-1573-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/2720-1878-0x000000013F1C0000-0x000000013F511000-memory.dmp	xmrig
behavioral1/memory/2732-2154-0x000000013FAF0000-0x000000013FE41000-memory.dmp	xmrig
behavioral1/memory/2856-2342-0x000000013FA80000-0x000000013FDD1000-memory.dmp	xmrig
behavioral1/memory/2624-3515-0x000000013F3E0000-0x000000013F731000-memory.dmp	xmrig
behavioral1/memory/3008-3535-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/3056-3534-0x000000013F6F0000-0x000000013FA41000-memory.dmp	xmrig
behavioral1/memory/2972-3537-0x000000013FB60000-0x000000013FEB1000-memory.dmp	xmrig
behavioral1/memory/2656-3540-0x000000013FBD0000-0x000000013FF21000-memory.dmp	xmrig
behavioral1/memory/2800-3543-0x000000013F3E0000-0x000000013F731000-memory.dmp	xmrig
behavioral1/memory/2596-3539-0x000000013FCC0000-0x0000000140011000-memory.dmp	xmrig
behavioral1/memory/2556-3536-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/2812-3545-0x000000013FE90000-0x00000001401E1000-memory.dmp	xmrig
behavioral1/memory/2720-3602-0x000000013F1C0000-0x000000013F511000-memory.dmp	xmrig
behavioral1/memory/2856-3605-0x000000013FA80000-0x000000013FDD1000-memory.dmp	xmrig
behavioral1/memory/2732-3577-0x000000013FAF0000-0x000000013FE41000-memory.dmp	xmrig
behavioral1/memory/2864-3563-0x000000013F030000-0x000000013F381000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2864	TxQBXoG.exe
3008	KEbBjkT.exe
2556	oIHmJpG.exe
2812	xSsjqpp.exe
2972	bmDvjBg.exe
3056	zORDGKZ.exe
2624	xfFjrZW.exe
2800	avYHymb.exe
2596	ZgtiWqx.exe
2656	SpHWtTW.exe
2176	cupkVJq.exe
2720	NWWzJSH.exe
2732	CxGQZvS.exe
2856	OLykjNC.exe
2156	LTpeGwa.exe
2024	qDfaxXO.exe
2388	PNVBGhc.exe
2040	vsnTUFB.exe
1636	qBdKtuU.exe
384	ltwajpa.exe
580	Sajuxpn.exe
1092	FsbfrBA.exe
2472	nbSFlXa.exe
1112	eLfqqvc.exe
1664	SfhBeRc.exe
1668	CnBgbUA.exe
2124	tkXiEzm.exe
2508	FdSBCmA.exe
1272	HQKXFyr.exe
2300	RlYNcyx.exe
2828	eERYUzD.exe
2100	YkjrmPp.exe
2928	ltgMoCG.exe
1012	JnsBPYL.exe
1468	QrbznfS.exe
1780	kjphJwG.exe
2060	kwsFlHN.exe
684	BIzffmh.exe
1740	odeDoJX.exe
1656	ltyMCFV.exe
2108	FPKkPlW.exe
1288	HlinfSF.exe
1812	rbIIosC.exe
1620	pwhZhfu.exe
1232	IWqMsbW.exe
912	QxNSgqh.exe
3012	VxJjCrm.exe
2192	sBBkEbT.exe
2088	yzAhblI.exe
2112	Ysciqsg.exe
1868	EUqdceo.exe
1176	pkVfhzP.exe
2256	ypZpAes.exe
872	ZicgZxi.exe
1948	iwzXOLT.exe
1252	MzRMrGa.exe
1584	mdgPLww.exe
1592	TCugiCl.exe
2380	cDjSSwO.exe
1564	LyRnqAL.exe
2056	YpZAKXb.exe
1876	SpIJKuW.exe
2572	tIAiwJi.exe
2424	GMmecOn.exe

