xmrig | f841cc2bb365c7d9ef419877cbcdc08853fe940f31029ef47b059d26d565a88c

Analysis

max time kernel
131s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
Size

2.3MB
MD5

220df2913d1f02aaa1169e0450abac10
SHA1

891ca1c5e46b33e4bea5b2faf30b1ce0c162ccb4
SHA256

f841cc2bb365c7d9ef419877cbcdc08853fe940f31029ef47b059d26d565a88c
SHA512

3cdabeb607c9cb8a727d710cfd9cea8bd7c7ab16f2f40b399961989c1be96e474d62eb0e0cf13cf0fbb1f09b75911514c00fd0c465f532b87042c9d58a4009e2
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOYkZtg94VriPp:BemTLkNdfE0pZrQ3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2216-2-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	xmrig
behavioral1/files/0x000c000000015a2d-6.dat	xmrig
behavioral1/memory/2312-9-0x000000013FC80000-0x000000013FFD4000-memory.dmp	xmrig
behavioral1/files/0x0026000000015c2f-13.dat	xmrig
behavioral1/memory/3040-16-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/files/0x0026000000015c3c-12.dat	xmrig
behavioral1/memory/2504-35-0x000000013F0F0000-0x000000013F444000-memory.dmp	xmrig
behavioral1/memory/2612-26-0x000000013F600000-0x000000013F954000-memory.dmp	xmrig
behavioral1/files/0x0007000000015d88-39.dat	xmrig
behavioral1/memory/2424-41-0x000000013F6C0000-0x000000013FA14000-memory.dmp	xmrig
behavioral1/files/0x0007000000018ae2-87.dat	xmrig
behavioral1/memory/2396-95-0x000000013FF40000-0x0000000140294000-memory.dmp	xmrig
behavioral1/memory/1076-94-0x000000013F830000-0x000000013FB84000-memory.dmp	xmrig
behavioral1/memory/2216-92-0x000000013F140000-0x000000013F494000-memory.dmp	xmrig
behavioral1/memory/2068-91-0x000000013F260000-0x000000013F5B4000-memory.dmp	xmrig
behavioral1/memory/2216-90-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	xmrig
behavioral1/memory/580-88-0x000000013F140000-0x000000013F494000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b42-76.dat	xmrig
behavioral1/files/0x0006000000018b33-67.dat	xmrig
behavioral1/memory/2444-62-0x000000013F270000-0x000000013F5C4000-memory.dmp	xmrig
behavioral1/files/0x0006000000018ae8-59.dat	xmrig
behavioral1/files/0x0006000000018b4a-84.dat	xmrig
behavioral1/files/0x0006000000018b37-75.dat	xmrig
behavioral1/files/0x0006000000018b15-66.dat	xmrig
behavioral1/files/0x0011000000015c52-57.dat	xmrig
behavioral1/memory/2876-159-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/files/0x0006000000018d06-158.dat	xmrig
behavioral1/files/0x000500000001946b-178.dat	xmrig
behavioral1/files/0x00050000000193b0-176.dat	xmrig
behavioral1/files/0x0005000000019377-174.dat	xmrig
behavioral1/files/0x0005000000019333-172.dat	xmrig
behavioral1/files/0x00050000000192f4-169.dat	xmrig
behavioral1/files/0x0005000000019410-168.dat	xmrig
behavioral1/files/0x000500000001939b-164.dat	xmrig
behavioral1/files/0x0005000000019368-163.dat	xmrig
behavioral1/files/0x0006000000018b96-153.dat	xmrig
behavioral1/files/0x00050000000192c9-136.dat	xmrig
behavioral1/files/0x000500000001931b-141.dat	xmrig
behavioral1/files/0x0006000000018b6a-132.dat	xmrig
behavioral1/files/0x0006000000018ba2-120.dat	xmrig
behavioral1/files/0x0006000000018b73-109.dat	xmrig
behavioral1/memory/2568-50-0x000000013F830000-0x000000013FB84000-memory.dmp	xmrig
behavioral1/memory/2216-180-0x000000013F4C0000-0x000000013F814000-memory.dmp	xmrig
behavioral1/files/0x000500000001946f-183.dat	xmrig
behavioral1/files/0x00080000000167db-47.dat	xmrig
behavioral1/files/0x0005000000019473-186.dat	xmrig
behavioral1/memory/2424-1271-0x000000013F6C0000-0x000000013FA14000-memory.dmp	xmrig
behavioral1/memory/2444-1528-0x000000013F270000-0x000000013F5C4000-memory.dmp	xmrig
behavioral1/memory/2616-36-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/files/0x0009000000015c7c-31.dat	xmrig
behavioral1/files/0x0007000000015cb9-30.dat	xmrig
behavioral1/memory/2312-2756-0x000000013FC80000-0x000000013FFD4000-memory.dmp	xmrig
behavioral1/memory/2612-2758-0x000000013F600000-0x000000013F954000-memory.dmp	xmrig
behavioral1/memory/2568-2760-0x000000013F830000-0x000000013FB84000-memory.dmp	xmrig
behavioral1/memory/2504-2759-0x000000013F0F0000-0x000000013F444000-memory.dmp	xmrig
behavioral1/memory/580-2761-0x000000013F140000-0x000000013F494000-memory.dmp	xmrig
behavioral1/memory/3040-2763-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/memory/2424-2762-0x000000013F6C0000-0x000000013FA14000-memory.dmp	xmrig
behavioral1/memory/2616-2766-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/memory/2876-3670-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/memory/2068-3985-0x000000013F260000-0x000000013F5B4000-memory.dmp	xmrig
behavioral1/memory/1076-3989-0x000000013F830000-0x000000013FB84000-memory.dmp	xmrig
behavioral1/memory/2444-3991-0x000000013F270000-0x000000013F5C4000-memory.dmp	xmrig
behavioral1/memory/2396-3992-0x000000013FF40000-0x0000000140294000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2312	yqkrKHq.exe
3040	mHCYaDs.exe
2612	KSVXwJl.exe
2504	KuYARpn.exe
2616	DpvsPYo.exe
2424	nUoyMmB.exe
2568	WPyMGCN.exe
2444	JxPZXkZ.exe
2068	qsRoQVO.exe
580	uyaAMqb.exe
1076	HRHBnnk.exe
2396	jOSQotm.exe
2876	MLlBwNo.exe
2016	FbNTQlz.exe
760	RGwlaVF.exe
1904	xNZnJvy.exe
1968	qpcaWCL.exe
2648	OyKkGwP.exe
1648	bJyXjKl.exe
480	qeTzXHx.exe
1324	MSRJeGN.exe
1228	sIZMpVq.exe
2460	DxnfBdL.exe
1168	RKIQUzM.exe
2248	bGQjoDy.exe
1948	WSLqyTE.exe
2652	bHYVEow.exe
1672	pWtVrum.exe
1612	vPCtByU.exe
1996	QAuNXDt.exe
2244	WKDJDDR.exe
1172	wzIHkVl.exe
824	XGGBBYq.exe
2272	WqfPWrp.exe
1096	LsXXyeG.exe
1680	NTuZeGw.exe
2692	uRCDhlS.exe
1808	HoDGGcC.exe
3020	TDTZnmr.exe
1856	OspOvAR.exe
1352	oojPxDo.exe
3008	OrpDwOW.exe
2124	oFmKZDR.exe
2092	RXORtPK.exe
596	ZrIdIWw.exe
1532	dmmyrgq.exe
2956	ehaTWoZ.exe
2188	UYglDPM.exe
2252	nWxylDF.exe
1992	MUFyWXb.exe
1000	OmNCwkr.exe
2348	qpNRmMs.exe
876	DAzZuIs.exe
536	HDwnPRM.exe
2148	sJOrcoc.exe
1568	QpFtlyD.exe
2720	woCGYxF.exe
2864	oMIATGu.exe
2548	HECaCmQ.exe
2524	jMCVYWf.exe
2064	HdweEGe.exe
2512	psjixki.exe
792	ObQEWfq.exe
2588	fMdjAKH.exe

