xmrig | f0b531724559e1eba3bc3ba6f365d40d88b1608cc89699740b4300d306f640ca

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
Size

1.5MB
MD5

84e7c18b87bded6c7accb2121e3fefa0
SHA1

63e98d35febd54e2b71ed08a8ad5f170dfd53332
SHA256

f0b531724559e1eba3bc3ba6f365d40d88b1608cc89699740b4300d306f640ca
SHA512

a156133d6bf8e0bc90142ca3d1ab02c3b5c6315acd132d390be43ac85e6cb40620753c262267815afdc8f525fcf5bd983809004961cd6938577dff4c8ed3734f
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbc+KGALE:BemTLkNdfE0pZrE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000146e6-9.dat	xmrig
behavioral1/files/0x00320000000144e4-7.dat	xmrig
behavioral1/files/0x000b00000001424e-6.dat	xmrig
behavioral1/memory/2856-2-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d28-107.dat	xmrig
behavioral1/files/0x0006000000015d4a-111.dat	xmrig
behavioral1/files/0x0006000000015d6f-132.dat	xmrig
behavioral1/files/0x0006000000015d8f-147.dat	xmrig
behavioral1/files/0x00060000000161e7-187.dat	xmrig
behavioral1/files/0x0006000000016117-182.dat	xmrig
behavioral1/files/0x00320000000144f0-177.dat	xmrig
behavioral1/files/0x0006000000015fe9-172.dat	xmrig
behavioral1/files/0x0006000000015f6d-167.dat	xmrig
behavioral1/files/0x0006000000015e3a-158.dat	xmrig
behavioral1/files/0x0006000000015eaf-161.dat	xmrig
behavioral1/files/0x0006000000015d9b-152.dat	xmrig
behavioral1/files/0x0006000000015d79-137.dat	xmrig
behavioral1/files/0x0006000000015d87-142.dat	xmrig
behavioral1/files/0x0006000000015d67-127.dat	xmrig
behavioral1/files/0x0006000000015d5e-122.dat	xmrig
behavioral1/files/0x0006000000015d56-117.dat	xmrig
behavioral1/memory/2612-106-0x000000013FAC0000-0x000000013FE14000-memory.dmp	xmrig
behavioral1/files/0x0006000000015ceb-105.dat	xmrig
behavioral1/memory/2552-104-0x000000013F100000-0x000000013F454000-memory.dmp	xmrig
behavioral1/memory/2588-103-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/memory/2444-101-0x000000013F420000-0x000000013F774000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cd5-100.dat	xmrig
behavioral1/memory/2600-99-0x000000013F960000-0x000000013FCB4000-memory.dmp	xmrig
behavioral1/memory/2828-98-0x000000013F9E0000-0x000000013FD34000-memory.dmp	xmrig
behavioral1/memory/552-97-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/memory/2880-96-0x000000013F170000-0x000000013F4C4000-memory.dmp	xmrig
behavioral1/memory/2536-94-0x000000013F580000-0x000000013F8D4000-memory.dmp	xmrig
behavioral1/memory/2724-93-0x000000013F6D0000-0x000000013FA24000-memory.dmp	xmrig
behavioral1/files/0x0006000000015ca6-85.dat	xmrig
behavioral1/files/0x0006000000015d07-83.dat	xmrig
behavioral1/files/0x0006000000015ce1-82.dat	xmrig
behavioral1/files/0x0006000000015cba-81.dat	xmrig
behavioral1/files/0x0006000000015be6-80.dat	xmrig
behavioral1/files/0x0009000000014971-79.dat	xmrig
behavioral1/files/0x0007000000014726-78.dat	xmrig
behavioral1/memory/2568-76-0x000000013F3F0000-0x000000013F744000-memory.dmp	xmrig
behavioral1/files/0x000700000001568c-75.dat	xmrig
behavioral1/files/0x0007000000014857-70.dat	xmrig
behavioral1/files/0x000700000001471d-64.dat	xmrig
behavioral1/memory/2332-49-0x000000013F300000-0x000000013F654000-memory.dmp	xmrig
behavioral1/memory/1520-21-0x000000013FC60000-0x000000013FFB4000-memory.dmp	xmrig
behavioral1/memory/2856-3898-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig
behavioral1/memory/1520-3899-0x000000013FC60000-0x000000013FFB4000-memory.dmp	xmrig
behavioral1/memory/2332-3900-0x000000013F300000-0x000000013F654000-memory.dmp	xmrig
behavioral1/memory/2568-3901-0x000000013F3F0000-0x000000013F744000-memory.dmp	xmrig
behavioral1/memory/2600-3903-0x000000013F960000-0x000000013FCB4000-memory.dmp	xmrig
behavioral1/memory/2724-3902-0x000000013F6D0000-0x000000013FA24000-memory.dmp	xmrig
behavioral1/memory/2880-3904-0x000000013F170000-0x000000013F4C4000-memory.dmp	xmrig
behavioral1/memory/2444-3907-0x000000013F420000-0x000000013F774000-memory.dmp	xmrig
behavioral1/memory/2612-3908-0x000000013FAC0000-0x000000013FE14000-memory.dmp	xmrig
behavioral1/memory/2552-3909-0x000000013F100000-0x000000013F454000-memory.dmp	xmrig
behavioral1/memory/2828-3910-0x000000013F9E0000-0x000000013FD34000-memory.dmp	xmrig
behavioral1/memory/2588-3911-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/memory/2536-3906-0x000000013F580000-0x000000013F8D4000-memory.dmp	xmrig
behavioral1/memory/552-3905-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1520	oZJGXEk.exe
2332	xvifjJp.exe
2568	mAHLUDM.exe
2724	pVfTUsk.exe
2552	JwPAGrL.exe
2612	nFisHRM.exe
2536	IVXFJdQ.exe
2880	QIzyJmg.exe
552	IscEJBQ.exe
2828	ZncSWYM.exe
2600	tPvanRa.exe
2444	IxFDxNq.exe
2588	ydfWQvm.exe
2208	kwPmDCO.exe
2740	KZhXONh.exe
2504	SqfCKCY.exe
2308	cEPUJrE.exe
1220	DwmXfkf.exe
292	gswEDiO.exe
1044	HlZzGZn.exe
1692	oWxssXn.exe
2604	rpBGvop.exe
2624	OejBDzK.exe
1616	ahGPOeP.exe
1672	YbycPnJ.exe
2964	RWsXJXW.exe
2088	EmagHUp.exe
1916	xzJAawv.exe
2876	pILMJPm.exe
2412	eOjYLFg.exe
532	GnnHqff.exe
1304	Rbhbion.exe
1108	DrGZtEJ.exe
2104	MNXZIhX.exe
1808	rgHhwAB.exe
1500	oZLtZUB.exe
2368	ByltQke.exe
2844	cWDVDJq.exe
2256	jQJZhfG.exe
848	shltrxc.exe
1532	kFgBLHQ.exe
1712	tKcPMAn.exe
1800	FFblmcS.exe
1868	CEERguV.exe
1032	TxQJpMS.exe
1628	XICryMF.exe
1640	mlIasXK.exe
920	PAkeeah.exe
2900	NEyaZEw.exe
1724	UYqeLFS.exe
2164	zNqmrfq.exe
1516	NYYhmAZ.exe
1504	xHAADzM.exe
3060	UMXQUjP.exe
892	mEJvUmi.exe
1760	YrTQhtb.exe
1932	eEgfLxa.exe
1196	SvtLAOp.exe
2908	noqKpXd.exe
1456	qPURioz.exe
2692	NAjAVKQ.exe
2224	fYBYQja.exe
2720	iWbRbOD.exe
2864	JFzHRxH.exe