Loads dropped DLL 64 IoCs

pid	Process
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2684-0-0x000000013F750000-0x000000013FAA1000-memory.dmp	upx
behavioral1/files/0x000b000000014230-3.dat	upx
behavioral1/files/0x0008000000016d0d-25.dat	upx
behavioral1/files/0x0007000000016c6b-17.dat	upx
behavioral1/files/0x0007000000016c63-52.dat	upx
behavioral1/files/0x0006000000017456-55.dat	upx
behavioral1/memory/2596-67-0x000000013FCC0000-0x0000000140011000-memory.dmp	upx
behavioral1/memory/2656-68-0x000000013FBD0000-0x000000013FF21000-memory.dmp	upx
behavioral1/memory/2800-66-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/memory/2624-65-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/memory/3056-64-0x000000013F6F0000-0x000000013FA41000-memory.dmp	upx
behavioral1/memory/2972-63-0x000000013FB60000-0x000000013FEB1000-memory.dmp	upx
behavioral1/files/0x00320000000164b2-90.dat	upx
behavioral1/files/0x0006000000017556-98.dat	upx
behavioral1/files/0x000500000001866b-109.dat	upx
behavioral1/files/0x000500000001922e-169.dat	upx
behavioral1/files/0x0005000000019241-179.dat	upx
behavioral1/files/0x000500000001924a-184.dat	upx
behavioral1/files/0x000500000001923d-174.dat	upx
behavioral1/files/0x0005000000019215-164.dat	upx
behavioral1/files/0x00050000000191ed-159.dat	upx
behavioral1/files/0x00050000000191cd-154.dat	upx
behavioral1/files/0x00050000000191a7-149.dat	upx
behavioral1/files/0x00060000000190b6-144.dat	upx
behavioral1/files/0x0006000000019021-139.dat	upx
behavioral1/files/0x0006000000018c1a-129.dat	upx
behavioral1/files/0x0006000000018f3a-133.dat	upx
behavioral1/files/0x0006000000018c0a-124.dat	upx
behavioral1/files/0x0005000000018778-119.dat	upx
behavioral1/files/0x000500000001866d-114.dat	upx
behavioral1/files/0x000900000001864e-103.dat	upx
behavioral1/memory/2732-87-0x000000013FAF0000-0x000000013FE41000-memory.dmp	upx
behavioral1/memory/2684-86-0x000000013F750000-0x000000013FAA1000-memory.dmp	upx
behavioral1/files/0x000600000001749c-85.dat	upx
behavioral1/memory/2856-94-0x000000013FA80000-0x000000013FDD1000-memory.dmp	upx
behavioral1/memory/2864-93-0x000000013F030000-0x000000013F381000-memory.dmp	upx
behavioral1/memory/2176-72-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/memory/2720-79-0x000000013F1C0000-0x000000013F511000-memory.dmp	upx
behavioral1/files/0x000600000001747d-77.dat	upx
behavioral1/files/0x000600000001745e-71.dat	upx
behavioral1/files/0x00060000000173e0-56.dat	upx
behavioral1/files/0x00070000000173d8-54.dat	upx
behavioral1/files/0x0007000000016cb7-53.dat	upx
behavioral1/files/0x003200000001630b-51.dat	upx
behavioral1/memory/2812-50-0x000000013FE90000-0x00000001401E1000-memory.dmp	upx
behavioral1/memory/2556-49-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/memory/3008-47-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/files/0x0008000000016a9a-40.dat	upx
behavioral1/memory/2864-24-0x000000013F030000-0x000000013F381000-memory.dmp	upx
behavioral1/memory/2176-1573-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/memory/2720-1878-0x000000013F1C0000-0x000000013F511000-memory.dmp	upx
behavioral1/memory/2732-2154-0x000000013FAF0000-0x000000013FE41000-memory.dmp	upx
behavioral1/memory/2856-2342-0x000000013FA80000-0x000000013FDD1000-memory.dmp	upx
behavioral1/memory/2624-3515-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/memory/3008-3535-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/memory/3056-3534-0x000000013F6F0000-0x000000013FA41000-memory.dmp	upx
behavioral1/memory/2972-3537-0x000000013FB60000-0x000000013FEB1000-memory.dmp	upx
behavioral1/memory/2656-3540-0x000000013FBD0000-0x000000013FF21000-memory.dmp	upx
behavioral1/memory/2800-3543-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/memory/2596-3539-0x000000013FCC0000-0x0000000140011000-memory.dmp	upx
behavioral1/memory/2556-3536-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/memory/2812-3545-0x000000013FE90000-0x00000001401E1000-memory.dmp	upx
behavioral1/memory/2720-3602-0x000000013F1C0000-0x000000013F511000-memory.dmp	upx
behavioral1/memory/2856-3605-0x000000013FA80000-0x000000013FDD1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vmNiOlm.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\bVnkpfj.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\pZdXtnH.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\zxbvKHq.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\DlshHtt.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\fLRSbYh.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\ExPAjWz.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\iteGDAj.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\RTXJJeJ.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\anyTVAW.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\dhNrAfy.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\sjAXSyu.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\MwdwBbN.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\eBNxsvF.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\wCqTAXA.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\XrywQOa.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\AmovbZV.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\UPLCxvV.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\sbfuERC.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\tfPMbKV.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\eGNUsSi.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\ubbytkq.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\mQFELkp.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\XKhWRWK.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\PsTdMpI.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\ymvMyCk.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\UXrgPzV.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\QxuihER.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\ElNvhaU.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\Rqsgnpk.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\eYBHXNM.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\PhPGjdb.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\UWsjySF.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\sIdYwWE.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\VPwFuzk.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\GOCPTEK.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\ttoNoNd.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\QkjCnlj.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\iZYKxkt.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\IaBGeHX.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\gFbJiHY.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\EYxEBoi.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\yLbVUHU.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\vsnTUFB.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\QzAnwEm.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\uWODxda.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\uzyOgSP.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\Prwhtsw.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\YaEcNrF.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\SliiUuk.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\gQEVIaO.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\KWIPdgN.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\QIeSHfx.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\BSdLdPr.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\uAYCkTj.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\YzIUBZQ.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\eZBijNw.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\GOJOjts.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\VByMLxJ.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\TYQhpLL.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\pxzAAoG.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\xMnIBHg.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\JiBfHzi.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
File created	C:\Windows\System\cmBrEtZ.exe	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2864	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	29
PID 2684 wrote to memory of 2864	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	29
PID 2684 wrote to memory of 2864	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	29
PID 2684 wrote to memory of 2972	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	30
PID 2684 wrote to memory of 2972	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	30
PID 2684 wrote to memory of 2972	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	30
PID 2684 wrote to memory of 3008	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	31
PID 2684 wrote to memory of 3008	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	31
PID 2684 wrote to memory of 3008	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	31
PID 2684 wrote to memory of 3056	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	32
PID 2684 wrote to memory of 3056	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	32
PID 2684 wrote to memory of 3056	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	32
PID 2684 wrote to memory of 2556	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	33
PID 2684 wrote to memory of 2556	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	33
PID 2684 wrote to memory of 2556	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	33
PID 2684 wrote to memory of 2624	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	34
PID 2684 wrote to memory of 2624	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	34
PID 2684 wrote to memory of 2624	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	34
PID 2684 wrote to memory of 2812	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	35
PID 2684 wrote to memory of 2812	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	35
PID 2684 wrote to memory of 2812	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	35
PID 2684 wrote to memory of 2800	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	36
PID 2684 wrote to memory of 2800	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	36
PID 2684 wrote to memory of 2800	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	36
PID 2684 wrote to memory of 2656	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	37
PID 2684 wrote to memory of 2656	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	37
PID 2684 wrote to memory of 2656	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	37
PID 2684 wrote to memory of 2596	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	38
PID 2684 wrote to memory of 2596	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	38
PID 2684 wrote to memory of 2596	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	38
PID 2684 wrote to memory of 2176	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	39
PID 2684 wrote to memory of 2176	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	39
PID 2684 wrote to memory of 2176	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	39
PID 2684 wrote to memory of 2720	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	40
PID 2684 wrote to memory of 2720	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	40
PID 2684 wrote to memory of 2720	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	40
PID 2684 wrote to memory of 2732	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	41
PID 2684 wrote to memory of 2732	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	41
PID 2684 wrote to memory of 2732	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	41
PID 2684 wrote to memory of 2856	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	42
PID 2684 wrote to memory of 2856	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	42
PID 2684 wrote to memory of 2856	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	42
PID 2684 wrote to memory of 2156	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	43
PID 2684 wrote to memory of 2156	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	43
PID 2684 wrote to memory of 2156	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	43
PID 2684 wrote to memory of 2024	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	44
PID 2684 wrote to memory of 2024	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	44
PID 2684 wrote to memory of 2024	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	44
PID 2684 wrote to memory of 2388	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	45
PID 2684 wrote to memory of 2388	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	45
PID 2684 wrote to memory of 2388	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	45
PID 2684 wrote to memory of 2040	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	46
PID 2684 wrote to memory of 2040	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	46
PID 2684 wrote to memory of 2040	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	46
PID 2684 wrote to memory of 1636	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	47
PID 2684 wrote to memory of 1636	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	47
PID 2684 wrote to memory of 1636	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	47
PID 2684 wrote to memory of 384	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	48
PID 2684 wrote to memory of 384	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	48
PID 2684 wrote to memory of 384	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	48
PID 2684 wrote to memory of 580	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	49
PID 2684 wrote to memory of 580	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	49
PID 2684 wrote to memory of 580	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	49
PID 2684 wrote to memory of 1092	2684	d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d1e1f965a8e3d1ae05599f8557f1c860_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System\TxQBXoG.exe
  C:\Windows\System\TxQBXoG.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\bmDvjBg.exe
  C:\Windows\System\bmDvjBg.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\KEbBjkT.exe
  C:\Windows\System\KEbBjkT.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\zORDGKZ.exe
  C:\Windows\System\zORDGKZ.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\oIHmJpG.exe
  C:\Windows\System\oIHmJpG.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\xfFjrZW.exe
  C:\Windows\System\xfFjrZW.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\xSsjqpp.exe
  C:\Windows\System\xSsjqpp.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\avYHymb.exe
  C:\Windows\System\avYHymb.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\SpHWtTW.exe
  C:\Windows\System\SpHWtTW.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ZgtiWqx.exe
  C:\Windows\System\ZgtiWqx.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\cupkVJq.exe
  C:\Windows\System\cupkVJq.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\NWWzJSH.exe
  C:\Windows\System\NWWzJSH.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\CxGQZvS.exe
  C:\Windows\System\CxGQZvS.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\OLykjNC.exe
  C:\Windows\System\OLykjNC.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\LTpeGwa.exe
  C:\Windows\System\LTpeGwa.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\qDfaxXO.exe
  C:\Windows\System\qDfaxXO.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\PNVBGhc.exe
  C:\Windows\System\PNVBGhc.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\vsnTUFB.exe
  C:\Windows\System\vsnTUFB.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\qBdKtuU.exe
  C:\Windows\System\qBdKtuU.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\ltwajpa.exe
  C:\Windows\System\ltwajpa.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\Sajuxpn.exe
  C:\Windows\System\Sajuxpn.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\FsbfrBA.exe
  C:\Windows\System\FsbfrBA.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\nbSFlXa.exe
  C:\Windows\System\nbSFlXa.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\eLfqqvc.exe