Loads dropped DLL 64 IoCs

pid	Process
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-2-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	upx
behavioral1/files/0x000c000000015a2d-6.dat	upx
behavioral1/memory/2312-9-0x000000013FC80000-0x000000013FFD4000-memory.dmp	upx
behavioral1/files/0x0026000000015c2f-13.dat	upx
behavioral1/memory/3040-16-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/files/0x0026000000015c3c-12.dat	upx
behavioral1/memory/2504-35-0x000000013F0F0000-0x000000013F444000-memory.dmp	upx
behavioral1/memory/2612-26-0x000000013F600000-0x000000013F954000-memory.dmp	upx
behavioral1/files/0x0007000000015d88-39.dat	upx
behavioral1/memory/2424-41-0x000000013F6C0000-0x000000013FA14000-memory.dmp	upx
behavioral1/files/0x0007000000018ae2-87.dat	upx
behavioral1/memory/2396-95-0x000000013FF40000-0x0000000140294000-memory.dmp	upx
behavioral1/memory/1076-94-0x000000013F830000-0x000000013FB84000-memory.dmp	upx
behavioral1/memory/2068-91-0x000000013F260000-0x000000013F5B4000-memory.dmp	upx
behavioral1/memory/2216-90-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	upx
behavioral1/memory/580-88-0x000000013F140000-0x000000013F494000-memory.dmp	upx
behavioral1/files/0x0006000000018b42-76.dat	upx
behavioral1/files/0x0006000000018b33-67.dat	upx
behavioral1/memory/2444-62-0x000000013F270000-0x000000013F5C4000-memory.dmp	upx
behavioral1/files/0x0006000000018ae8-59.dat	upx
behavioral1/files/0x0006000000018b4a-84.dat	upx
behavioral1/files/0x0006000000018b37-75.dat	upx
behavioral1/files/0x0006000000018b15-66.dat	upx
behavioral1/files/0x0011000000015c52-57.dat	upx
behavioral1/memory/2876-159-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/files/0x0006000000018d06-158.dat	upx
behavioral1/files/0x000500000001946b-178.dat	upx
behavioral1/files/0x00050000000193b0-176.dat	upx
behavioral1/files/0x0005000000019377-174.dat	upx
behavioral1/files/0x0005000000019333-172.dat	upx
behavioral1/files/0x00050000000192f4-169.dat	upx
behavioral1/files/0x0005000000019410-168.dat	upx
behavioral1/files/0x000500000001939b-164.dat	upx
behavioral1/files/0x0005000000019368-163.dat	upx
behavioral1/files/0x0006000000018b96-153.dat	upx
behavioral1/files/0x00050000000192c9-136.dat	upx
behavioral1/files/0x000500000001931b-141.dat	upx
behavioral1/files/0x0006000000018b6a-132.dat	upx
behavioral1/files/0x0006000000018ba2-120.dat	upx
behavioral1/files/0x0006000000018b73-109.dat	upx
behavioral1/memory/2568-50-0x000000013F830000-0x000000013FB84000-memory.dmp	upx
behavioral1/files/0x000500000001946f-183.dat	upx
behavioral1/files/0x00080000000167db-47.dat	upx
behavioral1/files/0x0005000000019473-186.dat	upx
behavioral1/memory/2424-1271-0x000000013F6C0000-0x000000013FA14000-memory.dmp	upx
behavioral1/memory/2444-1528-0x000000013F270000-0x000000013F5C4000-memory.dmp	upx
behavioral1/memory/2616-36-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/files/0x0009000000015c7c-31.dat	upx
behavioral1/files/0x0007000000015cb9-30.dat	upx
behavioral1/memory/2312-2756-0x000000013FC80000-0x000000013FFD4000-memory.dmp	upx
behavioral1/memory/2612-2758-0x000000013F600000-0x000000013F954000-memory.dmp	upx
behavioral1/memory/2568-2760-0x000000013F830000-0x000000013FB84000-memory.dmp	upx
behavioral1/memory/2504-2759-0x000000013F0F0000-0x000000013F444000-memory.dmp	upx
behavioral1/memory/580-2761-0x000000013F140000-0x000000013F494000-memory.dmp	upx
behavioral1/memory/3040-2763-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/memory/2424-2762-0x000000013F6C0000-0x000000013FA14000-memory.dmp	upx
behavioral1/memory/2616-2766-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/memory/2876-3670-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/memory/2068-3985-0x000000013F260000-0x000000013F5B4000-memory.dmp	upx
behavioral1/memory/1076-3989-0x000000013F830000-0x000000013FB84000-memory.dmp	upx
behavioral1/memory/2444-3991-0x000000013F270000-0x000000013F5C4000-memory.dmp	upx
behavioral1/memory/2396-3992-0x000000013FF40000-0x0000000140294000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MxCAbAC.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\DDqHdDO.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\InUpdfC.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\VEFzWXr.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\ZQSGZJe.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\QAuNXDt.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\OFAXNQW.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\CfNGkoi.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\SiqckZh.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\dzVRjch.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\OPtuHgG.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\KDUJyWv.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\dmmyrgq.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\WVVcUrW.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\dJcuUcP.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\Fyuwvip.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\eZdcRaj.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\yqkrKHq.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\RDRADtN.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\UWYtjcb.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\PQeMGir.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\CSCJEAG.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\IDnpWvE.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\gAHzHwr.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\YyeLhHh.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\qrOljYY.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\DZirxpK.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\QoWrnYH.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\toqlGZX.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\PKyxiAG.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\gwCDTol.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\omuBtAB.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\hkieUfj.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\bnJsWIZ.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\fZwVYOm.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\KSOyIfh.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\lgoiqOJ.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\XEwNCCD.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\DgIJVvK.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\fxPkXez.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\fRxrwvt.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\tiPNTfw.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\RLZeBXG.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\vBfIekG.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\POZKIhR.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\cBqFNCb.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\AXEFosJ.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\jmHjDzh.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\XarWfXo.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\hSizFKm.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\mCIulnK.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\bJDtFSJ.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\kzstGMl.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\MNgQjhZ.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\uQZPXua.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\kNRjPib.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\shWdZVR.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\tJUbaRg.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\mshGpEn.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\QvrBjvK.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\NJZBzLl.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\DyphYdb.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\VfWOojt.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
File created	C:\Windows\System\oZkeqLH.exe	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2312	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	29
PID 2216 wrote to memory of 2312	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	29
PID 2216 wrote to memory of 2312	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	29
PID 2216 wrote to memory of 3040	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	30
PID 2216 wrote to memory of 3040	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	30
PID 2216 wrote to memory of 3040	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	30
PID 2216 wrote to memory of 2612	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	31
PID 2216 wrote to memory of 2612	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	31
PID 2216 wrote to memory of 2612	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	31
PID 2216 wrote to memory of 2616	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	32
PID 2216 wrote to memory of 2616	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	32
PID 2216 wrote to memory of 2616	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	32
PID 2216 wrote to memory of 2504	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	33
PID 2216 wrote to memory of 2504	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	33
PID 2216 wrote to memory of 2504	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	33
PID 2216 wrote to memory of 2424	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	34
PID 2216 wrote to memory of 2424	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	34
PID 2216 wrote to memory of 2424	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	34
PID 2216 wrote to memory of 2568	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	35
PID 2216 wrote to memory of 2568	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	35
PID 2216 wrote to memory of 2568	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	35
PID 2216 wrote to memory of 2396	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	36
PID 2216 wrote to memory of 2396	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	36
PID 2216 wrote to memory of 2396	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	36
PID 2216 wrote to memory of 2444	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	37
PID 2216 wrote to memory of 2444	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	37
PID 2216 wrote to memory of 2444	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	37
PID 2216 wrote to memory of 2876	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	38
PID 2216 wrote to memory of 2876	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	38
PID 2216 wrote to memory of 2876	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	38
PID 2216 wrote to memory of 2068	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	39
PID 2216 wrote to memory of 2068	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	39
PID 2216 wrote to memory of 2068	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	39
PID 2216 wrote to memory of 2016	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	40
PID 2216 wrote to memory of 2016	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	40
PID 2216 wrote to memory of 2016	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	40
PID 2216 wrote to memory of 580	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	41
PID 2216 wrote to memory of 580	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	41
PID 2216 wrote to memory of 580	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	41
PID 2216 wrote to memory of 760	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	42
PID 2216 wrote to memory of 760	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	42
PID 2216 wrote to memory of 760	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	42
PID 2216 wrote to memory of 1076	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	43
PID 2216 wrote to memory of 1076	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	43
PID 2216 wrote to memory of 1076	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	43
PID 2216 wrote to memory of 2648	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	44
PID 2216 wrote to memory of 2648	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	44
PID 2216 wrote to memory of 2648	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	44
PID 2216 wrote to memory of 1904	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	45
PID 2216 wrote to memory of 1904	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	45
PID 2216 wrote to memory of 1904	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	45
PID 2216 wrote to memory of 1324	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	46
PID 2216 wrote to memory of 1324	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	46
PID 2216 wrote to memory of 1324	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	46
PID 2216 wrote to memory of 1968	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	47
PID 2216 wrote to memory of 1968	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	47
PID 2216 wrote to memory of 1968	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	47
PID 2216 wrote to memory of 1228	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	48
PID 2216 wrote to memory of 1228	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	48
PID 2216 wrote to memory of 1228	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	48
PID 2216 wrote to memory of 1648	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	49
PID 2216 wrote to memory of 1648	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	49
PID 2216 wrote to memory of 1648	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	49
PID 2216 wrote to memory of 1948	2216	220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\220df2913d1f02aaa1169e0450abac10_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\System\yqkrKHq.exe
  C:\Windows\System\yqkrKHq.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\mHCYaDs.exe
  C:\Windows\System\mHCYaDs.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\KSVXwJl.exe
  C:\Windows\System\KSVXwJl.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\DpvsPYo.exe
  C:\Windows\System\DpvsPYo.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\KuYARpn.exe
  C:\Windows\System\KuYARpn.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\nUoyMmB.exe
  C:\Windows\System\nUoyMmB.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\WPyMGCN.exe
  C:\Windows\System\WPyMGCN.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\jOSQotm.exe
  C:\Windows\System\jOSQotm.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\JxPZXkZ.exe
  C:\Windows\System\JxPZXkZ.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\MLlBwNo.exe
  C:\Windows\System\MLlBwNo.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\qsRoQVO.exe
  C:\Windows\System\qsRoQVO.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\FbNTQlz.exe
  C:\Windows\System\FbNTQlz.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\uyaAMqb.exe
  C:\Windows\System\uyaAMqb.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\RGwlaVF.exe
  C:\Windows\System\RGwlaVF.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\HRHBnnk.exe
  C:\Windows\System\HRHBnnk.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\OyKkGwP.exe
  C:\Windows\System\OyKkGwP.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\xNZnJvy.exe
  C:\Windows\System\xNZnJvy.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\MSRJeGN.exe
  C:\Windows\System\MSRJeGN.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\qpcaWCL.exe
  C:\Windows\System\qpcaWCL.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\sIZMpVq.exe
  C:\Windows\System\sIZMpVq.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\bJyXjKl.exe
  C:\Windows\System\bJyXjKl.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\WSLqyTE.exe
  C:\Windows\System\WSLqyTE.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\qeTzXHx.exe
  C:\Windows\System\qeTzXHx.exe
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Windows\System\bHYVEow.exe
  C:\Windows\System\bHYVEow.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\DxnfBdL.exe