Loads dropped DLL 64 IoCs

pid	Process
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000146e6-9.dat	upx
behavioral1/files/0x00320000000144e4-7.dat	upx
behavioral1/files/0x000b00000001424e-6.dat	upx
behavioral1/memory/2856-2-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/files/0x0006000000015d28-107.dat	upx
behavioral1/files/0x0006000000015d4a-111.dat	upx
behavioral1/files/0x0006000000015d6f-132.dat	upx
behavioral1/files/0x0006000000015d8f-147.dat	upx
behavioral1/files/0x00060000000161e7-187.dat	upx
behavioral1/files/0x0006000000016117-182.dat	upx
behavioral1/files/0x00320000000144f0-177.dat	upx
behavioral1/files/0x0006000000015fe9-172.dat	upx
behavioral1/files/0x0006000000015f6d-167.dat	upx
behavioral1/files/0x0006000000015e3a-158.dat	upx
behavioral1/files/0x0006000000015eaf-161.dat	upx
behavioral1/files/0x0006000000015d9b-152.dat	upx
behavioral1/files/0x0006000000015d79-137.dat	upx
behavioral1/files/0x0006000000015d87-142.dat	upx
behavioral1/files/0x0006000000015d67-127.dat	upx
behavioral1/files/0x0006000000015d5e-122.dat	upx
behavioral1/files/0x0006000000015d56-117.dat	upx
behavioral1/memory/2612-106-0x000000013FAC0000-0x000000013FE14000-memory.dmp	upx
behavioral1/files/0x0006000000015ceb-105.dat	upx
behavioral1/memory/2552-104-0x000000013F100000-0x000000013F454000-memory.dmp	upx
behavioral1/memory/2588-103-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/memory/2444-101-0x000000013F420000-0x000000013F774000-memory.dmp	upx
behavioral1/files/0x0006000000015cd5-100.dat	upx
behavioral1/memory/2600-99-0x000000013F960000-0x000000013FCB4000-memory.dmp	upx
behavioral1/memory/2828-98-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx
behavioral1/memory/552-97-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/memory/2880-96-0x000000013F170000-0x000000013F4C4000-memory.dmp	upx
behavioral1/memory/2536-94-0x000000013F580000-0x000000013F8D4000-memory.dmp	upx
behavioral1/memory/2724-93-0x000000013F6D0000-0x000000013FA24000-memory.dmp	upx
behavioral1/files/0x0006000000015ca6-85.dat	upx
behavioral1/files/0x0006000000015d07-83.dat	upx
behavioral1/files/0x0006000000015ce1-82.dat	upx
behavioral1/files/0x0006000000015cba-81.dat	upx
behavioral1/files/0x0006000000015be6-80.dat	upx
behavioral1/files/0x0009000000014971-79.dat	upx
behavioral1/files/0x0007000000014726-78.dat	upx
behavioral1/memory/2568-76-0x000000013F3F0000-0x000000013F744000-memory.dmp	upx
behavioral1/files/0x000700000001568c-75.dat	upx
behavioral1/files/0x0007000000014857-70.dat	upx
behavioral1/files/0x000700000001471d-64.dat	upx
behavioral1/memory/2332-49-0x000000013F300000-0x000000013F654000-memory.dmp	upx
behavioral1/memory/1520-21-0x000000013FC60000-0x000000013FFB4000-memory.dmp	upx
behavioral1/memory/2856-3898-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/memory/1520-3899-0x000000013FC60000-0x000000013FFB4000-memory.dmp	upx
behavioral1/memory/2332-3900-0x000000013F300000-0x000000013F654000-memory.dmp	upx
behavioral1/memory/2568-3901-0x000000013F3F0000-0x000000013F744000-memory.dmp	upx
behavioral1/memory/2600-3903-0x000000013F960000-0x000000013FCB4000-memory.dmp	upx
behavioral1/memory/2724-3902-0x000000013F6D0000-0x000000013FA24000-memory.dmp	upx
behavioral1/memory/2880-3904-0x000000013F170000-0x000000013F4C4000-memory.dmp	upx
behavioral1/memory/2444-3907-0x000000013F420000-0x000000013F774000-memory.dmp	upx
behavioral1/memory/2612-3908-0x000000013FAC0000-0x000000013FE14000-memory.dmp	upx
behavioral1/memory/2552-3909-0x000000013F100000-0x000000013F454000-memory.dmp	upx
behavioral1/memory/2828-3910-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx
behavioral1/memory/2588-3911-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/memory/2536-3906-0x000000013F580000-0x000000013F8D4000-memory.dmp	upx
behavioral1/memory/552-3905-0x000000013FE20000-0x0000000140174000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FKATZNf.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\hmMvVVS.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\JoZaEES.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\GopGPJz.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\EBiycPg.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\AToMnCt.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\MMmqkQQ.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\mhrzYUo.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\qxSXsOa.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\QwdJkfl.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\ZyHmWyE.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\MZUPzQl.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\PdweZwe.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\vzAPxyo.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\skmBAhB.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\kbZdUEL.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\frHRGYV.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\MPjtPzh.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\yJjnOsf.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\IkhLvyV.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\FWRTEGH.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\QGJIUzN.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\foLMblF.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\WaKovrm.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\uvkvAwV.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\ESLqDhl.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\gIWqKTh.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\ydfWQvm.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\MWqBUYx.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\yWHuziV.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\XBGxVtb.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\hulwXCR.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\duZsEFN.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\JlqDlnu.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\pQamjBr.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\DtmhOsg.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\MFLbMiZ.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\dWkQDhZ.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\nKgZOvz.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\TFSsXmP.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\jaBhGDB.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\FBzOvTT.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\EjGFyWp.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\TkHkLfH.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\jTsfwqf.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\RVHkjvP.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\LtwXpKM.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\LuuMhUB.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\DmLeWtt.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\vesIhGl.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\gqIEGns.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\NQVmloV.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\HBBhoRn.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\yLetTyZ.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\ojijqCK.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\YUUUzYS.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\YJlBJVx.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\wKBPviX.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\BtLuxvC.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\XszodDu.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\vsFwPTJ.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\lwaeVWq.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\DfIzBrL.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
File created	C:\Windows\System\RFnQWSv.exe	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 1520	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	29
PID 2856 wrote to memory of 1520	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	29
PID 2856 wrote to memory of 1520	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	29
PID 2856 wrote to memory of 2332	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	30
PID 2856 wrote to memory of 2332	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	30
PID 2856 wrote to memory of 2332	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	30
PID 2856 wrote to memory of 2612	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	31
PID 2856 wrote to memory of 2612	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	31
PID 2856 wrote to memory of 2612	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	31
PID 2856 wrote to memory of 2568	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	32
PID 2856 wrote to memory of 2568	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	32
PID 2856 wrote to memory of 2568	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	32
PID 2856 wrote to memory of 2536	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	33
PID 2856 wrote to memory of 2536	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	33
PID 2856 wrote to memory of 2536	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	33
PID 2856 wrote to memory of 2724	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	34
PID 2856 wrote to memory of 2724	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	34
PID 2856 wrote to memory of 2724	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	34
PID 2856 wrote to memory of 2880	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	35
PID 2856 wrote to memory of 2880	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	35
PID 2856 wrote to memory of 2880	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	35
PID 2856 wrote to memory of 2552	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	36
PID 2856 wrote to memory of 2552	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	36
PID 2856 wrote to memory of 2552	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	36
PID 2856 wrote to memory of 552	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	37
PID 2856 wrote to memory of 552	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	37
PID 2856 wrote to memory of 552	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	37
PID 2856 wrote to memory of 2588	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	38
PID 2856 wrote to memory of 2588	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	38
PID 2856 wrote to memory of 2588	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	38
PID 2856 wrote to memory of 2828	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	39
PID 2856 wrote to memory of 2828	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	39
PID 2856 wrote to memory of 2828	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	39
PID 2856 wrote to memory of 2208	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	40
PID 2856 wrote to memory of 2208	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	40
PID 2856 wrote to memory of 2208	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	40
PID 2856 wrote to memory of 2600	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	41
PID 2856 wrote to memory of 2600	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	41
PID 2856 wrote to memory of 2600	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	41
PID 2856 wrote to memory of 2740	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	42
PID 2856 wrote to memory of 2740	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	42
PID 2856 wrote to memory of 2740	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	42
PID 2856 wrote to memory of 2444	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	43
PID 2856 wrote to memory of 2444	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	43
PID 2856 wrote to memory of 2444	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	43
PID 2856 wrote to memory of 2504	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	44
PID 2856 wrote to memory of 2504	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	44
PID 2856 wrote to memory of 2504	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	44
PID 2856 wrote to memory of 2308	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	45
PID 2856 wrote to memory of 2308	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	45
PID 2856 wrote to memory of 2308	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	45
PID 2856 wrote to memory of 1220	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	46
PID 2856 wrote to memory of 1220	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	46
PID 2856 wrote to memory of 1220	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	46
PID 2856 wrote to memory of 292	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	47
PID 2856 wrote to memory of 292	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	47
PID 2856 wrote to memory of 292	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	47
PID 2856 wrote to memory of 1044	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	48
PID 2856 wrote to memory of 1044	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	48
PID 2856 wrote to memory of 1044	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	48
PID 2856 wrote to memory of 1692	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	49
PID 2856 wrote to memory of 1692	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	49
PID 2856 wrote to memory of 1692	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	49
PID 2856 wrote to memory of 2604	2856	84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\84e7c18b87bded6c7accb2121e3fefa0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\System\oZJGXEk.exe
  C:\Windows\System\oZJGXEk.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\xvifjJp.exe
  C:\Windows\System\xvifjJp.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\nFisHRM.exe
  C:\Windows\System\nFisHRM.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\mAHLUDM.exe
  C:\Windows\System\mAHLUDM.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\IVXFJdQ.exe
  C:\Windows\System\IVXFJdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\pVfTUsk.exe
  C:\Windows\System\pVfTUsk.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\QIzyJmg.exe
  C:\Windows\System\QIzyJmg.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\JwPAGrL.exe
  C:\Windows\System\JwPAGrL.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\IscEJBQ.exe
  C:\Windows\System\IscEJBQ.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\ydfWQvm.exe
  C:\Windows\System\ydfWQvm.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ZncSWYM.exe
  C:\Windows\System\ZncSWYM.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\kwPmDCO.exe
  C:\Windows\System\kwPmDCO.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\tPvanRa.exe
  C:\Windows\System\tPvanRa.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\KZhXONh.exe
  C:\Windows\System\KZhXONh.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\IxFDxNq.exe
  C:\Windows\System\IxFDxNq.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\SqfCKCY.exe
  C:\Windows\System\SqfCKCY.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\cEPUJrE.exe
  C:\Windows\System\cEPUJrE.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\DwmXfkf.exe
  C:\Windows\System\DwmXfkf.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\gswEDiO.exe
  C:\Windows\System\gswEDiO.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\HlZzGZn.exe
  C:\Windows\System\HlZzGZn.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\oWxssXn.exe
  C:\Windows\System\oWxssXn.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\rpBGvop.exe
  C:\Windows\System\rpBGvop.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\OejBDzK.exe
  C:\Windows\System\OejBDzK.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\ahGPOeP.exe
  C:\Windows\System\ahGPOeP.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\YbycPnJ.exe
  C:\Windows\System\YbycPnJ.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\RWsXJXW.exe