  C:\Windows\System\eLfqqvc.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\SfhBeRc.exe
  C:\Windows\System\SfhBeRc.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\CnBgbUA.exe
  C:\Windows\System\CnBgbUA.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\tkXiEzm.exe
  C:\Windows\System\tkXiEzm.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\FdSBCmA.exe
  C:\Windows\System\FdSBCmA.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\HQKXFyr.exe
  C:\Windows\System\HQKXFyr.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\RlYNcyx.exe
  C:\Windows\System\RlYNcyx.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\eERYUzD.exe
  C:\Windows\System\eERYUzD.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\YkjrmPp.exe
  C:\Windows\System\YkjrmPp.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\ltgMoCG.exe
  C:\Windows\System\ltgMoCG.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\JnsBPYL.exe
  C:\Windows\System\JnsBPYL.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\QrbznfS.exe
  C:\Windows\System\QrbznfS.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\kjphJwG.exe
  C:\Windows\System\kjphJwG.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\kwsFlHN.exe
  C:\Windows\System\kwsFlHN.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\BIzffmh.exe
  C:\Windows\System\BIzffmh.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\odeDoJX.exe
  C:\Windows\System\odeDoJX.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\ltyMCFV.exe
  C:\Windows\System\ltyMCFV.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\FPKkPlW.exe
  C:\Windows\System\FPKkPlW.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\HlinfSF.exe
  C:\Windows\System\HlinfSF.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\rbIIosC.exe
  C:\Windows\System\rbIIosC.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\pwhZhfu.exe
  C:\Windows\System\pwhZhfu.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\IWqMsbW.exe
  C:\Windows\System\IWqMsbW.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\QxNSgqh.exe
  C:\Windows\System\QxNSgqh.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\VxJjCrm.exe
  C:\Windows\System\VxJjCrm.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\sBBkEbT.exe
  C:\Windows\System\sBBkEbT.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\yzAhblI.exe
  C:\Windows\System\yzAhblI.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\Ysciqsg.exe
  C:\Windows\System\Ysciqsg.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\EUqdceo.exe
  C:\Windows\System\EUqdceo.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\pkVfhzP.exe
  C:\Windows\System\pkVfhzP.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\ypZpAes.exe
  C:\Windows\System\ypZpAes.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\ZicgZxi.exe
  C:\Windows\System\ZicgZxi.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\iwzXOLT.exe
  C:\Windows\System\iwzXOLT.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\MzRMrGa.exe
  C:\Windows\System\MzRMrGa.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\mdgPLww.exe
  C:\Windows\System\mdgPLww.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\TCugiCl.exe
  C:\Windows\System\TCugiCl.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\cDjSSwO.exe
  C:\Windows\System\cDjSSwO.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\LyRnqAL.exe
  C:\Windows\System\LyRnqAL.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\YpZAKXb.exe
  C:\Windows\System\YpZAKXb.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\SpIJKuW.exe
  C:\Windows\System\SpIJKuW.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\tIAiwJi.exe
  C:\Windows\System\tIAiwJi.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\GMmecOn.exe
  C:\Windows\System\GMmecOn.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\qCcYhqs.exe
  C:\Windows\System\qCcYhqs.exe
  2⤵
  PID:2664
- C:\Windows\System\KzZmLNP.exe
  C:\Windows\System\KzZmLNP.exe
  2⤵
  PID:2680
- C:\Windows\System\ZYwTUXl.exe
  C:\Windows\System\ZYwTUXl.exe
  2⤵
  PID:2896
- C:\Windows\System\ZHGrawD.exe
  C:\Windows\System\ZHGrawD.exe
  2⤵
  PID:312
- C:\Windows\System\RmopDdA.exe
  C:\Windows\System\RmopDdA.exe
  2⤵
  PID:1648
- C:\Windows\System\jZlrKlf.exe
  C:\Windows\System\jZlrKlf.exe
  2⤵
  PID:324
- C:\Windows\System\UPLCxvV.exe
  C:\Windows\System\UPLCxvV.exe
  2⤵
  PID:488
- C:\Windows\System\IvPHPbv.exe
  C:\Windows\System\IvPHPbv.exe
  2⤵
  PID:1872
- C:\Windows\System\LeenwOM.exe
  C:\Windows\System\LeenwOM.exe
  2⤵
  PID:1472
- C:\Windows\System\ZCXvdMn.exe
  C:\Windows\System\ZCXvdMn.exe
  2⤵
  PID:2944
- C:\Windows\System\ZCqvKKq.exe
  C:\Windows\System\ZCqvKKq.exe
  2⤵
  PID:2104
- C:\Windows\System\HsXmPux.exe
  C:\Windows\System\HsXmPux.exe
  2⤵
  PID:1972
- C:\Windows\System\RnHzbwv.exe
  C:\Windows\System\RnHzbwv.exe
  2⤵
  PID:2292
- C:\Windows\System\pcQZaip.exe
  C:\Windows\System\pcQZaip.exe
  2⤵
  PID:2236
- C:\Windows\System\XuKNAWM.exe
  C:\Windows\System\XuKNAWM.exe
  2⤵
  PID:412
- C:\Windows\System\dyJmMgG.exe
  C:\Windows\System\dyJmMgG.exe
  2⤵
  PID:2312
- C:\Windows\System\uGylFFH.exe
  C:\Windows\System\uGylFFH.exe
  2⤵
  PID:2968
- C:\Windows\System\qMTutfi.exe
  C:\Windows\System\qMTutfi.exe
  2⤵
  PID:1672
- C:\Windows\System\YKOZslP.exe
  C:\Windows\System\YKOZslP.exe
  2⤵
  PID:1912
- C:\Windows\System\NNMSVpf.exe
  C:\Windows\System\NNMSVpf.exe
  2⤵
  PID:1600
- C:\Windows\System\OTAzPGO.exe
  C:\Windows\System\OTAzPGO.exe
  2⤵
  PID:1956
- C:\Windows\System\DrEkVle.exe
  C:\Windows\System\DrEkVle.exe
  2⤵
  PID:1924
- C:\Windows\System\cycheyB.exe
  C:\Windows\System\cycheyB.exe
  2⤵
  PID:1704
- C:\Windows\System\turuvFS.exe
  C:\Windows\System\turuvFS.exe
  2⤵
  PID:2080
- C:\Windows\System\EWfJqcQ.exe
  C:\Windows\System\EWfJqcQ.exe
  2⤵
  PID:852
- C:\Windows\System\zuGZwtm.exe
  C:\Windows\System\zuGZwtm.exe
  2⤵
  PID:2268
- C:\Windows\System\DVEGvzA.exe
  C:\Windows\System\DVEGvzA.exe
  2⤵
  PID:2168
- C:\Windows\System\UIVJeql.exe
  C:\Windows\System\UIVJeql.exe
  2⤵
  PID:1160
- C:\Windows\System\mWQNEGO.exe
  C:\Windows\System\mWQNEGO.exe
  2⤵
  PID:2348
- C:\Windows\System\tMowvLf.exe
  C:\Windows\System\tMowvLf.exe
  2⤵
  PID:2848
- C:\Windows\System\iEigbMC.exe
  C:\Windows\System\iEigbMC.exe
  2⤵
  PID:2552
- C:\Windows\System\OhdhhpN.exe
  C:\Windows\System\OhdhhpN.exe
  2⤵
  PID:2640
- C:\Windows\System\lmsYJEZ.exe
  C:\Windows\System\lmsYJEZ.exe
  2⤵
  PID:2416
- C:\Windows\System\HhbeGqM.exe
  C:\Windows\System\HhbeGqM.exe
  2⤵
  PID:2408
- C:\Windows\System\ZTpXPMK.exe
  C:\Windows\System\ZTpXPMK.exe
  2⤵
  PID:2760
- C:\Windows\System\oIuGjgw.exe
  C:\Windows\System\oIuGjgw.exe
  2⤵
  PID:1808
- C:\Windows\System\ZZPvNrm.exe
  C:\Windows\System\ZZPvNrm.exe
  2⤵
  PID:804
- C:\Windows\System\wOrzkzv.exe
  C:\Windows\System\wOrzkzv.exe
  2⤵
  PID:1756
- C:\Windows\System\HYHgAeq.exe
  C:\Windows\System\HYHgAeq.exe
  2⤵
  PID:1612
- C:\Windows\System\dZVGWrX.exe
  C:\Windows\System\dZVGWrX.exe
  2⤵
  PID:2948
- C:\Windows\System\pqcEaTe.exe
  C:\Windows\System\pqcEaTe.exe
  2⤵
  PID:1708
- C:\Windows\System\MjrLkVY.exe
  C:\Windows\System\MjrLkVY.exe
  2⤵
  PID:1968
- C:\Windows\System\lGcHjVm.exe
  C:\Windows\System\lGcHjVm.exe
  2⤵
  PID:1040
- C:\Windows\System\rjhCgqj.exe
  C:\Windows\System\rjhCgqj.exe
  2⤵
  PID:2936
- C:\Windows\System\QtQBWnF.exe
  C:\Windows\System\QtQBWnF.exe
  2⤵
  PID:1108
- C:\Windows\System\qUhtLFv.exe
  C:\Windows\System\qUhtLFv.exe
  2⤵
  PID:932
- C:\Windows\System\eZBijNw.exe
  C:\Windows\System\eZBijNw.exe
  2⤵
  PID:952
- C:\Windows\System\jfRbZbm.exe
  C:\Windows\System\jfRbZbm.exe
  2⤵
  PID:1144
- C:\Windows\System\youmYTt.exe
  C:\Windows\System\youmYTt.exe
  2⤵
  PID:1536
- C:\Windows\System\SpNDRYf.exe
  C:\Windows\System\SpNDRYf.exe
  2⤵
  PID:1332
- C:\Windows\System\ERXSend.exe
  C:\Windows\System\ERXSend.exe
  2⤵
  PID:2568
- C:\Windows\System\egRDGEV.exe
  C:\Windows\System\egRDGEV.exe
  2⤵
  PID:1964
- C:\Windows\System\asxKDgC.exe
  C:\Windows\System\asxKDgC.exe
  2⤵
  PID:2672
- C:\Windows\System\cJFWOSN.exe
  C:\Windows\System\cJFWOSN.exe
  2⤵
  PID:2700
- C:\Windows\System\BRaOzpI.exe
  C:\Windows\System\BRaOzpI.exe
  2⤵
  PID:3096
- C:\Windows\System\VrliUSm.exe
  C:\Windows\System\VrliUSm.exe
  2⤵
  PID:3112
- C:\Windows\System\LeQdTij.exe
  C:\Windows\System\LeQdTij.exe
  2⤵
  PID:3140
- C:\Windows\System\ZIVBAYz.exe
  C:\Windows\System\ZIVBAYz.exe
  2⤵
  PID:3160
- C:\Windows\System\HjCpigt.exe
  C:\Windows\System\HjCpigt.exe
  2⤵
  PID:3184
- C:\Windows\System\xXzSCUr.exe
  C:\Windows\System\xXzSCUr.exe
  2⤵
  PID:3204
- C:\Windows\System\JfUMEll.exe
  C:\Windows\System\JfUMEll.exe
  2⤵
  PID:3224
- C:\Windows\System\CXKPGiz.exe
  C:\Windows\System\CXKPGiz.exe
  2⤵
  PID:3244
- C:\Windows\System\aVVHNnq.exe
  C:\Windows\System\aVVHNnq.exe
  2⤵
  PID:3264
- C:\Windows\System\YsTTUgT.exe
  C:\Windows\System\YsTTUgT.exe
  2⤵
  PID:3280
- C:\Windows\System\PeJccpE.exe
  C:\Windows\System\PeJccpE.exe
  2⤵
  PID:3300
- C:\Windows\System\rCSwVsi.exe
  C:\Windows\System\rCSwVsi.exe
  2⤵
  PID:3324
- C:\Windows\System\tRKVzeM.exe
  C:\Windows\System\tRKVzeM.exe
  2⤵
  PID:3344
- C:\Windows\System\hZGRblW.exe
  C:\Windows\System\hZGRblW.exe
  2⤵
  PID:3360
- C:\Windows\System\LCWmRCx.exe
  C:\Windows\System\LCWmRCx.exe
  2⤵
  PID:3384
- C:\Windows\System\ELAXVbS.exe
  C:\Windows\System\ELAXVbS.exe
  2⤵
  PID:3404
- C:\Windows\System\fJOpdfT.exe
  C:\Windows\System\fJOpdfT.exe
  2⤵
  PID:3424
- C:\Windows\System\spDqfHe.exe
  C:\Windows\System\spDqfHe.exe
  2⤵
  PID:3444
- C:\Windows\System\XzqSoTv.exe
  C:\Windows\System\XzqSoTv.exe
  2⤵
  PID:3464
- C:\Windows\System\KvTDHbe.exe
  C:\Windows\System\KvTDHbe.exe
  2⤵
  PID:3480
- C:\Windows\System\LAWluHi.exe
  C:\Windows\System\LAWluHi.exe
  2⤵
  PID:3504
- C:\Windows\System\YxZhWzR.exe
  C:\Windows\System\YxZhWzR.exe
  2⤵
  PID:3520
- C:\Windows\System\PXxBYWY.exe
  C:\Windows\System\PXxBYWY.exe
  2⤵
  PID:3544
- C:\Windows\System\TdWTpJf.exe
  C:\Windows\System\TdWTpJf.exe
  2⤵
  PID:3560
- C:\Windows\System\KCGFzWL.exe
  C:\Windows\System\KCGFzWL.exe
  2⤵
  PID:3580
- C:\Windows\System\ZToACBc.exe
  C:\Windows\System\ZToACBc.exe
  2⤵
  PID:3600
- C:\Windows\System\XovOERI.exe
  C:\Windows\System\XovOERI.exe
  2⤵
  PID:3620
- C:\Windows\System\TDZwMob.exe
  C:\Windows\System\TDZwMob.exe
  2⤵
  PID:3640
- C:\Windows\System\FpvAmkZ.exe
  C:\Windows\System\FpvAmkZ.exe
  2⤵
  PID:3664
- C:\Windows\System\bKEiczR.exe
  C:\Windows\System\bKEiczR.exe
  2⤵
  PID:3684
- C:\Windows\System\TlvQgcn.exe
  C:\Windows\System\TlvQgcn.exe
  2⤵
  PID:3704
- C:\Windows\System\zSQGBLe.exe
  C:\Windows\System\zSQGBLe.exe
  2⤵
  PID:3720
- C:\Windows\System\DpZrbHV.exe
  C:\Windows\System\DpZrbHV.exe
  2⤵
  PID:3744
- C:\Windows\System\QrgdHIn.exe
  C:\Windows\System\QrgdHIn.exe
  2⤵
  PID:3760
- C:\Windows\System\gBoljiJ.exe
  C:\Windows\System\gBoljiJ.exe
  2⤵
  PID:3784
- C:\Windows\System\VrkqPOT.exe
  C:\Windows\System\VrkqPOT.exe
  2⤵
  PID:3800
- C:\Windows\System\PsKhhDz.exe
  C:\Windows\System\PsKhhDz.exe
  2⤵
  PID:3820
- C:\Windows\System\JUVDOBf.exe
  C:\Windows\System\JUVDOBf.exe
  2⤵
  PID:3840
- C:\Windows\System\hOffaqm.exe
  C:\Windows\System\hOffaqm.exe
  2⤵
  PID:3860
- C:\Windows\System\kUohjjH.exe
  C:\Windows\System\kUohjjH.exe
  2⤵
  PID:3880
- C:\Windows\System\xNQGeov.exe
  C:\Windows\System\xNQGeov.exe
  2⤵
  PID:3900
- C:\Windows\System\AQkPLrx.exe
  C:\Windows\System\AQkPLrx.exe
  2⤵
  PID:3916
- C:\Windows\System\DbAgmhq.exe
  C:\Windows\System\DbAgmhq.exe
  2⤵
  PID:3932
- C:\Windows\System\tRNegQo.exe
  C:\Windows\System\tRNegQo.exe
  2⤵
  PID:3956
- C:\Windows\System\LlEpyZy.exe
  C:\Windows\System\LlEpyZy.exe
  2⤵
  PID:3976
- C:\Windows\System\OmGIjVc.exe
  C:\Windows\System\OmGIjVc.exe
  2⤵
  PID:3992
- C:\Windows\System\HlwwPML.exe
  C:\Windows\System\HlwwPML.exe
  2⤵
  PID:4012
- C:\Windows\System\qkuwJGK.exe
  C:\Windows\System\qkuwJGK.exe
  2⤵
  PID:4036
- C:\Windows\System\dAUakFz.exe
  C:\Windows\System\dAUakFz.exe
  2⤵
  PID:4056
- C:\Windows\System\nUODlew.exe
  C:\Windows\System\nUODlew.exe
  2⤵
  PID:4072
- C:\Windows\System\chphWbE.exe
  C:\Windows\System\chphWbE.exe
  2⤵
  PID:1692
- C:\Windows\System\JiBfHzi.exe
  C:\Windows\System\JiBfHzi.exe
  2⤵
  PID:876
- C:\Windows\System\TAfpASR.exe
  C:\Windows\System\TAfpASR.exe
  2⤵
  PID:2592
- C:\Windows\System\HCosfLa.exe
  C:\Windows\System\HCosfLa.exe
  2⤵
  PID:2008
- C:\Windows\System\CWrQyTM.exe
  C:\Windows\System\CWrQyTM.exe
  2⤵
  PID:2244
- C:\Windows\System\ckUSSvv.exe
  C:\Windows\System\ckUSSvv.exe
  2⤵
  PID:2564
- C:\Windows\System\zQlyAWg.exe
  C:\Windows\System\zQlyAWg.exe
  2⤵
  PID:2148
- C:\Windows\System\bTjJdst.exe
  C:\Windows\System\bTjJdst.exe
  2⤵
  PID:1936
- C:\Windows\System\MiPoVvf.exe
  C:\Windows\System\MiPoVvf.exe
  2⤵
  PID:2136
- C:\Windows\System\xZPaowJ.exe
  C:\Windows\System\xZPaowJ.exe
  2⤵
  PID:2600
- C:\Windows\System\UFWrUEl.exe
  C:\Windows\System\UFWrUEl.exe
  2⤵
  PID:2132
- C:\Windows\System\VFssMfc.exe
  C:\Windows\System\VFssMfc.exe
  2⤵
  PID:2440
- C:\Windows\System\fijyOpb.exe
  C:\Windows\System\fijyOpb.exe
  2⤵
  PID:3084
- C:\Windows\System\CoxwkQu.exe
  C:\Windows\System\CoxwkQu.exe
  2⤵
  PID:1716
- C:\Windows\System\MGIKAcY.exe
  C:\Windows\System\MGIKAcY.exe
  2⤵
  PID:1512
- C:\Windows\System\DOUqTfZ.exe
  C:\Windows\System\DOUqTfZ.exe
  2⤵
  PID:3172
- C:\Windows\System\DjDIxrj.exe
  C:\Windows\System\DjDIxrj.exe
  2⤵
  PID:3152
- C:\Windows\System\wEStVdQ.exe
  C:\Windows\System\wEStVdQ.exe
  2⤵
  PID:3220
- C:\Windows\System\WIrUlEj.exe
  C:\Windows\System\WIrUlEj.exe
  2⤵
  PID:3260
- C:\Windows\System\uNsyrBU.exe
  C:\Windows\System\uNsyrBU.exe
  2⤵
  PID:3292
- C:\Windows\System\egZndOV.exe
  C:\Windows\System\egZndOV.exe
  2⤵
  PID:3272
- C:\Windows\System\wAwqmJu.exe
  C:\Windows\System\wAwqmJu.exe
  2⤵
  PID:3340
- C:\Windows\System\aNacSfE.exe
  C:\Windows\System\aNacSfE.exe
  2⤵
  PID:3312
- C:\Windows\System\XKZwgKX.exe
  C:\Windows\System\XKZwgKX.exe
  2⤵
  PID:3376
- C:\Windows\System\rXkpIXF.exe
  C:\Windows\System\rXkpIXF.exe
  2⤵
  PID:2524
- C:\Windows\System\zzYSDUU.exe
  C:\Windows\System\zzYSDUU.exe
  2⤵
  PID:3400
- C:\Windows\System\lUyVdhO.exe
  C:\Windows\System\lUyVdhO.exe
  2⤵
  PID:3456
- C:\Windows\System\snqzFQX.exe
  C:\Windows\System\snqzFQX.exe
  2⤵
  PID:3436
- C:\Windows\System\dwWvYmZ.exe
  C:\Windows\System\dwWvYmZ.exe
  2⤵
  PID:3472
- C:\Windows\System\bJjpRET.exe
  C:\Windows\System\bJjpRET.exe
  2⤵
  PID:3536
- C:\Windows\System\oKZWaZf.exe
  C:\Windows\System\oKZWaZf.exe
  2⤵
  PID:3572
- C:\Windows\System\AFYNFwm.exe
  C:\Windows\System\AFYNFwm.exe
  2⤵
  PID:3512
- C:\Windows\System\ishxteg.exe
  C:\Windows\System\ishxteg.exe
  2⤵
  PID:3596
- C:\Windows\System\YhNmLVs.exe
  C:\Windows\System\YhNmLVs.exe
  2⤵
  PID:3632
- C:\Windows\System\iJDaMMR.exe
  C:\Windows\System\iJDaMMR.exe
  2⤵
  PID:3636
- C:\Windows\System\THeyOHj.exe
  C:\Windows\System\THeyOHj.exe
  2⤵
  PID:3732
- C:\Windows\System\ntdiQsR.exe
  C:\Windows\System\ntdiQsR.exe
  2⤵
  PID:3680
- C:\Windows\System\sbfuERC.exe
  C:\Windows\System\sbfuERC.exe
  2⤵
  PID:3808
- C:\Windows\System\IduOrPo.exe
  C:\Windows\System\IduOrPo.exe
  2⤵
  PID:3852
- C:\Windows\System\tmYyTOr.exe
  C:\Windows\System\tmYyTOr.exe
  2⤵
  PID:3892
- C:\Windows\System\KGEUcOf.exe
  C:\Windows\System\KGEUcOf.exe
  2⤵
  PID:3928
- C:\Windows\System\UEQZKyv.exe
  C:\Windows\System\UEQZKyv.exe
  2⤵
  PID:4000
- C:\Windows\System\EeHWXTv.exe
  C:\Windows\System\EeHWXTv.exe
  2⤵
  PID:3828
- C:\Windows\System\wGHAkkd.exe
  C:\Windows\System\wGHAkkd.exe
  2⤵
  PID:3876
- C:\Windows\System\UqjLghZ.exe
  C:\Windows\System\UqjLghZ.exe
  2⤵
  PID:4004
- C:\Windows\System\WBQhkzY.exe
  C:\Windows\System\WBQhkzY.exe
  2⤵
  PID:4024
- C:\Windows\System\soZWxKH.exe
  C:\Windows\System\soZWxKH.exe
  2⤵
  PID:4092
- C:\Windows\System\ITobezs.exe
  C:\Windows\System\ITobezs.exe
  2⤵
  PID:4064
- C:\Windows\System\vsNDFqw.exe
  C:\Windows\System\vsNDFqw.exe
  2⤵
  PID:3984
- C:\Windows\System\AuwiVYo.exe
  C:\Windows\System\AuwiVYo.exe