  C:\Windows\System\DxnfBdL.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\pWtVrum.exe
  C:\Windows\System\pWtVrum.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\RKIQUzM.exe
  C:\Windows\System\RKIQUzM.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\vPCtByU.exe
  C:\Windows\System\vPCtByU.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\bGQjoDy.exe
  C:\Windows\System\bGQjoDy.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\QAuNXDt.exe
  C:\Windows\System\QAuNXDt.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\WKDJDDR.exe
  C:\Windows\System\WKDJDDR.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\wzIHkVl.exe
  C:\Windows\System\wzIHkVl.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\XGGBBYq.exe
  C:\Windows\System\XGGBBYq.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\WqfPWrp.exe
  C:\Windows\System\WqfPWrp.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\NTuZeGw.exe
  C:\Windows\System\NTuZeGw.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\LsXXyeG.exe
  C:\Windows\System\LsXXyeG.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\uRCDhlS.exe
  C:\Windows\System\uRCDhlS.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\HoDGGcC.exe
  C:\Windows\System\HoDGGcC.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\TDTZnmr.exe
  C:\Windows\System\TDTZnmr.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\oojPxDo.exe
  C:\Windows\System\oojPxDo.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\OspOvAR.exe
  C:\Windows\System\OspOvAR.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\oFmKZDR.exe
  C:\Windows\System\oFmKZDR.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\OrpDwOW.exe
  C:\Windows\System\OrpDwOW.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\ZrIdIWw.exe
  C:\Windows\System\ZrIdIWw.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\RXORtPK.exe
  C:\Windows\System\RXORtPK.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\dmmyrgq.exe
  C:\Windows\System\dmmyrgq.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\ehaTWoZ.exe
  C:\Windows\System\ehaTWoZ.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\UYglDPM.exe
  C:\Windows\System\UYglDPM.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\nWxylDF.exe
  C:\Windows\System\nWxylDF.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\MUFyWXb.exe
  C:\Windows\System\MUFyWXb.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\OmNCwkr.exe
  C:\Windows\System\OmNCwkr.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\qpNRmMs.exe
  C:\Windows\System\qpNRmMs.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\DAzZuIs.exe
  C:\Windows\System\DAzZuIs.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\HDwnPRM.exe
  C:\Windows\System\HDwnPRM.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\sJOrcoc.exe
  C:\Windows\System\sJOrcoc.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\QpFtlyD.exe
  C:\Windows\System\QpFtlyD.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\woCGYxF.exe
  C:\Windows\System\woCGYxF.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\oMIATGu.exe
  C:\Windows\System\oMIATGu.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\HECaCmQ.exe
  C:\Windows\System\HECaCmQ.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\jMCVYWf.exe
  C:\Windows\System\jMCVYWf.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\HdweEGe.exe
  C:\Windows\System\HdweEGe.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\psjixki.exe
  C:\Windows\System\psjixki.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\ObQEWfq.exe
  C:\Windows\System\ObQEWfq.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\fMdjAKH.exe
  C:\Windows\System\fMdjAKH.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\TcemKIZ.exe
  C:\Windows\System\TcemKIZ.exe
  2⤵
  PID:1940
- C:\Windows\System\onHCKdV.exe
  C:\Windows\System\onHCKdV.exe
  2⤵
  PID:552
- C:\Windows\System\VfuyfeY.exe
  C:\Windows\System\VfuyfeY.exe
  2⤵
  PID:2712
- C:\Windows\System\xthRfQE.exe
  C:\Windows\System\xthRfQE.exe
  2⤵
  PID:2508
- C:\Windows\System\PBjNEzu.exe
  C:\Windows\System\PBjNEzu.exe
  2⤵
  PID:2760
- C:\Windows\System\xfrKJNO.exe
  C:\Windows\System\xfrKJNO.exe
  2⤵
  PID:2776
- C:\Windows\System\msosQTx.exe
  C:\Windows\System\msosQTx.exe
  2⤵
  PID:1652
- C:\Windows\System\ZoTzkVf.exe
  C:\Windows\System\ZoTzkVf.exe
  2⤵
  PID:1936
- C:\Windows\System\cteANBT.exe
  C:\Windows\System\cteANBT.exe
  2⤵
  PID:1844
- C:\Windows\System\fXgRYZN.exe
  C:\Windows\System\fXgRYZN.exe
  2⤵
  PID:2976
- C:\Windows\System\SPEJDlY.exe
  C:\Windows\System\SPEJDlY.exe
  2⤵
  PID:1444
- C:\Windows\System\gofuVoc.exe
  C:\Windows\System\gofuVoc.exe
  2⤵
  PID:924
- C:\Windows\System\nyyyuDI.exe
  C:\Windows\System\nyyyuDI.exe
  2⤵
  PID:1508
- C:\Windows\System\pmLoHUY.exe
  C:\Windows\System\pmLoHUY.exe
  2⤵
  PID:796
- C:\Windows\System\aGlLlew.exe
  C:\Windows\System\aGlLlew.exe
  2⤵
  PID:936
- C:\Windows\System\pRzbZeY.exe
  C:\Windows\System\pRzbZeY.exe
  2⤵
  PID:888
- C:\Windows\System\rTCfloK.exe
  C:\Windows\System\rTCfloK.exe
  2⤵
  PID:2604
- C:\Windows\System\gWDsnBp.exe
  C:\Windows\System\gWDsnBp.exe
  2⤵
  PID:2744
- C:\Windows\System\uolwYYb.exe
  C:\Windows\System\uolwYYb.exe
  2⤵
  PID:1288
- C:\Windows\System\cmDHmfI.exe
  C:\Windows\System\cmDHmfI.exe
  2⤵
  PID:344
- C:\Windows\System\KeFbCOP.exe
  C:\Windows\System\KeFbCOP.exe
  2⤵
  PID:2564
- C:\Windows\System\hktWdji.exe
  C:\Windows\System\hktWdji.exe
  2⤵
  PID:2732
- C:\Windows\System\yfJDpgD.exe
  C:\Windows\System\yfJDpgD.exe
  2⤵
  PID:2696
- C:\Windows\System\rNWMijA.exe
  C:\Windows\System\rNWMijA.exe
  2⤵
  PID:2040
- C:\Windows\System\LVSkvHW.exe
  C:\Windows\System\LVSkvHW.exe
  2⤵
  PID:1708
- C:\Windows\System\IHrGuUX.exe
  C:\Windows\System\IHrGuUX.exe
  2⤵
  PID:1980
- C:\Windows\System\xWNMJNv.exe
  C:\Windows\System\xWNMJNv.exe
  2⤵
  PID:2240
- C:\Windows\System\zgIGahn.exe
  C:\Windows\System\zgIGahn.exe
  2⤵
  PID:2156
- C:\Windows\System\PaJGPNj.exe
  C:\Windows\System\PaJGPNj.exe
  2⤵
  PID:2260
- C:\Windows\System\pJxObvG.exe
  C:\Windows\System\pJxObvG.exe
  2⤵
  PID:2768
- C:\Windows\System\BCPsPmr.exe
  C:\Windows\System\BCPsPmr.exe
  2⤵
  PID:2236
- C:\Windows\System\KEhynyK.exe
  C:\Windows\System\KEhynyK.exe
  2⤵
  PID:2388
- C:\Windows\System\LYQSduQ.exe
  C:\Windows\System\LYQSduQ.exe
  2⤵
  PID:2280
- C:\Windows\System\XeUuuzo.exe
  C:\Windows\System\XeUuuzo.exe
  2⤵
  PID:2276
- C:\Windows\System\XaDwqdI.exe
  C:\Windows\System\XaDwqdI.exe
  2⤵
  PID:1776
- C:\Windows\System\Plczykd.exe
  C:\Windows\System\Plczykd.exe
  2⤵
  PID:1124
- C:\Windows\System\IDnpWvE.exe
  C:\Windows\System\IDnpWvE.exe
  2⤵
  PID:2328
- C:\Windows\System\jnFRCBX.exe
  C:\Windows\System\jnFRCBX.exe
  2⤵
  PID:1792
- C:\Windows\System\bOexXtZ.exe
  C:\Windows\System\bOexXtZ.exe
  2⤵
  PID:1772
- C:\Windows\System\hYFNqxG.exe
  C:\Windows\System\hYFNqxG.exe
  2⤵
  PID:1212
- C:\Windows\System\iqyfChR.exe
  C:\Windows\System\iqyfChR.exe
  2⤵
  PID:960
- C:\Windows\System\tYosoUt.exe
  C:\Windows\System\tYosoUt.exe
  2⤵
  PID:1264
- C:\Windows\System\blezSbL.exe
  C:\Windows\System\blezSbL.exe
  2⤵
  PID:1620
- C:\Windows\System\RyjmLzo.exe
  C:\Windows\System\RyjmLzo.exe
  2⤵
  PID:2828
- C:\Windows\System\OEfDHrw.exe
  C:\Windows\System\OEfDHrw.exe
  2⤵
  PID:1492
- C:\Windows\System\xpuTBTH.exe
  C:\Windows\System\xpuTBTH.exe
  2⤵
  PID:1520
- C:\Windows\System\MWXFzlu.exe
  C:\Windows\System\MWXFzlu.exe
  2⤵
  PID:2008
- C:\Windows\System\dRTuAag.exe
  C:\Windows\System\dRTuAag.exe
  2⤵
  PID:2200
- C:\Windows\System\EvmMEBx.exe
  C:\Windows\System\EvmMEBx.exe
  2⤵
  PID:2332
- C:\Windows\System\YIHlPAY.exe
  C:\Windows\System\YIHlPAY.exe
  2⤵
  PID:2112
- C:\Windows\System\JiKsTBk.exe
  C:\Windows\System\JiKsTBk.exe
  2⤵
  PID:2740
- C:\Windows\System\orOrLvK.exe
  C:\Windows\System\orOrLvK.exe
  2⤵
  PID:1632
- C:\Windows\System\ctIzPVZ.exe
  C:\Windows\System\ctIzPVZ.exe
  2⤵
  PID:2432
- C:\Windows\System\QtxCOFj.exe
  C:\Windows\System\QtxCOFj.exe
  2⤵
  PID:2452
- C:\Windows\System\hIhAgUQ.exe
  C:\Windows\System\hIhAgUQ.exe
  2⤵
  PID:2056
- C:\Windows\System\oQPYfEY.exe
  C:\Windows\System\oQPYfEY.exe
  2⤵
  PID:2032
- C:\Windows\System\VHHoLiq.exe
  C:\Windows\System\VHHoLiq.exe
  2⤵
  PID:364
- C:\Windows\System\kYoLMMG.exe
  C:\Windows\System\kYoLMMG.exe
  2⤵
  PID:872
- C:\Windows\System\UbBneEt.exe
  C:\Windows\System\UbBneEt.exe
  2⤵
  PID:2992
- C:\Windows\System\cXIHbcA.exe
  C:\Windows\System\cXIHbcA.exe
  2⤵
  PID:340
- C:\Windows\System\eCBZgpQ.exe
  C:\Windows\System\eCBZgpQ.exe
  2⤵
  PID:1836
- C:\Windows\System\WeDEnrR.exe
  C:\Windows\System\WeDEnrR.exe
  2⤵
  PID:2164
- C:\Windows\System\oTjGavX.exe
  C:\Windows\System\oTjGavX.exe
  2⤵
  PID:1512
- C:\Windows\System\mJIsJkm.exe
  C:\Windows\System\mJIsJkm.exe
  2⤵
  PID:2900
- C:\Windows\System\iyvOmDQ.exe
  C:\Windows\System\iyvOmDQ.exe
  2⤵
  PID:2072
- C:\Windows\System\VxBBHsM.exe
  C:\Windows\System\VxBBHsM.exe
  2⤵
  PID:2676
- C:\Windows\System\vjQNAHd.exe
  C:\Windows\System\vjQNAHd.exe
  2⤵
  PID:2136
- C:\Windows\System\QfRkXKL.exe
  C:\Windows\System\QfRkXKL.exe
  2⤵
  PID:2004
- C:\Windows\System\jHXdcJw.exe
  C:\Windows\System\jHXdcJw.exe
  2⤵
  PID:2416
- C:\Windows\System\BeVXVjQ.exe
  C:\Windows\System\BeVXVjQ.exe
  2⤵
  PID:1032
- C:\Windows\System\atwdSNE.exe
  C:\Windows\System\atwdSNE.exe
  2⤵
  PID:2772
- C:\Windows\System\ppYZqNl.exe
  C:\Windows\System\ppYZqNl.exe
  2⤵
  PID:1832
- C:\Windows\System\lmUZWFg.exe
  C:\Windows\System\lmUZWFg.exe
  2⤵
  PID:432
- C:\Windows\System\edkoZjs.exe
  C:\Windows\System\edkoZjs.exe
  2⤵
  PID:2256
- C:\Windows\System\FFzHobY.exe
  C:\Windows\System\FFzHobY.exe
  2⤵
  PID:1956
- C:\Windows\System\IVvHBQO.exe
  C:\Windows\System\IVvHBQO.exe
  2⤵
  PID:3000
- C:\Windows\System\PlzwZdH.exe
  C:\Windows\System\PlzwZdH.exe
  2⤵
  PID:2140
- C:\Windows\System\hPcVzlm.exe
  C:\Windows\System\hPcVzlm.exe
  2⤵
  PID:1768
- C:\Windows\System\vjsbpsF.exe
  C:\Windows\System\vjsbpsF.exe
  2⤵
  PID:3024
- C:\Windows\System\MmACYxU.exe
  C:\Windows\System\MmACYxU.exe
  2⤵
  PID:1920
- C:\Windows\System\uQZPXua.exe
  C:\Windows\System\uQZPXua.exe
  2⤵
  PID:2968
- C:\Windows\System\kXpnSoY.exe
  C:\Windows\System\kXpnSoY.exe
  2⤵
  PID:2456
- C:\Windows\System\VVVFkkG.exe
  C:\Windows\System\VVVFkkG.exe
  2⤵
  PID:788
- C:\Windows\System\FpwkTLT.exe
  C:\Windows\System\FpwkTLT.exe
  2⤵
  PID:1260
- C:\Windows\System\MDtbysD.exe
  C:\Windows\System\MDtbysD.exe
  2⤵
  PID:2528
- C:\Windows\System\wCtgEEl.exe
  C:\Windows\System\wCtgEEl.exe
  2⤵
  PID:2636
- C:\Windows\System\IpVaWIN.exe
  C:\Windows\System\IpVaWIN.exe
  2⤵
  PID:2436
- C:\Windows\System\OFAXNQW.exe
  C:\Windows\System\OFAXNQW.exe
  2⤵
  PID:2628
- C:\Windows\System\FWranjN.exe
  C:\Windows\System\FWranjN.exe
  2⤵
  PID:2944
- C:\Windows\System\izsUhnK.exe
  C:\Windows\System\izsUhnK.exe
  2⤵
  PID:520
- C:\Windows\System\zMOjUMf.exe
  C:\Windows\System\zMOjUMf.exe
  2⤵
  PID:1616
- C:\Windows\System\ZZbomif.exe
  C:\Windows\System\ZZbomif.exe
  2⤵
  PID:2824
- C:\Windows\System\psWxzTB.exe
  C:\Windows\System\psWxzTB.exe
  2⤵
  PID:1700
- C:\Windows\System\eNuwvJK.exe
  C:\Windows\System\eNuwvJK.exe
  2⤵
  PID:2592
- C:\Windows\System\mvdsyfo.exe
  C:\Windows\System\mvdsyfo.exe
  2⤵
  PID:1552
- C:\Windows\System\GrOwHwE.exe
  C:\Windows\System\GrOwHwE.exe
  2⤵
  PID:1184
- C:\Windows\System\wLgRRaA.exe
  C:\Windows\System\wLgRRaA.exe
  2⤵
  PID:1748
- C:\Windows\System\gmxosgc.exe
  C:\Windows\System\gmxosgc.exe
  2⤵
  PID:2084
- C:\Windows\System\pzEmXQa.exe
  C:\Windows\System\pzEmXQa.exe
  2⤵
  PID:676
- C:\Windows\System\UnPExQx.exe
  C:\Windows\System\UnPExQx.exe
  2⤵
  PID:2948
- C:\Windows\System\eolfhOx.exe
  C:\Windows\System\eolfhOx.exe
  2⤵
  PID:1924
- C:\Windows\System\pbetVAU.exe
  C:\Windows\System\pbetVAU.exe
  2⤵
  PID:2884
- C:\Windows\System\wWLbdDT.exe
  C:\Windows\System\wWLbdDT.exe
  2⤵
  PID:1604
- C:\Windows\System\NaGecDt.exe
  C:\Windows\System\NaGecDt.exe
  2⤵
  PID:1360
- C:\Windows\System\POxFwgs.exe
  C:\Windows\System\POxFwgs.exe
  2⤵
  PID:2220
- C:\Windows\System\NullomP.exe
  C:\Windows\System\NullomP.exe
  2⤵
  PID:2788
- C:\Windows\System\LyfyRJq.exe
  C:\Windows\System\LyfyRJq.exe
  2⤵
  PID:932
- C:\Windows\System\dlAAVbL.exe
  C:\Windows\System\dlAAVbL.exe
  2⤵
  PID:2080
- C:\Windows\System\lkLVXzh.exe
  C:\Windows\System\lkLVXzh.exe
  2⤵
  PID:2404
- C:\Windows\System\VgxZTYf.exe
  C:\Windows\System\VgxZTYf.exe
  2⤵
  PID:1676
- C:\Windows\System\zcxjbPW.exe
  C:\Windows\System\zcxjbPW.exe
  2⤵
  PID:964
- C:\Windows\System\eNOzyQP.exe
  C:\Windows\System\eNOzyQP.exe
  2⤵
  PID:612
- C:\Windows\System\JVQkadl.exe
  C:\Windows\System\JVQkadl.exe
  2⤵
  PID:2356
- C:\Windows\System\kfhgmJk.exe
  C:\Windows\System\kfhgmJk.exe
  2⤵
  PID:2700
- C:\Windows\System\UliZLrU.exe
  C:\Windows\System\UliZLrU.exe
  2⤵
  PID:2268
- C:\Windows\System\EmJjjRl.exe
  C:\Windows\System\EmJjjRl.exe
  2⤵
  PID:1292
- C:\Windows\System\rgSxKHU.exe
  C:\Windows\System\rgSxKHU.exe
  2⤵
  PID:2300
- C:\Windows\System\KcQzpMF.exe
  C:\Windows\System\KcQzpMF.exe
  2⤵
  PID:1728
- C:\Windows\System\DgGYOno.exe
  C:\Windows\System\DgGYOno.exe
  2⤵
  PID:940
- C:\Windows\System\iOGaTLf.exe
  C:\Windows\System\iOGaTLf.exe
  2⤵
  PID:1592
- C:\Windows\System\LflrFOw.exe
  C:\Windows\System\LflrFOw.exe
  2⤵
  PID:868
- C:\Windows\System\gfnzCzs.exe
  C:\Windows\System\gfnzCzs.exe
  2⤵
  PID:2892
- C:\Windows\System\hJskPPt.exe
  C:\Windows\System\hJskPPt.exe
  2⤵
  PID:2120
- C:\Windows\System\CfNGkoi.exe
  C:\Windows\System\CfNGkoi.exe
  2⤵
  PID:2820
- C:\Windows\System\kmWnlhE.exe
  C:\Windows\System\kmWnlhE.exe
  2⤵
  PID:2308
- C:\Windows\System\NqJnQtL.exe
  C:\Windows\System\NqJnQtL.exe
  2⤵
  PID:3088
- C:\Windows\System\LgQtoNs.exe
  C:\Windows\System\LgQtoNs.exe
  2⤵
  PID:3104
- C:\Windows\System\EvLoYaP.exe
  C:\Windows\System\EvLoYaP.exe
  2⤵
  PID:3120
- C:\Windows\System\yiWwNtj.exe
  C:\Windows\System\yiWwNtj.exe
  2⤵
  PID:3140
- C:\Windows\System\hGSGNLa.exe
  C:\Windows\System\hGSGNLa.exe
  2⤵
  PID:3156
- C:\Windows\System\ZBlXhFh.exe
  C:\Windows\System\ZBlXhFh.exe
  2⤵
  PID:3176
- C:\Windows\System\MJCwewX.exe
  C:\Windows\System\MJCwewX.exe
  2⤵
  PID:3196
- C:\Windows\System\qneMNoH.exe
  C:\Windows\System\qneMNoH.exe
  2⤵
  PID:3216
- C:\Windows\System\JSEmwwx.exe
  C:\Windows\System\JSEmwwx.exe
  2⤵
  PID:3236
- C:\Windows\System\sjDYSnw.exe
  C:\Windows\System\sjDYSnw.exe
  2⤵
  PID:3256
- C:\Windows\System\QQxOlOC.exe
  C:\Windows\System\QQxOlOC.exe
  2⤵
  PID:3272
- C:\Windows\System\GsskijZ.exe
  C:\Windows\System\GsskijZ.exe
  2⤵
  PID:3288
- C:\Windows\System\nDfTcxN.exe
  C:\Windows\System\nDfTcxN.exe
  2⤵
  PID:3308
- C:\Windows\System\jBXAZNm.exe
  C:\Windows\System\jBXAZNm.exe
  2⤵
  PID:3324
- C:\Windows\System\pTCeVoX.exe
  C:\Windows\System\pTCeVoX.exe
  2⤵
  PID:3348
- C:\Windows\System\qSvNJHN.exe
  C:\Windows\System\qSvNJHN.exe
  2⤵
  PID:3364
- C:\Windows\System\uYsoKyZ.exe
  C:\Windows\System\uYsoKyZ.exe
  2⤵
  PID:3380
- C:\Windows\System\kuWNYAB.exe
  C:\Windows\System\kuWNYAB.exe
  2⤵
  PID:3400
- C:\Windows\System\WNRUFgK.exe
  C:\Windows\System\WNRUFgK.exe
  2⤵
  PID:3416
- C:\Windows\System\ybOhVsm.exe
  C:\Windows\System\ybOhVsm.exe
  2⤵
  PID:3432
- C:\Windows\System\DALKBLd.exe
  C:\Windows\System\DALKBLd.exe
  2⤵
  PID:3452
- C:\Windows\System\fFVzpUv.exe
  C:\Windows\System\fFVzpUv.exe
  2⤵
  PID:3468
- C:\Windows\System\TQuHuKR.exe
  C:\Windows\System\TQuHuKR.exe
  2⤵
  PID:3488
- C:\Windows\System\xuMDkKV.exe
  C:\Windows\System\xuMDkKV.exe
  2⤵
  PID:3508
- C:\Windows\System\hdTjpVb.exe
  C:\Windows\System\hdTjpVb.exe
  2⤵
  PID:3524
- C:\Windows\System\bTbyWar.exe
  C:\Windows\System\bTbyWar.exe
  2⤵
  PID:3600
- C:\Windows\System\wJTKdJL.exe
  C:\Windows\System\wJTKdJL.exe
  2⤵
  PID:3616
- C:\Windows\System\EkXyDmN.exe
  C:\Windows\System\EkXyDmN.exe
  2⤵
  PID:3632
- C:\Windows\System\nNipWqc.exe
  C:\Windows\System\nNipWqc.exe
  2⤵
  PID:3652
- C:\Windows\System\plLafDG.exe