  C:\Windows\System\RWsXJXW.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\EmagHUp.exe
  C:\Windows\System\EmagHUp.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\xzJAawv.exe
  C:\Windows\System\xzJAawv.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\pILMJPm.exe
  C:\Windows\System\pILMJPm.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\eOjYLFg.exe
  C:\Windows\System\eOjYLFg.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\GnnHqff.exe
  C:\Windows\System\GnnHqff.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\Rbhbion.exe
  C:\Windows\System\Rbhbion.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\DrGZtEJ.exe
  C:\Windows\System\DrGZtEJ.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\MNXZIhX.exe
  C:\Windows\System\MNXZIhX.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\rgHhwAB.exe
  C:\Windows\System\rgHhwAB.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\oZLtZUB.exe
  C:\Windows\System\oZLtZUB.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ByltQke.exe
  C:\Windows\System\ByltQke.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\cWDVDJq.exe
  C:\Windows\System\cWDVDJq.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\jQJZhfG.exe
  C:\Windows\System\jQJZhfG.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\shltrxc.exe
  C:\Windows\System\shltrxc.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\kFgBLHQ.exe
  C:\Windows\System\kFgBLHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\tKcPMAn.exe
  C:\Windows\System\tKcPMAn.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\FFblmcS.exe
  C:\Windows\System\FFblmcS.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\CEERguV.exe
  C:\Windows\System\CEERguV.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\TxQJpMS.exe
  C:\Windows\System\TxQJpMS.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\XICryMF.exe
  C:\Windows\System\XICryMF.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\mlIasXK.exe
  C:\Windows\System\mlIasXK.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\PAkeeah.exe
  C:\Windows\System\PAkeeah.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\NEyaZEw.exe
  C:\Windows\System\NEyaZEw.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\UYqeLFS.exe
  C:\Windows\System\UYqeLFS.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\zNqmrfq.exe
  C:\Windows\System\zNqmrfq.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\NYYhmAZ.exe
  C:\Windows\System\NYYhmAZ.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\xHAADzM.exe
  C:\Windows\System\xHAADzM.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\UMXQUjP.exe
  C:\Windows\System\UMXQUjP.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\mEJvUmi.exe
  C:\Windows\System\mEJvUmi.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\YrTQhtb.exe
  C:\Windows\System\YrTQhtb.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\eEgfLxa.exe
  C:\Windows\System\eEgfLxa.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\SvtLAOp.exe
  C:\Windows\System\SvtLAOp.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\noqKpXd.exe
  C:\Windows\System\noqKpXd.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\qPURioz.exe
  C:\Windows\System\qPURioz.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\NAjAVKQ.exe
  C:\Windows\System\NAjAVKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\fYBYQja.exe
  C:\Windows\System\fYBYQja.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\iWbRbOD.exe
  C:\Windows\System\iWbRbOD.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\JFzHRxH.exe
  C:\Windows\System\JFzHRxH.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\cmgrcHu.exe
  C:\Windows\System\cmgrcHu.exe
  2⤵
  PID:2484
- C:\Windows\System\gXEucsR.exe
  C:\Windows\System\gXEucsR.exe
  2⤵
  PID:2432
- C:\Windows\System\wPBgzVr.exe
  C:\Windows\System\wPBgzVr.exe
  2⤵
  PID:2516
- C:\Windows\System\fyoPvBz.exe
  C:\Windows\System\fyoPvBz.exe
  2⤵
  PID:2792
- C:\Windows\System\XRrxgJj.exe
  C:\Windows\System\XRrxgJj.exe
  2⤵
  PID:2488
- C:\Windows\System\wIcerDd.exe
  C:\Windows\System\wIcerDd.exe
  2⤵
  PID:1376
- C:\Windows\System\KYKpKLv.exe
  C:\Windows\System\KYKpKLv.exe
  2⤵
  PID:304
- C:\Windows\System\LcBarsO.exe
  C:\Windows\System\LcBarsO.exe
  2⤵
  PID:2028
- C:\Windows\System\aYZWvez.exe
  C:\Windows\System\aYZWvez.exe
  2⤵
  PID:2768
- C:\Windows\System\bvOcvcd.exe
  C:\Windows\System\bvOcvcd.exe
  2⤵
  PID:1540
- C:\Windows\System\WmeseJI.exe
  C:\Windows\System\WmeseJI.exe
  2⤵
  PID:1636
- C:\Windows\System\FsAPqpY.exe
  C:\Windows\System\FsAPqpY.exe
  2⤵
  PID:3008
- C:\Windows\System\XjhbNBG.exe
  C:\Windows\System\XjhbNBG.exe
  2⤵
  PID:2176
- C:\Windows\System\lFEfuMX.exe
  C:\Windows\System\lFEfuMX.exe
  2⤵
  PID:1160
- C:\Windows\System\TFVmKyp.exe
  C:\Windows\System\TFVmKyp.exe
  2⤵
  PID:992
- C:\Windows\System\KaGsgyz.exe
  C:\Windows\System\KaGsgyz.exe
  2⤵
  PID:996
- C:\Windows\System\NLfRcTc.exe
  C:\Windows\System\NLfRcTc.exe
  2⤵
  PID:2924
- C:\Windows\System\cJVhnfV.exe
  C:\Windows\System\cJVhnfV.exe
  2⤵
  PID:448
- C:\Windows\System\OETdUzB.exe
  C:\Windows\System\OETdUzB.exe
  2⤵
  PID:2300
- C:\Windows\System\tbEFtyi.exe
  C:\Windows\System\tbEFtyi.exe
  2⤵
  PID:2252
- C:\Windows\System\IRtaBBM.exe
  C:\Windows\System\IRtaBBM.exe
  2⤵
  PID:1536
- C:\Windows\System\UWbuAXY.exe
  C:\Windows\System\UWbuAXY.exe
  2⤵
  PID:2036
- C:\Windows\System\YBQtfyU.exe
  C:\Windows\System\YBQtfyU.exe
  2⤵
  PID:936
- C:\Windows\System\vFBsJeY.exe
  C:\Windows\System\vFBsJeY.exe
  2⤵
  PID:2872
- C:\Windows\System\ASyUtCD.exe
  C:\Windows\System\ASyUtCD.exe
  2⤵
  PID:916
- C:\Windows\System\MWqBUYx.exe
  C:\Windows\System\MWqBUYx.exe
  2⤵
  PID:2860
- C:\Windows\System\oqjjaFk.exe
  C:\Windows\System\oqjjaFk.exe
  2⤵
  PID:308
- C:\Windows\System\xCsLYVs.exe
  C:\Windows\System\xCsLYVs.exe
  2⤵
  PID:2044
- C:\Windows\System\RlnhxCI.exe
  C:\Windows\System\RlnhxCI.exe
  2⤵
  PID:2344
- C:\Windows\System\tGNnKLN.exe
  C:\Windows\System\tGNnKLN.exe
  2⤵
  PID:1940
- C:\Windows\System\TaAvehg.exe
  C:\Windows\System\TaAvehg.exe
  2⤵
  PID:1568
- C:\Windows\System\ejZUKqr.exe
  C:\Windows\System\ejZUKqr.exe
  2⤵
  PID:2052
- C:\Windows\System\BvBMwyc.exe
  C:\Windows\System\BvBMwyc.exe
  2⤵
  PID:2392
- C:\Windows\System\ZMicSNJ.exe
  C:\Windows\System\ZMicSNJ.exe
  2⤵
  PID:1152
- C:\Windows\System\bBTAUFO.exe
  C:\Windows\System\bBTAUFO.exe
  2⤵
  PID:1300
- C:\Windows\System\EVcASuO.exe
  C:\Windows\System\EVcASuO.exe
  2⤵
  PID:2732
- C:\Windows\System\puoaRnZ.exe
  C:\Windows\System\puoaRnZ.exe
  2⤵
  PID:2800
- C:\Windows\System\IjhzJcl.exe
  C:\Windows\System\IjhzJcl.exe
  2⤵
  PID:2240
- C:\Windows\System\ukupHKE.exe
  C:\Windows\System\ukupHKE.exe
  2⤵
  PID:500
- C:\Windows\System\CdgjHvK.exe
  C:\Windows\System\CdgjHvK.exe
  2⤵
  PID:1792
- C:\Windows\System\NGYpayD.exe
  C:\Windows\System\NGYpayD.exe
  2⤵
  PID:896
- C:\Windows\System\idenZvG.exe
  C:\Windows\System\idenZvG.exe
  2⤵
  PID:3092
- C:\Windows\System\ndlxozP.exe
  C:\Windows\System\ndlxozP.exe
  2⤵
  PID:3112
- C:\Windows\System\zBfnIYq.exe
  C:\Windows\System\zBfnIYq.exe
  2⤵
  PID:3132
- C:\Windows\System\UMPLXIg.exe
  C:\Windows\System\UMPLXIg.exe
  2⤵
  PID:3152
- C:\Windows\System\mlQYTRX.exe
  C:\Windows\System\mlQYTRX.exe
  2⤵
  PID:3176
- C:\Windows\System\aYMkzoK.exe
  C:\Windows\System\aYMkzoK.exe
  2⤵
  PID:3192
- C:\Windows\System\YJeeWcD.exe
  C:\Windows\System\YJeeWcD.exe
  2⤵
  PID:3216
- C:\Windows\System\tGWGvTt.exe
  C:\Windows\System\tGWGvTt.exe
  2⤵
  PID:3236
- C:\Windows\System\wQPYbEb.exe
  C:\Windows\System\wQPYbEb.exe
  2⤵
  PID:3256
- C:\Windows\System\kdynMkz.exe
  C:\Windows\System\kdynMkz.exe
  2⤵
  PID:3276
- C:\Windows\System\MtjuYpF.exe
  C:\Windows\System\MtjuYpF.exe
  2⤵
  PID:3296
- C:\Windows\System\qMMEyTF.exe
  C:\Windows\System\qMMEyTF.exe
  2⤵
  PID:3316
- C:\Windows\System\GcSngWU.exe
  C:\Windows\System\GcSngWU.exe
  2⤵
  PID:3336
- C:\Windows\System\gkMdZjz.exe
  C:\Windows\System\gkMdZjz.exe
  2⤵
  PID:3356
- C:\Windows\System\grktsaS.exe
  C:\Windows\System\grktsaS.exe
  2⤵
  PID:3376
- C:\Windows\System\nsroytD.exe
  C:\Windows\System\nsroytD.exe
  2⤵
  PID:3396
- C:\Windows\System\fAWjdqM.exe
  C:\Windows\System\fAWjdqM.exe
  2⤵
  PID:3416
- C:\Windows\System\kCCKbip.exe
  C:\Windows\System\kCCKbip.exe
  2⤵
  PID:3436
- C:\Windows\System\CfWNNrD.exe
  C:\Windows\System\CfWNNrD.exe
  2⤵
  PID:3456
- C:\Windows\System\UowFieU.exe
  C:\Windows\System\UowFieU.exe
  2⤵
  PID:3472
- C:\Windows\System\uIxTRWD.exe
  C:\Windows\System\uIxTRWD.exe
  2⤵
  PID:3496
- C:\Windows\System\cjpQOEN.exe
  C:\Windows\System\cjpQOEN.exe
  2⤵
  PID:3516
- C:\Windows\System\HOeNMNr.exe
  C:\Windows\System\HOeNMNr.exe
  2⤵
  PID:3536
- C:\Windows\System\zNzKKtW.exe
  C:\Windows\System\zNzKKtW.exe
  2⤵
  PID:3556
- C:\Windows\System\gWIctVF.exe
  C:\Windows\System\gWIctVF.exe
  2⤵
  PID:3576
- C:\Windows\System\DnSLDiX.exe
  C:\Windows\System\DnSLDiX.exe
  2⤵
  PID:3596
- C:\Windows\System\JhgAnqh.exe
  C:\Windows\System\JhgAnqh.exe
  2⤵
  PID:3612
- C:\Windows\System\kLmdrqL.exe
  C:\Windows\System\kLmdrqL.exe
  2⤵
  PID:3632
- C:\Windows\System\esmwsgx.exe
  C:\Windows\System\esmwsgx.exe
  2⤵
  PID:3652
- C:\Windows\System\NReHtrx.exe
  C:\Windows\System\NReHtrx.exe
  2⤵
  PID:3672
- C:\Windows\System\oDGEHWl.exe
  C:\Windows\System\oDGEHWl.exe
  2⤵
  PID:3688
- C:\Windows\System\HWsHrqt.exe
  C:\Windows\System\HWsHrqt.exe
  2⤵
  PID:3708
- C:\Windows\System\BoweiBe.exe
  C:\Windows\System\BoweiBe.exe
  2⤵
  PID:3724
- C:\Windows\System\ITPqmKx.exe
  C:\Windows\System\ITPqmKx.exe
  2⤵
  PID:3740
- C:\Windows\System\FhdOWsg.exe
  C:\Windows\System\FhdOWsg.exe
  2⤵
  PID:3768
- C:\Windows\System\iKCpmRq.exe
  C:\Windows\System\iKCpmRq.exe
  2⤵
  PID:3796
- C:\Windows\System\RDoeLzM.exe
  C:\Windows\System\RDoeLzM.exe
  2⤵
  PID:3812
- C:\Windows\System\tLqzUDW.exe
  C:\Windows\System\tLqzUDW.exe
  2⤵
  PID:3832
- C:\Windows\System\MRMjvWO.exe
  C:\Windows\System\MRMjvWO.exe
  2⤵
  PID:3852
- C:\Windows\System\LADgtBi.exe
  C:\Windows\System\LADgtBi.exe
  2⤵
  PID:3872
- C:\Windows\System\TpfffSb.exe
  C:\Windows\System\TpfffSb.exe
  2⤵
  PID:3888
- C:\Windows\System\ljcJxip.exe
  C:\Windows\System\ljcJxip.exe
  2⤵
  PID:3908
- C:\Windows\System\XSwNWqn.exe
  C:\Windows\System\XSwNWqn.exe
  2⤵
  PID:3924
- C:\Windows\System\bnhsRgd.exe
  C:\Windows\System\bnhsRgd.exe
  2⤵
  PID:3944
- C:\Windows\System\sJCJPmy.exe
  C:\Windows\System\sJCJPmy.exe
  2⤵
  PID:3964
- C:\Windows\System\RBusNYQ.exe
  C:\Windows\System\RBusNYQ.exe
  2⤵
  PID:3980
- C:\Windows\System\SZEEFsW.exe
  C:\Windows\System\SZEEFsW.exe
  2⤵
  PID:4000
- C:\Windows\System\oPnrEsz.exe
  C:\Windows\System\oPnrEsz.exe
  2⤵
  PID:4020
- C:\Windows\System\ypCzPGY.exe
  C:\Windows\System\ypCzPGY.exe
  2⤵
  PID:4036
- C:\Windows\System\SmWlyrs.exe
  C:\Windows\System\SmWlyrs.exe
  2⤵
  PID:4056
- C:\Windows\System\cncbcWj.exe
  C:\Windows\System\cncbcWj.exe
  2⤵
  PID:2652
- C:\Windows\System\SldduuP.exe
  C:\Windows\System\SldduuP.exe
  2⤵
  PID:1440
- C:\Windows\System\DHUfjQI.exe
  C:\Windows\System\DHUfjQI.exe
  2⤵
  PID:816
- C:\Windows\System\HWWwTOL.exe
  C:\Windows\System\HWWwTOL.exe
  2⤵
  PID:780
- C:\Windows\System\plDUmlT.exe
  C:\Windows\System\plDUmlT.exe
  2⤵
  PID:1252
- C:\Windows\System\msVWxkR.exe
  C:\Windows\System\msVWxkR.exe
  2⤵
  PID:2960
- C:\Windows\System\UbvHvKb.exe
  C:\Windows\System\UbvHvKb.exe
  2⤵
  PID:2276
- C:\Windows\System\UNSADas.exe
  C:\Windows\System\UNSADas.exe
  2⤵
  PID:1324
- C:\Windows\System\rbxlurN.exe
  C:\Windows\System\rbxlurN.exe
  2⤵
  PID:2560
- C:\Windows\System\fXTMGiO.exe
  C:\Windows\System\fXTMGiO.exe
  2⤵
  PID:1380
- C:\Windows\System\tZnMAdO.exe
  C:\Windows\System\tZnMAdO.exe
  2⤵
  PID:1944
- C:\Windows\System\kuQXzod.exe
  C:\Windows\System\kuQXzod.exe
  2⤵
  PID:1996
- C:\Windows\System\pnqZAhA.exe
  C:\Windows\System\pnqZAhA.exe
  2⤵
  PID:2196
- C:\Windows\System\qsJOjrE.exe
  C:\Windows\System\qsJOjrE.exe
  2⤵
  PID:320
- C:\Windows\System\ZsnHyzP.exe
  C:\Windows\System\ZsnHyzP.exe
  2⤵
  PID:1796
- C:\Windows\System\StRFdLk.exe
  C:\Windows\System\StRFdLk.exe
  2⤵
  PID:2620
- C:\Windows\System\QDvMVAK.exe
  C:\Windows\System\QDvMVAK.exe
  2⤵
  PID:3068
- C:\Windows\System\qridwhO.exe
  C:\Windows\System\qridwhO.exe
  2⤵
  PID:1068
- C:\Windows\System\FLagByb.exe
  C:\Windows\System\FLagByb.exe
  2⤵
  PID:3120
- C:\Windows\System\aFmoNUp.exe
  C:\Windows\System\aFmoNUp.exe
  2⤵
  PID:3172
- C:\Windows\System\SNrLWIC.exe
  C:\Windows\System\SNrLWIC.exe
  2⤵
  PID:3104
- C:\Windows\System\YdzsuuQ.exe
  C:\Windows\System\YdzsuuQ.exe
  2⤵
  PID:3208
- C:\Windows\System\tciqjVj.exe
  C:\Windows\System\tciqjVj.exe
  2⤵
  PID:3224
- C:\Windows\System\SThktnG.exe
  C:\Windows\System\SThktnG.exe
  2⤵
  PID:3232
- C:\Windows\System\MWLaMtT.exe
  C:\Windows\System\MWLaMtT.exe
  2⤵
  PID:3264
- C:\Windows\System\pYjgAxP.exe
  C:\Windows\System\pYjgAxP.exe
  2⤵
  PID:3304
- C:\Windows\System\hdJcCYr.exe
  C:\Windows\System\hdJcCYr.exe
  2⤵
  PID:3368
- C:\Windows\System\lAlcEub.exe
  C:\Windows\System\lAlcEub.exe
  2⤵
  PID:3352
- C:\Windows\System\hPsyfsi.exe
  C:\Windows\System\hPsyfsi.exe
  2⤵
  PID:3408
- C:\Windows\System\iBaLmVT.exe
  C:\Windows\System\iBaLmVT.exe
  2⤵
  PID:3488
- C:\Windows\System\RVOYOTo.exe
  C:\Windows\System\RVOYOTo.exe
  2⤵
  PID:3528
- C:\Windows\System\eTQvgvS.exe
  C:\Windows\System\eTQvgvS.exe
  2⤵
  PID:3640
- C:\Windows\System\BsXiJGR.exe
  C:\Windows\System\BsXiJGR.exe
  2⤵
  PID:3684
- C:\Windows\System\EnoCauF.exe
  C:\Windows\System\EnoCauF.exe
  2⤵
  PID:3424
- C:\Windows\System\IWtFucZ.exe
  C:\Windows\System\IWtFucZ.exe
  2⤵
  PID:3748
- C:\Windows\System\KuAJmwJ.exe
  C:\Windows\System\KuAJmwJ.exe
  2⤵
  PID:3588
- C:\Windows\System\DywgCnj.exe
  C:\Windows\System\DywgCnj.exe
  2⤵
  PID:3628
- C:\Windows\System\aETXirt.exe
  C:\Windows\System\aETXirt.exe
  2⤵
  PID:3848
- C:\Windows\System\NQbXmCq.exe
  C:\Windows\System\NQbXmCq.exe
  2⤵
  PID:3704
- C:\Windows\System\PKnLusv.exe
  C:\Windows\System\PKnLusv.exe
  2⤵
  PID:3660
- C:\Windows\System\SFdgSnV.exe
  C:\Windows\System\SFdgSnV.exe
  2⤵
  PID:3920
- C:\Windows\System\eNPRxgc.exe
  C:\Windows\System\eNPRxgc.exe
  2⤵
  PID:3784
- C:\Windows\System\kJpTWlc.exe
  C:\Windows\System\kJpTWlc.exe
  2⤵
  PID:3996
- C:\Windows\System\LfmqpbR.exe
  C:\Windows\System\LfmqpbR.exe
  2⤵
  PID:4032
- C:\Windows\System\xRlJYxF.exe
  C:\Windows\System\xRlJYxF.exe
  2⤵
  PID:4008
- C:\Windows\System\bILuxVJ.exe
  C:\Windows\System\bILuxVJ.exe
  2⤵
  PID:4068
- C:\Windows\System\ghIcFga.exe
  C:\Windows\System\ghIcFga.exe
  2⤵
  PID:4084
- C:\Windows\System\kRGlRxf.exe
  C:\Windows\System\kRGlRxf.exe
  2⤵
  PID:2096
- C:\Windows\System\yMPfAff.exe
  C:\Windows\System\yMPfAff.exe
  2⤵
  PID:3972
- C:\Windows\System\roePLzH.exe
  C:\Windows\System\roePLzH.exe
  2⤵
  PID:3900
- C:\Windows\System\nuNHCJD.exe
  C:\Windows\System\nuNHCJD.exe
  2⤵
  PID:1580
- C:\Windows\System\HSkHRim.exe
  C:\Windows\System\HSkHRim.exe
  2⤵
  PID:2132
- C:\Windows\System\TiMdQsJ.exe
  C:\Windows\System\TiMdQsJ.exe
  2⤵
  PID:1088
- C:\Windows\System\MuYWDPC.exe
  C:\Windows\System\MuYWDPC.exe
  2⤵
  PID:2204
- C:\Windows\System\HoMJePb.exe
  C:\Windows\System\HoMJePb.exe
  2⤵
  PID:1596
- C:\Windows\System\KxgORNt.exe
  C:\Windows\System\KxgORNt.exe
  2⤵
  PID:2296
- C:\Windows\System\oGFANtn.exe
  C:\Windows\System\oGFANtn.exe
  2⤵
  PID:3200
- C:\Windows\System\yZfqpFj.exe
  C:\Windows\System\yZfqpFj.exe
  2⤵
  PID:3284
- C:\Windows\System\AQKZEga.exe
  C:\Windows\System\AQKZEga.exe
  2⤵
  PID:3364
- C:\Windows\System\WaYppRn.exe
  C:\Windows\System\WaYppRn.exe
  2⤵
  PID:3680
- C:\Windows\System\yYJdUyI.exe
  C:\Windows\System\yYJdUyI.exe
  2⤵
  PID:2784
- C:\Windows\System\scYjpZi.exe
  C:\Windows\System\scYjpZi.exe
  2⤵
  PID:3128
- C:\Windows\System\lbhFutY.exe
  C:\Windows\System\lbhFutY.exe
  2⤵
  PID:3248
- C:\Windows\System\xZkPxax.exe
  C:\Windows\System\xZkPxax.exe
  2⤵
  PID:3344
- C:\Windows\System\AEgyZyd.exe
  C:\Windows\System\AEgyZyd.exe
  2⤵
  PID:3568