  2⤵
  PID:1856
- C:\Windows\System\GtVHtzB.exe
  C:\Windows\System\GtVHtzB.exe
  2⤵
  PID:544
- C:\Windows\System\NLomrFP.exe
  C:\Windows\System\NLomrFP.exe
  2⤵
  PID:1152
- C:\Windows\System\gLkIuyM.exe
  C:\Windows\System\gLkIuyM.exe
  2⤵
  PID:2668
- C:\Windows\System\VnfuwwA.exe
  C:\Windows\System\VnfuwwA.exe
  2⤵
  PID:3004
- C:\Windows\System\yhMEdxl.exe
  C:\Windows\System\yhMEdxl.exe
  2⤵
  PID:3080
- C:\Windows\System\QelfvRI.exe
  C:\Windows\System\QelfvRI.exe
  2⤵
  PID:2032
- C:\Windows\System\lkUyoww.exe
  C:\Windows\System\lkUyoww.exe
  2⤵
  PID:1524
- C:\Windows\System\cDTVpGU.exe
  C:\Windows\System\cDTVpGU.exe
  2⤵
  PID:1628
- C:\Windows\System\WuxLfVu.exe
  C:\Windows\System\WuxLfVu.exe
  2⤵
  PID:1960
- C:\Windows\System\iIunaZa.exe
  C:\Windows\System\iIunaZa.exe
  2⤵
  PID:1532
- C:\Windows\System\VeTkMpn.exe
  C:\Windows\System\VeTkMpn.exe
  2⤵
  PID:1596
- C:\Windows\System\KmdzXkY.exe
  C:\Windows\System\KmdzXkY.exe
  2⤵
  PID:3156
- C:\Windows\System\Fvldtrl.exe
  C:\Windows\System\Fvldtrl.exe
  2⤵
  PID:3092
- C:\Windows\System\tBhnnxS.exe
  C:\Windows\System\tBhnnxS.exe
  2⤵
  PID:2208
- C:\Windows\System\GACrfNk.exe
  C:\Windows\System\GACrfNk.exe
  2⤵
  PID:2604
- C:\Windows\System\vUKFQur.exe
  C:\Windows\System\vUKFQur.exe
  2⤵
  PID:2780
- C:\Windows\System\qvaOcLc.exe
  C:\Windows\System\qvaOcLc.exe
  2⤵
  PID:2940
- C:\Windows\System\RyTvbmr.exe
  C:\Windows\System\RyTvbmr.exe
  2⤵
  PID:3392
- C:\Windows\System\nKHjZbn.exe
  C:\Windows\System\nKHjZbn.exe
  2⤵
  PID:3440
- C:\Windows\System\AvPcCrB.exe
  C:\Windows\System\AvPcCrB.exe
  2⤵
  PID:2932
- C:\Windows\System\ukdMCVu.exe
  C:\Windows\System\ukdMCVu.exe
  2⤵
  PID:2876
- C:\Windows\System\PhPGjdb.exe
  C:\Windows\System\PhPGjdb.exe
  2⤵
  PID:3568
- C:\Windows\System\xATOPte.exe
  C:\Windows\System\xATOPte.exe
  2⤵
  PID:3648
- C:\Windows\System\YzQttLH.exe
  C:\Windows\System\YzQttLH.exe
  2⤵
  PID:3672
- C:\Windows\System\dHKKPZI.exe
  C:\Windows\System\dHKKPZI.exe
  2⤵
  PID:3752
- C:\Windows\System\wCPjuNd.exe
  C:\Windows\System\wCPjuNd.exe
  2⤵
  PID:3908
- C:\Windows\System\ZGqRrbZ.exe
  C:\Windows\System\ZGqRrbZ.exe
  2⤵
  PID:4088
- C:\Windows\System\ybJESBF.exe
  C:\Windows\System\ybJESBF.exe
  2⤵
  PID:892
- C:\Windows\System\JYTTSKA.exe
  C:\Windows\System\JYTTSKA.exe
  2⤵
  PID:3180
- C:\Windows\System\FiIuhYk.exe
  C:\Windows\System\FiIuhYk.exe
  2⤵
  PID:3872
- C:\Windows\System\hkyFXCh.exe
  C:\Windows\System\hkyFXCh.exe
  2⤵
  PID:4028
- C:\Windows\System\HaRdojw.exe
  C:\Windows\System\HaRdojw.exe
  2⤵
  PID:1804
- C:\Windows\System\rhhiqcR.exe
  C:\Windows\System\rhhiqcR.exe
  2⤵
  PID:1368
- C:\Windows\System\FeovctH.exe
  C:\Windows\System\FeovctH.exe
  2⤵
  PID:3200
- C:\Windows\System\gzfBFgu.exe
  C:\Windows\System\gzfBFgu.exe
  2⤵
  PID:3240
- C:\Windows\System\AxNinpO.exe
  C:\Windows\System\AxNinpO.exe
  2⤵
  PID:2296
- C:\Windows\System\tmPnYpH.exe
  C:\Windows\System\tmPnYpH.exe
  2⤵
  PID:3416
- C:\Windows\System\PzJwRIa.exe
  C:\Windows\System\PzJwRIa.exe
  2⤵
  PID:2912
- C:\Windows\System\tsEPwjw.exe
  C:\Windows\System\tsEPwjw.exe
  2⤵
  PID:3124
- C:\Windows\System\VaDuuka.exe
  C:\Windows\System\VaDuuka.exe
  2⤵
  PID:2952
- C:\Windows\System\eygMVfj.exe
  C:\Windows\System\eygMVfj.exe
  2⤵
  PID:3356
- C:\Windows\System\SJuzvNJ.exe
  C:\Windows\System\SJuzvNJ.exe
  2⤵
  PID:2756
- C:\Windows\System\vNALHnF.exe
  C:\Windows\System\vNALHnF.exe
  2⤵
  PID:3712
- C:\Windows\System\ZXOktmB.exe
  C:\Windows\System\ZXOktmB.exe
  2⤵
  PID:2748
- C:\Windows\System\szzHjyA.exe
  C:\Windows\System\szzHjyA.exe
  2⤵
  PID:3320
- C:\Windows\System\MDkOOhE.exe
  C:\Windows\System\MDkOOhE.exe
  2⤵
  PID:556
- C:\Windows\System\nFspGIu.exe
  C:\Windows\System\nFspGIu.exe
  2⤵
  PID:3052
- C:\Windows\System\yaYYuUV.exe
  C:\Windows\System\yaYYuUV.exe
  2⤵
  PID:2324
- C:\Windows\System\NAdbSCw.exe
  C:\Windows\System\NAdbSCw.exe
  2⤵
  PID:2072
- C:\Windows\System\JImLrBK.exe
  C:\Windows\System\JImLrBK.exe
  2⤵
  PID:1744
- C:\Windows\System\TRaSyaW.exe
  C:\Windows\System\TRaSyaW.exe
  2⤵
  PID:2584
- C:\Windows\System\nQsnkMa.exe
  C:\Windows\System\nQsnkMa.exe
  2⤵
  PID:760
- C:\Windows\System\ERFATjH.exe
  C:\Windows\System\ERFATjH.exe
  2⤵
  PID:2456
- C:\Windows\System\aLrOXDx.exe
  C:\Windows\System\aLrOXDx.exe
  2⤵
  PID:3696
- C:\Windows\System\UkovcBM.exe
  C:\Windows\System\UkovcBM.exe
  2⤵
  PID:3972
- C:\Windows\System\NqBNWEe.exe
  C:\Windows\System\NqBNWEe.exe
  2⤵
  PID:3552
- C:\Windows\System\vBorWuV.exe
  C:\Windows\System\vBorWuV.exe
  2⤵
  PID:3944
- C:\Windows\System\AHCTwaz.exe
  C:\Windows\System\AHCTwaz.exe
  2⤵
  PID:3968
- C:\Windows\System\ilpCqXi.exe
  C:\Windows\System\ilpCqXi.exe
  2⤵
  PID:2372
- C:\Windows\System\LMAhZlI.exe
  C:\Windows\System\LMAhZlI.exe
  2⤵
  PID:1208
- C:\Windows\System\tgtaYfj.exe
  C:\Windows\System\tgtaYfj.exe
  2⤵
  PID:3196
- C:\Windows\System\JoYUcid.exe
  C:\Windows\System\JoYUcid.exe
  2⤵
  PID:3940
- C:\Windows\System\pAKyjLR.exe
  C:\Windows\System\pAKyjLR.exe
  2⤵
  PID:292
- C:\Windows\System\nQBZVCs.exe
  C:\Windows\System\nQBZVCs.exe
  2⤵
  PID:3168
- C:\Windows\System\ToGIgHX.exe
  C:\Windows\System\ToGIgHX.exe
  2⤵
  PID:2476
- C:\Windows\System\cXCmlAx.exe
  C:\Windows\System\cXCmlAx.exe
  2⤵
  PID:3796
- C:\Windows\System\JDjPhaK.exe
  C:\Windows\System\JDjPhaK.exe
  2⤵
  PID:3380
- C:\Windows\System\NTOlhkr.exe
  C:\Windows\System\NTOlhkr.exe
  2⤵
  PID:2644
- C:\Windows\System\CKJbmAp.exe
  C:\Windows\System\CKJbmAp.exe
  2⤵
  PID:2560
- C:\Windows\System\IqATGbb.exe
  C:\Windows\System\IqATGbb.exe
  2⤵
  PID:4048
- C:\Windows\System\QZjknFU.exe
  C:\Windows\System\QZjknFU.exe
  2⤵
  PID:3740
- C:\Windows\System\IIUjIoQ.exe
  C:\Windows\System\IIUjIoQ.exe
  2⤵
  PID:1660
- C:\Windows\System\pJgEnHl.exe
  C:\Windows\System\pJgEnHl.exe
  2⤵
  PID:2728
- C:\Windows\System\dWiLvwd.exe
  C:\Windows\System\dWiLvwd.exe
  2⤵
  PID:2460
- C:\Windows\System\QZHkkav.exe
  C:\Windows\System\QZHkkav.exe
  2⤵
  PID:2704
- C:\Windows\System\BwEyyvy.exe
  C:\Windows\System\BwEyyvy.exe
  2⤵
  PID:3496
- C:\Windows\System\grRxDKy.exe
  C:\Windows\System\grRxDKy.exe
  2⤵
  PID:3700
- C:\Windows\System\osdCnMO.exe
  C:\Windows\System\osdCnMO.exe
  2⤵
  PID:1508
- C:\Windows\System\ncKSQel.exe
  C:\Windows\System\ncKSQel.exe
  2⤵
  PID:2744
- C:\Windows\System\tkIvAAx.exe
  C:\Windows\System\tkIvAAx.exe
  2⤵
  PID:3952
- C:\Windows\System\eVYeCsr.exe
  C:\Windows\System\eVYeCsr.exe
  2⤵
  PID:2444
- C:\Windows\System\vmlrorZ.exe
  C:\Windows\System\vmlrorZ.exe
  2⤵
  PID:1860
- C:\Windows\System\CDKIObV.exe
  C:\Windows\System\CDKIObV.exe
  2⤵
  PID:1632
- C:\Windows\System\yTebDds.exe
  C:\Windows\System\yTebDds.exe
  2⤵
  PID:2228
- C:\Windows\System\TMsSRaC.exe
  C:\Windows\System\TMsSRaC.exe
  2⤵
  PID:4008
- C:\Windows\System\cdAGDvh.exe
  C:\Windows\System\cdAGDvh.exe
  2⤵
  PID:3452
- C:\Windows\System\Aqbyamv.exe
  C:\Windows\System\Aqbyamv.exe
  2⤵
  PID:3768
- C:\Windows\System\ozpTNbt.exe
  C:\Windows\System\ozpTNbt.exe
  2⤵
  PID:4108
- C:\Windows\System\ekcdCCc.exe
  C:\Windows\System\ekcdCCc.exe
  2⤵
  PID:4124
- C:\Windows\System\sjCCQAk.exe
  C:\Windows\System\sjCCQAk.exe
  2⤵
  PID:4140
- C:\Windows\System\TYWjytZ.exe
  C:\Windows\System\TYWjytZ.exe
  2⤵
  PID:4156
- C:\Windows\System\hvNdpsd.exe
  C:\Windows\System\hvNdpsd.exe
  2⤵
  PID:4172
- C:\Windows\System\QtRGhGj.exe
  C:\Windows\System\QtRGhGj.exe
  2⤵
  PID:4188
- C:\Windows\System\kVRxyJD.exe
  C:\Windows\System\kVRxyJD.exe
  2⤵
  PID:4204
- C:\Windows\System\aGkaJzx.exe
  C:\Windows\System\aGkaJzx.exe
  2⤵
  PID:4220
- C:\Windows\System\uPRnWVA.exe
  C:\Windows\System\uPRnWVA.exe
  2⤵
  PID:4236
- C:\Windows\System\HXZCGci.exe
  C:\Windows\System\HXZCGci.exe
  2⤵
  PID:4252
- C:\Windows\System\jwJSWuk.exe
  C:\Windows\System\jwJSWuk.exe
  2⤵
  PID:4268
- C:\Windows\System\qUCfLji.exe
  C:\Windows\System\qUCfLji.exe
  2⤵
  PID:4288
- C:\Windows\System\ErGvpkn.exe
  C:\Windows\System\ErGvpkn.exe
  2⤵
  PID:4304
- C:\Windows\System\SDfbLGs.exe
  C:\Windows\System\SDfbLGs.exe
  2⤵
  PID:4324
- C:\Windows\System\veaLiiB.exe
  C:\Windows\System\veaLiiB.exe
  2⤵
  PID:4340
- C:\Windows\System\mhnOhtZ.exe
  C:\Windows\System\mhnOhtZ.exe
  2⤵
  PID:4356
- C:\Windows\System\TglKVMb.exe
  C:\Windows\System\TglKVMb.exe
  2⤵
  PID:4372
- C:\Windows\System\MaYzYjV.exe
  C:\Windows\System\MaYzYjV.exe
  2⤵
  PID:4388
- C:\Windows\System\PLCQiQN.exe
  C:\Windows\System\PLCQiQN.exe
  2⤵
  PID:4404
- C:\Windows\System\DTTawYV.exe
  C:\Windows\System\DTTawYV.exe
  2⤵
  PID:4420
- C:\Windows\System\BuBAmPI.exe
  C:\Windows\System\BuBAmPI.exe
  2⤵
  PID:4436
- C:\Windows\System\udFSZcD.exe
  C:\Windows\System\udFSZcD.exe
  2⤵
  PID:4452
- C:\Windows\System\xnJjxWf.exe
  C:\Windows\System\xnJjxWf.exe
  2⤵
  PID:4472
- C:\Windows\System\GvCrfbq.exe
  C:\Windows\System\GvCrfbq.exe
  2⤵
  PID:4488
- C:\Windows\System\NNZCErW.exe
  C:\Windows\System\NNZCErW.exe
  2⤵
  PID:4504
- C:\Windows\System\ZwWChjO.exe
  C:\Windows\System\ZwWChjO.exe
  2⤵
  PID:4524
- C:\Windows\System\qWbasGb.exe
  C:\Windows\System\qWbasGb.exe
  2⤵
  PID:4540
- C:\Windows\System\kcNBTky.exe
  C:\Windows\System\kcNBTky.exe
  2⤵
  PID:4560
- C:\Windows\System\hiJctKo.exe
  C:\Windows\System\hiJctKo.exe
  2⤵
  PID:4576
- C:\Windows\System\bVFDwlz.exe
  C:\Windows\System\bVFDwlz.exe
  2⤵
  PID:4596
- C:\Windows\System\XyaWtkn.exe
  C:\Windows\System\XyaWtkn.exe
  2⤵
  PID:4612
- C:\Windows\System\BOYMZXy.exe
  C:\Windows\System\BOYMZXy.exe
  2⤵
  PID:4628
- C:\Windows\System\jjstSqe.exe
  C:\Windows\System\jjstSqe.exe
  2⤵
  PID:4648
- C:\Windows\System\HazsIte.exe
  C:\Windows\System\HazsIte.exe
  2⤵
  PID:4664
- C:\Windows\System\mwEAhPL.exe
  C:\Windows\System\mwEAhPL.exe
  2⤵
  PID:4680
- C:\Windows\System\saRsrNr.exe
  C:\Windows\System\saRsrNr.exe
  2⤵
  PID:4696
- C:\Windows\System\PTIjOhx.exe
  C:\Windows\System\PTIjOhx.exe
  2⤵
  PID:4712
- C:\Windows\System\gbxnXaA.exe
  C:\Windows\System\gbxnXaA.exe
  2⤵
  PID:4728
- C:\Windows\System\CMHNkpe.exe
  C:\Windows\System\CMHNkpe.exe
  2⤵
  PID:4748
- C:\Windows\System\FfWaqLw.exe
  C:\Windows\System\FfWaqLw.exe
  2⤵
  PID:4764
- C:\Windows\System\vHIPFXQ.exe
  C:\Windows\System\vHIPFXQ.exe
  2⤵
  PID:4780
- C:\Windows\System\QBhFJEY.exe
  C:\Windows\System\QBhFJEY.exe
  2⤵
  PID:4796
- C:\Windows\System\lnAzTQo.exe
  C:\Windows\System\lnAzTQo.exe
  2⤵
  PID:4812
- C:\Windows\System\plofmCg.exe
  C:\Windows\System\plofmCg.exe
  2⤵
  PID:4828
- C:\Windows\System\cewdvJv.exe
  C:\Windows\System\cewdvJv.exe
  2⤵
  PID:4848
- C:\Windows\System\lvxcfeD.exe
  C:\Windows\System\lvxcfeD.exe
  2⤵
  PID:4864
- C:\Windows\System\MrgVwSm.exe
  C:\Windows\System\MrgVwSm.exe
  2⤵
  PID:4880
- C:\Windows\System\niqoeUx.exe
  C:\Windows\System\niqoeUx.exe
  2⤵
  PID:4900
- C:\Windows\System\cWqsOin.exe
  C:\Windows\System\cWqsOin.exe
  2⤵
  PID:4916
- C:\Windows\System\xZYIxIs.exe
  C:\Windows\System\xZYIxIs.exe
  2⤵
  PID:4932
- C:\Windows\System\LIWdsku.exe
  C:\Windows\System\LIWdsku.exe
  2⤵
  PID:4948
- C:\Windows\System\czZPbiL.exe
  C:\Windows\System\czZPbiL.exe
  2⤵
  PID:4964
- C:\Windows\System\HDyLhFL.exe
  C:\Windows\System\HDyLhFL.exe
  2⤵
  PID:4980
- C:\Windows\System\CyIfFEX.exe
  C:\Windows\System\CyIfFEX.exe
  2⤵
  PID:5000
- C:\Windows\System\revYSvr.exe
  C:\Windows\System\revYSvr.exe
  2⤵
  PID:5016
- C:\Windows\System\GXGSmMs.exe
  C:\Windows\System\GXGSmMs.exe
  2⤵
  PID:3296
- C:\Windows\System\lKzsHvy.exe
  C:\Windows\System\lKzsHvy.exe
  2⤵
  PID:4148
- C:\Windows\System\uJTpHWV.exe
  C:\Windows\System\uJTpHWV.exe
  2⤵
  PID:4260
- C:\Windows\System\nxnYuGl.exe
  C:\Windows\System\nxnYuGl.exe
  2⤵
  PID:4516
- C:\Windows\System\xraBXjv.exe
  C:\Windows\System\xraBXjv.exe
  2⤵
  PID:4620
- C:\Windows\System\cmBrEtZ.exe
  C:\Windows\System\cmBrEtZ.exe
  2⤵
  PID:4368
- C:\Windows\System\foDWklr.exe
  C:\Windows\System\foDWklr.exe
  2⤵
  PID:4636
- C:\Windows\System\yPjKDYe.exe
  C:\Windows\System\yPjKDYe.exe
  2⤵
  PID:4724
- C:\Windows\System\CQjLVce.exe
  C:\Windows\System\CQjLVce.exe
  2⤵
  PID:4928
- C:\Windows\System\MJdYUQa.exe
  C:\Windows\System\MJdYUQa.exe
  2⤵
  PID:4992
- C:\Windows\System\kqYvHff.exe
  C:\Windows\System\kqYvHff.exe
  2⤵
  PID:4708
- C:\Windows\System\QgATDGU.exe
  C:\Windows\System\QgATDGU.exe
  2⤵
  PID:4844
- C:\Windows\System\WgZZAvK.exe
  C:\Windows\System\WgZZAvK.exe
  2⤵
  PID:5008
- C:\Windows\System\eeUDQmj.exe
  C:\Windows\System\eeUDQmj.exe
  2⤵
  PID:4940
- C:\Windows\System\fPGKBwv.exe
  C:\Windows\System\fPGKBwv.exe
  2⤵
  PID:5072
- C:\Windows\System\UWsjySF.exe
  C:\Windows\System\UWsjySF.exe
  2⤵
  PID:5044
- C:\Windows\System\ynqEYOu.exe
  C:\Windows\System\ynqEYOu.exe
  2⤵
  PID:5068
- C:\Windows\System\jRbhqqw.exe
  C:\Windows\System\jRbhqqw.exe
  2⤵
  PID:5088
- C:\Windows\System\hPGehhH.exe
  C:\Windows\System\hPGehhH.exe
  2⤵
  PID:5108
- C:\Windows\System\XKhWRWK.exe
  C:\Windows\System\XKhWRWK.exe
  2⤵
  PID:4276
- C:\Windows\System\CjIfQJu.exe
  C:\Windows\System\CjIfQJu.exe
  2⤵
  PID:4248
- C:\Windows\System\iteGDAj.exe
  C:\Windows\System\iteGDAj.exe
  2⤵
  PID:4312
- C:\Windows\System\qHHoqBO.exe
  C:\Windows\System\qHHoqBO.exe
  2⤵
  PID:2548
- C:\Windows\System\YaJJZNz.exe
  C:\Windows\System\YaJJZNz.exe
  2⤵
  PID:4296
- C:\Windows\System\yfOaSxT.exe
  C:\Windows\System\yfOaSxT.exe
  2⤵
  PID:4200
- C:\Windows\System\dvYNCYQ.exe
  C:\Windows\System\dvYNCYQ.exe
  2⤵
  PID:4520
- C:\Windows\System\CEVUumd.exe
  C:\Windows\System\CEVUumd.exe
  2⤵
  PID:4656
- C:\Windows\System\qpdyhmb.exe
  C:\Windows\System\qpdyhmb.exe
  2⤵
  PID:4608
- C:\Windows\System\PsTdMpI.exe
  C:\Windows\System\PsTdMpI.exe
  2⤵
  PID:4672
- C:\Windows\System\YYHaUBC.exe
  C:\Windows\System\YYHaUBC.exe
  2⤵
  PID:4464
- C:\Windows\System\LyrukNj.exe
  C:\Windows\System\LyrukNj.exe
  2⤵
  PID:4720
- C:\Windows\System\LVjrcfh.exe
  C:\Windows\System\LVjrcfh.exe
  2⤵
  PID:4888
- C:\Windows\System\ZsoquFc.exe
  C:\Windows\System\ZsoquFc.exe
  2⤵
  PID:5024
- C:\Windows\System\AmLKkOX.exe
  C:\Windows\System\AmLKkOX.exe
  2⤵
  PID:4804
- C:\Windows\System\xnAFogY.exe
  C:\Windows\System\xnAFogY.exe
  2⤵
  PID:4972
- C:\Windows\System\hUGmywa.exe
  C:\Windows\System\hUGmywa.exe
  2⤵
  PID:4976
- C:\Windows\System\hQWsKfh.exe
  C:\Windows\System\hQWsKfh.exe
  2⤵
  PID:4244
- C:\Windows\System\mMNfftg.exe
  C:\Windows\System\mMNfftg.exe
  2⤵
  PID:5116
- C:\Windows\System\xUrARGt.exe
  C:\Windows\System\xUrARGt.exe
  2⤵
  PID:4348
- C:\Windows\System\ljAZyms.exe
  C:\Windows\System\ljAZyms.exe
  2⤵
  PID:2752
- C:\Windows\System\MVUtLGR.exe
  C:\Windows\System\MVUtLGR.exe
  2⤵
  PID:4352
- C:\Windows\System\eygXfch.exe
  C:\Windows\System\eygXfch.exe
  2⤵
  PID:4380
- C:\Windows\System\XefHEoq.exe
  C:\Windows\System\XefHEoq.exe
  2⤵
  PID:4320
- C:\Windows\System\feiNjak.exe
  C:\Windows\System\feiNjak.exe
  2⤵
  PID:2784
- C:\Windows\System\LFiZSDP.exe
  C:\Windows\System\LFiZSDP.exe
  2⤵
  PID:3516
- C:\Windows\System\qnSCETQ.exe
  C:\Windows\System\qnSCETQ.exe
  2⤵
  PID:4480
- C:\Windows\System\VXUBDzH.exe
  C:\Windows\System\VXUBDzH.exe
  2⤵
  PID:4448
- C:\Windows\System\IuvsPQu.exe
  C:\Windows\System\IuvsPQu.exe
  2⤵
  PID:4428
- C:\Windows\System\IfuPRWw.exe
  C:\Windows\System\IfuPRWw.exe
  2⤵
  PID:4788
- C:\Windows\System\IFxIXFQ.exe
  C:\Windows\System\IFxIXFQ.exe
  2⤵
  PID:4692
- C:\Windows\System\WltkVgx.exe
  C:\Windows\System\WltkVgx.exe
  2⤵
  PID:4704
- C:\Windows\System\RmGduzd.exe
  C:\Windows\System\RmGduzd.exe
  2⤵
  PID:4876
- C:\Windows\System\vxqxSTa.exe
  C:\Windows\System\vxqxSTa.exe
  2⤵
  PID:5064
- C:\Windows\System\RKzCWtW.exe
  C:\Windows\System\RKzCWtW.exe
  2⤵
  PID:5096
- C:\Windows\System\yIUBESa.exe
  C:\Windows\System\yIUBESa.exe
  2⤵
  PID:5040
- C:\Windows\System\SveDwcA.exe
  C:\Windows\System\SveDwcA.exe
  2⤵
  PID:4104
- C:\Windows\System\IzNFyhx.exe
  C:\Windows\System\IzNFyhx.exe
  2⤵
  PID:4332
- C:\Windows\System\ljaISQS.exe
  C:\Windows\System\ljaISQS.exe
  2⤵
  PID:4588
- C:\Windows\System\GoWvWRP.exe
  C:\Windows\System\GoWvWRP.exe
  2⤵
  PID:4136
- C:\Windows\System\ImdfqeA.exe