  C:\Windows\System\plLafDG.exe
  2⤵
  PID:3668
- C:\Windows\System\jfpBlSi.exe
  C:\Windows\System\jfpBlSi.exe
  2⤵
  PID:3684
- C:\Windows\System\XFIDFde.exe
  C:\Windows\System\XFIDFde.exe
  2⤵
  PID:3700
- C:\Windows\System\Nntduev.exe
  C:\Windows\System\Nntduev.exe
  2⤵
  PID:3716
- C:\Windows\System\TMFqAGN.exe
  C:\Windows\System\TMFqAGN.exe
  2⤵
  PID:3732
- C:\Windows\System\eVjvMaY.exe
  C:\Windows\System\eVjvMaY.exe
  2⤵
  PID:3760
- C:\Windows\System\eDSGbVz.exe
  C:\Windows\System\eDSGbVz.exe
  2⤵
  PID:3784
- C:\Windows\System\QASdiCu.exe
  C:\Windows\System\QASdiCu.exe
  2⤵
  PID:3804
- C:\Windows\System\mvOUZZe.exe
  C:\Windows\System\mvOUZZe.exe
  2⤵
  PID:3820
- C:\Windows\System\vhXrMmo.exe
  C:\Windows\System\vhXrMmo.exe
  2⤵
  PID:3836
- C:\Windows\System\zMqdNhf.exe
  C:\Windows\System\zMqdNhf.exe
  2⤵
  PID:3856
- C:\Windows\System\sfgiQuK.exe
  C:\Windows\System\sfgiQuK.exe
  2⤵
  PID:3876
- C:\Windows\System\meTPfYx.exe
  C:\Windows\System\meTPfYx.exe
  2⤵
  PID:3896
- C:\Windows\System\YbbEoyT.exe
  C:\Windows\System\YbbEoyT.exe
  2⤵
  PID:3912
- C:\Windows\System\llyQOSr.exe
  C:\Windows\System\llyQOSr.exe
  2⤵
  PID:3932
- C:\Windows\System\IjzidYj.exe
  C:\Windows\System\IjzidYj.exe
  2⤵
  PID:3952
- C:\Windows\System\XCdppno.exe
  C:\Windows\System\XCdppno.exe
  2⤵
  PID:3968
- C:\Windows\System\LpXfyKq.exe
  C:\Windows\System\LpXfyKq.exe
  2⤵
  PID:3992
- C:\Windows\System\YTjuPXj.exe
  C:\Windows\System\YTjuPXj.exe
  2⤵
  PID:4008
- C:\Windows\System\TLGQIrY.exe
  C:\Windows\System\TLGQIrY.exe
  2⤵
  PID:4032
- C:\Windows\System\TbmsmRC.exe
  C:\Windows\System\TbmsmRC.exe
  2⤵
  PID:4048
- C:\Windows\System\hItTxYM.exe
  C:\Windows\System\hItTxYM.exe
  2⤵
  PID:4064
- C:\Windows\System\QQcNQQB.exe
  C:\Windows\System\QQcNQQB.exe
  2⤵
  PID:4084
- C:\Windows\System\alreuHS.exe
  C:\Windows\System\alreuHS.exe
  2⤵
  PID:3096
- C:\Windows\System\SCTaZpO.exe
  C:\Windows\System\SCTaZpO.exe
  2⤵
  PID:2116
- C:\Windows\System\cpCYyho.exe
  C:\Windows\System\cpCYyho.exe
  2⤵
  PID:3252
- C:\Windows\System\ifImOGN.exe
  C:\Windows\System\ifImOGN.exe
  2⤵
  PID:3316
- C:\Windows\System\yPtJKqf.exe
  C:\Windows\System\yPtJKqf.exe
  2⤵
  PID:3388
- C:\Windows\System\jdadMdw.exe
  C:\Windows\System\jdadMdw.exe
  2⤵
  PID:1740
- C:\Windows\System\smcBjCd.exe
  C:\Windows\System\smcBjCd.exe
  2⤵
  PID:3500
- C:\Windows\System\bnJsWIZ.exe
  C:\Windows\System\bnJsWIZ.exe
  2⤵
  PID:3536
- C:\Windows\System\DMHxFHJ.exe
  C:\Windows\System\DMHxFHJ.exe
  2⤵
  PID:3552
- C:\Windows\System\gFrNZDP.exe
  C:\Windows\System\gFrNZDP.exe
  2⤵
  PID:3580
- C:\Windows\System\dHUHBYH.exe
  C:\Windows\System\dHUHBYH.exe
  2⤵
  PID:3776
- C:\Windows\System\qIURrSS.exe
  C:\Windows\System\qIURrSS.exe
  2⤵
  PID:3076
- C:\Windows\System\kdVIttG.exe
  C:\Windows\System\kdVIttG.exe
  2⤵
  PID:3148
- C:\Windows\System\vqHCyGm.exe
  C:\Windows\System\vqHCyGm.exe
  2⤵
  PID:3224
- C:\Windows\System\tpysbFS.exe
  C:\Windows\System\tpysbFS.exe
  2⤵
  PID:3268
- C:\Windows\System\PeXkLJC.exe
  C:\Windows\System\PeXkLJC.exe
  2⤵
  PID:3336
- C:\Windows\System\EhPgEzO.exe
  C:\Windows\System\EhPgEzO.exe
  2⤵
  PID:3812
- C:\Windows\System\FazZQTW.exe
  C:\Windows\System\FazZQTW.exe
  2⤵
  PID:3884
- C:\Windows\System\VfWyDsm.exe
  C:\Windows\System\VfWyDsm.exe
  2⤵
  PID:3920
- C:\Windows\System\hiygjcN.exe
  C:\Windows\System\hiygjcN.exe
  2⤵
  PID:3376
- C:\Windows\System\XbmKmLH.exe
  C:\Windows\System\XbmKmLH.exe
  2⤵
  PID:4040
- C:\Windows\System\OqkglTZ.exe
  C:\Windows\System\OqkglTZ.exe
  2⤵
  PID:4080
- C:\Windows\System\DeXzFUp.exe
  C:\Windows\System\DeXzFUp.exe
  2⤵
  PID:3164
- C:\Windows\System\xOappAP.exe
  C:\Windows\System\xOappAP.exe
  2⤵
  PID:1696
- C:\Windows\System\QvfSEAQ.exe
  C:\Windows\System\QvfSEAQ.exe
  2⤵
  PID:3752
- C:\Windows\System\wsGdAML.exe
  C:\Windows\System\wsGdAML.exe
  2⤵
  PID:3204
- C:\Windows\System\Xdufneg.exe
  C:\Windows\System\Xdufneg.exe
  2⤵
  PID:3828
- C:\Windows\System\oOPammQ.exe
  C:\Windows\System\oOPammQ.exe
  2⤵
  PID:3136
- C:\Windows\System\JKydEdY.exe
  C:\Windows\System\JKydEdY.exe
  2⤵
  PID:3868
- C:\Windows\System\WxisTul.exe
  C:\Windows\System\WxisTul.exe
  2⤵
  PID:3944
- C:\Windows\System\jLOmjgV.exe
  C:\Windows\System\jLOmjgV.exe
  2⤵
  PID:4024
- C:\Windows\System\PKyxiAG.exe
  C:\Windows\System\PKyxiAG.exe
  2⤵
  PID:3244
- C:\Windows\System\BHiENLU.exe
  C:\Windows\System\BHiENLU.exe
  2⤵
  PID:564
- C:\Windows\System\gwCDTol.exe
  C:\Windows\System\gwCDTol.exe
  2⤵
  PID:3396
- C:\Windows\System\LvWnxEo.exe
  C:\Windows\System\LvWnxEo.exe
  2⤵
  PID:3568
- C:\Windows\System\ubwWClt.exe
  C:\Windows\System\ubwWClt.exe
  2⤵
  PID:3564
- C:\Windows\System\vBfIekG.exe
  C:\Windows\System\vBfIekG.exe
  2⤵
  PID:748
- C:\Windows\System\jZvAZnJ.exe
  C:\Windows\System\jZvAZnJ.exe
  2⤵
  PID:3444
- C:\Windows\System\peJYazh.exe
  C:\Windows\System\peJYazh.exe
  2⤵
  PID:3408
- C:\Windows\System\cuIwiQk.exe
  C:\Windows\System\cuIwiQk.exe
  2⤵
  PID:3084
- C:\Windows\System\HtbVUmw.exe
  C:\Windows\System\HtbVUmw.exe
  2⤵
  PID:3304
- C:\Windows\System\uNcJULL.exe
  C:\Windows\System\uNcJULL.exe
  2⤵
  PID:3740
- C:\Windows\System\POZKIhR.exe
  C:\Windows\System\POZKIhR.exe
  2⤵
  PID:3232
- C:\Windows\System\sVNtvUN.exe
  C:\Windows\System\sVNtvUN.exe
  2⤵
  PID:3892
- C:\Windows\System\JtCesWc.exe
  C:\Windows\System\JtCesWc.exe
  2⤵
  PID:3712
- C:\Windows\System\OqTmCdm.exe
  C:\Windows\System\OqTmCdm.exe
  2⤵
  PID:3648
- C:\Windows\System\JyYgixK.exe
  C:\Windows\System\JyYgixK.exe
  2⤵
  PID:3128
- C:\Windows\System\KXKwlfe.exe
  C:\Windows\System\KXKwlfe.exe
  2⤵
  PID:3644
- C:\Windows\System\rVsWicn.exe
  C:\Windows\System\rVsWicn.exe
  2⤵
  PID:3744
- C:\Windows\System\yJTGoxo.exe
  C:\Windows\System\yJTGoxo.exe
  2⤵
  PID:3748
- C:\Windows\System\KcCQZQc.exe
  C:\Windows\System\KcCQZQc.exe
  2⤵
  PID:3980
- C:\Windows\System\bKkaJVM.exe
  C:\Windows\System\bKkaJVM.exe
  2⤵
  PID:4028
- C:\Windows\System\BAFyqjr.exe
  C:\Windows\System\BAFyqjr.exe
  2⤵
  PID:3112
- C:\Windows\System\tXZQEcL.exe
  C:\Windows\System\tXZQEcL.exe
  2⤵
  PID:1284
- C:\Windows\System\uSZhMyP.exe
  C:\Windows\System\uSZhMyP.exe
  2⤵
  PID:3960
- C:\Windows\System\BKdBXCz.exe
  C:\Windows\System\BKdBXCz.exe
  2⤵
  PID:3372
- C:\Windows\System\KqcynMN.exe
  C:\Windows\System\KqcynMN.exe
  2⤵
  PID:3572
- C:\Windows\System\akWfuiL.exe
  C:\Windows\System\akWfuiL.exe
  2⤵
  PID:3696
- C:\Windows\System\GiNUGXq.exe
  C:\Windows\System\GiNUGXq.exe
  2⤵
  PID:3300
- C:\Windows\System\WEELJtQ.exe
  C:\Windows\System\WEELJtQ.exe
  2⤵
  PID:3680
- C:\Windows\System\KsQWPRZ.exe
  C:\Windows\System\KsQWPRZ.exe
  2⤵
  PID:3796
- C:\Windows\System\MiVqgFK.exe
  C:\Windows\System\MiVqgFK.exe
  2⤵
  PID:3708
- C:\Windows\System\gCUWaUP.exe
  C:\Windows\System\gCUWaUP.exe
  2⤵
  PID:3852
- C:\Windows\System\APLXEJN.exe
  C:\Windows\System\APLXEJN.exe
  2⤵
  PID:3208
- C:\Windows\System\wxGsHVT.exe
  C:\Windows\System\wxGsHVT.exe
  2⤵
  PID:3424
- C:\Windows\System\CiPDjIm.exe
  C:\Windows\System\CiPDjIm.exe
  2⤵
  PID:3496
- C:\Windows\System\uxubEQi.exe
  C:\Windows\System\uxubEQi.exe
  2⤵
  PID:3476
- C:\Windows\System\wYZLHZQ.exe
  C:\Windows\System\wYZLHZQ.exe
  2⤵
  PID:3984
- C:\Windows\System\KflsuSq.exe
  C:\Windows\System\KflsuSq.exe
  2⤵
  PID:3356
- C:\Windows\System\XWnrBlA.exe
  C:\Windows\System\XWnrBlA.exe
  2⤵
  PID:3928
- C:\Windows\System\hhXeliM.exe
  C:\Windows\System\hhXeliM.exe
  2⤵
  PID:3940
- C:\Windows\System\gzAPvhb.exe
  C:\Windows\System\gzAPvhb.exe
  2⤵
  PID:4100
- C:\Windows\System\JsbMGvY.exe
  C:\Windows\System\JsbMGvY.exe
  2⤵
  PID:4120
- C:\Windows\System\rkWllfH.exe
  C:\Windows\System\rkWllfH.exe
  2⤵
  PID:4140
- C:\Windows\System\doVaJqx.exe
  C:\Windows\System\doVaJqx.exe
  2⤵
  PID:4156
- C:\Windows\System\qlhvqYG.exe
  C:\Windows\System\qlhvqYG.exe
  2⤵
  PID:4176
- C:\Windows\System\keLfYkt.exe
  C:\Windows\System\keLfYkt.exe
  2⤵
  PID:4196
- C:\Windows\System\AkIlvSP.exe
  C:\Windows\System\AkIlvSP.exe
  2⤵
  PID:4216
- C:\Windows\System\WBxgQkI.exe
  C:\Windows\System\WBxgQkI.exe
  2⤵
  PID:4232
- C:\Windows\System\ZKChMES.exe
  C:\Windows\System\ZKChMES.exe
  2⤵
  PID:4256
- C:\Windows\System\DfZhAYv.exe
  C:\Windows\System\DfZhAYv.exe
  2⤵
  PID:4276
- C:\Windows\System\tOEToCZ.exe
  C:\Windows\System\tOEToCZ.exe
  2⤵
  PID:4296
- C:\Windows\System\vKcGkaK.exe
  C:\Windows\System\vKcGkaK.exe
  2⤵
  PID:4312
- C:\Windows\System\PkOvLQw.exe
  C:\Windows\System\PkOvLQw.exe
  2⤵
  PID:4332
- C:\Windows\System\qYCkPZg.exe
  C:\Windows\System\qYCkPZg.exe
  2⤵
  PID:4352
- C:\Windows\System\adnyUyl.exe
  C:\Windows\System\adnyUyl.exe
  2⤵
  PID:4368
- C:\Windows\System\UDEAemm.exe
  C:\Windows\System\UDEAemm.exe
  2⤵
  PID:4384
- C:\Windows\System\pNSPvoM.exe
  C:\Windows\System\pNSPvoM.exe
  2⤵
  PID:4404
- C:\Windows\System\HFrkUzh.exe
  C:\Windows\System\HFrkUzh.exe
  2⤵
  PID:4424
- C:\Windows\System\guZtAvF.exe
  C:\Windows\System\guZtAvF.exe
  2⤵
  PID:4448
- C:\Windows\System\LUAEJKq.exe
  C:\Windows\System\LUAEJKq.exe
  2⤵
  PID:4472
- C:\Windows\System\BVUzsWq.exe
  C:\Windows\System\BVUzsWq.exe
  2⤵
  PID:4512
- C:\Windows\System\wcVntmH.exe
  C:\Windows\System\wcVntmH.exe
  2⤵
  PID:4532
- C:\Windows\System\OMPhBUy.exe
  C:\Windows\System\OMPhBUy.exe
  2⤵
  PID:4564
- C:\Windows\System\UoIQCRL.exe
  C:\Windows\System\UoIQCRL.exe
  2⤵
  PID:4584
- C:\Windows\System\VhUnebT.exe
  C:\Windows\System\VhUnebT.exe
  2⤵
  PID:4600
- C:\Windows\System\PEAmTYu.exe
  C:\Windows\System\PEAmTYu.exe
  2⤵
  PID:4616
- C:\Windows\System\AhqAmNW.exe
  C:\Windows\System\AhqAmNW.exe
  2⤵
  PID:4632
- C:\Windows\System\PcxNPcf.exe
  C:\Windows\System\PcxNPcf.exe
  2⤵
  PID:4652
- C:\Windows\System\BLolWQb.exe
  C:\Windows\System\BLolWQb.exe
  2⤵
  PID:4668
- C:\Windows\System\aGSKCVk.exe
  C:\Windows\System\aGSKCVk.exe
  2⤵
  PID:4684
- C:\Windows\System\kNRjPib.exe
  C:\Windows\System\kNRjPib.exe
  2⤵
  PID:4728
- C:\Windows\System\ynIRERe.exe
  C:\Windows\System\ynIRERe.exe
  2⤵
  PID:4744
- C:\Windows\System\lhogccI.exe
  C:\Windows\System\lhogccI.exe
  2⤵
  PID:4760
- C:\Windows\System\LQFlvDp.exe
  C:\Windows\System\LQFlvDp.exe
  2⤵
  PID:4784
- C:\Windows\System\SnCTWAO.exe
  C:\Windows\System\SnCTWAO.exe
  2⤵
  PID:4800
- C:\Windows\System\QFvOdeF.exe
  C:\Windows\System\QFvOdeF.exe
  2⤵
  PID:4820
- C:\Windows\System\knbvTEX.exe
  C:\Windows\System\knbvTEX.exe
  2⤵
  PID:4836
- C:\Windows\System\KEhCJUx.exe
  C:\Windows\System\KEhCJUx.exe
  2⤵
  PID:4852
- C:\Windows\System\KFLLWuw.exe
  C:\Windows\System\KFLLWuw.exe
  2⤵
  PID:4868
- C:\Windows\System\XepuZNL.exe
  C:\Windows\System\XepuZNL.exe
  2⤵
  PID:4892
- C:\Windows\System\fbYsNMp.exe
  C:\Windows\System\fbYsNMp.exe
  2⤵
  PID:4908
- C:\Windows\System\RwFrzPq.exe
  C:\Windows\System\RwFrzPq.exe
  2⤵
  PID:4928
- C:\Windows\System\VCpjUbR.exe
  C:\Windows\System\VCpjUbR.exe
  2⤵
  PID:4944
- C:\Windows\System\bnbSWnw.exe
  C:\Windows\System\bnbSWnw.exe
  2⤵
  PID:4964
- C:\Windows\System\DDGfzSS.exe
  C:\Windows\System\DDGfzSS.exe
  2⤵
  PID:4984
- C:\Windows\System\WaELuWN.exe
  C:\Windows\System\WaELuWN.exe
  2⤵
  PID:5000
- C:\Windows\System\NExTMql.exe
  C:\Windows\System\NExTMql.exe
  2⤵
  PID:5020
- C:\Windows\System\LUGZOTp.exe
  C:\Windows\System\LUGZOTp.exe
  2⤵
  PID:5068
- C:\Windows\System\VPKUHdu.exe
  C:\Windows\System\VPKUHdu.exe
  2⤵
  PID:5084
- C:\Windows\System\TQWSmDt.exe
  C:\Windows\System\TQWSmDt.exe
  2⤵
  PID:5104
- C:\Windows\System\TdbtQqh.exe
  C:\Windows\System\TdbtQqh.exe
  2⤵
  PID:3188
- C:\Windows\System\ynkTxDV.exe
  C:\Windows\System\ynkTxDV.exe
  2⤵
  PID:4132
- C:\Windows\System\ucwzQrW.exe
  C:\Windows\System\ucwzQrW.exe
  2⤵
  PID:3280
- C:\Windows\System\LYdgmWS.exe
  C:\Windows\System\LYdgmWS.exe
  2⤵
  PID:4212
- C:\Windows\System\uKeqZDX.exe
  C:\Windows\System\uKeqZDX.exe
  2⤵
  PID:4248
- C:\Windows\System\WeUSHVA.exe
  C:\Windows\System\WeUSHVA.exe
  2⤵
  PID:4284
- C:\Windows\System\YTskzVe.exe
  C:\Windows\System\YTskzVe.exe
  2⤵
  PID:4328
- C:\Windows\System\JIRKFkZ.exe
  C:\Windows\System\JIRKFkZ.exe
  2⤵
  PID:4400
- C:\Windows\System\udYLvgM.exe
  C:\Windows\System\udYLvgM.exe
  2⤵
  PID:4440
- C:\Windows\System\xqXElNZ.exe
  C:\Windows\System\xqXElNZ.exe
  2⤵
  PID:4488
- C:\Windows\System\BPrcKEh.exe
  C:\Windows\System\BPrcKEh.exe
  2⤵
  PID:3516
- C:\Windows\System\kcOaWht.exe
  C:\Windows\System\kcOaWht.exe
  2⤵
  PID:4416
- C:\Windows\System\NfekhLE.exe
  C:\Windows\System\NfekhLE.exe
  2⤵
  PID:4272
- C:\Windows\System\NzRIkTe.exe
  C:\Windows\System\NzRIkTe.exe
  2⤵
  PID:4108
- C:\Windows\System\pkdPqBo.exe
  C:\Windows\System\pkdPqBo.exe
  2⤵
  PID:4184
- C:\Windows\System\xnSCHgV.exe
  C:\Windows\System\xnSCHgV.exe
  2⤵
  PID:4228
- C:\Windows\System\omuBtAB.exe
  C:\Windows\System\omuBtAB.exe
  2⤵
  PID:4344
- C:\Windows\System\GBUWkCS.exe
  C:\Windows\System\GBUWkCS.exe
  2⤵
  PID:4468
- C:\Windows\System\eVzRyWk.exe
  C:\Windows\System\eVzRyWk.exe
  2⤵
  PID:4548
- C:\Windows\System\Kfgvrek.exe
  C:\Windows\System\Kfgvrek.exe
  2⤵
  PID:4552
- C:\Windows\System\fjEFTUJ.exe
  C:\Windows\System\fjEFTUJ.exe
  2⤵
  PID:4664
- C:\Windows\System\ZsdbaUE.exe
  C:\Windows\System\ZsdbaUE.exe
  2⤵
  PID:4696
- C:\Windows\System\UznbQqd.exe
  C:\Windows\System\UznbQqd.exe
  2⤵
  PID:4640
- C:\Windows\System\MwqWipz.exe
  C:\Windows\System\MwqWipz.exe
  2⤵
  PID:4680
- C:\Windows\System\rIasdeT.exe
  C:\Windows\System\rIasdeT.exe
  2⤵
  PID:4704
- C:\Windows\System\yecLFDi.exe
  C:\Windows\System\yecLFDi.exe
  2⤵
  PID:4740
- C:\Windows\System\TcCKzpK.exe
  C:\Windows\System\TcCKzpK.exe
  2⤵
  PID:5016
- C:\Windows\System\mqfobyG.exe
  C:\Windows\System\mqfobyG.exe
  2⤵
  PID:4844
- C:\Windows\System\HJsGKfV.exe
  C:\Windows\System\HJsGKfV.exe
  2⤵
  PID:4916
- C:\Windows\System\BmKdcRx.exe
  C:\Windows\System\BmKdcRx.exe
  2⤵
  PID:5040
- C:\Windows\System\SYYGdyK.exe
  C:\Windows\System\SYYGdyK.exe
  2⤵
  PID:5076
- C:\Windows\System\SanSmXI.exe
  C:\Windows\System\SanSmXI.exe
  2⤵
  PID:4136
- C:\Windows\System\kutVsPy.exe
  C:\Windows\System\kutVsPy.exe
  2⤵
  PID:4320
- C:\Windows\System\ckJcumU.exe
  C:\Windows\System\ckJcumU.exe
  2⤵
  PID:3028
- C:\Windows\System\KKVrgum.exe
  C:\Windows\System\KKVrgum.exe
  2⤵
  PID:4880
- C:\Windows\System\tQHWqiC.exe
  C:\Windows\System\tQHWqiC.exe
  2⤵
  PID:4952
- C:\Windows\System\jsDoqAC.exe
  C:\Windows\System\jsDoqAC.exe
  2⤵
  PID:5032
- C:\Windows\System\rrNtaaQ.exe
  C:\Windows\System\rrNtaaQ.exe
  2⤵
  PID:4264
- C:\Windows\System\VtfqdsT.exe
  C:\Windows\System\VtfqdsT.exe
  2⤵
  PID:4540
- C:\Windows\System\vpDoehV.exe
  C:\Windows\System\vpDoehV.exe
  2⤵
  PID:4596
- C:\Windows\System\IRzYeTJ.exe
  C:\Windows\System\IRzYeTJ.exe
  2⤵
  PID:4544
- C:\Windows\System\JFtsjnK.exe
  C:\Windows\System\JFtsjnK.exe
  2⤵
  PID:3344
- C:\Windows\System\YmIYbRf.exe
  C:\Windows\System\YmIYbRf.exe
  2⤵
  PID:4020
- C:\Windows\System\inmSVZL.exe
  C:\Windows\System\inmSVZL.exe
  2⤵
  PID:4420
- C:\Windows\System\qZGcJAS.exe
  C:\Windows\System\qZGcJAS.exe
  2⤵
  PID:4464
- C:\Windows\System\xVHnoEk.exe
  C:\Windows\System\xVHnoEk.exe
  2⤵
  PID:4480
- C:\Windows\System\clGFVvo.exe
  C:\Windows\System\clGFVvo.exe
  2⤵
  PID:4208
- C:\Windows\System\VmPZvgF.exe
  C:\Windows\System\VmPZvgF.exe
  2⤵
  PID:4708
- C:\Windows\System\RQvlJVz.exe
  C:\Windows\System\RQvlJVz.exe
  2⤵
  PID:4608
- C:\Windows\System\NlfLZuZ.exe
  C:\Windows\System\NlfLZuZ.exe
  2⤵
  PID:4756
- C:\Windows\System\rMlQPgK.exe
  C:\Windows\System\rMlQPgK.exe
  2⤵
  PID:4484
- C:\Windows\System\gXPDBpm.exe
  C:\Windows\System\gXPDBpm.exe
  2⤵
  PID:4940
- C:\Windows\System\vkKGuJJ.exe
  C:\Windows\System\vkKGuJJ.exe
  2⤵
  PID:4936
- C:\Windows\System\AsHDuFu.exe
  C:\Windows\System\AsHDuFu.exe
  2⤵
  PID:4992
- C:\Windows\System\gdcSFnp.exe
  C:\Windows\System\gdcSFnp.exe
  2⤵
  PID:4240
- C:\Windows\System\SefQtPn.exe
  C:\Windows\System\SefQtPn.exe
  2⤵
  PID:4172
- C:\Windows\System\cFDsqxT.exe
  C:\Windows\System\cFDsqxT.exe
  2⤵
  PID:5008
- C:\Windows\System\pLXadiw.exe
  C:\Windows\System\pLXadiw.exe
  2⤵