- C:\Windows\System\BwWmpfq.exe
  C:\Windows\System\BwWmpfq.exe
  2⤵
  PID:3160
- C:\Windows\System\BxLxCUK.exe
  C:\Windows\System\BxLxCUK.exe
  2⤵
  PID:3504
- C:\Windows\System\LDNEGrE.exe
  C:\Windows\System\LDNEGrE.exe
  2⤵
  PID:3548
- C:\Windows\System\KSEZWeA.exe
  C:\Windows\System\KSEZWeA.exe
  2⤵
  PID:3700
- C:\Windows\System\nWRSEdS.exe
  C:\Windows\System\nWRSEdS.exe
  2⤵
  PID:3820
- C:\Windows\System\EFDCLYT.exe
  C:\Windows\System\EFDCLYT.exe
  2⤵
  PID:4076
- C:\Windows\System\zUwcXhn.exe
  C:\Windows\System\zUwcXhn.exe
  2⤵
  PID:2704
- C:\Windows\System\uVmnzzm.exe
  C:\Windows\System\uVmnzzm.exe
  2⤵
  PID:1012
- C:\Windows\System\mmfTeCj.exe
  C:\Windows\System\mmfTeCj.exe
  2⤵
  PID:3088
- C:\Windows\System\VBmzZhi.exe
  C:\Windows\System\VBmzZhi.exe
  2⤵
  PID:3592
- C:\Windows\System\yorvgkt.exe
  C:\Windows\System\yorvgkt.exe
  2⤵
  PID:3808
- C:\Windows\System\htmGUNi.exe
  C:\Windows\System\htmGUNi.exe
  2⤵
  PID:3956
- C:\Windows\System\zrDCqQo.exe
  C:\Windows\System\zrDCqQo.exe
  2⤵
  PID:3828
- C:\Windows\System\OOzgPJo.exe
  C:\Windows\System\OOzgPJo.exe
  2⤵
  PID:4064
- C:\Windows\System\aLjGyhq.exe
  C:\Windows\System\aLjGyhq.exe
  2⤵
  PID:3936
- C:\Windows\System\gSbqDEw.exe
  C:\Windows\System\gSbqDEw.exe
  2⤵
  PID:400
- C:\Windows\System\JlqDlnu.exe
  C:\Windows\System\JlqDlnu.exe
  2⤵
  PID:2584
- C:\Windows\System\cHqyVxG.exe
  C:\Windows\System\cHqyVxG.exe
  2⤵
  PID:2896
- C:\Windows\System\uqMnQbG.exe
  C:\Windows\System\uqMnQbG.exe
  2⤵
  PID:1812
- C:\Windows\System\vIPvGIu.exe
  C:\Windows\System\vIPvGIu.exe
  2⤵
  PID:3524
- C:\Windows\System\SmUFLrW.exe
  C:\Windows\System\SmUFLrW.exe
  2⤵
  PID:1748
- C:\Windows\System\UqQcuyV.exe
  C:\Windows\System\UqQcuyV.exe
  2⤵
  PID:2352
- C:\Windows\System\lVeUpHg.exe
  C:\Windows\System\lVeUpHg.exe
  2⤵
  PID:3144
- C:\Windows\System\DxsrizN.exe
  C:\Windows\System\DxsrizN.exe
  2⤵
  PID:3492
- C:\Windows\System\KzNoeIR.exe
  C:\Windows\System\KzNoeIR.exe
  2⤵
  PID:3620
- C:\Windows\System\HuVnNBZ.exe
  C:\Windows\System\HuVnNBZ.exe
  2⤵
  PID:1244
- C:\Windows\System\iKVapdV.exe
  C:\Windows\System\iKVapdV.exe
  2⤵
  PID:1320
- C:\Windows\System\ohazOvz.exe
  C:\Windows\System\ohazOvz.exe
  2⤵
  PID:1256
- C:\Windows\System\GEtdAkd.exe
  C:\Windows\System\GEtdAkd.exe
  2⤵
  PID:2460
- C:\Windows\System\ltgYTEg.exe
  C:\Windows\System\ltgYTEg.exe
  2⤵
  PID:2348
- C:\Windows\System\KrerFZO.exe
  C:\Windows\System\KrerFZO.exe
  2⤵
  PID:2952
- C:\Windows\System\AHyurHX.exe
  C:\Windows\System\AHyurHX.exe
  2⤵
  PID:3932
- C:\Windows\System\SafTxgO.exe
  C:\Windows\System\SafTxgO.exe
  2⤵
  PID:2064
- C:\Windows\System\RFnQWSv.exe
  C:\Windows\System\RFnQWSv.exe
  2⤵
  PID:3328
- C:\Windows\System\kmDIXwk.exe
  C:\Windows\System\kmDIXwk.exe
  2⤵
  PID:3512
- C:\Windows\System\pxEiPyo.exe
  C:\Windows\System\pxEiPyo.exe
  2⤵
  PID:3884
- C:\Windows\System\FBzOvTT.exe
  C:\Windows\System\FBzOvTT.exe
  2⤵
  PID:1072
- C:\Windows\System\NhoWidY.exe
  C:\Windows\System\NhoWidY.exe
  2⤵
  PID:3412
- C:\Windows\System\ddiPNzg.exe
  C:\Windows\System\ddiPNzg.exe
  2⤵
  PID:3028
- C:\Windows\System\vSLuOjg.exe
  C:\Windows\System\vSLuOjg.exe
  2⤵
  PID:2456
- C:\Windows\System\OOTJPLB.exe
  C:\Windows\System\OOTJPLB.exe
  2⤵
  PID:3844
- C:\Windows\System\uPERWpp.exe
  C:\Windows\System\uPERWpp.exe
  2⤵
  PID:668
- C:\Windows\System\deTLrFQ.exe
  C:\Windows\System\deTLrFQ.exe
  2⤵
  PID:3824
- C:\Windows\System\Fevrflq.exe
  C:\Windows\System\Fevrflq.exe
  2⤵
  PID:840
- C:\Windows\System\AAPjgoZ.exe
  C:\Windows\System\AAPjgoZ.exe
  2⤵
  PID:1740
- C:\Windows\System\CIfukEc.exe
  C:\Windows\System\CIfukEc.exe
  2⤵
  PID:3288
- C:\Windows\System\ZVUYYuN.exe
  C:\Windows\System\ZVUYYuN.exe
  2⤵
  PID:3572
- C:\Windows\System\qAqXjcx.exe
  C:\Windows\System\qAqXjcx.exe
  2⤵
  PID:764
- C:\Windows\System\lmQBQOZ.exe
  C:\Windows\System\lmQBQOZ.exe
  2⤵
  PID:1784
- C:\Windows\System\yWHuziV.exe
  C:\Windows\System\yWHuziV.exe
  2⤵
  PID:4012
- C:\Windows\System\QmCAXVB.exe
  C:\Windows\System\QmCAXVB.exe
  2⤵
  PID:2360
- C:\Windows\System\AjjoaTq.exe
  C:\Windows\System\AjjoaTq.exe
  2⤵
  PID:868
- C:\Windows\System\cJupnhh.exe
  C:\Windows\System\cJupnhh.exe
  2⤵
  PID:3464
- C:\Windows\System\lKfjWpO.exe
  C:\Windows\System\lKfjWpO.exe
  2⤵
  PID:2152
- C:\Windows\System\kzznhpG.exe
  C:\Windows\System\kzznhpG.exe
  2⤵
  PID:2628
- C:\Windows\System\AwSEhgh.exe
  C:\Windows\System\AwSEhgh.exe
  2⤵
  PID:2648
- C:\Windows\System\QRAxtuJ.exe
  C:\Windows\System\QRAxtuJ.exe
  2⤵
  PID:3904
- C:\Windows\System\Uwifukd.exe
  C:\Windows\System\Uwifukd.exe
  2⤵
  PID:3020
- C:\Windows\System\flcwjeN.exe
  C:\Windows\System\flcwjeN.exe
  2⤵
  PID:2328
- C:\Windows\System\UiIqPaL.exe
  C:\Windows\System\UiIqPaL.exe
  2⤵
  PID:3204
- C:\Windows\System\TbGCUhM.exe
  C:\Windows\System\TbGCUhM.exe
  2⤵
  PID:3452
- C:\Windows\System\aZbYgdN.exe
  C:\Windows\System\aZbYgdN.exe
  2⤵
  PID:2664
- C:\Windows\System\WDNisjG.exe
  C:\Windows\System\WDNisjG.exe
  2⤵
  PID:2608
- C:\Windows\System\KLFrIti.exe
  C:\Windows\System\KLFrIti.exe
  2⤵
  PID:2884
- C:\Windows\System\OaqLBde.exe
  C:\Windows\System\OaqLBde.exe
  2⤵
  PID:3720
- C:\Windows\System\WQOxKub.exe
  C:\Windows\System\WQOxKub.exe
  2⤵
  PID:3188
- C:\Windows\System\aVFWyed.exe
  C:\Windows\System\aVFWyed.exe
  2⤵
  PID:2968
- C:\Windows\System\ovYJJLl.exe
  C:\Windows\System\ovYJJLl.exe
  2⤵
  PID:888
- C:\Windows\System\Hlacgth.exe
  C:\Windows\System\Hlacgth.exe
  2⤵
  PID:572
- C:\Windows\System\DSqZPfS.exe
  C:\Windows\System\DSqZPfS.exe
  2⤵
  PID:3608
- C:\Windows\System\gSgcWVK.exe
  C:\Windows\System\gSgcWVK.exe
  2⤵
  PID:2832
- C:\Windows\System\ZdkQyey.exe
  C:\Windows\System\ZdkQyey.exe
  2⤵
  PID:4104
- C:\Windows\System\bkvJVAI.exe
  C:\Windows\System\bkvJVAI.exe
  2⤵
  PID:4120
- C:\Windows\System\weaIcRp.exe
  C:\Windows\System\weaIcRp.exe
  2⤵
  PID:4136
- C:\Windows\System\UYWKvtX.exe
  C:\Windows\System\UYWKvtX.exe
  2⤵
  PID:4152
- C:\Windows\System\AxmwPOq.exe
  C:\Windows\System\AxmwPOq.exe
  2⤵
  PID:4168
- C:\Windows\System\HPNlmgz.exe
  C:\Windows\System\HPNlmgz.exe
  2⤵
  PID:4184
- C:\Windows\System\kfVwnXq.exe
  C:\Windows\System\kfVwnXq.exe
  2⤵
  PID:4200
- C:\Windows\System\RFNCWbk.exe
  C:\Windows\System\RFNCWbk.exe
  2⤵
  PID:4216
- C:\Windows\System\guIOvDK.exe
  C:\Windows\System\guIOvDK.exe
  2⤵
  PID:4232
- C:\Windows\System\SaGVlDK.exe
  C:\Windows\System\SaGVlDK.exe
  2⤵
  PID:4248
- C:\Windows\System\mbxuXQn.exe
  C:\Windows\System\mbxuXQn.exe
  2⤵
  PID:4264
- C:\Windows\System\pBXHVlG.exe
  C:\Windows\System\pBXHVlG.exe
  2⤵
  PID:4280
- C:\Windows\System\oPRkJSf.exe
  C:\Windows\System\oPRkJSf.exe
  2⤵
  PID:4296
- C:\Windows\System\tDmnKoL.exe
  C:\Windows\System\tDmnKoL.exe
  2⤵
  PID:4312
- C:\Windows\System\VowClwf.exe
  C:\Windows\System\VowClwf.exe
  2⤵
  PID:4328
- C:\Windows\System\iuWttQb.exe
  C:\Windows\System\iuWttQb.exe
  2⤵
  PID:4344
- C:\Windows\System\hZFuFNw.exe
  C:\Windows\System\hZFuFNw.exe
  2⤵
  PID:4360
- C:\Windows\System\EtBkbgY.exe
  C:\Windows\System\EtBkbgY.exe
  2⤵
  PID:4376
- C:\Windows\System\khqBSFx.exe
  C:\Windows\System\khqBSFx.exe
  2⤵
  PID:4392
- C:\Windows\System\CVrGTru.exe
  C:\Windows\System\CVrGTru.exe
  2⤵
  PID:4408
- C:\Windows\System\ljPQdnd.exe
  C:\Windows\System\ljPQdnd.exe
  2⤵
  PID:4424
- C:\Windows\System\xzaJwdH.exe
  C:\Windows\System\xzaJwdH.exe
  2⤵
  PID:4440
- C:\Windows\System\vsFwPTJ.exe
  C:\Windows\System\vsFwPTJ.exe
  2⤵
  PID:4456
- C:\Windows\System\kvWcdEU.exe
  C:\Windows\System\kvWcdEU.exe
  2⤵
  PID:4472
- C:\Windows\System\zSBkjwi.exe
  C:\Windows\System\zSBkjwi.exe
  2⤵
  PID:4488
- C:\Windows\System\eIYAQTt.exe
  C:\Windows\System\eIYAQTt.exe
  2⤵
  PID:4508
- C:\Windows\System\DRFxrWz.exe
  C:\Windows\System\DRFxrWz.exe
  2⤵
  PID:4540
- C:\Windows\System\ZSbRyDu.exe
  C:\Windows\System\ZSbRyDu.exe
  2⤵
  PID:4560
- C:\Windows\System\IErNcaC.exe
  C:\Windows\System\IErNcaC.exe
  2⤵
  PID:4576
- C:\Windows\System\frlnimL.exe
  C:\Windows\System\frlnimL.exe
  2⤵
  PID:4592
- C:\Windows\System\eiUGeEW.exe
  C:\Windows\System\eiUGeEW.exe
  2⤵
  PID:4608
- C:\Windows\System\lWrfkgV.exe
  C:\Windows\System\lWrfkgV.exe
  2⤵
  PID:4624
- C:\Windows\System\TJaCblV.exe
  C:\Windows\System\TJaCblV.exe
  2⤵
  PID:4640
- C:\Windows\System\UemawPf.exe
  C:\Windows\System\UemawPf.exe
  2⤵
  PID:4656
- C:\Windows\System\YiMdTox.exe
  C:\Windows\System\YiMdTox.exe
  2⤵
  PID:4672
- C:\Windows\System\uWpzHHK.exe
  C:\Windows\System\uWpzHHK.exe
  2⤵
  PID:4688
- C:\Windows\System\yTftDyI.exe
  C:\Windows\System\yTftDyI.exe
  2⤵
  PID:4704
- C:\Windows\System\YwQOFNu.exe
  C:\Windows\System\YwQOFNu.exe
  2⤵
  PID:4720
- C:\Windows\System\VnVlyGy.exe
  C:\Windows\System\VnVlyGy.exe
  2⤵
  PID:4736
- C:\Windows\System\UsVWyHg.exe
  C:\Windows\System\UsVWyHg.exe
  2⤵
  PID:4752
- C:\Windows\System\RkRUAwy.exe
  C:\Windows\System\RkRUAwy.exe
  2⤵
  PID:4768
- C:\Windows\System\FWRTEGH.exe
  C:\Windows\System\FWRTEGH.exe
  2⤵
  PID:4784
- C:\Windows\System\MrxjpnK.exe
  C:\Windows\System\MrxjpnK.exe
  2⤵
  PID:4800
- C:\Windows\System\lDxsKvy.exe
  C:\Windows\System\lDxsKvy.exe
  2⤵
  PID:4832
- C:\Windows\System\jPhTLUe.exe
  C:\Windows\System\jPhTLUe.exe
  2⤵
  PID:5024
- C:\Windows\System\gRMnEBz.exe
  C:\Windows\System\gRMnEBz.exe
  2⤵
  PID:5040
- C:\Windows\System\kbZdUEL.exe
  C:\Windows\System\kbZdUEL.exe
  2⤵
  PID:5064
- C:\Windows\System\orIsJbs.exe
  C:\Windows\System\orIsJbs.exe
  2⤵
  PID:5080
- C:\Windows\System\JabKrVm.exe
  C:\Windows\System\JabKrVm.exe
  2⤵
  PID:5096
- C:\Windows\System\mhrzYUo.exe
  C:\Windows\System\mhrzYUo.exe
  2⤵
  PID:5112
- C:\Windows\System\XqTkeED.exe
  C:\Windows\System\XqTkeED.exe
  2⤵
  PID:3552
- C:\Windows\System\LIHdipN.exe
  C:\Windows\System\LIHdipN.exe
  2⤵
  PID:2000
- C:\Windows\System\DXCDhuL.exe
  C:\Windows\System\DXCDhuL.exe
  2⤵
  PID:3308
- C:\Windows\System\uHpegJZ.exe
  C:\Windows\System\uHpegJZ.exe
  2⤵
  PID:4100
- C:\Windows\System\MlfmKfy.exe
  C:\Windows\System\MlfmKfy.exe
  2⤵
  PID:4112
- C:\Windows\System\wMsxiAU.exe
  C:\Windows\System\wMsxiAU.exe
  2⤵
  PID:4116
- C:\Windows\System\tzzyEjB.exe
  C:\Windows\System\tzzyEjB.exe
  2⤵
  PID:4192
- C:\Windows\System\BEFMAUC.exe
  C:\Windows\System\BEFMAUC.exe
  2⤵
  PID:2428
- C:\Windows\System\rhPYUhq.exe
  C:\Windows\System\rhPYUhq.exe
  2⤵
  PID:4176
- C:\Windows\System\Jhtecoc.exe
  C:\Windows\System\Jhtecoc.exe
  2⤵
  PID:4212
- C:\Windows\System\sfSGomn.exe
  C:\Windows\System\sfSGomn.exe
  2⤵
  PID:4244
- C:\Windows\System\TKfRiou.exe
  C:\Windows\System\TKfRiou.exe
  2⤵
  PID:4260
- C:\Windows\System\OKTYbMv.exe
  C:\Windows\System\OKTYbMv.exe
  2⤵
  PID:324
- C:\Windows\System\jPHMAxt.exe
  C:\Windows\System\jPHMAxt.exe
  2⤵
  PID:4324
- C:\Windows\System\LOvriMJ.exe
  C:\Windows\System\LOvriMJ.exe
  2⤵
  PID:4352
- C:\Windows\System\VKlbYrH.exe
  C:\Windows\System\VKlbYrH.exe
  2⤵
  PID:4416
- C:\Windows\System\MvmTgoS.exe
  C:\Windows\System\MvmTgoS.exe
  2⤵
  PID:4480
- C:\Windows\System\BxubzUA.exe
  C:\Windows\System\BxubzUA.exe
  2⤵
  PID:4524
- C:\Windows\System\sRrOCYd.exe
  C:\Windows\System\sRrOCYd.exe
  2⤵
  PID:4568
- C:\Windows\System\TAzhPPs.exe
  C:\Windows\System\TAzhPPs.exe
  2⤵
  PID:4632
- C:\Windows\System\cTaRzjQ.exe
  C:\Windows\System\cTaRzjQ.exe
  2⤵
  PID:4696
- C:\Windows\System\gaBfbPr.exe
  C:\Windows\System\gaBfbPr.exe
  2⤵
  PID:4760
- C:\Windows\System\zjGdFsN.exe
  C:\Windows\System\zjGdFsN.exe
  2⤵
  PID:4368
- C:\Windows\System\ZewXtQa.exe
  C:\Windows\System\ZewXtQa.exe
  2⤵
  PID:4680
- C:\Windows\System\ExGcOaD.exe
  C:\Windows\System\ExGcOaD.exe
  2⤵
  PID:4780
- C:\Windows\System\UlamDGh.exe
  C:\Windows\System\UlamDGh.exe
  2⤵
  PID:4588
- C:\Windows\System\cEeVoNM.exe
  C:\Windows\System\cEeVoNM.exe
  2⤵
  PID:4504
- C:\Windows\System\vmVMSYW.exe
  C:\Windows\System\vmVMSYW.exe
  2⤵
  PID:4432
- C:\Windows\System\LlnQUIK.exe
  C:\Windows\System\LlnQUIK.exe
  2⤵
  PID:1284
- C:\Windows\System\RWpWcWj.exe
  C:\Windows\System\RWpWcWj.exe
  2⤵
  PID:4816
- C:\Windows\System\PjToqWz.exe
  C:\Windows\System\PjToqWz.exe
  2⤵
  PID:4864
- C:\Windows\System\kOrVtZz.exe
  C:\Windows\System\kOrVtZz.exe
  2⤵
  PID:4884
- C:\Windows\System\xtrApto.exe
  C:\Windows\System\xtrApto.exe
  2⤵
  PID:4900
- C:\Windows\System\SlxZzYa.exe
  C:\Windows\System\SlxZzYa.exe
  2⤵
  PID:4916
- C:\Windows\System\XbaZXMr.exe
  C:\Windows\System\XbaZXMr.exe
  2⤵
  PID:4932
- C:\Windows\System\LoLCtei.exe
  C:\Windows\System\LoLCtei.exe
  2⤵
  PID:2616
- C:\Windows\System\WBpdzXT.exe
  C:\Windows\System\WBpdzXT.exe
  2⤵
  PID:4960
- C:\Windows\System\jNYJugm.exe
  C:\Windows\System\jNYJugm.exe
  2⤵
  PID:4976
- C:\Windows\System\xXBUIHF.exe
  C:\Windows\System\xXBUIHF.exe
  2⤵
  PID:4992
- C:\Windows\System\TNsRTGn.exe
  C:\Windows\System\TNsRTGn.exe
  2⤵
  PID:5000
- C:\Windows\System\vVbRRCh.exe
  C:\Windows\System\vVbRRCh.exe
  2⤵
  PID:5036
- C:\Windows\System\CEHkLRO.exe
  C:\Windows\System\CEHkLRO.exe
  2⤵
  PID:2716
- C:\Windows\System\hxJcNfY.exe
  C:\Windows\System\hxJcNfY.exe
  2⤵
  PID:5048
- C:\Windows\System\NOiOrBC.exe
  C:\Windows\System\NOiOrBC.exe
  2⤵
  PID:972
- C:\Windows\System\YFzVmJN.exe
  C:\Windows\System\YFzVmJN.exe
  2⤵
  PID:2672
- C:\Windows\System\SbvnSpb.exe
  C:\Windows\System\SbvnSpb.exe
  2⤵
  PID:1576
- C:\Windows\System\XchMjfV.exe
  C:\Windows\System\XchMjfV.exe
  2⤵
  PID:5032
- C:\Windows\System\rFjCZYe.exe
  C:\Windows\System\rFjCZYe.exe
  2⤵
  PID:1104
- C:\Windows\System\tSYMGDY.exe
  C:\Windows\System\tSYMGDY.exe
  2⤵
  PID:4144
- C:\Windows\System\bMbFcTC.exe
  C:\Windows\System\bMbFcTC.exe
  2⤵
  PID:1836
- C:\Windows\System\ZWiAOly.exe
  C:\Windows\System\ZWiAOly.exe
  2⤵
  PID:4276
- C:\Windows\System\jydAMGf.exe
  C:\Windows\System\jydAMGf.exe
  2⤵
  PID:4448
- C:\Windows\System\xsBLoEo.exe
  C:\Windows\System\xsBLoEo.exe
  2⤵
  PID:4668
- C:\Windows\System\lOQJwFj.exe
  C:\Windows\System\lOQJwFj.exe
  2⤵
  PID:4520
- C:\Windows\System\ZOFQvkN.exe
  C:\Windows\System\ZOFQvkN.exe
  2⤵
  PID:4604
- C:\Windows\System\LWYBorG.exe
  C:\Windows\System\LWYBorG.exe
  2⤵
  PID:948
- C:\Windows\System\KlsepKl.exe
  C:\Windows\System\KlsepKl.exe
  2⤵
  PID:4684
- C:\Windows\System\CaxOocm.exe
  C:\Windows\System\CaxOocm.exe
  2⤵
  PID:4748
- C:\Windows\System\TSdGslc.exe
  C:\Windows\System\TSdGslc.exe
  2⤵
  PID:4464
- C:\Windows\System\YKjTHow.exe
  C:\Windows\System\YKjTHow.exe
  2⤵
  PID:2540
- C:\Windows\System\BgBnnIM.exe
  C:\Windows\System\BgBnnIM.exe
  2⤵
  PID:4548
- C:\Windows\System\qbsVAKe.exe
  C:\Windows\System\qbsVAKe.exe
  2⤵
  PID:4820
- C:\Windows\System\JqSbXWy.exe
  C:\Windows\System\JqSbXWy.exe
  2⤵
  PID:4844
- C:\Windows\System\rExCjwU.exe
  C:\Windows\System\rExCjwU.exe
  2⤵
  PID:4940
- C:\Windows\System\WglHczz.exe
  C:\Windows\System\WglHczz.exe
  2⤵
  PID:4892
- C:\Windows\System\TtYluwA.exe
  C:\Windows\System\TtYluwA.exe
  2⤵
  PID:4952
- C:\Windows\System\cPPcvUX.exe
  C:\Windows\System\cPPcvUX.exe
  2⤵
  PID:4968
- C:\Windows\System\hYcxivQ.exe
  C:\Windows\System\hYcxivQ.exe
  2⤵
  PID:5020
- C:\Windows\System\wdiZEVo.exe
  C:\Windows\System\wdiZEVo.exe
  2⤵
  PID:5004
- C:\Windows\System\cwyYgPH.exe
  C:\Windows\System\cwyYgPH.exe
  2⤵
  PID:1624
- C:\Windows\System\bUtjKUf.exe
  C:\Windows\System\bUtjKUf.exe
  2⤵
  PID:1600
- C:\Windows\System\pQamjBr.exe
  C:\Windows\System\pQamjBr.exe
  2⤵
  PID:3428
- C:\Windows\System\oegVbGE.exe
  C:\Windows\System\oegVbGE.exe
  2⤵
  PID:4320
- C:\Windows\System\AZeVsiR.exe
  C:\Windows\System\AZeVsiR.exe
  2⤵
  PID:4744
- C:\Windows\System\uOfLvhK.exe
  C:\Windows\System\uOfLvhK.exe
  2⤵
  PID:4796
- C:\Windows\System\HPFfhWi.exe
  C:\Windows\System\HPFfhWi.exe
  2⤵
  PID:4716
- C:\Windows\System\MpPcWpk.exe
  C:\Windows\System\MpPcWpk.exe
  2⤵
  PID:2108
- C:\Windows\System\PnsQyrC.exe
  C:\Windows\System\PnsQyrC.exe
  2⤵
  PID:5076
- C:\Windows\System\pcnIAuS.exe
  C:\Windows\System\pcnIAuS.exe
  2⤵
  PID:4532
- C:\Windows\System\piBOTHp.exe
  C:\Windows\System\piBOTHp.exe
  2⤵
  PID:4792