  C:\Windows\System\ImdfqeA.exe
  2⤵
  PID:4400
- C:\Windows\System\kWVgwIy.exe
  C:\Windows\System\kWVgwIy.exe
  2⤵
  PID:4536
- C:\Windows\System\zdQRhVp.exe
  C:\Windows\System\zdQRhVp.exe
  2⤵
  PID:4468
- C:\Windows\System\ueYVwka.exe
  C:\Windows\System\ueYVwka.exe
  2⤵
  PID:4924
- C:\Windows\System\bhauLyr.exe
  C:\Windows\System\bhauLyr.exe
  2⤵
  PID:4856
- C:\Windows\System\vDKLppt.exe
  C:\Windows\System\vDKLppt.exe
  2⤵
  PID:5052
- C:\Windows\System\saEsZGi.exe
  C:\Windows\System\saEsZGi.exe
  2⤵
  PID:5084
- C:\Windows\System\HDwTHbn.exe
  C:\Windows\System\HDwTHbn.exe
  2⤵
  PID:1892
- C:\Windows\System\dhNrAfy.exe
  C:\Windows\System\dhNrAfy.exe
  2⤵
  PID:3728
- C:\Windows\System\wUvllzE.exe
  C:\Windows\System\wUvllzE.exe
  2⤵
  PID:4216
- C:\Windows\System\IOTQlcU.exe
  C:\Windows\System\IOTQlcU.exe
  2⤵
  PID:4500
- C:\Windows\System\abJXvOW.exe
  C:\Windows\System\abJXvOW.exe
  2⤵
  PID:4912
- C:\Windows\System\ATnERBw.exe
  C:\Windows\System\ATnERBw.exe
  2⤵
  PID:4840
- C:\Windows\System\fTHOJpH.exe
  C:\Windows\System\fTHOJpH.exe
  2⤵
  PID:4552
- C:\Windows\System\xlislYf.exe
  C:\Windows\System\xlislYf.exe
  2⤵
  PID:4364
- C:\Windows\System\falorIZ.exe
  C:\Windows\System\falorIZ.exe
  2⤵
  PID:4824
- C:\Windows\System\yFKJHma.exe
  C:\Windows\System\yFKJHma.exe
  2⤵
  PID:4908
- C:\Windows\System\hahdRdG.exe
  C:\Windows\System\hahdRdG.exe
  2⤵
  PID:5104
- C:\Windows\System\yqnCIxb.exe
  C:\Windows\System\yqnCIxb.exe
  2⤵
  PID:4896
- C:\Windows\System\kIkaxhV.exe
  C:\Windows\System\kIkaxhV.exe
  2⤵
  PID:4660
- C:\Windows\System\UohsQfz.exe
  C:\Windows\System\UohsQfz.exe
  2⤵
  PID:3616
- C:\Windows\System\gxEcUPR.exe
  C:\Windows\System\gxEcUPR.exe
  2⤵
  PID:5060
- C:\Windows\System\wOPSxAU.exe
  C:\Windows\System\wOPSxAU.exe
  2⤵
  PID:4688
- C:\Windows\System\bSphaFI.exe
  C:\Windows\System\bSphaFI.exe
  2⤵
  PID:5132
- C:\Windows\System\PUIyUQC.exe
  C:\Windows\System\PUIyUQC.exe
  2⤵
  PID:5152
- C:\Windows\System\lszPbft.exe
  C:\Windows\System\lszPbft.exe
  2⤵
  PID:5168
- C:\Windows\System\SSyVmzI.exe
  C:\Windows\System\SSyVmzI.exe
  2⤵
  PID:5184
- C:\Windows\System\tJWfWtH.exe
  C:\Windows\System\tJWfWtH.exe
  2⤵
  PID:5200
- C:\Windows\System\ZJKqjvR.exe
  C:\Windows\System\ZJKqjvR.exe
  2⤵
  PID:5220
- C:\Windows\System\gMkoorf.exe
  C:\Windows\System\gMkoorf.exe
  2⤵
  PID:5236
- C:\Windows\System\lBkzOZx.exe
  C:\Windows\System\lBkzOZx.exe
  2⤵
  PID:5252
- C:\Windows\System\hwvBzta.exe
  C:\Windows\System\hwvBzta.exe
  2⤵
  PID:5288
- C:\Windows\System\knwhRpu.exe
  C:\Windows\System\knwhRpu.exe
  2⤵
  PID:5316
- C:\Windows\System\ruKKPio.exe
  C:\Windows\System\ruKKPio.exe
  2⤵
  PID:5332
- C:\Windows\System\mHcoiaB.exe
  C:\Windows\System\mHcoiaB.exe
  2⤵
  PID:5348
- C:\Windows\System\uAIDbUB.exe
  C:\Windows\System\uAIDbUB.exe
  2⤵
  PID:5368
- C:\Windows\System\JyPRYQn.exe
  C:\Windows\System\JyPRYQn.exe
  2⤵
  PID:5388
- C:\Windows\System\GaFaFcv.exe
  C:\Windows\System\GaFaFcv.exe
  2⤵
  PID:5404
- C:\Windows\System\QxzaLlP.exe
  C:\Windows\System\QxzaLlP.exe
  2⤵
  PID:5424
- C:\Windows\System\jkXvBau.exe
  C:\Windows\System\jkXvBau.exe
  2⤵
  PID:5440
- C:\Windows\System\DGurcYS.exe
  C:\Windows\System\DGurcYS.exe
  2⤵
  PID:5456
- C:\Windows\System\vbxlAJQ.exe
  C:\Windows\System\vbxlAJQ.exe
  2⤵
  PID:5472
- C:\Windows\System\dihHxah.exe
  C:\Windows\System\dihHxah.exe
  2⤵
  PID:5488
- C:\Windows\System\lZapvgJ.exe
  C:\Windows\System\lZapvgJ.exe
  2⤵
  PID:5504
- C:\Windows\System\UTnnxzJ.exe
  C:\Windows\System\UTnnxzJ.exe
  2⤵
  PID:5524
- C:\Windows\System\aTnElon.exe
  C:\Windows\System\aTnElon.exe
  2⤵
  PID:5540
- C:\Windows\System\ikylQmP.exe
  C:\Windows\System\ikylQmP.exe
  2⤵
  PID:5556
- C:\Windows\System\wDZNjHn.exe
  C:\Windows\System\wDZNjHn.exe
  2⤵
  PID:5576
- C:\Windows\System\SnkjJri.exe
  C:\Windows\System\SnkjJri.exe
  2⤵
  PID:5592
- C:\Windows\System\nGRBFVL.exe
  C:\Windows\System\nGRBFVL.exe
  2⤵
  PID:5608
- C:\Windows\System\LLNBafc.exe
  C:\Windows\System\LLNBafc.exe
  2⤵
  PID:5624
- C:\Windows\System\qDThTqM.exe
  C:\Windows\System\qDThTqM.exe
  2⤵
  PID:5640
- C:\Windows\System\PWozgjp.exe
  C:\Windows\System\PWozgjp.exe
  2⤵
  PID:5656
- C:\Windows\System\mqJFFqy.exe
  C:\Windows\System\mqJFFqy.exe
  2⤵
  PID:5672
- C:\Windows\System\lZclncb.exe
  C:\Windows\System\lZclncb.exe
  2⤵
  PID:5688
- C:\Windows\System\kKzzYVx.exe
  C:\Windows\System\kKzzYVx.exe
  2⤵
  PID:5708
- C:\Windows\System\krDVasQ.exe
  C:\Windows\System\krDVasQ.exe
  2⤵
  PID:5724
- C:\Windows\System\hcyudnn.exe
  C:\Windows\System\hcyudnn.exe
  2⤵
  PID:5740
- C:\Windows\System\hKEMxvh.exe
  C:\Windows\System\hKEMxvh.exe
  2⤵
  PID:5756
- C:\Windows\System\utgUnkn.exe
  C:\Windows\System\utgUnkn.exe
  2⤵
  PID:5772
- C:\Windows\System\nNCsjna.exe
  C:\Windows\System\nNCsjna.exe
  2⤵
  PID:5792
- C:\Windows\System\QxjXOYt.exe
  C:\Windows\System\QxjXOYt.exe
  2⤵
  PID:5812
- C:\Windows\System\LpbkxKY.exe
  C:\Windows\System\LpbkxKY.exe
  2⤵
  PID:5828
- C:\Windows\System\DlldeyV.exe
  C:\Windows\System\DlldeyV.exe
  2⤵
  PID:5844
- C:\Windows\System\DozDUPk.exe
  C:\Windows\System\DozDUPk.exe
  2⤵
  PID:5860
- C:\Windows\System\NEKxAhh.exe
  C:\Windows\System\NEKxAhh.exe
  2⤵
  PID:5876
- C:\Windows\System\yAtUmCd.exe
  C:\Windows\System\yAtUmCd.exe
  2⤵
  PID:5892
- C:\Windows\System\hyzpcJf.exe
  C:\Windows\System\hyzpcJf.exe
  2⤵
  PID:5908
- C:\Windows\System\IfrCvdy.exe
  C:\Windows\System\IfrCvdy.exe
  2⤵
  PID:5944
- C:\Windows\System\gOSycsb.exe
  C:\Windows\System\gOSycsb.exe
  2⤵
  PID:6028
- C:\Windows\System\ZsDbpxW.exe
  C:\Windows\System\ZsDbpxW.exe
  2⤵
  PID:6052
- C:\Windows\System\cjuIZNp.exe
  C:\Windows\System\cjuIZNp.exe
  2⤵
  PID:6068
- C:\Windows\System\uNSmevN.exe
  C:\Windows\System\uNSmevN.exe
  2⤵
  PID:6096
- C:\Windows\System\sEmwzYx.exe
  C:\Windows\System\sEmwzYx.exe
  2⤵
  PID:6124
- C:\Windows\System\KOMzEEQ.exe
  C:\Windows\System\KOMzEEQ.exe
  2⤵
  PID:6140
- C:\Windows\System\gQEVIaO.exe
  C:\Windows\System\gQEVIaO.exe
  2⤵
  PID:5128
- C:\Windows\System\riJSxbw.exe
  C:\Windows\System\riJSxbw.exe
  2⤵
  PID:5164
- C:\Windows\System\alOhqMp.exe
  C:\Windows\System\alOhqMp.exe
  2⤵
  PID:5232
- C:\Windows\System\HLdvMMz.exe
  C:\Windows\System\HLdvMMz.exe
  2⤵
  PID:5216
- C:\Windows\System\ahQMZuz.exe
  C:\Windows\System\ahQMZuz.exe
  2⤵
  PID:5260
- C:\Windows\System\jOPkAoV.exe
  C:\Windows\System\jOPkAoV.exe
  2⤵
  PID:5280
- C:\Windows\System\xmmxRXi.exe
  C:\Windows\System\xmmxRXi.exe
  2⤵
  PID:5356
- C:\Windows\System\JBpzhug.exe
  C:\Windows\System\JBpzhug.exe
  2⤵
  PID:5364
- C:\Windows\System\bSooFXI.exe
  C:\Windows\System\bSooFXI.exe
  2⤵
  PID:5432
- C:\Windows\System\tNEQUUJ.exe
  C:\Windows\System\tNEQUUJ.exe
  2⤵
  PID:5344
- C:\Windows\System\NnZdACi.exe
  C:\Windows\System\NnZdACi.exe
  2⤵
  PID:5416
- C:\Windows\System\pRwFHrH.exe
  C:\Windows\System\pRwFHrH.exe
  2⤵
  PID:5500
- C:\Windows\System\JKOsOeR.exe
  C:\Windows\System\JKOsOeR.exe
  2⤵
  PID:5568
- C:\Windows\System\geHAMkz.exe
  C:\Windows\System\geHAMkz.exe
  2⤵
  PID:5668
- C:\Windows\System\KznqBWk.exe
  C:\Windows\System\KznqBWk.exe
  2⤵
  PID:5512
- C:\Windows\System\dICqKMK.exe
  C:\Windows\System\dICqKMK.exe
  2⤵
  PID:5552
- C:\Windows\System\Catiygg.exe
  C:\Windows\System\Catiygg.exe
  2⤵
  PID:5620
- C:\Windows\System\wqAfDCP.exe
  C:\Windows\System\wqAfDCP.exe
  2⤵
  PID:5716
- C:\Windows\System\lRiynzM.exe
  C:\Windows\System\lRiynzM.exe
  2⤵
  PID:5752
- C:\Windows\System\hRuAMpx.exe
  C:\Windows\System\hRuAMpx.exe
  2⤵
  PID:5856
- C:\Windows\System\omXNKZC.exe
  C:\Windows\System\omXNKZC.exe
  2⤵
  PID:5904
- C:\Windows\System\ARKBqnP.exe
  C:\Windows\System\ARKBqnP.exe
  2⤵
  PID:5924
- C:\Windows\System\xfGucju.exe
  C:\Windows\System\xfGucju.exe
  2⤵
  PID:5940
- C:\Windows\System\qBSMdhB.exe
  C:\Windows\System\qBSMdhB.exe
  2⤵
  PID:5984
- C:\Windows\System\xyoJHtl.exe
  C:\Windows\System\xyoJHtl.exe
  2⤵
  PID:5968
- C:\Windows\System\sIdYwWE.exe
  C:\Windows\System\sIdYwWE.exe
  2⤵
  PID:5992
- C:\Windows\System\RgrLcOA.exe
  C:\Windows\System\RgrLcOA.exe
  2⤵
  PID:6036
- C:\Windows\System\dLlIcQT.exe
  C:\Windows\System\dLlIcQT.exe
  2⤵
  PID:6108
- C:\Windows\System\wPIwkkP.exe
  C:\Windows\System\wPIwkkP.exe
  2⤵
  PID:5124
- C:\Windows\System\DoZlHzk.exe
  C:\Windows\System\DoZlHzk.exe
  2⤵
  PID:5180
- C:\Windows\System\RUYSVQf.exe
  C:\Windows\System\RUYSVQf.exe
  2⤵
  PID:5400
- C:\Windows\System\vwJUneQ.exe
  C:\Windows\System\vwJUneQ.exe
  2⤵
  PID:5464
- C:\Windows\System\Htwgmcq.exe
  C:\Windows\System\Htwgmcq.exe
  2⤵
  PID:5360
- C:\Windows\System\bckQnBG.exe
  C:\Windows\System\bckQnBG.exe
  2⤵
  PID:5448
- C:\Windows\System\nWmEgki.exe
  C:\Windows\System\nWmEgki.exe
  2⤵
  PID:6092
- C:\Windows\System\iDuejdZ.exe
  C:\Windows\System\iDuejdZ.exe
  2⤵
  PID:5148
- C:\Windows\System\GPtTpTf.exe
  C:\Windows\System\GPtTpTf.exe
  2⤵
  PID:5272
- C:\Windows\System\EoZLgeK.exe
  C:\Windows\System\EoZLgeK.exe
  2⤵
  PID:5636
- C:\Windows\System\gSZQhQb.exe
  C:\Windows\System\gSZQhQb.exe
  2⤵
  PID:5768
- C:\Windows\System\TyHWxua.exe
  C:\Windows\System\TyHWxua.exe
  2⤵
  PID:5836
- C:\Windows\System\oDmRcIy.exe
  C:\Windows\System\oDmRcIy.exe
  2⤵
  PID:5616
- C:\Windows\System\WkbxcLp.exe
  C:\Windows\System\WkbxcLp.exe
  2⤵
  PID:5900
- C:\Windows\System\uCAUeAt.exe
  C:\Windows\System\uCAUeAt.exe
  2⤵
  PID:5964
- C:\Windows\System\jWMECeG.exe
  C:\Windows\System\jWMECeG.exe
  2⤵
  PID:6116
- C:\Windows\System\fCnYtCK.exe
  C:\Windows\System\fCnYtCK.exe
  2⤵
  PID:5328
- C:\Windows\System\VPwFuzk.exe
  C:\Windows\System\VPwFuzk.exe
  2⤵
  PID:6044
- C:\Windows\System\sgjuqkA.exe
  C:\Windows\System\sgjuqkA.exe
  2⤵
  PID:5652
- C:\Windows\System\DOyrBjP.exe
  C:\Windows\System\DOyrBjP.exe
  2⤵
  PID:5884
- C:\Windows\System\YKWgBDq.exe
  C:\Windows\System\YKWgBDq.exe
  2⤵
  PID:5824
- C:\Windows\System\KFfwddc.exe
  C:\Windows\System\KFfwddc.exe
  2⤵
  PID:5980
- C:\Windows\System\GOJOjts.exe
  C:\Windows\System\GOJOjts.exe
  2⤵
  PID:5228
- C:\Windows\System\dKuezxX.exe
  C:\Windows\System\dKuezxX.exe
  2⤵
  PID:5532
- C:\Windows\System\dQqbYsL.exe
  C:\Windows\System\dQqbYsL.exe
  2⤵
  PID:6136
- C:\Windows\System\MblgrVW.exe
  C:\Windows\System\MblgrVW.exe
  2⤵
  PID:4568
- C:\Windows\System\mAhxeGH.exe
  C:\Windows\System\mAhxeGH.exe
  2⤵
  PID:5684
- C:\Windows\System\cfeovby.exe
  C:\Windows\System\cfeovby.exe
  2⤵
  PID:6104
- C:\Windows\System\yyZVUtC.exe
  C:\Windows\System\yyZVUtC.exe
  2⤵
  PID:5436
- C:\Windows\System\xOayKVd.exe
  C:\Windows\System\xOayKVd.exe
  2⤵
  PID:5872
- C:\Windows\System\qOdpcoT.exe
  C:\Windows\System\qOdpcoT.exe
  2⤵
  PID:5572
- C:\Windows\System\upHdMtu.exe
  C:\Windows\System\upHdMtu.exe
  2⤵
  PID:5956
- C:\Windows\System\TpydSra.exe
  C:\Windows\System\TpydSra.exe
  2⤵
  PID:6084
- C:\Windows\System\uaXDWcy.exe
  C:\Windows\System\uaXDWcy.exe
  2⤵
  PID:5736
- C:\Windows\System\pifanwG.exe
  C:\Windows\System\pifanwG.exe
  2⤵
  PID:5764
- C:\Windows\System\Tmyefve.exe
  C:\Windows\System\Tmyefve.exe
  2⤵
  PID:5588
- C:\Windows\System\sMlgBjU.exe
  C:\Windows\System\sMlgBjU.exe
  2⤵
  PID:6012
- C:\Windows\System\zyAedNp.exe
  C:\Windows\System\zyAedNp.exe
  2⤵
  PID:1552
- C:\Windows\System\gMIFTld.exe
  C:\Windows\System\gMIFTld.exe
  2⤵
  PID:5384
- C:\Windows\System\unRWXhn.exe
  C:\Windows\System\unRWXhn.exe
  2⤵
  PID:5704
- C:\Windows\System\aiUfurp.exe
  C:\Windows\System\aiUfurp.exe
  2⤵
  PID:6160
- C:\Windows\System\CwdsFoe.exe
  C:\Windows\System\CwdsFoe.exe
  2⤵
  PID:6180
- C:\Windows\System\qpysPap.exe
  C:\Windows\System\qpysPap.exe
  2⤵
  PID:6196
- C:\Windows\System\CFHwaqn.exe
  C:\Windows\System\CFHwaqn.exe
  2⤵
  PID:6216
- C:\Windows\System\hgRjjQt.exe
  C:\Windows\System\hgRjjQt.exe
  2⤵
  PID:6232
- C:\Windows\System\qhIMUKe.exe
  C:\Windows\System\qhIMUKe.exe
  2⤵
  PID:6252
- C:\Windows\System\FgmbBwQ.exe
  C:\Windows\System\FgmbBwQ.exe
  2⤵
  PID:6268
- C:\Windows\System\XSbdUVK.exe
  C:\Windows\System\XSbdUVK.exe
  2⤵
  PID:6284
- C:\Windows\System\VphRpzd.exe
  C:\Windows\System\VphRpzd.exe
  2⤵
  PID:6304
- C:\Windows\System\FYSvgGK.exe
  C:\Windows\System\FYSvgGK.exe
  2⤵
  PID:6320
- C:\Windows\System\rxREuoH.exe
  C:\Windows\System\rxREuoH.exe
  2⤵
  PID:6336
- C:\Windows\System\fTNEGvj.exe
  C:\Windows\System\fTNEGvj.exe
  2⤵
  PID:6352
- C:\Windows\System\aDAOYVc.exe
  C:\Windows\System\aDAOYVc.exe
  2⤵
  PID:6368
- C:\Windows\System\CSMiGRM.exe
  C:\Windows\System\CSMiGRM.exe
  2⤵
  PID:6384
- C:\Windows\System\VHkWeaL.exe
  C:\Windows\System\VHkWeaL.exe
  2⤵
  PID:6400
- C:\Windows\System\dLWYxxN.exe
  C:\Windows\System\dLWYxxN.exe
  2⤵
  PID:6416
- C:\Windows\System\UaBALca.exe
  C:\Windows\System\UaBALca.exe
  2⤵
  PID:6432
- C:\Windows\System\zEYrPOd.exe
  C:\Windows\System\zEYrPOd.exe
  2⤵
  PID:6448
- C:\Windows\System\uKEubht.exe
  C:\Windows\System\uKEubht.exe
  2⤵
  PID:6464
- C:\Windows\System\RAHMYmQ.exe
  C:\Windows\System\RAHMYmQ.exe
  2⤵
  PID:6480
- C:\Windows\System\NwdZvQm.exe
  C:\Windows\System\NwdZvQm.exe
  2⤵
  PID:6496
- C:\Windows\System\QhhZGvN.exe
  C:\Windows\System\QhhZGvN.exe
  2⤵
  PID:6516
- C:\Windows\System\DOXlsqH.exe
  C:\Windows\System\DOXlsqH.exe
  2⤵
  PID:6532
- C:\Windows\System\rGEikrT.exe
  C:\Windows\System\rGEikrT.exe
  2⤵
  PID:6548
- C:\Windows\System\fszAGWw.exe
  C:\Windows\System\fszAGWw.exe
  2⤵
  PID:6564
- C:\Windows\System\GOAJngj.exe
  C:\Windows\System\GOAJngj.exe
  2⤵
  PID:6584
- C:\Windows\System\kXeRcaO.exe
  C:\Windows\System\kXeRcaO.exe
  2⤵
  PID:6600
- C:\Windows\System\HCEKjvx.exe
  C:\Windows\System\HCEKjvx.exe
  2⤵
  PID:6620
- C:\Windows\System\JRxLFXJ.exe
  C:\Windows\System\JRxLFXJ.exe
  2⤵
  PID:6636
- C:\Windows\System\HwSJTLC.exe
  C:\Windows\System\HwSJTLC.exe
  2⤵
  PID:6652
- C:\Windows\System\KctpjWS.exe
  C:\Windows\System\KctpjWS.exe
  2⤵
  PID:6672
- C:\Windows\System\asrSoDH.exe
  C:\Windows\System\asrSoDH.exe
  2⤵
  PID:6756
- C:\Windows\System\wtuwdXS.exe
  C:\Windows\System\wtuwdXS.exe
  2⤵
  PID:6772
- C:\Windows\System\RSmwDzg.exe
  C:\Windows\System\RSmwDzg.exe
  2⤵
  PID:6792
- C:\Windows\System\lLfjRWW.exe
  C:\Windows\System\lLfjRWW.exe
  2⤵
  PID:6812
- C:\Windows\System\VaJgBqS.exe
  C:\Windows\System\VaJgBqS.exe
  2⤵
  PID:6828
- C:\Windows\System\eDsvSLu.exe
  C:\Windows\System\eDsvSLu.exe
  2⤵
  PID:6844
- C:\Windows\System\GcMaXaE.exe
  C:\Windows\System\GcMaXaE.exe
  2⤵
  PID:6860
- C:\Windows\System\Jyfgrlu.exe
  C:\Windows\System\Jyfgrlu.exe
  2⤵
  PID:6880
- C:\Windows\System\OCtbIcR.exe
  C:\Windows\System\OCtbIcR.exe
  2⤵
  PID:6896
- C:\Windows\System\jTshJmV.exe
  C:\Windows\System\jTshJmV.exe
  2⤵
  PID:6912
- C:\Windows\System\VTRfLoa.exe
  C:\Windows\System\VTRfLoa.exe
  2⤵
  PID:6928
- C:\Windows\System\DyuSGIo.exe
  C:\Windows\System\DyuSGIo.exe
  2⤵
  PID:7016
- C:\Windows\System\gKzTxpS.exe
  C:\Windows\System\gKzTxpS.exe
  2⤵
  PID:7036
- C:\Windows\System\hsptJiq.exe
  C:\Windows\System\hsptJiq.exe
  2⤵
  PID:7052
- C:\Windows\System\VTKjlYt.exe
  C:\Windows\System\VTKjlYt.exe
  2⤵
  PID:7068
- C:\Windows\System\HkSSpRz.exe
  C:\Windows\System\HkSSpRz.exe
  2⤵
  PID:7088
- C:\Windows\System\IlTkbPI.exe
  C:\Windows\System\IlTkbPI.exe
  2⤵
  PID:7104
- C:\Windows\System\DWxfBuR.exe
  C:\Windows\System\DWxfBuR.exe
  2⤵
  PID:7120
- C:\Windows\System\RFPqbat.exe
  C:\Windows\System\RFPqbat.exe
  2⤵
  PID:7140
- C:\Windows\System\NOptDAm.exe
  C:\Windows\System\NOptDAm.exe
  2⤵
  PID:7156
- C:\Windows\System\oiTJpFl.exe
  C:\Windows\System\oiTJpFl.exe
  2⤵
  PID:5548
- C:\Windows\System\uafXRsy.exe
  C:\Windows\System\uafXRsy.exe
  2⤵
  PID:6188
- C:\Windows\System\rcmEvYM.exe
  C:\Windows\System\rcmEvYM.exe
  2⤵
  PID:5700
- C:\Windows\System\oajGhwY.exe
  C:\Windows\System\oajGhwY.exe
  2⤵
  PID:6292
- C:\Windows\System\wPqLdgW.exe
  C:\Windows\System\wPqLdgW.exe
  2⤵
  PID:6244
- C:\Windows\System\JZYBtxq.exe
  C:\Windows\System\JZYBtxq.exe
  2⤵
  PID:5484
- C:\Windows\System\QaPJuss.exe
  C:\Windows\System\QaPJuss.exe
  2⤵
  PID:6132
- C:\Windows\System\TONbppa.exe
  C:\Windows\System\TONbppa.exe
  2⤵