  PID:4508
- C:\Windows\System\VTcHfnj.exe
  C:\Windows\System\VTcHfnj.exe
  2⤵
  PID:5100
- C:\Windows\System\sMBROsL.exe
  C:\Windows\System\sMBROsL.exe
  2⤵
  PID:3132
- C:\Windows\System\XvHLweE.exe
  C:\Windows\System\XvHLweE.exe
  2⤵
  PID:4724
- C:\Windows\System\nxwaZcd.exe
  C:\Windows\System\nxwaZcd.exe
  2⤵
  PID:4864
- C:\Windows\System\HplxWLy.exe
  C:\Windows\System\HplxWLy.exe
  2⤵
  PID:4812
- C:\Windows\System\MtMqnQT.exe
  C:\Windows\System\MtMqnQT.exe
  2⤵
  PID:5216
- C:\Windows\System\IFpfAeo.exe
  C:\Windows\System\IFpfAeo.exe
  2⤵
  PID:5232
- C:\Windows\System\nJmXbGd.exe
  C:\Windows\System\nJmXbGd.exe
  2⤵
  PID:5248
- C:\Windows\System\qrJcktP.exe
  C:\Windows\System\qrJcktP.exe
  2⤵
  PID:5268
- C:\Windows\System\cuUJIyn.exe
  C:\Windows\System\cuUJIyn.exe
  2⤵
  PID:5284
- C:\Windows\System\xXhnWFk.exe
  C:\Windows\System\xXhnWFk.exe
  2⤵
  PID:5300
- C:\Windows\System\fkDVymT.exe
  C:\Windows\System\fkDVymT.exe
  2⤵
  PID:5316
- C:\Windows\System\GQDeCUS.exe
  C:\Windows\System\GQDeCUS.exe
  2⤵
  PID:5332
- C:\Windows\System\BSvkEkd.exe
  C:\Windows\System\BSvkEkd.exe
  2⤵
  PID:5376
- C:\Windows\System\hOxrIwE.exe
  C:\Windows\System\hOxrIwE.exe
  2⤵
  PID:5392
- C:\Windows\System\xLfCOCM.exe
  C:\Windows\System\xLfCOCM.exe
  2⤵
  PID:5408
- C:\Windows\System\dtxQtth.exe
  C:\Windows\System\dtxQtth.exe
  2⤵
  PID:5432
- C:\Windows\System\yVGlFLI.exe
  C:\Windows\System\yVGlFLI.exe
  2⤵
  PID:5448
- C:\Windows\System\zmEJkVt.exe
  C:\Windows\System\zmEJkVt.exe
  2⤵
  PID:5472
- C:\Windows\System\AXEFosJ.exe
  C:\Windows\System\AXEFosJ.exe
  2⤵
  PID:5496
- C:\Windows\System\wCAVVvq.exe
  C:\Windows\System\wCAVVvq.exe
  2⤵
  PID:5520
- C:\Windows\System\iUuHqKI.exe
  C:\Windows\System\iUuHqKI.exe
  2⤵
  PID:5536
- C:\Windows\System\VOORXKt.exe
  C:\Windows\System\VOORXKt.exe
  2⤵
  PID:5552
- C:\Windows\System\lLtAqKs.exe
  C:\Windows\System\lLtAqKs.exe
  2⤵
  PID:5572
- C:\Windows\System\tTtebMw.exe
  C:\Windows\System\tTtebMw.exe
  2⤵
  PID:5592
- C:\Windows\System\cBqFNCb.exe
  C:\Windows\System\cBqFNCb.exe
  2⤵
  PID:5608
- C:\Windows\System\nDxPOZK.exe
  C:\Windows\System\nDxPOZK.exe
  2⤵
  PID:5628
- C:\Windows\System\ENsmdRt.exe
  C:\Windows\System\ENsmdRt.exe
  2⤵
  PID:5660
- C:\Windows\System\cJLEYCx.exe
  C:\Windows\System\cJLEYCx.exe
  2⤵
  PID:5676
- C:\Windows\System\ljsyIrh.exe
  C:\Windows\System\ljsyIrh.exe
  2⤵
  PID:5696
- C:\Windows\System\llAZfmS.exe
  C:\Windows\System\llAZfmS.exe
  2⤵
  PID:5712
- C:\Windows\System\arTRkrm.exe
  C:\Windows\System\arTRkrm.exe
  2⤵
  PID:5728
- C:\Windows\System\nzyAFfW.exe
  C:\Windows\System\nzyAFfW.exe
  2⤵
  PID:5744
- C:\Windows\System\PoXGjps.exe
  C:\Windows\System\PoXGjps.exe
  2⤵
  PID:5764
- C:\Windows\System\ZhbzHPC.exe
  C:\Windows\System\ZhbzHPC.exe
  2⤵
  PID:5780
- C:\Windows\System\JIohIEu.exe
  C:\Windows\System\JIohIEu.exe
  2⤵
  PID:5820
- C:\Windows\System\EoBYxvM.exe
  C:\Windows\System\EoBYxvM.exe
  2⤵
  PID:5836
- C:\Windows\System\oyzrtEy.exe
  C:\Windows\System\oyzrtEy.exe
  2⤵
  PID:5856
- C:\Windows\System\iJYMKUo.exe
  C:\Windows\System\iJYMKUo.exe
  2⤵
  PID:5872
- C:\Windows\System\JooZhUB.exe
  C:\Windows\System\JooZhUB.exe
  2⤵
  PID:5888
- C:\Windows\System\hKWHMbw.exe
  C:\Windows\System\hKWHMbw.exe
  2⤵
  PID:5908
- C:\Windows\System\DbHYVNN.exe
  C:\Windows\System\DbHYVNN.exe
  2⤵
  PID:5928
- C:\Windows\System\VJSMumz.exe
  C:\Windows\System\VJSMumz.exe
  2⤵
  PID:5944
- C:\Windows\System\GRvVXXu.exe
  C:\Windows\System\GRvVXXu.exe
  2⤵
  PID:5960
- C:\Windows\System\Zqhfjwk.exe
  C:\Windows\System\Zqhfjwk.exe
  2⤵
  PID:5976
- C:\Windows\System\LIStxza.exe
  C:\Windows\System\LIStxza.exe
  2⤵
  PID:6000
- C:\Windows\System\TYcgbCf.exe
  C:\Windows\System\TYcgbCf.exe
  2⤵
  PID:6020
- C:\Windows\System\bWICXJB.exe
  C:\Windows\System\bWICXJB.exe
  2⤵
  PID:6040
- C:\Windows\System\JUgKNVK.exe
  C:\Windows\System\JUgKNVK.exe
  2⤵
  PID:6056
- C:\Windows\System\gIJQowi.exe
  C:\Windows\System\gIJQowi.exe
  2⤵
  PID:6072
- C:\Windows\System\txxjlNQ.exe
  C:\Windows\System\txxjlNQ.exe
  2⤵
  PID:6108
- C:\Windows\System\UvhMNvl.exe
  C:\Windows\System\UvhMNvl.exe
  2⤵
  PID:6128
- C:\Windows\System\LJqMyZo.exe
  C:\Windows\System\LJqMyZo.exe
  2⤵
  PID:4816
- C:\Windows\System\fPZAMGL.exe
  C:\Windows\System\fPZAMGL.exe
  2⤵
  PID:4956
- C:\Windows\System\jklOiea.exe
  C:\Windows\System\jklOiea.exe
  2⤵
  PID:4716
- C:\Windows\System\shWdZVR.exe
  C:\Windows\System\shWdZVR.exe
  2⤵
  PID:5112
- C:\Windows\System\qHHVZuz.exe
  C:\Windows\System\qHHVZuz.exe
  2⤵
  PID:4152
- C:\Windows\System\LzGSNkj.exe
  C:\Windows\System\LzGSNkj.exe
  2⤵
  PID:4224
- C:\Windows\System\FYnXdAz.exe
  C:\Windows\System\FYnXdAz.exe
  2⤵
  PID:4592
- C:\Windows\System\NgYrvey.exe
  C:\Windows\System\NgYrvey.exe
  2⤵
  PID:5056
- C:\Windows\System\bnPpYEw.exe
  C:\Windows\System\bnPpYEw.exe
  2⤵
  PID:3976
- C:\Windows\System\KShYwju.exe
  C:\Windows\System\KShYwju.exe
  2⤵
  PID:5144
- C:\Windows\System\BIJpkrw.exe
  C:\Windows\System\BIJpkrw.exe
  2⤵
  PID:5184
- C:\Windows\System\wIMkgTo.exe
  C:\Windows\System\wIMkgTo.exe
  2⤵
  PID:5200
- C:\Windows\System\GVODTtm.exe
  C:\Windows\System\GVODTtm.exe
  2⤵
  PID:5132
- C:\Windows\System\cjgZldd.exe
  C:\Windows\System\cjgZldd.exe
  2⤵
  PID:5324
- C:\Windows\System\FhbReWW.exe
  C:\Windows\System\FhbReWW.exe
  2⤵
  PID:5328
- C:\Windows\System\DQWilOI.exe
  C:\Windows\System\DQWilOI.exe
  2⤵
  PID:5308
- C:\Windows\System\yvznUXa.exe
  C:\Windows\System\yvznUXa.exe
  2⤵
  PID:5364
- C:\Windows\System\bICtUlM.exe
  C:\Windows\System\bICtUlM.exe
  2⤵
  PID:5344
- C:\Windows\System\YXPEUnu.exe
  C:\Windows\System\YXPEUnu.exe
  2⤵
  PID:5440
- C:\Windows\System\mIKxZHR.exe
  C:\Windows\System\mIKxZHR.exe
  2⤵
  PID:5428
- C:\Windows\System\JEuDNEa.exe
  C:\Windows\System\JEuDNEa.exe
  2⤵
  PID:5512
- C:\Windows\System\yolnNMI.exe
  C:\Windows\System\yolnNMI.exe
  2⤵
  PID:5492
- C:\Windows\System\SIiuRhc.exe
  C:\Windows\System\SIiuRhc.exe
  2⤵
  PID:5548
- C:\Windows\System\nmTbaQY.exe
  C:\Windows\System\nmTbaQY.exe
  2⤵
  PID:5616
- C:\Windows\System\mtwxcNX.exe
  C:\Windows\System\mtwxcNX.exe
  2⤵
  PID:5600
- C:\Windows\System\YKKZhYA.exe
  C:\Windows\System\YKKZhYA.exe
  2⤵
  PID:5636
- C:\Windows\System\YqaaORK.exe
  C:\Windows\System\YqaaORK.exe
  2⤵
  PID:5740
- C:\Windows\System\ftxeFQj.exe
  C:\Windows\System\ftxeFQj.exe
  2⤵
  PID:5688
- C:\Windows\System\wmrQOqu.exe
  C:\Windows\System\wmrQOqu.exe
  2⤵
  PID:5720
- C:\Windows\System\ejfNSTX.exe
  C:\Windows\System\ejfNSTX.exe
  2⤵
  PID:5808
- C:\Windows\System\PtMVqxB.exe
  C:\Windows\System\PtMVqxB.exe
  2⤵
  PID:5832
- C:\Windows\System\qanGtaj.exe
  C:\Windows\System\qanGtaj.exe
  2⤵
  PID:5896
- C:\Windows\System\sJdNjkM.exe
  C:\Windows\System\sJdNjkM.exe
  2⤵
  PID:5940
- C:\Windows\System\toyxiER.exe
  C:\Windows\System\toyxiER.exe
  2⤵
  PID:6012
- C:\Windows\System\ZxdEqMv.exe
  C:\Windows\System\ZxdEqMv.exe
  2⤵
  PID:6080
- C:\Windows\System\wahLvwG.exe
  C:\Windows\System\wahLvwG.exe
  2⤵
  PID:5884
- C:\Windows\System\LkneyYb.exe
  C:\Windows\System\LkneyYb.exe
  2⤵
  PID:6032
- C:\Windows\System\wXfRusC.exe
  C:\Windows\System\wXfRusC.exe
  2⤵
  PID:6064
- C:\Windows\System\HLFKlxg.exe
  C:\Windows\System\HLFKlxg.exe
  2⤵
  PID:5956
- C:\Windows\System\GxwQJap.exe
  C:\Windows\System\GxwQJap.exe
  2⤵
  PID:6136
- C:\Windows\System\ZXMqyps.exe
  C:\Windows\System\ZXMqyps.exe
  2⤵
  PID:5052
- C:\Windows\System\xZyKoeR.exe
  C:\Windows\System\xZyKoeR.exe
  2⤵
  PID:4500
- C:\Windows\System\KxitqHY.exe
  C:\Windows\System\KxitqHY.exe
  2⤵
  PID:5096
- C:\Windows\System\YIjOGmG.exe
  C:\Windows\System\YIjOGmG.exe
  2⤵
  PID:4692
- C:\Windows\System\uQGaMBs.exe
  C:\Windows\System\uQGaMBs.exe
  2⤵
  PID:3360
- C:\Windows\System\lTWENDW.exe
  C:\Windows\System\lTWENDW.exe
  2⤵
  PID:5140
- C:\Windows\System\wCIuiim.exe
  C:\Windows\System\wCIuiim.exe
  2⤵
  PID:5156
- C:\Windows\System\UgikoYJ.exe
  C:\Windows\System\UgikoYJ.exe
  2⤵
  PID:5180
- C:\Windows\System\TxPzBSu.exe
  C:\Windows\System\TxPzBSu.exe
  2⤵
  PID:5296
- C:\Windows\System\FtvENFm.exe
  C:\Windows\System\FtvENFm.exe
  2⤵
  PID:5292
- C:\Windows\System\wvULBBJ.exe
  C:\Windows\System\wvULBBJ.exe
  2⤵
  PID:5228
- C:\Windows\System\gxxQMIr.exe
  C:\Windows\System\gxxQMIr.exe
  2⤵
  PID:5384
- C:\Windows\System\kRTzKFM.exe
  C:\Windows\System\kRTzKFM.exe
  2⤵
  PID:5372
- C:\Windows\System\qcyDkKM.exe
  C:\Windows\System\qcyDkKM.exe
  2⤵
  PID:5488
- C:\Windows\System\kbuuVcc.exe
  C:\Windows\System\kbuuVcc.exe
  2⤵
  PID:5560
- C:\Windows\System\Tywimeq.exe
  C:\Windows\System\Tywimeq.exe
  2⤵
  PID:5640
- C:\Windows\System\fcNpcbo.exe
  C:\Windows\System\fcNpcbo.exe
  2⤵
  PID:5656
- C:\Windows\System\BpkqiuS.exe
  C:\Windows\System\BpkqiuS.exe
  2⤵
  PID:5704
- C:\Windows\System\QppjSJu.exe
  C:\Windows\System\QppjSJu.exe
  2⤵
  PID:5692
- C:\Windows\System\fcFgDtY.exe
  C:\Windows\System\fcFgDtY.exe
  2⤵
  PID:5724
- C:\Windows\System\ykMEIjK.exe
  C:\Windows\System\ykMEIjK.exe
  2⤵
  PID:5828
- C:\Windows\System\ardIFid.exe
  C:\Windows\System\ardIFid.exe
  2⤵
  PID:6096
- C:\Windows\System\CblzBAj.exe
  C:\Windows\System\CblzBAj.exe
  2⤵
  PID:6016
- C:\Windows\System\qfooigI.exe
  C:\Windows\System\qfooigI.exe
  2⤵
  PID:5952
- C:\Windows\System\UWMcths.exe
  C:\Windows\System\UWMcths.exe
  2⤵
  PID:5920
- C:\Windows\System\AOTwfor.exe
  C:\Windows\System\AOTwfor.exe
  2⤵
  PID:4460
- C:\Windows\System\ZaPbDFP.exe
  C:\Windows\System\ZaPbDFP.exe
  2⤵
  PID:4624
- C:\Windows\System\ZWWWYWB.exe
  C:\Windows\System\ZWWWYWB.exe
  2⤵
  PID:3768
- C:\Windows\System\fiVGgvD.exe
  C:\Windows\System\fiVGgvD.exe
  2⤵
  PID:4904
- C:\Windows\System\DYUuvWJ.exe
  C:\Windows\System\DYUuvWJ.exe
  2⤵
  PID:5212
- C:\Windows\System\ZBJJvNR.exe
  C:\Windows\System\ZBJJvNR.exe
  2⤵
  PID:5468
- C:\Windows\System\QPiMWsd.exe
  C:\Windows\System\QPiMWsd.exe
  2⤵
  PID:5196
- C:\Windows\System\zivOGQc.exe
  C:\Windows\System\zivOGQc.exe
  2⤵
  PID:5504
- C:\Windows\System\SiHUQAz.exe
  C:\Windows\System\SiHUQAz.exe
  2⤵
  PID:5760
- C:\Windows\System\yYfdIav.exe
  C:\Windows\System\yYfdIav.exe
  2⤵
  PID:5968
- C:\Windows\System\AFHviDg.exe
  C:\Windows\System\AFHviDg.exe
  2⤵
  PID:5484
- C:\Windows\System\DBpfgnv.exe
  C:\Windows\System\DBpfgnv.exe
  2⤵
  PID:5812
- C:\Windows\System\taNXrUj.exe
  C:\Windows\System\taNXrUj.exe
  2⤵
  PID:5972
- C:\Windows\System\lVpRcQR.exe
  C:\Windows\System\lVpRcQR.exe
  2⤵
  PID:4776
- C:\Windows\System\FuoVWcE.exe
  C:\Windows\System\FuoVWcE.exe
  2⤵
  PID:4308
- C:\Windows\System\hSizFKm.exe
  C:\Windows\System\hSizFKm.exe
  2⤵
  PID:6116
- C:\Windows\System\OtwMbmL.exe
  C:\Windows\System\OtwMbmL.exe
  2⤵
  PID:4876
- C:\Windows\System\QodBCFS.exe
  C:\Windows\System\QodBCFS.exe
  2⤵
  PID:5996
- C:\Windows\System\VjkldHJ.exe
  C:\Windows\System\VjkldHJ.exe
  2⤵
  PID:5360
- C:\Windows\System\gAHzHwr.exe
  C:\Windows\System\gAHzHwr.exe
  2⤵
  PID:1020
- C:\Windows\System\undXShu.exe
  C:\Windows\System\undXShu.exe
  2⤵
  PID:5584
- C:\Windows\System\fRxrwvt.exe
  C:\Windows\System\fRxrwvt.exe
  2⤵
  PID:6092
- C:\Windows\System\WKThjPA.exe
  C:\Windows\System\WKThjPA.exe
  2⤵
  PID:5988
- C:\Windows\System\KPnaBRE.exe
  C:\Windows\System\KPnaBRE.exe
  2⤵
  PID:5648
- C:\Windows\System\CVNZadV.exe
  C:\Windows\System\CVNZadV.exe
  2⤵
  PID:6164
- C:\Windows\System\lVjGReq.exe
  C:\Windows\System\lVjGReq.exe
  2⤵
  PID:6184
- C:\Windows\System\FotMoyr.exe
  C:\Windows\System\FotMoyr.exe
  2⤵
  PID:6200
- C:\Windows\System\PVqwbDS.exe
  C:\Windows\System\PVqwbDS.exe
  2⤵
  PID:6220
- C:\Windows\System\biLHPhm.exe
  C:\Windows\System\biLHPhm.exe
  2⤵
  PID:6236
- C:\Windows\System\cIBOTPS.exe
  C:\Windows\System\cIBOTPS.exe
  2⤵
  PID:6252
- C:\Windows\System\jnuCkZj.exe
  C:\Windows\System\jnuCkZj.exe
  2⤵
  PID:6276
- C:\Windows\System\dkwysnW.exe
  C:\Windows\System\dkwysnW.exe
  2⤵
  PID:6332
- C:\Windows\System\fKHdDnc.exe
  C:\Windows\System\fKHdDnc.exe
  2⤵
  PID:6348
- C:\Windows\System\cTpHSCr.exe
  C:\Windows\System\cTpHSCr.exe
  2⤵
  PID:6376
- C:\Windows\System\FxuwTIo.exe
  C:\Windows\System\FxuwTIo.exe
  2⤵
  PID:6408
- C:\Windows\System\MkNzJsH.exe
  C:\Windows\System\MkNzJsH.exe
  2⤵
  PID:6424
- C:\Windows\System\RGOyqWG.exe
  C:\Windows\System\RGOyqWG.exe
  2⤵
  PID:6444
- C:\Windows\System\hsLXSzu.exe
  C:\Windows\System\hsLXSzu.exe
  2⤵
  PID:6460
- C:\Windows\System\PIkSakf.exe
  C:\Windows\System\PIkSakf.exe
  2⤵
  PID:6480
- C:\Windows\System\gSIZUrE.exe
  C:\Windows\System\gSIZUrE.exe
  2⤵
  PID:6496
- C:\Windows\System\gFYpNlj.exe
  C:\Windows\System\gFYpNlj.exe
  2⤵
  PID:6516
- C:\Windows\System\KvANnFw.exe
  C:\Windows\System\KvANnFw.exe
  2⤵
  PID:6532
- C:\Windows\System\WVVcUrW.exe
  C:\Windows\System\WVVcUrW.exe
  2⤵
  PID:6552
- C:\Windows\System\YEmHgoI.exe
  C:\Windows\System\YEmHgoI.exe
  2⤵
  PID:6568
- C:\Windows\System\crGFXDk.exe
  C:\Windows\System\crGFXDk.exe
  2⤵
  PID:6584
- C:\Windows\System\cELOeDP.exe
  C:\Windows\System\cELOeDP.exe
  2⤵
  PID:6604
- C:\Windows\System\WYcEWRP.exe
  C:\Windows\System\WYcEWRP.exe
  2⤵
  PID:6636
- C:\Windows\System\UWYnAcw.exe
  C:\Windows\System\UWYnAcw.exe
  2⤵
  PID:6652
- C:\Windows\System\xCfJGLX.exe
  C:\Windows\System\xCfJGLX.exe
  2⤵
  PID:6716
- C:\Windows\System\MDgOCDg.exe
  C:\Windows\System\MDgOCDg.exe
  2⤵
  PID:6732
- C:\Windows\System\IWEJPnK.exe
  C:\Windows\System\IWEJPnK.exe
  2⤵
  PID:6748
- C:\Windows\System\mCIulnK.exe
  C:\Windows\System\mCIulnK.exe
  2⤵
  PID:6764
- C:\Windows\System\WFiPOek.exe
  C:\Windows\System\WFiPOek.exe
  2⤵
  PID:6780
- C:\Windows\System\EVsVHTZ.exe
  C:\Windows\System\EVsVHTZ.exe
  2⤵
  PID:6800
- C:\Windows\System\MNSulhB.exe
  C:\Windows\System\MNSulhB.exe
  2⤵
  PID:6820
- C:\Windows\System\aWzZVgt.exe
  C:\Windows\System\aWzZVgt.exe
  2⤵
  PID:6840
- C:\Windows\System\PRHzNdE.exe
  C:\Windows\System\PRHzNdE.exe
  2⤵
  PID:6856
- C:\Windows\System\VpKqWkX.exe
  C:\Windows\System\VpKqWkX.exe
  2⤵
  PID:6900
- C:\Windows\System\YfQtpvj.exe
  C:\Windows\System\YfQtpvj.exe
  2⤵
  PID:6916
- C:\Windows\System\ifcdsUF.exe
  C:\Windows\System\ifcdsUF.exe
  2⤵
  PID:6932
- C:\Windows\System\axMdFKU.exe
  C:\Windows\System\axMdFKU.exe
  2⤵
  PID:6952
- C:\Windows\System\fZwVYOm.exe
  C:\Windows\System\fZwVYOm.exe
  2⤵
  PID:6972
- C:\Windows\System\bWEcVRd.exe
  C:\Windows\System\bWEcVRd.exe
  2⤵
  PID:6988
- C:\Windows\System\pXAqcwE.exe
  C:\Windows\System\pXAqcwE.exe
  2⤵
  PID:7004
- C:\Windows\System\ckNuCzy.exe
  C:\Windows\System\ckNuCzy.exe
  2⤵
  PID:7020
- C:\Windows\System\RbxMZwH.exe
  C:\Windows\System\RbxMZwH.exe
  2⤵
  PID:7036
- C:\Windows\System\aEpvimF.exe
  C:\Windows\System\aEpvimF.exe
  2⤵
  PID:7056
- C:\Windows\System\siraIRl.exe
  C:\Windows\System\siraIRl.exe
  2⤵
  PID:7076
- C:\Windows\System\ddAUhne.exe
  C:\Windows\System\ddAUhne.exe
  2⤵
  PID:7096
- C:\Windows\System\JueBkQX.exe
  C:\Windows\System\JueBkQX.exe
  2⤵
  PID:7112
- C:\Windows\System\PpscCmW.exe
  C:\Windows\System\PpscCmW.exe
  2⤵
  PID:7132
- C:\Windows\System\MVGMAXk.exe
  C:\Windows\System\MVGMAXk.exe
  2⤵
  PID:7148
- C:\Windows\System\AQZTeFq.exe
  C:\Windows\System\AQZTeFq.exe
  2⤵
  PID:6048
- C:\Windows\System\FsptFew.exe
  C:\Windows\System\FsptFew.exe
  2⤵
  PID:6172
- C:\Windows\System\RDRADtN.exe
  C:\Windows\System\RDRADtN.exe
  2⤵
  PID:6180
- C:\Windows\System\HpDGfeO.exe
  C:\Windows\System\HpDGfeO.exe
  2⤵
  PID:5444
- C:\Windows\System\bKMKtaB.exe
  C:\Windows\System\bKMKtaB.exe
  2⤵
  PID:6244
- C:\Windows\System\ehSSsYc.exe
  C:\Windows\System\ehSSsYc.exe
  2⤵
  PID:5792
- C:\Windows\System\HGakYLn.exe
  C:\Windows\System\HGakYLn.exe
  2⤵
  PID:5116
- C:\Windows\System\yygghrq.exe
  C:\Windows\System\yygghrq.exe
  2⤵
  PID:6160
- C:\Windows\System\zWnzLVT.exe
  C:\Windows\System\zWnzLVT.exe
  2⤵
  PID:6232
- C:\Windows\System\mMXWJTQ.exe
  C:\Windows\System\mMXWJTQ.exe
  2⤵
  PID:5244
- C:\Windows\System\CfEyVVJ.exe
  C:\Windows\System\CfEyVVJ.exe
  2⤵
  PID:4676
- C:\Windows\System\pqMqqED.exe
  C:\Windows\System\pqMqqED.exe
  2⤵
  PID:6272
- C:\Windows\System\bSuQtIz.exe