- C:\Windows\System\fyKIaNO.exe
  C:\Windows\System\fyKIaNO.exe
  2⤵
  PID:4908
- C:\Windows\System\eLDyVeQ.exe
  C:\Windows\System\eLDyVeQ.exe
  2⤵
  PID:4860
- C:\Windows\System\RMARdTa.exe
  C:\Windows\System\RMARdTa.exe
  2⤵
  PID:4996
- C:\Windows\System\yDDXPOA.exe
  C:\Windows\System\yDDXPOA.exe
  2⤵
  PID:4228
- C:\Windows\System\RyWtboj.exe
  C:\Windows\System\RyWtboj.exe
  2⤵
  PID:4208
- C:\Windows\System\aqHgTYP.exe
  C:\Windows\System\aqHgTYP.exe
  2⤵
  PID:4712
- C:\Windows\System\SdApZlM.exe
  C:\Windows\System\SdApZlM.exe
  2⤵
  PID:4928
- C:\Windows\System\CdJVktD.exe
  C:\Windows\System\CdJVktD.exe
  2⤵
  PID:4384
- C:\Windows\System\ywnEjfd.exe
  C:\Windows\System\ywnEjfd.exe
  2⤵
  PID:4256
- C:\Windows\System\TKqHTLm.exe
  C:\Windows\System\TKqHTLm.exe
  2⤵
  PID:4732
- C:\Windows\System\gxKCKZe.exe
  C:\Windows\System\gxKCKZe.exe
  2⤵
  PID:5124
- C:\Windows\System\MekjoOs.exe
  C:\Windows\System\MekjoOs.exe
  2⤵
  PID:5140
- C:\Windows\System\HJRDGdV.exe
  C:\Windows\System\HJRDGdV.exe
  2⤵
  PID:5156
- C:\Windows\System\WdyHTuo.exe
  C:\Windows\System\WdyHTuo.exe
  2⤵
  PID:5172
- C:\Windows\System\BNqIEPU.exe
  C:\Windows\System\BNqIEPU.exe
  2⤵
  PID:5188
- C:\Windows\System\tGxltTn.exe
  C:\Windows\System\tGxltTn.exe
  2⤵
  PID:5204
- C:\Windows\System\GXNqBgO.exe
  C:\Windows\System\GXNqBgO.exe
  2⤵
  PID:5220
- C:\Windows\System\eLEREcQ.exe
  C:\Windows\System\eLEREcQ.exe
  2⤵
  PID:5236
- C:\Windows\System\PrseVyp.exe
  C:\Windows\System\PrseVyp.exe
  2⤵
  PID:5252
- C:\Windows\System\CdYWgeN.exe
  C:\Windows\System\CdYWgeN.exe
  2⤵
  PID:5268
- C:\Windows\System\frHRGYV.exe
  C:\Windows\System\frHRGYV.exe
  2⤵
  PID:5284
- C:\Windows\System\sHRSRtp.exe
  C:\Windows\System\sHRSRtp.exe
  2⤵
  PID:5300
- C:\Windows\System\zIhebSG.exe
  C:\Windows\System\zIhebSG.exe
  2⤵
  PID:5316
- C:\Windows\System\KhGGKbb.exe
  C:\Windows\System\KhGGKbb.exe
  2⤵
  PID:5332
- C:\Windows\System\wYXHedW.exe
  C:\Windows\System\wYXHedW.exe
  2⤵
  PID:5348
- C:\Windows\System\yAYFuTB.exe
  C:\Windows\System\yAYFuTB.exe
  2⤵
  PID:5364
- C:\Windows\System\PFZDuVf.exe
  C:\Windows\System\PFZDuVf.exe
  2⤵
  PID:5380
- C:\Windows\System\SiJflGn.exe
  C:\Windows\System\SiJflGn.exe
  2⤵
  PID:5396
- C:\Windows\System\FckUdnQ.exe
  C:\Windows\System\FckUdnQ.exe
  2⤵
  PID:5412
- C:\Windows\System\RLujgcS.exe
  C:\Windows\System\RLujgcS.exe
  2⤵
  PID:5428
- C:\Windows\System\PhRcQsk.exe
  C:\Windows\System\PhRcQsk.exe
  2⤵
  PID:5444
- C:\Windows\System\rPDnyPh.exe
  C:\Windows\System\rPDnyPh.exe
  2⤵
  PID:5460
- C:\Windows\System\NgFsvsN.exe
  C:\Windows\System\NgFsvsN.exe
  2⤵
  PID:5476
- C:\Windows\System\wSexvHt.exe
  C:\Windows\System\wSexvHt.exe
  2⤵
  PID:5492
- C:\Windows\System\RRguQsh.exe
  C:\Windows\System\RRguQsh.exe
  2⤵
  PID:5508
- C:\Windows\System\qxSXsOa.exe
  C:\Windows\System\qxSXsOa.exe
  2⤵
  PID:5524
- C:\Windows\System\bRYqhfI.exe
  C:\Windows\System\bRYqhfI.exe
  2⤵
  PID:5540
- C:\Windows\System\rsqIulr.exe
  C:\Windows\System\rsqIulr.exe
  2⤵
  PID:5556
- C:\Windows\System\rZGajKn.exe
  C:\Windows\System\rZGajKn.exe
  2⤵
  PID:5572
- C:\Windows\System\CpOTDKa.exe
  C:\Windows\System\CpOTDKa.exe
  2⤵
  PID:5588
- C:\Windows\System\HIvLHxf.exe
  C:\Windows\System\HIvLHxf.exe
  2⤵
  PID:5604
- C:\Windows\System\WRpFOsd.exe
  C:\Windows\System\WRpFOsd.exe
  2⤵
  PID:5620
- C:\Windows\System\loApMPu.exe
  C:\Windows\System\loApMPu.exe
  2⤵
  PID:5636
- C:\Windows\System\fovJkXf.exe
  C:\Windows\System\fovJkXf.exe
  2⤵
  PID:5652
- C:\Windows\System\QrciZKx.exe
  C:\Windows\System\QrciZKx.exe
  2⤵
  PID:5668
- C:\Windows\System\BlOOPqR.exe
  C:\Windows\System\BlOOPqR.exe
  2⤵
  PID:5684
- C:\Windows\System\gHwWoBU.exe
  C:\Windows\System\gHwWoBU.exe
  2⤵
  PID:5704
- C:\Windows\System\VqesSlw.exe
  C:\Windows\System\VqesSlw.exe
  2⤵
  PID:5720
- C:\Windows\System\xEzjXGO.exe
  C:\Windows\System\xEzjXGO.exe
  2⤵
  PID:5736
- C:\Windows\System\fPVWlBy.exe
  C:\Windows\System\fPVWlBy.exe
  2⤵
  PID:5752
- C:\Windows\System\TPaiczg.exe
  C:\Windows\System\TPaiczg.exe
  2⤵
  PID:5768
- C:\Windows\System\nPoiuVx.exe
  C:\Windows\System\nPoiuVx.exe
  2⤵
  PID:5784
- C:\Windows\System\KzIzZRa.exe
  C:\Windows\System\KzIzZRa.exe
  2⤵
  PID:5800
- C:\Windows\System\WjCjmbK.exe
  C:\Windows\System\WjCjmbK.exe
  2⤵
  PID:5816
- C:\Windows\System\FzbCaFL.exe
  C:\Windows\System\FzbCaFL.exe
  2⤵
  PID:5832
- C:\Windows\System\OsJnVuJ.exe
  C:\Windows\System\OsJnVuJ.exe
  2⤵
  PID:5848
- C:\Windows\System\QJxEUuU.exe
  C:\Windows\System\QJxEUuU.exe
  2⤵
  PID:5864
- C:\Windows\System\OvHNBnt.exe
  C:\Windows\System\OvHNBnt.exe
  2⤵
  PID:5880
- C:\Windows\System\xQWUNmt.exe
  C:\Windows\System\xQWUNmt.exe
  2⤵
  PID:5896
- C:\Windows\System\yqgbCbd.exe
  C:\Windows\System\yqgbCbd.exe
  2⤵
  PID:5912
- C:\Windows\System\XjaXNki.exe
  C:\Windows\System\XjaXNki.exe
  2⤵
  PID:5928
- C:\Windows\System\UbIEAHv.exe
  C:\Windows\System\UbIEAHv.exe
  2⤵
  PID:5944
- C:\Windows\System\mjDggyy.exe
  C:\Windows\System\mjDggyy.exe
  2⤵
  PID:5960
- C:\Windows\System\KyVNeMR.exe
  C:\Windows\System\KyVNeMR.exe
  2⤵
  PID:5976
- C:\Windows\System\BWgDRmx.exe
  C:\Windows\System\BWgDRmx.exe
  2⤵
  PID:5992
- C:\Windows\System\ymUKRbe.exe
  C:\Windows\System\ymUKRbe.exe
  2⤵
  PID:6008
- C:\Windows\System\MTLXMHj.exe
  C:\Windows\System\MTLXMHj.exe
  2⤵
  PID:6024
- C:\Windows\System\hKXMInK.exe
  C:\Windows\System\hKXMInK.exe
  2⤵
  PID:6040
- C:\Windows\System\kBImOKi.exe
  C:\Windows\System\kBImOKi.exe
  2⤵
  PID:6056
- C:\Windows\System\hhYNSKT.exe
  C:\Windows\System\hhYNSKT.exe
  2⤵
  PID:6072
- C:\Windows\System\tFvEymB.exe
  C:\Windows\System\tFvEymB.exe
  2⤵
  PID:6088
- C:\Windows\System\wcssEMF.exe
  C:\Windows\System\wcssEMF.exe
  2⤵
  PID:6104
- C:\Windows\System\ngdfijf.exe
  C:\Windows\System\ngdfijf.exe
  2⤵
  PID:6120
- C:\Windows\System\lwaeVWq.exe
  C:\Windows\System\lwaeVWq.exe
  2⤵
  PID:6136
- C:\Windows\System\jBcPlGY.exe
  C:\Windows\System\jBcPlGY.exe
  2⤵
  PID:4852
- C:\Windows\System\tmYYnkA.exe
  C:\Windows\System\tmYYnkA.exe
  2⤵
  PID:5168
- C:\Windows\System\QwdJkfl.exe
  C:\Windows\System\QwdJkfl.exe
  2⤵
  PID:2824
- C:\Windows\System\EjGFyWp.exe
  C:\Windows\System\EjGFyWp.exe
  2⤵
  PID:5228
- C:\Windows\System\ukBpwOX.exe
  C:\Windows\System\ukBpwOX.exe
  2⤵
  PID:2304
- C:\Windows\System\gyNSaiI.exe
  C:\Windows\System\gyNSaiI.exe
  2⤵
  PID:4468
- C:\Windows\System\SRECTVy.exe
  C:\Windows\System\SRECTVy.exe
  2⤵
  PID:4648
- C:\Windows\System\KVXczft.exe
  C:\Windows\System\KVXczft.exe
  2⤵
  PID:4160
- C:\Windows\System\IWFjKic.exe
  C:\Windows\System\IWFjKic.exe
  2⤵
  PID:4292
- C:\Windows\System\UwuQQym.exe
  C:\Windows\System\UwuQQym.exe
  2⤵
  PID:804
- C:\Windows\System\pTgmhPv.exe
  C:\Windows\System\pTgmhPv.exe
  2⤵
  PID:5184
- C:\Windows\System\aQZrRLB.exe
  C:\Windows\System\aQZrRLB.exe
  2⤵
  PID:5276
- C:\Windows\System\NHDHsoW.exe
  C:\Windows\System\NHDHsoW.exe
  2⤵
  PID:5280
- C:\Windows\System\GUTQQGb.exe
  C:\Windows\System\GUTQQGb.exe
  2⤵
  PID:5328
- C:\Windows\System\kbHXXqy.exe
  C:\Windows\System\kbHXXqy.exe
  2⤵
  PID:5388
- C:\Windows\System\OIiRevy.exe
  C:\Windows\System\OIiRevy.exe
  2⤵
  PID:5376
- C:\Windows\System\DBciiAv.exe
  C:\Windows\System\DBciiAv.exe
  2⤵
  PID:5424
- C:\Windows\System\DfIzBrL.exe
  C:\Windows\System\DfIzBrL.exe
  2⤵
  PID:5440
- C:\Windows\System\TacgQzA.exe
  C:\Windows\System\TacgQzA.exe
  2⤵
  PID:5548
- C:\Windows\System\xyTfqcp.exe
  C:\Windows\System\xyTfqcp.exe
  2⤵
  PID:5552
- C:\Windows\System\SeVreIp.exe
  C:\Windows\System\SeVreIp.exe
  2⤵
  PID:5644
- C:\Windows\System\GoyTCCt.exe
  C:\Windows\System\GoyTCCt.exe
  2⤵
  PID:5472
- C:\Windows\System\yynSNZZ.exe
  C:\Windows\System\yynSNZZ.exe
  2⤵
  PID:5748
- C:\Windows\System\wKBPviX.exe
  C:\Windows\System\wKBPviX.exe
  2⤵
  PID:2060
- C:\Windows\System\bKUMfNg.exe
  C:\Windows\System\bKUMfNg.exe
  2⤵
  PID:5872
- C:\Windows\System\FlZRCxs.exe
  C:\Windows\System\FlZRCxs.exe
  2⤵
  PID:5728
- C:\Windows\System\DtmhOsg.exe
  C:\Windows\System\DtmhOsg.exe
  2⤵
  PID:5764
- C:\Windows\System\vpCTXxg.exe
  C:\Windows\System\vpCTXxg.exe
  2⤵
  PID:5600
- C:\Windows\System\yFbhJEr.exe
  C:\Windows\System\yFbhJEr.exe
  2⤵
  PID:5536
- C:\Windows\System\fDzyyBu.exe
  C:\Windows\System\fDzyyBu.exe
  2⤵
  PID:5888
- C:\Windows\System\MNHfWSk.exe
  C:\Windows\System\MNHfWSk.exe
  2⤵
  PID:5564
- C:\Windows\System\WaKovrm.exe
  C:\Windows\System\WaKovrm.exe
  2⤵
  PID:5628
- C:\Windows\System\QGJIUzN.exe
  C:\Windows\System\QGJIUzN.exe
  2⤵
  PID:5692
- C:\Windows\System\aEjFuQR.exe
  C:\Windows\System\aEjFuQR.exe
  2⤵
  PID:6036
- C:\Windows\System\gqKobwH.exe
  C:\Windows\System\gqKobwH.exe
  2⤵
  PID:5824
- C:\Windows\System\GTjvhDY.exe
  C:\Windows\System\GTjvhDY.exe
  2⤵
  PID:5920
- C:\Windows\System\LxwDLoV.exe
  C:\Windows\System\LxwDLoV.exe
  2⤵
  PID:5988
- C:\Windows\System\hLtDYfF.exe
  C:\Windows\System\hLtDYfF.exe
  2⤵
  PID:6048
- C:\Windows\System\fheqLng.exe
  C:\Windows\System\fheqLng.exe
  2⤵
  PID:6112
- C:\Windows\System\qCiiNGu.exe
  C:\Windows\System\qCiiNGu.exe
  2⤵
  PID:5164
- C:\Windows\System\TlMPhva.exe
  C:\Windows\System\TlMPhva.exe
  2⤵
  PID:5132
- C:\Windows\System\MSYJLtO.exe
  C:\Windows\System\MSYJLtO.exe
  2⤵
  PID:5200
- C:\Windows\System\lxkCmWB.exe
  C:\Windows\System\lxkCmWB.exe
  2⤵
  PID:2972
- C:\Windows\System\hmWqnLG.exe
  C:\Windows\System\hmWqnLG.exe
  2⤵
  PID:4924
- C:\Windows\System\WOTccYe.exe
  C:\Windows\System\WOTccYe.exe
  2⤵
  PID:5088
- C:\Windows\System\qCAxfpP.exe
  C:\Windows\System\qCAxfpP.exe
  2⤵
  PID:5372
- C:\Windows\System\ABDYfyo.exe
  C:\Windows\System\ABDYfyo.exe
  2⤵
  PID:5408
- C:\Windows\System\AWVwMLs.exe
  C:\Windows\System\AWVwMLs.exe
  2⤵
  PID:5680
- C:\Windows\System\eNAFzcR.exe
  C:\Windows\System\eNAFzcR.exe
  2⤵
  PID:5904
- C:\Windows\System\BtLuxvC.exe
  C:\Windows\System\BtLuxvC.exe
  2⤵
  PID:5308
- C:\Windows\System\METrMsQ.exe
  C:\Windows\System\METrMsQ.exe
  2⤵
  PID:5356
- C:\Windows\System\ABzsdrc.exe
  C:\Windows\System\ABzsdrc.exe
  2⤵
  PID:5456
- C:\Windows\System\rbAtRGJ.exe
  C:\Windows\System\rbAtRGJ.exe
  2⤵
  PID:5776
- C:\Windows\System\SFfHQel.exe
  C:\Windows\System\SFfHQel.exe
  2⤵
  PID:5532
- C:\Windows\System\jzeVePi.exe
  C:\Windows\System\jzeVePi.exe
  2⤵
  PID:5968
- C:\Windows\System\OWmyyIP.exe
  C:\Windows\System\OWmyyIP.exe
  2⤵
  PID:5856
- C:\Windows\System\pgJJWAN.exe
  C:\Windows\System\pgJJWAN.exe
  2⤵
  PID:3024
- C:\Windows\System\gLzGXcz.exe
  C:\Windows\System\gLzGXcz.exe
  2⤵
  PID:1280
- C:\Windows\System\lqlDRZv.exe
  C:\Windows\System\lqlDRZv.exe
  2⤵
  PID:5340
- C:\Windows\System\iHkGRZc.exe
  C:\Windows\System\iHkGRZc.exe
  2⤵
  PID:5360
- C:\Windows\System\nyDVtZJ.exe
  C:\Windows\System\nyDVtZJ.exe
  2⤵
  PID:5520
- C:\Windows\System\ThiyWYo.exe
  C:\Windows\System\ThiyWYo.exe
  2⤵
  PID:6128
- C:\Windows\System\kprrKOC.exe
  C:\Windows\System\kprrKOC.exe
  2⤵
  PID:6156
- C:\Windows\System\HzTXERY.exe
  C:\Windows\System\HzTXERY.exe
  2⤵
  PID:6172
- C:\Windows\System\XUUkKgH.exe
  C:\Windows\System\XUUkKgH.exe
  2⤵
  PID:6188
- C:\Windows\System\SoYXIqf.exe
  C:\Windows\System\SoYXIqf.exe
  2⤵
  PID:6204
- C:\Windows\System\vesIhGl.exe
  C:\Windows\System\vesIhGl.exe
  2⤵
  PID:6220
- C:\Windows\System\LdkqUUz.exe
  C:\Windows\System\LdkqUUz.exe
  2⤵
  PID:6236
- C:\Windows\System\TZZdesq.exe
  C:\Windows\System\TZZdesq.exe
  2⤵
  PID:6252
- C:\Windows\System\cVnziGp.exe
  C:\Windows\System\cVnziGp.exe
  2⤵
  PID:6268
- C:\Windows\System\fsfkPit.exe
  C:\Windows\System\fsfkPit.exe
  2⤵
  PID:6284
- C:\Windows\System\JRbQUKZ.exe
  C:\Windows\System\JRbQUKZ.exe
  2⤵
  PID:6300
- C:\Windows\System\HoklLeA.exe
  C:\Windows\System\HoklLeA.exe
  2⤵
  PID:6316
- C:\Windows\System\ZcdQbMp.exe
  C:\Windows\System\ZcdQbMp.exe
  2⤵
  PID:6332
- C:\Windows\System\lisTMqz.exe
  C:\Windows\System\lisTMqz.exe
  2⤵
  PID:6348
- C:\Windows\System\LQwkYTB.exe
  C:\Windows\System\LQwkYTB.exe
  2⤵
  PID:6364
- C:\Windows\System\mzcZGxQ.exe
  C:\Windows\System\mzcZGxQ.exe
  2⤵
  PID:6380
- C:\Windows\System\cSLhWhT.exe
  C:\Windows\System\cSLhWhT.exe
  2⤵
  PID:6396
- C:\Windows\System\MPjtPzh.exe
  C:\Windows\System\MPjtPzh.exe
  2⤵
  PID:6412
- C:\Windows\System\ONwyTKy.exe
  C:\Windows\System\ONwyTKy.exe
  2⤵
  PID:6428
- C:\Windows\System\hwZuhNz.exe
  C:\Windows\System\hwZuhNz.exe
  2⤵
  PID:6444
- C:\Windows\System\QFzByLq.exe
  C:\Windows\System\QFzByLq.exe
  2⤵
  PID:6472
- C:\Windows\System\qnrEGbF.exe
  C:\Windows\System\qnrEGbF.exe
  2⤵
  PID:6488
- C:\Windows\System\foLMblF.exe
  C:\Windows\System\foLMblF.exe
  2⤵
  PID:6508
- C:\Windows\System\lFiHKnN.exe
  C:\Windows\System\lFiHKnN.exe
  2⤵
  PID:6532
- C:\Windows\System\qlrMCjt.exe
  C:\Windows\System\qlrMCjt.exe
  2⤵
  PID:6552
- C:\Windows\System\qWlvFME.exe
  C:\Windows\System\qWlvFME.exe
  2⤵
  PID:6576
- C:\Windows\System\cDtXqIf.exe
  C:\Windows\System\cDtXqIf.exe
  2⤵
  PID:6600
- C:\Windows\System\uXzXxbw.exe
  C:\Windows\System\uXzXxbw.exe
  2⤵
  PID:6616
- C:\Windows\System\gqIEGns.exe
  C:\Windows\System\gqIEGns.exe
  2⤵
  PID:6632
- C:\Windows\System\doqIfJI.exe
  C:\Windows\System\doqIfJI.exe
  2⤵
  PID:6648
- C:\Windows\System\BAeCQTd.exe
  C:\Windows\System\BAeCQTd.exe
  2⤵
  PID:6668
- C:\Windows\System\MOpvRFS.exe
  C:\Windows\System\MOpvRFS.exe
  2⤵
  PID:6684
- C:\Windows\System\RAWlxGX.exe
  C:\Windows\System\RAWlxGX.exe
  2⤵
  PID:6700
- C:\Windows\System\xrgwTXX.exe
  C:\Windows\System\xrgwTXX.exe
  2⤵
  PID:6716
- C:\Windows\System\mDPARhC.exe
  C:\Windows\System\mDPARhC.exe
  2⤵
  PID:6732
- C:\Windows\System\VidjgUo.exe
  C:\Windows\System\VidjgUo.exe
  2⤵
  PID:6748
- C:\Windows\System\ZgfbyhZ.exe
  C:\Windows\System\ZgfbyhZ.exe
  2⤵
  PID:6764
- C:\Windows\System\yUqPsAe.exe
  C:\Windows\System\yUqPsAe.exe
  2⤵
  PID:6780
- C:\Windows\System\MgHxvlk.exe
  C:\Windows\System\MgHxvlk.exe
  2⤵
  PID:6796
- C:\Windows\System\KscikCJ.exe
  C:\Windows\System\KscikCJ.exe
  2⤵
  PID:6812
- C:\Windows\System\WHrGKiP.exe
  C:\Windows\System\WHrGKiP.exe
  2⤵
  PID:6828
- C:\Windows\System\lvavWDg.exe
  C:\Windows\System\lvavWDg.exe
  2⤵
  PID:6844
- C:\Windows\System\FKBDamx.exe
  C:\Windows\System\FKBDamx.exe
  2⤵
  PID:6860
- C:\Windows\System\BjdFWAc.exe
  C:\Windows\System\BjdFWAc.exe
  2⤵
  PID:6876
- C:\Windows\System\KGhWylV.exe
  C:\Windows\System\KGhWylV.exe
  2⤵
  PID:6892
- C:\Windows\System\yKXdvot.exe
  C:\Windows\System\yKXdvot.exe
  2⤵
  PID:6912
- C:\Windows\System\ejLNMZy.exe
  C:\Windows\System\ejLNMZy.exe
  2⤵
  PID:6928
- C:\Windows\System\LrDDKXI.exe
  C:\Windows\System\LrDDKXI.exe
  2⤵
  PID:6944
- C:\Windows\System\qMBKclK.exe
  C:\Windows\System\qMBKclK.exe
  2⤵
  PID:6960
- C:\Windows\System\feakngx.exe
  C:\Windows\System\feakngx.exe
  2⤵
  PID:6976
- C:\Windows\System\RmAEIiB.exe
  C:\Windows\System\RmAEIiB.exe
  2⤵
  PID:6992
- C:\Windows\System\YtZzdTZ.exe
  C:\Windows\System\YtZzdTZ.exe
  2⤵
  PID:7008
- C:\Windows\System\YiPbNPK.exe
  C:\Windows\System\YiPbNPK.exe
  2⤵
  PID:7024
- C:\Windows\System\yJjnOsf.exe
  C:\Windows\System\yJjnOsf.exe
  2⤵
  PID:7040
- C:\Windows\System\AjcdSwv.exe
  C:\Windows\System\AjcdSwv.exe
  2⤵
  PID:7056
- C:\Windows\System\wxJxMRS.exe
  C:\Windows\System\wxJxMRS.exe
  2⤵
  PID:7072
- C:\Windows\System\Tfvaytu.exe
  C:\Windows\System\Tfvaytu.exe
  2⤵
  PID:7088
- C:\Windows\System\VqAQNeG.exe
  C:\Windows\System\VqAQNeG.exe
  2⤵
  PID:7104
- C:\Windows\System\eLMHtQS.exe
  C:\Windows\System\eLMHtQS.exe
  2⤵
  PID:7120
- C:\Windows\System\DkpoHOv.exe
  C:\Windows\System\DkpoHOv.exe
  2⤵
  PID:7144
- C:\Windows\System\KctvTLC.exe
  C:\Windows\System\KctvTLC.exe
  2⤵
  PID:7160
- C:\Windows\System\rXxIHlQ.exe
  C:\Windows\System\rXxIHlQ.exe
  2⤵
  PID:5324
- C:\Windows\System\EkjXMmO.exe
  C:\Windows\System\EkjXMmO.exe
  2⤵
  PID:6164
- C:\Windows\System\NTXMJnj.exe
  C:\Windows\System\NTXMJnj.exe
  2⤵
  PID:6200
- C:\Windows\System\NqbtFtv.exe
  C:\Windows\System\NqbtFtv.exe
  2⤵
  PID:5468
- C:\Windows\System\kDGinVN.exe
  C:\Windows\System\kDGinVN.exe
  2⤵
  PID:5716