  PID:6212
- C:\Windows\System\vmzvaXi.exe
  C:\Windows\System\vmzvaXi.exe
  2⤵
  PID:6364
- C:\Windows\System\Xcztuvw.exe
  C:\Windows\System\Xcztuvw.exe
  2⤵
  PID:6392
- C:\Windows\System\LdiCzid.exe
  C:\Windows\System\LdiCzid.exe
  2⤵
  PID:6380
- C:\Windows\System\lLHvhQG.exe
  C:\Windows\System\lLHvhQG.exe
  2⤵
  PID:6408
- C:\Windows\System\xezDARn.exe
  C:\Windows\System\xezDARn.exe
  2⤵
  PID:6460
- C:\Windows\System\joiVGxi.exe
  C:\Windows\System\joiVGxi.exe
  2⤵
  PID:6528
- C:\Windows\System\cKxdriB.exe
  C:\Windows\System\cKxdriB.exe
  2⤵
  PID:6596
- C:\Windows\System\DNuODIA.exe
  C:\Windows\System\DNuODIA.exe
  2⤵
  PID:6668
- C:\Windows\System\aVxOwAz.exe
  C:\Windows\System\aVxOwAz.exe
  2⤵
  PID:6544
- C:\Windows\System\qmpkJSU.exe
  C:\Windows\System\qmpkJSU.exe
  2⤵
  PID:6612
- C:\Windows\System\IaBGeHX.exe
  C:\Windows\System\IaBGeHX.exe
  2⤵
  PID:6680
- C:\Windows\System\rSfpPnQ.exe
  C:\Windows\System\rSfpPnQ.exe
  2⤵
  PID:6696
- C:\Windows\System\uBDrLLs.exe
  C:\Windows\System\uBDrLLs.exe
  2⤵
  PID:6708
- C:\Windows\System\NSBhecI.exe
  C:\Windows\System\NSBhecI.exe
  2⤵
  PID:6732
- C:\Windows\System\ETpjpWL.exe
  C:\Windows\System\ETpjpWL.exe
  2⤵
  PID:6748
- C:\Windows\System\kwthlrt.exe
  C:\Windows\System\kwthlrt.exe
  2⤵
  PID:6804
- C:\Windows\System\blwPfMV.exe
  C:\Windows\System\blwPfMV.exe
  2⤵
  PID:6876
- C:\Windows\System\oImghMN.exe
  C:\Windows\System\oImghMN.exe
  2⤵
  PID:6752
- C:\Windows\System\mrGRPHR.exe
  C:\Windows\System\mrGRPHR.exe
  2⤵
  PID:6852
- C:\Windows\System\PpJvCTM.exe
  C:\Windows\System\PpJvCTM.exe
  2⤵
  PID:6920
- C:\Windows\System\ujXnVGV.exe
  C:\Windows\System\ujXnVGV.exe
  2⤵
  PID:6956
- C:\Windows\System\pAVyLMF.exe
  C:\Windows\System\pAVyLMF.exe
  2⤵
  PID:6976
- C:\Windows\System\hWmNhgx.exe
  C:\Windows\System\hWmNhgx.exe
  2⤵
  PID:6788
- C:\Windows\System\NfPpiyq.exe
  C:\Windows\System\NfPpiyq.exe
  2⤵
  PID:7064
- C:\Windows\System\yHjGUin.exe
  C:\Windows\System\yHjGUin.exe
  2⤵
  PID:7008
- C:\Windows\System\VytJtlN.exe
  C:\Windows\System\VytJtlN.exe
  2⤵
  PID:7024
- C:\Windows\System\sAiZyRC.exe
  C:\Windows\System\sAiZyRC.exe
  2⤵
  PID:7152
- C:\Windows\System\kwUAFEH.exe
  C:\Windows\System\kwUAFEH.exe
  2⤵
  PID:6168
- C:\Windows\System\BoBzPTK.exe
  C:\Windows\System\BoBzPTK.exe
  2⤵
  PID:7100
- C:\Windows\System\icsjHkF.exe
  C:\Windows\System\icsjHkF.exe
  2⤵
  PID:6208
- C:\Windows\System\shuRzyc.exe
  C:\Windows\System\shuRzyc.exe
  2⤵
  PID:6524
- C:\Windows\System\QwdUipM.exe
  C:\Windows\System\QwdUipM.exe
  2⤵
  PID:6664
- C:\Windows\System\eYmlSvH.exe
  C:\Windows\System\eYmlSvH.exe
  2⤵
  PID:7164
- C:\Windows\System\xtOUxUB.exe
  C:\Windows\System\xtOUxUB.exe
  2⤵
  PID:6576
- C:\Windows\System\wmWEjEG.exe
  C:\Windows\System\wmWEjEG.exe
  2⤵
  PID:6456
- C:\Windows\System\kzTHPyw.exe
  C:\Windows\System\kzTHPyw.exe
  2⤵
  PID:6300
- C:\Windows\System\IoClVat.exe
  C:\Windows\System\IoClVat.exe
  2⤵
  PID:6508
- C:\Windows\System\XtRAsqW.exe
  C:\Windows\System\XtRAsqW.exe
  2⤵
  PID:6376
- C:\Windows\System\wfblnuo.exe
  C:\Windows\System\wfblnuo.exe
  2⤵
  PID:6360
- C:\Windows\System\iLfoTBZ.exe
  C:\Windows\System\iLfoTBZ.exe
  2⤵
  PID:6724
- C:\Windows\System\DqrrFNv.exe
  C:\Windows\System\DqrrFNv.exe
  2⤵
  PID:6808
- C:\Windows\System\CTWKQFr.exe
  C:\Windows\System\CTWKQFr.exe
  2⤵
  PID:6984
- C:\Windows\System\GKPiweK.exe
  C:\Windows\System\GKPiweK.exe
  2⤵
  PID:6080
- C:\Windows\System\OudyhTx.exe
  C:\Windows\System\OudyhTx.exe
  2⤵
  PID:7048
- C:\Windows\System\NUpgEKH.exe
  C:\Windows\System\NUpgEKH.exe
  2⤵
  PID:6996
- C:\Windows\System\LjDxDvt.exe
  C:\Windows\System\LjDxDvt.exe
  2⤵
  PID:5888
- C:\Windows\System\vvpBwIt.exe
  C:\Windows\System\vvpBwIt.exe
  2⤵
  PID:6688
- C:\Windows\System\XXzctho.exe
  C:\Windows\System\XXzctho.exe
  2⤵
  PID:6980
- C:\Windows\System\oGMRGNb.exe
  C:\Windows\System\oGMRGNb.exe
  2⤵
  PID:7132
- C:\Windows\System\pdDfZig.exe
  C:\Windows\System\pdDfZig.exe
  2⤵
  PID:6540
- C:\Windows\System\tACxYfW.exe
  C:\Windows\System\tACxYfW.exe
  2⤵
  PID:6644
- C:\Windows\System\CGDsbDJ.exe
  C:\Windows\System\CGDsbDJ.exe
  2⤵
  PID:6872
- C:\Windows\System\UShxiqy.exe
  C:\Windows\System\UShxiqy.exe
  2⤵
  PID:6784
- C:\Windows\System\CxFzJXm.exe
  C:\Windows\System\CxFzJXm.exe
  2⤵
  PID:6156
- C:\Windows\System\UYZtflq.exe
  C:\Windows\System\UYZtflq.exe
  2⤵
  PID:6176
- C:\Windows\System\DawDjhD.exe
  C:\Windows\System\DawDjhD.exe
  2⤵
  PID:5268
- C:\Windows\System\jtrEvti.exe
  C:\Windows\System\jtrEvti.exe
  2⤵
  PID:6964
- C:\Windows\System\pKpSisU.exe
  C:\Windows\System\pKpSisU.exe
  2⤵
  PID:6592
- C:\Windows\System\qYwGfYv.exe
  C:\Windows\System\qYwGfYv.exe
  2⤵
  PID:6428
- C:\Windows\System\kyRQOZf.exe
  C:\Windows\System\kyRQOZf.exe
  2⤵
  PID:6312
- C:\Windows\System\mcFLpfJ.exe
  C:\Windows\System\mcFLpfJ.exe
  2⤵
  PID:6740
- C:\Windows\System\FYvjEnf.exe
  C:\Windows\System\FYvjEnf.exe
  2⤵
  PID:6840
- C:\Windows\System\pqEwKSo.exe
  C:\Windows\System\pqEwKSo.exe
  2⤵
  PID:6868
- C:\Windows\System\dMOIGui.exe
  C:\Windows\System\dMOIGui.exe
  2⤵
  PID:7080
- C:\Windows\System\ZvfZreb.exe
  C:\Windows\System\ZvfZreb.exe
  2⤵
  PID:6608
- C:\Windows\System\IJEiNxd.exe
  C:\Windows\System\IJEiNxd.exe
  2⤵
  PID:6660
- C:\Windows\System\sqMBXER.exe
  C:\Windows\System\sqMBXER.exe
  2⤵
  PID:7184
- C:\Windows\System\UKtqHVl.exe
  C:\Windows\System\UKtqHVl.exe
  2⤵
  PID:7200
- C:\Windows\System\MTPcnGm.exe
  C:\Windows\System\MTPcnGm.exe
  2⤵
  PID:7216
- C:\Windows\System\wpWnMnA.exe
  C:\Windows\System\wpWnMnA.exe
  2⤵
  PID:7232
- C:\Windows\System\NjSwlrF.exe
  C:\Windows\System\NjSwlrF.exe
  2⤵
  PID:7252
- C:\Windows\System\xYpPvnD.exe
  C:\Windows\System\xYpPvnD.exe
  2⤵
  PID:7340
- C:\Windows\System\UVKmbzN.exe
  C:\Windows\System\UVKmbzN.exe
  2⤵
  PID:7360
- C:\Windows\System\GVZNnrw.exe
  C:\Windows\System\GVZNnrw.exe
  2⤵
  PID:7376
- C:\Windows\System\jJRQCdX.exe
  C:\Windows\System\jJRQCdX.exe
  2⤵
  PID:7392
- C:\Windows\System\gFTaVZB.exe
  C:\Windows\System\gFTaVZB.exe
  2⤵
  PID:7408
- C:\Windows\System\yGRYgCi.exe
  C:\Windows\System\yGRYgCi.exe
  2⤵
  PID:7428
- C:\Windows\System\RVidKxv.exe
  C:\Windows\System\RVidKxv.exe
  2⤵
  PID:7444
- C:\Windows\System\qNPVftF.exe
  C:\Windows\System\qNPVftF.exe
  2⤵
  PID:7460
- C:\Windows\System\zubVbmv.exe
  C:\Windows\System\zubVbmv.exe
  2⤵
  PID:7476
- C:\Windows\System\TvSrQAM.exe
  C:\Windows\System\TvSrQAM.exe
  2⤵
  PID:7500
- C:\Windows\System\lSQXEuU.exe
  C:\Windows\System\lSQXEuU.exe
  2⤵
  PID:7520
- C:\Windows\System\mCJHHWm.exe
  C:\Windows\System\mCJHHWm.exe
  2⤵
  PID:7536
- C:\Windows\System\YjeVDRy.exe
  C:\Windows\System\YjeVDRy.exe
  2⤵
  PID:7580
- C:\Windows\System\AtKSPDk.exe
  C:\Windows\System\AtKSPDk.exe
  2⤵
  PID:7596
- C:\Windows\System\OlyjuAI.exe
  C:\Windows\System\OlyjuAI.exe
  2⤵
  PID:7612
- C:\Windows\System\FFjtkQT.exe
  C:\Windows\System\FFjtkQT.exe
  2⤵
  PID:7628
- C:\Windows\System\MXgTTIk.exe
  C:\Windows\System\MXgTTIk.exe
  2⤵
  PID:7648
- C:\Windows\System\SCflVPB.exe
  C:\Windows\System\SCflVPB.exe
  2⤵
  PID:7664
- C:\Windows\System\PNMzeYW.exe
  C:\Windows\System\PNMzeYW.exe
  2⤵
  PID:7684
- C:\Windows\System\RtUQiKa.exe
  C:\Windows\System\RtUQiKa.exe
  2⤵
  PID:7700
- C:\Windows\System\oiEczhV.exe
  C:\Windows\System\oiEczhV.exe
  2⤵
  PID:7720
- C:\Windows\System\vrvLYWd.exe
  C:\Windows\System\vrvLYWd.exe
  2⤵
  PID:7736
- C:\Windows\System\ixeenqJ.exe
  C:\Windows\System\ixeenqJ.exe
  2⤵
  PID:7756
- C:\Windows\System\QPIyQvL.exe
  C:\Windows\System\QPIyQvL.exe
  2⤵
  PID:7772
- C:\Windows\System\dDmiqUC.exe
  C:\Windows\System\dDmiqUC.exe
  2⤵
  PID:7788
- C:\Windows\System\giFVHBf.exe
  C:\Windows\System\giFVHBf.exe
  2⤵
  PID:7804
- C:\Windows\System\EKXiyqH.exe
  C:\Windows\System\EKXiyqH.exe
  2⤵
  PID:7820
- C:\Windows\System\ZawmMmh.exe
  C:\Windows\System\ZawmMmh.exe
  2⤵
  PID:7836
- C:\Windows\System\FWduAcQ.exe
  C:\Windows\System\FWduAcQ.exe
  2⤵
  PID:7856
- C:\Windows\System\SiGngVe.exe
  C:\Windows\System\SiGngVe.exe
  2⤵
  PID:7924
- C:\Windows\System\WjubaqQ.exe
  C:\Windows\System\WjubaqQ.exe
  2⤵
  PID:7944
- C:\Windows\System\SxHUUkV.exe
  C:\Windows\System\SxHUUkV.exe
  2⤵
  PID:7960
- C:\Windows\System\YZcxjXb.exe
  C:\Windows\System\YZcxjXb.exe
  2⤵
  PID:7976
- C:\Windows\System\GWoLSuC.exe
  C:\Windows\System\GWoLSuC.exe
  2⤵
  PID:7992
- C:\Windows\System\FTseTxC.exe
  C:\Windows\System\FTseTxC.exe
  2⤵
  PID:8012
- C:\Windows\System\fTLlsWk.exe
  C:\Windows\System\fTLlsWk.exe
  2⤵
  PID:8028
- C:\Windows\System\bSnlAEl.exe
  C:\Windows\System\bSnlAEl.exe
  2⤵
  PID:8064
- C:\Windows\System\dBJtLRR.exe
  C:\Windows\System\dBJtLRR.exe
  2⤵
  PID:8092
- C:\Windows\System\YlvowVA.exe
  C:\Windows\System\YlvowVA.exe
  2⤵
  PID:8108
- C:\Windows\System\gIlByRi.exe
  C:\Windows\System\gIlByRi.exe
  2⤵
  PID:8124
- C:\Windows\System\IaJeaiI.exe
  C:\Windows\System\IaJeaiI.exe
  2⤵
  PID:8140
- C:\Windows\System\nvoQsoR.exe
  C:\Windows\System\nvoQsoR.exe
  2⤵
  PID:8156
- C:\Windows\System\brBKKsD.exe
  C:\Windows\System\brBKKsD.exe
  2⤵
  PID:8172
- C:\Windows\System\VuAquOu.exe
  C:\Windows\System\VuAquOu.exe
  2⤵
  PID:8188
- C:\Windows\System\tMcKyaY.exe
  C:\Windows\System\tMcKyaY.exe
  2⤵
  PID:7224
- C:\Windows\System\QmJpsJX.exe
  C:\Windows\System\QmJpsJX.exe
  2⤵
  PID:7240
- C:\Windows\System\yzTebdD.exe
  C:\Windows\System\yzTebdD.exe
  2⤵
  PID:7264
- C:\Windows\System\hneBEOt.exe
  C:\Windows\System\hneBEOt.exe
  2⤵
  PID:7096
- C:\Windows\System\DozQNXJ.exe
  C:\Windows\System\DozQNXJ.exe
  2⤵
  PID:6560
- C:\Windows\System\YYHfefg.exe
  C:\Windows\System\YYHfefg.exe
  2⤵
  PID:7176
- C:\Windows\System\bCbLguP.exe
  C:\Windows\System\bCbLguP.exe
  2⤵
  PID:6704
- C:\Windows\System\VuDLKgN.exe
  C:\Windows\System\VuDLKgN.exe
  2⤵
  PID:7272
- C:\Windows\System\XOzWwYQ.exe
  C:\Windows\System\XOzWwYQ.exe
  2⤵
  PID:7292
- C:\Windows\System\tGCPETT.exe
  C:\Windows\System\tGCPETT.exe
  2⤵
  PID:7308
- C:\Windows\System\dcQxolH.exe
  C:\Windows\System\dcQxolH.exe
  2⤵
  PID:6248
- C:\Windows\System\tfPMbKV.exe
  C:\Windows\System\tfPMbKV.exe
  2⤵
  PID:7348
- C:\Windows\System\YdPHOny.exe
  C:\Windows\System\YdPHOny.exe
  2⤵
  PID:7372
- C:\Windows\System\mTrrIrR.exe
  C:\Windows\System\mTrrIrR.exe
  2⤵
  PID:7440
- C:\Windows\System\wFsNYxI.exe
  C:\Windows\System\wFsNYxI.exe
  2⤵
  PID:7452
- C:\Windows\System\Oxxneag.exe
  C:\Windows\System\Oxxneag.exe
  2⤵
  PID:7388
- C:\Windows\System\CYedugi.exe
  C:\Windows\System\CYedugi.exe
  2⤵
  PID:7512
- C:\Windows\System\MNEYlXF.exe
  C:\Windows\System\MNEYlXF.exe
  2⤵
  PID:7496
- C:\Windows\System\KcnDdNw.exe
  C:\Windows\System\KcnDdNw.exe
  2⤵
  PID:7556
- C:\Windows\System\kFqTQln.exe
  C:\Windows\System\kFqTQln.exe
  2⤵
  PID:6892
- C:\Windows\System\MdBnNmt.exe
  C:\Windows\System\MdBnNmt.exe
  2⤵
  PID:7604
- C:\Windows\System\ROnXqBt.exe
  C:\Windows\System\ROnXqBt.exe
  2⤵
  PID:7816
- C:\Windows\System\sjAXSyu.exe
  C:\Windows\System\sjAXSyu.exe
  2⤵
  PID:7728
- C:\Windows\System\uPxlWPX.exe
  C:\Windows\System\uPxlWPX.exe
  2⤵
  PID:7696
- C:\Windows\System\vXmrIFE.exe
  C:\Windows\System\vXmrIFE.exe
  2⤵
  PID:7800
- C:\Windows\System\SFJwJMv.exe
  C:\Windows\System\SFJwJMv.exe
  2⤵
  PID:7868
- C:\Windows\System\eGNUsSi.exe
  C:\Windows\System\eGNUsSi.exe
  2⤵
  PID:7904
- C:\Windows\System\OAYXtNJ.exe
  C:\Windows\System\OAYXtNJ.exe
  2⤵
  PID:7920
- C:\Windows\System\SKKwrJc.exe
  C:\Windows\System\SKKwrJc.exe
  2⤵
  PID:7952
- C:\Windows\System\AaMcuZV.exe
  C:\Windows\System\AaMcuZV.exe
  2⤵
  PID:7956
- C:\Windows\System\driGbxk.exe
  C:\Windows\System\driGbxk.exe
  2⤵
  PID:8024
- C:\Windows\System\qwOcWlC.exe
  C:\Windows\System\qwOcWlC.exe
  2⤵
  PID:8044
- C:\Windows\System\AhuMAOK.exe
  C:\Windows\System\AhuMAOK.exe
  2⤵
  PID:8076
- C:\Windows\System\qlbbgUj.exe
  C:\Windows\System\qlbbgUj.exe
  2⤵
  PID:8116
- C:\Windows\System\QzAnwEm.exe
  C:\Windows\System\QzAnwEm.exe
  2⤵
  PID:8168
- C:\Windows\System\sUMmDyq.exe
  C:\Windows\System\sUMmDyq.exe
  2⤵
  PID:7084
- C:\Windows\System\IQmwiSt.exe
  C:\Windows\System\IQmwiSt.exe
  2⤵
  PID:7212
- C:\Windows\System\dWTNSGk.exe
  C:\Windows\System\dWTNSGk.exe
  2⤵
  PID:7284
- C:\Windows\System\AHwCFKo.exe
  C:\Windows\System\AHwCFKo.exe
  2⤵
  PID:7420
- C:\Windows\System\OMpnTUK.exe
  C:\Windows\System\OMpnTUK.exe
  2⤵
  PID:7892
- C:\Windows\System\GYsKBDU.exe
  C:\Windows\System\GYsKBDU.exe
  2⤵
  PID:7208
- C:\Windows\System\WJTOEmo.exe
  C:\Windows\System\WJTOEmo.exe
  2⤵
  PID:7268
- C:\Windows\System\eZhjhcA.exe
  C:\Windows\System\eZhjhcA.exe
  2⤵
  PID:7320
- C:\Windows\System\DyuNxCj.exe
  C:\Windows\System\DyuNxCj.exe
  2⤵
  PID:7332
- C:\Windows\System\aoRbKrj.exe
  C:\Windows\System\aoRbKrj.exe
  2⤵
  PID:7484
- C:\Windows\System\MJTLUNh.exe
  C:\Windows\System\MJTLUNh.exe
  2⤵
  PID:7424
- C:\Windows\System\VDstLfX.exe
  C:\Windows\System\VDstLfX.exe
  2⤵
  PID:7568
- C:\Windows\System\PIPgdNc.exe
  C:\Windows\System\PIPgdNc.exe
  2⤵
  PID:7640
- C:\Windows\System\AhGryBh.exe
  C:\Windows\System\AhGryBh.exe
  2⤵
  PID:7660
- C:\Windows\System\cxAptof.exe
  C:\Windows\System\cxAptof.exe
  2⤵
  PID:7716
- C:\Windows\System\rHIZCyz.exe
  C:\Windows\System\rHIZCyz.exe
  2⤵
  PID:7764
- C:\Windows\System\CTPcxvI.exe
  C:\Windows\System\CTPcxvI.exe
  2⤵
  PID:7752
- C:\Windows\System\TIHdmOt.exe
  C:\Windows\System\TIHdmOt.exe
  2⤵
  PID:7940
- C:\Windows\System\JjIFjRG.exe
  C:\Windows\System\JjIFjRG.exe
  2⤵
  PID:8020
- C:\Windows\System\OIRbmHv.exe
  C:\Windows\System\OIRbmHv.exe
  2⤵
  PID:7916
- C:\Windows\System\FNhjfJu.exe
  C:\Windows\System\FNhjfJu.exe
  2⤵
  PID:7784
- C:\Windows\System\ZTlkXHv.exe
  C:\Windows\System\ZTlkXHv.exe
  2⤵
  PID:8120
- C:\Windows\System\xvUZFgm.exe
  C:\Windows\System\xvUZFgm.exe
  2⤵
  PID:7508
- C:\Windows\System\VBVLsST.exe
  C:\Windows\System\VBVLsST.exe
  2⤵
  PID:6444
- C:\Windows\System\jpdudxZ.exe
  C:\Windows\System\jpdudxZ.exe
  2⤵
  PID:7564
- C:\Windows\System\lzxPKTT.exe
  C:\Windows\System\lzxPKTT.exe
  2⤵
  PID:7676
- C:\Windows\System\QPsDuwZ.exe
  C:\Windows\System\QPsDuwZ.exe
  2⤵
  PID:7636
- C:\Windows\System\cYeXrVl.exe
  C:\Windows\System\cYeXrVl.exe
  2⤵
  PID:7748
- C:\Windows\System\yTEreZG.exe
  C:\Windows\System\yTEreZG.exe
  2⤵
  PID:7832
- C:\Windows\System\JKMOhwJ.exe
  C:\Windows\System\JKMOhwJ.exe
  2⤵
  PID:8052
- C:\Windows\System\AfKwsMf.exe
  C:\Windows\System\AfKwsMf.exe
  2⤵
  PID:8132
- C:\Windows\System\ymWksLj.exe
  C:\Windows\System\ymWksLj.exe
  2⤵
  PID:7572
- C:\Windows\System\peWblRt.exe
  C:\Windows\System\peWblRt.exe
  2⤵
  PID:7004
- C:\Windows\System\HVBBipa.exe
  C:\Windows\System\HVBBipa.exe
  2⤵
  PID:7368
- C:\Windows\System\lDDAKoA.exe
  C:\Windows\System\lDDAKoA.exe
  2⤵
  PID:7972
- C:\Windows\System\HHoMbLM.exe
  C:\Windows\System\HHoMbLM.exe
  2⤵
  PID:6440
- C:\Windows\System\tmQvrgr.exe
  C:\Windows\System\tmQvrgr.exe
  2⤵
  PID:7548
- C:\Windows\System\QbRPihG.exe
  C:\Windows\System\QbRPihG.exe
  2⤵
  PID:7988
- C:\Windows\System\APdyVDu.exe
  C:\Windows\System\APdyVDu.exe
  2⤵
  PID:8164
- C:\Windows\System\RLmWkfO.exe
  C:\Windows\System\RLmWkfO.exe
  2⤵
  PID:8212
- C:\Windows\System\DgvhJQV.exe
  C:\Windows\System\DgvhJQV.exe
  2⤵
  PID:8228
- C:\Windows\System\zTaKZQl.exe
  C:\Windows\System\zTaKZQl.exe
  2⤵
  PID:8248
- C:\Windows\System\KMjHhiG.exe
  C:\Windows\System\KMjHhiG.exe
  2⤵
  PID:8264
- C:\Windows\System\KKVgrXU.exe
  C:\Windows\System\KKVgrXU.exe
  2⤵
  PID:8280
- C:\Windows\System\kKbFMFX.exe
  C:\Windows\System\kKbFMFX.exe
  2⤵
  PID:8304
- C:\Windows\System\CQfiuSw.exe
  C:\Windows\System\CQfiuSw.exe
  2⤵
  PID:8320
- C:\Windows\System\dezyOkf.exe
  C:\Windows\System\dezyOkf.exe
  2⤵
  PID:8344
- C:\Windows\System\wCqTAXA.exe
  C:\Windows\System\wCqTAXA.exe
  2⤵
  PID:8360
- C:\Windows\System\evpkMmz.exe
  C:\Windows\System\evpkMmz.exe
  2⤵
  PID:8380
- C:\Windows\System\fkPOFMH.exe
  C:\Windows\System\fkPOFMH.exe
  2⤵
  PID:8396
- C:\Windows\System\BSgtWle.exe
  C:\Windows\System\BSgtWle.exe
  2⤵
  PID:8412
- C:\Windows\System\UabTynh.exe