  C:\Windows\System\bSuQtIz.exe
  2⤵
  PID:6324
- C:\Windows\System\WgbJuce.exe
  C:\Windows\System\WgbJuce.exe
  2⤵
  PID:6432
- C:\Windows\System\wQzXdaB.exe
  C:\Windows\System\wQzXdaB.exe
  2⤵
  PID:6392
- C:\Windows\System\XNolZbp.exe
  C:\Windows\System\XNolZbp.exe
  2⤵
  PID:6504
- C:\Windows\System\UiguRvD.exe
  C:\Windows\System\UiguRvD.exe
  2⤵
  PID:6416
- C:\Windows\System\SWYMhoh.exe
  C:\Windows\System\SWYMhoh.exe
  2⤵
  PID:6488
- C:\Windows\System\cbjDSWO.exe
  C:\Windows\System\cbjDSWO.exe
  2⤵
  PID:6560
- C:\Windows\System\AbIzmen.exe
  C:\Windows\System\AbIzmen.exe
  2⤵
  PID:6576
- C:\Windows\System\VpxzzDd.exe
  C:\Windows\System\VpxzzDd.exe
  2⤵
  PID:6580
- C:\Windows\System\WcVdwdz.exe
  C:\Windows\System\WcVdwdz.exe
  2⤵
  PID:6624
- C:\Windows\System\MflaHER.exe
  C:\Windows\System\MflaHER.exe
  2⤵
  PID:6660
- C:\Windows\System\gABMYFs.exe
  C:\Windows\System\gABMYFs.exe
  2⤵
  PID:6664
- C:\Windows\System\NLrOhKR.exe
  C:\Windows\System\NLrOhKR.exe
  2⤵
  PID:6848
- C:\Windows\System\qHdyTyi.exe
  C:\Windows\System\qHdyTyi.exe
  2⤵
  PID:6756
- C:\Windows\System\bpyDzbC.exe
  C:\Windows\System\bpyDzbC.exe
  2⤵
  PID:6792
- C:\Windows\System\IiLXKUi.exe
  C:\Windows\System\IiLXKUi.exe
  2⤵
  PID:6832
- C:\Windows\System\bJDtFSJ.exe
  C:\Windows\System\bJDtFSJ.exe
  2⤵
  PID:6944
- C:\Windows\System\kSTyDgY.exe
  C:\Windows\System\kSTyDgY.exe
  2⤵
  PID:6980
- C:\Windows\System\nBwUgSv.exe
  C:\Windows\System\nBwUgSv.exe
  2⤵
  PID:7012
- C:\Windows\System\ASKHdfQ.exe
  C:\Windows\System\ASKHdfQ.exe
  2⤵
  PID:7092
- C:\Windows\System\qAiNfoE.exe
  C:\Windows\System\qAiNfoE.exe
  2⤵
  PID:7156
- C:\Windows\System\mQCxovq.exe
  C:\Windows\System\mQCxovq.exe
  2⤵
  PID:6880
- C:\Windows\System\Cwysoqn.exe
  C:\Windows\System\Cwysoqn.exe
  2⤵
  PID:5532
- C:\Windows\System\iLvchXG.exe
  C:\Windows\System\iLvchXG.exe
  2⤵
  PID:6196
- C:\Windows\System\wzsTcWS.exe
  C:\Windows\System\wzsTcWS.exe
  2⤵
  PID:4528
- C:\Windows\System\KbdQEXg.exe
  C:\Windows\System\KbdQEXg.exe
  2⤵
  PID:6340
- C:\Windows\System\jBOHACb.exe
  C:\Windows\System\jBOHACb.exe
  2⤵
  PID:5924
- C:\Windows\System\ZYjFalu.exe
  C:\Windows\System\ZYjFalu.exe
  2⤵
  PID:7064
- C:\Windows\System\YeTmdaX.exe
  C:\Windows\System\YeTmdaX.exe
  2⤵
  PID:6528
- C:\Windows\System\YqIEjBR.exe
  C:\Windows\System\YqIEjBR.exe
  2⤵
  PID:5172
- C:\Windows\System\FQBvUxA.exe
  C:\Windows\System\FQBvUxA.exe
  2⤵
  PID:6156
- C:\Windows\System\eJNBFBS.exe
  C:\Windows\System\eJNBFBS.exe
  2⤵
  PID:6968
- C:\Windows\System\TTUVvpj.exe
  C:\Windows\System\TTUVvpj.exe
  2⤵
  PID:7068
- C:\Windows\System\dzZiImi.exe
  C:\Windows\System\dzZiImi.exe
  2⤵
  PID:6360
- C:\Windows\System\kzstGMl.exe
  C:\Windows\System\kzstGMl.exe
  2⤵
  PID:6248
- C:\Windows\System\GJQzcoW.exe
  C:\Windows\System\GJQzcoW.exe
  2⤵
  PID:5916
- C:\Windows\System\gUfbgFo.exe
  C:\Windows\System\gUfbgFo.exe
  2⤵
  PID:6700
- C:\Windows\System\xfAxyVz.exe
  C:\Windows\System\xfAxyVz.exe
  2⤵
  PID:6292
- C:\Windows\System\ajpTqBn.exe
  C:\Windows\System\ajpTqBn.exe
  2⤵
  PID:6344
- C:\Windows\System\dcJmdXy.exe
  C:\Windows\System\dcJmdXy.exe
  2⤵
  PID:6452
- C:\Windows\System\KldXdZo.exe
  C:\Windows\System\KldXdZo.exe
  2⤵
  PID:6620
- C:\Windows\System\abNcurh.exe
  C:\Windows\System\abNcurh.exe
  2⤵
  PID:6708
- C:\Windows\System\nrXIheA.exe
  C:\Windows\System\nrXIheA.exe
  2⤵
  PID:6772
- C:\Windows\System\wVKZKhA.exe
  C:\Windows\System\wVKZKhA.exe
  2⤵
  PID:6724
- C:\Windows\System\LMQcXzC.exe
  C:\Windows\System\LMQcXzC.exe
  2⤵
  PID:7044
- C:\Windows\System\xufkpYN.exe
  C:\Windows\System\xufkpYN.exe
  2⤵
  PID:6868
- C:\Windows\System\AKxvHUp.exe
  C:\Windows\System\AKxvHUp.exe
  2⤵
  PID:6788
- C:\Windows\System\kGVGZkc.exe
  C:\Windows\System\kGVGZkc.exe
  2⤵
  PID:6872
- C:\Windows\System\TDyUGiM.exe
  C:\Windows\System\TDyUGiM.exe
  2⤵
  PID:6524
- C:\Windows\System\bctaAqN.exe
  C:\Windows\System\bctaAqN.exe
  2⤵
  PID:5456
- C:\Windows\System\AyejeZK.exe
  C:\Windows\System\AyejeZK.exe
  2⤵
  PID:6152
- C:\Windows\System\aZrckBM.exe
  C:\Windows\System\aZrckBM.exe
  2⤵
  PID:6548
- C:\Windows\System\OkLiYTw.exe
  C:\Windows\System\OkLiYTw.exe
  2⤵
  PID:7032
- C:\Windows\System\QOAZDvj.exe
  C:\Windows\System\QOAZDvj.exe
  2⤵
  PID:7140
- C:\Windows\System\rSduneh.exe
  C:\Windows\System\rSduneh.exe
  2⤵
  PID:5192
- C:\Windows\System\BHNxWCE.exe
  C:\Windows\System\BHNxWCE.exe
  2⤵
  PID:4580
- C:\Windows\System\xPuwZWo.exe
  C:\Windows\System\xPuwZWo.exe
  2⤵
  PID:6688
- C:\Windows\System\oVgtEXb.exe
  C:\Windows\System\oVgtEXb.exe
  2⤵
  PID:6644
- C:\Windows\System\IZYfrvT.exe
  C:\Windows\System\IZYfrvT.exe
  2⤵
  PID:6512
- C:\Windows\System\UCoXZvT.exe
  C:\Windows\System\UCoXZvT.exe
  2⤵
  PID:7088
- C:\Windows\System\gBhxMHe.exe
  C:\Windows\System\gBhxMHe.exe
  2⤵
  PID:6176
- C:\Windows\System\raNiNKw.exe
  C:\Windows\System\raNiNKw.exe
  2⤵
  PID:6948
- C:\Windows\System\rjiBYWR.exe
  C:\Windows\System\rjiBYWR.exe
  2⤵
  PID:6692
- C:\Windows\System\SrOkzqY.exe
  C:\Windows\System\SrOkzqY.exe
  2⤵
  PID:7120
- C:\Windows\System\tmZXDul.exe
  C:\Windows\System\tmZXDul.exe
  2⤵
  PID:6876
- C:\Windows\System\qrOljYY.exe
  C:\Windows\System\qrOljYY.exe
  2⤵
  PID:6884
- C:\Windows\System\KVjpweh.exe
  C:\Windows\System\KVjpweh.exe
  2⤵
  PID:6212
- C:\Windows\System\OojmQhK.exe
  C:\Windows\System\OojmQhK.exe
  2⤵
  PID:6808
- C:\Windows\System\wSzORlM.exe
  C:\Windows\System\wSzORlM.exe
  2⤵
  PID:6400
- C:\Windows\System\hVlHuTS.exe
  C:\Windows\System\hVlHuTS.exe
  2⤵
  PID:5900
- C:\Windows\System\tLnMvwW.exe
  C:\Windows\System\tLnMvwW.exe
  2⤵
  PID:6984
- C:\Windows\System\pwnKepn.exe
  C:\Windows\System\pwnKepn.exe
  2⤵
  PID:6320
- C:\Windows\System\ApBhGjA.exe
  C:\Windows\System\ApBhGjA.exe
  2⤵
  PID:7180
- C:\Windows\System\xBjBXsg.exe
  C:\Windows\System\xBjBXsg.exe
  2⤵
  PID:7196
- C:\Windows\System\XGIGoDF.exe
  C:\Windows\System\XGIGoDF.exe
  2⤵
  PID:7212
- C:\Windows\System\bIctoCP.exe
  C:\Windows\System\bIctoCP.exe
  2⤵
  PID:7232
- C:\Windows\System\VrjCMeN.exe
  C:\Windows\System\VrjCMeN.exe
  2⤵
  PID:7248
- C:\Windows\System\nWZwlmr.exe
  C:\Windows\System\nWZwlmr.exe
  2⤵
  PID:7264
- C:\Windows\System\KeTnhVF.exe
  C:\Windows\System\KeTnhVF.exe
  2⤵
  PID:7280
- C:\Windows\System\PiFafiH.exe
  C:\Windows\System\PiFafiH.exe
  2⤵
  PID:7296
- C:\Windows\System\OluVXcl.exe
  C:\Windows\System\OluVXcl.exe
  2⤵
  PID:7312
- C:\Windows\System\EUJCeXO.exe
  C:\Windows\System\EUJCeXO.exe
  2⤵
  PID:7328
- C:\Windows\System\SdUlsZR.exe
  C:\Windows\System\SdUlsZR.exe
  2⤵
  PID:7348
- C:\Windows\System\IuhGJik.exe
  C:\Windows\System\IuhGJik.exe
  2⤵
  PID:7364
- C:\Windows\System\PaYTiZu.exe
  C:\Windows\System\PaYTiZu.exe
  2⤵
  PID:7388
- C:\Windows\System\YLFITmq.exe
  C:\Windows\System\YLFITmq.exe
  2⤵
  PID:7404
- C:\Windows\System\DyphYdb.exe
  C:\Windows\System\DyphYdb.exe
  2⤵
  PID:7420
- C:\Windows\System\qIjFvbH.exe
  C:\Windows\System\qIjFvbH.exe
  2⤵
  PID:7436
- C:\Windows\System\SgRzQIt.exe
  C:\Windows\System\SgRzQIt.exe
  2⤵
  PID:7456
- C:\Windows\System\AuUYllN.exe
  C:\Windows\System\AuUYllN.exe
  2⤵
  PID:7488
- C:\Windows\System\gOVFMMI.exe
  C:\Windows\System\gOVFMMI.exe
  2⤵
  PID:7504
- C:\Windows\System\MfgtPBw.exe
  C:\Windows\System\MfgtPBw.exe
  2⤵
  PID:7520
- C:\Windows\System\bsMystZ.exe
  C:\Windows\System\bsMystZ.exe
  2⤵
  PID:7536
- C:\Windows\System\HzIWNYs.exe
  C:\Windows\System\HzIWNYs.exe
  2⤵
  PID:7552
- C:\Windows\System\QfsukZi.exe
  C:\Windows\System\QfsukZi.exe
  2⤵
  PID:7568
- C:\Windows\System\SsWUWlE.exe
  C:\Windows\System\SsWUWlE.exe
  2⤵
  PID:7592
- C:\Windows\System\CxJJjWr.exe
  C:\Windows\System\CxJJjWr.exe
  2⤵
  PID:7620
- C:\Windows\System\QDrBBXz.exe
  C:\Windows\System\QDrBBXz.exe
  2⤵
  PID:7672
- C:\Windows\System\TPGljpQ.exe
  C:\Windows\System\TPGljpQ.exe
  2⤵
  PID:7688
- C:\Windows\System\vMuOveb.exe
  C:\Windows\System\vMuOveb.exe
  2⤵
  PID:7704
- C:\Windows\System\AGayMeS.exe
  C:\Windows\System\AGayMeS.exe
  2⤵
  PID:7720
- C:\Windows\System\FkVvYmp.exe
  C:\Windows\System\FkVvYmp.exe
  2⤵
  PID:7736
- C:\Windows\System\RbJOrJq.exe
  C:\Windows\System\RbJOrJq.exe
  2⤵
  PID:7752
- C:\Windows\System\LwSjoCx.exe
  C:\Windows\System\LwSjoCx.exe
  2⤵
  PID:7776
- C:\Windows\System\kBoEMmD.exe
  C:\Windows\System\kBoEMmD.exe
  2⤵
  PID:7800
- C:\Windows\System\GioKPCg.exe
  C:\Windows\System\GioKPCg.exe
  2⤵
  PID:7828
- C:\Windows\System\qLycWYl.exe
  C:\Windows\System\qLycWYl.exe
  2⤵
  PID:7844
- C:\Windows\System\cwzzCFU.exe
  C:\Windows\System\cwzzCFU.exe
  2⤵
  PID:7864
- C:\Windows\System\VfWOojt.exe
  C:\Windows\System\VfWOojt.exe
  2⤵
  PID:7880
- C:\Windows\System\cFBUiMQ.exe
  C:\Windows\System\cFBUiMQ.exe
  2⤵
  PID:7896
- C:\Windows\System\MNgQjhZ.exe
  C:\Windows\System\MNgQjhZ.exe
  2⤵
  PID:7912
- C:\Windows\System\ekHpwcu.exe
  C:\Windows\System\ekHpwcu.exe
  2⤵
  PID:7928
- C:\Windows\System\jRqxBoF.exe
  C:\Windows\System\jRqxBoF.exe
  2⤵
  PID:7944
- C:\Windows\System\tSSJTro.exe
  C:\Windows\System\tSSJTro.exe
  2⤵
  PID:7960
- C:\Windows\System\dJcuUcP.exe
  C:\Windows\System\dJcuUcP.exe
  2⤵
  PID:7976
- C:\Windows\System\uhWOjxM.exe
  C:\Windows\System\uhWOjxM.exe
  2⤵
  PID:7992
- C:\Windows\System\HLJpASr.exe
  C:\Windows\System\HLJpASr.exe
  2⤵
  PID:8008
- C:\Windows\System\iDmwmwA.exe
  C:\Windows\System\iDmwmwA.exe
  2⤵
  PID:8024
- C:\Windows\System\alGnqeO.exe
  C:\Windows\System\alGnqeO.exe
  2⤵
  PID:8040
- C:\Windows\System\bLEMLCD.exe
  C:\Windows\System\bLEMLCD.exe
  2⤵
  PID:8056
- C:\Windows\System\ioOuUJW.exe
  C:\Windows\System\ioOuUJW.exe
  2⤵
  PID:8072
- C:\Windows\System\jfhtnZi.exe
  C:\Windows\System\jfhtnZi.exe
  2⤵
  PID:8088
- C:\Windows\System\nTnhwDC.exe
  C:\Windows\System\nTnhwDC.exe
  2⤵
  PID:8108
- C:\Windows\System\cbOEbmb.exe
  C:\Windows\System\cbOEbmb.exe
  2⤵
  PID:8124
- C:\Windows\System\YvwferT.exe
  C:\Windows\System\YvwferT.exe
  2⤵
  PID:8140
- C:\Windows\System\Yffmyty.exe
  C:\Windows\System\Yffmyty.exe
  2⤵
  PID:8156
- C:\Windows\System\ukzuBWe.exe
  C:\Windows\System\ukzuBWe.exe
  2⤵
  PID:8172
- C:\Windows\System\hvTXFjT.exe
  C:\Windows\System\hvTXFjT.exe
  2⤵
  PID:8188
- C:\Windows\System\LHjwByK.exe
  C:\Windows\System\LHjwByK.exe
  2⤵
  PID:7028
- C:\Windows\System\bOAuvjZ.exe
  C:\Windows\System\bOAuvjZ.exe
  2⤵
  PID:7228
- C:\Windows\System\jZDqcHv.exe
  C:\Windows\System\jZDqcHv.exe
  2⤵
  PID:7292
- C:\Windows\System\xIdESYH.exe
  C:\Windows\System\xIdESYH.exe
  2⤵
  PID:6744
- C:\Windows\System\EdLZuor.exe
  C:\Windows\System\EdLZuor.exe
  2⤵
  PID:7208
- C:\Windows\System\IQTFQyU.exe
  C:\Windows\System\IQTFQyU.exe
  2⤵
  PID:7272
- C:\Windows\System\HDGWTOd.exe
  C:\Windows\System\HDGWTOd.exe
  2⤵
  PID:7336
- C:\Windows\System\dzVRjch.exe
  C:\Windows\System\dzVRjch.exe
  2⤵
  PID:7360
- C:\Windows\System\VpDEtaM.exe
  C:\Windows\System\VpDEtaM.exe
  2⤵
  PID:7428
- C:\Windows\System\eDsPOPR.exe
  C:\Windows\System\eDsPOPR.exe
  2⤵
  PID:7444
- C:\Windows\System\ifQVtcs.exe
  C:\Windows\System\ifQVtcs.exe
  2⤵
  PID:7480
- C:\Windows\System\jJGPiCJ.exe
  C:\Windows\System\jJGPiCJ.exe
  2⤵
  PID:7532
- C:\Windows\System\VloiMDO.exe
  C:\Windows\System\VloiMDO.exe
  2⤵
  PID:7544
- C:\Windows\System\TjGJgix.exe
  C:\Windows\System\TjGJgix.exe
  2⤵
  PID:7600
- C:\Windows\System\WHzJXRP.exe
  C:\Windows\System\WHzJXRP.exe
  2⤵
  PID:7612
- C:\Windows\System\daYKWjG.exe
  C:\Windows\System\daYKWjG.exe
  2⤵
  PID:7636
- C:\Windows\System\GevrdaF.exe
  C:\Windows\System\GevrdaF.exe
  2⤵
  PID:7652
- C:\Windows\System\mfZQVZV.exe
  C:\Windows\System\mfZQVZV.exe
  2⤵
  PID:7660
- C:\Windows\System\FjcSwBa.exe
  C:\Windows\System\FjcSwBa.exe
  2⤵
  PID:7580
- C:\Windows\System\mDXSYLo.exe
  C:\Windows\System\mDXSYLo.exe
  2⤵
  PID:7784
- C:\Windows\System\ovOKCuP.exe
  C:\Windows\System\ovOKCuP.exe
  2⤵
  PID:7796
- C:\Windows\System\alnfqdh.exe
  C:\Windows\System\alnfqdh.exe
  2⤵
  PID:7760
- C:\Windows\System\ZaOozKk.exe
  C:\Windows\System\ZaOozKk.exe
  2⤵
  PID:7716
- C:\Windows\System\qYsCqsp.exe
  C:\Windows\System\qYsCqsp.exe
  2⤵
  PID:7856
- C:\Windows\System\UWYtjcb.exe
  C:\Windows\System\UWYtjcb.exe
  2⤵
  PID:7892
- C:\Windows\System\ghiVSbu.exe
  C:\Windows\System\ghiVSbu.exe
  2⤵
  PID:7876
- C:\Windows\System\fJHjBfE.exe
  C:\Windows\System\fJHjBfE.exe
  2⤵
  PID:7920
- C:\Windows\System\AqXzrff.exe
  C:\Windows\System\AqXzrff.exe
  2⤵
  PID:8052
- C:\Windows\System\AxotldZ.exe
  C:\Windows\System\AxotldZ.exe
  2⤵
  PID:7956
- C:\Windows\System\uHBkRoC.exe
  C:\Windows\System\uHBkRoC.exe
  2⤵
  PID:7936
- C:\Windows\System\DzOgkgQ.exe
  C:\Windows\System\DzOgkgQ.exe
  2⤵
  PID:8032
- C:\Windows\System\uhAmcFx.exe
  C:\Windows\System\uhAmcFx.exe
  2⤵
  PID:8036
- C:\Windows\System\ZcgbGmH.exe
  C:\Windows\System\ZcgbGmH.exe
  2⤵
  PID:8120
- C:\Windows\System\LuwlkjV.exe
  C:\Windows\System\LuwlkjV.exe
  2⤵
  PID:8184
- C:\Windows\System\ZekwORN.exe
  C:\Windows\System\ZekwORN.exe
  2⤵
  PID:8164
- C:\Windows\System\REnPhbJ.exe
  C:\Windows\System\REnPhbJ.exe
  2⤵
  PID:6288
- C:\Windows\System\bydKyfS.exe
  C:\Windows\System\bydKyfS.exe
  2⤵
  PID:7324
- C:\Windows\System\DoPRnXQ.exe
  C:\Windows\System\DoPRnXQ.exe
  2⤵
  PID:7176
- C:\Windows\System\trGsyrS.exe
  C:\Windows\System\trGsyrS.exe
  2⤵
  PID:7240
- C:\Windows\System\xGivjii.exe
  C:\Windows\System\xGivjii.exe
  2⤵
  PID:7412
- C:\Windows\System\DCBJROL.exe
  C:\Windows\System\DCBJROL.exe
  2⤵
  PID:7468
- C:\Windows\System\qOGoPUP.exe
  C:\Windows\System\qOGoPUP.exe
  2⤵
  PID:7604
- C:\Windows\System\YyeLhHh.exe
  C:\Windows\System\YyeLhHh.exe
  2⤵
  PID:7528
- C:\Windows\System\pDVSKMh.exe
  C:\Windows\System\pDVSKMh.exe
  2⤵
  PID:7548
- C:\Windows\System\mZBczIp.exe
  C:\Windows\System\mZBczIp.exe
  2⤵
  PID:7684
- C:\Windows\System\mNvQAhK.exe
  C:\Windows\System\mNvQAhK.exe
  2⤵
  PID:7820
- C:\Windows\System\EgdXuZq.exe
  C:\Windows\System\EgdXuZq.exe
  2⤵
  PID:8016
- C:\Windows\System\MxCAbAC.exe
  C:\Windows\System\MxCAbAC.exe
  2⤵
  PID:7732
- C:\Windows\System\MsgoUZX.exe
  C:\Windows\System\MsgoUZX.exe
  2⤵
  PID:7744
- C:\Windows\System\BJeOxiK.exe
  C:\Windows\System\BJeOxiK.exe
  2⤵
  PID:6740
- C:\Windows\System\hjOdAgK.exe
  C:\Windows\System\hjOdAgK.exe
  2⤵
  PID:7968
- C:\Windows\System\OyjtecE.exe
  C:\Windows\System\OyjtecE.exe
  2⤵
  PID:7952
- C:\Windows\System\XpIzBNt.exe
  C:\Windows\System\XpIzBNt.exe
  2⤵
  PID:8136
- C:\Windows\System\vStbXSf.exe
  C:\Windows\System\vStbXSf.exe
  2⤵
  PID:7356
- C:\Windows\System\HFaUJwr.exe
  C:\Windows\System\HFaUJwr.exe
  2⤵
  PID:7632
- C:\Windows\System\IXTepDZ.exe
  C:\Windows\System\IXTepDZ.exe
  2⤵
  PID:7452
- C:\Windows\System\jmHjDzh.exe
  C:\Windows\System\jmHjDzh.exe
  2⤵
  PID:7416
- C:\Windows\System\rVoMJyJ.exe
  C:\Windows\System\rVoMJyJ.exe
  2⤵
  PID:7700
- C:\Windows\System\rbBHlUz.exe
  C:\Windows\System\rbBHlUz.exe
  2⤵
  PID:7988
- C:\Windows\System\cQeKNXw.exe
  C:\Windows\System\cQeKNXw.exe
  2⤵
  PID:8000
- C:\Windows\System\LPSoZPL.exe
  C:\Windows\System\LPSoZPL.exe
  2⤵
  PID:7288
- C:\Windows\System\ACldsta.exe
  C:\Windows\System\ACldsta.exe
  2⤵
  PID:7888
- C:\Windows\System\yuBoPom.exe
  C:\Windows\System\yuBoPom.exe
  2⤵
  PID:7516
- C:\Windows\System\kVIhblx.exe
  C:\Windows\System\kVIhblx.exe
  2⤵
  PID:8152
- C:\Windows\System\MkXKmus.exe
  C:\Windows\System\MkXKmus.exe
  2⤵
  PID:7308
- C:\Windows\System\JTMtaEe.exe
  C:\Windows\System\JTMtaEe.exe
  2⤵
  PID:8180
- C:\Windows\System\yXnOucf.exe
  C:\Windows\System\yXnOucf.exe
  2⤵
  PID:7496
- C:\Windows\System\yQEsjfw.exe
  C:\Windows\System\yQEsjfw.exe
  2⤵
  PID:8208
- C:\Windows\System\urCkIrB.exe
  C:\Windows\System\urCkIrB.exe
  2⤵
  PID:8224
- C:\Windows\System\qBJSUCl.exe
  C:\Windows\System\qBJSUCl.exe
  2⤵
  PID:8240
- C:\Windows\System\FgqnSGF.exe
  C:\Windows\System\FgqnSGF.exe
  2⤵
  PID:8256
- C:\Windows\System\PhsztEt.exe
  C:\Windows\System\PhsztEt.exe
  2⤵
  PID:8272
- C:\Windows\System\GaLQazo.exe
  C:\Windows\System\GaLQazo.exe
  2⤵
  PID:8288
- C:\Windows\System\LRGassO.exe
  C:\Windows\System\LRGassO.exe