- C:\Windows\System\sfVuRPx.exe
  C:\Windows\System\sfVuRPx.exe
  2⤵
  PID:5984
- C:\Windows\System\ZCEikDb.exe
  C:\Windows\System\ZCEikDb.exe
  2⤵
  PID:5924
- C:\Windows\System\XcpAvKh.exe
  C:\Windows\System\XcpAvKh.exe
  2⤵
  PID:5196
- C:\Windows\System\ojijqCK.exe
  C:\Windows\System\ojijqCK.exe
  2⤵
  PID:6184
- C:\Windows\System\JBVQyyt.exe
  C:\Windows\System\JBVQyyt.exe
  2⤵
  PID:6292
- C:\Windows\System\QnmfRSi.exe
  C:\Windows\System\QnmfRSi.exe
  2⤵
  PID:6308
- C:\Windows\System\HOIARsT.exe
  C:\Windows\System\HOIARsT.exe
  2⤵
  PID:6392
- C:\Windows\System\yFrsgmC.exe
  C:\Windows\System\yFrsgmC.exe
  2⤵
  PID:6372
- C:\Windows\System\LFMfevr.exe
  C:\Windows\System\LFMfevr.exe
  2⤵
  PID:6376
- C:\Windows\System\wNaWjIt.exe
  C:\Windows\System\wNaWjIt.exe
  2⤵
  PID:6456
- C:\Windows\System\WxBPORg.exe
  C:\Windows\System\WxBPORg.exe
  2⤵
  PID:6496
- C:\Windows\System\PxygKjD.exe
  C:\Windows\System\PxygKjD.exe
  2⤵
  PID:6548
- C:\Windows\System\EjxxaXy.exe
  C:\Windows\System\EjxxaXy.exe
  2⤵
  PID:6596
- C:\Windows\System\rsDSKpF.exe
  C:\Windows\System\rsDSKpF.exe
  2⤵
  PID:6520
- C:\Windows\System\IQRXzBN.exe
  C:\Windows\System\IQRXzBN.exe
  2⤵
  PID:6628
- C:\Windows\System\bpUFAkm.exe
  C:\Windows\System\bpUFAkm.exe
  2⤵
  PID:6528
- C:\Windows\System\pIXWDFV.exe
  C:\Windows\System\pIXWDFV.exe
  2⤵
  PID:6568
- C:\Windows\System\AxtFlKE.exe
  C:\Windows\System\AxtFlKE.exe
  2⤵
  PID:6724
- C:\Windows\System\AZDguWH.exe
  C:\Windows\System\AZDguWH.exe
  2⤵
  PID:6680
- C:\Windows\System\TzMLwYq.exe
  C:\Windows\System\TzMLwYq.exe
  2⤵
  PID:6788
- C:\Windows\System\XCWkEaC.exe
  C:\Windows\System\XCWkEaC.exe
  2⤵
  PID:6888
- C:\Windows\System\IBUCwCc.exe
  C:\Windows\System\IBUCwCc.exe
  2⤵
  PID:6924
- C:\Windows\System\UcbxeZK.exe
  C:\Windows\System\UcbxeZK.exe
  2⤵
  PID:6952
- C:\Windows\System\hfoRrvl.exe
  C:\Windows\System\hfoRrvl.exe
  2⤵
  PID:6904
- C:\Windows\System\wFCpNiy.exe
  C:\Windows\System\wFCpNiy.exe
  2⤵
  PID:6940
- C:\Windows\System\UTNdaSx.exe
  C:\Windows\System\UTNdaSx.exe
  2⤵
  PID:6988
- C:\Windows\System\KhvOvYT.exe
  C:\Windows\System\KhvOvYT.exe
  2⤵
  PID:7052
- C:\Windows\System\QbNzXUR.exe
  C:\Windows\System\QbNzXUR.exe
  2⤵
  PID:7116
- C:\Windows\System\IbDGhCn.exe
  C:\Windows\System\IbDGhCn.exe
  2⤵
  PID:7156
- C:\Windows\System\OZAcmBI.exe
  C:\Windows\System\OZAcmBI.exe
  2⤵
  PID:7064
- C:\Windows\System\Bsgjvjc.exe
  C:\Windows\System\Bsgjvjc.exe
  2⤵
  PID:6228
- C:\Windows\System\ptBsyLd.exe
  C:\Windows\System\ptBsyLd.exe
  2⤵
  PID:6260
- C:\Windows\System\lepyNSQ.exe
  C:\Windows\System\lepyNSQ.exe
  2⤵
  PID:7128
- C:\Windows\System\kGIjrCk.exe
  C:\Windows\System\kGIjrCk.exe
  2⤵
  PID:7136
- C:\Windows\System\nOxnrNs.exe
  C:\Windows\System\nOxnrNs.exe
  2⤵
  PID:6100
- C:\Windows\System\yxViNMW.exe
  C:\Windows\System\yxViNMW.exe
  2⤵
  PID:4164
- C:\Windows\System\NQVmloV.exe
  C:\Windows\System\NQVmloV.exe
  2⤵
  PID:6148
- C:\Windows\System\RstvaDj.exe
  C:\Windows\System\RstvaDj.exe
  2⤵
  PID:6248
- C:\Windows\System\labhQeF.exe
  C:\Windows\System\labhQeF.exe
  2⤵
  PID:6280
- C:\Windows\System\eiqKqHj.exe
  C:\Windows\System\eiqKqHj.exe
  2⤵
  PID:6424
- C:\Windows\System\LXsLRhm.exe
  C:\Windows\System\LXsLRhm.exe
  2⤵
  PID:6592
- C:\Windows\System\xjoGvCX.exe
  C:\Windows\System\xjoGvCX.exe
  2⤵
  PID:6584
- C:\Windows\System\vMLubIi.exe
  C:\Windows\System\vMLubIi.exe
  2⤵
  PID:6452
- C:\Windows\System\QWkorTt.exe
  C:\Windows\System\QWkorTt.exe
  2⤵
  PID:6440
- C:\Windows\System\RkosEJH.exe
  C:\Windows\System\RkosEJH.exe
  2⤵
  PID:6540
- C:\Windows\System\MAXZzNk.exe
  C:\Windows\System\MAXZzNk.exe
  2⤵
  PID:6660
- C:\Windows\System\NZkkVWC.exe
  C:\Windows\System\NZkkVWC.exe
  2⤵
  PID:6760
- C:\Windows\System\LMuBJqq.exe
  C:\Windows\System\LMuBJqq.exe
  2⤵
  PID:6852
- C:\Windows\System\OHXfacx.exe
  C:\Windows\System\OHXfacx.exe
  2⤵
  PID:6744
- C:\Windows\System\gsoIuXb.exe
  C:\Windows\System\gsoIuXb.exe
  2⤵
  PID:6920
- C:\Windows\System\aQkuzRV.exe
  C:\Windows\System\aQkuzRV.exe
  2⤵
  PID:6900
- C:\Windows\System\SpSuoyP.exe
  C:\Windows\System\SpSuoyP.exe
  2⤵
  PID:7048
- C:\Windows\System\rsoebLu.exe
  C:\Windows\System\rsoebLu.exe
  2⤵
  PID:7100
- C:\Windows\System\cXjCFKe.exe
  C:\Windows\System\cXjCFKe.exe
  2⤵
  PID:6004
- C:\Windows\System\JgedTlX.exe
  C:\Windows\System\JgedTlX.exe
  2⤵
  PID:6328
- C:\Windows\System\KhcCagR.exe
  C:\Windows\System\KhcCagR.exe
  2⤵
  PID:7036
- C:\Windows\System\ZyHmWyE.exe
  C:\Windows\System\ZyHmWyE.exe
  2⤵
  PID:7000
- C:\Windows\System\LUEXtue.exe
  C:\Windows\System\LUEXtue.exe
  2⤵
  PID:4552
- C:\Windows\System\cbzmVmF.exe
  C:\Windows\System\cbzmVmF.exe
  2⤵
  PID:6624
- C:\Windows\System\zjTNxjR.exe
  C:\Windows\System\zjTNxjR.exe
  2⤵
  PID:6740
- C:\Windows\System\UNohCLc.exe
  C:\Windows\System\UNohCLc.exe
  2⤵
  PID:6936
- C:\Windows\System\amwVrJk.exe
  C:\Windows\System\amwVrJk.exe
  2⤵
  PID:6360
- C:\Windows\System\bKuYXMO.exe
  C:\Windows\System\bKuYXMO.exe
  2⤵
  PID:6464
- C:\Windows\System\kqeenaG.exe
  C:\Windows\System\kqeenaG.exe
  2⤵
  PID:6216
- C:\Windows\System\locnoIt.exe
  C:\Windows\System\locnoIt.exe
  2⤵
  PID:6388
- C:\Windows\System\ZfybtPf.exe
  C:\Windows\System\ZfybtPf.exe
  2⤵
  PID:6644
- C:\Windows\System\zcrcnRl.exe
  C:\Windows\System\zcrcnRl.exe
  2⤵
  PID:6972
- C:\Windows\System\vQKpnHQ.exe
  C:\Windows\System\vQKpnHQ.exe
  2⤵
  PID:6712
- C:\Windows\System\cZUlYGk.exe
  C:\Windows\System\cZUlYGk.exe
  2⤵
  PID:6516
- C:\Windows\System\MpzYKuO.exe
  C:\Windows\System\MpzYKuO.exe
  2⤵
  PID:6408
- C:\Windows\System\DfMpFPd.exe
  C:\Windows\System\DfMpFPd.exe
  2⤵
  PID:7188
- C:\Windows\System\pHvWbpS.exe
  C:\Windows\System\pHvWbpS.exe
  2⤵
  PID:7204
- C:\Windows\System\JbdMOEv.exe
  C:\Windows\System\JbdMOEv.exe
  2⤵
  PID:7220
- C:\Windows\System\DSXggji.exe
  C:\Windows\System\DSXggji.exe
  2⤵
  PID:7236
- C:\Windows\System\LbproiF.exe
  C:\Windows\System\LbproiF.exe
  2⤵
  PID:7252
- C:\Windows\System\iqGtEcX.exe
  C:\Windows\System\iqGtEcX.exe
  2⤵
  PID:7272
- C:\Windows\System\MucOhhz.exe
  C:\Windows\System\MucOhhz.exe
  2⤵
  PID:7292
- C:\Windows\System\rKplrll.exe
  C:\Windows\System\rKplrll.exe
  2⤵
  PID:7308
- C:\Windows\System\NoyhYfS.exe
  C:\Windows\System\NoyhYfS.exe
  2⤵
  PID:7328
- C:\Windows\System\WPCbXrJ.exe
  C:\Windows\System\WPCbXrJ.exe
  2⤵
  PID:7348
- C:\Windows\System\sPHMUPG.exe
  C:\Windows\System\sPHMUPG.exe
  2⤵
  PID:7384
- C:\Windows\System\RKglANN.exe
  C:\Windows\System\RKglANN.exe
  2⤵
  PID:7416
- C:\Windows\System\sdcqmMT.exe
  C:\Windows\System\sdcqmMT.exe
  2⤵
  PID:7436
- C:\Windows\System\OuYbmzw.exe
  C:\Windows\System\OuYbmzw.exe
  2⤵
  PID:7452
- C:\Windows\System\kSzJwqT.exe
  C:\Windows\System\kSzJwqT.exe
  2⤵
  PID:7468
- C:\Windows\System\qmGGDLF.exe
  C:\Windows\System\qmGGDLF.exe
  2⤵
  PID:7484
- C:\Windows\System\XHFydUM.exe
  C:\Windows\System\XHFydUM.exe
  2⤵
  PID:7500
- C:\Windows\System\YFQOKVt.exe
  C:\Windows\System\YFQOKVt.exe
  2⤵
  PID:7516
- C:\Windows\System\XMENbOv.exe
  C:\Windows\System\XMENbOv.exe
  2⤵
  PID:7536
- C:\Windows\System\uupsfuO.exe
  C:\Windows\System\uupsfuO.exe
  2⤵
  PID:7552
- C:\Windows\System\bsXCRkA.exe
  C:\Windows\System\bsXCRkA.exe
  2⤵
  PID:7568
- C:\Windows\System\BQuSPoT.exe
  C:\Windows\System\BQuSPoT.exe
  2⤵
  PID:7588
- C:\Windows\System\FtwVpGV.exe
  C:\Windows\System\FtwVpGV.exe
  2⤵
  PID:7604
- C:\Windows\System\nALiFQs.exe
  C:\Windows\System\nALiFQs.exe
  2⤵
  PID:7624
- C:\Windows\System\DLRyFai.exe
  C:\Windows\System\DLRyFai.exe
  2⤵
  PID:7640
- C:\Windows\System\pBzhKGJ.exe
  C:\Windows\System\pBzhKGJ.exe
  2⤵
  PID:7656
- C:\Windows\System\wKcminJ.exe
  C:\Windows\System\wKcminJ.exe
  2⤵
  PID:7672
- C:\Windows\System\khBWOVx.exe
  C:\Windows\System\khBWOVx.exe
  2⤵
  PID:7688
- C:\Windows\System\VNLKjce.exe
  C:\Windows\System\VNLKjce.exe
  2⤵
  PID:7716
- C:\Windows\System\ndihxuG.exe
  C:\Windows\System\ndihxuG.exe
  2⤵
  PID:8008
- C:\Windows\System\WTecWxb.exe
  C:\Windows\System\WTecWxb.exe
  2⤵
  PID:8028
- C:\Windows\System\XGmeKvk.exe
  C:\Windows\System\XGmeKvk.exe
  2⤵
  PID:8048
- C:\Windows\System\mRmwBzc.exe
  C:\Windows\System\mRmwBzc.exe
  2⤵
  PID:8076
- C:\Windows\System\jeKsXCM.exe
  C:\Windows\System\jeKsXCM.exe
  2⤵
  PID:8100
- C:\Windows\System\phntWfO.exe
  C:\Windows\System\phntWfO.exe
  2⤵
  PID:8124
- C:\Windows\System\KjusvdG.exe
  C:\Windows\System\KjusvdG.exe
  2⤵
  PID:8144
- C:\Windows\System\brFXFOq.exe
  C:\Windows\System\brFXFOq.exe
  2⤵
  PID:8160
- C:\Windows\System\EJgUXfO.exe
  C:\Windows\System\EJgUXfO.exe
  2⤵
  PID:8176
- C:\Windows\System\FAfocVl.exe
  C:\Windows\System\FAfocVl.exe
  2⤵
  PID:7180
- C:\Windows\System\wvJVdxz.exe
  C:\Windows\System\wvJVdxz.exe
  2⤵
  PID:6872
- C:\Windows\System\hxCKOgW.exe
  C:\Windows\System\hxCKOgW.exe
  2⤵
  PID:6504
- C:\Windows\System\lTWgJfp.exe
  C:\Windows\System\lTWgJfp.exe
  2⤵
  PID:6068
- C:\Windows\System\jxDwGVw.exe
  C:\Windows\System\jxDwGVw.exe
  2⤵
  PID:6196
- C:\Windows\System\ibiySwE.exe
  C:\Windows\System\ibiySwE.exe
  2⤵
  PID:7244
- C:\Windows\System\wjdbrPa.exe
  C:\Windows\System\wjdbrPa.exe
  2⤵
  PID:7284
- C:\Windows\System\orzGtdP.exe
  C:\Windows\System\orzGtdP.exe
  2⤵
  PID:7228
- C:\Windows\System\LkXGHPF.exe
  C:\Windows\System\LkXGHPF.exe
  2⤵
  PID:7232
- C:\Windows\System\YndKnfs.exe
  C:\Windows\System\YndKnfs.exe
  2⤵
  PID:7324
- C:\Windows\System\dEkkkTV.exe
  C:\Windows\System\dEkkkTV.exe
  2⤵
  PID:7368
- C:\Windows\System\XWESAWK.exe
  C:\Windows\System\XWESAWK.exe
  2⤵
  PID:7360
- C:\Windows\System\wanXsYF.exe
  C:\Windows\System\wanXsYF.exe
  2⤵
  PID:7432
- C:\Windows\System\FulWKit.exe
  C:\Windows\System\FulWKit.exe
  2⤵
  PID:7464
- C:\Windows\System\dnVDMcC.exe
  C:\Windows\System\dnVDMcC.exe
  2⤵
  PID:7444
- C:\Windows\System\BqjefBH.exe
  C:\Windows\System\BqjefBH.exe
  2⤵
  PID:7408
- C:\Windows\System\qxTKMyb.exe
  C:\Windows\System\qxTKMyb.exe
  2⤵
  PID:7480
- C:\Windows\System\wGNNfBz.exe
  C:\Windows\System\wGNNfBz.exe
  2⤵
  PID:7544
- C:\Windows\System\UVQrdbb.exe
  C:\Windows\System\UVQrdbb.exe
  2⤵
  PID:7632
- C:\Windows\System\YnONQTS.exe
  C:\Windows\System\YnONQTS.exe
  2⤵
  PID:7580
- C:\Windows\System\ijHHIUH.exe
  C:\Windows\System\ijHHIUH.exe
  2⤵
  PID:7648
- C:\Windows\System\evGdJNo.exe
  C:\Windows\System\evGdJNo.exe
  2⤵
  PID:7584
- C:\Windows\System\zJNFNUg.exe
  C:\Windows\System\zJNFNUg.exe
  2⤵
  PID:7700
- C:\Windows\System\bvpAQNb.exe
  C:\Windows\System\bvpAQNb.exe
  2⤵
  PID:7724
- C:\Windows\System\QkLHJXk.exe
  C:\Windows\System\QkLHJXk.exe
  2⤵
  PID:7748
- C:\Windows\System\gZMOlio.exe
  C:\Windows\System\gZMOlio.exe
  2⤵
  PID:7756
- C:\Windows\System\cnHmUSt.exe
  C:\Windows\System\cnHmUSt.exe
  2⤵
  PID:7776
- C:\Windows\System\MZUPzQl.exe
  C:\Windows\System\MZUPzQl.exe
  2⤵
  PID:7792
- C:\Windows\System\nifnAfH.exe
  C:\Windows\System\nifnAfH.exe
  2⤵
  PID:7808
- C:\Windows\System\HxGmgLA.exe
  C:\Windows\System\HxGmgLA.exe
  2⤵
  PID:7824
- C:\Windows\System\jaJKixI.exe
  C:\Windows\System\jaJKixI.exe
  2⤵
  PID:7840
- C:\Windows\System\PXaPCjp.exe
  C:\Windows\System\PXaPCjp.exe
  2⤵
  PID:7856
- C:\Windows\System\hLfIfIF.exe
  C:\Windows\System\hLfIfIF.exe
  2⤵
  PID:7872
- C:\Windows\System\nKZFiPT.exe
  C:\Windows\System\nKZFiPT.exe
  2⤵
  PID:7888
- C:\Windows\System\AUdDheZ.exe
  C:\Windows\System\AUdDheZ.exe
  2⤵
  PID:7904
- C:\Windows\System\pXQXLpQ.exe
  C:\Windows\System\pXQXLpQ.exe
  2⤵
  PID:7920
- C:\Windows\System\PQrcqMC.exe
  C:\Windows\System\PQrcqMC.exe
  2⤵
  PID:7936
- C:\Windows\System\batgyJr.exe
  C:\Windows\System\batgyJr.exe
  2⤵
  PID:7956
- C:\Windows\System\cbmqhqu.exe
  C:\Windows\System\cbmqhqu.exe
  2⤵
  PID:7972
- C:\Windows\System\OETUPCT.exe
  C:\Windows\System\OETUPCT.exe
  2⤵
  PID:7988
- C:\Windows\System\LCfmgat.exe
  C:\Windows\System\LCfmgat.exe
  2⤵
  PID:8000
- C:\Windows\System\LFFpQEl.exe
  C:\Windows\System\LFFpQEl.exe
  2⤵
  PID:8064
- C:\Windows\System\MpaQkEe.exe
  C:\Windows\System\MpaQkEe.exe
  2⤵
  PID:8116
- C:\Windows\System\bIEZHeT.exe
  C:\Windows\System\bIEZHeT.exe
  2⤵
  PID:8044
- C:\Windows\System\GcmIiZn.exe
  C:\Windows\System\GcmIiZn.exe
  2⤵
  PID:8152
- C:\Windows\System\jkMbYjM.exe
  C:\Windows\System\jkMbYjM.exe
  2⤵
  PID:8184
- C:\Windows\System\lVMgKoE.exe
  C:\Windows\System\lVMgKoE.exe
  2⤵
  PID:8132
- C:\Windows\System\zwGpqlx.exe
  C:\Windows\System\zwGpqlx.exe
  2⤵
  PID:5660
- C:\Windows\System\jrbphPY.exe
  C:\Windows\System\jrbphPY.exe
  2⤵
  PID:7260
- C:\Windows\System\MtWuhOT.exe
  C:\Windows\System\MtWuhOT.exe
  2⤵
  PID:7428
- C:\Windows\System\yCAJuiN.exe
  C:\Windows\System\yCAJuiN.exe
  2⤵
  PID:6824
- C:\Windows\System\ouCVgMs.exe
  C:\Windows\System\ouCVgMs.exe
  2⤵
  PID:7184
- C:\Windows\System\ODndpaY.exe
  C:\Windows\System\ODndpaY.exe
  2⤵
  PID:7288
- C:\Windows\System\KOpOYli.exe
  C:\Windows\System\KOpOYli.exe
  2⤵
  PID:7380
- C:\Windows\System\fxeqHuS.exe
  C:\Windows\System\fxeqHuS.exe
  2⤵
  PID:7448
- C:\Windows\System\iwGQudz.exe
  C:\Windows\System\iwGQudz.exe
  2⤵
  PID:7596
- C:\Windows\System\mWOSTOc.exe
  C:\Windows\System\mWOSTOc.exe
  2⤵
  PID:7732
- C:\Windows\System\wgQbjjP.exe
  C:\Windows\System\wgQbjjP.exe
  2⤵
  PID:7800
- C:\Windows\System\YDIrtVz.exe
  C:\Windows\System\YDIrtVz.exe
  2⤵
  PID:7864
- C:\Windows\System\sEobHfU.exe
  C:\Windows\System\sEobHfU.exe
  2⤵
  PID:7900
- C:\Windows\System\fprJYct.exe
  C:\Windows\System\fprJYct.exe
  2⤵
  PID:7996
- C:\Windows\System\RKruCKC.exe
  C:\Windows\System\RKruCKC.exe
  2⤵
  PID:8108
- C:\Windows\System\ITkztrV.exe
  C:\Windows\System\ITkztrV.exe
  2⤵
  PID:7032
- C:\Windows\System\KDDjWkQ.exe
  C:\Windows\System\KDDjWkQ.exe
  2⤵
  PID:7264
- C:\Windows\System\jTsfwqf.exe
  C:\Windows\System\jTsfwqf.exe
  2⤵
  PID:7916
- C:\Windows\System\sfzrlRs.exe
  C:\Windows\System\sfzrlRs.exe
  2⤵
  PID:8024
- C:\Windows\System\TkHkLfH.exe
  C:\Windows\System\TkHkLfH.exe
  2⤵
  PID:8040
- C:\Windows\System\gHWtuTW.exe
  C:\Windows\System\gHWtuTW.exe
  2⤵
  PID:7356
- C:\Windows\System\MFLbMiZ.exe
  C:\Windows\System\MFLbMiZ.exe
  2⤵
  PID:7912
- C:\Windows\System\RVHkjvP.exe
  C:\Windows\System\RVHkjvP.exe
  2⤵
  PID:7848
- C:\Windows\System\loTukUS.exe
  C:\Windows\System\loTukUS.exe
  2⤵
  PID:7784
- C:\Windows\System\nFDfyGU.exe
  C:\Windows\System\nFDfyGU.exe
  2⤵
  PID:7704
- C:\Windows\System\VDIbbzB.exe
  C:\Windows\System\VDIbbzB.exe
  2⤵
  PID:8168
- C:\Windows\System\AMtQncB.exe
  C:\Windows\System\AMtQncB.exe
  2⤵
  PID:6808
- C:\Windows\System\vscAdGk.exe
  C:\Windows\System\vscAdGk.exe
  2⤵
  PID:7652
- C:\Windows\System\AToMnCt.exe
  C:\Windows\System\AToMnCt.exe
  2⤵
  PID:7968
- C:\Windows\System\LGzLMVU.exe
  C:\Windows\System\LGzLMVU.exe
  2⤵
  PID:8156
- C:\Windows\System\gcxhKMa.exe
  C:\Windows\System\gcxhKMa.exe
  2⤵
  PID:7216
- C:\Windows\System\CMceOxR.exe
  C:\Windows\System\CMceOxR.exe
  2⤵
  PID:7984
- C:\Windows\System\AUXsAJS.exe
  C:\Windows\System\AUXsAJS.exe
  2⤵
  PID:7788
- C:\Windows\System\RHCgaZK.exe
  C:\Windows\System\RHCgaZK.exe
  2⤵
  PID:7400
- C:\Windows\System\knDOAxi.exe
  C:\Windows\System\knDOAxi.exe
  2⤵
  PID:7952
- C:\Windows\System\uHAeOUY.exe
  C:\Windows\System\uHAeOUY.exe
  2⤵
  PID:8004
- C:\Windows\System\fkDiqvc.exe
  C:\Windows\System\fkDiqvc.exe
  2⤵
  PID:6244
- C:\Windows\System\CWigiXo.exe
  C:\Windows\System\CWigiXo.exe
  2⤵
  PID:7668
- C:\Windows\System\EfuqWoy.exe
  C:\Windows\System\EfuqWoy.exe
  2⤵
  PID:7268
- C:\Windows\System\ukMxxxm.exe
  C:\Windows\System\ukMxxxm.exe
  2⤵
  PID:7712
- C:\Windows\System\oSKYchq.exe
  C:\Windows\System\oSKYchq.exe
  2⤵
  PID:6612
- C:\Windows\System\zhkReJE.exe
  C:\Windows\System\zhkReJE.exe
  2⤵
  PID:7836
- C:\Windows\System\XyzORZB.exe
  C:\Windows\System\XyzORZB.exe
  2⤵
  PID:7744
- C:\Windows\System\fmkfyLU.exe
  C:\Windows\System\fmkfyLU.exe
  2⤵
  PID:7772
- C:\Windows\System\XBGxVtb.exe
  C:\Windows\System\XBGxVtb.exe
  2⤵
  PID:7852
- C:\Windows\System\hulwXCR.exe
  C:\Windows\System\hulwXCR.exe
  2⤵
  PID:8036