  C:\Windows\System\UabTynh.exe
  2⤵
  PID:8428
- C:\Windows\System\SrQZrJn.exe
  C:\Windows\System\SrQZrJn.exe
  2⤵
  PID:8456
- C:\Windows\System\JFitQnp.exe
  C:\Windows\System\JFitQnp.exe
  2⤵
  PID:8472
- C:\Windows\System\uCKkMLt.exe
  C:\Windows\System\uCKkMLt.exe
  2⤵
  PID:8492
- C:\Windows\System\QxuihER.exe
  C:\Windows\System\QxuihER.exe
  2⤵
  PID:8508
- C:\Windows\System\pOqLMUr.exe
  C:\Windows\System\pOqLMUr.exe
  2⤵
  PID:8524
- C:\Windows\System\tgGTGQN.exe
  C:\Windows\System\tgGTGQN.exe
  2⤵
  PID:8540
- C:\Windows\System\REuetNY.exe
  C:\Windows\System\REuetNY.exe
  2⤵
  PID:8664
- C:\Windows\System\zxbvKHq.exe
  C:\Windows\System\zxbvKHq.exe
  2⤵
  PID:8680
- C:\Windows\System\UgloohS.exe
  C:\Windows\System\UgloohS.exe
  2⤵
  PID:8696
- C:\Windows\System\mnScmpw.exe
  C:\Windows\System\mnScmpw.exe
  2⤵
  PID:8716
- C:\Windows\System\dHRsnhR.exe
  C:\Windows\System\dHRsnhR.exe
  2⤵
  PID:8732
- C:\Windows\System\vUFjskl.exe
  C:\Windows\System\vUFjskl.exe
  2⤵
  PID:8748
- C:\Windows\System\xblwaOr.exe
  C:\Windows\System\xblwaOr.exe
  2⤵
  PID:8768
- C:\Windows\System\sHGMgkm.exe
  C:\Windows\System\sHGMgkm.exe
  2⤵
  PID:8784
- C:\Windows\System\LZHasAd.exe
  C:\Windows\System\LZHasAd.exe
  2⤵
  PID:8804
- C:\Windows\System\HmPhAJI.exe
  C:\Windows\System\HmPhAJI.exe
  2⤵
  PID:8820
- C:\Windows\System\sdLpUqW.exe
  C:\Windows\System\sdLpUqW.exe
  2⤵
  PID:8840
- C:\Windows\System\SGnojXx.exe
  C:\Windows\System\SGnojXx.exe
  2⤵
  PID:8876
- C:\Windows\System\CpZBXea.exe
  C:\Windows\System\CpZBXea.exe
  2⤵
  PID:8892
- C:\Windows\System\jbnUhqk.exe
  C:\Windows\System\jbnUhqk.exe
  2⤵
  PID:8912
- C:\Windows\System\xNrRXwZ.exe
  C:\Windows\System\xNrRXwZ.exe
  2⤵
  PID:8928
- C:\Windows\System\nIVAPKQ.exe
  C:\Windows\System\nIVAPKQ.exe
  2⤵
  PID:8944
- C:\Windows\System\bLZZWzw.exe
  C:\Windows\System\bLZZWzw.exe
  2⤵
  PID:8964
- C:\Windows\System\VnkuFaM.exe
  C:\Windows\System\VnkuFaM.exe
  2⤵
  PID:8980
- C:\Windows\System\BwYVQbn.exe
  C:\Windows\System\BwYVQbn.exe
  2⤵
  PID:8996
- C:\Windows\System\KQPUYPR.exe
  C:\Windows\System\KQPUYPR.exe
  2⤵
  PID:9016
- C:\Windows\System\TzAppvb.exe
  C:\Windows\System\TzAppvb.exe
  2⤵
  PID:9032
- C:\Windows\System\vVrWISF.exe
  C:\Windows\System\vVrWISF.exe
  2⤵
  PID:9048
- C:\Windows\System\GpSqvZs.exe
  C:\Windows\System\GpSqvZs.exe
  2⤵
  PID:9068
- C:\Windows\System\zOMgEFP.exe
  C:\Windows\System\zOMgEFP.exe
  2⤵
  PID:9084
- C:\Windows\System\mzlDGus.exe
  C:\Windows\System\mzlDGus.exe
  2⤵
  PID:9112
- C:\Windows\System\KkyRCnh.exe
  C:\Windows\System\KkyRCnh.exe
  2⤵
  PID:9128
- C:\Windows\System\rqkloVU.exe
  C:\Windows\System\rqkloVU.exe
  2⤵
  PID:9144
- C:\Windows\System\PHuxfoO.exe
  C:\Windows\System\PHuxfoO.exe
  2⤵
  PID:9160
- C:\Windows\System\mTQUVnz.exe
  C:\Windows\System\mTQUVnz.exe
  2⤵
  PID:9176
- C:\Windows\System\PkFUDjp.exe
  C:\Windows\System\PkFUDjp.exe
  2⤵
  PID:9192
- C:\Windows\System\eVQYEny.exe
  C:\Windows\System\eVQYEny.exe
  2⤵
  PID:9212
- C:\Windows\System\XuOnYYK.exe
  C:\Windows\System\XuOnYYK.exe
  2⤵
  PID:8100
- C:\Windows\System\LoTIVDC.exe
  C:\Windows\System\LoTIVDC.exe
  2⤵
  PID:8200
- C:\Windows\System\sOjgpjD.exe
  C:\Windows\System\sOjgpjD.exe
  2⤵
  PID:7300
- C:\Windows\System\QSlukEO.exe
  C:\Windows\System\QSlukEO.exe
  2⤵
  PID:7192
- C:\Windows\System\FcQTmIY.exe
  C:\Windows\System\FcQTmIY.exe
  2⤵
  PID:8260
- C:\Windows\System\eKRmHfo.exe
  C:\Windows\System\eKRmHfo.exe
  2⤵
  PID:8312
- C:\Windows\System\DwMRfBD.exe
  C:\Windows\System\DwMRfBD.exe
  2⤵
  PID:8420
- C:\Windows\System\IhjNfqn.exe
  C:\Windows\System\IhjNfqn.exe
  2⤵
  PID:7324
- C:\Windows\System\Ezfghfi.exe
  C:\Windows\System\Ezfghfi.exe
  2⤵
  PID:8340
- C:\Windows\System\HjeJmfa.exe
  C:\Windows\System\HjeJmfa.exe
  2⤵
  PID:8408
- C:\Windows\System\RDAyWtL.exe
  C:\Windows\System\RDAyWtL.exe
  2⤵
  PID:8536
- C:\Windows\System\BMXDDkw.exe
  C:\Windows\System\BMXDDkw.exe
  2⤵
  PID:8588
- C:\Windows\System\oXOwBBi.exe
  C:\Windows\System\oXOwBBi.exe
  2⤵
  PID:8620
- C:\Windows\System\sOKrpzg.exe
  C:\Windows\System\sOKrpzg.exe
  2⤵
  PID:8640
- C:\Windows\System\mwSfSiB.exe
  C:\Windows\System\mwSfSiB.exe
  2⤵
  PID:8704
- C:\Windows\System\UASMnkB.exe
  C:\Windows\System\UASMnkB.exe
  2⤵
  PID:8780
- C:\Windows\System\zLLoeFM.exe
  C:\Windows\System\zLLoeFM.exe
  2⤵
  PID:8756
- C:\Windows\System\YMHlnTk.exe
  C:\Windows\System\YMHlnTk.exe
  2⤵
  PID:8864
- C:\Windows\System\oDFNHvi.exe
  C:\Windows\System\oDFNHvi.exe
  2⤵
  PID:8976
- C:\Windows\System\PavxEbF.exe
  C:\Windows\System\PavxEbF.exe
  2⤵
  PID:9076
- C:\Windows\System\mjwcmtY.exe
  C:\Windows\System\mjwcmtY.exe
  2⤵
  PID:9152
- C:\Windows\System\bVTYyNR.exe
  C:\Windows\System\bVTYyNR.exe
  2⤵
  PID:8208
- C:\Windows\System\ndTWuNE.exe
  C:\Windows\System\ndTWuNE.exe
  2⤵
  PID:8888
- C:\Windows\System\ShRSoBI.exe
  C:\Windows\System\ShRSoBI.exe
  2⤵
  PID:8956
- C:\Windows\System\nleNsHl.exe
  C:\Windows\System\nleNsHl.exe
  2⤵
  PID:8236
- C:\Windows\System\fWYwmoB.exe
  C:\Windows\System\fWYwmoB.exe
  2⤵
  PID:8272
- C:\Windows\System\YkCITuO.exe
  C:\Windows\System\YkCITuO.exe
  2⤵
  PID:8184
- C:\Windows\System\bEEUsDO.exe
  C:\Windows\System\bEEUsDO.exe
  2⤵
  PID:9140
- C:\Windows\System\qkdFkXb.exe
  C:\Windows\System\qkdFkXb.exe
  2⤵
  PID:9028
- C:\Windows\System\AqpHJGa.exe
  C:\Windows\System\AqpHJGa.exe
  2⤵
  PID:8872
- C:\Windows\System\ySxOptH.exe
  C:\Windows\System\ySxOptH.exe
  2⤵
  PID:9204
- C:\Windows\System\yxrfQxO.exe
  C:\Windows\System\yxrfQxO.exe
  2⤵
  PID:9108
- C:\Windows\System\lEBUkTO.exe
  C:\Windows\System\lEBUkTO.exe
  2⤵
  PID:9060
- C:\Windows\System\vjzdUDg.exe
  C:\Windows\System\vjzdUDg.exe
  2⤵
  PID:8300
- C:\Windows\System\wTkxPaJ.exe
  C:\Windows\System\wTkxPaJ.exe
  2⤵
  PID:8152
- C:\Windows\System\yBFjkMJ.exe
  C:\Windows\System\yBFjkMJ.exe
  2⤵
  PID:8316
- C:\Windows\System\jdmCUOj.exe
  C:\Windows\System\jdmCUOj.exe
  2⤵
  PID:8392
- C:\Windows\System\tcJwFKf.exe
  C:\Windows\System\tcJwFKf.exe
  2⤵
  PID:8440
- C:\Windows\System\KnLpLky.exe
  C:\Windows\System\KnLpLky.exe
  2⤵
  PID:8464
- C:\Windows\System\ZahLXdC.exe
  C:\Windows\System\ZahLXdC.exe
  2⤵
  PID:8368
- C:\Windows\System\lxczBSO.exe
  C:\Windows\System\lxczBSO.exe
  2⤵
  PID:8484
- C:\Windows\System\LAKBfIn.exe
  C:\Windows\System\LAKBfIn.exe
  2⤵
  PID:8576
- C:\Windows\System\xQFmjrG.exe
  C:\Windows\System\xQFmjrG.exe
  2⤵
  PID:8628
- C:\Windows\System\TkqljAR.exe
  C:\Windows\System\TkqljAR.exe
  2⤵
  PID:8740
- C:\Windows\System\GheYXGg.exe
  C:\Windows\System\GheYXGg.exe
  2⤵
  PID:8860
- C:\Windows\System\LPkqwWv.exe
  C:\Windows\System\LPkqwWv.exe
  2⤵
  PID:8816
- C:\Windows\System\QuKnJtn.exe
  C:\Windows\System\QuKnJtn.exe
  2⤵
  PID:8596
- C:\Windows\System\FLsKirl.exe
  C:\Windows\System\FLsKirl.exe
  2⤵
  PID:8652
- C:\Windows\System\mqqPEtl.exe
  C:\Windows\System\mqqPEtl.exe
  2⤵
  PID:8676
- C:\Windows\System\RGKhIHR.exe
  C:\Windows\System\RGKhIHR.exe
  2⤵
  PID:8904
- C:\Windows\System\nkLPDYH.exe
  C:\Windows\System\nkLPDYH.exe
  2⤵
  PID:8764
- C:\Windows\System\omjFeZp.exe
  C:\Windows\System\omjFeZp.exe
  2⤵
  PID:9120
- C:\Windows\System\evkDOEF.exe
  C:\Windows\System\evkDOEF.exe
  2⤵
  PID:9184
- C:\Windows\System\rzttsmT.exe
  C:\Windows\System\rzttsmT.exe
  2⤵
  PID:7624
- C:\Windows\System\ZFNGyzH.exe
  C:\Windows\System\ZFNGyzH.exe
  2⤵
  PID:8992
- C:\Windows\System\vDpgCpm.exe
  C:\Windows\System\vDpgCpm.exe
  2⤵
  PID:8712
- C:\Windows\System\PqOChYk.exe
  C:\Windows\System\PqOChYk.exe
  2⤵
  PID:8468
- C:\Windows\System\BYxLcxg.exe
  C:\Windows\System\BYxLcxg.exe
  2⤵
  PID:8220
- C:\Windows\System\VByMLxJ.exe
  C:\Windows\System\VByMLxJ.exe
  2⤵
  PID:8036
- C:\Windows\System\qNRBsGF.exe
  C:\Windows\System\qNRBsGF.exe
  2⤵
  PID:8564
- C:\Windows\System\zbfPvjr.exe
  C:\Windows\System\zbfPvjr.exe
  2⤵
  PID:8648
- C:\Windows\System\cCyvEmg.exe
  C:\Windows\System\cCyvEmg.exe
  2⤵
  PID:8520
- C:\Windows\System\iIGBgJb.exe
  C:\Windows\System\iIGBgJb.exe
  2⤵
  PID:8656
- C:\Windows\System\vebDkSw.exe
  C:\Windows\System\vebDkSw.exe
  2⤵
  PID:8672
- C:\Windows\System\pnNaxSt.exe
  C:\Windows\System\pnNaxSt.exe
  2⤵
  PID:9104
- C:\Windows\System\xBqOBsW.exe
  C:\Windows\System\xBqOBsW.exe
  2⤵
  PID:7936
- C:\Windows\System\ykwXQok.exe
  C:\Windows\System\ykwXQok.exe
  2⤵
  PID:8292
- C:\Windows\System\yzkNaEx.exe
  C:\Windows\System\yzkNaEx.exe
  2⤵
  PID:9064
- C:\Windows\System\bOQRaOM.exe
  C:\Windows\System\bOQRaOM.exe
  2⤵
  PID:8356
- C:\Windows\System\gEacIKf.exe
  C:\Windows\System\gEacIKf.exe
  2⤵
  PID:8376
- C:\Windows\System\FsGtyoP.exe
  C:\Windows\System\FsGtyoP.exe
  2⤵
  PID:8256
- C:\Windows\System\KcvJGVO.exe
  C:\Windows\System\KcvJGVO.exe
  2⤵
  PID:8556
- C:\Windows\System\dAsLkpu.exe
  C:\Windows\System\dAsLkpu.exe
  2⤵
  PID:8608
- C:\Windows\System\RStIfzR.exe
  C:\Windows\System\RStIfzR.exe
  2⤵
  PID:8056
- C:\Windows\System\uAFWSuP.exe
  C:\Windows\System\uAFWSuP.exe
  2⤵
  PID:9168
- C:\Windows\System\uRMthwB.exe
  C:\Windows\System\uRMthwB.exe
  2⤵
  PID:8884
- C:\Windows\System\vsPGkLo.exe
  C:\Windows\System\vsPGkLo.exe
  2⤵
  PID:8688
- C:\Windows\System\hvsEnnN.exe
  C:\Windows\System\hvsEnnN.exe
  2⤵
  PID:8760
- C:\Windows\System\MnoaOcw.exe
  C:\Windows\System\MnoaOcw.exe
  2⤵
  PID:8924
- C:\Windows\System\YdJnTHA.exe
  C:\Windows\System\YdJnTHA.exe
  2⤵
  PID:8812
- C:\Windows\System\AGSVVvW.exe
  C:\Windows\System\AGSVVvW.exe
  2⤵
  PID:8744
- C:\Windows\System\hdefCLf.exe
  C:\Windows\System\hdefCLf.exe
  2⤵
  PID:7356
- C:\Windows\System\gIAfcxa.exe
  C:\Windows\System\gIAfcxa.exe
  2⤵
  PID:8448
- C:\Windows\System\ufgBfpT.exe
  C:\Windows\System\ufgBfpT.exe
  2⤵
  PID:8836
- C:\Windows\System\LaZkbPt.exe
  C:\Windows\System\LaZkbPt.exe
  2⤵
  PID:8552
- C:\Windows\System\VquCIOX.exe
  C:\Windows\System\VquCIOX.exe
  2⤵
  PID:8592
- C:\Windows\System\PmVITfM.exe
  C:\Windows\System\PmVITfM.exe
  2⤵
  PID:9012
- C:\Windows\System\RPXZBaT.exe
  C:\Windows\System\RPXZBaT.exe
  2⤵
  PID:9228
- C:\Windows\System\zYjWGfm.exe
  C:\Windows\System\zYjWGfm.exe
  2⤵
  PID:9244
- C:\Windows\System\gbksvUK.exe
  C:\Windows\System\gbksvUK.exe
  2⤵
  PID:9264
- C:\Windows\System\GbchEXl.exe
  C:\Windows\System\GbchEXl.exe
  2⤵
  PID:9288
- C:\Windows\System\UoOGvZN.exe
  C:\Windows\System\UoOGvZN.exe
  2⤵
  PID:9304
- C:\Windows\System\ReIVBJL.exe
  C:\Windows\System\ReIVBJL.exe
  2⤵
  PID:9336
- C:\Windows\System\uEWINNu.exe
  C:\Windows\System\uEWINNu.exe
  2⤵
  PID:9352
- C:\Windows\System\BuJvLHt.exe
  C:\Windows\System\BuJvLHt.exe
  2⤵
  PID:9368
- C:\Windows\System\eEXdQUH.exe
  C:\Windows\System\eEXdQUH.exe
  2⤵
  PID:9384
- C:\Windows\System\uCctwLq.exe
  C:\Windows\System\uCctwLq.exe
  2⤵
  PID:9404
- C:\Windows\System\JqUGsKG.exe
  C:\Windows\System\JqUGsKG.exe
  2⤵
  PID:9424
- C:\Windows\System\nRoVIsG.exe
  C:\Windows\System\nRoVIsG.exe
  2⤵
  PID:9440
- C:\Windows\System\AJTZWIE.exe
  C:\Windows\System\AJTZWIE.exe
  2⤵
  PID:9456
- C:\Windows\System\OsBsfRU.exe
  C:\Windows\System\OsBsfRU.exe
  2⤵
  PID:9476
- C:\Windows\System\ZnzDKLp.exe
  C:\Windows\System\ZnzDKLp.exe
  2⤵
  PID:9492
- C:\Windows\System\ucWvEwM.exe
  C:\Windows\System\ucWvEwM.exe
  2⤵
  PID:9508
- C:\Windows\System\INVjEJC.exe
  C:\Windows\System\INVjEJC.exe
  2⤵
  PID:9524
- C:\Windows\System\DRDFBAq.exe
  C:\Windows\System\DRDFBAq.exe
  2⤵
  PID:9540
- C:\Windows\System\dsUgCKn.exe
  C:\Windows\System\dsUgCKn.exe
  2⤵
  PID:9560
- C:\Windows\System\OnXcfvJ.exe
  C:\Windows\System\OnXcfvJ.exe
  2⤵
  PID:9576
- C:\Windows\System\LqXFFvc.exe
  C:\Windows\System\LqXFFvc.exe
  2⤵
  PID:9592
- C:\Windows\System\YYYhLPs.exe
  C:\Windows\System\YYYhLPs.exe
  2⤵
  PID:9608
- C:\Windows\System\MvxfcKN.exe
  C:\Windows\System\MvxfcKN.exe
  2⤵
  PID:9624
- C:\Windows\System\uwKqfkG.exe
  C:\Windows\System\uwKqfkG.exe
  2⤵
  PID:9660
- C:\Windows\System\QKYAtAS.exe
  C:\Windows\System\QKYAtAS.exe
  2⤵
  PID:9676
- C:\Windows\System\pZWFzZh.exe
  C:\Windows\System\pZWFzZh.exe
  2⤵
  PID:9700
- C:\Windows\System\NdHqneb.exe
  C:\Windows\System\NdHqneb.exe
  2⤵
  PID:9716
- C:\Windows\System\gFbJiHY.exe
  C:\Windows\System\gFbJiHY.exe
  2⤵
  PID:9732
- C:\Windows\System\kLfEioj.exe
  C:\Windows\System\kLfEioj.exe
  2⤵
  PID:9752
- C:\Windows\System\BjAHZyX.exe
  C:\Windows\System\BjAHZyX.exe
  2⤵
  PID:9776
- C:\Windows\System\cSYfJJe.exe
  C:\Windows\System\cSYfJJe.exe
  2⤵
  PID:9796
- C:\Windows\System\jAYCGHg.exe
  C:\Windows\System\jAYCGHg.exe
  2⤵
  PID:9888
- C:\Windows\System\IpYzVfG.exe
  C:\Windows\System\IpYzVfG.exe
  2⤵
  PID:9904
- C:\Windows\System\sZurAjh.exe
  C:\Windows\System\sZurAjh.exe
  2⤵
  PID:9920
- C:\Windows\System\YQcDcfa.exe
  C:\Windows\System\YQcDcfa.exe
  2⤵
  PID:9936
- C:\Windows\System\KuGIVlW.exe
  C:\Windows\System\KuGIVlW.exe
  2⤵
  PID:9952
- C:\Windows\System\tavFuaN.exe
  C:\Windows\System\tavFuaN.exe
  2⤵
  PID:9968
- C:\Windows\System\VgDGgoO.exe
  C:\Windows\System\VgDGgoO.exe
  2⤵
  PID:9984
- C:\Windows\System\izFcZRE.exe
  C:\Windows\System\izFcZRE.exe
  2⤵
  PID:10004
- C:\Windows\System\dXNIPSM.exe
  C:\Windows\System\dXNIPSM.exe
  2⤵
  PID:10020
- C:\Windows\System\CvhckMH.exe
  C:\Windows\System\CvhckMH.exe
  2⤵
  PID:10036
- C:\Windows\System\sOqJFjD.exe
  C:\Windows\System\sOqJFjD.exe
  2⤵
  PID:10052
- C:\Windows\System\OWxdlDj.exe
  C:\Windows\System\OWxdlDj.exe
  2⤵
  PID:10072
- C:\Windows\System\fuoTPjy.exe
  C:\Windows\System\fuoTPjy.exe
  2⤵
  PID:10088
- C:\Windows\System\ZVMjuzE.exe
  C:\Windows\System\ZVMjuzE.exe
  2⤵
  PID:10108
- C:\Windows\System\QpjkgHN.exe
  C:\Windows\System\QpjkgHN.exe
  2⤵
  PID:10168
- C:\Windows\System\uUsIMFX.exe
  C:\Windows\System\uUsIMFX.exe
  2⤵
  PID:10184
- C:\Windows\System\LyvYayq.exe
  C:\Windows\System\LyvYayq.exe
  2⤵
  PID:10200
- C:\Windows\System\ajqBpDH.exe
  C:\Windows\System\ajqBpDH.exe
  2⤵
  PID:10216
- C:\Windows\System\zXqxgHm.exe
  C:\Windows\System\zXqxgHm.exe
  2⤵
  PID:10232
- C:\Windows\System\suwoQOe.exe
  C:\Windows\System\suwoQOe.exe
  2⤵
  PID:8908
- C:\Windows\System\KRlKvpR.exe
  C:\Windows\System\KRlKvpR.exe
  2⤵
  PID:9044
- C:\Windows\System\UDCKKct.exe
  C:\Windows\System\UDCKKct.exe
  2⤵
  PID:9284
- C:\Windows\System\oILRtez.exe
  C:\Windows\System\oILRtez.exe
  2⤵
  PID:9324
- C:\Windows\System\nbEFJfW.exe
  C:\Windows\System\nbEFJfW.exe
  2⤵
  PID:9392
- C:\Windows\System\zMkUmHz.exe
  C:\Windows\System\zMkUmHz.exe
  2⤵
  PID:9464
- C:\Windows\System\miPQaXE.exe
  C:\Windows\System\miPQaXE.exe
  2⤵
  PID:9532
- C:\Windows\System\pXOVwwU.exe
  C:\Windows\System\pXOVwwU.exe
  2⤵
  PID:9572
- C:\Windows\System\Bmtupwl.exe
  C:\Windows\System\Bmtupwl.exe
  2⤵
  PID:9640
- C:\Windows\System\aJDuhxI.exe
  C:\Windows\System\aJDuhxI.exe
  2⤵
  PID:9684
- C:\Windows\System\WWTLFgR.exe
  C:\Windows\System\WWTLFgR.exe
  2⤵
  PID:9724
- C:\Windows\System\QiJUZfQ.exe
  C:\Windows\System\QiJUZfQ.exe
  2⤵
  PID:9220
- C:\Windows\System\cSdqxwZ.exe
  C:\Windows\System\cSdqxwZ.exe
  2⤵
  PID:9808
- C:\Windows\System\jylVCuP.exe
  C:\Windows\System\jylVCuP.exe
  2⤵
  PID:9588
- C:\Windows\System\nOqVSBn.exe
  C:\Windows\System\nOqVSBn.exe
  2⤵
  PID:9668
- C:\Windows\System\ohSvCOq.exe
  C:\Windows\System\ohSvCOq.exe
  2⤵
  PID:9744
- C:\Windows\System\EIHRJSM.exe
  C:\Windows\System\EIHRJSM.exe
  2⤵
  PID:9348
- C:\Windows\System\CmuYunt.exe
  C:\Windows\System\CmuYunt.exe
  2⤵
  PID:9548
- C:\Windows\System\auZPZAv.exe
  C:\Windows\System\auZPZAv.exe
  2⤵
  PID:9788
- C:\Windows\System\XFafmRt.exe
  C:\Windows\System\XFafmRt.exe
  2⤵
  PID:9836
- C:\Windows\System\wzQVcMu.exe
  C:\Windows\System\wzQVcMu.exe
  2⤵
  PID:9852
- C:\Windows\System\RvzucMe.exe
  C:\Windows\System\RvzucMe.exe
  2⤵
  PID:9864
- C:\Windows\System\RbQApFp.exe
  C:\Windows\System\RbQApFp.exe
  2⤵
  PID:9880
- C:\Windows\System\fOKtvCu.exe
  C:\Windows\System\fOKtvCu.exe
  2⤵
  PID:9980
- C:\Windows\System\lNRwUUC.exe
  C:\Windows\System\lNRwUUC.exe
  2⤵
  PID:10048
- C:\Windows\System\FHEBpAF.exe
  C:\Windows\System\FHEBpAF.exe
  2⤵
  PID:10028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CnBgbUA.exe