  2⤵
  PID:8304
- C:\Windows\System\UnvgAJc.exe
  C:\Windows\System\UnvgAJc.exe
  2⤵
  PID:8320
- C:\Windows\System\JDFDTQQ.exe
  C:\Windows\System\JDFDTQQ.exe
  2⤵
  PID:8336
- C:\Windows\System\gOZFWYe.exe
  C:\Windows\System\gOZFWYe.exe
  2⤵
  PID:8356
- C:\Windows\System\DDqHdDO.exe
  C:\Windows\System\DDqHdDO.exe
  2⤵
  PID:8372
- C:\Windows\System\nxlxkQZ.exe
  C:\Windows\System\nxlxkQZ.exe
  2⤵
  PID:8388
- C:\Windows\System\PQeMGir.exe
  C:\Windows\System\PQeMGir.exe
  2⤵
  PID:8404
- C:\Windows\System\okqbBFN.exe
  C:\Windows\System\okqbBFN.exe
  2⤵
  PID:8424
- C:\Windows\System\QiUnfSr.exe
  C:\Windows\System\QiUnfSr.exe
  2⤵
  PID:8440
- C:\Windows\System\SAkLmlc.exe
  C:\Windows\System\SAkLmlc.exe
  2⤵
  PID:8456
- C:\Windows\System\pMgIyXV.exe
  C:\Windows\System\pMgIyXV.exe
  2⤵
  PID:8472
- C:\Windows\System\nSRMDTW.exe
  C:\Windows\System\nSRMDTW.exe
  2⤵
  PID:8488
- C:\Windows\System\yuGaLNd.exe
  C:\Windows\System\yuGaLNd.exe
  2⤵
  PID:8504
- C:\Windows\System\wulwZhV.exe
  C:\Windows\System\wulwZhV.exe
  2⤵
  PID:8520
- C:\Windows\System\sbBSrRK.exe
  C:\Windows\System\sbBSrRK.exe
  2⤵
  PID:8536
- C:\Windows\System\QskwZXe.exe
  C:\Windows\System\QskwZXe.exe
  2⤵
  PID:8552
- C:\Windows\System\pBCQNeH.exe
  C:\Windows\System\pBCQNeH.exe
  2⤵
  PID:8568
- C:\Windows\System\ieuJfqO.exe
  C:\Windows\System\ieuJfqO.exe
  2⤵
  PID:8584
- C:\Windows\System\BOUKuDt.exe
  C:\Windows\System\BOUKuDt.exe
  2⤵
  PID:8600
- C:\Windows\System\FoNVCJH.exe
  C:\Windows\System\FoNVCJH.exe
  2⤵
  PID:8616
- C:\Windows\System\rGZJqIB.exe
  C:\Windows\System\rGZJqIB.exe
  2⤵
  PID:8632
- C:\Windows\System\DDJDamT.exe
  C:\Windows\System\DDJDamT.exe
  2⤵
  PID:8648
- C:\Windows\System\gMNYLls.exe
  C:\Windows\System\gMNYLls.exe
  2⤵
  PID:8664
- C:\Windows\System\ungKMJr.exe
  C:\Windows\System\ungKMJr.exe
  2⤵
  PID:8680
- C:\Windows\System\MHfPDFu.exe
  C:\Windows\System\MHfPDFu.exe
  2⤵
  PID:8696
- C:\Windows\System\iozKKTg.exe
  C:\Windows\System\iozKKTg.exe
  2⤵
  PID:8712
- C:\Windows\System\khFqKjG.exe
  C:\Windows\System\khFqKjG.exe
  2⤵
  PID:8736
- C:\Windows\System\xwJFkEo.exe
  C:\Windows\System\xwJFkEo.exe
  2⤵
  PID:8756
- C:\Windows\System\QOgCvlS.exe
  C:\Windows\System\QOgCvlS.exe
  2⤵
  PID:8772
- C:\Windows\System\DZirxpK.exe
  C:\Windows\System\DZirxpK.exe
  2⤵
  PID:8788
- C:\Windows\System\pYvXIHF.exe
  C:\Windows\System\pYvXIHF.exe
  2⤵
  PID:8804
- C:\Windows\System\XLJlWYi.exe
  C:\Windows\System\XLJlWYi.exe
  2⤵
  PID:8820
- C:\Windows\System\oSFhrUi.exe
  C:\Windows\System\oSFhrUi.exe
  2⤵
  PID:8836
- C:\Windows\System\eDtlsWy.exe
  C:\Windows\System\eDtlsWy.exe
  2⤵
  PID:8852
- C:\Windows\System\rTSCVFJ.exe
  C:\Windows\System\rTSCVFJ.exe
  2⤵
  PID:8868
- C:\Windows\System\iNgVTKM.exe
  C:\Windows\System\iNgVTKM.exe
  2⤵
  PID:8884
- C:\Windows\System\jVqvruK.exe
  C:\Windows\System\jVqvruK.exe
  2⤵
  PID:8900
- C:\Windows\System\KsAPdDO.exe
  C:\Windows\System\KsAPdDO.exe
  2⤵
  PID:8916
- C:\Windows\System\xgoLYdB.exe
  C:\Windows\System\xgoLYdB.exe
  2⤵
  PID:8932
- C:\Windows\System\qsdwrkt.exe
  C:\Windows\System\qsdwrkt.exe
  2⤵
  PID:8948
- C:\Windows\System\yNPIDUh.exe
  C:\Windows\System\yNPIDUh.exe
  2⤵
  PID:8964
- C:\Windows\System\kPBbUFE.exe
  C:\Windows\System\kPBbUFE.exe
  2⤵
  PID:8980
- C:\Windows\System\YAiaUJd.exe
  C:\Windows\System\YAiaUJd.exe
  2⤵
  PID:8996
- C:\Windows\System\qpmhORR.exe
  C:\Windows\System\qpmhORR.exe
  2⤵
  PID:9012
- C:\Windows\System\LsjpYAV.exe
  C:\Windows\System\LsjpYAV.exe
  2⤵
  PID:9028
- C:\Windows\System\dBUEWpf.exe
  C:\Windows\System\dBUEWpf.exe
  2⤵
  PID:9044
- C:\Windows\System\NdqMwxp.exe
  C:\Windows\System\NdqMwxp.exe
  2⤵
  PID:9060
- C:\Windows\System\FQbMFjb.exe
  C:\Windows\System\FQbMFjb.exe
  2⤵
  PID:9076
- C:\Windows\System\cThniZM.exe
  C:\Windows\System\cThniZM.exe
  2⤵
  PID:9092
- C:\Windows\System\pWMFYpq.exe
  C:\Windows\System\pWMFYpq.exe
  2⤵
  PID:9108
- C:\Windows\System\eqMKqHE.exe
  C:\Windows\System\eqMKqHE.exe
  2⤵
  PID:9124
- C:\Windows\System\pqRhlcs.exe
  C:\Windows\System\pqRhlcs.exe
  2⤵
  PID:9140
- C:\Windows\System\TcksLKp.exe
  C:\Windows\System\TcksLKp.exe
  2⤵
  PID:9156
- C:\Windows\System\HwKQLJX.exe
  C:\Windows\System\HwKQLJX.exe
  2⤵
  PID:9172
- C:\Windows\System\CqqifAZ.exe
  C:\Windows\System\CqqifAZ.exe
  2⤵
  PID:9188
- C:\Windows\System\paluCfu.exe
  C:\Windows\System\paluCfu.exe
  2⤵
  PID:9204
- C:\Windows\System\AUayIjs.exe
  C:\Windows\System\AUayIjs.exe
  2⤵
  PID:7840
- C:\Windows\System\FEDHkSh.exe
  C:\Windows\System\FEDHkSh.exe
  2⤵
  PID:8216
- C:\Windows\System\gRetkQq.exe
  C:\Windows\System\gRetkQq.exe
  2⤵
  PID:8236
- C:\Windows\System\knWnHbg.exe
  C:\Windows\System\knWnHbg.exe
  2⤵
  PID:6940
- C:\Windows\System\LgawFmM.exe
  C:\Windows\System\LgawFmM.exe
  2⤵
  PID:8252
- C:\Windows\System\VCdgwgJ.exe
  C:\Windows\System\VCdgwgJ.exe
  2⤵
  PID:8312
- C:\Windows\System\RunVgJY.exe
  C:\Windows\System\RunVgJY.exe
  2⤵
  PID:8328
- C:\Windows\System\RwuDrHj.exe
  C:\Windows\System\RwuDrHj.exe
  2⤵
  PID:8400
- C:\Windows\System\yXqQlAH.exe
  C:\Windows\System\yXqQlAH.exe
  2⤵
  PID:8348
- C:\Windows\System\xiXvIiL.exe
  C:\Windows\System\xiXvIiL.exe
  2⤵
  PID:8412
- C:\Windows\System\clrMkES.exe
  C:\Windows\System\clrMkES.exe
  2⤵
  PID:8452
- C:\Windows\System\ytisoaU.exe
  C:\Windows\System\ytisoaU.exe
  2⤵
  PID:8500
- C:\Windows\System\OWnYaNZ.exe
  C:\Windows\System\OWnYaNZ.exe
  2⤵
  PID:8480
- C:\Windows\System\KndyIqg.exe
  C:\Windows\System\KndyIqg.exe
  2⤵
  PID:8592
- C:\Windows\System\EItHMNC.exe
  C:\Windows\System\EItHMNC.exe
  2⤵
  PID:8576
- C:\Windows\System\KmbcZMh.exe
  C:\Windows\System\KmbcZMh.exe
  2⤵
  PID:8612
- C:\Windows\System\TCgBsNG.exe
  C:\Windows\System\TCgBsNG.exe
  2⤵
  PID:8656
- C:\Windows\System\rcYLtWh.exe
  C:\Windows\System\rcYLtWh.exe
  2⤵
  PID:8688
- C:\Windows\System\Fyuwvip.exe
  C:\Windows\System\Fyuwvip.exe
  2⤵
  PID:8728
- C:\Windows\System\ernaWBu.exe
  C:\Windows\System\ernaWBu.exe
  2⤵
  PID:8704
- C:\Windows\System\eZdcRaj.exe
  C:\Windows\System\eZdcRaj.exe
  2⤵
  PID:8812
- C:\Windows\System\MbCuSrO.exe
  C:\Windows\System\MbCuSrO.exe
  2⤵
  PID:8844
- C:\Windows\System\iYqRIXp.exe
  C:\Windows\System\iYqRIXp.exe
  2⤵
  PID:8908
- C:\Windows\System\ZXvoWBF.exe
  C:\Windows\System\ZXvoWBF.exe
  2⤵
  PID:8940
- C:\Windows\System\maMtEFs.exe
  C:\Windows\System\maMtEFs.exe
  2⤵
  PID:8944
- C:\Windows\System\jHsCfSm.exe
  C:\Windows\System\jHsCfSm.exe
  2⤵
  PID:9020
- C:\Windows\System\LePSYbk.exe
  C:\Windows\System\LePSYbk.exe
  2⤵
  PID:9004
- C:\Windows\System\ZXmjZaI.exe
  C:\Windows\System\ZXmjZaI.exe
  2⤵
  PID:9040
- C:\Windows\System\TIOOAtW.exe
  C:\Windows\System\TIOOAtW.exe
  2⤵
  PID:9120
- C:\Windows\System\BnrfAGq.exe
  C:\Windows\System\BnrfAGq.exe
  2⤵
  PID:9072
- C:\Windows\System\dDTZHbk.exe
  C:\Windows\System\dDTZHbk.exe
  2⤵
  PID:9100
- C:\Windows\System\UsfaSaT.exe
  C:\Windows\System\UsfaSaT.exe
  2⤵
  PID:9164
- C:\Windows\System\mYYjBec.exe
  C:\Windows\System\mYYjBec.exe
  2⤵
  PID:8200
- C:\Windows\System\HABkHdJ.exe
  C:\Windows\System\HABkHdJ.exe
  2⤵
  PID:7648
- C:\Windows\System\ZGGqmVL.exe
  C:\Windows\System\ZGGqmVL.exe
  2⤵
  PID:8296
- C:\Windows\System\HCgrwTo.exe
  C:\Windows\System\HCgrwTo.exe
  2⤵
  PID:8368
- C:\Windows\System\RfCbkkW.exe
  C:\Windows\System\RfCbkkW.exe
  2⤵
  PID:8380
- C:\Windows\System\RfXTXEy.exe
  C:\Windows\System\RfXTXEy.exe
  2⤵
  PID:8532
- C:\Windows\System\FokvGsm.exe
  C:\Windows\System\FokvGsm.exe
  2⤵
  PID:8624
- C:\Windows\System\kNOObaG.exe
  C:\Windows\System\kNOObaG.exe
  2⤵
  PID:8464
- C:\Windows\System\QjyDxDF.exe
  C:\Windows\System\QjyDxDF.exe
  2⤵
  PID:8608
- C:\Windows\System\ujpUxWK.exe
  C:\Windows\System\ujpUxWK.exe
  2⤵
  PID:8724
- C:\Windows\System\rMVgodG.exe
  C:\Windows\System\rMVgodG.exe
  2⤵
  PID:8796
- C:\Windows\System\mYDKoUJ.exe
  C:\Windows\System\mYDKoUJ.exe
  2⤵
  PID:8892
- C:\Windows\System\XjImzEE.exe
  C:\Windows\System\XjImzEE.exe
  2⤵
  PID:8896
- C:\Windows\System\ZpNFGAL.exe
  C:\Windows\System\ZpNFGAL.exe
  2⤵
  PID:8960
- C:\Windows\System\ymLhRGF.exe
  C:\Windows\System\ymLhRGF.exe
  2⤵
  PID:8988
- C:\Windows\System\hQXSEST.exe
  C:\Windows\System\hQXSEST.exe
  2⤵
  PID:9084
- C:\Windows\System\kVroHBL.exe
  C:\Windows\System\kVroHBL.exe
  2⤵
  PID:8280
- C:\Windows\System\OmzVFeL.exe
  C:\Windows\System\OmzVFeL.exe
  2⤵
  PID:9068
- C:\Windows\System\KvrFUNB.exe
  C:\Windows\System\KvrFUNB.exe
  2⤵
  PID:8220
- C:\Windows\System\AAtaFhP.exe
  C:\Windows\System\AAtaFhP.exe
  2⤵
  PID:8396
- C:\Windows\System\rcavCfJ.exe
  C:\Windows\System\rcavCfJ.exe
  2⤵
  PID:8448
- C:\Windows\System\vTNEDZs.exe
  C:\Windows\System\vTNEDZs.exe
  2⤵
  PID:8512
- C:\Windows\System\IlpeAfe.exe
  C:\Windows\System\IlpeAfe.exe
  2⤵
  PID:8764
- C:\Windows\System\wIxQmCq.exe
  C:\Windows\System\wIxQmCq.exe
  2⤵
  PID:8864
- C:\Windows\System\HGcRyWk.exe
  C:\Windows\System\HGcRyWk.exe
  2⤵
  PID:8096
- C:\Windows\System\SgnOknX.exe
  C:\Windows\System\SgnOknX.exe
  2⤵
  PID:9036
- C:\Windows\System\gBBbquZ.exe
  C:\Windows\System\gBBbquZ.exe
  2⤵
  PID:9212
- C:\Windows\System\jbMeWFL.exe
  C:\Windows\System\jbMeWFL.exe
  2⤵
  PID:8316
- C:\Windows\System\tJibLHy.exe
  C:\Windows\System\tJibLHy.exe
  2⤵
  PID:8976
- C:\Windows\System\ljQhypE.exe
  C:\Windows\System\ljQhypE.exe
  2⤵
  PID:8516
- C:\Windows\System\TGQLMQr.exe
  C:\Windows\System\TGQLMQr.exe
  2⤵
  PID:8580
- C:\Windows\System\XMxnlgQ.exe
  C:\Windows\System\XMxnlgQ.exe
  2⤵
  PID:9220
- C:\Windows\System\sVWJVpy.exe
  C:\Windows\System\sVWJVpy.exe
  2⤵
  PID:9236
- C:\Windows\System\jMInscZ.exe
  C:\Windows\System\jMInscZ.exe
  2⤵
  PID:9252
- C:\Windows\System\DfuIfTv.exe
  C:\Windows\System\DfuIfTv.exe
  2⤵
  PID:9268
- C:\Windows\System\BdNZnQF.exe
  C:\Windows\System\BdNZnQF.exe
  2⤵
  PID:9284
- C:\Windows\System\vuElibZ.exe
  C:\Windows\System\vuElibZ.exe
  2⤵
  PID:9300
- C:\Windows\System\SoFwOpt.exe
  C:\Windows\System\SoFwOpt.exe
  2⤵
  PID:9316
- C:\Windows\System\TFiGBak.exe
  C:\Windows\System\TFiGBak.exe
  2⤵
  PID:9332
- C:\Windows\System\JHqrCVX.exe
  C:\Windows\System\JHqrCVX.exe
  2⤵
  PID:9352
- C:\Windows\System\KrNixmJ.exe
  C:\Windows\System\KrNixmJ.exe
  2⤵
  PID:9368
- C:\Windows\System\VvrNdZc.exe
  C:\Windows\System\VvrNdZc.exe
  2⤵
  PID:9384
- C:\Windows\System\cgjHUTx.exe
  C:\Windows\System\cgjHUTx.exe
  2⤵
  PID:9400
- C:\Windows\System\fwXXssQ.exe
  C:\Windows\System\fwXXssQ.exe
  2⤵
  PID:9416
- C:\Windows\System\HnLUtEG.exe
  C:\Windows\System\HnLUtEG.exe
  2⤵
  PID:9432
- C:\Windows\System\NiIpHeT.exe
  C:\Windows\System\NiIpHeT.exe
  2⤵
  PID:9448
- C:\Windows\System\nIAduNA.exe
  C:\Windows\System\nIAduNA.exe
  2⤵
  PID:9464
- C:\Windows\System\KITrspx.exe
  C:\Windows\System\KITrspx.exe
  2⤵
  PID:9480
- C:\Windows\System\UzLnsrJ.exe
  C:\Windows\System\UzLnsrJ.exe
  2⤵
  PID:9496
- C:\Windows\System\malDJcw.exe
  C:\Windows\System\malDJcw.exe
  2⤵
  PID:9512
- C:\Windows\System\HdqtUXq.exe
  C:\Windows\System\HdqtUXq.exe
  2⤵
  PID:9528
- C:\Windows\System\cLuDBop.exe
  C:\Windows\System\cLuDBop.exe
  2⤵
  PID:9544
- C:\Windows\System\dPwKYHg.exe
  C:\Windows\System\dPwKYHg.exe
  2⤵
  PID:9560
- C:\Windows\System\WsFiOIP.exe
  C:\Windows\System\WsFiOIP.exe
  2⤵
  PID:9576
- C:\Windows\System\zYjpjCK.exe
  C:\Windows\System\zYjpjCK.exe
  2⤵
  PID:9592
- C:\Windows\System\DaIvjZE.exe
  C:\Windows\System\DaIvjZE.exe
  2⤵
  PID:9608
- C:\Windows\System\SssfKqe.exe
  C:\Windows\System\SssfKqe.exe
  2⤵
  PID:9624
- C:\Windows\System\sWrMLSB.exe
  C:\Windows\System\sWrMLSB.exe
  2⤵
  PID:9640
- C:\Windows\System\yzVlCID.exe
  C:\Windows\System\yzVlCID.exe
  2⤵
  PID:9656
- C:\Windows\System\bcTKlQq.exe
  C:\Windows\System\bcTKlQq.exe
  2⤵
  PID:9672
- C:\Windows\System\nfSzXjS.exe
  C:\Windows\System\nfSzXjS.exe
  2⤵
  PID:9688
- C:\Windows\System\gAylJxd.exe
  C:\Windows\System\gAylJxd.exe
  2⤵
  PID:9704
- C:\Windows\System\mshGpEn.exe
  C:\Windows\System\mshGpEn.exe
  2⤵
  PID:9724
- C:\Windows\System\XEwNCCD.exe
  C:\Windows\System\XEwNCCD.exe
  2⤵
  PID:9740
- C:\Windows\System\cazwSaV.exe
  C:\Windows\System\cazwSaV.exe
  2⤵
  PID:9756
- C:\Windows\System\CzMCGIF.exe
  C:\Windows\System\CzMCGIF.exe
  2⤵
  PID:9772
- C:\Windows\System\ScVTVmx.exe
  C:\Windows\System\ScVTVmx.exe
  2⤵
  PID:9788
- C:\Windows\System\fxMuZKH.exe
  C:\Windows\System\fxMuZKH.exe
  2⤵
  PID:9804
- C:\Windows\System\QfYsHsF.exe
  C:\Windows\System\QfYsHsF.exe
  2⤵
  PID:9820
- C:\Windows\System\BxbBkHK.exe
  C:\Windows\System\BxbBkHK.exe
  2⤵
  PID:9836
- C:\Windows\System\nGRmVVW.exe
  C:\Windows\System\nGRmVVW.exe
  2⤵
  PID:9852
- C:\Windows\System\WoyRCGS.exe
  C:\Windows\System\WoyRCGS.exe
  2⤵
  PID:9868
- C:\Windows\System\IFSKbZl.exe
  C:\Windows\System\IFSKbZl.exe
  2⤵
  PID:9884
- C:\Windows\System\OuZiSXE.exe
  C:\Windows\System\OuZiSXE.exe
  2⤵
  PID:9900
- C:\Windows\System\nxeQlXn.exe
  C:\Windows\System\nxeQlXn.exe
  2⤵
  PID:9916
- C:\Windows\System\dByaXbw.exe
  C:\Windows\System\dByaXbw.exe
  2⤵
  PID:9932
- C:\Windows\System\ynHwcPw.exe
  C:\Windows\System\ynHwcPw.exe
  2⤵
  PID:9948
- C:\Windows\System\dnUJvEk.exe
  C:\Windows\System\dnUJvEk.exe
  2⤵
  PID:9964
- C:\Windows\System\dymbIgr.exe
  C:\Windows\System\dymbIgr.exe
  2⤵
  PID:9980
- C:\Windows\System\VJwykmR.exe
  C:\Windows\System\VJwykmR.exe
  2⤵
  PID:9996
- C:\Windows\System\beASXIi.exe
  C:\Windows\System\beASXIi.exe
  2⤵
  PID:10012
- C:\Windows\System\jwWbkEZ.exe
  C:\Windows\System\jwWbkEZ.exe
  2⤵
  PID:10028
- C:\Windows\System\GiHdowy.exe
  C:\Windows\System\GiHdowy.exe
  2⤵
  PID:10044
- C:\Windows\System\VaUsSyz.exe
  C:\Windows\System\VaUsSyz.exe
  2⤵
  PID:10060
- C:\Windows\System\ZAdpOqG.exe
  C:\Windows\System\ZAdpOqG.exe
  2⤵
  PID:10076
- C:\Windows\System\LMfPrPt.exe
  C:\Windows\System\LMfPrPt.exe
  2⤵
  PID:10092
- C:\Windows\System\uYAXxaa.exe
  C:\Windows\System\uYAXxaa.exe
  2⤵
  PID:10108
- C:\Windows\System\BLRFCvV.exe
  C:\Windows\System\BLRFCvV.exe
  2⤵
  PID:10124
- C:\Windows\System\SSlYiHn.exe
  C:\Windows\System\SSlYiHn.exe
  2⤵
  PID:10140
- C:\Windows\System\aIZvZGb.exe
  C:\Windows\System\aIZvZGb.exe
  2⤵
  PID:10156
- C:\Windows\System\sEzDNDS.exe
  C:\Windows\System\sEzDNDS.exe
  2⤵
  PID:10192
- C:\Windows\System\jvDvJTl.exe
  C:\Windows\System\jvDvJTl.exe
  2⤵
  PID:10224
- C:\Windows\System\ugRpNVs.exe
  C:\Windows\System\ugRpNVs.exe
  2⤵
  PID:8752
- C:\Windows\System\ZnRAMLM.exe
  C:\Windows\System\ZnRAMLM.exe
  2⤵
  PID:9136
- C:\Windows\System\fcqIeoz.exe
  C:\Windows\System\fcqIeoz.exe
  2⤵
  PID:9232
- C:\Windows\System\vkHHTHP.exe
  C:\Windows\System\vkHHTHP.exe
  2⤵
  PID:9292
- C:\Windows\System\eXsZWGn.exe
  C:\Windows\System\eXsZWGn.exe
  2⤵
  PID:9328
- C:\Windows\System\UGBqNPf.exe
  C:\Windows\System\UGBqNPf.exe
  2⤵
  PID:9376
- C:\Windows\System\PNAYKeR.exe
  C:\Windows\System\PNAYKeR.exe
  2⤵
  PID:9524
- C:\Windows\System\xCVXwpN.exe
  C:\Windows\System\xCVXwpN.exe
  2⤵
  PID:9536
- C:\Windows\System\yXuVtFZ.exe
  C:\Windows\System\yXuVtFZ.exe
  2⤵
  PID:9632
- C:\Windows\System\lfItGdt.exe
  C:\Windows\System\lfItGdt.exe
  2⤵
  PID:9680
- C:\Windows\System\jbpHaYf.exe
  C:\Windows\System\jbpHaYf.exe
  2⤵
  PID:9664
- C:\Windows\System\NxRIdCn.exe
  C:\Windows\System\NxRIdCn.exe
  2⤵
  PID:9668
- C:\Windows\System\DXSncLy.exe
  C:\Windows\System\DXSncLy.exe
  2⤵
  PID:9764
- C:\Windows\System\wTTnDwC.exe
  C:\Windows\System\wTTnDwC.exe
  2⤵
  PID:9812
- C:\Windows\System\xXRvDJw.exe
  C:\Windows\System\xXRvDJw.exe
  2⤵
  PID:9860
- C:\Windows\System\DgIJVvK.exe
  C:\Windows\System\DgIJVvK.exe
  2⤵
  PID:9848
- C:\Windows\System\EnAZNTq.exe
  C:\Windows\System\EnAZNTq.exe
  2⤵
  PID:9908
- C:\Windows\System\aCIxxlK.exe
  C:\Windows\System\aCIxxlK.exe
  2⤵
  PID:9892
- C:\Windows\System\qWTnRVP.exe
  C:\Windows\System\qWTnRVP.exe
  2⤵
  PID:9988
- C:\Windows\System\KcBHpJx.exe
  C:\Windows\System\KcBHpJx.exe
  2⤵
  PID:9976
- C:\Windows\System\yobAEQH.exe
  C:\Windows\System\yobAEQH.exe
  2⤵
  PID:10068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DpvsPYo.exe