- C:\Windows\System\YUUUzYS.exe
  C:\Windows\System\YUUUzYS.exe
  2⤵
  PID:7424
- C:\Windows\System\XHyqDQS.exe
  C:\Windows\System\XHyqDQS.exe
  2⤵
  PID:8200
- C:\Windows\System\evosXrT.exe
  C:\Windows\System\evosXrT.exe
  2⤵
  PID:8216
- C:\Windows\System\LooSUoP.exe
  C:\Windows\System\LooSUoP.exe
  2⤵
  PID:8232
- C:\Windows\System\HixUDRw.exe
  C:\Windows\System\HixUDRw.exe
  2⤵
  PID:8248
- C:\Windows\System\hLIRRxw.exe
  C:\Windows\System\hLIRRxw.exe
  2⤵
  PID:8264
- C:\Windows\System\HgHKRPt.exe
  C:\Windows\System\HgHKRPt.exe
  2⤵
  PID:8280
- C:\Windows\System\ZOISist.exe
  C:\Windows\System\ZOISist.exe
  2⤵
  PID:8296
- C:\Windows\System\bqZMUSS.exe
  C:\Windows\System\bqZMUSS.exe
  2⤵
  PID:8312
- C:\Windows\System\bmMIJef.exe
  C:\Windows\System\bmMIJef.exe
  2⤵
  PID:8328
- C:\Windows\System\QmIAIfW.exe
  C:\Windows\System\QmIAIfW.exe
  2⤵
  PID:8344
- C:\Windows\System\wIyPEDr.exe
  C:\Windows\System\wIyPEDr.exe
  2⤵
  PID:8360
- C:\Windows\System\ZQQanjv.exe
  C:\Windows\System\ZQQanjv.exe
  2⤵
  PID:8376
- C:\Windows\System\OlWFSRx.exe
  C:\Windows\System\OlWFSRx.exe
  2⤵
  PID:8392
- C:\Windows\System\aQZiNyM.exe
  C:\Windows\System\aQZiNyM.exe
  2⤵
  PID:8408
- C:\Windows\System\AVMRmUu.exe
  C:\Windows\System\AVMRmUu.exe
  2⤵
  PID:8424
- C:\Windows\System\luGKIuK.exe
  C:\Windows\System\luGKIuK.exe
  2⤵
  PID:8440
- C:\Windows\System\mauAIOj.exe
  C:\Windows\System\mauAIOj.exe
  2⤵
  PID:8456
- C:\Windows\System\fkRJBPA.exe
  C:\Windows\System\fkRJBPA.exe
  2⤵
  PID:8472
- C:\Windows\System\TrEcchA.exe
  C:\Windows\System\TrEcchA.exe
  2⤵
  PID:8488
- C:\Windows\System\JCbVHLo.exe
  C:\Windows\System\JCbVHLo.exe
  2⤵
  PID:8504
- C:\Windows\System\fXaMQXc.exe
  C:\Windows\System\fXaMQXc.exe
  2⤵
  PID:8520
- C:\Windows\System\IkhLvyV.exe
  C:\Windows\System\IkhLvyV.exe
  2⤵
  PID:8536
- C:\Windows\System\JpPdBZb.exe
  C:\Windows\System\JpPdBZb.exe
  2⤵
  PID:8552
- C:\Windows\System\RvYuOGM.exe
  C:\Windows\System\RvYuOGM.exe
  2⤵
  PID:8568
- C:\Windows\System\kmJtCTp.exe
  C:\Windows\System\kmJtCTp.exe
  2⤵
  PID:8584
- C:\Windows\System\KuRTxFA.exe
  C:\Windows\System\KuRTxFA.exe
  2⤵
  PID:8600
- C:\Windows\System\PHEYwFH.exe
  C:\Windows\System\PHEYwFH.exe
  2⤵
  PID:8616
- C:\Windows\System\WEDLeNt.exe
  C:\Windows\System\WEDLeNt.exe
  2⤵
  PID:8632
- C:\Windows\System\wbJreZU.exe
  C:\Windows\System\wbJreZU.exe
  2⤵
  PID:8648
- C:\Windows\System\MeCZfUX.exe
  C:\Windows\System\MeCZfUX.exe
  2⤵
  PID:8664
- C:\Windows\System\whUbsBC.exe
  C:\Windows\System\whUbsBC.exe
  2⤵
  PID:8680
- C:\Windows\System\JsSUOIL.exe
  C:\Windows\System\JsSUOIL.exe
  2⤵
  PID:8696
- C:\Windows\System\TkcUiwj.exe
  C:\Windows\System\TkcUiwj.exe
  2⤵
  PID:8712
- C:\Windows\System\iFAyVba.exe
  C:\Windows\System\iFAyVba.exe
  2⤵
  PID:8728
- C:\Windows\System\GpFPXtu.exe
  C:\Windows\System\GpFPXtu.exe
  2⤵
  PID:8744
- C:\Windows\System\DAxDDJl.exe
  C:\Windows\System\DAxDDJl.exe
  2⤵
  PID:8760
- C:\Windows\System\uHnSfEA.exe
  C:\Windows\System\uHnSfEA.exe
  2⤵
  PID:8776
- C:\Windows\System\ilIFZGD.exe
  C:\Windows\System\ilIFZGD.exe
  2⤵
  PID:8792
- C:\Windows\System\YFEoLFh.exe
  C:\Windows\System\YFEoLFh.exe
  2⤵
  PID:8808
- C:\Windows\System\KhWBrKW.exe
  C:\Windows\System\KhWBrKW.exe
  2⤵
  PID:8824
- C:\Windows\System\OFJLnAl.exe
  C:\Windows\System\OFJLnAl.exe
  2⤵
  PID:8840
- C:\Windows\System\MyRDvHt.exe
  C:\Windows\System\MyRDvHt.exe
  2⤵
  PID:8856
- C:\Windows\System\kJkwXVW.exe
  C:\Windows\System\kJkwXVW.exe
  2⤵
  PID:8872
- C:\Windows\System\bFUwcrt.exe
  C:\Windows\System\bFUwcrt.exe
  2⤵
  PID:8888
- C:\Windows\System\CyjTBBL.exe
  C:\Windows\System\CyjTBBL.exe
  2⤵
  PID:8904
- C:\Windows\System\ESNEQOQ.exe
  C:\Windows\System\ESNEQOQ.exe
  2⤵
  PID:8920
- C:\Windows\System\xgcZZKm.exe
  C:\Windows\System\xgcZZKm.exe
  2⤵
  PID:8936
- C:\Windows\System\VlEsOPi.exe
  C:\Windows\System\VlEsOPi.exe
  2⤵
  PID:8952
- C:\Windows\System\rzMvoNT.exe
  C:\Windows\System\rzMvoNT.exe
  2⤵
  PID:8968
- C:\Windows\System\YJlBJVx.exe
  C:\Windows\System\YJlBJVx.exe
  2⤵
  PID:8984
- C:\Windows\System\KFiCHeO.exe
  C:\Windows\System\KFiCHeO.exe
  2⤵
  PID:9000
- C:\Windows\System\BWuifou.exe
  C:\Windows\System\BWuifou.exe
  2⤵
  PID:9020
- C:\Windows\System\GsPRnZJ.exe
  C:\Windows\System\GsPRnZJ.exe
  2⤵
  PID:9036
- C:\Windows\System\uHshqpV.exe
  C:\Windows\System\uHshqpV.exe
  2⤵
  PID:9052
- C:\Windows\System\qPiElVs.exe
  C:\Windows\System\qPiElVs.exe
  2⤵
  PID:9068
- C:\Windows\System\FtoMqHY.exe
  C:\Windows\System\FtoMqHY.exe
  2⤵
  PID:9084
- C:\Windows\System\RHUrWuW.exe
  C:\Windows\System\RHUrWuW.exe
  2⤵
  PID:9100
- C:\Windows\System\fsuvzBJ.exe
  C:\Windows\System\fsuvzBJ.exe
  2⤵
  PID:9116
- C:\Windows\System\CCLjakZ.exe
  C:\Windows\System\CCLjakZ.exe
  2⤵
  PID:9132
- C:\Windows\System\PgiJLLw.exe
  C:\Windows\System\PgiJLLw.exe
  2⤵
  PID:9148
- C:\Windows\System\kpjpoZt.exe
  C:\Windows\System\kpjpoZt.exe
  2⤵
  PID:9164
- C:\Windows\System\FSgKhtj.exe
  C:\Windows\System\FSgKhtj.exe
  2⤵
  PID:9180
- C:\Windows\System\uvkvAwV.exe
  C:\Windows\System\uvkvAwV.exe
  2⤵
  PID:9196
- C:\Windows\System\YNQmyix.exe
  C:\Windows\System\YNQmyix.exe
  2⤵
  PID:9212
- C:\Windows\System\HQoxNSD.exe
  C:\Windows\System\HQoxNSD.exe
  2⤵
  PID:7564
- C:\Windows\System\GyxSAkB.exe
  C:\Windows\System\GyxSAkB.exe
  2⤵
  PID:7896
- C:\Windows\System\knnvhZP.exe
  C:\Windows\System\knnvhZP.exe
  2⤵
  PID:8256
- C:\Windows\System\WgahdlD.exe
  C:\Windows\System\WgahdlD.exe
  2⤵
  PID:8320
- C:\Windows\System\LtwXpKM.exe
  C:\Windows\System\LtwXpKM.exe
  2⤵
  PID:8356
- C:\Windows\System\JCvrhHk.exe
  C:\Windows\System\JCvrhHk.exe
  2⤵
  PID:8420
- C:\Windows\System\HlxuULS.exe
  C:\Windows\System\HlxuULS.exe
  2⤵
  PID:8480
- C:\Windows\System\lYTIaEJ.exe
  C:\Windows\System\lYTIaEJ.exe
  2⤵
  PID:8304
- C:\Windows\System\GKPhSeb.exe
  C:\Windows\System\GKPhSeb.exe
  2⤵
  PID:8336
- C:\Windows\System\sjbMgVm.exe
  C:\Windows\System\sjbMgVm.exe
  2⤵
  PID:8496
- C:\Windows\System\SyPcLiu.exe
  C:\Windows\System\SyPcLiu.exe
  2⤵
  PID:8432
- C:\Windows\System\WYFJjqM.exe
  C:\Windows\System\WYFJjqM.exe
  2⤵
  PID:8368
- C:\Windows\System\mWUKAjt.exe
  C:\Windows\System\mWUKAjt.exe
  2⤵
  PID:8576
- C:\Windows\System\oVitRJA.exe
  C:\Windows\System\oVitRJA.exe
  2⤵
  PID:8596
- C:\Windows\System\qzDTdCX.exe
  C:\Windows\System\qzDTdCX.exe
  2⤵
  PID:8656
- C:\Windows\System\AqaxcVy.exe
  C:\Windows\System\AqaxcVy.exe
  2⤵
  PID:8612
- C:\Windows\System\WFYPfMJ.exe
  C:\Windows\System\WFYPfMJ.exe
  2⤵
  PID:8704
- C:\Windows\System\sPmhYjo.exe
  C:\Windows\System\sPmhYjo.exe
  2⤵
  PID:8736
- C:\Windows\System\dWkQDhZ.exe
  C:\Windows\System\dWkQDhZ.exe
  2⤵
  PID:8752
- C:\Windows\System\ldEpPQg.exe
  C:\Windows\System\ldEpPQg.exe
  2⤵
  PID:8688
- C:\Windows\System\WUuggpY.exe
  C:\Windows\System\WUuggpY.exe
  2⤵
  PID:8804
- C:\Windows\System\eQBMQiy.exe
  C:\Windows\System\eQBMQiy.exe
  2⤵
  PID:7764
- C:\Windows\System\SgEAgjk.exe
  C:\Windows\System\SgEAgjk.exe
  2⤵
  PID:8932
- C:\Windows\System\indeQkm.exe
  C:\Windows\System\indeQkm.exe
  2⤵
  PID:8996
- C:\Windows\System\xcpKiDa.exe
  C:\Windows\System\xcpKiDa.exe
  2⤵
  PID:8820
- C:\Windows\System\ADjjhCC.exe
  C:\Windows\System\ADjjhCC.exe
  2⤵
  PID:8980
- C:\Windows\System\JoZaEES.exe
  C:\Windows\System\JoZaEES.exe
  2⤵
  PID:9060
- C:\Windows\System\CQuAfPy.exe
  C:\Windows\System\CQuAfPy.exe
  2⤵
  PID:9124
- C:\Windows\System\evkeeNk.exe
  C:\Windows\System\evkeeNk.exe
  2⤵
  PID:8916
- C:\Windows\System\cWQQSIJ.exe
  C:\Windows\System\cWQQSIJ.exe
  2⤵
  PID:9156
- C:\Windows\System\NHZrGIG.exe
  C:\Windows\System\NHZrGIG.exe
  2⤵
  PID:9048
- C:\Windows\System\vuQqhCk.exe
  C:\Windows\System\vuQqhCk.exe
  2⤵
  PID:9144
- C:\Windows\System\bqwwdzn.exe
  C:\Windows\System\bqwwdzn.exe
  2⤵
  PID:9172
- C:\Windows\System\ThACgCg.exe
  C:\Windows\System\ThACgCg.exe
  2⤵
  PID:8196
- C:\Windows\System\fyAvOUu.exe
  C:\Windows\System\fyAvOUu.exe
  2⤵
  PID:8272
- C:\Windows\System\nKgZOvz.exe
  C:\Windows\System\nKgZOvz.exe
  2⤵
  PID:8448
- C:\Windows\System\LQlYWBG.exe
  C:\Windows\System\LQlYWBG.exe
  2⤵
  PID:8400
- C:\Windows\System\IjWXpIu.exe
  C:\Windows\System\IjWXpIu.exe
  2⤵
  PID:8516
- C:\Windows\System\nTeYXUY.exe
  C:\Windows\System\nTeYXUY.exe
  2⤵
  PID:8292
- C:\Windows\System\gRQzGXB.exe
  C:\Windows\System\gRQzGXB.exe
  2⤵
  PID:8548
- C:\Windows\System\bLMajDa.exe
  C:\Windows\System\bLMajDa.exe
  2⤵
  PID:8676
- C:\Windows\System\mGqXnJU.exe
  C:\Windows\System\mGqXnJU.exe
  2⤵
  PID:8832
- C:\Windows\System\RTCNmIX.exe
  C:\Windows\System\RTCNmIX.exe
  2⤵
  PID:8816
- C:\Windows\System\GopGPJz.exe
  C:\Windows\System\GopGPJz.exe
  2⤵
  PID:8944
- C:\Windows\System\zsRDRGz.exe
  C:\Windows\System\zsRDRGz.exe
  2⤵
  PID:9192
- C:\Windows\System\ESLqDhl.exe
  C:\Windows\System\ESLqDhl.exe
  2⤵
  PID:8464
- C:\Windows\System\XDaoUBT.exe
  C:\Windows\System\XDaoUBT.exe
  2⤵
  PID:8640
- C:\Windows\System\zVizWXA.exe
  C:\Windows\System\zVizWXA.exe
  2⤵
  PID:9228
- C:\Windows\System\XyoHFgc.exe
  C:\Windows\System\XyoHFgc.exe
  2⤵
  PID:9248
- C:\Windows\System\DZlfmDx.exe
  C:\Windows\System\DZlfmDx.exe
  2⤵
  PID:9264
- C:\Windows\System\MqKscEf.exe
  C:\Windows\System\MqKscEf.exe
  2⤵
  PID:9280
- C:\Windows\System\ttFfrqm.exe
  C:\Windows\System\ttFfrqm.exe
  2⤵
  PID:9296
- C:\Windows\System\fwJcYYI.exe
  C:\Windows\System\fwJcYYI.exe
  2⤵
  PID:9312
- C:\Windows\System\ZraqsnU.exe
  C:\Windows\System\ZraqsnU.exe
  2⤵
  PID:9328
- C:\Windows\System\CRPmaru.exe
  C:\Windows\System\CRPmaru.exe
  2⤵
  PID:9344
- C:\Windows\System\jTselEj.exe
  C:\Windows\System\jTselEj.exe
  2⤵
  PID:9360
- C:\Windows\System\joYzdSt.exe
  C:\Windows\System\joYzdSt.exe
  2⤵
  PID:9376
- C:\Windows\System\slBWWPi.exe
  C:\Windows\System\slBWWPi.exe
  2⤵
  PID:9392
- C:\Windows\System\sjJRWJr.exe
  C:\Windows\System\sjJRWJr.exe
  2⤵
  PID:9408
- C:\Windows\System\tgZKmUO.exe
  C:\Windows\System\tgZKmUO.exe
  2⤵
  PID:9424
- C:\Windows\System\emmmKtu.exe
  C:\Windows\System\emmmKtu.exe
  2⤵
  PID:9440
- C:\Windows\System\LpXJKlN.exe
  C:\Windows\System\LpXJKlN.exe
  2⤵
  PID:9456
- C:\Windows\System\DBEUDVF.exe
  C:\Windows\System\DBEUDVF.exe
  2⤵
  PID:9472
- C:\Windows\System\QmjxxJk.exe
  C:\Windows\System\QmjxxJk.exe
  2⤵
  PID:9488
- C:\Windows\System\GHHWFju.exe
  C:\Windows\System\GHHWFju.exe
  2⤵
  PID:9504
- C:\Windows\System\QEcjoqE.exe
  C:\Windows\System\QEcjoqE.exe
  2⤵
  PID:9520
- C:\Windows\System\quxVern.exe
  C:\Windows\System\quxVern.exe
  2⤵
  PID:9536
- C:\Windows\System\pmDdJpV.exe
  C:\Windows\System\pmDdJpV.exe
  2⤵
  PID:9556
- C:\Windows\System\XGkOQQA.exe
  C:\Windows\System\XGkOQQA.exe
  2⤵
  PID:9572
- C:\Windows\System\ylLFyHP.exe
  C:\Windows\System\ylLFyHP.exe
  2⤵
  PID:9588
- C:\Windows\System\ohbpAlu.exe
  C:\Windows\System\ohbpAlu.exe
  2⤵
  PID:9604
- C:\Windows\System\EVBQAXR.exe
  C:\Windows\System\EVBQAXR.exe
  2⤵
  PID:9620
- C:\Windows\System\tHWnegi.exe
  C:\Windows\System\tHWnegi.exe
  2⤵
  PID:9636
- C:\Windows\System\hSeUUAe.exe
  C:\Windows\System\hSeUUAe.exe
  2⤵
  PID:9652
- C:\Windows\System\WPPRiRK.exe
  C:\Windows\System\WPPRiRK.exe
  2⤵
  PID:9668
- C:\Windows\System\vyBOxMk.exe
  C:\Windows\System\vyBOxMk.exe
  2⤵
  PID:9792
- C:\Windows\System\gxBgGfx.exe
  C:\Windows\System\gxBgGfx.exe
  2⤵
  PID:9856
- C:\Windows\System\VgAejUq.exe
  C:\Windows\System\VgAejUq.exe
  2⤵
  PID:9872
- C:\Windows\System\gXPEIPD.exe
  C:\Windows\System\gXPEIPD.exe
  2⤵
  PID:9896
- C:\Windows\System\COsNQGp.exe
  C:\Windows\System\COsNQGp.exe
  2⤵
  PID:9912
- C:\Windows\System\mNSzJpV.exe
  C:\Windows\System\mNSzJpV.exe
  2⤵
  PID:9928
- C:\Windows\System\shWoGbQ.exe
  C:\Windows\System\shWoGbQ.exe
  2⤵
  PID:9944
- C:\Windows\System\klXQGpi.exe
  C:\Windows\System\klXQGpi.exe
  2⤵
  PID:9960
- C:\Windows\System\NxlYYbD.exe
  C:\Windows\System\NxlYYbD.exe
  2⤵
  PID:9976
- C:\Windows\System\KspfhtQ.exe
  C:\Windows\System\KspfhtQ.exe
  2⤵
  PID:9992
- C:\Windows\System\RUJyTiZ.exe
  C:\Windows\System\RUJyTiZ.exe
  2⤵
  PID:10008
- C:\Windows\System\wxhNwsP.exe
  C:\Windows\System\wxhNwsP.exe
  2⤵
  PID:10024
- C:\Windows\System\FTlmtQJ.exe
  C:\Windows\System\FTlmtQJ.exe
  2⤵
  PID:10040
- C:\Windows\System\hXZVsDu.exe
  C:\Windows\System\hXZVsDu.exe
  2⤵
  PID:10056
- C:\Windows\System\AETiABE.exe
  C:\Windows\System\AETiABE.exe
  2⤵
  PID:10072
- C:\Windows\System\GngUoRq.exe
  C:\Windows\System\GngUoRq.exe
  2⤵
  PID:10088
- C:\Windows\System\LuuMhUB.exe
  C:\Windows\System\LuuMhUB.exe
  2⤵
  PID:10104
- C:\Windows\System\ZeVyJni.exe
  C:\Windows\System\ZeVyJni.exe
  2⤵
  PID:10120
- C:\Windows\System\YbQeqUc.exe
  C:\Windows\System\YbQeqUc.exe
  2⤵
  PID:8740
- C:\Windows\System\mqzWRzR.exe
  C:\Windows\System\mqzWRzR.exe
  2⤵
  PID:9908
- C:\Windows\System\HeoRziG.exe
  C:\Windows\System\HeoRziG.exe
  2⤵
  PID:9824
- C:\Windows\System\idRaCaF.exe
  C:\Windows\System\idRaCaF.exe
  2⤵
  PID:9840
- C:\Windows\System\JpnWiLg.exe
  C:\Windows\System\JpnWiLg.exe
  2⤵
  PID:9880
- C:\Windows\System\KapXZZa.exe
  C:\Windows\System\KapXZZa.exe
  2⤵
  PID:9920
- C:\Windows\System\tZAdmQR.exe
  C:\Windows\System\tZAdmQR.exe
  2⤵
  PID:9956
- C:\Windows\System\WZdfKkx.exe
  C:\Windows\System\WZdfKkx.exe
  2⤵
  PID:9988
- C:\Windows\System\VPIfbFv.exe
  C:\Windows\System\VPIfbFv.exe
  2⤵
  PID:10052
- C:\Windows\System\bBkJtyx.exe
  C:\Windows\System\bBkJtyx.exe
  2⤵
  PID:10084
- C:\Windows\System\hQpVaQa.exe
  C:\Windows\System\hQpVaQa.exe
  2⤵
  PID:10016
- C:\Windows\System\fbEkdRq.exe
  C:\Windows\System\fbEkdRq.exe
  2⤵
  PID:10112
- C:\Windows\System\muyQLdC.exe
  C:\Windows\System\muyQLdC.exe
  2⤵
  PID:10140
- C:\Windows\System\QfAWJEN.exe
  C:\Windows\System\QfAWJEN.exe
  2⤵
  PID:10172
- C:\Windows\System\EBiycPg.exe
  C:\Windows\System\EBiycPg.exe
  2⤵
  PID:10188
- C:\Windows\System\SwpSIQM.exe
  C:\Windows\System\SwpSIQM.exe
  2⤵
  PID:10204
- C:\Windows\System\DzdmkrI.exe
  C:\Windows\System\DzdmkrI.exe
  2⤵
  PID:10224
- C:\Windows\System\krUatnu.exe
  C:\Windows\System\krUatnu.exe
  2⤵
  PID:8864
- C:\Windows\System\wkCSqwC.exe
  C:\Windows\System\wkCSqwC.exe
  2⤵
  PID:8208
- C:\Windows\System\bDhkHLr.exe
  C:\Windows\System\bDhkHLr.exe
  2⤵
  PID:9224
- C:\Windows\System\PBdZCKK.exe
  C:\Windows\System\PBdZCKK.exe
  2⤵
  PID:8976
- C:\Windows\System\FWsqsjc.exe
  C:\Windows\System\FWsqsjc.exe
  2⤵
  PID:9420
- C:\Windows\System\IulrtvI.exe
  C:\Windows\System\IulrtvI.exe
  2⤵
  PID:9204
- C:\Windows\System\KbmkQUa.exe
  C:\Windows\System\KbmkQUa.exe
  2⤵
  PID:9432
- C:\Windows\System\rARaAxn.exe
  C:\Windows\System\rARaAxn.exe
  2⤵
  PID:8948
- C:\Windows\System\REpSJLr.exe
  C:\Windows\System\REpSJLr.exe
  2⤵
  PID:9256
- C:\Windows\System\aAnoImi.exe
  C:\Windows\System\aAnoImi.exe
  2⤵
  PID:9416
- C:\Windows\System\KatdmJS.exe
  C:\Windows\System\KatdmJS.exe
  2⤵
  PID:9324
- C:\Windows\System\zNneVGu.exe
  C:\Windows\System\zNneVGu.exe
  2⤵
  PID:9276
- C:\Windows\System\vqyPeWt.exe
  C:\Windows\System\vqyPeWt.exe
  2⤵
  PID:9496
- C:\Windows\System\UAukjlP.exe
  C:\Windows\System\UAukjlP.exe
  2⤵
  PID:9596
- C:\Windows\System\KDbcDNn.exe
  C:\Windows\System\KDbcDNn.exe
  2⤵
  PID:9616
- C:\Windows\System\IciVRUu.exe
  C:\Windows\System\IciVRUu.exe
  2⤵
  PID:9644
- C:\Windows\System\DlIIbxz.exe
  C:\Windows\System\DlIIbxz.exe
  2⤵
  PID:9660
- C:\Windows\System\vORPviF.exe
  C:\Windows\System\vORPviF.exe
  2⤵
  PID:9680
- C:\Windows\System\xDmZzvA.exe
  C:\Windows\System\xDmZzvA.exe
  2⤵
  PID:9868
- C:\Windows\System\zRGdgpE.exe
  C:\Windows\System\zRGdgpE.exe
  2⤵
  PID:9892
- C:\Windows\System\hAujynT.exe
  C:\Windows\System\hAujynT.exe
  2⤵
  PID:10132
- C:\Windows\System\oudKKIe.exe
  C:\Windows\System\oudKKIe.exe
  2⤵
  PID:10220
- C:\Windows\System\IGWgbot.exe
  C:\Windows\System\IGWgbot.exe
  2⤵
  PID:10232
- C:\Windows\System\DpAKRCP.exe
  C:\Windows\System\DpAKRCP.exe
  2⤵
  PID:8660
- C:\Windows\System\SDGBhSo.exe
  C:\Windows\System\SDGBhSo.exe
  2⤵
  PID:8672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DwmXfkf.exe