Filesize
1.6MB

MD5
3ee310e107405007e3470f0d6061c8ba

SHA1
05d3ba38e40927051b9e73edaa15606f455f9b7b

SHA256
d93a8ca24aa3708f779c5096efb985f6b7c9a67a19707822a5ac46bd75aedafa

SHA512
fba7e9c14bbccb81c373b990047e920f5d7cb6cf8972b86177384d8aa8cd155aa1ca8e8a010d99467d712c563742358752ea22efcc2b4f92e429bac1078f6a66

Download Submit
C:\Windows\system\CxGQZvS.exe

Filesize
1.6MB

MD5
3ff9e78036d324b9ab8ff2198f264b22

SHA1
526171ee44604075135fa75ae69f9c154ad6b8e0

SHA256
d24987426a1445659b80cea6d93cbc7546c02669d98a45841c644eac3468273b

SHA512
c40b0458cf89b46e9694a05aa54b34c40a6d05eaa8ec350c6f4de49b0322f252346809de44666c5e0c40ac4775c64aed63e784d28d25b89ed45bfd91585d1c50

Download Submit
C:\Windows\system\FdSBCmA.exe

Filesize
1.6MB

MD5
f53675284300b6dc04b90f69e9c29adf

SHA1
956b7bb453f90fb6881677bed74f8dd2a25d23b1

SHA256
ad710188bbc8a3f22fee5f95fe900f4285e5eb1e72ff5f069b3905c44d063ed3

SHA512
952e070fc99297e2838125c1f78255230bde2e474bc7c34048b19663b0f2485cad5d69704c0e1b377349dec18d49840ae5b5f252798a9bc41b38e20783845021

Download Submit
C:\Windows\system\FsbfrBA.exe

Filesize
1.6MB

MD5
e3da58e956339b0128be985486f971f8

SHA1
863042507af45ccdc376f8832a25caca3ba001ed

SHA256
1c334faf924b5fb54854f91de6a8fbabdb00d1048f44d798c423e7082fe9bbc7

SHA512
8f26ff02ca326530141f1a17ace0e67e354c2ce779bc1fb8f996639364fbe8f337611b2958da1af12b4ee33822afe23c6b8ad68e7cef0f54686f3ed23847e05d

Download Submit
C:\Windows\system\HQKXFyr.exe

Filesize
1.6MB

MD5
910a6ea935a942ba4e21457543cf4c73

SHA1
56ba63130e386850a7631ea838a91f773fe661ad

SHA256
5c1b754a4aaae3090f10c5ace5e51b0afe361fdfb38f60b2e1e16baec206f0d4

SHA512
a075203fbc619e9378fc34adcd19fed4232575bbf288403c3d171d8ded7803eaad9d3e6fa6e18fe51e7389b8bb5cc18f9f8dddea805967b0694368c5b93faac5

Download Submit
C:\Windows\system\KEbBjkT.exe

Filesize
1.6MB

MD5
b9ba6b93a4df696bdc226c486599f241

SHA1
906c17b1da295ab2ac626cdb63f291bd4ef3de80

SHA256
66b25aa1c0feab3b8d61f75eafc911161953a062515c4fbeed3333bfa88473c6

SHA512
b2c1b8f0c60e4597c7b82a00afe65312ff05013c490ff8be297cf2cc8263e7f85a9126266ce3916e5d068c4c6a5dff26e1eca07201d8da32e4b2cf0d87f4cbac

Download Submit
C:\Windows\system\LTpeGwa.exe

Filesize
1.6MB

MD5
de299db09e8dda44077b3f300e27243b

SHA1
2cd99b6e98f7d4ffecc10247236bae4fc4ee418f

SHA256
694cccdaecd3cf8ac3d9986f773a66fa5697524fd7bcc3319db219deeae975b3

SHA512
1f479008192fbc1cb3160d08bf5819ed2f55d2eae271acc9afb2e90817908654663c1d874c8689f8b023ce96fa1eb48efbdc8a3307a736458433e8a04d316319

Download Submit
C:\Windows\system\NWWzJSH.exe

Filesize
1.6MB

MD5
eeb58c3ae75329dcd0af2f4dc0f23cf4

SHA1
1cfabc80e68fa331f7d60113ac689a3a80fb3c99

SHA256
305f3e9e3d5f9cc74a4ecad2b727eccae61e0888abd838044a03a533eb116793

SHA512
b569138d039db259503daea39488f89a6b23d76fa734845421c0552b6b56cacd8cf73010df7b766426f2c61419fd31d94b428f78d8ab3c39d249f28a2545f905

Download Submit
C:\Windows\system\OLykjNC.exe

Filesize
1.6MB

MD5
b185cc52f7cc1fafb851618b1903d485

SHA1
4297ffe2450b49b7da14f99db52a8fbdc2c3ec2f

SHA256
7d8856bccc693ff29b85172743df88128ac3055a680d6d83495a750ed5c874c3

SHA512
3c4378193f41bc3b1375aebe19855a57f86092c6f6d52ac4f5343fbbc1a448a2003e376f965d6a0f0c595c48513767f0bfc7a05bb70183fb5aac3d2018869a87

Download Submit
C:\Windows\system\PNVBGhc.exe

Filesize
1.6MB

MD5
6ce52a27a9c4d64880c648a46d5f087c

SHA1
f41a4906c05ad419ee126467d6918e61c7316f30

SHA256
558639078877da4f0155456f5bb7ea7c72fa9eb298d4c3807ce9a034e32ad550

SHA512
514a748957c23bfa4ed9bcecb99a93a0251ffaf2df5df872342f134417880e047b1c5f528342064fdaa403860c836a4aad1d8fc873bacf8171afcea216ae0679

Download Submit
C:\Windows\system\RlYNcyx.exe

Filesize
1.6MB

MD5
68a217f269249e2a1a4780e12e25dc7b

SHA1
8053bf3d6e409e73cfd909d7f305297e4a27610f

SHA256
b84df81d2a1e88c92cd0217d5ac10b0d26d4a4b9524392fabb24c95b1a579c6e

SHA512
3c4accd2be4f9678b0b78480f5914ecd39fb8130303cdf303e19b619b69981fdb2592ca7abbbd08142d7da0d84cd99f990b85a4c2db62a49e9f75453beccfa9d

Download Submit
C:\Windows\system\Sajuxpn.exe

Filesize
1.6MB

MD5
6fa268776d6544b281cfcf412593a35b

SHA1
9fe640895bac5cd92d2bd964fd7402013fd828fa

SHA256
3ed661472376e1783482fd3e2c206d86a91b971fa60980c94d66ff641f815e35

SHA512
80c65c063757af97b483183d486257683c3d6a362e1e36c61df5b8e910fbb793e168bba57356ef5ee2e004e11b663ab10bfcc4b59f5a44579d5b0d83a8e7f41d

Download Submit
C:\Windows\system\SfhBeRc.exe

Filesize
1.6MB

MD5
ab104df06ed38dfb305df70885c8ddb3

SHA1
4b4b6f818d6f96e64f2317c2df12455819ef555e

SHA256
c352a921fa45ed28ec833f9e0f89aed1ee36232ba4eef7fd7981a81836a74a6f

SHA512
883358e30adee7736a7aca9184fdeb9e1f4ac4e35f873774c708ecadcfea0b7b928aa8597f4e30601b567b02f1d138f69ea9917d0a03513db2b8af0f4ca343cd

Download Submit
C:\Windows\system\SpHWtTW.exe

Filesize
1.6MB

MD5
7cad99bc332fe08f4084a12b956c5b1c

SHA1
a1ed2212e19e8389f6550825cfb835ccad67a5e7

SHA256
770b0ef614f912301caefcafc4934ccf99de1607eb7c3bc0444e3d85f4573635

SHA512
82b09ef0d796e025d4217b8e7083e3a835cf115777f96e4d91f457b5ad6062d988eaaa81bfe190109ce852b33699d9a59bf15b5da881d715d45b59a92bebe4ff

Download Submit
C:\Windows\system\YkjrmPp.exe

Filesize
1.6MB

MD5
7fe2a039d7cba554a20e32be0badb85d

SHA1
9fea72afaf8dfb9cd03148f3f427d7aa7b6bde3d

SHA256
618cca7f99ce75af92a2006db499a16399ae1ab382d0247c899c18d8b2de7f1c

SHA512
82d7b53005ce1d30c7e4b124b0c059f811624c681f00a6a970cabb4a2bb151345688ac85b5b9620b9706abe2c01ed803f22f26aaa4e750a90f85e869b91f616f

Download Submit
C:\Windows\system\ZgtiWqx.exe

Filesize
1.6MB

MD5
3856c65b2799700ec6c24b01270f3a0e

SHA1
a545806618b890bac398787ca226c4a504628a3f

SHA256
16edaa93c40b5c0ac6c8a8229b360ac6b2d7b32c5a4f4ad898b581c0e8a0ff17

SHA512
c6ff4467a85fcd88f26fee2ae0827442c90f3241abd74f834732e11333b94d42ec9dc6cdfc22bbd9f5c9f52b61a0a79da982089f0c04e40d0550483b8b2dcfee

Download Submit
C:\Windows\system\avYHymb.exe

Filesize
1.6MB

MD5
d06ed1944553e6ac0787ae93a5270927

SHA1
d41c4a51635f80008c5f50385c4a48a090c45fc3

SHA256
12e8ebe4aa6a24c229ed4159dfaef40e241245fe5ced3174d0dd02ca583f6a55

SHA512
fa038bb3ae7124914355c0ca61237cfb8cf7b697c6c8704569fe28f7ebab7785159a9bd9f96e393fc56ec612db641956e04cbd88df1f70cbe8a67f9ff1ba504c

Download Submit
C:\Windows\system\bmDvjBg.exe

Filesize
1.6MB

MD5
877cd1cb9d9e25e292815cb3e76d4fcf

SHA1
f284f49df63defcba52b6ae754065fbf5f07d38c

SHA256
af215b2ce000aaf8f92dd12b53aba751f67c7064bdc58b423accbfad994c3550

SHA512
949ed84627b766820eb888f2f6503da2be12d79417f41da2537e74b4984613e61e95fafe24abe6375663d8f04ab79c86389d69c32f7e49f1c6f0b0663f906e3a

Download Submit
C:\Windows\system\cupkVJq.exe

Filesize
1.6MB

MD5
54d9c1459c293c9995cac956d6991272

SHA1
6e8d81486167bf6f027b0b50cd6e688f12996ffe

SHA256
33808e6b58ac6f9d89aa815b0a8189d1ad86e660b806871d48561298c570333f

SHA512
8392d34a56511ad1ee062a89dc7fafdb0a15e4ef43f3746d063489aed8e1709117a6c7d22e5aada83381fcaffb70dec23cc298c0ff97319f7a99fb05587761dd

Download Submit
C:\Windows\system\eERYUzD.exe

Filesize
1.6MB

MD5
308e2649af14ac6726916f38c1a08ef5

SHA1
b98665ae32769d9e2bbb097709a1f5b08300cfc9

SHA256
745f688ad6667a3221172d96e6dd424d4436962184c10042bc4b34f722c8920a

SHA512
d6b8e3ec10b449932ff8420fbd976f32712a830cbe1713cbae01b6318a74b438477d3eefee884e3c7547bf7a670c14b9756db1b8178e42f1a0e33d51074d77bb

Download Submit
C:\Windows\system\eLfqqvc.exe

Filesize
1.6MB

MD5
e960dee7a1c2934c66e51205b6ca95e1

SHA1
e7f72090c7cdd87a27309ace2c099c93cdac9363

SHA256
74430d14abf59074ab0dbf2c045b41ef6c006d6cf7b18db451ccfce682cd8f1a

SHA512
360fa4acc88f279ff3a6d187baae96ef19d0b241c121f274832b0b13363ff49d8e38d22897e9c203c1c92bf60115e69f95e6b54d7b9e1b589af4ebe653c39541

Download Submit
C:\Windows\system\ltwajpa.exe

Filesize
1.6MB

MD5
cabefbec43d8002882dc7bbe9dc05965

SHA1
dd10b374cbde21c798abc2b2bb47bbd2bcf18498

SHA256
180f730fcac7f0f3b3f84293e4711324253b8041bf8cb3384c6475603ee7b194

SHA512
cd62320c5657096d21fcbb13172a8787a662ae4210de3808be19212df95a26d0a825d9e94e848b752caccc8570803bc7e1d63efd5def7e70f161a1566657cc09

Download Submit
C:\Windows\system\nbSFlXa.exe

Filesize
1.6MB

MD5
57c89580d5b8e74e29093e340c4acc8e

SHA1
5255d21f23f8f44edb34541787300137fe75ed10

SHA256
ed7adc9e32dc41772037c144495d25c8a9bcad2778f1cea12004b55e9d8bfc03

SHA512
2e2ebf9f44600ced3e6285d57364cf74285ea9517227cfd5ec7bc2b488eaa00c44749d3f9b19d2a44e27b7a4647e58a7a4f61b97cda86527b0c16d75cd1ee51d

Download Submit
C:\Windows\system\qBdKtuU.exe

Filesize
1.6MB

MD5
060371da2cf0054a7399b5077ad50304

SHA1
41ef03a831b79bf50b5c1873222c6f0e485db9f8

SHA256
a116599f94a158e1c6c146b73f1e3d9abb4fbc2c3e53b297b8d90c6adf8e71ef

SHA512
02310de2c40881a4745f04f6e04ff63fd49073e2ed751f64d132f6768bdce5827e8f7c934361f980208cd53aec9e10ae6b4c285adb622cb41655f7153a222e27

Download Submit
C:\Windows\system\qDfaxXO.exe

Filesize
1.6MB

MD5
e75e9fcfdcc2d92184fd4783f36a9bc6

SHA1
d6bf6dbb37e7ee9225aac77bc157ffa901b89f96

SHA256
fc58e0fab27a224df0b3693a0774b52a6ad3743acc69507a03151890472aa89c

SHA512
25b8c1df6ba84f1fb0f3272a96ac461347e78517bcdec734fae68e3791bf9f2eb8583af69547b6f9cd8592883eb51ca3fa999dc465c02b0d4d4becd57bc1f60f

Download Submit
C:\Windows\system\tkXiEzm.exe

Filesize
1.6MB

MD5
bc96edd8522d30ece6d3aec853b04d62

SHA1
966d1adb85bf8a723ed588453638c12eb37db224

SHA256
0c81fa451fcd2f791fdbb08484bc44addf0150ccc94e6b3c30924253a4c2fbf7

SHA512
26c845ddb5f53d0aac7cca2895e265b6c2fb147763dcbda9409ec0b9a37faa4315995c0419950fdd6822ed3e8a202bd25a25e88c51094a34fbeb3eb6380da2c3

Download Submit
C:\Windows\system\vsnTUFB.exe

Filesize
1.6MB

MD5
a9ed332a5dcf91b27d2205c42990d07e

SHA1
60e351b906eb31ae3f277215e0e0b806483e6767

SHA256
add76cb3519f5d6325d8655f1a9c711c7d54b6199a0843f4a312031fd2514c3e

SHA512
de5a94ad9f177e45648623a32c2a23b5fa18212fc15927006ba6adafe0930b2b3c40cecb372d955a9d8cc148681761b424cdf97e043acb9039dacb40d86ee949

Download Submit
C:\Windows\system\xfFjrZW.exe

Filesize
1.6MB

MD5
726cdc6f08b4c2717872efea49a8200b

SHA1
59add1a9f3e60f9b37fa71752277c3fb108f2690

SHA256
c77461d702b37385fa57705e5f2e52ddeeecb21b860233a2af64c27a0aa04787

SHA512
114f849f8bf4a4afcc5a7cede8332c90eda7e56349f79b8ccee1d6df2f7fcbcdbdc3ec3701be9d1029fa74226c1ecb875ac856217faa3dc2c3e192b0ed7cb605

Download Submit
C:\Windows\system\zORDGKZ.exe

Filesize
1.6MB

MD5
41a3f68ee81790b784bf56af0e9b0006

SHA1
0ed1d7b0268d381423f2db9fc53d5981611b151d

SHA256
15e074b06f2c651ff90a03aaa1c79ed5bd2e514aa6bd249376ae7411ae28f8dc

SHA512
daf7384e4ba6ac52dc51ba5573e9803c1e3ca528958fdbe1b6760b1df589cf0ab49d514755f46fe003c6cdeeccafdac436d3b1f0e0393dc2a682117f6e62af75

Download Submit
\Windows\system\TxQBXoG.exe

Filesize
1.6MB

MD5
048bca79463ab35ce086ec10bf8c4c68

SHA1
a84fd968e0803c98b2340286d30804503c0aee77

SHA256
4096fa7e5d22995e0e8203c6ce913103b479c6638ac953dab60befd9de5d2c9d

SHA512
eb070abb3cacac464302cfc9d4e016f1d8cf6ab9d97db915b4023c58508dbe547b356a7b618f8f21518e556a17398453d9b06fc8b204045d5a542074b938761d

Download Submit
\Windows\system\oIHmJpG.exe

Filesize
1.6MB

MD5
f8da1f12515f5a27b6f98af3ee7bbe4a

SHA1
6d53879cba0c3788a2707366b7d03db130cfeb78

SHA256
83c784a7eb31b568228ab30dde41c1b1461f2eaa1fb2faf0afb63adff4f0ba12

SHA512
6084d376cbad7e1b86376070f26207b134531b7b3e9f1462d0b865940f255be0fb61cf9e67f10998080414c633d07547827f8291106515050defab423e91d037

Download Submit
\Windows\system\xSsjqpp.exe

Filesize
1.6MB

MD5
0e8a6ca42fa793bcc1e070d5d1acf8d4

SHA1
66ea2177a8a570369d1ed6b73cae07b1ef29626f

SHA256
e4bd879c3ca77c1e27ea501a4009c8d2184a4b954a4bb5aa75860ca2237998a6

SHA512
dc7ef93c78a2482ad9f60fdef416d3ec6c42d15eecefeab1b013871fcd7b79d500c3e437e562b56888415a69934a4cb79f7ae628de877ada782f3892c8200fc5

Download Submit
memory/2176-1573-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2176-72-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2556-49-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2556-3536-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2596-3539-0x000000013FCC0000-0x0000000140011000-memory.dmp

Filesize
3.3MB

Download
memory/2596-67-0x000000013FCC0000-0x0000000140011000-memory.dmp

Filesize
3.3MB

Download
memory/2624-3515-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2624-65-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2656-3540-0x000000013FBD0000-0x000000013FF21000-memory.dmp

Filesize
3.3MB

Download
memory/2656-68-0x000000013FBD0000-0x000000013FF21000-memory.dmp

Filesize
3.3MB

Download
memory/2684-36-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-0-0x000000013F750000-0x000000013FAA1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2684-2515-0x0000000001E30000-0x0000000002181000-memory.dmp

Filesize
3.3MB

Download
memory/2684-2341-0x0000000001E30000-0x0000000002181000-memory.dmp

Filesize
3.3MB

Download
memory/2684-78-0x000000013F1C0000-0x000000013F511000-memory.dmp

Filesize
3.3MB

Download
memory/2684-86-0x000000013F750000-0x000000013FAA1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-100-0x0000000001E30000-0x0000000002181000-memory.dmp

Filesize
3.3MB

Download
memory/2684-44-0x000000013FCC0000-0x0000000140011000-memory.dmp

Filesize
3.3MB

Download
memory/2684-43-0x000000013FBD0000-0x000000013FF21000-memory.dmp

Filesize
3.3MB

Download
memory/2684-13-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2684-32-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2684-29-0x0000000001E30000-0x0000000002181000-memory.dmp

Filesize
3.3MB

Download
memory/2720-1878-0x000000013F1C0000-0x000000013F511000-memory.dmp

Filesize
3.3MB

Download
memory/2720-3602-0x000000013F1C0000-0x000000013F511000-memory.dmp

Filesize
3.3MB

Download
memory/2720-79-0x000000013F1C0000-0x000000013F511000-memory.dmp

Filesize
3.3MB

Download
memory/2732-87-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2732-3577-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2732-2154-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2800-3543-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2800-66-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2812-50-0x000000013FE90000-0x00000001401E1000-memory.dmp

Filesize
3.3MB

Download
memory/2812-3545-0x000000013FE90000-0x00000001401E1000-memory.dmp

Filesize
3.3MB

Download
memory/2856-2342-0x000000013FA80000-0x000000013FDD1000-memory.dmp

Filesize
3.3MB

Download
memory/2856-94-0x000000013FA80000-0x000000013FDD1000-memory.dmp

Filesize
3.3MB

Download
memory/2856-3605-0x000000013FA80000-0x000000013FDD1000-memory.dmp

Filesize
3.3MB

Download
memory/2864-93-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2864-24-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2864-3563-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2972-3537-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/2972-63-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/3008-3535-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/3008-47-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/3056-3534-0x000000013F6F0000-0x000000013FA41000-memory.dmp

Filesize
3.3MB

Download
memory/3056-64-0x000000013F6F0000-0x000000013FA41000-memory.dmp

Filesize
3.3MB

Download