Filesize
2.3MB

MD5
586d4cc62868d6b0b8d05e86b61a6b68

SHA1
355de5ba5ce110c64d6359332bdf0dd3f99c6abd

SHA256
931b308af80bc8bb6f2a64e13adae9eddfced759d616a1bc987d375a5759004a

SHA512
6cedf50f70177a09ad02bd859257059b021212dd74d2d56e4b57c95f7be76e1a674e41cf1466fa2b5589e10f9ad627bfe8c5587b9811800790722c9a5b7245b0

Download Submit
C:\Windows\system\DxnfBdL.exe

Filesize
2.3MB

MD5
497500d5c8e97863ddb3778b1c26663f

SHA1
a2fd69b606a3812003e2cb14a936904f9218d768

SHA256
11f04dde27314b7b6be08d7f9846f42cf593bc95ba1d529c2d856186ecb9d6e6

SHA512
79bbb7d66a141a9a674f3547cdc11a7203b1d0eda44296e92a2edaefc223b0ffe9cb123abeea2d344fe24efb5f11f70206b24178e7ecdb892ad052990750857b

Download Submit
C:\Windows\system\HRHBnnk.exe

Filesize
2.3MB

MD5
1c6a1ce6ea3d5aed39ed2b78037f857c

SHA1
1daa326b5dec6fd302d29a0931edfeba507a588c

SHA256
e912d7ffdd39bc833d5c0ac791c76da2825f80348e9f00598efa4abad477735c

SHA512
1b0d12518f6057701e84850caacadbb6841924b2b1cf6766e416c48342b3faf133fd88bfdbf969ea455267277767cb01f7cdd38d7377dfe5310b82c6c599bce4

Download Submit
C:\Windows\system\JxPZXkZ.exe

Filesize
2.3MB

MD5
694dfb18473e8b581883496722d38eef

SHA1
223fa87a990aa380b76d0767f29d7c84ff12da79

SHA256
f0b0448c8639bd4ee89cc57995abc8346e828c5db23885a43b0bdc0ddc3b34c1

SHA512
bd479fb5b2a643b30029d9bb4c4ee21787a619227050883d2828b80d2aa3a8c42f47df33152b9efed90dc102965580f0dcea59bbb2775c10553cf274fe2952bb

Download Submit
C:\Windows\system\KSVXwJl.exe

Filesize
2.3MB

MD5
eea24852eefd9410531f839c3105d207

SHA1
8efaa7a1f26603ba42f679252cf74cdaf39501c4

SHA256
24eb84a414ce0c491517b0e7da567547d2cb08c78176640830d41145d5de9f57

SHA512
eb413229ad04b947664a70ee52ce46722fd0395e26c5b41246069f307ab2b24a271b09dac25eaa00fc14dd8c6593ba845ea7c81ea61b2b337e59bb786e90812b

Download Submit
C:\Windows\system\KuYARpn.exe

Filesize
2.3MB

MD5
5c8490085abd7c15e810a4e77ac3fade

SHA1
e64cd831a7e67e27cd99756eac8abc5ec9367f78

SHA256
0fb32f9f25a741fe33ae0aad1f4d7e3e884f80ff8739aaee2c7dfb513a7b0080

SHA512
5095fc87c1dad2913a50295ec4a5c0ad1f8862f20b0786108fc346910758f7e25e4829b19e825325ea62a20860388100c1e39b578f748d4a67abb48282880893

Download Submit
C:\Windows\system\MSRJeGN.exe

Filesize
2.3MB

MD5
26aee58bbad78db0b3b5979e90ccd129

SHA1
ba1bd88fbaa8ed396f0b4c58ddb9d25878502408

SHA256
2d8beb94b002b099f1ae948fb73d9a08dfee48c9ededf4fb68bb228bc3e9fa16

SHA512
360bfbf8c33de2ac361347c9de45e8d7e3a20ffe27dd4d8cbba353a3ac48e0a5b42c0f72605b920b6d76d53a52658ae4e978f4333424352c69e71974ca50c5a7

Download Submit
C:\Windows\system\OyKkGwP.exe

Filesize
2.3MB

MD5
59ac0b05305f2b1eeba759deeb182694

SHA1
84d71f646d4dbcbe5f917a5c492bdf5ed6117991

SHA256
c1d9ec5607e3be5c687700b4f5c846879a7b7d91873c8a01802a67cf7579d6f2

SHA512
2967011f370f5bf1e45b2498e16dc90373f1d47a2c0f426ebbc246e4f5f9d35a9bf4e24581d376cd9329a30052bac2c587d2dc61c63509e7de0f6b25e0c6e2c8

Download Submit
C:\Windows\system\QAuNXDt.exe

Filesize
2.3MB

MD5
1c41669039f33bd7e8b7ad2b695b9b80

SHA1
8921eb82b38989d9e32f942454b80e56b76db036

SHA256
5a11fa9512a986dcef7141506bafd59c039956f9d48081b5437001faa6738782

SHA512
661bb5b6e46747d17ace4487784b27cc728c24e4068bcc5f200cf8de43ab4881a86b923ecb0dd6e1a0697eff921cd2bbde9dc2abafb409e3013c73bdd8cea98d

Download Submit
C:\Windows\system\RKIQUzM.exe

Filesize
2.3MB

MD5
872d5122db611f71a7adfc3225093939

SHA1
7bf8b73937c723923667bd8395c1c875847ce25f

SHA256
4cecb70d0f3a69dcb57e425807a62d7f06f981ddd3fc6025e480de833617dbfe

SHA512
ef4865b4f886df14adb0457934647e058584d35d816c589db7f0af21b0649e2b142e74fad5113e82c689d3b8c89ae7da0cc0a73dc89061850841f4da3853cf3d

Download Submit
C:\Windows\system\WKDJDDR.exe

Filesize
2.3MB

MD5
5da70893c1f341b7d6310d94f853a426

SHA1
2e41972edaceaa83aea747d9e9cae56ca149709e

SHA256
15557f2993a3000d996b1df143ae605e6ec197d7dbd49492d25921f614bd1ab0

SHA512
d63712dde164a1895e4e4a81146b0642b15326842c0ad92fb64eb9da9eff519e633c90b1ead082233dfae9114f2939322a1ec91b6349d2ac64553a2d6cb66632

Download Submit
C:\Windows\system\WPyMGCN.exe

Filesize
2.3MB

MD5
5cd59c498d1beeb673a44f0a5eea5adb

SHA1
8b303b93d48193ebc98e971f46819583b82f9c53

SHA256
8bbbf20b2df077180c8c570971cb97b69665792d9aae777f439a7574b8f85e25

SHA512
dc5861701808c3b800a51f63e5e735df93922946d21835dc1f117732ba330056a97bf8cca56fe1bce9213c7806b6f9e63d10ae852be061021c40970778d8f566

Download Submit
C:\Windows\system\WSLqyTE.exe

Filesize
2.3MB

MD5
7b3693b05922cab41820fb56ceaad32a

SHA1
4d18ce1015bb24ef4b4342987ca98a1aa334dfc8

SHA256
6c71e28a1085fe484dc2ca8675e31cca67042cf0533d603dac4217e5dfff3576

SHA512
31cd41980c7cbdea743bcb7cfb41daf0eb984bd5a9d6030292e6a3259080fc68cf3b72739824c8a14c879537f42e2acbe11dfbc2d1b153499d41dd474a078164

Download Submit
C:\Windows\system\bGQjoDy.exe

Filesize
2.3MB

MD5
a47c389739f10dcc677ed043e1c7fa19

SHA1
85f06a9f4497577ed089418a7c45d2a491990dc0

SHA256
ff912af0f64cdd3f8f1b214c34014cdc10cad492cfb8dd1b0e5c6f8857656caa

SHA512
1d093755ae774832c06e2aeff8ee7fa88e93a8f364cc3429476d3360bbf339ee667cb5a62103e3188fee04dae8d44b16e30f7e530ffb95dfc5fd4afdf9174d44

Download Submit
C:\Windows\system\bHYVEow.exe

Filesize
2.3MB

MD5
a320ed5ff8e14d4ba8ac96f0a971c6c7

SHA1
02b6bbea95365b1eea5951a26b980cc04e80ca86

SHA256
b0f7f58a0a3a19f02094a431f56156b20519ec0d2e8636c5dc06d6aeb6ec2772

SHA512
dcd8aa9cd8e836aa9d56de091196594aa84ae2481c6005e8d280913938c4b4430e2136acaaf45fdbfe9d24ecd3f5a7199460a475e15b9ad4dfca6cf906832227

Download Submit
C:\Windows\system\bJyXjKl.exe

Filesize
2.3MB

MD5
bccc4c293dd54e603ac900599284c3e5

SHA1
ab192eae3c0c9c2723973cbdc9dbbb7939bf5dbb

SHA256
8cb158eccdc3dc0729b9fd549ae2ad8fbf4bda295d28c1a0313aa5683ecf8da9

SHA512
ae5b55b1dbea696d3e8a9d59628db454324da11f8a48076574777b091eb69a008d348de8edc90a7513bdc600e907b21b460f688a5730e10f7e33d32827a872c3

Download Submit
C:\Windows\system\jOSQotm.exe

Filesize
2.3MB

MD5
1ab0a7d5741171d050ea8a23bfeb2962

SHA1
fe7af3e86e18815cd4c1f836e125a19672a0a86a

SHA256
63c4ed1620882dc984154c02ae3a396cba05cbc50a913399fe099c100fecec5c

SHA512
61505bb2d49d259cc0329bc4edf23ec2cc90c36c855c11b3a0ee2f8313db194894054863709f8add8be068688af2dd10f3ed86cb6c6760ee43f72d8062acc335

Download Submit
C:\Windows\system\mHCYaDs.exe

Filesize
2.3MB

MD5
66795c9897bfe03b171867757ed21ee2

SHA1
e8c43c001c3d7b59ce533eeebe046baa44f76daf

SHA256
c9509db8d4c4f7779b9514954fa4e8749374b70b7f15efc0fcfa4b1929320654

SHA512
aa22446e1760759556c6782e69bf39a60cd44bebe3170f09dfb05ab961488eb120aeff6391af9bb508bdd875a51fbe65954ea0723ae740d7d1d531eb636553af

Download Submit
C:\Windows\system\nUoyMmB.exe

Filesize
2.3MB

MD5
79ab0c7d7351b9f4f057596afc0bc6ef

SHA1
c07a49e7e84ce9e2c566a817e6247ee154ade3b4

SHA256
e57b1c7e328aaf03f42de4b7a6f9d653daf16dbe8cfad46b56c557a78e22d539

SHA512
5e8468d83928e2b7547d49540be3e211d8854914ac45918f91d9cc9bce248ae298d73b8280215a07d956f108a2ce642a934b2141e642b60ab3e2c623c839c1e0

Download Submit
C:\Windows\system\pWtVrum.exe

Filesize
2.3MB

MD5
10806bdb526fa1f3b514e7815d1f35e5

SHA1
f1b0a56c38b58a2f42d149b5117b3b817fead2ba

SHA256
f33b3d307411aad952863b200723fc1930780466d0cada3db905472da25dc968

SHA512
ea07cea416406ec768d9abb45591dac2e2892baa0b7842fb6aebde48349a7a493e03c38ed916bd9bd5e90ae570e85e141aac8e2f991411e7ee8595d4a842bbe6

Download Submit
C:\Windows\system\qeTzXHx.exe

Filesize
2.3MB

MD5
1a278c047922114dd9a0e6288c5fe670

SHA1
4f38bb42c4e7a7dbef24678064cd324775466662

SHA256
c59e6de8a0ff0f51020d21a7868788f74014f8ffaaa949ada30956af09b30200

SHA512
bedd91c2ddad308d4d5ecc518786389f7bc4bec5fe3a80be7119fe9f85778b933eaa056027bff05c632103c5e068ee78c3796b848c767ea20cfdde0dd1dc9577

Download Submit
C:\Windows\system\qpcaWCL.exe

Filesize
2.3MB

MD5
28c1e7434752efb86e196e9aea7602eb

SHA1
c75af44a1ad09f592cb66f7a21f6daead50c39f8

SHA256
3be2caef430ce24ae74048d1c9209fb8a6ab203f9d95c56d471644c775b38d2c

SHA512
3d3e3ce199014bc466799dcf5464854b9cde594dbb717c51fdc6439e7ffde351b2d0110b7484dd5dcdb1007b27e76b297274dfa0705a164aba0b070d0a6c657c

Download Submit
C:\Windows\system\qsRoQVO.exe

Filesize
2.3MB

MD5
ac1f1a970bf88af6233bf4af00b7b2ad

SHA1
2a635e06829199631e423e70c1df42535a8de4a8

SHA256
74c2c01bef69d683e31991164f5145ae11924ba3104c9ea89a081b03a51e8884

SHA512
004f24cbb5c9ec4127744182a58f1481d614d833ceffa3debb4e55b677e31fb92bdd51eb5af31bcc48ff88eb86a524eef125877b0f07eb39882429d2df0a2b4b

Download Submit
C:\Windows\system\sIZMpVq.exe

Filesize
2.3MB

MD5
96a0bbe088ecb390bbcf1949ed18d7f6

SHA1
b3168e0acdda8789ccdcaa9823b9840157a02324

SHA256
622bf7c2594e8716295af60c5933c0e2cc65a06662bfa88d7b8f4f544886c796

SHA512
a28730b3118e87f846b7fb469f2380b164121c2e4751fa83148093ebbc761c780f3018b44bdf09386ed72549f4139eb3e5ab19c8654c3f7b392caf903aff4b03

Download Submit
C:\Windows\system\uyaAMqb.exe

Filesize
2.3MB

MD5
cbc135a6b4b27717e5c5ee48a5397ad7

SHA1
69851b43327d402c7c47485516e858d10e30bf6e

SHA256
6cf5bb9f41a13902181cdbb24b6035acbec8f27209e93cc623e600aa0e0c51f4

SHA512
67d803c013f3bb7bb58e0401e98996032b1b8da51f2b3c170e502ddc8cd2021f14a982fc3a912dbcb657340e14cd975a9887c8b22efef80b1768706d5f5f3744

Download Submit
C:\Windows\system\vPCtByU.exe

Filesize
2.3MB

MD5
0bf792bf1f6b6b636117ecb7cf32ae93

SHA1
d87bff51c02edb2a188296210983f5d3b3a41fdb

SHA256
b1f90cf3996357e4a0898f8654f08849ec51b9db318d3020b4ece6d01e5b6a9a

SHA512
07ca863b6cbc6bb5518ba083c51479c0309d29ecf94fca5857f9f6fe67944b074269fba764ab3451c12afc88c8dc6da9e25c4e0a5411a84ac070cae0e61186e7

Download Submit
C:\Windows\system\xNZnJvy.exe

Filesize
2.3MB

MD5
489da65b1273d971b12591e44a67777f

SHA1
4ba2fd4dfaaae63bcc086ad6c0d9f233d38d8e7d

SHA256
9900107fbfffbca119ef7523f52b10b3402f5b0ed0ae1273e5920a91e43a5819

SHA512
da17b711e98a9a9fb356ce0ddced3aba4aa2e4fd2bb778a36850dcd0cd6cfcfe482cec91829d3417ce959c49c2da626b6f113c19bc282a88245a65896f33dd92

Download Submit
C:\Windows\system\yqkrKHq.exe

Filesize
2.3MB

MD5
0127c082ee1f247bd2cd9b5acfa79ee9

SHA1
86bc8f26ac9fbc1038b3a5cb465eecf203b1c51b

SHA256
cbe170057b4684035664cd7782e9937c509c88b2e6deb64f2c56032fe59f66a5

SHA512
9d88f3c73dac1fdb7adcf3a1c6ba6adcbd2ecaf0b189a2b526573bdd86d07697a6fdd292cd7a2028ac4828fd0293395211e4d4961f755b38878c44b59f1d0747

Download Submit
\Windows\system\FbNTQlz.exe

Filesize
2.3MB

MD5
e2e56b3b4d180558349c0e638a8b62ef

SHA1
0608740d67b2d939d4f3d9ef26c394a504986bf9

SHA256
0318c5d3a4af4ac3e13a8f007f4963e434a1774c8cee47358c0763a6cc39e357

SHA512
6eef044f29d0257bbd418a18d12d2d39587f1cf2d5dedbd592da692a9ff9795d015ee8b234f34e357a967b508545738f1d046d9728cd952856fc895492c953e9

Download Submit
\Windows\system\MLlBwNo.exe

Filesize
2.3MB

MD5
fb202688096b426be7aa221117084d96

SHA1
23316ee92e0fdd26ef163a7c92bb5e5794de8242

SHA256
6b2a6806b9083baa170d44fff8f04f3e1c3341cba0cda9d3c1ebc87e95bbe651

SHA512
9f6c8fdd3d93e4d701dcbccca69a6ba1122c631c2164695480333112471486e1f663ea869e8dc9a62228e7023191eba36fedcd194732fdcda7daf239d5494be6

Download Submit
\Windows\system\RGwlaVF.exe

Filesize
2.3MB

MD5
fa922db0aa38cca849af0569db00c6eb

SHA1
3992cf192ac06cd0cb3a1e23cdef2e991cd5a563

SHA256
37ebcc84893581a90de6d64fb24d7048ba26e00e3415a2b5b9842f4e6f695609

SHA512
6cb0a629370725e260e449b2e64d8afcef5e742271f12489be6d332080c9be97802aaeca7eaf37e263a485aada1f7eaea679fda5f1a4a0f6f80c8fed0648e417

Download Submit
\Windows\system\wzIHkVl.exe

Filesize
2.3MB

MD5
f48c44af56053fca7f105b333adbe5fb

SHA1
38f3031df0445afe4b6fee7f9e285410b69318ff

SHA256
62530610f0888c27dfe3fe8cb0fb89a145fe94963830768e2a612141dccabd84

SHA512
49e521f5a3ac18c628bce0238f366a773142f1787c813859e5aa86b3a0c8676b6ea5092781cbe16dfd85af350ab658363d075ff4d823c33d427daae788d67ce8

Download Submit
memory/580-2761-0x000000013F140000-0x000000013F494000-memory.dmp

Filesize
3.3MB

Download
memory/580-88-0x000000013F140000-0x000000013F494000-memory.dmp

Filesize
3.3MB

Download
memory/1076-94-0x000000013F830000-0x000000013FB84000-memory.dmp

Filesize
3.3MB

Download
memory/1076-3989-0x000000013F830000-0x000000013FB84000-memory.dmp

Filesize
3.3MB

Download
memory/2068-3985-0x000000013F260000-0x000000013F5B4000-memory.dmp

Filesize
3.3MB

Download
memory/2068-91-0x000000013F260000-0x000000013F5B4000-memory.dmp

Filesize
3.3MB

Download
memory/2216-90-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download
memory/2216-1527-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2216-58-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2216-74-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/2216-83-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2216-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2216-89-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2216-2-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download
memory/2216-92-0x000000013F140000-0x000000013F494000-memory.dmp

Filesize
3.3MB

Download
memory/2216-93-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2216-8-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/2216-86-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2216-2158-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2216-40-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2216-49-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2216-180-0x000000013F4C0000-0x000000013F814000-memory.dmp

Filesize
3.3MB

Download
memory/2216-15-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2216-22-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2216-34-0x000000013F0F0000-0x000000013F444000-memory.dmp

Filesize
3.3MB

Download
memory/2216-1249-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2312-9-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/2312-2756-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/2396-3992-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2396-95-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2424-41-0x000000013F6C0000-0x000000013FA14000-memory.dmp

Filesize
3.3MB

Download
memory/2424-2762-0x000000013F6C0000-0x000000013FA14000-memory.dmp

Filesize
3.3MB

Download
memory/2424-1271-0x000000013F6C0000-0x000000013FA14000-memory.dmp

Filesize
3.3MB

Download
memory/2444-3991-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/2444-62-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/2444-1528-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/2504-35-0x000000013F0F0000-0x000000013F444000-memory.dmp

Filesize
3.3MB

Download
memory/2504-2759-0x000000013F0F0000-0x000000013F444000-memory.dmp

Filesize
3.3MB

Download
memory/2568-50-0x000000013F830000-0x000000013FB84000-memory.dmp

Filesize
3.3MB

Download
memory/2568-2760-0x000000013F830000-0x000000013FB84000-memory.dmp

Filesize
3.3MB

Download
memory/2612-26-0x000000013F600000-0x000000013F954000-memory.dmp

Filesize
3.3MB

Download
memory/2612-2758-0x000000013F600000-0x000000013F954000-memory.dmp

Filesize
3.3MB

Download
memory/2616-2766-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/2616-36-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/2876-3670-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-159-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/3040-2763-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/3040-16-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download