Filesize
1.5MB

MD5
fcf49e02b1b8f2d5a851b864cee4676f

SHA1
d72356619bffa5142909e8ccd0f4bfeecce63bb0

SHA256
ffef64723ef017c42aed20286e975f6711f6aa77cdd26d3c9e46f6aa5f47e8dc

SHA512
64c8a155e821d9991728f0022df07fd6ac21b56de047af657fdb932a4a1dd1f2bbcca4fc8d9bb9788efba080a52810e319fd038984bd7d40558fc76182c421e3

Download Submit
C:\Windows\system\EmagHUp.exe

Filesize
1.5MB

MD5
6535a65f78fc8a95903fb1547365b575

SHA1
ffc19642e42aa9cd71259b6e5c2a04466f6d491a

SHA256
eac9035a724d627d5c1b80fa38a59f71b67baa7cd8e413e9486ec10344712f62

SHA512
16783e069b8f43dcc70c29042a2e1310069df2f2e9959cf19e650ebcfa48c908198a3fb7a589895d128421978aa202668a24cc2284c0ef9327670cbbf517d1fd

Download Submit
C:\Windows\system\GnnHqff.exe

Filesize
1.5MB

MD5
f27a21fd94670a5d4ef2cd1ef34363ef

SHA1
8960c2015a4aa94ed5320590a529a53a236c2b7f

SHA256
ac33bbdd9652e508d3c4b4a609c374c22ffc28b80f181e6102ad2733f782bc5b

SHA512
2638dbb098c9ccfd3f3d4bf29e964441014bf2fea7907ba4423cf4e20679f557d990fc2826fe23a035a47e4f93e0f66b93ca7aa6663399f5c304a913e81d6379

Download Submit
C:\Windows\system\HlZzGZn.exe

Filesize
1.5MB

MD5
26c0b52938e79f62ebe389f66d44e7ff

SHA1
27ff0293f0a25f7b3bf23cd4bc6aec8000c85377

SHA256
00bcab08eb82c92df29d681d9ba79da33606550b749946ddf5a395de9ae9def6

SHA512
529591a51ef7ab489ae46da677f44538489f0f40592dfa079cd4ec4586af0017e5851c0faa728a2929aa1c3fec7c62bc21610db94948c7a12a462868c451664f

Download Submit
C:\Windows\system\IVXFJdQ.exe

Filesize
1.5MB

MD5
d7215ae283be466ee9564711e7db4121

SHA1
fc06782d5fa967fb3b107755800eb9d761c5f8f8

SHA256
92edf8505bafb42e7e97747684c9ef3101b75eca4345b75f1ba35a00db227ce9

SHA512
15874b43c900ef492935fd9f4787ef1380eac9e18f44213ae4910c05727513dfb4e5d07a497e4fef54bb1a29ace46e921fb6f338c54b1f375b4245dac8a41826

Download Submit
C:\Windows\system\IscEJBQ.exe

Filesize
1.5MB

MD5
bf18752b60080e8b0beef49738b94837

SHA1
b5cc5421ab6ee292b535ea53f1ca81214eb3c59d

SHA256
3afca243d566912868ebd9cf8d9fe7c0f7fd29c8a8f110094760f7e8ef73fdc6

SHA512
5591bbfef3e25c49dfb3abced07212687240d014e544e2022ad994871b83eadf2d68326534e9a6ceeba8503246caa632faa1539f0d9eedd1082b812bdb8db520

Download Submit
C:\Windows\system\IxFDxNq.exe

Filesize
1.5MB

MD5
b95daa7935f96ac22caf40951943319b

SHA1
ce1e04236e160f5fd7c84744b43caf927fa7092b

SHA256
2a3b7151c69e970be004d3a3722c82327bcdc631872edd44de93087a6f123dc5

SHA512
520d9f5f9590a2ecfcb62b86f3bed544ee28e15cbcd9bb00b4d6ebb787ce7cf43feef63fd9fe097f5b17420c6cdd8937a491fe2935d4da1716721af40f1e7cb0

Download Submit
C:\Windows\system\JwPAGrL.exe

Filesize
1.5MB

MD5
586987f14733673430ee246eeb23f1ec

SHA1
0188080eeee93a7b7794f977630141c7553e1fe5

SHA256
c7d0e4146b3e1f05afb03203b3d8f2b9378812189a5377858580a31b60002b57

SHA512
885cd9f3265b202f4aa6c6e416bf0a85c66d92e51001dca1365a2adf9b04c00c7657736aa31b55a810c6c052589d327a6667fb5ad73836c6e8299a0447ef0532

Download Submit
C:\Windows\system\KZhXONh.exe

Filesize
1.5MB

MD5
59a892ca86e858f81a34c32774142fb2

SHA1
2f8721a8247fa3e623f5ae43d6531083e90f1606

SHA256
d08ff833e63382d3fbcdb5772b0bba48b0f9380c9a250e6c0f260c088fe57e35

SHA512
962382cc3be87d0a4de7a96d6379fdbace7bf9c7753927f2ba6e53711448d42cf1d773edf84de128d43c8e5a537e5214067251b0e540b0b28c667eeb3609c885

Download Submit
C:\Windows\system\OejBDzK.exe

Filesize
1.5MB

MD5
c9b4fad707a0673633ba343a2460afab

SHA1
30eccfb38c4e8526a4627affee8019db13b88442

SHA256
3d78136cc404933aade64172018746d1c50e4cde7fff475339123e46d0279f60

SHA512
a5d322faf85f631837432be19ed9f54151e8ab3c08d73b6b3872c0bf5fc4078c93566a0218f9e9358ab3c5da17bbb7b7d39355063e48a6aa2eca5bce1060a6aa

Download Submit
C:\Windows\system\QIzyJmg.exe

Filesize
1.5MB

MD5
6066999a3bd844f2d978b960a10be9fb

SHA1
5aa2ed54acfb5e05938a002131b5b5142dc07d04

SHA256
ec9d83a24246dde0e649bfe22d956e014d9b52ef45cdd46b2059cfb479756261

SHA512
411952a921fbf4f1a1481c5d8aca867984fcd4e3607efd679b0d8140d9ca9cd7b4a0454f1420aa80b70c56220ec61f8e0debe9fd5fa775076be5982362eedaa6

Download Submit
C:\Windows\system\RWsXJXW.exe

Filesize
1.5MB

MD5
f6d99c9c0e3ef75b031b5e8973327988

SHA1
a7c918d586dffe35baeb68ef9f5f5b2288a04a2b

SHA256
ca3885376671912281d9994ae315242dc22bb8069ba808741187299cf9000aa9

SHA512
e620b03b935f612ef4a8f802adcebeadb733dbc8f933df2dfd7459a159aaa691aea0bf6f28038e87bfc56df46748e48ce6e8d09155ca1f0980000f44f6bbde88

Download Submit
C:\Windows\system\Rbhbion.exe

Filesize
1.5MB

MD5
365c4b0fc9a157f17f761b725b34d3c6

SHA1
6462cebfcb65203ec1b656228b11af2f9e55f283

SHA256
4f6337a33645d6947e64f85aa901eb96b9b1538871d61a724397090c74b9855b

SHA512
663deaf341dc86731281042513ac3b584802ff2f91176ec5a7cea9d0efd9437e90854a8ad6978e6b5ec2fe572cde2d24cbdaae693d052a5773177e57fd557d50

Download Submit
C:\Windows\system\SqfCKCY.exe

Filesize
1.5MB

MD5
fcb0d9397d4b84bee59737db0a72908c

SHA1
0a9bdae9dc7257f6623b91cf21d658deedec10a8

SHA256
18547239e1c0a6da35f8eb17e422e0d23e596461f6b211e22d0467c2a36b1dd3

SHA512
a7fdd63f2f9bebeb6cfafc156a879bbde7452122b65196bad8a8da87465c371b41b1f9a0b0b2f98695882166822efb8ab917512c793a0c6174c0c9fbd59c15b0

Download Submit
C:\Windows\system\YbycPnJ.exe

Filesize
1.5MB

MD5
ec69d917380c2a7caf51512bd11d8246

SHA1
fdd8ceac5b4eea23431877996863eca07a8ebae7

SHA256
175e028000740ad4a8ad668cc51542cfa8d3dbce225bf886aa793213400087ee

SHA512
61a98c096c4687335b13fdd770a79a8add148747a806aac1f56e58cd21302917107bfbc4deb56068f94af8dc55dc4f302dd87660b57c43880f7f82a3c27c4462

Download Submit
C:\Windows\system\ZncSWYM.exe

Filesize
1.5MB

MD5
4d9e93b5dd8dfb2611faa235884523b3

SHA1
bf0a8a972a3c426a2d0bdbcc655f6c8015bf9be1

SHA256
d506b8eba5c15d819b58e12e429082d4bea765aa52a3b0f5a2c852064413a4d8

SHA512
d3567eab883755cd28d605c35eb8aa6f15eb16933a050427717aca8d2f8d7b48af6f1d00d87b4cf353d5ac852e7361a9877d4f4c8523a513b6c5a825e9dbe5b4

Download Submit
C:\Windows\system\ahGPOeP.exe

Filesize
1.5MB

MD5
a1dc67bee047c17b117ee706f0ed847b

SHA1
7c1e0431aa0609f24de8a01f6897ae985403305d

SHA256
4bcdaeaf4cd1348fd8f3406b0c0d1a6b3fce03568b3ca2151358516b5e1e416d

SHA512
9824a9a3e4e01cbc22301c10527ae6b9a5667051348a4e26356c9e302c83ae77e37486db1f93147fc446a20f2990bec7edb9bd7aabc2f176bbf6731f97347d78

Download Submit
C:\Windows\system\cEPUJrE.exe

Filesize
1.5MB

MD5
3b5cb3cf517db4f2995de79ad303d4fa

SHA1
8e74a92c9ccf68c0e923832dab37293fd5874579

SHA256
018cfe40e9c884bc08ffe8555cdbcbdc4da4ee871c448ae945878a98e343e7dd

SHA512
6c5f8ce7735a5c60a8a146a3452f406de89312485930a800a24442cc4546e9df49b263e01b187340263f3c6d0dea0535e8b07147270c0276ca549dd8cd233ed0

Download Submit
C:\Windows\system\eOjYLFg.exe

Filesize
1.5MB

MD5
e630dd3b54b58121f91ff48b18a13a1e

SHA1
aff8eefedc75aea5ec369918cbc63a7b3fb7b349

SHA256
9d63ba987d0dd223a3d03167b823a2a894eb5e13e638b016b06c641e496c65a3

SHA512
40386dc799d053ca2b4da53dce9b07ef21e204d5a8ce30cc0726fb8b718d683727d123d2606410367f31d42d9c38a31788c3fa7479af661b928f0d808e70329a

Download Submit
C:\Windows\system\gswEDiO.exe

Filesize
1.5MB

MD5
5bbdd7a20e6c070fb16bdba0857a36db

SHA1
626218c3bc4c2766ab4fe1b09ae163895d58ec1b

SHA256
6f386e34034f4736dddcb3e46762d948c37f3f79c1acd75bfe86d30a147ec48c

SHA512
d09d6fd4a478372a33ef3f98da388ab2bb1656a64a61f3f259c26afafe5f375462501359a97f16a3d975351151086a040d307cd21c70375ebba15eac6f32da90

Download Submit
C:\Windows\system\kwPmDCO.exe

Filesize
1.5MB

MD5
39328ccbcd1388ebf953212d85f638bb

SHA1
3ee8d6b219432cad4eef21dfa6c6414a7c82c3f7

SHA256
0d3d9712a9f70a84f024af8408ff1675b96748b6a8b3912e01fa95428fee1bf9

SHA512
eb7564d8581609188dcb564af3a510e11a4d83cd1230be1ec344a904cfe10c2c8c5eb83650269dfe0d5af401700b523b7b9bbd380868575c70dd491f2d724b9f

Download Submit
C:\Windows\system\mAHLUDM.exe

Filesize
1.5MB

MD5
d9d3eca9c8f010d636be111446a32062

SHA1
0af3a90d8cf7fdeb3e5a5ddb0044c22fb3f92963

SHA256
904f73be25c1f99f580410e1ba5910cc0aa0e32d0f0ad70794da47e7f02fcb4d

SHA512
5165c5f15a698c2a0cb111dcdee4f9859136fe91b9fc381e6076bc5e7fe0f3a18ed54dbc4d0a81d75480d002ad8fcab184cba22f73804decbb184255d40ddcd7

Download Submit
C:\Windows\system\nFisHRM.exe

Filesize
1.5MB

MD5
c5218c8c42795a5d6caa292402595766

SHA1
7d09c86a68dcd520a878bc6d303491e05b7a5a2f

SHA256
98dccb1dc76182f9ebacb995c247786f33e314420671de731becefb72bf2eb2b

SHA512
2a7acc1738805a90e8aafa35db6e6bb6708a00c7f7781e821e461a26c8bd2774fa15380a2e1105f31ab62385f02a799c2911a8f951c08393c3e0a196f108090d

Download Submit
C:\Windows\system\oWxssXn.exe

Filesize
1.5MB

MD5
b745c649449e9452296960a3da040826

SHA1
3199e6c37c9c2f238d97c26f6fe54ea8aedfb94a

SHA256
edd95bb7b9a80844f31af9110941af5596bb5182c59a808302bce848679c586d

SHA512
e1b5151f432241e73ec829f065894ece4177669f99be2a34d781a00ba4fc9d6135d823dd722e4968d4878f5aeb8db08b30b1b69766c10dd1065f5c6d52ad613b

Download Submit
C:\Windows\system\oZJGXEk.exe

Filesize
1.5MB

MD5
ab4d0da2a0b0cbceb4093a87076e2602

SHA1
ceb8f6a3736f9c05d788fe4aeb31a29f520d950f

SHA256
2d4d5c9bc401ada7a44fa3631a19822e91c76f59eb861847b6df053fb6a59f9a

SHA512
f96dc830849667782d42d59a5d34bb6732e56724604918c7409fb0ba5b91df4519cd8a36b7144da209e12eb760ed7cfbda17267e13fcfe64fbcfcce671d87441

Download Submit
C:\Windows\system\pILMJPm.exe

Filesize
1.5MB

MD5
e00586227562bf57f877d07d2c8b0de4

SHA1
d30c8bca85ff83efcdfbc06cc60b58d05c260fd1

SHA256
b59ed7fb624dc99a6495a0c8b464c4c18a52760c37ce1b13a7fb69049df4dcb9

SHA512
6b181b7ba94a5048c102c6f732d91278406129f61351016d8277aebebd4268f9733c591a9ec2662533c281331877491c2e7ce10454d8e28afb0193fa7f7c799a

Download Submit
C:\Windows\system\pVfTUsk.exe

Filesize
1.5MB

MD5
68d2f18681b27a09ee9833ab1797a920

SHA1
108e3e9b122a6758da3a1a6cfbb0772489c3e4d3

SHA256
8d1b45bf5a162b8dd2863f5041b291b7ea2f077142c640464426875d59e12a20

SHA512
bceb5434f2adfea685f2f540fdcb7f0c778066794d4c0267a8936d0954c10540899e750275a5f2e2459b0ed917a943d9ab00ae65a58ef2b48dad159800d77932

Download Submit
C:\Windows\system\rpBGvop.exe

Filesize
1.5MB

MD5
c7c14b1f1fb90122fe509150d1b92c22

SHA1
a2c8e2ccb4cec99d2c506bad4dc78e8010343a1c

SHA256
729c6ac76f2558c3733753d499d69bb56c16426864c2f02c2ad38662a2030d88

SHA512
5f701e8ccae2e10aad416c7d2307399483b862ad3e603a48c087dd8752bcb1e223d7ce7d8802b37ec02d94e79ab67a7997d91be39c8119b6219c4d956ff19e1c

Download Submit
C:\Windows\system\tPvanRa.exe

Filesize
1.5MB

MD5
761eb9ee953761bd133535ae955f1a9c

SHA1
e40f90121e83ffab0a8b8ac898197ed625de9063

SHA256
b0a02c9b422de680a2f338858122a0a7c88917c9903ec1702dd6871684c61fe5

SHA512
0da4832e72344f224868b48f6fb7b974bcf3d2f92d60205237c198313ae48c203dc1507879f5b1840fdf31bcf41bad7e668e4013c9a8f5064ff75704fae303db

Download Submit
C:\Windows\system\xzJAawv.exe

Filesize
1.5MB

MD5
90571f3f76856b845c1bf5647b15bbde

SHA1
2c3355f2d6eb8616b23cece0ec1ed00a405fb1f3

SHA256
8074d241dcba850ae2bde85a15808d7e757129f0c0d453fc14cb0e1e3cb03d2f

SHA512
abcc7b2a75325caa66cc37bc494e53d0a231b8e127d8493f0b607d9e9f8ec4d31ea990c41fe16fe99e41e597a1e377e057cdbc48c5555a08a0d7b40c1201693f

Download Submit
C:\Windows\system\ydfWQvm.exe

Filesize
1.5MB

MD5
e74cf782958e014319d0be9ade330c81

SHA1
1a00674158be3a9f12bd1579fb8fd467bcdfaca4

SHA256
f4e80edd2d4563f47099b4931dd5ebf24679354be6a727dfdd35e5c44f347b37

SHA512
0b65949a17deb40083c91c01ebaf9f023970780b36ba1532c9d5e2d30197bfe8fbc90b2fdb465825a494b985e5439599931f5f0d0eca88819586d175a1eec57d

Download Submit
\Windows\system\xvifjJp.exe

Filesize
1.5MB

MD5
3703907bce1dc12d7c135a23beb9ba22

SHA1
a8e87f29c12e0526e623a930cfcbd09882ae3cd0

SHA256
2ab62cc78c42f6e446f1288ef20569ced29d08787c164b9c2896040f7cf644c5

SHA512
16b254473366110f814648569832f6397a400a4ac27bd004c4ffa1556cbc7327a16251a749609d62f507a80ab43df355c8c342397edfb60e52ba3f343444688e

Download Submit
memory/552-97-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/552-3905-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/1520-3899-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/1520-21-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-49-0x000000013F300000-0x000000013F654000-memory.dmp

Filesize
3.3MB

Download
memory/2332-3900-0x000000013F300000-0x000000013F654000-memory.dmp

Filesize
3.3MB

Download
memory/2444-3907-0x000000013F420000-0x000000013F774000-memory.dmp

Filesize
3.3MB

Download
memory/2444-101-0x000000013F420000-0x000000013F774000-memory.dmp

Filesize
3.3MB

Download
memory/2536-94-0x000000013F580000-0x000000013F8D4000-memory.dmp

Filesize
3.3MB

Download
memory/2536-3906-0x000000013F580000-0x000000013F8D4000-memory.dmp

Filesize
3.3MB

Download
memory/2552-104-0x000000013F100000-0x000000013F454000-memory.dmp

Filesize
3.3MB

Download
memory/2552-3909-0x000000013F100000-0x000000013F454000-memory.dmp

Filesize
3.3MB

Download
memory/2568-3901-0x000000013F3F0000-0x000000013F744000-memory.dmp

Filesize
3.3MB

Download
memory/2568-76-0x000000013F3F0000-0x000000013F744000-memory.dmp

Filesize
3.3MB

Download
memory/2588-3911-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2588-103-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2600-99-0x000000013F960000-0x000000013FCB4000-memory.dmp

Filesize
3.3MB

Download
memory/2600-3903-0x000000013F960000-0x000000013FCB4000-memory.dmp

Filesize
3.3MB

Download
memory/2612-106-0x000000013FAC0000-0x000000013FE14000-memory.dmp

Filesize
3.3MB

Download
memory/2612-3908-0x000000013FAC0000-0x000000013FE14000-memory.dmp

Filesize
3.3MB

Download
memory/2724-93-0x000000013F6D0000-0x000000013FA24000-memory.dmp

Filesize
3.3MB

Download
memory/2724-3902-0x000000013F6D0000-0x000000013FA24000-memory.dmp

Filesize
3.3MB

Download
memory/2828-3910-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/2828-98-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/2856-65-0x0000000001F00000-0x0000000002254000-memory.dmp

Filesize
3.3MB

Download
memory/2856-73-0x000000013F420000-0x000000013F774000-memory.dmp

Filesize
3.3MB

Download
memory/2856-62-0x0000000001F00000-0x0000000002254000-memory.dmp

Filesize
3.3MB

Download
memory/2856-14-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/2856-40-0x0000000001F00000-0x0000000002254000-memory.dmp

Filesize
3.3MB

Download
memory/2856-3898-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2856-36-0x000000013F3F0000-0x000000013F744000-memory.dmp

Filesize
3.3MB

Download
memory/2856-54-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2856-59-0x0000000001F00000-0x0000000002254000-memory.dmp

Filesize
3.3MB

Download
memory/2856-29-0x000000013F300000-0x000000013F654000-memory.dmp

Filesize
3.3MB

Download
memory/2856-66-0x000000013F170000-0x000000013F4C4000-memory.dmp

Filesize
3.3MB

Download
memory/2856-72-0x0000000001F00000-0x0000000002254000-memory.dmp

Filesize
3.3MB

Download
memory/2856-67-0x000000013F100000-0x000000013F454000-memory.dmp

Filesize
3.3MB

Download
memory/2856-69-0x0000000001F00000-0x0000000002254000-memory.dmp

Filesize
3.3MB

Download
memory/2856-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2856-2-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2856-71-0x000000013FCB0000-0x0000000140004000-memory.dmp

Filesize
3.3MB

Download
memory/2880-3904-0x000000013F170000-0x000000013F4C4000-memory.dmp

Filesize
3.3MB

Download
memory/2880-96-0x000000013F170000-0x000000013F4C4000-memory.dmp

Filesize
3.3MB

Download